From 2cbae96c9aa38cfc60dfe553ec45fa7fa9673ff7 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 17 Jul 2024 23:19:32 +0800 Subject: [PATCH 01/77] feat: added project data key --- .../20240717114407_add-project-data-key.ts | 29 ++++ backend/src/db/schemas/projects.ts | 5 +- backend/src/keystore/keystore.ts | 6 +- backend/src/services/kms/kms-service.ts | 132 +++++++++++++++--- 4 files changed, 147 insertions(+), 25 deletions(-) create mode 100644 backend/src/db/migrations/20240717114407_add-project-data-key.ts diff --git a/backend/src/db/migrations/20240717114407_add-project-data-key.ts b/backend/src/db/migrations/20240717114407_add-project-data-key.ts new file mode 100644 index 000000000..e8ef083a3 --- /dev/null +++ b/backend/src/db/migrations/20240717114407_add-project-data-key.ts @@ -0,0 +1,29 @@ +import { Knex } from "knex"; + +import { TableName } from "../schemas"; + +export async function up(knex: Knex): Promise { + const hasKmsSecretManagerEncryptedDataKey = await knex.schema.hasColumn( + TableName.Project, + "kmsSecretManagerEncryptedDataKey" + ); + + await knex.schema.alterTable(TableName.Project, (tb) => { + if (!hasKmsSecretManagerEncryptedDataKey) { + tb.binary("kmsSecretManagerEncryptedDataKey"); + } + }); +} + +export async function down(knex: Knex): Promise { + const hasKmsSecretManagerEncryptedDataKey = await knex.schema.hasColumn( + TableName.Project, + "kmsSecretManagerEncryptedDataKey" + ); + + await knex.schema.alterTable(TableName.Project, (t) => { + if (hasKmsSecretManagerEncryptedDataKey) { + t.dropColumn("kmsSecretManagerEncryptedDataKey"); + } + }); +} diff --git a/backend/src/db/schemas/projects.ts b/backend/src/db/schemas/projects.ts index 19597c9df..deba51b9a 100644 --- a/backend/src/db/schemas/projects.ts +++ b/backend/src/db/schemas/projects.ts @@ -5,6 +5,8 @@ import { z } from "zod"; +import { zodBuffer } from "@app/lib/zod"; + import { TImmutableDBKeys } from "./models"; export const ProjectsSchema = z.object({ @@ -20,7 +22,8 @@ export const ProjectsSchema = z.object({ pitVersionLimit: z.number().default(10), kmsCertificateKeyId: z.string().uuid().nullable().optional(), auditLogsRetentionDays: z.number().nullable().optional(), - kmsSecretManagerKeyId: z.string().uuid().nullable().optional() + kmsSecretManagerKeyId: z.string().uuid().nullable().optional(), + kmsSecretManagerEncryptedDataKey: zodBuffer.nullable().optional() }); export type TProjects = z.infer; diff --git a/backend/src/keystore/keystore.ts b/backend/src/keystore/keystore.ts index ce752a1e5..90f79bb36 100644 --- a/backend/src/keystore/keystore.ts +++ b/backend/src/keystore/keystore.ts @@ -6,7 +6,11 @@ export type TKeyStoreFactory = ReturnType; // all the key prefixes used must be set here to avoid conflict export enum KeyStorePrefixes { - SecretReplication = "secret-replication-import-lock" + SecretReplication = "secret-replication-import-lock", + KmsProjectDataKeyCreation = "kms-project-data-key-creation-lock", + KmsProjectKeyCreation = "kms-project-key-creation-lock", + WaitUntilReadyKmsProjectDataKeyCreation = "wait-until-ready-kms-project-data-key-creation-", + WaitUntilReadyKmsProjectKeyCreation = "wait-until-ready-kms-project-key-creation-" } type TWaitTillReady = { diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index dbc86b860..bc22f04ab 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -1,7 +1,7 @@ import slugify from "@sindresorhus/slugify"; import { Knex } from "knex"; -import { TKeyStoreFactory } from "@app/keystore/keystore"; +import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore"; import { getConfig } from "@app/lib/config/env"; import { randomSecureBytes } from "@app/lib/crypto"; import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher"; @@ -167,35 +167,120 @@ export const kmsServiceFactory = ({ }; const getProjectSecretManagerKmsKeyId = async (projectId: string) => { - const keyId = await projectDAL.transaction(async (tx) => { - const project = await projectDAL.findById(projectId, tx); - if (!project) { - throw new BadRequestError({ message: "Project not found" }); + let project = await projectDAL.findById(projectId); + if (!project) { + throw new BadRequestError({ message: "Project not found" }); + } + + if (!project.kmsSecretManagerKeyId) { + // create default kms key for certificate service + const lock = await keyStore + .acquireLock([KeyStorePrefixes.KmsProjectKeyCreation, projectId], 3000, { retryCount: 3 }) + .catch(() => null); + + try { + if (!lock) { + await keyStore.waitTillReady({ + key: `${KeyStorePrefixes.WaitUntilReadyKmsProjectKeyCreation}${projectId}`, + keyCheckCb: (val) => val === "true", + waitingCb: () => logger.info("KMS. Waiting for project key to be created") + }); + + project = await projectDAL.findById(projectId); + } else { + const kmsKeyId = await projectDAL.transaction(async (tx) => { + const key = await generateKmsKey({ + isReserved: true, + orgId: project.orgId, + tx + }); + + await projectDAL.updateById( + projectId, + { + kmsSecretManagerKeyId: key.id + }, + tx + ); + + return key.id; + }); + + await keyStore.setItemWithExpiry( + `${KeyStorePrefixes.WaitUntilReadyKmsProjectKeyCreation}${projectId}`, + 10, + "true" + ); + + return kmsKeyId; + } + } finally { + await lock?.release(); } + } - if (!project.kmsSecretManagerKeyId) { - // create default kms key for certificate service - const key = await generateKmsKey({ - isReserved: true, - orgId: project.orgId, - tx - }); + if (!project.kmsSecretManagerKeyId) { + throw new Error("Missing project KMS key ID"); + } - await projectDAL.updateById( - projectId, - { - kmsSecretManagerKeyId: key.id - }, - tx - ); + return project.kmsSecretManagerKeyId; + }; - return key.id; + const getProjectSecretManagerKmsDataKey = async (projectId: string) => { + const kmsKeyId = await getProjectSecretManagerKmsKeyId(projectId); + let project = await projectDAL.findById(projectId); + + if (!project.kmsSecretManagerEncryptedDataKey) { + const lock = await keyStore + .acquireLock([KeyStorePrefixes.KmsProjectDataKeyCreation, projectId], 3000, { retryCount: 3 }) + .catch(() => null); + + try { + if (!lock) { + await keyStore.waitTillReady({ + key: `${KeyStorePrefixes.WaitUntilReadyKmsProjectDataKeyCreation}${projectId}`, + keyCheckCb: (val) => val === "true", + waitingCb: () => logger.info("KMS. Waiting for project data key to be created") + }); + + project = await projectDAL.findById(projectId); + } else { + const dataKey = randomSecureBytes(); + const kmsEncryptor = await encryptWithKmsKey({ + kmsId: kmsKeyId + }); + + const { cipherTextBlob } = kmsEncryptor({ + plainText: dataKey + }); + + await projectDAL.updateById(projectId, { + kmsSecretManagerEncryptedDataKey: cipherTextBlob + }); + + await keyStore.setItemWithExpiry( + `${KeyStorePrefixes.WaitUntilReadyKmsProjectDataKeyCreation}${projectId}`, + 10, + "true" + ); + return dataKey; + } + } finally { + await lock?.release(); } + } - return project.kmsSecretManagerKeyId; + if (!project.kmsSecretManagerEncryptedDataKey) { + throw new Error("Missing project data key"); + } + + const kmsDecryptor = await decryptWithKmsKey({ + kmsId: kmsKeyId }); - return keyId; + return kmsDecryptor({ + cipherTextBlob: project.kmsSecretManagerEncryptedDataKey + }); }; const startService = async () => { @@ -251,6 +336,7 @@ export const kmsServiceFactory = ({ decryptWithKmsKey, decryptWithInputKey, getOrgKmsKeyId, - getProjectSecretManagerKmsKeyId + getProjectSecretManagerKmsKeyId, + getProjectSecretManagerKmsDataKey }; }; From 547be80dcfdbcf775798f4bc3bda3135837fc971 Mon Sep 17 00:00:00 2001 From: = Date: Mon, 15 Jul 2024 23:13:03 +0530 Subject: [PATCH 02/77] feat: made raw secret endpoints and normal e2ee ones to be same functionality --- backend/src/lib/api-docs/constants.ts | 9 +- backend/src/server/routes/index.ts | 1 + backend/src/server/routes/sanitizedSchemas.ts | 8 +- .../server/routes/v1/secret-import-router.ts | 46 +++++ backend/src/server/routes/v3/secret-router.ts | 71 ++++++-- .../secret-import/secret-import-service.ts | 55 +++++- backend/src/services/secret/secret-fns.ts | 7 +- backend/src/services/secret/secret-service.ts | 160 ++++++++++++------ backend/src/services/secret/secret-types.ts | 27 ++- 9 files changed, 314 insertions(+), 70 deletions(-) diff --git a/backend/src/lib/api-docs/constants.ts b/backend/src/lib/api-docs/constants.ts index 5e5e330e1..e151ffb85 100644 --- a/backend/src/lib/api-docs/constants.ts +++ b/backend/src/lib/api-docs/constants.ts @@ -608,7 +608,9 @@ export const RAW_SECRETS = { skipMultilineEncoding: "Skip multiline encoding for the secret value.", type: "The type of the secret to create.", workspaceId: "The ID of the project to create the secret in.", - tagIds: "The ID of the tags to be attached to the created secret." + tagIds: "The ID of the tags to be attached to the created secret.", + secretReminderRepeatDays: "Interval for secret rotation notifications, measured in days", + secretReminderNote: "Note to be attached in notification email" }, GET: { expand: "Whether or not to expand secret references", @@ -631,7 +633,10 @@ export const RAW_SECRETS = { type: "The type of the secret to update.", projectSlug: "The slug of the project to update the secret in.", workspaceId: "The ID of the project to update the secret in.", - tagIds: "The ID of the tags to be attached to the updated secret." + tagIds: "The ID of the tags to be attached to the updated secret.", + secretReminderRepeatDays: "Interval for secret rotation notifications, measured in days", + secretReminderNote: "Note to be attached in notification email", + newSecretName: "The new name for the secret" }, DELETE: { secretName: "The name of the secret to delete.", diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 59aa8d301..c249580bd 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -703,6 +703,7 @@ export const registerRoutes = async ( }); const secretImportService = secretImportServiceFactory({ licenseService, + projectBotService, projectEnvDAL, folderDAL, permissionService, diff --git a/backend/src/server/routes/sanitizedSchemas.ts b/backend/src/server/routes/sanitizedSchemas.ts index 5b0b754f3..f84cea4b8 100644 --- a/backend/src/server/routes/sanitizedSchemas.ts +++ b/backend/src/server/routes/sanitizedSchemas.ts @@ -63,7 +63,13 @@ export const secretRawSchema = z.object({ type: z.string(), secretKey: z.string(), secretValue: z.string(), - secretComment: z.string().optional() + secretComment: z.string().optional(), + secretReminderNote: z.string().nullable().optional(), + secretReminderRepeatDays: z.number().nullable().optional(), + skipMultilineEncoding: z.boolean().default(false).nullable().optional(), + metadata: z.unknown().nullable().optional(), + createdAt: z.date(), + updatedAt: z.date() }); export const ProjectPermissionSchema = z.object({ diff --git a/backend/src/server/routes/v1/secret-import-router.ts b/backend/src/server/routes/v1/secret-import-router.ts index ca604e738..ec48803f6 100644 --- a/backend/src/server/routes/v1/secret-import-router.ts +++ b/backend/src/server/routes/v1/secret-import-router.ts @@ -8,6 +8,8 @@ import { readLimit, secretsLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; +import { secretRawSchema } from "../sanitizedSchemas"; + export const registerSecretImportRouter = async (server: FastifyZodProvider) => { server.route({ method: "POST", @@ -353,4 +355,48 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) => return { secrets: importedSecrets }; } }); + + server.route({ + url: "/secrets/raw", + method: "GET", + config: { + rateLimit: secretsLimit + }, + schema: { + querystring: z.object({ + workspaceId: z.string().trim(), + environment: z.string().trim(), + path: z.string().trim().default("/").transform(removeTrailingSlash) + }), + response: { + 200: z.object({ + secrets: z + .object({ + secretPath: z.string(), + environment: z.string(), + environmentInfo: z.object({ + id: z.string(), + name: z.string(), + slug: z.string() + }), + folderId: z.string().optional(), + secrets: secretRawSchema.array() + }) + .array() + }) + } + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), + handler: async (req) => { + const importedSecrets = await server.services.secretImport.getRawSecretsFromImports({ + actorId: req.permission.id, + actor: req.permission.type, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId, + ...req.query, + projectId: req.query.workspaceId + }); + return { secrets: importedSecrets }; + } + }); }; diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index 2a4f9b464..d19e89547 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -186,7 +186,15 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { 200: z.object({ secrets: secretRawSchema .extend({ - secretPath: z.string().optional() + secretPath: z.string().optional(), + tags: SecretTagsSchema.pick({ + id: true, + slug: true, + name: true, + color: true + }) + .array() + .optional() }) .array(), imports: z @@ -194,7 +202,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath: z.string(), environment: z.string(), folderId: z.string().optional(), - secrets: secretRawSchema.array() + secrets: secretRawSchema.omit({ createdAt: true, updatedAt: true }).array() }) .array() .optional() @@ -425,7 +433,13 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretComment: z.string().trim().optional().default("").describe(RAW_SECRETS.CREATE.secretComment), tagIds: z.string().array().optional().describe(RAW_SECRETS.CREATE.tagIds), skipMultilineEncoding: z.boolean().optional().describe(RAW_SECRETS.CREATE.skipMultilineEncoding), - type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.CREATE.type) + type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.CREATE.type), + secretReminderRepeatDays: z + .number() + .optional() + .nullable() + .describe(RAW_SECRETS.CREATE.secretReminderRepeatDays), + secretReminderNote: z.string().optional().nullable().describe(RAW_SECRETS.CREATE.secretReminderNote) }), response: { 200: z.object({ @@ -448,7 +462,9 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretValue: req.body.secretValue, skipMultilineEncoding: req.body.skipMultilineEncoding, secretComment: req.body.secretComment, - tagIds: req.body.tagIds + tagIds: req.body.tagIds, + secretReminderNote: req.body.secretReminderNote, + secretReminderRepeatDays: req.body.secretReminderRepeatDays }); await server.services.auditLog.createAuditLog({ @@ -514,7 +530,16 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .describe(RAW_SECRETS.UPDATE.secretPath), skipMultilineEncoding: z.boolean().optional().describe(RAW_SECRETS.UPDATE.skipMultilineEncoding), type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.UPDATE.type), - tagIds: z.string().array().optional().describe(RAW_SECRETS.UPDATE.tagIds) + tagIds: z.string().array().optional().describe(RAW_SECRETS.UPDATE.tagIds), + metadata: z.record(z.string()).optional(), + secretReminderNote: z.string().optional().nullable().describe(RAW_SECRETS.UPDATE.secretReminderNote), + secretReminderRepeatDays: z + .number() + .optional() + .nullable() + .describe(RAW_SECRETS.UPDATE.secretReminderRepeatDays), + newSecretName: z.string().min(1).optional().describe(RAW_SECRETS.UPDATE.newSecretName), + secretComment: z.string().optional().describe(RAW_SECRETS.UPDATE.secretComment) }), response: { 200: z.object({ @@ -536,7 +561,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { type: req.body.type, secretValue: req.body.secretValue, skipMultilineEncoding: req.body.skipMultilineEncoding, - tagIds: req.body.tagIds + tagIds: req.body.tagIds, + secretReminderRepeatDays: req.body.secretReminderRepeatDays, + secretReminderNote: req.body.secretReminderNote, + metadata: req.body.metadata, + newSecretName: req.body.newSecretName, + secretComment: req.body.secretComment }); await server.services.auditLog.createAuditLog({ @@ -1760,7 +1790,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { } ], body: z.object({ - projectSlug: z.string().trim().describe(RAW_SECRETS.CREATE.projectSlug), + projectSlug: z.string().trim().optional().describe(RAW_SECRETS.UPDATE.projectSlug), + workspaceId: z.string().trim().optional().describe(RAW_SECRETS.UPDATE.workspaceId), environment: z.string().trim().describe(RAW_SECRETS.CREATE.environment), secretPath: z .string() @@ -1776,7 +1807,9 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim())) .describe(RAW_SECRETS.CREATE.secretValue), secretComment: z.string().trim().optional().default("").describe(RAW_SECRETS.CREATE.secretComment), - skipMultilineEncoding: z.boolean().optional().describe(RAW_SECRETS.CREATE.skipMultilineEncoding) + skipMultilineEncoding: z.boolean().optional().describe(RAW_SECRETS.CREATE.skipMultilineEncoding), + metadata: z.record(z.string()).optional(), + tagIds: z.string().array().optional().describe(RAW_SECRETS.CREATE.tagIds) }) .array() .min(1) @@ -1799,6 +1832,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath, environment, projectSlug, + projectId: req.body.workspaceId, secrets: inputSecrets }); @@ -1849,7 +1883,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { } ], body: z.object({ - projectSlug: z.string().trim().describe(RAW_SECRETS.UPDATE.projectSlug), + projectSlug: z.string().trim().optional().describe(RAW_SECRETS.DELETE.projectSlug), + workspaceId: z.string().trim().optional().describe(RAW_SECRETS.DELETE.workspaceId), environment: z.string().trim().describe(RAW_SECRETS.UPDATE.environment), secretPath: z .string() @@ -1865,7 +1900,15 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim())) .describe(RAW_SECRETS.UPDATE.secretValue), secretComment: z.string().trim().optional().describe(RAW_SECRETS.UPDATE.secretComment), - skipMultilineEncoding: z.boolean().optional().describe(RAW_SECRETS.UPDATE.skipMultilineEncoding) + skipMultilineEncoding: z.boolean().optional().describe(RAW_SECRETS.UPDATE.skipMultilineEncoding), + newSecretName: z.string().min(1).optional().describe(RAW_SECRETS.UPDATE.newSecretName), + tagIds: z.string().array().optional().describe(RAW_SECRETS.UPDATE.tagIds), + secretReminderNote: z.string().optional().nullable().describe(RAW_SECRETS.UPDATE.secretReminderNote), + secretReminderRepeatDays: z + .number() + .optional() + .nullable() + .describe(RAW_SECRETS.UPDATE.secretReminderRepeatDays) }) .array() .min(1) @@ -1887,6 +1930,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretPath, environment, projectSlug, + projectId: req.body.workspaceId, secrets: inputSecrets }); @@ -1937,7 +1981,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { } ], body: z.object({ - projectSlug: z.string().trim().describe(RAW_SECRETS.DELETE.projectSlug), + projectSlug: z.string().trim().optional().describe(RAW_SECRETS.DELETE.projectSlug), + workspaceId: z.string().trim().optional().describe(RAW_SECRETS.DELETE.workspaceId), environment: z.string().trim().describe(RAW_SECRETS.DELETE.environment), secretPath: z .string() @@ -1947,7 +1992,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .describe(RAW_SECRETS.DELETE.secretPath), secrets: z .object({ - secretKey: z.string().trim().describe(RAW_SECRETS.DELETE.secretName) + secretKey: z.string().trim().describe(RAW_SECRETS.DELETE.secretName), + type: z.nativeEnum(SecretType).default(SecretType.Shared) }) .array() .min(1) @@ -1969,6 +2015,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { environment, projectSlug, secretPath, + projectId: req.body.workspaceId, secrets: inputSecrets }); diff --git a/backend/src/services/secret-import/secret-import-service.ts b/backend/src/services/secret-import/secret-import-service.ts index 237c7cfe4..c20c2345e 100644 --- a/backend/src/services/secret-import/secret-import-service.ts +++ b/backend/src/services/secret-import/secret-import-service.ts @@ -10,8 +10,10 @@ import { getReplicationFolderName } from "@app/ee/services/secret-replication/se import { BadRequestError } from "@app/lib/errors"; import { TProjectDALFactory } from "../project/project-dal"; +import { TProjectBotServiceFactory } from "../project-bot/project-bot-service"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TSecretDALFactory } from "../secret/secret-dal"; +import { decryptSecretRaw } from "../secret/secret-fns"; import { TSecretQueueFactory } from "../secret/secret-queue"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TSecretImportDALFactory } from "./secret-import-dal"; @@ -29,6 +31,7 @@ type TSecretImportServiceFactoryDep = { secretImportDAL: TSecretImportDALFactory; folderDAL: TSecretFolderDALFactory; secretDAL: Pick; + projectBotService: Pick; projectDAL: Pick; projectEnvDAL: TProjectEnvDALFactory; permissionService: Pick; @@ -48,7 +51,8 @@ export const secretImportServiceFactory = ({ projectDAL, secretDAL, secretQueueService, - licenseService + licenseService, + projectBotService }: TSecretImportServiceFactoryDep) => { const createImport = async ({ environment, @@ -449,12 +453,61 @@ export const secretImportServiceFactory = ({ return fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL }); }; + const getRawSecretsFromImports = async ({ + path: secretPath, + environment, + projectId, + actor, + actorAuthMethod, + actorId, + actorOrgId + }: TGetSecretsFromImportDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Read, + subject(ProjectPermissionSub.Secrets, { environment, secretPath }) + ); + const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); + if (!folder) return []; + // this will already order by position + // so anything based on this order will also be in right position + const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false }); + + const allowedImports = secretImports.filter(({ importEnv, importPath }) => + permission.can( + ProjectPermissionActions.Read, + subject(ProjectPermissionSub.Secrets, { + environment: importEnv.slug, + secretPath: importPath + }) + ) + ); + + const botKey = await projectBotService.getBotKey(projectId); + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); + + const importedSecrets = await fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL }); + return importedSecrets.map((el) => ({ + ...el, + secrets: el.secrets.map((encryptedSecret) => + decryptSecretRaw({ ...encryptedSecret, workspace: projectId, environment, secretPath }, botKey) + ) + })); + }; + return { createImport, updateImport, deleteImport, getImports, getSecretsFromImports, + getRawSecretsFromImports, resyncSecretImportReplication, fnSecretsFromImports }; diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index aa112e6b0..419a41b10 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -407,7 +407,12 @@ export const decryptSecretRaw = ( id: secret.id, user: secret.userId, tags: secret.tags, - skipMultilineEncoding: secret.skipMultilineEncoding + skipMultilineEncoding: secret.skipMultilineEncoding, + secretReminderRepeatDays: secret.secretReminderRepeatDays, + secretReminderNote: secret.secretReminderNote, + metadata: secret.metadata, + createdAt: secret.createdAt, + updatedAt: secret.updatedAt }; }; diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index efe5af03e..39b9ea332 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -1176,7 +1176,9 @@ export const secretServiceFactory = ({ secretValue, secretComment, skipMultilineEncoding, - tagIds + tagIds, + secretReminderNote, + secretReminderRepeatDays }: TCreateSecretRawDTO) => { const botKey = await projectBotService.getBotKey(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1205,6 +1207,8 @@ export const secretServiceFactory = ({ secretCommentIV: secretCommentEncrypted.iv, secretCommentTag: secretCommentEncrypted.tag, skipMultilineEncoding, + secretReminderRepeatDays, + secretReminderNote, tags: tagIds }); @@ -1223,12 +1227,19 @@ export const secretServiceFactory = ({ secretPath, secretValue, skipMultilineEncoding, - tagIds + tagIds, + secretReminderNote, + secretReminderRepeatDays, + metadata, + secretComment, + newSecretName }: TUpdateSecretRawDTO) => { const botKey = await projectBotService.getBotKey(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); + const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); + const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretName, botKey); const secret = await updateSecret({ secretName, @@ -1244,7 +1255,17 @@ export const secretServiceFactory = ({ secretValueIV: secretValueEncrypted.iv, secretValueTag: secretValueEncrypted.tag, skipMultilineEncoding, - tags: tagIds + tags: tagIds, + metadata, + secretReminderRepeatDays, + secretReminderNote, + newSecretName, + secretKeyIV: secretKeyEncrypted.iv, + secretKeyTag: secretKeyEncrypted.tag, + secretKeyCiphertext: secretKeyEncrypted.ciphertext, + secretCommentIV: secretCommentEncrypted.iv, + secretCommentTag: secretCommentEncrypted.tag, + secretCommentCiphertext: secretCommentEncrypted.ciphertext }); await snapshotService.performSnapshot(secret.folderId); @@ -1283,6 +1304,7 @@ export const secretServiceFactory = ({ const createManySecretsRaw = async ({ actorId, projectSlug, + projectId: optionalProjectId, environment, actor, actorOrgId, @@ -1290,9 +1312,16 @@ export const secretServiceFactory = ({ secretPath, secrets: inputSecrets = [] }: TCreateManySecretRawDTO) => { - const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new BadRequestError({ message: "Project not found" }); - const projectId = project.id; + if (!projectSlug && !optionalProjectId) + throw new BadRequestError({ message: "Must provide either project slug or projectId" }); + + let projectId = optionalProjectId as string; + // pick either project slug or projectid + if (!optionalProjectId && projectSlug) { + const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); + if (!project) throw new BadRequestError({ message: "Project not found" }); + projectId = project.id; + } const botKey = await projectBotService.getBotKey(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1305,24 +1334,28 @@ export const secretServiceFactory = ({ actorId, actorOrgId, actorAuthMethod, - secrets: inputSecrets.map(({ secretComment, secretKey, secretValue, skipMultilineEncoding }) => { - const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretKey, botKey); - const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); - const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); - return { - secretName: secretKey, - skipMultilineEncoding, - secretKeyCiphertext: secretKeyEncrypted.ciphertext, - secretKeyIV: secretKeyEncrypted.iv, - secretKeyTag: secretKeyEncrypted.tag, - secretValueCiphertext: secretValueEncrypted.ciphertext, - secretValueIV: secretValueEncrypted.iv, - secretValueTag: secretValueEncrypted.tag, - secretCommentCiphertext: secretCommentEncrypted.ciphertext, - secretCommentIV: secretCommentEncrypted.iv, - secretCommentTag: secretCommentEncrypted.tag - }; - }) + secrets: inputSecrets.map( + ({ secretComment, secretKey, metadata, tagIds, secretValue, skipMultilineEncoding }) => { + const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretKey, botKey); + const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); + const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); + return { + secretName: secretKey, + skipMultilineEncoding, + secretKeyCiphertext: secretKeyEncrypted.ciphertext, + secretKeyIV: secretKeyEncrypted.iv, + secretKeyTag: secretKeyEncrypted.tag, + secretValueCiphertext: secretValueEncrypted.ciphertext, + secretValueIV: secretValueEncrypted.iv, + secretValueTag: secretValueEncrypted.tag, + secretCommentCiphertext: secretCommentEncrypted.ciphertext, + secretCommentIV: secretCommentEncrypted.iv, + secretCommentTag: secretCommentEncrypted.tag, + tags: tagIds, + metadata + }; + } + ) }); return secrets.map((secret) => @@ -1333,6 +1366,7 @@ export const secretServiceFactory = ({ const updateManySecretsRaw = async ({ actorId, projectSlug, + projectId: optionalProjectId, environment, actor, actorOrgId, @@ -1340,9 +1374,15 @@ export const secretServiceFactory = ({ secretPath, secrets: inputSecrets = [] }: TUpdateManySecretRawDTO) => { - const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new BadRequestError({ message: "Project not found" }); - const projectId = project.id; + if (!projectSlug && !optionalProjectId) + throw new BadRequestError({ message: "Must provide either project slug or projectId" }); + + let projectId = optionalProjectId as string; + if (!optionalProjectId && projectSlug) { + const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); + if (!project) throw new BadRequestError({ message: "Project not found" }); + projectId = project.id; + } const botKey = await projectBotService.getBotKey(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1355,25 +1395,40 @@ export const secretServiceFactory = ({ actorId, actorOrgId, actorAuthMethod, - secrets: inputSecrets.map(({ secretComment, secretKey, secretValue, skipMultilineEncoding }) => { - const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretKey, botKey); - const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); - const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); - return { - secretName: secretKey, - type: SecretType.Shared, + secrets: inputSecrets.map( + ({ + secretComment, + secretKey, + secretValue, skipMultilineEncoding, - secretKeyCiphertext: secretKeyEncrypted.ciphertext, - secretKeyIV: secretKeyEncrypted.iv, - secretKeyTag: secretKeyEncrypted.tag, - secretValueCiphertext: secretValueEncrypted.ciphertext, - secretValueIV: secretValueEncrypted.iv, - secretValueTag: secretValueEncrypted.tag, - secretCommentCiphertext: secretCommentEncrypted.ciphertext, - secretCommentIV: secretCommentEncrypted.iv, - secretCommentTag: secretCommentEncrypted.tag - }; - }) + tagIds: tags, + newSecretName, + secretReminderNote, + secretReminderRepeatDays + }) => { + const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretKey, botKey); + const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); + const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); + return { + secretName: secretKey, + newSecretName, + tags, + secretReminderRepeatDays, + secretReminderNote, + type: SecretType.Shared, + skipMultilineEncoding, + secretKeyCiphertext: secretKeyEncrypted.ciphertext, + secretKeyIV: secretKeyEncrypted.iv, + secretKeyTag: secretKeyEncrypted.tag, + secretValueCiphertext: secretValueEncrypted.ciphertext, + secretValueIV: secretValueEncrypted.iv, + secretValueTag: secretValueEncrypted.tag, + secretCommentCiphertext: secretCommentEncrypted.ciphertext, + secretCommentIV: secretCommentEncrypted.iv, + secretCommentTag: secretCommentEncrypted.tag + }; + } + ) }); return secrets.map((secret) => @@ -1384,6 +1439,7 @@ export const secretServiceFactory = ({ const deleteManySecretsRaw = async ({ actorId, projectSlug, + projectId: optionalProjectId, environment, actor, actorOrgId, @@ -1391,9 +1447,15 @@ export const secretServiceFactory = ({ secretPath, secrets: inputSecrets = [] }: TDeleteManySecretRawDTO) => { - const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - if (!project) throw new BadRequestError({ message: "Project not found" }); - const projectId = project.id; + if (!projectSlug && !optionalProjectId) + throw new BadRequestError({ message: "Must provide either project slug or projectId" }); + + let projectId = optionalProjectId as string; + if (!optionalProjectId && projectSlug) { + const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); + if (!project) throw new BadRequestError({ message: "Project not found" }); + projectId = project.id; + } const botKey = await projectBotService.getBotKey(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1406,7 +1468,7 @@ export const secretServiceFactory = ({ actorId, actorOrgId, actorAuthMethod, - secrets: inputSecrets.map(({ secretKey }) => ({ secretName: secretKey, type: SecretType.Shared })) + secrets: inputSecrets.map(({ secretKey, type = SecretType.Shared }) => ({ secretName: secretKey, type })) }); return secrets.map((secret) => diff --git a/backend/src/services/secret/secret-types.ts b/backend/src/services/secret/secret-types.ts index d806eab11..16bcf6172 100644 --- a/backend/src/services/secret/secret-types.ts +++ b/backend/src/services/secret/secret-types.ts @@ -160,14 +160,16 @@ export type TGetASecretRawDTO = { } & Omit; export type TCreateSecretRawDTO = TProjectPermission & { + secretName: string; secretPath: string; environment: string; - secretName: string; secretValue: string; type: SecretType; tagIds?: string[]; secretComment?: string; skipMultilineEncoding?: boolean; + secretReminderRepeatDays?: number | null; + secretReminderNote?: string | null; }; export type TUpdateSecretRawDTO = TProjectPermission & { @@ -175,11 +177,16 @@ export type TUpdateSecretRawDTO = TProjectPermission & { environment: string; secretName: string; secretValue?: string; + newSecretName?: string; + secretComment?: string; type: SecretType; tagIds?: string[]; skipMultilineEncoding?: boolean; secretReminderRepeatDays?: number | null; secretReminderNote?: string | null; + metadata?: { + source?: string; + }; }; export type TDeleteSecretRawDTO = TProjectPermission & { @@ -191,34 +198,46 @@ export type TDeleteSecretRawDTO = TProjectPermission & { export type TCreateManySecretRawDTO = Omit & { secretPath: string; - projectSlug: string; + projectId?: string; + projectSlug?: string; environment: string; secrets: { secretKey: string; secretValue: string; secretComment?: string; skipMultilineEncoding?: boolean; + tagIds?: string[]; + metadata?: { + source?: string; + }; }[]; }; export type TUpdateManySecretRawDTO = Omit & { secretPath: string; - projectSlug: string; + projectId?: string; + projectSlug?: string; environment: string; secrets: { secretKey: string; + newSecretName?: string; secretValue: string; secretComment?: string; skipMultilineEncoding?: boolean; + tagIds?: string[]; + secretReminderRepeatDays?: number | null; + secretReminderNote?: string | null; }[]; }; export type TDeleteManySecretRawDTO = Omit & { secretPath: string; - projectSlug: string; + projectId?: string; + projectSlug?: string; environment: string; secrets: { secretKey: string; + type?: SecretType; }[]; }; From 4caa77e28a49c2a74bcdad3cee193bf6d1beea7f Mon Sep 17 00:00:00 2001 From: = Date: Mon, 15 Jul 2024 23:15:37 +0530 Subject: [PATCH 03/77] refactor(ui): migrated secret endpoints of e2ee to raw --- .../utilities/secrets/encryptSecrets.ts | 97 +-------- .../InfisicalSecretInput.tsx | 14 +- frontend/src/helpers/project.ts | 110 ++-------- frontend/src/helpers/secret.ts | 175 --------------- .../api/secretApprovalRequest/queries.tsx | 78 ++++++- .../src/hooks/api/secretImports/queries.tsx | 166 ++++---------- frontend/src/hooks/api/secretImports/types.ts | 7 +- .../src/hooks/api/secretSnapshots/queries.tsx | 4 +- frontend/src/hooks/api/secrets/mutations.tsx | 203 ++++-------------- frontend/src/hooks/api/secrets/queries.tsx | 127 +++++------ frontend/src/hooks/api/secrets/types.ts | 94 ++++---- .../SecretApprovalRequestChangeItem.tsx | 9 +- .../views/SecretMainPage/SecretMainPage.tsx | 5 - .../components/ActionBar/ActionBar.tsx | 95 ++++---- .../CreateSecretForm/CreateSecretForm.tsx | 9 +- .../SecretDropzone/CopySecretsFromBoard.tsx | 4 - .../SecretDropzone/SecretDropzone.tsx | 17 +- .../SecretImportListView.tsx | 8 +- .../SecretListView/SecretDetaiSidebar.tsx | 10 +- .../components/SecretListView/SecretItem.tsx | 14 +- .../SecretListView/SecretListView.tsx | 47 ++-- .../SecretListView/SecretListView.utils.ts | 1 + .../components/SnapshotView/SecretItem.tsx | 10 +- .../components/SnapshotView/SnapshotView.tsx | 11 +- .../SecretOverviewPage/SecretOverviewPage.tsx | 21 +- .../CreateSecretForm/CreateSecretForm.tsx | 16 +- .../SecretOverviewTableRow.tsx | 6 +- .../SecretRenameRow.tsx | 14 +- .../SelectionPanel/SelectionPanel.tsx | 6 +- .../steps/RotationOutputForm.tsx | 6 +- 30 files changed, 429 insertions(+), 955 deletions(-) delete mode 100644 frontend/src/helpers/secret.ts diff --git a/frontend/src/components/utilities/secrets/encryptSecrets.ts b/frontend/src/components/utilities/secrets/encryptSecrets.ts index 4eb59ae9f..121f3ab73 100644 --- a/frontend/src/components/utilities/secrets/encryptSecrets.ts +++ b/frontend/src/components/utilities/secrets/encryptSecrets.ts @@ -1,30 +1,4 @@ -import crypto from "crypto"; - -import { SecretDataProps, Tag } from "public/data/frequentInterfaces"; - -import { fetchUserWsKey } from "@app/hooks/api/keys/queries"; -import { SecretType } from "@app/hooks/api/types"; - -import { decryptAssymmetric, encryptSymmetric } from "../cryptography/crypto"; - -interface EncryptedSecretProps { - id: string; - createdAt: string; - environment: string; - secretName: string; - secretCommentCiphertext: string; - secretCommentIV: string; - secretCommentTag: string; - secretKeyCiphertext: string; - secretKeyIV: string; - secretKeyTag: string; - secretValueCiphertext: string; - secretValueIV: string; - secretValueTag: string; - type: SecretType; - tags: Tag[]; -} - +import { SecretDataProps } from "public/data/frequentInterfaces"; /** * Encypt secrets before pushing the to the DB * @param {object} obj @@ -34,7 +8,6 @@ interface EncryptedSecretProps { */ const encryptSecrets = async ({ secretsToEncrypt, - workspaceId, env }: { secretsToEncrypt: SecretDataProps[]; @@ -43,74 +16,14 @@ const encryptSecrets = async ({ }) => { let secrets; try { - // const sharedKey = await getLatestFileKey({ workspaceId }); - const wsKey = await fetchUserWsKey(workspaceId); - - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - - let randomBytes: string; - if (wsKey) { - // case: a (shared) key exists for the workspace - randomBytes = decryptAssymmetric({ - ciphertext: wsKey.encryptedKey, - nonce: wsKey.nonce, - publicKey: wsKey.sender.publicKey, - privateKey: PRIVATE_KEY - }); - } else { - // case: a (shared) key does not exist for the workspace - randomBytes = crypto.randomBytes(16).toString("hex"); - } - secrets = secretsToEncrypt.map((secret) => { - // encrypt key - const { - ciphertext: secretKeyCiphertext, - iv: secretKeyIV, - tag: secretKeyTag - } = encryptSymmetric({ - plaintext: secret.key, - key: randomBytes - }); - - // encrypt value - const { - ciphertext: secretValueCiphertext, - iv: secretValueIV, - tag: secretValueTag - } = encryptSymmetric({ - plaintext: secret.value ?? "", - key: randomBytes - }); - - // encrypt comment - const { - ciphertext: secretCommentCiphertext, - iv: secretCommentIV, - tag: secretCommentTag - } = encryptSymmetric({ - plaintext: secret.comment ?? "", - key: randomBytes - }); - - const result: EncryptedSecretProps = { + const result = { id: secret.id, createdAt: "", environment: env, - secretName: secret.key, - secretKeyCiphertext, - secretKeyIV, - secretKeyTag, - secretValueCiphertext, - secretValueIV, - secretValueTag, - secretCommentCiphertext, - secretCommentIV, - secretCommentTag, - type: - secret.valueOverride === undefined || secret?.value !== secret?.valueOverride - ? SecretType.Shared - : SecretType.Personal, + secretKey: secret.key, + secretValue: secret.value, + secretComment: secret.comment, tags: secret.tags }; diff --git a/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx b/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx index a1bf35292..629d94a37 100644 --- a/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx +++ b/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx @@ -5,7 +5,7 @@ import * as Popover from "@radix-ui/react-popover"; import { useWorkspace } from "@app/context"; import { useDebounce, useToggle } from "@app/hooks"; -import { useGetProjectFolders, useGetProjectSecrets, useGetUserWsKey } from "@app/hooks/api"; +import { useGetProjectFolders, useGetProjectSecrets } from "@app/hooks/api"; import { SecretInput } from "../SecretInput"; @@ -76,7 +76,6 @@ export const InfisicalSecretInput = forwardRef( ) => { const { currentWorkspace } = useWorkspace(); const workspaceId = currentWorkspace?.id || ""; - const { data: decryptFileKey } = useGetUserWsKey(workspaceId); const debouncedValue = useDebounce(value, 500); @@ -121,7 +120,6 @@ export const InfisicalSecretInput = forwardRef( const isPopupOpen = Boolean(suggestionSource.isOpen) && isFocused; const { data: secrets } = useGetProjectSecrets({ - decryptFileKey: decryptFileKey!, environment: suggestionSource.environment || "", secretPath: suggestionSource.secretPath || "", workspaceId, @@ -193,8 +191,9 @@ export const InfisicalSecretInput = forwardRef( ); // mid will be computed value inside the interpolation const mid = suggestionSource.isDeep - ? `${suggestionSource.value.slice(0, -suggestionSource.predicate.length || undefined)}${selectedSuggestion.slug - }` + ? `${suggestionSource.value.slice(0, -suggestionSource.predicate.length || undefined)}${ + selectedSuggestion.slug + }` : selectedSuggestion.slug; // whether we should append . or closing bracket on selecting suggestion const closingSymbol = getClosingSymbol( @@ -328,8 +327,9 @@ export const InfisicalSecretInput = forwardRef( key={`secret-reference-secret-${i + 1}`} >
diff --git a/frontend/src/helpers/project.ts b/frontend/src/helpers/project.ts index 6c4e91ffc..b6338ce35 100644 --- a/frontend/src/helpers/project.ts +++ b/frontend/src/helpers/project.ts @@ -1,81 +1,40 @@ -import encryptSecrets from "@app/components/utilities/secrets/encryptSecrets"; -import { createSecret } from "@app/hooks/api/secrets/mutations"; +import { apiRequest } from "@app/config/request"; import { createWorkspace } from "@app/hooks/api/workspace/queries"; const secretsToBeAdded = [ { - pos: 0, - key: "DATABASE_URL", + secretKey: "DATABASE_URL", // eslint-disable-next-line no-template-curly-in-string - value: "mongodb+srv://${DB_USERNAME}:${DB_PASSWORD}@mongodb.net", - valueOverride: undefined, - comment: "Secret referencing example", - id: "", - tags: [] + secretValue: "mongodb+srv://${DB_USERNAME}:${DB_PASSWORD}@mongodb.net", + secretComment: "Secret referencing example" }, { - pos: 1, - key: "DB_USERNAME", - value: "OVERRIDE_THIS", - valueOverride: undefined, - comment: "Override secrets with personal value", - id: "", - tags: [] + secretKey: "DB_USERNAME", + secretValue: "OVERRIDE_THIS", + secretComment: "Override secrets with personal value" }, { - pos: 2, - key: "DB_PASSWORD", - value: "OVERRIDE_THIS", - valueOverride: undefined, - comment: "Another secret override", - id: "", - tags: [] + secretKey: "DB_PASSWORD", + secretValue: "OVERRIDE_THIS", + secretComment: "Another secret override" }, { - pos: 3, - key: "DB_USERNAME", - value: "user1234", - valueOverride: "user1234", - comment: "", - id: "", - tags: [] + secretKey: "DB_PASSWORD", + secretValue: "example_password" }, { - pos: 4, - key: "DB_PASSWORD", - value: "example_password", - valueOverride: "example_password", - comment: "", - id: "", - tags: [] + secretKey: "TWILIO_AUTH_TOKEN", + secretValue: "example_twillio_token" }, { - pos: 5, - key: "TWILIO_AUTH_TOKEN", - value: "example_twillio_token", - valueOverride: undefined, - comment: "", - id: "", - tags: [] - }, - { - pos: 6, - key: "WEBSITE_URL", - value: "http://localhost:3000", - valueOverride: undefined, - comment: "", - id: "", - tags: [] + secretKey: "WEBSITE_URL", + secretValue: "http://localhost:3000" } ]; /** * Create and initialize a new project in organization with id [organizationId] * Note: current user should be a member of the organization - * @param {Object} obj - * @param {String} obj.organizationId - id of organization - * @param {String} obj.projectName - name of new project - * @returns {Project} project - new project */ const initProjectHelper = async ({ projectName }: { projectName: string }) => { // create new project @@ -85,37 +44,14 @@ const initProjectHelper = async ({ projectName }: { projectName: string }) => { projectName }); - // encrypt and upload secrets to new project - const secrets = await encryptSecrets({ - secretsToEncrypt: secretsToBeAdded, - workspaceId: project.id, - env: "dev" - }); - try { - await Promise.allSettled( - (secrets || []).map((secret) => - createSecret({ - workspaceId: project.id, - environment: secret.environment, - type: secret.type, - secretKey: secret.secretName, - secretKeyCiphertext: secret.secretKeyCiphertext, - secretKeyIV: secret.secretKeyIV, - secretKeyTag: secret.secretKeyTag, - secretValueCiphertext: secret.secretValueCiphertext, - secretValueIV: secret.secretValueIV, - secretValueTag: secret.secretValueTag, - secretCommentCiphertext: secret.secretCommentCiphertext, - secretCommentIV: secret.secretCommentIV, - secretCommentTag: secret.secretCommentTag, - secretPath: "/", - metadata: { - source: "signup" - } - }) - ) - ); + const { data } = await apiRequest.post("/api/v3/secrets/batch/raw", { + workspaceId: project.id, + environment: "dev", + secretPath: "/", + secrets: secretsToBeAdded + }); + return data; } catch (err) { console.error("Failed to upload secrets", err); } diff --git a/frontend/src/helpers/secret.ts b/frontend/src/helpers/secret.ts deleted file mode 100644 index 607fa4268..000000000 --- a/frontend/src/helpers/secret.ts +++ /dev/null @@ -1,175 +0,0 @@ -import path from "path"; - -import { decryptSymmetric } from "@app/components/utilities/cryptography/crypto"; -import { fetchProjectEncryptedSecrets } from "@app/hooks/api/secrets/queries"; - -const INTERPOLATION_SYNTAX_REG = /\${([^}]+)}/g; -export const interpolateSecrets = ({ - projectId, - secretEncKey -}: { - projectId: string; - secretEncKey: string; -}) => { - const fetchSecretsCrossEnv = () => { - const fetchCache: Record> = {}; - - return async (secRefEnv: string, secRefPath: string[], secRefKey: string) => { - const secRefPathUrl = path.join("/", ...secRefPath); - const uniqKey = `${secRefEnv}-${secRefPathUrl}`; - - if (fetchCache?.[uniqKey]) { - return fetchCache[uniqKey][secRefKey]; - } - - // get secrets by projectId, env, path - const encryptedSecrets = await fetchProjectEncryptedSecrets({ - workspaceId: projectId, - environment: secRefEnv, - secretPath: secRefPathUrl - }); - - const decryptedSec = encryptedSecrets.reduce>((prev, secret) => { - const secretKey = decryptSymmetric({ - ciphertext: secret.secretKeyCiphertext, - iv: secret.secretKeyIV, - tag: secret.secretKeyTag, - key: secretEncKey - }); - const secretValue = decryptSymmetric({ - ciphertext: secret.secretValueCiphertext, - iv: secret.secretValueIV, - tag: secret.secretValueTag, - key: secretEncKey - }); - - // eslint-disable-next-line - prev[secretKey] = secretValue; - return prev; - }, {}); - - fetchCache[uniqKey] = decryptedSec; - - return fetchCache[uniqKey][secRefKey]; - }; - }; - - const recursivelyExpandSecret = async ( - expandedSec: Record, - interpolatedSec: Record, - fetchCrossEnv: (env: string, secPath: string[], secKey: string) => Promise, - recursionChainBreaker: Record, - key: string - ) => { - if (expandedSec?.[key] !== undefined) { - return expandedSec[key]; - } - if (recursionChainBreaker?.[key]) { - return ""; - } - // eslint-disable-next-line - recursionChainBreaker[key] = true; - - let interpolatedValue = interpolatedSec[key]; - if (!interpolatedValue) { - // eslint-disable-next-line no-console - console.error(`Couldn't find referenced value - ${key}`); - return ""; - } - - const refs = interpolatedValue.match(INTERPOLATION_SYNTAX_REG); - if (refs) { - await Promise.all( - refs.map(async (interpolationSyntax) => { - const interpolationKey = interpolationSyntax.slice(2, interpolationSyntax.length - 1); - const entities = interpolationKey.trim().split("."); - - if (entities.length === 1) { - const val = await recursivelyExpandSecret( - expandedSec, - interpolatedSec, - fetchCrossEnv, - recursionChainBreaker, - interpolationKey - ); - if (val) { - interpolatedValue = interpolatedValue.replaceAll(interpolationSyntax, val); - } - return; - } - - if (entities.length > 1) { - const secRefEnv = entities[0]; - const secRefPath = entities.slice(1, entities.length - 1); - const secRefKey = entities[entities.length - 1]; - - const val = await fetchCrossEnv(secRefEnv, secRefPath, secRefKey); - if (val) { - interpolatedValue = interpolatedValue.replaceAll(interpolationSyntax, val); - } - } - }) - ); - } - - // eslint-disable-next-line - expandedSec[key] = interpolatedValue; - return interpolatedValue; - }; - - // used to convert multi line ones to quotes ones with \n - const formatMultiValueEnv = (val?: string) => { - if (!val) return ""; - if (!val.match("\n")) return val; - return `"${val.replace(/\n/g, "\\n")}"`; - }; - - const expandSecrets = async ( - secrets: Record - ) => { - const expandedSec: Record = {}; - const interpolatedSec: Record = {}; - - const crossSecEnvFetch = fetchSecretsCrossEnv(); - - Object.keys(secrets).forEach((key) => { - if (secrets[key].value.match(INTERPOLATION_SYNTAX_REG)) { - interpolatedSec[key] = secrets[key].value; - } else { - expandedSec[key] = secrets[key].value; - } - }); - - await Promise.all( - Object.keys(secrets).map(async (key) => { - if (expandedSec?.[key]) { - // should not do multi line encoding if user has set it to skip - // eslint-disable-next-line - secrets[key].value = secrets[key].skipMultilineEncoding - ? expandedSec[key] - : formatMultiValueEnv(expandedSec[key]); - return; - } - - // this is to avoid recursion loop. So the graph should be direct graph rather than cyclic - // so for any recursion building if there is an entity two times same key meaning it will be looped - const recursionChainBreaker: Record = {}; - const expandedVal = await recursivelyExpandSecret( - expandedSec, - interpolatedSec, - crossSecEnvFetch, - recursionChainBreaker, - key - ); - - // eslint-disable-next-line - secrets[key].value = secrets[key].skipMultilineEncoding - ? expandedVal - : formatMultiValueEnv(expandedVal); - }) - ); - - return secrets; - }; - return expandSecrets; -}; diff --git a/frontend/src/hooks/api/secretApprovalRequest/queries.tsx b/frontend/src/hooks/api/secretApprovalRequest/queries.tsx index aaf84941a..68db377cf 100644 --- a/frontend/src/hooks/api/secretApprovalRequest/queries.tsx +++ b/frontend/src/hooks/api/secretApprovalRequest/queries.tsx @@ -1,3 +1,4 @@ +/* eslint-disable no-param-reassign */ import { useInfiniteQuery, UseInfiniteQueryOptions, @@ -12,8 +13,7 @@ import { import { apiRequest } from "@app/config/request"; import { UserWsKeyPair } from "../keys/types"; -import { decryptSecrets } from "../secrets/queries"; -import { DecryptedSecret } from "../secrets/types"; +import { EncryptedSecret, SecretType,SecretV3RawSanitized } from "../secrets/types"; import { CommitType, TGetSecretApprovalRequestCount, @@ -45,6 +45,78 @@ export const secretApprovalRequestKeys = { ] }; +export const decryptSecrets = ( + encryptedSecrets: EncryptedSecret[], + decryptFileKey: UserWsKeyPair +) => { + const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; + const key = decryptAssymmetric({ + ciphertext: decryptFileKey.encryptedKey, + nonce: decryptFileKey.nonce, + publicKey: decryptFileKey.sender.publicKey, + privateKey: PRIVATE_KEY + }); + + const personalSecrets: Record = {}; + const secrets: SecretV3RawSanitized[] = []; + encryptedSecrets.forEach((encSecret) => { + const secretKey = decryptSymmetric({ + ciphertext: encSecret.secretKeyCiphertext, + iv: encSecret.secretKeyIV, + tag: encSecret.secretKeyTag, + key + }); + + const secretValue = decryptSymmetric({ + ciphertext: encSecret.secretValueCiphertext, + iv: encSecret.secretValueIV, + tag: encSecret.secretValueTag, + key + }); + + const secretComment = decryptSymmetric({ + ciphertext: encSecret.secretCommentCiphertext, + iv: encSecret.secretCommentIV, + tag: encSecret.secretCommentTag, + key + }); + + const decryptedSecret: SecretV3RawSanitized = { + id: encSecret.id, + env: encSecret.environment, + key: secretKey, + value: secretValue, + tags: encSecret.tags, + comment: secretComment, + reminderRepeatDays: encSecret.secretReminderRepeatDays, + reminderNote: encSecret.secretReminderNote, + createdAt: encSecret.createdAt, + updatedAt: encSecret.updatedAt, + version: encSecret.version, + skipMultilineEncoding: encSecret.skipMultilineEncoding + }; + + if (encSecret.type === SecretType.Personal) { + personalSecrets[decryptedSecret.key] = { + id: encSecret.id, + value: secretValue + }; + } else { + secrets.push(decryptedSecret); + } + }); + + secrets.forEach((sec) => { + if (personalSecrets?.[sec.key]) { + sec.idOverride = personalSecrets[sec.key].id; + sec.valueOverride = personalSecrets[sec.key].value; + sec.overrideAction = "modified"; + } + }); + + return secrets; +}; + export const decryptSecretApprovalSecret = ( encSecret: TSecretApprovalSecChangeData, decryptFileKey: UserWsKeyPair @@ -173,7 +245,7 @@ export const useGetSecretApprovalRequestDetails = ({ UseQueryOptions< TSecretApprovalRequest, unknown, - TSecretApprovalRequest, + TSecretApprovalRequest, ReturnType >, "queryKey" | "queryFn" diff --git a/frontend/src/hooks/api/secretImports/queries.tsx b/frontend/src/hooks/api/secretImports/queries.tsx index a7c510662..95f1621a2 100644 --- a/frontend/src/hooks/api/secretImports/queries.tsx +++ b/frontend/src/hooks/api/secretImports/queries.tsx @@ -1,10 +1,6 @@ import { useCallback } from "react"; import { useQueries, useQuery, UseQueryOptions } from "@tanstack/react-query"; -import { - decryptAssymmetric, - decryptSymmetric -} from "@app/components/utilities/cryptography/crypto"; import { apiRequest } from "@app/config/request"; import { @@ -75,7 +71,7 @@ const fetchImportedSecrets = async ( directory?: string ) => { const { data } = await apiRequest.get<{ secrets: TImportedSecrets[] }>( - "/api/v1/secret-imports/secrets", + "/api/v1/secret-imports/secrets/raw", { params: { workspaceId, @@ -107,7 +103,6 @@ const fetchImportedFolders = async ({ export const useGetImportedSecretsSingleEnv = ({ environment, - decryptFileKey, path, projectId, options = {} @@ -123,78 +118,40 @@ export const useGetImportedSecretsSingleEnv = ({ >; }) => useQuery({ - enabled: - Boolean(projectId) && - Boolean(environment) && - Boolean(decryptFileKey) && - (options?.enabled ?? true), + enabled: Boolean(projectId) && Boolean(environment) && (options?.enabled ?? true), queryKey: secretImportKeys.getSecretImportSecrets({ environment, path, projectId }), queryFn: () => fetchImportedSecrets(projectId, environment, path), - select: useCallback( - (data: TImportedSecrets[]) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const latestKey = decryptFileKey; - const key = decryptAssymmetric({ - ciphertext: latestKey.encryptedKey, - nonce: latestKey.nonce, - publicKey: latestKey.sender.publicKey, - privateKey: PRIVATE_KEY - }); - - return data.map((el) => ({ - environment: el.environment, - secretPath: el.secretPath, - environmentInfo: el.environmentInfo, - folderId: el.folderId, - secrets: el.secrets.map((encSecret) => { - const secretKey = decryptSymmetric({ - ciphertext: encSecret.secretKeyCiphertext, - iv: encSecret.secretKeyIV, - tag: encSecret.secretKeyTag, - key - }); - - const secretValue = decryptSymmetric({ - ciphertext: encSecret.secretValueCiphertext, - iv: encSecret.secretValueIV, - tag: encSecret.secretValueTag, - key - }); - - const secretComment = decryptSymmetric({ - ciphertext: encSecret.secretCommentCiphertext, - iv: encSecret.secretCommentIV, - tag: encSecret.secretCommentTag, - key - }); - - return { - id: encSecret.id, - env: encSecret.environment, - key: secretKey, - value: secretValue, - tags: encSecret.tags, - comment: secretComment, - createdAt: encSecret.createdAt, - updatedAt: encSecret.updatedAt, - version: encSecret.version - }; - }) - })); - }, - [decryptFileKey] - ) + select: (data: TImportedSecrets[]) => { + return data.map((el) => ({ + environment: el.environment, + secretPath: el.secretPath, + environmentInfo: el.environmentInfo, + folderId: el.folderId, + secrets: el.secrets.map((encSecret) => { + return { + id: encSecret.id, + env: encSecret.environment, + key: encSecret.secretKey, + value: encSecret.secretValue, + tags: encSecret.tags, + comment: encSecret.secretComment, + createdAt: encSecret.createdAt, + updatedAt: encSecret.updatedAt, + version: encSecret.version + }; + }) + })); + } }); export const useGetImportedSecretsAllEnvs = ({ projectId, environments, - path = "/", - decryptFileKey + path = "/" }: TGetSecretImportsAllEnvs) => { const secretImports = useQueries({ queries: environments.map((env) => ({ @@ -206,60 +163,27 @@ export const useGetImportedSecretsAllEnvs = ({ queryFn: () => fetchImportedSecrets(projectId, env, path).catch(() => []), enabled: Boolean(projectId) && Boolean(env), // eslint-disable-next-line react-hooks/rules-of-hooks - select: useCallback( - (data: TImportedSecrets[]) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const latestKey = decryptFileKey; - const key = decryptAssymmetric({ - ciphertext: latestKey.encryptedKey, - nonce: latestKey.nonce, - publicKey: latestKey.sender.publicKey, - privateKey: PRIVATE_KEY - }); - - return data.map((el) => ({ - environment: el.environment, - secretPath: el.secretPath, - environmentInfo: el.environmentInfo, - folderId: el.folderId, - secrets: el.secrets.map((encSecret) => { - const secretKey = decryptSymmetric({ - ciphertext: encSecret.secretKeyCiphertext, - iv: encSecret.secretKeyIV, - tag: encSecret.secretKeyTag, - key - }); - - const secretValue = decryptSymmetric({ - ciphertext: encSecret.secretValueCiphertext, - iv: encSecret.secretValueIV, - tag: encSecret.secretValueTag, - key - }); - - const secretComment = decryptSymmetric({ - ciphertext: encSecret.secretCommentCiphertext, - iv: encSecret.secretCommentIV, - tag: encSecret.secretCommentTag, - key - }); - - return { - id: encSecret.id, - env: encSecret.environment, - key: secretKey, - value: secretValue, - tags: encSecret.tags, - comment: secretComment, - createdAt: encSecret.createdAt, - updatedAt: encSecret.updatedAt, - version: encSecret.version - }; - }) - })); - }, - [decryptFileKey] - ) + select: (data: TImportedSecrets[]) => { + return data.map((el) => ({ + environment: el.environment, + secretPath: el.secretPath, + environmentInfo: el.environmentInfo, + folderId: el.folderId, + secrets: el.secrets.map((encSecret) => { + return { + id: encSecret.id, + env: encSecret.environment, + key: encSecret.secretKey, + value: encSecret.secretValue, + tags: encSecret.tags, + comment: encSecret.secretComment, + createdAt: encSecret.createdAt, + updatedAt: encSecret.updatedAt, + version: encSecret.version + }; + }) + })); + } })) }); diff --git a/frontend/src/hooks/api/secretImports/types.ts b/frontend/src/hooks/api/secretImports/types.ts index 1a6c06dd3..1bf60bd4e 100644 --- a/frontend/src/hooks/api/secretImports/types.ts +++ b/frontend/src/hooks/api/secretImports/types.ts @@ -1,5 +1,4 @@ -import { UserWsKeyPair } from "../keys/types"; -import { EncryptedSecret } from "../secrets/types"; +import { SecretV3Raw } from "../secrets/types"; import { WorkspaceEnv } from "../workspace/types"; export type TSecretImport = { @@ -28,7 +27,7 @@ export type TImportedSecrets = { environmentInfo: WorkspaceEnv; secretPath: string; folderId: string; - secrets: EncryptedSecret[]; + secrets: SecretV3Raw[]; }; export type TGetSecretImports = { @@ -39,7 +38,6 @@ export type TGetSecretImports = { export type TGetSecretImportsAllEnvs = { projectId: string; - decryptFileKey: UserWsKeyPair; path?: string; environments: string[]; }; @@ -48,7 +46,6 @@ export type TGetImportedSecrets = { projectId: string; environment: string; path?: string; - decryptFileKey: UserWsKeyPair; }; export type TuseGetImportedFoldersByEnv = { diff --git a/frontend/src/hooks/api/secretSnapshots/queries.tsx b/frontend/src/hooks/api/secretSnapshots/queries.tsx index cd81152a1..7709d3785 100644 --- a/frontend/src/hooks/api/secretSnapshots/queries.tsx +++ b/frontend/src/hooks/api/secretSnapshots/queries.tsx @@ -7,7 +7,7 @@ import { } from "@app/components/utilities/cryptography/crypto"; import { apiRequest } from "@app/config/request"; -import { DecryptedSecret, SecretType } from "../secrets/types"; +import { SecretType,SecretV3RawSanitized } from "../secrets/types"; import { TGetSecretSnapshotsDTO, TSecretRollbackDTO, @@ -80,7 +80,7 @@ export const useGetSnapshotSecrets = ({ decryptFileKey, snapshotId }: TSnapshotD privateKey: PRIVATE_KEY }); - const sharedSecrets: DecryptedSecret[] = []; + const sharedSecrets: SecretV3RawSanitized[] = []; const personalSecrets: Record = {}; data.secretVersions.forEach((encSecret) => { const secretKey = decryptSymmetric({ diff --git a/frontend/src/hooks/api/secrets/mutations.tsx b/frontend/src/hooks/api/secrets/mutations.tsx index 9c3fd23f0..4f4e00922 100644 --- a/frontend/src/hooks/api/secrets/mutations.tsx +++ b/frontend/src/hooks/api/secrets/mutations.tsx @@ -1,18 +1,11 @@ -import crypto from "crypto"; - import { MutationOptions, useMutation, useQueryClient } from "@tanstack/react-query"; -import { - decryptAssymmetric, - encryptSymmetric -} from "@app/components/utilities/cryptography/crypto"; import { apiRequest } from "@app/config/request"; import { secretApprovalRequestKeys } from "../secretApprovalRequest/queries"; import { secretSnapshotKeys } from "../secretSnapshots/queries"; import { secretKeys } from "./queries"; import { - CreateSecretDTO, TCreateSecretBatchDTO, TCreateSecretsV3DTO, TDeleteSecretBatchDTO, @@ -22,50 +15,6 @@ import { TUpdateSecretsV3DTO } from "./types"; -const encryptSecret = (randomBytes: string, key: string, value?: string, comment?: string) => { - // encrypt key - const { - ciphertext: secretKeyCiphertext, - iv: secretKeyIV, - tag: secretKeyTag - } = encryptSymmetric({ - plaintext: key, - key: randomBytes - }); - - // encrypt value - const { - ciphertext: secretValueCiphertext, - iv: secretValueIV, - tag: secretValueTag - } = encryptSymmetric({ - plaintext: value ?? "", - key: randomBytes - }); - - // encrypt comment - const { - ciphertext: secretCommentCiphertext, - iv: secretCommentIV, - tag: secretCommentTag - } = encryptSymmetric({ - plaintext: comment ?? "", - key: randomBytes - }); - - return { - secretKeyCiphertext, - secretKeyIV, - secretKeyTag, - secretValueCiphertext, - secretValueIV, - secretValueTag, - secretCommentCiphertext, - secretCommentIV, - secretCommentTag - }; -}; - export const useCreateSecretV3 = ({ options }: { @@ -78,32 +27,20 @@ export const useCreateSecretV3 = ({ type, environment, workspaceId, - secretName, + secretKey, secretValue, - latestFileKey, secretComment, skipMultilineEncoding }) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - - const randomBytes = latestFileKey - ? decryptAssymmetric({ - ciphertext: latestFileKey.encryptedKey, - nonce: latestFileKey.nonce, - publicKey: latestFileKey.sender.publicKey, - privateKey: PRIVATE_KEY - }) - : crypto.randomBytes(16).toString("hex"); - - const reqBody = { - workspaceId, - environment, - type, + const { data } = await apiRequest.post(`/api/v3/secrets/raw/${secretKey}`, { secretPath, - ...encryptSecret(randomBytes, secretName, secretValue, secretComment), + type, + environment, + workspaceId, + secretValue, + secretComment, skipMultilineEncoding - }; - const { data } = await apiRequest.post(`/api/v3/secrets/${secretName}`, reqBody); + }); return data; }, onSuccess: (_, { workspaceId, environment, secretPath }) => { @@ -132,44 +69,30 @@ export const useUpdateSecretV3 = ({ mutationFn: async ({ secretPath = "/", type, - secretId, environment, workspaceId, - secretName, + secretKey, secretValue, - latestFileKey, - tags, + tagIds, secretComment, secretReminderRepeatDays, secretReminderNote, newSecretName, skipMultilineEncoding }) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - - const randomBytes = latestFileKey - ? decryptAssymmetric({ - ciphertext: latestFileKey.encryptedKey, - nonce: latestFileKey.nonce, - publicKey: latestFileKey.sender.publicKey, - privateKey: PRIVATE_KEY - }) - : crypto.randomBytes(16).toString("hex"); - - const reqBody = { + const { data } = await apiRequest.patch(`/api/v3/secrets/raw/${secretKey}`, { workspaceId, environment, type, secretReminderNote, secretReminderRepeatDays, secretPath, - secretId, - ...encryptSecret(randomBytes, newSecretName ?? secretName, secretValue, secretComment), - tags, skipMultilineEncoding, - secretName: newSecretName - }; - const { data } = await apiRequest.patch(`/api/v3/secrets/${secretName}`, reqBody); + newSecretName, + secretComment, + tagIds, + secretValue + }); return data; }, onSuccess: (_, { workspaceId, environment, secretPath }) => { @@ -201,19 +124,17 @@ export const useDeleteSecretV3 = ({ type, environment, workspaceId, - secretName, + secretKey, secretId }) => { - const reqBody = { - workspaceId, - environment, - type, - secretPath, - secretId - }; - - const { data } = await apiRequest.delete(`/api/v3/secrets/${secretName}`, { - data: reqBody + const { data } = await apiRequest.delete(`/api/v3/secrets/raw/${secretKey}`, { + data: { + workspaceId, + environment, + type, + secretPath, + secretId + } }); return data; }, @@ -241,33 +162,13 @@ export const useCreateSecretBatch = ({ const queryClient = useQueryClient(); return useMutation<{}, {}, TCreateSecretBatchDTO>({ - mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets, latestFileKey }) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const randomBytes = latestFileKey - ? decryptAssymmetric({ - ciphertext: latestFileKey.encryptedKey, - nonce: latestFileKey.nonce, - publicKey: latestFileKey.sender.publicKey, - privateKey: PRIVATE_KEY - }) - : crypto.randomBytes(16).toString("hex"); - - const reqBody = { + mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => { + const { data } = await apiRequest.post("/api/v3/secrets/batch/raw", { workspaceId, environment, secretPath, - secrets: secrets.map( - ({ secretName, secretValue, secretComment, metadata, type, skipMultilineEncoding }) => ({ - secretName, - ...encryptSecret(randomBytes, secretName, secretValue, secretComment), - type, - metadata, - skipMultilineEncoding - }) - ) - }; - - const { data } = await apiRequest.post("/api/v3/secrets/batch", reqBody); + secrets + }); return data; }, onSuccess: (_, { workspaceId, environment, secretPath }) => { @@ -294,33 +195,13 @@ export const useUpdateSecretBatch = ({ const queryClient = useQueryClient(); return useMutation<{}, {}, TUpdateSecretBatchDTO>({ - mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets, latestFileKey }) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const randomBytes = latestFileKey - ? decryptAssymmetric({ - ciphertext: latestFileKey.encryptedKey, - nonce: latestFileKey.nonce, - publicKey: latestFileKey.sender.publicKey, - privateKey: PRIVATE_KEY - }) - : crypto.randomBytes(16).toString("hex"); - - const reqBody = { + mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => { + const { data } = await apiRequest.patch("/api/v3/secrets/batch/raw", { workspaceId, environment, secretPath, - secrets: secrets.map( - ({ secretName, secretValue, secretComment, type, tags, skipMultilineEncoding }) => ({ - secretName, - ...encryptSecret(randomBytes, secretName, secretValue, secretComment), - type, - tags, - skipMultilineEncoding - }) - ) - }; - - const { data } = await apiRequest.patch("/api/v3/secrets/batch", reqBody); + secrets + }); return data; }, onSuccess: (_, { workspaceId, environment, secretPath }) => { @@ -348,15 +229,13 @@ export const useDeleteSecretBatch = ({ return useMutation<{}, {}, TDeleteSecretBatchDTO>({ mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => { - const reqBody = { - workspaceId, - environment, - secretPath, - secrets - }; - - const { data } = await apiRequest.delete("/api/v3/secrets/batch", { - data: reqBody + const { data } = await apiRequest.delete("/api/v3/secrets/batch/raw", { + data: { + workspaceId, + environment, + secretPath, + secrets + } }); return data; }, @@ -443,7 +322,7 @@ export const useMoveSecrets = ({ }); }; -export const createSecret = async (dto: CreateSecretDTO) => { +export const createSecret = async (dto: TCreateSecretsV3DTO) => { const { data } = await apiRequest.post(`/api/v3/secrets/${dto.secretKey}`, dto); return data; }; diff --git a/frontend/src/hooks/api/secrets/queries.tsx b/frontend/src/hooks/api/secrets/queries.tsx index 382d01785..5864102d8 100644 --- a/frontend/src/hooks/api/secrets/queries.tsx +++ b/frontend/src/hooks/api/secrets/queries.tsx @@ -8,13 +8,13 @@ import { } from "@app/components/utilities/cryptography/crypto"; import { apiRequest } from "@app/config/request"; -import { UserWsKeyPair } from "../keys/types"; import { - DecryptedSecret, - EncryptedSecret, EncryptedSecretVersion, GetSecretVersionsDTO, SecretType, + SecretV3Raw, + SecretV3RawResponse, + SecretV3RawSanitized, TGetProjectSecretsAllEnvDTO, TGetProjectSecretsDTO, TGetProjectSecretsKey @@ -27,61 +27,49 @@ export const secretKeys = { getSecretVersion: (secretId: string) => [{ secretId }, "secret-versions"] as const }; -export const decryptSecrets = ( - encryptedSecrets: EncryptedSecret[], - decryptFileKey: UserWsKeyPair -) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const key = decryptAssymmetric({ - ciphertext: decryptFileKey.encryptedKey, - nonce: decryptFileKey.nonce, - publicKey: decryptFileKey.sender.publicKey, - privateKey: PRIVATE_KEY +export const fetchProjectSecrets = async ({ + workspaceId, + environment, + secretPath, + includeImports, + expandSecretReferences +}: TGetProjectSecretsKey) => { + const { data } = await apiRequest.get("/api/v3/secrets/raw", { + params: { + environment, + workspaceId, + secretPath, + expandSecretReferences, + include_imports: includeImports + } }); + return data; +}; + +export const mergePersonalSecrets = (rawSecrets: SecretV3Raw[]) => { const personalSecrets: Record = {}; - const secrets: DecryptedSecret[] = []; - encryptedSecrets.forEach((encSecret) => { - const secretKey = decryptSymmetric({ - ciphertext: encSecret.secretKeyCiphertext, - iv: encSecret.secretKeyIV, - tag: encSecret.secretKeyTag, - key - }); - - const secretValue = decryptSymmetric({ - ciphertext: encSecret.secretValueCiphertext, - iv: encSecret.secretValueIV, - tag: encSecret.secretValueTag, - key - }); - - const secretComment = decryptSymmetric({ - ciphertext: encSecret.secretCommentCiphertext, - iv: encSecret.secretCommentIV, - tag: encSecret.secretCommentTag, - key - }); - - const decryptedSecret: DecryptedSecret = { - id: encSecret.id, - env: encSecret.environment, - key: secretKey, - value: secretValue, - tags: encSecret.tags, - comment: secretComment, - reminderRepeatDays: encSecret.secretReminderRepeatDays, - reminderNote: encSecret.secretReminderNote, - createdAt: encSecret.createdAt, - updatedAt: encSecret.updatedAt, - version: encSecret.version, - skipMultilineEncoding: encSecret.skipMultilineEncoding + const secrets: SecretV3RawSanitized[] = []; + rawSecrets.forEach((el) => { + const decryptedSecret: SecretV3RawSanitized = { + id: el.id, + env: el.environment, + key: el.secretKey, + value: el.secretValue, + tags: el.tags || [], + comment: el.secretComment || "", + reminderRepeatDays: el.secretReminderRepeatDays, + reminderNote: el.secretReminderNote, + createdAt: el.createdAt, + updatedAt: el.updatedAt, + version: el.version, + skipMultilineEncoding: el.skipMultilineEncoding }; - if (encSecret.type === SecretType.Personal) { + if (el.type === SecretType.Personal) { personalSecrets[decryptedSecret.key] = { - id: encSecret.id, - value: secretValue + id: el.id, + value: el.secretValue }; } else { secrets.push(decryptedSecret); @@ -99,33 +87,17 @@ export const decryptSecrets = ( return secrets; }; -export const fetchProjectEncryptedSecrets = async ({ - workspaceId, - environment, - secretPath -}: TGetProjectSecretsKey) => { - const { data } = await apiRequest.get<{ secrets: EncryptedSecret[] }>("/api/v3/secrets", { - params: { - environment, - workspaceId, - secretPath - } - }); - - return data.secrets; -}; export const useGetProjectSecrets = ({ workspaceId, environment, - decryptFileKey, secretPath, options }: TGetProjectSecretsDTO & { options?: Omit< UseQueryOptions< - EncryptedSecret[], + SecretV3RawResponse, unknown, - DecryptedSecret[], + SecretV3RawSanitized[], ReturnType >, "queryKey" | "queryFn" @@ -134,25 +106,24 @@ export const useGetProjectSecrets = ({ useQuery({ ...options, // wait for all values to be available - enabled: Boolean(decryptFileKey && workspaceId && environment) && (options?.enabled ?? true), + enabled: Boolean(workspaceId && environment) && (options?.enabled ?? true), queryKey: secretKeys.getProjectSecret({ workspaceId, environment, secretPath }), - queryFn: async () => fetchProjectEncryptedSecrets({ workspaceId, environment, secretPath }), - select: (secrets: EncryptedSecret[]) => decryptSecrets(secrets, decryptFileKey) + queryFn: async () => fetchProjectSecrets({ workspaceId, environment, secretPath }), + select: ({ secrets }) => mergePersonalSecrets(secrets) }); export const useGetProjectSecretsAllEnv = ({ workspaceId, envs, - decryptFileKey, secretPath }: TGetProjectSecretsAllEnvDTO) => { const secrets = useQueries({ queries: envs.map((environment) => ({ queryKey: secretKeys.getProjectSecret({ workspaceId, environment, secretPath }), - enabled: Boolean(decryptFileKey && workspaceId && environment), - queryFn: async () => fetchProjectEncryptedSecrets({ workspaceId, environment, secretPath }), - select: (secs: EncryptedSecret[]) => - decryptSecrets(secs, decryptFileKey).reduce>( + enabled: Boolean(workspaceId && environment), + queryFn: async () => fetchProjectSecrets({ workspaceId, environment, secretPath }), + select: (el: SecretV3RawResponse) => + mergePersonalSecrets(el.secrets).reduce>( (prev, curr) => ({ ...prev, [curr.key]: curr }), {} ) diff --git a/frontend/src/hooks/api/secrets/types.ts b/frontend/src/hooks/api/secrets/types.ts index de7e1d503..d82e2203b 100644 --- a/frontend/src/hooks/api/secrets/types.ts +++ b/frontend/src/hooks/api/secrets/types.ts @@ -30,15 +30,16 @@ export type EncryptedSecret = { tags: WsTag[]; }; -export type DecryptedSecret = { +// both personal and shared secret stitiched together for dashboard +export type SecretV3RawSanitized = { id: string; version: number; key: string; value: string; - comment: string; + comment?: string; reminderRepeatDays?: number | null; reminderNote?: string | null; - tags: WsTag[]; + tags?: WsTag[]; createdAt: string; updatedAt: string; env: string; @@ -49,6 +50,35 @@ export type DecryptedSecret = { skipMultilineEncoding?: boolean; }; +export type SecretV3Raw = { + id: string; + _id: string; + workspace: string; + environment: string; + version: number; + type: string; + secretKey: string; + secretValue: string; + secretComment?: string; + secretReminderNote?: string; + secretReminderRepeatDays?: number; + skipMultilineEncoding?: boolean; + metadata?: Record; + tags?: WsTag[]; + createdAt: string; + updatedAt: string; +}; + +export type SecretV3RawResponse = { + secrets: SecretV3Raw[]; + imports: { + secretPath: string; + environment: string; + folderId: string; + secrets: SecretV3Raw[]; + }[]; +}; + export type EncryptedSecretVersion = { id: string; secretId: string; @@ -75,16 +105,15 @@ export type TGetProjectSecretsKey = { workspaceId: string; environment: string; secretPath?: string; + includeImports?: boolean; + expandSecretReferences?: boolean; }; -export type TGetProjectSecretsDTO = { - decryptFileKey: UserWsKeyPair; -} & TGetProjectSecretsKey; +export type TGetProjectSecretsDTO = TGetProjectSecretsKey; export type TGetProjectSecretsAllEnvDTO = { workspaceId: string; envs: string[]; - decryptFileKey: UserWsKeyPair; folderId?: string; secretPath?: string; isPaused?: boolean; @@ -98,8 +127,7 @@ export type GetSecretVersionsDTO = { }; export type TCreateSecretsV3DTO = { - latestFileKey: UserWsKeyPair; - secretName: string; + secretKey: string; secretValue: string; secretComment: string; skipMultilineEncoding?: boolean; @@ -110,20 +138,18 @@ export type TCreateSecretsV3DTO = { }; export type TUpdateSecretsV3DTO = { - latestFileKey: UserWsKeyPair; workspaceId: string; environment: string; - type: SecretType; secretPath: string; + type: SecretType; skipMultilineEncoding?: boolean; newSecretName?: string; - secretName: string; - secretId?: string; + secretKey: string; secretValue: string; secretComment?: string; secretReminderRepeatDays?: number | null; secretReminderNote?: string | null; - tags?: string[]; + tagIds?: string[]; }; export type TDeleteSecretsV3DTO = { @@ -131,7 +157,7 @@ export type TDeleteSecretsV3DTO = { environment: string; type: SecretType; secretPath: string; - secretName: string; + secretKey: string; secretId?: string; }; @@ -139,13 +165,13 @@ export type TCreateSecretBatchDTO = { workspaceId: string; environment: string; secretPath: string; - latestFileKey: UserWsKeyPair; secrets: Array<{ - secretName: string; + secretKey: string; secretValue: string; secretComment: string; skipMultilineEncoding?: boolean; type: SecretType; + tagIds?: string[]; metadata?: { source?: string; }; @@ -156,14 +182,16 @@ export type TUpdateSecretBatchDTO = { workspaceId: string; environment: string; secretPath: string; - latestFileKey: UserWsKeyPair; secrets: Array<{ type: SecretType; - secretName: string; - skipMultilineEncoding?: boolean; + secretKey: string; secretValue: string; - secretComment: string; - tags?: string[]; + secretComment?: string; + skipMultilineEncoding?: boolean; + tagIds?: string[]; + metadata?: { + source?: string; + }; }>; }; @@ -172,7 +200,7 @@ export type TDeleteSecretBatchDTO = { environment: string; secretPath: string; secrets: Array<{ - secretName: string; + secretKey: string; type: SecretType; }>; }; @@ -187,23 +215,3 @@ export type TMoveSecretsDTO = { secretIds: string[]; shouldOverwrite: boolean; }; - -export type CreateSecretDTO = { - workspaceId: string; - environment: string; - type: SecretType; - secretKey: string; - secretKeyCiphertext: string; - secretKeyIV: string; - secretKeyTag: string; - secretValueCiphertext: string; - secretValueIV: string; - secretValueTag: string; - secretCommentCiphertext: string; - secretCommentIV: string; - secretCommentTag: string; - secretPath: string; - metadata?: { - source?: string; - }; -}; diff --git a/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx b/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx index bdb059a63..0b6e9ac10 100644 --- a/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx +++ b/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx @@ -13,11 +13,16 @@ import { Tooltip, Tr } from "@app/components/v2"; -import { CommitType, DecryptedSecret, TSecretApprovalSecChange, WsTag } from "@app/hooks/api/types"; +import { + CommitType, + SecretV3RawSanitized, + TSecretApprovalSecChange, + WsTag +} from "@app/hooks/api/types"; export type Props = { op: CommitType; - secretVersion?: DecryptedSecret; + secretVersion?: SecretV3RawSanitized; newVersion?: Omit & { tags?: WsTag[] }; presentSecretVersionNumber: number; hasMerged?: Boolean; diff --git a/frontend/src/views/SecretMainPage/SecretMainPage.tsx b/frontend/src/views/SecretMainPage/SecretMainPage.tsx index 79bc72855..b9258225f 100644 --- a/frontend/src/views/SecretMainPage/SecretMainPage.tsx +++ b/frontend/src/views/SecretMainPage/SecretMainPage.tsx @@ -100,7 +100,6 @@ export const SecretMainPage = () => { environment, workspaceId, secretPath, - decryptFileKey: decryptFileKey!, options: { enabled: canReadSecret } @@ -131,7 +130,6 @@ export const SecretMainPage = () => { const { data: importedSecrets } = useGetImportedSecretsSingleEnv({ projectId: workspaceId, environment, - decryptFileKey: decryptFileKey!, path: secretPath, options: { enabled: canReadSecret @@ -255,7 +253,6 @@ export const SecretMainPage = () => { <> { { secrets={secrets} environment={environment} workspaceId={workspaceId} - decryptFileKey={decryptFileKey!} secretPath={secretPath} isSmaller={isNotEmtpy} environments={currentWorkspace?.environments} diff --git a/frontend/src/views/SecretMainPage/components/ActionBar/ActionBar.tsx b/frontend/src/views/SecretMainPage/components/ActionBar/ActionBar.tsx index a4b3eb7c6..855fd393e 100644 --- a/frontend/src/views/SecretMainPage/components/ActionBar/ActionBar.tsx +++ b/frontend/src/views/SecretMainPage/components/ActionBar/ActionBar.tsx @@ -25,7 +25,6 @@ import { twMerge } from "tailwind-merge"; import { createNotification } from "@app/components/notifications"; import { ProjectPermissionCan } from "@app/components/permissions"; -import { decryptAssymmetric } from "@app/components/utilities/cryptography/crypto"; import { Button, DeleteActionModal, @@ -46,15 +45,10 @@ import { UpgradePlanModal } from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub, useSubscription } from "@app/context"; -import { interpolateSecrets } from "@app/helpers/secret"; import { usePopUp } from "@app/hooks"; -import { - useCreateFolder, - useDeleteSecretBatch, - useGetUserWsKey, - useMoveSecrets -} from "@app/hooks/api"; -import { DecryptedSecret, SecretType, TImportedSecrets, WsTag } from "@app/hooks/api/types"; +import { useCreateFolder, useDeleteSecretBatch, useMoveSecrets } from "@app/hooks/api"; +import { fetchProjectSecrets } from "@app/hooks/api/secrets/queries"; +import { SecretType, SecretV3RawSanitized, WsTag } from "@app/hooks/api/types"; import { debounce } from "@app/lib/fn/debounce"; import { @@ -70,9 +64,8 @@ import { FolderForm } from "./FolderForm"; import { MoveSecretsModal } from "./MoveSecretsModal"; type Props = { - secrets?: DecryptedSecret[]; + secrets?: SecretV3RawSanitized[]; // swtich the secrets type as it gets decrypted after api call - importedSecrets?: Array & { secrets: DecryptedSecret[] }>; environment: string; // @depreciated will be moving all these details to zustand workspaceId: string; @@ -92,7 +85,6 @@ type Props = { export const ActionBar = ({ secrets = [], - importedSecrets = [], environment, workspaceId, projectSlug, @@ -124,7 +116,6 @@ export const ActionBar = ({ const { mutateAsync: createFolder } = useCreateFolder(); const { mutateAsync: deleteBatchSecretV3 } = useDeleteSecretBatch(); const { mutateAsync: moveSecrets } = useMoveSecrets(); - const { data: decryptFileKey } = useGetUserWsKey(workspaceId); const selectedSecrets = useSelectedSecrets(); const { reset: resetSelectedSecret } = useSelectedSecretActions(); @@ -155,58 +146,46 @@ export const ActionBar = ({ }; const handleSecretDownload = async () => { - const secPriority: Record = {}; - const downloadedSecrets: Array<{ key: string; value: string; comment?: string }> = []; - - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const workspaceKey = decryptAssymmetric({ - ciphertext: decryptFileKey!.encryptedKey, - nonce: decryptFileKey!.nonce, - publicKey: decryptFileKey!.sender.publicKey, - privateKey: PRIVATE_KEY + const { secrets: localSecrets, imports: localImportedSecrets } = await fetchProjectSecrets({ + workspaceId, + expandSecretReferences: true, + includeImports: true, + environment, + secretPath }); - - const expandSecrets = interpolateSecrets({ - projectId: workspaceId, - secretEncKey: workspaceKey - }); - - const secretRecord: Record< - string, - { value: string; comment?: string; skipMultilineEncoding?: boolean } - > = {}; - - // load up secrets in dashboard - secrets?.forEach(({ key, value, valueOverride, comment }) => { - secPriority[key] = true; - downloadedSecrets.push({ key, value: valueOverride || value, comment }); - }); - // now load imported secrets with secPriority - for (let i = importedSecrets.length - 1; i >= 0; i -= 1) { - importedSecrets[i].secrets.forEach(({ key, value, valueOverride, comment }) => { - if (secPriority?.[key]) return; - downloadedSecrets.unshift({ key, value: valueOverride || value, comment }); - secPriority[key] = true; + const secretsPicked = new Set(); + const secretsToDownload: { key: string; value?: string; comment?: string }[] = []; + localSecrets.forEach((el) => { + secretsPicked.add(el.secretKey); + secretsToDownload.push({ + key: el.secretKey, + value: el.secretValue, + comment: el.secretComment }); + }); + + for (let i = localImportedSecrets.length - 1; i >= 0; i -= 1) { + for (let j = localImportedSecrets[i].secrets.length - 1; j >= 0; j -= 1) { + const secret = localImportedSecrets[i].secrets[j]; + if (!secretsPicked.has(secret.secretKey)) { + secretsToDownload.push({ + key: secret.secretKey, + value: secret.secretValue, + comment: secret.secretComment + }); + } + secretsPicked.add(secret.secretKey); + } } - downloadedSecrets.forEach((secret) => { - secretRecord[secret.key] = { - value: secret.value, - comment: secret.comment - }; - }); - - await expandSecrets(secretRecord); - - const file = downloadedSecrets + const file = secretsToDownload .sort((a, b) => a.key.toLowerCase().localeCompare(b.key.toLowerCase())) .reduce( - (prev, { key, comment }, index) => + (prev, { key, comment, value }, index) => prev + (comment - ? `${index === 0 ? "#" : "\n#"} ${comment}\n${key}=${secretRecord[key].value}\n` - : `${key}=${secretRecord[key].value}\n`), + ? `${index === 0 ? "#" : "\n#"} ${comment}\n${key}=${value}\n` + : `${key}=${value}\n`), "" ); @@ -221,7 +200,7 @@ export const ActionBar = ({ secretPath, workspaceId, environment, - secrets: bulkDeletedSecrets.map(({ key }) => ({ secretName: key, type: SecretType.Shared })) + secrets: bulkDeletedSecrets.map(({ key }) => ({ secretKey: key, type: SecretType.Shared })) }); resetSelectedSecret(); handlePopUpClose("bulkDeleteSecrets"); diff --git a/frontend/src/views/SecretMainPage/components/CreateSecretForm/CreateSecretForm.tsx b/frontend/src/views/SecretMainPage/components/CreateSecretForm/CreateSecretForm.tsx index 571de17a3..c1ce05b4c 100644 --- a/frontend/src/views/SecretMainPage/components/CreateSecretForm/CreateSecretForm.tsx +++ b/frontend/src/views/SecretMainPage/components/CreateSecretForm/CreateSecretForm.tsx @@ -6,7 +6,7 @@ import { createNotification } from "@app/components/notifications"; import { Button, FormControl, Input, Modal, ModalContent } from "@app/components/v2"; import { InfisicalSecretInput } from "@app/components/v2/InfisicalSecretInput"; import { useCreateSecretV3 } from "@app/hooks/api"; -import { SecretType, UserWsKeyPair } from "@app/hooks/api/types"; +import { SecretType } from "@app/hooks/api/types"; import { PopUpNames, usePopUpAction, usePopUpState } from "../../SecretMainPage.store"; @@ -20,7 +20,6 @@ type TFormSchema = z.infer; type Props = { environment: string; workspaceId: string; - decryptFileKey: UserWsKeyPair; secretPath?: string; // modal props autoCapitalize?: boolean; @@ -30,7 +29,6 @@ type Props = { export const CreateSecretForm = ({ environment, workspaceId, - decryptFileKey, secretPath = "/", autoCapitalize = true, isProtectedBranch = false @@ -53,11 +51,10 @@ export const CreateSecretForm = ({ environment, workspaceId, secretPath, - secretName: key, + secretKey: key, secretValue: value || "", secretComment: "", - type: SecretType.Shared, - latestFileKey: decryptFileKey + type: SecretType.Shared }); closePopUp(PopUpNames.CreateSecretForm); reset(); diff --git a/frontend/src/views/SecretMainPage/components/SecretDropzone/CopySecretsFromBoard.tsx b/frontend/src/views/SecretMainPage/components/SecretDropzone/CopySecretsFromBoard.tsx index 1d83f591b..547507bdf 100644 --- a/frontend/src/views/SecretMainPage/components/SecretDropzone/CopySecretsFromBoard.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretDropzone/CopySecretsFromBoard.tsx @@ -32,7 +32,6 @@ import { SecretPathInput } from "@app/components/v2/SecretPathInput"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context"; import { useDebounce } from "@app/hooks"; import { useGetProjectSecrets } from "@app/hooks/api"; -import { UserWsKeyPair } from "@app/hooks/api/types"; const formSchema = z.object({ environment: z.string().trim(), @@ -54,7 +53,6 @@ type Props = { onParsedEnv: (env: Record) => void; environments?: { name: string; slug: string }[]; workspaceId: string; - decryptFileKey: UserWsKeyPair; environment: string; secretPath: string; }; @@ -62,7 +60,6 @@ type Props = { export const CopySecretsFromBoard = ({ environments = [], workspaceId, - decryptFileKey, environment, secretPath, isOpen, @@ -93,7 +90,6 @@ export const CopySecretsFromBoard = ({ workspaceId, environment: selectedEnvSlug, secretPath: debouncedEnvCopySecretPath, - decryptFileKey, options: { enabled: Boolean(workspaceId) && diff --git a/frontend/src/views/SecretMainPage/components/SecretDropzone/SecretDropzone.tsx b/frontend/src/views/SecretMainPage/components/SecretDropzone/SecretDropzone.tsx index ca0923894..09759fba7 100644 --- a/frontend/src/views/SecretMainPage/components/SecretDropzone/SecretDropzone.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretDropzone/SecretDropzone.tsx @@ -16,7 +16,7 @@ import { usePopUp, useToggle } from "@app/hooks"; import { useCreateSecretBatch, useUpdateSecretBatch } from "@app/hooks/api"; import { secretApprovalRequestKeys } from "@app/hooks/api/secretApprovalRequest/queries"; import { secretKeys } from "@app/hooks/api/secrets/queries"; -import { DecryptedSecret, SecretType, UserWsKeyPair } from "@app/hooks/api/types"; +import { SecretType,SecretV3RawSanitized } from "@app/hooks/api/types"; import { PopUpNames, usePopUpAction } from "../../SecretMainPage.store"; import { CopySecretsFromBoard } from "./CopySecretsFromBoard"; @@ -40,10 +40,9 @@ type Props = { isSmaller: boolean; environments?: { name: string; slug: string }[]; workspaceId: string; - decryptFileKey: UserWsKeyPair; environment: string; secretPath: string; - secrets?: DecryptedSecret[]; + secrets?: SecretV3RawSanitized[]; isProtectedBranch?: boolean; }; @@ -51,7 +50,6 @@ export const SecretDropzone = ({ isSmaller, environments = [], workspaceId, - decryptFileKey, environment, secretPath, secrets = [], @@ -165,29 +163,27 @@ export const SecretDropzone = ({ try { if (Object.keys(create || {}).length) { await createSecretBatch({ - latestFileKey: decryptFileKey!, secretPath, workspaceId, environment, - secrets: Object.entries(create).map(([secretName, secData]) => ({ + secrets: Object.entries(create).map(([secretKey, secData]) => ({ type: SecretType.Shared, secretComment: secData.comments.join("\n"), secretValue: secData.value, - secretName + secretKey })) }); } if (Object.keys(update || {}).length) { await updateSecretBatch({ - latestFileKey: decryptFileKey!, secretPath, workspaceId, environment, - secrets: Object.entries(update).map(([secretName, secData]) => ({ + secrets: Object.entries(update).map(([secretKey, secData]) => ({ type: SecretType.Shared, secretComment: secData.comments.join("\n"), secretValue: secData.value, - secretName + secretKey })) }); } @@ -281,7 +277,6 @@ export const SecretDropzone = ({ environment={environment} environments={environments} workspaceId={workspaceId} - decryptFileKey={decryptFileKey} secretPath={secretPath} isSmaller={isSmaller} /> diff --git a/frontend/src/views/SecretMainPage/components/SecretImportListView/SecretImportListView.tsx b/frontend/src/views/SecretMainPage/components/SecretImportListView/SecretImportListView.tsx index aa2a3cba3..7846639d7 100644 --- a/frontend/src/views/SecretMainPage/components/SecretImportListView/SecretImportListView.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretImportListView/SecretImportListView.tsx @@ -18,7 +18,7 @@ import { usePopUp } from "@app/hooks"; import { useDeleteSecretImport, useUpdateSecretImport } from "@app/hooks/api"; import { ReservedFolders } from "@app/hooks/api/secretFolders/types"; import { TSecretImport } from "@app/hooks/api/secretImports/types"; -import { DecryptedSecret, WorkspaceEnv } from "@app/hooks/api/types"; +import { SecretV3RawSanitized, WorkspaceEnv } from "@app/hooks/api/types"; import { formatReservedPaths } from "@app/lib/fn/string"; import { SecretImportItem } from "./SecretImportItem"; @@ -29,14 +29,14 @@ type TImportedSecrets = Array<{ environmentInfo: WorkspaceEnv; secretPath: string; folderId: string; - secrets: DecryptedSecret[]; + secrets: SecretV3RawSanitized[]; }>; export const computeImportedSecretRows = ( importedSecEnv: string, importedSecPath: string, importSecrets: TImportedSecrets = [], - secrets: DecryptedSecret[] = [] + secrets: SecretV3RawSanitized[] = [] ) => { const importedSecIndex = importSecrets.findIndex( ({ secretPath, environmentInfo }) => @@ -90,7 +90,7 @@ type Props = { secretPath?: string; secretImports?: TSecretImport[]; isFetching?: boolean; - secrets?: DecryptedSecret[]; + secrets?: SecretV3RawSanitized[]; importedSecrets?: TImportedSecrets; searchTerm: string; }; diff --git a/frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx b/frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx index 8890174cd..994f171ab 100644 --- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx @@ -37,7 +37,7 @@ import { InfisicalSecretInput } from "@app/components/v2/InfisicalSecretInput"; import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context"; import { useToggle } from "@app/hooks"; import { useGetSecretVersion } from "@app/hooks/api"; -import { DecryptedSecret, UserWsKeyPair, WsTag } from "@app/hooks/api/types"; +import { SecretV3RawSanitized, UserWsKeyPair, WsTag } from "@app/hooks/api/types"; import { CreateReminderForm } from "./CreateReminderForm"; import { formSchema, SecretActionType, TFormSchema } from "./SecretListView.utils"; @@ -48,12 +48,12 @@ type Props = { secretPath: string; onToggle: (isOpen: boolean) => void; onClose: () => void; - secret: DecryptedSecret; + secret: SecretV3RawSanitized; decryptFileKey: UserWsKeyPair; onDeleteSecret: () => void; onSaveSecret: ( - orgSec: DecryptedSecret, - modSec: Omit & { tags: { id: string }[] }, + orgSec: SecretV3RawSanitized, + modSec: Omit & { tags?: { id: string }[] }, cb?: () => void ) => Promise; tags: WsTag[]; @@ -101,7 +101,7 @@ export const SecretDetailSidebar = ({ control, name: "tags" }); - const selectedTags = watch("tags", []); + const selectedTags = watch("tags", []) || []; const selectedTagsGroupById = selectedTags.reduce>( (prev, curr) => ({ ...prev, [curr.id]: true }), {} diff --git a/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx b/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx index 6d45d3da0..22207cb90 100644 --- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx @@ -28,7 +28,7 @@ import { useWorkspace } from "@app/context"; import { useToggle } from "@app/hooks"; -import { DecryptedSecret } from "@app/hooks/api/secrets/types"; +import { SecretV3RawSanitized } from "@app/hooks/api/secrets/types"; import { WsTag } from "@app/hooks/api/types"; import { subject } from "@casl/ability"; import { zodResolver } from "@hookform/resolvers/zod"; @@ -46,14 +46,14 @@ import { } from "./SecretListView.utils"; type Props = { - secret: DecryptedSecret; + secret: SecretV3RawSanitized; onSaveSecret: ( - orgSec: DecryptedSecret, - modSec: Omit & { tags: { id: string }[] }, + orgSec: SecretV3RawSanitized, + modSec: Omit & { tags?: { id: string }[] }, cb?: () => void ) => Promise; - onDeleteSecret: (sec: DecryptedSecret) => void; - onDetailViewSecret: (sec: DecryptedSecret) => void; + onDeleteSecret: (sec: SecretV3RawSanitized) => void; + onDetailViewSecret: (sec: SecretV3RawSanitized) => void; isVisible?: boolean; isSelected?: boolean; onToggleSecretSelect: (id: string) => void; @@ -113,7 +113,7 @@ export const SecretItem = memo( const overrideAction = watch("overrideAction"); const hasComment = Boolean(watch("comment")); - const selectedTags = watch("tags", []); + const selectedTags = watch("tags", []) || []; const selectedTagsGroupById = selectedTags.reduce>( (prev, curr) => ({ ...prev, [curr.id]: true }), {} diff --git a/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx b/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx index 147e9d2b8..b3f0fb890 100644 --- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx @@ -10,7 +10,7 @@ import { usePopUp } from "@app/hooks"; import { useCreateSecretV3, useDeleteSecretV3, useUpdateSecretV3 } from "@app/hooks/api"; import { secretApprovalRequestKeys } from "@app/hooks/api/secretApprovalRequest/queries"; import { secretKeys } from "@app/hooks/api/secrets/queries"; -import { DecryptedSecret, SecretType } from "@app/hooks/api/secrets/types"; +import { SecretType,SecretV3RawSanitized } from "@app/hooks/api/secrets/types"; import { secretSnapshotKeys } from "@app/hooks/api/secretSnapshots/queries"; import { UserWsKeyPair, WsTag } from "@app/hooks/api/types"; import { AddShareSecretModal } from "@app/views/ShareSecretPage/components/AddShareSecretModal"; @@ -22,7 +22,7 @@ import { SecretItem } from "./SecretItem"; import { FontAwesomeSpriteSymbols } from "./SecretListView.utils"; type Props = { - secrets?: DecryptedSecret[]; + secrets?: SecretV3RawSanitized[]; environment: string; workspaceId: string; decryptFileKey: UserWsKeyPair; @@ -34,8 +34,8 @@ type Props = { isProtectedBranch?: boolean; }; -const reorderSecretGroupByUnderscore = (secrets: DecryptedSecret[], sortDir: SortDir) => { - const groupedSecrets: Record = {}; +const reorderSecretGroupByUnderscore = (secrets: SecretV3RawSanitized[], sortDir: SortDir) => { + const groupedSecrets: Record = {}; secrets.forEach((secret) => { const lastSeperatorIndex = secret.key.lastIndexOf("_"); const namespace = @@ -53,7 +53,11 @@ const reorderSecretGroupByUnderscore = (secrets: DecryptedSecret[], sortDir: Sor .map((namespace) => ({ namespace, secrets: groupedSecrets[namespace] })); }; -const reorderSecret = (secrets: DecryptedSecret[], sortDir: SortDir, filter?: GroupBy | null) => { +const reorderSecret = ( + secrets: SecretV3RawSanitized[], + sortDir: SortDir, + filter?: GroupBy | null +) => { if (filter === GroupBy.PREFIX) { return reorderSecretGroupByUnderscore(secrets, sortDir); } @@ -70,12 +74,12 @@ const reorderSecret = (secrets: DecryptedSecret[], sortDir: SortDir, filter?: Gr ]; }; -export const filterSecrets = (secrets: DecryptedSecret[], filter: Filter) => +export const filterSecrets = (secrets: SecretV3RawSanitized[], filter: Filter) => secrets.filter(({ key, value, tags }) => { const isTagFilterActive = Boolean(Object.keys(filter.tags).length); const searchTerm = filter.searchFilter.toLowerCase(); return ( - (!isTagFilterActive || tags.some(({ id }) => filter.tags?.[id])) && + (!isTagFilterActive || tags?.some(({ id }) => filter.tags?.[id])) && (key.toLowerCase().includes(searchTerm) || value.toLowerCase().includes(searchTerm)) ); }); @@ -148,7 +152,7 @@ export const SecretListView = ({ environment, workspaceId, secretPath, - secretName: key, + secretKey: key, type, secretId }); @@ -160,12 +164,10 @@ export const SecretListView = ({ environment, workspaceId, secretPath, - secretName: key, - secretId, + secretKey: key, secretValue: value || "", type, - latestFileKey: decryptFileKey, - tags, + tagIds: tags, secretComment: comment, secretReminderRepeatDays: reminderRepeatDays, secretReminderNote: reminderNote, @@ -180,12 +182,11 @@ export const SecretListView = ({ environment, workspaceId, secretPath, - secretName: key, + secretKey: key, secretValue: value || "", secretComment: "", skipMultilineEncoding, - type, - latestFileKey: decryptFileKey + type }, {} ); @@ -193,8 +194,8 @@ export const SecretListView = ({ const handleSaveSecret = useCallback( async ( - orgSecret: DecryptedSecret, - modSecret: Omit & { tags: { id: string }[] }, + orgSecret: SecretV3RawSanitized, + modSecret: Omit & { tags?: { id: string }[] }, cb?: () => void ) => { const { key: oldKey } = orgSecret; @@ -288,7 +289,7 @@ export const SecretListView = ({ ); const handleSecretDelete = useCallback(async () => { - const { key, id: secretId } = popUp.deleteSecret?.data as DecryptedSecret; + const { key, id: secretId } = popUp.deleteSecret?.data as SecretV3RawSanitized; try { await handleSecretOperation("delete", SecretType.Shared, key, { secretId }); // wrap this in another function and then reuse @@ -317,16 +318,16 @@ export const SecretListView = ({ text: "Failed to delete secret" }); } - }, [(popUp.deleteSecret?.data as DecryptedSecret)?.key, environment, secretPath]); + }, [(popUp.deleteSecret?.data as SecretV3RawSanitized)?.key, environment, secretPath]); // for optimization on minimise re-rendering of secret items const onCreateTag = useCallback(() => handlePopUpOpen("createTag"), []); const onDeleteSecret = useCallback( - (sec: DecryptedSecret) => handlePopUpOpen("deleteSecret", sec), + (sec: SecretV3RawSanitized) => handlePopUpOpen("deleteSecret", sec), [] ); const onDetailViewSecret = useCallback( - (sec: DecryptedSecret) => handlePopUpOpen("secretDetail", sec), + (sec: SecretV3RawSanitized) => handlePopUpOpen("secretDetail", sec), [] ); @@ -380,7 +381,7 @@ export const SecretListView = ({ )} handlePopUpToggle("deleteSecret", isOpen)} onDeleteApproved={handleSecretDelete} @@ -392,7 +393,7 @@ export const SecretListView = ({ isOpen={popUp.secretDetail.isOpen} onToggle={(isOpen) => handlePopUpToggle("secretDetail", isOpen)} decryptFileKey={decryptFileKey} - secret={popUp.secretDetail.data as DecryptedSecret} + secret={popUp.secretDetail.data as SecretV3RawSanitized} onDeleteSecret={() => handlePopUpOpen("deleteSecret", popUp.secretDetail.data)} onClose={() => handlePopUpClose("secretDetail")} onSaveSecret={handleSaveSecret} diff --git a/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.utils.ts b/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.utils.ts index 1e1e4c7a8..0a3d22c8e 100644 --- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.utils.ts +++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.utils.ts @@ -52,6 +52,7 @@ export const formSchema = z.object({ }) .array() .default([]) + .optional() }); export type TFormSchema = z.infer; diff --git a/frontend/src/views/SecretMainPage/components/SnapshotView/SecretItem.tsx b/frontend/src/views/SecretMainPage/components/SnapshotView/SecretItem.tsx index a571ca5d3..2a7397ec9 100644 --- a/frontend/src/views/SecretMainPage/components/SnapshotView/SecretItem.tsx +++ b/frontend/src/views/SecretMainPage/components/SnapshotView/SecretItem.tsx @@ -21,7 +21,7 @@ import { Tr } from "@app/components/v2"; import { useToggle } from "@app/hooks"; -import { DecryptedSecret } from "@app/hooks/api/types"; +import { SecretV3RawSanitized } from "@app/hooks/api/secrets/types"; export enum TDiffModes { NoChange = "no change", @@ -32,8 +32,8 @@ export enum TDiffModes { type Props = { mode: TDiffModes; - preSecret?: DecryptedSecret; - postSecret: DecryptedSecret; + preSecret?: SecretV3RawSanitized; + postSecret: SecretV3RawSanitized; }; export type TDiffView = { mode: TDiffModes; @@ -120,9 +120,7 @@ export const SecretItem = ({ mode, preSecret, postSecret }: Props) => { Value {isModified && ( - + )} diff --git a/frontend/src/views/SecretMainPage/components/SnapshotView/SnapshotView.tsx b/frontend/src/views/SecretMainPage/components/SnapshotView/SnapshotView.tsx index ff95f321b..734159382 100644 --- a/frontend/src/views/SecretMainPage/components/SnapshotView/SnapshotView.tsx +++ b/frontend/src/views/SecretMainPage/components/SnapshotView/SnapshotView.tsx @@ -14,7 +14,7 @@ import { ProjectPermissionCan } from "@app/components/permissions"; import { Button, ContentLoader, Input, Tag, Tooltip } from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context"; import { useGetSnapshotSecrets, usePerformSecretRollback } from "@app/hooks/api"; -import { DecryptedSecret, TSecretFolder, UserWsKeyPair } from "@app/hooks/api/types"; +import { SecretV3RawSanitized, TSecretFolder, UserWsKeyPair } from "@app/hooks/api/types"; import { renderIcon, SecretItem, TDiffModes, TDiffView } from "./SecretItem"; @@ -24,7 +24,7 @@ type Props = { workspaceId: string; secretPath?: string; decryptFileKey: UserWsKeyPair; - secrets?: DecryptedSecret[]; + secrets?: SecretV3RawSanitized[]; folders?: TSecretFolder[]; snapshotCount?: number; onGoBack: () => void; @@ -33,7 +33,7 @@ type Props = { const LOADER_TEXT = ["Fetching your snapshot", "Creating the difference view"]; -const deepCompareSecrets = (lhs: DecryptedSecret, rhs: DecryptedSecret) => +const deepCompareSecrets = (lhs: SecretV3RawSanitized, rhs: SecretV3RawSanitized) => lhs.key === rhs.key && lhs.value === rhs.value && lhs.comment === rhs.comment && @@ -52,7 +52,6 @@ export const SnapshotView = ({ snapshotCount, onClickListSnapshot }: Props) => { - const [search, setSearch] = useState(""); const { mutateAsync: performRollback, isLoading: isRollingBack } = usePerformSecretRollback(); @@ -92,11 +91,11 @@ export const SnapshotView = ({ }, [folders, rollingFolder]); const secretDiffView = useMemo(() => { - const secretGroupById = secrets.reduce>( + const secretGroupById = secrets.reduce>( (prev, curr) => ({ ...prev, [curr.id]: curr }), {} ); - const diffView: Array> = []; + const diffView: Array> = []; rollingSecrets.forEach((rollSecret) => { const { id } = rollSecret; const doesExist = Boolean(secretGroupById?.[id]); diff --git a/frontend/src/views/SecretOverviewPage/SecretOverviewPage.tsx b/frontend/src/views/SecretOverviewPage/SecretOverviewPage.tsx index 73cc88555..c63620cf1 100644 --- a/frontend/src/views/SecretOverviewPage/SecretOverviewPage.tsx +++ b/frontend/src/views/SecretOverviewPage/SecretOverviewPage.tsx @@ -178,8 +178,7 @@ export const SecretOverviewPage = () => { } = useGetProjectSecretsAllEnv({ workspaceId, envs: userAvailableEnvs.map(({ slug }) => slug), - secretPath, - decryptFileKey: latestFileKey! + secretPath }); const { folders, folderNames, isFolderPresentInEnv, getFolderByNameAndEnv } = useGetFoldersByEnv({ @@ -190,7 +189,6 @@ export const SecretOverviewPage = () => { const { isImportedSecretPresentInEnv, getImportedSecretByKey } = useGetImportedSecretsAllEnvs({ projectId: workspaceId, - decryptFileKey: latestFileKey!, path: secretPath, environments: userAvailableEnvs.map(({ slug }) => slug) }); @@ -317,11 +315,10 @@ export const SecretOverviewPage = () => { environment: env, workspaceId, secretPath, - secretName: key, + secretKey: key, secretValue: value, secretComment: "", - type: SecretType.Shared, - latestFileKey: latestFileKey! + type: SecretType.Shared }); createNotification({ type: "success", @@ -348,19 +345,16 @@ export const SecretOverviewPage = () => { env: string, key: string, value: string, - type = SecretType.Shared, - secretId?: string + type = SecretType.Shared ) => { try { await updateSecretV3({ environment: env, workspaceId, secretPath, - secretId, - secretName: key, + secretKey: key, secretValue: value, - type, - latestFileKey: latestFileKey! + type }); createNotification({ type: "success", @@ -381,7 +375,7 @@ export const SecretOverviewPage = () => { environment: env, workspaceId, secretPath, - secretName: key, + secretKey: key, secretId, type: SecretType.Shared }); @@ -861,7 +855,6 @@ export const SecretOverviewPage = () => { getSecretByKey={getSecretByKey} onTogglePopUp={(isOpen) => handlePopUpToggle("addSecretsInAllEnvs", isOpen)} onClose={() => handlePopUpClose("addSecretsInAllEnvs")} - decryptFileKey={latestFileKey!} /> ; type Props = { secretPath?: string; - decryptFileKey: UserWsKeyPair; - getSecretByKey: (slug: string, key: string) => DecryptedSecret | undefined; + getSecretByKey: (slug: string, key: string) => SecretV3RawSanitized | undefined; // modal props isOpen?: boolean; onClose: () => void; @@ -44,7 +43,6 @@ type Props = { export const CreateSecretForm = ({ secretPath = "/", - decryptFileKey, isOpen, getSecretByKey, onClose, @@ -101,10 +99,9 @@ export const CreateSecretForm = ({ environment, workspaceId, secretPath, - secretName: key, + secretKey: key, secretValue: value || "", - type: SecretType.Shared, - latestFileKey: decryptFileKey + type: SecretType.Shared }); } @@ -112,11 +109,10 @@ export const CreateSecretForm = ({ environment, workspaceId, secretPath, - secretName: key, + secretKey: key, secretValue: value || "", secretComment: "", - type: SecretType.Shared, - latestFileKey: decryptFileKey + type: SecretType.Shared }); }); diff --git a/frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretOverviewTableRow.tsx b/frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretOverviewTableRow.tsx index 8cf1723cc..6c6dc9662 100644 --- a/frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretOverviewTableRow.tsx +++ b/frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretOverviewTableRow.tsx @@ -13,7 +13,7 @@ import { twMerge } from "tailwind-merge"; import { Button, Checkbox, TableContainer, Td, Tooltip, Tr } from "@app/components/v2"; import { useToggle } from "@app/hooks"; -import { DecryptedSecret, SecretType } from "@app/hooks/api/secrets/types"; +import { SecretType,SecretV3RawSanitized } from "@app/hooks/api/secrets/types"; import { WorkspaceEnv } from "@app/hooks/api/types"; import { SecretEditRow } from "./SecretEditRow"; @@ -26,7 +26,7 @@ type Props = { expandableColWidth: number; isSelected: boolean; onToggleSecretSelect: (key: string) => void; - getSecretByKey: (slug: string, key: string) => DecryptedSecret | undefined; + getSecretByKey: (slug: string, key: string) => SecretV3RawSanitized | undefined; onSecretCreate: (env: string, key: string, value: string) => Promise; onSecretUpdate: ( env: string, @@ -40,7 +40,7 @@ type Props = { getImportedSecretByKey: ( env: string, secretName: string - ) => { secret?: DecryptedSecret; environmentInfo?: WorkspaceEnv } | undefined; + ) => { secret?: SecretV3RawSanitized; environmentInfo?: WorkspaceEnv } | undefined; }; export const SecretOverviewTableRow = ({ diff --git a/frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretRenameRow.tsx b/frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretRenameRow.tsx index e5488ab9f..4eda53b8a 100644 --- a/frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretRenameRow.tsx +++ b/frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretRenameRow.tsx @@ -17,15 +17,15 @@ import { useWorkspace } from "@app/context"; import { useToggle } from "@app/hooks"; -import { useGetUserWsKey, useUpdateSecretV3 } from "@app/hooks/api"; -import { DecryptedSecret, SecretType } from "@app/hooks/api/types"; +import { useUpdateSecretV3 } from "@app/hooks/api"; +import { SecretType,SecretV3RawSanitized } from "@app/hooks/api/types"; import { SecretActionType } from "@app/views/SecretMainPage/components/SecretListView/SecretListView.utils"; type Props = { secretKey: string; secretPath: string; environments: { name: string; slug: string }[]; - getSecretByKey: (slug: string, key: string) => DecryptedSecret | undefined; + getSecretByKey: (slug: string, key: string) => SecretV3RawSanitized | undefined; }; export const formSchema = z.object({ @@ -64,8 +64,6 @@ function SecretRenameRow({ environments, getSecretByKey, secretKey, secretPath } ); const workspaceId = currentWorkspace?.id || ""; - const { data: decryptFileKey } = useGetUserWsKey(workspaceId); - const [isSecNameCopied, setIsSecNameCopied] = useToggle(false); const { mutateAsync: updateSecretV3 } = useUpdateSecretV3(); @@ -109,12 +107,10 @@ function SecretRenameRow({ environments, getSecretByKey, secretKey, secretPath } environment: secret?.env, workspaceId, secretPath, - secretName: secret.key, - secretId: secret.id, + secretKey: secret.key, secretValue: secret.value || "", type: SecretType.Shared, - latestFileKey: decryptFileKey!, - tags: secret.tags.map((tag) => tag.id), + tagIds: secret.tags?.map((tag) => tag.id), secretComment: secret.comment, secretReminderRepeatDays: secret.reminderRepeatDays, secretReminderNote: secret.reminderNote, diff --git a/frontend/src/views/SecretOverviewPage/components/SelectionPanel/SelectionPanel.tsx b/frontend/src/views/SecretOverviewPage/components/SelectionPanel/SelectionPanel.tsx index bddaa9f03..f44095bfc 100644 --- a/frontend/src/views/SecretOverviewPage/components/SelectionPanel/SelectionPanel.tsx +++ b/frontend/src/views/SecretOverviewPage/components/SelectionPanel/SelectionPanel.tsx @@ -14,8 +14,8 @@ import { import { usePopUp } from "@app/hooks"; import { useDeleteFolder, useDeleteSecretBatch } from "@app/hooks/api"; import { - DecryptedSecret, SecretType, + SecretV3RawSanitized, TDeleteSecretBatchDTO, TSecretFolder } from "@app/hooks/api/types"; @@ -27,7 +27,7 @@ export enum EntryType { type Props = { secretPath: string; - getSecretByKey: (slug: string, key: string) => DecryptedSecret | undefined; + getSecretByKey: (slug: string, key: string) => SecretV3RawSanitized | undefined; getFolderByNameAndEnv: (name: string, env: string) => TSecretFolder | undefined; resetSelectedEntries: () => void; selectedEntries: { @@ -115,7 +115,7 @@ export const SelectionPanel = ({ return [ ...accum, { - secretName: entry.key, + secretKey: entry.key, type: SecretType.Shared } ]; diff --git a/frontend/src/views/SecretRotationPage/components/CreateRotationForm/steps/RotationOutputForm.tsx b/frontend/src/views/SecretRotationPage/components/CreateRotationForm/steps/RotationOutputForm.tsx index 3ddacf5b4..dab99faac 100644 --- a/frontend/src/views/SecretRotationPage/components/CreateRotationForm/steps/RotationOutputForm.tsx +++ b/frontend/src/views/SecretRotationPage/components/CreateRotationForm/steps/RotationOutputForm.tsx @@ -5,7 +5,7 @@ import { z } from "zod"; import { Button, FormControl, Input, Select, SelectItem, Spinner } from "@app/components/v2"; import { SecretPathInput } from "@app/components/v2/SecretPathInput"; import { useWorkspace } from "@app/context"; -import { useGetProjectSecrets, useGetUserWsKey } from "@app/hooks/api"; +import { useGetProjectSecrets } from "@app/hooks/api"; const formSchema = z.object({ environment: z.string().trim(), @@ -38,12 +38,10 @@ export const RotationOutputForm = ({ onSubmit, onCancel, outputSchema = {} }: Pr const secretPath = watch("secretPath"); const selectedSecrets = watch("secrets"); - const { data: userWsKey } = useGetUserWsKey(workspaceId); const { data: secrets, isLoading: isSecretsLoading } = useGetProjectSecrets({ workspaceId, environment, - secretPath, - decryptFileKey: userWsKey! + secretPath }); return ( From cb132f4c655ea3f107438da3aa0e990a938ca0a5 Mon Sep 17 00:00:00 2001 From: = Date: Tue, 16 Jul 2024 12:53:08 +0530 Subject: [PATCH 04/77] fix: resolving undefined secret key --- backend/src/server/routes/v3/secret-router.ts | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index d19e89547..b24bef1a0 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -1844,9 +1844,9 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { metadata: { environment: req.body.environment, secretPath: req.body.secretPath, - secrets: secrets.map((secret, i) => ({ + secrets: secrets.map((secret) => ({ secretId: secret.id, - secretKey: inputSecrets[i].secretKey, + secretKey: secret.secretKey, secretVersion: secret.version })) } @@ -1942,9 +1942,9 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { metadata: { environment: req.body.environment, secretPath: req.body.secretPath, - secrets: secrets.map((secret, i) => ({ + secrets: secrets.map((secret) => ({ secretId: secret.id, - secretKey: inputSecrets[i].secretKey, + secretKey: secret.secretKey, secretVersion: secret.version })) } @@ -2027,9 +2027,9 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { metadata: { environment: req.body.environment, secretPath: req.body.secretPath, - secrets: secrets.map((secret, i) => ({ + secrets: secrets.map((secret) => ({ secretId: secret.id, - secretKey: inputSecrets[i].secretKey, + secretKey: secret.secretKey, secretVersion: secret.version })) } From 937b0c0a7c6b8847b51162190e59212fafa740f8 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 16 Jul 2024 02:21:14 +0800 Subject: [PATCH 05/77] feat: added initial aws form --- .../AddExternalKmsForm/AddExternalKmsForm.tsx | 100 +++++++++ .../AddExternalKmsForm/AwsKmsForm.tsx | 191 ++++++++++++++++++ .../AddExternalKmsForm/index.tsx | 1 + .../OrgEncryptionTab/OrgEncryptionTab.tsx | 60 ++++++ .../components/OrgEncryptionTab/index.tsx | 1 + .../components/OrgTabGroup/OrgTabGroup.tsx | 10 +- 6 files changed, 361 insertions(+), 2 deletions(-) create mode 100644 frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx create mode 100644 frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx create mode 100644 frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/index.tsx create mode 100644 frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx create mode 100644 frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/index.tsx diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx new file mode 100644 index 000000000..f6ee93ef2 --- /dev/null +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx @@ -0,0 +1,100 @@ +import { useState } from "react"; +import { faAws } from "@fortawesome/free-brands-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; +import { AnimatePresence, motion } from "framer-motion"; + +import { Modal, ModalContent } from "@app/components/v2"; + +import { AwsKmsForm } from "./AwsKmsForm"; + +type Props = { + isOpen?: boolean; + onToggle: (isOpen: boolean) => void; +}; + +enum WizardSteps { + SelectProvider = "select-provider", + ProviderInputs = "provider-inputs" +} + +enum ExternalKmsProvider { + AWS = "aws" +} + +const EXTERNAL_KMS_LIST = [ + { + icon: faAws, + provider: ExternalKmsProvider.AWS, + title: "AWS KMS" + } +]; + +export const AddExternalKmsForm = ({ isOpen, onToggle }: Props) => { + const [wizardStep, setWizardStep] = useState(WizardSteps.SelectProvider); + const [selectedProvider, setSelectedProvider] = useState(null); + + const handleFormReset = (state: boolean = false) => { + onToggle(state); + setWizardStep(WizardSteps.SelectProvider); + setSelectedProvider(null); + }; + + return ( + handleFormReset(state)}> + + + {wizardStep === WizardSteps.SelectProvider && ( + +
Select a KMS Provider
+
+ {EXTERNAL_KMS_LIST.map(({ icon, provider, title }) => ( +
{ + setSelectedProvider(provider); + setWizardStep(WizardSteps.ProviderInputs); + }} + onKeyDown={(evt) => { + if (evt.key === "Enter") { + setSelectedProvider(provider); + setWizardStep(WizardSteps.ProviderInputs); + } + }} + > + +
{title}
+
+ ))} +
+
+ )} + {wizardStep === WizardSteps.ProviderInputs && + selectedProvider === ExternalKmsProvider.AWS && ( + + + + )} +
+
+
+ ); +}; diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx new file mode 100644 index 000000000..40373572b --- /dev/null +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx @@ -0,0 +1,191 @@ +import { Controller, useForm } from "react-hook-form"; +import { zodResolver } from "@hookform/resolvers/zod"; +import { z } from "zod"; + +import { FormControl, Input, Select, SelectItem } from "@app/components/v2"; + +const AWS_REGIONS = [ + { name: "US East (Ohio)", slug: "us-east-2" }, + { name: "US East (N. Virginia)", slug: "us-east-1" }, + { name: "US West (N. California)", slug: "us-west-1" }, + { name: "US West (Oregon)", slug: "us-west-2" }, + { name: "Africa (Cape Town)", slug: "af-south-1" }, + { name: "Asia Pacific (Hong Kong)", slug: "ap-east-1" }, + { name: "Asia Pacific (Hyderabad)", slug: "ap-south-2" }, + { name: "Asia Pacific (Jakarta)", slug: "ap-southeast-3" }, + { name: "Asia Pacific (Melbourne)", slug: "ap-southeast-4" }, + { name: "Asia Pacific (Mumbai)", slug: "ap-south-1" }, + { name: "Asia Pacific (Osaka)", slug: "ap-northeast-3" }, + { name: "Asia Pacific (Seoul)", slug: "ap-northeast-2" }, + { name: "Asia Pacific (Singapore)", slug: "ap-southeast-1" }, + { name: "Asia Pacific (Sydney)", slug: "ap-southeast-2" }, + { name: "Asia Pacific (Tokyo)", slug: "ap-northeast-1" }, + { name: "Canada (Central)", slug: "ca-central-1" }, + { name: "Europe (Frankfurt)", slug: "eu-central-1" }, + { name: "Europe (Ireland)", slug: "eu-west-1" }, + { name: "Europe (London)", slug: "eu-west-2" }, + { name: "Europe (Milan)", slug: "eu-south-1" }, + { name: "Europe (Paris)", slug: "eu-west-3" }, + { name: "Europe (Spain)", slug: "eu-south-2" }, + { name: "Europe (Stockholm)", slug: "eu-north-1" }, + { name: "Europe (Zurich)", slug: "eu-central-2" }, + { name: "Middle East (Bahrain)", slug: "me-south-1" }, + { name: "Middle East (UAE)", slug: "me-central-1" }, + { name: "South America (Sao Paulo)", slug: "sa-east-1" }, + { name: "AWS GovCloud (US-East)", slug: "us-gov-east-1" }, + { name: "AWS GovCloud (US-West)", slug: "us-gov-west-1" } +]; + +export enum KmsAwsCredentialType { + AssumeRole = "assume-role", + AccessKey = "access-key" +} + +const formSchema = z.object({ + credential: z.discriminatedUnion("type", [ + z.object({ + type: z.literal(KmsAwsCredentialType.AccessKey), + data: z.object({ + accessKey: z.string().trim().min(1), + secretKey: z.string().trim().min(1) + }) + }), + z.object({ + type: z.literal(KmsAwsCredentialType.AssumeRole), + data: z.object({ + assumeRoleArn: z.string().trim().min(1), + externalId: z.string().trim().min(1).optional() + }) + }) + ]), + awsRegion: z.string().min(1).trim().describe("AWS region to connect"), + kmsKeyId: z.string().trim().optional() +}); + +type TForm = z.infer; + +export const AwsKmsForm = () => { + const { control, handleSubmit, watch } = useForm({ + resolver: zodResolver(formSchema) + }); + + const selectedAwsAuthType = watch("credential.type"); + + const handleAddAwsKms = () => {}; + + return ( +
+ ( + + + + )} + /> + + {selectedAwsAuthType === KmsAwsCredentialType.AccessKey ? ( + <> + ( + + + + )} + /> + ( + + + + )} + /> + + ) : ( + <> + ( + + + + )} + /> + ( + + + + )} + /> + + )} + ( + + + + )} + /> + ( + + + + )} + /> + + ); +}; diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/index.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/index.tsx new file mode 100644 index 000000000..53bdefd3c --- /dev/null +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/index.tsx @@ -0,0 +1 @@ +export { AddExternalKmsForm } from "./AddExternalKmsForm"; diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx new file mode 100644 index 000000000..da3ed0b07 --- /dev/null +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx @@ -0,0 +1,60 @@ +import { faPlus } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; + +import { Button, UpgradePlanModal } from "@app/components/v2"; +import { + OrgPermissionActions, + OrgPermissionSubjects, + useOrganization, + useSubscription +} from "@app/context"; +import { withPermission } from "@app/hoc"; +import { usePopUp } from "@app/hooks"; + +import { AddExternalKmsForm } from "./AddExternalKmsForm"; + +export const OrgEncryptionTab = withPermission( + () => { + const { currentOrg } = useOrganization(); + const orgId = currentOrg?.id || ""; + const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([ + "upgradePlan", + "addExternalKMS" + ] as const); + const { subscription } = useSubscription(); + + return ( +
+
+

Encryption

+ +
+

+ Configure the Key Management System used for encrypting/decrypting your data at rest +

+ handlePopUpToggle("upgradePlan", isOpen)} + text="You can add audit log streams if you switch to Infisical's Enterprise plan." + /> + handlePopUpToggle("addExternalKMS", state)} + /> +
+ ); + }, + { action: OrgPermissionActions.Edit, subject: OrgPermissionSubjects.Settings } +); diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/index.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/index.tsx new file mode 100644 index 000000000..c32c02d76 --- /dev/null +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/index.tsx @@ -0,0 +1 @@ +export { OrgEncryptionTab } from "./OrgEncryptionTab"; diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgTabGroup/OrgTabGroup.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgTabGroup/OrgTabGroup.tsx index fdf541c54..3894bb28f 100644 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgTabGroup/OrgTabGroup.tsx +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgTabGroup/OrgTabGroup.tsx @@ -3,11 +3,13 @@ import { Tab } from "@headlessui/react"; import { AuditLogStreamsTab } from "../AuditLogStreamTab"; import { OrgAuthTab } from "../OrgAuthTab"; +import { OrgEncryptionTab } from "../OrgEncryptionTab"; import { OrgGeneralTab } from "../OrgGeneralTab"; const tabs = [ { name: "General", key: "tab-org-general" }, { name: "Security", key: "tab-org-security" }, + { name: "Encryption", key: "tab-org-encryption" }, { name: "Audit Log Streams", key: "tag-audit-log-streams" } ]; export const OrgTabGroup = () => { @@ -19,8 +21,9 @@ export const OrgTabGroup = () => { {({ selected }) => ( @@ -35,6 +38,9 @@ export const OrgTabGroup = () => { + + + From 9c4bb79472233f595c2cdcfeffc54cec53015b0c Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 16 Jul 2024 14:17:54 +0800 Subject: [PATCH 06/77] misc: connected aws add kms --- backend/src/ee/routes/v1/index.ts | 5 ++ frontend/src/hooks/api/kms/index.tsx | 1 + frontend/src/hooks/api/kms/mutations.tsx | 53 ++++++++++++ .../AddExternalKmsForm/AddExternalKmsForm.tsx | 2 +- .../AddExternalKmsForm/AwsKmsForm.tsx | 84 +++++++++++++++++-- 5 files changed, 139 insertions(+), 6 deletions(-) create mode 100644 frontend/src/hooks/api/kms/index.tsx create mode 100644 frontend/src/hooks/api/kms/mutations.tsx diff --git a/backend/src/ee/routes/v1/index.ts b/backend/src/ee/routes/v1/index.ts index 6bd9176d8..1892bd5e8 100644 --- a/backend/src/ee/routes/v1/index.ts +++ b/backend/src/ee/routes/v1/index.ts @@ -4,6 +4,7 @@ import { registerAuditLogStreamRouter } from "./audit-log-stream-router"; import { registerCaCrlRouter } from "./certificate-authority-crl-router"; import { registerDynamicSecretLeaseRouter } from "./dynamic-secret-lease-router"; import { registerDynamicSecretRouter } from "./dynamic-secret-router"; +import { registerExternalKmsRouter } from "./external-kms-router"; import { registerGroupRouter } from "./group-router"; import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router"; import { registerLdapRouter } from "./ldap-router"; @@ -87,4 +88,8 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => { }, { prefix: "/additional-privilege" } ); + + await server.register(registerExternalKmsRouter, { + prefix: "/external-kms" + }); }; diff --git a/frontend/src/hooks/api/kms/index.tsx b/frontend/src/hooks/api/kms/index.tsx new file mode 100644 index 000000000..c702ecaf6 --- /dev/null +++ b/frontend/src/hooks/api/kms/index.tsx @@ -0,0 +1 @@ +export { useAddAwsExternalKms } from "./mutations"; diff --git a/frontend/src/hooks/api/kms/mutations.tsx b/frontend/src/hooks/api/kms/mutations.tsx new file mode 100644 index 000000000..ee778198c --- /dev/null +++ b/frontend/src/hooks/api/kms/mutations.tsx @@ -0,0 +1,53 @@ +import { useMutation } from "@tanstack/react-query"; + +import { apiRequest } from "@app/config/request"; + +export const useAddAwsExternalKms = () => { + return useMutation({ + mutationFn: async ({ + slug, + description, + credentialType, + accessKey, + secretKey, + assumeRoleArn, + externalId, + awsRegion, + kmsKeyId + }: { + slug: string; + description: string; + credentialType: string; + accessKey?: string; + secretKey?: string; + assumeRoleArn?: string; + externalId?: string; + awsRegion: string; + kmsKeyId?: string; + }) => { + const { data } = await apiRequest.post("/api/v1/external-kms", { + slug, + description, + provider: { + type: "aws", + inputs: { + credential: { + type: credentialType, + data: { + accessKey, + secretKey, + assumeRoleArn, + externalId + } + }, + awsRegion, + kmsKeyId + } + } + }); + + return data; + }, + onSuccess() {} + }); +}; diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx index f6ee93ef2..30d061028 100644 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx @@ -90,7 +90,7 @@ export const AddExternalKmsForm = ({ isOpen, onToggle }: Props) => { animate={{ opacity: 1, translateX: 0 }} exit={{ opacity: 0, translateX: -30 }} > - + {}} onCompleted={() => {}} /> )} diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx index 40373572b..812637279 100644 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx @@ -1,8 +1,11 @@ import { Controller, useForm } from "react-hook-form"; import { zodResolver } from "@hookform/resolvers/zod"; +import slugify from "@sindresorhus/slugify"; import { z } from "zod"; -import { FormControl, Input, Select, SelectItem } from "@app/components/v2"; +import { createNotification } from "@app/components/notifications"; +import { Button, FormControl, Input, Select, SelectItem } from "@app/components/v2"; +import { useAddAwsExternalKms } from "@app/hooks/api/kms"; const AWS_REGIONS = [ { name: "US East (Ohio)", slug: "us-east-2" }, @@ -42,6 +45,14 @@ export enum KmsAwsCredentialType { } const formSchema = z.object({ + slug: z + .string() + .trim() + .min(1) + .refine((v) => slugify(v) === v, { + message: "Slug must be a valid slug" + }), + description: z.string().trim().min(1).default(""), credential: z.discriminatedUnion("type", [ z.object({ type: z.literal(KmsAwsCredentialType.AccessKey), @@ -58,23 +69,78 @@ const formSchema = z.object({ }) }) ]), - awsRegion: z.string().min(1).trim().describe("AWS region to connect"), + awsRegion: z.string().min(1).trim(), kmsKeyId: z.string().trim().optional() }); type TForm = z.infer; -export const AwsKmsForm = () => { - const { control, handleSubmit, watch } = useForm({ +type Props = { + onCompleted: () => void; + onCancel: () => void; +}; + +export const AwsKmsForm = ({ onCompleted, onCancel }: Props) => { + const { + control, + handleSubmit, + watch, + formState: { isSubmitting } + } = useForm({ resolver: zodResolver(formSchema) }); const selectedAwsAuthType = watch("credential.type"); - const handleAddAwsKms = () => {}; + const { mutateAsync: addAwsExternalKms } = useAddAwsExternalKms(); + + const handleAddAwsKms = async (data: TForm) => { + const { slug, description, credential, awsRegion, kmsKeyId } = data; + await addAwsExternalKms({ + slug, + description, + credentialType: credential.type, + awsRegion, + kmsKeyId, + ...(credential.type === KmsAwsCredentialType.AccessKey + ? { + accessKey: credential.data.accessKey, + secretKey: credential.data.secretKey + } + : { + assumeRoleArn: credential.data.assumeRoleArn, + externalId: credential.data.externalId + }) + }); + + createNotification({ + text: "Successfully added AWS External KMS", + type: "success" + }); + + onCompleted(); + }; return (
+ ( + + + + )} + /> + ( + + + + )} + /> { )} /> +
+ + +
); }; From 5eafdba6c87ca59bb579e5a7664432f4b510895e Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 16 Jul 2024 14:19:51 +0800 Subject: [PATCH 07/77] Merge remote-tracking branch 'akhilmhdh/feat/aws-kms-sm' into feat/integrate-external-kms From 26a5d74b140fdbc2acc63f999f8636fca7b79440 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 16 Jul 2024 15:52:29 +0800 Subject: [PATCH 08/77] misc: modified encryption/decryption of external kms config --- .../20240716063111_add-org-kms-data-key.ts | 21 ++++++++ backend/src/db/schemas/organizations.ts | 5 +- .../external-kms/external-kms-service.ts | 38 +++++++++------ backend/src/services/kms/kms-service.ts | 48 ++++++++++++++++++- 4 files changed, 95 insertions(+), 17 deletions(-) create mode 100644 backend/src/db/migrations/20240716063111_add-org-kms-data-key.ts diff --git a/backend/src/db/migrations/20240716063111_add-org-kms-data-key.ts b/backend/src/db/migrations/20240716063111_add-org-kms-data-key.ts new file mode 100644 index 000000000..13e6a1ef6 --- /dev/null +++ b/backend/src/db/migrations/20240716063111_add-org-kms-data-key.ts @@ -0,0 +1,21 @@ +import { Knex } from "knex"; + +import { TableName } from "../schemas"; + +export async function up(knex: Knex): Promise { + const hasKmsDataKeyCol = await knex.schema.hasColumn(TableName.Organization, "kmsEncryptedDataKey"); + await knex.schema.alterTable(TableName.Organization, (tb) => { + if (!hasKmsDataKeyCol) { + tb.binary("kmsEncryptedDataKey"); + } + }); +} + +export async function down(knex: Knex): Promise { + const hasKmsDataKeyCol = await knex.schema.hasColumn(TableName.Organization, "kmsEncryptedDataKey"); + await knex.schema.alterTable(TableName.Organization, (t) => { + if (hasKmsDataKeyCol) { + t.dropColumn("kmsEncryptedDataKey"); + } + }); +} diff --git a/backend/src/db/schemas/organizations.ts b/backend/src/db/schemas/organizations.ts index 7b7a004fc..aa63423c9 100644 --- a/backend/src/db/schemas/organizations.ts +++ b/backend/src/db/schemas/organizations.ts @@ -5,6 +5,8 @@ import { z } from "zod"; +import { zodBuffer } from "@app/lib/zod"; + import { TImmutableDBKeys } from "./models"; export const OrganizationsSchema = z.object({ @@ -16,7 +18,8 @@ export const OrganizationsSchema = z.object({ updatedAt: z.date(), authEnforced: z.boolean().default(false).nullable().optional(), scimEnabled: z.boolean().default(false).nullable().optional(), - kmsDefaultKeyId: z.string().uuid().nullable().optional() + kmsDefaultKeyId: z.string().uuid().nullable().optional(), + kmsEncryptedDataKey: zodBuffer.nullable().optional() }); export type TOrganizations = z.infer; diff --git a/backend/src/ee/services/external-kms/external-kms-service.ts b/backend/src/ee/services/external-kms/external-kms-service.ts index a2d314844..36e995b9e 100644 --- a/backend/src/ee/services/external-kms/external-kms-service.ts +++ b/backend/src/ee/services/external-kms/external-kms-service.ts @@ -22,7 +22,10 @@ import { ExternalKmsAwsSchema, KmsProviders } from "./providers/model"; type TExternalKmsServiceFactoryDep = { externalKmsDAL: TExternalKmsDALFactory; - kmsService: Pick; + kmsService: Pick< + TKmsServiceFactory, + "getOrgKmsKeyId" | "decryptWithInputKey" | "encryptWithInputKey" | "getOrgKmsDataKey" + >; kmsDAL: Pick; permissionService: Pick; }; @@ -69,10 +72,11 @@ export const externalKmsServiceFactory = ({ throw new BadRequestError({ message: "external kms provided is invalid" }); } - const orgKmsKeyId = await kmsService.getOrgKmsKeyId(actorOrgId); - const kmsEncryptor = await kmsService.encryptWithKmsKey({ - kmsId: orgKmsKeyId + const orgKmsDataKey = await kmsService.getOrgKmsDataKey(actorOrgId); + const kmsEncryptor = await kmsService.encryptWithInputKey({ + key: orgKmsDataKey }); + const { cipherTextBlob: encryptedProviderInputs } = kmsEncryptor({ plainText: Buffer.from(sanitizedProviderInput, "utf8") }); @@ -125,12 +129,13 @@ export const externalKmsServiceFactory = ({ const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); - const orgDefaultKmsId = await kmsService.getOrgKmsKeyId(kmsDoc.orgId); let sanitizedProviderInput = ""; if (provider) { - const kmsDecryptor = await kmsService.decryptWithKmsKey({ - kmsId: orgDefaultKmsId + const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId); + const kmsDecryptor = await kmsService.decryptWithInputKey({ + key: orgKmsDataKey }); + const decryptedProviderInputBlob = kmsDecryptor({ cipherTextBlob: externalKmsDoc.encryptedProviderInputs }); @@ -154,8 +159,9 @@ export const externalKmsServiceFactory = ({ let encryptedProviderInputs: Buffer | undefined; if (sanitizedProviderInput) { - const kmsEncryptor = await kmsService.encryptWithKmsKey({ - kmsId: orgDefaultKmsId + const orgKmsDataKey = await kmsService.getOrgKmsDataKey(actorOrgId); + const kmsEncryptor = await kmsService.encryptWithInputKey({ + key: orgKmsDataKey }); const { cipherTextBlob } = kmsEncryptor({ plainText: Buffer.from(sanitizedProviderInput, "utf8") @@ -239,10 +245,11 @@ export const externalKmsServiceFactory = ({ const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); - const orgDefaultKmsId = await kmsService.getOrgKmsKeyId(kmsDoc.orgId); - const kmsDecryptor = await kmsService.decryptWithKmsKey({ - kmsId: orgDefaultKmsId + const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId); + const kmsDecryptor = await kmsService.decryptWithInputKey({ + key: orgKmsDataKey }); + const decryptedProviderInputBlob = kmsDecryptor({ cipherTextBlob: externalKmsDoc.encryptedProviderInputs }); @@ -278,10 +285,11 @@ export const externalKmsServiceFactory = ({ const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); - const orgDefaultKmsId = await kmsService.getOrgKmsKeyId(kmsDoc.orgId); - const kmsDecryptor = await kmsService.decryptWithKmsKey({ - kmsId: orgDefaultKmsId + const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId); + const kmsDecryptor = await kmsService.decryptWithInputKey({ + key: orgKmsDataKey }); + const decryptedProviderInputBlob = kmsDecryptor({ cipherTextBlob: externalKmsDoc.encryptedProviderInputs }); diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index bc22f04ab..d8597af77 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -1,3 +1,5 @@ +import crypto from "node:crypto"; + import slugify from "@sindresorhus/slugify"; import { Knex } from "knex"; @@ -166,6 +168,50 @@ export const kmsServiceFactory = ({ return keyId; }; + const getOrgKmsDataKey = async (orgId: string) => { + const kmsKeyId = await getOrgKmsKeyId(orgId); + const orgKmsDataKey = await orgDAL.transaction(async (tx) => { + const org = await orgDAL.findById(orgId, tx); + + if (!org) { + throw new BadRequestError({ message: "Org not found" }); + } + + let encryptedDataKey = org.kmsEncryptedDataKey; + if (!encryptedDataKey) { + const dataKey = crypto.randomBytes(32); + const kmsEncryptor = await encryptWithKmsKey({ + kmsId: kmsKeyId + }); + + const { cipherTextBlob } = kmsEncryptor({ + plainText: dataKey + }); + + encryptedDataKey = cipherTextBlob; + await orgDAL.updateById( + org.id, + { + kmsEncryptedDataKey: encryptedDataKey + }, + tx + ); + + return dataKey; + } + + const kmsDecryptor = await decryptWithKmsKey({ + kmsId: kmsKeyId + }); + + return kmsDecryptor({ + cipherTextBlob: encryptedDataKey + }); + }); + + return orgKmsDataKey; + }; + const getProjectSecretManagerKmsKeyId = async (projectId: string) => { let project = await projectDAL.findById(projectId); if (!project) { @@ -337,6 +383,6 @@ export const kmsServiceFactory = ({ decryptWithInputKey, getOrgKmsKeyId, getProjectSecretManagerKmsKeyId, - getProjectSecretManagerKmsDataKey + getOrgKmsDataKey }; }; From dd46a210359c105bae04879646c4d4ead3aff691 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 16 Jul 2024 21:29:20 +0800 Subject: [PATCH 09/77] feat: finalized kms settings in org-level --- .../src/ee/routes/v1/external-kms-router.ts | 42 +++++ .../services/external-kms/external-kms-dal.ts | 2 + frontend/src/hooks/api/index.tsx | 1 + frontend/src/hooks/api/kms/index.tsx | 3 +- frontend/src/hooks/api/kms/mutations.tsx | 81 +++++++++- frontend/src/hooks/api/kms/queries.tsx | 35 +++++ frontend/src/hooks/api/kms/types.ts | 31 ++++ .../AddExternalKmsForm.tsx | 7 +- .../AddExternalKmsForm/index.tsx | 1 - .../{AddExternalKmsForm => }/AwsKmsForm.tsx | 111 ++++++++++---- .../OrgEncryptionTab/OrgEncryptionTab.tsx | 144 ++++++++++++++++-- .../UpdateExternalKmsForm.tsx | 29 ++++ 12 files changed, 435 insertions(+), 52 deletions(-) create mode 100644 frontend/src/hooks/api/kms/queries.tsx create mode 100644 frontend/src/hooks/api/kms/types.ts rename frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/{AddExternalKmsForm => }/AddExternalKmsForm.tsx (95%) delete mode 100644 frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/index.tsx rename frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/{AddExternalKmsForm => }/AwsKmsForm.tsx (73%) create mode 100644 frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/UpdateExternalKmsForm.tsx diff --git a/backend/src/ee/routes/v1/external-kms-router.ts b/backend/src/ee/routes/v1/external-kms-router.ts index 712b8b456..233edd968 100644 --- a/backend/src/ee/routes/v1/external-kms-router.ts +++ b/backend/src/ee/routes/v1/external-kms-router.ts @@ -19,6 +19,23 @@ const sanitizedExternalSchema = KmsKeysSchema.extend({ }) }); +const sanitizedExternalSchemaForGetAll = KmsKeysSchema.pick({ + id: true, + description: true, + isDisabled: true, + createdAt: true, + updatedAt: true, + slug: true +}) + .extend({ + externalKms: ExternalKmsSchema.pick({ + provider: true, + status: true, + statusDetails: true + }) + }) + .array(); + const sanitizedExternalSchemaForGetById = KmsKeysSchema.extend({ external: ExternalKmsSchema.pick({ id: true, @@ -159,6 +176,31 @@ export const registerExternalKmsRouter = async (server: FastifyZodProvider) => { } }); + server.route({ + method: "GET", + url: "/", + config: { + rateLimit: readLimit + }, + schema: { + response: { + 200: z.object({ + externalKmsList: sanitizedExternalSchemaForGetAll + }) + } + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + handler: async (req) => { + const externalKmsList = await server.services.externalKms.list({ + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId + }); + return { externalKmsList }; + } + }); + server.route({ method: "GET", url: "/slug/:slug", diff --git a/backend/src/ee/services/external-kms/external-kms-dal.ts b/backend/src/ee/services/external-kms/external-kms-dal.ts index bb9a6ce8d..7077b4aa9 100644 --- a/backend/src/ee/services/external-kms/external-kms-dal.ts +++ b/backend/src/ee/services/external-kms/external-kms-dal.ts @@ -31,6 +31,8 @@ export const externalKmsDALFactory = (db: TDbClient) => { isReserved: el.isReserved, orgId: el.orgId, slug: el.slug, + createdAt: el.createdAt, + updatedAt: el.updatedAt, externalKms: { id: el.externalKmsId, provider: el.externalKmsProvider, diff --git a/frontend/src/hooks/api/index.tsx b/frontend/src/hooks/api/index.tsx index 08e0b59ba..ea3e7f560 100644 --- a/frontend/src/hooks/api/index.tsx +++ b/frontend/src/hooks/api/index.tsx @@ -16,6 +16,7 @@ export * from "./incidentContacts"; export * from "./integrationAuth"; export * from "./integrations"; export * from "./keys"; +export * from "./kms"; export * from "./ldapConfig"; export * from "./oidcConfig"; export * from "./organization"; diff --git a/frontend/src/hooks/api/kms/index.tsx b/frontend/src/hooks/api/kms/index.tsx index c702ecaf6..9c00dae9f 100644 --- a/frontend/src/hooks/api/kms/index.tsx +++ b/frontend/src/hooks/api/kms/index.tsx @@ -1 +1,2 @@ -export { useAddAwsExternalKms } from "./mutations"; +export { useAddAwsExternalKms, useRemoveExternalKms, useUpdateAwsExternalKms } from "./mutations"; +export { useGetExternalKmsById, useGetExternalKmsList } from "./queries"; diff --git a/frontend/src/hooks/api/kms/mutations.tsx b/frontend/src/hooks/api/kms/mutations.tsx index ee778198c..5e0c9f43e 100644 --- a/frontend/src/hooks/api/kms/mutations.tsx +++ b/frontend/src/hooks/api/kms/mutations.tsx @@ -1,8 +1,11 @@ -import { useMutation } from "@tanstack/react-query"; +import { useMutation, useQueryClient } from "@tanstack/react-query"; import { apiRequest } from "@app/config/request"; -export const useAddAwsExternalKms = () => { +import { kmsKeys } from "./queries"; + +export const useAddAwsExternalKms = (orgId: string) => { + const queryClient = useQueryClient(); return useMutation({ mutationFn: async ({ slug, @@ -48,6 +51,78 @@ export const useAddAwsExternalKms = () => { return data; }, - onSuccess() {} + onSuccess: () => { + queryClient.invalidateQueries(kmsKeys.getExternalKmsList(orgId)); + } + }); +}; + +export const useUpdateAwsExternalKms = (orgId: string) => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async ({ + kmsId, + slug, + description, + credentialType, + accessKey, + secretKey, + assumeRoleArn, + externalId, + awsRegion, + kmsKeyId + }: { + kmsId: string; + slug?: string; + description?: string; + credentialType?: string; + accessKey?: string; + secretKey?: string; + assumeRoleArn?: string; + externalId?: string; + awsRegion: string; + kmsKeyId?: string; + }) => { + const { data } = await apiRequest.patch(`/api/v1/external-kms/${kmsId}`, { + slug, + description, + provider: { + type: "aws", + inputs: { + credential: { + type: credentialType, + data: { + accessKey, + secretKey, + assumeRoleArn, + externalId + } + }, + awsRegion, + kmsKeyId + } + } + }); + + return data; + }, + onSuccess: (_, { kmsId }) => { + queryClient.invalidateQueries(kmsKeys.getExternalKmsList(orgId)); + queryClient.invalidateQueries(kmsKeys.getExternalKmsById(kmsId)); + } + }); +}; + +export const useRemoveExternalKms = (orgId: string) => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async (kmsId: string) => { + const { data } = await apiRequest.delete(`/api/v1/external-kms/${kmsId}`); + + return data; + }, + onSuccess: () => { + queryClient.invalidateQueries(kmsKeys.getExternalKmsList(orgId)); + } }); }; diff --git a/frontend/src/hooks/api/kms/queries.tsx b/frontend/src/hooks/api/kms/queries.tsx new file mode 100644 index 000000000..572a69e06 --- /dev/null +++ b/frontend/src/hooks/api/kms/queries.tsx @@ -0,0 +1,35 @@ +import { useQuery } from "@tanstack/react-query"; + +import { apiRequest } from "@app/config/request"; + +import { Kms, KmsListEntry } from "./types"; + +export const kmsKeys = { + getExternalKmsList: (orgId: string) => ["get-all-external-kms", { orgId }], + getExternalKmsById: (id: string) => ["get-external-kms", { id }] +}; + +export const useGetExternalKmsList = (orgId: string) => { + return useQuery({ + queryKey: kmsKeys.getExternalKmsList(orgId), + queryFn: async () => { + const { + data: { externalKmsList } + } = await apiRequest.get<{ externalKmsList: KmsListEntry[] }>("/api/v1/external-kms"); + return externalKmsList; + } + }); +}; + +export const useGetExternalKmsById = (kmsId: string) => { + return useQuery({ + queryKey: kmsKeys.getExternalKmsById(kmsId), + enabled: Boolean(kmsId), + queryFn: async () => { + const { + data: { externalKms } + } = await apiRequest.get<{ externalKms: Kms }>(`/api/v1/external-kms/${kmsId}`); + return externalKms; + } + }); +}; diff --git a/frontend/src/hooks/api/kms/types.ts b/frontend/src/hooks/api/kms/types.ts new file mode 100644 index 000000000..a869d0410 --- /dev/null +++ b/frontend/src/hooks/api/kms/types.ts @@ -0,0 +1,31 @@ +export type Kms = { + id: string; + description: string; + orgId: string; + slug: string; + external: { + id: string; + status: string; + statusDetails: string; + provider: string; + providerInput: Record; + }; +}; + +export type KmsListEntry = { + id: string; + description: string; + isDisabled: boolean; + createdAt: string; + updatedAt: string; + slug: string; + externalKms: { + provider: string; + status: string; + statusDetails: string; + }; +}; + +export enum ExternalKmsProvider { + AWS = "aws" +} diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm.tsx similarity index 95% rename from frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx rename to frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm.tsx index 30d061028..70debab36 100644 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AddExternalKmsForm.tsx +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm.tsx @@ -4,6 +4,7 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { AnimatePresence, motion } from "framer-motion"; import { Modal, ModalContent } from "@app/components/v2"; +import { ExternalKmsProvider } from "@app/hooks/api/kms/types"; import { AwsKmsForm } from "./AwsKmsForm"; @@ -17,10 +18,6 @@ enum WizardSteps { ProviderInputs = "provider-inputs" } -enum ExternalKmsProvider { - AWS = "aws" -} - const EXTERNAL_KMS_LIST = [ { icon: faAws, @@ -90,7 +87,7 @@ export const AddExternalKmsForm = ({ isOpen, onToggle }: Props) => { animate={{ opacity: 1, translateX: 0 }} exit={{ opacity: 0, translateX: -30 }} > - {}} onCompleted={() => {}} /> + onToggle(false)} onCompleted={() => onToggle(false)} /> )} diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/index.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/index.tsx deleted file mode 100644 index 53bdefd3c..000000000 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/index.tsx +++ /dev/null @@ -1 +0,0 @@ -export { AddExternalKmsForm } from "./AddExternalKmsForm"; diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AwsKmsForm.tsx similarity index 73% rename from frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx rename to frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AwsKmsForm.tsx index 812637279..45f2f58a5 100644 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AddExternalKmsForm/AwsKmsForm.tsx +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/AwsKmsForm.tsx @@ -5,7 +5,9 @@ import { z } from "zod"; import { createNotification } from "@app/components/notifications"; import { Button, FormControl, Input, Select, SelectItem } from "@app/components/v2"; -import { useAddAwsExternalKms } from "@app/hooks/api/kms"; +import { useOrganization } from "@app/context"; +import { useAddAwsExternalKms, useUpdateAwsExternalKms } from "@app/hooks/api"; +import { Kms } from "@app/hooks/api/kms/types"; const AWS_REGIONS = [ { name: "US East (Ohio)", slug: "us-east-2" }, @@ -78,47 +80,95 @@ type TForm = z.infer; type Props = { onCompleted: () => void; onCancel: () => void; + kms?: Kms; }; -export const AwsKmsForm = ({ onCompleted, onCancel }: Props) => { +export const AwsKmsForm = ({ onCompleted, onCancel, kms }: Props) => { const { control, handleSubmit, watch, + setValue, formState: { isSubmitting } } = useForm({ - resolver: zodResolver(formSchema) + resolver: zodResolver(formSchema), + defaultValues: { + slug: kms?.slug, + description: kms?.description, + credential: { + type: kms?.external?.providerInput?.credential?.type, + data: { + accessKey: kms?.external?.providerInput?.credential?.data?.accessKey, + secretKey: kms?.external?.providerInput?.credential?.data?.secretKey, + assumeRoleArn: kms?.external?.providerInput?.credential?.data?.assumeRoleArn, + externalId: kms?.external?.providerInput?.credential?.data?.externalId + } + }, + awsRegion: kms?.external?.providerInput?.awsRegion, + kmsKeyId: kms?.external?.providerInput?.kmsKeyId + } }); + const { currentOrg } = useOrganization(); + const { mutateAsync: addAwsExternalKms } = useAddAwsExternalKms(currentOrg?.id!); + const { mutateAsync: updateAwsExternalKms } = useUpdateAwsExternalKms(currentOrg?.id!); + const selectedAwsAuthType = watch("credential.type"); - const { mutateAsync: addAwsExternalKms } = useAddAwsExternalKms(); - const handleAddAwsKms = async (data: TForm) => { const { slug, description, credential, awsRegion, kmsKeyId } = data; - await addAwsExternalKms({ - slug, - description, - credentialType: credential.type, - awsRegion, - kmsKeyId, - ...(credential.type === KmsAwsCredentialType.AccessKey - ? { - accessKey: credential.data.accessKey, - secretKey: credential.data.secretKey - } - : { - assumeRoleArn: credential.data.assumeRoleArn, - externalId: credential.data.externalId - }) - }); + try { + if (kms) { + await updateAwsExternalKms({ + kmsId: kms.id, + slug, + description, + credentialType: credential.type, + awsRegion, + kmsKeyId, + ...(credential.type === KmsAwsCredentialType.AccessKey + ? { + accessKey: credential.data.accessKey, + secretKey: credential.data.secretKey + } + : { + assumeRoleArn: credential.data.assumeRoleArn, + externalId: credential.data.externalId + }) + }); - createNotification({ - text: "Successfully added AWS External KMS", - type: "success" - }); + createNotification({ + text: "Successfully updated AWS External KMS", + type: "success" + }); + } else { + await addAwsExternalKms({ + slug, + description, + credentialType: credential.type, + awsRegion, + kmsKeyId, + ...(credential.type === KmsAwsCredentialType.AccessKey + ? { + accessKey: credential.data.accessKey, + secretKey: credential.data.secretKey + } + : { + assumeRoleArn: credential.data.assumeRoleArn, + externalId: credential.data.externalId + }) + }); - onCompleted(); + createNotification({ + text: "Successfully added AWS External KMS", + type: "success" + }); + } + + onCompleted(); + } catch (err) { + console.error(err); + } }; return ( @@ -154,7 +204,14 @@ export const AwsKmsForm = ({ onCompleted, onCancel }: Props) => { )} @@ -293,7 +293,7 @@ export const AwsKmsForm = ({ onCompleted, onCancel, kms }: Props) => { > {AWS_REGIONS.map((awsRegion) => ( - {awsRegion.name} + {awsRegion.name} ({awsRegion.slug}) ))} @@ -304,14 +304,14 @@ export const AwsKmsForm = ({ onCompleted, onCancel, kms }: Props) => { control={control} name="kmsKeyId" render={({ field, fieldState: { error } }) => ( - + )} />
@@ -38,6 +41,9 @@ export const ProjectSettingsPage = () => { + + + diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx new file mode 100644 index 000000000..b531399c4 --- /dev/null +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -0,0 +1,65 @@ +import { Controller, useForm } from "react-hook-form"; + +import { ProjectPermissionCan } from "@app/components/permissions"; +import { Button, ContentLoader, FormControl, Select, SelectItem } from "@app/components/v2"; +import { ProjectPermissionActions, ProjectPermissionSub, useOrganization } from "@app/context"; +import { useGetExternalKmsList } from "@app/hooks/api"; + +export const EncryptionTab = () => { + const { handleSubmit, control } = useForm(); + const { currentOrg } = useOrganization(); + + const { data: externalKmsList, isLoading: isExternalKmsListLoading } = useGetExternalKmsList( + currentOrg?.id! + ); + + const onFormSubmit = () => {}; + + return ( +
+

Key Management

+

+ Select which Key Management System to use for encrypting project data +

+
+ {isExternalKmsListLoading ? ( + + ) : ( + ( + + + + )} + control={control} + name="name" + /> + )} +
+ + {(isAllowed) => ( + + )} + +
+ ); +}; diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/index.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/index.tsx new file mode 100644 index 000000000..ba6180a8a --- /dev/null +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/index.tsx @@ -0,0 +1 @@ +export { EncryptionTab } from "./EncryptionTab"; From 7bb0ec0111b43e2340ce2bfd4cbcd843ef38bed1 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 17 Jul 2024 12:43:55 +0800 Subject: [PATCH 11/77] misc: migrated to dedicated org permissions for kms management --- .../external-kms/external-kms-service.ts | 14 +-- .../ee/services/permission/org-permission.ts | 11 ++- .../src/context/OrgPermissionContext/types.ts | 6 +- .../OrgEncryptionTab/OrgEncryptionTab.tsx | 99 ++++++++++++------- 4 files changed, 85 insertions(+), 45 deletions(-) diff --git a/backend/src/ee/services/external-kms/external-kms-service.ts b/backend/src/ee/services/external-kms/external-kms-service.ts index 66712f715..506472363 100644 --- a/backend/src/ee/services/external-kms/external-kms-service.ts +++ b/backend/src/ee/services/external-kms/external-kms-service.ts @@ -54,7 +54,8 @@ export const externalKmsServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings); + + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Kms); const kmsSlug = slug ? slugify(slug) : slugify(alphaNumericNanoId(8).toLowerCase()); let sanitizedProviderInput = ""; @@ -125,7 +126,7 @@ export const externalKmsServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Kms); const kmsSlug = slug ? slugify(slug) : undefined; const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); @@ -205,7 +206,7 @@ export const externalKmsServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Delete, OrgPermissionSubjects.Kms); const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); @@ -226,7 +227,7 @@ export const externalKmsServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Kms); const externalKmsDocs = await externalKmsDAL.find({ orgId: actorOrgId }); @@ -242,7 +243,8 @@ export const externalKmsServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings); + + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Kms); const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); @@ -282,7 +284,7 @@ export const externalKmsServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Settings); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Kms); const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); diff --git a/backend/src/ee/services/permission/org-permission.ts b/backend/src/ee/services/permission/org-permission.ts index 6b7b3b2b2..77eaacd3b 100644 --- a/backend/src/ee/services/permission/org-permission.ts +++ b/backend/src/ee/services/permission/org-permission.ts @@ -21,7 +21,8 @@ export enum OrgPermissionSubjects { Groups = "groups", Billing = "billing", SecretScanning = "secret-scanning", - Identity = "identity" + Identity = "identity", + Kms = "kms" } export type OrgPermissionSet = @@ -37,7 +38,8 @@ export type OrgPermissionSet = | [OrgPermissionActions, OrgPermissionSubjects.Groups] | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning] | [OrgPermissionActions, OrgPermissionSubjects.Billing] - | [OrgPermissionActions, OrgPermissionSubjects.Identity]; + | [OrgPermissionActions, OrgPermissionSubjects.Identity] + | [OrgPermissionActions, OrgPermissionSubjects.Kms]; const buildAdminPermission = () => { const { can, build } = new AbilityBuilder>(createMongoAbility); @@ -100,6 +102,11 @@ const buildAdminPermission = () => { can(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity); can(OrgPermissionActions.Delete, OrgPermissionSubjects.Identity); + can(OrgPermissionActions.Read, OrgPermissionSubjects.Kms); + can(OrgPermissionActions.Create, OrgPermissionSubjects.Kms); + can(OrgPermissionActions.Edit, OrgPermissionSubjects.Kms); + can(OrgPermissionActions.Delete, OrgPermissionSubjects.Kms); + return build({ conditionsMatcher }); }; diff --git a/frontend/src/context/OrgPermissionContext/types.ts b/frontend/src/context/OrgPermissionContext/types.ts index 95a9d00ac..36206873d 100644 --- a/frontend/src/context/OrgPermissionContext/types.ts +++ b/frontend/src/context/OrgPermissionContext/types.ts @@ -19,7 +19,8 @@ export enum OrgPermissionSubjects { Groups = "groups", Billing = "billing", SecretScanning = "secret-scanning", - Identity = "identity" + Identity = "identity", + Kms = "kms" } export type OrgPermissionSet = @@ -35,6 +36,7 @@ export type OrgPermissionSet = | [OrgPermissionActions, OrgPermissionSubjects.Groups] | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning] | [OrgPermissionActions, OrgPermissionSubjects.Billing] - | [OrgPermissionActions, OrgPermissionSubjects.Identity]; + | [OrgPermissionActions, OrgPermissionSubjects.Identity] + | [OrgPermissionActions, OrgPermissionSubjects.Kms]; export type TOrgPermission = MongoAbility; diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx index cbfb2c3e3..a41bb3ed9 100644 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx @@ -1,8 +1,10 @@ import { faAws } from "@fortawesome/free-brands-svg-icons"; import { faEllipsis, faLock, faPlus } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; +import { twMerge } from "tailwind-merge"; import { createNotification } from "@app/components/notifications"; +import { OrgPermissionCan } from "@app/components/permissions"; import { Button, DeleteActionModal, @@ -67,22 +69,27 @@ export const OrgEncryptionTab = withPermission(

Key Management System (KMS)

- + + {(isAllowed) => ( + + )} +

- Integrate with external KMS systems for encrypting your organization's data + Integrate with external KMS for encrypting your organization's data

@@ -119,28 +126,50 @@ export const OrgEncryptionTab = withPermission( - { - e.stopPropagation(); - handlePopUpOpen("editExternalKms", { - kmsId: kms.id - }); - }} + - Edit - - { - e.stopPropagation(); - handlePopUpOpen("removeExternalKms", { - slug: kms.slug, - kmsId: kms.id, - provider: kms.externalKms.provider - }); - }} + {(isAllowed) => ( + { + e.stopPropagation(); + handlePopUpOpen("editExternalKms", { + kmsId: kms.id + }); + }} + > + Edit + + )} + + - Delete - + {(isAllowed) => ( + { + e.stopPropagation(); + handlePopUpOpen("removeExternalKms", { + slug: kms.slug, + kmsId: kms.id, + provider: kms.externalKms.provider + }); + }} + > + Delete + + )} + @@ -175,5 +204,5 @@ export const OrgEncryptionTab = withPermission( ); }, - { action: OrgPermissionActions.Edit, subject: OrgPermissionSubjects.Settings } + { action: OrgPermissionActions.Read, subject: OrgPermissionSubjects.Kms } ); From 4ddfb0513417940d448409fdd0943036a24ec5cd Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 17 Jul 2024 13:04:26 +0800 Subject: [PATCH 12/77] misc: added license checks for external kms management --- .../external-kms/external-kms-service.ts | 18 +++++++++++++++ .../src/ee/services/license/licence-fns.ts | 3 ++- .../src/ee/services/license/license-types.ts | 1 + backend/src/server/routes/index.ts | 3 ++- frontend/src/hooks/api/subscriptions/types.ts | 1 + .../OrgEncryptionTab/OrgEncryptionTab.tsx | 22 ++++++++++++++----- 6 files changed, 40 insertions(+), 8 deletions(-) diff --git a/backend/src/ee/services/external-kms/external-kms-service.ts b/backend/src/ee/services/external-kms/external-kms-service.ts index 506472363..bda6310a7 100644 --- a/backend/src/ee/services/external-kms/external-kms-service.ts +++ b/backend/src/ee/services/external-kms/external-kms-service.ts @@ -6,6 +6,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid"; import { TKmsKeyDALFactory } from "@app/services/kms/kms-key-dal"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { TLicenseServiceFactory } from "../license/license-service"; import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission"; import { TPermissionServiceFactory } from "../permission/permission-service"; import { TExternalKmsDALFactory } from "./external-kms-dal"; @@ -28,6 +29,7 @@ type TExternalKmsServiceFactoryDep = { >; kmsDAL: Pick; permissionService: Pick; + licenseService: Pick; }; export type TExternalKmsServiceFactory = ReturnType; @@ -35,6 +37,7 @@ export type TExternalKmsServiceFactory = ReturnType { @@ -56,6 +59,13 @@ export const externalKmsServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Kms); + const plan = await licenseService.getPlan(actorOrgId); + if (!plan.externalKms) { + throw new BadRequestError({ + message: "Failed to create external KMS due to plan restriction. Upgrade to the Enterprise plan." + }); + } + const kmsSlug = slug ? slugify(slug) : slugify(alphaNumericNanoId(8).toLowerCase()); let sanitizedProviderInput = ""; @@ -127,6 +137,14 @@ export const externalKmsServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Kms); + + const plan = await licenseService.getPlan(kmsDoc.orgId); + if (!plan.externalKms) { + throw new BadRequestError({ + message: "Failed to update external KMS due to plan restriction. Upgrade to the Enterprise plan." + }); + } + const kmsSlug = slug ? slugify(slug) : undefined; const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); diff --git a/backend/src/ee/services/license/licence-fns.ts b/backend/src/ee/services/license/licence-fns.ts index 3e30276cb..fc0fb54a7 100644 --- a/backend/src/ee/services/license/licence-fns.ts +++ b/backend/src/ee/services/license/licence-fns.ts @@ -39,7 +39,8 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({ secretApproval: false, secretRotation: true, caCrl: false, - instanceUserManagement: false + instanceUserManagement: false, + externalKms: false }); export const setupLicenceRequestWithStore = (baseURL: string, refreshUrl: string, licenseKey: string) => { diff --git a/backend/src/ee/services/license/license-types.ts b/backend/src/ee/services/license/license-types.ts index 1cdc9fa51..df85f008f 100644 --- a/backend/src/ee/services/license/license-types.ts +++ b/backend/src/ee/services/license/license-types.ts @@ -57,6 +57,7 @@ export type TFeatureSet = { secretRotation: true; caCrl: false; instanceUserManagement: false; + externalKms: false; }; export type TOrgPlansTableDTO = { diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index c249580bd..39fdd3c25 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -316,7 +316,8 @@ export const registerRoutes = async ( kmsDAL, kmsService, permissionService, - externalKmsDAL + externalKmsDAL, + licenseService }); const trustedIpService = trustedIpServiceFactory({ diff --git a/frontend/src/hooks/api/subscriptions/types.ts b/frontend/src/hooks/api/subscriptions/types.ts index 6a8b053b4..91901c8bc 100644 --- a/frontend/src/hooks/api/subscriptions/types.ts +++ b/frontend/src/hooks/api/subscriptions/types.ts @@ -40,4 +40,5 @@ export type SubscriptionPlan = { has_used_trial: boolean; caCrl: boolean; instanceUserManagement: boolean; + externalKms: boolean; }; diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx index a41bb3ed9..b39c04391 100644 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx @@ -22,7 +22,12 @@ import { Tr, UpgradePlanModal } from "@app/components/v2"; -import { OrgPermissionActions, OrgPermissionSubjects, useOrganization } from "@app/context"; +import { + OrgPermissionActions, + OrgPermissionSubjects, + useOrganization, + useSubscription +} from "@app/context"; import { withPermission } from "@app/hoc"; import { usePopUp } from "@app/hooks"; import { useGetExternalKmsList, useRemoveExternalKms } from "@app/hooks/api"; @@ -34,6 +39,7 @@ import { UpdateExternalKmsForm } from "./UpdateExternalKmsForm"; export const OrgEncryptionTab = withPermission( () => { const { currentOrg } = useOrganization(); + const { subscription } = useSubscription(); const orgId = currentOrg?.id || ""; const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([ "upgradePlan", @@ -73,12 +79,11 @@ export const OrgEncryptionTab = withPermission( {(isAllowed) => ( + + + +

Select which Key Management System to use for encrypting your project data

From 69d813887b91ac0ac7d6ff0905b1242cca75771b Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Jul 2024 02:05:53 +0800 Subject: [PATCH 20/77] misc: added audit logs for kms backup and other minor edits --- backend/src/ee/routes/v1/project-router.ts | 8 +++++++- backend/src/ee/services/audit-log/audit-log-types.ts | 10 ++++++++-- backend/src/services/kms/kms-service.ts | 4 ++-- backend/src/services/project/project-service.ts | 2 +- .../components/EncryptionTab/EncryptionTab.tsx | 2 +- 5 files changed, 19 insertions(+), 7 deletions(-) diff --git a/backend/src/ee/routes/v1/project-router.ts b/backend/src/ee/routes/v1/project-router.ts index 62ceace59..23b755998 100644 --- a/backend/src/ee/routes/v1/project-router.ts +++ b/backend/src/ee/routes/v1/project-router.ts @@ -281,7 +281,13 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { projectId: req.params.workspaceId }); - // TODO: add audit log + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: req.params.workspaceId, + event: { + type: EventType.GET_PROJECT_KMS_BACKUP + } + }); return backup; } diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index fca3206ae..71714b2bf 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -144,7 +144,8 @@ export enum EventType { UPDATE_KMS = "update-kms", DELETE_KMS = "delete-kms", GET_KMS = "get-kms", - UPDATE_PROJECT_KMS = "update-project-kms" + UPDATE_PROJECT_KMS = "update-project-kms", + GET_PROJECT_KMS_BACKUP = "get-project-kms-backup" } interface UserActorMetadata { @@ -1223,6 +1224,10 @@ interface UpdateProjectKmsEvent { }; } +interface GetProjectKmsBackupEvent { + type: EventType.GET_PROJECT_KMS_BACKUP; +} + export type Event = | GetSecretsEvent | GetSecretEvent @@ -1329,4 +1334,5 @@ export type Event = | UpdateKmsEvent | DeleteKmsEvent | GetKmsEvent - | UpdateProjectKmsEvent; + | UpdateProjectKmsEvent + | GetProjectKmsBackupEvent; diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 404c9a4bd..4c099141c 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -598,8 +598,8 @@ export const kmsServiceFactory = ({ const kmsEncryptor = await encryptWithKmsKey({ kmsId: kmsKeyIdForEncrypt }); const { cipherTextBlob: encryptedSecretManagerDataKey } = await kmsEncryptor({ plainText: secretManagerDataKey }); - // format: projectId.kmsFunction.kmsId.Base64(encryptedDataKey) - const secretManagerBackup = `${projectId}.secretManager.${kmsKeyIdForEncrypt}.${encryptedSecretManagerDataKey.toString( + // format: version.projectId.kmsFunction.kmsId.Base64(encryptedDataKey) + const secretManagerBackup = `v1.${projectId}.secretManager.${kmsKeyIdForEncrypt}.${encryptedSecretManagerDataKey.toString( "base64" )}`; diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 1a935dc06..7cdff7ac1 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -713,7 +713,7 @@ export const projectServiceFactory = ({ const plan = await licenseService.getPlan(actorOrgId); if (!plan.externalKms) { throw new BadRequestError({ - message: "Failed to create KMS backup due to plan restriction. Upgrade to the enterprise plan." + message: "Failed to get KMS backup due to plan restriction. Upgrade to the enterprise plan." }); } diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx index 2fa9da877..7c8724bad 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -79,7 +79,7 @@ export const EncryptionTab = () => { const { secretManager } = await fetchProjectKmsBackup(currentWorkspace.id); - const [, kmsFunction] = secretManager.split("."); + const [, , kmsFunction] = secretManager.split("."); const file = secretManager; const blob = new Blob([file], { type: "text/plain;charset=utf-8" }); From 32fc254ae151def91cde26aeb8030714d39fbd9c Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Jul 2024 17:09:14 +0800 Subject: [PATCH 21/77] misc: added UI for load backup --- .../EncryptionTab/EncryptionTab.tsx | 219 ++++++++++++++++-- 1 file changed, 194 insertions(+), 25 deletions(-) diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx index 7c8724bad..553e89218 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -1,20 +1,32 @@ -import { useEffect, useState } from "react"; +import { ChangeEvent, useEffect, useRef, useState } from "react"; import { Controller, useForm } from "react-hook-form"; +import { faUpload } from "@fortawesome/free-solid-svg-icons"; +import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { zodResolver } from "@hookform/resolvers/zod"; import FileSaver from "file-saver"; import { z } from "zod"; import { createNotification } from "@app/components/notifications"; import { ProjectPermissionCan } from "@app/components/permissions"; -import { Button, FormControl, Select, SelectItem } from "@app/components/v2"; +import { + Button, + FormControl, + IconButton, + Modal, + ModalContent, + Select, + SelectItem +} from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub, useOrganization, useWorkspace } from "@app/context"; +import { usePopUp } from "@app/hooks"; import { useGetActiveProjectKms, useGetExternalKmsList, useUpdateProjectKms } from "@app/hooks/api"; import { fetchProjectKmsBackup } from "@app/hooks/api/kms/queries"; +import { Organization, Workspace } from "@app/hooks/api/types"; const formSchema = z.object({ kmsKeyId: z.string() @@ -24,6 +36,155 @@ type TForm = z.infer; const INTERNAL_KMS_KEY_ID = "internal"; +const BackupConfirmationModal = ({ + isOpen, + onOpenChange, + org, + workspace +}: { + isOpen: boolean; + onOpenChange: (state: boolean) => void; + org?: Organization; + workspace?: Workspace; +}) => { + const downloadKmsBackup = async () => { + if (!workspace || !org) { + return; + } + + const { secretManager } = await fetchProjectKmsBackup(workspace.id); + + const [, , kmsFunction] = secretManager.split("."); + const file = secretManager; + + const blob = new Blob([file], { type: "text/plain;charset=utf-8" }); + FileSaver.saveAs(blob, `kms-backup-${org.slug}-${workspace.slug}-${kmsFunction}.infisical.txt`); + }; + + return ( + + +

+ In case of interruptions with your configured external KMS, use this generated backup to + set the project's KMS back to the default Infisical KMS. +

+

+ Note: The project data key will be encrypted the organization's default Infisical + KMS. +

+ + +
+
+ ); +}; + +const LoadBackupModal = ({ + isOpen, + onOpenChange, + org, + workspace +}: { + isOpen: boolean; + onOpenChange: (state: boolean) => void; + org?: Organization; + workspace?: Workspace; +}) => { + const fileUploadRef = useRef(null); + const [backupContent, setBackupContent] = useState(""); + const [backupFileName, setBackupFileName] = useState(""); + + const uploadKmsBackup = async () => { + if (!workspace || !org) { + // eslint-disable-next-line no-useless-return + return; + } + }; + + const parseFile = (file?: File) => { + if (!file) { + createNotification({ + text: "Failed to parse uploaded file.", + type: "error" + }); + return; + } + + const reader = new FileReader(); + reader.onload = (event) => { + if (!event?.target?.result) return; + const data = event.target.result.toString(); + setBackupContent(data); + }; + + try { + reader.readAsText(file); + } catch (error) { + console.log(error); + } + }; + + const handleFileUpload = (e: ChangeEvent) => { + e.preventDefault(); + parseFile(e.target?.files?.[0]); + setBackupFileName(e.target?.files?.[0]?.name || ""); + }; + + return ( + { + setBackupContent(""); + setBackupFileName(""); + onOpenChange(state); + }} + > + +

+ By loading a backup, the project's KMS will be switched to the default Infisical KMS. +

+

+ If left unmodified, the filename of the backup should look like the following: +

{`kms-backup-${org?.slug}-${workspace?.slug}-secretManager.infisical.txt`}

+

+
+ + { + fileUploadRef?.current?.click(); + }} + > + + +
+ {backupFileName &&
{backupFileName}
} + {backupContent && ( + + )} +
+
+ ); +}; + export const EncryptionTab = () => { const { currentOrg } = useOrganization(); const { currentWorkspace } = useWorkspace(); @@ -32,6 +193,10 @@ export const EncryptionTab = () => { const { data: activeKms } = useGetActiveProjectKms(currentWorkspace?.id!); const { mutateAsync: updateProjectKms } = useUpdateProjectKms(currentWorkspace?.id!); + const { popUp, handlePopUpToggle, handlePopUpOpen } = usePopUp([ + "createBackupConfirmation", + "loadBackup" + ] as const); const [kmsKeyId, setKmsKeyId] = useState(""); const { @@ -72,23 +237,6 @@ export const EncryptionTab = () => { } }; - const downloadKmsBackup = async () => { - if (!currentWorkspace || !currentOrg) { - return; - } - - const { secretManager } = await fetchProjectKmsBackup(currentWorkspace.id); - - const [, , kmsFunction] = secretManager.split("."); - const file = secretManager; - - const blob = new Blob([file], { type: "text/plain;charset=utf-8" }); - FileSaver.saveAs( - blob, - `kms-backup-${currentOrg.slug}-${currentWorkspace.slug}-${kmsFunction}.infisical.txt` - ); - }; - return ( { >

Key Management

-
- - -
+ {kmsKeyId !== INTERNAL_KMS_KEY_ID && ( +
+ + +
+ )}

@@ -150,6 +307,18 @@ export const EncryptionTab = () => { )} + handlePopUpToggle("createBackupConfirmation", state)} + org={currentOrg} + workspace={currentWorkspace} + /> + handlePopUpToggle("loadBackup", state)} + org={currentOrg} + workspace={currentWorkspace} + /> ); }; From 0c9e979fb8ded88b645f164fe42e048978212b0a Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Jul 2024 19:37:25 +0800 Subject: [PATCH 22/77] feat: load project kms backup --- backend/src/ee/routes/v1/project-router.ts | 50 +++++++++++++- .../ee/services/audit-log/audit-log-types.ts | 10 ++- backend/src/lib/crypto/encryption.ts | 2 + backend/src/services/kms/kms-service.ts | 65 ++++++++++++++++++- .../src/services/project/project-service.ts | 38 ++++++++++- backend/src/services/project/project-types.ts | 4 ++ frontend/src/hooks/api/kms/index.tsx | 1 + frontend/src/hooks/api/kms/mutations.tsx | 16 +++++ .../EncryptionTab/EncryptionTab.tsx | 40 +++++++++--- 9 files changed, 207 insertions(+), 19 deletions(-) diff --git a/backend/src/ee/routes/v1/project-router.ts b/backend/src/ee/routes/v1/project-router.ts index 23b755998..2a78ac348 100644 --- a/backend/src/ee/routes/v1/project-router.ts +++ b/backend/src/ee/routes/v1/project-router.ts @@ -4,7 +4,7 @@ import { AuditLogsSchema, SecretSnapshotsSchema } from "@app/db/schemas"; import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types"; import { AUDIT_LOGS, PROJECTS } from "@app/lib/api-docs"; import { getLastMidnightDateISO, removeTrailingSlash } from "@app/lib/fn"; -import { readLimit } from "@app/server/config/rateLimiter"; +import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; @@ -205,7 +205,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { method: "PATCH", url: "/:workspaceId/kms", config: { - rateLimit: readLimit + rateLimit: writeLimit }, schema: { params: z.object({ @@ -292,4 +292,50 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { return backup; } }); + + server.route({ + method: "POST", + url: "/:workspaceId/kms/backup", + config: { + rateLimit: writeLimit + }, + schema: { + params: z.object({ + workspaceId: z.string().trim() + }), + body: z.object({ + backup: z.string().min(1) + }), + response: { + 200: z.object({ + secretManagerKmsKey: z.object({ + id: z.string(), + slug: z.string(), + isExternal: z.boolean() + }) + }) + } + }, + onRequest: verifyAuth([AuthMode.JWT]), + handler: async (req) => { + const backup = await server.services.project.loadProjectKmsBackup({ + actor: req.permission.type, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actorOrgId: req.permission.orgId, + projectId: req.params.workspaceId, + backup: req.body.backup + }); + + await server.services.auditLog.createAuditLog({ + ...req.auditLogInfo, + projectId: req.params.workspaceId, + event: { + type: EventType.LOAD_PROJECT_KMS_BACKUP + } + }); + + return backup; + } + }); }; diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 71714b2bf..3f9f9b468 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -145,7 +145,8 @@ export enum EventType { DELETE_KMS = "delete-kms", GET_KMS = "get-kms", UPDATE_PROJECT_KMS = "update-project-kms", - GET_PROJECT_KMS_BACKUP = "get-project-kms-backup" + GET_PROJECT_KMS_BACKUP = "get-project-kms-backup", + LOAD_PROJECT_KMS_BACKUP = "load-project-kms-backup" } interface UserActorMetadata { @@ -1228,6 +1229,10 @@ interface GetProjectKmsBackupEvent { type: EventType.GET_PROJECT_KMS_BACKUP; } +interface LoadProjectKmsBackupEvent { + type: EventType.LOAD_PROJECT_KMS_BACKUP; +} + export type Event = | GetSecretsEvent | GetSecretEvent @@ -1335,4 +1340,5 @@ export type Event = | DeleteKmsEvent | GetKmsEvent | UpdateProjectKmsEvent - | GetProjectKmsBackupEvent; + | GetProjectKmsBackupEvent + | LoadProjectKmsBackupEvent; diff --git a/backend/src/lib/crypto/encryption.ts b/backend/src/lib/crypto/encryption.ts index 6af20862b..b7a4e10d2 100644 --- a/backend/src/lib/crypto/encryption.ts +++ b/backend/src/lib/crypto/encryption.ts @@ -116,6 +116,8 @@ export const decryptAsymmetric = ({ ciphertext, nonce, publicKey, privateKey }: export const generateSymmetricKey = (size = 32) => crypto.randomBytes(size).toString("base64"); +export const generateHash = (value: string) => crypto.createHash("sha256").update(value).digest("hex"); + export const generateAsymmetricKeyPair = () => { const pair = nacl.box.keyPair(); diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 4c099141c..f977c01d7 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -11,6 +11,7 @@ import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore"; import { getConfig } from "@app/lib/config/env"; import { randomSecureBytes } from "@app/lib/crypto"; import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher"; +import { generateHash } from "@app/lib/crypto/encryption"; import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; @@ -598,16 +599,73 @@ export const kmsServiceFactory = ({ const kmsEncryptor = await encryptWithKmsKey({ kmsId: kmsKeyIdForEncrypt }); const { cipherTextBlob: encryptedSecretManagerDataKey } = await kmsEncryptor({ plainText: secretManagerDataKey }); - // format: version.projectId.kmsFunction.kmsId.Base64(encryptedDataKey) - const secretManagerBackup = `v1.${projectId}.secretManager.${kmsKeyIdForEncrypt}.${encryptedSecretManagerDataKey.toString( + // backup format: version.projectId.kmsFunction.kmsId.Base64(encryptedDataKey).verificationHash + let secretManagerBackup = `v1.${projectId}.secretManager.${kmsKeyIdForEncrypt}.${encryptedSecretManagerDataKey.toString( "base64" )}`; + const verificationHash = generateHash(secretManagerBackup); + secretManagerBackup = `${secretManagerBackup}.${verificationHash}`; + return { secretManager: secretManagerBackup }; }; + const loadProjectKeyBackup = async (projectId: string, backup: string) => { + const project = await projectDAL.findById(projectId); + if (!project) { + throw new NotFoundError({ + message: "Project not found" + }); + } + + const [, backupProjectId, , backupKmsKeyId, backupBase64EncryptedDataKey, backupHash] = backup.split("."); + const computedHash = generateHash(backup.substring(0, backup.lastIndexOf("."))); + if (computedHash !== backupHash) { + throw new BadRequestError({ + message: "Invalid backup" + }); + } + + if (backupProjectId !== projectId) { + throw new BadRequestError({ + message: "Invalid backup for project" + }); + } + + const kmsDecryptor = await decryptWithKmsKey({ kmsId: backupKmsKeyId }); + const dataKey = await kmsDecryptor({ + cipherTextBlob: Buffer.from(backupBase64EncryptedDataKey, "base64") + }); + + const newKms = await kmsDAL.transaction(async (tx) => { + const key = await generateKmsKey({ + isReserved: true, + orgId: project.orgId, + tx + }); + + const kmsEncryptor = await encryptWithKmsKey({ kmsId: key.id }, tx); + const { cipherTextBlob } = await kmsEncryptor({ plainText: dataKey }); + + await projectDAL.updateById( + projectId, + { + kmsSecretManagerKeyId: key.id, + kmsSecretManagerEncryptedDataKey: cipherTextBlob + }, + tx + ); + + return kmsDAL.findByIdWithAssociatedKms(key.id, tx); + }); + + return { + secretManagerKmsKey: newKms + }; + }; + const startService = async () => { const appCfg = getConfig(); // This will switch to a seal process and HMS flow in future @@ -666,6 +724,7 @@ export const kmsServiceFactory = ({ getProjectSecretManagerKmsDataKey, getProjectSecretManagerKmsKey, updateProjectSecretManagerKmsKey, - getProjectKeyBackup + getProjectKeyBackup, + loadProjectKeyBackup }; }; diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 7cdff7ac1..3a58d1052 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -41,6 +41,7 @@ import { TGetProjectDTO, TListProjectCasDTO, TListProjectCertsDTO, + TLoadProjectKmsBackupDTO, TToggleProjectAutoCapitalizationDTO, TUpdateAuditLogsRetentionDTO, TUpdateProjectDTO, @@ -78,7 +79,10 @@ type TProjectServiceFactoryDep = { licenseService: Pick; orgDAL: Pick; keyStore: Pick; - kmsService: Pick; + kmsService: Pick< + TKmsServiceFactory, + "updateProjectSecretManagerKmsKey" | "getProjectKeyBackup" | "loadProjectKeyBackup" + >; }; export type TProjectServiceFactory = ReturnType; @@ -721,6 +725,35 @@ export const projectServiceFactory = ({ return kmsBackup; }; + const loadProjectKmsBackup = async ({ + projectId, + actor, + actorId, + actorAuthMethod, + actorOrgId, + backup + }: TLoadProjectKmsBackupDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Kms); + + const plan = await licenseService.getPlan(actorOrgId); + if (!plan.externalKms) { + throw new BadRequestError({ + message: "Failed to load KMS backup due to plan restriction. Upgrade to the enterprise plan." + }); + } + + const kmsBackup = await kmsService.loadProjectKeyBackup(projectId, backup); + return kmsBackup; + }; + return { createProject, deleteProject, @@ -736,6 +769,7 @@ export const projectServiceFactory = ({ updateVersionLimit, updateAuditLogsRetention, updateProjectKmsKey, - getProjectKmsBackup + getProjectKmsBackup, + loadProjectKmsBackup }; }; diff --git a/backend/src/services/project/project-types.ts b/backend/src/services/project/project-types.ts index ff0cd0a91..38d436018 100644 --- a/backend/src/services/project/project-types.ts +++ b/backend/src/services/project/project-types.ts @@ -107,3 +107,7 @@ export type TListProjectCertsDTO = { export type TUpdateProjectKmsDTO = { secretManagerKmsKeyId: string; } & TProjectPermission; + +export type TLoadProjectKmsBackupDTO = { + backup: string; +} & TProjectPermission; diff --git a/frontend/src/hooks/api/kms/index.tsx b/frontend/src/hooks/api/kms/index.tsx index 7702b9fcd..027fae1e3 100644 --- a/frontend/src/hooks/api/kms/index.tsx +++ b/frontend/src/hooks/api/kms/index.tsx @@ -1,5 +1,6 @@ export { useAddAwsExternalKms, + useLoadProjectKmsBackup, useRemoveExternalKms, useUpdateAwsExternalKms, useUpdateProjectKms diff --git a/frontend/src/hooks/api/kms/mutations.tsx b/frontend/src/hooks/api/kms/mutations.tsx index 8a92af8d4..7aace42ff 100644 --- a/frontend/src/hooks/api/kms/mutations.tsx +++ b/frontend/src/hooks/api/kms/mutations.tsx @@ -140,3 +140,19 @@ export const useUpdateProjectKms = (projectId: string) => { } }); }; + +export const useLoadProjectKmsBackup = (projectId: string) => { + const queryClient = useQueryClient(); + return useMutation({ + mutationFn: async (backup: string) => { + const { data } = await apiRequest.post(`/api/v1/workspace/${projectId}/kms/backup`, { + backup + }); + + return data; + }, + onSuccess: () => { + queryClient.invalidateQueries(kmsKeys.getActiveProjectKms(projectId)); + } + }); +}; diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx index 553e89218..0726bb1ff 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -24,7 +24,12 @@ import { useWorkspace } from "@app/context"; import { usePopUp } from "@app/hooks"; -import { useGetActiveProjectKms, useGetExternalKmsList, useUpdateProjectKms } from "@app/hooks/api"; +import { + useGetActiveProjectKms, + useGetExternalKmsList, + useLoadProjectKmsBackup, + useUpdateProjectKms +} from "@app/hooks/api"; import { fetchProjectKmsBackup } from "@app/hooks/api/kms/queries"; import { Organization, Workspace } from "@app/hooks/api/types"; @@ -64,14 +69,10 @@ const BackupConfirmationModal = ({ return ( -

- In case of interruptions with your configured external KMS, use this generated backup to +

+ In case of interruptions with your configured external KMS, load the generated backup to set the project's KMS back to the default Infisical KMS.

-

- Note: The project data key will be encrypted the organization's default Infisical - KMS. -

)} From 6c06de6da4759980315c351c158db28221ade634 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Jul 2024 19:43:07 +0800 Subject: [PATCH 23/77] misc: addressed type issue with audit log --- backend/src/ee/services/audit-log/audit-log-types.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 3f9f9b468..76bf73d8c 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -1227,10 +1227,12 @@ interface UpdateProjectKmsEvent { interface GetProjectKmsBackupEvent { type: EventType.GET_PROJECT_KMS_BACKUP; + metadata: Record; // no metadata yet } interface LoadProjectKmsBackupEvent { type: EventType.LOAD_PROJECT_KMS_BACKUP; + metadata: Record; // no metadata yet } export type Event = From a57d1f1c9a870c96ba06c84cc1b1c30527037a2b Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Fri, 19 Jul 2024 19:45:17 +0800 Subject: [PATCH 24/77] misc: modified modal text --- .../components/EncryptionTab/EncryptionTab.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx index 0726bb1ff..7acb5b069 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -73,7 +73,7 @@ const BackupConfirmationModal = ({ In case of interruptions with your configured external KMS, load the generated backup to set the project's KMS back to the default Infisical KMS.

- + - +
+ + + +
Advanced Settings
+
+ + ( + + + + )} + control={control} + name="kmsKeyId" + /> + +
+
+
+ + +
diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index 6956f71a3..dc5c20a70 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -36,6 +36,10 @@ import { createNotification } from "@app/components/notifications"; import { OrgPermissionCan } from "@app/components/permissions"; import onboardingCheck from "@app/components/utilities/checks/OnboardingCheck"; import { + Accordion, + AccordionContent, + AccordionItem, + AccordionTrigger, Button, Checkbox, FormControl, @@ -43,6 +47,8 @@ import { Input, Modal, ModalContent, + Select, + SelectItem, Skeleton, UpgradePlanModal } from "@app/components/v2"; @@ -59,8 +65,10 @@ import { fetchOrgUsers, useAddUserToWsNonE2EE, useCreateWorkspace, + useGetExternalKmsList, useRegisterUserAction } from "@app/hooks/api"; +import { INTERNAL_KMS_KEY_ID } from "@app/hooks/api/kms/types"; // import { fetchUserWsKey } from "@app/hooks/api/keys/queries"; import { useFetchServerStatus } from "@app/hooks/api/serverDetails"; import { Workspace } from "@app/hooks/api/types"; @@ -473,7 +481,8 @@ const formSchema = yup.object({ .label("Project Name") .trim() .max(64, "Too long, maximum length is 64 characters"), - addMembers: yup.bool().required().label("Add Members") + addMembers: yup.bool().required().label("Add Members"), + kmsKeyId: yup.string().label("KMS Key ID") }); type TAddProjectFormData = yup.InferType; @@ -506,7 +515,10 @@ const OrganizationPage = withPermission( reset, handleSubmit } = useForm({ - resolver: yupResolver(formSchema) + resolver: yupResolver(formSchema), + defaultValues: { + kmsKeyId: INTERNAL_KMS_KEY_ID + } }); const [hasUserClickedSlack, setHasUserClickedSlack] = useState(false); @@ -521,7 +533,9 @@ const OrganizationPage = withPermission( (localStorage.getItem("projectsViewMode") as ProjectsViewMode) || ProjectsViewMode.GRID ); - const onCreateProject = async ({ name, addMembers }: TAddProjectFormData) => { + const { data: externalKmsList } = useGetExternalKmsList(currentOrg?.id!); + + const onCreateProject = async ({ name, addMembers, kmsKeyId }: TAddProjectFormData) => { // type check if (!currentOrg) return; if (!user) return; @@ -531,7 +545,8 @@ const OrganizationPage = withPermission( project: { id: newProjectId } } } = await createWs.mutateAsync({ - projectName: name + projectName: name, + kmsKeyId: kmsKeyId !== INTERNAL_KMS_KEY_ID ? kmsKeyId : undefined }); if (addMembers) { @@ -1064,24 +1079,64 @@ const OrganizationPage = withPermission( )} /> -
- - +
+ + + +
Advanced Settings
+
+ + ( + + + + )} + control={control} + name="kmsKeyId" + /> + +
+
+
+ + +
diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx index 7acb5b069..b5fa6fe5f 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -31,6 +31,7 @@ import { useUpdateProjectKms } from "@app/hooks/api"; import { fetchProjectKmsBackup } from "@app/hooks/api/kms/queries"; +import { INTERNAL_KMS_KEY_ID } from "@app/hooks/api/kms/types"; import { Organization, Workspace } from "@app/hooks/api/types"; const formSchema = z.object({ @@ -39,8 +40,6 @@ const formSchema = z.object({ type TForm = z.infer; -const INTERNAL_KMS_KEY_ID = "internal"; - const BackupConfirmationModal = ({ isOpen, onOpenChange, From 3709f31b5acf87af8a1869b51919e3a18ddf082d Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Sat, 20 Jul 2024 01:23:54 +0800 Subject: [PATCH 26/77] misc: added empty metadata --- backend/src/ee/routes/v1/project-router.ts | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/backend/src/ee/routes/v1/project-router.ts b/backend/src/ee/routes/v1/project-router.ts index 2a78ac348..7113b2a41 100644 --- a/backend/src/ee/routes/v1/project-router.ts +++ b/backend/src/ee/routes/v1/project-router.ts @@ -285,7 +285,8 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { ...req.auditLogInfo, projectId: req.params.workspaceId, event: { - type: EventType.GET_PROJECT_KMS_BACKUP + type: EventType.GET_PROJECT_KMS_BACKUP, + metadata: {} } }); @@ -331,7 +332,8 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { ...req.auditLogInfo, projectId: req.params.workspaceId, event: { - type: EventType.LOAD_PROJECT_KMS_BACKUP + type: EventType.LOAD_PROJECT_KMS_BACKUP, + metadata: {} } }); From 880a68937668bfe14c2bd4d49379f13e17856143 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Sat, 20 Jul 2024 01:25:00 +0800 Subject: [PATCH 27/77] misc: finalized project backup prompts --- .../components/EncryptionTab/EncryptionTab.tsx | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx index b5fa6fe5f..66fc5c617 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -68,9 +68,9 @@ const BackupConfirmationModal = ({ return ( -

- In case of interruptions with your configured external KMS, load the generated backup to - set the project's KMS back to the default Infisical KMS. +

+ In case of interruptions with your configured external KMS, you can load a backup to set + the project's KMS back to the default Infisical KMS.

- + - + - +
|P(y~%&`4Kvnm*4oQq?U^EomKgvfwj5ed`YC#!|^LYWrR4el`(G<0(mq zMwCR4T;EdX0!xg>GyI5|H(73TCkT}(H@KI}v(*hcopz_a?vhek`@E&BIb@)e`7bjN z|Fe}Yfi=rZzV`BmJ~t<*!D-1OjR^!P`0+%pHAU6BoJvHlD^a8B7gU5Ja8nAkHVC$& z!Texm#lffSHqw*QE^;WbD=9i8SAA0AA-we)(LXBh^E@nXo}U&#kZq-NnQ2#{4$GS= zfx%rwKU!;Gpiy(KuTDZabuj$sc<>S8Tckd(uMr(S>dc9*L*mm?mQ!BU^i4cG zM8{(1MW4HI@IVeG-}GSh?E|ZJ%VHR5j4)>SZsbQf+qX&YLMVMGBku;u#VU(TY$5L5 zro(qo9M>DRzxI2xglRF2Y`!bfQE}mC77K099`&e*T-Ls0^-|BKR8;_&1F-XumcslU zK>h?o-vAr@k#wGLqvQ)c7u~*Yo@79;Q)NKYDN!39t|vY*^4A$s|0sL^lMA_@|_i7)(LXHj4<^0LSzsKSz?wIe8% zx9A>L4`9{cCxXklP3b3xT&bd9O%#!JH>E|L(f)~w_d9X^h0Mr--MIndiW(|arms@C zJ4Y|YEiQjj$YI~q`V6ybH*y<>nVXurxe^Y#s0|++kZX(BTlXV|Xz5zOt)a6uUd z#8<*c%DhXS9+EMOo56SLDg`r%VU1?xnz!sNs2}0e20^<5{p?T4A1SW0o)c(k>xPLU z(`3kd?2EOud*2En$7!?UK;I)X5NodYKVa$1{{l+~;y+Kn&}Vv@KOaITqRSiBCWy@M zx4js@pm%h!M^JtZ?@xRm&Y*poTGtb}2tVea78|np0pHVe$P-jM^&(&GQX8^HREmOm z#@+5mqZl(1JjO312;;3*KdEllaDT6HSkHresalV=Q@_V@zsg_m2C(SxxQzrtcK^Fc zj$;a+w)<-@X)$@(8T}kX9>P}09s5X#U;)a9Y&N#Jk~k|v&1i^jUBhS&PP0OJdbZ1R z#0`=_0=&0<(~?a2~}s^p>S#k%|ca!=Bwqi0=;Lk?lC z=v1-K%puSizp>tRd3s=l=Kp6|yFjYE&`P?q^Jr$r&*UhGTV^x-?}z;VCpBocy|1S7 zrHe_)khCL5{t49r;O#)EhBaV@PXbX92Cpt5Q^||^X+iRS;F8o~d%&3;+ig6|pydoEYS2Ll&z_?DNERDp#se z%~YCDDbX6n0PM?=-!_@xqFDlw>XSHBD@|l(?36{ z#eTq~=cz2Ntp6^s_SkNPYW>??@{dC=9OAkEQ>D7E#XzlCMLwMzG0uCSU ze|qWaJ5df3C^s`5l%bPwHjf~gA~EM_I{%JXaq>y&I`qbQ4c3*uAZ0w|4uNR_9^!*`zMWD*j2Wv{-pE_=M z_-mBlCP~wU-@SAphXE%bxZH-KEkH_Z*7ymhMgRkTyA zV44IFrfn`Der4kHW1HGY*+3`DuFz}iug5~cP=yw>a8>0~K zKGZ?V*k}4>v<6%~@l@=}g)DeVHl{2o8);p5Q**3q{K+!4!17?X9*A?9-yJ*@X}C)# z+=_4%Zn97T1o{yE%Uj|8)2m40vs)I&Q=k1uWazw=Qo3SOgQKm%9CnTx8RYYKdXufFtleyX@y3@&-d>0zT^C1Kn6b;H`l$cx#nDJ&NPsNea%6x#5gmU zEy>Mn2fSU4@nBB7@yHC;64qvUQ-2+=uaoI5Hn$Xp-ZH61v#Gg>@U?95xBvGe!Wo7; zI|XM;j~y1f5W)z1k0ZWlFJw*_)@{cPu`XYc*VZjY^mmQ~2Jx1bypC;e zd?ul)8{=Gb7n&m%YD${-V5bhb7pf1XzJ>A6Z);zcDY9L%isxVICg3sK$~esaFo?O# z*8H|d%_*e*mI`Q|XCBftEe)@BA$KX;p^yjTzOq6@TvB@MEejqG2HBEK*5fHcr8!!7 zLnoL^FszCLJE3uo30==qLZfe;S6Ka3ICTiWe)ccpz!1Sh3?nW@piBJ+DImlPj-6ZK z&U!1&$o8ZoWjnKvjHu+u^NCG`c!VSC<8?CWfa7p)*5bBncK~~Rkjb+q5HfqkG6hPn zA5&vj7IWt3M*MN>NfY|v-D>4E#>$oyRvlK)r!+z`eWLV`)F6_DuuNXwcIRzFFsH!} zfO9wT4_EzK?gG+Of76LOLJr4kASi3G=w;gJ=sybrs)h%a$`+46+}$e-zXV>3g>0K% z>&=L6g^>J_TN&fkQsU^vItnX=HKa5`vM;Rdj}gSXdi!uyc%7E~2J20MY=OocI*N|V z-F687v?X(wbs%6S)pb)8$?S4nAQw}FDMb7IEsA0svH;7~wPOE;eKhfT0on${s#6j9 zw_EeyZm5?{fGsa!jo@RvZjz+FE8RF8eMbH62-{~ro%oVw^Xz+ zUsA)bK64Jsn_lJI{$h*C~%?(*9FWi}+~ zb(SgaZt)6J+}HES>PxW~G4I11#weIz4sl0>rxg-A<=(K%Ch}xL2%mmcjM?R+W698| z4WUl&ut>Fe1AcSA&S$WyBg0Xh4PxH`+bRLvvB0v)J88hCiHd#{BkO>gN{a7Lz6`wd z>ujQ(eRJHGDHYO0rP7t`b}Zc{djO&sP`<-nZ2kRSo6Mhp_YuFr{*Kko14B**be7t_ zR(#P7g+m%WQ@%Qkk(UBKpQa9to6PR^H1rN3T}JQ=`{R3lole+z@p@l0uu<#uH=l=G z{YbL$8G>Pi_TBm5R zaj_Eb3S!S~1I*0;%7gLHPzFXysgbje(0s5`SsWe@ejiO!N(@<8dy&Fj^b(hCA=RyR zB$`y$cK_N4OrP5!toKl87s)pfae2iybnbj7I}<MgFp7e~a+l`tkyp{a@d7j~*T@ z3jdI1Rc7gLl&QtftAx#q_P0AC6ng^yN_}fJ#O23Wp?PSgQN8)pyjC1_!W`?4(`vrl zC8M$S^xLlaegll8Ms?}cE`iUDMX&a*DDi)v)-wZ^O+KJtF|jC>M*0jL9{pJpWhUUe za-fRgV1T%{W75ja18gKtvM5)4aBB63>9b+1HlQ5T$>tCW2N%!I3Ybx_`xovS*fVe! z8<$)%g6>v4yL@t=5Wwla&{}zx-k@(_pg4V5-aWCRb^ae&DF208CMph3#LzSY$IP;- z;~l7Ne9M~NS%U!FN|E&{z}ndKbta4 zC8bN06l>uumvzo=bUUa@(ivEsdSb5`n?1hOI5&;nDw_l1HH2;dU^F8XZ|~G+tLSTl z533++3A%}XIGv@=TrLyAjK*W6R=(Y415WteC?)ZPXx*t3ZMbw<&)r8 zGPkGaBgcux8=>jVdB)u^z=to=-dNO!NPb_Yb!Z?ut4+;V>1O9@&B)zt!ursv5RMf0 zhd_@y4nZDggTuo)=k;vF!fl{Lb}nM;qp%r(E%j!zI1@msLs*;>o;|b?)^x9ki?t1vBGr=vnK^)6b*|}v9`)sSW zkukhhd>-1m&j&COt(-zwxG&ujFvn7RE>HBUQa(~m8~=KViu>(!O9P8d44eEofYWk& zfo*FKWrUn#`*YW{oaY23xr80@8(yEVbyr5OCc1nT8=sOvk+;LAh(P|xhJ}efXC<+A z>66&VL(R?EY-7_J=7_7l4r~Afv0d7ftzDf?))|Yb#(cGBe<8+$Sz^_tIC=EeJ?8@& zSSbWxDa9#GWYUYoud@7mm>L?rH=_+pb;hTQKCi^m{=BV>_;+M{fw#oShPK#qR#T!a z8(7mAX(>(#(KnI(i|7pwkKI~fw*cMG^6ew=s&yQ93sE0l`PDvr;5Y)G-j9YvRsyJn z+HrpbwnQKMOi&D;Gwxsm`AsiZc|*bBoe!drVJ)QSuram|#)29^SA?&`f|hcnHZOqZ z6=V6EyQ^W8YJM}=ss$@dv~Q!;p1~w$E@@_8HNOqiuk64zsIkBMk?@Um0GGkFv+nueSah~p6asDn2a!`d%@&qhW8bfsDNovh$1bW zHfhH|*wxF&x?tzkDU%KFe8NI&cHMdu;r+_?9MxNNeP%=GNzj=mp$ml`>82--^IUz8 zi0%$CKR6iwd+YsR%Xo-CV6{xA(%+BB43vs0HrrHGpH-(PTk!6yeidvu5*zx&raIls z%Z}N#FtxK;#4kQ2AJF4REd~rK_g_McI9DxVuML{=EBO>xh=JA=S3Mc6qu+2HJ zB7962IF;x5ya*%*0YvNaWJ;Dg3y2ew+9kRS`PujfNf03&-LxHl0|PR`B$xGCaG?2D zm?cgRm`{q)w6zarwlXEF=R2XeWV`ahGULd4ltx33H_Xfrz+5?Twm_&^kaM_szr z?(3h#I^FD#W3vE+0k4P~U7K=iz-F0+tO`b};9!G57L@P-a0qRj4|rLO_{c~EYI-Ar z_`78d%-X+1L!)u7J1SRqJ%#1^!tD_dwgC6lB*o!n9eOJgdC?D-xg4^TR2F+5P80-0 zfgJ#s*qG$rl))nF z>q`#&EA``_wMV>aH|xhM7A2E(YL4u1+Sthnx%daj1OA)*5#BV@@Hu3Cj_hR&#z&w*9D%MyalWc!*ARaM)^dN?ggP4f+dTJ&!3jzD|@^^X#Z z)n(%6dCR9Vk999(ROt>2w%jTT((wzlcZyDB4yVOW^~K%;h|@y`EP5gY9shWI#9p<*LjMw_wmgrMg3qiJ1$$*BK& zTh-8@(IhGq*s8K9s7h4|v9|v4ddBaY=1tF~-;u_Y&HZf$vqT55Mt#@C#!8VvmW5Gu zJ1^lE&;2ZsD7kKyQUkq>Iy2brcQwXpSXKIF^?0r7y}rOC4|&t^4YltPw5sKm=T$Yi zoa@h4PMd~JMa=DR`m|_MB5Y&M*1Y=i3n#z(#~%;_kn4%_)jo|6c^lHRPi*T}@{pM?7EWKfdiCWr1yg+IcOQ;Qx!}|(? zKB~2oHd7ExVatrk&9gecBnRVt0-P)xGWFO1OPbh^bHmt3BuH!=~WF?IM4#M|U>bK)6L{gy9ojR$3{ahe6-khgPl;6(ep zE7`1dvo8pu3oE=u!f;%FxgroI;6GD8Hoek5F8uyg26_s(DiqU)Bx{QN-jJeD(dkYS_vbXIRe4+Tg8T!s9+t}zR@S@*Cc^`(x@wrfZNQA)1KGt69F=5@^Q_(s+D z22!FviseUKVr_u=kc?JY8PbIx3pk3)_^Nz^gx#93q8y!GyA=B<*{rZY5$#D>^=u$ zWq9k5IgVu8FhqCc1^`v38-Y-<~pA^JEw>#%+#TJCi57D>j-wyduOb?0H>nSo(AuO4@je4 zz#3lVx-;R;rmmG7{Y+sa*goWkUt-B{Xnl~-(+oZA^@y3&DA}s~&HMH~oaa}CL#|eK z!ekoaj0kTMhc|v&jPpj;xYT|AEpZ|Cd(56y=JS%bVj<2}tH1KItY!w5t*>di;(qtl z2kC3>+~@uD8Di-^^SGa?W7w(Ks!Pm<gk? z_EXcJhXRJ~l6dwCuUcCuKBaw^ex15f3Os^5jtz6@-5?2*`|+;Ao4>M9;@UektvPcV z@rbVGvukd7bQh@S%ji`}*=|y#y2|qUhQOtob`u5zo3(6Up+|B|yb?&f`qR^va$jX|21P1Wh%4f2t-fnL~+Fn`S^p6lCFUk@Cp0p~lCsnr?3}nU1V5qydNh z=q}NYmGHf3lQ=E%cvSt!x`Oj!r`>vV6*Eo7S}_RA&>;(?as#yxoZ3yY zUukZ7QxwofTm+g1FMe^(lFSXx6 z7$-et4>oMxZ7UZ03q8K$kfse!oY>4OQoaE6A~O~#i-eV5AHtVv&OQ}1tpoz%o(Ai` z&H3w6%EZBg1a#j-PmSC3RW51aGX9hTKQIxR|JJ?qivmq#pw3jWmF2j_xJ4Mzp*mB<*>KFWJPa?v7u zm)EhA&Zbqn?z}H{z0v_5$}c{tzCh@d)85sDS{PnL|no_#<}{&~PEM z``@3HG@&xEqFIJO4hNddtG5DlW`)XdRBV&))_ahZ=;*DuwwmtUlyy9R7A(fSpTo$`a`y^pvoeMA=G`1r83 z6Cr#FfzXea^oLKK(4UWoXcqn%rPxF?o|w_#264x!+Yk#TP*AvgNsLt2cAoVS$}#j> z1rg1~jY}y6*E+$vt4CQgyFknA?(NJ@q9XMweTA-U72Jo)u7R1;WSh!MDYp73v&kkc zZjd@yHWcV64BtnyW)n@?-^Mv5>IF^0u{u2>KEAO_Yxbe1q**(se6bQ_+F1BZs@?db zR|o!n@(=JVyA~MdQ$-)7{f*sh`f&P(UPRV#vfxnTD?Hq*?xQgu^Otb_2tAcs)6HIx zZSbxC(p_<&NowKVx=@d37PFj|ym8gLPO-e*l9s}vw&(g1j(TTl>3Iv*{~RxrcIgkr zDBwFGQ{w|k@^w|b6ywZOHSd-`*$bPj0*0l)Dsq?VK=)yn$>EBu3%I<3;B1%1W~^Uk zAF{h1zf*R-nsLKl^Ji(`lwj;KXkX$$4kD)=TV0)!6*?`_s%C*gE9t_2DmyBqtxh&T zK_XSFD>*Jx$;83r4Cv(=SIm)v}+yGfFR z>V8C zZY{3RxP}cq9UY=f?#(tZ#{XkiB zzw#%vIT$K+bOKZ5U&OEG3OK&)>KTLxq$Ku!BVPPwTb(vI}Wfjk~uA9h;^9`uMVrGI#1?ic3kCo64dLv9LHlR z7}aU1b_F7Nndms=(3^G2=Zb%rtgJ3(f5v$|^2j%~q{8p+)YXSCuUr?2g_vW`sgH^s zu{b!OXi?q$9)^Q1wiqoZ&J)*8$^I)@W*Cp&A2SI}5z$e9)ikiAKZs{!&Nx>yD<>1X6@ah&~6N`A)w)xEnq-#Ug9+ZImPB|Og;B*Yp{nh^N zVo2mnsA>t3eAKOgVyg&ircs}A_VK4QOr4fryx!=(`o}bY_}<-;UI?WqVbKXLBas6E zu$8{yAOs5pTSKRCeNpQ`lCV_y48ylyxMmE8b1Gkn!Fh{x&^{i z76ld(AE2o-n9~ZrJaqJiTCuOU{f|$a1%2pS#6(!kQbi2|H3Rgwugn^IA?Vot~ zsy=+&c7Y7n*UbnVNKHa7*E%murH}Pdth6hpO3vK6{wH987^&Rpj7j&r}gf_$PnJ;u%H$IP=FHFC(7_Hhuxxi6fGY*wFv(I|wP|U3gq_bUsIY<;bT_3(2Xt z;?U0M%Ry8dYQ`=&gh!h*UU@s{#_w6D8gaTVkc|#BL?OT(bxz@ZbBDa}-Sa$tp!tj9 z*UnH)(gF>YvLdighMg9z<@ebSS;jru@HhDfKcn+Pl&zodGpxt9iyVeDql>I!LyFA1 zMgTXSL+wBY>0piRJ*mFfzo>UjC#0JYaaxad=tPv@@W_?(7~HPgj0gyU}&!~#{;@zY(_KW24$!N_Sfa)ObxxZH~xQ8irkgm3W#Ut z8TJL2WZWD>+VMzr_pE5{1Jv|`6Qh(-SJW`J$Q@lmr;e{s;kcO)5k~2f?TMi*5d-OeP?wAV=V{FPs{&FSfd+?!CcL&%BUKtdAG2 zXZ_~5@MfSjXIwSP|Lt%P@&%!0{4-cZ6ysR(al}YXYqJo#;Xrb#~?EJB>2$_@x*T4$=dUI4;U#-TLU_u+y8X zxiG8W-o}v&hwLI1zu%ukc}3Qh+`3IT)^CY< zzCg;mNhB$#ZRn=ZU9#R0t=!D{tc=C5w%Eofe{;R3Mynz3NVJ0%e@zu=I&m7Z`dxz- zwc)F>d1AEbNvXLcB8$P3h*)USw~lKRnAuEtFw&AjdK#=6w_c>uqZ!Va6h_Ztwu7M6 z(>DNKqbVF~H+`;%!C{zyLrGqeX5h9a4LG1%GOS$HWs zFJL)}MeEVQ0XSK+c|AMGPtP<>%AO%Py9crIkr;wQ5SL#{u}fE8jwgzFi-6VVeiL{5 z$^B)-?ScSQ=H|Rk_)=!{@HmnG^v|&IEwdGWLmG>a$Zdrzlw#j1jZNHPp!OsbFlo1gelxT{NXt~s z?w*&fWU!cGP+MyAd5^F*z+otx&?%i$=S>gqX2Gm8To;&W)E916fE?1yO6r=a62RUs zcs^JAJcy^|;jJwQ*M=Mjb5xWnNRlEDjXt4H%4~_)EQ=M}nbKnq+3!oqG?p22Q;C@~-|7UcdkOp%bM( z9@4I@9}zA9=|`qr7^Ujvfg_wzCXh2AULpE$a-eK{7f%Gf+*LltdcWDr7$5x9L4&J& zaP&UVJAu6);2OW1*S02mIJw*#b%TcMhO`czp=oSrYdkEu##k~m=u+0FJfXse#Ey2t zyglw96~^0L3CYy^bI0@kposs$zRA1MsDc6sZ%CE>%45U_?yqyv@=PY)|`6XTfl0 zr|EgVM;fT_CQ;laErj;_?+afn>xUrgo;FT3+oU&xtqMYX zQ5OKxn!EUYl(P{mVjAAGtMQUJB6Tk}j8ovsB|_$m?L%ExmqN)p`&g6XjL`M3_G;?U z2v#)W9RYX`SSg!h^fCHdfQVTN6QI{~1^6xNerhoGrTs+Esu9(#jISvTpGKr!0Do=@ zA~gfT%`?(>Sse`GutIP&@8$5JC3fPt)M7Yti=imlf&##g7V9S-@eA8by#i?ca;GnF zW{tRsTTIJPkPG_i<0VYMe_CyCYCcRz#P|KEdrk}QefK;m{A(sh_d3*G%UsiR*G5uw z=>QASfbTWwoGq&g)pt+qritERl1)h7L*SqxZe5AZ+h!qGX8ty zhGFGP-xG`$wZNo(r9a1tV3HZGN36!|6$7LEKfgSLyoNlM`%`>nCFHyV-FHMry0yy` zjcutJ1|=!bAy0=uMis(Gagf#7vx4<`r@pmXe2*qo+Moo*0BOTCn5{6l>&DS>4H1~8B&2ljK_#j>Nfey4e*Vf9GM6=6eR@v%&RL}hoB z>2qnJx7~f!HE=+k;H$3dFB}cSN!8GoH-R|uE-2O0PLIVfW04(^zMFH?s77Wqg0V#u zs%Dr5lUxr0ncNSC&iar(5oGmNgrm5dG_>Y>cdl45Y?`=zmA2JtwynFHg?B(Uu=*%X zg+H8In~0Yt+7tnbLRx@nu3xc}Z;c^h&sjRc2#%K+1g4)*#BI=tV@%2FTXSvz5O|}q zSQ15@(a6=x*sxTTr#AreNg$Q&3!HBMd+QESfzahd#y)Jm<{`=PdhvPQaU-H44^TIk z7Uba5sc3cG*@#?z%?}*2EE+nBR1`V_iPp(bet%t3c1khxH8(+}M`YRZ$=jlo%%GvE zuyVXWBOviupi3~eYGH!Od>L|-xAx+Tt?r?Xigk9MB-iPUo=pu&!E{Pc^!$%gV?(IsZ)Q5l;72*7w|`@T&fWwS)>n-tU8BYbV3t_a(#1NfO6TgAXS@-*_?Kd2OcZQP`wX4-OgdiWl=^(X(%< zc;m92`RUnKO|42`-_#O>X6P!(QNQ>Dz5m_oSbq<|nf~5sfyCNKv+3KxgPDH?nIBF+ zP9m-}8-}Vj3Sf4@1l9Zeu^VepRdZs?^^GFb0JzatGIylhK@u2V%SDJr?qh^DQtZbq zvj7Dbvn};~H3zxLX22KykzxSz)hRGo+Y=~5^Zmlg)n~iwRIcAx;hQ9~av9 zZYB=7=P^QzmbBSafPKPWk<%h2SOCx&Eb zq(H~U>VFOVH@K+JKPxK7Q8w4b^{VwZC#tOF#Ht8! ze{`jvxOI>a+!8asAYWwco$WTgz@;sHAiz&V0bZCrVu3h5X0|+9dtL36^*)_z?q;f& zR6e}gtl%t9v595oG5a9HQ@Dn(j@`BRX1VH}{K_MaZ*NkY0uuLB9ut4@`aQiUxY3^hj6G~g z-QLeH+@iQI3o;oP#Y;`0^+2)5xDK@yza?nT=MmG3gByuygAFs=iY&jYXfDoY;%O3v z%i4n=@~thEqMxrZuzERs@(=z7{I5>vKX3Z17=CPvD~@EQEx{LjE$AfMnz(KwQ7w&ZP%>8%ul^Dyf>&oO~ADz=2|8# zX4XYdso(To1qZw6t(EVnF85OIs`md3l416Tpx>Pd{?KS{{Zet<>LBmjSqmj+p@3eH zh_jrJS(tULppiScuUJ{irSfj78W|6QOy8*bfFH|?1`^rl&VHSQ;&RaH1(qPs`1y>v zP>~g8yHoK;u0@xI-5k23GQtOVsIFeNUqb$E70ljwr^kElxn1|5|7z?binSxyy%Sl5^#cr$ zH&kPoQ;w@s^xTzGX?|bu^Kkx{SHhiMo4LdHz37Gqq`(WRdNNC2{ah84!}{JYg>`wQ zQ#yx2t&C>CNwA?CdZ(3c_WT&`4_*#jxvX=v>m}lm>5(rmhlvbx{E7#KfPI-u>>A6dH2@H z(_hRieC3#6B|wEYrTFRl0uq^r3b8(y&Or7u}Fn_;_ZLWgT2&`3LkDfhrecU z#^x2u=s-03XVDGQz&(~}q5@pOV^wcq3|W=X4n-^RT-#)E_2si?Nqf(dhCbN!yNyt7 z%2+`k&%rV!ERpuXqxMFG*`CxQX^>#O0x#Sp32R_YA89|u5{^~U_X>`}+WU*B3`ce0h+B6Da3$E(XFBWbk6qzH{w&??zP?@{20&+6YiZ~?-MJnjKmsK zP_Ue?-MkBqsIMJ!=b2$CviB|g;X}RR9%F5xUPZDQOebHV2|N%f_}rF~o!O!NZU^=C zt+87#^l6{zxX+&nREG~ZF;Dczx@iQKumVqCA3)oHA0P&O ze!q%?oT|HPeGQ<#w<85P8a7@Tx;C|$D?Iuk-TlF3*E5WClK0d&C%Gw}uT3Urhr?eB zV7%^v?6w+=b^KFhI(7%2%M$MU{*^Fy73xRGF~Ml_I<|!Mzad8xw?v<{p7;2m*PmCG zfLE{=;BiYt+WW)(LErM#%lsQWrj)Bk$CrPdw*%?xf#e?i@yh)7jXcQ8@#W{pkiKoj z``r;51-*{#YPWgU@;%kT3%--O)1+2DJ8OkfeNL2hs ztv)g3uSFUY<&EWE$l4(edjo!&%CGnKgv^m4eNu%vk0ajRo)R-5#hd60W$PUI;Aw49 z&+k8URVDqfj1VTBS*2}Klj`C*-`gjNp_GWk&Ih*M>n=MS72}%`lrNk=>BtUB*VKMt z(@t=UE_?5`WiY|NZ!?&G__*NGT+Mr#awu2&+1Tn`{Tn5*w3aV-dpEQ;4x6kH`AjXg z0YD6o$wWejy&Q;7W&nQ_R3BBk592r1m2kVW;d^I@@CU27IG8$}xw#deP^? zb`I=2choL#Y5mK8r^5ePa{u+U26{-7_*BsN5-?W7S?=O)oX6;l`x>sy{pVJAPlVr2 zz0mW%-F-Te-tY59mMtz>u%CeDEF3uHtVp34VxBf`W zxvo%7^JK@j1eH&{UW=Vp(GT8@e8sgJV#?=$)d@oFU6(b$Oc!+9eZI5o9sS-YHoMl^ ze#kpK-CJE;#f}@lT8&t1zpFDC$~RWXXLRHny|Qu+ncq0RBK`=fa(}owcKLwLZK0Rf zkJchRV`iw{nfvQgX&L`HN5-3>cPJrJCmd?T#F}c=Tkeb2GS%svF&&5(T@Rcu z4avg$Ii4ntVxAvjVs#r@a?nF-X35~kg%Ew}cV!hJ>YCBfs*w#sF=}pKT0a7UN&odo&|3$Q&Kg*bh=gsby>rl@0a$TLR;ng z1=uG{WzU5Q-=enehAho1wF5>vm8agBzvzBCha5=Cj&jgKRAfAn3%sAm=gi^dF&lds zTR;&y7C@uxUFZpkFUv}Uj5u3Mif5_m43>|ndjG2ExvMk&p3vjxJyz1Hr2uVl+I^B; zFSz7)LXi}?|Cu7NJB&Djs?6Mh<4<2O7BDc{pFvjR7(tkdu?E#9C zh5W_1q$@)=1HP_?tUMh+A_MKr!Mc0Cx&K;R9VU^5(`Lh?2{~C-`je63*W4|4g>`*Z z8TDZlgohvVZq<175eDD1VLbZZcsz*#g&p44-AAAPT1uBv|PQPw7tPt+cu-i}Wm7FWusR5X=WGU-nUzOSKzF2>T_r$%S zPM8bpR$ALRAYf?f*$gBRdI2U9w?|%g`SW5yN|0sJm1DV?qWvpJP4C2d+A3kvC;dTG z)R1fZ>DyR$%R*!=?8<}n?vnD)Zm))jdPCpZifxR5%&l(k&De-A%uIe>ZMX4dz_c}IZRwrkckYqN|G3nsL0g{RU;fue?y z@{i~x{YPUeJDv^;4j9F>Np_2o)_7AI!DE#D{vl zYV7KBn)b1h#MhCSn^w-*TYj<{Fqi~P%wAi$+*x>jC??H+!S#}HTIX>qjB}w0_hb8Q z1$WhXY#rmh-t^8+r{etngDSw8{YV%)*$uc!$F1y1=akN!SX7cK;iz&Y+!J zl$iFAGH}-Mv8*+*Y~PIwE!9E44tKwKUTWT(9Ao8{H1bK8m~rgKqMOzSkf0pi4X3J{ zn)RdcUgDnbI~x|_Vve{EZa$GS8%vlk{jL8>s3<1GP#)iTfhJ&-FD>{<&$vcLGenx9 zKCt;tKeu=Byvil#>D`>J>VfnGIplia8+^!asD%{8rXLpBQN_Gc zQOg+MJrW}!pZ6JcT~EC}X*r@F!?Hd?O)wpCdB2@^C=VoS;|7St8LejRcW2WiF8L*iLfe%3rGK9JECga<;hxW z#YZ-4?+TtcGPp{6Cc}J}a$~q3WGtst@JYGXQOXf?V6eX+>dDBz2GnlAGc1>X$vmGz z-+9c}Edm%Wq;BfmV!G!?TK~%npfp12#DC=H|J!5zTM2Kn<5?i{P-o5C`tc%_mP-)B zY)?~#DlN#SuTy#Rc1_L-GP~8&rJ2>ilFzVrez$Q`I_b7+5;z?}5IV)XJa(MyXa=(bC;dWb}vUpzbK${}p1@+sXM(>g$ng6sPc~aXul<=73Lomj; z9yu1dVIJgH54nyYC?_ra@L zPLV@L(C4J09N5E0txu%n8wT~8h2?~?SSPE2CHAbdXz1ts|xWM^S>*e`FfwR zQxmz!qxp1`;i9S9N%CNNRfd=TZByc}TND5D_YVbjZ&dSGjvbFa+?L^!TPCS099Cq~qUr=GUT2tI z|M2LRH=vl^ra)vw)89G_;LV4B2AepK-SL{U^lL%#HD?~m?AP$YRhFvq|u z{cTLo!kUV7x-c=Vu5)z_zc_owW@Jbgo#%c#$7glI|6*AEK+QCt{8F*(9ZkYbFVsFz zJ?|Ho?!H((9(2FU{d~zzyOZ9D*DQP93H1S5$=7zjYAPQti*h?{_*>=E_|^yYkk~hG zq^Tco3fB(5DKk*&Pp9~24j=pYNu$*KD587EgWjSWua&@OPpV^_b>bK`ojFNY?rLHI z++saz0PFd=VIY~Ts4ivMvBUGKHSDwi|IeuZ)Hwd>yz;MB@^7C+>^f0`&U&1%Vd~l3 zC74K-{mqE+?x=hwNGd!opoJ*W-TSRJ;AFTC$Q^=RJ)m*#Y1=bz$mKwr{0g1>l<#+K z)Z=g85UDP6#A<#R7NQn(K5=dV#ml7h2Jw~kO2#^;9;~$37yUpUFR!jJgU;#XdGJ_? zVa_==a-oZ6w1*UWe|T^x7LWk27xwxVo)hev8!L>C72@_ELBpI%JUa4^qTP*I}gG+Vova(YE`B>Bi=< zp!B`W%g^>G5gX?_Xqe^jc#R%=>a&K)@&jPcI2xai_vZI(m|m_^U4yBaewNh8y-XU= zr)-kb4(SfMdC{K>^;ZzfEgPnY)5iy46X*8{o%>(-t$Xj@FcTy6s>klVUWHen$f?$u zV}-X1_8kTLJK&}`!<*nNsb9u?n@OSS8(_mS(x6OIzqX%zXU<&E=^JH&wguRo59Mi6 zjVC~j{Qmc|y`1>sA71;C9~*>~z^HL&2Z}a6@ux3To&J{NGX#4-f(#5Eb ztFk>qb#@-j&?pZc7sGIHd?GJbQY4;C&U<=2z>Zd> zP(92dPg{|&A4|W8-vs|e9CFsTH_C! zIyZ8Tc#+G%p<^HO36u`)(DjNv;x>9Hr|#!WR~K`EX!0ILfXt)Oyb5U#i^Oi4jf#V6 zae{Z$r32{OVoCVhN**Dp&xD4b*X)abYWen;B&yrSx|mGSI-XvT-mwjWUl=aP6^g94 zzfDx|d!D>voup}YDz(WYlZs~eoil>I#Mr}bd<2Dt?^F5m z8vits+`eC04diwhyP8!bG!Z5(HTC$bdD-*YEngJ7=L^{Eg0)Y_FG-eZpPw(%BaR;Tf7De5t%OgY{yNvjPb zG6>$N1IBv1K`xRstBY@^O>Yw1Xiqnv$2fPc2eGYhdAZi&6E2K}NyNCA&Vd0Rq!^&P zxaH>%v3-(D{06U2+HD1hMQH#9pZC=QMq1&VmaiR=*trF(F)^!^Hxt1@%&n9lc==Y> zN>cRV)6m=bu#2Fy)~$vPvX19F*b}QR(H@QWql0#0L%gN&y0KcRA0FfrIdTBqt4HL z1s~O(`rRN^gYC0baXVL|JXEi$;|O!pS);;Vv!klnHYo1oP8Xs_#k&xTg^XCA`vunx zC~`p7lNfveV>_>`pvYH#AZ&TP%DboHie7MMH1$VCY?+#Xv&6 z784cS^Ss{fD0z2<-)}t6VTj~3%Ij%qVr%H{K4#->i*&x^`Ec z9rP0$%KvuMvcD#Mcx`Fmx%vyMUB4u!9^&$uUro4AM5Cdy9*_Pvz2Lo_TV&a;?61n9 z8Q6JKMlVamqGg&d(`zAv^65jkQ)Jk$PM-~U3(JplGo(oFOkkZc zlc(Ko&Hd5?y0mKk?E+MnT~#`#s12}h4Ze-phm^+h-E54Or-qh4gnhjy`3i_N{B3p4 z{hs2VN>+sQ>m~zxX2+q_>eoX5zYy)u57}`KaDTKZO|MKR&VctD9d&yepag90S5;jn zY!La9e>h^OW8%eCxJzetS9!Wb*C*tf5VeOs#0!T^4CSk1u|^@7szgYls#D0FIM>-9 z1MQD^1_=hY0X!`;n|Gc_n(xb5yReO?Eyj1Itv4PN{u2&yL zV!i28Eb>6~fy0cLn*yVYt$LJqBpdVVEAvK^^Bx*GU-IjnMvcQR)txetwoXwty34R{ z1p6F+E*)b~802Tx`iLE_Wrrgn3LeuZmcNZqENuos=`Vq&U%dB8!SxZT?&V^=}97qrld(W>Gp{|Jh`Nw~wurIP8TQ{>Ip3Ydc09;_BLLns8}YAE3|i zlM%YQEEj#l?DOWikb^2>?}x>M`Q34k1FY(DZ2iwk#R|7)3;A7?_x^gZVjx5{8{eN@ zc{k5;vg6Zdng_XT1^u0;{7#E@zFmwwP&;h9GA>{^)`ldgFBR1a6m#W89#KCJ?&}np zE8=h^Nsj8%;6}5_9>+Xxjt*AZT0JPLMGM{PaT#m4ar*g#QlqxlkW2V{mWatVCmTS2 znRbcQ^z4vIIn!jMub}6;|CNZ7h6gqiyNpiAV${hT)Oo zYlLDU59O)TQ^<(O;V$&P@4EZw3<(GHR~~*hd-3kPdhA0RvB1O%I(+te z>MPpaT$^L4-5*oCdgn`d-PFKZ^SZW0w;px!e{B4H5Di<?lkkTF!?w3vdYJma&1*bZbgFlTSwdU0m)=?YR|)T; z_tv21&`aq_lI_)l(a{>^5&e#xyK82~W0g4}p2DWAo#|+vXCIJcMK>8i>!fCr{FFUc zFV8{)??wL^7up5pr(p}`%_fEAw9r&Uwtet} zslR;v4@Tjk%09Il1)pfR$FEl3mC&s!u7B(9Bm|M}ra4r!5e5PHNkG$fN5B4)@MB@d z!t>{(`MjOWhJsY7@_6HNd7QNL@m<0YMP^#R4}6;YWfA|{Wd|KGK|{bnteI#IoO7;3vOx0VEMH2fu4uN0$HocW>N>qW`&k z{_>=cF=Iv34I%@WG+hZEI-^zd*UR;h>d$1U&!ywfJ8Oqc7he!lOoyPe# z#1{c5rj>L<7D^_~bi3G>z~dc%BRcRT%W;Ud_Jo3X@H zzk?35Hz068yfG`*pyx%f6T;`|ikYR_m~uuL)#9-ZEGF;7<_RYMK89aC?mpkF;t8@*!gN zL0jatif%oYMh|xMxj9>7U@1Eu)@p}9hvPeCKWbMGzNTv-q=j_}Vnvr4Sca7Wc)Q3l zy{$z7G-s`2=l#C70u$+EA6^s}rf)8bj}&rFVD1p)>=4Q*_IV!h(R+uT$m8?o;ljxX zZN`bQe51k>CEKYQ?+Z4QteL|;#jxTdyH6iF`zCc-25)r2pJ4@Lcjp#PT4Z{-**gN~ zwpMQ!s(OLf%uz8fpzSmuoG=upDjQYE?h~yw`ViFnDYnB0cKxHBD}Afx<%>55RX&!w zsZ0$F==ElePpf9bN7g0ImiSmsz2^nd)Rc<3gdLl)GcRikfvJQrjIGJU5KWj|oh>Tv zPD8(m{>K~%Hs@n?TWJFHik!Y%=VHsx|Ff6gAzgn7x0$iR{D-CDF7$(KcqYG0tN<0m4fBo2ucgvP^^>q7eIPGL*)UJ>e`B}h85Ql&ht!iDfC<8srfxs=X} zxZ?Yjoq;x^#XngQhy$>Ww-KigD?(OHhRF>stG# z?rhdRH8N{gR#kuWyT25U1+vtzYi6svi_Y=n$QZ@ZtVrL^t)OJ#i!G$JZ{5}5Q4I6F z{91P&xQt{M+2q^p-0^wvW9#7!c-y@GEj9694%z9)xe8z$RRDz!3KtEGrRgENVj?G9-Iz=nP8AWkXb-hH*>sj%6M< zkd>b)`Fz|bVdwCmAtpJJaeOGN*pXzz+r=_1rE7AcWe}%vFHwhBXWFo^vq<(_@|TejY7zTM&mw(94L@T-VLz}%Kpi}o5Y3I!;-&;&v_bYzn1r? z)fR4T1e?@;Lt8p%CEW!BlAbV$dPk3^FM6*VWmKEXggR=~*;S-~v{%)dy`^m)IXci@ z=m-W}!OZ3RfII|N^X8|;p{l;#fthc22i8|RxH7zj zF5Z7w6aN%k|Kp3%^uJe5N z7eGAD8KnM+#;w2+Ww86wN5t9tI>zkvK|$VL27jhHMm;GIWIo?hxH#1>UtPe_65vV^ zQPD?q^S$$)@!9|?(+X=wiX6$|Hy%`*%>yT&Sw_}6ih-YKTMlTg= zlv$+(7v3awjKFItQNGG)H%VN3eA=X6ul>z>7hQWfx2tTj5j807mrpsvN_Y5ogY=!- z>4UiRS9;j%{!G6a^SUQ0C6G74?D$Mat1~_cZzMnj8;_!piKlrsohvohIE`3ic3XW0 zF4%=w<`#hpxLpJc&48#xYOF-EKWRT^Nx8>4$&K^WTymI$xnRxbWa}RhkKYAXg1Q!y zh2|#XZJS<-@Adb(5j(@>yTYJE!Tzz{Ml&DV)~&6C2h}_o=Ikvts}Fo_?ram970y(r zi%C4s7F+UOd2ks$^zdqOwPNB(+yj+v)vikzy`$cbT_sv8J6*q9TuSkaHsfV@k5OBm z^j|-ygC65G%gsdp5UvWAzY|3j2Xr7^+B_N6D%s@LogUt+z?Og26HA^a4!pgbatlyL zPcgpWZhpHoRwUVzb>tiOj)jWKLostznXTvuKR$~MG3x!DXA;DXka)}WelZIySL|<1 zvy)~ICV9b?J=Cd#?rM%TZYStJb$9V6hT8s{ZaP_EI?Snp!(1sn>W-Rukgg*^^E{@dM~ELo)^?DORP`4oI9KwxEr&$ zXpOU0UtU2A5{8;;b8Yzt809@T#69?xv*4-_Md2_(J=Sl-u_g$nh ziX$$N^_@Q>*)*{nk9zmBqrbbU2Vsv7+aImKUA z`}G2}4dr!@qhzuxR1)gJNU=7EOFnE4egE*zS$=5fvL~ogl#%7u)5~#n7Iwm`9=fsT zJF9%4D`j{20{8$R86lcwLbC}$PjDaWxKpTo^E)t_V=2d+9hb)2;BRrt&J@VTTCQ<3 zoZx;1$ghfh2aurDvVL_Fdmf_AnB`Tr#;pO@Ca=2n7fb-lqi4J&(3Dp9hxL~QZcdT6 z-p~DtPKkWF6vJx>)cw`QoiLGNW>!be^rP=ohxYTcoD#;XjP+$?6kK}1;(SBhwQp6) zTLW)X*i;zR-T)xTK~aI+g`I(kUcqdYY(anw)B#eDZC|?~bkzAJ;+7*NmiF%4fx@Ky z*u2Yc#cHF(lao|dxZgN)05HtJkdcxW;H$`PLA~efpR}}jfvods;+}EhZ5_UUvQ}4) z1kxTB>Eg7IjjcOKFPKMAX-JR#-Nxh0Motx}8PdNHzsdLKhrw#kQPIIRo6l#miv$uL zhIqBk@Nh#Go^#C`#j+AhockK?j_F-y_x9?SW{X>mAN0DW)F##0w`V|^Ny;O|c#Q^_ zz#WS+G+NxwK4c`Ma#;4|*-1{!W-{^U$nV&9rRuXRgSBM?d{aR8UenDU5TdulXcC14qI-Gn#0 ziD1UrP;C2rv*p!4$a{tR_~2YnpFCIfQU*v9c6beal4;%RQ(MqXX@@x^XeQ_m0{a#_ z^!=8uh|g$2L`r?M#a6UoS?q3;6CyMFxJe zM1LPq$*CTq+hm?@go#no1d?$yKuZ#cN&Q#KPS1UW$oqP5=UsY7pWtJu0oL(ajElXi zBnw|&QD49^GI3Tl&C$?4b5*d<#f5{|QV8_s2X;u0eyP)h#&~tELiw^(w=F&*yA(ri zro5SZ+&2f6!rd>qvy4b~vV4C#uiD(z>R8J|sTe}fs#wO9Z;5Bh5wogYpUPQWW0IHs z`Sj+Hw`~@sSu!;J8|lM(c0&UJ7f$g-b~U-6dHjwwRHbt;$YcxHV^SP786mWHy(?k- z>ilPhG%gMYWK3vs)?O*|GG$;o>pdM~BzDVlha`vMwtd!;B?20%?>KT-o<2d;ZXUBx zbheek5qZ!9r=*sLht0gc>14!+X{hphpns^Muz~!wYH{=+<6OKD4!^G)KYARf^K~&F}KzplDjOFPAL-sP>z_-|{$c#xbXj zz1X^~=5PCD)3^^W+y6Q1_|KZIocc5BUeollLRWOC=PPd!i&0)m9Ig71ZtaoVog?Yv z^)@Ni$xW$d3FcqECDGwI##?M+XU}MUkRk`a3&M1k6bSm6sFUQBaJStrmlu0I2q6rc zso&e&uIjRChYcF2pH0LpTCrbOuDg6rR_iB_YIiSJIwxpbT#Zz(Z}iYO_IGp-=4Vi)g2utBn%^pck9o zY-jVL7#g=lPq(>j+Zf~)@|xd(alyJ{CSUK7Y3I>##Bp>*kHi}PsOxW?f}VbHA$m7(*!^cD|# zS3)K~h2^BMyQ`ExxH;Z$d>Jy?Piwdr>GPPY>nWWBkJ1BdjWuVe5L-!1$ai>5r4ib@T>ziWWb{X)k|9a zJ_q>OxceV_VAJw~1jc`hURDC=XIli^xAe=WMWpo0+Rjgy7+PQ=IwuV z?_y5&YfkVt2roaIg-}2n`NPl{I)c6o1SSy(a8KNFx zxYOqE^B-(>{PC{Iis@UK@xsAyqRKq@khF>Y6L`*GzBFLlMedmXn5Lt!hp{b5kLEMV z=&<68{h2#jA;by><4<02?1~)cj9U`q zqY<%dR8KHayQbiJBLEouFEMs5H~gj+e3CA~er!3bYs&&Kym!B*Te4%l;*YSnrqvB+ zT~w5U7A40cg&*$DEROY7Y4}!-2#yUz!_-!94Ne>AG@aQO;ixP!|8s`__xbr#680M_-5V_hJ% zQfZnwHgcROZ3+0DbSYvO$(ACLf%`M>LXck{^M#junTVZ2Db9M1RZpZjI3gC<_1R z?l@N`gH&+~Z*dEnN0np)L7y~e?EB55{;v=5zo}&PSAl4gd}^gPt%@M;KBuE5t+<&g zZa+$=rb=v?tW;y!lCW3qa0$2-{5d5j@q6NaKD*r@E-0yz)Q|uvc?e5Z{illMF1-L z`Fu?QT(Zp|=W03n?v$zMpm^}{0&8EFkEer)){`r1LNf23AkqLTWJE(bVzqVs$eYN8 z&$YP+^@0N~x~X*b12q*7AYvgs?K%Q56|yQz#DlEpW#B=M+A;#kJ*3T&Zr*!MnujDi z++r~tvdA9!RjDSi@#hhkjTd?i-@gpIF}s1e%)-Te2J7lV#mqis`}C*%b6ogO-xksw zDPdel0iyS)!8Ply*ysQ^S|e8O?Vi?m>5q+Wjf*S--8M<8o6SZmah0v}o^t7B9&Q7h zoY0rWevEdCE6r8+x|4+IqN7YJlzf3Pm(Ft09oDW)d1>z!ZHs!CLcKDp&tr8M%!a(; z{AxOQOye~~`zOu}t?Nm(O`PCH4EcKwzlBy#byaeNd=}@y5ni5iJd7$e8643ZL^-3{ z#D{hKn9hrO=6Zc_mvm=B_^Y$#mz{bEQ)d?#L)`Od6c@Rzh;@#{1dqPRy&@puU!BzM zG!@7gH2n6lhw0aWC>}<~3pl4ZIKv^c*;27H_srss z0k-oMn&^gp%0ruci;;8vOUF?wLB7H8up6*QNc@(fc8q$Nxq_YRP09s(g;R-#|tYTHWK$mVj8}O0Lr@n zYs^vGB^ywSlQFrlqCuCBRdN&@DmI#wv>ru6yAE!OiFJa-NTn{-MoA@=T~ zWP-1K#AKB!E-9N`GEqTEVwVTMshI2JPTA?6V;hp^vI5WS+Xe=CnRTgvbXEc^E>~qp zu=i#0j?YMjKSD3%-G1Om}@^#v8d48WdLq4oSELM)z@URpnqfQsSe`@-`+u5!aS{J|vN zHF%cIs-o1PkZxkM?rP$UUG1R+e56rZ5W^AbtHX^#V{Wrbj&kJs58MMK@}q<|g!WTX zFDN&XNCB^3lqQjtx`*@j_KNgjXs6`wk{Oee1;joex>}XF=4!%&kK3UA&s}~`p(YBD)#GI=(?xM`(QfpBts!0vmyhc)};?=OP zETiuZ$rjFte}}bT&vP3S?Amx3%NMFu+S1@gko1YpGR}xSa>-KX$(?P_+*tn9mMT)P z(OrmsHI#hY@Llsv2!OcXT~8L03-1pI-zmJWhRKa%ofp3pNoZFq)R z$+L_1StWPhTpEd{6Q2DcXdY!jxwlvsqmS8y_c-r**wC>q-!Z^>?y}wO@u)z z34=et_9R^Q{t3aU7El(=t+^c^N!%h2z=GUKBrGkG^f@Dz)3I3vE}sTLAVI84GV=#i zp2OYj1Of_5+MkL&(ZE=6Kpne@=>g=4xk6d<@F(vjOMfMMEHBp-NmVwFd)(kOTfJ53 zl;|e%noDA?RDAZ-#+?W;ueNhGt4bV|bvNTBTzq1M5`c1)9@UMGgOC-s@deod0os~> zG?%|VXs)m$l#-RAw0Yruli;I+Hv1>kilPl?D?2k>rc8dHT>f_!;6HNc|9oLsp1g6rp7{j4GLRf})D3~{FT<4Z+unW%3foke!4<~s8+o{A@mwrxR0RzO>Fq};cs zOKrl@MKmq_6E{2e7BjG#3_2!vbC&J5!@5W}N7YJ1f&W?DIZH(e5Sp8d^UkZ(i&A4E ztj!#evQR6Kh3Kmd&&G69e!H6ncYD<=RB$cEx$u66WULozm!JJ@h@nc$L%N(AHSCXX zi>2kfN2O3a3-8xQjGxTTNa&en(y4ZPKQ)}$)C66euIM`FWuxl==Ni>E=iB{!nT`3{ zWHUap_z+Ng3X3UwGWzh`rP$RcZ|3-$Peab5W*x0kH}0w1Yc+#uzUh?aL_O~`41U+; zG(u0@dmmA4FDaq*)^#}}DgL-g6U|iz@Q(+(W}D7wY=sI;wZ9MX`HvQg|7WyZfA#7! z?jEbeubz$3VXU)3E7FH6Y@2SGUb@&7{i0!>u6}Mf(@-rFmFL5n_=NqSH*3(#U>>y*c;a6)E z`=y|+HAMHOVmiPDtEuGY&u%}D9u|LscB=iT)hXd&@T$*pWmM1 zjs;5lww=Q+N2*t!PZi18e6;+Ng&yt3{0E26%)g z8^Y$SfR^4_#_^ndY1uOqLkD*E50iEMfbDxNGuULzRT8}G3R4_Ab!v?OJLxirX;Ke`1>vZsRNJOe_)8_$oM%(R{hj`YZiu)e~5f zeUUNSP1jLTrR7AvO0m2meFkBJ#~w1Z2T^gCN{Y31sn{<)07?(=4wLIuRN9&UM(G}kSq#T?600;)la}D7} zvkp0I-v}F9stLlb1rxVk!`@!WpOBW%lFGzOyl5_jcRs5+cwmfoO*%(!?9ud9QFHT$-Q=awySG z6t#C>IBO;+G8d#?HEjHV<2rN(9A>8ghXxp~67YVD)H6~xM-sFHwS5K#PR zRPHO71dN!cUs`W*8N#>QM;sxynE927W6H7IVdCKh#H{g0ZpBud{5z$IQ_2*LawQhZ z*s!)it1*f7t<-WFiH=aqtCq96SmY-6R?xN>3*Pofj%}@%&NqlFPCjN@Jz%uNH(nrt zc5}^UcZV=>S}o4`7!C7Fr%X2zYvU7UPDG5=&Ci&-EtyjS*43C>jZUxp0pIl-V_ixp zpryO8%c6yXTwAKrpx&>ziU}K%P8=kfp(2p#;ya($SN;_8nST3*Cz9D5IsXU~> zF7uIB(yot#u8jj7O(ddD48q2S?C>)t-!lu%6uzu<94|oZiMmJ*P=+Do&n58T3%8m< z1r1I{E30^8KV`~8v8VZje1sYum|jAiz_{s34$NyWj>tt6qa3)xSe*XM9^yd#8Z!Vl=v2rq59Kq2VO5hIa%PDc zqiSLBaGvKR2ld)DAqMehhF&DvFUoZ8%xfxK(gougqv5gmEU0@K-Y-ws-Re`&S9{l! z`BQMj>p91jKM()GGS`=%-=P3gp=ZVYh*seJSq8tIL8j%`|Gpmo!$vUQT*HB>i_DY+ z8RnlmwsY>-G~HHwRA>$%BMhq{_*LJ%KOeupl@RSPbl*yT{@J{?`caZIu`T>MOZ0%g zB6MX-fKU~YGswT4QCl^RTmSKHe9M`rI6Xe+Id~%^RxV`W$@WaUJy@iJ)8V6Nox&=8 zUUaz^29-;FV%^{(>uEBrw*)3jXk8oJRi@+DA??#dJwG*?6By((1mPoo?9Zv%A#$+nKp1RpqNHqP ze`0Bt=6d%K+NRS6xCWz!u<%#f%Jlh=(kRqDOcpJtt7mq!;sp^0R}I(S><9Ve-ikYt zyb(*ClJ(i0_am)N#JZXIuKN`r63iTWAKeChB{?4IDxQq}VT`5AjWtDikVvGxH zJ8-E}%H${I%R8DYuWd{AXh1|RKSzhIyS_~^-W=8^A|fnwFQzsVb^W24J|V`IL!3Bn zsnE{iOtW^dt>IEM)Vmaqw1xDI7%ZdmEc-f>d+lU(t6eQOcJxa7%4E-AB^J(q}U%g-C-TZCmex@a~=4((Z73vcM>}_FAQr_7x;+RsT4@vj;P*7@Wp= zi&SB%+kV@0j5+X*vVW1mwzrI@TWeNqr5pw`ZkrStxWE<7=hgbqd1IRhL3caJh(#ss zaaZfik+Lwu<>jvGu1;f&GI4@pt0EHCl<PW=dtllT9<$ZM}p?g{SCn-FAo zNeL5sL>i0hbU)AcUoPW6Hbge+4V>pCmrD|aAhLiJS)cUV&j zm|X~eCSgu>IQL3<<$XVAgq7a&kQ{tRG3CMqQ|;kw{))PSlj8$Ok~*bHU$&Ju51Kl0 z9hRZ3)LJ>|G$(^GE+>0s!{lmN^~gSU?s8C{0T0`|wmuDMEHC5`PrDkypYVAnBBmE# z%vqANJ$pV*M4y-oniKVK-1*eOB^oK+@|Gj1s+?K|c$IMn?;3p&g16Dtd*j?9i#qCz zalg@Orxg+&dxwWOvf`k=yC8o-W}-g%RAUTp*(Z1bex2FKA>s|Y-?&bme5l0kC5$HS z@df5h&y1LwnJz9|&^3GHw|KwR3L2)L4tMX+5$YNPb!}F59}RA%ZsAs8_r;$6wK)ea z;6K*>&nvRVb!v}@qV9E2x841=xiq6_|NZOysg0+6e8uWbUZ=R;6`Er^nrO+tI-pYP z=$#pG9a{FB&IaQ*cuGg{&9*XHFr$M4I665g z5+afXq%F^faRd#>k{2g?;dsZPxyF5;4IK#1?ORc%je+rH_e@y|O*Q;dSoiIFqU4-f zb{URbbe;EPjd3gP>8Th>rlc}a7_Xq<zT9%gRFVIo_f z)DbcAUP60E*o5WWyOAq@%>p>GT?a%(bDGXB$#CXvSrDV)Oub=?|KjvjX$0^$olIx9}Qol9VM#b7GSEKybRf}|v zNuP8JFv$k)bDL@c(n&laLDBYsOFBLqO4U21H2%L%b7=j6Y=8ig+Q?bA*Nh}@gZFpg z`(%a=)Z;Mei{?Fc@&9fA7dk`s5q&Mcz?=xW5$5x;fu?&=li zNgT`)S@sRHP5E(hep#62=>_Bcp`#?h9hUX(yab%I-8sB{B)S*Rc^u(4j9oJmuq>?} zn1F7-b4(Od?}iYxCLO+Icw%=0Jgc!NlLQ~PB`^$d#cg z2zc$%etR23suXer?m-(HR`H9ZFbzfAK(w<$M)0~VcxR__IIGeFD{ZOvn{STbT615Y zi%0GzAa^$sCiaOPtA4Es3w~_+{~V{*g}vPG+Q$|6QD%{QvD6KRQ^Uu9-X5`IFzCA7 z)2Bl{b-k13Bvkfc=jLS57T*4e)obCvl)gMY3yscfPkD|HHk)dKRc;133F_!b-5h+F zB^Lc;Iha(+C&Nz}hIgP9TeNo;csr{gNW5;gsIj*55cXrO9EAK1r0o%?>P<{J8cr$0 z(#&TW2yE*}85L(0jx^cMNz3QC-IU1H?aQ6)LD_D%#lr9mXaf#0va0vi>Xz}$nQcU@ z*CVhE^f@O+`wSJGY*gIzZtoGcT)hxfs$Mfp47BBAa3}+539=7iu5YlHgAjJOF-Wy& zM6kEh}S)QDX5hA1NBO+%I-T`jia~qMHX*Y*V)XkF*UB^IT5Z#R`+6^ zk!9rr;Y%8d#txnrPdB|fA& zsTQLL;pn!ro(L7c49Bnf%K6e8-YyTg%bB@P8+p5jXO0Vsy_}~yPtwIuj2ak~lCm(} z=e_cu*Emn?W9qIwfOJ?SL~cFLKu#30b890vf0UL}nkLGYak9Na3Ad%Gs0yj;nWaTKjjjpCW-OV{v9`LuMH0z$1jp6z zh{~FQeFd1?QH{^v=L>gtS)G2=l04g95m6Blo&{(>&~cLFDt`Cj5UG%|8AEu{Rt0Xb zPnfWc$hdi0EH=X+kWlv))dhY>@7~Pw(-ZG}Ikpc-uE2H+s01Wz7l+)(3HWVrgOPii zvXpJkc=+?5%lh9P24J0PxYwAeD--hx^8^TyRPN3H(~7O7oZ8!h@Ap#~qeBGw;$Da7 z=J^v?n39f0Zo7VquN=5COYQ4`dQT4$6-qdnm)ue&1rM=o2hM8B5~;)cCP~Xjbg|5d z4y&;c@?IUx2w5^bo=My3v`sMmwtub8kF3lg(~<%)_T7@C;0&1wd;YD|n+N8(d&PZbheOXVzx#u1afs4JEE=$1Ot za{8}7a)ZtP;!BECsvk1C_wIA-7ngY@Y{oryVvA0-3V{h+WXjpFdVFpfriQLALlR z#Ag0}^k|AE>gXy=lfuT<{X$UQbHE2vOF!r|8-{T2RH`fCZJQIOxo1`DIrkbSlu-Wg zhCUKaDaFgcZ2eAHfwlWHk&poFjRLo7sW6?C_oa?o2;^mxj>we$RCa|pR_IPTd@T1` z%=6%`hfoEygYSs?ip-Y&@d(n;Y_Z}uc5#PooRYQ+D2)c{alHeIVJLIqynjX!%QIio z*|=jbtGlV3JkiF@njgW_8^doaJP0L6N3Z9v6fZ7b+s|G-tXxShtqnHxWFKk667Et5mHc90>RN}TDr$F)UOnIsq!!JAXsUG@rT=KJ;?mQJ|Y$iA~#H~?(mGwu0fBsL#O_->6RC%J#}+^H2>w>d@9=201$ zIg^mR&r=GdgeCB;cLoY?Xl1QqvjHiT{(QNre+v-S@X#S&Sk(+j&rbBtjyEt2-l~R1%Xfi~U_$Oot{BtNcW}d+R_)UUZyv@)AnYM6ny#Z{QmDBC*_WSTVG^kNVl>EbqJ1sABSOJ{p$mg zo~es}xD5BI?YevxW@D}894_cpO6$Edo2`_?OUa)I8yR0%wwiOw_Xg>%g&>{Bp-6nj zlKUq#rdc6Y!I@B*-4+g089iDtk6@QMG3Y8m-@E4HE9>3$M{&SAcmLU30gdgFXMxB; zgRlvT(-(T=syiMC$RX^Upqj;rPedgOKkWb!-QgKG#@1?pq{2Rj=KRowU1s8> zh09s;wZNU9j=okVccp~K`6Rk!sNtX(LdS7uEzMo6F1gDuMh5TtxNT~gLz=6p2&*sQ z9(gd6Yf6_pJ8Z_NuG-phi>cb!Ell0Q?0n7!-YFqr$RVK}rBRXm-L%zs#5*tEtF>W% zkNHvQJw`ZU1mbAJeNN`5E&j(S?Y{&K^;XB~>gZ7Zt(U6UUWYlSeCZ?(v5tv;(BI!= z#fn;AejQUJf>2BiQ0jN=GP*4ZBew~%c`cFOYWRjVZ&n=35u#% z?1Sq4lkJ7#l+XsIu`IY<@_X`9qg&3W+4sx6D{=~O1g$fDoR!Bw0e+=%2{!6R+2?RD zj8TepN&D#G*(-hTTGNUW;@f=HZQK#5nQzH9LU$N0FPg2FI#!D^b6JSIm_U}3$qwF+ zOE&ZzIQyF!G;B770wv|(a~qFx{8eJt5zz0G=eD^qVZ)GW^xIXIr};HE;bOQ?Hp#p{uPlMg3&CR(Gm-JW9wGKL^%2= zz7j+n8C(WoHG|1EevcFNxyeizQ8t!w49v{c5l3QpYgG}eDN2+q zZWhDjt#GAW>ml-FLhdwj7P(KQaBf3yO4SvF=j>nWm9QTs!#>Ik*4bBcqO;BI1$-+g z+e?3N=^Me!Ymwy zaGmbv1~ZVBY&yqhEX^-wB#y2abib{tk6jY)lWHtP`xq%f=us~&>$%JE?`ZmN?%ku9 zhAP4C>b60d$HYb=pO2b{vGD2tt!@5~ z+aPmgP5WrjW>-UzFwI4CgW|Fi1EQeI{(?p}Wa+bUIil}aBH2M(4j@ToUFGB?1jP#a zX~sT7A)l>S#+v@Eo9s#l33iD3ST_Gk^*ynt;l1Eii5iMY{(eaAGwW0>=wQ!|8K$6% zX3{3#P4|VE*=j9yPBf6U(-o(T?JnXfb|}(06FlQf zFqHw~!|MGs|8s*cMS^pxbVa9Dy&8Q0*c?^z!IxCsxAul=@Hv(k&+wLxsq1IJ5$3|qJo;JmpgCbumFlDp2eD+JxZVW9+s#^2hW)+xoA@99V zKKU~a`P-=Pf3O@oZ|aAX3%PI9zCRivXjZAgP&0qu;tYAbt{3EDIXc*RVOP|L7wKT< z9Vlzgls;Uc!?(Jk*~=k`o+}hBr98cm;gA3`D=J2~abjRhxj9fl{J3?J)~Q5!N+}g6 z+*PY%un6_w#ep#nHw#0O4YJW)lC+p$nlsj^vDZ<6$_8^GQX*7f=DPk$OuD(4WSa)| zmOLzs8MaWq!RKq0x7r^zlfUR2)gQ|bzYR6Xp6Z<8!bl5EZEt3sFq%@pn|QtjEAzrb z*ab80Ve+ne#wo#8%eeL`H&X>Xk8@J#Eg^NSbL`qetRs#`U62EGyZ6IkyqczwnB~`RGpn+fTu*+xCE$V)DcT$ zOn`yTT!5 z9#xGnUeF|LMjfy9gN<)y3lt_FLBD`N zJbiaI)2@=Fzl687>Xy$ezI&zJSU8ivTpOP{b6$0`lKM7I#_5C$&94Rf|FO6nj5}VR zUM!0XwJxLt+-^OVitkf|Bu31%61mf?GqrS;=~dGmsQOlVSi0(HYc1h&DMccqhIl-M z?dE;ZM0O(0b`~5hON%m}nK9}ugNNhluyy50?g9{=h-Y-ic{2#wU)pO2y~}XMy~Ju* z*f$-%`Cy~@&l%-mO&7R9cHjs*cgPA*wH6CEbw)9JL+!d=CJvEq-Onbx(7tD_(c zvF`&Kg{P%_ zzF-OsgN-7GS6V3%77)LT{D}*rGB(#2Pb|xfxQ?v6u7Z1&zo75RN!Q3EM+xU&HkrfC zo-An4fquiW4l)3fiHEE>$h1RybyX|(9;aD9+D~2K%F)g*Kd$>c&_c+wrmJ8%Kl73M z#Kh?8V7I`XD5xA4#eVJM>zURypCRGX_*Vkb4Sv(Y%Q822et7xl2@{T1PaAnKZ>3*# z6+DEIONi)~*4~VRd=kF`O~b{-gYiMPAv>S?h4VtwMJDdaN*iP3$X%P8$-2(pQ9E}F zyiUt!4Nh#@{;|I+RA^BRv$nd}e z-9cmYx`LKiM#WitRH*s{1^2%|=u7_$LRYP@ZRw(eLuBP*c=0+Inl8SwI|U8ZD3NmC zioW1%(EeC<6i(6xo#@>six)zx<14M_mikNcG*?R-ZzR+$NhRajMe?xuQ|^>*Ao`lG z`V&x&Nb;>N8Wp3k&#fu`2|oXri_qB!HGv~2tD=axm27D8i(&z3$^2I*B5sQ$DjrlO zB_(-#I3UWc-w;%t5>jM?p<#|6K1UXTGJ0;Y;?4rndftlR$acNf|E)V(xN`5dUGF

cTnoQTV@0oGb84(x@ zA|S*O9TX6hVx+66*yv44KtwtrK!5-tVGsoi#fEeuA~g_dLJ1HtN^b%okU%0JH6-)^ z34!;!SjeZ=0+orF$eA=VixKG8({3s54-vw zMl#QEHj8J{O-(W%ZPGcmQXlcC^H%;hXYxE7sdI3- z>`qgi6)BT(nw9~(jY$g|@=ABCx;8n#77?xCy|TOmWZ4m5(~Q)mTn~~4%`r?IjU%~V zEJ87;68R~w>D)a}@m!L9Tuqng?b(7$ z=H>C46ZZ^^U`yg9G%oSRAcv}(5ESV$ZRah9D9-ANF`LMCO115A(Nfp7Uo(PaQlU3R z!#4iZoGrDo+#ZvY33C>wXREYV_(#J<$%iB*<|NOGHVyjddbln`?|!p~`eWkmJBH3k z_sDK5$XwsPmE|-<--2o+`(>1A5SHDymjCF(E4rrx`5b_s@TJy|RAPj*-kYSN^0{L! zNYCNqF0H!xfVbx_SFYdO*|eiN`g;$H6!Ht&n`tY^SS*=++ne-!7^adzqu+F`Aw++D zP`(R7&XSFij*}VEo2eu@)f?LbTnJnb2YZ0zU%}2tunYyxZ;AYldB5A0AnyBpCi`!$ z-DtXw_c}PR>4fNktO@+nM$ny_^8O9w7sOxBaEITk4+*^cRuHHq{@@{dp_>>uQ7CYr zx)?$tGlea9dF!<9{P5K}Dm;^S;>Ss=hk$Vyc5n{IVI*awUo~m8TvVyJqZN7Y+ei`U zJH4khh}P2NftcA(k4XaD*7FkTEy{g9Nzp>dXdi^JbM)!SSs{d zXysSgFhy(t1e^kq-ta(71*aJkY8Hz%PG+<7C(Qg15&!{s{`U;f(sk~NiVk6)(uK^ngj+(J% zAzdkO#N*0-`l_ey<|tGYs%x}lAvhvGadqeF_qw^9I;J2%B|Tor@RGe&eJsvKFLY9}_J`Pf}>X)W2C_iWeNKW1I>`91;8 z;OBbJqn}mtB_Y}(Cv)_6AJ%COrY!wH+!}A%~3|X>h<|Gp~KXVHrN}K%EhczNviq?nl#CVEmR6jquQu=gE_cIm+qT z>}(3^d=D}!>rT<9z%sYtl{bb+YFC&{*1UehiuTn_eLaYKddQfbx1KjVoZ-rM818O$ z9>_&gH?6hqyG7Ooo3CY_g)fS0R*G-aUb{xtPTs8^>i%l}<7!yD6V_8>zxyv6M!oqv zD)Qn7?`WlVom|_g96oX*`zmy@A;AYYYO%@Kwzh*dQz!XVW|?^OWUX|zz&H^3tY4s zj#mgZpH~m-XY;JtH?Vr*11m*>d(Zk`*9UP$k>s%c19gf5e#e(aI5sP>s^t_^YuQ2^ z1ipvFHsr2RL`bF(kKXVvWwhZ-(z>Hu;|vvEbu)$(2_=PC)U-6&%jEl|?a|c?)Z4>( zh@@-R(z(w8%Q>fbJ*mw~PYBg9QSSyW>3+O~x(lSqG&Sdx`o|I!YN*$s$n)Xgl53)aVc~&%E>GV^et? zXV1jZb6u{S1Z<)*Z6q2ZnbC3Jsf|dB3{;tqEE^ut{k=YE2G(o*(WQUwd_kpMf^2dB zr-0jDuC4dg?rQOxDZ9A>@v?W1RTq=6HICx;ltO{lFluWoq&^2!Clk_Vvt;hpdDAU# zPSYHaj4gEDq%AO8awUBqO5wG_OUVGk$Zv~oPuO@v- zPl@!Di2c}6!sgbn5wyYIzE6VqHR8yd;?f@aLd(j-L9urSv?1R%(U8K>nwcf2FKe8-q4KspDosJzNh`FYzd-j(y(U2XH(o99i%;?O>`xZ2U7 z3zZ2*JGCnWQM}fCD2xZ85;HZGJS&GC`N0`F#j1C+{m>hL!2`L3t^Bbt zJKW^Z_t5Q?$|p>FFm__HszJ7LZat~j2vx{@&zLSKb()&!xq#zr=y8Nsa#YqIg$X~N z3t52`wo3|j^mw#8a~)69!YMO)dSm3;nNudQcpn+SboyrN;kIqPP!%~bdKZ4gV$47n z9-;Mp4>{?*wXmz_fN5gXk!WbRh~m`?EEc$(`aZ9xBjWmrqBb<$uH%vjR@3e;=DLRe zc%PMUMB`futQ|w}Z^As%68=gTTyw4moNnD2Xdi^R?sckt;J9(bLBzA)N-Ya{b&umjo~S}C86`v-rWz<&1m@x)L6 zqTm0{c=6?IM6rfl$X=?+JK$jMg&pHcjSC9=>9Vz8BVx~bFYFcpvLk(8dStq_j&OzE z5nqH4<(dAXe}Dj41fim7jw+>l?RwKf%%*eV;oyBb$#Hklr3!ND{Y6m7w&qu0lqPfU3M7EVqD-TsFZ zp$A6m^YWl0<$|~6c9!FaJS?9VVl3hZlVQGd-WpS;X?5}@)74*lYJFrip&vdo2-B3?nNqWsP+I zHZf0EDvCfDI?Ay1gA3i=)iz&7rt}<9G7cw|+vq3M*wXiubD|)o$qHmT;e2OMeyxtQ zyn%>s0cPIK5m8V@dkv(uR>R5zqONqC4mb5(dvo)mxpzHq#CEQ=gxxL@XO`2I&TE45D<)a1mGA0n?IF3`20Q<>UUKJZn>H|eJroQ zX1NBMs3cf9i&<(NE)sTTOx=QHYucfT2?E&id%2|nT;sVkhT2qAP^kOS`07$NiNc|D z_4113ViulDL}f?yPd0Lkc8PXPr5e+o2jwm)EAIUCIjft1u%D&MK$ver>|xSPw0g_H zaYxum&6U-3foj%nMqNhe7kHU7JuW_Kib6MnpY@^))*OPg2ZnfAtNdTtdAD^2)!Xb; zU*BMZ4~vE~E0{3f)m^~5-DU^17MP1{G!{h3i>b}}4(+YNFieVlVe|rH&TpyRDrYeR(?Zsuo2AL zt>XhEO6p{8NYz=oov?1}nK-<3=Q7hhiUQaBHhSC zXVrB>ca^&ygx@*)$06_xxD&JcxL5sWcpSFIhz}K|*wkEgBFqIopx~-c!>3|F= zdDpfYI-NdOXr1Sxbl+eM()EVo70Pug$S|o>Wl!>4=tVZLWpPdZ^qrM-7D0TeCe7{9 z>&~**Vj@)1Oy0M%yHnI+7T2zq8$K;()l@SovVvGU>5VsNP}(SgBur^?)yV-lJ-X&_ z-!LDULH=)pav}tB^?We(SqSi-%o9DAK-bo_OyKcSVw222>5XOo?mKrAKkR8FCYM{E zTy=0r%Y1lXSR56jg#%@Ph*W_0C{P(~_4nyhxH4w>RXtLBZY^fzmwpM!7a0EX!M>Nb zH|<;G*{g6k797?-oj>!jmbbf=+gAhZFrg#Ump6Asu_OPL4fq>^{n7a};5ln)PlAv^ zl=}5uqYj5*$CZ%vPW9}xnnF{s|A16h)bDZEV)m>$bb`glEZ|8suegXNufp zWr+Md;R~AM-Sycqq&J^#Q$mJO1eCV~OD9Zz{L>U;L3DUS`DhJIsW!A* zdEcvCT|pi1^7d;@%O9Cbcb!XMc!tw&+MxOw#`f!x_-l6qllfq za!+K>=SQ9G7q?>j2UR-*dPwsNaKHaoEbMPyjJ-e9MIB{2IGd>)Q^zLni1#c1YyiuP zuS-6sTefSw2mjfj==MXGc?aaWgFV91#LY9WZ}UnyW>%|5Ly=n$H4>-el2{`u?C4gM z^`)lN<|$wI2*S!{>}!?dZ1(1im+(^^0O}&2glCD6mJfskdX(e(KUEMd-7ExFtK~E< zrecrGid&D6i1?7Yhpo*O8{+;!j^nt(N%EpmE&({pQ_^L6_~**$-4abKZ%1JFkW~kP ze0`?coqX*i12TPpg}`~S3bEs+BrF`8e)r>`?z=epLf@KCuCm6ogcZ}zWw4-H?B%fd2P!V&24wg^snGj0}I?M$UGsXoRjBo{WQEOg8T`>&Jsqb*3S^5h4 z9(fH;xP(sx`sb%;IuNXN8hu6oyA=OF2^#i_!YO|kf;yEg7kg^N8qnDO>pL`(w#Jl?B#}5s=26A;+Ez)Psd=zX=Uvf*3=jH zNsF>0tFhW6s>H`*AFlD=gbc+(!wd9e)StaWtz3O4&H# zh76G2nc8NqUKyje;Ai?TQ2Fne)WJqacTWla_|lgY(AS-{%i`wPRsC0ItCGkA8t-ot zHsTp)9H;$r%pzZb95v0U`YRIoI4#MZsfp5fsNQgRbbO7dPuE0a{DCL7u2bo2PuGwlItuLAjiGei>gGgt=2d7myKZ0@xJ#wDJn-Zki z2aFsi%(z}g6L8btAN|aYk1YS;H21L_eN#$jQKH4dNk=bnoV=9j3-?Q7XHsUH(_9|H zave@-(rTX$&6^vRwuPx3#{_w9oIdnW8VWW+?+lEz0-v)`pAKzw^R}xJ4nHA2`9ujlX0Z8i&g_o@ zxmKx(Ch?bw+vl7Bc&N%m89SD@zPRHqlEA(M znl=_Z;mByjb#nN09#Kz^f{v`=FG;msE@S%0t#GlF zM$gIo=#?^qoHOvI>m8ru9A<^L<)i4Rvch%0Q&ou^!Ni0BO|C6*Lx5OcWfx^a!10wc zn0UpLB9+4)n8jqjnYW>*P6G{QhJ@7=kGs{YnBExZT(y|rH;1D|i=kbXcJc%FBWE5P zB=p@bQgK{EicJ_&!`+?fK5t5WD;b!v``Hg4nPH7;DQnFZ? zHJeYY9q|bFNlh9DfR1(5$SeD-InQ(OR0mEK__M4>lcf{t_FB(rN{6A|wC-A9)d%xp zK|nArK1)o>np5pQ-dyf@nH@yr)NxxZON2nS(5AZpGL=_}{FW}4bs8i-TN2e!e+tI5g&pNrflzs}+j1zaw3-+4CbecVHF*y3 z>YVvzBz{%6^J+b227c}t)Nm=M_?Yb++zQBoD0&wGZKTWXm<;BOYLi~}ZN z>b#erV0oa+)7qnM&bDNm2QqPNn3**sRkCQg3Z65YsX+tN==r0Xom$q!jfv3%+fb+b zBo_R*$v+34#x?^#vkKeh+2HnrxS+14G$217u36u(RsTh)B6$64`sO2W-_!XwBfCDB zZ2dB3a+Z-r^-HR{?bwW;EKOJwr8KT6YH4YFveg4>tRCIE20!Sd zWK0QAA%Aeg`F$Tik+HA&$IuSp z-t!C9_T3jPTN`SHu^mr(2Wx81VEGb3yC5GtHT=K+7Vy=b^78E$yN*qHM;vHRPzu0M z+&|w)Cw@?DK^clrCYMQsbT2h;ZHE#R_GKh+#NO+Dqv0|n3;76l!iVw1oE@Qis=&iT=ior#P z>H=*5L!OW@;+sR6p4!5uNkO*51D^Eop55CkMZsC+CGTE99ixpWvsQz0g{Jo!sfmBL zt)vKh1Co8B8j-6N%{3$?55SUErRY$8N29sI__bcSHN)1i_eZ8;@?sgHv&uVipWjk_ zt;ss?l}upf&6ZlyrP2i!4-u{N8LFaqJuaRhvKe9UHWCp6VG@(q^LwZzvFQ-o! zKs5zs5l`TTn0)4$Ij*T*Wm8( zD!UPl`NR4t&LwAk)Lsp4hDH*j&bNi5vyh@zjXeW0&n4vziR$q6LTxi_i1`alg6#1B znMRKNZ#1&r=OH!S#gCmTr09$1J(C}XqJ-mA7+3Hs0$r#f*q^b5@=@X82jj!72?GAc>etdj!?N?tZ&OSAnF zp6^EppqU8ciP9o{C41hp&+k2(aujh20YmQZ1gH1(7kyaVgBLt+oQQ!H-BV&JaA_Ge zx(0*}ef=*rMnT@jTd};5g&KCI4fJ@}`&?0@1%h=7WLiJbQ)mz!EAbY$;U%)IFH6Y# zv`kH2nVf!C;>HYlU&8KkR55`<1}d;$LggzQ2n7XLN{)bF&4zsMb$Edkfkx^3#;S$B z@t5w_mi_`htnd#enfff}HQn*E#!xan3Idjei1aB~&~xw&|+m>c}4N`1`y@m5t}x zxSPS@`v5*%d5Xv|0ZqnkOBsv(K@kO(3xq`7p-tq<%l$2*yi>U(mfS_TDrQqnm{WRZ zl}w&gerQ2kp`x_$+QFul-1CF=o`1w0Z5mY4S!(%x;YrMR?{$yVm*1Gqq&9PQ)0sGG za#I^ubwz4A-D#i>G9AdbXGxvSKC+)Qa#sen@{Jl&?_pm)v5h6qz_0#sU`t!#8T*9y zuq(fn-I|Lom?afp6q*Kuu7BTPy!HTi(hg%8lH(OtPb$a>ss#WKtN%)4K*G5sQ$4^2 zO{cLU3_5HZJv%KJ9_idsbGK>FmhxVJ&lLeKr@rO{{eGawV647yZufjK%B4tI&qz$H z&0Mdpnjgfcgg+PCyU!|JU9EnA>$Nl@bPbLlJ8v1_iH9p=@bw@-@EI7!ZiG`U5K^NsuC%Z~fU9fieN(w|>-UvRqi&-5P{7W2M+4 z0H>uqG&h{*ZEf|Pnw;CuJmKZlrDw@E^k3CP0mt~`0oWbHpKQs3#LCeoZtJ;T4=b~$ z`ePGk-ppML!tP#%>wnad@ST%oCE>KXx<5!Ex#l(m)bj6=E;{P3b`+F)W!Y?HZmljA zZU#QIqQc%1lxZu(h=dp#u(2J+ zLZ%vL!SR|ti+;596k{CXR8}TcxN6>RMQZ$ENYf;qd8C%f1s7lvIW4tD0&KrgIJVSU zokfOy!5ACj&L6wf88mlE>B}#ObkF>ofwC_xMvQjfV2( z+eqGSH(jkG89njjl?{i|jUP;uk-+rfdgBX~CQ>8x9V$XNJtp6$&rnVQSFy_sg&3;DdJcW?PP@<~#(X~2s zqEX)%jTsQhCNG{;&QnTugN6_@)Z84*maDN#zZWcB;{c0FZ*H_S% zt$>NY_6qwu7VJNN8zK7ZveXpy$F>xkBTHG&EmUJYSYyGl)=8@$?skEzsJse=$Gt@} zvNOURrJ8#lNu}?LOhbf9b~8n)Ks_$jx~Bv3!(j-4G^t;YEgyzA*jb6X%o*z6!K2xG zguX!~jo=WsRu>z5wg{MlaPB0UrUxL))B{;^A2j7#(RWWJX3f8ZZuMcDXSm%A{N`uO z*rCAi=PJtd1Ht^ddQ&3Yb}*GPQr%Sy3BZOaKnZwZORg=A4=P=;nJq4JV%txuEVh-IsuFXG^* zzVqxp^pjv$XsoJdbH8nV&l6GMi=O#vK5CcqKP}UhP|J<$H>~NbJSs*~o1YD7(^7=)jHlK+ijX4zqHn91JO ze^2v5Sx%LsXIgwoI7jCa%eLxc)M;KWyFRYqNHmYEIXGzWscZ8Cz%kp`&lvkP1+Jz_ z2=)3^le+{pUFip*Hg5b;~ zQ1&E7=wQbd;BPVg2zIfC5>g?d=Tq1e_>--&Tp z0gs#~XF+}KC*zwO(*+vYk(A+E+RUDNKg2f00 zLJrIl^vPN7)8@_5uj_(S?Q7-f-7Tp(5LG80@r#!#%6iSQlvo=f?fi=Oy8Qz`^?74?50mqDxMVu)cPm+{mUR{*X=%!qW!S2P7h-|Rt9cyYOoTDf?-`iA8l?*e#bL&mnI*rrl)!g2jp2lGl3{f?(R{fqXZ%ciQceuvb89x8(2(|wV z$D1Edqo1ISK>G#SSbp z^J`jkm^rycsCL#X{MbO9Hi959pdj?NFy~&Yx8 zx94gEcKEs*uvU&ZS2uT@p}R>xfXwfzB3%vtU9V|J_K@lj&~R7bfM|fs1!r*;2S$qV zt3b5{&OHnU8L=bsK}}tai@RH4hxF96!@Kw1UEU9F6HOyc(%#9hrl~;Y{b(FZeXD|^5^d$(d7){#m`sO0TvkD}P;Q`7D1>T>gPE-`746 zU1=(ltP|wyy?cDEGm87RcQ=wpt zTKVQE+`h9s%$JqY$nAE`WCYfk8}ymO8JTsX7S#1>$&I_!qqfl8M&m07bJDGrfXO;& z2O&Eb^e7Ugd8UB>k>jIC3$67wF46*8t1R2k%C7#eypsPu`hC%eK<^NQ==RXz85SU5 zsP6cr6wPerfF+EP*Ucxc(OpFYt}1m{$h(LHw~82u)_^EGII=@@f^A@ZreJ_{XqLyWtm}o#<-T>^AFLq+Qc5bFbp{uTN?GThg=Q zm3B*sdqsd*SLnu(+@s^2@sX{$SOIHM$nK_wJ(J$cxitoavS(UJ6K@UxGHK!yVp|?L z;M1=Q8%f4B$A;{4T0@rUKJ5DNO$S|@A3)#t-l}d75>(hP4!c!Rmw79hKrPW)N8?jo zEQcla^4l)>seSxR#p@mK_X+-;Xm(f~0cUohLlZ00%VQ43WfgiBGVW~RFxUEzXm6$E zRCbKZ#9IdMd)+_&At+R2>D*Y7O~GGCv+=`F8L9zZht;3lq#G1uoe|Qw3KqhRH*wb^ z_@{CcEPKoAmHl#+6>S4}O*0>|Vt>9v>8xjP8v1Nxla^V!VM}uu3`K$cqf;d~+4Tx6PPFe~k-NKR*i4|6O zUSTlZJoVAmC3mLFOr$*9AQPGR{s!~ z>-pGaf5hNL>GCUKrxR+~S%_6asTRz0*+Q(ZWaDk6;Ib||P@vSuwGSG2yYjBDGM{$! zipnVP#S(4hu29y+R4xv)uAL!-n>-t*w_JWumq*ZB2>1j~8<{I0C@B1^qxWwi0pDI)$?MBf;l^XRDnJA3HimydIW$BcX$0w? z%IS$yLq#$3wBu@}e~5>$iz9+u9%r_l=c|2jU{K*1H|x;l8%D~4Dik%`R5&sS)dLpv z@f0`E@9E6M3Wfx#Prl(HyCN%8s5J=CVYWIv11wXHBBJi2#t zxw$*=v-LxT)evCtnlSZ{18l%|mV;*VpF`||cc)3!)H`jq8fY!6YxfR@e@+T=d*q!w z?Ev7+_?Pjey5m^~0@}mKVSntk#`WDrXRr$lOW9l7Jaca7UG)tgU2Oj#TyRf0%qX0c z=l!qNtG|V|{0`h^DE6WhTK%VjHrxJ*-lew=1RY?hdzBpd?5vekivE-Vv8(47H=n2R zrH~LYsl=$4OE@SWvRa`U*5^o6$hEQ}z6E0-ZWFr8egv(2dYbF1DL^;hb^}sltPC1H zAk(XEZkB<%rqX<8$5f5`&|TjhpV!rEt6JTQb>) z8@yLi$5$$c7UC08|mI6?%6hRW8FD~fuDJQT;XQ-I8g3S)Y|)x=3Wf;n(= zTfQjU`&6;ohkuu`oPG8-6b7t+AGs$>V2WHI?E_tXEYngqmCqOm+b*6SYD?B7C-R1y zgo=7zqlcTKXTW_3qMs+q@f$Cf^#@&mkDm+)+1ox=;B!>I2Wk|Ety$zF9kvSun55oW zi$N_xY|VVk6H!2@^NEwv_UC8BYq0y80G278^IOUqNBdRnJomz&WBXdiLn6v)JP~LXnRa10*hpw z4BY?w5TlI!YX$E$4%^G7^l}EVzgiP9!Eawc)3Y*U7r`}rk+>$oHw{n5I2eF zC28CW++iAoipXtjTn+v5+(}DIvT!B2)1xTl!eL-<5jR=P`CV`K=7)b|r#hNo*FgC3 zGgXR~#VkBmR-8b(9)@I5rXV?4-4I?%85M zVReVCYe&6%5FIIfoB4UoxYPXxyh>XD$&8W@#1q6^fkuJ1D%MezPypO93(*OXtkig) zkN$u`4d;(~+C>?b4_hK)pBIpTF#k8sStEBK42y5WKyCwRiSvV~YvHGN)Y9Vy+V?x& zT3N+mH0exdpVwZ~Zg}J%r{9Kj)qD4peO;+w=e=LEBEa;~810Dy4!HMZp-cLvn(j5ta{S7u8M}K#6wSz8j_=Hy3=bi(`6)^odL=mhDS;RiR-FB`#Dlh4xiT6ptBCu#0OJS*hZtd2~j zKvLBRvQCw%fVs}UA%Y%IjJ6`WTH@5SbS2+X&uVpi!Wka+7PWj_V|7~jJ0}y_pH_D9 z$akuC4|&b@!9;L_pXd$kGUwRIjHG<;CV)AYhULu(6AXeANi@z4@?`O@<)%M_o6-S$ z@48xK{t$AdMH>8aH zUg{&fdiy)aQRed=8e}3T&-w&qZO#Vbiz8xuGrT2gbo(%B8+5sw!%Sy()Xcy@xaS#_ zj9w|aO}TI4$gWlo8K3s;%}^!A85*rB0H?@#m{PA8ga?hGJXl*ooA+#gWP6m=g@k}HYOH#h-A!S3yz|1R1Na@dV_j&%L}=& z^Vy2KT@$7U(E^e$Z@biK~;5H{QyOUk1%e z4#l4oKSa*Lh)!WNPm#APx%KDvh&qZLG3&)rtYb4g&kCY>ZhCdrx-;(Ztuq+E=fnMzxdu2pvuIdP`!fxQdhtW)HgYrv4X3q9>6uAa7)Z z(g(0GL{3dZDs28B!rn0>Jln2!fKkx;NTIFTwD@4G^>gap#o95|eoN$ro^VSSDs<1x zb;WSpy#y}5x|$-TYY-M_0!9fMTKWU;Ism2E-@@AJ#<^F%kE)Z~e&#YIM{H%EWJCvi zs95ow2mrYL{;8NoOc6yrRNGK>-%-**q)~}(s`m?-m`tHnIoTIJ*LK^ zSY3r{X`F9`MlWDtvuaw@x45S@5w^N$^Yl`1dbI{FSOePEvt1~flE{3ML8;38x8&7Q zj*|n%Ju#0a*r=K@T6*Y+yLq0OMOVy}MWFS*EgEX3RA!9ylkEs?e}|4_mXnvg&Hs zZaC|dL=287KfoQ?ECZ0|vKlt-UKJ3#oYhscw-*FnVI%7B1AC8s+@uyz{QT!M2Q>Bd z%j6*BV>!L|ZXb5>=^NQsSj8LgYV=M_$eO{|V1Ul6cb4;cBq2v{@u4g3+rabig#nJ9 z)tLX55tUmu>=6`tZO$%t&b)Ow_eLr;0Z{MFmi#`$BRB;bp+os^V0 z`xs7TsIVwN?*;-`m49*1{@Q=n0cZT^BKniuvk*S#dvE%&m`L-nZ%j7eM03q++=x1#L!WpZ>>i}9qQNVX+s?p;N zk(3%AAg;O%Ki5y|UyhH=AB*L4nOt?DPM6fiJ6iZh{YizqwBzM-hM?$@=Ka<%sgZGE z1ZB%;_sBo6=L}dLiTixTV5jnmt*<3RP*q$xgI51am%G7SLD|f0vepJj^S65(gO3;E zvRi|Pn-`Fz@q=NlOvuCM+>1+9Qgn2pIXAfrwIk%x1Li#aTSN0?D_{=dEHXR$S8f3j zMcRSkBj@jl8?$xKMt^+ji`bGV-V}~ga@*R_9>1r%am7Zo07I#0+5P} zzwar|9j)VC`&V`UKke23h0Y&#=?iw3IQ-<&o3Rd(q$|bWn4J^V2D4QHIy6qoT9I>D zNBJ**+&FSM7G4-KB?p2`(waJPxISxpoEA}gwUpiT&}uD@|D|(?Fx=`%XC~w&`B!hh zn?n~apMn$Kb^+4}^CF~#WI#8Q9?`_iuRZO!t*zdB}g z{Sx-MxpEns8H_J6Uz!KFA`UanJGar`+$-V!CfXaRGA3bp%WY0L@k^uMJNlF`X-i=> z`sZiwu06Jt@0x9ltumln?K%4EPX_W`pd{A)yDo<^<^&osiQ&C_Eq~uQZ*fYfxVWtR znJ;SMo-SDI{%t7fY=UPAq8;iT-mQSycT2)C_|)qUx_RrtLtK-GPj21}M45M;)Wld@ zXi7EtDxralq1WS&{qyWZOIQA5-*KKkv#ZHLdURfOn!`o8Vx{H-k= zCx(FZvM^&2^y4oRTnC@`$ibw3Sq2<#bvw4S3nwk8m{YtV&bSmnLvl1+D(M*im#??{>8_fT@^a1w^ ziS^Z-Voa31+847?xapvhndC+!*N&@BdKA-2E4-02Ubo$v7uWh0(R>tY(()taXP7Rt z!hdRgV&n+)sp$Vlr|^F`KGuYO+R9R2J%Co|VPsX&%lJ;^!ZFsa*U0F>IxYd*KKynF;?=jCHxJ&_|OySjOXRY42E;1Re7>1*Bc zTD!FT==ya-V}$T-d&wm+xOSUWOchSo#(JxQy@iWQ@hf=tOD}P#LN%`?Ax5Q&W;BGR zOR#J&OuqJN3l|<6cf{)lxhA*nwLv!H^a$2UWu6`4v6B9crdm&bv0BPWm${fGSH*Z?uvbgaKic%G zvFq~~DLKYP7Brb(J+17?O7Pv`Alzm9Cc{)d{lQ$X8v`jVM^s_5kT|zuSS9KbsyJ>$ zc||vlPmE3DJyd5S{ruWG@??g(Y?El%5$-z%2csNT+iNF)rJ0Z{*gqW`0lxJhC+)k#uD$o^6l=ed z06^=WF3EtG3W_iMeq?CL3hBex0sq8yQ5Bt5UH4l`H1@O_V1`RC0% zsA{T;a*Eu}TrGoguzEB4ahYcfM4D9^c{y3d|_H;9qA zVZ8Fr5t+U}a6Nr6B!z2{)Z?t9fsH&h*(AR2Y}v1xyX=;9?#;H|DP2OHO8QXrt5$n1 z@2bciUmGQJDjsLEWn0YB^|<0+A)=YSTOi;S>96O~k|+uY`X-jg@9I+q{dpJhlL)-eUTQkHo}HOc z(#!cMi$Zo5?0Z;*4TsgoO&WvmOKX!<1)6jfC1S41ehG5^@RLuRLiNpi?AtL01L zv`do=Tngn2t<=n#*Q3sjqe-kq(GmGFZokWEuOaJ7Zr)FAFn%@Y5 z55%;M92nAR;3hGIa_b(p?fP=q(meYQVPp{*4X$u|)!f0o%{ilA2ag7=RBX9VikSLz zz+cVPxGdf_{@Ce}PP)%6OVc$ZD%-l5SR=g^;hX4-1cSGNI}&Ir)pozB{Bub9m-Bv1 z3DosqiMTpuno04&xfS*t?0BvC{3kAd+GDUt+wR$F4T*L$;&~RCWJP+0Ynm$!^!)`n za#xFiSeL_8j0N=!O{)NO?_-3n;~o{v0&13NyyTZuIn%|$%=U2X`!A<|F<5!L9CyaM z;qlE8CEiWJ;{QY1dxkZccJ2N%&ZvV0Mp03uIHEF&f{LLBMo}3=KzdD( z4uOD_&;n!>1Pf&lF%X)F(gF!J0YZp^fYe9{0Rn^`NeD;@Es*S+d7k&(@Bi5Q-N%2k zzwv=jcdlby=e5@FJlA$O%i?JtM12riRh~IX$Ul*|u}0!j!&t#AGm0WVKgi|hT}8@l z-5yIEQUPi~6}{-9GPg%V-u4QPfV3tE%<$7+Lmr3+sRZ3cdVlli2ACXH%+?{Z!-Yr6 z8~fd|=jE7LH|D z9N=YFPCI5)x4_qyZlp}p1m<{5J>8G-LGjD7w=AMD`BMsjNY8vW4!h#fUOb9w(zqgI zTPga5LTxG}8S3&rMGSOS$G9(Tyzfv}lJsbdxaO>cc6LlvPGi_;=e!fwq32~82_nPK zb~FF70pSw*MY9~=Zx`&SQab7U+2%HZ# zxE5(C3;+n}aS0cG zUZ(K=4QXfF!+Njpxmd}sqx>4e-D}DCq_?pSvpU-E810Nv4ie7a>slAGpFpI~uWb}$ z8c2NWFy$rgXCJ4HteQ;jh2>#L#+b(n!;P_=&zUh?cToN!c#dhXT)@2`ONmLwm?Z>X z%6&`StF{Q7-KFgHjOrAoR0n<4p@@RUc?u(q!cU-z4eR}uMYfi)tw*TOLa`D2ALda% z9&3TR`G`6rVG(Ijch41pD{_Qy4gEWIl9~(6cl}jee%jVjwSy9i=6w6eh4W=8+6bmJavc1r{tUO_xzO7?6^Fze>## zTey-7gKnwQ#G}-`xf({iDVOuT&xr$D@2ZmD&|OKqvV_#MMqF9&O! z^TFHiZLtPrrUqfPPA7ztxXjlNH}W$N6Kd`)GaN*MJ|n@PD>I6Y-o%-Q(bau+KN4%5 zp)rd~BLq~hL5PkPWfodf)gS>_t%WBc4fkp7Sim{O!?m^;O>z{PV~&PoV>RCzsqRfs8%|>*|KlV zp!yJdEfgb2x|4DkOiMT-P}3IDK_4=d}uVS|r z`+j0*`J)z7v*~Yt#l=<{pkubaD;?(A%AnrF+~Y2CP0b2%Z+2dKP}MhxU#np3dnlFS zqO4Ly#6Z`Uk_f93iuBXzpI%H0@!@3V2W3^@vgnawBmpaI^Zin4@r8%nGz6?nJoKwl zBg87=H|Ts=-#)vV;!{->sYS2hAyt~xNBzjb8=Q+WIQMNC=Z@#(2lVtK&h_vQYG^A6 zAdW2{V`JlCkOHpWVfPcqM5d~_FQM15`pU|KHJ8y=H#M_;35`f-d3Pt{P^@fSZbcc{ z|5{>tQRN}#GSK8Z1BzwE3I9&4=z1apT`wSUfS*oOtr?yeZw{gDK+!C3uXE`W0prR5 z6uo>ySNQBBCl8KF2vmv8Az8jTC`%f>%xv(~ht3S}(7;fiGLoM|@LSo^Mzn+@KeTb9=M&~Oz{JB3%}gi z4u`t&H*S@Y6~@YyDlZehJ>JdPXXF0Y?gV!BFI$Oj*iaMrbC?Q|466+=+OQ%OHzr9 zrm-`@qlE_osx;k5ByDvs1%9uQ@4DE~yo^pKOz13q?Tvu+#tzY>=tnA4p_iLe^2gkE%tJ?*myo-9 zmuHP*(S4X|){yKC31sB?tnN#(qk{tfX1CR~u15R^N3FqChbpu|WpjHFL!ejk0qSp7 zl7`wmeaN^OmIC0>6Ws~JUhiArV%!u7&0y+7KV(m8xXfwnJ7qwBq(b|_? z7$^%ee*1f|&)wRFdS}zpen(_pt+yv|BeBvhS=N+()lsHEJD9|gW%x*imsfL8 z<`VDEXs|W$rWAMK4{%vfh)e1-lkp+Z+__VcL?y=RxxIr2!Y-eY^Yq_hYA}Vehi>Si z8@JzAtw8^{GuK_#sK=1+(|pejZP*-c4%g-s6N|Eg^j?%)Z>ZQ@Q$A{&PoC&AsO%() zvpHU0-P-i&c>*x);i0v4mCp7KIFTzjbOaLT z2`9ekfb>M;_k#>a=azI-r&udn6=_;p)G>*>gCzvBNvk8zF9KZ&iTORaAKu7**3_m?dpRXl9v#7r z02$BVv_!Qx4gbz9~RY1w>@=;Zy?CcC5a11 zskScena=rb9_^_9<&5vC0xhZg5Nc6WrFfRe6{Uu0e$#M1DJu%-NiW!eC!>Z+JEn~) zwemL;1d4AP^t#rbyxD}T+0bwE5`UJmI|cOezITUP@dBN~EG3iup?j5deQ-9h{<^XCWoF0D}Vc*w&%wqN_9NzTo`@bz18#0n^|;gMTcDN6@@+UIT+wHl4(2 z>bM_vurWL`HS^Vo@T4fn(am`gf);1%IlE53?e9D!;bovn?9z0;^s=+x9^zZ&COh9n zx?Vu8?>9pxdX}jyFJ$z&KzKJcx|jkfa}CH}oB=pL7^2Yq?abg!B?8B8MZ4ta{8D2< z!T$J9Qoe?|`mGl|rGskVK1JY54xE;-X4u|%gbiBd%Ce1S_v5A@tn*!ofTs-h>Po6a z;$VP4Uum3el8mrvmt3R4WwLzuWQ|8lH?n8LKb}7I`*VqKZHXHjQ$eD9Z1aSdhS7+F z{(0B}BF{bU*7a8uY++S@c;6wMK~kUr|6SzxDv*7kz>0N57VP1)NyiLqy|+#3oo37i06N4TLi~e56`$}|v8QvXv z;BW*e&f-d$Dcxmi8syxv>yl?j)I$4Vet{?5UlDu&_CIR%PhpXEH+Z?t6*OAmmTC*> zd?)i-=`;`uZ3=WJn0C{n8fCROV6Q+z|vz zDj^m@G=Agch>9&}pW&x+Zvd8;?JFYJyZQd8t z3#-X<({lmcvD_c1R^Gjg^ZJQ&`n*Dl=;R|^FJe2nS30XpbM5u=OYU@HSgU3_UTKvl zD_LFtK?aRIHbLct&AfcD>aa{P#9KgusC?pge)V47H~8P_NSaz+p(Kv52iJ9eT;}B7%Y@L7Dz1WT zNw}}E_8sS;%tyD|p8*2xyf`L&E37X%p7j4_KKQ>40n_>QnfSL!)8v^uYsrzw8|kM5Y&*MTx+1k+^6!8F zCtt_|GdGnNcYkvAP|0!NT5IODRABDn3CmUiQ{Mx98k@koNH7=sixeBR_ zR`0~+UN2rXq0v`!vM!ZJ-5(s$(|lu(Q_z<$xG=Qp9-#vEAw95C4qTsT>RZtTA5qS2 z<`#K=_QyI+(Q4DO`Y}oVWwyS0qw1RtP`2ikM6iE4sdltO^@4>;dRSTuoYMDVq~@@* zwg)xT)0YO%ATYh^zSw8_33RnZ-uuYO0n>_OUx&RZQ_7>|tTm(6*fcb@XmgI{mNk2d zN}%BHL?vQATTJM0OY~DFl@#TNHh;?Qu)W9$%fY-`Sz>eh*;z$+hrmv=DxPXGO#x8e zcN_paq^teUJXE4P)DZTu2S_7>yD zY7Y*`SM%QoGn~U(hTy*A;%RVv{9M_k(@*jh<$D;?FGoT)-zStv1>QnH9T4f3Ztv*M zdZAyhL|qZiTQ5W}?44S9M!8cnu(3CKgsqYBoSXEPQ?f_P-ZJ7+m`pEHo;WocsQ*1n zc)t4(d$z{Gh`AIjEnDe7!p;;yuBU89Z(@p%yc$!OIMXm+;VCqIe5GPyD>;aXV0H!UXw8XPTddnY&l@aBg}o zAr_dz{9aL}EO|?pD&Jw%SP*vQczY2T!3_$Powp4qYb(`6b<+@iB$4B}D$t6STGz7p>zoSQ2rC73#ixH}N3$sQX zjvaG6hZ&Cn4{u+cgC@&btJy)QKGe-i;W26LS`p{wOX;`l9qxuee7DcKjSvhV`HUR6 z7=k?GjJ$Z}y6xOm`;R!qFOiI%aB7qMf^0*`h9R4;`V{2;1)gAVN}jreLb?Ala(`P}>m!iS~%Sp=^b3V!0~ za`ah&vC!iT{R&~*e--ToN*oawXp5>=st;KD0Axd7*btW^nYFu-uH7ELJrVZEC}g0D z+vM~ERgWQG5>g3Ia{Z&po2B-+T1wkQd#$5{u`o-1blI2EB!7W{OPEj1%%lcGB!?VS zsx=Az>)X*AZFTb!hoo2Lt?WGJ&BOkgG(z$K!20E?$V8dm{KQ&!#o8vY!orZfBki{KFpWfa5nDo#6h`FI;%aX)SS8aheAJWScgRfXB|1*4<=~P64 z>eim55^sFeynkQ1y(*L?G%f&2_pCuM_^@5T zs>3l{TpbpEqaje*l70=e=bLHAMHLFHWQi=!xqla^MCmJDHTBe@{N+Tqfu@9$r?xGP zxg|5q%fI=OTVA7i)1o!^t`L5zTxM1sjSH>a8lCWqDWsDI9N$M+(bLDBOs_Cj>gSFr zZXlv;LeSe=qo^QK@uDU$`e{*~O=l_mL>>Tn+ zGezl??u-!6N7Q|*2F}%|hk@Nh@_VfeCXZey|IUw#|6$uXgs6FqIAxpph^!=k@+IY5-67V>){_cRID|{VYK%(-gU9UwzB;lG z)wgArWC~&KRCh*!>&2^Q@#FDui|G>Vfg)CYdhEf9h`zC8$Gg>p#@X+r8B2e5?QHs< z>rRR)suCVD$Af_IT`SCUgwK2=aUttb;_v}|igCf3KjT2U#a3~0;-6N@A$MO~ffi8E z_kW*Z%$NFZc*w(5jSHxMjkhI9cJSSiTiaIcau2BvXbaD4EyH#3KoIW-oDk`3H2U-I zwq7lWd=^>h_AGQW06y)fcX=IBN+lPJ4T&R->iL+n{A+Qkxfj}^1jBzj*iA#gX_uvksl^u5%DyN3kg(z~XX9?1fS{;;V_9-KH%PV&UF7Dg5Z13=eNT$8 zF>oSuDVw)4wK(c6VHr``*)?Flcy7tzC$0n!=PF2nxF$K zi3)d$wF!)OHk8oVZ`xxL4z*d~HEc2Ua*y z3fT2KTG+0;9VP5k9s0NEgu87X&pOPQ71zq)s@9^AP1%;nLE!)y+dC-A&GG6DZ3vI& ze|84oqrER5WwN}##<{f{fN4KUo4g6jK&d9&y;|h~!>4O7%N*TZgeG2}it*e8WloWF zEH?}gFL&hrR9xn#-3-9Q0{nF`z+a=cSo|VzbD-~_o_*q$rf<@56V4gZxs%uvn&MDs zG-m2JKNU5f<3~+To2s>IFxtxO5})y^=WG~a-%pj%80)ybiadt{z7)>O@QLnl*dzY| zu0r;d6ZBKQTIY9CW=eY@CofVNv{mwJz;a!=w2Hr{_RNxHXRCZcqW#EylyRMS{qf3m zAyU3W)j@tU83UhUFSOXG2#6US^4J7Mc)qT><8sgeK!OZOInc$c@dLS=tDR?3tK* zTN$Hkm^yeejBX|0*D`eIwCXIB>cf&U)+05$yT^iNdl>QHl%qV;DR& zUBed!olO=F^1YEPhp4qJu%LJ;A#*acqN=4NE5f#8)>R!GcU_DZ=3P?TzE}m#>&yrMA7Uba~vJU+xik2e~)VMALr^B(}{m9jbbH+<>yY+C>m!hxzmpx7;H*U6Y?9+*hob z_tj$IcfU3np^lWSTGP~np==Uur#Gk)qkzi37SVHaJ!@*=vDC{F#MKFH(WyWZ6^Mfi3m-L5fYY0TT{2du8vOv;ffS zI{~EqjL3Ym)n~`t?rs+N0>6VD;->cFZT>+^T&*QfgacV-aj%LQ#QRGP{ zhVU&>?2k`@$Fmuw4GKZnP%dFR?XHrDO>aagIJY1iYU1g=W$twOv^@a4;LjaxU)*tv zQZiy2?BANUaip`$yeCz*MCnDtI5f8~vbJmD)UK$UI=NrvzqTMey@Pd;gopLskJc;) zWz&8$f)`h*KvR~?RTFJxYIz`w_IR#_dPqWb=x z5oBG;mfi}9ced^{2zqG4R)<4cQGy=g$u)T;1_Y|u^U;7I z-PyFNSE>0A86>RmHD~EVD0C*^&LNdQ&589~lQ4)8N9f^ndgPAn4vv zPS9R;E;Wju>fe#s`)Qc!`mOr<0ELMOryZnP{D)oI%QYVhO-{eVw3QtA4Or}~L?hek za0=(~wvu2^51oQ*=JdQa!+KLNl-s7hGwDi2Mw45eNL461qXpphEqYEg^`th&W)GPK~GA!(Ri3*&xAhQVkb zuH8ZPWGSk<40t=4Uo)ym5Zo(P0Tu<0TvM)Ywj$*bb>h;wv$pwu3>^=}lIfbrffq;U zuyoyg$=n*27`vbbcc5)pd7^Xv5X|3KvYFP8k=JyF983+r9t%%%vTu~)iVmhtW9-p_ zA>E*DU~2x#!mHk+?{DRVA)DK!7*%e^ndC2@+P=YbzIU^Y=29*VBO-@_LhTrZAm=V1 zdfM3P5+S>?e&ZxC?zK<2B)Z|?Dflvxv`a?s@ME>d(3W3YOhMabFQ^)a82(E(R^bTU&x}4ES1(@|p1&NunMN_K z>91f=c`0k=^wtG&HWG2)>w5`72a6Il(WNuhn3)e8_NqwWs%VzHfiYU2PJEy*W&xTi>`>;1ZHi4p(@wG@hXVh_lpl<#dCAZl6!TGn{ z-DCUrpu*X{IFpJGxO9SUXPWx3##~^_^+ZNj>&V7Q>R_p4K%aS9d{(!bB*t*bO7p^{ zH>b}Bq@i^@sbq{I7 z&JBP+f+FBA7(NMkKyr#Hb5`6lwQpPKecAGjeeQMtTW zPSofb4hT7xrb{d+`E1_2COpNk#V&q*wl)_rf^|8~I6I+o(;7OW3+ zFz*MxAF+4}iDVetdUk|*0;?lS2(qC1m_MzNHjn`y2Ibp9?U_K+X$(4a$Op8aT0u5! zjQ;P_GXD<)M*J^YfGmc;*lBfWyG2c#&|^AX-9dK%1G!kl^)lnswdY(yM9*U1mHTOf zH#D8v(T6k3T5e{aUZroP7f+8K8Hq}OXD+d?(yo2QteIbuuTy0>8x^F6t2WuV)sSDNGI^%rKN}J8q zRR4Z$HM#bOM23to?A?xT;E60NQVE!;&dHS8&7`-5hnBJyZMLJnM9(u58!1+JR{R^S{v;X$IzQO8t{-4a zEn?Bvynl($Ywx~xN(|QEjmjLu<#jCKKt*= z=Zkg`{FT&X$FshMVseI9j;H2+xoBoC9NW(}Ee1?NzP6edAIq0#THpQ_n(|ODkQ^}3 zYZ+e^ke;><{bPX2Lxu+URY%Q0lX_%E1xAt2Ow-ZoeOa~X?F!`Yts4aNrZcfA=(kmd z4`L$!$uR|dYkudD+d>k~P&@=%(cfYb|I{}pZK&xUoy@8H=Bgz z4BL4U#Ot>G&t{MoABJq$-mIDFz21#!gRW}aF1P4HqE$`bz^#yaSv)kR(ORbBlkl6OCjt{Fm=@gy@`F(A-^3glUthqgwQbx z1X$#{T~8t(B#eZmOiVl}atc_t>wM)T4tnhF5=$KaY!nu1*5&c-rP#2e^o(1&-m=Yq zOHM~0Z)HoUdrPdoS6bJ)f{j*e!v4kOCmEpq=^&c%G)wgVP=){dpI`@|NvDrgr%HA{ z7dt#Z`0$i;0(Iyxrfj*S%H$g2Fn2%qw_vRNz^Z<;S-|EYvzf-{!(M{H+kywiZju7k z!}DYdUa$ret-(>BTF{7j@phonEebXui%8ct)T=2F*4)B!uG%nEw*zr zp#(5ixMUZxJ*d7w+)PZI35tL(@W_ObM;VJ}^%x8fs`_X@Mn!_uCr(`hvMHud%A$Ug%1cXc8~|vKskcX- z!>BA_=0#NU{XM(n4e)?#%j89(aQ=IDS6z=l2bn+ab#z2xi0vcwTT@m z!3-?dZB*?VEIT)Jv3wS20y%@Pfnv8uy@NMKFGBxR6eGQZ1E!4YWEqf+73XR&NxpD8 z$cTP!a0uJCnrr!_M!N-0y*e&B+3iCSC;x*?E9ZNuEr0ty>h_<^v}xu)%yeO>%SS%H zD>`z_Y_D2l)R1&CPpu(#u`L1AuEi+%Ep$Vnbq%V}kgXuG{Y7ED;FP^pS4D|^3rl{| zC$Yhw`peiYc((b)8NlHpYp(c|w^GUI$e0Lye~K!TT~suxQmJ$Mdg8EhGrVQr%(5>% zf(X(VUOe5Yq?tK8zDsmk{;KiYHCx^##fZPhzm`pQudly1h~j%x7N2N2AJ^CxNi_e*LU4`4Rqi3u&*|L8)2en{xeMBsJI zD);$HpTOzl8!HbZnghig=2m4#+kZ#Kk+Mvg5l{G86kC6bSegh<9@bKXY_QvKSd!(1 zj^=ftF4!9@j|T_ggUNEkmiZhojBdx!!`W>Q9xC~?(Qra0Sjf6H!)I2f+I_bn>_kZK z*txEMU;km^Gq-fRSk-9%zuRu5R-m?45ek4!>lB3oUR&9!V4zRY^&3mGo47L~-xTZ^ zTcp?uzh=7gzi?ZaXw0{O*r5yQb3C>Bgg>p-zs&58Z$#-n1V0`*V_4?g< zLzrtf^!Og0l@c}!5O6u$_GEb`T_d&3Ik z7RRzS>0uC-K7`n!7ZJH`iaKrzaxLcVw|YMR)PC-iAdM>HL+qqR=Cmp_)I_gVhO|gp zjv&$)67jRPjzGg1P)y@(O8G~h8zct?yt9;eWM0zC+iF<5N=UT*4&g7bpmq>*`_vAAwK zFwTpndU$ilE84DB*TTi!{{d^k)p;lt^NCwZyizbPfC}bqAIFn8wAa>ChYq4F%IN6RlV#0eX>VgwM=%ur7}PD7>>TQ9luDh!#4x^&N85Rrng zn^|acgd3BW3msCn&Hf)aQXP$4Ys0BfOFvj;IpGS8mOD!%7Zt-ENAyT(jlf>EPXw)u z4*s5XQ&VDtmmOe0f_)v%NWmoc;KE?>&G?|0`CF?BVX>tKvzwwRyB;N`8v{2 zQ?H3EFTh(qw~-QZ7b_L!&Tl`JKFHJ*qr8b(1aM~>RIyu9i2>)!R=o*pHLP+I%=%u{ zI)%09r}e+k)AYwD$q>PnR?xX&a8wgl-`Qs~+nhFqq4c_X`Yx-xlvG%s7`g0*gyDa2q)3r(eGyZCUZKW7>UD`LW(J!OilO{;O z`1tKw~j?M9KR*=BeuwyY&%hc%>mEB6@k+3YmB7y7;xl8#B=CbYQQV|Qukq64I!K8qg+vVkfw0EZlae-!F#BZ$*<)Cki? zQWRt;O5yeZ*2Ih~@at=wyqXOqVwZAym%^fL#CI=a$OnP^kMI_ZcWu1~P&4xT75w1c zYEUnH{TEF4nnswXV)};FO@f^gq8exXTmS)gG0zWbfBOVpa?mM#Br)DsoWE-G4>!Hw zq1oBauP`W#KxI1ts3Kd5Q-BlJ7H0Lzs>(;2x&w`*o`c!NpI2X&in3O`7d(d|O-sOj zp&TXA<^KhmMvJ{YO5YbSDfo5uDu9*!a)rh-1n1UgA@0C+zuITFhsUn$0CA z?16klePPvx8_w;~b;aaoDWPGz#QsqRW5!u0hvQ$+N>6g1kBlkuYjVh^6`gOXK%3`b zu)ve@$^Y=Bjh%|I#x866&Ap=yuhkm}h0*A(e1Mrop&IJMAAzZWb%lxk37uT<@UT{H z7HFXg_e`eI_H}QITkrgMs%05I$Pm>fWQcSxa0;b)O?@q2+0m-R{F<$%gkJ(`IqC)C zQupoMHTQi}BE&|x5V>8S5#-*pe=lqpY@=^Uc=u9HjID8`y=8&rS`A~Kni;c{XeRge z*y7B!gujSjxmbC*%bOkTgL*!lEd$1E_`iT@w)hkz0nU5n4${Hur^j#|`UdZ7SBy4z zi88CI`>ft(WWgy(>4J6sb>ip+A-u7ztiJE2+<^y1Jc=?Fv*-T->jzm9o$O(R4n0r_ zThdfayF{Bl^@ty^lsei!BJ&e{|I;s`_q^2lUe9*T8lqza-PSh9_^V|X8k-FcRSUgCu%Fy=QcUrYmQnO{*jZ}YU zp||dG{!Re&#=q%Qwq;p{tEjQ5=c|ja%1gkIuo6Q}XoyVT=n?Z*Vm?F+@H|~mMO4VHPj%h1p&#sI zD=zoUf0zt_dRt7RX5L=$HU>$k)-tk+rUGee&f2pte(rEA%CMqv`%OIVj_p!CpZ(4X zx)rwadlA*o9zekwzpW%Rw|SgIOitNU$X;)}6o>a7Sb+jX1Nm*JZv%#xlEJvyRs77G z6V1fF9IJ^?y7z`fKa-$%OrG zT+UE^6FZ}1Hsb%%`Y$f}|NnnJX8y9ZSh&=F9W?u&)ppi=f{JMb8JN*7pR$z~ZHdB^ zRs0K&9&*Ee;2&)skLmY8lP);mclc=Gf8nFeAO>JXtBaqroBho`R7349I4n`e4t#BI zW{0QVHVo=+3DbD9OgWd;%le*!+jL^Xp+^IrkP@Ons<@^EYu;~9DMxLV5?fzNi_BCW zn%r|KuW=aq@k9ME-$`ir4IeM^lSFcPT+;XHy;f6MQjwHLC002E<;NI8Y*|EKoJHCs zRx;R~_9fn3tyg$&((Bo6)>e3%H;^@5OmPb$NXU$h#ywN6rF0C8Bs|yN+?jTKOtky>Vc* z8NRTwK;X2-`SOYp9`3QSVPB9so};TJGU$aZUyYy_NvRo!NzA|tn_rpf9d3OZy0xQ4 zY)*7>%jP8$F=k$(1}xvFHQqCw8+L!ypkZxxZOh^l(D;`X(fou9R$%bLdr_O;=ItQJ zOnDLzsg(PsBr^Muk5=N)2N&Gn2YAcWnCx(h!P2ukFZX4adp$Kaw;EXC`6F5bQw#6($3O_qORB8D%6JTj+4*p))u7c4mP`yn|DT z;pOb=PVpIR!=~hly*+^J=I983F<_ArL2xRrKEcx}X7`ytF1k)P?A$1>UXm~5@)bd@ zP;;*~Z$pFLVA6i==Won?-8##`H)Q%=r^V-V|8WXq_{~bwGGX?BL^CZ&08>n15@?~u zcFC8TPj|NF+p*Hhln}*1zBAYJ2Z3fPO}l7wNE_Ib9Q5}^65pfcRXgJR?9aT0p={pZ zN;UTu#ISq(rG#0p81HsRoFoyOcci`KMUoZAEzH*IZd((KEFH@Fb`V*(P^q>01wPLX zQ)Z@`4|=m*fhbW^g&>wn+{Rll>jT+>=rLnuD@#P+Sqa!YVy9&s~cls6TO78+O#{xjfIoT9`no&hX#>d8b|fZjf*>&T#8^cQuIhS(ylNnlkm7CC{CnfiY_#BYS zYsFQM?k}i8wmtmG47&?cNgTjez6mLNa8jj{k@&P zZ|%90FD3X{)v?Oq02oaTau`?RD^$r)XsSooDihhjP|#w|c7anBbo1#I|MC%hL^ze< z{z&i#fA8zalzN=OhsV`NJFZ*K}5rV~yTBu52TzWH!v;j^e-2=ZdUI zxY30M4=+kA(bl)Zzwm+FcxQMQMZ5H5yBHi8v{q=xmP8}d@)P&WQBF*4UT@%pEu$Za zIFtH#B;NEMUZmq2x~alY>f2Y&_hFDgXPveGLRZQlGGRXjcv9`W@TVK2kT&Bp2f6`-pnN zuu9I#V8))n7(s@1-bw~q%(2?f*ZCsLAk<~N$K-r65F@Rb<-B^69<%yIXXYXSbHkWD zpgtNZFLzjqYdgJJX-Q9o&V0T;cO_X@+AE^08a=(@ITX>YpxD?fSDL!1jv3I=Wc6e_BiK$8u>L0B1O;Lc|E$h4m2^zc8b8tp6=50+vN)<%r&U z(1?pJheo$&SR0eKHxjPS9TdCMuOf>mMs2?%JJFPw)L>{^Io7PJGk>&p3pA>%wOqU= z`>Y{xdS;@O;5%d>h~M*CS7p-|<5#o0#Z0myTZQ7!ND-hgby}AVP!?6UJ|J*qd4o8} zLePfJ=b2PeF>dT1t_~vA_4<;` zE0p%aH>jIVSs23rtv4&>o!-II5cvBFp!tk!Knj?1tT3ENQ9TxHNGh=~X32JzzLZYB zeoqaLxf^Z1jNjp@N$YSOY+VZ8)=zKr)ZC}lgAc+xiQq=H;XBS(TNZ%AY=6J#YWgTT zv*829rz`@G9q_aI9@{=|$}On{kE|Mi677ZA%Qgoj_ZFXW7?Cs?34J;wD7Y4Sia3HP zYrf(xYM`*T(7c+vFMIwb9zl@v-jofj`;+n&qKy3TemD?bo5uexZ)ebgKNHt9pV=HT zR5T>4ySdCdpjxXr;giqQI@|B$wJ`b(my(K^t;z)HK8o7alw0TMdVuDU2(e!ezpQAy zo>lSKGQMIO<>SFLJ|xpi_AbI)z@v??5>NxvkLtB+M}S17vLJ?C!EBu*y)jq65xC@4 z<$K&u#hF4>lUR=rbrHV~tYqV1qS9Zf= zKV13$13Huc19aB^7wF9J^4HpBNa=6i^$t%sC>fs`5KvpJ3ik|H#WH|a z{U+_h78@(?$fz4$HPNfWh0%u0g5mEtWH(zs1MV+T=3-(GBam(a7g4Rqn5{SjpxXH-XmfuR>!J9Mx18?Re_bLH= zGjkiKw4@(yK@7ecJ3D@SYu-<41k=2irPK{#1g92-QVm41fhkYZ@qvG+s_dr zdX*?j+qqBT27s<~iBivNLHzA1)>g~Ukl*+0>H>uxUC+IHJNxon^KFosTceYgitDAf z7-h42v6&TBc`X5!P2XBxLlKCPY>FVta zC7ogHFG0Qi`U&DwY$5v7OO7Xn^B}-)M&l@Me>y0H%ABNLS{MkuFcT-k8OXmACz{;b z2m}IWMPlVA*gZ~=l622t>}tUlV09#N9V(CFw(D4jW5wq)=5^lM%0|*1MCra-aLr)@ z#HUe$Q?R00P%tAHm|fiywucwJ*^bxXts<+v0!Hu%2X_+aoDvGuzV^2WPWGdo(Pj(? zjJvPtlD}zY2&|EHkP8wxDMttD_y?6&JyYS zDRsav_n^1#=nyx9dU$tl$3MrYT0fF&wP-&VVv*X|n)1_dX zAh&SS%(>88+vJ1}ougX?IE4xdy@DQGiQLvI6F^2(Wwsk$I84>oef+rnRBx%a{}rUw zzeClu(ba*;m&+eB69^6f+o|83TKGhutaA9+J^r!QZ^^0&`?W>+mfMhxpI61ReIv6U zEJ!}ptPomM46WBe{y1k%qlAtpTM7RMY407?WZL#?kB%dQ3XFq_^ifo11c`!x5CWqp zs0a~hQUW4ULy;09gpjd;2*M}=(t?V#00}Ljgb)R#NQoLqfB+Hcgb*nSHRQX)Jn!?o z``h2%Yk%zjVJ#NxUe|rz=XLy!-)`w9<7ktiaq{tSN*pwDbWuz?|9W$_V~hV@Ghone z{I5Y9kr;k{aAvWkJL1`GnzgKFhh62=Q0qqiHqjTAx=m(O@gHjNzM#Qi4R4b^G40-$2a1 z0|4AyKs2nM=u_z*PCczbSLzemWzVj)4yH~t|B(ftHGb>I50@(iu~h#OnWXfpOgF}a zpREwhN_^X4p^Uey-C`Rj_2_qXTGEh$vAOE4)m+%zm)_YJ!HoYNYJhI&>iJPfRAkkcEzaxeXvQdgQx0UfyaG$kIq$kPYgV+LStCXsAzc7DfwLO%;{U|!En{$#O<)Yz|ikNgBAuTcrWYgH{r zIvVI2U9P_d0JKBX1NL?_^_Pri>&iYJ#v)&AWZUd@6D@tnij>*1nhI0lu9Kl<(Sw&4>CY^ZN{6l> zJOxTqA4pVNWT!J>(AAtZ|K^qO6Y4|0?q`$*pZ(hI{`mNeWpRU3?p$%{*V=Iay&lP{ z52JMB)EJ{tJ=Sn8&1YC?L&=rXeH}#as>HfPm4_|{R+E|h*YcjQlsF$*30gKQaU#s3 z-7TceWKhoevo3@<{Urk%PRD8$>FNjQoys^RQ)yM4z2u0RxZE2D#9?a#4(hYo$!|?x zd^Fsd(;O6)akh(MlolY3?-iizK03i_Csi=GGKtdKq__#g6UhzHz6hyhEFpf;5+XhrGryGzHe}t$n}bNUqPtO)mU(!^BQA=SqoLv*Eo+ z=D|;YH2ID1vCFN7UbCO6D5i!ktG(BC;dUc~O#THwFNnh?D(y1vE!gbp1-9-2RV-4X z;Q5+@L%ay>Q1AW)mw&v{lbYk4czN}1ObPs07CpcAf(`7#A};0fn)yAra>0+dmc?Da z(vORB>!iH}kYSC)JK0O?9ATD_#((kvvVK`CmR8}f#v3ru-@fqmxn~X;9dd~Nd zg%`0ye?mozh=Wlg-xgr7So0hRFWP-k2`H2fec0T@HWiYY94t#=XwzNSm@S*_B_e;w&YG~r$cfcK3DKp zhEAvxr;M)L4haOSJAm?HD%^Ed{sTUb{R2K<{2#$*$U!0%cjoIO1HX)(LhUeR_0H80 zLCm430zfGUN@8pG&9gai@2CA>on33sL`B#|I7of|rCW?nN@V7)TneI8{>eI*9mCan zau(6|(Wi6i7eVg$+DA+H`m?g8C>)fPph4n?teu{zJBG!Du9~nMEq2ay;!z)i)~uVR z&Xs8SRI`GtR&H)?qdU7(^0)P#>W*W%uj!C)H5HqL9vZqk!E1 zH8%IZQP6w^{hS~>+0vi)!NT+3E`UnydVR1G06~*{a9on&iJ-a|dDPTd%cp>L#x&=O zk<~4>e~!Nq0x;bfeX8TysF8&!haija|vjf$+3=p1@_*5pY z%g#xIJa7nEfu^fs+{Qf%NtR>mi!T2c0Mc*JmxP$}`p06-kT>--Nr{0MkSB1LY#fTA z=ZwW{9TzM0>ht?_Nj}!^qnLokmKJ;_0~Z0qLB)zEKzyHwb!(d`J6NpUsd>KuPU0)C zC*%n!^Pl3#+S3-NKr7@#I}iN5!Rb>mT_(rIszCgiI54exy4xbuT>Z?@eH~}ccT|6Y zdBPsql~|lI>2)B#$^<~4sTM5z(#~R4e-mIX2EE7aG24(|yyZywD zq%WJHd{k}39vApBs^)PC<-eJg@?4jXKw15_y4kgRz&q1|S*2F%A9mAD)=l*TS_6mD zJhj1u{neNCk!A4ADf!$or6r`Nir;o7vG*e}jXNzf2=vinzS0#7?)0g5`XT6fN~VnI zaA&)f90Q*QZjtM-D7ze@i!9Fmww8`SO6yx?zeszvwdY%6`^b(+UH$0{C+m;Sv=%c zdU-pAF46wCk?3pQUxusKle6y)uGgB@kh`?aPn%QVqp*k1ql*f_z2=Pu5c@!Dt#I_A z9u>uftZJP~H2wJ7S=OS0G?H6itfQbl3(f^ef||B*OblMRmY7qJ-(g>WAH9+3FH=kg zx^$C*G50!lZR+%rJPy zu#~gNv!zg1$?tVXbC=J3DMUMdos^?Euj8Worul#}NpCHT>00L$!mHxC_0WxI;ePKw z9^=H2_c%Vb~sf1VB;jZCU&_u3Ck#7b(z>%z`W&20FG1o9Z zq+I_n%Sp3Jv`-w`nQvJ~X+aHblgDmtc@b;nA z^a*76Za)*FYQQdnZzxb+)WmhSaR7rpp0-->gX0nXpa0LVyZ^K0_%3_b=*@oOsq z&ajp$jhrmjsZht-mcfyxr!ut*Van63ly3iwkyDT~<>|P0kNf)(S<^*_!Q;;d(Ph=^ zs0phwpge?;E^Ig>6S%}br_(_+Y7JkvjRlYM)gIY4egQJa3W3p%#3D9P#!GhHl+n3xdw!`cSg})MA|vW-^#0W z&%P)z*Tsn5lzXKIZLTqnZn#>lK6Us$rLx#t*^pC}vamdZ`)g3;p(p9-v)x4Wwf$)h zCcV*DYxgne^gx^8fE+tJJ79qU9rz;FZuFB^)>#N1iGF@-P8raSX30gMPC=L0cq`OX zDrJOmNj~xOva)RDtMKVBUyT(`n4I=vdEYNcRsB`plm_qq?OqPh}O z`b$$Z9`5_eM0Z9bq3KC>(<{!^mO+uI7nOUWHNeF&Ji=Zi0<9h1cI1-v%@iDk7qP3a zbl;!9?l^axwmV~F3g(cm=4A6TIlQ0y^qmJ}uVxw`S7($C)J4e@FyzV^Hgp!IL|yEe zcBs^pGMO;pWPml^apL-uB)ye^rk7}cz1$jX+Vr}2BkUr0hbdFP)G>ERFKx+N+O29g zjvKD>v{`ep(S2Lliix@__wzU8*ZooZ-2LGI%Jgqm`eJx*G(!lUTe5Z+7c>`ZwW|M* zymanGKWR}RB~&jNDQ&=xYp@gjrv0j|rM(kaW>JePuFmH0H<@Vzet50^7N7gwca85x z`~HP?Djn+K1MiW4XlbAZ0M)&GJvFpA!qybgc-yED;H4`}yTgkV=R?nRkWW{^;UMSJ zDkg3~3xJ;gg?M-+D-$(w+X_cP(310sni3;ez7c#p2hn^hrPP-qD2?s zun-ap@gpdYkd!NTw}#Ot3V1mAz8!3ie~xZ6c8zM0tTd)V{jgAshvp zb%3N?i@wl)?y?M`#&{wJ4huh+_B&p^eyVz~PQB#Bg5O{VIueS9RA+l=BC~K`{hm=K zm7=p$x*msoI@mF13Na|u)b)MbX-SM-Mn!T5z*WcyliJAgO1z7TKC>1S+9=Ktn$6wE z-Tru%S-lEwKaqt=V;rql)mR@kMk1x{f`YXPz@1gs%I=)_Qp=rYa=$bz0>8pQofYtK z2kTN#l1u-PM$(-OTLP+MG#$)#p>PJZf3lKrLD!YE&!J5KCkK#PQTIU|%fD298+2o$ zoaL0u0iCYqQV?EA%6PCZP&o4Oz z(|+Sf4RZ-_aTv#dd6@yCjw6@A!=2m*u#Kv0Dm$55X@49t`=F_4mxxGl?=2tjXX-~^ zWv(`_ao#6|GfhbBGycO&Io}_$+kS6N&s&8sMuOogZrV^ZjkK~;qlTl~g3Djr-yEAP^q)$M5Gk-$<{#;+@( zIK$8s={%URTCETCA!ZzlWrt6Nnnqg@c6RsD5Z86$+yVi`bQ*k64y@f?+^vpquyV?@ zWW*1N?wysm+IL*%%7@5eO5{_x8GzDsRvD&st`ox7HuciyH}%rb{?SWsLehO=NV>Ln zFTLG`{W(12UyyW?7?SP>9rIG!MMMqS(x#F!Wlf577Ha~g8r3z*g@*y&wQ6C29==-a z*Y)4r(ltkWb-4OTgMr2dS(oHMP?IT@X2GYOH;mb~c9S?l0rtyhmEit>h@I4v9|MWm z3e?9JuarYG*bfia{6)MilK4&bPK!4z+EVl0@77y&Nizu#{hH#> zbDN|z`9dYj+T87pM*)CXZ2G{O)GOAGjQ9q*e^hd3**0!+(srVa2NCLDBe6XzU}}(r zmV-`7andz22(zAmxUhKeKmt!#vY%YgQqcvrh4!5$+%kWSx9F-FU(_~{X<6*|WjZ(N zyz2KTRhKQMz}Q){k;nWH< zx6MXohAAQRwMkKBdQ|-Ye=`nl4EJ=_2|Y_wr51!VS3MpXhIO__113j{{YSU>Z`I#1 z4}6ZBk4rW&Chc9g{tXF}esvwq7j*ezYC1{1gXW9HTBMCNMMqtoocWWu=|j36#k4S` za^mvRPL}I&YcA<9BsvY0)e5E#Fx%X6W62BQW+a(N->=Bpa(k4FW-fM~tfK4YfX=p1 zpQ(p`cWHTnbkySY8eoA8OXAvTQ2Ug-?eqK1HxjG!UuBIxuaYJY=;`;Uq)_=D5D((L zM7i4<-~uVl?8(ldU5`||Lxs|8Bc<7wR>2#_`ac9X9qtH8j}^ms(y2zpzmZ*9^Rc;%S== zJ&3QFhIJ%f4)Q?x7->q)(xkY|okGf4`YSpi6OhuMw9;OSnuEuYuNa4wb! zo1(3jja|UCN0;8HspyjSA^B@qle($uAEs(=J%L)XA=FCg!c`5R(hyC zCeb+(D&r@6;>^!UHj7u(QjE1O-%~3%*FY*@lAbC*!{p?{ne#EC&_m-Rym$ZBI6D5% z9%;39ulZwmrD z_&0CE`*~4v5x!QWV9&Wm`&KoBz8xv<>J0U=66G6|3chp?)mSM>$7UQCbJEP6;lxgR zi=}@!>2}JO%tSFKy(H$O72rLmiw`oG{2G_MUoeeP-M537scmWNI)#T9E6NR3k69;E z3U9K9pe-RA7T*le(k2X>AZxx~5KJw%Dp1fe{OD8?zUzA0dT7$+lfo6OpCW4~?<9#m z$?oRVL4lz6h7=89bffkUquMD3X!7dIh_QMJV^@KF5R31Oe)dsI_Q~+7ipvuG$(a1a zOHm5#YeD0BW95qvT{|isG>UGhuIL^-@tMdOtfajlVc(bH$K}0N-F%~@o=#@vK-2A3 z3edyXG+f0nv>kcZ7H_Z4-7vV@klHDGpSAHt#!)IaaNiRE;{VNV57BFSaS_OEr#PP%|U=7^#z0N=r&q!&ZeQ_b|B!{3Lsf-}2P-s?pdw~U21 zF4d8;We_f$Ov#BwU*m3TxAPRco?6ecF~9}%05aoA@_zo2>Kx+H??qPe791U3TSRU2 zuK||<;CGiX5hmOhamc$lLeb*hq3SvyxE2niV9icA3ylvA+)+V@3ugaCLx1#~xMe&> z*l%nNbB9OG_i~k<+Au$H*9Lc;)c3?)AjPUI0|K?q2ZjYtXwQ6T3UMa=^VjiIF?W4W-E+6__pK+92#QrrIE!7-WWpqjPna$*I?QMW8{uV~z##4`APq1p zR{Ncp5Sbg>{iS16IGA4CAi^KBO=2%6FvnJ4WTEnjqUFwBCfLRP1^uDvxcy#8pmAR% zfr4s+!QN5}&h5H3@v_5~h_}xKba)aye}DO?v4;gnI5s#^89?!8ZT;%*ZF9mIBY*IT ztPPtey2i z!j{Fl6+sILZIJ|igDYIlw*D}ZCG2lmsz>hxr}<_^-Fgn#bTi_qe*(pw#?ql*N`!S! znqm!uWyP+feEq`T?wbc`&$!NhXLmFg~J{B^A`Y|TxS@7c@1dRBvOJ&6Sa>rC?PM;$a?Ct*77|NzItT3L#wVEK`3y` z)QR6-#V<-srs4=L$Gb1y(aBk0CzXk_T2`HrN~B)}aZG!l;b5NJkWkk9amLmSP2}9! z(7qX6#9;@lEsV5Ene?d2hMWnsT7T2kJwnRcozu}Pjt?>&6HjaNn=C`^fLa?9-z%;Y z;H-?d$+wRk0Q)=(RQnw5K@Ly>z88V|l}4WN53%wY@U+wZs#UT`$5R@+<4{EbMMlX5 z+>Bvfam{<9SC25=J90Q$fE@ZjK}MR6hJ@Ur>Pktw&eQR~wz4bz;V$)1S=OI!?Guvk z0zksQtIe8cG7}_o>0pHuxv%U`Rm_DHDxT(64^qGjU}*AA(KBhx!xIF)<G$i3U_%0KEMZ_F;kw&-wC{vyK?q|OSqYg<6G1dd;jYQ-w*u3E81%y;0Oo& zzTzYN@ze27r<*E(ue%m~jitLDjRsqL<4Yo+UbNGD|CC?3YIhJ#jAUn?K}lx zm|P)iB^lIq!eBu$@s|t&m}?a_HH*xEVVidv5+)$P(w=f$Vt*A&fU#a^<%_audB4e# zIM@DCsg$hWT_&_9+hd?>9NWSO&o{niT5Cv;HS7D(rI$=Y)?PiKjG^)3)0f9C>>|;x zUJjY=57Sv1hK2{y_fiJCCj5&1MEsqe+G@{5{u457Miq&x(TOf0(p%h-DgxV#Na9)C z!?`#6Ys@$XJRn@Srds^!`jaGi%?_W!dfh6X)S5?Kn&qJWqGYo`2Cx9V8#K>hsnEgv z!SD-yzgq49wjXU6hQmh7PT|j|QhCGmPle7KU2FKwpbJV_AH3{P($y-spw@e6I4fKw z(KFN>@0u<8nhbgW@NY4Q!*hPa*fIwgIc{uSzmf4iH@zu_6 z4PTpFO#xKVA+ZCW2cAC-*G}3+?p0<)8T%c3F}&CqKB(Fp0S9qiG+-9B@7h+B~7Hd53lzS}A*{6nY3qPWe59WCb{K53>Lnu!?v0Togt^3_;`K~1A>k^L(YCtRW0i_Z6l~74U>pzsT3Qz znU&f*=XsX5Gz#(YG39dyfn=h#46QO-fyZv&u-9mVE;;^%wMD{scZv*#IM;y6W|z)n z8_-ED%h{A7t=s5#oaJN_jA~BPnHlR8GZ&BgD+Q%b7xzg)QiW!^3yL|XRFa9Y8KV=1 z=%4sUQ%%gZCDw$4M$t7Rf z#w|!^qn{3v{n$o#Yb2WE-h0wy$C2d2X9n#r6?LloV?v zQ3@=(mgKbC3mt&Wa)feE&qT|p{RpT^eyi1-m!UGJ4;4h5A$I+(!he6HlR)bG1X`gj z$;E#I^#6NM?bJ3zeBg{O(yAhDhpKEt{SUfr4h`WfV|X58r20YjG8ln|pt?uuhJ45H zWT>rv>fGAE$%u9Q>(36~iVZ3E*_=QYhW<4FysGOn^Zx%K4R&&SPG7F$gAZuhX~Kin0JijBPz?9cTU^Dm#&y!mUE< zfFi_L`kOt36OoyJ$MXWA(oVU3CPllyYXL9NM159tfIN6Szmyc~<)lkUd%{gUIbZ6Y z7#^!QLUP`(HuC0x%wRjluCt_8;)#NmhQG`c%YDOMEQ0$JlU@N_Q#AS}I?xT2Y@1MQ zSkeMMmyvD{ft=tTC4Re#E+N}uDq+aZ`0MwZjwW|)-&%bRTN2pwp-(Rx&DAF^^CcUR zrC*KH&wzg?o<~2ClZv&H7uO;xP&61l_V?ec=P^%esWnZD-O&lj2?Rkc7BE4o`DdyH zO^5)J629?qGUjO16!Jf0D#qrKFEhI(ZcVU+s%7ZPcDZNnUA$Sq4hr?l`yzNHJwfHX za6M}#HsRg>4tcjzd7G*$Ft0_AyU|_yt!fqqIS~QmA+7`hw=~IHdfVd8#u@xKZW{36AgxrnKVKbL zSkjvB!D7|K`bR($&8Ft?>Z__l)=JE+*wJqC*;}i!xC8x~q}b0sU8dTE^Zt(+y331p z@S1GV%@lD@i$`gOCE>}?=id~f^&eYxj`dX(Wg8A$9s5r2iI^C2TK>Sm)?Ld+k}6y| zXBd@7N=gstc+7@#^(OkTk!?QXZt_;B?jDWezh2}iLrNR=*`-A@s|#hZeBa>pxRXKC zwan_VoOjx4gWvj_L0$(}4n<^ei|p7=(4Da9Vj`1Q(d0*f41d_jjPzzzhFn`Nu5$(M z8hc*Xuf7ZS8)*1Gsp?9jzs`I4&Pnls2^(c(IOA4$cDjQI*_l;tlm#)El5F?y2wvrZi)?U*(xp*4~9Ydx*u#-iz{{rc=p=LEbmk zUg9V8D6+HD5T)sCc%ulT-a+n4Kg&QDdK~LrIKi-nj<@fjwyg z;3Rxq<3i5V`aFxVaHY)5wO_O-(~4Lxfw=|9xvkjqme}4Cv$P|b8O1vW0ef`+2EJ40 z&QV&8qt5DmU}iMGIo$QLoG!={H|jBN^#ncRlw@uDz&aq+&@<4wdKYRhUybxL zhG35M*WOuwxk*!h4u@g@n%ah8c~*Cis~}CVhZc49LR>qwx=H&X^HcJ8~ygHYe5RSqmOg_Mjinb%b?@Z z{ii1`^`}lh8_oGZ62*@{b{+rjacMd2P_61rhPCZ!S16R^g&(O6=^j*z&sGfCY8tU7 z=TEl!_8e%~lJz@cGW1wiSDVrCGwX6s^e%p|6_?V|IZ9KX1{3!ZFS(}je)7F4=A7y$ z;+n^n;$|lzNw+<_P(URuvNJM}Z>LtIeHGXTKt?G{cc2{MU3tB-rN_5E?Sub-)Ywgs z8hs(W=W?D%|{F$9VGg|jgZ}unqQ|XG;|9GS= z5|PJaA7oEz2&rdYxjvAPlKTZapY*g z4~g!VX%W1)__+uONwuW7pS!P1%{T}Zpq8n1iTywNb#?fbk_WeGx!-bGHEsf0*!>q1 zj7%$wqKH9=s9D9XH{uq!0hJ8>@O+Uw(h#R6+=6d!0N>mMh*ex&RNk+cE_zi#vqchrv_$&A%>~@vDfUp2 zE~mA3jM}@>u;-%)LA zjH%rACE3YJ3+oe!(~K;`d#;8WO{mJIa{U_f68|!zY2A)q3z?MW*WAhExR$t?Ov(gi zH$8Lt$XGehbJsj`-&lV}%;jkuXtBaf80@M*Uu7aY*oZwar1Y*>Lp;Cp!5}U2Nd?2^ zR?m6h%R}v5QchOou*o@I`%9Xy&jmxU~8Fc{}@mw_K)e$q=m5Nbp5AzO#`l7gk~8Woglk8FCCN$BH=VcPZVqV?J^KdB&6R&Y-uvh?#* zHEi0B%Qed8RW@f}_2*MdqxJ{dJxrk#GP+O0uN3)aAWGCcj1neZ2eZ69&nfs*x$(`{ z`?IOzo#Cpl0!M-i4-G*B(j`K`&4estm;?iP3Hg|S=|W3L~d@~-(A1yC$Vr= zE>DZ%OqnU4G}k}k3SF}>TXf_N7!)h>YrE9# zZqBLS8wDH*6d&}Vk@q1JoGbq9s$WTKdX$(ZSlrC?4q%w>nzU$48!icIHwoWIwx$Ip zJ>am?c|k`89#V*kRRv4dUr`hS7ub8`Hc{;{2H97?dO~_w-e#zYU)7JVenMVvGypDw@2w*zUQOr^QZce35i&?LB|VY1Gmed)>sSJU#^F zixGFz9+ysz;TEs16}e?z?ATw??CGka^5YhTOUNA?^}aVSa(?M~Ls$OQFa|*{S6tb) zNXR()U-gFl9;SoeG^t!bbGIiHuG)iD1#$C=k1koUHi{!N#OdtoeYYrLf3%=v!hqL2 zkAhVGt=S%dCFb{394<~c?+VxE4U$a4EKhbGoeMZqeLaRgJ81r5>_SQ0htOpEPxbx; zuVuWdZ3#|U6d)=yN0)Cj_&*4~DGev56{O4W!z0e<3~}t})!I4HtUNq@!C#el>ekhx zA>}6f1h$`29Vw#3K1oy`+|DXEBHB^Ml4YPCh-0N;JBEXLhP(G*pDGW<$bzTl^N%-1 zg|1{ebtnTkPJmMQ8;=Iq`git>!rbx^Uz#n%63gWIe^0n%z_T7<{wfL2>j8!IYK>lE zuSBj5 zw`v?WN-Mm?vcUk9)7XGp0agL|OQIk433sJYmRD-}R?_yYW3O%vo&NEz3CfhH_&!H* zuqPjv979GEbu&T4qDVskp$@e!y|hqhV3eAMsL`<1w;50H|5>W#EQo);(yK2Uv!nHP zuyfB!ajk7M%buyj?YK3X12+tR;?m;4?s!9qH4FjiW{%(K=zJi$bOs%p&OCAR>_)wfmNMO<_KTI=j?MNTBXX^EcQ^72m z<7thCSNa3ItmcfqBzPx5?d*h9MG4`-cSa$!-ZoNbh}M=pK(y%j6{9(qfTw-|M!wv? zJ5zM?lqy3j)($tFQlJ)Z3n2o`M((@$qP>+(r6|vP+=J@!Zd_*wL~J?u@E-fQ%yA{g zJXx%M077A;Zy0wd?M8+A-b8?-*#!ZqDQJ_?lHnz3`>L zklGIm3XnAj;wODycnG_*41q$9x@@d$(4tO<`peY=7E)acOc^)m^wHcOQ0AkzZ@rHn zx}&^&W(H`y64k6hmh7znFcJ)OUJ;L-fqZYneG^!tS}?G`0szN>VJ45AR1Jm)7gpmH zuv|4l5EWGLcxx7kv>h8p`enu3Fo?k&0F2&MqQdwGjIPJQ>4t93|A5gwwm4k|P_LYK zEDz`+;Iv7e;-P*d>#c-5i9!vPrJQ%k92^<|$A(_Zi>mxDeY69`0Os7B1L&i%VB}!~ zRNJj~jI_g16%w^R(aG(xCi>LntCnwzg@1e&U4x?YER?Hvfa&l?t9nE`8{tw_)45tv zFV;naY@A%5b2=YA9S{;bBP`UB#-cIdm|OgCrT8o6%e|#+xa5vky7)+p#y^MmBZENff1_u=3#v+SV?;+aIpyAkeGc*>d|IOsVH14$}QP!ms!WRbOedWC7n2@RHQB zXoaelsPYGd(bj2zp!*+Tw4$QH)2<_#T}{(dbxLtPUQ_8@$WFrOGoUW`dc&yimoNh*@~aPF3t2VW#OAQz zvw+)GjP`H5ose93N^|{t_u9*GX3vg5jJHl!Qv?0+8K0Wp)Yrw8_evWjAM5<~sxIJ; zj}hju!|5`(--B0{>=*&*8(;o33%gD;-P*RuV!Nn4+QQP_JYP%KRtvW?_=&RaPTf@R z{RNDH#jp~U(u4iywt+IdP@!ZMkf;S!0G6xHUD~(~-GQ$=tk%g}wdwc3JAmq; zLSh)cdJw0(0G;~`z5KAY@aRs-?vuoNYm&1Sc{`36q>GBgA< ze?BHgMgSWShaTiG=BB*d)==~Gw>fLu-l404a(2wfenLO{eu+{EJx=#3cC!Bt@+sTxz^I){pc{To{iY^hRbixG;*dM$UsF;xo4H;W7pVtSTyNrcEzSImHN5Fz<{)V*eH+eGsxt9&_>&4rJM|5UNy#0Er8Oij@0$b-bNPUkhrByeV zhgkgLqPIY}=U;8ikmV2shlZ)eEi2?BED1=B`36%)b0EdXk72XsvT26q0A}c)Ig#9J zelpkfT*TP3)9w9pR|^L-Ubh3A<*emP*{@mxEaZ$Gj37&pIXgosj- z&4|O^INz~L3*@Ui&96juI2zGyZw&xL;jC! z)oy7?+XS=#@+5_R7RjyMFVfFwJa13M#5Mao+0DbaIx=$O1@>v$?EslR@f~W+;AF$J zIGO_CgdVec!?kAighRT5t}M)FGOUL3ta_#4-F#c~9aB3(`+G~$Issv{TQdbKNZLU_ zbSxn)?_8nQrA^@{aMcgI&+$WKNSw?j{KQME+b4rzEf3%~>VE+FFA09cjeBy@rMyZm zPoFWkd-Xb%z0eJR9Zem2Cr*bS-h&mV!;h{9sz3Ft_cuT8Y5~j?58{nOLj=i5>{9FiABe+V_;8VO< zhK0w9(nA1HcZDnsRHkr39>yE#xD33h#8w4{qsSSq^i!d=fx!{3jKtB{(mr!U$={W5{|D8-67DQ2KqeAuFKXM2d#!Tn<|PrVo^_5J-1 z0|a27W0i?DNva(A`?@MBKm73L50}oLwJj!ozO${mBDDYQm$;!B0oZH(B@l029v{9f z0c-5>=xA^6&mWuClkun$x_S>hq=gxOMI1VHscqRrlfnGS(zrIeX#;1KtLyQh)Ya{n zj|1%>NRKN7R|pH|8ii>w`yBIDzXC0rKxKHejXrB&pFUy0{fcT6H@ZUi4fE@mZ)~u= z-4u2FWdx}p<5nlw{A0xKoUPvVnE-Z2*h{C^SZEw{M<7usd@$_F+i1~NHPrBE{PJ~U z;M35P)xJAZdi2ZI!)VV;Kj0kJAszEa^cpj5tb>LF`7R4=#eU@4m#-?$X9fTo8fahx zXy^&v()IjY&B(!(AiyE_d%1(|9Ri{!?HYhX2c4He%+P_Z@LcRi_K8|`W%)tbEY)WV z4v(LVu_rHUEl|S!h_l$+Qb7k@*w(P1a1D(#B!WF2z(>|t6FA1jvPlnqP2gUmPAHTt zWz%oY1Jq0+hT5X8+yQ;(?mshzo%cWVT_H(Pkl!`b{pe3v`H*iVATn{g0B67O< zsC6fvvKWo_JcL!hlfC@v&xQHj+3m%Df>6cP+{5?jc72_4{%h(_+6+Yh#YNxsJ{u2{ z^gcXZ6(aA4WN9!Z_NV$KJ(O>@?8GSSNAaf#>siPV?r@2*v6i|J= ztFJo{6pqxXD+tCObYU%zx-Xdw*-1SOe2@T;(tq0~_?t^(`UYS6Vjj4%G(kUgo;SQ3 z?jr-sj3yMMrGya!E>^q>9jCJJ>N*WQp{1tsctjp$j66YQRboE|Yl1>Y*{7dP=2`PC zAa?94-NKUUdXLLJHk-J#KCOUpBRFSj_75!xffwjN^dvpL`kKW)>p>n@wJS6`$zeZu)ps=$JBm-jq=j`Erpt%r1 z=idP8J{Hmnej6WkOXa>2uP`p_y!sfiKDK?W;<&tpyMe%;4Shjf_Qq#It7RA6c`1fHz-4CW+D#`$Jor(+PO>wny;La&fr8hD7*)CmkV6cqEw;R-S;WV^AuBx0q z4A;!9>hIE3;B^$hrV{oUl9LCUXkQ}0Z0{$n5K!n6+afKZs#YWaK9)>z^eC*02){{PmiX`P}^5Bv$R)}5!#^FQvbb`&p z2b*_-g3+PVUCTm{pSC%`(@p4AO)a}{uu45ZYW$v_o@~8`uNFeDU|n`Ib`g+ zpc+mg~Vrfs8=Zb9+_K<9h|1-J=SITtx`Tg~VFGB$1h%B|Mj;t$79Wd1?pm@$- zhibO^miuYk0KjP+s98PTg5#&m?+d`t<`*Z1AK9;{@}J$3B z^@zah4w=5h`qa7;#P!5ddov;|nqo9n2zfc)QG;u%)ODFX+i4AiH_uvr?CXtSTKtGQ z?G6+ks4T43s(`rlIua{-EYuz(!2)xp=SZuG+XzM0LawAHI) zdWuhPPL#*B1>~>cXEWZs^Z3RBwglrxh4C_P-DB$PsXJK`omm|Bh!*)isrE*{cHdBoE3{81cxf%rI(2n*$6Rmu^pN%$ z#zdrH@C2r~Abj?~V6R7|Dkpsf6gOTy5*b47<#b9eq&P8wA7KlHnqMh1ub0N0At*H4 zU#=VE6Ga8e4%q=z!bO`TAm#bIoj@=c4AR|IvLfvrNZJp^zj(e7Mkm4}nnbm~U}QEv z0P$16pI(|l$3U!y)?Hq109|BuaioW^4W>dUe8by#JfwS5Fl}ckoz1j910t!>Ob;^IJ#->LHplHIux5?D8d{T__1;tvh1Nv_=Gy#<39X8nlrk3 z!W!D)I^V$9U%c;%C%peO3l_n2j-LZkFNXQy2eSVk(%$?p$wdACKeJSml}?M9=5i)0 zr%bKX%mtaIDJx5J&jroQ4ctjw5IAjGxlNgwE2+7mfTn^QQd*k1i-3ZPX0C{23MdGC zZ)eUq@5lG?{{Ha!`27R=1@Er=y07bbJzqCF@xUp7i@~`UNglm356H1*^4V#;xS8(Y zUcP1mAK6nocMq^GHKof%RJE$6e_i#i0zAs@MqAvhocNHtgh{%5G`=2V1KaW^CYuU3OQ7dTLhrM=b5& zP_@}*@7gg56Su5}R=~5-Pqoiodm;^1c^&o<$iV9!NdOPmU$a_4m}ATFxOL{i=N(Dc zW!0cH-`$(ME%e&GN~2WLvrB)54%h?-vURp$1#c>Lj{1Xdi@-qE>^q+mq*%Z%t+s+~ z8T{5Cq~-^4msRKCI(6#Up^fFulVKhSQ6QoJ`LO*1k@d|303LmVd(w8k@6%-+#~FbW zInY;=t12+V_}>O5cninuGEe{;?Nbt`CKv+G$J(r(2~zioJu>~mqkJ#JYfovi&)s{F z1?1<9i5yR_xLWD)`B8!+i~pcDw}rjf1QEJRtsouB$LN3SrBl@b)zTMOv`-^+A;(4e zwl3Y`c)P!4{RwF4)U?Uk*@esPW3hdQA?G>!{(K65T3`R$a%or^uqhn4S_+R4HKGjr zg-P$Vg0YwQQzX0cAn4FJjXHS%bysm}T+JhRYU zrp0}1#xbg4hR|`tnZvb*-_()T4Y%zgb57+sIXRz0f`;RyH?X(bu^ED2V{Jlr)qD0( zW6b$wAZgXV^yH811U33=y|ITpXRyc<+oxBS!}OM;VOw@+TWQ_-GODzpVb>Qv!=M8a zbNPYQ84r-+)i6Y3Mr!!5r{`nG<2zCaE=cIGdE~h~@ceRX(HK(7Ryq;Y^D^PydNbrD zZ}8VX0E+IOuBiSe99It@(e>;NBwEcKK%zr`{Tqq?I(LD%%m~N);|bjWt>hyqy`oJx zye(v`SNOn|v+-mPW+l<^{pcGLfx6Rf*}$Wt`tmgUBe^1W|w zjHnN12qg0_uNZHj(alM2--$Ek}={{rFL|cD7HPN}_EOWA9 zk(D`}oh_)(;|vM}H~`X%Epf8{Hl(0N?OnU4FEDAl8)}rGoB!TLfZRr9Zuq2^eqTmD zVqdOC?3!;V+e@4{(x11m1o)&^P5<^uZ(z|-8>pgIh9Ub(e%gAvA|L7hDkauMtf||HB^3XsJQm==FW-8K+m0=pM^(TL$YzdG_4l}wohKy zs~d(U*p@7sGI2NDkX1DM12Kjp7ic%uNm{kPpE$>=qCZV8cyf#?qXgW3hVb9lyY}1- zt{jPPB}EKW6FezHLa*A2R!GbjI#lv1lZ@zE`uH1=j9A_-Q(wGlOe`jU!U55oQcvBB z7h-OtZ-=JkWvKO@M_ywefkA2!s~`|?;svu?bt`sVi(~lhtv=q`0HcTaR|-=~3EI-C z7GdAmnjc#WS2c1%_?)Gv$M!ZaF&*u+#I*+6$20d+u6_IvMb_Dd?_b!MHL0-ABipls zsiY(gIL(=T-VmR~>}*3=A6R3Yv}$Zk1}u6{o`%~eCM-@-aej=E`xkd*Czm?K9);$~1;jtk!^9hO~Hf(Wc8$fTAayo09Gs6_w zN#iQ!QgpV1ZaOJdFnEILtwC!KdkWXki9{)FKQsH&%eO>vXwFH`MXICD$XY`RmM#bZ zmpV|aFw|FK#e!nq!{CW+XE2IU_)A-CFMIMfSm+&=AIM7yPlW}p0AY&3g@X5oP2K@u zrcingaG}^Uh3D;^hvX?Xan_pNX#duoEic-=2DR!FF z7LkTy3v-%L*i+2MmH{W^MnNaCrwx8#fXca|I$nNNiS8x9tU)%gXjYkBwF7=tCI=qM zH_CB;;Gs!*H-0N&x^%H24{#3J`P5I|eyytC0=;hVMzbVXet&E%Ob;V@2ZW^#0e)%y zKr_lV{QMnx^Y4ZsIgX#_$$+rq#ibMNY@x^=Z7NB)8R>mqJK9qq-5F(YkW{is2?{_w zPCuTa?}JL%kKY=bXX#cuL=5)}`=W2Cu{p*IjpwQd`>Qb#K_i|Y7?FK&5Rj#eJZ*TD zef~|WsW7^XUWw@jFQ@z~b-pS0F7JLr9(%>6E-?D+ph3aWbwo>CMM{I!*wUW|4m~e~ z-bpIK`28t6uTg*LSaP_kiD5C_#t_FVPf60>-iAxmIN0@m`C-@IX(`&H_grqMpX6m& za@Pa!1{xh;LuD9q!K;nUZd$-1JcTpkEb8%Q^}HSsO7zTHqQ)bZO?m;%^nCi?n(1=0 zrIogBVS0je+IRtYlf{(7-JPmDNu07Z(|bT??M#S6S9iAp3*d~6Fy$w?K-xPwZo297 zpTHkc=c`NY|5&E8#%Mopj_!EzR{rLcV>SI`8O*`>dS?c1f)1e3IkJ}(rZElSQ2b-p zi~}l-CW6Nw)o8wY8)r9m25Ky&PwvcOa;y=d2~Rod(uw`0X9J8bk6OnWOTt_<8$5B# zgf(0tgN5yPOaRDe!N=i6JO2>8yGQ-SEQTwxZU&VJx+iS9Qem>gtDz|N#y6YgcZ}(* zyauKN`r-UkmJ>YH?Ua$O4>}W-h$z>IN(ltOM86E`$SISO-q-|`>zJwVPIv#CP#nl8 zG(fMcwiDh4HGkc%lc6RLf#IEJ*6pJFu3rwgy$V|#C3)o=$=~%HP!nNu2H~A#{m$Tw zjj}8l+>Iu~*f<9fOFHaq&t0u7j8`|s?G;+E6J^^hpA0+(;nre2>3t5ZbwjE7&^9-U zg)K?S7)jgQ5yk4$x7g5a-$~xXvFdTv=5H zKNJZYhJ>Ns(2{1PJr~zUNtJYww#A)zDB3(1pB97Dds&LuTAmII;x`nxTMHo@esn139O=YJdlFK zmpX&J>**~(Fop{hiPH8~qS|AxbIPqKGW(QBY~3Aca<~k9X~eQ=s7j%cd-dqRfu{p7 z{n}Z>lAT%xH8tezK4inMe-n34K9D$b$(*~Xt$Bl37l4i~{1ZSNR?=l&IoAzZ?#J(# z-Pj(cMSofTT`CC|YKQ4Xt){Zf1I@A5y}a(8zOLAC1^8ktGtM^O)S5Qhdc1d`BI!tf z^=!N#s4scinLXU6xi@cx>j!-^7&)l9q49u?@)X0iYoDjQ0OlSL#_;U$8efP{@mHr|gGe^_YB zShp3t_PUz$@jhC$Cy86`cz}m5-&=h~G{K1n;f=OdAB%%FCme_yjPu$8+;?7i=WR(h z5jsCAtBXi95{p1=#3+1PP~s?lAIo;6D&M zBU=zdvaYF*wnwZ=s~`yu4$+n*P!i>5Vhu-_=IOcmzYNnn704Z<4(+IPtDOH~quo>A z*9^?J05N=t=+89QO?oF(z9$36Rfmwqr`kZ-^}c1<%N0H}Yk%M9P{i5hGc{4IzN8RO zR=DBF1|ZES;DwFhEgRN7Y%fqA!ewJd2hDsK=c@Ci&YU0OZ6Fh|GZNw9Hi zr`*l_KE~=E1$}g06$@Z^U02W~i6negG+lnqo_US! zZFjy%mJS7iX|5}_JvXv9){$Sv8@qvS1rQbrr^8Yi%UtA)>3*d~(Q`=0?Tq#BH*`w2!`VoO2)GeoqxP@&wnp!cPDd0KJS|4A>HNzD` zI+8%IW4sqQ!$^Gg@okYtz&)pNV3aH?+uL%maOno^^PCDYsK2&?^rl-c#O;)^+hlKb z+kB7254gr0i&+ge0QzO2BW5SeA_T-M)Srj|&ZZRT7_-C=XA*3VU5w}@bTbW(YpF|m0$a7 z)>a>w1Y&urSQT_qO^MT+#9+Bfw=(7GsTb|L#cBn9UBD)BKCtKwOZE9CEA-vBydTBk z>Tgmn2)Dlt?%mrfxjmsNy4>QRyMwK*6A6aS0pEs6*$}kxzjWi(el3Y@kdmz1J!6Ny zVTHyRY_tWp{MR0;ACgf3HIx2{L7bjhb+h$9Aj9#qf-rVFeShu85RWm(nEv|A(RpdA$8 zJP(&Q9Yb=^c0S{3Fb{m~=}E`_g$YgQ_5hFRt15RY3A!5K_Adp$+e56P4M@^_-LFOx z)F1VwF1EYN=apUMnjEa)D?cDR~1>|9`R2%lplTR-HeJ zTi{Q3Y)38MHK5gwuuT^(mCWpF{AGmqZHV)*?o}eR=Zh;RgIb<{>evhjy6$$!8(-7# zFYm@bb)@f0xaT)Jj1JN1>)ks(=gHPh-G-Yo-dun8886CASs`J0^`v;N% ztEH&og@20BV^g*17y(r7KOj{4W-v}fh4<9y2Se6x3=RG<7 zO@BGXA9D`Kw!kocVyIgRs{LdDoix6l`7!zwM=)1Ofg1&zEXH?Vohzgk_e z_8+D6BS0z5j+9oQ-$4lRmiM5}h@8Tx&Ih>$o0Ji+x`Em2);~aemvCUDg8rW!T9@(_>EXW$d6^ zdBDcnP|G+0=?v21D?=4^Z6VtzgHLI!J&FR!Y3J`f^hetM? z30=r!TH$kyLkIKMKDl(d;4jyb*D2GuboalDunnl3G2)#33S_{GZe9)UT{oYAgA`Ow zxmieWrRtg0W(UhJDBHPw04C7pQ_nMUQdgHF z&1~($cF~@55w0`D4-kwE){k0ys%c12)U|g+)R0pu^=(|&%=Jaa>U>W7i0>JXEkL|) z)`?rQ+ zN}BDDz^_zF*)=7&KQdmqW4 zrdIdd)7SbfDL{!i43(5>ge9>x50*9Hsyuvcdxsg121?6g;ti##8@kckDeOEmuP@HC zye;jkJ?&+$Hdi)|+)da!+XxycnC8_9_ul0rctf3^`anR)&93&pfFw_RIqSS$){~eW zdz)8~|4~5?!)gH)^n04|i*(b4Gg^DXLA~PQb6!Y-Aepk#x0XA&X5N2_azAHYRTgv! z0wm1#|HRnNLRHOFjwYt$ic#0h9sUw-KLTjP`3FRuiuN(rx26-4Fw~q_A#ngwt;hjB z`V38Ws#;u>Ej=C8=oNZ$U`XA72VUU1;}w>&Y|i79?{i(}b@W|4H7r+OgF_fQS6T=$ zHhqCWgb-Yf(<-AF{eMu;U%d1?PFkN$K$R$m_l2FaS#|k4j3PZUe*=3a{w7o7tLCk} zda@@2K51EF&;ri=?LvD>a(OPlAUwY_TlR`Gc-D_aw9m!yV25X|<% zAw!l+=PX8{iN4|HvHYPLXET*D8D;3Hx7eH(%>cWV)15fg$LpqNW6O;tcQ^%i@;)6Q zUdxS2wrW;O1)s0|mFLV(oPMVE!iCnjXhdZ=RYQ~c!fO&!`N&oC0NOS^@_hf-`%rB? z+vKGz#Nc0+aW`^Tp;9S)Gd(5uZ!>=63UI*s#+ z3rjcgiKCTzU%Wm}N`Mj{)eO}mw`PDDUselFnMiF}w8OPRlWtzqdp6*CcC#~vcE*|w z@4mNVb2)^6+|2up@9U-X$54Ol2t=o@y&^TT`;Wh|QE$qJRewATn8iK4DM=VTH?wkQBq4Dq$4`RO{y`^h zn{@SiS+dgc<)l&TU~KJaez?wpfaKqjCv$}X35*-`v$%5&8YT6S!0OJP8hMQF>nZwI z(xo|pMBl9dJ^kF`z7>vKt6WmO;8TMUF`WVJ;iU8D{a*dN-zZC?E!VGNd8a3 z?9fD^G;}%a5?dkLX}uyX^`lE+?8S%{ES-vd+7~Hyw`AFEi8Ie{ZcfQNF>&v|BGLbw zx&Z|D(om#Dm0ij4SBwQD%l|;okWs{%@isvaApmo{?}1Tu6)?3q{4jl6GGxk|m?3MIue ztMePt?D^y^vb-wqr6yde$^2eM(467_C4MHT?744K;dE{M%2{J>c>M&Kasm!ggjeVK z=>Z28&sic-sfQ8YH5~@oR@>+gDQSQ8Z}oFo%2yEI{T_&hULN92r?qCrEiJ92EqVtj1^Eke;shBt=kr69!r1Z)?JBC+%2<~IeGoajRgy;oi&t^(v z@p9N7#9RdBh{fJ4E&C&JRsS|X|7cEKYfjnD{4E3gHCinEfyIsWce&gk`7x48E!~V8d5|18IE_{nan*ehp<`$63xtaB zg^E#jCwVr1ASGUI2=EUMA9AX+XP-ANnU2YF29P=(d=ZdWNV9MH{3=?| zE=*6Ip)2S$rzn|2OP>NuKp6hOm!^{6Z=Fc%*Gps3JD`Lv z_h?`}+4LR#N!wQhqqMwX7Vqd_0UafgeKR1G23MW-C`5V_&2{Gl|wkj^u~g#(D9M0E-Z5?_g>CdqWGI+ z=?st@x~yrk(PY%p>*^N}hbFiFpM2W=FN75R&#yD?)GtMML0Rqw2qP0`9|;SM>tQzx ziqGmHwQ}-|HWE}aY1BZQa*9!{NzWKP=V@VCiP||b1Htl>w~ZE!&TaikSw?XSuf3CEj44Lvu!@^rPrgZ;`ELS%8lIYEZS*r zrN)2N0L@%BR7uYOKi~RvY@5b**ak0+l(hnY^Do~ z`AP6TUGTL%sdY7_&M#6PWM}Mfr5kuyPmy!CTO@=J75Y`!l>Gi$ht_B@3};;NNh#4F zi`2Z%A2yqraqx4J1^P>Msp(eJ-J9E^uG;|J1qXy3?kqbS%(1!cQVmz+XD!~C{w)|Y zmk<~7431L2Wm&r1yPsxfYm#&EPhzxU z3_o&c;}GQpc(5N|VVHJagDED>(c(%=ntw93OAIu2XunTQdpa)5Gt%)3HfRyvQ8~v9 zcVJF-4Wzu?_Ej`z7&=3R9i12F+%)z74!EPj6vB^)wbK(75?X1_Z*@+8?b282K7697UR1W!eD#OK1HF!%! zk97;^q(U7)8`1$awAbz3{3f>{*TymAOz5MH#Ybi7J9~Lv&DP1hG<)MHR;}~I>5CzH+;`49*Oo17 zyXC1AGUVP!+ufkn6tvt$2xKc!4?C4vj3pzrQ$~PrrJsLHam)i7&3LLW0KBN=oPcXq zBYpy{rXK7*Hhite>BT(J$ibOxjrrCV-QmKkM4HZnxCZ9V^L2P7y3-b0`tgY_mKzgo zX3=gw#S|N642&Ue^6xv}EtKik@LVw}7Lw}?wW-~UZY|8k{Nr}kEG#J`yrTrh45ZU) z_yxVg{$Q6zm#&&{^O~V;e zrO`JEpp<)<@j_Q)QSS6<)3VROU|4cjIAGtnZDzB{?0SHKskm!48Kr)bqP5dP@gJI2 z_fmhj%YCP_4GhD7sqtj$sLT{!-35*MQasUD*2?;#it8S6JAd%klCi7stj>FsH&V;~ z)pMu<$xq-Ca%r~o9=r+R~=`;95h>VXjbE~qG^k*5g)_kMKN8Y~PETwLrv61C( zYEyL@p}d%o-`+K#9f8eUnz7WHIumW;*m?09sgb_~(o(n4ry+hA?OZb0w;Wzb0*L=# zCrkD+tD_8%b}Avillb)Y^_EUVEpUN6ce#6p_--;U)g`uEJ_;Oo-wM8J`}rMYlmkDF zwXaT&k=pq+K}=2` zyIH1}Y}|cN9~Lg5z9{Hu(5&57V`|vCKiP_Z`5KXzzx3+br~0a89DA#9?Bsj{zCK_C zaBn2~{gO!L_NaZa3`!_}q27a>{K+finb)9n2&|B3Nk)$lUL;Wo@(dX+*A-?q_Z1_5_7+>E+Mm5g zDOabG`7hglG((+kQn~%b9VN-wDQ5h~kGTi6eF}YNM_zilpRSE4GUa`39ILts9wLr3 zXx67fJf4lf`1xg_NKX#GKd@zWPH+R!E)=z(bF&(tCCr zaJ=hv8#&i|!}7~y`a9nOS5OlhqWX57*Qu;F>YpC7{>D@s2$#ffH+)Vb4SbTjX_G#C zQ3HC1=-@{Q{26oN{88W`H;4+1lmkFb-?B)V9{>8$cQnc5jIifR}}p$p$IO)gJV3(O*i!3&<;9_QR|*2dx0zK9|`$sbI) zofK-FfqXGQDk=yD1BGwl~AW2<#m)+d&qcDS4vxW`DWyCptPNqdj zf^&l~!5cX{Gw0t>V;lv!*tx@g5;t-S$t3wU z?5_1YRiTACZTg96_ZC(tGCopUkEhjIGWsxiZ+q(Ra+X3;M>a|??qJVX@n_VtRhLNc zQ@5fXdBWZK_F$?L_BvlBOt?m0j8|}9d1HLQ*s_Va%O_)O*YFkN)Olwo^n`NUGwZH1 zSbMfh_e0!w2Gz6KTc@8)8%JAy1^O50p^*2&nHF*^3iN+cCU%75xOZ0NWtgi)tS3^DOV?6_FAU z^|Uc=ubR;i%5>dRiv7tbuLwI5M;TfM9gA8=4fn3GoLGp+T*$jpwm<|s(AtO^)VeRe zw=bt*5G?7Km};zsSf|EL{!-FA@zIo%IH{??b#*{@4Oc(d&&*TT1o2j@{8LUyx* zNX2P7lF1nnR=5qy{f(8{r(Qn=X+HmhiI0cN?_Ri>h7S11XNQxdG7yggWr&x~9PCdM z6S#&t%l*?Kz1Fp(^LLbWN}}Hvjpt>~Z|&wLi+{LI*w$quDLwud58e4+9@=$-hi)Dg zhN^{v6f(mBbDo`?pU5ls8{XuHyzP&&FU41{&4I8kyzhbwTwd1xfI9Tm$uKVGgopD8 zeC7*o;(E`>uWAQ%&tpL0WA#qnA$w}ivjmoNMc96?BXf%eH=6#)9m0!io!5Dmd3V^a zv|z!cV)O3nEd^k|LvTeht?)@aNE4`xBR0;VVxM zUPuRg(8ET@FE{EwnTflCzu^m!RN}K%Ds)W$oo;nCgKS;{PQ!k;j?i!i58g*$_dOcvK2mS9ylIZ#9Zi( zs?|~Hwp+1v+cnkX(IM>nWLiJ$xiawE50&8T{yk2^tn0C69x@k_yYTe`~=5OPvw<5*FGr+2HO>+0G<$>r@+b~hb45@eTLm~qId2eES7E7zl7#Nb+ zEHS3LuLrYawl<|&C_(GlV{v4xWKP`p^(le(3xv#-7Y}<~)#SBTM}S!b^TK^iOblyr zW{;*rWG>3XW&r^vd=wTxE!|;5?!MGKJV!L}0cBc@gxAWeuusf(XioUlDTHg;#(ISv zj`-L5nb;izaz@6DS((o9i7yq15OVQ*jHBB@jR<34ey z_fHOZ8o5)ecqXhj)TX}4htw&+s7vo${ZZKH#yL&$c}r!2GMiTwVW?j_`{nFSN$)N#MqOX^B)(${}tLl4gk3|2B%G~>ARUbYFjTj z#gV-s?5i_d*GKAHX>j%wGq$EAk^;=lwgvYjb?RVeLV|`VSD+69Xr&%S8_o79m+Wis zo`PC$DO?H`6&_-ia}g9yO+(jyztQ2Tv34J@^}DfNTu!3-<6%TuNifD`kDtpl8u+hG zx%aFHJ3M>TvgTVek8FF;4GX93{Q>LJMaTCFK(;qfrJ zruk@2v(fXkGm>i_3C}XpJqY{qJ%2TBitNI6 ze(XZ74jPT*{UwLKGt+U^5Hh_^T=V#DqoNxSPllfUYzQ;t^7955477)(QJf1SXDY4kT3XN(QIp*3M zLk89`J-c`%8W-pYSh-0+4?gEpE?YlU3?Lx3l6ov|?HOTYInO*td%j495j|L2WTIB~ z4@sI2o#A*jr9QG@6*auB z3RTh?WufL@0nw2Z$}6GaErDMFE~X3Y<@1I0{&f;m*=T5YsvB8WSaQYi>uN2y zT(|5@SN?3=c*F$V;(o?yD6z)akTWFY&u<+#Xu>wvl1L#tC3k^~D|&rJ!wmyA|IW7x zbxUvbRN+;A@Nz(Nb>GKlnU+9y)(M@@!BH%7oS#SdN90J)-c>HF@0PNt!u97(hJF~{ zr5YI4oQj|Xfdlfk5>EwJT-{FB8eY>$E{B|}&vmHU?Q{yCom+TCC$xCfDEULE#98;l zv)39Bs-!Z-a>N$uc#D2$DaRFy&9o z26~})qMC}MMChUF9vq(?uu>A0&J0Ulkx_pHF})J6B88L9iu8E}TYR&Tl`t1k_j=l+ zX83);bljuZERf`*0`8}&=vm?btm$|Jm5kVlxKZN15E77tsWkA&I@bfqb7`ba1+3{{ zLrK%PcS#4;Z-3wss6Wsv7Bwk8}X#xy-mcrHFa`y{{=7R=l@ZIzy=kpoDAC=OfN-6;*h`StXov9&udoMB z1Uk{$%eh^~%F#o&Ub=9dsV#ss`c@4fjed&I0uEM6A}r__F|z(Huk;nevCmFaV}75_ z>LMV^e%T(Hg#UulA-iled9k$Vg^Hy0O;Yir7;MjbiwMJWhGf9+uU)NjMC66GrSUJ{n+HOfWFBIm!QxZK=9?SvO{c zoSPnn_%Uv@Z|tCcVf;vR%xhKH+{A#bdBom^7Y$@0%8_AhCYrneZ-xB<3IKAGS466b z4lo`oNWa%J>a?|JF$%*IR4C2IUy&2BXG3K`e{q5C;bEn%U2)N;j*GUZs$d?Cy=o$Z zJRc=cguOaFjc*B|%_VkWAaztOs%K7rkOpui5wr2o`qfXPuV}IgCGCSvrw!0QxK+`u#&)AIFgz)q8zE zo3+zG4&y1z%e`Npo?dq?)!wMikLd+^fjPae##2P zaqWe>IG_qGtlfP!DcWavN)0No4>#VqI0t#0>EnyV)iE!(*uV8O_ z4HyRapuvRV~#$0X298(l)G#bCi{*lDZj%NYDGjWX7lX$Q_UYCiMIz|&Ng zQxf2uZo8q!fV#81ofdAfjk!e5U$IKEG+4z{(~o zp1P;!RfLz~_aO;Iwj;uhcgsJnC>)S^z9%ueG}0C5vJJ~!Pa*^z{EuF<4DrkzQSDW& z9fI@BY*>eJkndAhw+~m5vF7@P8nvZoa?z#WD1d%urKVkw4s$%I&gy3`PSj4H%^w3O zYW#%E56p|&u9B-e^P~_giYa;ey2N+Yi04_;{3!fZJvRzVGH`pyLT%SVIsP)!F{!`7 zKR;>S*R*Tfd->D@aU3yZT)JbfZS>}S(y$c}AXrVp%CtC!ynUu`(ThQ3Ii$rqZO*?IGuKTb(K69J`t!HwwzQiJD6-k>v* z5X6sz7uT<Q`I-zXBe}{ z$)p;<>zP2Dig#9EWPU3`TZI>~$*VTNSzNDUx3}h)15+he=Y`Aohs7Tald;E9iv!Qg z5uRfKJO3`sKKPBo%uT=2wBCpAQwy(`dBCfB(^A@3a%yijtW+_*%wPE+LLMZ?p4W}~ zKp7q%vpza3(&^$$K@5x#-ux1nIB{Ty0~I+UNrQxeR=QuxOLWdhi2SFSeugy)rt~c` z>RIn*UCW*D@Kr$y#+6D&*}$4$k(u{Qb;h z_qFbKalvwHfoK4f%jw;V?bd>)g^t91k3ntuHuFeZAJMBm>AH239rF)&snj+owuk_n zxdvA_zI4R=wM{%%_M{tQ4jMO@Z@g%s7zSAVFM*-U7cBQ@@1Xt`-N^pss6PNC$O}gHnf1c|Ghu=WVxH(n5 zDQR17cs>0-9o~#9jQC`1w&Q8zr2XU?!&yrsdxA!yjwE7~v`}ZS?d-LT_;w3+l7JxF zl;;(rR7SV-o^Zzi_kz}fO4cU^sm(~;M3jj*0Em>bJ{yNf?n4*VG8|yBdWADGcHsU- z=1;cMt4`%#Ge?Deo=dmb#ImXg{V}M-2IF&+C_W##7UgvN zgJl3?HuFkpU1dT%pFyHd4<5=Q4?Uf{C90VqOJ7}askf%RuyrZnTQw@;Rh35lPi*qn z-*FeLz$l}#UIj$nGkaHum);zo`scXjY~edpL8I*+G~*LD?J>nKgw*x0HBIf{uj%gD zrlF46br8`YtGd1@+{_gC#O|s6qJ`MvDV_^2iLp00Wn;m#yuJmz;*Al|1nq9w_&FQH zLFEVMnRfDO-q$St2^YL_iM({2g#DQ74WS+t)$GLj)p2)Zx(1Uig${yV*(XGFYF=xV z8~zS%$B6A$2Em1zB{c*b+Ijz8aV_~^`RLVGQx7;tk1oj$g zYvsqxJG`61^5vPShuS0F>GJAas|5$yvWpI<)heTID_Z%D3^sY(jrrAnsddrFMt*Jd zPurWsT3!F*9=B#TU}&2DBi#hpFBV?Br)Hu=tCS`-WOeupxeu>U!%t&lxtA@{*upED z9NJm`)1)u7M4~S_Ebq`re+s4j)K|<&Y2>^m1eb8zguC--`X7!lV*w+M60576+lNQ* z^1lu{uvloMZY>?F3yB1qntyH%y~+Pz*-^@TI4YWGz9+z7v%-RYFG+hCD0+z27UoxBaKTjY;nCeQ-w}l+zsobw^STtS&W=vEhW8N* z56j=zrHDg=ZKE)z!EqT_ai{SMl_|8LPf=qgA!~z~_H2Cm(P7fmRAn|kR6@{<2$5CV zm>*qBh;s181JdZk4{tIK<#pLyt&3A)%mhIM0H2!tf5m)Hd3GZ3lX@Vl>DYVe2se9|7#G9~tti^Y z1j4X54^t{_PFGqC*ZUyL-U^FP)$gc5R&VgrJqi)ZDywg9CiI@5f2=9594k2J>hf%9 zi|;%AlYYS@sROZ9@By|Q#lRFg*>R{U9(SwncFQ`g5UF=W()wOvtdY?G|7Dv5^z|X< zA>!QSbG=jY_r5buhKn}Wd%Je$ETx}GrV-Anmg(m%W3dtzT-5 zPHz=dO1cfse?GH%=k?d@R&#vP{rH0s@2K+`{PsC)t+*RG(p8SWHji(!)u)|N-JEr> zN&Bmad6HM-VZa79hpZc_8D}2BY^MtWjCv*Yi~;NgFGsuaqOKMD7hXC;@ER0nka3we zD|T}5#Jg*qx{h!xU0Ti72y#31so_?tZtEmel3FW4cQT7jf#X7;dY8N%N$uInQBUI=d(@E*M1i_h+-8IeZ`kX=5Sr7 zjSzzvRtDNk_N4*cqUdAc|uLy~nyYxZ{hJx3**_=wb*3OG88~+8O(T?TQ+73ueHQ9&Vlo!uYCym;q64fmqT2D*$u&;k6FF%Maxv)7`>Bi(k=^J+BL#bZsX_n`m(XY`V zt7B&>MO&>yYib$}@Uv^ArBy=2U*$SSHN#fBhc@VfTuJMhbx?!X95cO5?xYI#hKHW1 zv|?}w1anw_mjNO&^N8+QnVoiUyGQUdCq6huY_?KBXqIOm0GZj zQAiA;tY(YV3q-9`;^##{q?}t2Yoi|ypRk=*0EM_iH8YV_Uaun?5)rwso?!6fTX_Ia zt&*^&8IRYz?V+$>a+?~Hv*DBudbN6X{c^7nP*8R*uNBY#?t%gdo~H;O(E>XSS0CCT z%7LIlr$4++fvw@prQ5Wd@Po;sH=EQ+-+hZ6NvyN!(*)wwf%;K{KMAufUCuYAv|API z#OgR_#4J?o^k00GQcnr}hCYuB?q1o7!q)^<-6?uGem?|AtqYh2gtr&{Ui_=X9 zNHJv?;a=tA%vs`s$-xz;;e}qnCrYyNYUH6kI6p0~Br>jeZkVOHrAV^&WtErSK2>>V z60|FtlVD(;)|N%o&c4D*x7!ayS?yt0;owG3g}g0v^0%9fRMQ2t=HM2^ql?_C@sNcB zreVDO4)FltQ-f0RYsg<9YMZHUbXpQ$^99vm;+dB21gR*bofVLiU7YQWA^>+4ca z>8hLq>9~N`4oK2sRa0#x_BU08J^a02tV~Se-jvr-XdOC}kXhS#=us`(C^_HB=_Pqk zNPzu;_nZ`TX>98FqDcp+(bsuophhdXFE=2Z%$7U7GyJn?*BFSy0XigKLvJJNSwT*r-0}}lw1N=1H&Zi1BPSa$lH0d@Gp zxk&+2*kk29wOY`B{z45)6ZiWe+6R(Xs~WHhW8RQ;ze)-AvQ2YLf#fnKb0_p`&L6+k zHcZlK-J}$Z`J?Pt`w|(naSA_e*J5p{wJv!z`F`0lhApIZvoo7&5hjwl5_rG z2$ju`HIS<7%GrD8s~0cjoh6~?69I84|5M8MkWxYOc)##~{wta`(-dD4V zJ>m=Nd*vD1e4Cla@sp4+CYQNdEnKIHw+Zl^_NB=!$sB(Xk~Mv@mXkVv`6S6&ng_dn zfEu>LGSlz!ObsIlltd$e>12alFB82gdHLP#fn&I}bz_;q>4I0OTVU7!ALiaPs>!qc z+kI-QwkoAQiYQ~NRV*kd^Bk=MDgq)y5C{>GF@!nHBvmU^8KNSfj3P1y2nYni6cqsh z8AB3CfPjGj2?=8oNJ#SD*gntRd+oi~djIS%`prjZJbuSX@ooWDVG)hR z8k{sq@CD6vaNLGC@+HQR5QWZ)B7vWr+va1<`+j}f{PLnfE=Hyeeo7{jE!w>YmJL*U%nD-0k&|gaN5qbuZmygQ| z@p-4m-`&KVj-bH7lpI*Mpq;2I~O8n-jb~xtGb+#bbuOpzo;F%Ur ze%zK8xgh+e^N4I%kKROriN{}=*IgvHX zQOwe7@m(E=x*sLux?p{#c%#&D=}}vqhjuJma^)d2elXH!T)!4IUIm@MtQEbq0-(NG zwV|<;Me$ngv!|`Sw)JcfNqo1kAg|0N%{A!Hz*W$&IBca^6ddOfZPF+jv{Xpv)eO+g$PPy;2I5}sp#udsy zKjCNKu2~3KVA{@~0D_5y4uga5SYvy*_Xgj2K>@Y&%HVZ)I;uDot-S#{eHIM}431;6 zV>d&id(@g7dhtD|sJPWj(GQa?6u0+$w|drkL$kry)}9)^3o9Cct$iL8N=$uaI?Nv2 zlr!P{1LGk)G!izW@~F%f!;ylm_nSpQ`0(UNUMPc1ySG`{m{TOEZ&7(bhGaT<`5Bh# zE(jTpAw$EI%P@O#%N#zutg8baWMoQ2HVFF3qTuLZ%!zdW;{R1(XIed(9-YWk6t;n)|xjBuYRUxJXdUX~j`;Hc^r zJ5s;A{<{rA$T=GzYEdtC98dtOw1nt6KRo&N{-Q&*5$7_j^ek651Z8Q`p%KVgO9q6m zR1g?}v-DO~8vsrd$k;jx(%NLUG0@=E&k#@GWE8*MhdHTwxbmA|IqjL8hO1uXI3&_2apK0 zSB(t9-4L{Q6N;B1^?LHjG+$uiaq8}J`1q{{V+ouf(zCXxK&7c3tChq?Rgs1J;4B#p zXbF}nJYWD9_r%t{U5VE(AP2iNw6;1gJ7%<2iq~MFo?0S2zh3U(=#Mck#Ap0ZE5)M@ zS8&^qw9-)Aakh9oO*gzWzL!O9-G>CDa5{*_^ z&=g~rGT+(3!!-rC<-$!oz7(~_&37qHz-Gdmi6p}1-e3MbtBnKA$(tKx?<9yOd)<8u zVyZcy;pw-VN*J{*leFL6m0HMtCQ-WjOuGE==$fj`baR6h4Qa$qtZZ=3*ACC$-XXGn z4>+VFVgn-k3s7wZW{HihbI`coaZJbcRA$gcBX=4bc|``Y5Ohj$Y|&sL#u+|1Hnh+) zzDE3JyfbQOb0H8*_pQ)Vn1>LQ@oh%0Rl?{4Dm;tq5aZq)V?>A9a2(%#Ap_ZX?@+?& zX#1ss&I!8z&uzs~L~z`GR-@2dJ!%1aGBWZE9vF%X4vjkjPDN3a=7@MYx|$5C##0a= zU$FCkdFfsYkT;6%Z!nCF0vyux<|?5~^75|A=zssg8RE4tgT9L!p0s0FQ^F02*sMyR zrDsoX)tz2^PcWoi$U+mF9YRG=o96}umU)@Kc|bpo|01hjBl$Zy1GhJ3f6rR990teR z3!+Fa8H5g#FL!3|{+C+%pOQ*6pz_dK?^(c#P9Hm$^`{9J+17+BCX)w@gB#jBQi@1$ z(po%W7-3zJi4ETXO{5LQ=*qoN{M}njOnEn_A?lJGav>U9`HeZ!5K=k(Og-ER+Q{}D zd7R9y?J*JK0ugHmZlyPda@+++{aoCM3+83qXxQ0_IH&Q>;mS9AL2RklV%*8-(of(YVxQic8zvAGnXX{vhRp+#B{l`>;pA zp2ahOKw2l0a;xZOuZE75j-L@BOO0l_@{a$hYV;{iHiQ7^qYKXMwAexOE&0_5p&b2U zc1g`7V?N1^J6%I#l}T3PPd(h;40ru0@G4_v9!M3BBJNZ4?RhN1 zwcQLi3}Hl=T66<_JU|NFq^sAWpW3n7&^TfHsj5k`yXkUXwIMfaeJwR}$tidW_3iL-HgQ;yf{p=pPSOU&~pv?jN@(=w#DgFWQi z&sUe+>IIOrre9o2k=TIGTQ$e@(8-DHce#7bLSl&TTnC$X^?%)DVfAZ9a6ZPapO11} zUGk@a@@}a1_!OeX&Po4WmqW0aC1Duqlji3}{^XcQkOw z&Xy6UU$a}hZUtL%_C3fDXLY!sf7dn_+bv2%izen88I_3R<I$^igR+n(Z!Hj0&(9^FTdq0Al(Q6(iC4HwbfFtpMdU3e$ytQuMte#CtMftFFISc z_-MLKQ*NZG2qSIo>}_Ug+(_2r8hlB!-L8R@^TS$hdBt-mR!ej`^xKATz1fcLkrah8 zt0#4XEqXReZktbah&ZOJ+-oHRR_fE@aHp;Y!Gb&8eEP##ZC#ag;dlZMmxqWph1rD^ zC1$Oa%8GPOw6T0gG8HMl8G@;aF^da0)!GTL))&el4L>V5tHQQLG^sA2dr5c&p|Xk{RWJzW)sNzpID>-{Rq=&UUa)e7^@ zxgX{hbaAKpoppG9MMT=rBGj6vYR%7c@B0Zbu_fF0k z0;eUqpy}(b9Ugu9{o$}HZW6zAc|}P!e%``b7@t<+?GsH+Z2U$9mpy&521r_Jph(Pz z3oia?l`vbg$2M;HzV*Mg@pFv#Z7&>0_^H9{p5*O&vv4L^pE3l$HF%PH@*eu62Js9u zu88u{h3`K78*HOEHIq!a1z>n;%6IGUAM2Wsv`f^?Pg2C#;hhmJT!y!qFlT;(2WkkD zKGcaeiAt1NZBV zA|~U&Naya&ck{kuYQyM&Lq9TCuhnF&H$xiW@NvJ3t#GFu18@bt`?C8uF>Ol@Eli*U#~k-azV4*8 zG`)<;DRs?FcEkomjQ+iSWm0eAg(Pr!ga6Ho42HifB$`yBaBr%-& zUluw&nX{}@U1?^dQ9AELG z;YZOKj|S~L@fuJndsb#c0(VXvat(^60>P93!D_ifBwcGKO=?Z&&zfsd#fS1rqS&Bl z9XrPj9}sP*!lU8hQsHl8qGhv)x|g-(M7|G%)%V3o&EDZh5A#taeCRd;kH z%dgV0tKoe18n~+?Q7x(>_M) zt^(v8(Vw1LBwx}CO`^HkD``hz;Jyhn>wW-qmqU&+X5hw(4;rDjSr-F#(I3`~XTVvS z#bilW?P|%S=R@N&kt*NEZXLhh{Eb0JRo4~VG*Z>u752DZKQP{p7)~w~+Qh8Y6}vPB zzf26j;Cz9SPZ!Pm9v{61N)HEE@0a!xcplE#mf@N4YqIMXExl4@$YlA1u-lO1BC51`mc|wqQTpGDIrcqY)j{S|~rsp_|qBW5j<<*cGkmVkF$*t81 zHssVp0KOl<>=xHPEZ##C%}YU8rNx^nd;Y^f2i_hC`c~}aM?*eKj&>_Sfhv)|R?b^X zZDR_p@BNRicmEN1-22*KrhZr2TSo1T^l7*wTa}&P*uI(&_iW-_?!D>_3cvLisG>Fu zR!$jiw8qSGhBE&X0(Z7)I^genH*#t?$cGpbu(lwyF*#Ar3ncc3sn5|!2xjJEGyk)n zF$fHFO3zv0ELB${FhHM@U5FHTRtW5jE<4S}vM?EnBPn}6jImp&u=leI{}9mLsQ#U( zBi3F#eclltI7D%96fN$o8ZSI+h&uC9gMMM(gx|pzQ%B|(E3XA*ej{w(8%%imi&h$| zmAS?W6@qABm7KAaW3mp9=quJQ9v_x~;6O?Je!F2-4f6}?}nOb;%jo-!pil8exC_g>)EkgW4i`u`v z$}RVu;K1DK$;m4vW?4YH!tj0bw{VKlP^Q}t))mudTRG+X7TbU99GO>E)bMEY$$7GQ zRiNvp!TT=*-7nPgjea_amhY9R+%JAL+FwX$K~~h=31+P|O)#^|58jsMa|4IzvTfXH zq8s?fJ+g5N;!DqR)2F_Aa$N#-itrOyvFjeIgyK9NrD#GJvcr1QZf6S8bua@6fG1vR zsU8Kxl7%{g-L#$I8>?n@9*5jg)M!(kyA6aPD0(f>mwPR5&_D>+`_*47Ol!o|Z)LY8 z^H40#6A*xjErmquUsVFlSD|OZV*{qQUgm00X;jo0e;up#R*^J)pI(YoO&Rw8hl);H z1wCUW8KDlb{^|#M%&+a=Z-^VD0_SnOC42h$-fhY-u|I59d@`0_zXkFlO6>lV^;Rt{ zstEsa<~C^1Z#ej5(}`k7 zln$l6@AJz_vf+Zh#Uq?$XyN?LEhd`e>dtc&m!LCEYC}EALFA=U2ayv%R&*O_=|1S> zyqE!&=Ee|Tq=r+lBiC2+Rg*ij4+$fu zBR%aS(*>iMHP$ikh;HkrM%p$)n9S(b9Pp}RFW#=-{#i=waOEA~eAeyot9GOf{fN0E zPm^e6>O^OToI)StWggAhW)4>NyYvHdjO%p61+Zcvq8p35WnQ{E8>w;}I4MuAUj~Tu zOWMu6S`*s@ZyBTa2Aq=N$$`jEAAl1tnvO1RvY{2asn@Zy#0byIn4~ zT+8`l+_Md=+HjMV!5!LjO|=v)jl@ZUS-v?f@scFt0Ly_f7jein@Jk&>KqLxJE)};D zglKtYYP+mIL+mEjY-W{W?fZc{pE+FA`G{@iF>)4igll~p94-?L*bVx;bDaXEl}yI2 ztp&4N7K3>$y($O}MY?v!JXw&w)oPYTyx$C0VJdu0Q4;{iQgl%SiU4KK+{^E}x_orKxqC?U< zO2QpxJNkfdiiN5-hzp~r^V=Y>d4-1nNR{9TwBkPR9}jPF6ogV&Q1n0Oik`4Hf3B?*T^&#A%#g1>bg16~)aKT9)Jyv6 zXqh%_wK-&8%o?~9?RzX)ajAimo9pHH(>#5R4b2hd;QWXV5h6Iq&tu-#VkE88XQ49x zy0!*JKtEnbBf7!(2R)4{IAn+6$3niR2xVK$MkPyTW66tCA0xbFe`JpKQWv>-b(c+% zx(7#1Z_D1BMNE1Sk~djSVN-Pzv!TK$!uLxxL=^8X3D8kR-W>zmFABe+pu}$270O8!Fi?x?s(1KvT9c~ZC zmu?U#KPXhl0E!6@sKcuSttmYvuKKjS{JQkZpBt6Bmf4H2gL6}0Ay{HA=C4r~MJA%S zTJil5UZgxuB;GJX4hIw}`eXdoVtDdiB3s5oa>O_ka=3WBkZfF+L`-N5%5WFC^?Jt2 z&I*Q1{a$u;_L!FbowC{(`(rP`Ar7R5ru&DU0n?;6#Vuhrvx3!+-m9Hs(~1Up@1T(G zykjXoC$`t4kF>cBx@R5{MJC%8E=3Ki6640bk9CbdOW_3$e;2L>^-5C0oAMm5ejsk2&o;$eoh>BgU(Xek}rAwA2n1&Rb zgALw1H29j-Scx`L{f z-(R{xeqLWezZSWs{Qf1bn1l_x8Ys=L>quhX*`4PuctC!UK^}|RyqjflVw1jMuT{Bp zo|AIhjL8hFP>tuHo%1tLTI(E*G)=o@Vk&Z4E_UVa#;1&6oC8LFVR5F`;@)W59@Z{6 zs5G-5qv}t%@vx-4`9oD)@sAg__f~6t$3HOF89(2zIM#BGOIQooVng9WDX`qgiSWRT zwXP3#FuCH>8r+PW=To0#Ca+Zn(+X+31mC})Axy@I<+Jx8f)SF@LM1&8k9N2C&=*x~ zRI+RvxLY=6u`SL4l>7^sx^QKG&7QV_g8Tx>UHNKonjM#0^ZAkcNZo7j{;7)lH004= z+ZvHpT;C(+y+IWDvo+K$X~DBO1xC{?vZtXVCe0dgZ#C{xb_jHDD^4}hj0_T*2;b6q zAo;Om#JjH;G@eE~ug+_wTc89kM_w}vq)(Ch&C5>bYUy=j>{w}ktZwKj`Q{AB zZ@JutF&c4M6Qj;OirS1Rnu90#*Y@!7mv?J4mZ&zTpA-a#suoT;v9L0^6LUuZx_qJ= z)3B&G0;@m^v;cB^%!UG*pbXiVI@)9Y=AlEq{jY~*<#+@KF3zs?%VAP{BaRn)bHfHSGfg6xQ@7?Gz1w&SUwx!rZ#wrw* z)<&NxmV{Ikq6ArT4vks!BnqI8bsHa;oRWkr*U*V6ll~t8J@16Q6U_0U8}|{~$gGqY zV>&wL^{=+6-Pk#GfBNd#jC{Y-#E52&qX&_>l(eq8(ZJ&D_Ae#}Sj}dX?>$I z7g-)3bG=D_b(gSnZGs;)eDCda8TI{ykVUntG7Hg`sDB`6{H594|F{62HvJcf zmJ5}WpX>JTuL_ukgB+X!2b0S+x}xq!;ys@FPvR%pRnpKz?}}?8Nug@J_zh~~6Za{% z6(rbjK*wJeDib3KyIYq;?G2W+Lh3)rvISO6TDd8PqAaK{-KeK zdJixQaz*zca}}8`vP_igGvD+uYf);-29u}7>k+KxWRz*@e(`YQk*2pB{XTGyAP1TK z7l_@NLsk0FdEb# zX_qRuga?#3?w}kc<@KgK9?Em@_9q`U_ryrJdUotXVC<%YhHxHvcitG#S5-D`TB;VP z%AG)A($iXe;?rFwk~m9mS0!Um*$8?iN{}*o>q-(F2phKg;WLCyRZ|r0%yj2C-|{w1 z>eRE$&_OSq&6iP5HZ}3|IKw7R{?lt7@-)DH_3eJJJA6x}qv%q6?O=&ra;_I@bv&(L1FkA%RwK+c?xOwJLjSF| zdK>5Uii=7Aj_O|;$4LkDRh#i4Np*f_AzATSaNi$)Y#M_>^&-}lTT42gpYU)taH$TS zxhW5KY(uH?bYs@0794!!58$

}4^^MR0?k!XF}B4`-&i8^u*~Q2Ca^&l#oa6<&en zG`rr}7J#aB7shC+0 z!XeUn0n;RW*F)ate7y)E9Cf3*_qpQ?2|E7fxb!l?it~A!Rf*Lk!Q`IARAK#n<$>OU zR`Z+@{*9co<)FB-;M@$Q{wTK)zvSQII(#j;UidTDM@K|hJ)rxO#ZgZENNscT!Ik9nMC42J$B#K#GC?f z)3|Iw&c|Cd=T3i_#)r_BvjcoLEXl2Y+$9(Z;auD|+6d@8!Y?K0W0uHk)*%-W`2~H6 z<3PW^^wwZ@#ykU8#>ANkpDTBKZvroF89WZ@t2eVR6$RQr|BlYW*3aj(_${W@HfTd? zH4Xy@cH>euR=1l-b;r&0%{tOR^SQ5YYCv6IKee1)^;^tV0`JfDt=Q*aXK~r)<RY*WMaWM%xu_%}AF^!Z=Y*fr5coyB7JYaQFXl7oI)FJRnTeRZ2-pTt1cZQSzy zH!O5ULyW06M4G5KbgoXXoT^g7)umUe^`1|T$iW}6v(pSW9Dbr78sEzHw$UNq6slW3 zB2TMo`AGgUAy9#M+u;hieP&+X9kwvpwYrom1);3IA$YQ)|&O+*=+vGY5Ejkd-{l z^SZp=aPcjxkE2{+Kc7H@I30SE_h}Yr>8VN>JL9Brjr%c*^Y>GBeQpPxqk-WI@6|Ti zIafmq0jI%y-z<#~^!Yvg!PY75I#Gs_MJ1!Y83(?Pi_WV&@n4B&HN*#sV^F}tAk^5C zy%GoDvS^LMT)zMN|KzCn&u{Oke*bZoa6}zD{-n`)_3jtlp6b!5GOJXh8s@Zh&x@b} z0{k`wXD6>iEUo2)d@A6dGhk-dE96fUWY&bS&4=<7P1}}Vk@C*kiwzFH)ezOY-3`OH zEy}OFa@N5*+7KMteTWF3fL1qu5qMk}OoO}zl#Rn?Dk;|*`P1tS*- zj1_NHC5U$n<+g>ZIzziR6)Y~rX8yJNq=>2iFWsCz6`bvo%u_A#ChZ|T5 zEo`UXYm4HbN<;`y0AbZlmY&~ZG{!?{t zTlYO}o`b8_ND2pH_jA?2HcB-C6qFy>S&V-da=EXvwmmMElq=24IkOnsnb?g|w!c7; z9h3}OnkK2b>P-urQ+dj$DLK<@{jG3H(*P#t*q$N1HJ`c2d_c>)x5lg%y8g1y)y>yo z4L6yhq7lFc0=g~04tpIW1+bOQ*w(9F91eO@BepHzE;yR43GATf4Ys-ZSQX%&qw|=e zH+{3gwEAfOC#JyH)w~CY5>5h9!lg=1XS_7@_L_S}r9 zG+S`Hh_(9P#E>-q!H}%}A26iAI&yy$REU|czN{JQ09;ql0EVRBOM(#ngMBY9Ofo{! z7MRp=XFH`#xD(JkYPr}UMaP!OgV$e$NA%*4G%F4~F*0RoYXQ35_~{w!n^yT4tj_1s zFRj4BS-hIrkm)>S*PfdP-#CXU`_=5yYV%(AgZahDq>=eAhf22z6C}UOGwq5Pt!K+{ zjLvT2V2aG@YBQXE_o4d%rUVpF1vyzLwERUv-Tm zJRnWbR(TFs`<~hcH|b4n1eAg7pN%X)g99T2D&KIhg4KMSHiBbqBR1*$cApRzTSZy{a3x_GG71Pyy#f>e0eZMvKARXJ|Md5(*TYd>`0 z3Ip{g^Jwar7ph!HF}vUDGYmw1{xZB&lqFsZ>L|fRev-V|Qh`+n6jyXisTDE>HsTQ| zCaxg@f9y*Mia(1~A0p}}Qx&i|e2`9Gh;|Na)Kwq#+)>{z58jiFj+DF()1XGh*_ zwCAc-fnSBh^g@6ph=v9iAG(ry`Q6A7WnO2>R1I>bT$kG)K8FV`S>ge;xF*%Sfq?{S64Au7UfDHuSLde+~kp_(Z^*K@Jqx=z7jl2M$G5Hxai zfRViFa)CJ`9}wdM6dUz^)>8JP73PfWC4ykOYEnNVFYL2)<6(@~-+GQ{_pO+ULq_#? z^4nS-`;}V+bW}F1Z0fZQp0JUwy`#3rz`(IXfA|JGewd2>+S^l5zi18VuA8evt8jnt zaK?k^a^>S$z(!SoUiv8c{n_ynfCV3yOx!cOSR)R%n(8g-y?Gi8ucqAzN#z;q)~ir z=7*pLal3nqpQ*;@5FrjFyY%i5IDn!!yMAfZ|F~2>78gG@QtA+SD7$BDgirSq__=w% zymJ=&`Aly~VdN+XE;5iYmjoXEtj2jEdBeDrvO`Yk_=tH_Htr5Wytmggx-3H{?{n8S zonTicZE~mC%8&9V{*_BR)46L2=d1AwfAe zq}A^@ZQT;wl5nW*r4gGj_&pla2?>f$N2sh-{P<)eF6y9(HDne`S81 zjW0B_`W06)%vD5+yzr$eiwk-K5`N=2E%nZGB42#|KiIJa`}J5qcSh; z9ugRZR+G6Ieodqib!+REmkkHUbnM0_dlkpNkb_bG>LzJzUiT2$I$Uy*Lyxl5Jb^rD1ymF2XNM7OBh*Ug$AVOUvou7_-n&uj800e*b~bJ?<_r zfZ`9&9JBpL*_bZF1u&(UwxW6@-}x8(BYQ7O9-bJGKz3f3MH-jiErQW*s)bwhjm-%m zur`SsL0!S{OH>U6t5GF(z$n%RCyg2;-d`fS`T7x z4mxAR1@9_-Mjk(6SIO$cYpjmizy~X!9hbv2mT;5DHk}FNo2oXMh?vcrLCMU!W_=&b z;C2GA^}{B52KB3?gN&Na((+={u+lQk20y79GN`XYp|?GGbSts4Asja^UEv=!VC~XY z57?6ZD}ixD>#Z5$-_)o~;Xl-9>qg^1-mvl|jx4?3#hU4{r!Q%HmqK8Jg5xVdxs6dx zh0*7uN55i9Eie9mhAFwewl+yU#qdR&hs-#;o^8XHm;n7cSo1b8jZ{h7#Z z^5%fnZe`O;c@~rN$e_%s@A2S?9&g^-Up)nXX6%WzUwRE14LrqMx@8?q(uWZU67t=P{9Qi zBkmUe)rE-hq{$jjfaOg;G|ttajq_t1&sdK|T&frM-Vcq;%&qfz3b8qfy$R5FvEZfe zRmBI51i`ixzy~JpO1CEbl=rTc46Ut<8y8}CHiS_N%!2O|Zc^MWjbNQ*iMoEO@0 zHT^ar*`M5w^mYOL4YWe+GncVk-3*rwcm_8XX%-^=hwcDjIZ$lb#uk7_QX5v>C{Ep6 z+>nd1D?>@W?=CqCJbq0-DYXC$OIlN#NPTlnh3$@4)>9Rg>N;&H56CC3$bjD!O?8`P zmo{F?^~{@Yl3~{k4k>D8%on^VUz{(}Lzwx=`h~A^g>H(@`&bpjQ3{qnt-ZJcrVg?WYotW@Qc%`QSW^!yr%B? z(CgTKsIdi8Fx{XI69RTkW<5|kKR$V#u}u*N9cbBI4P^-MPsI}xhlT=NA+o@p?Zto5 zoNJ2Ae19YuE*ar&Y68>6e6#x7@pK%{r_a3Qd}sitob&}bU!aWt0m5h!15+#dqyAb> z$_~EJrb)lHb0GzT5YliSn2&+v;kBe#@MOzTo7`0*#9_$4eI9VnQ_nh;(|audxjac$l&ih>Aw zJ*x|G1GLtoxIGIvS(6U3&~qUidz!$atnGHFP#_|(X%`Bl3BV?!%yII|Q=JDylEBdi z-#s~a^^rpvhp2pZzoppu*5vLNPD6~<-Hw#a)iNSi{}7QXFCDA3>8s6zGMpzE`wdlC zGt}a!PLNMP1qYA%*u9^kkafW&dDL`uH-bC{e)vZ4IWm!U{xtW(u@@d3+s!vEeSL} znLVw)c6QZK%-r6>6~a&JsdTkIoBf@*-43fY1k>1?sxMYIesf2MSwEEAT`H1%i4qRH zmFy7w6~n0OB|Nu>{z^VAG4i{9vN#iZAtUp{%SR$x@GsS^!bpOO;Ob_9 zLTVyaIVd#Nxck%km&iQRI}{HK=stP|UCds<=bDAb8F6=Lw&fxVCBMg=Cg%-hM61rS zZEi%M@+VLkj*N{;&0m!q?!hZMdfU~E&Ha{wGgF!001`Yko(T4PN*=IOXa{&9?0_nm z1SC}6Fqv9avi*!iN#~B(p#otdZ;@~XTIb5{&F_Tk+D~KPpsvmhH8?C&Ku3=oiw~#; zZWBL{{Z8Tvl}my6-5jp-)jRLkaN-cB6&(_hSNLy7hH`?`KRTt0T$npj`|(!Zvt&+N6){%*9nW(Iqw7_`!%N;N zwNLw&OZoRzP8gWzRZU)SFwjKNwh|-0`Z@PC1YT*&d3% z{_ve@omR@Oj)i*r7{9vcT#`&mwI=ALl7(@XJWu{}9P2dqq6hL zLb>#lSVliju;#zX*`FbveQDP$A{2H3+rT9z6N)2(b-cUun+MGwLDv>F7<@Q^KFm`V zN36gmcBYZ#yFBzw@HPrpqq7uSDW^P))8$6u-CPpp@J z0V|8FsJco7d+GU-=Rsejs(W3rY*gXP2iwHXlh5f6K)7p_d@daCWgHCIBtK?1zV$f-DtXXnj+ z>!{0RSM}WxyK&bGtz)&(9?Bsf6;gYe8IFqdy=x78CSrNMYA9enn^{tQ>o>STX!3}T z3L>_YUSJ`kvf;Tg5@61-T#cJl5nU2AF!Gs`_mx~cPh%xh>ks`N4Q+Ex6XE!hh1FPr z4pBKXwecHMnuEo+>$AHevbuB|=Z*brN*=lOl(+mMp5f=JGVrl)Do%1o-Hl-TPR<^V zaBUoxAFafVeVdLm>4Op4KK(_B-Zxo>)pq3>P3S5j`z1{b6IK@6H)5)gmDP>@%}CKO zei>#Xp|Y;TXC7wMN!)DE8Nb@*`1l`fHayHrlX6D_9&k|F**(YF(h5W943&DQNs#G2 zo@~$IMPpMWrr3Iny2GxHw?vp#gB^M8%gs1onMZ_Pmv!oR_sUzc$aq4e+%EO}?z(_rXcJ7NSmZfMeW)tVB#6-Ca>n^n%Jj4jJD0e7rHdb@U-s8E3#r6Q9E z;v#KA8@nD6v^W;ayLi1+f;!o?kK_BfIT6$X(%B96lFWxgGBCoj+)Lq|N&(q!S!di^j0V}Gp1^xixh zqH)`N3-?e&wTcb8srPuLoLjwIn9ICiu4LtK)8|fw3)`#%y#eD|fdchH&3i{q6RA7$ zX5O>ajjrkIH``c^B)wXcQ`i-26wx)^jRmIHq-rB&lU039JDzKs#4{`~ies45qlhSx zN@wIKtL=HsZd3Cw3QO`MkSa!X^Lf|cLY3u`3*POZEU8(z*{$=DQN&3%HGbSGibP4l zZN!+Rd9O!M^Igsdvbq|No%hj1=eeZ+Ms_LQa1{00&iHs6B;$RBxaJ~{2I~n@iX<@B zy|vt*hq%QTJ4(91TE{wnLf>Y6t;GfGAX5vsotx zU;X6SY(}t&uS)S%h(TR-rX(-U7HK)#8FX{CYh%J>Pxrdlm|Cno%H2)sW*1NAeX$cM zOAA#d@(yHlE|;|FHb!o5>qqm6Co*e{rXkj&B-qDMQWP3S(&Mh%68N_|cIcTz6x1nx zq{K(mty(9GtB(WGSU2U$^N?=6`Ig*Vu8fC^45}5jJk~PW%0W>Ib4ymMr_4gUsE#6V z4X#7k1=25WFhr+Ons3o@8UDp(H@)2AR7&f4J@Kj9&ozdL2LO*t2H{6 zwP;5plVZj?ilcQPNfewF;f)W0R3M zyIUFqv3$_lleW07CZ>ml4oF%_q#4&9>QegYbW#^(ojF~tshBc;cCkhHw8t!m3jG;P zcP=I+s<0omH+F0)IKG+pmVzNRypLQZq^^HKsbq&J&2yDNsp;gSj&OgEK6fT8j_9n% z;+(|`$e%f0@yvfLc4LZFlqWeD&dr(Wgj*;Wv%BX!B z))dB!HBzC1!ip-bGNN^J5}oBv@jjjt0-xof!e2mS{5P@J7-1Jg4K@DA2x&}tO;|Eq zE*x^naJI!KS_SX>m?&M_d>*<-XSRO*DD|@Aht$FFR=LRmno>q%F8NH!iQ6Q1@!fTZ zS$7t4U#x>teM3mg_yAZkrD z?F7$FUG2Q;dp3(X<9iqZQAlDtyG_l`J8`2O>)wm^vQw*#G3=%F78HJBjeUCj4&`aU zj1)8Fj3>=EiZ6*Z#+@mp6O47o8xr<8??6PJhoW+d&>~qCfAM_O^(Cj2P^AZYs6rYe zd+=3dzP?)1dN~b7wJn)-cQJ z7$Ng?n!ccj6;7I3j)Axd%Jrff=&Zl)brINA=HvsV8M?Ni9l@zo!PQW!*-tZ#?Fa?z zXj=A_tz@~@sMT&EmcNz3=^S)KAlwwniTjo^tE zm)_V#OUu{L0u%HX#`2;c65nsSQZDT)-t*IS$nKnYo}KH;9>k`tM{pmg%v*hicx~0$ z@Zx2(mO|`G&q|cz@)2mJDi)GmDy4myhraXd&^p&hdD6V~9}vuYxOQ#R%aQl}SnIjG z-p2)JwL?nr!H@G4-%;ZEg;Q~1i8!s9A;bVXaklPVaGbX@EjpHXO<|SK{-*N+qjUIN z%kTk)rINQRyvXyGZ*142EGwGz%>N?oO{1DTySD$fR=pj7TI;~vRx5RYsLVr1trdz0 zD9B8R7?Bxd2tz`MXoV_})S@6$K$!^ynZuBvMTi(72qa;S5FnBeLVyGaA^Bgl@AIs8 zz0bYY{Ve`puP>~1ab=(TJdWQ!HuH--Q2`f;jO%_%?*9V=hm|s z=IB&TyA$TQW$nz2n*#6D#Zn6j+U&G05(@|Lai#K&hm5$MQE<}s+!pPBStKM{qBNfV z((|ars0xs%slUlVtrkr~oROToC&j~kRVUcMi4^KqZABwYI-VdJ972=$@7E(N>M?IG zdKKcqTH=`(@~MdV07al4LX*iwMs>|#{(8(=S{z_lE?)_eeI3()aH+Iok1$ctWQN#g z{BCtI5^EN?s?hBv(?Y^m7>c{sla38OoG2-ERd$53i}Lp?px_(@qae4q{kiSYLKj=G?jKpR5%eu% zi`R3ZJ>Rtd%8%;ExDaKAGv7!L?CIsOhP=8&mL`Uw9sbor@a07kXExm@8)Ug0g%{j! zTJbiXkEL8l6@hBBy zw}99?rxz3NV?h~&buZv<2pl2t0~&+K7)RtQQQz7*!$y!eHEEHIZ@4f}K64!9Xn2-4 zr!6q2zgw4}E3H#X3=U!IHM=f&Hk@NURt->rmVWdeVD*h@Ye{@OfsGF6Sa@X1s z1PdnKV`+Ic@PbrJzAzyFa-`C+LTxzte%Z}ST{HUDojxed6r1dR*>qXhOw!UvU zK~Eq=vXdtDrfuiv1S+4dvw?e$Zt&|l+fCv|C4a{U%<+$7wexFbudVsJ6R1Fb%F{FV z!S=`T^lwAe^H0{D;N*upb{X66wzNk%mWtar$(YYOn_Gfqbv(!;(OyABC8jz+)*yK( z*0y!-8pEiHA01J%U218E5EW0&l(yZ3tnEZ%POeoYScD0T$2T0pYSbqpzt4tf(o#Gw zI2H0Ev31G%SIXubslHBLlFK%dG0(fDqDCh?d zLwhXSb6$FQJhKx&kwN>uY_Y(5B0I(Ra?bIpV?>|i9A4^D*rvCG&LHKyh0JeBU0FS& zd5sFnW?;WhsKf+^X<=2&iV682$R~>u20&a=hnf8UA<=l5&hQ9Bs z4JFeQ=KEp`Ra93Y7BtR2M$Ke;F9ZE^(S9=%jt%rKRTIdUaeal*70tB*C5=oFgX&>)+Y(B2xOjWkaB zEv75Xt{h#EBP3q*uSaiGc862;0TF5Bs_mdYLOmXS)0BWsN#o4;+nBYRKPz^aWtz0kAl&_Xfx7*rWT>dPi~ zF7Ctc1h;=yTCdd}(D671dg*zf=&fguwDewn>@%mC?MB8NyR-4dCi%IWpqwF%bJWgS zUf<)3`>i6=iFJVvyH%|u1~0_59z=}rNb|h|TY7RqbwrF0U1?)t)=V>*NbRv2`3ZCs zCimtLDBcs_=1NK=Fj{ih1{+bXV{t}l!NCNG4)w!UNX%4Gb2*Ybg4|6`T|!&B8TnAmT88rErXM z-|yV6cO5JHf{Z-697v}8=(Phizia_$6RqbW_!sk}r{Rg&_fX^g-)iaRnH7$>=%h6? zw;Ar((kJxF7?vP`FWD!UF!{H%{HIburhkVH#s^s1x)!=rc--`!fLshtbA?QBl-c@OPN2{8PD=TXl6FvH<~yvOGrVjKDiY! zjnqJa*3|6(B}*kQ9BSr-FdqFK&@S~X0MmLYIC;1D4yw0g zUGFES1P82{fF{OzUR+x8bQH&}P&#rCE9+oib0wYY2?7gw!`*w|B<;WHl#Gv&*+IYG z?&$@5#%Re|yfgwnrX+~#`o>kAA9=rZ^OnbW6yP(R2^{I20oGNd)gS7F+C3XFGf22~ zj6~JUY@syZ16rHhNBw?7G_ZYcy%8wBGVigmMzSUogFnMUcSF@y$Y&&GJ?Ul*ZEcF5 z(E_y@#Gg)JK$iGeqpbQ6)8ALoEVIxYmF^pLQD4~+u_Y9z820udJSVzVW@!bCB!*YM z^-R=p qWM#B~EQV$0IJcJv*KKKKlwM=`iwlcj>e1wOJnfBt#)M73?IA>wL&{CIW zk=C`Ry8e7|zL$_R=;c+$DeT&T$WF)Bt-!&0HzBXQ4jEJFf!^N6vC|TLZS6=$?G5_c zJq$`y)Dx>Nw^#r%Pp7%aiL-qhTSlK)=uWq&P<-1TVsfW4WSgfL=%1EX?df~FM>#G7 z97CarAyZD!quUUc9XVvber}RDurliYOntoDpJWzm7Ls$eAue@Q#n5kdu}CxkE;HrD z`pd4mB8;MwgnbwZ2`6>I@vj`r4-L5G(MPFnLB1|4Wnz8FhOV7AjNBb~NQ(t-sR&Rr zmVQh|=hx#lzSZ*=qZtF9O}=8;3X{=YPCRB+Z6cvgpun3$fg`@{M5_4k&bW936Qx$m zs983_W70^>&%eQ6h$?$-ohwx^))-5U5af=ROGmh_#n`p&89zh zoU6DGsTkN_m6xeR-CZ?J3A%Rp>s3c;e{E!%pN27x9>f9$d(x48W!Ze*#X;YIoCKgS%>W!e&%gvs!9CZd3ro@4rK(W)7;#W*#@P_|C&wADO!b{(cp=!l6`)vc@v4Y-TDo~0KW>G6ML z6BYqD zZ(78M8BD%#E`Skw2L}&OB?mAD&;`_+B05Jc^@g54^e6%VvmOC<4>2l8#0k$Mj?j`tMj=u$Pt|BdcPRrU`%o5&3b` zazL`Ms8$vPe=?}bAO2=yr-{4_N{ACUK+B1z^`SmT&vuG#|@UEli}-sR#nU_5n%MNzq+a5ze1 zEI}B)u^JDG1>8v!y=p-1IB?3>=u4P1ZRU)$Yd_&! zI%Wg0Rso3&1(P;V2Zi50qqY8*nYc5X@Hap>RuuRvf)Z<4>i;qy9*X%Cvx*4~XAWiM z%mm03KmKvdDPEO1Ww!i4o<2U2Woit#+}SGcsh5;AH$D%UOAB#cA9UWy6jBJ?t(OU{ zTQ!_qaT2)K^;=Z*xBdYnO5CgYU~Oo8#9!;Fd)kCxS*el=_;;p4(4cuS+^{Ez zD@2M8#BB-kb zL(s17!5H}jUc|L3<3RFi-v$fG^pR&^yi#81d|Qy=ON<0lLFLr8c=e3S1sg?8OXlua zYhqxF3nNC6FTZGQ11Ymyv3QuxlwD}Z|e>||hB)#mrBXSi+JhQ{fG|8Y3t)Dj8w zUs(YE_OoAm`iceWgBafxDoqBpJ^SQM5AGd&a~K9YTfK)W&hyt5igK7Ijzn4oCH%v0cl4q0+mU{)K=$t0Y8EMqG*Y;HhM)Yq8KS>dMxlf%v^6oxV6++f?GI!t8d3?1msmmL2pbJK6<5+whZa9qHas^^P;S88zW&KQ8PK4#)X9-9G%nxyHpV zTU=PQkIduE{TVKV9!rotzm!&Euxs#XUfS~*bfu2tnSh&NT~#PBsIR`O!s$Wb*t*fj3eXoEjtJ76SgOE0!aDVzB%~)mhba7&S+BsIl1*Q z_-m-3YQ$S)Vhd?8T`tOO_xMDjoQ9gR49G;4YxLW*mVsBUC@m0mMlU%iZ9I;!XIVcT z+d_|?2Mq|tD~*39mUo=3m9ja3{I2l2s%wDYGH*TI_q*t|o5^%`$MvckO&q`R3?{m=4+o5A>2QhXM;A)b+SW zl0Y^24xmwaL8v%7k18UzV{v{<$8cBJ^ZZ2OgJ(_`22p76s{fJm0Q zOGNL!8ORb9PMBz}9o?|mM9##k5#ZGzAZd!o9)y)ulV3+p{lP$|@%KFIZ`UixzoO7N z`Z%G|AD28NOi|jVC1U*rX7DPy)ndhwu*XsNj|QI)N0%}m)x|m5)-KnsKs#DSu8jYF z5<03ICSOggMy%Ys?V}iu0~9y%tj;D&w@wzviWq^ z;PKNhY?z{=NVGfsmfOkFvk_zPQLz~{vr#doS$H|ymB4wv9JSG?fWjS^#^p*Ire+zu ze{IAQZZ@rr!#5;rwHEgbzE+JG6BQ?Ls=1tjcQ5%SbEWqt7^l1Rj{tWMEwStAYWJaH zW$*$Z2*YCc>*&Smoz1W79Ta161G)7PP-l~jcM*oKS!EnW(a(Kx#a-7cY{*$!F+dy@ z>04^gv5qTO<7ekAhjuxx8eo%e6MISo#kUU??ys(Fvd#(eu7Dk(pO(Z1jumb5xC;X? z7a@qCU1#=9m~`wjigA6l=w=ZLY&|f07zfH&{emin`WreilUkW42X?2`!6e?+-xwK^ zTJdKLx-<#SPJT~_M=eKXjE^LMbr_gyY-7{bJr@~0b%v4my| zhoId#3McTU8*%QU=J#fhX9`7v4`pu@_~NFQmtR+n5ls>q9?#FqFzC@vGn+d`HZXr?z4_#U${6_K~aiiS3^(7Gr_sYn-8v zPs7J5v(~?ptW_Ly+V7Wisi#}VObZF{_|*nV>uzz+Kvdz1{L;F4e&zX4;mTCumC!h2 zV5QIM54L9Q5M1u<{j#KgduHAJ4^KgRWZg;D;-7eC@s6bI?-_gD_q7N7U_Le;HWxqz zF3Mwts?iTyeVlrpHiKn!ajZoS9f8j_`~gbULbbU#_l_;nbknB48&6c*5s2)y`p`;L z63#%>U5|D44dn!Q3Pvjc`5}7xRC{2E<=E5Z`wFriD}C52)C3r0BX$THiJX4PR4sE6 z0d64M6H85hx9ZZuREFha8A0@I7rCIkVtzprh(yRT&lF~NJnnjE z#tc_8+bXtGw%~IMNsA-ix*ez%vvQ$jg1^F_&C(eSl2ueoMioN|znb^H-}TWAeU+8| zS*SSv)z`b<-lw?bu>gRrp}dc`+Kd;x*5JAEQ+^}sX2PB)>*&4+RPIGa>rh*!rAxvP zc$^(|QGC1Xo##Aq{!_~2#uBY*6EgsiZVO4^&C8n)q?UdC1RY|5*j%qp{P9ho z1>2di`t)0kOsVO{FH~zKOZ&)v3*8f7K+q6|p`?y?*(&X?4vh-lln!Lkjm0&JTbZrK z$ym1q#Ab>7=H^=dgNOIy;+ZK9Rgqo}zbJ+;rf(K3Rh>S+CM?~xU4wK_C9GgIT5P~W zmNULAp8*PPIb=!tb2zsb`)&n-8B4Ymv(OaVxXfh;ud)?mP{Pn#Eh(HM<1J2)TCje@eG|EA{+wsIhq2XOUSr^sih49Xt9+*k@WtdG{Oaz2vi*XW?djWOEOZn3 z`&M|rj;ZM!0&PB3C4d_|z_5S>v*t(|utY?K2YSYec@A&RrbmwY^;~Mvf0LHi$e`2)Z%V>Q?YA?#F~FTBN`ss5tV#r&wa&7f`YVBerc zKK;AM(|oYrX)pkRf{gjA>z~J>cp)9uF>yw6B8G!EwBC91I~X#pl5Gol`mT zX|3$q4bl9{fm;>j&G; z%PQgR+Bdk(smM-0@y6GLCq5XA7bcK6xodk2(Xl=Nt;p#1ce&o`XYfW9#DnRy#D$nqKG4SRyMguVlTsxe0iClqnBy4Z%x z(F7`@Ug7qHMj6ykZG4@9Ui*r>CprwC`RK7MGySVhWe)Z0n6icOE9&yd_2+oEB40#G zJ-MgGkmc{LI9em=YUq0Ou0a09$Xj;-#AVu&>Z(?nV{jrfj#?G{%}y{&DCqGW4OM2I zgl-NFw^SZV+c2xtfAbn}_pUF$-CX77X@x$6Ue)IPTxmoBeC%9F4p? zF6c;b$k|>Gb&1aYS}g_1v^i!>1`{_NW9k1T{V@69^an#I7y`tmBd~Wyzy|k%(j~QKNJHB^5s!RNHNWE;nE6k#w|K?=uH`ODil($;< zP2~k~{RRu9sF`#-4u4P08U50U37mi|Ix+-^X;Se!On&J(c2pxVCQz%PbRvIjcytqT zMA(4;{p2S9UhtYu!|ClUngEu7SxbW?WM78+uq+H(h&^T8n3+O&~>dP0_2)BFAKZ06Z};s+IGQ+V-w zHsU%jWb{{#6c~IE-FjyD%jfD?laSW~HEr(!$@G|QsV5xAuFqg6owmCIuo~QZMt)*h zM{kNj=}O0h_->sg&aclnZLWGGlcRWH&r+z3n_QYL3|E&IfV4;h>dU&(0(2??64Vo$ zaQesExZCJzSs03-TDV;m6|=NK)805e{z@zDc}=gQ?C`3VE=>rJWk~~uQ)YuJ_hX(j8f6!@MpN=qV?NJLBLFaA8WJfz z%vz(Ov@ELr7Wo|=2G@rcClF;14f2}83^~0bZ~CEDykFj!rEG9dV48rxHL6xA*cw$s zk>XcJB?^)<0qxm3rkC(5W1@LR&wVUvISkIEBF(yEg&I`V$M%%vN4uv;_H!*a?_kNY zqCCObDzDCVrt@uQPmZe>Js^d4W8GPcN~`^s7DtQT{p&e~=N^_>HFw=Kj}7NPnSkV3 zIx}a3(m=|yqI3XsUIbEfKaY;RszS|@1}Ik}*j$p~aS+)s;pfqV-Ky;%?YKE8kp+r4 zlrPUuQOn=ExK>qgFX9kyt>|F>nKvS$>2@PFtUlt}zxD2U!V6D5(amd%FSgwg8(bO9 zqz9(NrG~a(M-B$wW}XiUBT*d2m*Ezfejx7Ks^`ILfDCO_7&ZMiX~Z_4?>R7NlST-R zEsHoE$ZnnBsfwNVmX0!Z4<4xkwYMt3-hhv&`{($}w-MNlX-m;ns&{4oCUBdUFg2bVuec@;jgVr*keE$U>Qx3&kOH(_nbq!vuO0sNwrc{)V(@O9rOyHaH zTMgIzsV2;=`I9H1xJ(XjvHUZY)c5E9P(4f*nJ)qXGQ4|BY;J(>sp;e)V8lf?Jkmn$ z_kDjh%{q;27^YP+xmGMi*L=6V;w=01BTns)u*_udK=h28UD=k}AvJEbM0wlRraN*( zs7FB-y9QTs(*FG5tyXcEMNeA~%7%mSeOWC@5|z54sB*uFSq)pTL_6ISI9tkfcu_k@ z8WvN1s%&CUSnUA5gVft^SaLcSkIyyG(#^(Ohh|T$Kvd~7KI<&(l zS(Ck=MRG;u!09e2X!3=n>JuN`lMkq8uRy`#q}ZHImgmNGho^|x&n6~DD21eAWvaUa z-0?eX;TpHS+AXLMC`tP8Vw4+&$v1NV8fzhUT6CaVg;)yx)dXlP(k)FYI}hT<0O>6{ z(hNw=wFFXg6X35P{rfc5 z_HpygiipzN2AzVKYQHxP@(kj@{$Zf~AQ7Djcoq4vnqH0AY_3W5<`4Qxp*8uqrnEWx zI~9JZty<=H+We0P-PiJ-0{EG9Y=`Fk`)^f%!Asrtym;|@b1*H}aM!Fa62qC0kf7HtV8ZVYc-D!O0A}sy0V)yytglQHI_NI9*DiT)A)zmgn|BGReoAz|ld?hdn z224ky38u~gkzs+FJTm|eajZr$)xcw6h&QjM*$6jn{=-4r>@rgh$p&y&noA<5BgUu9 z(pdArrncl`)ZK_3nA^*6e%*%Pk>b;H{vPWkgDEZc{{=aR;lG0KMptrZOK+WrmDSQs z+1ZI+K(bDWC&`Y#|M9X>mDX|8%Eer9Koil88*6j$HGGT{{SD@712hFeCa^KdI>01~ zUoobQ9rukk4&%B^L(e{D$YLy=Uv-vV9-2Bi=n&q0dQfDY)@iCJ!X2aFXd&4QvS>jpoZ*k8N8$FE0|$HbElST?|jjjo}^GiaWr=^ zvIA-8;jNVEoH)=%r0$!!!0MBK2(|*F0MVH|e1=V#f#f_bbsOi<#e*Lt?Lo+m8K!0W za|!yP^)Q)f$27HMgcD19)@$b8uK87SzFA$cIcyEvgwgFzuGB|4%HMl-g5_=w)#$T7 zMyYgY^9elPS1cEL;F<@XHZ`l@z2IQ@oxE_CG0Ta2E6*MF#=cMkdUwD?D=?>~SB&%@ zvCLq{y-mT!F%8o9G+bttCxCSN~?38@aJfb89vYt8Zomr0}d( zPXCby&!|7X%6epNU%Gx$k0U-)GGi9$P*~iuHFxJN2pl(Bc#K3D#8vfy!U3YW9r;z_ ze~?T6eM1d70K^fvPN*Fp4_hyyD}7|_l^%;lKP#?V=OjS8B84kOk_iZMw+jw(Ple-!|tVuhyya>68 zgXxskwZ86rNsIYBFatxRa&lVmuiqdfuY99Gx6;V*8#`KfP`)`9umgi*HyzvgmVA%9 z6Suh;zFPvH2L%6!bM(FFa>i>dov-PBUp1xCpSY)s=q4vQ>ZLohOMwJ=sgZsWbWN)?wPRkzE7En2fzHg#Hl@aw@_ z|6m&LI0V}Z1S4&d*h|GNi4b+?LRDtC6nD6{S-GLN#Cis6YnQq1WLMeZVXcW8`xc3? zZZK?uLFn!ErslR)fa1puE+X^c;2MO@L6kl=XAqHVz>30p5k0+1McLqg?7^sjk1@?P zu6`1#+9=5gN|O#>3jH zL)n<2I>VOM;A=c>s5_3zBc(|lNxt@@8ck+?sSu`cre+~vBRT4+drp-5X|+|vkVV^= z2!)uMcHg;4U$Z!Du$Qz}lzfym*vk#lKt;fUW*zaVV9qsa=7R7s$2O>XeOhtm)z>ThY0=~krS8I!ipS@Nxj)dqbKteYSvdLn}x20vvce zsKZnM46c8;>uadq;X9pUsg6Cazt)W@p|354DA@H? z#WNyVy$y>Vc%MvG6i^tbT$q;IP`H%E`{Etl`;Yv(|BN~x+oWFOAdP|xVf7_FR8y+L z;)+H5`#OMjma=vZFFFJs+1_i7bpSf$vUULX?tA=#%Wr)bxTh-d61*(?#8$67u;h*j zy5Tw+kn^m6oVWaEq2!k%v$;4m+wsEe)+jzQ!b1H9{9{4T4%E8hF1#YNqC$W@0Qn=6 zC%~Dl_s;T9CP@F3JK|`{@Pmgrs%G&x?VNPLTkM)Jisq_-8@`v8;ly4^V8IvXDJ9^x z0P;!JsEJ0ERivxVzz1!p9tU0K!Di z`Y2!2@ryPfnEFnNJ_Eq5B^Puqi~pf2b6@Q~Di9((Syls89So8e@ll1BHt$v$cW8Tm z*8b7GZ+YLH%Y0FekwzTL`J0NvxHd*5<{PipZR-7hx4rI!{C-!&kI|*K_lJu9n{_Vj zU6)P0wEh__`G<6#!`N_sL3FLEXjmsoQ)7=v#$JZ)Ck}*vLXKSolW)XV#HUqDN5Xc5 zkK{<>2A3vBVd8mZ**)|iEmp7fFRobuh8FSS&aOUc(kijz**vVLdv5V6jy02= zY-Z0%-`JpEbC}1+S0lter#xxIvzx#~yJ!ix5=+nlqy8N_>{3y~zpAn|n(@(%YLp{a z#r48Z(cV*JJXXKKKCN(obNjmKQsDT{VPTBmb=QGdU)crPVrEFVl~$xHE2v|pB<@X# z@2D1gpo)*8M8pIfBPD!F<@aY*v=7f_0ZWR_=KflSEOp=G8EFg;_g#C{N!#iFPS}0T zeEC_-)-?9X>u9Z>gWm(d?%#~F4oU*wuxUTMxFbJGm#|F}8?arQDM!8SO2uTK2K(qr z;@d5aBGlgjQbP}KXo$X_a6A`|qQj#G{$Em#5LVAmNeupyUUaH})6Yd}^~a(%G`Rm4 z=bQ(#t3TGX%NX#o3_e*e8E^i@IaAD*oiNuWrLli1KkkYNrH>Bf(r$$!;_oJdl=DR-2M#T5kwlGF1P>JWJA8OKz z9VC$Q*A}Nq+N-~^MZFxY)<4S5H=F4>N5*b?0D`6gzTE|jQL=hT?XK%*6z#GK<}{xQ z1>%gx+CmrK3j8c*qa3vf3b#Nny`o4KiOVi;cT+sX;o@8({fS0ur#+9z{V)ZknGnPw1Hne*Z zQ=^>jqe5+PLUn2FOa-YK+kf=x!Dyph$-+Jv?(l5v6G6+@xSIV0V&wkZg!=Jw zyPAe*)H`ACMMvM4EZIPD)Z`CkkpXX6*F-q<-*j__PnD__D*lSFCW9ZaMK^bFRJpa+ zxWR7L0Wsd9jv9LanC7P3JHNj$EA$PVgh?f>R)Pkd9dK+uVI}KC=%~bJj1&1C5v1Q% z*)%co*r=ZY`<;PUsG;sYtcb0IXyomU_&du;ZFO1im#hJrcaTtwEJZrHyZk%ExvnNX zVKRN-axpCVNAGh)oH{LC*pr5bq z@@x>g1kKwBbOvIox&HmKuQ8iHC+Lg}ti4|#RcgIA_)0&;N`H3ZV*-J?MKoX4p5LLV zBG5LwXbpIRP8J!Maw_au@2!@Z9S_F=5McynL^5x(NCVY|Q3Q(qkr^owiEK-spb~yC zvVU}_)a>S|Qow|!QGWKzGGH(M?g_Py1lkgjo0i|FhcZdVSc z+1|n+QUmuz5GDW5f#lh>WRtAegwLd2f0(W({&&&~X7fdx>H1Dp*pvJ_IWz||31$|q zXT7;1UsK(t(fapm9sBUai~!NBoP95wtww%}XfSJ=QY#nk2pU#n&DM-h)&&Md2jUG5 zm(iM7Wa-c7Ey6iOc)sX_9ki-dflmt&^B)C`QdSv7;ig{gR+SCmg77qNz?*3B*eQOhL_}(x!y~`}TVnG3KVtG>F=7mqYhJ@B|BtwXQH$iCPfq_}b!z*FvLL$_a%8-G6?lVWaud+Bv%`voa_&?1wQP z)-E|jn;PlpEDjHmAPeBHN_#8xJAnzmEt;AA#_wU>ANI%&G`IGfPxtIA##%}YP`Olx zWm_-L-PPmXvuaIarr&FNv{@u{YQYTF*4ll}=BLh7sZ5B^ms|?3*RC|&?Q4_XVl@8O zIcQ4r#s3j4{=W!y0M_jOSG7jpp84c9{>S*yb*u5u@aR8lgpU}Z!)ekSJuKf%TTwuM z^`b-&wP6QH;Vy{_0a47O&(y{S6oW_QUi6FEzn0h4W*HdVAB?_nOaP$|o~M#ui`QSZSOMV}d_z~#jefD2!0>=%#BCTOz9YV{WN6EhdzxR@M191vS-bXAqqZ#9Qp0>)c2|6=Qty4KKm;&k6M|S7{g+_Zq*YO; z^)!RRR`o7}Zu8p*Cqe=XD8^?(_tgKwvaLGt)@_1sJ+>!fZEkJ;RqFE3Y{QqXoMQE} zrGkzKDP%kpp~Pt}JlaXu^A}Z5_U5P=8~3yQ{N*oYzR_?{fwe6KWIEU}C42*qP{U$s6Sm z7A#Q}4$)EFyjS`+^U6grfy&73pX+Q=9ZQ>cPPG15N23~X@detqb`PO z+asFDczfJW|O=R)D(8hnP4aLLcTBpYGU7~Bg$B6aI1^AO{`7R5p^%?uV z_zy+;-~Iw*RyX1kDcQF0x|VN+nzh=}(~P7RwVX}dYpu5@R*sGhipTloU)neEe`Q+& zv$1aIqt!{9jP?i>jan0`guk1!M#$)>sRRo4pw23CqwyFuWuzeAVIyW3Z?9WxS)5&p zaKWkEukh$#?p5ks*hh!Q3Bv44d9PHozQv0IM=n!-cLPIv=eEV$v2z(m7w?b z!@pDuxfGh$DnN`H&f^RWEqnWMwTSDO*W>#%*!;3eRxA}JbG5$n?5))Z;R0kI#Bko4 zXBv_>xatW87o0#sbAYC>>FItiO=V!hD#);2D6W#v1QY!p3RpVkmSy~AUAD|P&8-pd z1v{Isu@dRdZ`t3fi0e7eatiw``?u44L_}Az**u0-6F=yr(~1S=RQR$`lDAmzll14! z88)J=zjZPq!DsF3oM4dC!Km~n6Fh+#jswMLYHwhsAJ5S)kGky>0m3qQH;lA1e=4?^ z1|%C`<#SL z?-kFeI(>c+t3q4q$)DAP5aP;AEo^zMRO?UL4gLhhd$`4SM=VSUt4-^HV{Ll5oMseo z4jYX|ong2E0Q4s{2(X=_@Ldr1shU&y3Grv(g;>YsJ3iPP>!hrLwf6()mr6wo0U9bj zUO?~)>T31M=%iZ((hr}fwmq4-dQU2-&vhVR-icKx1reM?1WV()u6%C!Yjik^j4up` zOraj3p%OV#z52@k;-6Izm!6|`#LiZVxKfuhM4g%t`6}q0Pz2CG?CwE}*<6h#t4vMZHYh-l7@#y;llC zQlJ>A-1E~#FcDUBLIG3m3E%&wxEW?}BtP^iFB`Z8PkJKWG`uUQjZ8OjL**0DKhr%*kqIg^tEarlQzPPXUYs5_BX#1}!{g?x}9b zgxGEj4#%OdZB&aZjzxEdl>Hej@^SzPkxOp~%ARGDLGdZ(^Xn5)9(i3isV{0u_pdG< z2Brp(QP=Smh&*Z0Qg#r|!?eDFiS|a*m5^zV$`ko1Bzt+S@Dze; zgBYu*32KXty>e~S+ceJ0JVF4>nNKOovUqC9S?k^uoC47z=_nazhXs&b?$ z+>S6zBI*rUG_n9gB(*Q*DrMuuzdV0eKHJk*j6dKYud}BXBOKXi8SoFFRD+UOYtFC@ zGJ_*>-l*Tw_m=Q}M?Av4Qe8ZCv4)MzepwidW0Q>CSZ;F7NQ0ZofI&AM*h@#UuxanZNy`Lp} zkSZ_4U^b9O^Y5z%VU^m7y0hVTq;#aH9D(IOyfuJ+tORMk+28p4_B1~2f63g{{wlms zqjos&x%y#X`3npStBAA=oPLY%y*@rwKz4|Dbfo>mSj!s$Ot;#MX6A{JRsECdJeKo! zs&m}!9`oK#Paq=IjyAq$bLF;~#f#X9D)CSi6t%ok+xmiVq($;o`F`@W}q+ z_VZnAgZkDQupuOGtQk>4w=8SFK_oYO^^Aq54RLa2zaLjdcyVfOgx$e;1sz^;gPYDmy@+cS2a_V&u9&~deQU31f$$^dyH;nd7 zaWqb0`fTl%Gka>toA1>gV3JUt0DGq#vptCL8fNggQ!(a+gI z>}FH*EAZDB0VAM`1!{@OtLY4II>xOeb^yaHX;QObPcVu=<&c9tbUDg!#x#W9)>-4y z9V#YaCE6(w!dKT( zy(j3p9+i-CE>nF(g`17zC-stv*27Vz#9s@+_&RUH06-_ih+(G#CMyYHGZ)Y9n^X4 zzI6{Q{ycWnX1OR}BD_4!?;9Hp2*Gqc4FTXtCOw{F?VscuZB~rHQJcT%%r=k7@BV-l2wnO<#a;I-@i>C^O)0x?%l$zO5r37tl1aC&Op`(k zZS1pqGF4B<$gVp5f25s>The*|?x&n`o}Bb)8Z*tMvKeQxq*60iDoZO%Gq+rj%yM5- z+z_ZNtxTDw%v{OLUEBqQkjznYB^N|R#2p0@O#uag^KG8zoO7LX{hsr?F3(@!b#Z-`g=m^e#mWf;Od<-E#@KC17Vu8!xfb=`xi@&5B)3XnWIoYG;LDuYJG$l zdcfZUGhp(Xuvw?yS~C;3boBM=hw1*f0|w+aO>)Vf3vq+{>sDSO!`yh`vlhWJliWGI z0~(6N)PmO5#~#(~GAqP&Szz6tq7&DUx)a}$o+IKaSHrbKzSE56`(jlop*sv)ZJ%xN z`}p^SO$;2P&K9TMgr-t^VtB7oqyr1d%_mW5`su?n0 z`krKVSk@U#O)kl^G^d_aSEz|tha^b<3^5H+=dB1hpbW9XqTblbO(1BTy?+&Na{E@m zt!NErFy{Mza*j&x=U49@*(9dE9OsN|Mo-yOq_;%I!0TlJnw6Dspegj`?aRl@jNXlR z4$sAHzEx+|A)rQ>3rLU|0nwheW#dHP#_mV8seFXTwgc+5H~8%pAy;m( z4Hv-UZqNChN};0c06{PQE9nXSvi^!-ETa0?(-tn9n>#aKDgXh78_%arQqaaFOj)*F z%h!FfJ2b*hE2|yhq-21pTLH^e_xLkQjAJkW3eA<2xNUKHEBy9s9QmxN@y0UW{RT5J zY7w-*tkHt3iXFFxV5d#{;bRJIAB+ZlP&aolfJlgL&5Eadns(n)cKsJk?!`Q~iqVaQc5{0eAre zfkJ&eOPSH_!~{$(>ALVnJXaL!X8a6=9Uy&2TUUn1_no?ltf#Eh9Dmr}&>kF9ivKAD z)=s#(`b$pcM-~jo6^#@LNY4bG>3;`6|GLSGFa6HctT<`t-e3)8X|xN}F}sGR?QfoI+y#rjF*~!h$`sUPK;iT3nIqV`U3(2s(J*T4 z#uXqSclc&-Ifhz4bMkH%(EI|L2L(f+W|b=r=Gs{C1w`?5-imj?m&%>f!#OGS_SW+x zdsGM*Hq|zpU_RDFMm3W-;W;GcLX^e=-B<7~pzjHWT8~gcC>>ug1n4tnY`p!DZZJKDQf&q*mbj6KPnaAv$yi>S^$@ zE83%5cioTmZzehlz4s|A%MJ)NxBXvOw8{U*qFb#{K%OYlarL84*)zH|jH>ssI>n;Y z?&8+M?BL%bXri@?+^ng~$ZsC-oN0UQcJhcp$*)d3!rh|W0?d$h;VJF+Gm-Gk#s{Q$ zx-56@CR*o}J3!s#%~92%d`}lpSADoU`zh(AjFbl)Szt@UeQ`wxg|%k&(v}$s+Mb+C zpz8P58lK@HF7@}maBA|5rVPW7gs^9puRw8YTn1=alBzi%H4tT{Fs>!(`UYJ@B&YnP#3n} zhJz(;te6T43_^#Sl6MpA7U`p;wU%4^h1kW?iI%91Kudm5f zTbsRb98+>Pu(U`XP&NDMDr?pVE_o)gC~10vDg*wpsYbg+_fE4_b?BejGSR~gH#8n* ztVk~7RLiv|d+s#aVi@k_Iz?BR6DLo8TQ*|f+D4a&yW6d-AJ}-wbjT;5ysmp5 zW~SgvXj7zf#J%R!q|;hOh_X2t!b_TAM+(Z+Z+8N+oF%QXhV4Wtb5Q*QbA?$9`A38X-K%c2d*W4@XrJt&sL?yDBmPd?DAjAu5Uc{p&u_bgF< zT)_>Ci0Y(~id2ZoBauPHdT7H8ixoy_)Z^) zzG<|Vp-zOk6~QaV7rcXHriMy*KloKhpHfnThY6h)K z@TJLqcX$di3cmL8oM9IoR)*Z2PEg`RfK9xctAWx=A%o)L}5}<|34%b-8rn1nj&=GPdaE4pHOHN*;8n@#o(nRU)9sI`KrQ z*S@KTON6=uR!9Qf%RYKk5Umydbx}vjm8)u@7MAI5S&xWCMwQg@BxUNs^j?Q$oFZx|2jA^M)gKHr&L5;Jpe zAF8@+Ic{HiSWaV+eX*W639?l0(He||v$=imv`w~(OaJo;=u4o;-ZHyv=w{F{KX&+m zKQ`}xmG0AiE0!Ns;ZANGd$+5Ee$@9>-)yUVHM|+-ju-JHk#0SnCU_5AQd`QsxjT`A z8Yb-BvfJ%f(7%KH+3(xtY7+(5Xy)W)2vUfrfpO7a8G?)o_`W)UKCKHXF}wBTk%{-M zYAylsmYYDpxW||ZEG{_eD4_twZ;6_E9O9RVZV{dAo&BL~thO@z2G?Zmqyl?}6#Pg@ z=q#IWm&V@vDXKXOzF_UkCnU~-<_ffcZNLKvGoESH46F5O;B&%Iqho?R@`gICi3TdP z#zIBWOkaqCa21Pp89uE^)QI1gi)+b{+K3po-+P8?_FW%?!3r1Abg(;2B+rY^_w69)DUE0M4zb<{=7`l)BL`Ch;7N62VF|cRZXkFb^C&6LNmTvII?XG=q zebz`&fl;>m!1)M+Puq4I$HyQCZ+iPW?h1Y(YzQGpVZ7Ju==9l;vW6Z{)pK1UKM z3Bhwn{Mu}FJHC@v?Zl6G)eaR?3BS;9{~2+(){v!^=Q!*U8u=`HJdCtWN8=H1hamYS z-CB}iA}a~Q z#FiHC4cAbtE zhoaMzJyS2XI9a|VRs2&+{Fc1CDsZzdx#2x_N{_5)8~}>+?%gQf!&aq^6=0U~n?9;5 z?mo^sxCo(b6O_ufSw`KJ6}%+$B!E2s1zN|Im?l+%1P)Ljyu#>;LkNw`DfrsNIJz;~ zP6%G?Jz!pMvSP0#ei{#{N>_pF(MbSiy&9~pjD0*;VOyBiUgb&#FGz;1gKSYhn=#w@ z+Xlt^S&K>&2|1EzfBkNW>PxOK%-a<01s41bTayj$c#f>gX+^}ASpWqI3sH@E9Yx!7 zH{P_^Yv-H_h>>0%D3Plx#vEI`&D@o1SEC;lwl4XYc10Y-YF0iiS~9?)GaK1Q82cXk zQ;0!t6&K8Z*piqH1mDdntYtE`1ia&N4(48;VbAam<}qK#?0&qNn#}%d3D{US-1?Bn21X-Ys8O7$>YHc%EQ3f0*Q-k zn~5NrO-Bl|imX65@iv5P)pb@N@QXh_ratzTo4*q?^YcF(f|Kl{Fv44CwaENi5UAP- zBiUu3&^^|X(9!M>^>?Z<41@XParZw4YC}QYMwJRmclXOO*V!104gU z{G~D<=y6i`*VsGxQr1oH=b3E=@0)g&+jlt9vBnBz-;W;g*N9?vgA`oub4Lrf<9?Kc zqchX-cfa?$)G+M>P8Ttf3~%dyfW10Yq-Qk9HYtj_8LCe2lx!F&H9eY<%iz<_##p>r z)D?F~f$Zt&kMLta_B226%tip6XHf{@-zmqX#}0ZTU-#MFX&lV)-Az;i*uX`L(ob>X z!`FmfFopy1mENYiL@XM8;+$Vqac7V;?Ac`W2iH2t=czxd6~~m+p}jSO(fD3qE~#wBgB}U1{1Lu4^V90RiVF|J&wfpbduwi&g1`lq z!ww9h9~quVpk>Rz)V{kB`UTX?1s7D-)g40{zBjCh!uR4MyA;Bs^Uv{=pOk z{wFXvDS|QOhfWV`PTJP`XBn5740mM6eXJJ0?YiI8Qg>Y1mtm*2^x+<&j0t1b3;i5C zj)Nl0CaTew-gvz*qy;m(laTCdePPS}Xx#&n5_ZFBI8a^o`39dCP{UCf;qiGpfQ<2V zXR>(xE#p#DF({Qq{nOUia}=-@{?dnIA<@zhpd!mNNa#%~hbfDkAq~^PK!g+V9360Y zjT%eUe)PtBk1S{o?!M!=IsEOtIX3Zv4tP2i-di}!ss|g!F0u5;wEqLq)-!-PcJAKN zjS_PWctt|<^FntHqg@TBi#Y|UdF!b_*>w|2r0|!s(&xFLBEii2y9-$&&}9CFG_i=l zH{4bE^S99>j#refZzcJCNXJuyy zII`fI4>mvNt5=BM=l4$c6jvR#%HwKv5wXjc4LS%);(^|( zK34rLjRL~zvjcRKg+a;^XjkWnT|JR4noCWpQ9M^@F(ABd4oJPac*uCSnNb}26PJ8? zN?P;rN;ITbQ6L3+wfwc4q>pYgSRr(9)%skuOlf!Ho-*C>;0;iGO}o6sc+}w7nMT~k zZvht(;u^_It7XIS1$L$VarV={3Jyxt6_~l%)7@no?@JsB>5$ zDUk--x3+56{wMTp!j@bJ9SYB=5%kEdP_eJY?tS zba`v4x^1*m(a^}M!fc>c1uB3`5DrLf*~mgqJ4K$i*3l!Td|9c*HZEIFfc3xWrr^*OsLs6RkI+2X<@BiG>b zoI&0aQ}Yk*fe}7UfU*_Wmyoje}&R=S0ldKf}>-ycf6M50pTJ(7dm7 zTp@@7GYV>LtEbQAAn66qhUC~bzO-ciIc*&N?z#aT0;4%38!(b!`-anS!{m%8Eown} zl$UA_>TD^xwMqE{e}La!6~-4O4kPYS& zZQUOGE}6|W<7D==oQ^;c$m=<#`$Tz1m(&z9H6opumL)dF_os4oG?e<4B58ZmZPLcJ zHe}MWenb zR()9XwKMJgz*kOH{{j7E_!YkhB4r^hCPtK&;?hhjz0zAK?J0E4$#EQTWyd42&|f5Vf>g7G(+ZSgSGEugVOwClN}U2|Q>-xFrr?v`_V1qD7s_LDI~w z*g}jD1804@d*%#dG}qsB>Gpgg;Ii-GE#q_>R4@|hd6NFHrY!SG@JLT!PW%NoZ&6P3 zR!jDDwy*3EsVQT5^0fQ!t4|hTbp`qMC-{-2W~ON zU)L9oHL9K292coQX6>YYG5Q5>5$F0-Uaox)#Q3`dyEWD}HXIo$KgPb}ngm-I(k-n? zTvfqnlGb%NvCPEX6hcla52oEmnqAxt1q-NIB(t6ZC1Gt@ucsc3w<}nQJC7xW9K4{@ z03sn^x7h{K5j%ObG$@*QTKifE9&sHLKS)tJh;xzzg8QsRc;w;vaj5dp zT_XAOAL&<)$GK25YJgSO84DxyV)&{y+P)+2&}vwAFc=jo#%C6wHZyi-I6Nj#8(Iv9 zG`%>oT9@h4+R@kqS|V;X)*fPF?)c_%klXa=-5sEZ-2BrA3cl2rnO~e%doj7WwY?7C;|*YvBKRrmoRb_ zlZX=jhapkgYT_^P3(<_}j};%K`9q1-V`6yp+-sXVeACUP7UdC71KbP_={cY-$E?M4 zBI>oxDg@~5!lt90l#U&#%heyKU{N(HH~T^@dN_OOOhh#oV?sWGA$n(tjRVtgLKjcr ziZe@PE(gX9v>+#t#kvIhfg#@dYNJ=cb0ttA^Hs6ViWBCd^&|x+`4_QWNjec_Y6_It zT!X|M2md^lRWNi5*I6+s0}}D(JgMG&2#7J=7aV z=0!GT(FHx`*ko+VSEXyUSVAQ~7WJXb@rrYL1IJ{3-jXANmWmgieM)zAQ`Qz=Uj0q- zR~p>YZzl%nXy=K=DP{6qw5x3pm)?hKJ5|)VJLpO8`FhOWcujb9o>tZMVT2nZOP_x+ z*io=zCo1SX&AkT|_kV4TiV5Hsm|t0auc23xA2J$r+t8-*0ypZ{#_}S_4%(y}apW06 z6bv1FZ0!;3@&O0C<}Ge*3ZkrOE!v2#lnthN68A9~xgK@aePDmXSK_Zn=$5*y86WXG z{Lb$${Ej7r67iR3UW$FO$GxG2&bbZonAib5O%b-_t#VRj(&@UCBe^Pj-!Sw0jm6EyT-y9RrT8@^zo!CQNwI?40APY0@z}|C~Ycza?)JuN{Fk>0Km1WECS6 zEV&-(6#3T-LGl*ZC`iUW5ho7ha%X`3PQkl&sZVobkUs8sl!%kkfXw)C#b1`E1ibZs zs60~bF_X#`F<7LJarH_{w~%?#acg_g6j^0a04-Gj1i(`gcV-cPi9DWAjF_%2Kp{_N zAuJ9^5NR$Y0Cdz;g&3T0P#2$k^g?hkXBCXV-vJ})jd#Zd*#m@>x z&<|Vk4$UT52ptMMP8_>g^8|_{ER~-VpLRE#p^iFF{(womh2(y*8gvV$B2j`!n%Auqz~J#$E*nkg8BgZE@j+Fur=w+TF>MnStj#3K3ljP~vUJ5}`lb#s_;JrQXK8X&-L# zb6&ee=iRzOHa39FY9>)8%1c{IaE1oCAC0wNxg4 zyb;R*egcXKm)Lj?~2 zs|VG_(sgLFQF+XUf{a*2qP&oRW{ta>UJ3iUCsw8-H@D&n*|F6J`MRmRu5zWZ)l&m$ z#!<_tK(%|<+yggI3(tsNN!kOF!p4O)hmyHcZbB-dHqS=O2JD2YH{hszUw}o%RW5Fl zsm|w=k7K(==a%V6$56FVBM3R5v#efJmI?b95Pgx+?f~wL;#H!5Q-ujTjEF6{cgvzH zQFsVygX;3$N#dMSGeQ%Y9t-R?-$l!92#IQB#nE4n8byJv(eE|VqsH(yzD%?{;to#O5N%4g~Cl}2{&)9KRn?j?%uio(&P2tj2;iPfGBXvjz9-g z*sxY{i2fKX+7T5uEKeVbEWjb{cZ0=UExxeK_4DD#dm~AF)l z$(YEUl z1-H)V_8A>l)YY$Xlvu;S6^s8;{EkkJQbLFmYiOxevnR3u&^~z5ah|r)K&mG}Ch6j| ztwO}xir)rQ+31oR*DrjNKE9<_AKXU@Ap+^u=_>`>$U4%!F1Rw%@%B;Ebr9p^^*F6JNuB z62;z!$Q95mEWAqwEH>#CS zh$yU8X%aZxNppB)t)(I!x63X(0?(_LbdVm=e1d^L2y|0O1fg9~=~k&5^1nvh)v8`E z-pKxXJyZ*ErYCvl(dGi?z5O*Nus^^@p_EOJT@u`m(%+=mc?9Z(n6|Qbs_v_F0E+#&8zW z;7+E$JMlxG-P{f1&fgdA*ZK@!au}Kf1nTmQ2gBgSunW*7o#X>iX{CM6R0Gk|x{P1% zc~B8I)ATEcaQD!gL`d^MDAB+!vjQtMTm2f}nYuhSCmpRb-KWbLO-jVp;s7tDVD5LK z_*N+2cW`z`1XxhSJuev_Nwql4fKETSK&tT$&8guJNIjnaJnlm;B@tff*8kO&HFWuK zY2HfCVowy{HyOA4m0a*tf9_=MGU-7TMl6h4^`rY6_0+y=GABt=yq{djN;e)<6&a?x z#7(|j!KF*5>sq7a1oRNtWKrTP-O7%l9uprMmVtFj&y|JtH;sv0Wq7cip^k4=Fz^pR zs~@g5mngC27l6s7r>Os{!qybM!^=8Fzt$HdsT+1>)2cXaOjV1Ly?#%|8&6TPYuDmu z-)VkFsivO%ZajhcqPWc!7$aBrEBU7C<3&Och62h(aRQqsv}u;Aa_?LJs^q$9A$0TG3MrrF)8+p}~??lmg`B zV8!Ptq%#aW9hEqXh>jgba$-~88P#YcfVtFkO?1f4jT?HJm)+nyg+{E zE~h4P{tJMyv33^z?GymU?jmse)9e&eDs?X0^szP6G75nE0q_}~P1BWGP(E$u*TP5x zVik6BI$jL@mP-BTxA3ifCsCHbCB7`USt$Q=QCvZrM`eDp=FC`XQ=(so;2g)ab5Efc zs{Q_h#2BCE{qXXav&3Bq70N($wxnKf2ROm zNV>w=p!F4Tp%Pc|vHYICl;9FKduCIROa(@e21d5*&mbEvKc*Dj&Ec-45=R*261Ee~ zm2@L~b8C_w5cAZCnslG8P@D3oZ-W5$cxt^PYk25t{$^J1Ho?tQzCUy)!`nMWm-52( z7s|Qy%{%v4dPPXz-B;qOeZjNj5lB3*Q~&5WSqPseF;lu<$=8i8sAfhj+#5gkek>nT zk2KmOVQdGI){_Tn(Z!3WJ|fvVx+x8Do`I5DauJe{hec-|MZY^OTl6ghVn8C{XVrd{ z4N(dvene-xzfOjPB1t)WSaD*~2nQ2IV{)0FthHb@<3E}^lQeN6?Q96#BfS#P2&tXn&5k#}5n> z7i$@#CB)6=V~4G@7i6Dx*JsF@r)t*M$a;Fv!petS4Ct)UZABxCil4Vu2gCcvrfO|- z=F{gk`sCQ%#1OV=OXfd-)uNjL(r`z~AH0ZkRbjwe^Ph&^aQ6SM`AgiH+OB)5D%d#2 z@aEJ;gjOxNZNj26eqMKb+uO*Q?gyhK6baTp+f6wInOMt?ln}>73-ZIn)SFf!`_P!0 z`$hl@vWK_f7FOc6expyY`+y2T}tdf))dCGs|LKxSj zh^C*}55EZ=U_va=cBEza(;&h4%oZ28NbP0c3~t!8>IU)c~pzo>oIlB^*t#M~va$3e3MPh659BV!6j^G9h!C+L#Ias@$c$%Cc@VQ${tqfY>cqg_Px%#OQ_NEiMxyhyVcSc=z^C)m z?SzN?>GRn9>nb101Pezk;On_<0sz52))Ez{Vsb2GYjFUe@1=hGZo1fXhtMDh7gwn- z-Bc=3Vd*C9JY)VuR%~ttb@EgQru;S*WqJ%GR`oZy5McRxuu@8v`rC>#N_D=s)`Ke% z=I%v3t#?-lLtH*`H=avh&HP!|{i3kvw>wzWsGw5ha~7J`T4C1JvN{dSkVXw7 zOYM(SXKhbZWd{kTcLjmevWRDi-{2cWpX)h+@vbp(tX|k7FvyzjG+dzf-YG8JG}2Ux|Jit) zH<1>#c~gH>&ji10JduPA+ahgKg*#N1U{`X++rD+ynYE)u0|?Vs=v z$>$FO7u+*K+LyH4O-f440M3TLVB*K$d$JL^U>UXfl2|}!9L=d^sHUGpyppIEVj51- z66U6sG4DoE<`)i>Rpk$TEs*L3t?OIU_63sS2Nl!RMgBhCB#y-eW=(@uJ6&^BhZ!V> zg&F;1d^G5^4}AV^R%&+udHxqfTOegY3wx(GH3KJMI{lK0a9U^JfZzyB7R0#pIu<+} zvRJC|YoBH)Jy@(&kBjRnq>=?xFwRA<=9JJVWmLCjI#`Kn{9@rYt0Th$sobBL_Em0c zfOrPw6HH$z$=5zVlQ5Nzj=h8sZFu7sSmBANHCz?EPTx40!9b`3<3uIL5 zZTdyariW8n+Lhh}4y?=V6DC7cCE0=YF_i28A}yzadvk1n7j^i>|DvpoH!d#As95Um_N5Ab2>pC~7QQNmDe_WcNAfz~}3*g;VQ2En=*H^nr)B>pd8)Euj zdo&NMk+TJZ+*TZT?G#vTwa=cM7ze)>qk0Sdv8bsA_n#?isk(F1F#f@2AG-JEiDS5c z^#!)c%e>RbYHPX%=MZNNDmo(^p#B|Ctt0Ob_2V^tzR^b$t)AdkJhY7b8bZs8KhFU+G)I$#(R2EmRAmD&k1gM%*}3$ z6#S`K6@>VkvQFR0`pUn~&@DlF{2Q|Fu`H<&B-h!d-!1+r;j@RUD>LUJ+|FZMl-v@p zh?BX*|Kx%Ti``bb9MF%zD=KCM%Ox?9uuuTD@Ta{ZYBgH^M>*zoQj1_!;B z&NuZL$#G4HZE#C?j74(kCpND0z}?73Lo-Y`1ZA`i%)gvw$|&Dar(VsYbRxcFLr z({J%>!U8E9gd4QeiC_?Sd_;DtZl$CmmI z0I73fL0I0^E=X#qsQP%py!UvqxZ~aJ{X?(T0B4))7t~K_eEus*CV3rF{{!T~BU_CvshRUOUy+ zQdmn4arB)ZT^qAYO7D(bDv}uXsW(b)HO+tHPP3OvZL!bzkJ*G=4p=xq{1Du8N<4D3 z81$yS5RJG{qj#nyC@zaT7^iLUWBHAMOJ_nn9*Bu0x2M=5taiC`3*>S90PCT4hw^5D z^eRSBPUoWr^p4wTQtYxKCFOcmc%fEts6>;NF28T~j3f{y=R_F?QmG|4p4*<#rjNNg zt<@$QQWpJjv^iAmlnOZJ-^>!(T7=GT<9k#oNZ!>4S@ar9`C*fj-nsRklYiRcNj3uB zfEB}XFX?6h4dzubL$P70X0`*-xlv}tz1?N?O=aaTzT7*erl-_X1U+OSIEOlLi#F`9 z5`Nje6@t{bH|ROvmc44PJ*Z#WXaitbdf zFU!%K4FgOSVr-}Dtb05lwuPTRjVAv$OOyY4%6P#1VRJ>LDxz3lFuJs-GmOTtH{{RX z$_W;qI+4K%W|4;!O9N4pr7uOab|r4s$}MNO06zrA@%$NRCBB?7aJxLqPrUol{N5Rcy%LO~!nFZ= zj*IsTqQ2%SfieBAF^P7od6+m$_Hifjfe~+%)7x}XkD&VopVKpM6z?RQ?ri!wUWrVr zti^~flNHLpVx;Gb(?&j8iz}rw8`We7rhv#a`z5ZLfo4D*jdHCuNPk_k^{1aSUI$g{ zrsurectws{Pi9Y7k`&UP@oM#?Yd^x_DE!XuYiYSmB^NNjXXqNH7EF{m2=gaAV{kn! z#9-*g`kQFcQ?%Xx2cF?kIAvJ$Z7?n?tdyv|eI1NK?ltBLSntjkV$C;DB>#HT)99z> zN}0XMOhLZ$v+|R)P~h>Aj|rPc5h1uAk8cF3pzHCR9%hS%ywYn1Y-70ZGoFL-fFy&VUK`ZDH5kC0WRX;)B}^hYbd?FoC{ zr&e0k2+S6MJz?ynO|ufgXW4ragEO9MxON&lA}hYah`kYv?=+IMwph5r$oFcXeDEqow zzWxgKzc82PU-n!{>*~^XHb(RM6cft)^pz0FBTM5XK!A$?r!Rjl?QauQL}V|>-{TME%b! z0GdV9O(-%V+#8_o;_D(d4fnT&`0{`zIS~8Pwa-A%Bt~mY> zvM~Dc7;Ll-ZMx2Ux@T)p%-#p!Tzn7Y?Eud@w?$B}}Lpb73*hl** zwnDiUYmIEAotHrh3K59R3SYvHT#@`)>=<-Sq;y`2iVH^$zSJO4A>NF0iror5xg)A z#Iqmz{~(awn=PCotL^>6@GSOZZ`TC;$Av-$+fF|4j6V4gR`n7Dd%6gcyFpr@R`hri zdwi)wcOORJfyH5yhH%*K$W1Y4c{o3~0v-_80*&KYX4Um@a5i9RKv%!r89hEL!#|xV zx$|NYr5=O+66i*gxD0~G!GWTFNOX&HkOvVmzJQ06`WX(oG~J5RoFuPRkM5z{Y;p)!d`gJU`Mp}U78HYzp0a9sOUXDe-%<-;;tS= zmlE|h_2N&VgMR@}anD1RD?;Yqr|R9$@bzy6KOOW|7Y)?BH4 z{GnTidkNmZa?tw0uBKNXk8jCzvHsvACRZ6dX&byaX;tQvsS<6mfBRQ2!wZ&unDmH*;c2Y}+W;6nXR zdn{SEuxKLMIYCe{tx^(SOg`bEN!Bgdg_4~|II)jGsgj26^kl1EKb?$_OfS~#@M+yI z48UMZUww8ELgM0rP!})WRIV#is9-5KyEAm)3p%|b5VRO7;u07%cZrQw*_0&hx-MKIYgTr#9<#*=Vt^<8?wcsg!a`M4dcTd#ik+q;EA)Y zsjD5K0MWPWMI?bsqe;9$6}`54$K`cIU*uLbx+7uY?Ia&$C2jLz?D2JRGjS;L&f?(Dca*L) z^|7`sBi~5#o-rmDk;YsdnmqdsD{q@bu;Q}V(C{>8RBgEX z<~Umma3I;)z8kTgxfVTGGc2&nfxe+Is(U2ahEeTQ4*p>vY`ZLoNKSng90=ttmYN5S ziZoCbMpqG6Bc2Vk6EM*ApP>AOz1_ZeF4=$CzHNo(xu2Lr>MG$B>Xp9+J&vlP+4OXU z-!%;$><11xHq%au`Z4_XkRx38Ne%u;C0NULl{Y9ca#6`-pWk9RV(v$#x1xQ-GeT4G zoWAnQQg_Dtzv*b_tN%3}&HO*;=)0xF8#&>%5r&(VwSVH+7Q!C-D#Mu^@R{>AUkM9T zoh}vW?t+dNRPc4hB#cGPowdHSu|-ArKI%)CGH!y8gnDW5hSpF1W0%r&xkIm#$z!T6 zjjsyy3ceUFo(hd3(q+HI9f95R-+YNIskufRqczpVS8L?DA^g$(X8uVw?BcA`SvPxb z=-Cr81O&(YC`%d7iZ}RRaXFI3CMr}iXD(ff}hT%G6XX64^zJzYL zINfR0GzjpF8rD=x`mLqs^;Yi}+gsx8hGGyd9+8*aHIeg|PM(>)^x>zXK(-Q9abvlah7=d{h+q~1Y(mPmnLZ$xMe z>(H|p9#7cXb{rrNRu10re;(c*@1v+^wXdfwZUX*4NPF|Br1Ss%yU8i18g-hc%zesf ztSqfeO$}(KDOxo%C08m_b3t>(4QSOiwWf@6W6E4naRU_;DpSi1H$XuoH5Wv{4Nwrc z-_Gar{hj;V=XdV=KK}moKb7<3`MR#hbv=z{n3w%i9-Xmt81a!}+jdwIJ1>m0%Wu>k zjw;H-999-R?LPLZyKDQ^l%x>zI|((4o?0V{E_YZr4M}$CqMUD+UNZXj#JrVj>Pu@LA$eY z4c7No`R!@GmZLlAn_m%N=J~OVvcw$=NO%$#H08Vl``s5O>HL~lAY{IN5bKD~3Qx?* zyCtQd9YQdIfOkqZ^n0)M8~~Y)wfibU|I9g3+c0|jNm9@UdJ|iVPPK0jv_V+4dI{A2 zFbu&YtbHU@3(%}_^h7jH(Up0TPFhg&EZZq`QLcimz)x(c(AyS5J6A}zY|p&dutPtC z^}MbKcQ)NcOcK?!EHYJiNT3LeW{L=@X&E(WWz&Mt`ZBz$`|RMiOC+NzjBV^_MdU_s zQ)wJqJ3x-_IvnHR)KG$Lpwfbe?Ss8(1OGbT69+B2o`ld`=I29|ORP>{!#jYk3Q(W$ zWrHM$~z@d6esfmsV~F+`8ZX$9yP z!Xdbc^Pwrx^RSp?P@9|BM;%I0&EW~B@bXf7zbbExJlGE4r7MYMWtrZhx*<}YG=)p= zHVtgaGm@1O>j#EQ#xxmwHaew5zeYfSfgFmuo;oAS_>es5`EqadqpqAxuGz#654dn+ z7-l;u+1^W09jegmC?$eqI-YhT9*FtLi@w(M zD}=oKj}USu`qJ-{zPgmy8x5+8hKRpi?Wi{vUTlWC?s&FG4GZ!#UuBO9Y~`~miTkRb z&`$r}JQJ*2f@hc%=7`96@sH*qRZ9MF>(5nb6=gpe&Hrh=JZ-6iWAH~5?Pa_PSG!!5 zMOeRTWT}v1U>FnjDlieIxwwfwfqv^e);AM8*+Vb4lt6c8-)tIny9o4GQ~Biied|ad z1%6+ZC5P@Yv?v5hv6Pb~c`FH)SYbeg4uBVV1C>n%98ULPi?ldUT;dy*FC5^eGXZY; zL?3*ptf1f;`ETd1q2~Ta^AlqCLthrF3q_6Ts6C6uXaX&VJ^;^?$S1>onI2myv6hL% zO7PqPYGIK=hC7R&O@z_@aCW{^?maazy=BFFInr^uN_KgHEWAjg1vaG#10)F}wUyq& z`%VQ`xUeZ-H5vUuU3Vn_ou?k#BtflNWmtLVOv~M8c?VzAb@+AO78}nzS(9>a3je_@ zd+WD*eq&jkfr5SB@P$#^C$5!g-MXgD zf{4V}lDH%mx49a-ajJb^iLypze;2D;C7|{J+}){vyeuZ)E^Vi`)s@-=D`F#GK5FNN zHw3=I8`+JUygF)!J3e0aahn4UW`sRr0Z`K}@VI=%bWqDEDZ7A9H57q)Q|Dxh@3jr( zH@8lmED60)!wCZ~9n%GO-xelUJJ#R@HNe;x1s@4vDQ2==c5DwX-XHNAsb9$nqg?7t zt&Rr*<``Gt#A3p1orT~>0HBtEn4FWVLpW$V%2Bt$7jL*-gyCt6ATE%kb#?2n@;*HR zAk-V{903hYk(k%)65KbRK3?!VpuxMd5L3fV(+I)I%P~OhkCA*p^F#2OWlxBCPWa2v zjp7rWXU8XpLnT-?f+8wPm%QvmEp`DaNOaf4Z6y(%JzRYe&PO(cwoCsAfTWMPVa#wU z!Iy63n=~TrR1aqvT;|>!ac^t)n=(Z(q~_1wVPS$Y-glv^6ac5^E5GL9j{Ma)Zy(%; z3n+PD*!9g>7 zaM>`3pz{-`XdXBYVP>%u*zFGp|M?Yx&zP`g2~>*+Adxn{1t4yH>riT zZKrq4{CVH7rq|H?QO(sI+d21DZ1|!+v^Vi>88!oMlGdMla%V@>c+KCQTQk)K_sNug zBaXT2qmfRP*HLAk8=_2*FZ}GWv*gkK6r;yRZx~Ppp?R>SkDXgm2V*DWqW71UU}@e+ zlQ+j5+=~P?wCTc6sGwZ=DT?`v(tV{K&$AB#X~h282s%J)02Mub6gD2X=+O6oFLAD! zUNqyvgkG;*Rp%Ol8952WGEjJf3zU(=u`r7!Rr{tXA9E$zY4|ZHb+RXv zq%zb2*0GTDs4MI)>^uA>=@f>D~$DuUqi4c!{dh&SEuHr(em#FIA z%*&Y5jU@Hssi*BT8E6s9O7BA1t*eOcXU2lTI9@PFuGie?+s`Xf*aK_ubNu+8VE#Y)Pu(n1U{fVcz_MH5w$9#ykSqNY6Q}^3)9|FS0a%8xRI%J3 z*{nUb9Z*&2$|LoP)K9*OvBG+x{N#>CQ9Od8B2fgs5MR(DrWm5>o?bOtjI%hjOadrW zSv9I>uu94hh33kMx2d^11c!5Nt z60|V_^K74mrAZ?N!11iR)eHCKN7RdX60}RGAopv2P{INh!MJ9#*kSYKkpd5SC<0@c z!rNS0x$%Toj#w4nPCG^pg}h=Kq-DFzT<+lj>xs!>C-Nc!Tb2kkFbUy|`esE14bsu# zHB@Xj#+x`S~2!9RVx6E3J7Lx!seKRJv0FIgj$G{@rB^c5~m2 zLfgN9PfFSFF-e~7rtwSBnTx}J4jfbemK zEd-ja3EQWFPUi=5XvK|&0S?v?fv4PpnepHXwhE6nc~5W2$g3liL@$M}i(!WvDF;Ng z(u6v>W#ye6A9K^VKJv$jXS|08hE`Jjy27ApkWvMj@|fAS?LKhA_*+SPS_Z1`1Bdji z`F_hf>myx`Ad=`km1G#8C_IxdaBk#(bc#pZz?bA;Rtm1C=p+7m zh|~zg*~gC!00QdYf@^D!)2LV5{=-v`1;@86)n2t-qX>{S+*+L>Y4XDYuw5q?c-b~! zhAC^OD6MQ#Xf5U{n7Q@h^K9E}jp@zX!h5OOw^)TGnjg7v_R^PckxJ{*qpSdkE1h2OONUy!<8{rQj74gGDvU5uxMucvw~vlMc73m4IYI6kKwT<5nA$(wtFOsT?d6mLwh?nepHkQ!4Hsekw8yYBz$wPAXjIg z7{(zKS65mVgSNgL8tmo#5q9Z@^tc^(_C}-^Y3Xs_FHw%rNw*b6tyHgeKKBbq@tLOFjeka}o6}9>kY|qNd}t zF}UlqtqEO|38D)h0qC~K))T$zzqo2G3axP@Mqu>;q`wDSc77!~eoL-h^$~|KBV*oB z>0K3UauMK8It+@fE5D`liw%KGjYeH59hNy*bszndARbi+PTHAfvdo7&s3@|%4j|R>(*;vFWgQOi&044Rm)FgCYYykVZ@Hte zYyPfo`d_M=i)$l+HkGA^NtxnPtgy}@akoe%sGYnzycyJ~IhI75ocI_9f2UK(KDhiL zcN*LbtSIEpRp|5GG!w*A9@q zeZOA+@#?r?zV*cgukk||{Vh-E8a(~pEDcf4DaPatly|K8>3^rTeT%t}?26IOgimK& z)=EwS+O6|(hJ#PyOIbbhK6PbS;Tx3cE3!?4jB!=Z0D`(H*JGEuKP4Elc1V@l|AmLOkE*jm&y? zamtBvf(v!S%W2!Zo_XR#3QNpL{rtd?A^{Pmm9pT;6RFEAq7F~CUJN_xn6=Y>X&vq& z$0}RN-{4!*CjQt!2MqPzSQGLe3MKkgo2PZb5)i2|!!sL-SrYdS!nNF1Kuno&REjkM z{#sqlN7(l&>iu9x7uH$Ea`Cl-*8kLel;zF5J6p`?vA5sWYHB402d>XXznF>#$UA0f z>{jg0#cJ0I*EW9&TG(yD>2&2rYnKM}xkmpzO^!jxs-{19*9dsg3&ZG(nJ5+<_16dq zZ}OU@YISq2`I+4FTwS+0j2%-1_SP&#@BE!*iTa$1iKw|`3!_Am97Yf2r&U547q-C0 zsC~TqTA1-k_O()M8hiNf?Nrw#h)q&8)+Qr#MRlzDs$-8Vu>av z#hcjp8+#N%L8x5=mmziQGH+-*t86;kc=95AQ2JQx==$pmZHC#GrT7>o#lbRSY`$ zHRR1-WtOeLcT-`d@BlA`dkD+H+z~5lRgX+ihn+b9Y7Jh41e9x_sHvrxwzmx8*XpnK_C76& z{J`z3Q9T*UZ$79xRwp(gDoifhYJ19WcN`s8Z+fu1P(RAAXnbTMSW);PU>FF)B*?j) z8e{c7Jc9?5?JvkQlhI9*>|XwmAn%{Fbq=B`K*A2~27uMSLg1<4zpk!2!RO~im%DEd zx)!SggAQq)D;Syx3qD-Eo?@LES3}UqOrJSxZ4Z3vJ1l<+h-J7RSF_O-(GGI{;K8`p z8eIK3;g?~*TcDFxIE8a~6}}R@Ox8*6H)h)w?X#qsx`4Ot&7#UocMgv1A zm-sbkfm7bdrCx8HloQt@Z_K`q!8QXC#Uk?sGNLH%`rQ9iTbK2sIZnl|wqR?}^D~j# zN%2pIKRN~(17XL+p7xQ)^k_T!+=tQxea>;*v9EXkx4`fJJEFQ~ttAlWYE1dhjIM?u z?SSI@jTjPiC(!rt?spJvYDKxeGgYE5Xt;p}iY*5>?hi<}ZPkPC6F0BOCOosnw)THN z)YuQwJlu?>bTXi6WDtnxW6<4{|9qV3rm5(7@WI1oWK&kGPcS61VVObSb@XE4-xa7D z@36)BN+3NDxk)C?WPUk6q3+WqG3W*0ou_rPu8x)u*jT2 z8FB{c#Wi;V{%8ZD0|^+bL8W1z^2gu3ha0*?>aGV|j>$hR7$^qvk3Bd@s*$O+Ur7;H zm8C2$x&7=6zF7fT+}(KOe`zP51RZAjk0|(FX%#p!A_*u-b(&gV4@R)&#K5YKO!!wc zDLq81>G+_xO2-lC1gg17H>391{WNsQd859%No7r3W} z#fU)4-6u@uPja2MZD}kg0d2hZ+&x*P!@c#43xqPJvpN*nXe5*d6G&+k9ovl_@=eJ} zIg#ayWogOp)6CV+SZU9=b3ch*9h;tiIL;VV?I;=!(C_hfBKy; zdyJh(nwTH>*qU`Y2?etIfi`7oBO?I?*1J{;na&p#6d=MBdh3`SL!!%Ne=amnY8~N6 zeyH$6VES|Px;*CpN6sv|1GbcUMa73-QPC$6i}mV$FtJ(|ESS7iW9nEjK>irhjO!`2fq%%}$w?P7@Kif7wD0(EZ z4ZS815IAg0ZT+Yzxo?SGgN!fLbK7kM1YHEX06ng#1>cG{8O>6Dmk4wsL}Oel6-SE< z=H(seX+`_!qNb?pmEDr%=am!Ct|p_gAhIL^=vyz%E179)UoebJ%8a zcNpmR7!v(kR}EU|{SJL0vr|PL@`OmklrQwwl>nA3KwghduaMV<6`wq=ai&n}b;>f9 z5ZTad9gY8b7NR&NZcGeg2<45fU<-CSVjcN{fSh&uMWnYjl7YD-^X-9eq$cwO5Xp12 z?&UGa*1?qMW3o|Ij1sS2W28u6sCVb9Asg>;)07IFlUS>Cy`^^EYmDiQ4?ruE(`+P} z)L8cpQ$BxX9bcc^KnpEl3=WnH-zdSC$c0VP=9VmD;$F6Xtv&Wm!qvm&{XkhYZ|TMa zuvct1qiiucMWAtEOi_V%c5NC>DFLGdae{zUq`XXjF{lgJA3~yA?VTT zLu7vfLC~wjE5gYYJCU8S<+WML8m$e;!RdmN{#fu%XExC3RT?;X(=NL1jT;L@Y>aR0 zcN5WRaWlI~Dq5ZBxxYMfI( zo(YUGalH!KFJVdF;DRcjpBvyp9Y|hf=BIUIiw-Cr&-^$~7XDcZl=^DA3@4*^S^%ho zYXcX!=tvCBZ}hNoxo0lR6M3PoS}OfAk~Mz`_;wH(O|z&i9#Dvd?zuVQgWS=B>6BoD z=KAi}^M{h{kJEqzv(~SpYExWDA^PoKFmh4HWfnsF3;xZ45KLd^(OPz>)))LxQu}pS zp|EJY`sRZp3SF(0s_G1H%jBD@EBx@;^7*@Xltyi{Zp(x4-zINEojijcIJ5FI{HQ(? zmN~F1sIbd{Z04nRp%aN?P>zN$&VRZJRjM9xa(&e@31vAaeCW|ijrW$FUumosmlAG% zTNBHAs!<(&Sr7@)39RR$7XR(|MJ?V&NPiF?rGR=UCJrQ^Sez*5%S{85T6_xPE*7|H z$*)EGz@s;r&o94fk-L5Hg>25cDqByLxrC)A-NB;01}59q)$uAD2JuT%lhoWl@v2;l zbwdK4$tO@E9^%*z2H$`I_p7dK`;Y4gE0?QQ@M|r`tTRQ3o?c>kT3@=rp+&wX89aOx zffHVY1VDEDx3Xy(1#0FW_b%TsfOeao$G!iMtD_eahLnc|f#qp=&0|US$fX9Aqq0d3 z1d;kl?~IbeS2tURHZSIWXu%vdit84bWq~ea@~=g7$IxNTBz-OAJNQ{=fWCGO@E%1J zH1{;%T7{O|S>O9FR^r5xiTD2Z72l4kB=k}OQFX8Q`WK5hlg{p*%5u^TsJV zlXFj6lEyKgZW7IpvKfmda)uu0f&Nq*ngcC8G%=_46N_J7w~hGSql^!%HMbzy_hH3XG74;!TGv z#Ms)G-0Qy4(lW<4NBw-hk~v(fY;puC`v={A=<2pLs)_9`^eOJUv3QfG5L;e+QM6@Q zYe}}iaG$!|dh)c|Yrx|@UnceH-00fLHwjVwwof2!^T41eu1jxuvxtGU^&KirfuqG* ztE{#7{9ZJvfwg2I@!xfVj2cisPx)re8=Hb`^5~Q8wAjUOOyN%Jg6m2yt`u8K!_Nu7 zZCRa*=JdTvuki`UG)|7bU5)49_|Y)2GxNa2FmPJtjmi35=@Z|L9JNHH%*W3txT!-? zPda-fx!Gau1g$g`rOUlc`yrh`-Z^Y|6EhjEC#a%L&fX3%9laf;*2RPh>dPh;cZY$r zziB)ydCcVdei1T_&p8FU&Z)`SXA%&2$_JXNnt#Hjd$pA2-hrsI z#&%RpR5ZX5s;=nXgy#K)68U*PQ^B>+`Sp)}OU1*p`I(OqKa|A2amSeW)whn1@Xam~ zbf{R(xSKN?n42L$p90>xMlCQH>!8D5%$|%x>5kAB>Bo;?<~lT2H)~XT5Mij90fxz6(kTXHH&czxvy&ly{|MxIHnsI!F){jFfNvGI)-o9CWDRpla9|&ogWd zHe}2R>tP`0UnTt~L-T8*dA&i_79alR-w(8^|0KjJ7hh{ao6Ezi7HB$2P+oWA_Suwr z)@|ADgRT4-kpgmcYfV^Y#g8oROu7M!4~uFRVqHnb7vS~|lElhq0Je=H8!F;=w9>E2 z>Gg0T{j?+v(8GF$>>HQ&dW7w-1rRQl1dU%I^I;m``9D+A8QD1ZTFb)L;41|v#clti!*Q1B7xkz#7CY~hm zeWdZAQoi)fJ*e5fUNkWhYrDLg6>gw~BPdz7qBintSul`^92PulR>>jXm2$-}Povc8 z2(zTjFp%iI%HMZBq$?%AqgoMxHV{n8PuJ4ks2V;b=QR7Ck>}%|^^%9=kxEE|B z*q#$dw=K7&pK7hw&4dOzvl>-9e>I=*pT7v*>u>BDGfOF1O01qb3o{;FZ@$oT)AC4I z&G;x+df)psK3aR*>gLM*_mGU-_BTsS#5PLiD-=v0or2|k>Y(082o!d;Q}nFKPV z&-foTIR$>uwNx#p7X;c-utIe^f%Gs8)`@*ca@@=4 z!H{=itO8jeO%^V|c1X^{PVNWbj|GS%YA)7CntSpWJ(RkTZUz@lQo@pW-eP!Rm$T7w z=In8&lGNz2{aQ%*PdDW*{VoLi?mT9aYFKct2~#!xb$QTGVPv9e{?NAhXzY_zi#zR& zanj!PCSeLVf~1=D-FUFzj5-CIG}>TUsw9oO#%-M1(3JOW=rwaKJm>4nnlekCNizMA z)Cu3a%FA}}4a?7uKbH6V95nQcKRH*8HYMrE1qKt5i*t566j!MieG4Z5&y&}X*DzUb zA;VDLGz@Lp|D)^IK*2A*1_42ZQN6mi5AHTXwYhbP2Z(S;7cPhXE|hsIDD>Z z4Y23kb#GE}V+x4k?(%4*e<`6Vcf3qsOZ$!A8+NJYpV@i4b)oWXTLeVM`o-d-yH16; z9-kk5)j@Zi=2Fr!U5Q?a#L%NvBaJGGwdF**c$1;udgpx&7iM=IiWgn5-^rXh@u@;>tR-jYJRx zNJID~B5<@!NyL;ARP2e|bdmfCuj%?M3M=o8t|)?fPmrT7h4Q@?j^wnRtv}1E1n0g` zzi`MoOMx$2x)bcLImzHn1rSMLkth%kvH?9!d8E2XNfM6s?aG&jK(N9xm~Tmpl~1PY@nhT1Z8Jhv@ieBwLR_ot$lqcD z+3@+ynN&=wn0`O4O%>FEpjP+(DE>OjL24`nR>oHvZK=}u;#7(MkUuL$~ObJx>|%UYRbD*LB2!Ncl)@|FHX z$xH!W(OCtYaO6#GOjc++y@MISKxaqogTif%Qa#)F4nBt~XE)ZVr)Ew#iO=oe0(T2F zpWA~f|S8rtso~_q{OlUL-+lS;qru6)1QxER> zm2=~NKK4n-swGBG$Cm60Pr2*BR*vg!G@?qf>7&lgV{Gl`Te#1Zx%)v0>VX=M#}FMa z5lg38)#O1pZ7@Jjv7MGNVuSIs|4?`AjAQ>{gM0pmqHX}gUP_9C;NFJeQdW*M{+2Y zX!79+ESH~!&LNjzA$#vw_X0>dL3(0(lp;qx2j=5buu@$~(kSOmp1RLzL*El2e#@dfqlm((eD&1p2U z&wgm3knI8h+x`n&Gsv=If-RI5pe_)r%q_f~-IScE7mY}@9${?ypzJeHaBYmf57Zgj z5W}X?bmJ2amdaWaH%>l$_(U4%#LZ9HIW{B2L}IqZeAk#f)*lB3`$}sk^3iu>= zvRBtGuD_a@K6`UoM<8^kCS-Hy5d?H-de4yU^3NX7U=V8l2&#p~*(>l-RR4VG{N%e~ zb5E6~gTA<)Ax6|eMl5n?YARV0_SDa=_Mr3ejl4?;)*Bhv(K=Hw3mu1vtX)&Uf)x$-iuw@ zJ3@DBq>B`xKxck{N}y__ebp zO=C-+%X?dNIJR7wQcJ=WA5R;l2zyTgUUzlT#G5cN+{ovkw;UYZFPo3R_$Fwse>p5R zOSA2h%^#7xfEaXE^Qn`CVUKwA`#pj5Uqt=@W~xY~9G^`lY9pn2!vXRtb-a(PR^m5Q zb=6XRU6~|5!%UmdZ6F9#6{$I%>e!8nQT5D;C)#J8dfF`)PXf@k5RRA$AIR*`@aIf3_iOkYL`>B{6}8VcIUzYzKi<<+Y)Oc)?W`65x|b0-~+D-47^fO z=!*$_@8=jyyu7;qgf8%(fIxTo-Z}`kHr#c1OHo<}GSP!J>(FcEg_QXCxyH&&i5BNi z?Df-o<%OcV_(yzG9_pfM)nfQG4&Hd=Cqejo)%oPnUE^iGQ=8tvHQB+{(Nq0EiB6PD ztS;xa;h!vLF;$U6Dh9VM)vaLN&!Q`q5{>0jRdiBYtGu;VK|G+)4MwF=DU(*z9K$Kg z6`7=@W=T;C(`$R?_E&N=4=$;pGDSPXehVHH|b%WV4 z!#l$~Tx7wS>%nY56#3Bl6BV%~-iWNC*PV&52+y%`h({r%Nj&J|Y*{C}>)I*l*-S1Y z=~iM-;r-i!I8)FdexYjDKJ`F|(3vrq31#Wk$rx!@n%h)-7bQO^H>Xu>H6|d9=9$^^ zW2L{yOv^gvbn(Q!&$`>WiDS*KcqdQ1RVb|l8GQ-Gm)|fgU_p6vqfSXM4zaR$#9dy^ z@Dwq~(oYh6X$Z!c;?>9KNi%G*r72*cFPHvVVY*X#Z83)3rJ%$X+e}S-EMuA;x_dNz zC{DzSlM>u0zT(R@w9BP_OPS~}v2g&o1`)Fd8?I<{gAxPk=-YOBkUaINqwo^#FB?Tf zREr7IFbi19L%pJ{5Ea?uwJ+z<10n>3)9_ciTSM);y`G;H3|`$4!l8PX%=(@s>GQ{P zwX2IO@P7DaFeypBo?=F2&!;!?TXx{!`;Iav3_b=QZ%A`*qlmTCv-qUaw$S<=CxIu~!V&bOU7Nf;>-UbkrDoq3H+KcnrYXh+o;YPC zkf4mhaEC@<$xPp2X@EMLbt0gC?P$sbFqeL^mz2hPwbO&e@PH=~xwCa<;-oUsAefMvoc#}fF*o%mh0?{W|d z=IA0e3D*Wycc1z~>+imayo#AL_h!y>J<{T)?Mr0=2|pagaP@k*9;XCHzJD@dI16+9 zkUR3+Nj@8171vW4N}KKspjHgcax z$Q=qqbaVUw?K10aij#3jv9J^aXLPM;KJ zj9zC0stA9lh1xnO`HR_u5qTssqSP)<46rgt+87XtONmZ4r7A>_fw1^*e+6_;1mQHM ziC{^C3^i4*zI4cbYL_B`CzACAzTRqCId$q@a%wL;YVUrTTYM{bxo&#KzqG}#_|@BF zZAC&O)ML8HvZuVrR7z#{IYW&&C-nsLWM%X7(4caaXfQs~y3mB?b?2=-gn=r9SHIZ1F-9Em*XZI#1L{Fm8q)5_xlI zX8+Ht)L@T&#TlMixc)Xor#EeJ9O`$zYAQ&P*ofTUmyn)L3X7!z40rm)=Q%nKn*FBx z=kjR)!wsBK|5!x}IXD8B69UI(Ushq)m3a2M>UY+C$zc zwI`p{4$|zsQ4nlkCbkFYcJs1%)0C$%hJaTSs)eXn8Dlt5lZ{3kR&_Fg3B3S*w^QyP`1dtG~5kUD7e z_O=3d(E^2G9}TgvsjCPLT1*u)>-Y7m$~y{D9}Z0;^{|lACBJ3hPVy2%o-(KZ2vV0g z&;38z%zK{$oB3JwuIjw_hSKqatZ1!E_~~-~G&(QJr^MV=&A%p5eS3tDSwebhwMQ!m z(n*+b%sPZuiw%mIvO{fsa9P?P!^jO9!!q1?3s2lCD=bYMV=`8BkkPt@_@(Y=%ZpW0 zyJ_;y;ySQ$FgMqud!g#?11d*5En1Nf1EtV2a~{FO?1NF4(=smbNa>dX%!d*}66!|h z-Vw@pB~|ggbq)s3-JSSm3)M8G^&E}lsxAPR7RfVRVWI=UCDd)c(IquF|4%YTo=3sh z7xw~E4O|Nu|H+tIxfL6Tw}L?o6^-$p6JKiEJA%X+SWm2PGQlHUNL^Y^Bk7Ba4|${h zl}m;asyo)EXZrbs6vUypWDxxI53xKj|6@aBGpZ4RcF;dj4{xU~`zGFV7j|0jH!Ld70JwRh!KMJ?U-nm+C{ zQ8$)ZI^v98D6JZy&p`Nm)o4kN><{{SF(s#{#y(5VwzMivwT(<$j6JZq4urkjS}lS^ zTk?Gz@nI9ibTp?e^0ihF(#r;6zI|A=6cszQ$4Cm*TuQu#l)>q3s$P`=d^aQK(zNY03eK+y5%KL3QejAb7t{m>Y{zfXlHKAqgn5?V_08qZkVuG?RO{S}xLE9uGYX5)PNo0I9x>D)3>#yX$DSJ7q18er~$V(O+Rww=L?7mMK2 zhHKImKI2q|U9u}wgw14HP|M27QoiI&-z`v~a+Fs`e>X_G*Z)oB68lLQe1M_EOZ$B| z`4DZ928Gw`6A<{tKEz=q`LEv1@=N}*A;7vUV>V!sN#yiYy-VOQ$ahb5SuaE_&v0py z)G@YjhD*k5s-z9^A?0N0*$=h;@pU+?X@kB)sR5W*PCd+| z6X;%&6NTJzKm+!G#^62R24(HX3!)V%@~S}!)kVypYi?tBbS()wW+~CRxw+J$MHu+5 z=cqQAU9{sSXW!yocpUmr=!)#Et5FUK0WNmHOXE6h+mR6TQ-}u;kEeyB$9x?NB*yzz z*Lk$*w%V;S$Mv*qloEEXx6~Wo7p+wqzzmB1dztLW8Ae9_j$C=% zA5WINLrA$8{)3M~tZ^NlI>+eCy)RnWhS424-(n#t5L`R!^zEDc?Q!(-7j7llU0F6T z+}@T2Zk;{X3-xjrG>wlu;8ogFjo+p)`WZ~%L1Ak%;+~uEnCL@gJ7Vi5SL(DC)a#Jq z%W3mM9gZ0!u_gNEric3JHunciVg~X}t2mZ1dvHtaNJVaX$$(uia+%`#*cWcCS}>wF zj*Je&Qi3iCEUEWPNxj#rTR4uqS(vA1!`M|~fNGDiyxjxg1b1LchM{8OMSR?LlhsMH zI^U0IEub5tXq)Ytw`}cx`nD9-gF&4L&njeT2<)fl@Asu&DA=pyn%r;3KcJAter%c*JJXfJO=BJoO;?a-jH7`LZnQ-EoI+XkH zmlWF>ByC>7x~-8M4KC?bDhdq@=|UJylIE+U4PDa2C8jTT{cI~orNi7I6L0f`NJsX; zq4&nJm9g&X-O0CXiTV4H;hp7QEt$*v`ha%r?7X%y)%9QjHmPMpwo;UtcJ|up#yWh% zr!}YsI?TX2s3;9%ZB*Bvm615R71POMKA5z>MR?ZD5T9;+;O5nWt{<7MM_0SOV4|S6 zJCI)1kv}tR)@Ga$eHljFQg($)#fJt21v=SvK7iY3Ao+>a6)9hOdaXgn!XSaHHgpR$ zA^P}4bp32lF$UY4Gi872YK4^QS7vB3;tlY$uyMe$>^5W_m zcOIaoQ%0*u0sRMw*S(Q=pBJ)F+7DT6f;VI*<5^${XBx$GsUhev@7P()Zb8IA68qpS zi-}r1&3$aJc3Iz2d*1Fxxc;}=icD)A0+6fc`_DH8cz0HnP=veZe}A=obpz$kU)N7Y zGp=9LzDJ{a)VgGm`zH*_UC(ZXaO|zX)>`f@>gyQ28?q~kzUTWHP~zAqJjAT}0PVvv zCC3831wVgG(b#-mr?xFL-VySC;nkcCbZX?G@J)aiLhnh+G;X0x=4Rf@bwGP*CJKZ#C7|k5PD$r>{74O_da39OW4;D1sb^#-&cP0 z=h@XMzO?j*G1u0EQGkNzuH5yr_{C1eC}dMbp~M!x+I^7ly~@+z@V%lP^h#@y`!lc0 zkkCEY+Hsg`jECJECqK7qf%sB=eYYsdxmYpeOH-esS3xmE`xUtd%g9ES&L^^rveTUvBAbRyMiC zGF%g&UIjslYsB9nk?c@v#Aqu>hf{Km$mCT?x$dCgp{Vv)oYz|NxoNsD+v8UJ=bp!0 z5;CnNhS6ig$@6L!>Ub8d=qdV}_j9b1#fwN!2QI#NKjzGpd-gArn_3#v5NvE9!b!d3 zb3jm-R|^TJ1Y~l?pYeO$1Fn0%4xrJE1r)f0>tD0%QYSvi61z&TC;b@pwvTuX^X4@w z-&WL$W10ufZ~c^AVw5RftVaJq3=+&Kl4t|1sr1>Y;lYx))>5O6d*gaWteN=%HI%1R zydSu6LK{;*TYrB*?Mh!-KjGq}-CP{ANpYT@>X*JVF;0tPJNjW-gC3SHFImI3FK+`bYJ8Q9PDd1p`K~ubE{y@q$Tga&7ygSd!r!=wG z#rJ1F@o3b%7MR^+JYR@sFxIDv;Kn!r-Z1vJhk(?niOtaZUM}U#)cUI9)ssGdE~%w zBh%I&Z2*PtpPkXMeY|IWl9o@T31%-Kr@Zyc#J+tEpashqVA{VDM8<#h!!KOL@V0V^yNcdZ|Udqq{iw_Q4uM=3*s$0LYSdp1t8#xuQJ zp)ddblpC4=waXpGYI>)ef~3Ihy-FXB^Y1#t8mseuQr^$4k57r~+}wI_vA=QLuD&p> zLxs5s;$g43@%c)%tpca|E`E~C2aPf_TavaZ zl>IbyVhrujuA3XqX%mkq)9KCTi!a0xLg-C%^~l7BGd9*}06SeyTVe!n7e7x`K#97<5Ee4a;*NX(zTeHIz*%@0> z!qwM6gbaskT!0s!wmNyLxqvo7Vrk*lEj1<8) zZm2wzGxFrh8mkiy z(PlqsEGXB1>$hszVjYwq*AF%{t*v0|Wn}c_b&$0)tKJhYwi&$&jD~sNPzl$&%V``O*<55RX2<7-pivgF?)eqjtI*&H0FT4P(EO`b07isSq)^ysg>s!Xr(Lu(s zptLwL>WB&|0#Y*$gQy4y2%$$rdI?1cCB=?P$sht!qtXc>w9rXZ1e7X-gc2Y?q$MPw zB|t)w{loWNd+qh#>p0f2`F~Zum;;|Y&vl>Id5bW})Dr&%6ZcWS$4hPeZ0HKGLN!0i zmtv9MW!0jAx;I~RQp>|(&hQ6CZcLW2rLX#8l_N&43@p!9P-rzBedSNKShiSh3Xr){ z)>&QR-Iy_{A)WyXZB323W3W+5=ouXK%sWSRy&Z5a!;K>i2w49;MTW{gh0r+ zDBnf9j(Dx0*8e&$x2FP4{9tmhmGB|Z9844qM29j@0Ay%dde$3rd41tONtX8>3BBdpa)%gr~os)g_&Eyk9*iy*)B(eETW&X^E^mun60CdTfY`d%jpmj}b`kQr-F! zH1mYr4-XlS28lo$fVk5^CtaE->I_xqYjzFsmu};H*zK6kq2c@5k zk6`$}*e(2Z0VOs*#{~XK6M9)R5cG%CbX`l!jVn#c8a0g~<;N{fS+la+L92cl9a}ef z%>4e(_T?pmPWke_(4iOc$7LgQHBZVnMU>IkeTw_H5L>i;?_Kb}kx)V-*wO+$1YwnK z+K1|M>%I&>%cv^PQxy?xb6xIzvp<6Q!E7yT6qluF?aU92oa?C)+WB8maS_asA#UmY zHg}Ux@fHiurf2OsBj!CC|DYFnScR0ZqC2mAoK_Ct;$@H^QPq+5z!4c}ZBQo4*mD?V z?{0b%y0(L|^emheS+RkP`~MpmM+4f(D%yE`w;Hau4n<7jbO-qP21eZG$$%p37_U(! z%dkk6pNy$zw+S;0ARy~)Duq;S&x;-g`NS;058WJk)g={7gaf-XIN{caqM(*ztH$K- zD~g0txysQRuzPtW<$&rN$XC?E#uG#5aH|Jl+CYrxds(}F*Jn2uL@U(aSE+Rf^z(#= zlf7&ByL%|u9C>K$yku{a)ss!~;-?=Regk6m8ej{{n&pq9h-ok9Ix1)3SMzCeGo@+X zqaT$Dtdnei$`5^jXj%vjyr>G|gm2MrDuW5(&Qw=)7&$+F7XGjk6WLYH?8ug;-H)G( z_msBZUaikc;QCXtc7j1yiFcG-RziZ-_b9V_=GXGKiVF#g*Sn)7*`>eVxN)d2XhlS| zjaI=cgb{H>W%zA$h2tZ~rqnQKe9_X~ky)AHP$CiixRFyf=bwE&fnrf9U!mC(=~DKp zy==|2i5{HSZxJBASJ*+RRwilzR2ZSWm<poh6W;onURI#eBC z5M`KG-bx5{y{Y!ogz=P?Nepr3oEID>N%PZix-(taH48y&1I$QkS(|b8z z{XXL+@8u?u3dpwee-gB}^lSQ$OkN+B;ATHJ$3ryWh|JaHb#L3)!uFN#dndiTGYxlM zT6$w`Ow>prt=i_e+>?PGGl#xiT5Xp4-$(XW`0@5H4TxHey1n#Q3ZhA;mcI71Ur1mb z868fN{av?iU}ZYdy~K`H`Mgt7n$3v+8Qq^?V0_(#;XlX!$}c?0B-GV;{j8Eg>W(BC zs;}_&a%6ooVYUpz%-fj)x|-O+AhURO)u|d?(>*yiUpTGes%_isnXQCr6v-9w|CSyB zFMslxb>`bhGYv_X@}+_&6$oOk>2-4?pORnGwI1L&@VVPe6^Nv2vh=T*$X%Wq*B5yk z0j_U?mZNm_{Ek$MTxpB1B#npo?b)_?1;;gqzWpyuuO-?42OKWi^UqFY_gh(;e1#@# zoZiJtid&!vGh?4OK@|skM>9g5iW$!`eH{Sw5Mn>8=@cgM7jB&|D4z|I(%hxZb&Q}fPXm-WD&87;Fq~Dm^ZW$O z?Xo~yff$^Qwb1rVbuo9m%Rb;=!JrA1X`1-z^#rYCpkV|{pr#Cj{bQz7)+g={DU(*p zzl7}Umsl92Dk&(UFBTJPew+`6Nf1qlN&9X_F=o%%bjdRd*Q8}CoSFLpfp~}o5(`P` zhm&h9t(|$nAW>;RjgFcH%j}=pwdcvafRo=JrUUEXr!@!n2+zE!0DZi`)$YPb&-^`P zOY?Ny+~XAUg9O(QNthp@mAbndvV2h1{TSONT$>pVuzdduPt5o~@x*1eNm7?`Nc(s_ zFgXAhhuV1xb4{Xdl`Oxa9+3rC^gRsqILVTioVCi2;-oWzO7Swh8*UTKBWS+;ZDkxCv`w(-ZY|s;Daq!@?Unvl zSo|av+43vjI$s0`2GM1-rK>y?Hd3$wjCUvE9zl?0ee~eL06+SAY`?ZUQX}FqleKCb zEdq0{5{{KQ#UUzqGA0SmlBN}ffqqF$mvz7I`e0ya$z5miP+L6cdE+>&4#XDUXAOJ} z)Gy6me`K=Aaw&(4Np0*A)Z`&xgHFNjlj7#O2Btte-5jz0`_a>UE&TL9xRU<+S1Rf_@CefUl^~NAcf;|7ry_rWkatWj-RN~XNZ}&{k**zQ z|9NFAEY7{_gFrs5W1Dk=rlHJC%Qd|$g74{HYqal%e3-EX)GW59(H6x=tnZ1!F~vbaerCigYI zO!wPaQf}?Od^(oKcwKlhMos8L;AaRZ+lA0&8cfc0KQn(L+XmUDFR~Ow-b|Gpe}A0P zE4iImeN$9^=oP;mJ|y+2cttOx&_*sfkqko{fe9Nfj#HAD!htTc(0C8yP$IJ7X5IE88*g6NfvUXfXf%l(O! ze(YVOCC?q7BhnpSE$+BEMlTd%CA#dIi6|d*{tPDK(5gU`psJe07@% zAzkwIUQgq~VTXwm(PX7x@_M27@_4IFK*NEizmbGfy>#=j`D*M*^r71>s5i3Gj~mEO zVv52=6%pBfX)!>Y`zuFLYQL+M6tc;FgF0{we~Xk|sMPdZTUKK1{koo40>V#eCh6f7 z*Ze7#UP6a<^o0ZPCd{A7qV!I)YK*ETgae(M(c5uWSIdBkzLqB5^RO*BYxFc&I*8P~ zHCP@xSfw{1fa0}*0Ct2N*@p9<#bt%Q=fX|!OfyW80iVCm{R#uQ*u<-Zhb%`4&_XVG zqW7RXm5evnL9AdG9Ds8kgWx=8k3+&ss$tfm7VgTNW#v*YM&wHL7anw3_Hz8eWO&wF z#iboWpS>WfG=!V+)V@GE)5ut5L8_8?-q~O#}?^`yQ@sYo~xcc zsh0UhV+tff3hWr-q1oN;{7u?nCD)IR{)ukbr=$8!0TqphZ}ZKtOx2{>9hn8nJ9_qd z+CX_n{Lshdt4%(-6vYqBZB@+e+GVo;HP}uDT+gcyt^GPJL5})W9*gE_XUQs^4O|_( zODx(Jk6DC<{{7I$XF&5m330x?H%0<*icxPxa0Cmd%9UCIyA}``gTVZfl9v@tYD7~T z?&u0b8QQ)ET$mqNSRKEj9oEV+ajqD@kQpfP=Z0~B|-AT~#>mi=!|TuZhalTli%;SnfQEn>$IKSC6u zLh>~5hVNWJA`kq@{eb41D2n0-Ke9>W)0Ov$CqGJJ4^XPJF{~`S19r$sspu zfD;+vf{X74F4MBu5znl`$|kv{hM}sJc$Hv@4Y@FkRhmViEv*ep*J^O7&+%cW>sBII zuThXd;S^2Vog>XV$-EP+RkI3Bu5c4C7apX)W%g;T{Iv9C@tM^q)eN@8d56gBe7~KxO>U#VS%EY;) zg(@gsbdMzV9;s0gFe3CLlroO%Tu-gWCZNT1b=>(j=FSga+aRn{3FlcP-_;klW ziLiC{(nU}QW$I6n5n~kiaGiCTT!zxdIG*C-%)swR!fU^5Es4nrJ?hjfMh@eOg)jV& zrYc<0NUAs*FUj=K>um{M8G-&Gy({ahB>A{eA~r_?WbCuodkq3Qg0u(3Yf)7>)E6&i z>INO+I42w*yk+OD#8$u2JrT+H;fh&`bdW2P{^-d7@UYI_&AcSq*Rg6PSx&s)zsJNc z`1sB_GJPj`4=AM(xbW49<+C8_0n0F3Flh9xsvtz*vUQWLJD{0ngKCVn!^)Reg7I8d zxj$qf3MSCR-Pj-x7yni~fhLT!2#CQ@ zePALRkA56+AG}r;z`@-C9A#uWp&hw4b^D0`T}kz_J$p?U3yuf-oq@3ha_kljV1C+P zMVULDvEt8>e&HT3s$?}E-yLyplpyJ9jYzW8+x*ErhDDGGE(^F*Ev0F>PQ!|@Tk$_0 zhH}>0#+PxnTFm~P&^d%r`0-U_Q$AlIR?5`w^;}q;A;E07_h$3L(-)?o_iFD2*DNbJ zvR|Y{5Ro%M4ca%H8}S|Mh?$=4&o!Wy0a1~Uismv3ddC{y!+y-z2MpnS4)3xCBd zJ<2i9qJO;kP|re3Fgx(1z{CjYrZItUS_sa*t{Lp0eQC6Y7f-s_aJJQ6+R~jLuPBaQ z>8Z{dNQ@9n&Il{`OS2rYXtqyOLH;Q=%t_+uyOr8~YUXtQSb~#$v+zejY-_9cQqFOp z7@%Om!yOHgXJD2@lnor5O@K%YdA4m=<4U0Z?n|4!SkGIKrXdis2mH>m#z@W>d1zq+}>f)5EH!b6Vx z3tvpND?Wm)^_Pvn&yOQwG3)ODnNCXEHx=qNIC0)!SH= zFWBDH=iYdgcj>%v)@=6mu(oyw!E||3dfa3~amaF}y~B{azJg)0N;T@-Q>92S;y#xGJWVJOGwAuxltxaeg)-y;?i~Dew+>5sbLzbz zCMfF1+hmTMLsgDn&c_j$nQOG4 zh%3TnsZpXcpqL6NWo7A0JhK@3x)>4u&Ao0k)3KJQQ z;q&vBtGMJfMyO48|MJ^x`5x^nP#;I_RcQm0)HO5E8@tPJ4 z&SP{v78lNI`vOL9{Lh!MJ8BjnqS-i+;g6fkwIzRzk*}AmTwq%_B@6QLuI&zA9xv=$ zBf9_nl(*`tNl1e@%G~tr{x3*472a%958PaToT?K;=*S{`gL2h&Zf;s;q&f7-v1EfP zXMTahntSM!wt=VV;54V{iwgu@rxvE4;-U`LeF;L_DosKd_L}|q*rbZK-8jR_IU3Qt-5R%}hD6Q1fB+>wP2zG$zc zrs6>HV%J9e(p{%14#t1NU*uQ_>OJryB6nm`!GXNq;sxFdV&*K`@NRyJ|Yt*655Dz<>8` zSfC1%KI!~;L{Gf?&cU8gfV!$YeVKS#JW}@+sH_9q&(0C~rT+%Q_Y@?mK{%_ca`d0h z`jHmaoq?0svxX5268CR^?yz<{OW@2fO|`~!FKw?Kh*oCLiSZIdN69E`)s_)(G~gC9 zJIfr?&|B>XPjwx+42tMkKvYCcS|B;~9i`M73mwLoxI{&3x{3=;ca$zo<4F4&6}<&? z7k0A10;Chl1G%G5%EY~Bk|z%-vq9MlX>a?eg21Gnc2_>k{MuC4kP7rvQyBjBli?`~iq!Bc z_p*813*nsKdyuX#K*SdNuHUsbIUp+{c<9KHr%YAeyk*3bWlJHzd3&a!Dr=>P_?;aD z7XU!GP1*245Y19+o2hhq%WB@qMUreOAr8tlAvYSX!=05nD~N8Zwaz}qmCT}~$Wea* zS^xeGUZd#%W{KLhchL^3&jFDA(Bbw&izWG?#*1WpYZVD@xs>ZlMFBK8OJPEvoeFl2 zGT~~F6E)FDF;h*-b8YA@^vg(vBr)R3+)PRh}M8$Z64w06H{P%V%as z!-xS57IPAFC4m?*JactL0HcW={}FdyNuaUkr@Gyv0d|FN_T_B^|DrsHpPENqIC{mw z_-sfS_4U&?#4j`%9?TA7Wc6oGRTjlCrJh%e_mAfNSWhlw4+Wle;@6d#vl%8dK2TiK zMK@*&u_OhhZQ8D~$|teo{VLQYh;e5!-Qxpjy^X%sC*Ak^>E=aBS_-H}?3%tIKP_`*<$DB|d&sIONbSUhwM$PoUDbrjnA4&j`=5Sy>>#0D8+ruO{uT&TG;BQngDUj( z=Hpg|6DRMO>6Lr&los+qrYokow023eu;bSQp7yPsVc1-CaEOJfgV4e_hLEi4SXGkF znS?J5^gS?a*Y(pjuq<1j`JEqX5`=|&pEj{c3UScndtLre6R_aWh$zAU!)LPHinH(? zc(NJmYI9m#C6G&Z^s%?ht?s%<&>i-6rz)de@Gsaye*BE63x?w0+xs>lzc&VQ=4*V#FE4B-vK6`s3S=Q3tr!(}sSUh( zckS)*fOycQeNqx&2-W#-uBm5iqfn9aF_R?z_Rq|CE%rt z@(aQ>qLdlMRowp3o@xoMr{JbcbfE-J4sB%3Hmb+%9x=US%9t4Wd~EisbzCjr3r;(P zw_+JL<6&xC(k*{K1~!<};fY(n5_{9OcM82#GMbwem&9aCo(|&WJ!y z(Zm!tu7Y2M*7_N7>;h>lfl%U6xzaM(A0G6&+jX_~XlvX^aYXnCYU!Hxjsw^-#C~JN z|5vo|XYTtW|KS4o{$+qTI*(~lHh|lQ?L|eEj$|jy`W86pX*s^tH!;3Pr1~vQ2)rFi zo}`C9kfNiS))6XUD~xS0T}AcXfCfxa%cii!VgJW{pRc*fmiGUF8%+kf_&b}Ft+VJR zj{T8+oK>#qW>DvmLaMp$$yD<-Nw^ng`t5GegJ~ zp5#heHP|n+&t}3`QY-DJ>5f|E&ubLhur+2R)FFC5I@<>=} z@CDfLC`?)RSm`oMsfrLOEJn%eyvlHA8VUMBgsBwG3(laRkqKhtnje=KWw;ZV_xRsu z%m$Trp;+D%V#SLHXJK7RzyQ+mzBqj(=?`B(4jv6drX%wr9P^%7+o)+B3TgD$^|^jI zwW^6wI?}|7WibTVS!IsKt=q#tcU3;fRY0yr-(P(YNd;GF%K|;TL(|>UTi-aR|54#I z<(eTtSF0uKoBm@YXMX5cZ=aSpy5x-4;+O5tKuY6Z+3Bz_4!bs@lO_Yt(`b3rwYu&S zA-l=c)_fyi;a$Mibb4MHmH?;t>V)AhT+7du^1XezY2PI()Z(fVEmt--9q+tQ2-)Y` z?iaXJA$1ocw;=i}W<#Wgr9+MiB}wrZ?X2o^A~Nd>GZ}@g`)lUHm?S+*saw^(;Y-Af z{9g|JTn69o@YK?B$iiFHQSgxedjp@EVIODRvb8;vdpE#vir6tg&cC1fvE*c{wfI`A zpFV|iW#PNhij{vOazn=1by1{(oGFyxnI1c5Js)*r2_<+9X`K2iT^EsbN}awW!<+?` zdu#mm6Lh{7+O zVfcO3An$~fke5Trq0YP{e8(d9&$X`#lexoWEbarh( zu3o0JwQ_Mv)7D2L}GBTZs8{>H4@jqJabP{iTb?g~t7U z&C?mpylcqpZ^*%ox~43a6&WuS&_^x1yjCYKLng0c#Ek~N^IJDH6b7`WATt%zVMuJ5 zaU7ghkmGN5ZmQs}nJMe5qE9SF*-#yr^g21?8*!I0E*_>%0QXSeq%?L)imgtv)8DEuH9255s`VP;L2?(0k{G0I$5HRj z-(In>8?hk8Mm8ao_B-qqGth=-fA{;zXlY1wb5jEk`V~Y8C3^}hqVIQVgHk?iP8mV|_1RV-sy%qFZ&z+f zKK`>og`hK2Q2*NFH($dgSM2s$O$S{{6XtEZ|33g+QQ=DMz~M!t!LBY11e#b;mgN=K zVFvx(>uSxC{!tPi>xQG9LS~K%`Vx%>eF~l!gx;zK3@CH0-Q19G8(l#wi$UOsE{n)% z6@R4!t>9gqCI>hCvk)uldb7tOrwLk$sgk9*C3ehiNK#2pdizn1D+d1BiFeTbJ+slj z8mGh;H+`!9PYT@Te^cQ2x1Vczs-mNE`mYrgz!3kh5V*wfu0)z(vAYQ4)sv}A3n*sW zGGZD&4oSUKA{?t3TE5LDNWBY`w_O8d?WxM&gEkjlp-uqlEF&CivHZK+&@>{iMNW*m zgF$n*a~-!@II@0rj;5XobMXhkcJX8eJp%}z#@TT#yCb-ZG5kO4yDOn?#r5&Mg%3j~ z&xfu9AvX0Vt+Rp4QB;lY`3P_FOyTpHOJ_j0mO(V6g=i~=zrj}t;zCy+C`qpJbo0S& zj+pHu)grJz(5}y(SrV-x*46OJ%Pp)1(vS*%c+HML+CfB8_os)fof@mp5>EA5J1^H% zylt0pfC1eX>e3Ei8X_bO;Ximvr@J#LOAR-`!fsf8;4pI}LN%kCaImt$>DEjP4{&C2 z0sMBw33fU3#~P>lOl-Fy#N2uQ!bnTVsByD-ls+}P+mwn1+r#HSSNEG9& zK(idmgbWY#Ut`>hX#At#qu0fD8T4b3$7-Xe^e-6$$vXqS&Dxp$pjJUo4HNeZyL~s9 zjmPd{^DW-uL$gTC?J+PHzKMzUOPgH$>iVwz-cxHq&C;f6| zF^w0@$L=`$0^xMMH(H^7P#qC$pSwx#kMz$mP@F~Ahu*ZHVe$0+)z^X4E<|o%#<0fA z{Lb+RO&VL^898DjcU=!5W3Ou;>SMJ82x6+bB?g}ZaOHKq(s!QAy#}4yQy?T(m-S3P z8`h5KvEJWfsrRJ0z}IfY03X!1t5o-hdwq9M-oH`rK1SrO6Y=n^nT5W7yc)BKrFRd3 zf<(Y}P7rO%H)`Fomijau($XqdB-&!?eo*cPI_{ekz8);Zj9GV8eykh9Ygr;o>HOZAQDo(++{44L?+A`h*( zWr%2C6j~Eq60qt!{Lq27Dsfp(Z>kIcr1ALZX3C(>x5bZ>RM`gyv6D_Ttq+ewgz@?O zRsh>%?hHT=OffHz9hTNa3X{3lA@*p@Q}TS_rn_sqHmb&%_VkMyMQrcW!QI73w+hdr z&Sy><{G0hE?|s&K)2A`NzWBQ!d~VijpyWvnFFka{1(<-_tQ(tTB`sY2`U*DP$a=m_ z*EGA_TSc1!bUK?3_8q?(6N;q>f?ZrJzX}y@^o!h+&R#}N%H8NznJ8p;UI~D;SI&mj2)QuF^~?kT-J!M8u)g>@ zTS&F70@s(}KTJMo)JDwAqTGbFy?~aYLi0?f0Vs}6JSyVZ_OKv~)t=Y<3|eIQ4sbQ> zKN>#m##W&r1JhNGwXyvs1uUdZeUxGsunVHDjpY}#;WZq1VnHh-Oh6h&3KR_SJ4WV? z9mPZ}D4~h?P(@$#xo7D??oY;__pUXjN?x{{-CTSKs5sY1O!k<2ta^(+lT^IW?6w8L z*F0X!y-GInDe^FhrrucEND!m#y*Cm>Kn>0V62zV>T~DuM0aKueC0<=olcYEdu^z+u zAsxieaBoeORoeIY^8Dv#W`!rkFD#Ha<+!)DIN2z`4c;|<@$p?#luF|hI{KCO*7)l5 zrfFX(e@9I5`a1&-`#$PG)XcNjT}9(Vx@X02Ol6!jDqT0+9*Re3RNM;D|Tjttc5~rRDa8 z4m8D0z6j@$(_Z$G{abOV(F{$uAA6VbBg}>DH`Of~SQO@I%OM%dy7c0kpuJ)*6KN)R zy`*uiZJ|tEP`y=P4Jiz)HU1*v81;MUFHr$Uc*M+%d+JqwtPi(s=dYPgbJ(4W?1J?M zmV!8JaUQNTXidy`-l$93%4HZ$3dDJ9v1AtO-TBz{m91iKgeI4fIS8ssWbF8)mQcid zY}o!UL3sJo_K*?DxM50#5m?R3=v2EA|C%(x0sG0DZA?kQu8(o_%nuQ;W8xsO6IH zt7WQ>s#R(_r<2v(Ocy@sb?DUuDw#iVrz*4md3q*ES7CjIEPEgQmFe9*XD%b?Y_3BC z0#(VNltQR$nPO%E@68PgoVj)K$l9AB%n9EcgJG@Aq34~tS4y{|&P6w}XC?LV?L+a4 zBh!7~A@Bhr0D0SQxXeE*3>i8(oR)qfKg;)<+k%0yelccZNK|{}Lq+_*-n`Z~+tZ6vsP` z-)8-O$`Q(Y;a^|ESbv#gLAD$bwscQF_`F+;)|wVyP}IA$-)R(rPE%;fFt>66kgH-}}w+w8e8Ep4&TGPk02ICz!IcsK`; zJG4~PY>#r%X#@ArmZt7A#M_yJ*P=qPqA8A;JF~H!I-Vl?ZQ|qi8VJ|je}Ys-vyu<|)Y4BTy>%QAvA!**4Hi-UCu)nEQdZj@4K z|H*-yuUR-A*}RnfBm(QkkFdeHvU7RIyfO>=sv4=D_i35 zhS|u>;}MUWAf`=cYR-=%T{!CP?htuOEy(8c3Ryhe<@*y~ z5$6^Z9V~WZYQ+4tg64y!nYWa7LtUB#o#E%|(fuK>blR%)gke&K-|V0WVuH)+gfmd* z1nRU%AmqM7GS7=}xgz7=Rx-RVmQ5fEs?M9pffoX=O4xF(pm(B;;QS1hZ{%Y(rcW30l&U^sT5>th*0TjHj7pRym{{H}0`XL(c zfqDD)8}2l4LuWCnbbcqVIqT7?*XXaGAVBjpyD3FKUc%Qu-i=?wmNcoSSfeVx9KGH+ z1VC>oUk2kv-K0COsgfb`6(>0P)_Q@*brNfK#|P(ozt1&WAPY}ET7%259(;SWi#$jF zQ<4u%fo%=eXIZ2Xo_4+Kv&KRAewqur6d;VUlNCCPrhXko_%76my{qHj4K%|Mj%wva zHthmBiDenQ&VG6bCm&NkThm-&_hL{UXEZwDn5GZ}{4_tYSfe*D>r9j!hp*j1=EF@rgQOeh_SB^xeSKX*gq9U8F1`nPAB`z*F_ZF>K9*S; zhbqz3Un!68y(Pz;@;3QR2I3Q9=7l2uiw9p49*zr}1M0)=js;>^JCSEm_Jb$qnAv(N6`YM9RNrvkn8+z3m>_pOp`4* z1W@2lBiO!@p4+U(e|heWO!#2j5QB4+yOrw{@0<=Y_NA9D$pBI199@j1$%LWTMrdNc zQd`urltM-??=Lf4Jr4 z(K}YD$n7}UMhQQRHM(9@v$bY^w{XwmAunLd1Lnfd9RiitLHX!~kXHAG^@LNy9i;#& z9{(L4ClO=bober1-m&sEYIt}mGV8x@GyD&K`kuFI-6SrNpE+KGvk&H1u*;5JcU)r4 zcJ{}%PJT_PGW|?)&TUV#P5)4093*~j>~2BUq7FFlPDORFZ9TW1lZm@6XILCM zSryYY9u={tA*Zm&ZQfr$GZny@2Q&*%l364o}@rl)jbdzOhT(c@WUf z-XSce2)92Av!l?=kt>2GLDQwzBUoYGXtZ)GoL(PS=PdQEKyeyp>1>EGaHNy_49Eyc zNh?2YQfX$eJ&31=QSXB{mPA!ojAdwz$SLvjR@>>Jk*ayj?Dx*CR&P#VRzhwNyl&ux z1e&hX;PgXZLdym6O=+Ly^l~i3JD+4(8ci;j{DmYaM~YjVLSas^>OMYVrojM);f*eJ zIdbs$7Lhx$YqUo~ZF!*E*_kIeyj%llRR3|gv7sMt-_{N%!VS%%Do~A*9v%$J+fjeB z`{U*UM(DoPL>V3{sV}rFW&T2=N30X;Wgprf7oxEUUVpuRsocV<$^I|m3)K_{BZl7% zHV#4)>~#q}v!j35B_-748#OOp5y$`*Z0;)zR6O$vAWHL^ghj7GTpFBs$SQ0GDBDk! zQ+OXZTkgcy6))YclTgqZrkt|e=Y0a3CJeCjILc>YJjT_LRk%= zUNh!x+`>#Y`$}P*w0}g<>c&;IFXZ0NU%Q4iZTq<_E(Ow}`laqfR<8~dEb6iu{8)jK z9Y7Nko5t>3mU}SuYNzO9YdeXUePeszZ96&ceKEH725P70wfI|Z_2$!1=_6>1W-Z_v zpPbb*EM_-v?lb58q)+;j_hX;m{a8}V;1=%Ft3_S(i_qNj6={5ajacpy;_4EfuC<8DC6_OJz zoDba+NY`VQpzMePXiYE3 zwCa^`&qG#PJJJT0hJM=5Oq)=?Dl;JMMN#Itb<*d;rSvatcwl}s3&|l7ioL<2q`Bb! z-j%EzGUX zJKt8Q2jP>uPQ!n$#`FD1(V+q7Ef%Y1$8$jZX$3sJOK zbW}4A{u`Vvbh}bg0j69Ux#Je70K6d&K6wKdyNo);Pfp#g&%v2+@a^swPAASEqV(ck!#!r2J zgM&};%EYrUnYnD&$U^WTFT&fC`~L{?Pn1r*@51@JYWWPs`}U!Q&Ik*bdP*PX?a6Iz z=O+a10m7$yEvnT-?kOXx)!VY)paMty4P3Jz?niX>X0N(|0k~XD{iS%p1|w%8-UsRW z4V(psx;P(!H-h{LWnIUkl{5L?nCnkTMQB(cS6EScJ&nR#_*}kfTshkI+Ec0Iv*eFr zklz(2)xV;dlUI_5)+$T95J8NC$Unjr;u}e8e>Gl@WU)h#hn$i?b+Jruv#Jz6FW;Ki zFFA3}=bn&&-^1H}X}7ZCF;Y+&NMF@(EeBMc-kF&Uq;AgP{Y#hs(TQ7OBG73V3c^<$ zImug6%ZhChWJdQw z+Gj>fv+!@qZgA4BkKrZ+Po4As@RHuiv?lf~H@5&A7>n5iSwZXlv`FILCxUCtH4|Z| zeqND*y0*B}ENWK13ItfjpORe8<$dW#JAW-X`D3y$WMYCat--%_Eg#w}34{UTI_KHL z>g4RQL2kZWnV%}uFS9$Ajunowf#n_2%hzOUKUSHD^UY-;4WEmSHD2qrGh2-2)f}oX zP0L!mkRmR)o^*zy#fa2*sW@nGZ-BAKFt0gH{N#mAl6~h=n*RD*LX~cE+(orvrXVV! zt|*L;?qxHM(e#kiJRCQkP991_9f`jzhpNE68IH2GorWGCNk+%!=h~~l4`&e76%_a?!D?cQwe{Fp?L)RAuWw-Xoj0e0YGHBQXT>+o3e(hWy zTq>YX^()(FMgGmKLzgw2=vzq&@#ut9xDz_>i&^tOZ@n&$rg!}q#yO5O5gRdLJx6cs z$LD}pgn-FW>nrIwbis1{s=Q4hs?9w+pkG?~Tk+!@@fA#%UD>iZAcH9tkJZtOtej<$ z@sO&w9yyNMw&$Rw;Wc*bFE8A9iz`A6U@=MEDC7jPUzD2}shSWxQ%5)YYTR0){;Qxo z<9oIa`@1o&tV7o+K^$#E)y0-$W>uV?+)BJB-XDMM0)ic64B9>V)QtxtorC69n#&>j zI709sx`l`B8j=+9d>IcfWJWv=Q50cNNfUDAjla%>@D)5ZZtk}6(2(&ARKU&I%&;=G zVfO(baJlR}#3unU zTz)=SMf76v!lS&JT5DI4T)H^bIi6PgHd1TR1m}G(v4ljvJ-2EVe&~*I8{T)-U}4#p zmff5)!@Au)4F8s$|Z7^v!H2mpm6%SSK?CLr51U#6b)%yxwJKfU$TK3x= zZG*Q<#PP;ZyA(F0BFq-m!;HucNMKCraD6Pu6E9dtg>^HZ8(Vamhn>QD_CHD@`m<|h zPbFlAq-h`)Fv6&5wR1OOF?HgsPNDBG%3{Sl=xD9}I>bO}WjUSd;M|r}b;AO}oq#qG z6Iq1SWp>71^6t6VeA2GzbHh%d;^cObmU2^{o>Ds zf42(q$(r|DKl*rz2W=k^AvM0SJ8)^p#%9PZCSVp4<&b%(mv?US347f*k7)@jZXh4 zF#A%k!QzaMli4gUF8*Ls_oUV7cS?|w$TAmy8d>pAa~{$3(n`%*#lvBmo`vWuWl5Lo zx+kKaQg>$&I{W-fp>+)GiSc?3fJuPwH+vc1~|Dk|C>X z{GuPKQx7T&xM~A)dqQoo$LCckUt?eoa}TxoWkJjwirJ-udm5hVy>ZeMkLdQSPOP8# zI@#c$eSdoSs)0Daq)^?okZvh0Jef|!&1Zng-@)@?N{ZY{bjhx}M&Yq%`O}}Ck=YT~ ztlLd^tiGOY(dHs|eEwL`t9bYax54r1(_@ZepvGFAI~^^=yV*g;whi%gr`PU{sJJZ2 z!tVstQ5-O`Z4wVR%g;qis%z=sXeF0oeqXv(=aT9~U#^`~NMvnR@~GRTJcw(4=m(J; zO~sz|;x2x=vU|KlFU;x`-@3|fJ5M;Z=Cr5e0U#g;lg=@K<+4bqDEiG(KfO>oTmSX9 z!2N=;Am#zwOX$3+FFG$oUj;bVn~{Moo`C!6`DJQ4aNN zz=sy-X!xc*@sugCt__s|XN|7^JQ_e_28kdF+kNECT`i$@#7`b#Il6nC?Ar8@>P2{{ zIG&EJdSQL7&fKx5UHsOKz}NuLfdhT3;YH7(nlE+S^iG{L+Hq950q0I-9V2AWFgiU{ zoZ3NY8Z5W7_#1#`IQBJF9XQT-7A2~jKfQNfz1?x>D500{8u_irPfp>H4yq^dQIS<* zURjhK=Ql}~iyoB!jkVMe95Gz7GdM?KTO>v8VqN3@ek)g-kibjHxNG{;&c&37tp7#Y zo5v-YzyJO-%~(yAPK#Nt?Urj+YA#6SlvAc=?h8_yn)`~o(C(BeHKpcWnWBQ=jw@8A z=8B1eI~pn?;t~Q10_V2R`JQurzjGeH^LY6CuSb90-dy+leO=Gj^FlW{PxskV;t6mhgPL^)gERZo!4fKav)vZRl70;w*d`_L-Gj)bQ!7VoPPi&APb94O-Rd*ya-XXjvdr){J2;684IO zI{jc+qkesZSe-l~zNJ;f3c3$$azw6dW#0qz`nP@G!h`RE6?tf7d%07|xRr*{7;WVP z+bV^eq!qb5xL3jlj&}|G6QL?7MD@o}B(GLzE+wxl-c!$tit&uymJ(1N#WtCDH1hr= zj_Fu=IV$eA1r91XeKB^Ycg(LY(WK!r4dP62gi`(1NuT>8zd8|Qr-Ik>_uKPc>lFDe~ae z{?(~h@X>&?%SnsT@;7ECDsx9|zfLh?#E8?qfQeMCD+npcf;0S9s)7_{_OBN;@A@jx9MYZ-OFPCDrrgF+eNL58a<5P_IsR{x}d- zaQJJi^3AITIcKph=N8A{f1XdIT5_{ZzR!FPrpU#P5->4$7Fr}nO37Xa)!QDNbxfy{ z4DzcDv}vtL%_fPH77vx=BP(YnLxuSFPtAVWMCG`zy1h%M*AaC`?`{3J3W1(^gU4f< z!bksOil3oiEhV|T&wzIrA0z8{p-x>Klrt+KLf^<5-JfZC*W}_l_EzUXLgNA?ux6~m zX=7w)>U zo&7G@3ZI(n#{2mo;Nk6|5x(CLW?=M~CQ>4Gkd)eC4xN0l=CF;f3I&^r^$1&m``c{*XNJ0ua{)} z59?aC)P{`Uq%2MA-jT(W`sXzn8bNT2x%O|Gt8bXPo7}E({npx+gend1w)cUW@MXNX z>i`}+qLALo`@2^w?Ip&i=&Egc7^`M2#hN8+$5`1(wM|HOJ~%FV_X zakrFitVMxRxi5QQaki>o(ELk$1h=s`)(VvBb)EG=7Gy3Z;Yo9y5yueX z_yI*5uvcH)|17}rhE0>PF~N~9;QO5x<5lk^hV%P57-%YBP$6nq7tq&T#!pH7iLb=3 zz{IE=1JTi-`=xmDE|WIa(jNSalP4dK==f{vt?pIRF@OrKv-*yTIwR%Ig$&6)==$_| zV+ULIjH`dp8o-Ljx=Zs8ZSulm4jdy|Ya!mpZTcS!2XXyt<*&OIpJBg8iDkDRd8^Gbd4n2L9JB`6 z_dP9$bX|}IDW8wXuAh%vLqq0zW>_r5hE1`*G}Qmh6a6ijA}G&U#UY)$eX(JO7*}bM<%}0&2Qb?O444>i>6D-Kd?(x^FRc3&re8tYx^(RY+#t&*XiT5Tx9fH} z;^`XnNF$`$uVh}Y?h8CJ;L224u{pqaL;EFz_ljsB~5XT|cU5Yv;Rs)mFfW-*4+YV>krHkeagu7qkKTtgq4-+6DTAJ{WIZetPR?yO2RrnWARiU_Ir$;hn?$LgyMglTgZ5ha zo8VgQG*>^OP`tR8ltCs(dJiP6RvyN?Son@rhe#HPVR2UXFKMGWV3;@y zG&=48jSjA7dsyi)$gM%FX2vcmoe^@A^ziD=@|ubTqe4QD%BwIh9UV0f6m39dG8cPS zt|)K9CdzT?8}0%4dJ-rs3spU?zTB&vRO5w`T*s3Zm(!qnJAF*=B4d25Lzg0iw2@>6 zqFqgDAkc2Ab2D=stpyPbRA zIh}1Iaaw3p;n$td)p6<~3>xKOX=IO5a-%cKVHW}!8w@R6q`zs-nd)C&LGEye)lQ)9 zF-VT0f4VT-nSN{PdxlGh<6Zg#z*#M{ycv956rmicae99+0cOdXyq-r!3i5+ePp>qt z)=`#2;d0$Au>s0?7~%~Y+Eegu@fGcXUqjItT=j-HR^uY$6C_@KTpnC60EMqk z@j@Gh`WFIKYaSoC!Rh^@>5tQ3q^wF)`;x5bOho0lmBi`UCJhD#zl)20T?;i_DM+wF z|2|| zk_d264f`>rRYthzGF(njY|pAmi_Kj%6Ba1JGHFl@P~a(GuDzg(=VrPiYS{iCuGbSB zmty^;KahywlJa^ervmHe1)t!D#6q_HT{{-clG zDaHj{cV`$wM5G5>FPmyx_H{oV!>rvk+9V=){62Us;ro!Gi{UYrz>hS{0?= ztuX-t53aSWXRa0z_jaFy&q2Vmp`HzFph%bQzr{Y?r!oS9aUYo;U@fBt*~Z=dj$Gq$ zzd4xGL(>;YV+zB>fDqNVtBmM(k;+&=fI~GhernM)a`BAA7fezL2>UsWNrpw2U#^08 z><5_^p$UI0q$hS}0Tq9vLrs`;kwX}XOVkRLD%gyb@{ABAu1}Cw-g4%+IDf)Q9~e+N z3Z2ID&H?R1maG3o;P3(A0{FMKNymVv{$upYGn`Ub^yH7Z#E;L6bLxg17iv9j_K+>9 zz8VV4oflQ&HCI2CubuD4Q{roMIwVd@r#=!MZ!)hI^}Be=AT1awVAr~6!o~uVSL3=# z8P)J(&T*=U1saCnse^>!c73;D41ZnJIe<2-T!B5<|2CJ@IFCO=MGWUc>gGr1w}C2O z8toZf`SP*E+_E^MCNRC>7Uiy+);xx2ZZ0C@yujmn&J4W(lOl_?NykyftGyoMlwTIl z>B2OrGY~%bwj4eG`9F*2i%Q>y1wAcW4an^;W3%0_9&^yZqCqw|6RN){e9rELg&D_yj{hp6j5f7 zKZe(n|EtOVl;}uD?Wd!G#V>wd37g!46QZ2S{-1qwP7*^frz$@>Dyu~O7Hx%uk#WJ7 zWtGb>#C6cLsd3eyTjVVyK^~m_y~>mHpB`Si*r`U|< zE^#t_v=U9Yp=$&(!ueIqqvJy1JeOGw}Ifkps8BQtvw>lN**;^bPus= zkZr4QzMtDF&sSEB^|(RJb`KIBjTb=Pj7MnIz&;7uwq%@5^jw~4``3)BpG{_2;_^;d zA_UGw0O~*RC0=NDp}Qw@W%aO_v@HB8Ak+X_gQvp=_sd1^BvUWp>Dkr5R_(A`KgwPh zm=4E%d1$_tpb5}b%ko(bzBj1N@S}&$GCaa*eU5{&e1@wUfr@)1mtf)UF}Mc$&>zbi2Xh%T2c-{4sISiGl!pB35Q_=V8DvT@+xb zV8CBWQ{@-H0aB1!Nkw>svQtJ>Bl|~QPWoJKxoM`nI4fLkRWfkSi#>x?l1=DPMjRCj zwTn5;*M{=Pwi4a#H|IU3sAYaCJ{qAcV@(AvgJ~iy-3kYxf%x}`^RLP z7xjeFdMwiFJBB?paE#27|7$)}@bqe&&XzsMj#<`$pr(?GorFpXd#&y~N5jG`a6E9Q zipiBv@)u2mNtJo}zXPkCtL;~;`KSK2?t@UH8fS28xjMghkSWX#$Fgz$Ge*}N_UiX2 zxlL+i6}KSzzd&}OP|4?Z4=db|N7U$+Bv-mzg_hPINxfSs*Kx`7ZnfVWLbC=a_6?~ksr5(4>sgtiJbGL?7wNS6Ars%5Y*{a;9!GQBmY%Wg^dar zl-nS|ZviAYCnD`wNzRi6RLbywxd0Xgz{&vcqgQj$B%c%AzA9F(bs~lSQ+_dR;QmE^ zk5meCyaJ(ZE`s2{reW*C_l)g$Zl6Vz8z+N-20~J4pH+hPYE&fr_PBEtu-_pHT=3U} zB4#fO>Yt1z=@qIB76$iaXfLH&Elz}kfPL%wGIj^sa81A}lP5U~E%m+Gat6XhO1ud! z9+eZ1>5DgY4$hJw4{Ntv>Qg-!*H2K}q*nqc{rOM)xQ{vjaLKXpN|-}WB{&ciGm|y& zygp#0v|acDy0EZE%sQsA&F-f?=Wek~edB#+jH0BQWYZjyrJYXNbAl>NG1t}L)9 z8|&(30CLF(xR6c=Y-)faZt)&Fe$3%&;`0ELuj-D1K(glY4n|`~fu_hno*Mp0ooYUk z6jTZP{JXDcCJZSl!5=$9sw2OEK!MD@H+_vmx!U2yWkX-?rd4zqiLO^XckCOjt85FG zt9R<&fW%p!J>9ja@miIO5fD#VpW)-(-OxTqmjdjHOH)g(cNhJYtuV3b3R~-pAwMO{)U71D+LH|EK1S53C&*Imi@V4`PLyqS8 zz$V0+c0~LK}Cml(6+311;NW;w9a1HVXFV2x39)=u5)EHjHC+50gEEe%5IN;>;<6-ga}7h#_5#u`nZ1b%9OfDOuhK`Kf5tJssP;`F_*zc)v5Ev%RC!%>#vo$ zMtgY08r(alC8ZaY|5o{H6-a^nhyvO3i<`wrm+`F)K~!OT(0PwQ%2@Doic2Ef3@Keb z`ng=ipRhZ3=3i^ta?CTK;qz59D6Wfn+2LiTH<682u}qP;^?Iawh8ig2SBuX2_#Cfq z8HlxNcntXm(1kk$6T%8CK^>)ke_@lDKtGqD>9zYu@P;%z^roe?|CkCMjM)!_26^Px zZp-DY#o7m26Y6DTM0=ZW5M`)B$v6;_+&mpOvjK zHMciFO`2K{yt_6~|HmVu-rHRG_2L?;UuwkBTEz=wgy=)abkDVF6t+hEc4d3iAy${K zUYOwM{Y)Lb%a$3?!9|5(>x7phj;UvB@G>LIEk9%i!7PNJ`u_4506P?vkHzk}@P)m| zsG*88kUNXd}N*7qO#6TVFftc?pbF1uk7xz_A+^l(Oho!qKR zh*g##m+LcD&OyWO+q+NAbqr_6nyyJ!WP6Jl{zNW?XTvE3cNi}@@yA^L{-Zy}2!DhJ z9%)sIuY#`+hYQM57*-bXe844c1;4E-evGV(_gB-A&$Mst7I(+0Y_?rE0rtZ<$bJYA z86>p$|0VkjKk(O@FRT5mmt1k2vyeO!G8Sa3y{vuMpQ7(f_B&gYvriLkxWwsd&*q4FI7`HHw?$UgjQ;p3vU~#yQT*=91W5T#C|Ii zy^Vz_*F@NL58vXW;ic^ZIgNl+q;zV+y?@jy*QCKrvJ)4lT~MJyVp+#fXQ#Tognce4SO((vd@2|Cui}9^?C+09 zj7DT6=qNAh zh3J$gVvR~L+RxoR0ZeLs9B;gi4nBou+t99Id2KE);qdqWqeegM? z#|qFQi49frJj#;)^#p`_1ygg4xq7lpLjm3$OF+5@x^i9Hnq3k#glJ17$DG916isJB1$-U`T34(FDwk#J7&YNpZFZoxtEx}p`M8G zR(*q=j1`TbUm1k@Fm zvZ3u>);=y{M;6_eW*Y8;)UI%F3Db6HR#vwQqTbgU(2D;SL&mJRn^&*-W!e0= zxd*%Cob=~muw0Vg5cL$6csjY>j-@eI$qb>#3G2^Q+!@Caw1&zh}OZ zny$JI-O@DgYTR+|mu*jApJWCl8J($l$IMI0At;VSX+HZLz<&3nYH!~p(sN=-jcA=M zdI}8Nr=pkB#REg;%C@zxQnQ{M_~g5E5FMc$(g810wm;pWA$a z70CbLzmudvrL0YQQh)%D8u74F(@V6y>{J#mI(hc6_nix8N32Ku;|d*4-UN#6GvcGL z{$*Kx{~MX=0$f^;$UpXk@In_+f6|ImZYh%(U9) zTf621j0naNW(Q*mzO`nnsKPpt#DngEj1J5*pE&T861I_IgKTUiS6L~wi ztrR7?n;u~Z?2)`SfM|HuVvwkP>Pi?XxKy7RVDB#kOyZ8GzXPGo@@tgh5t5!~!-1^$ zDi?o>7gU&2VS6W~EB}|xcM>_$BU~>iLU$CpF7k>01ZvguT3yZ-2Mw6jCFVgtP*wa& zugAf|&Wm~uo_Hm?6$}*7(!IMt9mN(oZ{j{>;kGhM3_j}y3sS&=GccEF3T&gr0v(MU zi%N(a{_$PhoB!L>siT0Sra{G;Z#bl5%aAuOa!tAY{`f z?2(n*ySp1>ODnO6yDKPGdq8uORaQO#FzbM+5OG~mpk9P9*5!V|6o}obS38)3gdGM# zo4((nwuwa6*Wr@>!14b4Peqz@Zh`tOI-x>aXbE|lTelwI&&gYGz3gn!qf#HsZU)G2 z8CJbAo;X+?Qt&!n`YNJcCfK22?ni|S=Igs=!oPr}E4;Z_-q)$=R0kJNZ+0|+O)b?0 ztZH}pviUzEDzmTQWrB@LNnn^YbRIS^#+iq*3lW-&OluXh!K}BH-yb6%#|%;R^)4Ik z4*-Pf^NMQpnxU^hzJnEm#!j-g zx(WkDS10G6^s9_17mp6#;>3|uuDu!~q&9r6JMFMQIhzZ8LscoiIYJm5`l!;ZYbr7` zKNezEJJ*{kP86VB4b`Zb@6227l4_jYrn{n3tcYXilwzGnX)mg1vxeo*n|PPhN4YKl za9m(00zAvMg((P)TR7;h{@~a>f6dzq;H`bGUXSTX^NBJn!%}Xl5qiB{MQ0cQ5K-$z zW$7RU!4H>FJ-!~R=$QdKC#e)O4ftmNq?1C}c9wnIR-D{AarJY&V{Eo#-gnJ@GQ3Ls zARZ^9v?#D@a-?m0{l`P3DCU9&HWX`0tIB^9{k1Se>e?F;cSRX7c>Y4EU1pX&&r0F} ziSBt83N%vOG`j#UFu(u$MpSL)6&=#?=WDoE{EnqNn?xp3J|cc(b$rtRVz(DM5S5@k zL*Z8z{`FUdGv*K4r(~X?Y8bfu=CT1-6*dl++;{PRV(G&#&42O%?MKpk8PHE_?~Gda zZFu1Bv*>}0wKoHT+zf_T`cyT8?{hh42v35aYz7C&)F8p zbX8-ZemggNqZhg|mzlWObEYE9#M7G3^zl>~1a#o`Kmp5KF+4VY_Ju0qY$I?;aF!$W zqmm0)X)b#mv1@lh8tEoJJ{NcJ8>^Pr=STv74wG6@5=R~?KHJczEgn4LQLh5OESr;Y zwbIyBlnw8~eyH=8<%i3;N%?j+QzKfuhM(Ayy#dnFox-}4J>#9eQVr2MIO1KB0;|`x zZVyKy{LxDpW8$(VI^eXm$bVp8Br*UR`tawt&Z+om|4y$sRMmh}ipEE&O}XFTS0_m8 zpLwg^A*fj$u{$_WiR|$#_9RDxGIzI170G^58hip;3cfloC;mM&7y&mNf_6o&J0JjR z@c6?jf5A)m+iGU&gN+wbn2`}ANKj`k@!GkaaZ09ZKqFiiMX zMu=TJo_x(dHh5l?A^^{o_qZ=cpp=>BO}pE-5WZ~y;024@KpFiFzDVp;eyJX(ad^?r z)>`=s6Zz~3!QSy$yB7p8m*O;-y)aqDeL~fC0j~b`=KlqM6RBXrd3a-pP<{w1ZKdqa zGjK1u4BWDSNq2+TIYgRy?_ZYSjz6V$BuKMTtP`kuBT#-gN zoO`-~nzmLv`;gp596DYc5#~{_4z%S&r*E6v{}=xKbwSQgjyrCDiC&k}Jy-<}0IvcMx!>M+s-)K0d}zBSm-_4Ur#qtnJMqR* z{K9`ID`D2~xBPLH1L6j3%FMWn?z)?H^^xJw>1&`xeHK*a5Q;y1ypd^0|Nj8Mfu+Qf z|0@9AY9f3|UYxcTczn}rOk=EEuU!>ZL2$5fj5>LGIr8Yu(5xuM@S8wu20Fj(ev`!q z1jEzHfVHBMp4NC|tf0p1)d&zCJ~){b;Lv%n1dDjT)Zf^Cw)JYchYXNAd52a zX8?Vlw~lz_;RGtV8d|yA0)Z!Ob*m2D$ZEA)xn+z&l)LggX< ziO94&oY`TtAZQA>PMkdt8<77hmt3EE3~|d!s5D+kx}7L*9MuJJn@E?615DgmEqbC7 z*WhRGYbce7+aL!J;;>zXJ^YTJK|s@_BWsKOYi(iW$CPyE9f)LMk^p4f$F9dL`p3?^#uH3Ccz& z6>*X4@+$htTz6sqjW+IUBpPSaax~5Njx{m-`7+bLn_Kcad{8{VyXSAn&4yEp1;?+W z3yw+3{iL_Y}EzzhdjH^#dA~kYt=binX7b z|9S`byE5U;(WJRPSUI+#RbDxh#x1nZ99Ya&?ops>DUp2ZTMFJ_$qxO?;VVm2%QG3R z^x)RKn$LX&zB>BhE8_|{U&j%$mx@u9!?y|*8ps@1vmBEb}%ZvI6IUCg5M4=XQbcja;WBEQyfq0hc`y4glg?#02%q} zCbuj8jq||wxVkz5i_g1SySe@VK)!I+--ajbj)`9z%{$XWl3WQB$|`!6+cmw)u+4eF ztHz9$k#y=9f3-ouHls<+wL3?UT>h7LZPLoBMpy1@GX_d-yVQ+GG`89zcPyfpOe4A~ zVlPQ^<}vtx)Zl*hJ?XCo{i*6^9lg_ zxTxgL#6OI&MM1(L2(7r8z^x_dHvMK^bF4&}uM^RRQRQ|$2p=BA0KBdE)W3vSvpXz5 z;~gfVgv|70rf2O}ptT%jyuD#UI;4|#e?2+Rd^(rRrj>H1jpUU+b>{&;3sTJ$`Wv6) zBXzLHbfsW8OLb(CX__$6bRj}Z>uYKO*D!rpG-`{`91d7Ih4^t598{CB+7i_$eKLH> z*&2JcwXrLk(r7}G$ZpMi*U2PQR6p9}tW*w|m7aE2R2mzsb+&ZY0itWC^oVVE-^q3R zs40(1{~s-mjY8`NkbS4AL76Mk<+7fH4uIk=jO(m=TWq#LLiZ8j-#~Ub-qxvKo&r=* zR+M6i2%W4|^S>bCFLS^CzY%e~3o*35=T6a@>bk=S&`G;?<61{GLTD0@$9P5NRQEZU zCI$!M+`HVrp#%*f@+Nb*T5eVH7GO~a>VYIjg&KU7r^DN$!d=vHV!3krO=E(Jb=JQ! zy(m#!h_})kuF;1+)4Y7YZ;eqS+xDK-zNGAKFc98K|KG^)9G)gwoR#`WF+G^xIum|? zaPF(2bd|*6Pun{f26R!!%Nw({J9|cP;>)C7)MbmzF!SL^ z`y~enuy=&&pZ~z;KI|)6goY-F;<8^ITVk8#4W`FK55fZ(^Eb ze5P76@{b<;y4*8%mJ$u(Ly993e9gz~FZJ(}6_E6E#*GuNnX4ZlaQ`}l7w2?e#=90| z=JRy)S(Nz)AXs+neyIP7x&LblA>6*|dxnwEV=(6Z4?b&!|BYwjI|#p#P%o3E*U}r5 zzo(le=(K`*cJREzrN_SaDM9iAy6Zh5uVfo>oXwIzQ3Pm42sJvPw$Jv-4@H5a-&@9k7Is)r-WN95K=bozZn zX-&*x0}qi$jAP`!K{@!zRl|+doZh9l9xsiui{@Qi^lQ@>#N|t=!X~ZTZEMvgs&rhS z8dshbYy@uQG-V4~h4Bf$dMNOKISM{YNUX2ticFx$HI3y7@oG2Y4G_}5kZNUxS*g*9^uL7+n(kiYyy=WL zwNIf>Yw@w+e*qM{tk%3a=;a+v+e?N`q56Q_?ym_C{#ITI;O@ZG3~9?xyp^4@U`^xn z!`AK7S3N47-Rq1A!JDFQlT30<$b@r)J)ZA%N9QiRGrF~_h>#!_VGVx`F0ZW2sS;%!H6YLR^uEb&K!rV$uxXG+U$C^ zZIfNbsNY-VXVD_Z?xb(oZ$z1>zg7ECF=(X>V%_nlINz{N5Ds_w{P zdKztCPvK=lJ$h9pnib^#fnaUoV+BsvIXE9xglBJo+#U8Y3#v}@Yl9%^6a%*GW1qtS zRSqd_V-ts+-$z$u*>!dK@q{cldMx6VwBbn6TvYYfQcS7#zz9qo(q zO8SS4f?}`TQOlUw2^Be2xNUQ06iZkH9xdc z%n%J??T@~C*)ACFBOZ77q?*>EQrAs(2~LfkO}RW$K}HmgF!<5aL06kIWQRT7hi#QM z@;{OEHRzA47h#HWbrrW0@3nVsIXA_h@-yZffJSzhY}$4OJaPZXth?P96d708`38L= zc9&_u7vO#NK@=)}1dWM-nvBL?g;c)njuNTlK_mE8F6Uv&1X%yd+*CI)Wv0!GYJKe}d&7JwW4>p8-KH5XBd9 zebEF3?gKpIYY$rHlS&cydbx2f7+9tOtG{Ftx1o1;NcR07TzS!pRrC~)=b9wUmKc11 z*Y5{$wiT)ahmeQKbiK~DnSr$#mKQ~lYZEH$g@(QLoR2xYAPUiQfO z1ScZVP$Oy{I4>9nP}c1-TDKvW^oe965xQG%lh1x}JMiqsep!13`q!@ntHTa=x%@)~ zPn=6}n-^UDK5qaKoF2P{u9m~@{|1C6D`)Uo|86wMwY)EZ$xFr=GCZ8HS`)C8S1yq2zMCWFpgjGjOv#+oKrnu7w>;db`oaQ z0n)8qfU=f9V~w*a<&5Lm1^$mZwRZ0AI2Lqnyinl$N(2C?b~cP}JP`rDruO3S?*ucPzGg(`~;pO?mh{l|w7HtK>^qC(<3?BQcZ?1kvAN~^%8O(eM=y-n6 z&#J4no!siw8pYZG&oL@(37Nz0W9QlX$zE6BF16uL+Clr{(tMx?{aio;QLn4lmr7BL zDAbJWJ3zJM+=1S@)FejbI$P+I9B<2r?{-UU_{I4ZI}_MFvKOGThqhipMa^!%?<2Cs z!nC7zpzv|o)-#m5s?UK1P2}r2sePfrFL2EYEBD>zDQ{Kv0^r9In$Ph1R-@m=lF?8! zhIBlInG^9P5n&es{MN?GjoR#;)`7#MPR&1*Vn3j^pDd#{FP>r88oTgbgPFp~lS z0j)Q&Uu%M6>Y#IR6x=o1%ANJ_PZ_bh%hpKK@(_b2pAGSNG(tzveS6qc-rji&dVGIb z*!j9f!Qry+R#f=!XR%pWU|V4oA>q#{{-^(l$2a;XYi-?}62`s>h4Rh8Z}Pu?mtGl5 zKaf-b)-{qJsCq-I4l*XJW_3R=pD3G?8-U^UzAx&5eJFyLUo3O2Tprhb?5-EPDRSHu zzm%%&!velGO*caz+)^K0m^q&7N&D7O_20XvGV^^Dy`t@&cJhaK-U zQ~j$CHjahSy-v&iwQYBK|3TR~mxX8`Z}G;c(BJtydJ%ALDFNA`Zl@)N~xmpj6e>sC1F)CSz6@I{pl5#62D#g}ftXU=JP=|}PV{5^1{?602d!YYdET1xoy z%jsU=*6G*T9~@oJH7J#)h!8HclUx`b0dc5u+QuKa;dKqlYyUraGqp0;%xvRI`de! zJ#`~D4?_}RBE196%I8@`ftfj@$ErIT7!~zmn><{$uiKFBo?!1l0*k^k>}=!4`LXIm zGCxSi=#tZZ_qayjki+2oTWGP5!2WUnyy^N5CnRiGm25o3jFZ*##c>_Yqq(isfR?6lMIO}#@Na(>p8^PSlCNBQ)Awau{V{oC)9%sbYC2hjszXFT2m`pZ zUIS1HW0>nOy?)7B>xNeSv!NEho_W<$(0)n7Rvv^@5wCP{e^>)(CHZssW53zNGdZxi zx!W0U<_g!`Qn&rPZMRV#fLo{>2s3AujGfRIHmAfIpIL{P>-)C>!t4+ zei_7B`0Uefy4V`O1z5G{rn+$H&Q+l`! zY4h#!iAEMFn;*2dBF>}Y1LyafNKlpp1wmcPgG3U?CRrl4XjUqGf z+=+JBLAo$&??{QW4N_LI{GSFe-biJHx}qS1*6;C4jjx`2X7|3E_x-d&2Rbl)@Y^VXMHm@w9&AmK1?@hN(`yr@neCqwr^+o#og@!B;BFKn%;w3uv4QJ~TyATw5 z_>VY45~~ok1CL#nN+3p?(MmMJrYlTwHm;BKx|@BI?y}!|0m}|(&5?b(btEBXL0&4{ zsIepHYXRGaNa{Vg+zfZtFb&+kN zGs0DR3yFBe)tZ^5FOGtyha~>SbadiXJUz0q81k@Qh4PrXbn~t?Z?&hJ^DK{SW$Kyb z9%Kb!m+CEE(Y$FhRzhgVr>oGb$SMvS?@jQL%@ffk9TRMot2Xt-y%T5q{HV zY6RNb6$t7A9rb34%QV?Ez&(BiaF3?|?s2)F?(vzGMtA)hf3TjC?>UCvIJ4^YCgX`| z7vk>|(w^&ViF(4Ml2>Iah!YFeawCqY{6ZC=yK)vY89f+pi3E2v{Upl&{V!V4%zE1u zk#ln74SRB7{)i1CGDPNA1tc*E_k;<2;s`Yd9aC)#s zU0CWiPl-n{8{Djj79)iyqw4av)`Dm>^sG(9lE&U zJn^f^9&4p{3}?hH#KEXf5I{ce|G&t`A3hQ<5}cq1rQN3~2_U{>(1v#$l)WO4HrWAu zA}X18$5-25?nNMYs@dA{*^!mwn-pIGYz4{n;YwSpIrlFtZ~|AJ1mu@tk2o7q(C!mm z-ME-%!6N*(yfp`+%O&cQMO1F}YWn|^Dd(kni~N3A-nNMvtQ4d2YOiFDuA@fGl|dKv zzIZ7+lfV0z{A9}Sv(iKjvmxsclDlNc8?69`!N#!sS7RZy3vf>dWk-<3r{UO8j^+6T z|Ikr!mFs1$_SCI5RY9zm49o8I5MW`eCbZN~6k8|JgFmcYLBa+p-!T{PwK5<^M)B+RH`q>;zxzQG{SABVp4_~FCL{Z`40 zclp23Z$(P5DAwYXkISO7j??p*B;HV3ZWDZ(;1M=vdPoTDO8!ZbAKf6yVH+fQ<;2dB zYGBP1t9wa1sF0dlEPUV06*g6Z3(bQdSZG~@B{8xJyd9zKbTy3$@Dzi~&GjEKSEOKG zl^+$>`XnfX#HkGz$SP&Or&uCh8_0T-*>r@9y!)9s{D)kPAW0>g{Q&8JB@)ht|E`Re z1OXViyD6XrncP6L+KbQMDc$5v^Jg_SC@~CmIzF_1w=^y9Qw1;FGUcuvN8P!H9bI7C z7`{Tz%2Q;lhM^0>XCKmzUkBL-4D9!>tZ6P;SSK$tson)XK;8sef-rUHIEY7-x1Vc$ z7U(LhST^_QOj{Iaxchrhx@;;9pi-6)`&Asnb-{n;FM~mBBH4Zp7 z$hzjM5WB-F3>3@N8(&=~enxA{Rjfjsyc53V*M<%9A~F(Fx^{mf&rEgBo2RMQ>JMZl z(u^4=6lkK%@#PQ|0?I$9l`Z+K?xUlFwiDsWnuM5$V%>k^#Glns4vhLe`+^o%%k=PS z{6by){`Bf!q|SDG#I5}^vS9}T1z@__sSh_^UyJJp6aO6ljef5K zF&j5qjvY$@0r?cfFh=q&7za&t(^cle(LXif(G!M|D*s1}e90t_|DbI}*KKOWdv-d( zi523NCymX!ztQ*RI59X)2~>j}yd_5pv}kd_ERXgkaa?g*o2w*R7OUev@AO%gm8t^V z_8D$T<0N8V5661rj6IwV(0f{kn*R2X7z-z&Ch1jKY%Sf*-6;)z7k6#-<@@%uw)rLI z5Pa_F++FxrD}BI19cl|x=7j){+5d_Q2oPBV7U<*;fa$C2=?%wkyl}HP${Tz>T=uV? zMnV-}%Man$SKwo2+uO5#$xEy#avmXs2~4b90e`HdC|_;6w_CoL>}YA2TWIpQ=C^t^wuTM+pLtHuQ|zl4YPfIesJV=;Eeu=kfOy^LubR01*)@9*#vc+on#9 zE$2S~RI|C2OAu@7*rRG*p&H%e`=$S=!>w$6tD-Iiq(Yp-RgL%$%xm|zO|0L4YLW;L zVF}ea@Jn;qVMBj&UJY~p>#y9}(MQH-x0(#3v5dk|9GtbM(#Y~Jo4eUu1a3CCnqI$lO;^HE zdJ<oUf?JGmD}4$p1Ec-lqy+*^!yKo z#O%U0?@77ZwcK1VF8A1D`5b&St8}N0aGNN{dnsCgEx^RA?y5voe=^tD1{dz`iY~BZ ztn7W-mIYvGjlUfY|NTs}x9Ylf{Bx1F)<-(CVe|Oa>K2jf2)!@lV9qnY_oP;Sjo7Z7 z&I=s4S!_{9PCE!fa+|!_y51^hhX-m4F_zgpVioP&KMf1TK04;EKrjp|bOpvSy!@0m zZ%<6-;x`b7Z6^mloFHe9>njIh-(o{g%dKMa(^J>RK+rO0#6nK2$6|q4GiVheDK;-? zgX$f}@!m1s;jU>{r<&~+>IqgDCDT$$u^!y_p45SM)!2IRpdkw{dh4@qSgK(mxRlF| zEqMS8@6N4TqPTyF%IEW@r7QraA%KQoS3cF)MJR;<$M=SA0~6_+$+5u2l(10F-=xuja~V?UaBL$YIfhwU_8uk6*6gg+%eDr zXXoSV3Mo_So=VBt9kIFmLE3@m8ok3mv`00Izj8LVm1Tkx9g)+!mi7(zF6-Y6`%BeX zQVp^6%c2Uz9@V&u2W+>7J1n`EZ6h{jW`5cRWHg38S!omB+K&Z}3Zxw4^-1qciBr0z zg00Zj(C~gRAUqlTT$(|S&gF(1b3SPPoc^kY6=gu3^B^!rOy!+i(rX2$z5?sf$BrI^ znd>#vIU((8=LwVLP2ZvT`zryJ1;mbZ`Mo?KLwSHJv46diXPo;)hdy+QjG^9&ZuTGu zpM1@GacJze`56_BfKi!pIMSW|KWD6|J zXL5z#q(y#%6wNr0*1X<&Qc|6`=7LVvH()AEqNJaLu|ko03|k8b75nmfPGQnQc=`Ul z#&`7#YLlM(f5nCm{}EYB9S`6gQMIx5&?2eLEgv#h zJO)meqdn6{iJf!(-&!t^r^@QWoVdg0Uw|YGAFB5r4X>|4A|Fu07fAs%7%6gj#E_8oaiwzhwSP^fjG>P({5WCtF^63xjn~Y#eZuol`8pXwy@0+8+_s-D zbUqD|iKrENG|jDjBup>ld<&tLBNj*L*k)2xQjI*oT#+Bp*&Q!|a2BkRwE_O?1Z${x zj#HSMzhowC)|CIv>4ZBQBpS7U;OP0f1g2!VvXU0o z>VCFoduLqY;qFHlN!JA!B>s8XTN9@N^1uM{HSAhs#-EnsgT)o%_}hl@dv&Zx*Cp4? zfA4|*Rr&&)TNZrAQJ;KbR9$DdY{hx9jy$g?eyPNdPr8-i-uAQBPHcs(A<76`e#s^uWVx+b`Q$G>m1p&{+?R>cGCEv5FXj56~N22Z*9eKb^N1 zJdQtxe+{)M<+6{{IHSfk@MY8cw$DRF)wfc2&GoSa{eO#4Pl&+@jb}B#DdMN&oW6<3 zGY)+JkoLxq_MT~5e56~8G{;=){xc2o)D1GT8PsD7XB<2A$Bw1V*<5UY{w~K!8}>-} z#hkFTXxM(-DMzh7xUt3XyZv$acpQ?Qam*#AAWgw$I@eGjcGGeyzB=(59{2f2|3fOU zQj?o1$>Vs^uksZZg9k28T=d0mSuPS+BFEp|y?e7~DZS#@_3BXdHCBQJ=aue7uKY{wmCrYdowvF#jXC_8`t z^Z~wJb?j?c<`Wcvq8nBdc(_4Ep_zd=??;5vknzC|KNR7gPm{O!L1REUA)bMSFzpPN@E^`9|bKRlioB70z+6j+!{Gd81%LI`M# z2<2)-?~|T}fJWN$E024QAQkE&43;gP1v)O9K)}A$1G2Q0-};dGTa1locDS{5J7+r! z>KGodpEu`*UVqZusxZ%b%qwgmy8o#14=wUI6{={X`8u-JaQp`P##o&=%kqt?vP#%D zn(vo>`2%4I?(N;|W^DT98&>O)H(qh+F7p#9^c^6h4d{mPdn;FHw#|#BY~=f**&|Pnl7!+;q@{- zeTd7!xQ0W0Nu@SCwy&jh^{0zXeDw#A9%KDOKPthIW2ML*dR;p8YcPar`@7T{@;V#l z&6d9kIU5cs(dw*2t_{?xeRHe5KSf-1Bz+7x(lkZIuZDR4a7Qd804Tb+?bDe?jAz4Q zXnhKZu(miR z){~2h{S?JHQ2 zEHPQJ_P^Axv-T`g=n3h&!>gq%&dG``Y&^A-Dr|b^65)DqK|V5glmfBiy8>Gz{cU=U z1tj;lBXszp%KO;4Q;Yg7`A&W>d~B*+et6$#z^|zFiRI{(`U=mR4hS+O72^%lZaGd6 zcig#C;x)T~Qxl19|44*g3qkA z*u{!HeazsK8{HDKtEk)Hb6aFKcg-@Ibm`WZ9nu!pfo$TlG>j3StjpI`C~9`U^Epmw ziHVVE+$g1rFZy1$n=E;EU16L&uAubs;=kN^XganOZ4Gee?f`f0lfYf@A)>f`(d1~r5O~^)qzgW!CrhJ!O8iPce`iq%C4-e92Ysa+WxUZJ?ECo zT`SzJ72OkX|_q5J%-$S70QGlkCMbBZ4YwaPFz8i{b{c(s_x>(;ew}iC+Az*yS=XmH8BYHax!cw-Ewp2Ps&HKEK}t1-)Zy1H|FVA z@Oy+Ix-+H@U4u{l3Wo%?&+3JCLA}0cKcZpavwJo!N=5Lb?7a^Kj#s2qLBJVd_=TgNl1@Bgi3A3A@x+I zM_n*X&dRl*V|@LX&V<#a;gdI`o8R<%IQpjXeMMOZk7*?8H7b>e5{Pln@OEmP2ACcD z>sY+>nq4~1mu}!59-;Xya(dNoe58va3ER78b7bzD<_MXl*aM+MqPQca3muM(-JD|B?yj!%4(~ z1C$|S+3Vx*(Nd7tnKO_v$3bJW%f#GL5Fa?qp*NHF>jnA}*82}kHQ3YE92q#I8kM5q zpdw0*YQ+dgLs{^HUM-ZrvDogJ8>P^81~l6WM&JeS>~6k+aPC3=v~Nhqqc(l=%%kX^ z{6!4tCmiyK&tnvcbSlf*7vpja3TGjqso}zj;nBHjma9=UXvFssodzRNoGOrL^NNkW zAk~Cvrt$e{)3pKft({S8&5(Rj{@))km$u$ z%A_a`Za?wL71*-fmM+wR0NQcn#E#+K0PVxDe}l6ToPCaWSr~F zD*2UiRw9M251K6cd5*tT%!h+8$>P6Wpl;3If`HvTAq!4$<2YdbXM%U`hMlgGKE!T; zLoj!K12WF%3p+~RlJ()gVBx^uHG1|isJ5IG7-W1zTA8fhE$0?>*_zwd{;(W-Tg7B7 z3^y=r?>Lt4gVoFDj7dgFBPf$f^v||^1<2(rCKoo5HoONf~FI{Wtf!PGJtig-N(D!9?!Kba8*u#qrHa4F5iFzEZa~ z-TMG$$)7NN{LL`a9ryKlI-%RM9W2tlQG9WQrn?t^JHY$2rK~@O^vgg{9E@fBA&uv2 z{MZO_JEpz;?Q5a+LjhJ&jqE0YKYm2N(M%$U7XIe8ENDAB4rrI@&`w*PiL}wPd~O<^8E*|U*m=Nilm+7 zT2G_AwGsKZ)W+QZ>V|4;!xho)Ny&3WK_3Bus;802TOCS)@GWaHX*6+!;O8n29viJ= zxzJ75x*XPLM&7(9$;)LVn*$ICJ20cW$FlC}|B}o9KOf~T2Y{CvB$HAZs_;HLKXu>m zy=kLQR{`Y3EEq5LqN|hoQJ?-m)WE`aKxQpm9THzk+)g#Ahx-%!IwG0ooR1%eTvH?D#hK%eEa-%-|MOg12NB>st7np40ZH;?3dnCzP?|??E0;D;GJF)ihEq;5ij&(fxskGrI*8yX zPpATpecim&EUKo2D!#41EqYY$BP3lB> z>g@1(T&Oo?IO$ke)?gk4qgfH%K^{Pk_W^wx8Bcmn18!oS4ps0FXm*gd8zp^zl zlu6sgm-e;u%7RC*nw#vDK<-G;>Gk>9a@ddm6_S~0HDA@FtD;!zEScM4l^9OmQ2FKXG9W z^gOhQI@!wtH{?#|uM@#QWApn7;R}KGUL{ZNyVckh&w`vuH3Ov^8Yd(}v?25K1tUj1 zHNqK)CJKkFJ!=#ma~VK^axPRTM$H{zSVB+~uQ)jWdHicNYKx;1uPKHGics^uHwgVxC7rZ02Q+!b!mElPl|U= zlCX#W`~{jw96ni@_Fa;BFJfDFi`*C>zkBNU0LbFfsysZmt}I>p`(?GZs-Cf7raZ-< zgz>{w9Wr*cS!HvdNWlL_jF|=_6)b^i$nzs{s^73#8H7@*n zhOT%VZ&g9d(?#3Gos}5Aa>y^xtLz_7o{mStuFv9@4?fI+lD(V!rF~`(4o8gK=zSG1 z7kS08*2j_Ca^3$EHWYH)%-R67`VeJVtC@}bW+-+RbUcc`A_4}KaW{y2HF6-iN!f5I zorqf)4yan45C$3qH+XD};@AijK1R5Um(TnjQ$(bQCqw+Q93N#19bMnlAaxs4csWEu;4s7=| z8*Rp;`>TO69h%@=-`V9&j^8&Y%}Ms;E;nB?qpDmROH*@&d62Km_4%w+IbBjY3B2uw z$l?p;1mrz0ULjManoll(Z4DcnKQy`_4aTb3JH6)vW8c@=j;GYcQiC0zz#oCig z{q1kz9SuTV&{xKs5eW9YGf6XfE|6z=ps!L5WMz;}gu|PI6eD)5$avG?p;``BYKt#t-k=d zCSz%`U4X9)Y^?I2@UlK4K4{=}COphS?BWHzC2@=p(!Y}7O6zaPA~58qLWn&f4}X|D zZBL^6P~;A^_qq{4I9ju0`pDfZ;_ye+g4_)?SY6WgP&%|71pKR}&r%u0XV3>3hd?|e zaKu2DzcOV(>6;8Ia@i}Gemtn#b1y%&)W!0(W{`;Z!eoeB&@`a>2D!3gYxFL@JMY%H z>jvC8x5D)s@q+K|+I+VEDK62}6JXMhl;$xSV~ew52tnf$;=jV$JImz^{^zGfSdv(^^v`oF_`!!{F zAh#tg@rM@T%v{wbt>jw3oo3fNpO`_Tk6g)vA^P)AXF{V#&5Catn;U?4*YJ6-%P$Nc zKUYh=xGLAqj_9nYl?*_*xa7`;;*(*kGX;5{w8IrumpnIf(LN1PbZNfK>o8X0wAW{F3`r+C!lR^62oaZMwz_l6wf z+>iBLDWMBp(S3$4wG)YBA#j`~Dn3cDEWb?y#t?UJzX)rPhaKtzPH$S=lVOR;`*epT zBS?V@ZMXP}Bd-z}-m;`Z+Et90-t|XYsbqjOZlJ#k-W4XyZ^9BdTr%rexRLlBn@Bi5 z0`KN(YejuY8@FAmcHyb0XZWjQ`tG-hjsh#xI&g^LhAEC17rPD%aNST()Y+)pX5`JA z;^t0_7|a@yW|m#uG-K^;9V`bgtYr)gVux-OZJgb37j}-F$atT8WWysfcr5!q)qE+D zOWYF3Kd_CAAD=tpsKxg7p+Yg$)fkow${Wmief*-*&dgP2BN2Gyem^{bCg$I-{OROh z#H1P*a$_q|pCO3Z7E=@Ot6~Ibx4fh>*NB_Lzq~vFJDS3k9*Dl1#ajgU0CG=&x;hgC z$H^p%jVXHUvKaNiF?ZL(zl!|MnPXcEaClgy(#?zsGVB(`B=w+e7TS-w>X|!eeKx>C za8@v1$Zh8Y7a$f3d&m_b-jL%J^jHSO;hHHrwj-`$e0>s!Ox;W8c^*r5@I5;#^rJ#U zLpX|A&KU7g(zVbbqBT=sRTP8HWiqw7 zRVv}sa-rurpL>_We0a9DS+c-KQpt5jG2{3L+xh=G!trxjp7*AahF>La!3`JXi?-%s z4BS3$cfYK}ZSU>8d*EAk zU^t}j{+_=zgac?nFa&acr3Kt8|7B&$wwXkf?~&YK=>Zo|(c0x#E)`$lmB})~%3=51 zGE>vmi0QSyIIg(^?z;UET~S>O9RsAEr@aznJqgS5Vs%#f<-Vhw>kSlXo-1h^lGHLH z+^^a1)JJWjgLb*0ZpC+JfvzRtF*CQ&P`H?UN61W1O>zjpo=4L5GB{`kgviRTCMCml ztVXU*lkdOR6+$9E()#0FA%7=j#DU(4f%+_~2Pb?WPmUofB2y2CI)zy+wjp8cs;%sz zs+42|b1oxhvsWEKaFHUKd8rab2tt+j9WuOM)GK|Gb-gF)2`C1*Xj(p8 z<&<&y?}?H)boC)=PnfGRM283`#v#R|fHtU-QJ<;N?2LiPEB{ZZ2(4Wp6p=4BxyOUYKMwx- zvHh|ShtuaBbywCGb9E(hXE>z()6AZ1p*iiD9)!YA(&FR-b01T+um)#8 zjXHVCL;&xCSly>-hWw-0L~luUP+Qb@tQ5hm^$n+1*kNXp0_fcje7DI(bQ?#XpXiy)*s4QzX~ z*t9|l%pZL{J{EbiLPd?Oid zKX@;AZ^8GdgZvU9ny<6!hLt-W+b0IR#qw(<9aL{8N6y>b0R{UXderSl3)Kgxu3r6*_=?i`iyQyxGdTO-~2Hz4lO7 zxhj5!GIWiscw0zG7#F%krs>x4y$XTTNKzZWx>fnxV-pp?JQvT>)&&o!TB@x1sp(lms z9xzRBsM`6mjs=S1LuK?dv872SW8wAW!Om|MV=A~*bX9FZ&nk>^-XW>cV45)I{m7;k z;){$}OY))j6^S1>;Zw`y*1sAX2W*bqb=fbdCRkja5M`kSiK^mXCP^9rAMSy(}OqsahFu#mVli{=^IVdNI_&NpM3?my2;8(?uv5qqLb zzRaWJvFOJOmQoc&c0tz3n*2DZ*uP6sEajEv(&pDc5tMG6$dvyh*NC4YC#x@_vvmV& zR(-D}LjZrjhrv54f;D$KIMpwF9wRZw2qR(HI)Bi4PXPgoN=k#zgCdd+5Eb}}thp-w zp|*BD8h>@+dfzQ%=W82U!qD5)Bm(Dw7>M%9NAAB1J#O3WDFw_GAzp6na|(+r@RtB4 zy$?G{j^?pzX`(p=I#LuvM|=@&8Db~rCdu;F=CuB?%J(b1tGmBmL|fMFEC7Kpqr#`G z2z$hO)#H{nT2^9m{HDv?B@A{37xVo@Lc(!(pD#g*uXx`|hZyrwqlil7ah+D%!~lu+ zd{8AYAFrhq3drV{mJKFRm0hF5RHCY63f$8}H+8TYy6QK==#LXQ%HFpm#Ku%t_9|l9 zUm>bq_@qY8-l{ z>Ep`hCc(aQg!TEk>K)|1_$=Dr1K~PAeQlVf744ZLLonpR>T)+cWX;nS`B7;P&qeSG zyH|9+#SA2iDp1|US3rS^fZC2Zkt7|u*3L9{5TnF`)cx5M&nScjuFTth{;60)3}l<9 zrG26_AkY+$P1fq7g2-!nS|*t!*B}Xx0k2Yq8U*uK?!k(;ah--WLBWx=S0|rrauhe+ zidf(3A+I}u`Hc&oI|?7X{-&Rgt+hUl0(iZV9} z()PE~1X<0?WqFoMhKPUy9_q1&qI&*kPItt4980o(;uESQ|5kmzFU|-HWb<7 zlg~xnSbwCiw5|A4ZN4xS&I&jApjv zTGzBP>0{}i!Kd|9gO?+?S)R*x+qlEwHc9WNforD1*C9a#fgLoy9xMG!bcEM{_is9_ zl5~M}c{W)QGHa-IqWX34t-EGP_Ok&nyk#AXn3iQr8$n{07GYmXnnagP^~!Ou(Tk>xXCMje2j9u7K=H|sWvpq}ubS?@*aXW+21`#a;MBQ8fkUKTgo%HiX~ z4|3q#fo~=w5m(}(IfY}VzJv`xA3(K5`XZp>t4@>+_e1^?YHRd;u|O0iT+o-aeB!7U zlIZ;zbaw)yo0vUOwl*U~3;y{0#($Edh@Bir7FgC>c=%;TZ!U5ODA&@BE^+IA z|EHB(Dp*V#uxml zN2UUs%$Ys+q&3qY4I&%!Bn3#e?7SpWk7KMeM5;MeAU;`fNDerin;eDQ?%s~{P|zPj zyJd2746tQI0PAd$*pQzRP&3FxlA%Q`YCZ&ER1T+IzC0mLp5_r*RS?RVKUS|7B#@z& zRGV>0X`*aN*NTru_5kU#={Vd@=asWBMw-(kP>g9%-E_ndNgI9K=v5ZT-TT)u*Mu4V z4)@)6RVC+l6yI^y^)9|0+64IIv!;^$4s}$Al%BjL_HsCo10pCvPTF7BgPwGx{-7tS+ZEs zMJ9d#zLY<&w$#9HJE7seBfyExzi2wD$BZM9Gdxc-m)p*xG0ae%&@lhb$O_#o3?vaQpBBvQ(9(#qXO_ zkNC$Y_-qg8T~RP6SUBpUScrTTWmfN(x>ig$?6~bM^U!IpYQg{-J}0bp!CCbgI5sgg zA`<{I-S}z8Nm5Dd#dGE^>k0swUWKuV7A7U*uiw}Hh%=8V5A{;0t$Vzw-2*{+S;h0Q zt9gRiZ0K6kMY5;IjF0!-`1Hh)!x{*MxsgO^D1yAuVd9l0?fygqt_2G|VGa{s=Fs537kOwO&M$qS z(eL>)X$@8}c9!Al6I`ze65@~@xYGSQC=z+k2To-Q6l=Xn}(IvYT0!e2)^L+{Ne zB8f43>>T_M%jYU)NK((g_uQH~6v55`*mSeIaT+ju8!oS8?-+GbGD2iu`V{VS&b_-8 z62JqJwfcGj8^t?38ozxC7QXmG?=FOc&@C3a7pp#dXuvgM5@6Nf%{$|0+1Z2JyLA`! z%4Uxpimt6MI(RD0dMO2|6?AI98}89;QUnW?AQ&u&al*_LNcWE2ZIV2+G%9Nv8!S#q zwX&&SqkTXKbF#eYz2l;%EPo}xw6E2{;#K|o%D06nV`F2af{?pXOGssAv|s3~iul`* zyTe2}umbW`f?KnLcUst0tl#+^BAsuAtEHhCm~Uyw=rMnM(DXM$dF>6kbMgDI>2g7m)mmT8V7M zg$c}Pfnz%m!e;CldGmQEKhh?`U6e2d9QKQ^%HM@D2xB(q$xIC!AL}wxEHb)1u#!A> z5&NC4ZT(}@Qj3bqFJ;N>A-s71148pC>mc6m8UQCo5tnmUND)t?ztmn@uQNwrGxNq< zxl3+|cT0HgD1DWSq1VkFN}iX?hv82)?gx}|^-IFyMXjGoP;4>cQf8P z8H}4x2wz*j+C(SaoMk|n#I~ylFu{q?bM$iT^4-f5^I)O(wRDBKGY>(7BekswH40ibC6IaoxYWJn40L<2!}mW(oTiNYN*b# zSZ1M}`W~4aX~2)>Nf)7V?V3SrXq18%41V5^j!h=30$KDe%Jm_!c-jJynAM%~HWV-* z88ju!WpoPQ9R7#zPBNS1vw-03ZclO+Tq|{crQOSLk}8v88hiZ=GOUXo{H4kRbjZpA zNJ7T|N$5&1N!1Ju?Lw2$1IMcAr79o#kVaZ(vHGU`HN3CRef&H zk<`3zLf*T_@%;YX2aO~$3cZnV5Z^!6d6&;KWxR;l_8`;~;`b%!2E0y1@sj_aZLm?Z}ckb@3B0py_1>`E(`zK|IEo1YVT8XuEW(n;~I{>>P~v%ZAJ zWGVDWp1pLkwrgdV=*F~FC+|j5VxbSzeF)gXte}$dhU}O0!BHe)(Zeyb#+eL5;-}N8 zLbUT;^LD6Geq~{-S=%m<&a9sc<=}x5Dv&r(dO?=RkRG8Q-{cq%^veYu)ed{avl#YM zyEx5OXKQH{_qyXoo~I+^$D{5vbbk4J?nHLdz5#Yxr{OJ^tD%_d8l}7x7{WD@n^(Q) zO^edk6TSTVu6KX%h;Fk|XC+vipIo4k-UEirlRk{~Ui5^Zu%P#%cNnuumZrHF3zD-@ z_986IeYx1vf192gcIl1R67dBO6+KoGm8PFde7D@AVebYai+{)@fIC6S>~;&{Te4tX zBF8QW;jupu=p=kn>>jZvWXAN~dMNHcy`uOWQwaPD5Ee?q*?4F^`?UHxH~06{R|EEw z(j(A!8fU0;=XyI`MiK2Sq#0DoVENDpKUF(EszDg=W*!eEw>LQ7)x$&fLWb=Ra;GzH~I1#O_GwIW?pC$MB+8C zUvgc%NE3}~7hbTwH}Fp0MmeqF6ADKGh;`#gYyBldfLOWztjq|BgCdyQX`--I;6d5oY9&*C}tpWRC zcYL;oJMxC&EPT;cGKLXF&MCKd*M<5=LeY|oX&Ykks{9i=8;zXl82$uJ*s)&Md&5n*;h=BrYDR&4-o2w!J>i}+cKW{pw#_~^4jB10hvia_kJCq{o8&Est zrCc97t1tO;Ic^3d%78fGexrA>V(oR`hD&=v@eYuMBgue}&f%}NYBWaRQ76kp-7n)c zUTEGvo(p(f=-XxG`B~ONU&VQWM{CFRMt?+Qe3k0Ov~S3nl9K=e(9p;}rKJIKMchL^ z(&B}y&j#AnYI_H6@?bH3PrCxjy2Lo`>QLSqkNPJ{KJbT+_eG&@ z^8f(OzkWpNe1uHgAJ>n12lg=u?yP7ME;RSjUKFyf<`d5J1}XhZn%Dd{X|5=w5^Hkq zv)v({cA#)@a^~J7#?r7*bFb&}MW(!hlc~ zJ#Qvoh43`@RK54_ZIGwy%!}3%-Jw!9wyc|l8=~6cqbM|jJy+El?gElqt~^ylN*G&nnJ{p7>!|bf0%+bmuG5$fFE{zQT@1E>bWji2oNpNhk1`4 zrLyMg4T{n=K0OOV!2SJ@5s!$9tko8k;ptXwHN=!{?lWvIKx_>Qz$a)25D-U?YS_=4 zyRojvHWPHwMT(ixgQ54j!~g$Hn)4TxxZVp^uX{`t_!^kci={kA8{(sAdkAthjY5fK zhGdKdkCt2*u3k;!Vxl=yi>EI4Ti%4GR1B~VXqItT)llL9hCI%9Aa{b7KQy6b&W9p! zjklODNaLb^ar4jB_FnTTis<_%W+RXW-{tWNQB^tW%2VnoV9@`J#QiTnorLV2*XgBm zKOeu{=+_ij|JF*%-j&UrcxdfS*XhH8&~-ho{#jW;OBYFxbTf;s3c`XDENiv4d(#s* zAW_lSid}JhlSr3?UFtIzsdH$wI~$mQahCYws_=9qSke-9RcBV`JrYU6M~*sfjv+ z@_9|*fvS+y4xf){`k^lHoO!%@i{-073qvW@Kym1z5-bunW|R5G7_qMl7A|8Z9VL4k zNSx|KqA`!B1=mg`2c<*zWci(=z5-Iu*}R<_*V)s#DdvGy2#Udtn+@tX_AwI7=YH-Z z|1{fEYyWIcI5@dnxc!dn^9yrF>2e*%@0L|wr-TB3sQH|a@+d!Mc=ecG)Urhz8PFEf zfK`vb|7C>MwT6-G-(bs!SZf1I#uR_?@tsc7WTrq>yz;N)URoVeP`fk`?pPcQzodQb zicymvQkG1Dhm4)IoRCNA1vddPx;ot|Zop(rZ8EYgkHCjC&>>4XXW)QCs?3!9&j*rZ(E97Xq{8Pt7o4k-BD*YnzR=D%?B zTT6;OjjSx6Nt<7N6Xg@Z&Bo{y#o~X>FU~B(R@oiG`PWt=rk`S0E2HVK-6lD zEh6q$81!T=31WK>Zy~L+7cxr8|4%mCZSMB-Tm*kn~*TYx4XL@|7Q7p57WE43DU99yd1d=#0_g)hj~%lTK&8ToXq`S|N7Kx|Z{b9l zc~+Ovb(N5Q*Zhf$vK4a*YLXo1%`Ym5SK>7xO$LuOnCV+3NiKRVl&%k=_f!9lMWRG% zK4Oav)~iz?s9k}CyC5o*41i|j#1% zMzT<63rCYM#GrlAaCU_FuR*)pVFylJ+cW7;Spl+MPCqM^n8Qs=VTT*Hhtm8Ie$fcA zBpU`>6xlBd<`C?VZ)2y!=Rc4!S3e*TDO~fpcQ}V(G^m zah>A}2QX^*BoN! zUUE3zN&2{DG+lPp@+D=DXUju_R(oDe+?!+=r)NStY_5Afc3$OA6YbJ5Dy=5tEvc{5 z|5tH6WBCC+%YtU+rSS5{mry|*PQw@_{H+ZmD}Eirn?AOhpz*}X<8O4(v`Bc+1p_%( zXvJScg-Uy9qNWuFeT$FwNC)++>C@S1Sv@Qf|EQOOuiZWsW7vl^O}2rNYY`gb(kxi% z%@bSymzm^$jBr^0YhxrolUbSS_~a{vLm z{%6J9^ZnAPUy}HXms-gM16awiG8~x+ERq$vaLNA5OGJ0aBC)&> zDcdZH{9;GjU587n0mJ{x|0Zc?2SG?-*%>YsMQaaH5W>5BB;6+pOkN<&=epF)!ONh& ztSg?Pl~_ZiUQfj?kt3qrtakj+VR;1llo#Zx*93$ z5bX7xTImx&2xlJKp2^jqD;1Gn914SI zMU`ll61)(5bFY@MyFKp4L{KI9IiJriSG<0Ia;hgwd{&rW&1lsQ(roh63#^N^Iz){{0QyUY zKd_%qew8zvCtXqrnY|L>X50bYK8_2T%J{4rv!+qmQ&AEMpM5dRJ5uEh$+bTEqU*CTfYz7KVfdLd=U5c9;)R+CQJ5h`1@@DL?o&iYw9 zuRNMR7dr;#DW6=iZA$_bwZbCIxQWF`^)%gsj$5f;%Ly|ijQ)G*%NtE&wN6V?6xbfj9OL^*DS@IFN|036^;82(FwSS|B42bVoJAG|)7Tqg>9VH8n&3jOl*!m55RY$*Jy z*S=w-QfBvA;6vJdl);n93{$wDyk}82?dP=a%ya7;{g|xK6dNLY{#k3da7TDsg7Nvd zAAocG1d^l%u+pJPm{TVuNrEYUAmm+MMNljdj6O49EBxKtJ?93-JNGmlI#F{HX8TJW{&s)d+JeJp5=@V!XG3TQa@FCfuDZpu*nzo75GJ01O-{rZ}0*>H}n3JDfZlWTAcb93$t18|o&hth{Tqa{FUhh4fDTE^dG zPAhcdsBw+|1abH6Y=RNvm~!gxi*G(tSEx*2k!6at&S$vh7-zOS`qT`Dsii{CFJ(Rm zVsAuQ@Cp|jESY0r_xP_%S60+7k$T`(AK2daqlQ^vUnf1Wycob1*S7PF_(SG7-@(KT zkg)j0R1r1NkUt$pEfiOr>LfamJmD>Rfd=oF0HZ~vWP#M*U>f6W)hz#`ZApfi2U)EV ztDIFWRb%gIVu?AqfI-f?18bPt$f@KX^GpQHYc&&{hXEpe0AtkRgIFpog8*|qC-K!2 zThWNQukIKIxiDREBVOa(LA21E(63M0YMi*leHUpgVlBcO$(?W=z#vRJ0l+4HDp z#)-aw6%|?M7UetUd+8p&Gb2m9{m9LXLV2e`)T1v5|1Y#%kN{u~kO|M|7Vh5k%np}< zF$9r4fo0Kua}5ozYr7U{(PXG$jV~`37Q4vb^+N>oT2Glc|9PA)V0STWjjUKw z;kOG<>=A-yeO$vOOSLCRsx2|2H&U z`sh7dNp=D!?^-26JT&(naCY*ebdDYCX)6%7Lc=F3rH_C$QyS@%8P1oHx}z2~vk+Dn zGK|$AE1wylG$eaDym<57n_Y`?l60jsyxgY#3vwGsTr=?wUd}NW4~`yxYsNH|38TIe zdzL<07&33(`!)*{!%x}&kSaMl9TcC~=14$^P)SL6*MUw9Xu7_rTv%74h*aeT0CDJ^ zCD1~Ov_I2$NlIHwops7flf#{*YsbwGZMGm<{%63(e_=<4TuUgOiLJu{6HfP z_0`LGiyTR9rV4i5?1pz!49TZwS^nvyg#axI*kbN5adrCdSKlL|R@Ek#M~O4ZV5_qd zv%F-y>=?W5E7oPY)bKqT{2h{W3g={b@0kWcMmrz*i=)so0 zd=DE&XWC|f)uiXzF5mid7i)6aK^hOGLdnJn=s20RZShVTyud3E9-cSd@StFZl^4z% zHX%m&8H}$OObGkW!-jmX@pRNq9igrozWB)*bh>#ulx74ugVpG~dST6ZVDd9#( z&B*$n%b4s1ZXz1_N7~w?LqN&P7!gVzGt4ajda7REpZ(0IaDe^ST1d0B&Ht#pA)b#Rf*vU_3-LTdngpZSC((=`1e$Ha@St4|~o{ z@ZJq)KTWX!%l;AlBM2lYKjaDgvKRg()H|kD>$>yS+Geea?_P4s1Z=o=OUA^~$E@um zrJ%$lXBlQmzUD?bS7HxV`bZwwp3P12b;Q}`gm}SxQM6H(DB z#i2m6v~ggYX9oA3>;-9+ATa=!P8xI(k7>A(k1=yPiv!B|m_KwHJ3$R14?*R%;aLqK zJ02tGgr4>L29Vfh3YY3H^+RbZPkFjPd=VmpIUitc&ZI>k*D9IL_I}) zI(w+0?4|MLKa|-CnXh7w)(su?Ond{jCp?L)w$?ud3K};rKZBAXi#1Gjh&(vx-2&mYsv*?E386_xY z00KgQKtc~aKuAJKfrKl0FP!_n-{oVJTEi*})dDN`TVsF17yyIm%p$PbXrB@&%z;RzTCx64!Be81*Aep-A z(Zrm^JmNQjczQf<)?mKZQn0JWFVZq(_i-Bs@CJB=Zt9$5EWWcPTU(q2EP2$Nj(BA6Pa54I81wrd zj5AoPClT$%F~3+kWhoFLFHn1n8QY=;pT-G)6U%Y{*U42+QPC{_bymt{dQUvy+7W2k zOY381x1$R6egs=RsIEZp&6xmQ9AxjD0Z)mQ)_aqe4Tc6wpUdrlpVp=YoEAPPMbD8z z$O{%5IQ|37i@AC6!4qaDF!_gHaTytkb-p^Q&NSED1_R5z*EwJ52<7_pkwJfS*1PGh z<}?^cSm(@q-dz&sM1&*);3cyN42N1hE(azV^;x9BN|bvswvwd4Qff6fYlex6CDa6- z`UzewM$d2?Gicz4Q!|f^jkb}ak-aeQP#7j~hkv~n6ei|`uAS)(iew3OM*#BzMF~05 z9cgpyv5gZJQoRK`PFrcXj4sK~2Dx6nw1g!AcR7sHEUX(JdAPwReb0(j(39ikZ-Sl? zhnY4k_TT#36uc7aWj@v~`5?fxCc0!NuBi`%Poma(JE!C-A5Gt#{uiyj*!yo<{ZYm_ z2JkL_pU;FRM3f57tYlX`-Lnh}FFM)*L_(RTot(=2e&GbTnHFDE950phl&>gY5|v+q zWVNG|k%PgC`}tf(bK*iRhUQm~^+h-+CZ^S-tt_b6v2zGfCeKElEiNvHA8T7pABqF- zu*1JRDh7LQ{HjSu^KIG$gBLp~jWh6ed(K-Y(M{si-8F*N34gRB@aKn+ zfq7g)|5^$v3VKi&dr@Le=2P=ZyMvvA7HR;uilYQl3HFqU$->IeTbAj>^i-+zQ;lP5 z8P)dq7~h7ZgI&F%HS%bqU-6rOx56|u^mOuYb^Hr;!SfrjUhqNY8uBqx z&X(2(kH0eVV00HFm^H6TnxC*7`$nusHq6Rx%ErW;cx2l;hSuvO36qblErP*-)PQ4z zKf(FpAYpSHrJ4U{K>J+&ZIkC!-cFlGV1Q5ZxPCXcT@V1|4T>z`(K(WC$Sin# zN@pQ&Q%FKxG5Sd;xdIx|FOmzFQ56FI`1b>y%fWsZ=Fye$`eEMEl?vvPn+oOC>lIFI zbX@+8we}3}_U6Sl^wDbdyoR+f$3%drH2)OvBLUevvMV%VV9p$_z6`pvauaHN%bxTmF1-X-q=FYenmzPM932r% zCLa*mGqdW9nYT_$!JUEV4IjT6X8sICsj969-kw zit3Oc-K4!uo3E0N83Q9d*_-6Sjad_Isebc?=iMRSy zoa$cv75j-|YUstxqys_kOFLc@tX*PN{24!yORdiPJ=?44v&{-UK)cP1vxMF|K(Hyt zU+?Otv$2MbO((nGg83v6nIXug#b4{F%I!7n83w(vGBlmzF-~mhkYzqn+L^K*gWTqs zTVV`z!E%#uJ$UT4JFNzgD=a9`S1erCdHpZKUHxB#yYa;1bj4KdN1Tav8fX)j#^4es zaT66zSuV`}W?t=MsvZ%c=f)0asZHFvwO>xqa8JDmmv_Rz$!N zW;Rb5%8C!P84sJN%hlYgSZTErodU}U>KT~kRW08n`N;pH;=8{QmhE{#EQai?Z} za>1!=*$F)BywUlfVbo+S^Z_%X?(4c5g&^>m5140SH?}zY$`nQ#y|o0adkfO};%m_7@@W+2TmYS*<7`W_Yr@mx!QXh4YcfYGqM82c z!GbwNcbjT$knvM~WdkCtgx~%FTiWM23=xO#n`f6{cE1aFtSa&t#_UD@JU?Y*JZQ{g zD)>kb`A2I?$K;*yU$XsDG_il>@-^G^`bi z+Px65oX2Q}-?dJND=hA3a$|dIk8DgZ8f7`kFzfv}yQsL0&9-}L6%@Nv!EO&}k4i3H z;=u+TQ&F@JamO43BpoVK@be7(sVzLS)D8`|y$V>H@n%hUUe9m!heVa#k$kJvSjnX? z()>?#bcLr#cb!@GggZ3jW|?4@E`jtuk3WsK))Lv|u8nBGoKymJ zBKK858Y`MlQF*)UIICcmb>(zO&Ts$W+6hBfq*)MrbLJ@v##-Q?Sd!@3y8**rP8B@P zedvzhjfJsP1I2_&OI4OYzM#Tr4KMXIh8ncbVnU84vp^&2NCCsZQ8<;>upV8Sdu~us zQNdmDX#W&0kcW@uzwv&?E;qQcbAz>AD$&p+*8oXxZH&}}^vRe;44a=z-X`AC!8WMt zbIcR|3Lnf|U6th{UvE9?Uf`)=lQmq-=SWu;sdMj|IPP$w299Gwv22}O&OvPF{g_d(mG;tSALCR8^!;8I? zybzm(6g!ry=<=2CHSpp)l4V)WFp(}NG$Vu@bUtSRkDdre9t~ruom`8THb3rB!NMF^ zp;AFD_SgY7Of1Q@Za}#M{am_)cJs?!kYIn5oLTllG@Bti067)*OS2@i4|B5#;+t6x zLJt)SJd=|>`WqY(?AV0%*{K_|k8es%)+e9#0~vOw$GSZ!ZGj)lb?trVnRDO9-8v8A;7{VJjX6BrmZbQkXgf6!vMz~>V)#>t=eP_ z+s!4l78WejftuBX0@{I-!&J-?l+Q%f;Y;`W)#G~i|07=4ww_I}l%*6*55r<8ehr~$ zEjWzE#-%qV|1J!2^0ue5lMxI)+ja{7X;2!dzfW_mUGmmiHX@BWkM`?5=iH$k5aIz1 z8b6N|cW3CQ)ATpE#$IRDkKBNu5P<_nvhpY^AM}1FvKBmbO1j~uQFC)uxrf(fFba!H z#?KueyizRfse;E_d!~$q4%GzB-0IObb)$6E8M&1oq+z0eN^m=qaAJ{A5!I zfbja*5q+c(;gsA#g3iDmGAmb`mS|8B7(TKZB2Z2?g(}6{tfT9uYJ{*Rhnk}f&)9z< zi0wK_oE3h0{+x}!@##nNBKRhQeM`^e8D+(d@0VH`e6N((MN6a;sF@0m-g=HHKZ`Z2 zDqG>tLRVfdCJsYk2wLGBXAsORm7@C-jR)$w;rgEu-QJoD(r0>KiQS2Bq#w>khmKmH z!E05N=A3wSh|$k2;L0R!nNaA%%FRUGBtrlGJ01lEJ#`F!Jzwzt5=84*glnZ!VXd|E zw>0alwdaOj1_zwS5-W)v@78$wo5 zE`4q56sBx>N72PJ^n}grZ!r$kB+0R zj3j@aCOeUv+8l~c*w8{NYQgucb04sZiUjm>WNSE7Daw6Gll%Q7rsm#xqohc)M@ z1&vHK!<-JsOw-K3RhM}@_L_^$U)B((xE+ zpJj70ug3TXIbuKzq zBcUq^kdUKXr)2HOsJXcC*|>~mLe%n?`%*)!&&MBOg$-rfHz-o4{}AyPY3q@ow~h^O z6+f(X**>-CnhzK_q5rg6oOF$Q+;(c@rdZ@N@nLtKJ~mHNvu!z*eQ_oB?81=+I^Tk83QV@#^iu_;aIkxs@!OGWCm_Ds!S2iPOspv1 zYAfkpbI>0hi+_QDwRnheKE>aSH?h2S<{}y*3dGi*nN@%yj!y8d zO%F*{p#6B@Eu2SPv}4RBG1ZCqJzi_q?#>WU??Q4bP<|Z06qDg?biF9s3Wnf;q@N%@ z%A%CiZx-dU&Zg5g3I7eXA6qVtnt=fIe`_wd+{J&DS(q21$XTew$XVe$dSy63MLrcH zX{NBEZYs$^ncnDqCRnK<#OBxLEd(Bj{YD}eRP>%LxwKptTW6!}Zp)2?updC4eKA0!k4^B9D{y3ap!-ORpxtX2 zwzth?am=Lk;>|ADp3c>qCpf6mPhZ4FA4xx=t057Q$Q23_agsty7>gA9*l38uEA!Cd z-=&P`CKp4P*%?2IMyG3($y*pXaD>_Cio9?p&cGi~cwB{y zuW=;*4)Zwhda(ezGY*VGa&RHw4AF_(7qY@O*%k<;fUb-_Pe3jNly1<3o_Gc&@O|hD zBI=?M`pjg!%ndIC)Y^CYpf-JYr*=qs4+Sndy7*vJuI+kRFqQ_)2iRlEFsOZ5t4USK zEHxr2K0iVnU-Q-LQwF_OOBqnE8zN&mBqRYQrUMq>B_#$#Ykq;1S6UjCPb8>~tTpec zR)thLtnMH$g_umBL;c5IxRTF`-nVO`9A3z6bnzjzt&CAb8280?rsl79v|;R87JuoRHXUE*=rDm`V8yTZ{R-D!?24sL5Vq!n)6jD&beEALlI>oM z{p%OTK+$m;j$ll%OGdmBiWqom!09!f>+Q}vkdb_f1M_{xq?0Gax z6{HB7O(8CkKjO=F!ZuTJ5(skHvWqA=Z;|dG@&mT=tib5|5{>m2m{q#yb*E2vo<^CC zJ#CDQFxV4o?o~I{VPbHXw>V(Qbny`V+>Fdcpy35%zF1FujU9c6(cig8kd)zj!@gQwHYV0nFah~oN%LZ4wWW5L_RshnrP9)J z{@^7dV*Lfy=%qP#3A%3e^huLekzK;w(v2*r;MZvB0o4T2mtDl};I$6=o1@x~Dk$frG5a>V%3pA)J zhC&hu-4L!`^ozw$bcdSm8q7M(u0#VB>O@uNHvyt9@3Jf5(5U}uP$!9cuxzn>bPpFi zYn-4jgzevn)%gWtTFOrqV-Fy$OX^OHU$%5(>J<;z$_|QGdr-!vD!r#kmGzOwZF{oh zMCNxUUyuHAYL ztJQ`kubIr}zavqZ-S6tW2IUT)P*qAF<6j&0iiombNvk+V7))+wvOoVzpPn3~S0uTe zwA?Y}EpvQh4?8HN*Vo9CBX3_Vu5)vpASjLx;SVU#gFpDgyO*7dW+utHTy3o$Ys^D>}<1k8!%m`sK|+ga>@|vJJCX)NwgOf zhwXo&!FPDsmbm$yT6;%y~8QfV!R8?x)MovQe zEnejrC;Oc$N!5jwj)ceo)t2XOwA>O;?jn-ycO=L7-zI`PP{h|#myS8@sS~Kx61&xE zuWD_Eavf+s*YF;2NsYQO=yU8f+m6FFEV}WcAQ(AWNu|9!QT5*%i#|#lMr!>oCrp?n zQtRiWXnmQjAH$M{j0-4VskUC*Hf_5fbM=BzNzeZZ{G!cAAy+%~Vh|Q3q~DA()yK8f z11ewXF0Y)cfzB8~jhrosjK#$*!iBwxlAn7Pmk^cR6}+41d{@$A)$NEvogH@3c+6ub z@;^L#Ay>zo%8^U5gL2@rrdGAztGp=!R=OO~iCVL0{u^P|}YNfGFMFy|D@7n#CwY<^5Xr`KR9Qw=yS=LFJMmBno_b_i+j; zH(cb&yri-x0|m({)U~;GzJ_EkXGoEh^Als4{63(5&{fAGcm(LVe!aI;LN&YR68?Kn zN4b@K<4zbH)Ti$RcAVdGN-1lI@aB17PFTN8t;$VI13nG1$Hv`4gZ%f`QqZZIk<6`9 z@~NH0TqeSj?uoiFlEDWQ88Vm*uJD9#%50rDGtG%cjbzV5%oKY7aR z6-@CYBw!}pRcX$f?6@3+;tpiz(eH4i9H_d>aI;2;>xa2Q()nL9pO#{6E zW!hqj%m4+Ize2;%)6Qj-_pfeQ=430?iI+~w`%2-E7sblo?CH}O8@51hu`AgJkgftqTj{HIV69tMZ)9SOo3{P8IC0d_)a z2YW;C$WG2iORG<1ni@ttkpYm7T0xy@@7p8=vL>y{0U6)CFzr`#TQKHcGz|ElbiQO{AF z+%;9(>Y5S1c%JZ$=`^SjdOT=ekSDBecl;_!4upKjqz+lC=(leM`WbQPpGS6wfT|35 zJ&wELi7QSf9XK2N&@ezyHY4|2|2NXnNtoSG`;>WDn+8s88jRik))@#Aul9a;xUz0g zH@dz4vIFL6+^;)Xj_&QJt61}y z8gRx=GW>c}n|dqWdAgFLx9_X2d3!Zhiwl7Kdet|6JrLQM3i9iY=R<>5d;g_QA3pak zX~3e_Xk%so*!I7_7fn3-9PWH?wSxc+T%%y^v8crW{0fIYrqE;*5Y0#9XC zq?bUKwYJE1De*|W*gf{$2Pdhh}& zad}5q0|TQwefCmLGiIlmcy{<=YlQdHA_zOf_C;MY8?&=TTQKLfYkqTODjYD_R0CN7 z4|&mS?zfxz+_ezbhMx1Kam}^ZFCAh1`!Z#XAodJCMWEsOtQH*!@nuCZ2o^J>xs2zx zpV&fe49mc}9XW&d=}JL^?C->VxMPNY*jJ0or9M_)P8bNXWp*-VM~Gtue@;&CUu~>` zG{<(%1hJag`B&ELrQQ`^nQ$xXW4dm1%H_IBZy)@zj^~rTd2T{|1Uj^st)XC8eZtlR}RjiRlo)hW`(0=i3 z1_y*6g#r~wrCQZr7FX4S`yYEm5gBrC=ib0o^2&#Q^jLrPi%LMPd=-#alR0PDnu=QC zoYw`PeTp3zjzLQ9eXReHJ`f(}8hx}l2DY}^xO86FZ>l{m8BifKM#8#^-y+;8z^}2w z7L+|pb;r*A{69{;-y??>&}Tug&V>*UTi(Twsp|vIM9yH0j;@xs7iEOUj;!to5?GZL zq0(s=23;zp*Ot0tg-oMQnX?dap58lDTaPenv;r!me#T4Za6DG~j9wHG?CELkszeH3 zwKY1T$G1>lesipUX{{3H-K-yspuH`E`FS*l{9Cm?%nd`sM0&B_npG7TSk+VX_`5i` z(Ta85wHavYC8+kp$w}d7C4X|^vke9axIakptTUQ=_&3oe9~7t)os)qhL75YU zV+#|PJe9|t*(<*Us&eAC$cf*Y-6{*|Z(R_k(qCM04&XE&2k+{@?FfOLshJmuwSTvc zwLj}TmYvGKY4tr=xZvgG2PF?2Ewn7Z=$YwT5&whAZcZI@Gk3Uo21j*I$jtyIbG?jA zV>|j|x9YY}2-;9}@TWX+t89vh_2?DkNtd1A6`+awibyFBbV9PEmOa;oNPbNxoGlyd z{GD;IE(MSuHicgI=*oc0k>vx^sB9CnP_|>@tcfqEh`_&pgcXrjBO$G{trZAp8Z=e~ z)KK5O7oway64gvVnMHTF!d-`R+xvDCrM`PL0a3duGV$G@c67cfofV_(@z42BoKq41 z`pPvI8OMCv!@mc5aQ;Et;ZGk>+0r}mCJxP{r{wYYPs-?$^Hnc{`(HP!Y#_Vz{kApP z=+kG=QP-<1PF$2#LB}1emYiEKRhmUipP+naex_Eg@}iFof%LU=EIh}#^4auR^Y~;m zmf|~na9GlX*>M||p*;Odq0Uzp0=d6VEgkp?&FiX=175qaHnXce3;oCm1XYLmw-C(T!wt`;7hDrITjhmJ{jXp*;2nhL5{p>1VVl+Fpby& zMG7bALty?tVLqzM-$}fD7VY*1i2ICccWU`2Vc%owNdHH|z6pfIZqZFHer1#7n#-%- zW%4d8)eHMh<+q@tN0j={aa&hwlF3sIUA=51QLk?nWHDLeL{i434m$1$@do zyu>E+k_UR)+N#Lc0-`xwuR&Rx)lQP`uWhOT)~Gw##6|t3bn!++xQ?9OP4I4y0Sja+ zAZL@Iep>I}7PX;#-sawo-4NuCKL6X!PRhYPgM53LV_>gzu;|7oIl*ay!>rb;$^^$E zFyDA2=f{AQ26}1@>RZA|RZr*^DWt+5DGOh*aA+3&MJEoWOsQtE_t|G_FP0oM21{eq znOoc&51x(v=I*5#F#NJY`zw-~nFW~rM$`&VXyR;q2EZ%6@?P{)KnLjRMGxSyGt0@F z*%bqSd!qYZ8v-t9pU#`YDV|q>)`ikHMWW>ezB@W&%^f6LfcTiY)BNz6*jBHULyiwt} zu88#=zq||Kl&d}4{kD|spf|bJg@sh2vKOXf%cS?GT2px4&%>(%*X8S$Vq)c&s2a*v z-g{E@e|xq4U%&m2Ep%pf#PZGo0?OeOBioqXRE8K;8=g)ZTyxfU+#C;o*YX3+B2 z_sAUjU3-;@!tD1LK?x>P`7qtJP<;IoeeHhrpXxw=O(*&yB&F_0eBx0ffc@PH&g8X; z)#J8gWo_wA!z?9n1@<~EqJG_npogLxR`<-QO*Y5{^xtoz8@m$wZjgFP9(Gu*33~wuR(Y^~O zh8w(D@mL!+*utx(p#{8#c4K3g_0A|=kA06*xvd9+?U4}o=;pEW=%SoCoe?u#;}O&0 z37=(R2+D25qYj34uaCMjB*Lr=y)hHb)xO|(gUJ1ma^1W21op|Gwf-GU-alk}#pt+> zV0BFI@~bsh>rCdx&wQsmgTFtpK6&1GqKyf#qE&T7=Fb#~T9W*ujUN57pz1t4`)U!WgrZ&g#6E(2A80Zw`93@nqCq@D0PLVeOkD!HS zRNbF=8zDHK$7=eL_@}bL=`c>>^Ly(Dxs)927|67@?_eF=epver#OORMfWXp`{qNxCmpK{G98lK8vcv+ zbv8fyrNE^~mtTA@QP93#O?owDXuiPKxjNV>yt;{8(c4)FW+Ge{msIFI*MIYYM4+*;P|7qeHNxQo-+x7)u~0e8i14Ft$<9lhnA9&y@LL@3nH=m)<| zh}Yc};P0^jOp?=%cZyJppsN(Dv+;tsPJUY?sb!+9^WjnX`p(<2=O9RxH>e(fX1Q;^ z;`UF>M$rz=$dPX(u{}uG&8t?oh32L~HZsBYPQTbJ=Ow0w!C0eN0 z{8SoHfCmOZb<(3lw-ku}0sq3-lT8HLAlb^uElHnGwKL2eaYjO0n>j8QB7B8L9 zc2LTF(}7>L?tz#dm?~Zf6|12jR$fEWq>52mZ8_}4lZi6MGE<&~W{JnUl&sq#$k}1! zzb1ry{-d~|O=I#st*Y!AE@tgM#X$?G>h~N2tEOG6zTUa{Y_PuvR69|*@N&VrU zb$F(dPKX>?`6kRWtk(trd_O@4-sPiwK6@Sv7U(M70SqS7;u`}8iw(N-6}h(X_9D*K zgva8$eUf6}H`&0;=b?!X;-^^v@azmrTE<(f#=3yZd%TMVb9nI(Z!K)5y&`FKw@}gh zpcKTYlpIDNeRoG{Wlp;7K6fetbku=JUG!=xDV^ z*b8vG`4f;4CK|R@v9M_euj;OAjGg6NAjhAv6P%WZpi1g?v$3K8^1eSzv_pk^k*HQH7!Z% zwxZrCRr|LKK+3DX$E*gS7qY_+fuvk=B-LBh!YLreF0WzQv0y@5duh-tx;S8*Yb{_3D2zOLiT0eu`;DyoTU3Oak}PW5nD%PK-^M558`ZAFqgj3+T%9H5L)x$R&k>j=t0^|e zexFZ#_eQI^Ewb9syASmx{`!kyu&)h@7av{!qp?kUZDILM-S@^t({{AB;Ru&T$+LD; zV%o&q`AzE$8nHqXU0e(T_7B*u79Vc>AFy2w>0pzF0u3@goX3X7e*B!{N#UTS%gWrP zvj6WpX5lRnX~yD9TMnJmHM?sWxn%xAobTZUieYd1C{pFgN{SPZwP)r!U#i=d=R&KM z@hg+d?R00|%Q<`PS~I@&Zs@~2tW77J|JTX-fBV2FXmZTv{=iJW@6O3Kh6ehg z%Zwc=PWVH8@@ImB;)l5pRl}v{kn##x11*@>(O6Dc-`b_F;}(c2N6MF#Trio0A}Hie z8G}NjXYaZ*kxAfK9V>HI_kzqhNa4;a;Iq!4W?Qldy)m5Eh}DT_Oxmzgi17LruR1_} zxD4WV?c{5vJt7+F0BJQVOV9!&A~d{raJx-qnx0jPIRSG;iv?G-$5-sj)*S>^(sh@N zF6_7iQ4hpD5Kuc282fm9=aaeS^()FQFxFeQ4>{?!%&Qg5 zP*BGdCh+g@;&37}?)C9@&Eh84@ia-I?GrGjt#K|Cno`%Y7|nmE5bMM)crBbLw_0ff zr@Pg#jNje_#-l9AYQ9sGzDhrTpHbQo?+xG}djzP`!TPT^Y*S5K@j7(t@v&!a;BFQ$ zBXpI%0Bu!HS)hl%0=lkgkI+vimEuD%aD_aLBj9+zVO|KM(?P@>v#2^ZkV1F z_r2fwf}nPe9Z+d?QfET<;JffjeY}5QUP%AR24UP{V|Yg8*UgEQ`uZIYIV8Eaxvjqr zti8F>9Lf5UCwD(|OudSqHGn*=qq=P1n~5k&F?QZwM(|<)86veA^;D6~yAtWWZ(RF3 z@}ivn#E$8aWdDUoXuqV>yPg<-k)(QuA@uTww(-q8e&lvSVa3xXr|t;3DA!h9VM(su zWaG5N89+9T5A@^s5$<5eIG6q?>)A-4p0z-_tli-xq@yyoM2hCK5yEFvUZ#dC5RUFGx@>2*H9fSi=jReT zr>pPhBCMe~;WLc2Ti0&*9QQyk1ud{cX4p4&ytF7jy3%XeQzvRYoErYM1$TkmYK=Cw zLurfr&7;hZFzL0txur?4gH3eaI;W)xGm+=Lg1?5M9gE~sCmh^e4D9URmj_t=INz_@ z^&x|9s-$o1ihO9Xy7+3WH~-CAV-awqNWU^A*U4F*DU;SR5%SgStm1qX(B5PZt~#ny zBw3L7=Ja)rz2r~AI>(;+Z;n0qKODQA>IBHKmpFgp*aI@Ad8W0AZGqy35N>aPCZ4&} zKE_j#-m18S2Q~AdYv6CFk@#7~-ADg*(fYr?jly<6*6xJBeool5nltK#cwTa#bxnu# z^AMPQV;?;MY#Bf0aP;#t{EHh|E19dn4!%p_)QoSA`juWj`?kvR6#!S^Pq~EN^J_;f zl>D<~C|0aMgY^*d3p%aBL_9>}JQ(Hmw0W^CG56iDI$KmNom z(6SMfii6QK5aBGq2OhsFsepNoSFM%oI=&l@p2amCtiXAQf>m67cj1XAa;xRm+1}lA z3rVgGyR`P>Dn2eYA~i$@!jvqOVWv-Rxq03JET>tg2e<(VMaPUz2m@iYMVvngHGQbZTET|5)}dbtq}p7O0WK^)6o z=RYPD1?0+;ypZVyr`fU4@{|6+m+c;SIt@rCjWgs%0|wKONVeB)W0qy5`U%n8(-ha+ z7pxzeLUCkXUb%B=ciC_|wqa*Lr5(g0|INF@NPCuG<&<)Vnm!j}1P#oI#UMCju9O)69>{^1s4)8bzx zUDv=2pO@0B$N_;#M{#UJjkuE2@FyEq`GY}J4n)LyUQX*1uSzF&EaOie>Hrisf%h6b z88c#BUkUnCMR1mEYwrULphE4VY=$+~CixfFch3N_IpEOQ$NhZLEHu*c)DDGD9-2cZ zK$p_;fYNOB29q3{qfO2b8lJLV{JrFLdyyCvKjw>)Z`qTys4NhJyVq0&oYwMhQG<&| zZ-I0AO|iW%K`T3M-O7Fuw6bR+KUle4b>Lw^9w|R5OqXzFbk;qDZw6ukiEA5Y!Lj zceymm0>&?)Cw+uggE;LFD6XVIf!(jF&9p=NLbTBxj;o zK$i2ihCH&;u>5cL^ZzQq`=29)QA2Rp&HxYlA?C!p@Y^~U5xyr9eCL95Pe2E>4rjkB z^-%SVPy7)qJT-_a0!s*H5|hJC2>K0pFwV>}S-PD|>;75<+#JSubZ9?JUayzd%~~3^ z)Y?s4Z-A7peix>a(W{84LlCw6d}ou5+U$Mhg5AjiomK~eJXq#u^g%FX7sU$TmAyB0 z!RzKmx)GSNfl(`at3Z(57<~l<*-c;{z9?=o6QbU_Ou(TTs&E^08}CS=u4y%|E_JI@ zmz`6PCz>6aSM>7Fit$;wE!pG>!jYGooTLX~wL8O%+EK+oSU@FHyn~-T)Wz%nGEc&9(mq4q84=Y<{evzrkK#v?(}cr`yHrUNzl=@H<7(Xu1kc+V3qc z7q5;%n7SJE@agYc9?x8wiU3srH!j+GINQQ!L|r4^ds{3fN+burOM0~jK_EropO^7p zk@!wIfVc6u$suH|S;tRcjB#YYN)t_Y?HBZlnRgs8CLXgh+8sPYT+Wm$=8CCP&Zl&J zi7$1}gTz{F8{y-yWm0QbRrNPjyLhw)FK*d-kSqRPa8%6CtJdQjaRED)Fw+D1`fIK? zmzTG+$rp&9cFhxf=U}J)@wJDT4CKAtlK!*^b*wxwqK|qC*wvFp(Cxms1et}cEsh&) zlYkru(HaEYg`^{DMF;U~U;%jmjhY=jPw-i-U+aMtmGIc8vRg@!Z?vv1D)yXkV?&+v zrt8wvcLXZw&q!l>H>bV^g@eXLq4_mtuJ}W*m_Y>v8{PK5^SBFG_S@Q*O z^MBdeuN2_AFlv=5Al;5Z+9$~U(P04QKY`M*Dy8a zUhg~#58b?r2y1@L`a-ZpHBt@KXx|`r$$?tEZpo#9F`Tp>BCHskV?K}^DXgGLnj9nU zNCIf0Vd*9A0WU~0mi*hZZ@VVV&aw3$RPB(WHwE^inEM$f1=j9VZMO)kKf7u7h1!M9 zg}$RM3&zd?VL(V8c&~a#Ld$eA_~nIsOy=OOB)j(<54L4m10vEq{0YY7q$rkE{w;iM zQ?f}SBZ8X$buP4hXDIAP+KmJpw(BvuZ>O-TOfd5X=rjG=vf`&vNP6cwq*dT?QWG!4 zMNJ9H-9Qt;v~#7;*Tuppk9u&oS{1Q9foI)K{e7Mn+4vK@Zp{o1RTejBQBUG<$nwDg5_uC1*ny^1+RF4pf~J!Djn6yw^z_+!(p1YzqzlE@~-aAQ!D()wdAUHUX`WRk+z zmw@0oxMlc85&4Z%W-p4lkh`{iHoh$FE}~T0NA|U74N9)Q*w(Fo#l}Yu6PRC_5ItaU z5NJl_hYV>TN^DHM+M(>jszFSHN>#{OmL0j4x1v)zto} z#_2qB*`~1$19ZWsMs6x%ty=C+pVM$HncRan3h0k@vEB zaEs((c26u-HfH-oKuHc)hqX24X5<0Qx_z>y0asidnoxr|n10LKrbWWQy+t|XS!lD< zrDw^3P;J2>XX>ra&jYq-aK&!jR7Q5}rVf29fKiD+(53DUi9gISQRs{2pk1sfEmIun z{QCpZQjPVeonF#7wGBu9YwgzR=Q{f*eg4nf zh7bn9pZe9@SPOIKqYS@O-NX77guuivchA|Ls9Sr$ekeInNxq4igCYr|^p9XqXB`yz z(FGX*#BFAKK@E4(EsX4-G={^lX^}!!0Yo^X}L4zS)T-|MWcWhQxVbLf{b;LC7^NpLi@r@A!$`(LxbH8Q%aj95-8oro?=2@YW zdDCH2R~L4fQ0HsODI+!Rq4|V{2=vxhwx_ma-p2x&Q1TIOdA+t!*uU@lVQG+F`B)%> z8xrs**XzQZKga+;Ja%UOdk&)(?NJwHr*2|Cwe9w!Mgy4*)|{#>z*Mdkauo-CO1~kI z3XbD#6VzWaxL;3Xc%kiO=U~j7*FPbQw(7o~OMHd$Zr9hnu^7gQYoFef@nUlZGpteM zdT6>+9zA30x;Ar$?@7J>VIrcnxwi)U>z5N~ub}QhyjlBoFptXDs2wExD*{mY%kvU0#}@7`>{06>--tH}<^)mMs(>jkFa-SC3arJTd~D-oDeRL1+dzro}Z z=xL`QFQpY_86x>FJ}D61-%@&@>ulSSVd9%x@MqGCGz!-DaJ*4_5C4|c+n7irKO=JA zx;$oR7dNLgwKaHF56mQK|Cn|)&a*wakl3G%Nmo0Yce|v1=`kpRX}Y&aB!LUlj$q5d z`5Q&nDyxpIQ2edM_N+sVkMB(ZK03pz978YDEuaC6tpK)TQ{1%@W1QB~5p2CnW-n3sl&xtsv!Bh+Ej z7HP4xp0BQ~Pb8t0`m``T6#c=7$E?1QQ#sm0UbQ0nuzqEk!h!Chg4=Zi|DfznkOaHM zrYYTD(nsM}^?Gb&K0@ax62S>~%_N~?gP@^ry`&nKpKzl7F-(Twply9y1zEScK3Io4 z+aGux$P!!x@114X8>hP+7kVir_mH2~oIpu?rQbhD`@0Yur0S0`9~0!DhglKkgf4Jx z%9#JHZhOK3nXrKD3H11*mk({EdgS+fBOx_{fDH*?1$uO<7H`Zb-zcN&)Fu{vu%Vo9+ops3w=$}z&3$4qad z547&s6Jlp)dcmemWI3o_@YjX*Q6b8V^F`z0J^0PCU9G@Vk%C>TR@gFe^L$_xV%hzj z&)3-z>~8MLfSHLCK?dyAkh`xy&y{vj%D=RI$|AeQKA!8m=l|6YD$K4ht?u%|R}Ps^ z|5VO#w(8O*;h+O=#5n#Sii^vsa=H8%!fp08j65FuQd_hmO8dlBqA}xV^3gOKHXL2^ zn6G_b2Q)(PYy!SUDPd5qTTI!M?(;y+qd*jUWyn7#e?_(dE?;L!%v+i}TbzSH0ydEmi zh5AB>=-%_B3u^YN8wG!{zcfl23Y|DF%-S^Trk{5+yM?Kevul?GSd zcQ1R2xx*&>;=lTh1gafe?bf;GLwl^83y1lumaivU#PE+>7O&kIGx2Qc5{Ia1V2EpE zsrLZO9?A0(x#HYyI^q?@8xNuuSwFE5v+`=MW?aLB_kwaOZM#O_^(az=ukl(CTMD4XZ(>F%hu{jTX zr%fc1h23ntGbe<@g3wyocTK=R*T|y7LuUQl-3$D$52X!?{~XuZ)U$U$*6No2A=_>3 z{XByn{$K03|GPgx8hsVY%~$38gSB^S<<2QK)4L;b5oLQ#&QI<2N>6e^#AwUH+8GZ} z!0hM?DNFm@#i>~~K}8%SUx${$io@e#K0fiPp5w7gEPuJr17g*YpAotK z+#x}J>&rvraofeA3HKx#0l&;p@m?TngEq_%4Kv_G-joBfr6H12$DQ)ds~7mt;Ei0X z>*gPToYPc{3jUk=$gy&i1&LPkIx_FqW+zB;+p{_!Ckuj2(sv6I)#rTJV+{RX*+zrv z2WVl7d|jviSm2qLzUf(^5SMYG&~Z69v-s6a+mzt7#+-)?K5lvTTM3|K2geqk%H0~) zMc&aWHy_#xN8n|gTW=|ja)PfSrF3GElWX}&+x~y3{jnB0BwmKB66SEwE|$PwHv@gQ zvg<$76fR`lHrEEMbI4<{#bqZqjsJPndKnQ0{V&kY_&);eD}7_qu#6ZKh5V}-V>=LXOB`o# zf1v1D4WJ4yz|YnFc!D7?T?7vdxnD;z*s9~wgOzz-5NSn{<|Loj)v(46F0pOl`0`Kn zaw1WCNoifJ<>u}_{q5h@DPApNYdOb=9W~&dxno~m;;Nq2_qD2$uLRh3C(fPjT=7_p zElh@>bT^9Ar2cb|MfFe*O~^TNwicT8X3-=DWAi&JxI^;utqMCx!Yxqwp!4F;z8=wg z{xXJQK{!zPJ77Z7*>tvZ{~nlH{qAfJAGbx=VygYCfARFL%Y=u!qu!X||J_B0QcP{!j_ zfff&_R3XYIXyUo9x5Q98a;)e>XVETg*FKpIV#!y*9 zuz84R>7+1aw48J_h+Lnk1V=F1;KSYEbWlCnAbKBP>w9)%Z@2Lq5aqhG?Lm=y zR2@|(Dmmt%>(UbLn!V(ufy&%-D1RUCJIvl7bmExgjX+ymbf>`e?7dCDwncW;3mC@T zh(e?vFn>d6(Bi1C+K*XWxsz~LlAu#wv;)cn%7`;}X++_d zZ^vdVHW1f(izOU&Ese{$J8f5}=re^C0qj9uEb_J(PeKb)?)*cvM~qh=qGoaVfZ+~Z zdumEv*5Dv`$7C8})XzoCQM6d3wZ-K;+8TpI+CNOZh*Qs~H;*w%PejZ57*AX{%h+DZ z>Yv;s*#`(|{_H=StY;>=X~pTAd%W0{{mOxDvhURrr=TdRk3CY4HY1A{t}t>mh40+n zC(z-!A8pieHGoZ7SGPU#&2icAT`>%mU&F4{vJu+vaq4B6an2EsDSXw6*hk@_X@40lHg#;c$V>jfKM= zN52f7Hd_bzTcq|{kDLR*^@WC(cHMKZC$4!N;k~E9>{!>(I4AxU0+RC_a}}TN8UF1d z43e2&Edz8@rw!C}1@jt(zY!Lwc3aPaS6QHyy^-2~+1X=|-RE4p z4`Y&kvZ)fr8uSns?U;6FT!(i@Z#FS@HbM~lm?@mHP(gm<;|qU-?cGVkZQBKBhdgpi zO--BECfC1{>s7{%a{rL)zX`L`{$9KKS3_4df8wQWU}yQEVOCcW{k9WEb`0oP94gc@ z-sZ1rFG;;fX`gtBUni{iU+4!i!g0l^6_O>h0MmZ+c6(L(Nji9+TKm2zB<%bFQqHc{qpr)%_?C?6ND;N$))w$ue5 z9*1)rk2Q;?1q`}?4q#bxWdx^NNyJYr%DCGLA6C13=HC;9sjm%*Blb&%_KUHE$KxKR zov4__>Lq7WhT>2bVCLeGtFNV4qbIr?u)0!KH!jl!PuIXwRMXCX(RG=l@LG#aNxRBK zk{f6LYC%e=#)i4L0>pamuU0c&8WV6ONk@EU^g)DZ!Up1>A15q-#e$w{M~smt#+!?J z;KMb4tNq46eVyPnucRq_*R&fsZ5%@I?KE`YjTbNw;j%`C_;Yn-Pf;eCX$CJ5r+EHk1L56~D+l9qbjC}Y~{z=pqJRpfa(5FGV zrMB-HvPO-A?lt)XcS*%#mxY9|of(5X{b|NDIRjb#swYWAC7<$bavk`dupWQcY``bD z1$$#NQGtqobK~~>C0e1ROu4uL{i1MT0x%cMP81eh$`!pQ9<+a7hU7)Gsvwu`0Mnh{ zFMQ=_tA!JHW0u+wui*>i5X;~Dn=@?|l1QTD6j2lfB2@WsylFJ_0`hqQ9X>2$l>Of1 zLxeCzREwk4^le;6OJsjMv=OmMtlK2K6$-j+O~15=oLWa;Vp$&BQ)=liPQ7kh-EFrj z@GYKf0IY&;hAy*R#f}*<PbhX4x*xG6jdx$L%RQv4R;2f*rk zz`-6c(6!}>Uf^zd&7~5pC<(AxHMHH8xZ2g4!wGbnppdwB8X+3jJ5G=h%4PEMAX8Q-JpK6SQPT;B9;Mpx~xEIUL29@PD^FnB#TUHnpWN(ox(lNhBu zg-(`*hE7sNUyOp2#A&eYWdOHctgV0tckKLs*+%~RZ^gOqA?xt38|Q<}WP~S)7aD7$ zN>}q);9A{&v1duR+TX##eU_^XgV-mvzh1MM7Vci|uEtqqpFSVp-7%!ySzInWt{+xX zlMFYYUdQP!$_Q7)K4V9ScMIt0*mw{IuXUa4CF=)ee@78Q~;&|YhH{DW99~cY|ZSKunKI^wh zuRA{v6MQQdu6GJ_f|U}jqc@hM@?oRuyQepc= zr>z+*HJovzW5IWO8~cx-%x}MfJzH+3X-e`)BNrEkj?w+jtf2-|Z3iO>j&9)v8W2|s z6A<_F9-jYnLRxg=54--XeM6-2dzJg{ije6B2K?t9wtMOx@bQNv+2Zh~x|;Z-@L|@H zvsJ}_qN|b`AjaTpVSU$glftqn_9bsr={1;up1yQdBxsyY|j$})U(2hRKc3?Pg zBT{G1<6urKt%d>=dq&oI*>oUB^U>S%Uu#JzF5MpZ^bZjGvoSw=NwI>x9p*;Bi*OFq zO4#fZ;wriY@gF6wTtNJo-&a)K!QU-NA`^n`s?3C2)HnwIypi9WGPl~+1%X`kljKXE zR{k&7(anA9I@dGva_>qim6g2or>s4^0*EqB%C2p$kfT2%H}~-)EiwO~>-rPGak|%J zDEE?TWEDyAE?xM1Dfmct!Yk+*+>Y;2jDv}Rr4ihG>3C|LWuCfUS%u((AN?eg_USA2 z=Bd~yps?%a7A|Q*=XYAxjEOHr4EQzC{g^{#(0B?$lU^@+Ga~VEA_0oshznm1ed&$> zZ7%CWqe6`_A3A~>t?r2oompbzQ(l((CPM1ZI;VNr2pbe1Ri(U3Yd-7CRzz>^+pKJW zcP*%9p%8&nH~>@UDE#&~gDH-;NCb(J>EtYfKcj?!zI}seasH1(wx7fiG`)u@vnh}m zH4tUh+50Jr_}I%jZStg-&Q_cLMqf!ff7{bl5mm()!-W4WuUFRoqy=jv8v6dP3; zr_)8w>g0gSA$>3Z8mM}vl0%boOqkd7f06$SyuzkD+!-y zV@ZYAkvywQU}%EMCaivR-J+)7!>8NhzbolgDb_cBv(A6SuRcjSP)BmqJnw#F#`Lc5 zCaqo=Lp3SMaw+puzhP#VjK@Qm(>K@Y@GhIdPF!4NhBM=v3V$}usCH}BUD6*b76{NV zh$CIXPDsc`9fb(yP9`%0HN%Roj4mW}@Qy!QRmz>XhC32GWb>2-eaCvSS~T^IfOzw1 z)+9bTIR1l=FE$xS9vOTerZFz625g}fmU(4{5`uKku{mJ7p6eZGuR`GLz9sT2#Sa>! zmVBjM`fWdS44rl;AUZY$rT(oj1U*SQOyJoH^%65HJRZFpzd6iqSduia$ z#&e zdJv=zy02cypqg$sD9=r3ov;-abH`IIcbBz0EkilvB!@8H=)mDI=wP?s*ddX&38s{7 z)W8gdj4)k2Pdk;sYg6P(6!c@UnRYZ@E!E&*ZHd}ck*9I1+#HO0ZYP!Zb{`n2o1##Z4LS|mz$a%3E=J0gZF2%S zmRLOZ@pnN1I`&@^$_km{Q(^Py*S^>RTv3u}{fD*j6yY_Ykz|ZK{+e`mvy+k&(d zq1}Bed!s{4A>V~`3|@oNXKa}V`nJ10YzKNu3obJo^)Z%#pMi8tnK)eJ*zDl}_ZW@- zSCUkmSgjV#t->B{SnET{&Z9{eGnMdmq8JF*a{wwmqxik2Byj-f78N15Z_~$)*tZ0L z?7xcuoK>}a2C{L#Bz1f9Qx9`32Mb|eAYc1Jm?1ugujNy>1f{vu@&}Qm&0%5ryWAXr ziu>A4G3WWcw%sOXAt$7^_yVwg-mo)Kfc+j!h(AS4HX|h)QjU&kkqWKt*}(Svir-nS zMbo%xI{h}jM&m&0iSZ*2)~HM^=zg6_>Vcl)-a6nZje?IFjB8)+v1PL5f8+U-Jgrr^ zDjBdC_wAkmEFwiMAptwa{eD5z**$gERo^TJ>}$o_#e`)$h)a!JCNwDJ;;!!+)79x7 zG@u6q4)(YXQ1l%5#$3{>SW_8q+4MYYviwcCryBw_d6)Xtu5GH~adPs#|ypa{Y z5Ql~gKw}d1p0+SbZct6FZ|F&!wkmCM;X(Z@)6%mvHii(tfkUbSyDAc~=pGOX?u8_A zs)`U1Wd?C8S?cmd0NUc-$yj}h#FG4Wgk8~wHd2s+-f|y-$dO8>VkF~NQuY7=gllb) z>x!yLPLPmG4vT;$1A|-RZ(pPFJdxOM4=X-;iN4rYnLu5X`xE^3{4vo>W`N<#ET}(p z7gy7#Xib~ng1{NHsyOxL%L*y_8)ZF$6glNepA(9?Ah^-_sSy)ZJPDQRec#^#>T$xT zIZ9QGK`b&|qOK%tR4xlSiX=at;!Y+19e}7^6K!L8up~~e%bSO+G4lF+S8j_}se|{C zVe^(!7Z!h*ea^iCO3{N@0{J}4KP?^`GZX*Sw5z)ky<#OFW2b$ub#U%mmz24c>0Dc= z=6((Pgryz94gq$B*iM%n?FwSi<3K+94$P-It~gnAy5~}VJqWknaX&l_7Xk$B6n&kV zZ+k&Bg4SJLkIP>TyYJI>nC^c{82!2_SzH_rvKns(a!QRG<)YUbz`QHx&{bd_p&4i_ zF=RYLUZ%W3+)ozO3D^idrwqy_!H%WZ(@TX4(G9~5tT-xy;gz%E+FziKxXJR^ti-E| zUM>Ma_t9p%XlavLTLbJtk!1Dpx~-$gX+<{(=!FY}^IxK&XrZnU&P{pKN%;tbSR8ENyY;V?Y|_oE9q z*jswJcr4aX6O9{}u#&`*&u6U0J6x;?qWF6<+PcfqJ`GHZ=`_;Y66a3Ee!SlzWx~CM z`Ca%$YdC97snreKQG8`IBhFe~xbE&2AK%2?|4`d+v&;JYOW&KT{llU=z6Du~kq&T= z8>H#;d_N+O;*??MXJ#%dsX!-#8QkH1MNj}_56L#z(J3h%A!(|X+%>&r*B5h`odNjG z)*nbiLafZj?~E@Ib}7M4D$liX`dJ}vjUq?4Zr=(w5{fR1^^BZd!Ieh2<4Mz@yPCHq zE`ev{v|sspyK`&_wRb#S`zg2%npVljx}xrk`;3D&{5Vo zS6-I^=m$xU#i6WU*(CkHW9D`S(wO%UrTBGA&T_}KGp_+R-+IFIYCBql zXPs-N#Jd_jig9aC7LQ{5_INlhf)Ih(sD4VeK?yZbNHsB|XtYKU8htO&_x=(Fs`*2g zzgUERr}NkoJt972z?pN*;{8exM|{vYr}cG&wJyFSIyLlQY|f4*Js6U=es^UfG~!#W zi2M;+_tI{~!4nZ{9a;lg(WgpiV*yz#$Wb zZcBWUe1q~AqZ0n&=5GAw=70yDAP2qC{&B{^vk5xqao#@4vrss!>+g#1SUdI~tUb8l zOwV5cBnC4slW|*=N5n&73(gbu^hj$5Q|`%#!Z+4`5E3Ck@x-dRE!$^Nz6PX5+7;Dl2uv;ms~z3OwoKW@;7@4%rkvh<)^{H zjw(Rfo=ad^e-*p0n$WD=&)d{=J_M3_2cvW}fEvzi zNu^6zdq))iM{C8b3Qpqg5WwKajPTHB5E(hs=b zPN7J>SJ%I0CYg6*l*l<}V5#v-As<=yy5=$4yg>c*jtn_|3GU~2o^9W0b`q=O3cuRh zX>O_cqtl0ZfJ@^(c{8~zu%>c+xowF8#Iy0s@hEft?d%5!GRhaGsxuv%PcM8^7mVA< zM$joFleVP;zq(~7X*1|G9}^J#+nWr#KNq8|A3I{6QKX&WZ+tvA4aL{={WOLup@B57 zc`pG{m>{jaQE3#!1s=+!&|?G?+m(bok#8nQ_U(kc`ok)8GB;H6an^k(k;C@f)|gl__MCkhe*11-tv}-r8ad3T?FZb)56=xC&$XnitDB zSzvJYJ8xVvz}lvsq^}<3U~kU#$N?U@PsYfzX953&DAKuZ5UN@@XT#E>_ksM=vJ3$R zL-vZhGayApw-6Bi#hz*O(3u9%P&K5~_U1U^mDqrq`#g?`ay8BR_KjL8Agt&8IfXr+ z%RcQtQ`}C?fDcltHuZI+u@q%2d#RZS%fK1@epyq=9p5RJU6fY1l+*7K$69;d^)|TU zAj)nq-NEt97%&^A)kBvcI_C>LtMp-Cgy4=w;knHIaCVx4of>S!Q*)B+5D4_M%Umxx znGLjuR7Ts2f|w2WS5&aGx=dLd0d54`UV)o=VT=DKeBuVMt4w8C!P5$3%e;?#uKVV@R;h?MqVHL7 z@!(=4HB!meqYyfQ$7ShGngdX;wSFiyfEY4$(`+ap+vc(gF(r4zkWliX+*NPZ6@j}j z`8|Nm%L~MK>wVK<<^#9ZT+wZtVr2csWVWGce5x}WTw0PralM*Q(&ypyS1Y%3i%q9w zpaC)lg%9#AMl}^GR$%65n`dSxK95QEPf0RYCG%gWp4|p&HgABM&5?arS?QPySRd6X zhZtjVC?k2pV|~Q#;E3R*Xxi-v=KO(zU}i|EB7ceW{=R{p7I(kuIFeUdoj z=2}A+AW)jBLKjJvyx64qz|6-NP3JORPkj*3BzUxQK(Fsuzwzp~Q_-z6j{4ccFzFed;g9(zRspB+HTxghb@WOwS`(&^$<`b!&iO!(Sn0rMGj{3!KwWo+;j_ zIVZEVfXw56+D~x+8xH-Lrt}aQws6jW=q|)U&iC7-u(3GZY7|juG+z_(HpRO5V%LpL z@#&RC)OweDM$!Ebp1q{qej-&j{h*Rv2g~x`6c^;@S=88yf(#esKFt-%Ad-OB|&B4$K%O|JS9~gaY zS(X}Zf}EIo(?y@mTGR)VN4L!^=HJqJ}GdBR}NX3rK{aZBk>;$f+?<}Rx zvg1*DSaSydAs%ce z)_cDEvBblHG{uX#@R7^$8AJIj>Tu9v`0F(a>)}$3jeXzL=Tc$jhv=*aT1do)4O5T{ z8J_$NDp>sxNSoU(Y`tlMC~$v)U#|GN_ol3yq0Z`x7xI+>uS0yhDd@4`l^xb>;9*k@ zk<(8Vj`$R`K=5``a^11d4Y&G_1&QNiE`E69-u2$r?f29L!r<0NH79^XoGXuqCF zT%!+nqn2Xq9@?f;j&1-9J^lk`Z4i(o9aHnoe%!1LZ_~<_+2R3lGvf;(y;}nBT3nfu zA965t3FN_l_vHN51;xsi&sP6kv0ij+pe2uDJw~agFJ&(u!JS0n)|XGxki>$XIICg7 zwAUw~Vy-RHan!-6iatHUgZY_D)~|OaTy^EeyaxdH5eFI>7ru)o_K^p(!!3@1=?*f zyqoUIN9wUb`(w3kG-Dy=4+9YcpAE(=gh#9;XJ1lf?uWnfl8h)j3b@(uXK-EvY$j0D zbUj5QB$HN8FOFPtGou#PZMb-nbz8BT&*RiV)vb-yg%@79k9E!1HLPxY@=|NxzqLIj z6WCKkbUpqNf|M@l{n6&LVuqfZIoT?m`<5!!ca zpSNt%rU!d5>RW=;=){@KeK-Ef;5BRcSAPJZl@4st9?~xXgIf0 z*yVbGlkm%uGBmOzeCTuUzJJ`-fP|sU(gIErJiSP~dsfN!t(c=C9wkeip)ig9+in^O z*iDDDMV8~De+jV#3|Cimw!ZT@%-g$1u8}S9NvRHrAsF}(U{0xkn7HC(9)xQZXx@}$ z3bEA`RNmqX`^W}IZLSS_e<#D#(!A+A=?s+k)E~d(qoqi?MU5p8{(82Ey!I$|1`S7W z8}dFLqB8l2WWaLDWGC`}x?=vI97=KCXx&`?Z64;dM}KbZ*n-<^J)NRVTyX)1KN8+v z(>L*I)EJ_m!@HZ=*LaxRX3Bb}vqtwR8m^$kOtGNT+acUQ^`wjM2OY;FmJS+>IxT;`z-f?m!lYE^zFhtJUw^gK z+I*<)-yoQEGw>$%tn+T&cDQcjv|6qoe7;h^mj0sE0>6x9lz46^2(5{ae4pkCIbM#+ zp{_WCS&!8{2D_Z&Vq#5qdm;0#MT~Mma^985?KKETr#-p-CWdOdkJLm3qnkq_BY+{1 zZNQMohurXz%F6Fo^dl)wyI}PqS;{r2e3-Ur5S6TXGGuEx0|{`5(FxaMZCU?F64bJxybYMj9_!+)^rpG3k|8anpSSMx9O2Jy{j zF3lt%`W!X_REF9cbM32b3eSnv1wGSi+UbCVH$ST#2_&RtACQk%y)x+j$oqyblmabn zY>QdMFL(HSJ7ecMO5#|Zd|Q?Ja%ub52JzFD)dIgS@*QJv*aI1_wi!fYFwezv$-WUKtH*|^J;gfW@w6!9UE# zv7Zx4$1M-2a4qK4RvddR;humF(5P-5-@AH4X*L41l3z;lzxN+MyW( z+R+?FI2sUY@E(4yknO#t=p??C@0soo936emt9^LJxbLmr2uyhuMUo#McLUNM+Xwe` zz^kAX(e$IwG@17eW^Y?b6-)pwPAf6R_sur>=&kFI9#|TQp5guL7+C%87#Js;r4*Ij zthq82Xk(W0Hj$us>AZuT0<9UgHfXz#9$KJQ&q=Lfl5eB@OVAVrOtTi`S!FbTf_U!m z3D`?L{2X@ZrDuTGr!Yltrb_(}-SbkU9iB}&UJ|#=!=0yYFidX>wohNc-721UaBaQs48<01#$Bn9N zhFF>NZT_@qffj8P1=t2&ZBwlI%9$%~20VJ)!i`|aa=+M2r3H|9!gCO~w_4EO{l_fe zdE)%{{@a%kju8~wK^o!K)oc-L1S~Srwm?=(w8ctwB=ja4{D_zTA-}PLS#zS$Ry5|K z#(o!oUjJP#bhpxsg#n|DS>16?Z);V^O%dw$!8th^yR_)qd?(|4IE1E$Db7-M(v-~v zuMR@GeLb1XA3QFHy$#V{8#6g==-@S**X8_rV8Ie_SelnysmO#k{tr@X3Dv^fHGuG5 zKK3bQ`E$>NpG$M#f3k5e6xU`Y;rHNlbd_`bT3CZ%{@!(dY7p>!n9NktBFT6he{I-a zca|Vp+`euKS`PgMzjrq))exBZ$y}Nn(wL>>`7)_kNgdAK&ghka3rdTo+~#`=X}?Hz zP@Wb0>GlWEt_6-|rF-*Oh)Rn=&Ebkb{q?0eju*9;{>Qw;gEf|Zq9*u6J3~ey0muCP z!!xa?HuxB|efz82o%UYbds)qADC+iNqWNg5M-%PkqTz(Y>^$U;8RF>Dn>JPf_Z4xf zgv+@c(QAiP;BN_5rm)hh!;ul zU@>NUv5t$jd1I@a@W0@A@FpDpX%miLxS5B-zM=g%@VN@oKsnpZ{$XvBv{0+%r>}aF zV*^as@szrsmp}9}sis?BjQAmz0WtrOD;Ra6`UIXqpV8hC_RAdXN8ymEdm?$$?gR*75uo62>Zw`NA#= zf+_N%TdoY&LnCfUO0Y5}j#{JVomES<-m(;PFRCYk+u&&og$lG z>6EIpT;>Cw7J&u4YqHC(Y_hqK=Bhum7E3hH4-2~}0kTT|RY3yMbA3vN}jU z5tdM5x8b8A46%bm;ql0dA`_L_+OSX4wQ1c(s44BnPb&H`WsV6lgug{+R+|F}F#cPG z$99TmF+!YoKRUX&7lms{%dH7JZ6eNQhGk~4%e($Cu9|%Y6F9gZu^`EpwrKEH((tWJ zFeS;v^|~Fg5N6>fm<0D%ZAj5)P&N!@oC9~1$FNY#%3p$v{QAN%q@auZV03HgKlJ8e zM@kL^4J6?t3mbP3$7)CQ_N@0pzFSgV%+k~YAkGKT%TwDwiN}Ls1&rc~&T;@Bjt7Yg zPqu178LKH2dw)4#E)$MYHkDUL>5CJga%Jq>x{9q`O(b;9i>Ms37)=bjW-}iqY0422 z9gwNSm!Cw%m|f;@W(xevPotmj9REur)a?z4^86QIZrid&0Q+VcFv9647(iN%@na{H z#V%yave76OaZKV}B|#C55QONKX`7Qc$2P@eH;m=N33PZv237b%ih|0E`ZKB z@RPvfn`8ZyoZ_;i`nYHwiu^$3pkR{a`Iu(z@*X%@+!8d%?nP?)twS7H7MMADAa<>o z-}+&d0%iSmS9m<-j1~4grr5fBIz(XS`r+i@CuX(lPg@L`UHXdNP%7`fwa_==_v+qJ zgfU30SsHddK?SfTW~16Q-Zj5Mjgh@PwO}`HG91)TPFpD=UlG-nY)=DrjenAI@)Of} z-&!0|Q&ki5kZ)Oc&_Xfd9z4@>cUcojKTulDN^SLx^69klk)MyE}5Z5>W5+a|vD-Mjl-n$w-i>sdjS zlK$450fN2OB)^YXnjVBEQG2~K-Wm`6ii+pfN?W{OlZCnLi4cl+qE z1#OVIAA{ro3$P(xc)p0z0~-dG_W_%Np-276mo^vpR}o+jOX?Csxi*V|A_#YBn`kGy zN`is<9;UmPtmpxDrTqtyLj)2kA?tqd!o0W*m`dhi!Kb%G?COYLztl3{Lb=b=c8%tV zZJYuJOJMXv?vgv$xl}~&1h}%{p@fCFP2Ax~E+3cMKaTjJ5zLof(-JH3;T3>5D`QsF zESsZ%#7h{E*LfJ&#uCBRyGJ1$VJQ~Uz3_wmQyN9rk|{V$V>}I@#;R7U{~a!g%b3!h|l(>poW1(bOL#QO_vyO4xlvp>8uus(&y`^4im}9W`V0#7*DE z81f9Yr6ZkaKN8(XWhMWXKH?9GPOpvU?}E@$J`SXmfv{X_V%Wgw?FPyME?P%F24w1E z?o3)J_M1ayY8+xT`jm3RC60Ad9*0~;h8cWnYH4v+Xq9%8f^Blyn60$Y_maCTNf<7% zps9F{)GAV<)z$Rnp;(M=fJ9akV>{w#Ocp^i9AZPuZwg6Hg9Cop)#+Xp%#9O4TV#Uw z*#pOs*lojTv2-@{mN{e>h7R4OrX{Pb)@&i!_yh|(~9>rt`_b#l!r4;6FJGunroJpFa>THx!b&{j2)Lu>1 zfs-F$Ysx54J&=g-ej?(&L#qWo4*IZ)#qfQ2$2`D#-ky88F*Xnfqk8HupZV_yQk(uKvRA6~eox|Wgx2W;meINNvm!$Io`#iNd{FhfP ziNH((b|tAHs_?m=_?UgXh$v5hO%{;UKnjYwTqAF}OhW?dvb$(Kyn&Fo`64oMH75if7*O^tx! zqa<%iJ>7LVpq}h(<$z)l6$9}Wd-VDA<)QFFHx#-QW7<=yc@3U z9^nosyvd5TI)4&&Mr>s$F=(l$>p~Jh~fX zA@r>B*y8OoWrq?V{}KXdZ~RRYE#ZGkWNr(8C@2M1`L)C$xfd?S{D8ttJei6&K6#1!$7dPq6YKa>hwc;jndU@9UX_=fy6057De~592&4n1yXov#QF9w zu)8)^4YwD+aGq?ctLys^4Ct>ePT>m-aZIz4PV}28o8OoBhfT%`QdhWu{Zu+vhga#Q zs((~Omh)rLS5d^g{9=Q4hZMOk>8GU$U81OYns7*7O=VGKYD)I4?)s#KzDy3a1Vs&G@W&xh9IJT=j}RS(MZ!jEkC5t5F{OIvpfX zK_}V$e1_D4dM>`xFu0F^PT%4@$>RVppwOaY<(+K-WZD*eTVEYX&FSr6aAp|3SAty< zT$I#_>oGpv1CbjTC8+;T8gJiLmgFw^JdH3u)S)dpKgB&TQCuW-up8KuUHiw=CkL7f zWln@UOBGio`VSplUBP1FrZL6UgEI?uZ`0oyofmu|f1qK7OTXr`7!eP$5`8)T`k3qc z262yOAlX>?;&i-wOhvBa8ubwF+4u*KKGV)J!C zBEG=a4+QDW$}Kcq7KmEDK6#vt`aPn=E#+V@Ax^@TdjX;5{+3@<>EY^^G!T)P7U3>P zSeB(3dBxN{>Gml8xCcVIg4X%Xt$*qWlsF%t9}tQ-w&BuNGzX#d>NPHPEtIq8wGPoY z4)?AOo*gHeovV_F7Ot|S89HY z(5G-)94$B)+cvp%S;cgq-1U~r(g_scRt;YxYm(*~@PCirGrTAgJP|*(TDhvW8$CH4 zy~Vtl)+U>cWLpOxtv*_lFuzn#)=Y(s0_nY^b5qm#58^XKkVBiOu*xT$Pe+aj?*j(Z zpJ$?bgq@Ls5pHAAJD};BerQv69R|p*d3j#*$)kJiMGdCH{^(CSB@SaQca6WDri`lz z<(#ZbSowB|c0q0~HYK74 ztSHgvj!n+6L@{y!ypnTG)AiKNfeDIqY=4dy#DAdOkdolSoz6iSEUtHX;%Hrp7w(dn zJzgZX&hkVb&gJwoZ|w0m*?^`L{Iy?SWN)qlp6H4gQi5uJOj@>0n1(G_{&}ZOc69Te z2Z1%3D|n37c2G0$8-8A^5C#|eifaySViY$_@o+VL;O4XQt%2bOU-*){e_zpLI_VW` z)&BGQ%Gx%O1WEdnwY^qH>}X=zpNn=jhn!m6^DZD86ws;<&~oa2NP>fDf0)m}7sro8 znF?iuJ?IB=P@;vTXWxFTsR!&joZ;?Q%2Yb@PE>^1R-Cu!?b7|Y9U??a5v!i;xLonF zpXZWtHWIyr(ob(#WDv1roid?^K1!e045ycJ-P2dg-payUnE%5AFMyQIViFr@T8*1 z35a87bgMvguIewG+EpmywD@%AIRjBneo$AjJi|^sfLW~(-2fUH!%(^x2V3o1P?jSfId!#;ze&*S@E*wjI2r8(>cPm;gp+dCy7GEThIpip+6Tf(SxoLRZx6K{dX~Yn{ayMoDY_H4V)vKpw0uOAo%D1oTpi`Y-uV6C)hihx_$JgPYUDBC_$K zQO(Zu<3LL;rDjLx0fp2Tb0;lFyP3pMi)w);v?5 zkltdh?1VWqH!*}VVZ;RH&`ud8Y!1z133&XT z0{m=``h&5jTC?S{`jiniD!CanlY$_NEl8X&NxDMIPsx$yip@%j!086^x?5ptaALyK zKdG}A|BaE7?8-H|pK}NaKD%5O{W(k)nDrjJP(=?vKWq~RdJa=0j>!+K#7Ka;b%g%e z1|iZrl6H^D{}ZDqLfwVAA|Hc!BSH9pyCiCs2B${B*GZC6qxCL5X*@-mO?Jsp99|ZC z{b;8)dnndAuU^)d?xA{MYqb@`?*POrcfsOd+rE|(rjJg`VY_TSr}}m6`ox$U7&Q$> z%j|mR2}I6Nj?_sFeR0guTgWd#v*r1>H4Y3-_;vy6t$?zk)jJ0@EmF-TMJmrj*D<*) zDe4#@Ie9i~WHcm3)Ba&bt#2dsC40b1B!mrHl(+6s6kwBfvt7vHKZK{ART?8~2UeI= z;J|HkeesR%KCHqi{e7RsiUeqQ|Nbb0ABZo4>u!(n29-qJkfSz9fXZ`zkDV>4=BCPD z(UPzPVI>HI7J(K1X6Q%!;)Ttot9avy#;6&PC?el5qYC&plxV84s^YVB8QPD60>CHs zju$CCS!A1wbcr!pW>@~0J6`n=7Tt%Ez0}{UPHdGw0!?k z0trMxUxRB)A0I9ewGhMXebw|rHcN|LjOs7mt6v?~0V;@YHUmoPK^HEK*pGJ{de`>y)1eQI6lfVo*U&)8S+ajEz4LG33 zgAScOzQ>v-dnFs&sa$)>6+S1B5yAR zQaSOw=hy7(@a)`WUE7;&T$KuYtzjlv6g4yjuXjLNBGY4rA{LqisMqW{rb5cPl%@{# zk$z-O&I5~J-%dby8ax)(w5IWXi-O*y_ej`Y2d`7GJyoTmO8MU50QH!sG+bw~ZD@#( z7qOLOW@(|_#Qy(CdlRpu^Z)OAW~yl$b*d?IL1%KBN>e9GO%$1?Nt;rs%zdFUHCNnl zL4lektyG*Ab3w5(MMcC7ccn75TvG(x$y@<-LOLTGju{M!2W#C`x3>uI%QuzXM_N^pE_+m=P<&9&8MZD`8NF=HZckK1 zJV#YPCzDHGzD4;l=ov(Aif^mK$4pJLo7}1gA@^bOWf2 zvAjI>hEeSeIW=&!dtsjvF+o&Z+_69P>_N0ao5e9LvioNc#+0i=sS+77(InRFso1Wj zsWz<3Ig;NN50J#ZX0nEY6T=dgH7J>KD-?vMg~GV+(P*vqF=>`jM41YSa33KbI5O`>)#Y8x-Uavk*Lq6hnYC+r4};M43PhD)PDaXg=$WoZ zAd+N>R4uV-A5M<{eeeDc%jfuG2|Zw+=8Rxd003|0B|FpHJ;@Q8a>fP3d%k$7kl5!tA~9NsuV*XP5`|12J2$c0Ufhh38F&RW5*Jr1 zuT1&8)xw61&HSaC^rYj%hdAAZmz#e9pS`^hdFbj9ZT>$K{`Cb{kRVZrc>H+o@bQhv z{Foh_xn^TVf?u5d)i=N8V`a~lPbqS~U@q&?69-z_nossLK)(R*r*_E(Oq6CdRES=H zTU)V}Ct)7`^5)d!merK10$p_PBf2U)g&f|JvAquY-qh4Uq8uy2N*2~o!S z;-cIVBv9E4!xmuxD7;>QRR!e;Zzb1iFt77WuvMeJC53;&*MF)HuRz$k$qGVQx$kNk zf|ghROhFD#kIYvg1yqH9r79qzPAYjEM4Nx<#pTon-zqCAtATR-!#qxz_v)9NO_S+s z;#BVVT1YH0h8KYg6eE}3?{qOHa~q(HH8x)`hBV^}?=4Cgi7R9C4q}r0=+nBO=FkaK zo-!mD&a`-$wGBLv?>e^0VURY^3(1yt?Mn}hE$cDV#hRDKXmSKc9vX@O@AJh+uJlw{ zi6ikiT+)3u+s)$0)C&(5myb7YjOX9y@V|;a&`#xFs`Uv(p~BLSS2<%Z4FyY6nF$Y;Fv zoFsiE{!QM#4&aP_8Ksh>q^l^I+21x04Cs8F`|D;iCh{r-$2phJXD4xpiJ=c9N_tdpYAIX^_w~txu}9FUKotgtt30NWhxL{ zPpVX9S|_A~AR)*|sf8UAL8I5irfgbo2t@Os7Akvz4U(#&!?mME6&$6ash8G>fjccI z+HhlN_|XFGnpMaS%N9!Yn|~LPWLCHD{J%L(|9?pg>>)s2{Toy5LUzva09vutsjA^l z&(9*giXui<)=-98&(p(*m`-4o5SB@BOd(OCm3=OZO}bet+0y)PT6Me0ie7#82ru)1 z%-sBI*NpdYNzz%UE9f~hYwj>vR%KT3loMblfAS()9kaFk-hT$6IY<}S&c`KzVXnLo z_X~B{uHLXI@rXmpbTP&U>elh9lTY6+{m8oGc@Z)-MfDag`dqv#HN^j^0s%fr*2SlO z4ls{QsW6OIasvoDti{^lM*6`zCEKQerg`%cvpiB=$4ut4J6U?Pc9ovmj{kw_%(l&QI%^8ni^rSGk<4{4AZ#fJh=!{fkvoYE@`Xnm_?0 z!`VRka@bEjrNK^mD=jPo(0QkF6<@IS>K}A!r?rboPL#&S2WB?CD6_T=1=E6Cz%9R? zgDHYde)(Ggobp238=$CS&P3rM`O6g_b2FdS-NH;#hjxS(#*sW^HrAx0sO4TRTSX+L zQNlCSo@uCnj~63;?kSmv)py>v_Vy2Bo3NMtWcQYAdO`qCWQN1^sFSb(Cr`7gNa)Yq ztACA~AxmpYROBgwDZ=>WZ)+Dt2(Tu?c%oUpAoio4`KjQZEZ_HiPnehf^mjx)Lr3zC+#k}N=xe%o{3fOT>gke3*A{UQ^R4nu@@C^Pg7!!Z|g49qoCN^&nK5!Mr&0^#xm)!t!%c;|qhm(+8Z+dAOPf z9l@Ad`O*7_ZoATv~g3i~f#p1+G5YZ?svOb;?~bOCbTLHjDlowZ`3_F2XBF_%C8 z*|+nef(Yo_=JF_+S>E$1Zu5+xU6$+0m8DJ~GyN3-MFOKC$VAUYpr61Sc&P_A@y2re zIq`>qsq*N;j*V3Ug4{n1ApD;Dem6*2Dt&H(HUs zrs8Atm2E2_O*&BSvfC}U`a&&h->}bMjgo?9pa)ex8pqi4K`kYIMp|P!mowbiglmilWBdMuv#l4;$!d{hiGoH^0(;qtGA3 zl!R8xUxqm*zt|w$F~9Ne<|LFkRQNUw9W9`G4?QzQC*+9kyGM+u%S)`=%z3v8gN*CB zmnTM-uO|?2!#RG!t8B7kMsu~+mbGu>G0#^AX~==P2njlRtPF3^Hlx~^(gXu-NlA5j zO=%9o#w`tt0NouMy7)v^Dh&e?t(|~M3CrbS5)7mXLiyFx>i2K^!#4t$N7bN^6m^3r zYFbm9cHas4N3YsZME%%UX}1Iv*x3K7eUlCXpRS2D&1dy-WYNHRob^(ayY3 zU${CZA1Zaah(H-Fd|OYeh2@T;PDki#e9rJwAf#^_(x6pRDSM{RZf8VZ<@6`0g%l`n ze+cjTs5tu0JE)>m(_nL3j?nLcTEe!}>eHnMO=uojMBG&WWh+o*=d0$Z24a0@Gj5xf zPVKdvr%8uV8L&umw)z@A$HU60*B7%`OGb{&Rm*v?-B&_8lI|hW^5Z^E$-`0H!rZ*@ zp_fN?k?V^2fftSW{=6ncRfQ@V*Dx?RaL(!H*?&T2)^10O=H)Pr+Ke$#{}X(%qw9dZ zwa{#0BYla=(K%vzQ$*ALPDOr#knqubQTV!E_{ZhcDE1e@X^oVCK|ZN1S$^Xvnz9u9 zK^;jm9d6;vVuzXB(y^w42vF5R?9f8qw)LXsnEJiva?4O>ALc~_HjNT*Kh>^vIgI&a z!Vcy6L7!0lZQ2Pd%z*b<7yw`#7wsowglP~-cdz!k|7u62vrbx!E6)LYp(t3H=a+E; zsJk`A=aJT<-L)&H8!D?JoH`iv?zXI8riHKVCUw?8ZO?~_f{RVc-mJA&@ML;IH$Tp+ z4Kl`r7xdiCc(fvG@CA+czxfmGwhGVg?*B_WD6ha4;1MDq>;9GjGttu8_;0Kgbf*)^ zi=slJR0{yxM|b6w*eQosO~{R3@s{r`5iYT>GX+;H=RW3sSZ4PsfTpE-=9MNHm^rjv z;B`%Svbt}dlZ0VKE_}TteUrZphcRE~_%bf%H`G7{fBa@_J%SmGf?PyZgY)YVhO=La z#Fpf%Efvtd`fg6jis!(cxHpHSH>$Tt>=J7Y_&y%4klEd1F=(o_YpoZwu00VOu~ek< z(0j=KHGh%hndd?sdn)0%3TmFb=umQ7Jh#EO`{&U!OXb$z)b{5o!gUB7YsF<7{qG=# zm?+N}6*O}V53~ZCoBKEM8e82iT~8dFcgk3x8^8AdQd(eOyt?~{Ui0RFMmC^o z+fvuDvo~59o>0!(_s@l1WSP#0O7o(bfiDkcJ~JM3*f8gG2|q)2Z}Pr4rYlcF`)U-+ zt=DX#LbK%j*n|(L3I=J6tBhiKdBEyT6`vs*#jh?l%vxPY8HP!V zh+#8w;YdG!&dK_3hkzm1_Imp+*|_}U33bY$HDwa}um=*8PH_~R}C`r=B)WpPi&gcK0pe)si<8sX8&9_LVP$AGS$(&%k zoIHWv5f-=qMx$$O2f2B$3~B3z-2=nQ^RCv8YFiX5-khyC{#*;VIwd08RPU%c`gs`A z+bY{XZL*Eyj}6W!j8L33oG1gT9~Z+yzqxWxfdK3ooK89aa#vd(J=G9waO5I?E-b&T zKdN49D`iW++jI`?*Bp;&S5%n7$z0&BF)|dRRf-l-sN8{aVJD$=+~LhfVN17Rsncf% zYX^;~p{_0EYICf~TG)wS?X0ALOGz9SYpr0GISYj!?ceOd3F?}hc^Y)-y^0d(u3b~HO1l%&)kom#OU+UR`GKO<)@bnGN+gxGeuYxbnd{c0)>kLGY^>x|aXK0Le$ zo#z8l9;6M}!gdsHVT@vLy8sC<(uSr=GMTabj;1xD@MAg3;;5>iaGgVEh;inN4!||i zDmcFy^vw_bhtDTMfK7BrsKj`F!sEm6?jP>tDfpl2|9xiOPPqces{>rbl;)v_!_{5R z@jSoP_GF$w4-7mEblv`vw5uM67c=)y6e6gPhUrz}(7#EGC=D+ZuQXe!=se6d(AwAa zmo9nFvX*E0Go^AukCHa3PO*AN4^86~vYT&B+zQ#~gUs`SIJ%4Tuwrz@*zMveH17t> zsLaZMU&+Kz9V)Cdn+qQzySMW4#jn*#brbVSxyHy;#?am{2@XnLn`%ggJsaPozxt0) z+Sz#?hM@M6m7oO7f4Kno$&hP`8`XyW)<1zB_jlH3>#RX;WxwrDN~ub0k8lf;9Q7fq zHIK92mo5xv0P`AF`n>n$99Gu2J*!hZ0C7l_yZdQSS4$5*+#m&nv zas#@p0+O4>UoXu;0cu^St(a^&ZXy-VD>oS_p8+#|RZK=ff zRqRmZ%v);(&>Hp!Z~5CH>{Gw5ac({9pJV2{<-~`S&QOYFY1Af4@7In8(RXjSF7O&l`f@a(wiz}=^HdEo+8pn@1 zK}I*Ib)q(70xU!hCfsh{_$>@5G-=jMaYYxp*t5J%)Of}^#%nmJIupVZ1FhuEdIJD0 z^J3TAu1#+L0sz?T?O<(2mI**10Ts`pE9i&432NAK7n5L#6VXr=8`l^80BD9p2Zxs- z`vGQM=Fu~TJz#&naTYu`-WqbQuQeArV2OkaGu%AwF>jTV;R>LW!{(7G&EbUoEpF)$Y{KW-{^7ymt@1BXK=%}q6A|_R^E+R zh4L_}W_`hpUjAH0B=i@4_|{xRK9Ym7!{$%98cd{8s-|ibqphFhzqf=q$UhjM*7^Qu z;I#IKKzcm{40ulI15Q+caU9Q8S#0hcJEAih=vtU+ntkwh z=q0cOr_^p7mOF%<>+x*O+n0t+y0*RH1dvv87KSZ=>@GNee|bBz3a&LOF|h zO63Yhq++yG3W&i5)_~w-5Kw!Ip& zVW1)P05_hQ4hN2uz&V;OE~hbMF73u9$#VoSG37r3|4{3i{UQq!_w{KYUjJ}n(5~qI z!mg|;)qg%LH%BIGGNUDng&E;VzABmdtN7&SQpyS)F6}9)5LIB$MU2i>aBL`Uw&;BK z&v<3BOBc-TP*GaJWwcWdv(OAj+6hs#_^eQ>6LFqlf^7Wv#%$pq3CzL=qu9aBTyG;F z1%V12_`&3c^u+|&7xk%xjvVN%mcjxcww3^cPM&^`t*HGwI8^u$FgU;$xJNd!^{Ru` z!MKaoHaItqd&Ixy(*#TXQ9UOzgLTc_t6?ORvTBA}rGO6s5c+2TLa$sZqM*qog37#$ z;ghs4-VBxDz#FFm3^q*G&z1$GaaVUQ6}U^li2TNA^duuR=hwd6#h(lamt!N?Y_muA--I|iR_u~lE%l_%MA3);bMRQodH)?DNTC`{qsEq>u zN}F&;*}*gUV2PsYYw$s|NFm6xFA{)w;ISc6>QyuI>2bh?tvmoQ0dz9OaVa2#^+MHP zda`vjai-|W(6I`#N%eD)pIQ`q>_@3; z03=0_t9alCFKfC60H)G%-oqP^`8DxXM0>F-q8$Ly{qz08&GJ{y)@y2L;C*GkXEj@$F;?%l&O_yv#Frwh}teyj<4# z1{d&!LjV20D0HG0;~{qR(+%KXd_}U^FTFV$@RNzZT}g$!|k5s(1k}&7qzc3b?e&4Xund7b!>?z z>CC6|U-`fLvS^`FK3w;kgaWoQ4-VL%&?hY?PZ<*hqd4Hg8nxu|v%q5G3)S^)9Lc10 zWt6#*t&c9IpsWTbgwfmwTN$0n8QTTalMiXUj^4TRQ`G^-M|u~cnr>xZ1646i1G}(K zhY#!~N}C43A2Hkwq|wP{fhMivgv8CU4Coc`xuz9Go?)lkbUtxRfV!Ahp|KlZM_#d-a*Y_Iy!2JD*Yl(^Ua483QdM(_ z-StGAEle28ee`3hJ{sbLkyl9lZ*de(q#n5!$^Q! z9I1*|f&OLeE^8l@Ex0T@J9wFr@=xXSMn&o;TqhP?ss~4%zYFkO7ne4MJ!7mcIHB5_ z%b>+{W7vd9aV^~6wr8!`DY+(+ty#x7*k!D^=F32R-sII2SaF$A#izieI75PA&Q~Jh z?dECKbb5+6ebI1R8a_cMZJdb3d>)Yd)Tbvs)RMelpn+_NAJPSz3BVku5R z4z?}I?EjGKDjp6WmoLjn%0ZWoXKL)1kx_>{<$c(NC$e%+z4=~6^muD)#9zpP$US1k z(UYy!3@c!(xsv%L+fpzGuAJV&%3H)6ET+|K(o^KbCa;#U1pBsy9;=h+x*j=y{%Oe} zJvXP}-cOt;rat;=pQ6j(Q{ow32rquE-}##^qzFBbsrHdex#q%!c6}CJSNbIKF1C+Ni|*U0Q9ER zCy@2es=2OiK!gc4T760U+a7;?`=pROzy4u}${gsjnkKi`f;OM7Qlvx`&ht$(Hs z^%HM+Np1~zTkb4vI{tk}5QbG*^5IP5tqgV`v)gSqhB2CW456XY_IsfItiU|jZs+HF zJ?YONp_?-cV0AV;?k-34(42@Hgvxavuisy-zRvHqnXXI_-tQPfkj_qJ)(#r%U6%Y6 z)|GsVkZntHb05SGMI;0U8n3?O|H<}tc)H07nmYg@^Xp~eK4h>F87Q%PU(+h=NhCkI;P{~1J+KAP+qF3E z$!km9&3z#wg3x+!4sl+cOOvBn*U=Z+N3QD`O^ApLdylGlUHRVj%WW!nncj;D@TF|; z!20R?3GlPoX&Arvnrm`mVh80grXnM*-r+$nBF%H%ZfS@aTA};B*Pxdh=RLO1|Fkt- zo}Zf;MKV3627PjatZ%vgFjhNk-=VVgSy;>(1;BO}1rAr230`jFYA|?p&C^_7<^JqY zsdx5hZ!T8&56ee~3Cvx`W|3|9Epw;lv~K$54* z6NA_GEH1tAdeyTm4l`R=X)cOTu;>TanyBQ1AG9!~MJ=0*2rhim#=ZfX4A2A1_xJ~U zKdG|e*Sf6^!4r;#yKWsL<1RAqHyN)}XwTPsML($7eqkYBHF*^`=a`)WPTzGw9_hQCy9N^0)TU38A)drjJ=T_ov@ckujU zpWl-e%^YWu`j5FO;n2Oi58O$BFGoS_sx7708%tFM@uw}TY&wd&v1G7VDvB{V+8Hg!w*JrQB znRC*K4|Na&1|@}c$^ooUfP^t=pG|u87Z{nbTrL7SC4JDT&Ix9~?n0lz_SX}arZQjX z6p^6F)_1}ymp!0E`ubU50fiGb1fM(G^AS}0Q>i2(3h?~A@3)@^2O|cYW9#SOfhUSQ zPa#&FAQ}DAgXfS1PE_xB!XQmbU~1-qfr(I*4 zf*i=lxpLD@+G|dv4F3zTGy4AeX}=AWz3x4Nap4iL+4$G~CaQC*ZQ}v*dO3x)MGk2>}!*k;R z-L<3+OLq6xtOme!&47)>zIb8)$ZZ^2F6XPBhO2C(x;b;FnPVz*hTxY?%*WmHVKnFv z@GKC0>`lBs>uy$#(hfF}M&;V2?6OX6p_t~4wZ5-Vrrq8^;Vsp*{eX1-Iu9rJf-KCg z-CcT0p3o3k z;o+~<5*c1;iWW)34B9nfKiVfM2nHe2BIq8DH(Td>-WOF6kSU>g>nf;nt4{tM?#p`K z$KJl1L(*&6wLXUMeCd2-qlzg$psi~{1fO?80|k6<(Z8-az<8xv*JI}9;T zzY7;kW_Cz3IgQNkoDyWB7PgZ#XtbK_KgkezZLYF+uJeUk-h;Eq{2b`e`tOZ>6SUCaAvvk5 z)9fWZ!*wZ_{In*;u#R-j1LpQff-7rHNg|c#PV;LI&(5zG;bNJWhn=KF6V%I8sNmHT zc`Wda3YePME!^%X#tzMYwR!|}qE}*tSpLUXy#I8m9c{bh93F0=$R|0TXj=I!|G59o z^2>9!2VMaXnpcx6VlqCOVvXn?zfUbn2Y|z(2Ys<=2 z*Nc6*r1fVfi!6lw?I$r2Mgnr($kMvD<|J^)bCq%&=Bt6Fz&g9edV-cx?V^ll=&EtU zdI@kp%y4;&p+t^K{{7Se0Icep>aJqWdjlw zV|)(Ef2`kWcD+LSC)_A};yT$>&!EXQ)34r>*WkhvN0(&mUeCv_Q?3|6f)DuAM>qy_ z*&RMg-}~oIb$a>sO>X8PHj1+$L6|od%6ijgtv#Z(dsD*a(-Ws}YH5!et(4X>XLSe( zWW!&qqqyf_13NLJJCE*Uqo;&L^0aQ>?rNiw#0f>DPRmXLrm$o$1U8C2Y| z#%)1`CET!;)|Vg^CYlo=3;k1a`=FnJy|Is8*>S4su7Bb5|NPQ1e_c4PfBgJ4d>7%UkE2e4HrvD(#%2sqp+7 zL|Q2{Ff9l3LnoHVNU!V4s^r+h_vxNxtoTt~LLLm~I1Zua zXinY0+_5W>8rer_QbTieav>Mrl^2nC(X6g%u)S_%w3;*k^zM-f)N^Xy2jS0Y zaUW}FyBqpJ@W2!``43B^WV1aA`8^c&>&A|$(DvibU%+?fKR&=_QdFY+d4=vQYUp8q zRI=B45%EaM@(S{Fzwt%*8hC3_4KB7wXp`Y>&&QS;f0p z$(MY-H%h^ENgH=BrhQs43>tY+65^VyC++s>16vyrnWR#qa)0-b6GF4pAx)!Dh^Cxb5p!>fRm0_SB*ii=-pkKkaY zDCVm;0YHEaPgUG!u6>Rj0A`S_LEK07=nk;FpXFC8sKA2M(B}U@k%b(UG}K37u71%4 zC;Bpi@E0Vm&7lImd(h$|`D|0|<=&_P0LbncduAk}I0lrY$*xP!K;9V(vg9Ar{(NC? zG995%7=SggtXyN0@9^4ZvGp4gf|ImWvI*;Iu!!sjVSxk5Fy{89R99&ft1OVOigvSx zODR@fGXK*_j$risjYcQtbv!3i+IKD3Hw~rMeYhvu^rf-{EV!C`g1H=YT2nzWFw#P& zus^sK3dkt`j6%wV*i0l~02`gG!U7PyJ)7=i*dAMbmMA2cAWE)u0kX4}F(&hdrF!vU@#8iajt&1=D!wt|ZyR<9XdyaG4lTJQ8f- z+z$u1Oc@Y?;S8Tu|0*>F;bONb#$tW8l63J{N9>TM zvWL*h2JMx{oqg%$SIWl;!gS_mv8w>|{-jdF^6l7H9Rzs=_E>tI#TXM+M~kZ##=Vzw z#p{wr!Ohe`BwFZ(aJa8Uo2_1`M;dx}z4>My9t0??@35OXs)E1UoM|={2xu&?5cef8 zY}T5&yW6MIsBlM}jCz-I%o=?1M@EAkxV|1t`@df4;j@@v&9ui0@bF6aHAoaA*Nl`i*uykB#$Ok_u@oSmv#!8m zVuD;`^@Dw%&xNnXI%mKnqzxuWIVq8j zkXJ2HK53M!Zc^*p`GIE9L!Ax1Ku4HiUG}r7`nHS(KRjS^ACZ?{KG{(i>5h4p>Qv>X z-ZT+~r`K-o)f~DPIN`8R^cc#zHg8*JJoI9m%SLL|!;SGUGk&mpRwc*WB$ zK_$Sb&({IF=p2drBX#v{*y=7wAmzm8Dc+@9`5npIK?fYWda)L%(0L;rt<=H~XrSz# zC{%rW64ETZ2{I*dV?Z*)WFM76>%(rZfuSc<7${GZU-a!qe9fG=Edw^2F4}ZvJ}13v zPWdg!W{55LZtcPK;={-H#ocpoW3`M41(imvCxj6eDprOvEMSKpQ6pH!V^v`!M9HAh0afTC3$?tFhGT=?#$N3}pbdE9>zk4Bt+IJa^! zlEoa_SY|p)CfCgw(kIY?UkBMi*l1H{2U&{*fuc+d$8YmYQw+MkFS^pR-!z4uBVCBu zHMoiurnuM)gCPIDN{yHlbuo+nZ5yM8 zGl<5lhC<@ECeYu7(6CEpW+&(!O#?L0HAD1h*UQXZHUInMBkf`fB zcn;P$wr4fuIU4$UK~~803=yEFee3QuoHkePMmCff%h4G!$Wf~pFjiXi*>Q#E=GIL3h z&M)2;>H@{B<|fnE&}!h(qR%atM+a&Kk$Xa=i%ekqqFGTuQ+0x7sG9CBYuq&`9{sD+ z`f%;$#CGtV4RLoo6Aq+ZB<|;HPSgukQ^T!Ztw;Vw?Y`nTXgS1zsnUiDN^WLUP1&-? ziI7815M3<=(!7c-oJ}XG*h$ZGt{fFc1R0|%PYNPNuM+Ibg_Z>fZ@e zD@}oBXk4y8))+n&$a&f9r)4Q~$&;|~y@=Ida@#A~sdXDHz-+PwH{(uaabM;wM3}g5 zVXvQ%y#zqKBsTl}zp_co8uq89m2DDm z`@oD2@A-`!$NuXd)~!Od{(5R}t%e*pk#b6_X##@QL|MpUG*>ix)h`bn`2|}#yw?4m zy*_7D_s}x0nF$US<&kbeCV+hc1oNZjhj%d3JPg3USNy@<1aQ%?S~XlWF^bB1s`0W_=O5_- z74YQ9vc)HiP%?GCc4XcJNtPaf2W`K#8VW(aEX8aZBYz zuPCxa!rsAi`DV>d(EQ`93w=t{t$*NT(Vdla!~WdGf%JEKJ~$v*;})jV=t=}hJ%$Q# zCsN6&{m;kNg9TA;O4y780h30sfX3jOIx}H?LyUVzqk%outuJKyE;B35tY5tj-{Ci- zxoO_rv*|bZ6Xa9-w4fNUrpBZ1ME7Nh0Nl;L=3}#l8LPmBa6jGD+QB;JpugJNZH1h6 za>A#noMxQ|`Xpm?Dt_^d=>PEXe8&9LAsB!XiZ8W6d9!4d8mA~y33c4RImiWOeKti( zxi6&+y&$qqOR(HRc?IhDl;Lw4Cml6%aZ>v<*=xwIR1KvY!nk}f$!OkE0v_EBFeKp8YMPk^1sCH(b)CRgW4RAS%C+eQi}#+#$i=X?kpcYGFCMb%yLvwY`Ch3 zWEY*r#4IpDzWf#>Ei+yJVaWs5cmflUphY{D5?_B-!;NPqlW*yTm!2PzBoETwYdzWU zCizNwu_Z6K;^@UcZWc>@zs6Q5%sfx?q=Qw@-yVPr!?9!Ky|cU{ZmCz!O%EFe7&sJD zZ*1;((cUqsI-8v{vtRnWz{~Pz-Jr$cM$IHfZb>3&9CHxU6KXbWaa{XP1viBFSQU`O zAhXQh?qMsx^4X1iXVf;Vz=WOL%ewdkDZ7>9xBo-zNO3c;ZSai#HN77ADi0CRraj;4 ziT4`TJ?fhf(VMvc`rCnIhV1n|py64OnBpp>%U*b$^7P*7;51AmXmw|u=UKG_;mq6a zrCnDUiTIUuW#a>*{gIuEP5(%+k=a>4qru^YAH85B6u zA%(;5E1sWVY`>CHn$XN$4FKs=$y7&(+gbmBN-xO%q>yU!`VwLxZz+LL5`#F!swB7@ zUTDNVlJ(n<`b}BTb*qO~{by7MQkvQ<%`903#3pR7y~Yp5SJG8(FUkV$=>j3uxfE4$ z||ddo6XZi#^lSv~gpnBy z+`YZzyH1ctkNr*z8(xE%k5ss>3a3?ga@jXS+Q}}y;`tgWI|1;Qgi*DH&MY7-b`FqR zYJm@UjQZg##&@|bm2`M&5xZM9j-wV~iTQhWsi_zj&nMekm!zyZDI`0g@wW4P40&g5> z+mztk9*fm6;9QU7{GuB?N`CPu+z)+9+aKh(1_UMETL=}uRWnw zO$antsoJu1S+}DlNS`NH>;wN$jlh?E$D%K#YOpv?5kRS}L)BJcs^P#Klx2f{WEwar zs+>n_j&p&Mj(n=}@Zhzmq1I)<((XTs8Vo*Op$fu7)j?p<_yQF3=>i*w9>t{rqzwBp zj^2?HkHub^M!gH-H^=fZgQ6g`zUrGKC|T%Jd%lR1fVQho?T8)~XxWfm;4N^2gbx3p zoy+c0nDolS?>Bd2x&VCXn{dawbE(9|3;f-}>=$SGsD=TcGT1J$--hN2$}Rp59RMse zy?v_qpX1c>qQ=frMX5(bRT@8zfQ;wi+mR#u(>t_wD?yN39h9yT0jM0HB_)V^ME1-4 zron4U9&vz5X?)gC66KLB$;H*~(eIzOh8!W3O`rWDW*@{#0H5i}K1k3|`1pdjkhoX2 zP5cHsD@|%cMa;&{D`dab16THcH5(H<0?ssk{zzXY!PmS7=rk8z=ys8*#<{vP38q+O z^9E;LA?-GH^f_`U$B(gmj0M)LX6tbbT>vk8$h^~cwy%#Yb-~bfDb(pjFL6#l!H9sA zY7bA7y)wINoy~pVcV6>= zY!?Q+zI-2N{8y3bv%uijzVS9 zoixJH1?#GiiEUTQr&_)0DOG8JpzW15iW%=ke&)g%(tpI2?WC+%U10tc#DQ7hZj%a23JS%*uIU zEi^EIpF;+jWZi9>ojvqEF3VJ=+p|fL$-URY-2wxnrjI4f$uTP{71{8sIKg@0*WKXf zfTXv==J+Mi!Q~@~fYwev(eTo&g{c@@b9skm^$_SdS4|Co|qEH+|! zrJ$|x1Wzv$*JBBaf354ZFV^)fGY?oBjC=iJJ=q}%Q5++H10U*xCa=3;$s+|KZD|E9 zp+x^!Og!sr7sPwu(s}ifhL+(8+G*{#l~%yfM1{vH2CH3@6^!u-d#FdgzZY52lYg=?*jShm_5gvZ^f878Jt**eX(jZ4 zxDlsMm;54FSH*vzjTwMZA9|yLfA5cD?E|?Ie~DCh2jHH4$g09CK00;PQ&(;@X^U*GGS5(Dg{+WA2eZ zZ4p@Uptrd8W;W)4ODmlc9}t=hiSs4{mI36%BPV()#c!0J-n7~wIIegDZ+CLpVBM)L zgfFOjm2KLlJxRckBFp}S7lLWn7nVMgstLT|x8SXXL-6^v2VPSA{EedYQ0aKpZ4;Tt zgsXY^Tefw)R+~0Ff~9_VX&}5oA>YWZd?83S(+ZLrVfaNX;bboDkmx$#3@qa`H+Xz^w z@`-D{*imhUX9u$#t-X7A@jtLTH_N*%bF^9t4Fc|yrU33<)W{tK5WNk(0F!^-6qhjS zqy-;|vZhFUngQQ>k85D#F`jBW=^hRqQ3FJqf)}~K#grT+xIRiVmyCrpa+AF=FXV-} zBF@EsQTIkD;MQQ^#}La*%GeXun~9?e`3*q(aDLCzes6+n3Xt6Zn2C5%epDMayFN9I3h#xm>pCG<3BP!;|{ zSdRU&uj-T>BA;&x0w(gQ#MS&GH4WNJ%oAfVrK1;!9(ZibnED(wHS&R~gObx*AA5Kg z8qhiTE}x#0CK51-tqTRz6aXbHB<|a4Y9P)jRfSIAwUn%WOL%H1@_-eAWD1v*Om_;P zO(r-(CK*+YkG0Fbpzf(S0f?1#4$gH^?;bx|l6f(jAFyl|j2$B9-pIHMVjZfB*RS4o zl^qIr+%&=osH=K%06kTO%v2tKrVj#F-Zu~fq;ML~>S@}Cin8DkdMe6aK0?V1fDjvl zZFa2LQU3 zy!J7$EBEeNl_Nn;!o_av;2kY00@gUpcYFtFY{eLf%7Cu0*WxXbLa$!6)EVjoDCpqg z>Wx~d{BqAxX`W)}dqk(j^PJzk$WdtXZxeenV|<+M^!^3~G}UOHx!B8Q@iUPZ4 zBGLbru1g<&K)e0(#U3L$moWD9F9(sLPjy;9oNj-UN3j9tIXbl&f}fotvWf|oqzHEE ze)`;Ez|dX~Xg z<8D1jSl;e7%rTJ`Ovj-h6`Kd&zw9^r8#B+9<5(wld4NdfvR` zO5Ihxpp0S%j8fJG7%g-0gGpwcK=Gt0-H6C|WKYh^&GU0>>!&9wd5Ajddf-7l7}Ma+ zToK^H{-mW*y>=GH14->$gsug1Bk6+2XM62^7%LI9AO4GKPf!y#tWJC^kLPaCCK6 zArM!-sBWHTU7*I^z4a<$-GObUSsQ>lJ>^+U&#hYFMpkEpgB+8&!=mUnH>MLy7D`3L zL^$25nH(;8;JfF!XCtB+3|R>qk*AnkVCH==WNDeGcu^IVhIujG zyz|L3Kk+SU)T&hhJ9~HZe$p2FL_<-^ow0vU_3Y&7@fd2pv3FnxGP*4L<0Gjm*WtLF z?$^_TVO3}braVAzHQqgSN8I0Q>=4ZdIu}0VH^OW&8`+geIqF7i{0T@^4IWkh7Lk}lv zrq_NFq9Iy>0k#Fo&0}Pl1WyLp*^#l*7=y1x_1&!)<&NrZt_w}*@{{H zrV(aQ_e$1+GsKJk{8Nd;t?9lx4Zu+RxmT?xwW_nKR$~g>?}Aff2Id?5kJHv%nz!ep zF(-FVo(ClYr5aXek$+G%!q37;yXqFItX7ud3{*{J<^sWFg0|UDx3t)dQ_?7W*W~A#oM5=5C+&B>^qeL*9^PWz zz-ll5KS}rc|03Oiso%rvp1{er(4Mj1EM^u}M$+PylVxioig+UHacF~&Ub#4in+~-6 zhM{8SnHn$8{BPEs6?Qgpe|bxnu^l_Pf4KG(6O`PPKr^1>1m*Tjh>ei%Mx5}HBF}la zMbupbFGZIt-0^-4Ui%EAvZTNomt{x8zrJSxe&|NpO?vYAPpYT7hp%4tun%w4p`(#q1z6ql6J3^ycmM}eAV zv?-UIQZrL3QdCsjz#W<~wKT;IP*F+E1p#qkQ4siDHuwEGzwbGp`~IHO_kRz6$i;QN zujlLWdOY(Cfik6#_xCQ*Zq&B*UC&oH^#^eyX?6WTT~W#4pfmDvX=Bj*@-LG?BU_5H zKla&w{M`C*JJ{_}a6`P-%Ui5+YxTF55LxLxX<*}@CXo>cP#Lgk6opx7AU__JxOy#UGVUkZjc}K(5r;w^?!5jzds6JBfjRFJ|M4Sr90R{ln6kHgWxXWyn;8w!^BerN zt%y&(qwefUuz*X6$2ks8cl!^4mTaKI5N}?*w<&=Q$^=IhR|{O_R#KV zU`7Tg^N_^t5rt8Mv&eUeHhP^$d31N^Lv0aINaI4^JDq(mS_%=1ZdmA*nvCZw@f&K% z3m@Fl+o#U9b|Fq9Xx;c-pN_IAY``t6jxR<=TotB!OIdWQ7!Q!b{wU7j=YXK)t|uL5 z8$_-|SO?txFg{>BKs&j2s z%vYn~%Yc{0+Ik1kE?+RJ{ZPpMw+mp9DDbj!ntqU^pfJZ{WR8pB6|j;C?9(S~Jf}>| zx={|aW0`)Q3gEcqMHIRXp75~_(cQhvm%P$t#A~k3EnevWOzE1a6WE-}mRq4;mmsUJQ*4m!Z0PIr+Z19wGCi{XWL+We zhVe<<9earIij3wY+AFSfpQj(az52akyFH5Hi+*YSZq4xFh>_;xNDavykM zTXw-InlRHGix9|5oa@+8xh>{sK_wUbYl^aU$LwaIHIOCw?Ehot3~ujhFLhgv?AqRa zy>+U*(TmbMgGCVHAd*KNzNhHE%;`^x`7xE3HUem&Oa4$okp-!XGo)t2Vx6m`L8Pkd z#xkztyj^+Cj7s-`e=`=5svf1R7L?tg(K-w(14N{*wKWvWhXX z)aOx0t@83T!^R!7uCJs4m^yc+(l;tXGp4@2u&J)$go1Bkedi6cvnsS}v;2$R9kGl0 zoMEG|3PFcJfa>APq#z{f7yEYvs%vJiaVasG*3jVJPmNvLHn*#n8OybQNK35Gb$6H1 zQxa)XA>no8jW@SWJ7dun->6=OAHg zq9r+Q)Jz`nCE?0}JaWoP{uyACTY)YX!qA{fw>(n2Cg8ixr{Yx~-7@4hOjFYrito48 zZ-Pe@U3R%n{;FAszH(uejDSq zJ~bW=V>SQR+y8(1h1`SvFm2jJ-{X+He@5HQHi;YYPT8zf0nHX#Z-Q3Hc7XbwbZz#A z?5~JL=-l$oJMZJ;bjio*1xqnkYDbq7mNA&jKL*U->MHDK0QlXUX=#58O;L^C4Gmr% zyJ_iK^(WB=v?a6u4WK{|kDMfXHB}Fyx)%W(vsG%}s33)HXxZ6wiCo*SStF!4K2w3$ z7PWN^oCQzlTI_xK+!OQAAXrKJS9;%(8$~+PaSk7kp{(y@KiV|K zpx0OjRWaObMYZ^n1fZzWYpQS(H6_(y1$u_H_(rlPXyw4l%fj?w*~i&I&(;ou;eroC zUM9oM*jsK1Hh#mXj4r3TEA-bKHOAR!R+`$1#Y^1%1m2VR?u=R@rF0Y??nJ8qma2$k zDlvJz#<$gFP{`VwEJCH9SN!{^>_;5|Oa4H)Pw(nDw$&;9M=T8U(~f%Xw>c9~;`nj9 zj-zZQI@sMSOb$54WQ>cGhZ~1(up4*!8~$owu~0n!!q)-WF5*VjSn!cvRs;zWm6D(p zJsp!8t!JB~ppZ~QWwdC?_heb;5$g3k;p+nnCn|dz1yweNM7w#C6`E<Z18ca#qU`PFX;EVvZ7PMT(fJ{f|&7T65xY(URg%-r?!YADT&ps<;q{t zRb;<6k@pC>LGdk#kNZbAIO#ZKnW*mHKPo(FNGL(dii2nZpiy!s#;sVG5SlvSBcLU^ z5_^i_)x&dZSI9T+BbQfUc$g1WF z9JnXsVz-Prmj7Q}ssGy_e6n19o-ST$l3U>&0-ttgdD%H`YrQ+ch+5xqy@hdWs2@xI zE@)=KA?{U z7l0;Pv}Vej(5{E0xp0UsSPaCPWumee7-!&R3`Xs6rSiDQZ48xtIkXJ z{I*E9Q|V+Qhw0u;@f^C;sy}jIB1?SSA|zU9^C&1U(wq(K29^*I{N-#qd=RItbW9C$ z8fK2ubR~%(4N1qGLuuqw0kx@c>P~;3i~Pd^2ZiMeP$i4E zO4z(ShXe5h+HYp)%@XIAou9r=oJ!N{LcS!8o<}f#$Sdu2J2|Eu^znSVu$W^;(+Xe) z_-Ak{CuI%o_gC7+z=9C>%F4RIhJMfP+p&`#sYU{ukZm3JTo3{ioLT{Wt#rfo1MeOb z0@u4%uY3tu_}&drxv!=U9>YP!LO-OW{+>iTJqLBBf)pf7RPXxMM1PJCNPrag=u;qA zruiD(Z^IJApVb~!@>$O+B9mH|-z{{Fx0J9j1HhxASEy_hlnIJPr!6I#-hk(U>(PUM z?5N8IW5mXtI{$`wOx=bNJM0~E93k**CP8x7p}v6l%{lESuY z3GH}~w0r-W?+?YMzxc&y?o;{PyyjQ#_-Wk3-g)e7d2;Tco{lOXf^IenBp-h`1Z?#I zjst0kTbgkw?LXN{$EE7j!^ThnEJRYm|B*6nCO%4) zOk)S}6%ubE)F?O4=*U8X>s5?5K`>Wu{)CZP`lus!uYYy-9}D%WieA?9BIkir)OulB(6Wx%pSS5bYLwq9?Kb_T@VcAy1h=(<9kz##~ zt>m)_37YcZ>$%!s5Ot7_dfwfYlb$F|vy(y=_*%S#%3eoa3nMatfNV@*gP9YU8)Rr} z()bJ|#cVeHX)Opx#h1VRI^+Oz`jb;*q1nhfzUgLyIPUH^;yp0C2}(8HXfrZYI@sN< zr(6C&MQ?aT4dShlBKPB9pRS>1AYIO*-PK~zF5nS*Av8Br*2bzK91h-nl?>&jC&{;U zW(ztFdkQpwPM>e_s*&3={M&A93x%nkblx>;jV=g!1|)pX~HK9Ji3Q>%wq zs5dtnM=p9ZJMF889~wEwJ07)oL>3I zZfO%IQllbtX|2U~XB;ww>hmjcOMQC#kbwVPy-U$CWvX48-4fOdsTL+XDe6ap8^o#O zk~>NpOSMe%i@cm}=Wnfkt8w|tYdqyG?m4o!dL?M%9USr~){qQuaI_9O=#`!z_-?R> zSC&|BNb;`>ar6#y*#u{;Df)9eEj4Dwc`$rU!vQ1L>wNyN6Ttbz5GX@J+92Xr7?+m; zw_}*x76$ePUZ7YH1Vy|;y?Pq9+iQik5|PWrck)ja4i=Qn%0hf-ti%@TdG_ij3(wJJ0_gqV#`f;P*+(~{xf_Aho#B5kSjyw^3xs=@F1b#w z^{+N9=Y8}+T8I+6&i()~S6t2b9T2Tacle%WI}ZWwg2zesb048)>$b~dM&uCnlO6+yT)iH^}6 zohg3hpmlKF@=L2VK6si1&zn<${xS5Z76`Oc>y}iADw@L&-SHWT;+R61{=Bu)JvI-g zlZZkpy7XTn_*~S?=gnZ0WNJ*=-kD&dqRwO=7bia{!aqt;X8pL^UqVUqsn?4a*~GU_ zeeigv0ls0grX2^+@Z>AB{2e^N8f>V1>pFSQKNMJUWk+68WXAAH7G6!<$MC4^M(6N3 zwF=d(l5fAVvc~okZg)tZW`{%D`xY8B`+QERmBJ7q$ig%q!J8CD2m|6|>91bY`Gh27 zEZxbD)5P{}{x%z2J5#L+42GmQ*+?ff1w}EgU9YyeXw`WkwgawsLWf9JP!i6)Pg)xU z0>Ce1_M;0~RLN)6i65f@w)$F@{QKq148sW1 zaos=x)a-BxnN5@!FtZZ`I${D3C=T+3awv@l;@qqph7kEYy;AFWdUSfj#~q0-bE3#*W`ir7+JrP;e?|8Y)Idr{}A`n_ji z3;^K=@h57l|402ka0XDn&t!R1?^uwuHLLx!*auQ-6wN{U?fMp#*Q9SIdSR4cQU)UP z&Mu(+BafLoVI6#?DulJ0inn<1b+U+fC*a=xhxy35_=axaVO`U@Ln{47u6R3`-`IXn zVl&vkRc=jtMIC_@hn)u*jeN>QbNN04AqQGDX|G1~Wxsbe2`8O6uM?<=x!spd-KYt_ zxE`s0sH5>cFQ*r;syTuk^tT^6Y*ZR@(E5u9K4H}ZKg`|aZTe4AS*rtWSn0!GX~Lm# z7Cs6sMRazFX%hIc9I480nx8&qh}9Sp_9pzm2)VJiyz(X(5W$ZZ*KDRX0ACHytXNzt z3`{*?z#jVIC39N!z!Po%<$+iCQ~3hx+9!JIrr(}e5r4icH0)0`F_BU(R_ZjH+KivA z%FU;MKuH@ctyj9Q4`0h9ZdScUN*ZsNT9?S_wk~wwhfpzNt{Bn*?^3;-dN(gp#1{oA z6jz-%T+C;W>zRrbIglV1dK$_pJZYYX$YsVHzV$$RE_H)> z&gj_a)Q{!kkAyWD5#IcL*SH>zVBYbGsoSwbrOd_Wu|5}r2kBLzd(t?o(uu>msN^QU&9aMkZ_@lKX@v~7;s&x%@WOG+n1sHI^ua(Sj z&>a5ZeZs|0`)1S^^28Eoy+|%q2QjO;<@|t4WE#^5eC7{X0iIla_mv(}Bp^P430@uqvpH{4AwccVwNm^qQYa4lF zYa1wl#sBT7+k|DHr^+|--(Fvlf$uOyn~n0wpBqk6@A)IqMjR=N@sVf+L$;-C074f)q&E=u8KE}o+%!=tnU2Q% zMeQ4}nynt5kjK7=?=I(MC&OhCFj1fBYm9$ST*Pe#R3mPH&8Ht`(5Sm)49Mz8O6$u= zipMvF?25k6P_n_lZD)S#@;-P4%hs8!L!(gZ}?yvd#M(Qd+y^X6h_4_(V zGWr{3gXT%*H}KA*x{HrV++9hFCy!MWsT4wPZ)#s!DPpvkDrerV7?U7M;Ia!v+MNE2RP-iD*g{WquJMZX#}fp$ zMNyN?^*l_z1G2B;(Z%ot5+=l>H2savNA<1dl5vw>N7`i;={&c)`q-H}uEUW@F-Ip+ z?1;X!Ur!(sVK?d%J1z`vQ+dfciw#$TYINF89E#(NB&QgTh)SwGts>w~f8@1i*@I2n z`((|?Wpbd|;(m&Lruor5p@c_q@gq7ZQDB-bQNhL;=h zVa1%wI6`X%eKB_!o^*5a)KZ?%n;znBM5`P8xFZy57R*HXPbbw4`b3Dn;rd+`7q;H# zFl>|WGp9?`hk!wo_^i6Uj--T;y$LeQ_GZ)iUlHifVyaDw>1qNG$b~^{?{RTW=6jM! zDXLTbg!q~a`2&2w;y93p?|poqQ=Wfm`R-W0pguSA#K`RZCVIQpyZKS*TU2qc@?3OQ z6UCCslmJT&8GwjDGZq8Jr49hy?HoK-s;D9dzllzBstYoMI6VY~&Q%4SX-{FR?3@(8 z@}Skz=Gap~r&)X6hU!~q;4h&6DveT8@>MGsYrtGKeuiuzYFJ_fPkFrUVqKt$6bZ6d zswX4ijq4d<-A@!sZy8i4 zqE$s?7}`1_sfCyXfRpmR-uA4mfy3tp`Ykuq62WNII^CR{!pmE zQG4w@k%06){2Zp7Ili=F{sL9ZgImfPMv^p-_?-;$4qXy$BO%+$n4`cU#1T?{uVE**6M+!YlTknZK$2yNGlKFW}YNPn-nh&qM z*Vn0>qNw*2J-{%CP!ke6AFB?7ym|TK7AnByC|xVt%tEo<<7&fi%h0`AZK#!({8XS+ zdBs>7CSLz&7!c&kbtX%YT$}H>{B2Ky;X|;pR7w;?9MSN|F(-v|fD>^hG(UD2)1Et< zuP4`v%qFKy@~7sihH)l_nbnrX$lo^l2zcRt=qHBAmFQIkd~61V9z$kPbt34M&ICmO zm@WT4njuYBnpKEXgu=75#eDMJf>-Qut@mwvGQrm_7~sC{sN%H_JNc7e$RFRHrQf%p zYQ)=J=serfY5~qlp}?^u*jo)%^W7^=%wt znQn4MCt{7YX4{?l@{CBJ=%evpHu%v0zYSjNHEGt8-Zr&`r=?TdsNYLq13)~+73C<< zf&jWch_>}m`0{A9@eYk_SaAijHz&Q+eMafzg{tE$y+&Yuo}w^sc<<^9EPvKGWsf_a z494{unmE1pR@T>YKX?oXfu4RV>Sbkn}*goMe+xN^46Oga-j zB)Hc7(*g$%lQyyq4)-F+vE435j6d&Q{$hleG|o@0%(UOFkNE69{krw%D;z*}*l#V0 zxGv)SK@c7=7hNh=G=!ptu;rptOTY|tyH5IKq&mzz@#S*M;&`o9gjf=LWf&51_7ptA zO727(6Qb}dz)7aJU6K38zjnBiEU~^6-ya>%A&%4h)2u?%Ti?)M=IE|&yv=~ z=_LlquJul>;%QOFFQwMS@~Bl@UI%_Z^dusGIMa`9Rw$}H-727;B%5oak4BGNB(;dX zXYThhy+%KhVW7axUvk=gLS@Y~tihlUo1)2HaQh(*_|18EQx;+w$6unU1AWjd0bZ9u zUm{mKITyOcdFXuCp9h*tR=w~d zkM1(@=VdM(C=ZgvEu5r09UH30Sm_iq92#Sc$vhP8eCk7nrFSB>3cYf2mh(oS#V*vR2m14}UnO}`I8j{e4EOVV1K&RRpzo|< zdu)q4tTTx{TKnV%Odf?gItwc>!#j4(H3V(q%rgu$6-ja^$(7Bp2sNnX zkP`NC?fGW(qJu6TpZM}DAAY^fH0EVVwj1TFO+l6~%KC z6P~urXV@L+6r_qTu`&mvesBbpKW*=BpR}|VNTkP_nBmoF+o2?|f-vpbS?oj=yH*s< z)>+F+NCoyzi9V`WUWHokuyoPkk9(wuA|r1x)Gpc~_u5xNnESqj@Zjg!yD6bYuWK@p zCQl@SHdj>oqqG@O`{8H7t290O@a;i^pP%p&1=_X6ViCv1Xv&>7bHyj)5oRz~If#wQ zA>$NBUh{6@F2PagJ|?_vAC=pk#aOA@_ZszwHX~Xbk~277^Sn!e4B3yBhjn+`r%)I7 zoau;$biaxW@{__SlIdrwHUXd*qQUD3P}MkjfcNHx+)lx@;7_v^1aj_vaCw76Jq3LYk}Bt^UEhZV=t?DVFKC zH;;t8t5Y4eRutN66w3x#qZgdK>ZTAe;;t=@8!f~lVIE8`;nY; zLg`v|U8<0C8EolWnQ+L}R_!UwL&^h5fC{Ut$Hyg2j6J;_M$xpb!1+FGGR79Y!yI@4 zdpfw%|2oYDsBI&=<<6II;HuCj$t!}|BBV2KN|a|#!ejj!Jv8ia3LCTyy@!kMnT>I% z+io#yT4Q-##m8opQ!Scd_q|l&Q@&2t&!$O0`O06NN?Clw-!et<6Io%0UEMv+B=t%; zP8^YC{cZxd-%$tnFgOxm?_I-Jul_je$Dsw5^C&M~>>IE`I(v@oRBHOn5CmA^X#5bf zOhF5!gC2u+S(&^uP-lS=semfhb70pZEWr7nUK+TL4SW4*FWY@(gM_TQ5I2KLw$Y)i za6EVr%w^L?Rt%3s_(5A!chyZ})e~j-l{OmW#+Ab5W>k1tf^P6`QI&i*UaRO{2YO8u zy*TN(s9-e2eDF2Tx4Nt+c(9^JU}%y!Mn1m^)lV6f5PK_rA9@_EeIDH&bCD9%jsgmA zHqT~{679_XWsRRWMCE>KAXFR48!v?;loOcXGP>K~KA(?O*S^iZgeFT1;SyZ4U%ylb zqR`h~YzY#y@_M9wz2E+-lPP!Ve*`@1Qn%~9+%r*zWe;YeSxDZ_wJxkFhOI6wNH;)mg+g zs#Z}h>1T=xFL-@oU$K~xwHeUP9$U)`OHd@1>}9VB0xs-xg<&Jw`ylFry;w%M@y<>W zz+}DjOqYZvjsaCRrHciFs3jpFq5-he4!ad+LDG0KBdVc%NP#VcKZO9@@+9>w1IyQ6 z3(J}ho3waHq*GOX?s*$m8-_b#j@2X4^r`Tt=4}*9S(FMF!X1!9?Ez8z>g6258U_C; zw(3b$#znso98l5Z3Ck@#sN!~jmRGL%=JyV)^@AynE!NU7%F0kp8eXBY^iqNCBHSPZ z7@G<8K9gfhQZ;~J_wOAUAHIVjv}hIoswB&_9w=m~-!*Lhx}+UIPvPK@q&;ou5pnMd zJTK166D_(-2s)&v2n=2-x62^s2Bv4_;4sV>Z|4s8_lGX+>nE|b-}lKx;nYRZ)WX3` zf1}dpY_XYyR&umcOS)Zh0zs6@ zZiASOw{e_7Knq_I#M=o2aCx2EG>wMVks<3`r)@0OFZ0XSdmg!avARwB zh7JbC831u(B`qd#Sbc;iCnKP>{ZIVab;9gO;KRUu*W}7K2ZBALwhCc%V1<~FGFz~I z6No?~Kysb(c#Ee``hsk7?YS12deN7JKq}oE4a94icCJRHCOe35n1Zb=I6yp#a)E&> zev?*p-{!r*AaJ0W*;j0?^GTKf8`%7lAp%n?DT{6RdCS*b!>}Kgo>XSZ=7_&)c_9y$ zrd?w6ZptsM7hjl|n5+Fo+hP@NoJ@jtlO`dqr9F6l4e^1ZBdQ{)vj=z{t-hI}{TsqK z^RI}(x`KFS}HmfAcfmD!^9F~TM%zrVQwXk0GcRWoQz+?N-bi6DoT5<{mdS=(nv8t^Yj$I zz(gB7pN|V(i#Sp6n;{yQEd&Lz&rYR=fp>U%(y*BnrfQ(>{~?b7XpGcX?_WGhnirI5 z|5<$eJe$`r_5MXGvlEe+P~jTZ-x&&nuafeWJ4)bI)_2%rQ# zyjrjE=i0-iVf{z@2_E(}u^{S~+HLy8+!4K!P%nGUYy!tP(OM2v#R7472!ED0%^9U@ zKyOVU6s>KO_MI_&Lj^$;YHQob#2?lUqL7~B#O`lz*vynauD}B;UY!CT*ykfvA{eaf z#}jha58;^kP}CKH&#gmo1+jI*@Z497rX5WUgN_i8!IRWq;)18^9@Go7OQsgXRXVxW z4lVP8CGSV33jJhl$?e<;G8>&pKqg7znZ4wpF5lln!WNTyqxF>a!0X4PwW4Hnv%%VK z;mTh({R*2y_u-e2#K#_4 zmj8|S`cJ9MPjmYBT6LzSrk$+!6%PaVyRe#q3c644>sJL3-KqC{*lp-?AMRR5jT@Z&~hJh=QbzG}iea>Wh@6B$;;Fh(!6D4LNEB1Fk>jsC{yE)+0>)R0HkF*EIcc z{g*jXi?C8vNOW_wIoua1!dkE4efWHd?$TO#1Q;P1e&TJk`N<|zLRUJ`7%QT)K_BOD zT5DFZ9?bPsW`f|{TfdUZE z@fYP#Mk$K&i=on!tZj{pAK>r@1%11Eqqs78t_OCNLZ8!%p*z01Qx>BKrytWhU zW18}HO}4NtO9#|-#IM%2+~B!UC-*D{Wm9`5+Jojhq8ow(ZeNRY^h&$X>6xB(Hr*>T zWcFJ8a4AoKe0AGIRqH_<6epVkj7FOGbHneF&^c+3==nKFP~_I5!KFZ)mg%(YRH z9|@SU0o%{lN@NTaF5TPiEyc}^7LM0B8;P#SijXgLVIe<&df={=c?X&X;+JEIsWU9M z!9{E!`5NfJR>o2R{y9l=Mk$Nk-|P`<4!FmcY73y=6ZZBCi(quW&~XBK$8(~M4ndg0 zYQrXScVs_u0HoBynF3jl7@z#Yha)~`F91=3{TUmX3xPzbK`bN9_^OZb_~BrZZ;B@G z^@wY7^Bp03WfoRjyK-N*q;Yb`(xGKi5o?&BTybxTp4A7UErDdX{RjekK#)(s)|V;Z^} zo!FeMRvay>kx#SGJ*lR-#9JZOEAeXKEq?mN2?uwWCLWB2J$bS1gY>jqqs?Y;WG}vC zb=$k7PyRB!8m@^>Ov$ucd`!sILf)y?+;LIWn&9w9B>5DulD+?!=%f}nu2TE4+oj~T z8N_FR%DLg~ssEjq57hFvtAmA8qVc2N@Y+o?ei-k=hrs71DbEYkXzhnT^r}*-mW+ zz%W<20BmtoRcZX;;Py#$n#QHgJgJc|%?uBeHzv5Q&nllhQsgc^lgz-fU_7`v7IqXgCjHXkWBf+q^?0 ziR-Hx4{u&&9WOsDH56oQ@8sw{q|fpVqZpMZp9?;&MMlFRy{NnhS%mQmJ#yUu$@uIM zpnI&q&eNu5G#IbsPTk=7@s`j2nt*ck+8NP_gRmJ}sZ@*!MGl*WQh4`8S0(g{l-htrHi=JX2bcf@7 zhiahwYJv5zYI&&P+WcOk;~Dq3pn#P*5NmRMOdY{6VqUmqBtBXoZgUfL-GC*2W<-TI z&4VeFLOltvzU6EWV%zO9osE=NWZ(oxsh$NMVn*Wm5uO8tm%gnzUASo3zsm3CtYyd4wUJ_D%&a3Ey#(5Q9)J)7M`OWdsQbT*B z1_Eg9^FGsrtMy^36&mqR2d?VgA-d-;(SnQSfLx;_;bSC&P^=iX7za}R_bxLbF^iBj zx$SAD3S0XWX=mEN%%K&aKj5}x@AVn3G7-q`tr5>r?T_e>Qg)^O2CRID6}tnXOX?Lbjm&oGyfV`ivblhEC3OHoW9oq2|=#tafH}&45Vee50$`r z$sivaxU?)kTv1uXs3vRL0Hq&n1@EXg!rt?&-n9cc%rjpocTaN>2yhHJF_DjvvGct# ztmv6W8RpcaG5F*1%UNZ>{?I!CKKHgvBdgJ0yZ%?b8aM`AG@pElM}!FfYDMUtxV2Lt zU67k(o+kp6Uq`uA6mE70-2^yu0P9?RFKK`JSbABVV4S*2y8EX8k=8M7S|1z-unl=S z#+h;L`SnZmk8N{Pui@V+-W(Ahl|e3hM?{0P|LTaglP;EZZe%h{!uP%&tV;lLV3>yy zT}gE9$m1NXT~2#>XmY!xh!E+Xdh2dw2s^a$*C5}G&KZ9b{vF9%#eA4ks|7}0(?@CY z)Ds>C)^0qdad8PC9^++U#7}CyjjCOjn&7!s;s5aNdm+`{qIbTo2)0EjDy2oMdZ#EY zC;~=$@*}Ao!vR$xeHyySyhqqVyUmFbcb233)Fqr_l!pgw z7m2dFXmFurN6FSu)NbK-2GO42V2Sxu@$)-@okNr!LG z6x{Cs($&bG==u;6SM5N>@z_B$1WI2NQk-_&7r_9t$OuSSQHs?hLB zWyxxtpY>eHai;nEP>6P8$$_HY%ytcnn<`)L@gqd-7A6xjaIWhyate)~Iyz1Pm=4W; zfR9{xsVVPs{ryg+wFzX^&IEoex*FfRHCA^GtgU9KEL0w3Ps=$T@0!e;v$SYRPk+CD zM30-rTGf)>QnjnSj{xmb8H|DzZL|A(fH7>02-jTI69%^gOyAPU7HJNi$PJ70I&5q@hma!Q5dm(t6)vsqa;dOMr=9xiZC+8ig!C72y0%O-}Mws?9n}!<4r#;F@Ni$ zV*=6jxa2MUN5>?jI&r>90CY_H-YdYTR1tu*2GQp~`zfw*YY4T^sI3kO4q7FFJ0v9s z)PV7lUz_pa;z7T-A*9l*MvIS8L}tNiF1$eAv{4MI4zm0c=XZphya^FfL@Qm`ADLPB zp@0Ub-Ke_CrfOZJPWy=RgJx9nEl}#{77hSbD8d2Cqc@&~%`~Hj$99CsHgoQexVe-VER9VV*H%jZfnd63oWhr0J z)_gd979F4|3JN}C^pqg_hzy3AJaN;(zXurx(~3`o({F9_7?&KWB&KeXlcG2a=gLz; zUq>|OCbfH}hW3!IN3oPe4(GK!J5_;B!}^rHK4~3)FK6i_2y0HXL^{;IOVliBrOhBJ zxd;2gh9?9;E|&xyC(<5U-i#A!nLGh#N#9byI>Uzz9J;uFi#W9;@+g%lvJp6Y$ZPE} zC2q-*riiPQ(rm#*^kRSC+ErZAHgQaL01*+uj>|>jMGT-Sz>I$O+}S?epG|og7fh>YX{Y?Bq3?r@H91 zVtrwB$N+z02RraYre^klJH4%`UZ5SuyB!G>Fn`eEgn=0AUfbneIxR``rf}c$CHKAC z;8aP2g4pwwUeD@pGEBRqZnV8izC4X)@xo2?EHKf6jQq3`6CPK5WMXrw`#V*(X&?L^ z6y)l~o3)9%T*F3;&-n)Dji`Z^Q>lL5hn_E8te0zRx|)${%58f5@Ik>BnauUQz#8_| z$a#trgnUdU)F9Y=r-Am4Gnt{75bp&_73r5Czc*dPR4gV>mEhOs0Cpv`Pno3 z7Vo{g#J=S8g1lV*Dz|r`#(vZQipao|=TD(V=SqaDue9{A_}y_LB*@eY1%&O3vS-6c zERxC?S2hfzZ4fzD|3L4z{{_7(0nBN0MhQ_6Fej3pMCx$;1{C#0ieb&aLu)eZ`?cOK z5QJ2@oIHKGm1rQJ{TXdKqyPYvdl?8clqZ_MKPXO~VkN^AOq&#l+3tyGYv$drglT>P zU>Y62pmOyc!MWulcZx?BI#S=DspTt*28iE}KG6XD4s3Cp_KE~aZc8V~7c-L!CDs(c zl5hRG1qXQ$B;UP8+Qv}!fAUWKJ%sJzBvwUp>uat{1FmyQi6tkxrU4tzsOiV&$OAh!)NwxRI~LHl5j1`f5t# zk|er$h27t)Ps5P)c@ye`4 z@l;i9w7lO!){iyTUSBkN%wkj|{!uR!{RjkmQCWUL6=-? zZdVfCUu#!NfZ0ARB95N-CX@uk2faUj;3%z9WrTdj8X)Ell-+tBN&a#Zk9FI{@Qmum z_8%_tn6Sd9uo^-~r;UR7;@xXlYavUkmd%Pr^N#~_F7$3Jawn>Dovl4ep6KuQVJ5Cdg>%g4O1e;EM5I#X>{4>I!)_n!NIa_@UfjeHaXw+&L8EYJptrLtQW z(c^ChBfCe1oIraNt`IuJ*=K$`QY78+-W2{_O&&e(G?o@g~lbC783!J*|HUE1*TV zr#_6BH4F)@Ltp*C*LSgAnx*N!*FqJ$w8>%vQrj{)aT9P+b96&obg)2D)c8o8|Ia|R zSS+BNtWi~ztInntS&Jvm<2lyLGf>GyuL4!Ac%%;+#_~T@0VF&~4_iLV2@@RhX1I*7 zD4Ra}ER$EtK-6O0`ij%rcrk-DU^oAK*r+R1016`*x&;^IntzFZ4&?_|cN~7bjRU3g z7t(uU8SXWpxPI%fcLLy#JZ8^U_g2J9&3YRVl@7H@Y_LhtEptXna3g8sS5i%J>)L^R z;U}C^@#W$K6io$1o@JWh6{bAXjnRtvmc<9b+!<*1s%OA7Ct3?T94*N+>f;1jnvXHJ zrZuem0w?DaN95N^N~wC|8e%O_ZEQCbpx|97Lp9xHWry5=efjp38vPNEGvI6vJfTp0 zO#d7?@)BfQ?Q%K@XA2G0#8wv)wCP5K+yN}NehCcNXS{gjr&dc5yi#eJgcL4s?e8zQ zOLB5S?PfSb+Do9d^_Ww=RvA>)sCc+f%gd&2c=LkVat}&Q^p+{*_ceKJk^5}Q#H(NtBs9g* zdS*Jg5y9`&fi&)w1?@mDns+2LzTl)8ikG|s-d3y&Vcldodpng8@qu z6jPG5D60D?C?438?NX@xNPH$#QGb?pc1r95ghJNxF2JR;}v%@!#CV~3~S&Rnuh^^c~t7z@G{&bF2!O>()t=x!Iz z16jrep_RE;-Sq9}nNC=@LZ!H)0LJ=KPaLq6r34@Z8u!CefElC1=7-8r&!rv`O|{&P zW<~c3YQ&R;&aD`mDAlq_E|h&`VV4!=w$Hn-D6!+0K zx1Gzf|9Iz?2fA-#0YZb^S)&MaNb>B89E9Ke(1id?lZQp`s2%i5JaHN(^rVnevc2n^ z<*7I*e8JasQ5_Qg zxNgDfr_xG$RUvZzfAILcFL=B)n9<|!H8NqO<-=UKH+}ld(a4tMgj`F&?_+btzK-&H zrEJ!#=>vdFl5@F73WMVPjFu(GMeja1aAKKr@?-5ULU{$6Jm@~O0493+-rz*XE~>2D zzt-)~&|~0>pZinU7cCXPc+>Xh*>nE>VO0=+e60K#57Fyv|6N-Z2=lu@*W^ebbOp(^ ztfbBnM?(*`zu}|fOf9G}z11T@^FUCuFT((?iyk`a!rMWcVC9eA{<@Gr3Az`f)|hZK z)4}#n?RP6Z7CWLNS61+_rZ)=?OKa5v|sN!dm0q7m{i9Dc-4&slMjG?vQqf@ z)QTV=&a-aK!u*t?MO%llR_-1AmnR+;Ef?SagTL|`g5Yv7jk~k$Rbiw`HxAhdBN9?^ zl&EBp!E5ch*(iv4g-_&}dlwh$6ppyrd|Nn^geVW~0u6vQB+1F+&JI8MkWCs@|_rzS{LBJI4dcO0H{qd~wHPZ9HLoLkMTp9e?Xz?)VA79S`U%A6NaG zo433W6zzja8l8SqBpYy}98R*Eco!*&ljQ*5yf2i;U0S8)JsOJaKlsT5`sZEW(|WyV z4?Z*jy{vs--0^||Gvrd%t+g%w9ODZ|zVe{swQha`Dz7CGCXNHJv12&@tLI&^qOJ}C zz8SgcN7ixkt4do{9`Wa*oYwC%>!H=xgyFec_^I#D+H0bV9!y&7;N9!fYj_j5YNbI` zuUodNyY;NN(VgdfE>l6sedtavvrRQ=rAh6=hfxt33mndS%*+S=VH=(7ze>~Z`Jt)z z8n@eVG<;=owF_g5_j8{=cHHx=5P0gkXDZ5OS?WLqD^m8Cdn)*;BF#FYkvC88ZOu{O zl*)wVX&c>_ow9Eq1;a;{ei2v71+|77LY=29@?M=k;o!@D-@rcn0) zjUwT|JF~0~_Wf;+Vy%W~7$F_Q0z51Qk;SFCQ0$sZ?-u9=FQ{X_|o(w;1W!e+WvoiCW zwX*P7&dB^G$?;{)vE9EWtwTV1h&NE6lPk}ki6l3OyRa=8<*)N2^eOU>m(zu(Kc0)5 zPmQH#BD%drS>FFV3(V_-X{+dbiRz=fb#dz+`KnB&k)$@Z1H!Bw>nmpn0C>c-o-!jR zHcmg&+Pg)xp5Fk4%wJzz?zaogufAljaj?MQ@pho5rM>Y+2yu>%yD&n917RiDra*ba z!^vbvEJ;o1?E6I{Z~QNf{P6#&kq7qiJPMC6!6tX&yz-r@n;6j$a{mZWdgkYe^Oo>c zPdN3Nd)w72a&bBUKdzdOt`ebpTV+=01f}!Mbm*$$UGtyws1K$B{Q&W+gme~GHa;qVqIguKtp`N1+Z*qr3vp-fpYgq=d4g-$IflJm|;fTtKSc;Y>EWXGBk3< zoK|$a-)~L4xTN*x9-IPd*b9it-%is^Utk_Rm+fbI)-CC-p--GTp{OsNj`B&K?>nw= zEL*-p_lVlP)U|mngC8ToVVXJOqzGiT#HvOPP&{X7X_z^%tZ3Z6cF!Bu;`hdK(%Qgf zCYjx{XsdE|gPWw3&AuGBb!sJH00`}ly)hK+E){6=rZ1Z*aUr9*bHxpxGQ$mfBj5=u1w0GF_&_UH_5UqX`~A^<*Jy>A^EG_KD=< z&C-814-o>gEN5bu!!Iw7&44Vg`zppPX3oq*WEQ3?IqYnDjopjtdOn2#;8!l|qcpP9 zE_2r~nU!12QDe&>$ZHx5&PNYl!qqQN`_Ii3h7tOmY|6}iCTX2v#dD!_1(U^yp zg4#8KOvdAI+OW#Vn2`-5{Ts7g11nI-!|!63EXh?}48*~fMWY?CLCdMig5nKwC-RxT zc@wVyha^zCv$-KvHhQa+MT-cVPVGTVXUbHlDIMN|tnH!y7}Ip}sWx zj`X!0z${Z(Ue&>=yUA|!qZb~9P58V5mdfj>V4BZXfEztaH%*BZo!W(ROnrz7!JuJv zGp3U`gJNmcI!-Hly;sQW3{)g!Cq?9jLbM|5tdt^#HJMX>lGpv|HN~5fC!t2zYSj+; z!&3g(J3zO&8Nx8ah0{dCuCC&URsLz!{dnld%5{O z4-`p?Hyiykcj~(yQid_UXHl!gI_5p-bW+HS@&yxscCDLe?nE>dZPF!i&c_QY#1zN za-xL@CB3FWc|(y!WzQPGaio1mINPNXl>Ld)Py^XHo=2t!Ik!a5*uv zCFLgM|M=bqf{?U|3$dGnGyAi?|6ZQB3E?BbhJKT_MTJP3EVbd(p=UmH<`2FA~-@UR|T5Cb(As74!z~YA;iwq;KB} z!yn*<#r2>1j!)`ds@~9D;iPXErjN)K!m^Q0r2ts zStNVDHMYGTA*ErtnyJS_aldQRmXD-6!H9qaj_2Ktjh*tr&(RL2AT0d|*XrF6rerk` z+i|WDv2p&xAFhsl_>M}884M3ghOPiru1L-B8Ig=Z-*QYrS%LVJo_W)vXkxHAst><# z$1cfx5*FOVMOLbHRJ>GG45I&jr%fzSW@41}#{9D48h8-+e~j)UEi2fiJ;Y`|ajv9Uj}&Ja=dU*o-{RG| ze{`2CZmD(Qn^_gSZZNvD^g4j6UF2RJHb<@z|6jK|g6FIIzh?LKC4$4YZ2T+pp5u$B z{;0~{3HuICESkAv`J6(pzyJpBksSxO0UcK@*Eic`01<4VV_dP&HgVKds8|SA0$*56 zno8lb|19`)&L~9R)5%zK7#&pbcBM(v=e}RnXv{65Dbd=2w_svV|8fJ9HAzq0tQKSS z>rkIihRg?Btpp0O6ofbmE*?bZwIN=Z?lJPxU4gnNM`NrfhOtE-eR+X}ts8{{Tgf6A z=i$NT>YNfM^cPcamStCaKLWWRk0Gk!~51Zu2!D@(MTW|fD5Bn6|{;>Gy#W6$@np?|7&#Q zlSfeTXq8p>N~glC&D{<{mOFlwm8hkHpfQs*_dFATJE$}cA2wY7G`#HCz!!At4)}lQ z*3PhUa&37`IF0h|c;FbywVw2eWe@PZ9HY-qxvz3zQ!W)}!`IdRiw4hTcDiE8ULfCF zubdWNM{s|}aHXuc{Rkatww?U>VkFRK{*KN0JzLH&7vLTOxO)YQ=Q)=1!m$mAA*^*R zRU3Y%rIuEWD-G$JQOl@%y&1*=`F4e=xYjCal2RW-jB>@!>Ae;Q!LPcE{3dVQ?$(qT z)|?y*4?_`qxa2_m96qpeXB%Li;L6}PVdu$^AAAjHGEMpx3VxGAU#i(_)X%z2&HO`x z?_oea|E%g)^!oiLs}LHQzY*}c+f7KpWS4HNwR5enCKN|B`nj=1M7jW^qrKwOo`8_~ z%BG%7FL?pWdoqYrlW0{{uyeq(aY|~9lF5}Xtb5ll1)7=E#enD@{@SIO?iYpg!*Pv^ zM2G%&Beq3bUjfT3AS{lKjr8FfQKBWC-4iTiViz)PbF_uhc5V-$h?W--RV!ep6lLEx^oiDz;T+sWvj3;%;X6+JA8E(I)rnHTw%jnA0 z_a1LeL^ZDZSc(G#)?o^>hQ|*HMU)+3@X7Enir^B;{e#Pnr7u3pRtN5QaJDm#)He5nYObb&pvAN5s_84l< z^uu6*SHb69bx>oxl9o+J4q$UfXlwirEGZDc4%%{amh!W(@_Hcy0}gqkF6#OdRT9#p zIHE^=#IIbOf{Ey15Z^dL!UN<$Tm+VZIk&xe+}Yo!B#ejjG{_s7%zcqXkzMN(Hwita z7Ec|JYDwm!j2|nt89@phe?Uoo)y_rYJf}E_LCT9Od#2!YG=Ol&79SMU=ALy!9JTIH zKpZJ@P!~u+2$EAD;V!tQ!hOfFqD9jk+oi%eyW9!I13L&1aI>L!+sWKrTv!|4i`W|7 zS^MkH&wO#vjan;fJZsaFKXQ3OB-3BWxyMoVahqA8 zav4CJ_|TOeiJtIn;K-lsUIbSi5pOqSIjZEHmrugP028egv)en1>-|b>MZjX}D%9Rl ziP!wzoiRHos2cn(t9l~h~xR7J2m z?Gb1EUNBd&IH_>X_KOI}7f2ER;1QfN4hsu_)AuDRGHA#M?sE>z>kH?sJ%OLkH7ePe z9Ppzgikhqimey4NT1}>v#1tq37mizrG)tt<;MDUvW8>&&@~Fz7^$#ZEW;Yj%Q~=ca z4)KM#u&>`$Rn~gg#5y-Ibpp|wMay*fx}+-J*D>}asep=yptqekrrMl)prP@^b%gK4 zwn?FDoXRk;hPwMKy8jfp;@X8-I^vst4e3dXEb0#n79jGFBCDc%<9(@JR(B`F4VtJSjibr*al z1K-wq@GvW5lgUrBtN>(njj2(ILx$nSzNUdJbaVkH{3Tno$KP^Fo%#gBiOiBe;qTV> zlDe$+%ne@j;*DQX)q1~~TMJS3)Wku~XNe#&&%hw%#h82$rDFdLQG^V4xURMU}? zC0x)=7)gVL#18fMdb8XvdnxyDGo^&j6Ky7g5{l42O1yP?6z5v@OmHWMj)nZ$PzidB zk@dr@tH8Nrpz^{csZ*PuAVXhvg5o`*_c_-9#-xh$3_E87uV~vD83z1Y<#MelE#W^@ zcTE@Xi~on}o*QEo^Q8F2-m3!>K)HdEjd5@%hd=g#IaXD8I4$FX9z|1y>wvA%F2BX^ zwRPngjt$DRCv`CsqQm@}&v@36ZdAOW8{^XA1IWpTurh$IWHr>iKDT1tIATaRj$Y+V zPCnU-Yxr-Z`zZC-87bH0!e=m$%~e{0FRzB2l@aNH?viN^m@&3#49tg~3{6)WBpO?q?7E*X z$Oh(aFYdw<77kf$pC3iMVaFz(|>|H9~cr**Hc^+st2D zo>-9Z(`JtG@@3gj5jYoHiFO8S6J>vHt97DkYk30OHYr}=F(d-+h4~2%dg?Mt9XPwd zv#uL(@m&7TD(nh_?GEE?x7Na4IWH~N112YgA=t$*2KB%Y#pk2ZdDKp&>2F z*^`n49;tFYyz46f>>Uk|^<3$zd+!aI=rVD$A03u#&nI`GCu^p-wF@6U1Z%o4=Sf*n zn{IGbRts7*UCbTD;^K4)BFuXnDK9bk^&@)e8j}Lq=nu65=1~q7ds@w!E1hEk7{iA8 zTSL#sG;f5b!F4OrY6`oik5}=WklZX&V1*<4Qm z&Tih@h3HbRzD)wK-dXzzp9n0>@jLMJ8zI{6?$<_wQCe==8rC9jKk;4;x{hui{*?61G%9ro6p0Do)*VzI+INK*ij0OIJL6J`9ixjQ6cEg?ysHFBhZlRIWT z7HDllDBIGBRKVxM%F4=g9}>FlWxkEOl18+8XikXLygji})j;yh8aBrc1Y>v-Eb~0Q zXWDgmnypR8b~kr`wLXL48TJstq9w!98|ypmB0&=kqz2DCHR_0o5sEH4!B9!Z3jX-R z7=ILq@zY|Y=!5qsKAMYB(ymtLHN9){@Zxb=cn>&hc)L~+zuFv1$2v{qs*>A!sqgcGLXO;Hg zjOXeD?R8av?0!ARzw3OO!{pA`KdQZTdVEN(L*r1*f(ExF*Z1}oVc13stFFio&&|b3 zPPu8*Hd?T6{*-(WK6l+WLRf?|VnU{1OQ2q$LXTH{~qb_=&_|kx_a>@_AEiHul z)6rMNhZbVp0!!AsRnet#_4Y4*0g9{4u!V7f{EObB$7XghvXK~^%B@<=oxHP?(GHzGhCrr<*Tw zT)3xqjckn}Ss${kUun2ojOolDKp`ehJywy+DXvrJ%*LF8a_;gm^ar7tUo zH*A6p6)U`5%}!;jCnr-&i#BXq+OB2qGp^@2{D3B9tqwMr)5>wrVaIboz1BTAVdk$T z^bsR9=x%*(HKd2Ltb+%V0E)e^&S{`mh0($8pujw7^Anf<`oj++^gCFi^}Qs7)94n` zB9sKhjon`mn3qatx3`De^}E=dteJIO$i01GTkcexh5}fnFvy`5Q9(|Ux(!Qsw<1fw zEKmsFcnja3U$T>n{g#1Y7PJ02mSE^oEwztE0_*m=H|j ze(y(5qk_^CC+b#7)hq*FrYm{A(L_woNa~T)fUeEf#KQ@Xb3^b_ONn4u%FBZv|LpS} zxtBXlYaU>yYkaR}1fBP2hz*2!2k#9Q&q6*boO+i*tV1aphBYgU5biNI7yZ(XIqO}E z+(}j&EZ@ihv*W&JLX~MZmNLP{>H9FoG1AU9SUA&Qhx;KbY9^=hP7v zvY~%5UFQye-fZ5xUW0n42!GeXzDfWKDah%8g_cFjS=(@(IijI{6%|oF)>8nA5YY>P zh7gCN;}E4JJ(gzi?xBW)xQh?>nvI)qZaE#a4+5QfKG|I==E$_|R2|U2dw7x~Q+sfY zYNdb=M+Y3l?{lBA3v`;^2@asg6QxSHr<14qa|y>JB`azEG-uqD0a~-cQ8SB8$mMHseW?P@6&4y+y>;oXYh;i8S?mth8bai0(Kc&9X_<9iPt%wKMzw(#RN>KSw@F4 za*{14ng9Gi+~)zeRS8a!peaplJ6^BUot~)oBGs*RO*R8Szl%J=Mf@{9MIbII-U2qt zCVtHI=l!H)vfTd7Ge6E~d~V|Mb5KeFyQ!5HIVAd4Y47_7WYMKuWjWOyFB{|In8sko z9yOT}zl@BmWVsQpYJVW{Cg(1W)pB2@L|IVP zOj^W_B37iGZz645GdM1+p%#0iJi=%2-h16yFqK~Hk=k;QOb;?4cTRA^T@Kwmzs(tC z8CXakK!xDLpJzQ9ED^;}Pi!_J%bo5Ax~%_vy98thn2j-Ss>k6PtVrS;7U~Qp=^O7^ zOP6^2d6}eNC6EBTc(!7%fS-6(5RHv1?DoD*IE0!tb@Z zNABC2)zO^w$4mY2hmrZ%LE&z%1YuFH5!&PBF*UZVC}zZ9{1ieL*ZS*Ld$Wu0a* zi#d1R9WI5+#k+&doQm3UrZhv3{HyFp{vC)J?I0!_6l|c%sZg(G|Hv3~Q0*{I%K+vM{N1!sBI<;Z?e@W)di z@s`jHX<1H$4TPRZVrW+>eQ((CW_}aG7P-}3JlZ7lP?Vsk+UO0fshU$4nvjmX%ILgQ z$7qd?3>Gjivc5WkDj&udb$_bT(XD^jy}#i8%94`Z(5@@rsJ6+g*`5&3CtV*rFtwu76^R*6r0?c$unS9_rnOCUp9UrL z>$CcZ3}e`k**pH3P6P1MSOoc|r<-og1KyON^sCLIPi)p%W~EfK&3%jjOtB*8b1}C8 zRUFk`fZEDt7k6=uIR;Z(RErdqb*!r(H*)_pv%WmIbL;Q@%e0(Xv9ZC=m*m2OHL4FtlNRUg9-c9| zwj^4CO2 z!>LG>rTRXIf*kx!0M2^P+?~EsL3-6+e%hIr^cMP4b<`Rp&!H=6*&^mty~SC*g0T6T z!ysP|ovCBrdzIZg9Y_A64=Uo-%$>q#el#wadHC93OPWEYaHR-96y@&*Xpc`0u=Q{|u!+J1v?O zdphaY5KsvZiH>V&`$w;aqdT8|AG~lwxI?YeTifd=R@7i<`a*k25Q^P4Ztzw3@|>0e zGxjC9!hF6zeE&m#b^|D?!O7#PRJOYJn*PtT-S7oL&T%+Bo<(UGT6U)lK@#TA<6@GJ zn9)_*f>owV`d18DdY5t8MRWV3)IPe`ZtE0eu*h4fLww|V_xoj z2_VECa^WsRCI)kNx(ZN7!e1Wvyx3F#l8LFe`>ySjH#y`M)FQZO2fioUut4(UuS*Xh z+N`=CaA0|CJIySeP?|_M`&`Z3EOoj$t^?>N#Edz2#)N-3u<}74GFZ|C@6)(@qQfUsf?zaa_{X1*t z+m^6s4HZ(?byFu--fm|8K%QLKa^Q8dBjGG*;h z(nEtJhRbwm4molt~?nvo?koxAb^jU8xkIb#E6TSYx$}XF2 zFPn;?ah$?0ADnbK_v}vfmM&Q1@qG^Irm9zpRg%Eozu)QeCu+0vD#m*!ly{i%e2`09 z6V1Z(_$1B>+-050h{>EAONJkjmQsKkbB=)Sn$1PqZLRL7HD7vem(ze(p|K(2+Jur=}^lX^WqhiKL{KF0g?+K{c<}_2EN$Uz5c; zxwA5jW7AD&p~3C|hyJCb+BfvT$816{4q%bJCbc`yF*iE61@<2$#U56FNOohKF$h?n z+o%&f8Hw1lo`nwelMrTZdDmC%r)Kr8Bv;6R-`FuWWd9!E*iQFCuhW$^DJ#+ugrQ;7{ML zBkwhAk+~{t$GV-r-dRV2_Myg??y4UlGJkxad_qk?1PTTNTyN9J`4;oh6c>_DGVq*V<37QkH zNvU{PS#3$n{-t?ZzgnTPk(SLF&+;nk=lPSQ-iC8Wqa-1N-!~k(oO2)tMV<%?*e6ws z-5qNGc2wCi^7}i)X3s*@hKkN$coFM$Huvr@(3Sd*-(^xp44*Ap&ffK>%A@F|s7~>1 zG+h_kvxgkWr?fljlOa1=b02o+8Y}O5%R;U;yUn{=1VoZ@-Fx|~g<1sg_E)iMKr|+% zFhQf=L$xH*C`i!(z|u_<`eh5@VaV}K#jT{!khi!|Q?3{0XQy)}sj$-DLT4r52IFfU zsA&P>2mfqvd@_)z8rJ9s9q-hATP(;F2T(dA8MM#{OWL_77Tje)HmM>HqMbDa+Fp!oPi z-wQda(un$hG=3f%+2xQwedqjuDA_rf#ct<1-TZNMKbj^Br;c#un?u&Gv?mZaPgWoB;Cluk5;5$zrT9Tu zd8ZNc0isQv^*E$Hl=B65e7j83dj!Gi^8g3*wb+0)NLs9TkTD9 zIBFKEFs1`^e`PURV^z6VLgW-U;u_vGBVmMJ^Z z8WT-yGzutVeqA!uq)F}51Ch`^$>v*pVTY#MdY}VMI`k9fm6Z#Hpd@5@3!$YL*(>O% zaSge$H6(cWavEWW34W2_v6%i3;6z>WP?f@ob-PdRH`7L+%71K zD2>wx-!~O7>*ktTRhd{c#-7fY-*qiF2FL*~1VWqJ*GAr5jQM%K(7g`Lu#QV;sV|$T zcc2?ORE_t(*WsEN!zPP-rd&(rdFs#Bo@gB{JS@rofsV$)Dm34D)pbu9&YCZK? zO+*Kx@?8#`Bc8~6;k)OeB)tt}CsEmSb_7xgFV8AoAN3idD|I)?EkpiLE(3HnM#}Xg zz2pZ?g5GhDVpPc9W(@$mfD%nr3NRzP6AaK&mlM({Ri{}|`dr}R*kveH@8FZ!&lgr1 zVck3{RxG!|Xm5^f;@x~3jU5X|S$ul}u;i^g|A?W1i%=SM-4#L~LTcvV4jge{0AkAv zPImBiyiE{CU|MYs)$q@fn^5PKK?XtfOY?Saz z69wKLAdai9^g;G%Du9bwj$9bdnA2bhOK9q47J>P`O4ZFhMX{Nm!KB%uR)xa&j&=5< z%|g`fU=4h&zS&_(BX?Q+pUx z(fjAQSN^=YLLJ!Pr+)1Ebz2nl@qGqN;I7xp@(-629w36VyncCOJrM&Q*&}|Zkb+`a zo#$Wg&e^k2Reb2q`@&8w^V+!18D`tkx1Gfv%BOsjTDzVf?!^^}ZlS-!Li`)uvRG&PgoX5EktqpXZ#F$GK*k1mDw7h3r@MGJ}uZ$e*&C)|K#dX*UXu$}dOm}PhHV-L|iK)NK+jO|M8*J(te%vC~FX#37 z+4Umzi>TB`7SKVk4fl_A;>)3g-_L#g=MTM*&g7{V@Y0~h%VFY5XPIb%I+FO{Amdpw zaCJ6gzdDLfP06dK*n&0PtFhN3y*T!jRqK(v)elqSLeMG)ZNDg^VRlNyrJRfB5qTMW zIPb4MXFL!qOOIYiWbR*nJLTjtf@9+Yw+$VRWTuocd-hBV!hXRXL(j`cQ>}^s?w05W zEBe5~SCjB|cTs4Nfu>Ij|LmFiM+@OwVpU09kDzIx%C*bnX#wNUpo$^fcKp64ZdI08 zpBU7SafpsbX)w`Y2ss`tg;m7*Y=>sw0{BJzS-7pjhencSX`@(H+*xL1^x2a|Y?TP* z2OSk=!BlD7iZCZ=?cBEkUt5ljIfB?6{{a>qf7kEW>AF*hV^+js4L^hbVFC2(s};24 zCK4*QrGMbeI2^R4Cjd0p0%PX90~j+XOckgJc#av^sGOb;I%c639AO^>sP!rf$DynrDVN}*E@v^fq6gDI4N2243LIl_ zBki^(koq8BTk_(Acb`V!gVL%=+=?2$77zEaCNN8X^Fxx=%1AQA_^vDYFm+~prB9H3 zV73eszWuj#-YZP1ourn3xkU2M#`ud{9)jn1Er+DHji{>*U#z z^mWQ+gO}P+a>KC_pcG@cdILXsBiB`q-PZC+@n1yyxLt(n$SNrtk4<}{crxSrP^BNq z=tnAyt;(4CBq`MXBk|IscX zMD%R1S^6csyDPn%q_c#?p(7d)oC9>u zP*U-R_nH)8cX)1E+L6D!KCtbF2(Q0)c%R|>hB8F-2c7}%E94N0Sa`Srfu%D{-k-?_ z{bMEm!iM{SU%OxpG&Mh)gcG2TGa2&X*K@0P#Cm_F*$-Dw6j|DN9zs*SU;1YS{`tOjU_q+*M451`1WbD z^7np^)@L0I-a6v|J~F&6xBK+tm7Gq^-k@$+$%|w9N=_X9}-KI zG2{X!`R4{=s$H)wO=>}Q@YUS$<};5-Vt2F&y(QvbIioF>8$gxuK}N;_T-T+N_vo+L6SLN!0zwdI#2g5U3O2SO@d7FUu4jlQogqo zy26OST#4k412w=DP2i$B263EzdvGB<&9~_selBdjFT&lJBSt*WSaH^7^6+Y%!bxY} zOY0z9oe^ZvE_~G;eE&QOAxOEKLimW@aNIkK7oiVS z#-diz*SMo*`<|>EH4VS^s|Viw7n~-k^~U%|@n6IcXKC7!$zZcm?L2fvd0L{eF%tCl z^T8_A1ecP)g`5 z`z_@F(r$y=9!V5!olFY9I^=f@4eeRh^WW|8D_h4m*tQM{So8fC8d^-6WG!^Q)F11i zm*QlGC%)(=J`YkSS{3z6oe5-mR&~}WWa%D?BUA`dt zu|_~XPD1&@b}7ovGAQv9qSQ?E6Kh}hMP=r~mP>QZA$f8;ho5%w6t7ZrqXFgp-SREN z>IMA~#`F8EtWFV2w1ASzQZHJABut-2kZsoWxpUWpmpe8{eBGrt*4)Phs-Gvmyt2l!cJ}-e#B^g>w_b$ylXAFiW;U4;+D3 zZD7dZ)$}=fh(h?qPi(WD$ThB{D;b!Z2G#5yg89CehH2Lj40xqz$&ZeW_<~Gy$YcA| z$HQz7Iz^7L;&AQEvM#5>2=thKdm{x->S22$3&D%&|E;s!o?Ah)NN^A=_J`1?Lf#j2 zS>?Zo&!2uLzhe(Akbdcq;=5x96g-(qs$x*3BPkta=D?8rb(+krgB|x`9(?h$7cj38 zYDuYYcUv1zZg1MZIJ4*Gn6NqJQ;nGNDb&>~m*p{XzY@j5#j(mykG9+(uZ;G2y8JNm z^A^f*v5!^78iU1DbD@}82y=PqxArYsNA8EkLFskV_lxR7?)AFuKP8&!$)5Q&tVwSx z09|O_K!*(OO!W+hPbMTfNck~@^7u+=Rj9X`R=$9kt`Gh#rGqN^aqQCPtJ3G??Q+U| zC-DgnGu{_<@!hnt>(EjfoWhCKK731>v!`%FhH=}8*83|byBfV62kN%V4@23P@V8F~ zFk&>t@A{+c4Tlk^r>fFzLBAz5XmaL}_P~(YN+%wA+_RYE|Wk z&w8dN)<4EnB$(?(PQFf>Mn9-_`yY?u-ZH_15xXPNjBi16+a(BUqHG;VXltB$xUh)ze5=1_tYu1= zqsWrp2z=ufyQa^qcf_o!dZarfcoS5*CNU?uK z46`RDaq(M$S}b!K0no&Qd~JZR#oWp6cLpDB`@E5jT2XWw=I^Db6Ob6xxm1XQOZ*y| zbAaK5fl=e7ZA>N9ERA>9p^{%E!)IeRw>`+O9cB_T-@x>rwMq04##<`ng>}!Ye&zJI zr=i2j>et*8;I+>?+Wh`d)&=z7Y4K3R<&<}0zs43T&d%1H1-mYK9Ue|8Gf(RHOjNZ*zB_=Z?nndDDt40K}RSzT8YE4QxZ<|+v$~b6W*-j)7^`(D&97?kguqxp$ z#{#SYYMi?lGTlP)^yQ2DQx|_M-s`_T^@$0@eWQBY3{FU3d>!BkOXWW3?rROW$?yh^ zz$3zA8qAK|i4Q(EUDSjWit42YF=hB~2OJ5obd?{B)?_`p<}~*h9IT-*YjaJZEkf;F znU)09pnSH6bJ3F12AOb}(I?6V#zTWJ3LHGdxP~^sf%O6MRXOVMX@|CTx}*k|A1WQK zy>kI?lFFQeC!&>2v>xVsSaZiJmZmsnBaV0a$b-kveS+8}#KG}@Go6Ad3swV>Vi`x4 zlZE`^;pb3i%Sy|O=0SExXoaxdCN_rO4kp#*le*7U`! zk)LPdBMmcwCY2cE==;p>G7W>e?MEGP5sAK?iJ~0F11|U_$%Trq|9LN&(=0c zW|xWB)e9Rw{vf?3+@*R(>??h8N_6X47l!&9ld&d#J;Z2x88VOdVoWb-s?zt&!GYQk zQw&5SUhpnysiIdI-2tfXG=kI?q{EQ&{15#~K>7wB`#5zSyk8{wkXU!jvDQcqVu_zJ zMELD|{QG4-}H+!*bp{`MjVY`RK0)B43D{zBk$wC z4FiHqa(li(dJyqufVZ_eeM1+&pPI{VWG80f)DJEs>$g-DEB0F&_qK4_>(|O7{LV0e z$=3C*ew;ZTBokdvHQ}h+C=|j^Cr>5&QR9sSIHauAkgWzm+HFq!G-Vret)$*OCBt^z z{i9+w-hqhz2A7)fdSl3QyG;c*JlE-7?ULdfybm z8LIY{##VH6nkNSdcNAB!4% zWM;uxN#g7L!Vm`q+SdtvL4K%KO^wnM+tVs1Wqwsl0?TSU&oKC?iu^8F*K;5#Maz6Y z&BW(qtvSJ`0ra+RaRCKcZ|jz9UMxsz1(m zxu?k7qHr>3E$8SPS)?i!%)04+u)CtQ%heEcF+3mCl%JJ%mE$hNk~Vs{1%8tw*&r5yZ#>%^HoLO$;rhM>Xi>&@lT%l9bdYf` zGYRd%63?LPkVHeXdAUv=C-8NE&1op>ef|2LmE)Wr zl~e7Gyc%@GmdnZu)C8q%UEQe^<)F_Q;C~i0l=ibW9qD)R^UHDkA?uoxmBsa2LdH@( zoF~w@&P-+-{Waz9(-_cCa}e{*MF?jenCf{RcmgFYwUOW!a_m+ZW8w7>>ss@tHx1uN z$wK9mjdTo@7Ff0 zI^-P}&NIE>^W<9bPKCO&dXH$NYnUvY>fF|J}^-|}M9TkX$v zlxYUTw#Ytm(aw0~#|oQkd&rxDdxj#jUmG-SMnfG^$7_=9&V~kl!)(8{>tB`9k1}Ek z%kl@lo?U4`;T6-zK;W8iaY?n3l@g~!bimV)vx;cEF=K3{%{Pa-POm{3v|=BF=^LW1 zq-LeoG5K5K$L|s4tvY)4YX&4HB1-$yVPQJ+O}NUu+qj~gHZOezsR$}5er<%SEW5o- zae5>+Vr{6heOYJ6rw_8GA?G~gIBJ{?)NaoeU<=w3n{sipP1ghP?s8^0JtMyW@Hg85OP@>m@Y&N&P*a#>uil!*do+eCB_shOg z^n*#k220ewZqtjD+i6u#)u$${96+8g0!h-@Nu)l#oNyd4LNY-0E2acxQmWt|WIPh# zLa_)_+KFI;dRyyhAFq56rZ2omc^OPM>&&p;e z7BBJj|F*bW!CFcDYe55*JC?jP|3IS2b@&8h_ltTZPtYR#ES4cDvu;RuXl>v)HIjuo zM2$A%1cS|J7jqkJ|39C*!<85YmeH^6b|<5VVLybNr+Mw`hHu%%HnlPLZ@02WO}-{Q z%b`8TxXS50)j3n%MSa}A+aDL<_DZWEIU8!UfTka{U=4*AjZ0vuWNa(W{8A_tz6U`Z zTEA08!4z|XZZ@!pY~xp8_VMTc!fw5O5RlblqP!1>U7nMPR~75L-dJNM5N~5Rzp%?G zIZ>1k;lBkaM~?o&6XTk^HI7Z0}ZVXTvYr zlimW*fBD_#=Z+uzc(0^wW+{}`fJ(^9m2VJ4dH(Wha|g`7y1wAL9{XO%lSp~Txx=(| zcyluR?0VNO_7_@o7T-#Cv0L8_3+C5(wd$D>POSF2VA)*1Ya}`^o4wg(O%5uKV95PF zGY(l@tjq+9et^}!5g0QHyKG8dczL+1+yEK*m>yB8nN0DKDnRy?~*w4cOyYp zF%S4xu(LHv0b=$cL+ zCkNdOcGoMe_5){azQ6Q94qLG#N^uTO_oQQPt8#$sr1bGPmJEW!JGM3Suq=a?Ex}X= zk6l9N@8#@&98LlxN^$ScoKh69_hH)uSLGy*a$aQ3;`P#%ey?*R|Fw}9XVV6fW4|A- z-M<_q2H#hp)bJw&7^PZTv4mm?s@TEn>MQ*{YyJqBR-n0&$h}Y`FiA79fRAT^X#bD3 z_l#<){n~v+R4ia@G(n;wB3(c!3WBn0;I`JeaQ?;iV{FOO%8^%VwVaId-Mea+u>%?wg-wlnVy#@YKV6n5BZ91|i+ zyWCftR@EbmlmqUz_+AmM;g`h+Ijwl)2(xbAF;|uHjCsFGS*{*H5<$2A&?P`*)ZXN@<%K3qTzF{Nr!zN zrA1;mMD&fs3W4srz1_Av$VepIB~`ZpbxZl2Y9PqccDp)bu* zuLz&!IpBgi1kU3=Lw4mjh}QvGsJwJ#ieFZIP2N8LQ@=5))6lE%j@>woYx9mg4^}E4 z(-fi0+*Q*P{<0*x(c!MGS=`^W>#~2^^(G>6x)|>?zK|2J5%nAIJME1B!j&94=?*6k z%JxiWHvLS@ibXyiO=MBJZ(Gt zZp^1n7a$@RjmzUYxRVGu_Eh&2?53#bCk@cpBFN}{!6ACa$c?<6ParJk^X2w|&}t38 z665-&RG7ZyFi7pfTsNT$Pb~z(rT z)JB$R7;Tt-7cqv(^4&v;X7FrgqZrh{qT#;)fsGDJ-piFe+a%jA12l-kw)>I*_r6&7 zF;w0sR%w`>z|^V0tb|q{nM@9mx{=c7K1uR$Cbl-bFpe7=^^oV-g&zK%UCq_nn95Rl z`e)!sGqKMBaw`9(ik>QpA9wN&FdZ6d!Qx(Zl&>0_#y8bBnOjhk!IK|y8F26`iQ8sH zZVz|ZtS2k<<6E#R3xdqS;G{jU!*|~Jp$rS~iWBon1@u4MyUsu{W>cxPUKtf(055tI zz?F->BL`l8^uMWh7%^AhduT5Sd7+oh$EKLk{j}l$xuC=lW2BFsIDsVE7C$^+9sbc6)eY%1i) z-a|Q}c{V2f{nqptDX)OG-d1CI>r`OqzgOq?9-8_xGZ3eJGMZ(PP4(9Tue%fjJWRbF zR<_9Nj_ea62o_uXCgaIF@hGR5dEc3L2)?2AFKt4hg{cOf{gum_P&=hBCN&}JWi!bf zIlVbw)&V8^s=%@zl*_N9``PewNveQZ(tE1vz6}BS423Jb7%2;*3aD*c{0r3<8(S-BiEzaN~&;U0{eH0NwU!kr?a26I&B$Iy1FD=7Nxo zZ@lMh?(te%!9X&$1@^;V?~WbMYSax~rP&peLC{jf-a{!`w*cM&UfU(@^qj419l5d! z;O__8H7n|}fsto{d>sJ${h77dD78z`t}yWHsit|vjPN>=znt9Gd;fpa@ApRYJ{3aC z4WlvX+k+SK%Oqowi-NWVw($0-r}ojxY$lendN!5@ALBM>N*!}>8`1lY#A#MOH$$>| z^_K`+8LWe$1eChd`xhhu{|1XvoxE&pl#@I9qP&U%Q7yRGGV5F?d@*uNVij29(ezn? zkQFcs0}4S&L)7|qqWrInP9Rx8u5b!1b0~s0-XGiUJ?R<9pD0qfdMO%WTX3O3s(57> zeXJ((I!YgyMPUq_Pt9_Yb-EW+Y0?E$mz^=q8H?pq6!msj=h7DmFn@76u~BM^CB=7S7Qyt=j2 z>SRV%R&gOGm+jq=3|iUdJoI%{;;_Z`6gJnaxP41wf`mnbWK#NZ$#~~MDSIt1?v%P&z%O60)@8vrjqKTA`scFby^3k{`VCCeC5SI zy{*snH_au>Vbo1F`D2`J&s{br+oMgiv%TqDwjsag4*q1iC&l#C8vt5OyY$_yTQvr@ za;~kb899w6lAkgP2o-}6VeVrMroHjVY!a=x9XRWO--S&I#;F04`k^sTFKr{+-wG&X z)4pf`165$e?UhrsihMCPL7QCEUg~(`Cp6b0_tbAt zP^hdL^KT!pJG4=zAx(T+7PSppI@I_4&+IoN;suahrr_`Ujzx=-K zFAdrsm}skPZJ>PvP;ZEbOP)4TA7C<#X=cA%n_VeQTNTw)tc_l*np+9=@jn8?lfU~0 zY^{leB|EdlP0SEP{H#u9cK8^djx^s6z<2mT>_NIoaeZyT!Bd+boBK3A2&aU<+|;RH z|BA|2hjy<|*U(eIWO;w56Wg4NxM71#9BefO?ZSVR31m8}NI5SXMOFQ8YtyOE*ZnBk zZN*8YmOI;mU!&(m4~OsX-|q*hGqj9n6i-*Fek{)-9Z1+-7KcSi25uYCn?voW(s!n| zdav@Z^#k^84*Dl@orBgMv1w_$tz~Xckp1-R?8+!gf5O#ci2uJXf zk`Akrvk95`2XX&m;(C)FjBO9-i2TXQIw}49?#w@t9HU+oor)Ax=~57Xx*X3@EF}Pd z?d~n-p7z3jyU1{;@Yr*_eW;W4S$5A4)|ZR^wQ~p}T@u*HLvWiOZ`!b{?EIog`*f%? zU5?yK*l~j<{RIj?MU2^+kT0}LTv0rSOf-hi9uo$71whObR|HeuN)R>(x7^|Jd zn|x6#Nf$-K6q`$rixK+QuJHBOnIHeUwkBdy{QSDH$)cO}PI#orr5kt$_L``&R;{)v zHxI+XtAVYXm;zoY)h{e4?nj{)QpG5|dyqGey{ODrT#~qQBq+w6kH(4J0RMQ0{|y$L zsQw?Y9Z9O|=xq|Z$tkf3H+**L98uy-F#4jeGv5lZtqJ}>6(;8v@jeg@Ai76i9b(rT zR)+pE7Uek&W@+$Ia<_O&-@b=TILdFVa|2&8ZfJvAwIJybBOt^fY?A95V1R^gHO0** zANp!hp+FbW`%~Tr)oIFxNTOOUB_fK$>(tMs{ddv-g|=TJ{0D7+^nar5whOuVyXsIh zBV~V@5OD;VXA4$yzCRLsI_d+yFo0Q@_7^toiQ{{l#>3<;ij)gUQgLFMwj%C+7RP}@Tx!^KtRv!UvnSY5-p!5ju95F`6@Fh!581!mtj zS2A?TWwn7b)h1R3v!ig7I0Jx~C{hNpHTC1{6BIRhM=tgur$74bDL8M9<)W_s{+Qa8 zvIW#$*XJ|!3K>!WkFCN z1d=3d-uL1Kgz73#OaQoNN@LRSgw5F&^%7&Q_a=t6A4dBQpRz7+Ka(kkQ$BrwP8voZ z64y>b*Ng3T|8sH-&gwAd-` zIU55JvRjC2~pSove}l zRW+gBrM1H5qC{mM*JV9$-9Sq}%n_|9YQkYRi-pk^KrW)aQ7St^jhMd}aZCF{;UE{B zZA|X&EYGMHwAI}7%Ond{r#KYCYm9cfhgPokiIuUFPKd+NBRMR!M5=OST(5!xVl*_V z7BBEx0laDcmJ%MP6sT>Q9b89X`v2T!N-fzgn@K=)(8Cin! z0M)LHMzGZyM~Sd**=)DOOlW{7%Y>1ON;EIxqQSK&9e^Ep$62fW%Hd$6>7XgB5dD)R zfIRthc0P26R}W7FExAn;xBShZ@A5{_I;r8afHL!kVywzJ9BEe*qpVAzxi>5dAJz8%>ao;r)Wi4Mg%YRkPH%Qw(zuTBGu0);y`0zW z*GtL2F1x{_qK%PKnfJI{(jL7Ryy^^~<+p$B8dX^KH*H9RHd8R4w-tUTAV%r24Ny4j z$iVQU%KC8bC~32NG($K0F*LX-Z#@o4E7AOVdENJ=I~pmRgw*fR9MXOc5u=;sCDt7` zeI!rW7ZU+f%E6vQd>V#6%p*3|L+=om`x*B#2VqQ)Ju*@Id2Ys-PY4&BhD$eEJT=xwzwO6Wq<`2>IA# z!9lXFZB{J&Xd3I9(a_^x<;jyR|a2mg_Q&23zy=fDtzXa-BEWxEpt+IB)k4^RCJr z*=tq+uenN3=|H|<$l0w~Z>D&SepWEp1d<8<9Bo9l;K77n9UNlFE1VWp(H6JwggSGl zn*NxPEU}Aq_%(5G`O%HlU8Yjb$_=L$s8Q!IcxVR0!tl9N9T`qAak(Y4mRP%KlL8&%K&~#}dKF z4Fb|u3o0`gV?VT{%my&nJOR_q(6GCaizQo2+3 z7oW^)KsC8CxAzKOk0Ldi-wDSAgc97ow#BBu$2zRS;pcthJ9i=yE1M|6u*owQSSGW8 z50WuDK2JVxceE+uML_(GN)Pe>Cg5duXCb8GoY4s_wE3n}_%@KR(O~QB8{g^nY*s&z0m&^y|0k%0o*OgjoSk- z**wNb9+fzYr<^^}`-a}5S%3RXq9p}cAd#Sa_uVUf&}c*0zA$4!b+bQ}69ccA>IzQT zPlk@6IVnFXQICifv@bZ5oEm>s(6eD6y*&lP0M%0`^dLgJb`S7MOgM&vKfBX`!A7}4 zBCA5X_X7?rq;LM8oDEEc&kG9RtE!^>7ycd_(pj<(q5ZYgau+4p7jnO$fXi$~7d8Vm zJYq*5Q#rRiRg@=xU4dvA_RLyd`B{%npgYK@e2GQCIdaVSeQ)E{QlU#NT&=hvOOxAj zq7b{+Z(hdee-M#BeHU(7beT!{WKMAPJ7B|nv)?6;Oz`PAi;Q)cTre8>l+lAI{QNCC zQDoOrr?VLISWZ^U3+`9+Im?0uk@Q)z+gS<?v97&=6OtpXGqT=N$5QTol@kRk0-!dp#Nx5khy<7;Hig!;c$n?9k!fjp=#rP(Onz{=!2isW6^x zccEWw#Y~LLfoa3*pS^LP4}1dWTw?JgX_7UH^B@=y*RjaH?|W3nnFsr4-dMdM ze6{}&`VLGL*hABjYfJ(~N&d>l04%wtZUA9@q*Emmg44H*cwCA~oSkA(8k40fB%gQp!kn59$g-X4)Int8Q9JqqKY5uGp+5#z^d==!Mm*_l zuDnvf)}`<-nu0w+5=BH&w4i1E);oplK*8?EemY(k&1X9bol?~-MRh;?|u)pZ%xXl|DU)! zM-Kb9{bp%mL$v7T$g}?!*!}CXy!|ojKZuMLkIrfQVRLz^f1x$>SrQLh2Z#I~bYwIj za~QVjkFG{XO&WHr=R%V}dfczo@ttqcx$FewgU1aSLO3tpxJdv$H+ZW(Ck{jkwD$MT zEqws^+n4O`#f`xZGkw0xf#3tKM2CKJ-FgGx(u`2Q{4hnA>f+dJfZTO}- z)YV{43965-wv52-ARa!x3vb|T3(!`u8?ZiMuFxw2a94r{w)uA{l#0C;^Uzr*#-OMD z=3h)Rpg=Sp_4GV8a5=JjQe&SH+Az)5tAP%%@$=RA;-6~?JOc_GQ7fc$ocm~bL zfo|E&czsI1RRNa5Z{fflR7CQsX}?oCo>YkMX29!i5kDIawBrg2;UIUF9iK&ub7i-j z{~y^!>F8op3(M>Dk9NUm*>|~rP!yScO~$KY9Ow?RlA^dx?O0R%h=wC{bn1NUaa+9r?_KJqIaLLS|&dl z;vJgF;N5>E#{qy73U~G99);TeFwG2Kqwt5EGIDX?xaj?-&wu_jN@+7>n%@)fO7>i3 zPsp~&5v_>~0paOMa`1Hg$;<46oRy+M;YtS?NBtHxJ=cPY)97-?s!~)Ktk}qI&DQ6} zCPpWo-`j7P>pfes+*nMoN~C@KwE~jCnF@0koBfLJq~F8!Nal!WpQHb>RVUJ1ceuN_ z>*lyg{K^Egk>h!oqNSiu{NiB0O2Unx@Kj>O4(x6Z=$Nu|G0eY1@7vZ)uL`j4TM&!9 z5DkiB{9}B&3Pp&2;-h6$_eYPksa|P$aQ1j|6YtjvctgI=xkp}9|6BV{CL8nw4GH!S zOCdAUXG|U`Kvy{?N!!ql>vNXqmghB^IWM2-|Ms-xEFv=$Z|`ZH==fzNu--J$hMR>^eeiVH;G zl{rN0kr5E55!1w-?~?Gr0mTYeHJo9CArhhzOYHEHIPWJD6hIP5}l!znS#ga_tWodMGmW5rSdw5s;bqH?M=* zZ!oKsxhIJ;t}cEk@-Amv*M(^OP(J(iXHgv^AQ9Oz3kW&R|8U#AHeT>QD15&>sQF~O z2GmVjYw9Y?!K88}J-;9;=oHvS*64P|QJ)<=s6R|kK(u|iM@f}{ zaz@;f#xDjgtj`NW?14R=J4=GmztdjK$$K%6*5c~Y8h-Fv-8#~KtS z7BgmUu^62|zaL4$a_rq%adeT|GBNghwiw7^68Dn!@f|6cJfKPmm(OY>Pr6CiK3A>F zP40CE2lW}kI--gfQEMWU=i}X=*88QRrvsn{D=n4=q&@)<1MoogeXuLua&>@3cJ?>& zoqQ;{5)E~qzfwmi>I+sZM6YLUnI@gID=TA(N(BDe9sLfcI)XzS=7BGD98KeLdH(UD zsLl(vhd0|o%l1k}IvLLJzeoyp0u*_+et5AfTww^mdCWa<+O61^f7|NIEtoGe4TzYz zU~yHdGhOxvwq1|t^ct;k4Yk=15>SC0lP(WUn>U_cO3N`RCvENp($YiCb?L)a4|)Wc z=F&2Ed{+g7pB-G=`41oeYe+PkHu=!*g7E&kt;_n1*NCbsd*vW<3KHPst-*i351u9@ zH7d)g;j#|`mWw+qMko4*h{%d8KD0ssIJ}#MFRytZbY#U11p>N%_e96$20nn1ADKYd zBcq+F&)#>X6A+fr6lkX*++HuX%@$?4q zOu~Pu>h4(SJ5`}I3pEB6^4tAxWAgFwQW}XlQ>`B&KIK~kBD!|T$UHYVZE4}gsye4&t@{lw-gLrd zThyUxxU2`&T(-c+m_gpwO7l|M0*j%8(b1H)D&f2J|Df@cXPTK4#iE>FigwNbeperk zfo+qZKXCj!y|7K6_K{~pVS_P>rfInJrX3LmVwbivZd3!NRPAIwUPX?rUX{avNRjm? zP~DuiN1jHDF92?p_5&~@6yineUv4HrdQ?n%Fwh(0T>p@h^h1>oQF+;=t|O>5><=uVOFEIx7qbOTJ2{?7P4wf0pF z>)I9!T?YohlrS;7zr66W^rGe0xu-wzzOJhF*#VGwAys1sy9>{p&W&e{r)Pa^Ep>_~ zC{1x`I89|mzi^6&vE1^YgCZ6lW!O4@c@!64 z-Yx(Ve)!H|RAFboZ}eSeXoLV66?y{*-y1q&hrqcd=W>AXssnQ9w*1DW;tC1!wtXQ+ zNb%ME$4=0_9;2;oH0Y}^&VZauA8sp#_2)!E&tydbDKm=yI{;q!FznZr2;|K0EP}K;5_YE$igX3t zea1F(?_fqrOT}!vV%QKV)0BF$&%ot1yC&dx5?Ks7H`4&M>OKv&`v5h#FrNq(rHtlg zUvvjhw8c(x252VQ(J&&Gk!diw1gcd~bD@Q(?3s%gFPCP0f>O@fgQJKKQ-Ukpj-lx@VQ)JaVs##6EDiv*+f4=S%?9ihSc?Z=cB z0@w0S8oULxAI{bC8BpU%dgj#R&`(}qUBBazSqy;#eAI*EPz?LJmLKoQ< z{@A>i5cFBi-&oM-XSo2`>)r&$L-=O0Qi!xtcZhN^w?w(duLl#K4TtuUF^16AzAK-W zH5QR}g&19^Z6_lO_f)iUae}S`?HOE*+t-{r<+P$04@LJ6Lw`zI9`T>>Y9w{L0{3lusZ_k>8y2n+j3YSb1jJW z_1^17fdli}h(C7GAf>HvUFfGaFypzO0<90-JyI?~PWH|yk5j%3Y8h2G);yX``z<4< z$!$EY!{L6!l4Qi>{ZCAM`aY9%5sMV zLf}j^Vuhu6dLlrJclQh~W&R7eDl&`ouwpxiZ&# zEsSsji)0TdT4w}^ZN0!={F?%F3JCL5uRp}!#3ldR+pl-SvP)8S{%Tv_qo3ovRl{(8 zzpxkE_Boowj9HRMyiQzvSqPeQz$pgIpZOCv20GogjZ+M0vfr+V_uuSOpjQL{BZVu; zYevs!8Ahv8hxks&NA1-PY%6`icCkk8`!-LvpN#0|X~$D_X8VEwHcSTRd|Bb#RC>yv zEeBLipV+6^o_e=_n85^K6;#9PC&ZrbJi~YPq!yGw>39QaOE;c4ej?*oDa0M)j{2F~ zTg1o{s>*DfW@P!1K9X;IB}$D3P40`eeTmXkOX($$2nctgSeB=aQ9`*`Q;C92Y0&R0 zug_*tsQW4vv~qnWr|Ynz62O`#avC1GCBax_l)z*k#$Rjuiy7=40OONZ7Nsgr1BZB(0Tgxf4Dhf$>-BS+U<0z`?h=ci7BIH0u`aT0$4#BB6L`Fs zfSU^LPc0!Ir8zs4&_5$bv~C#rrOTVAe`P2brB3tbM15ZC&z-eqzEqV+hEjEC(+?ek z9O3@T*&UhShS+a52r0^yFl>9jRTKpO%1fI)C=~Ulw!6U|Vc@*M4&e=aJEKOPKm-CO zmA53O!8QkKon2{=aN7wH;++s5svA2*uxQO>dTqMc(n;KY_%{HJCeW@|*Lf$bPwaT- zO|z|i;a;wTnYg#_sybrA2(B@2LY$nP7uo7LSTaq4pS7!h}>_32%?;@;3QMSkEnPV)CL`nluK{yP1?ICqtbY1}0z zt?vWrHQJ_|?BEv?=>xGr`_BrSk{_7F?a$u-ioB3}?B-sGA=f&>G6gozmc%{0hn)7g zeI50WJ>>g8_K+FSN6Jg+7(_DtR=z#0iTTATL_iOoy8R&;m2*cLoSxpmvRwI33Ve@T zg|p)O9wR~r9jS&Y$ru9xS;1>lSV-XSS?W(pldEFnf&}Kw(6bjRhrKFOZQ`6mgfs9H z%_i5p@FyhRPKOjT_USdf(?FUBVxei+4fxi#3hk~7$wjL&ukQ)}Vd4#F{Vjh}R1$#( z-kM9PolB!izukE1m*{nei(yiH`?tPlxW@lVn5rYlo|>1tb?kMH1o6TP zVWvBG${c2|vJYCxdcCxghldmtBClIKy1O4xHmB>;IpbCyCO*b@(PL_uVr!;M>nZ~E&j4ckL? z$7IxfPg_ifn0T!lG3?(+n5IH#)1#YY(^q>0*;FYp?&1TWnY;OqeX7BjlHR49}c$u z;YXR<)rHze)AT&GZZ0O{HFe9<^t_TWmoGvs7rZXtU6pv}8cSRl6ixzo`#pEID2CQB zU+prf7#UyPj|OP2nYf?N4Ubw|#O4X&=xp0vG9=>eg)1V5uU`I_Ptf^1*)HNNxQHBD z&jo2RXMNu(rbgmCW!N_lUW`kbFqq3;P4wvsb(Q0H?=3)2(Ti+}n(0B;jFVrgeq)7q zOrOqw2`$OpX4oe?(5kZ#_XIo$qOL9-4q4vW9U34R_66(Ls;FiEQLgHSkNKgDo8vp< zX_lvdY4_$9^(hv{Udmc%7qwkmNIU&Zm5-&~#WQ5vQ6IZ#*&D|2ezMTgIDjxcdt1x$ zeVs)w2wG;40?R_wes&wbv2IP;ZhzZQ60v$Cp+Yl8IUXYBp$C4fJ$+`mr4Ze>TFf(6 zjS0%{Sh4~qoq_6(>ro_^1;4dl?GKsEa5DOa6?p9b-aSuLe9*zqahu}vm9cz`majmv z@acv*%CbO8dw&GNY*?agZ1OK2-kjky!}-1ezopt2O7F!KTjDS9+WsJXSkyW4@ZP_C z!c=RXtove<;ti6wqY)efO9Q_{}rAJLgOjP+Sf{3K5W88!YVwf-Ii(ZEl<*;~pZ;AL0e-4x^2iDs zN#@O>PD79Dc<#1fp`mY0@UK26@~%IUp2g`w0! zUh6R;=vL)X6J^)^8SM@q#x}WK!@4ycZ(PUi^qRwlS;UTR?{^1{@#&)lT@-6N1>IF8 zjMOvSkociTy+QpMjECB=Vi4u*z+uZgB59ayE6E$Lz33-4Doc4kLWZc2iwQfe6`!wv zDs+A#+S}&(iskev+Gh`oVbC-g8Ok6bNQ7BQ8n=_i*;d>QZ&I}l@sePrC75Fs-l$!9 zR&7voV?N)=)A9)|6@1}=`VFyq7B8cNjeGAM<0C*L75G&9Cl(+N* zVUp0lEG$4pYT`F_`d+%Jf$3sxlP$1#Ep<%Rrp@?O<8sN`Bb0^DK>dSF$*PaufRMs7 zxBXnhrlQNC4XHqUCYSe3SmxNXPgZS$tpG;tw1#0F~c^Z2QQ z4dl?ERtva}^XLDDW*F@P$Ah*yp-~HwWW%EE4 zdWZ(0DwIO_o%w-_+$^I>z58y}j>F>9q>cg*-y{6c-dEW`#>V}hupV_FOyPa+{B-S2 zr{;Q!Qw-F;CLtv$1D8~_9zerBL99pz_u*U-?AA)N{!44Bdk^x2U!q?8e3C0(7aA(~ zV-Gh2dgPizYubM%!SmfQwVM#W@#=Sy$?#KIdR||W11&MJ_{tYNI2Z|KCfdQiBqA3j zg0&9(J&P4l_#E0dGO=O!L)O3gcK-9K@IL)hU!qZ6b8+EfAFim0t`*+shKat`2G9I- zib7h)TDNgfuc*T`@#0jX^xA!Tn1M#RSndPL;&div(*s&EEYAC}&92O&boYg{c>}24 z*v=kOaR4h8)3!{Rb85yEdWUb)#*@A6pr7gh4{7iP8n_H59V~E zUx)UBg6-qu^_KYP3y8K3heVSx)}S>wZ3UTvi9$SYE36BnQFqHLg&ush8YVc_DnT;_ z`HB{tU{IG^n6}MhTF_}yso0Ms3|@B8Y2-{ybs@~nE;iJmWMSE^4Vi2@;l+2A|1aKz ztAE}Ekvaa}Z`1q0$S2?XMqL3=>SLDbna=Y#{mfks!X+iDn%*Fin}XP^Qla_9V4_t< z{DDR!j~m9LfhAoKL1HMkbuApoeXn>vtbcxTxw<12h+9&|Dohltu>dJh-|>Jm_O2Jy zF6btlLmrEiI|kdOMT@Ode)$^kTL#U{Lm2(FV>rf%<;)d6jUq%SBd9DXs0E z_eZztRcobE_Id*>^5R?E(`rA58=^Ks-UFH+bz~#E)>l%soN9XK+FlgLUtm1DJWaAQ zl=*sn+R}%lBa8fTs8-6XUq3*|M-}m@Ip-ufIV~&-oDQBO{J? z8J`MxxL1N$dL?8|nPOksz)Om@5yb}ce*k>JY*1TrbKnHqPs2}X9wnC|!fGjOrek5k zL%+(jE)3S^)Sdn42cySO!;9JE=$qT4uw}I5_(d3Xx^lV6&@}7G)aLVd9M?FYOzsfd ztVHO<%x2xOp=n$n&e=-L4(0{JLZt37rr!Qtkohh?4!2 z8#s>Y@@IQE^oXXTg|D51L{JXGs~6qGgJMV+ui%F6c<|Y7@7OvA!iY3FkLkykch)$b zTE!qoR8Xse;gSmL%On=B>J?QqVrwQt%y$^vH!_=pAc3A!ENI(QffG(6Do|AQR$vHZ zI(wFK=EB#;{Us;mn+Hg1_kvAz9`P1S&3o+>p-?A;Cd`gDLtPnSGYbuS!Z(J!c{!hn9cOr%R)B>@u{@={XHc?~OKdXlj6{-DIwk3`n4! zKdSFolmcJMLXa8t%+{5a$aD<#<9=Yuxa;pVq&LPJYKJOBP6bBn4}o}oOc-EiiQcGZ zyu_ITqW6QT3--yFC`PuZUBSeLx}gCdDb4Y7L!E|EvoE+Lf+mZ+Qct*dat#TlmE1oV zLhrhSG9qtAg9`Q-m`Zi%ie2ffxWT_Y?M!Fo;@?#JkBc9~48y|<1RQYwL(?vo+ujW# zT^mGk=1bmb#k??C3l9FcMMone61iwC!s1N(NgH)=L+PtZH3j3S&B)`EKrB^*9_B}9 z89lZ@uS~aKZ_Fm@^Bv6?vX?{}K`xAB*RL6bB$4z;^a-hamKH#*9sh z1kFsfn!fjg@ma!;mW;H1)!RWzy3!ckQ2+)XyazwDVO&=_Yqq_HQxW9l zJz^&Kl<gTvR-^(v<0CX`f4{FsYA8FUy{QB%vL-U24Nzxjcv;9uORngssT`ZlO57Ibrj zYVOcIFIY$830B2FA-G!lMZKSt0oB&d*3G9U+&$*Ez_X}co^A+{95p_z($g2jVN~Lw zd8*VrX1A|RgO-lcZ5r|22^t^*w9OUxv0w zR?^-l<%)rCBx<0{hY7-nF3bhdY$&%9X;UfIg_e;0R#79GYoRh!kUtSZGSH;p1QEAv zUNq#4zUbjMBo(4##opbmeeu%?H9I&FvPGIJJob?>i7oSRB`PTU8uDB zi;SIR^qMceK(eMdn0Co?+HaJ;X$tA&sQFy5S{)U&Uj>fO$BC@8MTL2#I4+G@C%1KJ zx%&+wz`e*Dw|bVRZ8A$~=F+1o_>rey3PXxRa%pV|xRA=Xt)nVX2RE24^ic`)LZ3cw ze_0$OWZ6XY!p^)2l(;pe{OI-4yOf%R+*QG_%`z&d-!S2|*KLv+ZPuy9{)NiFyvzc( z;4tMs{pNHG!)9V!+H7Vo{OOwH^cW^Rk|Gy^{aW{QtF57poco2 zCQz)vZneM}*CM5@bxRyk1N$^yP@o4hQL}-QHB_7tF?u5&WRqXbjwM{DR-4ObDCgLu%c`%}@Q zskjlnv%Ij(-wDXQ{U!qhH0b{)eMY7=_=>f0`GV6$8EY&4@~9-3gWDmT`RmF;4kAg+ z-X(o=HnzCIv+`~f4@a=UmDLK+HEUX6Lhdb=!ndbduJZhn4{8sTp<5V8=#VYS_`J-< z(BQSK4YqU6x;ztbr$Q;3N049xONk?CvO#ug8EI~+keJv-fV{?Pji)IyAX;UW7uTEWKHveb=5f6t1Ggi(NPQj;a6^Z(Ch{Rl4tz07yM03H95HnT(C6zga7X1f4(* zi~RTt6J8BKI(?&bJmkmhOuOw~$A052>=#Rgv3O^}sKuy|s+|}kLM)I@zmPIEtSQWM zgwxCTH2!#J)lwm>$Y1$&gHERUzdzCtQ6@j;>X#h~X&`GS8b=WnZjpaC6dVvrbo-hh z*Vm|Pzcva#Ur`-9H2uVPCFhS6`Q-DZcZJsn=$jsGl7Ol}1PULpf4x9yo^+R|I4Ps5 zhP&Y+bSxA{i`?Z|(r({B?Mk5*@;O^yK}oo8fy_Mb&CkbL-H2!C_HT-fTZb0a&Li%# z8Iyt_jkpD;(?vvXNs79<=$sBJ{)M~F!D~GyXTmW(#4E){_1$WO{sZaX<75k$)9+Mc z^Dzs-*5%p1`HdYPiL)YCC3@Q!Nq7f-Tg?6&gVm274D7x)^mJap_!jf6kA>hR5gTs( z$;p6-lBy(R4`Jt&`2j&s;q0bPAQF2RPDlGGArKFy(nJw}#z8$5hWR+;xSB(*bX>Nu zV)n>c$1`b66v34cq7MvDy0!g%{bv5iWe5puIGzmKeZQZoe6x*^E#Q-wA<1L$E4#x| zq*%P^(W8-8eQI?1uxuwuWc4>KR-ami*ePkGCb^25%lYMvRb{#?z;kPvJk7Tb3Ys`b^RCNi+S(a#eKU66VF$>x*hGdz6{N|`)DJ&0+~sa&$tUUTr5jKAd|v;h zO5L_(Vilu@0@fWT9vbq&Grd%yxTcOLOC;$pw|7hz^hQVnT&_;6kwFhAl7%iP&t)+E zq$Io13Z>4%rt2<6`s6zO@z`T7KWm0JuXX5Q9u%QKJp(V`?Agomz5p|&8t3k3$G!v# z5jf2V!BIKM8|TkaTS_CPDrq9t$qx$^g&Pwx7-Wds-#6{W3&08X+&?z8J1Thep+Shd zm4oOGPtBzCIB`F8TQYNnxM9X=J0;9fm*}2%50x8wwHSW`SZ9`V-qPaQ?bFVfirD-3 zLTw&)I#TqjVejR-uXd+M+(H1+Lk^EqQ`mF-J)q_V6m~g#=)FtU#Z>>dS#PMyD2I7Q zUao^(g?40BRc$67q=UzFlX{P@taBc{zIl7+QA|Ud=T}SGPtA1+*_MAZ`S_2}StEHo zzTW$4;01mkZ{!Zk)6fDWb_3Uid}nwjSk3#ybRe45|4| z{t9T@H6o;eMUZdii;*j})>&z*&)OIFApKsZmu#e$gCE_0rcaTknbb)q>sRga-0k&> zE8f$ucL|mG;q(2jpk`vo@0f}vFSaP@Vyz&L*N=jY4+uQ1>mMEl;EqY^%h&t%tnjPt z3>%0_sVm^S-VJ4@kj0vA8)OwbKyRE!>hqT1(I(HlS&-KYAHG*A)YrGZ_(OpYCu9yA z`hXnOOxgI7z+tETD>;$4>tY^xb7wKigJza&_3=JSPQrkzYxP2)6H0M(Bx_dpEVU=O zID7TWkVW*me2uT`E|+KdWl^hmq_sl_qYrJYInfOoaL~M%>V=fQs_Dc~(OwZd$uOl( z8Igg-QnfELD(e?D9R_YJlX!w}^9ARL|HXysm_I*mvTUW+^atKBW`LJky1EzIpu`;| z!ZI7Z*0CzbfAnXlY}w$>Qs|nfbRp1OPsD4W>c)ME*=_GnaaQ#>@f~z*?KtsK%XOV5 zeh^CzZ&UAsXidmQ*@|$e?X>M`hECdE=z?C3u@H0erpdy$@&h)q!7WR3O3`{UqSxoZ z$~WF)?thVX=J8Pd|J$z=B}}U&GL?!#l8-ISB%zYD+xKi)#**F4B%!SNR3ytJ6=h$? zI+H9@4TkIngE6+To6U?f?$hsk|L(`*{`cGe#x`@#dA+aedR{L%w^U=<(1*24b@Wus z=9D}!UIq8OIXp*alN+-#o4_?DKK%rRx4_Ph-LBzDzBE!!5T+J(xq6@kKqY$6xi)WC(@zoLBNTF2TG9F#~c<%RF)^Y^l>^lEEl0kI7le9jZ z_5SzsnHBy{o2yb_*URh9vmMeS%1Q6x4lEZZD*uY8d#?SkTe?%|om4YqRf&y#D>Wey zE(LiN96#DDc3p#4+L7G`n{y-g9W6+Qn%ykxH9f^J*Vw7na6Os!0kk1LkB8y&+j$v# zmr@%?!P78lR-%atC_b$yGeC}E+SB&`ccKsYsz~PpTHm*MCTTo~pYRv4xapn!v?%D) zP_?v61m|Fe7CJ5`fK5&O1uk=>rFT4r>+Gc^1$|<)!a~khj~`jsSPxl`u+h>U6!EBz zrMV*&#;BZ9Ae{H}ACp#XRY}t-yKm-vBATy4><%<0u9M*SO-3Hv&@q{8Y}a5m=cHJy zS8c5^^9};UiZ2Ah7j1*bs%+2z(@wm3Lk<_O$_)yeho+Xa$bNx-0#nS08PAlZF(imH}-8`2V#H=9gv(i{3ppJ9-Aqm^%8k z(w4nCg~7$zo2{wU3^nepDdd$oN9!{N6E=Am@@RBjf9y$CMYY41zZtz`BIQK7+dfWK z1MoS~b=CJCM>P+o1Dj{XLn3eJY`b|wd$@Mpbp1iI$wZ+f^C7J&@oM4#; z^x2tv*wD6dHsJ73oLVv)MV`%bfwo_5M8zOC`JX5%=(Tis8SJJK3C8nc9d5-jKB*|P zM*>Lx8*4NgnZmE$RVL!+Nlc_`wkHD|*WGO8z$c?NCPiSa!<<^kU4bpXOTRuOw8hvJ z4``;kLHVV}^Z+Nn%ZagWn8S}V%hr_lCDx1%n0=wU8E$A8jrNse?9k7fQkMRB!ovew_op)wn;4+u9iopJ2AVKr_LAp-S;cH@aOvy28)z()B z%-nh)hi~w%0|o-88X5cLSLNTO?l3D&7T6UG3=XYR*i|L>=8yLA?(g*9IA+a<8rA5b zp=Bkb8h`l^l5v#jaZ}FIpk#VolN2^wgT>zgXn7Vt3Q1@mPC|X+JsHAwvyuUh?K|xZ z9AR~Tormhld7a<=sLj`#moWKpib{Ii4DoB0INS@E$?Fj2kUch0zF)w0Zw$${=RF45 z?QdPR>b*Gd{OHfSR8KCVaU&H%!03khZ;VGlKDe+_(j`}duZY`|mfIBkbk%b(NQaZy z#aO?R=;1TT?Cn)@GWOSX56&5jS69G|G?eZPl0H}MyrJsm%o7~*JMH?U(QEjGfWFPA zl-;*x+S@+o|6IOH7t$CO^xIq`30yP5Q_Iemp+e3K2#lep4!scPVaM1gzS=PkV8t^141#lobBPQaJ7V zY^Y;tUQo(=SMxATrPg}}p)@9wmmsywx+G#Y`Q$|rLLsRE0Gr$5 z^VJ;lY1Cf!2vq#c^)`nh(fb4gUEP~qw3ISd8hqa?7FYJ*N`F3nrwf;JDdr7H`eG9$ zf3{kJZT4>z%@>#7D9p0Y;9` z@%OD~)XjIpHb2_L7V}=`@^xK%?S1wk?m35wW4XWzD#&4?$>nYd9_G7$Mv8_iC5@2$ zbCqfFcJar)a5lz8QJU`&Zh^4siW_CRLpy3XPZq0gBm;%z)qYNi5Me=}8`H`m^d z?dU0>2NziSY#sy6jBMfS_BnW#G%PKkFBQwA%1dfKOWi>gWrDgZ4<%Vr%}0^QboDYl z=5mE+(}R&>;mz~#^6U7yUw<*ImFV zSOBS!sEi$HXz)P9qUXQJrzKPPt2AdQZ_uA!gguvb&bFMBL0m?$>uCU+!XDLHj}(%% z@M%~zO4j3ZsQcZ#CGbjl2(3n&8sDZ|lJ0u@8kb(8Vw{(h8Vh5;B-~oh!cr`kYT2?n zTjKD8dnLc~CnfN++FI+Y_V6*L-~7}U+LGB=W5nb^jIU^#ioM-f7_kz*(YwZ#F5%&p z1eD0}xS{Z+S~uXq3!D9C}Qfs+J9xw-*hk%IV96 zOpRh}V1C9WLd>z!Y^1xC+mR*7l{QKLku)+aD8o}LoVD;&a~aQDswYD2P@$pob9rfs z{Su!hb!{-bk(t!o++13;gq?+5b%V}QjdLx%xZXx(Y<6qdvqTvWEF!3Os~aZ78I`kD z$SYIN0Q`=T^=tIz8q|~=)H1VRlqcVithv^7!BEnPC8Q#R+lX>oorP4XA)D7WzbMzK z<#Mh$ul#%t9HwA}JR+DO;0L+8j?XFk!Bbz(y+-GDyt)&ioi6+|D|X22v#Y&VvL?D7 zvq1dU*&WAiIBMNbHan#TtUm6?frdOIUU>%rHE8Y`3I`Q|7ZID!#`y_&A1rs?=TeU( zj~RE{$62Rx_P~EX-$0DVcUQy%&psGNyjLy6M}{!GiCobZa4>DPvuSl=?61NqQ}Sh+ zvo)?Sg?0p~RI}7KNSuFEI5<`YRZh@2_@4w&_*B#)R}I%w_bYTk8_CTB^0nK85?a#=p4o;?iy=pGV^EV!ZimOn&7RTsoJ@#~jy z;Tx?gs0jfsHD8&#(T~Nc_pQ(7CUdvp)W;=ib1`sU1>D*f6+Zg7$COBbgO`pOY(1T} zyv1KmV~>TG*s>=0uQX|T?9+xkndj713(QE)&waqb67_T6@%PIh(HZQ0u! z)tUd~>2DRdR-+kk$m(|u62pAqjW~G(G>fc%LBnHo@aNP;7b(ryZbmC%O3C7G-Y8OQCWuu9D+&AKh=?y3!eGR^BD^vwzqtbTJ^6VKGF zaE1uRZ!yfa9&3jlkjooLm3&V4RX!5Pw)OEW+V=w6LjAsvBaIl8ZqKNQ*bYtQg0t9$ zuZAEe)X_p3jRxrU#y{5HPk7q%tfbbAU}J0i-zF-`<|TH_1`?7Vz!yXg{0pq|$CX-C zpP3TZJF|hSQrQIS5kHNww@6}+o-O6doDag1K7Uxq=mjb(r+10Aoe849P(A7Bp5r1&X> z`IJnWayh^<+P>xkq#+&mdK~POQZMUW?C(*c_{(L-jpvqHzkQCdgbPE14)2+`3D{)6 z&56re9B8?tS$TOo;8Z5XMQU?>F{>6qMT`5>lL|ecU)lp6$>ts;%T8u&o*bB!kM5e3 z7|rfy=))nb9wqJOyVil7-0McEv+C?1sAc=jE|=g{6Z=C8*8?(;>ZQ1m)ia2xWZfCbi-QGRp6D(JF%|J>vJ)ww2W0v`o2* zKp3-_`80ClRr-MIIh&eNUCww^dKvkc1lnzYn!M$@k=W>g>?27^F_MAX@bqAI?sY88 z;93Ku?rRwMBuiaJE{7Ar*+Q2?M*{;iBAVqAZUP)7&h_M_S(7Mrn-g!~N(el&8m}j7 zzz#9sEu-SGuc-W81=0(mt8S!h<`J1{D9N9~(%stJ%VLK@#f|kuY!|P_%EJ~L6s;&kgS{!Gg$CpvsPfw|3$qTBiqn@Gz`b>D>+Bu zv#_?1hYtGyz8Pg%{m-3~ro*ZZ;R|frxs2c9?-HQruf8dXaM|Fq@f5}cc~bx}vxV8B zqR*w3*aSflKk+N$(KIy-kWkSgy@cON-f~}9xaDj$R-AomJc?-m(W@NqVAgaIRG{Gr ziz<1h&GuVN`!rY=yyijSPps~(Mv_`6^egnlh5FQZUw|QW7WCU}#ew(J+!=+FCDf>= z*Py7+eVnvt zlF=z5dho4XnRqi=q0albw&Ag6laEJ{z0c+9bX(>rKbjnTTE07tbGjxr4362=tT;4G z$jp4?moCUF{c{DKh#5ZCHE{=_)xI&`Ku|5ac zS9~zjW4?|>)Xkliu7n+Rvyj;u4IIcCDF+87wKJhz4xyY^@uw(q&z-dcLHo8#IYF}- z?rJb*V=O#|<5Qu)pr^x+jp+Xy@_=ttH{mGxescp<2#mI$jTx5(mh51gjlM(pFh%IAjUwjzt zE8(^{okQ3jQlMLGjc8P7JcP)$Ll%JXHK9>%33Q9O_DiuOBxbn^(Tx}kg7XOQq;E7E zXyQcZfKwSekq$v~4D1oS(hsuhN4`i$u0*N&S4Xsn@iWx@-YpL~duuO?DK9_ZYLQ=k zjow@2*pSXJkngYNzHQ}=-4f>YaBusu8lXhwe=h{Dq)f!!)_EpDulGB4B1-Qjv>SST zP>QAkyfDo|T}*;TTsgMqtL;1Vy5NHKNoVB?N1!uuOBvs9BH_n8SHg$00BVHof1OS~ z;d^6;{OVKthC?-0;kl(e$FfP!QqI39go#nHCJu1{KbSvZxEk5pW@Huc;PqFsX2il7 zbWtiAx=>KkU?up*ZxYY`-nFjyAfOk{9fOFi!wlqc;SoJ2o-<2(_rNcUllCI?(d?{X zy@3bL$wR>uWZD`2gU5wAv+E>1`^n(ZK#8D_=SzUZ@0`U~gsQ zcpd%UE&yKHPF}!#@0VSOJOXo#s8Ww!>%E4}`|ZTZ8rTS!sfP`c+|wbvr;U4{61?{= zGM?DX`dzL~=k=JIWIRCLq5Ql`Twt!DlO{dZl!XXKQxi24I$FOS(3Ja!%$Bgbs?0iy zSWD&^TC73@S6E?JB1FI5Zaz0A!OJb`U4=m(q`Q$w_)?_qo_w^ znaa?zHHnMkd8m7$X!2y2*2XQO*FvQt7}4%zsgub4$$`^`R#e{pSwR<9jY^)~)GFe- z=_{m>sL2@^t|y>q$v@!1UdPma-hFIq4uqa%=+RQZgy|*%7T1+Zls@^6A|nQ)C1JtC zS~U;z_6Pt>Bq=%zhPNpNNYC{?E$Ut1!oe z2R@dE&bTzs!GPC4zM0GFR;9#ISDYrb0%NN(t;EHGl!y@2iWw_rWu4_+|Gfx1Rz2Ra zR&)N?7Ke&2L*!TDIQ=UYj$)nVySXdzIBi*bYZi6R0KM4VzK+!j_ZM*?SZ7s0m)D2= znP*AKSC(o+<|fx-;hT=Ni`C=^2U)~TLSR&5qAcPQ;V|OM49dzrF1b4Sv@VO?odL6Y zusXekL~Ox>`I&0N^Lf7RQxPjoLc~uHuP(|tmNAc|gCGYundO;|X6pp|gmS?HPBN-; zzSei*>FCT}LrTAd2!rS1_HRc90%tkj78Pv?DdnMeAO{_rHztB!Wt`Pdb z!^lDbcCL1(88OCn)n-hicd@UZOTc}=^pYMgf89{N#hqJ*@MNOzYEl_))rg&z(I1h} z2-d(*;1O)-JMG&pV4!87r%vGZ?(ZL!QP1YYs$u�el6fT-uN*YEiZ5vCBl*cEefV z%)P%!6X=ispe&HRR)!EF=hnX83X*zQ>98t?>e#eM!tOFh54u`g#(Wx`iS+e7485Br zF0*-X$yhnUsbv7WAx|xGnYj8bV>W)Dgu`m3q|!`ugSkEO)U==S+edM&p9kCYsY(Wo z?H?&ax(C(Eq1i;<#8*J>!J~#fVN&b+k1Xw_H*u{CDz=OK$TbsrjnNKp4P9YKEHWp>YV{XQaZF++;YEhPIH>4b zCM6}M(o67TJZ&U5BrK^|XRZ0>(JW!qv~AtvFA-Q3+>+NK85~1K2|}GtnffA|&Jd_T zTTXaDiMmGrw}ZjWqMEOZVk7*Dub!-5JLclB66&fuI+%)_cKjrQZQSMc`t895 zP5wnL9+}9*u%Ugxiz494n}1Uc%>fbN^H-MHVR_N#d7iDhiA%HLy3gAXqF&O64n<0- z;Jn+^O_J|hiyh}JR68jCewv5MwB%aTlWC#4pK2NYTQQ*Z%;GAY{hL74N#AFYB!2m} zm{g)6+Q;%~RUAhBBJ`%%L$2x)+4vy)3^jppX`bWi@>%UB+$&|tzV5qtlV#Mlj}FnI z<2rm3c$)2pnTh6e$>G`&gBT_9Jp1GgQ!=zA7fKo1z-6jio)&vLyAAvX*&a6a2o1Pe}iJXlQ<`f=A-?64WqL@y4<8um<=FdlyuuJ@a(@JG;=ZK{uel6_DG1g^L<{2k_(;N=~}8;C1Cc_vHPl4=*V3xDyLR@x!2 zTJd~i_>s3#NKdlXg%o-}{u_JrZblz6S;82Hx0KR&)Zuk4UT(hnD2{IIvDu2&DRi^A zJe8wR^4w+D-kTAWNuiLWPu_#OH-!5)B<$CD?M{$$=vURW%ZA~%+3tkQ!O-u5QzgnI zJ$5Fj;4hhR9XO_%qf`7IGrcVGqzJq~r&ESosjGlw`K?a!XdUx2otOe{$`g3y><=7) za&Hf2wP{VuLgW+mvX3We)V~uM;X5v4uoBV315f|NFrPqE*>;#@?799LaIP!xnGX(k z(he@pe&GnrCbwQz@1uVy_r4 z=2f&=6#(#BE{i`lh#v5V-fp1|dk8f?IH~Dv4VPnX{QQxJ_b@R3ct0y2w!HUEW1;7@ zQ?F1TP6u5Xdzl#J7ufH#M9!|vLX-`=EhPTaB19Q|K7e|EI!Ur9x>1n&qlInTpO$Xi zSQ}plFSKR8`mQT0ME@HS$#DE3?xgnEZ7;Ei23k#GPi$+P^k6qTH-pKj__}P1oY8Op zL>U^1lSwwGA5qe%s?AH?J9^8K;f!7_+b(gUk~1wOt>M4&BD3ZQIf7ZGhZ-<`5OrqN z-$>~W+dZSGxS?;0(PPG2Gle#KgpNlFZSp>uq@|kMAx~kWuO7&+Qh=QZA#0u!nFi18 zIK!+nt{eSqP*=wOVr#tm6CNgf2>KMS0#v`{dSlbGzCuO^Ayl3`=g5H zw5;wL2HWI}uWvT8$E=HOaFc$F=Dp49pkN?z9l9`62vDQ{T%Fl56Cs;;f!C;iRXopk zW`mmPn9FdiDnP_<5{HeI4^Z+G-9FOv5{1rjo7pvp;$egxQ;tA9PWtMcC>{$|EKa~a zJSTu%U&GbcM!RMQK3AzHXB@ELSr;w(!ec;okyqFkG|DO~f({!r4j93<)-Q#mH?_C5UAK&tB`3oJq)oEB=Z%k*=nnrAemrK> z_y^^jX#5uUwZ(dfJK>miOqJg#IClG}-b=o3jGhMxp>`}{NBoIv;DKz?VPM!YzZBS% zZl$h+cU$5g(T8>r!)f^=-KYeQ_z~7-(EORbf)jpvyoHLre8+8pTk~m+*=D1>Go;or zo#h*Ptm=r_P-=(fBXYSeRr3`ABO1z;l zx0%==_z9}(2`uMJ1{YGAA9;4nasFmxai5u%g6x~WqP&j#wqQjDOhft*Vu-MPh^=Tm zaoPuM;)_$#3hMRFrMzCJmTD$j-gMZHYS7+zrd_66k-p?s`cfO!jZorEL|T*+Dc6tM z16R1UGO@=>rk*wX_gM+@7wCBm33WN(-IvRR4t>tNX56kaNeT7e!6uQ;VpLa5*!-7W z&EpN{FF_yYoH_u!3Rmi;uB`JnL1~5U=-;8Ye7B2!Ccf}-&`L?g3bvKW;csoyYnw2=bJQv5VOE0L+K1vhv=8qmNUE@;eF zL8i=QMQ39vVPuSPrr+G;CmNJL0Zm09>DFU}C1yHzvD0kSPCWvkn|*cSmZHl2o0h*_MGAm{7%EQT*v}IJ=+l}X)Yq?Tw>YF zn3(U!+U7$^N3-EvN6XiK+`AcEV%U6;=x#AskBOFM*vQj?J8)&*7ucg=dzSgAdj`M7 zDui_ZkdfW~cdO;P+^d8hiK&rtXxp4-b>ns|;d-E4h2eK#nE;day_K_@>EEg{v3X~6 zq}l$V#}EYF)LjA?ZggVbDH%-UCTsE5g%csyoH2fJu)m-`LU!JCQrN%#rEger@iWx# z;R!4jr(<3^#!*PcSyQ~A2@>!}VP|0%?0%2SHIS?h`2Vu!9*qA$gR6)gCH|2(!ZPW7 zZP-bJWS2?ONZY?|#~^dr81S_by;`jCHLL;ej)=bTp)a$VI_^rbB_(!^^V;bzuJb7s zr0LRX!xf`2k&n)&irdyai!09{@IW=hAJ6B~ZIsE4a5C?YiVWZQY1V+kRC26mw&sMk zDs?xeUJX&|Aj$tA%i8)B&C~wKlcV1*4){*9@ms(JXuH-U$5~Lb+rZ?7p;n@xN@lvN zJI`;>nx|PuBhFvh0)OdJo3aohKtl7^X)ok4`N(Zg44(fZGKFT>Qv&;4a*<8Q?<@g_REa~gJCes6XF2smbNEVP zKjDL|i{8lEoZoCyRgcxpVu`FJ&AJIP#b*@xY`+=ZxPupYgyel{DA>lLxsRM5olhtm zDyd}XczP}wn4_Q(ZE^{^G7XM;GH&6RlxeF{dF?#RC&Z@~;($jWzv0*UR*V|eB{hZ|~3am)EXyl>>d%lI*q(^|N)kbmvQ zY7^GVyv?Uy(CGGC?;s>NpHo5DXTkU7PY}Em&q$=#@3Bck29+fyv4}%XwxPJJ3RHqy2iLXb0IE{5I9D$`yF* ztzEZNM{85lJeQYrQyKKVmi$+N_#POaj^>r@WjHEq-42)2{YCZO)CB#ewI(4b2L%uQ z>c92f6*|&}ibHG{QB&)L=2zBJZc)4{!ZuYO&UL$OCO;AaR)qr?1el|#K8rpvf1#m= zf18;s4<5e5cLo!^!p+bNu@r)T^&2A_yS7MDb^kSf{s+uT z+HCz+Eua=xWld3a%_(?TblK*RnH64*ul`veQkIrJnP4s7ka8K%_Vh~K9#zY zI|J)4#)Hc{G(R~1?8_(uEZPCBf?4bVtpYAH1M&nCmSzf%|Mp(e>#eA?qP|3^!E~3| zqDuUOP}J@jOV1F}B^_pkGdqp8c39d9|L+IKK_Qyu>||>^ANz3V2-D1aF0a1@HN_); zHPwp2QNq@X7Gk*_Rb1FUpIYlEZrVA!dFB@b5wlN(9~1-nH`v{1wO5d;Hrs zRH!F@&JB9{;M2P`$UOeqc%DMx&hi;IFBN#H0CZk{4j861 zg$-XE`Plagsk7@}CE%TF-@Sl%v~#@`q*>9e>`!Y*{nZW^YdWFyxF> z-nduJ82-fDx!9qR(|?ithy`P9m!_782hO)7>>&y$oA_9zzKFBykJV4fBye8V@-$9+ zX|zRm43`GYWPJ9K_I%fRn5J=IPzdtT-fMw9$vS-4H|74SoXvpVPuTf;NpO!j#L%pK zr@|st>9rp*a^+F&g({t0u6}BVa5s~m_f(ZELfd%m0)?&cPclF zpQ1zFV~Dv|nS2!F9rY;Zy?$o<&@_~vF47R^vEwakiR(1cU)d5>w_|8VM7dwmGpa=| zKI&Dooaa)(O|FMib)}s@SZXbNOvd3ycD(xD;{~Rm^$*L7ruU#GMFx_U&jgH;vLjbI zP+$4C#du{Rc#cs3NLM?!TVIE>8oNz_+v-~HS*&eZ*{PxSg%d&FYM0~>mX{gu94)h> zk+|Rxo5}4J3k|o&Af1np2m9D}ee#^oxD85-(~Em;p_MlV$!7N)YrEGH&=l#JA#)0( z^X%Jvyv!gS!))bQEDsc7w7xK~8v@P+3H6^Y!O&-tJZyrb%_8Oq&n5~(E_RgT-?((# zGcvGF6#}k_J*4J+%wB-sisH`_cX{(00`U+%?=CpYU?m|9r@#qG#cu_q-S_4>-Fxug zgBoJ;zEjlatnNh1-)8jq{1+!}vN|+Ht-B~%4IVu2i7Je#eniLdQ229{n=%2Z=IVUx zk5mkzGNB^(2)%w)pCA|`mWYJ)b#gr-0FDkv^B*S~2V> zSQ<34Z9W)Gr`>?MIrnn9jiI(Tvo2OOfVxojq~FMe*QRt$sYlxgrh}8=8my^0H^aou z`P0EwIn3abfq=y}gHDulf6#(FH?G1&icEJ|6aev={(zSnb9u$NgW2(Q2Kt$eC72Vs zJ$J9|seqnskqVlC?!AKka)#O~9Y3pB+^kgo>n97j;@9>SquSx`pOKewaH-`2vd?Um z1^&S&`nrxPb?yc#7u*<9%U-*aqCy6Rg?8n=U5mPloy+)(sKNE|mS}jW0^y{*b!l9r zksU)mbv+yA;=$8`YF|@neyc#Ly(W7&XrR-NFw1_U(P;3iqHxH7>+!n?Zy@&m!qUgB z<4VcY2Y*@xDu(Puo)X@AiOtSreSZ?dAT;v@7!|$kH@R;e$7Hubz;OTYP&fKDXAGs3 zBlX@D4jc9I<1PXdw(mbJ{m-*@WADTzX`p36gSk|Jz6VgFT49oT6wAA>*?rBAi&Fjs zrKh>AxH+^|J$rjax$fMhNGL4J;v#Q?Yn7UT(8lTlj2>uEJ?p>r*Ej92kM9=9s#h`j zp_!ScZ^CVLjb@m16n4mslxKS9kTy(Hb0N|Kc`^o=q5LYn&cwU#UXXkqt5MJGd}@S2 zGOItzc_ks@OZwboenvR2#ViUv8p5Pq>s#N>@~}U&8(A}J=Cx-gZE|MJ^Gil5a1Tx@ zZ77D~(VhT3k_qM`#*doIcdfBF`iDJI1}*oNL54x8EOIGvdr+?=FCTT)$z12+i%)vo zqh~Ly3&nGdDbz8Df4BM4HDKT!Y|`kc#uE?+J5IAOpZ`3DtZsG;x5ZNQ?q0%|6`&n1 z<)n;_-9+zr=fWP^3qoLvhu-kUU#3*fs|0haL+(5}0#uqpnf&*kft>ekllg6<3vM0pFpPMbEgIcr7j{1Z2o|X+P9Bf=L@m! z{#xpWYChBaELO=gdzn==iYd9M|9U1`Es|8?v`*|2g6gucIJiN2j#pjK`!kmo1s2OF z=gme7guLoiSQXcy3<+IYX z|MxMq<~=eSS|5;)170zDxF;T+0Edo;OA<)Tn#@>XLPLVFzfWF|rOLw;-F*h+-G`-3 zJSo4GR0J;u59VYJv~6fLliG#H%==7%>^6pIMzqF*cTwKzofj$$&d)r~MUx#*J(yFX zAD*}(7(>s=h7}oZURJhgg=n%u8thlCvU>;t){;s^JFUD9*n_CuI7sN;_m%zUM-GTH z=Aj?wXZV447ttDWsqc)mr2E-qzgqb1Oh5e3-84}rXfBD<1$!fY<5Vfrr7w2Z`Kbj> zS8q*Txu8uyE3t!XjZmh=?wg#F0bcIW~LFKQbYvIxg$OIJT0oO%7 zC5d$THx9ygMLWM+{OO&YUAK8UB7%DmyU%e6 zw3Q)>gF*J+oWCu0Cb4kGw1m{?4!NRmjrC;M$3;}jhG4K+`99#j)T^Ht?zLZ7YHo@? zcYuIxaMg~JpOy-G@=YMioP<9OW))RSH_V>z#*tn4ru2l9AmxmmUrIX}QXmrr& z;$glc>fzs1dx?R`?9gj=sw-EM`wyJ2OxW{F!23)(Xy;h%j9p_CRGlPM__ZXGFB<`L`Kovbfm=4iy10;7UKk=Ar3R?dfWHS?gib5AsY1``MhZ*X~-YG!R`)hW_%foJRo;0^(Xp4CMr19JV(yIswSRG2~ z$rnF#*PX3datsdhviFV0uW7%4R~LaB4@F^;T<~eF9y20sK+AcFY+oo7S~GZoE~oT~ zN->gvgzr4mo!|p)W0r7Pg5{xdN48S^Yp(SUH=UM+3vbGx!pplLi)1Gtvh1P(Ja-vr z_2cY$!J8sqPqzhb|7-4EZEW~Avcu}0*P2}cbZ+9HM%8T8|00ZT+C&7t!k zk3QpkZwR|FtyQtEy6|(@;yr%As(7&gFqCRf{a{nInd&$1DhPDC?l0(NJFDMOJe6x; zlS{f9O5Oa58M!w(5iEdxP`R#rs?CwNeSSenI0R}b{q-Vd_0fOe#l!y}ya*K{kAm>x zcBpab@v$@p9XULZ{6=3Gn(?M;+oLdN?QtLJ>LruKJe8Tt8~gnyZ?xoN>g4%#7=@a% z#(=I$AV~Tm-y=bA5#7@KTQ<*bOp<$$sM%Ta*sVJ-Q#2aL#rtK~u~`+$Z^@p}FFMfk zy4p1xt!w<1?Ng9jl%U$!^A|3hBQj z(QS_aM5de?2NgP>LuctJ`%w$4%C$XI+c@p4Wx`|YIG?HG$V%Ck1LDo)$=&S6Y$?OZ z4$5FUj$BA198dDB+}|NE_w49hHmA7B|FigfshB93ecTE)*f^Tv-ZgMcP%+lR>>cvT z9=J}tq3eqoiFf;~t15A{n$z)B)r&$d-y!kMU|hpQc=;RYVQRjwyZB!E4TIN&W=+F| zz0%#uyf24fD3v*;=h9wBLtA^F_SVOg@}J-zdD{h5a0U$+NOG5FW#Jzj+NIK z8&9e*=mJ4SOOXS9MM@Ok&cob;bm09}R_mPv$8CBctbIwyzr_qj!Q zTONs9k>sdX)n0m~nNT+aFkRMPui5mWR-Ra{u1R)7>PI0x8`EK2N1`RCJnY+bxojgK z8a=1-^);-yBQIsh6%cw@OcDCjh_8li8jIRkh9*>JVy-38a}(wa9suY?B$vfclsgY?vlj+h-)<+ zEP;dUnM>9?li4M^JKIj9VqE@0PP?_kSn^52TxWkZIbiLTz?)Lo{RZMRs-&?v+p(nP z{yF*c85{R9UDUm`bObf1i*2g136yCH2%$fr!Xt^2{UOeX)a&MZ7N(%@l4Az znE$Hu^m#1vcqs4Uviu`MDY1~dMF>XE`44rY(BAP6FIQZF1i#ED#3E!%7d%1>RQVSP znzS-49QcKzyf3MWRTwRdUs&t#(5NBWDQbUZOYx)`uS}Pi$aA+pKNa6-3;#@+tilhQ zd1Kglck3zFvQVeX3swfLH?J;m^}`;fS0OmBo^nxMIo-=I5|bMnz*BC%9yfGkA%RO)S?f|t9~P)?ETSkd1qKoR%nh0q_Ikd~H;K9-QT zH&`XBp*+Fn=6DrAlOf!!!<9ECt1$Z#j?_$7>kXBkMl$>q-;(>`_I?kFjy$A(sr2qO zHDs9gyQFED&y{&iXn9l~;^3*G>tA|LrShl0rQmKmHyYYsk_1N0`@r1TD>XF}`l(`*) z+PpbH_ZYjbtdVoqAQz!HT35T0qETVlLo$-(lO5HXq0de z&qaTU5^YOO_Y=7lE;U?eIXPW{v3Lr#(j%DUShVD9FQ_k6(FkQ|de682YZ%N_+kRs4 zY#ms3Q>M!7sRrI(=UDDV$!cJ=q(X&kobSxXh~ou8B5==yJUu6QR^GqiU5Pn`{lO^c z9-w>i#+>sh^?`7;hoW38uUs!3J1<0gpCKOGgivC&Tu=@>d&-=PRO!FnTs-zWzRK^- z#c-QGbBC*OT`bdP~|RT;v#~)jQl{0O5WvS{3pFyGOzkESUXMCu>~9np7;72USU} zor~z)@Iy1I>zXyoON0Uo;pvOF3&u;A8{vgFxU-ZNjG@CV5smhk#5b#n6E4P~QT4Rr zRh-+s%vK{w5~neJN}MQmZYY~s`xeB_Cg(|Ft|W?6mB(7m>!v) z>tojUDQTi~H<+SJU*0n$xSsYC0ovx?q1IbVn!R`5XVr>lvb+5?((Yp6Z`{L^@#2|@ z4~2%R;X1n$QJ?>&s3B)(k`wI0n0P|Y^#toBoRWaS;1Aud^6Af`3RHuCuXZ{|)Qli| z+%#g~Wp=<-H)wIOmmBizCIXD9h#Gj*dQcZz~(%4OJK8Yqw`-hi9Be%zQ2q-n7WJ zS$vNd7Ngm?M*Kej4p?_1Xncpzg{tN?Sa;DBc3gfBMwD!h)Cvlm`_l8&&t8xY_-5?M zL#T6Xs)3Nj&-iXP{O#MAzsQ|M?AQ?GN*1>SwVw+z*9o1AN@R6gpqn>mts|KkvGi?u zdDddsjZj}-n)EBTRKz_Hev>ZibX+Re1IG+WQt6wj-A{#vxq`q8)K#NeC%Ptd8>PpL zk)Gjr$M@ZRD7dM`g4J|`t4PnV$~l)Q@Z~-;;u4-7dsH4R3m?7@mr~#cG|vj%=P4n* z=y@VmVo$>1F<-fKTmzJ{`$K3)lkxYiu6fbLSE#mf-K4q#b()qOVmCAV+a$yJM*7yu z`;P(ERn(>^KKGm93Er7aHS~SgZ})j~Oy0g~c5?_K7ju+bbiVVZjO&+YJASJmnW(uu zNZQ##jVivt)4qF`@D+60xkiv98w@MQe23+~M4867^-wCj?q6oR50PFhNjy2cxLLKr z^xvE+MpN7}cNhffk~v@>gM9;^@23AZErYV)P5*gI0)k>!84INxF#5gGa6ZP0F7wl|Jz8a^jGm98T5zn?V z^ISFkdh4KVIsIGr$gGM{d#|ziLvD8t4a}KKTbe$yz3gFgu)Yp{yq{aZbpy^Pjm#>F z?a5-zwfa4lw&xx9UAs1F^BG=M`>kS#(0)0qsMZMkSp|3i|5^>3>cw3ixpAlPCd@n| z3Pxoc&~|5y4aOnsU;*Zk;6hF0F*vi% zFukAjPO1~PFCkYln35}w85Eh}Dk)Mkkc00C0~+6Fi8n#5qjh3%I+ZOSF*RN7q;~W) ztI(@ApKcfWMxAWSbztuEnkznu)t97Cp8OjiLMsv+^Bdx&OLiq`9$w$ol#B3dS6*9e z(sE6AlVDOhq14lUfNYA_y5SO4}Ysdo? zEQX&?5sJMnEzsgxk20cMY*`mHR2J`Nh5TZkR02syFvz%3a3ORzRreKG4AyO5LJ2hZ z3V8E`G4h}FO2LAvKfIFm?M$1o*=)9BF#LXgURv{-M!yT*dLc^VH=Fs&P^gKHdTL>s zOCeuQeLCOVnhfGrQ#QF+I{04jBYKIx~rW>Tc8udf|-0}Z)9%U{z-4?w2 zit3^&q8#9KAQh}xKf4i)v*x|^QuM=|H7Y+!o~xRe?$lIHPYqfSYGg=d@UQP<4Mi8# z2|4?O@BT(8+&ExWM|%YW!|c{Z#9?rE~)Rp`6)VN?EE*MO)Ph>>O$O@ zn5Xe$3BYOHWGw$TX*OJKmhg2bwUpHgz9%hMp*19LVQ&7T?9|G3oi10bdsFc-8Or!O z3_B_aiGJxVfyh7_7PXWQIC-L(ahsNxzE@&K7Rg`v?$1%f9jIGmzR&Kq6zK`eFqw4B zm$UKB(%cX5J%sYPCFuFRu_v%&W|_Sk4_=W6zx5_BjsnhC|H9%+GC4-M1T}a&m@woH zb$@sYoFRNal8j?$(y@B($GNIvi77X59$HwJjp|Hj^t&1b2Pbgxr>a$AT!caRknH{I zdlTHWK5Oi6shr*pV$j`?p9t_2O=_#q80ats%js$Jl{=EF4Bn?#|6yv%V(`%O>7wc07t ztF)>UjDVrvlRw>omoHaO_%67e`X|X@m{krx9`bheV`b2(8sRuMII>!gW!^JHYAMI` zVpsPbe;~YaO-`f)^~A#BFWwL_xtECdD%97i@*X`YftP*@HnC6(zuJ zoQq0*Wf{V~?h%4BpB9vH z<_+FU1;g)ZJga~{%vI$EW_&rH<%#jL{t0ux-CXk9zD^|1?(tZ00%}pQ$KmTs0iTwS zP$+xXsLVb#e;N?E&>=b+J8T4S6?qfFzzb&NitDY2fblHgA-b1DAR{hx#%nx+hf@2I z(KR>n?)a$ir_=63#oZYM0fG=|Db_=Q9nB^P2fHW{kh~{FKn-?H&5E(KuE}%Qmk{AD zegErH8H78!4c=pVZAr|Udu>fipid1ZoP6KphYG{3KmN_*hv_fv^ud}FH~LylM~{-^ zeffTIq+XHEgMY= zBK(jOc05$x7{RI+b=oZr`+RovH^iDU?o*|F4{(&mYQ`GYDv1b5?7E>unU$SeM_sQi zYyO?=a?E4ifOs769e+y`&Q~ZMGFEaF;*~wOhe>-;jKH4Q6X0AuEq9Om^F$O>0E>D( z(^K+w$gIjzOL%EPo^)m7knXZP)9u94LoZ^Y()rmEl4Irsx9pVkpzJo1KC(cHice&s zHfK4KNqHi}Yi;XZ3H*FCBXq}Vciz&Yq7;t4f4Bww6H=vlILW2&KZ{gC;Rkgid_xov zKO(E8eX&QBG^=`T5m$xjyywTmk0pc@UuYkdu7+4Q z(>nKm4}9-(WE~udD4Sjp-i%n8y+NzGCd%qivwB&?QjKi; zOIhiQo;jYg1Y%Q}if&MIkide*CV2yvEhE=;JI3r|nu<%aCydHD^4{JH^|S3FQ0=*B ze1;O8ydWnVu-CzT2+=;w5?IJV3mC+H5hfwdU|T{B#47&}Y3~))X3 z%5u?EdI_;1DkUmQ>4YLpIv7ewQBe>n5epq6pdiwFPozc+y(IJ&AV3H;ArMITZ=d)7 zcHXV;d)#3R28;~G&AjKl=6PM`d5q%R@>|RMAt63s5Av(@&Ah^lT7>AwCAzG}Tt&$U ze$uO@Em^4Cj73LH^mW z(jts&EAI5ahmlwJN>~NRkVpD8D@N<*uN|0*I^cKoXL0i38}5-60kvcF<%xB}e1TbU zV548n8$9N;8ss<@Lx)Sg;1u^Yh%Q_=s2 zaIqK2Q$GdgGlS2__e2iajvJ1uy2AapGrU7L@ymy%J29g}tcCgnqrPRcLw2Wy59gVu zb=x*N4(N7VPAlN8_@wk?2oBN{Q2gdyA9FE}RGCp*DDQVu5biV*sTWSIkRC!!>#7%n zx6f6OL)FdHO-g6gPj6L`ni8C6@m->HhSUaF^ii>f6fN{T(Fq{ zi_aof&@mJWxeVc0Oyy zDA)XPV8C5{yFFWx)`gxziyKE#ers!;3bdgItGb8+=@8`s3Pr!jOn5?FDt9traG*=| z4@^Zx@-K8>;20q#(Iu6nkOg|Y+gPz=w|ulO`&kBWS(=eGVNhc}7|6!8{6M}c4b z)xO0!GTIuMqJ88<)l$ADrShmix2YMUVY-}x!QsKvWLK)J@gb?mch+?cD~rWdovhj0 z1J6P%YhSFJcg@QRk!zwwy9RDOp5RG7&hU4&0(Iz$e=l}CUMhu9{Fb{`ZxU%OynN%E zf5$^b>Vop{KT!vG-1obl?yRzeWMX06mU-dXspL?L+SL;KtNW^(0!;}`if+9&>UZ{c z*UbyN3)n);3tbqVp1hURIapX&fA9~5X>%S$T8`e!b5tc#DA{YUwuctdzB_unkbi2R zqvnP^0;vvs^25OLORbS(^)bh#|7mc|e8YSfBo}0R&B(=h2YDA<;%uWnxRaiUx21f& za3;Zsu+}i^GyF3uYK!-0d+o@{y1Mp~KZ%*)oCX%Yu*t>EO@kN%KDqaqhfC_apA50| zEnl(jDvd0^f?J7swh%e7z~UE{OOXxqs%u%^c?DPPaCCfp58YBCMRujBGegdKmc_11 zxNcO=W3+Q67~JW5rUJt;_Trett58{4hp#b+u~OkHh2hbY>FK1VwW-imwq=9p4sv+ZX;aVKpuDx# z?I^Us<)#>^fqy|bSs*V|*<;l(Xik*#J`KymvwN^~{;W9j3o2~LGRvaGh@U_HNIjG1 z;@P-ubG52n1&zV$4GxlLbd~M68!cG*;jM?iR_-4Aa*l0bl3!RTSGV==s&(Us^Jv)) z4>_L#G~(287DpG+?XBau^04dWio2FxuCg=euHK)7N}-O<@G>~O%{^&vFA_yo1WW8c zX3m9}tzAqmHh*fCRAk-i%Z_F`-&J_qX;_-@%A4K(kXqB>GZ7lmz7~mcv=Go}K2va( zXy4fv=&q5KD-;Stl&3v}dPvTeK1kIpGTi^+oPqRoGM}Lj-IZ#8Wje5S8+yQXDKG8z z32~3&io$SMN51>mGk+Q5eVntASswVe5j=atbYEMH{!Y*!07Y$rBO+YS-tM&2!*>s+ zQKmervOAfqPx~!|(NEn$u_KvD+S4Ir`&BRPL?(_Dyg)w2I9_UG*$9}$v3kf;NeUMY z79LB}Jo7c$G~$>(b+~;LZ{L24U!9;|Ta%8-9cB+i>`UQ(FwtxQEBwiSXdb5IIw|D| z+FBF>nf3_`9r3(5*w?=MP-+4q?(E1EPF^wMNMx^&Xc5fRi7!)p4wmeqYj0Rz{=f^R zcj@;Iq<$f$BLekY^GJ`*0?8{96}53IK-J*32)!upE;)i4W*(K_F24AGvH)_oF4?Vu zw|O^W$CGt!T<4{cBtgrk2VENWM{H)Z9|W)Q)DxLcPABB)bd0jb93XsA&U9$$c1&bUu@z>GX>g|Cg&m4q}lAH(-l*N8duS%UD^#$C+#|-mEJoU zQ&v^vvKzT?dCPn#S?q`vq#YBHp(FelyO8h~N0E7pP?X=+7)P_Oc5K2$vqm1pNhm9y z=Q)BWk!i|A$Ewlo>iGS*cV|a5$^`hAqX{MrwxAbMhmiMRjYwh?gQom_X}rr~YruWF`nu#;tA(ZM6WumEDjFQKTpdkPs$ ziLq#26^-OF&%<1Dnvawo#bbD`zO9$iTiC~0mtZx#7Ycc$H=LnD0Bli_^v1ZV`xfRJ zdZ!_38CxR1=mEtZb~aGw??%}`T9h_v>E%E1W&}zEto+k$$&S=U&0D{BF#(Mek^Iwn zgni|(;?8E9CoQaq_!1Owh!@Kw9;IF_PN|#075%)$nK;t-#wi| z*(Sg17D7$QD>z@lY2`1A%HaE2%gi8TMYjiepSPQC>R5tM99zIVhD5Ex1e@!gm3F6# zaYXVd3}Me4LWye4PK}@79ybmpaWn9Lj)an!r>1w0Ni)4ScC=5@r5~G*(JdsnM`Hd+|4KyJ(Dy}%3G(ZSMFIDzf=ipO{k~Pjr$neAM+>Dd zHaW6Tv??*|{)E4+z_4BBr=Xq^sf$M3QB;{7$(Gr?F{^D3DgG)&?46(6%*^MfH==VtOq%Mm0|waLM8P>@nLD$V$fkokT(?e4pSpM<}IkD_j`l)hw<)r z%1;W=mg?5TZ^fM>YQCQw?&)lDXkHkWrF~8%$A%;-kSIH~U^3>h#|9Se}$O54VlBGrfJI3trO#!FE zva*P|%7zj@z1pVXHh$3Lys-y(KqvK%NV2Cj<393+f@S z$!fiSR6SI(S50}hEE)y8;Ky(K2U7)>5yO=!WXg@V2mZNKVMM*TW(wQ8{)n@^Q}!Iry3TIoHU1rg>G104JA^|NG&OH2G_0ixJyL zU*BGuQjaoR;v7Bt{cjoJ?gEmd#W!ighjVpl!#`t2dq^XLE!yWao;^IGNL$k~qV9tg zT3r0TBJVE{WWnP}-iP}#aez?st%Lsj15ho3p=UVd+KWL;HxN!;79jQedSxDV(i{t$ zS(x^bxlM9A{FmK{)t2J{k0G5Z9Z8A{oY0bQ56z&E-F^0Ytvg4MD3=aD!zhrU_M)PA z*14F%Ve|VmL-58EA-PD&$S(M|=fEI+1YbMrlU8hVlO|o=FCOk!xb=@BDiVbXJY(MI z-^Jd!a^#xo;)18lFt7EQ(fa4hEPFEnT9Va2`}-`RQ6({{o=PA7A8ud&Yx?ws4X?y4 z{1**K7HlFda#nTjiV42>4Rhgeq$sqshrJl}hT8tdX6fy5FOF{mHArPverg2!uxs80 z4h_?MmCb|&@PQT1>8cZ&SdU<%*ptGsv1%GG-3XvB5$;li?hEL0rI})IfqhXa+~ddI zMmN6tB3=`?$Rs2M%wa($z zcNfOVB}|{urSB`@+>+>?PddyJI9py_B>5iJKr)W(RSMT!?#nsjd&+k4)j!fiUv{lk z-uOxS0Z&|MMJsa9IvJHvQDAP>D!LqyC+FT)2H+4+xsywb)z!r})SfbgOTR3S4jq3y zB<&>?`AqnKJ=FjEZ(pSHeiWP!z6u8wi$uTG1ZfUS5P91ZYqm~3*7yR=({Fvy0DPVq)98nRQ7W^=gvJ@ z1!za-++aw|IOe$~j~FpFGvYJU_F88)M(@$9T6cle6^fx;72#O+*n+;-lM+4|-~r~! z@x0|)UuMU)F9Y==CNDg}tw)5e?P+Ibwb|J88IYM8wSYI`!QLpwW=r(`%INgr#G~jd zx@!^{4v1)7xaods45a9^TUQN=#drZ(7d4f2UmfS&WP#^Do!4^d^}7Ien@8G9nr8%%Oyk z30O#2)pkiw^uJhd@KO4rS$E{q*22tzQYWKNc*Ka)YB&)tixZtc+*hczR z_1we7uV1-~E?$we#Wj`&853vuFHq<3h|uD7;nBI32DMtt`(Ju&{(INarao}; zVzLZJdupQiI^wH-@eWSi_I4sC0z_Z?O6+9}h^=bWp~@J0_~R|7FzqsW0>m(vW0{&JC%@C?5=&jv?ODr9WQ=PSO)`Ju@9Q2tUo$BW-AC2H;?|2FH!4&C_` zW(Dy!oTtcN3v&&jix1bfuC{3VU3s5%eAoh{b)VrfIUj%PYfQV%>xVurf$pv=w9q9# zel~D6fQoewEMVAF)Y3J?uI?P^*dbZ;m7#sh$%HLGEAe|M3{4*CmWY3tjH0 zd@-(^&*FNjF9M{mo<;YpW%iAS=1?B=J9A+5cVlxEqjX$`5d!+BIGv9h^o+>w18^8Z ze1pxP5e73zb4IF&!_CQXP;78sIIL%r>2XGP7tsN*Viu(pX?M0WQKaHhC#gSZJP*eH zNT(Ix*U-h)r;Q^wj&v13OUgcw!n%CrI(<^O7m0(COIfNt)kD1F|8^l+#N?NW|g{hRrCQh5Sz$o1I$#EMnLq9t__aP2a9x8}K{$-LiT~zf7Zdq=QFsNT)xm;}AXj!>*uZ%$1r8EdVahmOXcw;-2H5(}#wwEgGWy{?|Q@ZaaL z-33;AA%CQAMo8IahW;7F`l^#J+?`!Gu|f~}EU1?_MY;`Rp&oCz3dYN4Yj;SoLe;)! zljVayvg~#Q7ilHpc~?-n!QB2F)7X(^*A(h&>dtb#G9&||-C8rqQ?qj9(W28!hBuzF zxsV<%<;Od*-5Hn#UHVe%}P87$>=c=~i7uf#jqdys@0`)U5Q~}Po^dOY>|g5=BD6OX7#QK8 zJdDA7^g_yZ?E6UTId{Y*0LE1F{Qy?^fPdW<@g=oymbfWt0V&Q4|5d@4eXHtJ$H z1C`d0m_JdSIuC7TNWYhhQ?_!B3^Rb2k)B6nIa$xQGVbcYE{POCwp$!EKI%#b>~!8MCF%@ddxj15Vp?kKX(2aJ33YEtz&kIcO#;2 z@Zg2P;}=U$bWP!+)hMGv0ZRlBd}*FBP>33Mx^Kh{4mkVeQo=Az`&IUBuRtYJL?;I4+J-HFAY&<;YSooWx0$BQKS=njur%6hdVqT`>khxCZ zUvJ=BdLI6{_SG*yxcg;iKG?{)J`-A8eRnlYVEbi)U>cC2Qh3ww z6V8kMhjx@-DO#eT`#Nb#dj{`;Y2JMf`jybRa0TXN2W^KG}zmFZOo!{6+L z-Hx0W(^v?%0lx?`Cw-YkrNxOiHayxrb9IXou|Z>&$+d$4Tt*)d&|Bv{SgY$A=2T4{mTG$8YGEA#cr>U~+e4r2vUhdlz2gtB}1=+kUnY8vFem8WIEMqgx z4|O8dM_a#i#LEY~4H$GS=dWqvnSu?TBS(U+K+s+UIFQ-hm4Jfka%SYfZTSAn#=ld3 z7(nEXaY#r=pK-v;-QS5$ZdB%s)TLaKim{n3%*idyfWq*`a_Nj;xrIj3$gQ4dt}ES) zoMb&U(C*JB9D!arp;ylxruF3(&g#kJI9ROZq`qKmr;$9)II{LrM=STOt~D-!5@tip zE0Mz`!cxw_{S}X0f9ZgDEI?H}J8ql`RFW3qF0B4~=lV1YWIgI{w<}jFF~T6EWasf0 zDG;5$LJIB9{FS;tJ!@{pnhz*4M zi$f2J;<42-#aum!#cN)K%jU-vwB94cps%Xcu(Usbc>$$jK$+G#dYlk{EO$vy?3{m6 zg#hM$^2YDWQahdCTv75KHF)NomTa)saXEEE_mDswe=?c_Bkw#N^;z7_(SQtSU-_x( zm1wta+V+6oue;S$;q4vl+WDZjd~p;JHv$hjrBSuOR~L!H9{p9@;XA7K!{B8Z5V(qK zl~p|XVeAnzLdF!RfuC!@fjE-0A&gjV756S< zJB&WscBF+r#;)h}iE(rWwf!kR`#1RDc;d3IuS>8kvdEKT zS*~^c=GgvPQiJaq_pU9B5Nr$Wb!Dlvn4~V?{egZVtdcUexh~JI`dV6Dgm7|s`KI*r zF1o4*KvKyL((}?%T)Z&)UU|jtWmhZ-3*k=BVr~c*M3Wr+aD_au=3xhwc$e~q1SwBf z;ztz@PRK2m_*=wUX;S#$cb3yREXFbgJAgXE;FrDKdoR~*5QTE8ndzj;grT1iLkZBB ze{xM(?NsN%JMn)Y^@Ki`6pePRoqf>b`%>pf&!B7eVgD3V1&Cc@?#7yX>tyXERPBjs zDZrYi5Ix);3A!bZd0f@7F7EHr+{#`m+g`pGAp&fMt`MxYp&Go^3{A%B(g(D0Uxqvj+eOn0Tk6i2k3ii)rb$KeR*dMjmqQHIOJsz^jgJ425K6 z5@JleaobrM3`c`H6uwsOUkC!q&F z&xzCf(W_0G3_WJQX#tK1!QaKF=m^qjOGSS;c1L5FAmwVVCT57f~m{U+y>BT-pxuGl3{RmeF-XM+6W z=9Eg^3|h}i55$0Tj1eI(GC;=o*<;HS-al_)6<YxFWrl}C(VXC)m)mVjo0*IlJlQ{5|8LJVNMAh zHwBVECi_IXI9AD}cmdf?3qV@C^BXJGI!be(sy})qWMX435c@gqVom-|bA(`DLnu#v z!!Bi^pmt?l!uXp;)C7!d)AyTEVm$m+iu4I_MYlHs0iJZolsrGB@UxGm**z_{MI+bHIupEZy)w0Q(x$FtP71_Y0exx4N8?HfOs z)c1f4eK5zNH(kE$q7m^`n%P`Xg_+~2)C{&gKkTDG0UrkI zI`ac^#33UBv8ol5az<#%HqG!e_HEK-lUk>{DcA+&2bVs=e1L1B^!u+7QMTbN8Ns;z z!}xyT1B8i4hQ-9ZY2_c#otMIYT&Kw}k4%o=hFlgCzB0~<@L6$V_=XHW@hm57k~BI* z+gW-JL}}edXz^feYM}I#$b=nab(iXH!%e(iw`O-zn-I-3nx#C zCM#M&EvTp7Zbhr#IJqF)cna@&CBfIt9OB{s!^9Myu6jSyUL?Dd(!34?xslC2%dmm% zg4ODG-cj-!_X1kFt-lJ4PBgY z+D8l$y|*(F!rva6BGQDd%nO#PZe_h#TEoRD`n7yd5ReXxBB%{Z!~`#n_pozaNhSG8xRn@>dHMX8r4|kiAKT9{@T? zSA|Ze8~=WvTz#6mc;jxuis!1ZB!9bcKf4q? RD%XAhjx$i;@$~-UZeVrI*ysUoS zDo@!;CtdGM9J=Qm%{({zDDg(cKwnqw$?w@kPb=pGvu5=VJ)PeqqF(IyZ8*l4<;f9} zSA&)g`y~|?vWtn6rBX`+M>oD51|M?1n4Asa*OL8%c&^&hgOTG8-HmQ()M@d!mZtm8 zx#*m?l=SThb72iji+&*WOCaA9g*xVczHt6EK36iD`9=SJ$X8oHA7h%DZ#~lJ>lqJR zsUP1r?zIMhaE!ZB5lScSju%Toz3+~oAWIJxi>RyNu@51So*!W$ZQ=$6o>l0(=CS&+ z>D$8it(I3|tc0fJKE@JSkCy#2^M#b$z#bKCcZDmwA@xLq<$07@CY(e8<5r6WWR7?i zKEo!0y$BBY_o~=JSt^ zl4?)VBUtSrcwlepHrT3fsEf4^6g}0tFNFhqjle} zqcwQLmCwm_@7vqOrYXao4~0u3H90`YW-@O5Q(;hlw8offYA{t2?KN?5e5^2S_feiA z%q9u7O@x~4?RM=gbu3}o{n@*(g6qC*DnELT-Meu7P6^l?)hafrAV-U_jw32t}lOFfnKEL3q=s-P!4l&iA zaDC4l!jwgYfMil?Z~4O?m_IW`n;$dcIBI5(wF=)~HD{hm3n)+P1{cZ^;s1cdA4?eC)ol)1Jy zqjO2`w-Jt~l3#MJAU=A;T41t05HaDNaT?{;m=Dx&XIRQN&QhsdtlLc+J@<|Bm^Xzu zcmD^ctPrp45Iqi^SqjP~`zIK3=Qd)Vbvx`eU82;D!)cy0aQP9^W>>?(an%?R)la4x z9wENEui5=P(um8cpb!$-?gx3RB0ekL7T)GqMDEEnn z-X&l=4<8xAlEbBx3@1A_S4z`aD0@;i6(bzd2Gm3lJVD2uHsz-}0o~fVVJ1*<-53ol z2i@c7Q|A_=@wyG=g@Cl1Bl|V@QDL12`oUj??rVi2`;?T93{k|r>mIb`B>OJ!ysT%-LR!gXQf=vq^XV;DNjK zk)%ve_DY1@QYxu5>@Vp;+*k4+$gVr*i-dW0r~kE6y;3lwX)RKn`L$~3LR>H;6S972 zwG7o*C!Oe_u`?m3=bI)TFF5Q^X_#1v*f5HGyIfrfUO>iwpt^$^oWo=j2iDj#Wjq|_ zAs@ z?sY|56$Sy8mGW3h#S^qL!@KzA*3FW>LVpre|eu5Nlfk7JVHokkiH zh>ic;+)8BQjj3SWmEfWib>|8cDC-NO+x}Nvw0s>n0HPOjq2Y4cE>v-{ZKA*B`J%yP z4*`#shsqOBUgG(F{8I~oh~AaF3x??u%e&eg zQ>~=bwPz6r0?)LsCS5p|i#jTf-ZNc=Qku8#e`L{L?i{FT@%sZ&PUl7Fcus^k`)^?d zF+F5Zhmt~*m;j+8%~>z(3hpTqme}QiYmJ|Y!ce8IJn77U#s@I%G%JpYw{d*Y6-(RxyZUnW=qRnD#`l{u8jVSa^r<@j1$0?3bYy^oR}~a&7G1BH$);o zn~n2N&1_WNkhpuzIyE^<)*z-ICJ#%|^v!7A1sWe|wjoS47Vwn&8ARxAFSbV_MsTs` zub3l&*5e5nI32%*1$FFp$2fafrwjT{;rAMLehcT+g={cqfzbpoa-${y65n{$N+iiE z)(o*CluGd*pGW$C zylR<-n5dV74vqfGK>VyXHWEBD{MUPr%$O(i8pY9k9yMlB!T33?z`=olm(HE< zm+^U9NUq+tFsj#W+&ZTtIU* zble2KB8ou!M*~F|80Nnd8N#%P`nTMpxy+B*c?9FD?&Cyrh&bK;`4ck0lmbcW1hglA z12|!OYDY$NUi-8oBo2T`bR40+O%sYE2?9llI_3^)xD3S z8yC7DuZ-`dwrdyY#RQ((U5!6hB(}l@(v(vQY8L;&-ZWW-jXf4vdJ)R=3+i)ick!&> zTdzfBbzz~gf_+mKJXAA}Az}Vr^U};{cm<9$R~~=Ef!J@hD1unb#$By{Xs{R3yS4mp z_yrgk=$Kar>nD~P7NDXhzMFO$4yR1Ftt~p!2;z=71+lyXNk{1=C zqV>{qq(I7@w7mOJct9VSH))~c%LU|!vLn>KdalPKC!)(x)luT{)K#Mg(Sp~X2v^*P z=I}J2WPVDi_kVbyHhRn;_aCuFAk_S^_xte?9bF{jl!=z~1f+79_4YPPd-==Xy5T(u z(WuAZuOqDpv4_S~HL|s-5LU}EdPu8N+m*uUm%tq@&XL~9h!M68YDlII4R+1|?H%hO ztfPwi_Gc!RyMRS3{=T*_05DR6+V=B~N??XJ3fczn?h!vBOklj;exoPPR_TnhSv(P; zI)g1SWm*XPO9PG6n(4Rl2!8H49&(Sv0e4Uu95n1T2le+{MFE(dUzVzi=s6YankgfF zd$igg_cEjr*n7&`ui8VcJg_{rPeo(GCBmiZ1oE72>d7t$K!vjdE89BD?FNLf51VSP zP7sk+A(!-e9X2wV+L>t|=O)&dvYWp1OSr3>X=Is|8KdnbUtU-DgP};}=3O<{K3nzG ztK(MJODocqjzL9Z-1=-#kk*(7P%8mqd2pff;?z~4%j`?{{(xq*sXzHydfvUVLmmFK z=jR)tJI!%mMr5?LYY8)@C_#Kzq&OnMqEbdd{no|vBX+WNLpthR>?GBWpq!RgpW&*V zZYMoh;ZT%0Sz0t{yI-I*{e%(BjQwDuF6Ige(pjN~x)EZcx4XJ$o<|)ISxNm}OB-Rp z+$#MHufhsL3tC>2D;qVR9**F@U3_e>cJVu<4^Ru}FI+<(m537@g(6 zM^cb1kKj38x@#-gZzxv8dvP16>8%_*Wzn0g`v%!OQbBgw@TG4wJLH>SK>RQ~v$-bb zkurQa7yzA_RE{G2+wCv1swkT}>(GO5SRHEK_(zbB!07?T4#at8-Q46#A@i2Sv$r=| z`Zdu{X~id($8M)LOc2t=*WA{uxq}DLCY(XVU8l(199ILPYhD?jwz~Ne{fZQs)~ZR( zjZSF^Bu}dke@nk}-Q!Dfh_0D9v;CQrz&>?AgvS;3#HzmX5tzK)3LqAwg+$)q6VNZs8@XKskcv;rD zzOb*-0o5^gVnW*cFtKN>^c4pv?#Uy+9xi&HyNUMDN*CQx_TFvD_O6(7S2ddO;qd=Q z8F*x7tHu#<|BeUJ%Xgc%faNhbeLtRaDJdb?&12np1HjPX*O;#V-~m}a|I}XOI3n_s zCcVD)@nR6CoNPEq)nipJlm??n}n7l@SyIO zx7ndQC)jNpXjUMa%D*hCjc(C;ku{?X)cbv&0atZ5Z}n}<3V^5g?(Mtb^Skj^x45#e z&<-Jhc8OlyBJ#R6f&-QYU*V6h{-jE+Ed_Z4@{NM~c*Tc3C>m5{3#c=F08->IIq0{< z50pv_##TITMyp7~W7ra8AEKg&+U9YAxG5tT4_wRBA;?A3zSO{Rt>5+OEBu>D_9++i z=MKg9KQMPkkzO5eO|Jl%BV={)2l9dQtMZDRvsTY`bQgu=6NiEzZKjxz4fy%$lJ( zCSO^m67(;4^KYWU#p!!0`3dn&y`vK1ooa zQ;3YC$H5V630ByM1bU-GBb!E7mH?{E#y!<3?iRpl_JwcH#?wWs<0g1$T6o=3AuSwz3sKKT+J)mo* zPZZ@Nt{d4RxX=Cj`svZVgN~6Hpx5k>lpj}PDlD>H?$CyxcM4imq_nJ@l^DzbFP63d z9i9ctbztD|FEPAYkq6+wKYknMtcfbMz7Mg;p#4&>&gn z%!X46YEb01*Q=hZb!@UtAkr<3^(nCz@?n$uro5KAm>;69SJ@r5_gK--QI8D&`?it; zzp}tpLhF@wa5QF)<|m`;_<4bXQ8xMA`IS?BjuD>gG3NrLWwbV$t9vz0d)PdNFn7g& zb7^QHLM|<#TXWp@=k{+xBYZB=<*LNXlf}-C$M~lKGDp(_@CsjA7}Uk246Xo_wp5hs z74TMrz^K6_0EW~Ct^PP@t1?{!HU??h@0sD*1B~Q}U1#=B6BB3+05iVK0cbLTw$e6l zMEYZBjRfH=>AiV^Aa{D-rfXrmEut-XKr5gpfg(mh0hDS;7nfRE>f67YDb02L-L#BE zh0IUe22H(QhzEqyr7uA#5|}WUYRSz{WUSCc3kDcMTKF1oyXf~o+$7E5L;cRII+tN+9v0y)65T)%RiW)h`>Cey?6 z=DkNN>Jkn19DV8O8;S!DYxrvm^ZwSE*_}I{!U3jd+6W6S;GLmYray%bt1Z~<%~K0H zR>M>c&tl{w^Y+%88V>Sg%g5MWk<{{g!k!Ej$nuv?aku?xz16$3J*TmkjXk!PP2E%F zZ0>RL>%0C(5dVGbr7uVrPr8oA_~$;5Rwn7A$EIhzQxecEXU&X&f-`MzEo;J;cg;72 zdt!4nwh5KA3+P!XEjoZg(U}T1dxl{fNXt#$lw-iqFJ4&orfK>*z=2|FbO(UWpY`w< z>&Z0Wfb2j?lkrNIIm3HQH7pyT0RLyego{(cFRd@k7iaeIw6YKGkPlAtv~}`S3g1rc z7D6Ff!%s*hDdDHrffk?Ah8lH=18wHxde;<9Of`jrMl3<4`CA9e94s(qm;0Lv-I7!3 z+Y{QC5w7yERn9B5{r}VJjo!pR;Hofw??Zz-QTN{VW_0!Xg2f0$N;QhA{6tu%`m>V7g{XNm*FLlL}P)5607Y-*r?4u zZ15I88S0%Kg}tXnDjfa#`a=ZZ^>=~YI{fafd)Y?p#RC|=8uB7g$Dt_2&_MQ9F9B$> z<234Z>dpR*0k*8nR^~>W%dO;(Knu+aO`}(8&c6B9Zt{vL^Jz;WoL_gK;EG~J061lm&p)A|{^F-j6eP~-o zWO?{*_vKgUmVMC-k2){$tz`0i%|b|CK4_9TbaOGw2{a&ZWl-RMs)40}c_zpi<>f%J z0V$|N5Jqxgc>^lP#3&4NCo!*H9T46;JhW@BZ+HZ*1D9SL$;|tG?TpwU$dQp!^df$u+r(vm~d%PVPQvV2`r8^h1{(jjap1 zAENbGlT;J1xkZ^u^2lu1CO`9IbDr|2FSahP6B4EQETBDIvx${a!swvukudY3@S&$D z@oEnr>Iz}vVjRUYEIR*ERNPBA)@jZ|F?p)mac@TtCvmbFdirN{s0G#P{nvG(^WT+= zzel9wTqN5s{6Thv&gns#*nQ6j44o5lCr4a$q#n#CN3Efh1C0Fo5i5;jPgH~q>GuTV zh?;=CrTm3TX!mRPy_+l)!+#Ta5W~k=v$*cGAb_Gqn`%vHEO*dq4+d0()@K6_MKL=Q zH?FOkL)IK=uDVX4s^bE!Nc*>ur#k<2@1wuIP(|`+7qdFl@BKN9@L_^JhvxlUTnZPn z*x*``O1(@wYk0L_Y23HbHFc`crekC3u%d!>QB~Nd2wX2E)Oi#0keWTu~TFs@o~LoKFaTn=`;tjU8Q)t%`R>*1V9C_e_w^bwda17r&U1Rf| z8rZe#r5!Zi&DgZ^wz%9lU3jiLfVU3UF4|CKaMb9mSknS|D(HrnwF(iAAbEvydsy&y z|4=gQYsg*Nu8G5d%lAur7VcnQj%jw5OImQ48^Y_cL8o6z1GOtv*}W?bB+k@e6IwTC z;pR%TFW%}!ezh63q}ct42cfB{KhyXU4Jahf9_U z8gq`?M|z;eOFT~dYx@cP>CP9f2r5}RZygH2j(8TzSz5Tu?kR~Q4ve`QR!LG93e8EB zsm%j%;>|-MIFIT9XiGu=127-owGTe6^v4ihmJ|Aub`>w}5~>hgJT*p(tU_wk`D5{M zv&yfcNzETwkI-Ffm3`_v=!!GA&yVdg-+-^(9CQF}DJT|LbQE=#NVWFtJqge^uapgZ zdT7|$4C+6|Xyj8ylz5ik`)|D_lY5niHWwq>+nyWT%8nKs_0{%K)m9pDt+{oiOgn&_ z2kt$0viU<3Pc6z}?VcmGYU(puwv-I)6#u3gI+%JWBIeq8R-rwQOGhD4}V^*Fya;$GR zgu#CUka$#B7-~oOL=C*|#CIZS@`QOVR!~)kEEsaxGbjK%;CS$7BBfx0BLXeRe&ugb zP6^8iw1pg6KNQHdP47~5k7Iu93Oy(;K0>dI?U1D&4~@=`Rw?g_hd&(pE}i@9*~PX; zX9=1noPY1&ODkNz?h~-WRyaMnZYDseJep=Kcr!=#RWzP;Y3rI?w@@J0I!J>)wI(Qm zmwX3X4*w{TJ=rh!2fh293q>00y0=4RhhO(RuSp)O%W=9PsB(4LwOFG-pQxH*a6hY1 z=(>mo$JtOa6S_$BnNy9F?^W{np054vPDX@!X8TRY~Z1W~Zk|N15lP$gWcDw>|;} zAAwKYBkY4JOzb43Y`023;cF1DWEX(Kl5Sot;*1$YJyhN8&Nt0i2vO7uVdweS_j zw0=5n2sJyhVlFTtnD0#*|At50&-q9pHeRYCd)xMZ5Yj4%v4jjr!+N^b7n1CtCg_%| zcPVO3+OCl((rc00UqMw<8te_0lNshP3?=&xZ%gd5%KG#N7EjK}BEk7nUX{A+M7gre z7GVmJWVWSO-Hzo55i^2&b?(KEICpcZ>}b67K|Z3Z%4n-Yoe~Qfl==LuPA-9RPWa(p z8o-S1x9Gz8aa&A&`4{6o7pTE0&hR-Q^@iEG2D82Jf;n9V9JM z579n%JTHge(_W;;0reu!OuO(bP|Gf6p=Okbi5iBh7iXQ@{hJ_TnW^>IhtTtvU{6fg z3&T_+&R`Sw3~-Rp#TnZ;Hk{24lLXopwCSB(=4%J%T=hFbSoYlnl*eNAj2s2GS& z*hdhYN1xgxRDugU|9{tQ%9?~c@-M%j8m9@3r~2Fe;|^`QPn_yS2LrCx4ko%Pku$zic>N!|izp z7VKW}P`YtMI@??6{bMp~o^$lg#^+)Qt)!!DeOJJBdvWOJ$>eV3sVtpukHzJCR~Y9s z9^Wpw@IRj0e^uCNe3gK~JnX>t$xZ`D#y4~_#`BlHrhJ@S%7%WAG_#8{_yXIIg!2A) z1h5@$_9Zcc8q`gs>BRB^DIRxUqf%|Z&;Riq0^xD%R}@)amTf%y`)CHspU74a&90TO z75k2oG>ff!lDnY0hk^0$e}1ug$!3RlRBhzHY#?=UQ9&VtU*9uo%*G7`g?{;4@M0eD z@%fD?(5y}l{(q%?dpy(s|90n6NjgwYt0aBOAqf$dPAamH<1mMi!<^^5tx^=RPAtd8 zLJTA4<4BC0Pji^F9A`#$vf140`@MgM`@j49`RuR#vB!hQ`~7-757+Z~T^CQg$aCbs zShpVPa{pw0SGR9Dq|q(ld?@yhigKf`)@ssN4OY!Q!!1$zL!m%R;o#!U2#DJ?bem#5 z(YK9ms1HzI8qWJK-mQjY$?Kq8`QI-d?l&3>5MOeTE*XEca`~|5fgZKgG9)BVH5-m9 zQ>m(JP|w)*7~V2wC+M-FtmNV4fz=;F-Es(=vXjph3vk4V2^%DoZimZ0PFNikYOfV7 zyWEL)>`@}2E58D4TkSqAs$E;ca9?BJ?FzvSMz2_d_FRv!&1+Ost3!q9=zaobslVkY ztHC@AvIhY`ea6LzNVsiIa%lN*p8C)7(gHFrj#aPq#0s$NMG)a~EDun=K%m(zVtBR` zEo;sEZDQL(wlh3d5!gHncPQe${;gSC9NSc|O`}@tnLi;}orrv=@&-}*XL`o0R|R*?UOi2mJcg2?eqaxM37a_|% z3al@_PDw5;e)D%OGVwv*!%ZhXBlEJ?bCT;9yi3Zqzpw9(6s*SIx&Cms(mMRScrV84 zY&pw5SoPa_8-<}h_~bE0<2jk_DE*EsryBBaUTt<#kMadUldFGR;&cQ7d@~G!q0B+M zA@=d1KW~1lcG8hkWcUFEVx&9$I5Cbp*^|j%pMbK)rsi?`TB3eChGOKup=ekILD28= z`x<5;Ny81IMt4W)1nI)ooBp&4u3~j2dtW7Zi-0y{qR$9cQLjT1Xt=7``BAiPmc`Onhm)Y29%0iNd?~NZhxHp7^_0SwIY>Pp){Z5ib*VVzOp+Qqk2s(=Y3S4b z@Y2jb;|qoL>~kA?JAPQRd>Ks-Cmnn+(FiRBt8)@NBi?Rn2)t>U38B}LRY9kkHz)Od zlmzZwpvSV6r<2N59(fvezz-B({kpcQcJ0f$eT;BSYx~>4e$;3MX_;eKtfG3Vbx(sG zNR?m-=&L$+wP;%h<1+{&2Ij|3 zkAB@xTri{wuq1fTNG!ug(4SHz*!fl!>%wma1<17K1nBJiJQbi4`7bX;`KQ)VQL|69 zxmBDB{;?b9&ogg*_`{}EA~_9LUny(ml?d2d#Z?)|WP;tn7ehG}tYapFPmI25wHeB8Z*(iD3T+hWc7!MFifOy--^=px|884!5Hs*$y6}X> zh(LDDdRg?w6G?}}FZ-m!Jv07+^b}Ly-W%~&;>()xj{b6#6Q0N$yhyFcl0|jK3%>Ql0(rk= z^qzrk;n&GazeARs&+km-^Z)HgpO;nd!@>A z>DeXG_QZeWhGR{sR6}RQf<}U*xa7N1BaTDSk->~oJy2uF#GVNCr*q2fsr8C=Kux}SG`h^!Zbwo|0omHm8rc@}aF8(ZN-bp+SYO0gx;brAk`qztd zzkZ~hAW!d=eR12~75cS?`5STBb(%uS$?ts9Yv*N;Vwp^cyu=SFa(LK!lW?g^c}{fA z72{XylhHktBI5unZd3wCA4s^k1gW2_)J!AiC->juVRzpo+}BxjX-??~%?qU++56IZ zFXbe(24k;ROZM~v+l9R^nX;R=)MtcE33ymjRc`rnrJ>uNR;76ELM!>JU5D3foOC3Hw(==yL+DOJf5Klmfx;t@IU~xklDp*U;77 ziNy;}Me$GuC!pf^&9xq-`&A2yil5IsN4WZ{m~(>f78=u_ficOpMPaJmvc4}B8N#&8 z{iPLIPs@;{^atSYxk-N{+ZF`G&AgI}zuNOyT0woHmK1BIL57LNxttq1FBsQ%Tv_hz zmZ4pwkTZ~ZxHS8;s^WSoqvE?*z{jioGac=-O+!J>y8}b14?1|d(3NB79*d-!X8YixBU_TeR`D0@f zQ8sv#qu*d-N4Yo8FAq#+tZ`v zBvnPPWJ(LP==<+fJ$$ zai7+*&0>yGZzJ_75(Hb5DJ}{Q(=a4 z%ary0qCM+VV#zD*Gz(wjf=C&g7}A_y%|fI%GQ6TRv9Z`;)HF{03fH>bDb}`nf!aq8K*i&<*7D zcdZS-UP%WOt0I=xG~32NDYp|%Mq>iUJN2E0e-dHUDr9S{b!G|vasI?%r>jLxh`h6OXADB zwnoo7jueL6E=4ILeW-E!{qi^uOFLsF?5XrCt2lJ^nch_jRX+NoP; za@WWdGQ_DnbAZ7zegNm|4KGI{yf>Kw^%j%#SbcbhU-EZ5IorlAqJd7%lK~J<6VoF{ zu7U&w%4ODd14%~_$F;XMk_KmBpN^FGgPiHE35*x1FVR!o7@(*aY0%VYbe=8NFjgXD zw*|*AhT`&+<^G8YjG#TpS9=mF=KbVW#5r;W8d`#N+@16n5$9b~FnNyuAc6pft|$M z2Lj<8SGr1F?RG*~ZS{a@Mgrp+_@njGb0>7v47BNhZ(FEm$+~8o)CS*vOqypnc93gM zhkI9>VP04$sILj+ijw+}4@=XeFoUkGb8UVi|G2zgFk}LS!1&S<6BFv5C|-P9b4$CGk|;)?#-DnQPe1Lsv|Y^+XY#Ge$h8% z{6q9g)B0mwyddh<043N!wLV1}p*RByZ5H>~BT7e`kWsTlnjm>A|Ep+`VEl58VnCD%Ra2DNxtb6X+ zApr@k(E&GWu`?FBJeTk{;GbW_YdL0bzAnszxt`zfNV$Z$Uz=ev@i}=m%k!VSg2Z|~ z8tR8I{QWh{E5V_kh-4=UxmZL*OyvaR+ov@(ZegP0iy@uOa*S((Dt1nRM{uN^FGX!CES?xr8 zYqpjQ=x{@bcGK--rDpNS@PwHN7;j&T@0EvP5+m(a%^j{fD!Tzczu&oVRuT?qC?S@S z_6l5oV*jhoEJ zYg~-+&o63xxabZqilTV$|1{W_77&MbS+x=os(>(1ewHFciqKSgGDp8nBlsy}NDLty z{8xlnM`w##A5_+3#*k{cC#ByOy63S&HOaKs1gMb-$12eoiYy@o$c< zjKWTvt^lm!VvL=n-orICB|6lEKpohy?7Y(C=PFrWYC;T8nJP-Nno|$Vn~8Yd6sk}j zl_|*C&H~Mx&HZfwGeppJod%ubA2~OW`4_{D=9jNR@lP4_g#FVmLid;G%s*e(v2LFZ zSSo8hA2w!!{b$7FaWCOGUkRTQQ7p~3m|*o(%`W5h$=FZVtV`UdtxFELeOv$L)_?1* zT;bgE!hE}7EUhoI;Gj422R~iwO!cdLn0={jB{V6qYpwIUp6NzhpaCJ*;#ER_+3A${ z{1Kyv`B;IBj7S0P_$>J#AN}Ar|M=-(bI6K{`cM^NyrQ#8P=ptS`5T{#`V;6!PV4Lt z=&&BdXz&Wfo+{100ejigCO}yi-Og7Jy)_&CcrwiX7@%p-HN1SI0L-BYq`rtE$Ch6E zl4g>@sbt9^Cwwd`1Bi_#*jU7I#;u+!E6fa3obN&gZ!eYk(`EIOgkCswx>#+4(w^}C^>-Q?CxmI`hOWJF@j+LJQC%s}(El^Q6 z-YsSiv4qw$V&md3V{~AzMNzE)QfLc(dom_a$9J4nAFT(ZSQcyhA|g-AbrC7AOpW;c z1W(nIhJNR-dLFc3%m`J&1tYQN{C1c37rH)lO8U%n+?G@Tdlp&570VzFuef@Nzeu+I zE7%-#=ol~0snGD@gvFc`-E@zlWW7%Nl}AWBGywovh@MHP%0YTrSw_+^f z?1Dd!A2;CTmA`O)Ulf-}1D-mesC;$;1nvs2I)Lw!@)B$%1*O+Z?^dmGdHp>XP$k$6 ztoyKg1azHspuYJUQYlwBh~Au2;K1B0L?WGV?nQd&tU-|hW02)8 zZbEA87g!47&6k#M&-octbo&h(qXxg# zsZzjyV+Ih5tbLw5&s3DklVqR!P=J8Fs!BrzYFEqCRsq*Zg zs+RbYrBoMfZ!d3uNU>IK-ocjd!87;KYE;ot1%+h z_dnbpjyRqyGTTJw=Ly7NvQBOW#CR=DxM0)lfX9wYF-N&MXywNOF-{wS9xeXGeEr*w z*N*ycVaYTHe`&F#=Q=f>30Id&UN)hPDY*SLoo6l)V=(tTDn#0|O@oB8C&-DD7oO}I z-&miB%5(KHeg5Vj=<>wW+gw z*7qXxu@R`V)k&6%-!AZWTOHEq=*FJYjlGc*7Tx*^&y$6I9<+@1D2yP3$iF@nkUnsF zzQmpdQ}l*vwvRU4dVb7eqC`IH`V-=9WYhB;!K`6W%KQDF)t{?8Ymn#3+&K691 z;i zab{W%%kd$~xmeDD+8}TTdlMwg7ArT{8I}zbj{*$EspC2ZC4k$9nu&_U%y2--I_pCQ zd&Ez1f~cO1lkB_r+k1O4j`6GauxC{f);1LbQzRWN3P;sRc>sNN`b9)51ZgSWVF{pH zn1|1gs(vwPqJNO0^!H~1+%peBpS#iwz3uL}W@1vHiY+DM)Dw!W3pKYqyi3Pp7A0MS zkBd6=IK9^C<_%e;S%x~x7e%fBIp}c zIi+cOLHE<9?iFNC>j5VY z->6m8T=4$fsKBwP;c4%_41#BnTQ@O{!7$yv`wK?P1Fq7^x(Szi)8?ukIIXnzzD^ql zYiIC&$A6z|@yh}ldQ5#$LE=Ne`Kh+PGD*rJ)zIhoG3AgZS2!$*ktg7;!x=oE>;FJ^ zpQ%6jS;Hsv!&z$ys!02um_03l<8Xz>s|wkY0DosGhefVLa%*?XJ6&^j(rw9$R{_I` za=YtKMeKzZi!NQf{2<4b?&|iyHA}<*xa=qW?ilOSA2RC5y!P39?24!>z8zTNAzh07 zeooUlY+{#h@u%W2I8eQNV{SleTFCnFQH!A-{U6KI-En0LcWQWgH({=04G-gHS^?k~ zE4KQS8`D)V3Q#l|u;N@ykT}8&)yY$Z-2{?ODf+RIPC8hcz;}RQe55Jv55r$D_&v>X zlrAY|MO@_`ok^eIS?T2A%DYXKXd48-Zo05 z>ZTTc7kXc6)yAwYw^vUD66HZ|bVqG!klikq&KGu^GcTT#^H}LL*}T4O$Kj{jcAeU` zec%88*Jl`^cIED{Hg9XQ@&(DjsA6m6nN)0hc&O!gl9;8iJK%M zIPI5oe~p83KJoJT=Y8mXrC^_>LDCdxjA2v99!BkAnO$yPTWJgoU#pQUMp7ErjK@Dq z7Xm#;zXob#ZC|Cq-!P9x7|17JF^AslE#|Ngxl6{KRq(HX7E~Dr%%B`Z>*T?@_V#`! z>2Au=hr1F;p(uoa;zJc*G7UNgI%oi7-03$p!zAxu1q}r?$U+swi^%9jX}}B6GscQW zFz}9(6~DHtt`pJUvy6M`@Si>R|ND;WQM>pxhW2SY<5UVN4tbW**e>uuVXcwk*!vRJ zGH71)z;M+S&%`oAcdhVQdP9gIXKnq}e0K=Zqt2g3T#O?tlZn7b6@66u1Kn0tO3Wh# zbj$WF(d#1x>FJ)((4sVp0blEK%%Z3k^-b{G&}~wuibu@0#?cq%1~i!2`PE-=WV9}c ze@1@&`wLq)Bw(Ae3Ww2ovbFlXKNaMvyS|kFFjP@N{RRU#vH;6u4~bVFEF_lvo+jQI zNF)FBR+IHYT2f&3{6ctNtRly$YtbToG!rBC2p_cTigT*STnUETV}(s=BRO^@+NAG%_0QIDv&t?GCBzKs)|a z?xehBo8lCT8kO8C@84TkI!SYq#*VHjxPr-q!V6rur=S}%D+3+WfC~P zqr3-Pz2N;toyn!vcrvo|##%Z?)7~~j=CB2IiPChZLxD`uYGPW?O*Lkqrx zbD0=_AhT&%CI~)H7KTOKiw7X7utvwRt=F{|JSIpyLjwJAL2p~_h#f*Bd0cyDAzS1% zyB9@{`;e*U?L4wFLjs+<_u#-*77{W@3YmR9W#`G9pFJJ?WzY|ESotF_w~TSr^|3Z0 zO6t| zGg1x(#&bkwt`@?!pu8#Ni#zdmQ>St-4WhIH&Gh<9<4|9$$Yu|pA-C)y7(}~USOQWe-9rITh z;7BU_6k`GJ706?hea#poS7E-d?+JhRVP~)Ab=xF&`>H!wmhN(OiBZ3Ah%HokC?Fzg zr52U%Sv>=*(7}XGO&5kgl-V}H-FVsrf3s8LG~&8AMY*cFy(8{7Kf>oT47}wv_$-jc zN(T%IUsT+(3Frc*n0u zar^`zdFAQ&M-HxP==Nj|Qhb@N@UL^90xvmy@IOqn{|-9rclDV0>n?{_OsVX>k~-ZL zkz9kucaPQvNF~|L7cSPh`^xDzvKlPNl_L@s$=}9TDtJ-(_lE9%ZEY*G{s`cFx1Jvh z3{86{In#;eMZo~N4-Kl6NDg>1ND`=|k^fv3L3O2D=%bk6`x{!baOY+@zOP$M0f3rl z{%$iCgXDw^$?&v)3Cs^PpVAs&K6reStd(nsq4%1N zGa>ZvbJxbYpzPekm6~U_3Rj40e_f^Pr@`XN%+B#8*E&R4ZKdb$Kd5w|_mD*(Yxnwp zig6bx%h_@7S8As3=#O$LnljT1Vx*_)PSyp!EUtSfy7)oM3kYTQ5&veIC7fEF-~3XT zCF%6kSoKX+pO61l33x5}-3oLh$-*0dvMnWMc?52F2&6mBKT{nkr>gCls#10v=1swp zc9wo^+o8mqKswa@q;Y~Kcpnq$4+}qn07qh0N|hN_p>^R8N8CiNT{qhmS+G=gx zucOcCdd`avX^e#d;IFunu3nt{u#vkbK8(w3!_U7BmGv#7u%8fIlHs2`Tf>JAvGt&V zOpDujNaY#X%_=e;_^G8+oLWM;Ud;_#@NNYe7AOjD0qZUiSaJ?>o7@QtQ8+)$ikDMe zQ8ur_gH_h(hwi1{S#W?*DgLh&L6bsSZEuiU-@?n_OL+RpuF?M0V7ueL#Q#QBxqaWJ z+B2ZqB6|oOfm$m*czpy&Wo_>|K^QG_hDztC1}HMy#N%a$WeH_w0)@Qiw&a@~T6Ybq zKf~+&S+>n2=aH@?Y@S$kJ#)7+QSc0gq|jd$N2n)59xpJ{%Q=)Y%4@W)i;rHed>JKG zc{9`R{1)NmnyrCdlm<~;-xhvT6~+*Sn6Ixc(&n_POhy4YltycT*R?aU56PSf@LuM5 z-}y_qOAgf%eD+s;*lY)aUM6rrhI+PsgMwFP^q!~{czF&^;EM8BvLIw#{spTl`0UP} zh*$N!pj{dGWqEEG`<+&AsbWgDw;;-oM3c)qEF&pi?4Pk7tczMRObB&BK36+nez=i# zv%jo2iwys`5*oUM=NSO2CvCShkkp&QBDYtv<860|r}Tg*v3pH@3;qrG1+{M&@(Dzd0D>fw!84x0;deoG@kZ~ z-{;Ui?=f8Ljtgg;zy*yWV4>S)XSA!Z>vMsPc z3jP&C@JzD1KCM?701{@NG4o{fhX?N#bp{uc=5#Pn4R=+JFGK^JO)m@i)dSk~$X^@N zor-9h;GSF@SEnNEDXCq!qoYJiJbR;tq#O5pg(w|*YSR&i5#eCtI(@9HASWm2oxsoL z>LicBIirKN{k(%7W9IhAqN0tzF1@_1;F&dsb|PQR;gnn_QoBk_M)*a`!OpkikCcHA zkhUy8A4(V>s$plZI&1b(l*{>5k6;|d?SHebjQ$hlu`aK@Ba-3>+WA3k2rdqH3N0-oILY8L38>-21P$C%k1n#LIn&^<_dtD zxA*}=5FFET28~oD-BsI#F}2UPo6Z5Bto7O&xG*oW19w@Re)=6rYm~AP{!k^y9MQW z*A%Jiyekj>1_qK8${iNDz#Zmcm3gVhRjeRd{&dynIKH-l$4VoKcaX6Ejc!#MFK~uY zh8TFW6-i^eqqp;}daRX>IY*8edBRD^a^vf2bxc!v&c_~9d=2yHOMh}dBnrm0GXi_J zEVm)Z9zZK!?QDd0@fd41+?0NbF1}e3;mQ2)J(oFsO_y3(v)EPq2;S@zWOL41hVY-G z34$VL(qhL}euKX7O*_7+rH43fd&_(%=e~svsjZq;(W^!4$h|>gKfwh%GxaKQfo0KV zZ#ylFvX;vdF5jeB*9{w5w^g7n0CK;DTRG=G8mV~)Y0?j8A75OmlrIl_`6ehfD}%Z}lgr&K`kqdJ^RVN8H^P4Kzs* z62ICmf2nHNrX4l`FGTBdUiIcvhlipNquJ_#KxYqB+&wX<_|}5{-aClIwQ8=@RLIO1 z2W}RlT7*2a@fe^-GA{+vu}h3i8D42x51to8U9B$i>MKMR!Cb!ngfT>&XXY1(Yc?wy z_d?>w&Fwr{$XV-FRGG%uH`C9DeAaXoc@-0$m0fl2v{z9$>^JLO#n#-P!#pE&j!qO* zy(qWV)qKy!v%eMZfk)Y<5Yd97ADi{-bprrSttGNy405BKfJhHUD6`LFbMEeimGK;$ zj43=h`sNwl3IQ5pne~z}D=4b!5ZiSwU$f&`W)NyTx4huZo70uXJV(xvX5Kfir2QM&YLWI*QE+NAAa$;hJR|`D-<~Un5<(uWE{by*Go5Ylm**J4v0n zJQozAS^T>}(*o9PxXYTO$$9;$%%~v-->`tHbv}{JuT5Voe$qEFjgEu3%11!%Z_)?5O z4Q5*_)fm~@-849R;@(AewQ@gENk^B0N^a^3u07452mE~WmRrE9IUuv>RM}FAN`@ho zcL0Pd-nr4XfNv{MV$c8PV?V;iKD*O#(BpZ3pwZ(yhC7pL3)q^Ub2f+^t9=3u z%Y)?OBk0JQ5v78*+cyM!^n8Lc$Cb<9?YaT1^X< zQIW#=ihZmV0V_x@l5VdIBsf`y zJ6rgUZtzsuZq8N+eXSB>M&K6aH*QS_^(DJ{aOK9w%q-r0sA_DR^5cq7_>b2&ET33P zulW?utyCW+QbE<{ld24+=&(-(a<#CFDZX3`Cr4sE1lA#FwlQu7nB>o$`-}Id^0T(c zKp!>w*0O$S<=^X939_r%Su;+>S=V4t667OZ8A&|vjqJ6?*4|g5K&t_3_uG0moRC9T zAG*3<(BMz7l-nt9Bsxl9YjnnXjl!fOkTp|hM3HS49|jY+6~i01XT7fNuS8jRjLBG) zZuJBjC(b!2War;CjtytM%guPoYb2eNIdw=`vIr>Sy--j-?Fiw1wJz8w(FaPO;DA{x z;L7C*ejxi0+jLO^MJ?u;Ebu?_Eh`Glr3%zUv- zhx^bkn=r)vi50PEsjIpRAP-$J1@pA0@w`gUghY;-4PMWK<$#l2U(%(5z(JK7M}oqb zgN(-|jC58qlDU4lVglZd;MA<8EThL5i1jd5wJ*@F6j>xQ2|BEz?Fo^%;+Ue&Br!W^ z!MXvd@>kt{9s&m8?%-X`2bRfKYAGkRXz?Z5_qyTt{(WGNBJK>^Zdx`2fMij1a#4@4y7dt^O?A* z5}NX{u1)NGhnu^riM<+`9nm8e9f*J*fn zc`wS}S44Q`tPRO*#`WpE$Hj+-eG@qlvm=JaE^!5B62^a@J=~hz@fo4cYYzPbQ+fbR z9(JitlW02)#w7)@3ZhMuciLLc-rpI_g+R{M`kX!kFkCp0JlX`Dj+y9kWtze(LF*CA+0^F6B(E#*gl; z&f~ek5`N!6S_&gc>SVjPkI}$rhW|F17CJrJ!ad&%3P}aM~xkdeDQB0TOcTrZD z8HqPat;0GSVv7TKPbiAUp-@ZD7tKz9E`cq;chiKur1jNL=4JRKgiQ5=d<>$F*(3D) z%}2QLssWND#5ZzjJJvImIaLmuOT14GS82yV!^R$@rjmcl zf1Ldo{8s=#1Kc%V%-;?As}(}j*d4{M#n`e(Koqas#2HV-iL8R3MmMLv$+_?u&@&65x*rkJp?;4bw2>n^kpqU)VLTHI_X`g;1On|@V! zleKNCS9zqISv9J4s+CS@=Ze4j1KHoNcoSoh*!dPKfN@BWC-?vsjH%kzlqx+ixSG9* zH@7~c`1^A0=xYbIOiJKz{>-3msQ)87?rRCH_BOYR-44_ihL$1%4-a@(WXHekBbg}% zG;x;-l>WTZnOpy_K~+KsjVOSVjP3gfz^DEABe6U|vlQyVsdNUK;$aiZ?B^l!LoEMF ztJAF>VLEvNP=~G6U8jrD=UO%EXDZh0oDXkE;s#&GA(_TzD8ChA6z7?Zr!EFdSYw}y z{F+_-XxxHBqU?RV=mdYYRDMhxcRZgLOLce3=6%br_Ap=5wKS3@sdw6K?rXD1f}*d5 z6J@PDmZm#M_vLVpU3K$Rzuj;-Z!#DIJAd?h5whrJIVrx5e9-+~jPn?AWq!Op?+jzs zn^H!#4oUeP057!5{ejBy&NR8%UtzsCP<5rm%!?0E|H8I+IwyYULZcOU;E@eX;&J{9XTq_riroEv-zS0~O*O!TqA%Z2vj$^g! ze!;9%Ama39Ey@FEHh^CnaKElqX>dbI1x^G}dMlN=)f5aQ0B@@gsdg0XIp*z7`u^#E4fr-sy1sG2ZGXVc;x~;7;Ugd>Q{a z+NGgw-VY;=p^n2vYZT<;atNp&|Nlet|CP|65zegY?@UUX zC27xe=*|H=()#p+>r~YTgMU@$Pu+u>kPri%*4#6X_bp4h^@!}}JtlxXlY_RG6O*^Q#MvB5b)!LJ{rOi37S&m3^*O{c&eX}>m zuMI9j`;NAV)63xp5-(OtwYJ_`Z>^wonTSXJbhGrCFGF^!%5b6FO7_M_;WS6hG>hs(%IZfi)&~B-7sNr* z+BP=b+cbT+&h=v)+e>f&KtgO{&5Z_82!aTz65}(E@euu<|P02 z*3NLRWM0Wiic6=w6$POLf7NMOU;tQgHN5NUB(n{|2)l%|-YP}gcCN2AGGk%o41%gY zQXgmr|9Fk_`l)*ve~h#7rMKnJU*#>duia)o5CD0B%;LqB3@mEOTiBLk$$ekQ?t=dN zh-dJZWO!_yN~YP4+Hk?t@P$E(m!i++);{~&ZGi5-!mT>_>O5aZU33&QGk@RT1U2L8 bx3)#Lhz*)<2R_{<_}sf~bgSTo{qz3=;oQY4 literal 0 HcmV?d00001 diff --git a/docs/images/platform/kms/aws/encryption-org-settings.png b/docs/images/platform/kms/aws/encryption-org-settings.png new file mode 100644 index 0000000000000000000000000000000000000000..b413cd321f984717316c67689b20ff7c26f8cc91 GIT binary patch literal 493643 zcmbrm2UHZ>)-?*EaF8S-A|OFgP;$;mQF4YR2gw<1a%ezA0m(?tAi0|iO%4h)Ip>Tt zl9SM+CcZ-Nx%d9>8*lvI@%0!@6;-vXYS*r{)?9P0-Jg^dr3h|Q+{VDbAdr!MrHX-p z*NcIHUHKO_uqELOm=*&AU(8BELRm&af>znl!Q9H$3@Q>-SAmRi^SG~LgU;+B{< zvp>w=Bz}&W{bBIs?q9qw@6yIRz7x9O*+^JOUF2Ywk;%wUq2j{!w(8S?t~zXweD17W@NW42901UH{yGEitOYb1+7UB6;IjY240)XUcT2;;k8(~ z(hk3}6PWs(`5>;ez%J~2X9oWmQ$YfGV z=udLZ$Zx?9_KD?;v(d>C4_nEw(OrjS=iJ~op)Ji%7~CwICUfyIge=*% zg9XaZ7xhYeAdk3wqyy81L~Siug`0feL3Xr=3?IALJaF1KXKs`lRsev|{#-Z`D*YDKTJC2@UKOV`}f|7Jwp1=E`oi^4MaNw&nJvDd@6CQ%I6_d zLCinzAs^nkUA_o^#VgDIkOfoNFZ4UjkU%NesA;NH=IlyDtj)(FAre=O{c~oJGyIW~ zF~(5(19|)>)89{P_;x-8e#>IBRpiHVqe<#;^KDUk$*@SgD3}@Y)+;ze`CKh-F#~S{ zhtWFf)P&`&T>kp|vqb}CD#j(j8qv~@RHKLVJ6Lq};&C~hx;mt%O4Gi{--z5K7NuOD zWc?sEH7q|Ipaa=~^aDWI@XIpMeLc0n%|419w1DVl;0Efuz=4I5Ek_lNP)KT9zll^S zy?95sNuQRGt9o#t<^;*q21W3Fx*i6+jlV959oG6~nG!d(Rwp-4UeCvOq(AbO!Wvf} zk}snbp^NDMV0cqBmF0(E=ocXYK>;k6LPLx(SB3k0w7E`+Lo5@9ri6A=P>$ls=hd~;@}WX3>b+$+Se5q~=QSJgYJH++*gNneTI-c7+I`)2l*YW5>6 zkFo*d;ycwzDD7XknUA?&5phT|-w|rVHKLuD#<&~MMk^zI`*ZkT#JHT4+Cedo&7_}} zlNY=`dK?%T-RY4{QX3}x$}?)Bli{8ONSS5y4*Zo=7Jkg9fG^;+C)`x20rxXruW?r1 zD0<K@Ys`T`=wz9)`PDx98|qGD>@!Lzzb>nT*fUQ+J}%Wbu7e&b?AKeZVGlW z@}87R2^x7TXiud1mYq7nY0v6J5AxjL)9zQwJ>GN1%R9Rr&BXaPvEEaC^Z!a8%8*Tx zOA?H`{K4*n|A&#E+8gu@bay`qzGC`93ArB~l-Q=-meY3FhK`pGYLGu#rTv7H}-aHcdRQTm0I1G1Nn6>?Nr+r zN3>F(J$@wqSpHG;=J&ecgT1svB5Wn z!)-}n!u^=XkvqR2PWur!$rkl(YQ+ZAjt0RB46893H6U#}C zM$~X38+WAj4fUJsKiT{5xXdYeIyYi8GB?J0DtI0rg1vPwEHBniDG!u3kHbbO)&)Kb zm7D%(igLqO#?tkF;IECXi$6_(jUR^ZkN-Mg6JLq^h+7nobo~*V=|m*G-yFYD^iFOKj_H-*nyF7L+2Etc|!E4kdRPF+ikQr8^i}Tn)bH zc+{IYnAx?sY>67`%F+xM6*^7M3Nfi#(&(r+;qLel`uyPt=L$T!h-9Lmdwp7KWAbYm zs+~8&d)aoi*KPhgr03(x-JSBzoUvsXEEzTlpNCKM&9Wehrnl)OLWmJs-TbSHZ;zeQ zSAE(pvI1dJX&s^w&BEIv6~bQ0vnFh6Y~d5;C9Dp0Zo$X&yR0-MG~r5N z19XO5hH1OJ3l{Q}=JZZvsGRhy^vT_f1+O?98^X;GVkBPZb!TCrtjah2WbpL7HJfP0p9 z+I2hRkh&zJcj@Uz=^K;|l$hnVD8xL^Q})QB52A0%^mS$b`0&H73yb6iePQCD$dH-w zUK?d}A$?zhvrqZukF74LynKa4`Kk1m(lYW>iTfW(x(XKYv&+?BYG<{~J32dfX>1NW zCGoomwk0t+lq{3nrp&RdVeEYJVzf%y5W^c>##<$v{#<o6F9EH4$A%Tl&3P`-FL?aD0lsf~?nvKTyB|rDtltF+1*IjtX9J z86Zk(Ho-J|G5&r5j|#8n_5!QC-lVFj7I*X79@~rNQBv6bkPrvfeZ5LBN0U}*jY-$! z)6F;t(_*aNGZ$tSwu|zZ`h%7d6Q80Jm$%x}<>AZ4J$!|<#dnHp%7!hL!#Tss-3*X{tHIjD}cKdaNPX|$2* z4X@Ivo}Ny{7K)$9bopF2uTSEpKfm2vUpwFAu})noRlbUzk7?vP`nY2=H!x}F z`xPmE_+t9oXUS}^xrwiuq?)Fas?%y_q(l)*8Ve4Q(8GD3wja`CD%)8-5h~%NRFuL7 zZz115ti4+3I*5+Y&8wUj;kg`zSFKfrk7VWzq~Z!YZ7`#@_M8k>!&8p=eb;U*y&QQx z5fZk|x{c%OhQ4?cXd|`sv|6q&evYl$Ieb&t6|vgg1-sN7&@(ZtcNal=u7;gZR@*B! zOu2-(!B$<5wl&@McOgweSJaCJUEYUh%S8Cpqvu8_DT#QSiJ`ztq8S>5Xx&-D*$ER9hO@h#zMoI$u81^tw8^+|fj8 z`j^Bv4S7{u6rpCu{qp^Ab{*%veGK6e3%|h^QVg@sV9#h=^jH~-5`cla}2r|GZ@mHj4|4Jb-X5e z;^sv1PDFR{2yX+XaFaIpws?vVfL^HVCA@g1npCY{)eueIL-X)3ke*XU?+W;Ko~?34 zLIwTP2d-}1GlICzeRM z+izfC1X^L-{MRvx!1DSN34E{H{9a;x4#29PC() zOdX8PSl#X3UY`d;*j*4fmU>#vvde zz{bwW#>vS79Kqt`Vef3@&SLLG_xmJ&pXZgClZm6%TW2c=d)n*s8W}sdIEy@fe0`yR ze}3PmnY-10u4M1@uWkVyWV_zO#=*+Y_V058O@*(w3MyN+CCo@M02Rq=R&Z7SruzxlF@16f@D9m=< z_y2kpzaR9kt-zBOy)Df4?@<%IZJO2k8W_ljRXIT2t=sm$_v`_AQP<|3Kh)YEr`Q_c?8>)|K zgYK1KdW-!wC1Hn4@*KGovNg%zZ6+f!;U#ljNI&3bj8XXy){Bg0U8 zIE72J1UsT-DT?uWP2Wfb6O{IuW1|%Fs1b`BqSSND9ny#2l&SLRv5!RK6#C^i_hz;PhcnM)7XC9+oHfqto|8 zyeY0wIm(gTdls;h^*1?MQQncS0(^w@A=Xy6l0i?-~4&86i@X9QMSG{PB5j)GUJ{)J)H5^Hniok@>l`4 z0k~ScMXWGGtT@(}ya39N(@vpi{D!16{2)Qe@ zI#G*Ke>hrFBcYBnhzyov^m!af1>-Y+Q@!5CF#6Tt@^nH&P=JQ9cQfqeqkleFck(5_ zY9_?9aVo`%Uj&B~;AbWk)ns%J8osS#6DTP%%^!x!f$5-nQ^K*@S@+0Bc~`RZR|;H< zE*rGA;UGyHbe7G)V5httefk!kx|9P+k+Anu8uCMwy54BXqz&1s8m@kutjH9$vyCuO zk+cIkn_!(Y4W5P`rWCyzPchy>okA}DXLa5gPjOwqL-9l|b>Z{JRfb?XE10d870)X$ z7pPWl`i=SC&#vh-CC6PjU8*7-X&?-LJ*xXnnic=Co9&k9#t%r_Q+0&Gl34<4A%|#M z-hbJXy;-Zrbd7_D`%;Za$VsPkT3)TB_gq}+`w(80)QB4XoR)@!%zt7(e;=z(_noQN zMttUkp_L$#lbS(2K-;cdTClH=KV#S`2q~#v%NeJpDNm{0RXo@ZF{UK&EEusYMIv<| zxy=!RB^eHb?7aBI^Y zYpQ~-3-~Vk9GfDOJNC~mu6>w3j% ztnJTGL*1EBHLC_BB-T$q{XQZJ%3$|KvwnQPOq3RlCpj`qa}%M`Lg-6MUM#1pqNgQh z1o^_I+6Wq3I7yl{wXC)>l~#h`Us-GFY1rkc<-0%7HS*CO86F;f?uwxQ0|$3!t>Gr* zqX*hr0@N|&jzDm8ipQ-m5vr4$Uzpa@A^b+T!Y&1++c9G`B(8fBThv`>fbe6a_VJuS z4Y5k_{JfXwptioPf{kt`#j$2sRSU^dEC2`7#j1!Q>9Ty%th0A_k-!UQ_!`Rn65E-4 zf>cv8tcrA!g^he5hchkD1g@FSo4j|CReUt^geH|+U2e8=##R)07up?QWbj1!pE~U8 z(Sj1^7qX|bcTN}V%VAp^d*=PLuvu!!sL7xw)Dla7g*d^GD0H35p0i+H_(3|I7*X@V z`XaB$jz9jJu(Xgsx^g%L8F`nB=iY72K6%Q6iw+3~EfHwnEl3l0<+eKI#O-Uxb@~OA z0z10gYj;dm1e|%FSV6!!5Np(o45~^0$lzHq4UI&rtDjTJ_~(aaeq;0ptlBvoAIpx; zYGmCSF)gV|Is1YVC9?zP9Nrnrs_~e9lS{Zl$C?Qpu?F6zB0G7d2g4&uU!6IwA0B7g z=9wh8R7ccGq7Hw}S~CSUZF`FMa+?Z@c8l9dt_jvnw7|Z$s{Osq9}*wYoB{^_Ff#r! z3+0dEW*^a&nY>gzZ#JWK0<(~(kobMwxICMPTO&_g3-nx0*>v-)aJs+nDkJ+P{j0Wp`(5ApEAkK`J+u34}pgm(hOuyi3pgOERb_3y5*IjUm?H(RCih z02{beSr48E z0l46|f%qFWsWm*Zz46bDesCT4kZnZ!$^EyTx7T`zT;xW%SRMbWsW{(7n;8bqQ zW<3f{F6d4zA}D@BEm|v*f%F`43V6wK>cR8Y!iAW*DB~QKFJ)MasYx-cRItV%M$Ib5EKkyjtfU!; zD3!w+8O|J4@a9l|tCSEfC{=ZdREkl;vn?;~kv<)dVy(B=JkDbsQrDwZ~^8*8MGeW*7kBlzgI+u{~XzV;;KN}Cgj$Vycs zQH2i={`otH;m3Rf&eZGGQJIoT&ggH~%b#R(uMZ$uOsgrL%(3f-Wsf;_gX95U5RHD~ ze(PcWw>gG5ITSO3pqN%vP%g?jDS19)no`+L>iIn&@Nc7&c7>~P{vGpSlw(=Jo3%^E zkn@?6TN^5Nxdb~jIjqHFM2}g^3z=A9%h9|i6P(4HXSz$>Uc06c_TKmf@;~(r=0IS1 zECH9je8)=ul1Cl!GZAW%519!?m`jq5zUCE2v^wN3p@Zb|Hx4Kac@<{@hSw2HdOTcv9{YIrenk6F zR!$KP$r|sWB+qYnOr0@s=EpM@Yd#p%9Wdn0&hyA#B3%6P8ixARM9jllfXoAT-M%Ob zK5$KP|G*gF(J1xopTlR28)JW|Ya}=X81b8*sMlqOsUCG1L$R#L5k}Bd%Sxp9nBTc` zJr)o{d&197-0hx9@W|_5I}3ePGYuG0oRmncaT{$J58wgI2ISjVuuj#6rFqQ@LztVW z=(P5AN7?)L16}jLDp2sAgg;W+>vlUu6{5ug(HfL?C#Q$nB*kUKk6X2N;86 zs)}bgysy?$>~i4M+B5H1?NzDxjih(K0RBCGNbkNA;+wUY(t7aT`t7w^$%9F|1b1c0 zWQ}Gd;n1{O!VXy;Qe%buD?=X>RY>}D&jah9nJtjSdu)FKck*9ml(#@yrk-~gld>2O zhUbhpZ*E+nLEHT;w((;fAfY$g zP1tUOp;%VYxA4mW?jY-Z123K3+mD1RS!zED6!Ux#i#k@q@g@z$xAzfz8HqZ)!9w3- zYpm8cB%N$Bs;(Fm6DjI_&pRaWMzf~n{RZN5t5P+@r2nFE;I5{;m#)+91PY$0*`KO= zkp7!8h}%E%!2E;E4dZ6{U#1!f6JM+Llr;E)G^*QYs1W#-^N*o5QI&$Fpd6Lx>rrZP z=Pg$SAhh;N__vXmg@|Vn23<78{K_uPCs=Lnw-g5^m7fK_T&iSI=nomACNHEDO_V%H zP|>F&NzY?#k7pTD9A3d0K=Uf{OXBE@YG~(og<0wCQ zF@h(U4gfv{aZ1VLlUSmLf>JXDotC!{Pf6Ll=@=EEo|IgrJ)Om=>TS#6M;?AgP2T(! zxBt1P&VZ407P7OYTjt+>-_FFE%lW~&3i+O~75r^|o};+P)RN8$!BnIpxg9JAB^`s- zWK?m`Y;!8XZ4Orv)+I%pIz6riUICKk);K8Q_%Avhr?S9kID^z9L^w0SxQhBIN>4S3 znGQSMS$k@cZ{Uz&(lIk`&3dF>(X1&>)st(B2u^N~XBwWVL=rF8=!6GHVUu7TldP8^vcm{ zR>cQv|GbLhJp8q&4OEO3yVAl?>Mj;>aDN1em;yAEjuojA?+U(#ppWBsj{c^X0Hqg$a!ZgD=VD`o3!r#3A!nMNn6p+ z;xhmb5QeTD%ht~^fs+9@tzo8Kf_y)1DmuSVR75)XJ}+phJN5;yGvXFJdavN4dfq5M zBC0!*dQav7l%>nLFv?nU3m&pZ9Dhxu{Y5@__%8B#6dLwsb5RQsvJN~Gk;QDP1-!}O zWAnvOEK3!Hkp_A0h|mI6xe^wdmce5dxXb|fq($;p0;bjSipD@$N$ZG z{*;1nhOKcd)k${0-6k0G@e6PEb?#p&kdEby3tQ!&1_7`wFYZNSOJp&TPa5y;TZPV; zAJ-g0aQdlSS=CUVk4W`?xs}-<5eOfJ40`#`nB3p_YM6LoOG9YnbGvfCny&S`KCWm5 z7*$QV(kdtdDZc$3%PRhs+b;T3vU;s7m`fwb>>k^7HsSn%QmrUoI~dQJ65wl4>h%DsLP8VwrI=Xrsd}aKUV`#Q-2rO~ zqTVaeAr^7XvraMh1Q^g#qIcorl8mZ32b^g=j>Y_1Ea`Ow>qy!$nUON!zJDd70Eb9f zK+9IVyp(sMY}6zlK=vnyQ~l9*0#ug|IXxZ}ze=>gg&%;Dsl4}+i*r4PI}H;xmR0MK zwqwB?AU%LW$P1w=O>>@>{fZf*p|)=fpD0O+GI+7=Vl9LkDh{#U9vR~;?a4^9(uyFT zCc$=XUaV^N4R*v$B_l7CcD&%av>6O~v1^A}E$FVX2BXPH3cnn*mZCm~ooUV_WpU{1VJrK|03Ja#c!S_IagZC@8XInDCoJJ|#a;fW z59Ep1&Jb*jQ+;UFt(?lMWzmLY0H_1?Rkn;pG_;oLtCZZTRT`##I^=K_+UWb(zb@76 z+ba36nS6<|T`|c%ao`u7VsVFowTSp{41IDO0UmP?{xIv&YCV5up;Bq`7|-sp;)8%~ zeuO|P*N7!f*}659L1CU1pc8m&u=ak2bP#GO>DcMvs6WiO_IXxgoB(k-{LAfiRj5k} zrh48Bw8>f2OHZfu_u)EO3ya=hr^-O)<~W7@AeV&f$y$agwPcih49@4BcwTvm*`~BG z5Zq&peid+Tf3#W4Q)OkwtORS?87rZxhAg|B(hFSf!1-#@S1L!72PBOf*6 z9^lE?^iR)2CvU$?yXHi%>7E=dl>|S-*=$l_r)SDWqB!_{e`0G-{&H`He0e&;k-B;i zN^b4_S&MnWjCd>{DZM{kalI8#Wh{Z4Ua7kBtCZUozwYG`cU&H40SGJtt=%4wVhV&R z=IjNdK-ex*L!?qrYVva6@0c-UG^Y72cjJNN>#`N7J{Tt-e`1K^F@P#`qp|HAYO4P4 z@{g3{p>V8UW8t(c4(c0w3Ez!B(d#lO{2V`eh;>rXhTMBHaiecfsrwGJ5b%9bSnIT^ zKmrbDa(NCAk4#=3X5-HQI1%<=>Gz_}<=W50q^Lpj{VpE~mr>rK?h(!X0yAkcqA)c8 zU!V#;uo~y2*<#i4q|IEBL_n?4*Ot{HbEso{ z<+tALUWVG^X+Tqr3T}lDOBW5qhmHkv!J`2Ht4zul7H?En+J54m77SM=9$OLos3G>Q zCYE5;YN=^?F>K|C8L8IeZh+csR(m@{|5#KafPjyMg=OQ9GP-x-^uVZ~I|H<=md50# zT1fe%U`2(buzdWAX?cLJf|=dZ1qt%}8W$4*7er-L?AC3&UWTfnjCjE?Y$n!XgvF^) z<1ZvpW$=D`adNgIR3`BfP+%D4?0rTj=tMM^2ZS)x6?2o))c3@O4(pR zTGEx*fA~^iIwX|v(w2u#n53w;Cm7YIt#gLA=Q5dm<2GBWPcD(`c}A$VEuMAFF;WV> z5gCDl3x;py#|S=ZW+ve_gn|6DWRASm;zaz?LB$aN|dFrKtZKmBdo?O&oC zU8{>#0J7y2cZtNCCdBeGb!8{|f2uyIq^%GkEDM2u4p_y>o(|fz1r7BV=pGr-pXXGG z5KFb*#Xguk_#mde9aa|gNL~9L4wUeF9+_|?;o~ul;WE34V(wSJL{n(*2I%208W?}< zt6EI0X1HdE?Mg5c!3IUtpduj0Nu_Em-IHP@6oexoW6}<5|E>FY5C77Auw8rP+MNoT zd;t)_q@LV&a;c(uX7xEjkplYEe%g+g1}wuA-~pESGv?r{Mgol)RfMAfwq*;gjam;I zdH$z$SAlC0D}DqM?gj92u{=897h`@DGI_O_IK!+wudln7vm7f^1bB&S3?Tu^8+J#a z8BJ9YS+KP+pp!=;1*?h7iA&Ax_pq zG{D8vXC0J1c7l5{lzk&$#6)w|a2Fc?ch+QC{YL@!PUn;BypODhEHN*UD|tMDJE;2s zMIq+{zR!{t#25$-N||IuO{Q=bO0TK!gwqL1wpod6a4#1|`!wE!0{>s6X(dGozo8A~ z=<>68uzuMDYx_0yYj*<11qa}KEyOjwK0eYnys2u(3y|hAb!~U$5)9;6tvrvMuNGRJ zcjsG~hZ^hWnsq1dmRe|6zRlFGdFz)bws3JJjM{6cH6MEH=C-_Gw0HJ;mb*z$Wx@Ps zM}-x@n9a?f$08*@dicHg!y%M>S>#s zK7=?KMdpv#q~K3jM;L=)nH-{@f)7+)`Vnc`6|3bFe(C$AEQO3BvMS#+KyfG zN$TekN*+d?sBKwn>5mwH)Uk_;vaQ@S&B6&`>Z3z$1UD(g%xJ!Hsf2zghD{=LCm z#c(Q#Z=(72XVGIC2sXwN`Mylo3Q0qHcL2+ z-VVQqqo~BcJ%SUQGcpx(ZFT=8RZ$8li;N&%1JxexFM;gFl5XaiofNq#lLk;j(3%<% z;Trdg0+wQ=^8|AK3*j;8L#AqniC@HRl7=o1pSM^+qdo}d84Kf*2aiNu%`50o+3kM` zSD=pvRnTXex*U4{?-oSaH<^ThsB(gt2R6mj%uQJrXiF+RW^R17r(~R_8l5uVHV{GYp&FH z5mk4s)@kSJ-T1I@2zW)j4uk8a7soni2DrH9y#|=|YG~^eW{mW!Zw8=UZ}f5gbL8yD zs+ckJm#$G$lApfMi066EeynT=yN(fJ-n`{VqBnr@kS|M9yBq((*t=-MSpTs zAKrkkX|AYX>-qA)Zo-5?s*Tzd)qQ~s-YBp*c=*mWI51MN;4Uxt=s2RgVu! zeYpfw?1ZlEqa?XNkMu-dOyi4s(&Y&13FRx6y6t;Up6dqfumfvZ~1=MF4a3-)B zG4&8p3s<)G?oa1%^);XM&*aFWtZhk1i5PpUaScBI0ofwzceBvQ=Kz`DE0Qnz)=8if zqjs{ec@e{DBN3Lg*uye4`_!?#5#28AG;TGJ=qrCw%KehocnL1_f52Pg0Go7<`xDU` z^|&*ok`~Z7P#zLV(TC5My-CYK?ITgfFRMEfNiC5wC;Lc+W{H+uM`Oy>UdKwRTkgz~_0rrHk^AJ? zKtRqJ_x+gwXT(W^*7|4(iRzyh5Bv;3TVt8JFc(6f8MIE-Ut(YM-HI*!$EJ7`864+>#+>BjZ4~tT=IEK6SqjKDBGCauangdAZF0v0)>bRVQ&lD-XT!$cAkon~3=dEks*X@J|!=1d2*G;eqDN?G}3GLGNF6+&Aq@0{vpgPFhZF3;C zt29m^G?fj9{E7`{3OfRZHA-!UNb)?s( zq&F-SL5_2ejHUQ@Ey5@%!0XT>{Gfc3N<@%Wc$x5+#%;^*#f>Eb4rtSQ&J8>Dhxw_Y zN-WuevF*zU>j?Zc;&gdB&))pvD1-V3Kv9)u6k}hI`xyI9Nc{2=Q|8Qi8q9sF5*kTu z`(q+3bsBPwt9&kSvUP+s`BAMzy<6H`EU|a_F4#Je_}9q>GSH~Wsd04+`=1k7gW9;J z>Io%q5V;IRS4RsU}qNYb{k z53t&Z(Cy$x*WZO_dQ#`t#1DuiotLW=2h#L%KzpFZs5PET4#*(Vo^Ok~4z+wVKRuX; zR?_0}AbYTqj349tw@v=>5#B?k@S!zG5kK{>ZKC~aM>=0vL;6E?;KqIi00n)fvjfsVmba`=_ zSUvAE)0-^B_pHc0=dcHd#*|R(T)BC}e5sln0KdW8;!IE(@C$grQi$)RT18h4c%|`p zo@>TlXoy+Ib^^wbTBRyJ$BA`%%%^Jy&mkA_j3KYuDmOn(9_hnl6L#2XI-}<5Nje#U zKsz|~HtmX6X~`4Kv>cu&V6yflsn%}Gih>B%%P3zgy{cL_r0o-QmhgC07y}f1d(+;- zf#F~97BLoX1}JtEH!7t!nScHIf*>`ck=~bm$s0A4qU~B6I-s!C^yxU{cXi)4_6398 zC!7EKhx%`hyN=f{6sUarfNkv`usE|zZG%m?p`Czyj}GargU!D&?@QWsYGC*F9mxvh zvK;sAbN6kU+QW;;p~rUYLQr;WUi3PX47Ty?U?U&Nq2erx8^?rYJ^etl^-72Iq(BR?J=e64~XD-yjzF=-C z^9S1a$t&WY0Ul^e3D8ZTFrK*4cZ0sE+%c-wzTYsf!JKe@cYgn1Vd3Yk3baN~?2@Me z|L*n)0d;WhBvy9>Oma#Sh~O0m!3!7dkQJ`EAKpe zvlGn7r;w|+o`XVD0!659HVx9enlG$vr&w8v5aUgDXo}TrPNtv5@aQRSzC2wSmh-ju zJdzicUzFeH+zsi}(=EG-lxQ|i^EkC~P>z4p7?=~S9QB6<`0HOX z`3-qg+g%X9d|4OZ%fbe+2v3Ed6KeSSTDz{FNgM|Y5_#5 zyg&wm91f;@s%KIbqzVsg0SThWiYDO*eem7|Aw_liuJ$4>Za+oFD}s~EKvj4(H$8-W zrAHgqcqiRfvd?Ym%v0AV!_<6xVo3Vr>_f?N21+7dI-&( zt-zJvX=u~$?SwxN7;Z4`tHdK?k*&1on<&rOHVqq;tZ*63FzbyGyXv}B6(>r!KH3sk z88*Be*7Lmx1A;S6V$Lb6+0l%fq0?HXA+Pu8!JbJ<;uW5*gNgY-lD>y7JzsYIbLhx( zZG*xi**?Bv3ySd(BFQz>556}ZjKzBSpF@7ypa3vWm2Z{>7pVrOz#xqVzOO#tc@OcN z@$&wj@lC;lZ(Pfphs$c%{?qQ$r%kK#&5423p0A7~PA|Q7rw6uD0vvxRw6mv61-Sn6 zP>OLA3D6S{IHmAuEx}{O8~3}JdUb4ymZgN~&f7i- zB_1#ME_Ccw_7Kq6+czHOI+C7tPHU8eMK&ouvz`Cr6yd z?s`GUD$oft=bJQFwj>o3K3Nx=o>xE(e2M?FXe9f^(ss2D$%frGoRGMJ<{|w z7$AjCE=8<5>df~GEPilEvzqLyX6$tMcnV**#uYVOcG5*8IQ5GRFuQ_~c8IeQUAn6{ zU3(*JB5K=tk5zqC8;Mdvx<2F+`fHNqQr_9Lic~_GNkXl=IPvY){9*N4d72y_fxd+Yl z=)29WQ>G-IL`o2HU7f6oMYo!ah&6Z7uULrHcP53)txWgv&a_mx;?nPwHcnaWHnK$2 zu5{8h+cR13+E*?32vuxAVM)if%bPOMN5d`V1vzn?9S@x4=3n1onjdXVtrX;4 zn)C~9KIF0-q+Oy`eLHcB?6U0~MdK<~qzPAxt-3C5Z1rfe=1EowxR}Pn$w4{z54*kV zW~ZW(YG?t?6mxIQq&)+RMoeDBe9v@c8GHoAdQbsGquhzljg<3Bd4>J z+RK3CyJ+5vbNVA8Bc~;5b@XBctMmaW?ksTgZu6|1@Rf)7C>~;tKhT#jFy%77v_Oc( z?CG9R7O;z11wLQdlUm>v+NmqA{lT}?XM}U!Ctte+s_4q?NwRTBR<_gy>aAg>pHq3{ z^lu%AU6z?5(>a$}QH{H)c02XE)DAnYV}lX=$b5O1E=kpqzDc{iEmLp(7+JEK61s}-V|{qK;XaEqE%9Md%HOSbF?o2i`Lf!3E)4$IE#iMniXSD;sx znDzxm>V=M3s%LeERw>#PQWwrwI99%55&c}GxjJER+OW!leRVCq{LzByu`zTWQtDf7 zZfqG4+a3+-0BP#m9WD5Zu`CUgmkEW;y|}u>>P^2q!O?B>DsXHzs4=`%b1-Z;jdMq~ z`R?1JsnsM(`v#8b8bW1-*g`7xnL$-x-V3q5L)Nwa0ZIajk~+x(Lf3wC>iVE;*^utR z5e9M++-f$9~uU=;pTFc-*w&JJ9^5xPHgFVuKO(z@p7HVEc8*{b_@u(LVgO zg@svg$9AsUuIf`O&2@C5McN_hAkf2Qg@gVNJE288`=l#mZ2KolVdQQ4>AFkndFi}( z_nEoV(Y=E6H#evC`vG|2adE7sl(-}3%(q!s;aYnYB}IKmx-qBaR%c@p;8AU{J)XFe zYGe@4HBkp0EA~7CoQee#{P{%{pC$>^7ahd$&VD9<;P)4J$HV z6|q>If}+dF*ZIG_UgA6%ofJ2x$U#xO9j~HzEZSXC1L(6)7>A`C#OHlj~quk$ohf#i{qTJTS3c+02CDn_D4 zF|lF-=67NjDye-7ESbWL^Ij96$S!{xuAJ|Rt*eQgZHVS7rBj>tr`$5{i!DC1V@Rt@ zL!XwV@0Dz#>8^|W((-h~FN(@w^b6GvhD*>Y-$lHclkvvmshJdKWcB%`(}2i;oz%NCl$^kv859ZsACV(DE0ucDcK?U+WQ8=qqA zX1~ytX#fG`hLkOQ?B)QgsNQkvw4ShITldOJvRwN@TwHt~;P@8fKWQeog(?c~nK~UC z?hYL_q(SyS9T^2QLh9TWya#N>z&Ka$URY(#^?oEfpR_GQtmyQoc!w9U`?f0Z+RuFw zy+biHEet;U#5-}+bl5Mn%k6gFMRB#{P)UfaJaoi9%Zd=4mb$74K&M|GSZr8xjqz5# zLrSBV2711xYfy0;Ne>u`x1vB!2qiFsGWoHK*bks+RT=n^1=)=w=1cec4G|{LGxL*u zCf?_x*(TQH|iqNw(kCkkSHUv z^k=|XQem7EhQ4;S!<8lMY^{*OmUFZCi*7x~uAEQ$7Yn4#hp{XAEnN$uW9R68F@{rz zrgcx7LYj5hONY`$$z{77U=FLq-fa{P6(opnzP+%>yp@2DySc8g?fdDb1N-VE&Q0XS z<@Y*6i0WAg*6~%JsA*|TiDdI0zn8;@@6}FuiWgq6sVk9+!}0zt2O8Q^;iJhcb)!ot zte98qd@;h?>pUWPD^W^2w_mxrl~5>gePkin?QD6sVJX7=%KSq=RfIR`|YcD>P;OKo&f(frub6xHDj;X>7cH8N$T!?h`!6nxOoLjKs;H~DqBgi|50s6 z2j4n?nTE+XA_hjVb%EKb4Z^gW!Pb>>nxZI)t>ASN3f=OzQZ?O zV*vGOjx7@2WgM)xvC<8j2j#d;cpuL>G@2yebh36iiqaMxVo^&bo^DT8m90#BY zii`{>i$O;77q6SScJfLLsvb9a@qg7noB!b(%@f|X@ ztLWwIIT?sJ&7D0YLrt2fk@98(w)Qkl<`*X#VAPaZ{juwBU&Jl_CNI^MGmyroM%(EB zA?&-OnoPIu$I7S_9YsJubR0!N0SQH^Dx=r{l_n)bM0yEGCxi?Zuz)y&NCy?9geKAh zBp?C`38B}72uP?&fIvb>`#qU^z2En(b$|E%i)%s5`@HAuv-dvxc`UtHmbrF?S7BvP z#cfq^?+?Z;1v3e{>ELYcoAOiW&YxYQro;WBmY>63DMbzSkZ~3aFukxSw%L|@?O!&9 zVws8+lqjw>J|x?iP0`zb^7f4$Qxli1B=tk|3ZjwQOlGJKJ^JlYAccE<8mVv}Lk&gZ z1%FLwQ{gDC!$5hEjdD}y)nKF5{~{_yYl(=pxx;g{=I!|k>qchpo2xHB<|HN{`yGQH zLyYAEX})`}mu2<9z7W!Dx)#6;Om{<>>g6|e5}y}j<)eBv=0eFk1Vvfr)CH1H}D`Fy#~HHC8LVQ(a@ zL!$261Eus+)x)Ip$Rc2oWV|zuSHaigmPlZRUn#FHwHc*XdM0p&<){g3G2taCC84B% zdO565VOl*RHf6cv-%S+_ts+$`1B1A z+I#tnWxGkCW!dbdmV}g?7aJHL zG6%KF0z4}s8-8g79BI5oyVsC?cw`4WZoJkW{pdh`?G`P~;)P01Thwx4e=mQ2%!Qp` zoHhO=!b)K@mH4r<UJWMt}6qC{cHLQ3fpj{Cu&H44(*}zK3^DLBr!;-;do&4*;S?H@K(8Ikp z*o^Et1e;O5mxj~7FRlE|C|k;4>73t#qB88LEt{x#&J?=U@hAt(DeY~k)z6&*XS%fA zGlO5(^++H6hED&9aw7PM%jW;Q{*rwks9JHdG=+luuWUTppnxF#K_=T6Ar{L` z8+LF+qq*dI?|GeAnrWbStAIHz`%cjKfFB~Vof@%a`$~}u<;!Brb6*+3(QAM zSOIjo+ch?wPQE5JQ901VU7hoN!Kdo-+$RUe1a|~{hES`r|AIsFGOcF3^6cjl3|Rfq zZ)rS}3v7EPaEZhpN2egMX^*LbGj=(?*I0SrtafNEME_vK>|3{qPmk+dX4miSzJ34e zQG&5xIf2wt+cA^PUvv-T&J~#5DQje*y`F#rHWSZv{kgPlhr<0YhXoUdrJs6eO?9f{ z7IC{^$hCn>mPjuuGjpXdyy)zI@tv88MnEj4`DR<&$Bsh_x^|k5olB|j*KAU7w7mVy zwU!*T^TXKH(xzp){!Q!eFkVQ*i1SR6YTI}1{!$HCdV9RCBm7eQ0XwG)F|7L!k$Z%x z^L&=@T{tUMnATGir>W}*L%)jZJXMnh!G+q$d6VD~Q}IJ1yqriqn22l*dK?bltv-@W zz5}nMxIM^bp9LJOz-8{SgiQ+j>6Cnxs=-b7$DA_7;M}u|A50=u++Pb>H5O*;WtMY> z+1J$ShU4UG%Cng{N}2G|hItiAlo#ex!}On6dL!Epa;NDhNFepPgPd#m$&(Z%ydh1lubkV`uE~4%JvS+$R%zj$m@hE$sjhU-=wlL34Kq85FKkx|jVnu;KPVo~!Vz6x?C{Odg_nji zGHXm?hqNVIBB8aiKh%YD=Qq5(xve?kfZvH1{W47&;kNz;`uFewBD^7 zYYXlI0UI}y)y&s@7(8gFTq8^zpD=>uXL$+9##3p!@GL+~8pa_C-i!u+ixwOGv@J0( z_KYPfWXv~t%)(SQI?=*tL?NjAyz|2a*|i=(NGpa6H#czd5Z^F?PIS~RP%QqetCRPu zZRX9};yM0;)2Lym!F9NQCp{1*XLVm_oWtYvTilOG57{}Z2d&Udr4G_{dpCFxbP zl5N9G^^ybX;yZALj6Jductcb;`D6|67WGf%Q1(D<-vY4Z49D4Vk4?of_g2H2dDMXdpqS(#=xVG-h)(afEEj+)OWBN!BXKzsH# z(6?r~UM+(W8^Wd6O4;E)js8xVoW~+d_Ha3{@sU&M2WzG_kh##uHMOWslzgSYshVp zLhj6Zu^$h>G6>UHFq~jvlR{~D5Uc;KOs&4(r*>j{lz^xvsN<}ap`$ z;4@2ke>~L1*Jtk|XRDXKzDzk(@HRs;>1A?zzn-^QwbHh)xX_SRZ z{IIvZDfwCapuw;J(=P!AjtSqYM?`&;Ad)#y7ByhNTWayeNPg9S-DE7}SO|#|cJ=;J z=5b2KMnwyjJ=Cbi2|xhj4Ht&XT?oZ?75BN&c9o*yyM8!6i*y>r>4f3I`O5^S(sy&! zc>bsyI>8_3G<(o143N%6Qj2e#-0y}akt@{L&kuvS!{5gC;@DNyl6!gAQ*ZT@#sJn} z$T6T*dS_q~xMBLT}q0J&IXeZ!e&dg?3(B>_62|UX>gT7|d3Pwb$w5fL8*>zG)cQmIF3NCaAo1*& zVB2IhmcpO-8)fnH^Yc{ksC%mD`kMST;K8B**Rlny^skNm4nB0kM|r)LhDOq=cUfIW zF?PeNjTSf+kp8+RaI8dEjxB?vt844Z<6P?utD%WHc>NZixpQju_4`aCIPfUnK^V%A zvM@*r$cGa2u~&l)n0F!fbBn&9;ze?c5`w~Kr@LSSd{S*MJ`P`g@?H+EIsy&qc^rj> zkU+!GuI?QQrnX2KYt_>+&pD$*FRrH?=#{4OKdYc-tq$C>^AwnSr{IoUI=?*xbj#fN zEAqnwS>3;GXUQtzPWxi_dfcm3^Su<{OuG;n@wZP!1*xmGV&hZUBU=Fw19B&u6R}WI z6A$r}P}J!^Nv%P3nyh6hptcdb%Nhr5uDz^zxZ{jTEkwZ`+O8Ptm~QxcW|fn>caiI7$ORx?H&Dx361-h!1?k9twT7~svEGRxE(Q0U&E^p8fC>&eXe z#Drrl=OeesN&ZU`|94>nP5D{p(4QKDI|emg9>aJ`CCEh|kuNLIhtc_cIyY}ys&hGg zR7AcRb1IL7%drcjMb`ypMXVqp0Y%0f0fZ>;B5C9kPby!20qT+GmVl)7(i141&XbTY z>0QRSxiArLF*Vm|;5a1}wS)w$0c?q{Y+=-zHqFq~r&Z=~=%E&D-!83yDKlLWpzaYr zsQG!ZaVTrNo38I5l!b(3lxX~*&dPT(9Y&wccNHA4t0q7+V0(B^fR#hY$>CQ4IlG?eTPzS}c*H*noKHZ|vk-mg{9 zk4FY>1VJK4T#+p!Ga24R*T?U{YTUZTKCxeiCF#D2&$UXTG8+19UJDbokLGW5sunep zx_L5_Z}6gADcBhB-)vjATG}o4&y`-VrFaq4NdDVej8~AZu<`BA`CH4g$KNA{Pil_NYxJa-UVNUn6Phwzca>$YF{- zJw0zK|4%|g+SPBXeHJyi^(wf37a$&68#d;PsPB`VH0c!Br56gGHjV)oVQcnM>w{OR zRConJrz)n0@_2_r)cORAVwkXEjjkU-eG8S!&IUc43N*2~Px)Sv3j|F(8_4F4VH1y8 zI0+v+K~n7;i!!6g%+HR(EXPMZgE)e(oLZ61_c7aCh7(}I0p=rsjy{(vC9i|u|NCvq ze&^fdGkwS}>VTIAjj3jcXrfTo>0_n4#Ml5;ZKwWaYx ze@c|FpD6DxE>Tx4;L)gc?#3ELC8wK6{BCpYe4n}=B|I>-dJNjTzu_>E`hyCLhQ@T? zr5j!ul5gBvlja30L~EDOAqdgPn?(^`V_ADS;?Fe<+Iy#}qF@`TuI%I*n8CMm#s*F& z#+9$}mnQ+mbTj7?$L60PkdtzrB=N#FMF`F<<3oFBs55BV+rjv-(Ff|#CssnxW6mvv zfr~ElbLAHe)MCJ(M)vKSs-G*9h(L4lRTC1*RKy$Y^-C+D58mz8TM(u7o zj~k!coh{dBG?%*cEPuR;Cqs>LdAD`9nL%0jE)}`Ba?N0&Y)q5}L4Oid855S<%z@t>G z^cpUI-pj(})3S%i&a})P4RzVb{3l!g=k))(%JTl=i}^Ms#)tNd8Q2N> zc&k+iKO7=X?o5F@A-d~0L!3!Zi`o02bBp5Lf?x_y&x>G%6a{-MrS@mW@0iOq(d{H$p z2{j5uGVl=m=ci-J;-rd_32sIOQCmJ?Yb5BfjmHKYtzUk2bJtZAaD zqwJgz4CgAN4n7CHKLMofrf!5|ZuUtF3|1sgpC7-9k%m?aut=KR$( zgcAfatICiiA9Jdv|3(^%AD;&d@Jvd7j45>{WOem8ImodZT#lYzg)=rM<%8OPu3@`p zuWsE8h;co0{HC;p^;dhV2TsplKm|i&pqT2BJ3hgX2bXH9%n^%Q0#|LbRMc~z$?^}J zp2UKLDXW zOg`P()^0!~zX6jLBTZ~ zM?U2K6U;|;>{tZsI<>f>3w_o3HS+dQstLtk7-iEwt@0BLL924h3?3}h>y%@GC)cQ-0@M733-Vs6W5 z-;+eiyxMVBTTBw0CEE4{Q%Y#CCpBm&QFh-1vM2 zgqp-(t_$pJDzm_XFuiPL*cGzcA*Z>H`SP)ze3~~wkG~Q8A~tTN7BAXbLJVFX%lvK$ zUsNfkE;j?uSN6X=Uk48RC-Sums|M{=bsuwQ5;H?azcws=+EwR*4n9+{4Bkc`lxs1H zuHh~Y104y%g(l6ERFA4uFv?K;A`XX$qH`rdSq}WX$20|tV_t{ zzi{iV>S?skan7+MPlRBTlYyC!j%1r=pN2zoV;(yVM)H4VId=7{xcttR%QulbpYtwe3_B_+X<7_*+jSL>Ok zw=j?l#M5fGZ6YaZM&>WL1lK!IOu_$;k-N`N#UW6W>_=4nWAyXe*&jqc5Z8kUyx=}8 zsnbwvh0KVmF}V9a$p*cV8U|o4;lZ|D9aH3pb|q8;>W_CM513=fh^t%on?=}ny_t+a ze5GgKWJ?j&3D9@(T!p$=kJol?a#P}!^daVCGFRG&y}JV@Sdj_rxhTWo{yGk$RgKN4 zM=kG~I_Px;MvoEz9%f$YvOiL_wDuhir9+7foMK5+V!4ibmW=1>SP!5P8%*8S=H6$o zgZcWe^y<-2xAEM)76v_$V94%T&;hDQ7>Ajne|)eU=y2&k9qp~SkDL7yYoVyjb}~!V zY{l8qofGVn5n)~g?V*!WMXV2r^)f&Rs$03u{$#k%pI$d}fNjVcqX-6Tk#(I&^#p~p zy|}K87TPKPxi)EAM`yo!TJ`6p2%IJ9`wO1rbswy@e|C{bs$Rr$>4IeFB!#n48Z1O0 zz&EB$_hr9~;Tqh7(wVbH4pnNv3IN!0{wRHu1Y7Xg*ddL9MUW0E2toPLtLTntd-p@; z`S(M9ke_I_cMa=554M&0or{$dkb`9(?!tk1B7ZzQc7DA6I;5;ov!?A}ke`I5;|=en z9V_YotDci!iux}8a}u^iAZDm7@@hjGu+P&xiAQ&KiczsTP@g`cuWoYv8TW?^|EkP{Z-=GaoAPni}zq88>@Ukzo2u zf3r6AG$VXG^#m9#Ho^j_3trqHM}=%~WQfLEFLg+6$139!j5Z2TXPoJzdEu!Ea6rBy z3z|}e>=F0u&%cNr411Gm5Ptt%iCuF-)anuD0!)bU!hq&6!duNZUc=qE5q#&;j03!J z+Ux_}(JmQsRlgF5bUe5&Qa!jZmFmasUDQ|a*`$9*$`6_tTQkJLMxv}R-?B9EzJ7(O&^JFH@d7n)8rRtlbFEnS3Y!v2z z5y>wqYWbqumzRfA^@C8SL+NZ{#ddLrr#InYTF|F0)w zUFxVUC1IhF{j#TWJ*%t($D$Knci1Yv(YgTk6mA|bEj{3?+U;OOUaWgHFwrYh3{MdG zQS{%3W*fNyzcOcx-jpTBzid5(&Dl3LSBZCY zr5L*5Q+|KH@b0){61!^1Nk0@*)JXR?E~*uK{Witxt|hKFA`6QZUJ(ZX9*w z+_fx|@$V6Yk}7(8L-2)BZ}9tFgWWF^(bWon!CXjNq)XF~8}r3Leb*&*8(;p0u9a!b zc*}}|bQN%ZGCkGOfcWDR|5FpdI!NDH zC+hgVJrgQ_*2BX5lbWA9(VMf&BBxcUz{U3U`m(1MzGgb~&7u0(KTClZRM`Dw^umBO zg#ySke%bRlg|nK0_TZ0krQ?W5dSGgxi9ESwcd1?@cVP2>K{^=8=s$Kct0ebMF2#xe z_3_f{0liCHiCJegT!bMcvThP}!p=K+V1p9rl65u=th?DMsXd7+4tWp)_4T7++c>Xu z-$@J(1@@N))!~t&;!Iz@ zVgdWTeQ;QOVIDnMl_VULK8@GU!E%o#xjA-e89RU4I(0B_>c5l}@7*3H8tTe9)^eA( zNaO@d618*7aL%Z}X5vt_G@0Zy%1ARtm7ir52vfiYYm?dmeH`V&Ny+aw2M+rMs>GWY zfIT@i)2`_&P94QIAT1SMYcT|Fyl^d;-v>e_96^=X@=Fi?kVynb(KmDG|7n{f zxzAmg^WPrez7d!d!Ymbe&h0APj$(@BsC%~rKB#oY4w`H}>-h`eJ?c`R@MRiu+Bzjv z-0>*ih&7a$7G8($1D>W3w+^ou4t__lP9CQ%KXh9Q?|^slMEsX!r0!Hz(QC%IH#C!= z!4R+Px;(bH;OPB11ef(Pct8{HPAJSLAk{Lz@g?;S z(?XM`aiODugC}7`i`n@@(FT)ZKCcf`!uM24J zhjjPCw;X5;+WhVEvliqz)k^HUWYM%=|Iv$bXI1KQ8p2ypriB)n`ZdVLCPIWLGWFe}4`9dNkQ; zb@ijvA^kpY3f37nZcQjiH>cB~?)Ip)0oy)kUWo+L@4W5l$lly5(%wU3-wrNv+KmMh z#t#n%Qcyx9#CKFH5O|H!z&1(EWOMdQg>V<_#z0vbJc^kfPM!{7XPyQ^HqM=W$Z8z< zc1NlG`ug&ebVRUJ_{qlA-lx?Oo7vYMJNT48M(yr2d^zwXY3=!@wW$2sHT@NRe<0|! z@o!zL5^Fu+oLe`?kgqac`Eo?G+prU|7Oy+LBt<0x-svQcxAHeNuz}O3bMK`4R-Xor z1A8~4f4N@%y#hSzxYb@2KW6qdHuV-K*^&_6fYi26IpWO-W}St}(=%1WyXrgY2NBsw)^F621^M61 zrbtRoyeHg2PY4-e!4aB_KOfx--|tB8A_3C3su*r2OtX?pCo0O3GEKy>mJHO=Oxz z$A>Z)X7b(|u59J$vfc@&(RJQavT@+3vPBm0RQdN;ry+!NJHgX-p;7xjD^&Yahh+E7 zN&zaWF`T^mn88AVhwypEAL2Z?Jvx0PjSY2@_{5y1i%J% zUo>iCezvjqJjwf&I5UghaNpPM4FycwDl>LDskzx;*t~!eU~ibpxA1ha%M$L0 zqIzI|+~&?+MhRw6+nF_~i^faQQfDAE-2q?a2HSzb1ZM$2NC7k1s3?sR_3Gif6W9+j zPOop@eTwnr3TtPS;&Dl%TkE=9UYu(vAn;v-Hn1iVu*l%%Zlb8>n|XdGr= zwxE(V;?l+z4Xpg{%Eohfx_#VDK;vC}w5&JPU$?7pwfUT2o}GF( zuzf`?3~WF>PEK9XwnA3VJddwJ)yIth4=W>N*jcQmY4a{C35I8pCSLRcj#Q|JjKF!K z4+*hE3O*v*v-SX+;TV(fm}tD-EVVsqQ^CuZKNN(2uTVzsIr7r~Q)J)h+V(4QM{-nJ zLQW7?R8M}>p?ICBp+`KgPomVmbl|Nqw@rEW`Jp#_pXO&pj_@Z!D@ckphSR0|WeWKr zD(dh^zI_s8Jnw?mg@9}EOLKZ_mc3r8JJ3M~&|$l+OJCsr4&Zq&nMhRF@-ak5+}gV1 z{h3nD51p?|&seU#l34UopFIPzWD3*dO7$W8Y6j~bCCHgO;Xd!v&DQmcqptN{Q^zQ0 zhmle}onk@^Z`YUWXnm*1#Dqs*{9!kd-5%|l4Aqf6?NWz-GB$YfKqn`a7H!X1Y<}8E)0Fuxclw_@Z`ZOXXK8HMR(E}5<0_g&_!d_fI`=YSk07K0Ruqp z2L_f)&5t3rk?`c|8ce4-u2gRV>t|lfNb@cYaAO@@{fOJ_tp077e~)-r|EclxM;Q;W z!^WMx0l7T}qZVu|{G#)feuRs?OR33J!A``;Ut*4(;IeF`(WPJ>AD{t}#u{qq>-Je) z82pHLh})?IoQ5{o!j-^u_m10!TWC>LGDq(&mYhR0Pdz#EVm92aX~PF=XuFWb)#(D? zAy2gY$NlRQkkX*sPu&S9o{PJ>k2TbK!8$%i;y-R7MVBjU%sdJ|E7zzad)Xv(W9cfa zro-kyE6r-qgw!Rp2SbWhi7C7NX*ijYU5DpCMf&jW3}q_Uj$pLAG@S0dU1>G zh;{kdk?#)Y@9frS^&FkZtGj4)%`9`j`3Woa{}Ic!AO6sDNxqH|#jfw!r%UpGI0o!l z@A$rY_&?zJI_+wZ#I!4CQQC4;Lf8fv6+X_qB1KAaeex^eV0xLR`thEj4)<=*?(v6R z+ipU9bTaQlT~mbJu}1sMkCt`#wtcSwj!bJPx%z9Oa%>;ktf(|4y8P?Ojl~Kg2JAQD z4FMlv?P)RwaEv{7X#3smGdk44*<&ht_)1^pH|=;HD{~aK{X<_zQE8urF}ZO8%0SQW zykracbqH#v?rcRC>(I4{3D*zcJ%@qRv7Vd|O^jRttxUTgYKFUpsQc_B`vrC)CLAKG z8&Kokck9}zBn#*|ua1c9f`(5gJ+7{f<`2?bU$@G@8hoE+g|qH<0Jd;XmRN-wVSbLN zONwL?=zthTVhgz=)X^*7L$ZgU*&F@&q-e2&vWg$U|6wZxHSovK1LvsRtY{YFDZkz_ zbOg4kK!4jfbrjdfVg!?|*LcRWZytWa#g~VBm)5z_p3AfDKI5;wKzEu8%JieLUXs55 z83@NoMDJI|=gTR&Zc^+&=eRT!@zCQi3%@}!n_h43ma2W|yf1h2y*JhwZ?@2}OGf9` zR<@LCv_+=vM(f2}W|TIz1={s-_0D7Y+qEn^-Iiq|f6+Y!g=?|5dkJBaR)uw3Wm2~N z8>Im^G~9pf#hYIsX%KPeA4ON4Ldd{U(DP?@PFbOPKn0xoHpC0)UNO_A3pH#9uSjPc3;++K?AqZPG{J|&nb zAGVcyFOrKxzyE1!^FGLieKgte)<`nE((*e^eTx+o^bZOtFWqmnZ{S`^8KhHXGmzq0oBeE%=zF%7S+)C>*A(83yY`<4=3 z-rF(xUv~xEOA9g96kPGODmrd%CA~XOd4KMOyXcaz0k!^I&d!uMWd0uH)$88jpHkfo1MV5V6LqiFs63*wjU-c%GPnvb1*>vKdPr5;uRKj z;X*q|)S!XAwa>F(z-?oR&g1wB)J9+SyR!oUj7IjnOG4UB_9=MyH48*>GwZBNTiop$ z08mWD*gea928xn8S3B?Jl7iw)CzFBs0-98sPq^M#Zdt8_SUg>`+$PV)%Ux;Vi8@0~ z?^V^c;=&k!7W;wy)On}rb&(wq0|<`~ny3MOakPtTN*N;h*J*V{4`H4e&J1y$3cP|e zb5BjYZE93~VxZFE(H)Tc?WKQ)g^bvXs_Vn@26~Osm?gB{a4(MC$XF9E$5oeuZFE+p z!^1|aJ2)~})39YF%hPiG5jHkZ7B6m%K#Sr08M)mF#b5ISs-pE56NhIvVTrWqCz+w+ zcFqYl{15;tcZIHeRc6N#bRGShx6wtMHUj*BNr;U3k5ug)wO?Nv(0`wa;{Z|#3T~$6S>9#6z$5H^(U6s5plxN)<3{?PP=~l(X5&@e%8u# z^11X?@1aw=A#VXEDAND-$Ch`N1TA}={-Mt)Mx+DaL~JDOHQgq49%Z-!|2V-g|}H@r_t1OD>%2w1}$#udjz-*)1hIbUZv$ zj_Q(}dAD)Quf7$77&T_s5$h}>C-)lCyw=y-jh)UIHh$HBQ^_bH8#T0QU$wWC_MMIH zbn5@mS7kbH?^`uM0u;es^X?jiOLwOLZZ5K`)yUk+jM|u^Lm3gaZ%-)=@6swvE*F{R zRb$ib^g@2wAo-;zeRcmPlI7fqOtklFA@RTm~+!AcQX&lZLCFFXB1~y zj65k7D;bqG4emNdvv@*eSSV${jkt`je&gZF_2CUyeiur)K#n!co7q&j<0hS=Mg-i8 z?B3_lx>1u=(a@mA-(foqGt3dg$22o zujXfT6A_DgUXe=-hS;Ca)Z)O6F!S*cwaK1jbAPaTXS=6p5X~)WA~OG6Hp6JGf0V@r>JAbhCvFDLfR8U@e&gV=T)n=k5=)~$M@Q$ynK&VzLDm5m zA+&g@%Ljhiq5OOMa3MQ*`})e~yhKd8I8#J~YoOJ!>yy*{B~zewfW5mhMX=m+#oOLY zq-;(P_W(RGF(#hTW*kDRo5`YsIV&O9wmQ9;142InlsI2ZdC#kv)-OE!&WwX6bGOYi zKXd=7={FB0(T1%UgC3{jANmShY&oIb_fjYT*mzkq5zAciC)6>s?>Kq%nI0{Cs0;!5 z0Th3qw{_ z;H-Lyt~hNj!5VtHg$H;JDhNQ(b60n%YFrf5f_V<49w^R$l$yb6&lItLKehk!r%keZ zQnZj5V`ryJ?K^#^bgfTa&9BYu_!&L&%mKagz;Btuc4_Z|U=_IG@K2q}Cfv#PBz6wDTMK-ZkeRg7_t0#zUw zq!M`?h8qooQ^M8RJUUljp4i@b$+^TeKWVJ6M`Tq@i^&tcB!Fb4$H@EnhrA12)MJwZ z$*0>D_AZqA)Fgf<0&m%@=X6ryFY@i_&QXAF2@ts*g4n)MV!?TLxHQmFqRDGc;KTYg z3m(cP(bV0Cuj!j96UTO42d)%kXaxD%Ch~ccjSqmov32{Tk?lM;^Zqb*oJOf14qk4R zsXy}K%&&vc5hwQMi+BzAQyUQF=HJT$T8(3BP4*>jC>+4eK%x=X$GA^+*ME7Azjy?E ziVUxLD0l4ni$Dgr6x+tr(#oO3%+|6ah-2=8cAU4($lF3cXYlE6-Dd8UqWJ3LZ?auq zVXr(NlkHGSlfM*EYldBEQ zx@ClgHd_O=O6>0C#AaxKtziQG8w0lc#$w-ViN$B~u%Bdq0So;mo39-BVLrfY6|hml zA+vOy68U7~%F~CE1CKj_J-p1+tuD5Uucn-3sT4Mr{kJKhI_S*YkU7t+5x?$59UQiH zP0_930jtb3aJQrmS4NM{gtYMN+%u;EtZY1<(~r}6Y4HI7zdB%J`9uH(pF@3%JP42B z0Lo-g5ye~X*2LKypuh)B2V>{m8g7+GitRFh69J-4B-$<$ktJx% zzePg3l^iw|-$jjYd+dx&y>A>7-f6?uyh5%xT%CyFzU|V0bMQ?<(YDISHBU2jzt4lV z^{Laka0QZ; zbrO)qEalh`qpFxyI$y_qd@EqZ0;CJOo|J;sC6CEhYYVpazBh)LH9j|N5eaR&`r8dJ z8lkoFCi4a6q!HGu!afo{71I7@`|E$!+jDpPj^0sLVt{$7XXWm(#o0$`FGM0T9e{IG z(4)+IaOKhDGVlb4?7dHg0d=5+a)q4C zcLLt&kg|rAX9(~zkeNhdCHzx(Sd09-J{QV>Xxmwr(ZICn(&sK#kb%9>VZ_#Nap*v-8Ehg3xBrIwGd|wkXvzpwTXu2IcEs63)B9#HxFG+I6Zy4(uz;Qr%^Ebd z+HVj190g17)sZJMs$qT!tq?c7zm3bH=0m{camjvc?-337?lh+Z9}%6{BhX-?kvucs zn1972F-QbdSsBM+Zjs|av+f`qrat0`U&9fbKvIxymq7Ek)aK8y?kuzx%(eh|KPmo!r6Hyzn~c%l47O`MW}# z-kL))yeqBNUb|H3&dSQ&Gm~qSdKQ2nDlG+H}e0)^FQ;~wjZ=ZT+>d~ z;%}lor+X68*^-8`L%$qH5;1NkOj=?;_)8;f4OK9BjrNw;4b0C|bH zUo-*uh5I5hXP*u_-Vpfpa;7=}mqca*8urP7p;LdRVnO}`ZwZ-lWdJ`iz0kny3WOsU z96AYyvp`S*7~V=DE-3u4=Oq>x8>gx$aA^(wuUumx)3^wO@kI%_l$I3W0vaD_v~ zB;$gBo$!vetwy4ff77NUB*-g=-TU)mhFq{qGQW$)&WcF=x{>1Y;;AGM*Z5F@y6*LT zEj%!XECL`>(ScdqMvXK}dgyfkUQg4hnSJ-%=EZSgQalESzN3Ei^L2XCR|lQDDa58V z@01#M0q6i3N53F}=`o+QUEb%VccIWj{onw9E!L_fGD@1;c_8FgL#7@M1@p=3y{`!=nGw*4x%YlR2u+Ywm#5P1h3h*Th42B02mp%Z#rIc? zjAuY42o(`YfE^6?)54EEmlUZ{6*7`{lQZx5DW|d#$SHY>KO>xoc-L17;wD3vn#D}H z12;pTt%m74kFy-v`eA?pdk}6@rR|v+Jxm=%f=AB|?GrtDFkS2s+&v#URVOuV`7IE7 zMTw?vISeZ(z$_k><9f?tM9$F~KtUcqISU~gOpOazH8P`@er?jozFAUF`9W;BKjbST zuK0{rdOog>ymKj-OL*@nWWj}0*04*$Y&U?e=zA;~$l`ZIJ!8MU$6NGaa`g)A!)(aX z4|?z4qlV~!i-$5aVAZE2t6Sc^t%SAQV{cvlume}26XPKLGQIQ|%@5E_0hW#>_E#DK z5)6A3BmxcjCArdXdd^qH9gwcEB`Dl#1F%8mmi0h;)ku@t!-)6JjZ5s3f0)4~x*xQ5~jwO?MGu4x&5k}3m^uDJS zBVU|ev|7-f)uT(+3T3I>t!@540K{KE4?pb%z8P=YZT(Du>q5&E_b!k?Pa#djDji&q zqy;OtN_A?$^B;{}VV5uLf~`N`HcLhAUZ7Wx&Gms*D%aJ|f%3O?@Je8X-46h(1?q8> zM$UUVwRAOoMUwfBG7R++5Nx{K@hLa0{XFV{37s4ZvT{67P*ZZJ7~mQm!=iKiuxqD4 z6e)eiSQs8O9Hxb*fd1kK`d0!y9PDp|0)zXFN|++EOTVn5Z;ke99=!lU60xDHZ>GB@SE9je@*3YU#w~R z!N&c29;s>ln1<(uIOBz)0A%dF8_l z^da9oGd+T}eXCQFx!E(Zo6~4;mE2jydq;7ferA64)tbve_uOd}3EB59Goo?=sqqjI zpM-Xrl6F@yL1E^@!EHlfyw5V-OSN8pqY`C3Ik|EtRL`{q@>iry2PnqP9`sQ84(8lF zgXBR&YzwX6s`5|Zex9Bamicvn)`ho2^ z%h2Jm>@f8F3#gOKP#qclh}>V1)I+)-5x^DAL#Rn{gp;@?~S3 zKhTx+AlGf7Zf-U1_d9~S&x_SrfbN-OvfyM;2*Kx%t5(lGQ!Sk>#cs@Ztd%VHTUrE* za7GS)etm=(MHM;2A8(7N&D7xdC6Fy)1Hs@V)dR_>8eNoM0&C#`&)*DaD8*R@obB9G zAn%yW$;%>|9t^)X#dg%ekIgNCloiueO0a&pC`M}DPL*YT29>bkJ05N zLxTSdX)m|ZsqzpzDjjO=cxgRq@=fwWtH*bTt@fDK zgFK(i;Fb&7soNIB8-lm5eQd7uE4Q|>JDMR5(`^&~049_w1U1!NB{mb-5d1`YFpHhK zuYmyag$J~@S4y|mee!o30|fJTg?E8CwVCHtmj?op9QzQMwNEF!SsD?9t^?O|P8Ytx zw+yIIZKr?@AgPb`eg_0Zm?^9*C!k1*K(~74plc4p0hd2ZU<_bgF zbPOmZs>L53aDf(h%iQvbh2Gq6>`ZVhyI)H!s{fh+VsURCsfjPqdyISsJRooUjxAu4 zpDd2AvubcOb0f}ogR~Cfb2Ur>7vSE7L15D8h|+cfZI=F_Mbc8Xf7Aw$nim|5G$3n0 ze0l|+=QJ#S?9{8LxU_LWYQ}FHw&xbhem)7{wBgy336Z&i5iwM+!tID>-F?kZN*Hz} zhU<^u=F%?5gcr4n&y?dn-QlxjWEWfaLb$fjkj;&TyV6QOI*+#vH6Hh;AlY?bQ~6<) zXL^=2zrp85{qFyUd5-_UJU+$U-_!|JvBU7f@jSalCBJRNhO-;=Jv9!`1RaN@IiL6525g12Gp_sy^C0p02*D+ZS+k6`O-Vkx z{xyCT7mPP0I2+}3DgS7DF&0hc>6u2zh+C6@eHhLJp7rMM?s*3KGz5@w14T~JGXdNZ zI1=0_Wc9p(x6Qjel`&OhPzisgY zZmaulk!E!w>^w4J9`*uigG;4m1HL-zFats1J_t8(3mJG+*Qx2F9KfF|+~*Dvra5qw-Z}hW$5Rd0;E!Ok5B6Y=BG}Zs>HGjy>d0JJf0I z`>U2s$d8{>vtqg7wvj!A3N4jBZ_6y|wzAfJ!7>!|77kt>RmcuB~BP=n1yd2TAixxAuDUoZG2*@ned$bj?H^)H=#i4GJosY6Zw z8-erkT9%CG%Jjn1xQ(oSP$Npp>KXAj#oR|XhK#4cp%nKl2#8&xXVJl+-xEDs7j7!t zy=5#9Kq#psBX^4Mp!oLXJg8)in+1h4;FA|ETH=R_J-8-Jj=ho zNn8YdLur|ldUlkj3By276tj9zhgwl~Dl+q#Y-?_J|4QZ+Syh{>L!a+khd^3QL1v*Y zwa4(P9ZU=Y1QT_1qt zrIr4Cj~f|QxiU`Sm_7B0I{KkE9P_@(4XA6qa@M)wwL+Q9+>#V2ZrUD*;8Af&AAT|zT zR*_46-H-4ZPLb;~s-w#ndq(pdkuIBTlR#hRmTUoK$i%2%fZ|GG+daSYK9qricJIbA`Vqt_Ga3^ zYLMX8egbiqV6vOsHU=S=pD$DoSyLwn2RyLpfy~lctxyhn z(Cx$z15nw+Cz%>v9-0l@yZU4PQ1+m;E291`7q}N*u+-Is`Ej@c>w{}mN`B|Qd7S@ zZ7%*=7f!3iEy%fv4|`S8&1b@rnSZ#yD5sD%pWLb@Sfxus>r?p1ZgbR;$Y&njh$XV5 zxuZ!io?+*o$3`lrgfGP{3Pt)}30344$oVoSGva6&zsM?WUa~{drOlYh8cB?tzU^n; z1kiTq2&RCk?l{XwXZ z&%Q&NKCPgfcqlouWY;NUB>C#QXu8g>_>)&9%+Ca;_zsSbtN|Ow#Z}BXLs9^W!+w7E z7?{9j0%vFe6*Fpc&a`D&1;qVYWixbpf%$L`{m{aX89+D;s#-K#f zD13*x2?OFiF^+}Irh9%Vqo%8jdRYk!pe2|-^`=lJ26aP%DN!J=a{P+p6&L`btN@H+ zxzYn7;OV#-WF&?%Sz1kL9@_oft; z7r-I6drQ=--Rq5(8~^SVf3Hb8=-z$FnB0U8`z6+Uu|X$}RT)aLM*#T7#K{eP42id5S`i=~@KT#rK}t-Xob!4}IoRD0Qo13ea|z053?z z4Dw6v*60?6WAfv5@=jvblJkVTw?Y0LGN+kd6BLBf>|x%GQSfQRSDHu! zA4eo(<{Mx@BrgP<8jWZlh>Gek216tABHylS1k+ognX*vLG3;SmFc>x9*Rh&1)C`CS z`SBgu&G71-V&{Jg!0~Gw5L^P_zwV=6_U7y%boUWn0P|}bsQYxVKC7yuNf?zbZrd;y zSE($L73>^UG8cim(j|FR=LKQ)GXE09wjCw{QOAh1aG0M>6zD&vh#H{vR-+z3)FHvB z(LYukz57==thWTJc<2I2W%ma5&O^TTB%?Kk2IhlQFani2F07t+-#fBnA~{88t1gA6 zjNnxP8mn9xsG}~v-T_!<5r9qGoI$dw73jzm)Qg3x88h)i6|Dg@Vg(o!DH+*gfRq-U zzslWl2%N<@Z-KWrI{7SFt3VSv`eS~inr1;n&I)W_}zAj#DlCy3;m+bk!_ zjw;qWjs)Lm4l!A(c*&r&qDC3OINk@Sm(ljdi5m8nRCbn)Ay`uMy$t&<;M#6Lg20-z z>SS@CWF^W23X)>rkE&`7WujD4H}E*rK8L1@*i(fi+_gpm`|>21vTvh6GskQFT5|+L z<$s*p$J81DM^z2jt0^!ug+)BIHW2UjGP4SY`7kt)NK%XJt7T0y$NKvL;ap8J#jj zU5ZiwxalJ5PZdHF4)Bm;AYG>uNY@KMy0ZFS;$cr)TO*&y^v0al4}OiFOGbc}X%pX9 z1-%`bxtABn+mRsE123r2^tRoy1{HP7_bBextIa6k)voE!`*t03QVd|UQ>ldoR4$6aSKDFa9dd9Igwv|KWB z{~2ib<;6{NFs+9G0n*CXmH~#cH3813q5v{UF$7-) z+2o{gv+8I=JWP(A%Wem+X~{w&k`TW80i6WfPn!RH9r}6jSQQOkTDCGyt;z%!_1iRa zPGGoO!f>LfS&qu$^)MsDVU}98l44-UZch377F~`6!l-;}4)Bg$^A?qj%XflIG;<(`D|q6`w>)K1XutVVX-P0O8ozU86T01NjZ&TV-J zKeo-y@EvGAH$9bzWduY)!!!WT%@XC|>CGHT#O>Fc4KTA%;dT&cW zGks~ABVd2tf9VrV-(lt-dkkrQhBmuAaJdDePO`JFM%uCj4K1`{-i4g7(iPujh9?8f zk8DWtAWCriS%|LC5bzy7aon2*mf=f@O9gu}b79%eV4K7hoiVVS&O@d{9aYl*#PLy$ z%ec+!;;6J^rOM?C9za3YL#Zc$KB`T9$iv(P}VYOA=09Mm-?l znixl_zBN5|A3ii>_%ygWax_{H!UeXEIp`*BTAp^If1l9En0;9^oOcw?I6n1Z>jjZ> z$f$x#cgG6;myevx###g~*hy$(Mxv$PdBd5Yu8Z=wC%$Q>0N)AFLa6nuw_& zl6i#$2u^E}-fY`IJ~-xAo!(nL=2$r?s*FdM2Sg-yh#$S7E?xz>4M;$TzNVRek4t}v zA-fhEww|ObM54W$pTPq~p(}aA2&L9OL1KJ#I%(5hX zmMk^im+O;0#Uc7RAsM~Vb(4KDPk28PF64eV2hSK9DUu`ti_ekCcGmbyM@OB`K`9Q@ zdkwj({cj(}GVdEkPG%U;I@7rC@wzgd{wO}+Qv%~ zAa>08(XxSYmZY0^wxGbO7IF4Z5+{FIYvGg{)bkjzo>a{NsL1m+poK@JsvjbPTQNqg zqiyx$e47?bRvt#uGsI-|&(Z2@L-$W->f(pEcH-K1>Go-6LYF(M%^(kXhD#O%GNErV zO`eOqSl8XERnqSwlpQy+|P74n>UgKK=QcvL(r(eO(S3N8mMV$S&hPF*GiM zB8_4({Uzhr1~QIr8o_)HY4q{+%p5OuJ@`+j+6NhsN2$sxTg~#fq3zVSS`W`nKA0-b zL$0eas($lxu+v{|2H;4!l3rg%9( zNC)oe^`{KMpv>XTau{RS56_Gu>4qn8D&NT@^RR4{ULBR%I0iB*xXo3(Aolw!52&OQ zC#eNXCX*d_nP(eh-JQ2-kq8=6W=w5YIIZnxFXd610kXFQsJEZkZ!8byj)EE&!F>eS z_bW-w5$n;oC*MqM7z-0kgu&IRA@3ox)O*JAKy z)Gfq#@khsxq&#`f>@m&h3EJA*RaNrbK8|OPXAm}zMZ9AyFCJ@pFY76*+?XH}U;_n5 zS12e|DM+dugBi9G^|V`=f0^wfGP#tG`sQX7mrJJYpRQoehrsva;~i2Ig(mD{m^p{~ zq(=XYFCoAhJXpKA9W{UFru=3nPiM$Yg)UYX^uFh#97=QHl{)!#8 zLI5tzL|`8|Veku(QEKp$`~Kg91gD>BAgMYWtDW|K%xT;T3g}G5i{IuI*`r01si~D~ zB%7e1dU4_D;6NPtXTa`!eE$Keyopdvd4)L>M9uiHIs%~VJ3)HP9b0vDsFOb%y}#ln zVGkkVz(FkL2TqDk)jO}#7*=)gRe{Q(!Xhna+i!>D3o4eakCxDpT#bA={+1tZ3A4gq zm_aApZulh^8zjswbjG1>@vB1B{8?dI(y_#!F2rkSL~0$2OrPn;G(8~nL>+YND185q zDZj2R4#EMzePT>l^B@7I!nG-q%`lh?BtDN~$_`$j$Df-wPLme?daIYQU;02edyy6@ zB&02MyOVj7jg5*@Q6;_O8 zi@6YZ2EWK0KW_3BW+?PyJ*~JrBuSgHU8jjZJ-WzXd%Z!JO9TqdTo0>K>HREULL>h( z1^o&)U+TeaV$csl>d1)rAe}_S&~h@t3U3sX4`in|BMMLXiKffI^Tt!X?RUed?>#9p zqZo4urY3OMZ%k|5wuwCuyvj3O0c<2sxMo6rRgJqH&%Yli z8r7;`3Pm=nALT^wINE&k`+G3qU!T@q0*#LIOxu?_3nfrRTHS}M%_?7aMk|svuy<$h zXunVwHqxcJ`*=*nRGY+DrTJl7IwJ9`EorcPhSy9_Q1@B++nT(^K2*-KY$Rz#HeMLA+a_K5Hn2m>X$BxGT%JXkdX*=V7+h9N z<%Zntqc%b96x)W~C#9m*R^iBlf>$+~4H!fG7Kt0*oED3+`b%l$J3~ki85N`a)`x8b zqi4RUs6~JR;Wj1xg<fsX^gW?uioW{7X^4oUkMKmhy-r0;V_GADya z&2${OX8}7F6#Dv?Sy?CTe=sZmiOwwZ>QB$^1>zsgD7eG&QME%N@Ja@}&2t|A+?4$F zjGUevN#S2mf&G(PsjRnzX0*13H14ig+9eRElJ;Scf4py?cmPi67gErrQj(*oTH1Be z+69HI=F#Q~Jwk$&^9{mchw+b0vu@Msk`L+F(+x{$cVs>{&wQpz=>R3&fo!9tWP&qn zmCPv>D`yev>z9%Xl6t&Yh%OpSn3vGl{$Q-y)pGQ6zMdjpi8s%jL7O4(vx98|8kqJ! zY_K^L<%{NOc4OYvhlFuo^Ha~{KQ!t4L;qoL@6<>1_iC2^=~J4^picC%+&p z(!8aGd!(e!PqFiHyEvk0eX?8p;z$)EPFKCMQ`LDSZxx*DFPDU)&)ojumi2olG-kVe z>m<|eeXw1AOfT9-z=1Is{b6G6+l758q=KM%n2%;J_B?;lvggpYV z|HswO5B~nQ{l`xU;TX2F(KdydP28L-NRwGgxJzRRS9-s8RQ6UH3(m@}o;DcclWFdX zk^|1OIk;5f=aZAi0ZakM2HHP@=~T@V7r!tmuX~aX3?JT=mU`e5FrlQ9%Q*$q%|WWA zmeuh?lN>ei$}*6bzF8VL!=fSvoyIzs{94 z*1_e?)KEcYTO#~`9041)TmIlI(Fj^-DGAypXg&?$*)p^=kRK7xmjb?WX%EGig23+J zQp5~mtCu@JR_KvQ3MIfGyi;t_j}+2&bb>mS3N~jUB#J4ZD^VFTFx@V9niSgdrBGHm zCDKxV5ouvks)thBPCy#fWTyriy}0s-+cm-W;K)iYB8j|5z!&2_PADSyuPflMzxdyO z9n7axS1`q`K-oA(&J@wK7MgsXd4K7u034U3&g$7Atm{zou`>W zWd@rp>nV)m$GhkhyqO^EO{NMMPTf_CYkUcRn0b6RRzl`qzvVFjjW{M?Gru3_*Enbg`p|tUMxWrJX11^ zAPI3Eu7Me`?)5?_&X?Q?^$O_Syj*Vyr|0Gk95d|k&zSR;ji75d6+MUVm^H5}dJ)cE zAUa)Y@n3uu{up;~B-ARJLi<`I=D#vY3ldQqRB0^PCUcrQmHZ}uq>!sK0hya&CydZW!EcQ4++Na9U3%~-F_4?`5gL8)4}qv z>aH?<@@+#}qVS^BA?-l9W||DS^yE`a8sjZIkryB7op_o5B`-!p;6Pi0Y@@r?RdbH= z7%fc}mjtB6Qtn$vvOC)bZYADxQi3ISu(~>Fc{LO6kwcXdWPnT7m0Iv0E7SjQLXx>P z)fC*Pk^;{%#|pAvyZS_Rf`8tITedKnM!biK{$;6AF*=e=3EMzhn%kQwup1^gnUH79 z8j@jlKH2$9uT7wUxk?27{5^<#I{VR{UJ{5UX@!>CC8YK(vMr;dcZuUJII@Whgk{=^ z%3jbj$Mlp$h@xbm!`K2>BKMZQR!ayw$xeQd%~jb}8*qobsQS%2WLi9wf#i|)m*xI< zBlVdoxs^9n5rQ&Ag+1&S8ZXiG%F*P_WZ>|sCD1X*`*Ka?#p?W9v2v+ffwIiFfszIg zo}zdJqQ|Z-tjRNaePIb}uR3aJwL^0wrD6iw^f2Y6b#TDCO1n&5z!m@AQ1aS z?4$$Q#v$3N<_TBa{E(#j2HBL1^ehUtUujL!PY|jpb;$>_)sE*WC2bvE8>_I~kWVdY z{0Ytmutx8ottKhsV4}d})Y134>GI}-yC43CcjzAroa}Yr{>gmP_G9EhTzvQqVOi|1 z5)+7SIXfQ1?n^c?u1BEGh=Ls-BcE*iWr*U%@?IqszfK)U?K++9QfQOh(x&Ba{k35a zz*`tKwQ4Ifug4Jly@q9zqT2Hk@=sc{i>|mY?w%vLBi|}kI>F`;$V#bw;fGy@dc|b& zKAM^(xqYvAL6<{V`=uX(ChCk+ZCxNCP~`syAJgC8Ha!I3_*9q(SiT&bBEU=_mr#sp8|AJ`xn}p#zC6PzQ21$7FCS zPDPNpMT1gCBC{?7qeealDKN8O9r6=wwygXA{Z~43j_?!z%;in8I5Qnnx&}9*hc#M! z2qF)oEHal84ZVJoZrR&_Yvw}~$Eo|w!X0?1U$@kaqlM5ws%h^e?lmo6*z_^`pN z_YEPt0R?f-Pl5yr;xIT{RywE5AEl0_#=4$i>fW7Jno^s#??{eoCLWK?-DOa(MDy*p zY3~pM%a97N3`t-i-fqu|$DkH!g@ukocWxc$2mQbIXe@v9XhQiDST@!k7s}2`oAagW zS>hkP!Z(ymPt){LHi$R@&r&2;UaOwy+11p-*uWeIP{Bof!?;%n8de4Kk|r}cnAN^$ z>%)0Wi)>X(|LMZlNR9Qr73s8@ZaOcPWT~ zRS{}B;5`>p1ka;+ev8QQ4+(DSn7P^97fm3BoqX z644E^Bi_{1EgUfkr2qYubjFoG#;)2a7B0W+{?l|PWuHZK$2)|gSerylUW~50NABB* zK7vdyZ!#EhPFeiwM}3fGrp+q*OUfyRk#Z(rp3YM!G^n1|Hx+L=2SVE>%cFh1bO`sP zgG1=JFSX&-rCZZa1@Nf9V0B3vbng1my7?)JJJSYo1Y{%m0XY`cPGOgr{`;qK<{b3b zNJE)3i{KEwDWPI&GeUfj&{{+5Ge5L!hL3Iyu>XxO?0{<+J`};bcOex8&Ip!DW z%#vw+IUKzaHvK(K3i2k%&VRuLlCZ=g=IT}ut4b>_lb+UjYH+8z5wB|Cg^^c1ZKegK zuJGiGB_R-9c0g8}t>R+#8+7r(U+7}1c)UHJC0f1lTXTZ%J3dVp?bXP@+*|=S*PcS+ zo}|b7^rhJ#El3%}{|knf;9nUd9@I;FXW{rQ#$AABjR;2;mXUncRz9NQP4P(6KIhLX zLV%%z$gHRxdU+(B*CBa(;?R);qM`i3n2fp4-b-GmF)-0fXHz&8dEhw&s(yy~w7v-T zh#mfpd8w}5C}@$yEO$s6!D$a3`V-5Gy2VjY+Y1I|yV?L7 zglp!MR%Lyv1%;Og;Q*C^mxjHa3M4CtYf6~8k(6QsgwTZfk{v&taD1JNQ-tzGej#ka zL9fz*<=GoU_k=4zk-UMfsy0)P1qZX#d~vaNvZ^{OVbaC%zB1b+3^n;fxe6mBthUED z#N*qq<2aQVSWXE*J=x=m;wBTQqbFk#wqIc?D3T-Xt&pa9bzcDI1_lw%Hb4JQn<)Pl zdP=_cQzBHoF4CV(zLW70t(Ls@UE^C+!ls&bvE=d*w4@!)+4b8=pGf7;YJ-WWv-W+S zc?!FVuXCwQ5`~vXN|S2(`3%--Cj{!YDU^-m8wQ4@#h)KFWh9k1llJ@Ntpai{-60Kr zlvAx34etd(2L+AYN`@83Wzf`FH~-nxft0zkC;XrxH>irQ8mO#Bx}#yc@H@*U9HW-#E?fiqD9d7CSsq^$ZfJkg3y02%L)6 zh)?L^WV#D*nYeqBrn3*7R?s++{zNjmwJK&XqQav*;=qG<)L19+s*ub{?7W6V;c~6orY5aLQAN zunHfJeaGIc579T;6F+`O>&-;ods7CQLAo=GQY`CplSjc~h0y>F97aZ~CEs=g16y;8pfm6FW4KdVH;0wKd2Y>Jzml>h|_xK^J zhujW&VgB61$P-%f!+>en!nl-%fEpaMD9~bHkd=~g*U8$2Akb$JA@UZzKs-}i)2NiT zWGXNzSqew{$r+>`%JvqIYefe8a5vvQpYJe<81;qm4(W?R%lBE_iV?(_R?v+1&(#0I zbXCrOTCXa~9P_16uSbX0iz#NmeGyz&5JPjY5B)55^ zu-{0hghF-NlDqygM%b0MU!582INqc&>PI6}<3xQUAR4AorGi<~eBGe77c~{z*frI#KbEx-k&0*%R=I}~@AClJC_!0sU_}W~> z`fG_%Jx1Ewg?nZy5+m@|DMGeLjwsDB^D^(~a!=VRjeWl}GxzVrk>~=d?(*h2x8Ea< zFwMHxlY5344mDa0njpl#AN#!iyg0cUW3*v7yD~;Dgy3zJ{!57JU{;2z{z;*4YPKB; zQjELt=iC^`q2L>od(}9%EO;f^dp_rzE(Aao9~n+ERN1r^^7wNNGT0GzShB-126bUO zU>%h#6e+p;Zvm>&%|$0IBm6rODDjFVh$~zYP)h9a&7os)LyHeb_>^ceX!t2_SXP&L z{!4rMmuK_OKur(fJjh~f&|pi9w3lzj{P5Mga6`H zWW%Bn56$F|w86`_U}q;a!aeGmow$s>7;f;jL>7)s3&JIDfN;sc8X}y>4MSe?D*`9} z?yj6aptM+DM)DOJXuhG(FG%)RyridyC^TpvD4bZ_tm~7yJfm3wcSkP3@@cIyM6)sjZ-W?M+oy>uO<3{ zbTaMcQDV;EJ?qJ{^0!Xf;6r)Ze@jCY9{H|zBp^e9XRe~7Am0o65Is2_UM}jiCHobqiS3UXB(#7HKhJ~uJ8K?N=bma%iuFh z3b6uiX$!+Gjhaoa-A@>HnAX*%RunZnJAfV20*q3A<%t;XeFt*8-+bU8Ea#ZpWEKU<+D-}bWg<7%Pc1KV*kgrs)rn2rxES@*$)VUwAt`C-9nxp+sIoRr z?nJ-+YxvSzrE17}FvX(1*mc4xVf_}XgyZ^(b`J!Lc>AV!NmWkT(A2z*y`tyYyOkxc z{%*3im)2(n;V5bsXv^Ak;Zww|6No8%?rvDa3~`2q+Z6@X1al>K3rGr){NlrLzK@e0 z*F53U+x4I7H$u-kzX$zA5#W{BNjAYRzWSEte8oPnYe%HIoJlSe2CUM>%lQ9%#Q(lO zl)aV=*vTQzL7wxxw_eT|8L{6lT#qn-E4?u1g7TcmYhs>t>6^T89SU+k`IVJ|6hSTq zCVrJ(CSRMVxc_?KGaE~wKZ{%k(=QEX`o)BxY4!M}2!TYjlhZMY!TG@8YmdN;R~p=? zg>!uC8_m!07aZDN<_}t=?MU_B`y=-N;FifQ@{fPX?f$E;6dDT5MJN#QE3vkK|Kvwnw7Tf&AJz=7L5-^FzZA>KK~025OQE>Hk&FdVy@J;It)Xh$BWfR?L!=Q zigj^U!VPZYY@>a{t?Z5RrvfXZ_^iK^-N0!g8ju(|i!-kaS=aBHw82)<^xjJj4n;iO zZg`WALg1~K)7|Q8w%x#(PmI|Hlaa+geyVrehUd6C2j016EFuxv?<2=E}S+uELJ@~+cr{T{p&Gx=eUnE*o7o52~&?C*}$akJ4ZQor}L*Z82# zXH?A*IWe|VU_E*c_i;??R)VcV?mS9LOq%d-wI@+_P_exJXrxa8&bW8=7_w&GF z==H~04>m~a+r!tXE_J;KqTW}GHEIS=KWEx&DxzffWtKlT1I` zRIU|S>>r*EHFIBOf~`RMR3;h-uBX+ac!qfnfG1-nL~YTr7|8K_Fd16rAV)8`biE#4 z8lvW+pX@Sh!~N8HSmX?P`B1;GQ)tx;I2+r1W{lse9rbOy2pF)l6u$w$ z^2dDTCkJ{=pTL}#JBA%58iv!`R6knz(%A*PSo{_nS^7>PCCG&@Yt92sx35 zZFwOQ2luT^v)V?pNvLxK=UA}IY9GmbS2a??f%6BJmN85qS zG!?xrkzrF=d5l6nh*E<`Wcd6*KJ}ytSvlJDxV>BeUh>{)U_d28&0Qq7YTpf5OA?P- z3HTlN2qpM ztM;$C!dI;d8{Phh*$2RuOaInfh%V{hlaTHNxoXA2PuI7r1eLU zFUgPJf8fK2-!T)gSUWXl0)GExy#F5P;u~b!A8gZtj5u?1!K}-_(L@wcV-|4~W1p75 zKI?X-4iL{_V}i-00^uKJj=+}7GF75(@Cvq37R3qcky5t+QSK>@iwj9J5j{efq_)Vb z#42WLj4cfoU~!5)GOxR0;b^13ayC(jU5)*E!<*hr?_w)b`?tIO6*gZT4i@%89OHK7 zM`&}^zl`_L@mTAlR!m{dbl{t7{O__3A>_M}&EE0?;7&2br-CPaOeaU5`1rLn4{$j4MYy-1N&Vs}B-D z^^Eo<)oA|MqWGG+W!$XBr%gN%hAh@~{j#tlFQDMe(5a^GcWGZG()P^RsCd zd>H%T!*W0cZt|GHM1ZbCN-gr0x{!H zBW?JSQiYfEjzJ0G%vtbmVb+~#m+dko|R*$kT9I|z{AnYpQ|^`+w|mV7gZT;@pW zaWt#nc>ite_V(}@9kk5Wic)QRzF}Y5+(>Gs(vBKE2#QJ>y~jn2V3 z<~ZhNuW%Wy@|GU!9yIRI7LnQRdzNnZ4GTKXp2>I!6uOdVQ zfS4aE;8C>PecVK`b}X0;>0~J06#$;~&Ek;qM@M9&}7{^cYTjJ}h?E6>!xHmkxrg7EH zK$Zm$ZL%C^oU0L2xEFlfNFBX~ep*xAR&j+p`MR#I`YQfZ zb%o15OJQgI>e_gFzrgUbiaU;BcVUC-B%C0EeS~W)`&&ccA$*W6VafGNRu6dg7b+UM##=cz>>I`Nj(enddj^#@?`I zKaXRYebC9O>{T9LRyOeVn}YuPm>WR|sqnio_dL%@-*_f9y^`O4sI$`&_C!~_IK**c z_@K^C~Dbj&S&x7nJATS%Q}AvI)G2WCVq z?c!pg_D@Z%pA+at&8KlI99~3LwwK*DOEcb|IX-xuc5y3){2GC3)`k-w{(_!e_FIdD#H_*EXa+JF^e#M8mb zrYsGf8cE)y9CC~Osk+1c>B`h@;@pk!J}dN8E6ktpB7TlFFb`)xR>|uiLt37-@xFpi zX83;3K=dr%n1H7b;{^I9-8HQm6rCIkX*K>?=sGUCrt0j?w>7+r%^d<+z7Hnmbj+V{ zp0i>3HmY`E&MnH-Z#9V>TRhosr*ly&#&(x~o?MsGM3?=xPAIA!$M5Aktl#^Yy!>1% z)NeJ?pi$~9j;nDCBkR%#O{iZJFkRxw;a=1w&<$-^PVv1~())zmuKCL(77nkvlV&r{cw6SgO1OFcYz@Qthzhh7@3qASMJ!*N-99-p-i4$ywbFE*=d38X zIbh!@=j}h zAJB^66VU+y_b#$$?M<|J*m1ngc^7-dosGR3ch#T;#=}(9Tk|uln%c5e@{+fnBvE50$UAdVT}E)A?(E!S;F zd46es`FXb0xV#nTcqnzuI);>IZX|bR2!7a7&>p&8qT;w>y`uoTTXP_Oehq{Y1{Pb+ z4YKnoeQ{IH^CzH;F4)c$Qvu#X=)3Vz+pwaNq{*k_wcBHpC?iMCngdqK#Qv@dXD<8c z36Eu9I?nv6nFQDTxW_4oUXg!MU$*tWCrzCg0yz)r@!ahl+&P2b_!Bb?O zj7JlQVWb@<=L05s8~dHXx#hgxRA@+lOL14MW6|UWZFZz7Q`V)M2aH4q(>DbSKFs-j z$ReTpauZHX`mQ*30^R-m3T~tV%j2JKSxUd(GkUy&+nSBP_FAv1MpVzfxpGl8*C$MTzX%m_scdw9N+MG%|`)MJTPT;blPUzLM-$c&c=l`vrYp?D;bKi^6 zU>57tyAbC)$@KXhs|<>O2{JnzhPP?^6f!Fe{{5)RX*&81Z5&9cVLd4X;ei@1yJ5PG zX^NIDw-tAMY?k{o!c{a5>X%rIbWk8x@<$p>hek)k%I4ieNw(7axoD71NXNI=IO8c$ z??-N!8v_G~fW?UUXt@K~@xHgdbg_l@V3~dH)(XcNnXvtZL>KkWv`zNX(*8+u(QwWx zoDO51od5|Y{1i`rO|_3pN%&l&slr^#SkxINRP^%i4)>QzTwbX-qXnxXqctm@Gs0$| z@;_b>tLeEdb;jw^&{mQocu1J1wTc%KNmtgl`;P^->dw)bl;ccdW)J0KuwPfqmv{f+ zV3wxaGBD0d#|h!n9vwH%$SaVo4$ei=^{YlW=z}Qm3Mne_@EcvINxT{T%`%sB)C0)c z1J5Ft4p}93bVe?2CxM+p2l=)5Vf_2YPC>-HgGGXRzU{aNwS6jlgIJ4W)~-vGMg;d4 zCqi&ZVIO-_`rkojo9mvux%Qh+P_p8(tbq=53;KPN)iVR8?Xp41+RH=3`G&e!o3Jn7 zBsP&BtqDWe_McFKlAh>R&Ei&v?TusxOI~mc+ixK+&5F72Ddy@5RxU1-5;&GQu}HB- z``QY9@^r4L_hHufepeLU*_WZJtQO7KwiBkE^HY7hJGIrECKklBr~q%h!0^t}_{hTm z?<{4?r^uoVD&^zRf}=13${CQ5owdEa*c)X2wqd{_$`C9-+2K5xn*7XgT~+?$?x-)z z;7^e=pnNymI0G~Aw0z~hm|f_cx_tscF(tjQnG1M7rlTESPdey)IN0{(D$j+qG4hRG znzbJEI67ol7|4!`Li=*9ZtTBhD#t;{roYMgu5OYFA`h5~k6kaem_OLGs2fD3?hMs(~d_a<~4`O?RUqia-AIm8jlu_2 z;E`Im;m7>5RmlXh*iJ02EGic^qquB={#d9PB$iO8@+oSU7J^KTRWs0;u|sA#VCxsG z0`+ea2v%I?Q}Q>(+SJ8kfy`!psrMmmTw`em=UwK_S`R0dr{YiQyn#$I8`X2VTVeR~h!cEGWM^Le}<<*XDPYalTthP(OCD7*5wQO;oWR-DV!u zs_tLX+6a`Nes_o}+`Y_n$QFY3O5xOnwP%R~}xPba0u+YC7Ox%H$A zU)C;SZNJDHpiBI)s%*w@w-%t>Vyt_H0d`h2a^y`l^G~;gNjmngi)YV1HMzCMqP&%% zwaPJj^GgYSh=NMi$^E@dKP!`@=ByLiP#p8%?Df09_2cF?+&@yg`D$g<4HXwcF;J&8|4mX4J(q2t2&YN<)O-f;i=9aV0 zQQ%$JE(G*)?HTOv_v)#J4-}b)wN%}S|RuvwZWjM`-; z!t^K(?>6K2ol;ZE5p8vd9_L606)%omM9qOahJl!8)}!Kg^4JV@-}SttJl~ggi>0MALg~c=rxo6Nk(z23RuU_s zKvrE+fTl}eBjf7jSr#MuksDE(E=gdI7}ll`cgFj@3EgOI=9YFQ!ME(!GHf}1F1^mZ zQu*^>a|UEA=TR8cAAr5>3>8^@mq&cwj0`YIXR4{vnyrq41)=%cB6q_BF2e7FXrkK~(&1)RVwm7lw$h+vmgw4ITBR3h_p z74_BNaSE`eHN;rmG)UQ`VvruyUpYoWDddZ{_PQBVbr6a;^NIRSKwr9Yb6@&!ys%$% z0sZjR=Lv_bamTfv2$%f{++Xx(sK&nvpvtjZceFUVK&&*11etjH>RP+=aemXIwsXym zR5o-xj@z%MqGDZ%HuCJ%_*@B1DOvf<9DatpucK#TJFtsTjq&|Xq2gg`d|~Q5{VTc; zbGv80OBmt9v#yc#pIw}2P{LBi?!OxR+GHv-?ddiNV~vxA|MIKfYOnauIX-rM-74z7 zr$CWFAc?(&&>YwJ{FUXsPR4#S=QBreLg&D#%~iyv<-B=z`0o3&j=wrC+a%_eCG56; zUC)lBxT3_l>bl!6?@ZX>8-w(5!q!l=SJ3oCmE+H(T8lmUJDiIRaFa^0{jCM#2)PWE zM>V2yJF@HT-$8&f9ZRA_5Qu1&52jZ&$f<(St_&AiGPgxkw7Kh4?76ol@>=#i-dliD z4Lfm4PRWlI<`^CKX$7G|vJYol#I-}=8q6)@(_m)wat1-ZUm+}sFX}&fZz8v<@HYFK zttdnLcSv2#%Ny}v?y9lE?PEFHshLL3X01`u#T!@4M0Y2?t4A}6gY|@z@H9nAd{WkH zJ}XBT?*xJ!5See!rb%D$Ln0@g0>^RoiGR^=X&sb`z#kwb*HSw?9xHaP1J*)8Zb#ko>%(KYJAsK6zjTHXgjOQ z@cZ|Ttb7-%l5u9aY>|)SgnWWaePW!qsi|tp!YaTnKbS{=rW#9*>Cq(aJXQG_id#Z2 z2K;VLlU5x-YQWoJ2>uZQ_4o;xtzY9shf_BneMOFo>)f-j8?l?p)c)a5QJ~%6OJ*_g zg1GsAk@nV6QNHckup&qaC<=&_fPm71faD;GptRE6ogy*7fOLb1bPS+?NO!kL4lNBs z4xK{|^HmZEwaSa*Iw*RPB~EX37b}iJ&sCmSWJi4RD1hps9q%yvrt|x@ zAdDW=BqO2bOP#^5gR4~K;;=`(+w~1KH)LFNFd_W zErg^-R&#AQx9=9(L?SWt|E|&cEZ)ZaIo5y{qs=xX`vbyp>pFHi!;2TE{}fi<1NqK) z1F_pho5Z3viQ!$`g{^^b1D>AC4NJy&JL?hzoT=0dLA(;4&MR-(eB*pBFh69xJ(7yC z+-kH!F7c1YVY1*}*Z0m6=V?ugKR;t`iJAmGvzZvC!hp`W6ZBM;9`=M2hnpnPfpl&i z>xH;#+76ijC<}zQM@i8 z^!|Nc!rc@D+JT4HjyGkqPNit&Bdsce36u3(DN)$~(`lBSgJ|@UQC|$$Lz^yw8T`&HeHF5#6DCIGSR1dW(JT!QC$T|V(%%E_wj89|R9Y92tdHL!3_2lx(>J58@YI&+L4QQbGKQOnhoqjf)1vM~IG84ocXk;-!1Cz>l8 zQsCE^qd%Uhamocmm~dU*@)2FXo^AC>WIX4f?L^s|o3})il$A+{t4-n+CIU ziF{qA@j5Rx7#XVY0)a@BCpn7Gol<5kz2TwdGMT7mTr8DpS)=1Idv5-XZw*1@a|UmZ z8~hcK%Qw8BD?b+yeZ&88coqGFS7 zcftx)ykaPa4R5I5yO7U$UwECj=LR9i|0Ra`EY9xzXjOa#dr~5KEcYE>gG}78 zfDB$=|E3Y_uv=*GBC?W*>yko9v0}uuF)(@7JLqxb}c;{A8D;EVn`gId7oa-3Gr?g;s;hiq9Z@ui{*5l;7cJsymWec>F zD(-U&J%0FEgBw5nyBYn%@cYhN(B+Pp*G<|Mg>QM#2#pdbnz`1sHGn8nW|Z^YP*CTk z{;QEh3s`Bi0j<#B^H3T<@FnuWyJQ(#i2E8n&)up~iB=}fKK}Pf4H&TkeRzZ0E;f6Z z4Ud_IR0~ygCdzCW57z%gFR{gT@0qYI*3uxM$9ddTN(QYv;gTPJ_`rWvn9s-(+e~X7 z@?%|`5R!NNjC@ad@l@^C2lEfsUt+l5`{9rXf3pardusE?QssLJG-1BUm-wrb)o5p3 z<;<5&r1g*FII94_J>E@XV)%rw{(+#v>gz-^`?5CrQ5Rb$A z!v7y#EK-!N?RDQDK44fpRXB5>SjMq!gcx3j;{sG4>`9Q3fSkSXx!z1$} z9MqVoD^q1W+r$1VB2-rWe~8fFYY_8+MAF5VL3Cyg$bU-3*Uu&aC%13c{3X$r0>qin zq2UeJU`^L?)vu#sIkb$YYYtHUHs`U=Vjp3HY<0R0N|e^n*USd?OHg>3C{?#kR~ptv z@)@1hhhy?5D-zZXQ|dXL*Dl+)=`(d|od-|Gj5chS`}7_n5-RbCc>vsS#%8B2Z5g;|vdDX@s3SK7&S!+@r|nAqFS6*ltSp{^x^N#D@QYK3RU~J;bpiAk)4(Z%**Ho;{8>5Mzp$iZmvt zM8$FFabChs8&Py`_UXvppQ@u*A3$f$T067ho|bEA_Z0MtuTx1Jo}+#i;hJpR_M|6w zG;rDZW<$>=D6+8_q1RD1;LZHAtz_jE#A`iLmQxxR8Ym?=2Y^+6<7t(G+y{EMcs=pY zx(__;AAGT`xQBUR9&xIe9Eo{mwFOZ%w>7-Mh1X}`Se-I{diPL+`1q5|*ZhAf%!2m7 zmw)kOUkR~Tx3rH;*7QV4%vh#-J%{k^^ga2ULX@A>g zswD2@w=jo07NHArYq$0?g$0qw=ag$0+4vM$qSk2eZOoZJ=!Ywm3oRF``Bklo9ct(O z%=$B_a&CN$QZ)G-=f2~^{tT$&s>zni<3ia~1~#<&%d+)b0;A^?&t`d0lxf9rCU-TCq-_Myo`W2zTiJ@-MI_O0!vBQ^Qh zeTg^v#kXo&xPBQH+_UTP(>#Vw816OWc=w0s7qiLY0EM%O*jv~GnZd-aF9mCgbrhTZ zGA!{q;$jC~QApiSaU$NvVh2o+MKp~Mh<$fA;&%3k&fbjRSZR1 zydMu8#V;>XZ$E!8J6UNLhtH(|wuz3KtyM@>Zp!_@)DeY4Na6O9SnODTb$kJP-D{^gaBt135NhK-_=3|1iqO@mym;YG znwors8PCo&hM+fzHEWJmIJO&vA>8e90vDPEmnY>FTfvtiOlrDLPH8Ffw%9j`sUPAd zG`34>lv|d|CO^ZsO_+S%>|rqz>deyYk>1A*JCTF0YQ7GmUNSl6LKAuu{(Xo4JrMas zf5qtX%kK_qvwim?C6(x6#~Q5Ks+@8wO%~d}mjejcicdThR?a6t;8!JQ-?>!cU%2*b z)2XXOuds2F#5Wy}uVL~Qz0(>DvR!!u2~ed`aGy4A+)9`3L@5BajH{2U8w z)vB~5+UO_i0jqae6ZX5QzbXHq;KZ5!(Ar!dwDT~;C0wcihJ+4#SL1oc}NDA%SH$(OZ=$%+jZTtT0B(f z?kz_g^jW=`ng>=D^M5R=pJc8|YR(70=mK$4%v3z;lWy&EOy^2W#Pf{k{k3tK2%$CU zaj(m@Em~5VE4t%ke@MaPaATZbW;`qWb^LAOvEwl==I{t+a^&{X zjV!d&vl#qdJUtG02;&VPn}ds5SeVRWqAX{Bb7*qJB8fo8Wn=8lN@@1ohK%9F;Q-+1gl{C4G;4PTpy_k|ggJRoG<8#PwPTd!2_17HGczVpp6|?RwEAl@`k`#Yn-aDi7fX~*NxA+Nr z-WTjCkf`~DHSuz*)|xWB2+~6UNpB0-*ukcH%flh@lzdtVr}1`Z^_SgWZ|~zk(m71T zf>?7ThgV1-UZGJ{Vsk8IOJO8ckIKiGFu>j6cPd7QceKFnrm59@@=2x+Cr3Fl&*!6~ z6rMdVXsVs29*bTV5?gs=<55(b*0$Vw3tf8+68Gp|fktd;3&GW3dQ@-JGz86s3GOgl< zlUchwT`oKZoWPIu2;7~e=U~&IV}dYH!S=ejZdf&UI?2%hBZ~qEJ%sh>Hu7@e)iK*> zR`Sp9Fgqg-)**3mEb_nhEA&93|99Pbw|BM99P3uH>m!A6;Acs!s&IuJTpe1t17>xG z@Ny`-@AFX{2jRxu-X`xG-{m(aMra^&CO}WUk(h^AKGVlS+|FYd(JZ&@^gKNm=l9z6 z&(o<@1s9yjg;u!j$O!*aYNy4hL)WEtHb$I+O=4l$kMbOL_2(5Q?y-HF4#z^;XEW}H zLciAG&O{@1OUrx8mFgF@a4PMPoN!ph$f4G5 zGr?q`T48F5TIMhz%aB=*^eMaf@^4g)oz-Ek$u!2vS#Di9jm{qrg>;1_ZkUyLc$J=0 ztxjxWpN#hv#2RE1$Gp^{V--daQd*4`M7wX*>(RO$N2xPV=zR3nc4}KfY12GTe5&1e zXHL{nOwYq2?`*sAg3Bhk7Uj@>^c6DgnG3^z)pve{VE#aA<+o}UxSW$se{B!h=}%B= z?)G_!JZ`6kmD#xO7q>6XoYH=7CE0#N0@g-M)VLs1xG2tdr1sG3p3D?U_t*avav_uA zWIl!qZ`En-d#=S&4(ak8efjBa=b&yxYGHlOdVsi@QcG)Bn!4@@499PU_j9u0cVKVm zwR<7k)F-P7g=M30JOk_ROD`e&9p64&o|9xvqYJCf+V{T6c$#NJ$MzGRS(IGyj*DRT zYt#g)^oN&JwSF^J_3;;(O{7Y|Xzq^&Pu?FhR%NmYdq4NLrn_ki1&)Hj8S11B^rCj` z8F*LvT2AYHVmQYlVdW~FcGdH2w*rQyNRngtDmeFKqcnTkz-F`lHPu0)PL+9jp6+?@ zFMQO2SZrUtbR+&FttYRz3rFL`6q103_a|4a6!|;7@kX9zy(T$_Cc7K8+CJ?}u@P>L zR(8bshV9Imf1Y}=#J(q(4d500uEHk#vAG53(DAMS$r>Rv;9$kUM;S2MM}zUbCkfC) z>r2zxl#7_o=*`N9YuiLMdK@x6+c)&$&Awh-42?}e_H_?`o}AC$UDo2?hYqH{bhqeF z^H%0Vs%F3?MUkQ8TyNd8#^1A8-}V&uyv5%HK&1rn zU;O;Tl!*DHH~-s7;QEW+70qA420Q4|t)BR&zLICoPlrf6BZjc~1DZl1DLOZYSW3t6 z+*%cY`GlD3l!(4dg$KXFcHq+M13ZLCKU3bns znuVM<9j`}jkRP=v2OMPJkF`>W_;9{YItjS}xgB&kkjQ=mmicA!9&b&4fBZ}4&-<71@?ndRQpAR(sbhiwBfJzT;p#1G8<^_7fN?jLSA_5oGsNptq0 z(u>jAX!){f2rpKCVdKSbyoJQqME~@MU=!h^{@A`mp=J`UhK}BE8UrfdyQt5QW z8`Bjey&Oz-=Z{|be-b{pT$df7;B!mvpQddD6A(PG-|L5C=L6X;cH0;?lf8QiW6QdM ztdE9~lLt8XUo&Npag>FPoHP@a6l5Ki(B)|tlT>KbOT8>bdIxO{^IwOhVbX{D2H6@0 z>4)xUM1m^z16p3t{wVZATxLX+qMRhzz?~#ur)^f5yS(ppd0=<4YXS+Gx(MZph(dGK zJQeLf5DK<;y~af$IC!s{Nd^dU88CDedpZ8 zT`9U)`j&2;HX?rLV}GB_@)JUw`fPId}yP;Th#Cv2t>!sVn=`W4oahN(-bDe7%SE`@PK9alZUs(X(UgLItx;StBGonU+i0K>E zqOVbXggDmg;O#NFO*YIJDQ4Q}uoTov62}xV?5rPyOFPy- z1<%l{8X$Jf8td(i1WP7EFSh*cjvW#=(sk7^MBI}VHt58u`bI&=tRusW(PrwElYV69 z{sU{1RQO!RrW@T55;2w0X95#zk6A)71yZ6;YO_5jWvMAfqW{C87JrJj7-b+fS#n$P zxB7XY`gz=Y>6HBK+8+Uk!7y7&4u;=9!NDG*c-`7JMDFN|*I5jGt#VBvFX-XyvV}|n zNk&*{(1T6DE|qHG6~M0ZN9>i<#*23 z;k3pH!$1d3&_^-+J-r%uWxNu|UM2}WGBL4>UtT3)9aA1Yci3t(auG=alk5|$A_4s} z{y}||-mwMQZDg#qrMYSHl0Oow@0qNR*zg!GO0(@r=!jXZspFxZlH{58s11xe_BHDB zE~J81{K^qFnK%CwA=cO@=AI;r&IwzaNIQrWz3`(L-C~FzwcZ5q7W=`;w($0t9e)2t z=^L4bWvS9Gm({^>t=E)R{H{v{qc|a^w5q$+v4;4lr%B)p3 z5mP3wJB>wP71)45tU5$qgr}v-v-}n(4!xv4Dc^wb&0@CrN-`$MGpc_&a*t10P1@Cq!>|0VVZ%A@%Lbdm<5s-U`WJm(HFBPN3o=iq8niRGj?8b` zod*!zLu7fb70ub-@PR6`D%4;8`Qh-%MPZo#9QE0@{Ybo$z-sz5#WTsT;kGl_D-5z) zXf{%ZM=|zSMHgw&lo!aK#Y`?@LQ(NjbwTdb( ztI{74JCfw9@Wy!St?zsO>>CC2{0}P`K${q^Jjuou%f{3ptI_T`s(bk~E4lnR`ZJ>0 zLY#4C>f5^Y)&XZVs0;6s0gnskuf`v|EPB*Wp&xM2E7_{>>lipeJKwsST&w=dlb3a( zmPwxE2PSwfk(hUpo{mHzrr+tDCvxmohT+?hQ)K~b~c#(D3Y+%G(de}bZCALr#gnC==OHv8XK`rkgZ zF)4mAn32`YXf4CMd)ysf-hd3Vy&n3R`*E>@9{>;e2zRj9E`0B3Myh z&jaj7?6>A944+a|wJMBDm~y&{HIJ3L<81Y66Royb;C0b|51_Nyz5e9UZEIc(c1F1} zd&}>|RZk&++>F_tU&)&f$!)$B6kZc(#g#aFo}`i%IV&*=;Mt8^f0dV}f=6kFP%?zo zK;DGW?+Ao&GU%qe@TcF8*Q*$xWppysraubJBj8ned~>%p>0FpSUhT!iea2V5X${a) z)4^I7E-p?ozZ`B^nFg!1u_ArXiT%~RW?Z_PJQ=j0p&l%4$Df!sB_EN^3tGp0P3;PH z@403Cz9N)BCp*zl8>+9{7w387g?d$vVLczS)*;{wSy^L;&@?K0q7Vb`SsxrilisOn zkdaThu2m_fT;sH988=*hAW1?-NB*9>kf9~`E{jHUd2Qv7yk2vc!njC?E>pBF6i05v zGGMC|!RMRdu;4Z*bfl?g<~PIIkr&iP*2AUO!0^p{4-TeJcwm@Yc1Z=UI(?g+FXj0X z&XGl%Izn`83+?rb`0^?uXWwMJ3@2+6O2@J4;XD0qV>i0RoxlUlU`ZZbFVOXUT|op9JN+0lS|H&?c2>(I&+WDG zw7uhd@IqZdG)p6^Su(W3CGxZzZbxFg(+H+GyBQ-zOiybmQRNbi^aitO&4;B0T#)+x zdB-d4ZLPPYQCh+EwLFGwCy>n}kXuKxH#-7gj+0CKP1?KvwPUsdrd$o%ZCnbjaGG-2`h8bqw(|@1qeC}s$rI7vpsX}npCcvLL!%idBSWY`quX* z5f(CNcf}~u9lj0TxT)h^R6D13BzigA2Cdy@VU z)ZD;r1%EQpAK^`p05P@DDuIqx?z&(w;qCl9;6^Y`gIFJ#icsolPVF1s#< z!uka7{y66G>%ce5P{YsvWcHNY=ObJ}Trnj#jZS34X9-SH^-JsX+k;QnXpY_=2j|Zj zT_CC!G0zfE&E4!q>&4p4q59pknC5r8AwdijWwO0iaC3l!w zT8s3>-rD~#6hs8&nE*c!|70cYa&1M| zDRf|v*;Kppc2l!_aWNVG(-q_UrBcj5iFOpzBay^!G;pcNby#~Cv zi*qnOUWq$lNmk)yh<#Ro*AIKrN;3(XV2hEwocyak7~qslQDVKo+dVZ#2UUtuYj0Rm z9(S~?>vjuOo0aG{bbJ-WI&`qXxF}#in83i+1eS6D|Q*-63&F>Y& zIIkeU`abXIH#Jt_%A_|iAmMy4Pja^4`cNloSK-q5-r@LLq?qlp!{}K%B>6U zSVicBe^ZdSh@3q}UxwtYzY|_!i*H;)K{^x)Yg!8Kwl9WLzDLNs4;&ZcO6nT`p4sB| z0)1VaDO^5V+Swe5#TYtHwChKqd2>coe$}Oy7Se;TYqptXyxuByGwR#xaienw)DEvm z`Vk>lgL%WMq3>uGZozG#wUf;8n!e}fABA7HZLzwIzU!XSI`DtQfoX{xSx2{UqzE~G z1>0K&b6NX*py&MLWWTK_?ffn=r`}pEToR&tD@KQjgMGto6gn$TPI@6PO|_7#iiwZLlVyppLuNUup!lTBHvx^bKeBKgzc zZ97#%fhnl^updax45V(x)n%(*q-ffgV6?v5Iz1}9-N1%M)%!DBO+)okpAR%pXA`{y z*tw$yvfzYH)_mY0Z&Bwae~>tWOj7^1Ox)iOL;j&jPjK1T^8ENh)pZQVxK;!14<^yj zKgBLtNiOskCtU!v+U>B3Is6;^(^yo^gT403OkoV%IsvOTke-wt^7}8MP8Mstv4HcB z!1hTmP5~gG^|>6#YhStpdFdnJ3-`JMNaq}zz?rxG*}ngL_KTf(T2H~EVE;AL+dSio z?*}dgbd$th0&{okl;*K9CQw^M!E>LGaii5vT`MJ(x# zZs{j0jiP?MpR(izl|PQa_|Y?*RZkFD%wyl9c}`HSLS_C!`o(@E9F#E&%6t(VQaaI6YzMi0|@z7B^;TM?TPf z-YO2c^(bBq8#6E79g8cIG?HJ>-emBMb>7#W#s=V10pHCeUbC+Gwrzv1unKjb6Im|7 zd#v#;MrXhtAV-erbXH*Ht^*FwI*Pk3GTdIjl-j#O$mp=0kFH3i#`;x( z3VECf*5Q%8pPhrAVENS8f)`}JNc#v)wc+rE4*Y-YsxIvca3M({=MDW_ze5t~)jK5mwcE_yf3o^My{n z4jCsxm40T#E`+O}^ph6vY1t*^jiXF%-6PA(wb$vMKbnaacu9GIChMUa{28-SFE2AJ z@Xoxxp~z{bIw$V_Fjt`u^vDGVRxG=%r?jLTo!=PSIZ?Qj`PAr@-lDx8^)X;oZTQh0 z#i%8$&0Hpm=DNeaBg!lz9Rp~^EwlrdWx4qbs61;qL%|K$D9_x0{AUo&a_c8FLS>Z& zr>EEx1_wB=>p6FjY2G(BF3P6KDr$XBf}@!`f2!m@^)L6mN&NK&iM4s;!Fau;Q;`mD zk5v|wW2@Vwo!YSs=Fr0*PuJbk9mUoo5bROmY%?L_zw+|07WS8m|34oTMX;d8@g!Wt zODw>!I`&ClIp#|iys*&k!(gdKA|uYw-0E!&2lhk%@hdz3XPQ*lrN1q=fih)WvwSm| zXIWc_xj(!=_9@*fO0zqB6Tramlr&EC%&#JO_j=rS^4eEkz$&yewS4!zSQxDY9m>FW!z= zu^CFg+>WpgUH_%SxHU%htsS2t8dw!-iJhh;aL`?nI7O^(!&ckH?eHR1|4>%_VbTMQ zG9t3YK(=_b^a@jzNH#G4c@I$&j8->N^AUk5+xA3CpxfRL;_ zpwRn}bLF>~iMPfbANl2qxP9Jud6wh^;XC>{V)Jf(vkZTi#g#>SN85;{G4%=j$|7{2L94`qdB zVY{Z&gE1pD?n3q$iz<&Q!yFfdybe$d*i*e`s%N@cF{JVCawB;v?<0hGVwQB;W);qs zJBKUhVy<k+URRL301!6sWV2kVlhzocSl zMdd%o;?h|snId?&8aXtLOMhB9J8{50_JUqwkgnb{k+ldM-^8Tb~v$6$7#il!U4gcyFF4Sn{?)WhqyHH znAli{h4v&n!nY<_?H?Wb-ooCP0;D&XdM;#JS{=uwQS!_4G@#+EN#Z|A;ExnNu$U-O zh+q8%0qpzL>1$P66|@Eqsx6zOV7C0-U3mTSma2Ym6ZNT^+;!4JIEQdL5^L(vy%OI2cIrFn3rI%3ZE=du4? zIf|-OZZk?vJ^KiI80W4JTAvx}m&7?Hz(JNA*?4_}r;2{(CFIItER|-LRSMVRrSUr{ zx{V5i4KtDgA0z%>ALCV@Cpim~BUj>Jy{-IIx9UfHKL@KOaGGj@TFc0qsCIo~+$?3) zx!X--HAc-^b=m_5?Vp#^%yg$GcWnRHiyOQI!$kw4lH8H!Efuz~AJn7yRN4to7o0RO z7pFKncMHUKPbhTnAtqA3D`Pj;ZGBVgOC8LRbaZ?K{KadIX}4lbe%h9hA+)lwF6?p8 zUiAx{)k`CjcefdmTt(%%w?n!DQ#`W}LCGHntgUL$d8gLpEV{N(X)2Az3r7due5(Lw z#Bjts0Sa>I;Y&T$)h8AyW(lX^lK{>=liVy>sERxd|CE*U5&z1s=%sMQ0CeN!rl-v@G{`UAw=!Quhu1XgiP$w`4-jywk-&*N{v{lGk6b$hrzzvJK{2saXs$ zA5b>QU=@t%ZXdYyMY7udMoVC$=c*S{4OW)LB1=r-Bk%UqEIV8;NLxX&yzkj1hbT%Nl81k zaW-z}wfB(cKsY!_^TIUdmMzfZpH;pj9vIwt>xba|c}+@|N|$pZ8)G0D<^#{ZQWSZ5 z87#|M`;Zd$;X`qkvd#g9d%FkOH@c=^blIZHPMS48{Xklv7Ey{@%k~5x@vV{V)+hWfInDUNd6Mk5Ja$ z9dl(2(R$B7Tn`K>^|$K5K#c3d8+OAUtX;!j3iWl{Q2;>5F~nctI5xbY3m~^gw{3G& zFnA%-8epf+7L!@wA6Ex8l1yCg_NehR+P_T89&d1H*f4zwc{XXiIZ3+d1Qwa7bD@4VxsZA_A8cla* zf7V*po2~)lt1XOO>Xu6$${No@CrWDi2P8V_Ca4XUuwkPe%^EFuR4Pk4wrWmkuY8(v zVO$i=XDdp5uJda^B%2J9Xz#Ro&pckPT5zT=^ihbXsDLfrg|`YkUAg)V0Vg_!>Ydx9m^=?mf>~Ysv~M#@igD`6f%TtXZwfm=_h6m%p>8J~ z9#w^;>lIzL9uJ zX~^SGIOg-M^<3~iWq6^1kGfOEQvk~8mE+6<7;YSsF{0v=d<`scw+A{F|5-&3dDVo6 zBH_Ob!DISfjEM|UeCIZjcQeJXV`6I;5!Ff%N^@PG9C-e)Dq4$?A_B9w`gjw=JnU7u zUCP=T1_&SuTE=3|zIYtoKsYD363!(P9VpPvoL@9I#AZw>iWV+zKT#*qYi^tMC8XnD zHI+%Ht1?*oCE?VHQ-?J&XS6H=9UE?g5Lc$c9n-298Hv`|Yhtrr4`F zT70wrnWGJ8DjJfH0qVCpIgo8jHC`+<{dla|Ht_foy7%M+Y=q3qO&A09-aJyzb(bkx zW8d*(w|O*POr#*noK1No*c6e<0fyg79Kj(VmS>1}!ErMR=RPbgx7w^Z9{2{fM|#+^ zzTDYjj(6!R582z-ZVyIHhpldNXfW8-?Pf`S-9B0EPp_wT+#hg`IFhTttTJ1{s?1ea zZW65}Asg8`zc9(Pg}_o|2iywwll?>4Y&qnbJ+j!l9}Gd4Q;m3Ia>YG?gMw#qv6)|) z>}9X3D6DY~_SFnY=GBg0zA)d%tQ*&Q?Lof* zj2wAlJ`4^!EPmOV;i|?>7xP4nv-Rxq0&S;j4S-A3#SQt7FH76E#=xxo8@T5UoAXpa z$8U@+!{fR-3aQ}Mx)~=Qy2-nn&eQukbVc3ASnEl|cHt~bVAQg-q2Xf|7u*7B(Q{v; z(zYJ(7e|t`piN18aYJzR*Ncjz20uQ-#m5Sd!i#Ye&DI{GttC69xZ#_+e$_hb4IBHz zLwy}!sCf$2VMKPgz{E!OHdlXw0|dEL)^F$hnZLOBbecZGrF)iI2Q(O3x1|ooh$}UH z@#GCQy3I9U)u%vTbd5?O;`y1q;CxW4jkN1PE_& zRX46UW%ukufv}mNI^qKrAQl}#UO%XgBt5{wpZFh>)89Mx|9seERP?)rp7W=Ve#L!2VWwo#GIK%VDPTyb-h$P&T*pa^@J6`(akL({})jxKEfhe8;y&W z-}C=U=XF*Lm^@{LTR|qz*fxTFZ$f>litx67e2e%hPa{0BmDG4Fq3b%=) zdZeTDRKLpn^>{Qc$zcH@S$D3vE|729$-bHgcr&^VFULq*29BwK& zV%`2Y(dN`|YkH1cwABOL$eAvMsm`8cEmm2JRfCz1W`Y|<6%`t#H*?e8$$Xt1;Rl|M zS_$sLWgVRP$D_JOgwT~asoAdLc523GW(=3&$L#^F8JJ6h4Y>9TZ>V}!^)wiNr%XGj zdEZ=1OE>mIBeCc?d%W75LsF|ySC(8--Iy-?BC*U4*^9OswJ~qBxJG8B>h(w^SG9cW zTcjwxnw}#^VxE)a_FdgnFc%d=`e~gI8^dtDYf0_w+2`Hr+!N=p-38qet`u|l>6VwG zEoO7u<_L6g$eM%n589Qs&V87v2cj4acj|+e{@twlBUk)3)N7o_eWQW9%y{)36eKNK z*I)FS$0x00U z)oge*V(?!SVr#bvro^}5Sq|6FP3~RUDzsCg&I$=|ttjE%XIMq|o<4boloY3HttP^(f*_p>|48$9uB z5G{S|Spy0e{`l@PJZdUGcoVARRu+jCyRX~v6RlYSP?(zZ!8GEcflEBL=Z7TD=YfNQ zQR0os=qt=T)eljXwiTPx&Vv=kvZpdD1;K+xUzABQubBz_5L5=j8XDVi~W-eDQ@8u<$T2r-%hNt zC2jU-Y=C_azO!zj*%C$k$NI9+E^ zO6IU8b1#tk172c&hZ@d@j=JRS6Q!rAy3yeeXpEOf*5z=%g3GfMtHqbZb}m@Db=*xS zJ)3|KnF7(P@G8}LKs%dlZHdrHPB{)&nzku{o?KaqaPnqsCXKm%y978?jg%o{#Z_SKp z)RGLDiwDte@qyZmu75}kmhsPe5Eo*o1a35@>e&psmU8FjT07_w{W<$e>i$IS*0R9Z z;d6kYjy9pCb;Vt;7CcTjFW)9r*lbL6SYCpy>~Bvaq}(Jfz&ZBn`b?j}b#5NqO>9er zAQ9-Uo(a``z&pZUZZ|3)A$oZKW9iXP;8Ja+#dWyJip0qm1F6X80CN`3NjiY>NRcc=1uyPN+PUfbCZ@ zI**6KjYx}v=HK2(`m6`d$9tdkJ%D+7MigSnk)p7jr1^yaMF&cJ;mTQQD;DCwe-ub!owim`F8Mo4W3npJajW8}me){AdC-#0uYcI7r(1R@;fgXTe ztW^z?_pCoCxa}2M9axV>x)|r5h^!nG9P!qjEqT8FNKN>!m-yeB8N?m%?$Nh;n7%OK zzg~NC#LSlL_h}kqYNugJR7Qb|W7^zhKzE?Q&aWRx)y8(l-ik%#qexDkem~Sg@gM&s zL+s0FqhivZ|3LU-4{pbIp+5%bJTJ%@>16`pp_0#PQ%M*=VUz)dQ44PXCPs;~IzzVI z_o;gGmgI%UiR1Q9#tq)`1{M(k>Jo>&Ne8$z{xJQsNV2pAUpg}vvXBlZm{<=t9ez;E z-+}&8ofstozE5ZjV8rcpQ_%e~_F=Wq4CEjE< zD017LVWTCQe~VWF!KEO-MTE@rH(7na?=TuOy>DH8=i70+!BNS=t*6GM_OC0P1#caDj9 z{Uf}D<*Hyvd)xiI=37MMRf@w?m>UoM#~skUrA|i7IOL+vUC4#IDo~gvJO$~jme zMLnX#R9T=w2lbg9N#Y9mmotn9x;%Ts`%?LRcilC=t64K8T@vA4;UJbUZ*l zCH`os)sd$^X|)Mg;HH;&}70`^sE%5+#-HzH{LcXon`S#PpQX@2d&R&j_* zEl}_Mb`GX2+1RzJ%%keiy|w(UJP+1Kb6I@Dxi!0ijhNY}JzOfR011IO|)X7+xb$bmR*#>N{^8wUmZMX^Qbd=b4GO!Csf(oowa#YR7HYjV!2w%1w zoYRe(llA9tPs?$|4VzI4zO2OilkwII9GYcCFR^@1ut(F0EzL^axNvqd(=geC;kEPp zPwz@+8BsWd$_2Vnn zNyvz$`LE<}uf;e(jskBd2W$F-=eqYyqcVG=^QKUtF3AUAM~iO@or&=!7EvVGcLR#Bi=&AF=J_EaeXX6{vp z?{flT6VVrlj+iK5_D!O8>>4Bwhi1q)2`D3{ISR&xW{?&lQ8)=3iYw|YH#7$Nda&30Ggn(h# zYi$S&)B_d}cn;9xxB0<5H3NHw#N9Iqc2tNiE$=sqGZCAoC$DhB#P4csV5Q7~vE7W9 zBq<(`USnGeUS*WnV77)%#DCD4HQ(6W$cCVxRbhxX6;qHY?mAQ24vdp|joT_^jH(@|}Tc<>tgJRdywD@a-P8st!T?a%z+VzFVn zbBEEY3c`btK2pioRB@EE>(u!C(@6NifL$m#hw-1aKN$??pe9Ii{hFx5TakHy*_g7p z;E}*Vus)R6+^77uEPcuOvd@mws5C!nQ}?TlhuEguWj@H7I(Mh6zcj7Ey^=#dUTW@} zJcjiKbmwFfA2iS`jxVS7txs_5Q)cxskOi$*cP<^J@96Fey@AE%j#D7^k8&R^Yw4MS z=JlsZu-z(tpUz0bbYQSWx0+Vh;!$164BaT>f3T={@4ZfYS8B@KD)KcdmCqm+k4c3) z=g)Pdi&Dw}dBy6Z5Jb?m&5W!W+lTF+7_+*chFl}rpd0#q@}tlC4!&FSe>t_2Bc~rr z1Q!Jn$nAt$Jay?ZG#zeHFz=2h$&j@yCfpB%Pf17<(Ud_*TP(|7O?>FZ)dqYU?Kv!6 z(3wORKfkqo&o9z{uNbdDTiyCvbCZI`PV0>uS2Fl%{L|LvcK3~0=X)g%5?8rZg8w_W z%3Cy29C-bfo-tmNOnAOZ21eq@v?o5u&i>1kXyeBkw&i-PRPte|J?c(7K8jJe^b7W( zBGx(PFp60&actTu>%d`w#We#8bJ#Ab2pqS=9U#UKab4+GqF?V-%Kb z8mKVX9522Al8!2=Bwmdl(b1;b_y!TPHC+ub8jBEW zbj}%2IGt%{AvpB+Bg)jt!vVo^5?S_T^Id~yQQu(6xC>k-h4L|ANQAv^d#rB5o9V_tjBp*tICn1U0p&kx4+73yz}|JD8xg&*&`kgMk>vsSZS+6 z`C)HX+}AW=RCZ%)Sxy*4fT*Fk)Ng}rb^oyg`GkFV@4tEw_bzEX`SdV9JA3sdt1*E; zOy4+)_EFO3mAvlaB&l@!8(*fHE?Vvw+G~)9O8Wv=rod`zMgPmaScQ#cm(^Ms6>> zy)}_ncMD#1Yahhky+_^oU)W&d3AQ{X&nplKv}tqH%~jcPjDOd-JC;M2hNO$d8$mUS zgXMmCZZcTAeeI;BZs)ezF%RyR^S(te6yx5JGn=Fd`v+l`mHy08Pj6Z56F%KtMi z{BOr1J~z=yHG$u#;FD+%_v6p9cNK49e;X$|0_Om)uUO&L)vRk$+XXj)r$i{x_#Aj+ zs_Ct<$~tVhh7#c zsSWaTU=5=#vO4bMKvnR5ifg>aEN}bN;MX#toQYX+)Nsh{w1sG5NU7xZTNKXY);}BF zhOEV|aDsy!BMyGOE+E^`ru}awUcZmt9&9Lhn=;|F*v+BW1+rI+$4iz4oEJQs0(G(cspMGXFqU?DzNrkxdRQ=)~O5RE1GLzzTOZanB>RWvf zp&P>-P9?*EmLuk~`cvjLjy?(KTSE6i;+)n;y1_VmeRjrN!+%x;q?<_pn`UA9ZYHM{ zOnetJsJu-|p9u`Il=(DCMcPGS~1aA_gKQ?qa^UIa`V4qdGxf89C7d8WYbvS$Y z)(^cOk}Huv!2~UZ)=5xaQ7QaK(-P{$qR+2piK94{J-&Q+1p(n})2G^>UqF)Dq$m64 zj3ECHX>T3Z^xFTAAH@O*6#)SSG|6Al(h4 zq;u4$v5oyM&bjaVbLY9g_xb(D1Mng5UGM9a&tMYNtx!D^`4jU#H^um}pz>Q};ZMKw z=T4@cqb-47DZx_UQ%3&bQ~sAx+E>UPbk4>0{ue6lzinB6`=$Y4$aWg9ey-uT_nVZ= zE3#)7p4`b!5-9PPJ^ZTtBru8+VQY~ZUZ8g_#(;$0SNh%$l5sZf%D{m;+27xp%6VN5 z<3$$Rh|_#v8rljlz8Gst_uI&*O49Rio4@L@C_q=J+|PZX&wlM>uzO3Sg>V&wm_whl ztCteQ(H;``{^~6C_l5s*D*qUQ{+9orCA_=D{mum_IKgGrPO*iBjGfIm zRb#flL4Ov7$$p0S0=bK~HDCI0F*I9GdPYv9@J!gT~ZDBZ0+t`=Jg`yVMq#up}~Ga`$Pv2a{njQ#Q}TTT{>%f zdSkF34s;%U_J?`xZ&Uey{X+if?*)Uq>aCR(+kvy?y-2mMMy~eB)n(kMOFnvF{bqSn z=Ye#C?y}#EOYSGr)3o-d9^egV8NuPXs9A9L%sA>_xa-x#yG(XMXjKs5p*91%>63Cn z&dh$A#%H0o4=`BO8cx3%Ja55+oj>q;=Fe8heE98h!%lwiQ7j;dkWkjXgwU2Voput^ z{?6RdwI$<*|5>4+cWYGogvY;$q+$AFg4!RP>ksM+0Istck#SexRLYq%$?{UsSe}=y z=PFyAE|N=0ILB+m_{$~Un;#k@Qv)%dyseZc~pv<0s*WkplNg#Qy{|Q z!Neb_=>t=2Zz2Co)7aB=+s2Oy(BRLV(z6(q_PET^&=|Jmaq(Mi&-teW!GL&^mWfg( z0dl3Ii@K_g01NW{{PQMtix=toN|^UeFVfnAvr@(_`a<_FLcelwpWdq1J6RsNSlmP|>6|*IR*pBZz6{l{CMD8>x0LnBQu>-`}8@o@R{$qV}1#P7FS&G-%eX{tkF z$KIt5z3X^<4z#}~fwGX)f+rWb#XG7&ue#3ky#Bzl+J?EhfwtWZNL!syulHnDY5`X5 z5gE`Cq+r%g*f2;I7UzYeR6sC5!RJ^>^csor)wnv%Op;6t2e@G=*KIzcT)| z>6``kZx=MRNvfeXL;B5sJx$(XffFfI6;(CCjhNRVWkl@w$dp@tGIFHSviHQlN= zeO5W9uzX(ZFu4T_j&AW-|NSBh|JJ*$>$InLf6(G4node5$h(ODQXBurC%j30>ckOX z@d4}IoS%#hnyL>B1Fz5?ZAC4%>V7@lITg_%EAK4Ck9>Q__fGfeB-Yc+67tC($maD0 zeB`f;-j-%o6>~uOS3l*!{;ZV!&T1Mt;S}&la@yjFMw|R~n2MKD#mgTE#O=CRI>a@cK;hBgdY5 zk6SV;HrsA^d3>WpaMJ3>5t7&v0R@2Er&{ilwn`M*sbak&s)Qo~!;X)t+4h{Lqg4&{n;*D4u>1bEZZ2U!URs={xy; zf7$Kj$v%6Qk&`fZcxp``iShn!+NWIJmoU;))w2i$|A4G&J-B+Dz8>_DNYhK{53U0- zyg3OPRVMod z6ZlhU&(^jI&|3xaR|0erxonCzZpXNg$beP*-=s9Q-|7Nj&zts&`~T4K{6X6LrynVC zpXP6Lx7F{ypRnt5sJyy~6|f737jUU8VXNf0w_&dTqonwKu=^(Yv4cnC4`h z)UdOa#G(9@9UyrDizPFe_Ei!TkLQqjil79t6~^x0?`AY{_A%F5-+Fw2l_2Z8@lEKT zR4V+a&){^ugw8BqN^OK$%z1MR(SmXeUj0u(WdHFN{Y%(zWITQOoy!H@=h-v~PuVQ* zpUEhFw2u3@@@<0hjlk&BB6a461!Q=<#UNSKqlVj$t5lB=w@E%lvGh`T(Ro(>!gW7% z?A`g3X~*-gu+qQM(qs8M!*?!f=mPwZ)=57aqxqe(UdRW%^<48ilh`+zTUQH^T&gX( z_3U&3I6byTA)nQ=7e_lzF|T(@e`4nbVz7inkK%I=dLJ}a!@{NipI*Gbn>;q&zv zV&Ui{1Cg`O_vtyU8XAT^>3 z%FDF#ufrI?Ns&p({V{6x@BaFKdh9AuAXOZFBUVA;>1oTe$x^G=^L@oZQwK&;)>01N z-{}>Hq7D?T@|*ky!O!z+3Q|0IxqI#>g(r=8hQrw#2qVr7#pN?F3XMz?0q29{0T^$pt9@)mF4d+&5SO4x+xd= zdK+0X@;E_oq>tu8gYGzfM1X4YNo5Zt=F$z(KC0Rh8XyS+7-2`A``siuxtVI?>@}Cw z$b6&U-u^Jlck`xX^zQ8&5@#$9{FTm{%7!G~R5<%2?@fyLg=e2{zw^KHJwW#InOiq+ ze)FNdqOd9CR_i49)!wK(EbmtldrwR^%6PM6#I^ft8=+=%UCF5RZ7!^Gwtv-K&$|-& zkV~ufmrblj(o5cm2)%+3PIwE#o4=2mAAb(gR)-M^kR4 z$_KnDVgee&<+Hh_vT(NwGiJGs#Fd;3Uel7B zmv&9L@$7^~_h`$6u2uUAfA#nFF~YmN%zFySt8ya&dO;(=&$TIS%9Qo#QmU1z3|^n44+)k zqyDQFz(1SwK1M<=0o%2n!e`@aPkm(!Uuh(;Hm0kD`HM;$z4q=HTd62uTMNv5Y^bQA zFeI-!RZg7nEfi2lnKx<6T(wFnMk(9Ynn`QIH5A;Uf-~I(7QJY*lea;dodx0n% z(Vzuxbq(g>br^m&7B=y=@`b>!OwnnAIhE1e%Wjoh*u6Kri_Z;Pftfvz^sQh1&aB(( zz1R1c0j<~9Pziqg7w(t-h~if+`mf%!2~1u#4b?14jUAHV?n~~e@u!;<#lMs8TU#zSmuK}$Icf!dvtSy|{o$aXTKzV094U@E$39skBuY%;@|ExNt$LD|z!=z4kfRIQ6XMNPd&KH5UPDT`H^DHn zj6-n&&M6P;A%X0}QaS1VYt(9Wr?v;Q@A+q~iU1Q)H+oSc))-zxS>&?+?VEo&Fx7lg zoha@6P39r-Urzt^Z~o_t_8k}Si!b(IgpjKK`;C2^cHvB8wR?pmDx-@HaGI2qo6e%X zb2D&4$gH_V&8J_|r-n;~J4jtTYR{3N`BjM`BTBj7G^d}<5iUf*Y9$@cZY-=RYa%R+ zrJU@9yfVosTa^l>Da+lKrOz^y=SuMi3@#6YJLF;g^*OlXaiJVquW8D{Zq+!GyyQ~O z;W+qi?nq_&g3au4v%SX-4P7P_%A4-DFA^sgA2}Q=$VI8(5FNxfm1x)C9`IB3uO``# zDNd1N_?}(+Ekypy(f#GSyRT1QTg0vBeB=JhlOkDu`eJGBTui1LGt4GGryi`xpgsIB z17B{cZp0Upno|7wwzw~OX}!4bXo8n_b+!w?+y3jS<2PKLnB=>z;*XNN>q(cbD3 zpo{C_7aX1U;o#62WY`mJ#*##~T*i1v3TNIP<0YsEHCt{b<|75xYFTC7)UdTD^SF{h zG=h4uV;W-gCj!+}-I)eb%;Y%2L)>uBXX~A5qc3GqPT5#{>4e_J7{P7oeV`mOE>1;g z%B?v*=XS{DSwR0_I@GgJ>W()-&D^u!aomAUTe#1c^2U{6xk|La{&T2Dro<}gvl^}mM6Atdv0OlQ;$k)RoPTVPx~=^&gC_U zXH?qeNB<|9+OfQ;bWIF-eOgcJNij8N;w}I9w*T7~>Ebo7>y6dqU(Yg-ck-^v)~vY> z1aK{JQa3IeU`h6gl^(|!Hxy8=-GFrT>?``=#%@A6YCVa^`)F%seHCrDxUTqxv?dkp z@TWkw(!@NkCIVeYMC@k(1Lx*L7tG>&hrT1>&FT(0LcQre5E)liah%W@zXr1+*52pK zJNCnUMxV)156Q9Lma-(V!#&0+OY+T2C&+@BbM8Oi!n)xKUQRTQPdZ0|UeeTUoECerswMNYS z^=T z_usxX|1R?W^pN>Zfnl$Nz~!2+Q}`+{!!n9i?F!8VX<8!rG*kjwndgnL9tUH>QS(%y z>o!#@sWFX%d5DFM{qQ{ZHnA-)s!?4r#N^(Hn~SMA8hogR(oD8K95uUwRm+Lb*XK7q zdPeq(dMqkG-msmYDc$iCGl@^&s8BH>?>WV4?83um-zzB0^}s9G-!MHgZ? z`HebF7{%PnYk*|>K2R|npKqfYtym(AE_QxJQ&T%-`(cyKt*@t4nJ<*KJI0e z7e41I_$Ka$qNuCx%dK3^JnIkBf44%vs+CmGC$gwGVza^gVQ}vU1{9j+Ny>YiCvUKnQcsZs1+{^jdt-*bJS2;JCB9vEFneUpEJ$YO0 zdf)?36Jd0D5@B(F91Wz43tEWV&Rb~DWpDN|+m;)Qa>3BeY781!t%r0)VYT{)EpP~1 zW`Ra#b1EoaMR+Z{2)!{qNu4Xrg3I$j*I9zSUctB(F6f5CuG9M7h_-b~K`tM~QHR6l zrQNl$THwlEI;5=bTir+X3;)>e1Aao>irpe@R;G$tQ*Nf5xc~U8h4wMI$SbIBxms`X zrd#^Atw83Gxq4y=Jb{cUvK-CVtyD`YGV0oSv{cE8UtQ(1%sSPSV_vP$ygJJ`*>iNT zxdf%f`ddS%ttu9j-L~J;u?>hniJMD0-r21`5AmCk3AHNH|MZC8T6U$N9G95;z!#H! zs^-Y21rsLYyS7zNMYBha?C)~YNeo;(N@nNGxl6v9!8KgXm@0M!$wlFi26C}e|6PIq z{Tk@Z+yWtDZ@f+L*R^XC?9wDScX|l*@nF96?QVmYqgrzd#_==0*f_`Hld#x@F&+b` zBHDiUUJ6VIJ;Iw}xU7}i^AqEuaiy*p7Ia`-Y)oU6tlul6XDqxQ#@(%o`f zew&|_cB|KPykgr27BAALmNJ>j`t${L zwXVMU?;X}Z7kj^)@h6>+=hkjHW?au}T2ZS|u;>y+7c-A`TSWnf@}&vuj-UXxu#7$4BZgGN$I#$O}&_gCB?L{4Zat= zXZ14tbrwyU1G;3SkU7r2l;vy?`2;YUv}}SgNL`^wjcgGc%PV7>&AXZ<(zL)gHTB3}rP}LCq{`hv%U2WZnNn;q9dC2F z$eZ@yMFhXg-H@ZWkA+g@yNB<$B|tYpvU>q0-SvL4= zJN}rNE_4_ngn_5ghw2_{Ky?wRX&={)J5ysuFIz=vW5t=tnr9UWVOs#pIX23ZgbvU~ zjfmAP#XF8$))gdu+5yK_qlHeh`u6eoY1hZ{K-j}v&Kk|IwRad#3-fFqo@9@$Z+;eC ze8U$uou&-Sw!FPA%^!b@>$;tE0Nly0Ab#EYycES}UYggtr-z>Qe5_MBQP?roNCmY3 zU6NF_;x_LZG@%(eFUVA$x2S{Cct(hQ3{`tUyF@w|JCU_ry9qbCiexN*HGCm0nF{s8%@^LVWR@k*&(KvE!f1my%U9G|YAJ<-_CY&8~-+`fUigOB1 zh}6M@Z9{67z%me2+xf=~^clHz-iqSZi}rym`&p8$!|gfC!Sq*--5{};9*e|ar?RJwelOC|;#JLNtMhRS z6fd@Wh{q61H?P|VYPz;HeM_DOra6wC1ubyfl)xrU-!W2ZmeDo{@~YevY@f&D=nZa# zc-)y=J=_;M10^Ou6TH0a2h9z*r>&}bP>j~UBCaRQlh&-|3S0I` zN*@JtEFMuk9L}357&D5&n(j_t=+V>r3RN6<_mwa#6Z&P+hu6AxMTOsL;{3X)06`k^ z1L@pAs_RkLO1hqxUdm`yUf(VFfVWZQFh@|gTGPI3sBd9nq+%)FI8wvaGzx*~dUb4j zi?}y3t#h8q`7IE2xu0D{*cV=3w)RvvMgIcT^z0FZM(Q!XbYJ{xOek_HCSZ`Tp>-8e zUBnk8x91CcNavcVyh2kGYBV8t>8`mv)!d9*lN0;YDD5+=vxf96WZxl zP~SgCS57#)Zk1%ln?wc)Otn%9>JV-0Tn(aO3{`iiF=dp{eyhqABMzArP+Ywl_ax?x zNm-SC8kSt!^CzDytDHFihTpj_WA;<2oc1!_HU9W=R{FgWH>+F(2W$)Gl|iVa}nrtgL>iLBY%7Z$sYsn}^}U(F3byv-j{9v`j7T19WF4cBRV zR&6(HpG$JK3!cZxFMaca`z5+5I|fx|rd4ee7TvJ@F>{Lu@Li_TxH`^DU9h^aZ@iT= zzR1$OVNHRkBN%k<1+;`HS|?vIvxYF!6vnMTn6$axgv|pHv;pCEFbSvZ^DUcn%nD)> zMI};iB!%vur@S6j1q7ctOIj~5*C_8&&oVMBdLVWcj)8TFaO^W=HrKVqV8_PlI!e*q znEi?#^yR4~!exSup5G0}9qP@rRsPEEvP96q`0iO;FHaG>)cvv`zbw(E>7X~NeaNxk zl_pF^zp+lRDYGTTuEF)&tD2o_W=VQ*TaTyaAMakIgI<=89c~{wsXl696AJ$S&)v@d zWy4+D(-n|TV~?oSCv*P7Nxbs3>5OIo+a?;rt@~7vMvV8`8cp0a&kl|{N~5WT2+iT< zPdD_f>oB=BynBYY7HSx(YE!O^%F~%feJ#}docB)u^WZE7Phj-IheKO?nujtw%dceC zDp9;ioqkuF8QxiDo>$SVtg4IEX`lKzz*x!ZR*Kv}gq_$mehc%a6#H?EUxMP?^6u$! zf0BDqx1u88JC*n`SmY>u^00#u{Sku9pL80Zd z*1F?<(Tj4&A0g659@w}#yTs<)J z>NBAha8C(WF4V@)?rhx&TyCN3Bb?YYHInXDp(_J&%BEarq#623JPrt7ME4KphIY$d z9yx?77F!zV)uBdeXPb9D>dN!b#dDN>HqJRE`$7mc&o={$LXmNJ>CNvBSyFZjq|jMavD$ezXg4<17(55uR|%n&J&+DUOj0%(0itN<5pE0W`4|C z*vpb{5LXSKnsLZO7MeYdIhTd{VEv$xbj(LsLf*AQhn?!;hjiPk zm*_wYyY#I8e+gcH`CVGO)1a2>yAd7|`YNxuzEH1sf304XZLdOCjejFr*}bCh#Yoj) z$_BU{v`%veKe?CoOsz*PpjfrMkJM0I5C{SYBc2{2u?;uktd8@5GIP=a2cm!98ozsJ zD#o{Jjo|j8ViHMbs5_Y$A$nlsc^XzSiiq+2=k}(F)U%uA1b%JPeV-Wo!BNB1458e1 zuAy!F)fT9FkOa`+Uz}@$CMvEZ4Xh-oh)5swSj3f#lrj^R*KG&|Elfoo6XiE-0r*n6 zEPxX~&3zn!e99De4k_};+W~AX-PTdnAXF(V>bKI7sd+*Q#C0dU+ zy&S=5xszc32-wgDW&m5t-iN;V|h6jF**$HzXf*VX5zR19N$lOP| zR(HJDRUb+u?$aanEP8L?E}U8?lPb=>T9!>Q&y6Z zS3SEKUht^qxN=#VlHEtc_^=J5qG4+oF0R!2NqAjn`gp%@<|qI(TI1FSW2+8vzc6c7 z&-$~2R=t}Hv)cl?a`SP^GRq6#KPP!Nqd6iKcuf}|Zk;aVRqwC~6LufG$;fQO)8VM7 z6Fp0Aj!zN}h^$eBB^*gLZo_SKfasbUpxyKq0mM{&nKLD1tZT8f!c)Y%zB=3oFC-zI zDvU3tNIf1Go_$E2^QDjuWr2)7F1JxOwL#vdn@0lkPxSv`ub^EBdtBW922gw<6&TLj zOha&0E+-DzX}fPrx^1TrM+u0XqlW^sW&37@b%74pm}!w8`=cHQ`Fo_0c!RR?N3Ric ztrB9ub1z2NDc3T;-k0BaBQ~r~SZD?>&U_@#U1D9_$Fl9fH+ya_&I!eOttx4t$$E== zD9MaUM8|X7ZIjFAbrt&fk=y=PV_x{z9JCQ`Z&-aKaiE2({3m2)e)nW{iY|gR_14Wu zF^&g18T&Y(IQs!fvilRZyR5NScUowoYx3X_hj8qZgcb!m#Hk^EdYxC1t5Qii>)Izt z$1;3<-kimaIOP>M@N$)JM9Y%8Ihaah@ONNDHHHK&i_V!(TDt>pv@yAL2vPb?$ z;mgwGz*#*Kly9Aho|ko&;@F{`A7~wRd|WIU{kNfDgT=Eo(#((t=VSA(v-7hRg)#(E zo4?i{Qk#@N=?4-DE6A5`XO!2PInJJOfzhE9T~+9Zv#1J>dNKvU)YdPYdQq4>?9KoF z!g;+9d(7QAvdJ+M)oCw#jwDm~j^Zl)#fY{%HJdTogMoQyNw-ibm_GUt?-%^IlCiT< zxmM=bF9Y#YoG0S4v#9}w9priOJ+my2AN-RBp*AQyxVBCLgUpsN5iCr2 zIf29iS#wa@mn5CCBbka_%dM)n!tQaz+xsK6HX+>*oQ0Cjt2=GB=zA~xHLVW@7LusP zfGxuu#MM*i+Q7ntN#YuAtQNOHZ6po(c#`f}vk#7B=0d($KXV}Sd zS~A74Srs}aBs3}Js_8r<=~zolxVh@rg)B=GT_5l7rEq!l)o%1C@1k^D;?UDQQ0=%c z>-bZXT(e6D!#`8cLi0cAmZDW%QdEkEJMm_lcn4W2j{GctX5^N3GJ6!ncWx zUvG@41+j0Og=0~bOp&*>GPchkd*k^{q~I@@e==A9DTUrust zqESITNATjmo=o?Ca^MNi9e;ZHjot|syW$=m@(8iXX^*$6+B6N_tea-Z<>_;rG+ffj zRU!1rjCXKWSqQS?Bh(RSNI$VRK5i#=^R}CjBwyVFhJz|ls*m?@)n!NX^S*;oaq!`x7i`zcH*29|^?vS2u6sKjoCR>@*C`BZFW-1t+hg{|mhi2MT`_Bo z+c(NPN3zwNx*pZCWEN&AhYr$<~aSrTgP_WNJ!5l^f zH(W+}kp#EtneZ}RgXeS01GY`EqrRbautFlMcL76m&Wic|&sva9>4P^hmSwOvjFAsq zc8~;#O#~tjVGhP$N+sDd08Eev#yOs#R||HLq_>KBlSSkXzVT$FZziA86j{y0kV3lLxMovAmr`a!gZQ+PIP7M8u(b6B z@LdvG)vLuAkLVkp?n#wuDP;eS{BtU0C%_Ma;j8X|MX1SfOH-(jA@b+?4!WU z+}+XCl_NR8Z*16HaR)xe>y*Mr67aC{I$f9B`^5)`ANTu6cly|c9IE@)z>ENoKydL{ zw%l;auh~CxFBc%-4q%#YpfIw)^=z07ILuaS2UU(`)JOLmMVEQJObk#OLCx!Uvef=` zlg?W%J{~|gSJqMIxud7+kQCPi?{&uTu^;s{Cqf!8;?i0{3Lr9`*GnTdzYS__T) z0Z478MZ!D;bf0_FM@i^64es2<*3|SUb8RXS8_!5xG24b}SU~*1vY133dtNo$K{C>w#IiU5*3qh~cjS!n-kkqw#JV^!q3fSzVhCkivCm8)Z?3ekB@v@ke>^xQfFiL?)t7W-ZKme zd;`kGy@3U)5=punrobP)R@0L}VRZ=^v8&FKR<(j9QwO_(KGq3H+?zt=GonShQ<}q260(@*rkU1*{rfG4G*_!sfw`_@L4_i1yyFD-2>bLGr*!PTe3vV(^jo{|m+4J(L z5H=~?hTatXU`S$&Dg>hF0#nZ7*My1hkfV}xTFGXLM_5s)@${kZ$UV!n zM^$Qf7V`CeulQfUkNh1Cac!{fgPtY^e&g=z>c(*nRZ?A@b1a&1D3tB%I zRBnk0Ik;!#l#<~PmUVgK+QcIP=FQA}t$NSV0uhbbPLxHP4M%@^PX+L6DXTavX1}UxlMI3a-g=nQ z#!tdd;o5Eu)q$%Dd;m8T-ygdq9V?sVKSGjFPN(Gi#xkeeP_y;$2QoBDe$}Pb{nM%~ zqo^7#A-3#a75Fo=42Q%Lx?t)E7qL2Am+F} z3ho&)>X3BYAyU&KBc*vb?2*-kpt@}nsqXZ$#1T*_hIX!4c%n-CH-YTDNmkB&2zU7i z9e&pqdbhS!&^4rouxys~zCwGe0_Ia;)WT#Rh-?SDnYxq0=GOF9=$L*iztQ@&s)fav zcb5sQ#O?ZcB+DpU=eoPBFJpj1CaHt1f(CuWIbhxFv-@%w$26A`*F?LX~ z6hJ-R*RXjiIpPU5brqXS$FHRAI@Kgnk#~{7wsbgg}X2ZmE5xCXzTxp?4Ac}<`8mdv(=81{l zJv{N^qeeUPZTou!s;z^zllYdb-WYsZ3xPEpHyU3)<5uIYMTcxVAU?uh(BGJ-*dM#$ zSWK+mMJh#8*WxrmB+qGR0B*mNpTv%Yht`Iu7p*bWi**B2q?pX?XG3MV?4RI}-jf9+ zyh7af92jaz{Wxnfry4F_CJE3uWH}a`B$Z6gO({cIpU@>yO%vFP=5ypTE=tQCfXnfc z_%qOlbm^N*K3E?T-a?6UBpI_Rla;3Em$U4>ZN zWEa*1tsV;0e@wZeM0_2(u!GBK;2@{8-=7`TRy$&cVDs3m1Ohqh=}Ezqn|A`%@6t(2 z5&d0=UyYF^9h^0tm?^_XKME(zKBAQ1IDXa}Veoz00>iN$S2n%UZtuqZQ@TDGlxsd1 zq#v`WMJ;x*bVSPyCCi?3bx{)PF1RoD_@_!y$M=z9CP>h7*XR z(2JR=7;WLItlY}x#lsaW@_?BIg#Y20Ge_9tQ=`PUB$hjb(5$mp^Vv_^qO>>!pTTyB?s3@t z%3Rg=VSV|fg(4!g{%%j;xuu+z4-XoexKd^>qwH(_OJ32#c^Y!dVJ3ug3_JEr1yAZ4 zq?_?4drYuE(EF1MgcLB(wV-M`*UmSr+9+1E!csaq8_=R|luB%Z#n*LEpaxR0D;TRw zae@VU(b|qG7W1v+X7)Z~PHoa;4ZnvmB-mAa!8WO<#EqbuJhIpp*tEX1?%wYer#+i8v~ zuWVWA*fsA#kI;B-`E2`YSWYRbU+!>Ydq{AzOWkT>YSQ!P7I>kt3)tg43X37v^xDhP(<`jW9ppS16VLW94$xa6W53TVC#Y?)-SjR)V-C!6Q$_a%2WG-7 zf)+LtIv-^sp1wnYrmkBiG?tEjLPb^g{byUyTbHS%%DvR;-uo8s(f#^2M5Z}#D!)|K z0}CDD?=xM3#5q3=!iw^aOxrY4I3Cd(H=`j_9HparjzAEmN3;qNdh zB%gT%m3f-~r)vct;_Uao?iU1mWV@184c8tYt(|OfP>sZck#%0EE#iUjdat-;+ug|C z-Gn}bCt*z+{oR|g^!27B&Y{M=s!MFnoRVG3{=3)t@pXB9!=?-)vzadyOdyxm2|_s_sPr;r>+lgngi)+AQRHKNvCP#`pqS} z8nYe0K0Fj?CJG}Mj`{g@zP}yxITh7!VY@95o)z{Ry&H=x;3as`nB94 zsphwF_cWR(|6_&qf2+hl*ylXH>;-aB0W;4IhGqR@A?xr+;(Sg}8b#<> z+?|Vt#8ciA*QTe}c8R-d+G#(rv|kIBy5fxOHI{miBg&o)gKFApDaVBc%`t;NC~)7) zsYcD1Uw56OqBo#=f#}up=z?i-g;;^iRR6H9llS>}BNcHd9&uz!qvC}9Fw?kxr*;}_ zC5u{h2z1bIL{Wjf0L2i_qE6n@RkkdEaQak?gFtn_F7T;CUAYbgoZ*9+xYmy2WVRr4Y7})^p~Ec( zhUR!xAI?6T2!Y$0?k!0-dt^8po-Ew_uWC0@gi$Xt{xZw^zjt51oc4O$O^V@F0#v5! z9c{~*f+_J?Q@e+SsVPbaPpj^An?ap)I7>$pPsY$Frm9U^xxM3MX_XGStmZz}=>u52 z1(nEF!pmCELP8Tv6!`#Rujjhl7-@jwWHfgfRdQB?(UrnUf}BmXJS+=%PRVXA6U^g= zk;I0Vn4(4ov;ySG$LFikiZo^EyuF!Eo4S$}Sszib1*P6Q;bmxtzg7W1nZ4ZK)FVB4 zUiEr1+g(6rBDE|Ckf>Z71(7C)M*2ZcfLv26ep80zf4{Y=t)%m@Kv!JQ zvNh~-QD(jTN_T6R>!di>sIjH8WOR^DVzKMeYV+Ks8PP-Gea0 z1Gm0J3qB$DLmS+Dv^l5)Jv)8L>GcLuU)m4gT^!p|A^~>J-lG=MJ*b5d6cA;-i&trpBt2?ITO$B@6M7dAR@m7rdfWoMnt*xl4@ zlapF(8r;h!u6+3uGz`EO1N$9n%2{Q66q+YQSK;;57Vx0AO9}hqDAsA{SSk!@RW`ZL zSamr291ZLdf^Hmc?}phvTs6inL=+Wu3pEa_>L-eVm8c_7l^)eT-pn&x--+9YxP`J6 zmrpB^3}H3b-gr0I)!F)om(svlAE9I`f6Rr=rftVsUJ*yV68C?e>Fl#G*&_|7&Bz>f z08A|9Rn}J;3b<<^if64VU}##{=3F`I-ndi>xiTZrxtfo;LGia&+EHn2TMp zB+p<@0W#w4kH=?se3(_vrWD5&zn%!1ZEr@sGQ4N?s_N_i(JAS3^+`&nN|NK|Lu=~I zD!tjPWHSVZ)x?4VS7uXP{JlAK0MSxaGLu&vaJh8ZICHwCAx+Qsn!cXw3)o5_rPkYU@*?6Q<{*Bu%1@+_4v0nW*@hodi0KX!T( zX0K#gK7`wXus~x8QG6%;EaJnsOblm!(kqN%TQ5@<`D%sl-a7Tf$0cd1+TtXM=;tg5 zH8?7LL*oZ~3aOZ`MghN>BwPd8dqnX;dzY>~o#**j7^~uu#L(4Kf983o@Ag{b55sR8 z8x8ex5)JQ-wa|->qLZ^RmSf95=uEN;*S+GUl{Wx{GeegXZTjWpsIULYqkaVG?0B4E=wJ2ln#JT;lmas5YpN<@ z;$25{gaSHtP`A-{Oj@ka%r1Q%x7&S!fjGJHBP_UAY7Y{Or9H1e+;Ol~A3n+GT%d}3nc=N+!D~5$El34s?I83*uh+t}L z2)NBdk5xBHGChu4^=XRw0+OyOK+RzmlQUkn>bni1su!jdvyDe26Fy zpgd~@(bA0%)5t|xUt|vW6GNv>#?#;w1y(hEJ5Psui>AaE{Z5o+fU6Q+pWLbtHsttu zgMZXfOmjIAK^)7P{bqX-by*ntZ*$9|DTNxjd8I9X2V-sh+N@uQ5QWdz$TM8y>RW9NnHM4PK@n!?s;G&W?l9Z$hLS9yP*!;tJFZLPy z1^=*fa3(`<>Iv8F_U)u*faFjA_P^sNPF=W4y)1yh%ZALsKXqnm^NrGYXdDl@f`<01v-BY>20WMnJQv|? z;)&3}wQUcqiCh$&#GklZzW_0nce+~5Glgmp?TeB9zB2T8vlz&eKDIMldlnNLzhiD5 zNgJJBl>Edq=>FuY!1_-bwiC`(hpD{jL&=kr@MwHR;pzAoYyBOA7eBg^;d~2Z!|NJD zrIqRB4nZo5@o%R(ehZjERgtGevx0(_)j}2`d6WIl{ePT&bzGI(*0qEP0s_+A-3`(q zDIu`wloX`9K}wL8ZlpKe9nuZbozh*>@I83soOADY?|HxP{R?3Wzy0hr*PLUHG1piw z_m^92;@AUc?%gjfIMPDZf7lMvACE5Z)>@_BTXpNT8RNws2aZ7| zPWT0f1>dfqcDcON$M1kUVWwCR`oDA8f0s*s|6h5Dw8e`f+SjrZ3_9-$AsWyHjFv6v zwLT$6Qj-=IEayR*?M$-eWd|tW$W4|-ff4l-=MumIh02-=Jm14{BEV4}c2~hte{7=S z-h%ufX;Y+=x6y``2AH7z$`kglaseyqK6OT8VDK3(gSK_T%$5s75L*NTT2T$Ik|9my zifV_DITb^3FFp&MuG`AY=Y>F}wK{}r;ILa!al-r%A>jrNpI8b5FTpq`f%s}5*PUw@ zC1n=~oWj_F4LErqAPfI*8b2GjC}8qt%V5`rS8Pz68_&m^jX8xmiUy(HOua!}ZQImh zE$bQU+2lO++qC2Aa^8rd9=1FhP*4v1Du7EJCO&k~n{N9%pl7!Bf~CH@b#Q}e>?I%K zGkPytG6Qf^AXv`;_krt1+&VgF^qotWHC3eE2Zb#{baXr&%LV}s<%BYO3?U&uXcQZI z^OgNk&pX=SWjo-hQnwdT$8p0gL~q#StkYi+Vjqj!wz@^rSpN5M|Now6{x}7k95cRR zSEwlo=G* znvfh7jmw6T07jyS&aDP%NJ4tsI@llDhft|%yQnV z^%l=Kxu|9X#N)~Yn_}~GS_O1G4qCO6=L6rBUJXqfu-Be+2+dM6(c|KPmx@2e%KL-_~1 z49LfeV^{AC%cF=Evo=4lU*-$c(`nQ2mp#g&u0tSrAZT%EY0-=x)}lf@B(x0Ii1 zFc6{91hTm?{jz^3+TmxM<{9p~0K5!9 z=fBX$MPL5K)0E_;jG<_yj-PNLlCRw<5x06&SJ}7SR!}!-VLXy~84J(PrGHu@SW7Y_ zG3mTS8-0wzO;~T>q~LUkUfYMw;dG9v#dAWYmizOxP0w$uPyZ2Q3(`V=6@dg;KeKY9 zp{jUb`XLyb^+Q$j#$Ufy=OYMomxj4xKObPHl%Z(M)tnVKuJO%oW$f&c9JnPItc?g% zI+p&Jq!e?(K8-oPM27a>wF`yP&YgUm?{ppXV4M%u&gF)jliAyZMWo`n6!x>u4UiIlH(1$AD8wwmrlK>5I~dm!l_%Ny*v(`GV`v{pTw+4#z>fL{3ZXHJ$6Ns$@xoe|mb=8aUBsqo)9a1cQKQ z;sb+NMJ(bEeR2bgFkvH{!aJVZJ#wysa;UKWm)*uV+IQLLp4lAqfa>)YLY!( ztu~vNHR~=<3@SvJ&spx=Pl$2k<%1}9~AbNie0X*o6hq)@jMLR~^Q)3=N4 z$EBtN(K$0{xW0*t3}kM>@Y7^SfKnbbP_f&%u;8oL;P|?tIX%sxFqqYlih@#8^O)F9 zSEX^l<_CM2R-iIaE^5;0Z&R?7Bb2@Q_y2Yd)9#t~W^*PXyJ-~S*}aWNXZ^vIC$m5X zPZcrcKeG&Qkihkl<$7%avu_02*DEKrR}T}QaTgvt@?nBs^>v15Ij%sJ%H2CDya>=C zK&c8PZ#>370;Vs&uq-PN`IQ1WjcQ^A&`bGAmYUISm4RrIJJDl-u49ua^+~4YvYv9{ z_{Q<%PxKV?{oy{hG3f{}kCuw2wxJ2*#Mt@k7$?GwhdegNCa{>MJ<+YrToO>MA%_Lb z zIRx(yb^zra{eDu%`22AH!{g$&wEj_+Yrl*qM}CW=Ia9883p&pCFZubv%%%bBPsj0Q z9mibpX_tHEb0t0UYsoi5G8rB`88SZ;3ngv?-l>0(56QLe;GQw6On1qmFHM#+x9yTW ze4DPoKKv1kOAnf>>!e*p9Rr!b{kCLs1uU7&O09Jo%D@NlOijPo)`y(HX};;mzg&#E zDA-Wu*{GCs>oHH*1)H-XOiu;ao4~g)JqEm>1~f_eje<1&T28NAbv!EGZA&5BEu2m1p31WO-M>Bl0Gi%bO!!{LPpXV*ykcvtjYQav-k*D1Qmj;FIX zAD*dYAD2}xtPuq1#uYX3QpGKpXl|)%rX*@7!pQj;{aOoA%46!$E*>Zw$;a3R-jivaHF!!Q~UYUZ+q1t~xk*oAnyJZ_mdOm+yK+ zQ`}45=A0hUU?WoTwvWjPsnP=GtX^dXM zNMTdv)3iCLPSh-o*)hu3kB?4VQK^G0DNzbCOo=ir=PWIJXk=!o96%eWTyvdS_{zg#RBYRZ@++-k zZ+Mf}@q1rQH_-xsbPc&Wm%G4^vLw?UUwm!Pr!9kf1+q*0#UYVB5(|KNQ7~{|?&|u! zjP*9TnkPDv_n(n;g`{pf38{I?H6}2sGS0zTiue1`z0X;HZTHsEmJu9;MV5UjKI3mJ zmu>J28w_Sjdbc|RyJP{z!Wz_E#;QBx%(aPD+)JAVfEUN5FK&@SyNq=xSW4@c zp^c%d;YcpPuLoS_ZkK_J*Z|bBO=dqm@<147c{~~ZW$+VC3|O;N7r^nel%2;SJYk4UhS_YWU3>Xb2 zO`iv4kUVAu3|Pq9&M=+49aue1ie77K{W7!GFtwS0yg{J$o2h?@L+G59PjfJBT51|i z-DKOW-j{=UdFx1})myU94btM-LUp8#)?V$^`VJ)fV1OLvi3ZtE*7bg3z;#K=100=P z#Oo)vpweMh>}Jw{RDOpzJ|3FetH{z(I&lnOw**tC2fWrnqY#bFvcL1?m#lC&`6&m! zT4zh^Y*MlDN<`fbSA7R~I`YF~1eGa!e!QQos_| z7hc4ra?SP7Os!;JW`(TZkp-zpp}Mu!yfaqYuK>8Z2 zpb7Hxf1n7n_Ru%-9Y#PM{0lu5(7jXhGHWH1#b7k;pz)0I-Z zR<-;7+I%yd7;r+VPE_qsdJNacW&77KcZvK}#QM({%7Jr(`IOa$jE}#7@e-0A*gLtl z*en2oqge~Klfj~sdC|AK_F-4Us4V*(DAN!~Xf8bO1AM`$CGlaj7A!JvMet=YtKNrx z#`#Y3@LAZQrivlv^yw$ASxY4-$rrF?c z;PXE{tKcFT(-cxOHk;EYndDcMmKYMC$H+f@52*!Eq@QTc5`5%J-?aq0?b*EOTcpL+ z$KIp!hT-vt?88jjrkwSdtC|@Co#kkuS7&d_rMk6Pk{2=wmz6VYe6&d57u-*#v7J_hC#s6{mf8Rb9?QF zS@-_gpN@+qOsK!M?0Iq66{)kQU)up6z8=pO`^wk~50SHr2b8W|XZ+ze98tW9$zOg2UpvqO2Gd33&UM-cF9Z!Acso~jU!`+ zs;(=TUN;{P&E~7{>?`W6A&@}wQ7o7cK#X6(>ET5NBBr8Xg|gDHd>Waz4{}u#O?lDd zlIGJpylq5^(5rbT7>lT7{duPAf^8+2fn5$TLP_XyQ}DOlhz(&^T>ZOx17qht^2;GW zHu&7mI~5RpUr8=7Qn@#QRR8UF7q_4n8w z<^;-heH1Xdlx2w~g8mpKbn?*Z05dYHGZU`18jj#ErMtAs7qb{zTix!Tl_0EWL0G)I#( zJC`1NnHx(2a;(z^rpJ}d5O-L>(u)3PbVm>TzWVrxnEeKcHnq$l+-i`SrKnav^==`@ zDE&?lE;g`r=Y^9p|9Feu=cIt&;6Yct?9k(T{tpjYLiDnQshMbj-SjsAJw^Ooal3Un zDYic?fmiEvE{wM_^ss3(j`XVl$JH;rUuy&vpSmpPaqVX$d%WZl#sN)WgLHbcYcj!$ zB@Nd1EAlEJsnD1Lu#$`Qz%&JOCO%;Pmid#35Tup~R-Xin7S*XeD^?ICwpRaw~|`m2T&M7G9;PPpq99(D!lEOwFRySh*Jcd&7FO`&#>z)9SJv zfMfno5ZWFekWJ=Eo7-r&>OazXo9KYWqU%$h#NSO5#&bw~UcIJ16Kdm3x)DT#EJOxc zX{pyuzpPG`V7^0wya9X+bNV6&UUN*%jCZWMjOszPaOWT3$fN;zKgbz0ybo+v;@iSK zXZ{&L%b*=l(R`?@ghgD+TGYyWF-sZgD^%3gCL9k*DyC?V4Jpvc1#H; zeoQO=vWfgIt|B%H4;&S|Er2)t$Ct=_m|TtRNWoqL*@;W4T{~)y!gZFREA$5iHXsQ>anoy0kOEq zAoS1q*2N$20!>-&XZRiFei4Gt0Gah&#J|a`gIY0#xwWc(CeeVwu#dTF5kDVQEpPwm zMBoEP3c1Nq12KfqGUS*mKUke=ljF#rC4e7>ZGx)4P`kE0bOEDJ9oS5p=&)z>qlNe; zOHyu^>{c$n`!McNMXW~#rYc82*bN^^{hFyL2vL8FK1s=Dp^F9}q(B~Fl*jky4ZL5! zWrh)`$H#n(*1v7X20~zgJq6|rU3~w*&~`}P9>7F}VL!dXVnbgJ6(FaIj{>esF(ZR9 z3~iZZGz{|Sng?aU9#jq8yJtk%%6yHU1F~fcu-G?M4I_8 zgW$(gQ>{iCRB&fb>;S_-_1ZKzZm=w?8{qh*EB^>>X2`wtnzTL^{G%_+DFTqA_}b#N zerH^GQf~~vQrTO93(fI8(^T&#y0hB&_d#o2^fd+VsmBMCzr*n4x0I-@dMNlAA*4hw zvqcwSNn7A#^_jZj;hZk!MkLS6IUP!|v%9a6$rVnLun zz#{8mZ|x8BbgJLU2T~{vfX%pP;$0L2_>#20(4HiaG!vhwJwk*3NW*LrKa>nuw%OlX7DM;}%+|BA z80rpnE;z@^z4aJJHdS|18&#N5vnbUon>wP-FbA~OWL!ePT$-8!DGjoDw>|P0LGP3o~x^BVsUG_`Zc-)D0Jz~s%Ly( z%rj2_ejzCWEz`v5!hviL4qTf~iN%G$7B z0?9tR00)5U+OvRx1>Z|xB%c<%a^(w#K+mZ8x`KK86qvty=ldtc$pEB`y_W`jkGt?c zq*K8(V<4X%U=Qy8CY4mN;Lw0WT7?dmXaI_Fz)+fDQlqB>r4=lPAkL(x9*?#$Y>W4y zIf~()=J0=3;-o?w1>D-%Ov!SDKsnTZH@Ji&_-$`Vtx{sN0j?T<{maMF-%PDk`aP$B zz;<~(+kR871~woYuw)@@rF$=Udb}E7elHkyrL3ubdkII`;i~uVlIl|+BRti`dL#kU z-UIQLDAo!2m`wi;NFTwCU@6HT?-J@jw2s`MrwN5MuR%Wa3`ik)fZ+3cm?*lw_`$RN>jPfX`op1D z8GF)D8nEXrin@Xj{Db%vvj@gC$`}mXRtVq3r!omlWWR|gQTnr#Bb&qnX)oq`De^y% z0Yt+Y&`ka3R2Ce+nIk$S=&O*_l1Nt#RIvlyl2fj%1zW2YQ%&p13a$dP{t1R;a@7w5 zi0)Yk8I@8WsH z5xYw8gMr+nw&%ct+v4##~wLfNrG z$a0)3d6>yJ*C8uo$3-5}yXu^U;I{-FYf6X@7NV7?4~idRo)rDBUhF>*fxW6la$ zpr61^3ku5mq_uTnwVTklV&G^!?T>Oa3{67n1o=UXN0%dG`-a=jAG{l4 zR(zfHL>@Dd$%C1D)nO^tKSqZBLu6o?a(w(FA=B9bkwJI>SjCwvf?ZOznqFVBj&gKv z8_Gz(=ZSjgzXA8D3iGCEqpBT?`l$dF?OKX?KrMPNa6Rq!GsD(%*U!mtylx&Mf%+mN zztCv$Vx72Ziz0FChcjRVy8CnXpv0`Gc7nitmpSolp+JdHP2fF8k>u2fAgcjLNSO6@ zog+Lh#Z}AREalxKM}D7H@#!BE76oaEmt@Ze-1E1AX|#=sfj59q`T(WI0YMuuv}2&G z4c__PrxpML@*fv&v`!XVV(||J;-(j``8SIwl&&=)v&{m%OwdQp#~`Zsp9&MOSz@#- z;>@egux3q0nX7J|x7~#ILPX#D914$<51_p~ysy8nKNzgs$nGy$oIeYix89-sd9Y!O zCVQ|255!&q*Y)r29fRN@_L@+FeSKJLWC4qnqzK>=i^+<&04*!>g1fuv(68}k?7a48 zC$8n#2PVq}H`g1&u-OHjDV072@YC-MfaORLzCGaLJR(K=z6J~!1XMrBo}>3yvA3H^ zwtLx$mU-Hr7Y(-M_M$dLR#~R}p(}6StEdQ1&v5cepfBDoQ!mSJx1|E+J+`d<3-tJKa}aj_U-aiVEdNV>YY{5Q zKY|X(l|b7oKPQ&(uT#uI(h?DF?h$b(7WZrR(0Nv)a(4Hs*H2%;BAhgOz*GGm9w}*gxe3@EYR60fIqg1# zGHW5#EeM-_wF?dZk{x|xYpPU#H}1e~wratJ_Bs}K8ZZOFWFIx^PkQeO_;>CGQl^}m z#eZZu$|aAjV4p}bSyjQ((Z|!;hSE3pIh(AGzD2v>8KFRqcb}viDV_Q;LLx?ju{5V9gu&Jx(sUw z0H^H2lGbD3e6QRE$I)2=lEm3F25|QIWo~2{aQr|AAYl$;Rji-$@*Lf4+LD7x-G%iP z-Y&A7?$iP;`5+~~chkG2$)1yuO=h!Gtn4C3>u*eplmy6+N9pL$fUV7lRvkg{w@>?D z{^`vD>-KJ-V=szT;2jjqX}Q|L0KD>-d*cI|r2=rm#jpftPh+ttMBQ|9UX&^$J_&3YHw4s`@CJ#{<8c)ozvH#OR(M9h zp%P~NPs`Lg57wm*j6cTpoMk-POVB-&&TvXzD z4`DLN@R9NzEmSHx>QKD$V4b)PJnDs7b#!`rmz#*WG2V<+XILXk>0E)WdkagCQ6fQu%RrrVZ`{d) zZ+jYXYT7|Wx;}zm+pUQuN1TS23oQw#-)qC3aBzx)p&^6>k&&T+FD;DFD<;_M=tnQH zvtS^zc}SV+Svd9iMsXV@_xHp4Q}E$Vb|y`HF9EZNcbxC)Y>qf0xdqEZ`R(Ry8&65> z_Ew1d9mQK4il!sv2O{K^3<#4)ip+6M#=%(`pRdmk+73}jnW64TDwa_OBJ1@Vm+$l% z1yGOM@WWd6`(I5yBb~;KsL^O1m&&76Df9u9!jSjOm|o z_)e~t)m=G%)>!GzO#+`cEO|f|gW9 z28u)q2|t}CNYyX~v&`*7<7XsB3z7lF>`RyN^VV_Nd;SJ*dr~+(?Pva)fBXA_uvjep z*GrTzKc@5x^xw>&G@(PFi#zn~PM2Y`^bfTloLpJ-tDG%^GSt2#E0zv1SysI;AQO|P zyIpK1~p{dJoN zzMe&sFlRf$oW!>wEOQV)KakpAkjW&VRas0Ih$VAc@(1Iw2gTPcWbq8v9Ido&gJ_A( zXDYz!i=Ov>UnuX}@8yIi3Wh`gyc%91%{*-5>NPz++ve@_%qMVWXLsz$MH~C<@N&it z%&IJ=e9(^`y>A~SB%*21ft%DZ<*c!~3WX$J1n`vaHya4omm83oXIb3lV%-oROE1cW6JAR&MHp-TYe#)TFs95iJ2!S2)I5o4#Nwg5OlIo{<90g}^qX_Fw0QhB z?Yipe!p;{L8Q+3_xZhscQ>iqOR6XO;Dd&@u2=R?5Blx5d8cEq(7lP1k&O+92Ib9~{ zOx${t`!)md;u42}9p`!&h9C_deukIyUS;rO`zfFL^L|%q5;JW#v$!7GM)L|IqhGT3sprF05a%?G5c8ZK!h1vbl6Uw2mRPhq`mVNgukNzN%**Vgva*a56=H*k6jmkg4h|N8Wy z{k@Raq1vPip8lD4ey5**{j$^}NOWQ=_pQP3>2mLyC%XNQp1A0Kl5CVT$7^bZ&H(?) z^R`q<%g$3PjCx#N#J(Jaa}wzM7--Ya+uHX6Xv{_|g_RMv!KMooq6H*k#W{cw|(b6y$Z%|f<8zMr2Vkt9({ z9!Fih-nu$7GeLgF8lB@CNiGc;Qtf!aUqI^0U`=Eggm$>{nR|IKx&9FG>h7F@pvQpq zyMg2vp|T%6x*f-c;FFQ8KHXieevi<76A=i*&(*Ye_>}|ktkUK+X*<2q`K=wFF)xd- ze?)eCUaH+-p-p}LIl2U1d^$&1)8^eSXVGHIR9K`2-4)8&t4RSb;QWbDktTO3^NSn6 zg~00W=BbuInJv2ChT%Q;^{&#UjONnMR)(s4w@WN)J6mnARc z0|^EA(HJygJ?<`z8wfWveWq^SByp9NHQH{xScv6GcsjXrBCuyqbD!P-$28?q>wiQ9)DKVxEwi(@&(-NrL!%; z@HAq*v16E^%@l7%fbO842HeG)cE`xw&u|-|Ovg9wk`5QD614Av(Ih*=CKP8*v6tHe zQNv!3z4ZMn%-Ss;Hh%pL;^Hn&>o89LzJdqL9h7w>G?a$?&V7+r6yLJEaj6NjikBu zPiabu1vn=ZT$84H-Z`t5IeC+?hT-!N0B|#Kz8e*jLg|%+h}Qzt;E}MyrdRtJO*Acp zVcfxJPO%;VUbC7F+4l&jXQu%)AR1cC5FAc#9goYW#RH_Zuv=@rF>O`PO4w<7!RXhRP_rouX>gzT-CNk3-pCXoT;O zjwS8@zv#2pr>r`sOs45#SKX1N!r0p3^zun9#qMl{Gj0Og zdjwJ5NlcRc(dIX^4Cu^p@NOqXvTGWF;hii=+ua`8=SyA<}bNiPBj2v1*zX? z8Fy{%C6f`@UKE8 z)Do_@@JxWYTk<-sf=0MJQ7!OIpAxkq)mMwHku2Tyf@ut4){|6sr}0lc1{;NFwCZT4 z6JT$(JcR{6dt10sKHN0i#_mGH%yTyCMN@2P4+ugy&OZg zpO|zI;ZE8!8PqeWf^j)JzjK~p2a+8)pOB(^^W8X;^bhH)VC2D`jAqZSWLQ+xcV!Oo z`+a=+oC@G$!gQz0)-ZI8Zd8rcDzG~FC%7H_`r=BNaIKf?-}v-*T!-_ya`ZWA3f;Oi zOrlm<%m;yrQh+PWKu#~2?^Xov1^rLArss%&{RtzJ*wiy0rCD#po+%ysqI@#7i|#&8 zsnbb>vYG|a8t^9nDsB6$!Sh}_t5~fZga2Ylq!4#f(f{hh^zMf62{3$&nnJO3{H=!k zO&sz>ftug+nWE|4DJFnbl@ggF$t1tRo(x1V9X#)nGT8{U@wcBaCl?^XlVFO38efzz za_x?6+t8zjw%0ri{;Z=AfP^|->DPC1M$U~@rGJYe4Xo%2E>Ro&Bj%Jth7^wT{AiK= z=Jo#&E;nMjeJPPvJL~R0yoM7^sXuz%!?uUuK6@#Ej@gSoz3iETtoB@wUsNy%_s@6{ z_#~KAV%5)7Y%EXnk(`CJQA)ITV0Y|@`AoZJTA5`qeOZU4V@&9nmn-rK)Qe%wkd>hu zg&f(Z`6`8DWr6p{eZ@>}?XX-(`!@< zZYgAqWkZoDDXKLZAsPh`dZ`p$<6ztg#Id?ok*J|UxWGr&#L{U8x$v3{r}3jvD~LwS z2V&{e*{Rjoo`=>giujZ0HMu#jeep=TIg#6~hJJy^mCKTF58O$2h-V~`DqtCUEOR?q zy!b>qmI2hPJ6@!PT0X3zavMk{D|+Y2prx=w@xII;9I`x~QKL$T+N{&aA(+NJVipI!qwmRy>M zU|FFV0*!wATb5ED3l0PRtBS7Rt%30x$Nf3)Xj+v#ZpCcp-VyER2hXBEW8QlM#XHyR ziWyBm3lUb+<7&$|j>Ygf9={tj4af!kmE%4%+#xgsjolT5`S#LgVA9}u>pcigm}g$7`5L zs86>q2_D+uwJ?b*5Lj7p5^wm%*_PN$d9pJ^KsH5b=iPNEzI>r6C|9F8)LWw1Fs`~e zouQfds>i96Cw~yy?hegh-m{1A@=^hQhL;FwH|$3f5(FVZubNE@13bmy$w_Jd4_;U#c*V)p@F;%UbvpY20T&YPI)ccg zJh!6`w7B5=QAC_q?IMT#9yeTU<`bIZJ8*3-iw9@BPc=9!t=Ye@CP}V}rSxC%IPCj6 z)-~nZ%O%iJf0!>*QyWa=Boqt9SyRUZi`jE-YZiaGy>frTZaOwR{zS9Z=IIMU?vG9d zEdvm5tDIh1z>{ofQEZiM|l>n84m+W0%$NT|)@a+rSHw-P-^WK;t~2V?Uk zBrUR3CbRY{&L(l&>W<|ys|$cL>_O$(@Bu&fcucXE^FmmAcnsqvjU#d{ z6}gmR7@Eop=H3BNqz+ zcT$@{-~tWg+s*Jkug4yv1=R;gl1%+fLwWA_`4UpXLV=(viY6#tAsJH9wh5zIaJ4 z3(dnMeZA0l9Ti3_!qnElL+TdX?KPDTEhuXkiN zyHUX6GeR&bY&KRUtasS6TK$*^k??9&IDVDd^;WxgOt!5~dalMAJwC}khL0)cp~p1+ zj8V8$f6$~jd4+JYj&RJIxHp^O)p>onp_BGDqZ213NiStW;%J3@nZan+ab8Si=*e?(lt^Zof;T7ce)#+V@t#&tEECyjR+ zG%4Aqn^utQ6hZVtHJE4h`lea0w=ly!)g^3`R;2rp^z>wp^X0|mPREV&s-k1dYnFbV zC#2(#Q2=l{Oh6?@!eZI_TSM{JtAG2U+>?ir4Qa7Ln)DHQosjr~rQ)w<1=`Q6muaX$ zIY!9&xE>XiWnKYA*7*llIFk@0)!Q=YA8y3YTzlVT|k+KZ!1m`ct@eq@r+JM7_xc4cgW9$oQXPr@j8XF8@^&&gp6^*uUTe_z--m z7cHO`Uw%)x(u-$VgYW*bVQ9~1LuT}@np!fF%=^Tobb$XhhI!NUue z+}{)zSt^DGvD#u@`7Fhr@YzIxcAgcV=N+$7p1PKXT$0`$O$v^Dk=xVBI;N+s@jp1t zXQ269e@@KVG?Mh6-^#c7?Y#F9z5a<`;nGB<)5Pm`+#{d$bL)h^K&KfnFNaM%<4VdQ!;OOHIgm;Y-gfK*}e$jq%bNuAben1EpTV9HGUl671uC4iJsgv9JPFt zNapcasM*$&_B_ z)yG8nX%Ds?4t_{1NT$Fd5c`+mAM5 zoQ_u1G>73E!vqK*Bj67WL+4LR1KR8c)~jA2Z8A2q^(e{-LG^df*Sr-8*_4U@uH#-= z79;5~+Ibev>ulq&r?@|J#%|}np_O|t#z#Num@}xQH?%)bu)zFmlPCb81K~s>Av>1+ z^(Uqwhkd|4yU?e7_uQ@XD<_q|@1<)Te)1u^aU5{+%MRJ;81ctj%~$5aCevS^j)6gn zq{XRR){xtcZwV1sbzv@ChBI6p$AO-gp~Mww<>eEIde!gmhVvAkosDq4$Qp5=O6GAC zYURCzSwc85g%V!=TE(ZlvhEKE0V{A&8|gGJ*PR`b^t27Pir-4-Z#YC=|J+x`W#llQ zLEv*eb66~T)`Go0`Og2ci359mAb#UgES6dkMl95-5gO#{JZB&beP%ve1!+Ebu^J}8 zH0s93QQghw+63crSAlSneWnjDh@i54WaHQ7>;59u-nb{`jjFMhVQ9ljnZL^~eR?E$Pqc_Fxy zLUT1Ki;4$xwTOm&E7_`qhPzYW<#XkUKZEY?pehCmV>(q8j+O)5)1{(mW}4BtcbD75 zb5Yw=&s9cX)&Vh2_^W6j2=lIbz0yo2U4i_SmUIx1$(%$UfW%W5hLeq@jF=&0v_u>eLa8o`B$$O2gM0@j5T$0|3z_8e`8s>Q z250TJdhrdV@j^B?yw7*;dNryoz7?q1dVOkDC-O&`Di2XQfo;I8-`J;7_V3zb(4MO? zJrP`JV4wq}b!b5BP;mQRsKH4a$#Pb2yHT{gzt^?RZngwm%GVjZ6Ot~CISEgI$(&S{ z>`I%$!(`Wu9E~y`t(OA3AjX@(Vg6j}m7~I7_xk?4=TXAdET&7Ka_KwrhZc!NIw-#9 zfw&Le7)V4S6|ZIOw{;{4wa4xGZiBi*r3<`lDrAnb@ zI?8&!Qeif|+#r*j@8$Nm8Q@sz!GQR4uZ?>tk&nKup+1GR=U4YE@9V7Mqs6x>h7rVc zFo-jO%i3=Vs2F2Sh9?vf5hS$;sV+&S?oD-KYc$S&HHfh$zcF?vj4vK=zyXh%b@lu3T`J{RpZ@oNtWx${h@&yW@Mgj(dCN$Ku7ZcmfcP;^X^R{g(9n#^s0^y)$L#9Q6 zbPq8TTd77Ddqie{%y`jsb4)9eO!fB<;4#V}AEF$xtO zWsdr`Y}o=wZBNjBmW^Q`U!a&$YuE!!30|FA;1>c4It4qB*Q?&5Ft5CL?Z|ukZMM1k zfcU|;lV|Jiamk)_Iutx3L8W+;)*q~|)imWAWq z&$D|8vS<4^NpLqenx*^IqP%01Fm;L-TZh2;*jc|pz3?CJIzR8sE3ot@K0yIJt}in5 zM=_!*ly$R-g3!ctJ_DhY3xJhSf|&upvlXZyTGsb2VA2A1N`!_q0y|Y=Yi>54K*H*!(7#^bwMVo0E

)f5t#qY`tsP23Is059(~Q^>zrfnxH(KbN4I|EN`SN? z8kchb6byUMjFlJKWQLVFqbO&#?`(4rHDpU|1T06ku+xv;Ys)ReWomZE$fl+rxcti& ze~j>d#4@=EC;id}*fWyMsF96j`!PZCfuy)(Ghm}4NxDlUf?27jD z$PH!EsgYo2Y5RJPCw?O1PUX{Bn|$gEhpMN1GdpF}PWgVsfTFd5r;Yd7I@$Np&y4H7 z*foJ(K?y1+G21iy&mtxR+hy1GILwz1)7wljTpbQZtejD=XAvjU^q?eyYw&nH@P6uI zT%l1bwq}RyL>B{@M0nN#Wjn#6=1RZ|m?aV(rvWK7>ib`|#_25>wS#D5cUbyW#4nI7 z?LKrf=|Hje<68QR&||O9qn7oN$$jG<&u=*j;BRvy>}P6TNY-o85BNC@;C{o-_>Eem zfHOdwU$UMmdUNrBjoIAd;`Yh*tiDt9`+oQp%>+|~J>Tk%^v%+C)!)hQTGgbcMJbzvRbC+%Ko?h= zEVW88umoKD(3;N`N1g{8jJrcJa({OXXEK!=!K2t{ya1pFe+n6#w#$=^Wgnz#2$Z@& z`8NjM#wpHXmw2yEQB@lZN;?Iz0YX9x{;KJKgs4A-?^$OkZqCdvIKF0&y&f--&s*zJ zVyTXK&^QTSCH6XRyyGo-D|apIy7gh!1jFV+M$SYEm7Xv#ij`9;8W9MfP zx@4pj99()8}>^&p2@nMA5KH_LN6!Y9U&I`t0pr?*QYcoXcNMV!Vd8xF7I2$?ng z0O0|bgT_s}KN?kzH!gkqV7~sD{q}@U^Ibc_^**lh(fIQRJZA2q?(eL_skDPq2j3aU zSGFJVhIivo%`xUfkFWjD!fpL+sCL$Fk*0T3)X{~ZOqnVpZ8n)uxJSQX>2Cms|kta+;ZArQEqs3Te9>6CxIJIgJN`i(7wC$lS!0Ew?M#lO zRG=z!d)vdndVX<)y8M|jTlI!F6kRy({Gdo4!=qJ7XR|(6G*Ce>k?fQlxs~^J{{4;9 zx)g5=oJ!U zPzEE4ef@XE71-0r53Mc|G7~c=5s|Mm6yD$dk070(pkZ9tG?zVs#5-XY)=26msV>+# zqd=x>r%+5A!N{D*mN0=^SWL#dwj0T2@}Vw5ev95HYBb{8xmsJR_5Q^<5T(qKZ5kc7 z$2f3!JSfb9JP0%3dj_*lUHt>WzCM@;AHX#0yl$N8*Xjq~mN>8|il^CiFw#fdOIGa2 zvzMQDI3ise6|i{dw-&s`s<%o(7D6criLy5d2fkY*CTP&Y6OOWsGt}RVIVUI0#evmzl{G#0+MXLi*q|=<<$z&8q`H_=!Hv-sh zK0_4l;7;;I;5Kr<@qFbr#^$@{uY=IM?{4{h+1`&(dG^IH27L43XQ>ICse2l!do$(; z^ioVBE7Wdq^|(4gT4z&v3w6u$S6&de%(F_Mthc+g$_3CQp7)=om);L%NkxAIF4mRl z>y+?~bU@jwRQo}!nf-=iiABH$BFRv5!J=?k0pp+pv4K()OS{>kFafoLcdd^RWoYfw zG&_|}5pTn_g-RQ|Q7ZO2;trhdcrSV#!pV4r{Th2)11^%Zzq4bbB878~iz8#W*FJ$m^r`241IS4apc&5T>tn|1gF0xx?|m%gcadSS1#wgT6N z)(HJe|0YC=j0<}LXfa)=DHAgx6sTZ;<;n`{cG*F3n0Pzzp`Io8jDzA)Z;gs*w9;Um9Rg~ zSb)2gDYuyCWTNgoxH8?F!PQ%M&BPc&c4wB*IO;c=VC>4Ox6s2MHPk&*nNO@pq0)*P zsy~+doyk0b_Wjezz&|Gr{wgX&uV7*I_+M>G>Jaz$;ryE0`&Cc8r~Ln5q~-G5;+?^; zvAMXJmD9TW@7GOz4CI~ACiV=njaj|{_TdVdTXGRhjrL|y$?-*lB54M_c|t7SO7TYx zB|O`5Bx9vKPZk}=_P1BFvjj`9`iZD#>7$pzfwA)iHf9Hy0 z(N$}mEE{qxHj^}!#aITdk2E0gH$E~dtMoHwtKlcP3biaM)Z7*~&~e>zm*VB8WE6`4(XCcx)DL?k`n3e zk`@F(VgYHSJEcpyk?xSCb6GmRmviok`~U9D3NtdpF1v3$&##`vdKV!-qk935aP}MV zL7<-j54Y(IZ`WrGQUPb%9WiS3!Ez{5dxIGd%c-9k#H@|mm%ZJSH9Qjg#2CVB7F{#I zR^s8^8^er9g+T=6C4ACSYA9~&rB>QuczpqXRc)ymJFVZxW@ACrcqi8^-HRgg)VYI= ziFj%AD~hu)$@Q@A%VSR9V_QVZaJ(*FP8c5IO>}CeS!qvL(c};|P2OgXj$&J;B7zbT zM*UUJfD=#`=^dh>_ux0pF9N6Xae1Sm2JJz$N`B>BiHz?Z909K2%P~$TAE!`-8+vec z{^*mfh>v&H%#XtTIB>Xwx>-ygSwe4Tbd5BuXaNX05?@t)!1s#fKeX(PVa0G#`o!9H z1*FcOlG3;NohG-o#|s{jdrztV8X#ywg-P5iR>^z-E(qeb_S9f>qS4i6o7MaQs05~v z;|8{==0Z4e<1I)1Tlay)aXVFBYtM;T*5+^dN{9f0C3f7uVZq*vR+6g+8rOv|hYzY7 z0cc-+y={)(Y*hO3J8k8nFHTpOiN7hdg=#7X(<*ii5PyT z4|A3ykMzK>+bZ_!R{zT_<2nHSuE=`!`Ax)%&_K*WuSdOdT;V2N5y>HoBtL0s9Cv3V ztxl9v1QRGR0pCodlyZf*s(oKR?)kWj>g4sMPcBqUE)=(ec~`(?Z*+@A=Z9|&bcDg7 z>5)|kC=qg6zjSv6KEw|MKPB9P%UxgCED;vtJ*rLFdGzFY#sm}qxQ8~phqbajWky}? z;2*k^dmztBGfYX{3;zl>B=TW3yom$oDj7o&XzaUFgzB9m8TfuGi;TeB36(cB{520* zH|q2H&uHZ1UO9m~qxz?G&%F)4rP2D+OVJ^SZs_0)h0ki|XLiej^r_2J@?51So5Sgi ziTZMaJzu<2vxoLpArv2H(6GGnRM)xTZnt1ET;7n!2N58ynJPCakYjn7>NUaudc^=U z_UYgzbh0aUiFc!D4u`>P%8Rlwipj!{;DHl505E^q90A{T-2Kd^ynExV?0qsVK_Ahh z`0Y~y8#&%kh}%v`NHsRj$lxoltFy?1PGSsnr+?k`e?v6?=rpmRCK&$|45F6epcpVC z%lL}En+5q|&RVhBC+;pQ##*}ZeHvh~7*}eX;>3%|8fUReuqF2tWk7;9__I=3Oco<2 z9e!8oi?gx&O3-6hfwt`}hpFKdi73hT^$J{=zIt<=>AZS%Vyy1Xw>Kyoqg70EtpvYj zB&Hwyf$ObyMzn&6XXa~Gy#`c(=mt?i8W&jVq+}rPCyPlhY)#6{YGMYwTUuV0;%3?eY}8zg!66}(x@&YpGbSNn)ckEhsJ_D4g zY)KOj?U|SRX?cUjHJE8U7Iq34n1WX`l~yPySY#RR4W@?EKOiC)zWyPjQdps6Io`Xr zMZ?-iU8I-!L{TikF6bNxt6vt)l$alEBCevtJ`pOjcFgbbeZ4xuXELA|3=VtSOtO7= zlk|x6vm$Fv9;g9$r>d>$r;(HeUC}~FRDak$gL7OdQ%3+|=;;QRUx~}^Fc7zBSFYG9 zjLPY(w^*TVU!Z-Z`vv>HS!`k+_Lbot*&r2jg{Lb>MvUCxRUx%AY(NLP-F&lTl!sFG zwpc)ba`Oz4rTrf>02@N2fT1_GHDmUo=77oRp3n!p(%OZ>Uko~x43O^eg z5Qm<4o*%UxZ|Z9TMePmQjb0$}d(vK@w_MuHN#&`;1w#ol{L=?z4<#Wv-fO*YDzWtk zZr&DZJaqI)et69SjWJB&sR05FmCMGl9+YvLsZt#G;|=p^i30#;Q{JzDq;CVo|98|4 zaI2MHVGacy*E2Ou#`09hLT%!tR6A-Gy@Sz^wc3lcYZRF8DZRJ>$`v-( zQckJk(-`Q0cJ9=od%^da4Kh|e!7!hEihcp7t#_9mEG{8~6+eZyCQE_?j!re-9060r z5BBd=(Y5MsUP|V8lJ(A{2S`m!TDQO`l)G3_^^ldI@;;@0(?`AMf{M;WKNHUO%F3Ic zvajHMlcp>>Yzqwg5r>j%w%Ov>7>B-ctSOetpk&hhB{I$3X|)q?M&=bz+!Q^!CjEF* z4R!RH{=#!LjD`<3*eWBn+mI^p%gTr31YqrU4bU$V7K)YeY}gn8fQapkrXMH{gHqYI z$4u$OGquzCyv_`L;M2*VIe-YBbE0BlIn-z&dy#>Wh2nkdvE!pnK|I;mvh!EG{Q%v3 zM|-**rv&aQuKhO!aoVV7zc;=rOSOQGk69Rw5B~qSA?CTJ)MAIdBKuU4Vq^NB2adO3 zUA7`xCErW^4G$)t8?l#*B8{xIPyTAH{;8vUv9a443jH@g|8c&NM(6d97H>&~0-Nr+ zAh8OyQ=l5DojMLT@$$3pKcch?Y4 zp|**u>kG$@{`V5XY0u@EwHv<=_#^(_BzAPPf}4sC3=c-JTX6((KJoeX`Qm z{;PzelfBtT@rN|UZ(Uy$Q64-ZOYtZtYdAhOepl6eMlaBg7^&hmr#Z*wcMD9C!*x!? z$^y!?NN1%?J~Y97Cxsqah=(L}y{-u~$_nEszLBftzn94F3kz0O98*ZbOvOZ4ktRrK zR>Us@xL94&9g`i~fV^kWMN;dZPl|#KiOj6c6HM}0YCNserj_{Fs8yv0lZ8}J9cz9| zUMZ4qtJV;OgFI%y@Ad^rp<{~ zUe);wK%5X=Vn=~C!Kenap%mnpasDs%guMC9=cbRu2?R2Dqqh6vS=YZ#$w%~`eoR(< zd&uvkXEx622H$#-TKk#U5Ot>nx$=n9? zk!Go8sll@p%d;pBQX%&&IVpp^bw&M%P=pt=-i~OnbS+|~0Jq+7<%GL3xgMWU?PINj znI;d@G(2;F8iQDiw{~heahv|7WF*-<`Z%xkoNtDtJmHoGI6LV+`ix{qPU(CNBlwk_ zem`-~aXE}l`Fg|VmB;CxgME6mHDukGhX)U8v_-@oDKBvYgx!Ss9`LP9C3!ZrPn7?^ z0$cRUT^A#>l$9hViV7>o{@15n{Va{6KbYrzws5)n1W-cAgg(nNlHkC3OcNCYCxYe} z1-a=~1Z#xuC2zSI>vIUsr2@kAYygK4wTuvFTeyyB&Ni)XPX|9FX=A0;=&1=8m4RT4 z>O4~B>I7k$Ix~MeTZ*7>BiR5B8N09`FI`W?s`JD^xkL}{aKXCA@WpQR!D#|#-P$f? zoO-UteaG2ax}3=Q{X-3k?nDH6N9bf1*#fQsH(X z(VP7o+8U#jTqmZc7PBQs)WG0T(d0@c&0{`F=zg-3&f7K6HE1m7pRNtC7IIKdf61GR zABq%yiVg^c$vM3AsKu4y0~wo3*YKWw8W#v?Y0xG(Hp61Dcl zFxYg{DLV_r{1F1-D!Tko8QzIO41t~`ICbFzxm(0g}g{0qY`&Zau8ncFti-u$;k zhPjcL5fVpqBH5Xyc$x69%5>$o9u5E`C8 z&gOos(S`TuxGb?mK8C(nc(Nak&-At$E}g?JC27TzR4_nZS(c&KSO?K`2zbn?~cSXt#3~lkHUmH=H z!SZpd68p@x_br^UKMDR7nj;5){-s8gUl9ws0w}2VDIDqLy=0Fsf|6nz!`v>S);CwH zPx}*3GPk~7##X+{Jh?^KB4;!L^xQ+)L#lsv4AvvR7lwwK^91Eis;Lgkk&a{%ov*bM`HG4bFuIxnp3p`avP>? zKbeS55zmKD81JPjCT8)E*e!c4_>fmyhpya9)2jNgh0KHZn7)F*Bq1`it-^S*(1RLp zgimlHnMT{4+T#?9{NmfOJMq-K(K8|jb+%TV3%9x-&%{nW4=2%94JT?BC`oOj&|#P@ zGFAVuwMgMDt1^(1w?(wLMDZFjO)mQj9gF(gEx=N->68*f<8^sL|Hv&GHA_Wh)}Z54 ztnKBA)m4rA8|sv|<>BH#<$IqfoJfpOwWZWH+_>we^-n=LJWkLN%aUgp`dq+h(t+%V zI#NSnP#OllFQCIrO5UBntTMcb(S@LXacr)Ipuv=oWGD>)V0WKWSNfT?i!I_y4C>X% z(l4RP$^6J~@?B*v7D5(y4<%}W+b3|fD^eV2zSA|zGM@N6URMxwvN=15A}Q}pRGyxN zujva$S^df$D7Bj9(INK9vm9X7u4d~`-7#-EhY^e_(RRnPvYM9N%I(Y5XS;cy&ew?k zRNq%ZsvTpP+VLGK!xjvpWau6(-Emmvlzqz$Ieg-ScUAa zYPLe4-D+o&qMg4qasLImVXlbF-nZUtrC8Gp&hZi0Op_O#XH!J}FZTDzPMf1WesN5!GyMMG3m32mP^Xy?{v-K8B|>0qZ%7#GS*T5c56jRR&-}|U z`UHUnCFpfm*RiSTQo)g6Tl;kn+t9@G-Br_1xsAV@UOp&HDoK>-ujTx)ZrC8->0hLQ zC1I~mDhzH_;?B^^M5p3OS?8fQh0@aHtdj>jp%$9p=ZnFSSdlyOzymIhgEe({Tco2(~OxarI`z)z00&_QGZ@#|Gy7FB7c zc$F}sW>7KmK)S~AX{BHc6Zq2}Lrk#$`qP#~{O*p2oaaZtx>K`sd)OszxX^GO=k5?l z`ZCILp~EN4X6{FiK?=aj&bA5|o~)D#Umj#D5`T%Y=uhPG@urR@)yFpmMJ}WXLI2G237iZz3kWj(^B-E)F86(Wfp%0|5WDt^OwfhcbRY`m&U!4H zeuJwWwVCpmiz-r|Tx@>Jclme>xbsglN@D{0R~i)#;0}Bi!y}13k}MxVGW{mof^uN1 zFGa{>*-Ee{tS^cR1>^J+>Vnm*RLkDH$CQNZ%m!Fm9RAGQ*getRacZ;*gec%wzMi}w zudGeuwsxF|w>+y!41BacYq|rH}X@Ez+og%ah&AP0x{ZaXK9fftaUTWY^XCs!#iOo3y7|FzGIK zGS3r5_H&hM?eUiZ(K9!n!{xIu925$!{AJnrkV&czsqK$VeJdSd zInzl%;4ZEpL^YG&F~)1&Ct#i95p8f&XO@ZOk4k632F;CMnn{&n{7a?GnhZ+rfAHWXtUD&S z0>|XFx&pdfhm09z{@0&-d)5yS1d==wr~4_K{M%te!R>9xQD?6yi+eq*a4RAc`T%yY zJgHxlu%qMLd4@+F0$hCGgR**}4LBcU5d$24JxvnE>&FqxtXqffe(I*bSlI7&F$Y}9 z{=5|~k$a!|@*TX6v+SDU&}^5KI3Q?5hQ|Rz@RX-kYQ>*SD|^W=%ZVbA961uHI@yHl zM6c_9PnWW9xArZ0xRYV~{;*qlcT(gsZntqk@QH-3afy`g1D6D4Ugt4kd1%gpD&DGk zliB{WJx;^L=X|!sX1YCHme&DKU(xQt)-nIoEDlushJ!jF5s(^{*=6U{P|( zj=Eo99)r>_ZAjGt##)%l{dluf*<2ED~u^BY4FxK9*gBa3wf#0%asW85gE3j0rQ zehz2^pS4l;#t??Hgx+%?Hc20h2jY_bkxT(>m6%6S9icBgcW1bZU)uwYh5~_~psmPp zvz#%kv<4l9hDQrLx}T@hLv)JiG%J*&n^1e5C2S~-;#hPCaXHU9@p$thl<+9*h2nv< zF}HA}5YH}}2XiVGXdzz$&pWzeqdWX1?#a_PHD*IBu3LFI=({o84evVSsx1noK5rcy zcKKtRWNo0qN*bb3Dpr(vr?A-*CU$|a4g;PwENcv){feI|6;O+(ZgZH@lx74>Z%0@5 z;gkCQ_Yp5Nw-$YxfyiuoF&>!NkjzK3*r&EDE`l#K?J4_f%zq7*Z~A>KpS^lXJZ6p< zT6?AyY3ku~32*>sgmT35=zuoi<8GieC#?1oeC#v;(g zdBsjzfL7US{kd+P#`Wg}0X($S?lb7Sh2K?1T}p!KX;dWqm5X$SDV`laIWr>56cRYt zysrqo@LyOZvJ-~>kDk&u74(z~0GI4~j|q$I4`wGL@rQOn1n+c$g>H*q57G=1KrP)5c%B=M^Gdm;)} z2TW{UJq>erXE2?QzNT(N%?AXHkf3Q-?B)DM%iA02>Y7A)kx!8cf24o18$CjD_-xfE ze7**1;T(!f7X)mMOMRE>6i!=XKg!m4og^*~$$cDQ-x7QWEA3CZ;bh6o=tt~bUA!Nq z9;Gl(x`#joEwES=x=$IM05UV-mS#YWa;hPdat}D}$-{^#U;d4&D>O@nu-e(7f zG8rX5^P>U8*Ve!HHoB^{I}04yn=Y=s9ONjs&MlJ4*4g~Mouv4HgcLVcrA#i?C>yf~ zay!{9nX9qEO39BMHYgt2u#!G@?#)tE`T%5UnwOt7a1MVM_izNUU%deVTgbHz#F6K+P^DdMWXD~ov6{sM z++=nCbHMPN&6kb5+P9h~LRb7W&(EZqEqKTO(8|X@r8i7*KU|L~5?B3>XSiVf)i+^E zKWEV5&bRF^Egaac-zMl35o#9T-`x{I=!c$&xE!vn)K-`sLgxJ$ldkuK>Z{CQNLR~A2i?%X*hu3u8f z9Mm2LRdk4b$!qqM_bbD0Iq(H+PFJjd@ZOOreUq=|(m!16#HD*z|DX~R@e$ZV`}5#z zW*|`LdI3xW@G45a!O+T(V2GU;d<8_O#Vl_N=>gcN^;tIHnp!sHpvS*Y@PoTfr<{@sWAL0Hv;FDy1^S++WxMecU!AQpy(y}7u_dLiC6>j`a2>07x3H~ z3}~G}E5dN0rfR=j3KmGw*sKZrj}n@DDk)XN8el& zapSB}qNl6KtB);3r+gEdu!YqIOo?8&8`m`8IcG|#`aP(mB8hn)^u{q8K{yP>38(R4 z4u&`3HQPqT4v952PEXJQtm;4P(xrKoR8(>&K=p=NoBFsML-2H>Cr# zozzYJN^ydGG41ifLuLaHHB#FM{Yv_yG3Og`}K zA^|de{T>OYYBQntL}7UA2G>w|`F3?%d*yj5$ zoPc6O#*?+EO5s@!;7k+9TNZt#*YUwt0dGrgm^2p=1AYLGn_6aVHoA7xmJj(QWxRwwF!) zIcP7=c}wuFY4eqZi9Y?j?A21g&|_B1&8<6iUerwW=0_7Dpkul;K!weSy5h{6N$mGs zB}iETS(F-a>#?&v^IwPD-xbA2QMSA4i>S(}Kv`_xx<2-06T;?FpXQpuK`@HJ;Ya;9 zy1^{9%SFztGk2Cn{rA(ZoL7!l({Mv8?dNYc&ab!OY|OAm zAkoRBs{89Ax!Z4psK5wn`BNAET4C(1WT|lmul!DNe}7$Ui}jJI{L~4q0=A;C6c@Hs z(P0vzu>*dHje~>BcNleP{mb=>7V4o$kFvcS^o{^m%IAEKD~6>=W?7VLUO7um5X>{^I~<)&WL;6X_?w-Pwc?AlvlgQ(4Gq5 z7%vXEG*0!)ZPuRsD?rRHHPvyVQNDV@Bu(1ogIlRb4D?Rw=~74c`d^VWev}6<00%%g zQwtNo#>Ynn_9;IC{mLfSbNJ-qQq|;^Mz%bWb&gW9UiX*yOlorRSd$r$l5Eo0FLY{g?y{Ca03AW`+cBm zqX5{SWd^ksNg4*y^0Hy6WdfZ)F*ktslp%@>4(>?fD(OSnM4U|@fqb)`@#@TNYs?&e zE=%p@b@<1!rsBbdZXOQ;>)F;bRk|Lx%Q;)nU^jW8U&z_TJKBEz23z99vDte*sdmYP za+;e=>U{`AZ1q=uUh4+rooTH9H@ytl>ZI@b6KmZ0x1_5h(W|5kQJ+LV#J$L_Px=7G zp6dVAZ>mS*f~9m3vM6ZJg&1M#;=m=h?ndSLAbGn{K1D>kj4TVi1Bvgk2<=Z5dxAd- zAq&@&pH<-WCg%_)scMck>o_SCkf)6kz#FWkNee$@^nLG5aaQ(c6(nIV<#%|bZ?7Df zYJE-UxK8|YUMQOGl5i>03&&QWPWeaW<{yg8$|tq|C=r3-UIU3t8XV&Np_WR2RNro} z2WbkuP!5w`H9}tNhV(=Zp%U$y&R5dCQB;c>TgUhboFWAr*Y>1Q%fLIAX#&Z)01C2} zKGx=bS~<|`J~`Q&FX%1;t0zCgCx%5AlSQ}gXa3?SaQn3QdLIBKjrk2^<7_Qnl|q?J z*>kc)KN$4fADltC1DMp0DME|CcHjgt36PLv(9^W^D^04IE&}Pumg1O`0xmQa#NSEY zgp1e9Dh77%IX+z+NaB5C`8e}jPlbRMcn+?ZwRsX7e0v?00!(r^EGEzqJB@Sb`e%!9 zdZX{sBfjY{QkwV1HrB01{0H#2E>#gW?g=QRAa$BvBOYYufy1JeH*5K zh3NggDbDW5+7ndW7e0^lnAfHQ8ttT+Dc)TQQMbo4m#g(%2^)DMcPDq9xu8;3);N9L z>bcCy`<^aS7Cs{?jj8);dc79#aJQZ-rw8W&`)ZtECURlk!_84TQwPY+njN7)8>~j} zS--__ci_J_qA(6H2Wm#i_4Lcce6rn?&(P<+|Mfhf^?=<=YCYaBGRkUwH8gd-HF`ZW z$dvHgz#Cr7uPVkuT%%oAFKp?0@IFNlr-Tdu{x@zu;d}h@4_UfQqL=8anUBU!qBGZ} zCdBD7H#c!WmfabXTeam-UB$7Y!upW3wwTE3>aFk2AXP1^2x_6ogJ`ttE59L7{~xL( zEZebsaIYga93(8ceahkajUDqY(@7AK>h(X}S4P+!PCfax*xY-KR3=vK}DBRuliC_gFvR{I5!YjNZr=1|2|8 zSf-*PXjy6{x42u_5)^clwM{_Ne}BQNrk>dl2J}03(&k3K=pLB4dzyreR@mdrrn{^V zxwz+<`JLfJ-zPpcC3B!-kzGXvhAZ$qB9IaTH5DBC)G&oHl7#PlOV}1zJqWZ4XE7{R zVF};lq}h|1;Dy7q=2N+*M6;6EEJc9LYIHlVL%sj?GG-V!$7^3=aV}rW%;Z>iL(Un z380pLVyOF!e*Zp&1KmyOY4t}DE7Ia-zBXS~1-VdF{rjefFtgFMzIZ?(l_w_5OXac~ zb-tV|PUa@Ad%y54FSy!;(UVm!LLY5om z#>6&$(PtJ@Z#Y%>&F_$Wi(zWw22RM-Po37mgPm|B%t8nGT@rw?V%L(Q#|fqePEVI=lF zJ)z!60TY^^A`Vs2z*2H24wW93#nixnnzhvJK|_h=(ueM4mQ|UNxN6+NQTOlQC@uy1 zi!(y&7s0bVze^;u+r5Jd%ZOSVF1w#G6Qsph#8{ zB9Uqs_PEd)8|IDt&9{)u@+v;u@pHtMc%btse++{29_akHvjx#GWeMmOsBvZcwD*v3 z^84b7?n!)umb>gviW;kVg@$b0yHnMwBRe(v+>(h`UxM_eb}+&3zz2&xnFKU+_p=q) zqpz+=hY1W*t^j&SnBpU>;~<-aa{NAr8IFcD+pH! zqJ|?Ee&C=*gE6VI1V7hI`PG>b2BHe`P2TZxrM&~r9CVnmyk;1KM_JP==t`Z_qAv*G zd!t`e42Eg?TNH(V*Heb%pfB#uN)uWtCG%r|cAaw!IYUsc%`-Rkd$1zpH12$MRwxaF z4cHNQApmMcOW|Ojd}a1FlQl3tZ({G3FcW{{yry@nDz`&+Dz$s0iuBn|o4>WBOhIYXmqXnNK zSEu5wv}hiE=GfL48Yx5DPLJ7{)su3_BJAuEHeJ_B!O$-KL)g|BrDmb*EW@DGAt1z3McF_gLU^@ zA<*$qQ;k__6n?XWFnCn{X)dTXv7gh!#vTaurMM>zI z%?xosWwcTkvQo;mDSmWMc&2jfp7 z%t~QPrIdV_hQ0~~Mqf6FfJ;iP)+TTk5NsSHc%>KKD71LR1h~}$aN2Cs5D$v-hZ%=? zLVSA?p2*F#40N^JQ+kc=_&`o{zf!g<@72T}he zF`VY>n^CqWiIrp1EPs;l&br(SL9$Wb;aE%xy#lhMnfDUJ5&bk{7F5-sO>o5G zUlZ4F5LyJcMUOrZgFn|S?=H6so%zPYat7?9i(p@_KyyYN&9$=?ldSn(wi19Oav>^^ z))riC^?9)a$h3SDx%DfO!_@xHW%-As!=^_7?T)e?u3<_DES+8=hOW(%zIVS_FOYwH z@H~H~en8)2#aH_#9@k+3>Zn=ApTO{I$1? zZQ)KW{cFG^>Z>({(Bo7eD<{pa$B57C^HbFIW?STJ|zFj z(wU_PBGMy_o|Q5=tea|Uu||@7bL`4f5`JEexqx*@<$!5xV5q*4fv! zN3!g2{}N3{XzbD+@Pe8(I`}{6=p*Gnn*#ArWn12F{~cN$rjK+3U>ogW$JlUkb@u(MUKBfo452KLO}PRDI@9&1ilF!eX8X($%L56d;hLO!_V2567-H1m zz#6co`DZIG1^^+kxnixuIuNVSYJ{9AQICMG6Oq$QY4T!L_b#Ru@_kO`ZB2zkJ`8vd zyauNC;5Q2%B?P9g^m9tu6h`I!_IL?;vr|Aa!`nBemR?WZeVF=Thxdim>%r}v0IuWH z$+VYIG}s3D%7@9qUJssfy$?w^X8oEk2Le>nT=r9{wlmf69hi!CNB4=GQV!S8Whug&>Bg(d!2;KJwiC!Xktf z!wvv0i+^T#!$;h9mGFx-@QpHUtd(-F#t& zkE@11)-Ac&noS@^%}t(qo>zOs^6dTilnFKjdAPCuNwkptoyu*mpgp(%!Oo~@*)-Yf z0fj$NO0bjcNejS#5Ti)g+<&8d1V3%}v(pCwJI`WB$m)$jfLQK+YjEg=QZ#dIvRAy0gRAGkT@Sc}w4Z!%>z#F;OU<^!O3FJbKO^umv#X{bMG z+XM#&82mYLG=Wj^Ay9CsV`KAyk6Ybx`G@B@2aqc9f_UBgufNNgScp$sFoYH9PFGo= z0OoP5SauvRSU3_=ERL3^<4dfDcih~Ib-5=lN=Uk#QL_pV{YH0WV=(%8B@#6j07-2= z6`g@Ose|v6t|0;))OQ4$H)L&IxPZ+>s2M~ym?94a&>>IZEip(58KyYWjj~rw<5OZK zp`Dnvc@BPKUFwXe4I#KLSkwqPmZP?AJ4!H13Az*fV!Wb4;KWI&y;~0**u7>9pw4nm zXeJVOr={og1UkLi-hwRdN{dP75{uA~9pD-MIrPz3FEtb(GzKSoBN3}$3@8yAJdkA8 zW%uIgOckeTG@X%FFsODu-sMVN=+!x*(W?px5ddr;c&@gHbqol7?gLN~;eup|C(qp@h z1-RKbP>k~9L1&%2k*x%@e40-uL?G3`f+Y%nSl}D7?H99qspp^7qvNxl(Z3&aKc#nS zNKPz|V@N}1_x!>phwYRD&k~C3(BOA za^C-LP?iV~s=?rfC>)TPuM8ZAnRHI!vQ`pgXx}N*5@{kfhCiR@V-8f$zvJ?r#TkJ8 zlEju-+6k)XR4B|u?A4%g;1NF(?rTGjg&QugNBk4%BT+=KU38~y245RhXYl$8 zwVU(YVBKvr+V0>eOxDEz%qZe67T$PnYC%AS6m9E_9PiTVJ0^MHpLzU*-V;U|AX+x) z{*%+cF3=VqRKF=HNRGAhOM(2Q>4#4bH73Cv4HtU0vhbDnU;WjRtl8` zxD#!S<+QOpc6C@n$c^b}9gyZ+0~jSh^VkCnxDpNx5HufMXY^=n8c=}bRJ$yCp@h&A zzfV^<2jx5>C8vYi7@+cm<=JH+IhNa%_uKM@O#?m8AM$f+Z*4vfjG_v@)FFtAsC&q7 zwep$wsr$7cy~nv;{+B6fdolvy7A*y{@nU(ne;?FW#~ zBcm?pPhFXMCsfw?I0pu7Gt?^pOZnvo9v6*RU6!y_7B}M zlDS+oL<}**dX;Lo&=Ls_Ej30)4#s?P8uRxml+>B@7>R0H4~Z1LAIshjT{`S<&p8YV ztuHuqxwt1wdo8Y4Ebgxpoo;*UuY3ItCV$uV=uBQ7fm-yx9@DsK1`G0gtAWij@k%!Q zu|taQsb+2T2N{f{n_af2oF9JTX>Tx1oV4oCWi{EjF5AZ(+-yiau3LMRL+%`eaiNxS zwog#KLC~-7(V@-ZGAK98bKplidLd!+F_QWAib{sy>hag(hF}n)uEq;{` zdB99>W`jrdtW=3X=9IkkT_=i8hL%L+4LzOZ)BAPH_pM8p%=&1)Vf_f0MPm3YP-L(; z)OS#p03ASB3halKX16Z9pod_IJhXgvAD7~fM|ZfW?Bjm*yw{r9O39RKy)?IFU;7zEZ<>)e|hd{A~*S==?OUc;TLbH&u#tuo9GgYJn*s@i<3FcvU~We zE4o}BzYa|t>9TnvT8tHigcg78b!{?m;JqA3kn_0Ds2`M&#`U|^;v;2=txa~TM&Im* zmFk`8i0;F8qrAp~*^8Slw15}p<*;Kk%W9)GTM6Fp?Kygek8YpOuTR(M=KTi+VU{4> zlx7BuP{HZnM#>{IsM{&;8xViIKkJn75Xwz;1!lahx)HZsz_-84el-%h$-tImEAe`C z^c2kiT2|Wb$#Z&$`op>ZYyq$lD4yO=G9=T@M2i>^$Pe_zy;h0PW}*l@Ae=a^8n`LX z>Qv=3N$r@|u8S@Lc{BH~qR-C#w zKeL@Pqv4*{A;W;+E$Rug){o#>^j#{c@Z+)cv^F2Fdo7LTZ%?5Ekq+w9C=_IF#sOo6 znpB(Vp`VF)dq8v_ZKTkNK9PWPIDT6_%IVg4SK(n@eQ!mH4fTtI7WZICW z)$cl#?T3UAO-^>EH|zL!LCX{s$J{viiAO2*CTPx9eC5LV!I`u3tQD`@M!F%iL5M=O z`*Sg4#9JJn$>Mp5p-{D1NdjF1^0QYdHz>l#I+G3yjccoO!+gRQ8{(&x8I!Om=?5Y^ z=~x`OxpR%1jgpH9IF(*khX~5g-ETJBVg{Z#My7!HeYdGx{ZYsDWEbmEZH8k9XaL>} zEgY^MkWA2gbrgn^pK4GKMpsBX&zRGhy&o3B`+O7ptTWQ5RVOmk626h+-1_lU=yVd0 zBnu6iYg{e_X3c5EQE6v6ib*U&?#GT3P|QD;=AR4nkFUSwd_SHewJIi6cOP~s#K5@fQ7+lIQjE)#jCM*ol@(>W{44)^|1HTuCRY=Y{Pz zmSasu%$j?`&HKJ_R}Qd3Zruj-?f1-o{hrk4`A}hHGg})ty1|Vc?qXL+4p{+szNo$Nj6h!_j}ejlbp6=#gQy7b%-(Pq|N` zz-cNEc&+fM6LQTa&sv=K-a9xF(g~`Zv(2!pV-5GWp^D9i(_#w4qRDW14csA_*5;ec|FC$^`d}Yts~bkN#8dA8r-L*5{Hd# zK~wJdF=UD>v@JO?Y9K0V`Fa-3}+eRalzE7!Z zh(AtzrGI+xBOVoWHvf5XEgILX8|)4Wg`^*3Ub6{T@H`pbIZET?|< zuI#7PZz|VdPtTY9&sTh8*1)gA@DgZydmr-h@3-#Hv+{THJ!BYKmV;^Wm+g`i3ns3L z%W$_Gh)=xRS95Cju9HDNr^M&yM_Ae$BRNryb+$hB&DQga_RG_p#+#?xSK^lEg|Mw| z*pR2u>GemqqN{g@`=gu3o7F-a!5)Ihu$KWE(*IO*tw@$ZZY92t?S}(8ULA|`iST^R z8h_X{0M^@EOd`|zKwcEgKIRB)X#{nIm+=Fg%f8DY_ZQCka)&zK6~BMNl*ZeuIYV+j z)qYRC1!E1BN4`Wzn!FE*HFfo&WIsw-pr%Byb4=!}@iPCOLKN9OdZ=d$O+GU3F&2J) z5+}CjYb^qDCd)2_1dSJXo*y&0_v1dEH&Cqw{HNe79mkzYM1r03cb_f@h$;!P^9daM z?orKh*-tvELSJVvKzK=%&kb`(;-N$S6c)(`B_!fIN~bQ_YdrOK+sd<(g%?uz(IXw} zWt={~t+rp2^I*By)?{%ugjy}zQx&3oI^!ayl}GiOp~X8lY&IJh1Y1RHDx0y z1f5^2JxzEAW1uT)8KtLE)#B9kgvduGm?IeG_&i*vF~7<3hz8%hZ~QRM=)!#(#_q>< z|EkVuyPp_oA@+2^L-`5wh1iGje1@Eq8I=hBt=z2lcZpkkN8Oo-$S1PNnlBN8d`R3iIBspPFKYx=Xt7_SI4wt(wyH1> z?e)zTF=GT!9y6ejI)2IVxxI1eIXh%$56tmH{!jh>XB7{=cKeCS;`EE~XMZQLQ;Q{` zWUfp1xoVPqTQq0Tgf}g9l2@B~PWH11BD))Z)94A$7Xh&6P5Hb3N7-A)MY(Qa!-60n z2qIDn42XnuNl1f$K`KgjiFEhSAuZjhAky94Ff`JQFd)s)`QGfU>~p^Jp7VX*f6r#m zZ||AszSmmUy4JPUI{xTnoa`t>QT~QSqobjcP10jhv|%HBC#nKmolM#d9|?5 z#rIA`WGt|#ojPvd&WJ6hnK)NS&j@0SJNYsxR?Q-X411!{kL$IsS~ISw&rAb-NUQ4j zI0=6TJLI9_E%%=*wFW#SE?c`id9p3eHHD9(?~*FZ2Afj6kWoa3QM{1g=_jzdIy;Yt zClUm4@$9%Yd?T&xBk6(OX@8qxX+I+>!aFzt^S5Ub%Ayi#bUqPvTFd3?Rx(J8En386 zuA#M?8W7Zja1sb2P2UFOgr_r#5+HfJS0BlrjR z{>}j*DE`Ho>WkH9X-bwypWprTzvSqUs7Rpf1E$%>E-QWQ++^oakiing`w{OoF}~Wy zJcYLTE~T}@WJ&}s=ZP2=b|UaD(jO4)D9+x6+S_3v#?D&2mF_0j2cB?nLXd>HF)-@7AW0PbC>3V1d}<|7bGWli+a*_#B#?4*tY`^)?^90)Nt?;FH?hWbi2SbmS6qb>)t@vyhbj3BhB3>2&JL2`+s}2t)m08SQ zCVez@ot^&9QEA*4m}2@2auVn-uimEM+uj#{zMgEs)jbuBA<@Sip+aX{9Jx)WmXxwy z*p@Cojn}iXTA${@ONZ-4<=*errldAk6# zG|{LDZL_`J;`c?BAhl}k`sZ3G^{4F1KjXC!79HOiVF zXCo@#pvshh6AKY_ zjaG=Z)Etbx?`m^FXW67_{D=%b+u^25xbt?SuiEvl`asx9uVv$N*7iOj&mKB=v%U#}SjJYw#=`_doo^AEIJc48Ta| z&r{FfshZF=zRke6-=BEJ=I(}tSZ#9u`P4L5lTc(Btbeq&lesUKIGBN;Ew)X*yokib z`9<*pn|Rq!{79)S8shSV1QkD`xFqQYI~Ie8&^DdS%tX3RrAKrh!XFhxSg-Md5B-ph z0Y;Qj3?$Bjq9PD>Ns3B4r^1fE;C=CYc#>*tf&mYQ;kRfr-rZZgd1I+#WLtRIK@lDC zBt|Bq@A}=jucOPdBqvRNqA81f%~Yw#X*RHdFE|itg=jtr5$)0?-O9 zeX9CQ&H{c^AS|wgSXyHuIW~#NlF_mpCUmwY<5WB^o%6Z)?7ifJY45;bO7scCovW&K zYz~hk*W2_-472r5)zCjTfe~2y>y1=B&Fkp+pAS#2P6Qb{e(>riGCs1sjzP5gSFTO8 zh`9W{IfmB9n5S};)inO!qzw_>E%16*y%tYL^jD%j4sp29xTCu=(7mtbSjA}xU&VxM ztNf5C?kZL+FvmOEdo%s@s|vvE8Zn;NDh@%+eYOK267o~yQbmt?IroO3UOZIj-iBszxzJ=eFjWeoEBzSn&l8D(e z3ho9@v_5*ao{Sw_<&#b)YIfUACYbDJtV{+Px5O6ZHq65N(XuCk0rm*ggd^pWjl)sb z?tX7}L|KC_v;vk-*N77H#~s4$T}48ON{HpI`-@NGp8S)VY$Otm&OQxeiGMr*c?7`j zsUODvoiDxq`d1IK{ur_>8vZz@6kg(u&J;q+_pbl71JzxywNFqmBK(^Kk7;hhy;mlR zL!+G0td56@;#%l*#REFpOY010tsf#pbJ~Sn`TXd$_^0uHpmT+J8ypwadH$}59g5-sd@Sni(pRXbm7uZO|qmJRH)*~vo7SyhJ0%WU|W;toa z5-*jU_g75TH%ID#ySEaTMFfxBL}9pTe&Sd#6&B>b`8 zGG*}H%}RZf+{3Rg?*HSV;k^_H1Gy*La1xMq@lgImxjtxbNpcq-2l@i9A_5Qj`lssc z-qG&AqbMzlqAu~dahxtON%C3_jU2*Vx zVD^Pv|HF1y$${;zatDjyqoN|j#FEyolUv=_4V^4zG;Zbt_sIhSwTspG>{a9Nr@LO! z(&;$93z5c0(oKioIiUZ@cqZWrfC9I%FWg>8wYhlj77;&z6%udPfbnzeB>ciKL2?D2 zXv1_KQztEAEa5ABrp*~0tID^on`g;1h{y|1j^~l}B=F%Y|WUX6sUou|d zQLNN0C=tHWH&f&r%po>Ah5NKRsm2Tm-Nj!u1^R?|NPqt@<5qxvX8mylL}~ue_t&oX z_k(+G46t;SoyI=VmHRL_(xc4lPteLEud>5vDi_~MDhpG2Rceh$-hgen z@FDF@&G^Mvs4$u___p$MPqM!Y6gfUZ{9%mxS6Q{#9tcTIKInZtv3Jy=n5KZUIYM3` zGiBwRI}v$1Fpl!%&J7Q!>M^aavem^HJWcWjCm%a$Qh1tX-AXW>0`>2(Ie2x-gSO9! zasJ0K-v_r}BDF<83%n>C%4WwuG1-0L6*%Rs$fqK`M8(H8Wb|6^BLGx14&oTpkZF|l+By(rHWWuExXIS zT3cAeUHR*9>5&B#l|epZ`e5q%G&{V(;Z^o8D*pN2|9Q;rVOLyWnBz}>-&x?}LKcOX zuY*_`9(o504yvB>J^BhSmZz||x*aVhmy92kX@N?f3{#9m=X(AAiWobO&m>3+&}ZLb zZv~r@1sv__;Ns|u^56v&t}Y&;EHo`=wOh9}Valf_1hlFuk}YWlME3hzQWNMP`q0=V zO1B@J%k|D^Kh|BLHPD`y8bG+y02_V|Y?we~4<$Lm!x|na19PjSoV{V8?K|G$)vAeO z(WcsYm1=l(a&Miu2`wKf(m9ASLmgAEjG54L$ero8H48nV0EYU6Clt%`Pwe`GUax=V z3vx3#XuWWukVr>NX&uzp!8N0Lk8|QKv%{NFfZl5-MDjs zrF_7*e#nw}ym|w+A+Og4Et)cVNjh&R-<>vbZrA?O6b6*F7|2piZa~N#=Cg*!Ry&C8 z=y}~F22_Lta;M?-kMQzvNczX|UVGr{2Ng>9+9?@wHp=xQbV(48GLS zJ$h8dB1i}eo(G1611aoX! zkPq=Ou=TtJUrAu{`dg-5VMe+q2bBMLwg3EuRtiPGSMdGCiB*8{c$zCQTpW1-BZ5&y zoX%9?eX!A)?Vhm1ub2OpVU69!um_7FZU`d}cr4v3dGw|C?&DLFCb?{`eLEQrw6?`x zrju3y%t4n>9P-f8fJb>)q_(JTt89BsTalSqWQw*1qO+@+NqIIO%SZsD3c9TrzFCZ#y6?Rxuo%$d!k0?YQ3+3c<6_L{dcN7ow z2xg7jPjM*aj z(j1Fm$G!{WQtnQ?mK`tFj?jxBOQ><&(VTruD^gMKoPC@K_0XeGw;QZ?s#30O9jQCD zQ_o7Nv$eT*h0cJDvF6hzg{`C2-suRk}sdACv)Mw z+SDQB)3;>z;4*bQA`KxAZ*_gn<#9D$wqGQ&rw9j^pz9Pkx?_R3gpl8sTBd#lQ)=6j zKL2-^G9sDMjsNt^koRdvMiBUP4_uhDFgjoMeG+t6!r|;Qq=-0ai0JmRRa1N8Z?h?Q zhe!K1`#tG9FOeCRf4a4l$M?R~_1W&O zw@~VCK;m=Xe|y{}l#H3|MqNMY5N&C>`2^BY1i56eMguj>f6dwMxT6y<54HXZFH?4> zidZes$DZub;QWy>Gwg^mw%WDI*OfC3ub;&W@$9_twJ8_)vb6~@?cRov$oBR=5(pIM zNfSG>wU7EQ3E1E8{Cg0QcQb#b;79Ysv;+oOi4a{(Gt7&###hHhegufrgn~J@Z*sw= ztmTPF@VDAXk|fjGO>S$LQr-r*FO0>|4=ui?CrqT-5hEP5Dt;O2W@O7(eg}g2l5LUs zSJzJOYZQooUl01(SpG)<+a=~)(}ixyIG*~@WMg}P<_Q$74dtZAB4A~)o*a3FKm_4!{B9IJCs90B-7+t z@9Ec`=fB-tJvqN!pt<)IKzp<~X37-RjF-5YOhX>gvl)umQcUsbXsEFEr4MsVH4>Cv z$HhFo@-2Tsy%GTRDx{cYeZxqaY$9?|lUFbueF&TGpd{((QLMDzf&9htwAni)R%4?i zg;)xbFV(rou_XVXSS0^*SN# z@~yj*TLnR?fLbfs_MBx;CYPZEbRpggY0=+4SA_y7btHWp%E@t0q@zs-rq@U4pY5Y| z_rO2d^i!ouFBW8uV<94f7VE|_g_0kXcyzngqnY=M1g)44uZk>4u}*ENksZ0A^*)H8 zoZv(3prAy*QMCW`H(vp}%IpB`$_lY3{UILMWkV*?fUV}BeXCw`TBFU+%dApEBQ{C! zQz@d@cZF32c#02=^mqZM+Qe4%9Q3-5p4*4MRt{wVwiDB4{yw;CJa4daZ6*Kt5as5- zjK(KBs~0DpOg{0mu@{QDKx^%-4JauJ_njv-~? zudgXS0kINK%KF|ot)ry9+dJ9bkbRz?cEgJ)I}LB8gS&?k>Z&Eo)n7T|6*oxHI2)Ed zLtK?n6wnCH>J8)w!7F10oa;&@~>S^=qEewZkFGkI^QE+(LsjlCS__0 zBs^2OhD>afz=i79jK%*C7i#^Nc?^O&+u%tH-7Y*?1vE==nO!K984uK-T298HUjd1( zNOtWzh*{go$jH_F{LhUy>!NIoxCnV}0mpH6xBnW56rywua}Y0|I}Teforz-#Q|XHV z{v&1B{%2uEzKJ-0*N!PIHCOe|@1I&a6?u3uU0EM2`4M=G12GGdrhQcQX=bq=%o}k7 zpbPh_ilj11%#yi`kognuR<^(4)o(iBYY$EGIyN^lMoFv$D$=t&833jkKck$rCdiO; zC{P`x-fpsVCEh2Vya)63a7aKcxxNFHS9nUngGA=PqYBwLbop5WUc>1;{}R4B|KV?y ziN^KkoP~lz(HZ2#uep&Z<;M!nHD$JB#(Uv};qy&BFSeh%r%YFpS#l-@bH>nmb?B^66eTxU;A7SVCTiS9q zA0aQccdahoAqf`JyqO{TPN1fhtssVXY*|MPX8gVdNdiBkuSMIqP)>JnZdg^{ zsFx?GRU`h{V|~Eay4Uuo*f~eo%j4KMgt-0s+8+UuYm26d?Z5k$zu1!dGQbBB_AQF! z|AB9h@6x{Q){U`?@Du-hl#gruodvh)!wRojmDmbCX@C$b*3#M7Hh|^1bo)4bvft&i z9^H8`9DTFrBJQct`X!iOS;?S&=AEN%(j}PRNlVs(6t6-ue<7+EKe%wC;nP)0jVCLR zag$JSbnl=nmi{V(`}A6LyX6xXTV8SpDaL6XY*%;hyZrQC`H7sHZCbOCXhvq zXWY|{KaKTez%J3u1rb;^ll7r=6qRC#{*oW05+ z$8i|6x%1Q`90n^abe;fC9uz-&i-x3mJKKUD>MdqS6&-{K0`1ymCs@3!J2lkT0cM!l zC^jr#5oz?;!%ifeLtlxLv<@3qkrR4T>4KWw$tt+X$=8HiZZ1C{<96}?V7WKK?63T!Q5p!p$q7?Z}vE>x!Hw}&6XKPsW5&7yaX7ph|5?_kn z0-|>x=cIEaUF2e!KM+?*gDso1`86lsVX@~?Ih@2RxM&RTdwZKS09tEVR=OLoD)JuD z9Z4C9`_k5V4ntq~Dt+hP%t+`o=f)0LMP|qld#gyiKduNPEsj9~NJX2qZ0=a|tFZ~S zTq`!v#D#vQ(ci{|4N#6ZO)m7ICHW{l4>|B^Ad&M_unwr?Lv~?^2x|56HjdS*3w5{R z`IBv2F;L8{Xwj+v`>jOK0sD#m-rTAA$9`lnfa?I<#1u37SgNM@IG|m4VY+uY_xl+q zVGS8GPtxQ2+7v8LQdPn3n99Ad*I(XdTII?@!LaY$GX!&2Q-}at(@`mP^%-@RY^sMm z$7Oa*omBh?sHj_wJHQi{tcL7bnnODFxH95b-`Hy|x{0o$mM3izMYY8(^OeVlP6dYKH z&Jt}n$NiTV(o?#$ys$Jr{)_Nhz5D1H5av{Qr|@f8xCn!Lp2GOADjHt$qc0^)0(Xmi zF~&sK<|Vf=f=2>D8c0mJc;g!C-34#P*G=o`|C>8zzjDXLH%09JTqhJe?+M1s)Hz_`$- z_bl)Z`d#%@%&tmB7=A&5VH0e{+cK)m?P$HQoecC_vh5DZ2sRG9;OwR)p~Gl=`V(|H zQdN&g@7`bQ40X)DQY~c_IU34N4sp!Ip(tridmNL zl&Y)^j|Tq{YLmPB0ow~f_n-c^OY?t8BmJ)YbqktX_wU?V2!mQSBcqcAhr&WWzT0NBqL-5q+-wx9EWO@a9Igi(KGpgp^n%{YQxpdd}%CwS@M ze0Xk`x--5ySHMF~K-e{}c&7e^p*o{mn@f}oD#M3Vi7d%(vWBPp8qCf7YC7%sCRh30 zc!8FuGoq(__p?KX_WD?+F4%tcvJi|QP{HQ;si{a-dp`{7 zjoB+Wn{@iDZyOB~0h;UMYL6-yjx{Svvq+yCy(bvZV(A(%DGGhyvG&5_T)X#5H*YR_ z8HfsBcJqucWfDkYBknhtzOG-0 zc(F-5r+)C-7w2P>B_zt2WDdhHVs!7!?nh+yVQpF*D$IAGk5pmzKIT^}SXQ>^*5gc; z8IM0YoECfm)=GUXV5)Nr6?@u+Ym$eA%6L;DP>lV%?E7k|@gmFBuhC-}FY~3MlHcc; zpH!b#21l8+t18z^Ra&w+AIb78Y&Xj#>h7lo(C5`WgJM(ZC$Swr%~Gu_%26(THDR~% zq3u|KZ3%ff{AW&<{m;+1mSbAJ;~Ai6{vuNv&O1HFPbYgt3#Undf*!JfA3uaZPMZnf zSPujWB;>|)!siP%M`e}2qAzNeV#qqmd4)^_YjiwNo)AyKc4KA~Z!b58Apifu`+wbj ze}BLl{7X$os1xW^qdHlbWgk5oLDBdA#M-FsX3YIHlxJ4)`_@~vD&od7;>=`f96>%2 zAMA%rVCyhPw@}0SZvSltwS9|5z3}vS#YX3Jao>(PG@lMiN{AGeLQ0)J+eF!)?a=79bV%Iu*l6JhPPyMSSVB;Y z9R37u_>31PBSgQjr~{jKoxE7Tx1c%6<$#BnZ9v<<(%|BgoG?)PlHMqf-4=-Z466vRf5ra%*tjJ;WA&!=?P zO2uOh!-1PL(Jzp`IyCx;m1ZT_RYS80hjb0gN?B0eg6;HNQFO z(>_xp*lF-2_dTEPp|gGOW!7~HDX8ardhoLP0;qSXM%Cz?^rqb2(Lx8+N{$^TWJ`;k;dV8-#xu!iO=tlwtT~%@M&0E{!+#U_jEWNIuFTwiZ z%$Buz;V8}!XA%jkG2#0$$RGlEta;sd=%fVni@+sK=$dvq4`K{9-Z_^AItIkcWpwRA z0+1IYxmn&<`5hE?@8$fXk8;NX&OVuf#g^F?Wl!sLsP`Ac>2MB}S&yUWj1zn#(8btX zmNIL0Ta$NlV;nH#vrz_oXlVCckr_kG=-+*RUmRS=0Zq7?^VvGP%I8>tV5;t@DmBtE zWA7fSsopHBuC@L6V@AgM;?DAEHH}0FY-l|pgX7*eg-ddtou6-i9?n7|3EKtr`Z@=R zXmlRAJD)+{$lu>D-W_J|3%`v|*Y)L7UpM&BTlu_*4jUZ7@1NFH3|!Yv_eN>PPt`tQ zc}f2(0eoNOD$Y-einjlW^J9R}9nuBT3Rd4AgvRoB<=b*`137uxbbYxzj@yDl!Wun& zI|}A;9=Lopludn(Zbvj-7j6%~^*=3}g*u)3is5gs zm96DfcNMmCM*h&R1&9NpMq1s?#M|w@j~yZ9Y8D0*O!Ay&7n3Dg%U;tK?WDTxq;_En z8nK$~(lOj}KG>wDI4c?tFT;9V&9EO3V3G^;0CYhGl&PnW%1kE10~Ieu6?tnu9XhRk zCDel;Mv!}iX1~0ATk`6SkHh|O%hb^~$|bb$ENJWQ5>O<`J)Ro3>f;A-_U6w+!HdxR zI^{=QnCA(oJ<{VvdRRlGSVN2%eYf5s^0lhs!IBPzTy>q8UIk{Xc+#Bd089YBvFMb?@RU@E_dIx$`|;hec_Z@pZb(*hlhz0fh}o(;-O)zaqve%i1zqd( zbiQxwj4bBi*wE%na;e@S^8H(+^e9Ehz48)$9{E!pd4`N4Hx87R&|Qp3@tJ=CNdhwC z(PL`KmLU5fr9d&k2+T3IW@n_E%X`10YXLqk?W;!Tpt#bdmV->?iDc)!)EZueS?bmx z6gJBKnk9_E47GKqo1_j3^)tJf$A>P|lf>`@W?wRB1nF*5vCdLDYUgELpRT|GV-kvK z&8qEqt1~=ha)awIw7$pgsa%=l=DVeCg;1-$tw;FflfBZlj!QCZ^Q{IOb!BSyosn;B zdW zKaaM1#xCP{QXqu<)mumaD)@wsAX@FmyN^HebfPuN4{(UbE=STVsm!Nu{`x`af-YT- z3V}uAEcaoqE67KxU2HwbDt1+?K6918Ub=}UW$ zpc@kwSY+hbGCY+kn(QoIcIC~(hrFg+G&D&>r*9B7(uqs)W_3S)eUU<4Z7(%8Tr=oN zqN%_(rZ`V$<-I*!VCfj++rSj-x(V)Y_Fn9#S>M#j|v)(mb+X1Q{o zEk$d53Bmp4dRBAbm@+S5-`a2IuKCoq(d{$6*Xys^$sC!FYzpNXx^`kmu%5F>QBbirQV$ zakU=O0h83}D$jQ5e`ZF~-#lI|{ZYPU@+RvIRXZ~&m+OVo;JFVOo7tvH8MLM2Guy}E zMSTdLD1-f&94@mT5tQUsJ5KxjbE%obyQtLSKqx%y>qP6Tvgaj4s%P|?2x5*=PL98Z zge2ID7eT4g+%ABomr;Dy(9NK;R+vzDrNqJiS0&C>k4;dBAvLLVP%Y9LLPjvmpe?u; zcFa+0H{oEwQ)P%bY1H#Q^1krHd+mwlX%Xzi<6QBsvpvp>`y42*#Ss`LlMe^vAGVLX zpPTLIGUO>4Y49|l``Vm-+<_PEo&MZ{yeihL;~=wwYZ_F9=V}W4s(t0Xc)2>F^8Ni} zvt!0AGvDrjIf1dT@^L9R>DLZKsn?xuTWg5IO7h zPSUh`uxS82V5-u2iay^{!qo63U<`_)dN5%lG`LtwIh(5^4;BF;nW^0)1YxdB2| zr@88s=bL2f&Sn)y2pPSpnD#QJ7lF3f6rr1k;c3XYONWcu`PFg<-|Iqb>x}UqcpvIh zEFiDIBx1?@LomGo1QTPp){NXEkj6#b{`;!Q$P{E>64s(Dp%RvJOfg?;*+R$c7_t zYmLKJ$NqFxtV_;Zk$L|C$3AU4PRr0@TPO6iwI~tg7y-8EDi7>OF&0WL5<&L{B;v6) zabiUCji}5{Bzmr-_7$1Q7Bvsd`=-UwXS>k1%VPo;A4(nUD3-C1nxG!JRuFE^y4ICCdErtR7?oIlBhYUo_EAcm_ zdG<@jnhCg(0&m)^{fI1-3AVU+0f(Ia2&1wT;?ueG!xd){oba<7-r+Nyb9>U<^-ZR1 zzG+{mu}V}x0MA|#Ei9ke_3(ur%3CaB-P9@!tl!NH3C`rm%zZ-Y4hw)=|2K{JlO7KT z{LS;(ABC=VdCHX{J~(6rKOj52XxOEf?|--=W+t+YvgT4_YnbcSKW4qL!2ykW!IFqi zuKSF)+BwbibX=Tz<9AQKV7#=5)^Bt+%RA5q6SO;ox|DbQGI8-XJ5zU3Jdk&wgJPS@j6;#sHesyzl=Tnq^Q?<6mhy$AJ>9Y z-5t!kv3}h9su&gmm9IAntb6xeRjg`1P>*C}t8=f>tw8c{z(B7rOq#sw{GcN}{?!`Z zWcSJCd7uB1t9o(O7hkE%m*k;BRkJe4X!s&}5wjtOS#qy?SDg!wYo5^LOWO|rv9L~Hk38^)%3E}5^ye-_Xjq2I^Z$^TCWh5x{ zG=HkTxgJ8X%B6>IS9P!-MuY>b4fxmB=yF<88j~c1KjS~5)0^16&6!PcFZnPd3HW*j zu-f3WD2~Zv-i?xQ2E~GYT>+V167L_)#>cnue-?=1l%_3+1rT&Lc|*FvOk};0oN+cM zX@&q>ix;P;>npd`R!s>S)&X?RmV}yw85j3(+A8(1fQjjc-M-WUgxHfn zq3VQ&9U8@`GN#`XbqN~ox?xJiUmO4+@xbgYA0H^S*o}BHm_JLpV|Wn>_L_ALEhZId z9Q}gav4M3n%Y<4^Muc1S^1OcVu(A5~>OKw>Y`o=2xZu>ejC7J`nWa0BuuWWV*X#bd z6s^uFz#LkCarV0I^ny35Q09)q!FcAz)H5jH0ok+`P{w!r>MgsTkpBD`uA}kO6f~qx zBu=SALkwWE0E}+zByzJJEN#+L^ImMv<4hcJ{|7$-FKxITK5xpY8yD5 zt1>E`MSP;crmF5>6UGC75UXS1j*x98vC5n7Z}!_*q-k<<()MsTy2^roevQ@$1JYMX zt_K;jP#Umn#uj7Q$?x`ojn$};!^VWoa;iJ-K|-F&;f>0TvdIMFeRlntC$&-|XD!F& z@iix1C=#H->J-w^@(FLr7j(F=_whCB*NzIJYd&P%#UXjNW~g}W+{uicIcKI@cHb0wL%$+{Wal87P zvQ&Kn`xVXyog$eDrf|Qu_Kqxr1f%Lzm51^r?LjDMQ)Vwep}a`>fbkp`Mwsinsvwx5 z^xANA-gaWN>KlPb#Vf-N%WFi(+{GbB+*#~2%5 zY}UfbRSAK3AQ2kWIfRijz+8IA4h*;3_+mDz!mpIe89TT!Sv;BcmB^aOr~MAKF%2!Xk%wo87)>Y zi{-J(7*}Z5Q2}JutMaw{a_@3@?^C6N>iBa-P2Tl_bXXiua~VJA+hO~#eN$h9ze)e( zE06H$jBR#_*(}-3oF9QZC!yZ{+xtiu1_6v~_djc?)2rLhqY`s(3-|_%BpS`!HgCT3 zE5E}N;7pw)qQ#O~J+=levk}R?sgI+1wfqvS=bY3xCwRADrP`;F^a`&|u`|bbN?aOl z^h~(cFuEQuMGqdIVZsE&+l(Wy5OKA2qU~>&xDetblcSHfD#G8kETG?mWrv;z ztC*I&d^jjJnLC;b@G8CxSG}hC?Dtgd7t?i0yI=V(#zd1YHk%?ZD}}$0elyHw>tUNs zd-pJ&N)@dSY85Bx>JsMkantN8xT&+RaQK>;1+?Jb4ZKWt~vEBbrZ^nUz5pm}$q|d=_uk8=($5oS$>BmM7V3mvFG)D14Y|C$Y*I zx>$J498-?8P6-MNp^L%1>KCkLH~qYk8cRF;d?8_!A$(1a?AkwH5I_B8QM{!=AvNAk zGc;c&Xz#|}g{p~rCj+E0c+NF7vdP949zqqtMWs}MU?R>{zoT0U1bzpo6X(-$td%4! z0@i}S=+pEDf zC@o=X2aES06Tf>YvD|)EE{pkzv!@q54(LtG6BDd=v(l{23ifyhawaZv zi$0|vTjZLQ-gXgGKXR`RST8*ku(TdpF1rX2OIG4M*>ciT8L4SBU6Se6n^7q?uJ(`F zCy~`s{MyC(d54)=$t~%1)p?PADJ+R+dh?VWW~9IExU8D3P@g*d?VZZV<(BJv=d&eH zavKkMy%A&Vs%x3_ln)dtQq*0lhrdVC>ux5*x_AFNPJ<_#c1NFU_IWowTgIn1rJ)OB zGz#7b5p-tWs^=X&QLUe+cvIaAU7qF8)7ztL-l$v@9KGb!wy4cmBOB|#T|RngmY8#5 z=nZ3sN4Ld)n{W-5*|jKMJ(_0Ga>681dI%%Stf9AY z=|L_fp}OT)6SdlpUjs=5XulYwRjK(7eOa)b?5?vph*s<2f6G;Cw^BH|;kq``Rq`Z% z!sV>rsguH&i~^18*;Mer7jmN>{?{S1TiKXlIFuOpn&4LsaLs7E0_yoHdlPo59Bxw8CAWOY|54bZoJ8)l zsWzQd-X*;C>7>CUsTyb!LJWk4*RsowRdY;&Kba!nwR&4OlRl}U@*4o`-aS%t*gJWU zw0sFW-<-_X3*kQu(@`N|c8cq3*~O=uSp1UAyw#hycpNzJiLG+BYRiaS>ix;p3Kx$}>5zLlDjkvEs` z0s8-9h*&f(y_hKmc6X*`tOWUPi0kSmA=tgg{xCi{Kgky@wlDU4Z6taF2H%rM@cLc$ z5D`7p#Y9Z>?%V%TG2Le*b==%4%uE_u())VsA}PqcSFGkLxNWwnleD^(_Do@Hi)O;s zIN*KS;r_SDb>g9)(Hb=Z`Va6nv*e(H?`MZ4rqAG?C*j7uORAN>PQY16_HJ4i+AKvz zw+GC0dvKl~x+U?RRHr~We{Dg#p=XV45u1mBDaW#zhs(>k%CB=LY}RYfT$c}{m-J_p z%%q>zhv!GqdN}Z72VwKS0Um;3#Oe(sS!0wBVRzkJMQXwXEPV(9MV&f~Rt_&yj zm({8Qr_OS!JaoIW?PTGeI07BE#2ohKb4cS*-;JPc{sZ57nq(5AqBOzB?|L9}G*XVO z!9!K^I06yebr}RRs7ksqqgD&w+N8p`-#x`4uQ^a&5Ai_2>uJpDNzcSgqL~Q0H^uif z#ipcm(ok(api#!)^s*#35*tL8a`G9D6{IH2Ru+?3w9FR;93zj^o@>>;;9nXZf*X4xPLhn(>A|+#I4n4?NnD-jDQ#IL)%HygqPM2ju2{`*FB@KNtx6c-X*Sv?y363OW#$5Z+CfAM${lJSX`6km>G`Q%*og zt^_frp3c0g4`@5Uaxdil19yaI-52O$1UJ3#mX0_#a%Sm--nrwUG+t=R2OhMzLTtT! z=x%s-jLi}*sW__psu|fZs<9it)w(#!Y)9eD)?D{Ds^X1}J5QAN+J}wF?IxSnnuOne z>wBkaa&@_P_w47&=fUH&%VM)G5j6Y{q8;CxqTlxM^`Vc4h**VrZ`%O)StbSHTd|)Q ze|bKI4;|RR=G}ZeI%{8id^mfsY1&(N!F%3_cI)w{^+fDCQhb7G%XT4^(@fmNnIBwj zP174cgEL=;>!?i7x!lmyyi}R)v7Kc!cD3>7TrlxUrQ`nPfJiJ;^R5=%s_))hbF4BQ zJ80jk?{u*{EbZBJ*w?y^PxYOf^@EenFC(CB98Sq7v58GGI0@}&jaJ)$Wsf(#lV6*$ zozYW}qo_#ot>WKr(TRGgMQXKVZE`raGi+tkS_Db-Rh!F9qNfkyo^Z(%JlMXwYCWL0 zTpda}(4*5_6qUVl*7Q2B=#hHg4TX8n!JZ^Va57%~sOiPbL%dP6(9z%xi~ckI;O&fRtrvo_zMbrBXjR0YH51Av2X?@GBesXbFmC_0@=WLwpPYtigW37W}Qkd&=HUl+GeMvY`I7 zb$_HZF=R1IdlgZwN_N5<1ZB>}Av%T(BQywO&zQc)G(iOi$~J3Hg!h84c$!o^TTC&CTwq4jR>&*4}z!a9LG$Tu599J^#W8kh?EP08U`RPI3kJw}nRB z2O=*}Vx0yQ4w)S(3SrAG~(KQdhXfvGAuX{!_r|2 zLmxGt?Sj5?x4(wzC446iM)Hh(_N6*^c1E{^2R>!>Wyk^kOvDU78Z7S`>3l4>7-UGj zI4f<=mYc}6MOs;>V#jlu!~Rtw-rvcLX4rhqbb{@CWh~zl*bfe|=GOvba)#C}E6msS{ zOep>u=P*ZMT- zO-gZe*PC9Ap~E7v&v)X18*`ToQ0$KBgiJsw#RVRvO9WxBMEgOSetm<7ON5##unOKA z5=*|NV}YEaicYYpeWgZ!Zf}Z=%3LotS2kngGXC@)Ub>1SCfwf*CknfK#*KWX{gazz zXfEhjsr6}w>tp`$tv4{9Q_9{$LC_WWn5$fFq{J$`LtmVkNkU}Q2pD?g4q|o0374x@ zn(%8!)nCs1#Hu`BChM)cJ=)8saOo00#?hS~Y-gq=!q#J+70Wao?^>fm690-NU%<55 z#KC|rNTJn>E@`MIvG87^d`0GEuhnU`hcbS`nms;d*4TTl!zoj;#kMnrx{F_!lM?XN z5d^__tFA~}24dwhPK+d8e*Zu0zgCz-CEN6b6B%EYaGBK()A1b6?Ch+Wg1Zz4t1!jQiZ2GXXnZ!h z|Lt@0b9ObIA;i}5B${K(=rid`c^2Y=X*fI+!W;o;u;A2@<+m*PO`YBOtIJb5dv^%v zgrrIo}di7nIID7S?VkK%$T&|*b z-Iz!4Xg+oJ#a+rWgs-Y1M<-8a z%|de91}@8zdXH0ZLRKb;r&R80kRGmx;@Ia+JKtWmfu7I0^vNgh-MNjJiCeX0Hm_&N z-%t%Pi2VNJi&02Czr~6}wukQdl(~lIMY&5wKIWl8RM8O6S+dgRte8!sJg7P3uc;_D zak|{hbAs|i_Dt?q={*ERO-Lpl3~tE;?|Mi4VHtEEUV;tX7uajAiymZFOI}j08pFVC zE?0$A)>TTNZpv|;lhilzt-JLh1rD9&o!YN%wN0AUdzu_zE{7P7yqU1!CKb*7(Z|i7 zZ|*wqiobmiN#&fcKX8}dY}G7poGoeA$Yz>RMY|ra?yy&tCd#-EH{|WV%{jYobfpbh zYZit7VQm!u)`lpMew~H|AFFra!bCJ;d$sMMITj7}a|9(gtR4;$V_^Pj1|M~ z1Y|nd^=P`9fUSLJE$&JpB%aOY{kDf~>G{fJJlb9yY)yL8ruB=`4km*}2RC}+jx&x2 zS)*1>hcd<>)h3ytknl{&&(&L1D$ndTAFEZjv0w2BnaURF}cn`mct~XPJvX4csr=)9(kS!2p*D``%M9Tr$6R1#5 zAUak5eE2#=tK-o!?IcM}I*qh6@!Vth1Nl%|tpLP`@WPxPfLB9s$M;<_7ta7+apR72 zLtxKt4@lQ`ut=Zs8t0kLm=0=i<~|5glJt7;>$7Oav!_3vC-Ee+YjF4>6ZhU4bdRb02`5CJL9QGTMk zl^U=6;>eu)?NUHVr__rF*37g%T}1%Bmx|%5l0(*E3@P)}l|4+-5YC4BN$!CqOCi5J zrK=I!)2BE1;(_*4Ehjdts`72wdz?U*wEXzL?h1hG;sbJ&s45;iuB#>errN3a{r6nI z5tDA!v{m5Dh^J7H)Plr@N(%3?c$wC|3%d@I{!1ffQWju0Owzy|>^6#LT}Ux}GI1~rhP zO$yv&1>JbHgBa_}+&AbD&wdQ(Z{PIs_BV}3sqw9)QdIaayemkEz=J(vGy)Hdn{!R& zi`ItPrQ9mrsy&)@M|$UZ*Snk2R`uXRbc2wZwe&1#QzPk!$<*grt(c%+{W(89%>7qu zWBOqDp1*d=*$!?LWc_G9&KUpPycmQ}LL$&@D#c>M>5n~!+Q3aS%l2d`AlxmO767dF z|6J^)=`A`jCw1QtgIW=mV`bxXHDezNk>5J8k;Q^lX9$hf9}0hKUSPIiC25zCt-N@G z>F72#8**BSZvWIQlMa53JpFa-y{_&7&k%H}vS*ZGZar!dHFozJKTC|%ff^kZ$*AeW z5QisqxoZM-*HA4}0i0q)+%0c6Wuid(Af~`WQ6Lt_03j6lCA52Ja`=L+Henw8p1ZAk zEi!YqHbFGVojDzrmxuv=1_+1$jSW+VBi=h?ApeFM7oSKxY{c8=I zi>fp*n_+e1=5o4B_H?*y$$eWbnPsy_=(eDb8}_LX54n3wK{r<_*ck^m?0vkOw$kbB z+5{&Th)%*MlB_j?{u-8 z`X#$^!KK=IFQcv{~VX^HBaR!SQD$jiAXKIj{9bV>G*EGOx?6GotzDs{e-c}cA9jWsKGv6-CCFr z@oR-F1fKo1M)lMmiV$bQ^Amb*;GHMPF701sY*pK8oo(GP1s_!_h=WaIgL=;D&EPb| zK%W1L+b4HXzo9mYvH#TX?>9LU{66||axSxOGW4IGb|+39MN?NJ<;l8k0nTmxK$a)$ zkr2$LVGc;;QQ1V4yWvj)M_(CN+eJ4^I4<(`?fnhDZ(ITR(VfuF(C!ZOpVykMv_;@m8_19*HO?_a^m>jchipt%5ka%ufSyd#Ylc>W{)$U@1B< zT>vX~pS+LwI?#OIN8m2Xez>9)e-|al*SGl>zSDc|-Q4u5Sb^ z^Zvy^s0ngA9TBD(G?Zj*L5gnsOGDyuSIbiM+%AXB*#u%IFpZaZ(3>5%mc_&mNs&`D z3Wte&Afx(XHxyI59YZlF0Ad)Mi!hTD0(?!@XcMh1^3sIuzxHc4W(MLh;_nvxGJoe+ zrYLN8Q8SpmZNmVB?S^^U&@D}KKPjFW>^ps)TRy1_HNKJ#0j4D@f7 zcltW(kSMqYTc=oIfGM8olF19HolSkYROeW%)irMNu)>E=r3>#PjRk6flUsgQJ$&BB z@a3@=Y#jCLMiaLs4?)jvD8&w7w#T@Q57V5$Qzek(OBP<@FC-6YB6l$gB*>%1%`URV zW%5CR_{boAfl%0v^{e|w;a(tWI)-Q_^qn;4t6sJ^#Bym!uA68zfxRnJ7PBc{Lrvn) z9li&3QhDB#trGN3Z3%9c9KDdBiX~efAKMX0c zpT?;-0T#_5{QBFC00c__^*DML*q2?uT~oY&51XoR#Wk5j!!(ovHAz-qF}0Tv$qglH zk{-GFRbkK0esBZ58$!JI8K|s-{^+mRI&<&WhDEh*_veQ2ET0V;;K_PeRjDW4v1a9R z^;QeK@4fkFPQTw6`_nL0_gt>{Xub<2yQh~^f+&aRUL8;rZ-pN1&AkvyBVkB2vvhT@ zH1&+FJ!+f9mYrn=^kk;tq_dQ}_^mLMo`T^)^qclCin zOQ120n+(ry!n90^ZOD`WIKh{uMz|^V3hypjUO3FD=PfbcjdJu1#Qa>FwSr>H%fk|Z z15Q_;!Qy7lnkk2=wZ$CnN!FTY+q5lR`GfSKIo6|6_N}QhOlUFn52XKE>v7Y_Sw&Et zjfW+}z~k{nm2rGfh}XG++}3Pe)WhmgaoOvPBXG351E1iA$?jrrCo`wU!xT8iY&fYn zI~f|NICmVwLP&_E?*n8o`#$k?kFwcnoqC1Nq5JbjYo*N3?wiw{-PhJSB82g-V=eJa z(RMjL&>#K0DT~7o-oN|?nGt%e0+Iw1QU#wun8p_c%QhGTqTEO9Rc`~%4{PK=JoZ1r zV!)G$v+ZKR-q!mu>z@U?`~RpG+}groC`}VegYLe0V}-(pY$_>J#Frad49@7{YZY)_dY=VE5ou?EI_iHvG1;m zypP!QW#=#g-Ldy$&zU}|@Bf|E{<>-tUJLnbR^t$F=6Uc?!FMIYW4I1-eh#eE)xC*0 z?*_Rp=_jnJyf(W&Ln&M8R|Cwaph^6e3qALX!)-XwjWjT+yQu5{&8t*nav3=?Npunw z7BYTg(#koeJY{^|at^+WZS~KAG+382fZ)kWDR#D)@DtWNxQ<@S z42S{j-nV0CK7j79!KLx)V^s+pt!w~cvlq0osqJ@Re&v1&yXBc5|?eukY zo?7pXaD)ONw(THI_y#yU=!MT+_vWXq`(9+c13o?PQQ`f+7*l<=6OSo)T| zqZg0J$6&o+*XF@v1mvvXmb{X{2L1j|PE^dLN=W(7zURX8#Z-vw)I6;gpKH&MEA*4Wh@ORI7@(MPSmk6u!Js)Rg{C z_fpO~Jy#~NlH}$yjQgqO$m+Xvb3@@~CwgtVUbltwdTaj=<7&bfkb9z^FVZ-Q4l9z1IA66A66D;n~mQ(?dl!0wvg!*L2K#D0!XY?bhFlUkYq=T zRCDQBDLDam)KLJ;*?Z)nNy~0f!mH*+c(U_eG_Ha0mS|WYqI-a_1TRr{k-zgvW;#8p z#%yWi{|?w~nAzQH87xC7q)TnLS%7>nJ1&cCuebx{7{wj!Ks_USWk=SJTD9!nf%OZu zJ7ksfu_pMEG57;>+H|{_spZ^s%ZeTPip^F-VZN<<3UglKNAW)=k83p2N=+9J-w%Pa zDbB7(aHYT#z1n0GXkMgDE|>J0)`y2Lto1wZ$Yv)2Ui(LPw%;tA%q-{6?cCwr0uSMH zf?Yll9Uz;j?~VkATsG1lTF%0ycvk=b=fQDwbKDpJqM94^>VDXnUA7yAEi^UmDeP{s zrT?c;zG67Szm=2DL*%q|t1bE`ZqU;w3@7YjZFXomQsBK8T_uKpa;l{Jz~E*%ST9j_ zo6x+SuJJNDVhlz9C%n~Kam^jV>@dTdf_Rrm1#R8{EAFxH@5? zyu3RcPy%(Y8I92X{b_JIk_^~p0g}#7vZOx<)@)%cpvxBPfi6DP%Jr^@K`#Wpm%L&z z2_Tn7QB-^@Kbq486o+Nzd0K;nUQF2z}s zgStlXOW~kIK$kdwD(*b};c%kC{n>$wVP)>;`%99CJPye*0GI0z(ei@_CO~?ymFEQ#F5&2RF3?PkvqFpKHX#g3_oUb^VchH%eZG zMIQDrjc-r;ETldXPunI;4;XS1iQAcEDYv`n!}uklZjtKfw1>VLmUwUc>%FmHP7bHl zulFP>f@_~7!V5wqq^o7Cb6&Og<>uNxu(w2}$p}x%AcbYdg`2AfAIo9A^$i;^hCc9$ zfX%wVeL{fP*+xP3GiZ=KN2_9HVse(Niwxad@w!E??4Q0ojb9auUv@@acaEJ*D;pw@ zlhdL}q_!J`o5W~PmY!@dAAWwd!B7n#$5VCPm1Hg1?8|RatKafCz(ZSo?$Em@xwLNf zr7K`9an`Ga;T7p@q4i@Pnnc~QmX%07{7^xTwoi4sGP;a8opvK$S+!($?r;vj-ZXJeI5wFeCo)hkuzuA`n;h!0r9FRv^<*+9CT4u znMo76hVr19Eaa@R?ou5aIhU%?S?)pcnnc@zX<37cU3@B*9UeIEz%_3EUWX1{wH#TL zc^wNERczNE414d^dJyT5_$Oz=y%nPprj({9{j;-&^H~^lKx6#Vw-2^UA*9E5E(4$$ zgm)QAc0SB4h<9{r7GAjDHH#6y11k~pbVsMC&QRILiC$hL>rs`lh zmc|ghdACcG+o-4>jkLr?vglG|uX1#^==tm*eDG}VTzsY`F2oOP=V1Hldxf~(@0MAB z=fGVuz7{!*&}j9~=DRQDVincS6KTZ^E+p5>qbrA6+oPrOdN_}#vpE9!{bja1Sl%IiGleJ&` zL>ZqIKbYZJ=)4$PtC?aYyL~z#M!0Pt&Syw`LTCxvExL2>nK&}~?2mAB(J}TJt;cDJ z66g(5qlvNBA`cP%H%2b05LZ*g3b}l$Z(VqG#-jS>#MYalW*a9QDgL<_4+6 z&9b-s=M63Ufeby?<(`-%(J7;@Pe1G9fqz>tiaA(q0okjTB41jXZvx7vY|q`6co{kO zKgxdl-@;dih;5ERGe~XCy*afT();qVc{ zn%CQ>YnRY5@mTls$T|52c%c6{!-BGTuQHiOz-Ei5N+rcmt#102MDoq{NX8+|n#X}S307JtESCeA}N?%eQ?Mk_&T1JZ1K-Q-UQ4q~6p6tN$ z2$6^95bOTZw!oM(-94(hdj_yrVODVVig#`ufXJw-28$B*)eo2Ow0UBv# zV-w_~*o1M-oy>c>c*O^PnYB#TK~A)Ovfy9$*kK>Sy&69HvcudGHW$>l`yYXlZ`{8H zQJ$#f;!b}+JQto*&2rNYLRv3~b)L6kS<~w=Xl2=^u)ppbYW#ei^IN(xWEB$_IKS1~ zcwHu=>g$>Ydyo>0S>{J5>M`K4+b$xiI>jR~^N6q9@Hy&E+Xt8}hL@vdxB^3~$cRJzOF zs;fkD8Nd>~=U@Ai@Y z0xA|{nQO7-I-v_dm+bJpfcB2DQRTs7H|G6VL!OQnifnzo#=%{4m9XWf@KjDBR}R$+ z1t72{pyxg1ca1qw=V~dpR!u^Ro?R^9L(jrM&E$xfqqAOPOR2w~L@d-TC@ZlSn{=+6 z6zlOmHdC_3wNqVk&p$pCe}!@4kB-MKg2xS_{aZsZ z#j9ZrM3xkU#;wzYSYK5+|c+=9e zY~3`y5jopmwFd1)Xl=nJ0^jw1x(d5y`nu^ibKg_YYuT`mMLI=Px;k0)IzVbo1>c0d zP)evVUA=|SHrJru;@Df2+E3kJ^7( zVpb%IQ;yr%MGEYN|16)^55_wdV7>zJTf^j|ZePSdzm?W~M~aIeM?+FJxvX!bQV(?9 z^Ilu_Oepft9@k7t(3BKRNI#yJs!`YsPa*LI-vpX6 zIoIbeV|MEIWQ9D}Zx$GwE*0uv?^xqyBJ5B#k2(P|ZfD?6DeAgb>@El6jI?f=Oh6qF zcNkPPfA0RgS%EQVMqtK%uQk5bfOH)|9-mIX?LU;Pbs8M1pMPMQq_&Io{4*FR9MqEG z{|0mx8KAzBlx+Eq4F<9``K~3v+Zl+vyl5?U&6d%SNM5k@niQ@100(Fk9|!C_V{zwGrzLv?+d5%Z%wUg8Ey8bm6 zwGX_dOz)#4JiH(4bhaM~}&EI;;#YB|pf0oW}!eQk0M8 zE2F6v{aG1VFi~L5knKdw^q-Pon4!8PY?so9H#FzS{QSg3r8Z4ZK3`GjyK_hl=jGv7 zfbGA9eafS49D}8u_%#O$m00$V*Ke7BsLHoDuF=W=!67$0?z+oiEdfHQF zwfhz<_FhmWOgJ7dnmI}gbgWjD3MfJB^CDtJF5M+mt?<~A{Nn}SN2JD{`s`_mQFwYh%v=^NXiSbc)?v!LxJ+G@OpRK zIU_oeShHPzmpz7_t+^*hP1_9%S92A;G!%jwE>Aftnj<~k&!2&vEg>2NUC;3wFB8{X zDoM~`r|LasLdJ%7AZHqgz7;u0eL9V&Zb(@$ggrIjeh_*xIoHjc{Kf87K|J`UY6xOw zSW7&8BfmOl#q}0$@oXV4ei~%yLyGpl&pd(`nDGwJ#3RX2XgXMLtLo)UYu5i|WW)g} zNPr*L_pkrT!{n3Lw7WpovaAkaZ)vAs{ak8;q)|oAxsr#hQ@7VL%oGCHI?o@mf*(96 zwWr?B{(NUI;;9>f^ULj7MMuZ{q;)wuYXZPesliB34tro*e$DdLEdkg}Th-Y*gj!d#h+rd%`rRR^+3@ zI#u@|t0zY>fem4A?+=Ct4*a>!R>lr;K>M-$ZVC=VKePhyHtxPP7w&j!QnZnZ$-gLC z1BroM$NASeXMUL*QUh!muX90idVDX3dOU|SAhrj&Dt{s^t0Oe9>rLeV7v_)-)|~5# z7au+;@9i&#o^y^DXwux}e`1g19w<9>*7l{DY*-t610&fhV7^5SdKU6GDU?4S&q>qm4jJ>E4fA7m;%E^kFW0A2^?!9nnVhkaMSIiy0-1whH)pCj=MSR8Lu%b*g$R`cv#tEN*wd+a5Gm zUj-9gTs`toT6|jk$L`ZlZs1*7fSOQ<&v$M$(eUkNB&yu&XxVaVLsXr$JkGab-YRpW z8>zoi3SCk~5r@4!D2F#Z@R8p>D2q$JelZOz!c>9F%zZb=9Vea~_^=uZEczu3trRY6 zKELrJo!#?FQ4rbGp1>*6sQejt{L59)z<=7D2OBKZf8TfiF(rC_VP*WVS;X`6-`C*t zEcxgY8dUYr=pz?EiJJESV>BLK`teqxRIcP``4hBg3fE!jHl;VLnY?P9qpox+3`$C@5Ivjh39~o z6c-RytCkyr%NbqbK$YV@QZe?aW=g%76DuB^0Mb4O`FqnWdH5A3uTLo(Z%#j(GA?K> zMK6(o`a;5@VD2M*cSb8yIc$H{S_ZfnL-3d#{wKZZg}YFqD;rK~=t_8HRtkdCt>)W= z5cCcJt6k%`g%C2OC?6;$5mUo5DuBl|#6=bNsfNz@W@rtS?iL@e zkw`o`MWyILeCm#;;5?th3uEAs;cvFyBGfy5nu)Ls6vPmh1eK*rYXCl{-Tra$Lc%x zhEa~a)-8J6PIC5Gnp4fR$5ko~RZ^d@B@>CCoVOJ{T+m}^c%K@mr8qomB~l3=Vpf`> zA-zM9q{g(gxwhJ=4`&e+E=xfVSTppquyc(?Bg)q6R0a)%ez&~XehQ?A$040ZT2x-3 z1452Cr_0vGpT;o)3rJU0ZJOLjnh#@@t^TH?Nm&5^sH4)oIrEaWO!&T1>iQ`sH=S>( zQKj_bv7qg50jtdi97gi;T*ql^Z0phfrOgOdHdwI${?9k|1mPCK&m|#`o+DdkvRy`? zvc!tBTS?ctdfE&T-(+3Ermh9cHD1;x;%8i-A4;Yz=hju4ttDM+s%veQA7@)Z+D;VA$jW-G@C&0LSL7yp7xM|(MokIK@c$J$LL{4 zvm2?{=$_*#lCqx;R%~RUf==t)wV|6W{%xTbUdW|U#7j58dByS$D!I&6IT`T{v_1S;;Loq8uvyA^@&dpNF%4=E^Hzd9YJO2_CA6+QB zmMyVy`jY)-*uv3vwSHW7qyRBILcmS)ETA6e+-4_Bt>BJr*c=hMf>tP-5x8{VsFPBjKO zORZGC)#2fwUm_?@2J*1O)|8@M{wj=m z$YsKGmYKp1pGulcgr$7wiueTo$bEX0%xlWU&fok%K+?AoARMXs z@&d}jmtaLG@!(UB@mt-Ga;cfM4c?Q_b}GO~Ng4ZZtR-+ME;OG?US*+-01_VED=HFEn!e_bfBq`yCTnO`&;T&?@ zk*q1@eF0Lt{!N$HVgcyDSu9X2dgcwv19PwIdVgy^@{A2+?Nhh+2(vkvfQB(W-{*+8 z&k9uT35xfv<~l!^Yw#E&m~{k>U~NjPkulAEmyp!sO4SO&-DNis@65`kimuCf2Gy#w zu;SaKN1d4|XCHiH8ap~GLqqH8W&;;`TUYd{1ah<0;H5-S^wra%zv*KBP zMumoq)OJhy`dUlAGjQ{2WQ8@T{+9Z$?Cd!C4Zx|p%@gsz3;!b8LK?ZwbEsVmkSX>) zZ77Xnb*S?wM+OFgqn_%si z*p=n8&^T7Twp2Hh_*nP*-Uj}2yUmwYE)gN(UHc5a)2XW(j7UfUpnLRg?Ee=2sqPDI z`r69=m1;%Wl`a?WV98x)azuPRePAy2x}$6I6&H7Q7R$@@K!lTcpIY6=Se&WT=1&iL zKzDu1$g1g|n6=4Jc`tfc^B*DeGVYHSoRsu1Y)J-%sD4G!GnHO(bK%a&+sNl!Qy-_b zRm9mp-gr)tpfBxvOq$HW4&K7`LkN7Yp?I#LwEBwCXj-Cy7A7Uu%EDAhzN}Z_48!2Pb)Mm%=1Egj-`I`_K1RayM9!x#p! z)t(*sI0aGp$HKmhe3H(lDdZKnIXJTXylC1fD=G(p!A>!$4lF`6j+>p(3LyX@Vy-dV z>X0H+epv{~@;;i|q!2M#*{Z2Q@w=vkjT9}pa2F3x7IUf@S4!7YmMYp7w|$skWx?IZ zWHI8fFfZX<)>lkL3)_3T2gbfiH}(2zDMe_cHF?s;~#GW*P%GzpK700*oCL2rwT z2LOb!WbYrN0iu!R=?22Nzk^lpl{gh#8y(Skw228hwHDjO1E5^F>_!iL^o_D-a_p{9 z93yT^3oql$)p%LWXUL-w`m!}*d&WghN9QL8cvsYUx{uk?3-?gSXZT*gHsLL4iAh;@ zI3jhcqqKNyg4h!E!w>zn&M_`dcmQ3O0wmr9ax|L>-LE&d(U52*`qf1aPJ_Ha;B~a) zhiI`nW4f75Y%~yjxKvZS>y<;=bhR4R8nNQ~p5oSA6ZS{l*G!nR=zv>!QY^t;mIP~AVGamq8kw>uqra!3iE4d^bV_1s=Gqp69| z74O?rH5P9S@x$WQ+KjJZYVpqsvQp2@uKN#XjUk+WnLnze!8RXQ4%$#7KcJ?XoRZ;Q zdmEqc{%<$Q68z;N;-#OD>i$1I>0cgcv(s2x&_$?5I3z_VOu@Qt7w66yym+mXF^W>^ zpsN8sYsjrJjYgaOztH_M!wp?m=&V>DA}4WM>0Lh0rb@`t}=uf9(@SD;Z=G z{85fcig@tq@ApA*v34C-YU5)aWN3w$SwNM3J=Z#ZT&M5Kp*VEsIel()6#8<7efAx5 zamkpnMc@)Cnyl;NdLP9y2Gc^tDDsr>(u5f2*F_~hU=y2aSz@Dr7n@O9qGlT&Fcu@9 zUUL0O2E`wZa5~5L$&VrU)X(Q7fA%h^{zX3eIdYmq<6I*sZ9j8Dga#s2 zRv#SwD?+mej7xP8Q4=q6DBCk$^C$Ve>nAhysqJR<8h45ufb+B0z4&xC2?w~|I&C0g zG@XB`y)xcqu5{zB*i(V>SH8++laRf0J2p3htYdEA$*yVt5J|dAWo@AY^|S6e=(&gj zL1^Bj-jzMwrLorjL;EEA)d1xrhvfb&!QUa@e_L#ks<16MENfg$yqey5gf~Zy(JOmE zP4^SeZLQN4+^k;=dI|7)w;N7z#ZNV6`;6|d)H2+5 ztoct-5dZm?B=Fm4+kB^=qTP;vL6?(xjGcGa++g7Sgc_H*Vdub&R|}WpZ^^vDM*>8| z#1phe&2LGs&CPu=q3ua_zN9cp`sqNijus{iLQFu;0_<25Xtk>){`wZot#Z=)-BWm8 z!Xzdw66$FEV3_MJDytFaFP``EP=ue>Bt3LN!fv{v1q_iqZ156X~P!ut=@2|M1? z4`(LlC5U~ov~3Jv?(U}hi0UADo^p6iF+Ye0@SfF}iuG@Oz!ZA#S0k}zupz`RnptLj zY%oD*#!Ex*S0SR@m2urx)}Cc|;=sap*Acgphs6l&k)xv-MZW@QzV%r&q7uqzclVCyV)^eJQ6Ad~weexRt;6*b-TJCG#@hZ5W?Z`5G2(IBjAi_th z1&sMx@gnUJdZ)Y}l4Adc>Fk(x-pLeizt+l96PNNG_*y1RG6%kY@3M~j7_6u`~#K_l_3RJ|tP z0k}@_+KS>rRsSHgQcM+?y^cq=9$e)y+5kK11<)}cGK$QL?% zRwx}ueJY|QUdH1{&hA-6&NxI*8klPEK?55uoUnqaQ1EPi`y(mcw);evkHwc{@<|YJ zuhgo-elJ6LuGs5lC;~+WnCc(%-CVb?{%yCV?|zX5s{7q@0SJjkU&gV_wWx4E=H{l{ zOSAuXhIq=t7QD%mVn|ZfH?Q)pA7}rtn$Zutt&kiU$te6V`ZgGTU)V>P?-y2JG?%?6g9vEVNfnOzgTkN4U$hC}Pj& zN1mhu+6Zfg>uvLqbfc=JWkaHd*DF=J>0w(eI5Yd8#l?U#DnEP@Lkaw3scK?~gli;g z?^8@vD~b;2F*uPjv9hdw8t*TaSR`+jbsUkXAyDph zHPuPKyF5)#S>pT)x+HFxK9Sf5tkAg9UE7k@MX3av=B6MeHqwDabGw8QEJ61!S_i<~ z+uAbolnOAy$3J8p9smyT=N-EIo7JP^oDUM<`0z3c);|_bJ6A5xLU@ zzm$u;{DsJSjWc{QnoW|Z?p#|I6tpO}IVG~x>bkoH*;R35b2}z9tUsP}h9<1i94X21Go)x}oZf$-t8xtmZ++|VuG%inl2G-CxzVx*A~Qwbn@W2M zur8+QGS5iSvuYU^YscG40_BS!Eve=0n&|H-QYCHAl%T{-nS>V<{#U-tS!DYF4%{_x zR$gGQ0C>OAfUDoj&UJlpeYaIZP(7BQ0p4JJ;PofOFEx9LyQUNr?$M#R-hX2EE>cy4 z$1Xx;9ZRmX{u93X^J$Li+fYAYx?&r3<(tP_I@PO`mtLLi)F)iR!@s!HBURhZ-<1Sn zCJlwWW<^q63E?>+^PN|GBLiQVm^!yLdhX2Xo76e8)+2+$%^=9=Dra0(Nyxb#zk5u} zWgT)QC0>$h39%2IcZZhTvyeGbPNRmB<{ACAOP4lTvJ1LN(9XN5H_ZmD1h4;O0rlpV zlW1Ku0q7c<6A`Bc^|~2v!b@n;^J=$wEjc|&~p7Z#N zab7+pCNL+u{n1g!@3kd3*>FQe*za%)Rvzq{PF6Lqwd`ksSpEEem$08+diu_TZL@~A!O`cqnO;zu%%4+U5ot$TM>_MO_SeTH##3)xqBjG9d0_UVZo&CO zaZ8`qRSCNAJDgnk6Dt(8U+6NfL^Bq>YMz{{!H~bE=QVN2yH)%I3#%rZp$C@tGT-KX zW?i&&I;dX8S%JedeQ4=yibp0i2IRYI`9BBEl84we6tIDsrE8!$eFw9~(BKc-W|)&q zam!?4+i@q!$k;gLH-ZQPm7)2GZVJi7N7oT^6s?a1S`cqk%6Z&_nPlJAB z6Ux8UX~IUs8gVZp0>JZh5;0U)JqS25^XUMUMd`nEBs3k4jtW4KK2^=d>bao0Y2x;i zUcjtKI7C-NiSJ$thidI3AT!I~fK)HJ%ns?zYbh>6{5Z3+UpBM-TNO-YQ#)Q3&?kEa za&E?>iYpI++q!@Xm>9~bjtH{5-^aiEMSab(CzTvOb3LsoGAPV~gG=J$52ii?8{<1K zvPVzvO%?ufeF+M}`GtVJhf>O*dq??&h^TsfUp~YcwG373A4zUc>RWudF|&hZP5o6< z^$ZpOqYIlTV*$87t+X?TGYM9UH$mTxh+D2>erAWc4y+R1&23aR8>{x-@jhsDOy?iz z;kVM4JJMi3aaNQ8SAU=|!@J3}`_;~5)%RvkJbJv|hMw9|4?U`~MJraShT{S`@?36j zEsUEG+nU{mnj+NYh&QB9-kx1$f;`y7q1XB^cx>#JbhDen+Gp-_TiExbM88f~*bFg8 zsq`$UBT%nR2UX_9b-FO@BQvRm{Jz%4s(?onF2iN;DffK-IF11jOl==phG*AjRDDrv zz8*RqTz$R|C4I0cVSNV~n7VOR8RWJb)JIe2KVl~%6Teq`FPR$^H}pp2M5bvsp^nuc z><~gYXr>!%X1ZRD2}d_sugF)^D2W%IibL0{b)g`v^rkNwY-=;O5|dtD>qh532l8Gy zKuK-n_wRl8*Mu%!Kq7~h=(=E5_Oj}=PFbHR0I@#aZnAutSiS?W0fB`!`z#slf3HCQ zf1rjILZw+!?rQ(}C4i1FYdbI)k2T8Bymsi~G!8Qmz8fuB>r-F$ZtU5kfu^l8_NZi@ z_-?@P@=x~*=gB8>X=3IoX(EnndoAd)dEfCNAy+f5NV74wlfC-4BbspcJ9h%7bdgVX zr0%Em&dbx_&UsXoomM<59n!&V!L*&qR#%#oXj%?|3KFYg*+DP!hv%@-sK)Cghcnsr z@`+K_IyZGXeE%)G_2`uqRNvaGCEtyMV0&x&>R)~XoDYw1k;fT9)F9a-oEgtTy(|nFr`Deug_c#*PquqA>!$IP17I=;NC#yJR-OW+r9qZ|LUofQABb(mt+#>>Rxb%ScN=nsRP z*+ayNob9)Wo3KPp`E0sUllu7MEzb%BAwzPr)5Gj)hxSDGm*#PoJ~jS<%S8$uTIZZ4JkLiWnA{^Y&}HRrjFqGK_}{K zDapeSE6Na6XXLsPJ@g}8fPeJ< zFgs|d=P0K=kSER|X3j*gm3k$1iB{SsM!P>yAXy-4W+@QJ&fcI8IewddaLwQk5c6Z1 z4n(|@Y@+1I&#shq^;*PkP{z@euLTVpT;4M_b;o@?NF4gKtI_e2UnrW0DT~E)!uT-d4Pk--*Sl6#Vo>8mv zSc3FGs~GB&(c3x41Dr2d3vMm;lPlxmqWf4|E10ZqVg#n-Ss&8aqd{4_Ij+qUPk;~_c} zv?5O1VVpNpJ{e>_<3D#_B~Sa!SYJH*N3%G=H{dE^=D*#A<&`g=N{kn}+c?(S13nH7PswP940OZRzO7 z+uzWje`2drVo%qjg!pfgE-=CvT-fiI|B8Ya{e8CO)h`#3qgO*Pk)K&WLq6s2g^Iq1 z+qTTRmG3VcIj2ipo zyNkOBwHCW5v(fNg&Fe@~Bi}Gx00CaJ8TIMRB}-(>j#8QXgYI~Wn>DjbYFJ?53I8lT zspJ_f+rkT$-4}tqI)0LUE2ZG%{R_RQHXsx3dSa|fIBDHy0ZXf#?U=t8+y8lhUd!_= zwd}atL$5boMsvg7AxaU0HAT8Y`pf@B$MvPQn>dxT7i0;JjB7&R;5A-Ee>Oz@F!4+n zc!T9=u4DVd*M>;j1=(Wgj~71-Eg5-1EoTNl->Z?bYj0zCQu4Mx{lh5xC-jOd4w!!F z$kUbn(a?#qYriK)YioZ^sHE5lt(kl-23&Ev2(e;o&t0zf8g{fzJ}XKkkL#}O#KGaf z{`_f|V2I6*H09gs;%Np zADQXr(CR+5n%~yx3|Z7Ik#CknH`%kHDuaoCF{#Bn3*wYbt#bMXUmY)rnYU+aq}*_2 zR%pVMwIj4h_xrEXT@IRfu}Z5PPhE>T9ffvqyh(;wB--R!G3)*BT>s}H)03}5`3xhz z%@fY-ULxW=%~{$7_zU-akAU{uP%m;vG4MW@f?xjocKh_Aoj=90%C>SoV2#(f`%rSX zEWk6N?ChSEx$joAp)#?2peQA~zs$-4QVw`dX!YBJAVx{ECC zNm#}xbx605{_8jK>jHx{3t2d>eKYw*%w;Z>h=>CiP<_7^gW^>v8T`2g)&4Gaq#WAi zLExD}4~EhD)N>h}R;s9z-3pD!EB_Bysa)_tu2o;v>lf_xysMGjC+dLrD$08RAP&VB z=@PyICcBA3A#YYq1*fV_F8#6nUnJr`C)0rO;*%D6F%4dK0v8v3~?iCDC0q)i7~qHqPGAKc3-rmng~i zv`KMK=)t7d?KQvIPbkW2ncB+k3;i7Opnt~oxI@%-y@;8$p(pie-LDhdrYRCD)}kLDEj~X#QvX0<4Og- zxTKc9?)}5={3#Hu7wX6TOXQ1nwu-V}A7h@;J~=(hvUA(i+NJZbPzJwPQ5#$ut6Onc zwyJ3C5aR!^_TBMR{{8gPFBiH*}I7BkiA0ou~)Lg zvFG7%oP*!{6n#GT{r%kE`|*4Het)@m;9S@BTF=*bzn;i@m87yFOfP5$PcsRjbt(ug zLOPOu)(2sUQM(*mJb7yPDr+&rMDo434Ll+PZoZ>msUQPmBTaEYP5N=fo5eiZ5L08Oc!Dot8ZGs7|rHo*9EOc+b@ zCZrL3-9Fz(k{@bDuN?z@PX+HvmW5Jkzao^pLrkn5+&F*Zu2`tF{>g@^2xIPxfp5Yr zg5YQMq>I<7x5K+8J}{ds0GGmy~Wi@_no>2lteY**ZNxd{uZU~ zkMEkdFz{%eQ>9&^xq^JbMF9^eajcD`Y*gm7n2xY{pKKXzmRjwml;Hny*Zhu_TC#15L?veuLeTsm&tRuQy(|k!|;y zCw88_yU#`Z_D)z;vHuLYN1ZV%g^46PH!a@&?gKXJcDwor#rb}%}W(|ttrzAQ#^Ek#U&XfA}|I*^O!UU z;X`9%uDoMVO(`YailL#o}QW3*rI^*D0VTIPsZdG$IualhuJVl0DWvb zjgN@*0643$aPsAWuD9Ux854WhMGTVQ_?`v*r77aK3-l54>vz1C0m& z4ln=hDVSw|@42W=T5-(MuKMZ)OTC97_N7VDs8$`bU!~z-@Uof`u5CuyWV`hfIU#-< z;p;#kFBJz>G~UxhoK+%9<@7h6r$CF`x^7Y#bcf*q9%bGxGMyIiyyCiHL?!cA%)zV+ z5KL9@Gh~9a1Kkt5L}eK%NQg($Z=b38fqwHQ@q4d8C4NbvXW*MbHEvw(S&~)d^eL}V zV4tA3JvL!lVeE&tTNF9I*K2QRaI4R!8-M)UQ~mq5%9_Bh2mf42Os<$rQ z0nI^YcbTv&R$>=0mA4-k@+58nh1k4>hdcB(sPFE~*fY&l7$GC6k`PDPIsv>+oNcfK19*qs*7% z4M{0!j1(jk3|BuWYqadZ`KK#CI18q{rQ6mtVBh)9=_K-Sog1cvA{p@-nE&i zjY&%eM>IR|Cv+C#04W=z+Mk^8pD(=M;tJw&?57it{Sd2M3Yd94jlWEqUQg{ZTi^Z_ z1dvaNf~&Up2`!i4W-5MnCBO)MSM#(5s_$TtU;lIF_fRg#R-i}HAP=n1Tx{%X6kpcWx}=MhDQ@RW%8Q>AZ-2i_Q(YAp3%4E2*TPI+(GT#z|(+XI0wDB$WjUgUwT4xwtw zgoZXTe9rChlCY=RscwtBSx_tVeIFv_lf~Hk_5%whJo3FZ1eFow5pyP(0z|RgH`OLG zN|*gApY8~}s;W_@%T0TiNeX$92>}g?j+bV8L!PcKP(rsNlS39H8FmdAKMOv%mcA3k z@)Ajs+|o?@{w>%Rb00;mc_ux2{9Z`L?RQz!x}&?=9H&7`;4-_3=;= z8!(iqx&pb(jpnKsQH%YHM4SWo+3AZW?*C1EmvQ1dXC8X@SbX6xLb&w5zm}BK9M7gm zyBkAo_Hb;|3_Y(t1$(g1T(O}EXZZ%!B=p5lS%nT*^CU}g7uj7Jy9#Op+Bq4mbG@|0 z_(7`)Hp-VWv|*q^)3mM?{OS>|uxlv;H?Nzz!CukcP;bdAEd~pU>Xu_l4)Pa>1a9VD zaSSs^j0;IWWbEDxxg170KZ0OG@5!MbePVhezZG5dVnW2iPMg=<4}JF*5#|WadPgP! zHD%jpmN@b60rU^t`E{X+0~e|$@8_={6~7{`dOOusQCQr4OCV`kCXMID=6jEiN2P_) zm;H{xr5R#lUzusv0e8mkq#m)8N$4-73~=`eWPwmPSM<9ZhFAQ z0tZA%Or0V8Wm}1KHq<}*H++9R)k7{1V1ydril-YeQu`F5THy~?=o}R`gf-4 z;|%@9(Eq0FSrAo0b3OZ;WvMhC4y?t)ak}*yz zdzQt=%39tZuL!2{(MJmS()XG5usc%^h?IOrZs3d%k8a8S&X~#rnlY2i&}Z~PXu~Jq z1vn<;Hy6Dk#%pe1zwU!+3h4jV zkT~%V*H3T?%@!>#d(3K=^&mwCgQ5$5L|#9(Oi4DolBP0da+^>pi1fXwqPQ7GM8qJ%DrFZ9 zrYIEsXK{^(3Bn+Hn+I1e2rcZ)2Q^YoVZu!lKi%@&uyKzvY;-eqD?|IUH2ZGwsmdSCgDcY!%*$i} zzS{O)<{;CadVfSCA?rX_($&f4Q0AFb4Vjp(&S<_rvFQUi?*;bgf4#efzFc}a;w1TXH{}#B5b=q8}={e{I1z3KO}(1^T+KO1kPnv#L9Ga5E$eG(_TQ6T zf2lQHF>otg_DyMr-H(DF>eJUB24`vpg5wImpF#RsN;ty2E5T4q2p(|OY3*6K(Q1p4 zAN0jvtG-?-fX^ty8$Pa={1Mx~U9i3cW<${sn|fS!cD|;Zx-UehOK4n&&?wat%~a3# zs@pS`{r$~vgwY{TWopxWIg=An=0ptNFE#G|3h-(z3hVy4xb~7 z9e;5n>}v2UUlTecf&zK4=)N#yC1@nBC#G{=k6);o0!PNkeqBVI*w7^ z2{?9Yp4?%t={qsKsP@c%%vRZ2FPeN>Z-!4-M4~bu7E=djr>mw0|_tZh;seT z+jD~P4)}yWf&GB=#*4GU1#RN*M_+AqTs9Otqt5>a^4Nh-U+bOZ{!1_ZCsqePiNJXx z1y}3&D@VT=Ap|nBHG@m9LqCgVyxQcuhaXNlSXm<1r>fw&x)t_ISyEc?zyZO5HeE3kJFTAd$M#$Nff|)}8|fa4;P0>b zZ`Yqha4>=1J@hy^S51^~sS{!Bq*?e7axcsSfZ4f+X_MEpL9t1-_RhRG?$vw)IUzh= z(dqVUhohZ42H-3uYZ&-PQcf20(Q`xzjP$vCxoZ?ew41Q=l9#CZ8C&Uf2^V< zn-M)Z*YSkG*w4B*f(()UjY5J2Cy$g@cvgN;4=%i6k!CYLv`AgSv6j4%pa%c8@6G2w z1&{x5A^#T0gt?sEDe%b6WZ|8pF|4_q1R^K*r$Qy1s6J`o-Ik6y9I`6TGCYuypCxZ| zoAI?mQs!PZq@T3-gA|N#zMfKy|N7rV`46_`O~eFL&;LC_;@F;62u!HpOg}}8T9_b4 zWZpHcte}arl1HidtEb{{4RlTR7|Hj)f8N{GVQ*>(Qf@;AbCGa;Ir@8vQ})1?AkkMx z{%H3CYiQ$B!7xr(y^3S)duW(KiFRtO}W+eEoy`eXx51)2?eZ%%^ zno02M6ZH?{z-#8K(!0ZqyQ7xZCm7)YGEuU&-wXUbC_yTyd18b2*g;5`0ELp3X$<`H z*#CT?oQX>ro?vN@Z!nAZWSD`NY_-w+N0)8g<6QvX*1Rl?GgY&r&dm#Rf4QLa`!1ir zPL)f?G!JIuMZ-GOa;OotS4R?n#vL{`TsiI+;FH}jt@G%JNG-hpnx-KeF*_NZ3Sy)g9`HC=W#QS$n(fWfS~sk@Z`7*vl(2vm(pc0 zfiV&u88~pql8!Pf{MIuyqEkE>O1EIAUz630bcKBTvU28@N7al`dnR{1R^A?M_x4z; z81Up(xb#N|W&j7Hx!#1DR1~MaS|Kdv(;NJsSO59d9YX<%yD2ZxiC@k*fcI1K>4jJ8 z+eR6Y+MK&hp+W@ziXUGjgZz`J&?82g2{eY_H9P1M)Dv)c$%`=iaYkr=zJ3>|uEbcl z6`S;YkS_c=LD9rXDjSRPM>YO%X__o%#p{{a~2E z?1`^f$qz5tbt`zY*K&?;^FKXA>l4t%%Qu?EZpL(xUC#bvAlC@f zWMjHW1@%%#&`fa4Zw3Slh7(~|3~S6n;tI8jR832DUBg$$NN#^X?-jZ&4c;~bki~J( z3W|NrawATOgW=bC;uI%BI2ReBT?&3yyDXH1bfyT0|4zNi_~R28$!}29c|0tVtCDPZ zsdnQqfA~h{-wzi4)1yQ_lz_SB+Dhw|8F)i!7B|~mWPw6&F{hk97Og4ab3CNrB83zS zoj|<@7za0zIOO?=kvyyAd4SWba_E54zT375Y8f_DgMmcI(tGC2=wZl-{8(_hX~4|< zMzG$4)u`$xdI+oDFzn;+@y2@m0|gU2KW*qz#=|3o;(uM4$OpRbE7c$qVzOc686W2* zYxF0Y{ex=*jt|UTDmUPX0SeeW_89TnUTGw#EH?2;avm8)3hTvn0)#KiBn9st6a4J# zL=ZTHk=kxs)^lcaHOKxm2f%5Utg7(e)qX&y0F{sRq zBVq?e1AL@m#l48R{?trbP#Z^@b)-#P@tl1l<<|0q>22)_O4xKOhAPc#f3L8azOsF` zAwa_((+q*J8YjUR)Q3(jaq4`z-xRVhPsy%B`aH=$QYuB#_e^iz81-hKlDK;4X~AHv zNRJLfEoSY=Dg~FPy|nEh^ya!n`ShR3GrOe)d?=-s$g$L}k%mZ^5+jxbEG!r|bGTpz z8e|=Y|1|-TznWsJFmRPCh*d>jy3T`{T_oUma_8CItL}bK8nW;A=cICE&hbz9zYX^( z{(<3UgqK>6sO43gr8&)i&Z|1uqq)7?Ybe)m{i7s2JD-*z-sT6hrrIlCe`2aOK&;AG zI$^KQP|=@;hQx2<7L z_B`;{t~LqHW?g%GQll>PI{~u0T()4HB$=%R1J1Z&UT__^*{;12@NT;VAIj6!UW|hg za{vcpdpP`G8&!c4V-?P(1%wYOtcD8%se5@Y;3Mg2;eW#JjKo(W#Crw5j`yAh19!lN zoR~EWJfv;ye%`q&{5oI))=C>UybA5mSw07jkL**bebkEF5t_Oqh?q}ZPS{dF0ZV`K z6shgl!DqTN<`O>JuHN!aNi-4lu{OdZgy`u~Zb`&c!^>AhPW8PbYgKIOI#AW`3sr5- zqvr)izgpqNa^zR-X&FEU!d)ltslTlUw|z)a#L$inpwn#0K5`G&hDbAxCz2YkE64hP z4F)u=y{4DisoX<`e*w`yFX7)WBn$~G{Lnv&pSAnoBZ>PAL#sjl!NjHZ2Q%IW87A6< zqt~1Bo}I)DddKKqjBU~0B4C-f8-CV)>z6wNCnMfw1m7>We|NobD5Iv896z-cr%x5Ibw^_lB{;w@ zRz0DKGfH+31K1=iH9VhyN)6Y7zkcZY4_UI&2^XTVX#t_9>uW?}`vT zLNH(3?gI6Eyx~qR)L8Z|40IxKt_ibR+4}jt@5dS_Uv(ft-*d%z*sAEEsqgks(J2Lr zhzaMN8&^aT{$+V;&oDT{mC@m6U+|R~tpN*4M9ARUVA^a*-?cc$hX104R@L(YTDRTs z!Rs`eDWC8P3Cn_no_h-qCDw3?9VX1P6+X%F7#iDY;pq~ayYf-Dl5eI&+cxUuY(1JO zRA|uZQS3tIJKJ%UkQn(+6L+y7bN0!a81fPOg|HFu-fHFda83#Ec=^y}oGT}2X#cn)D) zwoIplFS^gr(XiB4xz#RaJ^VOC*xXuo*0uD**pFh%5xIrVZ?y+|+JN)ofR!_9h%n^J z{)0ym*xE3$CB{lUM%hEn9` zb@S`strMNOxsJ>InW-TLhZqQ~4bTa%CY3Z(Z>S9Ka1BinHbX4iJB4wq@kq|7fM z@ZG*uOCNyx;=ElmSboXJ^?l4!ar@PYh?RT+f4*W!eret zIB59q4eGj%nZ(j#_je|GVUy(!Lv*FoF4=7);t$^NU`V$57rG5~1?QGe_GTK(DwT(F zyNuo`H(6H>`>e|*y19P3w?dUI_D;bAo62d$@^v4iN%4T10@1kYIUKuld!lQ|=2m7b zSgqYU=)Sb#I@1=eK7zFVk;6eEYNxL?mg2KB?yk>4WB+lk-==bv(G!yZ4uA6@BeEf! zRl9FP%0kIA5L})3`;SFKKL}cEn%RC>lJbv$Dah|GC`e77hTFyr!mR$(g^(<`Sng zf2ouG^!38BiyziZ@au{GlkYwH`5S);Q6%L66p1j)RNd_Z>?%n&-H#Dfq(8`-%oB26 zo*1+kzmmI9w|JSH%x~flWP7t9+j~>6WR#HexH2@y(r-+6=ZDl2+T5oFuayrv1g2-V zhbG=YU|3B=htj>roK3qb7+UBo!LUP6hxPVUbjYh~>DA9>2!@T2_h`U!j&KCuf(U2L z4YHda2zV?#cNtrZdI11RVkW5(BQI+ptU7vzgXQmEXRT7fT^9;p>sT^|ng=fDsr*pl zuZPi*FSIs83JyN$Q`6De5`Tq$XG!vCs}h_%X_D(XT^yb3iOelEolzb7ZahZ7wU{R? zvR!{0oZMJ@toRlncS^OfsBDV^1UO9D%t|nHp2je9E?kx+HQ+2d&?RF>@S)q*e5h62 z!2R87MG+0Lxfi!%L4p+$cxQ6@vAh6cE? zMorkIp0`SSMiHK`QE(T){~IAR%pV+-lDVa9s<&O35@1Cjg9;PfOac62y%k>FbpdU6 zr_D>8mbqoyah^ImgdSNn>Vio`eW!q1dZV_n#GGx-$sVlKA$pB#aZfDrd>kLb4g@vz z+|U%-=J}$o(Wg-pT})}w4y5cREU~ME6hDi4cu@&FNl2Vu?X$IVZT-l2mx;h4~q=T)lSEr9=6|MiE;~zIuMr za#;iF)6as3alGMP=3B+4tjeo>rTVuWFikYBQA_#NKZp*tM-SmvIZ*S_Hoqybw-4!N=@~hgI5cp`=aK=Hcmd6Af zr|*9JA)YMs4y(QHcOQ0fde2?Sp8Jb&yz={>+*jYJ>v?t*^)Ni9YLlPfO_5v6kM3~Z zTFlPZRyhPAKf05~+M?@WtdMFbpJVS65Vw1lEWXV)m;iuOYD_nXyy33cxQ(3aDzzk! zcBM5#k3)oBABt@I@mf~|CJxQ_bhQ&BatV3hNW|poS-E`j&?3ipA?G;FY4YU+^>hdb zCx@0|vCm=-*9rZret_NOprF&{#9*Iyob}%W^)D(ij>`YNz6cJ}fNDWhdz;*!DZ1+* zK`k(|@T-zJpA|Ts=E(_ar64@Xr8W_UyK~g!Ry=zw*!ik0?9NX+HpK%oY$*=mDrAJx zrRi3>6z(nNN=s*}>pJFoY_^)W=7F6>39HqgPr}jN48GQ$Y--|&J6-p)b4#*BP%Tn&JvfJCzby@h zVM2mQ-A2puXRwk~&>uD>!|4tks_H)q1wu5u(#SfP%6-u0NuG+URhE|&HQmPrPk#g@ z29!qQyiJAKTEZpDAPUp zhrktkx)sh^t4~&y9sK;+wi0EC3K~1soAv4i9?F-{vh)@DU~_>rX0@d2pw(sgLPU6A zgER8v+rUAvV37n3HWu6yF#bd!&R)IQi$n=&RybuQ7<@>_Filt5-Yr|*qnRBT(o=GA z4uLAvnZ>&l&y+C5K49z3 z#&mQ0M?{k9gj#x<4^(|V@6@izxR=dk>cDFsgTf*}+bME^^{37;TrL9&!pWhJQao-% z{ZkR@n({ub!@WNk!E;=kTvP;EgJb{A>#-@ig(=vpihj_Li?ucZ&Zd>tXRv4;6uiXqJTOOaMSbp~LzB2u9$>$L3L8 zDN!xo{#>kiZVcTV_s|U=H1XL)PWR=Sc!B2CgqY0$h zl|7hZ-I`OY#Y0*Ot5+hQ6Tg7jtY^4@<6xsaO2hN}2bL$1$%2+qwDu;9^`bvAMOVKY zzYSl*B#bM0p=Z^1oSKY7P+kknRIOmGxM6BCh7Cs?=Fm|*)b2U~TN9k^l4IU9w80AIhiF%vsW$XW+GK$~3c2BKBZuEl=1c z(s@W%{kHTM+rgYziZaXT2fykHZHVhx9?hY2rn!70t$Q>%oVkGI%~&z^wsffI!MB-R zQg~OqfW8~8+w;Ov(HC4`$-4NPcKG$P*CNcx;g)`GAy4wHfLH<-w&somhvMz5f%Nf zRw^=25F#PME;?FIV7Wy|Md7xOzT`t+0fKE4UaJX656{)}4T$TwR=HAGG@H`1K9;uA zjjO$|3vIqia@drsw({y1-O)^b$C7wDq$NL|+-rYZT`KuHVaq7a9CwqstaCt%p@JG54*m}=l`fVo$uPwzV8Sew$<}zNo$;L)9;o5D)d@=S^`*^JaX=kZ$R~{M$#$9 z?pi9QdXRmW>ghhMb-`?&{1Bi1P(3^~Oz19Z)Yz501H%c@K+;%#&x#NZSbw;vwErxq zvPW9xRqI_>Oo&*14mv&8^`qeG-|EI($2pdA`o=FfBQ#GlNq?xZ>qZwguT~E8yM|S$ zCmnS0pzZ`39F&_Uy~UNy`ZN1xVy1okmwsINwgk>HF_~xIs0K8+E+W`&i*4#2Pov>$ zxFTK-K{Z&d#rkuI00kgo0mni`%|R1vDyi9J`Mab|`NEknWj+68Oo*e3j zBgsg*vJZMGuUx*uY53Yw`YSQ8B3_DQ!LWI79^0n;Seh8Ik}@kEIu9*NaM*m!pFzXr z#Pl+KDZlcEmD%ujddquQD>;FTEwNnNLaj_Ns5c6U(aBc3HQPU)(K4uQ8|k5avNO|j zrl+|ho|E1sNG;Hq0?y*Uib67STT|38iCTy&t{1%Z1ye?mKR2hY9mi4JnH7D87(s$# znEyZPOt|(0A0v=1pVk9K|D%$g+Qn1eWC+y@$#SJJArBKk2W+p?NzWgUSXAcfc=TM= z^xPi2?K&=ko(EW}S~1b;n^g!3+X|?GCi=SI{SW;U9PwLmnKq95Mzh)TXF&j1^o39} z`7zy{)OrIA_J;_J+a)@UTS%##!K}iRCpAD7;a2KuMMIJ!KJr&V*=6x&iAR#5TYGM4 zkc{t8&6@*cKluk5O4dhQVSBJ8q-`H(X~&;JDmP7 zzKz~}*-YT>7n^}LH5CNtW9e+3KP9=6WvmI_TkLaQ%bvGn2%eKaj}J0l^=<)fE-W~Z z;!isF&)wLsU}`#v>eR95BvhH+h}KtyoLIg;AKqm!4Q8xQtE7hP+$pOJ;jIlMvlFoC zzps{~Vdz&~WKs|M4CG2;%;2=WUIGJAZ;4*D+h%=?dG2#fVcOeHW!SD)n1#Rs6b*}`P{jP>PqKgXPr8cd!24SKN*L< zTj(?YF0`vsWcCocJxjH$1E9dflHc@9Oe(q2*3-W9)}H316RxLLV&)E*&eQNm;1g5H z@A#5D%q|*p8EG?Zc=>%3L{Og2Wlr(9rIuu$Z!3vH&JiQF)x&C@lXU^JJR-POA=Kjjq*UrlS2Cga@_cnarGIXwwtm3p?`tij$J<6y>AMMjt|nRmYqZ|FTo`(E-EfaV z^g>jPr(&_S zJq|^7ihDUWS+}(3v~&do>NvDAcL=XlF_jvHL4=z;pwl5$u)QnhvBF+3bJILJoADUI zY81=oyR~{3#WR`jYpJ6axH!2q2qaFNB7JcJFYuxSmwv=m48w_&$3MFIZU==YPvIrfKvAQbWc~=0vVRt1nY$YS_?}+SW_frthnVZ6~Tbc4{hvAd5tGSgP8xJVDUi)`PG34Kblc zv*o`*I=jXu?8XL~2;=mV#m3G-HX3%nluu&i%G37-piI$*X zQIfU)^se<#@wl^-D|}~nYTRsZ>q>Za?e4G=ytKAD6H%StN&EH#f0*1tIqO&D-s2O1-x1H4@aIxEFHUaE=6Aw3KdvGrJq z+i|Xw4_BNxd=tnYCjK-5-MhC0bqz4A+~tdVcdK5Qvxrd~vbw!iRzY%w*1lhCEvWZ^2Qv@3zTi=(wi!q`@Z0oWxKY(aUdj{+$Kc3_iwYVY#hyBzSy+rU^ z>hsj62oRMoc`}Z);@?#Orz>As0#5j#l{$;kF8W)#K@JldEy&m8wdyn>pn>;}|&1D!`cqzPb`k{z%_(z_#O&!uj=&9#+Gm z+x>lrx&Zo;Q|qzmeMDu6DPD~f>YpOq=5$@-A1eu`{;Z5=_kotKrkwUNd3k=MZfvjJ zIq&lIQ{LcnneYX3_=vhwr`bF5Gdsg|(P;{*L!G@CAe77pRQ}{g3 z#Q2tWWNt1c9Jbe&%&)$Wa_B3y)rTRZq6Ye4&~yi{U9+a(SVS0X?;V8Narp*v;9mJXksqg!%uXS z3SCK}&7*sj6S48O~KL$73!LYnA9g_(RB)t^aX)VdVPl2<*oM`PW*qyS$QESi?x5rSJml^)EGO=ud?mP6vz*6kzyvzk1%_x8*kVZZSNWW#w}+nKVQe}*H4HFx zt`|7lJ1Peq?auZaN6pPOG*qsJWhYsAo`EK9vJ#(JW?O>RinD>X#mGvj7a2>HcIj!D2Dbe1y?QiI9U;}r*`RGz7b z*Cp*}aybTSdhPWd9~+7Z;rHk~@!gu0!J1S}hgORWSM}hfMX$Pij@wFN=qEfpK??8Vm1Ku5RaHp6hU}p>6@jHAD`NA`e?WR?vTA zP&BouOK@npyxFd3t5+djUEgzHxm-Qdw@lj(RNHp#hu)7mvno}r)*xLtQ)+BC_sy_= zk69J2dDSefy2HOcR@#|%U*)bZ8T&U!eyW6X%7pSDduDMy7R+dS`pn6f@i!iynJM`-Y*G3 zq`!QH=AW(ix5;+keg{c)Vpi%mf^cIv$r+PBBv;c@5$F`-dRLEyW87>h7rxY&5pT~D zDnKH#{$^pKwszQb&d{uOAH^NCwPJZ7G^>f6^d%99)B3q5Sn_y(9~BH(teEU;*v>|4 z7!ejNW=VCVc%Sa*kJjgZoKdqZey3Yi@P5@Q-l#0?c3+lpBG>cO^8&mIBsy&(JEP+8 zAkLbZ%69cz%XO!d54JKono8Q;z#4ftaP3Wj4f^c~x#ZFL#e;E(6;0crOYd0lo!o(9 z@NrhacE-Tk;lta_P;ju zDIGR?tk<2zS6Uex337@#{LZ>0ynL8e7QMFoRkFR?u*S8Pw}t+<7`lxC-df`h^SSrG zi6I*2ZWZV+J-z!|3|EyIlxrJ2OrN%e2z3W6OW_N_L49S@?B~tt4lT<(!*q=v)GJX` z7H!pXVS8Lba|plw`18~@4IZ0u59BSLshQV^9oO-JU^`L%rY0I|lM8|~R~^$R>MJ?+ zHc^Tf(l`&KlbfGJSq#!*C}G>bq;b$ zC-|xKH!YFh$YGtuwE|XqKP&XPG7?0_GlXCV9*#fd$VK#LYlce&wiEYtWo=!{S2y$8 zMX2z8c%Kl53&Drlo-IiFE^z4+lR6$hg30w424Xy{l*cds-yrjEk%)j`S4Da( z#CdBx>NPIN;x*fxuj8!C4@W5%xWu2Y8#r!p!pv%_7fRu9fpM<6B=;Iz5RYSy*6GdR zclsoV`X1io>{mO}s~_KdxO?yM^R8s^t_O*G4v&qtXRgjAIYwy?c#%p*W9+`UuT`5< zYMPKSy|0RQUoL3wnCCVwK1b|baup{kdL#``2IlL5uZEydt9oHCOL^OArj^7dK! z&$YugBi0Xq@n%taZS}|^s*s$#r2tQ537)ySF30jq>+Bqb;R^P)=jagH$f{RI@ytRN z+?)IOV+fbQi-n>5WN3retMPrB6I8!%6(%!iEDD-H?CO01Z?uml2AN#yA#SbbHA{hvHc#T_tlr9Bmee5hR=RQ0 zODqm!kZ5pVjH$hVsb#f<>F;u~7Rc^F4?~y-2|ev!C*H^2qoPB^V-jAS`E4B*=HNL~ zl@7ZbF7PRGQPd_pUj&Sxe4GbJX=Dpi*yWwW)PVeHr8{EFYO8adiI(a6u5q!O%a@QK zuTXEA7GTTy>@)mqDL2@io^JJ_5!wNBxV{d719obw+R4s+jMReAOt%#Lb~`&5-aLRh zHrnQO+kF@VBRm~1X{_g^4Oo=!4CkXa7{vLL(QtG4{<}4ScPvUMW2qH^!j!ts%e@_1(rJN4odv}2g@_F*Yv56T06O%>LLHona7CuIYUTCVy ze4G&%#948N(LmgAl(0Z`VAVKG%nYztqq1Iytdzp7OZQz=r>DG!^kHK<&+GinlJ-ka zy6#UL?k5jhAv>z<4$HWk2QEc~QH!>@<{To)Vf+BL7ER;}C6XTI39oG$XAi@CzZ-YG z?d~8+!%i*ME)PXtVR=TPA9#gcp#lPhx3t+si7MWKjhD|2#H-%|XuM{zr&U$+W73jy?Gtg@<&e&lzgK>km=V@Amhg9r82;8USaV@vC-CLGV=F`Xg7=m}dm)ie+t8~;TY4>rr{eZKv zs=Dh?<2YgS!5&=SQ(zZZ*BEj6D79<3O~zcZYfY`bQ;&2L%{H@% zebn}2^8~M#v4W22wMto!eV{{k4EkGCyb_m6Dt-pC#qka5G?aNn>AGl&ui|0NlbuUy zhahs?e9>m_Q0!m2@0y`0q67fPUWxe}s%9NajM!}FR3dJ;bF8&v_rDT$$U=lGdOwbR zylsfZJM_AKGdFGGP;QAg%5=YE#M-h3JIiSqgl={`7&92jV{_a=!G+BY?S*zHOYPeg1-~=x|3|?LN#)?*1B;|G{@> zfyy0Z@{T=A((QuV@1B^yHK-|k?}6NhcueFJbqbAFPKOG^Q^Q2GG~Zq-x*hBA*tYA? zv)!e4!itB}$T4xN{8&%tp?F)?f{IRHl5Z{kKmjE{BD(da9Ftc`{w{Y1BVKc}-EBwm z?v8hTW=VDx=If*nKJkMerR&RIkcwve+d~5RitYmmfC6=68t%}3%lyK@Mx7Tnja=!r zBLbeO)qrypN3ZzTCBO@3j(_qSFX*ej#|tsF6fV%+jdu=Sl5pMiew?kw^ZTz>q`nd& zn4R(q58~zJ*%L^|oj2K+rk1pX;H6!bujG$HTP_Z($d@HuwVeFwjQ~~Y^>{^E*AKD6 zu6ecjEHQ^|>NQ3s!!9&Dw&Nm>*zeQ(^h0${J5!Yycb4a_^*bO@g^C}?gZjiV-Db?1 z*IMO)XBzoh<@c%f6&lCU%ZF>^JEM+aIA6}zC+BPivfY@o^v_e)P8_ZZuf+kf>i%HO z*aziuZA?{8t<2H9;uv%nw!4*Fksnl;6`#ksANw4)6W&rJ!u_>M_G3TB0uF1ob8VsF z<>c`!y4zld%{%?t6T`z#QNyl~TI*55X*j1Bn)vWw?j?;4my-CllSl&LoO{Ezz>|(j zZ&fwT#%4Q+ixUKI(&t~_G${*sC5m{EWA#i@Oi3+r{A4{mVz>-5EIHNq)}Y5tZE}9B z_cQjAWk7b`fr3}Xv*4rf%ZbzZj3Oc6;K|zBamGi+Yt&)+NA3yrg$nXb!=pox$6TQbe9Gw#BZi|Dim#_ z&RypEik-<2-xy&DPBs|#+!_0#9DJ0cUF|-Px3{xq>va&6jCsfMFwSK3>|%n!nC@Jn zdr~aFbzCjUp~~70?0IfweyP{)t0}V(zCl3EnZG}ni0l-oT&aoIw9GAjB;2wDq%DAb zAY}eFmfKhcd*9<&ZbxeC3_N;%&@237f3n4ON>B(ME!>*@rm$Pj#~nPtDL-6*?5@EB zrRgy$$ih`l+CAsqSGU$aHdI|TI>uu+v>|J8q^XWk%jrQyjz5`#vJ)~CeN~V&dSlM^?Kq1 zv72VQ@HC8@dkr#iEymUZNn>_^MVl?#8^62Dbp*^_NC;f~Zq$AYK2&?KeP0$@-5h({ zG_V}8Xqi=*jdK_82i2wMUu0$g*3ys&L95aeKMG7~6|BV_a zmt?C`9V=i5y>e5x;laE8iuXdlr6r*bs{W9Vx(aWKadBxM_NA7}q*`c2)p50aPK{rI z3pQ3f6sxWWZ447OL%Ck>xLAM&94oE15&-CPSXz~Z?4$;R8+22jD!hKjS#Wr zOjfSJrik^|jbVo)6CIK2dYZ${=Z{^fsP9+Ku!E19Mz5K1F8Paf%0NqXSxC$bBh35j3;dLAen|9EP`+Did~le{Y-T z-CDfWb)_U73Mj57DSTn1r)=j@g-%jmhLS*-C@KaGFxMa#<&iTv4w;MqT)x)0>~}1s zv*ay3hBbWX zf9ymC{+CMkMU(QLAwBmFB@P@|0PvAt(Qh>mv_-EBb?hg)j&IapquExP)zbu2`->m4s4qs{#yfsms*83I zJK^<|)BCTiM_VOs$G&KH*!#iWCABKBw+|+2ld4oL(Zd*pIO95T$V>T$bl28 z|NI#?EffVN9;2q3kvgU$E~w1LupGTTZ&I;k+pH61w|Ygp{c37@ML5oT^<+ne_=Km0BaSYCW{CVi?l{j>S$1@ZMvP*?hNu=op2PT6#VCqw)}p9u+O+PSbt& z`-OC$*5=W#dEKZr)W6k26Sq(__=7Y=)G8we;sJZ!^y>JDRt4BL`4Sv9Fbn>lh@@RF zG#B?irrm?h-2M~pBxiVGcze`p&(hx>@*!~ym-A0UcUlZ2o;WY^Eu&=2e+s0(cgN)~ zt6uC%t=GSbX9ihJzbieB=T{7QXkBpJh=0w*W?;#qt-*3&TMpQLpbSTDyaj}7< za;gnd88{?c^eiVWaDVsDnW3FP3>2Lqw!kQ6*4mUj2+pXf`#n#>% zbvR?hQ$fsg$^nRk1h!SVfgfti8@|!w_u{T65XxBU?utY0R0^XQqa6`iQJtAZBhA(& zYhki&vRoC){pA}2=5h4%+b5P3K%B+^O060bfV_$w_ih6ubXsBu7xml*uG&moG{RBB zl?Hl#>voqxi`>aeQ{XV64bbWJ4%gCtaCl+P@0@eba@~E|!llZzrr;lA=itO)sZjC> z82+MGR%HuC%Y2LYkUe8WFuHkre{Zv@4OA`CH+^Zp@7`*L$ewB#Ll%T@>_Et_O(bXH z_QYzNs~?%|2BOV)=FL($_{_bS+K>vZp4d6kDlbN)Nh>yZu-dm=^? zw~cb^FY#=S*k(Kb_B>UiG=!%%hf#4EXItF=n{8oIUh7st(vmO*p6iMF!{>S&@ZG+> zcE@Oi0?_Dv#Z7V+l_2Zl#1-IJB`?F@9eExN$M&A5JX8cq{c#U__V8ifjCLeIe+m&C zIFmI3+p)B5Zc0_=EBldw3lr`;8|$>c6ol9BqCt-abjm)z>xXd6dao|BjDOfJ+sbpogaOJkaYjyXa?%kb<73QGL1hi5O_t_)-CGXpp+=+{TYBXV&y7yzG z!*4Prwrw1{iJt|Kg`Bjm#C*0{vbF2p-p%IKk1G(vj+UZ-h_*kD?FQ;ix;FQ?j)|sfeiGJK^*B1cDogfELY2|g6j;D6!}h(r$lVdg-S5CI{VB3Op%if~3q8A7>$nNtQD9qc z(qb=cKRhZdEZlaI#!9b8-Ix}#zm3X{%WoGd%j0(&f4KQ6gm$4`mm2QW{E)}IhvVzT zI9z%-;@1RKvmpYVn20zWN;rOX^bC6`?SDn^ZgpB=s>lAG&cxKqtsUgPRTg$3g81TP zd`6LkATGJJa6>X^ZArLOtabXO#`6f3Rv?>9b_v^$rA>i%Vy|u%!uEHFav@Xqh-D8v-x2EGa$9r(dc$zWIzqWnFqmj zx>k*ukX`V0$^4&#$wExgj_kvj#g_)_TexUs+n>#a)?TT#^`HG-01?UF;b|A>Y6V4$ zWdmsNhTpid#d29$Hiy0({V7=*x27E{WZ)GZHrt`YrC;k1C0rY+->rmLwc6m|`>|Y| zy{#ktyeoF4q0O?YtS!51$zwXX!Z=#Y-DT3-OM@O(rRcX49ptLXYW0*%cW1k|6;v$G zwqJ1_Qrq9Fw@=;wc^q;_erqW!L~Og!BfJfS%SGXivfEL;g}qwlpC8AJY2Es_ghvJ7 zj_P%NJVp1UlmB*Rie2d84!zefjdPa#Ikefzafi4X3&c=9p) z-ZLB(&X-BZkJaV_60h8Qr^D#F!2}Z2Z7_L9{U>FUj%YPD^!kHVkfto~3+tDVyS?G+ zm4l%&i*fWx%c-vw4nc|ly>zP5bt%Ai{zgFa4{Bifyd|YytQfSe8W!1@F_dn>sy$5@ zy_GW>w1||B@7M>T*1GdP`i;liRQ64O^(#_eiO(PlnK@pav9`TmWcY~A@REkf_3_u+ zII_2VcM~6h>`r*rh6oIurM}yUMd|L}iPCbDZaeERQt#lUYc0xyV-RB{TA8C1% zT!DRUl-B$9>iFJ+03PGki9w5(cb?JU5eoPJ47>w4=HNE>>kx})h6#m)gnb4gSBq53 zscu3Cr5c>&24lm8+I@t7lx1`3jw$VuS5=lf-nj8c^!OsF2l`~EKyS$!Qsb$$WumiC z>-2~3bohf724GO(W6kBi|57{)#K*g93E)fE@wFaZ4IW~OC2lxFfg=I-&CV@@OPX#g ziRyyt2RL!B<#a1-nwH0UZ-);y`$?I$r<7FBS@lz)m~#qHS1kn%0d1TAdGXK|?r;D{ zym*E^IBZ`RUFCbN?Hv zMe|GA7Pp1kn5*^A0-E)WIq(&V1LC-0!Q-)49tj2VV&oXpq3D^E2^MdSXpqarA3yvG z55qq00dx=o5R5za?gIWZcC5H_f#{5=s}#`}CUN8_2%R-AYvUR!&Ym?~%5gF!;4(oO_bX#SnUay`jw>>9HFp=j!~ySq1gun{PE@Z>14nO}DkItbF4`e2lyBemSsMw%`9JJH2HBt!gVrBtR z!zi8RLAX|eN7}8pC+a3KB_h#1dA=&5nQ2_f$1*Scl1@*R_rgT&2zAXVskKe#+s_4r z_V`_=A?w&yjmAEzVY7J?VVzlHA_e2gG+-X|V)pYPwL0@2DW%2~`At$uJu|r51%t87 zQK~`xwx(v%s`d9#__BlXm4zba3Uy$5G!)6IIxCaz715-iUM&3^-V{-M4^Gxc!hXCI zd>H8Qcz19Y7jTJFnW)X&f%9?v^cswyUbxk@`ngmNTh-^n-_8CCv%Dvcn-pG!M%(*i zr_>TMOjc`&WlY%3d$(sx=)2fe6%g~j-A$N`)ov@y70bv|dMIDUtE+{g)3bj1l(G$t z?M5oa(3W;n6}=w|mG@G@KszaCgl-)h)Gw96R2e2eSnu}U9y;ixLY9PDx{mSeeth$| z2kEp@$fqq+?T*_z6a=@%eui>>^Er=pVf&v}Ki(M8ubj4jA0o|H@$KnTGxJHw40mpr zrcZ){*AM@=wByBeh>fOpV?zwHOr3q$TvK8Wmu3r(M)wD$$?5!aJyhAcL|e7v>x1HN ztn1Q46$Q?*J|60IqC==PK`-*MS6xI@eDI>~&pO3PLo$tNZr2Y;ej+1zk>GgIVxA_` z2zrYp|1OQPuEupp4q0-*TdW--f-LKlvCozXw}8~(oaRDMRpQ+d2|#AG31bZpPpBoX z_J>B~8D3NPhkJC)^E1$ekjn9d-iN!KbmlaG5nV26;{Fu3NVq}8H|_hap_TcOSxT%X zaoDLo4QBT0l0xQGi*PZK=R!7`xkA)}(u5EA6ly*!Tofg7=0 z!E5V+eyVkEx13yrz5!`F;0`|d_xuQeiHfNa_8)M`gddl;F8C>N{ejP+BF1gxkuwK6!Vw_aY zJEB)}?p81B#liS(iWK>Zci|EO&s0K5Q+reFsfiKF6i^sT;9Kz13mb$Qb(C(Nkoc!n z+ks2yCz0xz=^ZYZ{>;}sW^Q!z?{hSGVk~&JX2hG*OK#<)>qruL*{N{p^k+J_3n=anq^`sWKUsy zMY>Vt0TqGiOaf2;qg@7;~GWOv-p^ zq#6DxvD6^SqME!cTH)^IwodgNhXQfix>B+)HK|+Xm!jtU^=$ftUu+07N{C;GSV?F% zTcmDwZ}@q$Z@?;LJi=@Wz-B60#5eveWy1p{4omKpf!L0;QiyjsjQJJtSD;-O?`S9Wvp;JJh5WbQNiLOoM~E!=-By6tfjR!z%nn zReWoji=q9dQm~5%HR1+Swr2tH6l0?|-r|rl&Vtz7{$qD;?0Y!!q%c!S)}j!EsV94FTu^zU!ocWPm6@}-1+BEXfi_?GDxaJrR!^gr*D|+s zZbBD55lDLNmcV&T<(}ekqI~IAJ_@ng%sU-VF@l*StzU`PRri&(dckT`PO-nIU{m=e2LErsB#p`0!W{i(dijl;1PYLRnzRzHoS)#;r z6WHUTtZjlEP$^1Ea~+jycOIA zOR~f+v(o-q(%&e>Uq8MC=MsK~CJuk!W*!l=EpcS?CoVUow04}TRjhV}NP%T* zyD3z!vO#AgWsc$@%t4b=B+8)t!}(PVd51hL&DQV>W-B2f$7!dX-=b9=sD}M=)T^@q z)?G;c7b4imnZ5_K)A^?d-h2=wFqV+bzs;0Fr8N+4u0ew+m)mYtqmW}BD0sXY)GMfN z&k`;~EcyA(br#hp3{dCdDd#k?1O~__6>*sBcQ0kBSQWM&wln9NxC}t7Zc!)_lFnb{ z!2uss-ST?|`w%L-mt?kf(zrl0P(d^}T?W>8Y!5%)hFPe{JD+5%mdBI6KGheO@PkMl;IYN2S;OyD@bitbn2dlznZzcHQ8 zL(N`vy@>e-`^uD0z;fs9!b~TV2y9?cJ%Gn#4qGGLrIkL67qcA?E>h8CLuqH2WTWWS z+N3&eRZS8&>|QqJtRzCMp2pTUY3^*Vz>#@hn|iqj0k{6`dGWAHy5lnrxo5poE&f9c zYm@__+se-3$V!MiZAVBuWqDFZ&y?xYhx6!_9}8qTJ8la?7_!)#{XIRO$pOpCTldmt z&40e20nz@UThqB!5ZRq8^i_~A(nBKWDnfFcj4{;$!IR0tn>j~z6NAYh1I$a%lIM)F z%=I`P1c8YC$FNX%S5b6G-sAjc4YXPhf#K7{=q$PFmR&~MK8_@MH@)(Q-$9|)<(Di5THTGm@IYWH9 z9N-9T=BjEA27Q&{;0Sp8rKV)mnWshRD!6FSBogp&(M2qs3BjqB;I7Tb!W~i`<|+nv zxmvG)O5ZgTBO5W!BigG;sx40>Ir>WfCDk}B)T+t)EXB}GT|;w)-DSDt>aQK`0P(Ok zusgEEN{CFViKrGE+BNhHPn@PM$G*Um?oTU1#Jw@l_kjD?FhJlcq63_eR26ZF8dK{T zXLBj_diS8|T>l6Q$|w1NT--#jaGgzwtewhWSaVS(T<48~cWrQst%s(|WQNnL5qF*t zTYo*Hk!HX8zkbV3C&NAUlw_vvntQ)5mPTF)_&EFU&;81{2H5>~l;R$B6#eN9_ky|E zOTRw3DXl7q{Jir-d}*_0Dm)OO0J-;OWlY<3K}yO6v?1JG7!9DL!UP10-R7a*$I0 zQ;v49^iZ5UD@0>-6wG1>H2~Y}YKNV<~wntsY^k>ZVnt>&RWA18%=C#JSkD(st z%810-+-Ldd#A-oDLqav0vO)lzWqFOY)6{)+tJ=A=+w=o{=-P>{+B%P8W0k?P_i5}x zRR_i*hS`SAsw)%Hs{PKR8GH^C%6myHV3Q<>^Y9fL|3rfaf&kPwxQ_ig+{u|;LZLbP zXw_32)TI*0527N-6t(hus?AS`pN{t!Da&))ICEz{zldG+K)& z3wc`qk1k`C-)Rb*Nk~Q!s(Rl24|S-79z}e250cE3|ApgPAmMx-tI`u21xK10U;Eah zed_=c5$Dpm7DBebG*_2`Alwm4kJMzo5c+5W?l*3K$LvMv zk0w9+Wajy(RE6Rsy2?w_w-7s)bRBmM>(LZ}xTt``PM(NC^vDgzqH1pfpKeXb_`T!k1>%XrY!u z4g(dqd<639pkBqh);nU?m=cXte5WQg5%YH$t9(^5UXS0U%#)DMW1jJ3H%NRj5XY&X zDPJI@6TXTb)HA**?lS2Yxw+0QHWt>M?vfcr-*>NsOKd%3@AC%Ag_|DKxuqQ~^PoKC ziPt<{@A{V=`?F$C2b{b(oG7qlNpn|5j}m-D~@o=o1L8k^#2w+&|s3!^66OE9u)2wFNH@IN0em z2LjrJga?@~f3n@K$jKj&>CkylZ1N`L$p>5W4=mxUtgOzGC}OhKPr8;?qPbXdrm^cE zWz+@@pp)#66DBn-P7VMgE>yL^MW zqA@Ip41kmsSS(bS2@-|$RpA?MmyCHco{V2^-@w*B8ypqciRE z$N~pn8pyCbOYz7e=Y47|iw=oT7P2#Fv}PPttXMhqK6Q_JlwmZ&-V$-YKn9oZ#I>jD zh&MmI(g>I{qE7wYT{fKhbCBl*(v@!jxS`6Ck-R>UI=BrOlelGV8Ta&zLS3i`TGe5>5PsUqWQd@5wxd5^q0HQB@3y z>@JWIn06@RBom|f5t53b&bFkPxY)#~913Bapd!}1q5r0v4AWNNuboG9gMWNIe1pLE zW^9X+{Qw7~EaIAI&UPHjlNTdx+4SB0Z0uJ4x+S07X4c1@n|sBt3%}r|ovNojq93<$ zx%i49|9^r{dH|mbo2_Yhg?{i)F5av_?18Y9{-y)X8L+=7UY04Ath*L87mn?@@1HP3 z6xnV6kZ4DIjCU1K)i8^zHwoCSUNyRi{mQ9;FcN%ok?4;c~wRCq5=GXPGXDdQHHsdbe8k-_x5D155AmRC8rV`Q90^(l|YKb0b z$$_sIR>>_%r*GU+&lKtaxFh25`x;OpZycou2H>1gjW<}~13UhZ{w<)JK)}WhF2yL_ z{$+1Vs<-Q9>YZz^^Jq}YbY08-_{{H=rRK^2hRjN?Q z?13R61588HBeIMiRlira9F`E3QzDS=)GvTqb}t=J%WISj2<5R#T2-h911{h_Lo~)l zz<)a2rhgvOZItn`royG-5hH(;E~jFzzwg4R+nkMZp$0P~XDlgw(zw`v;fAm3i&q53 z#U#VJ|soX-5sOBnwoTuymP0Y@i!o+uJ}MZIev zyy94X?Je8;Kkh}xOGNdDm9vW*Uiorf+NmP@wMr`XW&cY=DkYPFeSttDPC=KH?4g)69Y35n4OPk#yl!b#F$2C`LgF`O6h;o9>w&I28cHd~510^WsNZ$fuETV@p8 ziisnNP79{T8{V|>0*5Lm6Gm0sze&)pq0|@FQ1{)iD4yNwXiw1J1z#7;J?hgK088zi zsy$L+|7p4Zo?YOJ9bOc4KIBr)D7tvOOq*)O(q7u-5v4ZSM6-EB(DP6=A2Jp9RYR{0 zJ%QY;o?qlG5ZKE$mvr*TkzbOTxA^IXclcz^WDBh`88LQVIdhs*;cV($fqZ2lQGUR3 zfKSNI2g3(IO7|66jwfQp37Lh(%{tzzamHsJ%^4jK7Y*F1QD=UE>$k;T8MShe${4hu ze6Ideun+b~0$6HX_d_cFX-S7PrXv_Ezj$0J)#%SQ-dnnfyMhn6;y$@ZLs~Q|^tuwY zx&{g-EuGgA1j8)!0_KRBS;ErU8+Gj)AI+sz4OuI_6q106(X{CLrKmH_leR?Xkjdq| zd%7T05r4*$Vch- zvmX%mF)5KUeCaARBD3Tg2c}MXZ)pwf>;t!x=Rek#m;6;Uj5DHc!{!g8Hl8#8rRD+G zeFMkJb`u3D4+DpbuxId(>j)t^!xzrtAIY}|u4fAr@v94W401+T4kYR=DE4ZnOU5*X zsKv<(+MGMkXfGlRR*4G=h1+_r&yi<^Cz08Pbc_C&Z*fm(e!K&;Eq)`^FRJUAXYWIa zFb@_=aH6yR|7p*SxQR6hriP?bXNKa0XddEDc7=lSY@d~jQ5n!~05jiYzQKp*tWUS+ zLmK%OPb1lv;BJrD)EpJ1%KqOT0#YOTntEL6V zp7$ru-)M+(;={bYHHAaV^foIdkzOPO2+=W*3HIoIq|!;+bb-B_SYUrT#Ng#lOObct zRF}Ta&|hW&ZhtOA9R5RGzqf-k3t;W>{&?Z4a%aWvM?3GrjAK| zg9xYg@lUOt8R@^u!S3nNE&HARv2Y@AM{eCc&I|vvpodty{P! z*&*h1e8=6nmD*H0Jaqm;5NVVE2mF?W#ZmPU4e{1_bSH1KgQ=KKQd)Rs1kR)rtsJ_k zCEJ_kQXmJjwa5(bngdz9OSjOI8|#-4pWcN(F zc#-jn-*U5}Ts7E5KSVGm@aQ^FlH%ysT_a9j)LeQI!S@^6tq?>gvhsB zIYm2*vL)l{_w=6O<_i8xoW|8_1k#uNTN%gSuVvCM&fu>ymajidnnpk?hHYcId~Gz$ zx%#up$IpFXuSBCm>@13(FokA3?;^GS{&@ab_lMRANsG`D`tw=~>826(wrgd%*l}id z>mdH<7v3%QGIi-AZqRkpVr)FPf-hXOHB#TbkYO4<&K4MnWoCm<~U_d|5PIYwKXUeVEGo%{mQcn;c$8>`CM=vy0Zj1ejnKyGUCQhOsSn0cMH zOh+P}5o8!eDmOKl4n+4do%Wul5>cCkr_wnjh%}&!IcFF|WiXg1!ye(B@aIqjTY(PD zf&If*n7nsFKhd^O#i3OWf$?TeZEP-`*FPJNvzWwimWu|&(F!ydyOdo zt3;UD1-jugJ{bXdrR$mp+jASYJ^jyQ)ez*Mh9Mb?T} z)ka&-d#)=z@)e{^CE52{1=T9Z7O2XP2@)I%3^#F?tI7NGqt?1V zzMW`sIcJDY;T82$w+%4tx7EAJSG=*j9D~1KS_Y_1_FQ$(n^RK81gR}_qwZGhNnK~V zX7ykc>w@`^15CP>t=p@V?2A#~?Y*E))^%ptqT*a8=Xl9(Ch85Tww|;|9JjY*&5q#-ymLAe=Ftl&4fU!A@Gxe>k-QHgfq{$x#Av8SGL0R_>v2^!Lbq zq*V-r0QF+SbxIjuk+nbw`YUd6-uGV!Eb=|3TQe}#LnZa(#PKxwu-|-EmM3#9S5qKz zF~Kv1_A%H_zk+n0(g!>_9WJUjGbCnYpBQATnW2xdHnPsZ-d`XYy1 z=HfG4-is%^zR^{qPo8D(KWEy8?rZ`i?ZER7BuWdti%`x`xkMcX%4#BmqwtCg=hUZ+ zyn#S<)skM_Y|2ib17RAtB_Ksg!BCSD&K-yQ9vcn|-qDz~ z5B$~Z*0GkBF<~x|3Lr6xla>R8LYA}+>R@6ui@Jp^>ZhMSTa|^14`cNR>8b+7ybs;O zXJ3ozGvs^taDI@-WP(vd66A4vo6xzpei^D`ZKTs7Pqr+eZ%hjR=HSsgbFB2LHgP%K z=Lc3oM$w8HlVTKyHpmukTra~$p6MGWz03akW>(9MWvWzMY(v&binAP2VojX+*b@RD z`w!9W+9_~a1(R}#4h?2cE2fU0f^`nj+4j!j2&G$t62QW_xX&WL{4)LnXW@pEpZv3QAFWXms?P8G1*5{>c_qFnU4#G zTP3wt2j=Dw7^zo@M)eYCU=uwOvx{!uN!O#tD-bpyaUFlS{2$hNjGz$L_t)m5j)zVc zy5mUwO4+Ve0$J8})F6kKD{{V`?Si3C(|ymO2GU2HxEzO`_RKH zi;!dt&*G9As=J5t?_2^`Ws9UHvZl$~Dk@cTgm%nAkBR1xy=NwAEyJuU!KDn@>lDh; zcV7iK-F;?`eRKPNOJ5l{kAB+hV$Kv2A&(*}KZyfR>zRwR6XPNG4*a~9Yx{M>UYFzZ2=4KQtsGFlDUi;KEvq3>6o24eVH!vpO^vDa`(d6EFm?e}{myc7W zB@2_)RZ=m3^YI$|4oGD0P5YUs(5ggQoPO#2HJ=oJVQ{|B6S~8)=p%&x7iR3~g3Hza zw9XuSLKL)rOf{z3f#(&@StPa@E6a%Hd}Q76R+t~ga#O#uHc8TfaZbS20U7qR9$ZEWUkE$!BYN*?Wv|LozdpCLU&y&Pp!&h- zIKqzNKCCp8>t57vk>R<54pOOY&sqI3$T1t;2D=aEgc{i`SDLLNth90ze4O7^AF;{* zu70!|`2R`W#Qc^vIxkGE*%Eq(oqho)ulc1VLcfe6ZdFBm^#(BUZr!WB2#M}_QJ0?B zGoyqGT_^69R`i=)d9J&NQg(04O_%&RFTMh z)Y(bR+BAOJ6(lrmO0EpNM&jL>* z4d;o(QRK#9zW4(X0T9aW^cB*nICrEy z|95VIG8h1)8ct;))1-xz=}5fA5}|cBXZw)nRbKnsd^5&!vqQKNL` zG`Y;(uFUkG2Dln#p73iGs}Eat*3e3f*B9D0?iH4@Lc7_cvENSCxUZxcuk#n`_6E6u z(*IQd|Dl6?Kpbn&a3s7eaBEV?B^%o5zV2>)ZR@=o&+y!rKb6cae7Wb#_=+A^>L!Ze z4CQdNI@3o`3y?v!)^bMdRmVnPs^pwQc5E^SB|BWsKic7GjZ-*gi-3kDS#RUrxU%-z z7Osp4Zo=7}nBEnLoiEaOkyYi#C=vxXiK~_*m50{bc~kP!CZs5p3os2_fcxG<(%pTr zd}j)bZ0vb*6a%h>#({%4G}CuD)$?!S^Itz&;`-|2#GIP(&XxfI?ylYY$;Or9ma*lK zR0|w#!i9**OKLW{aN%o2mlxS<=3cVshQ2~Ly%a3^meftap5N9MUtIuk*GRK;`XY272i+KAo zC9cxsHV;0!ko~9#CEm;iQtgy9T&hg~+ZE*ickj6#Wrgv9{zZO7p8x1yeYTs{MVKk0 zK6&9CLhGspKHG+cVil$xZ!jf9cmF&8?!NhpI(?sLQn9Thvmly2%gxa#gzio(d}o)| zF?tZ@Xg*d7-a;8O9t^2&7k#n6J5_3)?Uz9#@FJ-n=A&33s(Q$Yqk!Z>;2F-GXch^YwQPG6s`!gXUdk#+`Ca|jKxGB`Un}G2 zk2T=6tqyL0;X0-5cL!hmVxTF1#rxh5O99M9<6n+!q6rM(VuWU$Bv4LBCLHfcjL+i? zNi0^QW%WyDnrX2AI46^xYIIrOOuIy?Na%ABC23|D(zknL3Z14Jnx}m7PhsdST$1@H zW8>|X$(MKB#My8cH@nABgdI=^N+T4tJ!k;N8U4}+oY!8Xefrbm{DGts73t?nd?jNK zVzIhl{=aGBU2(=-74t87`d~co%8c4vTFxRZd(&US?7n##l`S|fkEhCu^au1HF7=+Z{_qy1bm;I4?X;7@Fp??3<{9vQswCAYmJPyiQ2;kZ}I`t{F#q zHiCEkmyk5`TMNd~r1MN)OxuMFML*1NI>FKv6m((o2m)KH5DGx8q58bIiUJOsNZmaD zj3>ClISf#c9`dNGe5hZ|*Cft50jl+1_Jf>OD{sKes@tuTaF&{?xMZoJ>>VhP%daF+ zJMyWp%GP8tHo6-4#mTg58b9qL{S;}SwE?(zU__n$j7V( z#;o>MZS$^_tgH{H{(?>Mz;A<@)as0_;-}`Vb(|+78vB|P5~kv%r!lz@vAq&O*nD(j zx$PxgHyhi9b$;mg;VN5;;x;HH#LaeY);Jopg4L2PY(4et^P{7ZF?C@u?6+ccgPdovWlkW-ySC;ae|X+|xpCdqOTJH1)8sR;m~I(9a8P1>61d z1FCMLgk_+e#MRUSA@AeA#)xjhglo;jL-vBV%gbPx064~m_;b;)i!A4D>Mm;j(YjSI z4W*3o=YG$b*~0Jj4h&fP9`%MnsP7ahWK1f*e+rp4F>STCyj*Jprd}`@{`k5wrP;<1 zz+o_wJGL>L(I^VDEL`WC`b|$yc7=|2^)hZM+oSLC;S`8ZpK6C*baC#T-L$68LSx(b zi3r?^t=~{WxsBuPgVi%Q;*o}1R=8<0c1l`D?oHAl@r?Ub+NrYLC!znsJX~_n%Y zgr3GHa#x6Pq57%7!0{b=$1cJJrsJ;aU(I?Y2p9N>-yojzOvT!&&p+cTd7Pc9Y#ds$ z7L&`ui)xNBX)Y3CM$kQ1W*$8mwev+LgJ^r=Si!3GuXG)Fa-zAnzBvWU_8-I1Lgb*% zp7b0h=(Q!sL3IrjS6zb@zCqjRejik6fa|c`E&B~_)kU~#b(9=ze+oN+Ud^eiBuFSRg(U_BCwlh^*P?@ZkGjm37#l{v9 zCw9D)#%gs8-Jfq92gVD2J9|0jeGI>KV!w0Wc@=<2>vs9yW6if$v>oV-Mm&}(8e?&@ zNl~zsfOok~;Y&QJaw1H3rXDU)Vdo4W8(W4UvE;$@s3lbmQzqL*4Au4ynCNl^jB13@ z^)pYO(N*h>7l3&=T31Y7vK=K#`LP+>fG4~iw!~|?FQxZ0Z{Mm-+uw7XJB7rB1>HK= zjot5{!8e_x6N{UEH`NZ;cSfHAAS~{e+_N^ab<)D%<&y%9;6BW53ed7g}nrvx*%RP#>_< zduW`zPAAK7Q~|+@yM(g6EI6O|yQWzRFw`wiK0lti*5$kwpP66d6dJXqZQ$fL&lIgN z@W~3@FW**dW;ys3hJ76ty_;3Gco#k5fwZWq4HoMoHVokjf$XU0GqUiQT9cmU*!t*6o*YK>iwwAsIC@>7C}7qoP8LxyZ0J{tzJQSahn6KuZDrXfy} z-nkBGU9b|>He=YZwL@cFGNSczMPg5EHl&RYImA)^LKj_wZjbZWMWrM&1s*-!2d6on zy+JLycjP2E;AY1JJewTh$IjK9Y4s)*QM{sSy~`CduE63xDA(yTUW3L>ka69A5z?$P zj9uJ74(>goy(zXtxHB#<(sX8WXKnV=q)rK}3z!-$Fn81E9PM(PVDxx4kJ(zT7+0_2 z?3Wv)n@i8_ek4MMTIO@cxw+oW^TdZT_^PZh5d2Z*UvmaZ@t(8k>?B3 zv)?0%YAANqUFV&~q=`v@+JtmiRRwI4`@3JhO|LdtNW?-nw{_LQBnbhX5{2wvT-kw#jKT}?WbTGFb{{F&^IdO2u$MvQ| zVCL24qX|Y8Uf%@6fAFw7I((j*8{rBR9(5Y8bpEa_|Jxm9>F9(Ks#+>u8hKX%W~gzs z@mFHxAdzc2hP6R_cN&6O-M!nEtSaiYUchDtO|z=o^e&Uu**QyBvcC-Eqi>Z(S8R;*h9F<;u1|H!c0vNx3S*84@d5EoG6l*E|2Za4 zJPn>2>paE z5T3qTyrFojr}4y0!xC2#(ksIHKIuGro+w3DHTOG?2!9>Y)qM4YjP6xi4bdeAP`LB} zl+zBhlBc;Iwr(9p<2ZDs{o;y-u!{t z-Z!B8P7I}_cQk}z9RO(dO-AwesLM-rtBd|;rkG%kV@}07HBOF8WgXf1S;+CJ+9>kg zY(wF1!r~QW1zhEy8!N~^4%@XXSwwBTX~RwS-?*AvM(X&JDJu4Pl=hGPxEgt3D{C<@ zm8tQzszx<73@QKtZxR?UjhWkC+^n?LQdM>oyuO>)a?2cy47@%9=iXyPFFzpNcHL}f zD;}9@mm~Y8?b1I9W}Q99YB+vRiPExIEE--)xEy>2ubhoYeyf1ISRx;q98n!|Z5Q3s zG~4DJXrC`f-}-K^?bw^4p5MAW4Ewz_Om7Ug&6>S>r>^RhugBJ+KYR9_6DK)T)LjSa zlv*d6HdU~OkAnGh!6c(4;oJ(>_R*}LhQT~wn0;>5{`h!EoTl~He(ZvEd+a&Bp+@YQ zF=TUi34&dIfUXsNv}N78a)t)`V2KpZ+hLnjy_)R~t&m)B@_1a{JFhlDR2i)I5;$A+ zeWJv^Y>l`s#Rz+N_)sl)SWU|BEI@>#d3&{5vd=lT=-TDhx7u$Ex(~UQE;})OsrdR^ zl`4)B%3}WkxxRy3UqaTPkLo=CcthF`z}4@4F-3t_reh_ON^8sCe-NrYLy>96S6{kc zqDj`Hq5f%CvennxkVUJHtze_cI_Mlc9_mBZU5>riK^G9FrfNQyX8Ur?mUuOUc`nMl zv~+0e<Nnd<$rgD` z8QmjnuIHMq6FD!Z#T_(Wn}Nn_pr|Q^obDXY-lA*8xyqD!c%A*v1iU2j0%03Bt;WTN zPv!3|)h#cQIEFf+hD+ic?{6=stdHIv_L116W;X+Ka?R1>56-XaXO(SG<3?+&Z|aZk z)Kl#?gBfb)-hHYeDA4v;7Da=3j9VDL)CBz=HN$h`rSQd^VLqJ~4z+T{TVKJu%39;O zHv~MEN?S^A<%8elwtixRl(`3PH-dpxeb;IQ(|sUQ3Le-`Nc2>kwHe8gbVSOW)8bfV z>~OUx95?Mid|=GV^6@H^bxD)J2aI|4Zu@-MrcOluP#YT}!{BE8%k&r_ z`*cB6U>94$(2amQ0yf~~E|oc1R~$RHnmx#=U59d~{2;rmWYY9E?dVzhtl<@{tuZ_| z(9D6tO#(kF%4%qr+eKW%+6RM3LGtR`xUU4?e*bkY7KQzq^_iaD?v>{EzYn(Yq*J(e z?%`0?hqqioWw`}kx15|j97k?MFUfDmACXl$0@^H~=;fF~J$bpRc%hx`FYUPc3YdEf z94wtR>D-OY=MkLpRa8T(=0byhDS3QFehvq%T5f!xEmAgLrjI`IHmHWxyD@6f zdNN;Hi|f3QJd6)?T z&vXwJQ|;U8+#w?^IOkxlFza3L8sJyF|H7|A$lm*E6FBj+U#uuoZEynfT|6>uHmRfZ zMuO@kHmy9iI@Jeg5?fq70QZf>4Hfc;h78#h=vKj|wrQ+4#?q6|FYE3#-!z)|@^i26 z43_}X(a1iSyrHZ@>48^9iw9aWe+^8QqGeA#r>}zKyhg*!p7pdQXd$EAW1hN*p9%I~Es*61sZi*SXC5&;;LYJfNEoDj4VY~%R zhluw^c1K6XIl$bJy%R8GG4egSa$!nmiP{9&a+Z2+f4+ja{JE-nYK1jhgy3TpX~Mgo z2~6WnAT;&wF4>q_5?)j!Ml-T7Ff?|Y^?Frw`p(G+=R2<+GlZKI59SzNZ9Om=ISs*7!5_3j6b@>1L0caqUt2<&o=UnbcE` zJH$?v_z$}ib0E2q5!b2tY(H76U8Zdql`B!NZ0ksTIqvrOK`D6CL}DsEHA9w(fZYgJ zZA3}5QOU>mkKuJ)Gh^bf?cxqf#xyDG?gdgg z3*SeIBv}pm@pEeTMN-1b)Fl%OjKtb_i$glkvHSX%=jQ)>Rq5naU)r4giF5o!lyVAt z4>^^;Cq#Rc+;}R7m80kSQM#M4TYEpN)}rTkJbs@V-x;cljO*u~ zqZfS1xZ_6;j~Qq4iSi1U7h)Zea`h3$?#vHm?+#cXE8SE2Ib7EfIx!WKZB@Egc<{TU zS4JF91siDPcki8(W)(cWKG$1*OW3JLy}!G<57u6W zlp0B0fi`x?0Z^(zE zhvsQ2M`;Y>_uX4{J!T&CyN>K;&7Yv(3YZ6@b=5N1tDHvzxSD@J_Mwv>ns?Z@Sn{V@7*iVEe1B##pnBJ;**Xz`mSy-wv)?u{x;^YjNvBeSn~sw|27k z_xG{z`FD_g+W@8^dH6nzbKjjNTeWh#u)p6Jo}dlhS<*kexNW#Xb2eIu>F|K!o<>d( z;oSGl@<+EWsPi_!D>{`h?Rr-RExWm^1{J=c@t>TL)k~dy>l}7>%R44k{?q6ki0K}K zPMZG0(8`r4%Ime1OzSS&)h^Afb&~|OO%X7bXq&NEad+p^&fdGbiq^8bLCh~-8hEBm zf>FX%o~gZE_0d{aW#d2JaQ?;qQM~i~&w`q9w$A)FPJv2?Wc7^DZ6*d@BC_RkE)ZkZl=<1J6|Nl7$ zK9;o~Y;s?hYJ)Aa4?1d2c6f=7_LjOzd*Ri@AdQ9WF%UuRm;Go5PQgiYRnwf{iqLRc zz8H4#EJIq3{95fsC#92oF9QG21QsitHsa<0A5ON6lG{Tv>3iNRg z%LbsM`FXoWl)L#u8mle?;P7$%gY=H0uRu@Gu0}fF;>X_Txo?TS@48~98NN)g0U%=^bxcPa=`1o|Jz->uK6pZkw?l51={h%j!uT=W%VS2UQDBgC5TOlv(k$`@#fJ*g(C+b8jy{4gYN z+#^sAw+T5Z_~eO3dbWF@k(9BsI0r|Hdx(=mL<{BKU_&KZo{47o-9Z zQ~))1<2a4bgb)PWr`NVc7=_ZE3DolOopKJwwaqu{%1N5lStH$LuE}!dgEA z22(E`F3iFkKMts(eLe{x3lohjBgez(bncx0O~Q@HaW*Rd$w^PrdmHS9CZ?NW{lX14 zsW+x>1;CCEHl-UGwdm~g0-VS+>}|lgxk0LCp~T{522KJOC{vDguX4cna3 z;tidRi;D|P>_!>=ABfilx%Hp%>{bVWAA3_Yu+ukiHqbx^4Itb7Np=l<)}`Ty)qcd) zj;XM#+YgXHZG20F-iC_V)sE#tbwbo)O z#XTD;y#GANLw=W#>UjRIc1tJ3e32(zeYQs*Q~u$|p2v_6U2Np>jyEKdf3^v#n$a@; zZM}}f015X@H@5~8(t{eog| z_b$OuZe5?oj>4U2ju7Y;L@m63i$>ree&_>@XdZljqpX&K&}CgH4_cp~3d0}+LVlQ*32fon?-i)By7u?-W=Ksq1$$+$<6@yzQRE+9M#$DPi4LuK% zPrl}@YLblcmhHK(k~csOhdK;T>jo=8-VePMI1UN3cYaTfvK8_~H@E4Rq-HFHkuQy- z106+d-91_sJNRa*BwHv#&a$I+#N}w`cya?vr|Go@#?5iwSwv7Og7UB>sAYBE-O;y3 z5{9DVN2LxqdJH($S*DZ$ccJD1?~Ew3aXnIU?`zACKx`^ldjgmSEoZrjP-`OCkpvaO zt?O?;A1{coWFg->S9 zdh3>nEeF4V7xD`Ug5Gt_b*wy+3DMMci~`|tmQ$kh1tLaK4Tj@_>%ePBTy|%Y(ck6@@YEvMktRIx8rH;~5CQ@3Jn zuM2IK)NrscJ%KTaGeke(3%I4&<7*v?M|Nn;3QnXt5Nz0ae5`-hLI%&j#aVOZ_+^}= z*no}daADZA-9vxEu=j7lGA71E#!kksyy?Zug_??5qw#y3FSbu}5_Q8`xCE35+G*bSQ890~)bjngiX|a9VR! z@?f@N2MF0bF-V8g@UX|$J)?@9m9<7G2x`XZ^kHiFM%fC{0u+X;78rZ^}=91kyV1i8L&cG-X+-g1Gy&Sn>t z?>rb{(%RUpi?%#}Y=e{+l4BfHcMmO{)tKo|l1h(0Ej4G8V+$QKX&ry}hrj62k38`N zAV;1NWNDyfIB(p!NqDGiY^S|W8FlN>ZJh|d|8zIUTM-erI&9&2xNIHdsrzjO4ZO(W z`EHt$qUVVfrc`A+^_l6m3moR3d^oPpKKcHaCmdv7<5sbkj+isc^V8hq9RgmRqnn0= zAcuxL4|@bO65Nqx)*|?1MIatP_up|fJ*2#4KnONw;}7{gIjaso^s(Qh@;Xb zNsFj*^c1Kz?&#CS-L-M5aU^I2Ii55B{BP`oDPG@Egs-)& ziV@DPE?<4zRsUdy?}%jxuPJdSA@L2R0%Pi{MBVpK!46&v-Fmw02_J)fkx9oZrWWLm ztm7xyCQflrtS}s1b|1o&G134wDT>fE(!WkKPhe_rAa`mljUjWLd$+8lYE_1Xe4s(F zQ}Hccc6Gfvscr^{fYoCY3oKQ;@%{%mXggZDnGz`ojk9yj5e`I~^6pv7N^_C3Rf)IVM{9>pgji zt&k&n@2+L>{$8Gd$2gVn^qwQ|B^oS4d5^b;+LoOAfRy8QM2KG3P(c$JI*lG%IJVi? za%XF~*XQSXI+hJzH?(xCAo64s+_DJtZCPYw+Xk@>OE! z{$>Osx_lvkL{#WF0x)ANd!N(<>0^rMt>cqsIpCSCzxMnp-}YP!?c2Qe0kYEsH6(Oz zd>!7;{Y!@i{P-dkfSzp}dryB>vFjXO_%HayVnhYfdzY#ljYzSKM$ooU^u$uKe%e6*|%tvqsU@BH`qd z&Oqa{*2Lnnapf}8L2oiYf7$U0f(Ue<47tQspvNiMm35=O zZGdrp-pFu-kgmO`?i9Yx)Vde; zTv8P$*}4|d{g87m^3C*po)4za-AKv0|8QL*U>g(irs&A!sCySkP~I4+|16ttVr9DL zZLo!ksQUcF(<(!wQ&GXDOi_z9ueiHO?PIn`u=R)2(y8ZD zK1T;12ib_{vH<#-fwRZ+B}ogL5b&-aV!d%0j$WW*+Pdhtzc>DgAAK3>KS>AK@LAR& zbZ3(bZ~-phU;c>LT^ee$^zfsdJ_7EHhikYjBo5`rZfw_OW(0^)gq}kevr9)4gvVC9 z@8F&@-H3sc$#|+Z^nTEI#PJc0=iUB;Hw`B?yG4_q2$!;t!goZ`)$vnS9!y8Tn^L|t z2OrUO%^*6OJjEp~LOTey%(HPJ^LIDs`ey`&l8#DOOPBH-%eM&gmA)Mr%ubH2vA3Q? z05D}4)p3}ac#LTi41sr3T2OR&`nG$zR8NzbQKC|`S}RTtJ+*!0EYdsy_Ugm&B=1cV6_fLycR0P_b6?hji-~ zbc>`|9^O>8+BA>6>D?zf?*oitT44Z~#SES`?98;0gQJQU_qkM-+B;wf@`36j(pUC7 z+saU9ts5huouCj+Iuz_NbD2g!;4=1A*X1n@JJB0cc6IMH=>x6t7it4aXWb@()2#H| zd)hXv7Gy0Wy}vM?N3b$b5_>Lj-A48}v@7-nY%aHL1+uq&RWf8& zY{(n3Usdj3GxlrJ$x#6Ew`JdS4(WN7xpAr0G7_$4|N44`i=OMdniICoLX&E4nsDu% z=;U{>Ht8mD0<-Bt7lF5vA2TF*z6`=LqbqN2s4rkKalv}QlJIT0g3;n{%Jp{gQgf*5 zggvUqVIknSgl!^1wbf)Z*J-}DPE@R#j zH&m71?pw4weoVRNU)18cn-6bWb%b9j%G2}JuzE7DV$MsB%_KtGjrP%0a*K4ut+uTy} zBvYeMg^?Q;b?@4fyy(@K!-|M29XWnT<$qv~M>6LVpYF-xswgeJ1@SES>=^n{nj$Ebhd{dD7m# z&xX*c7)pTzRFxP>c4^<1lImRy*iSzkln{7yh0$Hx3&FJvov z&fb%vH(@T0uk7A*;VEpOtmc`DRgmvqWegIh{bYH`f{hx0s8j4WI_xCo+O|^r$L<6y zv$&D5eJ1gZ`_`ph(E^8C{B^8Y8Klu-U4>1V3KSA)h4aWHeJ)sYr2K02oP|5xD7%Ye z2fL2?z>BPGB%FY^F6wun+Ki0WPPR_?NB=bZbx&Vjynh$i)EoZyKb&X#*O*Ohm@MvG zPujvkm3(zzvUs1}qt1EbKHGAk8RtyLunIFFubGNs{SIDz-5t6;yAeY66gdIqcis%g zIiH+9cXvkGEt?y^PXnYBk*2;3eZz34&siS{6_OS!S;P@zjV}peoIYFJhO-3PHStV6 zVNW1&E5%>P(7$8-+cO+QJMVFRaxLUdxg2igHNGwFGNBEWZ8O;W+8q01q5)=T`r zh9Lk#5MYoBIsY{0&kI}RbB?e6d_>CRN;X1%RBJ|mdkM*B51_&jB~xYIaTp?mnSsZg zDEgV=R0-GaY~Ud?YL{U>Ic|zr|6JLHd38tFCf35x~=1-A|SfpSBf;@J8$Qu1WJ!)1qBL!^YkvSggOX<-fTxh9KqLWzce zWJEqE6lN~o*GfdFFbYQ5#sD{85l&5|Ax5nV1B%J-uL|z z$Db~?Qj-RgX85fS!_Lyo;l(*nD+$+dHQ0y1rbkk?>S)BcvUc!WMpsT?NaR9J7&AlZ z*i|!P&fOkOHgu0_c-V0lArOux4NW&mLkQjexT*RbB2(JvQ^5@bOD@3sYJGUv;S~fj zvz3eF0!A}Y8_`p5WJR1lIJ^t*R&Zj6JYn#@S-bMxT#&V*d-HN8Q}Wx52S}mBRMin` zLTo4dbWm%uEO6!USrya(>Vo5S8_mD->OTVUG#Na87%nb}xJjp%fM$nDP zn(_}y;VaZEH)(h{-wlU_jj%x}?8PB%RQvt?ja=^5k5=EWV-gvUMc125v@WU3KOOl(x;s5taQjuY zplYrsS0GdltimH@u^eAMQT)x_h2U7)Q&(UIj~;A6g%T7W##NNdW~rYMKXeP4k;&H9 zg@nP3U%ZtXkpz28`IogCVVBl3lv*lPjBVP#E0#7SBUrjpu|SUqsKf4iFmYF81Y zC7_3=Yxy0^VCSCr-aQ(Y0=Ctf#g z*-uG3e8}zbAbj9ZLx;zc^U(Al~6%2hfq$u~DPO`x!T){4?qVb8>PUObbM6Y80jXxi0o0+}u!BtceYstlA zef|eXyt)+^ET71G>J)%y*VL{wH$Q2rD0BO!6N~(O z7E<@v!hx)xdvTQYtP1>sxPJcV8UXxF`EKos(vJjUwM;a~ebXY6m3-6)XD>#3`2jgS ziN{75Y&>AX*v?6BM7`fv2fiR}tV8|a#b+I!z#dV4L$~NGo{txncv$^kiTetCqcKYy z|Jtv`?em2DL&f()lMyL0JNE^~4mbceXHK2guHQGP~jX zY`t`nHOOQ?!iEIK*__y74HQqyz}=}QA1CMRr=D<|AEKm9(l*!b_7fp7P(|kafc*}t z{9NJLu9b@ba7NR0YM1H9(*W;Y-UcAo7>AT}J$nJ2X)Bj6mI>v?#rVXu zrgbkn3Z>`s*b8#(vx#l8tim!eQ{wOo`bd-%MO+ukmo8P*Wg}fUj zUOS*QB{B*i5HW?~+=}AIv8$6`Gl0YP=>NfCi=YV9(Z-!#%L8O1+jJXcCH4Ybj|8>E zr8;$9ZZcV5hJ$R^uX-c9KQ9Bg$I^pGDv645k-iwY>8s_64ox->D)nYOu1|Bys@r-l z{#=xR;0c_zRxebYpn+YXo1HGqsn$QS7^<2k#uV8X(3~rAgK%JyH{QUt4Ni5S9^v4K zc=5EMI7nB+(%%u27qge-^fZ5D`^qs4rdZ>*S5>@rXj#RIKQ zjav$j!h-Kk?Ftaq*#dyKLk^U~q1kmRtpd8VTR99RZ<_V9!SMr91Iv^4e<{!}FQx%2 zQ*tK#iG`0Z9sqVKj4QBTxW+K2xzM=oeMeqS1gE69>5IYIr7l(M0C(wi8!Vxtw4Pm= zbc9r)?1arRO~gP^LnJ!M*<)K&aq4N}NpX4ENj=Q?Vq&NZMSZI8>29@&8yfl$VV3bw zfv8N`N=vij5|{0i!D}8SMu7h)1$RGKdUxe5mIhHWQ;8mq6EW_4um z8-Se?Vd7u@w54Ni35b5n&RrK#G6n%u1>9R>q;hQTH#&xsDrYebXd$KrXM!>kH|ppW zMs)8;$fX9$J}CuDMJGkKnofB&Z&8K>mR}~2p;bH0i47q>GE-iqIuQAoG`l*NDTg}c zK&of}e+1jLpekteOn(w=Wg18S z27dgFL^y#oGXAda@p)txMq-MaHCMMhrxni93qM8tWnL4QgDl;?mkQ4l6XUD^_cz+D?ZeqaVF5(T7mtG!po4Stzq;X=wI?%> zk+B`3Y?VmGc5@{-@yj-cXY(7ZuRj`b2JD8O8&_D&vy-zEu5i05_7qcI!#J(vD@~`K zW^!`ILSMX>y%EZ&A`bMfkK`V*i$|xFwR)$?J<3h*Mqb0>E!_S~Xf#JNhzVy`d16jL zAXQymH1}i<*#9bnxj0h ze}(TB=P}Y7GLUE|>;ZJ}>&Z-Re|0?a@Bolaa?;<(rqbf}92Bo;EjnlIjdqj(Pa*cd zb$%}|a*1dIron2qI8oTO=C*;f8!WJ@8`j^}$lJObNI<{Ouiw?I|@gQ z?q7K;Q#rzX1_u5E`<#C28YSp)SHh$0hyXN_V|^76)&obd&Hz*cf!7A8RTPu2r`*(Q zbv{oTqK+Ec^yH=bcDj?+Q4GCMp;}@L;bQAd4Ze>Or-j+i+=ypwQa4y1lIX7?`B^5V{K1MD5%%^nE?ppLuV2 z0w82x%KnZ2w2Sb!oJW(f0mHOtHsQ&gk0(5FTkmUN#!KAhyF%T$Bo?)o zd1keDxZs523{dM9;OQPHFyq$=VS=U#d@H0 zzXhDouN4Y~F6fXWtZvjeOAoS0n*Eq`=#+ zCd)Jw@ZwD5W_`hy16^=!H8~RlKXq*7dz^)Y$vY=K6s>|OwOv;8jY&l6@wK;>n+mFsnioGw*!Pv%7s|{dJ5FpS z3wk;lf$7lF^>G0Z{%TFY`O1C)E-d;pw?M%c?=l>ZLNkt>OIWS2oFu z>%ufZ$9Bf1j8SXx`F`{&eCJ)RRv4}O$Xp(O*jlYQGq1Lx-=9HXS z&H5%PI6%s`L?-VG&53jg*UZ_B=BGDBG%V2dH`-l_I=IwBd@|>9plbgRyZ_g!qz3*?Z0MpE@#y~dc+3h%`e3?0Xn2qRL^;`XSwogzw_;aK*1 zohAb)_+CF0d~IVoi{1ywo=fI+)Ho+@J}?yV=je0F{4JQ4$2TP8} ztQ0PP+WkXd_zCWQ#5zUM#Z7@S2qp`pBaUV>_w&sNwi;GM+v?B$(2R}^4MSz!h}Yo& z%cyaZ4L*mt)%axsx^*wZ6ljzS zz-UDC+cj=b@XGnm54QRFi@~;=v98`O@`sX$mm1u$j%&fll{0~F=w{+|DyWx!T9fOq z58kSA8>^Grx10tN+oR#4wKvP9OIcSC<*lAZbN@8^{70J0QMrJEE3J(q1OQM3TmEjA zH5Mh14d9%i4zJ`ha1=;);gplw8lP$PkDbIpt&?oFh%~-EDeGeWCPUq2rPBL+)SRdO zr2t2-)ToAz@B{pW=-z&%l(@nG(i4*wyU}(vA8-4@#ROTZoeSI<$X)TOiMvX?x1^xm zvZa4odUMK8)nd)e++7%at~zz`jtxb_X9~F>qiGsw%KBxxYkOj4rGkdI3-;9{fC0f4{8Q2c)d0<@+PD*Og&F|FE8Q{4c@Qelbk8qiMH!*8fw2x z_XgqLXc>*Ti!S2X`iYExmlm{5FO+yLzgb6iAMVCPy3-z&Y=58`sE7OV>~QOCnnY3w zb(EhWp>j#>BZ95xR~y)*A5IJeEO%9EMnTyNw%$b%l(b4Ea&itBKdXE9J!x`zbMr5K zr$i|Q6f^XP-vJC84mS@o`Mx$E*qGtMkF20r#EN`)n_`&g?Q0$OShcvTmCF@iW zJ{UO1z&XB^T;y{~eJj!bigW&xXilOz%?PSrbT}MYyx(@w-5CqTN7?J~!j2*xnm%iZ zV`iR2JLJGV?~tYQ*&|BI5vVO)h@m!bgsLs(78S_t92dGgqSN+^}wanf=gb$VoME;7en| zQ3H%x)$%PIRWQoe0UlZ0m|%Tpdqg(p4N=%T?`5O`1)xHzR{39Y|Gk`;wYtc+=XU`B zgoGv1Hka|Nxyuzi?cLoh^!=}{y?q?>X}ZfWo~N)YfQyVEWpd_e-AlxaquTnCjHQ)i z#mlEc>-_QtGydL7Tp@PJaNlmiVL}&bcQxXy_0|6RP zk8#LNNd9>?hErpgBEA|3Cg$Em@V5axCnlV=q8GN!?e%>Obg&XS+9COmXx6%3pRZV-N$~SPNA%#=^|YRuH!m7&}CGz zjAZRuFF#+7-X-H-QqAwm_&sW`HjFUB-5+~KY=XxC#Rm_N#Yjh{B^&t(R_}N;_$W`+ zMko8>Ncu;all9k|PvRWs#PZ15f2n2w8+$xtJ@{y*C!n+P4PAPd*weICImqp;yDt65e&yw2o>D4POHR9c$BO=$(urhGa-w9CX)~>gmxeT=D zn%_fLBQ5=IYboNdtf+$9P;bI942;1$(@3f(ZT#oimJ|5a<4^0@&uNtZsMDvZsB#yx zH202L-?QH~;9=S>M|(1YPgRvAR##k>vgS@n2irpKyIA_qzap(9_yE|gu#Vumg!kDYue5F6_xY5L)KSw)izyyqvA z$S|E{w`0ZSYC<(N=9uSj-U*tyJ%inZxH8CBYgoQ6sr!-rNipxJv~X zUjAt?{4ZpZ_mzgg_KxElLC^GlilB=Qi=fsH3w1(~wRJ>HEU4KM=URUo%B1V1Pp-3y zo&ebA<5jh$;4e!n>57l_1Xi%81u_j(hNzBTzIBRph?ekTM^)kq#wD&0CHh6rf6{x` z6N*-mj7}liS{Occt8CbcWZmvykfJwuLt^4>%%Jg>WSS<_=Go(stWg|0eB?^A$&MDa z&bQ-<1UtE{xNiA?6H2^sUHO7Pv$OSaug1pQfw+Mmh5ZjHvlqkwuco#GWsahe8Gg4k({GyZRP4Wh{eX zWH59KD{)6G)Iv-I@CL#QKTY5E*5}s*{huQZ|AjIR@FPNiJYooT_5E>JC!Fr(*v@xi zmk8PD?8kC{sS)IS#bO3<#71c|<|SsKk=C>}uQP87#Lgx(kPXHCy{JHQSSE)SCj(UNTa2unhsagukE znZipn4ZjAc{!*dV5vWe#v~Kq@2l7D_PnWTBw&$y4jOHq7?l5IfHb;kJ%5#?BDKUOW zLIF3mf9e0c^n3v>TW`@?CF95Xw9_w1cmn1ISHRp59q!{BS3WB3t5MMT!_z6YND~bn z=c>)-$r?MbSTu?*7G`kj+W%rwXQxbZw)!~aZXm;PgrM)Bc zi>8nXho*KW6xr42PED#VOFT?qjh%O+LU`2QtQ{-BZC(@$T?KZH9)`A?WwM{)euZgp zeb3QeCC0MXaKjF9o;uI-%rBVcnKlQe62S74&pr$k1rW^DQ6BIe_KMYuRIVW#xoo?) zM8sYMk=NfK2rsd<7@FyU z2bjeS)g(>eD|cE{6uUH5vSr24CHMq$R2ln>bzdu%h861*u85PJcC-6Cf+HExwal2V zecP=uI!(UKWooins-peco=n=1J48M>&92D>ASP2t+!jT4Tv{=@t0sU^361_II@fQr z<<&c-)Q-ZMOdbbJ9>D;?$Z zf6A;Zxv_UUPs^IdTwyD2yvL{NAm^znEw;IRU_}t&fpcuxDGWIHexZQ=qn-Rg zqYpm@5~BkjZu;48Df})v02^g*C5VHo%jv*k)|XR3gx^-8V>5XYh=X+bCUfn9J>8B_ zS=slFJX-r9Y4JE?8Mc)zYS_MQ1Alhl0Rw(wrPI8P0P}N&?wyP;!LeweN7mnfnWL|= zm(zdL?hQ9a0vTDcRNuQ(3}GW2v>frZJ{T?NW13x+%aol4SHjlL=PoNv)V&A@Ywk}a|Tz>$ifSMDGleiul@*?^+@0vS(F*)vhGv!9u;1c07eKJ*hyu}K1<|l*TKO3 zVEG-I9x6wcUF8Gicm7qcJe5I|!d|2E{| zH-_6|@p0vp-sOI?ll&FRp}l}lJ#vq^ z_@RiY-oB#!21&ETXl1*Ta8Wd&dX#*P8xe8CIie(eGLdfS+_LPaweRMzJ>PYAc$DV% zQ2OlCN}Nl}!$quRT>+NC$4hjOT(2I!Cui-H*K`2pd^%pQzT8}DJXqUQo)Jcl{CL$> ztS2EM_O_Kzf8tkQj4p0s7O)E_B(EeWdd9p+teia%Wy!V-Vn3GLI+_p406YRG)~=2x z0T`Kw0VDGepYpv?VXfzoGwr@Z?nK46*y}ImYFlvZ73BdCZD*aJ)_WyI2NY+NwPnO&IVmst;dAXEkz)&=++(G>>$A8`3dpTSe=wjS#3QrP3@-dT8 zX1q1E=ZT5}advXKbT5wi2*4mG*SSV2HQ6(~%cc=G(B2&+*igXBl1WAoE?nNL(I@?w zQ@j0;Mxqz+vJ@?L6HeC>KfnvBxp@hu8^z2Nwo=1cHKdBJmB(9EF-}D&n=!1a2*1U3 z_qMZ+21{~(>;wAYdvI|qK-8Um+6ST#*tkrN@yD%8)z{Vv|;E{mhnXG(6w$5$=#<&`Fg-aXZ=Ks0UR5yY-Qrg?@p`HIFuh%zw>fJd5Saf zf+7)}X=2=lo9^q-;Lq|+vKZ^#$6!Fje+tkXfQav-5eD%l9YkuyKIgEnap4c-4P=L; zgH0o~gd2Viiyzzo(~$zhv^Mw3=AzOME$n}`&gU`wEB+I_V0PcCnIYMbF4j)g!Gx{# z7Y85jkpY*`+8{A=A6mBklve5}lQd~@&z?d=uX=~*eOFr4p zhymjR>b8gUqdBiIV~^wn^L}*78D>Y=lvkqATSD+9+0wrRtm8=cdx#+)kncMF33YE? z#0=>#Pk3PsA%XqAxzKtx68YQm1PlwjxoF{%k2N%_q<)>HqQtN|Bk7#`(`LOs$Za>@ zU$yY=gRM%544SEm)K}-`xaFq{@13W<8gr`8(Y0ySGCj(O;e~9N-NKPxj$Zj&%$?6Z z6?4@&CRl$pX4^MnHBvd=CKM&9ksy@qw#K)P>IS9z;4VIcT>k@b*(l_lx@`XA_7p86 z)PayXJ%=0reT!ZO6#gOh2j4X7J4cZ-<3i3EI+Tn*<6Z7L*lAtc;R(QavufDS$}_b6 z7YY5@j{`2WE}#yK%+hd_Xq>0>atZBY5Jt$gQvD(1R;38ciJ*4)p5eibl07ij7%7t% ztz3k=TG+)PZ1A0jC5ntqoV5@fYR^^E;iba`vf7SSVY3g8dk+)A^*-Jv9cZ${xtUcD z@}izg-`@wuF{I6shK{uH)cNRNrMv1panm=vTR65BD|8jc#EY^Q8xdvrR_h%HG3l@L ze)v6fGm?(wX1qrg28HDXJKHo^Lj>?|;pS$lAzdG}V#%CokI%FjFYrzxpq3t6pNs}H zZS5V}`jnty{d~WV`}0rn?^!jc0`U*GG2Kmtx-+`u;3QdpI!|^t8p8o58>gPFQ~L${ zwh{XqT!NDtYM-@yNl-IC8Rzq`YemMK#RGtd8$3ik_rC8M^t)xlD}-HlO3$Uih?p8t2xsKE?`F`kcC+x%IVLu<)_ z<^i9MjuBLtOfEh!Dx7)api)*+y-T{sO^xFI#UIzZM9n$(Ehgu1W!|J{o*x{ub=E6& zE+Y~XtqLF(ECsH=xgbQAKm@e6|J3`U-Vwh2f)V=?$xp>Tx^e1)?)Mc=U$)%;O~_rX z60PBbKK{AwfG}Z#&d6_X&LZ^OM<=FdMe~%S&Y{ll6Tm#R)xm8eLpqp1HgK~-3ulXC zj*aU10pL7qfhpK6Se9BpYa&XD&w5}JTxcO98MAdi%YYVW%JsF|M)YT{Rh9M2)K{$i zcG+rKveuJ3acDJKOzg{SWF_b*L;>qgHDKLIj4S4s7mO}0&wUK^9^DW7ZgD`KHu1|n zWW)4PWgd`dPWhkGuE~cu3pS&=JlU09fN$bTbe;2q>jxVETvHgpHAOP~UDqYVwdsyP zn_gJBd2&(^?h&q&+2ts+tXNJ&)4#7@8I$x;nVZQ51M05k4t2yz7l$QQDb~*i_g-GC zCrTM%6M$$4!HoCoiia`*eU}Zt;C`{7%aBd!i=5eeu^mSfbs*VmtV`Df92*}_`k`?c z32J>8kG-ox3+%8&rT~gYw);bpWK$iVb$%e9H6G-qFBeG^r#OiDK4n&2yPXhEz{MX< z)-Q*J*?2%|50h}W^oOEwK5mjcwTy(iH~;hzYU6v!NpaJbZ3I|G$K15YE#W$vJhC6S z(-f%b>F!WN0NVH7)~hT%Ga&yK)a>$k9c@MtNrCSUJ5Kowp^xbd=)9l52z&!aAG~FC zyQ{8m+ZKzY`Qw~^O`^?t5vgS(4fA?yP4?P2PT@5#s4IK-Hgx!jXrZz3gTce^m zJ}N4=UePk^FiS)ne|m1+%6>qVE|pYS+J1$JpyvhZt#FscR27TQ9c^25%flpS4(=0zFRbT__0$;AhWe$MZn zo7^U|m8iBRih1^x7J^S;^0IsfhjcAYC=faL5wJMJH1z?dONnxQcVpp+SWyNIi`_@e z?9RvsHZ3hu=BrbGGRxQSz5h8?@bf$Wn|0$X1uCA__E#et$`Aj*_0}EztQk}T%YJi0 z3~TJ(eV-O=(YLS^X=e9APhO*+9mnk;x-cM0h!evwn3J=kd%_or{ST5CjQRi_M;0&P zUF`4@fy9R_c@0{A+TEVJ1YwLRoHy%z4igf!yKm4L!}XqNDFy08J0;OTUy4fHlA;Fs z(^pYf^c~*I;(R(a=s4`!M`Y)?9n)IKJJnt&3<4HPY=Lqi*h=kHKewCyH`aCj3N^r#x^(d0TuyJbHdI^tz{(e zfdNK!{y}N2len?17BMizOEqG$wAgu;{;j0?pM~jcrP{<^7Bz01;JNzA_xE{hYCgfp zk<+i(G|O{iKFvQL7L)5%zz&4RuRA9R3-m$KM9?{07U_HWr9qrEHsgV&J0ygE-D`%o zd?T!9PiSAV0Byd}m=j`6{f-#6z&bp-vNuKd>KcibK#B#E$75-UWYfsCr!yD+{h*!i z%Rj5o1ux^s>_cCW_7ul*m=X~hv!Fx2$bDlngm-)ErN;`ZGl)`-Gm2OO9^5wGJhFJ}w?iGKe1 zy??)&(@(W6&ra5)vP~5375%0Z2uDf>2{ZoU2t`nMp|^aP-KV+R1mSV7eu$;&tFJ5i zhh;Hf;sO9BrcmtaDw+};>M{o(lMrWv#<>%L7oN8)Eeuk+URrwR3QQH0rSma{y{Ncb zT=fzl@BA8`@%6BO1a%~^m93jpzSN}G`bb7FS9XM2xZiDweKe>L_^4G#_>zIh`V5oOU9HjKTcfE6PhJ|*Yu(iOj=7S}`R$gw5FQ|Aa7r&mXr@>ITcYRFW7m2% zV0Dw{vlpb{eZ}+iS${sAsSfDu*3&qe(A8&Mf6tpD2Z%AZ4s<7w&3#G%-~U$<>i2n2 zFh;PBE$GA73gb*`%&;tp)ahuj%h7}hZ1-zFf<9XAR=^vtZ`ny6)$;0G*;MPyMm#b# zdDmGNX|b*SbaP?`5LOe(%!Hx^%xc_H20iq|?*qUx3j!8Y`<3Dyyj)TY1X0QgHv|IB z!AYF8KKR%FDS!eu5)#?B>|>aT;2pqiI>Ned)#G;Br~t{L=9%>$EgS?}*bL+6jPd_u z>pFp<0f0|5RZ77%(&fzXmh94b4#YgDxhR5t7QemOx!qX04j47frHZbV@Xpj1>taaP zYF9}AoD1K5wSmNpvILP;KH-z#1t3YJ+XU9<&hA~GZegkIHg>>oc#?4+sLl@_4I1&j zjZd@-!@14M&~SRY!6PQ`9|Khuv4nKVj2gMXAXOQ`{1sg1rH<-}f*Vw@?}Qf6mazk* z&jvv%3`O9z`}5*~|4SJDX5E$SQlD*VjznBkNGobgx~y(fd^(jq8PM$k+f{eBg$yus znNe}xH_VN>6kjPlO>w)FtwgV<#%~L8O?mMo#N7zW!ogJx+eUrHf7TjG zbes0q+0p@n*DhtY6xB?2;t&deD}JS^6bA^0_O?Gb2b+93FyI-l|T&+=l~wB6|whQVpFJDzgDQ9DnQt9SUy=vt`d8Dt9|#i)+_fJCC^yx~-L+6Wz)Yn}0VCVbOfHM} zG1F3JEl1N&-*j`zp-;?wya3T?(Q-7>@@04Bv10GD5MbPDPB9)d)(Ovt@#h2UP%T=REY_TK|j;2E_K#H-SiP}CdBehy0o zWO`>Rrjs76ytM2=a^w%o+UEqlcbH5!2~HB{nM<&$jzWdvNxD2gL;m-K4yJtC_snl& zOv$79vA|Yf2}FM{&|TNUw06A;|C^$E2JOBRuU9QPsgF<#Sn`swu&=T(!48X~7Ovfd zL6<+Rl;T;Pa7!7|VXCSLD=EU{K}$0l>`b--{&-rP1RLg@=IlIc3k_UFvn>=K|3$=d!LzW(p; zg0>~mI}qT>c?^uq7%{dt2vgvY`5$0(Nuk_*)nU8xW9g=&(7*!{(2EX?ENPMS|Izm5 zfl%&k-1sTQ36n(4SRzLnTZT{wlO$O}Swh+OWNWb-Nl2EdEKwM;FGUm*#=h@DvK#xp zFT?PDZ!PDX_c`Zz&++_z|H>ckzW4XKuj{j2ti%+q{T<#;nD=_V(#5B0nJN>fu|d_q z5wgUTGm2}?NT2o$6;tApN`45Lc=>9;Yo%lunv2bJaF#SyQcp3Jn71`SVk2|0*XqA{ zL3b1!9{7GwJNy+bEzZu$`DT6^+27~Qe{vtbJ+g=TzC75Xm+GAv2Wm1{#Y*@)N93>G zHJLyz8-Fh~ey{6)zEAEBm8#~DZF-Cpy)t@Kw; z5s{L65+iXHxUF{(@a0QHuxakI>{Z9|qGOamtdUv6wRAQhv|8%6mpy&ey|h#Ba72rx za*=udc(gqojT$3!uG=bX-1fXh9Owj86NdzgDIQGtIQY;W`y|Rhu@fefV($P;xA!uR zjd9-(L^a9E)%XAToAskwc>q}^^f9@EG@94GbKcvdfoWJE#fNF6bbIbYwuRjn@?M!z zlcW<@dB|O}y-q`T7V(A+d}o+Fy1(@dENu?QM~p$;yXk&xSrsAgF|R`8CK_m^Jb!C; zBxGqxZ}ciwE9Z}X&+l1?PaNerRu!x3IPG3rhk=|8Zk>!M5gmc3#pT2=o#rAy)TV%Y zp?RK*uLW4`EKEyN3^1id5Tg2HH_f7R_2p{JK5v$;Q zI?Yp?T?+kz+T(x%H4rm#y@K$QY7DsdH&o+gNgUf)kiCp&oWYKujj?gZ>M5-N9OR@w zF^wXBW*S!^rcrjTnIHc)(fYg5^RGLYzy4{_yi9Z#Ki24Zp)Z`VH`qEFxICSiSNKAG zRuN8DuXPwzbfiE=&m{fcU$z?5Nlg@a?GP`Fl~*Liyw)ar^sWMO4Su#GEwdeHe%?}4 zBy>B`$HU^}ko0~!^^2Zy$6f=LAshZQA#=z`0DUWWU2b4|b^FVzl7m|!!wZ2sn9g(RorM-Mhko5e;_ zn;!B8m+i-`?BRD6GsDZ%0ttAFC|1(55YU;qD@qGJye2Pkkf2t67~)8FqN2Z(+rB!y zxu|rreXm64Go>Pr906ux9p>@S`(<7w9&deHL%IdX@=NwGj!>O0{NYjkaY6pcn-(2e z)DR;LA8IHcR2Mlm3Q3&t0);F-Jy}-gq|C-^EH3xP>4KP%vMGqP!+nB zkA~NtP;le#{c`=?DJ9k8U4H+>(W&hez4(xmSDnjixeO*Bq6m%Q^?}I$+lc$lb!%9} zb?-+87L${55Z!wX(7lu#9sj&s|NiKQKx{K7c|;7jKoP}aU9XRjx%>yacgKabZR^R7 zRa$7}Llm$|Tf6efkd`luBlqr?-BFV zx%YZ1&Mn?OguQaSh3vq%{1M?5sbT}22;^I@+E&Z4#MrG0x=GTJWrtJgjjfofLwah0 zm#Sq#$}DQC(?Ecikch3zkPO#>8UfH+14YyPiQn(khC_LWRw3mfcn!547KDGuOO|4! z;$CZO1F8Q3U$TGy;oWmU=ui@3uf)_?^VNtyrRz@plc^mk`u z$x~K`QN+SZxYFlbhdK1EWmSh)8kAFfU;r{h+akKPyT4@ND+-gNKlN2i3q3p&XJr25 zmMA%gLza@=Z{elB(kvo?P`UREIsZ%iC!jdP=zvTNO4Pgo@Y4v-#rU6z7asw}h$LW) zNCL(PjibJ(N6M_`Q9$4W5>* zb|&~`otZ!Rog~Y*D=ZZM{P7Wo|2zLP6WM9cL_YtrN# zFJIv`;X{3fU>sUk`{{K4ch3W+A+Kl0q)pnCuk8Ju0J|mh-lwDm7C$-j8c6(A*z9Ed z$Ork^5RY#NQCD^dHKuByLELYAzsjY`m8e>#*7~l<%VLz)X}`3@Q9P4b7F3 z)nNL>W>sQmFkVGBKudFKo-rttoSd^VGX!G2*YomPp6ZT%{D!AC0*T-!*ru)Y0Gx0b z_v)Ak&pFpMe%W1}(&gx9(Dm}lvYSz*CIe(n&Ib*{ssx5Wt;iGwniIE&PEc3ghbd@h z51h3Mx9$$rwpbK{h6Ncee!j%?L+^QK8Ie6j(*fh-j}p)SPHMS{ z>iIu0S|^vi*H3Z>?gkH0L4ud9kve>t!!j^-4}xHt;|xeR@dPJbgmtw7NNvg{2sQFd zUD4_-Ov{XvPiPJ;;YMD_lo~&Kw6({^NSl#O!cHaSPs8b9Y}h+`tlW*1x3f0_O;{l# zc>+@lo8I6%4hYqjS*^|9(0Z{$PAxML2qO62JemfeV*G;!@UIKnU;cFEjK>oL$phuj zp9xUk>phPZa6}>=-8JH{%R1R6(DvHHo8;(PP4npy2XC~p{F_RDZ0kpXu^NS=Gv_Bqwhj?1m&2Dd)f{P|u+*+Cz}RsFz8O%sBhIZ;TL;a2L3I#{GJry&kSgzMd;`sy0b1FIwzMo-W17RI3Av zTSO5zG{V{LWiMKiWuvAP z4Uk~*rsBpf#s_d zig>VZV&5$gHdETKgU&okpf(X<6!E;DE#uS8sXSpS&6lML(L(XqTkd~h#&h)Vq5{m2 zX4i|#w56=5Q5pA$3lV_f%0ZsF$ZjS76IlpE?jQ>yS35uy#kG(WE#NQc^d&|7N9tY$ z0JBX#v$zV?Ez<9jzXSUpFl{rge2mO@3AT=`$36~RDGgY(lR~8Tekp{VZBkv!Z-!W* zCz6Zv`Lp?b&S(zmeskcVsDP8|LNJc!5!XhS8;O*|alEL|cjDajkWU24)G9l`5s!1! zL?CCvN47H^thMeCE+6GR6%+p!mZZG8l@k~8`S^M5eyIohq)rE`nxqK2mCoDdGF?c< zy$TydP~y=##ePOBA(u2|#FOS8ccJ?ZsViyd-K5G;XkQ-%cvc9+u`m5day zY1V0^aHi1G3~H7~u^iKZv8BZG=Z6YNBpGxDxEmU<>B)}!tb0DB0Sr>A5CwctG#+J7 zr#uk}yLK%hNL{DD+LvBRJedY~@1lU;ryy+JsE6@$<95LCEAe%>WETtSp+Q|y! zP|b2}h9S4M2#shASn^!AvjW#g&Vjz31IG<7s4hG)6H)Sh>Ms8 z^QQ90&S}GbYa4E9^elzj6BouPsD$idV&d*ImC8gUFz^L?&y1(1;6;4tP6zB~r4Kum z-ug~r~K0-tL@!t%HKYrKayuO>k)^uW^eK+=br-*dvdDAKz{BgXtWgj^y6XT!5 zN%|~6SiRMzA{6HxbdC|WPG6C!q7q_q7W00KXiU`KEV8|!NV6h~)@O@Sy`1^V@tOr^ z0u!_ePCl8yucXe)R``187EgFMN7QGZb(P^HCHwh8AABz^BV4a;t$dAnM;VJOPr`xp zi&-w7aAcq}WDv359T|o#nx|S^wvKr2FYC!(G4N(#FR9j%IIY0c-Qj(Z$c5viK>_k; zElT#tz16Xi3m3koJvT)g$aPn^(WVz-D7%#K)1?u_7EAZ4i$@2g0!Z&1GWw~NZzsKr zj49@Rc~ivu=KZ?0Lfy1}Q_215q!PkZ`NXT6qV@w$^N;#~gU%T=d8>vMIlyF-Uf$^U zat%HL_%Iu;>Lny=Ze?UlgH z2}o~D3&Rg^MMw>*_mPI(ygt}Dzd?Wcbu(2x^bzuQeQ2efQk1Ha;aNLbzrA{^N88)> zo6Hw4S?k5cWV!?wR$UT@$|UQm`-kG<6nkt;t3Xsl72lu~352vv?HI7qr-m$*#gp_v zEa@dEmNX*R-Rv-KX;z6e+jKbV`Te0ES4k#mH`CN{kCPq*_()Kz-SR1K4|7eL_1C4L zj?Fx%nzKClZcn}2%bKH~ymLx@hx;W3hx8zxbM#&l zR~jGx$S{UT%6OBw2` z_lX`HI93ouQ`s~{MtSxc9kOR(z+^27@`5Ct1NHkZ)vh=rmwkbHVSQbsmjI$@1H92e z*i2u^8UGNJRonq1e|+Hj7o2(1&`@;QF&*8{dZ|WEzn;}B(G2|%hR@0I40`3Z1dLW2 ztum}j4sTc|kW};0*KE5n^A|FwgW9GR!U@7vF-~`SRF2~0sQi7&MZD?Dt_R=r)2$Ak ze_WlpCjT|F=tk_K$uQdC1+H|{_!eXP9oIv7AY7zhv_M;(5@Cv zg!ANvE8kwb$PQ0M1$y#SqUOu#X8NTKIQREP-;?DYwCiDPSoby*L0V71!49)fVu`EY z?*h<&Gv0pQ*A5?1Knwe^%=tXeOK&b>P{N$MRO(~iWCI}b)rF_wc`jekn}H16T6YUJ zEIL@DmQa)@{Xgj;YQ~|d1b;4NW;7ZX$U=`uMi+2S{!1Yl+V0x zJ+7{(k+VVS*SwRn97tK^ie^2Hoj3-vN1KD+`7^LyP1y$CFk`jxz~wSIfw{#+-`w;x zMfnvsFtrcF?WWvi$o8*!trzs9e;f+FNeVRRZ|dJVb-NZ893aHDYIY6Q1mo8OhKhPK+bnD^LkwDJQ_L3i2064it*F4R3 zQ4ygMzCpp7UVj>CvlgK>X5ouOo=Q7jdC=Yw9`Um4IeK4qztnjHUbnVCp8DFM)ev0P zrZ|UEjpDY9vl11|4Wej2!goccN$j1ZTKwQq5U8*%aDa8r^SKz8lFB9i_cXT*%xOd~ zzu-wmw8orm1gB6^~Aa$?Fp{KX$}fJjAo_`UnKr;%&Hq!SHeybTh0=}iE3VX* z7Ts0Z3mp{q(-khq3Y^OuyyrIq9H(16M)OQc+&L|oXHi=pS9L)L0r}r3pluD4u7ECez1a60)@g_D~nDryit-IOT^eQZQlwp$w_zF z5D^K-B#lM)2h~#HSDb5Cvt@g-fV+*m5XUA`q*2#;HCC!6;}PgoQ|*{l!*xZu2(*Hx z^WpE+1VPy0D=1>L(ef);eu(0eB+ydT3R_&yg;Od`4Etw!VC|cR`HQOx zrJG}?e&&AtgU{`ck}}tL(sr|Cla`e^D2*Lsx%RZ+JS%MaKJ!Z93!g@y8MxLVK)`Yz zoYjFHNrUyzc25E;o9tvFf3W0}Fru`KIz&TF3u)OeYrC6Wz96K^7^YZi?;NIhmz|Y6 zHyLuW`CqGf@H{FW`b5>ffmkRxs7dbATO{%qiMQ+Cr| zchXzULr_ft}cC&kx$aD-EaqQsdeEv=b1uI z%gII1AAB$6n%3vOxn7yBhrj%0H^uOK?`L-=Gji?CKxtQ10prZ1$dpcK4s0#1VpMLE zHh^5sKS?6q;{&=x$}JnaD)Y!FllX4#%!Yy&0UscoDRCvprfPlAi*>Ehel zjV+Ois%mmvY&y(H7F8uv;rY0u@VuiJ4PxcFK+Yzo`e_+gnd%SB$|o=RB9}qDs<%7xnB!fg3n8+syy{x}8O1XT}yUUbljChQy^Z7XTnM3!UKyLcc-i){W`8h2G4Vv5fn;e)+7UuOV z5M!VNv+S@sx7ARO`pq>Pmw#Rq%Bgi`@~KtN3}pUF716cy14}LoYxF#R>X#md{|cN|C*vkvg^U7_10$u2ErX zpUmaYsN9R*CRKj~i*_v5wEnAa?ypOU2aCtB*SfhaO+|H%N92od)H*w%xruoC zmiJV%UH<1D!S`68c4cfakr9l7^=vUuA$69*A%U!b*8@k` zM>U+TZl(7RmGM8Z$x4hfjas9P$2_N-g%~UUf~U%?oU%Q!uc!`Kh;o@{Vb$EHbFrX@ z|AguOh&ec66Q#K-TRa+qNshermh)rMb4NwU{23(g8Pvs&k!Mf|G~k*)!qHIzZP!+Y z3d(X))a(<`VbC8}s-Z?>eP1~vaUb!Abkqv@`(y}@{=I_t{9Xp=(DXBU1>a|Fnc~?k zR)rbQlvdk}nuDtUSdXcs7Ct=A)5W3`OLGtZAT^7=a3luU|M-N`0=k~Fp=U4#jvpGA zqALnow^hNWXNgmk;(WQ9m`qj?#hjyOqo&e3&mLi3?dn!yH)lU4?VwgG!1=Muxf1e# zHQWTel~!I=kmH4MYu(Q3K7~O+`2jFEHpDqSpfOp3EMQ7cuA=7wZS^h3vtboU4VvKJ z2*}-_OvHT+c>cb|4|OLJhbCO8$$ZEi{HMoeg>tXME_t3*Qloz326hrVJ6--*e7Hih z!WTdj!ae6cb^uFP77TyOEbrrVGw~Jj!t*U6iP;LfDD*VmXpGt?EoD&ij)1Z_C?Wk9 zL~oxw=7MAl6Ad(S)(*Y^ z{KDqtr4idr$oUA3WmQdOS&+V4jL96XR~;ozOpA5e=+KfXmx4f6V*uURCBqNzoLdeu z!$Wn&=MMriPfO9G7T68nQQ>JtRFdl01B?L3;!@8uldx+kv}4sxLe)wC^ydA`0=W*L zi>zk&kSG4g_5`^?bRa2&D#@rKoeLS{<=Ccq-0QW0)dzpaIIx#h)Jcg8cAX8%*tg7{V{Mx0vS#;NGmrq@@(M?NBVQx!ZU_BI1K@@b3l#FNDld%}8x7-2<-v)DHH5Z$QD z3{~kVC*N~V49+Rt)iao_TG+}oJQva(8(H#%j;&LL7*Gywh@t{}9P*(2eQH|0t9OJ0 zjksHRkS5}W6}*Md&!o;w$wDkuenRBt<`h#iTh#cmJ{+&kW=T^wh0y)JNk+2m+~-^i z-2<@(TV(Jl+FdX__&pwrs5(~R0z2S+vO$>SXft->_v1%vHN*W&Ufq)&?UP`Iz3R$) zkvN<~SfZ=dcg|oX7Up;zl~Q_Lq`k49peIp9JmZXS*V(u`5|@VJ4&xG009{|MCQSW^ z{EPr(bXMkuDOqC!R4BV2Gt~$vLQi^XC$Id^-Jg*HQmLk{3H8h7C1`s3xjpT#KRbW@ zQ*a`En5|74TY2(S3n5AJQfC$a=OCY%e6IXK=b87j$L7|$wa+ehFi!R@<=9kJuKG!K z0cuHN%xoN`_TJjBR<&yGZA+sBNgebNtuzFR{kWS-?H6$4*fa{#(U8xNq!qW%#`{%1 zJC}{LE-9UX2AuGivw|2C0h5p$`6lnommQghRdp33b}=6Vdb9W>N%|( zaj%wwPnJlk#JO)0m;FBPsuCPFKb*T&;(AB&EvAuQh3WI8h~~nJ7emd)OAtCi>ep|5 z7jX4{>M)9aYL(U=zBM9Nn3(#cUj=PxKp)JtHN!pG71qOuZWfcp($LbfO`j@cpxh-ZaJr@O_?Y)xJLqPO|cwCRQSRRAZ9~#B{KkGt?bI5M$sEd zdfyvNz!*pt@;Bz}PBDf(FH~m~F=c77uTQ~ogSkQFuq>HbMuYvm5gDgzIUqx_H~xE* zXKVkh$6P z4NE{;=~WEOi2_TLPlX>uTA}oAZ&RWGY4vsN6D||`dDL>VZ8fzo4@XTV!pP{&vMG&D zZJ~ibV!QvweViv)FjM@Lk(1iXJycM^hJ!GH1h9<{(2U4d`bw2G(m16qb5^=g3HP9s zmu&aex_8o@OyZz+?)^Kb0HA~sWOZg}TkK&0aabPS?;=IG+T2z)2vm!<*MCGE{A0Ke z)blUwbJL@Z+vJr)wPT1-86S%^z-w(EIjSFa(?2PF*h+e%*CVG)ClhV&UVbTW!~!SmOs=rhQ5@S?o2m>Z#ZF?oP8w7l9J2xG7+O6GUl-)I z8|G%~Ul;PD6?)uuQ3TzOdQ76~Y?!eI(FVELqcb^D1wxW6ofpu~9L*0Hxfwq%$ZQJ4 z60=BZ@C&SnyS`MgBX7D8e1k&uwlPbk5{DZt)ZOh4BaIoUBsuwS=q4JuqzR|7O9G@K zv`{qEQ7K(*0US@Lt}j3}zlx_DZ-KN&@bNT~n9nslulz)vm0iqE72m7(tIFm8)uIhO z=HDF6kKfhz`F4{gyOfUw6rWq4!F~P4M5PBz`+2y1XfK2jO-Klvt54nw;~V=}l|&sYgVrBIVY|jgqc#R5tK`L#h3H#hfCT1@|7?dyh}jIsYQ7LjDC02ke?j;N+-7$D-4Ayt(C-+_52%YW%Ixay=(qNU*+w-@L_neCfKf* z#K5W-=Cj+89vo0dr=2_q*$zbbxTAbevpZQi17fLcW0%5B1(iEw;?hp_y?E-}OJHN%2c@jZPRHtf+X_O=A#Tyj>ZDr`% ze|pE@8HZSy0r(bKXN2LdsrZ^abkNw#;IHqsx;3BigED5OJ9#us*b3#XOsoaPOTw zaRf0a5bv%*2Rb`bSX8IdfO+U!^QZHQqTXx}Llw^qLd#q)b#6FGMu_k1Ln&loYI>Kj z8q#`Nl6skjMc!eFG!XVbLF=y#wwCYMym!RIrt(iT&LyUawjdhz*uYuH3R9v-Xr z=-m2yRB*e^)!b+PBIBXTq&u$1O0jl^;KF6@5<>$QZq~%To&!uxccH0iwJmA;%-q?Q zN1s{e+|T5tGCuKcSCNwyn5w+UYiUpo%mVMPmU+dbY!M&61f*5e{Gu+WB+nyW3X;%< z(QG+Yb#~CavGD!-0w+7VNqT7yr~+h+VNr4}F?#~p_CxdT>+7dM=bH&S-)!Ew_Ays2 z#MhvOpzJegg1TeJ`dACs%zXfW;!q^=-?mo#-Hkji)!)^K+jbFU7nF6*&@}a4DWB6} z`r_ooQlD)$F82y1vHi|s?O@0~u-gkK5GvVqQC%)^CKCsyCy2eWL4Q`(_{m)f{C~<_ z2{Eh=coIv*f8U+=S48&Tk={EEhomS|hmSY7W8L76?Fn*h&fbG&a5+1^lHzV0NZCF_ z;e8*(INl$b<*0q!+eMCi9^%*r7<({QA<))l(EGR`;cN@K!BRfm^VyMKX_QdJK)uzB zcN%x<$Dyi7$0XTYRX*WI=&zYqaGig2ZcPQ4Le6sbJbU7JbHn?t|7e#DZ@@mFb8-D2 zn0oWDN|E(bh#s&iC}V5u$X4xC&?oZt0#EB#e&h`=o(UTJdwJ1x`mGJuPA&zVGV2QL z)vy$#^-2$##jFs21*n4C|Qps21lzE9|A8PeE3jKNKhEWXcypU!ezfVh(lj}8#&uHfqm#lHC&^^t>V$M z?lx-+;%>SS*G?_HuO$923BLPRL{g}0o4zJvt#K>ND+g9dK48BSD_EVbv>^@(Bn zL6>`X+1O5j9LF~Xa%Nrrtee`bkr$lzSJ)}VrDM>aEQ*$H=DpSq?7Z%n@np?E^DLnh zH1jY?S=h6!8armc=a#;+B5bu)@F=zxP%+#03u2_WJn75aBtU}W;vS=OcGn=%>L~yy zN_BSS`@k0E;LzLGCD>TgLc(JTNQ0Y&F_C0H*(N{_>RJx$jLau<=P(-_cEqQN}^}i;1Fu2crU=mHjm8gJ3)RyZL zJ|?m9c|qz^2|ktGB-I025MgCKNXHZ(?0xNsYMBG~M>rJMxbqzr-HB_oD|ZC&#QUu6 zhvI#or)E`okNc@I9>((2N2uwAp%2sz|6PsyyAlCHvfVj7=1Ml*Jv|Q-jQGReV2tJZ(FznFS(G)2cY#j=9p2C6H@4a#opL=;6%>52FY{*a_YhaT-OawrpVSLuE!h7vYV&WkAwS5f z-+y7NbKi`+LE(t6(Q~`O9B-Nr2Kd0z-qnRU26mMEgqZ2()$)OY)R>1K_H3rR0P7Ud zoJ8;4B1^04o|JU!0e^dLD6?;md0@d*V9tFhR+)<B0)*GF7++3`_DiODW^O7_BO1FI)0OS-18 znCIJP+N)NCu7v6YxFl{Trns-hrJZm1lqsR$aQezsj`&9)Me#e3{v?Jd4+6G?E{5EO zbaUD}CaNIqx$w=sDmA~bh6e6f+|vp{o(;OF{? zAJf%8!8E_HAJPrmwy{++bS;|;usc>>q+2OS-d}Kse1zXL6NqEpZfH%?xCJ7<%DFW+ z%Dp6uk5Q)~ChI+|=(}N(Z1q;gRi&wV9B6(>kJ!b!#*jygg;!ow3ej)Yx!tFn7FNNw zHiZbCgXzjqrE5DtP@&%uh`oQm{tS4l3YAf&#QL4qz1DfK&~R*)M``10|18y_ipK6H zep?bySxlvW3{X8yebEyW=BK1HCx6cI<@y_0H8p1hF&A!7*pjI_$dVrNG>UCZ4k0h3UE{qX&TGt>8#V}h6C|T*@wQ>#2)-FtXo@6qpI?& zLrA5U+viHReS&1%3|MaM3MF)bDk31O5-*kVT#kon;| z!L-wesIVmw94$JaxzqVJHuQVpvt=j>HAIv$+~zmTnAwk6r)!kJEo5 zxkcz#=N%2U@WosV5l@=eavAd{MG$GLy1^6!a(MQxx8vFl3s)#6%{9<&G4UReg?ThD z;ojYrUMu!S_jN|ceY_u2LA&RStFWIwUP_=4o{8MTrC=szET%k50;%{yv!>5m3`flp zs<&RcnH{MYy7-?gRc{?qmtq_lJTnp!2~s~AIlatW5n@3Jg-v27M+4-YKsEfyQGwoF zZI@tS_jbuj%$qfrBnF8M(1G>OubpLj@JsegT!5o|$+nk|?vN5n&D$TZ{y?*Ho z{CQ;eB$9Xh_N)1GddY=1E~ghcM?B+nhnpgovg3>|xo921Sn<)ZRwXI7JV%Ba^sFUjHCNT#oBlLR3Nw<84 zw}MFRN9+s)#{0d%SSUtm7?B$TPnB@Fnbbe%>oDg*^|k-B*u}GH$f%C@LGbogWk$;0 z=AE`eel-o;A^(j+ewv>fDgN^%`}-FXkO-@Ieq2OAYNH^vu{Wrq5{9|y(=jfv9uV@8 zq_w~7SODpBt@KqUUITxV&o?Xm^;DHkQq8B-gRSJZ80>EL;!L$-BE%EvORT}nsDG2? z@nMHhxYwOM;kw3kOH|E zIr`yyh_|ZC=)-uhxI6MM`E1WQtt=%yx-lBNhtX*A9Up2U{YZxRBj}{Il5zqW@CiGu z`aoGjHV5&G5En3*DOIwmulWl0sUFG;u_kK5xesNnEE1#h7_dSV6{ckWBYX2&?q zK2NXK^J*)mB*A+EI?p6aojKg>Z^$@TR2Oi<_(2DIb1mfFloh;g>Zy|bvmVJy_im4I z5uUP1)Y1#O3P{Qx0v`G^+DavzFqchScrKndi|e(V zTlokUf>|(ux|YwmZH=Z6o_;(1Rv^K&owhGlo#XQrjxsOrpj4|eJ1utrOz2L=s$RC+ zJCw_+R0nt}0N9EJolH$h3cY#P`Q2VVeilrm^6jbbT3Q>YO^ErxWxlYw=umeEaPLcT zn~zGul)69nRY5H8ZaKvO_=soQLKC!)03_YIQ1nXr2!d#XBHww3R6$ftP@Ywl$qL_2 zJNI!>X5B?BX#$lt(CNk>IFOz7Cd|}@^L>_U(RsHI3Q8ww086dXE&1h;UVhXyd6g9X z$B;dR;M-LrR|oWCpd-Jfmi%(LY_UcO=doz7HH{O_3k$RLOgxYr?L4NlcW&!#y4)thG|7$<+Uuw%~y$Y!nNNSDsiCq zn82K-HmG)CsJ#wb=w~HrgtrfdzKP^uDIDV76e-}vQV z*l0_+(Pi|vDhKE(3>p{v_XL%kR}4f@^=y#ly_|A)`D_4HM{m10akjEDhXA4JYYz!t z--D{4V&8?dVy*{`|s>E-vEl+mbzV&l) z+3y4G{~P|BqhXudq*`RE1kjPI6ici`-YnhLn2rqDE&jBFx7L5#!mxhP$4w{Z9U>O_ zUb$(WWZqL@OPgrnO%;!GA*Oz-=a5yxw082|ZLGwj`(?;f&Xz3=78wql&9Bz{$HCk* z$OtIk=j)5EHD9spc}5)H$SNuPwxM{OI|^_)qwTxwdR#Zw1@rlF>#UaSjvM=({HMkM zXEmJ*-K!isZ&1&l_Dv!+Hn&&6zonQ*=iLbtxYy@`1cIvZER-g1MxZKb$>S*Lc9)43 z;NQ5)?#iR5PDZIQJ{c!x`in6axePcC(Uc&a{Mmu@Rpi#un}6k*0teCxAK8<-8x>{~ z2Xq|E%_1BOSaKEr(i^9!H}t;t7oNG-q`ZF7Y0b+sgQagV>ER4Z&&|u1U#YiDA$fhf za#4f)%oTc{2)OV3)G$rrVJug;<`wZI!TqY7HO*RhYM4gzP|Ic3j%O~4C=FXdTo&vm z;HHjPQ}y{FH%%p%T2%9l3gLo^0n!dC05*zF`H_Jm;XgBl-Ps4XZ0sT4$kC+E+6)O}D8 zcl7A-Agu~H+!v1CTH7M@fzJ}>uJk&59;3kCp;TFu!E)=#!LE$sfuC0KlZ!T|+=J3m9!Mq~BD4N*+ZKG1uI<%)Jo;W0fxPCf zDCx9^{-qV3ODFAlp{Tc`;yA7iYTmRw&9YTRUdHn<8jGt28bB4^k_!si1L!LTgzSCq zAF3Z5OkeU-9)Me~xx7z}2nE>YhsOC2xZ-#&B3 zo2I#lMMHL*V3@=UoAP^hnt^8()*o;e$5b*`Fz!<*uR~4TSSEB`#PJk93&-%M9fmWm zydj;wSq6EkM3=+2AOvRMk)lyCJ)!~#$l@qkW%MEr+xM;cU@psvCkw)w5%Qq+rKR*= z{z}Xh(`~o=?bG9(`}Unv%pqSM>GK;TKi<=HZvAPLDJvAm2QgGchlEXs(G4sb47pEt z)zIqfEvH&!ol~%;k^|1Fvy9}K@X^T^T}~cb%M0^4DAHciS52Y!^#<)#a-X92J!pk|3*2 zbJKY;wZ>}@uPBploPrYfOOHE6l`kx&chq|&ZqvBr3+OM-6{08Meee+*5_j15O*sFm zpyzM^frb0l>VjedT7;8<4U*q8eC;A%S>Vw3FW^j`44aqTk!X58i6Ql1I0N%s0FHTu zZ1E~O=Jf{;2K+<;>HPCFAdTxU7@zv>V5nz|3OCyol<8)KJtc~}f5^M#kWWLL5o+Am z^LgM7Nm^m2XyQB!0{co`GcWi^w!r)#c^~uXIK0ihp4D${N7Ql|iuCQqA$ED=2EEp2 zQh4Y-mI{cO?=VzxGWq^MonHOrlbl0*c5;DQhIJrh1i4Xe%X(e#*j`{yR15F95>d4m zGF2^6RbX$Jbb_?I*=ElmE`ApK`MsIbpE0&XKA)$24MCPl-^-#-TA|3>k&k6?h0_Iq3N9Zz z4&geZ<{xidei3glCa)dHcKw*3E;sTt#9q5VRw{1wEQp%-g+;FUU#p)TmF9?*e*xy( zCm!heWY}gIun&yy7O)&U%&8m3Dp+QJxBd!H#~$$9C^W!HHhnBP>0ofXa?h3S=8_Eb zn0tJt8L{i;Ws$%j&W!eqxUA_#@>M0ag1uCgqHfC@oma>brXHFSks$t(C&k27Z=jg_ zr*%qE=+DL}c*CJ_@Ys_N8Sv4;Qj~*$mjAN8{@@vC{}R2tt)Wks?eDwH|9(XOk6~m- zpyUp4h;`P8Ab(oCum5kgYD17EP-qw*W{n2ZP$uNJuap}tt;#wl*5{Nt3fTmk&b%)t|g-ym=H z4?9&IP&db@LHxZ+o&nW-e#5N4_wo)Zk=H?5W!+x!TEF`AXVU$@Xx=wH5749P+#i)z z>|r23O}1tDp!`=R>b2rIU+f37BIQNDJ!|Z4wwHzC5}YTAleuF)R%{)Bn~FsRI$v4^ zfw0=D#qX8L1h={^-Hv?*>!*P7Z=7ejH1jG)Pc^rFYpK!9R`MfWKov-zo%ap6CNG`* zgbM;K{ho(k{pMw6R?pK1ilqfA<;_jGbL;E1imK?Hsmf$mm0?GzNe%dbI;&g!ihz(G zlv(H3MHETD2Fmo7Uka}SyUyAtk$^C20LUcZE1YgV#Dh_YxZkHT>P_3JF$L8IIa^!5>6M~xmLk$ z3XPP>rfK>bXG4rYJXy#4yH!th-33^7pxBprHeY9@a}aAekY=-xfBSQJ*nitO@HcJy z+}Ym_f&2#9Cz$tW<{)PI&GxyNGgBRQUp91EBwH!||7NHv?*C+{_~yWPWqoDW1n>3% zAPFIjpF>{PGuF%y$XILMNGf?NT@);Fpp z<)JB>KHo|oQc)n)Ny444i>ycmAnK1Wyu5;F?UPuQ1&ae%)QI?&Ljlpj*D4JnQh?1v zrn*hzw4j1`5@6dxV#U6czuK^uUgQse()Wzfs$R78^4tZXpuA> zUyT+9 zO!pUJ=w8ArNDTcHvjZ#D?y5g>*#}Gm47y>JU%rA5mg~7s0XM_yOa2- z8@grwdaa&Y6PU>`@3(O=9u@EfdF__Ayt|NXF|FS~QY)q&tJZj8-pyH{6_RLPjla=O zw<^rAiuZC)+M?W!`QJWS;D}bK-}UG?DD?-QFcW&<{RH7&X>c5|8e8mU)ZZBDBVK?( zj3$`{mvl_2lj7fz+D22;GwgdbAcGjdxkE4udn>8R%1M3cyF#5X+`N`WiNVVA0 zi9Bg5{`?%HuD~7Z`vPf=40Gtg*|@D@ObvXv1HM?Qo8b>Rsv>}zQGGmJg>t0uu{5gz zQ+FR;_F2L!w>t|F*HE7Tm&mym-Q-|oajXle+&5foH^ib!gv^UA{X;7|6k}z^4#hYi z_q%bi(cyy|Ku{!W`sTz;^TCj!_MN!u-}U*SOQ{x7?7z96Iatd-XD^vfJ}Y+c0C@2Y zqRToSKhFzfa94wZw>M`}rxGy+g|1hl3Nxo;G>PX~-)!rwIa7jIM*zb!ZCnBSyEnWB z+9X>&8CR9IY5L{PcQ-@!IKN@!h6hk(+lv2F+lb2UjRs=Z){c#p2wGFyTNsP zJ`q(%rnH-nM6|+jV2<7+U}14+b_Qek8_+iS7$d5viB_KHD(v5Q&&$YB`^!jHLz8Al$0 z89RGG*u3RGDWc+$7o&e<0sP1Owo_1*9StzEjWKsm^Hxz$*HTTVvYqy)b0pF)nxpE%|_b|`8G@Y^3)=DML%Oc<;@(kp8*vCl6GS?aoI$b%pzCTe%nn>5j%6B;a zBMoN{K9JY}UByj`Fqd7J0{gemd90Oe%DyU^Uu&OZ6YTD|v`kwnQFvu3iWn z1N5FoX!@E=l{qHawTLT~c0>U8vJ4w%(x!i%Vo!S$O53;=^aqoc>)hU7`czu(E0NW5 z#nT0{gL-NpJkMYHeo(YLn- z?T6Q@b`?z7xxU5r@)2LDF+LurKt1*wx6t5L-!TA{&zD*4G?OPA2YD>IybcE3;r%v9 zpN*52B+Tz)4UFjoZY@1h7F~mOU}X`$4YVjrfcTmz+ZFM}1P)2Ou*&$$&9BCru~%%E zgAI-gPIaJijQY2EG-Hx+02%1StW4UhW@#W8ioE{prBg&QU zH~SY??7v(qdC|ekIcc>7chXu8D2A7I^Xlys!@fvT z*}j8SkSI;6Ah5J+qWUt?c|fGoy3e8nLBN?4+%5^l-MOPO7|4g$&(L!ZJ@r*j)X#3v z<^6A$dk{9jXo9@n^_Y;k1&Ee{cG<+IgZrxN&=FzfAe1Cq@ZQNQ8tPY1eH>Xb+<#MF zd=oIqUwkj|Y3MOi^ewFIz{4h}uE#TBY%CqGbf04Pckd7^*6O=?9&nYw>?(~k(X=(! z2a!LsNA7Jflb+`CI~(;YiY>ktPww)*X*zq2QF}QW2N1W0h8KxX2XqQj7dVvF-Q7-; z_ygHKW(ACgy|UaqOp=mX&s;y((Xw%YQF3FYhZNXeayP&TrBH1_rqhj5})! z@-u_<)_`f_8@2xp`q;*z3qi{fwyT!I{?{`22>w|9m%^;=^Nv?XULl#IFe6X zs`tYN)WCgQGCVGu}i3^KHLCqw$_~1$- z$dSGZEp-OX@|OYiZI_43IJ?2P2>U>&0Pc2f1E*Hd22@;kfr^XFCCo2S?mH(IEObBL zpEbmG(pBhvq5sQiV&B2p`^UUDHA}ydVj5G1oPQw2oKPlu2IF}!cbgEe@r2%Qj2H*R zh>dRM)^> z2{CsTaiLkFYZBPELYgRy|Loq9#+TjIZqoyakl_^%X(;PLJHQGmOW5RNWsR$G@iu|r zOU(nN2&TkehXCL+jXdG#MjzcvAu~I{GE2arkPH!GxM9%r?^^u{CRQJ%nv7@zb5O!D z0xH(aAWX2Lzu=)Yu4_rPU5}~Di59IfMYTZF-7#{ZB&379OYES6SQn)yF&h117Lj3&-T+poLla!BRX5OlCV-Bwtc?!-7FsB;eab zUKUraxpA5gvqYmLcQAmwsef~tlYG_u%Qhq%jM*vKRzrt$n`kEIC9vFMGtKp0kKSu> z)MKuZ6!gj_g|8txUMBRd7$~`Mxr>B2DlOI-cQ=1wMZ%8WOtidhHfAhLGxt%mxE}0I zE@Ei%YonRVhn%T*A3dGX?C@jg16XX~Q8en-ARO{><|ORqSu$kxH%eR!7=2CBW7RJH5W zcDLWNc0HAMR#lq-Xfb2spDBVS%N<@Uir;-&OETYlTBO`nj*`K8mKlL=DK<)=$)U3)wI8>nczOHdI6?Y;1x#V!=>SqDuYC5 z$U>xvp(#C45fM;8Iw~L?q&Mk7Wr0eU4pOCwG(n^ZM5IZP(0dUA(m^1B5J>XQ8`s*; z+57D0>}Rvj`*r>Nu;T5UbBu9~>wk5h!z8-UDnJMzRcUk6n7`Q-7=5KIwFRC7^2#i8 zO4Kz3ak_USL<2aedsm^ebRwS6uIa z?Eq~FrillsIj@O##UWP~^$pRo7K>5jBIvWI{p3d(+~^7U>~ArNLDsZjYu~8glCJ81 z6}!~nE6)VV^0dF5-}hq?(>qu-MR+hV&-FS zvqmIb{0Et9+QNG}Cl$XtOS4&F^zmP0&ieSRk_G2} zjdw|P-R_f+rhJkZ59^3{=o0qt<5RwKse?|JAuz}|E^kg^M_w=2i{(You9Nx27k{%} zrRLW}CmtVI0501wx6=)N55AS2h_tvN8+e=E_4m=2diGo0Fkrp{a4>{goe~3>(0dLw z(R?k}+O1#s#Bse^O1((BR=@tNuk}%R$a+PC#O*t;COhVS;~g&v_k7T+y3Vp;J5FTE zpx%M*xdYwV`}drjn#yBHG65a!U!qn(x2P(@zNw4kkY+D?yxJ;8Wnj5Gl8tS+AB@s~ zVK_Tt#0h{>veWi?j)70PAxoThA<0`ZP)rTX9%P3#nlqh3pORj`8V#BlRhr-DO4{JY31+-Ph?RiqQgU$&~JTy<4pq#tEkw>Hlcrq2@=w?Dl8 zvE#Px`R=Ti=li6;T~z-MzN$M^k3H?lM14yZ7}Dr8Gsi&6cc?swI-qL;lm|Zf#;#I) z21-CZ;I6xhvR*&pC!$McA~i@QN@V+GPoXK08k&6B4mW|-YJz4pFhhRk+<2->pZL8L zxjuD44%DNLs2#oh0>!lLtrCw@lP~s-R;O?6D%Kb_yJ;;%XuVwPhBj_Fv0&M_S)#`} z5`ry(DZEs8-tFS#(`pbXYradV+C+3;)oR{XwRi|H;M=L6Vf**VJf9J%pTXwz&9$a3 z`dCo~p?t@lFf!P;rP>>*G-4YNo#|D-@A%H`B3<~(HDLlPb~l_!?9(IQgF87%3%b~g z1{K|pp_L{N_wo&k$!kPhE6WRvB|*l(Da;D#14R7zx*p*Z5dw11I*sI}0Nb0a+j+s< z|2Iv`m)xUuGqJB}DIQSM0v8+~!n~I}bme_R-hr4gP zGQRl#v#7PSMd=+%;zv9MQ^V^X`$gWHgB5vykwoiUU2yV2lsI zz*5lD5sm+mx(Ok?Ir|{S`rWh3)8G6)rJl6=(a18W)e&5%XHvh5<`tN_h-x0!yvY0UQ$O>Zu&LeM#T1NePbSsT%Q&?mbYU{r%r_|^tPiMn4 z#nm88V4t=lSc}vsB$(Xi$ANb*<`VN+V^}>VIXlibMWq#a+wS ziQXQTy682MKys9MI8|3XqYUkhTnD@c`__`wML(F;{hTSYy@2(2JP%ZfHYj9QILAmcCS(Uv&^*gxGX^7XMcv04d97EK_GrU+U6E>>;vsPayi!_pao3w2>f}(%wi-hMfZEo zD>qSgA{q{~%O6GkJI?uOw+U~KBj@w`UNO&!UdrqeIyx~gqpn%!*Ts3UX31B_g7L;I7x6Oe{*}FpUM5s?AUsW$|@L?FPOkrl6EuQ z8jeFF^4C<@AAzpj!`r-PVwwb22(I!Mzm_xE*aUe^KgSsZO<%;M_W&GN66aAF&^M75 zBFcmBMk{3QBLSHk2#-E9H1D0Hkj;bSD{92M{q5Iix39n{hc4NGW`E-Ip&{M<9}zmxT*+lLNAV3yYpc2Oapb! zxTXFfQ4h~R!CR;Pt2k$a(3EP3kK8p9GrfA{@~2g~<}-098e{bgu4eGXY|T)uAkhkJ zfEGnBT!TEC)IZOkTeZIX-MPMLBbxa6Y1@w&_|P3_uW1Z6SeGB>MtfK1EW~JgB*dBs zx$nQ>MZieYZ_534C!>t3T+1aDDv}XcnLJLDHQe-tRvuH z@dnR7Z+zLys6T5ab&svlV`CB#D|-P5aUvCs>L7YIF1(dHzU0{>wzh5Li zIVyOhoo2KCs|G<4l{aV!-y(Qy|B+P0Z~$^%SHoJld&SHlS&k?kZPUAq#T1dhhy|-~bEmF>rKn#6IU|-m|^?bZ>xRuLT%( zWU)3%o!(SdM$0KKd!t=(6e-N}$qBB%(nP{feJo~3ZE>J-1L$IgjudSxxrq?Qa(rly)IdTiV zz<)K$>i@f+DBOpG4E}C?Jd+QSTKbSzqfUe?EPjFayLshaSWOh!)ji?)(~)$eme=s8 zmB-Pmy@iSjf&4`tj_$ZY+?OpC)egpA_AAQ&J^PjI(qu@WIboZkl&Mq4vtY@hho#Z?sYA4A_Jc4nXCI5Dd9 zOMBwPAnR|pumMz{OX(THZGUt5`HHvaZNIDR3sA>Yei{ED{w4@|c>(y|l}^VM1uU-T zB^3fARwr)z`GjOM{^_68Q=h_Zu*Ui5Koi#w$AJ4~6IEZunVgZ&=911U+6fq^-Q6zVPXl(;=!p z9y--Qd%REn#oLm&2{n4PA9ZhM{=y0@3lhg&{jo~A)5^kZa>GMc6|~*8KE4vK8flsI zoo?`*x6m$z!nE0CSov@v>#foN8?4rV{+E~8smRad5|8rX*wL@$c63v*e$)>O`%}p= za#7v_KaVOuIdtsV%-t%X<^Bm3-}7P=NmKgO&kI5veky00;0 zszs?Jz1v%!3EC@VsPO=UD<*U_Y-Ss?ojb-%fdibG?TuvxR~?2Vf*WpUqp z-XJ@vnvLM;-EpI3o032ME>NbDuJGj=sEt&TO z@@-8+%YwkOptsL|sQE5-VU9AJLlZE=m}i&+kUP77B$m63NCPklgX95+hTF9w2w6c) zNNh%}!$ZJfTHTGk{MWMOw z`|)J8(dxAij~5E+h%3t#0XZJG`}?QE$BXABH=n8&e_64u1$(xdt_K0FY+v}fzO%C( zPvLsywt5hT<<`wMk+SD;FsgXb-;@>h&NN+^w~-m?l2D{RSoJ?r^SpRGeg51r797Wd&{i(6@q*pF+Fq6GsdBh=+&w= z_QbsJms4o-x^F3nj^*}W40&=fVZLjAM*UGbX%o)H7!_4?#zndSw{oJtT zNk5c<n#))feDj>$UDw_dQ`)YfGr`F_(yE{XlKa#&#$UO0(1*?9vxVN43U zHFCjOs{s2*9b2Q8xZAqaNk=Hz`e@&XQbAxOtG@F9cZzZR_L3N#k|rmN$Z~4zkg@c3EB$@V^I#ppm z4C~CFVOSNhlgxW^zZ=D{B8yMxxi`(VZ~@bu{DA_x%b?Vax)j@_dTBrq25($+kgsnV ze;)YTzaLwzJR(wrzPW7*7cW!#6Is{Ps#uGI$9-AP&$;M)*r4WOJE5i`;tgr}Jp81P zJb&btvMaE1CH8RT0;QjC_nY7nuyQ%>Te<#(@au$|J<8To3ue4|Dfx@WI{~w1br3TW z==q?<<3a-g+Cno1`BAoPNa2Ib*+M?I7^i`}mG(NWZ_Klz&1$fY=w&K@{yc&^h8+4d z_ApAqchLB2Zd&ygvulG2$7o6t>rc!P@4W&^?W$-~SMHKHbt=j@HdUihYuS)^NdC&L z49^Q7v_~IK73&>reWogh8Es$Gyxq&8FqZrC;brGsz%sIZ5v8l5voDIL#&m?9@>qPm zqhV3pL%H;FH#Q!#Bk+ECW}8-AN4|azvO1yV545gOb_{}_uPf*hBR)}W4W~!=dyCDO zVHHPbQ6?8yr81*}Ouwq1wIgH{`}viJOh1F_EJej)d%RxA#oKzg2_(H*4ws-bKYnH- z1_0f646}=%?g-jJn=+~Lmzwq+c zeTcq~nE&}t4vWPxe#3H{y!=tQKJ-+XWf-LV=QF)^)ESM#ka{xsDa4|zD&8iQ&vRxGc_vvAqsbJSH6zt z?vL)X>+4tYxK$SZiidHt2ir5A8c?c_Pi&FC`j{><;-_nz=UvNi(xLCrnPc!cP(5-5 zf}vNqs*Bst&9pPK(pXwa200ofDecm(C}od{sUyy-1`WJ#yMhgVdUjF*U?L^3;MR9` zNy<^5Zt5~J&tv4QeQB`lD)RCoG7T~C5 zuT>qyWc`{Ek6+qEA-q~E3Rz6}C}cZ+Dx5;RVG&nWle6_L5gUtd#&x{sbSx%^`scCp zy0eOt-d>=1lw6a4_u8W5VuX92bj3F}1+GGW!2)NO{9+4f(x^61d;CJ?vJHIYED61L zEtpn(`0+1!tSw+5FSSw~LIMPMD+R>#bf3^E4TMTcnf;Yd=m@$O_b@HJ91UJiUE`cq zOq|-Lan@1)xdVAHT-6UW(6Wb06GvGAW8_zTkv~0Ot_pCtL75?mLL95GX#PD^g)NDF zXdwc*sIs_?RZ@W2V_$7EGZn?dxEnsH_-|X^_4ji5nD)5dMmo^BaAkI(tbgMo7<+SK z^|tOeOStjU(P_gY^?IU;`cg0n_W&T6^T!9lG6HYE_;4^QqIk~3{3Z@^ei>zt{^yTf zK3_Y}5jy(@`0i|7Q(fr)##dD&765(3d<^HmS7BuKELF5#X&vg%@Eo7tM~V zJ$DCrT1?-16g#8)wFeuXVqWaV9M``ymS>)QFaF?eY8+ z!$SD;J^0jIU)0k{SVxQ~rf&~%@q#TBh#(045U%XIZ?dm+ScHb}VW{=LhL_ z81UEfsta4+v+_w2^4PHkom`wJ20!}Y&x)TWwJ9PbZY0|j+!>8Sh}`;w67erF}8 zq9^CRO{>12#N_$FseI2I;l$z~Y%e!#{LxWRYPF&|xpirr#LfNWlf3X|} zx>c5jZaG7*`ONiZJ~oPc!V;Co;>}Hhs$9f?@db6NNgc{Yx;wDW_;#K-Dpg?U;sF&J zWavuPU*S=+vr}y!?d`V*e^&lv6t?1BdiS6MTlr*+gN~uh<5)P@*&Tcpq|4-#!662< zJG`r1uYgHAn?v>+7*M|6=~7i)2;b4|!0X1x&v`l5_096>sO|l4JaPA*n@{f zi20h$hC5HEnamo7##E&xodTg+D8>AswYOQKa9s4D`nWJiPn>@CmYrG>%;~yq@3URV zvY!rWb|O4SzHBK2#OHfSOdv1O4pCK;&WOdB$<)pve7+c`LCaW`{VJ-qbFc`&&#(MAEa^S?AV= z^vCw+u$T`ju;yWX939;`TQy>ra`@5@SSpAN1Bn3%u`pT#xr*D77TQ!8ZA+qk1x$ zP8PEAT^_9B@He2Fe#IyRn7|5C(6JF}iED{ncLNx_OGso-3nM-5Na9(|YBOsI@X|ktw)6-ht zb1~Jfx;LU#5!+agpNBKk>Yw?ikkTJ_!Tic&fPvi1arVfcHGM3`G`OSScg{W#d1z5g z|5#MZfRrZtJ_E)YLA$X070Wyg^w!$6-wy%_M>-yP&HO{OfRE=16>+qA`T+_r+1o-kK33})=u(YjbN`5cC0i#bnBgFJ zu2Z5@xcp?U#fnXwg?C}dP43}ikr z2+LCVA1(XW*-Wh+;Hd>w8pp?D;wPCITg5sePxv7Tddo)@iA#68n}2c7NUO zvAFC{xv)|VYgTb&x`%}J6*U0>H{Op)XgM_q#U!jkpGT)y^YYTm7Qn_ugQ+hxeEN@G zn=7ymbokJ)F{|c-X)C99z-%VcE8kYNXT0<@AB7qFFN0=SJXE;MYdR=6uxA=T0Eg{;{^EO z<_14+SYV$T@t2q4zMB&=-UK}Ruy73}rZ~|HBfg6D)c8QfGk1$kC69k$-;?!j-;+fR zk@1G}-Rixkk>hNA6_c+bSGxB31-{1*s7TluCCoM9{LwTU-9|r_XqT+TzN@PsT95tG zzjonM@=q$zycCZl`tn$Q?$Ujz(0g$HqF@F?@(`G72M=Be`rw&pDW!G%yV+IfRv%V| zCfh%+JmwW%sV@3Tk^(7EL7y_%z5!{?t)68xaTaGX)pzl z-t2w8WE^TG*PG(_0;=%jwhy!;+I7K+{5J)RF8~Rc;4-^;(V~^(ofP7)ksAb6GoSH4 z)vv|B)Gt7@5)M0VH2Qcie`iv-G0uu0un2Opk)@t_X(kd&&$mX~d&?8l$YZ@+#7OXQ zY+f9HiO$N5QTYo|W7ygO^6I|uWG~e?NdYKIb7)#u{Utm;DC+5&eQFyZM1^>M zROFwN`LB+(L#ZgaNh|9)VA*25*YMfv9l#g*1#KxU zrP0jARJ~%sFXlf+h{nd%E*kIXuWz3*_@VU(lk6LDN0*uH&>?nrNSUQ@zZ6mv=G;fH~=w8k>QNSh7Hm%)&pjj81T8#kx;k7*kvFksBZ-naD3JeNZrX5kUK$GKr$v+nf+ z7Y}AMG3w1D^B?9Y!EZyTq|(-~XjLRFQp@$eat+{Z)@?7{$vjo`jXAc9f$5>fr8sxB z4;Qr-vyG=k?N1NLtf!~hu~QbstmF-_@U7;V#$J#Os!QZs-H-nUj{RNsH!6Y<7BtBd zYJb6in+b~S6@XQSwt8I?czzn(iQCi&{};>_Ifcn_n-IzMKqFs3shtG>Iy1%U-m+}C zQuwe8VLF$uwf{YDqsNw3a7k0;4XP9b>Sd`U*(5hCaH-E z{uUQ+1#K&PmB>q0nz^OL^id!+%fpv)(rQRO=TdQ-s&!Y5C1Pj`ua#%8Y%yMqQ`9gY z4r`ejeC#6T3hB??mpmKM?X6}iwaeheI=CRlLSk+rpt&?o0$fC)o`u)}+IsRuh^7ha zp8BPNy|MV3Mz>tWjj+p1B*yiHGD6*xV`$<1rY?8|m!hVJYT8QX+pPSwxAQ<(VNe6Q zid;?~+F?3K)5$EUt}D8|_llsvu8`S4N^j>En{;iq>8@99%Y_m*fNdX`xr+A9Tw29d z@{pN}bI`)d<`#mae43dQ28B+kKRw8O@p(VId{~mzxQuqmWVWdGJo+#b>Y^5U;eiLo ztK;b;vD9X=JnSnfl2<{nxv$W)QawL0{9ynk2h$xN$6W@#=tz8aKho5`1WM8}OR`A( zGf684Bx!wqB>RyoITd$yG+(r;8JP4vehRS5LS`;T_3+G4xjN4;(DF@O&)H2Nd)1td z;70WsnvtM^1ZmQrv@^%0qID3ARpixJsI0(b%}7C#35Y?UoVr>FtafHdhocwVZ5~?e z-MvHAS^OoJkjosW#Zz22@2E+;vguO30%p_bK-4b`~s-rI}dL9TFNp9MmfX=WeC}{V=X#Zs~`e0prATWx1yC|c^0T* z-VLkB6)iUg0cTj=kKG*&1lG3sb7me$L#Vsi>&2ic89sp#%2wHrkImWVzNgoLM3U`&?t5X)RTRtKeOQ-x zXB(G4*sV!E5C?hWC=^@dHy{z<8s*;jp_y5T$7lRAiKh0d`nW6DtYKNdpTs)CL%pyC zEip{b1f4{zSqX3;9NSKXgKI9%!Vj#sflY=}^oy~az{!;*t>0OC`!6S#Wvsi=iNK1O zn+bgM*)sb-M6gBlV~-GD(=i@qH52}RFstN?aTvNTSA>y`b|&t-GSZG5NHUOzz6sr= zxure>kIxxLqlams%N(8oh!|~R^#Tu-F4f-Hyk8&M6mOWj0{amZD^)JbM1ho%zLegA z_Ew0M6&RSo-zX>>(aZ9&Hq2JF|E6oX@4k_PHOIrgil;6FLmQ$r2O6mR98L8%A$2LU(&z?lbwv7GccuCE`_RGR z@u0DS$b@-4RcXTvsjP{jBJl(}h9=6hSS^{K>&1`;UR{y)x6CZLOdn%|r zet6nRj)(0(Y~J>qv)MP==}3p?#TrT5H1SwG0HT)W9pn0fBEc3hu$|G~c}c+0ku2zxh=^l6Li#*bbkU zsHeKC|D~p}<+StmMc4-Z^#ZJxo{?Qzyb|Z)O=UwMp}mu;@whB_i|*$e5=R_q+Yq%R z?zjAk?hQ+wF>Y>MEaj04Y4^dX^v;H2 z^RodOtcf9+l?Tg`>pL zV)4Sz$AuY8&cm*vGa%!zgxkkzh0~U7**ZC(9uIv4fo3XwAb)V z&gggx>YjPt7Vb8Jnon=dDi5fT$Wt0lW${*2SjUB8yYx_-`9oS&!Xb>Ic=hahAsc1A z#ZKqjh2V*1*fe0eM~qrbv;)1&;HGR`NciiW|G4zCO+bKl;hDKpgm$ZXRn6%Rn)>_S z!lo=vMl@p^xLXeqbnx2#4oCf2M z=`_mI*+|0G56E!nAqMn&vwMK&DxCe@P2Z~i^gV!Bn2|HM<1Wu36%Gct;MAogU3N=R ze-x=H6C?Ob5D`dZ0b?8pUsyXb+`s7hb&b((SCtA`ECLPKDh@=xTf6hnHo;#q0urvS zHD9&)I>|ERWy3ixc^vhTmoU}!OR!24jS#KUQ~u^XtrSBjDLZAw#@FkSVPoJUvnh_~ zRlloYV6FR5JF;o?%ZCNb?5qs~;1n8vJaVg;?G{(6j_(Eg5q2`Surt36n9OLk8V-i= zIZp}f5PcUfSL_1|!65x2-9mey%U`k;J)o#F9FjiJuEy{CYiv)=WNBlcgZRg#dD9qT zsaYM4YcGu>379AiD`Z#)jNO&eDfUpD4?+^M?gTxYzs+{s%#l@mA`fgx9c#1r_n)<=lgXb;Oh}(k zB+`Bd-V}Jl?)_EMUUk}nMReFyO;?>UqD~zv3^>X0_40x~g|AnIuArp8`;R|-$!meI zxP1&D(q^(97SrfHh1tvh%8GpAAV8^gBeQs5OQO@r>E!e9tNW5F|@4g9yF@GOZ(NH{07+qPd+N8&+JU&MV*EUsEXC zX2rT@isZG>qLw-P%&o(sWiR_Yg@-4LHV*a~FFv$L84W%@AJFzf-0--1!ygaNIat%? z`p-vu-VPz;eabedcb=}_if+$eXeK;bk>RhrcQ{LrIi{x=@ayhpH{)Z=wC@naEakxA za+wlX*!0~PsW>?a@V!N_q7TgNN?9572@ z`Dv<7qDY+zMA<^7SnX9_FyZ2TZ$%|B~7c*e1>7gLPDf#x9>3H4Ummh7C zNH5H!n)6)i1}xZAK<||RaX{Hsp4#k`lM3Efz0&uMED{|bDVJ5_<52%qHiF5;lCNfF zRzAOuXn!y(*IgHN6{`IW-?X^~c&{(%4c=k4>F zA{4}6-Hzv${sUSReGGr@EKl3QWx;V~0chYsDxr1zyKG7yAK}AQ*f7!8Pzw=7Y$;&F z1itQm++AD^(uudXtBZL%=vG3R*-Qv?sk_qwH*}|ia^R*b`J_y+qHQOuAy}of5MbAs zqC#OKo7VoDOoiUy-8Mlw1-+iQwC7?!LLW%K0xJuCAi4^-50rl}{F0blsg*X<>rtOR z1TGZENU6Us5C7jv$*X~%2Sg$wqM91%fYET~GhL>v^Z57hb@}Zjm%jUMy-KtNw1n(# zKU7*xLFW4nd|L0`IDWe>1*}H+{)!NAeHiaeoO&Zx~`6ePP8qE zs5unjhJRNN2&TzYFJ-YEqFJz5GZwy7EHv-sTeD#AJ}cfx96??qeSHsQljyJH#AVrMwmhPLTepg~|HQa_ru$Rx#n{%goaRuQ{PVy&vpe0CUogEYO2+u$|# z)LVP!+osiLoO&A(npmg2h)S(B>lX~as|aNL3J2GlmCDg= zQ>H!X0VQ+2`)i?>L?2wK^&blL;GODHVx@_ymk(DCn(hy&7wrte;+RMM1DWSH39dW< z?_7EWO?*h(T&ezGu$HD0-a=U`#;agk{bHGcVWZB}e&nV#Ux5Tuhq9=euh^Z(9j*&KqFHNNY$jkm^b3zY zDh+*CL0eki@3HWhOjQm(oKcr`N^#_*VYcjaLyu85#{eVP>g8J)RE<&C+eCoX!h`Zr zT1Chw)wVyLd_@Nh2qpiI>J?;)?_6q0P$8px&&P|mcV6Pmk+Q|ZLq!1NRai_JBOYUSm*irspI$Zauh^=~lKHq$fNfKvp z@y(A(-_PmDkn8K0snMa|vJY2;Znv?e39)_2sLOXAu^oMp;Zrj((z$>2@jzGK%@0T! zV!O6G+OM0z;3Wuv(yZ?MXAN{Z_$-1x?(ai(IO|Ah3K#w~eFXx*i|<y zm4*~X<*_QydKDGgAR0;gS(dm5XoPwSV9>@@<%}4}L1GvfO#d`{9rr9fi7FdGYx?iZ zc;8cdS8N+5q2yN>$9EBGwotzBe>coN1&j^uXCCBaboD&U4;XZSg(q8m|eXwEMggH;gLHXX)e8Q zZ-`7|M~V8bp`_Hg_?2oEqo=mpzp~|KAMqyCqt*QLSF#KiKKN-!<(@#ftvZhD72N49 zCLAXJPrfhNrODN+SN$*Yu4?~R+gFN?#lpQkmST<%Y|}S_Ui?$n7ZM3Z9i0cP5lM(c zhYpd+1vV8qf5EtyQ|#lCtK;lfE+m&ZQnz{3^pY=FsP3J9b}TCL>Tl27Vy#l|esrO+ z@xT3LD~+jok~}v^-X#hXy%Z-K$d@n6;W@8#p#90Dv*rE_Q>m9mF(qYVqyCc}ueQm; zSj0DRfz8J7hGebeZR2ULU0NT?U{e0(dAgPr?nx?DebsUc^md!EzpmRCIX9=SpY>*? z<|^n8pkFAG4YEtGzffYkaK}Y%E2&Z5@VrgwrNq~BjeaT?kAdjd2}hhT>^TgEM1zgd zw+jHxqVs~UJ_r)_t+%+{Nuwg0b1a)<@4-%@2IxAjx7ZqPPX6} zZZeA#&)(hcsPN*>;D}A&x!7cH(Ls18zj=PxY{ZGs%=KemFQauc{ajyE4d*I5{8BmZ ztKhy?HX#zG8(ZXcORk8edq)dsWtRBsaPl5L&m@&0=pdrZ)o9SeaUysHUc6@GywR|m zH8xb|K_Q<I!yh+*LQD{ZZnz{>YS~C}qVU(FFahJ*ld@IU3Hannby;a`p?C`3_1H4MuolCZ zso$V4m8B=fD`#4I9@xhmA^X^U7LvdJX3)-k zGCV5$0~1_sQK#)gn&*ST=sj8IJ;@URNBwxX924e*^Z)%8`|z>llXwz>yh%3F+bTlj zBTA=2XxZ-t;eysvXNLG+a&>=`!*acA33|cz&7skl79TSC>5&l9JUsh1if=UCk-@;B z$+C)Z;Cv2zW7RQrv&@1~p`HVaaw|dmzOlK?4S8>kL@KkA5ZF0swKeK~59vSL)}AK9K2DcR0|fP94d|_U` zhm_Au2i>H=lV7sWH#}+OV3`!BAiHFe>Lyv-BCI9w(|t`{BLf}p(dAv%7@Q@Q)4MU* zK_d&ciyy~-zL?w@k)tNAMOhSO1-x?OPzP$+u@;X>kDcVwD$PV4pqB+2DYp!VAD)lm zfs8p?UScIG`@PJPk%izEs2gAZ&NEgS4{gv|3R0OHqHjOJSR8!;-Pp&@$>-i^g`%1b*A7|hYUS&tL@4gE5p=d3F9Gh$ujRIn=98YbYA zu&79a%kY>5Tlk5HC48&3v;Ti|c!nlKA`nqpjdb5=m+HT!Hoaya;^UFcbNu-{>YcHq z>mPxQPmI|Hx91G#P&OkZONXJCW}mb~zqhnaQDX51j`J>jiYnpiH{SGDU9a9@iTL2@ z*RfHwDlxb|pH40n`)u~3lR5Icb++uVV&a7m)}&JK6!C#&fxg!}jrG>qZ`_(PbvpATOU^JzKRi3|ce0TeK^Q zPl;XWh@E$itM~^p9OHBrsY455=xIUibfeXcJdVrose^k?Ne zE7`G0e~m=1`I+>o=utCW0;U$ELsM^x>ZvA5USX6u508$!CP)z#B>Z2#)gMY735`}g zJ$H;7mWu=}pa*HG6}RTkwxR)tm1J1$cs9r#SlSr|L&Ve#t4jQa;bAGm(aK@O82rhmsoMOEXsJVFn!~C?vuVgR z4j*&X00-7$(%KMa%Xur+6OnE7dM%xtNiTAqA!kZToHl28C2Gu1g?jk{r#2Ob94B>V zEXcyR{}P0d=b+Cf>Vux<`A(O6u^7`X;6tN$ChPq6@H;D;o6(sEs<=+QJ@q2U%i)ZJ z0H5e7M#LLn{Ics~V818XMcqPL`^n{3fqf;-|3ywUc{^>gZ(li^IcNAT%hG6i+xnig zb|}@jrcI3dbU)<&>cpjb(FgaBbGDK7IvJH(3LW)_y<jfzftH5nP!r?NHhR5vE19at z@XltvKFrynerEbwZ6dn+s+*VAwn5d)&2LPckRM7OA>8ak@;z1D##q;-xVMf$On}jj z>DWQ~&X8l~K|B4C_;V*Y;_lEfoPk_=p-cQ!TVkDbD-pMwI8NuY)j7+EGa$EqrU3ZhjBP<9yWua+w>JY z;MyqoEwy3oAHaUp&>56jUkA;s5ZhJbFm+;l^G{EO-R93} zc60h~vR1|MrMnjle@xZ(N%SSnon1#w^x5!y+xY#9D{V*Qd81t`dWqL_o<4Fnd9(qL z?TtShFg~@IrqK0TD}Hd}o@;e@w>x!JdK#Wh@tD!$(UmTDxbxL}3mVnt5L0C^%iJ`! zQVW&9V7UEgPP=t3(qFyKZx_Gb%l^aX+9&lR|918ClbP{F&`#mgl-DDCL`^uml7&7n z4FT-v1fqE&4lcvBsUgAkK$PTgnGM@u6prK1ON_@0tB~DpCENHssRY1+g2V~gmc!iz z*Cy0IfxGcTRok{svzaSbhu+GQw$_>w&r@m2s+cTZdKI>~7i-$UDrCxQ~zx6#F%^11^31!SAwK&HC)ARtZoNcCiFIoscOz5!_hl5F~ zJPz)uAIZL{BD%Mf(%QHAhbFqVI~pEPCtV)1c4D>OO~!OMX%uGN4{KF4`1QpY1S#k_ zBPe=Qo@)jbLQess`hNA{vBByyMXTArskOdF8dCb?kio;nS(3HW=~|+ z{8q|{uI`BMWZG(Ou_dod6o<8>u%Rcm$l&+3ds<$FJ4lTpT~dAE5giogpdt|CrTU;> zN|`y0kvdx_?ghB=7ga1%|4ZLE1^Pxt8O_wv=%~Z{`0T03SBMiAQF_7D%By)POawcjw(H`mDeQZ1_zA(6^52UXI9x>TUQCT zR>7-9ZzOIr@+?Tb?r871Rb8s;QlbXNCbA%C*;g3q!I(c4BaibV)@$^qLUu${RTIPK z3KMYJ2;?3%$m{cgTtyPcKu=&Cwv_$KFZlKF#QLG<=c`^a)1l4>ZNURbpcdIHF$*$g zWAC%Jri+zzCw#d!f$*zvd;g)+tUctn-Dv6eNA%{7-=8zXdzpP*$BB-LWsCmc1=k6= z;1tuTZ)|YuGS}4eJ|77~4+^z9+FhsBEJ&VvM2g3cb!MsbE`YD%n*DozV+shhskRd^ z+)Va-Al=Gr2_`2uq1yib0o6e#=-e@sqSKAo)|gRl64k4hJ$FBRlQZEKg`CW->2;Hc zn-5}A+Y@m2FSBXnosRL;Q=k^7-pdD3*fa(U6`=;G9PJA<&La<{^@iBFKB&n>s8{-R z3?*uM-Cl_AZS-lI=%i{WFPJ*N>gC_MrJH0Yzi_FDaa+Lk1IV3o*^)`iJUky93_j0E z-t8>&hq2Iq1Re>AcUCz`@Z3FE*w1Zr(o>kr`V1Is)R-W#O`d88xin9{oe&|<@8P)x zR6ys9lum4mCmC4!FcH0?eg*laW z>1ol~fJPf&*OUG-QAJ*$`K|H(w{k}=1%cl8D`2{Dj@LO??5bSnoXF9Xmi%37Ugd_K z*fQVnuR6^Ib1I6uVCN^rmq3-i{?_f=@9UK=r`TnjbCKLo53QAc0HnbA_e$UKK|31~ zaFqdIG@@JSe#*|#+lUJ2jbjg34|Bk@R;cDFxrr<3>nBfS^je=VboWoKUc-Yj>^e&7 z^-FfPIRoRbuZ-m^vro6YSnK{qbIc~MtnT?Fa|Ch^zd*P7 zXmw(D=sLzqcV!_cbSMK8w(HR;V9JH8nKJ3}wh;z>IXPDR*sBf>H|qMK~V7b~#nLx20J(e|EEO>XPIs4kYE3j%gJ*boq;cLIp06p_`kgPj*52oT&bfE&>~X(3h95Fs=A6&-t1o2Ed!E2~OQcD` zW>`qP<0njuL9Vtm`RUWnM<(^70)M`HA+deA=6>~!E=4iAt7)fCyi^8EC+lJ#mrLe0 zZ{L_)<{jQD)!@eE8>+SOMeJb%{oxI-ras9&-}%^l_<9trMMu6C`aBHAi#L#qJU?|| z=9Qs^cL9x8?O4Mju-C}Y9QB-x7XyTv*!yD$?}9JPKCoHU|Sv^i3BrQZp~s}`wRAQbtCDYOUpu5DF*DW zKgmz~r&c8`k@^eMfL2>JxoyqWZ87K&hZmL3`&60qK3>abXk|A(99^5_jlYCGeDm%h z4Q9b3K>2s8k;HfNLcx{6Y#>9@uhi(7<>k`XTB_s&EOkVh%`%P)@@XK;3$8#=;W zw0dDKKe^;Jx00_n4xU2Q*!=3xm+V9v6O@RaFVpTg?JE2{`{pz54p8+acn-5wcZ4%E zm8FWjBl@~?mkpu#Q<404!S(1*ZIL~NY?$WCBZS*tSh$*U<=8fa!d*~m_4 z@*+Qd>=UpyV53HVh30<#AD$Ozw_uovV=B(scBPws!g6L|%_+vM%w=)mw~F(^0oEff z0>vqA+eE*Ku(hY8)L5e8!w3aE`Qa2xW`n!L*Mg)t6@YI+$8DtF&mbOoC)~Mwbk;e` zFCICMG^t>MDhFul+>&TS4{8Wladb~T--AcodBhQW8r#Va`gB=$hH*1~>Xu?D7Am}4 z-{`<{4Y;*hpZ|O+_OAv-p)j&4n$aiP47YnI0JZN3?6W+1tAloJ{pvN92P~HQxM7Mh zj+yC;BD$^88(;`)iA*e6&uns93sy~xOSy_8|6%~8#UB*Rq1|k^E`RV2w_OSPro^k} zCY|)@oBDmOE;nOJ5W*f#;>jO{Z zMcxW=9)>N*)k;h|qx#Ioh)C~@MhL@D1VUd#b?wLSWPFmwILd8a{^OHa7)B=H-4LHI z2)@j@@4SsI{d$=f;EMiY+Hl6e!yFs~K3W1NDqqGFU+WjMR?xrj;Ws)L(<#{othSL` zqM%62&2^3p{syT|o!-H$tC(2!MzHkGU{(eng}*p4^nkKzlYm^>akW^sU#ur>tFm-6 zJ+rKLV0inkevQT}Mx_xJlOJQ>gynW~A~|;)BDe3S9XAKlaFLY;4kE!q>+hamA~u9| zn5J=rS7O}9utF~-3|NUoS?6S(_#t2g`PjyECD!c{q#Xuf9PgliIm8_U++!wAtdZo$ zos9g?1{#@@D4T(lwc>E@U2tn$di$UMN$x)+ap;c;r50a{v?BC+8T}bM-TT53^!; zdl+g1`$!v~H{?`QS(zg@Qb~@OGp%}m>>#h4n6?Z2byoCq<5{8W2!qBbQlZvWk0VUe zN$6>SF5H@W6*|!XFckal#)*vn-QJvPYFADiHmy{|gV6sSHoB z5nWthAHpZF%Nj5ohvoR&tBB6xHSFo397V3F4?dX2*;Ck0a;oK{N0fx4fj(0fMA}Gj zgqxsGH;`%^-Yz5=p7yb}wed0e7Z03)~0?cm%QF$|5O?N23VN#t7GF{z*E4f~q|Yl5R( z0ShL&H7q*2JmVqNU79nQTz~hKWJPO@M}6DaoD`S-r;nu8hrAO4^5(;La>xfrblI8e z6U^lT<)NZe{6Iq!%vlkSsGL}xuCu!U?+H1E00E`dr)er$IVP^AWe9v@C(@t7Q1fS} zcWBTPht4|vlD#)Qpv=yx4YuIs`y<(Mpt3Ap0KCQ9Wi<*5$yN8f9dUGhZy6WbS!bSF zV|>cA{9qbJ*4Cj8$vMnG-rezCuO?ZU+xoFeRtN5SyXAeJYrEgt zkg?lI8Io=j^R2zqmcip2EXLG8kMnlN*5)U(_Ny>L<8e1laKcZmu?I)1g8ky4xWcXw97v_7J!q@(%w%xY9uxL+7x0enkDlwib!(az#YWyzS z4-^j)2QjOwcP{o}>)xAm1*|tBn`GE0O%E$NWs2>asa2PY5%NeNy^BiMOk)fE~uxkRYqTyFd^;J)GZ~C&s$3-sNjN-E%H=Bmw0r-+*8?qVf`o?z-eUcC;@n1{2<jC~7vZimw$ZWpYb zG&Z&K7xu@MKZtv2jyonrLkzqim;6zSrjje)U)c2W1^1MaL7nAOc!!wt1?`ykq$ zOGT;i{tC_Ub%3tc;aL%15Xc#P6>tp+;I~T5cVrxmRTZjmvU)aU!?+(t&<`^xCdBkv zpxZcd1nJ1P}y!PFLxIJHSNJeR$GnBR*6wJd@FmESHIBFr6p8h`Z%NK4bD{| zgsr{zsOlUlbsjQ)xGm$No;_N|$<_(q8%DGXzgx1hZq2p9bSteU+DpgbTR3O3M9E0M zr#LH33;SElqDXHA*F??NCKnlv7_Ns!E=>VxG{jUK4Q_rVcCWSRcj>y6*^OBr?a3uR}f zr@ES#;F)rGyExBD>a8$Do4If6_(EjNGt8DH79<)~-K2D^r=_l}oO!(?np<2rQI8C1 znv8A6U1~yCWW{2_h)5)O-k>Rws}oF#04AP#6TwIOGvJ{F+64u#=g@mt_ddC+wVpLa zkM{Xhl|YD@c9J!{!wb9jH!b5;`*V$)y*3D>79K!Z;Qi81`mLWZ*wK>m7 zH#6_xJDFvNw8L&nu*?T2AGNT$_nVY~Kz#EO;n0~CF!Yo5r#I_DcSuKsMrKNFIh$OZ zZ0*AbUtL}=Uq3O1iekPjHC9;TlAABBXr1K6mF%=BlQ4rtP8N6geL52@&#qY%JLTmU z@V&`R^gOdw(B|@)@DFEc&&@qsmE`h#f!&jY{3d09(qINKpeJ^H(VIjVxiV^q8rriQ zXsOTxB|CJ3eBtRY*RK472Qw>CV6>)tAbuT-&-+Mar3G$+3)t9Z;Pt_A#o|o$)?=Eu zVXqKjZ9%i11LG3)6+q3oj2O8X>iT}0TQc$CM6bUXKDJrEwPjyHcKZ?0-fI%95pIGn zazhM&OXPcW2pqIjB~~UQ(3~0E?c%zN$fjt9L3RZCn%$N$0P>mishskApedh_4yOFn z!FH~TT{RS~EqR%%`e%3T-!KYv$&oUmyszvjL-LhapNnF+S|Z#0Z>|6^_$X(Sp7Ey8 z#3^i5#9_uZ4iUIx{*#NAnR=`reQ&H?C?*~{!H)Na7`B}4Vm2$E3^O)W)>E|^7TNwm z(?%M(qLsb-X^hlW2t2~wp35429}E?$?(A1=76Gy`tAO_=+Wn^wkgivnab2M5kwg7i zwY#yh&=g-~aY`$6hNb)ZIHj;ke{t0&JK%$yDp*7NMStSMm|z=ShQ({>^JWr-m>M=Y z*500pE_6k>qC!{edSxBGIph28+IY+bazRN2MsVSR!jd!SE=~h#7oU&59{>xQ4J2TO ziRM*e*4r6k+M4(Yu|I7(+cm}y{G$+2C(M@V@Q)tp;sM2(g*uLLSw_$tKd-P8_5CcrGxgbMI|Ai*^4#z~2(dbL@+i*7&d{c6 zBb4Hvyf~+@z!O5Nm-varZ9tB7QRPcK&CYkQVLyEzC2Y~1H)TBD&5>$OxYGu2_8;z2 zGGGhs5P{XtHTPfxEiUp5DSz)KP0K}wkW!C*IP7_WW~i2zQBB}PrU2J(6a0G+?hKkx zKIq3k-UhJ}Y|G&5J*V>PrI}$99--WYN9WogxC)Gy_|IINUBjpRe$rKqx}Ol{WAiA` zv7iV^MkW2N-I2I)VoWqsEGwvsHoKMsP%(z}@AJH^6y?fZ*THY4HK4~`X`kKTXuHQ1 zE=r?~k>MLExB`HITm1O+D|vbvpu$ugRG1DeOE%BH)rkoN*@)PmBY`XL#3U-xJ<-06 z%l{o$y^UEHliz_@m*+JK!|lGdPRR~wypoC4fJ>``(79IBUlXX4OgCvhV zF8o?lRng>)JdiDthdWkYrGt%Ho7gb+$uFiO63o{8l_bSqs~Y;6Y}159txcHt!B-i< z$Y+s-f=2whF=uUZ_4ZglsZm^Kyo43*U);36@YloDI|iflTI+{Aay4*f+m^RQIVoRFBPeMn;6w zt+#?O{VUd{4hM%X>=1-S3c2O@aTpaEl*3p2o9B-SN36J>Uk!MGKGMfA_?Zhfo3QT1 z?GC0zvS|BzIzRDC{}`#& zpCu!+@Mx6Koikw6PlG!fW!LKN#ch{Oe{aoYp2u(Y)jVAQ3=K3YE^Hq!p=Pl1JXYe1 z+d5LM!fn-?FZw7JvnpmB`YCTYdu}JOC|xA3?~*7Hq%*Cc zL2zBQ!lD@&HcM+N6K(v$6md&^{J}dt%tww^4mZK+W>`E3qS(M3*H=SxGg3vWnFJKk z0;>gNgtZ>n_cz(#otCFMJw0?U#%45m6;$QvSu^iZxj^ue?my|0zsZPY7C?(~mn`3x z%K@kEKGmo0FX?8)wS|3Y<{3#0!ygM!qG*fdTmdz8)vae^Zww{2j>6W#fwPk`*|#Xa zr8;ua$CB|mIC+zn;s`~$dMAc;5@o6CCBak;$jNT9@ye6lH=(EC;DY2BR`uHP_Gu2U zF8=z3@K$G?OW{p3+|6arXfS)h)j!BfGd{cvL>NyzDvX*m)o1q7d2#+36q_;mA=9me z4D_4@OV!$6lz8#Hy$0Vo71@Z$2UPxb=8lN?O$IWsAH{hOrG(w&tm9UwL(vTGgdo*8 zUAw$Rfd<7w^?65WoAC z85`wW%`IP)M)4)X^T|?D@_ao3DvGyEB2BxUi8W z8ioAeHJ5C)+z2-XQa16COUS{NB(jcLD%#58Sa}uqXN)2^`Pg8RPOR z3V-KX;IpUwNRsOm;TDYQY^V@)_qaK(qt3ndqWm`#Lt{8w)p)|;*a##UVER}XHRXk^ zXCtOk6|e}D5Sw`>yH&X_+c+oH6IrVWH0cbY4q!c_P)bJaHycWg4UMhlx6On;90em(9RW}FtW>+3ZEK@nZlyMWk9?kZ28uat zx4J&{Y629vsPFimp8s|XEdh9Gs+ii_e8 zfzusk*TL1%*1$f_9dA>>*!De5`Gf`eHUTaZgyaZw$bXcc=9($3-l6V})h_G37NS&4 zihCF@cJR(K{BnvIto~1c~-H1S$AZPE_0?x2(ysAo1QS9wf1Rb*RmpMdwZ@?T4D5R^Hdz& z0}&wJSwM%33mQX2d#E@sNud!A3x#n@s9BK6B~^izvI$v+)i#VDL{!0wql0KQ;f%U{ z!TUqP(6UoblzPmYuSZExRF_dvR4xEiaua{LYQoP4fwmP)E(7T^P2og1oJn;3oa4FX=qnoztaNfi8^Z44a}# z11j1HXB%EAEX?OTAShcAn+k`V2D^O|TWZio52d6#l-R**jUkYNh0n<<_O=KmD;hWZ z=+f;0A$J3Z;WzmFT5<)M zz73kcwrCr&+wdjCv?5Np+_BTvwypvFo~1vQq{99WnmYB0H{(_K=tSsg0>rA@rN5{d z2P!z7r?%aTMK|ktTWUOttQt@00i6q?HNm}m{jqIDCc_uku@pD_QESy z`|&i=`5dRsCY!bAE&eu@F=r#hQe76I+MmTTIUHyPUQ%fk0aqg-Fyk+0m304dt2>T^ z=MeYpqiVw^t;6yomfLR3*jj%!AsU2MCb)$&yf|*a(NAV`1~pdrp&-9cQgjPh-!e8} z)jIKdwI6R!97F{_taV0hLVCZYxXy!FAXy^7d9#i=f@9%5w#BGQ-`pkC&SE~dar_dr zvxG7+xV>hWx;`ZASMa4JIhk_TmO^VKr*mX&5+9xn0sXR6MOr~Xe+!K4j`Q3mQda7J z+@D_)9LqQ-zo%bs$F`8Gr)k$kOx?PPWYcC<(L!N@tG%l78dqkdEb9AbF50GU+%V8n zRj)xXzuo&xiROaKtdRuB0y7oc8teWAm7ac1h$s|3SD!%-$%cXcVT_yi@oSwRSZz`x zeHb3}O8%qKaY4XIteFW903E{>M*Wac9lO0U8xk(I!RtqtOtF9XkZsVFM(JX6*1_Zs zFw377ot>y(Z1)uTwsbY%)|#k-_*cWs>BaiqvhTpCM2NT_!1F$OAuD7d-Zc+g`TY(o zyJY2V`{4(!iD2v0(;SPmdrLEzEEJPEu&2lQcPHk*v1WTLbUfSG&sCbR{mJ=&eW?>dFlMTYm0Ww2_H;`_Y@wc;qKu3s>)Ti($V$6DB4lWrk7Q1tj` zZF*)xZ;yuaN6P~C?ChS7gLPf zfQ9Cva_d?ffgDS3YhemDciLbSX^P6!hn(dW#yua_{%YTJ_%-(sO09e5x3g@pY=6rv zYg%;J(`(Eeqn^X`8^f}z7rIQdAK*e-_Q~%IwivE8d$t2jp9D*)SdSdjfJZd5m{($H z$2lXxf#(JzJ&|B8T=;=Aoz%j)HJu!jj~^Ho9b0J?D{^5J3_aaY*{)8G?ijEo=$+tNf8t_p0~E)hbv zbOM4X3a@U5alaV?+VxLTVPIa@Nt#h0bLb84`1ko*JgR?5VokA89HzGen#_Q8+rmtS zOX5K5d=KD=znGRN!p$`O3#2c?uL)jzKBcb32v9ACs8{0ao8TS&{-T?mhzzFkSj|_P z`R4V{^rapVvwucQ%9n-?SIyVqPWaqS`eH>Ju9xO1);>X5rD>@OqMvt>w4Su_pC+rf z{`it?<0QNxtmM>;^A5qqQ>uzELjicphA2jdMd_|y^&4_uX=UQi*C^MITX3F?TX+is z{iYrbfxosF2sEj%Gu5r(HpH$>DMSPTOCZRZFOXdxd5Em{ufG;lTijHO-NfR~<5mTd=`wu59rQSvuQ@t^oLcYC+bI;G>zr*f<-c=s_;D@84!(i7(6;^z4OX2bjz4(II} zFJ`=z2Q%PW)zvjBVz+l3{s0H5dgJsv0L>d1NWY1dZpgdVtG}V@2aJ)B9s*Lf$s{Hf zi8GTjGIA+?$YsS)4CF>)J+;ie+F_GdmA9@>1Wu%pNZC7hC-!0zTESy6PB6aeZIy4F z-}7s`etXPjP^ZXvF2~52%v)oiDRNUE%wqWL031nQA*hg(rh`Wny5e6i0e8z@(QZ#= zquwlU?$qyBs_(yfrQ(ytWTa3GbC&aqu^(0x!NIaScOO6k`4)z%1xB%?LSK`Qobhpi zIi#nx%r9E}Ye2M4pzKGPJwqAoF%nARHyO6Iv6WNrwxQ68n&8_I{<3`n`*#*V(Cv}7 zem{5laKMWVSfCf+Rz(5pZ#j7!O@AKX!GGLufVf-HJLIsTQJNuEZ9Mzq*P7hsI<~oN z{`!}UfT~{zHkBPP3cjtxa&8FVFt$!isDSiO`229v35ENk-4l?A3Xs*!$CM!rT)fWr z!(1ksXoNG@=a0|`|KyY9z16MmwF32DIRd7=EnJ?hs`S5d1eS+%*uv`M*k5-%x1PG( z8abr5hVyp;-c8^Fod0H@GJ_s_^sj@a-cWl12+&2j%jR#w$O=(|XQ{}fhMudpxDz%H zmScAq>nGOFuhuQLw9Eo7teHL87BVJ@V!J`@GvlckS=_z^2{V{rcq=n3Cy!Z~rdhYg z4r?io_gKD8G)u9na>KTFz=ikBs4lOY$=EeX>6lv?oihrRL>XHVq^}F=egCWQLO3^& z6x?6^>+#Ovu-?}kjmZal&b0dpp z4ETq`2D&2z<2%<-#J-9M?Jy1HcdqRsZ9x-rPX_RPpdEccc#C7%Bu8z$l{RwDN^Y2& zro9EA7=Q+gYW&-~iR}2F=A=CyY$##+_u^HVO^y98;Y3ytD$S4+h+q`VJd5I{Avp?Jz4bw{-< z$R(++nRQYKDANLr`!aN)Bk61y6;Tt?#3r zsh;FW%-6C}c7ojVU9aao=1f~2G6;wai|6$~gM4A4x9M|_AdE9-`lh8Reu{$^M1EbcQ$D-&{^H_OwhS z=Jo~Q2#Mb#$aOZGo@k9j;c-HsbRshv$j|3=8b8FBn3(vDRO}2-Jh(99IJ0}^P^gFP z()#)YVWPOL4RMz$F9^T~E;-}S?ropyzHvVGJJ><;G6>nhSmOD)kP~i3((50z!vux}LDM@2qy`dRgnn1rJ zgo4Cn&>+c19L=Ccd)0m(e9Js19K5yrc{d2{=$YvkTEp;4@>)slv6}I`a<3~v#u*bD zM=xNkEirpu_?b+Xwud6-7slHuaSKFcHYT3eV$aZNe?Kb5D0?4Y+%#S!_&O3*Xv_C5 zs`>j}o8jJOQpI-(hRd@5bAKK^B7PnanQmP@BIWNi47iR0`M}b2D2XH>g~oOl&PY4P z`E~mNxQdM`8->Tg<6w_g89F+i08~ZlcKZ)SR*L%eXNjo0?hxX^usIH! z??ST#tpD+cvk~-nd=mB^jQ?VY*$|7><~Hv z%aKVahLGSE_&Nv0;QB-6YJxiHF(a|T(TQoh+StT49S|=gfH5Pah>_bnlySVpk&?RJ z0raFeG43qrE(FdAvQ2=cvm+3T~50m@r0vKwd^eX)*J5IU}KW{@avK&b4t^n08@e zxZ<8?i7}2w02u31U7SN?fX1wKxJ`j9!Iqk;V|Um~KP+&+&})J6CQAF5tb(j|Ukw;B z7eCWi_4?H38Sg+DEj0ZxVw`P3CL1Ib;N_>#BC@Memg9_!L@ zyXJxo+uy_)!pV}hTiUJqMgtrkM5}Myd^_FWN8F@~3EP58jPec_`xkZg9{PgvcmTzv zo@HnVwdk`jo~S`Xlgrg~J-8#_eT9G#vGKK#cjdvW7>88y0gJJOqK)uIGQ(Wn`fH?107|xPhXYWWlYTx& zj;U{0E7XtPgx4F^&cuBO^cj~btcf&%U60GsjSpmeCLeAS5Jh88(kpg-pDB(VcfA2N zg)a_cT2EEsJ6o6BWP5$0rAyBb?-6L$+1VJ-T+>4ZWdWLN(7P)mekNg!D-#*jM{#Ql zrbAm*ELA|M8g0&E8^nE+cyEtDOZB#Y=GAFmm4CXGwMYx!f@K z7q`{e_tvzlnA2}zXy(L$?Tt_N4cfLb)`E0d| zj5KvnW%-H!yk=7U1xA(;6?i@>&&Hfy{gVChz+dePr%5x{R#p9^7@P7VSeCAzrO27c zG3`v1rEa&y1(v#4VP$ISQ`!tm73C1tIraGi-7<)!QVvnK5&01!&B@MKSd4RTr;LXc z*IUDc@cOTpfi~QYhtmf4D96p7byf_;2}G(Vyg;x}j(=-LdNjM@KAT1zA$_sMtVdqj zpfMRN3CVv_1#fZwL57hd4=lBblmt46t6GZ~Ujvb2EMH8np*M!^&m)H8cXw1NR~k5A zDP}1cYjUDQNk9+?1Tp{RRE=C`+0p;7JXz_g{o*}@8mIaVvpbvp7*@2N)y#&!UT(4* z(;7ceOGtu|YcBIAaoA*k3=W~QyXgW3v`z1V01(TgyvE*&H3pno^dHCCesOBw^l+fO z^}&A*L+(Em1&OX4OUx9vWvB9*8AiyVOZRBxr9Vwbw}!J?c3I2&+He&e6=w5QXIL*K z$uF}rqz@p0$e0-JW64Fll%6W7H~-BJTk03~)Q~=GQQkEL+?+b`v(S(G3q`OPZbKKj zauF~8{&ARkl{b z+u<|*>vNsyBSX!~yT7j&Y@~Ffk{H5{5=#4BL`{VNe`Isd)(tB4@mVmu$_we>32hfY z%(mj;kXSXKQGz9sscIkFjj)j@As2Ip#=~p;?Vh19)s90XNu0mh&1hCRJ^ryy;%5!XS?hFin#^xzCio5Go z{dEj{zaY%kqF{3q+?il*+P10mWoZ_T+`V{Kex?h3f}x9Y4<62V3`j^EF2~7q^;Bh> z{k}Rzowri|A}N%i^DoO?ILF4$7|vKk+WNWbHH($~dO00f($qOw`D#2Rel$3IPUMf& zDLR3e(X(X!AG{iZhLkeD*a6}TsM-vA&mIPAK4??e;6Nr#w@@>+}VXtapA0T_>ZOygC z1=K?L-cc2l6k-Cl3}S1xKx|DY=5}H;elP8>PxKS80*C$jfgb_j_^2*B@fr zu8Ae75*2GQ$Rl(EH4*$t5f}>BLkX<=rSa!thg(822!c~V0WZV$+%p=oTs+>HI&T)O z71h&?s>NUlK@gC_oD{Z8`|9iN?@=;`s$LGY6pd5E;B>k4obgp#IwCE>R&o!sVmiLV zxr4hC^s=n&bK`FsbYp_(B_aMpnEbwe_(oYm|E$(ASefukGSe@fZIoqaxSyjUS%=>p zTq^ee@N8{uDrZA?>=-g@O18)7)xtb)X9XL9!0#^>+K$9ybPA$hO?y}ojid>TS0{8u zA{3jX%;m6$tCtCZ09&ByM-@V2iNK&p__2>FGnj?47nKr)#RDazLtz>^zb?qRKKSlC zhX^K``nBk`08#GWxqkztV+V-)q+sDG(33kx8~n zTI8DI3koi6vM3jwdi)Zz_n|2GppYtp;6^GGz=Rl;V4>GHk zcy2?xqqIT0ffV5w0f}^*n>#(@DE7~&w$1)M%uC|Veef`2c1uYm-XZJt%bGmIw4<({ zCbFe8*_M5#%#odI{BWr9K^C>AxO&OBhb{M9J%1b8gN`YJWE$P|Ee=wu<_$^Eo>xL$ zdmhk;>|y};>dVORf|4QH50>sye@+X^~?`=Z5C`l^B?r3*A-Xfmn7tYWX zS3!Y#7(MmvuW&0mBiHw#__-%R)zV3Uvf9LQ)wK&ZMLXV`v6)2U3yPgWD4HjTX%|Rw zI`KegB`3BQQnm*i0Mfb=9^VJ@**%xCr8U!y8jstbpYNHXN6hT36wd|=jE~SnQ<8rX zymnWqxa&dG{;fZNAZR+$^Ws?eIVES6O$G`}9%x~(an8ulvF`oCj5?PA zZ^NYmwWB8LkMA?n}*~H4k}Kc89_CxzF_@oRrbL_H4C6vaF|}vY7Dh(sz|)gPp-G7g-tW)utv=P&XW7TX^7=~ z#e6?mPmt4rg^()1CtnphRxc_uQHLD-JSOuP*vCTWQeBo~i$XVM;H9EltJt-pVoWHf zD<7+By9_(pv4d(O7EZh?Fkb_ml?NSu4)!B#kM_K28USA1vA*VUGD(DqcJcja0J12& z;U&M3*j~0P2q?%;?*j=akyA2S3%uc;(PurAJNK7^-0b~y;rRV_nJWCaUu2u^C2+=| z3SYNv9T=G(=0^oKqLy;?pQEL>&0#uDYE9||=ND~H$2NIK=d~BG|@FvR2x;z#fv-Y9%tGk(3;SZb! zcI)QGNi5<$3S=>;LMwWmKq9Qa`#(h$$V0!V?_H9v;9&8l!Dt&lX=C94LSy?E5ZN|- zo0=^f!pp%I+?|{SZnR~k+k`S@1?fRT@YQNduIJEQI37x};%L>v#|3-o==imONot(= zpo^;aq!J5y>Z5-Ag2LU32-{0qa<~YN;-@Qu#<<>rRp;*qn>qG^<#z91y}$$0nQbJU z8)}d+h%LMv`zr#P>B7PqkOq1%T#4m?ymqe|BmbdDFX&dTqHt(oNh;~YUuVo>Yqq@^ z!MeJ}(yy!uij|HBTIu2fLj5@ja&oLaJ?u+CypR-C1b=j58-ZD%n2#C$Py1QLYEqkW zI-HkrySm;4Hw_(XQ4#;)Y5u#U&6HCHWXZ>n!;7{Q^(Pc3)~W zL}{;S%gPv{7&ckVItEa~*GuAg0Vsg6uuYcVPKV8t+i$6Op+(6k?-useRt}G?yeS|U z9>Srv4M>mU0vQ?ETDinm_gtVh`G>|1VCojZ8M8F58X}6|~!>V6a5*!lauQw%s=PoU3v{$!2FB{cLG=WiD!bWXB$y zwO`y@&w6L+YUmfofx1)f3~gfTzVDVi zJiB2NAiCY2Z_Gyew~#=u(10iFMc#FfxIb9=nrRHbT@E*k_R^oIXYquAyK%e91`8st z#@}2C$m|rEseP*K1AJ%#@G$2HdL_DTeF2@)k5HnEP!%x)RaTmokuLZvdLp3lQ2@TJ z%CvFt-whZ*yyHe9#5cV&`WpKHS`f@%i4Q7&7aO6&oIm06~D^tdH#M zwLL>;Qq#xQlReYn!sggyUuTD7Hf*c)7Nf2wx<{)jq`0KratjmBLYb5s4t9wF^nDQ5E*! z&N}B~;QNbwd-02Wt4w7hvYQ&l{O1&a+Nrbom1c@4!$VqZXJ+<-Qg;aaxq3b$ouhEb z*JOk3C8a9+y_)f9@w9Yc=@BhM(60W_OIo`@CMj+drU%pCd(K=7XTb)E!^Vjg&PbTS z@U2%0QzPSdQm^h>S#4NvTLKn9m!~UjH1agrIRr?;`Cb!TSs#l}*=8>Np^iHV31omI z!P&zoJ8JRS)Juxy-MiV+&0Rv7g1;9vY^025k%spQC+_sGNeq82i{}NA6sV9XKJs_R+O~<$Lj7;Hu;Xu2<*VYR4I}p} z6^glj-mR!PS`Hw;Ev>+5CUFn2o!2#*}Ss9dja&mrR^sMmt>^Y$KfO;Y~?uzr4{hVrJA9|Cc{_!qs| z?l|fCl`_TWTTWs5r$r0J5pL+@3T5Bsedrh0BudOfhNmq}O?tA{PbzKZ7Ocl3p)col zEz!nI_7I|UZ zD{69&I~9evQ^;y0nqefq5;DO za+jjmQM^2qAi;K5g%^9@MKJz9cst^FfE^?I`i5wUONN1E-M2}oS_vwN7vs7s1QD;{=sbv zg$}U`?zImtMI}Ws3<@K*Q+RiVCWFp96h${KgdfF zzk+7W3n%~fsQLbf9<>~Btx&ybo1$>=9Sx78(h_9dYbtZz;v&+2a`S^wlzNVL;ZpW8 z68RGtbjaJu-x|pUrD~+YGN*CxS_>Lfp#`3f{o=__)54|%0?eW-W6`nrs|P_8tT1f;4!gm~b&!@yrC%+q?Eg=<+OJ&E zRBD6?`KsXiZ4J-&e2m;_Z1|zTUe1h@zP3=-`A3x@=v-Yt39G)M;`@e+{R~zjLD-(c zxs&c#Wtv}qtO_V8)qtgjQHuQ2)sz7r!5uEVARx<#xx&A~mFfID#`qYBF&_1KGLhGV z-=d&`1>w0DqJh#CBn9%)!MNe)n{vgNNMCb5?zeng z|813H5c18X3O=$XxDg3ZQ^fG)Jpd&D0#JUDZ1-IAcYrirD~`rO2yoo#>nu$M6^hof zy2MhOs$UtukOL*oUbxE{-gBN>zkSI4_a96gAO96z*aXVc@*KzLk3-$!)s?j z=KKUf_dll_JNOp{+9>^R!SNJDdjwn`d6)8 zq$+U3^Vl=#W(z|{{@bcprRTGti3n>W8Ckcas7wDx}9EE^?rp!<7c`*FP14-s&jL zM4*s-fmt_A1)!`Ipw}+MYHXB*5Blt}Yl)mc%-3$^Iweqy-!DFeLZqa#|Lc?0yvX^! zwu9o6QmD;lZBTtHJ}~1K!0&6fFRv}u;>@oq0Zg~{`ZqXvwWpwma=OO_zGYnhHO*7IL>rv=ur9H8j>MwMV>?{>t$rF;!tqMVv~xfeQjEs&-I zu_<o@)91~S|qZuH&{)0ZH<0s|D)EQplYX;|JF{N@a8Coma(4{ri%)d(( zcew#ycoSjygxOA2LOqsbUa1RKwPR5O|EE>$^RCUpQ0I8ji=2DebTP9hqjvHPw-;XA zOAGi@_9*io=MKK)Uq~-l77=$kbcNxkOJ(!Zm;bMe!w+d*r>!qr>ME9-bt^t9o2m56F`?Hevqfn8}9F~0qc^s@`&_5&T^%QdH$Ra9!9 zV(K2yFfcp6vM$jMdnIoFu{?{;(xQg$fKKnsU6US}D)?&OJ9~#j-`*SWY;oB4eSDdz zk+)zzN_^??m}9IwSl~Ok&f@k(z_F>}POWhM9+&jfBX0K)z_2l#Ih_M4WH zYZ(=GSqt+3|EvAC%X!}9GoWTY7wT*xHwe2BazJM~6w{B*V#4R3`?I(IOMXXAW zSrH9p(>C(Xs{CG#a^=qg#!dO6G}Khk;U0epU-*VU6{>LK-Bq7UQ5gAXk9%vl}?T)+E3NcCE7V=VmE z_VI4rzpU?N7PhShj0*}Z$FAz@ec8Tw^Q68{&wz(T=K&s=3RL=#+8>u(l9N~~NMf~G z*hYVaztsZ;^WgOOol-$xi@gv2-tOI`E)X%IQY4ungryJl>S&mOTGvJp!Ui4HVX`4k zsqHB%qg`7%;Q4mrk~BxOTbBvTSBA}p0Vo3{_caO5Re!{dK+iWJBn_m$qPeL7pKAb5 zNC&skH&FuU7`OcEy<}o<-zqWyl@(#^|MWm&)yDSh>ulklJ8oA$S*$TI-3HZPtG-pI z-)8&){ppRDeXZpKKhLoq>Q9e(+*`W+6d_KE1WoXl7^wMawnt@r&8kW-vcpBLjD^?R z-mB>45^Pt(RbxeyNwb9$N?gmj?A7=U{_SrPH#b#St8YyOW*B}=If+?~2yiQXxp8*; z+X;r17k`B}9TN9*9A@%KS@sN{PpS=yKY2jcOXs!4Lo;?#yzXSMZqP(jWZ&Lp*KtsT zAC`IHHN+71<0Ip5)kb>rCVSKzm&opiVAnSMp@*o<5N?~7f_;vP4CQ? zA*%3m!Fd@&{BebXr>k@uD*57BdARh1;0}IRrdvhdn2GoFIH<@$$-P+ss}pfj_NINq)Oi_Q!_VR?3gaCX3tiPfe}^IxR(MW14@v-uyhQ zSEAE4V*1Wyuz`J-3Cq^ZON=5tWBmxgs<*5Hao=x@-#H&N;qIFSD&Xm<9NfRqll^wl z>wE;nvW2Z@j_ANiSMwpfuG%%ikw%Y?iT+H zDvD6$Ca%0bQBzmR`O-2HL4KGk6(S}AJU?(eJI@?8=xO3lSKHZwn9l84iw!kyj>}35 zalZX`D`dDA1jHW!6KGTPx8%~iEpRzRUuNa?_1O*EOl6ANneTYJ^UC(-kD{I6rkOd> z*LkRoOeHAmdmBH8-rH|V3Iq>s?b0Q z^Vn7O?FSnIGkLp@Qrt2EHv(#6dl$sJawhpB?B@85@6ut_>ra@-{@1Vjm{nb^ z6QyRmy8j1WxS3GQ@$CzO74~U6mLNK<`z_HdW+>9TSO3m0i<)SDkF%X^^83X>sSPvz ziU_YGSGidR=xI=sAD@Ag+i{KQwn2SgmprDwfTWSN|D9k<6?SUk$4}yR#>UL$_3h^d z#dF2%wY0*{wXY5JC|<=8AZL004U6I;{E?uncUJ{5PAokt^KH(T!1ybse@ zVK_RHMUMY3-l@aJal7&rpmpOqF7O5O0Fu32s$zlDZD0`aW`ck>a~d;MTG-KNEdDO{ z(zXj>pj7V>wHYM6nkQ9~*CGuYC7FxS?EZxvJbfu_A#dW9iTg_Kv{!T`>iEE6davq zX&&XJt@IVoOe{T14U+Az0DZ58Io}r82A@ITsJuh4Zx@MqGF$^`=?k9QH^84}T(9eg zG}(;f$}W!u@S({M+~Y}^*U3df+m=mzMd=)zUB}>=zs7Q0k1wmxm_&ySB6lloE>%=av?vg^ySQLSzNc=VJXImGI|3&39#f7MaIz{Sm*z7okV5M`#s3d$ zZypGB+xCrLB~-Rb8cR$ip>1rHY?Bm`?1{o;DI{z5WhTi|mZ=aGhOD716|&6OCm~yQ zvdh?Im@#9Q2|M|8svPS;>#$_ zomi7?=N%dOn9d-{HlEY7Q2Cg?s>mV8NzrfmBnj~sk>1xSC**P?I|d-Gcl3sIa9n+B zk_k$gHdg1BlE0h%fym9pHFS9SxNv^K$6!stdkg^$pyZtk?_Q)cnkWw4%_0b$RO^JT z1g|B8V3=turuNEjfDsCDr+?90sHd^y#;oWVQO#|%IE3fbbLCY-{2RFZ71#}2`=YGv zA9qP<2h^Ppeh;Yl{dV0Zn7zLw%tL^7`}48W;5+)ONyj5WW2(w2$PRX&uXxHxM=gn!KSTU@FlwCQ`Vo0_c>E`u{dXX4TF6o znk1?umCRZkJzXbZ-Z?ZIdeL6irSJAG>ys?j!m=Q@Q75DFX3djCM_J^e#>@iWH?nq> z*$yq1+ehZDM~R2U%mWUNQTx7Rr9?a53)?O(SYi?|Tj;fJ@V$7Go(A{as}-OvKJ34 zN$gB+Y*@M&MST|+$^pzx)+fi1)A36VrCx4%7#AyBA>_n&_XqvTE723fHoGGl33)@h zA8(%?rL5ldRT$w1brJ>YL{=qr+#-fE0&I6%{Yhj!G^hz~UUa1y z6RHC8wOt7)OL|0}3`G*6=4Vg-z%_hly{$}sR{Z2w&bb>F&oHuoAkx5w4*px{PRKa# zg5P{NjNj*p;!{gSod*cZg|ENqg;t=} z1@^`9r;Zx)!g3?+$5(Y5pqhbYeP?q?5oBEDLj+475yEya$XD2zo_|On;2dFkIVsBZ zKF_opg1WMNO3gkcN&uI^r%I{Rx@Kl4U(lz1Fm5GtOlG<@A_jqpCfiZGzyz#_Z_$%?-bLommEFW}f_tOhQaJp+W-%XRZ8)6c<;&yhp!qGv?x;qbyx`#z!kYQJ+BgDJK#4@g*DBpT(B)cu#8L z{$1zog~vIHax5JOj7cAd*b)7ssdhKnn0wuh2TR*Y^$eBMV4 z@y2Pkh0Y!tc&vy{Cp1R!VBBgSx>XYjwzp^EAB90qQ8+k|A*dhCQ2sP;>Bp!v9_}Xq znXk&g6r$^Tg{OID5G(ZpQV%6mDxICm zUmjQDI{ho;EUm5OEs^(x%4{fBi)JP}l4jS+H59H|_YhaL$6#qLd!-kdtu@8MA?KQs zhmCvmXKzeY!!RCeL_+PZSM`s0b~nB3CiI9naLt4Phhkc~bCg(8$B9^f08FLdU_8@j zTTZ-!w}e_)0F?SX7yK#{cdb>_g&yp)9&2-SULs^cUYHi!5Qg4{Gd7UbS>HQHe15RP zQdMpW_L|a2t%jQm5#yE^So<5~H;RL`BCS?yh%JC(e?lWbJtxE^%S&!G$k4le$j=#Z zokj@fi%O|ndSuHvO{|fueV_%OJ(gr7So$KWB9iUhQ!z&0>nJAsu{IiP=FC3W*>Jkh z8E{@K0;ATnRT>Nt53P{sW+>dkEc3MaF6BPU+@>U+`p_VUU1xy2NcYiN}aQz@uy6cbB6x3Sp#%Lyf(c67l z@>7(+P+LQ`mviFSOSjWWi-(|y_+J^!zhy{Rzr%bQu29OK{VF|48h3VFmwXkSJ@mbU zM|KP5McS`(({|KIc!-~pehy$l7k)vm_aozmwA@BSzr|dr*}~k&1K|fhWWP1oh+C`- zBEp79`@8Dx=WPcSds-@J`p%j3*Y~%rmke8-cf=SSFVoOn?Vo`kcrbvfs1R6?Q~!J; zhUo7M7Dj0{0T2WtQVf27$NjWAn|NDJDB}FrR%yD3c=lXo7?TTemE9Wv?2vXljU0Vh zRVG(x{iObnpUp`8rQaH-d&9~Ek6DRY`VhlKNXzr^`#$Nksg?|MA>Et>IrTt#d_$|o z_gZ*J*HVV1u;{`~l;<{bK!eO%4^~qBb=GEN^^;DS(G#?X6F1?B)zjO@4i8+#L5o&m zkj`2Vbjrqg5h7!6IIRu<9yTk@4oAAHm!o(KBNmU$McgGkh5a#>L#g&>t=0SYpR+@O z#{y?yO&GaL8IbORL8wsQn^^dnEAVk~qyxECYFqovCK~ClT z*sF#d?AD+R@1dj|9=%vI`WX?z=%dUeG}=HkBLy4wEQ(hqk~Q>Q(48iXnMmU-#WoQ?=i?-{4ofIbLnUj3OoJbo8Sdo=c& z?%u{u8#IKQa#P-&NFD|jrC^(W@tk)#;nH8~z1!erVd8+sysQ>el4{hv4{#5^t_gt6 zUx2xL!p!fmQiO3_3wKb>BLJ={8Yz>@M{#vcVMd_7M%C|^iK+&SiCS3=*`18AIjcU)jvJnd$2GucNmSex4r-v2~VtIDsV_wvD$ z>}n}S7X?TCJ{fxJZxcTk6C!c5Aydsm)dJ9qh^ z5fk0wzA45lwpguH-+VcGudtf$`&(Dt&uy&iN{F#JGH)m6LgJi>ZA-#l;bI>}Gf?_x zod{gzPkPWJo7urM>J{GJ!)?jbBVXuyy!O`wmo&?}w@ixkbYj_R^88 zv^VtX3wL{9ks~Sd!|{_mTrZBLE*>*iAjo1~b1z(Yxug|`?4p<+IPSQjKcp)>)G_>% zL9F10dz?_Ey}v%Ia8C~@Kga4EXu6y%=YlFVQ6}K`i{yeWhqE+)H6u+{#{1mp@%)KC zNX+;d!J}r|ev-9dIULr6($gO+hfQzVn&B1>H&6mbou2Pz9x#Vw`ob4r9y zWu8T%SHKd~cg4R$W&HEnc}%}N1JuwQSk&VtwxR**DCGiSL1a+z z39sy_-5HB%+W5Zev!k+^t&q%pEt29N-*_9?3NpZXL9OfBjPdz1T3j{<6bc=cxkr-j zR|t>lK(sJ)N5Igro*SxuwVAK zsnpJO_{H06Tr}Yyh=fbfJn{Fv%b0v^n8L9vPK#~ReRck<2IpMN_r~9~P<_hG zy?6j<%ps-zDCU}j5`xsG#)RWmy6ZhDPlO+m0#1Mm$kc{2MgW>3@4@Aa<3p z?)GKBIBzOoV*}BE*JEeuE%sxSLXheTfJ2Q}7IHj(se#@tU$NyqI=gy&p1|L37K^WW zT*E|??8A{d|LJ+cW@F)lCw6p=)~$IX#@IY5;NW6Hj3e31cVDh)a4n6BPO11-Nd1gu z93Mx`QW3qhHF}c;!@1ntD~r@2ph4!TmYOTob)z}NZpRjaShtBF7QJ|73fig7&c5pO z&w=HYt=B6x*_;^`EOM7WO&4f2CO9JDBP{f9Hrh>*gW;;m0u@(l6zoMhjd}`X6;~ga z!LcU9Hpn89P7PtuOqr#sEQMy^)!%3zL@*t~QBvB4M_!Fy<~IXS6e*d0QE zZx7;6eryS>pOHZ#3RqrEg{CiE9KF0h;5H|Wb2g>r2>1CbaVOrvA0XBmDpVw5d`9(9 zJvxjpB-sI|;FAyh9evVmcYo0>7}~X{JPhDH42JBRlhx#-!nw<85w=|BxlZQ-#!6;w zR4j6bEme$q4YO^N$SQNTl+9`EKYP}c@h&5HPVUw^smP_W_a@JLo?!hbyu1OZiJQhI zd${ID7ORj_*tfbdgUw$EnYmDF#c#ArC#bl-VXWtX++%#W=>nnC*`&-(0*khfCuDf` z{*=)--$T=DP_3$ybA%Ev_uf97)RB#xo|k0B*RXM9w1ymDBsq4a zS*`n@c$e@O;CWN6c>cd|@y<=9+6ad%l$@em!y}U6$0wezT|-$WpB=}03+U1&0_LoJ z)8;Keuy;Tp569avKt7ieqfgoPN4dFc>n_H$^Kk8j2y&xHLMnzm95p#}boT*uLN3V8 zQw-K$yb`$Im}H1gR3QY(Rm3kn@NI<#tj5sCQi8aEtfR`~VEwx&F-DSOzwc67=-MZT zd2~D1i7;DYKM4+yt7lBr6!YzGAd|)PZv#CQ8*lv!4|uhdp++n11-J%7L6%OQO-w*K zNJyf&*p=^zsJvBSRq0F)I=`Zlj+EKAaL=UNEv(T1OwVpVluN%ndv?IBpDH1|+LX!m z6j{{KjQz0U3dZN!Qk>C7+i%|_Bq8wL2Z=9PFTAzSzv`@w)(VR57li>nGs<$4&#aE# zyj@%JH756~x@>?aEg;sh#>??GY^);036l!l$BR4T54cQ^gPdJJf0O4NK&|4y%_eM% zuReB0@McXzBJuzW*#Svd{ucf_nos0@>LOstTKBl7066Zzyx9MPB(wOxNiq$-X1PnE z5|K7!{?gQ&QK}7tU5YwKA9U@px0SmJ$qVwnXd4yU|JG)>#V8Dg1amY%Krkh|#Y_OG z$a9R7dxPw3sxl#8Pld~#d(>UOD5j&Q8KW+;5wjjEf10B%A1eH#O8VNs*^&;#Bn(v^ zIQ{S%+;SMm0w4ypR9Z~H`lJ3`thp=8b)xfj43_NNp-q-7==MLcWOWNSP^Ja6HcEK( zp?HFJRqtwi5?kdZr5;q`hbT=vkP>*Fo(|(!UL47P1eL@osqok=?WnXv4Y2d2 z!Y;^@WC7;s@1~GK{M4jjE=nl+Y9~J@V;tG1>9cbrCHR zUm#*Esldcj(ZW#a$TPXmGRq=<=$3-KSN#nES`0p9Jr5yONPV{epPw)O zDPk=M_`PH!JOjbMF(#iOQ{iS%FM79W^o0G#>F>yKlhwT~4t)(9+>ddGb`$=(TkM~h z9MdL)*NTJW*7h%ntJmRPXP~(j2t;WP`f#H(y|_pUzr)oUI(unK zc-kA4>dFxg;vL$b>d`uwQI?G!SQY-QXG_3xwVsX)^pjt)v@6s+eXm%s@W^nfXG1eoP0i z?FyZ=SnWQjqSdvR=N>?(u=2W{1Xe3<>O+y$y$5VUR^MWZRiWC%%jHw-rBl$r)Uwn9 z%r(><8UfiiMypwfe|I{oL&Ls@=hp`Ycjjf3=w|f)=gx#kT1uHjyc1)-)N5-BZrk}f zJ)Cj9j&EMC>9IIhnU7D&5ryZ*YFb~(c?5cBf9F+rpoB+K=|BO8xjkp_?+cMC7eI1v z@S4ryq~$n@5dJ&p`&BSlcNbdnZUAk|w8uJ90E2wd<`q5P(R@a@pWmmr zbf6nafu2qnT9g>e9-AljlRQ`){hPAWZaFn~t1xpxyy6-;AV*iL}b%pJ9!oEEBxj!o~MPM05_RM8ABLy&b&J%&jr@+mQ{KB)!!6 zF3c~wq+37Rrt5S6>n|}M_rk(2j_kA;SS)*uuiY~R>P^bKU%TH7T!!CALmm})nGp$U@dJJNS=o|Amimi(8on>kxOHrrHJDQ|ZDcO8)CFd6iHs6wjc_#gxF!`bA5Dwqy$J4BV?4n6)>w0Kb0Y;itxVj~1HCF!3| zp3j_3T~~XYf7WRXIc2N8P?48Sci-C>+{!b?|GJy;lV+Jy*G?Y{K>v)b{AEHgr9)EWA zJu_|#d5A0i_G0nz``+L3-y29%RSiV7%j~RBZ7`D(!m&UROlR01yv|22cpB&+%dD?sSMWM1?YSko_^O9^?Z(J4Zri;b<31%CQ>`E}V}NJI|M-x+$j zr2*NjrSb|d#apPf5t-%N-!j(;6(1mKz{A^h-Myheoc;j{aUFYV*BXh)U9tFvl=_*< zzj%)Sq9!5f8`dee=y`VbV^Y+{7TjH!ab|VjNBZ zOe{=1HsnK^wR5U!w$(1ii+8J`2{=6%$EV>@7(VN#$%ceI*?i^lU>obpEq0P0m=Qn^ zpA&m#5zl_%x9F(eNjZwN^lP>{K%|)*1R_nX?e*uUMSWX&)Lq=uFuAnq+v{ye`3Mez zU0aK0kYa!v;Fnn6_bLXsz{5j6yWS$B*mlmmdtkIMmzoX#NU2{4_=qt=^|s8A?AIKh zoCygDJD;B3O*t%T8pa;Gy=A`{V!wthO-9b-^0kVvhB`p0`4&6^mWlfM-RPXt#t4_( zwNp!59poA>Vn-YkofcpTXE>Hk4!5yC8O|HuIU02!WZ`z?Pua=tkaZsSkAlVa$2MW` z3VED-vf7uA= z1UiCB=aXWBC>?c=*TJ(@eu^I_li4(7W1Z+|R4KQV+^#o(96&|p2^earvFF^&;OeY% zZSRsEOLsex3W)lx;rnjVf7(id^IMSLzjULXFa@8(9mR0Ygs;ff4K6QWrU0><1JJJg z&{TG6)z_y#5k#H(&EF>2(#gZAgO$J;)Lw*=OjXnd#A3`=eE)U- zFI0I`?Fd9MelWm?hUWYy7ZCF6JNYZWeq`T}a7Dn3y`2F1}^C};gcm#q#1%&RVW!&xT(M#7Z1!gJ}_F2U7YQny)BhN-cHxSMk=Y3inl>k;ub zylUWbN?X4&5t91HOy-o2?W{>QrhMo;Zw|~N2ggsbz=5ZNOG9js zxR>p%CGPzk@+WesT4UXTVmg!YVnw6`eG_OQ51HNCdDf(wpZ4SR?Vn2oz^K7#kBV^! zn#$D7O~?-h<(d8uLd_n@^Yu)9I2OdMF_yq{8T36gICGUDfjM_asR~GmEk7`E(~bgH z^qD4DS6g1rVSk5)O_LRFA{n6nj-r0kzpNr{i#pi-!iEG@HrvW7$P`$eK)$nb4KUa8 zuh4vIQ~j0F@1y0)YH> zbTQgXvjjy#@ktA_1^yoC!c@o!rQ$?n&*lG~V*>$=f*_#LbMWlgLO=#jVY@EF>?fEi z&2LclsUpY74Q(LN3kp7RY_%aoMx?-1YnK+^Cj04n()HH)C#HaG;3fZ!w#ch;7^vAQSev`sRmbLyaArEW#lKCMi6X%?6T2%DUZe8ES@G{8!M z-q}<_y!{3aGwHco19KIE7N^C#NpBKs6_^(Nzlz}BsWnA=@L^Y&{4nDhC7tUrr#za- zk)_sQ{^t|G{i?6h*Bn?epi5>ENT8gm55W^ctJuY3#UoNh;S z^H`7r;O)9|JtEVhayS6m?NY0{+~l2pxO^#;L*Pfy_E%A?+^aRpDRMXP5g0>?6U zFEPZ8@+UL_%<&*(rS7ZFG>?1qe6SkBJ6i)ZfI)kK6%kAe6C7u=g15oVDp#rT7B4ow z(iX$pJMJO^XMNGy40Evejl98*Ne;et)ek9uphLMWE{Jk*J)gJXyN}k|IM@*`Fm&U% zCEwONov7P(NbHW*bxuZ9mqkod#6F(s$W0fm9y2_Ak7zzts^vwW+cz?6ordP_(I|De z*quu_LdjtaWD;~$eFV|-zBP}UT7RCM8pAjV^)V_$Ym4IPnT3jHP{o}ATP8riZ~85E z9x{l0^J~Fl3-1eOS3R7eKu&L^L%}>%=bM`_UPf)l3dyumWs;S8DF0B@C_L4<$B?%4lEU#Ee4yW&8`Lp5;D&~ z8Tpw+tinRpY}PF-&NgG3QMO zC%Ox9LyteIcm-i*;f$814R*jtYR2Gw-YB7!Y}{3odt{&`9P0Y_u0I(W&vQL$+5&== zf@`&T{QDY;z@axlb^xa%&wq^W_~<4fLX~`AO|mM{Rd?njLm!)UZg}Q<*7viml%n^w zu$O7FZ#p>jaQq1T!c2Nz%xY{D6w6i%Z6mXCh%emBI=adbbY?v;!pxz)zRJjYVL(>dg9dy(AVtTNqfbm}3l{OnUGgp3 z11S4b_-H`SXl~In;!KvuQD6<^INg#+ynX=r%`Qv$+&B;UDy;aUrprImYS{D34cjOq z5!F+|u(Y<8o2aP=wXHh9a0Yg6`L?!L4e;n%O4FX96mY4oGkK|QfeNqgx!3E{qBWbw z)YtGi6L+5{NgxU#QRM~CIflbbulY6{#4`RR&4jRc-#@xqN4um!W-w@H`Ej@3(MvHX zOjTmIY7WO+DAuJ8rq|PP^Scy3FuRA0wI~navy*{5Jp+3Dkjkr&PxleGtjI53I7IP8 zG8Sxyhp@q7F8XOnvS`JgWUMr}83Xtjp6OjG;Ipim{H!)9w5xDkYmz&xuI`H}RE*n{ zbIA1;@l6!&0;-_>%N&EVcKnK7l1T#M(>`)m)n1Pe`3>eE|6x0HRf7da`{Y3ozxBOH zI9+DFsunG=Nz06kd*Mc8gDa%U`{s2aq?%Gc>ePPqs>^|RR*V_8e@K}oLe#)0r>E>> zTq?oSxovwo3m%ho#Jq07l890m&t{r_sU@o`a5{=;G5M3*5`4cJJhP*lt^GYt=A0*r ztFd^g%b@&5d-H=+nRmLJ<=mlyT{BoMvvW7fF;PepKG+V?MdLjF#j09;w8Tnug7=M@ z(O5OJmls34VpHeanu8yIde;9_gOG2laz>B%G0|z&<2^cv@|Q2bJ{*jTd85z>$;+Bc2`-A=(K`H;! zZYJSxt`3*GWM*d~R2=NLYYaBO6na+eLf2k%FWueZjClvR&6G};n0zl{Nq+%}yTR9u zoC-S0U?K1{ZgVqHVKt-ccm_Gqr=@-uq+R${M4p<{`VvQM7zASH@~>4rqk#@{8d#1k`K}z`?!K#{fqQ0j{l+bP?i=t( zX|bs@etmfXDA2?+yOSBbQn&CkKVODFu=NL`t4$c+pJ)~Qs|dQvdw~4NzoSRV)=tGs z`3-JIRhaH&kaQ#4@u?^YC^z-b7oNS)piFianB-06wUzp12L1jLfU=DKVvv| zTTzD^J4fa8%&*LnL^zbf>u)m{S3hn3G++uDU(vQ25I8 zrIS}^21XX zN7OI|qp$@wvsSew?VV8e*hyjWrZn+WS|1cF>dyyWXVk=z9oSY*5cUr-!H+AY_~EJ5 z>${$vW}?im*Y79->gV(Or7zrl&H1z3odyfgN9MyQPjvc;*_0JgF(|FD%||FV_U zA1TQUdL+5OSx}-qQCqF_CZNp3eUzFqOBMq|0M2`mz5931pH!L16@b@HT;pfL5puNk zSiaz7!Ns>HKUmj0|6s8`N^kJCA{vSa{YJe@p(SJb$dRfWw)q)d9+@RX!=Wo1@_e*> z8H+3BVb$@vh%K@VrTLEkxD-_I4`pt zIHD`_5rP9>FrI__F%C3sxC4S%!)j?4)sg4tw<2&{&@|~~fzol>vk-5c?u$=(zYge4 zqeFvzfFkwjm;_+VSYc7UHv}0obG4|`2G9?mHw|z-HK6k4C3$q0BEt~f&g6Ui)>0(Z zSC<1n|2W+}?_u+RChCr*2}%fTFDs6fbqEq4Lm#JAobe9}S$Da2GR(W}EiV7I&l8ai zcVXBV7^%e3;Np>i*=&ZIe`z zP8t5>eQ&XdH8zm$fDx7}&=fCKH|ZAmZ_@NinA!!;gM6e2RO~Tq|6+D4dy! zb94BLFNtCd$0#GkfTJ4DKom#`&!DeTe5voOUu(?dMLSa@XYwNFfU6G4sHb8rsl2h~gI!A<- zvVnuCPhJ=mNM5;u^fqwJ?C3t5JL32C_xW@SPY?hyi>?6lwR~UC_tx8d*G@+gd2xA= z6D6-&df84J4~>5tJn0YnkDEv7Y?7R*vqLz+V!Gk{dhC7i`KkCoW&X?>I7Jkg5;S!j zxfyhXI@erEP&zusGdk*lO1g86m%P+=VFEjx9G^n#H9quJvNi`xZKUpY7$e?^QF}FXkmCsD)|K9axurO71&m8N)O9^*N1{u${AySf2#9J*4=z) zMD7%jPCo-;xkG}Bag-TIPdHpke(kN2hDwgyr=;Il9?J1Et1M)1gnwE6iYzTR;0$#a zU#n;OmQ*egS$R<@^SWxCrodvnQaDdhr+pZKl;JLYDxhU4d2b=ZSz__)LD65~W5MFD z_{9K$ri=%T{|J-9;!Oeu4|2IjZO;D$DR=XmQ3cZDdDz9_{Pg)G5Y9Q^NwI`55V@w- zs6b_fj3G8pix(PY$mwc$<8$`_$Y9WRzXuH3w6>breh@^a%QMe0hG2Ek83+@d8q#??XlY!Javw*2`{eIXg119kJ<(YTio0NWP<5bF zs!cYR{RF9H5nZZpfEF+@4TyH4NPt&i#*qanv+C47Xf)~anjGx=+zb___;f_&!}s-y z_bMfro9CxRCTt4#=Jm~r=DvTq7e7G*de3hSB)d#0owQ2t9!5T+A+?HNRFE_Nx+9!# z00d|Hz6GN=1i$20vvk#e=`n{tmImy11HsJ94i_+$_u>(`=!QR{&g`2LFHw5X?rh4B z1woCJ3n1&_*fv^zD1)+YdA5O?W?gH&z3v-B`@}^t2UzkHXQ^#WxXDM28YerO8-Hdr zzEb(B1s6^quCPZoS3T=XpEFN?;TLnUL0u_}C{(O_7Uaf78fxif-wp#0cewSFO~dZr zO=}`;&Y)VJWvW^VGfv6t0RG)xanbKB8PEsRi;DH0a{d=Y&i;r>iSX7o<)GHd_r1_e|1lk$E%Xm@(a)zCnWU75Go6c#VBAis}88@yagFN z4T+BA8pV!g$8L)JgM9(6M*>!;_6NY?voG#T-tA~fB@?jt?9XHkHjr&_1vMcbb-Cel ztyjXcJL4SC5NrS`*yk%#%jt-_F4e4C8R4bM&wP@Nj(Pm~@{1)QKHMFRB~9y3Ap8^; zLU2Uf3Zh4PkPJL1$#iLuPpeDFoSfnr&{2q2`_s6l!NKzmaBJpOdQg!6mmsy@tTy6? zV6_nH=8nVNt$$K$hM0>FB6wRQX$8QuX7A$Ww_d8Jm8#la_?Xdhxthfv+4QY#b|~&k zH#b6IO=znJi97!7LNZ*unQ6#f$Do|PHz(gh-5JWlp2>}#s!~khi8=%x^KH;K(^fX( z41?kADD9;(%;L!6WuGF;T5%@_g;^F1`4QJW%SvY?v;!01KaTv#Hc1NJVV3}uFCk(x zZhZ_b*5U_?vUHun3f?uI3raD-UuZV=YDgp}4b{GCRZrp*$vq+h(ogqu85m?3)$L(y zhQHj4wfXZ>8E$3-wqh6WxJ! z#yva6IQ^?i#$R z4sY5rG*CevAT}9dRi!M3IbM{)xLvp1BAK~en*r8=j0`C05VktR zt0G6PY5vYO^v{dOPp;8EQih_sJO;x?us`WnDI=|$=AeOY*PgQb4nm8X*D%0diM?H> z#ganLk5bTB0hU6J6dtTyZE(9TCEzI#$&D7uU3+O>(S^9aF|TPFc+mHb-^+QM*Kf77 zMyMB*G7_5ZjcQJ8&r7pjxS(d#u(|PO!h17UPMqvd1(t*qrsO-V;(NH3`McZRN0(!U ze>Z`6xsl9>kUm#6`a>MiP4Uf+P+Bmn5Q}2HhkH{i_B{2;Hp*eIt?b4*$T*&JE{)z4 z(AJvGPWut%fkj_`S)G3kDgn-j5o5he+^eWfH#gE@4u-a$8jB-#J3Mw3oF+CFnh)A9 zYTfkiEPZg$@YSXx%`~MMZPapfDGa$B?32%&K6MWxc=u;S^mA9B_(L|?RSHX&zz($A z4FAgKvCBl;WC6`)mGTdn9^IBb)IcY}`l&)>#GC|d8XuX`0o!#O^$xoRvGRZ~_n~e2k24S7d=obIetMyW)(N)dQJwn6b-p0d5*&r3I zgM~n%S~PV|nDEOjc6rxXT5w?BGx+*;TD>lfICq~K719MEOYz}MfHV%oPOQ$tJbH+%u zAeX-I)vyI4x8jviO`c`@?g41}o9?G@z#j2@6ZrQv`ww^g+z|zkgB1C!Td0XJOW{mO z%7=wD9`=CCYNQlPn)`qB{<^W>Iu&l4}eIqNuf#k$MU0#$KH$^}hx01{;XxMnbF z&J`{iS^)V?V42ABbANF7@F{Ut$JOW4dBP-DACzx*i*h&MVw!np=n~}ecGzdbW{?PV zeczw#G~;Ei)%`zkvNyvzs5vv!D{!;T>{X-x-I;bz%^QrJKnJcSKn&C|K3fu5-953Dw+TeIS?~zl zbOap6nK#3^%~ZpEP+2me(i8mbSw$dbC!w?9TEiEB|DtNse=&v(J^kT%)ZuJkZm?zK z@`!$9pvt7>CrX;|6hCwSW#9>U>-7A;$!7c)3WRke}-rQg_FRz}jB*6%#v z{E?oq?+U|@=H3boq1ip>R`(ihAGTOkgG`MnkF(zgiH!gkada8V!>F{bm*C-e*nV+# zv3a|4jIWP`8<@%pB1Hb40C;PO+KDi}kNQL(J-YL*f+1Mqkde8~WiQVvA~VOjU0O#e zBQacIv|7nu{yxas5EqO;A7$-(^QA1Rx_ALR(N~#zqE!NK$8QX^6ckGQ3# zXgoR>K4&ux_4YZ&r!G*YaQ8NhYb4G=DS9{`lYdC|Q-`j*wig#A9rM~v#YOR8tQ<0h zY$ZGc3;|o=<+Yh0$T3q&t~(%Dq06yufw!?;u5oud2L+@*WrL5?`T9wMoZMQ4ESzob z_(hqXQ|NUz-%G<2qqz(OBYDpetv(m{wsRkZytGhS;#S%Jw7pW3Rs(|O_C5H*#Jfg1 z%E5Q&Q=6a&v+|uGT24=n;bk<<|34s+wFta)=IU zf+pAg_!#mU+=0d)Fa|k^EO;GIhm?r9ld@XjFp2C@-^2(4Kd*9}M&c-qPmy^msx+I! z^AfD}6T~wn5|C$-1cgk#fV=&kc*5hAT5Bz_++!j}f=~O^SZjm&-$d$bscAME!5Cqq z6%qoQ7|GzTt=kyGWDhCVv}~aC^b9~D7c$E%CpSToV%V^um#%Y`n^K)6oWbkhD@9KI zG!Fv1Ml$2ivq+VRpAke#7m56Ne!zND<=DyE#`E0Olz z@QINyoi3{cK+`>E#61dz)p1(rC5EW;|2J`uu2*qu)k^V9MM!z>JP0xZKAzY4%s@wk zo}$h;DxNLR+;=5j-D%^JC5Wq#U?Y()Qd6n|fV>1G?1iMhaH8yFd1Z;CZC9?pZPEVc z6fg=o{_LO;C$&JPD3}3{bOLKK$-UT1hPA5?=1rx>f`RB}9x(WBoHnIQlVnR1MNS)c zC`AoeYq0`l!jD%RbLLWGFMHO%SlXN@@d#Axrd^p7~^5 zHNi@XN#e90|1Itxa}>-Q)vX|2zpV$W&)Jclk|+x8tWl{33Oftp^4Y1ll?NO^Wd;?4 zOBLdg3@AMw^w*Bq(&QlIfia}KE0C{xW&HG;&&$SC>ro^}jo>v?4HNfI5MR;1`nEdj zYhIJDHS4)X7XGTG+Bi{P9lkIo12f{^*w^`0T$(?(PrKx&Ug z?n91m%Jd*>YT6P;p1u~e$3Jqow~@EHffMliPX9EJbWv_}M` z88TVL)Uwrlwc&M+We=Hy5fLC~Htg`hR26mCC<+)~_JZ+ccqV+=vV0IB(}iu{Xvf$+ z3lIoZ<7<1~KQDgTn^g1rb4&h8MWWoR5Ht_n<+pEb8AwNLFM)Q|I}Wq}*I{fM`1+T_bFX-M_9E}eMX2}U-tf$u4 z3^c1FMa&%O-q(UzoGXJh)fg~A3|~ps9iG{sqBi`LE$N<|V=cAyWLXmtzzOVE^J}LE z#@R|lT&fj5#W~~5SbA3ULhvLI1~N9M2>z}i6dW4898Rx(G=VMo4p{3g*}IX%`rr+) zV!(!HC1fS<>{tsGTR3O=$WOJq6Z*nS^s3kb{WrGS$gF5pEkzZ$7W$Ee6VlBUk=Iu; z!zHPVEeci?D-9I4$Q_II)ND3%Z$9{ z9-e?$1&b!G6RE1_Oaj^YSm1iGG{?SjEMP7g*We|HI10LkG5Ef_wQi=7ZyN?PXpJFt)}1!`L>14?{Ce&Uu|N%6EDr?GC>Q4^AQK z*S7El>tAr;0*AK1lmx|^ptof;4M{^OpmIOzYbJ+0RMV#bNA)e38t2I z*PR2YkabfE|NaP3>3nUN9K0r~1lT!^fwuPuua=$PIp)G;uLmhUgGrDs?mnHC%0GZ& zJK^H14;Kj11Ys&dNUIDdBOMDvPl`k&m67*=MOZ3(L`_H58D4q$0%`2HT2rLwnjo%Y zsa=wY6e?XdEUXb%dGX{u2*shYX`r<2N}bve0(x7g=9qQcUA8{(eTdTPA}&Hu{(Q`{fD%+A{Q%kVbauJ1Q#9vyq*0MBp!18^t1& z%fq@BSfr}5J<*5fDqSrl#S6p1G6LXGyv4v*iu2`_1R?l?4I8R6e=h=#|+yj$@(hvOmv$rpkOQU}F8fPBP7<$v5{)re6#SSF1}d=saZoha3XjuzGbzptMz+FLvLl&=l#M^7oTGg zb%8gp5ixl9;3`nePYC86wWEXw#)1rtcCHGp*$oXu3{MnS6#v)>wY*`KatMoJ>|V%g z4%-rwq)dU+F|U&d&Y^b48@l89D_AEAH8bmpdlL4z~xAb zmt`Y~jc9N#5Y>iiS2WT{`SAYo?>u9U!BCR_QjypK$94du0TYpWy z@iDUC%tLFj`aL=cpS_6JtiR;@4`c(o5J!!d99@yFF(_K`uKkM~vF6@raXrro#x6Aw zyFgmO{(Kzx<2JB|{|>x%JY?02s(;i2y_q+bK?!?m(N7N0I-|}~d)@dYgyf+MEW>9< z1LyZ&q3$pLm~bc9U>6B+vD}p7V5M3VSgDqviMMFy4SfN2YJm9Q@2=YKfeO$StW+}& zJ`1NeLMDZdasRhn+`ssP)_wBy>UCAdj9BhipNut8md-D}GbDe}GVQ3yJ?#k285S0m zcfUAubFrFlRI=c|GeI)+oY3OOf?`cC!&l4pS;L=218(zs-KulJ7|RN8GrjAMEqWE3 z@b%_soF`QPGC)TLPg4WCNnrkvuaAyroDFnlT94TMlv z#$k!7(NUcozuRt8w7(%=Lf%;)5wIK+TW_T}^o6UEBHZ@o&E_e*E6yue{p?sXq&U00 z$=$J}55FgL2G4Frfo@sh#ADgoJ+U=Aj}?1$>wi1WrFNtJQKFegllQxXuZ-%kxn3=Y zv0e=Z^2?TQGbh41A(YzZYx27uI7F%dh<9$TN7UU20K+b=VMfr=UH zGsbGGidIP{NUF5YDmPKZdOB%&uJFORRJM8DxTws&^AlEpy1Ud{b}uYN)PA`3C)gO0 zo@UEnDz|3Ag&8y>l94%8oOIvxA8l_Q4)xy0|DST?97`${2~(+%Y>_Pti7Ay))@)-9mF!EHndDF+ z5~8w|Wvp4Uhp~$kS)66Fd#DGS8K-YJtiZ_U;8tGAKxBpCE{J;O#z~{BAyi?p139t(t_-b*uI!-Z8)nUh{IppRA z_#Nm-Od{jHg^_7*RJ50hlDRz_>O7+-ec;4~#ju}uCNYnwFS)6;NJ3D3`TP9f9mzkg zO&vyTwpXWgco%ws5&k7d2Abayiyy$ua8&n=>HZ8ND42tRG7ne-qv-@SN@+c}BI`s~xMh}G!%ge!1^V&HlBAtp{!@j#uU zed)hQP&n{{9ux&X%|6l%K;?j|20*AWT0{NfB6+@P-*de-rb2bp>UD{9|AW36>P093G+n z{fbb1Cty21=A9b-JR19Dzk}mk%eJg1E_(xZ{0ZLu`byZ;HGR_M&2#*pfvf126e@wO zBWSod%ZK`y^+{kg2o@j)geYUb(OiGswHzq9zVh=Oj@pLmwS>0=RJo3()WX_c5geg3 zaBcl|4c?!UH9O4sW}}wTYO`kM4r3I8R`=8qk6*Blb$#0ic$RA@HdcTul$mg!f&W&Q%+1p&pxv&wQj- zpv%Ln1JD1l|HGQf)#q33sY-dXqbg2@P)e>w$4C0=wG-(VD&=%laFE0o{c`bz`D=%+ z0`!}ILr*669DtndSxmjc4hBlMZ*3e#*`v%fedmskDo;!Z)aZ2W;r9H23)qMpq{vL9 zLJJqhM<;rigCCOn_M@BylVyHE%|FLn)aR?7h7V;F}T* zljV#Jv*w@lLCMT-z2jQkVO0bRNE4k=d-JKfQT@z})M|f->!QewZ(Cn>t@BpDJ*r~S zKFht=W+6i$S1-+C{XPT6~)Q%J}l|;lmaVj{T8JD>nX#t~q~% zdE`azgQJaQ0&vb*_!k(-K3{wPZWL!O=R#KUeyPa{yceorPIWe}x~sKF;SdI2i-=d_ zp%CV}I&LWq%6lq_qTobf9ftUqu(_y!v84H>*-sKCFkii0U_tew<)X`TBQ=Xo=B_f; z_<(oth>E@?T`Wln;Fh(n$X^&2#lCDZd9I4FpQ`~Y}9_x-t4*ytDq0mCOwbDA^EbiZm0EpQ~~=VR(*0+5$!wS zl?qwtgDQ^n34CrkK_X>1=)jah(xG31ZFq?}II$2WPpn>gYkEma*p|WzFQ&I+fhjg6 zzsLo2M$OxEMu3-xD<9Ep@*#zFLwWbd^(FG?df83XrZGP~QTCU2)U*ul*|~Wx)g9S#!bx#bTQvm# z7XKW##vW?F!q`~ZcPJqV)nysFft+KIE|Qr-!OUC}0-^1?(~> zOC-2>y3~m3wu-b=)C8l*O<00Gg2$&6W*D31 zFTzfjjK!S}i7d`F@l-6wsOTQAc~**=fwpJ&-AtHaw?6>D%>Wq%UIDrD2kEWfaS8V{ zgmOfbjRz!hyeY3_Gvh-1E7igJUj9-y65KNDs~qzrW4d)?DblYr#;h-$oBbJde6*gA zsZV!Z2GXrEsL{O*N=S}koXR3i%p`<$KelwA7LSSU5DPAN<(slU{<#NgFX!{6C((=F z*Y5f$EBTBXoIeOH315-H1)82}(9|P(b2I#z|FtvHIsq5rs=>sd$<$s&VyAWd)`~)N zXPJw#w;k2ywj;3EqMl+Md>4k4e@>W7hM$oy+5SKS3hQkLeW;Ev15BwURSt#4%I@RjVn%k~_ zcf2viz7QIPbv+#(Ubi{E!wvQ4=*Nd%kHuWKKOLD;x6gK!)$`&+C80$Y47WdU|kmu@eYXbyrhy9{90B0xUGLGUj~S@BGj_qqZ=Q@{?+`3vT*r% z7;d^{`BPBSe-=lG#7ueS|8aYzmvw=pucicB#af{D>)C$`&x%7gPJ2$8H0tti?@EPMB%;;s| zzYT5GtI$7Q0`JYZvRwh7A@Od8%Z^Vg3Y#$;uiWKrO^^_}5^dMGb(oWU_E`p=!LC%< z40>>fY=O&*43N`>?H|<=C920!XZx$$e#)Q0t~SA^0Dk{$g(1zLb3s`5ZRuXzk4a#M z_REXZINJ34(^R;wc@v_`vsBje_^0gbH>U21;OcY@BrMMbT(@Q8uP{No2?Ttc>_{Ht zSUGV?_`l!A-~W~J>r37#qQl9NR}XoBpQ;Uf$9M7 zGMi1fTGWkn{-q^l6nhAkiXq^VBz`>iB54+R9wi)Ow^c(Y-n$0mYVyE@D8C;;7rw;X z+W&Fzv{&D;47`7FHeS)mODcSYL+-25m3L?yoZ>rGBO0R*arC+Xc*xN%EoR?e+#wY= z6vQ36ga%xVPas9!p~s9BP<>}U?^L1b8-)jT4=?FVTuPMr!?veo8A_52tJ!Gyy;jZs zy-Ew-z&rD_@OVDW8&@FfPB9_VVQA*Q5sd36D1Pl~b%44Fj0R=fzwZFv~1~ zt`0E)C=tuO^6mDcQ%IxHYBhI>enqu9kR(rMZcIMABo@yfy+!B4_tO>{=T!qOLocX>jJHQ4*7)c945XD`xMSZ6Z9Nko# zREl4^U6Lp#e)aY_naTCp_fbC@eXw&Fn^O}0!`!eg-jIBI@R&LMo`^EU*2F6Y?KD2H zxZnKBJJmA_3D?`Z1#tV4^>uG55HCsahbK66>FFRk(t^4#Duvve&{B%JHW5u>v~NW) zWt}MftqQ=4O^ak7Mn1D|jDE>A#}|yZBuR3Ov`c@!7Cuc5O!lTeVij-jTNK#_TS{k_ z(p2=eEZab3`i&UOGalcvmAkVAv z&Wk?>nqBu!JB4th|4KQbhBE|gfP{iBgJs>o94MTJGqn{Y)}4A>O!`#V`0wGoj+KC$ zU;t#QdaL$eAix^;xjqgQWRY<*x>@9IH+rmfUaSe#dUGPshOFD&ihViPTwp1lbx4H% zXgB3U#E8jLPDA!^5@DM<-q%aY4y~!mAa|4b#&~^=EwyRCg#$c?w9vTi^ z{$^~jJkUqS{21k*&0qaO5#vlxKK6N4HvAy%zIBy~b1IB-Tn#tG_C6G>meM_=A-KJm zm%yaKcBe!Q)G5Jei%Yl$;OMWv^D}exSb`ez`3o+;21!N7G_p9;D$TT)fBf)1-NHW< z7@$$Xd)@UYOVb$rTyE`#7VQq_NifUOYWuZkW8Ht=cI-rqjtPw#=i)x!un@#FL>kgu zKCa%b8bk`b%1E7%LnbsBn4Gh4KoUz%de1H;l^?rGL$F&qOYxhmUPc=DXhASb55FJZ zD_~9{aVA zO#}k2Wr4QHPy*TkMF5%Y~Go$P0$YFv!*$& zcML;#kB6G!Zg-P%FluR?V41tsm;0PJ7Y{wqR*S#`O)HQJ6hJ3x%JpxmIw(6~036X7 zT&GG&&Ni~@8kOAROmv5C(crq9w#WE0S4Fl6RXetlX>S64iJxZ^ z7H6-Fbo7vtc^W=^nI_DFaSv#ze8Kw_-qk|g!|%tH#(mnNv8^C!(f~eoC?e19#h3Lj zk(+vk>Tm;-&7CE|OIM=P^#*?7AcC!nl&i!J@=SQcq?n7JZ@k=MQL)Ssyt~GOkJT0rm;EfMY7sB#hCn^-Y3lzL9R%uw@RAJ6% zf9DqF8Zbo;a-&mt#j8rI2~xX^LcA$rf9iP8{?zeyz{}s?wu;o@YpJ81O0ee7$^c5< zV}_D+E6BO&ClOQ%1E2MNZTX34zl@_$#dAbbZuZA~wYL#*lS)xGkC3ws0hvWO zu!~Neh-YT;cQ&veP*lYcrY`UIz)1F`nD#?K)UFmtzGK-p@w)lKnJTHr<1`-=tE@7k z>mKJA`dtydi|=#Tic|v~PGO}O+Y(qfidZZbr?p<%@0B;P38!YQj`$BKRSdS2kAaQf z5F6TJ?jfZWY)|$ll%lGh_O3$??gWF++IbcMO?K!tspWAJ2zRZ_ zfdWLHqT(IYsC(akzOh+OK1a?T^Zy1-W#`p%uq@{;3Y%edXbOn6|TS|?k!5H1a7 zvUQSt#5S-aaWdW%bPY`W z0rksl&c58d_TSF{M*@#Rr`51A$-_pAC5r*w$2C$$uxVf7Zh+NQILQ#Gt?NJ2 zoz*(tPBkQvLv<`GMrko#Qc|~Z9H(j!nB=ZSZ;A`(cRiIpb}Rn86aGAM=(*^I+cHA@Fqj4P-!M?yEsl3RJO{-mqAY&I<(D!@#0f~}JY zqQ(6PT1hWamG=t6zq4YT8AI;u)>9JfEF zVA?LanZeQFBs=@*(l6Zafr|y68$OR_p~7ca{bn)i`hAgmv1wq^bANg_FKy~&X!4iU z)*NomRE)95IB-x8u8?kG0YbHRRCVt&Dr*-q+ZlUrU5+wgFyT+K!g~eF`JUi<;>mwp z;xg3iq1+-<(j_jESmnyDnU(Pv?E0AF^PBw&9vdzafcD<$@{NK7Dq}@`+qD-Wi_}oe zhl?tm^#wxOYsWD7r;%U$Ws0IH5Ph@{_!~?PE#IE>b24dpgoL9%Jw%V;NE)oImn10G zW{}oe*fG@62bK9rf}Xe(8m$f8iOlQ2>x9FwYl=w=>YyrM&p(|a>^3TVAtdB_EJ^>A z^;rPz)EmGgB5%c9SB4t#{(@PSfxkm(<_dL=6;Q!&+TQo}(U($?l57Z@uek4Vu)7Ms z!V@f`rPA5MZGRl^WCr*8mvpeL*B#QNXVX;i^R&D#+%GDg26iEfa`9VZR)e+lZ*)gU zr_*V`$l)!MG(!{)ctQnM=rc6wqzSh=wm4iasjhnOXzE{5T{JzY4m&axtF6p+9fVH) zb$CFl3x~A2>=!_*8x63gKdFcP*O5t}#C|=p>}M^6o4BZO#yoLA#;A0cIp-qTFto+5 zq*0UVLuqX$e0aH;K3OR<(_iMEnUoVoc&M_i{$POmv;LEOuZJ6|F!;eT*faDCosfr_ zVL_KhX78ii2Yqn{28~Kr&X$5s>z>;*!&R50U%$i}(GrGrxp{L4LdZp>^qodL$vt5K z*EM6#y#6yO^rNqpv@jT%j18d9<>TX-s>6E<8YkCLTN^7M1LL>G5eYqgk)b;TY~`TW z|J0<*mQxXT!rKk4mCWM;FB|c;8uA6$NYR#_a0c~q5Ovy-a~{;0sCGdQf6_|CN6HFJ z;Pm82S{3I8q2{M?Nk8|Bz-o9`=jCoG&fqt0?l0d?-f_$?I{opR5dl(O%{SRn^6-)| zKeC!>AfUIu8+Av@ra2PCV8i}jHN5TmC+2Jq$G|aSZnrj7{8PiTx1}Um(`?c`20g5) zpXYmk*S3Pz^g+!Su+U~6dj9__;)xtKcOC@;`M2`{Aho=F9CQFuDU;K9aNXQtN?Op| zIf|tL9oFrE_kQfu*P5^V^=2X)%bRmN`?XI_1Wt%I@AaQ&-N1k8RGXQ0PQje*TXK-0 zOu-e8sM-Fqi*zZSyVT<-iv;Jqb&u4<2aU>-XD>TmkPlfT3yAEdh_-l)JKfv;p4Q3c z=K?dNd9e;-npwM%*?R>he-Pv-AHsNS{$c@am{D@5dA9rmbp|ft6Hj*Krv)459fmH| zumdXX4u*~^sZ#9<7X_aF_i>_&DVk$o742M+JNfzZJ593eH>8T*X1vqAm|lfHR*IBD z*3vPY6X0_bBt>x*7apnZ6zaXQwld~CFYE*WGEzW&7(gA^O66M2@9SoJE;->PMJnqv zp-$AUli3fA^q@Z&8yUoQavxX#%Y~q$WtX3y&w9S}3|ij;OisOyn4+NkjpbYZi8U8_ zmAH+%Ex6f0E4%(F@bd`##}?Dk{An@2r|Uf52k}dFGF(P6o14ISd|8nx!@TEj0b8rd zzSbBTH+&*(qNDvIAQH;FO~roXAXU_^`6lGGqI76vTxd&W^Exs4RgDcOoWuDZTH30s zE4@ZeRZRzK(XojhPbpG&{|nw}<9^V^a0purXEaKuKJdYlsvS+`lj!R3|0L>#c1vy! z5+cU~DzNoaj7xr+m` zI$}IJe%q%6c{AN|fV2#t26bu7?8BswLw-MBYoTce1kpBwQwEu^5Vj?)=`VR_CH;0n z0lI-vId}Av$jO<9LyTKR6Z|-^ZbfVn*>wbVCH~2hM%o9nZNFC zoQ_fZ$}m`sF7-5db;(>X1bdi6CyY_8A5KHBxX0X@h^`)9%a-o}SyJuB>YU7+-^@Ny z%lH<(VN>sK?F zwn(7`!T6mip@Fd)co)~vw;V!+qRx!^motGYVh|v==akDzWmS5wylo zFwQRZ`~FolSALy6CceEzLH;S69l&RW|v}>rjY!^rNE?oGI|h z)iMR@=G#Z6&%uGjM}h4|G=t3pO!jI%C+^-ohC0MW5%B(ey=_tK6Es_VKJ@jnCfPvH zM`B<>Z! zns)W-m^Oz}{fHMNRZc|mgd)>GB@LZRi5UZk`lS?KYqfJNAGPA%1ZjV$hrig2$r~3+ zRed>^^e(`17B^DWJ({3VEjQH73VoA9Bpw#=1~hHwIa;jLgbOtdDsoR!1HmJ3f~!EI zO<-uW2+(QL9~0er9unLOOHH*CfZz^QY$WTmTPqON#iS*sYmV`q9z85F+`2GK@^oLU z$@**ClD6wo|FvwJTl-}(eC1f<=^JKqqX7!MV1lO#5Z-0 zP)>>Aa{lp+dINn=98ge?KP+TudoJZNk~6WVX!W_6s7D-6O7fklc+`T!MG z*qt;;)0-|ueCsAxsA<2SSxW0t*BPa8Tls64w_h|)zkYy0-4sCn%S5I#fO!om3{3wD zf&-)D8^$cD`eqGk=#+{jB@QP`?1V`88{h#1K|a!X>f1WB%;G<%inTf3p*Z^T!%go{`r+?}&y&-F5wrY|SvYT*HW#eLte#(o)NpS}H3 zUV^@`@MpJml>&PkMOKd`Pe}2NX*&s~>tsN0@8^?$K1@MJmMc@6cE%|otEBPtINGC+ zK)70`#pk^i6el7$7kaKnHb$HB4K(ab3}1L+6EDfNAh40SxV9HE0YZgzP^H;viX+Xx zwVUl=ET`ORH>j2Js5GuG*_eH>3mrpi3T2$#ro4UnKN5ZB@CISpG>NSw5rcRltqW|o zg=HRre`4}KyUA$XG}@cobC}WW%Um{03py>akIvU>HIh%z+p6-;j@ecrR_>uW9Fy?l zICGQcmO{a%f~4?Fmj=p*M_UTum+<&itPBL$^d+;ge#5-iH3Q#Wf?8&86L4i!>9jZvGnNo3$d4dcmt#SZ>BqjQ`aoxb_Lv=6qNv(>xkw)6W;B#$vMN-lAMQ}EKe z?Ci|v=F=n_R&y)mP37dCuYuYO&gSS(GV%BApTNr|%s*Ac!7oCV;%l;O^pnE54#;^M zouH%ml)OWbDxrUa6s@aED`q%vSqvlf7eV||57%7p3RBKL7a50{C605qcXDT;y!z35 zlK)-PyNtSLW}4KXY^JcS>8V9w_(sLz2?l2Cc-{r9V7Uk>spi9ZEcl&^82Pg2$?KSX zZ3IS_2*Y@r(71U!*p6v}J)d$GyuDsc>$+N2}DURq$o0p#e zsyp1G4^<-1Ls zY&Us+XIL@g?xr!|>tBS28$-%axAXhcg9a~Ic!)~raBnaQzp49h?<7!%Vmz%*XYQ?!x|mhMVP=d&Pt-i6^6?9 zeR3{4HZ|!BnD}c$ubMj={7d8GhV-ugM&t8H*x3FJTxRND`uA_3K|<$0)V}N7Z2Lx2 z$l{l@RP;DUos`>J-QL24)fl|nYhaKPtS&rqh{T&ncxVRo+vtvv^!reU2MHodwWGUe zWiS=nM;^17*>cGrN#(ahY4we*ulPmqr6qV&1ve1-k}6xT_ad!D(fi%rCR-QJuyIcQ za5@~@DFTiZ296XcM}(7qaygr`9y1Kr=o7Npp5m?(HNFsVSg9U}mAM2J~I7~n(s51S4=;RhQq?O22%}m3bU9o42yF0p2 zxmN`yw%G2Qbf~tUnpylZb^h2w_OrY23VKm;Tz+!>v8w~0e+IsN&Ku&>T;_$NZ-(u2 zGD6Gf1`?jOKA4l+Uq0}8Pp`!_cem5T1WToVg^d*5ISK1A?%NY$AXAl+jL8EF;tqM( za}kKm@)GP>msbkK4w~~u8obk@;c|^&o*%XTIxJr#wUX9MzVufL5T0w9fD-7u_HAy0 zLaW{!i&{xMiJ@PFlLCJRR&%@{OdGCi1gRlLa`x*QO~lnu&DIY9G4SJ4Zr`_02$z0* z_t2@HKPlum`>-AW9G<^h_&;R8CHjNB#dDwZbr2#s11cfK0+)x3b?rcs)8#w!&9n!h z3%K;W?TcJ5@uoVZfY>|2LZb9GIYIkXu95VpM2v4#B51`3QY*4Od+<1mzk%$xj-ax_ z$TX-?ep0oKcD!XBUSD8Yc2P5*ND533^Bv}(NxY=ouuvzeYO@zPJ6Y6KyLkcd?>F7L zbKQ1gF_b#S3ok6XocB!rM5417zYXQ;p?utBC*$4&GLwTk!nw!5s-Fgc$Cp?kcj%X^ zj6Dt>Pa|)*Fdd46ZeJ+FBIR&ws|dDtbR)w?{nOw8XgGSxH6M21nOg+rf`|1+IfZN( zK7P(Qj3`is{(%w73XpUHCSOm^jr73kO_m@-s*C@u@`CwMg*+Wt4=?#c9D8bVjpX_} z)6b<`+i^2Z&BkEuY-2npuUpd1ay|BOAz%$!*SesrYvOcDF{7)94=m;0EneY8yXnl= z5Mi{Z&&X*>PLG=PbOmhVAtaeAdu5P z?iGV?mbR0YQ%DMA{T68R6`6bEphnP%X25?0zt@f z95+gs+{JeA3FrO>wCSg!-#(m4o$JouY7ezL z1{p@(>K2yz5nH#VB{}Q=l?P1lyV&Zbn?pV432DML&(_q1jUz&D>6Z!gN4AJ;Zhw(U zOuvU1UnK6>Rx`cvdsfMP>*sk7r1RdS?`C1RQ5T^2|P0+qP<-0%KNK=EuQ8mi>2i(HnUV zXdD-TEwpm5;{tX#^lhqFy5JmQnPWpT(1WO zllP|IeP-*J43T7%E|#SOWy44Wxf;bWy)JG)PHpcVrY{1aAMbw*)r<)&M!tN5PpnZ4 zrbB!xC=964A$LI-WFp+c_5V$zYGTw$Z_e^FtLKyIRdn4rM;mWEq~;?9NM@zZo+Dm>Z2+~M zb_a6xPCal+-Ze0qKLikdehbgNXK~UoJG)<#VyV{Oa-S_)9e70;-yt%gl)lf12QqFg zfQXAW!=b%@oA0@~@JgyZ&Mur8{cVQF5uo29fooZ|(&p|MHS0+Iz5#; zeH8Rx%?h;i=;S99Peh%03w|uJGN2#69jVMLk3r_q60)DGHEPL}+twz!$=?-pbGtiD z?z=zO7b$~H1C5)dXdKM)W{Yds(M=!D@L8#)B@?AM<8JOyP@4+x385)RR4@G?u4KX> z%6uDJX;#IK&2BRw)llxhfVFT3@y%Ff<|B{zTX%4+MOpon91t)AfxtY9(t8G*Ni}K6 z17b6&W$|vLg@|salN_Kb9wuX)DQFROGS_dTz_0CjfAHi5pq0J zAkyG-=i;sj^Yss%y0`9B0b`H`Y(vOa!`5m#{hlZFU$uuFSl5DZDXi;qHhkEao(+0! zFMU!ZLaD&3cq_}An5aq02&G4P5b zL=HDb`ysY#^jiMHi{vx#B8*b3c&17M@9cfVJGG^d@I+AxQ5iciF%*%1W<$)_emuW@ zaEfb=S3GeL005c`1+PHxX? zi}GwhSu06hY4#8rbs-IF{9K%{W_VTKWQEPK(~P8f^=Y^jbj;ja^Ws-%&dko>kJcCadOn6C!tRUW|cyVhV0lDU^z zz$b-7UHWvE2cFu?%0)3rm?Z>>V^q6-isrTz9U2{M`P}-avRLR`Hpsi3%l&6Qu*zik z%VefqIUaHMAXvvuhiaj)Nm<4-dYi74}`y z!0muB4G?mX;II5Fa#kB?RG@C}e|>|3`x7RKzAE4;4+O+PQ%$vIuVP;tYNoJ9KHX1^ zw@+x$t@fs-8iw!!Gph;bQ=m10+C3LQ+*OIJp^XI-c~xNZC)vg3IzU1BL8(r}YZ>aQ z&u_1E;JLz>3xtP{A8`osCOm(F(>I#MWF!l|(F(k#v9~Okx10J=f%+adnn*7%i|W#= z`~y-Dhs)Lfp&vp^o2Ai5sm#1LV}1n_($*6&-)l=LyNF3fC;q7WMM{z@+?b9ChLg0mRJlS@YY+=ip*!ex=Js=8a#Fv@-CA6 zZxKN>74(QaWzwlo0EIpp11DOV`Ufbo{n~^9vg(-`m)HQeyPa&S{R0XC>r}EC*M^l7 zz`P7RMYZ(8u2_+@Akry3JHTqGrVXPb?C)$foixQs=^$y0=g*TG9%`FA0{ze(?&M>x zZrV&r%c#a}Ar0YPk;S5}_%WM}I?UpR5cgXD!r}7&90|N2nQ*iV_NCtvd~I+3hp!FD z*&p?W_(#HcbE8>egg;ye2ojRH{uYS%W{(FcGNq{%ZEUk0tyK5|>7g}zSPv+NST>(o zmy)UuIzXbz(;92rQbrZZZSNpJz19InJ}|m2E?P5`?d2lQQs~9u(=yFxc7wQbKB2EQ z6*JLTC%^eQh_G0Sm|IHv?GnYz&^67qtALi_nWkk-&{qJC?2MzjHCad5Pe>5|u*@3a zof7%w{RL)r#4c2+_Wq}?if44eyUXhRPlu@=dBnrwGTN>YHYzRLAhz?d#roHUnS?+= zVe%Vj(yJImo;Eo&0Cs5^4|mbJke|lKz+ALDd`{Sw%0PlLXfL3%Gkgq;>RS2EPVv(G zqBhOqPo)192}~4wT7QyyLt-h(4~hf^(fSU2!Rl-U1o7rv?bY1*xeMkLj6X@zAT-BBZ1%oBarb>NF9D|bZdJI4DG*e5Ng_2n)M!~#(*H6FYJ06%{De|=weU>fb& zKx!o+qsan$^S0wO!8?4R@dmYN$`D#lDC1aCWJbG{5*$tYx|cx2s^MZ`AXdK zTb&bJ3~|sy1$s^re}UH6Ck>eiHkAGb&IsGgvEqWg+p_x=SM-+PuJt?bQIuO;R8rtg z^`{?%%eH>i-N(aSEIt2_Sp8^p3(n$-4RcFous)0A(cr@>!1Fy$EwVd3G6xpf4C|qB zV$XXV@O90;`Sct3vW!NNf}`ETkpFP5d`uRzd>cLAgTM5=rkU1$7sr;JW!nroIj3TH z0OI9(hq);16o_!NlS7hnl`X&&;BwzfhnWvcA#g2tW4&jLO(5b554Y!Nxc5v5P04jMV zzcM}%bFcwpbQx0X=^Ait49*8})ItKGW`m#8hy2J*puzL9lxS2(j7m**BT9$m32FmZ z1fHvj)`aOz0ER}1#nvga%A2M(31p$X->&=6YadgyxX7n9yVs;n6Sp#bkbwO8JuUMO zFv$U*BtJ;0ILuspxtEub_5(a6^lyJf{gl9kc$BI2bb*%DR`5m;*i6508f?4&vb#8B zt?%*WRz{u1S>C?qh1u}L_=!?XI9a&5aDZk2X0lzboD_V+OXcijGxhbbayM4m(=%u* z^D8+HmN6o$4wTf_agcKOM}8cl&hYuCc>3a(#AxsgdAxO`I9N9E)}->Fz1`fbDmscW ze+yQp9#y*#bN#$h;@{A#m}tIZNq-8uDa_AovX=23+U{DrcB5Ls&ic=My1U?Y=d-Cs!pnf&TxnE`OFSV8qs!8ADr(9KZPl5GG)!Fa1 z=7@K(e8TgV*LbJI!uL0_06JFYnT@LslpD{mDTgaRY-@q^!M%x+>-{_eNFDuy=w<~*)w*XH`06&TCdD3+wLTNsPa_MXrIMh0jDWZmgkmKEO zf@sM22_ZpR6mdK3cfAR?B#pCRgdojl8VWUGmzwU6T0IH~uqbiwku^0u58Dg@#Lw8O zQW^6`=q#a90S0|=pGdCUfhzs6TlW$p7P9(G5CH{`k4d0CP7{@?ueVMgeq-tfm2YR? zqtvU|F|`vb{cRrLggXge`E_LqY>%A$+;+uC=dHxEaFib9C@UkkN%#)`uPN;aL-q>moUy{YNG+hFIqD>)@pc4W|~< z=fzL?I^V|Pf4Xq3_5(`>qt$d8w3>!tYNaicfQugu0-K9L03a0`a=jAdaDPpYfy{+A zzY`BYPPO*a#Q&-J-3%HJ;FG}{cN*_FKh2Axq#m?jf5X9$0Kt7TFG~9!4+Q%lwUN&z z{C;8~%OjU5J*ZLeb^fUVrtej;{1Ca}GrZ*(M9l#(#piSz=LvPJ8RNUu@QIY?-RESC zx(JO4-;kuegc@%gmdGN5BYBooNmt2YuK0`OQd;qfV3x2_wgZ4c&A=SUgdv;#%)Fha z1ESm1dVbBW6Lu0KU0^{(990Eg{QJht2n}D4ftg{mZ!y0@utgYS-Zu^gJ);nUbopBN zSa6-fi2?E1dX?a)2LO6A?yt8sxQG5yJ*S z(8&yY+XOXx6Pm+;3b>t*N+IswcO$3(9 zyoG0SrxjOOd_!!-Z`_QDPX3a;lk&QLf;Uqlz~SZT;4U_kN85BzbbTwwkx#e$v%L;< z7!>O08(bO%Cn+ZK?j;2LT=@(42@vhang2W^-$emwYJmSP*mj0&-mz*ieGIZ^%HP;_ zn*ed%>}PT*wAfScT@ialw@I=6AjLJmdUM$>jvh7merfat!}=1W@UeriAW3sOEXc137Pulg zrxc%+LTN#-gb$M7$rA{kJRWRJnbXaFeGZ)I+98WnUb7(Ie$l}aySuSxlzcklzO8lt zXL;`?%T~G6b&pTmp+Ssg5+V#k|030i=f4c&!z<=N3g3$e2thG~%v&Gn-d-F5PV}VO z%$zB_2MOUq#)@eZ!MUZ$xfxW!r*i`Nmv#?F&xIHfV~geFUJEo_pGX3iX$wa@eExFV5 zZ`fzCanpv3?s1mCqk})I)8?M!m4G5%(_U0`I=CmBI82;zYl+=+w<;m%XA}G4n8)}7 zDWhcH`X^@|fy~4{CjTtgfV@Dwco5_xTAGv|qhzIAxE4(ALYds-ZR6aI4ET$505|76 zDNs#sRq+I^-~l<0sCnjl%Y#}o@DMH7Qm8tD@4;_2UAXnVmzO5-_%&@5@mI{x^i3XTgRE_Y=Sh#Tp4dK*arR6nSBm&t;8vtLJ~+HqPITgP_!1blD2@uIaY%H!Y_BP3xj zYU(Du0(2ZXE=~qg=1xLP)4-D~WMKZ9Nv$)4@r`n@Y*D%QjbMoNztKTF(x}Mh4sIWm zE2k~4E7Au*64hEC1hOX5n4ihP%o6C z&I#dDezwbU9&~{k>-dE{Vu%dPhN!`8kvEL;ko~M39$fvAF^4}Y2uT@~$I_~!j?PFx(r_Y}R9qx$TUCv?% z)zscref0PGZuk1dC1WaBNh1umgucA7V(-wQrhS71b;8n%C88Bx%RZX-!np9TT0|CJ~X{yu>%$M)+iY#5zRt93bhh1qN31(T=^%&6ITPWW!n&I3}zQlx|U*T=e_I zdrSR+5&JKkgphes={25psA7hM7#IHW;JVDUqeP(Jb^S;EF0>dRdMbBeW0+CRFOE_3 zQCN&pA9dHzTkPJTbGwFqcbHrzA3o_F;lfq!Oym28@Y9T45%Y$kf)`&bKE#xg(A6+$ zKI6PD?uPA%*>+Meec{;2v&k|PXSI66PQJ zgVGM;UgYpQ9Tt)9fdQH$ z!*0#qz_n|$*(`kp!u0rSS;XUD*Y|MCRXZkejusxJ{0Lqd-Ep(yDYp~Yc9{0(xwAvBm|wrbp0o{hPtKxZ;;Pj;LBqgfw{EB1JVIG=KF0GLb?vwPWJ8P zo%W7EV%iK@$l@#VltTdDAL-l?yu(-DfpZ!p`$yP8 zJKH6|>qDo(c580b%AY-m!=%zp5Q$5rFN8$F^|BQ9h_uw^eqy*L+lf7F!RcNS=5Rro zt~FI@xJ_mDVRQuV6|7hTalt|;=T?^rF`)~d6N;P_E~adhH;Ysf%z5=Xq$E`}Tb@iGet1VwZ$oD!pgPsm$Ogpaf(S z$I9G8+&V2RPot{jyG_Z3htsg++T>Q<2@o_k75dR${WU@+;M(?I>gPUyv01$K$rGMl zxF(Et{f$-yO6~^sBrW1(mg81e3}0_!PyccY=AAv|>o(>e5X|W^3+&Azpmg~hD{r^e zhlOY9dX$Rknuw?72jU-_G_iGe?xA&ex5}km)_Lm@ka-_G=}qN46Omu`oNyL3Ec&Ay zP&c?wFuAX2LB)@@t)1=nke}F`7X@pXytCg|&YTGRN)6g|&A*$+}lC-2ndC z&z3ZKf9EEaw0&(9m+x&h_r-*=;iT?D&G7Y#{?}ewLow-J-pNVv9oHhe>Z4Vqs{xJaVlHKL;%9|R-`aWdU znT1+Wuer z*QTlO>^9W%SKsMlhmnH3tlaDY3O%3SB?@IuF&dMnW1=B3-D&yz+8?jB@6!Nn@Xlne zp~~#nx1fA$((?-DO2X^cd2o-B&ZN9bGYN|X03ctTTbhYZ?T+1bHTu`rGEyD9czzE_H=*yeqOjQ!?_~4 z_|=bpazDY0HxC;B;9rq;NW+A?63!}LQDrWtzAlx$Pt@+zRSsFqd~U1fzP=j4(<&h1 zKF%3clM4Pek2CqV$@l^{T4zj55AhJCj2d$6Zws&5sDEx=8*snTVwQgO^Ao^yFximl zE(I8N2SB#e`^d5y?U#0rmd^Xlhij3q;mgmL2n77h2uPXbP%hj0_8f*;p@J7fGn)D-_=2e}J3vKW-ZglWa>E|!^mbK7)Xu<4 zRkv=x8>sxN(-QDIIsAxwGKa(iXYfZ5QUN)B03}t9iTe+&21owC;2g_&e%ADa6Ys_z zHAHDZ1H_eX@dhW$5&jGrl1}fOWu@AMq_*; z^l7|0YVC`{gYFKQ)D^x(LD^o`bX0sVB-bWTq4!NMrrF?=7_{t7uGco*pFk~lx~K4| zqDK4u?lm*x3tM97pn|j@LQ)hre&77nc@*@909N+4Xgx5fR51Oq2Gmkd)ol-kT zw?sgqXXa~vp>=i1z_W4f8U{J0yHphCG9&q9))}VIhmX63!y8~*3M~11K4QvQ0YA}f z8X~wFVx0|^MmtKQ*8BX{pFs#vLeRhx5NI9bpm=AD9*B49>z?Ew{+Zq-#F6LL#rm&S z`?s}D$M}7_s-nk!<>MelLF!HSZ-iYq!K-n7-M_c&?GTGCVC-9zlK}$zZA>;FKQOlf zBG|)hCZ9U9V2()7R}y$~8bs$px{Irz?9xV+KxFAbi``gtHgtGG;h*`ye^7sb!ZgiE zfvmaHoVD|6Sp=5JhJpScHEonE|1=TtS3}KORRG5e6L5Q7DDND$bgFsOt6Qy`1)WG5 zK|sMl@V{kovkyv@n|v-6RPAqZ~`ue)@MG1*Di@Vc4L|J zS=qMy&Y?+vtAQ<)9o74>v7Zp6!+VVsC<6!iL7(;zbWQn-L!^-Q zF77Ztf8QKjnop1(NCccvU##Ob2lLK#Weh$X37cCgY$63p{@hClIwhGl!zQd&In?h> z%eg~Xk7(c%sX^p$yqFb%P@!PEwg4d@AXeyp198?2&D5R104eHQk_fsyX7EM~`LI@4 zu;$h>C`!P|O#H42VlEJ`@0a;~%*fhzfkP{0axeDgK;NoEsrFjmgO8uA6OUumeL%yS zr~51}FByKCkFcF64El1oDP`230Ee19S{}lsHQ{Nxy!8)zZ;hs)`Z|n*p%yc|F(`vz zD2+8Or!G4SOHCl=0Qzm14ZP)mfN1CcD;A5@J9oV`J5Zd9c=Sz7(L{Y`-E5`#wo~5y zm?m%%j@56iLY>;V%;<;GCzol)RnjnSKW@QHGH;7_OW%=*Izi2|ZhdYV4?&UMlg4Oe z+uv}DL);J1>X56I5WJRoVzF?>fxJ_-zq)FS9w^z2NaLQ*Sx(1_|oq)@~4A1|x zohD4^4mH+Spp);~DG`TJ_~e0KM(CIlylQ~Y%#$WWb~ar(1J>-rE}4OUyTQ>w7qdg^ zVCRL^aHN*I3@#p2I0tCb`yt(F%lFK?$K-PQ9Ow?xyvEGWrqz`(DzL_{@ExW;-pen1 zOJ08Qa9^vUq?J#|q{&59smbe#+ z08RB(fJF?#q6WmffJHV7X>N8_5lc4LWyTcvj=@mId5{M^wv+9k`^5RwXZ`XaVTwpu zb5S&us)I;|z+RZ~z=z#jBEP#(wU>YH|6%RDqng~dyr4A&37pApjy)XXLQLo?|xKqPG8jZ8F-g7b}jdT ztFPty^Q9@P*M8XS9OvcQpWIHvl1DtMUhZo}$Zv{LM)tM}7G2SjN7d73ja5;P*^scuNgs*@2u{^|W>o8qyv!_OZXr5_kvOndZXzyYo25P9 z0#>P<+JA#ZPJcO&Kr$6gq+4G6RI_wNy>%*Ose4`bt$4NWSLHc&m8I+>rm}g*y_XOs zY_x*UKKY1#^eU8UZ}|%?&IhAX6WABh;@IKiQuS59e<%a@6z|CQpTA6q^}HO(E3Lag z=FuO`X*EIWMA!E`q!i7+OT*2)(`4V}I_6<}6+Jaz0` zmSnKGTh~waf|)qdMka-!S-bMhA6SQ0KIWnr%^d$b2X{ z2ORn!%*i{bQrj^6P*%u0Z`%#;%v%Hs7s(A#YPh1Jv>7)t^73c z)FgX<%FkT2SxF;kqIPBppSq+><&0iE$EL`+-2KQ+=E{(ySKRF8DN(e^0p2`93SU+? zqJBv5TFcp$@;2K|~53(#|~UoR+QfYj0G= zC(j?Ml#P1()HjR%Pdg5hCc>%#x}kGa%8PF zCDV7o`Uh!RqUB_{pw*WE5s4q=lz5IoH0R*z!xIl3n>wLwHCnxlb+!!H_|CMUUm z7d+Nms0Wjtf9HH6-g($_ezHG2l7n_WxNXr@#ws-st1PIs~= zjg-~OD^5#AN@Tb45E4EU9aSu&c$IHa9j89b-+L&^N3gElGb8n(jN(B{T!d3Ak=WF2 zDZIxxa5OxeL76?lxbgfwazd%5hYL3;S-9B-VMv_qvPoF$SVwUG>U~8FjBY+vC77EE z4lsyq_F(-0<-OY9r^ihT=rFy|8AxA5oK3PHTf7CRLA_n zKPO0`jCRZ21@{bh@Gt(FDqADXf~Y}3os>XBvrH?GT=vsT0@(5-8Mn%x(Fx8%A-w=`qjD5X71T;k_1N& z(Yv`|`KKB+Yd`bY_WcwTeypiff?=e>eu7KJXD&$Ca%e8sTB|An!iWo9+kuiP5t+zn zAgNdXx?dh?==o+p>P}~i<>E!1&(=%i)mP*Dp>saiVsqr>`<{dFjYr4&Imey+zbqc} zbl~p!?FXz1a$2?V(C&z72bNEo3Js~D%ZH`K9d@m; zdmR1L+hm%IAW0<>2!7{w)XA*NYzS1$T_VRbQ-I~j7s&GpF>kZy@ur?GG*nAZB zsz$5W^zB0Uc`vQrK$kCn>WfaApKQU>Y{a+It!lEJV7_x4I)s(CZiy1LA|1lGA9RCpg-%?HH9>>zWjzCGN3OPkov;a9pHjInl zPP&E)S4^{Z%?TWsKgTLHqnspcuCIICe{`9GjMsZGeaw*f%HuLPuFmZr*HGm1<=z|Z z?+#DhmdFJaRzbTGD-Jh~jp;npDsiY4U&)vfHJdFqr`}Ot-F@_l_j+ZEi6)xI2j9nN zn~-H`4D33NdYlr8rLlOflO@KzF~yN?Mux54STf%JAmh=z5GBLwrmnp6-Cvi>eW`^-st#Wzi> z3s4hbQ32uv+OUOg!waP{`}xkyW2l}ekB%j+y*;}0j}EvVoVFmP^=y5Ya}z18p0^+^ z&e!q)mHRIf2`}3McePdn3Vsvz(lV0ES9Ye1(nrli-A8G+MBTsKQ8g#=3_WsQtkykxnN{ui~8qIjfdT& zYxQ{8sB~?|Y{z5qZhwaGM~DJpat}H^KBiNO@4uNKptBoLl!?T%ZQY!v%oDA%s4059 ztOJj@sv?xgcTK~wG@U=MaQE*H!)92l?A@D!@?>dh zKCK(^-omOT6&}wHmF^Y&bD|vGZD-zMdole;&~Fc0q&3i8**7aJc3TR1W*KH!2kXwb z%EKd|jqj3cFldAw0@XC(PcnIg{-{K*WiJm)!AD62;>63a_^th_vqrMlGa(|gI23~jy55p+XGQ%Lp zPOZEhKDE5}7rC(r5taMOOBxwRs!GTin6JXr);8vdJ14a@;+CKH(oUlXhAJJ@7YPZ_ zR*X88SqLlO^^BQIR)q?PT~|+WDz}~i!jOSUVgB~|m+j--x7k;O%cBncfAJmv4Ixr) z#~cNXLRQb+IxHde0crjj2ca6_+>8#tZ8>_T<$-o^eyxkW&`(V5kJ9NNY_7Jt5}pX* zn$biF8&5W@OrdU)Dr_-@m4b2v-o3ELYkv4k7C0pYLhhlQ4(&}lyzSY{`KmfnhP;j_ z{4`2^k(4U(RrHj|SWFE+Hp&RQ?lZ)W9uPPXy%`MCy^HNt%;0AP*rfXA@L%ZEJ?^=& zM!q_PrV{&Guy9Jh%67o37aVul0>CiA_Qga`)XtiHNIK%``P?q<%|iZp2@JO9oMj*j zC383kR?}VY9|Z5A5$^`jD_>TXt5i7WmDUoDN3xXg*u=u5lPve0U9t{h&IqRl} zTC|Y6{sPpKxbspDy-`qPYzz4dITJl%2v23Sw{$PQMqGD^z5$(5MJ+kUUaIotVja@^ zNEjK;`)pfi4hu<$(N{56T)R{~Ts_`);MA&falIE3(+WT%NT_)k%spbm#V7Wc9R6&QOk@`%enG?X}PCjK4YMJ z^}uNVg?-a`fK4%tjf8ad^@jY#XBMjdQ(rUoM9_wBBLoVUFIsutmRa70OGXW!a8axJ$CL8@Qtl#tr7 zioO@Cu5fqkjaFTcDk7G9B<&4UAa3iS=pzazl$%5qQ*%)J_n6Oe51uag+)X-9d@MdY znlgvQX{ih~eu(J5^s@RsqtxCIZ8B4wPEyZSQ#XGQ=kyveWA$JS5%q&7VlO{bUS(RU zzs!@YfJnF_Me7nDf!i{06_Eoq3kO*(W^m2eDaZtcV_U6i?BTaK8Te1>_bp;-0^UCr zvrticV39?4f<}c8Y0iN`Y1x`4JL7OB0K-2(QZldJd35_KLloTwF?&pi*KNz@=Kb1<+8CJ1*dpM91@qK5xMyE@$ z++0QB@62^?>YlA=`N;Z|-6iVK|bYX^MK6_~hntkni+C zcPLy6l^Is{<^mPowx=rESpCy<|^?@qd&7_C-TD!FKV9 zNV@ZH`@fN5PYnU`(2>B*Y;5m%+l2!07+V(z#)3KS`<{TP6dTt_1@8;Ta*WIW=loSU zKB^q7$vX^bxa*JFD5PG6G)LafSjsC2 z@($q~P0x`@nOHnW1$@-h=?XH=E&D+*N(2r5oD%}OWUw`VaCg#UCfMglVsX);nPfZk zfd)!7sSeB^n3UFyTzb!1IZQ+AO&l0}3;s1Xra3-x`_bGOuhF##|1&zC+*Y;~*dL$? zDBAuGAekp^7FN8dhwf&bzOKt4CQI4OSNfmCEpabyt&mHHB?masD zb?ReT#&nZ_#Ds8gv`kJn4Ku{wh}E3l#vECW|HwSVr2~~$z0Pe2VXU#zn~g;$gCNdI z8l0>8v1P$~EJS0#3z_dW3|q(M>m$9(cu=3txv-5`JSgP>gw2ieP(FS!>?d`=zG6S&EIwHKJ*S_t&U`()YQPB-4~Bbm;(V`S`p8ME_8-|HY@@xUEH>A90_j) z8LW0h}bLT9c<^StbEU1qu(FF;MsQ_p)&9hq>* zrR+m_#~9BG4KrQ@5_c0hDbJA8cs`$$a#U2-riluJmCYFes9565n(i`1`0wkwRlke) z&@>#+v2OCkZi4z!?r~Jnftm9}VPv{X;Pe)7%&U=_`ScgsK}hO}i0DM3jE>jy$kFhP zg237=TGZp0y`6xVETXz=c>3c2NPK#G-o^k;AT``WYGzBg)E-KV7H`q`+-TO$wb__= zlJ|umu16`Qd=$~Y^>wS3o$p664_QH#>J3k$ z&xR7Km<$ym(B1Zix+9uoYA_S{U>~2SQLq19m3kMotrMQC12t>=Yuh_gG3AAD26fTk zyyw0=wPsVHrK2G+KEcwhhEUDxLHdZBA*Rx6iF>`*vT8Gz;A9DDtr4YPFsj0|Z>;sQ zFw)xF)@S-ycUdRQNgZ!Sfbsocp~tuB8lGjCaG=PbJz$q32p%o%4!y>Luh{iqq+4$m zEcCM0bN0ck`uw$#OXBPQ)==Eh0qXUd94Qf(e1`${8Uj*)6kB2KQ6}DCnrR}jR(JZ1 z4Y4V^vwKxX3VZfqpuk~Ca1%8rI|7#GUYll(1GPnhY|o9ysgpg zMT=Wc;vUylOx}o%PH>A(9crt;Nv-$+Nh|u)ZZP%4u#1js&-ABTd39<1f(OTuq-Q$e zRhA&R_$IDsAn{;OY~HPIlcEH5o{u2Fv`@H3GJmhs%#mH|*Q zi)$iRTFNnK3{uJJk`8s!hWt{1eKooUOC4!+Oa~*#v!vJ9jkMkuJt*@+kKA5YP z=&xN{$gXLTqZeVWmbJ?S$47WSR+Sm(w5Iq#2ox2tlufRev*tn$xv@b0-pXTSEVH3~ z5mdFEn3pk*H^915ezvaq-NeJ+RLX&SS0z4`9`)|XOXnXWur~?)jO)$(0Ha?p6+5Ti z8Ua9_n*|dtUl4j^bH^F&D(JzU0YTJ?p9@YNli@y-HCdodqA*FvWgna1M$&ys3}2pO zr|LDroKD%y1Z?B4iJID38cU4T7%}nrvK;7a@dvB%EFq$&lXb~;_N7a9ywr1n9=Bxo ze1cLkiOyCJrl+154A_kPEO2geOO5(@%sCBUKbNAY_G0Hg6u~<8Ph$3Gl z4Y&`-gC-AkDs}h0>6rOUOq|EV-VE$SL9Srtg-4F?Cr&+ zGRhA4+y(W{r2|}p5N%d^HmqQQ+t{59F!g%679y7M*XiYc_%iS62O!U5KavHVb{Wzd zEXdaIlv`~9EV+x<%kRJBXVy0q)`^W2ElFScQ|m-|u}?##Z>=}0ZHo_llz* zG%4nA`Ky3y?&gk8Pr0$V!?D|p8Z$a${Ngj9t)SFfKq6|au%>Atl9+uJ-n;tBPiG(W zR}i+t8+Ll^3b7^5pup6|MkXj%T>lI9_WHss=`dbqNNVECcF^=A-gapE=1}HK_iLB$ zZvF_bZHx(RNl&(^s3(~%W|?F_gLh%TwAn^}%D%zTp{IDwnP;tSC*1lPI6vb(_c9lf z7O++mUoe&gUwYMa_Q9D;fs9yV-eEz+5XlJjqt<1Ie-|tB8111J-1vFQ&wj z7jg@#H`_M@V=vQioHhwCt^^YialJKf{}|S&#nW~Um9cR zmCu;}u@=^(+q?0;6a%?kieVn>Iof1`!|&r@eEs^4V$>fmv9=xTZN z@6*n=Vh)clecy33H^ph#^!od|EyPd$`a>LjR@xdyQ+UOzrvEo7xoa1UjoOcX`_`vY z{Un&vY9Mbme4vf@0?Rcz&L^lt=iXodixjgEeZx0DMAR0In9t;f0+4<2eYHVX1#8HH z%gL64k{s7f zWEpnO%S*Wag{E4)BJWq9E?ihDN2`}TG)?^XyeWn`BaR(|Ovv4!OK%5Ze)~`BdU{%P z;$2ISs`;8yS9r{>Rg~)Uheg`8g|#k70_>EkKvv31k4&%{9TJ=^yQUdf?y(~W;=IDS ze&lC!7u3E=@2V&ih*^faE7rW=v~Csgb#MF?Yu)3l)SlkX#aSD{Ccl^L?sAq{T{32d z{`2uVnEivlJOu>FnYt4Q7UE50v~^L9qnG=DVfsjgY^UQ+K|oc44Z1ro01|CMxF$u(28#F$Rha0!)7^tkxrhi~7tW-wFbTGy8SdG5zX!wMKXh1<*KCWHPVeoDNlb+FdlHH!t_3u!gb8_4V& zPag5=+93TDP0#%6#e*_`L66a6+I&L;(X4s2?%*@(>n>_#MiN#?bpixEcTGK2cVFd> zYbTt=Yo_1)%{tG=0QB|XcGN0|v$Tf$v1t0niSJSG-*VS!Ek`&!xM$EgU?ZS-^3WI0 zZ$?NLd*mE^Wr$qoJ21jKG=i3%D(i%(mK4mDw|ulToLpm{$rsGPud;u%3f9S}6zoVn z%a4BIO&KWnD2fJ*up}>3oZqJqqM2!Dux@>H+(aOAMcwHIX>4Vn}!kn##S(|V>n1WsKApMm*|YhH1zH)a_wzau)m zVRZHOnbNc^9tdbV_n!^I_Lvs2%#`Ubtu%YhM>oD!RWUWTaR2e$bjjRx%|={YODe)> zu^h1D`)K;xVb%`<$On$Zaaxts{nWX+qBNu|Y@c~{aC&i0aycSB0R+~MuD0IYS+s)P zpNHB}kigulNV>8CIr`&;=T!1i?qmXzU*lh7rP(edf8JSEdJdzlzgh{5(o9A#o+K!E z4G|amfqhZ(o;g!i#!ZT_E?Q#ufAYz2XLXC*#+^UpLA$;6RL# zL~rhrn;?H_N&{;dbocoG>VbS&PDSAB518+~oLugz?EA&7eXt8s+fIB+i6+!pB%5*I z@9RW|NnM4ltK^ELP5@R59fr-tzj&)JJZZ58l`V#E#UE zM(!gkMlYq~mI^J2oa8M3anJfLC{c^yblGsKh^S;kE&3^kCs<$(Z=Cl9Lt=Yn3(@Jz zUm`An3^l?=Il|$Ll=+*3D)Ab*^D`C{wETJTFq?hxs9U`ynS@ZLdMbWqEK3F4W z<@G@MhJ!{fzlZDDzW4|PzZ$9K5DY^FpX&{< zBmC4>36CIh214{m!@P6V=$pHcVCL-o+#|cDTF?2d1WLM(^!xsA+7gCJN$|W%`-JlO zmL=|Gn|Y*zn;Zf~id(iV#a1-kq(qIoDJgwR?*G;sXqq}1CJ?Uer6=p=;4XjVgmAqq zLLa~b95N}}vf%ZLgiCoSrwP87WL0hj9edxim53GZ^*z75vKSs|-Wc0u1=4Z0p@Y|$ zLWp776=k85|A<~{KO#f?-xM#x#z*l5BUlV+L?#R}7Y1FPbM$rz@z8o2HIQmBK=tz| zNs&3Lp+l?v^$3cQQpoU{W89{7!=pwKEVcZQ4qdYQgx3$j7hhVASz%~hMa9kqhDaUp zu#7+8tbxmf^jbFA&pkYKJI&qPZcDrjqUC7ePo=d)3GTc7FWhz(bieymoSZ7EGVOc# z>4?;XK|g&q)^ldTkKQps!wXQWH7R=&k7|1D`K?>gmpKn7>u&LtFsuv)B3x_1M)|#y zd>?MbsOJ4hUL?oqCHwh{o-_%1N=mh=S)3lMlfP%Bi%`bH}XLRGo@@n`~zfq<vD+Ieh3@enDJv}u z)RFoQ_}FfskzjUq_ux8jQe12q3QQ$3I6>`xdOz%^@Y+Q?S9N@aH~#wz5ApJ$<@QUl z&bU-jIZ-%hTz|XbizJMO5hLhnqk8)Hzrq#(l%b`7yBW17Y>RgmxGPXi2?vD12b8iO zdH?wNo?sQbtaT=)6{MfJF5O@2muW$5U5sT62uq13wuLnRMp)c0JTWl>)Qm&jC)AX9 z#$Voqo4lP@QJGn{`U+x9SRAix=V9^x^JdomP;2|K-)21mYU~NrJYj0)QG-nu6X&K? zl*&54!3EIgxHT^G^o$3N(Qx`KrAYeuZo(;I72j6V7wdI87C&AgxwjyLP!xp!O5`L| zt8@W>C4Jg65#W+#_hzL@fVKugf^e}WttHxsuPKaQdJIs51dNR9JmXlF z;SGyk@Af*mH-at+F}L}CjE6$<3@z_?8gKcC0oVe214L9iGIz;i~k(0TDO!zsnP$mZZ{cDXO>1+uXH3U0Op-KIfQFP!X{ z@}*TNfr(6|VZTbQcGsOY1y93{Nbzz>2^3aWUh(M+P(+Q!wID+t>-ku;&7zRu%U#diP? zw7tDj>TL7C@M4Zumn>uoDI~aW_rvmq2jFxzb?x6b$>zL(*W`Wq>6|OD@-Qdr$1G}2 z!Yf6+UN4C_xREdZU>4#+AgsrLaGhbcOKlA*WsM4NF1xvrud&?wxu)Cj?Egb)S~J#c zN%#K(%Nw2JNIV*MOR85_!$HU=3-+IfCz#*y*1i;t@7fNHp8eIPJt!SnARf8ur}c<_ z5{j2;iQcBBX@~bF9%V*sIaK&PD8+b8soZEW%XO^IV%qKbYRNSXxl;{n!@jVBLeZEx zVxyCYDgT%V zk%2L|xRhs#kak;uU~my=*dTeEvy@c!;rYch+S)KXll?*$huhzvdY@brC2;dYF!v=~ zRFsn3Lhu&U=VwZQ=cjV`s;RL5)J&YMq`~?O6str1`;D!0+76k(%HzZXDplA0hZ*ad zCT1m^qm-vBIrvs=q~+mjnc!yR8CUuU28rGG1U;!c83~K;p6>|(JtqQ?45Xv*irT$X zN5eye_8HAUierXyK%4)O@%+HERsHTJ^geGau6fJyN>vZ0iaw7TWkly;ti5elFkN?U7P+bWl-@`LVRj@|i?NRnuV!^0jKSLf?sttcW zt?#bGwsb6I?^V5IRKHMNDtg;A8G=PS zm3t}VZAyEsvM-Flm3FMuska=TiqR|26c`4jwjDVpQ`Ef+JJn zHl+S8G?yue_A(b0Y5FMVWFDEG7H_pas=O98I5%AH*M96;!X0qeY;z5e)&Y(Q2Kkae zcBZsU1ltfT!sey(;uI)eQXZ|D2q>1EO-)Y~-~F46Ag1- zW>zwK`1sYPiGLyVulV&~4@mvEFIb#YnN8L6=FKo$Z#$7=6qxVaoflpunfMMt4%W;6 zke+E!qr}+x#S^q=IZp@56~%uudBDRW>3_k$84>j$!=N98>WL+d$r}oTcbQ9PVNQ#-jewf8HK1-2{RXE}4DH6}zcCjx8CbKYlAP+a# zv(&r*K5xcIfVDDqLN;x9m(G5l8U2iyL1x*Qy@IxC^32sXRdVJnO4{|`;|_i#mW=+W zpV_yzd*W`#7x-epWiDDr&y}Z2r}6FwdzS+ToJyW#THy^yk2A^rHWP58HeAyLa zjOHZo3c+~(y?&`s*l(+m;r+F;!5*<=4p-m2Z@JOYKYTU>oY^ty`VpArvmiwm=cE4* zUv}A>da4}9;Pfb$irxdB|i#6|# z8D#@sBy)uVP&9BowQko{RDT>NT%!eiCr-nG|DD&;ibf~60-WGN_I7sv#U8Y$f}H*_ z(?-+3eHhka_n=y@BXOC6L87w~L*%Cvsql~-y|0;to<&0N8;RiXWOk+p9CM{Edn8#m zDd?jwib7YRIvD1)L*?dt$O7l|jGWhadg)bECYUNEu?3%%B5rWD*Ra zBey@^>7(Or4VBvE4{p3&ys2>e>@{D9x+dPAA3G{4rk&3YeBRRW#SA+VeZcLXFY3CD z3ubuea_oxV<_Xq%(H^CcKbFg}V}DyND}d!PkVo4?Eg@C5ujkjHB}2~cX?&O5{O_1R zsA4=2N$+OgG&#?=!(t%>pb~#r0);d=Kwq?9!5E7ho;t${HAS-EB66;j4Yfan? z7Lu}XLW&sn|3ft*%ffyiB7nIvRwTt0@Gf8L=5I-jU%e%O4KzOEd5v46;PBHmG4xZV zHAC+H)KCnBoT=Tu5B!B-)+L58B36(~4$AR^!Z>$+=gy6+7YmXih+~7iC>c{=!@R*8 zypGH|p#gdf&tlgz{9P)xMZms@m)H^vUEhni&&{n=+@G!1zfiBJfJyjldVT!Kl zh=)aq^S5m;5R&k2hD^+A9%r?$vG92>c3(>#m@t_!{jG;E5x<^_QV&=6-qZbK!1P2$ zVs*TP%i-<0rv`vQLGh2+y%z{*(XEiFY0nk?b=_U)#Q$o=JOk^=NUquRsx~afXRa%t zKrhSK-4;JG=4;k-dd5WrQ}PB*SGY(EidlW=>Nbpz8T=;OE_=oGM%>>jOg+%u48R&8 z7f)^@S3ziMH}e*)8lelGC4gd1{H~t;XL>>WlgMFGWkpm8NY_#a9tnz9qL~I32}Dgzvc0h0|S2 z!~15G{kU^enfti?4nBAQWQYcuC%1!+ObLaPE0Mcj3*}S@_g@CO=!U5&KeTF)Xc99P_Hk(3 zg&B71>H^h&Su-cxLUhS=0#kK(V_OgXL2r^>&;>h&vX^SLf^F<4Go4`n7*^ zpXzfLhK@b#Rv=^^2cN0GK)m-7^u|l~)$hF%L`}pz`l+@3^C@}qsDoijZFcQCv2CH6 z;?^`d7@7U9Ml;P1zfOF|`muv)(5%hgh-zoe1@*`UI|&p)zrDA~?9TJ9IJDnB@L^cK zVl*O=V8knhZ4&!5ey?B6ydN$8r1pM$sCrC92(%06XSw1{g;Y+y+F(Y!DBSz9W#;?- zx0$cu({e{ym^Ts`3nf+@B=yeZFa|VHOZPeYswAvGop^|@L7<*1$O1( z((J4_oLdUQV6&uTikf+p`VywsmhZtmxAe1Dy()J>0@|+`1~?Qy-U;s2Omfj8oGE@P z-_}mHKkZFjA}GwFlZV9uRr1#Hd}latnP**1#b$Fr=*VK!m31LxvnXxnk<$ z+|ea%d+{UXM%`wy;@HgN8mosdbt9{0X%6|^1wBOpqES#z-^6;7Kzkt zk(?ULlHBM{YIBImZb}Lm8*{)p9v#+rW1L)Yn&AgkjNPI+r!e$vUG=+Lc`k`!w&Awyrk=>N9jQMW;SAQOZ+Ijs|QP zEp8WAKanRio~d^<6C6RxORT`ySyrY@*4BOL5UHVm-L1t_bTmMD%K-oEzb7`s4SB1F zpEM(Vd=KE2V%aj2(7j&NM^*_jr1^HjMs$e6L zROs7FEDB;nr|p0t^NS8JWY*NKc^AYD5QxHpL7N=~48<(mY71%29G0%O3OOpq)dg_p zado4q8L|*H>q6<<%)lM&yH`T6!;VMGo4Xpm>6InP;}-A$7YIYt3px^Vl;I>ztn;lk z?CC>d!a8&0tH6eAJh_qImj>-FsU?fUNh+=JCdj4}4McnU2i@?EH#r7|a=1*V@{>U1 zT@l!@ak>X=%h1}UAgCUw^df9Bvc-F~!xoQ-ZK&*5S5?xOkiF{9WwXU_j#+g!vJ<#b zGrafM204CBhMlfBPkS>O(DX-HK~>Ql*f78aSkrdH#r&6jqL=@PR|?KOvGz3*f75Pb z4`7C*-$D&s(THh-Dq3fKT?>ewqWIQ{FdMp!O9f(lA4b^$aJdJb&K!Z8sAmA|(Rb4@ zK)rXNdEGiN#{f|)g<=qa&u#I7g(HgeF(bxzCbF;6Et({NsNPYYY$R4ELkyE8PZ%Xt&E1 zBPAZk$$4Lu$$d}uc`kMxBx#JvRuMZvT+dJ4ip3-Qn)RfoA}>oYP5=P{`$H`YwoOww z#&yW{6*T7NKlZ+P=U_YNL*D>0vmrN1H#J;HV|p}!5uBN{be}=ZD4|z&I^QRHK6dv2 zVMIjV|IwjI8dqLR9EG1o4-G#tFtoL=erkwj5J4OTcgVIHg15}0Y*rJ(sKv+J25sH6 zjWJD0T1QS0m}+fB{jlL@Z76o^GZ)p{xXCdCqvb=7G|TAm)Q_J+&UN?Rm5AtOdNhY| z^vCWD__1RYuvDI$ZdC*QMLO?r>*fr|F8JG~SyTkoanEDSA9ne6`pc~EW#aX+z7%Vy zUCMZh{j!3Y)Ls2WX-6qh4y2aFLS}AygSY#A*J>K5O%fo4fOB|iipSU5AQcgw`QqMo zjEk*DcCoFXX@@L(yXDSZb(xA$IQ!F~F&T)V8;{5& zhLp|h7vP8j)V4f1Hk;rdIDJyJ)k=fOTBmuL920hSjU7FF;1TyrO`P_$#Os6PB}7Bh_c?7>HJ z23}1!y7)m--K#nL7&;M8Ocxq+(2~=tM7OGt?eC*GJ#Ixb5OYu^?cUjpi7|75~bOM_Ze-vN3y zR@CcnHdDB*s@!A$&&er>t?#$mJ^)MJXTj5bl)b5|gMTr~uADVj)1dlE5&e9g+ys~{ zD>6Bt006E*hSSBs2b!`K0W|WXB4>T$1F{wUEpr_KKpvo|4W@NAm}*z`KKJLkSKQwz z_N90BGXT>~G?ZarPu=`w!z2H>VwhC8dy5F$oj!M>!p`Tb9P2fi9LY7#Xyp)7AMnc? zW>mxwTuBYEdP3GOUaywZ%1aR19^hqikG2_q=MG*}7B_gg5!bRD#ocKAor~bv3PIuT zZ-JHSzA=7BUVwVfX@i0qsWsKl*hayzEBb`$#S{FlUS))o8N5b>rwKI{yft0M;j3#I z_@1`9Ew`o#U($zkQGWqj--kVS)@Q_O6K*II3jsBa^sk0*XOIRm1H6px?cL(daMau7 zpoT}lB7RR?P2gOE;y#^Nnk2$HMK%hklOG)@<$DE6Z?#nmw6w!r|iA_`p1}KQXZ|hl+_*0)P!ugZzsnYwD1+pwy+j-wL zs1$Smq(-Az8X6Q0& z;UyLo1XWS7EOO%u38cq-hf~i5ljHYt>54?kTr?1L76schK=;1A-EUjTVndO))Kw#1 zFddpNkA^g}2Bm!7pPKOchxzBm+<* zarR%Ff$R&sWhu5;;M@`j<*GoHd*ULv&1;~1b#taiz%I%i--ta+byE%>5Rq3coc zhBD2ykn4|O(B3^Txi9j4*?{@bI3=GGnLXBEnlhryv}P{YH#uxsGZ#gG*sI&N^Uike zTG2nMk&1epQ25~&*UM6jpJ>hS7Q6EGTl8`1@VrQ&_p^8woC}I+mm+iuf^e!g9p`YP6Zhv3D_ZV;qQQ73-DKMg;IS=UKwFD&>+ey~=ldpt z$m>r|8(P04hFlmS1Xwy-5H)+~ONbyr9Korz>_9|5oJ`ZXpp4yCi|gsyF@GBLBB? znq1$kmPB6z{1%$JzA~vRu`PQ3O6+xJUSr*rJXKd)neqMoV<-D9uHl%GM=zmvYTYxP zCq+!p0L>D%644JdOD#+ZEkJ3Xob<8EEIJ)ekC9??3!^8}BLdlntQYwGw0 zdo`G@WRf!?^G&Axesk*+NVSV?lF>l zYLxeK*7sji0f%KVRi{C2#YgQEF@*sd%D0?-pen~unl=P(OmEW7;#%060`tdy)h%*k zwGKUnDKlTY0qIq|^oay+y{PABa#MjSRqg_aL`Xg}44LrWrh)2ja@s*hzfzVHhq=3u zZ@&~o2*0eJYBT(CScUa5^EUztY${PuD2oF}$a$guD;2%K`L7JwSmB>A_Bjq>8;ym8 zloMP{{w`Fk^V;;7f{aPBS()20-dJl$=tZI8Ar z{|3-J$%2cg+RF9{#6&k5N=%;WFIUmHr5TND^Oaas)0oek2ZN(WN?C^$vFbc?K1nF2 z?Y%kKuxuIe3GfKN1+mIDSij6gW_sliJFxXl zZ*@S}x7*aW3*clBIx$~w#W+OhsNYPe0-a?bZJrq6-Kj ztqw>}Lwp~@Je)ORl&cD`KczW4OCZz>E7)(b>1 zShrYHbk99y8(MwcZeb`#kCh+=qAVpX;Y)^GJrB`>>z;WaD^P_+V=@Kl^_2B*1w3yA zGXQhlxa3hUSrRoPkc>>MAvo2OG+faB)zSc?b$q_7zb)QGM7N&M)1QbX%OhoVytIk6 z%oGCvaAAbjttmGPs~y1I`E^@&rzbN6cTro}?ed}LxBd@nZypb2-@pH7OR`nU$Tmu) zF4;nMqa=~6U2S5hgeYX+W=K-js}R|SWa+BxA=`+UL?I&kGS;z^w27YHCGYn$Uc+AkHmI?7zA4$+XJgQ ztsGq&{5;RUeylUgKN?u92GMZq<-Q19oJ1T?pO*#)Cdd@O-!bexggaSF-`t2)?SA1E z2rS?y#9^L(EsJ@B%ieA1!28aL0#b4k^}EX|KLkLZjh7QY1GSp)yxMP0fubg~h4z-- zx&zF`0Qn2N5nTr#)0({bR8diFm?c$B_I#u`#W7^|ZoztRjlSh@*kmW$UA9kmf!*P= z;x{vRdvHu#CUCXr_#@IyP!<0+)~sXy!mhys1cTQKIQz!GbX7HWE;yi0Fj!T;can$; zGjm9bALt7uw2vjcEW&+3-#}cbXqxCjum^YOx5Qo*W!M=-5R#U`nQ_`_Fe9~|V5@!+ zcm;+F{sDIS6B9d)F*1I(5ZQcMLr?4*WglICQDopkZR5E~2sNxn7Hg54(T0@fxu+`>I?|Ra7Fkdx(!KkSbd$=tvTJFL7 z_i}_fq(nUH#&MUBVNHXIFw#VE2kJQr|C(6SOaB0iA_q zR*dI-=sNu??njz-A~tNi9)gLW$L1{A2vz$*{$h%2D83Y%-|1cIRH&&IFq;2&#^@n% zceYYYD_L~ctk#z4Dz8JVDmTCZXdIZbHuQ9bPB~`f)vH=5gp$KS+~nw%T4rW1_Ht8*X&zwoi`rx~`|f!_%JU(s__R%b{WGZ;6N zj+=06M^OlF)_kh_HIgxmew{}jf(&TJpW_~>&3{`G#I;WkOqQHZ=yVTfxov^$Ob&SY z@%_GkYL?yos{j5c+Xhv>CIQyho&FWwbxrpEIOns^Se9Nm?hjt=L?Ex}16~X?s^$QU zx)}WW4%Fyw+d;s9@%s6kEa^8TXY|urlXZx_+iVb5Vcqzz2Mx{LV!f~)X9}{2r8!I2H%5bdx%J3NY|1`Wta-2ienp_wMx{2gqiUC{C%Dh*} zCr!e`ca@RT`d_?SM1DkOg5U7gdXAZ2T7f@-_e_wp)p$ZHqV~?u3M=DbEyt(Bb8l6r z7W;1s-`KaR!;N5BxLzChA#CsPWC1_OsMZMs@uVNH5XZGpwR-9=i9n__{A5&p6!=B8 z_q&>e)oj2XbtzT^FOpt1_=lsOcON6m4B`qnD(9w??e@rMtinKG6t&5y$@U-n zA1)~;_cdqOnr6=hZ*5W4=YGsrHTIfN?<5{1{kK%C1LaiFbueIQcTGHd`UL3Th;_s5 zsx?xy7}n^M_fO;NcOq^YxXdll#~zz7-e=bk8<=Bj!5$L5BFx1SxSsux$SFTmb0bpd zaWJ(&ueK5lv~ahoMc9!u7~4C=UyC%Of7c+ao@XOX&x}eXe=8CTOmE(hSqwPO(X_l!=9Pbz||vJXCq-gfooU9&ZEqu6O$id=@)Ms5MDe(VEBdJ?z%6xrPtZ&1I&I*FFT%pL3!m zwi(@oDMQOy9J!V9QWI84224cZO(r7RwIJRCel*M@{m*_lezFAeatjB(<#bsP^L*2= zvgWoPCoe-^E+f6ssM{uH7BUx}N3WrKe)Hlfv;s{edOdG0fumJmYc@Q68_*8+GR?td zdQ6DRARBAdkfMfa<9aj7@)+-TwquNRX`;a`E-!7`RRnQVDYl9QU(L9>Zd&ut}d%jTf6?0A_0fb z>DXY^6vIn%f6x&4d}v2ovmep3*fgC2`hfC}(XT*Z)V*c+YMzD{a}HVV!Or!23DV$? z%h=*w8M;GSsB`IyN5#F8Yy~wSP~y+;87pB$%{<9hr-OJbLsR`^Bn)+9VEa5VxKsqu zwmvHey^(~>ZSrorKR-UhU=zL zX6q(xL=>pgJ3#EKVH%GcuxkY+9U+aXFSg@7sHx705#`vFyqyhPIMdc+^cNSjUh^*j zsbtHJAE*>(zZ5>^z+*MVSiw9!rK@7`c%fI~4kI}tI(OOT&OBi}*P+zncDRGP2j|ab zVGnrwX3Ps`Vq`?&*zlQK7_{&_MdYksh=Uuw%g6*uCB?8_bN&yMYA87gbREB5-mb<4 z2V0%%-H}q&_?YN<$MKx=O3RlKI34HFpDxv!T|&T-mhORr9FzIq+%&_%!{Qbd{O|XX zEL=RyK8GaL?;i;-Y@fxpfZVA{zDO5eb{KJG3@tfqED8rTvm~8UxbTbEMVM+2c+=SX z@vvTgw)yj}n0LN?n;WaYIM!z5(&Xqq3=nwFrI2^SMeF!)n-c{R!nh?&25h(lem5ax zeDK^~3Y`r;mn9>b89;j;h$VU!*~%WVG^VJ4+kf+KdcKBSF4&nDZgFQ0o|NZ}C6t8c zk)t2FN1N;wah|L>kkc;psGEobqGtw50LenozqMV#(I3|gp-Z4D&%dm8f^AZWCcD}@oHD~G%dAz{Ey~Sp#WQyOVdZiXE8>ZASG-vH=)e+ zR=~nUBr8b8;KIL!@(%AxeLiCUb`#<(ht6vB3jE9C0_rrwvNk#04>===xTXSb{bIHG zGX%uZVZpN?6K%(^Gu84q_tO8zc#XN~hmX6H@&iZ0+z9q1gdkK0_oe>UcB#b(H2UH8 zHv=~>47HM`Q)|D8Wt~bYFV=KMyH{Fim-rZ)2>-27Zu?oT1ygy<{=CkA9iXMZV^5N6 z!BKBKryK%70llS%!!oOB50XQ2<)#J|oH33wVZ(j|jD$Au^Q<&A{>PqNFCCyq8EmX` zfR(Q=0%o_LPH;O@@EV#?U4=k(Q6t5X8vlP}^LQr0_?D($-}1Q(vfj`$#QF8R5>)}u z5X(^>bBzeXhl-%ML}c~Vjia&{rH4=wf|z}>KFHhA!dGlX*4J$ScT=p=X2dZ;&8d1Cm-Xi1$Y8w3JsITgD?D=*qf*82vW=h! z4|bH0?<#!zjhnWoL1m5xA3hoJ;3NAw2>zP2I@nE(=d85zmv^JcG=x9$PsVgZuPi(G z-%!^KZ$53WSDkRR{>M$PV{!hr`@zMl_2qXP&9|!-N`@hdSwu=%#9RR_sV=yuGs3SH z2SA+{x3WPPeyjr~oU1y^64>(bsCq}cG(`?ci{Z)?vwYP%q?KaO%3_qm3rxVw;k8r* zGk-sjC93cN$lV6f_K}WE4P0iX;UTI0MvzvDxX8=F5-_+jb8j9dcDo=%>7g3ajLd}m zBF2f&X{@tu8#6UU<2Ik;GSke2?Y#+B$Y0HC6a$#~WS_wEf|R9jsFYVfd#4kE^hbQA_RA`ph>8tq%2(@FkFOcNjhIzp#pAg% z0c~7h`XkgtjzG{S*}aH$(i^Z;AAM+avp#lv@${Ag^KNG2&I$a>EX|wY_p)o(Pq8X(KN53IedD+oW)GGV2Uu2;<=^f@8+F4N(KCS| z--RsA0QK5CKy*QR^=n|~m##==-U2WI#;`SuVsd}5cZGbnH(%*qH98p8$? zk2dxd;-7!$2cDJIrD%1opBAGnDn4F7lH+gHdm2^bF04ZAl`|n%?dPz&cCy7Xsh<2f zrbr8FK@y1bO{LCV;Wh>bZNn~r{jh!yo@>(M_y4^MN{3a8HAJpOU{%!7_hC2K4=qQ*{Uxx5~fBxJ*u}?J6y-7{Dlufifx`WmTSLPx6+vE3@Q~i07@qycb%M$ z_R9Ju@^&HY(f%AdS?ezLc{x;+7!jL)j8>H7XO^$j5)pdeVDD4>;!;|pDE<5k(lFufv(6o&Xwl%zuqB6!|F|~3-ku4 zvostf8L6nRm3f`L(qf@^6#_hr0EAF0wj75Rq`8_LZQlIzz_6HDxy~>g&IbSlgRElz zxU)S`er7~?0^KEx@{y@=Nn1)Om;V0y|OIVEVbz}eL-Hx`==h6~AFQaZ!c z&-t-mM_p@^+!sKBLhR+kb1Jn>aW0MS4>NMfMThHW!2C2iw(6c)lhDc|FuOOX39fryh)U%^c*7*gnNZ8~gKHlhg z$4E>>ar|^b)@yoxsyBn1Sr;^d*K=TgrW_3bZQygvj;L|~mY}A}-#de7zs8}NU$u!o z--lPH+okC9W>jzh>uF76%T>$Un1zX=^`)!O?)}7;wwn6vMRF~QcMp$#?pLq-OyWuv z)lXBL7mCg_Zr<@wAS??q3$J+VGMq!R!QxA_qrDK*i5By4QJGle+>3Aq(X_dUiR%}4 zlyZi6GCaR_4QJ3FLq%X~9JIO69JJV5ZzzIq|}1z5c5O#n5i zV{9xB<5oYn;55sIT-eA!du3Q(6pn8G%`IJE@qb6GQvpqocN!-tF=#rm8;LI5(kvXr zUIDne)OB>tvxsR-tlC*n%4)}+&GmP*{Rv6sV!{yw zu7p>qHS@xTQCavC2+vW^!%(U(?^43rNB-E?NM_eUD5e20+LRN)4FFngCe2JNc!P24 z4`40k2N)idDdhwTS$NC$=j-10xifr&Z(@vh^6ryr6&X{%dWq!Zee+rdX~cuzzw&D6 zW$_1wpI=$yIh@3RLa3h}xIu2M@GN@AEo34h{HXX{1z)d{yU%fvmA6)XuI~IhM@Pk= z<*Bis=CV)!6_tX)?GAl(=7xHxv5S`Y~uv}(0LqHo(Oklh2)oxjeRLXkdOi5V=T zVYOFZAXE1KN63MY|8PxP2VgYU-PXP@%uJWXaQp7xiC$y|iFP*saTkqjxHn*z5^%vW z=m#i^{HQ91%n&kKh<3kNnv$W|_i#K6S|9`#hp3PO7~oCAR7!7YMoxnsD(DzQ7@FT^ z`MP>#jNG#KZXg@I2|uyXVm<877RNfQT%bb6$Y^Z}o$5{_U6UkR3j%mIi*zWA0lCkd zAw=b4v=ufoO~Re_+$>~%|MP2RiK8<)dyMXsF_cqOuXNEV2RG6g*Wh#5d!Vf^gCtCOo#5@n(~q^%jGpU`i?D@o z(03idRi|F>e;;>C*tm^@xzz6%L7wu}i9Jg3rw` zY8=QE!@vt_FMf2wR>KbfTKjjiiqYMxkgk%uC5#vI!J_w?Y4+Y&nsu;bjeh~Gh?S4r z2*i^ha1*XEO-#kb;%_p<(2hN-xyG)v)HUP$ECoSx{*~)Cf!q_tATtGLLe0U?Hyarz zmHQ2SMQ7kL2&^nUkh!zF7D*1&nj7`pJt8sq*r>9mt}}3d476q-nGU(DPGhyzPPROW zfc-V{xUc#H)n-%iyvbBN0gQrlBw$Ok>{*FGThw3f0f-^BpXECY2Ytk(aduD4s8I>; zgV#>}^uNhiy`Q1s}%; zLk=RYQaw+sr~EyeKEY|YxtDOr!=maSS*j?T1=%qOf9?GVeLVrX<>|2y>&R0S`3pf6!47_$aJ+4)O> zY{D!|a7~ZLylI}MK@q;<^&}|5*9y7@8B}~emVRSPcpQkG58gU;2xQ# zIHnz;KHDyPUh=odnR<4;)>|uTSOpKYC+tn+pK?T4VhUq@kgr|lGcQ#f={gS@F#w-k z=n8)h?oqDFc*NW|TD9GuA8}tp<{)+P5Z#6}QgSW8Ee&TY)3*}$PEtG^S3*di343J8 zwv0x;^7m^55BEZ;L%|&5E0pAO|8t$x0IxKc`-6^O`oPG8-oamu2?G{jwmZDV*=~e; znITa0_z+CrucTq@s@$}y`jN=kO;>RIgEo)q`?ard-r^?FI1|m$wpP`0IwW)&Q>*s8 zqg0`EXqH|k$QtuqYfe4-pusxK9IHe%Lo3we)%V_2ugO)ha|!@zFP^(GLfM?>A-z6; zeEo-gU=_#^#jdtSH1Z!c#;c)N8Tm7r&hX;%86;c4Dueu6;Hv4ESU-5RW=ch)x=-w# ze2m`(1yIu$;rF0*9RZC4TY}Ix{yHR0%!@L|U^l4>nsS5!7m>k>f;!>q>uZ64o{FXa$uc>aXlWBLY56|JKFkMmw{Zf=vlQu;D(^Rf%h(vS1um?t|Ru^T4`P} zG3~Mf==VbvvOH0N-Ob@iUFGKp5q*WcU%Wg4K;=N@RzexBXC#0|&pxq^F4Y;0-*!af zdRr{+>vHN{odEHk>b7+UF2JGJYO6CT4~my7#pm!FU)%At`)LE-p$CRV$w+ z?w!T(AH+coTE}>CM+8N(+oJ{hE(CZ#_pS_x;nxHmrDlq{LulaW+L|yQ`TITX_$*WO z2mmNxoG}`~%}R-zpcWLjLPUzm)`y{rCsgQ`HtQ+~YD#+Ul;B3ri z0!2I}5M6yfBXWn<(4h=1lGi(m&Fz4U)B18qpk#i5O*)~0!?uC{Q7$)c>MUx%ECIq- z5ra*@pz68XR>SzS(n(SA3)w^_xE-FN{`Y=FPDIqr^h-Pqy1HSV_N7@Py*5JjBH5<- z(Ed7UO9#vD;Kk4l23OCSXOVCGO2)@}4ELOHx|!DM%r@(eh!tlHr-!-yy~(o^#_xdNPE?-4$+OkKZ??J za2|A3NVOAa;JlujKW%`1?*ihRlc<^T0b$7=FP`e2yKX7qiT?c$o+$NT`I91>H&0Z> zk4XbFU{Rc(S(ATsPL9-akpG3C?7=pVfaEumEZEp1q3r?DIjg+JnWJ=t|4XR=N>dEV8gh0*Y;A~zwdQCH@TZ2RgpeoGG zIp-}vG0-aV;M+2@s!g7+u@2af|fKqBN>ZiwKrF1MukG?+omL@Y=bPtLaZAb$L0*Z_W z*l5`u2)$vARfeJSLUZ`gWrvd9cb0h0q0VlP`!~8rdv$= zW#6}x*| zuhkmcj7Oxp?hcE?9V&^uf%*3oh-HGNaE`^YpxHapWi3uj<#UKO>PHG(!9K>Y)@+oP zt$e63P-%mLa)Pz|$qT%&g`2_?ZWpg{Rqj*9FE|=U3!G>`X823?CG+UqK@ zzQ3(0{*fY^i!7&Q##L|Fya;3VbTzQ|H^*!+@143=|Mv^a|9wfZF&YMCvS5g~x~=$} zu~%c0qHH6)-fKqDLO!5>afJ(~@YF9o6mt&{mrFV(UARj410v-G9OT%BJhxRrRgI~? zg=-JMd&N1S*V6vx4o4);B6*-x*qYt)5Dc6BiZrs9;AF^noBd5>>=hZg%~Nb`O2#E@ z#!>Hr)VjkDQ#bPoC#7#34Ywyym3=l3@wp-2#dQDw7<}dKM526RMKU0x zYABm<=!kFY#}#=QtqtsMSCfyn^C30*J1a^~MD^2wBAN&(qBm{O!mdLPD9&F22YRy{ ztzd}3s`b%^Ue89TK>^O(V#w9bxtg_x5!MN;9G{ckvGC?GZiwa*(z%28M>xDu3e**U%L}~^ zU$4US^H-W<%(@;$AE9$g3gs&I$$rb>GrY`WwhlRe47T#K1b1g3oG>09AHDqYDcZ07 zliBD~WvRHitEaWv4r2EA9wij$gI>nB7et79UZC{EHNb2LypJBDIFC3Tk854q7m2~y zvOV(PiC(@l`wBCR-?u2vK}73r!*1^cX+O_x*t}#$fdofj@*H6~EziJNj<7}-TW_^| zbRz@AtxcpKkR%K*SUIQ`UOOw669vaPuK34bPDv_Vl;-{ZNuxO=Sf%Vur8KE+R87k< zcYe6G4Vr4HA1Yl-|9e4Uc){S;TZl9;qpQ7e0V=6=qrg&Er@o=0%9$%M(Y6#L(60T{ zf&u2%v_sW}=+e_fi|)wF;TTmdk`ZX-`wEFce=nCPR_Ft-Rf?Dx(qyl5}M>xx^hW# zd;KRkD(!=u@c3SWUW4iN8iyT{l3DRgveQ1WVK?1U&!+0ZT{ZFy3^FqXe-a?1eLTj- zdYbT`y`#Ymo3Pgzu7+9hnNWx-1QTJqNmrMlgeZc&5vdr+0o{45Mz+C6rmz=mbfOD%&Wk_TUc?X(wu7fga6S*$015gL$ zh}m^P^*;#JuiBXxQuuQ-AQ2t^gNCbz#@wghNwhw_d(PNwS5QcO9m@a|In%ANlLbg? z%R}Jfs?TU~j~IKOnbzu^&1OFAAGdOgnmYmoh(coyDl``k1UZU)#&P!E3n;=Vb`a}@ zLHdzI-^YXY=cwWGTaSMSPzcPAP^gao3T)3pGStp^mnnVHZJ1G_;L)7?zQDN%vf74tDir;Dp`_{CA{!PiClCD( z6atZK(DAS5C$tEF)?lB$H9X0I%}MvgnU{%g)calN!$(2-`3x?3eg9$;Fz9$m6oe8+h18VwT&9FbCYU?r3OfEc|MCq7|!Z5Ia8XYFl=g5L3hn(o%ITLEom z6uE~his%mhD}&2naIcJ-TvFg>+IpWwF7xK{@*j*s)PvnWyQR$3jm7nuF~3K! zCzl@-hW^^Ym+?|RN!Eq#N~iB5OV(OTizuM7tIH;hX`x&lK^h;uN_Z|}2k3TBFxfN7n^Q zeQa$jaWbw4In5TxOE5yWR=b1GP~Eaz9}%O6*llqoX#S1dPFhilUpmL4Z+*jx>nEG; zdN=h-{pp~ATo~k+?`LEbhH`5{udaL878Nwm+VrAe92Rph{E(=VT^P5zn(TyPG5)g? z_&T$!?S1$4~4GS$#l^51}ZA?aayArpmze!VIVZ|}*A z?=h|dRh+k*U3z7`o}i;MtSzXD$$n-dyA$lU*Do!gq0RM{5&@AATp8J-(B<2@Y6k}0 zGv3ZNPzjz%LGh8rQ&6JxFbVjl-vE2KFE{Gf<#mZ2MCE z!$i!$yyTH=B+FWFx4elM(X~@QZnHIRgO%b$zFk?<^^y)E*&q4EOku)D7Pbp*?jF<# zFOVG%ot=HYOGGuSKShhYmHvOoq5EQhuW`#N_G18_?f!ZBVAR_zZSx5T7oeqn#MuNW zqA5S{cKBNV@bd4IytLwd>i3R|wH8_-?lRa{+r1?D&^kPd!7satRnDife({YkyU^oP7$q3tJkfkFjnBwP_G~3`?UPqEm&Wep_H?3U& zLM+;Q5zYw=KRN2!X`1)mULbqXN@#etyDIAUrr+g|Yy}9xWR8uPLB6tQaY5>m09N7( z&jE?CuGSE2THAIx&`nN~)F_;hv}|0m!mkkV-Hsb4jBB!IKiwe&f451YPjK97hM6po zTODwdvz`|?YZ8p}chW(d0uA zKb^pQzjsXD=HapX>)4pMQ9ekvDy^k^T;1X8}HoJHh zfU8bPQI5$W^Z{2ku!qVleXBB)?_^9$1s2LndPk%KeNf;iw_!(?fQninYI5}dMC`Iol~u=&V(nWl$Mje zBA9Y7unqcV{5U5?|Ew>CCSC1rZ;y#Ip>}>;h}Y3B3;OO25(9v!apA*XdNQnYw)~~d z@xbSkGjG$Re@D|ehldxYjE{e`)QG-+f0ss^L5OBFuPphsNxdlkx9Lu(s$8>17O0b@ zz$zJ zJ&c@IZvcw!3vG?BS8YQbol0)*+5WXOVj%iXW6bKI7&dKaI4RlEaPo7y)IHBbP)i&_PslGtH8M6wh$f+cQ;Kc&>5&M2bSy0;ibSekQmVZxsB$gnr1Kh%kaL&FS@;a%HY`p&c zjc!;aau8R2i)2b%kGz!X3ir6EB#Kl;sZuBj@pHiax);9QfB6U6ZI6_w!-(8K2jS## zTu1VNM~vNqau(Zdi!xxww|%vhQwsQd>7g5b${+L^!3iRvsBOLTRd&>O*jIkmOof*Q ziYgB3+ULJN3gpCxVpV|{+59?o>CiN9U`(mdiq=~3>i)8b^>_$rIPL(!nIX@ELV-Ah zq;~P6a**lDP}{-qqE*9cgI~Ks7H4E=#E2ENy{-nQVG)(jxf;X#!qDG1;m1QuZT?hcWvTLWwV<2lgx;aj3js8(MQY!6-V1Q9b}T z@b4>nzsM{fK@qyM;HC`0>~ZZcWwXz+IbQ*)$pX12 z$p#%j^~q`dGZ4B9Le#h_2Wrr$QW{=rkx`*747ADSj3R2%B^o>}PWiL#0_d&P_;8{9 z@VfvvYVTw}BBkXI&{uB-={v8tcuQIXNfM!}dSHl*AQH`WVxv$N>8W_w`$bq{N%PY1 zx?p1CRdXBd^t-y#SN7z+05;w|3vcEaSPJ)2#&Sz5Xec>brwSOsGe_4ibzf$!bs0Rc z-f)t5+ME%H@Mp-ONz>AnAy3Hr8`|=$5F=wGAxx*OYGlXc--7^*f~AMT$p+e2E`ikL ziFa-Ow9d*4)P1QQ_tND%$*D3it&UITUd!FXodnJG0cXE&4bik48Y+WS%>`Xr^V#K@ zMuK~33(jn#%b({#hUxrby*t!zP{;8$pim6KKE&MGJbm!q_B8dh|J3bv6B;Ou<_uFp zeW6oW)~oRhLJ;MiJXGes=Km3yXFLBb!w23WA5*#Wi@k?SWGvC56Mq(@EQL&BDn~=s zpOL}y1Ba}ms(2}Y9(a}fl%4f0N}dl;broG@ng=YwR!V+Lynj{ZwBoSVt$0781@uG) zw|vBRdrkY2r8#Nn1p{|5uILX!nP|*rO z2lcj$2zX5K)-$&&e`wDq!H~I&X;@)^qEZ2M-)*?5%XK8Hcd~OKa2_+5uvahb1oPww z{f<+lTf=rok8FCh^*icGUzVOCO2;>pQ%Tb2+;3zHJr0u-{_-3*=a>TUAW&N9ADxdV z+cXYKltRqWXAUXHnBwwNKznHpX&*Yh&0SNGDjL&P{SC28-OAaZ#Lb^s;s#=t{cDJ1YXokgp<`z5##d_( z17KcW`m7Gj=}w z^gQZMB0055t)EPS7055vWB6A-&iB0|)(b#7q;=Eet}1@m+Pl2^gpXLdE*Dv9Dx$~} zU@3ANVaKh{jNCl$RfcB-BI70xdKr>N^fqCKYZODf{SNj3$k~XV|Bw#}>5ePAqlYLM z~0yYOG#A*h{`roQ@08@H+d-Tw6ionii;?+(!D;lLkI8K6pyg8` zSoFbsCk?D@*0u6Qdl|oJq=IcjtewOgqohL2cbrRkYFq6f;*=u+VC0m-zq+yjrca~N zJcKGWi80Rpc&+|Ph#jO!zPmzq0E6qUmKDSLo~3fF?X_pB0bejLuP54#pe%O%qC-D$ zrtkLH3XOEZ7&>70XSk&)9KLN}xLpgga9u6vh}z@d`AgC?xf$zR!%@Q$%SsmY0_I=k z@4+!iM z`NN6g3JL0B9e8KI^&~WmKyG{w-&SZw`rq@H%gW<$1bx%hRJxVp1+x5BAQSB;o?kxn z(&yFq&c6@aSst;F`vY7LS5^*jbQ;_M->7?S9-3+!x-!&TG~v+Eb-;(p;Ny3&%8>xG>PxS*Pi?OWAdYOIfZF$ z4sEJ3O7}g!t~8whP6^0C>Dj*+4l=t78z6)LOq{%p)4)HeR+YG(;9Z7mQr0Hjh7t6> zLX01wEiGn5cY}8orGPtE^h^^ET^h^IM62=r(a9!5^<8QC{LRc89r z->uuZCGJV?WaF(T!l~v+3$i_^STs3#-H2bG$4jPhdQ99(ZTB;=1|8?y#0P}C@^v8W zS8?;PpB|_M@-5if>$wZOo@v)_BA=W9bs7KCB!!n#uj0qFI6HK06gNf5Ldw_MB0q7Q z|A#DzhpptWtjm~DF}PRQLpJ^`rfCMMWyZHCOTGi29-*!MZP4SRJFIpW zpTzzA`sReoVVmS}wfdqa7UIU+CV^J9=);|CsT4=HxozZg>8Uj^T4yv+>WY z+HRMgDhdCS%B!sTnRPA{b6E#Fiw$6i&!KA6p3H-#0Gvs5(8*kAWZQ(u;wrBf*}m?;SJuUdb_G1~*ld#7uORYc^ zc=H3|^ANpaR%(T@^KHxn681n4Vim^I&9Yh{PUqyHAx#3uGL@gq=?x5GQA1T$@4qAP zo$C&(bt55YIq>N*&U}C0e!vyZ6HPY8+oh48*61gXhD{PrpF3IRHy*L% zEap{tV7TR;B$#6b5c%xh+JOtPD0_9nSg+3yv|w8_7D<&Cp8dho$)K4eWNY$rQ0-di#_`YR#EW32E!ou%qOe6+bBQX1 zq84JxVa=hsFwTY7ACe^RkPn$&NcHF%doroixQ77ZrXU;4UN^0=F~Y=&RQx4xOAcKl zbFYjCLOc;xM5OBha1;Fs13VE_pc#fv)B|e+zq5`3L)BnR=il`uNCR}xU>9bUFLVc1 zJ^@geS8c!p9OLP5P!_MYddn}V@t#@XLjbuB$LKYf{Cgr(+Q+S>urBy&Cl+e9lHXGG zgX+Nov~7*CskqGRw5P~h!0ZsV@uNV$@_5v%TJHfDtBw}lq-ZH`RPNa2j-r!)#qgI5 zEItB&f;OR6aETqJ%pf93YoPXPWnS9SUAhzA-lz{zMSdlokcqnjAHD87=~*2GT}~H6 zdV~$1%y;{=w$_k5fgevAguIl#&39IM1wQ;hbQ^}Jp{<5c2kfj7yvyZpQUYQwfilfe zW|?Lxs4~-SfFXC@U%$$UwEmzZInl!CqS~ox8-Dk z@erKrEuNFy8Ii;~;86`?Y4^(cONFO9^*0sC%x&5Wc)=@hG1^mNBOKBrXUn;A*V)!V z=`@JN??KCtjDZxJ8{7#B-FhA%4G-A>CDM4!jt3%ixn_{cCu{zuN5rZg==iz#>Z7w? zwODgzn0yTAQEVv1#_M-I0XO9%TU;B@0!von>7r-g3#0`yJXY7Xsbk?~9c2;2Cbhx^C#8J0O(oZ(NrnH4bbRyr^e5FX+IL zS@%1Es{UJh{1v;L_6vF9N3{mo;?*XSO%)Axx_x*IGI_%Tz=8TdvCBS%bC-=W=BGiW z7ypqh?TXk~^Ff4M?LaN_ojo*kg+OkJJER5P)~PW!cZBa>NpeXEd=^8Itx1|hQN-~K zATsNUoZ>QN?0jm;ItzVCH$kghBl5Pwu2Mgv>5V$7s32S@Pf0l@mc={o1+eFTX{*)W z-_M^q+dTR!aG6WaH<>4AjF8wyCwK2dfFc^VYX7%G%Zk%j|AQ`PyM|vpDjp9F_S2BB ze!Vzyg`ga2@&-)cQR&57XiNf8OA2h_$%&Uz1tn^Y2ZOFnYPE8jn~0kp(lH?kT}Tx* z5r<(&=bIZ(t?ji5(@?)N@rc;@b42SfVi|;=zK?VES3T%UF&Huk89DwJaywRc8{)c9 zpwxvv)X3=XI(SbPNOjb$pQHS=*7*H8)=iS8El%8%`@<^H~kOx+pfjl5sI|&Nm z>vxA(@#Cgv#k1JFGC@kHVceY&)_4R)0tTkm!&@5`cKHO_(vR{rk!7$xO0f@bzMFMD zWg@O`4e?{omF*rCq2$YSK=oaBf!dLizP`rcMV0?%7Q@8knbwC0+3<6-PM~a3<(e|> z{z?Sym#CN`M*TKAGjrK0ol%7mL>Bn$rc@8Rbod~8S~CLSzI~14w*d7}fjZ6kLy6!` z4I0-%hcptl;}7(A{N!&w8$Og=8i5;T2=h~mxmT|PHK*ktyp~DkTFH|_5o5p^KINq0M z3XU^~-*V&5mj7LD+~v$KClMGE_b<1L(9Z>@q1Ktnb+Yn!AGA991lK&&q1B1}o^zxC zo}j3;*O$?AZ@?|OMqf$_54m97dPzh!)D&E}Gs3XmZ6g`>Oa}Y&>jC&6_u9O4jjthX z2J+kqZ0QRm$$U3uUmgdvOnxN*JidOi&kg{O1AD$0k?|6M`n;(*YC@Xh-EE?#>~*hW zp-_#%o#SE&8?OZ*!al8Gt;qWB_;X*9t>R{I&ws?8$i3psd*rtYX_!v4Lns+QE@%B8 zP0uiG?ND&<4sBp2j1Ei@=}G}Bs+EtMJmmNORwCuphsUCCJiZOeKCYDx%|M>~&s&pC zc9GWd0kY}-V@a8AY^=|5?`uGaY|y;j1v1{mA~&1rsNN!?d5%+TW0Yr%3wSdHO7#1p zx~^3!aU+g{>NXzN7}l8sUudh0!fkM{@o^P#*6IQi!e{d2`5A}ZwP=u|t*%tS6G!+p zeQ7pp)zD0#{f!USRuePV*Qk}TUNL+cV2!);V&uz`&eD7lN++f;ji$np9Ya+?&KslC z9&Winqa1Ow25vj$(Y!4*K~M*FK!>I+Q#ydG5Ob zX5&rrBHyk3`6WAM6=eWT)@;bcYUt+T=Dxs{xDZ1usax>ZK0<>@{a`1)|9Q08siBtE zmr5%Oy!|kH52y$KC$A&_p4j5Yk{f!)8P=V?67e>_P_o;R{~=xqeA2gsulO?8KTi-# z?M-l0m#4>yBwhgFxmXFekz?EFXEhuGPONv~@RQ@G1>gU!MW8>%RD>LcgScMm38m|u zk(Y(Ph%lO(PR;5_@h+*JET78J=5>#>_+_5Eu{gR!s%SIJf-HmkcAx+6efB}@ejwo_ z4YbSj@uX(~w=@WncJmxsy`>%UphM9d1bzl@Qx9?U$gNaY+`1nyi&*XDjlsY(f!qelEK;4z8{GqaXZaY;8Xy#N$wxloAN1BUKc6w# zMrrTW8c*hb5lmQ0jb#h}e1x+)1L&AMR!be*d%1P=7|ztQj8${0Jjgbk)ahSqO(2?; z=0UAFU`SQu`!}L2T8HxLmCKeN>;^xX z>@*JR*onZ?5k4X^tRQ1({rNK9lF?)$B+)j=PAZ;0-W>Oi2;As_8$INFS|^L+ATD7O zCHpq!ZvpDRp=9MUBehCnUU=m$Y`h^OG>^|Y z@>f+`arU4Os<*YvUQ=Q4G9j6g8$VwQ`C9)oXE~i#L#(Q&JN?hl?tn!}H|%K=d{^$|cl+l}~| zh2brBC8f`OVS$mYtxl+=(eYkksK$@0KQ7&Sp+dCayg^}Eb?MQ1AG~TwzCOSX6iZ+w z%cS23unK$M=MiA$0%*wJz;%rDfOsQnFIxsf9;1DE^(q_y7;v{}%P&1?Bb$2WEzpD| z8}?-h1f9@6=3NqD)y1Hib_`JROO_glP8fHF>xnnHlVlnW!641#W3Oy!#*+w^4W@A~ z57^UA-H+4+$nfA!lFza9rnA^%ZQqCy*GSw(y>@s160A}kN83v=PwYd~9FzoiwDYa7-#tRL3*iQ51oXwb0Kk(_*J_JK$@UbKh6 zkr7}XHX?6~dE=KK^EZPGLrqC-*jydSdEX3Gf1wHf9;5kF5BW~W@VrOaH{;zS3uIPr zRf4($ZOL)WR)~3#zusLb^Ct8jkLyjkMH|n(tM=613gh-$D*u2vDWM%R3&yw-c7!Hy zE{{lEul)k+BkC@uf@z!$UgdIZmw3h1m6@P~Grw5?y59t8!1w0}!arcq_>M7VFEWX` zahi%%AFdG@L+%I@o|qR6Usr&39uxz91J6^W^jL%X20Tf7X=cCl*?B%WRQ3c-)hox2avoO;>sga6&pFR^Syp+FU`5o#|89F3t+;AxQ89fbUtf z;vO6Y6&+GH^R-`IvBnfRTyIU(s%I*m9?!*&S}lRR!AsJ|U7i^uV+lixDp7&9q#`Yp zXhOTnGPtRnx~WtJtdKuY1ixVcxU(V@z!X4}L;*@RBjS<#gYT|?GQi$P_w1IEBtf-h z=uiN_(G3`XRR16|@et+iO!Vy(Xf2{}p84SNBsMwA4q>sId7PMaG zif+1GX*TdFWcAa~H4wzK!2ZeaHFPfup7x3R32e7~SuYl&2xWiHO=IRj0Mlqt?UUnc zU^P)Ah~Jex>26c>J*<1bZfJnkm^{9-GYL*q!6&YkzCs%^{W%lsTYAmMY+ z3URF58tt1}!Qu6~iLwTr<;{L?$q4X&071mCYQ)T z@hhw&|J0ebKku_V8tT7edD{I?Ij_?4$j0?)=Hs=!cm2}F$0ISE6_}M#oxlssUvWEU z)K?MN>|*Daq+!(S|3?mUeBdAWyqM!IJ^uLN;1|by&pim2{u11G(*9Dx(!(OH^SLn3 zdAYkv{N-%XkUI9CQOwPHw|_-3Q_-g|c^@zrT|Ugl2wzxM(3$Yk z6j3CJ3kUQ3naP84`RMra6ML;%IPoH4vHO$BQ;#Ur1hOs6Z)P%>KJ!Z}GnPOc$na0-xT`O&UGf@qN(9^f8~q4l?|69l0r8e3lUW(^dFohg3PLf`jRFw)mk9m{)3HFEo2&8j%cGO>GYS-7mwSK50Gq(PT6&$K| zQw^k+SI(xsnKyLAnM{U|oK=5+77?j%Cnfk48Z19*yrhyQ=`l8t(>te58d1)vp zbDtmuDtP8dPo7NM>R?+e+*KjZHZgP*LOA6!%QWA{fTF&7Zhb3ur*s($rtu}d4 z#z)Y$lZC!y!M}3rSEk@bit&7Vyug7TGoDYk1?6%Fw@XF>%?uPRU{@$H2;LU9Eq#S; z&Vh9i(9ODY(z%Y`HWWX>|HthZWN_n33RX21Tu}W_^*qmF(k|KD(T_s?_ak+3MRHK^61hjD^n3FA~itS-1`4(OKO>s?XqlKbL|+QL4HRkt6{5?dtIogm z4Yx4qC_^{Ib##;MBs@P?jhguZwhWI(b8;;hJeg8C#cxg3t8j9lEDAKYob>P*uakc; z-$w%nD%+*49jFk|bJ_RogV>bQz!3dz&tE+7V|^#Wm^oqV*jn|Ey(MNl-*!lS838wH zk)-IH4BZPXF4;_UEhpI|*#&L2A|TM7U#pI^UT_K=)1Luk`dl`G=KyFL&8K?r4xrc0 zmE=}DnQP<1$KP8Ra$}Hm)Jh<0$s6tr3U#8>LW$VeblzB;wz-&{4gI-Pu2;q(qQhCB>_pgQc!} zA9E#~Ye`L7Lv8-8#AbP(}(&=v`3JUFF9Yak0cUy|`db-om*gbd=muAJR4 z8Ee`#|18-p$B4xhjBNP`HgHeg7-SVbx^eDgeq{2hNUZr!{}bIoAJ3k&-FwnU<~Yj+ zGE{!<#7@<^j2N8m@w6dycrDeY?LMRP`kuhM9mZ6(+YUGA#()(zfbXkZ)Cam#vXiFO zNjozedW1(HsgtNg-8o6jqIEnI`=0PzEU~RfY1ttR4t$uN#x!qPtW!E$&kXW9b-~yN zd89DOGhkaC2<)W4oN|Z&;>$}7V3B~FgreJX#@k9UYE*clT~COzpjXObid3Z`QUcyB zVmLs$LQIew2H7g)yGy`ob-c1_zc#=Y3|)qm5?o z;3mMT1a%<%g;j@FPc62j8%-1a*8wbgCQxCXt+ z3HK5pAEG|UC&mHVjFGdlTJFz6qHQ$T+k<5~9E?j1U|aysuj&89E2*vIWHl8NqhsQZ z_XK8PNTkkcPm5V=@;*B4h}oZkPTmIgt>lx}KRta4%G!8rt_iDtB*g=NL3=TIC%5Jg z*k$64f>bIBo03oU;b3<&zPncX43{g*+up;?vLfB=^%XStV-!~sczm0?| zNP)o1YaLMbx@Y^@DENUmo~r!T@AY+t5}xTkTGA|Vl!`xUEWh~-;U=90z81?`={2ME z5`vk7T$o*U*SiN8>v5mub%T@gK9OMI%T>>%+n|QE#HCVc&ZS73239@r&*ZDm4yjCC zS}@=I;t|PrC5Nu05pE`2^YufU`MFb_bP(7h*OmDRyG7{tAv&tKiu{AR?`?j7bUtQ>c+`oxrPmxQO2deg|4oc`+34TGAcvj0wi)|rk< zeIbTDxufpxVQ9G+X}nm!?yPOo4i9_j80>6}x_h$k^?J^V57RRJ6z#VDl%6z6@s>N~ zhlD$Sm|OOU*X|7MlzF%Z&mkVqY8G(s(&#bHoU-SjiJo3f;-Ct+-9ZCJCe=_517+#+ zAX3gPHOX)%FRLuMi!MP8cyT=ZkJwXqBBI{9e)?CeT#>XV{Vw~G-VWz#{lE6cuQnI= zx<1kGy7|}PT$|+W&UZiUFpm6XZUE&;-9u#=KsGeFIDjO~6iC8?NdH$PsA4^Ulbllz z1t-a+ZhhH}mSiKdmg)Zb(Nfb-(|#$ z`<~*bV{+5M7k_px-+t!58&HqvCm0<#ELV{!J5br3Q-5VViG&bp< zfyaaB_3(bzpgZPI-^~m0ay+)huf2D=fW=E)s#g8@bC6&$dBSS<=bP>Y0*N#YltpiG zaaC3kxZT5~9XDFW4`Q#Qc76^6c;R#5n4IeAfqn94EUH=v)iBKPxR2fvNKZ)V=0Xd2 zD3XE(-uaLQ4`L0kZZx?>cs*?PIa`nk0eC%6)9qPuH%E#+2a2a+W`NE{mo;f^n}8e0 zaY%bmp_iB-j4JtoBdTf+_NEQVuC)wi;)nsH^rg0I!0N%B)J z@RYA62M8#eec7!o&as4c)e?a4oNLADaC4_EyxiFB2=Rp7X)Gk^Ejlh>~pX?L)pDLeFJ zJq_w(noKN+9-e{ptWvww$-8LTWgTOQW+X%V?oI!Zp7;~qtBBs!}H;Dez@3~Re1v~S_6m5O8` z-y!w2!+`R<@fo3t36eF_}VP;10>iBYU@O7`SS_9c*0{mKW*k~0~J z7{;i`8=>l8i+aNqnSt%O6P2Q@*N!9~bt?ms^%SpESr(q4of72Rzjm01Bb+#zXkCghG0vK}_-53{v^A6L z&x!nP+B^rha|25?tCM(dV?s1o6Q$HC^TF5;gwqhFM<8<+0!OO+fVF!KcOS)axRU9N%9M|l z4L>`YgtX_%jrRBW``;72n}S60Q+Qod=#O`E*`+k)KkR4~*Zo{A@{S9{-+B4cO-8HK zd@xIzy=Ls($?5#UP7X2kv%4`m36x)iXOJWs#IqYCIn+#lrTS z!ODo^D-Eyyn{RXE`IhzGQPFEgZE3`{%X{gPgG($I)HeRCN_cR5Db~{f@yUYcGGk+c zjL&=YwZCD2%IPPazxQZ@?KPte*tN;RPk9NouUs2Whrx+@%ZALuX3Fk-k(8-RuJnFW zrpFOZk0_5?Ok`A(6B=2n>5Lv1->+{OV0EX)UEelG0#M5`_$}BVO&Tz`zhy7^S3C%H zp+e&SgMeArpCgnUO`S5?n;|M7s`r%06DE4_!Vgs(#*|P^?TzQ;l+XRgb{CJI#VDp|MgT-^sM5jV;CZ?EVgxJqLniy_Q5C z%x#X|t_aVsFWZky`R(E~@6w66raKGpgLp5N5@1QyY8*O`_9|iE0=eeOc2~bfbK|s zFmfFm-H0spSmziN34>Gi|d)T8o%F9UL+O?fa zm?Y-Q;)ySP;(s-C77)|O|Lo8#yf~|}W$gYD!|Rp5>$vgiK+{FcB%PCXU;et~VleZT zVawPm`FCj3|LE$hx+w2sL$FoNk8NP^dIIuwH<7|?>0@x7lpQPtypC~i4gnkj-Sviy#C!yb-VRPHp?7`;Dl;9~Bni9PmKW~n_xx?Nt&hgk8M`rN$ zPjc|K-z-^om7nE@Fo6P3BI^3ne~b8dbQ=Wc&lNZ&g!0a+fON;WKk1GU#;kajDd1?7 zni~hX&vAKP`X%q+yT|tpdKG=R5n=t4YC4{PQ=mdLGfWgX$CwW$4Q1nA-met%TyXfs zqH1=2Egud>%4rs_y){~@L)}4_+piqtQ-w=kZWinOHL%a>s*tP!DDFodjNpG42&IFm zKW0m5fP)$qI`dO^xy#e;^YB40_YhA*H0+Y~p7Mxo?kES*AH?h%m1my;0^0?PUYz_B zTGdZjCwT!vea;_UKR|b_W4Uz46SnEUAyiSlQqAJRQUuiUVqhjQvMN8Yp47@9m+;Gx z!KB~C?P0PC*dH*`6<9SOt!MCoRbTQP$vu!Td-SjgvnZovok)+%TL}9IF4tS7!z-bY zBz@&-PUWc_VF|#hF?Q|6o%G@!a#UE%L8}V9MWy#E`$Accjr~^B=F7&NA^DY-AP=V+ zu4lYGj+w8bcurhJw4YB|zSy%x`y~ziLBf9wr3_Z0%`&b?2)-u&LYAb=z{A|I5n+JU zo{9P28ato9{XI%rUF|u{7c6ufF!qEEuJO1%hbt>_*HiYI*8lQ%s{R!CrtEE-9t$7? z@@6~Wk?a0Lcq-W4*gdL;uaVD`_QVPNR9)-q{a4uR|HyVeZTL5~(<w9WAV*&k?hN_3gi@zNP$@Awe_9u**W4kJ!cmBi07)cQB8Z&)~7G}3K+zoE`P@0v_;&U2ta53Iq6!;ioU*JHO+RPs~CX+bhS zSg@t1k$;VYuqc-RiLG;<`0m<{N4^H>CK>~(UrLZzKLU^!>flF}&~N(W2W9N-+_ zKM1ta1iOTHDUvunvZ}I=Yl2p@A=5PQwG()f5fsbuff3xVU5(v>m&CO+;^79pqZ@^1 z8>f50LK7grKz-I8Eg=$}J4cttPOyOezVBv>r7S$)C*XAHJVLD@EiY5b84@I!EfS&o zRQm^%7%EH%Y%N^a!|tEZBKkX*mvwiaqRg4}_~ zz1J)9Q|=CDAw3M)6fx(k@|R1Dx7^K0L(XxSc+M_!L3#&`jwp8r?awXDzFMHe02h3? z+F{;VkPCQhm9P_C9!%)=uCsBx68^#ViTwRiOkpZOfWXcKG0@Vgg(9yJclzpiEzsgl z;j^Df`Tsa*Y=367jcRO=jAR_y5s@O=kaAOqffwT(?AiWD_XH3sBP``ip-O*3g!h|? z>WY~Hj{Vob3^;Rw>lbF9w(cNR<{Hn^oj<&_eC=pm(@JF5r$N0{;RnK&<%35veT=U@ zPWhf>1H`8|O2*h{$M;#>7x#tkXvA1;yrM62seX_43GnY1Z+*aLCGAuvat<+i>c^Q` zIG2YpE9cqt!M8=S%VMko*3@d!XCyBcRL%=3ZHln{T zA~q6k{nG_T)o}n~-$;Rp7rm)h-VGA;{5mTjLf5>W*Qyo%RK8g-zCw^^?vCF}na@YL z8E#sd`Nx$aLWk?usi z!1S_Uc?L0FukSJ-&4G}&qpZk?a%^SNFU-4@`2{0Xe(Lm zZvV#@eucq?#)%bdW480bn=lCs8JiiQHM2Nlao}9(_zl-9W^TtSxv7NhGlWF*s1oN$ zQ6g10^Kdyv$)X;yr0bGZH+$D!2DyFljYwmHb@1y6|hoj3=KcTHjh1P2Xt!kSGA22Zpz3@DHUgHpX|!;Zk6653$+ zy4uEH{9R>CPLYm|e!T^Xb?}jx?iNuUkt0i3@|y|91-5*uG_ZDjTV`v|Y9u>M!N84- zvwwh|2b~!GVvdSf`bb=9_t;@DM3c|!~D3rCy&?e)@C%= z;e93}F0R}+`GxM|3`%jRPyJ9}ZBj8G{~>L0;Os#u6>4qbbX^(iF=&wDO*h#8VmWGY zDX{*k{4l+sto!%4u>GO-wivCDAaP;>_BbV#z+Hgiu%;9gFtb$|pJgyXzW~NMPo1KPX)^ygw!Oycu*>uww^c5Q=CG<`s zKTN8u23GQ^F?6?htoWZ;$e*@ZOWdBOJwf?PiE+5fiBMrGhmX239{Y7n8uuxeV_ut^ z4eRN3H@jm|%8fImU5(x{oc%se*rYb}_`EtLrCf7<$S_}3Ox)@r?sQ(nu~GDvVO&^` z(-FKFXZ)a%YbN8JMhQ03Z`+Q^mu1CLW+TkRx6L12FG88O;(Zs~DHb%Dgo343$5vf8Pe9+R7Ie7KNYwi~2Vh@plgTLd`rA zNz^iSt{7I|bKuLpL6UJ8ruh0Xj#>|7^K+`Ra4QTU(lVpGpvJ;XAXIc)&#lB>VmE2c zR8v+MWn93Hu*+>akF^ZGGLcl+a7K0HHdVq8R-W0DH0-2HT`H?a9{L84TPnR@Y+vy3 zZWEtgs|&@t;ZmS$P18u!DlEBuGq*&qv~Gww09!?W9gAvC;zxjp_ajlGuc zKO)=D>zh0J=>}83d?pnC(l$t*fY%Gc1tzGhb;k%dSb7lb?R1;L4RraCHxTiVD$)rD zZat4CZEfw0(|YyoDpqzy>7nf{6~C9G(5&~j1SRT9V3n(8bycroR3KY8R#oy}?aptH zhb$*noE5Cy?q3S&a0fF~*Tt&aiMW#_9pNlaVUP$a{w`W}$H;f0KqBYpwcE2}JNcHK8rsN!S4sbT(k;xrLm8%T8Y_S&G10!Za{Q>d> z*$g4ZZK)YUkF-(0hP##uujECyN&}?sN7@EMyodRykcTX@^RE#vr}?EMF{IYEsCjU_ zZt%;uF|^5Vhu)1gNYbb9=OIBNwPC>2?HA;*cdo5Yc^4Oho7z>JaknElK&cmyX;}l- z54)+^gDK{2BX9(3Tz!t}gfR0;Kgw2EtiwO~VmgOYMGl#sYejTaIaSpe@$ppN#n`gf z7xLd=#LhS_B?L(ZrDb#ppo=A8W@14&;)|n=Pg$s=%%FqnTRai^%-yikXBDSdSrnAV z{jopB!v>GudS92w`_JK27uU1D-&UOJe6gTVv6!*V<#*5gieFxth%O%vSGssNyzJ7q z`7^qM&#ca2(3-(>xn99@a><#uM$WO1Tuk@Zn1~J-m5`!b$Yj*(x;2v-76Gk$5sLrl zf2t!DUdIeeJhn{A*?EBm=1Q1`wjd0+@pX$^{i!4SJ(zEgmvhh5@%n;$`UuNN75+Ls z1Tzjf+q{grcYZHcBEx4n&YzOArKllkyWK~1#U`R&Tcwi!67Hov<~^vd+#&1BQM+q# zTIv?Mk&Ay7?!+L@Z%kh@!b$5YR%LEz4UPO-t~_{q^DQF|DD2uQL5*; za$`eYwmreN`=Wv8nP%2b(p1tzepQc4bMi~1M3Xv)#=m_>b0bxA?M3KNIm;B#iW82q zg1D;T^8C zOik{MZDuZ9a-e}(D@>e_NI`@pYZAC1+twd!Gwoi#Oc~P|(bkHCvZPRKJ)^SQ-W$Wp z%tj=Y$pd;7^konp(L@!+_2ygVJ93WdAr*p`uJYKu;3l$_HNQ?7flpE0X~VowyZ$$Pri?WKUn&2~$$v|^c6b^3Yb#d`SF zBa&TTG+yKDihNM3={`EJHFWW!7V1HE?0(J7%Ig>Q%q2peHH>9=80qMs89z%z2bp$! zj`0_5m2JEF&yQxfbdYp~kyJ{-*W2-07G_*6$o6@I7&G=-(fh3rteu8D8=YD&Ee30% zG-Y?dPn|Vf<*HL?Vs(p!6R8lfLHg>V zRC%$qG|j8@BGq7btV+meu|j{|7j&i7o!O9YrTnlIOTzBxQM(5@J*|}ExU_SwS13ha zIjGh2F(2=AzOL~K$^PfjDS)#~uayipB;?!za?sN+XBe9k@J;;l4abzJnvUP0gWmg= zjQO^)SyCXlU8HR*ruqin=9s!Da2}61ztVOK*h~G$1RhitCa|;Ef+aHQ|2%Gk)%$|C zORc2Bx2=GVmjV-S8y|AMbgsLv(;RYXzir6yzqKK#94VxNRy%$feQt>^S+? zp!baYB`K5s>@%OhTatmxyo12uN`eS4rg;g)4+{4Tp)IvYjs_H_1BW3y`bTs%P^g~TUrlQA2lD%F8NTz@oXkss6FNrxcI30`IxIYi+DEpxSns~@xWefdXk|D%p~8NKz;?W;?FiS*R@ zSN+W^bC6sv(SVPyn95j+n2H;@sNpkVu8hbX#QYjIbPp;xz~q3B_M5&JH<5Q>qnExZ*kSfngH&qK+eVd}na#=xPH+-)p?luka%T0`$V2UVGzLGD8ubU~}SEcyX z*W08yar=dJWtvw^kFh-2v}V1@NzA8iQ81Hczs+y=;*|2ZNi`0dgk)UmJBA?#5_pzv zD*CMku_a`y1!?b>wpSAHSkL7Z7i6-?ry7iozoUBZZq+1TGm8?E81-A*;_s4kOZOzjVen&UTZ@M~0e& z-Lw%5+jrR)1Kt)zLBE>Ha*{rwD1$-UIiL}?0kFYBm4Nu4FSJ;FQ<*%z@RbKr?q{n#xOoZ>c_L>Z ztAh1)tKZwiI28+lIF}nqGH}UOe(Ev!fox2hPdaFvPh*?rOlJ`VI9uFDucj~Sg@lN< z++@>nw@2ukmL?krTpFM2m3M-9R0?45l2);gE1m&xf_8;^vH;z3(=?mzkIO61pVqfN z8(G`?So)&L+ZRGKoCX^;ThbR1Ti9}XUd{4$uMdJ%N5-;o5Bi@3n(wUiF>PPdZK3CI zJN%GR2c23yMaM^f<rlJ1&26mH8@w`PAwI3l^2S@?55|lz z?u+?#x!x`V1Uz~-O>EryX{2^XgnlX?ID{#pxK*h(=zwjyk4n2k+v@%Y`jmj=99CQ_ z#X=hCz}N%uF9nAoX1fx^9($Jd+n z>^^&*Fx%~M{I6UM7zelW;dk{zgnwX}O zibC%RP+4KSYNrPVzlwqKfrP_K?f6hfRYlb8Ba6s8SPQpqlpd2j2hQ82hff^iW*pW9 zCan4v{P{gmXU?X_)-HERB`wMe67t;tqgQdaaU_oZEIpRox=<3_r1X>Va{7UEfOI8d zT)uYV4)acDQs1la+f-F7UExJN5-Af@{w6(VTa81r1xHhH> zfeE9=T=A^mH*Gb!^B4BT=6FsJW+d5CyFQa`AN&OdwZ?sNJ~)Q2DwPpG%7=-_>;?SN zF!eNK)>&a%sA71$=o7wQ*Eb{{;TbwA>x%S<_kUmO=omp2(a9*drE-Z^TksN*W$iGx zt#}u@D&q@A58N$YZ6~QoUSF{!Qk~GDw#F5kLR?Cv6~9$^aZQJeX^ZGAQ*@ACdV<|b z77ns{$MuW@fRQ;a@apMO@O@eeWGo%tPmh4U)64PK%p6Cr6Pnr{N*Ay(Fy=V4RPZ9g2t$14V zXqbm|*h&vi#*Dh?mQ>+;K{;rI0Ufm2rFK_}!{You$M>r5BuW42T(1hA{BFfGXt)62w3`2#hh>`pGo6|UL4oMdqF8{Jg0mY>ZM4RGts(Q+O0S|M?oV*9kI=Er8!wKdSGi$;fR1BUtF;|{IC zFI>H^$23&j6wHu}1kH`C*`!@IvOOM*A{*kzN_x)shc-$|zN6g6ihjW<_$TdU;hmlUY6O>`AHa7x^%^sqs{Ep(N9g zTd^K*8uQO~_^_^Uqm!_1wdM>G#$wIy;Gr$J1XpmqDj|guh0BMQnrBo{J2<^||F#Em zYQ9NeklaEIOTYQYWXiMS`m@KgMO(*h2J zEBF3PVF6@cXw4aT`G00azI}IgCS`2m8y&kMrv&}`C0mb4P zgsgEX)qHsJ)}CGN3nDzgz1Fd`9iV@={o9p@2adP(6>Q^p1LF>3k>FEg9p=OOxcZD; zm}5IHG1k07Cp0dwn`e~Z7QY?YN|$gC2X3F{FYCC#Nwc-!km0Ol_ePAkTf!iptqcOq zKdbW#PT${AoR4fT~iRy5~M-xmI6I$<2{pmsc~1E}lvHh&xU>F?dNF zKt1e5PCAR5KmP*^9u&6Bj3wpmvdp_xcydTy2_K!fyNJnG^exwzm(KO3wU0P``8^)> zo35g`^X>-m+rWRsEGY1I(bP}dieVvRmhjVA5pTR6v?~&pzd{t8SB8Ej&&ixvo@JRxvB4*BeAR8hpljJli@<1b^;UM}9i|C�{9x4X`vN4vqfJm3_ztNW4xA zs%o~YXi{qdK6vVRMtK&%e6*R5{=Br~C~xY<))}t0 z_SS&-eC_D9C`{p*-W>^dkyNC}rI9oJp;;5raWnDXML*XtaoGvriu)<|G+$rf5-;lY z7D-RGB;v^L-{uQc=5Q#}(GTz!C^k5LPfgj$oq=*s0N~(65Lv`bb+vxIjKMG*)jRg| z={YiAW_>YmTtih`#`vz$fw_&Mf#o+SEp$Ifr`D*!Z;}gxjTy{-Q~D@vw4ag{CZ4Lc z|Le0BlfKKS-+)5sVZLNm?^}j$wYy62@e8u-^JGvHEPCs7(Ysr&?2(|bsN6H8wiI(~ z2PicP^@+a9^5KO&ObhyN@-rWs`U|r1xm*hyWDve`B8d0Ci%oV1bYf#)WckGCL?c&( zfrXv;G|kIqe3o6a%|j_&<|`HVCQJd+`Z9p%>U|!%Ebvzrz&{3e9FC7cRwd&^udZuf z96awL4s~zt>SHG&bm@K$rCpUWrAQF~nxVUN0J-w zL>%D5L6NFlS) zB&DyI?Xvl$W5$BuF;eXRgaCg;Df7cUf(g~&uW{uwlR|xMBkc#U>qI}Mti9N%()gZ& z>xBp{WFn;27?)dPj`VDR> z+lP!)@6nU8sx#0Wqc`U`!~rK=0H=E)YmTAi7cGx4!)yAJCUc7X>fVa2w@G zrU;BE>RFis{_^wa%m&v?DnUR$8<|F6*Kz#5hUZbN_4{Em2u9+&A^*G|KYFU9H2k*8FAR(A{9-s2>SN{UJzXx=G00T(ZnawwRQH_V5p58|+&WrVifwoY<``GY@=8$XwZXhglYK zk^g&&l23$MoYg?n?D8|Ft|oohDc zapN=7Dp)$O+Z*-fV((()+sN@???RX5`Xa~PgrT<)D* zk2s5UvuC1PC+Z4(k}I|SKQz$b6EC@K!lL$W#xYbTbjiBQug&ibE)BXWEDcfKO%B8b zMrXU3L6fgVe#>}6-U7}f>mko%>oDKQoHOI;d?7=#3+?xL_0N#8jnwfpGY3Xz5 zk+(K4EZse(zXf;+Ur%6I>5xghFw|{1a*5&h?YdSx3eDK?$P~iJc}9wLP?M%#gwHcW zFR>VB^D4WX+wTyaj$EnXL(wo<1BGE8*CHH1cO>o)J*DzpGekf3&5A5@U$&+d7bCKi zVPhqc%nYXDVG_u=(s4uwq1__Ki$M_)gK40k!Bp{PS3wk3fWn}TKg>f{j^#~LZ^Nez z(A&H?l)hm0xTy6ZiEPa$@nFGk<&s|4B@GpB&J zHcxy*$GV@qu!F6I*(Ehbo|{SdG9e*{S9?)$mfxeHAuTB?!;0Zr5}x1Q2LL{dp8@TI zqbgLS!bn$mzbN@ChZy#9C6RDTC)u@bhws$TpbKPkF|C?3?w*{-m&w!4W-v3515Qgx zT%k)K$=zv${kBhr>IH^2=3+^qhic9C_yY2+(ni%h_7OVjb1m;r{6KX=r_vrDYVK0~ z=~ye-bK4kI)9>08b;4lcG-15|*&SNhhkZYX+Fh8x*#wLWxUvkygiz*NZVRK*<-C@VfDdtU&Q~ZT*1@Vn0bo`{0q|7{9yy~hB9YQ?k6t^GujDuo@ zci~5Tw=#P9nXKY8pkzO!B4~pjO<=^{aJ0hK48-x{j!GwvPRM^(=IAPu=PZ6zA=qj7 zaJc`8E1xy&L7SR6Ej<-cXmIZEM>yb>WSRsdAj!F2vHnVVfY6B zlT2|$RD&u+HgNYGcKfEM6b3BIm0H6Fog2gN+!LKD4*uVd65CFoWP`o< z_{E>iqbRQA^t{mhIB%diFZl*DjJx7i-8nKh)S6Cs3068}C2Hy+K2)?i^U$_ryq*|^ ztcLR+X6R_Y)c&;AL*KCGnU45X!4{;xrHHN$vyT~}NJx;rve39^%o>C8v2L(lX%qV{ zDqMnq%x6&oLEe0Kja9_ss0KLfd+moa`Rz}=nt+~(57`*j^Q+iQhUMf3E?26BD^IHpXCkC}xv5^S!<`ivLR)wx!#h^4{{ZA-_aS9IiMDZJkqV^ssyilpjslT3 zMDhd5ol4|B`o)?tcyyF$4pDGGr zSWv~!m)+uI03uo2*q%HyQ{kQ5Sy2yW#tOqEYS|qfPm7n8R?8p7U#Na`^aZoxrqowv zpCc>joL$HvEh-81=!&zn402KsUS;zK7iN4{FOP8CcQj=xa9~~>UIpk*TlJxkbP-}v zArV}A!SNRzB1au3(H+|TIIo$GFHUn1%+p%8A4(P76ECL8-IQ1!Iq4fEjI&4^=H<&f zE_uj1&tcO2qbI)8F?UnU$@C{mDIpuK5Q*hfLV>$=fJeY8>2C4JC&}Ts5xE9en&U~N zo5${5Lhp!uTHQD?EhlOFxy2uxI9y(60e{O2u|3b_h1>=`lfzOM!9b@9RnN|mvm?Y&;bOwevg^D^c8SQcOAfs4 zvVlD!Y;f~Lspc*LKuHe#J0%I&^9B(?J2(AYTZ#o!WnE3akoo;nuya7aYjGr>ewd5Y z6R=tk-7I4Nr?7{#=4blbeM5m?dPI6j$*!h)L&kp+9Y2!mZ8uF}FMwMOFw`yw00%@X%Kst}A z(n@F_=baDg4@EMKk2K^A6dy$uQG=_fm}$^AAh}$#6|)C!*NkHw9ZD&|kp>reaJ3vE z9ZthbC=N-$8R)0Yxiy`DWgV?RAbw%YR-uWi192*USjmtZl2Mg`$wfXqOvDUaA)&;{ zU|Rl6iTze;-y!9P7U2zrHL9>lo&aRx|GUmrIXMq6Y}_|*P_OL7{)fO5lT)OI*SC(nW zg4RM6cPMlHjc_G7#N9KFX6SV_AN#kBKr{KZ4Tzk-5kM7TStCba@&r>doDtARMt33a zwN0L`V!Hn_%ST;~n28%nX6>AU2g;qpNt2SQXV6;_GSo=33v(yhy5fp{5+t$kZ_q6k ztmw(IPdXoDhQg;r>Y@it-R!-lZ;y1dN(q<89v8v?_+%o(;%59I$A5q3RRy!VZold9 z^JJ4m%1@?lvwI^;LfI$VYiSOEt=b&Nc`z6=(m~T3kOaMZ15Lh7OQMtYr@rC z=(gDn*B6qv?ffgPuH2ua-wvJ}bIq!}5hhS1jFI(>EYIOpj-%`QV43W)zx|DQl{jd* zwYd&^JvQNeoESD8J(;a{Zl~SYgaVE`0Vf+qJW}aC zMdr|m{oo6`S42FN`wH2ubWp6SGDTvB4TERns(=zz%LNfJQK4i-KZxB!v+j*~5ga+t z*IhwMh$eBod1T`QLG{LfB|uGFK+~FII{+6Cz}>z9)a&;hGf7U-q}Rakow*pv=)aVb z;I&*KJGl(;AdZv==X1=F2M2B7+o-$fPTcZoj(qMKg22@G(Zh7~ZH2l>(A#+J^XDsK zCkBl>0Do`^((p|jn%xl}7fmkQ>o^Ws9aJ4UOiolR)LVk;3uM*Yd|QElq_hc{q$V@f zPm5Piz74cT7X_t$b;h2)QY(t;x%ACCz`8+Wr7doTT$tI<3lJW30|)J_DwCKg01Hf) zE8Or8(-w#SP?ilIbcpTxj{^#$!}p!y!KzQTO||Qlzi{zkFwwTy5r%D(#9dBm*vU&+ zyP|*Jw%cEvx+alGeA1GKINRFiuoJ?XKR}NV zx?5VP0D6R2h21ynDS`2~FW}{6H`0wzVzHTA@P>H3d{JL!rvP3$GQp5ox+U57n<7PE zsNT~|te{7PJRJ@X`(JRBdkatEL;sDV6guE2L7#W(P<`I@V>Nt)rH)4C8&)ZqM^+pC z%fD{_?q-qg!7WS0Xvi#(DhVL1@2CC72QoM=Bz<4KBv`_WYvNOYwd`@QNq9Xepj?(O z?vSPaH-6G{)oWi$!wqnhU0h!`pEFTi>JEcUxGBlHcxFg`RA{*-_(E%T_ijx6ZNwfM zF3&cP3m8Ce5=OUvla;FEw>^gF{lDrGT2%A?W-GbYs=eDvY zgR&MXot-RgSA}c#UiFV z2N#kKstY<)couoYoU2~b(+_c;={-qJd-6!TK122D?rFW=J3Oxu=Q!_hh+^8QLIIz?I&Dp1oMPya21wR778I^f2(!Al_puPV-3@~KkEHF0$n zE8KXdUh!nh+BFKG3ICC4h|LSxmD*TQVHg(q^8D&=YEx6BZjJO?G*s?pand>jC}cr7 zy9D3ZKC);~+J*3!XgRi4YX9an<=cN;{!>MY`40XC$V#lIu6Ssv%^q%8{m&F+;$?LlNp362$5uO`2 zs?xm}*wQ&#K)5Z9ma4hVh5U@L*W_-BNkjihW2^STs1i_OnIj`~Oj&b~9P8?~-%RJd z-%KaW=o7FGzpR1E{?B&I&$n!&7Q6kDaRGqlv{Kl$eRi};av<>CffKW0o9u)+%Vwj~ z!^bX@9zBKMfZ)e}_0?j6ts=d8wHT0{iG}mPjHZq0x9}S$MvC1klohk6893P>^(r?~ zJ|^3{wpzNBB&J3GFq!;(SXSu4@#jYSqin%hpCg{vdT@sYzXbS5e}o6S23iqF!>i0u z;t0MR@GrkP;<4QitZihsh|h-|#n0T9yxNCnPOwKy4e%s3f4f|dirtT(i}Z%#NvQ8lbv+0f>6LID5CkwZe>pH zc+%MO!eYRrC@xC;o8_EiTVNA2Gj~=f95-m;JuFvh-oM2O;{y!8ZvZOr$-{ zGhEjF#ykf0ynqYAF^%ktJfRr9r(WBSe|GZ0cq34(d+0K1WgD|~8V+%{vKi>G(Rc2&s9diKFYSER9f{2F(zUa9~^+=n1&Tj z6wBA#(R1T&vn=D{Kp@>o@7LrUaA1ov-V6pmP5M*bRzcntgc?%k7Pv^NFOdx)0ok^D^JF*e_r zR zMD$F2p#$!nmswF|=Yas;6b2lc49@jL(arON54u|xdeIn|G*wAS-04T#h^lrlv(jEu z-ZT>`CkZ3Tt(*7I?vmWOvuglp!WgWE?n#PB|dETzQAMuvEYIx*>y${a!x?9C%y*_3*kE#(q%k(LmyFfv0lFRK{ax2SVOCaE*udEFk z_{*btgFc0t=6Axwio>`ldQqcSIbLm>-AzGbOi{m}_#HEBv!-Jsq+53UBpdu|ab@AV z1OAh0^9*Jr-;pQ7vfrv2bcB0Fpd&0MjfJ*lv$>mQ7NahG%u$d6J}D};Ll!ehv{h6| z85OKTc8&C#wp~A#J_Iu_MW>I_zQ2&=nlgl=W#n$~Z_N4g28L$QP48}obia{OUnpUz9sO1CmjJ8y016*zpAB}e56us`W`Q91j^FOv(* zK9dZ}wL?>%UB$C!(xe!qZ!(b{v{wFa&P>ggyAs{Vd=76}O(q}!1NU>nxg`1(-~ z)l65$&Qmdb^;=PPBMuMxT<;@@dcHUBNc3W7(*6tc`Qb4*g`9`1+MiRHnPp@b2u&*S@=@+yS9eu=gpYL6Wwi-S0 zn~E4yj}+rDnIo?1(KGzN-uNfwfOr>j$fXoCZMNX`AjdDRzaO*Qe9iIx6q!s`(sW)Z<0ZHSYko(wBP~@ zQk9y+9zaVNPn_uM_*c@8YDB@c|O{0^Q7H z$#=hU>4-v$rK8bCQ35yMTCOr22J`&mb`Px_+!PcLddDwNNYWF# zZ@MQKDeo*#n7mtx{9Q@Lq}c?9ff+&izERb`m~5ok<~zE+4w(vKMi9=3bn6D13WQd$ z*DZG8B-=>WJL7;1`Wnio3#d|EYuJGfRgq$WNKdS27faeWg&+Vaiu(UZ`_8DQwzk_N z7C@SU3eut?qSA|ilte^9K|w^CNQqRHD!n98DN!jArMG}cFQG|?2vK^KUL(?LfDj-d zBzNOE@A%$(e|?8L{Gme}LiSouo6nqc4}98IeZmIfc#COTs0o%UNCtPhkInjb>%Z%@ z05q<0BiVLxs*B^>k=<$r8=Y?_3di_np$FrZ+)e@3;w)m3N#Hw)S%0j8xZ;3$=81cR z*R56=V4dE>mD$B>DE(;4O?Y26RZI@1nLG|TEs&^twkIY!y-vC`M%ob;MAKiNLuyA2h02y_W8)L45Wr=6JJwLy#ye}80eHU zZuG_V5{xL~H|RDs_nL0fORR@ant7;}w7p-KV7w=3qtM9{m zF#WgSw#0P-tLF|Q$M$+P+V%12C$Z6lp_P|cHl;rOAq_>qCce=wRJ~5F>+;>88U078 zdEItn>HB(T8n+nS^|{aUM1oOX!{%m1wlfG=t(7R>d|9cs`F$cfvuib2!c!P8GCkS@<-eQ}>e$U_jAydm~K=-*(OZCmkGn0~c0eIUzsnhQApMFTk9S|%W z!pareDHQ5%wj&5mfY32sgLI?9J9%N!HR~E6R&a6y|54gzL#NLJdnPSFN~Q6@DTHOO zmnY)blO&3Bw z12$*ng(@l*$wjG4l>e+pGtWF3NtGhApHz*!fcfqXES zY)F?TRc~>VPhdt6Cj6?QZs!2m@z4U9gMEXh*%Vh8NC_?J_qgyz2k3$oW|2CLz51;# zva5hn9yH z|4mNGJlzGba1B>}+Bu)xltS-c+n*Hiywr4;O1{Q#QL+4&H@{yZI73U;JOe|rUDJ@ez#tzDz0TWc^Z!vsF9981QcN|E zd{cB&aF5K3FT$zb8a}~5A17<=xsbq{DT{nDpg^&=MH=@=R|6VON+v)!_WAgm9X6E0GIAu_^nMy3KD0Cb6RZ1_`%V{ z9u{uXoH2}kX9mcrkp~q0TfW5kZ+Zlue!&__K9*-4S#vsW^yC%XqYZ#&kT_w}{rxW* zn+$-}_OTxUEOO@Wp0v5bKs+ANc=c+usU!+@LgA1gpbOXqSAI?)^OU*_EXJ0QTQ?O7CfH?6zI$6E2B5 z0Z9~%UW^M6h+4I2K#{zDu(gW#zB?IGv+4J|UC3+K(i-ZW>%f$8k}gtrhcy|PD_^@w z<(1h!eI_mhuxdriO$R=OuC)ARzGXVgM=20jN(S1px&c7V{`)_@<&!)WMI(hg^eO;>9{c|;Lyzrgzrs8T5sZ!i9Ah3#oU@p%w;Zq1Oa94M zCm=R1IK|?r^7g?6`43B1*e1zg8}q#4neCUIoD1xP!_c#z8P%puSly zt0wt;>T_L{{0W|+*E0YT0cdeuUz{a3RWfOIaDIVijb z98SRq+;xq`^BEFXA~gzV&(uJBnjxEH4Pp(VQ~1Z&1DFTf6x$!0(-eraizI1!&+Y2> ze{`Fk>=8AbQ$A6>>Yo6nSm-nR%WjR5A^Ax!d>g`}Y=*aU!Q!Uyep*S=ImP#K_qa}* zb;#r$9lV0woz7*KtXX5wJy556$1?f`upMk-3D)q>;o)CbFN@aWLN1`*2=c))g|_O8Oy{ zKYZNj&&m5bGfiFhdq!-ON_2dOmv{B$eh@jR`z#~OXJ6~N*WnOn!hb@^dlE2y+PW?t zg8Nc}$86@Sfy|<>Pb~o?jj;Zw15#mwQ>_an)djsJa>@&U4U4cL_#iT@Uw6)pNzol# z&OIH^yKT9i=zrZUo>StRbxupW>DU;pB z*0NF1+r={??C=FGlBTZa$2w zlhdgbZv*HWDoEP{aXHn_jY}b3iv3>tK0jn-|Akg_{%h0m;ev0y!$bPXjq+q=BPW;a zps1A-+UDg%N8$vf?wsi4d_iK$|qYuvOnPnGoWWeaGMIRU7D!4NLj(sXe z4YCdDRoGW9HA@C|{$pEPQ^3wXU&^B7-2)uwY;yDu=+ATK+RjQoy)(t(+fojc8s6L= ze=Dt1)jVJPa8!Dp`&e1c1?-FS56eE#t6W2wfej)^P#`1?#2U&P0W6%9pXRoQN^ZPV zx9bWPfDL9mNS*^I2Bc8;eOuzX>#VB_wgk1=zCwUgGXJwxu6S3(VmhMy0WSHwa*w{T);opwZy%fp#8yx{&0QgO<3KX+k&Kf0AV4M z7zeWWvnQ=TwHJf1e4w-zgSGHac=*M_{nLK?*DKk)2A8fY1~{Hm67xewAcIflfCA#( zffNvDUc2C^C7Ml6v7bWUw)yNY)b0;=H~I!#;wzN&5tZQ{|HuDnKl=cx&s_gV3Z!{GGsfPer*HQA1{2@nktI-70^03-wCRK#dY_yp z3RL56+7{lhD;og^{ood>5s7LJ+u&kNeKt`b^BL*70ejlR3{xNlCWY8c0~mwZ;D6j} zr5acSK47jK-syQ6{Mcp{h|bsp2_WQ{fZ~csrArTq7ODI^3VgtF9D~-`=nwk}@>302 z0B={Ww+EvC0)mtd&r?csL154GXu#?L8FBEl#HDc+t;=4!ddccqbc>99YZU5CD`pd6+t`_! z8^rehG>70A#DCQd9YPm1U1=S3G@`hMIE@_JcE^#AQe$o@LZxu?Bs)uLq>5`67_`MP3PEljr>P# zH+yy#dj7}LmSqn~w!vzX?{O)!r_P<~!EwI><{IW=o#K*(ecQn=K7ZfsVVz~E_eD_8 z<5Sb3ZPufSt>Zute>)gRc%p*%D=Y{KPmgd7p-U6&03FEneOpDKDJI|ZC%rI-d5?}x zoUwyXlTrN1^k$*}t@F|4vvr!mJ?#rEiXEj>Qz(dF&4?Gf#qP-9=XEbn&k;eqkE~8t zE=+&mcfaL-ya0B~VY}r5a7reEvL=q-5Jy7DpCH%$7xmHcj#lMrn-4zxkt8M%yMmoV zCx{V0mvjOQxEtSvOP!$TV3^5iIKE_`*|p7HT~OUd6o!9-PTOXjQt*v6pT+G22^5$L zT4a%FjAnPcq?^78Dx94Gnw6VAV4J#vo{8bxBEU9QAk{F@vk%5Eg8s5#jEn3kb*L#X zsq?u_AJ*AaUi<=(X_YpNbtcX(B$(~Hj0v!N5mbEuCkF1aDAxnML|2k;f6B6RYqDF2 zP3$mQtH&F^+tC}gt;e>M>gAmh?1+7AFt>|X`&B==gPrOkc0oXNg}BOn=^M|$f{f!@ zr&kSe?R&Y3>&~0Cc)`=>)k^GL`1@^iCBnP6#QD80gih`Pfp`2s z_Z$OPK0%Y9n_rr_Sn&=&yjwAA+1;`*alj57s=C0uhh`h+>3t`Hbyq~C>CqoUoPF9% zKSOEWCG_eEQUTc!Fb9_fjO@a>NhzWzBA>;xNDHQ(Nc-IF*fL2_P3y%Y-}+@DzX9X#DC7 zU<95cySf$Xb%e}y+%?fT(P`5AKV0*tZ67F&meE-HFL>UjKhP%&)yn~|sX)P?-||m& zCZ@Pje2xx}?1X#OOs#$A(&Y#5E$D)1J1AQ0v3S?#ia#mAjG>UYrPcomo(Df-+DpnC!cljWfbh`f+{}#AKp3@$gRUz9(1R)RYVB72W?! zm4ML%jEgAh4h!VTa_ZV7GMScoIGD_a4{uA?0c=z`*yp^Z^tk^^Q`>C zasD&GK7hjpZRLXeW{0@nT#pn8fTDS4>GLSsWuDN=9u=dC_lSJLh`0Unx`-g;PmZKh zFmxq8Bx-1a0y&1G_FUXs^{Q1~IQtd(ngY1-Z(3+j>}m#D4I1aZp(vQM4W_=uGu(3H zfPT^h1VE46V(yQC2CycJZB<0=v_NH@l)_6Ue2f%U1(nY4{`a7n#%@dc0!03FOShok zlyUD=k8??>Ht=#1T){NVHI+UrF#N2~a?Bx8zf9!kygk`O z3Ic3E=iq0`nouDakDSau+>wXmZh*X^iKA8rK;bCR=7W%ZpKz~Vqw>W>Mn?7jOUBz1 zMzosRHiat!Yh08f(PxYlLUFgH36Z7NCW=}ZkM zsawC^Gk=#OOeU!*N%~&(FS}IwNBb=n%gRXy-}#T@1K(M`cZk`{S;k_w0bXF&iI;Z{ z;^&(9t(}d?!#Vi9#y&d#itL7SBX3%bLGWI~rhTlA;V9JlI_Rp3_uBrbbM8_X1n-0M z&n=2uiDAoX`9=d$ooqE!P(W9egy+~^9ap8cVf`1@)=~8FNe_(Q_~cg%Y-O?^11C+2 zT9CDP=rK4vZ3Qn#n}W~|%OUOdYr_igH?GTBj;nL0G2TB+=s^6w!*SQG1>v|*5LfS= zF`VL_G0_4`#UL|jyZTVNACf>@C4l`$%VDPeTMaCd-@V6(WGpklyQ4uX5Y(b34m|xZ z9c9WTVT7m`3JASkKqZT3nF za>K}N7GVEnD^N&n*BRzH($Ex20RC$i@oP;L)3tkjVE1Xa3eOO3(FLAzEwE zdBNwr1O*Y)bsTnY6e|GU)up@dcz4skrY!9!g(8yuRx5E_x46esBpr<{};?ZiywzO{fxgg7KQxzZ`CKU#5h*`}o-P$*<_?_@3ywFWLjLNCH zJD)3OD9gzL4unzTw=lyp14zo_s37-=~H-|qCx=& z43C(lP2TUSyD~ue#t3%V`OQtAS$l8fzck5>Sm&M^LV`C_aUu|M3l6n6g!-{JWx0+9 z9y48~X1kW4iW2Pj4cRS$_{k5TL5X1M4>bL@ls6*pIgbR#t6D67=q{Z=hy7k#F6oLE zwxUgPAQX8wP>p-*T}5d0ZY4T*i#Ug%&GooI%yDxdas=qQKVcg#`RokJmV_rK;jdG7 zv2;IqnkaTd6q#1EXWs~kA3-6krM8LH1O$CDq<%R(b#G{!11k(Xpv|3Na^S*x%GCb< znV=Mo_*J;efj!Y_5db*qHcL8NgEqg^b+z5J+J&3SU%kyC$?J1QeMNtY)y~Ja-Q~;z zYwf;U=jS3QFROs{^{FcoDxL0TMjY;ol+_8pD24WbmIEcuD8K+wa7suT9R~e-v*mv~ zxpC+!ZbJ_sQUErO>h;gAYYavC^Zs3J1aMRU>qRAAE%sDTboz8X$cla%M(}S^23Gg< z^%hI2{ZnJe#8rA+m;a@)hcxtL8JPgam%-&QSOSco?7z2U0Raj+CbW^1_6AGI#lA0( zk9i)hu`$)LpxL|aI=(*Vz2t8jOW)NMtRw7V2`)g+A$H6*`NWo>F44S4{kvgvMaoDt zwFMoj&;Xj_NACfd#;V4K<}F0)xdW$?A&4CWJDS#>DRPWvJ&)@BjhNUfE5CnluE}&{ zzZq-d+d?VeiNtyi_}W@!7c5+Er;5N2U(AF*FG5d&c>QO4(Jh?|9bL8LwN1X{@UP)2 zj1%;ee%E;?QIMul5-NjCr?eu1wp}WqbR)QjRC^QiBt-KtIih~umNM0`Hr9=(aio>Q zm&)0jWT!GcaVkpYq#UCk*)FOBO1vABzJ2Qpx-g|)J>HQve}^H+YOj@dCVuq$ZR=Wk!DvjD}M!a!bl_bnTfM012n^|H)extsskeA_U-90axuM-D`FVq@?U ztdSm*g3#)>n|XYM%~ug$T;_s%7+Rks&Q7oF{PGT`f2^>bAaO*lsg)(#b+};u>WT3!bI#a?rLXOVGOxa$~fy zF8Y(28EVC>7oJ{Sq}oY1UGK2BRZhS8gt(s-kSPCYp`LHFe1OSACm?BrNdknt4ejiv zo8l=0IDK8!)A#!c@a<~ko+cf(vo<-&=IpJ`f1P)cz9C89pl;fKhwyHq6zV|tJFx3~ zSXae~pJ4JNN%6K*tlb17TwyGbE@`2{_a5!P(PIA|0*3I80^b&~w>H0|xl2jIxpAPC zYbN7T(fipMiKVn*-%mAFHo?OI*UPT`w$crvX|)?cUY~2TplwX$gC9E?w?T={B-D$57Bt@|egg-zARt}< zW0NU_Y>&AC_328}n81A1}dk1G^%L=$@8` zoi!6cD+(y|@PNeo-&={jj*$l3;Qb2_VW*1$_wcBvWyMcs@vJi?DyI@fV+cwLQ#ute zssR#2Uk7z%n#bS;W$Q!G8*B6JEw=|-}nSryvTw)5#iXJ_%G0xxv1K3#KaYki9(=|9PW zc+#h$$lv`9P|ja)KxkaJIR5*ynz)^xT|j2uuM^5I_%O;e==X$)%?w3%D(;ni z7Kh1zuGC0cz)t*N-Rv3{WSz@(oWM9mvBRxwYN~Iqa~y`RF(Rbk!5w;^NBbdFB$|Q@uehXFn4qPR73M3i{X)+~P>@6DU4h#S_b9WREpKS$!FXo}xG0f%L zAm=UM8Aws3f9Ppm7TkPkMRj49T;-eAjr_->LAeIw`uNT)f~6gW_8hrVC_B@v>uRW3 zJIReozR4K)OschZpPeMSIdrXY-&*a`fiuHCXPYtY>Fh2389&N-B=~A$+vCHoHK{57 zeV6HFAcU#hr5Nq9X*A2FX$Vt!xlz51Z`rboVmnaoH}~dIYzpm7e0_ARMOP@kiRilw zWNQoBj74~Yp!0ir0+yCA)KN|=r+e!o63DJB(g;8ikX;BG z5eejHZ*__k?R^g$u}6yDVi^nBD+M0ia#2&UU^0T{6P+~W+DY%4h@)%kJ=w!bq%bjT zzhSZGJS4<@TkR81fJWE{O|ENTJe{P+Wfa;7d$)V+_}jOi-|+2HR1H+os|CQXx6^|dQ$pETjc^_bVyy^Y_EwA$PsqnnzoxSj z<*iy5*Dm-Y$h=_M&J@7w&upJSmmrQcdIm`z!8nw?o%Cw}$DY7uiEatocV)gX2@xLrgdRV)$SG@gnmrf!XwgP&@6cEIqQLp_|`OnUq$Rwelu9;)ASd z23zqH|4i~7sQF{pVVjuh;bAuDXYTKWv4x;UIBaiYn-Ak%{lwmMu8Q zgU~DcpfplFfwxonT_Z|RbCV-VibvZ_<7Rl5cL_yP_<9q*2*+sLtzd}U*rXNV;C zX6jaB_g0*LgtdxTUsmCCw%{ z2Ul=DvU{_3rQH9=Moli34y~Uo(YV=Uc(}(IaSm@S0&JZKB9^^S94D( z_k}BP4eoFM;NB%(993$^nAa*z$LX%_eDEkkq=Iwb=tIsZLVY0QzE3~%=SX+I!Rd#$ zt8a&#xh~0rSm_@ei^|2YLgccXyH$Q8POJmdWJM4Q_iWMzggnhPr(C9BrX4NT0&s3< zyM$_8$e!FieWVZbwg5-z)w%Im@c}3tR*9oVn%3Hq zx;<3rR3h2aik?E$`?VHi$ziF>$2=k)+z^$2vm7fPf6d5rqS9I5_U}}O%EuBAsH1nN zkuY83^M&E0lyE)hXNuSoxH?;Lg)Nzh1Mvy3q#(=NfU| zF_6S|Ja^(4J)`ly^)|<>fq&STtK_XOc3IRytSTj5I_qekguK3jF42 z0oRYMz)@cuhQjrcWZ(E~b|T9eF_&#T0x|Eq`U7u11nW}Wu9#_yN#LQe%vGnwV6@Me zZj*Pl#^;ok+H;eC41A^4)mN2I__wX>`dcI;whkZO>;7g`p#5!nFkh*CSD6DsEnFAH zbj|vuQV(;eoZ!cs;n8V?NCY0X9VCqxp746bVZ`N~ezJ3}X15njJ2e2jF?(<|J;wZb z7B21_;w!O|+{V&Z`)dM84)LhkZpYGTyESQu*hdt%egmT!h=liQ<=mJT9>%>Y?-9H0 zvExro*V(G?K|fZNw@lj7XV@|>q&bi2fmMtblpa|;LS^tJ@Sfo#&P_Fm_$()-E6Ce>cUr zA7ThwI3EyNtlphfxFWX8Br_^hI-5rbt_jptm=VbXj$r}lqw;nqksvW`=2}_5A2UW3ql608TmIykm?ZA1-L{bV zsIF0GtUx1$x-PH>v!i_y(XDC%A!=M(8pHUK=y(ehn3ARJx8<;t$4;E2oDp8%E0g;X_X9W36<>Hiju-9%0Km#giJ(ZWk%~Jw9jw}Z_ zGjOeHzVQr6b#XK_z29i)snd5}4Q?Cq9k?(|HO&QAuc9?Sz-6c)2JMDSmx2t)53-Kox@Xh>aQjqo7pZE zpy;;T(v}zS_S{c|_!BZMO6`Q=E;x<9VAJ!cAXLV*V2-v+=MU`ple$;F4l>Fm040Wj z^(t&W6&v`)Yh`4{KZdk%O;#4DI74e1JkJ)BSrl=Oih^B8V- zj9ImO1&|sW1+M#Ee0T%DzN7rj{zG8*R7=O3y3M;ORxF z0ytjR6ZWw`HR0=A&oM25`GAz##nF)w8NOcq%x(jVDXy;%y~`iBSw6Ty-g{VQ=J}Z{ zDs9q#lH7`y$v<^YVcHm*e>vaNiS$+VteLguJ?|5q@$5u5WhF!Pe_zrhPB7?~@Bwi* zdhLtgLxxUh^p8=Fl80~F6>sKduEk%(I{e? zHk>FPIad}YFzfi9;0>RNGO9|`L{$Np<|T8vp-wOP?HKNM01<4ev@~uVrjyZhS94a3 zXgf>N{1mlKU=~lEOK_rd?>gR%E+@Q)B z*W$O=hf_QIbB(H(Fjz2lo3eyK`kg{Phr+~(&bIF^skV#aE z#NBe7sVU}eK7L&C;kbstoX05Vqu5KiRL0n8on}KB`#g2#L6+`qO<^qzrBVMuQ>We= z5;gbTbKmBCKVJ`@HG{z?UCw_>;!!S^f7g%x3HKWxZ_G=9@KN6$rfrPo&B_~#_llEM z^N+-0JX*+UMKA<)FvU ze7Jj0n0Nb)kL0pbm7p*1ilMPS=mdVK5UPH{_r(f;QOx*zZ7zDWJYAAPSY!ifzPr|e zT-+^CTQfV|@@e&56S`R!N{a7S`(=@=zek<$BUFx8dl@15U_hm+^erO&OxNa{BRg%? z?N*`n>jv^ndL_}i;%FD}u#cEY)y2Ll`<~A)E9QxQgt|HK_}(+{tnQMeCwpCQHC^pB z_sp&n<^EtM8osE4+=yC~BFsJU=r>66sM%eub}Ij|f>#6YLe;h+7oLgA{PYGAC%S>f zN*M@3p&G<6$MHzJiOUw{T%N@SkLq|HAtz3dBg8q`a9R&|-jBZj`TVQDoM{WzBlF=K zXvs&sY`YYxvl|L86|y<~ujhmtzZit1uI)c_x1ekT{CS7Slp?Fgr!Lv%MDa%9ZLgIh z4S4QHp$l`GbS1rF5ew-tc1rlr&+xg z(i~@zto!9uv#zmSg5JwBc1E)cs_-bap}`&_i(7|^wMk@uYE_26f4QfmlXF$Hq=jHr zw}t1hP0xycrcNbLJ)2j?s}*>+!-2{&T-yY+OX%vEXw$LHO?Pk?3uO;=bYlA{S&h+W z#;5nbLM4DX#Q^gJZUAaN<(uO_?&#qU^hIQ_)ou#$!M8OA6AflQuMZfee_GC59rCB5 znWSEi@1)c3ki{(JMS}h3l_!+0l8t2TRbt#5azv&t^Diuw7*+M+DgI9IJ z(`CqqGNEnz55|$bs3~AT8a%GAsKe^$> zM`~bHo$T0ZIzf!#?q4*?lcn6xN}WLccK0aELqE(6r9>=6JtBd&)7w^4A~5=c{F41@ z(AHtIiqlzccZQj*laTGe7l)@NuGRam@>Z4dkr+;MjWXfS4bR?F z1Cy$6$evVeHTrqqL|EaCz{~0^@Mu9@jl_KfU+>qqWWkD~c#TTm;=BM+F_I~rzH@ek*kYtT|f7B^t{Ab_N%lvl~nQ%|ae{it2 z&OMsOxY*=&TX~zFy6PB(wQY9(Du4Z=!`xG1q@6`>exucGot|k92P=WwG=oEavB`Dg zYkR3M&9ALSOF-AD*PvB{?cc~4x0{!e6f^!;(91ua?PI2U9i5MnKA4OB{rZeoY%-37 z;lz3kf!7wLU&Ocu8ag+x>8X~PO^<4jTu2dBe?9SOE3;J@>j+;_r;U^qB^N)ax=QV& z`l{m675kRMeRBk66OQ6LJnm#c9)aBwpDamPyLLEn2IxjkMX|jmZ94pc8c~{ITU>R$C@IoF&Ld5b~BRPI#GX zWU&w}ZaS-ztg-;~LKb83eVO5uNW_B&32SCFA3r$NC(jhyDgLCQ8wOxQt81w^`Nsrr zaCRTx)WBlV>yMULlV1|h>SgT1U*_3YRUY&+im4cfdDuYi6!IKq?;#qqE_oJ?=v6m^ zQ27FHgZg!{l^nF5nxK8PdeSHwxgrsFuGTMBa1P9>2PS0TYO5|R#QKQwl@OY-_2AAiZ zJ=+u3SKXuUUvRlN9%|IQWOLg5)1RA=esqbmU@-sV*?<)jq>BdW2oV1W<`o-}cm(&G za7uCbbn1t5Phu=<@4H~iZW*4>YBPS;kA@UZ23<+UNZf{P z!cCgBN;NE$QMO+L4BK>#g?Tb^CEPfBs~b-jJlh8kJTCwLh4!ib{xA0;KR%)~ zjlNPE-O}~{oTVc}$IsG-wdzhM4CQS{oF9xnE29R6Ek4V`NZ7}G*|E4_uiK}`P_X%C zMZ^+aJaaqgrh;TyiD1G5&eGiEHH{uMc!9GvN@(B^TLz%){yT;R#FpS#z?mjTvwHJR zv5l56LO8lu{SyCu$yS})sKpm|eczhqVE)FB;Y=Uz9UzRKWC6L`hgm^iK3Hh-v&Kxh zNyiFwv_bBoqL-Q-n$2%IDgN_Xl_UhJu9~h?y(G%8XU8;_%kcYVa{)EiaQ=PNkLDo= zb0!1u)S1Tu&SCX`B{OfIe%vI6Fn7pj=ex|jMYmG!Uiz_6IPAlAXY`Oe*5XI@z1f=Q zj8FNViwGNkl@~6`(^XBMw>nWF!g*KNSO6qEsdlK>Jyuds2dwt*2hVdKF8(J1)fdmF zBUsO;6Xi0+L(5`5=)-MC4dpR!2fe&u4KEUsNs$?*<1qR8X4lx!5uF!6@6;*ksyuDM zU1)du`4iLAH}OxcJJFG`3@wCbLTc5_5p7AcQ3zM_q7*Yzoj%V2D3{iot*qoHDVS|- zQcKtJEh6E#prF(~biA0|&pl_6s7v%VI__3&aXkgd>&L09+qvE^9s#RH3NNVBa03Ge zWebLJ#I1ek#Ywax3P|_6^1k3|ET0}E@!a7A;1!Q@lW#-kD(?Bx}$sq&cB!B4SmcZ9iS@>!=f2exv>K7lgQonJh*p8E)siLhsk=q1}X zeMDzvO5el1gxmtK^ZEl}=Nc&!P&m)|sWE^dfa(j@(uXJXKVg=gQ7{hb0me?p@^c2S zFMb1toTz&!>a}Y&qh)$KAHx=l)|<;!kH3bWw>Pp0GLShghF~a51J8gw*-58-mKcwk zc`}$}s(be7pMIqYe5#wC%$rtc-F%76V|uE`1=w$K7>@~x)lg2ZI(3^AXPL}SeDmf2v3esV2$-uS z&p&T1%PTkKlw!9U71HohZeY)*J2aPB1q7eggX5IcokZ%N`L@^=-LbUU5fYw3`kzmnL-UiYfSm4RAvot`}A*VGBNya7t z#c2ya9N9DtE3=%)X~SBy9-Wa?YxRbamd2TFCUvBbEAC)tY}pO1yJ*SE&=f7K8W?JG zbnyhG$={@A_XD5j42Usiqnu}D$jMvn`N_f){zg7Vdl!f+cXzTc20wVAk19nW{pl zQRR87r|RVS)M>|~iUr8r3?3|&3#Uj!mD6vWn0swV#&+=MOFm~Y{dR}dUZG9;xnx%J zG(CQJnlE-=qTHN+Cj1QpE%f%S%K3vB%jgME1V4gI+N=xj;r;;k)&|JMNJxDCG-&0E zfR_Blu?Wj&zSk0?kxv|x{n0<#TMbrAy1;z-tcC~4>Mr#scz~MFugu}w{L^X6wV4e^ z{Rc{fK#|;Eu6{UD0i?N)5f2~Hn93aaf+UBFf64I`uxtoFi7@~IJQ)aZRzuR|NMJ7e zr94*Ve%!*NKmR5->6x{l!{_kd*9w{0-fU%b(poJt&na^loHFfOd`FaoyL<>+@^A1% zvuuuHkCqNo`;4yKv0%y{kl`201!|dT8c+sFVNHe`Mo)`#gf>E`*Tnext=?(EpT;dd zNZQaW${s{7ePMajm|SEZdGwiblKKe>uPxT*bosGrlwiIjI()1I zR|$nB$M`-%<_Q+6M1V=G8-fp0Fyc)wqAEVOf`)49UYf}(j0q;9zAX*8S7-KjrkTv- z_HS^>QyAuT6yqmKk~zb#!$yIM?T&_R#T`FTTKns@1_J6op*w0K$2IpM^Se<*t4gVru*3|cc8FN|4Wu@Gp1&-)=UywA6taAzcokF( zv?Fp%8&-#Q5zjPz(hPA>E8rGOD6!j&K&(&csv`}ELwlf1`?FusG6MC1CQa( zcQ!qno2B+-@5KkFgl*sWD7CX3KXZWG{QAuP848cx8&)(wZ`s}mw9vP^**EwcOnJm5 zhwpShn~HFrT$+^oT)W>~_csEgp5y3cgrg9??5<=k%lD;^QxCtLcotZrul@7gwG2H7 z+Ly*z)^_#5Wah`SxQa!+%jCN+6yE$&EeU!BF^jpm^k}*(B)|XU9Eb&XKg*f%(yBgv zKwzFRD2VZ%q|Uf4iS^D>S>-h``3z$A$a=DVQ)d|I3s(Ww0@%F{jxFlZ-e16G8Z<7jrah~hA9B8_Duf>S#YPsr2h^TqLlP;`X_$mI zxnru|vc)s#84pCLx@v=MnYqPXDMt~*0?nI?7o3m&oaHKfr}QvZsDAq#VkW7Wt653l zA;~_NIyQogJO|+}EcZ$=n)gu@a5OMhwFEW^D?a2icYQJ)iiR(O4P+J!kTcT88QWK^ zZI3o%ZuM_kHkk%_K72%G9*sz8HEIy(y(V7VdTTCjZ=2OJpJE7;;z@E9tINOdhZzKWM?O2kCt-E-Q*QaM;`XIr^#0>WUD@!@F7W zS)8oI>ZNQ6j=HU@;@j%(vD`dj|9-0fi^1{8F@afa{V#~V57a<`OhK7ZnIgTkk3UaE zMtpvFw|wY4F1L=>M(Gl}m@iKD9RKMVFY@PX4LMWJ^e(;eoH1b<(moVCgHhQXxgee1 z^IWLj>*lutCF|V`nP{IJ&H8B|D<4s-yAQlkQwjCt8x7s925y7ANG)K@cLK;%ZG**U zUX)+*zVfO5j4yN_-xcfKzHOZUGGsLV%y7NVFoAnIwBsLARX)4$n6z2%1?94bH_r(_ ze?yLo`qOPVdw)Jix3OlSxqsMqL1zO|Igh6{WKEfPtSqMP%ZGO_UK2OEz~ z%>H0?^$=M#ui<$PHPAp6TIDE$jg?UQ>OQ@}lB*olKPxniNxx!x(a<5&k=LOr`2vD@ z)Mn|meoH9y$)8??jbV-co_*8MGMk+lpMd!AVJTZEwKUvxe)dN&qn2_4u#$tq= z^6}pNBhRG-!vq(kBwro~;u&F*^NbyQV|ys=NKCx&f9N~RQOi$`#GA;&5_s#FC8Ex3 zn1BE5e-UAV{wBga{zHUW`-@|r1@rPiESSst!ED+ppvQ4Gn$)LWw(L|+x!5h3N^;WN zsbqPmEYC#xYO6Tb0Ul*Ll4%|zy0AT1LLe5CRsaa3#%Ny^M zeuH?2!UJr^2{98H4V~in#YHWe);&YgEqDYr*an#>7=1-3DS=w~SgE}$>fF)+KoIU@ zuN&EkobnlY-Sc(Sc26d`^qNoy{_`8BbOJW~MkbHusvh3%u<*%T{xEu*G<4`z-HPi3 ztu1hw^Vin!xu`LoM&&XLi^~#OI~HAR)m)5t8}562vNVWwF3oqup#a0KYe2Vdl+xdi zT%a=LSYiQwg?|-nVEawpO(R&CZr|de7hj|6Q(jSaA7L~-nsww5!k2QDE?AIFHKG`% zgZY=rPp9{H=GT>ps2?%SJ8ln*#N^5(*4%@9*yFF&kmNJ`l!O$&%poZZ~eMgoT_n9R$Z zMDohwLpwMc8s_3o$H@&CROWwo@QF1aD*zXS)kULhl{YY}Sx0cTIFTpjI!JPlPN>1Z z@0(wyc?`<8xM%SNoM%Tw5_U{PCA zUo{ArfCaQ?JJcd$S6g+59_T)@i17N#Rp%d6K;cDa-S5*=5tKh~H~eg#jb*6^C19~mkDmN>E zg+QFU@Q^;iJYLW<24bWQ+-**4)qmf7{AxJYJp?ts*%#@k*?Yb_@3?&R#mM8C_W>r| ze{HuX%Hq=Y*V%tY-fWidEYRH}8<;cczH$KB(?B=YX@RsfBmwmX>PQW6iG3$79*MzY zlAl-zsG^9EQS!Ykk%P}bIdAp=OrN;0RY{4wQrbAv71FWvZs~Go3(E9T0K=wAS-*Zf zm}AbMaQaI;|1_P z>$i#rOsoK_?MO)2o5nNz{~R~CU911JrakGD`KSE_f6}C9b)8#En>fR1fsQD<)~j*S zLr-__TpsgY4kPs)CFiJ@33{{oWZq;oLv56cslzsU<-d|@LI)R1UVo@qDfnlHoSmsP zMSO^qzdMjt^_0&erJU#M%-LZ3C#D_Rut}C1%5hPkVfWuX+nP^Dtd|zf@d{^AINupM z8~q>B&O90l_wV~fg@{TbYmrKpv4pIXR0@S;UxpB6OZGi`C0q7nOOk!xnaRFp-^UVS z?1RBzw&$9@-`{=T=RD^*=c)Vu>1gI!KHK~Cz6i}FPrNH+Kjm)d2y!gu-r4+%%j>ii zcVBLk*I?t*JjIt69_ZCxjy$h5TjmEc&BwhLXoO2`&iY~QeB9u#K4YVK)AV_fhBvS5 z-GrLHS|Q!S6P%aOLm#-KHf#k?k;lh~6ht7lJ;nvJ&Q? z6=B!eoA3SYkS?qu%TLCoWA;s$hc#tQ`VX2Z z_U5Qgm^v4tL+1op)x2Zzv96u>U`M8Clm_$fua7))Hg?R9pvQ2({j1(|*exKG>1?s{ zHqW?NVjD1fIc7bo(TGn(TGw z%$U;VLDWk3EZ#k~4e^)sUHJx~{w{NT<7{wOtNlYvDwP;Kvg9rh>@1^en`iVZqHTn}x$#BT6S@BknKZmJhNJIajx}*Mq_M_4 zzWLWRzXZiwdW_=zE4(H{LSX74t+mXZ8KSBhaV)7**}$U0*24Mja0HLIhj$}?-ncw@ z(B$ncq5e#t&-YmFdf5}8@ZY^LqQhLK(#LOFTQT4^tM*g#bNIPMQUd)>N6p&32Ym$| z{!b@b7uu3{&E(1-nbN7n-`=ex_hCyt=Ew`Tr}iu+F*ZPh!{aA;x^h8)wuzi0&*f`) zcb2SJd)+kXfW6JM0fnO)@=})M#>boxdJLcF`@hg~UR1vl2}GJv665CX3Is=FXU><> zmC=law@cbe`x?g*PbOPv+6c?k_S+@9hR}0_=Pfc13_tyXiEgz1j8Cbkg_oJsx9dz= z#CEgT^h!GwXvoDqDory;?i4d9G^2CJp6b_twIdXYIBAFGJ)BOK{0`1QJFeb|nDDDV z@LJsV7Kyw5?&7T9*^bRy&ZC;icKt7OZBz%#^oB?GC-Ypi&mBwUO5o;9r^K+_R7e2#uc5~K-=)+dI=bTk6mln z2+UZnxXb}7M_Nm-QdHM#2DE3!3>QSYdr zk(TVK2wjN%k**jrsRF4tx8r+x=eC$qQI3)d6`VN(Vp!If40WAOmUETR`5f$_{QMg{ z`?!Q}!)@1|6Ftdt2Az-C&NX5^I40_f$lwEzP)p|T#o&GhFiZj+uEr$$qGqwTH}Wxu zvhJ>1)c!lBuBjZY+{tQ3RNgA-lIu>pMw0fB2K8QSBt@rvCHN=B2Gy@J*Gn5Y#Ip|ah+1(vnZnh1sMnuCC+zIUjQn9!$~f1rI|ayZ@}AF1F&$hw9MuZS&xW&o_c;5o^QY$CgPN_rL*QlxV0LWd+tdwM?E-6745=C_OsPA^gm>-Y43Ys>+< z7EudetI@^4qqbSK+x#vKLloHW0Stk9=z44lveeQ(J*lGqsYmo{xm=qk3bo8dGY)MW z8=pgk9>+C!h~UUhJf-T~ANde1#tsWi8>0wfImZ8BWufH&U55z=imQValE=h2s1m7l(Gaef;(+MzbKR@aHv+jrvPpsFe}BW3M9`S0#<_tSG*YSRQiRPl)rc1lP^J}74W^ZxkD^wal2 z#~;M~$l|<&Sk6}o787#OS}!txYfWN>HGNEZPhfcfO}Kqa!2S_0`04d3O)q|&DepRl z;X=PZS3b4NmloGyU)qyzWbJS~30op~iXM@O!GbtamMj1M;1b;=LIP&JtKs5U6{e9f>Hc+Qaq18BpSFlm2s+;`gAt05Eik)|nhRmV8uE?Wnm-$-D12J}AdYgtz`9B9L5$ zLJ(`BD4A|tmutN5L1ui$RF|H6aUHXR^#=K3=jsysc$Rul2`5I)47Bt92N_@q#phtjjsY4ddPcU%nwN+8T3Ti(~BBP zTerpoFCMAnb-5VzeX5mb=8CHRPvgtem}uj)x<|v&dcK^8TW^`W(UaAsI|&k_n%?g{ zpNY=h;FZ@+8D$)eqCqwtWhzwgkv|wUbI3bipdW%i!?<3px=WY0qVa5-$2uMPmAMkk z3Y2YRceS=7Tn6ZQ*;cMuT%2hHqY}fv?5cw851~2Fc05e*lG2bOeW}2-cS3AV*8=y< z#e_$-yW?tXETs-|xxlN`l{9N7DJQoM07n$3_pg2h zxkClN>REhGEg32`a%f>nS0V8i);%2(o5cpNN>pXW3poRXJ0CX}3VD%L{BriTD^T1A zCD(tOaoijw$9IU&7Om^vnjRLwp)xbE-c7-$?4CVqHS*eO*;wk&upB=?k3RPnPPtf)3`xIKd4(%vxldFI-c33ikI(oVY~PxVd!-9Ro1`gi6COX51m*A@}H-j70ff2ieidHOV-b1)N;&* z4B0R0<%!M~qHmD4dLnFVpDbu@xUAkm-)$s%bV&DeN$=S1%WkKJd&HOkqIa2NC0h0x`oMJMG!K zK3=L+*;s`@w+YqnJaz?S)*`l(i|oO4vGdVo&LWjQK>?it_y909L(rPa6PM;+%7e7d z2|*%oq+{w3vyKF?(bl5h1TH80+SRUCTs+)kNe$>y8k?Uv;tU`IJ5V3Vd26r9O2Hi(ly~{OnO+gqXISF5ztk zm|x|jVCCe8w%y)PbRVe=N)+MB^>LdIlbrOyT?&Sdy4UXn^$jY&E<_bZB-_Zv(me^` zymJs${{BSQ4fccIvZq}-ti*GzVeNnKjmq*2q1sy}qI}<+X%+xrcpKalswDZPCHVV0X_Ak9j>rKW`cy)EN0gho`s_sWa?g9ubkNs z0?}J|PNvXP0gi6oD6E|EK$2nPeRg7*X<49{LK$iHwb<<8VI5^%@9waUu`?9EA21wC zD7vNHkPBxnK=~g8`^J7pU2CXgPDCT)7pi^g-}X}ZA4EpHUGSE4>Fp-{{O)QW{~Ca} z@~`00bt#1lU2(Ox$V$FUllne@!UdRyq1I(aa9t#88ep=0TX$6khr{a>>LrtoG@!}u zHGK!uBVF~4~ z=xOzgm1}v)fu!PFZVoHjD5iHs?un`M*BZw-E2Q^*puSoJ8>dNMeg?zO;Z^corbPm( z|MWz)!HBk|^fyG?Z_8n+O0@;@#1H<< zvE(td@-0o!7Ce@0>e1`rg*pHg=yuPxPd>8+TIA3v0n6xJ=>S=RxJt|vnFiDn4_6i0A!&O?!?H-jWMXQN;hy>7IodgO9AHyIMVCNY3%K-p@pCYvMs|TK=Ckq#y5R`e)qd5 zf%SJpsI9y>*B!sY2iBzegeiil3=ZJGw%@tghFq;8hx|+nxc+_dsnEqntR;!)imfNS zZb+Rec^u-7sK}-zkO^Eo)d@6$1jqe~R>ME3blaNyl);<=1!Yn{1EkJm8nZbHYRO5S z2-&$FB*PVa>q5akaT-I~55e^u+bTZo)hVc7c8wHIEx-RWU^69#v$sL>YnEWCsUj}J zefz4J^Q{2zM09boK|at$9@6Y-g{--)e)|REozPW^^3~45D~$if`G%JoAP*zF!Wb;I z)YRBk2I(Cd!DycOFGurdf#QS!);?0sIr8x{Wd^BkF!eFj&Plm>dps#QthN*9XF9?EZT!Ms}k960fjPR6Hv2 z@tUtmy%jNBX5%HuXZqf^d-T^8?tYJ_y4|@@ljH9$cj9DUR#P2w9pZ2$SN{VtmS3j^ zxK;4)8@mbhdsa8qksKN|)#Mj?Qe+Go-KTxdITY7|I2GVFMY`3HS_=Ipu4A-7jx(n* zu{y>MR0!#tH?y9)>vcoY;V|{{-8j1gAm7q^qe+-|mnWy{`*nm`(IF<|( zPA+L&s$3$T(ff$;)*?^wY7A zrrwn)VrR_{d$tYiXFl4mLw8mMxCAfsJQ&j15Julc5lIy)6fV%K0E=xjFVM6z%MQS2 zL=cBJM&>79Hl0$qnEV#WMT6W~2A&|LxPpa#@o$#v6XkXwyPO>vRD-UEbI6@vw%cV{ zs>7FvTWg~z>=BzGXy2EEVuP20(XTk050t_apbI_+UDi`!lG7|3gc%Y6Rs?M7pr>^! z?UHfhy*}py7l+G@Z=z-9ao)~%{SV@e3x)^55eDzp^};;Y#jy*1kbL|$16_&cR-+^2 z7M24|ko6UWfb!zAGsM`wrcRi6ov|H9f8a~Vg<3N28-g2pw$yTHht8;E|135OO5*DV z)rIS1%2aKB0iWyop*3&`Nov{$hLEPDMn5Rj*^tXiF<~aF$%}fs@Q{&H*!#>-zU5O3 zx?^i3djH+)-x_F{>V*l6LI_x<*1Hj_Sii+Ct{>Xl=m`gqqXmsoT)Ks4$){b@>LBHC?JV3Uk#g4`x^Swz2*$kWU4Cg|>B* zfT|7W*hpX&s5CT=sV7?mWB{vyJ*0iaix)I!?Bq)4FSzcEY3QsABid>TEGZ^1Aiy{D znNGW^^af6iC%=;8*XgN}LDz{jdx6}=pSsQ#-4e=NORlC=x40KUwmfyPPn7jia`SZ; z*$0~3)jD<3*Ce}FpsHX<-l1j=3szVWs00OG-GrO9qx{Gkq!X3 zKGg+D683os)^wn10}D2huk6d6B@My1dBCwi<_GQ&f8j89(sY`30=qFTc7M{2)n!<$ z)?vg5Sc{ncF!S~7PL_2R-NfR(WP9&ZEam*(Jd9y#)dUuyFroAy}bth5zN+D?@BI**{VZ4CTZVtA^$ySf0wWf<<7Q4?5uB=I=v>6LP7GpMVL2_9Yf;8Y&MilTx&KDrZ);qI%gFohmEnq9*inzredLihG z3HGafcE~$q^4aO?qZGQf8e5!%D`2koruWG;FfeARrTS+1UJfidjKna19V4a_L*NPXW7Z98GNohRbg z)2(|Ab(~a5Y&45A{}{`hW-Uaxc>BcpmTsW4dOux|b-UZd+d@i-#N!Wv3k#hZJ=|TzgcISb2<8RSR)nt;xp;-*Hx-w9W{L#prhG|+ORgl! zqcd7FF!2Vw-f9^arzL;Y<(CMnes1h*!s|vDm)EAkKJ$g+{Xz#aZ9?X^h*6P{`(kipVj*CP%YU*n+7)vZ0_d zGD)Eo^(NI@11@sw-*%h-somlH)!X?K?@Xp^qCHKk5k9-Qu%MphtVhWwjar*b4kA|i z#=aN2B+LLbpRfl{0Wdw#`eSdep;B;4yt%61;EOrp8^9Fnlt!vA@i=1zSA~0a_+ih% z1`%Fc%Y2PAd}jgGlX$Dv$;k1C_y(|n5DGKr0*UMTH28HV+~m^^J@gR>U;3eZLJ+fY z5!WO3imXMi(*>SK4}pILW8lJFxp6xH-8+D|Y5#KC1GL@t0w{d*VKC}N?>faj#rI#k z3U@{D5l4t%1q1oI;vufc3R~J#*Nw?#`NPeOH4*jK3PzIl)#Ld_l@gm6j#+{N;ZPFc zKsNoPRDo(!kCi%Z9;l5o@Q@uGWQieMJ}mO1$1t&&zCA_Pgwe*BT?X9;kzAZr=VAVP zDQ#@^gzR&R62={0bmS`LP4p59j-5ao?AjI{ew63T#WOwhX}msLfy@k)`AVy39{aYj z9i#~NP5x>O%_Cgi07&{bW1|(vyJJ(Meiie-QfUr6Eyg5&)_kHO${u+mh#&1UZjr0n z=XFy=OiM|sF)}sjY>DlNu^Go=<&aEw)=KqW{AkU?B#EFOsQ@-qJLY#-v%5O^P;%;A zE2wQ9Tn~5naEAFjli@@G-J-Nokk6ERI@B@?qDIqFes@SfSTh|X?f*2KPM-``M&_o> z*b$Y2^APffI<9+@o~ObrVndbOpCEaUJjR~~;sUE>t+&oiAeu!leAScEd{ z#0oFLo}$;F(K$5+eCXue;yqwm_1rbC1lE5#V{!TgZ=KZS^2PAp39RP2b4%% zC27-oSnRd@-RG#SvG8OdxUi|BOsKGor^n1o@qYdn#r~7o3o(fX9PCOOHWlg{4;6ua znckz_&@DG#G-=Gr@ND0|>ee6c0fb)!`~siSG4+O)I5v0z=N)E^8E2gM7VbI48*e!0 zRY}N7@#svJbCej$sH-47tZZv4DXiiwx2mKkAoK0ALif&LMNzp58a4u zOqKYRIAN3{<1*r)S5nbPY*1{20gJ!%9yo=L$=MsN5=4z?*Xb&4LFr$=Ga$TEi696T zmJ4h%_#XhBLx~BIziSmF+#37O*o;{q?<d zwL^fgmv%7rU8j&8U;|YKo2u|zy2H^$$~PTkl*=sTX2%5G$2C^dn(*I#=~Dgq9bQ!g z0DVy48dhIx$cTBr9rhr}_;Gugs?W3Xf9z@g9c8*KLv@T?5@o!W)U%Ck(+tVlGN9J? z98(x8w+6m#iylD0@l?Sf$72PYar*GxI^}D)+zyi$|6(^*(G6Jie zb}z0$0DqDtV{wHF1gMu87}tAKl+=#vXjtv8G z4aY+1H;pC{ggpZk2EIQRI@KA=A8>6tbcL{BhAUXDkj+#1qo#UHBQZlMyoTI? zg)in7!u2)D*MJ4su0hOgVk3HoG(L!kJT~0uh{!Z8rv4}4WBK?6b~%q5PK7!l1dFct z1rVq7A(2?46+#5p*Y{moI!3W1^~M=wv6<46C>nKW4LWSIs(4F8YievSLDaK{fH?9q zAA#QoIVmI9YQWHf2st)(RQuQl2}dHr+FQ_QGcWH=YuD|ejsb?Vhu*%wlGL^p-As23 z6M+61{?)7EtAWqkwwv$yz4N01!BJ6qHgCeIF@0@ky;T~et)xWEm&qv*_^rUY{Qs}O z`tLXoR9E0K$o(bne~+vuECBpEP(QbNwBP>rqPVk*Y2qugYQu^wf}RxcuNxoNL){%F zPJmttvf44rj;TU0uQAr@;RTJrn=PS7BsvI zzrD~^Ui8fS>OLyPvnN^F{kn}NNaRPQyK(E@a$r(;>&8cNDld(+xG5o{W6Ih)x*v&Qu*^QT2n6|r`VH@$SxyL45Be4Fi&ado0 zL0M$Yp&vJI;|DDt8SD|gdTPn$E;8tv!F=H@pTPypHV1(~b}aHOQa?WuKfkZS$SePSrMMxeZ`$qJJskR<#9}^jYpjX#)d|ez|*aiWkZF?tf>DWS;$6 z`iFJ?zMbR+dxW=j%J-h+v)$NnVVDFy-KCJonN{Bo@}6vsvNN#0vJ59>>A zjIHjiBbo0koqdNZm;cJ#g?qHrAD}56KLoT3gBv=Cn#?Q8Sdj>Jsk73*&?Tjb`jIpZ zyF9PKiwVtpxIXlTrd7RH);^nkU4Me%lO&W(FB+H@b=A9!R)?N9`sL$^w6}(y8zUX~ zU}u%MYCO^Pl6i+HHj)z#F~+3}0y)_wuy!MUw0b*5+1DmwI*lAbd=z@cwSOXsX z=b9p!%W+&MC%rH~(s|&E$Kyf6(J(4;%q`?0>!go0ea*@J zrZiZW*@T~b6g>Rr4Rb%*pj*HMEUBpYxDry7Pe?`EqrE84h#`?y$H1l1!27IKL|QF4 zWoh!k;YfIwn+{q0-WKnh;?+epBjwXEz^m|bT_!R0rcdMQaKbSd+)RmRiHyB)N(^(;OeA9%^bsaaphvjU^WEH)54 zLWSVhs4)-_B>RR5ZCpNOT&$m{clX1$hw-^^^h-2m=U~C#aY3WR*bDBCSrpy|)t9-A z%@pW`Hc9R88t+Uyxqn4g*wa>)&~H;Uxs&@Il{*8O8&$>fb|mT7$9^XMlv#a)cI2o1 z&Mc(6B&7H1ZLRs%T+w1+GO7B?*N1O+STML{CF*RC7p6NDym>1$3|5((au1CvDp0yq z*BSIb(-CE z>#YjgcmDkHv{aFc?}CMSkhbZ9r3=e*E62cVDUHw7ebfvJ(63fS(eduMVrRqAjpFqS zRZ(v~us70I8&z`-GVAPC$HfNz9O%G~U+ftr6@7P2!vZT`*KH{y4&>ud1p>J^A+d7Ch4U{>|O6N zU{TsIWOVw~&*P7J^Im}_;`n5RrTCxE^^Q=Gc8}#X;lqrJb!+aO5sr(~fzn?P8gSLm zlkb`r#N~ZEDg0lKQoji!eyGUQO00=~;~Wt4t6w)Oma72WSt@@MA2jICk~Tb_-X5bteUU2|cw>fi~yxR5#7-&78q-HYF*5=+ucXJ8hq=Hg>(%q?0 zRPKOO?D16xIU+&-ng78$vNEI`Vi0l=pw)n9@6t$dPtf<4h~)3z{muj^futSzTz;aw zh7Bx&0a_T(S)^@!A*e>sHz`XNQ{pURdeuN}{gzFwtYTN~ve&yiO}4z>%=qn4Z8H_2 zfDu4)$FHbgQM@c$4_tUMl4)}Pq>%adv&`p@0yoVLexdvo2~#uLm z8Zd>2p2q%7;lBxNfq^?|k}*8ur$*zGahEdNfd_ZLO~k!9nFVN8?L)QY+qj{uK0WQX z-%pNNF_|8d`QxJlBbmOouKdJOMC%+6AopLk*X+qcd_^k*7ML-%m317H-l zoXL>ERoRH$N*Ibe*CPks8dCaOsD0fOY3>mWOqz)E;iv{H%?<9qKwvc29U9mp-ztrAE!%lbhlT=Kfnx zt}|Xh=k;E3IynMtCBk}vurbR&hjWU7>MT8Xj$-mcMmR~^lIv*g?bYmP=mi75Zy6~$ zN9xq%aui*D?_&6D*sksg)5M;K@KeaD?QX8FITvw{&8wObD=S4BjSim&`N7a(y7bat zDMX@Q12@$taq9Z992BiNfsY4Ulzh~XpF;!!lVkJBw4Qm|o%_v^1k-U1YmVmL(=%@z zz9ji=+x{WEjqFD!SKU~_T~)q`T8GjMYgSzDKgI81E`AsTKq;!zH1PZnKD+Nzru+D{ z!0Vvo*csbP+2Ao;ILw4tIGJx22Zd-e=ziv;!C06bt?l72AOmm}^t|$8cXyW*qPg^v z*y5O=!qmBfv%(K6JtvA>enJ0X5NKSkvOnZ1Nh!c&G~wGrdT#%Drt$sw-Lw%?cusUo zkLJANnOhRku_mQIBnoZVwOFQNQi~k3uQEDap`g_*QvRw!k>k#ryUF_D9}1x^>-fh1 zpb*TKch1x?8>n3*al2uF1Kn*RPz=*FS(y2`{WpRD4!f;<>P_F|cWZ&7_VjF=*Vb*c zeHx#kEYeS~e?}FvjI39~2|uKiGRi57YmIg|}Gaem*KJWhl=iX+^Yg~>4K9efHPca3U-5E0E zZhpLu$XYLe2jC*Mq}5nysmhysW4EcXiV^M>8}d zITYgvibKFd@G)_ie(eV;+BbPgmj?+=6zQg8h`Aq3l~bFt;-r!h+|qjEp`NyPSnrP) zmUp9|MLCcX;1Z%;zfHhB`IYZgo9Dv$<2o!qF11KmShWxZlYg@u3#R;9e>LTQ4%XO5 zlYu6a;y!us@c-rxtdNb@L4B*K_Pl0T^4EzoQLXQhROQKJ!TT`dSA)6j&}C<^=51Xg zyfqVE6czXL;I?$~llJGmbdIkTL;dmwFKIL#8qEZbW+!xXB&45Lb{j=T&>6HV zfAsM8kfB-g)jkC}7Y#X&!Ud&~#bAp)!*REi%FfaCK#sMT!f3Mh4`6vDhSHmBzy#b{ zFJ#?-3W(xAJmviJEBt5U6=89*Tk(QL!Q_o=lpLAIB93ZS%0KSnX5#@?Ef=_3&gjbp zp`UBPdY4a)@92$xbih3f8Ws5Mc9U%8>U}qjMCa$JMKz;T1aYI_@ukqd$)rzyTEm+W zt^}`7(7WnUAD&p)hfxo!xc;wKT`BCzQt0Pg&S56x(^B{SFU()FV!z9oe--_aZCYHs za`1$(^Um}D*I<_*V+6#);n6gZqr}GIkX}~FNn@w$_g=h zLKfpw{3X5%TCo~C5ff>8X?zWt&w#G`BeJO?2qXeBb+xWnD>I)P?vn26-1YWw)^EVk7F^aj8D6IXc=g^r_CUN_b4IXS zXvK9I4sev;-_X(DY5*%zd^6oEApjso5%XI@?D-;eiNZxbt zurc|!d!I6zZy15pMd@@wU8qOdxa?Suw9W0MKD+8;3J%M%A2^nVh4C}#l-{3wm5aDU zdsg3KxU_`jQU(W)p8C8@n?5`-S=7CctOFjE*tTfb>+e=B=nki&FC9c_$!W(4Vj|3L z)V~yG*R%L+0UWww@fpcwiqC$>V^*`jGOiN%CmySVcudQ}t7=CRM=N6B6nU3r@a~DD zS;yJ0gu0PTwUr|;{DpeR=>2box+!E-f9xMp5gd_<36EInPT%!2*%^5$gkv+ z=^jonpT_h4UR|QH5#B2u{>-RM;O{iDQbfjhIXIaQ5(QWIM>DbO;HRkHw(WuHxG@+D z(2P+of4l{AZqd&AT=@Xt+QXW0W2@vJ{WjZl0c$=T zAUe z^;45u?K68kWaj+Kf8!=;?ncQLjrkPRJYSxz-AC#)Xl%XP=<#?pRr&JR@5ns_9C7)N z`kV^LeEdn%aFnIQhDM{~j`N#u_;&rO2GLVWJ`M&=QCgxoI=_LVvS^oUT^1aUDW@hg!z6ySv6l&867DPZV3K%fXI3 z@bpsAFTG{Eg-=b$4{R${N5{xNP{qF%WypR*^=?*XntuIDLbX1x^T!B&uD%BLUs z(!qO$P<+~q_MjOtmY6~M=-x@h!6JR-B(oF{YpGc$EmEWx4@>n=HA4ckgXxWt6IlLw z@g3Nz0WM1@pHC3GRdzAj(< zvG34l6*E;e*}j`q7v#x1Z<~)=7C!VlLhVMPm&kjMDE_eR^VgWbV4Ph-HPW@l|+M zsWNXrg1ErEh!$~)|MM^S)A9^8EP*rw37Pvf1NRfryOXL?X*MQc8{@nlf+IciSbY1u zf-c*B1Cf#y&b%-$JAPCcHZj7wEmDy2%cyto$Psq22X_>nELUIBm}(9X35)vRmKHQC zqnn0;y?|~+A5so}K}e=si78b@Uf5QdmkdUG6vR|KP)b(gV;CE6?~&baNJOJQg|r^M zhaYf+dleK(O#AHi2AnJNMod&*H6XtBONRI7kTNt_3s?;$y(~EwF|?RZZ?FIHN}i4U z{{H(mEyk5DtkmCe^}2Su{?!Z2#2-;g~XCZI;8(9T{)6$cN*)usQDu zp6=UrACDlga}~LrE_5`7E6#JNnp3IEMx=L~P^*d)ByAuOe(5W(-Ir|oH|HeuPG<5g zUWR9Bk?v;J+6 zDiVGz!nY>lJU;heVN6WfPq45y+xc~L=t@;noPcMZ^v5PhcSO6J(H|Yge|`_Y zPqz*mWp$W|?Gus*-jtV*7vA`;pBLNA!Atmh9+O8%JxcX9`=PAnh}}-_KvYj>AJpQF zV!>9$$i-=W-O@mj!Ee=Uqitc%$ZMcP7~YF0=HS(MXTMWj8|1F5COhh9|AYq9D`5Dh73pB$sn<-l&RFc-c^0$)Yqy0EGuC>g7 zJ-dV$;h>apOtW9|`1HYDSHbJWK6pzSdTI>==>rEfOELS4tVzr?c8 z_KLZ6cwd_}8(MQsfbN!|g@yZ*uO`NGp31x~j0{d$3arRaAqzgHDPrope}1=~O*nHO zmf+ip)@8YY3!(}-8G1GDepxD?aeYF;roA2Ojjk1DTD#MH7@hvlhM%ZZ4KVLdt(x&W z3=g_Cw#e?9sejV>#)eSk6zCPR2#;VHNu;{ctawWDUhr-MSi6L`D@YanFqyYh!up`jtTu;H{LJoo^PmFQAZ7yVcyB3W09$JYkK~N z2k8-6PQqMxdS$41wiNGN#5D$8 zF$Tw2u)2mm@8zVYU7@z=(#dsJ$(R^#uGC$^VIsfn2Z)Y#uqJBSa+65G;_8^ zloe6s%pUsL)NXZEetN9|LL%mY534Bv|I8{%=D8ecQ!-5--!ko^){ z-x8?`#K?IB>#3i<&CE+pugBS0nsLC8&Sp_gAPx7XmFl`@-y14@mc6EmJ$H7f?GtyG z0#1eN{U-V80Sy(&?j>uQ0l4W;0r#X&{XVRSwjr&*xpg0sZ(UaE6ZZ-jdt=HuEZ8c^ ze^p}3J-9w#A;=UX{Ho+tsmWDJnaY?~N&4NR;2k{4R%CLs)4SN%{osw53{@BT;>YK+ zZgfY-bhLV8pr-`0i|r2F(=Q(6Znx%Kq9KI>S7L&Gmktnw+uXd$-K$=8p!6R-rkU3zf9Hw3yzM zyz#%tg?z93?F1e8F_dh|7~im(6BC-%c$3>KX0aaJGtj60wZ-cap=YlobXBI45NdVR z+cG6V+z{3qf6@f+Q@K!)a5L7v>zSj2@VcxurDu*(qtn7xYC=eJGo>KiYD2qmGbz9! z8MXc90m1M2wb-&m9>aFJ{c;Cyd9ZCizVrT>wSQ~ta~>0=&)WNiOIAgJ)~QmddKRpC z;^N)=bbWBxbNa<>@scV6G?e(9F0(VG|HX;7Chv&Ot#HU zj^CG7{8*JAUTyq5>xIknEI*rrVJ_xng#CS^b8o&BNXY3SG=*d&@wxN1`RN?AcA`sz z3~%3Zsk8EcsJeG*hGiUljCl$Po}wGzZYT2IzuAklVWd&TV(*wyVOzS1=%(iPZSJQ%N0s zK=P8}9)#kf3@>pmxzZ(jtY z&pgOP?CD$T*?X0e%&`*|cj4=qWxYGH>Wgo?6s6`GwuK?V&#fYKO8m7s`;%Xpto97< z!Pv$%XD)ku!T6kAoE6%-m2pX0I=w0QCKu*?>=0K%@Z$#{y=T5Ea5H&|1s(xe$Z||X zSZ0q=`8?%RZeb3l${!y1-s9zo@mj27Spo?|W6_ob<_sDScf%r|?51+&^_frEb7V=4 zwW1L(v!;v%v9y?|4m=_&_UCvR?H=chxBXV8*fs)s?#42TSMiFB> z$vr)^iiz4+Rv4L9@3eg((mRpL+GBlnD-7;hDbU&G?iN{tc^|gI0(UiVH=lZ%!iqIr zDmb;`{JsHK^(fWkl2528L&saSQ&96@+yV2i#87v7-d&}|be2v^iQ%G~J#2>zt4kR6 zBqU|#kmrulWeCbE5t%a7$t5~8cP5lXr*rE5jJ%nX&> zXIA#Bh$F<+U)@d4^yX=qe#r+3S%u_$VlaZlnQS@v z((qBh?2$K?S|tm`(#5cZkifsIU~UO_hd{bfq-Q;M*}o=kuyB?x1kH*-l6>G}->>s5 zU%Mr%j!)gc?YhXbD}uTxLQ|_8%;r%%>5&4mU)IUOR`K?>1A z_r03~nl(kutJ0afm@q-F*7rs>lk@si4Ohe9N(K|bUl$UuexD;w!{x`o|K4}LRM7!~f9JS6MfjP8Gt)*`zAD_i@~ z#J*JO_=GTO@8+7)r!d)Cea5$5ZG3ffx}daeUk)QYs!M3Zm;U;3<6XY&Q_G94LgKHm-n~qw8$C+4}~62sVEZaoNqf0 z6M?1e&TMks+l{K|)d)Q(<_~pG0BOUF>4$pva65M)uGRYZH||wRApcF5_%-SvrbDtN zw##<=ZNEOX*pLu$J{TW*!dqEB_Xe@EQ+D|%e@~W6o|xKX{Vr~9%AOHJSGIq=$gWD4 zGnn06u)t9sY}~Vdxuy-mTySA1uJWa@3nBH=%u@pgUu_@Apsb=pd~4Nx**-LjG(*7F zMThwBr&L6jB~g5x1%y0PcWXB;gID%DYBM|*@P~q+FdYTK2CKO&xs&<<>#N_*bZSr~ zz|-~@WagvKtfZ0cA`Np1QKTY+0KI<=hkDW{={&85Bphev%G)q(a}Rm~p>M$?2sz4J z51J8!IbKX>kGxpI{bP zZNFb|YR!VKCgK`K{r&#Xrs6ZJ8L_2!G+Q>8Th0CQLj3Kqq4~N_;c2;cg{Ow z-LxM-7~vQ2ww))uyM+9w*YM=h?-mO0b#wh2byiLy5uk_S`gG&N>p#AL@HZ&_Ihnoq z_vJHZ5LZSahaB@2QbQa~yceuusxrRJpWnKL5bN##aZ%)Zjj|(~vPaxm`xOuPNKp#0 z@91>-KsP1mp0I%X$v`G}*CmDOaQb0!f_-nAG3&;R8|!NJNB72{?w7ss^ZmqwPd@hH z<$cbK3#jJg5oN!B8ZHA#W_bSRNL#tB~ zLwu+RqfF0*1;By|YyMp}_y(4cDtI$Fz1*SrO-Em``t+9KhsDpP0HSxicFM3{wCP68 z2Ny@q#hW`%{oI5G!%>oaZP(}gK)-0IjQ3HOfg-VRlbIC;YgG~pwflBhjtL_@HnSZ+ zi?>c0x=JY637e|SP7IN0&I;xdRm7zzAiP!|oZ_5|u<}Z~z3@JKc*qDS7|Jq zX79?OCDx?^U7G(@&wT0`ibR!%9~9W|*N%B&_#yF{&FI&1IlKHZHT_#JulD| znM9OqqNt@?#SjS#YGiA3DGwNlW+vlKkLa&s-;iWheyyFv(W;s1Ep{IUXbP&Z%KS7; zBD8Q9O`CFX-FI(tljD>FkX^J-%YP2Ii?)b>RUjDbPoXxdr? zyI-XJDFgY`MI4D_Q5SLMBhDVSpcr*8!R5itZ~r?BodtUykLq8()}S=jbbg z0D9ZJdmvPR@fBw|g;j;@c`tFn;W_JSS`7{PzM4C!+={tdpd#!|(f-$j zj(4g(#-zO(3e9HzQUsUY;T$)pBQ_vXx^=LkXjp!xJ7mp#EM;avIWq(tJJ$LHU600CBNQj3e$P;d za99>t7gA{;NoqokNRpT!6?O52%9V|v)z~DmZUimKNNVJ3XA^-PYz#k_S(@1T;4J}} zV155r;9X9L=F9e8(Az5tD?lfvVq$!$AQA8j`(yUtC`)eY>I^wtZJw~74pjtD)K_3N z1la6$FcP|eN!yZ~-<@3ILW7)iV{Cks;!y93inqy_YvgpcGeV3(+jv?&)lBA}Si&0! z%P0rUqChL-Mx6)rfXhSIP3$s>&tRlCni<^Sw6@F%rcM>dS?yCiSc8;5B)4&*+S>Y- z1Z`Po)`eyExBqkgdXM7v%ug-P&F7M<7>4;2Ta|mDYd_BP$bgp z6D6nPUT=u+`Z~`a1uDHw1?h|_vdy`-A;2|^Kp9TXFWRvg7>n*8v7cYw>^pR3G1Y(C zTV|LwT$Q74*|(iPj!YpQ^OAYNWriKU+rYS~XX-9q39M0^QH0*BAr1YlM0K`U)HUXngfbcl(S+`b;u~|KjpVV%3A2@& z3#Y`P`YKb5x_*R|?kT6-_7h%vTAhW)Yd_H=` z^7#!>G&VF}XXq!&y0`KIEq*0|Wqq3Ccop#@F-MZUce0sFq z;h)RH_f}`-zQ&3_zsab`u=jLH=)mm z4OaK-Hi@@#!LY~!AK8QD&;0hEcv81?vBQFfVvpYHGAu@$Pb#5L=IpbP>DaMl`T7Aq zdRex9_6;%2%<_Q>M28qTLIR(Q5KiDBr8iOO#d^bGy89nwpe<;SrjWOJ_j}f^{Xd&Q zSf|l(5=*q^<{&`LqP1gr523A>uMti8I??m65-F}!igGavp(B|~U{uB>~3Ze?R z;Elu@mfvn3TCT*pjW^{JQYY@f3>Z9vML$kd&T{VdRf2Qdqxit|5Q$} znK2Dlljk?LLuFJgY{J5k8=}6mpop+eii~}7UmlCT;n$I;IcS_)o86RMs|e0ke0>)u zOfs7CNnFyuiJ~yxd>n??f^368x`yTmZ;3_B@s=Rk-u}AlqjZ|W+XAT@{`$H_vlTf+ zB>Ljj3jJHmZ#?f;edbrJJt{Q8J^uI8I*J}u@Fo?DZnFWOjxks9&=4zDss&iY*zl+! zxx9jx2}jw>taX}Z%S7*;oq7` zYbM18?MV2u+tIU4?laj6`U*#SkdAO3A!kr>$B>?I87XgfsNSG5r-OW;ztS|u>@IHL zTatb0g`ub9MzH7mNld0D^f-^YT zIoP3z9-4Zzv@A0WmQVz8A2@4|Q6YYZqP~7j@Hpg)2d`ZUa=S-$-zvg69#2PZspnV! z!KO8|G6oIV^l@T2DhEFJ8%~+unKe{N3&yoK1R4}EAD#$Ql+GoNRdP_P9UbTsL}wai z5yV&Ck29}ozTs=L&cOd{LAQF71o^JjzzTofw=fs<8{%OZ|2mlH6+${OlK?8c&?hv` z4g?*dMG=TMejP-jB8ZWpuh0<~Kq>*z#0DZCD{%4!FNyubqk5dPFzQ3N1Y9Dfd&n^P z6~0hUpj8V9XCg=c@XN5?{=kHv?DsZJaGRkDs+i9)J!D(-oY)2b;Imd5G>2V5eA_O%YsSx9YNcQ=q+$`;2f>z_=BM1*(!29YL7wiOIFP8-?bN zqZZH!%RS{I+EI5idL9h4H-4*63u!P}7Df(6Ai~CX^Y1?2$B$KZNq>{P`N1JTl>u^l z8x@eyq0*7vanS*{il9q<~*|fOscjUqmxYl^FE>u*m#+OXa*3i{{@o@8{$ zFi;?oV@134ne=h@feZ``rH?AhUCdT3CRI%Vh#hC6_1K<(|Q@bO((^C@;Q&J--=^EMY@(tqf zR&Tg<{?IPq12@si~&b}0+k;y$TF(rB!52kV^0rTK@KXxWbr{Yp{) zUL!fGai{Um<8b45hM0_gDnDmUD-|m}Z1v8p&Sp35HyuCqyhRQ|4yt}@M7^k{szRzt zQ(;!IUp`i?tA?dKsj^U+qk5+-U0G7zWXNBoGowFSR9kNrH1})9a7J-fvx5IX{Q$;c z?|?%XU8p|nO=tm*{kUdlib<-ameJD)U-$cg^pW)5l?~&w(cVm@P%!6hVrGzD&6;9& zgC0}&_h1UVafZ$6sA7!i{Jxzz<=vT<^0O|MF!v3!tpUfyWw(Cc%{PY?J=v2Rg@uWQ zGu4aL(}VNWoyBtpr2IkXoyvV|TT)h6wy9el9S@oQg~BP_;IL+{1MW&LN0-asO5AS3 zTKjoDS~=R#X~R+)%U_OxSENTYgcyXO(jmhnT8vsLM=VQ55+FlT+jnQ#shO!WM`=s0 zvG8AC?|tXlBwW{8T|!U8K_mQvb4)bCM8{o5Q^wQt(O7ZhhxTVHNL^FPtIF0^8 zRBNOJjIp-`Z*W1XIJe{jEE0HAZ$kb2zn3C5ztcf~A8Z^56S3c;5OI}Rl#wHdA4)1D zET|;N6M}=m$hm3uiP}MIe`v+L->2v8%;`_KfF84_% z@1oA5U_=Ldv(~?_oA*LvK#>+DjBt+{=$>?dqKZfd&;HS0rXrKZ}S; z%qE=rV)W*(AZJy`70TV!e>zk>L`tExWG;<6>ZD!c5kC{765kWO64Q!VOk9bQNf{;6 zMxcZ(W$pUklnn+HHT6Srq$DUg8qL0lY1e>l~N*kW>DRk~n$RRjwI0ua8Ml=aGMMP!GwJO)2 z4vVH{Nh{wCc(D1i8=a}^TkOtHIUAk@ZrTr{{%qERG~k=^UP8i0>PK9nkx-wJ)mLU} z-aet_Yo5R=d>a&GNpq@RWli6tTvn&oJM(cb){SZe}~`+uHN zcTnG`rC3PLxLmS!Syul!uZ^*|`=wFW_*Hlyv_`ddZY~*)Gj2NFKJwS128N@?;z4sm z{bG}ct&bG{4ndi4#n#PYbR+Af@8Q>l;TbK@mQ~&hzPZ*&p)6}dJx@6yIVD?J+pY9) z{$lDBYIsymyhV?Wb&*M#gUtRgnNTcz5SONv+w%8qfu-K_s4%tMszq+*$BF8i?V8Z> z^xWZO1TNd%PiOllwwha^Nmp#1+fZwt#|5W@LJnvS;5{909<=?x3a@>v6(5XSpslqF z-Q#lT-0JHsd{i1%*VAfn;$C&x3b_W=T1fq#wGVPE+;X@)P;xvya%O77EDxiH;-9q%+bq_ytJ5=t z;RdY$O}9g;N4d4(-MA@Q)ccJ)CD*6x$3vx6C7;r`rcu|*hvKt8Q(k#q@JBX_?jBmF zd`In}VZmWWJRdz=E}d`Rjl~6)vS_I_`Fb?4#xt^!uLiJJXh9;gFj1p?oBjitMheO6 zbH~^RbMq)|7~nQc$-m5_b3-6wSOPK8{&ckszIL?5_{Ocaa*4ECC<#Lph{&7737{8z z3w~GT*(O<2fjZO~%o}EAGOT-0)DgR9&)pVdcman`>hKd3rjDD#g0D>{P*DULD2p0O zNMSrL*!&` zW?{?W#7+Fq5gfqw^KM#VqJIvt`^rtMEcu0q-_pi_h=qoZhK?AFNJK=$WutG%AuAyC zui?ON+{DIqc2*p;w2qFBG>(ikmNrJT^z7{Hv~&!#3=Gu35!ANM7Ir#L)E2fRe^2s1 z=MgZl)w40NvNN%?AbLKpj;^J>9XB!Y^M(HR@%QgEa5DM#l`L%kH7#I*w9lW=($mn< z{_nYgpz@Jt*GK=p;>*L7?F$if2{^a9BW$e z2Mmd4A|NdfyaUVZ`2np2{2>4P4s657WR!BOp*nuN0kc;)4=BDa*d-r}C~mRtMf9^1$?0vI6B0EE6QA+l}pB z4O4Slf6OmaR9uG#D6S9gzFR&jJYJMKUIuT0hij+h|I};v7ZXnk2>hrnNZ*t_tI3H! zRC_%hK`)Bc#N@Rbf%Fh?fQhBewE7{i{^pDx#Ls~w7=s!Ofv?N6M=0W^hp7_en|~LV43dH7uM)OZ5ObswUnHIu6!PR^3#A z`IvzrY1kd3Kcf;?6r7(g)-f>EMW$n;ue6jp}6_$hpQ|R0(_!3#L9DRvro013Rv{lM{a>dUy^X6Mn zF);|`oQUt^%jO38M&vUu&Ne^U2t0BnCDwgZEN;9e#r+&Po-$hQLr|049u!oAPl8y-XE0uR~`paF9 zE0hM1L6?Jn2%oyNRdaMJ1?xP+=QPV92YC0%uUCTJS{D`Ebz=`Ia2)pJ{=NAcb^-UH^Za-FLaN4E{U&IZ} z*TLW~+%9PEq|OH9TiseZ70cCvh4D)3Lw2p=*E*a#gbJ|m3K%lPp9 z?5apY6)-`M-n_29ruWHMb<%w)Sx~HTMljEZI^H4N9K*Q8;c10KAiV7PfhgP=%DseS zOQ()Gh`gI*RUa&IO}ns@$8PYGcd{pDBus?`1&attR~#0Vk=qmOg|R0i`xfvd?`KaE zjzB05psx15Ni$Weo{u?t^hw9R)T8Ck@>*bJ)HY^?jeUC1>+f{Ha|k=3)6QH7YNhtS zJxp!+aiRJ7TdfkN5(OrRk3Ik&me$RS*g@fhzRR8&-^~VRR_FeI{ptN@X!mR! z&QP8mY7@oKrP6s&RQUj=VpuLE}LB#F~mV9wBc(&^kB4Xu+k4o9t<*;PaW(;aqGT&EK% z8>hh|P`+?l;k<94>ZQ}9_2PZeqKm$nv!5xCk$Ki98Nc?S8e81SHo$jC^W;?SUo zmo7tjcc=)m5j{2E6S+AM@q>`;G&urvF@>1IcWjgKJWC%Df6^?ZZe!`p9<1V?0L>0j zOk1Sk+*Opv5J!+&nLVl;b_uAGg1mxgmdid#-3E*sN~L4LWJf--YXAGmj4W%$uH)Zr{nku7^@&C zcYhDrS{ZPW_*Z%_isa8R67*~-*4L(N+$5NOYN-)SQ*5~O+}a~Fj1s##b*G|18{t&R zK#=gdfpJnXBOl&{?)P=(uuh@+hI$!EiofZHB;ZOAXcG=q-q^NGPajYZl$YCMSs04AD-VX^!Q0dmUmA)b{ zl&L0O{Q&CGq;o08?AN8!b@ipkXR)))actx0Q6+bZ_ohq%?ldJ3Axa`tnb{iPX87VtT=?~Lo#T_g$=lMH-Uqf8+7OXrwX+o!` z$y@ffZpFBFCz~oXS=K3J8d>AchqqIq4g8h$jN(; z22f*x7{(P~1E_NwUb{UxMZZbM_M_?Wm0x$jOc)KEk!@|4pam1kn-tE#c9GO5Vdv{q zUK-AUF3Vju)_nTRuo}9ZuyaNaJC|eCBKnUz9@am?IJpY8iKWlH3gp`-cUnnAxBfEv z)ri;Mi$_sLEc?qbFMR-GwO}EOtgNiJm;8%Y;+ryJzz zkZZttZsl<-qX*bco@K+jCWj2Rps`kzKoof7U4>|AnnSvjcAL-{)yXXiw+y%I@8`;T zzm8atx!8O%M#JhpGhN~P-3e0F)pJo_e|PrPJLYc)dJj*S!h00CiuBSsdcnXjNT;E) zaj$3(WSAiTX|jtC{TVgOuCq2!(qo>R2a$=MD{n@(ah~O8{z)zk@HI|LH7_M{qvsIc z>xjh9Y1SRUEhs%R5_@OR5ZK)&+*4XGXtBl7Jf&jK#59*pgk$`HAI+=qbie4_xnO%kaL zWfcW^eSYeKw!r659;m1{*lm6pi`NylqGuzsTjUc8fvWjXlUdwd~>j#;eC zNrVHsqCz`ESCP^Q<}AG>>p5)P@zZZ=0tg<$C*Mf0qztPbi_+LsyXc~pxZ?>fSHyfPk-fkV5oL*eg&9-}$9sTgItB`=pG;hK#Sn1`fWVX_r*0NM_MyIa*pJXH5-*gyXj4%|Tx_Alk(3wQq zuyG0nSw4^zkrp=NcuXyO*b3%Btf8ry(%&eXy;8_2TJ$zbp^~QqK)sI zR;nUpxPt)v&Ol?qB-x+=c!e&C0-eHc6l(BxSsF==Vkeo~Do5~^u`pg?f}oe?N1$2-GX-8?rL8eG_LVirrKA&%9YjWj!I&YQ33$20b1r{B@Kp@7>jk7aD{YN+IUi zQD!7`?xX2=iK$kj5&6x*J9N`qM?x3{i2s4?D5_iBf|o$q*(1>n$FlS*fhYeiV6|VBS5tz!0!qdbj)b$6aKC=(en)}X z>8Do}SEviEj9H#+Xce>!O;ZynMn~}f1FCDn*ruN!Vncu~aLxLiP=c3Ew@fPPlkGk} z8vOy~K2JxGri!FyoQnzqwKCq)2S~Cbm>`h~D|1%Z@%%ToY;eL2|Yoqe?~WHh4<#=zh}AB!^=KuZpG5vO;)V zgN61BR&|26O=*{*^<0ux^JP`-c#}rgU-lvx^xr zQ_BWwE?eAd8N|BxC1|jypF*7qtBfaw#Kgo#UQVkJK~g~}l8vYtR1m;Ge;_52%J*f` z&-{>@Q$)GEC&$!w=V`s8K&nXQl;?-%}lG&s(Zlc8N^ib-gRdmZ`ujqKzznbo{q=9a9C@A6W8ypfNd7x{Ya-P);G=sll=a4{v>U zwz97!Ty4kL)?jesd$Do8eWM?N?{4Q!kOdeC(U>*#=dz-Q6<<CnH*};?e^KTRHd&)+L|1%7hM>Dqi_!PPs>eEsCp7gJ5c3f z@a-KQ^+MM&dAxY4~3_yFb{FTfoXIr^+T|og+u|F_!X8XGvvp8gE4?m(3Ey zcxJnZWBKEx&s2J^{7CeE+QolWq7xFPj1?wZJ>MPt9>F&LKBSEV^GX^Ft3xwJLIdA< zSdOVH%@4O%w!%RS$AeuK(#qih38006VhFG@htwMK&h>gGkK*LR8qU<@Cs^=M+Urag zzl=Ju9(cU50@u%tbD6W6FsXF39YDd<_21yRG~{#qDg&9plTX!NY}!PMYiQlbVG=%p zZqMORQaz?8M(V5xf@@&4358TNsI8o@)4jh#K<_(GsWsVibK5L~)1A`&k!EePf$xCF7FHyb`Hl?CB6kI#O zJ(%w9)qhen(P2WRYC0SRieIaIm@AA+{OrFR#T$9?7ju@+&NYN^ZfeW|%2goU<5Nb! zKvOFi{_-`r4=4kLEikjm|5f<*4}}HB&>{Up#Fi)un6WRwE)#~y%94+1Q?8x|CY0p^ za6T_*^(O6&S|<%XL3u9SxvLwLpWOwVzh3Y;=4>GWp*%q;(MGUU$TqrqThedrC5%uV z{H`-){^!Vut7Qgz4s)ZO`!_HOIQV&3`4}Dtr?+5i>$Q|6ybx%J5K%$urJ;s?^BR-Y z8DSAcG^?X_<5)vQJ!Dmad5!JQ_CwbKKp6@dQ2zu*4{iO=RL>R2#xOk9A4&(`lYliW zKl_<+bk{%v>?+{rq?_9aW^)mJMJmwYp-TX%$d6TTAY-oC(@14vpgYi=nWV@IrP09)d2p9p;seNjyX;HXG6 zD}aNEihlpb<2p?e18%^$(;Hx$bPe=@P%>`z3gnd${Yp?_`*TtlvC{czPq0jYoN2^O zniyasIs$-r`G(S5^&m0u%J}__Ky&(xsSK0tRRX|OPP9U=p@E85-5An+;>R(}MU;f> z{$T6@{4G7c&|m&m1@a0t_L8ZG?6&z8Ig?x~%2|!jF=U*&7lDmBGGu!VC>T2grR&{qn zmhMm{4*_DwGx)H$*8B@TwgB)E)gO>@w%06c#fMIi`nGsZL{t=kk42W`O?Zm-44 zk8Ov06b!AKL3MOL%?*m;1$EK{=}pFTXkz(_Fn3120~~Zoz{beNxSOIZ6=p(M>6gN| z85B4mvF#ZBKA+!bx2 zPVze?j4D|R3!v7Yod^ht388K2B1Y-TaQx^%&A1WmBk^3B=qyXIFZ@0s&wdqH5sqv9 zyKUt4A9`KsQ4E%!JPfXkj8Wz&T(SFCGS28684z;IJAdB)s`?4oQyu7 zS^mtogcKY8nOB(E-}NR#3jksr9H>4TIIt~fmcId1S#t#&H0p;5Yokzq*jFXmIfP)U zBF}m|(HlAeZ0`;25W=QOKZbq(w=fB}5o!q!mF8I84;<|qDRF8Ic-?tr$tL9LmoXD? zL}(Y23I~M2nq4dYYJigXSj05q1B!WZ_(OoShjNGC`1T!R{4=zlN;T#`%2Y`#zZpBX z4Z9ikBuR~2QSfMh93@M%G{->o3|c`4=0CBppXA@X`d>K_F_RrE2(U1*BOF%g}aaRLbfrl-P*d& ztddSH!elAg|Hq>WvR_QMgnz?&4ipe8;&M6`l)wh5ff{=-po}+Bxtx=_*KAR6DPM*w7XL z*hlxPg4-(cj`1*E-dYeupe|4pAZ1M!D#gwHF(<1w-Fcdf#$`4YyTE0Ze{j(eEh;JcN~e z(Yon*Z~porIiMAnX9G-tym?`4!|8%QT~)iozCi#}*`47}9DqgwL{;vt)^8yWv~aa} zyK4ZXToiwGd>Ob(>8ndZ4hJBA-y=Qz>B4E=-HBqVKjupCQEztO3^KHu9g2(8YP;N$ zjkwUl$<hHs+ zN0cQG(k?^dCeIP9>rVlTbmdi-fq@L-Lz$OHTE@41L^096+p$pXIKom)U+c`Z+jE(t* zh$xTF5>RD=nXODdrbqsay78W9o_hkssExpRbBa+%h<>(Pap<3k z;R!xt)2>~PkwxkyOXtIPr7SXh15Hu9?0=-y;Zdwso5Ex^qii}+q%t$sR}o{e_=!rX zB>ZA;>g`9*%Pax_zf?x)(!Mm=^D_PQUx3sSqHD9l_WGRV?aG z%qq-pLs?@vXtHN69=WuX6YlLc@HUF*F*~Odc?mZ0o zvy&VlNZ+r`Dp492Gw(h@#6QPvtnKiJ`VP}DVp+P|SlTfrsLyEj*k<&veir|K>u0mb zeXuvYY1hQZe5TK}tA9Fo_3a^HCHJRr0U3#p%RaJP_AIiQLMSFabhMrhDR*a{`MDd{@Yp*NT(AB=d*4n0R3>1*k*({7>1)L^cEm0K@2Gs+x?s?xZu`36#{T~!|n`qj$aqTKEVRTJpVeSe=_>fV?v zx@aL{hLQp&;ga~(cE%S|6R4rh^^fTGsA)+mg(e&p^VS>n5Jb+R^crw%isAUs1)sP^ z-JDTMKvCox{II!H+C3Z@x2h+ls)Q7Ohx&Vhfz1nlse1+cK&M!xGM34FN*!3_J24ue zrDCj>u?FICJ)47x69vl#xy$~}Y9!a+_?1o4XuDYx#9ycfx3CECCi5=wsj<4N_35~M zUl|_|F)8!2W_#L+aF8^EdzRt$2{X~Rru;%od$XY(W20_sTh}wT^H$C_R_?^~C;J8u zAIrZSQa)U2%_vq<*>DD8jR3kFlG_tD1bH?@pau~Za8Dv|lNu8){oIQ*(@Q2BZz|5fEM)HIU0mVP_;BQg$WikW9xou<#m~Y51LWllN~ZU(_nMMHy(p}X zkt}~K{nG^}Z=M#2SeK5g2a?J^7yGo4RQ0$;TD+O3Lw%0jbD#*Qx5gp|d7#7poW8jRdbbN4fZ!dSao)SQBMnT==FnpP;miWd%)Sj$6$iWs2F?s^4*f$j?~^h+f<}{G4;p zsv=;gwekeSFWA%NOsf;WLQcHsHO@>XvhpVil?d}FeM>YdRTV#JDbiGr@M_V-*S~sU zs5Y~ODX5ks8(I6VRorEX2;|!811El~mLZT%-cTIi;snp_3vw1c-6X$T{ZPL4HK#1q z&P%0qOQqd@xV43MBQ8|5p!q7+1`Fb6AtYqlNT6v!V#hH4xlv9f907Sn@egj+r$j7q zbNix_q+7cU&~|Lv(*Xxq^^$PdQ={9|-(hX2HdjLgo=a-Bp!S|HOMz!$uQ2~esZ(J| zh%$LLh~cPfTdGLe(-OT_THVCf~D{B;FGFuQbk*8AWZQ9plwzD}{Vb$tc ziAu>!i*gS8tq1dktM?e`15n`|hx{VDr$igAkp%JEH({1ni1f!&OMVP`OFbkL(EzQG z_Oq1VHve5f1WO2UvaH0kBxg-A3GHu}Z>6=Xnkf#e$UxkNQ-GihmN}-&ew!jK3q`N6 zIVTwFq5u6^Csbqr*E{JdVZVEqxxkp^>P8&06G%5lKW2;tptHZ?U|cu!v$RIPlxg~F z2c9SprrsJiD^Ws z}1s8_=BV#r{X?U@uMmp(J(&qf4{l?w~hF`%glXBB|oT z^;Tr{*N&W9xQa9nVc=^Yu8V7~?%Y5uYL@Sg7;?{g>Bgrpp!PM(rz1+-*;zckMcJid zJo?#l*Ufe!qY4SMaZv)Ut;f>Gzfa+!JtJgR1>vSG0%%rh^E}w9pL`+ztZi9Ch83ww z@VmmEm`obF=4&@%#>)}v&JhY_r<1H7s zsc-Jn*I|_ssMk^SG)m5mE|+$LXD&tbBUBiTw&{@-BLz@Jcq=26&RzxVN^&XlwC3_PqR(cSZdBS8GC0ldBr9yiJYWBB@?JbB` z!Ew=ft55KqhW6!jW_NmpL4RzKYseoI(sUlNukxiddR@V>hJ!zQqbcMzPWwy0*lD+P zv1Awu&6Ckgk6hzjNjD@r#`6CnB*y2o3%|YC>qq6eC(`n`hzTZS<*PAMaGl71P@KBO_Ip!tU6MZy zV-*n8fFMe`H&vn-GwYesGPr@$3a@UQR{GtNL!9_!u-=Q3muM9r&IPEM|It4c0e~k5 zWa5hbb?4(mHXZLz>Qy~+em|Vc%!#FPPw*C*lU$2btCH>B#n{Aak&$+aSMozEdb${y92eK3= z?}R_~{d^hH1vMUeCw_idSm}+Q!1u@P>x-^OETf9{nfO+`O2JiA`VBq@N?Cte7uJ70 zJ@{0a|6#Ey4gsPhurApYx&-i+zNvfzCZb=k2JU4ZQ3w2Br+jn>GlL%2NVx33 zv{>6Jm9w|9t_>U~?NlYwu60RmzQRb$E#U)PcS9TnyBk1t?wFIJr5Bn_i5XwpIob{4$a^mvmfGRbHTd%X6;x$3Wiskld)6c*ojo^FH; z(s&lLwlk2=vv*-!vP5&q@xX2!YS|742NR-4dXf)X9yc+_Y-_BrTNu7~NwywTK5!`V zSAL5TjwTqMbqBer9~~-CSWl5E&0CC|68+g|29e8wq86*U|b;Z}~CpBB}+)+q;g$f0LLx81+b z+g>HVGFbfWY%|R58H0eaq$IRTJyxMWh2zw@VKZ;t9mpcECqC^k)|=abTiw{kH)nsTDAg@9mdO>dK=3uKhJ4Cvbc<5B2wlEGfkEADugDm7NRBznlb zEq$44y=HK_PVtyCQ5r|BLA*CzEXmFDM*yghM|B8a2)n|0@%}|nPAEg$;5M7EY0R%0 zhk>0vGB}(UjZ(U`r+lnw$gaz+h)r}}$&%+I85)aE{P%a=dAzF2SO zDUG3lua1teB=8OSICXe;C!N-P{v8C3%KXsl$^HIr|BPxjBY26T9>);(xKX5-m^?K^8y>XjGh*pP z8<?2U1}0L0N-2+P`K|mhe=~;OtTA}`Gc-4w%nM7HXN5(? z3d()t`c-@8S64u+2}RNH!F|23v?=n>QJoyk?`0_V z{bPOu;h3-Kw^-ijBtkuBw7-oPTZBSDy%*CDrTdLnnq6P++kX@4kKILWLt&0I_Sb*#?6k5&S%xe-LVO zz#MpG(U8wQ8Pyqh_5B26=HE64j7G8DgDvQiz5(~ zZ9{fKw`;`+YRhNgj~fLm~V%s13Scn#UgP3j4LT>CE?rrdW$jFY7dRSK!qr5o8R zB+$;k2yM#n9F%Ei>#Q^9?XR?;-A%kvKvVr=oieDOvwPnr@k6_Z!;`!)p%FoHLgA2& zw0r*Sa5Sxz-^|;7USS^PmR6Bs%T5<2KT&RSjBMv~xxG9#0z)bsyW<83EbA)^ldLaG zDlBtXDqJo|>u)`;BKW57`)WP!;(+>{y1w)H=3v&Sce&MPV0Bvk&NW}7ux8%j4>jpj zZZ^-={8*0H8o`)=;y{lAQu}GO>JXbmn?Cz4dNz=!xRUnl%U8m)2kOky_ zMZmlyl}5u6B^nLaxj(1pzCR6^d1$&h3|t%dQ#p3&BcRPO~3HOu8n#i~}D zQt;oKvG48M$``g9bot9kh7b-XQE(R8C$d^vY+gT&lCF+R^T;*P-Vlse>;}au18UIonDcEp583=+|5PO=#eFK?hYr+jK39 zbL6SlHk6DS-c8^tkgR*SkE2&rqFnwtM=F_A7~fuhb_N>jNLG++ZiLWCz8e(c(IKRF zn94Aq;+#<1I}D%7`9#|HP;Kj}t%7}Dj{e*gvfN=ueu)o!Q7PS^v&w8iXyJ-kM%DD; zp_+fdXtjPzGupEGjwW1qNjUeMQ`B^-h=N2YG*U8=1@<-yE<2I6Kg0Jn#i7nS5hVOq z8g(CY^jUjxFk*rX!q{$4^M;edeqUTYUH8w$z_;`+F7O)_U zS^PB31GJjl>IYI7g;i^e-#1W>b0DwRE;uxBD7e-&l$*%$9OG3h68vfSJjY<{>@W8a7#KkrYPt}+=?bg7XbWdb}DT6ZHK z%K_}%*Ak}U+NIIPVcU?wDbLyLcZL2eKMSsQK+Y%G=(B#C3%N&sZg`&J9aHjPm_~$U zbU-f#1T@bv!XLl6OKX>LF6SgM<5kuV4rc;A#Pm5{9-UQ~7(^<=Q6>Se}9qUUcoQ3fPFql8WLin3p-NX;L%`ounNEr=;y(C^ zGMS9&<2Ys8zIkXzec*r1RaR(nv~WkRQsb8JRet(vaQx{iYrkDaCJZSy&BxO?kbPYJImKn1x=p=v zv16|E00GCj3r1KfolFTXS4U&W1KCJwu~Zs-2x>nNd7=!5?gfT8pP;(G6bmt#PAD(p zFsj-O-g1a=^Ojk!!Cg@H^mf#F${z_c=74<8fIO8g9Htr3z5vySc(bq(*YEp|Qfk*_ zCwpZ#`svT$*JdxxEzW}~$kVf7o<#8dSp~yzt>x0tcZ`W9c$8m=8k;aDwTmt!Ruvvw zL-4;O=+U_DPs-iz`sm%m=p{3S!xXRD)C$aiuc+TPvn^DQmoQi@^D=IM4APp99`BM* zz~CGVBvKhn`1=4VFK>A8D{J~WM)?zZvf}5~5DJ==sOjX_5iFeh^5OW7dk*2};8nV) zuamoz89aqr12?jpw8~$??^iyAdVzaEp{%M4mMYgHyoA7iE_kU34D@q%Ae_^2=yI%L zqhRaDoS<6|SeX+YI`&bBXfh?!>3F-oarX%7u+$&xUcktuxv{7|-#-mZxT^Jk9pRB{ zPgg1~UMm*IE&L4JHwJ7SV*VU)lUpDD#V<;37blO0AU{pAhudT`1`Vs$&ePFu!o+ER zym?6iw_}g9+naZq(VT~M;*FPz@f-#f^vPe_uh1Ls$j5JTcs+sdkQ-c!)7Ir0Ct_@i zi%Y&QZ91(063x^)c;&lRe;CgrCi$^X?@?mZL3Mh~pVq#SCY{XbQbQB|-(YKv#DOr* zLxCvaCm*>L09;TTC1*>e(KY~>EnoGi1sZjTE>_F)!G5gSlZWy4_ZbZxsVlxy!$s`0 z!;)VJZtwS#qlA;^f-MQWJixGIn{$H4SpB|He0u0~CNnJFd96!2yw#@~q3P%EO-`@J z0mfm5+=E2trs23n+rgjA2ECElHtP|>{jtTnIxt#ZgKA7s^p?#Ab=$D>7~6xUCr{gQ z>+qU8@hcbP<{5+!o7*!8qFtF>ANuK{3sLkLca4JKQDe#qlF3owX0bYID4`qAZhF9r zCAHE=?Hg%6uaS|bP%GW;791H&#xO5#sOIxeo*qmzwUa-?GL5_o{BRcDLL0|hX*jrE z(r_5beL2&94|F$!Rxkfp#-W0*m*bGK0}s@j{SW@s#w9y0syzG>V?6uHeYQEs_=K2$vm!U_=s9m6{j!Ll_2kmnohmlb{PVb$#2bdFhsh-|W(;17L03=3 z1Vm@B=)*`0h{t(MKu=$*T-O)RLx6CrNv3{xx|9}!ER<2@!erZLlHyoq`j2HZ1+^MS z?%p1-++uEo)_|Hak;PoLYmwiI^H-oVm10qJJL=Ivjb7YQ<5egS2?gHLsFMp5+9s)} zZe67Edd6~i5wP9{S72;=-tHK&YvNpvhN2{om8Nn`K5|4EZIAHu0`v&ZG8#=9-viv? zW3wVzS*pVv&Z1M)$Ju%^A+xfZ^n@I(w#AzT#o{hjg9cL4=jOd+be;sGu zMdFf3dpt>%EtO8AU655Z{37f;>Syl`<*sG_hMPt&Ly2tECv03(lH;I2Dg`z1AZBHe z8V1%t?vpG9rY}dQKKA8gmksE?+ef}!^Bzs@D^A?!WM0$(`&~1#WKO~~ z4`y9yJ&q#HMvhF=R1t^Y^m=aF}Cqj_?~+_mW80*!AFQ&iUv@*DJ}&`o=s={ zA15c^b2Sys&dJV8% znvE{K?WjCSt?Hm1X^x!_qn=Nv|8I1gSHWk1WxG|+CbRq2gq#&3gyaQ+qZ_WXvhNy~gri@;qz&2v-O_~c#f z|NJii@pam1&YVgAlx>Rc2bV2g&yuveM}QA%v{r}kV*A{RpmBFtTYA6uqg%30q}**i zqI<;PyrQ2b22d3frf&tVR4TWy7u`emNgNmH2daRQivRSQCzafl(3^_uw1;QCr9@+p z%@(SW!ETTBeo{&3=lG{-0C{t}5ai6!Nf+itO$dY58o}m`!x3N$gZ8c_&aU`x_|OmK zhvxu%qT2+x2?u_$92hlc76s zd4>@*4!nAzId-_d=%XqPKO5ql4t9UMdAD)NdH971GYnYm%wdPO@8LS3yUYjoSdCtX z0~oPupy6Ul=XC6NWw*Ky@A~(TdGJ09`(}LRAlns;izlQE?9WkR_ppORlZ>lmfzz}i9YFm*GsES)#HqWb5WDUt1U*q-qU(2XqpbAn5jAUQ3YtA zrg_ID_hxdRau#{V!+G||Ov8#{@SVVAdAaVZeZUTFM#VWhq!jZ|488zbxhlZ?(e#hp8|nUJefK@mhg(K-9HV zxy~maw%rddTjx#&8DWiO3~)dwH;bL&ACTK;V;eB06-P!*hjxAHb|@DNAZwPZ)*?YL)^@)G znck`+;MCn3dd#*kc1!xpg1TTgj(_pvXT>SBpiv{ zWA?+!86sPHtTO|()8siZ_jhL@zNJ&uX(pG~rm9mM1ZKAw-ak;l9a=;uYqw&Ikxyq% z2qTn|c2am=T)?Z7D^zQ^^WJKEeEHk9vGUQBTR7xRvnugw&>h3~vrwI_h=O2n0Z zeXcr7{Z~J{9a||wNd{o|s0mBZ1J*Udv0@b4Erdy6Gu$>MKsEs9ZabKHf9oVl4ren| zaI_D5Mka1Is!1m{cLzrpgx6`lSA__ z&w3%o9W~4{R@@VND<;=Uts|FJ!hl=JLtNbi_ja6|&Q<+4YN8_e1Jg;iEvNVf!%>f# zWHI9E)_UhfL6uNi_TIWf`Zb^$p0HkBJdGQqC{fSU=UG`)@gtLsf5h?gMMfZ!c`^Vy z`vmc;xGa8mv7HjB5c*)}G-h{k-c4hFYh;!8dDF|VWD_;xh`T{^13BQji7b<^64E6c z8{EQMLMI7LkpWnCEF-x&&?v3U#Wt?vS_1G50C{uV$qC>YX=J}5*h;5hmZ@Iag5q=& zku|>^tN7ILj6G0pat}O{=9wRN+f9Cbml`;C@2eBR*JBDD{7JiSE4a9+59!KR(_c5HW52YY6_J@{S2-0Q%EtDJxM@ z4-O@ynmn3{=X$oa4XR|UMYJw_i{2$*w~bN6d*|2t^zUNpa7l~;d*k-Xv7>HciF$m! z+iG_hPkQ36sTmhoZ5#k!&mFbXR-wp8kw~-h0z1$ zfdSbwhXt&?Qa?hYKLYxUWT_yi?*O24AN?%AD3Cz2f!?j{wNKqR!5~a})(bLhr@j-P zq{|E?x_LDAfiby9ho^n36dctvA*yNe(KLO^;F0k*Gs~c5dX;?qn+`5%U|de!tyCPd zqhI#S)_h-M?WBG=K4qzHkxhGQp)F#p3)fL+VS-^^%K@yAd_FMn&1kvFKq9>V-l~kp zi^JPqEl`&OAa#A@O0OublnQFmVNTTy$+@o(80%uhip3wuDiQ`n`z*LD()B5PSGAZc zch22$NT=j&rN6_Q$9tZm&iR5t@q(GUy8hU=K~A~Hvhh@Ng-;R<-b>ZFT#EbR2U~$0MUkxU6a&q{_ z(@P~xgZ4%g!o|qiBnIu%aq!2X9KJSr;*5+7vVjB)!ZN|gGwewooDmEBH%DLMC)Q{i zU@Li-2>W6-#)hkl_xU9+YVSMw{(i^!G9%!iOIpK_jPO@$7f%Ko!YFIoak?f>*kU2D z+HT^D*&cdC!(i-Lp<#yqUKn0g_4hlBm*POW?2o<=|4e$y9KQ7BZjhY*wj8C4I*(1~ zMOcUZe*R}eo*_KV%!y@pe&eJ3A`0EMq7)gl`EW=7`exQj=T4+P^kYwdh7B&AebT^} zZR)0Ls*}vY&d}abfok4}Q>5kA(xOGjJLv{gx%%~JvI`tc^zg$4x38OJjmdKs(X#hf z1~NF4oC<)@i!f%jYzMb1!F46cI>`mqvL7$C-BfQ&9ElA4gfQ`&t+J?}4xQyw;taU_ zAPf?8A|!sZ?h{~O0O8lf-cXHK$>5GY!1Xx&RZPD&0LI7?^3ryHiw*IlsArsHx%oC4 z#O-JQ3le=B%nJN0Ip-}Zc1?7Y2OG_bO&6}-ob%aV={m=g?%<^Vp}h>3Hmu>qCvjoeMUR%*@owM~=gfLoF$y9y)saFC8}W4u@-2a}x# z(6huFP=8J3)Qj0@nzZxp*Gd@LD{Kn~V7k`iIIJ2N;iB!rJ)7Du{0^j^jF&y<=Sh9l zbi6Dmnf%FM^zkataASW9M#f&bW6)_^aG+l>dGO$(VxzmPa!st0a5+f`7d|X`Ua6R7 z>hsJrmG(PW^75Cb1qpBi2JoT7_NZMxu*>ph8dRz3q5-PW3vhX4qdx^svN~vv`QqRp zVI&97TQc9B?fSHsUphD0*zZ*>tn?Q_D%>ou2h$H=cXz< z;|Y1xP3mUvjUt|}>HQ6_em}4sgT*D~X=EZ$5kxY&DzF2KXHn3MdX%Hht98#mT+ zKeq~o$P17+%jp_G*cRb-qlIQ15A26?AGfd0K?II{0hW5M@r^dR+^#~-k{Bh8{Ma7J znu40|10uQGfGiKr-PxEnC|qc8lakH4H}Ut0`O_J{EFuK~C>f84dqcfRqRV&`JOQAE zE+~H68fugofIo22o;?5|jUtnW8=rTvpQJP27+>y2m-Ps~EQ=6mP!@n6yG}YaZuibt z;7|t!PW6uzBV9R4O0OCk#{aVi_YyrQgme9CXQ>M9KR&v3uAn3BA;j;%;ZT{LU*+*? zZ5zeMGrM{|#2jR|%$oymqdNH{w*xj?3PbNn^`wkk9G!cDY~*Szs;rK zEOm9$d$uT`TNZr|okca4&Fu1w(%9!+su%K})danU%q=Wr$Mm+ftWBqG@X}W0fXE`J z-rfl77npc z0!A{wjD}UR&}k-XY^hq`#FLYEZEjI>Ouyzq>qh~t<`*75dtHH6iEGv8c7RP7Gu|x| zt-UczzxMQOyn^AWKa0zl4z?LYi*G@vo>&XPfcSYd&$K0(@P@n{%m=qoq_(AqJ9Aan z7HfY|0n!dP&}3tdKJ=!5{jV>oVW#zx4$lNt83p;CwY<8P4g}EehY1g^CIq#(t@eNQ zbUYS>j23AtIkg;F-9y$bx}JF1A!q7ck9QB?Z?$#j$qBE6TF?p)o8Fw}`z~KjGeu5G zOMT^1ILSd?P4_GFKUz-6;t-Ts%M4z+kGWt$_-dlR>-(l02@Fu5t%{B}kqm4M!)W79 z!`ANu)XM*CL=VOnGdq0ncn;x+r z9rkDsvK99vIDTG?8Z1!cnXzHckev5c0~u0_Jx)(==jZk2mU=U4DPnOI79EMZ5CXbV zD&PcxJWO#ui9qY}#BI_)bSZtxGdk}%Ei`16Pp{$L>uuD)c0F(7p?f4|IYCLe(NmfV zR8iDIq@;1&cI~`z{O#v_N*q4!?E;JHnHeIMpYJ&$nAXP5p?~fFM&HWrgUp>ne`D}N zYw~o>uclrn;vvUR=a~1)8X+muuL3=A>mDR`xnWa4{(`2XlRpsS_iEv@j5bO_cB9G( zN^};PN*YxX&U3w~nJ|qMgw@w1QHU_lg?axTHP>U8e)2QG&)zxkOqni>iewG;P4vGA zF&UD+Gq1;V>@t59?5pS?aOg@lw7exVZ~ADxW;Av(oYs$nwV2>_Ssl{Bm?Y zaoduB!whf#LVm-ONqP&2*YmA#Ze1x>+6}6hR|&vIGe^g0A26C7)2 zqn;=V!jHA;*RrYlHh~hGWo&Y34ROjdn)YY9Z+pN_SKcqHcHOI-TSavnpN8=v-#A}h z?1255vv~AI|8U6zD|f3Avca$Y{6|RK;m9|1usLSD_t-5tN}Z<86FGjQOT zCeKBKPL7l4z-}T0uS|p5zC7bLK!b+tw2~vs$4^V??9{>uYE`FRu+}>_ZcAW_g_TrF zUwkv!oYWww^n}o`e%B^<0hiu#=hwI4N^6awm8Dm-1VX0U+Q=^E+@gjoCe~rD>E1_f zgIB|kdD_yYNUn9~V3tCq+Q6FhN}|OQkOf7pCV;1X8v0I&Zk%E=j$gk!QP^Us1&@qb z?n$s-QXa_+oLmLWUyP1-wA27`+zk2H=GgF@_0Ev6Pm5d{d!^1zKeV60(sdEZ_l7~PLgL#Z$ zT5k<&APU{<;(0VLjf0uMTdJJr=bEB$O7jpii+YJsIBugj#3;-42+;zrMxWs0qv;)7 zHNsdlOVSGb-xvNKn+`LOG#K3KqJkO~5D<05#JiJQyoup11YA z)`E~bTB6@?&gcAir##fzoXVQ=9~3%=oYS|}Geb{ZIt|thh~&Mc$$V`7M5Ep}H-NtW z5-zSM-)#QcpE!Ao?_a~Zh3TH(NojIis<`)FgkapX#S+!cJI9sCvZ{Ni)r>$1#riZ)yW(Db%##d>#bcxwx#b=u=Ry`tQ`3gLS)vjoXxu7NPCzOl&w0Kj=wx6_uxGUJB0-gjhz%rKtGAEe)OXB|Za4sP z#r{03P|j%JPVLOK#;vcaI$jP2MYv@u#~DsQsm6*nrzWNWSLpP|U0ws>8pVTmtkvuK z5YtSWftrL9)K`fxIu0g zJdfkLNcf^6mjJ!1Ft7ctce#8O#9cMEf<DXOJ1gVp%bwAGOFy*wu5e#x`HTHG!(zpA~ep6zWw6-Zp_ zDR7>*SQ-dCiCLo;&k=AG80G>0sCRqduu^8Gi9K8rDYUrW?z4$I%oKLJ{{-wIX=4o| z?T&kOCG;Do#cWlW{&h58xgb}TU})-|gwnl8*OsdP+5^&X?QeyAl&lwY`3f5oW9 zA*{rt_KI{bj8<~z{R+8&SzeGFLi*c@W1M^z4SMQqxmuYEBAkIg7c`$Bq(lA$cyx`? z>ob!dW?d+7R04JKWi7akXZ!A%?-Nad|Lh9nuAbC;Zsv-2`;J)FFkNFfu`M9JN^VL` zN>wu-FGL8&-_p*1$$DjN1eGB7SnfFeG{y7NzG{vSXo;8PErkXLQtyc#{HAKIrV?z@ zys4J_vZCiZ&8-8xk@AQim)p^~D?jAR1D~6>zCLwgSz^2icgC#BOnWh2vK_&R4#;rh zey8Rp$gP_|Y(&j}p0%BC30OiqP~b>OeV`0}!r+BOYzueEF&DOg=*ekksr*mofIrfa z@=k7f*n9GBQjkbXof~M|Aew3AP}qKnKmokoEGKzyX&7nLc%0UyxX0M_VARY}!J|;mH zJEJ{SJ^dU|{7?5xdOz7}7xWzN(!VSf7ERDKg@5saWc@u``RIr#W45l0dUAtkijF4j z<*Nxj^O-mNmbF}DvRIriW=lgxF{y2|+Fq|GoT29fH%Ew-W1l^bZx>l8vKpWaFOj zprrHMOse{9_M?b8^!RqeIDj2ta`g~IUSC~#(_Z*xbED>QP{sK{MAFc7vfDH>14KKj z9419H6Ci_h9BVP-)me=)WqaOmDqCN{mjaM^;Co;c1dfhhe0y_-YU#@l+WiEkBdO{2 z-B0unB602kePTsHEkKse4rIu@A54+;Vg0+yVtW@*E90F+tpCv<kig`k@ zFIbf6Y3U9dD(n<>!&o$VZ*r*vq35x6hXq_9a;cm+K^lsa=7ZahU`m5ce&qy5Qe>CcG~$7|cC( zi)LD2e_56%+E)F&68yfBEHu99GHGw(pD9osDa1!(Pm{H}=lfvS#tMRR!Tz@TKz<~v zW!J*Hd!H$fer+AyJp)1GHFlhbzE;P^#x6aJp1uBM`yy{ukTLNMkYD{TQQ38UzA+3+ zuY8~cd4Q?ulM51qCLUwDE7uPae-|ZVux;mfQm?wLE-?DOu?5EnKUzr{&Qb_9{VtPj zSbYt%Sq=w!&sVDNZ`OdqQ4TFyxhAO(uI48F0cZ!v@ypnSF@2Lb5TH>20X7!N+^gHm zyHLhIoJ;~dZ$?%9qs?x(^bXin24{h4#<8mx;|`(b>F zQ^R9`FzOFaZE^jRsg*A`fh{FV9o-prSJCWH>_^hu|= zLMqraR}%H#E`K@=_R%OiZY_nw!6Mc#(PR9aoH|yd{nS5%{_G)`2{$w&_iYbmtC5tt zq<8)db3r0lz`#o%pjvd%&DGr}&alC!Qe;5z^RO01m1)_1_cYFxtk054qzN3VEYwuTpBj%t}k~`9N%$pJVA{WCjjnnW9Eh}4H|^h z!l*f9?sA*dndSHv+5iZ*@w@xQ@E5Zmsdxj>J<(f}qN(kXn643hW1l?MRo_oupbu)N2p!%Tx_m2mhdVARlQh4E58v>VBf1PKd0 zn0`42lFx<>5G8v!Fc6+YusFYUP(wZff4ARXsoHs7Zk1dFC%p_z@7p$nC;!CFhU<_4 zH@JBFM*{P(*vazu@6-&J^=%BLB}~J$R&M`%JZ!EoHJ!J5B#=9#M#DN5t4dK516uDv zB=2$0(;tkTKd=d%u(+w)Z_aD+c_)fc4e+cZE2w%EQjNisGKELekQ~R+&TbynJY>SU zVsu)T8gJI;s7xuzD{}f@>vne*-9kv~c6(CU%CC?K(icloBu`94XZIkB0jz#JV%5jr z`>?!kzb9TmK(yQvz6j>CY`;;aepexvbvnHv7)ffbU>@uXo9|jy1rv{2@^waIZ?jBD zSP&GD{k`P`6P6eoKph?t%T3_WvaaVDuffR3zWm9nFFbBN^$^dRb)(`3CN70g+CHYw?egXJi2MnM5JSheh=PZ3ke@&%)3AsMwXd8ar+6to zda|EEjBP}aM%2TsHz+Cf$_#JK z`|n2zk8EOza3aBZLB{ui4}2c?Eg1MnNiV!+T$J1zpoYHzr~A6rd?e_&G)`e3z#zgn z&YK?u1wmaAyHVc#tD(@p%mG0W#^yp>Zz7fh|N035NF#%RV9!`D5D>Ul0TO2-#~AYK zq)ZT?YCH&?5l+iYP7tG5YgiBoR${x^4>BoQ?|Rw>u%b-l?7N27H&cdB()Q;YRFds*9=+<4)h zsXn@>Vf?=q2^_teI`4xmeY7_cy=md1=yW|%#QrptiL_`*paT{0Uqk||)BCX&HGDpk zm#XMO2S4>TSZelPgVukRM)^`WSW}S3tapZZh9qsL4DFVMK2N#Uu-Aed>hl(dA{%;H zYNYqo*2qsKtr>zWYp3FIs@$5&Ko{RV9#Z1$3)f`rp;vI@_NPP9(d+lRIaeahB7=wz6qXTUa3A4HgjI-g75MD<+MerT*a5_YN1MBcP@~ z4q$~?0|cVR(V&u8_ac;rHGaP`xc*(Y?rm}cfF!vf&6UmBdDaBHR=&?)H>b(3;_#0H z(+LUC&Sel1jwF<)Em+-51tqGEw$k`1g|E@bMJ2Y2_cY3j;W60< z#XMs6<4=G=!03nCL|q`5QvEZjKx7QP_~ zN={%k8rU5|Jq2UeH9Py~3pskEw@LfaVt7{o%)j+G`Bl(wroRW&OL98@`rnJ4z<|0Q z^X}38m;?d07hf)vbGm^g(r3f>KC)C4{Cd52VVd7Hgdc%z zYDC1B=H=#|PSd$`*mi+8HmC)Vg1tcnI!jqgA0Ye;*SlFiha1b*tv0$cuYqisg?hAc z&27BbTM02Q)ZA>sy+bWl(`qi+={yau3>hESl1ZI`NU1ET$e@#8I=Kr05Bx^+)TVGt z8+{u=*$xSEeZ-C8@+kIfPN_s`FQ?4FjnSeNvmp5#L2sakljcG()h}B{d3xu8Je0(4 zc?W0wexsb1yjh?aBr~!Dxww!)!4rKi*9Yl5Wp;nkuLM31Nh%BXg<}@pi8M2c=nI2b zDA$L%X1^2@8lge%lX{S@iu@**-6IBOJM_xx7Q*GR!X0efxJHp_@t2(!m}Pz4Yq(aj zA{^$Q`ntvj8AHB&opx$`v@(v(Y^kj@B1Hw43v;5v*+eY6FW*Bo?O(%B{1?I4A(FnV z=cR634K^?3DsyuF{Rax%LcEtAetz>NiY$ukd#@1K@pGE}H{*TN%NI4zWhXwm{N(zn ziwrly$W%V3#$MkAUxF#GrJ&%ok80k8@{CQcZn?pbrG6>3{_W-CwD#qg@%m*VWI(@> z>#tL1<^LkP@cOUQSO2d+E}W~X3zF+UN2|2U$k153 zn|)yo@nV5ipA6*WX!MktPFpPGS2FuYPsy)?_E#h#?$o?Z(s3DiCD_(5y^`UxVk^4Y zmUM!@+a=!a58e;gK#D$dkTEqHskbaX{_F>-JLc7XWqfK35(!oykZ_AOMT(rDXW(eb z;r%P9ETHX_^~a3BlcR_qa-OwfjjX94*7a%lXe(2+6ID4NH<>kq2a&*Wpz@d1SL9Rp zdPU&xt)|BGe4?Sfw{*b`Sol_IjGTDUa5-x>zkTgj0UQ@mnn zti)Lq)LPHbrEMmWOn)R4a%}c4jCNQa75)r*wA^P~kY<&ymJ&ZY8ZAjDi~bl`1JXG| z!|uVjCf(lRHhGhS;ETc^1!^YD+hsGd3_x~xQ=k$gv+U~ivD{%_1N-hrm_t(+#|5ee zAFL$Xmz{%Z)QekE;6(fH{wS&JmvU;@TyB{*oCh$<8IejcvyYu866VjlZM1ODc!>)B z`*Z$pr|-)xUsi&#>`ZgBYH@Sv-qO>3 z7jhY!-JQ3{kWj2XT(Y3dZYc-j)8j5yuS1k0&L6cgC~e$b)b4m{WNXAb?ro>6aTLok zBHHdz+8bbYNRB6B^W-QBu8kF4UDmZ&Vid$5=Suc^Iq9Gb#huq9e`&Fmo??o)-H`bF z=UlJMynhTCe=^NLnskSZvvWAG0<8HZR*rJ#-?I!9AKIpg#xWedSA8lxsP9kxq;KT( z1~nRF@auelVdh4i>M}Q*itNo)Ge#bGS&Q9ifl;Fco6(=2d(C=87&Mq$3wYcd8RQ@T z1taK+H}8C>T2XWMjfwYlw9AA5tL;sQo|iU!(;BQ$s26<@)OZJ);#hMljg+%=bL&qe zp{9f~kKnA7#U2SzbU3W$1F&~eL?mZkDXd4|pm5C8uRyLqv4N_$E8d3q>S4>z`0oUB z-VSJ|#P}2!=?4eR1!%l`va)d1qqZzm4*!*P7Q8tvQI8EBN7OLWVvEEWfhL}Lt@xzf z$QZj7u&!z%0>-g@(b$lU`~S~d{IAnpqYIj$LAy|FHw5ofJZ9z&mP!s;lEZsV?_Q*H z(Pk^k>Ftmn(0vgGQ&GExd=yvwLpw%GAmPzgWT&X;)n?4Y z#OV^I%lt(fdW&(lP^YKBW+L9jD8#XC2(~aC0QQ7tpc(d)-!Y1p`}EoOl2J*B_QPH$ zST)-K2%GO?mfz?CeVcGbK+a>TO)boCDLBaZ>X1HbkQ8|U-1~SZ6e8Ba=Jv$4fv*w= zgdyv>{d8XNI*#fL+_<0FLo|TRRdJ)nPQzoGQAWr zcWNfCrCh_#&3@*xoZEIv~ncexqQG?T@4BPZa)<3b?DKHngNyo{02eJl7viS|D0H6zVB`Ma zUN(2XE`^8V*k3${k*{zII94~}o#f&uFugG_k9+F$sTz{{7dLx5f0cuUHA8ksmuWU| z4dZnSnNgS5oidG0zn$qj-ftwPH~<;WVI@VZYsG8+a?Jz3aYH}9z0`Y^+uLJEqE%7? zfZqKxV{rZS=(?YugY(N zbLHHxhz@vSmf%z~Y1PhbVPQha>Hh_;CQ~(+G;TeK5^GLoSsReryuA-tvhlQ%T7={w zae)zjHhH_pX&mKcw%8}1vF#kEt0xSkhO|kWoXDnnDR%`QPmM`GFMLa5m>iyEbhVVl zn1%v3fjZx@!~;1BoAh3ce8*D&3M>p&2-Jt7Jrj@48=U7zwtZzQ8C9%Wk_dUTfj7{i zlOA1pp6jk*Gf05f&(N9A_#mB$z>%T4W6Ab!TI>IDnn4`rmYg!9dv1`w%ssIAIOb`R zg7M*tl99ETS95IK7@1TwN}n@s))6_NDSCk^sbkbFb4_o4$>ArraYN5!Kony}3%-HE&` z)~UuTQPf*C(@s`I0+vpV)oYQ!?ltqNS5kbCL<6lr$<;WB9%sc`R-A%w%tmUrau9}nuK1ujeWgS zaQ*Yv}g>O=ThkW{OPv?DGHPT50pZ)CTA7N8bD)`o>gyAdDyV=qF_o`* zEc3oBQNAG0PKKSiRa!hVhoQrk5q?Q-K}&}kZ64J!b@oGi5HyOw$V&@3e&q(Z6yn-; zXi!V{g-s_j=nvL8O#>y*Z{T?BK?rTg);>j*0Nug6a}3C^dJl{*0ZmHV)HKp zWi&mI_*OKlk<+fE5!ujIRCZXm7$rK78?XJm%ZKdBmTT^U z&Z&e28DE!rfeCmjHYi9!B<-xuy*!-{kx3^rt8xj+iLY$aOS{?;QnkBnVrIJ=XIAhpiYII%I zm;kval|rM}*J-k2I?A8L_+Z{PgX5E~Hpi5W&6W+tpMrJ#91iinKU+a#gGQ4%_|kb{Zj!d~o$PZxV`ls|CEjS`hxxKzBMwaHMxrx4g(FcgWQ z2M6?4H&=@PrKWQ}4#z85vbiZ`qlsV)5;NTT%WBVm)K0P?{^zcUOP_sAuewvJ18@+)ozbvpc5$_1jX=^>Hh zean%xFSkebFBa5&-6$P)H zXU>}j(|iy$i(V<_r0}&iCG=X$(cg9h_eBUfzB-Z6Xm;%A>}T-GXEz>|Pl1b3m+Eq; z`yG;Z1VR%vsq4+|PkX*)953O42 z_Xd|GhCxJPrjC%6famJEV&L%U$)9GzwDu@F2i!h{kyqODm!BT(Jyy&HFnWsASMuB} zgTehvtzY`A+MR#=tRzS-#k43dUIgWfXgu~BpRzA^1nU^=R#Kc>wm$#D150|`p=wC+ zo6pVv_#(aM1{bNJImlSC z0BUP1uMoL;KZ+0QY8%Q2ExweN+Y%hFvDbh!!oI-mEi_3??ZP|%hA5& zLSs{{&z^I?ZCh6wAM4WUKl%uKukDv{)+x(pg5qCRq2Zr=jQxX>?i#)x4i&GNeEKYb zrA)eup?17?f6<38J=1>}W%RAw>ETS3hD&yQsN|Pv_XTbRKV{3qKPc^mLYw^j1*V== zX0rY8AZXW(1hM|x?7qPGb^FFTAK`bhY;w|eyq5sKP0Okd(_{_>TKWnYfu&n3GHXwaD}LSVQf=iDrHz=)dU(R7Ym=xH)9 zs$-B3*OT%C9Y2Lco03w*Y(Lk7BZ?dW$haHnWL@rir|#FA6(DMf#_(te7#)C7)2U;i z3Yj1bb3UuM5NC%*Rg9)=%rBf-!--oWWzT;d4n)}h_-JtilY{5>_~j$XQfE4Z@v z_6;cJG?Fuebpur!7!>gYwF206=?ilpt$mz=Z)OM05h5-kO`>@H`qHEkL?IjS;+7*_ z&va>Pf$%~LJ08;f{9f{Z)+qn`vj9ZQ)8`IZ*Mcka=tX4gv|QxfD9rCcw&z;+hF#d> zCd;yJ+HM_mqq`@c_?2W1_`8NozE|`uk@HGDT#4S^eS2!Z3p>nSB;Cggw9Cc%)P<)Z z1nABXC6BHsxh9Y#-anka+FvWUMf{Mz#@55a z|Ec8!qHf_~n`LYUk5eY24SGz`)L3K?MUsZV1{f;n+y3j#q`4uIt5Daz?d9`85Zhb> z!bmBgu}IYB76r{Yp0o)<&BlRdVVLgltG5O~3@gvVO#-OJ&QKsBQ$`+Ir+Mfh)UX9< zp2^RFzR}=n`wNI01(Q}Ojvqz_i^~qc)J!W0r5H^Y_j@{+03+FJd)=~?pn3{fS>!8A zJl>z%3LJXGsC#GM&AzNY|L8YepiTahB(3`KSvizb)hut#GA~Ix8 zBVa>&(lr=`kF&qVyv9zA{Xvgact2==ur=9EP$lm_HaT#W90eN)<}9`AE3$*2!88&= z1*xtoPHGab1{Q%(9>c!jYvOefc-#@lgk3ys{2!lf70-Y5&r8*FOwPHn`!gK}O?J~( z(3SunOKFdgjz0iVNRTMgD&dR#TcM0ra;e|A-p3cEv%52mA5hY5gTcmqNfp~t zTYu)EZr`t?!q3li6aL)z5p9zCu@t5u%3C{-xq3^wl=7b5$lJwVX)NoppP7d4gi5Ke zH?{CcfyD+y3Yv9~)b>+xRc~cDJy^7MNBnv8bR5?@jk@7JJCr6JbBawD!mCJp3KXsJ*-Z<|&5! zf!^00dFxd^VjuwNW_5D3iqQNchpd1B&CW>D@RP*+@rtCIMcXfs@ZN-i&Rx`Zq&(4A@z``0djKXsyxuDRO@OII4n4hQTc67Roh90)w$J}?K& z?*>wCDS){2)J-?f_9QJ!PT6o*wp}qu1VTW-0g;m)+A@O+JYM9q+V7L}a&{{xm4^jD zJgLT!PDC#VwGWsxu4>Z4f3nYJUV|T0mybaqb(}$lq?8Fja3S!>If5z;(s__@H*3S> zcIS5i@LhSSjgxZda@{&n(BL%OfR?SA2WZ;bHD9sRsuhD8{y}F z{Pa8v-RvHhH$ht;P$*J#--OXS-XMt096-`)sfwrWGEkQ4%{;93+G5p;gUP!H!VJ?^ z)q(z57iQ-i5*?D9yM8%0&Gln}3+G%BTb>r19&@E`)PjyUcW}*uj>pvDYL1G9F2z=? zN%td}4RPm*gAh-H*MV%qKX0ka@^I?@DElK;z+nXw?xgqA?KKbA6(;|1qp%3(8tAo?u<0x6WaUWG)r1vY+C#uD#Vi zEoRwzTR#q_%}}eIRx%rIV3!gy`d%k5wh%TPOTq`;(fU>-ofO|y&}7QMlDF|7f}x|B zdIDGce!htP9=kQr)btt~Q7hWknv8S+e0#jvUti%hPfK!DXb{itn0w}YbUAYUZ=n>{ zDR&%jOV_V&{}$2YG{aQs!peafzy>J~rxD-P&pvrVwx0|vfb+sPmnAav#kWT<(hzI}|MySZZ94^HzA2JGjWY}354OKk+5Wu#4XQriz6)&RMqsZDN=g1GR- z>gh~@A3jB=W{LNykw;H6a`G1Pk3}@?Wg^>36-5W4SBvhd@y_hR7TVvzE;8iQrNli+GLYy;#9xfbPKEpSw&5+YI>wJ zO6Qh>+XGZwqdsf7eP(Qppr99Pb>lmtMj%exvIWH8$Ju~S7iXXRWIXA>NWiP|2zUba z#{0>LhXu&cpt)HVC>Y~T1VgC8xS4z^PUxXo<(Qtq5vQQeHv8x*0ch8^ZQctO*LKU# zM;p=)$)oPFLl1w?DVwz4w%P(v2m|u0Yn1Gk6ut>q5M&eu(`4Gc7l-V@JB@Ey{UDe6 z?mw(>K|UW^2hr;XU_$&u?8Vx4&5eS^1V#d~z7BGGpJFJN4x?SLfnc;?)t8ljGT%LQZRYLeTxz-uVS35O#dZtl$2YXbDw1_(jHgj(T6 zTG~IR%luxKx;J3idO)#xuDc*A=ff&aRiCZ&;Apqq-S49}L*&K~1qM9uW0-0GmXmWM z`wKcVm(m&hg$5;wViUs77ZMq1(8!qQBwKU#Si$z~MJ2s+Abz^}C~$A7Yw~wHD$NH9s-q+z{~p_O zUM>4+C%seexT$c!Q7AHu1`sL!xkaS7d32O9@c*$%04#rNI$Vf&>IcddNv%F{=FaZ~ z3#_K+?aRV|Z`6zeCu{`(jHfeeGl%aQ*Zv%~1#!Hg4;Lve`Kq!$2V~7Vp7Q{+#;hc0Vt@w?YxnOlo$QL;*9SVv^!K;o9i@B=2Ei)R0zNbD^t8x}@cB;X=GryT6V{35>r~AM~R!3>%-i zuISuHqobu43nZQMr=49Za!YgO#j3De7uJqU>^RqwX8S%gUSnv-Vxo>yRlky9VL(urO<4sK-(4`v`ufEv>3)Zb zwk!1&nuCJm&3n@1U-6&5nMd5o&l<;lrxHvQgziQRL7sJTh`k^11FcIEe%K~>9DNSt zSewg52eHZa*I3us%he=jNBx1EhY75;JpO8dyyr511F0m7T!zN(Pa#?)8n649SY~=f zoU8_(bP!d^sBV9e|60(Ma?fogG2;YXu+qsL?eI0S`ais0r_PREU`lQYZw``k5$P7m z7y?4*+^gwVK1I#?;>G8I*GBPlTaT^CuG6_31+U@~zovVuZ6d0e@6OYi2tNIKzDg_L zhBNIyjjLdpeDuB9uUQeTpItZorHtVo`>OxOU6?_sb}H;{p?%vfY(_5FJCBmrrHRk1 zYd#^rU42Y>^&#^RCZVkEMfKF&pwm(3dx0^87m%bAU`H;UN@?wDf2*Ni8t!xLz_?xk z_?QBYMR)?`yIE=ta_tPMsE(f`{r7>@AW$)Dh8&kIF(p;QDkQI39J#VTcyBTQ*r{*t z5zr%jAo+V?)(=9BhW$1|`6m472jhlrYIyeT7Q-KcSXmN{?PL88K1nFm?YN| zQ`}HK_y1j5=D#!1K@+kQ3f!Dl_f?i6k=PE^VIjVc3z{#|6sb7=c~n-t|Nob}Z<$U%6=s#~o=U32YLUwua?9DQ2b((5ga&F( zqJId4$#GMUfpZs|mzPsuC(px+EIjP`Sa!ECK3Z~tq$gQGl_@O;S1Ei0R(MaZIFbS8 znMEp$O}4(k@)Hxa?nhhgQgV2=&iJ94+nEj0Bm&aB7s9M^A|?1{55PzpvzOCILSxw6 zwj0GPaI7b9SC4AVm26YD^uP35jFe0!!9d%oDGV53w{b83PwtPLTev$OoI+pan6CXF=C8k(J-OK0f&{>%P{%aqgu~zX$ zp3mpYEw*tU6fRzsCtyjh6NlfHu-gwB$wZQ{7*{`~9)(%mW-5oD;7&qWkjw_ag73Se zdiys7L82xrAfh8dY7XF|>Sgfwb=r6-y_CPaNo3-iGjyNT?N<;b#cBjSvfgJNKW9CI zodmH^0`@Jw-v!d*GEjm~kp%&*V>?c1Ln)Guo182MW zrME4}k-%SjTRU@5le}#=k>X`6O;Pu7lX5h}O8TYcLxjm6l{ef3E|P0+=%T6XFvIvpFZxqR zM#+qu$e!9Qr*j&+6=S#q2PvTVLKHcLAk4&IscmFI8l58Qb2Qvkq-X)d#JIpoF0p~T|3hf(zh8sDQ)P=W z|GV9(0OR0Ky9?u<=QQVE8+u*54XX!nG79fyyACA=-iQU|KJiiMj8p}a8@h$C(Mx~2 zozDN4L$Q0QpR}qO;yD>TLY+r((5nu&c(YrySct4vr*McYsHhvW3DH2d-DpN6<*r!Pz`9OLIk5OAh2+!xFV4O^9O`!ezbI`a zl?tI!$(}8;mqN%s_N6d(Bl}KLlr`D1PZ-PC*RiXFvTsB7BE~lMv5hgmd-R-hp7T5B zd!6c^u1VLW`F!r}{eEqCaT-u?6l_#K%E>F|TQvIg?eMSmChtF8`3J9N8g)%9jW252 zJH|o9#S&IY86EQg?Q*#{`3LD!fU@`zwrdkV?`)`0N&geDP#~ z7OxiTli^5)Je3i{-Xy+LT6?uuQ)WKb**D4R8$(8|YbP{XDf|1iZHX*~_h}_1B|ZRT zQd?au-_E|3EtDSrYw#DoHnS{!Zt_W6NBO+p7<$q6BJ{OrL_ z*YWDg;^^JI&3Yk_et@&i1Psa;ppxSWo8#k(aeN2|B47bvE?*x9wg@WT{ng#|rUVJ) z^W=C)AqQ2xn9bKE!_7l~x2$$*w$bUfujQ+8gJz8^`tH+>To9`Akz{K*Fqy)@UrD8t z8+)V-Evk=qIt^)3=B~w;+-jCD3~B%THoron`F4s(*hHptcDMd$hW@9th>b|)Y97k6 zepc-D>uO4k$`sCxcL1Z(N1aW%8?Tj^B{I*?4Ddbevt*~TSPFaOIpTmFtq`WeM^c0h zj438@PE#Gabd&p-4G^zPKR=`NGQXW}CUAjh(nK&?2nO0fwOs#SB)9AR&TdGSNBu(SWc> z$l5TYw<SlRczdCmBr!K~H7H$47PWsNx|qkbhJ<=rU|8i|8XU zt6mt^1kLfkt($^L+Tyr+ty?T?QZxaBo~;_xIH1V4U4An2{Bh-evaUwGrYK+zri=;Ue%? z$hQ;Z`73@_&MXtDOVGwwx)S#r>O=M}qubZxm51y;2Lf=xp~mmPA*-XG=x0b^P04IV zLOcj7L7SS=gJpB$P~9G`AORRLstTr(eRgK2fuq99$ng#3FE`gk*SfrceOKPX?oxC~ zHil9)khG85&WhEh z70S~hZ4k3m^H&(&5x%L5$+U<1Aw3xp!sx;Xqne<2{w?JvfQ|2uikcVYO&xZ<&y6UW zilpxs73z1T>yb?k{{%PmG7Pe>_74R7W&2MgrCijV*Er;~5N zIZ}t(F}2Y+*LVwc63h^~oVmO60MH5PD~`?-g=Y0DYCG?2O{TSwwoGp;VXe&x z+JcrT_c`~TJGL6fnqMFf?xPH>CRGzPR^=vLu{4tDm&xm!AP?$E2*blDuTyVbj{yl1 zxMJWII5ytaKiC1)W|Hf{F1kaP9$i;XwgJSdB#C8-1JN55G!Z0)f=FI5~NCPP(P zM8?@ zU;~H|Gf+t00`Blq9RLQjgO=^lNVrwvojs6Uatm-u>6Jhc-Nu%gXbh_S2$v&8zm8AY zE4&|<;z@zZdFIr``KdL1xd;6Qi<22fOScNB`aqIY^FXV8cE8p3?1(6M!>-Y6u}>6= zbf)lGYS=4aS(yobS)~$LRch=&3H#2V+yp3LGb}6y+?1Mc11T)J@9F5^yNa?76R$T* z=tCA;4;(uma0vlj>=sYc&cUZm)yC+a<)stkweR2k@;LvE1{Jvcvs|dX7z&-EN_V)W zo5ve&F2-!5Q=zB{P-a z19i^A3moR;wvIJn*et%8f_wI;#|9i#ki)|vJNRyu_jy4OyIo`MB#XEmnS$|f`# z?@Y0UX-#d=UB8f0y3r*XG1u1mnwzD1!U}C=ZGrNtp&89sW3KPf~ncEL$8sd?Hv0yggqbn(VOFS2e5rbmSRs`Co&Pd8Al zAJZB8+lc(~$F8SRn^fy#uQ@Z*AaqgW5^W<+gw>u}GDNfRz&bfs(xy^#Ou; zuSLt1lcQL`7geqAnfoYeJ8Iw}6SgSfbh2gBN#(`}k&dnBU!2YQqWfPMhh_#?Z_id! z?eT3Wl=aLXnq=W#VON{b>y%BbAstg5v6l^i=Z)TI_d;&lS~mVwWU^3R>)88xN};as z512-p-=Btl?%||8xFayTyo{uX^y5>L?R{d+ptkebN}h6n?S+e%Q}OBz@Ic>C;oj27 zVknMA%v0>~eg~7_%HdybGZ&z=SJ)^Rstyhx%|Vo?P~m2K zm&D1ftdg^4@-5=b6A0(2BC|)iQ&Py+1xlz@ko{(zSX7c;1``BK4d>1yd3L4NVe+JimU%pVN4 z$A!A6mmMc8et&hm|8(t}9b9XBD!{58sI^{445i)C9QJlDKiC+N8T*y5SK`RWH0|yS zLRVp_@P7)2W0@<4a6=}p8xhJ~inzxn|yhDcLbk<2e#+KE&@l$4OyFvc5L<8YsBhi0;NWuy2NdNXLWxfX(c?S&F(l(*MobJEv(DMY+Q6|Ni2Cn@fLv6u1Q5e{3gTI@M}4XSAxCdJv1C zc|{p5d)UZgQjds8iGlRPp1zgt8i!`faN3uFlAOJdB1_pz?~^|aQ{541kL{g2Mn0Wp zco(@Sz#Jqvmd95S2p#mi_TJq@U<(2ufuD+)bZo%V{l@+$?-lJNh zFSic+o_ge-9zeW|$BCUDF6G-j52+vM0n!5&{3OMWoC@c!b{Bu&%Pz@YawM;9%AtyO zC-4J@90A2S*BL-}f^_@9gj*^@zE|8~z^r(Mh!{CGYa^-Y>O@n4>UT-7_-?@!ty=o{wEWf7IQzbg>Y*2%)o!t2^{}4o4 zS&8k}h9Wt`@9oS#GKZX8=offwUO(ZNMc?&3NR-{jO2ghzFoAbr*l7>nl@Xz8q-*_6 ziw#?+Qa1dA-22(HU)QqyZA=6%y{`0=u*;2t7H40s4E3$NQ%j?O4vb-kW!uuf;nhH@ z$(KSQw~Y#V&V_R{B{_?zR-Z-nsZOV{OCynj1r@bcnO@yNdUH=f^Ph`U$OB+v$Shlm zj8GdUSs(u#^ts#Q1)5EA_mPf?Au~G?kc)X>!O!;S`d10dq1}1=x87R)!?!U)D()@@ z{xTN&uj+o9jtn8x)oM=HGgh_KE){nH=1o)n@fL-?;OoKs%aDO!_Sh{pFptuKnjRwN zRi)_vuqQjJf}(UNC#)Mjv4KqTZV`SYF?U51?X5jeg)OdXodIn-{)231sKDQab(AS1 zp}6nVS!W#=T@R&oxq8Xd<}(JhLPkv8K-WGs8M^nAeD4`zK9p7Z%z@nd;L*#!+=u*a zCaRJ)vYgwQrqkCZ(*w>P(Fo{4TGCnO^>cP^%a=WjK5G)Xnc??QfkX8$9YmTv72JCP z(FM#K0C4`ryj}JD2mrsc^f=8?i=v5*_{9*uEY|-I!+|b`Yu)bHC*A&w49$1@-(_gg zcf_;ioXD1G&S#DQmFKUUivEVcz>oR$Fw7)eoiXH)&N4fDM8Nz~%v$dv6(7{)Kt?EfSHdDRjwa=OYA+PbB?%-Up+ihr?^3tKt&M zV8U@T-3Vr469wJ=D-{J!x$ly7CU%-%>%U8pF~28p*8<_qgKG@g8Py;C+RKx0>6 z{FP`opL%B8_wU~iuD_4?+eG^1kBX+GHRKx7kUd&&D=dVWQL6w|uKf zjf&RL<2{39I>aSfgd@s$)buMXyon||k6EesyYmbbN z@YAzLirDV1sUnKl$z57_rmisI*zqn+U9c0&;nMNKjoFy1>FkDUK}S--!N~y#hF4PV zxr1#~xW5)tJ~LTX6urcV6pzY{KUquEJmZQ>_HV!*@lptT0pb$x~@rWuSC?PR* z!fH24S2ImSrxomMx2UpdvgO%SAqY0oBSte9wCN%$5MUp3|G+LFkA88EBTS2~a4I(J zSJWC9SbD)ru9Q?>g8-*cj+4lsg@*B1wXy-RlyAgEZ3zH#)QOw9{4zZGuMN+z@lYxZ zz7!fx84tkR&gNSQA}Ugl zBa9HUQ1&nqPRVWpF|eqeaKqlpYJFm8B{ks4LMjffX*NEbSD&oRda0Few&j)_Wo*u?du%!9O`8N?J&Lic6G=S0UP$S>(SDFV7IsB~J9MzPX zPU9$g+T23lm4089_xH%}>Ay2}iQUAa6lvsJHwCYFpo``X3CjCReFt$!%-|bpeL%+~ zVR9YzMic#sHW!URnh0iB)RvFW67$yq@<7oE@anQUyoX6uoly{lFI^#Fp!3iaFb_95 z5)d3=n)uy5y8fKHy5?^u%1_>D_adChz%*x9+)f52A^#Z5KY1YeV?XTR;p?01>dd;qIn7?>Bs;^0mL3;CIO{@eT+V17Z z>EuXVSd8+FnMdgSkprLxMW$zguYdI}<*%{^e`}1TC=Ys)6RbKe>#QJesZ86M7Px-H z>}KFv6+&m(%j+q8pn0<>?Fit?(Yuu{lg^H~Fl-OWytaSvXo1^K|1#ugvQ*1exE2h& zw7~>bQ_br}^xAg-RYw(Cq%k|lze@9BK?|1urIyFj)6F@jV|KkQtrj#wos^)7WD4+%f4T{PF+qt!F>O|n&qu9G;(mP2RiQJD&WgouTtHaA zz21BWk!3{!`^t0y=qX*B-aGa(Km$>}4|F)z?1MEVr;&&zIvOx$IU&=lfxvvnuPV|( zDtX`v(v4A8ng_XFW_jC^zW=3n~5P_Ji!T*U#Qki)@kf1e}A8T#KiKt z-fxVa(_}Z-xQkiR3@jTpIM0>hN3^=Bb6Vnpxn`gG**tAzqZOLj!qg#fH0X#1RF=FP zPI^acyhExfkTL_%s-!bXj`1clgfS<=0GcdKHw2Yb;y+8Z&?szfv3WR*uy&^PnoCj@ zSdxW;$xRcQX>k}qVxLjhg&r_ljeOitZt9{$i+;WW>IUx*T(FI;3M1UPGmU{VeFv?&D4Zc%=t1u0;5HijnumV8Uo3m5)N+>H+&1A^u%(7ZhA)8n4LXQv(>R*o`-v!$gb+GnQ)8#Af7vGRQ%HX=aB_?qJmrbnL@=! z2B2GRRwM%K!ecEl?$Rn6`-ny(P*MQ#7*Cq79IjqAUis$PEzr~64fw;J_K_XjsQva; z4ns6WOW34ghfEG%RKE=a718tl8CrFA4Fv$mU=d{LM&QWeq#(hHO` zy0TCtQ7&r0$=svCV|q!N+D8umA=51}o`D>)DI#x=e9ThsMhl_v{TJuG^ywvRoVGHm zDMr~!duc>_94g1`E^*r5W5u1VX`lCA{Z6rS@Eb<%_sfa*Vp5MRpui^E&7%|IIjC*%IMC9qbpDHmF?G4a(47~+aECQ_o%0LFlVi>!>3<<+$ z^p+6G&bu{>T&wva$ED{Ue+R&O&mrhAUkRi@`kdif_ILf!V67TA$oQm9{RcJ1Qx-5rDUXvPJK}S+##GpHOjB<+xYQmLLX9w~ zMvivoyxFs8d&Ov7%!#@UA+LK&qMtQbL}ZE}kj%^bmHEZY?2ruywSd6Rx34@OBxL8$ z>M`bc2Mt?S@sGi|SLv80pOch|L*9!8SKMLH3Rr4O6n|DY1+zD0QG3`&5uj4=052zY zXenhPboG9khw(kFdS|3WnbL|>=}&d3*F|L*ocZ&Sra$0S{EjKZ0oWB1r8#xp&e(b( z^loG%-;0)y!x`Tc>20;B#WmBA4#*LEI|vPMJGxZPe5$p3&M+2Hl?~IH*mcxt&TEI zw(2Cbvt5H=8B1ycafDb>IT+`3pS&8`voDIE4POf3DA8ntr4A*0PXi{Ypu^`(rflH0 zVFN{s(Yyxb>jEZGcf>ajlIS5-YD*DDm4cz1yR_lYkYWhUL@Oau63o;_sPat-OYA$> zE9kgb8Us*}ppj_cgZL}hV1=U=oqESW2FDG_2Hen0Rw43Wo=O|l`juyYwEu@l0Wn)O zYuPmyykm5+q)!Vn(&?@Y-sUY=*SHgO z=s27Ns8Ac)2s>>^SmceY6Mt3p>Bxii-XtRqz-H|^SLc7~H9$~6d-dNFh|*vdJU;NE zQ#%#hf`vKrQNeC~Idu|%Kbpr2R6aKFZbI(#dNh)E&#@})-h+$v+l)}*Ca%+V-jfx6 zLQarkI{GKDn4%lmHKDEn+*N6)RPAM*4&@xa8(Lf_S&EFbCP~NplozAyZ3G7q$~)4UvB{U?_~%&p1P5~0KgOK(&b}iJwK_V_M8Oeq&o&9rAkEu z$2u|-a$Y){wNTCWzl0H4n4+yng5PMGT9S>sI{4x@xfb)5K4_(%&(oAcvOu5q%ka@( zIN5b}zjx6NW+Q&N+vng1RPMGo0YS9KGww72pXTS@PU1k`+M=QQY+zj?O5sy5%_>V-^SU z8Sb9oGBq1^O!1z!T*D;T2@DuHBHZ0K7Cvbq>vG&|fVN(55~=sN?J#Dqr41NB>x~-v zcSQ6YcUl}(ST;vJV=D>$lEcvLZD3}KqY@fxtFa%&wS#NZ={ zm~pb(?n+|48$rm{G{)$0<9bEBt1od_db(-8;8?zzpzc5Eul%j|3F&#eL61=k#B&F_A;!M3AD3APz}YWM46NKUd#6bmtm{H{BXyXM(ed zUfIfeYnN30g#BUlqXIgV$_PGQ2T$qj#4t^3$_&BYSK_;oM=si&Gcx|t(z8^(33FUk z4ihQ}dD}fYfpy*GDOudH%OAnC&1WXJCNxs1qI{*g|QdHWz&C^OmZS>=3ztEv5A?2kaE2>O|Nx0ixl zdS~j^a$x3E#QFR5Grl%peZ9%Iu$vyorlrWi%CsJGFQq?-JnKWhEtc5&3ok zHAVyqgu7|D_u=$Ye+Z|8&F{SDYd^KgAaZu;?3D7bE`1xvv*nf|0E!wkPlCY+t?g#3 z>0hRe#+GGDJ_IEEfT@awuV*h>8_2eb;bct>5$i>fzkFpXlAyc5oWDZe15Y+Z=<9@*=r7dRcukO`Kyni zyz#&=2#bvTG-}s}G6Ozii6`~7d)ue_U~YvVdO0wE+rug+<2x{Usr;4 zK6RX$gn9;dE7iL9CHdoj(2nGUzVB)QWnqY2bx&rl^D_+~22~Ud_zVauNm1-oM||E! zh8t$)BJWvWx6RtNb%@zkA8N#@c6%yL64yJt^oVMmMX1WW8U6WsLS4HJ&Te?yyF+mf z=I`4$c2jaNevVpXJ?qm&;!K*a(0GZN!yrFmzTVxW1dAu~Th2anB&qJ*En!L5OT6Vckzl64L{jtJ-{|w38k!?IawE$6WN-sWZO4-W704R zjnwx5-(2A~v!rBSI)ssxamua}1_I)0jf+i}neEwn+0--bLEN+`kXQfy319&fk|Ya8 zfIJ;rUir$VOiHrOS8s9x7fT6a!>s67S?J&{c4^&&TKuMskJ~P40e{&u4Xm!A_tD)fH^3v_0ZX-GG>ZJBpzMELR zx>lR*0zG^;@C$vpX!#IR{2^ey3v@V(ZG#&&TKz6@3^R5p$DHdWiMdKS+BuK}_IDfnr`0|qze(+uDyZ`GA|{Cvj=Mg?yn=D9EzLQ42G^%O}rU%W)u(&w#rfy|M)lDl2x zq5MnL0~?}WJ;wWZcUe!!k0p9c9GhOOUR-YWntsg!w5QxNT1oi%k~U{8qqqeXT6z_I z1o+P8!_0?G2RO76>u*=9i_&K$Q!@@-PuiH%ZsgKvCLIF%>^(-}*l?FHP$3l|7fI(p zc7&1FoCYxN6cWzg**d^QowKp=eOnc|XDQzzc!{N|&iCvQw1i~#WA7jKJtl&weCbCZ z?IHYs9RNEvD!>2!!4`9jGS3ERlX&XT-D9s2$WI?ICDQ zp+A-OJGTPqmWvF0!wKpqaM%Zz@cGE3ohUm3UjEmMZY{a1R7T@gw zBZt|>PI_&n&yOj}b?%gYYq1=i$er_GfxPmQa3uG3@m?XYu`<~$?#(B;Y|%O{W9k!k zkA7QM_qAE9!1DNvkQX{{-Sr~Vi!gr7-JQ=cljmnRTa z*p)*o%U>q8`fk1EDa@1`WqU;;LgB7VFP-%5v%^3YbUJ4u14l|`>6#DOx$p18-47Jo zjnR_J@r*2aFsa>V0p1{2n8Mq7S<9w(u4yZEZb@Mhh}bZKAWYg2{ztDi{?v_1Kf?fd zgz7~Vx+ggq(C4|!Jie<>*C{-b^fk;o#IRA!an*}8;&DTym%*p)wg%$);+Vab^qT0_ zpoa*ZNv?vx%f(o~xbo>>WJhv+ zxgac;w`p8Ta(GP2t`|y0R2JWUUb(W96Y0DddUMRF!FhVnJb7cq?}+ypr;S~oE062i z9YlXEa~(%!PhjAfrG!xLz;)r)MZlsnscn z@VJ*0%4hZC4=~gNhpzJh>m2Z~)7@+>4JB4my$0nf0i{f( zF0AXw7m)VrDZVi?-cB29Ffneox8W<;s%X$(?+e1g+O@((IIG)hJm)v#9tsVA?5tn! z;dJc7P|IToSp*)>ka?o_FfnlOQNzRCnYOsjgo2Cqa(P627mFHsEhr-)cCnRy;1ZYu zAyBL;JL^gr@p@v{e9h*Hdv|N_EAO*e3GeG-y9Ll7bIFv{fr$#4hVD7Gk?vRS-_G+H z5$tm&C)fZyIR5(7YvYbi^PX+*AO#IeK<@)4MajJ-UA6I{hNrB=lUVJ7>z1DsJi*cT zPsy3Zz!C1W>VHLxfXr;I5k(v(g12<|`Q9Y8?@cyCaaJ{2^?%X|VL_2cqnhK}M^x;3 zUxkMdFJn3TDA13A);E*W?Z_VhI8tIHNNWBThAOI9hN7&=uV5AohIz8fn@ViIUX@qm zYNQ#Ou4ll2*j_iI2XhEm@7={u#rWoJ&luvbwI@1m=uGce6Qe%0*1H@o!8C6^oJdKr z530m<3Jq!#oHIynvXUjg6#f&O-$G`a3hb>7>=Wv-NoL^oWwVXM!Rb{=LsN6nXs+_D zH)fL6vOKOPgpu2h1Sc>(jF#g1rBZC=n$6dZP&-0v{ixc8%mjY(u$<>Cn5ILH?T9mjq?O$vk)H*8 z3B}H^UF~2-`&muSE@lza^6?L2QpAi7s`dNQJAp353LPjKy({n9y4xMdoOof-po&}) zf0z`0mP;KK(7dOxsR~rl7f_dH9$w(Zv zds|P$-jUq9Wo_(g=CbL4!uU>omL_;^8VwJONu|)=6HPGWRp1hATqq%$M_wGeNPK7= z=BglD!D(%mMVuK+Sq<!CjA$7c5#;hjB2C3wJP&PQIG> z9;tgXD7rj!`oscT&x(AiupuQ5@j8)P)Va7RT7X8?u^xUDdemchiFV`4)u=sOb1;v9Zy_;rfK-nxfWm}Umj}l&{n+~1 zer*C>z&7O+6vgN~`q0t72J1Fjs%cMjS*6BSD_vtIe)2Oz3g%Z2v~HZ+WXP{>iXV-= zMXJmNBdP?OMw~I&=}cDQr4P}7_RJ6*AY$JgA&3x-;wYACF$L2|4sOPx=J55~tI`Ki z8>ITb(ryixU(w^V2JY8<*x@8eAv{s2Jj{He?ZJk*WFuGs`5Vg|)#`_DsfbhW9jI2e z2dZSHW_H*+5lub7s%?l89IrC{EBIsVZGL@b>IWkV8zSb`o$WsRs1<#qQ$cBL`*#< zNAQoq>eImE6F^xiNz5K)Wu1Aw{oZ$JnhMK3c+vU>ag`>8fAN;b?bh+Ssp|G~OCwf4 zatkZ;#+3_EZJouQ(cagr^~bR$DMw)rn4~8oLhWh3#Dp;ZVJHkv4J$pG*<;3CdQs?WQ-@>ddn)-HVc0I=^D z314|oe^l*mCFb4oeYMv1)nlWI1@_*dv?eh4fceuu;zyoKeWF@-p8cq4V3*rQCzscF z`~2_-%kbuQpEZ$6L={2%L* z+kS#w<|`dSren1@d|LoRJz6nY>^7=*G?_Rv&U`B~(e0T#xbh*ga=~SACK$+R%7waO z^Llr#>dZ1=`_d=m&}-jNfhplFWRNTk1kl|Ib$#Y$Z&45EF!@H==rQmazGw|xu5&6s zb2dWosbGhR9yaeU6C;%1G2nRtM9-oOE41B2y(iG02u0XhY zGlgx#=olRnlcwMw=^IbIymGU&xYloM`x2qG&T>)`z2U;{Z;_6aVmw#*ux@H(<8Hlz z9y!6GwcrszfRFK8_j9g2uXWyg7s#~Sw2d?w!7hWd^nS^RLu*2;q0ium<3Q3h$ZS=A zA&6|#%@EE7F>GIQD|%Y?p?9x-4Puu+b-XNd5o)BGtCGUNhS=%-{$U^YCJ$C!KUF?w zUpwg>rnNs=P5ySzL$^M22?#ekgZL{(hEr>k?L6V>JEgMTg4X4gPV+7Q?s6Dpg~r!N zSHuIT8lC}@eM+4a=wen^n!FN}NFHg+fz3$y?C&In$BRFo!S2$CkSO5O$#xc*?u$9~ zHD)EnBM>q1-XTSX3cbZvmitaKDfbMAK!#rs)|qMpD5gB3Aym1|$7SM_ow2hfSZ{tDZ$U8Yf21hL`retjb22*!T{B@12fCXFK=;0}4Nh^W9LR5k2Q`oabD<)Qdrx12 z8z;a20l$3k=%>>c;$e1hYI=^mcYK&7uBMGBzRBE^OX18V3x}ZGsjk3;g zq5R?JKDEiLKLaaO1mVW}0=Ig~pSr1fo>9pIuUCwaL~r&cfGu?%_+|U`-*_jW76-3r zzGsS5EM6b#l8WC~OTFML2FYJSz43c|{iZrFM`Xb6y9knY_c(Wxi#{4;vHBn#Vy(kj zL-|rx;~UcEWH`zQz^l`kY5l|aO+jr#Wjud<$u z6JZKycD;Rq0(?mJsw~<0Z;yT`CG$D!z~G%Umwy{M0;Te$0I310_0@TgVY75*!D;w1 zJ>9)BkXJr^y!`eRlw}goN`Y}g>R zXU%Ebjzx#e6vyrB5Ciu11(x8-nviKg%!h*5<{|ILSn_fNEcHsEO13||$G};a}(DyIUyR=tz3+6v= z*Ksu%T^|v&5x^w&hZt*yTsU?0<&E2zg=&mT${cd;CR$uv_`8u$Yn~^#T+q{ZR2?_A znIsZ=fb8g{r+@v?c=YOLDI;MxABVB{X_dJvOf1eqf(+aS{ZE9)#7}oJ24`}bjlQe9 zb=kVugBOvcx8~u<{rQ|RH0*os7c<%dJx?}7XmoWc4K@oM%!VCV#owztFPN-bGU278;P4}c~_t7O1!6ETdm}{ zpTvl9t=KrYa8ApgTcKlDhsWpjpZ>tJJGcpsMjMXPSdd#{Bn2ugEId;4qj~bk9(4p`?gj2xtZ?xp(ar+0A2z zPDvd&_{)FLCrUk|To=sCesTbDScw90IO@7s-si=YWkaI^%fpR~%EBv&{Pr}3<(GWB zRchZpw*7dU%*yt{yfJPl>Xv3$>)<;Todk{-V!JQjdGIz2*}Qr9)dRzcEq3XeL&V1M zbA79N^weY5QzL9Cyi(gTSdSc$H^vRcDe6c|Rju6=;%M(2V5kVM{K3PoR<(HPlz3q9 z_C0w_1-Cz*&fitth?wN# z+7qD9pu1QOizs#xaJk0NIOi^(0ADgRep+_;B@MMR;n}j&db@F2T@w2jtG5}r^%C1>e#w|xbXWNoYM@Fy_9hHt)8~K*`X8Zr=gQb@b1%l0NWUw-rFGnWi$)qZ zM9C0uP*m-rBigw?nvqAc61+aAC2ze|=;15b`D}E5xi*wSleP6NjO9LA-~7jBiGcLr zJb#~Q6W`hGx&CBG6+WC=%+-;f=fph}-_d(0T))PUNL~uMK9-Ltl)JwqeR)!joxlHk zBl`FRX+-57Fdu~>^fW|Z-SI5Aw#U}o+WlcSe8EH>I>*WNzV_4O1t&e}R}E3!&1NbY zbc1BJU)8|Neby6z%GWG-Xla6&@V32bUFPu$dfR*M(xpMoXs@yu%h5fn++;SaTF)@&V&zdT2`wzQ`oYOYuNwx=V{opAfS>4_pf z0e#aC`J-k~gIvReo~9rp2{epFk06BoaD1<`@)RydIxwjQ@i(frVI(qr1%)Gt#^N5*;9iATya zqNIHA3Mh~7Js#ChT`-g6-J?(TCQ;uF=%`gtQn=inj4FycNtbMW=>DqgJS@%do3r)o zS<=Speb+DQ`_l)(vh9w-Ok)h$=W86s{9ojo(j>g=xo$B@>+WIt5%$%A@_f93sat}v zJ(TUl@pkyd6UE1d3pJHh`W-fC>PKP=rf9E7EFRb7G1GSZEPh8+SIx4wFfuQ>rt|<# z(UNB492|yAM7VDq>y!NF_Ue|*>0ecERCTa6(|z#8o2XlHB3pZ3yAZK2&a0%QtbIPT z5JPi-Q?1doi!Ogyw+OuhuK zdWps?Sk0ICgMDV`+3xJI^JgbkPlOEEvgeoTXh)*0)rYiQbaF78rDaa(o@Qs%xz8ypMN)fS2;4f9e3LhJ7x4h$(RTs9 zxOkLC2%Hq!oyX-+lI!Wvy)Qo0vV7oih)i3RSATEZLZvPx`AM98V0jQJq10U_J2z`p zw|Mf?M}`K(?LkXTo;=EM8xML(EOe%Po~;*nnrGK+eOAsm+7sR#kPv5~`eb2>KrwGY*UN8rBc zVk@+~PLbCOPQCJbngzN^j1?&?QsZQ}yjV4e=;C4Z4ylI@hRd9}a-4L-+}j@8B9E9oo&y#v`% z0VO|lj^>w-hu5HuK~pe4+B-5k>*Uw6d@&pA2zILS&A1uwC6!TeUruT78mG+d@1Lc{ zh3lnrkN?*9@~b*`<1)FomwXJ(SMYt<6Hpf1*dgaa|ET>D2-SIixUn-uXy9;nK~^us zC2vlKVn>A5?8z_Ja{I>$eWsKMxVBDTU{O3v_H++s>D=wntoX{l4_FbWt7|oWDp$Z0 zKa`T<@9s?E*VFVx4V`Ynd=_3};$N(ch1-!CU5$D9_m1HIu9E+1 z8l)JHM)3k>@Q_bJIW`@Vqv?FpHsBs?xv0UWL1cxH|mt#R=$OaX@9q)%l!x3EScFXuCQl9xmO|Wu8~Ir7M@7&74V{ z_eQ#}P1kMCp>sx0c;q-F(=DPLrsS6rbJBb$XlHqRY!^LutgU4)`n+Yf9^2hs{d7io zx=Men+%|wRf=cM(w{U9aJ*1borP^2>Zc56eaua=CdD`!P&xd8gQH}N4NxrVw*N-KV z3dT-%%gP(bS8p(SJ^8#@!kHgL`W4IGCvu;BNMFMM(3SbPc@&CrZ9^<*AaAt)9)(9F z{2pBRAXN-gF|NO-1XFceS-;9Dy9T!*%J=x=^TcM$wxbtuk<1DS>#eD-lq$zJ1%jkBT!x^is|E?C%v58r!QvN2_#j%2`{cC^!vJdIMD1aW?(|-Z zHRKlB#Wuk^lzjZSj!?&d>qJLf-`?`B5+ke=9bCqi0`c;ji=%`hnx$ISoup7ZdSTyP z`(}!9d^3~pU9-+)#-*67x_({Tsb*QGSvj$YWCh}XGJsb@ZhIKN~ z@O7R4Aft7thYXEI7vo{lXWYGbJxXh^WV4e8-@j6VT}h%>IAzIua6PR#B*M0QwCI)B z$3~vDXKTJ3m=xE1$(52$*)JzW7f;jOg&~-|_7<#q}DEcX7^D&1$2@?ajv&aXPHc^he=# z6+G0967tCZxnqF6Nb&vQu4>BlJ61-qL3^TkO$wRD_Q6FxuATN3lS4@f7p}GL9}_Q6 zw8is|3L=;;{#?%w&{&Hb(zT)u;x8N|!+OG5`MR1B*(@sBQv7_@X4A_XQ(uet+*eJ{ zf38*&aap*;U|aEyLzKdxZfA~zZex|>PEt~qlnEt#;J`LiVa>e9cd{MzWA_Ai&|Q@i zhdv%$pKJ<^Zq>tK<&lDccbCveS zU{UYT3V9z5sh5v`E5-h_Za4Tkx%c)%x}ufi7X9-L)S_+BS{MW8D!6bacF=M9kn`~1 zUz1KV8qe&ea*j*)Y~SFQqXJC_c0TCYvP?EBf98Bsn|kQYp|10Smy%e>JeSI1*B2`D z?L0A~u2Vqy7=DqN&(xYu;K`$OY@B&YG@E*c%+SZl86I0N2`h~sZoIT)GsoaO)A+l; zGLLsyRJt?6TcwOHP1amXM^UbC^K~?z?ma;_Gv685rU*_eza<4J@)@qRUDw5f6U;&| zzW7%XS=C46`b};mSxQ6|j;W#XZz$Kt2UuI28B(Q)J_OSN1J`3261!-v`z0orA>C4o z%cKpg)UvmUx&OTy)y+`5`P`B)$`PkCvm=P$QW#o3hEwMX$kBVPEJ4ti{&BQz+^eKL z9o$#%^Ah`I&yU955E`*0X`{dXi60ER{N^Oujgu$QsD#lI3JSj+o{a#e>H-{lS{jQolzq zqPw*)^~7}>_oY56g|L1VC=6{;t+LGFQI4H^p*EFMkBCVk7!;#^jjx1p=f zn6l)gPy}!8>d^Azo_qsQBLezMW=l1T%x7QXn)0CWTD$jfr>}c)TfCqGta4jsQ=I-A zo?E+6Wy}lc7cq%zrpSa$+xnfU&Z+Z~#JJoNC29a+>(;q92GOqK1|oO&Si&W)YZ%EExVUmm5-RFayJeS`ELO(n^{J|dAGrvCDt2czQ zTdG~(iZu$OC7{DV!E)H!nN{mRt=Y!`sXcB3k?PKZxa#`$XdW5w%SI0qFWlDR_#PW$ z=mV{2b4iIF4PM7*Z=%^2B?RY!d5ZIG{bv(#=kFnNaz+z}x0gcdw$|HG<1H8 z3bK%w_)VHZl`kdQx&s{s_slxtS#T~AN%`z0rafVaJh*|?LS-?=|43lM6?~^SvBnFJ z{UJAe5WmDqe=~a+EPyHhM+udWX16jvq$-OOoN5M-Twkj0l+eNUFRy%#Slz=jYolZR zQD5&;P>+3FvVOEjF<-z#KVq3c(WU(4!wUU!4Th;&0SZMhwy--wv$@aSix-pYkX`}_i1glTK$?_5LJ5QXCC4tP} zoO6_SyyG2Qf4MnY@BefF;*bjG!f?%RqRy*)z^rhIoMRe{MN{^c1U8J5Fm+@-xs3)g zxgU(8GpU>jROpXac7U(0&JegnV6|IrGvy%uSuw1LIK$SVv^%EF=etY`84aH0L&KKn z4&pmM^`|jx*AU`@-ZHk>)A$Dra^05Uu71hxHDWG%KxUNtxt#VL&ak6zY=%<{JN*;w zZmrASvNj~QBm4A>v*vL8}U7{W&3s$N2n|Zs>vR zv_%;s@2z5SzOl~ZJY&!$6K|%@hh^pw${nLS$`1_2hl7fjYPhWV0{5cQA*~T-7QgbJ zSw#~+wxaM;yr&1bs#g;zG zr40tmmbF1UBNJMhr{u?28#8{Siz+bh+tD1NG zoD^Rx&(!NeG{%CEqEn3jEQ$S~sV)HvVbGjCt zSn#xEI(zQkj_^Nrc|XFtfY#bY)OD0Tw8<$V6@JF>==OX5XIgP^GZe{%_Q}|iUv3L&;WpSqV zMlqkBo|J`dG=`N<^7#|UE&_hlNUPvctl{-fre$d7%4R*pq^_>~-#sc=<23T5L?1d? zs;tr}kviK}97iJ1Elb<)hw<0(T6`Vt@iT!QQKc|C4A%B|FSO|v3ZK|>e$Rs|ME045 zER4Y7>?ZD4WkwS39lLVS5X$a*-bB;WvtkV~c^`SDzIR3ZJ~db<22&iAO1n_b9)t0U zUQ@12$YO($9WFVKLF}3u6Q2N&nR623T$RK4x0%dB$8Rr+7Z&wROY8uk-M8$8BUOJ# z@lWOkEjC1qhb!o@GxZrIr4|I;Njx)+Dezm%j8u+eSKjZdC8$zD*_AK3vDW9p+-B-~ zK4aena`8deHXAgU`ULRwyE7_#3jLJ;&Im``N>?LPc6%VdZ45osy<^JL=7}9d+LDt7 zAcy-!Pb(JhoV{7OYe4XX$W}lq0}^n?-l(=>M#Zh=ObKsH-6Nrc-vOV~*%$&C{kYO> zX15SmT6X}V$EMywy#PFwG~CO)yGyNWyog{%=~S0}*Tx%Ca5&@3xKhvMzG=%K9n1ca z?Ri=>82giH!{~?tf!PJT%0~LkXwV!jE>X>Y|HYAmYR13!e$U7#8Q;D9bBBQ zKau3Cn<$2;aIco~OnS|b@tt$cngP;$sw(b3wSdF7G+6#=mBgq(*=su=FwArScjzoL z`H}CWEZ{K%eg1CYyb9r#)Xj3oSzlXD`)(`Lu__mu`am&e<32AKP&F8K`)ROrNc{E- z$v%5Z4W>C1go(VTRkphZ7vFY@9eE|cx;($Hd3eHw?1}U?7zpA#4gc{id@(19GK)5; z^@tMU54y$3HZ?T5WBG=bH)nUA7DqHu#(h11OVU5AD&EvbuX0-cO{xfG)Yr%Jn%%Tw=%XA= zpcf`ojIojSG-S9ll6xNt1w%BI{R3Ux=qHabC5J&Osk3DFi?x>Bq`o5bds9oB*d|HC zFR`+4)-#u(Bt7eju-0M!@0plvrp`K8$XZyns%O2>GAEySa>z9Q(0mgl_6X)62YIS5 zN1L}FLR(U}=9gB}$$&#!7aHx=8jkwEo3{5DM6Z{SFc`~VQv?iu6)M+WiSnN8uD{;b zsz0x`RfNJnhA5WCzr!hHs^KbaD+4>ri|1FBMt}ar4x=nQjF$_#CFmZwKbZCQ~}e(1+G%sb5lQZOIl4lvdBGyDl=DI9si8v%n(=o`U}?j-<90| zd&Y5pl35BhZO4b9GdrS}ZLj~(CB>F}vy{X(I?6j<@id(OnLffZ6Hl+3;OWLmGhv%q4 zYrer^7(aAjQURUn*G?a9w%$+()OHIat^~7+41`4EH=Eh#W-3NTrez;{! z=yHWN{SWD5rd1pJ(w8WWVSEu5H%64@g;J87cm#?K7Co7n`s`gu^>|d8CyeonU5h13 z%14Ut(9EP|$uw|y`BY9SJcXd8Oq}GjN#obu0y7wInjE{9 z`TX4$Ah-(Ev{=3#T}OFOZzME$Qb76>%}-f4g<_RqB_6B|MrL~!=qVqrai*|Bg9EPz zn<9C7oVQqYMMP^%wpz7P6$Os9`_;r zUhnWVDUpNYD@)I<;G;XM#c#kT$flBmDhJ;=8lRSpyzsF$?cvrBdRs)WW&tHnQ zQQ8arSMCX={)j}YuvepBLM#TX!w@#qQ^7J~3HhaYY$JluK| z0E+96ugVVDfB0hg zp(@Z2%)ac&;QsFEk0C5APC5&b$SyQwm-rOlsl81E>Y!h%E%CU4EbDR|IYNOPIJ0U8 z#v6PN4EkAUumvWDlgJw?XgpRtl#vyuoff#8P)EWXM)I?zQwA8;?JHL=Bw2kQB`j0& z^DjfaER>uhfMB3Oo+C3;)GK<|b)TEUoyS$v#4nLvE>VOgS-9tfG1c2na_cxr@yor?f5TC9!m$z1nv#JJA&Qzm5?{7RCa@6E_~9@UuweR0BCG&}jCluxz& zV+@y}pw8Zd5mSH18SJNd9h?E8;zX+Vo;t%!KY6gJ{(>Yi{83yWYdU7C0)EEMB^&X` z)q`mIv~g>FvMT=kRHs7id!C(_q{5k963+!#;~dc~{NVj7Y*^w&RG_bFS%v-8TE|(f z^^u$<0Gh0lI1yam>6e?3&z~;Y<*8A4_KTBxbeHmst_L54va7^IDig=5!YKWa<0WhO z-4l;|dU!knL9iUAdt{egZozCN`Jm^?PyB}F;b=kak6fk!!pqJIJZn^Rj%cUoq7r~5 zf$^4E6R2Fz!FV=4|NS?GKYW#Pxc3#jF@^90J_=zebBbA(Lmi8jSN^TirM=-lIMpnT zPyE@j+(VVgTL?@J5a5}%e94kxGFzLC26JEs`7e&%1YyBy8o+FncW6qqaJ#A{e&ywv zCza7(H8m3bVBa->$wc-hat}j7Ts9V)A{8%#s~4_SnL|S~a)zTQN_K+g-8RV{q>ZM? z@1>(*03vxUsT^T>iH)hx8Qv|UR*ChY81Hb46_hb5qd7saZ-$P%6Vc`Q)|vOJS+K*` zz#y)xkduee{Uga+S9F z=u2Dq-~=z`bnHY$_&a_D`Q^#%(lGWftUO28UeGV^zyk(!gQBYNO5QVP!4-i7fsrt2 zG4ndt+p*{hPqy0TP<&I!a=fu$&D2KKqYFb5N4!JPIl9gUF0IF5ibxy6PRa zb%>TpruBXurYd_O&bq`%6ju{1Zq{EvAi0~7^&=S9(IFco=jE^=aUYzzSp8Q^0oU$9 z#0I$hJj!T@J0s|eDr4@tGn^DpmYGin)>P=JvOlPmHgVK{jssz2lB&~J)?yOMD$s^ zwpafdOb>2IJoefm-Fx$mvJT=j7k~ie{^F*mTDdW*l^aXrFLORk7gl377_nmZu)CVP zGYYxGsW&_QsGl;PlMp9*)BF0i3nKlVg1Bj*vRzDFN)Pc2up)Eqxwq(*=Z#=AL>Cv^ zx*!-)G5#@eHjIBW4B&(Iaf_eDBt6om>)lzoZ0(QI;zFw?Zns3H9W(GoXyno2hKHdG z^XxO*O?EWI36t7I_$@tu05lspl+>^U5!6*$o-;6K>0<*2;CR2S_E!E|6W_RwFlD6q zO@LF2SDI}KM85CTgK^^=(ZIbKlv=zgj^j}c+EnLit6553Z0&pZgI;!W;8kP{Xu*te zz&=j{2eys9m$Ymi5uclS09mMO;Z!X~+Ff-qyL>fp>}$L_B)DI|rygP(TvOlIhq9cm zioYb~Q#Uw~Vv)%zi<9Y9BqeLPiU%%_%#h!{Jn*}HE$Kkx6{A1(b`3&dt}+ugH^-ln z*2$mWVEFbw!nx3#h}QZwx@94)wgXbSH0HPH@mb$y>lt)eD!OEMeS$%p zgIf1cORqmDeML?|E9pYE@@&flK!i}AYR)}3zZ6D4F8$ghblg)!I@nZl!(K2D#VKxj z4vz{#&O}nmD1oGVRZfo)1Ok_7j5C68TV~qlJpSD6%jT3ZS26qjf||0Hu%P-2bubWf zB+I#5tPEI|_Q)&kOAjrc#h(}ib-wwBM^=edGu`BgR(Uk+Ja270KQ3EzvgJL$cvBeC z?y<&yt|)<%pe67z1W{hFcbC+cmnYA?eDlKEuR8D}00(O0LaoPlG*m;UrT0)W-8xE2 zDfh-EzAY+~)^^h@WX)T2H#0UIM*!}=WOM_HLN(AU;EW)2RjDADGTavidfyt1a1Q}R2{ z!(@OT+qV3err__l5zd|>pG%h{&5K`4co@2?mgKw=D10ul8J@y?aPSkoseH<~xMC%} zQTdc1zG>SDSin`!sghP7X4bJvho8>%IV8(xjTneB~x&5#F3?UoaCW3@J{Qgtc%j`Orzm_fjXv{#K`kVw)8~ye>4oB65 zxthi=K4kjA{?E(O?q9MGST$rt!;>Oo5pV^7*VP^@pW+7&=nI7|kA^rFdXD_>ActCC z4_d3XtmRj9ZFERzJq{{86zg6VbiC^IVCZoEmWI7{=aV_$km>3F&tVr5WQB^m@oI1)I7O^twjP0V|DYSZ+p z2SC}O8wji1k@qyj;1(>%ybe;~*bn5u>SF#oNX?s-D7BV|GhD_$K8B0Oxc3~qFBXR& zjBAU_QhPZ~9Y9&Yezb7CwmU^ZpBg74RhsMHmGrmdVc$95rEsv_8qMK7@X9oHTUlJm zoP*@}Y;E3ou8IfZNg5GK2j73}0reE&cvH8iVsve-UJ-|dT$N4@-SW;DNJ6vn^9Q^K zA>Ly?(cR~k5HbOu94Za$dh8wy*XOd1FVHP}&JxKhsXZ;u$9NWs8mDI+8-iIu*6+H*>=hIf{ba4HG>Ph21dRG8E|exC5&tyF zs%=z@P`k*yT!r|D?DBs{B>s0vBSy2qIvpSK#_5)b#7y~-rxX4*B$5T0Srv$` z0h35Kg)Da0#%o2uVUh*rdpr=n9uSm*{_;1ZEk^j^tTg&eX&iAN!S~f1xxqhcIKxu_{+^w^*^bN@v_mU08=d*E^KoHm2 zB{hSuagRS}&vYUCm?LQ$a&TGS*!Ml=cBKzZJ>L*^f{8!y0@Xvmmz}uU<^`MCEUFq; z{@5H?%)chguKeNXgAsQyxl*(VrOA&+QGylm`^*y;00bPVIOjrGQgPaX;?jV~MO&vh zd;Cce{k;Y#>G5GDFVs%ZNBcnUA`DSf5u5WN#FVQ@yoY66ew&$g^U8`a_ohL=^bdu) zl}?pa-e1^^=`oG^q0j5lDCiIL8wda;!?VNSOOBMNCto?bZE5@|B|N<4(-iAhvPJT4fT={Vy(y@(z6 zyAKig%Jp|S%$^6^Lvh;i#vsN-ww{LsvbVl8RUU}HRyl1aqSWm?Q;n^eCK*;ZTqKWT z`49D?nYANTHedMDUfeEy1f%ggV-dj7S@qk^9P&|A3wSI;r>L{{^7&q@U1Pw~yME)9AdKrjYh^ z@i>UnO#*G+QTr*R{-R|~XP4-J*LRs`e^c^uQw)3-d0wHB@1Y)`?B66XUhO4bNatR_ zPnqKdj+OOINh#D@<&FMm-^fXL!w&pvfAD@l5@QAh8`Rr|;}uX5Irf1M88;&B0}V@gMO@o76u%gJ@NQ5yR;0LEOBbJ{?C+;vEWW+e zTa}Z}0=#Q6H;ae(%Y{idhI}+LEr-y%*htR(~E3ht;D5Sr#v2xTP2+xNiG{gw&$YC&L`KaSl{9K#mM*% z_|&D);9gY--1SP#^zD1YNp6gOtQ)HX72$P+pGImfFIWEI;N7FfUMquEMXYM+6`jxO zz&ugSVpAn|Mlo@t$}a0WAV)0T7P|wKslwJxcJT-Us9^0jNHWAluKQBRyU|Xl`~Zqj zYJdiqwwU0Fq2g(iQZ|%b1x%Mb0(kvWFr@M>@ObB2r7rC_aw!&%M>kD!8aashMK}TG zK}dk2o5h~X*J3rC{~E&Rf>9aY{=%T{VyAd($LAFRlWsv+!Y4=4X4D-54o7*ezWyi0easJqvLCc-#RzL(=Lb*+>Sl=eDVWyn- zNt7Ch$`hdhgu}R-FCkWcLFmpI-Xk(2=oL>-|GlU?i&<$0=iE$T8ocr2eycI})NYeD zc;?6eO=vyso#7y9VNYc>{MDWAn8b)TbzK~G+ZLsi=iIH?88K>4gHb{q5Cp46=`dD* z12#hcaRg)x{%~n%=9W*eWUr!0pns1+6hx(O-p&ocNA2TF$y^u={!Y+l9?oUF%@ZVc z#p~NYvrKJluK=JS2ZW6B)%=RvYh@U|tB;e)WV#;}bE7?zmPE&+qN-&(P4Em#!(awz^&!H{MD6Vm;aj~#Qx zgPS$RVFpp(TUiv62{<8z+gwZ{Q{Cwx96ku*@yOebux=NZTDsBdv8IzEUn~9k%9F3b zsy#QJSSsg;>pRHUd|2*eaYk-O_%}Y&8;AAf>N;~1`bmvG|7H+8_wx}tt;!GLwJRuk znJHCeibKph!dB;ourGcm`$bR6C?{DVL0M_rp2b)9^_k_-;$r`&77qzMmhVP?JgbK> zBFl=nX~`!;*gy%0Qq^APyRD9uZFV3M>_`0Tiuz1vcDov=rDF(katJ75NaS4{1x&lZW+9W<&dj z?w4_-?xP=eHX0OM+a328x1FW?D-PcErWd*KY`R28Vdt;3acM{xn2j#lCh)14eI1+$ z)hEF2JZ0VeWynUdf*HYB^@+|5+KpPtL8DX$wo)mmRpx0FsV2AyADnNLVz{ zd`Z%UNNh#&db?$%qOZjSUKwZ427H&a>(n*U(D`FZ;8PxhGg%$vZ_lmhs@4Is?_-iP zA@^~a2HkSm-QOZFP|Lg7R8u}3n|*GLx{ivWboXwb8jJRiTLW>|4Yg@;v9TtLs|7HY z+oKH>fZm$u!Hk8e@uhpOoRQzI@hJaj@F*3zU=Lu``PC!Tc3zc{sCZTC7awpap`rf{ z`H55QrgPLL|Gxski1KEULw&94Uw(r!NL}muhXR0u0Q+lulVyjk$-7KzN3Zt+3_F(R zp7O@_zV}N_qdLDGJA+Dx1Y`tbq4RaK;46?4W5j{qN1I)oanf#C;i?}1w#=z6&vvl# zz0F2-C8LqcqB%`e#9X`(YKUcj2(XjTje-8qOV_M80*b9@fpze2MY9c6C|x+ zT8UD^inrdAyfA>8V%ZTREJvzxLQPns_B+!kr%ogHK5AO_XEZC*P+c{G+(6GxB~M1q zq$xvdjs3!tKC)mHU5RzA)O*%~*s=aa^n0 z)=^Wft+chm+YaWmzn4XQl+NL+5*@AK*-)|WIb8!}c{;M35hbt_J&OENIo?w6eGqib z+ApP1jPfvptyn6ZdkR1Wn;5r#fV2A5`w@15Wzfdd;1Pw&Qq+^=8e&5O-M3lU0j(E+ zfcPexy&>U0xshKs;QzezU7%Wn6?{rKn|HWwSQlK?2@)AI9(Eoj8CGN<4>OVFUY2Iw zUyL_dRk_kFfgG^(g@~kVqGVqkBq;e;GJi!5G36R<1NlyIbWv4mvE7FME3Oxk07=5NaX*LITCd&)DM4JfHZJN$TVVpQp{GPy%ss@B@$Nq3$M zB$4m4xu}&?t|Yfc@Cv2Kdww)k@@M4U8lEd3?ES0zYS8!NVVa#FldAMrz@m??eF2V(Io+Fk8Tu9icevDCTzN;L-w3s{gPPm%@b>o6wn!i4 zwr|)Q9^E%ZkavxWi0d&Ab>cu=W%yVOzJD}9#<7-~p{51Rs)ISxcR~@hWnl1h+Z&(-OOAa5+|ksr+8YTj$qWB+X;X$^m-?ZdfRu$=t(c#uQe& z`c`0%0-RNR5M>E@P@PJu;*}7m1y=DMjDV_Wtl_y8w2m!4(h|`toBZaWu&g(>Ih>1W zX{3B`x*P31YJ3rNL~WU<@JnkrRnKCjQ(9aP9oyq$kOH76COhewOt&fpu$#EtH8K!X z)Xn{3iu<(0Kra8K@r2d$paEu|JT1|$?}ZlQ5Yo|-VgkX}e+~fu+gk*GfR5U$dmh)# zF$3~k4`F$r1%d8|bo74Ofse_tcLzUivUh5Vvu+Q9;NPBe7YN2k*&C=(#&s`7^V@}j=+A|B*cVP(}za9Bj{{3<7gLs`FUFb&${Y)RN! zM5K{38%u#gO=xl8F5yy*$eF%kR)EG-xs0QweGulY5rM`)`7vQrnxq7(v_sAz&z>)% zFZ-Cj1Pm-BQmE?>JBV@wk9DY~^&B(4I$t;c=HiK6R9VvK6GkFfP8UN`Zx?Z@=lZ6KhNg zLznf44&B$FftFcyFO+JE$6-)#(r4*G;1c{o-|euP( zEt4bTcAp%v{N%kv;DS$Ww@CCDCCCfhU?lqC)XgvdndO!e0JdoQCz_tK=s~9&^#Y}1 zqJyAzJqdhnZEB@>Q-6XvwJO9cUi%#js%Fw6^;Wr&&QxY>|CQZZ6H2Q}d$sHQyovFB z>zBQ2PE0)tlp6`M&Z!H`pg@iD95HCE6}s%{SliMm4!;E`KC`{PJHw+3ss30^4}|As znPAgVFHiuy+ncK7c$m-|?1A6+PxG7B@U~hjk4TXpee*Pu4`rfC$PQe)L5mCH^LxFv6RHG7KBHfD z260&i_n0TC$#b;x#SsXByr(kT;KABAiUzAfZoTcKb`mrmlgB5@blV~AhA-F5ZFL$8 z?hVxx*YDN>E>FF53h-5_OCZD*Nu)*g93$C>X4(Nw0qsrfDjD#` zkvd;@!gd-gex%5VROxao0F){rtR)&;h4+tb(taA_dL=X7&s;5hYR2tOu6?)Gca>8wtiE{P4mikC~a?18|)NEo&%gv zv-{RSMu4ZXA()o8Etr;mAul)8)SUSqLtieRfSRB$UNz5!vLf#K z*y}t!nTK?&=GdP-x%YPg#$Fu0QwS_QPq6QfG&0^9NtSuiBAlCiC6tkkWfg$W6F_$@U_x1PkbuyDMwc~Q(Wg;JBzAvOi#V$&x`=i>jgswEv|$~ zeXa2+_v(7c$9yBv#1cg5TL2GO{{s*F{u2~P2xd?Be!5X|wZ%qh{C>Zw{W*FvXg!6d z`y|OYW^n0_{_IT?=Q8#wvFWRJ1f`UUV#X|p`%Wx~yYDDS7Z{g3dui-Nh?Vf)UHkFm zGmYQ6$7&ujE(DN0alI9iP4$Oe+Oy-W&&aP2J+v6qmTkAIVq{GPC??Y)Anq7Ni{nw= z{Bp|;^yeJy+&c1dNtM9MNck8D3<&G0n*{k!Gx$afyaS82IP{#x&%e)tZP+f71y?aQ zZ}HnP=dY)cSO@}7?9u}|BMbA00R~IB2U;vc*;u~V&rxgRy+MS6t~8{;03TrB?A9zTg5JHz)9m^a74|~8say7WFbs!9a@G7` zu5Nq~8LcAGZi!%bmS*U)pW)C|G^N%&Y^Upd_Z}GlOI#=A@JW$qb09}v%N1&mGh&Og z>P}=>viq?QSObelO1<`N=%#uf-}JaOwtgX)emBy1n+k$}mIzSIeku%hI6awK!X2VN z@BPX*-e8)nKYK9fpAa-vedN~aY^yHO_0jly7Tn@~@+s!ukIcbS3duS5K@u>PIFZ2D zgq3}%a-K0|WIcUJGhQ^-b-u-tp=Z=eJ8>4Fo2D#w7g=`2`0IUYSEj)ax)FEBU&$_l zp?mQ2=Wn?q+HLZOoc}9#}CEJ=h0O#ESv-@5MD<=b;7?K!J5@z0rcqoL4@G z-;U($Zb`E!C@hSDnZN-I5#4DQvoHbjvXC4hs&&{NXjg?;-G4>p=>7ibPJeTFkB0co zUOP82GV2q&Wj(_;-p5|0O#Ts8Q`{xtBYyZ6pHa3@RmJr(Ck*8p<&8 zDJ_nNMjlFJAE>oM!TwfOt z>12QM77m^lUN%R`d*vsw;HXLZ0hve;7I!t67Sc|9UANC9|N!g)64G3)w}_Tp~>y$)qV-ja;hcHx%e>%%=x!MwdUJD<#X~FS{eU;zmQW)qPuN7?lb^2H18wwK!MfsE;$JzRU>%noM zN$PM&g@UKUv2BZw|K4%%n5gK`|MP{_$P80QVD+c%;tP2JiVBD{O>)8K%}RAiIwtNV zLyygOur@9+ z?4%gBzP$MpdaGW2#Av0b zJNo(<-G%~8o6!$p4i>Nakn65xx~|gIE1`8ts)c-_>oza_Kcf}$zP9QV7OnxElAHt7 zGxC3ZO#jny`R9Ex=Z&3;mtJPJMXQ3=e2=i;(l+E<1O; z{s$H21Q3La=C4UFV*N*mm&~r3bY)O9tCidu3Uu4oo06M0q#( zuFBPK+>4@R0a+fs2}hx8*Kf}_d5+$vI`07Z@7|byy)WG-&$j}26#Z(B0oU-AJ?{d+%kCzyo2@zz{{Bo~_6rS@QU@wO`kl$+lA%kQJxp&K z$K2air2(_3nD%wkpB*uQ51{12NVH)zYfpGOtuAlqe`Rhuanx>94JZ;sZD&aRvTjm= zAty!RI`?bbQ8&zcV?9t39ZRApdi9y6qdi^<2uw!@&@*)2pApdeLzNu@!vpSRRJB@g z#$?s42E919@sXm*yJ#6l4Y^qNU;D@t(lDnUZqYuc?pb;Quzin+g#MW$?OSGW15y;l z<2TSnsMVE$2R(N*qO4AKXF*$ayiWX*fKuh)04h6iKxHStA>X_=daS@WE@9eqv$QrY z_A&4!G@WPvAjG2ju(tCbI#iwWewwVz|1eql_Vj)Kyl+dKjN|A>J&@ceX#KiAs^?EW zsq}aQf<^(7koJvUUP`*KD;fN~;}L^@cGhj?=+wdIl3kVczeCl_j@phQGNtTC3g1YU z1yHZ>%HcvUgQcaOgmu$4!*$N0B|4FPPF+jIIwWZ46w{vR+~4WMX6a1(-|+z?MIdG=@WlBTq&Orti{1pP3g16w?m=d zM;><2fA8u3`(ubQ(^2g|JhJyQsY;)l*N(oNu(vbwp2|Jk6Vq)}`2nQrQJ}ft9#yQ! z<`!L|Z{X~6Lg}-Y%&FqGBKrX)T{xbEnTmY4R`T_dtOA!4e`vy_OhVqSt{%+1v1F{= z^WHu@%=}W?5P!q+C3C(rDyOL2ZaDwGY{WkoR5ip>Grle3B{Qnab+KlE(^xvF4uI4?Vsi&Dj!qM|@2Tvwwvl$Wq5rpWbGotj>H9OyGmtf1wu_f?ZsZN}|&aLybBww8} z45Dz6?pf~S$)fSqBbr9RDk$hVJzXC^i>JFG6OW8-oBkyfC?{qeb|c%QJ+aVK%XTSl zruDXt;Y48(a#&M*T}yM!ap##vQa2uJE_u&z;xhPe$?OBOSB!?%0S`Rwd&P>ZbISX9 zQzN?-gKQ=8_|ybyISSf^-KQ`ddBL9E8O~qv*;~U!N(Egi7m-3oaqU<<*#?|uC!bkQlbE|$*@$@x7KZ~3rn#BQJIawmTc9c6qmr0 zjUF89pTayVsmj84j*N03-*!(-6q%-$w(U&R7L_xMSe-Ju8^JK~ z_5UNt>Zbq2Jgx5*$NGd_VHwy|O_jkrPevuFYL+8)L@fa%!$zxSxKx!_fh=QM;^`*Z zm0HsRAu$xbRbtS{wl^A(Xv;K`EJ}Hw?|9MTeie8B$qRpb3#t1p@aC6V@QW`*8e`^1 zl>;X7(8MzlL!h!-W0qiXmOvW1O4*AQO&??bRG;dDPh6ETjw-u!y|8Gwy9Zz9S2|$z ztiCAqYdHg9&>s76kj_ExVozndxf9aR)RmP4RAo!!3fxmUKR7-8DU(rQy*hFpP+HTn zB1U@klJb&5iza{!=7&i3<*HhfFEImx`r;Z!!P+e#azH?KX@J0+JUjm2ACI!^svTDrYd@Bp1q=m67)S5|sARc)hC=Qk(4Vh=@&WoWXZ z3xvNJdwdz3hANK9cINUQr<8}JSNbb z7X8yQVX>&Ic<^MnKMwNq$DmN?m`N?bh#>2a7G>^lX z@cQk_#t(g5F3=!y5`HT4B?V=O7+$b>!_nhf+g%h_)-LDIt6*R&`E^=Pyri7H`ukuw zIe1;dG7-A4l^0pmrT?T!`R6~1oqbME(bW5Pfv?YLJ*qU7biuPckh7W(sDSrdp5HD3 zLm}IT){{O7!-4N=`p)-o>v`-4lP@d}_)$VI4=wA6e`}VY;gl5uP-kvHWB?DXiO6oqo3rJr%GXDKzoXkmJ z2~THt53m{hdLp%T?=66?b%}A4vJ5&ayQqU`q!eTu@{>T{2egnS=H``Y3zpJUcfZOI z4$bhR4fQPrzfR@Ynzm~y3|cS9vdhlitq&m{>V5Nr{nNMOyT0Tv;dK+Nby0ovSsShCS&KP`6&WLA$al&Vu;j!o|B( zEmoj-TmiIn37v`b!{=#NH=P~mx39%#Wiw<c6$P?6|M zI`rq_rym4>-)nk#?y^bG!lT=^%qf+%yyrm#616v+2qz6X-1a(I5U=+$;gj}N(}@@4 z<`X(&f{B^$Se9C@xXH+ol0r>-R@*g_LUzDWmMBf1Anh?sJUS60qlvcrrNN$G9#uFD z>>`lQwMqdeIlm9zM>iqrpd|Uc_Y2=Dck!KRpG^+q?U}SJv3sQP)uJFl7o~Y~wsuXp z?xX6-BKULi=Xk@3g;n(gQBKozLY}HVNEpI(-`)F@{Q_BH-=WL-1tk0L1?m=7Kyp^n zv0vuhaOXoqRm)Tf2{qZ!yGs5hQBBg`k>8zLN4bjQE2kCFM;Um+=4NRMI@0qbHDB;r+ukT8>r5$5Hif`(srxJkE z7|^3ecfz9SD!#UX(`BcXcfBpMwJS|yxP?u;ud6B<0|og3f`!CTE*+6t*m;>MzFC}E zEaU+qnH!gCrMW`@>r7*^(lJ{*NoJs9UDkejiVR(S9|nj(|1FC7fBh4nnKo`CR0-Lw zlOmvpFT2#D{e;2nE(j+DE`t59XL!PsFg%#eezl^(Lc|0Tblo(vxyqU!rmdK*eN}HF z;8$?RoUT2lgrHHV|6b4v3}3=T0%}=74qk zb#O!)Ef53lR+)@zL>Kwi%js4BTMLxHe@e2eUa37m3>n0m92HtXyxt zR_&hCFfv)mPO+VBrfTsY2@5F9`}B0Rp*1I}xO`>YwZK|~d8&8s$&Wz9fZv2G?_|{^ zzLiIkt8~y#Y<;RazM{B)fb&D`7ly1{)B1K$blIKC-eChwihm|ZXeGN&k3cl}f!^^2 z%ZDfXC_=gRqp*P%vWl!Gr??j-vioC>Mq};oJs;XbCk_LtKD`N8Mcft7dpw{=N8PRE zkd=pR9o-Rd*UI`?J#S0lrer$y<*1%L@5GHshD`Y({*eeL`Nl*OOe2Iq>tlxTInG%#6wV*Z- z(ZyYP_An?oKFH6{x5y?L6sa?FNxcx3yz_haf+oc8TptX|WIH>jYt{AXtcdac5nej& zztb~nYmwm&o>9@t_lGs^L`4{t?>&ZeD?6ahWvj&r@ks{JSoSnbw!M%P&kI{FLjiTvv;@`?*{?Ua^QvA;T9_=N_%99?8ywjnICux^yL&;WjYHD z=4hXPjbIDlEEAy`%Q*kPqZ z`^6Pj)8qc@68^oZ36kzTgl?!9HlQE?O#gWZ#{OEEc*NA*o zq%m|{z}mOJdf@R?YJzFX;j%fme2sEL*L#m|2Kti%0zxley!kjbXY1K}{l6Dsc@j2{ zTt)KhQA?T8`F0{E!^+MQ>7Dq~mLE2aB?;4*?s=3 zfVUsQBVR8z^XTT0$@54qOZF4RE%>Ze{^B^+gUhwuz3j4m%opU755GI3Fw$iebQlt} zK0G@lQ~xI;wLIQ5Ec-4=Vhz&9n8oY*vN`TDha6nEKgUSS_{Mw%HccaTzIfI zo4LA;oa?21-sU_wTz=2&``%{fQ1PkC+v;*xEgx0#Y+J|eTILI8|81#-h0kId!KXmGX1|WPc-@CB>3@_$C%B_ZG#pf+IpL- z$B@JuYQUd9`c|Ll&Dvxwl@{F`Cq@zdc_-r#omTQ7_RsqQV?=UdfE*Ktxo08t29(l3RQ}8~44h>JORSV)yq-<%@4m z$`jGV$A?vXggW&f_BFfU@kymvZ8$}XS4 z#=EF&L+p}B8^K3eImSO0m44senrGnDeF@8)7&z_D1{jJ{bBrL~_;xBJb5h!Ide}E) z?SNmr5j+74RXqNZr6GKY-R&Olc z;=-|OlrnVEtjMeI{g4&z2rIz6b*MX}b6;l0?gmT8!tDDQ;Yp4`fvq=XOo+He;S_9a zdkt|c`%w=681i3S?j`EuDT@i+V8i*iWpfB4=)M+|PFg*|J|PX$3a5#6+oe(zy_4Ha z6D9MuecqL?O!jUORUvzy5Qt@?@?tmBS6WysTNuit@8&0;&Dd@!X?_xF9X0y_O;zUT;EAhg}mYVU_wZ`LajAk;n=MKEuLyTIPHH|>con0PkS_bX{pz=Y3I9TpLOR8?He2hW{hk0iIsujk}z@vrs*Yx=W(X7m-y9L#rb%xmF{iz-Iz5#|2xfrG0 zp0O#(hNoD2R_bF`8>Dpf@Edr!4+1HWccOGZcRXLP*j}&RI2-7`eE#3O+!v=hz%C6- zBIP9k65??A7$j!yMi29G26$4K=#2#WK4!TE`;aE4ecQNf$Np#MWc!)UYFWDm&DzFh zN{Ps`ei2aj>)o2KDZ}f(YN6uPKA)pAjn;4ybjbLCbd(!J>-sjUzA9w>jf=O4WcEc*W1j zuXrgE#y6x8%CRT*_29K)U67W;E1Km)c^yN2P8PqE8s$aYnY2Dfk*=|7w zTHqz0ztT=Eh$P`LBz|rQ(nQiaa`xtLgO5K>9LCj;I0eUo`J7#k_gd7*v*$BG?%SI0 zNs4h+^72n}Q=qbSIdEXoF@&Yx>g%T!FH~_Gn^KJV_{2#*0y*Hwtyf@lN#Ik8*|?xq zQP2&e@Et^gb5y?&#}W@po7uYfP$_R#du{@IN)nr5yrng11K}QeuHR4P&N!TgL`urn zbmLwtLOC4_%MHJ9^ju+)$`c{nh&4T1pyQCvf!|_g1V)`kH&yzGw_hOZq)=y|5B|g6 z@&Ei=Wb)%bCKM{Vb=2y}4P2Ye@?Wf(j$l z8v}B=A8o1p2p?rgi04YXFxjePW75REuEDDyhN36}W^T%ZfBrk49MBx_+nMMv=ntyH zICN-fo51gA%iajn|XR?eD$o_HNywu@m((J zR_wA)qR?sm+zN)lsXbiD*gLcqWze|#0($eOY4DR$k8il8`66^)iLp~%+cPdq1prau z`C^>SvX5}oQ3{uR5+K1ae`o%b;>)d^EKv{O0~$QxPK z1tFwh6aJOHURr9Ng_rjC0V6UId}exER{9u)oXO)gDlc!-$=Az-7{SE?51+RD(TkU!=6-DU+lPPCpeE-Q(9P zkPy8Bnpn{l+N>cq#>~!Mdru+&!sbtMo7f+N%csQ%C%Et0_`*kuX#Rd| zt$%j+1ri}5MVJ}JzaFFA;akCGQEKjUwuLRL+jt7(S|HsoWz&3YLyO2lpB39M+9>YP z8?58C?l5%+3r@viFJ3=4)XIn^x`CuQmc0{{%bpNG2KW(9@#&^xUGjT>ac#e0&|k@| z>NRZ|6dYqqDWzFWE9nMdR1dnZpD)sP^;Q+ZJXlAgiIXRDktJyXhpt_K{Lq(_W_s^T z`}JEs%BQK)R!WL^*UKQ+u{*uLbEj|YuS@2cV#+_rNEqZ(@TD7P*!pk%KKx(e1fQv0 z=w7B!O!^GIv=&;e$!#~lfH6GH-N7`*6zAfSUV2|GVSEwl7mB>5=9Zxq z)NWVTYuLQ)vsmE(EDx*d72~(GCInD+_sgYpX8X0we2zEPokf3Q&!hHnbxrMLJ|{(> z`1I>N@@)P8dXFtvw(Y#8vu7=ZTGofgzt2Y>6Sj)UhspHLE_^;`ZH3oNZbOqpOb~6; z^8=ZPE;PF5-K@J-rEAWt{h)j-bRx*saS?aVMGra%sHw2xUgI3Jd zxtbNSd>)lfwcE@JX-k?&^E>Vwd)XcKJ#CCr?6RfpA|75h*uy4;A9# z7@IHmig}6SrP+8A$RY?eh)__#?*l-8a!7r!TXC;UnT&t9#nh=fuSTRus>KzLZXGRm zI6PqxLUps<-o7nr8By36FyEE2ZIn6Y%zph>G}V1XE@7zFKLvcOOPF)b(Wm-ocyR9>!vIP`FF?=Fx(YSF^+|VGKj)K;{-)f4vY=rS`f>ZO zx~#mrMHsEYrvc!R0%V;4@QO zi#y0W?_4NqIX|r%@@O*2xQ(^YG>1%H7+ZbNo>L>P-|pGAbSZak%@vmhv65 z(8YVgJ&P}%K9{=ya{O%;4&{G=+3NlTCzpSny2&+0ni{+|G|y8fhZPf5W-amM4NkOx zH$>epox-TAn+8h3&~IIBn;o5QGuURN0!3;AOl?~*>pmT=z?Li~qsTy}fV>aMe%B0c zFM!|mKj`J_|4adetdc39v%HYr%b6jyNJKoCwT)FvK6j<>1Wym$a*LwNx!?BdPT~eh ze`aA_0b*4oX8V^Trjx%#PT+PgF7B>~ltEjtwI*zH-O~J~$y?o`c?l^@_716vw zf8FlBapJ_f+3s)*Vh~lt&Xtv5Ef*>WRp2X|Lo57xTDfgGdQEr8-=?idzbKe$f5$6y zDZ|idtRRoU23op@4A%L0x7H99ED@S^24NyF^#B^9kR_twq{bZ7p6!gM@efhe@}3fZ zkM3;$nvZgA>V#&m(e6j8x|;c}&87Mw^lJ;RQ}|BtoB7-$pWa0jyX3z(JtFz^Fp1QI zu2JOEi)tv!o04X7>0&=SAjAO6yUuawQd%2(cSYx^=L-IH!a&zv5TSXAif9(vg67!N zrnSzR4PyF{HIk&j*82`UaOo#*d8>0blszw#0@P4ZP`9+*plztkwhu*>rGgELTqZIx zwhz`mkI-4$5#DM!IN?O3=-ZQn`n*ALbFL+#pCu$!q|avf@mv(YR{ix82r2eU?^r=d z`6^|~^e;k+B=}6-V%Ur0RPX9vZ_cgJ?o=I?Czrjf3R6dP_6&`X*(-4azlPR2X~xnt zb;5(Eg*Gs=`*8Q5!@_o7v8IGxOV-sdcl8&J-RaLdAIecSX6Y7#kATdHC^waKp04U( z)waeOK=b9B68eSsccaPVm0LFWvZW)LTvnCBsjO0k{vqT)W$fDx&#NfWha^;~8w>YF z5T)2GC}aiU9yhRQ*lu z6#msJZ0G`<&nIGPgAil3397`rfnDH{zpIc{@Su5~4n|A`R1TCN*QHX?mV#)RsiBaG z9{2@0waENy>K=%eT-kT3gM80gSVuWXw!IT5U^T;-z1w7)&0H_#;>(lu`I20-vj62I zeswT0iDd^(4w$!0uPotbk!oN5I1g^3bdo65?=u)Qsp_y~l42@C}_)N;@GuQda%<5q65XW1s0OA%qBGHQV zU};eSZHj+*OC!&b@n|to>EAYMqj z(EL8SywXgLO>==#GzJ^>v^&nyL5Z_fUj8xj;%2w7Mh598ZR&29BH3SP1HYb^UJo`TV&GPn#0p8&Iw&}`o zmmC(Zoe1CoDEQIAOdr$lf43!iaC-Rp2WrhP&b@{w?aL^w^3c-6>@xd96`aT3wy%#U zfiS{e?9S2E`}rzZ`fR0-}uC z|0{4gA>4EMfPq8%l8c(9C~NJ_!NjYXlI&J-N7)$&m9WIU zsfK;2LY1x?l4LMfxN~Q!Oz%M;?gXtH=1_?!R@UtD3=nOe=yieoikh}>iTTRcmL)-c z-%!b_V1v2LRSD*dliv4AX#$dbQJuQv6MOm?_sO;O3e%(w5seFbyxiIzUQe?Gfl$&2;#JLxjBS*mRFaT-G*3c=SOfNUz*hcZHRaBX$DeFO|S{74g(u#}$ z0}!<`XoefQ{mx^4(JzyLFPA$*vm6;#A>Y*9;t#}tdArALyGGXERJV$Jj+A%y{@Cp6 z+|eMod<+rfYLZ5gK1MTok>6CUm4fWQ$oJFad|%G`P;&D2IS@hDZZNW!8aNr%CJ%_c zp(wSZZ@<{?7t0T7+?D^mZmG5Hn0>)Qom~BpMN5UKWVC{&=TCKOSc?(FP*5_hZ}-YW zOC$1ZQNoNJ793%Gw`mvk-)lq1Nj_ROiD>Um*#H+ePU8h=rMYxea!nEYQVg3i@TcUzf=oWH`0sHsI7>kxzn{>;Q*q44*R zm&*QQh^90MZR_&LBBdvYlA7?ufx{qOd+oM2>M%Rgww{$6M~Ym`EW5QpTLjc&KZ`Vj%Mp<>_l@$p;yjp%nHn4ze74W8r^D|oi|_KVaWta82osH#fG(73dJ^#vER~4DN*Hp`%Q!>rXwSW?j4{cf`^(}Vo zJyw{<^8J%e&^+U%b-CrCi3#BISahf2ss7_|{x81`xJ4$LHnZra6J`j2_flms16Ix~Xf1p+j zHOMMN1QeRP8C;oA zy8F#BDJo2JY?9xi2b`Ynig|VrMJa=z!F6Rjy`&Y{jC*wRmQ%83vp{eAJ9m|t zh)w1d2|xu088KO>q1yi;4`%iO!htLxNkr&nU(_M1z!9Ekv>@uTU5&0q{acz*FCBUB z4p~FAZLChL>iY*q6D2Bz!ww;NfmCor)nQN%fv zWr=QmWf4FGX6?y`-;DuQmxfOjz4k^i{O#PN2bhda@gAA#?^_nzBW7XcAA_6z#YKRE zpS8iA=EDZ1`f2IuQ7ZESa0%YEt=y;f(r}>cjFj!yzm&N$%odbw^NINFcEY)SA=;v` zbvuSj%q6-{3XFZT6@a3gpg>i36Pj&IF8L!mixWC1x@BuY{gkl_s$QDq_iZMLHX?M8 zRzf#fIj^wswMnU5_|q7R-@tV!rAp+|aX{M+QysR3I|`=A zhMkRtEG0e4IZv!Ixqm&UdR+`#(vPs9#jZyw?s(zXVl2T*Dc)`=l8=DM$!XsO4ww-2 z^@Cikg^fCVo}O7~X=jdJv4%@0)g_pZQ~Nf$<4*NPU0{sZ?%NJgs+&B~Cv!^r6tIL1 zI!p+^O&=#VRCwx&l7kw@?_g%+O+~U$p>)mhpac z%nX71xLf8rgY=w9ur4n;fu3~(axEGG8mWF;x-|JW(k0<<>5|m_=5Ohe)G_jpbV=Vv zyL0NsUyowzO~4MX@fB8;nt=}9ma7deo*T9M9bMuZw%4D3Lz?*TPf;T2sW%)(rmM+J>F|L-(^ZrFF{Qx$r%4+;YJIzc$OiKy z6xc=70eo`ou)xdqV*jJFq8*05yMkGp4I(`q(o(*MuEnF424w?7zyi86Q$2-m-z2H~ z%ja)5$b|Pfh=9WH5Z(a{hSn*s?Y?dmkG2sfF*s3JD5EZeV+-0PT0Dn;$Vohxp( z*}JP3t+G`Ha%Mk>)%$2!B%*CQIr8$x*f1rtAI5(2!hiGoOXpGb@8D9%R$UIkya|M1 z%_oYIni`o?_-_eJSrHnY-(aN0#t#D+mg|~?;rFD)uh%tQ%_OM~AqOIApI@B6qD1B8 zv3+!~Ij3olz>o8Huw@*v3qo|MW5K#tRTO@r3=4Lca1TyJ8o-}|y^5@rcDy}{pPrh& zBhw6DuU}dC9Z9nBEx0yM_rC_ZH4>=~*Dt)ADavzJXyY?7;o*$dj+7o$6>TilUL*&t z)T+7uYxA(e3KIjqP}AM-&?Iu_&;CdPvI6_p zQ0A<*mbaOYz<@%m{(~__#*&oxWz$(#?`Xv5^TlUhZF+Be7v`o<+E!1qAj_`!U$SfQ z(NEdc>8l@)7*DSHXTE9O-W9GaCN-}n62I9cy#Xb#ZHNBei2wm)gK3h~!bkc}DrWn4 zUYCR?!4>i&Ii@vJZ%cy}1`&zeboxojs()i`ZEpV6KN%FM4`i;6F;2QZZ zt-q&R4fus&Jahk59fFemt4Ntf2g(Mt*q5146#{g{cwP0XhsfgG80>^mUw^S z8Et@PeyO#Ry1DeD4PXCJYkv%5=l}#I94+1T%&Kb*4-rh%V2C@w&Hmjp(_oS`4VH3t zT=({o+!Y~$jc&2se#GFc%^alQuwnoA(qZ9_4~kqiSd<@vA1vI82JQ-tH9LKZSP+r; zF^7Zs9d`M(*X^%~I;Y~mr&orXSyjZAFK+idqH79#xes<`#p8y`&z@|a5CyL2k9i_5 zUu0aG_FTMH+{|Pb2Yl1HxnHrstdn1LfZa{jemYe!=h1vis>4bwlMN0r<+GE*Qh4{s zqH{Kw8-6uB3WgY!ARf?TflrrU_+7%_1hCqRX^k>+*V|rm41~cec84%AE?uI-_ba{~ z$AX1A!mIh1x){eg&(80~-SF)?(?qWoc^BM*PP8I-?R|bL=VxFykx(4G>W!XL6GP|0 zCdtaMo8PKSpj%=)#1nY>c7V*I6&9#l(7}}j6{B}e4`F#&vEVt&_ zum^K~O!M&$Wur%nWIKAegksBbUiG@ru%SzC4Bx`ux%2ufz{$${4s+j^ttX@4^X zMUYd_>>W?k`5%C+jEc@k$khWPV<}bW$2q=y9`W_4@#8K<7H`Xk!&H8z9!mV0gV4Eg zauW0b--X0`Z79`reLVumaWdK^U`~7^ zex-9V^Z_2*?N>L&oIYo^xi5ul4eQi4@MVY0cg~;=z63Pr8mj@fIQ(14;T8U;pI>>h z9UYvPy$UZIUq7QfJP)=8Tt2G;!Ch{Si4Haf9*dbctnmI%s8ukKux9%jbKPs{X))Nj z9i5$D*T$4D+nn)opHAY(3qg$y2hhTQK7`|$5uz)ZEYYHi@%$d0lOEG%_=$0*t^8ff-Gk4$<-`)tt=5d$M?^vfq%^J5+q~a+ z^5K5kYnG#L_guhRNpqfelK4@-5&edqTREmVqTcuBOg3z?Qv$5ov;_B&R|-F>n(OIT zlCHT@H}Y)4NlH1?u3j=9?D=o3;O4wo3t$e5W%;DLFz{K?wp|9hGmG_1kd!YsyM5sX z#f@jh1qd}&i_gIxJE17U3%-@6pa0tKJk8<5^L6n4h((mq+GVMAyRyGTf3H?qx&Xqm z(Q(DGy4yUaM}6&L?dIPjo~eOGuaGKF+w$S^*05!I+n+5N&1X024F>bIf?TvHh2zS6 zGrzrD09c$|Jr*=5=Gv&tJfIX4eKh#)Z0-jY?+D{UXj=czdXw*Mzn0RtXlr7R1*Gty zVl7lyKc}KfM%Io=++o?F=Hx*I*+R9;pglB6S-Q2wG8*m}TbZrNdp z=X&MhY-83wvwZ=wmKMLrM&V=o)czZZfT8XL>3*W35+A~^B5apeDP#YNO`x&bVEQr$ zIVRn&E*qO8K!Bw-^L)TaQOj>9-tS&KJl|R#+ncgY+Yfh)L=wN=!ZOtV+5ZS;<)N6LM!WvsAQ)>EXoLYOqk9DkGbI)S)Xe5Ch&w~RriDTx}2wb~n=W+%~ zNU(G@uX-eIi%u!jinfAzXp;8(dfEN~N4xX}+=kSq;~vV*;X}etlX{7R{`4>1^sY|A zV8ANjykEFqfynuzMJW>RxFaT|a=psVIdpH66N8`B!={F-yrskK2XpR0@UKF*HJkSb zK99V>Z#7=V9NYok5dCH;&E||t37*rFcVSrYPk;%ox6`b@Le|mn4*eFdv_wZ{<>y4z zn(EJiIOVZ-kC8nB3Yg9r?Pl{Vqd47kUE)N%4d)pxRu7poD%wb5!7SqC!&)-|Z43Kq z@F(3$86_G&`?z~fL2Mt7J-p?hy@6Y)nBOd|_=S-d07kBv-HLS-h}x8x7KNYk2v^-g zqFcGp70a&;%_<4=Z&WoyL9ZnKXNbD~qqp}z2$xT3HU9PI?)KzU9kOY{%hRW`J3-s| zwH`lmNx@a^(?m{>4bS;>$@w)@m{|GIMx=5dxGQg$Bda&V{CtdD#%wSOT)e2Gd2AN* z@Z_H!>#6d7^0^+^tCe#itQ@*6#ttUhvL7g{Hb1)km zYGW0ESwX+qJEOhMlD?9kibTwX3KzkqPKN%lC}#DBN2OF#B0zGr2otu;Db!x!7B}=> z8?@YPy3CRA=nM*RXj8lpX~3})Ymr2E>Ea2Hu5(6BgU4Xc>!o3T1l#;pbnpfJlD;gG zGz!aN$n$e8+?tr-cGJ3kG2k3YpNxo+!67Q{V4TH zC+w`m2Uiqb zsMRvGVo4dqf{MAf!qd2}a{uw2{HhgOm!;%Dt90?jc&QTs_+ex3NpgYK98)+44s&W! zYaPxUh5_piEifTJF1xgImPh-M@HWMJV|Fq5h+Pi0yX)<=fJ2a(+ap>wZ+J}m4o~y= z4IAx8^O{`}0u^p@j9uRQO*4YGNB<#+08PyYtdPRGT6u`?qrGj$0mQu6k`WwqL6;4(7nN7e%4)D_(JI$MPe$Uf74oe{LBoE)C z-TZJqoKmc7aOG?eNA3fH!(3fX0S+6NRyRLGvtgG{*wnZ>?X#`y(sIpDn7el8gJ7Ls z$52&;f63kO{4ODITEZ*2&l!8rPnRdkZuEE$xa?h`V za1C=CgksaY>%}>5LWw{o%ktg@y`C$MpJ~2ip8j1{_htm z4R$AC!Ovh9abIO2vo6(`+wYD()jO0cm%++BlbrVStP&iip3jBKbTI$ceLr_agv|84 z6=dB_e1SnimRGg(m~BOdU}*3R^i^|s1iEnaK8?=|JH^71cNvYTE;$e^jjP+cC$ zfPItzvu0qRtT2FFrqKWrlFe7VWmz}Nd2m)G{#^T#AJ;_#=%KdOcsQk94K0*WAz1_# zOuJT8)xMM`qLE<9yy5~um*lk7=j{d=X!1PHPAEQmdgcCJ6;hnR7 zyL{$2!8!@WYZegWN5pCROuzz0EaSSnqDqiztUL>z%-O!ou;EYFwTF zlfoPA(tZGOlnL6~hPK%WX@h zir>g@j(J*Oo%{F~m?Gyc!tMk{LU$EgJ`VTBH~9w=`Xnd_;u|${%A1>*of%v5`pjIM zZ^HpE7Odti^`rboA6f`ZlkaWEbo*4DuNEd_y;1k^wU@k?j}C`3VgXCZdL=C1t(#aj zPGst+uJ=7(&sZ`TcfV}G(yTO4^6 zZC4Qo=R*t0JYXv-3~b13LlC9Ld2n`{xJ8tmw&CWZ)3wBX45<|MZX}gA(kjU#-PdX= z4C6j#BkS^`VLB9KWdM4euwXEVuGz6-rfMJx-iDaDD+ioHe(RnZ-30Ovhpzls#!n$t z&nh{j_QG2QN4Zj!)^svx!&#gLjn8k#X3o}K*v&4Gpgmn?al0(rA@uV7;UeilLyx2M zH!uCe-Aw6o`_%Z1!l|GMKP7%ei+f!|?kYvBt}&|aow$@084fTWxFTNLSoO1amUG>h zisTc~FVX)^>MQP|)5rH<=7a&voX86ID!Nhl@(op7r10(Se~P$weo2Qq2PYvQEH9Uu(8G+I^#HZ*7dgMI5O0@9R<7TP68{0yMN*4?+~1f7f`_xwTnH zK_^jP!923-TnaB}XtqT8?r{kKK5=0YRBR4{U@7gsu&*$csUsk?(F382n_gQX)85|; zt=isg^uY_8u%LVl3r$etFU~J&TM6aeUw927Vw24GsS1PUxx3EFppvW_dQ9SYWjsl{ z$n2nn=lil=?brFed>YbFbLOqY);*WjJ5g!PlP+$Om<`_z#m*+$9eP${+vYG9mK;%F zoYD!%rpqC0Uk|e>!L6h#o_i~fzvFoo&@E^D6zjG`+=L6NG12dQCVjSVkK3)Cxw%=X zsUq5o5E6P#7juwH0xv?ggN1Z}H$h-KVk{eJg@xAhnQp_nLP+J9NmFd1_qs_N*qRHA z{>s-QMcC=L1i9tx-o1*==GD$WgF~Q8gOV)!@w41CJ5EeBza{zh_>skoY5wF->*Rve zgS)of&_um7Ao-(z-(h5_a{q&?%61i5RqSZY=@r$)?`MW=%FZ`&rmK$$m2)U36|NkC z{&Tdkr7n9P^;n!PXvD`jS#a)1d$YrLb zh?EfUGe>nOaQKSo9@cIU>J1UN$5N3NM+lJr2$$(zD(}`a4s28|b`1>JX6HTyNk4*# zn@QL7&7BUwA~D`~>F$@**%#X#fW__(;h*!MYB(jMOOX6=;{Bdm48lFt*FV5Mz3yh+ z2Ybf5rj-1Qc#eRfM|A0M-e6=CFNDRuqyZSV*-nHKH;3sE&pwjQ&}{PVBg!Z1Y|o0A zU`$3BCwHT+gUgBE%cuOy&t|59nxzD$Hp)9fPZvKk#ket-Pp=}<8}GZfK~Mug=H;2Y z(cp%$ZgPh1gZTDI@VjHr>&dv*@QedY$T^lT(kvMb-oF*82(kb{k|gQbSFRuPrXcVQ zy}wdS<=vPT8i(f0TsQmKtSZi@1*GPCde4H}eYJOQ1%WnIQQs`opX4^xrOL4+(CB_U zC)}p zDL5<#&|7&%y2ZQhILEzFm(~v`%)w>aBAOjNSiG8gE4N;S(|!~)@Q`)lw6Pw_B{@+L z91$+D09%zZukNPnNwpeJT;E@y+t;}`0ZLX3u&s?Tfa9`Js>H?WX+jx56JriXv2lD0 z?sLQs4~||TAu9g+zoiHsh5;Uo=zUjfK=L?|$_t0sF7a-u?l=`}r%CNSmNX{s=U57% z-(|(K1r16!35?~9airVmr#VMyLdgT*Xr`QsN#S(Re)zWcSNkEN?xTE45XZ_N+v#DDQ0Yu+>YK>0l*i>>J6+v(inBzRpi`~6$Js%L00Y)PTu&m zEBpC|2V)-76dkGZ;h!74To)5GI{~(h5gl$bIT~7ja*5FnUbA^mC_#7Lj^)EuC;5T8VvX})eDS*wcEb-d8FE#WFS?tr$8Uk7I<|Ii ztUnIt-$eOfLfUVwR3`?k?3Wmsfq+By@ZpK10me)5VmefZ3sJBxK%@ROAE~g(o}IH! z>U$W8tYd6ZVOsi!=4T&dnV#?1?7F>StOwlQ{4oZYjXLkRd_P|gQ2Kn9o|bO-Jy`7@ z0FLp&cILejieGqT(ZXR%K^O1@8Zz!#lj~7;%*5?m)~q%C-JR>?c^T3#?6Pv4I;}K} zDxbKlQ6o_~*<$<9mm@EIMYWnCN^5tcTn7wC|3)A5qSils(37O2rBs!yDk!AseUN{Z zwxMyvxK+<0o0#;Q_UsFmM?N;T-?TypQ~;m>Bk*zA+F=DGW8J)UGxL7j9+RWJA?f)t z%SFI{?tc``+COnPC@lq;$-U+kvz%pjZtwn`Va=o|gm?O=dAM>XaF5e)*`IK+YH!}q zx*+}xAjjD4ZcGwyghhqB{dIsLynu{b0YPe#C`H`d z$EL6lnh=G38MT2}><7{tNFzrM}l*W}sMGPh9-Zv}?vo8sFY{Il&GnBmLRUN*q~ zrR|MnR@xM-lG-7Jd5X6u`1I-D!JsD3$=X;=;{LOZAt2Kmo#drXjSq9$4d|=l*ElP` z5nlqe(WPvjeVOzAn5H*}9S3XE>7B)<*$+1J`MDL6OXG>_W~GTCf>Vaj3T?K$%miz- zw2#(uP}^W~Pmyg4N4N}w4tbOk-Hxv6^J>Der&J!zfUXTCMd3F5@$dBK@{f*xglI6p zX17z)Ci}kX=577SHLIRFwmkeMkW=I}H5=-yLO$y`LB7A6Zv>DJP2}hSC?x<2z;p=a z*GRSB&Q<-z=NpBhuxYI)cvRmVu;TaZt%qo5=%kM1`s2P$(r$OXCW2Hev~?B4KPUHiF*xKDOIaE+*1%`*d4tEPX+y88wl z;)g%6Z2jO%dK~;IfC{2gTINYGa`p#x&iM&=zTvu}9PrwS^#ms7xpi>8T1#zXPYY$? zl5wiTd0Kp^|5_aICyWLBVyXHZ&}ky8BqiZVq(+u5q3oQk-sh*cmr}xF9m+dNeT~4r zsDoD6@bY&jB+U+){Br@Mb1D{8WOW0&J|+O1@{ox8{h`UgaJl7s9sar`21$%}A-?nK zdb9XL35eXnzjc`2&! z?PF2-TrUdC_xf-*mXxE|_qn`Z)4_;eq*p_04B_!E^{XrghAY8w2^S33``Ok*gv3WL zMcdzC)bW&VEwOz(7Zj|js;$YceHbz)z|c>`(sKxG=c0#GXS;0TVycdC>eC4tZrMKM z&iI17X=}bBjy-nB0v$~mp5^2k=RR_H<(N8PkG*A_Y)XCFrtYzjtnM8=NmilvsX!W= z^vp;nvC!@WUUiNZbe6q4&ui8k4IbVQx!%i?b#7zB6bXL_6h=(D_R}`6y}_I%GfIHy zZwk~$Y`~?+nDV$k&X2gw;!RJq#E#kJ3k7r6>E2od4IOscz?;zV1)L_*2Lx^p8{%HM zL5I(F=kV8qdI}OxFqc@@{i3gbf;!_#l0zBJ{uUQs59;~sDNDfh+2(jSlIbDRh5E2i z{3q!xH&7ULfT(eq#-m?a3J`kHpai8osBQ$v(s(;zwcw$By+hcmDfHISn0W6sL?iXpzY?na-VT$i|R0^`-`&h zr2XDB$>2`5DtDta%JTEc-w~~lGt!{v=?2$#a0C!wR3Ju$8w#GlZ0OTpW`Ba$4sEON} zk&2^kE5@t0=DfbhUTw?%*|5gFcIxm!KAIi=f`NkY2gPDV;stV401}@m?eYxg^tgR- z1a31dOr_8nV>b~xLjwFdvx{E2r7DQMqJT3H9@6r4nR#`2ByK8-t_<*h>3iB+Qq;|G zkGTV`>hDZB9L(l1B?)hQKmQfX#CBG6-UQTmGokyTt%q?bZx7#B9?U8-H3AUFksogz zslP%9-Cgelmu09FhJ?4 zrm~#S*XYoYSoDCKcE@|YGH}!`-;pW}vfWX<7fg*h-K>9#s!tlWn=f6`M`!nYQ_4wK zfrPXmQfO;^?pLRqEI(<1Hj>vWZB}~CJ?c)GQXwo->e@kEsU#+vonQ2o#U*Qwd-p`5 zxs0buFkL$aJ*dMDO~LuzNPD?gio3cW3a{z7>3^ySM^B87Vdagm;YKdR%&OkgKPP!9 z+_7}dbMi8)gsQ(AyRFG{^-J9Ovx}bYFT)UdsqAIk0)H+XMmE5ta6vAETW{c*`HY9Y z_WcUQL?b5_*`G5ONnpl;N0(;jY|B4rR?|G5%?p&%HWN(5%5LAGt8N2yFWuH<4!C`7 zsJB7UM>Ti)u98Ui)D29PXcw^nw&kN&TpWv>r#+?#*jp@mqPmOl$E0mkK3#Jg zl?Bbt8Lo;KF#^l!^(8FbB+$il!2Dy*44gga+UdOyD%MR-%V}S_f<>j%&4vYlu#cX5 zizv6e7TyY@#e(hx;rF|D{t!kir$xnts}j>Z z0q<{Q4YHb~3t4R_C*t26`hfrdBW{^*zfsL$LG5|QFHcN9L-~Y)8WJHtW61ApzGLxM zAPeG)&zc=PT;PDBB>&r<3+*dn(*8MKnzQLhJ-8oS5nX&y#*a=XQhPR zf$)(=xxYYZ{98EwMvphh2;L-`Op|XX&8I+H-<(B(mNpoErqW!cp&iKE?fJeZ{?glzN_*X6HP^6s<3r zIFNFlm$SnXgBc~gTvr+Q7z)PUD zgS-0sg>59={oDm(l&^c0MOp1)@|(4C(g)F<9)JE${G>onKDqO6!iAK{#}r$W;0HX( z1TPy2G$3x87B(~0$}=q$!?T9o1|hV zKx)JQc4NFb+Iw!Oio1f`&4Q>g04Lr7=();o_WMWV^stwITC18MB`5QnoTUQ*jMJAO zLUeq`Z#8q*hPd4pvvMFT&_+3r=|it(8m;<XcAq)t37R^ zq;4 zzVFe<*78C7*jutgV%hy6VcT~V(yJ#+se46SN0R(E@Akmd>8Ot!s$)~?!B%z;p-89 zoSj#N#t}BUJ5m>DcDh8?jbZpPom?k(Oov;S9NF~Lvwv%((5!Y-xbnvrdQ~B^k)ZQP zi&eZ+m7YtdAm8G|H=tSwfq<;D?$i5NkAlD|RryAA<}Z{*`Z(b9$?I4sT|n5l6?TNg zkrUE)^>1)f6z?3g_{)Xh@wh%&Tah$ycdEHLfyL)XC4M|;FSW<0j&VP}zl6ES`6bSAZFPt&XzyO{YB766Ve-(h%KTA5Z8IXYy{sC?;=yalwAk_Ps{hJRUL*{ zIOCGvUh$l!@bs$MKJJ;H@~k3kjCa>1S@7QPfQe%#U86wBxW0AA+wc6>8sro+vqOSL zL_DY$5}U7n45fGb0Ckj8MoaSkGyPPh?}vTUN;G9C(WvONuI6DY)4!9@rx3vfc6?Np z=^?LYp3MSX2^<1y3nJITGoFh6Z029NqdJ&?C68=RYzrPLM?Cnsd`6E!IM)$wSRUYp zm*P9LvJDB#$e_?yXSj6~RGo8WshTEw$M=az0prrOn)|mZm_39sWDF2G-p5_@zL#=>SKz4czNGU$=nbwS4jtA|R&Nk#`Q26qYL-857J=BXv^Va^@6s*l@opPP zErJI2n^`6ulzJ0}s65!d{<8+k4gkfX`2z8+AtVug&%VqlWr|vknHDL?n0;}lHsfGw zV0`Z+q3Ol1PJtZE{D(80_^JK6gT9Xa78VkJam#hse$MQf4^)Ssq0E7}6~){ET0v*q z6>6ns{-W<3wIbCOmJL&R>3l^}BibvvEwZ`yqpnU^Z2}eA+I}q(iAV_*5@1c(32qkE zb95iI&~X8EgoQHiZ_X|lfh`|(?Jwk~b^g{VBJ8&mMA$&xuOd%w>R(ve3jkxShWry2|0G^PnMy;kE1cW4N8dii8r+w6RV1KD2EbXkn)- z?WEtW_w8HXK4qsWyCTCMlxruF&qRvmN2Ohs~K1S$ucY$;Qe!>V=N} zj6|;>r-1#Ud<==8Qalc?zRcClmshRqScgm3v&-FDw7519gd_$^N%Z;b6{Ak|9qnXD z3Hu$*p@3=y;{RkUnRx+h5vs$`Wnr3cV@MKoqU~XBk?G@+SD`xP;BQVMBTfVaAfu56rt(3m9{G4W<#eGZe9}$lxyMrX+I3`PmenT9(gy= zh`)EPEye=TyRzWNf-MmckbHp2RVXN9q1nkxn)D#Wj(SYjYQkbq28B|Bi~9*Tdl_Rs z0pos+sRBI>Ru>6wCxO!j>u>VB6y%Qc`Ymk9)CC|AWdG$%WuD8G&8G!+9#wfg$_n|a zQ9Y!}N~U?BR(k(r_^VJP!n2B~4|C_U@^&^{R^U>FcZUqVIbh?;KtIkV4{eS^Sf-Qu zEWn_c7U+~_M^6YssY2P|PfE-2KCT*2hqUamMP(`%!c|$u4*@Q@a@puLKL}btb+8tD ztFf}`QvMd&kT0qH=uGimlGcm9-8V8{fRfRAD>>xY%^o`n!Zgu67<514UK-Phe3SO} z-d6^54?l@{sE)GIB+vTLHTRM8*fx%QTl-P3)!Yu@x=pt^uTF1K|DFB1eP5UT$^CiG zQ_ZRn+~ZW<2p0_uNJOw&VKm=cm;aO4QA)m0QL3tCDhYYmVIocL~#R zVTheun>Ij13!wqDV@dCC1Gxvz-JCwT?Cb?IE19G5pt{cVMb`K2Rp}37b+no5l zQjp)WgNHToc~Rxkr(mOKFCcz}T7nwuZ1eVtOYq)=3tjQB@ifiQv~xSyv5Wr>1hf$# z|JIBG#JZ>&L+}_|ZYL_9(+~cgR_${y>g&n$)w3Kjm-n4^r(IX}lZ(<2Y^v~@iyBx> zkXKqgAtaT<1C}=>3+-@|r%{K_*w|~wr*K{ZyH>5{&1svN(_H73{~K#>8C7Mwb`2{c zp#lOT0s_(@or0uvcXvy7FF*td=|wjP(jnaom6C3d7U}L-7l)<>3t2%8j*v~q2NXJdf3B41`Zw$^(x z`GbBy?ea2zJL2$j#LbB@%g|O~R-3<2ImYq5ZVv!N*#MCRg?~jA_+?Mv2k?KN&)FP; zP8^nP^Q@XiOezSbzmN(DS^m&lDoX*bAP#Td9;jy3F8yL}5k8-}Wa@4GQ!apktLD8( zxp$`oPR3OJ$cG1(4NgxgqDn~^e84f;s@p$%+p@m(>{UQA|{cO@fv=!EMK#vqXFlKX~^j%8zdd z=hlvUr( z@6^$tS}6=nttPH0SlC&YN2R@CQ^5I_q)zwBq{&N>6S(5kR2zB<<%g^~@M`1)ZdePR zII8Hrd8tm!=R+Lp1NoO(tXIV~-?L+d)7Es-K2O;IZT;U)Kj(<8Q(RgBInK^5qB&Qg zmw!3^{>K{azi67ZH)itFIIO?_po=tBn)@$1MqVeux&qR!+c|&&-kS-B=ZqKKJz$7X zwtp8D)p|O;g%F5_VI7eCT~oC`G8n!8*k;~=loBnAfA`lBUaHh0IgN#)XC{()YRFNbmXFs2G{AgZpN1B|FEs2I!R`Yu=jE?W$Wt z`B#hhg^nnHi+C`85nf zMe&oTD^GCJqPHbzidsM3@2Y)i0x~Yt3w6gqLdWr)>%|Hbu!H>mLC+E0cIDY;g`&ve z`rj$Fo^PVyfi1ZduK5Ir^COzL*c|8IiU>ADU`u9OzB<9F-*|7sqewMM0(uHQcHg|S zcKZtGsCN`=Ur9jBioqklnsIe@ph#}YdzcA1q^mla$h2z=>b{})f)I#-rr^5r9cY=2 zfF@mq-FdaIhvz5S-y!b7H}LF#ywK#)Kpyk`j|-S*O4YXUqSoyynZAf$Zmj%!?j}V@ z&IKofnjnnY=!Zd>t$*#Lf>YhaXgzS}ga(=B#uq&)E_x$^sCPZDW!bi2hAkvTlt8sHH3(P^|%S zELGK915Mt7TE6-F)qb!} z8qOT`283gM`UrFVdgI%jVqLm%0+hw4ykLy0%ig7C zYH^jvtEB}NI9cDG61@b$J)4R(8Rbr9qzj9Q)!FtjKN;8HM)XRAcc~AI;aB~~py*a!KfHI#y893pQ1<|3uY3Nz-UF;oiW%U* z9F}PEoTDSithw5MdsGoN^V(1Chc%PhGuwV&Vdm*IlXlv>p%b#VVFqc-lk0JLL=R|i z5sIu6pP#vmcB5Xl8uvcF%sa9iH&*Z{VBNUGO=)M0aDA28WbBwu3;NgdH7g^yN~gN`Ue?*2*R0%;w7e|c9wD#R&z^cJ6*gB;w~zdri=evNT9#6qM; zl0hQ>j@|FC8rl{JKAzEGmgOk!53nG4I?(8KFE6~=)5^IcQ6f7i)v9>#``oKmP?+;- z0_at77Y!)Qwo~G5gkQ zdAFT7K0$Mn=9uOYq7xNm;8C|IR3M6*-JL8P`00jG1I=6awAKd}om4!RB!#cVqW5go zGvUu%Z6YlGg*&X8E9 zHb|$GAyE13R+>p-|K#SPmrHjKLDe|<#s4I?Y>MuH#(_xCL!@1M zc8sgNK2iBpkEh1@@2$Nm*xLU)*!(CyyheGcXQ%7L^CRZa;UOW_c7VH8uDUcLkU%=e zPmnL~qD!h3#yWKNZ7DDCF2bYuRnhtJ-{YMS2;o^RBEMipLXd%o8E6{ayMH)nY4A{) zxkM7k4!*v9UKQD*HQ&-1Wsp~Wd;HaYXQ964M%3Hnn%UP8I;b?@u#?CISNP;RPFzr1 zXHWYSlQXMc7H^ZguwoN3{;{`Ee!{AwwBWRMkmjvW1iepCk+d8gB3;R?na%Rg%P3d{ z5c!Z$2{!csF4Yy<4?v@`sO#(afAx3rUVr}*aC5LG_>4Gdg4U>iqs-%fS6kpPt6V+D z{F~4K1ce3N2avMuH|wZry3hf}@w@|Fe(9qkshX)x@xH#5VUV6tln>T-U7Ws`SEr|| zaJo~J3#W2zql47-F6Ne!IYMU5>3?s5{rW z%!F*x9eusVN_xoL_>=FT9k=3|S4#xcg7~20tXyF4e5w99e@V?Uwu@?Mnm4^b5Bw1g z+!Vj$4Lb=JBYMd|p_Owq|FCK1VobJ|K zpT17+R>`BhPKu~+@l|cD1d?0+){5XM+q!ZqN9hIcJ^rK7%OT zEB?g7wte)6wFya0P9nsgCrjC{{+8nJ&q9cW5>a_^qGG6}acE)w0`atqS;r_c1g=M8 z)P?r3q@(%c!0_9P1m4^EdhfY)mO(Ee*q*%pNwi+vd~?z+cwHMS&)aeJyFGT34(A$~ z1|PrRv_|e4&-A3%@1|<0|6;3rZ|gjB?iCoUyl1Xj5na81L?((Gu{doJHyPmFvT>d+ z_ZtoAZKYEQ-BH1yRKwW#O21L9(M21Xz8NGQMPh5$xFIg+eFMiws6NFiQ=}^tk}fmp zF$!aTu8F{lL4?+4HCPioDid5m$|FszmHYRQXoC4x^n7G z6};ZS@;xrCn`gV+scUUmoA)O2X+YtEFH^53k&@bC)JI&?9=N!xFwBgTL3>cnUB z{S`#)9Mh+Iuzz1v(BQMcxtF1o8atr|-yM28UiwK*JEA9cOt%yiwED$uh2>2Tw^S|1B3nH2EZ1CL!lt`gYkc6i?5w?#ayA@|s%!K#lU(c2qO!f1f|GKT(Bc^Myitpo^L8}6r zvs9`?-H|fSAAG=+=;j|nt>$fg&HUvTlKBU$GQ)X~BMj$TpR+Z)RNK?3K0fC`6YtAR z&+D4W>&E-|nnNXZ^IbchgQgUVa#C=%x|B0_*RSzp?TsmblZ3!s%nOo*z=mL~y8Asi#htfLJ8aiMCyM$6ar z;-TK>@;(#N1?Kyc3WY5(0-X}vy<2OH1lGEsXatkqizIPCIBA~qp#D8V4)JjPjS%(t zi}!L{4~7aGWa@?3sNZWnc_Jp}WB&DuWeu?T$YMg27I;rs1X$M|8KdAmqNJc-y_1CdF$w+R zVz0%oHs9Xd-OVEEb>!w*17~_s@y+f=viFr9yZf&0hOZQs=VfV~t)Tkp){MmIoI9zE zx!^&2>`IDtc|vCd;nXIn@44{l+}<6oc-pywE5M(X>>~7Fx+w6cj1#e_yRF>oTL!@X z=jt>ADC6l=bP(Mz;ncB`C=*L9XXD~qn~S|toC2RO?19qK(&Abn`-fZ})o+mIK83eyyyU~_a7nF>12QHlD)eoe zLCEmPw=Q|Vt9H@vMAIzvhSx(1l2k)YZ`WO2C4|tA$9;mv1;vE06_KCZ{V#velisBo z(ztnEa9;+~KLqU6e1`@{H(iGd=W_IqF`n8Ov+?9*1 zu39lwx5qQLaEl7d*pp)087?-bb~Q4j#$x1{Y>5=K{j*tJB-_pb-ijap~otqbf)b}$ml-_$9b)sF(G6_dJcGqObA(NF!Sl(oBF{p;DB@wZQtNo}I8w;IGlV=`y>DoYkkdFwYPJCvZ8iBKl9>4m@nim* zcny7{wXgb5+pXE#cXw*pW2R@O^C%wiJkOC$=G6lcpPjp6KXfUe*gHSizT4!8zwC`w z;3ESDlr&;o?Dg_zT(a{X*K&upM?JmFr1W4jTD)@$M3CKWSc1l%$`zn`Zu3%r(etpJ zt}ZO~21ff_g$3W`bm_3wEkfg~Iptz?Mj}VwPa9xepc!i*9|`WeFY;>Th z=l%VMB^lWwkNkb>PEQF14Il@f`Pj_Eo54;dNbxqYFNITPLMuOc)^DLjo%^0td)k*JUp|FxS^@P*> z;x>Na_FV5Nqps;e63Y#Nmgh=5W9Y3vDoM4#?fw#$(^!l|4{&;$?c9JR@5;M-m_5HO zI6=bQsb(*Pj>^@7lCvrf9taJzo|!9oxr*zCW%sO(UyjZ{SG&kqpn(!QeKc{0KuYM0 zn4CoI3F&XB>WFvkAkJXb`Qt=UaP?{}GVb9~SkB@kNM{**f4Aij|M4Bp`b#`tV%>jo z>7MwTA%Sbhj5}H)pFpOV170VeCA%s~k~4zCBsCimE3T(iXMCQ_f`UD=$Bw;}D9ZLM z$p}gydxpzZ*S{Vh{4#FAJ<}&wAyYr$xS#7qG2jMJ*^Is;6I`y>ziS@w>XFl_18S*; zZu8djLm8ldY~1d&a*!Y2a6Nf;H=x$zebLyu+!6tZ>0| zQtxzH*(oAmuF*9fgddD0M3DHzhQqqUO~%-e_~`|%_9=K4+i}}42~hRsz+b8h^gZu) z>8t3HT$3lZbvs<{rart8yIbK055h3}-M(fs2i7FaK;xj6%$;ncuH&i(Qss{gc?fml(3R2K${b5!E zVcKe}Xk%~ZAwDc3-F}ab4CFj<1Z>2TP@tSS0~&$88u{N|K+j|~XKOzgtmUoOz8%(O zBH~p|NiEp-y_kG=3mm&r3%=LOU8KI0%#%Gw1N<8Dyxos~%1ygY-u96CT@e%oi=dKt zygT0ZEVOm5Ad71S{;P>Wx>y6~bd9wR4iF)wt;@HT8kCvK@m!`=eb%3AJRIp|?kz5F zw(6ZjI|h9-Bb4v9k+JSx+_kJPoT^YIzZR&CdYu-<^k$1H!Mh`smRm1(Ur*h>yC>&~ zvJr%lm?(wm?^{ncg!*tayc#HzyK&8sy+mgP&!gL*jEeH6Y2jbk%0jBTz5X<|Bnd=g zlT2PliER6@!toi2vgMQ2>JnAxwk~I%1(h`pF+GaK5!J^VA<1d;N%DSxJv^afHQQWMutIzvcjh@3tXU zB+K52yuB%Bxr$b*MP>*~479N2nXR=d-!DY)yosQz{wXa zCDQE0^SAl{9#rwTOA-6WcjQ@Uv`GKu4^=6|gQCh8izs@5Y*k`SK18!ptR9X*sTpJj z>W3`y1*V&%j6+@f$RV=sp`2~o;kaY9!^T)cjtl*$J&WX`_D?%yeiJjK0O7}in*}+` zAn-6IUR}F;8l@5rJX3V7sgg%YzY6j$@hk7*C}Sl{o8$F zv+3gvf6TIgtglUm$X<`v>+bo_Q(rJUof`#9*V*Z{=r;iU$%61xMr|9yYiqP)Z0z+= zjVZA1{}S+s$n66|-K-N?N7z$FsC)n203ZxdH}CU!sggKI_S!1wT-NNEIwH5MZ-1;^ zc{MDqy{(9yg2f<&HwAi!luM4@5@m*+lv#=+iYBWnFDvA5;$2ZNmZKDXRlCzCp=PMe zY4y2d%d>lL;OFSZXC=7@cwc-Actgj~j-?bwxW?}zidAB=s^C8?R*i^awK))>t?q@4 zBbs%V6rb=;%GfH6BPhX@!eDgt`=%s1cdtYU^8|c7CKl(|=iWwCP0((t>@jV!leRwX zLN$=cI{{He_tRT=l-h9l?H$kGp)@-uxuJu}lG_;DCjb%fh?YP$3-e8fevvr=b(~}u zW^w>JzRNo0Xue!8j)|pV_;WT6Y9ybjf-X|OG?#S;|9*edR)@t;n%;^P9tY%8bI%`W zzTE~ADVh+WC^wKQ)OfIn1OydscTtAATt@rre%#);n`m)O_O-v-?5tc1%vTa=d-ePX zoif-=WmSeo#j3~@0qCUcr!wFk$(aQMM6}Rf3J@rkq^njpOss^|t&~>ky`a0$Dy~cb z7DbQFSz73q75VuV#tI|w1${DCJ5d)yoK!puF1J#$MMm zCWmM6c!b$G%RmPBMICEa(2vcYYTfImT|RAA!!b#oDqb17`Q$@F;_=e(;g@@yPUaG)7A(qXX*?F4``WQlaBFDy8A3y zskSYxUsA|%6VQSPyBB3s@~Qj7Eo;FWeD_7Les1s7Es#y>dh0d7a~EL86hl=RjgyWp zQH>Xb4Mzh_nk$mOzmcz+kPnSw_e6_u<_`C~?A7<)qw6AZE-9(#+*GIgaS2SAtyizk zx-@kQ2BcGJw_ihwNh7QShz8~Pb%UFK0i zQSk`k8|Yqp^-xec-L; z(p{0sZ&$$^$*aX3;%LKmTh8n(Cu<{033(2!8m!uX6qpNZF$gbkbC_mTyolr8bb`m` zz?Zw3rAoDHOuxOqU%4dTq}c?yjkY&|5OO*Nmin3YX%g@rvw6>b?iF)d#txp@x~*N% z^S!-x_ujdESI}yBm;9RrMmn!qC8DYv&U^3mcIT%VZ@zL;CvhFaR<5(-hwleqnO(db zEuAJ4F(x0fXhL^Y$Q00HS|4I%XNaJ;*2tG9-s1jfiC0F{h`qk&Csg*_*GzHHE&647 zHMH+?CDBRUz;%UX%CU<$yGMM+&t*HOwv{pD+L7~hq-f-GrNI-!lT@$Ohe|Rt1sQO1 zaECNj!xE=54gy^WNytKjISV8qkQx^|bV;wl?4-e-Hz6BA(Yqxt!`74|u^dAawQ|1< zM*kXooe9^p-0v1I7<_y|kgSh>d{AI5cOruL*6roTDgMj3^so9>M2IAvRc^)p=~R^x ziF1Mzd)>#^3I?&nApZu{W`_@?^FBlJLDhMSew^@j6W4*=Q#7M>@bP*wkYrIykUHxI zd038#!I#9dxSxHo#%7!L#SvXvKAF^`05bC$V*9az;+3+d@av51lg-K4rrl=sq`?_4N4kHxgTmGmC3r*I;&l=OaP-_n z6qr~-CtyM2JTB`ihrqrNctPy)%YUTG0!znla_;QMkC+@bTj8vQ(v}G67QIxr+P>Rt zJJB-n>MJQ`SvI-K$njzgjSO$M_d8r>o2tOIQYP#JT9+BHAWb&{04+A~dZAAcy%S{> zlbDIcmxQXudNP51;FXGb^NBjzJo^Bj-T>dyqnTEny4}O8_RwT69q4v`{nVr6MGqnp zfq*xm5)S)x+zwAq-#n5M-rwgv$E2E}(u}66dc{<84b5&%oqEKj+1%a`r)&q&Gvu);_ zkBJoPv2RG&SX#ejubM+56J);k5!Wv0mo-{>BzG8h{{n*Q%)TU6kqK>Q#;LM?Hz&}H zBm*u^Y>7mZByv5u=e&CRM;cG4Yu}!3PdQx@yY~PAFbxJFN1XE@j|}FkUw52CvVs`2 zt0hlot?l7E+@giI8eB6r>;yhbx4EF#CAbKl4oj>61s@b73F}7+Y)bNgj0YQH$^9Md zxf`s}!B-rnZ*S0!b!;0x>-t^0y6HZ?*kcvohquQbf{9d$Xh|hgpye}AhEA-4U%KD< z2Z%K9NyTPxpK^b3)APH=I2@le=smU^HM=Qq?IA-YrR4Y0HNHfOTBLq+&Avn<2{eVv zzXCAhC}c%_MJEiJJt}Nk+vL?H+{A6Tw*=9Dc2iyQZuyHfP)|3=y?Gem172H?U757V zV)^8T=7$u;7wRV=C@q(uFaSnXDY5=ODz)w}aYTyeOlYezU z2?wNri0`;=Szfs3^5TmWNZKcC3h^G0L`C#_572u8BX#zf^-Q&p&^M9=t_4LN~qIrY6m3Q+E0(E3ks5yRWJp&U<=- zVe0un%DI4?Y4Gq6ihSmg>`YzsN}!#pkW#=VGqv9C)cZ&f=bGYkKvcRfrea7gE0w;W zbQaAQ`o#MHp|mpeRbCYQvzEAmAfkFY3?vLH(Z*PoT@=YwD5In-(GyLj3A-VZDT_Ug zF`1TCHg-i|dSukDHg$e!$si#N<6F!q{bU9|%^=Oj=7E|RhNjq0=0zND&FBzvTA5-p z8K&7>91RMtw45z)qoVWn0!UbiH=x!A2!Z90Vp&zVT<^*4Mt)|l_ZbOSqff2O#C}c` zul4{}%qGD~hVA3ImfLrC*&KgA%%h$0MMFE@nVI>qYdd3Wzxn&%6}Sp3;3d$pcHWk%;4hr*gSzekxS>5<8|3K_1vr38jE=uY(NGS z4{(Wmdy6QaiKH* zdu}3?wtnJo6^NLdhE0oJ{+9#OUlW$95(15i(TMjKJ^t6+w3dVFY+7pq~GS@q>Z6wc;iTs+DjR?OdjVv z2vEyLnn(WXm0bW%2hoILEfIn9eG#o{2c?M@qs{trUX=%(MBPB|O|#&8R@!{gV_j*O z&13p?Q7^g8jmspqp0777W-L8s?5pzX!a{47oErhM{LZ5j zm*|qcxg;X9MA>5Dli(m<9;)FarAPK%0F_=`c@Zap(BBvRURj$OJpxszp1V5yGgOj* zj<|WUvQ@lVK|=4*j!jh)PQC={1^f4cTT@$`8p>kR6EJ}eFL_o72|TYna7H^$=Cw@$ z$fNRixeM*AVl%~h<&=r6>}Owg))s;2+cnkF+un3`Xzsy<#vBwc21xf zdfg|LsAP%W%n>)D8CTp;=!Tebey7YhU1+3*vr?{wh_bZ`!p8#7`!N}gsXn{P@C%Tk zqP_km^+G1p;CP=-;un%+PS7h+q94VAdjc5r{);7)93wVsq8yr(e)B6iNz+)^fLo}ksfs%{Q|EzqD3j=Jc zX2CQD{V4H57_f=r(Un@%6zDraT7>l6ymPBl3}K&RL#Y=kmhQXl12O?+WxX>ls9c*x zIP>YNz!6H(5v0@^CFw;{S7ag7`}2_D@?0pUk^$@HPi|wR!brI!1&YF##;;Vw`fWNO zF_rHRvg4)9V)T&&jRg#X6J1+yeS7a= zNW+c!q{f@(M*`uR3%MIbY!(A)=h-#l*ahN<&rT?p*ZAq5eRe!C#AkOg9xHhuoYmP# zjl>_?Aw|V#rP0$7IFPD5QPw^;KiJG`EwKQ2v;n0H$ zO#EMx(pw^JVoS+Rfzq8cq;bcQJ4p&my|~3vU*$!AmH&%ftgrC-hU`*B9-11DDUi*F zDot)FdyHgZ+x=NQia_s?Gz^Hq1XLy>;IBa~B^B-Xjk)oQ{^*2)Br+CgQkrT)&o3~op@^O- zZycW_pwj~ZpQY;8@j{bA_#v76N-u#GI(J)4Ji}{$5-a$xbWbgwPOZ6aDRLYlc+f>MbVyM z`wJ}m$o-liCG(4ll~bND-R{UneY)C~0@!`sVZsl~NdKY_LVPo>Il`egfrpXb^xY2= zZCU4{?Bz?zq$pGl<$A}4gscF2PT=%Ks0-(nXtA_uX-9nHr(ouT5WGJhcGOz}$t@we zzxb0WUKTh$RVAMQ9BmU!ZAo>ANB+u;DyAn6Oyj6`j-*Uu^NM@Yc$_PXPNcC5 zI?+_skbLI6P8c@*Zcj8mDy$v!*b6}GK$ZkjzPb< z{zcu;*{`;!m`2yF?xiRJ+A6`z>Z}{b2v>on=wT<&J?|jBEUSiI@%s6$T8lmiC0Fdn zF3_nftDd)!v8?cwx$M*bV(8DuwR#u6c)3^9u(qjRfu=fksa0|MwskY&YY~WNyCHd{ zZ8cd&u|(2f06T}cow&W~Z1OtU?7bWO+{jw+`kcaZsm79(u}1Sh?%Fgjut5tO5e(iG zc0#sFLfgKDN~Wn&YZ%DN;4t*&QbkWh*9J-2$7&E8rx2m`q{K!MAUn7>$z^gejzy@C z_^pP;?n;g&iR4lKsBEf=-%N6m78s9{>7_c>Xvb?&n<`TEcI8o>0n|>Rn z%k@P=_lE;< z=y>Z@BF2ZYnmHqjDM(nUZK9{(EhW~hvp3nC?abWSw84aRgMZ7-Zfg08l1Ru%E}H67 zq*5+BMjhKx@d<5j;wFo67K6^q$>#h4u+xQHudK28Z1x^b(U7Voc=DE!D;lA_i=L{G z!O}A7h<{@;>pJrm{;S3PjaiBka)^*vOQuq*wAfd%Uul?n+eZXuf~jW%iy{||Z7*l*&~z zUA~&lcL<@B-Y_&ptM~ux%13vQ+=8OzwRw-kdgz0IdSHWUhBY&ua@XP@l=2hNbFF~{ z-}wY)GqC^ikjiCa1dGY^0fe}K6;fEKmP{s3U})>lxaJ@Z;EAt#b>0P;A|Bdth>Pc{ zXZmN~YZRWlH`jFrE1lL7KV};Qmu)oOnu+0-J*?@nZT^rVHw@x83aW<~ubl|HOPeFm5hOYOSS zx#0JSSp7nYl)l|lUs=<+-vnzPTbi>r%c6I6)BkBx^=11700U+gW#cMs>o$Oouy_`BoANv@y=;2N32F=&?@NNI4}${s%R@3LrU5jFfhmSss(TiFr&Y*|Erya#vVtWIC>@| zCTjiWMc;z;%{S;~M>5Q#Hp##>11ekJB;_gkX1oxo zP&WSk7c9RjV@@01-L__F)J5Ju?&CV?ZW}t;x`I<5UMY+eD4A&ae!vqMBoWPS1&6%y z0sX<|`-e@vR>kF(jL&@LLZAXi^uwh?LuzpNQ#Kd6fnx#=29MzHi9-5*W<|gFrAI5n zzRq8gGJrP>%p>g|h7IjHCMFNvN!Jks(Z08!68yDJa*{y0{nZ0`u-Tmx=3} z?id*g{!5WQg$v=fE56>U%4dGhUu~~{J_yrZ&&;&&B#{aR!5%l4`(mq>(t&*@a=DGK zt~5zl!&Ta`wb~(X8Ug{@cZ8}}Wx#(^c|)1|A!N`A)vJp|$u}jOS+|1;Ge5Aq(w-$^>=PUCQ1t%7nMKy%c5Aa5;|lc};sFBzC9m)ByS_tq}m zm^|1y?oxP!%D`OpfPD~eRfd5R$tU!#nyVV2e-GtQdF7_nNJa1Gy8>;&r?HuSJ)#*{ z4|=AMtc!sa6F0#~xda+-w4(yg zQuB+-li)DWV=acVSUR^4n)hP8d~Zl z{wWwEaD6V);CftBL6PZmBUX9JyET1Lg!2KccPd6d}{)5s9oQ%IeqxY0Ew)3S)7u zLG>yv$q`GLb<;dkHY}02K;@Z|W`TbOB?rr2??b~3Ya&=ogtn39MJxhd;r zJtl1-mw~`&Bt<1Y=*7yvmtG6uI!kKzQ}^LBOMRtgZuF2-7oh@_9aP$@_q5N#%oB2m zJI0RN>n7@E+5XqqB>Y~G8xyRDt9%{4_A=$LB^#ZF(SpwW^iO9_M!t~aUQmt{xOwu> z>IwFg#AS6AQ*=#AsYw_%)p-uq{86eTVt13T=N|iX%l5@fPAkf=r%ctk5Yan+XXykh z(>X8b{9$mfEtw`_x0t-*5_;FIiC8!_&W(lvgo#-`6^OSGC-seJi zkJvQ|1`r6r5~r#JSh3FpYo{l~#q=FN$LFq~5KZxl-f{QwSoUuc@%hB& zz3u!C*wQ~9u95ovP>G77o6HTGLc`+Sep{$jmDk6Pij$GKuiC%`c1bb!FnPWw403X{ zg0|gqihc~TQ)1+}=5)1fXSLOJOc>#dP4+9XQG(HD7BFJZpGM>36Vb%(miDeKM-xPc z08=Is5#9grE9g||D70b5Bevh{8bf=k#c#qQ^XCD}s^INafL*9c8QO7ic|~5DHKx}c zh1|ilKIrgd1j`^HU)v|#Rm0xWnIGo2Q_6(gmh_xGt4OtSKJX8U?KW?Jn(SSheZbSG z>>(k&jAqb$OiJLpa1S%a>xAfMtwOlB=FQC(vv>Ly%}1fk<(t3(_Q5TNt&$n?TmgLW zDvycO?h8g8V5j7c#fwl7yg6@y2zVz@@eL+lYe{0UootTdN8i5N!_OQ{(8!ldsF~33 z8i1peafK{yPQ2vXxky@4jGsZu9EQ*Qbl&?RK0|a@r@;DgpZ?P-14sLJ2?q+1 zRa@>=jI~fXZF{DO)H36}CIb6ra{ECKif3rnZj-0pS_VW+t?wa6E|NuHJLkv`-l5-myZid^rpX@F$3toTh|VfQyJS*%U$;{@>Hex`z}iUFAfFM|1IOnO zJ(H?i8>-@x+LWv7H3PT)rG~&3Cd=Q1Oh8)9H@#C|?88-7ec0nx4?kMfBBE~PU|rLW ztirgls~@JW<(-`V?u_C5K5&gPBhgoychFaGnTXTM<}7x6Qny#2>Xv2DrsOEmz(XF! zb!JUwIaB-k=bHJwDrVd2Zu8nL1HWs!y<`j4(by#t?6?MW(cxN;F4jxQfFO+fT)+6u zF2?Z9PAxJU+R&rU-Xps2O1xIuCIv7w?5Er(t4S$XJm@`$d+ z7c$RyJMNfo^|q&udDCTxkT#!1%BEf!H@K%F1~G?0 zqm0xf9`TgRC9LljrI)^mTi1POc)1I5eJ#U1vl1RC{p?&2TTB~S$nJ(@$@W(>!Jqgu z)id3&%dsN889w0JGq{sXW)Hjh`0F9rC9y}6ExdoyAo(m?%5L(9H9p1jpq`pNlh&Ea zZJvOJjwHM9ywyKb8rm0(~R|7Kk0auy<$++KmteS9w50QgDUO(WhEv>V*IP++3nkdwffN`Fo?k-_1_-QyOG!;f) z&hKcfUpCBWl>evk@rgerXifs?($jg3FaFTl29eq8EKh~03x)0bKTxry@X=D!Dv(dL za6l=PiH^)h%(PK_+ld;Nud`cNPuE1^fJ%psrhP*{mosKU8GjP>sGIVDPB{UIlu$mo z&tc}Hdey@tOG;NWQ$o3$z}IjNt2UGb4h^u=sJEbU2hg;s_5DlF>$oR;IpOC@_Qt;( zH>8^107Y^F`=I~F7>+U_AY(F)cbWc!uAA&*5WK{25r=I}%z_rxLXV~p(vnTy{YhZ774#>spg)a1_J4z#4 z+|Z9-?7Zg-3`Cm`Std?Q;D)*E@&8Z{ND399PHLk?;%DJI7;|RWV3uF7E|-n3z?vf} zLgB%PX^0Wpy}uZO+@vTH`>i>O%lUG2mh_rlW<bM0AFUw=>gLSB0Uv9izw=~NvD=y=S7_ZHp4T${?lkW~s69+0y3b*s^M^o(R)}PdO zUPV3^poMzq_Du&4a5y77(c1LK?=~!%%k=b*qqwfQZayt3x5)IIjYjTT+fptQ*l9ue zG~-B<9^=gHH~d_Z@OI3^&E|}R-a=OEu4D${h$}{Tmn5yl3M#yKT)SYBDa6eD1$EAC z)HUesc|+RhqOte8aM!ZF8vKSG2fe-{V8oc|^$#Y&YlzIoJtM$;BA0oAQyDs{)Rk_G z#hfitR^xg|u!a&mWd}1-UH4R9=ez9Osa=B|F3g>sh6V7UeMYcD(Sz=er}tOG9t7E> zzico#_;xpoePDyKxUAO82LJJfg|o}M5(tt>Z|`dW`XvWe?iYqchNllFF@Jh) zOXbV71@%f`eh`tz&G6-`WLkiQyQ|G&-T1%v6)D3xkGNc!e{Iitc}PHZ{mRAvG8Nfl z*8b~D`o)ah*XPp3SSKE>NOVuFkT@$Oy1hMEo&IreyB&jCu4l~O>5?_C9O5RXApQ>d2p)-&Fbq%m|PKr0zd85nf83| zqdt4IJy)tr^t9d@1yz=&_0_QYx7xNy-gy#JGaZ9Np4*i*=QnCEEJz*uLTmdLisyoM z+-9jf+`k#M(vbF&usI$?=*TDq>*-zByPfF1{_W)awL)e4s%s9nED}VrgJ;;9=nI2{ZJNJSdWxDMpk9gnkvs{{cnYC6Y53jblpA*2lWvCJoQwi?8b z3x=D;di`X!(8dUinF>=^Z(nfTY6tkS_LH@&a)iuPj*k&S<(+i~Adb+}D()lJkqfiw z)uPkI5POospaexZ-HeqF-Ot)67_;w3=H5Q9e&)I@Q`1Kz<;q|Ti-R`inDxZaKg)cZ zx+JrKp~GU(+;>Vj%_OmT6Ey#~^F;w>5@OVAjEk?CWFu-=H?W>X;j#*pN4U+`5C zHZ_0qp{Qef$ZF|L~O&ejp>r`jl+pi|NAefzY9_y z#~<(KC^&>|^M_r=ozWi~rGLX;KS4jXJbjsXyjEr(zCmgz+-?cMd*9vlXhrE6UK3X~ zbN}p0^iwx$3_W!v30rz2}5MUl!kl{9TZUv7-=aRtUo7tmzpHX+&7>% zM1ns%V<#taF3pMz6c*Lon|999;^usF({|%`qh&MR%;xG8qN}-mL}!=rWw*k7&Vpv5 zf0oqm5hi8U{KAsabIiyWo6a!R^&?vvTqE!DYs?3QAJQdvef_VHouBy|NC^uV(BB6{ zho_tE$7zL6^UOj?a&J;T*hTws&q2Zrv3`5(`XD=3l}fiZy{w?row+DP{S^VaH)X;?o4X%>kBh)+41!$Hzl@D*NABG=?!ZzIpGV z#i&Ygh46L4c}2-KE?cY zVEtOj)Y$rMyTYEo2J+zHmbgAP{C@B>^|a5Pf7|vfQhFE=CpGbKTH=}* zWro*%2k$w`XZ`b~g_(2hsU+0B3b_Y9@=Eq;?RW2rq^Zg%@^Ub1*WD(3I*)Y&Zbp45q>|5;mNtKzy& zv{v`&V2zk6N*`c%9%>449Z0Q5zll9PrGCNnREtWK{H`Jo7hhOzV2s0n6d)}buD#u% z%sxnMlh}*@PaB4`{xTZL3Bxdao16D+o*DOYvmjeX_Hv8avZFIgIV zJf58Nqn60DkM-nGc+rPD8oHdA8Yi8IA+{c(~-vTX?$Hl6D28!Tz})qYui%3H(ioKKXBi_k^Nv>0BA@e(xQY$E+?=sy+as zuiGIb9xdN(Xjk&?fMxS`?p7x=Oa+u7*gF;7xbW8Xak~u7BGtyoo*thzP4J@D;A~Ay zwa;x8|In}D{A#r%LvhX@*yx@=Q%djD=2tooiPOXM zl|A_c7VDzjlw8Eq>tepjhj@yZ!9`{Ys$jG$5`h_xA6==Ueo&yYmNV$A_s%qT%%}_1 za!C=G*bXZV_QeIJ{Ud6mVVU!Gzy0%c8BcQ7Izn%ww{WM&hk2?4-2i8%KVSU}{i#*n zSO?V)?S&io@3PKfekDVors;5Kp^-z0Yh%V4a*6cCa>vYv4B3rHg8UF>n0cv(I_&Hw z`cqa&;B)txJeZ9}Gtp^iN&5n&Hh`Re4y2HIv=I{xN)gk#@9b~=EaQW-&+yoERlI!P z1C_l+FoRfomiBj#IdAz#AZ(*&sy=M$2nN>)eSGSJI& zbdbjgFnw54xGZ?Z_&EBa`Kmj<+8Nxd)dX%|l?{`j@w?V)Q!ox%e^9?GIR+1@6v!{Y zx+u;3V1e<*fJuYhho%wVz>?3I{iV&Y9i~XTT#kVs>b<9si$>?a&Rj%f`!#C{730fK zl|7kf`(^|$lLIbsf!VSn!~e>>s{{a` zZ+vF1!%tFt;oC7_O(n~Rgr^~o(7xWOzFGaO8q?*D)enc>{o^Cg9hpfIgwUz_nsbmv z{~&+(b&z?4=Wme^T#JgFHhtFH7OzFWfDjvf;GNJQ>^!GMeUKe+9V-tx=yFQ|;PXn^1nvm3?&c$%F=<_!w6yVmG_k zB#wNIM%!O?DG0JZpvfmrJk%_E{}J94vo8QuCy%9GcK-BqY>7{@+1w^Lct~iIOJDqu z4*~~unj+v?EPPW!#5x?Gq(v`P)n3c_6rNGP6jyscR$z;&B0@DvvmmpWY@@2ilF$J-fmzX{LW0J;0@COll=IQH`b@E(*1ocfpus z$hOKUXfYxEX4Ur=ABxhsPF1D2N82!u$HXvi$E$c;9ZU!MiTK18r`!2bHpTj9-zq3k?f-;GO2d5C0}a;7F0dbr*lQ$Ut;(S;H#z$-6I z1-q~65kOlqrunucy3u4qe`{vEC8rsQqKY5>q(7vEOv#8nKm&->u9;uKb6j~P z;kgicC+^3r2gSG&rk9DuD4Gt`R`ka!Ed~s!F_qpNy*dPU0yrpNd^$bzikH8%PYH~| zLig4Q(EH%d^7|3kyTtYE#Sbhfwg{uBO>^5@st8ux8-5KceZ5h>W3UdfsqoZmZf1St zk+vvpGqHeNC6DmWoodAVUf7o4!<*xzTP`ICMPEU zp?LRV$gwereyY`eN2hBpptUGeEP93cVu{IX)tQayx$_IJL6wTV3Aflh?sbJ<| zseU#wD0wd5Y0o(OFiXpym=GKOTK5Y$mBO$?+ja*H1bgP6_^qeuU6DqG$CcVTijEC9(3ztFvw z>+0Roye0(|U+|p@ZB2}4I3?wOJ__gl5|eyJvdd8%zwrl}Tlg=fBBA@W4|;RqUA_$5 zoNbY8R`bbt4AqACuWNNbcPf}7Quedh(wBI`*ri#U8qg(6g_KoS3rkgfcU0wWT;!}s ztrCX=CFC<$jy<-GQ@@s@x~SULj$I=gR=j~?*$ROAuTVKoRSL#dQ*PaDV>~oSC9X0;<5!fC zQOolw_0+>`DbNY4@ze@cR65+eu;HQwU3k0OKRKq{D`W7k^5BbzRLP7>{~P0_0Eb{a z<=9lg8*s&9$fe5X5Be#6L3nVnp0TF%X1W|`{!BzBKf3xb(&F7u+{H|EUWRM~7+1?@ z`i$nhM!jg6Gj$)vdj_YO@-cA^(|d2XXW`W>12LMJSGbz_0Gq>WaRbiB)c9qf+6m`k z8sUbqUDLPha(v2O@H2Vut%K($Z*LdFhWUx*eot$LKCTDwl?ii9`pIv!-yg}Xb{J_PkUOW1( zqVLoStwU<1UBzqHHu3#~r|T-|0UCW~WS>=MOYl!kz~yavcbr&SH9h(6xt7$exH3f2 zS!SE?8`lo%F{gTSt1+$Y{6@J^g(E*MBwP5&SkbSprL z3aN`X?EG48Wme~p*nn>Pu8uZtm}(;;&6=UIE*HaMM>QsPBG6T!K=n)WJo^21(klBP zVkp>GVBpu&kP}x#NU^L+hc_61k~SB@;UVKfK{?eEB$M|Ws5nGDPNh8D$4s7zPPHTh z0)_W-({cQy-YcaY7HCeIWAuI7=4rbBJk^Lq3CZdP8 zv5MRx9;%bS?-Jc{LKQW*ux}2tyHc>k94|6Sz4cYW;O;`m>j7%IdWusvIRKnt$6I%z zV1hs&T?FOt(3WOT)nT6@FFx^mKC6>hvVYPJqPo5czO^>nGTc_^5oW#?F5#EYqxG@+dISfY{OH2S7oNe-!=YJrOy?5rb${UxZ;iM1!}l&3 z<5rN$P0%NMI4Ousk=}nDTcH5ThGNe?+lmB7wXhGa2e!U@y~O;m_wJNk8`X@1t6@=i@cY|1Bd;4Hd!LQi&TicfCJstVlfznG9xUG7 zaBU3}{4Dw*nxQ9m^U4Qb-(KqA+r=bEpUlmZ?5f5C(dxGBv6PoKVJgHm_E+V`e9s6LCar^;kEt~h_ zj$5(O3gEv84hK=gXIqDy8DJS;k;l$By^7o+`?=`*nKlJu)VonOw)53Mfmn#D-yh}7 zPU(h=+fP*jZ;|E6wyqYuq|(ez;0Iiv?R2ZrK^YXG1Xj^lUW$z!^+SNz&J&Sc|x_**2s_ykVf*9u?*O!CrFO& zD&DQkL~P+PyC(L0d8!^e1i+^WlNqorkN#BtoA-+uF>_uK*Q&8DXA^VbvZL`7wZfR! zRN5-p&PZ#5`gC}-_`+W{*Wcaq8MBSkzGL--=KyhJSX{@AzL`br+9s{A9-kjiX}df( z@a#UUYWz8d<3wYJRAmq8=dmw1(5rCSiMUBl-@ys>!rvzUp(Swe$Esw$V&@kLT;Tv< z{n0*8cu_CKJkqqWK z=(Kgjy<9h7!onRH# zKQ>l2%?p2+wY-qPI`bOP;@R*HiX^#Bm?`=Fp4S^aq$w)`FMi1*6KXYDJ~td1F$R~@B+?bJ{IwTc{lP)y*J4Z4;N;5yau_$PF2-1 zLwd~D9zrI-9P@G`@|am$3Nwz)JX=mN)<{ZMI2Xi?)m%} z;W(ipT6Q`m`m#jIPT*sWr20h8vX6eYTgA>_>N%RHJaVo$`^nHCsDYGbY=$S8E? zpvd*tpqqQLpP}15Fpnrhw1%F+sMH7YO2`9zGmsv45*V_B_2M(CeEDBdkx)5c;Lt9x zF>q7NR5~X<`d7M_eRTY-KL8x!CDOa}t-LaRaS|1y?yH~PxqzQ)RCJUtCMV(3*)4TB zR3fJ8Tjc#GzndmI={q3o7XJU;^)CCRbZJo5_qG}Wfs+!iT=aDXt_d}D1uYD%(#;a) za|3OGZE2ECq`Hc_Xzl6gC*rL!{~m};UPo*Y-0?vlSCSR(i?0s9(HmiV4y{yC>YQt# zUeeaD9^%)Q_>B>%nx%B;!N!1sI6i|3hYZwtg(fJ@$g!bA#I;+UFRPPta%E(FjDmSe z6Mkvy7@Dg?yxBjRm{cok!chhUm46V(g-{r{7FoGCc1Ab|lT>s34Vam%>HJh(j9Pfg zi)VYnBmYG(_G%XJwR+QH%$=>P*s(c z4Is^!STBZ&*6;g=Fg%&AnjU)3^JvM6#-FKY=8VZPdz+n2I2(jv66>AoTvcc_Opng!fQL)g{cCW#xFww{CYWNqMtb3>OkziiuXc z;jzy16Jnf#fN-*ge`g)cH%V0uo!lSc3|C}ySvYq-h-l@~I17JT#9^I2Eq=Px46NZ{ z4Ltuy@#Euq(V&k5kWN$S(?Vxgd~dk>&e-sAPH?JC#e8X350uc`Bjb)+U;HBaNw?G+ z5&yY%X~>Fc?drxz#lGjVqq?S{ho+0=m7sln8GMy}#@*|Qc1x-aB9P-s_pUBFp=f;b$bXLW3xeo* z_JvKEsoG*z+hYOe*UUA2CiCM_4RXlKEm9vbybzjaM3=^h?Pv3PIWzpG3$sL!Tv->K z5BgYd1u*%zXxuKIZLxW=n+aU1yv@tMDPs@E&(IDPVl7o_ayJdGRslI;{@B<6?tqA1_y|Z%P8>^h zFzdZ;3d7{CoU$(+b1K`&wp<)!IsTY<%&P%>P$Q=Us{ki4*siEC`rAlW#IDN#qv&*K z6NhWF`{}}?WUaJ_FLH;V^GCpSJ!N>u(HXrt6}=5Sb2%!C>ux*Tc7;{djO1;3+mwrc z6&yTt02(G}h#ghGtJM6pI~nk>T2NTk?y5X!7bEa?t8!JE{h~vOW+7E|CiG6;KmNBG zysO&5<8vUnbkEQAU)jS)l^a<{(Tq3Fw;X>6*4Ynk>oiSu$9 zx3g5pEYT}LE~Lx5pxDh<)EEq#VG%)r<`bHSoB&u`Qt?(M^u=lR%`u+ge$mJ{gA5qe zXy4wp>e?jia^cx9qbP*=#{mB~nJd~efX};F>S|Ey_(%aSJt*T!=S#J(uj^mJt!;L8 zmjC=V(+brvOD->Y0zJJ{uLFd&4ynL(D{g5j`=nImy)unI(s8yvpoEsiEY1H8nSsg+ zIU)CBe_{k+ubE=osbFpp)tNc_jdzpbwNt!WW{kwgmFiiy8tHz#D4atqa}iR2J#w@22`n2(d}lO~S)U}C2Ed(LmA*h}G)vJmW1gWj?%dIK220aZUXtV;=aTQcm9O)Cm# z#qn3Im~RCZKE{U`&Md8sR56b8*`h`_bykK#Q0P>JH52>??B@uwZBd)IUA4G8_g#tV z2O+|I%oEdb)02NV52A#Zkyai2kLoaOIWaT*u2!%|jC}QNKfM8)M?fIur|)9;(rm?X z`s6MA+5H|{Q)+agj^-iz-4YG_Civ2&b(J5I65Ij4m>uPVDOCr!u)W1dAb$z$NDng+ z_oM^l&&I=&u9TfILcZtXjCo!W#||0Erk*bW8h6MAr@av80$bvDmPMGK{Nhm1PX4G1 zNH%x>Iryl1s+r0Pn}Ak}yj4HjmCwA?!2+&AqrgN|20y)&)HN{Z@gd_t6;(UfQDm@C z2~ef`hraAhhyiDuoF!PKUjwi_GuThspTc6F>KWTwB2eXh(uM8ikG)pPxVqPj>>Ym1 z1aiQqBltF-M$rjZx7QILIW`%icZz+J{kBgueE@C%#gu)vGZM3!bY;RQxzcU@?J2M5 zMAw++zrj?WGz*#VH-@^}*Vp&r-Uq%P6DHPxwebl?F%$}Nx(bzeO*`swEIbAVUNTI8|?@Z-^Prte<_=NRNmCs<8iw!=oS3b`E6LP8Y5g$A&;>2zoCi zy^vVYF4oH&T$S}-#reA#0l4L5_jE#H z$;&nwjT#meN{z=lbl=K-IGB!@#abd-sBl*NKq6zF)93FTPNBNx|5Dxt=L3m#kX+-I z)4{FWxN8C0L7al?Vav6roQ6hwj_$LIyhhab8KFf&QiE}x^o5^~=E?u^RE9na9z=~NfAiC={b z6m>;ovtp5F=e>Tl^vboj>aGgW{FS@3Jf}u{^b=1-4xh693D~ay@(}4&Y0``XXjCdg ztju9>hX5%u>yRx?FkD*v}hO8?&LMERQ>3&+&6b6=oE;IsNCNiXSS^ zxP}>nCT+)OPXx4K7}A-xe{L`8?Dco>6evDy3dc>NEkyS3Gkr^h&sK!{tH3zLl#*hQ zvX?Qwe>#!s;G?Y@pQp!Xx3!~*|6V53-)Q1zP3j8`z)LLfT;&eb8A}-06pLC65IRb&&+G2D45En z>kQ}cq1{X1#{;dgmqd(?YTuDk-O#+1*i4ZhB{QwEr;LN!OPN5rFU7nWGZMV~ePlo+ zWOS^TL07&`4QK#X5un3~_

UB6~pwbHyOXnNDq=peFKVq>8`$-lDANmc(3&q{+-k zG*Lz{*(SZMIjt*;^=dhRxLN=>MrCz8x(nLhDoPxZ;-&8ncr1DVH1N(>j+E_JJM4Qt z<14gWJ-`%GCXx%lXprZ>1+69)K*4RuXZta(wpALp^UH?3Up;>Cf-7d87B z$v!^}tRZJ90+3OB1(xUHu(82QezfG?&+mE9=fh;yYq|fsc0c!8yZ_|XRIvn$7CQ_` z=`aAYtvJ4Ss1gAA+Cmq7!|Hz4GGsZCM_hI?soKNLcJx3TgCk-nCVVk;}1{&Q}*rb_UEId zpDEW&-*#J|g8N$0%DF1&Z2^{Q0&HWT9Y^TvcnS>Px0tcbRD$(saBDUo*6DA8O@1ED zwcn4uUNW1M&ENQR<=s2NHot<(br4b4pQ~B+0+$?ago2GwC|jf7jj=kr0T%94K+9FF z;8HoDSgZ6}Nx@n{E}>hymB^?(p7$|!65}Utfla%#a|M|N6FzwzkN|Jb1ZAnLuq^p) zR1Wt<+50N6C~=rSN{$Q^PzY8C>N0;765-tifL}~oTS{*g+mnnwShI;TGry-+HUwG& z>06qCM#X0z8C}OUp0E$PMgsUf1dxkzRUFQoa#=1_XiiIo^3i_v;$j7Y=kJEiX|Oac z-XQAEDQS|>=#cV^nQk-900xr6suPJ5It4?@fe{6vKLEI97V~G;JFx;U1mZ;8p}{dw zM|hstFM%4)$#A&kat>gt@)lY%6rCARD=@cG>no}aP0*}@_S`dS#fPr`;?C5>KKbch zvf%fC-n10e@Y3Yw%DeA%uD;Liev~O&8BU_FjJv069QH={9GIPFvt+ZdZ>X|u=zywH zl@j!YtOyCE4rVJu*p_f1f$S5DD3Ulbd zK3Oq!#dMCFrf|Pwt{2TEv)gQOY$TupY;n@&>~||-u~mT>E2IPRku&u#{FJqSx`?lU zBkinOBXxImp*5Nu8ZDuIBY-EgTpbWbJ!286;CWeG;YdoKNO#PFUiw8Ds@osr)snst z=VgKq`|9P68c~e6-_!NW1Fk80zG7XZv}! zp9PagiCs!qa(swRwvaKOHU`92s=J}=gICtQ4lAMWUfxkZLMgwl9cqvDVE@9!N|zIp z>OSoX0iZKW&yr=tnk9ixPYHS*p|M+~nc4ZZ8Cca`{iP(D7Q*eR%YHWSETJw$=^}Kw zKpF6+NE2U9U{4d73W3cv=PhvAd_b{wG6|+~?)dsF<%^~2%2zw#cvnfQE-YUM{55>5 z1>32VYX81M>~(+-)qtmHorP5b7SgeRpxDYL-&$;>M1`ndSCg^}dBex8ix6m$UpH)C z&S2Or?Vl;4HCSjsyioY_@L4f#vy-`}D5vDp6w4wD!5I4#AJFlf zmg}3#_sS_TOufrIe`W`;ECaKw2Z8hLCASW`d!a7_JajO)5w5{?1Zo7C(MqoI-(~Ww z*B({M%F5m0Xs`jHx4eeX)#ErbZY9-atB1}*BE41y-*j|&RLFA#h@XG>kz}QRe(!@* zSH?yEQ@@g}$qZ`MPB7`ucz!LikgTh3Ic%d^CM5e=Hx&(OTpj}fS0Og9$Ww;TDWf~i zLl^&1pRV}vm50wgN(Q{J*6F*O)Dt)<9}6;r!)-1}ciZ9(=_<>x?V}{mdu(T7UC=U) zR(nx)r{??Iw#NRiNRDpefA3Fz|1U*6LFh0CAHE7DgUsbVOzk^f3Rx`K-K^wTx}jSN z?vw;GD@rK};@N8OQ^2_IeLmIyH8nKLh>-C1=Qc2db&q20Eob~TSE{F!s_1J3Z~%mx zPzW;VR${xkn9v==Lp;pLW-H*oe*}bkq+T+2OKcZ&ZCA~Jw?=;rynpDJ{idE!B68Yy zBQ%rAq5w0W_5|?JB{n>BmeWdKF{f}PHltmqlzZI<`CK9^9VYQhytxyzL-Hh~)E zODb5ck)7ilJKC9IwOOK)y9f=pb?Oz)XkJ)r;S|s#^k;gPHeU9tuxxCqxioYqj5tHZ z$iAw`FSI?Vio#_;)XGs$@NQ+zg!eRM^Bub}&YrRi%?tUngyct41W)XBLi-dmLzom! zl!87yD(t?L=I5g|OXUy%rg_kw_l-p$pm)9uGXkvrcA%(OK)S@MZM={>SDY7fsg_)~ z!Sw4vdip%9i1&JrjjE|WzfrA}gVCH(wt*Pn;MZHVM}Ley&}GA){(v<3x992A>@fL( zZ2vW#L~b#Oxa`gX^|`+}!^B~TdYP$uMPe-9Ak}s~ROH5TM^x$r4{=h3I*kX^%vB&YFx{%hrb`C_d3}wx1t2Rqipwu5if!Pq|hNmc`bSu0He-+S=s;>RW z2IMgrAJPyfagQ_vgWjG-oyjLSam-ZgHJ2I_vDg!#h#=9j9G-KS+I3l>G)auIPc42( z&xOw{=U{${HACE%Mb{r_6P_6cJz3EwIq36hWa3jRC=}ioR6@CMLv}bJ2#lgS%A)lV znA6_3q+#eY^bI5nEb-60{9|-w%`UV|_oN%1V4H#!{ddV~mB82$bp?t=wLZQ2>eUSL zUuPN*W6lFT8G7KIQd-QnDfq?UsmZW?L5l_8X5T8ax;8g7=t0fLwzp1Tlbjg{yTtST zmr*5V-+G>C?LjA|r39+n(~3QQLYtk9R?Q^nkX_oiaF#%fXow`MGi&PBfWq zTw4pvF6Ms@iE+C6bHfV9*ZBCORuJwPmx&KKF|yjPx|Vj|u{v9vfoP}pLyqQOL=K{( zv}U>YKIE%4EmEYk`}-9MxuQ!SCvd-cdNQ}V+GKgHPyXKF_auJ?!>!V~%oglpeTVB_ zB4Sq92J^lCG>cx{5J|5H6}ZarinbqoPi^b$?UCa((`?8z!5EVlGNxkLEUmB&Esp&GG@Ad!OC7nw> z({CwmEwBJ_M3DxB?^FmT2w-qiKEbru|aN9cag;VK!$oAnQSF}iq{YX|(p z_-wmkZ?)YHKNYM-YVo4Up+MX$@91j$Uq)V?=q{3)9<>fb{l;KDL{;KqQw?mS@bIsX``i*7{PY zOAP-B(*y%kE*^W=GFOIkF=r2#|2>Pq=?_Ry+^Gu?mP7WWQSqfPi*h7`$YTYCKfq{} z0=V-fRyfYz4ivyPGCtc17_MDmjVpdc(IAmALK$drETQNs{jkKSNEKv*amYLkv7g< zi=Fzz)L7YUTu^>SDP$P@_b&jlOx^z%Yr#3#iZma$qB0jb>SS~QGsgM&TD=fx!pt~V zuvQ^g@3)%#f6IsFq?`hici=4xP0kTwZ4Fxfr7a))J?h_d(HY{mh@e@_AqE z=!L^U$Sg*CfqEnU9~JgHvXR^WT{UnE$RzB%k<&g(1qd8dOFleE5B7f_N@-vVt!n5{ z4>HTh_{tA4%vCAP)m`hg=yE)dt(xbmoL)N^C5H*qYo)L!D|w$NM{lq&2z&|VN(RUf zQU>W^iLLC!KCbvmzaoI~7;a`m7!ldN!0$GjNH`OUs~7Nm^$!)2M3u4h=v%ZxPfH^k zYZ`_NZP5KyA?T7jT9d=(CF{YvyJ2ha^wpca+>tR#nd>~)d80sBk@WLh%{K|dr>eF~ zA9LKj=XMxDy;^sm8Qe2_C)EDR8YQ)`^YbUJi7V&^i8S6ON5U0#*;{{(kDs*ih(U?( z^%CN==5!=p<;qj#a>%vG$=#!>zp2p7@zw{K&nC^SLYhV>M|J6g^6|wa`23MxO{x<_ zOT)joje~qj8pk{`Bn1~x#m@MFy!M^?7zwC2-b`SH?>o3NX161Zqa~Soi|OK1$yrt< zc}X$#PPz{YLj5Rc9N}17Gv^}z^Y>&wW7W_jD+&aB*KLf9|JYn?T>Glt4*vP^lvBKk zo+p?3q)VSjEcqwJn@4?k#>GLV9nWPD=&|}$%i2|O%^Gd}Od|y_^B&>DE4y26Hz)A) zT9YYAB~SxCTO?11NiKi-`RsYj*y=5}1upiIbf0>e z7}I*Qju>doJb*B_hTI|DXbsTfG6jMfAlMcnwpu9MQ5`!^Bwu8sBXoKe%)`eRFlK*Z|B`R(;}(kx9itJ^ro5&_pR$v z#)_m@)F7C38rmF0`yO=0r^9V)z&oSvOmW`M=mW+X9p;P}CCN>5y0pdOM#I+A_IWp5 z1`b{>pX@Km&c={#%mOj;mPzsXYK2U}k`+bM+)eH1Co#p(}uJot>F}SMnZ$Z)mYM>_G`)?R^E-6#G>} z1Xj{?@BW~jqu_eOSDYH@9zVH#!=~?J<9> zjahegFS}vXGR7+pX1u2R!nCkV;L_8mck&}_xwpN0gonk04ja@ilW=tdN=564O56pd1G)>2}0Zv)p&x_yh4Uv%{a-d`=WnAgjTje znJe&4XXlpf*$_U*x&y=McDUsgipH^|)(^xFsi_{iN85y$7d8<+ImKvVB!6Ig@2kpO zg|EFj!Kx(r&5atYts8%d@%ipSSK~8_O4|b_{Iho*G5IO`A?7W1=*w@nOH{pgFSEPg z8RCx*Y2VC9Vbtp=v=Q?pe{Dg0|2)bO9&>J*)R#}G9cOTF{8K-CaU?%m8t?a}x8Dff zB0O^B*@mIk5^%VgqSb)^efKH&EbB*Ui$+v**%h+ zwn~vbyM|A?n@@5te!r+?-j8*X>3{!y?`btN>K!y-X2dk?^(vC^;{1%Iscdv-YXH!n zO*(zd)O`2H)0bnA7vHQ)9YYf-km03HZ^AKW<%YbXe$f0V{YIIZ& z6CgM)eiB9FZ$5mk^p3Adc+4}#Ij!9!_RS~c6{QY|2(y)&5YWyIyAQ$W3xp1zbPwlLM6=m>krvwbZ7 zva70icW`%Z`wG4WvC7&_pX}}p3p3Um)Ps1nhZkh@?(8*W!>;NunFv$g-O(usRp|N- zQs$fIlsJ4M?4hR2X48_+d$?p1WK_iVP*HHeD&7dYx`&go=%TFn*gf18LKEKR&ZdOX z6H|(wnz+58D^N0t_Sp*Syuj?UIrkvPzdiHVbsI-BhkE~UuO;)HV6*eZfDFtwZkvXl zo!gb<-Tsk^J4;AZMxfTu&erDmi(4zGzt?ZCo}v4D`3DA|sI~rClH+j$513$Adh)hk z+M@#Xi18iq82xu-Pm4|38*pPrYjxHco2LU_7(M?POj}lK@EPg@Kj;c-cFWd2JQ87z z6g8+t(eAAWVyzD(6Dbh6B-0Up?`6>MP2nbTC{lkl`5Hi9^aIuEc>KmuUwwuozZB-1 z*Jd8APLuNAfH#m@Ogt980Uy`jUrYT2&xq>m*+yWBL4NBX@YjxGpgO&4?;tuajgdL` zxJvds+`F4jd%3M4z28Qal9o`1>)O@>Q zY=sRL>*yJSOJK9W2{oG&o%d{&vX=R>fE=$p=RSw6Q0q?YT{t{e?7)wj`Dz)i9TYWc0;R23 zEQP|(UE&&4r29VoujgSbYWxm-K>`Sa0#N56W%I(#{!Dj8fzb-zzwv2rZfL9tfL9T~0# zc=`@Hs?}w)?igx+rh2V^CT<@;$pyMORUP*-Uh+tQc{I-IP1;`m8C^*YRc*cz$rPad zyIzN0UFI}rrG~0-DM&7_T^3BcdDC^vF z*y#!Fghe&TCzjIsth>6KQL>M#F8J;1Q5yxg7ky#Ef`pMQ?_t(@I~UDiVCkn8MRI+` z>LG3o2UeL3sv5*iBRp2_#@r^hW*6>PmIUa!&p|rCBkpD zeQrXt_GpSPX&$p9KsK6|Oy0v-11QCXH-0huIzZ4`8z|)ZXkih+*Mf92wIKC(e6#>}zhmUASTT3b4(r^# zjuFep_BCDF@})xIt$(o*esCO_($^AZXZ517Gc@E`3=U_8&c#Kr?D6wByp^G;UEOea zFJo=8jsZFk-K?gL(nIcFU*G7N^hZuw`JkJ5L0cF)8|G&_r1fAT~Q*% z(iA#KkJzj2cU5?%;2Ze=Y=ysp_dhnsrRRkM?3ruS6d z8dQxoKGX1{_H_N%Br(i zl?}QGfLTuCpb55L-yGL76aOIqEyay<>nfC%MD^(3v@gpefJOLI75^e($wX}}vx*aQ zP))cE!1~-JcWCO?+h*3k!Q-6So)@3oop3oCvqIrOc2{X*xRWpNI$u;H{G6iy>T-a2 zn9DhTn`GZ~`<$IkmiXu)KE1tIPi>PH6>?@E{3%~usTsygw5f@B!-O|Od><`rhCq+- zVSJ*fUpMVvxZ3Jabq{l%MZLc>9S)9{|HTc%|uvGv|0`4^#8uDJ4_Z)KdGN_d_< z86(H4{p);iz38ZluR@X|bcC-8N)CQ2eJ5%q^C%lJ^t@NdpPq7i|6%)fP2g=vTky{j z0kZB79o$JTHQ?o=FYBMmY?Hj**^M z1Z^$dzgvLaF}%3kx{<+CKy_qix}X=@qgi!w<~&u?v$H^8x>qI#=Kne2559qi1B+R{ z-}ykels!ia@tjkyJ7TMFY7V&6eXlnr2yLTV%N+0>Ej&xF+B$Tdbx9-Mnaa5MErr<; zbi+K{Fe3CUIW9u884-UJ^sn`U4`tW%ztJ;}dy?)Uyt^M}(pNhR+U!NFuY1s8G$F{# zcNP8pml@JxhqOko2P9EE0#}|}s)D#qy_A}HZ?)Ds2YoOKl=*CXZM$FIm8q){DWfj6 zi=d^$=(#5G7?{752AyX`IsV`W`gq?T>)*G1&4GTQ%272&>OXu#H~dAYz~FhM+MqoN zd|4vzCs~aPZ{+@XZ%h9Db!WC3UjO@bJSRQb#aP4p$_lE;>7yXn*=7y(wtaDQ8EWLu{k0F&d7`m5*b6P!`YF*LpE3Vp zfk_|66*p)C&)#*pe(u9l*Yat;UpuVh`v|>A87C%2Y%Qpex z6H)xukP@@8>9_I~PK)^H65l>S()$gQ^DlO&k8Amk*vIro3K4U+K=b+O(3ytALp2zi zM_iw>AI1>$vJa@={c7l&)GRNukcKU)JJbfs6_Z=f$kTYb70e69f~`~H5ooaz(k z<#{(|YAuZ&s9!rChY0SiZy1r%TD96gTgEY8lr~|388T%(!)L6PqMEGIuIuw^p&z^y z$Ip*)-wk;>Zt5Xju~AgBi+y|PCza!WqW+5iKOBx0pdyFZ?$M1FGico4oyc$?!Ol|J8xA~%X;QFuh@%_7YU%k+4c_C}$gy(nh2#;_Z&z{`;5B2na zsj?rR0Ka46{VaF%{`CXJ-&aYs^yN*bS2qJ%-|{Pu%GhkVNRt0yVy+%=K{lHAu3&99 zYlL~td#y|jlH*h?h+;>)Y&t(fIMiEQfL5QnhdZvwJh4KP%MhnS$L9%Y_MN9Ua^5}{YjKI@q+kX<*jj4}3|L6+=W_O0x@n6bC+9>@7kHSnH>)8OtvoF0^2(TG!3{%VL72bagCZG6d(@Ryb$BqCB#zNkxh*D?~9W+CG7t@;t+E3m=O!bUb7?6*cWD3_?UiOK( zTNpV2T`MR^(s&V+vvpPQy5y(GrFy&5a=FWA$gy*_H;z6lkFuEhHjK80xAUC4R;aY! zfVHC+PtjnBzbTQ)K#i*2_9>)Pi(xB@xcEw0zkn0Q<#ys8Jx}mW6Pa&?dzRJ)a2I|< zSY_wgV#Q_d4^{X&>#{BhiO~vu!87@AolQ>T?E};nT2ew8kB)=g8qJ@~8Qvp7ZsveO zdFq5c>YBfQts#V`N$S6<`~UV70`fp&spSd}U=@+Q+!r7&gB4(1166ACq}}QYS5c) zgU%YcvunE5CJETAnCepOGHZ1Vw+@XWILN5jwD|!|{cgF21AeZzl{`~p(5(lsuNn$3 za$jncM%5Wg9GewYB*#%PQ;fNg5dz5R6f4nhYwB++Elz+Cs5lP}?)#}0v+`pBwJn_N zHD`(@`;5dd4_@%iCjCR$E{a(D=B~z~2O`ROx6$)TAJ^UK^VxM&4C!`_k}y7K!COy3 zx(Y68y*V%VGXHf6RP<%BeA@TylwICftZLF);q=EnqxuRD`a&;1GNNE1)WGO0xt{w; zU6CHf`^|yk4*?Q}h~HIv@!Ouo|97AI1_3xG{`67$2rY3W73OBh`|FRQ-w1V%Cc)cO zmIT;HJ56+>%Kk82U8H+QtG-Q&g;R~li;eUj@B&NmY-~}E9DFXenDg_CcI`Kmks6#% zQ{h}(N|95qHF8bipDVfkmImFZl>PNp6%=`HqSDuR#kDVLWX!ix=LYQ)rQ8UpG`CLn zao9iiXJD~Np(dBMoORn<{3hFaG|?XO*{h8yxl?5d~Y$?5^V;ucFFyqh0ZS1AL*db}zG`83ID%`lTZvJeZE;lV+ z&h}*lB-YUH%<0>5`3tksC9P*L!=OLT=A4v|gdV_SWpWs06n}%0O5AP1MVQ(JsdH z8_@xT>Y(Al_4fW8V}TCSblQh2MwnxkcH=`HbkL>iL3kIg`U=eS771K*30mbU0Wpgo zI!^4O0db7HEYWVwBcU>NYb{mc5c90}`L^JRa|fianw@n-dKO5VieXY9P*Hd8hyFGs ze}BsQO5i)15bD;F_mcafJ?xaDZ0gY^8XCdxLw+{5#?xd;Pj$@s=>MR7hqKz=mZj~i zWlmW?h>4yi$-Z( ziZq;5@V}|=f|VDS<^jw?HFUtb7GF1rZatf&Nd-mAmhx=T#JX^)MW3hLTVZ;EzZ*k^ zS$bE|e?+*YeijP%e*gFX?$gvU!gosPSW?_*<O<0tZy*v_D^Yr|?t4;|Waa%kYTERi=}*t%)I-8d}B zjw8~zzEK6fbz-QAqxbpV-u_mJ>UsFAG5CGAFP9(06Z%%)YI^ejGU)!T^i>9e@8sP% z{&w*U5l`wyZt`QwHtS%6CmbK_<4c_3?ddHTIJ`e1`PO7rnw-O2rcyHh$XJE*yqE4o zYnC#htoyOWm`CTwm<=~X!}diJga z<$ws&o2O**UpHWvbH$C7_#7sy2kq{$o^ZKMD1ttB(vSboe=v@MPy}Z$b6f@QE{(h@ zR7$A~PsB(Mc#R>L=UZN%w`-1&XnS2!+AGi+y2O)wC;M7m#7cEWcUT+$l#V(t=$eqWQ$8}PKxD8KGWnmSH>)xlyv1C^ET_c=g%@O%Hc0Rk*Pk7GU9K2L4^@9 z`>V5&{C&jKM>CNN>4=g*G9v<}A9?m@y*ndzsEi9z-K~_MHKwF5YtT1YGf6L8n z2yU>=Y{kM2`y=P`~}+CZyb`xiL9 zCH6I{EUg-Py>u5q1&XIu16+|gja)Yt%cd+brRS8%aZqMTC)_b`JicGw$kY7KvnF(iQm8ER2<`dt?K{o$u_5pq+g$>k6# zn(xG3OY~-ARqhW}m&jt>7M>59o5qHn7ai?*4+~T2c8!+!UiXZb$w%dcE8N|ND*p;@ zK2Ph=V3Xr11vIelof)UD5${JEoyMF?YhZ#Q$hIked{nqThU5CB`@xpLvE8OD^JnX5 zA8gAfI>J2K!T!!NFE;0X6sW9onqI-Kv6~vqG+Qu0%2u|yPicm5mlPY+7g&

n+|ER8#}+38l_xy&-InvqOPwI^$3es`s*&Ne$z zp#{{Q@eIJH`5&%p8$fs7O!BeL+lJGI@B!FT4N~CVNa$tar}}9FK?7HI9ooS1zrRmEVq$q+ z?>9!zX|kJZ+{G+u29}K)oaajMBU;_mIW2L)T(eL8Y@Rl<(F)CMVd@Y#8gxVhDob7t zC%vOJ-XYZ#NSOg>RnnOx$9R(&!k80b08N&r8-hwI@t>tyXcRWL*gPCYSUb~t%_XS{ zEXhK_dSDDf4RM6i5mbXBe zTj?JW>=l14uK!NUAp+KaoKYN@N<>eF?Av#Mn?Ae$LJt?SePobw2YiuwhBzKO$CQ|n zu0PI~I?rQduYz5h48@cmTzNxd5PzW?M^MZ3_g8gr09Cl~6vfVIeab&5z%QvNTmn89 z14A>d+;+7}DY`N_`}CGa7b|PNJ}pOy)xPa$Zn?&coDhbv=mM`1@Scq;pDLE1lzxPaqjQ`CO}NaEvIMs7W}j|KX~J8% z+q9Ad9zPP_$Tt_LLE!@ou^LH&KLDsk7WfAz>!q&ePiy^r0-QBOFsX)o+7trjH_Gr1 zMeV9zHTeznlh+)D*42@I&ybg>IQG$~fla-k*Ypv{C`A#fY@~7S$}JM85CTAjdu2ks zDv{WUDDSA72ZB#d#ES)Jo5ClV(Nu^dNV0a2t(%%|k!lFP1%2YB|epZkzBd*iu6y!xupP1|7salW0+r zHP*{X8#rHvQ~ho=&t9;c+3MIY&%-@VWLNdpOt?jV5YL@8Dt>AH^T+}`QNgYJOrhc< z1JEruD-r>A;jxw&cWD)keMF-XC@Fw=j3>=k4p%Q5uYB|D7U*g32K-@9`^XM%)PDOa zhasAxC2Z2LLnenWs^5lzis*U&46Qo5h5`WOaZ9~|7*$M#7Q`D_z9`HXsS4===>^Ie zU0EoSC>J&0WbV=6F});B?IVZ(km;5f&p-~@6p^<_K4z(RqlHlT{)_Wo`t%YuPFoq( z6r*gVy)>dd4wYkempJY3vEt6ww9k95ey7+u_zffX`{l%YF{wuuP+*ho=Fti9oL3K! z1>7{i989CRpXh#W(!ZUr^yz_pBJy(#`@8;VuvQJbR!3oh|4`QHuoDpS z{q2y)Ev-gq)%xEUDs`}5WPH-5{(~ChDGL~*l*dVt9q~C@V=8Pprm43ZTxt&rp+=Zg zBS$-P-t1Yly<)U3=0x3wkk`E>(a#zzA~Hn~Nap4J%KTzxcF2Z!LCY&iwgE(;x6Ee#eyI0PG5h(wsVPXKcL? zdN(qX??ubU;f!yJ^tM{m;+knl2jqx7@;GR#6d?XwD7=h@{PVdBTo4k$iZM~Y9tuDh z!jCkJJOXzI9jyjBDwu98RvWZbuXgUd7Y0g-qImj3QPH!ge)o{@kUh4}<;WPp(j(hC z0HgQi?WaBwahn^Ikq8@S$;R!12p zTXhoJ*{(sbj3qUJI6^F`9E@|iPhO4e*%w97hA)M1lxVWSQil@0rvZ~x(BX3?Q#Nqh zuz@1RXkLTzbpey8JK~!MN%W8^wWSE7O2JUhUE1(xNHK(FqLmOS31(^|RQaZaCH9@` z6?9xIjR7b~&`31!LHreLu)2y~HZ}S!_TczlH8($(U*c%`gl%gR?ul50K%g;Boy~B+DJ)ueq zZ0TsDLdv-y1;OTKAF`my6DqToJ5Hu;=td=jjjOrNhVfoNI}u{YqTRk{hNmVztj!H88P?`m-Dl)6AJp!jitOgSr!;U8MW zQq~z%C$s-@FNWWFc=6yLOv?8)_rPhjPS;Txw{^DGx9mb@@2d}@WxN@}rCf}bYupJs zbR13sRHzMYgq=1dEb>OyiNC7)bmYN$Z;}xQV6*m|tMfng8Xzd3z54G7L}@S!9v^to zshtXL!NQ#Rs9?9goH_}>AI;+hDjyqoHz9X=JsQco=UA0?@4?0TZAPeY6W3`w@5u^3 zAty*N9sLtnOwo<(no!pO?y59Ys`j!@hjI?z4J|H|EJa3I6QoE9GNJ@|<-!5W79Pu)mg0N@FA>GH9%o}biFdrpFK(j9}5Ql+AS zV;z|ZIWL{fTBv6GU&4qiOwm>(!EZE8Ey>1R9enYdT#I>2AGFfX=V{6zS)fn*W%%eX zoa{Qg-@9laP~?*j)M&Rf1WevRzJi1rsN-5d*#JLBZfS8PW>K_VU0LFLZ)Y5TGv&Bz zc;)6|b(;cD=bXb(L0yxs8BTCuj^6d;3h)GvEP3u0$%-I`DDL_UM`sjR-SQlcF^dEF z40lg(nVJndrg%?Vu3-}F1O|*85$^6A3!k)*bvbS}KwGajiPU@Cb{MnQ(gqBm^+pZ- zJ0g0HJ1veXESsaAv6X~=$zkaBHZU{AQ3;K;)!2{X+Ce_JWxzB8U%13-VdYYCb(<|} z%sAO?cO|jjjUZ%e8e{ahalInm)t5LdJ>4{4a4cUT00ZLHM{b?Sr1bNVmXn8+bjx^s=fn{ExUGr`$J zuWV(#wM(jg!v3)OQ2`xFWdt9ugQs+MVwk2iWrkqyEAidPBNuJX85w_R=~=4YggLG% zhY1ygyzL&Hz`E}8lq~Mp<&R+6<};IaSsXVFT)#SR@14_sa%b)P=q6t)7jfv(N%ILw z+^5NQ@6EBujU4p0(}NvpY9dneZ3DGnI{-GbAK^0lqmGB+EBq(|N`&a$4 zoLs(!1t6#<*~S9P;~agxV=5QtI3m5PiAxe@FKD$+=JP03Ff)4Lt&NHs{F>&PaDE*2 z2?9eo&5HIX{*n@W_Q|h60K&%^Xvu)QazFAWiPwOmj5MpkcJz^5Es2&deSS&7z7!}A zL5b|{GXV`hM&Gwa?WBur>Ww&9(+a563rWVl3j+Vt9{x7;>-S3Wkp+lakf=QNm7aa7 zdHo^Oc<^FtsnCI>5WLKVnbF(6o-+s6(kAOo?3_>mPI_A#q6=rCa;~18VuY)X!ypDh z!T>{_Vru6&zWH9d?Mg7`Tt;Lp|41juynT=>l$q@Ita84<)ztnl_D3L71pQ3C+e^VN zy)$)dIWTi7;{1L38DAT)zTV_p*iDaP(^BMMWm*rpm(m|Zp7p4mMz*%Q*Kfb@mNeb4 zfWjr^n_V;p4agTKt(Mt64Wlyh=C(Tan3OHn-k(3wc|JXh2e}xXz}07VU&C&6HZ)^@Yi z^e@v!W6Lrn9|977z*LFbv#fY`jF5AH)2I|NRu3jnzq@T&*VTB=Xr#uy0rfU?yttC2 z4kLVxRNigy!p|?d;5u^LJPG2iMD*^;#5fR_U$_;_U0$K%T1(X?I!;LbRJzxrP}0UL z%V=ikvkgsvcfFj52r!1hU4@^3!Dz>QC{ME-$ z-gsabghfVv8nx>~nE{`%#FP5kz3o%|@(?yI4TyCP>Db-T-cLLP6(5qj%+MammzoKz z;!gNG=S}k3==ul;{e6A<%!wN5B6Me1JdVX)$rR{E^}Z(TF!B}-my(bLZamYfuPebi zpE^!WLOp}Km1^DllKk;MXh(8F-*>fuvM|K1x+gQ&`I!a~gDQ#!dcjUcyFC>riR&F+dPKF(B2;DGjQ)H*p|0HqXE(g<-Jv)K z^Y?8WyD2#sKSwRHp7rS>aVE`IXuQPCVUQm&U+->Gg2fa0EoYxOl2rHZmawGjC1NKz zD*eXt95cK}rF_>y%fnMrtYk-(YMmUA#MK?4c;e1C+0ys=ZXfL0qGJt=C!;!FJ2&{O zKJ6ssLi7|=f9xQ3%;ZM`O~|UTRffR6g%q`rrf-J87u}%r4P@LaLu`> z97X#5j(#e7-u1ackDWo{1I*fuMSmp6zG=5ZR9Q9dyDtA@wB=+5e)VC77_ABk(( ztnEVe9_e;BJ%ek2atAPai=%niBVN-tUx4vVYl~DCd)z<%DDBgQr4XEv#DwEC2zMx* z4~niemMF%LnN2}7akrUDWbl)91hkU@{M}oiS#9uDGuUL%YCnR-uI3a}#-w2B;%&FRxr z%WSrAQ_uW^(S1^o+VUH)0zSjwyLd&3hM#P+9$=fTgi_YcoU9AWiEK?*vh5qaF=-fu zM(TTjZ?15gSyHku9m2@UIAzxf0|9Zh#>J+~%=T=(Z0eczAZ}U|$g6+<1h4=KNsdXEq>F+$88t2fWPdShF3Bh#R;uX zzPdb$UNVw4i$vML$~}}Z6gwo_SOfTd`Qx_Z^^ro|)lhJ8dFl30w~?H8byE8)-%YGu zU8~J@fgZja_=Ub)w0wvu{t&R<1v;F?w!sY>t$vp{h8a7Qs_(jMIVDP)la?R29kbqitRP5P+rbMIFdRihgmVy!2HGO~Cl8)= zWGu6UioKtg7pbPZ+}*F8$0G|kM}45KQq1&3C0nNzcG4ReW@2@%EZ6E&gx|MG5_f&}sLvDn zcURtwyE7yB(+jHi5(pLi=_&XGqn*v*uL&5TuTMGRgRK<3C?$=xpU zQ2wRrfeq2G9^-wyyR0YV#}Yjzj!iFCFD^HGO}}OV+EeZstt9+>Nt?5lQQU$GExn39 z0(@ulVdlf80~}h3^|!0lMd`DWsTqf^CvD7WH*#q-lMaD>_8uc~Y`9ApsE~?~i==ZP zJHp6oP6HTs3JK@$Y#rdD&e_=bzO9Pfvy^WUyu?yf=X>@DT0%1WvG))A9uvV-zVsuI z_7MKR4uBmSmEV8=V2e3MnP&sENj!X-X(h4TQI|C$lZ3%BEt%rcGve84)DCKq_7JqD zP%u~B^K*KVD;(2b?U-yq8EtR(GE^|V+MAUyBkVX{yXlrPL-blF#zkuyHe%3ui|_V; zk;80bC%v}P=f@P~I(JIHwOEc$2)S8GmrnZj*febj^qC-1qn4?gxtP z#%Rgqct(~ynAGmG0B?{hOyO<4tYyl7YI`WogPV%R9=xa!3k@wg$<%iz;?TLbZYam-#zdQEg| z&_jgIBv(P;ri;qtHhNm0F{8Dr}0ze9EzxNKcp2f9~zdaivjo% z!tW-5ys8N*c)*)Atw$**sTy#oLpEMD%SH$OGny}X=0ZO%kWnBVT(6h@(=(K&)an#O zc-%`0<+J+n2N>#sL)ZC$bq;vg>29``h7v2OUW0O_kNnlm>9R)+wc`^RW#_Y_XXi#?ONd?oYn0$p7Wb=4~2$5cGj== za60y3sO2$)ECP>b$UM<|m>4+tsNv!6Oj}%MLcv9QxjZ7ii$#sR7L<_?yVy!Ua0yI- z5GYoaopq&*cs;RezGid9y}LE|mG{}Kg!gr^-2!NkxnxS}z(j>iL-!opNcSuEZ|C`p z2=+OX6Knt;9DjZ4wQ)zMdC#_Ykb;IKp!WfjqU7F^uG;ue!&6q`Nvw9kb<0l*p5W;F zr{v6H;0SkG^}nJ;KxVeqh$0RX!CN}~d~cH4_a>X6II9}1`afxfu%O7JQO)t~BPw>i zufju!m$96E6zIo5>zm2xcH|EL94RppBsG5vLlsplLs8b`S1=0(!#vsLO(nKpugWWO zHPQ@C*E3*1Y_FTqgE<7O_wM4SVtn(qXAJSz+7lf&bf$N#iBX?g>s=0)V461{PNbyR z2UX%ag$A_=&KV>(S;>-L3jYbtZy~cy1@_hk_6haaBr|aPve`!B;Pk4bp{coOG*|i7 z8#BpjSsqst!pLn$f)kh?MoV%1QYp4_&F1Sys2!oTepGEkW&*!?*!E6ry+txg^7s=T zF2|+um3-T_X}#SXPwTyvEfcW6T}*1TPU@YYS}y@x)u4OI`@Pr}wGq|4K47Ou9)VA} z7*)u#@o1N*BKd$d0%(`|)!(oe`u)@}j*e7qf39E#AwM<71*BYLS&)ky#n6*SGrA`$ z#*SWPqwmE9=Giyifkb%NfFe>|LVbZc9k^sJG5-b4w7c}1Mv_}&sJ3yYiyP>RtBnP3!MyJ5WF(H- zy{#u=??~?5vNm=#bJ=u2VSJ}POA|adjfMxtq*Cbbi6$8GDsTxlE|d_>BQK6!BtEnb zb5)S7;Iy{OBF>DZtOoc9d2|e#$AftN7Nz0)heJZ`;I7BW3l^=a!#J46g*%u>Ctpo` zkJP;x6kQ%VePV&FXGK0$*btiAk9oZq)ve2qU}u_)+9ys2cKY1%7aKW12A7y}qexaL zvcmqIl~g0i?>y@%`)`sL>-tj~@^>oz>JB_V^(PhN4Kf;FxT7M4GXTQ{U7$&H?Mi3^Su6J?b&MM7we2YSbRCIhaSlw~&}QK&nR;Kw(0w%Y);Xer)}0 zzczs`V4HFZiehvgeduUkgLNA%)wCzNtWsmEm98-pKlzy<1@o&1S~t#ZGUQh`#gE3` zB30&s5mkasBhDD?bS5kD(uZh3du9j@5V7x$5JZSZaTH6nn1X2}2RCC;bNKr0Rq2DM z4O0DIX}5;Uujp}F1NUn_>~NB#5S}Ph9%eq#_F%(YvJtF+{EcOfYW2gnRK%(G4pb}K z168t8Gdt{^h^8K3)iy*4j#ruf75p*wHorbI^@9v7_Ht|=q7TVG74+d&+5`vb|HWcNo~hN4LMHIJ_}MhY$$?PoIETTAl%>gXMD zUT^aDLc_Y{_Z4?l8vCr!4!K3;s3U|e4bHBRO&bUaa1m!D)#u$^`74P(YZtzJ0ND47 zgs(iPKdN@O67z2PzFKSh>akJ90(W_C!?4X!0l{;f|?nvrDENiwM5DG9R`~po1;zy!RZB~y|#K+ z;uIx1n5Qy*`^Vl9Rue4)_qc7WyE$u-=Oip-e0scGNP$cIn$RMdxm^8XydE9<7)xb{o|@noOJ-XTFu0==RJVT=@`Lx!^K56Aa`uVZI$oB!2sKj8RY_rBL+tc^|FDmHlLxD=pDLfT zubp%b)7qb`CV#uP5&cAoI`ol;qELF@8Lr}>tDcR38QLgQrAx)6jL725USkf<1%r|&e&O#EN5{S z^;PZ7w;-7HKT;HAeecZNIhh@Vu9>ih1KrI7pnKog2B$bw4&*n&gBnPIxlobDy{9k1 zjg#O1fL}g%^wa4J@i03$H9be(J3h=3SJOrm-(>E|rEunwg+owoRoaE%mz)(>L+M)) zC)V|f3@jan7?@X7&NW8FTW7gS)bU22CW)qK|C?w^5{RbMmH(S)YNxLvd6g#cMp{IdP}Z@d#wi-T7* z-!nxj7OxL=NyYE0rC#tAgXAxv-uOMfep4NoBQjw3T?9$Hdz`z;MIQ~aSbdNVvDV?N zp?oQ;@eOHnG8|`tq9c>?YbAzd`%tfQ<@V1Y1A~3l^-Q?d$`=xjN+9CZM*Vw%S6NTS zi7*8;yWT!Q0X`&qRhI1hw?{velKGrdUVi%u$}$OPrNB5L^{@H3K7;_{$6rYUiwx>)G)R+D4H7fUm`tkhxtv3` zv*xsI$D%`KisSZmhyi>10!wgZO~^DL=0ibj^N{!BtY`^KAzpDFak?#AUAm26_Q|>? zT2^GoaZ;E1=oh=xE#kuHk+)|d$n<>u8#=X2w)QXLyR>;E}Xjh^2TkHO~`VF6ikys*W4m zOcDt_Kz8)f)4%>`JbLxBl#wu;kHc8}w94ESCKhKQK?ZJv{wKm?;-@$t6L35iD;CN6 zM}5!Dq?Ax@Z!M)6z~A;5v~W#N@XetVk2@=Lzm zDz$GP+kU)FW@UR}-WWF&bxSj>b?}{vP6EdZvE7&NJa`+1Y~DQl>Ve_J7Q1xKA!6hB zxxQ6Bdg`(3sS&mmUa4&vtVfQ>8{>xJ6m_Jfs@84_akO_1FjRzB{@~$Pt6IEtN<1)l z`<^@|@|d4bKt7HT7xk7zo-E;oRLnZgUyA5+Nw#si*`g4-WY=kKa+L`?E= z?FrCl&|NHtMHIUTxLjjsoO72?fG-&uKP@|aa$s-$r9YK5$15-mpIFY98)_} zbY;9rE7ci%=jCk8gD5RhM}$7g)8xr0b!=TfT=;zs&S?h8UP?IpR!`gA?9hqya+Ylc zJvqW=QQS0#EzU*k%oA9SP{9vGDDAPYs1wm@Lr-z3rH8+o<|ebZcP1az43BXUpoQD{ zZEwq;_>7tagPI_p3$Ey(e9r#6Q}whQ2(BZ$VJnt{VdHu_%$$GwfKbnC&KPv{zY-<>;POZZaEIF7-Uw zTxEFWRW2^6(H*_oAH@;dho~vY+1<<)mOnmUDNO_iAj>|zy>vo*Wf+pR;B&I~0li=$eHq3Vdk8G70t zW}ogIoQt6T8ftNHusopciHl#ng6P0?E1bv;TaR0%Xntrp=`n3>>X#{|BjY^l#3SVy zQBpp51(e749*^p$E|^L3?$IZElc?_obkr&+DO_$(MioV!q)WCwbbnQL9+qbK&DnbP zENNr)zUvqD{po{X*>*=^rZI->^ED1*{x9-PX%gP`T(_8{b@wp+2>a?lc|P92)Gfi- z9?Ev&csu;!iQ;3!g__DL{SF&6^&_zbQ?yqk7LRN4m}xtH7QZ8^t7h3-7@3z`Q+fcW zXi2ki4i3X5BHXu*^-2D7dv#0Z^slNnsybMk=|1@4P1LP8k*&S2U5MBh=T*{D);=Fv z2qfDYEj(Aq%!A!F!G0JqkuZf*n|{6XTT}Ib-<3o1KaWw`r#2B`f=5PVCLUTZCSQVA zy+mUctmaGn!9FweYOD6}4(lV!XPqQ=X+~<^)BB?zu1a2KlzR4TAi+F(W=(_-4 zTs%r61WpR=&f{_@$@O&T-WMNgSw8SMM5e9EtG_pHp;DKU{3Omkusn#AQ0gv|otw3) zTRi#cBSQn?_MoLEPab8s4a>P3wtIWV`6=k&i`R>9Cb(?}uEiF8kBlxqHE)Z14hEuk zVE36#%(V`Q)uOMc_f7I>YxfsRgU$VKN;!SX&ONn#JO`e~M)<2o94y;a37ZuW~*imEyFZ!X9; zC!$CT@?99aN<`+>6&>$@qK6E zFj#-*T%FA~iNXBqF(Pk7FO42fttPgmJ(~66yfoU9O1@jdS}CLZS*l*vyd#)=dcsc|w~UM}yWaTR0g3!s9c{M`!bEQ`ur3Xj&OiJ5I@ z{0ekl>!EBp@^s6%&3xAPw|$EPWD2p|5sfF#SHkg?UHN5V(YM#+bFi(f_lE26;$#zQEyjoy^2A|_f$LeD5m2{SX-hu3> zfRZ0NNAt_a!)wsSpedLi?H!q&b@FRjzL<@51UpsvX55VTlFF#KFQ>G3jZ^0K_s>$} z!u8U*$A9a4`Bj~}ahcrPOFo9?EBHR_2`CG0?2vPzf7Jd6gzCIM+}N2SG;p}PAgdSR zk~b$qu_Hoj_T-mqx&32>K2u5rTwA9vuqd7-d%6d+bnfuLI;hE6wOJ_|1~@h?_J@-)f{`Z~MFnYOVqTHH@Tv1}MLjceL6E9oW-`xs zW$~5unj#OCsv|+2VoM!eKI1wDDQb(i&-#c(_(|kHWF&nJ_~oNcvpx62#HVk7>wk|x z=SnT99=Ej7{MuKva3X_#mSPrqa9F+^HY%fwvOFUx_w)C@I?8ESDi_0PsKJ_Zjodq_ zkk8`GX>IGgvh?C&H4!HZp7s%ia1hSvL`=BGp_yxO_jsA!oZpcJo+J^3;W=-RUI`ss zohoBk_7u@0ufknJTpj-S;skWCIH0oQ>U_?;gza#7v|Sw&50`G~GS4g9(v?fkX3nI} zdn4V~rt3E6&^e&FsF z1!JeXW#tXzt2Y?Eo_yXc;mi*r{fcGp6S+@5q_1HB=*oQDJPJj*wjmZYkT=?YkHRAo zeh)5ukSd0$7}wuZf~mT#tY77nU4z>Y<$L_`d1A9=+tG`-NM?nE_109^amRuaoJKLX zzdqfVZi}BbN|ocA0zpz5E<;e%Rf7amW~wpRVDSqhd=M?iee&9dVF0ypqV_OGcY3eI z8gdKmVw>O{NK-C@n>06cn}UBZTA?nBZQjPf!0;CL<)su9|VDK zUb3}3qb_(x9oE?sl+BEuil;6}+71c0@A!6_;(Cq7yEx~nX0=h{_U2=XI33nz`lE2W z3Lff433=rI+%dpjr1<`DS2gAO9V?^QpgqyNCWTC6`{1G;*G~J2$)Ti#3)forkBOHj z+TwXf1rbaaf3D{TXspEz=~~eS@fQw~VLjojd|l0mY!(%5DSkd{v+3oHsjo$R?yIKf zKUb@XxGY>^u&sE5kF0n zcAl6~*D0WU48O?CXKGC+@Z?cCHqJaHnoT`JX6WPO43Djsgq6k*H(pw@nPYICY5d(^ zna4XUD&3jktx`spCTp&xqbS$6`8t|U_nx4enePm2Qv|1#-;#n9`3%?EuIu8#31%S} zU;HbHtm-3j{U$e(EG41}$JEgHHSn0jd~Qh?<%rXn*%3r=DGV(i!>Mxxd5ao%m(@kVxaJGS#}7AbMBReFw@^H9yWw-GS{X z%PDo9Pr*zJm`p2nEAFaiDwV+Q4EB-FpuQSAZZFjnXT@d0cJKK(ud+FSD+*dVM6ojq zo?nWgt)>&73Z~ZiJKumbJ;^60mP(ydCSROSWDR6=$#SwEM@(~z;=yB^{$NdMsox_Q z(cM~@dg8i``%)j3LRh~F6o$5_R$1ooD96sdP@BrBN5mu%3<}d)wOH-G^;mM%+t5{K zOj&YLD1tY4b!hoZT-$v=hS&gVq9*C5;cIZb?e+4gJ@TA1ChIXEa4K@wT#w0 z>m_%m&LgA)PwvrGpkHHcUcwj9IkEcgjR-!c0Rw~jjm2&4%O}orM}b>h<+v*sR&(L@ z;=B?|OpA6uei#w%uJiZQm+6$4w>ox8@YLVNkL21ce0ag|zT-NB9p|uZY|EUaWslJ6 z$6y{AGeVj)HBGJZbCj|qUUAIZ^8iNOfmHTy=eWG>?q;Wuu3Q7jA2De2d15`uHVJjMC8{Cay z^02M?a=oWk*3}YIR~=twG?3GI)S$p8d{Xb7r%`JR7c`KuJXVuSZ@af{dzwMgl_AY& zyl#(49|EBrF$edOUrUn>@7Pw0O_JTOasJ14B2{^~<+Yy#lSm3O(ywlWnRb#?>QX5` z1zE^T{3cDI%9j#t-GL5+duAQ+EI1d5q6h zQlrv)?}Q>EDheV3(oveUAiV?<5$U~#79s*t0tt{nNJ7Y+aqWHYIp1^d+4}vH=TQ>K z{LMK>dB;26!GGA(#ct=PGZ2SVJsCx8c@cL?^9^o^U-Bf!Py&{|y&$?~o{DRr87Z%Q zq0t7wC_0O3Oo-}0l7=&Uc^O0ImxR@Ccw#C+{Ig_Q6?6PRr~1~IzHq=IGXxbjBaDSD zut$!i)4DROys7l)xPm+7H3|}Egv)(ro{I4I1qUrUhJX4iVYf|_zWRh5DrkOc$}nPA zY1+DiUFd45jPO|3UxH)M1q(lpuDcahF&dqyO^rJy<0GM^3w8W=Z`;tMDWPLS{3`N$H8bfzdwFh&uFkt2&CwrwT*-hK`N4cr9M|#&1ShYw_- z`1Qen*@|{(rwSG`2BtRPAq}4ur8X&1$AUkH{(W-Fl}e$7?7R^7LX73e1Rt(1UDmx3 z=&JTy1Jh^-(HRRx(sG9A>=ES~)BO^Kfhw@)8GipLuHti}cAEidq@fW4N5UgnAbA))-k@Ow;99Dm7^ZXzyV zR&KCOm((y&doAdEq^@kg(svoQyO3Fy8RxD#mZs?BH@2@aHVf$ycN3*8mLr}kT$+9| zr10==gqT8nxyuYwpwkf7hTy|-K(P}QsuT`d-BdEKUXUqCEe6vJJlC{2*tMrqm;)z> zOM@M3UrpIPR*T15+iLX))sd`=CHlJR5IU(I9%K7-x|yvnDnezUJ6*EN;$aD_gQaUz zjXP~*WwCmm^JLX5ckcNcOi=$43g;e*MgI!ATFNJ*kxC?JFHhvb@Ce#7=g&=)(H4&J zWlkXq%ME`xv0QSF?z#SiX^(&bQCP>NpY~*~eQ2klUJAaD=<#J>6 zMsXgSo>YRaHAR(A3I~yC?xKOUNZT+J-t^LY%L=Spb&C;V($G-l?_N#3c_wXAwjY}& zUs3Iv!kBFf78RU!qC^^mtUsfA11+HYwCL>4L-oCWbM1!35{I_kUJDY7k^K+D z=SE?PjuW?QvSTT?4xZor62TL2%0k!2r)mW;c^i4Yv2RJ{HX~Rl1ydZ<%e&ET-a|=h zzEd6?$WoKhO@3wXA^eIqhp?#NL$_4+A2rV7UoqLmE?=LP&dnQJmN^1IyMNJ_NUi;b z7MaWso&ORu9<6G`!_jY+no$&bBjxxst|)LNJ60o+M`NeIo~%WW;L$ki$=#R_^Tagv ze!#y9;TMLktbftr=ocliZecXHRR^j8oDq$}nf}*|L7PhI`_>zXLvJ9bgM)59H6Z zpV>g1Z`%Zj-hpeaj0+%G%_OiWw6)N-B7_KISIBVR@o2g%4~MfyCYJjw_D|b{8rTes z5@wmPVC+w}J-Z7U1ZJm6nrm4YROk<8Vv2Uq&eMInwd~J#-7(OJ;ua7iB+%6f&hD<4 z9>@tdOq4=21(wSNCw(zAQrC|b-CzY_ElsbVdcfh^m@NLZO=VZ5Z?~Tc9^u%9J9kxB zd@pp>5cS4DpS+qorAfXjf2Go8CcuHusmB(5u*RLKF+`fvyx$iFR1HQvf0``pk-7d< zuHT7Xhii!dVWQA6O+xq3{L3!sea}>u7iV{L_fELee2{)7gQ0xK;NQPS&*!DmXRsFa z-f`k0p;y@tObw$pZC)@71kN=?0ul|DXoe;Jb2Z+>IV_Rj$UVbw`s!M^Ii#O{W_{P2ji3WE=3hY3kV2GwhP>8!H>*PL;v?xe5W0versotWe{AYx5Uq*TJfl2B} zBwh*5ef%7hYGhXx)ix6JEgP51(bWJ8Ux}*K@@W)bUw z=?e`&n9GV+0yFEn*oauWVzcdfQ&iBaX(#U?>}nYmhqDQ@M8HTFpvoQ9Xurvx#!LNe z#dvH8~X;LA_Do#Tccft!T}CXyl6y8l+rS=DqSN$(^FjqMN3WQeK{B@)V>AANvQvw1??R353w<*VsiCV!A;6!GU ztUNb|n7_&(p2|&PyEFrl``l<#K2dq4s)59#0kb_yv>AUUS{uj?NSfQC!G$~@QB-%r z&mJh;);m+f>KO(YW~_|)qKw7Unl<&?5qLK^E#|wse{Wwc)3yX|K6@=MoUW-te3Nyn zZ{(u9qVEtI@tfOL$A$L6@c{k<#t- zj^d!DTjCktW3ie%wb)3A^`Ko8!age%vG-y44kA4CcS_iwPBCYOBYdskd)tfmw(SRi z;_5wRApn%vbFl#Mk}LD1lYKjj;JZ&vG1Vqaxg%9vb}>9Ple?jAjXn5h6?>fCe6o2{ z6JiQxU-o_!_~sLYBQMNPx`|V1?o2fIr1XHP?R5ltcR;T_hk3*c&_R&@D7%TF0(xRLhe(63!11 z6w_2$X@B_2U6c|p-A;aQWw!T*hQu^IW~(Sl=vHeGP1G_}`op}_1?*lq-m=DS!8%2-VleE{-T*$Qdv z&^`ZNLGKU{EJqpc+u~84d$^Rg+xy@rX-#);yqNx5e#>BqMK@K!6$Uy-aa42H48~Kz zc*~p#biU6}(gES1ofpO51Jv^bc2xav#qeEWI(Z>`ic^XA8Xl{n@mr-!C)0m$su?E# zq!VNLd#ckm5V$-bz%y+V$(3#~Q=f|kb6|%=&Y-SS^%F65` z8raXeIw^s$Z#uwaBKuMVMj+wtYxB*qYUjY!i`J{oW1^V3!O?VeM=`4&`!sLrT665T za#R$6NS@1S#MqoYz|rpp?@`pQ#{1LFHwC1ND%dr!d?46=h>g7w)9v%pP3XeIFz3%9 zq5KyhNA?u9szycFZa%p5ys~UhzleAHqmRsGWJTzS%Mm_4oOW560H$(o=&&`(SKsJo zEpHQslYKd}@Do+huS8T;7AJGdqj)}X3+`We%DT7-4<0lOjjJK4`(aLiD*_1xBVjV% z%^F6$BYR$7_%3bQRe6A;CUT@B_&jPjrHc3Na6);|-W zE#6)lF3ZMIzWDbX0AmCu$&`vdb(whae9NhE-_#Sh-Le8V6r{8tqB!QVcpF0RZgeIX zP;62y8v{EnHMhgv3@Nc_{$^(4OptMKS`Rz-TQIJpQz=y0*Lh9$HaK+&#?KalFW!Pk z5Ap|kS1?gFN3mx#$Gi+Nd~_c!%==wC2J}?kjGVQ+M_wWH*{G77*i)Sw%JAz0Z6eXT zZ!g27f@6ceHLB&vyjtXQ<;he60ZzbX73!;g)2@noVEc3sK7p{SGGfz75=;L|GiBebmE)m=jS+`VWEJHLL-!-K7QjP;F@}ndFDyzn<8H|bI?(WbK z3Ztkc-KWe%iL6Hfe9$Rz{)4ofcjk1X7dO9y(|%@RM9swY*4WI0CVmK=0%qdK2y||i z2SaFfWTH%1)X&4O8U+EM+041Djw_UWO|$h08)uF&K4cJ13f$;u6S+F^m46?{$IQS9 zaB4~FGtD8$*Ih<10ip{QxHpq>>ldYof?A>L*ZAA(7SiV1`d@u#Rhk@p7W)pgV7_z4 zKgk3Kww8!ke!_Y*!bvCyWQL#^rnx^L=6S6ppp}maU4ZMCabyw#Zdl2Jx4MAZZiWBx%#vf5v zX&+wTgm>P;`LTS6w#F5fMRC3MU24}6EetYLGZYr{LFTg>b~N5;$Z5ICXJ}#N~12(s1hWWcPiz76t|g3grIGpUmxm{oi@G29v0b(95^%rz#f>UN-KjR zwTuj7@4q3}4e#E-Y4XF&E;Ki&C$4bZ`Qh{Lm`x;Hoix_Waen!gJkuT46PzwI%4Ylr zX{Rz*FykZ<)HncoQ*G4~Se(l4WRRZNX}>Duxs%;AK+#0&aA%>;cce&})G&%I({#}z zJ1gLaya?O3Oq4ZKg+<@tPcl~{%oKEy>>j?0{o3*bgzKLE8%?_4gMZuhyg$h(SFs)# zx8)EZ%qI;r5r$vx%R-$HdnF`gQJ+)Z11zC|=huC0FKmNQtGFOsJR>^7)P#NwUrfA+ zi7~08;@}4yb$FR8hIART?3Hdb1BS_8bUAf zwkx>}xf9|)t$!lSvLYD|$7_VFLV_=vDvmvb4kSJL5k5zG+`ry-99xlrE!$e1V3Xlx z)IGGb8h6W|(bBQ%hLDW{hYC>;Av9)K3H+E{h+-XAcy19f?jxxXW+}JkBo>0^ld(KW zLWd$TvGfXh2=!Kt>wN^7%y0S54MD!HIPHImbn^N+EBcs+w9`&eT}5kDXyfSy7>GI2 zl)bE%25riFRn&JBhUZU^4h?}i-|XFe%aj^S4{f4N1q(YRRG%b5%$1sKeJvu>9EEhe zuk)WPO5h~uiM|a-R2FUDr1lpSs0b`xIlc0$4tx*5f%?PgV%t~*q2T+rARBY4sUgG=jnA5G?>xwGg)B6Lwr>e8){ zl}UW9?$#LeQ`fzW{r;HXwb6|cW8PCJZjO)Gi>tht-Q5~`yj84nr&6qtl4bRj%I1?O zMc~H>Hg7Xkg96v0dD2z#SyB~*NGr*ABet|t-IhWmPNuZL(>Zr{e`41)j+&QNEoC)n z95p316I_7>T=tnNYxC#i9;DEZA4&8TM-+2Oej*?V#YHR`mt_twF`rXB&BESKCqO%k*QN|)p(*7OfFzV}} zE44QDB5EE@&dF_mfl3eEu8#|wq;)9_I#PIlwP;GIark)*iRP-+Qn_<1x8T|^hAAY(=sd0PoLULm79T7x`fA?CQc)I_S(&Zib zu=`5fuSP`wp0xBxe$fW!YMF8A&k8Re&(cOL4H;_2gMf%g1&6S?36QTT1+R{-TVC)6 zC_8iwVVghtnu!wDiU*n3ZU!9xh89v=Dsls0^Gn%3 zAbI{9>o=Zgk$`xTPK^5Qx9{6PJw+nP(lf3UTVHQf!fUNuV^GJkxH$%r(44};LBAo0 z-xf6xvcoZ>!ru!MT#A=^2+VVca0=_v2E! z1>+ApptiVtWnJdpH@R(U*6P&#U1AuTU49q&B1mF#MCDc5qyxNGnE(Yovu(xX({ zc9b5uex7r&2JsKs<^PUI{O^*+JKZmKS)}k6u2&^p*8I^E@$am&3_o5KVbC-@H~~w` zBNR~#o7wv zhO`DQS|Nzq8(?U0oIZ!Ep!I`ME5Qd2+HZ5&`>{S>lkrs=zEhX@cS^@oC37H{WzqOL zFo|?s+Ptf7o?T7lFR13k$OC9$|FsijvW&qN zwFP{QTOy&`mUFoWU8n@e?m1)gfY-R|)&5M4!o&Cp4v~=43=jQUY2re=FATF@QZugc zwk4!gWJQ8UM7hpCZvI44d62sl>lhdX&e({%$%%mgAA?OifF zNk=4&x4%HC_xGy%qBld|I)(U^;3!gR_`Emami#3$ym~yV-&Gry zx-^%Ceql3~2Xz{UKdi>1q2IADAOMt%&W(aExRkHAYLomh$4@Zw;L%xY_|AJ*@G2)mvRkpzi1fKdE9S$9zPy< z8zTCd|L;nelOVpA?z-uRLySpoJP8lsX^XVf7)-iYJ?$u|-s6U;#n(+!O{<*G&`@}h zJ$+bC{aDTQr$NkT2<7)+Oo7L(Be)gcr2BO?6t7W)+_vqm0`6C^STHr0sp>eb#h!lW ztwvBa#?{PE#(s5S{R7pEx|SWgqe1@<*x9d>dOPV~0GeRdA%j(?ID)cH*M&^g%+K?G zfjHeF#QqhdpF;jHGj|q`Y$v?2+bZ{~y052N$m7^ks!hUojR0l;3Yq;vALVqGz#M7H ziX?ilqJK(Wwb8Z!^}S;)FZl%z@T&u1JHe^!AL;nezILL3+!N_45GQFf>RbE`4S!#- zgn?OW0md5C9m4n9Z8)0PPsDeKD<2@bui0BXCwWYz_@^3W5 zg+!+zCQ@6bzpQ`RO)4<&mVJ0Myari{4MD6P=U=0nsC?I)vQy=+6%M&58r;2=8MwUE z-e^8aVC%=0S@@2djN&m6KbozK0{4{n-ErI06QgMr!^n<&bj7K(MoqgLg1;CU{{f#m z8xhv01%Z2Z*o)<~)+dm#7P@?ceT1Noi$CRS>}ImxCddH-X1H)h2&-(}iEHbUeO!lF!UpIxxl+Fb~3m z)jX}Y-9MLV6N6R|W~a?6gm>nK4ClLK+B!chiCXlC!IIy*P}k#bunSNXCJ_?~-}G6F zq~yHy2>=}w30@2Lq?XXv^X;!My;d4Ok0l1->xOJLr`rG#XaVgxv1E6hvVxm(+o96y zAes-v2NBNWo&n?p<2msg$A$JOj$)U5e1f*)Zp`Oo?w<6tgy{$+jR!8jyQO`dx+eI8 z2GE4IV}2i<<*c0;tcJrqSuUyUBukI^5l?~?y)y4+-R7uSM<$FO;fx^LHYr4L2bmlo z5B!CIjKS|N3}dePhspJ+S%d`jn#4gg`)3_J0esXkzL3U`!;x-;t``v9$J>2CVpqCK z_?csA?{FRf4S67BRH+qFBdk>5gfHArtx)W_S1N$@NnI@OM9MoqFcNWEoUAc@#wBpb z`eBVPjmn6Hq1Sz&`-?~DLk=*Z!ui=n}Df600;!a`Jl zr%jYBt+Go&@@fAJY;6@!EMbtKyWF z2HpAHEAmFynnVC;Gxuq4I*N~`nyjHtaN-Iue13cpRazSK$oek1*X9-K`{PC!JF=og zfSGnA`~WBc(Q7&y0tnaeN-fS5veRf#W9ee!-*On#W}cTT29b`8lCo@gKn%TAy$1D} z?@S0m_>eEZu{3lc+I#}^%#y!SPah!uMoWRcDT@XxR81IhY>&PID{aKsVkTl>_;v+v z#t!ywSCdK6#jWum8HX8`!-??j7k$XJ$J1p7s+)&1#}yz^U^co`yXgB;o>g!rv>pJv z^N4%vmmwR?31bIi)hD_>GOyJ;e0IezZxRenK$xJ@yqA9C2>p6XzbM-|3eiJg(Som5 zG`ArSJsgvxON=!#u>|4D;8Wg1n4C`9*C)0tHLHNx_cqmyoPWPU zhh?$i=5LV~80FnuhAE#;$UV8jSVz@xmRFB|ops0CjlslAruxjpganKER~t|;Ijzz!4Exi$|p`&H;|8uguq;l~QR(qA~- z_KVatYY5zQG^ut@M#iugyIp!1b{OS434X#89{_ECu*ldjS*Hl6Pzl&LkY=m|UYPFE)V=rQE>TV0!hk1ZNZ3|EbyePQKckSAj?nHtb~ z^T6>V+M$!=N$${uL@6`Ma!<|96^&j0oZ}xE-0_Y5S6LUc`}n)`+>l{!;jTBX2w>3{ zth4%bd%=m&%Ie@;shmBa5f(D=HlUP=XW8z(yBR?ObQ>y?#dH zN+6&JpB&l&^@h1;NHmCcWnwBbNt0eVZWsh&RXgd0=Ux6w$n{nsvS^@-8fl7P-SjmQ zRQ$8(%Sp&LuN5aQT*C3xhRWZhL+HD)-S00prvwWexQ^1I0%I%YX)ej2IIc7h479cC zs~v1f4nuhzua(em74n2@q)>H&Ynpbw$LfGAPiKxBq6~JZS4~7d&rcq{1A?v@r-e+q zSpjaS4bPx+PXVZ49p^a!aMr-aK=Kx_4Ene_5~5f`o^g^q!tI%$JN8SPp!EU}5MSi- zd`bRKZseB@_&+cGry15@iIg6Fz%SY`svEB53W-^(*dKi8A0l!S%Rg|7@)hxBI0tkGP?SU1>tM7 z^!kE*<83Ayf{HuEaoj)5myl}vn*Nw*4@xTW&flL{m{mJ3O>R;aYW21Sv)m>_sI=P$ z+_lT9m(to|gv8TTeBN5B2eAumjQpq^>O0(XA@ti{QMz3qld29<#iRc^Wj#JL3&%dNN`jM z2kpoEJdQE0GPvx&`vM#nXO^G9BJ?E$?tHeTwEBkZfEjvo6a8b;+t1Hm-#QB=;PhpC z1hr#{plz9zP*&gFHAn<;mFazH_|E=hMVER;hME~Va}CUyz7c__uKU^nr5>3l>mP&cnL z>0Z;agZUz7$CH;&fd-fz+O+I|u`gDdSKL5Po&yA5|2Y8sZ*LL%4mxTtY3h_IcyZ#mjU+sRs!qcTI!%Y|h!M_vV77&b)cQVnWj~m()l~fZ~@8;>n zNx~Xbiu!Jer;9Qw*^>%Ew0UFmc@oI2qAF?^;INqd*=0T)uZD5OP$sn3&4#=&kI1BD zHaT{+yITKaUaJj_#>>^VnWP;@?-M40#zMUX@}jyA3s^dp7Xbi z1Pm-BQoQ>QJBaec4t8o~_8v69FxxQu;>@8fbVVxa0XqdOr<*OcubVQ}dudjF+&}wu zFtt7I)Gw|R2^0<85Sxip9&HvT3zkqY00Pi7Yc#jUW;a&6`s_Br=siJC}9+DX* zm$71zpzZwAU{h%-eTtZ;PD`C03{@hCdz1_Sidg~z6g1t}j+9lRTo3z-( ztq1#T-uo?(`QcN9R@q*&WEIiN?36&_HLG)fX1V1>fi0T;iDl(0xzpvzxIkIB_)w^0 zZ?dpwyLLIrGKg%&s0wk))PKW+s+odhqiuey8-p1;aDJ=ag5IXtQR^`~YhixdF0yaM zm7`acemPmmEn|)o6sURY>H;8y{~XQnS;a|AV)5ro(EM);gl46{V} zf&$>pz6^Djz2v@7w*+9fIhR*J$l84H?BS~rR1@LcRd&j=b@fMyf4H_I;WwF}jssofyEwsqFAuE@eiBZCV&sR1h)S<}7tcz|SF8e4j z=0k1vL3KUd2O-n8HD|tfbN8dLU{%PCmtBlbf~JEiq!h&-N2KG(xw;=4UFKrj!*!*N zTlIj;)2NURd{xE*2yrD-n34T?$(uz*MG?|Gnj4=Q*1kq-rymEk+y^XmPZm*E*BZ`U zV_mf3c{vu*EITyG+On*@giFQIghP#N?)xQQ@_5`#5q&T9A2YlEcCq&c<5@Jqrdv+6 zem$DKdB?U+43I<{{$&IMM-PX3{ah-a0ff3OK&p;Qbw#w`#XGd_v+KHWtC@cIZVj zP!P6D_sQcLdl>O>+b$!(NEnozvw9BzOiVA_{U9x6e}-{^XxOx{yv+}+=?K8&Wldzc z{%m#nw*V`Hit`p*f4;D&wpaj3tH7PUB;)bmI{7BrhqS7!6J&nh_Y^Bl zkb1E0;GaFY*Ea#iUK+hw3@p81Siq(NGRX}|Q+&`Wk)L)xg8cy3G60{e^pa&;Q1N^E z@eM-;p2PvoeZ9zqY3kgFF@$p&N+ANfM=jx88|LS^IvucJQMXw=NeclF3qXRMklmdd zm>YBfjh*`-!lXvjqTI{-{#9Z@O0F>h$5J+=;%h1=u;}9;c$MCx zgkiw1zt{xK^VM_vc*WX9U|oA);s8wjvfU-!$S`WSsDX9Rt09pM8b$z*6aadSPrj2| zbQ9ZwVBa~A8f-xsSYy*{jQVxou}47|Lwd4`Ps%G{^$EMDA`LBkjDE+ai#-Qv_s;I! z1zm+Fu0-Jkk3l{^49|>JGbYSB&qlVaR#-N_mA3DFgVF{mbj=9^Tsx%>)p4-%wR3GB0}^Y3@r-kPX^e`TpPoQ{bxi zase_i9FRSUeN}SJjeFfYa+B*+wI0$}>Ts-K=gt5qCdWJ=?wG~PkkEc2%8OrE zPr5jIb{6DQtAUr1_csw8lrX$z5gIhj77#P|3M|@s&l9G=pnmHEBaX3L#Ht^&*1sKd z{(2fI#USv+FWg};LCz+w+W@M*4cq1 z+2W+g4@PagFO*!=orx436b1~Ot-6JI(7P9VjK_GQ%1JywW5cNchU2wPtC=0jH%tnp zVKrqtY!Ezd3T*vO7+ym)OGeGZVY(q;`<@A~#0~P!@6{;wyUMhceDRJ%vjd5?Jt=Gp zj^B3xYhWHpZ`8jIUBA{ZJUwoQZ=4Hb-HJ6QFhCH{5&^2&k0ihjXQeSpxWlZc{GJ6Q znM~7+XLg5zl0&Cz_g!6{X)~mF+#7$*MV#MBJIeX{kvVuu;dv+D$N{Dj9}@VQsESWD zZWv2;?qg?llcW+nW?OC8dQrCeDKiMeObzLq$cppkpKmj|GEKg-jC#5JN_G)c*WLcP zj`;b`B3Q>r562hK#;hCYjhB`*g1rGnymz4fJ-;I4HvEMOP+-G)Kdcxh-}yH(*JJs5 zS~IPSii_XDEZ_i!i0^WIH#Y(DvhX}{hIJqec4$FtZ$D#j^nU+zXT8|F%|!X?q@SM> zoAaK>rjR7Dh~A4xwJ8KCh-yhP7coCAFmPt6bS68=JUEWgCxKiR&kR1NH0@0g%wSIX zMG1`6k`J5C5LeU$njR6|#KaF8_l%6g=~7$!enr-Ktm{{Zp_NszuRBFqo%STbtgf|V(w0ZC zh~ET|LT+BD|4o?b-yv5RzdJLLW_~mKnye{1`It|p!*mSXYiM7D6f@LO9+f6sGCQF! z$x0(Hq)UR%oo{?7~dvG7C5z|k+Pk}wF~{A0rbv?Sb?a+ z1z4{ZVa=uTav_1m)Cs>Ao4G#sHMtNR>VLXFgP4`wK@uzoq>-{?GG!407N5 zNrcTxELx#ed<#>#h>RqCmqsB=$at7ci|eP{^QSm1+5=J;XJTxr3Oyg~OkMq5>jQmsa#)z51FQ3x~i0a>x~y zDPsY_NLltB!`1qttpUh!=hwathlbx{XJoT9PO*XRjU%v4Rg(Pv1Y7{Gn(vB7ytE`d zE*!BNO6mS=&a$UJN%yVC@7~${`wnVBZbn(XzLoWfi`a5L4ZPS7@PkWl|I6rYlrk)v zlFc`Yq!tsDMst2I@c&-le_eS0`#qq&T`yD2N#ZoX2RVIi=BM~sc-kH8P5OYa0!`@r zzVm0nuj=1s107xq0kCh34HZxO@XN8jrcXBS|FheE7O5rA3XSBv>%IO8*3K`DpL7uf z+A%YrG5Q}AKRi$3g40i;HP5?~0U#?reH8s?e?aRCApB55BCq^}UTwTKYPQtd6Mt!p zWla^P&mM@d0*lwW%YV}*%TWEo`G^K}tzu!RRr|=G4_MWL&us?9#VbIkBySh}nD$>E z)Bki_{(0ZKlLvdW@Ynk<+?X_Pc%0+9dJFKP#sB`u!+3bLY^EF1vL;|Fd5# z&&DjG1@Zq7aHq#?KSfPoS=IL>EA)|Z4CBbXhKLGkx%Kgy)r@#04RjNwPc>3YztZw; zY>o&l>c{=5(#%`Vxo$1D4V#D#8z*^Ae_87T*QKIFUQNKF|YPz z1;8vSWq#iLXGcu*4Jf&=Q|#Fvb|gQVzNTUtbpFS53d#|s4HOCD2p{EtSvUER@FS9m zT|0GN=*w1p3EpVg&IKtn>orXC{$5{I1g^6a=oz~0U__1nP-TbAc1K_lU8^1TakA#> z7o$Ya@zIjWn^;8`9pwbCU;8K+{^iHDXzPw2*L=zk0k-cx$%sF5r2UI*oQ&ayg+3q5vc4Gekru-iytd8PfVV+TraOrOt=qx z2~*dJKM1iHKCJ!Jn@%maf}a*kv)?TizCLg&n z$@;Cg=kK@S8XWue|M1A(&Sofmu3y|AIpO5^&~GY#Z|}Pvv+6e>RgVMB1-BStMfO)& zQUXF|o{-BQM{;J!I7sdUmvs{blQC6=aJ{rkWjRIehyKun$yA_ADcU7TvE^*lIjS1Vkqe0$eDm z*fLve{GZG7_6x{dZAJ*evwqXGooYW4 zIJN9L#<<9R%m%!F_-uwnK?EVS?uICTcF{4Q);-MTTtXTAYKALcpIh53Gc~}V0*5G` zXL+1Id8A}~d7rLXm?j!}(#X(1(E8C<_{2SPhvt6?1u9G1MP1Id=twEH)N@!!#I#*E zFr6qaL5}Fktm^5GxokexN$nxwt>kW*PMib(Etk9d@EN67`~P&2iJ?pwq5o`;q{|{rpdX=YRWY zxR~UdQ>;*ZKEABv{L1HBHektT26 z)%Q_8)eL1}A=5WNAz1GKE``s!8THfC*F@5#_+H~Nlg?VUm%i1#XAUy5ql zMIY0Rt}{y}i#i`(n0^W3=B;er?c9grMZWBrm?*K#C~x1Ks4uBx8?`-Zb~A=;;`9GU zkk!-plT~K_Ro>MJ$KndGsk)j&Hy)tm7;2WI4HP|5B->h>ZnS)jZ;=vvX3DW<=B0Ye zB5`RnsZDms%%LwHkZ3D(QmxB{o^1Lu6Mq$V|H%t~dkY!+E&Ae@TJY0P6ee@dd)0#$ zD$tbUF~gv;TlX;8`UIIee1X25AeA-7^S&{|pOmt!XdYK__EK@lNKY@RBCveW_HkoL z#^*{l@{kk$?huQ!(V5=rEGt)}sig-u6{yOVCl+~S@V#+;^i%O;mEH2_DL`q>%!wK8 zGfFK;jVPG_GMH~-c@}HxEk3;)6f>65F$>dg1(5>+vc&`h-c)!*-s25QPqQ|j_$R^m zAJdlqWw1Gzt%h1K!kdH(v0}#l zv`L;X>Fzx17J9>I;^PmXL0krc%opxyzr*GKKki10m!BawEB4{RbEl@gTPsZWqd7>% z9UA6${oPM9A@Y)cY6z!>ev~vlZU2I|*Q36tB(b7HIY>y=#6j-!w2@3%B~R_Qp=esz zs;o^4bZ(;{wxrwmL9@ose-u0WT_0f?_wBTBzw2sTc?R{gPh|*StuRmlAFw$^C<8+w zJBC+N-%G%O?`r-g{D+3}G~cIBFkER|$VLQCeX&0MdGvD2Dc`+E3~ZLh5`m&@T^*OPki+u6@YyGa}x-Qe+tQe?gpYo7nMGaq3Qfcx0O@zTDs(}6xNYb%**R;&a8xsNjbS}A1AqomS5;DfZMl=S0-w|Q_T(@R4~z$?N8nF z=i;YtM1kLHjy!qJqId4zbqCJ$>UyD5AOeZo9!Y^yhn%nb9w|yP`kDM*|AOVjQ(DU* zgE6s`>{nb1t>--zm8q!_7QM?II;r8C;3&(MXH8JI*(UBCdZ(z1b^N8lURW7dJOb<@ zkk7SE2Pe6(pVZGXA?2(t_oVNW@UlSZjcNaNUULE_Ge`Osb$q!bRLos{*6KiqF5K{5 z?PLl33GG9Y>BQXfwPYzi%Pew%mN7^eq77f&`jhu_0yF4YM-Hz-bH` zF`_#OsVvO^hmh%tV;Wn2Ho5xMmhS{4Ec`BMsha}@`9ZR^>~KB{g;Cgv%#c|x%`O%9 z29eC=v-JuB;ed6fGgTJ)D}hX5$amMwmfQCTN(L4rYPyb1dFa(;~3kRO{YAyeg1BS4dScd z7UQ^j~`S zjWwI21mCQ&7}tp}320O{ta()2eKAcT!K&IF!LlA?36COg7HIt+^ zK{@{NAxG)esoJEf(t$y~H}#*`a`G)3J3!H8Ybtm10AN!5GeJTx&0~5LqALRQj!)a% zJ23u*GO1gY9zVz6hw|P2E^}qLgnD-po3#9stCSX;G=Y4Jof*ze~o~?Uq zy&W1@_JO-rxqW+&&AFVx^oMbAFd}oo`k+sTS4vCiPvta1Ws2>CZU2kL`%AiPAM;j6 zzmrW%chWQRvyo_Sv2$oPfse!|RHbPrL)C7Aej>}NG^jx+Jh-zW(Re!p>MTXpF-r%y z)W#so6d@^&dd<8cgAry8P8EmZ!ZvflR|~>?L*YKGlz+{axI4l9wHKBxOTSzXY6CId z0@Ww>f`a3n!oou9T&hXQHBNr{rxJ2Ee(zo|g$JJOhe0_UW_}pjcE3L%X}+^hh(-VJ ztdI5e$Y^JuxOk1*BRV(YV$3SH??ZYtoY5z9wG+jKXwR3A0t4+h2c1b2Sw~0CCN@YDAG_uP7 zC*TrmuGg2>{5jd)=P)VdzC0WX>7llANYv&=atxIyNM6w z>7ROzI1nsQzRL;btGN9YQ+>23UsvRIO3c&B=j|*W_4K~!fUvIn3E0rcLnp&;-#PeX zC*pA2N&Uh*dmLEKeY|<(+SQ!sm-0sr|8+a=qv$oQM$u>I8ux4GNE~O@9thI{>c^&g zndwd?$$ndw@b2jfyPw@@ULjtYU85+n0FBX2O%8X}l1osQf0a|;?C%-+9O=TyiA z264Z1bR&@$a|$PPjH~)mxfVCnZwOecq4W@i6T1u9I)r;@Ck@%OqM-G2rJZM317T$i zTUy??5$7I3>{A{zxUUb%n74cwwQU1~gdu8wzdZVY<fH%Zbk&}7fztYe{!Nv8{ySVZX zvhGxu7B-G9mvEJmWFzb;H{*)O6dO zm_s7-dIkxAE7;Bfb@_s~1q(ifkf~FI@=)#ssYw2gF%`=&YRAn8;TY zB*^Ddm44};48^uMc_9!%?tzbrZ++#I@m|_9csWaR-@Dpy#HTfu=pv=Cu6D^PWv}WE znGCt~x{^;{e-cX4PPf_V6&+41vrs5Zu`XUeS7<(ePu#xh$IA&Z5&D<=FKZ=wZ{IJF zXj%Q_Ir3|Y80-@(m?D;R-zRtTCE>nONmm~1(w&}nl*^!#iN)b7;vTRBVV=`=w4Pwc@{#tgnHAX>(MruKnCa|3N-F*ckp4fT9Bl(1#EdAH7 z$$9DdX<c;`zQm-*wFq#C-XX|i5I*HWz=BrJ0|!2M(($Ij}K<+ z<#H{*7B|J@i|kc6m^;MWQrI}obFbp~-wFBFFHh++Rx2p4*1r8*7xD6*OXRB^$}MAa zQz;R8-*f#15#*rRh^9;={mrMbCw)9h{hWtY%=exzZ$D|fRcx|F|2x2|wo)(iPxhBp z>*4UH|HayyheO@If8%$zkRo@BY@w2reV-&-LI_#L&d9!wWXn29QL>aZ#E^Y#*>|$c z$TIeQEi!hp8)L@rn(q7a{eFJWaXiP<=lMSWbyUiDU+?pLZP$73f2dZ95bKfNpZwz^ z=GC12=gRh@SaL$kzx7b{k8n0jH)f2K^@UGmjQ?(2lUH_JVkf{gaj z!Zf}9R@CVT{X&Ov8%m$&q@R2E1B{Vf26j1Ut`%~(0eiuxi+h!eEmsPAQ=kZJ+Tv-c zrdgidJ9 z_iu)lLb>hrTvgUYIG|8HXgN5fh2yuRYG$LxZT(s^^HFLA`j>OV7SAESyo1YrZ#Uqr zKl@Z>Hmc|v)VQxJHRZ>33WR&h(J8{pC@$~VJig(vS>ve;JX#|8J8-|AeYk9K5);O3 zse~1c^d^?;hZxwFQT%4fB5yD2r9Y|E18Gda4;$Nne+R^`#pP00PV!93!E~c(6FqjR z)FinIFtqVX5uHEWMJkkUlu#A(^h=m)0&-g6>3;~_^o&`msg)3zWtJYTT9Tod>3wQ5Z`0unvwYav9W6gs&HEtrikQ7 zp5zawU0s%#y~d74%|xvj+2K`azwBXS|_tYZ^JmBStPl~RKo)AZ|%sJ zp1fA~?LN#L{~{k+6fs^<^@)mZ{3EnKCx*5lO5@{}ZkwH%tGdT0 zB?kRLfo-i=Zxl)#$>>;TVErY6cFad##kWh@1m%#ZpQ!m>-gL4|qj*HVn;Q#lbr2Of zSYZsA?RUV7HE>%aQrQaQT=Mnbzk!{aloJ$Md~)UULF*eE46k4kxN2*AyG$+eKYDQ= zns-Ysh*@4T=sj9k%BDWBiU^W(Ii*__D1&?MuJOR-N^Gg{CCAA;=fVc{7WvESj<+AB z_1y~1v;Rc;c0Kv8f%`tv)-nUd&u0F4s^G~dt5P*wh31(tRHk>tVoQ^| zD0-CZW1t?{yP=(Vv`g_JtR1({2iQE5|F>m;|HogZmY!4^ zP10s$hk#27KcbV>A4;6sxfOUww^LD56ImPzD=n=Thv?d{?xi0Ng@`R?XTbD{?id$T zKn&DX5vm|#3f|$@x|!E4r3z7H_sK1I4AqqgHPNaC{U>fH)Kn}bNc67}+NF|A-ohMz zO!n*an!!8h_Z`pJH)&`W<6t7gs^PqQcmAtD(=Po}pb_bH>I?Wc@zP2V>;z3_j~+vw zN2swbJk{kKQzx}};PL)33F-a#&@BiIvzVpK~|(EWibg@fk&Jwv%`6r#92= zv_~rh*>ngm(ZvnlV$Q*Sue3LD^-qX+pb1%Ry)$I*D`>5K3C#ti(r&D`YVtJfeH{_u zJo2cW=Y_j^Kf$BJRAVAPwZ+fKITgDsS{-T}?v}*8^C8lwUB@FE50IF>I_s#lNjw$R z-t|qH1x^8Id710f({n{~mVQT7vpYd{p^{(B$`cA#J6){63+(mkwhAHo52{0wpMWmq z@0Y0H^CxI`6qfA!)y@T;i@w1RZPXrRVeokMq$N>AlR!lx5%*?ENfKE-fvWAjQBZMdC405Yw(-mN*R)Nv zsXs)bx^$og-smBy)Oc-VCr96;AM8q#KcZSzSVbs9v44y z^D#%A4rjSGiuq_)hlNP^Eut&3@ zoI?*Amdltp=;k?0cuaqKYj>X*{QA7`DW`zQ560Y%-4%;QxuXTQciZoW%%qiE3xqcZ zsw}cWzm;jm)Lzy6gM#=D(JFT8_n)Va#vc^^Jsc+}X|DvHD`#C?d*i{GwQoE8v1NMm zR-=t5GHZEA0-fAv!`(((8DJ<9ad`Srjo$H&j?_R%Ne&WV#Y^Q~6#YT%I9esb*c!S5D8*e51sC@by1B6TGvVEdvv3$K= z)iC8{YGw}CcK!FLf_GOzSP!JahkBVQufd~Ib3~Ka}tSl(PPe2iV9vE=@uC>p9 z03_ui^tlC^?r+pHG`v=W0dG{$$W@_Ye3mxzj;o^A42j_M+Fjr0= z?u=@Z)@B|SrCV+1_^9C*u+tRp8S}ugy;ZYTm34%l@xSmAR2RMbN{KFPp6amS*|m$p zLMMfK>1k~>0)M~Ev?PGH_xsUK2yBDX0n*!J6P(ySswJ&m0qVp2-<-+vXgOq(S@bi~4yhQ0^?+lMy`n7}vy5 zdnxX*3pHKbdUm;$%Svw<^hfNn!-hrj6j){bz%6WXFPh&>g`x6GY6{|c z+(O=79N~-O?jQE|JH)R9H3n=kETD)-2T6<0&S-d$0+^C2}55ZOgt{ zF)Y&au5;fMdwk%o)OW>HCaz0NHGXjK_Qf5Tu1fEt{3gAA)Cuvds+Sc{!}__QZFYCV zChn$P@YDUEOX(>$l&pPApa`$z#@w@=JXeth-&*=p(6vLyb-=H%c#>rDMpGvobQr>& zoKRF1`_I0<_Yy90M?3Vd|9Kz3{=a%3IV`)1mi&uClg2LB8oQK6TT)Gav~CDsR(udfT!gFC6#(;?$f9Q4ZuGQi}#tu+;k)MybDsfD3O=eOoqbNM7<1KI7VSgNh=F45 zc@#SN_SHD8U@N*?{^0YrzYw1eM$u+I`dEYx_B5Qb?$x`Tt5Hg~E6D*h(z7-n@j(~l z2KZxW*Cf&qM|k=h&3Qd!|8KSC)iL22piBO&z!zPd&)eOgNi=k((hALxkwuG z)QwGwZwDv19yJC|-{GQA@D-^LAM$^@Rdo2M^Ankpm9i;Pb@)-|d_=YFAH7t+UV8J?}Hcq8EI6N>sTsV#xz+VL}H>D=!>vz<8bHPc%QJAqui zfvk&X_)yd4Jn1Ea5{5HbOIISY#3ywp6!ab;wyc3iM6PtnbIK-5pP`m(vW0B7FSS z`ipkoZ{D5d6vzaOvq(Qb2$d7Mat2DlqvWcN?jceDfMxOWEHyY*AuT#t%BST1kI3|& zztC$8zQ(r`IY1pJ*9}nV>l&BhP}$N_{+Co8N{{6OOF|i0EBs~W;|V&0krlVr!!GS) z%WUh?e`VB}MA)#1NA;zm2F{a(5$ns@xgRRrw8KJrnBE$z#=yJ4;*BPgs}s0%)W6URXRXsR8NK8Rp4^e-aJ`i$QV5Do$DP)L`><4zJ*q<*o8`gW zd#~=9Ke+HkPBw!>5c~T)BCr88{RTmH3Psw#0P2i0>F_bN#JIRrmAR%?uxz{@s+v74 zx#{FEID9L4jeiEULO4yEv2++s=~!J<{LK4lZR8Nl_7I8y>?gzX(^c_n&|B@J5qUg+ zzgiVMr8W%lCi5~GC8m!{t5XMZQoL(mjN9brxq~NO5AzsFR&#RCvXth_lz29 z&67F%04?tfw2_WAQCblhtu^nB`zQ%P&c=X#28ez^1!U4#rZ0TAJTjVux8KG1(C&Em zgl(oh08j6cA8P01fAI9)f~QCFVb>inB|kkgs?Hi83i~d}yxWf^bp5J*@)vuC_8by( zV6WzLH#j}Dr6zdySkqY#BE{MB3R{iEQ!_((9lm5+1o33v2ME;oA{nX5|AjUpeM3wBqR>OmIRsxdIx>%6w7H z9xrASLy@GWN2~6W2a4dE8twfbgU{$2W2}oFyDkdOlpY-EM~P_##li*Ffu0ql7t#KK zA`WWlhe6F20}U91$<>RymhlAlP^omR#_${UvJMK>EFDf3eW!BlvdBKK|1Sswuv&s< zes5PL$}BomD%;s+S(tn-m-SW{795MUOuL`DJkSiVAj3{@S~FI-P07{rjz@YO{F9)u z6r?wv3tf{YM}A<>LU;ZHf$}hk{J;WabVm&Te%(@EmJhLNTPIf-nLnb-dK*to<&~_h z`*<6?b}B*6B6>|S_U$jAcEMCjPTiOC+D(cAJU-4oMV&4)a#f*YaX?18Jj#p#@@pnp z!$ReX*n?`hCQN>EYMu;)%N@M}6FxCl?aehY0c}_2bXv8h98IlEA`f0Gcn@v7Ikz{G zCoM0#2!)a%XDfhDXo|GgC$0e){antC_V;-Z6NZe}=0ap?jU(Zy@#rB|0c)o?Batos z8)ad#Iwtcox|7W67i0LuZhl4wgvJvF29--1t@1qz?Bx;d0nx>W`yp{o4_>K3pNLe< zp)}MkdTGZ>8Bg5J?er^g?B;+%jMDzDl<;<~slVkoU$PuWOPq%u-R;r%+1C@Ri{5*s zlwmRhlp1cBYoU=$AKk9F0%DFnc{G5nA&!pZAppqQEXBQZ6!*cS`y&v?^xJjviclEn z+#DEs1XIN{XmRt;FG{0<<~C5HQ}X>|nIo|b!!SY{yY)URPPvl>;~bw=AHNL!McT)s zI)j=m*Yxj7Cv>-Ua7Bc6=CbrTpc%^5W#koja^Ij-|E@LR+2p6ENbYqt`4!W#VT)Ue zyb-#hnY6^@A3AH)pZHK+9<$jh%-HB+jPbC1xANs{>K6tUxN{~tIaixMyjz@H^k3KA~Pvj}} zXi#HBte&Kq^`I`Zm7v~aC@PUOm)^0ZYwAFTnd{1aR+BwC1%q`@39iKEUUT<%6%2WM z%kn(yZ%~2b-$j0|Kx$`ksG(w3ob#QT6d;~6emd>)kul^?8NmJ?{ZHB7Nk}i_0Rykz zCAUX5lHB!Ihf*%*Nb}ex9py;^4#;!KY-YGa#lZKrb88Uv5OW8=Bv z9j@sLL-`Q=Nji_l!-u3h6&SZCKtlCKt&0^^)pdMJDN<)!k|rJHY-r?G-GaHz)rjX$ z9KY|A)d333f);hzC!VZv!BcDNRTilmx3$mj34@2|fAr)g-S1;C+H+)p^ED_VT>GTb zL!+m+95Z7?`%w@Rn^u*;6qlm2~wtJ=p zMRlh9drA2Zh=d&mR$Y4s6W8Dh!-68SU*b!Jw*~h>&ZAtGoYZ9{<6oqYcBH8Xajx;- zSl=1irMSo{6?9Kq5CCRB9PfARn%aHS+$!-qQs3G8W3wN-qfK;+2@@AU%OQ_rJ}~=` zt46)8s`Bq^rKvLjb#GL1-;+vNK8W^9xdqPeZBd0Pig?=jn(p z^WXZ*`gWfRv^=)Z0SRI5vgVBxxlXrW^j;4-aqOpSpMvtmDhIoH@SDv;tF7eX)9Olo z*_9t2NHWOopYd8fQ0xNNISHQ}LZ8c3k}>*RSx)oT)=y5irW4FDoLhxxms*_=+HdJveG(v(;t?1YnqhXa>fMg2K^^(*p3Sx zO@B!F!T66U>8jw9HF$#Q4|+W}7^G_TWmwZYMvKY`8v`^Ka!+?Ky%TrU zbc$D?Xne`z9pHR^bZ?fnGmui~%%QC}@cbg8XgcDyD(le-+9I_F;m}1ZO)eJGqM4k( z-vN7F$ok5}g|rm-`BU)JjV^f+li?v&RcrqW)a^&UPc4!x8u<`LoqswPMSi^Z;zAU0 z@&2xU@wZV=Yp3GGE}q!D#0tYe_Eg!s!{)s9(5lb80%--8(|1&cgjw`W1|&2Wg^{1* z-80t3(yQvS!WTt8#*6&i|3w&PvvxDX7xuV~>;4Si+?)&bc*G199^-g|-FvXj$|MzV zPSj(0kbMYU{1*rZ0QDdalKmeri0@?N{lss%rE&qt)_)_-LL)g34ofLgSGRdLL{|wS z*Gc10o@%a67!UoWtSqS+4g&k&S)k{qG$xsu9MxjffOtj~8&rTT@3yf=6qz*ug9-ZI z!b&c$K(0TAY_rr1`T!5&HQ9q$+PjbvRxWZ#{Itq|c)S=S0Ig|w^d7~agZ)-CbAfZU z2$obdolWxAGBI+i`hO!+9{}(&7vs7AkXdYHnJ(_m7;09|SrHqjJYaMw=kVV=B^~Am z#K+4$RQy>q!+AfufoFKrUlPg*XkUhBf~J-Ns>EWq$+AyJztCtBM=(Sl>#YI{9L=pXS#+aar;g#JTqR=RmLXo>oSWL0 zl^NPoKbG=;(5TGgQ-`X102Aq6EHIJiSjr^xGPG_nqudjJDV!3T|NXY5pd7FZXcj>| z=Fgl871Pjuc3|kE5^=FO9jix-kOG}mk9XTDZVbiaVYH+}bXrxJkxWg387gTB0JKb| z#R1Kb_i1XWBUFd&(LIp2f(_69c!u=f6WyP5(-exM^_=$RE*&w0shv%7EUd=(9TSu@ zG1LQJvXbBy5w~Z3!)G3&{K5Tn+&hJ{I-^l3Zrw#)C7l6ZHtdhimh}nL`ZXPGBQ?un z-lG45?g<62hcOrCu<7BK8M&D;Dyz@=d60J<%Y4*6+Rl{!oPy<%e{&Wk=t{`8;-&w{ zRy0rf-`R@)Z6%5|rWMaI3WH^KYg(q4&jbSP$dQ5wM*BJ_MY6Mr`S;3G8*?6&HyPYD z@S5`I%FQMO(Z+r*=8@;(JW(EAa#H=6fd<=XE|(O=`0F{ zL=2jg2BI$+cWu>)xV5j>ZaiMESrJTdqrGP?bk4vP&449LGX^l*cElKWfxXSbAI4Ml zeybWPkkziM1TYRZ=*w%B=(v*Zhs@CJ!S#FsQ{I8NXt%TF&6!8cQwOVEM)Rl79%>Q# z;MO#{=#`7;Azh+f=|;$Pcws|--YB8NJ3sn z>fXK}=o>~#D88VIEa1^wxyT*Ex_CkERESt$lTE5u=QpQ4$3(o$~I{E|j~ z9!x^2s-6v96^uN2hUWL0C5S8t^?I=hQ}3KRfuN}O3+?Y7W@Hi5iBNI*T*gi9!25GT ztgx!#A!SxJtEWZsvTl(B@m6%nO@UmIcZX|SXY|sv+1Mru)1shOPum}CjNI~)bS`~y zcH6!@P$IAA2M=7l!8xVZQf8S;b0`_NZ4sU=?ra|KYRbYi8r@3P3w4M3F&>?Y|8$Z8 z`cJoTfA|jB+^M6d@DB-$DlDR*y+J_)qm~^D8%Zpp$4A@QAK3kVrr}U|g&N`Xm_Qq< zLoi-3K^-#nDYF6`DNj*{!JPm8=>V4al0H1@H#FhE$BLlweD;}aX&3{_RT-q0z#E9Z z_B|iq2Fc1y&jOeP**1lo?KC$;BXgtka+inTXi1ifA6Aw96B-FRRV7Ll6}3yC=LG8I9kJN;~>D@A{#6%*3wEaeV&AAwj!;M-Z zVrnl@_zSSypkf9!JZLpgOW-$j2BB55*zOtWX8>7sN!<`Q!7Q-ClbyjgKuI<5!XCU{ z#J{c98_V<>C@GmKc@o3hGZkC|H}x9XR2K$@-$n~UAFF`wRY>+$_wZ%o?@+pwWYOel zip8Fg+@W>tm;c(Kbvf5&3!1$vOEw8ODL_D> z>gzjL#+}Zhx5Pg;IYN%8(hpkk)L@E3!H!>_Vl-BylP~%$#sBE%bJwE(x-Uh2?Xtd- zxyzRrEofrOS#WdQ%;Pp5@;+>NmQk+GCfp9OAnT_hGe()$`w%*msB2zVyMr#Yokao3Q^_0Ku+SVRM;GfXmxqOP2ih>As z$XJ6pdAzx8n~{j47C)RQQZ3w;F25R=Xj4?*;BX1%=PC-OL5hx;xFvw?3N3Xz{c1R{ zU0t;C04><%SX9sM#3uPP1HYt+SRKJ|g8^Jt+l%Run2;CyodUIC_`?zUQOo6NDttt9rU*kNs>wyr;|?CafvFn}KiP5P-y+Jhiv!{_#zfx4=pQY=m|(`Hb*Oc zbz#nWdjoMiafE|3ii3B}IiLs9;F@aavy{m~n1bEK;~?}~$ZU-HEOu`KG3`{lX4`eJ zIoIX4ja{%cRTr%L`KcO&X|Wp!S;>8GiMgt;*WP{rL)*UQ*DUkI%^lf*-4-_EWeZ)P zH$MiGQQPFZC2=2G5CUM`*&3$Q{UZqSnYn>MeILM-Mo}#f&&7aX^0txfCVBx|avKYhQvj(mvfI-EY&jR9yxv_?#!(d7NU6x&}`OA zqkTEMC00)&b%S>wQuuDU4ZcAN`olBWxcZGmHV42>f&cD89*-EHt`zxzxiH;s+l`TH zWL<>J_=!56l(~WanotF{hlo0UPL54{OV3w6NWe1NeuQJfSy?$W>b-85*;0$~XuTw{ zaZcUWmEd+H9A8negtAiT&Wnqz=_aLW#`=5V&@z)BP>_u@j% zX}E+l;ZYN1XF1;^=qE8COc@V+Yz{i@{xleMmCcANd5@>wB2P8@>c3fwQPOFheipCd zeDdIB2Cg3Ao*j1lEk3u_L}g~R^@i$)c_YNyUc+U_W@B|-&(JR8sqMTQ99*jD>-6Z~ z0nwb|AJLp_F}|7BTbU?bau=;HlSrd{Z;{H8s@x^)FQ1B}+v#TVCE*vCZLK03C+X&l z;dqs8Fs%?BqO$=RHK*`p-P6>eIv8vo{Q|}*T7cc(3mEJanCn<$=!O-y;C-0JJUw;T z@U!_0wXZA#-l7sn-;GItF3xaM$t6)aP}$xmRU<8_bZ($4iaC*jVN0XZW1}J3g%3D`LOQ zk>5GHNIGl=V@iqYq^8;XKaaM1l0f0>Gx1#;s#YQ##KDNmPHwYrxX~d;1Vu*wB4RTJ ze{0Uy;jz;ffBbhhB%#iGZ_K_}%d&)ar@L+g9xb>%?lB_Byl+jl-z*0UW^(*3q`X5- zrnsAzb1ckH0nRSv8$%llOv=LPC%l#=gN5pRI(!ItH^}m!qNUO)x%1=@2ClO5Y16_i zc_J02>6F>FSvp3!PoV=6yo)C}#IHH0y_d+__wz8>I{1gLPjBf?*_*j~V++r6PI*rH#VE$+-{P96IcPD_P4~|5Tfyr#YqYbz|Cm-2s2-f5TF1z4z4yQZ zPIs-k)$eF7DHCqu^>(saC+kSKd^({sT4{Fh)1h1(K#)mwc;9VorC871?T0pryTgPW zJX%oWEUx6~b-JB(%#LM*!6GKo4DfoJBHEqd~HiMfRZ~or~cv0|%xoIz5yUJ&M&gvuQM+Cp|`yR9O}w1OvGY!7p;7`5PiWmZbN)AZuSH!wwBJjun3aE6{~ z@r=1J-S1eqsgYzQJ3U1HmMOQ8MSn)-vi={&>7NRZ)N>2c*Db^F;`JL)*9L6ygtVB{ z7>o1i(>nv*k(Mrg&OuD$0Y%mB)cxt+ge=KP*Vqx)3SaTc_1d91CiO(qM8>Vo_WNvdN=(1UX#?W zA#Y}46ReSYHGHRdrt#2L5z;}&)znd6@A?N@}e8W z3(cUPg^8w!=05J`tDJn={@88Ce?KX&r~z~La53EmOl2&tta3^4&fD{xSo=0obrMu; z-;U>gxCGmTXpPf!%kVYO7as48uQ;wd&&|V6%siV@XLapM;-esfNr<-K@`}sJ$|ach zJd`YpbUyT2uWqEF-6xOItzJgug^OCY!BhbF&7GW*U`Jq6q$dKHzenPLS|EIk?-{UJ zD<2Vo9riQoJe-VY)iZVu$E*>tVKW{NGadA7Tyy2y2eV+D-6q1DB8Qi5p2ZZdK-oa;ddoip>-$l$rb?CAIW;xBLbL&KHcNUB3-QJW9KmY9r#sz%!4 z-C?9gI5+hrL#uOcV2$qe5cMM)Z}o0~)dJQQ`_jdK3{Cm0!~gUuLXvjcY@*d=)@N2^ zk4gKDSZ>+s@aAAMzfDRT@F3x>>sUkEWM>yn&7_7P#o{ZSa)?1K*)nk_i|`Id3B88h zVLpWMGs{$x4cG{p1h9=}Q^7I-Yv#7f7g-j;YNix(q^K!kHxDMdF8F6FOpR|-#_{B_ z!slVEOXbww-dk$KzS=hJ4j9*40YSGN_lM-+!6E&O+ozms`v6ut43QX~@3LCT9yGnj z=^ziSI6Yn1!DejognLR$frEKLP2rWoS`8s~*h&h~xsrJ6gI6Ho+H+C6JbM1yYh^mv zJ1hAGLcJhdyn?SrQ?nnay8*OEMF6jqxZB>CZPsn}fCDeAb-d~N2+q|HKOesqFIOSd z{iG+YPvJ&q_{gGv<`j(m=a7oONf8C7g*e`bA?!Y(MulS3u zG4ElGw;AH~I+Y=PY918+BEwY|Dg65e9tYe!2gj>39u4dpQaRbCB7VGYWc4cbJM#G16mpm}KW9nJ{_MFc$pRfdJ@j%5Kh}VZQ_QF&1LPG+x@}ZxIb#y6LWPYa|#g7F4s1; z3sPw|HZbehAy&)v&U3u^pZ&n;o8+H!y-=Ge~8#R9@KMdo4 zwwTtKz~(hMCfGh#)qW$1V7wLEmRlP*MMS^+v4Ts=9yN1>oqE%g?6*a;S6VFZ_qEl9 z2zm>B0ysw_O-K2LrCq_SaH~m}_=ARz%*Q>526Wwm^af4VBqMC+)f>>1{y_qH=8-Re zhCCg{A*+$5zwbBc7TPG(+h+fh{dWv}x#M%da76UH46RWn%kuR*0&andLoC7CXH{2> zhb7dhUBwE%XDy?0NIW^R-X($t*<(r_Gv-*S+H zLh~iQT_PAz&2^XpZ|$UtOvzLO;k;mbZ z?FZ!XQOv=kpQLUn7qx_d5!kWi@Byg==GDm$nV9HfJhgY-rIK{e29apvIF2?Cug#rE z$TRkyXI|viZ0Mcz+YYz+{)!Qv@ir-0{6qdOX!H;yan%#|vxS~lte01rS$d=HSd_Q0 z>fYxaa(g8UDBG5Xm<@2%stvJuWmK2`qdXC;F40ggs2FD<>lL}1p90@p;7$b4^$Ed;QF#$%$@b_)mTW<%yCDI;3rb1;#P zrP$Yvu;z8p81@%Os~ksmlkabpDxxyDqj4;KfoGZhgf9hAd-y$5DV1+aW_S{cKWE)C zf3|1UNlHW)mvea2@X6awf4yDKP>_w2^v^|J8=}}kFIJDI#+Er;PnXZ^`>mwv*?{S{ zGN(*ImZb-7Kj?2Z^4=BZ7pj}^XHbnx>OK;w;TDqyYZST|uSdXdLfR*qTRYqKnjXv@ zA6@jnO!TW)q1{Oi82_*&V(G1^@`>E|HZF@vOif;bU+= zP!2?aMo0lRaf@Iyu2XEC8KfN}?B$B(2` z8^3Fw5;*Qx6T}xo^-a-7ha=y;soC5=*Gm$|RRQsvAhgL;q#0VrLc0Jvu>*$Fnu{b7 z5Y;0>>R+rtBSiXpCXP9k@<&au6xTM*Oj)oa{0~|jnY~uLhdUE~fT{9ou$dQUY7TL` zkj2_VT#`#e%zJ5gD)KJg%LXi3I@4dX0HEx&V~V#@V&l<#_h1?AmiIPR##g{_Yn$=- zlYAU#oo_Gj@Zh=5K-Ni5TgU=NoS4|k@Nrcjscb+)97q< z_*yeB?vL5Zx^?m+wzk`k{Xhp5s$JEt4TrgTO}b{gBHFKzn*Z;P57~`r^d7IDGsXRT z2G|Js<}jLg5$%v_!Q!mH#xNjOpk3XW%hL-YY*0GA$#qtpTU_8?W$v%&g)FQiLkrE| z@f@GCT!JbrGjnYK8N{R-vLl>cJNt0WjjTsln}CpgtjAy5O>#w=Cx8&VQyK`i9w2Oi zV&F^2WZEw>IT!~Nt_y6>ZEo^$2b0^u45bt)x5C(_gMz8Kwn$O%g8F~<$8{yxV8uu5 z!=?fV1%bIoh`s%9MveuJlQnu~SlS)1FSDrLpD_Hq{S~8`Rl_kc{pcK7jVQ1W$GC2? zbWY1{ge^864lUW_X2z*9_p-imn+6Y`!+&RE@6yqlnW_^V;*!~ zeo4)-+8INtLz~M|_Nk4FpW1B_tmATZ5q{C4ZBo&7*23b#);_aUrmNG9x8rZ1 zbw8*MBJ;1`6f#9jKZQNm-1_0kkw*g(=7}iTHS#Ej#u>BX--|-){3{CWdAyw-eJ68S z4}Vda=j^hPt2Y#mlt*SS{=p?sr21iVJ2N*>M_gM0y7C9E8HdJxG=JlX;Jp*`_P*DVK$Rj zv`?&lCEX5rIDzd)SEF78uLp*1Cmt4%>xw)+;O*v>VMic6)Ea1aB4z-xXNH;K>l<$O zs!G$D8x}B+4f4RwZ;F;5flisCKM|5zlF*vUa2)KKQ0UMKiP=EP=)pxhEU*exS#G|nF$ zHqRpnu6!$^k^_>TjlKwa_HOG<{*KR|TAcsHPf;`%|5QknlVw>15Q?F6+J{x53g)wf z#t}DQCFfSK>5(!HE}}E?j}=Pcr;Z6T9F9I0>S`ZPGxq_Kk5x(mLeB8fnhQO|!uE$( zFzH|g06lT#%dQ!cKi;_{v3Z_y(etWouATU9><^~@g3iE3Ca&i*JSu$=-zYeKR(iB? z11H6eEJ)(hz;21wHy5y=`m;~Mi%izl9srFX5maDEK?B^d-bT;Jo=Y84HbHgxgN_g$ zw3cL8YLftnQMuL}P^#b8NP}X2jCJW22Ji0EyRW>DHrucj6F9^YP&#OE!K{UJdsT8& zhhzb;dT%^WXM2CnT(XuxudU~krEE- z4X&^T1M@&i?9S2vtB$^zH*~J^CetFT!L#3*2w-ji@S8c7JQguRB0sNiz~Xh{%A2NLa4We>h76ug%b zxf;nPHEe<)ij(sPs?t%>nxt3t@9)-a5p`yqLi8=4 zNE3kM4Z^sFQ)Pg>!&?=p4liijo(4i-8_UX6(pahOMB~Yy3UduN-}#w7`)*YV79^Z( znG)+I6B-;CEkSos+pUEFvb$}An^@uR>G4E_q9p?A6g5ZGD-pug|SDvO|iyYFX z`P6Ut-+u&tCto*s@~mU$=AR@gAN=`k-M6*rG>&j`N4+?&9WfY8&sdg%S4y>zj{9Net z&br_8#$J20pi{=}gKwZZc+tAlxjY=6x$OOezDtqObdpIxq!;Fjwzhf0H9camF-X0$Vq9V#nneDDppvoXmVT@>~`sHA|MRH~R^p3xg5&@D$>SfRh=5H4} z*!|Ppl|_%|>EeWKGiT-2Jma}49u~vmWZ4dq%B34W@Q6yjvc6=;d-LY)4+3V>WsTiC z#=XeHE*>5NBv*~*neX5E^O^%J@R7`Qvrf#I1n!eNIQAM{XJaP0-=Twwd zh&BIYyY0wI@uFbS?1H!Fi^zb&44w)>v1{{(aZNB;e5e~aVwzLLeCY2qpjt{Yb>&bd z6UP&&;3A2T0qxG&Hv8;k2M{J&yU1)CI{l<2oV79-xNX_k_sRi+1`F_)$43iZLXpyY z&x8uiw|>lwvHoDxS#-HJ1CSLKaBvpOb#=XUpgi>YEh_L*u1toLtG~aHp2SVdRM?Xy zN&piflv%`Qq{^9qiJ9jd9K0gEGyky42p3_(y6-)a=bHJNz>xyqYVrVRj zr#b{m;s;|Fb=hOULk+fTXOfXl=(ZW+`uDvAr}JHG&%Qyhrd~vJBwYruVeOmzy#pD4 zr#PHAwUYueY16V4JWRL$OaLPs_MS2Gfqbw4Hk)67oo#zwGbRQuyD0<)wi9VlL7f zd0DbQvHF%B+1v_&8A zGbmhm9|sZ_#Wxn|f`l2XCc(O+RjSARngR){JmncxBjhD-Zb4BZV#792n_GtTs`*J{fi$DsFOyOfqEK;7$!fY0j z8_fY3D93zUSsK(qz%PN0j``qw0TQs^FSp@PeYB-UTqCU4o2?7VUM2^~!1mw1cgJJ5 zkA5m(ZDnhnExYPn9j6#g%zT!(WT*Kl>V0v*V1D?d!Z(1haqL0Rr$kMWIIe@;JHK-V z0xN)>FVBxL|<}kczJa0ZxAa~qMom0WuxpDUL zu7A$wS#Y0cTrai!junNTE_5hl58MGSudJFGcPn2>%ItZNebreF!&3CABetL;#}HkR zvxhmb1DC8leS_1@5_s%m=b%dJvGPb|@JFf}vN9+>&7n*jh?dO-v?^nWcZXE5yp)b_^34n^!4vne?&Icx$HjREpE0U2NeI52B_?N#w$}Ymf#7@Ds|a`^YQwi{VYoZC8HnZF>^ghz$tu_BgCvt@%{1Hz zU@xnb-+7 z1I~zp6nvMh4BM*KH@F2-cn&J+I%~0)wey}u!ycR+kRd?eJJ}L!_Q=>F09gi3O)uh> z#Y+Mjxe0v4sVJZW%6RDbWAtQybbZ?ZYpPJeKw{!Q`WKkANd$lo{V-|oqoLJ%8k;6c z#x9c!h=6*D-daKXBVZPE9yPxtbe;vJ1+hAL*``l%#u1kyRig+CpYq-Cw;3^Q%;Y{x^F{Ejfo7FE~bcD~F@onI5%Ui9!7U0j)hT zT&mN@oalTX1qbc5Hfi1_^|_#EXaDQ^#sBXT)Lm(|-cS_Ncl}9gwA_sK zmy8YGU;5BDYv!h@s#-i51lUi;1vF7MLO2e-l)zD$pal@os|^J9YTscX8Y3M2r(Xc6 z7*!2?i><6PZJjKOrk?LP6!UNP6PVJJFijMy9_IfS^x>?=r&t0=c{ZmU(N&4_qk58pz`Dq-40LM#}kHmz{!jSPG;fsBOXo=3fUcKA3ZzaI%KH#PmjN? z3{8cl6gCdWCwGmdT-L9N>WrQcwe+|a01N{ja0?aG@`|1|NRB%*3MCc`CZUD$c!5%$ z9%`($wkE@otP3?>LhX4+H<`$`X$5C|H{tC^IS`PMJXjr%BK+4Ug@x$6I-YpiMgHUF zeCeAEsqX%t&ItqjxAowrrQE5Vak=9K*%=EQpl_)o6lZVuPEY&mfXfdzG(OrD)@_vx z(#^rA$SH!ts@V=q9FXt({eY_}TsTq}FZuwnAT>kIh{2|#%#VOjF2oA2k_R{r0Inv# zIo27~@JbP2c}*CX?o|fyyIT7AH7Ask9Y0L(zsTVn9H!aOKwNW4NcJ2TX6hEXSo;w; zg{b-RmyozNNF8um-N+UOIk}v;gK*X}!z*msZ?Cyr)?kp3UjuhyL z*ww1JZg3-^YNc>Or?LV-f?saKrnSvR{l3VAOJlMjp!F|Y8Sid=<;0~1ofQ_f?Jny{ z*L!+GXQKrX0gXyK5W&{6>2WwmyzLQ81nd>CX|uI4jL+lBS=9<2ES$+%i9AY^TOa zJqVe{6=OCNgGP{VRln3>pkJusdQyxb;RN8@Y zkwU&}yXEFY{>r2F)zY4TrVlU3!Kox-TNrb+2w|gafbl5)O4+4XzgL(3&FUXzU5qb@ zxWDirzp>6z3YV&TImgt|s~Xg$$KVFlJ?F(=b*X@{e>DHLvN7Ln19;EZc9t-R>eAOF z5$;f{VAKhiT03>j`x{07A8T(NR`u3)3vU4hln_vnav|MFcPI_g9TL(lAiV$yK}15j zLAtv;q`SMjyB2lk+WUFm@B6Ovo#)!mKJQ=t<=&USHRpYgd)#A;`Bpho1s<-H&iu^S zoQJZ_>2kHWDxqxZYb5?yu|^);BHlwVD#G8MN&x-*BX-YAbWY6u6OpDO-UwSEr%pNZ zn=DKPevwYY&50VSf}hIqx#t(MQv_>L1h+eFy2%rYZ~YKGwFx$nLyzF9B|s91oPdtJ zu)ur=*r;gu48jXaevI#lQMq*D4NvK;ZBKfn1z5SS4~g9;;zRNf;j8#kAVrzJkGt`J zs~r1S^)5;(f0ByD0x2eGJKs!ZqD%Lz$Ng=4%uP=NKcE=B(^-rglp8+?ytG2vj|aly z$!~K69Y)~U(kJaD2pzUyd(I)nz}4mcdXeblbVN4pdcSr7t`Ju5xpuJ_&5~aif@pLB zX{f?oz=M58M&83Fp>=By*DUh8IjiB@=YL%EYSr&QLE2}0`ZtppJ?G&TNP_+NX#&7D zzy{@LTustwq<5YDIQ8mCy8=;s0 zNCsN7IOvVO9Q85?Q&P#}c7kzJTwlV?eh?7Wye)I`y~ljIvtZ$Udc)Jf4S3Gx_qg#5 z{E0nEIcTiek6@0Poi8f?N)WXH*uW-@Y*!zlwM%dzyQ2t*V`2aWLlI&1UxQpA%U}}H z?B3zU{Pn~r{o0Y{X;{Sl5@wVWA{2U4KB3LAQ*b?W`SjrLfh6Ea69*q6>5q4uX{hjH z?4Z&`QRovkOu&$@SdtBIu1p?AxwvQ?;~dllzm-zlpHnD9-V%-#F7fUq-T9;>FVu;$ z7Whs}WY**PYA9!t!yO0Roc%J?r7F|~Ss(t)6=`F@S0X{Iu-K9p#Vce}l>E!>lWV`F zCi>YP_{YsMC*A_%;4vFn#z2_+K3J{wP}USToDclCdo7NC!!)=d@Z8Av72pWk21e&> zfp|nS=HUyqCX1qGm-F>K%ou<|Sjvw&Nj-EKYBrZgIT3HA7Qry`28UAS{qxI3Z_HRg zQ%-=#>xu3PajG;g9j6S9Spb|-G#}vF;8?$0@rcAX{@d<6&u?H9{r2#{m*2COU~|l& z;RsP#5ny=w(sU!2c8MVv(a|$e1?UO|6$R7Zuu0tBrZr3SJyf#;EP;=Kd^7I9Df|KaNJI0h*RBj!JuCWJ|k zW#n3$cO+$}OoO~mn)f;UUYt2PtqNx==GeYBYtt`GTyM!7a|Hr{Q#8RuTvQ_)xJqeQ z;jYqxA1kcS6%*24w~@n*z{={%W1#KVm}P=w9VxRvQ=a~n)|Da#MG&gF^`X?yKjrQO z_6&IPum~H7Tm#(PecmMW46?h5eu6)sh<17<>mTzAzCb==p=TZh??U(O)}0g>!A`f@ zy3~dokt!DMPCyfDFolz@k!E1lo#@NtKQleKIbkd-3;w&lL(l)0!4{kdL#6(a{pHZN zr3Lf4c)7wLrYFUyClv%=Dcx=YiyW)G$EQ%4Z`o*RcW-zKs@hnanP}=xwr-e!{A=u+ z3ivk5OO=?=zhyt2Yw~daY+K37T$DTWEx_qnuDe@>v5ED|xiO1l#KI#C>PIjPPqMyb zc!ba;6C2AQpaaXtp>CgSuvJdkJRjm}4aVDccfoNZUET>;II)4PUiB4_+cTFM4=`vA zApET*J^a}GXcipE)aAtLgoiA-sp|soZ5?yQdUhY4&a1EZRyoekrK8`>(>2~48{Jgd z7=3*n$pN`pMBYOW8@Rr|omqIr4nzf6G1|eYgkT>_nF|T*`P0#=a{c^z=f{H5*Bt$} z=WHfLZS9h*X*t|V`5tE75pGaF*TODlMe0|?_A4~?WiO!cxVym?lrS;$<(#g6(I{%+<9w_o*f>p5mSct4@$^Y*v_^$wE!}5=~fg6ixlWdt~H^ZRWCmm5QXEBt^fJB!> zP>K+1)}nrtE3AC4$6)?1SC|ky2n#f^js-I75oh;h!(fT|Hw%~TVeSLs|5E`4opqkt z{B68@7H@yORc!C|b@5Km|Gn)aLJ`e)a86zdK!ejt9ZMfzkH4ub9VzVai(4W3mzvo}&-fL|C!+!Ff(!Srzc71~jShXTfub zMuUTw|2BmA(gZJX?sB{o-*^AYNSjtCkE>fv8^s0@M(~UZI6F8(y8CIbT@Q~g_mai_ z7>EkZFeW_&{`7EJH8_9g+S#@1b?fJ~wvLf)0N4E$i~Foo>5}gbe6H%MyT6r+1;opI zJgi4&dS)A<>}iVrSV?EgaPKs%ERfRNnsNL@9v+8ud%f3o8z7_zOokdIISN~CY%9@| zAu^*O%c0y&AmRdUy8knHy|E1F*T+8pOIDx&mlgb%Q`PKWPSuGGYHq=v9`o=b%=zq} z8q{OJh7VIZ{nMz*x%EU8gc>c{D7JioZ%cKvxKRF%7Vod=1`VG4=eL&%i42UY@ocCy zFsRDQjSnq(KY^Y>OV{WHmO6ZW6mihmS-?-6vtNz$xm_%n8}-MN3m9hfTU#eB^v(<4 zuQ7Uby^pV|sy?sT>4ockrB8!d$15jvQryRgvSdsa)h2j=ro zy9~C0B(whOxvTa3N+WU=!>{*X3Z>J zVLwv5lErE5GJG4atPHhid#>_E)5Dgw6ciVYuzO(-^ZPJaKEqcohp+9Lzv9M#t$!$&S8nL1SfC<19^Xdc0CGJp3D z!u9N%e2U!vLB9R1C}?Jld|2CC6rMmra`zMu&yqOK0B_I2a|?&^eY7s{Q+SlFV9dk; z9NJH?2ywpD+mWSbP`lfZ=9n3U-hR0SnYMMhVeY-6v)TeVI_l4icM^5x zT6ZgEqRKea0rOmNbp%rE7-|leo1$h;A5cr71^brdW}Vkry6E@<6XVU}^=N$=u=`%p zR@HJ&cLvvbulBbKpIjr&xb8=FTg{Ql4VnuGQR>*A>2jt#F&}xMC2)qYs3}M^KZ@Mj zH4WC>$y!7Sfr9o&^wl`bKj}D6tGd2Jt+-{wyF#dx> zhYCM*zxC7nLy^8)C(Dvca#GbdD~QhVmP>5UtahB5mh;AfR9{?=h2`;^hQ_ILmYHZp z8LqK-r{OMg>!jfCI>rg*eGje=j8)VP4ef3QWZnS!N7RjZNcNMhji;H;%&5*=mByP) z0j~Z$AnR)gx}ORJFYuIB_TA6?AmHeyt6n98M|Mn@v#tYPgemjxxJ*>*PC7=?BFT(6 z+e{o;1x$C`qBgrq9IP&q0AbM9@*)=o;nK)fBHE=bDW4fgex?j5Ba``&qKIH z-R_Atj8Y%JSpYOgaDP14$ZqAr-Fn0If%WMc{^aEfL0qbbQ#jj?pf`n$cQsd&q6Bfo z33DGlxny6l$67afsR^Zu4H#Pm;ca@j+#HSJTm1SZbA0k>VREXxst@NQwC<~#4Uefl zTgA1CAyx45ajZ3K)KQ&PLWLNxvA4D2>UKPjVkAyb>DzqShL}vFDYk~+vnN||$*O!* zgo@bOfRU3zQ-BQpTn5G<8~i%RHav;!jPkw5-^XRi7w|l!J3P7OCOE3s4(fKnn*Tzr zZN+`HYV7s1!$H;>`k9Te&XW0-_M z{-b^r&qwRt%_%2Bsc%Nj@_#47BuqLRa-geIKz0 zc<7<6yq8Vh)idkSC-N}}*0*U~k{ z%pQHeUo8~4FWF0WymvRM(^&;06zO|HLH2BQ#n`>7)I9Cd>22*&2g@wwF^+jP zv*>$@_b-jFg9rrPiUtxIo-KW8*2siJL^0}U$8uOxu$hg93<%u6bH6=PRcwpVqg`kD zxf|C+Il5>uDsTBHw6*BT$&}RjDl1Epe;ONkFebe}?H2hAOHw#l2IY~2gxtlrrUIh9 zCb|u~;C!S!b9T`)t)T%Q>M5)n=cw3krx^S{=mxIoqm8-Ju{WifZRK#jqdy=Y#3dNz z4k1ZKp+flnDFlxBD;&c{+;8wW>Q~)jdjmJX6@?woRj)N5(PFDf|TsW$it9XfNytha$QrZmrSd z9{ud3NC-2+ykLu_+^@4OJIO6vDECML;rbDM@Dg|V%8dun} zKjcQ{i?ZJ92U+%HU}q3S2;AS4j`3N~^M*;~C5r~)_l(H$EuEoj0|Lp!d2`7RXRps^ zzs&AQ^;Je(8hAXAom*h0P_6i#Rh1rCUpO=4)hvY)VYjm2(s0G)8SvvueDGh&_D}CM zCYhQrS@klOr!ez!LOL0Z@lNAXYKE4*mo?eoCK*b&l2h+Kdd*-%j=F0x039E0?vU{~ z{q57TGxO%V?(LwgIQd|$$)>%!m>}w@p_}iRfQTTL9MZD~|KT5!ufT5}bwil-u+2|U z90~T>8~J5Kor+%AkjO4N) zZUE&THvXh1w8cJ_X4-FL3;L?~Mt?${%}C}zh)hE5nlQ92S*O&6fBpp&bZdXBY<325KpnIK+1S?^U+Ya~-@5sL{ zRXPs*v-dm8=YD_mzyryJMf9a!nTc=4co9~QM8J!_wPZxhaF?^~ZUSV1IbE6afPWy3qHnaV<=5FHGANWiu zbzk0S=8k6^A4@TIi4s^EbOm{Og?R4L2NNjFbe{T64Vz6wG=zYMKIi zEl-%YD}F~kx`SOas@EFjx9Jc6o-hD7q@3(7Gs(RjRtFv<>S zJyeOCy!Jy#Kelso;kHg(dOxu`mO@>~h6A^RPxO9P0gA5?Xn%5DCr$~p& zIZEsXr#6umL85-I9IAjSIH}@pD>E_N7o8wQ&5DKWObp`Mt37i6im#>z6mg55{rU_3 z>I;6BAo(7Y)2vHCovzNF@7-eHA%B?Tb2%;Zalh>QtWsOL8}&y>61!!rf8D|u>AAI5 zea-vC8(&M+=>5NDxU z^I>Ezbk|>OJanfS<0G$LgRa{(nop|U8f(Z|ukq{b#1An8+7zy#U!=_(=p=aa-hv)! z<4+qlFXk-u&I2kT&F=+s`7X;%D6zTGV$5H`y3-*V$$^N)C>oo2%8oKG@K6EubjwI= zrw1GKHAbn@?1q2P6v2g;Y`)&!Ac7d)L$p= zZHOiVQj=DC^$OFXnkaeEc$&vLjw_c6SZ;$pZ%y~*(^TEbz7)CJNb-nWnSN#6jq^>l zu%Y<94a#XNn&-S`v{4$!#?sQJAs!@MzVoL{_?QzY){NT23i)WLgmvicLa}c5b2Q>j zT&!9*G_oZ6=+~GHdHqM%^;B~I-FS!fuu!&Q45V;d=r<`XiDhnpa?0u2E~z{dOY>}n z{=7OZbh*L*F=F}iFNDKk3#0mt{pqp@u_$PPj~-?ffEJk5#Bcg}(umHOKlXmM+KzH- zaET^Hz@vfp?(*f;VQcjkT36Oxyxp_}4-Wbq_GaPM>i}Fv=3AU+MoFhw;!kFh4s(kH z#-mUB>i5sye?B`wd+pwMdl5#@zA%d$;SPRH+oQIq?mAiiBWT^hysH6V+bgb+hGuh* z8FG|!DWY^7vik&%J5z11iBi!~>l5oP-;sQGP1(gzge-H=r`~6bg}nA&8)Uca9lfK> z*Vt3c(&S6MPRG?LTIq{DE2v}HOYm~$5b0;;0~C%w@ojRKT#YNT*Mos0~{1o?kdIg^#(l~;j_-b@MW zwVahEj%On89F@ATK5iCy^DtxW=Y12DQ&ml`>u*0RyYgaK&>PF%JcxoS=H`8}rxL(( zci2Mka)0Nc3cd$cU#XOPt;E@na3-`zZ*P9E^cNxB$FiAglnSy7+#HgwGUAxNI&VB` zC(D*k6}1S#LHG3enm%qRJ7fT(rcU&l<~XCPkKc%w)wnQ zObWX%6?HSOiz=m#E%|gwNNc&9tT>+PY2jrkAHBO4WBVUE{4QRTeAK2;tUO3g5Gfmi z8)0~vwE9~(k~E|k!~72+W3EiO;G2}HrNbXVv-X-3B3hB>Jzh;wi$DGE>X$i z4VkU_pL2zr$Fu!93o71t&I>2|k&g>9OT^$#5NC z;(9j3`3p973MXf(Xb|?6^0MFs8Kg@-{}F2oK%vIfg-#i@Ne60?cX-$%&50;2hh^bX)fD$IJ4ixw5X5$c(znl(+yML=G&}$hsl67 zjDXx5YjdifhDBh8vqo&rp%w(D=;zsz9qD47U}0@;p`;J|vQ;o2kzVUe4GM8EE)S!x zoNb|b=zI@cYhmd{W)tUxtpCP@hzbZ%c}seWX5NGW;Vck7U&DBekg{R%f&} z*NDiw+IsZ&&I&>yO|N=O#fH&Wh>s+5B-m5$w+s~Yigku8FyhGyM$nfd{8ud%`(OF^ z*S{5B5?(o`ix5mQ7F7O_EedW$x{J#w=Rdm@-AM3TfisdN^II6+Tv%i29*pV9Fdu}8 zBF7{?z-!alBgFPhOhuwM8%p^am^WXeOv^KPiOSd=%_Q3yO71HR`KjgA5GdFjfi;O8G;XdA97RxcOw6&6mGb->w9G;DbJ$=)x>U(ZzOZLMSkje4W}``k|-<^l!p zM@N{Ulb;F`_lP<2)fFS}?_6K!S`)bk06yeS&MqW##A-Xdg)&a6LPbh(TqVdpew8 zZ+N6N07l~>X8&jBc-S}28!QlNbp9@sGt_qiq$9MR{P_0y)UNPLvD=sJlJ-xijPHV` zLhv8nQgk#iML2o3f&#%UBq^35Nyl5fC~aK0L24st_*d%~vwr(~Jf>sz7`74NWJ0{3ji#XWg-d zQ&$sGt)uwPCtESN%tkGbC-sAImy1=iHAG&yo?;P95uwi{xCKGa)>JD#fHBK(Gz+QN zz1iz4eAJE+KfmWb)%qzz#1rlPaL-_CIDI%%RtF4Qm=?D_NBYub=k$A%;2e+vE~&0? z0ks3dSnqmKau&?TFAA)_5hhRIa~fL4eb;>cd9h(LWLuO#xF?C({=4b2bhJ{of;#XX zhwib1C&EBT<-WFCx@3eQKz~y;Agocfpf1NdLC2xPg%b$0(mu9*hhv(~_-Z@1Lv3i6 zh;3IJ?#vwk{^1;yvNEGHp-uu*eHjC2u{#n$@q(`hNMFX+dxpNrWT%?!wg8jpbjz8F_1?E!>a`B}gf^@4#~VrC6z-FNYNg-yfX`9t>UfQQ%YF9p$V&(ruv7u@ z&h1;aLn64-+#!oI#5K1I8A&zVaKspJ>aQEeC z<-wUkt%Ifci4Q7{!D4bV|J_A6wKe{Au6iw4Q!&_~EF;@FeT>YzT*2hp`i+yOT4-*m zv&hsdoaJG;OlCTm>=|!@As=ru0$Dt%7_j#S(%t(tp;b@NSUG8)jQfK$?1isjtr3oy1mHcr0cV;s_YV^;}!Z;%U zppEW*Q5tas2y6JUD5tMjhTc4T8~aFp2-}s2Kd)7v%ws5w)pIU-K*V9|2g;EuIqBd4 zGuCE37MDUxQ@3&s3d&KGwu^snlEA{#5wY$xi9#{9N{v~R(>VZZL?{sIQzP~_x~IVv$XM{W|IlxFFL1S$nFQVLwpP+^=f97~mFAZm`i4bn*c(kr_loQW zV%Iw~T&S~<#ZYkr#0+7sy&k^}O^6Zrda`}4NP~IbJwhjJT9&JZUfFUTXX&GLxg}&9 z57;t)()Hll?j&_{6aA~brdG`P9IgCl)V$pGj`4#y3tKhrVW{R~au`<$b3GqKTi5U0 zoC*}+^-EtZ@`nbIerm~PC9vNmU=3O05|0&nF7F(P8%b6r))USm{}(ZNq<1~~+rD%m z?*8W{goX&ZdusRPJy~Ga2}~Y=&r|t-^peUI=%rF5zgrJMcrPhcMW#3`zV0@Rrur8@ zX{Wd+nhfCrRhY{>vcol_nD8N(O|I1~UeL^)H=vxd(n-S5*mDr~kx#Z_59V?rP7fUG zM{|^W2(`Y5b)AC3*m)x>5D`Sg)3ZJHEklP>xlsFqXi(LdaKu8k+`W#+t+LDcF8MdB zr1uiu1H3Emt9ylWjKf_k-hRG#fQa0^+NCHhUvm5O>E=vX@y|KUgVMrmI|{m~-WN%q zm;G(WlvO3cq@Fb{DV*-HSMERDc>l-MMWYAKwj2F#VenL$7{skC&?`6xq;E<31tsj> zsOBk2_+r+opHG`J7ADT=Io>}&H0)lb4jRjo9?l9Q*He7}o~f)_RuGq|QYH$N6*X(^ z{h=;uJsE$sYgj^wIw4`8xcJUb3XlIcc|qC*;ExqDUZ)Wdej^}1D!n=*1bh~Kn0WI+ z8PXlG_9KWz*q}n@zER1irIyWKWujPALh#;+CY@1}^3QrFwFta-e*QR`NAmWs-pM^p zD`v#AenKjdl~y7A3Tut$a}_t9r+bFKpmj`GMxrn0mE8c>OvOD=Y8w9jCePneKQW8e zJOu90fA>m%{HeGrlo&7K8G~zzlFHY<_cuL^%=)m;S2IsH`MgK6ay9aE%1q|pRm_@6 zsRJtIO84ACU0?hHYYw_L!(mE-PQX@H)WBjHdvjZfH$k>+#8T|R`7uSP)pte`EJ5j~ z+~(_?k8dv)cw)KU$x*=A&BwLaX>?@xuW#%C(`Y$NJW?mQMl+l@6*OFBqkpxvk+fRx zxDYjF-uoI6-)6v>?AZ=i#SG@(c_*SeH3T-V*(N75WWk}&#| zEWT7kPXbp`fWM4Ya@cj85_RJ=)~PLObd7Y^F4=ZVFHJN* z|4*s?KZk=!;-_*5w~v_mwhbO2tPP7LQ>K=HNnn>7O$*$hvhun2K6;A#ZQ@ow zmsk`Cw{$q3{K`3ic-n24DJZcWqlsZL4$4zI5_@~{<@O<(c~tU2fS~p5n-5QRWyR#q z*^Db$OPY#!QDIT(X^7*o(KxHpCO)Y_#%13{dN)Y21B~847`OoM8cZGV5~A^3b=a)J znBTQ4QQ{qY;m59&-<0!6IN$Tg>VqT6GH}oV#l;t~%yks)vHVp?7yn?^(ErDhIv-8>oZy}*=I%164NZo9# zSes!#=fZp(%|+igP)hexCYAm3WhG;i8!{ zyfKEwpZ8}axIb4(!f8lSfL&wYaM%N{H?wp!-w_oCYHZ@e0#8DJ_pdJrzj&Gv-ens% zrUv#wLmf(pPNpRA+vj_Yskh`9wkJ7$ztw1?fS(Im15QPeK8rR$_kBD16=7o-sqK_S zhB}#+PRSPP)EBE(6226MA?DKK@b!c&WyE!TMe4lFmao;XO1P)xTlF2qgzEb`H2xoI zI{#g}%Kyh}myNws$bV%4fEj?#zs-i6Ue6U2G8~^C(qK+4Zu@Pjvz>`3O>3gpnEa<9 z^46kdNF&Lt%B!Z2$gZ-ij@IMGSZa7AY8{NbeNY+27aDF?Cl(@IkuGL$K8caMqb5Ty z^ByiV@pyNe)-2=r!q7xo@@zCFrgzATcSWD5x5<+*{{p>3c@e_jfhGA8(#ZJL?lg$4 zw^lB)>jFjrz~ueUiu!okYa8pR5#6&rnpiS4J$fXRnLeq;01FTMycIQjd3Ee046hMc?uYas%s*n6pOsQ&DD&IPZ>!79ErpVnL|#S1 zkB+hpdA^bBdTG?IL@YPp0I0zc`5kc@x)&oWi9Hy0d5N-Rl>X?%B4$=6i?0XW`$18-Qv;B>K-j7WzvtU|2VW zH9n}(F8Jjy$Y?;}GEA)J{~Z;9)H&A1kpI)HL74O^3eMNNmM8sDAm6+z2dwVKx+6-= z#-?sKLG>6r<9EZc1szR9BMag&Frj6-s=6!#VZw z=l8IsP7(4jBnOwc-(Q{5qK;7ZvMZPt-es0HKO8uY1`7}-&tW4&1o*h*Z>mK34;iX4 zcoS2S4aSc$Mk@IxnADG;p!+0^{4g{cpFB{e()n#g#_J)7mH4S;FpmllKNyj;Pe^e% z<-x8_HhM<0t$V_=6%B!~=7EBHlRLhsga`C0?UpWs%wx(d{d%Zxs*iF@DF`}(z;+s} z5i_6wBkUb4eu*)Z!>ev?lU{JRbi(@)Yeh(BxqG&r^Z}1V=en{As4h6TVilx`66!CL zJ|o#Lw>$J|Rwu3q#fOH9lS_&pZXkZS;w+Jw>oZtt`6@Byl8zFtha^es*orU!sK1i~~O7CuhNrLjJf& zGBt`-3JL}22ch`F>aKQ$t`J9P@9|S_`h`(y%$1~N$cl%0iPGK8ilh3LaG7zXMV`$0 z(F|ljcZ8?a%0l*j_p<%LdZ`kww{GGo>%1~Ursm)mp$ElduV2N$y8#Q+U~np{`Ix8YDHGQM!96<%}p5eE~EH$blU4Wj6NW^5W&>)ET{(%xhRC^YR zA2)g$cr+<=(QSMpa2{bQibaeda^^02OY{5zu4fO==h6Y=@LQvK9zXQ04HfG*6LGPP z*)=hZ`62F19@jzm>`vZCABdFy&HiQb5Dp`KIW`DNI@H0*_zDmL0)>B_{IK9IyR4CV zyu!Mp7s5HRScU){Wix9^Tw&~f=27rn^t!{d_0llbANAl`4!_Q2$PoJM6Pkf^k`b>` zj0$INA4iS$YOI%ri~PXM|3O;{7AMG0i*VkX9;bu95y=c4UJ_@V3Icm28v%b=Dy+H1 zPTLB!b;~OkUx17v0X^X5<37LD+Y$K)(i%mh7J<4P{$TvYq%DRqsO71~BIez%5Yjyb zgT3p$7+#El3 zP(4QOl0fTu_Z?%RQ$>@bi2vsHLWj9(q1^c>Giw9KZaDRV*n9_!htxu_i|=Iwt5->oK+)S(*mLukkvhFI|KW?l@wN8D5o;G!ld! z_jzBp?-lGldl1m{+K-6*IgLtq`Fc^;>V!@oe#9c*%XE|NRSD*;2;7vMfO=?Uq^m@I zUuDrse?0q`XfLA!>3655;TtIJ$B6)GzWMx$sfwQ*^MG=tZM<*LdgZogB{X<5L^~0H zj_hekz#d7|`->!vk^ffs1;b@V$O$+nDkjAAa!6A$L&R1&7<-mk zhm|&%)P)G$dU3_g8TT?+`=0DxT!(!gph06duKZGF*@tPP%g=*X)cA!)L$^pCFKYuj z+58dzy%4o&)<}Yg=a5%wN4KKtC(g*sNG^>KV`yG$Hv0M4x``WA10k`eaS&n7BGaU6HppBbc@`hrb$Np}nh;$<{^ELR>4mCu#4#K0a=# zGF}S{-dJr*NJ$*1LV_V;a4QAzo+AxpR-(Oi{76l*>Eip4!3zn-$RB5&x{e$xVl+eO zUUn7xdq}$;dy|jqlmrp!(LCocKknf@?&;PLlXqfQ#@pjJpO?&SdZO-W%FV_i1I;a# zUC)Uh-y&YjCMwB!sj50|QO8*qN0cwl50M_jdTHNQLWQE%H{u2c&p1aed^PJFsi3H< z-j2p7^Qo+sRVak^v;HObo|bff9Mqj<)WMdk-swIYyH@|@Stf|}24zwGlS}Qr1mGY0 za03zK~kFeF~&qL)*p;Ed7$q;jEVmOY^115k2*YCgAyT)SzqrSp3upXZiVb6 z&fgP5e>ululZ>e0g zbwafjASV(MBre!Vavy8dtLcn;3=*d&1fV9)Wn>EeFMv=ICpehfo+Iq*6I@Zubhht; zc<++aP){e$iRi|1tu3%Vlp2-u-W|FfkKra=J+&%6v5HhH9ug&(Iu=m5Vc@{nUNH}o z%E&^UsGd}b{~h>#uNQ2Uww!EcaL=IauLlomt`lvi)%W+ z-r-$vz>uqw|K0H1{?-rHK=BI+rdDK{`UgTa_NL>4zBSj{4?Eucla0QJ%nn`>^NE6^ z?!$7Q(it7Hz_{JT2)?UHZ{~wk%zCKA2Y|fNLKt~gmggQHsEMmx+`8D)^Ymv^s*@%Q zPv`v_2_hgyXuEQZ218`i!wd%6|D*1+=m8ucpgSFN2u}1^nv)EY9`eR?uHJ{PzZ82x zZ}s3wp63yIe;XtyG|uC}HENlxEfUK|_D3UfnYCk^t1D_tS^g#ckt5Sip`@j3Ctz_w z@9t+pPOl5sM55OHmnO2=Pb4O52|;&3H}Nmx@z0I61dB00wK@(xm&R6yUu1iP1Oj)x z?DD&J?%Z9)7Cid`8G~?jGR8rajhaL5K*$2lk(=)!b7*z%_?Q+_++epoWkL~?-; z#`^mU79hDms}Zj$hbMI088GKv#a26`K8z_>%o}NH>S&}4f@PI$O&JLV!amP z5vld}DaE)5L-{kyWTM^?lYUHX7WDhmM{ zE4i>yYS7M?P_vOWoIOqwSEi)&UP}JA$R-~jOXN=ZT9I0k83JJ|xLd z!Nw7W+Mbw=cF(Z^7ECEf9!FC*x;WVYZ4rJt{570)bgodULJyd@ zK=L(GgiA`u0QKmrhc>9E=mgf3*Sn4(qxqFFN(EXXD$(MX0gd-E^RdhlcWT8XN|l^?KAc1ZH7N_>xPmQyJveDji7bfI92Q{^$1&XTO&wC$Q#2xi3>HM}Z;k?OO zNo%KI%P+z0;G@k|6%+Fn$k>xmNH=4fIZsC&=*o$p-Lub0dV}B=e~rVX9qZMyzSY}`ut0*=D3&YD~-;~ob_f|WCm6Z*{`2pJTi&7 zJVvT@cbv~pXSFU47%k8on0K@@YNUnq#q6Q`u(^JUBh4=y<0yD7z;HLOd-JvT>aafC zoMfcj|AAc$X|G|f8)lJ1x9}O5ueS9#ED^rxYz8YuGwzuY(l#P`70+z zLqYLL0e$-XdR$MAhsrct@CNpIO_jen=g0=Z;iU1s_g-o7dPdyzk_w%Um1Xq#`D(a1 zS2sII?hNX)w9hI3x`DrrggPL>%jiwL&x?HhS|?Y{NOzGm>{BZ2XSCVque}>X`@@pDDS-jyBgA-n*RBTQTs(kpF@eC z{vGTD^XjStVo>9pQFEac{hg!cYu= zt;*d=WgURg&A$c``lhEFOzloYB6E&on==568aAoj+Y2epXrvFob;D(^qhBE;Iobc= zxLaRk?`>&#;C5bl28rdv8X%~%+w~ayRg$jG5z*^PohX#lcduq7hg+4^)f}<0*C+$YYwf;}UeCZT>pJ}J5kyss$k!ip z-7ty{_yI^~9VmqK;R>#I`a$YwFW+?*cO-q(yt{1uc*4)xwukSs_tB?SF8kbV*Rd9t z*Z584%MocczZaS;QBDHtmWgXs2S;DAH_=@kXQ2W4291cA#bznzW=iAPin18orzkTF zmv;oeIV|XZ$<{m@^}fis#jw!7%P=w9Kt1rT!p*2V(pY6-%OVY;pV}qmY^reF`8|DS z(vSSLL0D9W#jU>>LN;&gFlC9^%wnO)Qc0jZDekUT)_F(d+eqn+TveTE0E@TnK&x#( zDL-pKo_2kDO@5~WbK3V~zG%H5$MAfmqd%j6;I{iJ*l|KKg0@R`{jSOF<|;D@W#5#; z&~~Brmf20f@p`-b-;xSXkpXkm@m69c{P|zZ`V*#SMC~M z8I(uI637tEeqQ8m(cvmIV18jidLLIfff7#U`N{`X_)Y}Dxm>64w|&JIuR7n&2{K0H zGvbf8S(;WMY`#hd8E;z3H8F?V05x!$f>&!_2ktx*^Yv{^FN_SP3zycT(in|^TXXxv$4oOGz{ z9q-#YD^7gj^-0((q3~Ci?)(9p-StjMdNYmGuxMjeJ%S(hevM_-&Bsot9%>qM$VMwR zjQdOKp%Wm?9`;yKr>5T=I@iJkc`M)kGX_KPhNWt*K5Jd664#9UpRJ^40& zU5gT=EIHab`>h#9@Ac}Xtie_sI1r6qwPq7if(fI%FG&b%CVZa&vdrS7{|Lc z@YVTXWRH(KOcW&Yh|U^da5{XCzt3`Q8T;8EsdbK3mkJp< zH`qZ~e+^P)XEq3#ny=C32Xd8j`%~Txe?ZLYUFT93H%(qdIJr<+@e*S7q`4X+aY7lSh1?vDJY2g@SYH$-nI4x{eX2C*cIg#oTa$$zUWA!Yyqzu@48>2HqJl9#j&4rGQZimU(Y4$@MLeEP%POyeyhSM22 z7%fi9zrZ~E;CpNxeib! zrvz*N2Y*TCD0ZSZ2cO_F&~c5}8;B&ogbzx5C|HQTL5JTsh^OFlE#A)<)aNNJj+@gx zV&5J*caYouvV0jsD_-ReNYm``?va@U);=uEje2GR-Vyz?&YuWt&_ z>cJr9YVzRl{Wb|C61TAka6a=$_0|~NE zv!0s9pq^9=i9Ux$yR&;F@}3X!S%j+iVr^nw)tL`8ym~}T;eEQ^uPVp1USW4JPtjsY zU-)=(Ng!%65D}f2=MJ!X6$w(TFukD*W|z@EZI6p(Bq8=T{CBXXkfDx8otsvg7t`c} zq@fJsB*S24sPIFdt=I=I_as@Q3Z2QR%PdWX_c&V z;XBAU9@KN5*pvT%QTCqEaJF6Fc(fp**Jz^?ZHVYS2!f~y(FGCFdz2YHdKV&k2@<{c zUZahY=)L#BV6@>qUC({5_5bj^*ZRL}&02i$!OWb;KKA~#os1e_MK$cvm_H;eXIOpS z`ly4f`|*Yum1UDqHaJzep{n9I8oy{b=WR%-uDv7Gg|RXCyWf)WA2l zrTs_3Y{7iE5%#(`)lwzd3!6j(G{0s>OAyVl>(ZFGgE)9VYIfaku7310I9=%w>VL!H zLgjCwEGuO+fbB0e;puMoXimLz5iIj9O745GeXOs?tfjC6;p*o@2&VH{_)_wm+hi_G zX32%*pzEBpcp>%S**RUM3o_RfR7@&=-rE?O;M~z!(**(H8oMpP$-mqiKxX&dejx>>bUi>gUDV!F%TP&( z%|ndtnL0Nz=IcO=!wF=1%)Zfifu!zp{vBNTuYec$%Dc|dQU-LdW3jmRE^o!|g>8;Rt5tMp1 zt1Q1;W1DyREQM(2+?#Lv`>X+8Fu@kIRH9s4>A|9n_h;_V{RC7{fJIR%mQhO{aud-Zv3t_^<75e?gV>QM}c zJw&oyD{)wz)`-lyomWXz#4e`KhwddWQC#nRo&&nEw}5U;BOcRh+54D0-6w8A*5^B- z!&@laHnyHx5X1oXXsXRrB)A;&8KB1u1yT4qD9?)vE&YylyWNV@kRig>O#97hh>hD6 z`Yh_>glcGIL_f6XZE2#I+uqE_-*a|Lf8GXiV4_RlsH-Z{dF1T-n$mpWK|5@DH=*jf zPp(zuPN!n;!3>M`y?yHGu=%`9G6x@>Igc-=Xo_#OGpZN&WYU~)Vb5j;)#xv!rL3o; zV;Zr&tAru@>{%;w1E$xyuVJ%N#^-%B@Tx~{uUZ}|IN8&p#Ps=y4rYm=qstblyFW|d znV)ADtv}Tx^wW_hHbRBvJ#3b^Z1rDcEI^LCoXO6|oc=(vh#*0Un_jdN*phF7mU)i9 zdy-wPoyDBrw~M?E0?jTnhd?{(S54=XUh>q%KMkT@$6Csq910w<#asxMt9z(q;Sx+1 zEfIldHE5ujF%f4($YSHQUPxMo8Z z9Rdu*v9;_OA3}npLp$-tc}is$J0$x!nmG2n?W~GO=?urq-k3s-y{(&Pz>5`B?a{f> zl4H!TbE8yt6(sj_r1jv_co&uri4uuKGxA#M@|$@{O)}cE^KK{S^dyuT(SKe6Jm`Q2 zURzDAIap+j_7yIDxFhaq!=Wy(CfS!2jnOs2B^xAJEIP3uxk-{EX%6e!qWtssrjZjL#}lk9xv9hV?Jk*BUAgk%osgvu?Xr z{gt8m_|N!BHnWCT`uaOU=*q4DxfA_f* z(|vX~<>`3KR{g}BX?=B+xYVi5aO{}cAqKXdMc~@&*}5W%JI)Um-8cVC0KVAdvY}|* zAD=9?dZ`{_G+js3A@+IzKzauyx_o^k{aROwXta%e-z0(Wh7T7)wGLWA692(x*Xk|j z>VpOgF&H`mKb57R4&@NhL6XFpsQ|_c;3LkX%l=i%&>%TUa3tjAQ4KZiRp*t{l;9br zW$FEtZJ&`6BjH$wBquIL;(?oHz1iN=tu*upZHY}j`MvRZGg>%=;MlhFX20AV@0z#Y z?V+ACa2V<}8@2Tr%$(dNyLLh3#6g7@h0CW7aa`YbSg0%0T%}z$+4%Mo-5l z{hnf7EguR|iSE|_CqTm2r%<#s?=PSUJ&%`ER(`f5US z;YgCQ^1&WRs#-#yTbjQ3wv{-3`i1BU;CVh!y4!rpX$0DTL0db zb(M9!*eJ+cCzX5fT@YnQlPxy=&{H^EEXO&ZnU+P4xst!%PpSUS=taIty*uuyebB2@ zyoeD3XDX&7Cg-Q|G@``vSyC7YV;zAOhI1V^v`(%DG$k~i!m}JF4J5**ARIo1IKLqw zfPmGo(f<4C?|LH?Hvo%ImWJrneE)f<{DQ*~-yD5VwZS8%?3{Mi(Od%JDI*fz*?Nl{ z1~Z=Utgl@5hd!NOIL6IjQh^cyjVhHdGj*OSW!<6bmMn@&Xg(VeSqmAtYIsO~iA&1j zR@!z^uBJ5hs!@!8m_n9kD%`L>&EUUaN9leL@5)yY`bd?8{U*S-V?92Qh>q66j3g^? z4di%aHvYZ<@Tv*3wb+Iw$wC;U0v|-VP91bvjCtT4)a+3{%E?g+VQTgH1aB^naM)bjA%el)T0tj$fD`&;j(e5WX-?7GK0 zCLhbtcB*Y)dy)Z0j%~l)+ML63rr}@k4|KO%_q@A!q?kAeP1^0*kVla;QKC~dDSNbI zQl*&;(Bc^81r+-%?t&f3BFF~!W)SUN0IdcpG=LCRF?fQ2J$+cn%cLC9I z#Rg33tPpO44J0cxNM!~f$RZ2za|7a*oHQ^j-U<8f50pK`#PzjrD&G@<3Cn9QL1J3$ zJZPUcUVhobYr$JiaT<2RXb$8D4PUm?Kg6LC&`Sa+k7Q5x-+vC9LTqxcEeT_J6!B?R z-xf5#R?I3h{1JZo#4({@4M0NyAA;)XNppJ!WSzfHfGhCoJof9|jXB~FiWzVin(9!F z?bh7O4|eY9tif1!Z!Q{r`TarV{tsQZig(RL%gaOwO(RG2u7k_aV1fw$yjjGR?BbN0 zA$qgQ^IkJbpJQ}yUA~6(<8q9M&xBpKQ669x zyeKc}K!PdVWS`fl*pO7@Y~YaY$JnErUYE3=ig5o$#u~l==~+Sh%0S7XUa6FQ9+CO* z&^4uwK!QJ8rIf-ajn~Ezfli@(AXNk5>B&;&A@XtU7-<%US>^^<+H$t$T-Gvnh;n?Kv63_^es?U^VpXKVD&6}u4v;3!{3-`$XLlNj_hU~<;9LOga9qtMp2@{C zQiAtQxFLZ~vE<&^x25&1R;x#XbKMPa7f# z1@#RU!y+s2VinYJM93dfqAsjiKE6yNgtKLp#x5+dxQ8dz#x9l+O|_+hE0rIWin_r(;Nte zO80YvsVe!DO6;AP?V4E3>+nm7m1(*uSzXw(S34svIB_-sr=mT81(y;dHtn|C2uf~Z|Y2vgWt?mx*ve=`K9+| zxlHXjl>k^Zcjt(@vH?GFUbCsMMh=K>8NDy-V#3RGJb6;7yN9xEnS)W}UE%`6^%X)L z{QU;V46%@b+dQ&%{N2jZobVw1(*dQHj>d!cPjEgcl{Je@(yMm3#h&5?5FHV)$&*O} zgi-BuOF`g4&PlaoJ=Book5S!|_ibUf^hxfsmL8&rG=$xo*asPV&<&EioXG=)WH&%W zRadp94spp*1(2y19~w2Ii4}Y|tLto24W~Y|Zic!Lb(h65TR-}q+C|Nf&}f2%xCycl0&Kg_DY6g z1zfjF1tYO{@dki;MEe3mmLAun=)sN%H{;3SC8ddVQO^0#awx!}SEXCgRyUkq(G)A| ztxXRybde|*%Z_{K8Psvp`7cHZ-4uBm;JM04u)uYpJkim8?ESO`jU3&mV~oV#QorCdH?p zu;BMGj=yZll&#z2A{bm5HRM}~kT4paiikbhNMOV$t(yAW2jX)LYU#~Dzw63a`RE76 zT6qA{idD76)4nmag_3_f?N2?R{5d_(YKfsp%h%pgx07F!XHeEH=_fH6;(g?YVq8Ef z`iO3Kc*D#8^5TktFt2oMe%G+?&!!g$v$wo&^CO=eSqM4a0Q+wV{)BLWKISHmn&b)%U~Z2j)ijoypBZRnNFr zp7e5@q?CGY?@b?wU0YHa5(->5Tze>`UDKn+e-t7SuBd9`f1$Z$h;i=4`V36p!Gk!7 zgAza-j|h6?s~cu>#uwfVN&!uF_Fu~Nry~KQ$Vkr6F2*@KcNmpui@$5;C!bpd8%q~1 z>$WGu$yT2B&*Xd|Nk5R%(-P0sv0u>Ux!HF5@Wwa3_+tK*+2zU4?PI6MQEti()87D3 z&AB8`msl!I0I8y~RRCaw%2tI-;@*zMt0FW4?!2Pa#kQ5#!PCdX=R{GY$JxdI$v0?Z z1l|e!9e`Z8;%ruc^dh1%nF>}tZNK}0g7bV+f;Hn^B?A3 zeq`e{`@?G3WHFbZE^VMs?HwzV==OW9wtN{|p5vvU8*Y%jytaISeBywrwp1t$c8%x@ z0_j~5@oE}{OnH2w-4H@LQ(TLW>m>H-5*w;B6GR7bL}3Z_%y5!z;veFl%hBwBN~RA# zq$3I56#h?F^ishqh}b@H68S+b`4}d-Gn2H-6e&Zf^*A>!2b^QTjBfu&fB!?jQ7U!7 z6OvFh&Ad@I@#p07A}`-tco>>FZ9$JpC5pjmRm zt!RlA)o6|daVCV;*JI5w#%%wjp?SvDTh{9I-e>+=2@uLa&^LeLl!fX%e!)gEdlEr; zIbCL$^N}ojn65Aw;6GbPxO~VG5be+_$*aCv*bK7ZKsm(egX0x>4{_mjeRn2SgoXqB{ zESP&nYR&XJ$4sV<*Yks#J2`{mpNW50w7rK%BpA+h66iO;W=+?3vTh4&523D0M$DES z!Y0^F`NLa4t%+u*hsa1>etx}O&s*_b@8ML6N-^OZ5-p`1r$#G`Mq}3o(d9oJPVGh5CyD5WS3=t!VjAA9|LX>FEpkFGsi&~=V*()60o5(mLv6=%- zoGqD7fTdiH(|nvOgQR*MN-6PSgwMTE#8@V3I4{YT?nkjaZCIt(7WATZd5=a(#P)9~ zD)^il?kG&~s(Elapj};O&IeF{760&i*IF#D?y)2_FXiEb|LED_RiE)XG{s*`Ylfso zI4FwzuTVJfF}jSP#98;bxXgqe4vtF}1RMl!ChE~REx~3KfBZWKNqNsfD!iKeiiP<|A*=81 zn1KG5+9vv)P?W@NnAj^eYRbP3zv8S-HQ4ZL&&9v=9rsz=qeh0So}XjK{qT3!xcYj^ zJ}qICvHPr=>4*NRY}&UNc57S%0g(1MK7M%b%&Pynw4b%xx)^&;7yY zqotuTcsc_JL&3B;RQ#R6^0taiC+UCO8t@q@WtjqGH&?#vQN`zHF#pQ9=e+-4(Gp;? zVbEakJpg*g%4>S>%N*=A2ni;pe9e5`X8t&;5v`-t8o{f%2-Jyc#+k zB7e%DY&_nES41UbJAk5tCSaG$JN>tMX*Yi4M!c{LCq~2LpG(VTNr{T+#9@}a*0~Xk zFQaw*#Ps>4!ftcvoyJf78tO(RTA<3;D-0J1wqH6a>ogE;I~A^tXbR75 z*H9WKNiZA%dWJy&ui1u6oQWPT9?`U5MZk zmw9w;5dR_ogM{GKayw>%O-R#-@-KYmQQcoUGf=neu&~-ej*35&iJHJA)G9b@@7(|> zf=Ye?1f$X)Y+BcEe;h{J>0jVP{|0VLk6b70t$+ignR^W*1_6uTmihf8#GnzN^hA{x zSAg@A2bsUrRLu@a6`=Jf1??ld!P{1~p0pAj{(#E*(9QyHX(f3E4kMv`4lrxI0u58q zeDd`e_>8>YmM8A@Sgr`w2Tr2g=q_US*Ij`KVx44LTY+QCut9z%3ubod3N#rx9sUG) zBAOcuHQswsUnJ_emFcTry?{Eij>=gIAtJ%H4Dk;6J2UK{nh?I#Qx(OmEk?0z=iGsi z9rs+-Ko-JE39U2~hiaxl5+V2M>C(! z^PV3jb2~#u8n8b*Jek)8ATJ&q?OC73EgdneL)lo@y#a^^z5&8*&+bEpaNivGu|HoX zr=?03>>MTWl}EqeUon!P`_Mf;o$BIZCJkOB&MDfa5Bi>t1a=MSx>=Rf_Bo*^Ee5r36`90OHQzOwo2BBjPgTJxNzTlSY3>3!%F`7_!g z+LS>h0{XYP2{3t{k}xYigOFDQgRcNf(eI23oZXIK&F;MrD8*M*FZCB*8oey}G=>2e zmw-vpKOWc#+8Y-HwWk6U=pRtue6_)PZ#HaMG*X30b1|=cU`e}N!#If_&|4x5Voe3l zXV@_{S&b^o=cE?SgiRofg!3*vuw7in!SG{Z?_e~(~Zb3%}(~A;m>lpD} zeahW%D?%p5E$A#LNa-&00`}Z&f8qpC%6vOxQC2pVjf`NZfEiueyRNLMiy56STKN|7 zr-r7QVR~`6YL6ME%?$}%X%93u>pCMto_Hg3x$;gmCJh{46Cl|dF$sRn6&R8KE(Sl)N?ciGrq@lzGA#CxNs0zJSwEiqaKUYhL+dvxKkDY`XhMhU(eDV_o7 zAmB)*mt3|pmC^wphevvkC@uLWA#zwp-uxVoWaGFs7*hJ1Kzsm@dzz&-z;pJuNVb=r znOLTLY#kx_>L^o)!b+amUCyqHXBln6bU`w_{054m7AB^D^_ZD7!Qbi{GP7z|Hfz`p!!2TBxo5<|{qTgA~? zqw)gl-CcU!qH4k9B-o&_`z5~Q-aKAj&q&iuxaT+J+F?JLCTS8Tyn3p6if?b6Q$5vrHkF zS$a@E0??q5IphsX8ribh zy=K)0G%2JFM-!d}<1ocbcx#O%`pT0`-)}YXdqQ*G_(<^#6SY)9;k%l0 z`PT$~5DUk)jPpTOZs6wg*b+(I(oXYqp0ZJv&nnaU@oPCl&Kb`9o-9$MI^dcD7rUoC zGf#yVP@h?KK#7u$6!41QkNtHM^(m2mR5K|r(` z*puy<9Jxb(W4iWVJf!M#o99`NQ!ytCp|FXzNa3>0qfB2hb$ZAV{T$l}R7dGu76VAH zyM{SZ#-zd7vSSJ_wtPh9%aE195$k`3cpoa=on#8#L%NF>WI@DcEBpPGe4 z&({K_BuF&NDUIjR%ObEcdJ9d18KXKk<=`1 z-D?N`2(u65>6)B2Hn~aPod(Ve`4s9>HaoTrtX-{;Y;O%g)g5u3b07F>(1`9%liIz} zB;Dr6X{#mrfHz>6(?C-qHPYxlWmkKxbl=r%rO~`wlH8{bmecbr^$lsjmIY4tKCrke zc3v>1@F+AN7KHrN9J1yRAw4931`}&;GWJnmUomU3#X0qXb%><2W=;rw{nyAu8ACvZ z4x)T&r%OS^k?ajbBl2MumR^LEl3_v+U^7vK?!>#qcaZj5hBxz8;1{gd2Qi=Q?Ua@z zrWZD?eFHRx4Qu0XE2I(ptf-oWD%a3xjqya&#l#6tp?^esEAijo4f?RfLn7!w(PX+G zR;x|kg|!oCLoxD_b^60BTIE^j zlpeoklBP44Ql0$Sl)`OTUoKxfDNF9Z`Z9|J_p~ql^RMUA`PpulKl?!OCdoW%JFP18 z`t{2+4IY5ZGDF_TVl{qq-aiLt3h?k%?pNJ))IRN3V-U5BzqjUyE@#QvQ4+bq8`dUO z8|P{PCPE}jh4y8TQf&P0pAsuv{YaLGT9z?}s~x}z##n-s9Q{T0Y*|c&H(#nhhiP;x z+~AK-W9`~3>p_dKO=G0*;cwG~(Potg=JLLEW&n%v_=$&~PO;u^ina1ywZPK4b@y5q zWuLX7dU)z_mGYq^|LtXg#Y)|hQb_5P{u{vZK~5Xg{~V|e#7*&Nu>_ho4?-&-K+5W5v?Uj>LmRS2?R;<+7AVr8 zgrGE9)T9=g9Xa>(-laL2RawJ3Q}kCEz$fty!<)6NGU;IqZ_KMw1sK}@xwVZGF}>sy zr8Xj~_#;`x3YZ?wz1$3umtA)vviS{`t{NEdS+rsBteY>Yk@N{r>R0;wkV%Y3`@j9O z&N!x*>B=HFl2bL(ut9lP?Vxq=8M2&WuycLq;Fi59a4Jf*cE>D%I#*;iXNJ>&%v+C9nvuDn(Sp$P;h70KGMA z3=lIa0}5bjqX-@sl=$O4LK}J@9`=*>s`Vme{JbEXWKXw5-*VC!IVvZ0=)bWn?%8-P zHHAb>`+bu87i|cdLe>LdR^HQ^jwRvCJDTLV8uO0)=o+iF~e{c8EpKdL{-`NBB zJEOUF$nQfEm7lYN(=PKY)Ls&Al%R>)NiFV!OKGR!%WdU41+OJ% zI_1B-ygCk1pm!1ucf@zTyJvMq* zTc8ptB(}TJ-yb16CbGBu>*TS2Qw&#MlKl*~(^e)Dxmt9L5Vg`DnMPJn{sv*168Wbn zWjxF#9DBSsIX6VIWt2KyTL^Txt3Vr2omvU}ItnMLi1i@!Veswd@0;V;t2aJHy=d60 z#cTk`(Kn@9Jv!zK;uz*{f0K@BQNF^fW8BldAXBvmDyNg19Vh~n@M6Imjvfj zLMcGV4BKzM_0TxRSw4#Z+Q2yBjqitelS z4CecKDF zB|We2a)J{3fZPuNMvnQXL>T-qwd`Ag8lYKSu^0k)Fb35u)=WF6 zjl9om;39=xD+&@5v8(%vwPxX&KBmM|(H!U~OI;80Wq-rs(UIQnlCcG0^ ztetWS?XAs5OjN-bX6k#{Hd~z1C9}e;z*>J+xRYgK+%<`7ocak7!APmRWtVx@@e`ZZ zz@G}HoCzTJ)0zE!I);-IFO3UWEWH0EZx2Vh7t`7;9%s{O&Yxxnp0wI5?*$IlW z=UIUUVB9Ek@le7=CjW=s7rEll(Wq+?+ZdeEu0pU@R=W4+(Wu5~kImOpr?qPx1qNSE z@dPVUMPsY1JN(mDfs|yeOFCu}69f)*P}h(Ichhoe*+y&AOE0z6AvdXWVq}XAprYOQ zO4+ARb3bkaOo_l|QU?S-3=*{k0_z{n3`ohv-rY>7uOElNEx)d>!TFM>>D|7e!LL6n z_E7QzO#-~t8yl`j9gblvvfY!o1IgUG7VUfU^Iu2s?)zjXr?_! z`0hU()>&NJNqEu%(xgP?nO`)&TqRUz4s-0p)I=RB3fC=cD~=thOHSU>#P5x zY0YV3Ze$?o4+gjKy_I>4qoPQ=@RmSg-LY&S>eoI=_83FtDLT5|)?rIa;c|?mYZ+^N zE`+mFFy|SQ7&A$ZDqxSFj!(Ch?SS#ysmDVIMY=Zwf}W7%Y2a#I4GW*1DKKFZW6KwO zPo1np5&Kicg{BxjBN!lhLPE?`rA*g&9zQI!)H(Gxsy#e>0XaPaLLydtYa3o&uT=~ZKaHDF$;4U54i zi`wiSI$w?Yw?Hg3<_WjbJi-(?Uv>eoEv%_uUUQL=SmB9_zo-)_jyI*DbB*FBe3EUm zrLXCYc>R5*H*5!e4>J0gJC+Wzk!j4o4X#P@Dvs&nbbjVk1DnPXjGr z22N{urmt7z5Y(5gvFG(6<71++qamF5=h=@n8^Mjmfy;v!O28_dA(AjVwxfjKEt`ii z@HTO|Udihqb(%>n0Hg9|8Avwyy!evo12fVF8?gnkXk~K(6-lHFBA$*&kPG@tjUen` zZ?6Z!3et8iY2Cj)zYM@PvHPh+8q9?`W-;sU!l37 z`2{J~YO^R(Sa(zLK6viWy&q6d;DR%7jso%b`1>9v>{H&dz+=n9>^ReIr$5Z(tp4&igb{6ZCZj)%3Q8eDvGQrJg#(n%Q`CTLFx{ zwiF?+9MxB!z}b?AB2Si+`7aIw8_NT|K7+fj8MT4Fg8%JNEX9E11*Hj>sq<2u28D;w zR^xp`VJ6256D<~u9ltC^oh4@u1|k>HYK%K&9~LXliz{8cnwlqELhi0f6g2k|Q*LGW zhCR1S@-k|GQ);Y{Y%g3p9p}KiQO;De_O^>ANA|m|z7K)W{KIR*C74+V+rRc245Ywx zk%_B6>kd)OVnA=nX8Z0-rp!m)mFHCDSN}1UwTk=o(+CQd5Y3(7Z*@8<0^F!@q3JF4 zt4)P=UHs`x66HP_yk7}04g8SoyR=;HzZypLN7-2K^w(WDJbZiz#`4IXDegf;sQ2W6 zkS#!u%8uol{pLPlG&@}aVF6?Cm;7cG18kXXgT|Y0ZG|st8^qVYb_mmDi;oHHrc@yr zau-0Sw9Sw2wd4TQe2k{EJ}v)D6b#S(IMh~|{4hI?2Vv4R7SypbL^DLhUQd1!+sRm9 z^S7(nCn_g0H?D7G4%dxM)Y*@Y%0FHhX4ddydAKT~4b+xUQihBKJ%6R|K$u4`kWP}! z#$>BT6Gj%Koo{L(8+%BkoPZlt;Lv(CetP!;2z01;ZeQ5~WU+qz`)o+Q$Q9R>$^(Gb zj3xUuGNI4Zp|?&Is({;+E5^mCUNp!t)&+-=dllS2#gNgs1DICunB=h&RA~2ojf7SH zJgSvlWSu-cT^j@eC=kRGhm_L$Y6J zPf!h^Gc4wVy|6HGwa1(}7}W9DW|DQF!X)-0gON zjgY3{oF1@%xEyVn8k~*?ZE-h5pEVQ@8*YUPJy@Hq*_-CZNm}~Oad^?$S^d+YS4{qo zGi=iNWapr8WTa~=b3_1^q!3UB@+%D6t_7^RN5hwZ(02`@(7k8q7tBCBAB}EJyY9pmyCZeCPkOnYD|%i;&H)1irB)f?-(^6^%gF|B z&`)h)S)4CR-=yVn6+0#O=pU=NJ?M1Dxmh0M55Ap-o z3CRp4MZ!=Bg$lwwM^6$6ub)ZCD0PL_%-qq^to#f$N{z6{d{t(Dbt z+@{t^AIVOXIL5cLw$dVa7S6TV>qaE~HpC9i&I!D{U`y&ELNM*L^fI&DL(wD3%%Lxt zha$y_vQ=o*r@*L1E{?XU9_N&b5Do}$OZedubEzmS7+OA%jRVeAyj;3l8*wYWR^kL8 zO_=Bfg@j+!7I)4NSP&L>kSdh?a8BrSQ~a|G4r)!RU{r{6C8K*qvze61%xDGj&{utR z=HZQ=BHiKlzN;Rw51kUL8Ad0A>YES`Y{X%60uqTnhxtzuis2$mwDkYM6f_8!@u{h} z&8EzB{u}#kovNUFjnhlZ8l~{$E%xI_)Vl(sddq{9Li4)mt)7n6Oh>{|zS$H+)_rIZ zK!ua%u?qT>;<0QFEQ|Wdo1S;*n6eg{=2#?gcM&v4YxK%tI^aI|)9N{+WY6PujLa-A zG2O@Ui+7nV2*2cCjpuhc!WHeog;|6O5GG~ru?G~VnKzUSkDy8AuZ-7#eDEfuquqae_9PEmOvOO|W@9 z&$f4gCClPMVSEcX<3@1d!Kx$#TC(F_tQM9O=IurB1L^+Sl22g3X7reFSe!*81m{nl zpE3Wh&o`%4BXut>MfBd-I>Pgg{X3JZz*HaQcf`pa=dOm1)e#_Y;&L&kI5(vbX;7?S zsYYuJMH@N~k6B&mZLPTBF6}!`&RB%WES*-9{1v#4YQY!WuX~&vp6L|qmgEsZE?CBx zOi=xvusD#Xz|R<|G|00n5!Ys*O2-n=Dbe;fI*HQ6DV>f0SUTVhjY#5ALk`+FcT$jB z?bZ>=aL}-Xx|B^#c|Dxv*Um&`sq{$7eZhy}`niq_ca_GI54Pcdrx&GQ%|d#3pGUNn zqjkGL(OTS(QNzCrf?G4Ijmd?x@ob-BovM9*9_MmRa30zl3oZ^XexvilFc9-pOucPv zwcaG%LP1@x;O&;QH`a6D^XhgS4}J! zf)+==GvM@D956_>``Cn=nC{*+q@N?T(_A>~{ETg)5Z7wbIxf&Q>33+H7ntu*o)XYg zo|6({O16giHi3Z2osi4cn^nYoNcMcr`g_>Brf9;(bxs)ePJr`;#Y&&^)Ww*8TSVaI zo*pe)%ZT`PatjcMmKHrNM&T-nJSEM!YbXZ2$WKMGWtdfXp)GF#+wGf@n`O)1W?MP+GcXWGdcoeIX5Ht0z= z?_LvqyY_Hvz&iaNa=R~fRZl7j@*8s+mJ{#Z!=67v!>IeFx5d(Mv-EKN?kG@tG8#x; zxUv%rp5CQK@c|q87L$;0VhHr!se1^A++OV35O98+9K7==tcJzoZ(eoLZ7n(64nn&U z_iDE+M};kRFg+fl>SVHuzGX58W1coz%`Uk#zV!_Ol3PF+cXU6HPCM9=hqS_4r>KLr z)tiiyvg7MpLi7uG(cNirN`nLYku*XPgrvFjj6nq^%~ZTuDtUfat7qqXxaVgg1KNU^ z3@yRrNZ0U57|{Or7Y?Hg8U%-mU`iPsAJBB#l4ZQ~{}et4&|q)cqT!Nn|q`^t97F6vCP3T%2xI$z_nR=MV!Lp zJ?<4(nmWVtDTWI(oEI)_F~{At0hi?%lCM*0rHBfx(Ilyg+7+raw(pbfpJWps z;|$2I6RdttlQH$t<8wYb^Rt?3Ewp)?vQ`$D#O1d_rB29C4dkB*Sgo8HopBB6KCxnE zEGb+4l#TGbVu2(Xr{iRU_rB=59 znoEJAMHBp@Qf~Y40RESzv|%1P5h(5Y&Chsi2ixfNEh@z`Ko0_zbiK>8t6MTTmzw|L zinqNGpg~?{t$3GJ6f0t&Am4U%0ROS4?vA`k(?B~*qs&aOiuA(;DdCWgnyW|sSdgO; zwzrikFE`X_kHCWqN-Fwdd!;9wZ+$iR404sCp5w{Nd~R0kW80W{4MqxUsd`_aU2Zk& z-e~W`*7IN=o{r#z?VF30!+l4=3O(!fhfPRcL|tm6-I7x7`xPZRSnRRJJF&HTekmnY76piL%bRES1bPlXJ28aBQa~aMslE^R~>@ zv;+g0GPoM*=-ud#rT82;7P%P#jkEG-;%G&E+tO(l_^Jfg`w-=VfZD8v6|{LL4w_GZ z2vBTfuz&|vWi3rJuX|=$XCXgBopvF}eltZnF7borqLvMcQFD9#t>&+n`B(wnWenSbY_sKBRI2~dXDWiQ$W&swGALg+kgmqQ{FJ4gjUxHpcq)!?&D-1oiB;UE>6w)3v}>`K~l^R#W_tH9~iiaYcV{PEoj+@6xXSf+EDOQ%!#IgX|u-Ch1@%MJQf zy^ot+_8=HK)n@Za*!>QsjuQU~tx_0;x8*hDp+reov!=u*ZZcdDV^&wmEd+zt-UU(~ zSHmFWon>XcG})Rl4HB8?tu|_ddKtIo>k__2^TstpO8biO6G|LSZ1@@rxXPsUe2y3u zL$3|kTn*daEXRf9_rq@;qh053eO)=!Wy;Jo;oiUl2;XW4uPe@>gKY>Ns2l;|5hWrq#5gax{28u)@zKjAU*YfFr@`;5yoE~j)69qhQYg0TYq)}uPFXe(|! zcp=gd(t`eT2!eBQe2oS*iy^`@=4#mW4@+3t9Y<;}@AJsYY{{Y3K@ zvewLCselAR|6N;DGkpC{%|3BP5%D7}$0Q3UjBJB3R<&d`udR z-D5r3>}lT;E)(@WG&Y} zhOANAAP>EdZEsgT#?`*a;3uExM-5`%2o|o4?|hD}DtldF#Um;`^0VZwmvu|j#AosS zha;&e$jnykGyR75o`hh4zP2Q zz7f8GiYP@B3~H=C(}crbRmI0MAUHOLV z8eun+Y{K?|sF&?`y%a+5_X}U+Z8$c{p$nNp*c602m+)sJbMJ5#)o~3Uko1T~0Phcq zCfSPr09Jgv_^#0+%m;N=Ihsk_U^+v21s%@}x$=nmTlALo>bh9^t)a7J5Fj*qd z#y+&f-YP7e8*k{eh!jL25iDnpy#M>LipC$T1jsK?Sy*AX^{EBEw>o4GIQzQKUeYwf*b_cE}p!@DZ{+W)y#cqZM=P zgXiyEADksQ`c?$wsBD9WHx*^Na03du^`GqNlZv^-CJOzFFlD|Bf`i?&utjFCWU|IF zPtW{CZCL!ZNJa_M(%fzz&}apJoHF**tO;Fy^-j(%?8nkj*3xKJ@}sqoB}ca`qFJ6w zy{gQf+7b)cgX5wg#O}ek+g+QwyB8qX zo`ZCM-sMh+jy(wCV*HD<{dQtwYF*4u`fjK=U`ggHWxJqbhhK!t(rq3{tR0)sPQYf|HQVnIRLnDn6?C zcUxOWzk@X~zPA&pM=H?t_)2x}eWMG_gapMCGs=sdVz4jl^>l}&B(5S0brrqtY5T&& zU-DW`vzFUPjW&FfTl9#b$q$4i%a5g}DH_ZL5xAutPZR{H{4*EDxESlB-)aOl?|D|> zHu$jH<~U|xyo|G~Rw6ZM_u$6d;lO~__oxn5b!LG6yc5IIN(l|dyxEsA5!;Q_xy0ni zD!UPQ|Al3lJ!|#Z!N*yk9a&$Ni;kt>(Vu{XW&p(qULdIl{rw)Uq`0eQi`)(H`khwHesbvI$74L&k4Fg8eLBNFo#0B z#?Lq9{I6Z-z)0`6;%$U9&Q3WF=F>hAJeGqzb@7MSXNj4I#{x~dkZV6PJEBqK^c};_ z)!M?3iRg3}SXa>8%V`JDApQ~7|K-R4H<(QN{i#WpcuPV4qJ2lkAvh&}t-Rvvj2S(- zjA=^EOmoW%AAzaG5z6HkzPk~t$^PCx`)MQZ*^9q`-p6I7XJodq^Sg)-DAva=hCLRZ+yzN^;7eH4Iv(8 zi&|{F4!Q_{SQuRT#9Dt-IID-_jL=CflT0xsDVE1Xjq71@S6E_SkziQXhqD3ytpbQJ zf!SXMJ%rXNlGbqt5FyqEd?7VSOKCp(ucu3) z(?5L6G-c1m!O1~txU_BO`D31KxmJ=wYMVn)UPq`AZ81Lj)t){5n(W=*${){8Hf18 z_Tb%%;^VvDsm+y<|ujtQtZwBG4}>=9Tf z%@=Nt2%JB5?yOMXHyD{5g+!<38EaOdorE=;mzoC#A8HY3U`R1X7WNyUWci_AT{#XE zSCkSTMR+CiptRWLrCv-H8yii%D(Ux{eOr?N&kMS!`taE_7*DFBYHfM zq8d#&M=fugMj~e7Wmrj%@V2MQOxP0+sc4>NOnoP~QE=FC+m5Sk-pYW!IBlEtK{+Is zI(LQ@c(qnwodK(ty)G>}`krlo6D$^HYp9~_7Jxq0uQO7SKGAmwB6@z+$mg_u)}_!U zXtmZG^=w@W9wNl~LkhqK+J0`WVBc|a=@u6zo_@prm*emRS3}0+W&L9#C(Ja0Q;in} z9b7?amy_;=icjk8ZXErevdIbUUi|QU^U;cByKV({?xf2Bd-9zj9q}dh;m6&M&)k0S1apQL#Z7UuYJH>Lm zVASP2mfZ8P*k6A=S{zT(C%}J+KoDI&o$0g?vX9y~8;U<{P}|=LUK!)-aC!W9x1wI& z6Wv9Cpf-0E^GTnV7+!?p<5yU*O0WGjK(6Te(tFptXPny-Thqw*cxymI_u>MgOw>xo zl4M;uf#ncYDkdG0LFw>TgZ#OiU^W38@rXX&nE|^2mbs}V1FuPg;wwZKwnl5ot*mxs z8_ePGRACZ^>egiS(#9ic8|jj`*iET`(3P3CGWAy$9CH|)GyJJ>RXWJyPUMf$%o-rT z;ug8P87=`~1d#_KBo`xz&MfgS{#<_oE)1S1RhkL~x&pS#ovyp22B|V_&h4~w>P9!% zAGJ;t55}VH_K%^z zY-t*#=*CMDn?F;%Z@2#7_xCSUgT;!NrNbY^$%vLiBe*Tc#+7QHaegE({_+)H*;)(+ zog*nF$9nJxKj?XI%LbLVZm>+Y=ejk*xPa{KbX&3UqEGg$rcnskcCBn*IS5QnOCNPd zWTNAUrV5Dngx&D)zS}9f@k??b!NyU1=H=_hJ>wH+9rhAS;@$i%ica1)RKsU1^RIS{ zS?LuD7Zj7}i!CtgVeTb|d{q9@GJ?Pp4AJdNs8Gcosh4}!kiq2kR-`bzMRlQ|Hdz_l zH*-sL@YWRoF?%eoxw5ZZ!TuB0STqiI1UD&CwHC=AH;z~ki>1gg0H!Jpi>Ru4&+Q|g zWX!FiLt1ZIh+!Ld>U%iV87kk@LVjcH`M`c z%1?1of*skj@2Y=SOW2ii2L#@iee$^cd@3x4EK*~$3P#nfgPW5DU2aNGwYA(Fh;^hW zLjrDD_-zLwNOpI!dXT946zlQ0zm>(UV@&Zawl4|n0mh|1_0YO2(^&ujycQz0d`5!W zn*c*S(to+9>8RtK9v0hjjB|JCdxt&TN-ru>H6Y$z(O;V-h)|{!st=HqMwQ+RvD>%g$meLnqi-Lh(bN80Lompwf_mn}|GVXlvI; z2w~hnusz{zxAn+q`@$9--O4Sfq=86qgQav$B9)4o^1A`*JkB;5uKdg2{V5Lk-JcS^ zdllpBnU3N9nDHv!bB1|>A`@ix4w;KQ&V#w({`n9#65&zI512Bd3Ktm|gU=NA?5nQD z>j8MpzS8je=oSZF;fw)=ucThYyD5RWcD!dOoN#BDk$0oXFc3PoB9l6Q)LdJi2 znrzR3BdnZwGlvL*uDjR6B?+l}4YK;x^CbAVeCmb5 zxmSFxRI6UiPxW*J7G!B^PhSyFc94D8jLt9LcwznMd$4O`{I>51W{;C!+2KqZ2%6Kk z+Ew)4=RYDJpKi+^zWQtiwFZ$2JQ3O==1L&QW(zR9xmoZCqoL6)7^#Ib-jpL-zv1Ei zbo*?&!b^tdx}G8a5CJ95g(xWKLYsQU1H9uzhYfA@u}|XQf;kGraL-x=TBe}CyI8;e z-0Kfidxyu1*B*XoigWX3>x^m6b#2LVe6z*TF%2&<-}H;II12rr1h_}o&Oj=Bs#mf2 z#(o+PLe@QwP&`fMfupniIm``=a>C8$DZ;yER#-HLvwFz0Q8G;OY0Gf*^`Z}Z6MJE+ z`_VFosw5Wy;EMPcKrngsl|54$waLU2Gjk-L6IuH=4Ov=A#zNjs|hn(ejiY zu|!LvdpN@LJm(DXemn$8?X^^Q$lt--Uw;mtBn1mJN#|a}Ui~0lAq~SF14m^yXPukK zn8%XldHDU-f`yx_hI$G3*%PC~%KfHkU2Kj*TavAV zCT^z^@rIZ|(1bFb$|b^~#s#s-{?Is+K01%12E8V?Rm?q@H`W{vhj3pTX3HxF?<-h) z4zpAmn12r*f0Z|%qeAeVlQ(hNfw)n1818U5L{dflnTl!vwctcW$SXR07S%r7bR&LA z2D}GflVfzlSidceT`UiBY24x`UU~5R=vGcTjEqm7>NBa{fNzuCm7siOmxCOyoE={q+n-z#%0HaVG#rM~oXS=8epGBRU=TH}_{N5`Xi ziNmbx!wg6M&yplDJ>0*Z$1JD*2abqT_PSEoHJE8|w zkoFYE2KUb5C~(IXWat9SoIB0Ydm#mKZ(N};5t>M;>7EO3Z5WUK+)YbUeHwNz6dnlX zV0j#@ONQ1yyY!$@O`L0yu{= zhM(?IbR4q__nmt7qVjksw<><<1?t`6gSxV*6t2zc-CVc$eFw3X??cO6 zx)+bwyBPJ^gYt3H$6hE0)rr-GId_;#H|jeW(qick+?~nihtvBuksp024uF^kjeqTO z^R^>|%G`@X6R&Ylm9$>3CbNNKnfq;{#gub)$2qW4z6r+i1z>+ zYmU;rDb?5h$GI=6I&Y;XF;7%EM5f6nc2a1WbLME3#W<`Ec2w@K8n^5$6xuF0?VPOU zA>5y(wV#zu;gW|-rmjZ6THHGc_i{CV1q}~Kj(|^)BMp-Rj8je@4VTbLJ#LI!NXg$K zxs%Mn>+{>z1BQHDyj#4k2(q!`vfd+^4W%YGC9OCahjJqE+7JpjcJ1~yb8KYTrG&B( zHAlHVK28tM#?iO&Gj#W`O-%Lx$~aMqj_V!%kR`PDpsNQW5CDf}%zw{c{USw<0H97`6{sL5b$W}FEh%fRQKv9Ds+ zs8ueCU|Vbeag74``ivRDkmM&Ls77_|I@us}a?_9~uO*bqFSXeqXN0HQi%D7C_o;rw zy_iN&-ji0oI(p1r_|;jgo%z2gIZfDY)-kFLuelUPATF-J`Nak6xA-@KSm%q_1d|jN zBj7DF|3<+QPY~Zqro-bH|6P3hZi~V+I~YbMfjIN{OF4REq%t_#O&mhswKSO1;>qbF zuNAfvSJj6Vu8);P^7RTzDTp1HsS4(OJocw^QJ;LXE3X06gv(-eItlm8Zg(f%E1Nx; zta0t|!aj)V7MRkWR z!As#Qbnq+MZE_2C<-n_FJBuo9b`!y3kcpLv`Mt2XrYqfu`Z(d3ezlxJMPKa9nug=0 zzcobC>By_J@!0dJHa?m#ph+xVxUKC{!??ZPh;Fi85)m`Um#j%_Vn~)LkfHKBlq-no z-yNQJ^eEPf79%o)1zlBwD4EgR`S9S@?VRcUHSNBH;I2X`!ex&0)5A#47mm@CI&mCM zQ+8p?oR?|YcV8^JD}Q-aWYV9TnM`Z1q%>2PHKdW-ashLnf=|Z-eW)JjgBkA*u!_Rj+@B;sEZj0jv7kilDi0v7s-Dx~zUNgQm=X&8BrY#C~j8^xk(=YZ$v?1hav z+|apK>;|UnjC$mt#O!tpH`Wfi4eBm8dD%69(G%{A6-?uzWlqvC!-^y3 z2MkD~=tQ|`iu2oLu_?8|Y>hi}ZDFyu4#nwLhjQBPhV9>^PqeD7xOQV$S3&&zuJitn z3f|Xy>hS_rDIS^un~15R$U7dvQhGNEuPr#;HMju(xMRclbbZdK2f^hJyLKfoeqxPt z>#3m>sf?&H#r~*KJyRkZX=ouE=I(S=qaGXkSk-0Xu>-lbE2;qr0;8ZjwqrssHKLnP9_{T|Bp~3vXx}pfg_e zcq+ff2IthQ?LN=be|b*3QQOg--Zmad8bHyf)xhGLs6S|KhLubZT>A{`(|v)MNxs|5 z2kT=Uo@nO_^O3MSiekr6*X!$cLzn5HtDS7}M9UM1)|aEjfx)!*9-8zdy;A)|x67MY zC$7JwvaWiutWKf7t~mu2b+M2A_UYm1x5tqz2;V@b6O(%Rk5Lx%1T_5IP=3Jy_KOE} zu4}j&)h{EMK6gWcYanLh&pghIsgrn+iLY=ux9Z;qUxp1Wj(TYnnRG;}5!}n;;TrFW z6MIoQVq%7gSAtK$9v-P6B*Sk$K8-7E_|OFKdaK5D=Y%-gQ(vA^Rv=S47PW7To(`n< zhOg$*nCKoZeUoYprZ(1{au{Nc=him}&fX0ppfL@l+&3VHJqg05U$E68{_U2Jj3y3& z__$;rVdxelNVq_ZSm`Hs>1Peuok=hKGVhbBJ2F4)MVBtE1w}z9s6za`_rHS2zvh%s zeTi;VsbF$!cerv>4{NXQW+NjOkmvMkrhfl{$JyP(nU!3Ly|>BL2K7h^rV-F-4TjuV z9n38g8Y(~O+IW~R2KNvjF$|k9Zf;k8m`%%~uBe&Jeo1H z;+J(XWPRed)Lz`f&9E!mx89kPF`8cN3zI&&dhxBeO9yF`a{y2*~f)8 z11#5Y2er`7FGP#xdKAVi#~#qRY@xjxE&f__I2**(F^$i4H;*q6{EMY*PuP3BrEb0} zIto;BVO9|zf{5O}A2sN22Y#DJP*|-Vgl~tVke}pEFcB|)Q3k~!5His!-8(y?D6qiX zYJeA!@CTHtYk4EFKlE#nhX-C^sH@!`dtO56uDiqN^#^|+@wY9CUt;9fF#sRjL!?%z zad}-$7INT!B9HT|Df@Bf3Ke2NUo3OJ=3sQ--IVKrNPWPRY+~+&;ftsA`PT|ml}06m zHp@Rdr}C5u?s1{vdI%otg7S>pR~-76ICVph5uY51syFdWH$eqxV+p9V_^gV%U zd3`nE&UDm^8Vi4m1ul<^BJ)~jGhtqfQG06sH5caF&a2%Jqncw1t@clRX`pGxv3@2n z<@U5kXmxGeJ-N*45w?qY_+xAm9u#+lla0UI;cDsTW_uW+iOZfT$#yhDA!#SFh&uCu zLY-rnx5J3an@fn3gwJR>rz6@cQ=nCZwMA&w{#wkN9x2>(10WX3DJ7}0qV51|XoSq) z9`|3~4G9?(-uM{i-w_?>xh|nQ8&_*BW^An5x3R&U$~7&(P>8TUsZDcr^B54V)hbH` zr$?O$ekiklREwECW>Xc)Yc1h%zrnu1W9dU(2OASyxA>)U-}5Q;56SfT`&wj-M$~(0 zK>XzZbW|EFa@Bn4vX+Czfp=ex%JEwc)0++EmK@);99M_c_D=3xU_(3mzdUunZ!+G^ zKPJaNmL0twoXdoY9p6TXXtM9w@W;J59wJJ^KP@dp^ayu+Y)M66L#wUQBt{af?$u7} z*0@BQkM8;0wdhwTTpAe|X4z@Z)+pUra|M z4Eeq&e|nhq^xV|;43{;ICSKZ9F4a@5Z`8L0z5RLqW4v_YCK9UvgGRXE)UMBr z?dVeRC#=V``zY;PLuYzf+l-Tk5Ru( z72!h(ae5%djL1jwcRF>-jL-!I<1MS~3inL~8b3U`2rw_&AKaPohjwg{FwG}q`D^kx zVw|U4vHMDOu^A>}fO%vX9Q)PEA0pK89eYCnw&ei8!o1Fa{6z8+7G;u^??m18>zQ*W z4diE=9+$G5l}n7ri(^)HCnhy@Q?S#{_6Vl6?|eNXPdTghNSDW*Wp|JLy9CJWR|lKk zdRRvl3&!HhF`&bxMsULfB;rg&i@Bz)shVLF2E# z=CroL8EDdI_|4gf#Ev{OhL!Vr#V;j8#V>rv{VBtvCs#@Oy(Y`t)io<@LKd_)Aoc+F ztx1v6%>xrJKulGP2_y^l6mvb@Zlf!i-8M$Vbi|~cRyw8y$` zzVe3zd%~Xd-4#yTwHM31I6ncEeO&GmL+ra2MKMsrZ?{3?spEH-e`Lj8tJ=`4lC-nK zA6I!ZCEv2JsHc-CFa!q7H4z!7_av{IT|$NG^6n1|EuLe{baHx*e~5kFDLF)4l;KLMUEBnsbOtt-o`S>=N) zZC2WOuhpJz99#@dxiPiT+GQWtHwn!#J!{iM6BX)H1mAt1dP{`M3$a61Too^_M0G|^ zF`|F#Y;RD5n)8wDEE&>pXmGK3% zmd1rX@4*?ih7O<6IKqkAT7?}#QM}*ABMstzR~J90Me%+ckK&Z5ajDSUO+P6;UwCy; z=q-n%(v%Gd?T~oFCL4#WIR6~H5fqK$B}x?TxSlB&yW3NUOmQ9NT+FMxcw4{u7gsg6mPy@_K`C9T80A7@fDU!~5Yafd0e3Z! z9ijrE=uTDThS@qbnsm-a30-m98EeJQOz&?u zlP#o+p9j{YPYi_dqgy9wSq)IbhVxg~M9&TPSMKffOSS# zAJkP&>}1LC{(jUm>D^X;Tv`U#MWcLVwnou>XV%+5X@BR?E24bp;w3o`#MUIjo_)z7 zLdAHZ^sXC!+vxr!&j>d`(Q-v+6|VcF`H&?-j&XoZ+D^bRK$1OWWNhi>@$S6s+%_Nx^(lSpJe6LD8z8Qc>9Wk-#|7DPVNvN zUTd5}xc7T`vAEZ{B#{>=S8<6(E&96H^jJkrhe4Lk*|)n$QFox_{N6x|s4Ez%{1XDN zigG(-22=6imDwId$LbbJ+OL0xfow{pf6+fKD!<1+Fms6%pK1$z;WWX`)SUWC=aPPd zaPM}t_{I_0Jk5adLzh$H|_o9P-d2yIe>7if7|~;?=7}H<-sP z%94ZWL|ebZJWO6V`rOGa?+RE7E1j(O@>y7j)$Q?XNhvZBMFDMQfsIj$vH9#WA2-GH zYeQLpF}XSPB5}F$vZrdZbJN2kp(0WFU2mM2=upFjm4~Z3pqZGfY<-Toy$X+KgKoAC zU9+x8!RDJ^mheDDP@9kb&p5wzISx}a?6@Np*3|rtj>-rQNYIw+6%8VCW5Xcwq*rk( z8=bcdt9>b!8JOMLB+ECqysX8$3|KapN+E5%l-Go4^fiiGG{w1s)v{#J;^i6U+i1{W z;TE9#`orb7@$CQZtnj~!9pAB0OoIP2lMs4h4!D0lv=>)UaS9%Jxr=^c zx-NPL4i)2N$|zxC6t*9Ikfw02(cbQbdw0psa97(7W?8q^-B?P~Iz6Pw@qDE1LbTM{ zs!okO_Q@)U%IS)!`jy{wq3viB({(2+ckb`yGws+w?*0#$iTeLlQaKJUV=s|5nL9t*K{11cUe{=c zbx-!!nRb!Av8NkVzX$!|yVR25%Q|l{m9LzkAAEnNSPE&fLqCxT!t3I+M;u>vmx|Vjq7@!X=Q<~ZO50L@m;RC zZ)YdEi2`cr2=R+;#R|A0bhopm>HB4n?wNSSb}P+V5`wEvG6mLZ-_=XR1o|X82P3Y~ zkP#sro6=XZcy>Z5(ohk1cNJJl{(99<_eON zHDA^^9*Xz71xcn!)n&odKA_^-a|x>yG?6Js>>@(gl~iqph8f73A6`(ozXcBg%q1xL z5fMxdpYD1iw)U*%^T6XR2tGqy6YG!!cX=MaZ~MZF7y>JoVTkUbuT03!G7gnzx$; zj2PI0=qKMmAvJ`v)O4dystrF#8rUy>RAQY_UMw4EkdJyz#)|I{7L^hfdA*?EtltME zBdDOMy!dzAMaI0unBe040->h~m(>+{MwokP80TNoFhp}za|!o|;t2Pc+yE?Bpt2IG z*wjxqi`~mu9Z(dHh*S{!A$QtCH;Q4v~#j*l@mmbj~bi4{*CviOg=5pT|44oZ#2Ap zwnuR%f(7tp0C2}6S=C}UD*{DBXY=V`)aLfl#Gn~PKTlK?w@i{T^qZJ+JHt|&NLz2X zAJk|}wZs(L#q(3nF6s{M%66guOBmIPx`T7F^_ZCv62+dAc-kMN{p#2m>HT8-ca(xC?!r-_7zOA=O?d#Uaw_E{MSb^@K4fgt~J zLTw8Blo`lUi#^=q?nexFpDSqYET2?!G&^^D{hZ+9o8xv1L>__@Y4%I{{)i!6cY+#A zxWj6q>pnkZDGv|{P;;TaI`Sfnn$_h3H$q$7r3tX}<2*VCqh^YUW7tqPHi1d|NPzO| z?2c~mo4;HgM7!RnYk|2Z$YzCo@}a_JoT!kvK2Nt!=U{9T42Q%Zx~oMj)OR{$Rq{i1 zC+@zK8}anJJGoJ;scxO~^EEEbpihNF9+F(2+v4Nzhx%$~?6-FwuPnDMuppC7h?N~q)ahBDvR3wl12 zuBg+raV|t~z$E3wiDsAP2Vgn_+J@not~U2DeCTnKP(t@s?DI zIp42Jq>fQjpV8-aCz>I<681l9-!lquUSA*?^tu3$>-svp&Sn2K03Nz;VwU-__r`VK zPPt@-Sb!jIX8X;edtp-|mD-`usnD+RBSy{j`pv0<S>-+U^CW`_(NsLo(CKNI_EEBK4rtt!Kk`#|+1U z{kS2^K)+i5AN?wW3`)O>1TOXR!KR!TAPcZgRJ^ud3iL?U=GD)TDE0^$8in;QS%?-A zz(UN1`r<}MNWg$*wch@*-i*Kcn9U?JPP`#)5YXkgl{w&#e*%n}-JWuP9pKt++92iu z{&XjaO9?VT6vkK`!yUus5Wv<@f?Y7lHM@aVI3WLB&_TbVDl~rxTq+N4$dYL#=3ZMI zalqQJGjX5zX_B_fi1CQUjYk74@0 z&e+LgxOXtj(Zp*C>`)S0y$lshhPa9O#>fAAC*6IA;b+X#kc+!9xTbuBY*IRgk$h zDHB7{u81%0jAP8CKtnzl@#S-%H#)KVo)JQEj+@v`H1X+5qKL|UwZc2Q*qFDh034a2 za!&6d$+(MF1H;Kv{?xiy_wWG2nP88``^{hP-W!~kO}OV%#(P@J{FdW-x~?pJ4F4!4 z@WNvPIL8lyGjQt;T9~KU8`eDdH!gdk19|4EY_EzO?{AGKx|inL*?hQ^i)%~>#5M73A@6VjvqQ@N8V}?f(Qena zupP1|8g_nley^&=B@y5bV}M>j`comMdtNs{aPhceCzHV$=@AYJ@23*jz*yW2ID=PM z&KKI>LG9@S8VtjezoDJ~cqkF(V{?#Xd_bE(({@fTY%O*mCBoU?OGKTtkMlK)9_>xsek z2I5RCzt`_^y%^yPwhzIs1;4W+Jk0f7k{Tt>^LL&)emekm-Kz`YgBE7tn`>bFS>ZpY z^dg|CExSDRx!5$S{^vphPKp99f$5D&oigv>WLF56cviBuVJ5lRdQL zef|9rjd{NjIPQ|Dy!#G{aD)%_03z7Q`x$m8f7W7;d&~4o`XV{x5rfp*McmxH%9SVg z*Yc$-Ow}i(?-NpS_kB{UJu7^=5Wqy(8`y8byGV3BDy(MRFSoN%4MIPtvU+oh)zHn;X{m^O0T;B|IXNF&M-wH@`cxGBHEBfJ&_NaJvmO z-jGoEw0ln}Z^KbYm{EA<%-e)h0)g zrFtLR{nv*TQbfYq#dM0;Cy#H#1$wVY)W`gmAKDz0KkZMvHK&D>*T8r2BpV1ffUCpC z0=9qbMn6teH0^b|mBVopS{*V+p%&vzZz7iT+Ybc_PHpv=7gSN0w?iau0t47sHB7JI zfzR9MxBka}cI|*=4B+cTqlrp~(mU=sj}rp_v8(-^21Vv1elq#+7DxzP9~ogyHb^?K zl|vFso2pHFudqJGc6o78^-Qq<{RA{Clz1VlD$VQj@nkHftGgh;J)&?gWpk?x#2hgR z|8c(0TQ%Z5`1oA5k1&8%j|sEzh2y$`P^CbW)6{vMIkztL2A8y-b(O=2O6e5L)%CJu z=;9Wl?tD<3BOil4$ckv?3%6Xk0!2S_2WCc>6$f7z-v8)SQ0< z2pzo5%j2*<5UT_Fw_C8Vk^HFTr}aL#3Q)tmyANV)EIM!7BH`%fIJf!Qu*ARQaEmF^ zD&Jge09j(WFS3cKEDje9bOp_*|EsxuAU?UgvTxgfUJlR9*?>eXC^?#V@~k zCnHyf`C4rMh!wA6JRLvk7MX+`%T-+@2K;r^{-$&E{3@#5Fh>jAlf+v%OFm_Lc(ij4 zX#x>zg;x(Qsc|6o+F8!!SR3)7JG=1?V7#yA4=^rS&5+% za46KgW97fyI0(TdAsr^&-KKpr)4cw|DD3N2P(eWS2PHXXGT?fH$8ZO&016ebYXp>q z*m%RDik5*#M^H8LXK4J7$_Y6OvR97_c4v@K=?fwSamphNPGHqVBf@!>!H<6L7JR5q z>z?KK=h4>-5C0TdDe2;v4{y~RPvs5%h_%&V{WBE*d2#=`Y!VzOIUa`~bDBCYN{;u! zAdX|i(#s3}xw$)7+#0?tF;x~;eX^oWoxCbx#k+^YU4-tgHk&fW!u;`cz1|DM7P0{j zk!*_oU|nQy8SY2I;VtR8!MU-PXHM#A%dG`us!d_9l*3=py{Jnk9=h+^8u7$4BtDuo z$%DqXMes~72x3F|ADvm8%pg#)*0ekUh6~n$_O!EJBFEd&GSLCpzx$g$`mV$UItN&^ zZHwHe(Q^T+^lVQxHtEmuD#9o!KAAq=4=H#W<{r=t-JL*csVYW{`~4~GSYhx&nFE0| zcSV1JJ^s(X_~WGg&kujiMD&%Qa?z8_NU+*pO)IexCU1YWm++tk(qC0}jjB%(pelMM z+0ge@n-u~tHG_F@IEx0Ehc9H;<<~B3cOKV8Q}fY9Gf4S&g2~o2Y-}89bb5giMqamS z&(KB<3uuvsXM%`uIO3xYO~H{hKY^Mf9dyo*1FwM{$X5qdJsz}^QrB~}GO8{P6aQ7s zAMcyr?<{_wNv2Lx2nSPq{2_jSvb3`2ltEc1(noGiGrdWK%~Q=Ss73^`*bV+v( zo)SXi6K|V7{X+`=`iaEU=f}@L;rA-p}oJlEFom?HqXlQNVle6h}W#v2hAxLGlj z(!VT6IQO#ldq?Mgf}eI?1?*$a2ytS8V|jJGVsi(jNZG<}{F1|h+M zJxNTXADScnQmz=ULN9I})Oijwp%pfu0IJp~H*d0sAH68RL+XHoX*8>rACN61c^!vR zsAN#=&iHF>;g!)Z+sCy%pwU7cp~SAh2SD1WHddM`D%{tG)!|%{A|a2v1Y$JKxxg5Ud>pAjSE1x4Q?6F_aEOX4s)>3mb&E+T^*48Yu@LDYwpU$75M*@9;9)6iP0$!c$BuU`;XU2-2 z2gGSIra5m-IrvqfJ}HLyFD6*g#EUNLi(2LkHLehLR7Y;DREu(er}o8TrC!kOHR**t z)`=4x3qVfEv2`9UY*O}}xZ^x5=rUCni;4!nGXO-gHEg@`rX zZ#I4nN<8{1q#3I=$L>HC?bytA7FXKk7OtWll+6Q0G34RNz&;Zpznlt{=8Oel2W6{V z5_bEDxfHjoE}iG@77nt;*REhmZ+FlSPj44?2t%C_t&-8~jRvE?_$rn3F;#O;avOOK zg#Nlbzx;VW8t||C`}3=&6CJ{R*tcsL=DW%O|7ILfZlNy4LTzM2Zc_P@^#rItMhtcb z`-?UB#&37#su%ng!>NTbadXceJFvuTM0I2CJ7A0-I~gLbk~i5x@Cl&>#> z)cwud@yyM$4^nGbkO;JQjRKA_ri7i_1r&2zX7xhoj-RoC>H}8E&n*tSMx2AtF0E!f z0+;_S(`7ak6%L@tuG@c{gcVk>;j74sqSyZ*L(Px|I8kl(D|fmr3C@}X(F6-S|KTYW zSI+()Lh);b2zYNXXUu(+KNyivXUfWq`F^X3Oj?w`ZE5*pB0KCP|IV2`1=8oo)-z4= zINOSJiO=(eI6(|Q@ylXhdmO+jpoeZmJ@gT;%O8+|Z`N@Nw{J&t+)SOukojs{a6G6P{R$Mo_W zDkj`wZ4k-yk+4V6N_RW^y$3(P{wap&`@mn%J5E@zz(MYf0Fzl_BiSsa;w{~g{BQ9` zXIJn$gw17{UkZdcU#Y-AP`veh#>qw8W3rC7xy_?9%rZZNe2yokk9Czf)Z7Lic8kNn z)I1_0D?Uu%@Fmd?eHNgOM0aSDw5DT|$eTf8JH#NoX=a5XNYt1K1kmjXL&f-?7)B)Z z7Gl&8;Yww1*OGH5x>Ho`rnU!*$VQ+yd3~m=(;_X+?O>>bm2Zj zwIyFr%$<-&t6JkOIL6(JH;Vo8%`~Qz5ZHmP@#oXAddL9_Ex&9ORBVD%N_63VUcgEC zo49>)a%CL6tub^gMqxRW5sLjY8kl}k6gl$YudX2Zy8eL&HF3WA{F7b=j*rdl_rFQ* zb9>dv!b8nJ2}ldJ8CVc(H4N%gc*D->{qssKR9wMD#%S9Xl0|(*r_byGe|{fZaD00| zOymEvK(CbLsiJ>_EPd+7B@d9Ix@P8WRv~j2K;SQLdJbD_ATV zq0RavoNrtB( z1~G~GII-NptWQ6Cvjd~;Fm(~|53^;&S*z20qBjb>`7_#%&_!?qVQr3ySi8`F_wZ$C zs_;(@x%tn6a&Vb8Yz4x(ln?xv{anLky{5p7sZlGlL-KQE65B7D?eJQZQoJ@rWc455 znpY=^M_Wh+PbosZ>IwITIVI}?Udd>tHumE^@9v>9E6pF^CKOMuuWI*oN4Oumex7R| zvPwR~NT1`6X&@>vDGyeYcE3PB6T@t4@qOU%)}Me#eAPfOM@BH4XcyRQTgXiu+4-PW zxyN*cZIB}{q~T$vK8oZ0s0o6tCD4j0#YwdjPK|1|q8cwaXGL{ay2hqvz?_Lc5E!a6 zd4Z$x7v$v&zMdF4fz>Y$>0dv5&Ib-`7PVkmmNM#6?)LkT-*s)m6J)^bDJx|Xjp``3 zh+%v}n;0wk7~72+PG>~LpcGOb!bTUg=LJgNRbUn&bF|iAHWzs6Os_v9*M)LUV`H0R z{AaRe8V3(li~hGj{fL`sjVN&5%1HWfrmgrM7_ZS*!joky>QDSqDs4j=hdjSZ)dh2% zzhQPt_i<`!x%O<2)PCG1&hY<)TfGrr5Rm+ZLEyU@iZU6BG@bb4*8chjC1+H=t>)8z zxWGgV>;{bs+*-Bv=!{xkU+$2B3p!}*7fW?;^m8JEV++dW!bJXoe94B`cak3l*>c#cmZjdV_XcV*Mu;9V?a$v{i39Z; zQ*@2{{uy=urw02YsnDY;dP9lXC?TnzwOGapRxh!^Ta6~xtSf%CKS+EfCzsXxno(b> zfbV026YEl5Q&&kD58)K6UT@n%%6HRC{BnV)K&X<`$ zL4m&=l?trl*>j`wDh~oeQ^kK?Pt5b{C@a{JzRovLTG617i=e|$&G`FMMA!aQ!R(~i z0vV4nkZpvgUhJj!gGqMBdy(MTj<(crP@+aT%?VMsrzbnUPhCIfdo`7t?6&_yZD&4G zQ6tNEg|FJEgH)r+(c+s*EU)Uf4(|V6f+&1MsHsN{(_Ua$Qm2mf)6^CO&mU%c<>T|aS zMtt{=S7p&0?L5v+h-V_z$!GEW8GN@-sT6-sOke~P6ATIlRg~T@2)pubYm!E*Td-nkg@QO9N0bBj_IIz{j6EXHq;{t7(OXpG!6D#J-eT~0Spq=-UwPyYJ z=-HJYH8%pxpzkCr>BVw4Ug(TYDOj;C9kUd^e^_m|rV1LP8vUtu>B+E!H6Y91 z*&otHY-!0xWhY%FxY0h{;4{w(gqy63x)*1Z&WrJ;3$sr-VFGn4)%d?i0g3N-O5t_d(aEV5g7&H^Fzncodv|gVxlFk_Qy@XN&mf=WT#1u(g{bJ zSN)#@kLjC-3a97778cZW3M#NU=jnf@X^Gb$B&0uV^ZVx`fPyB0UcA~eWC0rz(CFIh z=8~^)z0Ar>yqzxXi?EH}KcKj!M}5{m42KjvQ-{ppO4Z#U`SHxk#({aHLxqy}QDnaO zHM}dFM>BExuI#ILv9rd;+XYyx86Vr%M8{@^^W9syY_UbeaS~W)2T#bF-;hu&(_@|; z@$1$T&Ip-5ka77hH461U_zvbo(24U0=%Zqt1c-ItWzfzwOfQuWraUg&=LR^pdT)>% zMBO@+?UCo3Sux9vQAoaEEqi`=dN8)Y`=)PtT-~8|X)q@-$)my95uwZ^+d*Sh4QgDV z*ofGesOo5yPn<7^594HPtQ?(y1>OJrX;qHomu&!i~i6WXG8BONVGZ|#mBH!?;~ z``QS^w3NnO0|UAwAiVab#_V2|mkn$!yBM7LY`HhsGuu={xhG~&hEP>aP$zi?je@xU zWHf#Rl9=}x-jDO$0Sr-3RGX>P0bI)a7!Iw`%jYkH%|IDtyWeL<8q``K)}>JE`hLO= z^b%};L`%&Fan<4^YI4l^`HuL<ERIrVHD&cWXF!a=)aBTFsWsPz9 z8B+Xm`}6+l)R`us@S4)`MwQA($WqYqnr^3h3Nx9IU(Z*i3^ve=`p{(xSxG%R3R*d%9~ z^vQ3AKvLisci66yQ(acxMz8x@Vx7;WTRu|{;s__QZ`4qsPQ+SE&GFU|{ED;}bl@X> zRrMP&Wi0xvsFABXcFB(Q2QnL=I|1fFaTE$QWs##M2wotug`*LRyIn{!wTv+5_8%v2 zQu38=1bK@6cOsHkB`3UYt5LiIjP!Hq$p_v`Ta>U}c~Kl^dFstM0rfqgjn?5&2%_Ma z55!jQoe9g-f;Ff zvLZqRQ-`@U9%Jp94dq7L^*CZ4rgU)1`fcA1Z(E@3TXkLQsbU$m!t3)uOn6*k?96Ag z@=T28luc^p)|$Ljcr;Z9G^-W_Q!b1D=?y7DN`{k|_vI42H-(F?8Q2XI{-D z+g0+EXK_AH@g|;Bp(<=5{(YXBzZR!fmjWjp|3`!(DaAr2ij?xzSqvf2UeiC)2 zZ&an^yqbOit;o;q*V92#}6+;g@A zN-4JP1cAsH4$aPhh^F=P5w5P7Q|O!e+6&nEVMXZCMoR#=Rc6O$yS?ik8>bsXpjR9H zFofo@I{Q2v*xEGAU~a2KmJ#&&{EKve(WZ4evvHgRxr-T}f-_&7ZYaAW@0-HTIS~Bl zv#cj;8U^!)@@>DV3B@kQ921VIu6`Skp22=BC7Ej)M8q*%mAhkZ+Nltnvf~SqvBJ5t%W7%AYuRq+V4S;EH@ zDZllN(>j#S;9?U%VbKTchyrq#iLb{#H@N*w&kl&$47%>doAwR5Vrv1!C%9yJuRihaHI7WXTnC}yPRzNz$|wbvxDsEfiuQ`X{?5jgivvx&@7dme zvupmNxepgSLbA;e%C^}F4B^{?sfvd832vhA%%i^Vl%P}~&@@s3MN>2A)~Pe9fL2K;*%`@X&8c=LRxGS1@v|+JsWp`c8RL-1 z$J0;@%nabuDQ5NnMF5|5&Fs^ibf&QnXjEpz`ao2zhl!wmPM#l$zESI`iD$o%Oq2n{ z_#c+s+o}5CN#zcosQ4E?xX#(OEZ3c_B(mAGKIR!hcJ;e;wi=H0EHkJGB8Y1`xyPx_ zEEfMR7i~HW5ZGMBX_)bdL>LGLu7BQI3uB~C+Z~6d<_z#`U=t0Tth;(`0or%Wb|CRH zeXz~PzFnc+ButB-{8Ht|}RW3UGXB*^nPc2h1{{zSI z_2u0458&01Fx7F5it5s93>ulC-1iJTnGhJt*O>$VJGFftC8Fbur%qm5C5yPuK#}Kj z8yZ&I+dgDuyqDJG5DI}HesAoSkwcnu72DH)0pP*~k=`;4M(xBEv4RJ<@DHBGQIV{L zfiKg_gH64N4(DUr5qH1kpaq&EvAAOArabJ_YuHD8usxNaM5W6smJKU7trJKTavF{+xJSB6P+d5R?$8Z)PUkTuh6$AbIlIXzGdls{G)x@)#e8k4G zy$&;)P>W<@yxp>H=Bx+jnM2g)D8u7g5RH{Oc-cA$>@_aWh1~jNxlxfRBHrj?&_QNg z*+ocQ6C0&|rxQVvV^YY@&KRpxFodJ3Jl< z-)&jGqo|7$*lv93%(6Pr(SV(@s{C~$3Ysky{;eQ`RG)|yu1*iBMnH#r%))!^tpg8$ zZ_G%!#No;O;;K4|nLkLqzUbIF-_*L64CUQ;eXd$N3xf|y8P1p;>I7%41mlrz_Y}o? zl%!dvdK_0=$z!8jzEskB2E~PmeMhU;q;iKxsPn<^pL1{FK|MWA_Xup}eSNk^z$o0A zOtjmjmPO@v@1;uy#r5g8FoW%y3h;4ac~R=$-qSg)FrOOh)2J|s=6!V}6wh}qc0O;y z(45w%~Krz`0=d_a#xoywj%5%(Ff!7UJ z2-8ELIAvi+HQug!dCf#7aD~MlN>wA`SUk%YGH?#WtzXnYoQj(G4St8|mUhVE5$968 zQA)@Rh)CgG6CB*%9Lc5a=i_{%nR-;ScvZ1o6ulVAGZqX`By|u?cQ|n=jlD(y2MVYN zDVExis(RO>2mp`Ff1rLKDtJ8{n3~~wLK*6W`Aq2C9BR+1hY&-XA)fUx_EVLdCmL>e(ag^CB9bpB>%-%2V{_}*)T{BAo7nv511 zh%PB<*~@HwK%gS1M%h*9$Id)@6JFY=#ZE;Aj&7s6B=^VpOC(N1%_bj?SJd*yQ1MSd zEa5?DMoE)Dl?017$)Eq?KU_c^+a#p{9?VZt-4XFUDSRE!ZoZXaB*-slP2&l9oBgGj zq<;wvw-Wd!QLjiu9Nn(5`OdG6;ZR3lt?_$xH zSGJ-VMp!-g)Ka;Ov+zwCB=J%dtfpjqk)F4u~Ws`t;4d@+BQ&XIXF z5=Uw)|5SS+SIAnWjQRtAeJR}*z5a`0EP z*bKd4=pt6q)Ct`!m7sc`+9;vdZ3W9hr1s4lI5 ze0o}foW^I}UC5Mzf>J#;jHkOkV!EI+fg)Pp!h1Y=JlH|W+HAt&<*tl!NgEdWK6&<8 z9P{C}NKpH0dN&J{xhj>um;Pad_bo2MrlrbrtND9q5DsS(HLx13E3o$@ep z^Ceu_?7Kz`p}Nk{X=<%wugTy~;W2sc4xMofvN%5i2|I{Na~6g4Q}&)O`(a_66pP!N zRIV5DPn3$1)w_CXr!`m?n0O*oY8V>`kZt+&Zv4Fg>sWVb==w=HBKG0KeB zmHH7(p(r-1{?YKrb(yuiVCtQ`;5Yx))#Lktw^k>|TE?1APEL8^QJ%H}wisR1z(RVQ zdh?3w8tGTt9-Hk6vZ=-}RoY*p*wV`)*10&(q2G>LFV3Z-opS)WThK^z z9@w^VoniODzjLjiG3%JS9qqf3d)u{jZ~Nf1&p%KL202{r6WM{AfwTY#7h`^(JT5Cw zF>&-#_w?48f_>{4spy0%^%jE(&(?rQ=43-}kJ}85hNI-Tk{n8Xe1XRn071)uCB+X) z*O6Gn2E=u@9!fyId9FH8?0Z=?FnJ6v#Mn~34xLwq6>BO%sYeF=Pa>YzK1PR+YdQLu z&DL?nFz^SHa|!1u78`PhJ8n#nwY2*Y51gz`Y9w%&o9M1xUzdIyd>GGpB69{hGJQa6 z59RxHinX>+4xF%rU5?iR)}KrvVOIX$;|N6UF0<>436c9C)2g9f5OauP8g_9YMZ`YH zMfcOLxs`#u+3xVVHeL8=&f`+1#=e$)(8d~Ptvi;*(gXAR#3giY1W`2Ra=CpAp+*RQ z>5ecxxQJSf#9k|{CYecfKo}!0Sc#4CIllHAC)qj5#kq06k&n|}5xo`@O_kZNGkguO z8jmk=|En5#4VFClhZg`?E=4gShrfbD{g(k)cVCR4A{3ZutL$*bF5Pb(Ec&M5l4Xm~ zCrWbX_S+kHyM&{-`773n#_CMWt3g?}N;+A~QSFr|LMcj#`sm(xSFZ0o&(c&w*+bje z!8LMId*vUtKVrrmpV8kTf8!PX;~SH@*cWz;y3UrVZd}W|_(bnh(XAwaNEPFXa6L^aD}tGWQb~8_K6N(s^{IF!qE}(OhFK z&JoC7H^q5nvg&z-$@rK2;s#0JG)NCFi;&tduP@YTxfN6%{UGH5CkHW@(-gTfYHpG6IYklu~Xbqz&NRg!!rMZN;Vt@!ox_v=GR>n zfb_rQhMNM>G|ie`=sHOr_Henfz|(oGy|pE$~ws}3A@gI%6mxLtpWoEE?9FUI#u3HgQtLunc&Y)J<4 zu?1_-V&I{N|J##O6K&T3ufE^eJ?hs?pYEuLZIKt?9ysaH_kKq967Lj(ocEY;ylUDQ z;-6Env*ImXkHTNkkYDDC&4Y7eHQ1v15e>ST~PS$(oGGfa~-emz@ly(m5$;J!X& zVAI1Yk*EyVHEhY3_MGk~%XBUsFyt4GMOR83K#nw_t|Gl<~7@YVl1u$E`9%C<2mLJpv@Is70_MU zo3Q0Td>t$U^H_QIxqqx@LrIAo0={jYwPEBs(kcHAYN0{)!YPeRt?ty6?1feM8M(Ni zWq;FEFBU?L8V(iOL#FC@Exe_U_}uWg^)P`71KxJ|MEB}1MEoBib2%F%v&N?HOY|d# za2HHORUG~+@I0-AC%23g@z3qL+pL5i#0smTby5lanj*3r_xi+&s}-FYlRMZ+44Eot zmc}!RVENF3_p#+s0nT^-j$%+>O&(xxckh6TKXVzNU!h=Ad zm%^rpflN}tAK4x*GNJEWjnQa367}1H?r_8#Z$)H)^5@UfI8s!QHGmHI;MUmSRTVTQ z9pD721ecR_gHQxi3j#)xonVUd#YHOiW;+-~5x)pJOL`sW4vd95Gh;POR*rT? zB>?hn$d7r+YBwR5t5WV)RU76SFf_wjKIk=DFHvo?oB==}8vy=D4QI*dLR0Tuixv>o zYZW=+#;|BH^SO$qL@RruQ?>K4eR%qz;G^MMc>)Ofn?9I{#zp9-ZepO7@j7oi@PP5v(kAGn-w+X7ljm-tc*u| z=j96wX>-Qe$A7_h$eX;)&olOOLr&}AeL`>| zR^)Zk|LsI9AX~eIusDpLx9;90;gIi=qsx5R+=e}lck34J zwA>eBZ~=1!u2;<@^*Kx{hxUO3c=cZ{mEUweqnx>$ZoY$eIRI>DGR6IL6gSH&zKOb?dV8_3-9+u(kl9!+|sO!OAizU;kb!R!3A_m5Uk$uUvt)ue{X#({}>o)ssr14ho zvv^s|eiLl?E`Ne9?1xxTzZ~kzP?1%CLSHH4&I*dSc^kUj=3oLKvsNUt6kg04;i4CQm zM9DPbXk!%8xecAM7@L5=Va2I0J`ObA206PTe*Dy`7sc0nRi@(>p+ze-hjk=Ui)A=5 zMD}Tx_PWoiH}anKmSv~7NdhHk5WbfgKh_%F70f5o{X9|T#PL%2lLu?F$9gOdTOccDuC(GRIifZp-`-;VMprDbTKwZKTz+A*Kr19kFE!uRT9rZh+ocXmIG7y99Stlq?HI}OWkjg71YX-CL2tiuV~~uxUPr8L_bTr zSbXV8;=<{6$ABMOaw5@UgGP5WUDGY9tt6v7+r%Yq&U1ASB>l;2;dL5lh4tqQd-Z>Q zj}3g`j=dIimy`2f4U1nRbDhwwobp=Whm3!k4`?>y7lYJv#1ezN)OmY7)Bk@-6>VV=Qecu1K)?es1o3#$t57b+tsnO~(VwB8V+b0n zlu^?)McZlWdo4`?BuWrTiip5LqkSU7t33 zLU2fBIu_@INp9sy8LAT^hxS}LC*;Rx1)!dJE9aG&-W*k@8t2O}oWgkK|ECBDuM{o`F zhc$rgYANT-5KjGlrJ&{T75~mVoa!w2&0!uN?SkW1a;rC-SYQAul!hT2pTeu5Zsw4- zVb&mF5X4Q!;ikOxfHcKP*SiN|+b}z;?g1_&5YKG_nW{9m(WnLb1eT9lS{}fEDu&4v z{q)p*IC&G;y+75;@4HYappP_m;+wl7>>q^*T)Z9jxT-V0550} z&|#mst~5$sAB}hf>8F@k^}RjBi$7%}D$ULl$)`(WdOAzOv%q{2PJ(IDJc%t$NB#~= z?nbk2Kq{Clm_AfFHaZ1Xeg<~mB^=K7KQOkjFt&E)pwfFywrCG3Pj459_`3i}Ht14b zagVu@-{l$b;Wjs>mK(x=|LBu*Oxc}U)g1PkH7(kK^IHvEvJRGxlQYrp%;bj^D3?BT z;8DRuh)cH4eKT?#9_6X*JQnI0p@1EM{NByJqZ%KVwm@R@X9Z!YkmKq#<}C#F)3kA0 zd(xvBhbb9IutqYs1JWnI%?*Zk_9$(fYu0J_4ssKHo@v?+Ii1I>hFZcV$OTa9Q_^^# zc=umCcc3p7tHhIvqQ1B~$7~nxdv$o*IA7CmueRq}HlU$Z{w@HM{5_0Cg65AhPj)?I z9na2IwSrS$3u;N!JF%U52^pqb?E@FT?wkm`cDKtWSrA@K;kGAasKt~eYq!37)g+JC zm7VGl^YQ-f?<>L#WKFoMZT;^+{Rhx(q$<|kPBB8q#>Po}?ECmr<30(hBi?1YAZ)#I zvT!gufIz){b^Gp4esDTqvA#PyR2h`7Z)G^#pc1_eayotJf+tf*rhw{YZ%lQ4 zQispMdyMziPYQ~O;WxKT*&8vxdaEjcJro!_AXYg1pzFB48Mk9u3eH6d8eijZ%uUox z8Np(V8nsF@`SkhJ<$RtMya(Ls$d=#FF4k&>Y1(77KxMd~5Ezmc4A*#& z363jNs&iFK+rJu*-3ctNUEJLKOdA@0Oku&1N_CI7)ozIME!>}E$y6TJhZ9>X#nnE; zL4=BUnHS^{+Xv+m4s&+;KL1T@7GZGXB>FYnW3Y|%2S{KbKRNK(`6=LfOdb!Pek4&P zS_*HiKbcjtuzS40h@QBb8! zKj18BE2-yE7!?sczfOuTn2_U1xp}kVzHSzoGB7D>BL1f>jXaxv8?xzkWNW_LXlap0 z<%5YAXdeI-P^y}%P*dXi<$2k=8@uy%w;@ldn0aPr>#1sRSggo%33l~*mkPq=us|$? zby&=A=p;2VqAR;2EdNiz#6PnkJ<-{aEQp>`{frCbh~q*#F)I0E4P&lD*wfN5-@q`z zh7lzP#>~#+BE3caOwhgY?dt*aOCn~3%a^5H`XF?f>YQ#E<%!K=V#S8PIhS9!3^z$> z^Q4`F1F8Pud#s?=Q5#H_V1|-hGoL++puKzkRHeo{;q$8uiu`@53w#RxJbOM zytf`r^rKUelQRbX@WS9Uqo|3jtcg8QX`b(Pw*2r6a3zMDGqhAcPFF<`uEf4yt#~Epf8}zt z@uT5<``PuyWf+oNX}lW#0mZpQ88X}?gh}y{4R9h@++ZjV@!lC=Ba5}%7IIM73Jb^h zJC*n!eijTsuI&Q2BuNN8JqZRxpkyOAKPR@|ef;zrO|YP%LCip2^`OB(`F+yvf~mNb z65~gkr6bWWJqEny&`*m*Vw1Nb^|`aS3M9T5-_BG{r6rp3io0#b-|SafX;MNivNv4% z*>~7y*SwTyry1{~b)%v4${BTj8i|S?|HU53Gn)7Qsexh~)j;M4-e=(D#e^dS`=56xU4;rXXQgX$|xh+ zxWSc}s(Y^=m5quSo$9Xl{rPMVQndDaND(-A3NHg09_rlncuHa#l!E7gYl2iBoj}1A zgTWO#YV%+G0xCtR@DSOrX7p!H zRF5Tl14C9x`Z1f`1#m2?@a86Tdw>y2`9UY^#}p(5UKY>K_^-z)coRI&RFu!Rh5ilc z4krL5#t5C(=PnWIx?>tAs`O)Mq?$i9)i7~^)7Koj!ye{tQ65?$Xa%A8*<s zJ^m~s#pE>#RL6?q*c5_wZHkL6Wu=?qR#-aasTG8H-}-yZD2gs-MEN#L4^EOo(d8Qe zFLs(^W?qk%FENAP5ygTE^V6f|Pc5opn1u7sfiwVEuT{1%CCV5vOrg-~B1IjHIz7kV zCn!1R{h{+p+}t_Yk@#bVo_N9-6+iN2nH5fmPI=Hb=xL@7qulg9RY?9op)x%@l?BrG z{!g@YvEZ+zJ26us`)j=l1Y}14`I-LV9-!7jK64fzAPe*sL{O|n8mvFT_YWuffDwSr z{WTl++pctsWYu|*v|N}`^P7zTSjc1CAl^|sc3goZ`{msUES@SR2W-IVt?un`eyAH~ zW;V}TF0rLeLZ;0DdPodE^^^@1y~NuFyA%A)TrE6zS%G@rpD@ql2dx%-RQZ0D_p76gM?*4do6f`6|W zohG_a-<|304u+i^hBG?}jS1r4x+g;*K5D}IC?Bpu`MdaNy5T-jd?Y{-q&)kZ_()K# z737@AJtzshcXIl>_^1v<3y^d4pFLXqYyz-ZgC-P3P?X~0OL31*`Mkx-ET|UA%0QGM zP5ABijNnmdF@^@b`Acae_!v0^G`Igv75a~8r68&bQhY>`#-=|@_!@>*PmuF8Q(riL zgEO!n^`#6B57XB&I;8k$)-X2Z8QKWSo8tWl5cNmJ^uXf6T+~{51Pynu1yrBVj8vA$e8S7AVnZH6-eAA1vqIL>eV)7?i~)3H3s=+6IE|2EvFI`s5L(n<|@;aeSlGy z7<7}Ioy^IUIUmMU_0(f-#Zxyu!aAR6w^4GhTn}}5zLTspAg^?VTQ<>TNK^H4e)QGF z-4^W!j1rYJE!65aPpN&v$+)m3Q^USdXGAq-#n=1LzMZMoNZ?tD3oDOVqRhKvLG#gH zdPa5q2>_~D4BfsEh#tkoI&`=^pppQ3Z~bzhyWRMGp_Dlvr9%5heG)WAPOZj#&SNtF z@|Bz+yVMIFBEu*?R19BVnW%?%g?~9c$e`u>R8jXE%kL)tzVfsw{w!XfL?r0VUe=3Kn@8+&vs;-|E{FxU`5HaXD~=a%Em6Jf6Rs%}{`+lA&bT*vj`K|F&HCo92~l zLJ|z8yPux_ep}U>C-4}=hdK6LeapGY{>vXa)+LB)e_|VD^xK&^0%xWSAC3tPzXGM) z(5L6xgJ#zZ?BM%vDz^6^6K}sCkQh}DFuCVvCnw8v z!vFpC7mmM;V#t>NOO!Zm0IKRO*U3Yhyb8cwz?*akP{{w#YZu1y`0+RH!Psa(Y*C*RY1kJNg1fJG^APYba;OwU&x(+z@qe zEu^;ORU6(1p`q*b?iSz7{M-8G84ub_079LPHlY0FQ`13st*f5|qZuB+IGX{+nIYyy z6Pt({A$cRn{5di5B7De;jF%Mo`4A|id;o{R8=nG#+XQ9YK_`T-a{a!d9NKwa>_OAm zOY^Hk{0aERI&ufVlnFL(e!$ZC&sQoFse;cuTKZQZ>Jk;WNDh%g)Z<%st9S-hYZmM3 zN7z+UnJIW?A0pS<$a%nd_wvLbHcv5AEJ!cI;}TKkc4o6aoLyXZbPV~{WiK@_dl4>@ zVY>>r)CM?b`yI<=Ky7vAKDzs^_JcXsdPd|@n81hbD(kS$#YKkJmv$1k^XSvccW}gV zraG#+xzV8?_);Vfm!N#HG?7Uot9`eQ5;BC5akAzZ+|Bvc1IPqQ<<^7B&q$M;QsqQv z{+qX&{Y!EcycVrhMLiiQK(iaLN=2o=VkA$u(*k8gUnQaPzo9{qHq{{=Oj}8Ia_(Eg z(P{$;@_hCBRLl(I(tY-_txZC7!epql6Q70%QI#O3=of?Q(5L$sNDp+y=#N*SMUGwh#dRj|2C)1u{BG)4I8vxK z9xUswVaShX$GisU?Q2E#pl1yEm{ zeb(OFY&{I4-e9*@N)dVopVlLR#}m)n4+PuoptGjO@iRpL&mZEIUkyw@TBYUMw%$s-|En1LzWyBFx znxI5K8kw-12@|`)V&xP7pX;YjBY0b`MAMb=z#A(>Pu{1-mHSELsflyqVSg;x3B4{< zeVGaH;xe630%joA!K@%{Y>hobB>_84EerHaP7>VeEV*$Um zONynQ5yUx(FQkwt{-XbFWZ_*Ile|@E%@E#;PIV&mt?FS(4yBq3s=Wf9W)stg`)a|! z41zBO_2&>0JsYy>D)`eDJncJjCj0*Xp;W#=>T0flQn`x~d9gld%9N4Ep6mF@)6)Up z$>YBzvh8sCoGDE}X{9Hbp~XKeyiJRV<1pbPiu-N~@GSk#Q{u#q(IERBJ&kD5}@R>C#{b$@olk_{sFJ2#A*3jP%OuE)RV)d}--AW=!~A z0CBv|1VD=f>zCOd7*ZIoFAni6&Xw_7%uo5pMtrJsWY74ABSUD_JC{@D%_rl}k&G{p zu9tia817#%B|@Skqo3;NCe45~nhVz=P5cX$fY#*h_lJuQ)zEGQ5uAEdrb&}kU)4C! zCy!^r=moA1q~3W6=t?j?)Vu2;n2&q$EsP|tjoqmCOA4P07kvEdE1Kxr$_id`$hoRt zKBj`LN}H-S`}&-Cf%HbAQER#jdUvq40AcT*^dcVqA9c5ya6qX@o$i3pz}WNe*$mW} z=y1sSWC_hA(3Z9RZJq z&R!K0eCMHB-xXrA3IlbXP=2PdC-`8~V|?vIyZtzB{t(6ZE# z01{nDY?^R_X#qjFxI@DA3a@|Kc>orX{#MH(`S1+t@^i$nmHlaEp*AT;Q;N<+gA# z^H<{tx-G0qn))

gwVwB38)m|5Mc5d{OAlzJ z>v~`LTA_djlbo~YX$raxU0Shn>6fkV!*AP&?w9`sNOel9!+bzZupb;{~F2q z_|GXzsPWd?ynfq#WIErE!gV<+8L)~kigo}r(Hi?r$>Lde17MoiRk_WRA+IB{{&O3b z3z74!6}a37FjRi2jq+>&afW$5r+3MCoj$L@;tDisW7KVr6m5X#wkXfQi2}vi_@l>s z0Yf9@{KU*Px1qnSz7A4pL**z2C0-pU10?f1{~}|D^2XaQ7kXr;JyP$jf|fg{jAHdw z9@T|S2yGSB?mT2Ss-p*zT=rqu^%bV^+*h9hjeM9db$SM~R)hDnhZ^bOfnQ2S>JQVY zib&v^Ys$jW-y`8wq;vB9Q^V||Uy9X|#LnGdxt)#LxkvO&PrsU@f|wG#E+hw|2ptaos8}Gw zjlJ3WS9$V8w-FYE9L~frCEAv8a?<^marJLa9Vci^W<=Lw^?&bm58gjv36W!+6-VEe zH^@rB^s0q5-aU}-_QRMc(GdZ}%-W1mtd2z79I#`G6uA2QdFH78{!52Q0EKpbUc0_L z(W(fEhHR_8j6Q8hR=4d{6lc5yC}(#du|O^tPt@mzO0dQiyx<;?$Uln4@GtCe)%dj3 zqDP4oCno;ZMuV;0(xES@<|E+u_uN_SNTo<4PNPBC*?6oVevNqc98P{SV=zVq79O=zN08_2dSpMaM z8>0nLdm?aAq5!sy>GawX(2#<{4}~?VwrQ$|`4@Ya*ZP~4h1M<(Jb1-cdQ=|D*8HvL zBP@@T+>fhGEQuLhCd)xkp6OCnqQwhG{&&1nbJI7*!sc5{oE! zO_YGA^WM7^+i>o6b~Wno{uMBuj6}+Mfnc*R>mgD1PMxjdr1R?2gNi6J@Oe})y+K6&4<$uiC4P2`8$F?)Z zVgqKzAwpcXW1B+r^uBY;1eE0mpuDc@hqwkl|uM$Vq<}t=zKWneur|KS+ zEM%u)3pQ#YRI|muZ0V#okqwJ%U&BL;6mW57p;O zj1t#zz-=h*TYN>g7i#A@?z$1n2DZqLHEO2m)uPs>Dw1!%F3Boa)gx{EcC%ZREQ(33 z&uXl~#OqW=k{4!?JnGC}Bp3Z-nycI(RwFOLlI0a5j>MYxE&sZH_2n`1hC%54v6ziv zK!Y^+LS$-EAq!Z%|?hu;lV zIl!Dr05i4mj+*}tV{wW?OaBGe{Q$#Ist4#L$hf66fVhEsW!&tULQb0ILD^Nj#(k&1 zuv0*j!A7l#5X>MGmEUUT`wQFnZCGt9ox|O zJ-v2bMxsmBi?Sb=Ga;N+ozF5!^-ztA$t&(%9rM(*ZL}t> zrnsx#uN6J1%H9UsqG%Ah^6m<;$#P!8n?F|FhB(GD9V>_!GfE;R9+cP^W#N}jJWe0U zR~zRa-9IyrUZsFKhIlGD!lm$rHIqzQe}x8ctZqX`6N*e^c*m;H%!XIost@}t43Cny zY@@^LT$>FL&io(h-K@U@O$3gwKi&i8Yl~UJMJKqtMAv76meIv*BNwfiojR#mH`|8o z6Xct!IK&^4?wDwK5?G(GHQyHmM~jpo#@-o0C4i>PaFC zDDF20&H@fgoN730wa-xM7wl_YR+t-3(Q%J)n~_3P#xxnJVb)S57W-b|bN#wmKK_$($;v5*D5NYv5U#24 z>ccy%rFVkG*JRmR%}*bfXnuc|o22qL!_~XQUKBi)iPy8=t`i^p4ej{bE%+aJM<*!~ z8R>rWJS?4BE_@#sZmlAMAgk9wPsF!CsJt9!eD-|ihhx5`Ojk6E<)<1TMvi8ZYz@xw ze<2{sT$dI??zYz?u3yXpVbQ2j$bxZ*81^PDuQ6+Bw3Ryk)Xdj4|4>S(HGx(BOM+=b zNE}z_>4pfOe0|>iN?C|Um;R(_F`rB!Qy8D-C{(4!5hl^cf6iEL-0?Pf*$0n582I_W znJhC{j*iVHW38lAg9G!Gq3^LviI%YFpr4h|@85FKjjdC#mh7YXU?#lXb4ez#fq@_} zLKhfacCt%glIsrFyLuOUcd0B{h|JFRc)!~i>U5LOPV8cs!0ahtV3x1pu3Gk`vUGqr zHzjpzXU15vyhE4N2KUnBBNjWD586(EH!fqi_S{o%N-)8)IiXT^2;JDZl8_qaBM-b1e{ zQDy?PjQE~CO_K=6z#-|peN?-*SY~i=$nwmf(4|Reb)qoQWnWOEX7Tbt`D!OlzW~em z*06LR*Q(jz+-zDg_=4W|@ot(;g3PV`mn;&Ph?G1u_h8<)jfVT@+8^?*PXqQA6XP_djpEky`~w_H!wm^j!es$!(4Rf5 z%{)mjr){66q-LxUMPMh~NoF}1G5aVhDrD~xBWqsrF`!GJ;Z1AhDNIh);$` za9_0(4%vFBRKEjzUlA3kLvk*a%b4iVJ?W>|W{ldO@oLb{Hp>m;qE$~lmZO#8JHe=< zsO!YEM{>3_EDL;PrV{rj&K|$X-JzcSU|-B>%P(*HGoP!nHSE>FEwYz3pQ>TXSXIUH z!WQo5X=r%i9Y7uuyve*=sFs?`oo^XB`d$&M!YDThq!?stKA&J@Ql&Inp)9$+V)MAr zTR99&^?3JiD@b?2f-k4d9%xBShsFaKk_k68uh(c7N2G8uIU%2v z8E)^l5e_ps%6t8aec_U}?14kY)?xowJbyOI z?r_Yt+O`8ObH3yBCS)#Di$w5u^9EqBxmc>jp#(ySk1n^Mhb zJfu&?Z5D^vV!TVSbCiKaMBlZ>s#n5mDByI>NBemM1_Qnp0gRV(?E*yIR6|DA7i20t)4-yFO?pr zfR)RSzpY&U@eWU0LdwXOlAk;~U;nWgI%$EBnP{n%NLC?v zfL7Nm>N)VFS%=Ks7&Y*SSBJRsAaRIyzi51HhDqEly zdan#?r^i&78`d61O2IrXmla3%DaK8QwIWn2OyXh6qsi;`{?_M5J;Sn+fPpU4*O6+a z3vYP;4n!F{i?7w2O@_T0XWsZ0_7W1CS$r38CWX1&3lh1I6#wWJRBWdvj{ z>IC*Y(Rxk`p$=d0Mx<~!@cCac|Zj9fb#<5_ce6Nsw-RyVgPCsoJx2o@6cO!=d zu7XTObDY6${khhmchkw-H8n7pFrIejgDkW%=)*3LgSH$qezM#r0SfSP2z-!?n`NU z#}%@|<qIh#R`3+hM43m3_Ma*h zJ>s0Ri?l{U-p(K4ACIa9v5r|dn=d;VBX%LDLMf>S-r)LHySh53dPyFFCRBKT@F9fh zxPw^buuhd-;_7PCl7gf1c6Ue{s{I_vTYEh!OZ07o12EJW)l#>#W<11Mr7ZrYIT2T+ zX)!Rq2qsJ*(~Ixlp;B7Eunbt5`vA)+vCB;;6B(e> z)ezp}xT~9tFugkI}}l{IPt5KPPkfa${Wl>AvP`hl1r*r9ht$y2O%CltXEZu*6wh?%%?s~aqe@i4*n}mo7&3_NyBPLLO%op4#pjv#E*rBBrH3V0E%(6k|r_JPbl+J7{RIhro4Y9wYa-Up}WhAk=gSX(b)Qb;vsVnbE*0vQk=J`fjD5I!Nf8 z^<%0x|D?#%w7O+r-XErdr$vFzGvLohT=Xmy{Xj-gi=2$j=&!@|=PCQ&e(-7q&7EwI zzoQh17pfyTw>q`!pDjKG0jQTmRNSD00z>!Sv#kXTWbF$ga$Iuyd6CSw!e>MJ%I6hn$&)X9M?)Uc8J48 zao^G&v4RVlxeQNK_d;xo6h0*P(4rzZO0C0|>2G&6a&K?$Z2u@ihEv*>_Va*9z9rzG zp=ea@zgARnyb0i#7v3Hc5-!nA&Z{ZeW9na=WYR<7gU#FyHHyrzEw=LIs3-m1;a^2) zleXSe@ss9|cSkejmrc;9rBiIOD4lJRzJS}e+~NFT1i}GdRiC|_GO`3cLMIO4BBiqe zC1lH*-Et*({av}C3@a+4yw7_39#<6xRf8qg+BU`7Xb|P$T$0h4bixZ2Kiu~eYugMt zxV&%Eb|rx|kbm!C5e8g>+&W6Hx;~s)gS$I3R#W$wTdltCtCr>_yfS(OXxuNGXm6ZSt) z%KoT5|J$iRA?#!VScq+RYAq>~7o%O8e-yjwXM!B0I5dP>;OXA>Xstgm6cNArpu2`i zdGDbB=+l!l?R$UPmu;NPEospiQgS+c{|=I*fojjSdNI_Z>~yoZHw%ahaBy%8R+E9o zq~YSAdkH=)%YHsP-QWY9nn)|Tau`hbHsyykhJP^(tzMlZLo?jY4h&iBCZOhK{2R>h zDtg(JboAkt`7X$uvsxhw0}yv7t9!IXms+p-pSIeKpSwp@sRjK~`z}W@`4VC~?-oS_ z>-pStRC8xz>PD!*4*Hq}15P&rD;7(1g$;N zypXO{K+9yjh+r5PLYc_n-1W$~YFraZ zt>K#gL}YLtx@~=@B1~Z3X|h}hO(lP<0nwG8RRqdEGpVMN*JQ0sB91|utUz1z0LW51 z>xbZSF4hd6fhEJJ6gE_9YORJyHTeQR8Y6n&;D+%MA^}f%sadFM z@9aKyd)OLSHXH$QX?DDG&A`EOSG)^nK6~Y&5ayM)H!7Uw%e_yk zl|+AnN3M^zsa!dp;@So7<-zx~Gl+gZ0f+1QldES2ibf#lx#5dxQOM^(YZF5+#Qt8( zw_YjKtl{$rRnH=pQ5uhS(@I>pQ9f(Ice6BHAVvzL$qQA>G~eUBk2E zdEVdN?|waw{rxwCGsofF_kFE(u5+#PT$$>r&tA*kSs5+Q8VyvjxbFH?B-*%EQ05vz z$*+<4aY=*gYPZb@G^98tUME+zd8JmhPh{|<39((VaXMYMPcr6z0^3N2-M5B{1L9nk zh?n-k6b@^A^`x=jyd+$^dX~*fqIY(j6?+XLdY;v0C>4zV#k1gtdTF^@)vthb$70CH zJ#a7gj&VJkjN_DpDq!UTS9;dL%#&S?X4!^h<;f=*qw_M$BcuLI1IfybA{isVbMzOh zTAu=cBQVSG{CSSxOUDUI?$fLD?Nk@>GLDMDw(^+->mKu=tRY+fwU64;xiQ9?b{{&Y zI$3=7NhcmmNs}JS>6Mwynosbmky_-JZ)E8NOGL1O^{7Ei0hDs z!5(rxPw+fbKV-1I{${HD4NMdnOK%H$e17cZf0o1ko@g*@2%Y`StgxLI&^Gi}9mcT9 zcOY-MhUtJ6f3}U)+jR!NSb%{nuYJXkdnyU{si|ef-4(T!DBU$h!tJ)HOXX zb|rn&XrOrT)ed-nUhVKN>4g91k9+W?(JpWA$fmppifS&iEY6f+Bjk@bR( zUqLk|rm}$_-h3qv6sIPa0T!{)G~N}fW|=Il;AupRa;2@2sn@=o?Xddu_B`!}qg4*saVb@c;IPaXGb5jl z$2_%*;lpx>L@MO7_j8Ay*rloP=ff$3BsXEK)2_-1Jy65yi=vzrxLl9 z;<=_4xx`OKm0=qWHrRKFnc7I*a@4cEE|RoaoDYXqi|of-8P3tm+t%!Gy|XTy&*5x-6}$G$w{z{A|7KR#rP|M#&Yfi5bD``0 z94*qV&)(A(L3dMNBVe~V9rvV7E%7Dj|A84qozM>Dw01$aZK``^wGA~9Db`k_1xkSL zeZ9{IMcnwKL!bHDxvKECr?YwP9co2bysmw`T&SgOQ6q|Hf+FTg^9ALJw|yZYkjBq~ zISQL54j5dRCLjMVX1M-$*!H)7g-*gp=E^TB-G1WHzfl_%H)rN>BL4m@QbUsUM34y4 zor5n)S4*-SIfc?~vow88OI$L%SEKG>FsQ7Km!%ttz0XQx9OI(DX5` zT0a7MR2pu^!pb`BxT8;NDuV4wu*$i!-7T+~NHAK}vGhaptAvcqMQ(MHkdVH7*$)Y`;4SBEkIEj_FG}^E z9*bbc=1^OoWQa6xLfgI&H=D$>3`yXyMER>%y=U3jF68{UUP0UQ^mBVK{Z$3l!EVhrr<+eqw%~=MLS_{C0Y9jNeA`x=>PLo+$P65_b$t3}*puol$&YSjkUj)A z6cl;91(k!SB#?=DV;w86J5=*!i)pt&$u{c`29w|#F$^FPL&XjkmJ3h z(ml8wr-H7Jt##F~ShE3ZEYspCgQ_E4sT}l;NV(S)y)z-C3!Rrgm z)zQpwiz}z%Oh)!(VbHr42c^Ws<%qq?)2zJh1Qbzci;25qE6KnXPTnD4o7`=yGTrjo zLh99#PZ$*>Vl}^(=-8bqrwj}m*4b}32d<)7V;2EwG;wNGlfsJ`wAq>*tlj#Ip55g* zw}dK7*!>P1u#o!47aGvkSF%fqkxUE#vx=Gb?#OeK?l@ck+bx~lb&E8SBR2h4(kq|2JWfY^%h+?JuM7Vw1gl(YcJ!nLc+gXl5r{&)z%J2f{By)ydEckm> zeY*g>c=Nj5owR~xScl|MG#Q*Ul&0vnZLo>xImPJ#MykWYQ(N-r} zqSR1U^?lshE#vDklf({ep^M(<_tC$|#rsTv{z-@D`6g@iwsvm~@=iy3q8j4KiKTwU zfgmuzQ#Mh58Q&#(y11NpxzpV0q-uWj(mX4R6LaWG;@|^CRP1sfvvLfW8>)DV&%k6s z-xYOD5B5tdkuH~K8oiJ1{`kbQU;F_P(R05&!i9+n>K@1-ZYLKoeF*|?L-;E~7Xp@Zh6?AeK z%ILs4z{R^ze*o9SJdls!{Lcd|e@48*R&e#S=GA2F8+5o=%h2;@>+FaUXivj6s~fZe zcJaPY@@zFJv=C*moPw(6vwYUXvBbSnP8o;gz0IuZnwf7S5e&+$7uztQtI(gRkVrVq zUPhn%R=hp%OvU%juRfCp+*e#cdpUD8*IJ9_6Bpn>Z7~Ezemk*%S3q{ml7Tc2^fZG3 zLpx#`1ov$#=X_Q8nHql)-B>#9iyLCe8!JHbUo`gye0#p17znyVB!+B-;*c+|D zUuApzOMrb4NyPh?YMK8BR{e{~4Dx#T^_W?1+F+LJ|TSL^750*6wUf4j_A}>F)hJgpJOD}-*5h|&Dl1hf6$Z(z(BeuYkX8^XSh|bk= z=+=mHYU_R!*L&%^!XB}?lRI%={!RSp*EO1snOY9yV&m8o*U13^kFVegXe^NB=m=cX$6CZ?Vz$ySoEhJl1ZWcN9)W+l|c!^-*1I(wR@;gV?7g-5CF25c_{zEAkO| zEA|lG<~oHMZrLZ!AVPs0QjRO)rt&ju=_&HoBjwnHpHGU8_Xe0VY!@Hd9*voFULu`! zfvz)Ev2iU6P<0a%_EtMS@sTkhy?bOqPUVmN87@NETV(vIyxg-lmYx`3RS;(-&~pga z2P$E=;-fu3MEJ@xB`zWOQ`tY30>}dg7fqB{i_n4cUI0U!M;4kGBEbaPwCOS)7(+)5 zvEdT>Tu`vH9u(zK~y-^NQ7la_H7&G`c*$zhh+7q6jaD04YW-b+oD8|B#LizdDjhQ*HuaihX zgfA5gy)m8uN>?z=!3eR$^Bm{<%KVBVnz^QOD6(YFOYB!X(+DyuoF-{YsmasEC^Q+4h(Ae?iQilRp)XS zsvgmH>lDKd{?r=$paYOH%;9tjyRmD0+NrHpa9e=b`}wt8VpWc{%BwG@(5o-sj6KRy zC2gOv^aw|Dpz7$sf?B#?Z8a;$ZE0J%M?kCQ0*W)Rvw>6WjUQCKi3mM1QD%h)XGqQ; zve6o5%6XOxZ}_F?O5)NbWZT-^XG1)Fdg1(?*O6%Qc((6+yYoS2blXy6L>e=S19^5Ajr0;X@V%W&mYDQ{bC)Iq^zy*9 z?pHWs#CDaBQ@w!e^)Gru3I8uo$3H(KTnBcp2+kpmHpc zYFL8+Wi#+rd5%3lELEX!_rV5*7};{%X)*EYFq^F% zE69Ev*N;0z-EA@EH31uMQ9YL|zJ%F!!;gbX;3+)ce&@Y1^baNVToJmptJ_4W4sZaI zIuM=Vsrdt@3!vV`!p981hluEv-~m^utwaA4j*Wd1>w`KH%cn1-+TqN*EBmdXnK2xWhaseSuGq8ZRqW`~BCRhxr zm_N+zLL(@(QNBxzQgnt>B37$`r|G{)_UbO-l%H!TF|hAk6~}KYfDbN=>M6K4+?V6?e%e=FE2O-;JJ%dJRCGG zCkIv>)%QiRm^n_cvX{OXp=9Y*=8{FgCIq>vl!K5iY=%F3QL`n+PoY;`o*1QVoXq)F zCt)f2LVD8F68Sg?bh#9?^W7@bVWJjuk0XrB(94_1wx&O#|9i+=(DQ&zV6|b1EhoD_k5@ zbfG4oOyjr{F}DZLSS}v?vj5nv`fqONpMN`e{Tvxy5H+(Ez4u0zMRi?ysE3sIqx%Wf zXmd|z<8k4$ovnmCcImJCKn8YOh=c2AkLTeD-JMIbPZ=Su1KCuc8O&lm^CFyF9|a-~Z5P zj`l?I7=J4c4-P;#fqUPm)Zn*H2@_4|v)>5Z+WT@p<7mu-eDq-%^|h|jYg{!IST2ys z*Z63nmh=At@Sex$zj93NlX}-8fiVS5X3>rZ6JIyqLe{h6_~}z&-az^t4-0>kBDCdV z&F58){1O?>n+E)a60~4#VUmQ1@zVs8Mda68Pq8zd)qGo+g&^~KOmN|tE)b6WVQdii z=rP3826OJIr$X-M?hg^d39MOr2yhWZTaiz7;?j6J$e+5)?L&@u}l-Qle2=eRr z&W!Z4M+|R_h|CJ^{t-k0Tv#k5wHmYF{ z;(@lXdP~z&L!6vJH+VQ}I^PWK?472#E!top1@MPq^+65QT(}Ew#4OQAqy1(hMh%X< zMpKRS$iSgHd$=YR?)cToDTmv~lK@WnEcYDt0-KXM@Ct&V6^en&X+^Dz&ynZ%CL|cc{sz5@ANw6WN`H_^De^fGp)Tnd3AN)U+yh$#-z{C$ki-C}{VU^VfEM7qB# zZ3;d{o4AL@BubQ403kkn4=`%^drQg%TyRUv<^2<%{}+CJG}eJcWwLSx*7vM>Imu86 z?x=AUugn)S^yh`)I-rssVL$0hJ)3k~DKC_9C8QZg=No0hYff8bLM3b7YeVFR<}km0 z4`U!&=%JSrTqU#lGKM-Tc;gE^h6G)EjO}Sd!YUr1BJd4se-6LlxrO=Z(-UN?QC?XS z7aNY@ql;+pOhb!qP9M*}f9doAiNux4N?BHwCGLFH`5Tm zhS7^y7_Wa1d5an z^dwTBuLC|$3q+0f7q6&wpfL$tZ2;xv1cO;-Y~)o>qSrQ%y27UmAQS2(V!$V`K!FjG z-WvCNj82j>d}P@<{$8;h4BXH}?e_$#B;RQwRyr(k5CnZE3K)zde%VJ+6CMiV-JQ`J zBKm1`-|=MF@(v#pUbn1A-UTV29%?KnI-PVM*AyvMm)u=&T?mS8e19-tOVUc{;8Z{n z;2hrE{W(bs-mt&~7{~E~_Lrf|bOay!E>Ybr1|Gmvg~v&maWr6O|MCdLbpC3He*slW zB?4BMe3l(_fL!SiGI%BRA6!rV$6fxjg_=*J=n#~wQ{CV*GW+lcQbe^bpbq_s;__2( zIv5kLCxa7FmeH#>=EzD8sa~hWZH9`Lo(_EZbh3?4F|If?(jHr` zQ-U|1^R5K%H~vg8+&IeuFQX!iiA*X)&lxbQ`N!&-5C5>67yg^wJY1YOp9xowfm`+$ zzo!2IH~;c>_IiwO`&MSwIxJD^4DlKA1}+iXN6rsgsrQi{HBYA&Uh4-le|eLV^qnYJ zDYaFt@Hmg0{-Zv+gd7vwcdQ4v??gn@b@ifVDxH?j$7{IvmuknxV&b={w_@zNDwo~2 zHVVAlm;W&$A$$(knR}e>AMD{3kgg3O$X)1m=W`F2?KcxX?`WB&uI_Mq|Q^?U^U~;tji8DD9lRk<^ z&~iBg2R&Hk{pQNoqnM!>d+{R@JHK*5Uyr+@OoW6(G;EJ8!JNVdRwjtx7U~RNXZw{a z=be!6rJu!&Coq7D;5&W^Hzmp5?ulmmJwTyC0{`A-Yqa$PM2FyaB}g810faVLD#J?t zYvDemYsFnZxQbuT^GzJO^z}NqpFNEWlG-UA&Q$P7XVEfGUw?8f`_8kP&sgAFF81lO z1qk&zk~WXtjBSM0R|(^9g%ZOgFYD#fY%afVCVM6{hFU%d+;N_2z%J)OFWxcGcwI3y zeFSW;A|!^R0}?0o>84F)+e!#;*0HO6INZ^~q^R#o4^<>(+^oWY1KkRvaSgax74sy! z`G1tB|Ao7R9>G0>&i9sA7io0)`l61dq@EV1YlzVL)>IB-j3zU+mRLzd@RV7uV;bUU zDA+glrQS|i$i+Uqg?V9E*3cobP^M0k-`eiEg-c#5Q82Vvn~prD=cqy-Ic zK8BTiXRMQ`5!tyyEC2^43e-mNytRQBs&#d5IZXihfTD=fm9DFV=F0l)8Sk!FO+V z@W(0FkF_3FkblOBeatw+hDO5AvSKnkC%)m6*jEOu<%x~LIG5(=%12i*igua8EKR_= zfsv{q6UPQ8X5ZB$1fg+#8s48xjXFDTWqQ@yunwL|@$^9faW(^Gjr#Ua6Tv@s zVgB7~VL$lw5oPf)jqvl{6voyvh+vkX8^>aQNE@JqGJXyt zf}>Oe%2QzDr`vg_&LC{>isO+z-n?&|;i1MA@Yq z^;jDlRReAA`y{qfzG{CPy*K)Vu2cY`kW!eC@_@-dak7ff0DUl?YvMCE-#H&2PCVp!OJPWd5_N_b*56A8mlYzIdYpzE{rb zm7uMSScc@G4lD7INu~ZFI4h}!wzFvln;s$b7VROne5+#0B>(Kmi8_f!K;B)Zch*so z3I;K~zZMLMKIn3TUyHoC7jbWPjBMXtXKLvsek6@PO|c$ssyqfUD+r#txPD)|r=1>V z?L!jxd>xnO^JzxJ9HOC+nI(+AU3p{*-U~%d48aN>HG%;wqDdS3IQhL<0y6=3cOMUd z4D0KcMn@ZCJRc*Gd7ps$!FO<2#PfS~Oa>bGovO{8k3X>E-kiX|tY%-l{#}Qpo}hEE zkE6#{?jdgv{X|(QMfe5-)cxJ5iMv+plyMZ5NW{84_@(+TrWWL0Gtv~|VUNpDm^vk+ z5xWYzO=OhsrI3G5g6$#_p^R>_vC<=Jsz7-J^c?F7c!&yp1Y0k;jBZ0dl25Nc(Yp}z&oIG+u zI*RW}L*Z0qG(V5ivZ*M;GLScU=4w+ypDb$(x_LRcFrj4r^maD{$aZ zA~t)l`4rY+#_%E{nNpdx5U^wIidoNsH*KeNR>&4Ok)VMm18iw@kDkEp|Aa@n%f;jwfPQG?)5i2P6rNKSRHG=i>m$ zZ$zca(R_}sEoAi=*D>k1e|A4aKB*u1z`^0LztYZRb+9sgaNX|QNnf(w*DOQfn$}F~ z=OgAWO~cc@#j|uvb56q_4}Yt`dE^ToXF^+C*;FQEQNBL0Wwbz95I!abMR(&z%xaj)AH-WKOOoRc;(jT>!y=fqvrETqF;S8<-C_)_-=>ZWZ9BuT*=Df1Zy_niP>e1> zR5%aT3J&eyYY;@+R5PPxHW%>RmYGX0eE->nkR0#X99@YKD9Pu6=lkJKDzooKUsRJ5 zv+>6@HHZg!ql6~44gwMBS{TN~W1#;}64%5;ek38RlMad4=r7GC>@6?L;?bOO>)tjg zye1lIj4zc5KEp0NEpNK0udAE>xDv(5J%L?bCL_on@jK*wQWm_heL2!%sEh|fwGKVG z?-w-_l)S9L4+V802Wn|+Y^aBk>wPuX+_d)6>Y?d*g;ab6EOo(+n zd3Yb{`Oq^@mz2@HtnrlK*L$-R@Gnf-*DD1xU29&t6V=1taBqXX;q19XlgtX&|11#PxL?PzkmC- zuLo3J*2|c)yGC$KJl~AyD#653dTsM%K{zY-o z_mvrbMLHkCKtNCIi;Tf83NcqAyb0r9#2{ERrO_XZ7y+-?TxzxKtg>w@5^yO>#J9A6K&1m!g?}qxgw{Cxu0m z9{dTIuobE+y+l|zAt0&Z%r8lo=Ful{dHn_N%P6Z6M3g2UzH#OYKAWvZJQgNM^d@m= zNR#3+G>3-o56=%neUpWP>F;&9b5UpFVG(BZMxmp*<>V(#x?)(Vn3%&Jh=;SRvM4~1?OKEJ#vCf_ zhOx4~w)WKxcH1!_|JS_-ygymhCk=((YqWfO?C?A21j+?>6(?ylTKPx??zGq_$qj5T z5B4K?LNbNHbGT6RYQ(sl=BHbk9O?Uyt~KaB)N8i;lB5N7t{AN46E^Jf(8TWBdy@J} z06#bB(*}u)<*>%JGO@?@9nN~sgJP)t7Q7g$^XcC&1mhR?iPZHOZW1^Ve3g6}s0-S8 z^MchsFFT;YhcB#~lU(z zVO7hR|0cz&fX-uKf%ZFfy=J^)&1@U{Q>J&$nLZX)%tmw*k(=SOgp%Vmaq7GDwK+Fr znM2U<7Y%B7G?N4&riQbH84%(|R$3;I=T6Mv{Z<)MT)xRPesq2d8)h6&HoY)4G>B|V zDG$*)$Ov0KiXv5Z@3wf+MrCN#B-vP71-=@&$S~_}?QlA-O-d7SGY@;MY4W+}GW}NPG6}vM=3Z|QUsjYb*tQy> zOjMgrsQV?n2>Zk(H}A(I;p7>6l;lvSDx&0xG_trL(f4zD%cU*e?9U!nr+hA-2nGv|)+7Fj5VF|CRJL>!D4+$8=!ZNxJmC;5o0 zRebK==KMK^AfHT*yauRC|9aH42WB=bHeT&)#vjD`66fLoVNLk{G zY}hlUI9t^K#I4?Mdp;s*4^V9-s-C7^U~PrsiG&7tNb&ARsd7S(@cNv#e>Pnq7+w+m zNtzh+ghsW=PNL;1H6{ZHWTAD^MQp$)^>by4u!9g|d(E3UA8q*orKTBxrV zVi+sX?oj0r)}Th2H=f!9%sw$2)w;x|u5c%pidV0i-<7wd$KHXUUFbkORNO;?c4N${ zDfN~D&z*1GEcd6E=YuXl@lm1p@DugJBOj8B`&=Dwd2SQ6`JOWj z2oJFXIme0MI;~ZJ*1hUIjRg{dhu~a;B=5|=*XkUGey{Rj`iaHcLuA!d!JsAuVBmf? zVB{Nb3ve@~xcC0C8Y2A34xQ)!VDR!wI6uDy4@^f^?JHiwV`BsLhk-3S;hIi#f{!Cq zlgQllB7Pkru@unf-60y9r$5PKW?DhzR)f^D?}2bXNeOtLH{1vwz1san?k>#ac`*<8 z9JZL`0_$>PT-E7+>uHBivA3DDd>&FDpMXy1Ls-n!U%{KY8Yj4sq)Q&QFB!MxoOD8a zC^0V3H1(lOjS_K05v*-{O6b}zLE1L-83NQCfnoXlVUB$FX7YOI^Y;>JvJzlTus$xI z0WL!7j=?xP;N?No0^+k>X5^I<0S704jGldM=ZSi-RzXu;1$JU3=@JD`=I>ju4#-6S zu%l1P_tRui2nG$z01gF;zmf$18<7AtgC{S}=?8Z5&y#FWT^XJILODiW0f`$F>2~}3 zuxjb+t4qUKZ|L4yc78_<>vBf~18ZlE%YH-{ofn#_*!sXX^+mday5SZ_rw3i`L{Z6I zn>-hWT&g}8tEL&u?0PeM7IomL(`Hkd-CL7+qvU-TvhU;LN5L7?q#Bs>7+#=(oBVjO z&{TeJrvO&~9@6D%d<%I8f2qkfDp*a$#L5XWpljMs+TVnhm8Fp>Uxz?g!DvBLQ4K{WDj++`JNKvFR7X+*1# z;G)?lT7bc$Wm`2t4tJE zR};1nrPGuL%srFxY;OeLF(ts}jn)>5?t>4SGx4o9+9X(9TW_Ej`w2mAjO=sdWC~dT z?*ACZ7i?8F^!^5TLF#*Ja|W2AkJy-snqQolGU*%ji-NAP!W)?m)X7i{bfzp(dcZY^ zI)e5TV9p8!aTITkzC?g)P5{Ihw2UJF!~vI})TV1OGYs);&t{3?A3^IszfcT@KT)lk z20hZ~1X}>Z7XjXyowG4ARqRq;%qfDS=j8Jp;v%T~*=lNWCS*Mw zW!qbO+&T3qg}e6><~_)ng5~A$fTEiDgXfT!rv_`N5Z*fp0l}Fckfs6&mNu?L35jn% z8B+ztZ!FfNk`^Wc{K$WJr)gA5Y_lbfBZI&vdkg?kr-E5&if( z@;gC&BE9g3Far+IzH0BEdS8gVR);zKo)7?^=PH2?J6f?_sIPx%G?)2ywF6E@YtMan z7tW3DZdbe}d?BpE($6388>lA>zI z#%bHxdx=!PtYJKVi-%kxl0AnwF)Idpz(yKze0ISvy%f{w^eH_=*XMn-F<$|B#AB5xLKz=|J`bU01zU+4H#2=5rHVZ7uz}kls9fMk!3_{3jJ7Sjb21faU@$WR%;@+SXf`<#wKEZFG-;8H)Vs1W{ZTTxa{r4*IuL;LLH_a{J z7@=L|fh{zlR7Kw{r;-c_ow+!ZWfMIMS9mH%EBA#OoD;slA19?F7wTNo&IUm5!nc?| zGDB|nQg>Ubm}+fjO&4Tg1w>ekc_bDk z__%UsTLq(<(0qYYJd;zDUS%l{@iD4U%-w};K6E-~rnSO= z#bM<)ZY%tF3OH7!L#k1(9`U`W7k0}Io9N5)e!CY$`~?`EvJ?8*&WfwO;3E1a z7*qW<{wrI;#I?rqJKz+^?E|bWKkt6%!d>4(zxw|rzC55QW+|yM^>~pXCZNBBb|j#O zgJoXqIO~nj-&dT@QFVQF-Z|~I$&lzJsM>RJsJ^%Dbv+T&6#g@{H|+9wLP7BIK*)Ae zCog=gSm=91_m{&$fNvZx;_k$q)i|u$YFZy5p_W;ZGK%)q4v(968AV-vPdJZS&kI-8 zK8>Xdc%l#=*iOBmE!!#yj8SiK>uW+y#XHQE?mqsmU>rv8*u-k#<+;+k7@_QG%B_7K zRlmZGH~H;2<2+RDMW6~8Bh2|IMAk;GbwV77&xRqCY-u3a&fZCB-Yt20pVfjw7WKH1 zuYi3Jv^{L3&Fr#!7m?;XBT(*jgYL~;AcFMh*IcgqTQ1fxT9QTZFq+0J{G&LDbtmZq81{}6|dN?=Zv`vUkCGb zgw%~b3&M?II$}(&o?U%IbVUo)>m~8X+bF;G?5|X&i{W$1W6~Pm*w86?6UNW&QpA7I zN5yVE&2Peg8tzR^=-~Zkc*Zd{cQGqFucU2~-7#mn&1P{yF3i>!_)R5i|p+D zD1(rv<5xk|c4%7iQ%erv>4-`n6Fn<JCZXHEgOY~+ZbOmh0w>VmF$x?-?92~{ z%e%~d_w^CPQ_xd>m7b4?)~|&Lb;+20m`|d1;qz4*`LG-T;u}&VMY3O6*M-9W3ls(a zBtmUn%)WZp@yA)(J&6Ci7k~@K?*IoX035P+hokLYAo>9&V0T5$<3&M}`>V{Dq$YP2 ziV^L7lQFAm%UtKWaE!TkFt`QXx2VgXBU)tU{#a8Y&tMN|-reTZZ#P-~asDDi;E2a% z{ztj3?>VDNgIT9ss>vZ~q(j-1F$rOxj$W;1>+~b;=?ug(HSA?d`%=0>3m*ZJ2ZnnK zCYE2%x4ne(DnupDD!ZP)z;0}P&S#6e_8sx0Wg?N(y&%r>%#^EdPVylGhe?n9+7sup z8Be~-g-?N-7a2;aMxBAIXG^5=QZ!$M|3bB)Gb4|gHtJd56x`_94f&}W;tgF7L3d9N z)R^L*)lfkJmQn4Ffj(G>w?3<>DdIi~B`cTzZ{bsbxa)c_l-55I)IZTuhLP$9U+-ZQnDqL3BjeFr;EUcFH{3OtR!$MEUj^d~t^Kv;f2Z z8WZYPa#)*;@!7EGy@9yGR zL7zqh-qddFg`imPp-pHrJ%%6AhRBa!7T>xED*DQ z`tWr265FS^URpzJUxoF-l($Ds+Nk%n=(|lD`pzH-dV|8 zmm^K1RgQJBNaoC~Y+W0_dqtyOpo-_Xol!bp#tBRI)hG@R;{n7E zc{cc3VZg(|wedMr&$0#0G(N7oEu;_VW}d z4HNHZogRc=w@X62sB@Wf1zEJo{i|IJ_1Abka*BI+i`KHTJJ-Fgt8?C19(e8y&Wo8XCn&mk8N{DbHHEm*sk6t8*^RHwKzVt>mj9)iK_D1Hataj zN>0crMI7MWbxML{1Ct;hte0e77fR|LheL~Egi6<|9~q6hw|m3uJkHH3(-aF44X?6Uy;!WO?*!XU=3)g`oADP+#!G9>NAh|qPK6ub(y#ib>rAJh zfOX&xtv{nJ7t*?tRJX1@jPqFP07lOX*H_zWmFHW0-(Vltu1|aTY!8&$cpT&s1&4-h zKrNHC;z>x%wL$kv(fTOCVR#Izm|#__bxc2VW%LzV2u=KeJLLx1U+#?p7P`-A1uuiB z#Dz|y=sM;CAWK?HZh{skd9UKGQ#Z>8YE?%oIlL}OF1g;_^H{IS+PQ{BY0*wt6qkP7 zTaT}NMc7b(wq~w>6pc;EgJODn!n!{9wZkG<_0WsW_d4XVg>}R8F(?0W&!uRHz!r~r z6Y}ak9rxrrq`Xg-$&9<5U&`}s+N)2eK)80ak=UEo$voe;aLImGFu-NB#y!76W0 zuwFI%?g5fpc5Yc#PR*Xv!Si*)WY5q&;B62Z!!a{dFC@5)Hu5_10T?yIG$#9x>(u^4 zroEH~ozkotF537|;avck5p7iavipBlkS=p}yh&z2j;Q?X%-07awoArXfhf%la#v#F z2TeL{Plb42O@ef_inl48s0@qc>6D}xc1ma4D35hezgR?q^c9;YveXWK9IalEVl5+SotvzjQj@A&YsRM zb*P(Mze@1BLh&dQ-Ksoi0ed$Jh_O7PPwJJvdpx^UFDlQwD-Qe!o5V)Ge4hd~5U1C% ztW8eDwD+`}leL^$iA}&Rp8AcQ$FH}BMjFAc4-(?#0R^GYNLV~ld?O}R-LZa6{@CGx ztewr^=}jX%@k4n$wR${eq7#!3dET(z;I26PQxX!!S%Ty>I4`l;?bRAneW4;Q&k+N23JE=J1LK{ApkUkx;L;D~N;JcugXp`;l9zL4q`%ZqI_f=a+ey;(lJYt%#`mNV+Q9Pb5| zWgO$DBh@;RIiSQ@U1cB*zt5FRID#6j-4`*PZ$Pm9!RZwl%soBo2o?wN^|AiMIxwzf zY!`u7#ewPzJBWXlM;?n^Cs*-p*CsPTWB6saIUmz zeC?Y@%I~c8bfp2wXh4p;&@Qnzo)K7(z&t`A$J2IERP5Y7w#CPbs@h?=)tj{ETh%ZH zHEX^;NG>=4;wG|*{*Pbz3R+z#?_Df(bh>9=%x_Uhuqr_Dy~V%(JD;VNwYom;0ZtXI7~i3eTbi?vQO z#fL1f3mV3?R5m=7UTs`4686IVWq> z1*O#osM_s22BY2C16pW8l`ZnkzKMOJ1(r=lo;q>7O4byCDg{`cB%_TliHJ((DR({Z z2n|O1U{^Ghf#5~)Gns6Cjs)KD76rJ|?4@x1cAZ<-7xO&g3jLbmvjCy<4UWs$g}2w_ zwGRPxu}nVq*NL%z%1Hm^--Y4kaPAC)c+g*befLrfP~x&`f=nrF0v>jb#`|y42S7Zd z?>u-S^-3eNJQ`~wE!8DmK7L`vz>|VCYiI2J_i+B8$6n3tQ-%QYD2jM`38emP^;}7o zTmX^GF!N)jN8_NH!%CzD!rQ~_iRKky>$U3R>GOpwAsx#EUYJs9PuP^#neuv~`(7sd z{E%vVWr6^Sip6ElAy}7!Q2DEq@$hLx0r7cf7pr>OkFH2yOR<&TcyY~p8q1qkd1N+b z*2QcY1bpJ#KX&{$>5F%a=whiI4Cz&7y9Q<8hoaog>dr@d&G<0sC>E`aFHX}gk|7wY z!q!_C&EfKqBQJx<+@sxu4nh-GYxAik$s9^*vMHUn=YL9)6*b!88?0NF4P-JomkRNn z=svwX7}(frg7LgC?r|UC7IHta*%bDI#tY5MZVF%bGaflqeel$sjf}M}nxDzIHI23( z#X2yeN~GzL?i#~0$8gEz{dx0?vb=y?n%odJ(#pk-ULL&{fQ)C*ceRU*o9wUv+#{j= zZt?T+cn*`0jnd;fG)7?7n`%)umUh&HJYjWAwfqieNsY>eBmU|KH}j`6j}dz?>P{QKy(Gwr?yJkmT1?+j+?3V6sgZ#s!;h==6faH0rM@on%1VuMg! z%X;^oh1ku=9=w@aN}t5-l^Fc+X=CNI-`V$$T?M(&>(%mo`yuP5)9JJI4(z)67*8A4 zed}U%=Y3`aqmExRJ!FC%@M&2V{E+|fsQvZ%GX(9{UR67@NCYEx2zky?n+|x;jTN@}rkn69TRn}$` zSCV|Z@$+wm%<~HU`6D;ky^g1j;lO;p-Ic`kXfSUJWKxgg8CI|kfe^2-tgujNtA3m8 z{NmVvC3JTjW%^o;VygN$^j<};yNv5&SO=1(sAm?xIE)Q>`@GH)uhr%RTQ~Lho9w&}$6wZQPN+j1NZgiU zOh)DRjZc*x6rU7gw zi*!*JYW|~PO+$PS<}Ym>bcvJ$X$suY@h&;VnBCakHn%Z^&@lrZzh##H?s`HTyN7(y zIIio8c%k1&nY@F{7TZpF*TNq@JlXp;tPuHpRu5mQ9WFnVv!j*hRts769VLxaC~OL<>J1izQR8+EIDhVgsA zhXI9N^A*q&t&KSKHnw?r>VdJ+)f-3m8}2T`rSS4n!|J0;qz@d&b)puQpF8-0bJcD;KN2sRH@_kBQbY&%$|j_ z@d6z`A<`x7yvq1s+&n+?{`t%}%In_FOtC0KeEAd;&Pr6sMC*$1^$+fu&VspWG0XgN`-9dK^7H zoq9^UT!6~n-hKDg+!?ml4w9*bMTEoQY3n0#?indvvNHUOCsdui1oy|GWcSj5UqH&# zFV>pAErBMq6`fZIwIMK4x8i8*mruC4yI==MnDTnF#!l~Rb{hB3EKvj&YLBOjWxIC@ z=9(6M1+udNi)aPgYb5L?i+b?haI_$ClwQ-SG?>F${QOxBtPN}xqsQhyNs{fi+6PXt z%>GEjy{O09aS~F@eNAoBcO2SE(V`k6QyzGIv1;z-0ZkN)pJ;&OjcG2;z*`3`Bp=V3 z?m0=#9DC-Ja#k=C)F#mP$D;?a??X6>_36I+Qh(Xajp8RTtaI(g?p*ub(QLS_7!l%w zuWr)7%f3O!H(^b(x5b^}v|m0uprByuy9Yo`c@D6xbBtMa_G%+_aw#8Oepcf3>qFaW z;>W{bub0=Jae|iq#d$i{o<&_di7Tj_=e!0>A8_XZkeD%Qy>qPj&K$1tK@MH&w~s*qrRkPG3-VkCmqk@_j-h`8DvVbGd~<{ zrnK~r7foWcyd{^1>O6=ID>~!rn*p4hbE`imohunT?%dT^e)ni6 zN_Xw+XA_%Kvu?|?xQC-6i7nW(Ix2J1M#Wo&} znQwc%YvZ|khds%Pgo;%FAs>Ca0^9umSbOWJD%5t}Tj>U+B_@iBg0yslfI)XiNq2XH zfHVq%NQ2a*yIVrKySqbrQsEP<=A`uvmC6&7|!|B9oO}{oh+0uV(iFi z47QPpLq5+q%#7sE+2rK8A39E3$6-xqBl4_WF?(Jsvsf>_IzLP*h#n=JoEU8-!%Ets z#vAm4e7Hv>|G)KVaKUjX5Gwfxq2n*#JG#f}cRTZSa?zb=3=JsNnl6~##uiIE*L)?G z)Gm2G9`A<&(7a5_Uk@&X`Gc}5NZ@vk%Qpka_NuoiRV(-7QuAHgQ+PTu;>^A{hHr>@ z_VJx=2r$z9{B+RMu;n!EG}JRlerAw*tdQHVmA@N6W?Ao?`$Dz&r^QB{oaOm>O2AqD z0$P!F&zz#;Z0xxhS;*HR&>fVT=f|m5Vg;jg<$EP@JYx% zA%gUn@VrGcm}93g@e4K5hneZY^Cgj1?3UYn!MT-MYTVV-@U5s4mh%EdjV=I7h_e zb%ycT6zf_ptr*2SsE7|9fQd8$U$0Jh8iTu($HDz&-s&dytOB(4ChS`Rs#4viMl?mw zX9Jv7-#az!DVm|)t()?uELd|tolwV7Y?=WVym`&F>uDTLrE5;s4cX4?a4?n|7HeJW zQH0?kY^rthfNsH|1~(fhxF=MIjJ26B&p^}nz3pYf_(I8F67K0u+jGH6h<+2|;eMVu zJWhk0Mpxxi<7J87tvhdA>iA3@zr{+ibaS=mxy6A}$FNG~g25+2bLLwX?7qtP=4dJ; zdINQZKL#AWx4KJ$8zVU}_|0zAJ#m(``tCy-_4W0U?)>gBJLlt(u>||oz>0TQV_Kf( zepd$5ZZ!k<#L1t|RNJ%WlMLJtYh5bec&PqJIJ)@NNmpRj-V^Rwd*EOD+h#THV|)_} zUy4_~M6&b0jd1^Gu=k%vh6)ei-G%+ZZ#Ewg>=DZl`RwxW1gkwNE!Yo?k=es2-NUvU z<~&#qXB=1JZN<94G)YV3UT9mGd7Y1&VO%1Q%Td(_?&%w_JtE~51aC&CZo2P1CVtJh zV3+@DO`ZrXd6VH6@uu|9x2 zi?-y*)O_}-onXjY%k~1yhFqCX(&tx@u|tK?mm$_Q89^ zPC017mlaIlO~<-V80nx?1aO_DmwrmPH3BfxYtB2kGC-_oJ0E?$e>-LORxIx!w115$ zFsua1?t!LF*jqC=hgp=hHb7J2`v7Q&;Jc`5jPK+u``e^%xPI67JkBfgEA?F<_rQ=+ z_lz?yAH~J8c$&cDSWdAB%8L%h#>Up8l-A2SgEh*QTYZUq>WOYPweIy`I%pRdQlp#1 zsIp(?5Zur{p_>RolY`!X8BLdsC(egG6+4$5pKCTM$gzw2dQfk6Yqu;^e=Iulmd`kl zO}HIG3}y&zu8ujfvpl&nx(uEtGm@E5zWM{_s-if&=2pY_iau6AyS_!|U}DE(WPH7qGb-2AX)QFZ`#G6o(gw`V})QU_!Zl zvcO_TTB-bw#7zE$Ic7s@7%uX7>Zr+=t-; z`MF02XG_u@qQn|zNw{SE5@52C@Wr%UvZpK{erxT7^^AGf2Rr1lZN;#2@N7vk4P~Fi zX40$|NF+FPX;8KJ8=91(o_m~~pW)*g++TD(t7N>xmkc}%s0#}q%_M@SnZUx}H2$$v zaG&<+i=gMAHyLD#nHftb5fA}kKg3+lKRllwzyVz}{@om}EpCtu5cbE_Oqt}+gO&-$ zm?!R*NI`MBe%0lU<&Z*0;szDu{cwr0G+n$_u~VR>2^cH*1^d|Y(czg=!^%qe)NWzl zn2N6bmAakQ#q_1F6X^0x;o^MvwjZN-Of9x;u+}|S;(4`&J!xD&0u!gO|9G@LF~rZ| zN%O5i-#0uhoJ;P3iyr^uGcZ}IlLkgFu;Kw?GmAyu@IQ&o0^pCNt#bEEzQ1F$Ms@ER zal9nyeac~9l&cRzWZZVBq+2N>&J{JQlBym^N-5oYYlf*`DtL{V!$J6HnNTdgT?4`~nzKK17o z&5*o`BUDa9tm_fZtjXHHT8YU}acm1wUWuVeTC^CGrOrxVKPH^w8?k#ocjM)|+;DSM zpb-w4n=@ktWy3A~fmBhOsU63T9axgHSz!|je46FtT1Ifr#KnZ67*z(U>2lKLGK~$8 z`Aj$;Qd1{`2Xo?_bcl~)y^n{H)nZRF$>f9B^2z1$+VDLvU<2Lede1ZI4JW>)(r!sH zs4=DuritU$w4tqMO7++!b0CWCJAeqa$TsHcz{YvKDZs35V&^l(dd2hyOfXQvbf+F9 z2y$X!(=!!)61)dzy0ocUGx_Ib9+gXe&*ird*TJwBHP74#Oa>C_nw{_W8ZE270<|h7 zHulU4DBXNkR8ke4y_rYkTE-h1po}%xe#a>Fd3UB}YR>yJwdaHQus!OpB%`(b-5XAg z@MeNMA-tI&yybj_v|ok}(W4kkr3Jb(^M?xJFyIx7O>U%E;#dEdBCRA50aiI&34ez5 z!3Ek-4db4$iI^Ypd;y9@ZgtTcbU&)xD50t(zM6`aXWwUuvd#`bmHtzV^HD9Ph)4 z_23(t@rJIDi*SzF#=^e*o4P%&xnkXGG1i-}7eaU4s{#*s|3v0Q370wbX)q5RAqDLT zYOPB=6DjJ&;8aW|(5XYXO00XZ>_(^*KD?V4OvIMWdBN%oDkFLai=s;Xyso1(zlT4f zhh_0oceDzfn~R9}lDi*$wmH)YfQu{5LJAtL-$pZ9771HZk9)#4-b}tJeS(LEtZ!~a zQQaz)CUrJZtTA@az;bCrP{3h3&!#1mg9|nXdK-4gN3J{g9W+Z1?$zG&kW9R+1?BGc ziq-R9eQMs(8$mAMiRg&uO6qz^Sl|gB74}FtKsbzl^L0)8r{(rpmmG=s{ZhA_zSBut zX|D6-NQF;xt-VPOlN&7d-!bM&R^T-nsS1Y@?b%vq7SmBP&@^i*H?5wDx;nUx8$oh= z`cfCBz{6_2I0U1=v&OSD%ZE=BQjuyCc|qUVYG=*Hb$!;(^J^nB;c1=gsZI0+Pk&Cb zQtP@wgR|RV4~I?bSLML-h(=H?9{o&s4dywRpu%D_tr?8A={dUE$SloHzq?Sn?F+>+ zS*Kz_*d=f{_wSI_f*~TiAjFJJf@El%mGE|7ih@e%hx#myor4Y{k0#`X7!8WMSM22$ zC3=HDGF$CtIB*X`(Lgmbru%vsf5JXy!3I>lj54RXV*$ta)8)co7rEvyD?J zKvZq~u(AB&7~Ws?jqH0AwD z^3Xe)yLZvZ=L`_#1oytIl!Qqqk0Kv6kx?>PdAWI(Na}-eTn?|c40;ax8mRVa4;c;5 z)l3VX@a*nW6LuG*>aJ=CT;3z-2md9!jOPlk<}9b6{tK8eFvc%%@N?-1@l(R~;lWbU zmvDhZ{Uk6%yn+0OCmq4z+1XO~F=8Zs(1hHVG9Us*qW1kyW61yfhk^lc5pY1Q5)q+L zvPCkmoQ4rnglY(+;kRjqv{+*DXg6{f1N~Jt-i9EZo#kNfe#TUlGs(l_^q6be#MqBr2^YTvllv2$%i*>uZY(&4BI)KJs>8;syXzLa5EcKAl`M4Co$4mi}<~mkLU?Huf zc@J*l-;oK9I8%@Mcv;^#Od4m|?M$)_d0%Jg#_zBiIC1xf^Y@XS`g1_6&Q=(uF+$Bz zLJL8(KiivR69jHb>jsV*Fz4XClDawD-1WUl*;%{jIsHmHhno>nF~Pl{8OiQ;N_Ul- z?t+D>E&J|@huc+SnkOQ}^Y_4b<&~8!!G?6eb<|u(TM<}2U2_fZaIUvn;IQd$LhXuK zjU$nHrUXb8t}luk@osHB?bNsCK0K97^ng0%Gi~Gd!O%iVk5a#W@-d*X`L~yA{n_4c z+p5YN%8`v4>0PHekDSTVvr0p23UmclkSnxU_PL?$fC;gMbM?AP-3dHn9xV~h{6;cq z9%JoXJ|jwaD6oFj98X4bi3jO)EbTNtH%en`L6HC~)_0=J|T&y{lhM^DFI%au%OaW$pc z`Bf35vG*6m&hy@=kI2F-vmk=wAad33$}5k`pUk^1>09lPm*&$~1syno+lb{r5EVw# z9vX?sP>I&U<qH5iU7l8EL{To7Ald%JQI*-SdeJbGon0&tNd*Yddh6ODgnw3 z^7>6xQoguvppt#67m4nvQ;t~Yykl8*Twd>7as$S|MJU3K4qDkD58(O9 zQMde&2t}8htw+1(UcHYSjc9I3fo&)WGleNR`oe?xb`apcTZrk+2pR6Zm7D3YE+lXwB659E3FT<$P2Wk|A&6xi6WV)H+IT z`f*pI#y--Y5}VdvQ@NLSNx3|3{TnlJme;i`SayV70BG)9A6V-I;&DU2DKO~oOGZX3 zcjCR7zBmqPFbo`bvdZI2&}JODsv-GN>Q~? zrgbaP8Gn?xmrpcA(5ys~%$4d-zVypra0HQ zX5&X9o>W2-&3%?*YNnE;#Z7pG7sp>n3+kbe*Jl!lP8i({d;!4)fxtrBaz21S^AE`4BpLd_Lfn*@Vuv5LSe#~cku5G`_E^aMNx z(wgQ9PvR??nbZ1HJ|3c{$)M0lueX&~UVI1?KEy*i^`NdW+HhKbvEr$9-ABB)t{YbB zS@OLJ^y0g6RZH9t+ct&_^^G;lC5ZGzFS#%~nZVOZN_B|#C())HJlfo7W!`!9SF}k& zXT{bmsgdX-tme7tkCapxymmrK~!j_h(E@YbFBwRKhFIUG5O=!;T74SR* zb}&qk`l!WspQ2JYC6h2;!<{=MJ1*Bi8*)xtxi?#*zm-=ZclU~V(%U2Ih2q`1J?~ms zJh!9~3aL66d0@))x^WHmnhx3J;P|JX5ruhaf(E%}88(m&{V6XujTntFZ|Dj7G8zds2xwb3u-)PCYr zJeNkmC96GhYqkxe6lGJnD^LYDIt?DU-q)uKfxDZsKqnuxCa%wjEWM%)$!@(|w{;jc zkVXvo;&2Pzcx+h~I97Sw**~C3jOqh;shZs$_9+F2aUE9*)|)%QVA|f=@BNl=keyMx zX=r5lUV+Orb7pO>Y-zRq?VRcx9KL03!k>=ix;nrR3ESarr!cG+rNN(K7=~zm=5Gs` z0aNDVagLwP@$6Mk(M0W~%thD^%Zg80qL`SQe>F^ueGGBiPvLl_nkX-*Mbypv@lR6W zFYq>nv$+KKL+@&D@X|EPj)`qHby1z+D5N5EV{=TtW&l!C(Eh|Ef@VCYUavcu%+WvF z*8yYYUY-vn3n->`B_ckKFc*K2GuMfB@Axnf1@AH`YLS6v=go0@-HT{Ykm zca{X2T6f7;(v(~uez067*p2S)ty*svwRe$O8nusi+dbMEnwylr?{{Eb^lJn62eLq- zy|dmZ+{>rkyi;E26gZ{GiK0FaCl)LO{s(J%Z~=y}UF|iT`r{6&Omwp&FA7H=E z1UX{fEpxxf>%=*_BRaK!KAh_1(SjY&(aUo)?pT3I%uqV_Mfc|pP}&tAfqo^&4G3>G z0xqsi+i|#-seqon{>1rRmkm7qT4^}ErpqZP{|;~GNpU!rP)P_{w$(lISc+?pv#fi< zSa)XAc5u1PRhS^eIRk zot+O~{>fo}3O~$4=FDTINP~YHWQEZ;&bT8Amv}$+6q13;y|SQZ3h!kHbuowv%TM6W zJGQ@kG1OC{*U+4T=)UX2*cScuehR%(hiJ&lEZJV}3r7}QvpU=eEd2S$&OjF;7!+CwvB&QS-#d3=SEi3N5QFYOYSy^?k9~ z8+ATZXEA8jssR4MD%x7laxi1v;|BgijuR3?>r|R7#5i#KK5Mj4UfkEUXzyw?{2W9> z?vKa5uFD%JnrjvO>D#SwOIoPatR0hd6rW)SlS=YItR3Fn-?nG1D$+tuSK7d=W!{Kt z4E#9(&Ok|FHFxWNXnosFT~5JB4f>6azYbN~X=H*CTx@gH&CAlSEByFbEt3au4=Xx8 zqT{bDg&T4OkIv1zvbc>iwd3+LyKaI){$?7|kq)y(m45E^Ovz)CUf9(USvU^2m1pLm z`}(7+0P8OfKRq2+T^EMTdEWwyKB9rspDf%5_`)5mFdwI)53_;1lqtnk%m~Z7Qtb+Y z6xr`BHj!HLtS|-m{wx~IbIpocSId|7Yn`>;zIzuuGg4yc8?=NPsA^l~kkqiY>$;Lt z(9nyKzNH5=Y|Fp97$d7B3aeUul-HyJl}+BkM{HT_+xa`mIW(q zpMr7{oTkG4dkkQe8YE-yp3O%*UMS=cy89-qg}G3+-Ej3U1fDt^ffoRobD4AW-D@Eg z*xOV6+acENg0a3Nw^SV_n5=|+w7NU0=}Lb=FM^HDXY+9*qwB&48B;I*`l`I&ja7Dj zV4PD1ybHvcbi5gBJ#jSf5Q4hU5*Xif+h@a!+ebH0g`_zbR0t;>i*+%H+~`3n9?l9m z(d%IwD?C5ho#A1sYxX!hgbVAGwKnFmcaDITAffS4MPncW3+;luu8Lf4zc;GkQF)H5 zU(&-K$xm01tDz+j4LU*^v+jFWoW;&sXFtCB?a@V4?&;y3s0>^Bw%0QCIgn8Xf&f@e zFW@2E+UZ9g@H|}7_DeuO==wo0da&8zlaP@VqV^B>J#4mif1>*T#<<0Z(Y0>f5~@jG zK-*>aHPlu5aV-kx4X^J1PVu6wfYV)oGIOtPZWbg#_VpJU#ugUQ6G?85dfvs=4Snu& zJ>GmiH{uSau}9vlR}j#v-k%lXXA$&4r#{K71^iV(IAx`BioI?<7H>6OLxtjozG?y-Pp-a1@ubk-gf#E?=T6_N(pnTS;-3pKHJ}` z#($DLNWzncjHwU##^^ux1R=C{0)TN+3>?V_mTs5e?ZNcm;W4u3(3^q5L0Wox`ji>I ztu3B6z%udkW%VgPi)*y{PPJBw1(5+OdLAPaHt|YxcpRUV)(au$@mxPS93!gDrK zSJMksoQZr>6b7u;{uTTm+HavMG^Nj&7EV53HZniyoON_teeljr`1$#~z5n7n?cf3; zpT7;(c$F=r{Cr#869{_B8~UH73xz~yu($-Cs;8tqUO;OR6S}gOlFguwwr`CJ0?(lXK}3V2nk$?x)T z_q1@k?8{tP{a(V~{^-M#AxYg4(9bRu?Oa|tsGuwp6iL;Ht%glJjskHR{@1h3KbT+~fC5@1!e{q~#5~Fn|7nQyMXRAuUh2aM~Leza=M; zN;~_6hbP_vB(Zb+pJtE1utHJ~H%#wp(}ybof)pNE$hdKWD+hmBq$w%ZS^xt!rxU1_ zi=zHFyYRoer{U`zwkV6r>vI`0PuMI)xSTW3stgt!E%X6fkhFB@!Jyi|da1cI&({4C z+3=ne^w&rp;wFZ;Flkch%)MmN+q-*uuQUsFY5$$B5YfOq2+=w$!d3Aw0*haZ(*IpZ zwBo(A3XWvL1c)HuMy1Uc9R)=gAgJyb03qG2WJ2xVBv@48>u14VN2B53yCovy|0#OF zZQv9#uOXu1m;d%TAHo?h!sgm3w_j1r(4~m*{YX+p0YFYKD1?K1yM)Ezj?x%hf z^|&{B5IIl|{%9IUd;U8D(2QUDK^Q2mQe4TzJx;Y%?$l0VT8_q{xktjSRvi8|| zqvhOb;oE;l-4+i~Y*Q%(GBSazcU$rSKrZ*v-PU=kQS$ zFcOknC z@Zx!Y=d;m_d6B!oZ@lt9=QoBw_p@kZd5cr`a??t9%_^-ZSO#sLnD!OHac3ERR07Iq zn~~Nqq+jOh(g1+xjWvH^w(3HDm%kCwmnZZYf3Qm-wg(INraNLiE<=otsDY=t9+|2fYNeoTqhP z=#u_QCvQEz+7~D4iU3d%npgU`KLrkdNGYhuZ3UOO(ll?#pQP(S@O0f?LxTNwg;SjD za`~T+>+sW+*&|&LKJLdQ%o5J}Zki`3pdLnTHTKThYTdTaZr!Pq2g{7nisj>Z#}BVZ zb&W4m&tBXYp4pF79rm4pv;Cr;lArh!e9A3Ef^!QNh(0r8{=J_0k}7^{$Dh#7_<#dK zi6lvw92j(f9Up0v0fIK1_Co0cWqlbxKMWILj<3IB+E#X#^9%O*RdW=WCAOE|v_=7E zY*JkLcPT>vj!m~G^50Um|N0NflW>fmIY*n@5MGw)FwT)R(q6f|&1aue1X%k^XV(+q z*jS2UA4xQhwA}o%snVAEeDOrrOwXePXUZ& zNG{DfVADIvcFf2#`bTKMK@CJ6ym70`+Cp%?c0 z5sf@l_?I)*{_EPqWjM?3aS=g3O-dWz$XgJAnbcKvcEthWW(~fT3WHyMTZO(V zi-WKM937p5ps72)@l53SO%u*>SUq1Bu4Bu3RYWk++lMo}_r(d$RJVrL^4^V28Y?GT zI+9@-kY?zr)o>hyn)k_c z>!#gf&LU`U2AuADfYW_T`;jG5)un`cvCjAautJICKX|b&86bA4x8}`v9RUa~)A#=c zv997}0}@5bUS7XH*~6dV>I)~+Zm#Fv)!L{q32_HPkFA@{pl!~imw}5XLY=WQ`pB_( z+-qv;xKXX&M)N-1Zzqb;D#}45{WyxBz;u-5{mgkw#J>?iAeP>W<$h@szUH0#$7YPO zoL%VlOC)CpFE-mv0F^QDoIo9~SmK-e`W99Z3-3E?ADTx_56$jx-Et=gh&HH@E{)Vx zB5>}yl(rf-Y2i_X^K&Xy${h-2Sm#|iz80`qj=rl&_rtQ`79MOZ0`F?UrX^oEGOotu*zesgIAS%=UVgdYrsdcPl zCi$$_HtL4I-WGYw;HCmXPb2{Wk{94XH0OS(z6iIDz=E0I;)DO^T)LYN$i`TM-iY5xlzqMBMd-h( zrWN2aMao&IA#&dQr02y3|1vf@%OzS|HjOJur{Wl4)avL^`7t3US83S#$DQBn8~xlR zFYiBC4&MRB4pjx8Fz|dF;j}Uy$Zi|5K1OKNZ}_S_5P9iod{(45xA?CxISyIaLO#_mEVVF=5QO@ zq$EJF-4fVtRQ@Kg@eKYC5ZE+ym$Vi6h0)YAL)Th9M&$R85lRW8sIE@t%@00%Q-TW@ zvAfkg(1+qH1q41|Pvpyfg+fC`ewmA%NByWM2udS^`g+nu#vxx3ndOeQk1T_t*Q8;OMzJaomf5&*$nv;hQuvhS#%W|83IV?de@tu*Zpt z2rEFOOsS_m&cpStDS5B6Vd3cdX|A02^P7_>gmc49EBx}V&&f^NopzZbTg|@*#|5ub zXk1umBdGo(0GvQIi4nigZ`_I!q7$j|BZFw_FK+bogTKP(29n^q^fliOYx?3gms^kh z>3v|Oo+t$ksrzH8Z*v3o)X+vX_=Of+`T=(j+rPA+? z=={(GK@InW(ifJWfqpcnj$l>#4^*3v`%%D#w?xdsQU#!^zfQICIcBTf$Gk+GW7RiC zuP9OwuD`iRPd_be`j2?<mVEF1hiG7A3+DEUDmDbcZ&i3cIaAA3XrSA1b&P99+5 z>hSzqu&)BDhBAxa!-SLT{-Q0Xr34UaI1)scy$?8N`nj0V3Zt>Uy|Yv_O|BTE z!Ys|*2fCQ^=yElQJ?dSoqzfG^4P4PTTYrI(K`D}Qco@E-v=50?buezDuXbt{r6xFM zjfPj}@q?~Zj2E{)tx=7K-1lEJ|MfE4R;~Q@wi4*{fq>x*9xWYCPL2v;`kGBLCCe;s5c&QbO=xO$EJJQhMZF-PYCw z{iGn8O6anx*5Fkqh1@G9xUt@pH_x>mQ`Y~fR(HhLW~waleV|ExBSBzuHF}!c`&akt zEUGVPZ-Hw*C;ihdg)j0&D<75Y`-xwD52b)lKAC%jpX&n|N~Nmd;{!~R*S~Z>6Z+4` z3_fybd&B~7y8^)U3jmn*KK>ggjtg+&^~%L-#~<+b&kpb#t@A~hceFpVhxJ}w=w4IY z2kqB}Zs19kzYVraK_Vq}Bep%8CUlc)lK!dwt(LwRuVuZY_OHdKb>fFOov43+*8%C+ zGT@)^$DoUIGkAku$}Me7$h#hcFZ8k8*g5jWxgTso!`zJrcqj6_h?|F>#XWC#8@%H( zCm5ByJ+c;4o{Rv>CVDbdplULem6d6}n8YiTNCF0!$J5zYAflA4S;@ z?ze5q1nV-R3sgzg57Bl{ogMpfPjwRIQ~F#RVWzvw%v)Zu!)GL!A49dL-#+e71REi( zUY=%SwytJJyB;);Z1-j9kwTni-FzEC$NooIdb--6LE;~sf*trg0SB*M>ZwpcaP_;y zM*n_&7sFUwHCvh&!HLca7gjx{n%|ca=_k4l%AM?GQhe9kES(NLXb62~ckgmoYOG|_ z2ofDrv1&CB9ILcd4So7DmQj-=ck{L@tiZdlE@_9;^B4GUB1xusJ89F_N zMCA<8Cxs6x*HlAtjTm7fH0h~K5st8wh2zP{?s-ESyO33twStsRLfk`DmmX4d& zTom>;xeocrKj+?nj%Hic;IzgXuR|2#2A5@Qwq(Swlg2p{j!vY~4 z=rFSo{?cKlZ1~j=!#gaRI5# zAU1Efjm>>z&|b))!??r#k31}co)wH?0iuKEg~S?4>WGAvKEhmGzdj{Scrr#0PsTWt zO#r9!!xY;53Z+*gS2Ti440)2h8=NZ65w&%M7^P9|@D-?%rYw$Ddu&Bl#oOV?d6}Dh zCP*U74Tr{B45Jo9*Y~(%5!_YDueg8kWdI^r2YkNjr5oo|5!x^tJC0I%8m)P*RZ(w{ zS%_fgnrROyUs~^tfa}^_235uM9rv0PbV(UJQdAUUB5o_5+_^m`ud2Tr%PB&m43e}Ga$f|InQVHi^*%LLcw9Arfd$VS&LCcKF-wXARVBfngMPFDx5*FEH=gu61LtI^T>T zI0@ZB!1KC;M0Mvbn&AKcAHAVSO#RAFTC0)08|N*PW8@X=d{TyTOOe0V>(qa5(#WO* zrlL|mXv%9$*y~fn_9rpzDgGBG!5?hP4L17{IM&V`4{CBNAgDL7)Hkn zcP-h%uy+nBb9cTgliPiAtMt~CzNbNg7Q%se)!Z0Q`S8E~Fn@pA#%8fQ;CD`b67PD5 zXGo~F@I0*X-y27>(AAmF{mRENC{AX^tM4V9G2kFyXBV=#kd>P(d!jvG8hHWD3oU0m zaK*{Q)mIewg&->D-g=yaYYa{Ly`mE*HTpa#&N#z^Q0WIPC%ICQHsSZQY`f?Z1GcKI zR-yLi`592b975$`1(BWek0^?7krltHK`TRPmBqilNeiOeBsr8FQ7rqQ9N3odZgPghlG_7UY2mUwrIeE2#`cD_|E?S5H0?B&&9BWGI!ab5p>?8d$ z6vRx9>&fPM!Ez3CUysps&DLZ_>Jo(~db**w3M1hU~il-X00_p0W5|aq~-%7Gm`o zirhm-8H9qEA@JPg`EE`*yNy?811XuX{@x2E3O16FU!578s>#POo8rf&@2%S+=6LeT z<)M*r*_$I4t%PO25ck7*0>#DKTfSTTc$=w9pe%o!Hv&#Em|E)fHai(A_l^*Lg!dJm zhSFMOrFDxdDv!W4HcoRrZk~lHvclYRIh9d=WlrF}QdFqg`Y9a=+lvTi?hnSOX2NR} zY+&Nmclr2_PUY=J)_n)|!uapCqk$((mt^a{-b3**Ho^|NWF5@A6;;+Aoa+isQ5wfN z4_lv?mFdK}A2hbr?Y*q!MVTu{?);uPu(`|K+M_^YRI!L4NvNV}Wl}{U8^Okw|MsVl zHS0*=WL{;MiKTNxw%D+slI@`JYejwCP!8FZPG$Y!+(m9^o$ngH6RkU9-jL`Cv;7DC z{=RhZ(`J0PmkKnY7{jw>xd(Tlo$_zN>Q+JyKU+7vE|WX#q-Z!Szju2`Y$5xRC`q3h-rS&*+vzB=+!3Z(CY*^VMLEc{Nii&k*Aim=)d*Oun)s*r3u~~D^E*LoG=xj+~0Vq5FnBY9WLrjcWxai)kk(o=FWY? zy<^@l7`bF8@j0W**tr>;Qbtke?#qJ8>dtx1+yhG}`6B#QUVe@Oq0tv=;iHk$%{!#%I_WJt$EV90Ey##NW!_Z90Vns$sv=#H^g2s&$xg5Ft}_n zO6}o5Ia96-2?22yAc<=yD&Jl?**&;2j)I542P_EC!}!J(InUlrNN+gj5QAXrC0Hqk5yzee|?HtzkwWki1$>qxgNX-GV# zu_NkvPTZ2LSg+=a|M{7B2PIiJ)}n?P-`CGC)0kI+?N^%E6~dtNaeN%u{+Vi`q@|GE2@zLD3irE+%}%-7s2TF~Tv~ z9g2Qb!43ap`|3@%Sv|oqOK(o!khSm6mDpIW&$9*}DV}~$vV^STpsq!GPGDH9cE^4f zepo1o4^E_@faZ7Ke|{pDeD0vYtPe<@eTYK)VUY~!jIBbkBIR-YO18R`scqMJ*>|wm z>{v%M{9!3CQQXezG?*~RRnfyTK~5C&o%u`Il~k9R0{Gt6;8#R zZQF=Fn4cZn60@~qA1NlWY!M-WXMp%)=4;%4`1FI#sqF^71%dh`+!5?(!2<94c3ERY z4eBziw4w~`J?d54BeAY){*I<{nJ;-M-U51xafBDLb596I;&+{?%C%^+8*|%`bKFT~ zR)`sYL05!KiQ-i?*M7Xxf+oLd3Vb=4pQ@&m29<+Ok0=ltl`Z;1QOGO`F1+l!y`a(* zbIxXn{5lbCM^$o%i2bmc&W`*!gdp7!iF8J!5L^B$Jl*6y@qjAiQ1G22?*tCw{*!R# zuLDQo3C?JEgQ2i!3w6I~GGtcuJQjX^W+Okqf}taNP8QD1WeFfPm`dRmH;SqCi&qQ0 zi+oQR@L)HGOSF`vb2y1l^~#9%XDjm9`~2MJimblQ9-Gpt@Vz#&R$6(ZKy5;m6KJPX zxA;m8dnB91HRQueXIp}GLb77eR@TWRI?T-|OX|Cs_k;?UsZr#Ty_vYaL<~J&ugb6F zM3=^B>-dA`BH0#YQr5Y3Za>qZw2oBoeQ{A>-^llf+~BKtX($o!2dkKiuAL0oqG>!& zd!wz_8O2tMSZum3MOL>X=FIvs?1*ICeyH|k(TrUBV5kAdb*^@!ghFzq;1tPk`%Z23 zki6`o6a|{t)suyb@|zfy49*vfiM^Aq^42Bw7#Olbs)``AT|H4~YEFCq#C>hPQz_>bWwD=i8$R2M2_sE2~=r(jGe zN#$+nE37r=Y{rDt%2a4dVciE2lOL}YgR-Ih5sU25_uQJ+^_!1-X!El~R@0#1pHY|A z9z`B~apm{2?WFJ%xhV&3Qd(-yZgH{eMy*vf0y!lCl>jnle zFmW_oBW;}Ca%X?l@ans~LLc1Et z%8wr?TrgCGaMNd-Jm&R44rPl~CB4Xkp|2gEM5lBtW$cUMaEK?UUpX%O_94(#qR${?Y+9+E* z9)%A2`L$e%`)y&hes;Ln8lKx|ANAkpNKSIP^Si{L_@|SZ=?7<$v0uIeUm{1sX=$HV z>Zz&1pfI_)ptx+I6Q+ zekk=buTnEemc=MDLP$@86)s;Ea2i4QN!H`|*-q+6z{&Dt=4UhU|L3m+BLg_XTJQUU zO{VUV0Ne`po|6P;U(fwmrb0)otpT5W9Sx4IclcBEinJOvu+2Rj|93gbshtsXrbs(G zBJLxM(B3eKCz~SCMj)`e9AL-JTy#=vd9G;hyTK^$x%oIDqF=`9jd$S6gxw^iOQC&` zsnX}SJQ=)lUqd`Z7N4TPpOg(|+Fhf#?zBD{4Oi#kVxEha9TAi{9;_=5dfU$q<)wbi zVjK+R>xFo0D)jq#gY)FK@O+5+4{lg>c+L?mkQvV4ZH0Ix6CSlxlymY_r@!yP%pvxL zhNsgg<%7kP(YeUlsZTu}jq1565Uzl-ZU=+nqfpnkMr<-RHj=0worRi30$&+lz?W?6W6+lukWYG`)$>(n*x&MvR zI#u0ZBBrtd@X|??ng;Ml_z<2W)`jGyIo2i+V8uJwjFFmH-sc#WCW)P2?MWKbh+!$E z!MdQvf9eprd$`sUI)q(EN|^6UAU?UnI1#fqb)B?H>=fR_IAkYUrcbXan=peFg!xiY z+qo%w#X(GHw0>!35aqWR;j`GqAgF)y$?xk6_6*cKIh)cCitgdElNjw2atT=)Ae(;n z_h~MutTM^;kOFzPb({EmD71Rm1#E{7$l-wGktp=*cja9s2F-)JYLxXmoVKgoPF#Cb zg?I3s&bzdB4f;(V}{&c&fFQfdT3eXrH6KvS;l#OB> z9a{a{M#7?tef5!F1j@`*7*Kq18EGA6u*pbQ8GcjR zpH=YTqo_5!_{3%;zC_FPc+9paSxAiTF1%=KeY{u0!C5A6{r>rFi04#<_pNq#aM!tJ`T!8-+=`+k67Y;fsq7Km zb0icwP(iJtdeUFJv6Lf_Y%LPyG(ARja^@;H%=tR>rYic7qf44;>2ficemBFSuzt$5 zfNut=#@S=1jA!*+551&^*K>4YjkCZo(b+-f#$%rGIL)6Rb66@AHey8^mdO?`H^NKa zU~(!n&dmKVC1w5#LL4KmJG7xG3nt6nid|-KlZ{HlK>I|TOzA7Pm~lzF{!%YDe1nl~ zMx1ALK2jX{t~?EYEUE;EvuUUXxwv2Rzb!BbNM6hs4$|FONsC+h`^~@vZ^m&HxJ?^V zgBdoj&07g)mTsKPbc|yDpvrLvNi4R}rmLZw@ArCIlPOQ9xGgzS+edgb;2pI#m^R%$rR%*?o-GER$;nJ=Hr81Cg8 z&(3k~@qJ@yzZiTf@eNN7roMUQD&RP|VOUAZD&<&W*t0pzh-k)SHJO31bA+#$rB4L1 z>LTtdQBtzkzkXG@6A+U}6HBk1OeC-WBpNAr*h;8~9I!(VdHun)#RT?yU`?p%P|@8~ z$=dy@!qZjs4D0&%bA#Bg``DvzGUcFb$shv5Ai@6Y zQ5r8vnkT*ovQCk+#?LnI@l^(}j%>GY{GEaAsm(rt0QG-|5&vZsaDVYp;o0K5O3|m1 zHsRmB6N!3K)iC>=7VE-z5dfBOO-?HUA{e!3iTno^sh?ADd)QY#%|YeeayGZ zGk2AEF@%V#XP%$!ROp`Np|AKpIYmHy%2EyTc<9SYm9awL;IrP%)i_DVnw@fW2hN{; z{1>@3hrK*Afc&?$TeZd!$cF5Gat69&RAzs%sfPe5JV@q zY+^ZHBWuxJ35)kyb3aX)h%{*vS&e*FI;gH#@K=`kMX2uLRhs)!2&g?P+7}!L>4t)0 zfPBXD7EgF2Bub&7g7%{RY;jk=i*fJz{7ir-I(h^DpBDuLwF%H_?W$I0bZ^cAoK2G; zenXrH2ur^33W2F!{wI#DrDxMjTB9DnQCvK`E;SslQeC%dZywey_>;|$8pdzzGRfO* z5@N;7KG^oLzV^C0wRhb)Uf7={+o&UjGtwLYt4?>_HrMjoT)V~49B?KJ*E!#u%{H91 z;sXcd4PRV&{jkh7q$!^bOtmf^z1UA$1DcwH4nXA*8q_@-}&Pwm_#W48`k4G)eS7I=eMy5Qk z4~^W=#&}Ej>B>HJ!`wx{Azb%q)V?B*OFaDw7d1s1`pujt-^IT%5>s~ z{@BV=elMi11gRck2F+&m#E7%YkN$)eZ*mY&lW9e=36#e)5vwV4L)L?A6?uj4o*)q@ zGbVH7eJ4d!oVYdum6rWGoHpI)wcGlPC5$9tm4=BPCf%kfcm8=;e#e_w!28!b`kmF- z0^o?FbUok@LB-1wqM8=e(sjQ`Z))5KjgO|~G})01(-Ck+bpI`5=_RldMe4A0IbrZ9 zks?#JdUZ}WipQNa7?6-sI z-j{a_6Fo~eCf+w#)2;;#q5PTNg~gg804$w;$j7Vg$*f(ovHunNIbhaq9Xu?`JLaK{z{uE8`C77J-trDXG?>ZQ2F?0 zeDEvfaa_~$QlM(;1mKz*UXp(=uGlkvDEmZFQNyHeQAK|}{Jf(>>xUX?PI1MOueT=o zfM1~3&E5o^<^jfO^I>1rT9T`Uj!A;%KksvZ2vtJ+;7PPqFn#^Ui!H4i6D8%n`%B2) zegS_!7}w&USX{ehaMT;ROT8NWb%4dTsjet*F-dY(u%LaxQnvx1EM^iMX9&CZ4CAi} zPisjxb87Wc1px26nSM4i!NWg}dC88$bu<^_>Q&oXkcae08b2Y;@koJYi~EkxVM|1V z?9IFgj;-UIyQ59ulwM@$%vu=VQgkxz=Tu5y z2USD40+RK}mre~#_x5j2yMyTR*Arb&NF|OihkP@Y|M}r!5=5BgZTR^mawaXDe{!E? z^DdDHEn3K3Z|&q5Tm>k1aZwv8)W)CI*vc-P(-ZNkv_i_>Fv;Fv^Qi;ZkJ2qRi_qZiYj0jwQJ?vG}#<)q8mT{Qwg++(Sq9Foenv$|3%uH z$3vmN{r~4A+DIj3Nm@=6Ns-7lN{1r5LG}`|XP0e~BC;eQ>yUly*=I0G2-$ZtL&$E% zIy20eneTh*e3twE-M{bmbGrL4c|0=S+v~bs*Y&(yaDc~9-A=oRTK+(&ED4D8BaPbP zN&<+L<@T(x3+UP4|L0Kco>n7V5mdYng`}^UR3;rCZtyRSBVbfa6PG#bigZ~ znmv=I;HT+K0(Z(xyt(}c6qv`Oj7u#AhalY+j)_#A6xf?e$P5Bxw+#K_07lTi7l!LYK>;W@O|%{Ix@XwH0E_*tj{~1)1szi~nFd#s6d|A_?$4MM^wG8~jX!m+DZl74y1qsJt5oJz&c+y@c`>WW$cE z3Q@QXj85;IOJm;THymTq{&Sb%x7{JPEZ23_QGb4gt&`CVfsLKlJh5IoTtAZ#ju93L zQMdWe*SnfG7~$kgWGtqeDCh&#Ey=z9CH17`doq3`N9pMbN$fq_RGef2-(I%6yiZiI zQ?E4KY~k+l$w)ed(8BNH2E<5ivh)P|=U!wN2So=rX0y+)bmU#@Y-@6z;zpuYt=P2* zc}H4Llw2)jXEM6h&isMU5(ty<_X%ST#h#3vVFB?y;S+++P_mG3{m${- zm+Ch|2^(J1l${<6Ta&(MWIpaO?DJtk*AB7jl&aCOZGs@s57aFf>=SLBV39+iZstaN ztzg|cENv#NhjF+FJ@m3Ur7t0*o_>4*HIBPNq5cl@qsJs-1Fa;hU)3r#V_CTUpk~;LtST33oT3T=x@9Zir<{iNp_x1^I6{~?G(&`1wqo$ z*=U*d+unGo;cOWVV~;n~PsbHkhN`;**4?K%H>xM-?$i?}7IuzvzbUcnpGuL#SEyfJ z1^6vr=f12v_Y)a~^6OtRuQfzdm(E82p%{l~ND}If@P1S=p_P`Vbd&h8$&266R8nJ+ zB}13(r_M0s?Irq5r`ED<>Yv?ra{4V$f;#M*(DP+BH-x^Su`>+08T5&Hv7Ho&jdj1p9?QpZW#xu)Azu7s z6>Z5^o>L<>1s*hg)h9&h7cLc(S3#TY+`G|b*15=U)zsvEezb&e!sc1!6%xj2?x4cv z>&J@#oxOZeVfkzv$Cox;^mb%PtzrElv@K)6&!wHzLfRCY?ur;#s*Tl>?S1WARWIJX zt?tFLQ{Av#^byAeq1Q}fTlmpuzxy@@23@)j`=l%m9wf3~)qeao)Do^J@`KurRN;$p>;`SUxr||2W^PpBuCg!Qv!PJjE zxINXQmpn6fHW&I)*H-3x}jY|i{0L}pO=b5k8t+%=9~5XYp}d^zKFWA%^fcV>Mu9hZs&r^1AN zFJa8K=6kN}{yHjSErkkdm{32cR-}W4`b}$$H16f)#g>=h@t3N}>p^O9viuJIuNOHs z`*SorEu>iL(anJ%9&nQ$_i(QcB*qvNoU&I6><*;maoU;F!~@#Yu?*S-C+>3?S5pN# zi2llA$HIHg%zH+xTYy@JlV^~s(PCc}HhYu_eiMu!)a;@IHiX}4-fP@WmHZ*0{^D1& z!0j1AKb-DJzFve}6vat@{Zjvu_F!`s=}=tTLi@HSVMM$=3=GGs_5@TC=gVln4V;RL zUud#|gTW)l^J$1J8zmA|xicdUbDdz&n+Z{JE9_`(L7#8GSA%4wjLQ(ImPQBI#azOa z`lT}R2F|bAH`;F)HO@=wzT!S1H$gl}E}2)MWydEi$D8}|dbc%CaBd{fS3?PJ^=w9{ z+k`~hv`Ui|Ta4dfjYm^K-*HMMbMXU!&eU9lBFIjrRHLo9$jg%5&&l*xdo36g*2%=J zF_+pI12TTazqK=2uG^`+a}VCV{Kgh%I2_|dR=~Ne)Jtcj)_p%hn!77h+Y#t31Nd93Y~-*JJM%dTbg!GRr|6zYA%kue=Jh zco_V5uEUSd)Ia(u&vmBq-`yB*+5*#dSi6^>VXma!NIwaLq4@d>`#SUX_<|XBXc8z& zQrkbkcwNv{>@qQX)aCtnJ=5CNT%s*N^>g6Xr5rLy$WvsKw zx~Rayc!@NJ{)J=|nB*!_ho1lBf&`;BXem?EY3EOt-Txa@NP;*OH* zpu>d`{PVQWU|hzE*Qj;%eC>0)4P4aoEwIZs#Ro zQx_y!3W_O-=iCWD!njl)H-bC+fn`Aj@8)gk9*3$-IY)G=+;XY1@@fR{+(g-$5NX`j z4dhH3zSOVB6+9;kr+R##4!t-&O5NJ7UkO-oXVBI%Kkb0+Y)Bp_^JcEfH@(KG!LpMb z6}H5WI9B5hx(4ZFpq7#4m^EcVH)ckYcfp&JoofNF&OYHTT2!ICrQ77Yq!CFrp$K@5 zG?-M+5g=#j*^6(adtjfP)6tiZL4lpp4Q15pYuzwO$ysW0Sf$J7hWlR4(Xatp$_aqa zA@HgJ!e|``w&V;UIy(BvVV2o^ zsc`>f-R!OwK5<=`$xhu9_g6Uuk$ak~P0=e&$sHgMbywPRkZXw33~a!xB-}Gvfn=2XEDug2PYmOc9hdG$ zqyMDU+QK#Dh54)4#>)p$I0p5z@Ta7+(L3)F5hVwr!Fa3Ua!6ZQ9_~RP8uKK<%#V`v zC}%N%jBAw*0Ob-`zHu&m1!R^88*s+WcWH_WT~7v~hN$R(Xq zo~gMa>F#v~kMv!YIUs`V)?J3X9J^|*6&DY|E^G3l_Z=XBkS zHZn`ZGlnt9|1P%}orVGPqOoGt20z2&(8w;rd=o3%Zpdn6HvIX^YTt( zY@lk-@GeemrE|;=UtdD)R3JYO42S_^P`Sx)FH{YTHS>v20^PRloN)5tz?I8Bjl&HD zo3ApR_1LcM$?W68EjA;5G3~v#Ak6VY7@ukH=eDIlRBbw%OwNebfOpRBO90qiwftZG z;Tc?0IB(3LST)wI(L(`W#Q%awhc9z%3XgGYdYXfM(?NP-bKHE>$z&*hbtY^K$Pjt& z7Q==I?!IX_Yv+ViZ?8QkeUxsaaU{8#J@hT5gr>oLECGvblu~4DG4(ewQ=kBG$-}Z@TT~qV9BDg+!Xq4;{NN&?^OgXaRtP7v2#$;eEN9Y(wiin{a_R>=6Q>#NAN^4R zihj%mu-#km@$oI>x9=RA4K1VPbI+k%LJ=O33xVHa;qqh5Ku?!$2HQZ@obdT}gJ6L2 zw4j|Ma@e>*Re!NWk`S|D#-jgXSE5wgnYff#42jL5cA+wXVW*p?H>*>HjaDZi`$l+ZXeXa59CdS zkIikwejIJeb(s{g-fLV|aO;Ug#Zv!a+b?`0<*ti+&TKw_i?4|iR4UOP$JR)Ex1quL@ipRkcd zr2A~CdJsNC`J)_c`l$~QGTB~kQ8zq4ecngd?6;|ru3yl|r~nhBhRjGX$bQ8MrmVp6 zG(6;iThID3`YxRQvf~bt^e8}#Ze+&dSYW^$wE@3S15^;2A$nWw`i9*rLrTiKV_NNKwOsK&}-{|L4-O-k-!$G8&g4NhsLdMOSs&M(Z& zTn-6(aDp(jikTz0>VKh;bBExKe&u|Rtdsjuz#H2r;I`Tr_z_><9Y{EiuIU(Gcy45| zktBs3zEpFn5M=erv7@%hiQ`(BrA07+T>SUDUSQhcQ+1q@pwom+GAHtEwEX*W8H#t* z6<^9iE)M*aZ@rErRkBZVlz-m4lz*PHz=wsVst962AXDf`4#oT7v0#`|Prx@8%u&Ut z188F8;{)`KZpaF7z3>?!=6ZCFYiWV$ttU2ktD9$If&y_wzgZMK`gO0;ABy7FeaaW) zTt^%j^HQ7TG!^9DSli1Qsqmxx$(&jKqzv;M3_d7N1$sn$@%*pI z5zoDw|^Dx}7#$zVV&~1WB@cy(THEg=1 z=ry223jA#LxX};<2eiemKBz&MJKU{3p8!U=glG``(;Y9u9}+k=^8=48yuFqI9s&^7 zan^*M49vsO0rM?II#wKbXBk);8PY@BnS-ntkXOLq`b+di@+T~>t$%Z>JK;$!lwfJ0 zB(vP3{0Rx7re+$cf!gH9&;rH=;nwEt*q5(_Cb-#?Y&qgU|JUz~l#!vk7XBGRUD=|~ia@UqQqunNH6LR0R3JyEqek>ThtL z#Op%rZ@a3cq9!Rz*fU=JbU-l0s`N%qG{lsC)xEIfJH$xPRJ`y9qmlEHm#{w_b`veQ z{bjOi;t|1u-$eqa021qy0VF|}fng3}5;L90%n;yQ0^LgjuH5J3C+#LKrqto8Fg4Af z?gQt|p!JFoH_X7>O~kWNPBt}^qmMpT{t^Hpepy&kK$RdI2f-XKTv>Kk2bV?fpA%ld zsnY$H-rjzd!R8y|;hZag57`Nplm5;e;p4sHOE!qt-PlmZ(-U_nX@1y~e#>_52yNl$ z5sTe2gGGRsIjPRML^au(#uF9`TR(qFg zLtDQ=XD(y|YYYplu^M2F>*N1(QQL`re?Pp!T@APb0o|Zkzx{5F+#+)IItvR=@eMnq=(ItlW#L z^;)9ht8pitXAcrP@_E^dU1b%j>e zN}r5Ur0D&~0I`j~5~nvL=2#qF_aA592Dzui+)Sqi8rd17d&0DKyx);M13&=se1Qub z^++xt{;2z2;o<7Q1 zO-Ri0=n0>mMv@{ybxBu5`GZ&oDo7DU%Z1c_5(B=^WQ0{TEd{mNCm2Ge!v%p95*^jp zq!YnbYoX1nCgfJRd{~pi?i2QLuXS&H$|xph{ZJsJCnjSG!~wlYb&flVvBFvhr3a|> ziYvJnVe7;<33Y$G8%Z#F5Ox_zW$6jGSM@8K;1oLI6-igR+iMxypN`|a8>Sf|L7F^Q z%KaSESKi_9Y`)1Bb7Bste$C`bFe>BQmFk)J6*cDr3*z;gN2u~UCPwbxV+1|HET0il;O<0 z$4@$6C0F;rd`beaj;Pu?Z0STkED=arV3Zm<6Q0sJ6%Z13awCu(x!HbiY}!2S6= zc|g4OyDm9(C2&{)Oew(v@a2+X-Q3ChUCG~QiNNYB#CKqoR$MH!_?*sWl8s&HC6*(k zIp3BE%FqjfYJvrUz7+~V0)u2YVh8R4Od8X?rsUyh8rC)cBK?@R1$x4-h1bHBQ(>nR zMT|GW#oDM1&xseDPNc)3zM|yWip1NG#I8W$aFJbuhCog~Pzq!J+I6bM! ztG3-~Ru;EL#_KmySJ+`vAKkBiX-IjDae`Evt!*ewZ}#Ji9qO-tM=pP0NH%SA5V|E9 z%S@;4xiy5o7JYMtUgzF*eb~%xA)Anx3wK=^*}@Y_l{q_H4fJar3mq zi4}|SbTHFVI8+?Av)nGqlJK5?o_PHp7!c4j4x!oET%KUeuM46&Bbu*a9H$K|XwdtF zK&k@^U7gRDn6xem0^M&hO{x~`P z{GUZOV%OGR85%T;M+k3Stlru0oD=Zm<=?5${8vPtr<_g(dU}Cp`~nGlm`mk7?^~!gtaV4em$gcrJ{7?!K-Z26BZ)> z_$oY~&gR+VznK2a5)26S@>^~&X>^p|0i%-M^}-CvU(UkH8@GPnZfF3LXgpkEqrI~x zQg^b&Yh401KCQ~nKyYpyV)%GsX8!@nUSK5R0pK@eN+)AFXXrNT zfy`uyh4TRvN5FVpZPmr9&w?AHS}0)T$X61NqB166*H4vQ49k#9^Jb~1MCM;dEzqV2 zkxO%FWGFQvr8gTnI-6W;rEU))jZ8n=HiH(7WKEh{fs!Abb4fjU-()fA#Y+}^x#{M5 zi!URa?cZdQ>9#ebZlI`UD*V1VV~c-AklJeHj11_VteKADXqp5G=;f-dypPO!uUD`` zjKSaW8jC>Gy#oWQ$RXk;kNhc{w={uWPaO6x=uH9_n`Toamg?7s4dckA8tZs7p?3?hm3vrd zNiJ#!rF;bWje_q(XY0SOBfEm>B z<=FsYzLcW5+xkQA^)_Lo^ccr9eTe*hX{}YzTQy*Z%j*CG*EUJ;gJJ5>`R3JFhffn; zu&-BIkp(5SLm^Z2CzGFwr?yxpC7X-}?6^>NvH*@|eXKeZSKBjK-9q z=^7U~vHRroEQTuMH*)L&EOsZ}#JN{0cEW!{jPP2SQ$43G01mo7R`xj*RmKM#(>!n; zfK~D1$VnBFqIosAjZndyvX`;X;qqS~(fyr{u*pAs?Vm`5Py%y94dxC#0^#j+6 zn9JAGKeI2?Z4>8uF{u@P$ZR>>)x@!^Hh_H=1e4BN8#J+1x2L zeh-)K%xN6CFn9K-{?5kxnK=E<$Y(9M;|kY!DFp=*)-G>3r>CHSrAxue*^nd@p_u|vtx@;6R8j*+JDcvC}{>Igz$C;>e1V{cWL>2Ys?W7_rSJZX-vU`_D z|Fw}*Sj81k@d!fJCTd`HFO`3+K4#m=1(WBHMrLz{CD)^IiYsiCsMGSr5dH$Vc4jpsN#e@k% z<2D*5T-+N?#jW6CwG^^9&4{MsA4p?_eUc*+pa|5)9Cjv2kJT6f7rwDU^!M1ufJz!FGy%60+Wa(Zw-p&(vzZ0IxE z*g&U#`z}r7E<#b))f63)EtTM4q6S4P=Kj@>vud5Khg$!5eev1ys<%=U17 zoW1!!JLkS7d@IMUi`D>8LQ8+$uiU4P{zykzyU)wE{?1|ZmT;^TKcha#haZKLeY+_`5|K)`xYFo_I;oX zxK5=gHq7j^`YMc5cgZ4L%>*sW>7b&Tt1Z1)#<2Ceplh3+b9#5?C!SwP%UJK0knZvJ zAF@tnlNHa+d&8!j8}YFo`4Xps28L~o=lF*z6OfNV3Q@8$0>NOl$uqVtg>Y$?V&>`o zS+-lZp@~Wi)M2L6kSv_o35B)KTmlmhPfbe2q>5Va^}#7^()tcn`3P-1Xu2EJ9x*RFEv1_!(yR}Cbla65dPxA3F?qhR z0nHzvxeE&ZIMh$gB2qtOiWcYnRnD9b%9-P0AhT!B!eZ>Ld-(h>_bgrbMYXRT$P#d` z%F<_3<$(#$2_#8qPK8qXv87)cDUHque1^M*CLmp0nGX|A2GUq>omyQ}JyNtmuiBO) z)HHP_O17px8M^K~j;$pelZiF zPEPaEpv6!5t<=T-_1hXDTkR=%ftybyh`H3Tu_aQ1-7uo-A!k`q@3rR6t1G*$yL5oQ408aML@y6{3lYc%a0a6qS5ANTme@#vq|%xJ$`{1ZJ_#b zUS>8ps9`ZT#Pe6ep+EKk1FqxCr8pf~e(#ppeIay39+~>JVa@$f_xxfn&*w(s%Q6%O z2CYW4vUHFc(ytZLF}HJ{Im6l-97Qg^qQtn5SgnEuwm~1bhPsvDubhkn7lPLL=lxE+zV;gQ^f|wcW`~@(}mPT#p@^(%wJw-B>tiC4EmMK>bDxk%8@@IExs$JX_*po5 z|57SpEX)%z>?Llkd#ssTYBRT<`+(-ReH=56!`jUvZng6~pz)h;r9@1W=Q8|g3H?Rr zX#C)u+hCbMnwS=kmEvOd?ZMR9R}Uh|2zEkq5+xw!oMP0rW%_XLuD{bm^$%H>elTdB z%~$dnhT(CxG@{{8ETn{yrtf?+8bJ@jR{Ac)CJSkzh1GLTN z(LV>jhD*hsYq2un>S(Ibbk32zgW^8^2%*HlI+|6b-!hfJRf}iqSO@D6vmL`l5q$eG z9aI;LWix_uGE=i)Z6ItcyXJkAgdp@@7Q%QVJh{MY(W(S|Me+y3CwoXV3d%?g+x`r~ z0J?V`mqYf@1+rU5$v2y>l>9@#@>ze|75DR57CbAM$+4RSHNzQY(k$TQKJA|!ZX&L$ ztn=Q|D6Y5GP#KcZt%+W*7E$MRGIN{Qow(nPTDCjUIvlfk_F_PXXzIoD7fmd`WX|bf zqpP^{DFWKa#}USkEy^^}S4_?cetW>_HWaa|*-5`vR-TFK0Rdc;qF|~ibTE#|CUR3o zvd=do`i}tgiT~qlkNoafw}ZE9g94RK-C_Ax;_+X$=0DQg|5&#Fs>Y4J>;>24aY{kx z0_YsaNj=4QJnl&fE?5MJAj@FcG3fm`4g~&csM0~gn zt(*l8j(L-BS*+=E>intgc^)ab-Q3dI1}7ZE1#u@VvZivMG~Zx)I3>AHZ~oVx_kaEr z|Lv>Vp-S5TJv91Y?%{X8iXh!4>PudK>x#{>i7j)3PfBya_a${=rgq`6HG)t}3}s8< z0QJNp+Jz;L_neV)r2E{P@~Zs&v4Q$8^UfFN`Tlm_uY>IfhTkCe6|{EKBD`6h0t?q3*;+kBsuxk(Bpt$I^U-gEc45ir#LRc`Gz98_q zJ3&#pFXYzc9_ih!*Z#go{qd$IxEvKFDw5agt@cJwebK%E&(!}43im@10RB;sWogPr zmR0G`7=lY(J3f#~XcY%IIDu;c`OgYeT6Mx4r|LcuQx~w`~M_5qoTlYObtrT2@db}QN{Uc6F?}js^>RS2T zvYlGie&cxERCyk;>-Shgnv4~ne)bwPck@N8th!c5-h&p~jD2|a`^G+w;YV54#Qf>c z&{prMcwzQu(feZ&AAiq7>WMTDRt`Tc*2-fC-A+G15%M!XkUPKR0;n*T4PP>pb9(E~ zIHXZ%V9bBC3DUA~MJ1d=%S3 z>Zfu@)VX*pzqPm~3XxPcm#OxT-sB#DONs%wBnboSmF_((^)ea1BDMxj|5T$R*Lk-E zoze$Z6(6YF=M}4OX_-v(u%6@eRpfck#eLyY&)Xn0dZHYYs|N68dorKw_I$JdD~b`+Vj|{Yu#!ba<%2h2qSy6#}ouc~7 zbY~Vn2g{s}(Gm3FxDX&PIPTcU?4nWr*+tWy2Ks0I>Y}mXh&;>eh&BDi!jP9BaN!#( zcOA1RVhLep){SP^2X6<()LSjTZIm2(+lX^JZ>AgPt50b&(9Va~Jl-}`rrArTb=in- zNEZ7oP(E5b#d$L$XN^0S*a=zn* zRf9@gXlE2%ZPD<)E;r9XsD&%U*Z>+=Y{Q+uxd@@wm6r_>4WaL$KVNUm#=c0z+Y?Y| zlCJ!1CM&621w=_YOxcA%_V_jrLPI=gC&RsMIOdIGeqaOYfP(yW9~T*9&bI0w>^Jz3 z<(@D)_YLchXmRXHg{pzI zx)10`iy`!hx5l|O0CVB09B{eD)(V3$b6%N=jT7+%W~MeYYNf%R`xeKSmC+JG;%Nc< zpSh5-#p-Ygj`QqNBu!Cu3#VZVfj4K8w5573M^+VthS;%vQRQaOJ0q1>p`o9xubn-t z`$L9knK8T7GMIYH?57Gb;2kCU830CP8{e2zTHlrLpodUP;8%nd5Roy11}04@v2H3$ zY~HwA;&@7vd*nyYgO2qEUE1gNvvt+bqkfl<(v$9U7-1G2i&TnnE*<4mmE`_T;^OWL z&1VkaAncMTwU)q1I^`@xX_9GK0 zUZ^AB?7<{`QynJ$vJktHk-ZVs&^ef}(}*^jDQZWQXv4z#?gs02+^ z%a<{5)#eZH@T{FNd@O0(rEh=q?^hfFai)I;T$uGKQEJRJ%yC$bV&57aA$i5m@vp}j zH)u6yzHfXjVr3tL2+D)J;P$Ku@DO}15SwQaKaQnOeVS?Ikh1raFS-~Ywd}N`l|ye3 zKDU41iBpwu-{9R?gl@JG@^W!a(&ED+1FW_l=T(v0FQCx4_r!2_eW<+}GxF(LYtI7Z z6rOLl^A`VNFSI{0cT^g_drn}^|8uh_@Gb3DPyWJZ0}#(=LFS61hb1k$s~OF%T*{9J zGY<^4T|g{Y&R2x*zZ%fwFBOc^EzoLi(vdo9cSCT2Uijww`cEj5AXr4MZ_~-bq~ZBl%ys??JtDEH8G@&=gI1okO``ak6S5WBw@M zA$DiJM|^v1)cg$kC@QD#UROAD(@glFtfs3Jl-0PX=6w#IeYY_2BUD!q&^zD%kMz#W zh~*FYt-K%DNRBBI6`{LS85^aGJZqVF|b#CwXbvJ%ZlkRUj%=rCw;HCzYm+rBb+O4 zy1GYt&+_%T3)YFx>#=-Y2lF*;eWGaXRD=C1mQZ`?`2tSx zW<-$W52+W#-gT$GTQ}&41O5>kT z{GJ_=>}QKSKQr%5djEE%E_r89lvBi*O~3QxvME!6Kj1cyLof1bf*KBSaQ(_EZk`6K zILP+XI+>9Ig z1y)%A!Wt~2lZgK;#A*6MjcZ|-7U(v`Nr4XZf1`DF9@@%_I0JnGxVi-q)GI$QSE5oS z*!!k%LH_RmJIB8Ae~(!ITden2pqrr$S2QVc^QIacdHnfIB~dZCS8%>Iqf<9^!w;XquKDwa_-G2llSGI>UQ@xli|6cmRDVgn};$~=iJ(uD;* z`+xQcL&?S^GD8o}qJ8ev2ALoIr5JDVP#&;Mmp#6RJlR0CcaH@(r#)LP^*zOers@lW zG{|k`AQ63g2g#13h6}0zw>{k?p{D^LRtaipWIi5E5z);Sl_`2;GU4jk7ZEL@19D+d z4vv>vkMy&@=OOy^bqd#n5Li&k8z};U1`K^euSHc@YEah9Q_)2teTl4`XIy3bUFwT0NAMG^YO&* zzaS`o+XwEz2KJlLnSE?34^!}i6_Wvn z>X1RpCVa->xHHZ`g|t5U|5YJhE+r#Dr<>lwf#0pZfPgejcK_f1P*0TvcAYIKstUO- z-08~~@!G~xI?mPYbBp!f6&?wI!SOtJVrvYXBKV*-ObbTipsfF{zQ^2M*l2qu8{4Ne03{w^mXaJP}XZ{4ZQ*KSnZNenJOq+7WIpCoh|i_<)Nq(k(zvO^5C}z zqffqON8BHSNKfR(=~_RjyW0_rIGnA6y_T5E8 zMRN?CzWia#-r-$vAHSfJ$>Wr<_})B>YH5qXqZFa3by{seap?M z#7V@Zyh$>2mxTg!cpG>bGIIDTQZ)MV-kt!3l^_e*`pDc>)$_dyu;%^?W|Qcr56PX8 ztB^2keHUGGb#R>E2Rwq*UYLt4sDRSQFX#OG@lNSuu1DZGi)QI#b7S9X(##o5&Z zl!vl!p~O_jJEqG%!TDTU#yNfE{Wp$Z@e-x>?gl``x6NZj!#$agBX{r#B$+>*PW>Qh z%7u`=*kh!YbC(hh8zRn>16oW$V#u=_gPMc_gBuk^VQ|kpV!`En%I#)X8ee=4<#5Op zm{UOE{kqY&p>4qAX}<8_=GQ&TL}xmgLhZtsT-$BL*Ca53A{5~34F*HZJmA5MjuQgY zwaatBL6w=-Ytb>YPyJbzeU#yyv(YS41PGfqxR@{Zz%R-V=6aE?UKf@+$sR3n1ejqf z|J8?+R?aI*;6x(!<18!Yf{ey)ovWpdyeZY_R(JirVR*m3-%PGdlQ>4mzS|C9y&?39 z>IaScqA!s!9Bs2u77G+QCvgtG1I+l&w_C6dzogO2Jd?7 ziy(zp>KuPgHg+Vw!Jyr^CG&vI_|YhC*3iuxJswTaf;xs?~Q5f(<^;63}~ z@qUrBjbHIM?xYdLbdL-*V$qLT3nhb0=S_&Ou-xp0I@f|OhrN7;tco&|XY1Ln17aqFox2H{2p!wEeluomg zS`PQrpurScCshl6n7?f>FDj@p&EOROu5DdkTpND#a^XtaP<>vQa0iv8M`Ymy`@m8`#UN($Xy&yu(NFvPQN%u|T?R$4#9a>vodNFzS*Wn4#JF0i?W|IMfi`o9=; z>TF~qYol(y5s=HgvE#qsepc+%Cyq^4OP;?$TK?yonJ&&uY5G-qs|lUJ+0@?U!OF3% z7G{`9_XEx{SL+3*2amQ~+&R7(+-a;~CwNBWG&!BoyK@7#5Lo#BkqH-L(UPh|Ye#^1 z=P}wY;PocYwAY}Q1@xR+rq5+#ZJ&v7{X6eZbNBy|N)jo0pqKqqcwTR{6UlJWO{Y`i*cWlaeE9xut>kAF)nhD!i$QrvL$GiyDuHV;ZY=eAzv%Y#(0^2T zo859`X?*Hpy_;#$&GN5XWx8k~WpV5ei$q?&iQ^fu{>WLt6=-3d|DNRnD*2YMy^?Dd zxJ$>rN;I#}9lHxQspq<71;8Hi9CX)dlf-hA0QGgYBGt04_J^9^Yw5esRy!A+d#W0a{njA8LNy@zm*ykLWBX! zJ$>i)X)T`C`zoQ@yScUBt(<>ed^Ao-cX!OJ(R{{j*Yg>OJdYc<&p(qnnyq|OReP@n z>w*0;dq16j*~fL8R#e_iOY!QiCBOB9f6rZMP4Fj-*{)O$`@)k~yXWrx_xctk?p>g{ z@a)VX$p&CT*sz*EWT=l^kmEBhFg5ink@jF~(d_tkpqw)-YVG3@_tg$YAFyqlRMr~q)Mf5qj6ZECNMemu=lS`Nv zhx&|q#yvoYRAkkJi6pe^q?91tuGZIjH%qihN%M%hNgc)JEwpv*ba!r zKStyTZiLZkTr{c*V|*V}&WfX4@>kC{;?N_-pazUnnfr$sSjCIt5ORj|XWb@TUQ8x- z^>7o45{-(}-jv_64!Z6>y9JOG6$8=Iw>s=E20N75->h#0>7fra4y}XtggERftfm7QwZCuN|Xrdnv9VWw9BInGr#h?^85Jyb%i3st$SE z(B_E*^_};zulSGf5?>6z=>xxn&SQl{HiX36o33SE(iKZCLcBQcRs^On zzohPOT7Jp8Q}9sbYx1DP{m0$#+winQ7Xj{-^`TXfcc0~c`be1-4#05dNmwiIY5+{| z9vh#(XPLyHTSFd~Po&_x=v~*H8+W#A>2_wixq_);CA{Nll57kj^=tX5w8SYk0 zMSU{5)_=6O3kb*LTbDD;zz8sS!$U~eaz4G{WZYORCpWcoT{{?v;^-8%I0FEJ1j4aa zGy2HbcOg_pH!v6DDS6Hn_gn*tV14`}370|Ti~-79JQ#+O2x_=!P5Kp|`}H3^)P2C3 zy=`)vXI)vjFrv)nvouRyL`~!K>6lEF+L9B#uQ5$unTY8PhSo7`M|aRY*!M3n1OTyg zx7eB*X98&*wN^L~uJxmoa#w_)KzX5)k)uXHwZ&LRoThZa&lw+5+N~v+!sJU#xw(Hc z0Z~#T=p^*;wa}b7PBlCSo`ft!#>us{pSGiKR!sr|n;}wez@0E~1K5roz;+C5 zo`I@(&}dxni)oijT$YN4%D( zIIi(-*mvyExO)6_OQib*YU^h8n0*1#54O%l{>Z|shl)r->bt72bj+_#FWNf)sEKGWnFsrk?{XrHVQ+C}Kq z$vJx$>bzSyMdzH^{^A;(Efmry$B9_LYbDSJ3}X-$7H`K3SfPE046q$k{(U>-?B;}D zIc#{Rz`mWk5Lb(EAZoh?L~6xLbDgW>hx)6$?H$5vE>ljlCtd_DP`at6hyx)*<(nLnMP$A4;i4>n^f?a%shfm za+P0^sa`fqqS`>H$Zc-NxST1OO~WdPL41^PKDMeeks>$#R#~=R3pXuNa9^r+Sk(JE zloiC0IoG~V^XpzX2TZbpDItXEB*svvNTfJF7(^!tP|s}IkIHyjeU^-Y!Uf`i-vgNU zL_PGE^1LFu9e2@0f+Qs*e5&PqI_(oL*N96fXGO%8dC8b(^I_y%r=I$)28}2|oW@uO zC5&n_RifSW4$6PTH&ExWMF2-af>?(0OSxqwOU!&68p8wHE$8FumT33>+-5dP6KD0l z%^RrH$A2Jt8$Ro1Mt6ua!~v75VbWcmp4^HH6Hax6OBxtjq~lU_o%)eeLsc?gZ8{>I z{5W9}L|d1;zq^#6AECrcsib9B!Gh~@glPay8h5J3GPZ3-!F>`=xMzdsnA$Psc)@3Ad`f;0LxHM@QQxyfXGF?|kOIP1}*( z6ubVo>k?I}2UrDFlJ3#fEq0z^Tw4XOwG*^r&|=zQI&Pf5Z}UPXk{xjm%A)*r_#}_~ zpw@LLzh3UiCB=s3Sw;4B|4pmpTImUYy=Vvf%`?mX@15`Yx>L)Gimd2m&O>WkWmTT~ z0wuXW_SSjrgg6;`WeI#)5!oh0$I<3Ohu2oR1+}t7V{%sO3y!MK6&RXodX{^M7U$<5 z9|QJm9I$6;OndhK(DvR@O{d-7_Y8s#Dl#K7jMTA#fPzv5grF!@IsvKCK|s261(FP) zGJ=4LfYL%Qp{YP9Aw*O_L3)QIARr|n^bkl$c&{+`eV_B5_kGrLZqD=kJFYcrh3j`+ zd++c5?$0Ja-~IAvZF$gUW##5pA2WwD8HUnLdiL$;Ht=RO%Y1x*{m~KsL%vkL)#dOX zV^jDA=4j{lrmco@#SkaJoJ~KB9 z(}J82Ky^T(M?2L?Y;u@bt&2&`1eb{ zAiM7D-~?J2BE~yx^RL`{Rr9W9ZE-VvYO2+wyqiQmP_shjWR3*g`aNA6f@Fu&=W-M3 z00vBz=u^ZBFV0U^m|EBM8Q~Qm#HkV&j;PN)J6hLo=2@azYj;X)U;`5`xOIDH?c>gT z=jEyOeioQ8wxNGHUt?HC(=r1aAYC%7VSX&KPAa*O8H~K4IrnQbZMVH+A-Eua=#YsC zKsXv_$%~$;h!jXQbW@YHPQ=1Q1LG$B(FcLk$iP_n*lO{ITxT7b;wZGCw>jZjlB|_W zFM9Gt{VU)D0N1qSlV@VKBl7U%VcUISDjQP!pM$Tf9dT&*-+|u$(|fA@;!oo&*qM7b zB-8P(uRt9n^!kLq{vTZR2~=(NL&h~>qvEPBhp_NLZbk#ViHO?_{7uo}pDchC*6E|? z9csHZ0Z+mQF#L>vGnirwL|f?rXAxyiZCq`vta>ndyGKua>$QCtwR(G2EM)s>*hT`f zs_Xoz64j#7jshL;Hg?hTQ!MQLwK!FHlTP&EAkWgedJ!$J+OTaf59d2vPyR~&oSzc> z@iBjhFOHUc2yy$weerFDCUOb#z2;i98$lxTLCerHdP2VL(|bm^DKWOgJ*`dK+m8gd zM_}w#n?(-cPt0?`8yYX7N&*nZFcy8j#(E5(y2#AG4pkj2t#D~MH#G*Qc$avRw)x?O!Q|VeD@$T^JkR^aF&l4VdUph|EwjeX&9wH!aQJVMcF+WNKFs zJL4oEq_Vme;l(cb?GYB6zC#J4Khk~u@@*vg1TrqeQq(#2(0Rj>qcn%N#l3e8{N$l^ zYt`S3C%+}qGffd4%_U@AjblSYn|A;=B{XWKv0vy9-lK5zJO>EwYx6&NeQ_ub zF$KN6-}E?aOxg3Z#H-&-viJwVyz~?pY@jOgtfcv-8Z>+}y_G4U8CunKG+f+Gk}@$n zb6k-aaX@?;QpnC`R2S9ej=FX=A$s0#d>L}c`}p-RVhINc{`mFh9e^dQ%Z=A+aSZQy z#BQ704XQ}LGwJeFHDMPJh85Zb^{t);2PdH+9{81IkOLyl7< zTG!4(+;meWpftC}DJdeC0|0&tyQ4*(D_SyEWxdka%#xPdtT=QU>4eyF31J*}t3Tf2 z1d-UDI6&N*&7gb?Tf_~Ch0fV51ZbN;ZnLB^?nfS4-4BVD@XNyj_QgWq&#HlQKhvA# z!o1rQQjPs!vzBnx{(Irn_J_=X+S!SVp` zI?0s`U|;;=s1n}%mTVxcgOuO0+TPd1&3HF{bdPEOZo)g8rzV8^<(oZz)$f9d3(wg`-YUEu06UIP_lKWkL$(N=mM5DcP+(5_A zh}}GQQYqM6p5b0n<9+-2*li}2cp_SK0hJ!mS-1GY2*2cm4Jr^(bbZR=Y7zxlch_SH zjKhq|GD)z|t z-;ayYXj2m7-#a*DfFMd4K6})7-Z5l+zHsS)~}KdUAtTmhvT>rbM^>n=XSKj zH^lZ-SWa~g@460ENTj@OMvpDTlhg52i-nl9G&>8+a4LieyZs0Rd?W@l~&db#lN2 z+-I3RW>erkk5e~>)kapYj9&e)tkqNS60$kLQh{qJb)%5%K(MAoWx4%;4AnX^^FZIM zy#8-<{EGYF-zAQZxnx;8WRc!iTs4mJwsG>S+eJU1gzETI2*VwUQ=2yU(7drwN?Ewt z0TZ>)9jP?!JHOk+!90)82_A4|QhaNBZj2ArS8J`GQ0(xflCW(u>=p3N3f0h5Q2vL6 z0QD<1mVHNB*LGj>!xHp>-BAtOWWk;}bsT3d2CqpoDo&S9L zr2puf$U$cOB0A9|+EdAFR^5@~Nf9Q!0l_@wBs3(nytaX}HC7DY^M9gJc^B0;RGQ2i z6?Ul!7xaEmknV96{+)MStX}L7+Id!dK5?68?dwY|`2oFK+!CrJ$!^m_Qh=QmX)0$GF=ta3P?j12HaOdih)M7~FJc%W)|*1@Mg}7+nxmXE27p;EAHT z`s(w^UfRmL#|3{QeV-q@Sf9oOfFhL4^1CG%+1kPHI%>AGvMZQFxXNK9?q_gPfw7Qr zmc>5oJ^^;!ETR>~hsbU+{Xl$Lb}T=RKt$Aip>dCgn2ZwaL$erLf0NZno|01(@G+V{M3r-uW@4n&yj`erAWGsVKcm zaQ1Fe)pe+BS*C2~&|}pNj!9=m$j$>wyjwZR5JvUO9|=N!^Y|3_cUUKSg0Sv<3L-Ff zeQ*AjgApWC&|--{KVEqL^x@6tKN3VV$M`n)2^=8kq-rBuY!|oPLCmN^*4~JUcz}3c zFtSuVE54W=EwRzp6~#;ag0c{pvkwBx)8x!{4)HvRWMOWwp0qAzMHSR$1dsNl1byI@ z+A5w0>%{JIo@$?_NFIa&YkO;r_Sw^)ib&F8@mXsxNBNTw9mI4k) z`2SV*Sn%=%3IY%Lj9qC-tF2o*hb)*#GYJI?K-%9E zx-5?HU()meiMxMABLh7aSlL0fjVu~~1m3(fK&p^psIALJ*NTMJ;*p>#4+Mkx+CHc!V@8@bit2^6>16&_!JurO{FY$P6JsRa zOTA=s^HQ2RN2ZFh-qmO!5=1MTl0ZSkI9Mc%O1-4>;A11&u_64Gb_IQJb5V~t3HgX< zlET%N$H7bIFf=FAS4-9o;1-j95FL{EEi(F*ZTPJZ+#&BHm{>;$Hug|KA(A;($SDEy z1`?J)8Vc@nVYI+pMK$kwv_$YVDDqxSaJ?2vZAwxVv3+0Y)v)UDJ?EP4ud8hM%`;(3 zxSB%+=mQXda8AXp%B1O|E?h>1`(KV=zn4DnXut2;$H%%OH+@wq!&_AZ09V!k+ibfXjSX9@8$veDw}3st6HcM?XE?=CJb%?s>^{i( zS)W?AIvxQ48=S3FAobH6(OVi5n+ygIu*w!f0>7lFu{4><9xr5J;E|+|@s0|KAOIP$ zPFogVuU@RD)c2V%F);jUTM40N0q4r3@lz#02!CNu(UAz0EqxPd@0Tw~JV4q(2;GS1 zM;y6yFJ>n{W+I@6n?ZcaLX?e0!kgr|99%+3!A!BmI8~>bq=gQ(wE9kbKl<<66qfn5v*-eI*ejj^Rv@Oohx9xp@q2KwUaLf~ zx2L&771zghrkP*+ez&>xD`fdk7NH!A7!;X7g)OQH-S`=~{uWk%mQ{|>3OXsZ{P^y1 zN37@OA>P}WP;1)}0GXoampE@>sN_Bt098(I5Pc!`zEbrIn|@##`Z)V5KQgeIIU_y3 zK6Z5<>r=8ca_sY$^T^F38eU6BG?iWjFFj@bxEOIjqV3Bff!Wb7ej}70(a6aV!^W|n zkWQ|zT?k?|;~o_Oe=z~x{=3!=47Ln-JpmX_waA+7sM)Ly11wHzfCF8f5U zeh)JzrO<8PbRDGJRVm?1f7FoCC768P#f*yq1sWgOvb?ds%011bP|A2XC)if()9cf$ z43)2%S?L$Dt}w{|UR2(5it|q&C`kq-F`ne#*USh0uCo3}dhUosA8SQR#1VE=DPbgZUzOYk|0}sJukKT zsPHKj*y3`zWDuJzs*N)$gj-R)g_zAvDWYt|?S=t8@JhFcAp1LbL8DsJwk=sl<)=bZ zjjpmr2Kjk}Q&1t_I#W+2Q1IA-{h;JlSM8QAK9Eyo`EmoKH@GwlR$)8c?3EG6;Ekmd zf8p1^5gP1yUmM`S0HV zC(F`hwiaTDgYbV~X>K7j$cGH?4#p;pE8{1x$`|70^zr3Ounp+lN^c%{Dd!THi zx|JIK=@IXG&f~qEvi1&8HGer?4A=i{1otE4mjiuM6207^X^Ud7&@Ny30w2DfRVCeZ zPLspOV&`&Vi7eO1OrY7Jtek>Z8-5r_)dr1}Co#u_?lOc9|FJLN&nZ&aA_lhqW?PED z`ZKzs|Mcg(TQRZ~{@`)8J0>O7EfKhUVzH6An2>n}!o7c!*Y)8}JB&SvA$WL(9UI(v zUwUr`wX^M3(}6)998!dPHI5W4g8X=GKK|0Aeh64N!khv!s=aSo^-4X`7V#jYV*s)~ z3symfhcrDBy1vvSk72)U??m}o7KqN}c2O}{fVj#0OB}3wkRo2xllVTBh~EfOb=&X? z`M}%C+_WEOV6dy`-;wLhfK(S$D5C7~5{YO9dloA30p(#NHf10C4|@*dD>wYWusrl@ zD4?B?+_`Y3ONyhA!(*eKWniP&qNPuwu?kRl_|{Ap@yO&uhqs>iUe7@*ucdjjXWve> z)V)^pS)FwokrxrY^gZkITp90r)60!pku1W4wb4}l)b-uR+xo(H5+X*byOri?w+(1% zo;5?WJMAW4{yg_WhXCZbb`BWS=i7%zJ{dt$g^l_;(R@Ml?M)xmKR*3L2f(&br1!1z zupQ?3lGMB@=E-{O!c(6^j0Wo9>qd+oVneZpPGai98P}PuE3L-Lh&1Mf3k?S@N1}lE zK|6E=6xy^f=)~sA6!E;G?*_hhgD zaVWYrZv*HZV94+vjqaN3eg=*oz``qAXv$~>m?7D6)>2q?O9FTFuf5;VkdhXWs~xFh z{$?gsyzBpps<*h{?e(55>~9~V>u8b{vz?cwtW;gU{^py5Uw9``o1fw|TF{FeJUkss z2v7+M=Ol_?BY_bLQ}obIU~cTi7sg2F&opPs6WFz%GN@NjP4xjnP8W!r1rux0!G|O( z(ylZNxTFDqsFJTJzseG3OdO+{-kYgZa{#{7&|bbPO$r`uqs!wyl{KsyYFz>xTOwVq zPAODwANLfmUNxrzJ^~^f{;d-*`av zJ*L~*k9aoYk*1ArFwWse6qsm|I$m8o^_*B|tU?-wvnW!`S%f+}*}eu>0rr*-aQ3^f zar-s*`G#wuQBwhm2=?L~qnFz2>?ZbWl znx+kDliY#9X$jlYZ16a>QUCA~m=DJ{$*XXWWAP2^FPPI(n5U?cvslvFn@a`4zOf~g z?aR;0;}S9jOMC{8G@pU;ZB9jvKSP(=!sSA~AKX%HxP1{gCS9sSYlwVQhHg7&xgK1;6*lr@y}WtWJMfeA=fYfO~gsW@}%;{j~-degDw=T6gmTHn`gVh`{r4 zqfIJ1&hTi~nfS4&TKqj+wT7LILtc~B8g{AvV_Fj|jH+BSGNS@*{Mgm1wP7AI3EoUG zIw7E9;K4(<)3k}!{OOu6k|KIiK!>G*b!N=PRL_ba2?kInJ2j9kWp7)A*;_!Tp2UoX ziU7@`p{O%2LTh-v4@H^TE6FdIPp-~1*umo_qZ$Z9x`D6$V*QZJf?|aG+sRN7ehUFd3 z348}>20!TKO*nwu;Z_cO+343MQ!{4%IM`1Nv=^Vs4wWDj(M70cGA41m5^Ur1pvPG@ z&O@Td|C$rII`PqX$XDJRM>iGMLj94(MHt+>Ss(<{2M3I75hh7 zhz&~J^stohCqoVaWy}^;6NBT=*F1K<;2;>7=x^U!6iTA0B)#%Ne_zo9Xc^Ki7H zHgkrU_4Q0Y-V9r3AS_r;IX3&xJbJal_r-|95d{gFh4nzjhOAtLLS8G{7mfJQ(63xh zSL;UBkp2I_siOj>|12w9abGXi7D|2feAl2v#g|!V2m8L}U00uy>Z#Be0V>20f#P~c zYi>dZbU3w=(Gbr-Q{jz7P8IC_ol^yuC)}j-CQjCeHVf`dk=7PLCS>osR-F9SaYSKo zDA^hCZcTy!2*T!~$6Rgkc$IM*4-w@*1# zA22Ets3+=Ii}FG>EDYhncBFZU2h-mWTkT;>Q;3a96tgQ;TVkF0JV;V1p$;@ZiZs@r z=@5X*oo2@`NrrfgSMLMfgaSrajoWLw^|AJQ3zgNv{X!+B=%ZAd^rEXqXG&zygB7wi zjpY5BpbxrBFmKs2C3TXnuf?2H;p8vkxP_ztWa}v#0bb zpLZR}1;-pyld4|i%T_qb?weUxy{o?|`|5QJJ5W@Z6s68efIk~oy&Lj9$=ZLX@dF;4KfZE= zj+M&1XR5Vwr!7k?{m=%K`DNMHHU%)3$Ekx(Ob7wU+aBYE(ZrI9#y{MHbgn|P@cn~= zvff51J1O6Z=#nyWOZ@RE@$k75^zDGI)_JRYleNhT?sfx@;F9RM+HwbQtjcR82km_1yOW?og^7Me>o8aW31kkbinPB+c>5eI=+ zJ-O7dHUR1leGD?hI8KHLo|avVRM)N*ay%u*2z-lr4*zsQeqJIxjCgV*OX%#LY(Bl* z3`m4luogx%8#56{vd#@50Dl0mT|oL(A{rY{;02z93d{|d$yTbC+MVJd^KJS6>X{}6 zO;)h$*8z`b4(H3 z{G6V_bKLhkPbJ^ceI~;(ZMV2sa0qUwBTco-I1LfOsa`AX)mzOaFvk18a*1j9lxk4E zDiS=vM~>M1SVBbZ(9Nao?>4>dq|+J2Pq)xF-p+rKas$@g-am;kYnRvUd&ZxsqH^L*!5TP{*< zR{nmKp6&5f z%9HHok3_!1y%|=UhvzxBKJ{}$!3#KwnGbt=Yq3X9!V}V$oAk>m-CE_rn?&5!jF&2{ zcBSqyWB#bdH<_bmAPaH^?-P@#34~etHqSFiNtny>R`JWeZ9{Vn*w`~|E8j!7PoJp;u?pH6%v|${})Hh?C1yR zlip*^b`=FYk7liN4jx564s_25R4=KDF-|fuib*T-|L#zz$LsB%NbGjgdUDkWZlyX} zTHDwnWpunhS9Mgq<{=mwe1~4FhWTZIlu;qV>DHdGLxuwSz{~?jx3%O=^=Nnid(rZF z1DPX3E}xODy-WANdhJADx*9kbNBn-czPY(k*)1Ns9aBQ^MXaSw8he}en^7WEi`qVq zl`BjziJ@K*?_Ty`jtZZj(>-HO=p`Ux4kbfW6Z4&s^?(%o-BoZ--gA@dXe%@;MYRnriPJ9KT^_Bl<76q6 zTmwhbjNe-&{r;Ijq8AtLX^c}xC@@2|cautZ*Pt;a)k7lcWzRofK_gb7`{{SFj;SA> z3k;!4)=vQM>(8`A7*Z($8&n#Pst$CoRzahHL!H z-1}=o1O#UJ7!e>I=8PxyC$|j#Y6>Z=96N_Pw1d9*X@U-?f#)piQdrLzDSPzgqj|yeFJJjq7 zv%OM}@S)XrEo??EXFG=^RY&;XGl{T(6)?qmq?uODHt@X#+m(8#{jA*xE`R6+{J$T) z{v*6y;|86~+yMmQZooCrI(are@;=k|bBejmXxHkPe^?ayX#-K& zsDAk8t9ya%8UFH{g8K{OEYnSiu?*ZyIB@7$3e0+Iy8KjgEp`Dp5|}SDKOlKrIjKv; z$z|HhhBkG6!J8GRf+;a|9FTzOoTv7h2A{0iZhU=?S}_u{WD0Tgv4)_FjG6>%n5Cie zvH1`hG><$aRJ>Hk?a*r;UBi z#mp49$;}TlI~m{Cf_y{u+o(+#c$z6I&P{bHILxA|-@XNm!u%gJCJ+Amzxn;R$d8Z+ zr$&SMEEVYk`EpRvV)$p_&C0hKahNeT+6gGxtCZG=79AHGkh!b;J0z$O(H~t^@sF`q z^teo$QdalSF#D#hx<@4&{p?uJLv%!{d!U16|BXH!Ep(QiVDXjwvRvT1lEHy>)*zZT z25}6Qsp_A@t%7W!HXtd#>2haiyfVglAkhN|Y8#yLY zGzFu2O9AN89ZMd}5Uh$gGz<^p{K;XyBoxEa8c1m@Rd@Y3eW;-dCJ35;em4M?C{T(g zUvPeti|zT5>z{CNy!9O;8-mZxq4;1x&ic>{$XSh!B_3200IN$5Un zJk=({JT25Ai$y&Z`b)5J4uWIWjy;qlF*H;(wc_joAhcdou0n1WakvYtYDo46eljTn4$8u>J@-d*g|VKU#Rn`ou8RP11FiNzz^^JK}^u!Q%vaP z-sWbU1mW(Su}Yg-u_)zt`q&E@N?yN)(AJ?MSeumW~fkLH{r z*jT}qa+y|oo-$*QVJ8%yySJRd`GFJKcyf-G~ik+vtxU+E4NAqSik z<9Z)J<)CG?>1ZyhwS$EvpYm*?hyIx$GidSdC;JG^u|HY}0g=zq+9)__ll|p=IUX~4 zSOG&ZP}!hpf>92}JKxuPiV&xH55KO;G0s|A7hs;UZ`8M6-XE+n&8l=Q@=~lSl;UZh zv(L*YU)oaioj81upVFmT#cT;j74y=9PpcP9sd*T&^;j~Cv43-Rg9EO7L)fo4BX0!J z3sI3DtnQ(;aVe9LvOY`0Fkc20aOlrjC{M$#(%Auhf%hZOCichZ7D*Z~5mLXK)|RqR z1zLn^<^Y>Ytb4pp5GwcenPg5L;vlpJ$0?W-e&><^W~y%Tidj-|$*}|AIXx*b$FqM= z61Wn0OdHo1oxEP|v#4wM(YmEGn2&FPc6cjll5WL1!!$5W_ciXXsr+D}8wB;WQk6-Y zOh)5hqHp2kn+K!C1n6^gnaS2VIC&-%9U5c@4C;b}{O+Q+_fhdf4Y*VMj)jEpR&dXn z$yD@yPjNaQ`sGoyCx8-x3;C>2!5xUUVgT7uUuwOChJR>y%CundcD2}1eyQ&^MpZUck z%hWX82KHpix|H#3qncf`Jb0e0M~SiY2!rF_UKvLnxxh`O_!-dLJa=>^IC4e7!3C## z9%0RhPgjx#ENR(&z|Ywkykt{>%bm&VdjXPuy9xl|t!OJMW|tpZ6TQH^GA;swCCYhz z{KIp!!0z4K!8G^6v{=Slkwfuc#_g9c(Qm>iT{!d81F)P(nMbm5@$|D9y#NyiSB+_R z&v+adkRWW4ZCFzKP^DChPNj^#Nq?+5cc>ySsCV9rPfOh{Pe!jxFvaFLAy%24X2^HC z>PHF5Zc5pnCYY^u%TS=e^qJa7<$LS@M)=6Pcs?qxOx9^ts=ttVR-wL7s$Yol$+CrD zaz72y-thbJHE6`-%TX}!vs%IEcCwd=uW`rP44e}woeWJah6E-0=-++KMe*&z;hbRC z3uQLa%Jf;x^}!-ed7XMmy0b^dJxQ*_uq3E?Yjjz6W%&zLx7oON*TXmD@edE*gfLMQa{|&A7NT1^Aj6= zXqYb4cevW{U_U+gYIVoK_gI{&}6vMCujA^Dq+w~1^( zy^$QbG5voOH~BLX{cpJTAAZRjg*{9qUFmqZ<-?wkS<1Opak#XsRiUc=1;C?%aR<;3*Nd{-^UOVQpi9YWhB$6;GaA@sP$3-rE#8hh){X8m~1a953n-sRa z8~?eq2Mr4n;v8TddmCXVXt!_GrsnqB^JG&Nm@roD+bupu<9J%z)`55pFT)p^l?_SX ze00bt=f~SUFF3p>L!J9hzETOg3;*+soJlasxf-@t~;Pko*U0c9WL>;XMk~qzl zFZht?Vaiie^3v3%uMBSDp~?hj=23Z1`M^JG#1O_4)-xV0{jp~kY6}ljdme^v73)N~ ze9(Hm+7&F5>)X`;wg||Wjhosd$%W|~Wx=RRYmo;z8P5UxR`RCJKmsY3bLn7@3#m5+{{_P6PCBQe$DRz_|rasY5U?KoG#h*z5J@8t66X^xQ$!B_ngPwC9iuG z7PqEwWW6UAExyOqoy!#cfL_N}A37@gcR6@>q6V8dHf7c>R&A3M{eUw`Y7MbVxl%Xr zN}NdujWfE2%&|7BWwd+93-=0{qb-g)R9U^P_o~*iE>GvArS;}UF-Dw|Lcc?!fr17f zFko>#0|RP*i)wPu77yACk-azPn0$!ul*YR;8rMpK;-H^x2pV&BaX~x z&J%PIFHOxJM_u+OzkGwcOR*-dfV)s#gbI|HH=tpLB-+8HOYq-6bH_VKs|1ydmcaeq zEDeQNBTK0L8=G&FEzvSzeXs&{zj6JE?8b>}JTbBb29ACBK(=tce4)oREPyktEVss` zO}=Qgba?2P4{ofK)esoh`d5kZLPnguIq@H!!8ktZWD<-11RXc195_%wi(o9DO`*gwLcvGccEvf8brq-?#;WZ37z3D?uyfQx2?Yg@j z=i1xsCZ)ICDGBDMZu6KU=jksN+cB8V`~N?stz6y3spQK>uCI$n;#EH`;n~N|mKSq;jG_bi8(;~} zj?Ied~^Bzl54pP_gR6RDoJ;m;3bn z>@%awB#)x3gg_)_DBuk*aARxDy^{&V^?+aIE|3Ix-$N1``L#4*=qo4B?Mv?jD1+Lx zTzkQxzB{fi3t5d2qSdUJM>LsiA|-_tk&@Gs7TAJBG#}-w~r#fDx!RT0ww~% zW;@^AJd#Ggo_v4bu7^Np@2}%Vm1v@!4Um%bZ{(SZH0_R33m#vO-EOIWS3%}WkGMGM zv-0TWydFE4mU5|FiI?ihGXGY8#^ZG9?_~Lr6wTE!JDQZ!pWCIc&-I*tK&h|Gl*u)b zmFu>OXbP)@KVeip3Vx7I!&Ko?n1tap1!8d z-}Ua~Z8V9jQvH`|p`vKXPG*d(NxH<-;6GlJjWyhc>dpq!Sf6c6TZ5H8oH#626=aDz z4epxxBZX;KOj39$P;^gy$f?cz^;m%j6mROZ##7Y&X+=DL4T|=4%msBk64de6gH(EM zB~8gVr0S=5m{E8Klm51X{wmr@60t4&d=b_tq{Gs4G(h zwpA{}iXcM0YPCNEUxq_@H5F4G8Dw8bPG3IWYu`w%iH^q&w1t1w?Vv`x{0^s-xR3C9 z^TK05YFhmwfAi4{8a=23glpm(r)|}^gNs=lHLJif*jf`-|GcDmp~f@=7QCsWELUs&R2QyLF|^3C8#ovNFNAy9MC z-NJlx!ue*Le6nBi^-*A+y+%0gUH?8)ccA@6lcqJRBkv0U(N}*!$%AQzb!g(@y-YLc zWHGrJ=MJjLfEG270x#6gij4N{hi~15KRNvqg<3tTy&oE@&$L4h4m+SF zN{R-wd3HSd-F%t97`Q+kvSe!erar~aaS%#q!ooh3Ox-6@XS2TK0X@ zjaGydWmQL?3@{J3Yh74 zxDbn`V(e4L^!%DuXIe7F*02HAR z9(1IJruFR)Ki8CCG(0L9m4(ovLC%y^*@#)BUfUHPcjzM@&PQi7B-3d_%-dB>HZl_w zQlQW>7Uv;sOD?aCL8mr%=_S2{1{Je_(I|Voju(iVl6xv<4syiJg=^ouO2fY&em6=y z6_=4Hcz7v;Z=0+$nrqme|GdZ1+O?S{Rbe@0{UiDrdwpo*>Vi5k58$ip55@(;hzMVjJDCp!h>tH!Q&UkmgS1r6AY`ifp@2j@>esIc(@a%Ju zd_(ffM)3Y&Zk4H;C1oFriB(pqinU?lAs?jdOj+>fp-q?yE{;BOevkS{HwW6~t|nb= z3eK;|w1{6>Ih*u!5cGu+(L@mEy(T1fTQ$@2AN-MM%r0dE8rR0s#&Iq;ct?(CjvjO*5 zPLZlMG;e-2jc`YG{k3UMw}r$&oQiCD1}!$}b3qn>E)B@wy9iDT`XV#0*# z!t^F6HZ0E@Va8!rRqAe3ML6z<(-JE*(Nzw@YPCilXw(b#xc{Sm;=sn$bI%)(1LQR( zKj?;c;UviTH9UxI9|Ii8U8Hk5Zy}|PGQXxbTkhP)s7pk{n|-hNsR{CPc?pu;dTg=}dqf7;KStrpP%y0Vyoqf8g*XVddp`74cL^`IxjAC_ zTBtuCwQ$X6%U03Wg677QvA3;*|3^=+un|eFbRfEf1kIbm!R|WRknN)w;4CXvbz$SI~&64#D za1oZBi^0am!$Zy*B}xy_{n;mM%<)Q`{bw?@xQHX{0SxTgoGIi#we|WI8#TiSt)Z5< zc^j5=$>a+(J54E1H&5n_$XGqPcULJ{g}$a)`5ACD^>?Mo3nwQ@jWF4F8M4XGHRG#u z9ie5odn+;lH^vi6!9pDN`@1;3`f~zvVb@+L{ri_N0(p)L44NpkJZ=d-@l4*r4`!un zd}cR^{%u(&s_<#1b;WTlXrZKVtKV>ng{R|6R*`C63(b{cDq^k3ntLTE{OwH_cxlJA z)Hy^zVWD%7@(S~@$yPBY*%%3Kq;>b3iN~##1DiLOYQ*_z73V-HDlcp$eMZwz2;Y>nA|jsfA1pO1Q7 zV5T}#<)Mvq?TQmE_Zn#zW^R0Zy{ya1OYNmxv7zG!iPADYr3V3iU?mP%^5fQV=L@w2 z!UCo)I_?wA?GO|qUUcu6?^47S;&}fz2}ee|%CoouvqUAd+$@iZK}n!3^&aN}-sS;T zh_g!cT=bAmGp_IP>t7Wm{G?0B)=a_Kd2Y$>LjrpOL-6dL7)Ho_^sLhf$T;Z+I+%Y5X?9p*#Q(-=J54rXO?$q6vaX$=1S^GT-#Rl2TV?!Xl#go?Ue{f<2St?Iw zhb%!K zDE@U&>d4{R0}>76;iOnXx>~^Y4p!sRcf!l$l1mph5`>l8_(W8`I))Kxi*G*0pAC7_ zCg(fBNA_TyT`a;3iQJ?L@p+-@WlHMNsxne#@1%X)eI)!?BfL~Z*veEq+W~5346QJc zmMbofgx-HJu##F6GM&8?<)30nDKz5L7{H9?S<=bL8E>jjhVnDdA+?J>?ew zZR3HuAV1Y;g@m~|mlf_diDnxue%(uXKX(;W8KG+DlJq$_tj29Eku;w0=Pc95hFjYC zhGL)g33O=hyl43=5*{p;W0!*I#1ND?-66%!L%ODUCJoCma5@SBI11$5t*cn*OkAd| z4whlK^C5!qVxwW%>MHK9!9Pkmi%tUl3CF%kNPv{7&}#D-mDM}Xiy`MqH(kf0#Y5yT zRXeuU7in%la1W4z%yufo+&trP|6fW{8OfpMW#!LhLK-(FbzLwb&3Zhkc_N zCD8JLAb05gkxr0ECSj&m%w4XdXugqr@V4fAhbVJ-PH8}WUcBf$X)Tjp3wRqVpEzP_9entCWF%_? zbcBI#k*ssBrfB+rcsAtyoJ2Q?+bm+$yw*_y0t^#yTrZMOX3tqY>pziBZl*+?wPD z_U{YbDEIx0HG%!1BQn?|tBtK%KWE~)dv=6Ysy0exd3>^H+x%n!}Elph=?#+=hr^#fDvDfoaT_(o6#ZUfzV!TpgS zfio!m_=p%;{K2%F&p4cJsZt@MFoqh`m#4x=Bljxn461Cb|b&W3wP|< z@>)$*<3a=)B5Ql!=S+(p-&U-EUt*P5>fIOCzLxW#)7>|^+;U|mu^gvqp$aBofz_1; z+b*KbwhHy{EG00?b2$&o5tYvWiaY*qn8w-Pc)>T-k#%lgSdshA$}Nl3OBW`@!xe~;@(;O=?gBoi3>oKn-OnIPk!fb(!6pd8FSyKeu_i1Y@ zd@_#lXccX9!cdNmeM5KC|%y^*$ua011eJ-5b?FWyj`Gi z0~C^B3F+25y52gEc-J264-pjoO-bri1RKnO`y0vQs*;)IV6Zm8#_2)6#?0{4$y4_S ziz;frfEH>TA!wHB1JJxZm{@ssCUfz@tezkH04{6La%uQTSvmWQqgCb&3 z{&fVR;$Z|^-ZhIqKJK_;i=*EbKY=r>`#lBrt@AQvp{NS*?ywq5wH>WC4u1I>w5q;b zw=IcYnnb|5`P&F~-xzilP`kzwTvl5Zc%(4jHwv8{mGGVQCFF_%GS3zTOD}2E@W>JT zM_YDX{n)H$Vj57FRypbtB0JwYsEkt}su$yf0pk~eK(^s-Wf$dV)Th7aX4u_O^vvw8T}9;(0`G~_w@MJNz=%p*pEj=%IQ=Z>S158ds1P30ULrZziiYu=ResyJZ`UfZC*Pgb2~Ory zv~5_7`sDh_oGc57JTV)!fj+s%SRGi=!H8fMsXI3QLp((yav+c$tKW^jayhQHT6 z2%A38HCh%hH8B~`7!bT}v@hZEs$$K?sOMH_FkxPCal~!smHk+Ewhpn#Ja@ZNm3049 zNZ04*M%ddQA7kqR#xXlxvJ1{z$OkF*?)gbX4ljzmJ`35}&$SN@hGX9AZy#aGb3gq} zi+}@=J|9xUgT{)B?dPU+PC!3M}&|FyV)8dSN!TqQTnsfwgP zh!@f5EUONm6{USw7^KBf-cVYe5s{&vke98uem1=xwnZE&>v+7}aU%|fm z0?sJE=dC`9lF zq=(w)r}R=^Go@=Nv%!72`t)JIGB0Ey-4#Dkq%M3iO;aJJO+)ZQnTQ7^Wi>(ajhi{} zBfOpUJB1sli?^fSRTeyne9w zdk&`dzKmQpwA`FgN)|4YJyOld8cgd`HuQ<}Pk=PK6L!*bxT~cYa)A*r^gpuh76E;& zq_S5fP`S!2j`18d%2!!DBeD6ON%SZwx64n^4I9tY7$UN!B(QiE&G)>{8(VkW+e$~u zjdUA7fP9z@9%lEszSA1^-DUI|$<_4}gDE#SfB{vvPJ5pzV=eSCY0a%X0itA@*8<-< zr4;K#v1RZO!OQ+Uf*pXRW|BQyGlJJ$*Q|Q4Ew@70J*+W2D-8zbtdSS@;ofzn2BBc6 z2kqxwmm!^p*JVNAc=u_3y|r5#=^lDfimV>tv~)e`^PirN$|^hc2=0X$)PlG_Z)>t))NV_pL&oKU5W%{|q=2+fZv@ zH|D(i(i-*u;Sz{q0ddeMZtvzlcNdWpqW=$RZypbI`~8pKDY?}xMN$cExDhHL>u6QP zBwN<0WXUd!bxev>k|N1EBKtD7u?;gtkt|~$W{gRevCRx-7-r1O@1^(W`&<6|c>n(K zN7LiMT-SBZd7kGv=XnnMdyjJb#l>U1Nm6apOJV0>H6&RRc`tV8;>bB#sXESY0jYK+ zWZ*RkhuxS-AKw)T$lLsV#Tf18Ugi7_{rgoXDSVvkg9~dF(Sine3vAjX=(Tt^uUZ={ zzgHAO+g7`da&AiHgAF!5|1d;k7^>wy&h8LqBB}ua4$pm&yh+e7)D01ouaz!jF-&h- zPz@fk0zC$FnMY}j)3M-7Zdv$y_QzO&6o12@5>At z9>vfA)#}!61ojK&qV=UgqejFpPH

OW+rckIS!sWX}|g8)@!Swf6@k5jiPNzYErd zuCLlw%Tz>0&K^4Ba1WbZ(M)%n?fo?V4MTC_Ps_kJ{UOdv3133sVVxne74?%nx+GER zV!i()Nt5U`J#4SWb^J$!sW#Ga!Y8#amz23?vga#qakQEwDCsckQ@?z@Ztz9k*r!;T zMNNYHDZW?R>r~oEk%g{SPTQt1C-(b_Zs$b@Bk{Q$77|4(mO@$h-?Z8Zv_)urR`Rq) zaGEX3mx46@A4LZ?>m^@D3cRIey8JE7Duu@bie>-Zs`ujkTXty=)jk8zh{DezhYd3| zW<_sh0Fd-oq;FtkpL`aU*$+XJ?s7u!74iz;c0I5AC&z;Dj`V$i%Hf*By9uI9XnQHU z17Cr#PMek7{|Yv+CCaYuHnu3LxBN}qr;fy8BFL-d!400}yifd127*6EZN^2GeXg7W zWEBuX2!ecX-I=d=$8c0QMVCCMB^$gc?96%{bF+ zQ5m8Kpv7dFZs^+?3A4QSFLqKBPJ5+X9$1hC4SS#46}u+Ptv?@L( zRx#pHqQYhTlC=jEy(JgXNBq{ud=LQ~DmnpPOUH1~u`-b(@L>=zaIQ-ut#uv%RQRg* z<}U^F%^`%M`uzErAwAk9U{RZu-G5rneo0N;b;`N3 zr3)4+f8<)SZ)Jn~f2nVO>%d6Bmij(I6A)D*>|){&uj z;x2~0uWKdt73rFgtm$L649nAX;U4z%aao!tAMzUp8~L=jEEhym>c zEn88jaZAMz64>%mp&{L;sUxC%f&rLZj}-b@(X7oG`~}2 zI6$EGC)EQO76>4N>8k?-_-Y9RjpO4bYcl%3{0$=fv-}mT7iBOd3#hM$#+h1!dZ5t@ zxkmA?_Jkvh!VY*}Q=Q%L^$_uPa=KyJ&VuMt~m^$So+a~)W1 zUk|kRL7~EzVs#@wxtXvn&6?t#qmu*Za`-p0pd3b4uj} zK}x;pH!h5vj^ATr_g%Z#^FJ*12d$*M0frF zn0fg>fwShHUs0|KT?O&fPnRHVLxw_j|6d*=IZ}x#t>sgiZa|FymW9dphF>XojieSw zHhtHgM`9+lKN^6>^Luex0TK5SA@zRu2d~`g8t3wz>6o3<#Xp-9K(T>|x6N__PYC_p z-Lh9H#A^T56JmyjMM@z%cAWTPwd-n;z@73JPu};Qdw+b-iR05wf{!kLQ9k+3>FLwx z54%ol3oFv?JZH43Sy|0)Yh774FRw^nz?A~4PNu6VQ=5z~ahr)TY=j(3%4a=jIt`xW z6lK7B;-S=wW|U#tjzTAq?XeB24O4f}iz}VVLN8{jogzo&YWuEB#rPXU@kDHb9IK6# zdlA2sdKad}X+-;|afMzE_|KH>(aRT(xSKYsp%*ThOEvLdeiO}wZYnW`eHXcI?< zB{VPQNkVE+*I!pG;~`SC=B1XnML-E`51lJ(H-yDgzF}plO1&Jo^jGY#ou?^dh`tJF z_SP-dX_36@8r3eZ8?%z*-Jh(HJO+2}VKhh=mkA{)c&PR5{J;rBKQDAV?NQDwObxQ4 z9?I2g38b?6R2glDzy~%0-FL%ehJ4Pcx*EhE3o?$kAhy%)w|f74uh@9?>R&r{?Kj-U zkH^A+tMz-B*TlwQC!KX6#fD^}F0s6M%}y%)R<_OVyh9?wpN!vkzc7xmegNMX|8ymG zWUhc;b0>=DZWCn?CZlCvS|&%7Fe*ovJHl3zljnFWIGjGd@MN!7cF8e*1CDJx=W0=4 zhRVb=nw+`Mu6ezONvKN*Hd5+^4_IZhs_B*Ov`;I|2-dG>qLqA3CuEbDh8IoHCSce@ znU~=x0obFvc>>(bask+xsBx=oK9~Re($F4e2j#bFtaCBMyLvJq&N7=k1bjqM4hu{5 zuS3GS-{`Gy?ss2lKjxYwuP-*Pz+W%qoc{tO(nlNNp%yLi{Pr=28G_ z`k7YFz%|)`)enEi>Xaa!FA}){nPR z+KZ^%i#6nV3`k^9+z2H`0xPe`UvPgY++7Oc0t3lOtIpY;*4iHa;PF+?t40+LL52*2Vk*qWnVYX*<2@uNub|9)!PN6#@j=Cy9NF)-pomxj&nrPK+xaCCycwl03`Oytv zDZ-Hjdf?9Gs+J3Il~EG2D4Wax)R1*`dStlsEN1q1W%iypwv*u&rC> zSs&&;UBZF|1SxGTW02z(9X}o!P6VKzmn~%iqVC#Np#}>j8XJVq22LhXQm&|<>zd{j z(yaAEbFBOCqS9YB22aS|Ko9O4R29>(>99~QvZ1=>(Bjt%OHv;tie4NY&JfJ0%~c%i zc~g8Ai9-;E3YACAOEf4~1j8B*Y~RAxtg?|0?>1_E>Te=m{}Fpe?#}anJn)Fpi;!YH zNH+JW;Yc>~NG+)lY5DxMHgi7_Q2)Ig z4#3@t6bR1#uIZydsxQrs05lqp;zI#YjX6u1>PYg&azzV|9X}n2c4jj;S3~5U z0NkaP!%$G=mi++{j+25_v5p#-+eA>scMspf|d zGLyBrdtWf+A?REe9rwGviFPIj2?PuRnvRj8?xEA0CWC8#zfykALU1-eXu1JvTH_{j z5{?}#tx+Gh-I&^gFHLFkL98^hf=-VVHY(?O5$SC!>Kbvr>}A7R-&8ihqes5iUYe-k>^;~-?t}qg7!2IM#T^Bd20n{m!oA9#j+;t<(Fy@+v-Q*r- z-Y0_tTueCs@X;ih&~I(8wY!?}3b}z}{gP zZGbEgApS-pgE`cRX5L6xN!b|ote>4bX1PtOmOCpQ)M1svx5{hW1lS;FBWZ5yPn64t zxyM6PxN}Kqm2n>Oy&-4_h4xw;iCdhM<$UbU)Wz3s^w$nA@a1-3zb?&JDXU`7=;`tU zm>Vj!724J01b@qY*+P@KPQULEzt2`&h}FYuWYTPOAzjr^UCmw^kL-(USn!Zc)g-sI z{;QH}|Hq&e52Y&pJ|G`g6L(9Be9zv#+qZ-rp3COsGPQ5kTEK5JL;VY8W!6rlpLa2~ z$F)BE-}~M_j=ExM??I#?;=-Nld4EEtyz(WGQA`*p-YKuf1a;`nKf)QtUf#zBlmxT;$dQezSM`0*?TklJ*3$~rgE%+L9{lSN***c{z3 zzW}eZmp7}?0IeJ#-jD5@Dal!|Dl&vPJ&IE?aC6J@zh1wXg!OH3$=Ryy)^0xT9F+-Q z^ntMZH5)a)NjnO%@nk>1nNJ4j_w8XSH11(0w=a~F9LpW(*pGgF*CdH0NM5H**!sla z9%|(^hf{V@k&ALEgqlYKVpnPsW2Qzy{0$r}ECu#kT(&MwwdwfB9zY(*Cs>#{=_t6# zqBQve6|Vx=v~uoc!BD>5KHWvX^b2$E{Px4M?zaMhX4r7y`lE6!|vJDBtHs7f-10}mHxo_JLpXFfP(g?%0VLvFx+UfPW<&kQdsGD zs`4fMwWLLv^#?PjBxQ>XWru$0ZzIBP-SU*g?9skznt+_O>owC4iJ%e_@3@`2|EbtY zHEW4$oks$cPFSW4l}l=9>I1iUi!(Y3s*{97D8dZw!zD*BoJD6L>A-s*SM$?-YJq}m zNk(CD^pJ<801w9E_OVwN+ychogt3b<@Py36hpnh&j?|F4H=toR3jPVX(EIVB-t^!=ONwAIH!m4) zw{QyDUGM+3KCF!C)03gS77H5l2KMZD&mL}WeY3_M#9tBM0hFjK00Mk5E0M#U3QRzn zPIM8F{`N94sIoW&d11RSvyc)IXD)j7Og_&0!Ltq#Ee{GY`kQU|t~fUNAj0Eu!+O}4v2H4gN>922T_e9Gv$ z*qH#!j}V|XLY+zXsR3F5t|$lUt*!OcRywOy21NS%Xnz{;ZK~nld0HT*@0lw$rra82 zpLsEIGw73X6KLd(F4YT(_Lzxx0@PY-y)mP%_eT!!S7A0gc%Oc%kU7Xx4pvNQhn&qX zy%cc_BIH38j4bC(*71KTBBM6~?2b|-vWTj-2B%A{amx^+V?My%43pBIjmTsC5=i`B ztKkIp*LU}Ofc<^1Oc4gnEjfFbb>m^_+^P2#t%tQd>uFM$#LYr;V$7>03|FC!eCo}5 z7TlgCQDz7U&PLDTYH$YRH`5ea6{APfwd+&uVpV6G4?@H9gX3)R1O(1qzpZUR4HfY> zBQ~Di0PsRGu%^py277lI*tkR(1%cY3Wa>gKIg)>5<`|G;8X-ns95}W3dH}qabyac| z5s%L|L(wByx5KBCZGNWIR9!Cyplfs3n{rYYHSG4QG}ZI*jjwK{XBdnQA6+h#7%G9P zo3k1vlCy!&357ZNo+mtPNyX3w^Wb@BB=8y9mT5q^IbLYNUbf7}m9$;lUXr>0#h$=b z=4<8=TJo;3xBJKQzWr29fgip3BzUJ}J>Nt5pOpN;3w?rVFi^z$*{#f_%Z3^WP~B9Z z7l>{NkixgXfAue*`Ibv98J0dn$OieRCJ!8v`l3 z+#Au_6sHLD;DYPkwzv{(i5I^wA#%{#9;OjK5hLjhXvZGyzx;Yn@aS%-QhMSnXJh~j zasi6C$_f{3K#+K`jMhq$>hJ1dUydoT_CiPV!8f}Z{eBX(fX`j6Lixo(D|Hz;$(qlwb`9H7~>vM$NHm z%nb|l(V%Nsn?bYq0|?rE%WQnW@srz1Kb{yyZe@&GY4)k_j}}1X8nuGNn6V=CeZtJ< z=4K!###SwBjorR!VK(zjo@jU8_t^P|FEaf${nwTg;9c_dyV$vJc=xGggu3$RU1oKU zdk&lW;UlH4sSKqS?o4(r52(+)8e5{c8>ODJ;4`UQ3HLsutTdqs@Tj4N{75JO|6__* z3Npg%x+&ctBp`9_E_>8KFXGcfMmPUdZQ8y9N-;G2L0g-%ZtqXU%C8#%rn%4D!%&Wc zw81>+yTXP$9|rPnoT*B*|I}*mE`BDgWWc?GP}V+7|3`QcXiISb5*C={GuAdS!CRYb z&#Sn`y_OqwopQAWHW@ZKUPS`U^0<^=#eEw&O1-!Y?SV*tS}3$bF6Fy#X@^jd^t2eDSMgi^pW90x( zevs(RB6aSabtoTwa$+G&nKBg6{c5@!wZ0j&zdHxoQ@AsR7{}SA}(ipGn`>Wzs<)0gIC%ml;q6;5t9wo3l%6opBX zO-&QE)%w(&Sb^M}RJ9NcLm0x#O|oSH&IkvueSQjv{@Q3};vE4PR4^>~%Q0d0#4Zg= zU&DO+b19Vz$CsaM9aDOBj(tT$`iiZ1_3UGhGc}~Nbg9x(hP#4@W`<_O0FcQ$`h8U+ zIj7%Ixh*ofst~{V+*^-`sDrY5I&Y=U{725s~U+1jf7O51rUt z2DM_%56o+ zW>$;8+r!Mf?P9h)_x2$osyr*}9p<6m>4{;vhtH$^@sca1R_66iug7H04b;3Vf9`7q z5Q}Qq3ofs?lhg1EO$7i+`Sj8GR;({M@)NrWocP8%8;_CDfLE3A-duNyz{mRtO?+fa z?o#URXGsQXpMnPRJEBPs?S-4Bxe8jPo%a)HI|?(omPuf3@*GeAx&lbyCV9mV*?^lT z08#X+otS{PK!um&h*vmaXYcMzH4mYqWzaZtA+O~%zy02F zMuX>%7H=7u@p#(JW{)q5kerEy(>#x;lK1Em9ThDgA~(q{m4# zt?aX*jZRDYXu!;fV=ynFnLV%kZs2=+V5x*yNb<)t3DW#TlkDIgMn}M$-ZWkMZ=2TQ z6q9zJ-eGFl_n$%?B${Tg`}e29ctKwEstkgbb?0+=j`yMjaf92DAJC+ERPFq{?xu;qo5lXlnBG z<_)dmiNBnRe>fR`v$>qN^00)exs zLGUw)3^~!aUJHgI9~0}o6N2{LeP|ad=bSkms3^9Vmc12E@-aiSpmQZ z-L>9-VegPin)#e$`Dx3PHHddgk3^3}Qm?Ew#wYG7OS9?Q=e5f(lNqxOpRd&=Rb5fu zXvx$!3U#g&F+Lyh<-tbN(fq@@;K_*z%}k?`LXzFBMTk`AD}vwMGnD73zW0aId%8!b zeD1V&Ug|9RA9L?Htb5xZ;b*vI?y4G=)RX1`$vImWtvz{it*@NXmQnC3VxLv26KHMd z2vbnW@n-E1vN=dJSD^XKi|vM0NOp)I`?{wU<5cHHLiwrGY)DeC6X+7;CH7T(ZSU}c zPJ+CMFw%Hed3@!bRhkURNzG$E=CJ`4qHCdhs9Hi04x}YfMyATHi&#VU9 z61`Wo4g?(~<@|B@(94aQSz^SAqzvm=<-IY` zh6{Qc^G^On)CbA~9oNhU|REA-Er06v()~Zexky^jHytrhZ;{} zev)!Se!j#}2ORJc7yly85v-T}wnFNrrIqd>(yM9Wd$Lp-t@bWj=T@upMz>vF87HCa zv&6}BxZU=$S&dF_l~N_&AqQbym33q39)CpAmhTRUX2_#lAz^B9ZSZH=HL6W;N#+66 z*RxGfen-UWb#K#@O1oU51#;mu+j7f$DgZ$eNRbb*goOqJ70uE8c|Zxz{$(2apvJSX zAs_kqaiCa~XYH(BpadJYGfkc%awP1UA)g80fgQo$h)iCdWe18cI(7@r)#Sw-V=j%XX=hx z!1Yo&rLtMmfzQ=QAW^y@XjTvQ;wK7y|?`K5<}b|>+ub8c6sf=AYkkb$}4=e zI#h^FJ!(}-m$?pix)rGN&QMezxyIi?e;>IoOFi%FwR}(_c^>6Dn%#bfR(?2H`(~2*>&lgT#q^hd1wv{ub*JA?VnEgiSMp2y^$xh}la`U8@O`S+$gvGOX6dlkR@pWIb)yWU|+(j6|yex91_W7rxEm8(^5 zW0Wvtks_ypWK1Q*bdvvekg_kjh%6cq4-7&%nhPnl@1{I*`@XT3al8^PM^KvAtE{!x zo~+f`XrOr>O0D~z?}=-;5T}{uRf4_b)gF~7gtvAWoCm1w8-osZ)<7jWIS{BMSGF1u ztj2-*RTEIZA{7M&0*M8n&ZGJW$Tc4+F;8rh!Z{U{22=(988yb_g^P=glPpzRtt93p z>!TdYLBr*iP@5cY#T}SFd7Uu*)6wkslr==@R5>?xN3wEd+xx%%lIgv9^^zsSJtRy3 zD+ZI$ZRG!K>nySC$)zN2ITI&+*-Qn9!$pcBXn&>=#ZvcBkW3wa#oxKLBxOiCP6r&G zWfMxSl(-OJ{EyU|MMJ85!Alio4Y+%woDcs= z#FbQ#se>iZo_`bkI4vvyZ(h$do*V)SwYMRr>ozW7*8seUjx`6C$!y409(d!Jl|a4Ns6_JLSzak@Deq5Z_)bo#{K~xET;=-;$oM7G7EF&s0>Sr9 z#61y}{oOFBu^tYs$=xmW#?j{-+&0|{7aC;H zT?~yo2Q}1kQyy?vRx}@&OZ-DLum-!1<^jnRaN{ljS?b}Pqa7`vx6qR6;;l}kK-@`nwFucvIp4v#3r^Hc zb72nPGb@rLriWzXf+COqiE_A@7u#uv0ABuvAORAEx$l}M^)~UBjM$o^d_-93luhi_ ziOqJ;)*oq%Z!E;EKrnbDfev|D|BB!OpsKaDZ&80}w(1<>r47IwOPA^A>g{y`vcB<9 z=dNWc442a&q*s-U+4a%ZR&Uzl5ELasC&ASU{k?GKqgW3u^~~DD$A+f4C$>^uWql7< zN8qD>6V5vJ2&oEP^Ogfbh`>M|CX*(-RnHl`+ zefF_a(Dc}~;e z3~rkz*RZ2MJYbzw>g~+@ukO&Gq4vD|5ORxD2JEl&6>a$^b3<$l_0Y)qhF_3yrfH_p z#su&We;f|V7$}psB9y5c^(Oc4hVtJvSxWlyp*?k425^#4!7~qKfFt%vOEYMH>?34no^Gz|=I{eBJnO;oAV=zO zF3r-e5y%;+`3!_?+51C9{~dz4QDjILQ@nB+jnAZ)kUA+fOJLOZEeo*=T*C;sRmyyTHX=<&r5X;O%hmp!@C|K8U= zcZT935_gRXrdXj-A1fwBMeRhzUG2778N4-bg-$IDKV>lQ;hHwJ)2vp*Evk^}z6VvE8wsDK%WknWRk_x2 z8~{eEZr7Q*U%xl;KV2`1!tCW}XvzqUxA2&s{D2$1O<34s}pBeS#XU_n}rSY6$ zm0lTe)ir(eZOr$XLeG{^m;+n$i%s(3+zm+=((UjWO6Jx^_Q(yUY;zPK2RCdh+%!$gAR68E}Zr z?{Gzr`9muvL7oehGkVKh1@Sg#itQQYL4|z>#T+udu3HMg{~A1tztMH4j-(Sw$h5P? z5305g20ZkwPu_GY8?zgX45|a#%QTPqsI42GtgEX}AEcBwj4>w~fsR14*umr^p;tg_ zL%Q$e{r4aG{zJ7LjO#kM{CCndAWMq(ttcy-smoLQ%Q6?UCtJ<3$W)MBYoH{5WqV0% z(Sg|rLH6mq^Gg4*NLyica`alrQ;f-}_`FFEkJXaq+YdZ|@aXubblM)AK8UG);D&oQ za`KR7+JfJb6i=ZJVV)3$AO<6YCAPM{CFcJQxdhcaeHIRI67SEfG1r;#WECSsnEwkzS&kSsjgQ`Q5>f4p|Z`@c6iq+qW%B{v|&R}ofj zP7?EgGxQjguqwAfhaZ-hO-W1;Yu{d%aCVsh6=?_=&jMG;)-2vr!qu(%pF0Ai7)xLG zFD1{CQw_Qg)$=#`=hf$ej=2y@NXPF)VRr0K*=`nPl?`+|ocems`u@1w_jZEnseT0` zC3>aZiIGw`f5$NV%ag%tbASHyyDNgO-5HOXt6i_JP^@g7Hkd;Yy&34a1jzQ-{Z{;55v)wA5oj}v;OMP{PtxW2Rkl{VrSi>6a^;}-2k{ZU8 z15m-~$5VH23kyW$-O2{EvhDWYm3u1QC*qepYjx*h^GR5Wh>XrRbN1_-PJb9yliVkK z?pZFiPRYo3eL-$BPM!zR>_bXhl_IY@eiDGiBx`MxiS3OxJQIb<6nrWqdW7&z^YE)J zj8<`a&#iDy_fN_4lc~!;pCRKfyD#m1xrh1mWujz`=9TH{8Cdl{(7q0M!6%n0iu^jmdt|~c0j#do24j9gauj6 zPXgS2PU`Qe?R~w22VPiZtDQGraRSC+4Q5_qy2~=#SN!zA_9`?L z?}Z2DdpQCt#(}ruF#;9HT@FW6tUg69^?ourBG-Ox%NgI;^9`t^udn`&tbDK3=jpI2 zd8g{KzQk-&f6aE^eS#sd)iw+L_%(35`%XXK`ddxvfx`m2!8~M|&QDf5n~5s*QlcLm z-ey|=ZC7Jh*mZUyHc0H4l|SZSwNj5-q2)eRQ>~EM$CWYee@^8LOaLgypd@AhJ2FpQ z1(;KbB10?__Tl2W?fp9H{%ir5?!nZZTUK%0Dm!1G`TAU(y@%EjfQUVPxOKb7^7jR^ z?BE#6f>oiY#2nf|e(GsR4EyVq*vqf~yx;eG*Y_~P=I}QGSV#aE92AgF-#NYg$9p0Q z)9La<&5y6BseWmA-H5h-WhKMIy-^!EDZuvkk zy{^=&CEVt>Jtw*UZvm7rQ|a$B$5HAJ3U4F(R~;Q^i13K1feG44VWy)`c_c7p@Fi+z z7nWXqOLl=uMQ!YzL0_~-pZaq>XW9fX0?kfGu-8vY%qIm=tST`_HJ$>uC->jno>R;d zw8P2Gr*D6bbR9%F$604X@;#5(SB496T0Yp1nCVhy6K918Kb6ZKip!5Z@CB#);2q)m zH<_qK=9U4(Wdiv%dtU9BNp}Wb_<|YrDp1rFh?d{pdH+52KU^m#U*UW{v%o6D=6Cah zzCFy==Rw2+u?dx#(6O&pHCpMqELgf093yh!w0hy5}h z$?*Tca<&UcFi(|^2M zAiP&pBLbtbDfQK`{h~EJI-W#eCAUYlYd8D24?Fh!;-n7n?3@Wr7Wxu-v9_8WOa65&f$rj(E6Hib!hg@VJmUS%K#V?@^4ianc;ZV%Bbou-hrMnS`;b*U_QEKX7&)prat~%7 zlx*dN;k2{^U;6mDW#`GwFG>eA)be>=(`>G|I61>fVhjsBFkaT!R&m%|M-I&s%nd<_v413YQ zd+m><0^Z|)cU)h7tL<0ntqV`Trqqk9TKNf`FH#^XXpz2cxd0o7P!#Ex*z?$bq&r-S!c$agUBPIwjiYx07lpbyKNTA8)?HhW6{#~y>Vsa0;*o;Ms3Yp*MWuC{E1jcn zPh3$Nnu9%HDFTXbtnqM&%dG-(1nbw%R!Irhu8;T0<8)n3VCScqnr$#oSc~M|sfzY0 zY{Kw&2n|W6Lzkz-6Y6jgt_;79a18LOe9GY?6*M3FfbIlK%$Z+84nV8=L_mrrSQ!?& z7CD?+Ky0HytUu}om&X$#+tXauI5-$}0YV%a52ZNj{`&Il0U{;sYvA#U!@`3=m*P0{ z`x#XFYXFFey`K2ro!9?;uKRZ#Rp@m~*{3SG3%b)mF3jeY!Bs?t12C8bgct9UGR!@N z%#aMgnI1pgNA{;U)-JapDpv7QN0i2~Y@j&uyE0{@TUeRX$;EE?#4Iy#9t@7XHIkjxx()xp}=eq_?kcO;7%;g+l&aLdqTsdR@}U4+$YpV`_dWS8;&J{#aJ>f)>$B zJ)9A*MdkBWQqHQfjrcsScP0wI52Mz!p19>>`Z_CF22t?0)hs0NqST-&gr$ITG)+hI z;nM!_2P;#J&bh1&R;NmxLw)dYm+cx$0ddP|pEp(ro3f0Luiio1D}ltYi(#zZ)>agY z3?~B{)RV#>H357s#v4svTkQ?{3XC(DYMH)pDsSSCABZIa{nF3ZPB`zY1Nv-hAFHtC z>8XsxW(YQNhN8=@vGC%q;`ibLD2^tOv?T-!5PpcsTWx}!V(Sgca*wT_lk%?lvu&l=?zZ6)JoOr>%;d4@=X);6TUtZisj@k$SW}2*4NuXuGQggM21?^?TuUV?R`${ zEl9K=X)^xt()Irm=y?mW31VNSjTt^!Z)vso{DDH&Yy z{d94kRCfx0rDX{ig?v-vjj2a%P2lYF7oK*@h%DA+?3o|{`Z+G)G;a6LzTwRuMvF$} zjqDc(JgwN9Qivy!3uRb!gk@I5#xi8&aopQp?liR)>{MH-4QpXtlY~6LqPcIOgO7tUcd!!!Uf%p_XA!lQ&`VJQY29&S?#u^PN%OtpL3^=2HTN9f#N7P-vwP}RU=!Ij~TNq^p1q!uq zjvDNUjLn1!o9g@055i>TS%_yO*5>m}Zne7iDlltk0AojUBKS#QeHSulW%gcaL#{tk zpH4e@-z+<3VA$==b8xf;#B+aAl?R8 zmlvJ1h~P)a5xO~fw*j1u4S(QeMqZy%&_WHEX^+B$TH#W;Yt!Q2)MUbo zxHENHF>zRQ(9;bi>LX;6FcZDFX{EcKO^;TT*Iy~*&bGG~nA+4KlhrAsoNJO9zMg2D zCqWsI)?3vZq>E1%0FkOSR@5Z@XBLd6&7qx$9daNBrDRgGcZwFy*|hIf!yGQ|=RnU# z@kV52yzOE4O+?CGViLKua9U<+JtSbKw8`f!z@Zbg{`AAq_)`+IQc~vxw#A_A*ySMz z#DkK+3YwL!x@twZ%tqkhX6`U}t~^Ezwz9cfs@#`DXHnnkf#AG|^f{#*(Ia{nOZhYQ zzM~ry$S<)uIQB=94A=8aMo{yM$By4xQTu>|>NiQ%YAE53b#3n(8{UuipbU?xL9 zymo`H6{dpST+!q;`X?7JVg$IM*rqRlw2W`Oj|kpgKOn1_Q@!C|ko7pR3_BinVsz6J zO+7NaYW0f@jFm1KEQA(9gqDTrlMd7CTfkGTerk=rh=t@ml^0faDQ^LI*%cf$AqpU_VG=dGex+x6i( zjIV;dfN}Ie^(2&T?fSegQ031 zzn=q$qmj#!G!69H+gM;Ih10TkV0}u+;JDsQU&1W}V%Z)m-2>v2-56D($dC<_78Up} zp%x*7b$Dwk5`JYO>shnOJ<9ha`mN$Hn@uumoveC5H7os%mM`hhFdpCFX=%7a@Zjxj z{IC-)l@1y_XG_`KEU2tJXZAt_UpcAsz4UA2SO|ZDK}#E67%;@r4LHw%M<~I=ljJ?S z#65X6d>$u8mo)cgqJYLrD*D8V!Lok)eHC1o00cJnDUkTzmPXnQbQbIAmfF+V zD8JR~tMUWJCUDa4wuVf*%e|SgE+R~==DD@It)x~M_@co>Q`#s_F2zAi#&6|{>!WF@ zg6g*Q(o2|4MjD8p66fN}H4_|MUIV!WJENYs-YqJ0g^EXCu`M6Su zPd12(w1ob?ui$^-kkcbS{Tf)7G|htkR6mr}sk-?c4OroM zuFHpro!l!jo7qc0jP&&MEquC=4nN|;%f9r)sXFwl;mESgA@wXH+WW~5Wkm06vM1K+ zQ27&qJ^yC^Z+{rVqfm>x*t`TAkoMHp@{7gAsfEeNjg(?ZU;ov96Sa7SMufB(XmYiB zw66ZUN`KKvaO0%3D}LQ?`Ma+3BvZLxams->`_VVsm#}~)bA3YAPsvDw1F?acsPeBc z%@dI!I7qYZ*m|4RKFDT&N{cvx`F^u(l+v9py4M%JkUp?p<{KV+5kM!{bC z!Wg#q7lzB`BzKxcE+Id6j;e`g@EQmDDeB~#<1oGrxA-F$2d=tzI{5 zwBO7eGPS!ogwnG#4%E}u(V`LmMljOJ8IG)H0&~D2`W`WRtJa=%HOr7J-qXGgdFWy3MGic;C(7dO+d8wG$#HHBjBQ%;@2yjH2Rsz4=kR;*#<` z5Do#~8i3$G^_z(KKCrxSbgYAu{cPVJ_y#Tb^Zfzg2|Az1iZ)HxjKOVE+*&OVP~)(C z5AIG;y|bD5Ju=?El_9J1%s63%V{pXM0yyk)*pw~KKqF!$iBFhW9?j4+ovrSWHaO<@ zWyi!fPS$=J9LsrrWuNwG{m?B($;k|SygtstNIoCDb=3Q@EWr?BKt(iHug_GI57)Ls z4*oD3E{NhqiC$FHTRWFvJWvHWyx!%;Q|JF!Wccb$<6D~(IMWw;fIE?tk>p>C70L+Y zk2)AQ01^fh;>);x1Y#{MhOQFuIy}J;DxeSAM48J3z|K7u)912Y2MdC;jrt1zw|4SB z|IcyPot<1ey`v#En_$Pqs(YHjKZKd13=S0wsb4Mg$%HL317<(PM#t){Px;}(H@(*B zd>+DYJ^&$$flb7m(1r27E`M9*Gt@!Sn2j>um=x^q!Bqu*+dzMF@v5jkv$uZ6-WBH*(5+F83zBtW{!aO3XK=`@kSKVU_YM3{5$5Q3^w@OIgn7dHkRL#KeWu^$O)OsEFFGRNJS;_x6RIZe zt`~)gI0*}VEr~C124@SkZU68OfwL)p-?P5&AYPq>bc<(I3Wv@LGrfokuJJ68e;qo8 zqQ|kFSZeh>gb|nO1FcoU_qC6$)lL8~#_EUJA^y5T&t7oI?;)Ffmw zy=T5A(&|}wXcP-WQEQFlP;J~_tKmA#9N~Cf`S>+@7z+|T;KXRWkmth%UAfLUtB62z(6BO`N@&sLZB#IAb#f)#i+-6iPZeBox==o#{&g6HfOk+qPY2dN2} zT=>6ed-Hgx*Z+U`lu|fSC|k&q$vW9(ZILBqin3(Oo~&ax45^T8AxpN=NhGosW0z$H zgOOcC4B008SY|BuH9DW)@B6*)-+e!h^L^Zp$9eSM!TWt(*X#A%Ue_B2+fXBa4Wfto zjxWB$BOUGD%2gDSkC4Sp%AS?iOc7sAD2p)ACYW!_WIP<62JL!l&Ne05I_#%A%{BTjIAJ2pN@E9v|RIdW678 zqfU43ZR}~G<~e8Z$~&^-&jq57k8O4OH0_7qwswT9$WbWzkGt)D z6{(jBzDl!G5?<;brAfC)Kb_$-AhUz^4{%vG8ejtV3kb{o;Nf&R1B=547St_}i&o=w z8szJ?Ixz1_gvkCo+xQUc=+|k=L8N&Yr&$cXUfx^F+0od1 zXR#e}w^MDKpxMX}v~fM8yF|YQe`%gE_llyU_g;ua-iV$}fC(_@2ccM!wr&&+z&lahfP!qdG#gi{IFqQzOT}l+B$EDlsih zD@Cp3&IBzNlpjm^46ELwS&fkm%)X?Oy7_G&{nY4kr;oUDDL{c?J-bBMRd2n(_0>%a zf4$AZ!hrKg9zBmT(334zC{TJevVdCJIxcW%oQfjI?R&j7F_rVmNzL-89ZV6DvJL%Bhx!LNTWsFv}=RC8l}Q*j3t^0J2s7WYvBva z@^|&8C^gL5R|jg`8%R!?gNN5M?Q>5OMucXD8?S7^QrXA&4}vNC#x0kXZ{xUjUL7t9-^NDw$pC zyT_nG4rrX&LRvq${+KGe>N*~E9PEVwlbx$gW{YIP`1Lx9QmL{kchKtzv&CK9rp{^9 z39w1Wi{U$(4XsSd!e=jj6m~Snrwnd!fJN3w9fAF)<9wP*s$H8}`dMBr8vw~527(LQ zG79>ri#_{hcCS~q%XKus$hU{9^H2HO<*1(a{MH?u#ctsy^baBzxJj>NsC6|z!8J1o zuAHkzIbpA6vDJ2T{BsT}cDMO4Z+P7iHxwc8(#Xz&+Uo_R%C0eT@-1)b@6xCkteU{H zN87r4kA9bbmJ585=yIJ;AS(ajDMM4$PrKjOw?#N-N+(XJZ7(g6 zrOm6l{!E8f&v}w*oiT6f4TiY3DdPlF7f{T zS$hjUwcL^+Hy0xjo=NIrM+pNnZ?rj4Wow zGk7F22Ciua32ygG2TGp>dP|4~iTD~AqEZ373>L@nft{;Y`xVSd(pf*{DtNt8ho2?Y z5jX7jL@p-+SgR(vv!eB#^1dnqkD?{J22qB``RZ2kwoGO{)}gF6w^r14>ViZvl!MgK z{Iy}wfbocNJk0;rb`rhr@gY`Q5G`9;u5E;#vhuReO44zw?#^h18>J zOwOfWwivsjh8^zh~&9I$`+=0F2Tv!-W&?fJT3es7# zQ?Qaf3L1Nz&8*iWWHAQog6R1*?pE)_e`f-o;87A`QszWwY`tX}#=|LrexM@z#vcD^tCbT|8v2VkO;~=lLTn<*sSV9e z50|?#?U5`j=#sEOv6*;S*#^_z5>tq)g|DT;Vs(&1jZfLY%aq~CjC75lwXaIxm+wZs zvOtkB2qDVA;gTTPbCgT7!Av*mTJ+2*;DSB6eWdxb9PRh0dT(S})goiU7kZ{eH?xr9 zustuRs%5bw=q`oa_CR~3g7WbNVRoRZbLi-!qk1$d5d1*%w;V^8KQ9IEo+(FP_iYC3 zZo!Q*90IO&lLn$*(4t|>bBkOU(3ck>pYyi7b}PTgYrY?2k@Y@c zFoIq^*z+(l?z#BV5Ojc5X`(77=R?Nj#Q~iIJ`DM|4EQ3Ruew|RNp0)N`;R{DEInqK zamZBrS*95lv)hAh@W@!*cJou_Q>9eQ-g4#CMRt}pz`pN5dg$iB_eQRxQrI#oCcAYS zIqYls($#C-JfKzkdJI$GQtNoe#^%u7tpS4YOiaL<^@dbP&D#-aSkNtniRZ0#e=M~I z?UXMmLAPs$w6{~`dCz1}#mV$V&zxt=p9_)V%5#!2V@eP5-R}kiZ3I)NF%cbKOWvYe zZI&FE7Ihw~{LV6?iPV?KJ`j7XALYC4cUa{ejFX+?bIdi}Ob{IK_g!~Yla_U}@cnvy z9KTEaO9hZOjRL&~7fDlH_jtKpo%qDi-gE>WzDCXo0+k{_%u#UV1&l z#MOWPk|hp!PftqYTUA~MVc<{6Zb?-mm#Qahq2YCVaXZ?mZBr^5uADDmICj?UkEE;X zg(sDFUfGA@k-Mvb`;5~SrdI+vrcli7Q z)8c`rEU)##H#SXsdKfk~hJ)&sSbVBXd^<}~r$NKB8&^uQ;8Fc=CQi=Gbphk(=``wKBgs8OJ?=2UyFa*qgH=fGLYAJ#NDc_V;Jjp^6j4yEdt+@x8@A% z&QO)J2Jo#U1FvC6dKr2faKd($299maV@&Z_ag%cJ;@vb3CV8?x6bI|IbKi)eY9eUP zs%H)?8NOe2^T*RhI_#LzS>8SW!8c*=G|1qCB&x)b3TbL(|I-yYJnWp|il9?j+%M}9 z6157Zh}m~4hD*hZn!y6m3jEt$Orz(|di6SAUB|JYw%Y9*>(YY)sZvcXFHUk=MGHu` zY|T#D9~Y~v(srI6Tc#ld*egTu^6Ie6v8U!Gx&K_=qi)b8q+nOTVdOPyLc!o46=fO% zHcr(s1SXWvfO^;T5d^U$ekMlcXR_P0(s#-2cKo&{n*1TJAxCxR^-?fX;005+FN!^p z`>or*h{`S-Ed(kk+Y|j+cvZ@E3Dso=v&eF%?+bKm{!9MyvIl#|>vx0OSZ2b6lmL@@ zL!netH(h-OU(xCWgZ;6tY4Z5&Q;W!~4!X5Sov$o2I_FLtv_U0YUZq=`vQ;>lJRj+? zJhB?7{GHqVunLZA{|D6u9i<|cz)i=el*r+x|KUD~ICgaL#h%XOALFfP2U5?dTUZgu z5iRvXOuJO?94b?HuPppDu#>blhBL zeVS=o^OtuspE51Pg?a4%6qm<`!8eJNcD?k-*Chgj9lN#bZ0EgUnRSN(EyT1BRIP)f z&OG!wj6?~Zs03;dawI?l{O@Q!I%4%^!_c9%v+85Q{SSN(BN-!;4)_2Ma;XoX!y6;- z7|mK1TuawUeNFX@7Uuwf(f_>d)u4>I2gmh0XIy4_b>~2T^r55o876fznShD3-njVf zbpJ$rAa}uYPjEFB(E&$4)`H1Mu(N4wJ+;#f4kl`ZG*tP1LD~ElVSUR z!9V|}>qh3*5puTeqyImagcX))5drC3Y(uH5T?!5qXBEhUDxDjoMZBVxnEFvsaP%Xr zmbcFMicO52TV71v9MD z4>p)e5c0M#f!qT1{A!Q)H5@GQs)BUUI2`o1^dD{pl?l?}u@W%f=g#7siMQOOZq-4C zqa{IKC*#tWkC4eH{1gfE0xsJP{hma+wR-jgo|DXo%NyWBr+Gc>t)$t_$22GYl>hcA zJa50D1=rmC@y)T2ajar3ZuH*jfX=;<5-P&nNF-f3U@g9e9NSrEp!_P|8x?h& zqP{G1iKUvwKzSgm`(Q5x*V@efyG`|=8oVaWBZVQK-RiF#3ju<&LAb(xA^H(2;0EGU zVK|8)4)0%WyY3G+K#ys+Gd-;m%ya(WK;${&8g}7^%0kbH=KLW^$H1}Edp&af&S(b| zvLVVf;PQ9p-;&+P<)adH+e+gpKzQ%7ty90(cbK=(zJsLWGN6)Z21qN{3>&uOfcDLU z-~~um&oOPQNXLonTd57Z#o?pzGl!%_fJi8B8cdwrS~Q3IIc3x#-e~Qn{GcVQ!*?Uh z07+(=pPv`AJ>c#GRgNx;mYf~`(>UBOau}2E7l=Y`FjAbpK}Igf^-|ta3z%Eusg~WT zxcP!A380Jhjeig=j68<3;ElkgUxelUQkt5E^sI_O`e0a4W+M+;W-E_-ssZ3f!qB!V z@X7Ut%~t0x$6>a~3aJ@9jyEiODZPz2+^O*{<{H1_t!~Tn1yTzfhQw?A z&I0!&QSdXM?Ed^W2k>+Kw`gvx9XGMG(}nX}5B;(t!L0aAdBK_&kN}WFm zeZ{rL#`$f)N_GojH)U8RUYK=4?oGx}GU5Yaaz_l0+PG>nyOKQr7So%F)0LExXhI8k zC0U_%NAIi_>O{_m9LX)TRq5y%dUq0h7!qb_)@!6%Ekik{Nq@qCO&oKX_r8u9U>|oC7tm$A|r>yBALp z5T)?p(i5FImuBP7|700i!uK|6MA}ORUXcHhgk2tL_2gXTfbr`rW{_WOL0uojY+*wU zR-CwUU9BgG*PEuSHFC%0k~kRA4xAf=-dStL^4A8>d%s9TQkwO4L(&KN*tC;7LX~S< zzJBtbLhAA9V1Dr*y_gEeD|A6lYl(={^Xu?XAG6=a-(W(7kO6O2wfQcmcY2j$K$CNM zYd&4{9QP1S}f)y>-RZ{_~lg?3>)sejfu}B@x22kWg>Vq3|{RBy2P7 z#&Vo_2{Y;9dD&`>p%kNs4`aN}VBn02IL$=!4ocgiso}A3chvGH;#N@!&)hk^F@@q+ zL6@GkZRnvc?%*8yn%!}EIm-%Oy&t=8Ti9x7m5ZH|uW`SmXU#)kKW1mRBnq|QnJ()< zo=v_o9dGa;~9PZWO2@BNWd^IUsZrevU5 z4$|Gza&ttSbh|5GbyWY1wMGx3!i*j7>QQkrH_VnjhQ%JrFM&N#p>@r@QHFUzK}AJ_ zn|NRTC!%~%3Qm7Plm133=1&eE*4XQAOLCPd)~7YSPlDGOwV|r#tv*<11nD<~%qsVv%(X7> zH7rOytfwa_fGHw{R~$Bu))6!0@u-2>e4J}}F=9J%eucQHI_p&w5Ht9WzSgz5g+5Ib zkJb@fh9iOYVR&%J!5(-R=_gMXspv!txj*rL^d>rLDblC8^Q)ir-ls2$=C4idmBXDr z$Dwa)R=;%ofs$eGx$x~StoQ_{p`qTf)T|SB-Wk(o1y7eJ*;pqU^^b98vKdXV8rbH6 zZqYbVl0H8duGFvGpACwQ%fnr-aQ7NmgP?BKV+FfQ5`7no{qtJx?@ZMHdEsG;l%VcG!7#d%&abNFID=e&$w+?ojMYl3|_Z8gh65 z)#O2$F2>dWsMv~bYg3$fX8Kf#kt|HWgzjjYJ@q(Sa`};4R7hWw_BG1(ZkFn(W|e|q z%};wB=ySz~HFl=Y;eE5#vnv5DQ}1HaHWe=}umKd{Bjj4(a}!PQ^cHRk^jc;mC16b# z*@Z8NV>hHuREk{_ISqYjo4mgtU;J_pmv(H?y%h7w)MdohST9#Mx#}bTu+(cfrDcq1 zyPxdUDqFM(ygrqwzloIcr(s>F>b}z4oe(m%&58z z11ne$l`qk^Acb%BAse515W&-Gz3WK~{Z3YJXo=yv$vtCl_8?r}D8aMMx_~JH=UtE| zuwb-ml!|!&R6%z)UoW1WF8)D^E|NrAGBUHN2sNAMDXi8#zZ1~%>>hi0B&$puOyuQV z5q@KM#By@%XGm;9MH|}Iw3x}bEb8u;0L(8!wdELC$bV5{dN1R(zc^bbG1B6liTRN% z?u-jEpK?w-f+f4oG4X68&M5Zj(?CD=$vjT79`Pod&u%yebS$4TI8Q|`-}#kRSqTA8 zi0a&Mmr65Ge0aioH8mQoa(R9XYtUB#+Jw)3{NF>#Sv;GKr8Y&34e`01eG)&W6nI9SB$5yWW8!4c@60D)F>?IfDo zo3c3g!XRjQxoVj12YUyy2uGoyMDHo+BNepJRAobL0VR;Xv9Jdmy6Ay(7D(9gry zr5?xuSds}FV7r+pU~4fLIB{v^gy{O0ch05;A0b`k_dGKWQu;xkm^|9=O;qq6$nSX_ zJzy#(gT{vEeyw3Ob_={JX=reAwkSVpS)<@f&24^cSLuzuUY)7=3TTWhoKfK0^wtECLoeriob znLf;VH}1a`zA97F^LXf8R_wGyFB?GED>y

    P2SR&s=9r|*`#r&~E##m`He41h-n z94e6Jfh3wA_j-AXa5YjXiN`uEyKhXlr^P=F@rar4jl1BLIQA7^u?Iigr-<~bS%c!< zV(-(wupf`?9Mzy5)sN|2+L%YE|p&ua&@kq=%DA{OMsrFXJu zhqqe4q@Al~pVb^?WL$_!Pk>*wzUE(i1%j1jXCYIdY^0VZFH2MgAez`@2A~-&<>kHML8quU2;y!B z-=?9c%P5PFa~{?fwrNFOC(T{lpfS@?WkV~XJ8yX8ZZWCIt712thqV=Ly@t1R&oKG z+hd!ki-K7rUf3w>B71wJ^k6rviZibMB{<0HakMx9=Oj{&6E|F%Ag{D^wp)!z>0L$y z1fa5?w3OJdiz^>nC`v`TIdHA^eY-qn(BXH0#iK&DmuyDEr(l^VnLsS=bkyhg&_##0 z8~KOQFpG07v|?D_^RXvz#*w^wPgO~h8BJG_rydw?Gx-fP|6Nz?N^VnId$U6qECxSn zxBzE&kNqeo6sM3Uoq;h%ZXqT{Je6u=eAWDsy|6l0htn>G8s0n*IpR$fo9>rxjm`$f zoVg4_fB=$~Wk8u}KddbbaFA?$Jh%1}fWp40+8DF7rck`B3*od6Gy zVO*=0{defaI>;vNrQ?G_7o!|_x>ntq&B(jVFCMvJA$m0SNE#(lRwNr|KaO@Q+dZftZ z{&z1PnCzbx63(S2Ds3Tp4|F=GE_z6v*!x=6JA9wOBX|mz5W_38T<`F%DhE(#)DZYmUg4Hb!94aeZ{xi zz9vp_FsqDbPDEo)`?Z7&5l?PnKsGpiPB9X>Agj>RQpK*XvMfcnF&oBHUZA%tsF9V? z;G3bA6n5S%0zJW}9>sr$s`33G}&y6`tX)6FRl|b=FWN)n+oz|%? zOF{UaDt+Rv6#w8-oZEItxRFnyJ=ya9*`i0O3dl7jHt=4K@p8@h zIUdwboZ-K?eFQ<~A4-5bN6Nc1{_0~Srpds>5yA(w?R;5LZEfe>gBFnsT{j+#A0c0*@dbao$u9*@=JZ$jjlO3HVZE8WkgUM3 zt>Ig_PZ9lHy4I@2WpxPR?(LF-m{Qs$?cG}tJZyAeWg8NO?g`u@r)yR=MkGsUs(hlC zmS|G&A+skj5Vo8p*!aWsAp|%-skiBs+qEZxiM27S8!xL&-vie=P0=Vs5kPI9NbdPU zu~&CRtgudr5;2a=auqtnmh%`DY6rA66LegVUf}hMTa*MR@G+Ga7#uY1_nQ~os`_f! zs*I6^yH8w7#}t22kuxfgm02nEtfDoxi(zG(d(P$#AtrJC$eVvnih(-+!6QtV!exaT z2u?4)F+FC@x!LpA&6uZ06MeJgXda9(+xvFIF9w`MB%-=EU553LLJw<&gl# zX*J9)2SWuneDO|+T5w}-kPkJk-F5US?OAz-NOT$aqn#KFPTafFic8%; zR7KUYuZ()Zvu-*j3fp#n$Uyh5Ns|40Uam}2r9Rp4wQAG0x+49MhkWDB>cS{n&TQ$A zCxxGV=ZIlZ>Njc0pJL!&uGHciu|F#?^t)o79)^pug%MeOeuR`-p{9Jx%o^GYBAxKJ zFgpZ5=1zUs+6%s5Q$cNU|H2ah1YKn(me__C$_`zqq+L$|ig`-e4UA|wgI5zn#rCD} zbfbqYs6J`eH8UfZ^VcWkUVAyg3MC7|Wq#xgRRs2bQ1n%sN*+c&iy^k_MdlQjL@Sib zM8Q+cgHjzrS~_?5!rR-{xoFfdR0E_gCybL$f%bF1ndm+@-LtzuuX8wRj?a}>QF_#8$oI8y&B$D zhd}{lOXJ}k3(NneQDV1WDlchfz>~D(8Uui$qIuAA;(3aysPwp)kwx^?rV0k-Rh_*) zI{QN9*5Vu1ghTVf8A#0x6|}onZ++X9+LeP^f#yY$q+tDPmsLU{@W>Y=LH3RH8B3-WWSP3c}F z108<;aqzHk`KAIvqUttVmGlDJ(CZwIjYuT@Unlu<@2ZzfoS|~`59Ri@c9IJm*fk)d zsGD5>@IZ>N9$Uw|=`pmcopGV*ysBK+YU00;P_|iSW|IUNFtWuaH2%eWLC*s3l;p=u zcKrE!Yp&$M(g51T1Yr7NKN>LWKYjGdiGzW0OZf~-I=l&A%?7|_v6DTs7}l@h)vZH1 zWG}Wk&YarNZS6>{Cv*vwKS>vz9VSE80@5nOE2g^303L?Ma06@^J$}uy={#M$xITLf zhp|8Nv4UzVl+{9qzz1ug|9O+^wa_L!jCAH4848b|2Ks`5m%+~!sC=m5z%?3Qucwq7 za}QYNUPlo^Ftj@kqj2*#UsMXdxNo&|Uz8k8P9D32e3RHO?PsytG`k`GQO|e))7t}F zZ{FnQv2*8&O}ALPvQ3zi!u4cFfpI| z2J-nyuoRR$#tv7w7KRvnwJe5Vnqry45jKf7ie8c#>WKw2$A0!>ntL-jeatz9&;8_` zjE8 zI{UlmVm!UElna~i@k4ONn85r#hmu94+iHSUp%*rM-&`)3);pX0y?aWu4EL)Y8_eNU#AFQE z008 zza<=r2zrxYwJTG}k_-7C^oL{BwX9y0!!fk^?SY||(%x67s?POP3 z39PMUtsB!QK*|lVE7_vl(6uNG!xZg~OonOB7o_2{z;AlUcBMp+`Tx_lp#$ z{XP+lq|;fg=h(0hTZAkVZGS^cAfM+E>eJ;0a}=k^d3PKC+{crH8s zJL!(V7T!Xu0FK->f8o{qXZDG;@&>)rtv=RsmYUv{%2B(+9cWXNP9p}XEG$py>P ztbmEmPZoV{OKBQ$&pn4xu|oaY8ok9Y>gJ+Mkce%n+5(5s<)G+!hX1x=a7KTNgwCI7 z!(H~;G(mIkqoWr0&AZPbp+1~j5sZ^G(!}-6ee>0_Zsd4fb%qsp)%dTbBiUO$h;~3J z5L%yX)x_$RF}`W&rK=MqMD-_A>^Z&48g;%MzuK^&eP3;JOwDY%A>%7jtbec&5JKLr zr#*0_O|<=1))S?>k{2lr-qmttsK{dr^&4T=DPq{tsUsDm(m=iZHxuOj-e-|c{mhs4 zW(Ut1fB!>QKq)qGvembCh+b8;p9KO)K`z90WUxpr*YW7RUe`N4ExH6s)|>Rs=^5VX z9_%-{epgjYdN;#gJogJZ*sMl;$VQdQyzYJuf{t_cBTH^K4E+)HSXNh{xcjhL9 z=R{*FMkV!b-;Z9jJ?m*4dRN5!9PZ-Zcx8&&zW-&qJC8%f2pU(CrI&uu$K-mMEfr*1 zc!JMz{DiGA+#Yc_?Jgl3&r%hh@L7TX{=}; zjk|GOP}D_|N4jKPutdrblvvOUab>Y0zkA^$8Wr7xZqbL(qB3hu<=_n6ffq*9)%5pr zs@pj(4LTtpuXGi(K6BdKy%`tBdU=(18E!CESFkk!qr9wV<3^n;!7)0fNJKjcSgB_K z_-CJHvB_a)045GR>I0Synv`=IVTR15FVkRomZdu#MQ%lj}G zZBn6Nlar=-Us8UdL~Q8OKIn9=0H8BX?b4e1)*2*vu_s_?i`Qumh3Noff%Cw+%9Tvd z!z$b_xD95&_Z_t|tpAIV$4NFu9PKOWQ~uk?!$GQHb8qh?TWCEn<(^Lc_(T8E!>BlM z0a8}Guh@w*MiZa=s!_I76|j>f+lhXrYfMQG2@G5#Gh+NjC~e}J6l72OVrrY12d;cm zi}of!nkUw@kH+4J&`P{%ON|{(elFgJG1laz8vf70Uuns~k5vzLu|~bQ$VIhap2yM1 z#1PtzL8&y(?>e#XrXj2zwnvMLGZgp+ewe?v?=OPUC{R6w(|7OGT?gt)kDsI-tj!a& zeeSjLMC+ZO)+53-nW2amkZSC9=>S{Lg^wkk${PKvvYg)8JW`LefL(4NuI}C#0!4f$=z(BCk$Lu&w^BBAIw^cfYdYOa zHQP;ooI?)v#Ki9RrEGH%Y;BBNQ}9`~KNHju zRc}x+U#cfE1ojOxQ6=ijCTzLU0RN$F^BC9A2M*xY)Ndal2iWtcr%Z)@lgU7xZKrFv zRg6>=XwT2J9yR2G$jE(S<684L8xq=os>Ip+2_pG5r@5bGgrw{zXs_Wgulf5h#i2*m z{6}wDUsEZKUf5nsHgZUKM}W^i9DI#vc}_c(f~7C_OJ^kA!DFhS%pkubE^zc6*5r&j zpI7W%D?x_etN4qcIep_WXsYr3wnyUU6}ul&;ak<4}2Y5_VN%*l8CXVdb{zo8~L@`D$SuA?kc$X!DPe@0C<|zsfTy)v;ee=@&P=s;80OgZ&jj$lhhlw|O57pK3!sNzdafDXV-v*!K_Q%e;!9kwYsMS)b9y}2_ z#Sy&2xOsHIX}6#9(I zrL?VE%j}}$0$XkjRg|$lqjjTVP&)5W22qO{P%B2zH!8LIM+&(-YA&rnlb5jQEjqhI z!cXzx1~OSOm*apT^2@;nhkICNOgeta=N79;>9)ug8OrDPyw}Yd_m^5oGQ#J)55scc z`AIkV|GV2~^=L5aW52in<5ua4b)3wjf##@>Z(q@Qbuo9KPl8At7H#^UNZoJJ!Jt%p zO(Odl7jye9C=^Q&9#DvZW5wukdh)|k3v6LFCFCb9iT9~s_1>>bHdB4TKLQcKN^ukC zOxO9DgTmBghWuZHz^%=ZF6Hn3BZHGezwSKb_<&}jMFfLAq^xkw{%_|miK}s%G&TPQ zRayB3iGLqf`63pfca(vV(t9sb^kYufqgynt$eX0e+9V`rHTI+HIK!DFD8z^dD=Zts zm>Xsm+NWui-+;Ey%H+c>JBby!T*_W+FIiGF%2O<%@c}F7b=1o^`mV<2Vb7t&UoSv9 zLcbnuPyA6jM2o1UJ80LRId@SdIIx?!!d|8tOJv|qDLy4FTMy%BoG`Xl-IBmq)wv&w z8P}iXvVGTkl9S;>cnCsKuDY?wfQv=vXkYK0e5joiGBVJ}z<~w(@hP`)!m^A(|Fzv} zdCa@eh34T`X3vQu&^Rbe+J(dK(Cl&|m~P}R@mhdOd~W~i$CncIevz1pTICb%4{T6( zXI7pu_#Csdm~EqF!3Qf5?RX#MzL4uO%=Nu>K;0tc2*9S?U@T+LlUOb$^B4w8vv7I{ ze20nfwH;17aJ~5EO%>3DBbKifT&Wv84vrXORs^Y?+{my~BAOef_#EVR7Dl9W=U)HB zTf;wcXl~!+RxkUO+|rrf>B}iP|H7lkc@)1klt{YG7MuRt$&{7sW0}@nMS*9JD87hX zUhm$J(?!C28koG`vA|)uGP|4sjcj=S+xzQ{wKZ{K%PA3nN&XI4d&TBg;L$;o+Pgua za9r~0P_-?%Ey4nFV5gmGk|97-tk@Cy%GTNw>1bUY>-ezHP{ zLI$&yGIcpK6zbv-ZH)D~ma=E`SoBrurNxCR>kn&Q9~rE?@%nE69gsGz1ksRwO_d@L zq2uxv`tr#a&vyB*3asXRiA#6nhcCLY<)VfFpN~aWo>5O!DJ|U2DDH3ah~#z`ooFsW zTDep_VH-H6-rbrAt}racGQQ?7xhIs^*KgQfS5TZjA5Rux7n*{uC>kYGB}CvrTvZW=y|7ms-#w@S zk$G8^I;@`e8VUKz+qxR*X!U5O!0|!M$M0aE_u(hO63?noga6pITOK9K#a%De^6W=v zs)|Om9LmgvWQlfhJ-is%SlVqFB~^_&*L&R6D0iDYIKNUUC&3{e`I<@Z4+zDh?EFjaa5N zQ+pn^`Jg-U7d0#R9LyQL9^yBUe{3jUmc%tOoFn@{h&xg23)OWued_-vV=<5Ar*-fw z^7Q7i56XrL=$y!1^AmiyOX5$d)krP9j-QX^d2FVr!FqMJ55nJL{ZK>Ep z4=?XGYNx~69Q zF_W__1sg)12r;Dzs(@E_b=7I2ZmWq$o>&5-8b2&XnUp9hCzj-XBE_p;qPdk~A6&wK z4*r$N%%f^Wa&Dfjil}Y|{v(m@3bji$MVUxA<5zz1^R!b#kRTU+>uBtGj*C<+bfwY= zh@n;L868`0xj3oQV<;isvj1V@vsmxxI;TA*6IBilTr-$CA%)}0cz4XNsr=&nh9j|3 z@>(lKplv`X1ZE2~%a$4hl{J#!HAb8#y^?--539T^lWtisCT{^$2@nZHJ3+kLo3Azq zs>Y1yRy1STeTG6R2NU3REuDZ3+7tEn{RsZJ)8*8Z)x8=OQRxUUXOj){Y7qP;qIWc& zqdX?w;&BQd6(q9Fud}sxOazl!?!*A5(XtMj<=LM`qaw_+j?6o8`B=12nPW@NvVZqr zXScvwM9E#GpsU?Qs)D%Ov}Lsm3dqo-^OCYln49-8SFfqYG^^X6UG}Ibi27(f)G25b zz4}Zz^)Pu&nklc4Z~uIKd-dD%6CBTo!D8ug(}_9*V8Y*mM+w0y)q47sTx(RASd}2q ze(4F40*){s(PKAvdy$7;gs*enF_&rK^~;nN=((($)&fDlT|XQ(_9*ttR9~|=I4Hw6 zMU{6U6i}ih=}evidBG7l;(o%$)iEgo-0B*#_a0lW{P~_z%k--v^nyy+)IFGIrQ|X- zu`ixAQ^hlz9tlf3LyfX2A;NC)Ui_?~b7DY{Q|7ezLD>M976Q5_X1#LI_RAL!E{Zte znde{rBf_NAe)$Fbys+F0rp{vA;oe4RPc09mTt;sK=ZFWSzudvse)bgE-uMF&OawW3 zS~wlg=JhrR90>b?rHgm@b<1K0jfMF}in za&&pwV7S=3N{bepy8owyy>+JOf7wW4-!7vDmP-GR=E?ti$NO~JXc+DZF0~ngVQbsA z!l&V12a8*M4T*y3@}E57D1s#_&b46pkSapBGm@u5m*xs81XGcbltm{%}zCe&}c%^#YG~XI6Jx+|_KR(3O@ogO6b-F?e}z zV>UG@@wXK?DLDs#rC5#soaj%B-H<0%VTg7$x$QXnVJ#$J4NyT@!D*?tS1#R(7yyy0 zi&JI3RV9+iii1E~0v@lsrgz)<7Q1Uac<}-F>#K=bR}&+LuY22pAbjkGlFg+I=l?ew zuw)C|g!=DNxWxh)mtg`ABaCJWBUh;|ARkWJTswZ2=&&390?93$>hE$tP*)(nN z+!#W0u&DUfF4aLgsAdgf;+}_hswD%uFY4+@4OEFK__|ov*`~eZ93|)$6F%RfQHv^W z`f|zJ_yN@hY}NqjkDS*FR2%Twz73eYD4ZwXnXV`{8`eRMN}Hjp@ZvS+=J=k5K4T~s z_BWRR2k=tEf1lnHXX#WiH?J)+H7&K4OIU?JFabIX2UTY=y6_N99Xq+NUScD%@8-rP zpuyP5NQbIT`gN|ERnEYJT_JfnxD13lqoW~RP>RElp*DnA{U&{PmiX9T*S#8%|O&ZQlX?2Ng=pXvzC*Wp{gSPr!sDSw=CiT$&OC*AF}4+BP`O^imv&gwtj9pceBvIH zGo_t25A;waprlEcczc~i_s~-APMZcLJWBquk2uFz5`uK?T-{ZJ{%4qT$EwjP&mQ|) zW)YAU0a6b}1B^$nyIb#8!{tl@->HFPnR`g?H1oVkMO64~%%GXqzB04IF zt#(>Am&$BMBub=9ff&I$xVl^bO?K93t1a4T@|ff{AU@Se1vf(cD@zyLaWGrw#F58U zk7NAR48Ii4$gO`YmD$NoGpfC2j4f*6WrH9JEOo2%ghbIv_k4|HYgeIFaA3KJ_(g^sl&9iZf7|mRmChyiM_g^)Xp6^6lYi&c?Xd+w98><`Nf+ zLl6@o#?$hQf32ebt0}0^v2O~#l6pHy<$5xifT&W(z=XcIM^fkba?}E@fr;-|^GN2O z*G~%nA%r2_B#w&wOq^dX{(1fLH@~bWEtSM((s}rU_1qhYP**h$rjg)9rqng#XnP!; zdyNpdESZL2doUowY9vww#-_Vxm+i2$t#i~N+Hf%?4*7Q%=XNlN{SiJO{Bd!uL%gC= zTnCyT0jWL!1)>z4eY4ft$m$sHV#gcbeZ2 zrgS1V2FngM1}#`$@$fG6tUYP{kml^y zUabnUGO?$r)%EY8zSs_M;Y8V^gZBR5>Uw}oJumF@cbO7HY`|fz-HPI9s=uVGl1o!f zpj+MHd~%FFE7XuPn2nJ21{sLd8_Tb&Df#kR@i~pOlW+CfllNim>}*!1?!e}4e<{T= z(Byk*CsLnxt5k$K>vvbTNIBZ^u1c+Mh4ROXLh+zwzG={{sGKWUeWEATK{AlI#^;3n zhZBEt=@-=Y5;*Bw{j#396VUnpF3zh3xbL75+cZP>phBG#8A28}PKMvg8dpjGF$(4$ z9A@liPv31cSp9q67F>p7RXm<0@tV zw*vKe^Q6FK8HtMy$p7LIdf?o1brPqX*-H)lfP8iW$Yw2_>8Py9caAx6gU=^L!>Go5_eUPhXUg=q!xf zbr^+eTTFHvQByQ6&}dD31@6f{KnNwR_>QwN+U@*E*l9HD=1@*Lv5*K~sZE^5mq%(v zPe~4hHFq<-IblN$D-^G>6R0Wr6pdO!uYUY-xbxTcp_>q9h2qV|SMe9bP!)>o$f z#9Vm(%)k0a@DSVfhjLzYqsw}5nFx?)6J87)EXjL2Q~SX(nCuYui-X@1TQkhwANiA+ zl)qkfU;Dq=gAS(W3w~b-f=&)vwpma139xizAoZ<>l|SsVB@|QLLGqJ#P=oOr*7+Cy z(>eGsQ*%yiTR@4f@ZL&iZ==`lAAQOOXvS-REtX1-Y5r52@c*Li&Euio`~LAd&KY$w zR4QxeAVPN8#!@OqHh%&mGX^8GKF8e*v3wl23Rdm~;c}-4txDye;+2l6RZouu3v~R2Ux2qiE!F zPy0i}{7-q%dZ2#fW4kVyz;uGCeXOI5zUXUxGRL%Uiky+<-1@d;UcOq(^fy%ns%5`Va(YwSW3fC%5~0mjYxPqZ)XmUN`0td#!P69#vAxd?2-sYyvHDrtXmB$j$2Lwa zWZX&tHc}#084NrJXb$r~f=lJ5ZBqIYiuu4YhUwj)tUs~(z-i0E=^O8`^0P*kk*2djHDu%VYcpp~+Ll`m99!USxoaQR^(nnWI7 zI%xwwW-$7nvWWY~EcDy$yBZn2yjt6+ilpyUQ&Uy7iy?I5lT((+0U>+{j+%HzTGCOAlA&gKhCFKQP# zJlqV`6!~@=jT)KNQn>K-MS#z|KuhyY>9ux>)rwu|V#_-_{Q}zf_KWYA9V;mc&YG?- zx%_`se)_Ajefw7J7gij)R_&qBukQCqNk^GzCht2~r_kb7bH=xZY(mIeBKP=J{7Fy@ zbAM8xK$A;5Z1H^B9Y|G7L~Y#Rxe(qak61%DUI~X_zKur2Y>6IUzFOVJqX`D9AU>(d zY3O=w{;b?lHRWGUMm_zNhwJda{iE(Lc!*cn;>G5jFT0Wrtx6_4LXFQf8|ANitTV7S zCDA(e9Dl`J7|PtZyYf(-q-gC~Objj9$v8uEnv?(`ul??__x{mb4{b6-!E3d9Q+Epq z@55cV>4!dl5?RLMh+c*9_e{4_qJu}9Qsusinh3@Aw$;Gq7qi-PqZNy|J<`V(CrlNy zX+{?7+E3db8&5t>=Hhh7!13Juw;$kd4}1LxyF&(QSYfstO*heCz#cxqq;V|QFCG^u zK!}R<{JMHhY&Icabq7&>aaRzkRE$;;lVmkinaPCr&zO9#1A4}%rAZf-+w&3{7A1_u zRh>*zODUg+iE@bX&%4FG)7m%~rb`tid3mIpj_B4nw5F5wa${XKRUz9|`O=h@MMee5 zi~O}gM$MqW+Db3qLhbu4VWHeVs)OV=EEHXbbgQrm_?nU!B<470AKPqZk;Z?1Ts)#z zGQ4OM`kVFaQ(BqS2byj|MY3+m*#?n^Mf}&}#E|9hd~ZZi5=}9Hd3VYqWjvVd%7#a7jv6E9~L9w6CG9j!gEW9N1sK4>3j`m}j zqO<(2udhQpekEwEfgZ!M;{LP8l^ zM925yLYJ}RKyurakpfBf@^M(yquoc+`3NFMRCN)$^TCw5Pog$^RKHwok-i43coD%r z9g3*&OOv?G`yZ5rzmACcoTCp7>F%Yygj56RrwP(kIQ-pXk#$z|(I*{P6?q_AwrO2# z^Xj8khb%W#SfNES$;GGrcQ5%```10#(a8^&yvAolcz$Q$6ARKI`(;}z_=4nAK=10% z!VfOtc>i;^<<3Fz62sQ8g{SSOEx2AKska*UGSc#%jSO1huN0W^jGIl>$ow3*%@gkK z^N95fBW9s4M(O#~xbm1XgT>wdxZ3e>`JMP>60(B~WSiA&lt%!OwIh397#cg=Ehvt@<2qGk4v{W}QsX8kzD3to=pbE%(5ts=6N+cJe>O z_lkc1-2(B+M94}%59wO>ma!``BDx~6dc>VIMws8m^D08M?Q~W6cJP7*@7T#me(!Xg z3f4IHNk1b-P=4E=W$J`c6=*10*W&)OHnjgl51%VL(~#_~n+C^vYn9V;T}_nmHcfgg zq&$?r17fMr#uMYi?_gY%oX+sB?WL|*R|f_@+nkD*Y(={0_Jhs^j7P#6H0yTCSE+-u0pgV!{#>9luc zh@TywOpm{nj?=pc+aa5!^&T0M)?O~o8}AiqC#c53)!O}BA6q&y$f_j>6qqFCFJ?T6 zsKr;Lh~jti2%@y@2+XWLufX|NQa7fn*W@ z=&XH@^4ui4ya{?%;=M?Kk1k5Ib6F;T)-+;uVyy+-meCLFsp#MKmnaPI?H?a+D*}7>xSAvCTfYgE&Ypsy|IVA^hFw;EK#1 zlVHY6JA#n`2>W-@+Lm`pd0@K>- zR%V_!h~w0!64L3~^#=jJ^{jGKwP9_xB8yM$w^Pg+90}L5+Be}Vx}MH9s!p=Pnx{!X z&la(--Yz~DsU5ein0<{epMI10Vw%Z{MCP5uySWKtJ+U<*GB(V%@x1+gh39JE<+^tp7J!Jw+gn{zX20~qVS-<5R#7hUPoWs@1-X}B6YdvX)X zKPDE`^xWSNl}*L7rgf`aVzYYCWz%RxS|=y@>0u)F8(QU+wPQH#hpuKssHJposn8Yhq=ZtP+-6&?#RWIpV8;bmM|t zw#f}^bg42sia*P%XViv%Fs0>_#9*}f7^>Y6sb1JGmQ7Ntgmt}>g6$o!TY!-<-P0TgOcSDN#*C=|Y zlLE~=K52I)cZZMm{*DRWjXiuHln?3cF#4+r3~nYDD2^`@w(E2A#*|I6rz8%7%ZrW} zjw?q}N^VOaEhGm&ImEYCXverf4BWNnXADgn8oDE1o^9?nZmDeWDQWy*hi)wLo&DMcH;mgXs4!KDAj#m6!&w7riov@60kvn6P$5b;1b zQVh4jQkz&jd?H7lRxMuds~Gb_kpI}C@U&i@$aIeF8s3t2$WNR8sm##WqeHoeeREdVhc!_a_m4wYGOyrZ-}eLq=f*5AabVkaTW2Gj z74c2veCUc`*qh5RjvHpPCJh8nhHAQQiNW2iQ?yMmS9ep#E@O`_RR@GfFs^Jiz3zcV z@sRAKn&)dbIKBna`=W&bdUy#eE0{>HTJ zNuywubFdMEipmRZQ|mNR-ZR%vf0|WVLS>TQ#6{L9p_w>hAtYuI%+_{qWmkA3=UjCh z6`a=x{?_A%hPfGG)#FQ-u3k9%l@Xzl6zCTu0c{?D!&91fpKw@dETkt{$p`5K{2tsA zAi`>UkpbiVsT|9FaRs+-Ru?9Dn$hCv{Ti2yN8UHIr(t~b8XmAee0AH529o0x(fMO8 zyBEH`f97etmAcDmdy#eyx~_BYVAbQeeFnt?TrzLb=)8axm?EpUs>X<6^)6qe-Bl&K z+1=jyG>m`bncAVrL3gaFo@9N?<j> zXdEWKBK#ptx6nF}Y%2fm%8V>8V|B2+8}<;JS$*RV0G%=t>WR>Gf5ncf!!?p+I41`}q2j=`L+|&ky1L_Y=ez`kzdJ=cu@dDE{nH z;n3Q$5Kt8N$*0N1U|oCsVz^5;Gwv$lo9#BkG_D8l>wTT3RV5-)Y4FkFdR_P~W#(22+i& z$p-8mJtDiobASL}lO@;BEt1Sqgm;R&RIaK%SJ0U4R_DJmE`l}-?S2u)tjr1dMxM7*sMePjGtNx6Dwoud>5Rc#8G_C+ zcW7v3n?0O;uv_YbJIB|N+T);lZ6z5!{v96V?GueoUzFw^;4h;>) zxs6lr+TDZQwN;V{icCsQ{_&t{d}Gw=@L8J)=cVNY*ryYutPbdQ&(5&qTk|GWkL*Rg z9X%vH;W=&aVU!oQ_xra44rmOHNRwa6>R!Ok@WU(387}jbCVn-{B1QY>Y1wx&3S9a$ zX<}bfWbd5^J~wzLuc0Dkdzf&C4a>FcP@HFVvi9M1IRfAC!MP46I7Iu%U*o4_V$Iz6B6g~sb%UO*_;$9&5CQyXjrZ6-8sp zmxB%B76iCbpjO45!1$!7XYxz@NF&Q$JplnTBWL zRw^(_4A8CSz#d@$ca0RVQ-j>GpEF*3p&bJu59%{d5Pe|7Pn6`FCzY>MKDTwNd;e$@ zY(*Y3ArSAZbb9nqY-YM>)Er~yWRxr`hHfS)w)|MWE%#6gpCdl;W3%TlKS5_pe|v_R zvuKrvv(9Q^6+BhB^1&uaYB{vnO!nWN;DQg|jhrrDbU zyH1->dhxcL4|cZ=@rak>)@DG2C4JcCZXP4{6d8Uad=M4O3!z|q5`{sa3LfR;2+z5| zCS>kRKYIh-F5J%Ph_@2-z7AeFnIj2*D;2(%qICb-1@Lb(x$jR9$;BoVGD(4Tz{7v) zq`4t%{*!lgus3pzm_I6_?w@ZU{k}YG8(AM^@{1g`eFtoaEAC}B*zYOi2rl@@wKR+t zbih-$(%Bww9rmnKf=}JP93}hy9-|fO{F(1T(=VJR zj>`m~xhTJ)^y%|ab{(Z9Qd%FB~Iu*fl>~)8+sB!FjIWBhlcm?-wl$F^PAf2@?*})Ejt-2 zyw7Z0gHKiI2A4Ob?wBgN_7%EzdQHJC_>g?p5THN=RvnNLq_!;5jP-a*Zclnr^FV;d z+X&`KRo05y&Dp}7)Vqz(DB8?pGzFf*8}O;a0kQZ^~U@1A}zNm%h_6uw=uhh->HfJ{0O75)J

    T5Mi0Pp8bYro#EcT&bpnP1Kl*m{vLd))>IDa@8x=?zAAP%Shf3x; zz3eT^L#;$3J&h?0ukW=a2SBy6uB&Ve9>-@5Axs-qRvCNwvBs~<~O1}7!w8bg% z&t>0VWwhFn+UgaJEcHZoPTxohl%*nmrNXN(u9`P8LC<$|xY|b62Dml(8$Gf~N-k+~ z@yd_cqRo0>NyYka2sJU=K8onI+%e_!-qq5BusF59wm4+8I;j5!c+EqR#o6P|(pd8^ zB5~hfe7@J%To&oa-*d5UGL7Oiai6t~ST_@J#puf~8)0xtZci%QEI-*a9X_v7;8DhW zq}5Ah8YUCSN2=P@xk%m4eb7-56bxhV>!{>UaAFIoc z>*VgXs*A$oDjezar7ovP34ns{cH}aoQ)c#t)d`oj631XnBt5~kPBm6`8=0Xrs7@Zu z*PAaGEP{7WDaOdTWJree0;IKfm9JV+!L9w`(#Zev&M~9>$O5|=ZPDTYyf6^bHVvFF~KyKLETx!LjYWz6fABa;N1xF`1q8$0b1hfcWV;-m9lh@dJgd)kq3-C|djq$~0#bkEumt7^PAAzz={^ZJ@ z-9GrGz%>IYRz56BcaAU7g%Dt5NHB{v{@Z(%Z061i(cRuPe+HX{;?Exey&915JqnU zvhzz&=0Wb8(XY$n%1YKzBMy&RkNem;uDtqDa1E`ZICZlzFyyk5+-qqSZ!#?{GxCAP zzV4;M7YI)j9N_Txl^qat(RmJM4wCu$-ZM3!Rlf#>b;^r1)0(n!l@E%Fpib3|g`pNT zoQ53b3KF#X)@5OE#n%!vyu>01`yvFLB!0o-0e&qd zv?_V7S6HX4%6dHe5620%D@#fM**^ymAaWd3^8Ri+UZ6)l?#c@Wf;#Kc&KF6c^JzVt zN|ZH-m-3r~6i8P_02&=>6s~t&^Dvi#Z0JUwnOpXnKIU|fdR9H%qvG$GTD-A;NU;Z* z^fa!|IMwD^hBLf{$wJ1=pIbYrXz^rfvvO_jqoNMie7?xJ!H{!?zAyq9;2734dxF?=5>%?x%n^g#M$QLpi$0Wm zizPh#rYct9Fb$Zh%UdkDF;d=r-5ijPw7`!*s6?$$YyH>znl_1cFT~G(7l|(w`l=*n z(ti|pT~*x>ZDcPWuFe!I3Ht*yun?5iuQzi~9-{(%4B?zhaj(<@xKXKlNoVl4kb8Ui z(%m%12bo|plIyoj0I}Gtc6M{(&`nqAAVL)`z-vAxh)CnLez({9ZW5n?O>)52NVoQY z$PJYOBL>0?+F(B=>5#xWfB#oXut7Izdd}XZxUua!ZV1{En24mrYN?Q`L2@=MUEJ5Q zzO-HP{^RON8T(x~w=QoN!*!&=%Ss3soOK|cibjiR05&q*V+0c4IA@UX+*2^rJdqU^ z$HxMpEO~XZN9|SaId@+IWC!|!^DnjdKk=S0b2(A~-(kiCQQzw&y6<1DI=04yf0D!O zkK~Vk7HOZhii3aoe=dhHJg@WF#S=svGH7!S0`--p{Z=TT2qKNFBUXsBbI=Ep?MCF=28g*!^I^=q`)YJd)#*pJ_wYLLuHO_IK2;eAO76SG{h1yj<4n4Shg zh0cg?I;QWCtJIKP%L(7yXm21joBRMCq3t#n^#fQ=x>YC0fLrwKm@U4+o}vKpxIT%6 zPwB;OzhX584uBmP^RorWmL4|ah>NY$7}CboDoy5cqJ%^R;O*saQ^8a_m|xr+*ijBI zXIzV{a22o7?5?goKp0GngA+gU0BnynFNz1u$9Y#ZSakel0h;K4Vxyj`q7$3AZRYZd zP4DT&mDKR04QzIS0tjfSrw5{dXV0&a^Z)_O*3uR-r5DbUtrU|yTPd4d@osb!_Tl|f zxgi_emPSPx=H=U%toQH#=&X4l)l!+7~&cwKThCzDBQAKqOsHd%}m?qK7p@Z z+r~$K^&j-TRyyGC)4s9ot7AF`VcWxh8v9F3eL3duFUAgdjqi}durZd8*rMjW^ zi>}mTBvo@sI=nrI9Gab2bM_9C&9}l@D3$;TmZo`WfS^Zfc0Bf8y9_K}F#b4IcaB5X z05u{37;K8&wLUm$4^W8P3DVtL&)icFf}Ys^ykgr|r-AAWW)*?F>nqLg>)22(H1alz zZ@kS1w3cKrZWQ99p2$s;^Hv;bi~ttLO1CFC4OR=`5J6158|g_RE2usHXM4w(b{I^Q zcNXtrcf;&yPxJ;xOo^!VvN+|L&Q)Dh%oF>xQmpU(#y0(H7Uipky8o%_QU!JC#PbW$ z_cF9b^6yvz=E{Gbz(w)8BkYoB0{0tzyjnR5b z{IbDGG#a0*Xz(zWSxb-nIl-Cec0|ok!%t^a+Ex?BM*eGLI%OT=Rezu{nhH4put#FK zy7rP9PE;|!7JD{uT2oxQ&%=Yz^!d}cvz?$&P{5YXTNjS7_p^+4?l?dZY(@5*ok3)M zBq4`a>rTFAZJKU)i(8j+xL@u3r7m*U+*t2p^2WE%Q%@5EwS-x_j3qXk4a<(6nUcM@ zlfM$*>$uN@+>_K~a;A5`ZNxy^eq!sw+4q1AF7;a`{F4g93p8o@jeSCd<$y#g6@J|P zsAa;db)Rm+>A`yX=C}^BuU&PF6MKw7!{0Y70k?~oGsLw_My`))0JD_IMB}qrWy`cG zVFFLbkb72a#N1KETy&#yQ&Pax_nJwGa3515Yc)yEKHIJTgi>~Ri*-f*WmZ8P_>NWz z`tmDai4dzzjFf%QzW2czr%d;(*O4U<=h}L5iZ5=&tyX`o5ize&o-Pg*46<7PIh92n z5Z%*DcXN{B3wn0Zh;lA&p42c$RMqP~|cfM`!OJ*Fb?}i9ZP{%0*aP(`~@>?E6H+?i_@&zkUQpMT!`J z6h)v*aG3bS(nqw)AJhq~H^Zc*!I31tNAUUD$(goog`;bbyi@=fD*X(EWb-9f6Cj#V{fGT6c9VwxlV*11|I*Bi+$1HA`)ANaPfYhPj_N{qJ&e*{t6?8; z^>$fD3voiL;^&TKBlbXbl(2uf36GeQBvyxhwCcmT$5c2G6diuvxRg}xBzhsTjcls!OO8YJGRyV|NN|Jq6_w6TC0<7@NCs%|HIdz&3O;d+JU3FUrdFdHi_vnOL{ zON_ngu(q>|ttN-U>W6zTH2~_*z7_w`B)v;onvPVOT#73Ggj}`{+GvvF7sR=6KGj&%GyB!woeM@|mIs)wK1MZl?>VOkuQ5sy0T0892Iipz`FZ7qc1n$iz3&uLz;9sAtUqhwV*G?#GS>Q2O|6i` zd#YrX$X%EyX{c!RbP&B!GqcGoal|6XzxSWqqemkX#e!FIZdS38)buw`Pz|IM`sXPA z-{=0iTMX6*dJ6krfQeLEb#D1VQ!(>tr3LcN@FA4PSE~!71KNlzu}>$ZC94}0M%L4s zlbtxT?d&IzrmT5`8=|V7j&K#9F(sdJ@cMnuC%*VS)fKpX2U)&fajZX?CdPR?_8+&( zuw2aj%t|pF@rHAWQYP*Ky@bBZ^F3+u8TPJp-_~F983*M>B~px$zOMzY{SPELd~V-o z1)&=1=?+*ZPf2%c%UmjcGg|4G#7WiBeD=Pfuhq;R zyIrO^v1)Iff)h0vqxdRr;FhMeYc9~g7E`sKU~n6tk{^6kW7O%IxgDlovxPBtb(H-s zo-5rI=c$zxIZAb0cK4wD#E!hm3H4{B%@y3|KjLN*aE~lc?=p9I-C+%J3}oOR9-4(z5x?9>lR4;xNCH4)AD?tQY~*=a8$%51`nsGg?|_@IUGNLdV`lo%MXJ45prd z5D1{(L=V)Uxql4-BJ?NsqFPansr;~^EY#X?2IeNg+KLY&RGr9&YJ)KkHa=Y+>K`#7 z-N;VWPYj#^y}F7+s>?-m5l5PKxkj})BJZ(S_l3eWR7A#G|IoA%#7sqQrr*`*^2aej zt%`>@SQV2a;fgNCck+JUpEJi~kNcO!-h0;j+rD3$U)xYm03Tm*TM3w1yyA-Ve-gr- zAnWkvZ#w6{t!;{4d5H2$Ga@p|e{ALI8r@+2a$zIHxa-6jcDl)h&ZSAXPu-~XZX7w1 ze6?{g;iZi0iL+HeLwjb&5l;~r(b1k3Y_>~7MC>szejcs}Czz%w`fLKD;+Fq?`sZ-Z zhz9r)>hVOY4ax1T2{UtfCc05>O4cGxE4ShP+fq|jy9?n;>B4Eh%gfLGp#l_~~l>$^DzfbHJPRR=PVutN-OG|0lGh_#{6ciKpg!MS^F=PU8jJ5y=4z zJsF&DS_6WZIt}q|nM>TdwMp;v}>FeXwDpEpfbc?$%(}>QARE)|%E1YA6EI0X6JIk8hbxx~#NvaB_)w|kg zzi0Li7me{h!Py*ztUqorjJc4$&|oiE5TcbBD8lZPcdoN4{7*()vZ01*d`Z8XbtUV= zWGEzN#zO8>t1&p;2H}!2^iBOK+1jsdyEHu)OR0de4?fnmN9|^qwgW1m_kol@Esv_vG&c_t79y(yLxwxwu z=glq7pdZ8+=eG=8M;6L|x1;WBpo@KN7ot~qS%|efWD<~MkiNSsNXqx`Aqxi~>!Or- z-j6FYM2)5gnTvg$#WZ=co>JLZc?fUnHWoPQ2@*Q%W*lLY))-hDF=>+62j_3`lax%h z>R#?xQmQ@fEf#3nCHCJ!S9_?QIqx1IGmWLSb%}HeY+H@mLU-fNmxQPJvX~x>|ZYF=q5olb4|OfMmxlf zJ?5*tb%l4v8P5L@VH27*ZzLuZh-b(6OMU7&T>KMdEo^Hd`V#L63=iFvvYQoFT&0CDtU?vpXbt=Y(QB%DTJ;y@Lr>gXb{Rj`K=FHSGas@jc9qSywR1ZO!s zwp@^=<`JU}tY@yOc=PwkGPK-V_l==pp(p$x0b^FFk_>Z=lW#^LngI z)4FTZu%}k~)F@ePk8Nvzmj66#DWG(`c(cUT_|-4R@F{0VR&ggM#Na1QYz4m_msnAm zGc&-ZO*e2oItMH>V>k)9<3_!QfxBtoa|~d-!0!}0fJifW&`tqNg^xNWhEJqhtm~O| zN0K)u_;~FX9;$A|OMr_a4doPokgT`I=$3HOT_P=avH9JaRV?)?wSz|p-`vC&DIzSx z$F$Ilscp=jno#e4LZR@uNvY6n0cU&Q*B`zQfHT^uXJT*d{zj7Qm(MT@G~sgdOQnj7 zjp~A@Yh%tV=G2BHxZQcggwOF!WH9rv zp&}P^x!-vdS#ZQNO1oC#Ve22|3QE~V{j+Nd!)O3I$$>o}RJlh(GUFxHu{K4X8GRY+{{(O1{uq2j zLi*DRfo{{)O4cRHe?O}Uprz}Wj`qAFjc6ffueD?I5aJ#4NI71GZGE&iP|hyrg52CI zz8r&cDABuImM#2-Vjl7nqjYQl#+Z-R=>t1mQtwflp!A;W)B3b`iuh@I&^P2Zqtj&g z=l0D$cQ3RSUR}BK`)NfqpH0~U_t*D{6~N@qzmP5BeMNuZ!OZ!7Kp_+sDW+`2;Yvz(S{I%H+-B%uHxw0XA zv-c*#7Cm~mlAS+TwYS%8kfQ@wvea056Es-TaQM#OwGl{bIwLl~-)U(a2rNGbC6e?d zzTu-kxnuGAWU0c7<}^ruBBo zI(CU`m-SwPu53eB);B&&#tv_Yns`Pr6E&x02qbzM0__p-?$r(+OBbzLq3spJJVwyd zOcX0VJo--JpXN4O+Xdj|=>`wW)*o)R z?_D^$j#^XzWRob)1d2o4VZL%J6CDGM*s^^|^bLUr7$5mI)D<@ZY|1o~o;5c~Z9u&E z4+yS)+EXLeJGsJcF^7}ee~@|{;C9yIY=88Sf8e!cE~?)c=@z5eHM6Cbz(w2@s$ktP z6Hdr!NCfkUMr{_NK~75IM<9)iFXvV=)Q6ni{pB z-H%#i91tbf`lVgW{VfhBeaeLQLJ%7(DX#1UDW3%KvCqi=CODjE?m+|&vxZvx!B%Y} z=?auM?X^U!Py+dZ^la~EZkfIZ^E2UraWea6ws-8{4`?4PT$S)5a5NGweWDLYf|GeRc~Tv zc=2HX7@ay`8vhhzr@jA})pQRkWb!QdJmLevyGmQLW@)2b90ozYU){%<=}+pS zli;4$YHWx)ti%qP#nJdc4B9WcDhy7()r|Lflj-kvs4mh9WFB{V$ToBq5kh&C?ptDq zOc(J);05$@s5=pT{ATRo^IzYmvYh`4`w~dcF&}hTT|T?4H#5iT0u^I8&+n%!(pG^g z!+anCBkXt(WM}k9-N@6iPdbq~%ZBo^g+Cx$i3+SCK%#Md_U=z@?JAA;YYw(QjAOTb zX**VYg_D(P9{=h~&8kzwbt}lHQC+2*oR|gT(v+c&Zh{yl{VoL9mE3JkK~GOFh$|9D z3vrF?v#Pry@?Yq_{1rpnPD@H4ocniTX!Ap-#+1i3dk*BB%lXqeciY>;_e@0d6QsrC zbz?eWHJ(ky*I=zNJ(Mi1`eYhD`rf$f<@EOIuW+v&?1jHa(XimbzagN&HbVUESe$m; z;VTr=vp$>iR=7d>KVsFf6QO#kq453>Hc?BvPfAh*z5}--rA)V%t9jX0yBC_*R+SSM z1>on9Jot6ra|dg8^IefHmn>M(XWe?R~-1=vTn06-TD?FZ5}+1BOv z@*0;+>?=}4gk+e9!B9rD?eJ_lju^sk|AIBW+joeA;e1!zzY1)%D~gT2vr4x47-Ne% zDP z({p;}RjY8kct)^t;GhW$N6GGKTb^T1DiTOb$LE_Pvk|;W$@73J0h!g*64T3)HG%eW zxP~L4b)a@oQGLR7r!GDNe+mepEj+#J?+HuXNU6g@pXkvKZ8;&)3vZsSNf@vnCv>-6 zYaDvgQkNJiTMyDc*C^|wx~vh+a%_1$A(nGjx*F`?EKDlPPATTn0Dtl0OWi(Hm^i0X z^=SXjWq~W_lu!S^yK-PRi8WS@!_7M44#nX69H1c~s}&b_w09j|bJ{Jv+z13Y@ZJp0 z>6vXs6S)D|Jk_1WnJ_3FH=ifA?8z9!QG3q7~DKoZBLvf=pTYX+}_a)>qM`WZ?~ z(exxYE09Gkk9--Mgt=5s-o?7c`uI0pX9it*eudyQk!kp<7 zM*o~h1DI>~H|C^gD{RyiAB6`7S;!KL?#Vm z&{4FG5f`wfNVC^!wJqS7$OluS+hrc@*@4ALp4;G*N$vhJtmJ<}S`tLi@Vn((sj%}8 zu#_26Db7_U>NyWI-ax+9;=$%_pYgp^5utQqB_M$Q)YKAaugXCxhm4XGLkpaWq~$%$ zxLBXFIR%a_)_Lv38Vy(KPd*35QN`e3C|_B!n-jVey73a{{rPAhwytvJYsNSbN*!2+ z6L3D^u(J7|$tDR*rKys1#n-uG`M`UY-5_;m`I|-EpMfC8^bi^|`nL^0$5!mO!;76` z2Ec}+l@rUG_B9L1`oyN+@wMj%A4j;<=!oGvBPOVx{8LwFWig+VkvX|iy(ejTp?_Zh z@-Gq&vH(2Z0T)aFQyq#-uKL5*!#9tTPyaHxy#J zA%E&-U|!ZkMY-N}f6($a88j^oNE&rl#)=OTjLi`T?^>#~i)tYaAGsBQ6|3gbtjlf1 z{Ru3A@cg$iQ4=XS3`>e?WT6aK*tYA{6r0x{>>C-*Hfo_n&MHc9l49a2GX0@e9a|q* zP;XqGhBezsv{@>tWUCgC9`*m)MAyrs57>}2@eZ$_xDQ>w&wc9> zz~h|Xj%D-sw%-S`dogqe`E9~iOxxzy*7p?o`*%C)wq&;Sl+-A4rwQ-HIn-c5=+_uS zr!;?4rImDt)BAjXDe%o1qi?f%Z7ZJ9*ZA&w23baVtLrQbLs`pscW!pC4k6HlBtn+> zzZ*g00Mqm915VE}U~9v2OWPNhDXk^3AQumX04FdJC%8QSjaG%|#qHy1obDh!?3+u; zR_YPmwcw#Qx*BNjlUDICIdEpAM%!=zEIgZj5(i{7db+*J$y7qYR=8>9HxH~n&WwZp zh`$Sh(!hqphJ2jypdLrjk!<5y7&8oC8joS7{VlHsUSm$Bu^1si`D$$J``}u)Sg# zl%|nsS*ePyl0>ZSWqT!Z!-60r9jQxKYpgGs+)e@%k9nSl`@mSYyMtVp!>y-7TLVH54%Zrcr4LOEzNb~V6;%bTKXVPE!W@X01`^7_&dB*L2Z1RvI=g@BL>mErt7E#WjHqCDN=YCqbwkhJPr6 zE8wK$tA1HiZM5eaDPUe>V7}5zN?EHc@rtCq#)obYIpdU<8SKXPXEKe&5B?t~(>SQk zgGUEaE3O}DVw;V;XRiD0VoXh{?q0m@d3%1yDp79dVkE=|SbPdP5^_6{{FkzZDAdsaPNnp|zqGac-7NlFs=MQ;`_P8Kvy%X0@=`Ce@5f~yY-7fxYb4wQ4^~^(2keq^^Y^O(_%TD zWY$tZ;vzj5FUcP;Ki;qw1Y&A*d$6C>k4w9F_ZtNQ&vdKgPmAspSZlLbPPc+bP&bGy zC^y4n2|wt!R#EK7`x9_Zr~Q{%6xh|&l3jID`GkVMf36~?c`}$gv<~bJTq-y@phZE2 zf;~MQ+x%lgjwK4aziE7mdAYpIU&*gIlJ6mqK*NhyGhj_+ewafyS1jp(v;3`&B4*PC z>ixNQ2cx&RSZBqG$|WWCEF=0~>ZU%yKPUmu>l3i~Fo&KZ%2^=x>?HE)T=I`5pm^6p zwnQ7mTjz`EWy>We34(y|0Sb*xhE>|fmCKEayyqv6#ml*+R<4d?{mLJb+GqqB)*p#d6KnZGe`*LQL8)4X%)t2ai|cya{3do*`T0C_!>{ta06*R^k`gD24l z{nWEHp0@r_M|^m9Lj_&KkQ-`~oLJ!g z#|TKMf&~>}TTXT48K>_OE>SP8gX`@tCvlwiMX$y++UmnDc{vw5;_xLAA&Y;{u6cuv zDF^i@OnB0e`j$DYxVtbJsz}SoNd@)Q!=d(<{vfPIfh&2O1G;K@`Ri%~-shIC1aM_| zC7RDw*CeIMRA(y6`~V5C*?r^uOX3R+xpSa6kt-Bz<$XCNkO)iLyx()vdm8y~S;lM@lLQEMPx46 zKRQB{x?t~L*Nk)yOo6tjN#nyL#dMI2O4Lb!bRtzg+y=s1M>!1hO>zh?zWWKj=F)~c z@?-#RwO6--E*W9gNKB>j(<495MWMTeK;^GgHS8i^TOShys8o{a{obPrs8I2Nw-54#f}~!3Y>9bULX}LEBB9*3VbiNJx7}aR#P;6PC4jlelWlbMpnJPdNv5 zJE8<^ry~acu714^1l%Hl?V5q*KyAVImmXylb8cn%j&%mMv*;B6#TXb;2XAs|eKucl z6UElhkvy6}q^faJ*un6|pKAq&J7k?zWNy|t%6XfHICG`GVi{41VCB$7iE9sC9$@#L zc9J!(7o@YI%QLb+G*+tS@i9qeQXCzd9` z_-6iYAc)dbWIe=2(A0(mB+Q&j^L?M;u{@uCr6*{tV)mAvalbD?IsCYrfY? z3ad}Kz?#U@`(=bfGC?8H_U}XA%47L_faSOnIFWzu>HtpUjD08aX?%>v^0hYf?J2FZ z6NG6H*b6K<2$iR-AI7W70+Ulu$(3TjuMMYw{ zeyFg74EK9U< zmzNk>%rp3F{o}V}#FR2%SzOz6sqv_pZ&U%tiG&CH9Wq}Z1XOlwb1~0S2=X6FAt>Ge z$FSa}>NU#&^0P)kTA#R)366#54MAI#o3f%6Um2~au0*v3OhqecvK3BB$davjuj;&d^blM zVp2E>;ColMlPF!(q>TnOY14d?`bbsLNz|1w;+$2BJxEU)ABOV-|F*^TZ!4K~j#t$A zkw06pkm8uH`A?OPl%ItzFc0)(;$7Ugwb&2giQ24YDUr z@0~E?rlMGo6hj2p&HWAC@g0VR*-||v`BwM;!`hn%Lfy81!-Ys_DitcGF4ZKJeP@PL zN;0I9%AST~%f8K6ibSTeFJml4t`s3VV+mQumVM2>FJl>FW<2NUx}W?0z3=hUfNT^ZMxllh}-# z4>+fPI|4RG@^cVOCPAvuula+iXRYc76c>X+y`8XQOxz7e(1G#%6H_GWD(@>s+Wb_j z!64q=Z9I`ENz%XOZ$nTcRM{!^)5in;9F`!6KO^Raptvid1o2`fLia3c7Tr!pxOdX4 z82(d+y^T9}rdoO2_|=m4h3t4ra?GMYDUdV4?$|yvPv|~g+hdd<(1vg{dUNd|YdBG0 zO8eOUza@upxgSK=J}|^*#`>HHr_^!($kqiUx1#!7U&Y)R&7XIX>7 zihPD4QDzIifOR+gMNH6JerYbGSP1YUK?0V#o(o*EMu&)2t-v!79$@~h8R#mK4T|16 zX2s2T$m@g_>;Rg$SRN-lNdCU37=Fn>6XZ01KL?zM{pp-|C?nV5HB$wI#^&csM-U`l zU+Q&C@hnRr^#7=5INZ7i5($)k|B*w&=$o)258DQixSA+ERqN(nMvQ89wmpIV+7qhP zI!v*k@>q{{y>OrDbrklV?W-Y$ew~Q=6WiWqN0Qt~b}#@W+)<-iJVQDk5|G2L&S7w( z_k12IGcyX`ywO;4)!(8@UxL+v1&HUPM*FtSeB~=@Q{Lq+72bZ{wf5wy+mA6Ehmow7 zxiTz4Cv~%z0qYY>h@ZD%85#M-k? z+j7l0jgs)elp0So+Qp;3KK8WqS7@ngR?KfD7sdZc zBayY`q6JPGd)Gi~xOW?PIt{3Z+%ZuCUa=F>ZUgpt@iu&#Fi<}o-$pQIRTaCgio0#g zufEntPf9V$=eztrJ>`{z5BQcG5i}Ug*mU!msiBOp`Xeb)fx`QHuSlueu38J(eLx%| zTlro2AqGO1`N=63iu^-Cj$prqgS6azf_SyjZ*e3Lc&&phpf#Y!RygvHDJS{4&hLO4 z_xkaqrk%(^E!`SrLK-UKA?XDO67N~m_cX|(r2viV$>=Gqs=D>)gx%#=`xP)TUqf!x zf+A{jqT>kPU{#=*)O5F!M7fqieXg_}s;qLStGvl%S6QLDjUS3@mGCOhEbKdmWp~Y} z<{#L2{+N;0XJr>6tNq<}SM5)uu3As{O*aK3qhpDIDSnCzp!FNy+T_y?yj@%)cGx(> z+Hj&_3m9Y+;$swJJTp6UYk$4Gc$n66^2g`Ck=aW5kE?|7n2pY~C5_AR3D|JikFy8Q^b;RUm48<^6l&&C#{{$FZ5&!IcL`@Zi++xfoO3adr5 z@&^SSe?6iyIE=P(Gq(NvKcvfM!g7G}aj$(5E;V@vPJp1+ z@y+mMsdgMAr?rmzG3wuecwy1!(fjbTF{^9sQ1lJeV3573r!!NmC zWju-DFyM)+U8_ZcnIW0UnZYD+n`q}1;jD73|J&H}sx6~X?yays{Lt%F>PM-9VJd zzo}mB+!wMPgT^Zm07YkavTe_SOpsJ*EV)(JX= z-Pb~fikD+8Vg}>PKOCA=s|FH7y`E;^@h-6rik{{c-c0Jt-XVLhCOP`>Gyf_PL_YE z%Ey9G3#h$~yp^Ad6Q>N6-^r9x?y$e^Q{pgt8`-9*Q#8zoaOE5SvoV8_!q{?m zCnbom({?haWANFDH+_Brw4DnbLjLkK-XWu4PGfv)`vaENu2Ggs;6t{#G|g=dOtR^E z!}SwIul5g6lpQK$Aq`y$Rh>3UR)=_?2(tS4_aCxIxQ6W*#ClY=d9nl((lEslnDoss zhNF@{zKi~u9es=^_To^^`-|tnZYMWw1?>Mc$c3>MJ`VFfC_Mp!Vw5 zGYOeXqagmM>NYctbt1leW1EDblbowJCr;L627Os}%~CacWGBMDVYqdi-{^+5S z)xZ1Xpn6QLWbe{Zmd%}iOM5)QlRwcXA;Wtz#%xG#=8 z$vzb|tmyk2U5-1F?yV#lvtUfVI{02AT}gA7@?fZYg9qAg^W2w)*xAgdwHlg0E-jHo zuv~E+vu@C@mCbB6md&J&k)qUGsXv19%h7Oz@savSi>5WyckwG`G@UB8S#y1s!OUi& z$vJqoViVCqn#8+Z*0#NG39eZU=}ONOS@cg!7dszdR(wO9Urpd+MwN4_8RwedNBxJ> zjfOM9VDwLo|0T>fq~eP{n!=R9uKOTAUX}2$pL(P6U0jFY7gDiCg}t`D@%z8o2YtQN z-NkZ;Upj@CZ)G0f(S|LgC5q3lYtCLPi+%_>uatRF3BGa?bN@J$Ye@e-F+PVfyu_Vt z9fZFdhjzQ5bz)I3O;R?)&TjW2?NV`*81(}$_BQf72`^CKrTeUu)bO!RB=%8vfD!nU zn3pP4RCy)0j{4>l%ca>pxA1>Cxh7b)y~O5mpQ)s|M&7-W7|h}ufIPO&^f!z8Z2hE_L6XQ6p^?~xuG(}DW>(gA8OXjFBMNO?-|m^7)(TM zR$TVJ6}*{)b163`8LGHtJX3!&6xdsxM=q;j6?RI3rzisw&_G?Qj;+Hr+=vUQ=nz2( zS$WnxxrI+)7RPpHY2aKn^?ohYx!X1Lp0=+`a_ST{AWc8Df`3$}J%}`xZjB(TB8jVG ztPuozQ$G7zq?h``MB4Ur5Xsm2rSPLsQFZ(e#N5?HT-_(BTmFs;4-;%174)9C)eiYs zo`~LE#b(g7_QAg|CexLsYBQXva4_r*EmQ~#Liv*9(i(cDWctF_p5p`!u6pZcme{ka z3yk|o%3yC}rd^SV9Kp;qaOIpVlgLD<%nP3Ge z@p9SR#Ilst2To<}8_)z*d``~$|MQfW>m~u^`FO-OMbphL$aJM}Os*~`^}e~_Uf2UI z)p*6}#&djKA1c~hl)z!->~a&Qi&CME8>_z`cL`NNkUJNSWg!NCvBikeYh?FB)mmH^ zb7iyqY=qC&69ji%zlwL4hD2RBR=kzMk3l-rnD`V;)vwHXtBeNYrmhXNR`_(IhAW=Bt;lEe=r{vu-BS-h)% za4~b!LO8)qqdy*e?`7ff>}*!q6$EE4)~5e{g-LGW!qb9Qt}IuU&D;d8+-%CJFJ9u9 zDJVy>QLf-mq}tHm1M23@`KEqrL1f>9V_zb6p&vEP>$F&0n?%JK)P-hzH2OZBhOnn? ztW9G~bQ+D{Ta;UFOmKCp3?}I>!0)!t#_p$L&$>k;`xjoki)%;qz3giLWVc{nzH`wq zzwZ_^|Bn!Zo4mc5?P{2dQ6w(@^NLEC#xFc2+u;HUm1tB%0k&r z(~gF)kD}gh8E9whmopQWjSq+BQe&^lObzN9{pj_^g}L{E-ELUHG4Epd(6X97)hXN; zYrAOl(?o$^(&9ZTTy6TAN;>~5EJ-lHY-M>u@mkOKkv3eONt(Waql&)E*!eYq@t(=e z7WaEGv1=X1lmXtUiezRUaC^VD>OvVl-dM%D{! zr|PQ)j*Fa{ zXWB#5M3vz26P-8;uh_|0+kt!swCN&L8JBaa5T$y05}*&$boH8PgH2F^Z1$n1rb zwRqCmNmBgvJ`Q?bXAl?S?)Kv1e`l#Ee_b{`RHOr*Z=v73ZzMIDzO`gVV_6I7az7(MfKP{ds zTIkbtn7hjL+Mw&;RpMtYD%my3wFOa*9hvv-Z60-VH{QJs)&*-ySs_o@+bFibFAd# z#_Gef)OqGRHw2t7}svuEpr&nTmiOx@)C#`p4aw2P(co*O;OxPTW<2ftkFc83vqBY6 zYlhIi;Jtk>f|k_6V-@v4gDvp3w%w-a#Cfc7yBWO-=faxZgR6C&*Uqa;eH`9$$tW#B z&*cd?#y5*GMrxV4Bg>rXxswMOCC9>((Q_s*kil+kEvATy<^wy^!n>Sj)`ABz!^Tm0 z%7u~fXRx}iPEnbUNIw}xRQExYOqcPmQ0(D&9&mI@YA)gNHU`F=Y(q}L(B8*j*Tl;s z&POdF@EpaRI@+|MNef+Y{W>W|yWo5*e(~E>+v-{)fOmM>X;>Pv~QihG{+6 zfcVX5K(&r_U$o0p5|>XLdgf}bbhc-@iPLSwwO5>{<`XR3#z2$yaR@`*tR2E^H(g`~ z{N2r|b+7=#;$6tYsqq!OeGRAppYcP9XZH@?W1$jUhgEh(ud07Nyk|fo*F$XNGWVPq zDQdUFATlIxyVG|g!bs|*ka6Pz^z4i8qJeXsT2X}q9nNV{AKcW)rtd4tdu*OTyiCVp z7QaQ~3q9-09bVP>3gjjk6#FjLj5diZF8gvAeuBwJ0j^N`=Q-Z`@CzRq4QRObqmN&I zflA8M$~b#Q13JP+$xL*W66tM3HOEgG$tp{=)qQvV`rgZ1kJG2NHklxRfT28|yN`=K z>fY0zg1;};6-Fq{T$ojf!S z5k}Y1Xv4(QM3#lzbQfLnPQjZ?@)hYAsCfSm#fK#dFoNHm4 zi+O|n(-!dgn5fU&D{K^D<-sr}`s+mXVLIn3j1=WO_#CqA0p^bR5>4%_euWjki6U z2OJjsn=q~_RNqM6Ke^cD9mo(^W21zXKf1(3sZ>3!6R&D~_5?KX3fl2@j@Oe$>jnQ2 zw!a;3>6M9No(|Gwmah6B&i<{wgj0l+Orq_5^W@OePsd^4<6Q6a-5A|m_AQfkFSem3 zb}O87))?Iqi3)5!5^4X&;@P9lM}#yDr48x}(0E#4jA<4;v_e^$ISw>ZqX`j)Bfr}FCmG@NW_cNgic z#7NZee?>WWrypU1J!lM?vO2lbSI$ZE@`Z=9E-h{S%CTXCh!pFtTpbxaFq6>aW)!6@|y+*zY)oD4;$XIe=h z{MSJ5IVbN%9b0))Y+dGokxOwmRgyI4P z(-(7XAe2B@i)*=?0TZHCUv-vh&ecHcJ~<@2a1Kb`(Ql3yN3QbPU{~sY`4S4tJ%q|@ z_fYElOH(880EH+QLt54v(;;U<9otL47#9j5&Ru8!xL~=ecM0Nu_kN{Jq=YMDbjX%6 z{G@L~*=rqa(c$2}EemMRN$dKP%C`n|*+UxKjgzJ>Kn>Fds%zus9iGp7OL2m_c|;wu z9K;UL39afcMonv?nu}Mb%kR!e6)Dehu8QAbCazmv{UqDeHsz|0Q-f~cev#(;9Q{E@ z(|9NH_s@o*uE`h5^3?DL_U`wI@?9^1D}cZi#!0T5RmPt(*{W74JB5sfj{7f`#*wAP zENzakHWx4A6x+wwyh>BuVzM&|jV#ZNV&-mx@;6u-8?B~Gv(AePE(dCpS zg^r#YD~Cm)hDLMfiBe0!L@jq&trw>*4Lpky*so&cnx@jP;}Nm;oE9YLs#MY#h%5WA zx=jF;!LSPHV;9?36yG8bKyOX-zH4#X_BFQ3O8+3Wd!7H~0Lxsd2_13Zr`WqY^vai# zSw@`$7?Zaw_4r2zcP{fd_D1WR)Q*W_0YwrflqZ7ZD1ZjvHWJ+;4IJi zrQtLseBl+WAkd0suo1cOf^s;Q_H-Ld=VQ$=_74>KJ?V?Ty3EV>41Ira{}L%8X^~>S zYt&%Ef*I6I3 zR)%kSaq95eBR!t{2(uOlsr|&@hA7=E!)$~;P3tTj%oPTvbSV+fQNigG1rKFifG$^@ zUG}GFN(OQrJcsVpOjLoFm1YhAu*vFC-={))hV8XTK{<>kV&vYVyfP^KgBZ7QLxD=V zX^;Q*5mFi-@489(zzcuhoIYhCMIM*B1@lltKou#Gq}Q%CaR(&m_lj$(XXg6rA$tP0 zI)bx>_0z>>g1wY|6I_{Xu{~I5F&eMGkDV{nQb`vn*S06m{#aCAY7+dKbEHd;R+*WE z%`)LLL8ASz7l(0MrwSfyxtr2;8|tCxqt!?)b_gw(RF!g2s1(Xt?7Q^g(9cZq7fEfN z_1-FqcE2*B*`TL$(xrHAb=DTd|C*MKlCof<-eydJ&tNXyRwvxVhi%<^LTg7eOa<5K zM6&b9Pae)#d!XJEkDEOxxec(i@9sv6bD*nXYE!JdI^#t5Cmynd>1g4?m2LXC4a zfKx3p-i>Q+l0>?j^z3fuBg{Q6^<~Ie^!*;sI`5a9owWdNTGg+jek@Z&_$QI;W~32O zt&I?VO2eo*xdOH(Gw!_vPO)0&nVi*L;d3eB&IQePE+jD^Y*Ad{O>bS}iK=j^8O~Ly z@JGVTw5B&qRD2UYz#d#G)(va_u*X?rmb#!T?xoO!+nep{dU8l-kn5t`DZw*KbkQsR z?Lk{2=d_AT+bAzH-*hTjOs?Io)lgazD$C4DP(V57Z?YnSH}m(ddz4PYo*lOf3>x*G zxl>ay(`T`9e@IFKj25Gz(tz!A+i-hgGRcS3a@Clw&g*dWKuxx_e1*41s)_N-=kUyH z#A4frDtM<(ePjyd4N!Gv@s2^A!8bUsWQcUiL+xQxV9QWDxQ!ePkg#0+jv{*nho-e( zVn^mV$M$%S_9b)Izr2OmV7rVcv0RL&v7W=F9^A&NArE;zOeKY!e0=SL**Q3T9bfv1OU(ZH z-&HpD_3Irr78(n;kuxBsi$!JeIx}j7VQybgjHR&Lo$qrV3pi`kJ*?@Iz$!w2ZkHnC zA-m4f4m`W6wsG*w;LU;q{(}wFQdP8;PoT3DEEn^mHjgu)lWT|L16R{I9=h~sKeo-{ zTK*T~Oz!1JtY!ljv5JA28Z~F@zuet2Y z<(0Wg3~_pHb1Xz+zYKtL6N=XTA**9oh?g>{FS&|+l+Y`xTY$-*WbN6fQBb2F0N-L^ zABgo`7w7D{;gsp`C?H&Ia|u?_H;!wUv$>O)8#S$9|rwdI;^N%a36f1SWi#?120=$kLIay?cm zD#1rcH~fp#gKs6UE6I7Ua(vw`qrjJ(iID#XsdtN{l-MO>6m}w3DJsAP%s_J7Sv(gR zAnwsyIAvcr%=`=!1)}_fuM>;PtRDPZ%!f1ho9HlQYmbcme(kSJOjF6)7)OS&S5)^xQb$Az_W z;Wa~g@e=%rmx{8LXL8WpL0>xr1-V~&vkP578Ki1eZq5CAgh&%K?qQn)yPv;JN4O~8 z^qfh|9c45q`sPZu^Q+C;rh$CmGSL=fHuab}Eh`o)!*6F9#&g_D#IfuV; z`n%TL(5S*h`X34}(9(7GgZl&Go(BfBxA)-Dh*d1Bu2?LM)&JsKykFVf;=r1CJD}d+ zU1k;j`A~E>wIH@HDX}4>nJAm{UeMrX>C<*3W|*=VOh_opCP_Wm;qnT4n)tFj<9j%Y zquQmdJq-U0=Esyx$0k;LTt?QUXJ(baPYdE>HXLJ`jUrQf9UgUBWV7k8BV!bB&`ZR9 zI$bosLB&e*o1b`kbk`zV@3Jo(v8tv)&3XY2PMCcaJZ1cYrC7khvagX;<-Z`7T)NMT zK<|%p7#AM0ABq&q+fxd~1ocaO!s9m?yQiu1#spyCcxI0`?hKKXy4&$KWA z^K?K$os}$Lz{=fVyYQ)=rt}W4&6j|&WRQE?#_>8(?gg&{{C3-{FAtxvHQf!+%^328 z`ezxgB}XOh-W6T6jRh@)kb)D)>Y$hVdwI1_szCiWA+A64hma%(BevJRlYQ0mR*1AE zz#;%{5_jqn&Z>P_O7hB%eT^rJ0@x|X>Ed5wP1^-=>{=>#~kcKA_F0eHD zXAp?IE>R>bD|Tn_0YRF_EW!gMkK}*C-|-OBM18&81sW=GCIK-M@U*)(DVAMd$^&m% zAa7s0YS&+B)0;J7?4w7WHBz88uQuB~&=c3J3_&}1R|$T*Qtko(p;0UprL7d|9I10j z9c6S~W0_ZYt`DIqzdsk#2@SY6PyWeDt)Qaa&lh@qO7y%IyxD+Tu3Edl0YGPEmuim1 zHxvOua+N-E`FLQ^wtvNTNs}m`U}Hl6^X&dWC|VCwV~$7v!hqTmPzhy*!;3%380wyX zOM@vU7%J|4(CPb#WpPYDeapk;!^2q)^zFBbbB9Q&v_j6gD7*1aFBG%}Li|Gj(E$Nu z+fcQb0R0Lkz;MW%PT2014h{5@Z`o`L==%>4+4u8WIG-O4Sp(G1j0(VP1C`XA(q7^} zV@F3Oq?_iaRnoM|pUwn(gdwGW{F^lxRK(HAqgzqB#7SQfmLW8KGBfjv z83pV0`@;@{$M!Kj>^aP;m%eNq2ESgG%1f*|ed^l{n&^e=zUy{Lnle(nvmfcN_S0VO zxtpkh2UG{;AoQ6Z{!8;Da(kC)VOa@YCJ{QMPx<>Ax`23Z@m#>YHyCm5*8#ZE`E2do z8_5mX@wNNBJ8MlQ=PEW)$*cg4Kk zIaHgEQm*N+wX5(1RictEGeDTUI_UoCjl!_5{r}11?fV?w_O6vWEL3Y5|J7J)&K_yJxO>wAcmK_gGI-(~>V!k0_#) z6H7_1+0e=iW_QJ6xh2kEbr|vpWd=F>4ZXc=2LxAfObM=}eeDpK0N$w^0kYvGPY?j$ z{4x7@b5(hgPm&*b+ci91g0sgF*0}Azdm|KoQK$5n^_GDjVH$c;2e5jql;q$3wSZ)A zVwpcxfd7@m0hEu{aMX;e6Tz|j+o&)hfgRhR*Ru*bRRd@>b)4-Mg66x-i(=EjxcBoQ zwqFt2>ojT5)CGhUATQYTIf5ks%?GiJ5QR)R^gGI2nD61zS!AOtId+1WddcXcqxj`H6??H|K(B>vj&^(hCLtMyab)$U%?%zK20`FW^j7qr;DBH!mTzhF>rX0a;`KN z?mPMFdHe@p_1MPfwNk* zhh|_AgEpmw?F?k4j8;>^)E6q@+swII3&9n6N@5HqFK$(=VNSm_j)jtgcQ2ays36qv zCoVp)-F*56DjOtrTC1&9$(M>Hn=jlzxbKSRUDJCjpsZ1Uk9bb0^^M0}ss&gG*HGyf(FMwX|18OU#U?TBbfE)r;tjGIAo-=p>C4fDNG?U}@^tYP?!c4r|O8P)z_bM#-wQb@1s&3iK0^@&6EghEVRZ z1;3pW>#V7*q>fOc=E*~R0b*N8iL)VJk;aEzh8<=?p8#66ITA@RJ0!1Ttmg&56wt4I z8%pQvvaCImdfxi0F#wAqLi>SVUb%R*>Z6oRJ)cqM>Lb8EbDfN2=5f?I_)|L(W@4z} zHZ5~qI(sf8f&2aw-~Q;XevT^6JCm_B00`?Sp;-@OcVR-b0*95Hh1`g=VHO)ZYTK`R zB%m4Q@>v&aNnoC`T5;(kt9^6SnF+1g0F)6<^uoxohVFulLNpTVvardiNrpfS~~2T%jx<4N(70tVvO$2ms%1yexyyfJ#B44 zG89XruxtLszBFa|#!pZ;rDqY+XcMpd=7!X9l9Vg5{fQm*ywL&lD|S89v5EW8;3$!A z$bnXS1$vtkm(!g14=!EC5;|KWv{(1xvigGdo2V?Fi}tC>(qlSj>4`>vukrxfQe!3UpV z!>kwMZcJSUQ`9;fZ~4}R$Kt&0+Ed2&E2hZ-dR7XpmH-Zwxpan|Lj}?$7-w(G1)ttV zYap{uuHL?0UfOIRsjb(ydq;cL?u5TDzsk$tjL1Pj<~wvB)J?r4@%vq>e-G^xsGdOR z`DVLph8UUD^O6#Klq7W@iQFH55t-*XFuG<9_dt#;CYzniv!g>yXnt-IDg$ro@9ao& z%{&23+hbKLEIahewKtFB%U2H;@0ZMJa+ zeF{KumxPe^Q1-#7lZY>f;eapi8M5VZ3ECLyGOd=Of*k)>~lNy(ZclNDC8+CK}GmcZ41stxzEj)@!ai5 zJ4cS<7>ao4*eK^}2`^JWN{TI;cWUVM@Do;Cqv88}E$lB}FF&$nZ>AvUtqmwSg8e4B zJ1>c?+g#k4D{I4Vb6fQ!;mYkzF24G54+Gb2U$xhx3w@Cf%O2E1o^F_Z0=QY`dVley zhmGV0zHJ9QMPML|OG#XgR|j>><&qG%XB2SHrd6OgwQRwYfe4rWU#MPbp~Kyl-&g&mAexl*ki(8?I#f=n#;_S7kFLi}z#5;;T4UPxHY*=NTd+ zONw@qsdF&I>rhP37t@KZ{rV2{WGDzG!;13$&>WfVjbyqp z#~?2yM675yGoujR0;ULVi}1v`<}?4&=87me1bN&BM8X|oF!y>Mqen8KOEQU61sLO= zbcJQFpa;)OLkpVo@b@(?g?;P@Q{+8>qK^eO!4uV?rfSL+DvgJ-Q0O99M_S^%{uXAH zz#mOJrmS@kah!VLHNL=vRP|hYFwJ(hn9lDtU_lDoI$4hA7~JI8H(wY<_^Yh!!#|wg zE5&y4*47oLIE$Fy9E6Up@C}LdRt_a^@4yiS_QJmxzX$hQBGT*uMDw9i7*1ElzdMy$ zBJaJ9TUMN2`*RDqnfhS=bqg`8P|lw_4Ja0=n#r4~!8%Y=DNOK*tlNR;;`y-3?Ig0rFRi$UN+2wlI?c;OZFD<8>Gpvkt&#lYoLG%N3#Of?h< z1O<&IQ|=#mQl!IO`ge>Dqz_V`KZ(uo>qcg$j zFd43_Kp`N?a(J&?PfdT4!!eO|7a0hz^fUBP+2n-h`N#nvHGcl~Mjrj=+8^34-VH#5 zh3Fp~aX-p!$(PPXsG?tH0}o6?v>TDCPUXc(X&YX^9Z^z-`Ox8!9w{Y z=Uox1O1@?@ANp_9dp)~O^Ld~D;fS*aP!IN*#@|T;$XZJ7CF`$*zXhQpBgc>aD5ob& zq20KqK9i!FL=l@*ixxqI#KE#X>-k=8l?T>EXyMKZ^-|8J=jatLa1fcf68ODs?=#Rw z;~6Q(_K(r{3LUS<&awCg%Lxu{+W4}>SqAx64Ji^v>1x3#u~73%ap* zzrMzsbYV@aq2j^w$O|b8K$Y#L6!L4o*JOnY)!t0$q4yPlH~Pt3cm;^ErVn_&p&I@h z<1jq_B)onrh;wP^uX3XYKUzFg&?d`QGZyz?g0CTp`QCbCllBaR=Ee{A6m<(Av}F0+ z?Bg!QNFwfk`hx&0zHBb`Si0X6aE$P6l;-kn-nJ-Xg7VGm#a#xlkFa|s65|8F4y~Nd(6FYl@BVWpR?oa}H z2|;an&mb0GNQCPi^Kke(MA)WbzTU&2HdGn(Ncb^5ZlFmh5oYSqkz%XlT*c7-iYl-a zJZ#5~iaXdO_0Y95q0y>yvk};i7tWz?55$ZIHIS3|oEb(6ALCUmANdZMH8mpa1g%a@nq z#2#;utF2;(c9(u#jvZ_1FO<&xOw27c^|7&3^S(;hxu3h!|I7O+-1GAo1F||pxUr+i z1FAJZRauJEPl#FWaKKzXf!9|vmoPxU%a;mv#Y03t0qoIZH;rKxtY;m`rI+^sp1{i_ zOtaiO2dXIX&p3HDX5}ClB}W%Uw2yM@@EIBitr_smUD2Nj-Ov65&I*YHixtm~c&|VG zif<3ie8%EpdoG}RRZ}V9ql&XmuR{>{Za;q$%y;oXrDatyUQvQ44?Ucj1}Rom-j_}| zwfn}M?6h`T&A%AOCoHqU5SIDTB-;!V@drAtGW}C~x|Mvr9*|r{S^+kD#5#uJNs`UdRBZr-! zx_%1=$vDWD&I{$ld2!3hwI{wyu2jK!U>jWL5E>hegD;k*RRF%@_vgj5O?fev>T=S2 z_6AY5b|2)PE?zfbK;So+Qh4CP>bZm*!M@~G3VjrS#vB1mL5++;y3MPdh@fEE#y%V> zcyrO!y=m1=(0-Alx8dhlYa-v`$BG$=XuO1(ArUD~NaKSQuk)kbVi|H7zGp=3Pm2i! zc#cXd9$*>_FSG&&c00$%b4smP*y6KmZnt~A#<6%pX7|fQsR3JxXQze)#!;gzWZ9=X z?bd|daIoQ$K0~|?qnWXlngMYWd%fZ#lwu?U>z84`;)`>KT?#6IrOq|80?!l@$NLH> zD^I|7Y2%!VhBjaRaZLceQN8Kv<#q}eVW|qB0ZlA(r@9kix_^3aZX@#{|q;0O@p6qzn{Zvfkb8m8pY1#o`y*vbV$lcy-GL?1#O z`J6_6qrT)F@LTI4H=v3G{y*tP5q3~n%9)BBjz4t(KsmE~g+H!xmhk?>-B3*ESsClC zSa&{|pMXz9BazxpcAMo8SUzw0nUi$UM^jCB0>N_>hdzc-zP^JglN%J3i!VY5p6CKV zfdDOv`YraKdeF@Z4!}-Quk;Y9PKIZ2gL(uw2H9G1N6}y5p@DJj()no{ z@shhg1JUFycT3QD zpgT<*-AHX08~0<+LS)E_u9eh7mMHNo9YQiWNntH@L_?rlY<6ibyF~D3+8Pk02mmGC zC;q*pKhObDXox-)}P26 zo_@qkU=z?+HnGl=tB?<^nygdN8o_)W%im6SjdDcM+<%OlW+gY6(lW3W&HvDe8S}E< zBa^rdnWe7yS2xb`%tgxe3G$aH4D`%LKL$wu@XH~qDrx&i*5G9bVd`ZNU;zd?0{Y#} zM^0y#5)ckgszx68MPB%@aBj1)KsiK)*9|rmn*D1>`DzH{LT-?Dt*tuNPKJ<~+%w}v zSLQEc@BgfdfnyeDe=CBqBX0LH+012I{FGKUAQjmfLKtlSE(9=uptEpuZD;hT%A~T_ zAX5Z%*4!roqfY>dXb;?4ZppjlthFZ=qC9o^A1aYy*JV(NM`(ZEz7I_OLTO(L8>KY` z78W`t({Appia)6oD_G$zo1_p+D8aLT&bK*jrl*Rhu7=>Bw?jHXq(~C?ls@q5rfPtJ z{wNzekz?S6+RCP0)7qmP-kGYzk%cb8P5C?2tWe64Y6!0`suwDMX?7^oFlI{-!J6FT zW9pajm4j%Dje=4=#5PLg)|1x+BiUDU)#CY-g?0zs6YI}lr zFRW!-E?yO>(Ecmht99r6=dCJ0xdc5h~Z?RMNcd`&7I%M!*saxQaN5 zWluOeNzU~GO=8KtT1+T<0!;BDfcM22-163ya9dt}h1WeBZgZaj&U|0`&<+KX6BXu` zurwb4p+rcdZz*Grb%mYoP2ToJ+Y^ZnWU1i+O^8l|7~bulwa-me8K9E+-LsatdMipC$ogb;&0|6Qf6~N zt-Qi~t;D!d;2bQhhv8J6EyQ!b{&0qka82oOJ6xI;U= z0oha=tCo`q_$>2Di4`KQuc_7uM<^6Ny__F6+&Bze)PcRNM+d%RZ9h$}zCPuG{&~Q^ zEz;xiqShkkDzA^>UrdNdRj-!0!Lp`C`A7|YF4&Eli%*`1U=QcZqgLLz)4W7YxS#1cX zyk7p=L?{fH#J#t8+?YB%b4I1y28xmfA35E+1R*&U=Z&2#7_SQx$k|==ZelvH_6w08 zYG1%!Gkc5MRSat!s)Ey;sEIB^3eFl)8%K&V7iG4D+AVC2_nt%|%Px(vjw;O1e5SYR zdDkBy{fXqB)_ST$g#u8SCoi01tr=gV3Xq?-T)S1=Y>Vo%Q10H3a;!g{k-8JRgnaTU zPs!r^rGF8Ffe88%8znx3DWQcU+YIlN9^7GCbwHQplY@g)rU6I4LN6{+$+@j?MC{89 zdFqVCB+L9bLbX7;=X+oPx{?JMy;wS^3n%v~)g}Di^M!8|%H8^uZlVeHt=E#bUY}`b zvjO2e>wjE;JLMh*_<4xew+0z#Y1)#juEc@9K+bfrykIxil(v8!1E8bw;#}_NG7A)$ zIC+by?5{svq$nWH#+{EZcOOoq0&);3L9Nyo9IoYv^-=rF(4ERBZ>0qQ!E&hIl0hkr zaH4$cp&vDu?sGg(^TFm`K9}9}GbSg_2CI#}gL;kc2oRmMCj_Tg(4B>#O94R2y)t|@ zx@KT!Ccq4fZZ0wEBlLZ>{t$6))XgL|dxCQ0V^@4OE2EW+;HwXO4KQ6tnyQ$#pm7|m z1?saF$&4PxkY$Z?b>QPH&mn9^%EFX99-LCpQOxP#=Ke5reYuTNO9K8n@@wvTRjSx| zdeJf49m}7o35GL(AWth;J2@;wyF(9UouBsht~6dYV@F5s!jxyjWp|o?5uN276kdS4 z8hI~mv#`H?s21wPj`qA(5Sj!`nR&}B|662Oc~LRvH6=M=7?6SD`phZPPR6Tl4}lCD z{oyzt8%hMr&=r_&-Z|^9LoK-~tb*qmITM0E!I}Ld>y2PnTCLzZSuW(CKCsJEs6{NF zYH9cnH)sc&92Ks%|Lg*l;gt=B9v-?1gcO$+XWi(A`Q+GdKb%28)XAUy)2t1HNP(Xy zfn(6^%0qMnI8zlU%4J`exJkd0KHjS8f3fzST}^M%zAzmT5fufb1-AvU016_~f(4P@ zR8&epq$phhDIuXKC{;xfqy$7MqEZE%Zoj^VeogCHAX#mSG%!^=A;kAT=QbeI#_*-3aBz3oBjc3b?}JV56W3a-%q2 zR5`+3MXngS&48?)wuTG)lg24wZ+P;sy={<((V+C#Qqwe5=F5N981LUEQ@}WW>002* zif}t|m*D3b!IK2u#;9CU^V5|QdNg#$C)K55?r-ZY^)=eB>w)KQ%GQahV7dm~Mj8QZ zAW?PJ!P{j<5j_=(0pFq)O5t0?6JYuCo%~l(|1!1wl18rJGLb7_D1@cX>QC zw(XkBk^|i)7%JCGEucPB$w;fUh)RYG>FYD!>O|;ADEKgE_4^|>zDZI)MnY@=N=xP| zy3wc9XQaAFgjItZ$|gA4xH)_P!t1yhXCXB zh&L?$Q3A-48oZ)qbj-i4q-y6Bkf52DB-+k7=ZLTGj~4EhGz2KSLo4bB`Q{sBjey)A znSmBk{|Z(_n=M6JEkMH4I5}tpuj;g2g^>M;tDkV^nk@wOb!<#=5t!eTF{P-}yKERi zKam<_Eh1P2!Swp|NBm)TfrC>pm8bH~I*}9&^UXTWwECqfDce2Cm3pIm|Gh=vX2e5v z=0&XHW9env!kZZaGVMt2Ouqgs7=bNN?Sj8!u$#S<-hg6zh9mo0JHdhs1w!U$_ml%| z5w}R*Q!+rw+#8P?vFG;_veMz(CGX=g8)ubI9d$AViI)+GrB|~$@B-Z(bK#4(&G^PG zL@z+mpUuEXck)OrFVY!=Yv}%K`D@_S{8wS9v{PNwv#iP$OYrIe9rpO%o0jn6lcY1% zicOOOr%u{16>EBFpao-XNsb~{qf9%>K(mMaD#tumBvbAyE8P735Z>b`!udRS{6>hr zt(jS0`Nm)CxqLQ9GFcR$+I|v3(~id+gju3hOE;bfD(C(m*`C+`WP9#q*p5ZKs($^; zBGESJBYjg3c?J-Fc_3ga67|uD$>UOkGcf9!;SjhP%zTLV|C{wYzs2RUDEMWTR|^%u z)GN;3xFh+I?tJHUh$je{QpH%}j0-@1)Q7$~&VFLyVTV&C$JmKIx|^*qG)}PmiseYe z@dm2Df_h3iWWnPBGymmhdkt=kIVCJTTwQO#zux-~{U_478b5)faX~T$@m)mBQrH{o zTNRdR+#_ERMwV)G)OXO7cHgtMzwR)rYw(}y>Y*3lg$e*#Sf=)3en;BfmUNLFDShE< zIWp~>HY`$NM84Hb_b{$Q8&>x}F$cX$HlJ-(rJO7Tptnt2ufuzz~e&?7a-C^ogrCOba)P;17bz&$pXq_L&7 zjG9)o9#z9+HgJ*c>gEJs*;HJ4b*lje{cFZq&WkVMWBdllSQja5oDRbw1HX znD(=c1m^U&yB)_l|C^!Dh7DQTu#>u>%LZS0j4EZm{0Q{v)ezZ9%MqC%+n98Oa~Z`A zphrM-aE1cPDf&NV+?Un7RxyKSk?An~w@qt6Xb*Ui#bD zq57k}PTE^^&RJ&06w93LZ=jBSaUSd6sH!lupUn6ffQ_c<{%0mbb_WTc;{OL2$^c5CY*W?E3;Ss!IvO8DLE~)0FY`!ChyI;k!{8 zd=BCXW@R9#A%i8&FGyb^b5TsszK8*>=+Oc|3Ag^JY(V?^4{ZA9#y3#|p5?jHY zdvb}foq+|3p8wS~_K7qIp_X8;;$(T-b(La4 zU-|62JzKdHexbM+5%>ejcOm!a^Yg&{&Z6E24C@+vS1N!X0xqX(www%Rbx)blWRCeu zhfTLEpV3}9H`%I$oUy!=x^7wm*^ZkD-0ql);AZy#*|a4Ln2H@D3ArJ%x8wT^KQaoq z2Ip3KL&7cP>DWWF!qi%cdp9bX_D{Ijz%&TEv3}Sey3h?Snrd^6PT7VcYPHx>DoB$M zCb#2Oj};)ks-355q$`U#w~{H$wvs8BI#?+%5k_RP*u4$#tr9aF)1KF;eZ9XW^V#;` zxxsbg>7}OE!3E~zI82q=gbk?C zRUthYC|k@*uQX&BexkN&IZyG*gX|Y0`Ro=_C|w-Yu9A9nWf7 z1Yp_krwjh6^XtALkhP2o5zTMaES=M- zka;c&qV?3^hK{kbv3)n6?TeJQDu=BRa977s=Gd<3yfwB~I5tw0;-oh3^7eN*Lde>ofo8>8h?T&P(BX&HSLF}6Vqe#S%+|xR_Psx5!0-?e zfE%`@-*?)x268`BCCa}&pb_s^+^7$8%bDCO#f%LBTT#PB?`9h`9G;P39@Ga`gb(1L zKn|_(5eOjdAbFe%TyPN4v%tC6BgmDy-T*W2RO{-&0qONW-KEA?bbl-wdhovXg{b zWr1(;C@0lHGHnp}jEmp&z#F&h;}-?uKk^h&y;p#RI`17o{=Sdd-?ycH+b=^~N&{i7 z0J06de#)~DESwp=om_wSACq8YZB(3&ee~%J*Lt&=1VGunWYM##g5;p(1RkHhVpf{r zqZu!)!oH;qR27?P45GG&R%8;tt%$M-3UXnX(VmBNb=ZTJ3jQ!80rjEB+JES-P9+E$ z$DLfmO*k!DHVUSW@e0E(O@twz6jY&n5PyezA}50O2`SMOJl)d&9utny(>iX`U$`pU zY9KxQQ{1Ym;Oaf(y0d=-pT@`N1cHdbe`^d3j+1Gxzsh3g?7>t9$T)pHdfp?nRPj7k z(K5|StydF}cs$=Nv#?8D_;{f~%QPO&rHmh3OTZu4{v+5b8=+0SxTT-71`Y{TW*jf{ z)D3#Z`Rx?Mmr+a{*-nw^_^cnBI@=2AIW_5+JRk|A0^WhUGib^;-@Kd7D{r$MC6=oX z4srD9R4$RvXw3XtsW+PBZG_Ev(uqgn29=1Kq?9of$Ri~2g++59X2MS&E@OrqsE0`H zVTr+WVn*fD?<|9z0E|LVFL{G-H&nkS)cQsLA@4*BK26FSzscS*BLTJNw79UVt_O(o z=`-b+cc`{vfXS~GcYSh2s8wf0OO3wNb^X@Lo7`d39iN!grQHkK^40qrCMc3A(Cz+O z?Et)xQw@3j8Y7>5k$doDT%|cQlN0%VxTvu`RasP4AY%3*u&{K8F;mZyg?=$d_)7eU zF)ISkEWST^v=9T0ABsI8#EmDjt5&qf<7aMyp_cmX_W@behi}!+6Sezh4)znDzbLXh zzoRPRZWe9)`~Zls5u&>KXfhu{H0oG83Wtp=vs= zY2I0~7b4(8K!|-DDxG#pf-Z=zWGf=vTOY1>G{eeGcvkbY0_lP~#6*j1mj-tmYs5jM zA|W^6yW4^TeJ=$0g=6Dh_K>p>+DRy|Heg;*>NUy3X=CCcRpR-0wSq0kC%-%4RP}f2 zr=N#LgGqrXgEyRFFhHJL_H$IRdMlv+PtUpZq-{lHfp67qjJ0t#v8If{C(|x;$jwEP z4I|4JEC7f8C(tw6-=tCV+ z1%B=KRJ=Mo>7}mF#!Lq@``e{^dufcY`z(+|3>5s&BoQEmmL|O+x{`EAI}Gr98^M8* z3u%RZ_vdSjQ*n|&egx5A1`d)l_(7|QO?YI(IqV?$R~HbVpJFWdIBwkhV<-PeaM~Cl zFEwkap*wX4Et3_fPSgT|9zPV$1ed-L3&&+NV+`Gm@4?rW8TrguTCpI7US@DloWS1W zxGGFM{SEq|koBoYyGuG^^^FZ$l#f;qP`<@_?^LUc&@b^|q7k~R)>Nhe#L_JB+qhAa zqVjUoto^1fY0nj-4tudvX3W@%HQqezwgD#u&|9HG$H;bQk%?>{V_y2$)A{-uwewy| zg3;@xh~EKBi&-1s`V`N;!Qm{=!;&iTN(hrV2@qV^vbnwO`p&-fM7alQ$1IEaNs70s zpS35X1|aHQ{IFL<_zo%}@lf1pPuz^HVacGF!1k8aWMm4X~)hxXF^SLSll0{gh2$`hkRt|F(EL~^2NEs*<^7&G z{>%IQKbQow-8{NIX-1Y=SwZ0L;*-^u>n?U7gBUAJ35c492P+Xd!CXAR5(x~+X(RTQ zo9t_dPZ|XF{Ey*n1(PA9U&b3!9!7o(M5g02 z8Ka(2O+&*>>FnWqm_nm{wFc2$@z@_ z#$KyzIwkM}<5ps2_CL522(0(lK=Po^E-k3et5&AEt=DWizR;Cw<72u8TX(rV>`zWO z{0s9IpiSB=qD_%PQ!-MAr(KS1u>X?<@ZD@Cc8^v}OEO5l09AL{S+Wn{GbMz~q>C|# zMy8eZKZbmJ5l^Z9^GS~Og<&N>(4n*TZ*li4qA7-B3_nO%a^rlsO zn)_xwqg!1&34?;(V1}hfWd$7U4xp$wZ+6CY&UKjTJi-nDYpNIgiY7t?zn-n_0U3I)26 zH%oTQx@_HbTum873Dl32yiaS-1V&c`N4h>MLc$zo8-%`RY9&ql?yz;5WfyBs=Ut3D z%x1JJg^m2;n?XpBa^rq zhAJIe++6xfuL~Ti+=i|EGEaGZ<#0#sg#sZD4)~=TNqrAX0~_B+OFi&bpq}}r|19X8 z13Cas7Ec?A_(XWTbo)!c;M{B4%JmFaYkV{`Pqg2AEPLmp70v6F-G$3<5iX1d-M%0N z&AW-%LY;(&vEg;zFN&#mcosy*v@hK~OsH#bTBxw<%X=UZcl!6G@Ej4+x5r3Emwfxh zo2)#&wy8B`n0k?^dR|P#)2qwT1hT!jsLYa)Em%kt5Z0BX)Ocw|`*+j==7RT2gv)!6 z#&a_VRY|*#e3LJaaIe!4Mufw1CM#eeiNKj+Ioosl1$gd2s6WnKwj(bKwVOsM zx+IYu5uRtg(*+1mhRLu%jH20Ua{vw69QVA)qR^^xmJmUw-zx6r|Iahg4Tn zjG|N_7^5On87%EjDKHutVDQ7zWu|&9IELZuYTS~1!7GPk1qu$5xPPl8n91MUZ7UeK zidHfnZW4^pXop(Hc+VU(_|7rcWL*AQW5m!z@~|}RgN_dJP8Bf%^?FRkSDh4=Zw7X3 zUA&!su1X|IPa0FZYmG4f;Z^2P<~14eQI6R!nD(a9k7^nkj<+(%HNddrxUGZ4gGGU+>c3?ceX3b;?nDifwe#p|U;bkU9Aoy>JHiMu#AQpQ$aoaHGW}v3J-8PwS#Ej}0;yCP8204sR269gYY1u;us&+~~scB*T zvUARLIJmOqemlbNytdxnAPDGL+4WkG#1xrPKKS-Pbb5&y-Y(^HBG@s~mzO`+Y7R1* zLUHR*8iz(VOB(`u!1$^L4?!4j7y91%Qk|f(vyUeaD%SV@l)AZ~5=EB!g(l<*=AL^y zH^HBr19n9>U{_p!A4I{;Vcj%G{*nxVT>e0xP4^p}EZbS-5q<>GY@8UufO0+BAO*GF zYuCtZd;G|)cxMHo?q&Ij)+k)A`Tjr`NH$(s?eLHJ?r4-b^~5n6_M))(kEOlPbk}nl z^1dCv>rTyG!$(7A+jdG#m@lcit7~e^49U04vw26dQl14u=J{7IDRwvxkwP-L?x@7V z<@n5iK&~$UI2DokWop*C_6F~yoOiPc){YZwH)qdTVn&sFRb_(|FI2mb4{rWNL)Z;8 zkZ5ijGX;}qL-OW9kfya9Iv?|q+(*&e-#hu;=~ZLjtAMUS*uwGFn7FcF&5@02qMzxx zjs2e}`NPk~plmDQQPWX~(-Op0CwL)09Tc3Ww~xx9HuH%-F1Mzq-X$;i9z;YxjBN^6 zd46Cd0wvkbO1qnH;l?)@IO6ZZaD8SJ60SbbRXuG`ox^3;wd$n>1?<NFzgT5BE4eNO!tI$qt2SK~dud|6zCzAc> zryyMr>Z<#Px70f>S>1cB_PN_EVTN)hPKcSd}-4@|wc7c~{$UD`mn`86(lsSzKXr-A)KWX>G^{yPkD$zb` zUvm@w<>ecO)j3KMuZOFixo$MLZ?Pwmq^*;;|~nfTs|_PM9}Rl5IT zlR|%|fn|n4ajO|d_|jUz;@pP<$Y>5qV0!i1H5)a{2l@cWwkgmCIj94IhMntIhG#Qp z?lkF4Ia@X^%C3p-FtMmSt#J&oq#tB>?&;5N&Qzr*L1JkJPPa0=%{KE~CQ`dX^51eA z%^VF^S#9?H=m4TnU9r1J@y$a))rih@2qFZH>o#QtCX5AZtB^>>I^II+&7s5oZC)P> z1(?jHy8Fk0%d^?@n4O=CcN28jJfQW0;--RU)J3^_c|+i(6K_B~Q;Z-*FdG}51G`1# z4AXdq!K77XJw|-P0%2}x2sxDdAm`y=h?C;Uy>mrxH#_2}wNG6ySKq~B%SYGN8}gk# zrck4=)9`ohDoFXRa1{Ms)jU_dkY!nnKU3XTD+K3wUDwNZ@L>gmn9WWR%1LFZ>%R7p3@2|G>U08e=FW-sSFLkO+Fm_hD!bxH}|bVoVxib+)yk={j;wSp5S^}pQqW3tOt z`QgPb#;5A@BPsjmQ@`s*3D}^d3e^c=)=TF2==`HDVDEYwze8nu%8y+nNeB7QAr<*4 z-^_t$vEN>ESfHI#kEN2s72<)6kZ;GJxumW?f7a?P_5HAI8z42+b@d`7F42NP9IEe1 zQmzNb!j~fuk15RMU`S&wuNdbj<2V|Gp*m_d*KB$Pqb$#Z60WJ|fk>(5#%g@R$6pJd~o%F&Ra@Ak(ky zAOY34md(285k()o{8w4zTYAx2#xHg|L{&IaA5A>fDOGF#3$=g3G~2B|I8gl5XF-*Y z#lGC!LU-{(#>Z5K1}sOgF#`4uy0bhC)Oiong^0GV&$Lf+EZ7N_s+q+G#9fz>-?$Qk zoqjnuY_TZ@1$Pg5xx_iKG5$8n?MPSB^`rEm70t9&OYc&@^GceXoMGPBy)$afHYFDa z@v|~P3?d!^MbhUyW^-66CVND8IfFmMcIJm5-<27!)>9gz`tysiBf>VF#QDNQDvEBj zk`OpNeOg^v?_eC`F+@2FJow)sJpFtKOz6BTAT%XjG23xf*c%39y_s@|7msh$7=L=+@SEY(3605662;Y9EZ3J@bEu5BmT(u` zu40-mo2rl;V0vorYi7z#r=HGqq)zwo8PI*RN<6P|Qxx@&Jg|5Xcj)5l(-Idnk> z#6;C9limumukU(F-$#!_o0fidX&nAw4zar+>?uz*;M~l&C0lNy+@v^btDHZ9rn_SE z+|ClG{KXRx^;!2(f1mS0P!h)PfS~pKp3ToeCh|%?x0}cBP}@7+jmCFHZEjdlM_t~L zV=i5c=oWHq@cnfeD?Om_m=arLF{vWu5HR^JTIbiPy!z5%#w!2nerEHjlF1ypj)cT-v@FQ#b-t4h#t*VoP>J zcZuVTXu=JG$>yM*eCMDx4ZEbsS1fkbYp%u=`B*E`um9#&>ux`N}!`T z6ufs=Iam2>Qdsh6Tm)4zD1i)@e%qJwLhxCzRkt!qcUMZfl8;&1p*C?pvIo52BuUF& zOZ7-*eP|-iFbKy%`L$=ON9%Oib7YQ5ijiKgwFGNww#Si2c2Vbi`WSXv&>@R}yeZ7} zQpXgEMr4K|K`{Jshv$8`6`pZ9y*kT;gtGalP`FU`nfU4@!{(d$MAvNBZApAML*|71 zy+)iY{f2gRjr>=YDs*%)uNl*#5lPZ>gG-R$lHq-t2pN}mW>X^i?qzv1Xw@t$oEp^;wM?| zg}NFs`)~dc2v6_DcN;(pOS#-v@p(ToZ#h)*-jp;&fEMAu`gLG}s5RV=q+R&wgSWV+ zq?uJ~8y$cdT5?@aPS}@SKz);TPS!<1D&c3;z{uj*a@|?0B>mwJ_^qbhv+Ke; zIu7gSSgc}EJX51A-OmCe<_ky(oo;DXw^K)k~N16q*+PjetRnuz~(rl`bi(m7fV*0hLVPB=A)Az^KEj{9I z!OhfqsW-0%!O`OBIF-$8R?2D~^9=DDKR`T|#z2jqc*m!M$$9f~tq1d)uFiyj;5I?G z_wp58KC=<&YR#sQj*vKSW4jB0;&k5*)zNHDC;#)8Fyek595e?;W?7V1Eai!C?ULVt z0ourl{zVya-XZL#J7g1PyT%3eRssWXH0{p-%*;ReiS*hdb4Rb9SkMq&{F}7a;A@AA zAM~EA53$e1zucJ!`qal;38=Sjnp9BV+zUpqCz`W@&pK~&1@K1XxlYGH68oNKQF=Ct zhS2Sy81xgHLoaYglyIv0F<-F0o_pHku-~ZDk*H!r4HXPggl8rgA>=&SvO4AENv?ID zv>c5{B63HG6mHZF>sz3&z+j4&il9QhN51XpejFZ8w7#37jIg2x3=y*L<+ztPKMNE) z3%?%_)GtmoqWY)>drzE2tKSTA94J?&LS6MGU%H9DMVR$f=Hrb)96>%5$Upjqdsu2j z4=G41&^Us2UlB+y@xm&zrM-A_NZCcw`+-Bb+tiXD^;_lzORjz-w-ekHeO>tuRWJE9 z7$P3?b+LinnoPgDDBd z!?%F$Ty_RG@}+&E-XQQZils-yv(%ERhSZ8o;m;=im^%#74d;p3Xsy_poaI2U4cuPh zB%WgEY9w$~$jttxS-Eq$s65BWfw#!L-NpzTr?C$+BYk_Ib9$ikWbT~8`w)&}pvp!! zI==&&kXxMG2diR5OXKExeM?MQqF$w{FDk!8PM{NyEYF3`U7R0~8Cn_%BX*ija@0y# zI;EccekVWE~TF#YPiW)fl70DzwI>~6=>yAEw=-@;&5{)X5m)#hajo>>dCl&4@UG;U|ZEUWR@%PfM z2*5NXzIq)U!YZ{Aa+JQy0_CSjoqM-`*q3~Tvzm@60mZ21I$j!{Iq4&A8fusXW2fC1 z`T|Zoz3!gg#Y1tI(n-G=H27qL zaSu6HgT`Z75*}WW4hl)TJ1)s9wi10vChUcWgn?j4%j%;Va^=Cw8&BWFdc?KC+Z|_} zB)p9gD$fOShttV+E;Av3pxiyP>ru8GC)Kh>^%4cPPU@#}x_ds~;t1FnvyTZ4$s4s6 zxzh!L)StB4cl1p}DLPTOnMYp~gxP#Xc|G(#EzqOtUQPq4cdM{j4M;p)uxZR?&dJAr z^_g2lcJg2Yp>OsL_=C-lW91Tw+6Q^2M9!aMX$Mbe%?SVMq5U1V+p0sWj#QcmmV9># z_l;DYGvxt0*Dw^i1?K`M)Mum=;*8u#N4kfIc|$sK;}j0?mx~~>LTDBW)PtIrBfg15 zisb#A$|gPpnKA1mKIBhsLuxlPeQmu&${9PkZNA^{CrAnRuZBgVT*>3Be%phfvvJlk z2;w=j9fN(bUnKvTB2x)<2YnrdNmd{(Yc>uAMHZQ`GU#h@=yP?7O!4|_FTWvrUC|Qu zQTdCzmv1O5#%v^c>X4p?Pa9dl5Zl$B5exR0s1LjQWe)dsb|Gwnu(mS_H8wn}PA98K z{sj3Q-65okA@ob!W`m_tXW1IeLkgDjQ3za3dhPkh-Dg$m=zZ>|+*_YV1993l-c`f) zq>6UW`(L6}jl`jV>;Nk*#bk|wtxUwCBOFOdZq9&@Z%=Y7`W)&0=M3#MI{e2a$3_6VvjU$!YNnxe@Phz|JzO=8C?eR~C-^RDrNM5XZ za`Y3|d+~4}F$naDC75QVeA`8O>nO4yGG)gSZv~XV!s)n#6BDAkw_kvz4=$WNKr(A( zF4IQ&x+xP=C`fwynd{rM+Qw*s;8eFx;x5dHRKU}XUvrv(laz7Z+`fveX&^r#hX$RY z&tP_hXR{$w3O4Oj8PWh*BGjY&E)WK6Dj^H+v+dli!ZCs&Wk1GepNu6-?CU<}w zYw$Q%$Qb{sEL$4)m8fwUf{an3p>^xsP99*PJi-4+5Itp7qcQz4R~&aY`eY988xD%) z4-L_Asmskh>e=)s%9?dr!tKLCoy51>f`Q+X?-8El0`98Ho!R*Hyami>*!q`~?i`!s zV}PVvnzfrX$m8#)c^PX6w3In`1svP2**&+!OaDm8H*ORpFo{W#mBGY-3HlQDbGOJB z1<|#tA_2fl&i~;haq+21+Jhfp=@HLa>hkt;4AbeG7}(Q!yQTYSxI;^Z>KfdV<~5a? z!NU8q(diOcvl#$V&Dq6)$or|lcM^{YS23gc+7K=$rioI}Pw1-7*98mOKP-XhcjVnw zb9@{0WsNZmpX_hzNUeRe9$?Bhepd9tajNRQp!AlolOK$hp4$|RA#613eFusbz}en? z+_{5kru;Lkh>52uB^u_J+569(Y0cE^(=I%TK9@jwGc-L8$PeNCZVejXVOh)k_YBn{ za#Qy9IYjXOl~O%^aKN`j0PIoBR%3#Z6kCStSSvuV&JADa#Vh;Od3jzArSzGGz6D*62lefC( z-65#iUbcqODL4zWhGvA3%hy&&fdPF{8l`cwgZ42fC#n}DD&W1Hn6@HkgRgBxZr>WW zd}Ex?^NZ__Mf}kbcR)P`Mvn%v7G{&1!oEL(B_IA@CU9U9tBuG;4y?nEWyw_iEZht@^%p=%vXO{n4TGE4@ z&rMGUIFM*$%Ou?eKKSOkYDMq0hn6ZuZq`ib`Ly2u57(4$74hP$q7kAvMsZKDJLkOm z{@J7inFn{H?{;&Zq;g@vC<*Tl@r{M&0ZN_A1yJhq8By9$(izMbM!-s=aUW8$brLbg zziG+U>vHj$5GuI0AW7ZO-wBVe8H(MRUzObtftcb?Q= zney5NuTJ81+({eB>&6F3uH!7jHQRqvgo(U$O~l7DT%>y6X88ddQuBnaOZ`KI^??>Cjk;uZbaSN)c%akZ6(i*!3Bix?qEg26^SNX!V#QiVRiw-XfiOangiuZZ0wqhkuxx6*V7kggdUKR5_k;6THn)^TSZbOXiGdB*5!?=F&l6w8 z11=98vxjnB9AJZ{hk&%y;;`Yht&>Eo9zi3>un4+Uwd-84ar7BcjmIV&YKSc}XNw5=U-c*_1;{ItkRu0#4@ z%G7*)2W)3lsun2kLT-N)-+k#ERp5`YMSk5y)}mRKwHy?&QO^#sTXQ2 z$$h}x3{4*qHu=M*RN2Nr;IBaJEs9>$Hrw|TJRYd>)S^wh zAM^?6&J?b)@~6RuG5&TZ{qLtvU(zt)$ny#~yQn*oDk0D06n-y#xpJiVwfBgY06(#j&kHv8)j zTys-ekCL>1Usz;*!n+8`h;{zeeY^Epq0X;w`^H8)&SvE4b6BORC;rjFu2}EiDzSXG z#ubZI-MV;wc`5f~@_1`yz<3)1qZVpeZj3F%`oanFCzFA_(%&`lvJ@k#u{V)P9&2z7L{)5D*gW3* zqX*(yZ>lQ}v6JQ>$Dd!bhtlw>l4~KDE1vSlLa4ocor|-BQg8VAc$Xd9Z9myHm+lzQ zPL)!G=d4Q@fj)f#%0@JSr@EFmJ_zz3wEj3+d#c-IyP%`F{7gN3`^A!%veu_w;sNS& zj3v~^Y1=pXc9D?Y`tK7-pLieWYRQ2#7vie&NGxh^Z}w}K=jPWRzH0QlQk_F%^V@jr zTk1|*8joSBL+`M!*Wr{37|k~^g_|3|n8_Q7>YZM2!bLnpo~&}1s(PxX_yOphk1|Hj zt9V!{gUu=~dI8x3zHUDODNB}}>4w%%HBEc%*QlOEAE7(L-&vWsp7y>1kaf;5*ZM8? z*+o4c1yI)mENwH~nk}I>?w=mMF|JnWZ_KgCb>CvA%GBaQ=6^7ji=}?|Xy1&tn?+a? zm{!d7DiSXT_LU`7!C>q2T#`ZNd!eV$#>hUov1Zq5VY0*8#b$oroY9ZY!3^lOx!-1K zlnf)@0g30I7@Q_}SwX3@9uSfBZ?tYzXIC%3PR7TuF{t0@_xORr6h~t@m}+eG7B9j~ z2=ww-x^ny#g`2Yd$$M7#AAPP1!E_YNLHd<63A5J|y1&GAB?;WI0!b&`*Eg(_A3?4I zp&$?1URoW5wcMsgzxwo5XC`i{Mn`WgobP5$s(b}wyHIDf#AGZ}=ebmjcVI-Y(;DQv zi%Cuk{1=lOAqMcmqCh^$25hu>c5vVq{fZ%leUPKTliAeNfMn~Z&t6WF3QRW6e~lG` z;eeLE(oB9v2yAQU)U%H8s<^!!s66t2ctywn!RL3DqP0^FEX^-s7@M!|7&U#@-2>vH zQiOZ<`8-T+3fDeFGMJ5eAcMuy6&asU>Qj>>MZS2eO9w4WQm)yD}9mMKFW5w)5ax!nd{KgcFx23=WKfT zOYq{Kzxdu2jwu8cr^C2sNUtXK6W;5gcte;{joBD(h7#(?6j3>k={c*2q0#mnXOfAkG1o@!>>Ex$f7cFI% zen8cnX}i32m}+#u$A10~=5npdXZJH&4rFJP$nsBe9^7E(FYA*tw$ha^eI zd%eDTRmr<(<9E=n`3Rj=jm~vSj%qFLcKu^iz6-4gHCLpcLAI0nSF#NBSHg|C#_si} zPGqk~4HQ^kU3=>?vn4Q)zh^h4iK^Rm(v31G-)?c~1S^fejRU(lRvFa4oHsi6zBFK8 zx_?>R%lh0sFC$g7MphRS{)v`WX~~UWJ~VyX!y@Z_W2cuSGvJMAV?FM^S7r(*0PCrs?Fmas$16G6+*yC8e zsjAr|-@g9z980**sgO1PRYKM6vus9)2UQ;h5D(8D3w?_?`cf%4D1PTD6)gnzE6gK{Z6^t5tylaR17cwtT?WA6M>L*y)Ws=;d9fs7G zFeTUubH%6(V1X7(s^cmcMRW@9fj(U9?+iPm>FGe~s!^zImUeyoQ1x3M^4y?M(3F(kY8CeUlWnr{6Bu(einTpLOfzD$e><5HWIZ?c9A?-3A>!6iLfG%?FF_kUB;l$xpOXC>}7vM zX-h@m2t8l4S#^ZFf$(bnMoX#XyvP)LCM)foXZWAV(&{$MVo#hz)6Q;@mxLR78cd~K zY_?GspuPg{ef+*Z?tTSLz8u2)3#bDd1S6Qb$nP8rE+I4x2wjUUu~F_GJj1VW0x+>f zNW{K_)xCXVMYO-_s2`Cw<)1MMK9<+1X*YoB<&%k6z5KrgCn{VfMvl@1Aa2Lb}cs9WNtfMjlfX+3@ zW&RbHkU?=9bOIPY;>Y;UteYD%`j1eNeV(RB$rTbb4f7$J4l{Cu&KMFcoD;<%gx3M} z=le9};2MMo1TPJeR^BTe<6A;rXIrK9A0`1ZH(%Gq;f&5%BLvyws zU}X}?;;Ivwx)_Xz8`|?MW!ig~_{j9H7eu`#r$&KF|F+>1BQ~Vrwn;}nS{*##TFr~g znoAbDsT17dvx}RLH)8f7{D?qV{(u11zl~lJjo73w?)6h|pMMu5NjmeJxBlKt$YqG# zLJ#9ajkSSO-=*pC{SCa8rt-&l#_kWbn4FMX{E_*}RXlvbwI%SI4XCcUDc_H7(OoS7 zt73^MuuTHg2sF_+_PJ~~XNA`y3(E9fEt?FSyvTO`JIla;q$0_L(&7wJy~cTUr7Z$Ze> zh|b5Y%Y;+VHq#TCh|9_Rd;|A8zw0EPz5$#sk%JX23mc+Jof@($4J*e5oCXTi1K2Da zryL&^wzyU@^#g2S4@)y#%H6)eSdUsipvAz+-+vlpt*d$ekeUh1B-UQ`kB9)BQ!nMP zOP%W*ADZXzt{6<@lG~w0D}*W!IL!lLM<}iQ(o@yE^*am1F5p0gx{j zBgm+UCto1m{zBPal1;R*MQz^bTCd2Fa~{j4vwy*4kCEokrDVRVV-LVyRT2#K1kz}% z3`9PolQ)s=N#usfE2q4j)Ovh(bV{24;kx+adXsK;W9Ul&31HEImJZ~=8<%`Dq>lQx zkyQ>!N2$&|=a>Wj%gbD~{x4qEZ$8&cv+4APtH#=^s;(*SEG-j<&3LEJi}vx$a>C6RjDiX8@~kSg>&fa+(1ziuUyhY!NBq5N2ExD~J)W2(jT!X)zl?J&nfMM%J-W(8aH=%d zGv_W(mw1W@|Mc=8Kh{EIrZ#a0c!8UPCU(q12hklW9O;6c=o{PEixZL zyBgV-T19HX>%gOTK9%paAmr0qZ2e}SM!htJ)WD2|*{La~#=GzVx2wiCK#%4B2xhkc2nr7)(!C%|-c z_iJbiR=)j#42y8VBQ_coQ>5bjoB)r>P9Ilkw^{VedffEO8{Uk=V;#%y%9oPF;v7P(knD>?x=QIhW zgUzKlrYx_?n-#}DJKu@j&KTy3i+q6`UR9ja9`cc_G-W+@kGC(5R^!hQWL^@ql_eJc z$pW}>p*jZuKyw|Nw>33QV(Yv<3@_o|#=Vr8&w zX4}*i6zR5gfxtMmEWRUSA42jAAQ)Pdfj+`e1#ALiU&Eni`j?1T zYS*+LtxSoQ;$CXqyLDMwon-t>^0#g$@21o7myN(P2XaPgowm;r@~-`HUV=}tX~@sm zu1=}lr~t@lyCI&>W1XolY54OG7i4^^7@Uua7;`=`ek##kGwaR{N71(bL2T|@v=^K3 zvS9L>TLoH1KqRhKf%q5&kO`pw1Nh0_GE1dLyI)?PQH}1}w^gS}uTuT>H1La1`ZE8j zElV)J)6AuUIe5ILex@RJSw0Jew z-kk_nJ}ix(zNh`&?A8lLEYKoC$Q6(HGT9hlPvr29d4wK>Ruf3(-DXFhvN$cqJE+)i zwM~TB`5CozRE}S=ak4vi$3dcI9(MXmkVdRe%0TXZXg2xgRUj`ZK~xCfMJ|Sc8ZBI@ zq8?tYk`TbeA|@3KAVkQaY?Ut0&5dGKlOnoUK%$k#f*K6VoCZiW$> zT(TTy+1I^m+S1|@x3Q0g)^$1{ zcNv&d5)6;0J;VjM7BKbGCe+~mMwz(2_a?Wne-8s6jLZGlUE@zO@2;LmpR)FAGN_Vo z?w{V0_d#90gW=7Z#o_IT$dtJ!INzs^v8%1me_F-bCkB`fu(@w9!qf0RkrEHc;@%xw zDY9NSTQf_6aTc91OFAizv`ZIi2iropRyqh;WTqoif&$7@{-){zhW=BXNqG)x1p;ia z2GQ%jGMKtG-n;=jTfv8Yr8gmdX?OToNrj{O-Ob^s+hzY3hRng4bqI2UJ3xUYknn^M zI8Q|BwPcqQdvYf^zq;90^%gvFTsxRpoFIrYrgme?Hhz{Ox0XZ(^>$Q8knKeNGx>S; z7msD!7ozDJ?)7v>9nNFpF{ODIlQA2K3$EiXSv=@5a0Ba^ubzSI`PYvLU5vQQvn8%o zk;C{O=v$5&^sc;vwf&0}DH2rXn_H0NEF zZ4_Y2${@aP7oTU<4-rLDT?6Gewmm3wpr(z@*ap9`4vgfdf)s8eus2%ELhM~35ZJCh zd2A#K`5BGs3Xzw)lSQ6vKR!@csw~>r7yG|hd-Hgx_y6zTF4-!b#y*{+&`Bt}FiIV5 zmgppkAtWJ`otZ(Q5>wHtjD4w)C1e{CQz847-N?=u3}ejld%daiIp6ELez)K4n$Pe5 z^T*M9-tX7z`FuPc_s6~tvp<8oX`oITjBb&a53tdWQXOAS7hI0pXZd%sWRnN$%MCteE4?XVpwg=XhpttUejiE(PXBm5;-duE zg9DkjzD)UQ4ZMKL4nz`%Z<53RtK$>Afq6WCdfJa^7bnRABJiWMF|Br>uWS&3Rpd3N z$oDs7>u3(@?v_~5 zhD92C(&4Y%jTdg|bg246G1}bv>p_i0M@!=DSczey2kV**T>}rMw3tofk`BKJdDm*;(k(v{1w{6kum#p{Ai~I}2Im=B zXBj37ow>PRanc}#XCQC{I((?*BqG%#7>loo_MKFCAfrUY!*3A=oLA?k8c%L(jE{63 z1(9Ieissp6BiY7=V(e1(`aRA>3nZu%rt${OA7lR|oT)x=#H-#aJg&&xSW^O#3{5g% zL-f4URf@i+uJ?l3a;~@&)6cOQwO* z^Z{?bAfmmRx!;A+#dJxCTaZ;mU(PJY>BGOd1!WcPn%B=$zB-&rkK!Ns=ipgMrflih1STRGa13ncq z|4ro;_2iN1cfJ*Hy7W|HN$iJ9FGjy-52a8YZf>lkLlJAiF-yl+Q9(UXzrw1JE~a~j z?;|2<%hKe{k|tspn6s@MZ^ap9w!*M8y85xendedtBM~)l#-8=2lH57FnBNI%+(1Z4 z81TV5{wJn+0r-SJaI-Ung{kqZsI(A{pXU5Kyn`nO#B5z`UNqY3C^x(>UTZ97>Gs4H zro|=B>(z?}n*+%+&GC?~(j5Sh$S=^i0D6SE;rqTwZAxN!DpQ%k`?zUT!+&d@!-ZQ) zqx5@}t%{lV@$@mT%k-L#Q>i~i&+hJE`WaJYCU?sUQtRt-0RPeyW$^+c7(;cmng+#+ z+h9@u);npXU;qJe+iJEJMHl2%SzL@SV{(B_rAm8bqjifquXo3$4F}0QzqIn+!23qX zEKaiwU0>tNH4Kf5H=%H*RZ_Xg+is2370JxgpiA;Nxpo{n{tGzJG8`)0Gt`gGr+aB~ zXl)@VY^$pCuV|*uw0;@#SPz<{ zkC@;+tx<<41no_=A%CE4-uzc@Cb+OkKb1zD4C_rV?2^xsHn#BD7y6yA-*U*ksOx*W zHPzuDAWlfd_1OxP7E(wOJ)(cDrfG3{h0iL6t&}Nq&r?I*+)$DJ7$H<7R74a-pqv3S zA2p&VyaB~vr!%8MoSLu$~9uZN;`T^x~LlFmZ!fo%pdJ#8H)ziD2W6|X2f z(AOE{1!!9`{tFBO63CizKiHBr-)`Tyh&F2v^^A8IJ-U&&dP$%H`^WRbE3iajRCWh< zo!LuSMk`_^o3I(kjBgMYyF9G#V@Z`*W!3jRldBO`BSwU5y4gKBSLIu9CN9<)?lERS zx1Wy+o^qXZT54D??GwcU!!(I<);Ani7b%E9cGH{@z0OaMl56!gcA76g2|RDJ*HgN0 ziR+JaykJU#l{l1V%^vUWa684{m|@rPu|?ki9hP{QO-Ozcor__Sc#wB*JFNNc<=Evj zr{g|MQ3D?p&qVzaGSe~-W6jnBDH7QGOpBp@;~f9*<(0+%L^4k=PbP}0gjZL1lmzP) za-uJYZG_-=fs26K1$3G_V>@Qq%%vkDRtno*kL`VL4uD$5dp?Ltz6DOoUFh+4K_ms$ z3EZb*m;n)O9kp$u&C_aqZQ6Yn{LUbvfIGL6OWB+fh3jnCnUVK}Eg_Q-&+jX7WhcM# z3zXt8tMT2D@ZJ=aV|G+ zLTrzT-+3lV-^^m72P8YoC3p8rx@I+K_r0Z2nsmFD@y5;;Et;A&t_wVA#g~& zD`?UwmWvWtO8rE9{_WXe9fNVTllS;MmR^88z*sbJ#sUrjZw1#7Pj`2GZq3nuCHiT; zNoAzG5Yd0WFF#ynSWfmhIo#ipE>_bf{+Q%J(mpWrTN)yA=b2S)d6DbckK=H_^S;6# zr=jjy${-ytmKJ(E$_;G5I}uQm-`ghoA)hM=-_32K^n2&Ot++>nASOWpTz8%#lSoE4 z&$073xw$$)=Jb!4Iy5nasCQQ~Hi7>_A4f>}K^fagT)JG{P|7ZJ3ceUqbqt%4I@E&s zUcu`AWF=Hes=3D1S-2as^*h>w)ymQUa#$DZF$ba~9P;vG&Iy!?*=ER20yUHWmzsGB zPa?Pf3S$aMI_qL*z;?_ikcf$63O;(SQvZQNx3oaUO${$(+nYQ8s8T%Bu025pz^=jn z;q}kf?Cdn+0jqNY!3x=1Va9vCaO!vYvK>id=I1T`C8+#6mHDxs6~69WEdy%V>0aWL z+!3tOaMiA!A!PTRh#Yu8dCxUlqF`OLMt3*rF_h8kPWW)>CjQPl?HL>_cShyRz?0wb z3QsZ#XZFV{lL52m4Kq4U`}g*gk&~&>=z@XrOyrV=O$0L05_Ikn7gwb&&Ax6B&ehJD z`R~p~b5vMWVJy!cY}UWDOxJNvng2z~3`!z(9*}2tan1Pd#x$D|hG!tG4J1S>g(5Mn z6)aJquS|jQlx1rGXnakM7)?v+0Qa08?VTHIM{mT-#jC9Kle0Fq=H2`;qfdhh&3X+6 z%^J)`#@xP|g5RjcxU%LJYHV&l(#85I_fo<9y>%D*1#*)T1hZ*r731s8wE(7PPWDXC zcQ@B_!_LTN9)(_qsafWpSR#fBB0x5 zUU{xV2^vNX&**(CNk*Drpow7c4~7etsBL`ElyP77mEPh(D2~~Ld9oUEh6bFn_-j=hnBhHKpvX7{Y3}*JEQql+6=u6K9<`1l$ z2t2M6`yQ+r7oXc=0=LmAdqHtM&qtkmWGMd>hCSO-4Che6pAe;VHA~U*N?y_g#0sD? z*s);A9t>~oj2yzoigQJ`hq<+AX_PFw4Qj8fG8oA#+f85icortP#j|153&g$7><& zD-51jNg#R`zD$vKhUopDLz)zC@HnSnlVNPRDS%m)4x2oA^ac<3mAcgve&@9AaKJ9_ zy*WDNn!1xJuY31KfUO$ZsGY3tljVr;P{qto{56!Cp2?`7#R^P0gjNbo-dvWtek+IY z9eA9qcjKk5in1>6sr0YI!>8(F2~qfwlOf5wCE|mU@-SZ8JoopCcxYVsC|=$MC^Bd> ztf}mpfPx5=hZ?)ZbVIqZd{cozuWqQvtWvK_{pA6dtD))TCQV_RiyhhVxFw(wbYJiI z`~Uv2hOuTgotHcZ)=zDFIXrzTX~)~y6R0CrvBYP9EhK5bP|JSgOBc5g3%v2cqN!@* zK(pkykd4@$3+f!BTY(rwzJQe)_nyrMdsQ;#x51l8>McnMz@%((RLpS_m#~?=*Ejj+ z&uk`@0Mg(FwWDm^WPw2s5Sx6q+u9A8o>{B!R+|ocv?{G95(bFyrfH8uHGJEOa~kB- z>-jpO%XV#3!QX*$Y>>c-Zq@e@v%`LDUJ#^=<*e~jrh|6PPtTK~L zzNj^S$8V7-BkqCzbU=+I{+k*Lj7mzt(9UlE>Tn+h7)kKqtvniz==@y39B_W|D3)j# zTs#tSXFNIir_Sk{(CiM)kbN2Csim&Y(e>Pstsc5izDU$ zZ8tfA&ch6@E}z8>>(egeS!rGaG)G$WqOZQt*y^oTtM6qM@=W^^*P6jL=+^J*)p@C1 z4V4EDyw$BS3#z%dKE=0C7&*aWoG{5(in+A*W*T4v%G!3v_{RUpZ(n#xbAlcBFCEtg zLT6^&s^tGaFKp-|LuJat@W(RQDwC}T-Epo`hI{YeXbRMr#Xb8_1qUhI_u$1TVBa&k z++w=j%QJkKXFwnve+__fHc_&w!bL>xy5`gW><{uj-K=;vxqr}%m^X_n+3Gw4vKZEN zEg59q(~NHP^f4`xBjlWJQG$|QV?YeCb#F^u?_g~Ngr1ajKx>2;*&N&!L67Gkl>`IEyb+o z*h;1!+_g!RO|KG|?Y;-!AV4qVD}WNrsSg}1;Dr)ZCsy**npC3%r=!S^RmyIvKne1A z!S8-~^F-~1s*MrG0E{rvzr_kD_%Uu9drLHDmrSYm807k6eKjkyHWbZ{Nvzl|DUtTA za<6^}9q>Er?*ER#YoK+wv<7$*mUgk(B)l+(7!h1vQ%G%|kl2tjXYO3F#kqPP(vmR~ zVVIMjKFQ(lZ?A{;Lm3BGk^oxn>JayE$cIW`gw8R?9D~9cK+2rT|9$%DF6PJEn`va| zT_s0seKlM4l{pg{u)XD{lnFK_r--wrl~eO7tG|uc6D}Ge%I~bKK1OTw7Tu0^gtxzD zji%)Ve?^%SGduUAui>!P(NZH=+icixM&4`vn3%ka?Wc@k<N=<|^wd&(nG@;9~q})|lFcu(ee9agxT*FAe&JsV4-w0OO%(m3tOIlMit) zIbli;ca{?+oKb27^5Ah!0umoL?fgkJS#92y4K3N`@&KTVpWFETzkZVhcd zpXi$XqQP6pQstUd_1@2>NzXPVhX3f8)rlZlvKs#XA!OyGA1cp=xeDGH_gC1T4(4|jSURJDy3AY1}%@H%d_E*h* zloj75JqVk7l$}-XCN}rjZ)c0M-0ICH_c#O^Jm}-ALr8kRqGpSwc%a|U0oCLl?i_9y z<@YE0f-%s+cJmD*gXF7O)qTgF&U~jTuESBuOsmq*p7HS8K{1uAe5`?u>VJkcw zZKEm=#WA0s{*~QiR=_1CmdzaH(nm_^;}K2`Dt_&Ak1BH+b|W{>nk|q8m;2+{a(_#3 zl~frbV*7Vg9&0W-*QEcv_T_|19|!0RwtrRC`Z`mgp`H01nlsFb4-W_;&ZL28-@&cJ zq%hwqJ?xV;*J5V%oY%QFYIsB(KbjUscMs~hTV?!0B$$9yubQh|-$zPc-adZ4VH}^= zHB_kln(6AErrua^D!+O0i%-UHv^?5=-L)WrN$X2;7C3OU+i71D<8=W$DBk?a(&m^kz!# zKX5~p!V4yD{VHG{e&NB|r)|RV(%>u&Eau=H;Hn#?8NR|j?3`3dS+&O(=E$R`4XH11 ziDr01H{d;4Vf- z=18>nwA($z`AyuT!Rh|OIirDH1mGCR`tLaM$^u`G@6D6&x89nT>wbx{?4+Y(K>J;y zk78tqdHd@ZDm(ds<1lM@_`S{r?df0c7e`uMVE7E(h#Qy)JB;ID?q{P7(W@wT03fC0 zBadlEYW>lkn+N>g^~4lYEI@ArGv&b@o)D?yP3Afz?OmSGAX@yUMCDqnepj5{V2z8~ zB=}i*e$D*9A4oU_mIXG9c~y&d$e0n)McmB6FOQ!~FNEewKizv`0{z`SSZW!SL~7kd z9RVQcK11(5kn&!-4>H3(!*V~a)!tSb9u%F8%be%$|L0o6P?_{(@Z&ZEnIAx&5iWQS4-quFQqwn2u zq&IdWjqr*XuoGkvVA@LTAOJ7y0jFJJ*60bC|BT7u=V^OL5>F!_tPu-ABt!z}@$8kvb--H(n%}U#n=!aYL3YT+U=rW8ksT6+ol~d#dLj*sjQa{w+~L5_ zPk$%;%g=A4)Wo4Yk*ezWkp02cwM?9fMe0@d)!B6q0l8hWgwr&n#Lacfky0LMB|BK3->j3EjHwFLRsh8C6rO zGs#scU<$d%rnwZFLJHGf1Rq*E0a!;f;~D}XVnwz(Nz+qbZrspAk3Nh-FLX}F&6%#g z*bMhsRVO6TPFSk0xb+&dqTnLw;4C@Izc8cw7G*+!Q%?7m#qp1~uB%tsS6q;*Gn_;; zW;XwgLM|Z>lVIDK-)Jr`;pQ*vmx|mMpV@9@=u&1dRLtL2tRZlP+hh7UK2m4?+u|<5 z?DG6go8;3#{NjMbFB5~-;jVkgqzO~D?&IIKZQ-P0(A(ek->h?p^45E#z;iAeyCI+$ z6K4N<#0jtl5}Yd?2;^nsz(+o9?XL*g`97Bj{IGCbfYY;*9bTFG#p%pDrhxpo9&OC= za`)k{>leE7$iJYon9>KaAZ0UrbMNrCF5CwdArD~xUlh~5hb0PHRb*CRJC!SPZR>{A zbamERM5`X{Lfe$X7c4EGQ)m1>B@|xWoiI2M`{bGNt9QOn527;M2^D9Xv;iFX_hdGI z!z;W&DbaHJh0YqQPRznB?;>-)|KJ&p+jV#F+r8JR!Fz@C1u2Gt2u_mCFvC}LUrX~Z zzuhwcK`cxCp^x4$+ZnMOPJKGVumIN4kV6ZJBB%+Z`1fyv*e^Tu;w*<;XgUQ zXIKC`%4hT1GsG0DGGuMt5#_u`UTtr4sW?U`tWjN!x4KZcaAK-j?SR!yomhwI;~tE3 zdjm%I3tBxa3V#HK3VqB$?bZ+J;|86Y>;F_Dh_{Gd{Y`=>SS68@lj};IAAXkM4VhRuVnio6Vp$R|*JAbp2Zv>zNkX2Q?c^r7R3{9BMx#et_UCYrTwMemex2#w9E@jI@CL9%pQ4oCLn=1SmGX8(SJOv<}^ z;WQg4PhbaH0PiVo^6U9qI(y^;q3#ZKLVLSd_$aY@of}v~Gd4Uy?H|p=Nf^#bk%gP$ zQfKi;$hBP^-03Xw2$3+SY2@#p8&EC27ZKZ&GFp#A8!-J7GAe0VSg_?aV={#i7g;=+ zM8Pgvz}{CS>t7_52MM9?YT_K6tu>dcag|~^u49fZitPlfD8p7wZ3-WJd5+{%+q+n* zALGK5DC@P&*WXynOIIYJ!`mni? zE6X)VmIuSzck-*)mI=jrOGYH#!f{Iboo^9X$aB+NC76RPt5+McaS$w#sPI>1W*7tW zJFr+@f;RCU;8IK2dHPvxWv8*hMXOiCQ6kxbCVXHOZ|$44%({<%4H7D}D|Dw?h0L3$ zlBpmx?x;ZlXJ~)y>Y<%3#i@_K@fHYMX60pp&rk}RpP@e3q;=a#y~V3(d*Felm05sx z-QFIz^Fn6x!?s557qMn{f3)U1R4js22s_V!75>M?)(ia4ClY zIDN?7tjlPGR>i%Qhk@jXuXfrX1&5$4x16}O_x`~c1E6UJ2l?F4&YzKcseNHrCKm4h zRKFcjE+k2GlDywe_AhWy9%bGr`*Wv)w9#fhKE>cO6h7f+^M0TX5YR)V;!#31jgOxf z`5Y+tGMyz&*bN;X1BTb6ycBHc;Bv%o@Yl2dC}XCK+W>U{Dm9PH!N!U2@vDii1@9rm z(V2AnYr--ffGleT` zi6`z_*PZ*$2`Z(R+v|KSVaZsW_VG51jnU$~5qB{+EBXF{p5Q0PCQezDNo)Sy4?{tL zZx2=<1bJL=0|w)#E`h8FfO;xk>{<3s*t59w&(=Lup6^Qd>(L{Z4(_>e|Jv_0%c_Zq zbkddzv1Vfc`Y|wX$^WAhI1WsUGh`LRR;j$JuEQw7#X=2Fsh{y14h-Y?aub{cXKf2B z%iCB>e^mMtJ-X<{Irc_M$>F2R{KTXaxD2Y7sMPwM%_IoHuQ_?IVdO!K^L}2O@Xdq0 zH@;&E6RwxcR%ZBAyMwN)g>V3Q5P!qY^z!oemXNS2Q}ZggxvhX{qHEwG{~x8M9KOH_ zTq<_pI`@3sU@lnQbwM>|UZM{t#eMSPa}YrDZ23hkwF^Tnc2H9X<5L0ONl@LK{t1ve z)3LMf51>tOl)r6Ts*Tq~MUNV<7ijB07J^S#qCqiM9J!VX^(a8z5^u{xSo z;>gof99^G%tKfi9$3`2{SvJ=?0Ce5#ezs|^z!y~zYpl4Yg+Cekswe2XB5&2n>nYN9 z-S_dyQvs5?=eXKjCBT}XEI5f(w6x1YRq`19x0y1z2;NOTP8P zYM_RQnf_dd{p0yuM_>JLSl22!JZ2Ou3z;S)>h^CTX{V_bqQ^OME zngIX?MCORF@TZ*+I*J@MrzcSuQQ2_N&8L58z;ls95=4JMGXrOT>HWTF8AF%0p z+BhKZ$?4xb1}?IX9{pUQ&us60U9x{~O#Tyy!x8DbcLA_-CMN)}w3@JgUv#pq72Rot zs0n4Cszv4Un6-xPN@uQe%?A@4LY9oppY29~toO7;j!-2%-hdXi`W-mcT}W@H5tSGE zB8GwD7iH{iJ^40k^^jX>5WwZ#P*F;)%GgW?y+_~s%hfAG9nJE~mjM|+Z7Aa>N(G+h zXKb!Tz>A39)uZ=W?fM$gE9g1t%#klUIaFLa_J0$9_RRzkk9@vYBW<39uPr0p%E?7< zX2h=Em)QsiA%Qn<2<7ay@IN=|CQvwtv;aqC2LE|$%6F+{7Ucn3X-yB_+PQy|=gM^2<09@C!j}_3tRvL1u)xx-K9GM%`1P zTOuv#`2cV^==$KvA<*(Q1{7?y2TVnFf(VBoD*e;$5-~IRKPJ{1HLLCRTqtktfOJl( z12=T|?Qw9Feaf7A0d~$?LT>IPW}}BQe)&=Rw>i;Yh2p$rz0I&iZS`WQ49q_2?TQ0hKS$c)qYy}e#C3Ch#KsJ}r} zwbj1MdL4Gu!G5uHP``^hvJk4ZZ#)m;&a7Q(4bNAJaE&9x$!9doxI(NiaQ^Tw{H{G5+hAG4a?xb5BT!c z?z^}qtI0jM#8Z)?6g&8Gb1vYzQy49(#116htk3gwe-5gjQnyKVugn5hkGi8ex=Rf$ zmtnTbujYt)D|YQ#hqX72VAX6I!9XhrTz+3+=#~4&yL@}fV@?;#@q8rMXs(^t&`GQ~ z7!%ihrlB5s`4q0*tLh|^M>~4N;U1sXpRZy?4mUwmg1Kwqjb!1ed*JKMQ zprly*t6*_f06w)da5EwB36Pt~T^-ddnX2h$5Dqk@lGqfMrsLdg#F z$Nox|)gKsV-3HS?Uk#+Hf4$xjeUDX2AC2(#R?PA7$=}ZmQUQUHa z=K6hwGdmuQd7k_WB>DhFdITOL-Yy=S&HtU|x~@RyO`2Q(+^2ayHt4T6g447u3Rdk| zLu77X7!sCzBXvLOQU!-()03eh+u0qgf3CPU!n^~ocsYCkSNIQXUg1G8VVvhB@C^=h z3Qx^kKGV>7NzxHup2lvv=25!&`tR<_G(3FPGQJk%5k{%lT^X(al z0viOe%ZYw72>C2z*vj{ARiq5r3))n_C4*+y5|HJ?l?X8a45CI;vIob z*JWIt=(kN{<%T5ug$QReoq0apC0GFA(t=i=j43{92_~@EsmUI*X}m~PiPTLhq|gJ) zNSwhr~3Qq+RLyrOs!uP*O*z* zA^6(S<<#Z3s`c%`(T{=WPmSYdnV zQuIN-sI|BMU-_a+Xo-7`%^}SREOGBCCH5A)2rlw?(tQ6-K~RMfZ?|Q2g46hkH;IG$ z2r<6gvmQysa{#1V-g;QrtZOt1AckYY=Fb9f;%iJ4Yay&aqr_;_Li3izg!Q_?P2QG$ z7JyEdiXDCH9N;_}CiI@hBhB!rOP?FesbN~T_}qjoFPwK>U;lfy%eEeTVfikA?hI%U z{q0`O^1QaObAyC#p~(ewDYQe-IvjATc@+<`eILqi6thF$LjuDsT>?m*r_NsqYoa_G zqc!gIMG<9q`_q2001lbTYBjs9a1Bc(?c9$$d#5Pz#bzk_ES?FHw@?^FZ%JPL(hv5FlctX(4&VI=$!0 znv*UddaNd1eE_)&xV?2&U(DxSeJS{2Uyf6sYEe(;NdD|`sgD1`7X%)rOYf<%haY^? z9+J78gEPzl=E5aJI(Gl`J7e0YPECK&_AqY61{RE^{(tfTGL$k(@N10E)BRAtMaTNa`|ONFb= z%Pm*Hdz!yr89)VAmpA56uwm$8q8^5{U~;e^g>&i_pkl@_IvUC~_~wU{WeF>8U+Xp+ zY>UUe%@SZ)OlxlEuYnAq68c2b^0gA(KM&d_Y(^Gxw zbodK^5}}QskiIKcj7-b~$>9r+Y1muLJcX3#+Kold>y}o<5Y9 zX0l9s|Dk+pJ%zhlc_KTcgWoCyRzTh#_|R=LcD}8X zVkeME@G;q;=3o&`*DM0OCqJ4cJFExF9cTszIy=OFrMlT>g5ox zx#3fkEx=S8jCg03SO)jP6tRMC(pA4j2<=3)9$B#F>93V__fG?ty7LO6A@Qtcj%+em z9bl@>Ixz#BXmOl6;05(R4j##qnGW_D6-CO`sWe^MC_Qlp)tO+`1F-sg*cFJ7Nvvk8 zCkL6mi&(3am|3qQX0pbEp#4J_=Bv&0r($<&f9D%K8I%H}+1VZ<8?(I2C!@ev67=>> zPX8fKpmt{0xRby>$S+$l^_1YnJ6%Fj^6V4)%7NQ^~c2YjUcf4nJ52T{Vaj_Hy~Y7W?)im zrT0(R->ojeu}nE>rQyLVK3-M%GU&Gc2g z!pX3;(8QHOip1f&tB+~p2G`QvE>{8R7A#2aaISa-x!(!0teUiA8r>TVratU*-98ef zK!!ykU!IRvXzt5S;QPsl{Or7p52MA)&7Qe>ye!j&4otRA(R_W(p_g_lSPd&* zERvqTpOP|)0A1iD$$xb)>O-#~o5-NuAz@6+QO$>Yh$ouet()fd!i@>Hy%%42TiZtE zSgO9rwGzn+Dl2>`jl~6wCF8swFuwU^2Aj|;cI2)DoGIg?pBb{sVpH=Rjxx$dN}{vy zipXw=meSAk*4hE>)=|TfL*!I{jw29+Hn4&3B2hGLGn@M$t z7eW+FfH=#csX)eB&=NLiT{Wq7xUx?sM->}na&Tj_2U_gGLHS>_*srO9mas7=<1cFU z+D-v>9V0I_<-csHIX^9D>lvWCH2Lf~J`A@KJxlqkJvY~^bW%Z9oa83mNPsns+yiZl z6qvkvm>&rKksNG2i5t>&V5c*yPsJSAF5he^0v-jK75nl_y)?De$GDd?WmJn|bG8u+ zxnkK%u|yDt^g#m9f16aAr%%7vh>L-Kq8}F9sw{?iKUAhH6ocw+xc8!~^u%;@U%v2H zKVLu;{GBZiJRk~gFwRMs;?U8@hVq9mwZsvcmJ&VeLu5yQ5B#bCI=~ci=9Pv53nejA zr26JqDqx#(z29J)D(_-!yMG+)v<52xSOm#eCs0ay#kArd^iSPrEF2PK-Vna&FH*Pu zEHbdaQ*x@3GAOP<%*-Oh>_S(oCd&G!vw{Z+uQ4>)eZmC!T~ZmXvAg&!gJjxRV2ST+4Ml{D$=D zY}k7+p#Tuf4llE>BchWjqRJ^-Ch=Swc1uy8$|`55eutN(UHiU9^_%9IWV^F?Ls1PjBgeo9&Qfst?WAVz^mDn_ zANGIw{5B@gu28tBnQ>0P($a2O3@c=?9_AT7lu(Qwbfu1czl-l-saM<4zT}o{*@l~) z{q945rwgb?e{hYTUtf(2$Gbn>e~}nR+Yag`KSP0|Ua8o2i!WZu%Z&T*&)!>o2klWR z>W$izZj$9nUmIX24s5U!{msV4>i7z$D1Ow+f61CAvcAURPJL(aEbyD{p8v$wzF_R< zJ=V=001j)-!6h zN)ntSk9*Ep-+&&b0QICjjf5B2uiMz;K^*W!cLGgrvk&h2>fbA7LvpAtepo&(9B!vR zeYCc}RH?$sf!?XL5~$b0NbA;xQmf!UiZQtAKInDum9tnK|D~+Fsm(ID+6nZ`j{!-! zUO%DAUJq|*=zPuQ&h&>0x1=b zZ;8Z12k5uSk2yl7Vl}E7%;=ot>K-#Bbi%50SZ)L9%W5l z|4lN-Z>Eb{qeanp^|FUj*rQn7oe8I*n&EF0(B(3Qx@tR18ld3r)}O)MV5o0#2|NBWrea zCHq(4#)JURwb1a&!?fA^U|V$GC~~gLB_oMi7IsCRKn@K`iojh5AFI;#3AjM1Xvlq4 zF)tPFVc*>qZvn{m)vrWZe4k1q!40zlsiJt*UZfD9MaHf;FAb@n6CRC50WEqTqws~U z=YzOuJjb-|Z0p5Ak?!_;FHGlKUnh^IHFkq>^IlUU!>^=f3*jt(`r*hd(7gamr|gO> z(Cr9;|Du2WRMA6^ENuJ-SiFbzDSh)BWqZ`VU_>&aT&KRUVylCg-@(0iL6)1|UcJ6+%*Ac+^z^SpAQLt%uysjvd)7J)L;^pmG^Si%eXk+{Q)Mwm zlQN4wJOF7jKH)COjM;{Fw$M=%MN2F^$%;}S&N$U-BsNw9j751 zBh?SA^q|Gh&egBv;GO@`I~fI->zt?}R_{2SOBkA2i2O)`uG>iEL?^E>7+4l|zbsWr zV4;8WUMpv5o``8N&!IYmw1EiVtc~KTck}ue#=HHX@z!JV>L^|{Jj|vL6pKzL`P6Om zH3OHu`2S*b!96gcpVD5;g#9hOcenM;qrHiHp{(PJGEkp<~ ziZE~_0H%(yz==#}kKJG;H2p}p{qr0mz21~2U|<(UI;+YO&mJos$MDybARcxa~}aODTvZ2!dHdJP;ecRLSFYkSbOO;d-0=|Ymp$u_PJA~txgQpDW9$E>fZhWVJ$rY*m%ncV<~H0=YClmEz4v=SM#Q!GFT~Hm5KU)h zrw?2wFDNK8Z6jT?9QXeHj%@@{&Knz%sftGhK(?(jyMnmB^y`nhoTM-GsXj}q&g?!P zo{PZ~v9@UNQw9Bd)mu7X0Y4s#P1Su@<^d|NuHLRh#S? z07rVa%?rys%7wP%8u6`+fwq{Rkk3FoLFiZ#b!x^Bxjx#Ba&G9AZ%3^d9VNP(Rn9aZ z=OIoaH*0}DLtAJbf_EzG&Ht$|lo}UDHd2U-1PH+&=44*^pQiYZ!@_MA8OF9y*-box z9h>I6Gn-@SUk|U2zg8vYL4J)Uh^hAbAhT|6t|Hs+9)o}0(rno9)Qudp0L7r0D0$s4R83piNv~NNa|gY z7u5z;r*g0%#koRc*hkQeh!%b)0qht$Z%Gt29SOKk2Q%UUx@l+`s7myaDBCQRKhZ;* z-MJtHxF5O;u^XHMKVS?x?&j>w_7e-lIQP@qN{1dWSA; zfn-kv*WCMp?L<;haM0XFBSVFlk8wjNWh!ydIuyQg2ev~cW#Py|WhpK$%pX0Z4Ve~9 z=?{3d}I=D}6is-QbSp=B8B{%MHLTUfHIqvg>Q> zb0nadDh9ke@D;$)srkQdxs6@yg&#o3evJe^!>I^`rI;~&Vu8{-ok37YZXfW*SQr~w3Ke&TZj@-2Wf3yr$Ne1XeJ7A+0r{eavei2--{Nilch zb!J;JvX4BmNlgk~vmqC*!X>W{5sWbxCv`0)UG4;RKgIW30nmNa>H$60s4Po~Hj-%m z1Zhcg2JA$^VW?VuiWkCnBnhPhY)1(ZTJ(C}N0xGA74e6A3n) zO32BMl9Y7{TS13bicCMPxeUJ2n;1o;*tCftLIJPM+K$Nkw1}3(8v+Hl02#H}7*|;J z8WKTe&ixcY>6;?xZLvJ{GpW6c3B}R2qd3Q`?wu^a7djX4>BsY$cl7lk@ELy1mXtKZ z^IfGyWn6NGK0zy>Jl|JPem(2?7jHd?qu8I12Mk5rz82Gtoj(@%eTG5iA5_Lc|L=yY zb5E!v0+2>_FbOXINpH>%e((rmYZ07(`NMDVsRk*Vjd5iI-Kuaqr03g>z>ARrxcGi4 zM@B+ux>EDlpz$hbWj1pA4D=bwGs7ByE&XWJK$gn%NmgB5O~iTKp!_!hz@tRs@IAqf z3w2)@Sj60jMeQB^Y}aA@^^zapq=QA^+!z1)SA{_p?$V)VoHn!yNB||oq!V?DXENt- z!v^24e;N^0MEAT1O6r3(AKVo_Kf(pVbne2teqMNyJwtZY&v900@Mcoc(SWz~D4X=1 zUxSm`v!&gr)n34{H@9vn*yN09Jv4$6i^#-}{LH~6Q0xdM6LsmQKUt>Ii`K*l(vnOF z3)JBzXRvjsm~PhX1W_8VwwNhnQ7&^e-RQhkCkcK-W!|RTPHne^b7EsB)q1kZ!hH{ZRW6;(+Po zZcCxoPa7p7n*k*iXs62-vrXG*H^84>dSJZsr24m_{*iMUI=P^7T{DZ&VBw|DTLGWN zYaYJ-Ho^TmcoQKu`s;+!{Cd%g764UOX3V*=ZH_6!tc5CMcl>nLFxPe*w&7VsqAglV zdgtZj3yekuDaUWHpc@9&d!>!k-R=qJLGpbRt&mW^;P&ie0f_A6T`rkF1irND)u6AU z&HiOni?wrLqfpgb!-*qdKsWA9{}HzAepOqFATE~wo}tnzchr@8 zWmVqR3fNjRy@P^j86H8L3kQN;fQ!yfN(|HGw56kf6)NQXD)%tMK6p{hZM1%Z>Tvqk z)11I`!p3ja1gNCL!)c1(S)!iEC{8Ax)$R4i;#F%tCr5r*FIXd4txFC85W+^ssM4FA zeM-19E;h-S4rHsq>Iq|O+qK-MGF|RqP!v!3ukuHr3y&b}d7%?%F7BsMX^qat)4a|X zGc3R{@z!rCk!O(n6oB8oX~%Rb0QqT?WwLMgH+A}b4c}Emmg~}7W;FV8yq|c03O7S~ z?O*9m8ELcC$3tenqMepnWSP&0>|D1GyVy(?O{7-g%Bl#%tzXnH%#@CdlCb2WkECD& zdEk%gOKFazuN~Z$odr&1Wut28Kt!oF@&l3a8&R0Re8eC}83pNT!gDL9&X<3ZES z09o|Cn&<}N%+dWa&KE&vS~l41-D7jJ_e!Nj?5va2w4C!ium1NZpRQ&A6w676mq8UE zuf4SxIT`Hx<(I%IT9A3ZM-iygVlnw3!rRQ-Q(}MkBBt8p)XSR?Naze+yIGS5U}OQN z@2uTB&{Dnzxedy%f{vok2}f?dkKDI@$Q|J;uQm+ohWj%yvTy!KbVF@H%A2p^V02 z(6i|zm0`Y-RCvMu1H%%BE;7CMem`NcL%-cZV|C0My1sdZoQ=u>K9DWpsX30czuqLy zD=9E15wa4D7CQa1IlwB5cv*$Zm(xQm9F`u#e94lSWF_J*9p8dDJ3=HJa-kO|&HV-1NY!)w6Y=ulC zRbi(Nydh=g>MYvTwdC^j3koaL6LP{vNun7h%dN~At+cD}=2%S-xs(X1aEa)i$3bVw z@TbiT|9`L}pz8>ZU@~XA^N@{fTb;nI=F0WJI=vJsg^??||;$LY{RmXN+Ft}@+o z0O%#P`}r?zyo~`gY@ZAu%fH#wtuxWKv@psxx(F+MH+t>KK-$CYEqzYzcPQ5eg^e#8L2TiLEtIv%X7d*ec1K?{3P5@hD4T@SVJ4b1 zBToNVWXDIOeVcN_t>KHIk}i-|T`ZjLc(UROXh=O-kyp&x=}u_w((2P2zFhGG3|cKb z-vtU%`!Cue1$eL*ZG*z$@&v)Vu(QSIRTF^yeGNFuRT}q*M!m-)7GvIZhFbAq?fUou`@zfNY(P z$p0y6q7a0d5z3Y8&m@ppDhm#IRG{+aCE(n38$^~PmAgx-MI(XLyKfFHp*+3(Y~-kG zBwi+q)Y^Ug_8fpG_IL%TKd)c99MqGM#osr4%hFhbIN_7;E!1%@EMPL__xnlem%1HZ z0suH89ZXe!vNct?Z1KSxHuGIfJcw0#o~ri(+EnRhTBLNxXQH${QiGZH#IX2I#dHawM|d& zt&J$4sG)Zg_CZeQ%AZc?UeD9(r3=1TI8A1GNdI9ROsX-XyKiK56iA%;S5#utfekv) zNe1k*G)BL%Ll;ci12D?^(BSb-B2(oD0;csXJT5&#>&+K3^=_sQBW?F#u!7Two{jXV z5(!yo{$v(*koJ6ah!*&c734-&g^}k2)WNHh~@OZ2#0>Pt0>{@&@3%w|fDS&WgJWl)Y*7GD6@{^t zl$nq!5A))BG1GAVN}I@kGMpos2`(P^1rc$s5$U>s*Kn%quw#5Xpu0DO8gyJlh%O^N zbtqzBW$91<^qHpq4$s>M!4&^bLM8$TnNhIVvX++CDkYK3M>uALavA(R@r z00hT$(p%iBE=1q~?#67jXmQxd4z2k0Q5okIC9HjVXY_(VK4%^EG9&O=` z29+JwdTlp&J0BGsh|Aujo(4VQ8r-91d`eC0s;-J3 z0hx1&7WUVLGygHo_G(YGT?f4DpTIlTXS$gYH{mOuKq8c@P3m}3+*GUVZXqT;J*vSqv2*?i>$^-?xD(1j8 zx_ksR9Mt zA-@ClQ)9BWI@=$~)ET;8A%{RR5hWng=`y9Fp_I)thn9%DN< z#t-LVS zV<<*4V5sU`^S@f-OIPvcX6DaS<}6n=Afqfb!n$LwYNZOQrEy%BM9icB1ylNeQ!w%W zZwlrB$e%_%Wd8v+`?=kW8KD39^=?RbO?)=?ot6VtO7jsoD|`GbxV^*YFvU6oB#^I)LD1h$ zy^UB+wEBODd-HIp+rEDsBT_Myin2^yE!vT?Go+G=Q7R;jl924#nIV-VRAgs}P_h)+ z*DRBDgph6QYnH*7eSFW4y6*damf!Jxp1Hrr@%!`o>pFDK=RDu<*D7*yEydkoxcmW| zQEP7i3Y;?y4O#7?&v9?{SaL5C;#xkRo?1wt2xCDR*g0b{&YBtR?v@4fKX1&(_AsfQlL*a8qh94+1zw@o842wV+-KR z7u3bKwjRgI2u=PD@FohMIgeQDdRTbipX>h4@pT=EEhETKK@ z>1XH;RcdSD$PTp^dKqcwo&h}CubK2PA;nh_8T{s+-LpI=Cdk0P1M1{e`XT#8n-~LH z{=J8!j!QFB*noK5D%tsd7hZ8OR8RS-?J~?q-?R)BVVYb zf3y3&f>&#PD8siZxN?e4g`9+olWplVa^nL$5&gTSvDQ4xS+%SX;f-FBz3~JIg+&8| z{H&Jf&O@2J?>0V7_kt?7Ijf`@L@|~|c_MRu^ZMEmL zr}?4zT`Qu%EY!KIQyHUd-QOX0D)`envc?GOuDc=6@NzuUp&KB}dri+r$*>-Iv7XQu z)scgLN%$eo6>hFWlgEP?ff5zvg{W2P+qom!YRMQu44 z0$^w3wkcP_M?MMZ)>x>fC0s(acON?(u>fMTNxA9Nz<__TajugNQM#@u6GW$=!H9Q& z!x8Tnh=CA(BbC3K@NMg~pX9jlnwIu8&!9_%i!StPB#6_KUW4}79$)Cqs1~D3+G?7s zg639W((HCFDQdrA{`hrJo&gBV%`p1VGH7~BeNrK_hrY?6z;@bGY!z6ChD7e! z9Nb@u9#KO=Bqr#V|J%peL*4@7IsCBhY!@HKlW-dAWYb8N(;_6r#DTt5b2Yn%AaqA) zJKF3maI-=&2xaZNkImA-cZ=S_S!(u^%9V9=8BmNPj;1T9G zS?jR)){b2mdJ2L{iZ^>ND2TcwC58Fy{1dgJK3A0eJ2U8{ysEWK>@9oz;^dyDWc8nC zKg}Y>Ubz61T9E)pgymZE3F7D;>-ud#i4RXt4X*QBQQoum_9r~1C*^Zr<(WO2yk^%7 zmj2sZ%`-@H+|->~UKD!cXN)80j;Pdb`0-RgHmAZG_-p_A+p2jI1F|g>RWNV;59EYq zUs0NtyRmav`Z2hPnY(Hz(yWNP)l;7Sfu77;XwW%cPcp`jq7o&;=aE(d#0>lMV3KQ+ry^tA7?T+Ba`BO>YW6s`mZ18hO;w z8R?M|Bb^W_WI%k;rCWA+B;Z&&m_l36>GS-k(Bh5M@XA~!KrA!A`jtD1mwqP)VP$rQ zAO;=xz>duUi)K7zS1Qv%VomB;9M1QmNd2~8&t`U zV^+QdVG5yEqGMdE<4nibyYhmmuOG<_NV`jDqT(bRKJc5k`kSDIJ$?V z)|ZxRV7G$D2fJ|QB4w^b7BC>f4ip^<&q(_Q?8lzHMvw+CVGu@a?MSVZ5xKn*L%D?^P2lG|_^lzVt(o7P=B3 zkHtHzq`LLYR{hGgK}p|4hqNH_ArF0xpNwQVZvUy0AwPh4feA`tKyB;7YB&EEZ1)6G)scY`@U*yTA+NHpCHdr z=(Y_7kQp_wV&UZ_iaypF7sG|U*|MxZ%CanR!7I@v1Y7*8;U;3~h ze$4*X`F!Rbg#d4N>F$zj>i8k@di~*p`^hH<(Y_uZcS8PWTTD?pi_WZg~X49n| zWulw>cM$DC!MZ8?TN?S^q=&_dS67Nt7ZkHW$kQ%IL!JNq2+z(I1}BN-sjiRPOCyji zX52Vfl}m;@^TqJ0q7v zaGktY2JeATcBoP`I^`DFR1SkprSg6k!p{vP(k5@)oQ4Xo21|y*NePrzKn&0DrD}qa zfg5}oCr`u_PfC@GR9AZKoSgXfyUVWvboo(d2HlIZnV2gMg+GtSFGu5w1Lrj&NEd>* zknN|_)DWPJo2|wyC6pepX2|3eB~SHVKh9$Sux?Bg;_K(BJfIg zh40(fYXELjkVT&#{}eQ5gnf0MCdrRT9qPs;&HvaRHe$XSP3R=3eoMG;a7BVh87p zWg`r$61VRnfAp||{LZ@fQr(rOspwKBH9*|9d+7>=rxuzM=q#oV)fOd*1+27wuN{SF6B(qtn;lOl_O8q|g>0qq-* zBW$F**fAdF!oFMI3`a~>>rtY+K@<`_cj{GQMgOTi>sY2bTm29P`q@Fb+!?eKRgFLfCL5`l_pb9TN{V`(5xd3P`TBewBX z?43>DgBBc`{^oGaHu%tjdTc_5yz;m|M(V?KCdz%4)-WWCIu+2g0*q^qH}@H z=q}^a;M6~WQ#T6>X6skRkBEF(5Q)lb>@ibmdCjxLZ7X&G|JuD7#2ke|p~I{F=qPx+ zB_{vz!;@R<1bl_>Y8Mq0mv3Eg_XbM$#l@;kA)Iszvg#@&6We| z?gfW>=L>_qkaAx&>4IeV;K&8_*VXyVk$;#rS$TdWkH?hL#N_>JiP;;GLp;~ZCqodA z7C?@Z1a;8oA~&hE`7Oe!U{c%L;XL3=fOyEBC57x&qzDU-tp4z$^zX**5x*Z*;(Txb z4}l+ZQfm7Er{J%5Ku{!fgz?RuU?l5AU>HHRw|7I`H9*AP^Ziaq&P2Uk@e*-FiyzCf z@RfYc(OqS^9&DNO`=o*-EQ<6)}mlzPG`b*p0P)GXiSo{&1T;=bV+8 z+@{M_XE$?&Hu9`o4fRoLCDS8-=>lBF=Bu9u>KK?1|LU3MJ{dU>K08=_i}VGLLMtGF z$U@?v>7vP5*0W)LEdXGKp)u8jlPgb#8ds=}H_s89lFPOEgTF6a@IQH-@qWe+<(<=< zevcWa#~gA_p@s$=hkVu5*Z!YOv`4hX<5qHAxF z2zYf~h|T2t;Rd0 zWfk}}oteXab_17J-h%Y#vAg#S3jX1h7v@O&3zfNmU+uduy(#itQTz3)!>5(}niWg8 z>1WEPEBxw|qT_VqfpNT0w+pr5^U@RA4HGlyGFB%UjQrxSoYC+yuK3wf|-XI<< zLKLU8(0@a5&PCE=64pB7RK3?a<78jk;`Ik0ijz}e7ZLMRy0zkU>b?_l`w==0j%TgS zddHhKTu;!?w-f*~A?sc6`tnfNyl--}*hvYZWTRvB4$N2T1uk`$`g7K!B-{ZY9y;(r zYjc9~>Q{ABXXN_ zeL){&G^S}w1qg%Y_&|RPM>^Hf?PoH}4fS{*TTedjSZJ^L?%t3j?o?yLTIZEvqv>eS zR9S#d#AyN$fCG$35XzwoJn^=p#V<6x{Vli#tY@xGW#`Y0H~q$OrAG*kpjZ9Hv;<^tg zmQu?zR*)wn&6`<8dV-S)t#p%qhFo#hB4(Ieg50=U;jkGz+6rwu7U2<$16S3;jC9OM zb}4S8Z~2%{mfco#`mZO+l2*&$FfF0BxOS^|K)DIp;)JAJeI5(*Hx4h8M&>?y(Jdo2 z&EqclJ1T<{Z8}?85tp^0RsgS`eTW^c+dmCnR8Z(_#!=vd(E)%HCD26v3boCW-EaBx zxB;kVXarVGf0DDNQph`q`{acZ3=aCYCrdY3`rg_01`75H{fj&HOFMuQKr1;WafTFO zfV_QrhXWpUNgoblSd_<9gC5qk6YabS?6**;5C9WI9wR_b?`bV4>GV>d&$QpuAu4~x z?`T`K)-XYl_UbMEra_L%McRgXkMC;BZjLoBP4pCdA)_Y|J}3GX49G~fyars9BW%F} zxND$qReigzudKo1D-Q=*FXjft)CuMpIMBHFZEVPgl9rdlc1AHS0uh{aaoR|G1^gR5 zTRM@vs69Z){|>K(Z%OrYWBYy0SBe6u06o<8Fk{~e_FtYm-6s;D z{d7$o4M@?e%o>R`PSmqe-5II&2%P4Zr*o9Qm!4*;TU5uk)uDP&l;RL9HA8Q%L8O`reH(z!}682b+T=9e~}Y@JL4RK%(HFAD=p(~tPn8?f%1_4*>4 zu@!Chf|Qk873Ap;*j-vAgO2yur{BZcjjtb+7#I=x4{Ru9mJPJ~+!>rmEgT+cEUlw2 z(at>zkGlZ0(3x9bZ9*LCJrS^GEXIU^4ENr=%Nugqr5c6+;3yUol9r^U>t~-jWcl%Z z2|pbbYmYQt78Y*H=2Ai5`H5>yLDw5s`+40aACoSu`8d53#cx2D z?T;s|(s$nj3FGy~bjYBf7>t=G$yq&qdjFkfjABu#yaV3VLBo1BCPdI@l|-n(u;?zf zCY%68`xdYfP(0*<(KC(L_IJT^vb9?rHKDWN*;2ca^}Qr)YDhRV^a_Wd1qut)t;PYu zc|QfH(gGVdB1e4HR~NYcaH0~tD2nrFT9YBNjbdfMTu_A)A{Tn{fN5^z2)7%kHR|0F z^0hS!G%1TTdLS}Pr%i))VJVZNcbTnKDMQ1uT|ckfDM+WfkC!h1u~g9Wq(X1dta0wb z5zVP#n{U#smS)V$ocu^Fpm<)iK&{$)_Y?3N((qHS@N&g{SQS!}>_r+VK-V2qTURqP zYT4U4wuPC)O@5ojTVsL*jbZWh^};b4RQ7(l%m5|w5wJsHm*E)2aP;mq_LFUnmqsoV zL@1C-8gLBrC5Ei7)!j*(N}Z9c@)_bT5b+5Db+8CfUT72`H2ir*`dRf9(C-6_Up3+F zu$26FdezFI=1reicNF@~KhF+3|G#-TJwx(-TB>S%e!a5;rUn`OfJf=vqoiy4C z{~{Qd&+X%#IQvv#S*?c$$tml3Qhx>A6^rvB&4APrLl6;Z9oPTf4Qw+YJG>I9x>{V$ zI^Dp;K;hy_G|5bQHmU|tz>*4ol51ry|4FVbzuo$8M522$x(KUGjI^)kenpSeTF8_; zPP@eOtEQu!8zGS6EH3|Eyp6_pavU;Hn`C+e2x#vC^StHW#rj*K0a za%FD#C|s&dYVSfB2TlN+>cXv~)8pAh1$)Cx0{#7QUc{Lu@L>YHTJ*Psk>rp1N8x<_TGCjo!?VE zvEf`zB|tnum_xGp`Dgcf`1E^y)iqtWS?Wy12EVrl#XNr!Ym?%yj$~ZR*JF#)e1DfW z{)<@?;_|;!4>7X+=YSd>B#1MYfxspZcUX)0M5c8z0PRm@zazeWplE8JqaR9~`7jOA zrV%d+uzR)%>PbS;NmWt+cYuS0w!=>cetR~-e@nN*E^vf8Yyv5f0M(7HIaF1fcvkX6 zhQNsy7xm=x;dSYgJ2(F51JJd7=|_>x1g`Dhuh&8LP3sqGze!LaD#kvVJ;*d@{*Tou z7Wz!s@wP40+mAQy1VQk`s)Yhz-OP$kPWavcBGGq_!sBZ!hSa}$({KKOKGrmmBjUnX z&F7REvdF*y))>uTET|#F*fvNPiTNO*1+n}2rr%qfo?ee2%*B^QX{)t^X#pf^%biz` zd^4V9)oaq5s; zD{TbE>U1<^8&D?n5z6InYA_gYFgAs_8%ng8Ht7ryJ$6#jzA#EMMD&-ZqMjw?pv0dT zaU27AVjOVzFpkC|IbIOSi>_C28r*Tobkmg`_2<|2(rU=TVTDzGWKx(a%Lo4F)Ig68 z0EQk7UCXP58XL2%vS~0^}2);!W#!(%)QiPMu!)^Wt1xke< z{JasM4LR#dB&M8imAhu?&C#vXKK+tFnt2e=Kajympc8p0p$=mt-xgaCgdbep1!v}N z1eDqD50pQMBj)~uANbWv&v%Vp)7I3j6L^qnba%sP;liV*fRK8@>0C*5AbaM$I9`#g zk&OEo57g8SX~a(mAco^t2mki%A`?@^WPkWFl$|&nu=5WmN~-l)*ArTyh%>dXsa|v8 z)WORy^v})oWsd>KW&Lm2ZJ1ldpV(~i+Oo^UWMBj6bv&K=X=uUfMDT=E8s36JH51vD z30f6FjN;Dnz5W=#1Qm`3c}1;68jqT0%c~t8-!?xyI_=;jmVNheK9o_i@6cMA>@q>N zV<-xQOUn%KSx$w4tEkn{+*ZsKX}ikX{~buEfy~AakzfFS$QV|tJKd^Q>I))F@-c(* z-JT!UWHwBnS%#7)0X1B#u4*0|z|ga8-;S-vutD9&qT)_CA#kPoBGc{BeIem=xAKXIOVERY>2! z#(9SdttCpAd2s)9^2EjIi3Bv<>U!8$^?UQ|N-VzczaRY;urV4y5#^{)+Ln}Td%o!& zcse~7eMM(g#}eb39A5yQ+5324TPIqYtDIZMZ(&nw39FrQo*(MG!*G=%9-uJi0+2Ex zAZ+<>8k=qC^CzhGzwn^6CrTYMZs@vsgPRgegIpWbJh@8X7igl@@$b%J3A&o!NP6fL z>U09~!DB`iYd3yaEzYpHA#gzitp%JZun~@&DMy7tp8e{DgRifC4EMf!$~)&p^zs?7 zuI$&*DFew~SEv0z*2?_2nn3B&yD6}*Jo}IP3b*5b+E@HV7a2NLL-$G^ zwpn7P50t}<>y7~W=F-Oa74Hs;K^H|-RXLi^Mna*9hzK*?STRpibiSgy8EuX{n|w5T zJB(s45^Bl#w{f9g8<$m01guU(-rY}r1bvhjxpg1a0ShY1{2dCCC(Kg=LAfeOIn9Kx zS;u!x)gU~q9~H2;+;>{xMU<84uSkHNSYJM#w&`&@h2Ks}qABT59j7)NZi1~r^;f+P z?QoCN+lj5{Axe5DQcJYGc$MBKpRGQb5RU&;kP}C5Iz%0QIBnBV|1q^Z-Eh5yDHZ0m$L1P-)Ix8w@0w)z$WCE{A)!e1{dmKo%{pz+gR{eGLJKmT26^Uq+~ zEodpREYeN1WJzPO(#L4Gj|auYZ4HhR*bxicoU--Q9jsiEV^CT`n`lt_?~Gd7XVr#Iuu_9)$St4F#X+FYJpW3) z0R=V(qL1xE5OqZ_!LM3*y?T(ZSGWIc2*_*yK0WFey12S?H|SAKTZB{J)3a58;xz0j zN-wm;NgB?ab$ESL;_h=|_g&Gn1T$FID@~vaYUZ%5=ViGD;e%XNU9IXq6Z=mMVf@cxpAOPagR2i<2d1ent$$AW315I)=i(5(-!0 z1Ltfckg9zBzwz{6=Xc{mi%}~A7v9?^>pZ{*wyBga* zGxn(t0rCjd{_2r(T(^fDqlr*2_L8v z*BMCzKIEsu4n!4pwovJOCvD@9esy2G7D+wzwxpYj5G{V^f1*C8A}FsRyEPa%)=D{L zf?e~vkN@)c96RT&=pgQrNyIXNz1HSnCnxm6B>_;IyIQeI82EWW$8N8&zRx4OS&0st zHkR~Bsi|O|sX*yRywP_rQt+aR>l^h26j%T=*Itk zF5K<+L<0k3?dI1hm+enzQs8l`R}$J4%JXJQ8Dt67j~vE2-mEBtV+h(#(oICWDgGWc zN#uK7&s!`eFX?;vZIv2-vR}ov1@%oi_}JbN;Mt+|7&_3arWk-X)$`o#?da(v^)eI{ z;&~<-H{MaQE67mD+W2@;X@=U}_jZ27Q z_VXhm@JmY}Z9#|LPlShI8O;iT-1Cx&s^HLhnp;B zQj66_O%j|eaPdaoxNLZ*gIhGdfl~S)Am)C+_-k5cxB_CFcCl1@UyUBisa{jwq%l#y? zIJ~w$a?|f@^k~&7dmS*Ew;!(LyjkV=!P%b|)ZXLSPRZh%rKSR%+)bQWg3b7eGcx!G zR%23g1m3}=hbNm1C0C~^5ld-joOp@vXDS&tx!8`0M)1SI%4ks?6TIx-a*b5K|UQ_Z5Q8Bx|r2KP5>2QTQR`Px((7B^A|;gnZfvACws$TX zcig{9F`B#Gi5V{*#ZO|prhb5WKGo8wtFsD34WxDx2T(7!KnL%z;PRG4>{;W$llct? zvJ6lMJ@7gpow-Q$QS{Q0TtZ-x_C>`IMh7gD$y@#*MAF3}Mj=N!4i63(!jsNL6~G2< z6U(v?QJ#H^t*E01dFH4(0@Jt6Dq0MksZZ?rO|ot18l)=a&RVn@(m8aQ?jWZU%l{am z?$Gh(9MQ$3c#Sr#8v_nPK%3Hj>H^vnX4p9LOtWiRIjk>PPU^Iimh8)?(cT)iVlNzg zGJRlbW*n-`jbO{Q5n&!Wi?5b?jq0O2yc&8oUNFfA-cj0~bfq_xreL-T&peH=en%{N z6~^mQS(d38={A0(V3k*ImjOJy(u=P3xVlmWo0xNQLKcKBXWA}%VTmVLi zl3j^yf1qcQmyKB#T;49UkrNZ;0fDuTw8@+lx_)0|Iwkyz$iwVow3gt?@v8j4o+;%n ze(g&>CXNRbbt;$LM~S|W8K25{UujLZkYUd(dum{n)mgRo*D8HPJMds22DVXht2T6+ zZy?)fLIt%jb%H+0)Na;s2me}A%pps?&~xtdm?d96^=YK)GvO{|Sy-=u%F0tem7Xf@cPwMF;Id_4 z(JfA925BA=AANmmTDpqHy{!=+~D+%@P;UnA-7|b}Q>N$O#GA?EkrdOOtZTs)UU|_K%J1DJZ%%AH*?qnL9s|ro zs!OG!;Rfka+qJA2DSKX=oEDq(;N$RZ0dHvhG5(_Sis%N(hmFRUK4$&SSJXtM$YKFQmT&>j%_N8fd=o()pDH!$Oe zyGE*>Pns4vjo>1hhRmLe<^y+8UNo*q`#J8R(Y$4zEk)U%NIWia(Tk`7=hRsEmj);a zdlYNcKX`X{?sLV?c=;ne&S9R36R;0OmxX*s9;R$^_8%XqPntjM(OH@apB#bBiVet6 z(%1Pr;ye?t`LZCJXjx|7_!Q{;R6#iIS+_j0d~!4S?VAdtg(GZpy988LWFi&XYtd1W z*`93W?gZGZHDktOmcI{lo?18*8)VZL4e8InOs!0(xpT278LKPX8VPK9^KTNi<7hsM z!6+|s71`epZr5&MxN`>)YU%w2P$v~WaP7X}NJH1MnYw~UU?T#F#}9d(0MlMa>DD+^ z^CV-h#lm>+@m-G(RO+?LBQ!K(RE%Sz2M#HPNOpw9zy>Y_;6C=%V-$ZSoIlnt|NA!j z^%K>!y1`xerZ!Dfnmk^FEAFNNZkwtji~zAlnYhodTZTlwrW|Kad(f^1FB>D9VO9JU zMd?R^13PVRu3f%wh9P|p^rH?G-k=LZY%)4(-}_0edDl!jO7HTQS_S+S+%+)kM?}qV zRspctJ~5Qbht%@R@Jilu)vYdPP?dYF>vycVN!!+ofJaA0VRArr@NgbHaqC^e5+vFU zdsAe6$;W><;5yiWxDxE}ibZvX*?BGO!bLz!eM3-;Uh*)4TBt*Z5<#(T=p+;1*aKGO zm`@8~Dw3w$wtrlU_Wm+Tg^{^AB^mbAiCOhLEd*!aTgW3<-Dl-!o zuQmi`LB~gT=ZpRhU_6}9GojG=Ja=>ES=*DtHyLzn^sk~bYOROiN;?sYT-Ky54-A;V;$NdrLO)ZJ72ufUI=~rE}{Hd1fN_kuNJBE;naG5S3=v+B9|owvG35B8Wkxj2sd zXM%k}zd`e&ji=1&c;LFJ(aYWm<8DX<)#Hs%N({560>kRFtQx>(c7j%4zTTRp_IVYRms5N_#DrvQyD^z3g zmOheU90RiMFiVtHl;{y2x^1FoFWQdr?k<+ylP0DS-p2#7*q8#>bf8+Th zvZBrKqi#W$ulk@CV_pO+dEz=qnrv#coA$d7lZ4+qhF{UK`0TX}{V+M<>ZW(I4EDeK zeI|IWTMqOdnQ3m@ls9T5Xfb1U))jE3KZzam24UXbw`38BPnMg~(D!g0`U7urlq!A^0BRdUl+1CRoIQ=aPz1YU>ZA*gJ`5q_3e2eGCn+ z8GoP$)IlhjH8L;hs&(?GN`jE>BkAZ}$OpX32BVDaR`$e{3dH&ekR?yosGUe&^3T2z zsW2(hX#Q=b{YU3oV-f^2d~zo@j(un;D7tw_dnk-9>7(|{3NP>^)o-M;>ckxGWYd2b~r7weoQuYz{H-Oi!m zovQah^6SLj<0)LL`F6lbpo*zEtG>@Cad$LMi;)U3rSG{LlP7a(zPz<@K_W1C6u;C+ zb{nbE`X|+O42GRAGQ$+>qYlH;X6@Bq-eJ^QyV9t9p6MK3HZKP>P!7%}0=L>Cpg&G~ zTA<(NV#(=xuNM1QusIo za%Y^Q6l2V$9WOF-fZ>p&wZ$Qud8s@pp>q(JWK-eW5FgF=53)Zav`$dY{gen~5 za3b<%jD)(wd|nx%p~&tgC|0V6 z?7+piV@aUWi+dSErvdvY^&6Re-oC#UuA9yu!_%M4<>ft$sl_%0x5eNA3Owsw^W+X@ zpeE!xM4Zmf{~(T7#v|Ol*ND?&p?(a)UR?esrw+9SSdtj|L#+B8+uRp)+{lDk1y?i7>U(G{f@rw$Hts7zv6h-wDk8&vm z+quwh+mtq!cPKeEt(m%)3W_DTh(h_6NO+Ul{XoPVs7}VLEh?)Y6q*96mSx|wHg{+X z6juDowbj<7yf{(c6EEGARoCMpMoh~qS?}HMauG+;?8+1lnwN&bBW{OJb-(>pUyA>Fm}A`w&VM!EZKcmZg2%Z>*!1 zlxJ~>tU(Hku!o3JVav3ZhWL--nA@2A5Rj}r(SBd(nVe}ttglxFZIXYS&>V?dsCI#v z)%_m={3yz;s2RvQ`Y}EffC^N=mQpi_d8-Yf1)&N*XgP3ZUNm()sNH7!;DqaopSJ^T zW|ypIy!vM2n|w1v_{S-D&8`NJcH0uyv9+eF8+GbnuL(%Io&7+_wNK>FlK9Z9l6Y}%pbCmp1jrjmA~jFGbL zLxbHxnXwk>hXulDcV)~nKHcqqIt#rXr5W=|s!wP$5kK1$KBcez2Xj8DcYn5&a zkCegs<-*K);+g1^Sct2@`m@{OX4c4wZ-_)AecrwT7{gn#05QR$sgJF#ZhRg+<0J@~wLO}MbVFf|w zIgwKP#EJ=l9u9=!3-)_kEBwm$YpB1T0UNWrlaoiy(Fw!x-AdJ_pd#=ZMt&*5$4r%= z^Z3h;jm`u+rG)@o$8oSOrlv~H{5n|hQDs3(CN6XfHz}L2ott%QCXsr~xkbJTJ_E`h zk$K$g{E)KjG1Agxd#wvd^G}5v(ao-@FFMl~BLx>c`j!liqROF%;}PPSA#5a<5_a#G zJy@rROI=MBURN%z3|F2NTNoT_w*D{$j_)dmTNOAy>BW$18n0$ts*h~>R$Og&)@#RQ zc)0JqVl@cLT7Sh*U_gN9g{#gI36Hm|QTRR(5l2;8wI}Sct5;zwOQ8{IJ3}K2dJO<_kbocrWOal+Ulr5>&tdAn@f;#6 zwl>j-ce7rN?x)q!Y(I{kpH{P&T?bzO(|KSPy_r3&s9sSYH@MKmEi#_a@8sYegB{IY z1P)O`h*M)R4Cy`BI$KFE7*;xlnEyNro#v2PC-iVw5f2hOKe-tLo6lM6W^>>RUF7b) zwyB2sDMZPV403Myx8Q5efE6rfnwD3wxy_01u8OPFo7vy+zzsoFB{NduhglKUj@hbNrb6#$_3o*v*tpJ^7P;R*Bc@z*$D_#Oaw!WYCqtX+5|IM40fDc_0P944qbnap)z z7!$+;yzzB2^+c8i&1h@(lVK^{*9nHmRU|`jN!DX%Vtcw?-FnCk>S1SV3Tjf^m3=NI zh`4nYnIJl@C8|AQT$5P4NvqDVUPMTx!LO>~_BQ)3c|0h7K=-U8RMp24qzFWz=eU|( zn?}a0y>5uDPS}&Wc3IhMk}$hp;Pa#0FF}eko5NGEPK^jId#$dQ|NPW5aa2=4wPkd# zbs4WJf3S7o`-hN$P-Uf^zs~vLoAovsBIA;_Rd5OrYtjNg-5dC)BlH_02<*h2vdt+t zeq5dG>lTz66m>fh_I7r4vXXH>9=*O~myMy&j|o}y_)4mz7RK`IlJ7#*K7N>CLHooj z;0BG3AnYffvK_aadv(G=`GJ!eUw`Wd(`8kq=5bF&Fr}VP=Y$H4+XJT5idSAA9|irV z?{a+5bAP=9vTqCUmhsx*XqXQU%8GtHhAw<*%b6fpO4 zq&K1S@dfSjbp49TFccw`a25yK1YLu~PYLQEKV1h{zvO(*$6!$F|sTf~ntI zpQ6y3>!6b3zJG%bUO??#V^PF4YHQZC&#jvx7)Pm|B{-mJ5V5XYPO7tje!VF=4qn|Bz>LXG2~RhgxAj- zJ??G9RQm&p6ko7J_Hjs$Oaj;|FSc|vr5v#kr!;9b8PCWAj?WZHMq{v(M%?7#h9Lld zE1X0SCw?hqLH90BpmJi$Dm+`2-R_4RM+Hu=FE{A&qZDy5M{bo1O)_hq{FPI|`=Q-m zr>lVVATO{JTis5ha~)eUe*s7@xc?pJjg3zc`L&s1t1j?;p3Yk#nuM?S!+e*!@fVhw zoWJG=;SI=H@)20UtPIxy&;?_wa-XPy_FewJB~5Y%E4lxj1+bg@zd8L>0dTm&=fw~8 z1B`g`l1A=;ER!^<=@1T#uc!a)-dDQs&;btNV~``#Q}RU)JT(AC~K zAuc3C0-ut(Yz0-`qIMkyWZcRDVk~c$qMm9u#))D zUE2&Shl}mULvxjnItE+3SX+%Lps!QGrzX(f)|y6L8PE3`Pir)j(YsffCytfkAJ;6c zh<|?=a)1^9F2Uq4jzlO;o54tAIpk_a+Wj*6Z74&cu;jhm?9N|T%$7#E-{6`9Dbf(m z!+#;+RR6%T!qQV3PiqN8C-bX+;C&$5;>uMjnAb)AZ%Jytjb!bIa$GI^nO%Q)Ok+ed z>?<6hIDNtV?HY?|I_>vAVli!E=PMX|bgzUYj&9!L(9Ijl#5G-f9jcm}DS7*zW!cEp zvtII-0WWvRDG^d0ki@1zyZ{g#7}YF_QYqm_y=fOk6F82)PKQ{q%|_LULG0B!i$O!RI}&&Y8>Ng zd^77_SLKfoMXpgg_^@3MWxiQeLYe~;)!IROJp~89UY`1Ee?~o%(d#>z-UCa6z8%zmaG8<}u%Dc9KyG!goYO(7O66@R)Rs|N z*RQfa^d{gu7BANl^+(P@2u~>wgUs~K29qlCeuBDLt;qZLVYn6qW_;P|F=b8xo*G@j z^7nrivPNV|m+Kl6V+;EGn+RqHF&~r(1dHWSr~GRTk15{jByGcKxrSTnX%|_n0KjCv z;Am%7^&3%W#nmhASQ}{XT0wv1lV?)4)&N~SY*sQA%B8~H3&aN9(IEFWf1EBB6Ka`g z+U#c^0UVzm#lLZZ<8&Q?DMMeMZB46UJhTAzR|hd8`_>@w|@N2`>TKJ)%aa9FHu2ZYt#sOtmqx0}9dWS%hF_1A$!_4ZVm zO4sA@*8Z#4r+$2}PqYs-y7<4(1=}a1Wws=^{NU!J7iV@CU4Zb94LW5>c|$wMKpG@2 zJ)tKA89#U4yMu`U#!sm)i^6yUZ=V-plXEpQZ`YI`2*RCxgLBltAyqZBwUJJ&N|YEc zfnZ5M#b;yg&RsTOIv~|vF7F;TZ?{=A0Pj&@I~|70SKOeLAxQ;Z32({RWFHd z4ks{CgJy%%@}aqDX9`k)@zY}{^bd(yo&Q4I*vv_PeECz)A^3W1?^h^9J@a)CH9}8EVhWSlY_v)!U~(>h`*; z_c|8<-=|8dB&Cw@fjUG%kvHx+@L~GP-Bz}|>0yf<`Iph{_t?|>^bUs8+HZ%!M0yo^ z<*2cnl*77Q848%;havh>8?%PttG|&T^=u**4E3DVv929)Mefk!Ia9vI(@VXhBi~bzk3;Zl6z#3ck7;lDwasGVZI;J|uO-?K9%H6l!@*Pw`I% zQ@~pqyfvXW=Yf{uGBYI*&Kk_qp%bTXwTo(2dB>wSWY)UVNZZHh`G;fWN)g3?!6a_|#8F=L)5>wc zl>{5UeF?ad=PO46CqVN(9Q@4BVEz!$JbB??Za(%ur!EDE|CPEdu(!gaEp z$2e^*fn14Xz9A=EZIo0FSY!|GFK+j}xev0s{spIP7(G$@*1zuBzPy1d zt4OfKP{r(fH#{p?$|t|8FHn#bb$ibr!`wEqIi0<|R3NY50&n!+C|Ib`0#VeRUlM*d z@y8NPn}5Ji3x;rciR?_B*tNQm`%^hpaU8$v;<+wOx6noIWC&Tu+?iFz#&)9`t+(@~ z$7a1jfjUd&+*r>mJ7sKf;)Omk;-(KK+D5l+hxb6&6Nj`(4#2T_p6|_s7jE_YsPgN& zR4`X*eA!tuJ%q971vMdp^l6w-rU0dyK zldki0WF7phMupHLVJ>^0=CVC;dlA>v&C-}J;dml(DxfOqOxbiJx+8mHn@#(y3r78X z5{qIZ-eD;wg*F(sP#|kSn`l;qIV0u7PqpXL5ZwOs4ugUK0MT=f0HP({PJpvNh-x}@ z+^<7iLsuenDgIiVmq1E_YR+`di21`AP;#Y!@1<)n+PCyI?DBVf<(c>fw_FOClB{HE z{iy&Spkt#l$GE(jPE1+S`i7=qk_~&6kw9Ki7D>y+jd_y!`K5@8Xh}vNLG%XdJR)a# z_jNS&2y+`ek*<1fWAQ9x{!~_wvZqf)ewzJl{**)dCvA!n8d3^o<=Cbu6kNm)R*Ve+ z7CMm|w{Ndklg4Sdcz1%kA>c z!{NC3z8^IC$RidP^peW8;m=xtDmqCjQVK_*CT_&^#LP&!;9Ds~09}T2^oEQJd<4+t z)~IVKuV+*QiS=4~>(rHecS4#q;icS%DPDLPBwk-To0P9EGobx4=;@CoQ9+Mkx_eHu zES-5D32>e~`-gYRb1#yr)q$K1l+#z@AKe}-6RK>FNdqA*v))IY3+z+V4z#WwQCCof zk4sKLp<#55?P1`lBIVkJ*s>-*t>$g-pJ%Vs>;{OtO>JPTdR?#jd;rZbRU6a8*c6vv zLDP6XYnVy`w~GNMw~M0IAeoPz_kR7!t+}e#uR9!tc#*+F?LQA^`@ zm%c8gfS|DQ4+4rso%2ZWsH+hwkN@uhFF&k^A3#`CQc>e#8NTE1xInbFL93G`JK2OE z9}iCqf&Ch>B7J`;H3!OJoZtUgdTu_g5NXffMIyZdRo5CCY8{2L8*;Ssyc!XiffK-n zq=IPrGY_yU2e*I2j#c#HW2Zx@?h=oZ$UNvozpa(13@I#nA+ELSdjYexiMX|Yc?*AT z=6BFsQDFJ8pxgbFHQ#-Hi^@DUL{?5v{o8x3cz`cz-(=g13j{*8-quWoGLO zz&TeR1dZ5v1)3~nw60A8Xdw-UcUKY?8^}=)OtmXnUsRvooqMG|dVGJxRw-EA@p3^ z0Vyd;*fT@ixtVai4K)Q@2YQA4u5)7|w3CG{-b_9sm4B*>*j^U4Gv|k*W6rVvL)w?d zL*2H2+l8V~vSf;C$`YmQ3|de!$xfD%sED#}!%(y#30a58zD9P26j?I%eVMW^V;{_z z8P7TDx|jd+e?HHBx!?7|o9X-==Xo68?dTUA9T{4mCRIRx&5hS6?%}3)Cy;@ zfw>%5GVUgZ(MKvCZ@iI9rSt|bo#=G~qFEfP5_>wQ>`6ZbCz{pA`|*tNav@e~%i-Er zU0}ZK+7b?G0DPZJIg6+F#D)%?FB|?BO+hm~%>Jl%E0|6umpByTy(NQIR8D>dLushE zViDyz%GLig#AB%_?wk*Lr6iDG`fXIH{BpihL3$RFS5dU2)2<+R$L^^|wR_H|{`XBQ z44w2NO|W~4K9=Eh^b4Sx@KW6vczal!8#a@Yq4Gf4&(aIhSS7hJAL;GwYxncj)N^!Y zuph-}^%U?ZJlY1b;2qbeD+OzLpF%4m_gHz2tDb#S7S2z}_uC;aW0Y@r>x6t}9WPX5 zI-)q@Og4siL8UCSJS^v}61NdYe8ops-6VfMhu;j>>pmHO9Bw?FxxN{CzrzK9dArtA z&dRhkwB{sQ4Zk^f>m&F=&D*Mq#}zaUZZ@1{9(=haB`VRPG;q#o=rqhHzbbV6+}@q6 zlD3z>8B7%HyvqGyAluMmR$gH~b%>jG16QMrYQTZDovS53mg`)A7;QOR;3;N@cP>c- zn>M7O9Nt~q%{1Ty6{CCuQ1>XVbRnOV+H!2*>$xr@Zfg;=mo{m; zdGICSmOk`82aJxV8_#H8TtSH?C3J!Abg-SfncP@kNJXvSf`){Q)r2fGcqN%fOgWQ( zJ}O0EIl#G&2N9xUJhNrA(rh`1VWJWA-vKwp!XKsAaOT$7Tfro569X#S$eM{I$o3Q%jbddGlt*>f6!`47fDQ3XC zKN(6fKuFW41B2&4>-lPGB?gRzL*C|BAeOrSu+g1}8pN|&X~)rC?=w*gr zyn<6v&hcpJg6Jq)R=h->e1n;w_vvYvQ~i3@TlJ`MR|HzovAo4k3{x@~I(P5K`on=1 zw1?VUn(RzGmAdRqxgQ<)Ups^>7`W6;WRC0nM(mz;1cJu`M-eBV@&>$c_l4@;<^t zd5-k6Ff+N~kf4e0q{js=flXuYiCTi9w3)Pz(%2MsoT>(Oy+KN`sj)gD0Uzuf*o67M zLiebcTG`Tf?lh|y?Oi{Lo*%-6hwp3T?^skhu4+GlLi!oyqh^?>l;vJGRk)zrJd}CZ zgUd4{*BtBH!-?oqr)nf$%ka2cc;EE};a*e~FO{)eJlmXtTF>yVxvczQRTl$qJ2F8? zvE72nFIAh2^Lzm+rHG4okCv#istn%A9TyZt>xrbJi-M2flrR5MnKwqC$`-ssb|!_> zOHBtF;66-Ii;(OE9~s_F`z8uvkN_c@mqPrecz55T7Q@?1)B)pz67a`gRgoG_Sc&4F zppkV7d3XEFsfL0G&zqvY?PG?dh9O~`aQV)daa8UajiUWE%)@#Ny%VPRH))BQo$y>Y zBo1(}?@;h-NFp6%xTE0+Y_NRubRwD; z&0WAO~hHk$GVD5qwk@Vqay59M*#Mhrn z*0;!RpbgmFdJPXcaHw4Im!|j=t|s(&e4oLJbc%KUU^v_VSoJ;zfUHXF`IA=|zHRN1 z2(oY&v^#QNxf&KZ#+pO=ipR+$a%G#Jhg?tgo>)dvZF?`Z&?D~V7>rY+33E1N&i;ORktBViT^+n_kBx z!}+=U_t>-DZd^Z&GuHZJur&%=1s-uGKy-PNru$0G37RgDng-^9zevkTx;Ymb^fxJm zCh<7{=p^mIQlUo+GBeXw*^KFAoc&wn8;m+sQvz;9Hmi=a*Qov!^(5bg&!|<+riK~~ zf=yq|4JF0~rvZG$bQ{1|yprM^AG!i2x)T-s)JBJ@`vsx@rLorH^2lSE{O{#Nzv#Os z6p9rb-E?gRI;GdVskG&bw#gJH9=VWissYoEI0wkCSKE<(TQv=n%%X&uDWF~PUjPp$ z6!fodbhy*1IR42|agbsO!c#|8SFGyS!oN_@`z3Ul|HVKv&<63uElEAnh%!o(&l<*X=$4 zR#+FSxE{rS;4ntVjPLO#eN5z-QgvlU z!as+`JxdPgqy+4Fhk>+_9`8P8#4k3fjOJC7sh7-czJgn!XU`;fm;*3pO!ki_S_<(J ztO20p&RD)__oIpkc$oTH=WYHgNM{fOq}fp$DfDHS^bP-DvC*EY_~WNb+_cS>3+sC*w`OKF$WIy0l%jxbv`D?{|IcpQXB>&0CMqWlVv@#jm?O1!JdJI>ceNo`WLoQCt}ZP3unE2fzQrTay^*zCOUfCU zOO8eh@j}O_JeFZeKLX1J+XQ&svbxNy=C>Pmfbx*sCGKIl#6)dpl^%apJ+pFG@Liv6 z5;HTmsFVNJzp$0`JuRATG4c-;z>>~@c7M;CHgvyQ;>ln^CzZvTru#X^KQl%wM&tZ8 znTOW?)pAMcwsH2c4@C_+`1nr88_Ig%2rIfZ4{++Ef z0zorCasP&n_}G*0xo3Nmh1ll7?Xxl%Xzw*YqOh{;Q;C*lLnYrMb{OP(5gA`u95A~1 zD;+TRRm5|g_G4eEz0uIsW&_yX`X`Uz55y{#Eu?(6wwPhJ7JZNDS!~R%$5Lw65{yah z&&mx!KP0?MrxTMyBCP!b=E6Gd^|ujGbTQ1#`?+)0ejlzrZP#?S1GI)cveJKtt>nh0 zOZ@KYooZrdmck3qm z;v<8d*##lQac+H6Z$NDAR%yAPmWW2+#vxf)p}AT5+)Kyi*eed=jDZ(%l~$kc0Dans zZeah(FTb2g%r;$*vN z>D$f=Q)FDDKeKWm9_2|{--p}Oe6eI`xgEiQIsEHs58QO>*a9iz>{p4WX2Gky_T&xG zElY~QVjShd9{SHOIdUO;Zw-gkX2}nxn%*Q~!-+8~ihb1eo%^ZuyVkC#lh*x*E0GD) z;~H)uM|m2-7z45~-|2l66wC8ZXm$ozGFD&J25@}F_q)4YQ%o7x~ohH&d`-Cwk2 zkOHx_hS`hvwKY{^fL&G{W}CHvU0dZSH4bQd&qB342_;%E*RuGPR8vz`LN`xmr$7jP zRo*`~k3mAv=uVCRAWHm)@sdCb8Sq7~IGv8vhtU7Otd|SjGHrDlyLn%+dy$P`7%iH2 z3a)r@lP)%6>~XaeqmG;pOFEUeR7vCVT#*HE2_Cs_X1UlpYGN&!tIJWe5)NeEuv!;x zSlJ}7zt^a1pKtKzwhc8tNftvX-14cp=<&yQ>AMoVI#GZjzfQtGU8B9mamVM(rs;Vy z?d4^fOpH}g;$VXE)I^q((>X*bLUO6rzFhAmB>%>5wMYV6{41iR>0lrqI%8}{EP~nH zVyC^xJ#E|gIZ^l!lK^I1c#a-3KaTy)ogjY@>^-d6{iLQe+@K@q#>d$o61qk#AdXO? z(s~^*dZmPt2v&%dt}ZK|KN(N?2io8k`G$$)?HT^50Fxl$+|Q#i9;G1c$>Pl&y4kC% z*jx1)nXC3^44dA?sriHo?$2R*&5~ITApzm_oH49TZmC4B{aiF?7m{}Qs(j<0?w97W zy^Fi_^-1axd$lY-8`FjYAB9{=E-Jeh0AguJ&bEM9+Q%*KrV#E$;qRC0x@P{eTc#%% zu5@GIj*yQ!x$1uzE*}hO&~9Gtl33s!jpPTjqF{5jD2O!(}N(>PP> z_z%0~x7Au^c`n-qW@1g(SmfqyM*Ow0ARQIom3{akCaxXQD}~e1w?Fh4P&8wRwkM-k z4shiRZYqD|t)p@2jF`||#Mfy$e-xaq_3N|2226-$z0-70=-QaBG1S8HPcI&`)a*(z`s`g5;gy+4f-bRZ#I7y*Dfiy)bCPc`6^14HD zJ>Bp)9w_;pG~cdMh=BK+R8bhx*$Mc0kM0(sQQlKDMi0vHAC_6x=?4EbACZIx(Y6sL z{G9iN9N3bxtcWNizm=o<0dUWnRQElCJk+16OW1s&*)t*m!w)rQjdjxhnk!Jw`>0j1 zH5d_!QG}587Hu=OZQX9ugne5X-xx`I%29q37%;6W{)-|FcS!UVz9|>|>UcEpej)fp z3$BB)9(;wi#JJ32G#M*f5m3Ob4kyi%VB*9^Y zXj;=F97EvsaG;%Z!0)83y`8w^9Za@+1mTsn1=`r3xw|2S90O}gP~g+eld%r<57zfv zJ=&(h&t&v~E_#RmDn3$Ho$O_Q-_UkKVqkp`_%3hZ3>~4O|Hfg8%nmWZj8})w-)RM{ zX>bhlT!ST|Uc)7!V&7!wEPtBPqh}CAMrI_0hjD7$vblL7S+EGyzSgbl60GS zRZ`VzA-QS`tVZnLm&^Qf5-|}p*iOZSlvlmifl%FGwWhC5Wt-dtqUuCW<;~QR_6DA_ zl;3O7&(VA@!WEjPfdfDEGj!q1Zmy(wl?^7MNSkbQX!bGAXaBHdT2q7`n-E@&u@^Ux z#}4wO3OYo~Exbc1V@K4V@CMa)$(%xf*rv8M@592*3T@i?J~}2Pv~IbuOwhzyak0Jh z+bV`A2W@^ZUu!1}PHz5`2ii11xl~hVk`mDFalF^oKqsgKrcW1aGW%@9@rjjNPdp44 z@$D_639li!X`YHpjT0H72mq`wQqAV^JTg1$KGZ0& zXrv3+6yaZ)d$W+8%(Fm8_SLdqu&i=o6J*R>BEB0&U zi5lZ8N8S9Rx{pG|+7ra7J!y%SWM)yqmb6IyQk@*BhHkmq9i zmygPyjK^8oj`+xNUa+w;gFzY^rLGblVZ(kG$2d_6Jc@QqH(0zc`lK%JxVr^VByPy7 zCX2XbyyBHwm)t*|%)C%c`6Cv0E?8%c~m?7t9uPzs!u~8|W8g%a0FQ#^{!{IM!!J$lQActX_XB zRllfJ6W_DlQiC{*qr)-u>r^|~SKVqDRev}2<+kD*qych$$+){c!1ZH?e09i-GG59g zp+&+^*o@iA_>2r0OJCKiF6FCGJL$yB5f>?iO+nuw&|~ImEapnmf$k1|W%p-iVZl=W zYcxW|s-TJ-<_g}oQ`A&i24&{vER`uv%VAT^ub=e;D|T#{;QFcFHn!0Jh|GKE$-svg_3^=;hvR>Od)v-tT&$CszQB9n~$k z>t=9IjhE|?5I z*h|%`ckqm}dEe5Y$J&_kz`i{x#+_340XvB$F9G%T+KMShLS!(Ao5c`$_tw{R`&nRc zb8^AVxsMA3A?13QkI(cj33%P4ms`>}0qd2Gq{4gMf%7C{jp2@-hst=8b_eL>FqH}!RW zSi_(6n-2P)wQEG}qpv>Bdd?8iA*^#Cgr@%Z}gol>7cFKoq&Ru4p?oVSXnOH;|9hYj`yZqgUT&*@dG865(lcJa7SFrA+6k%yHsg7=e86onz5wlE^>(jQ}K7xgA{0g$)v0=)z zl(;bDZj8vn=h#4&h4!C=m}+qz5~Rm@6_usnCGde^aKK-{O56 zRO{n^kaMD4k4uHFqGDAI*v$r71dJ9FV{Q%bP=fAVBEEhV@Cw&@ihBhn^ZSt;hu4pZwPp4+My zIuoqaY=A0>zOIF~<-7JQThn7Z(0otWbXsf&x_$V@@I~(BTp6IVk)a3f(JkQlhXz&L z&0xS!Jn=u=nUhQW%4S6|hJSn(AmvXU))El`?0n2rJKtCw)y`K&AUBQjkIh)|wifNyn@0DqT6s%P5CTG@kr&O;9g`Jwx=x_3w-FIU2yZ9{9oW-`o zGx}az>B}cQ3hAlu*2Pj2x~zQ1Xtp-XK(eF!41HV#%AE%IGU?{4Lir~X>>pFlRmk(O zQ6BxKH(MJuKBbpRSks_=E-HYS+0`cBRU^@=-@Z)7#x!~lxqJ@W*-{vieBIAdV0}g#m`MRM2UjGOFO0w4W zZzP)6F6Fll!AeDYu=Anvm5Oz3e{3-jzaG%d+l|XDU;XF^2zNB}FW6L147*0nl?BOE zg<;{|Fsz&t_UlmciJ~cGD)aDV3M2?mqlK3eMoCqD^Yo-mmH&}2>lv_h8|%Ze()o|5 zCZQTMIndL;lXQ#@UyS$@FiS_e@1^KBw#dV*grAuc)DZX%4fve|y~BE5cXgjgt38@b zJ2+>^bY^dUd}H)v76k<1)PC62+hHL~h@*iK@nCc(UIetoaip*Z& z#xVeeeS5sA&}Xn2Z(OGEvkce~&defr?3oPSf9#ozo9FKxbPTn8!dmXuG*!r6>NKAG z5}i~ZEQB>DcrdQd5nhGPRg8vgy}grm zGU|Hiwyctg;m%sr%gpZcyA1o{CodnMzbNH@cOcv@>>IEn-lan?x8XF-=J|M5D)V%xg754clKZVv$R2ePE|MG1?X=@_@TCx(l z_M7c2LN3h)ubSn@V-fLrf)Gm05mKAH(tc&5Dszu9MF0@pf0Zm*Gz((N*uG8`%yhWs zJRl7xgS@yP7Ivmd*O=gje%%kIH>u&W)P}*02+r*}(dg3EJdQJyi5DEu zA>Dsv0UT&Da2xns!ajg%2{2H_SZ4;%OS={cCuG6})%{#R>gww{6js)yN0)0+;+~{| z4t!QiC9bRx0zwW2iO(5l_AQ*f=A9@4tCQ*KJ&WTgJq!WMqbImvpx?btTB#!q(o$rq zabt2pZil_imH_pczAbsIC)NI}Z??mfQf5%{&=Y!C)~}#ZkXHW-YL`=-HL>HhvGdmb z%c^;PUyJ7Bc;emI+4rA^smds$T`_@NAkCaKdJ-7_``k}(7-QU4YTo^m1jR7xIZ-)K zx)lAD@VUQ&XCM4Uf&Tml1q$LwN3yqB{kTXY1}3nj^R`Mot?Hn0Am%+?BdTVTszz?0 zA&wC0c~?tHSZwwi(BbaC?OpwXDL#j{N$73X5a5SalOhnm3{2{MW?eka$e_uaDprKx zZJ@PfS*pY9H7tY10ynZ?YwB{uX=Bs6Z4|LZ8Qa)tC)&(++fGp1VerP@fR&B2yisYlL_7)AReyhodPu9S-S@l_FV41LjO@?_cbS1SjO!Mg++4$W%*pj}ji zIVBGPgV?|Gp$W~R*kPt+kC0}3dpo3T5|4QW~WU{7hR=KsQo zg8bG0jS=;{_mZk`91wPm`umLq)qu2!t@6 z&PPwbh5%U#Ef3*2h}-eq3UnoyHUCh|Dx(x33J6%7pJ6e zmYeoA-&3T?H|AarVB>7S>c`u6il5%ep!E<09tU7QqBO{~1?;N1u#5q~k}};|#db)* zYoDjiX~%FzYDzcg;_nmg)`VM5{T(l7(^SxZ?d7!nhnEv`$D>?ZDb4xb1$@dm%K>FM z$1O|Q@;-{o3>DnoU1$IcSolqG;7UZbTz=bj9O7}$RB1Fi{j|ea^?mo%yMu|ioJMB#j72w#^AO=D3SrT2CBzq>G`EaMtmXaqg<}+>;daXF~2hu zi7xx&Xx!%>{xDR>7{+cAgb_=~6Yl{ZkjquQft^tTb0baGmqYk;JE=nij!r^chy(#Vk3G#2Fjr#+bzF^p@nO=sy-=MX-waVtzcHFuz~K$Hc@ky- zhDkMiZm3iPF^Zu7F1spfX;vbuN$TuxA9m6Ez&JF=8tJoCHlJynYPc>!IT_VJRcLe_ zT;zE-)(7;%!%Oi89(=L#(jul;37gG#zfs zAwBKF&ZGmvBB|k~4R64v6skiWxWt~+vGyuks|Fz2O~YM(^v zHyu~R=={JNlPP1Moq(}5yZn8l04+-;H4O`$xmI`7*7&l}3$+g}L7DRXxvaM4tceMV zl7!5Y%7y|0Zpwc0JG(rmu8f%ZVAIHl^)RA*X);mj44&}co=?f^zdfHE-tC^h25UOD zidJh$k1tV0RkIv>&5-W5i^Q?#Ta&y@{E3`>0U1H|>;%&D`D zX)+lshQSz3*~A<7@9ko5^2_Lsy|i!5a(8=YRe!&to^Mn5J#CbqL_d_^ zEIV7%zh@ELu(6}k=yU3~;EG{?IMYTrvVdBJJD04O?_^vzGE_S4ni*paGxZn?lZQUB z!_FszV+6{vf}@gDb?5pz$NpKsnR;B^G3>+xCDm16`t&aNF*ej?<0IMV+0+bI+E|(0 zT=QG$Ej`t_@F8_B5>b!oX>6dsgJN#qu1=pX%4 zO?~Jbqww4?1J6!GOMF|E^j?^%^8UnzKJ)OHwPQ`mQ#bX4|3h$C}Le| zD5k8+Qi>ioRaG-V#Dr!*+OU6ZF)y&JkFH7`zI)yhzpZl;LK6_;d|?S#ThSY*hQ)Vt zyK;it)fX6DCSWUJx00!>ZCs0bhi9XD$9w9{WWpKwC$iRn^1%lke^gd=2*C)1Vo(qS z)&`s)C#jCf53Tk~;TJI1g(vME=8mR&gB~w7PE-IP0?E-wE ze5B4fydY74?v=gZr<_LhRHKQz%1=-@Efptp-NJCd`XaL)5MU16-XG*agqO=tVIW`Hf z^%0Uo=m)LQ1u?s0KQ;aBW@%Jc@&iPfcm$T7@&1%rC0nT9IIt)A1KrE{qp$2fiN)HR}v-z^BZXBi4y8w%R%)Og@@~>R$~0v37tB zpYwKM4g0{oE4Mf_g>t@-*j~D^%7}?uNX~@dVoBY7-oE@^8%}iO2S>RW>Gu24FdU_! z-J?SDAO6!(?Z6VW?b_xkQMwF^&?&}XPV~c+-K{L zp80^VqZb-wm3_3`{l!)1jAs6g3F}uUJ2n{0$ix#}nEp>{2In7sKpjmf_D1-2Vcy&0 zdng$uIv=fXcZJ?-cF6J3U?gQYJRF=^Hy&mC#2QcJv&ibEmwu4rpNgbxbuFs)7A&tSp+mq^jlc%G|NL0 z^vTbx$wb}T74mGZj4o4Z>5{`yr~=AYCkdJoMg+PGJ|a?-|9zA*c1BoHP&x@}+pD?u zDMwjRENc+8af{Fzni?m^Fo>!KN!`H+J{0INVeE4hMC zGa%>GpTwu#O$JG2Q>j}6scC7=Re9B2C8RP}t3_q)L=;;v;cp)@`0;ua2IBhwhA6%W z*u4vGH4ma6HA)nPRd?RelIVOb$8y1qHp}^$^sLPdKar%8r^P3bJn0qAjh8$}L*L~m zlhgC6#l@{ptezxlLh?e49;KjR2^X5=U55bUV*l3Auin{$Dk~~6PzL! zCm1}D^=kj=r~5C*FBwo%{NuU;vO0OHg@qraz*r>-c1XOMYrh)Y1SyO$wLEx5cjEWy zt|f5#Z3i$cL@O7;GW2~3*0WF}mqXc>xwV;+&mvI;)u`506Cp=K+xQd--)nZMq4{v> zBz@0oG-r-gWUn=3K-h*#iXbOC1Mk|2*&6!J+VqJO6&q7L?LMhSE8j_~(C-ji?F`8J zsZ%ka{Fd0+53Mn_@rWPw;W z^iDDct2*Xrd=frzP+J##x@(CYFRm^{M=zwEb~gLbr_~*6a@nY+RZC_VzQ3GV)!oEl zR^o=+qZh<>9|CU{g5)fkb!jQL`fkJn@GCi#98@*zySX?~JZy+=|fqfM8_{AueOAx^h2U zGT8c{JRxx}oS3ZD)K(zU2Ne}7Ev)261aM9B44yMk{re}Z?MOE$Em6QV-H^+O4|9tA zHZzs|?$fyt$=TDDCmS(FGfHHfP?gOdZU$_olnu3PHDEa@N9NNc+6*C|$Tgzr3OsjQ zVVR?uYve}E;H_D4-bK6(eYInAF44>1HU5&s;A~w5@t1*2^$DL-FBq`)7T{#BK)Xy| zyBZHu67%#tW5@HpWkU3YV4r~9yc89Q#zkc;;Mc-WYcZ-b5}9+iJ+t!HTxV^FE%>zj za#-)9`QZkZHK(Mrklmbf6G{cvdRxu!^s#$))rCajQom#RqKU1vst-;&>gA=xeG+*@ zs~~08h59%rvB-v2KbU&}$v6v-T4Uq8o`>*0ERm1vl{i*y2eUN!%13@dsRR=J8t@6* zRfayyu7;S9r$a{fqYng@IRtHA_A5nH9sGSAXXukzMSQyk?qX`!>n1Z=Z)WLb6;$mj z$dA9uw6zD{3!P~$DHgj0KJH71_lJB!`<6I+FOhXpi_bOpW{aM7v@|ZiwJ)8|X5$H6 zRlemeuIT;mRV@c6Q{z<@8D5u{vwk~p+e*YSu23uEfr8CP)|bMsJ*Dc@J>l1Q2$AWK zTv$g~DSPhW9JhrZFV?CNxB2I%P+C~!c6d2$9i1afe-Q50*K0ovVXQ*v&+AFTb`o6k z4VWaghp`h5FS_X?XVMVJHS9-!R~&pOl=#NX0U}b__yMt&*ch7q1K+F$Lwp|S!l}*m zo*_XqEL^6t7cV}$&LeQW_Y+H&fkB}!fg-)WFvZ|myQ^F4hE@$qMIym*Gv;O^DA^1Ev$xL=ABC#2&BII^#}{wG+^UPg*#g$BD&)XkCE3FnZ$g$LN~54 zkgiq-5)aDTK#AdgqoSGD_egA)D!~RqtAiQG%DNtc&)kas2<>)0)=bT(3nj7}}y0$`Hrt zDxz=SV2~<$6BcrQI^wCJQQ--)bE>KD2^PI*gC>g_k@(0aOkX;xmO@l>Wbr<+*H9#w z*>@l6oX@yq6wAPgy?Hpk%+{c|`G%9u3=6XjqUnYHWFw25aZ&ej?#!WCwxqTm@;7|e zLY%n7y|Cy;rVI`x#}(m+9x>JkqXq2N!4W=unuxB&*s9%4G;4Ezy5+%y5~(zfd-1*S z_f-XM5NI2-fVcnOY_F(4KJkqo42kf5^nynB0PArSYubqwDc1wYRJGpjyL9R|Tiu^k z3S}+Dh@soGH==m*H$IjylJspd#OE){CL^*1SgISe?=EiWm<+K_USFGsb@X=&|5C6 z<)sk1U{>Ojv`q9#m?wIr^Zc->wRubC{v7b|iL}9c5z*n%$`^7SFE&%_SDKOSZ*-D> zopa4za8=9T7(CMix-X>Yz5Ar+`Ms;;vsE*Q2JB`sc*zz3dS_N7Gcb@JMr;jmmqVCL#E=vD#C z5o84ejuQOqDZzR)l2l#fR;2pF&-b=Grh@c+VCY`|+SWm(Tpd_bN93orpcKTx$U-T$ zkkp`JC+Y|NAgx4$jK}S~#G_;1c5$dQK&(JwS>t>%X(w<=?aH4vqv6Y5?$XMd!sEA9 zhs#d0=54J=^=x#`IF+OKYxpl$-Zi|O-4?h;E{a!9DaCC_iTiPMi&!2uCP4AYHJ~2+ z-F$_}DOjJ_+m6WDhiv6KnU-EYeJbiT+Y(-CRpxOlri+Gsew5Wd-`9)|N?YB7`>&;G z-DBP=I2~;bs^x=Q!W9>}-g~T#2j7QC+;r@$VS=_{hQ%f?{{08{s3k+Oz4;wzTd0{7 zKCI&+@lA(sjMSkkGbiTXSqv6L)QSGWbAdDbczQlfYM6LNQ&MLvZt!Z_1@JSrBFb=c zQIZx0bfZ|&X!$5KUDg-wtB9mvhJ}+_>uMVb-K)H8LlIAMTt9KdwjC%{Cl~pX!PVqH zZ!(8sU4Tet9k=pMl9E zwTWauqTWA{nb-FA?{m2ZPUP=%^Y=4zX%g`OwZ+2Uk(H>!kDuDQ3G?93G`&bZ=1#uv z3Ue7o1ewr!X}{m**gp!Z+2o{JeemMZOe1k)96of`MN2194Jb zs#CKj#-fMk^|k3UNu?yqsY6QVES}weNm4Tv+HW|V1UWHCr_djCeF<7>DsFB$)E_#} zf-lhWVk`fi*2dPgo`HCfMP5EwLQbdLru8K%y@gl5R1m3r(Y?;KabR1rc9Ljqfc^oW zi(fI+aZwH=-p?ksZ@eLW&xAb8x~~u;_~@bRr_9Sf%@!>u@#@jRSuzhi) zt17*{tM=()q8zeX*mljoA#6Y6m-<{Gmq5W!W`}H0(T$1(4Vt4&JK#rdReaDhy|Z&4 zC60=u#4?{<>&0CQ{k(n+VPBHMaiX2AbNwSCFoyw$@POw-Ho_L*vsq8O2Z|4{%|X)d z`37!*PXi<@t+~W)*&DPyxQWIbeG-p2udL(fY}%aj@`YHt&%qp#akw#X@+u3a2f62dgD`~4AbuTq`LH&y@i~U9a%A*$g z68R7lku2woyk!=ChLI#hw|JI9t>LGGU3oX;6m)#|XPeT9Lf5ReI#?@D=tXr~nQfJI znVuV&!!T7IMHkOD7%KLM5?|sX*OHDC)lL<0j&DdBDJq#|=x5^lQaJHRi^o7EUyZTm z3n4k0)`jUqW_2ldq%&YmDSMC1u_c_!mr~l7Hc@R53mw%ja2ut}evC3V$=nt5(@GcwlVLG%%szNBkJ3ddHA&YgoI^7$0_dySH^U_qeY?w z7;fd+3|vI=Ne7Ma$v41-MCa%`*u+vzoHc#MPQHJa4ZOoke0@)8ky~wz+nE*>M=Kc3 zo^n?qei7>cl>HbN>bq!KOW7>(duxB)SMwrK?eJ%V+lATx25e+W8siTTk`VivuaJ#? zhM|m8mAleN-#}43AT(qJSM8a;ysMr=MUK{&uIg!soPyw)J$z{&KQu{l>ij%^8Bu?= zZ6?jsoe(|K@yykZ(9(u_X}U8LW8SFTigR*BmOEYR3SDT%7>&Zy#8@&L7=HaaQ(Jn| z{sq9^1dqlp<(+cpQMA{nzp}Lo7k78yYXXoQ!9I7?aEph|4l(t3@8AR7Cu3?Qd|Av| z?c*}8`HkoUwI<9Q}SNTem;~{esBlAQBSmRcq4t4ZmB5miiQ2zLCJNG zYeXH$C(oJzwX4MYvk9mB44b-54(6t>@DHx{;+iLkgFh&HDvPg|u;rYSxTl|I(2VJu zX0t5E+IrrG9TB+ZGiX0QY*@9{aqYq0-8@t@3@`WWO;CYVpA)VWcsF}hM2_?EJy{lM zpRf0QY>u~OXGKR#zLe}xU+8IZo|QmnOW1OB*e+|^=aw?o>%ZR_7a(X0fK1+s(uaYP z7SE4X{xW9IRhc;a;PkvraK+huDZTJpzS?gV4`R2u>DG%bU+8+h#oXd>sZe4zub9Hj z9l!5+f;wB0t(A0+7r!z$`ocV)aT+P+fiT z(*3!`K`c+4e#-JVV@E!pCiMZjnyEaISFgQ4m{rdrQm#-eCINLw+~PXq<%cg?Dj1eE zfB$E@=#VX$khNUXC&pX)WfA+&_l&JHWDA`NAkiuuy3(v5&FMbiK5n{+kPSXnLTx{; ziuuwiL|(y*276x%r#{FVC%(t~DRDbWR@ib_*P9z;o`NGhy!#`3tKB4WX?C#G`Av)v z%*tl^m=v8p;~A~PEMJ&s4d2J67I1Ry-rq zTl=Q(Rp)$;SGm?NaA*rpua)A;p10AOs`ryb+Ja1;(91WQ$!aG`^g|~9V|L`PnHGHh zZ+2eRz1KK0juCh(uKL`KKNo)L;Jqu=FU9kv>ax%)*5E+DeokB%;{MnP5Z1Y^uydut z8v8o8=-j$_8F2A52*^9{ebU^i=dRcvr@`zQ=nev9+8U$>i#Z0ssam!*d;d{XE27AM z-S-*S@ILo`n3=Jt@*CC*wB!+=?rRcNMFUHh0(Mcw*lk5>87p{dN<8Ie z3~tV|-+#Wox<1HG;C2_kNv;|bXe-h<(^&~t22T2ZB)Y8p7!jCNcPQ%7%y`fYr_nXT zGccoJ7K28fbc<_F(%gqSPXF-xvB5PP)n--6fo^9A;wWu>4?5|A_x$oppskb2goBtVHQH0zWGF>JYx- z7BjGuN53=X?KZsmCiO%lsN#LQui_Wy9*g;}g~bTNtb}Q8l9X>I&1G^MC4)h|G?t*$<&7?ce_W2rohv4nSGbP zH~`uvT9cosL#OrQEg*#iYkDuPA=fo6|aMDnxrN8{9DVc1a5Qo31g-3vgW5Y<*S zyL(&w`4!_-&_k^Se1Cr!bo@XqUkKQ_<&$DzkRB?~_^9M6>)}vIPd6db3SIXLhH7*> z>(sEAX78RG@!E!-J)}?7HD+`cEW;O(tO8deDJfsLH4sTh4i#P7lfXJ)WpTRq0dy-L zz))UYaM8YA(+|}E+{(ej8GG5@6@aN=U=F%)5pMV(?W)lNg31m3f(RPbQ*o(}C8zr) zX0IDU@zi#hYo{GjYSFx7k0KD>?XAnLodwrcU(kTUmPI1U z;%{I0dxSOhO2%F~(H5ry6S7?EXgZ)s|D`^`znBYgi6i&m%mCb&zv$eb1%j+RZ|!TL2NU%u&zAWQ;FBOi)D8pxFeXR;{V~9K7FuXB29VRS z2>Q-Zo;gJ9TcYkK9VD6P)JYc9g2SV{(9YYkNb{8Zzkj;4ds>c3y3DXOMWbcf;Y7b~ItP|+Cj*SNkA(~CE7E5$^|JpC zgPvdxIA^S6ncQ=73z36}O_Luic2Tg3c%W1~yoYVn;E)LKyl7d@7rQc);G?wAxx~DQ zSN))HUyHOsV=Wxr^yFoA%<&OT~aJPG_FvrH8*01zAmW|d7TO-nOw_4 z;lLKKduF~XsMAyV06tO;0eB4YuEsL_!+y&2{73+)8Qx>@NY$li5VqGFXEAI?n znGkgbkX?>+r@FhMom$pfB+V@~S7Vj|UD%=0yw4nrhOit+uf*-@e~kES7R|i%oo7BRt459NWmAqh<7?au#0i{tm3Hw_e?3k;;HMdK3Ly{F z@}pU0(~d{5rlo*U-1ElAFszi6Qj__Hg0$0FArYUp9bVT$Qt;`*!*rPaRkH0ZM13X% zHrynt&~B!-JRs5?*{22Z967!>%AyCJRT7fWAdXXST%-H!GZ3U#gCZ6e$3H@KrfDTz zI0Is=Sb`etB= zK2mwcy>{n1&foQQytwBuGh>Lb`=KuNR$~BA72fpucHoNAv))Ed7IUn3@=RxOfJD55UGZ#ZDHfeaC{eIu|^Lby)AJ;8iU;|3MQt##=PX?UgjEgLF*X6g57u44Q>%Hrsd;O7@`;*g|?_f1*LbyP-?RFS?*mQGb_rwGutxV6l{88CT+JI~zS^WV2ViiSM*!Qg3ZoqP6# z@*pvdH_mo)SK4So;jfaMoSuHK`*x>pm;LrSUQ4cOJj~&Jr z%y|(ki{9PT?aImn`^lS~4v%HAC$?wi+{zgW&%bV#jyP=JCB=g(eE5ZW7H)dcDEbVj zcJqGOXaBviL&>Linv9HtXy~ zOqblw7+3X*Xr|`VL)lwBOPjXivQc4%P@l2i+I=gRS~m-a8>mt>as&gDjJl?o!9NQ; z!v;we7dw4u+sFA3f!SyG4{YV7yz`cQlI;hg48yq&z~gmQjF3l*dAp@SQ};^UD0SXJ zbF95xZ=r9QK&-%r=1p^-d3+##Gkxjf>3{aKAwJ)&O~2>WgNY0GSweHmL1C}?ldD5( z^xGOEUyhxktx_Pn25cLAh9f*Q%1b{)x6OkMd?IZ!s;!lCouK6*?jEyq`QP(t>At*tMs zdn3R^>SZI%KDy3UkCO)eXm+5|U$YfZ;_#$QLa*t^MbyDo-o;j>?QyubE^^YR{xd@d zo-*rS{2ZU6U+kj})`&=K|B_VvY;Q9WoPdwE!_H=IHzuRwELp0@gTv z@XS)1i~O2<`BcPH1#hy;D87Z;2ZVZxY&kmhVZA!;xKWTwpx? ztI6{oNle+(xH&=$r3PE`&b>}yxV79w;>vNGMCBY?dDn&2PUYS+8v7cl^qVVpDqQe3 zBVLnX86%^nsvEzfdUH{Ahnzb$1b*!7xn;P-1v*~?yrzuSAX zbs=-Mx4kxO?|yKp{K(!LTh+*Rs+1_X&A!w0oxd_vJVS zgq+-h74c#Be(T=uG;Q=0Sq<*i{a5c)ES%K5SUDL^z#71a?aMoKGtnyoXn))qA;!{W zx#S3PbD0nkF@>Rw-_Uper6ZB8>ylW>81-EYGtb)B{sDHc zQ;D8On1{1`rZ~xSQ{QOp&zG{&D)UKQNhqk9gX%`K*o;(j;HtO*g4hWSdiovAXmeSQ z^`Rc*_Sx@qmUsgchO{aYv_LWHr|RjMJK7X$2r$y&UgCJ9Jv_%~az&&>hmoj&i!z2C zN;Y3=n^Sv3iz7sUR-Jc?tvV5?S1;;v9TvXi@a5spKkCNj#;lZZX(7iW)ueYK-Dutf zS7y9j5~W7Vd)9(Ount ze}%lzAL@HKSN5Fo8O6Ds(TPOZQI?yvEw_7R8Krzsp~%^okT_|UF15Xo9uAsFV|$T7 zY9Yen%lv>F#v`#VS9N3bi}zwJ)lXXAc(I^Ujh^?E;lCD74|vY8Vfhzw?-7;T)*gco zx`$2EM-IAk(6o?>n*?nB zuo%4`?+24cT4Il*twiEAKkq(nXUauO7sDLg4LXtvqr8{@y{JpbV&}<-vD5qHJ%mbs zfxtrLo@UUE$wxETFUv)M#2F?ZeI!!kFL|a!P#m8bS2{XSzbjll6=C>wjzqm1y z11qabPPzjtfEz^TX=c_nnLX~kX)8g?rkC(m|E-4Y1A`ob_T*@%NFJ{4s%p%}-0MSw ze}RgO_Ses%y<3>*+!Gimukx-k8e8K`I--|)^y%Td#}&iUqY}S$uX}x)C0$uRraCLq zp;Gcxq6^)csD{M5EWRoB%zZlHEkWoT#xvI{){2yEv$nzfi(oe@XE}W&QegKuXaS}C zg&yD}u=FDN(aIH?z9Id8Dg_ndMLwufid;r;Gc_PYE;a z@Wa_Q-c!*8xyg8&%!H@9?sH#aX?G>`J+I5CxZZVNGqlXvW5795MAs zeUom=qCOthwNU%Un>^c1U{FUk)wA|HgHW73 zg*yB!LL~oj;~Ei%gC102u21&z$<(A+B8EpiZ8MV*KJIISb`{iWC<1(XK9L?7t`XK8 zE_W}}6H0PjkaV0{8y4v|wAi@@%E3hhRhfC;$Mb71jfw#b*w9zWY8x{{k5QE4t_sU` zFuFMf#Lw#m-3UeBNr+3{aKyghh`qxYi<_AhqBcv`CKAa{pHh-p8_84~aneUx8K=jaL|w>Q=Q0GSXrmQuE6>DY9i2od z=~UBmF%hxxy6dqxazA!8tRMf1RyA860KOAyt>_41eVmXBXE=!VtICi#Sy1Lu2=O*; z9DsB3Y>J={EB!})>A`men+E!+BE>yw87GCZAgZrGR1uPEy>xhEy!_>fT*P$k4U6cZ zbmr-(i*9)`UZ3kb$j)HXW-vIp72)Ac&7&YG{`e)`rQI}WcZ$s03giu$OCL|-7pBEO zG1FZ~syp>_So3iFnvXrt?6fhL625qN5r#OlTg;}s;Fs-A91iYvl^VW z@%sw>b=LGJ7n)png>v_(H3@FCPC+4w{nb${YsO51uRa~vedvjvqstPLXlQVyz><3v zRJn#uLO(sxjoArXAKQWHV@T~VfHB%Dc^{D&t+eIug%3PJV6#O1-zy z^;iR$h33TTNY~XnzAH7B^Hy-2<6O7#P^R1?GYXBxMI2!aka|MTfsDSU&C#h!%_L-J zCXp}b>Zf=LjM)FyAH%C|Y>qX&=mml;!la@`nX-Fr?Wv_Igns!)@hkmG5<`gf)R5eM zyw?bA$douxl{Vy0BM}CcZF}*|Y5g=5*QCB;5;~!4lN+|KQTDjMz~i;RFU;D|V;esb z=j=HH(jmbvPug6P`l16x6Zv>n9XJg{=tbJlToBH^@gce3k|Kj_#5#*nDAdTBK(Z=) zIuTuCYc8JP3oATkKhQuNLK7i-le{KE2~{&m&x~@7^e=yznhl!u9C0@zYweau@l+Xh zUl=GNl;fOp!*P()RuiP`4bo^WhGs%3;Q4KPcfH(UrX!JvF<$x|Wk92*uX@QF#3z*x z(Sp`M7lCSac=2(T8C=ws)(6Cn4>%B%V}G1aMxS5!2hrx$rWBlV)$i`Az|M{?UXSn# z>ntH;cF~w0j-3N-=JzeBy?|6E9w2=dq|(Fe`P<|#$Nv<0fSF1CGwq9#Hg0lSi*nKC@KjB`tBSC$)M(jh3!G|GEj&ODg4Zu6E4@%d5=UF<`F0+nbxq1p-O=P^gQy$0;2&B zD7mICVBS|wpHl$ zXO2uDwij8${+!PJLHW)@zI^fRR&v4ltA7dsHKDWm8@Ah(b#H%?7t*0>AJ?C~Y?PSE z`AO|_a4byt>fp%F)sO<^ll{2jsF^hJ)r9MJM+9aQca1RERuj^6k3<(#j)u$8Q<7){ zTp@!6XIRIBSnFvnY}o)qJ~;!lSe`y;l-_&QqYpH@IDsu+OY{p$i4nuaHt66F! z=)r04MUpZfC%zj^OjukYyyhfhYEk{2T|DG)d$YGpG@eo5!zk-_5~+qMW_f<+=}tU4 zlK5(Iy6Uk3c!?$MdEQ$~ZRMHjlx?U{)?i7%p3tql)kNTaMXZGbdsMYDlb$+IpsWoj zq9ZLr&7yW`bG5I(obY*v2yhkqM}zY`k>$gYe$Rtp>WHMm$ zc_n`5s5AK$qd6pWXV6N!5YMdgWHlV>B~R?_zB)da=%q zW5dbj^rEoZp8{RKa>R+Iu2G<@5ND>I8jPQbF?(-#i~s(=hB*&9dDm7GH2f zXqS=eU!gf>aPPAHugrSAXOb-a=Z9Q2e4&w6H1)xS{!h05a?fe+|;kR%^}pM1gLqq9pJ#L7m2Hb6E`v~~+qMjm=W;PcIr!L2`{|R0R~fzK@<8qw;ny&-2*cFM zySJR{k06){ZUmch;a0+G=~7hGMb|C3a*u8cxXh^}(e>Co^qt`|@v;vtrmgIKg0jyw z)bNMo_|caTDkb}TYD7xa6UL`cpYmVfc;dKazDSk6SrbTBM@9gbr@pjVZT1aLvWHKV zz(@4_V>taI%$yNrpthX(j^03mQc{bW48ZH%4N~A7NW7yyZ(sqVJivR|3Kuu&ZKOQw zRIZ>+D`4i*z^DavW0o1--kMkmHzARco;0+;S=P5J)6L=WchJv3!?)2Z*KdVAm<>~7 zZLanT7^rlMx^VZvQ{6X4o~2-ik&Jmb4svF+D08|}q*z&l24}8_$XtRjdIt5CiKT>$ zPtGeHUm>5Kk0S1j73|;+d_MZ!7l(+u;8s<3?j_x@9)+Mt!5(xbsrK$s7#@QuKcPXB zX|{|5r`56ja%ONNYu9nEq-5m_qfR~jnB_1+E1X$uH`f%HQaj3R#*(L}enT?)k!8!t zK7=!@Dv1<>HLW?jWOY>V<@qCp;p%vp>xnu}QZP=mmQlqYBWfUdhR}RbzID@0sH?_h z4wppxSa%5QeQy9U0MG&^21;b`Y27yoZTta}No4)jHlOw7FFb%QA@qxfipEu)gF45t z*H7%Xd-;a*W6Y@)>GqqI&TF!r!!8^%o)=}Y)l;4)+BQ{;-v!r>`GIKXsH%F~Nm2weU;6jBN zwiBdkQ)|EF?}!1$f$`hEfmM6X*Qn5m5=;2OPdcqBee-&4FMbJWlye9#J zwi;3TiRYmr!7yoknH(|iWNVv71KB1A#48-WZmE$E2NhG)*N!-HBi4jYC8Fv;fyr3+ zrvi2SMw6&bJ)%3{&CpC|=wgIFvkHphnh)EC49?s14Ta87Q=i z6__STN&b^=5GBC}BjQCq)5 z0p%dA)7Jxx6%W2J8oA_@TZ%EW62UhcuWgh?uiW}0 zffXJoIxm@Jn@Jl)PRI8uyI}Iy+9d-VB7t<&EObg_;M4+_2pI92Q4CUCTJ5K^lR*@K zD&Tx-l*mLarkh(VD0yviZ4h%)gc0g!zDHttu99naKuc)<2nEbEOd)aVIBRi|KLL%g;<>1y*xAuemDaw^460e4`}s zBlAhw2xp&fhvHYnQCD-RoBiL|17)8vCU?y%8_o5r@lHnfz(o;LBN1G~XBOFUU&@U7 z@5c4bZ%{2;pDS06wvL@7_oDhVDb!J4)Kg8?3FzT$_NwctDsuS^yr+jS9&)4{%#PM{ z?>67|ojXP5^v&p#yT-6qc2Wqhp%Ia?i?(VDjFv+J7OVm+B0(i4b^g# zJqI2T8~Rrs&&8$juS`K7g?{Uhy<#iA6KZHVXOtDuZs-|_8NAJIWU2}3Pc~!?GUj+@ zaY&7N`Sbg0SX34rStlHe|L!&4UXc?4+o)XK5q$f6zICKil=F9PR^#as^NoX|JnM2J zgf^8Xgq0IpVK7kC22{2if&RD++zbD6{moYxX+Se=eV)A&6WHQT41@?ijnH~SwkB~t z1}H)}6N=P|qhUDLlexyTK2`yL@5he!GpDB?PF?9E`G8?+E_*UeBCHXT=zCv;Ab zW6^jS$N9JYvJ(Qci$wyh5d#ifrWy^MpiX$GbfHE$7y(kN#Xt!ueH~=x*j@=Jasr$F zPg_ndNCvyf@6B!#&m`(SG)bxR8#Bo$F#F&^e^Gi?ZbSSwMmo9XTx098Ql*bJ3unJ@ zLq)dQWxiBr*l+#E!1vgYyJI-<+#=_a(wx65LUz5J@v4z$6~?~f^(h|7&Lpm1U>H-yf&g(VCJb*D=;ws)Ys$d9tE#{o-whs;VFG25}T-x z-(RU5(+@}bTlRNZP`~m}wYC$(KVb#B>_DV^hN@i~vatqTi2Zt0?3%U!gU>cvaOm2Y z^94cYHpyNe$M;oP5jQK7&zT(nsFyvcC0#=D@k2t64^FoB)-_4|k$_uKH{5IioZ;e@ zJkZno20Xg-Q)15-^^RBsUEw~sp_}3kNIw5cF8>I^EhPusBs$@qBdO)j?UEv&*PXnJ zc4UTJUteVrHwlEt1#8R0*+A&LQ7BZ1UfX;C?ZF3gpUW!%?F-Cr=1*0B82q_>21@pJ z?i3RCw-O<^1XecYb(vNkW{tB``tLCluchAp z)T#9*-3N;!zoLR#&x#!VA@5t1{KuGH`gpw*67j`{5Mf}VFya;kr-X2`Zq}|4q>}zJ zdy4=?yO{`bYQkalefw+(2N?3>H?t`u_|C2=SEBrOMwr6rY)Hb75r*s7$HxWB64Q@I zC6fIn46vO%eV(M@x&BJ%UN>aISX{Nuh|Z>d%_3^rTg7$kIV=nx##nEL6@>dUy-&8G zpeppc0pDF&KK0_UHn*(38iJ$gk%8zVeoGAmA%QN4>L{Yolu<;hhMm4Sa(SL+4>h8X z#aiZT`9B)w8(5FT zX|4fM`f3_f%$-JaOzuX=Vcj@tm7|$O&Crr5Tn<}MmM=}@G%&j$)uRyPOE(5>I->WUgji%ihz2=7sM!3ZlPy`8Un|hUwdCA=LxwdwbxBTbG6N5gTKZ*`CFGE@o1 zrfh2Bh>Lt4ytS6o3s{fi=;G$`^Giqf3tj%&alN0|Om51y>Cbt8-l}@zJ?E2JQpiqH zkPoPRlxzL6A0PLJzr&&6jcWg>stZ`>=5hK|omliZANe6~ zKgB=0um@7XM!XqyGZ<4eQQwQ?E4y)^Bh8Jq@v*NWZzUV4j|H8$BhdvP7kr!ec)y0N zoj2{t!^&%m_C>le&1dvX(*xW7St$MOQ?j43%do`o-_(1Qkeq#xEg(NSB3&^$!9|v- z1JhpEn%D7Hr2b@HoYu%t$R9O1W0tKZ5A;C2E&m7p=2q}&2e%Rj4e09f@X8MVDsesyU?C;uc?`>%|`_DA6y>YHdLw4q5&oGdA3Jql?Yi!R68s+bc;Y>24 z<_XM7{L(WxyI_bkH9bq#55||lP&9En12V9FB-YbEzd4svP)(3bUT^l`U@Y4fND+<9 z>W@$-M^PiEQZUO+qKqN>0(gLowlm%nvpVFjqhO+sqUU_Z0>d~LPJKtwUt8bZj@96z+mvI&f>`Yl_m_y(FG5 z+Ws#?ur68OyX=lq0R|5U3zNDg4xNgVZ~tfsu*pcKx6H3|*1o?wqH!X8`>K)l{Z-Ga1o-+|+QwscTz zXY8({;>OWpx`Itj=^tLd8!D`(>WsT-0Vh60GVzfPlGoZSnkVo13)B6=g|gTi)Dzp0 zg`vlBuM--O&Uysx`M)8I`FZ>e=pa(DZkagSrg0W1WNIwszB5XF9z!4M(Qfinu(T(P zqVqNTE2*4}Cyc60y-D!3rtn>9eUkQyv)+O+{OD1&_q;vYcN+|0Oz#B@V@SlD5=A?d zY!}6rhUeVTD=q?U@l4S}`TuU#*v1k5JW(APY;@kEAU^P_jN8Il16apyi9e4>%VjB% zch4nj-v0r{08*K78s_X<&h3?iHglm84$)r*Quf?*o<_ED?q3f>ay0_lK{fkjaBf4G z?O_NoPQeS5&Y$!dOr1Hu@JrZj|E(-&*t*D7(D(xz1MZMCw1n5GJEN}llKYcfno0cT z5BXrA0;FJ9D$;0Wj?4E#Ov58f-x>yF<7ND&$=yugwt9p)uoVyJo!0=yM!PolC|BZl zRAl`VMROfa9oU1A6B~xXSV7QXP-OEL-_o*yqv42n8t^m7V*g^8S2I`Ywy9i8`>tHZ z*OO@ZOXks~THqkuL{R2Cc~<0-q#j65MllA1bhe{|7K)eE3cir6Zc@_d2(3RM@%P3o zoU>3(kCVuopQ#V{iod$9z_O3lfD-5L1tV6$uMnDBFN3Z7S#ej?ERkq?&^fca7L$bN z=?@Cy4d)vf0Q|k&5z)_Em~85Ug&qfE%39}(yXvt=*Tthhp0fcSx>sr!cd16@e8?#e z4*gs=0UQo(ONKCihJ*26()SbNk50iX{2JIKx@6NQpLV%QZ$6E zSkwxL(CB?bm`@iF$b&`eI5#(x2ABQod1wj|K-rh}N9=K9 zn}9vMkQ1~rsp7{ueu{a>ln;Y>n{V@}t(tO&KhIp)J-=4$!g6ize&nLHKr)8KYxW|T z9zC(eSEkxL*tV71cB2EJmMVEtvIWG|wtyD>6inlp1KI`r0k#cKZ^ZAC7|C&qYUMMQ z;6EqzM4CtD%bX@h?|aU`+$$@nS&d?NKaVnzPwxC&6PdQac9GjkM zPOLL+`SurQ*yMRV&bZepn!h1`IKKzc*J18*@%0??k4&uohd0>DH$eY|<6!2L^a!sV zdus?Y?I^5Q7A~ODPfI&<0Tk^2H9B~3nZ$(5{xLdW1%^VXnGB`w@~h=FaYAim$cJk* zZinh*x9aHbulH;}X0R!Ht>zC*1vkP>kdb9o%yL@v;%Mg03PNIWOHG_ftp%`SnxrI; zqA=+FqI4h~G2W7N`y(4(H*-hpm;959TsQ9ez*A6BQxE9xt;OLl_5@R~O=Aqk-R)kI zk0KcVm&>3%W^-x)g39Mh)ARc65(+SjNAm0ewatnRaGUI=-K(@uC1=llzW<=+UQFha1=!y( z5bm@d=7S8JTCg(fP$1P<1b%!>L?s{+vr{U87aY!s?HHc%6L_08TDniITp6Hxb%ovH z!p(o(sl>sgi3ppTuO1Djrq$gOWgBK|&x2~x6COWwDKq4I(=Ub&qt{L0Z}Y(tnfll4 zV>!n49+;+wt&Bt$YWm=D-v6GD$G#o^x8~Oiyt;=ii&wtW9HSF3Sj6v2yY|bU&8{;S zx{3gd$-Sso{RUp*SsV<_)0kcU2kV#-v5#XfjX4L&g zH9VyKP`$(EiQ*nm{F*qZa>jVb<-rKHCm;=Rii_?JXQW#yUOeVVWsqrD#D_tON0cK- zR}=^&@AE@*G9viy$dOWlot%pisJsjrkNh4s$Y#>d{_z2DY|#e*qO?f2mgIQh9i#uZ zYhM{&n9Z5<7udjBiO0b22$=%(v13ofmp6WI43qDWf=1rwhZtzo7brc52Acl5pgnUY zU0Ll^tjM$hwdBf3)t3@__WT;}T;6l*#!ck&qcCDgfAXGm0IqW}=rDukAE{YA{J-$J z$A81?0Q4#{@w6d42TlbnnN!hO&L&6Mq+Ih;c!O4aU+Ir?{n{DtPQUnJkNi+HX&D#h zzvW3)3lA7A$9@v*<`H&}-gTHwv#xRmR)7bb2|$S-z$f67nlatC|M#AuzZ#|T2IrV3 zIb)BS@iga2njGKY8z{QOi!U;SyMU|!9#RHwYOd6o3!(3$Vo|Bdp+My> zbVD!?msC_m>jBYkJ{$;Ey7XV(k+%yi1d8Eo^S@ zi@nBjk$3L=WsJA7d#FS-Lzu(QpG!ptO|HC1v?TxV6UsQV!sisKZsi_=_~6L5a33n) zkUZvG<`wY74puDDGoQaIHDk;v%AQa!EUQZUoxxx z=ltp5Q$W-(#}S7*R2%AOuk$_riYVKp4BUS~4nFUY|Nfyli$TDs0v8+G^8J4iX1fu{ z-)sj%FX?Re7GksnFZ*!$FZpZ>4s3dITOd&H%$XC)M=n$=??+@L$>w|(PSHPk;P(Dr zg?>XNz{e>XLbW;N>H~D0;n%jKOEEpBrawU{l?5iuP=EpW1FuUg(fuOS0RNiVs78(p zLO8-L0xE(C#lQ6Wng24O{x7!9$@_v-T=t)uM5I3#)Ffs%r>?!auhpaN#kS-jyDut^ z6pI_4fPc?||ACkRo_F2YIETX86As2b-}=9W&^Q>z0|gy{CW*XfkzA&X(;t8Y zblWh#{AnPnj%J$Lo4F}n1VCT&j|FyelEy;>8HiH8V#{A4@5!{#d8pdmy6jS+g$ShY znchBf?4@*>Aj8K(@~yN*Gq1WK3LV*qe?ZXkZ!rLDj?61d zTj`Ha9|O`Ko5tpZFwS?fT#;Y7ZtRlh<~taENl|IP4P(75m~m~u92d&j+LtUZC!0uX zm6_+usW2|iZ3M3tAQ!mFr(9pMkx^ed_e1YC@r~vqt&8$Q$w-F=U+m3{h}%D0o~d&G zL!>+Ghr`kVkPe62$A|l=IAD+kGbyFdNwziqFpD{cizm@zF>zuofQzT)#m=}gO>rh$ zS`z-<0G|!FnhI<>I&5WK$-muB67{wORmoKJ@_p*2-GA_WdayfZw%YaPPP2GSl)(q# zsvuaT4b6&z$D@E*RMTS+0oChKE;D94N@6dK#!g*70{dB8hw2(aY&J#3vvs&@}QpY<+%>f_~@C+k00 zfk_!p=b)su{HxM4{1+$*RC*Yrr6zDo1pMvg+^qy8`G5d{Sv}4$e)*Pg^@LptMvIpv zQF*y>*KY5-oBrwI_q@VyKAlO0<+AxkCRwmu^&xgUvq_J>Pb#pBWs#xqq_R2S12;?D zKmgPgXak+p6`$Dn5D>6G7U0;B1;E_j!NIuQ#q9K(s3|+5N&=MqKDyju+1U_uVEhZX zEA8I9GL?3Mw14c<%TQ{W;)>K&%-q%<-E)ii++-a9iDdJ+5$wfG8{TXoyj_4cOBl8@vvd91k{D}A( zM5J1^3EDG>9yIkK4mQO@(a~aV$G*W<@GtrHRXgePKj?uI)y|ZBZgE+-1KS9sFUF20 z)tF3w&m;6YZ2134s(cm8t@R%}t;b{$mAAJzPGtO5L5N=|(+&k2on zbp~%#2|&m6!pGfm3;Z6wtDJrf<6El;wU^@B=k;?aVXyY81- z$!Z%ddD}O1jBij)t=Wmi{J}4Wjf0lAQrNHxEO=LapKsCG?g}o#AxA{sc~<%E`sZsa zXF}5#Tu;K3WUbO?&I&rR4JBuf@;4jQgu2y1?@AIRWbSn8y@~o5^F#t%ZSvv~<}357**rP}{9%p4^X8uzEqvq`DYXJe{Sn5^IRNrHJh_jjUiQz~ z=G=NSkp;aGgSViMana-(77grR78<^^9YFxB-!&w@VR?`8oI*2%7qLYuHWi7uQFoYA zjCJ&-(jmk|^?ceSUFKb#%qD?Jl&>yU%zdm%?`;Rz+gzYa%U+7dYE$0`%$BWgabLX) z2oHOM_TBR7x*T{dIA-A%!YTUZA9>1N?H+5F=Eg_f%^f0Mk^#l+J799Zt?=bFIsnw7 z2@FyFB?_9McSrhi-R2#4iQD4fS_SF$!JD_QWnS7Lk2lDIgS!$CV^$ZW4uGp8#9_9z zM>kpDcqn~$G9f%oA;^?{_h+3`;f? z&sCRd{|D7!C%w?q))=&7e`)a#N$b=wn&^TaxGLd^9!Ksi9ZLZG)%$hkh8^->GTpzu z&&`25J{XuGGS!)9CDW13hss0?wuZvW3!D< zmH--(C~ria%uYOtX?{AUpZ*9DL@9RTdNIu=ZSei5-%-o?W1Ma3?VD-&uD)`2W!9go-2nXK2AvpZhDmoc}ky z<i2u>~8_utczt0wz3wh6rYgsq?Q ztPhvgi;nx{ZE*l|mLiul5RjLc`kq4xJA+8rg{e_@KOP_Kc)H@bbVvz zbe#7sjdxu1f<`BW$X&rnZOkD#R)bU=%MKVIcr0tMZq;03IAM7#iQxaDojbMd+C^4v1SlW5EKRlBtiS{0+Mqx72{(i zQC)$R4kyHz%!28vMLrwmCA7YCfm=}Cz`fiFjNuB(nAL^XALjN@zu>Z=&h$g{ipvJ*sh=Y9g2>qt1h0GD4F1QS!8xh!<1zJgH%2~byL-mSGf zvK*t+S-8t-_nS=~@Le@{*ol0(XnG>k@R<4!>5WklW%`wbGCmDMsYr&&PMEDYMP#_p z1YA!^YY638)OR^lU-5}NU)2V)b1#wE42G6VLJ!!KrcHxeo%4Z8();f07i-wva+N0N zatrl4HaR1MNxSz~q*JYvm4D&eMU2-|tI_M!oixp#EFJa#ezC7>WPNgSa%Di0es}n< zF0WswbXc~A4oAh7Gw$E};FZxvJl*Pbr6#MN5xL&-vW=lW=xi93yo%^mL`8pt_S9DY zzE7VB5y_sn8?MyfvF>oDqD^@jJ285w2KSO8pE2$$nyFv75B7Qe*yUx*$q4Hm%*~hH ze&cpv2=^WGDYfQ~QP|J#EZy|3Rbs=1De!1b4j zmTbzZW@APoIc#OYO>J*0b59=q&(}|464k2%5HB>ePCR;L*D@U55fesJJ<%Thz}w99 zBA^gWpF3?Ir>oLsjhUGXYY{u#aQB^Jm{HrF>f(`to10;=Vxq$lVRZ^Us=69?RV0o) zT8`Qjo6o!e6?YevWoGU5>*+snsz$liep_aw*wkuY6K*|?Qt@;7t0MQsuHmk5*d{r; z=dkRu?CaFny?(!;N3Mv|=j85tYvnS>To_nQ`U;L7&o`~rA)Twcg z-y?cAboM*3gK=22DPqrJzdrfB)Mnu;uaxyO*t9&KG-VSgqiZ(2xYx{WEUixXLh7X& zZMmPFZOv$Wb^69@h8)3rJ51#Kw)+(~;R zS>JrG;irK&bi*o42u4jXGlIE?#07tf-?nY9kj@niV{lJ#x(Uy<|NbBs?7ODWg_2VV z7d_NzDXIL$`g-gkr4u79D>d^iyw_4Lf4y{EHR=`j$IWjZXTlFRKX6Z%e{M8$?acJf zd|X6?uUS)fXWo84^mazv`patVGw0}o1ev)O@BHgScID92yZS<>; zF5K0yq8@T$ic5-nc_kQg1G|S(^m0m8Tn=?%`GhXR_-cZil~=qx!m9WdRTlB^xXH})H^qdo zRc$B{vfDvLaynqy2zg<=G$8S+$ED=S9VQV*6Cnqu)LS%8LWfn7J0$!HE|o@otOy66 z$nM1TpBPv3)fW)54fFIFfQ_G9Fj z;8=0%W4SDQ=4+^5O3j@euuFurYz@}EuWFW~xq{4=*U7ZNFRS*-1ItFHGX8KChJ9nF zI##6KyTRTk?(qE^lL-<3f8SF(mcG&x*cV(~!-Gb`cbJBmMqjo7m^DLeupWRfB$Tnw?^Lda$s?kcmIvV+q9n}N~yi{44V zzND5H!H^C#QP?G)C4n7in!TGg9d`2v<(cHHRy1H>Va8hC^is+a&C-3ITwAmin|@*_ zk7&Y=tKU=hIJ9vGFel~7B_l8cmM*I{+XYT^hVPMU!kL3g($Qya zd6(7aEWfzCNBnFcUkvL>9GUEP6qm9PpA59Qj+u}!d-mkTmHVko4_@2_eU+P=ALa}d zpClq2yI2C4fpyel4WIDkqS0VgTAg0LcVbG*~|9i{^d$Jp} zHie{R1ZDcFoM)ov!5g49|Kf!gF)(>0DPr^6aPisEk~mhur#Y1)vyU^WN)w%>*~!(~ zAM3Vt@abc@5u;3a=koX-^1GW`i@`?^%}(y54Z>&=+`2pN>pU5i8FWIo;Y#+WeUp7a z3hek*n)tDT7VlJZllq9)-dkU#>#2=$asvL2PlB2MEzxhDJT1@U?Gn~O-jR{7slYm< zsZlB{a{W@6AN}Zju(tw`4?CH^48_8hzR{saZ@N>WMSlzuqpZ3xtnu&v)%Z2N#mt7hZB+JtE!~?dGcv{2|MvL}#GrRfRzbsXd}YrIR8!E=7gxOs`?!%So>(8(Y?I$+*?n9j z90=_RlQ7tE)Sdb?^w&97OQDRSZvy4It#TOmo+f?Wc=k+hP?)kG{Ofs>v-Uf_Eq=j%tXW zn8BV0G&vn1UwMWHcmV{*hEGIXpG$1Bn7wQ*6?WydokMT}cD?$(@lQq`w~?2m6YEzeV(X6m@w+zXs9!V6GjZjws6Z=f#^a_Lm%2Fo97(X^3)W0%PvJ8;N zvd|-b0wvyhrjw;Be^rpf+p|oRs&w>vOZ*=JcR*Fn4)BMnkeI0t(I%l1qMzallIti?gB2iT-*;`l3l`0yj~R1y*8ZYb`ZN4 z2EC}W_hoAimt|(2%0vu@0BL2mPdjpXqk(s^Y5Rc0Nh?r6Fd;;@Kkm>@INU{OUN@WF z(c0#F#s#9EJCG%a*Fo*cz)eQ$r2qvrJ$dKzT0t@(C*mr_DvxH@rDl(hYdqUBK2b3T!%7R? z`xL?4s6Ym=iSeKN}r`4^u4~=@j=GDsTsPY1i{t-BPu|O`* zw%DP;6e~lFzQcLX6BGdeIBJ0_;V%sLP_MzcBH6bz&cy_cNE^}yjsQKs=FlHtz! zAJfJ*CAcJ1Yxn$pq=b$Nh=!&jMUW~rp+o4+0tg5w zAynyv4x#sQXWVD+bI!NV{Ww4G9b+>FWRa|7tvTmgp67YrnV0u9l+Tedkr5COoKv}b zN1K4)tQP?Ru>k35@JueWJBqMl)go>LmBl!Dm9I4pti|lV1h;KDT^6^yC>E3C4UI4#lKv>M_N!K(&PfpfW zZBWGPqJ6W^AL~1_KRt4MGd^c$QgF!_^Xj;*FHpPs%Ay|5D5f*{L!icy;ZCj(641OD`x1p6I(N zPRJ0v&>nI0NxlnzNNi*g&;BJWQ^GV7nJEE@-2Un}VPSBgf-p7X)A$QC;r%)aZyz~v z7Wnj5lKQ<{R2B-PwlDu~OQ-c>7yQCLCXAUUaOVI!ko{ zd3*6yA}upwg;D?2M>xY8)jf-h-9&{;pXpEUwr&<5h`2ro|J3l?RhV6Ue-;Iy^zEnH zSnDsR+82UQu977O<0eJzewT#t;)&Wru;Zr!G8HzmIxgo(WFJ*?yILp7e;yWwuk5_uYcQO#i}; z;z(Re%4L6L;$Gb!YQ^lboKc;@<|J}S{8Lil>C%!?lEmzX^xv(AJ+VJv#S z?n+e9NWJrn-~tiHtxI=_q91NCK1vGv=zg7=30WoF_xWhcG9zH93popg_QU%NPju|kbUGX!Nuoa*j4V5y@@2H zI(viJ@WopW>$_J<7;_c3I6_}VfA!9wu8NSks1;B$bJ5v3#dEFA1L0we4g$) z`=SH%u^jxOL@8mMwe zh@Y{13~J;GznVdvMGZfT4R#6+3P!IO&U4jrUVJHahc}(sk1qPfyDx@cGQVtoIX!XK z;_9l9>ytYibFUZgnq}O*82VP3hby0RiG$^;>1B^-xoh0KjJ%TEr+BXLo{b@kX^ZjX zVbQ5h-%y(qHcWE7wZ*Rd#(V1B6m}|qif--7WAR;K#UKmC)$}h~H@L~K(Z2O*gSN@G zFsZ6EcGgeV{IFzL*|wRtY&?OwKXi*B4|COYU+3`Y3=}-RjV*6u=83Ua+05k9 zS&cKg`o&;_R(N$wjjUtx!a$$EZX5xSqY9*7?|Z zK99&flTDsYg?Vwz84)`sOA!vy$0D)zi#-yBKR&2*m-SG5pMugsoqxz=?#4g=@y(8p zDX#ogd5mX5Z@ywrNwPuBo|cz4J@wpk>`V1Z1KcdvAFU5edrZUlzS2>IQG}uBZ23owjSRVr1WFuB7K^)47RIy& z7{lSxETeq`&C-J6dK-nZhy7Lqc@HrrF~Cp9mm?O|7iW7A1Nojm-r#fvV2mnrN&aEB{-b>68gq8 zDmtIKFSl)O&|tp5v3R{%EXp72IP(oQGUnGFGJSEmJGT=}pi3&HZ!Y*XeF zqg1Jk7ufDIuCRX>xh`8IP$d8Lik;r~mk(|~vRi2zOLSBai!*IsrgSBLN8L?_xX8q8 z#JG3uo0!_A-iwjXLxT&+8t5NVT@JT{le}L13VFT#Aul~kktLE#Nm)@}Q9go^T3CA8 zk&oX~b+NM_<{IGIKDpd%+;VTin7Zd87grBgt>%U%-@Qd9d7p##tMt(u(IhGztr=6n zQ%9Ii=lQvTk$D(}4om2Fk?n32TsXszTQS09|^IaPQgNLbva zz6<_sFj+J{DSr6Xhquvh-0tRZf4f+&E}9@^X`lU7LzizpVOq$kqb$HR$IDpYjWl>Zc!0^zsmR3sbQugOAR$uBlQ7pK^h8k ztVPNtGrJ>i>%_N0mK}z>`pp9yCvI-u8vOW1DZ|yqGEhfJN8e4`Z6@uNLOy>o{~1c@ zOCteartV_2mOivcX+_eqFw2-d@*4}Dy))Xn5glcmT{a>sdenm|pDm9>r)75~ot1H$ z=UZP~bu*iZe7`LbI7>8n8?D$E7O^C-bS4nCd-x#KL3#2@#l4QWVZjRb$OReCrkS=@ zHt|BT#GH^qOoad3lfEIsR4&4sLHojOB)dnN zHZT0TcofFuAMUbh*%T1;d_LZumD_>2Q9qG29^WFLN2-&s!^v*Gmj>vC#aY2ubf8|_ z{!S%jKh3VF=vCSS=4hN`;Me^b;a3Q$pp>p-BASPOp2H!Jn*gJLTN|j@sH+q3fMZeu z5<(_|Q{adY{K^qB|9PxLc#VMg*YiXK1ffs@l7F0|0Uq%`ufQ+M##Mwu84c!O`=&s;@ z301UzTLGWn2h}xjH&9oTvUG70cxdHfVJ+b0^a%es1TtPy;Lyq1{UN)TlcTenl$R{W zuQQ~;G5%>m4)$NCxI4&l7^vT8S8#c3%`PTzUEn&092q-1yUb%N8!7EOO8+`loY&vL-588esBiAo42$3Loa@3H_qQbf+3f|J;WbE*|c(931!y{rU6zeOh}#|9K^6w|@)^3{VjNilC6db-_PB8@yEp z|E$z~sF$^);T@~$S%z*fq;+?#Htws1LUJGJ! zJ&~>Fdqy9c>5Lb-n%`Kc^~^3L#_wdtTSTN6)A#h>cQp8TjY;vsz57(mopv)xKfjhfhO+M?^^^wM@&& z3>Qv3_xI1cK}aY_N%UWy%%pp>5qZlc{2|qUbvHL}Hnt1@H@6MWd3u`m!ixQOW=n$; zhWN+lU07M8`0pm=X6mg|U{W@k8R-7Yagx-^5dW9AVRxU9u<&%9&~wHAVtMfQPAJ%Q z@;d%L$iJuikH!Ae-2R^KzZlQo*8P{L_;)b*Yrgn9nEXE<11<;n)~V2rOsPe z`#8a)*AUI@Qv147ZhvuOu zBG|OyVsE~2_5N~A=>vUi#Zjwfz?*{lz4^9|Ugn$Z&lLBUD$EBh!uY#6!uZ}yh~F=a zU=|lR$0{RX8nBC<+nq@%gys12lRDO}HqTK8?kEVallm;xu6NEg(VIJ_ovAr{QrdqS zdEvs!JSm2IcK!GWcii1;>>_(gRz!9)OtAj0!gC50dXq;V)o7o*Z0s6zC>*AlOhjFu z!yxrB{$d);PqDGa0*A}6hIWL9`Z6g;zt=aRmW=Vwp_ZD!J3<{?>nI| zdfbRKC|d79tf7s{OcKltzW+lTRnQwLLKG3o;%Sf|;cDTa`ED*M(W!i(8?7mCiXLwl zY)}JB?9*}RdD7Gn60uxmAH%qoM`PTSPuE)9bg5lc8g%QDMGv_&$Qn*2nrZl~wO&PE za{H#`R!MxC;x4CBcurNI&4BC159Ms9isAD4z6fs0DA}!k#Qvb=WJUdEK26%^WLe*G zWtjRNgXCkYLDv?R1r6K5so>n&i{qb>1=Tzr%Rj5;V>IPdVKCsdYx==T+vqQ9pp zgbj-sMnakNO+7GNLwP6Py^iwDMu&Nciaj0{mKFHZa9}x3C9PcNm;<1qdP&4CRoGY> z^by3tJn+!N2+XFBcC}gVmPo zTS2EGL)OeEV%zT@iHOWtD1P=X8HxK+Z!KHrJUT+Ng_>(wq z%Oy9pVV>KV&UeY>iZLZ_osw5Oq;a*}2v7fAY}{NMZ=sqNi%Q~e*ZGOeghVH)HDzAg zr1)=DS6p5m0LJ*<%x|^HvHH`G56aoJdIpy_mxra1o#o$dwD-u$djs#cwEi8Y$+lBTVa*8`8V$W(YDD-&hYuVw}P@lBb^L~25N;~SS z8t*UHYx)Mfgi@`*34Uxh93NJjPu6XZ+&gpW(M_N65PEyoz6zI7cW{(dHJyN*7Al@R zSntxLH+9zf}rv19moq3N57_SjD zGsb?49`k7nMCpY6?54=yZv_46ljzAoat~O;rhnGn$QGGbQzPC3-8)44dh(|{z#3

    SRlHpP8={LYZu`$#88?lGFK?$gYU_m_I~TpV!w!`<H z!i+pn!V}OU>7iu8!X1065vJ=8Zg#lr0z0(P8K-i-WfFSE!YCN;!B3@@)W1_um?@RWFAW@RfY!nCrKUQfGE5(}J(4S+n7TQm?Wu zeHfW~oXKOAy|s2h-kRL1`t?rfzP!N=U{cv=4e9*pDvYON-Dd9`KI4C45;|u?k_YD} zy2R$Ua;qAgi#|nf^2!4Kam!BV-1rY=wxm}FdCNY~}9S)^@#+cl$3CHeWhVExoO9GVX!5s#gm z#7Dd=ZFHAvuNzs%KoCoas{A?}jKLhZHFt87olySNjds3he*JywE=}tdZX$E>VRs#y zJ~MyXLjP`+tC?OS2vnj=z2yEmy=8}v8jjAF7iP7TSz_wKIDSG74)5d$-u9w;8{Rm_ zU-47h`<-5)aw>1uak#Avf}SpA=|D=b;o$L>8K1^6V?(h~*RUyUIOb?2RK85&`Hq?I zVzKfdaA!1_z0t)aI+iIM3Iu0s97=k*(h?D(V0=Jy{)EW<^!cx~Hb##S7Lpp9dShcm z8?duKKA^>h9MM+C4Pb$7ZlxbQX&0#BL-NsF4kz`7I5-qk+0aQL$_1OyO!CfQvdBl~jVV@A6|4Jkovu~fT{DSkg z8a}!*Nqaixf1Y<94Lm+XKMZAwod)w&-2z!Y*qMwfT^UTh6~qIxUZA>YzXU5Byak;E zG1tUFA6YKH{nJep*`|2EK)=u|e?HsmJ6EFP8x2Y9+lj2TwMy4XZIU4)wA6fn@(ZC) zZ*{skWEi@1eYYT&x>P9PLkSWFrI|* z#+}YHY<`b?Rz9A|o?58b{TW$5y2RLK-&GI4&jNBmo1gD;mF?<{e51%m`Ujm0bv0{| z9J(G&wE9*t#OqG^hvBMFDw4XbL5HinW3)QgM?g697!A#5Z2wFt|NgwpN@MS(d4|8R z(|=FY@n`Yk)M8cztdY0gtd4t?<1W?HJPRcK3LHwx`9Ql6LhjW>W2>0TY#-Gl}F3o7T!pAp!Gq1E$RckjdlkVZ`c>5yR0_Hw=?riyxa}8IV zQ}C0%!|l1nDL92rVa{x$X0H4Ji#NxyFd|#n?^x-Cvnfm#>Vr|A1spZPa5>-9X^C@{9RPP6Y zcXWS!&52Bwzd~3DM#IlvvsePzPkJB0A0dhp&Z=`<=!w~_Ldk`K+;U!W>ebq^5~-JB zNXa?zpG7iRM&$V5Bn1*#_s;61153BSPUNJ4n(IKZ2GVM?+UjX(gqY02nKRQ1G z6Ka8IXgFMQ5pA$0$tWKU*yq|G5*|Z!tMXh*S|4;{0*G`26A2YmR*mu$qkj&Uh$yR_eka${}pj{k zlw5V~NcU~y_ZEoek3nZ_P4Or!*JZSx-@_bs{8rZ*9*Ix#8+atVEDD##qs|SG-m-Ff zXmm6+-b)l$`od$gdk-URt!BTc>4^019JR0o`fb&s^v#?iv!=kC`;ZFk2DS$5}WeJFwH>XJHeH!|Yh%K7iP zPxbu}|99*EOQ2Q@1+e6tCwfqN4Ab57f>Lhhfz-}eP~x?+D`TP{lW%+?7qq(kT#?T3 zx28bAPp*YNN`I!S_Ef(RWK82<)VX3bz?W|71(~AqCD%KE;MHmCvLpK}5}NVJb>MO| z^$NUL+3thcgWsMRX<5&t93R;3CI~4SlelaFv#x#`)o_3noCAcDHziJxuX;9puApWa z;X5p`RW*}*?-!f|yelb*>EUYyN?8%4l^$~M{v`&&T#(IfNZZ!$PCHz@v5P4Th@mrf zEOs=gf$U7}x)rcS5 zmVV|6Ft@E(FJQbfNDV!Qu|D%a|5EO|oOU#Xsdh^P`f|@BDZKmvk{&3_rV`(c`0S8+1F}_DuV#-oo%-0*Y1=CI`fA9!SrjIcSev!VWiOQXTwhym#Yo^u;rD>U zz092J`n(tP*V}srs6KwigQ|f*kMr%G>d1W-dY3|c0LD-O0Csi@H!6>;j!o0wT^|}f z5+i>C8HjO$Lm8r^=5x4eDnMGL!L|ADBj%gRVmFQM;c_G@j2d}~Vq|@{@&-L*f>s^- z92#~zT)HbjtVM)=5y=<@0uFMy^z{i`%tixWys5$ITwH-8M0g7-E%ty|rHw*Bu=@TJ zFRzwBzwlI4(5wvFBlGbgjYrd=oRzQuNCT*Wt^NxT=X9dZ{$fkyvY>M~fxg;HJtUAt zETIjDTMi{P`M@Ebc>r=CGWVf!ZIbO+!qlxpv`JkwZsAn9Gl&u!L2L)9e$K&24l4+< z>8+pt-bOB}rgh5)&DtD)USjMCS4&G<8HHEVrlk*nf3-If1%!HskeCDxL0q8GFz#Sa z_+BH@C{;-Ot9*^;Qo_V;9;9gjgbX!25)Sa%V!T{$k6Bp@GNNXUu(V8QPE!c&_0wz; z!VsAepE>_6>s|O^4F8DJYMnU{-r7vDn_fqFWc9W$jC?in1+4T$*8LbvpGo>HIiM#r zx!VGIpcwr_sfd?HQ_&!epC4hXcp<$61K>-Ur9)n^5|+E8*LQP1hJ!>4i4uGAI>p>Y zEyZt5#mFHawWd(oRerh_k7E;_hUK`^joMCpd8uBYn5GkZ2@Cy-w08N95@93W>*_iOjF?_P$x;wq zJ7v|QyKxDOL}shW@KJRKBi($22M!7OQhj{1uT$YXZ0|Xo@W3$O@x6wR_JoB#4Xd-_ z$#tb&a?&7gLh=J#rY2Wa{!_;P*PO-!;2e)))~XM1!7Zi{JVSIJ@t%P!6_~}_11bz1 za;nJpF>{?1s9Agyu-k4ZgU~^@A#J5ldn--t`C|X@C*T>N@T&Qk$I#G06b1qWptQU5a zGiwANpwPg4WAPNxZ`~?TX-ClS!$qTF;Dt$14{b=j@VuUT*%r)3R~SMMV+2B!Ze;?< zKS-8j3n@&zPdO@IIf``-sHpkgUf@-=LIyNndC$bKh{cx|jtK)m84_-)fpGrssEClr z2~WC^24~phML~?0VE9F_wFSp$Z-qx|Naapf?MB9H3uWo$VfHo`;y5aQ4B}aaH74Gk zg)I#MQdnLs-l;%B7t1ec

    =+ozQf4SMvM>I+lo<=-&$jY9q)GHb$B0HrAdP!#UO z^c$b#Q9LrVUAg6#FzxAY^#3_*)Rrj~7tjb?=Z7j>I?+?5Mvcf3>G`?rlmcVgLY0}( zJPKwpK99NX%)tVLj!5& zq1q1yav)pc`9|p&MD4O35<{+O;yGaL!RvP5JPvN1VR@?|v--uT zMn{*z_h@&feSe5)rFtgWw>v#dz(}s)16}>m-U8RH60pMJ9>6N*v4~T~2v&(x%*>Kw zkX@9`JL}l8)n?}GB-n@~xqnkxMn3f6NVaAQUJ+RvN6!b$5XS>&$oJO|ZXG?^swe}I z7AvDJhdeybkzs^X%*-Q=FVB?S_^tp2*Dv%@MUk0-4)N{6z(WVTNQYTBDis>}EF_C% zw0-|eYw3MI@!#?tm~Nv3aPhfs!d+?rmqNluD`kNoMZ}EB(shL1$A>UHXt!te?9o!r ztijdS)HZj|qB4KPqa~a%x*P=P$V;jT$wX!`7pUIA*~gh2^0cau z13qf4ULQ}2~P2;D6bJfTx62ZSz*7%wvGL9--6 z9@Z5Ovl14P3)WtD0>K|5sAJfKn7>8K47?auofZKkNkM$}z?Kd&tuWoNx@+|4Hh9*{7B`jvN}F|k?2u&1#R@P+mneSu)8 z@gTtY@9~7%Cfg5)+=iGGzZQV6-^3a_SNWk@X8>`3wYRl2WM%AIsMbYW3#a3kWsA9- z1d!Xh5V;rjVzeA^mtUA}rZXwgbFIUOM3!@9AeN5yWBLsPl-};5t~6J96K>}#XO!AP zVMBoZ(ncC)4-V5Ou@XIDiP>KP(2KozZf!uj(E;Qm4XTUtUwgsok{TS$D$64zzbTxT z{0*6|yZ!{uqLl^(#IB%!ZxqwUqvCYV%hYEs6JLZlbO{Z~1pZv0at&GJ0H+tM-|iax~29zwtxFZ)e31rJe#XuO@um0Yxh1Ts@bC9scFY zcu>gYUoJYf2_&R!yiN_hI+|ApQX3RdBV={qVDs{DO*V)Y6@vwi#ty`0P3Nam0*}go zl4XO-!{{0F19gBO<;m0nkl^*rIdpb^lJyBQ5#Rbty&#O&0wKK_eqS%Yw-?&;{5(rS zwdax%ss@aSV{;yZY^?{`y%U%hUV0aw<20Z9+SnvH^FG@1r)$fBc8455tFs$jfk&kS zTlUNxcOL`vr8g9Fnv(TB#~q!4EYHRTQ1d7-9G(Tl;x5QIZrBUPb*#5)HIk$tvT{5{ zc#MGc|M!XT81>)I1WYjldNl+^x{fOM83(1QKC8XX+u{QgQy@?8zt|)dUj~4}@Ox2a zk-l07lTO*m`1_ZCOX7ztq-YrIZI3!j&DE0^5Ag=uGxFaSG#u@$N~j|DP)HnU@W8As@><_B>T+gCZKa<4>!<;n@L>sxy2VD zW#^@4QxU$(;S8@&Q!v~g5pU-!#mh#SJ9(IN1Vpz2(Fa&nISsn^S9$RvUgy~xrwr_O zG_QNo2cl9!uZdfS&5T;>^OU2FY$&K%<_sw64#KYwe|bsmz^YTld0R@0s$is)PUl84 zsI_BtvN4C9XTEDUB2f(yvxRkga44B&^(TA&tj;{o(Lqb8zDhF?s)Um4f1-VWMCy4D zPps<{x`C!LNf+1`10a7Teatoj6|W)M+}kZuy}9=yKofx4>aw#6Zn)F zrT|KTmgGOS{-H>(4hXk?M`}MX@u58J{uq6;cRt(8rUMY~L!bw@XVHgu8Rcgdr?_{k z%z@Af_4KK82wmbq=5;T==N`Ba(>pQJp+%=u132meOYG9ZK&kCsyZO%eUZ@zO#R?dq1r?XdSLXF+3>h|zy`6<=MucY%Bd%!fT;i^tl z8pz&AnYFL(Ah$z?FjmIazsFIaEO|#;!g*I^k^y*cQtya0uHFI+Hkm^v`=p-3r=aL> zUo`VTiR@QeH}pd4WNV1Va87L^%?}ZVqRBwLkxp`LW;86yoo>x!5puH7^+PxUImjMb z{iU)Q0Pr{XMvJy~pu4w8082yz;&0>;=(q?3%2IApypWeYdN3_6+VzqJUyPxPMN)9{ zgQ(4okj0Q^`L8z7L-AEzDz98eEesD&FvcE(_<)frM-8!ovIWg{MdlWOI~jOIU3T>g zHNK$%6jHg3f~)p6=A!W^zYJu?44*FjOY+V?D;?)s3M8hO>K&O3RU&X z6(zMq1|5!q>Ujh-gjVk>;s!)oZj`R2k4#7L6*oc))x(ju0Z5M3!+cU$Qy~AT_wym$ zTcB9t4kWL>xt92=9t? z1Z3IO+-GwhvR<<43~vhtp3YW!-5{9vgX$5H2;XknRBa9JB*^;dTxEF`c~r!D8YA6=}?KSqmba0Yq>-RGES*DCifRLU8Z^i2QC zXaAF|{}m+t$1hLszNaEK8?J$M-PYO65^&@Vtg|=x(Km&UNO&}R2%r$W$rB1jkQ#Je z6)!IhAK~-8d#B_~k8Bpdv@uzXqPZ3$PnOzy%ScJ1VGm!R7tU*|=~R5Vc&}`)+DUdL zLVV;dK6hbqxx@ScXZ7!Y7>c2Aq-}{4>?8L=DVw7$8+jc&W!As(&BjQhHiff{!&U83 zM4|X~i})k%+bv+{S>*wG^2C)cpIZ9uf2XQX=WhQJ@X_H6D`XQO8;h8NIx;jZgf78i z6)+KL7J$X@O;w12zPI3x(WJ&rBF~nzS{L5xXsF<&+Kys6m?P**F_hrX3V8p9ZoD9f zQcfcAQ$c3H-Zn19v@~;a?QjW{nCd5_n|og3m8TJp8vjTpQJ!-Q*V*wRUjDor(0Jna zZUivrLpQ--j^1vG)`7XLVe_7PJ(u$#65b>R!n!ZN6Ieg)th-JQjl2RhxEDs~f^sN( zW)SC3{HqxMLKI4~h59c-`@i+tG=^Ws8|AjE(mAhFZn|N6=#-{o2I@BEP*2ud&xwlZ5q9ME4vj{V;EyTo5O1^}t1Z#Xy zv~w?RqCv?r_UCH2)T(A$BVi)%QrPV98Meu9~QllfJO zC^SxR&V%7b<^Y0Q_^w3>Q~?YbuZh=qh!bK<*C`b*6XQ!(+PaYlkE982d`Sz$HDot1 zoSu2y2%rUi6o9o@OHI7s)COb=q@|>_4v4&^R5P#@S#rLno={MzEqaV^G&8I7L3s_6 zHYlbp0yOLfy!yM9sVBfr8uI%CUERRWb+!*c4;hv|ELBan8=eX==80FlIh`42)>aSm zJ2pspBZk6lgXotW03ua3kU?^tn<@cQTTRN&D8zSp@q?}=$Q&!Mq7Bg0P%%)y<)i<_ z*BYqOF1>+{44^VS=vdl;SVoo$C8y+=RV0H(L_0Tv3n`&K1$ zw`Glloh;NOnJzbZW%C0e81o$CIE1HX_+F30X$!*>g&`CG)b_3Yau5=H(cBSUPioCq z{N>`@WR!g8CpF9Fa20$*0DMf*uN-Cixb;e|W{Mm{Gx7Sv+wg^Ql;V{_3Bl%Sd^aS> zh4SRoiUe0~vunz3>f-w%hX$R(TDk!7z%D4+UCF8n=Vq|n`xtNGJoWW8_a{jz3uqJ_ z?H7*w)T5%GcyJBJ0dOHd(CG%DuZDL3iUS4eU&rzSD9v|+VAhY| z7N6WNw>6Jm5U+br-_;9BNV;y7;-h|UdmkwS?z;tIBfXqGL6lqc2VGeei?UR>_oSiC z!psc=_~Ivd0VLTW=>!}}s!M%g1(9Vj%q{?i73{osR_Jp`(j$y$+8Z2sk6YQg&u~STXdg_T1a~6;q`pVwG zhCQiYK=%Xoheoq<=Bah|JeCGgpnC!Ys_x^%(PNBkv&Qe&^x6cC9LwySB%Yualu@%> z%?o0;{y?#i)5LRT=XkuN=1A7d57-6OrY4P;r@mWI;b`_Y|PS8^hi+ zN%{5PK$989!a79{Hhq(bBm!zukN=PY#-}B%y#;ExsZ*2XSW(*066Hx{m5G0V*aQ@aHR_ zB@f@>#1G^sJNTaKjgzinrwQ(VtEZ<=ger%21>Z0A%ikaqRY29qZtXXDOYk(8^Lv%s zj61#&63Azqc#m_co&{Mt5szy&!psji)In`qeMTz&B(M3ys2e_?!V^o82aQiQfa;J% z>Ro%V);dcip!fHqRan~VO-ak7tL8UMJif5R<*9rn#2 zycRJVA;fo*bNpjiV7gELm$&ivbpNr~f6n{g)BUGW|9SAYb^paz{|+X935|aTlfQ$> zf01|o4krH(2b1g6=Fk85E`ST{f1{MYc=X?(@K03m=fU3?{4XB;|2YO>a)$y@%fu47R@I`Pi&h0(tF*TY=|;pFtX< zGCMkJBlsO=dnv=P_C25DAj)oa@nMst$D$RRpntcgbOt_f^f3shX=&z$xh`xeTg z@%p7xdY^GV!MFCYELEA{NG-v_N+ z?>JuQIuf5=e1EhR7uJ@jalERDKGjfHRO_5p-e}}d07{=`oYG?*6(g!Z1vAD3RSbD1 zmVM<2v)X6%Jy@mba~`WoLbvAbO6>Ill&YJ+~I z>c$?u>w>kfSh-Kt@euRmOL=oi+9{ot1P$+-pTJg|y^Y~VTveZ)juYgicF)XBu_eDv z+F5kt1Y6~te`ZAI+@z(gO@C&l8!=yepgI?%jk%g{{WPS;;~vm@O+6pf#tGCOMq_CS1%WgtBN%z*f0b8mDuaTn zNASGvvRf6aY&Tcp0Sr<35$xniufC7!1;W>cd<`xZzxmb?M#9EHpfx}Tdb7(05y*^P zdIR>3Uf{=g*$>FnNy)o?4c#@6XO<2d^D%U0UgLR*%B=n(9bnTN6m0qA4H2c&ERBmD z^*ufmLD29a=*!|k5ne}k8ER28{Uy86Q=H$_7 z()E(nHxc45p1L?7isOe|4V#zsHg*l6Em`?WL@p3Nea-)P`<|tb@6Sq_m~YLI{=)Kk z2a=^{YVkgKxY-rhCi9#!kc-80=k=U^gOs#WkIUybhZpfhmwTY~nTy4LadmFBCFNQT zE&cSh;TD~Mjn8F6&cxkBnYPeaZ4YF;p39E#u`2!HZs8ngrQ~N#j+8j?of``}|E>IR zY2sct`t$SbXblMgP@zv45cZg$)X)fvN$wbi4T(zI+|5<({n2u%FC)qi`}E^>256t+ zHI`jm`Oy8nh4o(GVS9=;PPF%HIm=qzXEf-Li9TA{C%@PA13pm979eq17JNIy+!yM= z_~zK=cNL%OVRxlAUIn4k!#umP%)^(2PEE!O721TFzz)yNeKUU_!%tbiUC@Ja=yOzU zMD>{p4(T0~f|6&3aKP4N*&J8m+sH&|MJxhe*#`A>sidRm6fttqrmC39WwX7AO9B09 z+{;=Ay(5hBa>K6sNpqFd8uoe}2(Kk2b2Dpf4BBTw9Rc40J8UxpM?CbSFXN;h#L?hh zTI~0gc4eh0u<<&p?&G$TXg>DY^&LzO;#JPr?NEIaTd)~L6?_{2Y?^i-v~y?DKq$fP zXahMhI>f2k^fv}19YE?l>OS1pn>*Yx^9lH}4&C4_6p<9ygQtPb$;|JY+g&(c66weC_QaWnTl+}tpMBEI`v9$qo>h=Fu-4AZN) z#blk2K-jMOPaac&KavHGn$>MZqfO1 zCtpZ=jp{Wi1sfmMSYRXX%mNQ1xQ0CY18QiFQ`wf%xwsjaj zvPsN8mfkeN5`KP8si`TmY8Bn#u(g~7J_T0J|ICt?ufY$#a%+TROcX&gl2A%x-=BUw zjV~&G~mUBABw@iy>2tk-^In{DdZ-aE>CtXI|LJ(IGL z_?0sJL06E%@;y`4v{w5iaD5GF%6?hJz$U#*+ib@hGur)&scWL}7R75$Scs2$#pOcM zX6$$!DXXdHE-ki@-e!Lp%or=~bqJl&b>D(f!Bf(Obz9YIu0rRQoNLa1?d1&iY8ox% z!-X|I4E|!j3snB0Ieb1_MN)Xxi9EJ~-*iB2sc~2C^iM{K4?rlq6fZoE5cLuD*2JD^ zaaoL%UjFv%>2CQ>_yVqEz0>ejVWq5jLpar^nB&L-tRx=TY35q_w4oj9F-hAzNHs z+runm;jXd`&8YP|?M(#0)2+FvQ$m# z1u0{v7k({TXT+$MZeQCdvKTj)9h!MH#fL|pk31cGfsKZG0Tr(2Wu~pm(I;W*u1}kp zQ140aHsjzT5LoutaKDu|tat9vT&^IEz&e@a!iPb>^WbkidP~Ff4Rbr{iXlyQO^@{R z^fgi#w^IC%42}GXn-X+QYnJyG(4ecAE!*x-X!D;BzN>1f%V!oF%)Py| zSa@%fN24vOD?uL2_p`T7MVLeF>vL|>@Mn=Qdu@thEqRH}w4Tml!Dh}wst5g^iB4@0 z^X5pFL}zAq-`$@U@u@dVetZx)oXQHByIRO3aozu5_3A(sXoYmmoTIaBYdD)(jOG6% z;k&#lKVVO%#tT8VW}j^*A|G-zEtnNKcxRiSCTeg=UzZSWe-mv9EO(;b&w%tPO+%MH zb%SaPYoLW>rGDNRZA+a#S#y4s=jhszWt6Pc;o{ZoxSD?7l*5vF<>K+5=1DQ?(0JUz z5AN*DA3qvP0Y~4pf>kjk{nJ})vZM_?vkE7FXXcrG3b`7DW7Szbh zX_2Vy4LLRFh_P7eUXli-&2Bkg+&frwz~KUU zw`RcB`r2NU#?dXh4fr{#2ZjzwD(JJZl-Kxs$h>6tzP?&}n;vtyph@*|{8hHV-^fSr zm{T1YX0^bv&b%%Dy#o!ZwkdAT8&ZLKh$uLC$4b4SA~O zeubm~{8|Y|qFH3&dVZsh<#Sp1FTmh-a;mQDcd6wp5DZycYlBdg4QA40z+tzs-c4j? z1D&(5l|!iR+#wxppGEahPI|mP3cmdfo7rgibJDJ9q1i`w6%JD`t28_A5bw&8iP-cC zRrC^bNpvYUhN`EAM(9kTGZ!ZGoESJ@`qOVrB-*0)G zFQd1+99FbUceo$d!Z=<)3Yku;uAENB@7atT_G{;#TdHWmDySTa@f|i;HmMxrazyzb z?LHv?&j$J@6#lLT8n75!H&B<4Tmz$y2kK;I?+Mn_9z^ZzHs@59^rweSgErz6(1qeS zM3%YItCV>`zsv#)zF2xrQ&)TtY&dAcSaE#0aJ<5n&#vtEA1Oi#?0_2w7Z%joKPYwMyh%mtkgiynb|V9& zn@jec&UmA1OaD19kHYzw8Jnx>X959jiG9xe5CIC#;?j9HKtEj`=uIxJ+rUv_;U*1I z+kt37Roe3ObN(A2*W4q6oEtcos`~1i&?N|+t|JG7gnW@DvtX-O(*j#McD(Tq7(LEq zF4V2?7lLq)6=A+sK06qwt4fHczK%(U86-`FR1LcH@uR*Mwl5A z`uzW}_nuKrru*LTv4Ue^EHn|YAp!wJnjpmnDplzn1qp^Ky@QSg=_=AfQ-L5gLMYNv z1QZA;p%@TC5$T;!0wM4JcJKY1*=P2nuCv|`@4MD~Vg@1H_tpO8`js6TAho1Ylwm*@ zl2W@2JXL9PQ6`7*Q**0n8JqA8xsMr!RT4R)lXus-rba72YYEhGv8Q~4N{lRO%22{MQt=<2;8>}5&i=sHguzR;LFI7%wT$pG{gL%&GlKol>L@@ ztdymzCPNcJs^3w&`ekM9-U z$P{DZZCF%phv_PWN=w2xJmW2o=e0{kCToN>=f*UofbCwuL+j>zphC1TJD|&lEOk~f z>LI}vVoA%Qxb30S+`>4A&`bp{p$7+o&p!5LEC7&m1K#NQ^MGD2<1xZiDQ9h3jOpXb zfQ3BrT)d^Z>ebysU3$ijF+5(bH;cZsCRaR3}A=3c1Xp)pGhELGl@u32Altz<1dU__lFsIZmRDKe?YgOw(0l1K= z?z`v@;UQPP?3C_pLw#XAowCtLt)5G`ceX`d`o%tGKfYQYd0OXBR?xLMXzd)MkL@`JQeVow<`{eESNo_Y zbk9r|CZ5sNg6pXJsxs5@JZ|B1^6Ff>W^B=uGm$x0& zCcoYHsdSs+aX4@c6=t5Dx8qF`)CJvC4hxTG4^d=Jdv_9WktTwbB{O z>7##8G%~$)%P)zcSleqY*1XPG!BPn1b-yXQnr(g~CJ4i?KO&QH&S17QPwwlwPviAE zRgnrgZoeic@}XKM_PgdQE4z0EA2cr*mG5JvT<FIPD1<G+p(K9q%M?`bR$7b zUT-a?_@z#y{wYB{hYV^2ZN)1pxh0I_G0zIlMoX;EjYKR?Wj?A?1e|1x<>zzDHsjMV znR6ySlWyc(L}5WiU9GHWK}%J4JoiIU+@Ze0Z(V+^jiM1Ya}~BZY7W)5Km^sON%EE( zm)fW`FZ}9Oj;cg=Z}e^b>0aB^H%q-y)L8`P#HT`%5h-kYG8%V164%mL%qpt2Lxr14 zw^Y%6yl(a-QTXCe-pe!5#RED)kz6yflWn|dks5Le<0l0Lb2@Bu%2$siiz!*EwR7Yc zT+co=<+s?Q*yB8IuihO0X`|UyR)@m&V_S+Xj5?TaDqj-n)!%))VUvd#-HvB2Q;K@Se1sK*($Zep(6bA)S_ z#nVkfPgo;DmORwVWhyj0jMqe>e@yy4A&E4+aqdi}wjt|uLco=XsX^Y6LEf?PLPRG` zT~*ioMHsK5LcFt3bc&IhPFN7z^*{0)H8Po>+P|FRe|vh?yx_x5Po=21mr{Etk*0T& zr?b{6{_ZP7nzPuPZAiU#@0>+f0kipqC;~I5>tvUt(op_Q(9wCrFWtvlQ9i#IpatYd z!miFq!daRJ<~L$TK@qH%s;fuLk85&vc~tn1-rlsRdR17ci#4E1klX3&5@Bc!j{Ye9 z1C2{V$)HJPSi0VoMQCrx5P;7tG@~ethIjMpCS^^CS2_6BNrYTIi|S(0RN$lcN3dHp z);hK9fI@96ggRqu3VmhR{E|@iE8pN(XseF`e`JXfuiXo>Fjwo04KxiQwJTe_UGw0X zE@ysT)He6Kp;#a5@K@F%!4}c2IlU^m9rX4r2i7b_wkmzGJ}S_LaGHvAlyK?IrHTFhd$i3p zVow}0#xL^wuWpaYtr&P+6O>jq*3qSjO} zxU1XRuTH|OcxP#a4WnJE=vW^ssSs3+PLfC4ae~IzSB6N+T-3(J?VeUUh7>`Zg4Q|1 zuX_CrAEB~Yc2$3L!lhYwDPGhBS}`gu*DziBVXr)!)bRT^aydP=CHSg>dT&AmUF1~$y zEnsnK)6|pEsZGmoq$-SsUo7>W{-m_+@yOxb7x*70Z9e;G=C`XaVs2(BPiOa@&RQx( zm1W^;Pc!;^6OEIsldZibzF1cc)61ut;>2BAd|QMgz9hR0c!kh;_HH!mr^X9QwFn=+ zq7%1sEXik@cpiIQOCWE-qG?JOmAB)Yu6_X5%d9s2w`xumv58rGG;$6&j^`=#xmilx z)eZIY6A%&dstJ=uTP~q{Z|H0?b8=2=$@A-7VZU)UtHqLFba;V{5KwFRv_UIB@4~2P zhp9Av6@-yUO6=wdj_eFE@{Pzes{gEgJm^CmHT^vOVyquBs21B;?pm3~#G&Z5zGLBr3m zGPuRO96kF5ttz2>>&UqsQO?Fvgho~J4$<0^&@aNR49AP&LE1IF)iOdc$sK_mcAOiWjZk7UJ0<+8daa#q!7;wNxjfj~ZsT}*qo!%~c7@U&>7byN}0kHg5BXIG&X{*=mRI~L#@5$_39kU1+h%f+bJ9IGx2 zj#%?s6qhfs>`8u06mv51ys&L{rMH_vF7rv?49ybFWfWG#o? zV_49q&}zc!2w0wjDGv*txnj(RzLK>$sZz6gJY6yIko+x*dmz5~WRgc9!>RBhmEM^(t5TPRiCl zx_AhSV2t9y3k}a(jR7Z!fC#j}QQ+zPm`# z$V1MKG3&U@zIWEzo1X;pz0K%1MrmvINN<0YYnT(v$8GLIEwo#y(ImBz)tvK8?9#pj zFgA^TNKb0;7>BMHCq7Ky%umvf_8}bulqPktz1P#^l8M2d^&W)7%BEuX+{W$cgcI$J zQMmT{*!x-fct?s*ZQ7nAeQaloRf2rH1x_>K@l_vUNWxqDEXXwm>#wv9qh6034$*NZ zagoR66jr^d6H(|mw`iN!LL1*O$_9c_2W1X7b)))N*|CTKv~y!PGpWa`({#n-0_p?D z(v>)juw61Sx+AouZF$O2(D*?yP?x;Sc|P>oM##}_7Me@_BvZZi6*AQ$(l&8yVw*Yz zh44B%e=F#mjqMRauLSchh47)>gZTCyInkjP^sG&?(MFP`G7JJ zx2Ad%r6BsQFSL;~^;z7G_ObRy?DQ}3mo&K|zfu;q#I!TBc}yI3?bvjcKLg3XLquoo zZx6yw8z|i_TyU*)2sfVfJc2eHOlQ^?u9yg3nJ~^%6x@I}^&ksy`+hVZTqu9n>LcEC z$~M^Q>zFFUGr}8U{C&1=LE;}eyA6D(L+q`u2g8kBy6g>a4YQ9k1o5^Y(a7XM_Nref zzRS|oT}X{^S@$vP!VH_*?qXl<$u{4ey>jbg*^12UdV=d*R~+6(q~q}ENHifYr)u51 zy;nj0+L_X&-qp<2+Awn~!c}!0=H#S#ic3gfRyPQ(TN;g83+XMz+rOI&5j%a|YFj;& zZ_(^)s8z;@F=5Y!Y=)_mmE`h%d)O^P&B@mvaL%<*KRaZ7iP_ScL=$ImT6q{c#5VLec%ft#N$&Lo{E_07eDW3QpIy2G#C)9^^x~rQf8WjRGqFnP8U} zatj}8+S9l~>@7~8GZVru5FQNmT70M*P7XLkpDX+Qa#P(tak5TB9hbdM;%s)ln&FUv zki7Ct`bk3bdz$GEPlSgunk}x;s2RlRWpVip&3WBxSSN-mx0>KWYA&15Bi%@AqAv$9 zgyQ8LuvnUCB}cUAw&D*s>M`IT=LZSk>>CALF-P=w1)qs3k zvFO$`DF$)6bs$6->;8G2MF4#;^C@%k0oR#BqwgX$a&_9}L`p{vkG>2z@L2SNe%$>D zAjGSWJHEQ!n>!*un@XwV4`%;tUu@cH<}+m`?qhO*CDLVml~Pcj3U!e) z&9GW%EYNq^zAwKFmUB|kXJ5kD@Ef?~jq%%BzPEiRADR}-S@ohEOKfnP2XU~144ozk zQYZ%DEjC}%&4_5JGw7NHZZrNt*?$GOw435H*>pwXs$BoQy*in5^`5!0yKSq*TiV*#JqBEyE4_wu zWc9-RfcGVEj*ypt@xx3LM9)>{=~(hzVfTB;Cy??k)S?kB?yHOT&Nh)o&xG(9O$YSd z!7lj>y}tO9i`ARv5UBi;qZMS~uYXewq&95S-u*t9GjptlX|m_q+9Sm`oA-VtuqwUk z2NGEBHiZI@sh2z<)oQ4C4hHY@+an%ylqF@j3*^MFy0ZuX$M)hMTT_0M`E6Kf*>Qd4 zTVsv;Qm==(H-mmQd3vm1|X(UGvoY*Noo8=TYY)oV`fcyW}ZTtsfa0wQ{*dhKUvIj#d zMlY0q_sp0?;ohH|{$RxP33aef63bLg+I#S$*Bzo%&#A;)Yfh5o4^Z(^Z{wMOOK?GiKad)dCQ1doNo1#bM`luh$lT(M2eGZwren>-<SdSge$er?fMK7{?saq^?XPc0$7zw(_9 zAZ^=Jh>mHjKOPpx^YitDeBg-($c8<%X;SLf9_OY! z3}y$HxcpDFz5hAX*LLiNbi(RBNjOy${*jefMy_&RRK@&zxcppW1RqQ;~1;Oxo<+QB~Rri1GrV;&B1 zq$fBxNXW%YO-DjG^jvh>`&UlX9)oLZ+m5Np=dXPL?3gvV&f!G!Ml(LHcg!9DtdNc` z9FJV^Dw6u8kvQ{=u+gtBj9gx)2`ZqukMyl)RXWV7vo37f(|A%toG39GVke{ApSx#g zXzmXp&cFW2=*q!!W)%c0F7QjRZh@;`TpE7KhX^2soH zZ>kESo$B#AQEZ9_R_2MXplhzCZM^}{vNi5E{N|eHKSN8wC*N`4KSBPgo$8T)yA!0D z$dgk!Wt2y^^|vW|z6d&|;^)1jk?gy6b(?p}FMQaBjXmn$S4VQdtkQm2*P9+?g$@CL zQ{&?p$iQI*{bVLWBv3wk1%73rZT7!;$Bg{-yu1%p160S?o{LU;n?i}%UR%vwvbI1{ zk9n|*GXZR_vce@ge<@!+lfJnQ1cxO)y^Bnh?)4>T4`bwLaM!BL;7H{}#~$*VS@#)* zt4o2ij=z%Ioq1NaEmX3@0Fy6(Qv;;2(VyNH(GMG?-_1v}|9tKq#H2)$$)GxG^WZT^q0fHY^7BORj5KluO5A{C&#!+ud;a^i{Q6KMzPFO0#3{q9lGyHvAq|T+JXZ%%iPNorlPfa-wvT8IZQD z_k(!6?NNZ-B%@xs`Kg;aeP@dCCwcm^-EP=(<^EhPdrd1Cc|?MkoWV=`3L^LkNMn|I z7@t4R;wx!_!bP8-01&2sXMI;zEZ91Tw`9djk-f+5N%SSfj|;IX8*`4H0Odqn@>;4C zs;i1IiHPyrr*(hS|8Z1uHU1v_fF80Z)EKceD#C-BCJGUOQ=Uf1N010uA(pnbW5!PD zIk)w{G>X+9h}Tf0hide6fVbEaFbmDW4TETu)m8Ez8$m?c4{MW|VdGs%@n=fS%C+Hf z$j00Z{P&RirmU$<>8FTGdj!fu~-yVG+pEXJXHwp0S{L!`cZ1=+Qj z+>&oy4`_PXH%0rXpdOYA(@4-Rc7xnB6-pfmc~FiM2x(x0j+o7xv!oxZuh$*_{^}0j zUtI`Z{aY@iMR{i@L4{Nu)Z%>4`(^1BfRCIHKr45)0^_CadABim(6sKpxK=?#?iX55 zeYAkigs{}LQq})HiT?Vo)f`Ck2zy=x5(OvQsN0>OqaLYeaQ*()JYbdzPnM4Ja*Y|6 zSlrlvZ~ijR7qg&>7`etD_+S5t`?otaPES56>T!?Xn!|492^WYlRSqv5_40rbpAIb1 z^H{L(BVE|5{?vP6&ZwIjpFXnP6LGhNi@0btqzp8Uc|Xpd=-TSqZ7-dkSGPZl z=svjx=&DmuE9)l_bco?4yAFxT0ut^7r<~_4kU)+hK{XgnTdF#Os5`6U700s)I1nA* zNdd(`Q^cE0HB#-Q6PR0>lAIfbV}wg&&hEEPaLOOwbs1l^ZbYLna@Ar?-MvV*9s126 z35jXf)z?7im{Mikn%ZCHUtO<3n7mP2cX%EHTaFrXev-76<*E}sW9RBD_A@XL5oegE zIIK;BuVEvL;(-J+@V0baBo8A(h^G~;p;*-fLZvEo4KPN>CQF9RR>m`o42$!?CM0dA z)Up-Uxj~?H^Io+_ykQDp9q`Qc178eoyXZvcH_xKs&tQUE(4ydzhA{KYOI=|9_ROw~VpfyGA&BwfZe5HHO15d&j^vPuiP61;o3ov?85?UA+Fp8E=wIf@pYfU49B=#8w8pe4{UW@{c>s=Br{d%G}E>YzB$^aU7r>0U-#p?>`8h+ly|DG#n!o8QnX9K>w$3X3Vz@@b`t2qC%4lkV!?vJNZXto zbfV+aMTU6JYm32bhbXD2dS-cUpNT3G{Hkt-jVEA;3tP`J(Iu%9WJ13|+Q8$BJj5xN zdejMbQyyGqTm2v)1L9!@s1~}F^!a3boas`v`?TbK<(t#^0QuwKi`2fe^Jb&dQqPiF zo*l+OLTGpFYR`00L(IGh?1)xy%ZosnNcj_RUZ$I;!%q$H+Ve!r%F-9KweO87>m~Wl zWfZ^}m=3R3{(O|%<4g3hB+mgX&A{CiJdH3*)cu2=?+*pyR7JUWua9?5{~-Zd8Eqz6 z6^Rg0PHsP@&}+80{wLMWvk++blrk5Ehzk9q>hz7APjCT| z{d7=<|A;Lua+d`ku@hJC1$PPkGiDZTl6P_--0r-?w9Xe_VoP5X>A8i7m#cvK2AYVv zN&Mq7sOf4+HFg}`sj!p1N$~KgqBmQ)qz(jgwt}X0sC$jdPJSy^F!S3s3N(JqDa5Sf zhIrUy?-fe+Vf4#j&g^3ex87oFh~P!h*zOomW~E;CcrwAQLx!B~bg@&y_8SMGQ(dg~ z>5AG-$*^&E@S3RrPoQ`lgvKJ`L4(<+pvQRx{Kf0pvgRf+xH#GE`^-N6-ehyr;N`h5;rjXc=g|!^QS}BqC(zo# z`QT5U4v>IK=a;nC4T4$HO$Mw?gI?f53&u?OyZh5=&s2vD=#~H%MBOz|bZLb)VU(zn zL4f~+Xz`bPa(-le`vDvGFxqYXrc-XRgFWSLe2|Ik#(HdgN%~;OqQUK&ft0&+pNLU^p&{rnG$!F@4ZCIU!dvnPh z+-)Wc>h@EbAMy7|?m-3q_@?5@VTks7b}I9i9`0-3mYr*3RCl}6f0g?YVr?$buA?pa z#r=S7QK+e3jX%A)CE6jLP$?@<8?hXPE&M(38G(#C!SGdwjjYfokivaZ9JC$qZ1Oud z#A$2F%NsA^rOvS07k4{!g9$-*J-YB6N(Ef!zyRR}7c4I@)4WlH`pP3ocnoUjk{F7g zZOoZ$6U3lCciX-1q|f|^ol>Yf`n)s2aY+_MIE$dPS@5}wb_Jc}bZ|ov7cK#Dh}M8A z`x8MkJ>c)7mq^d9xYi0sepJgx>P$@p4lLYI#x_p1xJHgTHC^!G#Ao#wf;nA&-0S_; zu}Fv|DD);wmCsN4>Se{s*aCY#J4v6s41x0!I9{6zm67uk=&c}Mt=EIMyTE}$KlGV- z6F7H`1j5;`hV?imUZ-2XxX z-34^Z+1?_5ftpxJL9|w|bK6zMC4^Ww^mJ_&{6j8}=XSpi?FW#?Q*@$R2et@|R+OdU zwJncl;I3XzH~j8gLZrR2VM{eE@0tq{ePH!Gi7#_CDs0;^4n?p%;+7<6QO7;5x_f3n z-dYa!p8eSQ!}}Hj744EOlnX85u0Ke=aW;+7UJy12Mj1|Qp*~WMU3&k3=$BOw++D>gU~EyeoU?bcq*0$?!?gz3Lw=MiZX*E-I0sZ%_+s?A$j z^-bc6?HiqD`ra5`aw6`#^GYR%{LP}HgtljJIbCtmbnlnoPR!;*J_{pPNo$aQX+W$$ zQz`yoBByU99k2!^T>gJi8rn-C1DF1C%aYCFOIDYNlm)r2 zVrgAl-E?A&K7BEDzNP9JZXFk&>&SfHUE+5mmqVw2eAFKN$Ooys>D#U$cGj6O=YhwH zXE`^S*;8fzkcPwltT*HwT{cfTLE)kjF%Hhg%(tqFrc*mst<+7e_|e>@6ZxuwWh<6q za+0w0(?Ue2^j+jOiUS_=rh2s%Bz79G6V3$JTfl~7CH1{IAFMm+AibSgsoJ*swzYOs zlP(H=&s;%VKhFVNfmOxs>ZV;V*EhJH2DV41!zBR8<^lrfo&erO1XNm{>f{`^Gx6wY z-zl!lx=PYJfjA@DGKbb$bsAVwUB5mKWKZhve%1cRb`hf05u=<8ACnUoB`9IjxJ;=LPfHXRdHu=r0LziRC)AzzOG;mPs?% z;c4nrYlVUSaW+p#*nD%@L1Wt7Lu_e-2EmZ>JsSbv>tXdSXYe4GoHMKw>B@i7)i-@Ce0C`kI|d>Pe8yeV_pqe{%|L|i z`CSDjEZOQ!_8Tt(C?pA+)9{`e^ocWB+4;`0w2=U|_|(|Z<8Kuc1?;zg-B{VF9`|k{ z2Fxq6%yK#EGITnYsDMV)tfI9)K-faOnCdL&uyDknCjb#7((Yr&f_NPd=pm;=+*t=mHTL*J~3LZjI&*V3` z2JGFy!z=TZX|wR#oF^zggfv9*$sIPJH9C|2F?oyMTZ*shA z0l^H+iAA}+M<^lbI>lfM6^pu}$91j@yx8XBhBCwQcW%JHcwqnI#=}zt@8E0M`j}^% zr`v^$knRHTq&~QN9wdqsX<(Q=lxiTe5R{*Le`H05h~82L0_LO+ zW5#oDBD!%9$-i*0Nm9CSN4TKK1RK2J37O)|61ApgDil%Q+z?bWoY!5$-L`nY{J8X7 z-ZaQ(qN#-BoLDxKTW=&Fo}?NyoJ0qWfgww!De18tQe1#<6n{=74NFbeU9#L-K;zrQ zZt5DekDx3mw0pn^Y;5P&Yv;nDRyI@EWVj$2eJz{C2)K56a{aKN4PD3_(;Q1hD&Q^I zx{0MtM4!`MXhUvMc=1wK$UN+UFP<->Eq>31bjI)%-r3oY`NWvzw=%d+&1g-feYWcW z25VN1l|Xk{GR-H5KjfB0(>Zp)$J&A^#pPm3?`sou0fUshc*)pqcG3==$IBPJBP_1( zf43v7c6lcHOs$Ylx^aCk*3VuaPV`WvuP!;hj0g_oDOE%&oYA~y9X4zEV7>v1jMo-H zRvVCKwP}agZMfGvIBj=~fyF4Ukx5U}CjS#yBt~n74hvvSd}sNPw%Z51>sSWAwVzS8 zce@4eY1zB_o7132@l^tJ+$1)qX0kh2TEdW9CwWQ5Keic^YStKi!!)g0;Z4ny=>@>P z>XoTiHSS)YvvISR++nSwRn_Wjryd>&w_6g-+iY>~OK{qr8JnU6>pWBIB1=qzL39C( ztb9H1$v(FaeBYCrjyMNtd#?T*W+x>K+l-CSZMI2J=&CP(UJK-F%$~Xec0bMwo>?J4 z5%fzNS;0Qt8ZmG8hW#^RozpMu>XK{nue{$yR+I0R=mTl{R|Sw5fl^eU6y%f_%+9Cm z(mCM%xqlQ6n$b!$0R*h5xOT4%?NZJuGl z&s=_72!5m?ARL(o$i-Um$*tvxKM6p*Ycrd{whD_*^1_YzTMa^G`~fZ9m6~ttXD3zD z3i@N6Q))(H=V7)L=&tWhh6nQcUjVnd^sLUXXNH@bgNGoDYJ&gNl`aoT1?gCPTeBJ~ z!KQY?C{Y+%N?^94h2(lKOYEA$C7`nWO5kQ?$u1q+KMKZC#4KgDnc$&a_>yl8Sn?ae z&S3I;h4tmZeX8?FMjh8)kAZ-Zbs$&4-K{#y|3UuPUTdzr&_OuNbS4K+4TkodSk(cB zF!Zy~s;5P+lwa_M#E}HPR0i7mU*e#TsfF5NU=GX)q_i^)pchgDktS8|75(g3XrLj2 zeTF%Ru>v9OR5ACYII@YzI|mOmZ`vxSJ!wlIY^R*w z#Tn^PLB;JG-q(l}G~fz0W}%y2Y`ORn47tjV{TCIgRx9zKoM`ZQ$08j!9sCODCLq?1 zax5b{LZ@Gg<%2KLH;A{IU{`*f8Vp1|ow06@Oo^eV+Ir(=-~dw4EIY2dbdhaF_FHTU zNkxdB-K8M)fQ2`SnCgBr_@J?0$?|}|K=e^mbnXsMN#mrGNvoeO@ðL|^^c@iFkP z=*Xt9*P;u79(j?+%hSj*tUasV;t2YIG1NI-2a3^_dxv#5n&r{Kee>OUbwkhoTIWV= z!>*~&X3lbK#W8rpqJr_J?0?a}An+2ri=+=kwG?>p{NKx24ohs!408okqc3=Qq`>N7%U zyDp0mVcRY@*L1^&$It0O!^x!L9kiqqrFsh7>t2n$nU(^-MaR)6svws@*vCtg@O`L%c(P)dUc#9xDS?E>Xx6pO-0Vl-ENF*Nfw}atz~#(Zmahhf^~LzFjQP)qT?xq2J#MP$VV*M8p_JPC4|E`-R^{1 zHXgihR=SvA;}>f-7yNI1AE1AcAG^| zRqWYp1K8B1lST2Q8fPQ?>mw9dBLX86R%&;*;_Nj2r1v0$ z5qb4Ir{k%UG&^O2fK50AVW($?mxRYe%O>VrC-N8?cem~g?y>vu(TW5Kfu6Xnk$+!V z0E{;DhVs74H}W*&_db6adnmi|U48_+$t|<7cH0XEBGLQk^y%Uc@!>GMNV^;o6Q?!! zr6aAt&b|^Lw6bo#?tDh-SXRe@ZoegYpH63sG zDrloPBLk@^_`T}0NtN=2DXuT?{0$bMOYrZPpE569xRvgYOG8|wSiCCM=7hY;mh0hY z#I_7bbeg#6j$2sH^c^z1WL=9b{TyVgxZLNb9utx+;lP%gd0_m#B@DJxqCZ{a61d@9 zB&o8=3+_Y)dTmaX1g?rYm?XtY`r_$0a$U*Ap=v}u6gt1txc+?D&_t*>5Id&~*A$w8 zVi_6fa9garA9xZMRR_HsG{IN5tIl$BzV`x0dVisg-QI2xb3q)4p$S(&I|hY>8C)c- z$1i|`jebO}e4^(-73tkxO_Q9EFpCoyh(s?$!Sc*Y!N<@}U!^I5T{Q!mrfyK5Ryb8} zSWPph+uXG=wY$*Ge9a$PP+oreTOf9E?jK}tyxi-z^pcpQ=W@jT$KmTtpAWz={X{E2 zxdX`OW(x1@I~eO=Gtq*N=SH&$8oW-M?&mOjD!meDm=0i+p+4uS_K!RyGJ98mO}N)f zbg%&K{at}0;r?ZANTVID*HS8FDG^p1ElaA4RE$;E3fn6yD^oV$b@dEoz~N4DT(f1V z)6lwN0Ynlz4sbzbU%iQe1O>@S?J2k!Yf&Nc%@eW;fxD2zXu?O`q&~Wc|M1H2a zLcK;0xX~?BONFRc(wBL&%E&HHrH3LiO-)gSPag= zAYa^J3VPS-#ttiGV}9u@DPBKcbfAZB&&`AJy9hh^ImEHkVbH3V>;#30Vr>+YfjPFM)=w|GImC(=WB|(+(6wE|P3$l~CU>Pk&-f_)ZH$HUgw!Z5PxQ>k-a3hoV zi1*jp&cXu7N$S$wfKR5|)h>XiyE)YhYi|dw%TYLs9NjN*{|Tt^pIQ&Dd2rUUZ}Rvw zv;}Fei^teQbL|Udr?g48#G`o-i%s7t_4x$xJ8}QO_(2!6fTCLAUq_oNmuNC7&+>sPX3i2>x*`+TGTyI5p zQkqbgJU9iC73)>N1X*)JPZiR~fgo^{ok2+ycvEHK?Jq3bG3bnhU8g4=eeaHcI*4Wp z;iMc^)8&l~8H8BsU4$B19|c*YOHd?rUxHa`h7NlY(bvrkx&O8BNadsXc44ejAzjMF z*>i3*`}76+VRb`uY!U-@S=l9bp$3KKy9DS?3sIk(D0(!=%V6^K?Hlaky%fus{6Cgv|<`4RTbb$4g2_VSCCej z7x58Oaxgzq7k~k4daAaDjO6ymiBX6c>_C43-0tCQ@f9L?V?Zdh9tu2Q;<5&vT$Ol- zQZIlCApWJ8SgH+(2&m@0Gs~NJJ-7?8L~n{AqdMvrZ*SNHjLOM)3xQ@X$F(BSD5>4D zM$mT`EK}zlER<}Ka~W=w+Ql(r$AbcyJNX72dP8F<^t{c!eTCVTn{C@16xBr57)Yb6|ux68*`+EYdM!~Ydw0=bLum;ksBNlkRO zsoXpc)x+b!Pv2XrC%Vw_^kXce?IumTezI@Yjw6%*+dRwqQTTcaGc0-vP!@^PvoDjy zpj5yC;zODU-L4gs`rWM+$vgpTK}dQcz4Johk{X?snEVZj^9RR}<|yKC4;Sx+77sZ6 zpCIBQ`wpc-eUgf~bknuh7;je53VoJH3p+Svsdg(B^;-8n${Hcn7ZwMQ=vog#WV?>O z$AA~yS*JnY^g5w>Izj@NHe94o$hT3aj4(^GG1zk39Bi=2Vai%Gk`u+%uRMVVJ!u{;Zaqtnh z@;Z}cz<})RM&oS}mm)M`wm zTt2N~5}fKVr)HnsU5^$i`P%xxn{|lw^_P7(=K6WP#<&uz!1O7;h+7bo7cZ%Mdbd05$$}> zbRAk123V(gVzC;aau2N3793CfN7B?~+tQYDF+zhX9F1P9741-+u2}LT79Gb7wi{vjGp*4Fz&AS$&>RoTuW$B7tY{aO2Q?8#=o83# zJyLa>P58(OqJ(xj)Qd-n(v)&c5gDzDT-+-VI{V(-C2)52s_q^s0|8j=d*%CnQehlC z^K1~_le<_@8-(5Vgg*Eiar-xr_+Q)aZw%+3`j7txaQqw1{`~;{8>Ekf=f7d!|DB}# zzi?z&?ewHhk@!1T2IgDJOfU@@G#snGnS4N!HIrN%PryRINI>({%;xKC?pH-7Jsf~) zgO_zPcAE08>OwGh{HD~ZkX9kliq9GI-8Ob|-A}G+-af;uCNcYNH0Aku5&#i5-8)mv zJ_0vOSnJCBt!jiOY=AXlgl_6(Shdhw?NLUrD0_2t??`4Ht*kL-v1S32QB(en>eG15WGBELFk}@M;d#>ndCQA2r=$KufmwPN>Py@37f7Jb zL2bYu3g zMPFpAruIh2KM|2z3gumsDIMIxD4?9h3|u}&bew!fUs5yom&w*HE}<@#;W(|ae2T;H z!mYal*Gja9i`!pk)f4pby`$2`_Azxl))NcsKAYxm85{cr(F!|y4yrFja?Twy-^rWQ ztUym~8Vd~IF76C$K49z|H$(z;xF^XcmupzGK-7J#Y1FG*SI_)3QEuFBWwFe$Dr!B3 zel7iX4%3Y;O_G{Mo}c(yT}dsE0?=W=MDluVJJZJkR>$ShQ)R==3$5E*!g8m)%r=@H z`~A)x)1@z>>Zd-vlWdu#h-+SMk)vNwPvqXndMB5*n(gctu{n5S_jJDXI{knfFFL@3 zhq|;WB(Oeq@^XGadYAaBN7nI8gn%W0rPkEN`go-Lb>J-#sq6q9)u~rQ)5V$uqL_Z65I@gq%L1D1kI|b!75;Ca z7S&!%lnsEZg|Xz8Q;R7cFG7-EHBlT*ea98Mh6Ww8IQ?a{sVkL`qDtI&-{;yq%J{Hx zv!njFeW=Vv#YCrX5C+$A7 zkKR3d*E#V+dhB8I{FHO7iW*7ot$FGJk1`8JCoJ`u{*diXwpd-}{aQ@EUR*u~79uM3 z+D2^lRJ_fW}?DnYbr9; ziN%yBxn*N>TSJk>-XEm%`}@rUW!Gxdi`5V!uGFAyl@?KC+0tJVnrK-^rhP<}|3f;j zhy!7Uhzxp-e9Y}m7HgRX{rx=~@O}($1E4uT2dz)r4RMnQITs#Z+jaV!9sZGtLHfHr4U>weOa+AKOytSZ(`UiA|HsuE2|$ zuc^3VQ1oSlEZMkLXXg@6M~~add?IH}iY!laj((`;&6tYF1&qQcK8jzG^m`*k^WR%Etcq|>Vrl)cUp9P_Z|Dm5woO}uQf-I^Ql zPqD(EIIcgY*b^+>(9e*-(=0RiwRtYQXc1m~Lash%Z`mjWgCi;DrWptE*Y;NVkSo>+=;(-RZH?>yXt0{}wzdjV> zbrXfYVq?3lI(%z6I>9TtpzWkkssJuQ5Q(BYxn+-5tk7&n7rPyrV(6LEs&s#p7h%C! z2q%Dx6%0Gw>p4na+KSUR^FI`yH$h&g8^?D@nBVHJoinsL23&NBaXXi9^%h&x2INh; zroUiau#?%P-()dw?KtyW6zCGBKJ8XJ)h#eh=60`~Dp3u6s1qKIVVzP1qhx}BC0kwh_atK5nw=|r!NU;5?7+?mOf zXEo&(Z+WkiH>|jgGd^(^pDHGM)_o>QF0Emr$=}}pp)XLe*1COVzShOvy(DuHJ%jbe zVo19Te;1363!3Z75=}QS6Gp$W$$H0uDtNyKQ@MprB~o2MX}{2E>AJ%-_m)JuE&4#P zZFXs07v^oyv1U;Z-J$|36sAjWWkq&8U12ahhPRRytlG*Bq-s5qjURxeF7_rn-J$W# zzR0b(-Dxu46ay-V;S!SzikJ6VErGE5CXy|_Jb}sC%x@^|R0VEfRNNt$H@#+w+G%!~ z<%^F#)`7-3CzfmaR_m2M3;nC4!3YHtzh+M&m^F;8RD>(O zxi<>d3@xDmB2}0>Q-%*}u9ODy+%{5bKw;d^_9Hgaz(xOep7!C=ZPcF};bIE$%>J2QLdR^Gl>1^y5vYP1ETryuXSy43LBV2b>#aFY= z+SPA#4^XrZy}#5cO0td>q&u1>H0>6m~RQ- z!q5hnhbZ|(KX&~FNqrOSi(G@l?_b?m3ybs%50zeD7NGqekp9J^WpXqs#tbEuPY5 z`Y2XNRCSh@uPLUY2pw-ZWvATeM54y2qb|ymP=p~(FG`O`sx-wjhfErFixLY>T%9fv z4-kdSC>d89VXUpJR1WNd$udx7cp9C1*hLj>gKyK|fw`xjMIa`Xoo=mHFOdm6gQlHkz$# zs%Xlb%$^P7wJ~dph4f`W4>o-@Dd}wXZ_#ZIsbBU%uWw<$Jj*S0S*mDofrGz-TF13g z6%&qvGP!JuYfMEK>tpiL8x&bH3B`MOZ^`t|vb3s!72!D#fIX9Kg#SFepvdgL^3 z)t1vER~AsbM*Eqjb0#|E>Q<^K4lxpgYJ~6NjDgSQTV!%*cdy>tDX1vR-pyLf^4T_K zz=1UBx9)oh3(8YUGHZQwQaw2$p>~g=l=7`yt@XuWMM+ex{zA~lPloAd>B6EEvkEYYPf-%i7j{^aHd zZUNe2f+DugUUf+46nU#(!u|O{{lrP-q<)Z68~?Z7=Zwk$?xUCznH-bSCsEjj7@2ar z+cwX@>8=}CF?Bj{SUtj^Ulw03cXtq+E`^wPf*P2aNt*iW9q=4b@yLFjJ;eDIx6zcQ zJ61ob&046m4H&;xRCmXJa}N6TlNd(t9@*@BN`kRG8@5#E$nQI6-eCarv)*U{xU!5c zOW79Yt#Y7xXm5u%J^MhKA=nWSyWz{kIN5ga)u%xS(K={1ZRYfI&z)^F3TH$N#?~&y zjBU7#1JV4#?1a>(y3rBm%JENE5egf*R`&HM8QK2*Ok=N#th}tkGId{fcSRza(|+0f z8pX2c4Uc}C+@5Bojl?<7S32!!8~pSj5C%ByejxK!Gn8(wZ+m(oCxhQh*cpXdOK-en z&KgQ=e6fv0AT)-v$6}Y4z8E{1nx563RdWYJ=iLp44VLgcc$1h0z4=pZPKfL>mXJJG zKY#lAOghgtt7r13iK0rt_E`~e`P?ZJxbGn{k4A2N`NZ2*?yNrIhdNTdng5}Qh>Av} z4K~t-w?2q~?NohAJb7#3ZBT6IrK-f!v;K%g1 z!%%k5;{FUnf4NP`Grpn|Du$*>t5}(WdZQLUSEhm6Qolr?k^sEw6*IAIPNgY#eBsfj zWn&Qb+Qlry!v*MB^yn+XeAL{|)PB}*o4ruQI>m5<5L;!1$#s-&bdqkJ#)F(qgx!78@oJ zeg3v#*e0^_4orLEU@FcxL+rbMmH`aK^RM*sU!8UVF%$r7{Il;S8|R2I964e$jD(=m zrch4ZQwsq}ekQlhey}*EpN<)FlGSWYiQP)>=uXA}~deS+Xqk&4R(bYOOXo>Y3Fi#LdeD6Qek>)znIIJRAh7()~DeIxg6vpc| z;0SYdIgL_NV)t90c>*%coT`kz_XfKi@iOO^??tYP$DbxF9$7;GXicFs_%XV~X^pKXdPc ztcNCi1-F_R$Q|j@?;J^syo1|q_@U}>yJ&Z*cFS20%<8Q4q?%R#w!>*COrPiBTxyU& zuYxR*JYM0s4h3Za+1EhpVIlO*el|s!8{5V`A{ifH0zrMT5mSNL1Nc@KLrYKlG)Tnaa1d zhoOyOxzoLRyC)wA4TRHP+uh2BDKq%t^y=XU1FdrCL;<_3o#YVOM~t!8Rbg}fCR?*Q za`A4NO-H381C3hk!Biffad-ImSs=EO*Rp!X`aL$ffQJ~|Hv$*Z)%Sld-k|hD=iX0c zbeQglv42ZB4FwL4rJKuQ#XiPu6rdVs#piFVz>gUwHdE*>y}CDpP>d-4lsUs1?xEA# zT~e}8vKwD;@Yu*Qo}**yd5HEj;wG%AK0mjmsCq|IoIB!rFqb@GQtm#=u$v7RtPpg# z8e*=hDczK}PufcgE@TN6^-F0yj5P{KW;AmX&hHzO=CzA?NSp>i!+iy<7oJ~M?y6?! zI6n2>6~h-GI6Ez$V8mbD$D~QLP(|z+hm{9a4uVP}MP9ade5A|EvpSMy&_wOM#SOO_ zkA0-G@||urZ~ch2V};+7GV-b3Ot#I^5i5F=+ZcIrq?j)x9|r+Byg=!?p3*9$6Q3~$3a1}{^!^FMW4%8Mt zxg>89O?#`LqTjpAaxivKjh^_i1o9Ijaa$lga&M-Pp9TEz(E9GDCuFWcm8{KY7N8eg zKP;7nS!RDB9;jp!TLm0^YCvOEWrXWn--CUuNuF0eG6F+y=CwlFXOeo zw{2}b!qp%7?67Ao_Du3+$cK$g*k@xdOieZ+M{pvM{<^f_U)4KhW}i6{$o$>5K52Z3 z3@?=o@}>;4t{OkiH37~2;P@)JN;XSG#NHf5a_x0@_zJhJR8l2iI(e~d>oHG|E?g6h zFI(odu8rJo&7!jHY(CN>mqiNefSc{v-)wzaQK4~Mjk=-5G9_XkG+(6m0I_fp&(blG(49^}PAe4T*sb$K zmJ`GHtOj6=ki?DRg1CU!T+i!HMwt&4Le%V$n!&ftKTSc>XQx}!DHn1vWiT`I-dehX zVMN!y^_sv3i$gnxK?$d$klkp+Pezz^!E9-)i!G2xK&fD%sh-g;`TD&9qnxe6Ebb*h zVs45WuJVQ}YF7SB9cha$J4jTH-Z}&%B&N`|f3G1ZS)f_yDRn#b1idwtdYT|T4NsWm z_>!;m>R7^%LOmJ;^#lU~9K`td>ZFzwpVK=)eQt$^}@0a``@7pCv3aY6i!mPI#rYQR~9>4`^pUcfZw;_yfP?ctUzi zcsWmdn|ah)IsCexWpAAVU7MJMj-q`*MNt;zJCAm^=U8oJGKL*1j^jMVGcJHZ=gIMi z){y9WaDC7;{e$#&+N2gS3FH|a2bI-{1zU4LV-M$j1=B#+>_sXl{(}rZQR*m60eNo@Uoj*dig^IPfTc_*0SJP9%*cGj;Nv zm%NuY=`2>q?{N^$%w7$Rzq9KG71@Y9&IIBjXhv7q8)83z&^DoX_Evk5D%fgf|%JjC-ypbXhSdp{l zthF+vaVaFcgH%q@{2+M=^o)w_tlIOlA!ttIzJkZNuLyP{3_D_c3DYAC(pF%4Y52>$ z)ct3i-;1?qms_WyE)BuWWjvDj$*Bzkn3uK;t<|`5OCwFU z17D$uERCEH3O7~J*;Q0#c4|r{x+u$lQCa7PjU+6>(wiJ6bJfeBWJA^X1Z{J22;h0pIqh0^Q&(d$!C%$mQe{K&H zrmRHwdIAn3sviniRf${1@c8)!61q)DEbMPj z_NS0Wvy10urm)hfVU&5EVsrIBT8G@;S5Y)})lK>c^I|!bbQ9@~ShWf;03j$*Wy2D( zH)aV3lxC+HF}4)?_m<-&6?td?UU)Xf9otEs)KRA_$aX7B18YanKI?5cMjc!7ANMuB zK5iXpN?S2Lgc8L*F$A?z9*rMZ${UP(ZA6MZKH#Wn7PokGs5?RD9%AZy#7oV^V$+dv zs6nOBR1nL}b@jpXVxjSqvI9qX(U`fuyVSDLA4_p>ExzH#tFYx>zY;(59LLKA7>v6L zpFyuX7dbCQl?s$}N+q^oIN-A|xZHz;5d?dEha*S87;q_MMd1l?4g}%r*?#%`=k{2G z!%rl>r2Yn%S0@kVKgNCRgqqp-act%k{>F6Ql3n4w9$=vJboe2EfC0&>l_n)psZnvp ze+jC%149&4#<9>u3Q698$9$-MWuklj7m5-(21`Rhyk4<02=zbu}pxj}j{AT-Fk@aZ0DOoK*Pc!A~UoV#N zeLRLmY`{O3nQe!Ow&yi`pOtdNq3K|~qG9s&+QtbNjFU^74o*~DuqVgg{IxP6F5S!H zM^otMPrEyEFI_fbri4ia)yV@3uK)NpdN65ycTEXZ*N_;Jx1{QmPn|H|3S0}<4_~a^+)P)MF3{!{iDsnW zX}qdX;!B|2iL6v>m%KMfR&^VB$`#RdM=tr~a4YBZ8`AIAT1^>IvHlt>*UJWFM~>W= z^Ly3~a8MY?Qs=4ub7(<)V~@8zR|e*AKy_n598YEwNK06}=9d+gf<0Jr^nXFJDb6f; zI7kO_klq>$-IDHcI8>FCaI`^; zRr$ij@UJmmocpYycIC6I8$R#t3mYRj0ZKs;rr`u?*~M1B6&e~#okw(^G|(qe$PGC6 zVn0P{q{a{fo{FoQ`6N@OpaEkWqxI4wN+Dzkb+tu0HcyXu(GcXZO}ggef}PP5ryhE# zrt0!bg9-_aT!XPBMhNcTQ;jSUmj)AL}>tbgdrWOW?UcmI}xaF?w~ssx{hIzil~SAR@~Q#{`sXH z`<58Izx)iBK@4X6ntqE6N%V)GFH(n|!#Yx^(zWNt?A@|fFo@U`vKjnFr%#wEo`#av zixLdI5qTn5i2UA=$#~aLIgT-i_DhJ15Q_@6pwkYit#64oGg4)Y#A%H#&%5fCUfCg=_5~|j zv_T{&!*w^2syW{PXotns!mv(nd}{8EPY1qLC49^> zfQ0F>%KM6G#o(6_B;eUpbFfxiKpr#kB^JA&j>ec}AOPobZW@lLEJ$WG`)I@oU9T{s zPkTv9h~6>^9%$}H^u>JV>5ju}!77vZ$ue05`D;VKs`7#9XwALN`##&ymPh|Wu<}Zz9W9lAF+zG8Io6nNZs>HnX ziNqv-I@RiB>=N}?ilPNk%U+G?nEccBQfYmVc`Wn9*w--j1Gv@GSk1lSJzurnB%w!S z4jmI?Zdw`s;OCQ^rVw=SjW>&K+n=c#Jc%idV+2J`6KTZL+^qyp$U*ZSHX&w4UN6`w zRZ`TgE{)PBCH%-XoKl>um*oH~OHhzF9py3-%IMWG2jfUgeQ4@Ple&g{x*(O2Z*|g=X@Ql>gC5T9ipVC?06;? z@0=;^#U~?pNWf|nPoEW}6(eB%iuOoO&sX%l$Ci_dzVZ7G%sXEVl92UWYhW+C-E$#H z<2@fHC3hFxY45lit?PPxSj#9ocjW$teozdxD%rAQW>gu=g$#tQZ8Vc}(C)~w?{Uh=P!XQqo6$=$2Kzp> zvG<5Cj%uVFn5|~e!l4zZ<#*gJUi;KbW|w3=BKTzFsKBZmH$xJ%>+xy*7-P1<;l1VO z&pNBJjSd)Qs5&BMRo(&QIL>cnq3Km0%qhtkHUF}LZ9Ij%X^c$Jw}s%IQ+VF;@& z+Y?B~YtD-|uAci#Ew$Ay3goI6gu>lAgzdm<_uyKz zb0jbLEiId+8uIlx0@`lZHFp3U#VYm{x+##IwTa#cu8Gw|5e3f;y=3orb04`iC{KU^ zt(RNjes^MG^8R2@7^Nt)ey(D7H;QA8j7hD>LVk)kAUTtV(asjJZlOqKQMUMy>&e)J zbOhB5^$V56$xr-g2adX7ksu<)FK>EpS?Au&@Ujv7nB>~# zP=Do6b804Ul1X>w58F6J%cakJ4>pCH9b3QMj&8ZjeVbD8KnmK-f?-aGXJj=hHZhVc zRq>bATD~7(z*BFuP}ZT6{>zZ3$-bc}=jrTj%8kpLQJ!D$1u7i--Gg+eVb;#_7n9hR z)@dG}pU}Q&`A>4+D#yIcc=aKi@s`9Z1CPzL;lnN zXS@CLZUO8facW9L#h_cmihSn*-Pdj+kw|{lECV?s!Jr_D5K$UysUN%0UpZ zrG={`6NC%Y#M5`OD>5@Aehi3~IkFDA32#s>&~9CC7NTswl$*z~%&t;a{)@576;9T}%3@JgtPJo~izbfc3HlA$e zEouk1I?asO)A({fwU)gp`=xXl@OdU99o9zv-m>Hxxka;k6s3MAWAj}PGbS{XaG1j?Ow9nExMH&lB@vZmfy10S48!W44&RUR)xKh+L@y;hA>eFlo z+b^pYtx&nu3j3bwVZR$%GuFHP-t9;$iwsJ|7hI-woY}t?TDHslLyeqYM^7Yfz~?2j zCb=DMI#z~NaBtlbQxtj1_nGb@9qm8A9w`xtJj&T!e>9^PP_qgm645@LiEEjDzUI@S zO9}hBPIQ-_FN%EyC3!rN zwPhQuY(LU13<}1NmqoGs?AR#TEpkfV@YtJU@Eh0iGFV2u$B&EhA3Z8M>{CNqJv4ME z=bBQ1>2K*e&)x{@sVWL16)_&suUZ(k74RJM2yPU#A6Q$qg4QnRFE2W`G*3uF!XOI^ zF2)TNTvx~kUbKAudE>4b&`+t0J1`#VjYpACP4NfYUG~z=1F^v!+W}AMp}fOMBfrdN z>J~ET(BmwlqHNK`U{YlOBn5~>1e=wnc48akmsLrhXc1eH(c1FCx(#V3g~|1T+<^o% zF8+XVy^Wa zbDW@VLjvAc!OzmgNkp2yLEn=+I5=_?y&?)yJml;+pi`zjRII_c z^erRbyH-+mA4B>iCtpJ1QJ;_`m|3%8l3pTe%VKOuOJP&E?l9S};lBSbhLNM?a}OTR z3$%%$z1Y#1+i0x!tmiIAP8e-FI8xgRAd}t=1%er4PO@d%K_kE-Ksp6aYFjjGb7wQH zoXy;x&RENvS%=$gh^>!Vd3F$h(7$wL=b%tPG}vwmG9<)+vLQWsJzxl(`G|AFQa~_Qfef<^FpB0kb48;3WP{m3huW^{Gb-Ly%;!!dx zK7pxNQh2~pmFaUQ_(p>qK1w~gT-MCPg6qZ05TTQ1n3|YMzmXPOE>)x)Bo>0L^PEmH zc3y&Czk7X-*&Ytq>v_yFQ3iKrPBf+(V3ErnM=qI}U*wedaNC8&vRRbp53eSZ`?k!f z#rSExO{~A~^^8}q>@nmj9d);lj_%6MH*gU0RKJcEERZ9&4C#Wk$ewPExSL=DoWgmN z_A0}e6PlrRB;b-2#b3K>L)&>&JwDjN6gUt^>dUc&7E)v|nY^?Zb^dXmAkG9i4~eI5 z<@-%%)#6Z|RmRRW3MTsSiflT;EpDBeWz1qn z9WU$a1iq{dFC`K>(t#|}encv7}Kp31X#>4z=)%Pe`6Tv5_sz+o2W8=w%U z#sOh<_3J=lE1A(tfiNYuX|R-)3Vn3#)y)!0{NdTm zll^=#vK5&cb?PYE<5UP3TTDhzs2avO(^~FmJqA=o6KF z_eX3c*G9$_h|asMjCHdQ<<(seCL^Pd+QWTAb2*L*#&|W;ahW(8oy(RJv|k3igRf@x z+S7TE!c{UL>oj)FBNS-5WidiieQ8tsW+Rq!4!66=k}>5;z#d5p;LU;?*S_}%djR}4 zgep^6)ejLR*Hp`6Ao7Os9@BKE_hF6s>r%EI1C!2mUDLiDg|h<`&OK-B>iC>KtLTYg za9w?ZcS?mLnxcU$M9xy%SwuaWv-#{JA1p!A8{5;5nlD?f{cT$6E;o>t;!zov6FHA! ztbv_wU8N@{R&L!7+Q#c1Uc%Cz&0?dPH8$^wKG5hO7$JVWe^hI28`9;ypP2mA;sNYB z+4eY{qBEu5eF$<${c`VqMu067Q!aqLq8rL`8BPfaliT`Z>-eX^BxCgJ)01F@u6?&! zn)hvtt%36n1m5FiQ zty?`p#R{s`Egl}^$WDy#m7Qq{`lI?D4k%PaZ@pnJi`nNs+kq7i$Q(C3x)W-P6q|s-phg+M+0`-p5&}(zv_nMu-??Nv{4cLK3z6cWL;~4hwcyLv=b^g| z-7Kw1!B?K1YfoM(=JxG;ZQGWEbB*3l;MJ}eov4S+L$<=@G2-~50Z#&I$_;;<^&SGv zW^Yv|6Ic0WQCg`|dpnbHZZxSnar@hSdEa=VV&pcJ7K97=nH^`9R7c;``X$|YfktxY zy=8F))_#3OAlKNXDZ~VGZ;!PVqCYeIN}fl7i};Q)sK-jTO3^*~EtTrsK^+cc0W%f2M?r$SJ6IdBUr5c>@{XOJh@|0mF%4Yn{xM7fFoB^7pni1u2n}t4)R=fz4PAV zy65RBY4iH)mP6tbiZdTo=`Sv|E3hh-HMY=UUG+KXDqG}Y{c_=R9%~g5(z~wwG+Vg& z)OMK64R{#;{sD)4;-sPtS&bJZB*o*N5vvrc%L_|7z=$!B0s{a9>vBO8<^s_>#@n+ z5Ub$21K_ehk_zr@O7lH8s21M}#($2z=x777i2;Z9@cZ+X8(ZI%e0v`RFr!Nk-6h)R zaD9@GcPJki8G1Zuz7!JYm{AF~E6@&gGm5+e(&oTG-%^4Tg=>EW-V57j=`xj9j-xVY zFW%#ixwgPOe-Z*$I2f}xtK3Imb}(}!nI&&K9^BIf>bEBIUEv|zOmj@84zB+4941@8 z=zE2kTnoU4RW47^2Pq6%u4cwI<7q=9K_vVV6EAjKcl&5w4gM1PjuH-FmK13z1hyPf z_{J9=c}NI!Z_H7v@-(J4xOg*0ae95T=9Gz$8Ir>A-kT=yq8wzltLJJYoa}N?6<4rY zx!o9l0pF~+XfOv^PB$d@8~>I{6vQVh;0%0l$(4`$iM@sECfJD<+E{O`4Zfp+pUbbf_5f&fJ^UyH96hyb zI{kO48gMX^X0J7&O|w|Vv@mj!%Xx#2splry=M-QNzwJ0Agz%`VKb_u7g||A9NzuM0 zuC*8x|F*@))-zdDzVjXI((KjB2N`ae)VjSIuFw?mmeBn|*~Q*>p}?sp? z9wQf!OjW2MJ&%jG8j)qd6q0@g%(AEyF(eFy6q~TMxY5HtlmKq{zG@i$5?sMDfZ6en zVh^q-{MGh4WxH6M`yw2rIG{|I-8lQL z$-7dS?2^Tnf->H&!tQYS|w-@hb`K_9v@y{w54Ian|JEWXl@@Jd)0=pjOKc>OL zcs9$aMT}C!J8MYgs4fxH=O#ouz z%w;0_k>7?hGo%_@GT``0;6bb9bb^-L=9l{8GW@P-<>yhx@s;?nUkHMJ>|ML0jw`Lo zWIP3?uVsLpFdk=8knFP}dbc87ndJXyQIo^JaD0UmZ$9Q8?O!Hbz3(eI1-D zfokU9Bp8Aw4h<#leP=Q&>zLJ+XOK{1%116*Im?$m40_Am4yUX(32LJpVuQ}0Ymw&f zPi+cejgiP0=~6T9D<;ByNfOcyja?gZS3=Y@1-It7Cplw_Hb-@DSqb_Pn^mgTf-U< z{eFSbZF3}txi+8tq1+Xz%g68b(Z9O*#)3*z1TMuqR_-KDbw>YZ1R1j6ZIsVSLTb*8 z5&i7esDT;J{+G_9Mwk=K_LJlG?y)pza}%xzE($87vdOCU$=&x3%}+p-rM12g1EvY#H@GRx{!0@xpl&8OFjB*)|0O~ zW2ME>mxB6yJl{d*O8xo3f(h`QjyKbEehpFGpyZ~m5>zP7n1t1 zk#&6bS#doF*vlz&mT3*5mN}Z$bzksDl%ep_N)rJ=9F$W3FieR*>G^5N4v z9-H}L{hQ$d#%QM9z>6tJzA`_zu~sDKiI(BykFXw|6gU;{QvthECmwc)A|I+KtH>B zHII(|Ocdx6%1p1mZPii_WMLH13{3qL)>p{`X|J(+w~D$mXIGgeXp0u$}C)+!XA3ec6a)F0D0C1J*Vi^1f;0o zLD%zK`$xlP46zq{|A^Y+FT3~pfTFo(e^U`;3Q?AO%UpT=SLgGRicz>0`;6;bM3yy3 zfr>*~*z_ZJUrKxs8yCBADbOV_W~_;nV%=nA^0W$I25XbKC03U7?3NueAzuP*c5C@& zr{8(5B%A)cyg+4qPYHC~B>redO-7DrGd+0MLZ|=g3Qz{+!-mrqGk6h+6xmgrTcd#B zR<=(eqK~_oYX`+J>q-sB+D^tJPz5C^2gqrSxDXAM)w1}~nFt6;fGbRVw}^{PW^S2b zYG+!%x2K;|!=zJ;r0MDXC{oxweR0AzlpZ%(c%G3yw=KvB_x!bNR8EZaIOPqZtOB9a z?P{Q9@UmD+q5>P-N?ppPl1v%6NIm?lz+O$vdX2UC3I87ZGoC#Jjv6mge|!AA^wwJ{ zl^b5EMhrHA0||+$OwZG)9PJFPLl`4b?S20%Mb70yEkL%f;E?aYJfezpK!1X|@@eaD+u@soxEztpsC|7DA$;ssKd%qOg129tE&z zAPP~&RN(4KN6790voOk2c|8|&m2n9WhMD3m;jGZ3W)wVhM zVSQ;_(w!@wj98zILB%jn&JYj`Wr8#<;KYzP>&2yNk|FZnjO6A|LsaDmw$Y&GDy$6~! z+EODaa$EA5DEZSJkNVQgAd)~fp}2{s<4e@8oZCiO2U;PRX2s0w+o{O0bWG-$a~LJM z$MCRg=be%aKGMb524{08%#zYPqPovVl#{F}u;ba=Q0Je~_1wJFab1ehFzwHLg9}TfA0WYnFlL zQ|fs{*mqCQq^=70s#ETNU`mN;{s^#U104!vXj%nj#5RD`M*o-N+95wnWnOVqr z?<}aKDng?il+Vv$8E+4?tF4cmw*Mi1N{pQY@~JCMT1;bs=E7PtjGGU@5VI5ja+N`O zT9!KCLCIE;PAuSp2g@hSj4TZGPva^XA=V*b+|m2X8W8Q~;P#P+lj~tJ6boaZZS#sg zYTznHyObYrR(Xu9m%sY{?iBZj<5{hkt^F&JpQ}=iXEU3IjB;>Mdwuox!Px224yO%b zIkH-?=CMJmDX7>q-NpP|V5^{;k!LjW5Pw;baMy`LSzm@g#{#rrzt_Z%P3S@Qm4@b- zSV_(9D~e1jv7HTHE4l%zT?O_%p3@yCc_{C0Vc}$j*y>ys4Pkm3=<3|y;1B-bc-N+t zdBTg#mkzDHa;>bF0!ce5YQ}4Feg2#HVoyec$hJp{t&0u1Zc|d?afhbQlbo}|cX;#0cyFAb+2$JF!I@jtxA)^yFDsN`n75)ni?FFBa(<(t9uJnJ>DZq^wT zV-IoM9FikRAwaBP!1JsYbxs=0NRkNTaq> zez&J`mu#Z_`;tBn`vsQ`G+3P!YWOo43(jZs1xeKD#!gT6$=Z2BG;f$77#%0hJSAsz8;>=A|Bg;dxs_B#@>iqG0-PM7m|2&=ya4aE~Fl z1R`qW6Q*Xw3$hpstCzG5vrS6?;bQ06@=os8Nq0_bmrxwZ=Xq zqJUPiWN_@)>-NgLYc(!WA>WIAtc7u|+)wS_J*cXOJN3L?yNrrXPW${Gp@#PrB&SiI zG;gX58*kf?ngYkKEj_!+bk*R#9NTsgL(OJTE54E04&*VbH=DUK#1N1A`3~*M^boCx zR$iZG#pc4s=I#tB?s49k;It{tq)qaYkj3XCp%PH!<4K1Du+fSaVJX#?1BXGK8S`ZK zJWThDQu9Ev6qT)xCXk>*rlWGtzTB|rTW(1&)yIej^90*le}cT4<7$n#cx^fh_u`CX z5vOtyskOLIY2A^hzK}A#1a#RUMIfEZQUP`Hj?d{wAkSMoD_@S&y{A)%p$&)7b{lV@ zdWs$7MJo0N6^N%aIQ^DYpZE{V%YpS)7?=%Rlras!b?LPyVx3k)y{;1{884Lmn+_WZ zS$>0j?Y#_O@m&+w=WF}Rz(vc~$tEtE88=RWbP}zr#izbIn@Caj@6feENjH4hUAU1f zQfn`C?oNAde5@AJXsjE_S>j5xJYk&i&zDTnJf4 z9AxB@ONPRkrY!f*6}bmt3X3dcO$`EoR?XJ$Wu1)us!J7{{&`PI!)$0^#6hvliW@oS z4+7j&x1mQyj&Q2Iu4G}aY-E(~rvfkIo$JrUuic#G&$Lc-QaldcY! zY|n$)hD{16>wLpa72M8YO@0%8UckSlz{Ukpm6}g?PWb>4ug#BWdzSjU3j@IWGI2n^ z5Ifl}W$#0xVi8&obm5JyZl0WZZf#Q{kl!4g<%WC1Y)eHiaNwygv1U@v$CnS^WaXgx zgPJqpU3qgY3aHA=!u&T=Tk&0wInhzts+6D-^XJP*?XPx38_&|-qAMO6#8U8|ONj#w zWaha>9ozJf9og2&#^~e*9kM6%?u-GW5rTztF^5Owc6CqE58go!R`RBPwdQbhyfS!r zZ!O(%yYEd#o7)J`eV?}TytXqtvbv4Qcna8iH>QrSIn81Btr;3U{|I2_A{{k#4obV- zx|Ai3hB|9r3-kEj%)REuMRKH!ZN)>NaN>P_XCm<CC%-bJBePp0B zv|G?)2e4H{^)oydt7_1-_c40JV7Z=)q^AOm;B9$S%INh&JBbgQTSI*1*K(YzS7baf zS=ioMy<}N5D>0a-{c*vpW@o=x`{iQkFCxD!-d`s&O#s#}6AtDD(sXs_6`+UOboV|! zASzw{)d!Rgma^p00M$1B$ztxWLR!Pu-#$;{{NGgJC+_qhYT2B5Ku^K$<84l>_QmD0 z#g{T8f#vGgGrLtt_AFHixZ>~=tG1Lmu07Qz=GZVVT-4zNJ?>be`1Hr93Dgv~aminM ze*4bPY2Y&PIymFbxT))k+GY-o;^k0E=fXzHi_@HZrz7%vGp8ZNSPJq`puM`q-w!~+ zcXDZXu4ADGLs1}Mr#RhB&xX3*I$0}qy@ff4RT^+ZS)qYcC|IK3r2x|h{ZNE{|d4oRsJOj-8mF$0`g#Yl-k2atz zIV>$`NK{PmGyQxr#Ei=Sd~NA>7Fr|qr+Jc`cL4midH&;#g5SNV#LWMv!#4lZVV_Ti z{u%La=KP!F+wvT+AgdXS0A(7<>Jwlx&jJCL{|^)X{hOv4f0}6E-%Rv3SGfLJ79S%S zfSX-z`X%Rb{B!sDAEo#orT8DE_?Hp=kEi&TXZ@F_*dmZ#xIiGVpx+Vwi|>4W+B1V! zFH`c&*;8v7W^tqM_KU7;L1mrRx3!ANpqhN)IV(f$4+32U0!>PB0uk?n$hf;LRfu^a zE;14;H@?06fF)e4@iFRgs9EM!?7qh)Yz11odQi);{Zx9x=%LLGynAm;Uqe{7a{Rar?e#0EfT0+N_KmQv|Tq&E?;k5#JWS zP4pj-QU7t@UI~7VAq8(H0+W0NP^2zKn3Me{Zr=aClJW>Z;-10i){Qq|0V65emsMOY3r8KG%+w7vFd*U z%>BnZcdG&XFKJ4EVCHQNIWQdAyWjo&zYX~EHGpIKn#r&+|AIS!bgx8rIp8l;g8z`) ze|_}h7l4?&04f0_x5@_$$IU|YyRZKB2p_vhh>_h!0Aec9&nLieYPX61FBU4{&xL9{ zUnt`NfbOZVa9~7&7eC5m*YNrC=L--2dyWE0O3u#CdwYBLJUu-RiUlzuBV^IR z27rW%HH-ix84B%h*~G}FarP7CcB0nZKZ(Bn_jEp*5Sg0xSgs6yjt?}G`0e8=(E(G7 zFiec^xG^JMrZZhEpwcMVHzMwPyyt)@8mVb0CjHl;7#m z{+0kaO0HO4R3QDAIy@BlaV;}5Qw99FIEVRfKmWJ& z=mV%j_4?B&&NYyMb?afz9gjC}QmXSWU;_T7i+wzCHapLekkW;#>3O;6;NOVtZpgWY z^$476*pnBHfn9h#$MNcC$Epa=ju}cJ69hGor}dIBO?w6 zMXV&W|E&>9ZWJIeQo!5WJ8gFX$@p)R`I}K{%K*wdmYHv}Te;m3#r6L- z=zzs5hBa^OK*or2X|sM~y5C9Z^EoG@Y1huhKP{DkaqE>cHVlD45Rv^gJ86=d+S(kr zo2y%WMkV)Os{I%G>$%__p3A%D{lcX`&6f{wN>=T?FYWAZzJ2>Ic@wAU0%{=1B;<|w z|MpO6(r$@F$hyD&$9M){ueIA`-t+jIWd7~hl6_ALbUof$S4`0Kzx69VXHTQsq!06)BjGYRsg8qRWTzjCqTGL ztbcc9KOX=ls993O`)?2XH^plQ0VG5=Whzs^AaC!S5C4}-`(Vu+ZS|08(vg5eyd?S0hha@8H}jhEf0kgbxg-+?S?Z0n!p`qzxMi zAb%HB*k93V2auG}d80Uv*DvKx_lA7?#pld}s3gKJ(a2o)|5?41!3+@LVyfglvV3vj z0Ee{PIdg>6{)eIVLQGOp5(J>HU^aHF)5}s2Ioh|W>) zcqX^^1A{k_ObXgww+Ep%{5K*-R(Lp1U2>f_4-}_33{18w&ZhNaF^69y+dU@hq!cwV zv*G+1AFu#nt89Bw?M51wupr_e9w}0j>y5fEYwS>}whqS<7L$bxORg(G2fKpM@6U|K ztVc~P0gCci_fb>+FPfQYB>S*1FC6+>!{LI+ZYhm-PQtksl{5qDCir;ipI}x0)H3so zbCqH(SDpqq?#R5WI__FEuF2yYWWoF24XAJvUdCx^YZ^xPmv?#^WacUaUpKjC$q7qL zELRU35ADLdUnwIAzSv@z{jdHW@Ijf>VO-FT2F&%CbsLYtJoh~TNKhGM*SE@+H&?># z>!DBHczPO4s>9t@?ef~!$L-t8tb69B@pZO$E2CD^B&{uSM+u{A`J?*n6$B`Cr>(Lq zA#ismPP^uMG`?G~0bJ)%AUi)kYM5mTJ#}&aUROjoYfCn{a+6ll8I6=$T(-hXE_Kvm zOQFaGA?OnR<`vv$5g0o_X{PIEg2z00CA<7F$Z9*gE$Co~@M}QBpIc(uVd!K}8>2+A z!tUBS3&aN>&MFOJ{ZH4@%S3&@c{_xj`w)FF;A|GC_J8Ne$f9BahjJ(-QNw((SUr+v z2WdkC`8-~8tA`6wQPCE~Dz@W)lT3Gf@UeaeJHAUaH0>6^C4_5^6b{?#<$aXYI*=vB z$KmxW{*$m{=h1ASYOM|YR^7g%b6-b%v+~UwcasXi7mMe$q!dPsou_>S@-lp0P5I$B zeBV`!rsE<2r4@n!JSIMW6ep&#I?CZ!#X3bfE*s>{)?B?glW2ngrhO^j)a3Ox@Af<= zA=lgF+SWsU|HB~8_RqW1EPjy!Viq=G39ZMKF#7I4ot8Aod-&F5i;~kx%HCemPze=dv?>xunaMVsgczcPk-biwvbEVm zsv%h>#=Z?@$ueX#mSK#2XRN~*%zyQwgYI2RbqNj`M=k zaC$>Pr;4++e4oS2&uTXaG&rSKWbNXSx(=8E7{6gNX1pYmwQZ6c}1R1)FX6&dwr`pl#GTEtq27eH8!n8+fBFh$w>|h0RW- zgAqo(auGCeI~Gfh&AD6E_gM?f#p&IZ&zNIPbcUJ+kZK&99LmTzjfr_HPE)O2<@)MK zCB=GUk9_QCk7qGD` z^ptadtl;NacZCOE8}M`YqLY0FrHzh%b$W8z4rM$~;v(qaTy#7~_-$txjWC1rM|mk$ znQ52W!Sr1TV)ekaTz+I6l^Mg7rk~SC%fSd?8Q?Db-6}5Q7g}53G{Zf7V?KKD+`4lg+EMSVAPxvt`-hwMev8_^sDkZZb3L&04LFLM z?a$?g4{_nU97mjci@~tHi66+ht=Yzs702Gx$HzrJ%bd1+cOnZ6AL^W}tNvUwG&(Nc z@#?{*M9bk^1JO|`8|G3b;WE@ZecxRTQGFU6VmRKdVj3ZyN5N{q+42;8T zjPW_gx640`f9vQyMvPCfhVd-9MFB?00uvkrsFXbCX|tHOrtfWnoD!qnHO2E|b!Qns z-3dr>mzEm`0RZ@zcHk#3raok}n^igd6dI_2lq9Q6zut;4R) zBOlU~T9pReSGSxdZp@we_W6XT7FCioWYnMYlpEb2o`%D%C$dPkCB~_HWsEaEZAzJL zwM`a@4I}BSlCcpN7iY1f-AgT5Rj5Ff*_&c6RkuM5G?kEgw@W)FaW~!Rtaa{i25U+R z>o7mnP!_!~**nytaN9(vP=jEJa}QAN_-y5A^R8f=vBTgN;bvGhJy>EcbBvpX*^$n#cg;>8*$Ll8vJT1+ zbXA(n_vvQ$TPSm*qm@Ul+^&e<-z$g3sc@K?#FE=(?nj3=WmDGVU4~Dk%@nR}jW%`x zk#DJUZxo`fK(Jn^(>|`ZmoeX*Uz`0_j(pU2-U8Uzx83Ssh%0H1Y7yatiE^szo1alh>DOSTfC?0tw;!Ogp#P zZKLl42Se{|9ew=n5GkbXvU2;|EHGT`&ZkV`yp6Nxe({zkuuoVpW3and8e!@E=1m~$ zti;)Sv;A?M`95O$mK8keklU96x31@^$bhN3RtD52tHGpQQwXP#mKm#zjhzln&%Dx` zbD1uvIX01a65&9#j4QLrY(?5g)OezBbw*CKy#@!zlUP6Nx5~mM6oYM!ap8-C+0FYl z80ItFDnkq|oyt0vfE*6qc%@MqCKnbQF+}9wT5+vy2*g0A zWMznCUfcZ*?=`M%qBJzq$C!;LHWcD)KA0&R&wSigx)w3%l?UgI1ee4({{SPs4L7;J#f8K6Moq z=mvt37syxR9Ie1^UY)GLU$$HptAxENKo(-YUX|IiRNOiMGH_jswv!IBAkA+~xhvha zH3iK65N6EKow}@hqn+Fp>d5}Ag*cV@@}%3-!LJZX~jT5`NZDCb$*8BGaxM+1){xc98QrDj#D)}+E0X!f8Ncy^fU0K z#%#qCz!Iv)uO@Fqb0X(OE19GOqA<#WGmx?#OF5$(y`*V;3~Xo8uhe4tZV0bl2W(@e znH*~P8ObClL+&zSw|g|{z>5s^3kP_wdCwwp3U1^MU$5+yHTISw9S$-NS8u+_gJzX9 z)repcH_Kv+Hl*TqHTX`YdRVS66a4j}0pCkpo1U382IOgsRz$Fjk-oG40KLX-#Lrc@ z>evG?Z(95(c(fz(SliT?me|$^+XClS6yFyb@D3pQpWg!}o7eaC_xDfuRTP0h4A>&h zyg>1Om4!zY-KGnp)wgG zAfVKnG%q>VFmLIYeXP=uTEM1ZItEehZpEIc?)EEjm;GsubXW%6 zoqf$V-yva55L22^kX$~S222S63{BTNQ{-BLHuC0G%3|%}Ad^wRE(Vi7g|Eb30wV@U zUK6t2v`ZLN0E5KK<4(mRio91!BVBRpkRdZfT?64R%e5BY>3QkdahN$)^wn8;A^{z@+;EM!1_b!jg0*d%N!fq z%~E;?nN=VC2T=wX`1}3C0KIv2gZm8-kWx#~XMpuF+qcUsC7|n&fP_%L3uvYzr1~)w z8?;9|<=Ycoz2o!<<|W&zXI;}z8yOi<=3^WSu=U$IK{rQvgc=`q?=)nFqfJnJl>nbT zuJfh8)up#Y+L-k?PnHWG;A)8J$t9+SljCz?{dfI0!pn(W$C+71eD)1#h-!9hVv@ zV2@nrL;yd9A`%D%cE~v()})PbHS{8Gw5V;~Z7~oau^jrFRVM5$N~ujcFZR1Ji|1M* zom#in}p+&*5$9<@+LvkCaJ7qF!^3I&L$>x=Z-=ORg5tY&y?}b(=JmEVmd@cZ1Iq zKDZ5L&lVdmjE7h?Sen1_mCZhYkT}>DbpNE(hdK`pjb7Z|Nis6my34L8#)z=@AUzzW z8nk#l#@SRX;mtcpFM`tC?sZqR<2lS{A=caM31La#;->zrcJJtt zg9(X0TDXmEV3|459h_d;eH<6YTQQVI3wb)a@mObfD_0)$#CV(TFv04KhZdZ5RqS^0 zQ=Wn*kiPu^OVPki0b053J=3=gl_~p~_R0sQ@weZ3HjM2TlLYg|Z@GI6PlraoV_kHM zwN-j3%JzX_WC#EW_tN3}>YXPdJfeP$8;zU0u`zs!?DiOLv5<3cv5-^miPBGHyse3P z;ghH%9OXJ*e!OFJH~Z=yQu2$Bs+R1rKzFgllxDcUO)i>sH!*YJ-q`2e6NC?x+NY;g zEk%LN`iPKPJ=tg)SjMJLFU&^0?Bx?vT^HKZ1dq+OtwnsbK)yR> zkK&uSnn6`1*~ww^dl1H3*h3RUmQ9E|i#*dV;BmG8`c)5K!BMJtvrPvWGG1X(qwbY2 z*pfignSniQBQql++_zYmX<%Y)-g%;iowP;QRoYg#BaPjrE)bsJOmxEihu^(XX^mST z&XmY@w%AuE8Afq5HTK6IxfHDeM&#u1d^$L*>$S}`Gjy9$6g}z6h4;SWvV94C-*MOvK!b;m^WORq)F^I;!`mFD zI7Z?dw#iiCEUH2`V@Q#r5$2UgW3`cc-;pVlt&)g=En}mf1g7IJgmVp~)oCTk5S%7R znZ;V}bI-x>Y^Cd9?)am5X0z-fb{Um6*}7I`v}j;{H*el1rMVA{w{o}jHgIMe6wmRc zz1_PilREG)1)zlQy>rRD^E~LF9XeJTrW|*nROh)z`^Oj1Ab5?fqu8Wz;RUfu6BCs@ z2+R6}N?Ep*5YpgBOUt5K>vO>GkACeX+L@#2f){cI-gA7TX?AB8M3hFdOozs(@Ld!I zo9KnF7VkAok%o0}_Q*ta9(?|-ek@~$8^SVoULdo~p}|2|jF%)& zg-o)pYumh}pPJ-+!<}HtnnmF9_gYT&l11^~>rjI&NuV6%rB>%gSetkL=mj|^ai^jE z6T*3Gax*wb10EPX|0q)?=4P!73<0GF4-%w*#8;O7S(vOm(Q>sF16S zEtzplCNo@VA>E}pDf3)-$w8Yp{8${O?$A|CV#;}H(k&lJ$Fs^)U$0O)V;mm~j;fm~ zw-wHJZpC9uv_Fw*==L@6vGPt8-F$O!IC6H7Tph?4_aiYn`SIp)934MAZ6bZF=TM^J zSEQ0C62#q>Vp3N_Kk8d*)F1{-)k@9?%)=29GHvpT8_v5kyPl5^l4}5-AZFn{GC}D~ zle-FH6&nJno@IZf5t9XTn~p|IOh9n{$rdvzRGBf^2-UC(??^4B^4ch1<8#LAlkCA? zwE+d431 z`dj523<)Q%=<+4toWhSfSmnVYb{@2`M5Y|ey+*YPxv9(|#C6F%?dIpqUGz#3JehEa zKkV{!bay;+mO4MS4hw%uI_=oCnUOH8P%wid+=&)Et^RZRLbF{=Vm>|9X(+X_nj)NV za5`46#(ngGWRJ#1WHpZXX)1`C*?8UecwZaO+F#mqK(t;{WHmQ{Vr*v@*weX+J`m@J zZCQS3MirIp_;GB1DezR0jKHgLbFWXi%M^6Io-+tlv_(rC7wdX9_cfQEZ#)$0FKq+h z_g_D4f-BSMvP#jV5e0)(;i~b{p(McDQY92kc&2#P6CD5eNA zW5oz~9M-v(_#-;;*uGBy!8)|TAAl_{b*XbuN!BX}RK)d9Ae^@Rt;F`1J?#XAZh7}$ z|DlV82~VkKloNz`&}Z@n)T7Zh>6GgLVtAak8W?XC!D&FSmhjeV3b^9YY)#Mx%D*7fb1`eY32m16ln zU=;sbisdUC{a<25d^*dUXI>R541>Y`&Ka6yGD}~dt5N8!be3MK`u6HBa85XBJ(Wcw zn$2r&^zg8FZGAm*71uXb)w*MGs(?gx*HPwHb;tyADI7<&A0pPEQe79>Y0coJK%HHv zE>=_eZ$uvxz#dDnZX)-%p0GXl4@mi9i2mX-;KJP9Te)_Ty{CD#Fd;o%{^Ut>LDj-P zNQNY-57@ES0GYA;ue}vHK?}sZv6sU1SMmP2#1K_fL+Z8E8yD^KUu5q5hr_k_s_HN( z@g0Zggb;Vk%F?pjd~D#?;NW`h3xDB7t-j~tavcO`wav}VVzON@C<^$erFzBw0GU={ z$h2lY+K9z9*kUlgAlk9U<5r3M$>qycwY}@;cphv*lX3CPl8lvo5NFHc)Nh{#%5(Px z$JHz4!^;y^N&fPUB8A%uf-#(#@WWhngVQ`qCHR`Zt#dKKKerCM*E`Ly6Y$8cSGSt~Fw?=NJizkI{D zHGO;i|2E%qg_!&Q2{CtNqgFNwG6XAB_up;cis}32{{Of4B&?Xe|9R7wbdw7Y0?^Q- zX6k90mcF2uUtgc^)s1zv&7$ypcrA@04oX)|KMM#hAKMhZ11y#En!4{cKrv(hXamtt z-O=#XvTocCrKKe#F`&t*^ngD5Y4?zRFy|}=gOM25&$w$TG+AMF1C%ws1v^Xq;I{)n zB;4Akz&Kn!?a*D|^P8#HXD6Ai$ak$0UNPLRLc2G`;N*Q>%;XYbdSqcZjkX)jSiXbF zl9&+q;Wx+}lxt^VlZ) z9cn^^=)n;RuhjrO_(0&O-y=RODfEb3j!SB{aCh$cciI=j33i~~Yj8+^()!{W>(J%4 z)Khggkex_8+`Z<xt9N*qO z)DDPly=)O5KVUjPY%HDL$Aur8dRdjf9;?|i;NrC0ULMW^D;!lhX9LO04B~|SvQPNF zC+fK%8MCyEf73RvlMvaAE1k;-5N207zf}WG0DIoLrGX^tP0$_jZ>qP{_J_Jc*;ryW zl#MNRs~s!$4U)h6)H4yrb)A>3$wRf+!1-00owEhUqH5O3lP z)t1!o-(P%RG*sWi$UybI#a2MgqpP{_`=s7Bd|TO)GIs#y_dSmlPmbWI)vECefncc@ zFR*Vyc2c_gDc~Z}PkOY$xb1y0|lc&2roH?g4mbac$8rI8PMM6SaH4 zcs5)(O;wWy2J}A>%6^xmSNU&UZh!Pyo_@X&wBB6g>z7|{n^eUi^vRRzDZ`s5;;BsD zz0ai(Go0RA3XwwWdy}^U{)bg5yK5DzZE@*La$wn{V{CM~U z*f{N@B`SbNNfNAffj}W%4*fL7^8DE(syvr(n<`aYa7xSt*Vi8W5+R;BskCkE%NcgfAT%nF{p&8L?X|#EKX?Q+p3+$Q4T`{W6c^wxQ7wf>fHDKY$%o7$DADbp3#QMb_ ze*niMhOcy4(La^~fLK+I-?4*S_@}>!d{F^44;My0swzxwe}h}sQ?(9J`V8?DE_yl- zcAY>{tZeR~DakI(lqsa$42yYz~Qv9AiSZ( zhHU^bVmtlE zaUv7mL%qFR^1 zL=zy&JS6wjaMVEEiO_WE1_4l&k(D)Z(RBJf%v?vQF)~mzdv_bP6R};hE_mh8H;2XK4%aYrd&$BMQ?>NWUq~0RcNm7 zX1RCwg1TE3w@GD)#T=`~Ln4#r=+c^2CXrjRFT(m6!^y#+1ZSLmD2nvaC}_AF^v7j1 zkCbqfhx`dODzapURf1wFt5zMagXW$4w}LPNHsZXj$5Mv8Y`pI91>QU>`F%G%QrG1D zIL&M(9z)NPhhO8&oZr3oSP%MVJ3@$a4nk@ADm*9-Gc2L1>VZ+DZ;0%hYnC1)%))N; z=>2V7KA_fj$;0&h%`{>XU_T~kgBwIHn32a-DE0Ni2#2yxvJ89k(S1>=!D4w52Xg9Y!aRa1` z!!GNVb4mvwqKs6f&|+i^b$~1c*9SM=OGxUVFATF%AmY9Vb9T^}BSPmaOg%tK(}+we zrYr}rlW0W!#O$8%BQDIL#OUryMH&6P12TDS9Rv9c=NfkkPRIk$)5}0%{aI#yJ3nVD zAoidOIDpturi(H%%I|%0X489SNU({RwM(mzL9w53B@Y_nrSG1{Ozvx=+`L`0Z2r*= z6*9GwtkeL}C*jB`HlVIiqUWsCXT%~K1*aUT7fSn;)JK}qLQOc~Y=eL{8j7if1Dl?we&ZQZyoN!FRw&_+S zS$Z^~{$(SZv(Yf^?|RJEZ#un@e8hw0GDI8BZm{PAZH zVo6ypRUr6N{Y8KWpj;Rpa|s3^yI!)L)^k`Jg-R7^w&jp-+F(c|_xXef;ASkeiQ?cw z+D7xiq=^i{mXpAtjn6}-1?o1XGe$-NpzgEVprf=*u0|QWnA}}lSPr=!v@ul=6Kowh z2P+wz5?Oa)(OX%ktUna3iI*D5?v2V~QU}N9C!Yu3Q|@}gQ-@~a6{}}EnrfTn?tGS} zHTRJ=qWy)Ym6r?Dv?V}1KmPT-<6FSH7TJ=9Xaea~672TqskO)u<4ar#K%eVRO&N1$ z;e=6&x3hsoZ^v=YobUMjnN26&-Qy@0+}2ed|2(HM%}A}hoB|p#x_Z}az~9NNPCN>bFsXyp-8_u#p7g)}~Mq|so5clp> zl~c(90ZeSK(zO3ECB1O}q1i!?AE1t_bfaT8j0+QXR!N**&gH2?p+!aNLnu#C0AWSC z#sQ@I2fOxw9;s+XL8q+u}JE=kqjuwmu((1NBwYxxln)dCY3e zb=G8kEyOb;^ zS;1}T;n5f4%Eb4=8P3jG(ljz9{ZRFZ>ACfKr9TxW#NKpVst)&u5%p35KEUm`x;a{GBc29Miys`5s!1-Ra zpu9I6?Ryhgnv_XH@_WKS>TQT^-y7630CjsG?|U^**m2Fk{Z`TaxDK+0EIvaZgD{da z*wq;+k3kZ9TCZh|_Rmy16^Lr7u&xp_O2t9?T1|cacOCxs6jZediqMcL-JQQ-3-*Nx z!3fxctad=W2c^f(0yZNMrx9GQAdpS0I4EcOV5k6q79|kTCNlCtO`-gawbEana9i5f z>r0=cHg`VSAN8x6q}w4-qeZ=n8_Ne*<+#G9&M&8q;n4LAFDZgh0Jf5^FSBVY`TGCG zd>ud&Kay4SfkUfR&kp$a1NHacT>1?JH2kdv0$d9ceq$XsT2to&{?u|uVgR7Ix@*6# zxhvI1S=IGaVrQHDvnR}2kX`#DD;$>cQs2JbWE@=I5k%;LV#&q2!IwQ}ei*fScKROw zvNmijSlr213a>Ok*XoYI$zRuR0QjIV4NlvfzuRBiMQXMFE~_1f1K8b=HtEZNWX zhZc(fScP(pF?KK9vjKZC`78pu@P^U%`IAw8{*P$sp9(&Qjej@;m%bOkx27QD;de{+S+Y&= z4_S6YaI#wDY#>13h@V%BX#wyShm${Pezz;;)q1Q=pqPc1V7)=!&D((d<7Z!!vusej zIvfJ^Ug|CyHUQiPfpI{S{k2r8l@OlWb*;4AFUMQ}_^)-yDD{R}&TZL0yxUSgd?|)9 zpF_!ue)}m@n+U$i2z^>Jdn3M-+jXNf0OLp02`NC3FDSKlBBWLOgqGXy!%~Ydn)za2 zvx^7aKV{HNeGTq^isn-P4A?Ej+r6KBG_qWiQC(f#*FPfhDN<(1TXg=|^LiJZQQb_Y@MGvz?iRI zdYF3woYB2f>V*lXYsutrpFD7l!8uGu^j_jY&4tTv!F^wolgzVDD5tk}DBBF%W#4-B zIzIp^VA6C-axQ~Uo;m>NGpqLe!8%$RZUff^RD(V4+(>;j0S97p0rhIdj!z23orlEcYVX4wp)M$b$gACwiCdB?@Npv;YNSzzxf@j{9(HQ zcydhJ+EtPp?XM^~dX@{%wdeAZknbOd4G0Lj_~`fpg?CE8(3}#O-p++@zYDeCEoU0n z`T2k+u?G|i1i0{}5dzrPo(-#h-2aF2{f8e)p_`gso)Y~U>4|#q%E!gev%&7UeTrTciII!SAle=5YRdbH&)%UN>CozT@%)vx#mfFhjw@(F&v5OZAI=DVKU z37(XA?9Vt;m@wAE6Lp|X-m`f9at9j7&+9gH7na4BH4gjRC_DPvB|!J*%YdaXmHXy4 zz>{OZ2#N@lluqw#qhKevv;;>*R6ABLWsm-{SB1x+JDuciKFHZJYW2gUT_7;cm(~8D zpZ)n2|MpphSm>%HpX;4$;G*(ap8G*$zT@`d-3tFwnVC+i5#P13tC2{k_*NeZ-#TP&F_xP`02@I*NQG^yA%ITCm`7K^oqn zk4f5E87%V%1mhcT+JBF1JPRxME`f?@?Bxgv&P*8snIS!`cn#RnqP7R{krOq}m(wgb zo8j!Lx(D(~%T{?7rHxx{o_tjLB%$0#NX9TrXFe-?3>X~f)E5KPyA(-UXi{> zN4dDAr9YI06FQ%=CV-DNlWq=Ti-My#U9BM74{ z$ob%QG%s}(fUn)Ov3z6^?VO|f=ID16{a1OV@>Lm{A%XKKH4TI#>rtVTo#3v%FZ;hd zdzf3VXAybr8LX}`yHUrV_n?2wk~ZW|YoWgX3#k6q5xRvX-DleSNT<;mcR*0MHSreI z*PIQupyON(pYzs41@AM<*)-6V>Z{7<ZmbMk1}S*8yc$%b@=U-TP$>iN z6H3z#>1OX?2ik&g5AZU!!r}0R-G{Kl8w0-``K6_yE$em6SsM^8(lo<<1Y-2MsiZ)f^Q5;bRoP!$|^NdIe!t;b|YxzRSx1 z@*3k%m5k`!y0oPJV((XZ?E|%GEAq#Cuw}Jk@dGPlK}NG6a*yZx{(JaUV5=@}7))PA z<9>hH1Ax|mVqyCDzwf`_)B%=tMezT$6)S>YN`+Q5en|)L|AMLEc;q@>;#sxI^Kcar zbJy=GclV!s9j^k6=9n=2pv_qb(6*8gHaRs^ylkiSMw z|87NBG-O3XRy1VA?fy&VwIYxef&5d7_NTF2(U27lS<#S{3~VI>`xiT~B9IkTrLXr)Q*T#UUcM+%Q#YBm}Kt{_7oJGTDM$QWS zCb^5rCkdvGyN@c-9syygCDxE`eq9pA1Vb)==t|r^OM;EnT@Nc`wNn!x^I7p)yIh^U zxprC=Gw)B;yMt6kKoQMEu8Bb{lgJnWI`|N&ET0qWiG=(O2_?l3KRB7y=;@Onv zNZl5mEnpB)m@S|gaoXvQtuGtJe8I#0_|fUE3e{m$#+Geb@W`RqS~@!kK+6g-|AdC z3zoD-a>(Emrd4Rk%>kiI;C&(T@5fs%U!ooja_17`r`B4ilzYtk6d&70fuJ%G>zYCa z63+VeSUiSkK;y^f{`pFxi$qI_r~0&Qgdu&0=pcN&LdmVDWFqo{JyPwcmazK=_)w#) z^JFQCFC=%)yN=6$K5}^eru8!&quYz7@f;jvVM)K!71K8Kp3Q(N2f>P;3;Ja}-ZVVE zvcc)XqSi0iA2+>x<-G&LHM~z%`0bp!`!GB@vYk0|iz!IVwtL`S%s~#G@Y-qz%hyGa zhrLAi@%| sJwl^dyJ3BdFN7>3BLNZ4nnLQ%~KtQ>y@>K{L>HUhK{(!`sQjiT?c`F-tjJd!?O!!KSW-(xT!NIrUnP_M5&oQ``??()aidpZ85Xc_kA_X2+#X^-d zpS%DC8}ehnH}h2A1 z?}P@oeBiKF5=xvHsz!&BS(jb+Lh#5*F4`(VPZ8ezfO zV+0c$WMRY)dl<1dFt73Le)P+;CT+sj#y8KN%qDcC)A-1sj%s{YD5n;A7}+0ah$foK zwk-4}Q&><)5S99>sngKVF4J`Gu5|8|aLpbrQey<}y?YO?`-3Pjo|lq)|HSoKDF}qKRh3sgYo7SY1!*T2b7X#f-`?4JQP|93R#p`_z9_fYIut? zCpiSEJ%g|a$x57l9JBfr<#YaVjCalW_TUs`k`_~Y%IToOT=GVwt9i<^H`JJ*_q30s zak-vC@PykyaOzoEB=GAtYB^b~m{ULWm>q)sSX_$d} zzd4SJvKOtgRx7+aKpO_NQ?*hH?A)Y=f{7yMrQpZL(H!;!Vzi=TF64GayMY(s4Wc3ftZ zJ)J)xeS&<7_f+&eJ$CTXyLxf8enEbuym|U|m~34zM!3RcxhdKWM+H?c;C_J49X*`M zyLWKj;soG4dA*6FOnO4Pe*c`zl&qLf$ZXh3f#-ye_FO}(vR7DFY?TjI8R-$hMs#K>b966Z%9SPMO=eOb;o~L~MKyKS;gj{_X5(5D z&nl$0^|#SnH@Agk@SoO2f+Gq@U51{ur&*-i8JgdGljxx7egEx!*TTw+!|z=mv?D}? zFOolm8&@xBbu<`1>Ii(pOfkg0S`}MNFqYrFJ_*|xZ!SOl$`|RgV!hVuHaqX#6SNB6 zsp!leSt%?`E*!6#ts3i_W@|5=+-8sp$8U#q3#=*GpE{+l`Lky6n{CHcW z^0Axe$(u^D4yqcLX=4s`j)*a{Qg*v~x3E)&U3Mx0stDz`0}l;(4AXY`=FAny%@~|W z4ztrgq>t}r%y}U&tnO_Fimg&D8!pb_XOQAisgUkbe|y9!QpR2;)=B?D>s#n^N&6Rj z-Sf%TQhW&pJv+D#*hvI~#06k7a$V93rd~b;icxUH>)^mrtj{EHe3~~e!qB3(IyIwD zKNMx=JfVzWcq;Qm`-#|FQUV^~Rci>FtNd2~xSNBoL(kIASG^ACq8`C8n1NxKp;7rr z83NrR6Z8C;vQH9w6pJR;*Oj##xNOsfN`S&pl=MyHyQ$HB8+mLILtmn^Z^iZUR+mg} zp5lVSM7pG`oWexXK@dS#{sK-`g?gd-WgTQkcLzI-!;ZH!VYi)QNep@@&kEg?JC!$# zpG{tfRZaWO_#DK7UdkQ7!*A9!5Y{`H#+#U$I1}|DE;hzVHjlX%T&>9aPRQ6Yw^K<2 zvhi+}%ck$6uS1@@9(#;1bB&-f_H}0sw21z*?1NRWHSLv`iD{fZH#l!eTS>QhY|Pn{ z&Wota=4*7$AUj2)6AYCky}km$g64<%Cbk>XqaJ35VXH0!xbHq2Bb!Q$`p;ogV)tOp zu`B40tC_$aeg3h}A@O;bsE{~3+>ZS~|Dyv}6RfP(xNDq#6XDIe5UJx4rg{8-`70&=aW|K}1RZ_?f-;eBcl1xvrzwNWI*T zvm(6L!&TKksw0Np=MJQT9y@J74!8E5o~=csoC>`BfwCky^kgjj?Kb;1#!I*JtLMR1 zGE4L|(7uEjjvD8P&Bw0oYu#Oi*V+U6#)b{AP3uRq^4} zs9&BR#;)V6kFVi@#O{}f$TyMZV)VYACmt6hg9%}!e1>{WLB0+Ai97;Kiy?v)hR8U4 zkJ#?M8k<7SU_cfRxa8?ZJHJ*o3-KOck(w8SpFdDFD?u9ma&!7a^vunP;FXBp!U^_9 zp&}Y}7?ya7Fd)59+DduxPBf`mO4s6!6Q1+(G7|kHkKGk~*?GCf6ICD-kUnsOLJ0SE zoe6Sm2Q-Q>Q<$8Yq9PItkj6wpLncE)2U5tuDT++~cls$Z6B6nl&ry(&f-R8He&taD zuD8D^;JhvK=M^>PH4+AJ2L?{}43xieqaiX-|4O5l0Pm0_)TQL)fUCN(qp7K_(+fN2 zP9@G;%?D&JtK)=(L`;8sBFm}K?E&?VS!lqVVTuYu#&$OBa1%QtQ+9V7``dbu9=i(x zNgGpVIJLWtwXKtoy9n(cIfQ`p?PCsF>OZnLTZz!Z6ji9D>>N$0`PezxIcY_)sHv$R zJDQjYsYyTmRUEhzp?%@(Y%j#Y;pXPX?#9Dz=V;EsB`7G!!O6|R&CLenU~}@Yb%wjM z**ZP^vy#8+kv4TQcC@f}wy?9MzO5H-War{6LQ8ww(BHp5`)TTK@lQ*(PQQi)43OjY z4F?xHC&%A)14SR-J{3~2a5uHqk+!e_Xa=+)D)@-|@gMpBUvK_t@wbw&e@b$3@jv># z=x?w7x2UF*siTyg4bY~u=s)xItMKnHe-(VpaXa+iNbx6~|9A=zS`_Os$KR7CiY0+- z5edvAg@v@T25<#d+3gQ`4ESUE^Lm@!N$%BK2Q*@FBspmb4R_?NRE$@{Z6sgUurxjK z%lyJH&noT){?^QvDXrk4D3zy$B_v=+o5fuh8bfc(hMYm?CiY4Dx~;~bmhLQ-?v zo&KhfH46O5cs#f~9cfGspc?f%G$zQC!@BZO9eL_E_efRB)DhWt{YPm3=svX{CO+l| zsxP7nfn=D4@+iOvkb(T@uNG{MbT%x zoq-o%fS`SAUv>X)0{)zX|C@mS+X4T_g8q*M{r`gjDzM^rx>c5%Lb-^|6d;kmn3?Gq z-x7Pv`~Nr!`2IvFjcvY;27qIC-bEoqI4%huuvY}$GWcmB0MQ1KV0ZsQG|pd$R@+jx zaf@hWX-GlzeCXg#>RW)#6BRZk^$vlA{Z&2Fuj;>l{W`?}RL^`{{f5JVSu22~!8oVA zN;>1pX=AroaSIne2>!&Iqp7>QfAo(DQhql|{0@LBG*ZVC%sul`CaSm10*A_zKd~k! zjE`@Y55PVp{EV_V^~hL$0$@-=Cbj0S-L1X{jiR@}4jj_ye`0IqoUJ>?A9cV(ZC;^q z%iaQC!GMy^9V*)JzkrVgfWuqKK=Whyel=e(G#-v+>qxm9IsZM+nyLSAG zkkl8yfcVPwi|`-Vj|H_xrHhjILyGWm?dCqi(;@uT5e?NpK{!A2?b{kf6uKyN0903o zmzMhi6>s~playLfmj1X@`Hx|WqkL!lL+D8SQA0k9d|QVK%!r)Y59d}Qc)d}nj%W$) z%>0G$8DYTFTf`=^v2L^hD4Iem4rk7Nz-Y$+AdhpW{lHdS(ABbs&tLN?`fENv&+Og% zqmEX!h>w1Q6m^k#b5E-*M}`5Zi{*;%8#5~lOTp3Rf&VY+i=)&@{Yj#_Azyb!x+oBe zM-o$@sfG|Bfy75NdXr?m(h&6}@^QUgMFhg8L{}y{e@(^muU40R8x|>J#62)oUa;VP z>K0CDReM)dIFeUVK%%AX;c;$(XdZHm7MGCl)2(#1$)3}FyD>6S@3P5qRo_Vci<(j5 zJ9vK%dFLb5EC{rW;x{;`rm3%=HCm*Tid~~_aSBiXeR#xbSmQ4FBbBPnQT1$k`S@<} zCXFsE0?>UF4-YJk58X;0js|u1riO^Ihkpq(o%AR)x6)Eq_MJ8_8enmDs-LrPh#3+Q z66eLUYUQo;+zj^onA2&WMGnfQJLj9IO)Aj-?5Epc_Lc=49v1_~l9$Ug=KDqJKSjbn z|3h$)LuN+`G_^Ml9E3o)~p$P$XSwyFOut&{L;zlqe?K)(6!#GFR!6Y1|)W z0u^+A`J48?Cy2x|p7y;fP-&h2*|bOU9gXE>W)4t(m|-Z@5SYTT`7(`TkG`hDLb9 z-+bfOa{FVCvLuP$4XrC`i(OAhUo&no0k)w@3uhr-yyZwywyt$`o$mhbXXlqZ&ui)a zqU=Ak@MDqBaNT}8Tw(fBUS;<)GrNw>tJWBF)Izgo#l&oUL}J~RDQ4fk1SkJT&sB&( zgv7)J8zWW)=Z9pPXhbn6yBv-Ab<|Fs?e)sZqk@nYSo zkF3*kFFA&UnIWn$N8RA!l96IL@R9kJ5N&xR5Ua~9Os zN{7>1U{&V@B2+*7qK;%pNMS+yI|5n%)z+VEPaI{Wa7^XN6RVNM_Hcd9f{I#cxZFFG zAo{U2Kl1;~FAA`icFFvM));LK6k1(KJ0IcBfAq<(K#5uwhLTWVSrz92my=!1_l{49 zq~}{M%_*#5sk(a+`m}{;JgPxy#71;mk(3 zZ${|aY*kO-I4f%)s{`TF`1$J?WBjuwY! zC7PraX=}9l>Ox3`^#5ZCApzV24)nto*Ve zUqek&@B_PbMiv^epltVH_cy=b@%LR+z~ILjnElh=8$S+9quP>74g|G#V`b_cD~}Be z56?b!_Xj`uD544r`w?JV^&k6?8Vx0$8M5v^svC}PSH8H#yCcU0X^{s>)QyE^5VoJm z?N5>djXVEm@j~;R>W_ewOjIzKVi|4c~5(@r#aaPQ-8m&HqMC@Z}e7k>Z z!hZ=6z!18XsdeBWZFw2}LESgCpW+LCyx?kTRZH5`^W&>xVeS%91>q*Pf|)p@|7QpO zaZ3knriUzKp>3%8e<|sC$0=>^#Ttz?qbkSM3eG7C=+bm>h;Gwh3GMdD(pScUGCy1b z{k|rCrB$*)8gXSBIql2g#1G*iv^njyf%GyOEMQeR{dq@0Rao~*ZjaaBoc*7j=+{e- zhY9b(j}OZvotnf)yt&kKAi|6P_K^uy zf&_Q3&G>DxpnP{rV*hiXv{7<^S1MeBDf36&=ZTb$WoWATCI+Es!QFl0GbeXD2;vk( z`?1Vr?dASs?bAKSG*N@GFyXO1^>>zGR;gKd&T+UgoX@HY&F@8$QSEy5zRcwRyQn;@ zHOrzdvwe9aU$69I?Tcb~+)$56Q9Kf$jVbY?&Qkop*dr1s>j||c97NJ}s1I_8KfpG* zQ%mvP=p(Cs$pDgh8ch(rlt1)8ppDv31C;d;vOrc{8)z@RN7h5c#!zb3_bxl%|BaC^jZ2?G5}W-Q#+-qZ>{sN|I1$U`+kuX&p*I~o@YXc z2({FoSm8%7xmkNNLC(Fofj{vD_W$Tw-XdD}L&*B8nMHYEo7ONWe<)i%e4kOaj2hJN zud4rC+!z=;v7Pq)X7Z`EWnQ z1k$Un%_}Er#9*$|C-L5eKGCq8sK_o*twbo?)F>6}SJCE^@euq+U4XnrAS(l7f#C7i zE^~D$SbMiZnbFLQR}jdr6x-h9;82@&XU0s;vsKmfx4^7%0G* zDd+z&r~Sr69OJ|bTGb}3?Sm}0-*NK`SZiyA<+i(TBH5U&zB&4ss1lTYUlrtrkbpC5 zs)7=7%h0eC{(}#QqdY^&$AX@FoG-S-=Z1xarDU=|^}BW87T+_USZ+_wztRLayLzEk zvGc3khM0)FK&vVnR$?f)IF%T>9<$~F)S1L!-;9h=aI!sB`27QwdQSq!fb%{i^4~K^ zEr-I44Fwy52wIBuFtlqc2w#_JMC&SK>p}Wbg_Q%dM_!u;L57IpRg&}x5tgGx`4M7G zpEtg}53u~686;_c5YMVz@cH@z>T`9hy^)lgzWTgMQkNE+-tT~*_Iy=Oqh@EuMPjdK zw!y3B_F80xN1_US57Qv}`$o z-hgy5#-{wXV_MkIWSgcs|B3tl9yb@8rGwtn`-uhGrR?R&?>5bjcR%0!c&Z13DTXtS z*SYWS(i#!v=aAbKZCHPdF3>7|$HKy{#(J&y{`$<=qBo#ju#OHglCLgf;Iv(3IUpj; zh?6F2+8w-6ArZj+K!8#q3D{4AjCe@p2w4Ip=PoF<`|syT!6T-#p7{x?0^dQGP2eY6!3e+>lfg6t@IKeGt8me6wH@N_0ut zM}SOuk5!xG+b!1;41J?F+AO*Hl54(={9H?asR4|ajc-Dl*Lqw<+jYXQXE^f-wt=@^ zjqL}^;k@^!S7%F+md6{KSfhe^HY2*bdX4VomXjYtLs-x~ry|zT$}M+N>S)=Eo#K;N zTL&3hZF>on3*JhrK>4n&FLyVxkWr6<#U`98MCQKBP!;zJ96}8Ghya~H>YgamRAKK$ z^sDgZ9~~Vp_yxAw!at4qVVG^36Yi!mc8IPF-^9f#tBGC3c{8>NM*mC3dyoIB>ifM^ zS4RUe9fvOBcm?D+-@|x56s{>%!yE`iE-%$6v^21((GYx<)2dbvbS&9=;|14Cwo53R z?vGKU$&VJBgGLp)F#qMTXNzHkgb0w7*!5mOhz#H>xJ%CG2#LME*i=SWMH|T1D!$tq z;~|6>J%54TUaVED%c6{8PD8_Ti7VDSw3gI}hd5~0u-Sg+5}itPZ^w2ijk1*OW3LY! z^mHgkF?NO4CJ7y0A{Wc>F1#!FOxrx&CFfnV*&}y#rE184(5AIZYbfK!M)TVjrR=Gd z*_K5ZAi5_RI)|&4^UV^LOF4=o>dGS749aP7!ya%GfcM0EnoSF=4Kk)b67PG*+cU9> z^&9gMe}p+s49)o(+D0#?3R-KrnHA0nNr3?*(IkM&eVstAk9pIP-nT;vyu;~3#I1^7{CE~pCfLxB^2TbW+6T|r z?#w>td@3O+`(Cip+=?wH08@!`(vO(O>x4p3SGTS;W;-m$YVB~XRP1IjEWszwV(4vq zc5(h}mGe4Sv*F}vMEF>v$KmihUaOR?>M}HFwxE+)N1GZ8-bk@QLp9l*{woQ{dxfz2 zGUv|s!3C_Pjos4`{+DB1GF0?j+1K_b9@==HS3(&(3fQX0TLm9k4u9BK2!7yL{h?kG z&Rn1zaU4Ml=>MwTmPI`OOy3y+COEutQB9>upD47O?U_Kw7`bmgst=qh}~=n+45CS1L|)32r)Dl>@adRyQQT{f=GM0@PrFG)mE2Y z+5cF|=dh2z-}PIVn|Q5?H`67BLv8F;oVv2+TXNpfDP<8}Ee!SD;r!T*kxl9miw?@F z__3?gncP{=O~o~eqUE)Ers{Pc@Ui zmy{Zt#npqOX7=GfHwrmMhV#|OFkI(Uuu2@(vr&&DL{6sFc@s8iTXK)HNeqWK&vWak1OBVYkF}##DO*zF9ny zlWbd1%4Pi3`FJ8Xy#SzqzGzm9rDG!$Zh5g?Gxy9qNysJ4OhX$oc(OgA?y^0pxzHYY znI!C1;<>Vtu%go&qMhOd(PXI2^}UK1TjM~OU!VQ>uB3A!-{87E0uQFlaa%aV`RWVO za`(AB8VSDE+fRp0&TJ;InWaM&U+k&0GZYm#sZk ztI9q;^+o~ z*-&%6m9hQvWXkU1kZov!lq8+Y1`h*vs8;)2^yhnh^qNPy87>i77Iv~RTY{tQB zi+XyQlyjcWWpX`Nc#Q9IdnMVfDgQN2)8qs?GMLALUcS<-UxP8-JBF3~&VJ3?`|mju z@5$q3^$T87usuav39X?*nG!jjE~J)4qdzN6bKPLZBKFA7Sxb82S^*IZ-~IAhP%CmamikqS!-Yi?N@fiNQ>uf) ztEdnYCYQ!!R3In3QyWVr>RsD2Gfcq)#Vi8oA|L+BEL|tfYsaHtZogwwF=XZPyf%N7 z1Rs<>2f$g9~68Xz#pQts?Ywr##fOn9_1cLI!E@1DcQQGDL@}E4Wt9|We~^+GO@*?274#$mSzk$ zG35C!^zpvCH_Z-saI(tkW3>M)?1quM6}%B{xP(ogDFn{>$eMhjWGD2}8V(}HypMKH zUpq>ADpcD_>Q>K$4ZXTJR$ohVYjSEBGjy}bcoGrYrRzsMRO^tW33mN5*g~fVYlSH5 z+16zXE<Bx-UcF3+vW;LRmAVB*KIu&OO%rCMZGQvHapFRvE0>;WAAuwpT>W zw@mLY)uLuTepkw1<@txl3VRf@UN@*~liK>eb)LJQ+>A>Wi0Geh^YmjO*(kYNwDuGv z!7iy=3Vsw6mOKhxWVd;MDL?mK3d06YvYSO4y2kgsITQ=w;9Ak+FTTWhZ?YAvuU=Za zC?D)+fS9}JjCRX&70MURxk*L3iv*lY~vd9h}1o3=1 zmhmQ=6|#V`J>|Cdg3ETGtP>MzDyfn*5=&F_yv6%C9qqC@mJK4I;a|I)fTx_Nlq$4H z3M*(z&<`8_K{@Wcgh65ZD(iXeXY!W<{;fy_6k5 zWDb{<49Tt%$&9wzRNi}j#6~BRRvcA*)l>Ct@#L@XX%a9tZKMRW+!%kLa;sh_IGQj| zx8moj6_?CdAIgnvD(P~b$nd)$!?U>;k1R4cD{`WGb2)dTKW7V5-EcNsJ8 z8HP+vtr>ckknvjQ8Dv)z@iDZt?Ul`%o*JFd>rO5PcVUMoMv7g-eAspZWJOM=lpA14 zOD{Nr!&S`m-kbP$K{*t^u}9TLj8))V?$!C8$KM^Gyrc%FF)RkB?kVIdTy^4$u-Bc@ z9s_dmgbvEsl{+=hbVE)^UY!bJrru3^%4STpXtO|g<*fXa6&rq5?JnUx-3pbZQ1IbR{!_~bUHE-K&I;8(;LC97Y6l?i^J*4-M@ z=Kgx^PU{|BGB-WDsU%FYck?a3s}0gzygovtvjwMv9&c4-b}JgevX zL}SZU%{mdUtzTkLfnyADoAoevsi_Shg_2=XiJa{0n0TB;%V+{&X2*Q`t4eXTT+eDa z^^F&;N(GIYH%pbZ#=_czQe*DU`i#xE^&oi%ARTY8mgd2~*p`J4o<3Sw(biuajP|*# zl|~u^rQHol0tEcst*fodfnoHu^fl|`cqqm_!tX_;vw`2fWgn*b*;=krc&#%&qJBn< zh9R8lax#Hc?x5g#6fL9AWzXHRT+vf%zsPtF;>DxE``n}Ci(spUfoL!kVicb}5U@Mj z(;E)wXq;z3Dak5r6#9PbZP&EUzzc7MDv8?ZBs!Ge>|c4KZ^=BM%(jl+`+_SrT*)I8 zRBTA<*jKgDjEd{*x>V`n{dp;6+r3q7uE}SFesd{w0S&W3hRVf6!OO$D_rA@(1(wge z-=zUp>4P}&EBgQ*5RYt{SO0|BkWS{OjG4qoMr}45b^GL#ANjSWx)!jA@tw8nJ2ka-pU;K(ZMj^O$Z)p zIn1f6kVYJXm+Kio%ro`fh?WLIN+N($VctXNR`!USo$2N$E4zc(&7w+G5dD^Z?H<2F z@a2?XL_C8cS@@#Xs#*Ybvlz$t^RGmv@bz``ulZVwCxOfSA!8VWKaH`W_EOU?KUcu` zXBRmI+NnpfFsR(c-#)lXoN#7aV8KWbjO|CbD;U1Kil3b}OSWk*ups{=>h!g@8EFW> zw(x2`iKm~vl%B#`F_ut4^43MXIm+oJOXTa}Uf0d&dtK$qf}>g-pN?XBu)1SsszNu9 z5Y!{J_u8UCj_lGrc9Nodd>}2=vIu!TkM>9@TtNYbPLb|bmsy`(A4WWKBQ671or%Lv z!q{SZ&hxyEr<(Mb_d<#PBr;QF2{vVR! z@l#IL%WDY6MbpY2*-lqlh9lTi10$d=oh=xGYwM|-H_hNpA_uoe-ZbJ8gijz`(-lt^LXI|AH#5ZIy8GO&+pN@sDRbY-P_Cf#1f{qd5wBhsw--Op}r=6q#koQzj zDM+d9Pg_Lc=b>SbR|ZUhB()Xx()T}5r`&lXJguvcgiu>=9UP>GE`7~rj>fvV9B{;7 zH#@TY=*!2gM>i>NhQY)2Wd5~L5m#d?7^(RR&6ct(!s1(opX(-5gLppd(G}f(yq54- zctx2>1En7bLc$#n$Op*p;X%s@)^3k+6ohx{f(`l1(+x_}+oNN-o}>GHQWiZY^cl7~ z4ovOBgnIS7apIqKu5=1I91vF44;6K){=|CH>*Z^N;D0GJg-4I~0TWc2F0$X2m=#{$ zj_b|-(_bXHH7y$U6c06u6FLpL>hYI0kLkiN$~V^UWsgr(P3#(=tF4iE5#X{=IS}Cl z$$PH&NWUmd!E>QK;RwfP{Iv?Gg?qx}u=%q2p8T%%*DKt|Otz7!M>M4_aR$V*tQb_o zJ*Aj7erQm-Sa4{-Gl|g%9wIu3M58~oWzqG|qOIQJa%pN8G!2;w!Dij=5>_Ma_GD7r zmbDuE7Cg}QW;jRFx6Lytc$Y-WZ)_Nd90--BcdFEs(3jVNfhkcI!HaP@G28%Lhf4^A zX8`UWmhvJSwwxe>08+SgFYX3l)|vcnL=1sZFN9ue#2w(4cFd;C<0|MW$JN3^iwfNJmM`I z)WC;*ujXlAOB5Mau&LPpOl#OZ=vm#W40vl?T{WaUg_qvmMaPP#Q$17tq1AcyEPF~%<8#`s35Z=Z*tY7jzGK4}F+WkONNgy02p5~k zIzL|=Z+0CWkn4W{Y}W0@VJx#gry`alp@#uzViU%Zg1V*VF`?U|0v3aGK^X_K_9B4| zlwkeR*Y`d>lc0D~!3J+6<_!)FdP9jVpN_W{$#$o`vYO|KzWev~jUOL+1fElwaR+!k zh%q2Wv3`%YAMrKpI7-gG_~+Kp zy!fuy)`U(&#=D;w$3iMCLhFr(1KNo#-?P##cODwvBmbG*cWr_oM8v#rd;D+dEE6o9 zg($9mQbA;i#j8X7=Vv zPwe#xq%G@e&95$cIN0H!R(#*S;1Ts_*PgEcyE((qVmtIGqdU$Nfm!q>xXHCo2-LQD z56AYvWE0F4?mA&gVjvP?X`kDrQ4y5gqHRcdKaj*PabJH>?inj9PIYPR0ShG#MN0qy zy;w9OX?XT~{^^X9nHuxVMW0A7HeGKX4_8SQ!P7=3qUnt{^pT9=R+W!i)gEth>o1=O z@2GffmFG64u|Z5@y1sW%d|+?fqxHF~$65c(Y<_d1@=XJ1*4B*V3$$2otVCC}2A!!5 z79bldU(rt8$fPWIzFeF85bv0+2FLB7dAq;&o_PXMWU&pvD$wiYn=ho-DM2wdMV$DL zu3ND=zU88Upfe4-#kTbx0oewb2cJ3y;&cc|P+Tx52TUE90bdZ?d(O8=vpMMTGWwRZv76(%3Kgw`uXX0-+e6H4-(<&9 zej^u~)edWqK~|g1F4qdvjwpw3bFT3}!z@V9a{SX~Ew8ydYPiAh9D2t+x4&te*E}ke*bcD=xXD%(EH=xie$Z%D8H@!=JNWClo0#NuF6=mA0yHxnPF=1ak9q!^;W^d;L6 zv3Z&Mdij8;kY0T&IMFXvF2s(2gD6Zkv5t~bgz~kkJl^b^y03j2}igVdl9$r_+V^w>$*lzh) z*|Xs)umkV{5C-;_>s2~dJPNi<6yH08zB2H{fteD{Y&iV>=THCpJyc&fzH?8tXQvP% zs`aT7x~gIFM;Tj7sziv!@)yKxx>@F#6}xP+LPk9l!-bIh`$FXq!RI$uDO+7w&<{^V za;j&|$bFs(*+K>IhqRU6J)WrJLjgU^C^M|zs^|f%W(lF-bu8#C^Dh1tnHEEm(&@BU zI>FMNOud_>NNsH5-qTNSK$dR<;F!=PGshX1vBIm9Im0>DMW?1Pb9 z6E@?uPVcHQzJGwOiJ+RZ9-=b~+i+oCw|Kej631!o)@+7RVv6HBV0N+h5WhT<*c@Qa zO)F^rM%UZ?I%(V=%s})i(Q;4#RA7tNPYnlY`C!u7#Zc}|Z9&aE2IUwFhXw?`bZw+Y z4+uuJVF3Y5)LhuVk?)mw%})6Oqdx$;!V-&vm%E>gE0){1Dd8ag2MA$(Q}M{avbdru z@T(T1`~oa!?Mu78EqA}_=sCI&K>|asKHe1p|I2qKcTUG6NQ~Dr!#T8MD644p93nq8 znYv^oDp8hF^bjLh3X)A`8I)1|G>Z()>DYnn+HK7bv< z2l`s?fquRMmK3b}5rME0*eIP%uUf%nYg~11kqgW;MLfPmeS~>rV+IM}MD=4BF#*Ja zF)tB257%VwMMRfz0+BN8*8S#beYCXt=onBj@>L^6H>|z1_mW!7JLtU3S^*+?*s$j2 ztLNlFIX<-!MjwI8o68gz$3u@}T_fY8Z%KUkZQny)Qb_xLki;hVvHs|fJ z(}muhQmfIpzSX$yfbfEL@DBb^mT|pvEOkx_puZ@+xnDW=to7|tqO!o}8wAgM+X+A5MUnHoB@M@2dsXz@tjheW$YyUDAE48EKCNz&d63Uux2%@R zn`U({=f%tU77WS+E;0D}$022H#vX_*15H!p9L5B(4<6kEl&>-L&|Zs@l~1QLrPa^G zW-d|$ol;-|B?_YCyG^G}fRi^zl-uKg&Ly?2?Es2LN3DzFiTWmLOT{HwntRYe9AN*zzlYNMn?#dY-Yn^Y=-E7~3t;EyU)icy z1VIHBw%ul3%ph$dr@Jp33DBmQRkZkKoYi@ECiV+5GQ@YEUVc$HD6WZUmgp@#oef&L9+CTMnL7C2&2urt7cCfGX~(BzWtZ+7&hqXRB6G7USv1 z&j8HStSn15S#&?pbFT%%2<<^H zZEzxAmDQN*fpHnG8>ikY0Nx~Ns@p-;Tq{=@ey9c<4||*3E-4=x@N`nTZEqk47)?;X?JUQ6u8ZQ@bkJtjTo z%D0`V=SKgjXqjN(#@hha%@iOtU3ni&r8Q+!^Jx~nWp}HxUv19kv^W-Bvd8#?OyMZ^ z+s4#ZFoL_!JcT17GYv6#b3NQ$I@+PnrQ(tO8_>>~)*b$Ncx^)eyQgBh5 zCKj*K3a|t8nmymMHF=eX=FmmwJqnls9TRE;y@W5foQ55YK#4WiQ@y{wd&KUY*Pdl!j{sg?3)giWoP~Z1jNuydUa6=0*t=M<&r@H|uR#;oc^m!}VHkpm ze59(5AJm?l<1NpywKWzxcwCpGCZV1&4+rm;)7;W>ACbfamajUJBwo{^YT+n|4E@W~I; z8^9})Uszh-P52?fRVOr%K4ot(FhR4@tWV#Ru&X!j<@I@j@9eBA4oS;1j0f}GR0BpJ z(%{hXi4Vb37!OWE2ZVM&=`y`x7T}0fcgdH$cC(Kwp&W2t^l&=iB)2=$il1EC&##`i zA2Li0_ECKCxnh#ofQxiV|Kr&NQ~*^5l?QOp=fhUxycagn4-#^^Y4nN#(w{%>%F}}^ zApDCAy=})Pg6{L>%6)?;3VW)vw1WGCptA;Ub4z63JbNBZ4dp5)Y}(pufAOuYn|WBS zw}o8ZWrw(bq!hRQ16O#9^HYy9tQA@KMYSMFj}DJ{Sn{-7KYLpe*+YcE{SZcZJh}*Q zf{2*bet%W2D{lAc#b&H#jqMC&O&wmTXVL*3ZJBZ`a?eL%)m>(phRtfuO2{9^`Ogf7}VEvkq0|mIK*Vu`G~7S zz;9yP7|+6nMC|hZAD?FZ?WLk-LF2=OVrO^T+gHYz4+$+65f|}mm5BtV1c09c=4p@pEr! z*d~CpJ(4xEnKHKwW85mM_dqxkt`sH@bXK3C57L*BftnMrZs!{q3W8IJMWCDcXNo?N&INuD`w)g%h z4dK!H)EIt*!ZVykDzMuV1#-KNH91XK1)DNBl&bn0@5^g%O5C2|4hT=z@>~8nHG5|1 z3&4>sow8}gzNEWTJ!NaToa!ccIZt+nq}(}18>e2^?0)0XpkF}^X3VT>5Z_TRk8+RG zI9_gVlNpP3pGWOikG0g&d)qTpD~^^COYdSC71e6yL|e5@pmdNV#|VMUNTK!RSmUA{ zdkX)-I9xFeegI`8xd_=Ed@hb$jM9@1XwX{aaVsxooCaphYIZ9U+R8TOZqR^$ZPqn` zAbJdR?Y}*UK!R2w12FH{QffgrO(+0gk}xS`f{A_Qk4U@mHSIMM+q}#}6<9X~y!QZ| zm9`fNeF0}w6xvp`70w~5t)8pYHyz|H-`ZTSm|R_;IK`K_w%YY^^Yae@p8GEtlB;K2 z^+p^Twuik#J&piBg9SeGgwwWn*|I1VAg`!pI(wl!yjT)CTA8i(fzP=G2)z?HT6fHc)!P)8*`=nx+k_S2My(`WW926yH47E6F>qvh3tzBDhuf0YX1oG&XU2GdrT20!Dr_CU}+PyMZ0 zXz;XQt%`K;s<`xo(hfi02S}j;Cb?xAxg|gNvvt{^&ZzMok0Gj{Q^2bTjX&>oX9IUW zMcEI`wk|5IQF41jv0ht8gL(2km}0B175L!c_n2QldDeMTzsLWYQ28l_tM+MtLgsUGP* zL1%|;9igYyu1%74tL?#3r)${`ndh?Wg{j zsO{g1(4Pqnc0UCyXr4z?p7c5TH>0rFQ6qqNwBB8ji!$wUw{}V+4-~Vjs5Q*M!a@E>AfE_S@_4u^GAq! z=xumxE0GK5uK&-@Fz6&v|I@V)C{0~^5F5~OHpCWj%O4-N{%fvo=M4{t#09O8IWX(g z)LK{QhT$XZrM|M2Y`s>)rVTpmiDiPs2R|72kFaiJa2^wiEf9mepM=tHuFZYSW$Qo> z?iE%Q-z_3RJR&;-d_Z|>nlT4QZe2(~MRzm78&AUNKj(h&`JcYu-l|lAG_uOjDugoJ zeBU#1Wwy&sXS*}&wb2`f(>E-J)X_00=;{~z$e1NWSRefHnd|S1?vHdQ0}2rvB*}{{ zE)h!06S|^S&ce*h)nL#AcpUS1^_LE?4>j|rd+UvAzsA?wGN_XiBDkN#to+ZM{dsHh zPF$@O%>FJ%IK{w_zzy_N^qY~qNTys?Aib0Ed1fL}h?jo(*=5TbM=VNgaAchc6A%U! zZIrf^iUq2k6U{V=AnMxN=UF;ScIcY75wX$_QBrt<`vy z%;MLqLCe2lhgcEepRK;j@T{p@;3+(xo9U43Kgb5SUjdDl8jbCaLm3Tcdetf}1kndW{>4WBW~miX;)8(aJPp}RfCI&5E5QB< zf*3V`O4YPcht)>d2i{d+ls2uC7Ra99v24P8&yk)xfg+Cf9D}NvTTHx1t4C<8NDanK z_b*xS@3jUn4>&fIFZQQ^u0rS!ZqtSEMJp~>kM$CBX_%t{MTz4kI)kjDZsr%!;^B3% zlC6DyZfxrJ?p4>0E}LUOz{;pL5IY)XDDvPxs0%DZZZshD|Nmj{Eu*4r*S}%9yQD)H zLWUNRE|C~Qk(BO|l4b}g=@4)z0Z{>w?oJ75rMtU^9-8Okj=lGN-}`;u=i~FP_y0lH zu-43Vo#%PvdBpFK0%=mQsKigjbD+Ld78&htC`m+;vCRI2cJGK@)$^bXFRXOrqck%P z#L#aBXo~yS+Wzpu1k*9@T$Wj1wtKr-qH2u$7hChD6czD+iA|ZnV;bsLM{P@3iTCgk-g~gWy zD`~$Kr40e)dKrhb#p7ZM{rjc=@=o5M(E=@f3wm4s!UCWr8^F1PTEl+{t{d5N9O0S-X<@5ScefQn!c*^B4j zR9}&!A~ZC}f#=2ngj-awVCGRHry%>fw6vr#(395ycxNx<k3HYWARAcT8=a#IPk{Fn9NJ<)M z<{Qqs33b0BizF%|Kvh>{OZSek9cu`=SPT`my&5))7dBY88LCJTx!%Dg$EYrDcxdQ* zy=tYHnTAW%dJ_mK(m2@?`iZzXj2v8Rvwwd{PXLD&Of?M;Y{4!3^Xm6%bl<}gH~535 zCMCq7c?KTSFA5DCm7*K$b!v-^G;t=J*KhM=2}IQ+>j-Cs)UQijoi%IS=Gd?`*pYpz zP9^uB`9`OO;t%L9R&}tZeM2Rb&=<5DlOg|scsw_Wh-#2q?e>^Hzh_WH{qWV79N)`I zZ&k0i(6xD22N zX(Z&(Y+q&iU1g<;Im-;K^8+mmQoI4a2vG&My}IfFr^bfy=*RRvPmg1OLeW~0qnSu@ zKSn;A(Vq9VXVJ16`CNMWq-w$tI5)Z7k8MoChq~WZ_%}ogmD(0m?wC}HoDC4TDrAkX zC5hy!R2-V0wy+`o*XN;idIgGcff!e%{hf_g2`WO`xfxzf6vT7hW}i|oTI=`lgqzSI zg#p@zx%+`BLhDdL_de#VxdRJrd`&^SQT68Qi*oOkfO?sH$Zf*FGrdZO{IMe4&kpaT zmAbuqYd*Tew%gS0iS02XJR^_iL><2(R*hKI*Bei@F8BQ7JX_yytvBvh8}UB}_X3?M z?sIM)Zcgx~)V3hRT$Z2FvEF-Tb@E`4n3@;D#s{E3?P%e#DAcKt%{BF7GR& zyrO#X*Iqz~=vy$*zxf4We3K4(Y75BEz^_+Ed7AlEQwhn7{ z?=TZ_g0o^2l^!Wt=KrWK3VQ(P!3-T>%j=KCIDKQbazz}PKhHsDN0Yo`>V$$YuJ-h2 zdfZVaS-|I|IJQ<~uq$h42JB#2p#4-`Q(C9)tc>ZK!>o6Ydn93QM~MF@kdoQA>!$w0 zDMJM`W2ss|Tm1Lnws`Rc|CQGI(SiD%oT;k$mx7K>;XsFl2;rA-D59|2_5dEK-$hK+Fsyn@+M5RxX*nsAyw$)3#SC}7m>V7g7xg(mS~x__ zFOb9aA9i?>W{F=Id(&nO;S6Dr% z>Xzs!!M^NR%1?drQ{3IX5~zFJzQPAt+hp~fzJ=aM@7;bToF|1;y)SB*klJ5~-Wqu> zkmLI~=!3Vw$h#OQf?mAxgt7oa^c{s8;uJ3PapYqK&?x)O4&ggO!Bwpel(lQ#f^YS% z5089KuKPCm5aBJKoOG?H9qj0MP@AO&(*+>+uD{O+Zyl-SVi-KdG=xKy{e7>}cqFyw z2UGWYB9V44_vRt+BWR~J8)X>9J@Rd&;+j(jsOxjR2u@mX?wsGUV6Iqw`ebPXko?YW z>&^=+Sg73@#rLTm@mZ`wtY<<-a~XWUW>%-)+n#f;2+=`xsQ#{M+gmtgt^G5bc#;vt#z`#bHt^&ix8$?bjN0kWkU_Oug?-5r zy_DPG*sWe3iSSZ(DcZzYQIF9bBkvmlD$cc6=Q_o~WP?pJD#7#U)Q80Ph9|co2PF>awMr7j zmVPWB`#A|YH*Db?1qBNa(IgoDg0rKUcDl5&U=q%_K-I_IpB3EyC^jWO9G#X&etVt2 zeR-mtnP)`NH@^gHnw z_A-vpag2JX*Wty8oTBY+y`>EBTsM9?%wVxZ@Fnw0Os1chT=92Jf_ZU(H96<))g9HQ zT+6w>6vFeTarVv$O=5H$U79lU<_pstnnEtjx=GN5yja>_i)_`9o`^K5`5W#h7*^jd zKfH@$yGRY&ZMjeF#c3Lkg=wtXN&U=iG{V7kw!%rNP_uj~9eBl00ad9Q|PuZSo9F+sb{W>+2%FCD)`Z0XH>bRl%g&M18A3 z?icw$UV|0LATk?B5PSn_BMuXDD)Reh`Sqf>xJ^1K`y$>RPjT|pi5y^UHToCJrZWz> z2T<~wEo_eKRvx9e^@)v}CiIWsP$l{!PLgb6xo7*B#z{);7$+vMQA3NMh>`j^zazmA zsvpX2Qt+JZV*WI5cQL%EYZ44C#JsOwA0xcS&Otr-Ev3xB3p0ARbew~&mEpk?i#JhW zdW%8|YOZtIMn2!H76tCn_*^?_BWaa0K=3RxJa?p_+I<(~vTrvZKc{RLzxX*@w0w!! zDs-QB;c0~T4obR3$QrOE-Nl^XyL_euXh-D(_3enp z^WvI)8RL1k>Vdi%jX;m_0$qqd8}++3Jq9ed&-6{&g}RMXZtUrIB34wp_-MRx7k}Ej z+o!rejq?DN!J~_?{ith&&JSCL3`i93W5KEk8NQWE`_w7T5i2k>Az)v;u%}ekz=lgla{JkNvsQ1S&6F__nQuFw5IxllvZVEM@Pqx zJ(i=!Xog6}CqlL}?ZTE?`*hx!$D)1f1eZ)d>730a#TP@mt#}TWJ1EZw5H~-q)))Vf zkBhtOX<08&;~u0%23_ZaJ~A)bYKxZ+Qsn_70gxVr%LK`){C;xv%VRXkkHpDKGfRS1 z54&^I^N*yTwDGu~oe*e&i3)jtem6EbD`E1E@XBp@L*6{VfKgnsCM8dTlBB36e(<%5 zh)%Qp zWb~aj^YgslrLLrrj^~2zeQ|+PK0&BfiUn$w=&RZ1bhC~~S|`5u7X-n+6>=YRelnUk zg<+Gva-ZHU`ApBUg?EVQVj^H{WHqI3qT#>x3w0X|z+}iNMt;;BA;-|f^Aact>{u8e7823Q@WX2%(BdsA zYc1!`w7?>MG3PIz6f1ex5qJ;3Vd}ggfUXJ7h-1$>R_S?aoxgTv9s+83u|FU*FYign zETI{_C7Aviz+isW>Rt!`;z~v9efIp~x_Z|={g?#qdqjuKG#)nV2X`MC&%h_2wjTG) zm8NY~c6mz^Gl@v$0K%O2JA7hu59sBlr(MhYS2LzW=Z~JY%Rw)s(0IRmgg=}i%@A&a zzjM_~y$y;Htv#nG{D26d_yKPo202liC}y(z_jxov6d(25woi9yG?ge2?vJ%2de?Mw z=wg6Ykj}Wqw3s4=W%)av(GRhJ*VvG+s&Z(;N{f#;mk!BbA25Na5#Ct<8fr=C9>XS@ zLFW$dx^B9K&e_NBQDo+&!2v87i3+F2NYkfM!}M>Kbe{1Cy>z+aJMS2O^jSU>XN+Ef z$j(^U48yUC@r{{Uj30Za5>^n0SpZ7@*LU|bCY!n2rcku*DV*}uO*~3>EG`KSfQS=g z#AW!ODhgiLJ06SNNSVJ8MTyrgD9sE>BJ`tbwEk&4yV%~czLupeI*4MCO=H&W$BLNq z%CA`jKXsmpz#da}uUmcF8bfI<>0iU;bEK(@DfE@pVXxmVBtC}o0|%}fB!tw`N9ckr*i3jq z3Rr|yAjTO!6Y&sa!8uW)$mnczoWOeUjDFls74jmnj}!e_i}*-JKw3KufxvbY89{>U`7 zdXEk7{leDTY?ueeT%nV2)5)4$`t=X1YU$}VqORoMBaQsPWlSC1B^G{LD*ZfMd~Zkb zK|+G)==;9+dk?xR-+ffonyWk6&hvKLmbcZa`B)F>A}6qrPHaUQQw;-|Ev2-~_O`=I zL(ri_mcfkBIGdzUqqls?fpTOb;o8{?`~F)m!M zPLaJnc1G0*wHMiHrR#%Vn=+(`c#3A^9N7b1Kw`C5Tl~G;j+o>6X#g;~P%Ju?)f)180fOb03C?w^8ikHYvbh)V}C+lS_e>PAPbcV$7tPFJWn zTP_cjc6ry=ZZ$*FzmDd$gZM0r*^A55sH7)20YiI~Id14Btsib?rr0`bU4N3mJLB8M z^>U;VJ>(-)xmxwB-F=g8zkAfg#Oo=ETbHvd)hVfEEtiL_LK_IeU`jDkmb3uGk>!Bk zNqhZhh77$7*PKPkDJ4@Tn}D&<`XUq`mg>3A1mXl!1zL;gR#&n?`RA4%jbR6ed761_B6dPhfT)8u1FmqO4=&|g-kU=~^NVO)W_sV@B z;gKHXLR-Oa9;7N!^!wfaiwcr2=@q4=U)VT$wkd}BYNgh2(coKB0licXp%nEaoP13W z|Hzc`{0)-%O`z#s14z?4gZV#2-3N;2=yvrS>mIFD?GAjo&UcP037$}@hfiuI1*x81 z!kd_yNBmPBX$we61$=j;UE1z39sjlGIfW`$lQrRBwe~dHjTjB2qjL_@dr}L;=Tv!h zB~9{tL+wZTx-!2+wn`17J+17W^`73XxTHIch6S9VP{lD56(25aL8!Cqj`jwQ72_AC6S6FXOpC?4`8CG4F>vr%qD^SvO?T4t>*4b)p^k6PM6el?g`5eD?i-tC2Tcl}`}`v_2I$~8?XZKaL5Db7l9i{BRj?_4AR{sdAUnH1zh5oX-z1G8V+H9cs1c*t}G&$$FQ@8OCD=kG`8=Yqs^k zBc#5D2+owdh={dK58QwF>%CWWXty{3k3}F zRZo=a*sxmEQ0OaZq#y}1i?|K3^|K3d;9k5Mb#x5d^asU>fFq0pN6U2CC}c6YF$F(*X{2&}8#9ULVix9MGA>1QIrjS%5JbZ_=Yi? zvCYuTI7((5W-Pav$4sM&m-EaG=`eio__ZoB_wv5PT-hsWrVaYxLeir53U{WFZv4r# z43SIw7a3(qGp=AWR&;ELU+cUx!O|lt=`kz_Q5)Y+d2hEimn8{AxFO`Tw;L6pnejT{sI~#nGgGV6Z6pP@2lQ{r^U@jpm?cJX z`D>-V`C``7{s9!#eixsH5r%*Wf%H}iDeMi!p0PpwZoXM$^1}S1!;b@r>0JdhCfMA% zLi0|QlXT?|o8vKbQ_tKK4qo#*7`tDQIxb>SL6c>;D^@7s95i(K z!e(z6Y9u|KoK1W`wN@UwPv;ubI8Q+q7@U14$SfqVIJN}1N8c07B!%YS!H-l@KtZ@P z-c>MYx=>UhN?QEYfe4ieHmT%7WAMY96t)k>6W;P4Bv-xIK*I!Al*wBF7}caqvN&lr z$1wPMs>*)xMTYKT;GE5!WmtC&&NiPO%7D5hDbf;*S--*^at#5Iq1n~#iJ#u%T-x>V z4_1(y86jV0_&v(}TY^hY&ZHX%`>I=pfM|I1*B0ojj*99xb&V>f#5191L%VBt+zEshdU4zLvAxb>!xYYhvS`@sa5Wf+o7mB?>-8; z0gBrrdq)b3%(`DunhU zrs)mLBX-IrbLnAJ-n{u~M*Kndrw`dv+yS@4Tuz2qZDtXuNZ1B?B{LRM(b3d@+&UEf*hDyxWIsu!s~dBIka~KW${=Km{acj zfEvp?!KyxNnBN7^=aP(BJH1@2Ap1v>A9VcJ8Uc;p?LL1xaAiGD3YIaJ3rPfI=S;El z8)BJ*B+dS{?yE-zQh$;Y==Pcvz;EL9E6_pnqjT{np{52SH@$oHYlH%pDXS! zGj$(tCj5ZlsnXhY+8&f_HJ2G|La~U;!*!X(slYBfc}mFSewz*4g?j|C1>)V~bXWFk z1xa5lB$q}#JpZF;;0NAac%PO7>;+^~zdbhTern&v8_u>eu|CnJ9=BlX;km0j5x*Ii z@%qBcTf}<$q`OIC3`+O9CXgI8UR)pph)Ha&4?bQuO&=HSjh&;~$8?Zo%?P7&>>P;s zSUz2lS?4#fqsyJ(A%JuVYB{#z7yD z5^XUSWiuZZ*_I%p#=px>WwJROo2&41E=hk}a1g%@&C|>5m==h|gxGApYomY}lfOy9 zez!mnS{3$K|MuoGw(c6Xed2eNo3Ha}r*V!1q+o2%)i!)^Uy5lGbrhGoR(()pQ=9v6 z>OdYqLTIa0mWi8-w8&w_i`%W5YV7j+mUbnJ6M<~iQ<8M59BBA_U?u1c27*@~UhmjE z`EO0 zOsU+2^b3~*5cl)_IjQLqF3Zw+)nvC4pvqQ+8`YAMYfzLU#XZi(1Y2g?LYr{3`gq>| zc8fu^VQ+QKH%1xgzV@)K$!AtcT38*F6xAx8_TQ<|0TdUY3Y@P2FY<$xUsS6Hs|2TC zcTGd!cvxDoOIflzrFkRW3eGy&LODt=dzgztSmSY#vU}U_C9ZM0ceM##0LWW%qN%}+ z#>v9$9CEX?`7L!CZ)bc>r15rPs90mTiqp8{S1%Wk3;1$r7d4HhvM6 z$3C+Bg1G=uiOO*TG1{r<0#T)WlEXz=Rb@gRCK^m&uu(^k({uI!P{7JAmH=cD{gPMG zEjN`6_i1ZnSpsxSa{=Aq#5K&J_C6teJxJ$yP4(>)qEgZVN5*6(6`ynTlMpnAr%E|= zfb~2z?sNQUgYm_$)Sal|3#Su!o@x(&~n#<-{gNn%c&t&)m+DaY#GfJb)myAus6WU0g#Ha{O>(_h7 z_+Bk0zo}U>0ML%Os$Ugie0WXq?UR8FlOL26! zKz+ew(_(xBK`k*Xq;&OwR_*CC1>ovY&2`FnN@Ln0%<&!Wp{EaZYda!2+Av#J*C|~d zHdoT&NA*pF-)mI(dFf5#Zp zDD3qq4`;s{&Pba#4a!oVsN2BbI=wJ~gXq}-5ag5yjJX7JQ zWF_~ugS#s{ylk4%U8;S?e7OHOD)q}|2(O<|kVpMX{E%$BlO0iM z88xN0_&7n-S5h}Cp9w21uq+9_GoJ4=$C4(+yQfM%VQasql-Oqs2x9)d8A@JR-86SP zGBC3;IMIuQ)@LVKUU}>b8uAEk`KK(i$Y3f%-ts}9k$a?yPShre*QJl9zC~Lnp8s^R zIB9FBGL)N8>mH@+AWZj%?GHiscX`Vm@EJ{9A)?2|*`^}iSjP468_dlk#)rmF8#hU2 z%5}@v_!p*CP)fXnYUnl9*4w^o02d-_x0D9cBzyuO1R^*)Wd7a+lo z7_m-J8NFm-vs8Vv+Q5BlPbP+p=|sZ0Q4~lTfN9hkdg?X>im?hRLF*OQ*`MqdqO1!e z%I#((TOu7QmgITHpyF%PI$NwVeQI0maJjKC_xKSIi9gwS5o@NID_*alACKCz6wk=M zTdpR_9W*h2valiLY&G*~6vk@zGz0`?Bw#Wd%IAqdx=EvGtyA(PCdAsr^g@W$`nf;B z>bCmv@Q`wZY4L_PjkbW&6`bgM>e8-MTw=ZCwJ27TzSQ{kXg_9W$j#ASFwBgVfMzU# zn5^don;ucS=)#F2&o%>gU!P}+PqWag5uIkJv(Xt?*=N=3q|t|-59@7OGM75Q+<_r< zmJLq=rLZFVY)tXB0MxIS8bRB6>G9++-d0ro4aOhKE)pl-Jx8VmVVKMvYPk66?l7`4Nh|pu29cb@ejBcW&hxov14)7(^?oZuwlm!EWM| zl{Y{W4I|H8MvM-=&?!N{hx0-lYKC@>-dbrjRo093QYZ+YHuGjyXsKxb3uitZPa9m@ z%A8;;*b1FJAnKV+#qJ7bfrTnFfs~`&WG>73?P8UmZJbYn{n#?r zE_{;30Lw|d=dUoy2yTsE>p2Oc8QDb0HE$Y^=^$8jngSr#82F8$AM7iZLm6s%E&79b zc3pUASMcIL^lfW1YNYWC*p%L-=kL4f7Zo1#2{yvH!=jT<=@IrM$sc%Hulqj^>{KUt z`nTHlQg|PAh%D2lNX%d@yZe>LoE|Uul7RIGJ`JO%7 zozi#?N0jB)+%8=*@$eXpgI=_e6dC(x%xZ(D+bY$=OU-*q3?BANz=sC;Ie|nI|L#ZN ziZny0Z_4yF84+JAkEOV5@wOb*`(!MzOj{@Lga>S^EamQ!p*xkitpVgS=0Dd|^$(47 zxJMHLStP@-OsB=jq$_=;VW9FCe|olGfA})yu#S34%ku~HdLdv<;}38qbr#^lL_rw> zid5vrfw%+s(LC?R3b!?xSA4;$sC!63Y2KAK_Tp>R7;Guae23~4ZmZkM_OXu!#2oWoN8 z`HKJI<5hsyt%+|;_$JtlQCKrDx^1>A4QN|?y=>|{B!7#ux2y2EDf!cc-D}4l`8ac( zx0KaLJE33Sw(h)8i+Zj9R@tvHaeH^VJZVY}>=>nI{0#_71uWnMt*o;KN_C!Tl68yX zCeLyB^DeX;PtO^71WoB?e!ft2I;K0hPSKrE)(wZ*ILFKIZIhaIPxv@<`Ct%fcW(zK zD~s||m_5EHusw<0ytka1+|gAL(oM=1Mza_yLW5D-bxgBR6Jo-aAyklNtZT9K^P~O? zp_*;umN(}0k?*UE>RQnJ`=oFuSsQp&_0G`K16wY9V>gRY^{3$|cuq}8M$>%x_uADR z+n`o099BK+r77EVD3Ffu;)aF3A?xOZRKd{cEl}OpkCSZ;;|C7kMTi655Eo2~ajpc2 zP8BzUpDlOB#5mh`IE$HmSoalLlprp)ix+cjwrM%g-Q^UBsHEWJP9vNXEw@q`chI!P zWzBva3;2a_8K0`Cnn1g03L-$=F`uetGGEq8(A3b+MK5PkeO47;_PI7g0k=Mte9b_R zXHGex#qKvB@VF_h@5)NjOf2&r$X$oC^dsMkcB4?~8nN%@q`_|iq>A-DonxbEwVQ?C|&_ZhDg@9t7u;h>nFKIM+ zez**f$S@209)ggjBX(9nVQ9cLd2bC=ZiU5RN9uhspR@Uq1Ox}xnHFoaijg=)02cx0 zLUovGRSl@97}ZjnV`y}`b;`@QzQ#)!1#a-l(nU^Hs~=Mohd$r|4SJyrbVtn7-`;b& zEqLnaPh+)J7Ut?l!<07 z!2$8&?D#zltJgquFthi8^Lgt>tf24+uqNy~*n&}o@je{fD4e?3odHuRAkD)K&Xe)A?$0s~NAhy8g2M1uFJt;! zE@z7b^cNPm8(cR{Z?`8?1WIB&%+0*U$Mdz-2HUOm65dyPR?syZweER1yC|=f({_q- zj9#`sp;B-n4^8_jv`BCKE9`V9n$vt;aDFkrgM?=i{^at?b9>b*_P()?Aa+TU_sN4* zd}Vrg>f^UoF*gKrk)HmS*xlhh3agL7^as8H?hViU$ifj49WHr>h2AfHOEk9H8}2IR zGNDlYYs%O-tpLOu8I2ln%yb8Oqki54Si?~~2a?9S5L``%1Gk)wn z?MQ#4uQ=^8c|e`14Fp6hyMPci#~6>OLJ>Uq7f{55AfVV>r-uv%2I|Sdl)5#k_CQ6P z%3~)lt53Z$!388h46{X0Xl5-D`S~U&Ty8miZ>qZmfOZM^0D2RCp9pC-2HSETY>F(w zI;I>}-t}keVC|FN>T4Mt9vO6uXF}3YeAa>D<4~e+-z)U6;lw|9Q>p zSd~F9wj*+I!Sd`E8c_+&K@5?``E;@5cyB}#Ywz7$8&#C#2D5E@5nE0WT7zM&X~@O- zdgjRBk^hkNUU~Ug0r?-T?}@Q@yYc&TH~Rmz%-;#{JyzPXgxJBlK%KKLZ_RJB(f-~O zu>g!-=?;-~d|Bel_dJtJUh$b;5!G3CE>!~H?6XPQ`2IuE$Hwfw;bJ58%% z2+KAuHNQd2w&5TF^CFf@>I0?ze4tEMUaM41#Zi12J?CX~BIklc)*q$3WH9yBfvf*Q z`nd0Cj9_x|LQO!fH)?x5ha%ZHAHC??dm&TnZgB`y1ss3=SfWux(f#iMQU7lF_=s~i z9Pu*FMNQ|m-IG#}o%$|c5-ykzlQY}DVI%& zoj`eis-pkH`gp|xtHU8O*h42Ah+>7P<$oJd@<8QICoJcdd`Y>=Y&=4WJ7OQa{jfIz zEswC!)2e3LmAw-{oIroTuR=~}5G0fCA@*!y7z*b9*S@pO4F-WychG4vh6^!R)Tl)rKF|m`1lrl#+k3jy{(Yl& zdqxdHYE!SuB!Z!k{$IA)(1MbOerT-pePgm9UrwP^XPFG_(v%UD*O4UW@ z@d3JsYeZS}8Zqlpf3iI;bQTd^C{Z?7Y8DENEOAb{H+-#@DFGlA5=vepF2}duj2?wvRNN~1YapRbvprD1k^n>+-E(Q+(HAiLj(dp)-Rpu@*lwiW?9RMWI zDSrG@HoDRHUS%wu=vXwBKqs)GLHntSyvU)+@30d9AbxqQP%nwg{Pn=&Wjqf6YQN_6 z)ZGJ^tB}Ub!t}Q#d~7C?(&;%xYg0FV?TQV#M8FB@m7E{rQSrAcD%dzU#OUq;P|nKTM_1FUvxB`Emq9m7LVDLjovB(EtIs^TrG8$t{TbrZm6esXcOdAdlMO*yI$IkX zPLk){Y9DIuQMIWPQyu>8)yE7dSdhskDZmQHaGPw_u4lLqitS5TK8&If8Zhu&46z8< z1mJPtE&*)AKMZ@m0&XR%<4n!3>ouWfj#uJs>P*xGf8)UoAvC~P8w8Y)B{PCMvX}<5 z0Jze}V!k`2T{C4Cy-QhT3oL}RDX`JJtB=w_GCn!4r4uM6d_2Rpzkn<*ay?b$D8zG2 zujN)v)1jw3c^p4IAdpBJKGP@r5mSv&4~LUFw%OR=>=Xejk;>Ij$tx4~{Hos1->A#! zA*BtbY=!!@{1Pf+TAbiK`?}E9Ak6x)v9Xqi&)<2)cexyI{0h*0he(9o+6d3hH9}QX z-Y3lN#`aXcCi^QFO5HNQDM{P~e7P1D4)>^&4AJFI6)aK&xGW%zv?JzzY__MBwvlgT z0#>>E?n@7NBjW8VuJ`rFLlD^u0FK24_Z~MM-#eCe1*h{?LO&uk!ocBfwoF=ByqvQv zCTOTYr?gG{d?kS@pcCh1^H~QE3FO4J2#ws}Mep#dbP{Qe%q=dGLRRHuqTu@m%&9#O zjBCZJ3x2qc=~~rN30St9hRcU@y&TetmK!s@gE!4xeOs3^p-2SLBZIYX03$Dy7~DzO zR9$m3yuS@M>Lk=0kGxP5?#M2)yxh)}yv|D#a?E(~#_1$q8SzQyrQKM8Gs#=m>+S@$ zBr~Txx>&KpFzD%|m3`%^tJ=k9eQfN1iRSN&iyC$3?0)~v*#(I{EUH<;5waa&&!y}4 zyE)1Xl_hz|UAOTmZVng-BeS3YUz1F)J9p8Uc!)q7;uk)@CJEmI zV2-0|SOQk#A>16etW~Pnqwe8Wd^J_>ISEJ!RhFaGS7zkYvSTw=D%J_0s<5OS)aDU zf&?hOj`x2E1$U!vrrH%@%S6HKZO&nRION{k#c3Up_e8^$U(!=FI;je;CN9u@=GUuw zg$-#YGg6r2Wy|n1-Jko#hmN8BX5YH%rlQ0Z01FhpPOzUSVZvgsD-w$XFm<0%)Mj`t zVIz)*)w&)8>AXH)O$xOzBY8by82)6S)&mJi3Q6&avrWA2`?8w;8ELkT zkS;+!5!R;o^H(Xu^@eS)&bsLruY#GJ_>bnd9_#C7kJT%?TND{;BDcvz7E0K}SQ za6r$}r??Vt^}eB|0<6kfT*|Jan;}x=b+opS_2qQ%7;@zbAA^B)NiLpbXx71NUDn@z z-_rIH)7^IPpAb=y{nxGSH&RoE-N|s{+dpJD3-p2{)EqJI->e5rN>_ZWc8h_B?y~X~@81mVD?S7G~a^@L{8C$q?JvMzH4WX0O+O8uD=*d?)}QisaK%5xnf4G_r{!1{P-E` z(**IGWro`tTE_ym>*tG)9;5yB&SWfgXCmB5|1c4gCUJf5zOn%7gG=jc$x^hqfOoAm zqFT?fag<)^%W43NbUThjl^-WK-S1-41UvnKLYGCvdnL*j`fQUygc6h}s&R3jtp$Oz$h|CunklH=9_Vb&D$BuDr{ZPYHD9F{pd^g-fj?Bi_kU zh5i|j_peA9ttqHd3V_Yzww~@`_?SE3IRtJFC{rhX|Npqc-F?J!x-&8aPky`V1!ol& za$yloS*Y}WF3`_sK?Fyyu7s}aw{n`HaO8%g%3t%*NwwgJ?{sV zVad-adWsFHt1=)s+cvtLy0f*PN*=my{3NPYnv)@cMHB$VjoUoExfCXO_1DiwEdOrn z@L2AaF(>o8ty3(0NAI~1aA^Ik#R^;TWrn7?Tw5#`gGWN|^hrM~vc7W@m{kGd{3bb; z$M3A0F(jA6IMNH_!tK2n0F3*yf@W+;L^(?_7guXSGFvQThhn@Fi(@G;kT}l=`hb(E z2S@1v^K*ysA_HlxD85o}S)DBh|3t?yw7=;iWaT@3ElnH+VDkk=DDw2#9eHDU3{CU%JyGU%Qwm9u5!Dmo?C1e|L%lLrXkdSHF_;l zpgW@{3>ZB$6Asab@xpgUl5NmVW~G=z35lpod_;5k1LHmSx7&77H9TiujaV_SmBIw8 z!<%>O?<@0*o2Du&DuRgbcDH z17SsZbOWEH%!`3(86F`MYNzJ)Y5Lw)6~L^u$_80OkaX{u)$nKu?1%fPrZ)NkXGR(Y z%oT20;=KG6kv4zDO2H|a;Wno0&>2Ow=;eq75#Nk`{aNvEJ`m-{JN-!)`kVf=2z|<* zt8k_Wd);cLC=;tJ^RwqY=j>X4+H89`X%G^b98o>t_fV;<;Ec1mVDWEt(J7< z#`v42VI;kCM(F`f6IhZ+N8SBF3E%>b0C`BmC+&D~iebPKIyYa87L!26AB-BQq<^~v z1`IjhO#@ECj!j@yd3{gcN%}s|^-6W~wSAb8`B7!?o&^t7mng&3kIOmZ8#zqFBT6OP z^`#EA@N09Tu8|C}7q4;vPc2lo5d=Q@B6+wMAoh2~9df6*bN>vlDXi%%=H?rWt)PFQ zlsjaN$1+jr-KY0jA`jtHcjIAJhdAm` zmLZ)NGoOITkn@{YVl=?aBvE+7QJZ>&=M|vbT>-y3N)4C64)8pvZIWuTWJBLF&Q;I6 zhI}%tlr>FnNGz~nlSG#suPu{j@EzeYY7+axHP~=d){EqSTAmp~x7HROdc%I2P{c7@ zNBNH%0bCk6zM7nxjezvI?M{x9yK~ z8b$!_4T^ofYB=x9Ay&RT>MZ$n$VaL>uQ)ND{l%^qiJxo6p7i(*=L=D?0=>3W*vjsF zb8~U3dXvL{cj1EX4)pV%2f8u)0dN&+U#JR$^ee38Yv=5VwS)c=Z@E+CEZB@-kkZo+>U;o!I}3e|~r6Z}NK=%Qgl!t4p2zuuXjdAQT<-|4+Z; zw1Nxi@8>G2t)2YsR*WqCk4S%j2ccI-FWs|(@><)ao zM>F_zB7Jl_8%~#}a2L8=x}xFRQ0adVo?1?d8$YPQC1~w)5P;+k+=M+aPpj)tF$o@S z#W$++00b5Qh!#)wvNMKe9YAPUc&VpX-j1O#@Z;U*z^@fh{7Ijst)enJ3P&WJk)lUZJeT0o2Er$Lb$ z++lo2jur2())ru~pGH{hd+IK|L_+7u-40!+_H#jbpPL^ResgC8TkrwhGpzD&OCG)+ zv1TAE6mNJ;{JtzG{U34i4JZmp62|4kZ`MxK;}!f8WArBq5I_L~s>OT(C>52UoZ9$h zHajJluX6*VTmJ_mOG)1USOXztQ#qwkuB`W!;NF+w1H@15ZULx9I_mn_2BIG4g5NI7 z8dH?ZiqyRr9X1ju}>l{*NOuNQ~9 z6Na%egDvW@fe;YYMB7k_$#)<+W$$p?6p*!V8OrpJH#^pw&r95CT zNdUfl&4LBNY$$o?bbr$-^!`78RzWPKvz12g_-)w&$f_s@XN$yed<*=Cp4E^;GRb?O z?8XyZqJeFr&iqYdh!&E;BGll#%vv)x7O;q{@e(JrD}M7?{NMM*i-g4pK2c#~0&6a1 zjD$US|FA0__=D=IPcy&PxJFHE7ok0CO zJAO^)kR=!t)X9=h3`@%DPVnT$5jN6yLb|dK(rE&wuwbvZ^$Dy8cM0I@tNerlDqYaJCnlxLR%v z{vI)_$L6*mh}!V=tMb%X^K^p<^g_ zCW_SZ{dwiy>~4ncfopBdr~k#?TfRlvwR^y~feHpnDhP?lOB{?&M zqJp&4(1X%F3>`C|NOyNg#{dHZLl3+c-h01~dq2;6y#K)d;Bm|c8CdID*IMWKtJR>G zm9#-ALZ);1#+pkrvxn(Tep6_p$XKa~y_IiAaCrG?x#RfkKv$)!#**DssSKUlPx%m6 z&8*HVsk)E*Iceeyo^=9@xxKqWcalhViWtvbxVy!!v636}60X$jWxJ@y(Ghfr=}U{& zYqMsxowZEPjk110;zXIPytr797X!p)DMkNPuuEQw!AvuLw|;Kxokf}TPYE&mCUOT) zE02|RESB_c2~*1lZrq+tYhVj4K+kbBEClj=J zf7vUHxSdQo!lS zqAOA#d66mbR%K-T;%bVoIIbha@x)ObF-3HDYn*SBelv%1$T@_a0I!$D9#ALd@w zN#WPtp|}0qxS+l--7K@J^(3W%3`%Exxy)+tDoF53*4hMmFxW-0_x@0Ze4uMDh;y;| zB+4ULDv9ltTuHr#qLjfGapv~MW=qV-$f}&YE!u}%&e}xL*uG>@tI%bzq}|Wc6sHAC zqK{!Krilm3;N%{YYZ9ptv)EkKhV<&?5H?M_4)ML|?K&MA{>T#knBt%ng)(+|OZ0b%@*>XtGlag5#HLn(BK z(rb3Rm`_iWdZ7&Ty|xNdE~{7LrK)Hc`Cu&EYICdm@h&mfOp`FV?)ZtBPiT{;PC-b= z)taRnp$i=v;`pcZA3StxXauG}l|`oyX6&=}25?sRO=E?*$!P25#^)P3oXk8~A{Iv$yOgTNXowa?sW4(?6&I;mee z(oiwpSA;Q-ww9X`^1-`W_l-j?20Y%z%14H4vz54o?}2`19%kqY^Jhe6o2YCd-gN8T zzIdI#LchumEo~UL(S@}-FEg%oVgcRzc1(@+P@!pcO%Xa#$9`mo-c`JvJ(ynm7OCCFNkkvp`$h09EvP5>7=}?ac`|5)u_Yz+S>LIiG ztpo)+H`{qEfa)9Yg#V;Il{ZtLdIo)lXdBrTFq*wE#1cfEfgXu6ngL!52Iv%oiaqV# zo8|yhX6x3eku7RJa1Pp`bGN(cy6pr)g|RJQT|`&5Vj|cvV6)f?B`TC+@ z-+Z-D#*R<5ih!t}b{IL?d=|>6jkQWF_mrCSm|RFHOj-JK$#MQ(avuL-$dBw4V}`K~(^9S^w&qr-PZ*C~iJEr7JJCDBV*_pAc(_ z78JENT#DT*Xy>K6SorOyKbe{^birCL@%*p$KJVKH8IUOSte%WaycDu;sd0`_A0>wL z!=Zc}ELt|mPr-uWe@?~!=i3J$d8LMyso{I~;jk?;8F%HHJuRX8?;w$-Kkz|s_*K1l zRm!zxD1?Rf%aZ5E4|y_D;7xFlcGYvkg1ywgW`lYkM9fuLB4|aQ*OZ4cOLqyPBz_?T zp!cJBsqF38}07l)c)P5(qWJ(8pn!jn*%_0H|f#{2J znvX6Rm521XbAJn6iqfr{rC^dR(Xy;YrY@;L1$m)YRJLmRR5m43XrY@l$tW+$MVdUW zCUCB6m^8veaJRD0IiR+*C|w*hM^gPjrD!&hwo?T|(tWP3egiB4@*X`8`)I?h@na!{`%Hw8#%`IXDuTlW4PWevaX+97QG zF(yPGFZUyc_R8aOL6qu3qtP4<7j$LzJvX2I=KJP~!@nkqM||b#`<8`dhI+R$!16JO z)lmySTb+YsGH<@Z)IRfh<)=n$Q!G z_1S1B;}{0xqg`Ll!i`jFmWQHGgFdn|{xwGNGPghBdO5ZO{GLHBWN2rfv!E{-VYy2}M|ww$ku7Uji^EZ8~g zjh>JS92zz15)F}1M@q?a-Mkvny6xDIZKR%lA%|uNd!xQmVyGC6bhTC!3`f(*+UH=d zA2g_7lJj_E4)5T-T^18n;X=l6C6mFB{u2 zLF+Zl)7}F8p;cjkjucAlBYRm|&9U46^Uj6;(T@ROL8#&o58o)e4b@Y&%$6XI z2It}e;U9Ue@W*rG5JAC*4%<9OT>dyOb&Hf`w1P8^d*T41o$pTM! zl7QuU_4b-+VY{MhNjo9cDVj5KlxdWKn=i)*>WrX~R1!)z7Zr_0HlKj5%1Y4j!wgoS zFc5rU)abPD>G$AO*^`DUR;x0pNu9$dTZoKRzR*O?`nmFg#EH!70T)c``XEUMtV?2zjwcaY^V!-cOCT-$ldSZTQS zHQTWb$unAmK+XEx$&y@vP{|&UhU5 zo>yi4<+cYU&D*prneLpdkosc$3T~mL=Xk(=`)FOyrQ$;`MJQDSwuIX1q z$y@7sUJ(2G3u*66#Gqnj#JxTR6UAYL%b&~bN0&WzqOwi+cOmR1iVFqerrj0RH622W zy18`;5_{|8I2{<8$A0K4pSN;%8Q&{(`n;T_edILp)w9Ghn>i`%>R2!YS;Y2U{d{hd z0(ym%pEE3l7zjgd3f5AF{Xt>ey$;ZihncYe4CJi#-!RZk#5IPf=*!JCET=DbcQnJv zOn%<&QnP98sb7kf(!y9a&&q|r`55h)nrw$M+76NYf%nOn9L#S8nI(sJYR=Q%f2y<< zYHFDDbIIL*vT>+DkM^VA&jXQkn@ajY9uvESX{g=WJ~<3g`33WiCNXPSW_~pN==Q3# zgE>`$JAP_Lv=D-mwhki~`phQG?XOvS8zae-$i<9W?7j3d_U6O6eLeE`YHsZxY_>V@ zaxuRTlNA2KlUs?dr#8^Z>ax7Ijm==+2qzH$56`;&f)G@kDQf$86rrNX+JT5)#?El4 zAr})cOXDWEYxj}oLn|sOSh_^H`F|uyHKuqdT#Omv=q=z4-qQ%w)&moawGb7UoG@vJ zOvsQP0Tw(Q*^^zawAL3{?>cE@^zaf%V64*#0Xfh8wEa?I`0$XK+Wt7~PnpbJqu+B} z7xi!eS@z9(fAf~2c7`SKfQ--E?!UUVL*h4%iL0tUwWy-j%i_RYINY>@%$&74;$wLKOx0eDxwV!g^G6T=YRcp{#ykF4uI;9|iL3 zc9)JxcGQU`7$p3(ebD5ayChPrsq1mzv811L;a?!Y-wlVJz96n!uLcTEnJdS)tzMdl(8`dI-I)Hwtd3I*J@^y z3ONzmeYHshkgKW!1JUa=>7~^FI%m%~!Y4pSaX#r1^D}VnMX~?J8lQoMt*RrEHYy~; z?>~{k@;b7|;KJ)QJn-yOdr#nNz(>0%unqS-A&Xuci?RQ@m4*GICb=m-_PcoxfAGIC z_eq5=Bd4J0NFN1p%^z{P(iQjZ0;jaK13qOKZRo8dhA8uE_WCFjrV2P-+_IdzREIP8 z^m=$Q7n8`@C~AEt!%uUV>L@!gcK*@7_O3JXGWP7(Q7sQx+(c+Rp;7}n&DmF5QD^Xa zV|wo6)UWj)yf*E~vWFbr3??ADMXuXWEV;UB(WlppRo5640>5$+M_q%^$!ap z)`u#;WNAo$@E0q_4qX4&^92ZBEkGHY1Jfb$1p*J`&7Y;o|1kvrqBSn4gKZq~P6cp} zMEHO3x-3s$yd+XlDP-1MEnVY5#QQVbOnzZ~Ze#$2O_`9!wBR+YgRXPY19CN_Qe>41?5u*Xzdjy*{Qd=C zt~O16P5|20!}-H9V;U1~(6#?!wE(s4MCBIs84qY!qGtBz3jU2my+2WX@^FisnzQP{ z(O%7k%e#Afi~hT;|Ki0W9ZWh#oE_R1`MccQ&EfI?Mn%4RBKx4nxu~BBzILs`qCL}R zsCae}pfZ8rhTlvg!|LQ^1N}>IXX^*XpiyVleYy%$0^O>3IFLYVC`8+m>96`_s;*tzwztG2U5DWk=O-5 z;CRo#RkP zIW#Hp#NDsN<8zU@b#xyvuAczoyyAX|l6m%J7{mJDv`&TDk*J`+tyA?yhfH0;gEismEl+b-#d&`y5J!Ow2o`y zXUaW*$>(;jxa8CR>xVmS`lzS@P%qHm~cA* zBBlTPKmX%k0M57no1gz%8~;D=MfFB~r0v_2)2D^jUzkZz8veE#!cu}pBUR~f)GjsK zaoOBk>1|^gOCijXO`&(Bhsw&!b@a~thkf#^-`*+WkotPpv{+ANUJ*Jo&{puNX4{AwDV1|MG zM5|q~drxzIilGk6?17=JFFb?)FFEVkw-jAGdd>!h7X-r0Fu>RW&zy40W%x{u2D!FI%p)@RP_vZ5)&R>Vh;67DH z{oO^gAh=-0E^^|zIB=6x^A#NUY1TB+!4J?$dWNq~)cMwp*LoX($4AqG#P9r%>iVpV z00bzH0A(kQDRIXL%nBXSt+H1kZ%c8IUS zak_RB#Yqx2Z@DSvFah2J%uQ8*G_VSA?jXg!F#LxjI{L|jPZ>|&Zf@l@(e&$srdKVn z0(>F|UthhgvKj6Zs|!OJ4^f{>Gq%qzM?P@op2${Dn|QpGH0QoP#`N(k){W}DzP|p% zRx{I5n52XMnX-Dq|2j_kjs3gN|1L@k<2xS;oTyUl1-B)^^87D%;M!oGU?qF$;H+pd zKyx?Kd5mv+6{$I^m!$Dp9)Lrwl1Z}s$o8Iq$i+u7&%UzU zj1#s9N|bagO#Br)04Oge&)j4VdmEFauNIHKsb9=gOi+Wn^@W^*3-2vG#?MSX zr{1pvY;A3E4zw3eq&~&;94$P7u3z)~HStebaK8sAaDtT9ulJaK%ozTdQF&aTF6LJ> z07{c`yCWCsJGG6ZpXKIZwcfn#N^`3iq5KACFw z3FQQW-vH+2QexTdP7itOoV}C>Imp#i&e31E*k&UuprBU8oD{Bw07$ z%~*Gg%@`?R8XhW19MJp;$JKcgrYFkn$8#UAf96SJAx@F@@a_*@hFm#+%y~kjmLDKF zKRnwP!rq)G(jjIE6)&xYR`Xt}btn2$vh?P(K63%NOvcuY{_qE?vK>|Z)X3Tq3?T;P z>M`x&*jcaOp%3jEwXB*x*{yH@gw9wF0qdoDO0UfeGsc69XENeR*Ey9*YoFO9moDjM z?D2viCG?cgeLB0lHX0>9H5j#rJ@s~2?)kQ{!md_>@><|EqQ&=aJ$6~D6stSv{1ztY zGZVZKZ;2#dNj-M@BD>L+SLiC}vlVz{QB>tLv>x^2f)T8M3v+=If`e`uX*W(}C3r*d2Zv!R=cO zKqhD;pew3?5!@Z_Qrxc?*nxX!`W$ zbWOwq`D)7)?;-CQ-`X!Z6`b{bP(g`qBj`em3HOAh3@N@yPhs)A{L?1J>HU|SVQMl5 z=~0%J5Pe8^MJ>jo@T^n*I(2cCn~(d=){hVC*Qc$qGxdGIPJ=z}xkFP7yHG)71r)^C zh+XX1%0x%}!%3hknV4+^!RAsoz;$;WmcRU9T~q>J8(zM(hF@j!-Mt~!Ih|H^dNh6N z0(d0B?`}3i)3WwBNpX7 z#-6))2*Zf{LS&yQ@}8vJ%8o4>m=Nab7^Tgx=^a|OhV}y@8;SAp8;=fU&KLPZ(pBlj zsoXzBRYa~eP+L};WhxVyU#Q`%f3AT+=j zYO?FGDWtm9*c5KM$k|)mqUwgm>IFq?F;Id~)L8@i^R3_QU~U1j zmVnpQVQmEM0KELPu?#jl8O7LEYQ%s5 znSpj)uF>TiTBj%Cu$^Tm6`@?3CD3qBtQR`;y}g_4L$#zkvm?vMzD$?W(q{{z_G9z< zxT2D@rr0Kjs8cn!+*1NySb&GoX`vIT%yy{y>_z;Ry&i>eF*BZ$&Qr7Oh*KYtH%)hD zM{K#>!S$Qj#WuZ&z!f2Uvjr_;+CH5p^EIsts+xK*d%J_T&~_zZSHJo)wiz&e-hW7^ zt%JJ2KQ~qijT)~?+c^wcFE?Yu!_f9eyGO%QnVkz;(E^Fh5DS`ReY2uI&rUdLWg-sc z%AWV=YhDH@b-Ew^& zxere1$13J^+2G|Z3K~xe-|&rX+v%ftox9=Ewgz*RWzM}z0q*hIDYV$VRefg+x6z8U z7T)sEM8O-yj(~cjBzW|^Sc+0~w@T#jwlRmCC`Y%A0c#mBshU`Y{sxn9Cv30}L5t>I zd&=e`K8QENjVc_B8uvDBjAfzr4=8_^2E`XwS@~9KKAw~j{pivpH(BmnFS}`$Q?mW~ zxnOGB7T897wt+15_TT+*K9w!%001Nf?BP@Zs(sIU#X8*xHkz?98!UJuc7M%M24{R& z9P6JUaj3ETjnXIkn5-)Mx@GOAvIpSQ`PBNBFHJB@_IQT!XG5Jv2s=4F#VZNG+3IQI zX;|T&eAE|PJ3n<$=;6-W6gl;}OXkQf3*H~=V0$?0-OgW8nUV8kO^*6qs+WPKL_vnC zK7sA1`*gp%DCz0bLL!-ACV8j5ESA5axQ~8J?D&My?>qI8{+jP$R0>_wz$Xem+pSZ zf7H_zoN)JrW(}R7@mlTPB;KNS4ML2}n*i)jEDZr_q~WZI#M57$CU3vGh}@#uv!bGd zoca$31SZ+XHss-bmTI2nf40c;9;oze~G z3cbhYm?gXaQ})U;Jq+i%z+NcI_a}gx3?-Ltrr(@aPBnWJTEkfD{QSTtOC@D-YAej+ z<4?do{!Y_rMoLqetI1A% za=h1(WIQ=~0Tt)$=+)2o;cqI)FqP#1UTnhYxt?+uv1vHvS1eGnLb^gRtdXmhNso7t3R{dMxge>0ZZ@w&Cv4!QfR*yr$vPmXx1Ljbj;()M+#_+hle}%)a6C zXm!?>27Ql@d_V54U`4`g2lMvY7#%S}+qIcy<&OB8z1q!$kQ64MJ`O+XrSwfV{ZakU zoyJU2_DVWL60K@amD>G0l+%{yw3D$meukl)2DsDp;pR*L%Z+t9H9e0e1I&$o5SuS* zUzzJ8Ygty0bRDgPs)H}7wHrmHR3c=cg!n=Jy`Ck5$yHl(Ir+%uzK#cmVAx*G^!m$C zX4-}@-@|5KikcpUwTPAA`3rlpuf(-}2Q*9{Oipu4380@LFBQ9PI(X+C;pz@>zbwA! zzUK%ytj`z3m%;c*y#^;O@Py7#5?jYtMhEUZIqX(X*|;(X zb0E7ZjRLHFcs;2{y_&L_DoM1S5J~lgGBq(JsQzR@jO9!yOj8YfbY6~=!Qib zl^QZ*pT>nxjczJr#j5bZl`E zCJFgxVfF^|D8auOf)myjM}hQ&iP%$od*JgeVl48mE)|y@8K7F63il;s`9_X6Z%L7x z2OT}211_ct9?ON*Jlu6N&ez;yML(qYB=Kf_$iUIf1Go&avrT3At!(bs8Z)82S($AT zi>L3i9`pjBZs6ySy%K53ph?xz$O$aeRaw9Xj5TN2WkiUo-#1AZouWvH%G%7*dx0U^R$4}?iXRao5RFAc8 zu-190F+V$$+dazzm@O?W+6nO839wLO=f7ILR|}sETHy7|`s9A6zc|(kuqd1vm^Z8Y zsuIkniHSA!f|dLq3??31rp(b~8)gQ63w1WDGu(646*q`2%n)pl#ViEOTwM+B@>PE$ z%%^q^dZ$%#4k-Mcvyy!hRIlFekUi~}4RAe9W1^TVRHgD8a7<`v!{KH@0s?9czT1h@ zl_|&joLi-Y27xzRPFWq?xBmJ|;Q3h=0Lo_+S@+s!6CAY%ex#DSU{d;q$l%eIlT`^4 zsA9XAJ?M-Z{kjCKY?tIbTiKJ5xv73frOn&%VkjWr;upJG>ayH70)-Wydb8bPPvCf;kS@EsY__pa9Y#rQ%P$!z4YX?;ILHx9q3)Pg zkkU+5?NMOlZ4;Ge-#F01p_)Wrkxcu(v?m2ZTjNJQjF`Vl?KV3ecJZkhvwu-_)2-+RCG$RZZI^O21I*1LDXI<^FUYcus2Vw zcIlSkeM>1Z>Bnl@v44|-C4Fv6W@lURlivg%;APd-i@lUS8a^w@Wj~N^&ZtLwwpB@k(PiDkZJwQ3?dpwkW|hnx z+i%K{)%nm=!S3F9@6ky)GIOOrh3j6)H0h6vWA|wx&s-rJ1&Au9f0;qQb>I2FQ~^r0<~<)7&kTd zYaA2_oQ}Rn<3CaJZGFNLD(3mE&sW`0aHEz!!jIFF0pIbTtjPE=ZJISPb#Y?DREfJn zUvarr!g5>iec07>xmydohy-JUgiY(WTqSi4w$Jw09la%W?l7aU8)HQiFV)y6UVh_K z=UQqF0MLMYwShT>w9^Kry#Tgiq~}#0CB_t9AK68ku#}A*Z8F*;%!GSY^4a(vo3V6< zB<@S-dIM(%=<_4>FlJ4i<?7rl?2aokQOkmk9HVFH9v?%%bxnbobaOxoNn2LNX$FKQ;A~Qn#sv4q z7~RUN0+mk!o~JA|DqOv+>6=@Xf(&UKSP)jTC7&vAj@$L?2iKk);;4;(Zryjrthl|F zMzA%2zQo3*E;R3YgXVNo&IK);p=erVc7r~@P~o}nFY*doTRaXxeAi==GXo*!iz_wCuw-`;s9n?i}xvfn$r5{LxN0->{g%} zo6p*pcj-QZBTDeMIuEDn<@W#4HyBYZ2Nuy_VvYyUX=yvpRb%P%G|!!)Ctv+E3@5Ssl&LeZEEsSKr;M9vyYdv%wPDOOd|T<|OFHmjib3h4QG8Cxq1+Hh3D{N#`*DXv8bn^Ti;7%M+@9m zvvh`C{doRtxSjg_taB)1P5Qdy$*!ZH{8I@CvB5{JPJS62G3rACzG~Hnln1d4vN_L3 zN2rb%Zd{Vtt9l#H#iuAm>adj2>auYT&ztZC$Knxo{&Z%dFR!S8#F=H@dq(+M8xU`nMg7`0O3mAPgS+>Sv?7Mw)c{PG4O_g7 zT`x$l0c>>>S=S#26%Baj1L+5P9*5(Ob<%t}=z=iF7>(FW8Ve~~dcG-y$jpc5ffh}8 zZFic)gHpeL;~dg#qyRadT#!Atd(JYL!%Jc^=sX}_GlkQn$<_VBT}8X+^hVNR@3hLC zR&@ttXex~h4ijk*1dgxn*8cV%##sA>`5RjzS`&F;MtW+(jiD_MNn<>Ym*NqIEoM*Y z>W)wJbrqw`cOEmRsoB(8{iYbahA&*=hIeMg|W_Z6D zu$16|r~NQCY|3aQ(26fRLz@9^{bT-^K85A{W?s_zbKLs}j)H;dgK>zs1|cxp-8|$n zl-03}(s%jiLT*}7dIta4#e4SdrdHFseG6=Sim!8bWFEW+)l@6y_rV*1u&Jdtu<$l6 z2|cw4@kLjrK-6qpx%h!j9RMPa#d?A=h=aNT7Qr^*K1rWVL2Cxysw>+(_CyBB-7+)W zz)@B0gZX&T%^qPX-UNA*uEm99pl2TRY?lm>`pxsUaP}CPC{9l%(Z|9bmTO=xe9TZt zrDwT?sHUu`_?WSuhtba!e6#YkEr^)b8nf1aN?N%o&nC6yo4>ggujb3K_KY@sRK8{| zDfzD^!8ti*a`X*;kKROiKxFLq(b)aK!o-gj&pKqyQjiT4yu+H{Vz)+H4_$E3tXh6n zo_u3VPqCQZF~PAeX?)vk^6X(zALT~^YIMWh(4oBfP9uugSQNqxs*>T!G=)-Y0T(P!Pb{>Ae_Kk87f-EA$h(N#IO1X<;=! z0u0jGW8OM#I0(};FU=ABEV?h|P^Y<|(Orx1`V|x>oeehKlIEhgMlqW&u5JyV#6gzm z1PpH@Q0db3c6yEPqJBkk@^N2Ex+p@_j>ved`*3lVYG&gK2!`s%X&H+O*X%r;d>Og~ z62P)G5c}9_TKZ5+Ho&E8cv@+uBdA;E_+5_+`B_B+{pdIcvqPvZYALmw)*#&UHgMRv zvE~7nOOs98VW{nm^xwix9r2VxANq_<%9B*aMd<<|JdWcz?A<|dPF$`dqmVn0A4anW zN0G2jB%9L)iv{PORE@U%9*O$-3BzjqM0GjrF`eH(S>yhLiDInCX-eQD200=I?57u zs&g%)lq+)>iAmg%i1?gW3;0KXXEQx`6uwb%>#XH8W%f-R2HwITQK+nNwgB&l7SOp$ zVVh{|j3qDnLmXqEEi{G(Q_lx6s4-C;Dnx!(Gzp!PS8Lxe67hGwxV5z`}aD`+@lB$`s;E+5lvNV$pfrGl0|In#%jB-^hfrZ5S~eY z@tN`;ZR_IsY)TopzHJ+h1L%^qeEEUQ@)jAr@hfA2bmxMtJJN3mU7E=2rat{DVr1R# zFvU8aWuQCSqG8=99DLT1xr&v_@1Y{V4X(azXvD#Y4F-F6A~*?GMXoarZaVjZT$ym})Xs3G@SeuhVXnBbMY#D`ZgS?Qoh zt`t@+G8oBRRM0)H*!N)+?qrcv*WEOMHd^ccjr&Gr);<6Nuda;XS4r{}!&gjlfMfV| zw~9LvR-USY{lq?gkAH9Is7uc>S$nt3Yu^NqKAenf&gD;39T&CncvO>^&Cf`t7ut@= zaFUxU3cW44E2*HKBr@)v7?zSoHMvG*XpqTe?;G7791eD6KKQKy_`=?E#&Yw5PFxgZ zX?8v_vDRxu=`Ja?N9MjC=~XxQ+HJF%U)}+vd@lK4W89D!lbDfL7RHsh@2 zI7~c?$e=QvUq}V(0LFe3PTA13m-S$ZcDnVE z$y!QMCo}w`;>!9r@)l}^dHGtSyy0McFl!;^2$F304}0l92a@?C)2*b*~p8}&O%;CIZyfrH_tSE=gj_2Ws>KWOPCL$|5jj%h~4IHkwFzxP@+|Vibqv#8gx#mo(0GDy`wP z&PsilIvul(ix7kF+6_+#kCZVj1IFe{Juk0<+%*tku~80%*ZYzMj?QRMRY7&^;Ueqcb@(Rr@5JEZwHb5GW~LbbHj|l2!34#Wqdf5N1lAx<~m- z3K&Yp5NUos>(m1BDj*S-*##D^V9*PfQ)}{3Pu?8^3fSNMq1<>a#?@;&dTFFtW*4n| zi+60`Ik+!w=;aj(g#sqovTe(;*{+Y!l!BFFn8SGX6108B?znbnSRF zXq`TdIuZnE# z3Ip)R8gRAzzxYOHedMs~&eYUUXedv$oiaTcU^195i{n1X=+oEiF-3L=j>`$uYf#(- z{waj2G4k_acPysNmN1dcUDu~8f3$u`k8BhSJv1do0C@e~lBbfCXCOFNQZ8h)EV1JP zrPMF~>r9KK?V*UrdO(9npndQnN<97rFZokm1nP>A2cXJ`+-!V&cgOcEH%-PNxlk}D zAzx-|pZZ&8$x?^=FowV&X0wwGUVpa@*7&(jcoqoKU(K@kJHaW*_vGMdM?bwaF%Z$- zc$*Q;66~WLMxDO%;!%B&pMw7DQe%6bJd2nyi%kIFyPn#kXPH9le!pKxrB()r4E8Ty zsal(GAr*JT#v&{>MoXHl^PE)-2ORjjs~5*?+s?l)R~eRW2Z{$?pQu^!R;>!eHGXfH zb===vbg_Oc&5+VE8eUcAdU7&fHdpI4CD#b6x5JJbZz*N=U&qBI0j$o3+)^Ev*K&>k zdF;wx(-CIAGzgkJIpo739B5u$jNG~No#zA6~Be#T*$+EZhfEZT@ zA7J6p^6^pzI?@%nYlFHw#=TK!h*s9v?E*;vURhuDfdQ9`jR!HCUE^dLw)|C`(f%xn zcio4(Bvl1Cw+HXYQD!W#=Xx3j6^M9DO>Exz+htLiiGq=O0_aRwjaI_#)7q>JC!kBo z8{aOoP~fqGQtiITqdjZv8&~Ca_#7$6OT>HpGdgXL7favlZoQ<0eaS}0ZB^&46Z02m ze;7i7xpSk4C%jeC7n)^I?5W6w+Me}@k_vAr1o)my|L{Gp;-3I-q?CWcu`G0Oubc^8 z-v`lH{xe9BS^h)zFJ9~U_ordx^O!**ol37!I= zeuH+qZz{b(wLJ_H`R?_cQKPUfc0TuS)}Zcf=CZp__h<@$g4%+J^O=B2BNKg&w+du$ zP?x&;^t!10GCls5Dh%u~!;_l9$hNy-QIUYrBL|K4Rsx0eprC_qM&;j8!!aELuGOgUJX zhckT3(Tl`5Lj%Vc*Y{x#jKN-JieNsQ*cZoY-m98MO`-h<<)LFM1${>grzHGo)k1qL zr+|UV^yDKUrZs)Y*FA z)t~!HK#;dmaPQrkGB?MCL_zT}95aZZ+7e8!(Nk;OEkpH*U1gS@<(v=zS}WH_D%Y)X z7b@#!vNH&c6x6!fB%0XL8+)33j%6EeusS@S_19ObTeFDo(D4{sJtT+!p-6v%;XaYw zaAP|`YE*Ew+)!PgT2+PFK2b{tNv^L%`+>&5@!HYCp-alPK`Tn1DOa#fu)3U3Bhjq- z*`Cof*`0U6b<;8?f@?2f7}L}V`CC?*c@7F25Nsv9=noScnvFe8O?EOZft?F7?WZ_FB@-LEow;~{o<(yPDIg!=cc#hFnsX-ziiMNhl*Zz>eD?mxg^(o4<@YDB?Vb0>A z{=^QQvpz6m?+^2(_^Z}wroJfW9Y+LJYT1L-23ag!e|_X?R9w!2G!-OOF(hI*5F^kn zv$S@t894L|DPni8b-+oZ8BOTxa^cnyApAKfN~E#vb+A`_DTX1k-va6g-FJG3d3g}y7MGWMjbG66M$2`u5TzRz#y^*Kg4k0=Qu+s?=NPCCQ^8CwcBd?cJ!NTgCOSCfSm@u_U~jt;p%p3g?_I<5X^Bf{F2Q$qQGDRh~Zro=E!w;%|x+^)onk|?$jo!nCf-t zQrl-SZ^Cs$LT#Gb27MyFTT`9#GE5Fj30fYoeCjf?QDJ@AtRJg^wO8}k&omg@jGZE z#2c-j4^+UBvE2Zyz38)Umb2rZynDO^?M`4nxvH9jx&#PR84W8h0a=LP^Dz8rz~1rm zO;c`yovq!~T$GV%sh`vI$@chj!^EBVU1Ne2fBypX#{0CGCjj^X0V`Yyk-Td|jzrA< zlfvR;elyz$Ot>Mie%bH2vLp3!VbP;bTcO?>&v6}8W4=M6)nU?Omv;S*Almk$ilTYn z$}NZ5ZIXb!&mF%#C4KbUPvgV-6p^`!A)qfiS3`YfBJ@lYms)l}F+N0X@1FtTSHjz- z>rUU%r|Ymu>?_R1nS$<5Wru4-Hlbnc# z9LDoEU){YAbu=Qi<+X2V1Eizi5``$~J%S?&K!%S6C0J zo=t=o%_R5Ff;S9q^OL?@lkXRIacOAkJ;<7d@wN4&PbrkgGfa#pn%;eNP?ZN$%V2pM zz(0`Cxx#vVB;$jY_WJc2yU08iG15<2-4ejj*K%z>uR-NqNh&oB@m}{h`M(M&@;*85 z0MWGAsFKHUG)R;fVW3Exwn0;51{;gOwdj*IK}zmTNI&$+Z& zE&)8khAtF(dF^Q?nLdZ-DI(JIgJ}9qi8S;Q2XPKpdMd1tCa(CC9%8v9`qVt>p;$5kU;`dp9mB|IFFqqni(?!lb(1hB7_cw=fq5a;~=PKS4R$T=g^q$cm>u zBVLd;MAL}5bj69x=s~AkVuh?b-ZDSc9Iml+I)DB~`v`zm8eMxbZ8Uo=LuC29xk#qj-`ILs_GtYzRgoTz&@jxYTqV00lx(+7V1{LPx zyJcVRo_V=k=BP$zcIVwVQwd(Ny|M&voi{PAPIv0Aj9N~8I$cwg>+P=z7tAQm*Z3Om zz09hsw!ym&AXLPKwC20_&FPNsxg|$_dO(G0)9&~fYzd~UW!-u%7dUh!0mV4ig`PWi z`Nqxo=2w&?4jZ$LoOQrU_EI~I4ZSo53LTEOn#!o=s_mcmwgP9>rf&EICSI0~dnhJ+M20Ci|52j*)ENkaCvb6v5%MZ=nKWvp#6{wL*_5Ze=5WC)Kb>VX zG@JbTGdTvKo-vW}*8{zr-!lX`LDt(zVJOP!p?5d7d z;7ot;Rg^!?eV1t8klhG!VTr!z!5S|gx%Tpp)+ncl&T)GJ^&e-i1j}T(xsEJM78w5k zHDT_Io$b%cHgKpy^As+CmB?APsF?m}a7l zgvhr>4ogblZY8Le{x6hIWr`Y6r z76$VEa{6;RV>XhszJOY3yK3>wT%kuid!&5fX zEj>W__UBTPOQR*6lfEWCEEP;S8_JzC6~@*LZ~TFankxCtV^!PCXWSTv8p1w4Nt>~A zzI!9}zm!n@{+9JgRz6U_(bjHeZsK08S6w^0%@7AG`asEml-&#;Uf$iP zQ-i@&sl!XlY{yfD<7>N@H#RoJUa`CTuRpFkI{Zj0uG!{f-{?`1;z0UdzuGx;`#u<) z+11r;FFO8UYwsIl`>@fCkr2t$wrO@yW}kLbV1h@NYCAB>`g$RFZ*M*(OAzie&K$@0 zIe?xRinYVt`S-8T*+l;rkB{PvHcQ z=vutVW%*Ec(;t#K|K<~GeXqnKs7d_tL3|Dg1&DZ7Pq@BU53>aMXNCXu6^7tXGW9B% z6XNJEIykJxvmgws<^nsi?;S=W?J8)qr;z7&#c;lUCYA_#n*xra4wTmJR1dktqPZZ) z4OD6}b^2X{9(-3i6MGKYXC6};L2AmQS}w44{Ah{T&aA#wr48jH*P}z&BDeeoDTu6?+X-a*fHI6eaW7k^T3P>|jJfmr%VMg3{G}*_fH~ zA`}r6ab4F7Bc52r{QLCp+j&}hVdS*QX|l4v#FsE@4mT!V11+B(W4Ulb`GNKFB(tIb zH6_nzL2<7-w4vT4PzYoq`%AjK#1?IX^_L_=b2{bi;{O}$F>ZEp8mnHHl4qa8!s2!wq@i(G;nnlCW@ z)zRkncYI)I=BY;neHl`;D^N#o^N!_shyqIP0LZsZzN3qqEay?aVQ~FFzjV=4j~Mzg zuYfr>mj=i6ax<|^LOx$WP9wVW#W$mZ^rxG=mzgzb9pdhb{4S?ky!oHFy)nhK+*BL! zb5zEg5405Q-dzI;(!|VWXa;6ca_2ZQa$i85V;EC{{jO2xFLLC!8)n3$7_ws|`m|!^ z`JYfzTu&y3?i#Uk$9ATAi@i5A|5~s-{pS|>bf)SOYRWM!T&)9<2x9G$w8)R(8T5sU z>Ql36lIqd@F+)28V&C(qh9vT+qz~J$Q zw_s2uv=3ieu0{Zx@+=#T=;Zg0?}Mm91BhML9*j_KQiDp8B!1VWQ=Wvoybk&OF^>-x z1;*Gqb%))}N5{P}&gq)8G(IVJGy`T{s>d|HTbYarmx5*vyoYIZ+_PM_vc(Gk2*sjMQLYKHcj7TUH>q6C$QB;fkV%s&(RJr3{^eO z-lNQs+&~SMHLEOe4U{`91+SXsSY&MT4N*A&$I>Quzr);%(EH=DqdcBS5-4V%xW!22 zX1GeKkhgz6`*hrXK6DitB8RUa#^=^WB@?jsQ2O(`(L$?e@G{5c0I zD{v^G=sAP9i>|mk{&5gSr)A&&_lb)McuJ9?+hqV@>F?{uVx_t4DSd`<3GdyZn^$@ z2%q3_>eQ*Dqn`dd-T$l>B@8hN#p zR5_@jBGb>cdQX>-#N)Y*x2f)1`Z%^uLtb13Wr)U~R$A4FTh6tJ~^Mp;a@DdT!9h*q}`{2M_bWeM+XfUNyfV4=wSn4dl zdi_2G@Q~b7^sBUT63wnX;!{E0x*Q?HPoqW%~9`c>^3aEniA=^%f2S`IVC^7z9wwAkqy8m*x<8!Ntwwlh-Xr>nd)fwNZnu5(^CKO@> zJEIyJ8c5?`kNuZv7)sH6HOwe4*PQJ{(;sAN^^{S$&fWZ>#_3?TfaY^b-FcA$e)ZHw zzeY3rnq=`xb=j3!7~sTWqywK8+OyQFj8zcaRR5evBf4w^gU$ETRCkNA1+*X z;WKL%P5TwL`Y`W@RR3jB?f}bn^%B9?u=U<;O?%$-JO2{nucdkL__ZN>!?TGiAQ4s~ z=%sV&e~x+O?fEMp>HAA`UM$UT3|s3H1Acw^?@w1xdtuJ|A*J%CKLC%pu6FfL)x34* zK|bYVzU_I`O$sj-5^tb4z#l97nCLv}&dn|I`mpDZ@}~`-NdKuCo^MaptGsEf1>Qmd zc+5qhnD-yAa^>nR%>cVWVIpYoh5rcSKf?H>9{(pbBR1Q#bKN?A%9d2S*G2*U#Ale_ zX|^T$jxC47?K=g}V`hcJO%*pV`T6-?Y=%G^-#@m>;MZeAEE@MM|5>tT_SC9cH0oV^ zHXq~7l`18gE8=(S5+9I~YF`2Qq*nizt^69WW@x~G#{7RWZ34{R!v zqiS02B}cUeX((o{6VnKEhgUH!Saxr;oK-d1X(r2bQ&PHe-nhXLE3Vy^sHY>}JsxC| zEVP+oC!L`XU;fB_-`!t~Fnv+0wmL<|zV4t^sJB=v7o?*NLXgucGv$Q_K01LbJOeHO zmQo1-n*gp^r4_8230SObk4KbUT8XbfB9`%rk>14QS^CaMD549plE49z0Oy!8^(SRz z1z6kIphn#d7>6uk_ai2pO`c`My`19V8+h|Bnqz24%f7>(ehD}3{yexNu9gFraak-S zsMt&k=DuU&?b*NLcQ;^P_*-J5-O1aOnII9iP;@=mqq#p z*!%Su+fAGWhq-&2HZmDXL3hUnZ@%~k_k%Dx_2QA z>osNFH6d0U2c=f5b^FC?O5$5DY(>dW!mcL>0JZHSr2q078gdI}20D$iPVcS{N~t!c z(r#BSZxK5Z1tOkp%;liYZtVRH3YYQk?K_rE+B7GQUwxxg=>8p>SYr;=|2bcT2-{+xiZz!n+-d z(0SPpYLk!}*CCZWeN;q5fEJc*6D$Gt;$YKRs(6|!Ale)dpQbVKMditRwmKMl#6(A( z8s?$5RS&zND?^PC*Y0jbp?O^@U)#GDIVbuRk)lqZfB3Mh(8}Ng_nRe;sd+dYh10UD znuGZJ+GjiT(e@KNzHNhFLW1g!=3X77AiBSlx*Ux`+ProxrC6LM=Jdx@z#mrApNiTN zBCFU{G#d41YxDH=I3$nq1)k9jwN?X_svxw&t&vgV!)-RM2X(KeYeiEBU7cYKgo8GO zPT)8Xy&Sw@!lRgwt*>V)DK#-2P0*jfGu8-|88BO75fX+YZlZcND{%qQmW(R{$)OJO z{SR2*>DlB-NotJH3AS;UO)MNNVC$kg;!E1xZ3ZXsHz`kImA8NkB`uDpuMZOh0J#(< zKeqp~oty{AV}J8OYinzvWMW>Wv6t8$es(Kt!UGYniyV6Mb3MHFl0Y(=yQVU>*h-zJ zKrihH@}TKX#Rkei`Yb8e3N5s|#^@2*MzY>E9p5~iR%yrOC;@@JpY5KG+Ng79NR~?+ z@e$l$W<=sOxsV}va&hX!|3QjW987BhaSrqxxUfQ63{5h zc15g07)(;W_EWijH@s{sV%gEm=8W&>XF^Lm6KP~KZO|{!j09x#DX!g@EG#DLUpQYG z4+ho6{75>gdGo@6X5{CfS{_fG_$TguJvB8}Z<5qY?_BW~Af%A>9apq%Ex1{9?E9Eb zTLq1yoI(bf)7MW+>mPp@o6H+de)Skcgd#k}?*pbV~Qw z7;0`@MA|E!1tT7weNRRSIF!b2+?wQw#9>FzL9LnMX#CDPlh|l#9(Y)eMrUB^9JD!F zS+_a5M^~G{!z^ZZ4n`q1HNRy)JQO>K#9uJko}hXoJ)Any8+lZFe}qUVoTI%kUpeor!Gq~!(p=7gBjF%aNkual9k;Y z8t$B|9KulR!d^tJ-Q$>Z=Cn5IrStu*&$hSZvYR57oXH*a_qP?QG8*c8HO?}9e235% z2JTDOoEB2+ztT>QYH&nw)WnuFY=UX)>_+oa(!yZ$fAiM1{VY4xeyy(~AH<`!EM!M_A#)ngM?Dw9L4v=E;crGZ}J| zy+u6RQA%jKVaBd1o1+qX&sS@bm94cTHpZ*dyJ;bzd3CzRiz|%iGn>6SXHyT7>E7FX_HG#N%9; zsB{E23<>qm@B&liniuK1tOXfz#07g*9(COU>DtH;;SPs+7NW00d7_oo!Bk4v*Wk$( zLypl*b&S8c?X%Yr9Gawgo8C@ytnO9R^?^Ebhv>+=*L_#z zwDGP2c8D>zyqwamsIwia3!}Vz44~y256cRC=E{~PIxK^1!UKQkhBK0}z}*!_U(1{U zw)jl=<+%~C$4M9N))jzrLYx82Vn%GeO5qc^giH*}m{3(C<4*|I%Vi_kdWkJW*s}Ge z)8n5^wR(g-|5Fd7?je`ls`r0XG88tC=U5dTY7Q`V+T19Hl2sg*>ie?-%J-!?VVO-F z!Dg@sIs3LuV*JZFS#XXVBYU37_XN`ExQ}{E0+k5cggfAzPA;2Uj*~;rX96e5C}JB8 z*}tVTlZ)XImYRiq0|utXT!0QqhFLJd$;ry5;2%n zQ^o1YG@&xM9_Re|BK=5FbtP{K@>x8C*^Rgww~uN7SoGdnE@f{cy_I#7+hGehn1@PqBiI zkS|^rkEh4$J%>Q}nrLoaf`D-j72=2cLA&?pYvx=ToRoh$13lZBaWMkgQ@20)r@3B^uNbU9igN*DtQ*Q_9HUgb7nnUH zS)BuhL;c)%R9OjqB5;erEm6wBtAZh;M^!bYs$EOW5C*!NWrW}fX1$xb5KTRM6Jdf# zrEf^^r(P9x9YmP@Vfv8^jgumg&dN&VVXq|*iRIO%RYJ36Y8Fm5EwD?Aj<%xNQZvI- z%k8l;oES>Wu&}4RX6bacZ|+c#sel?wts}(GG$~YK@Gwnxp}*bPyoV2_kMOV@xp^7I z;A&s=`EA)o$N4(juy;QL6GFC6qN*zZ-?u9c@UJnCrF_YeL6|lonaCmRs(!Tfg|nv) zPS>_Of(6Z%cVQCA;b@5zt`%32Ne0H~*AHn@2c%VQ{KWP z$!MM_IqJFUY6@AXcIW!{mFO_xj1F;XBIw~%76~q{i>TTI(}Fl;+x$;Te+{RA!AP1A z*gMb#DeraaDy29x#Tiewj=Lx>FC2U!Dtn&dixL1G$M7AJY3*m7NEQ!`8-#}DSSBt!WMd|P%v;&f#yLIkbDFE`D9I6>S(^J7Zx(Wf&7049;MMwk^|O%G zPG}`BvYavRq}V>a#TX-j(=@XmZD_9Nl>`@I)q0U7A1krB=)8$w-*pUvziPkET>^!>LoD3k` zE+Zl}0l&~UcyL$8pgd7_oFAr9-7S{EJCrW5dW!ahg-m~b=AGuc?fv6TN>{I%KRA@n&q7nOaHH`#E74|cmR45Vq_n1k(Xm=HD) zmFr@#pjMU;(|o+!|HB=XP-_r#za+O6|1~@oa)yQ8q{PUjpd(g;`G*WoxcK&kflF;_ z`6+?#7VoCFor6xkbX{AyGv&`ikyX7hD@HirH=z?nV#cWffAd90(#qs{R^*u&Uv_XI z4*yE1V6GQu+9Z8WQjz`MS+ws5A8g~QfvPt~bY+!u#45^`Cg5n}b;+V-Q{6Ds)|!R3 zmW2%EV4!z%|7Y@W`xkmTXPA7yVD=^c`sqTG`uV(_3YU;yp6~;`W23by2FPRRr#D7{ zNGkfi-vlw|z%`|^-WoVM#hAryD%PeC(p;rl*A>;mRXyL65mwYbrl(o{gRuBb`P!=GZtb`!mIo2PtHas1jGLS1E5P_hs5ksR%&* zEN`GHblh zmr);<>w~d0GJlE1+UMylGJ4dY$pr!RTR8-m{Cr(k915KBw?#x|*Zfl50BA3A^ltvV z*!J~>6C0&p8i*4ei=WUeza%X+R zP;2}=wR@>V&q8uuX;Cr{H4k5XH@77=$7LmwYq@X8tEs9^iB_fj;gd{5xrAG(uxouu zWSV|`J^D!V(oxrg>7Ob~i&duh_r4UI9Wj!XhR)SX`KqrfcDu$)MO5p1D`?=Mb^9eb z;&T(1uCwgDDRb^&f1-04l;6oCA=)P)*d=ZQdzCW@mR@_l(E(PUd>e14lWNtt;gjcz z2Ae>kl@FejRl%N!9_$!Q`zb$6*mwBsD0Ej&NKrYYFUiuj0@g*Q-83#*bEzie(+Q7@)d1Y%oo>XHf!!Fjr#tdSHd*QZUtA)TN%~M<|(MyoMzcenPtq3-f zt1Ck7Y!6&Dv;B~E&NSMJ{UU5Rc>lN9*>O-rI=N4*lS#0+9>A+~^z)uH2n> z6>-&DOAGSBVgl7yE0Ou3^-S?d+c4MQ#n7}9ly%4;>t$);GoCAXmTJ=%h66Uq zjbNEx*Zm9rm9qOAdDf91yl}yq7K3*o@g8ufXq!#%8!CIefyYOM{Jj5-kk)X+gRkY~iJ@ zdNvhP!z=#qbb*_$izOmSWHBL(Wx7I(ST%?Ks9dU)1F1k?y%*?ep;NsXZ^7EIJRR>s zn)nMKceI)rmc4RmVMWNe=XrQe9aXM4rdh&mV%2mxGjcu1r6JB&_Ss8FB@Vei@q)~F zVU^RQF#0gv1ju3;Ssm21smLlj(BHcOrc#yacU-2E)uBkiZIcJmfy@CYWpOZ8HamQH zZ?i12a73SL#uicCkuWH$H)d%GwA&r4;~%Umr|uxor|ft5Uh})|cHfV9 z4{NAs1KYQk!|vVr?Cbmd{7hAVCAC-CkU`oAGvzywC$6{gNODo3&(Sb`EE&5Ww{>6!@vCI_49Hjel7p0CVWt#7OgH!Ma9*x>mv z-o74Hn;vBau=bp{(`;*gtUFv-dI6k?D=re13s3DKByO)BIL)?g9(|bhk)OQapcXDs z!*i1=(n{Hq+=aV51#0v-PPCHyB5De@0R6_`o?CnA$Ps~Hbch%bjDpz-4^>KRDoO&K zYC1d9tHmgYs9N9VQMXEMA99E6XC=&o)z=K=F8A{;#gSFXZcw{~zOp#_%0?HDa9uyV zIutE@^3;2HeCnkFrydXhud}ooqav98(+Taoi{t*LouqDoPY1FL{@!hcKX$N=J$Za_|e zB@nLvD-9ztm9%)Iy!IkLQ!fL;F4Jvi+-;Rlu*GfpAjcXg%=+X$*xvRkkCv7e-?IiH zt$f3WZQ(YRxYXVhIf^PI(0_!_q>WN%bs#6U*y3B;02?eG^lGlFWHVsje4@6-VQH{u zWg(v5-KrhMg@G>)B<1by?iSk5$VW?h)YgpO;5U_(lat%OGS2iXW$E}+|L>SVtwvfZ z2B?nqE#B<&+pB!=h5i(_F{41P$7h+jXcydm){_*vZdwrBfhwL6K|;eV12o*acNsnQ z3vx83yY&&vEJ3t_g;j@#gjGKK>6Vsfw9cE0Se~_^&>+ikpl`w>piK)m&=Lby8ZC6< zZ~`>a6U+?wmlIZhAC7=T)R;9FhKkaxN{39h8Uq3XtkTsqH9zdw9aGiY;|Lhg*akHi zpP7^#a*mufVi4dQ1=M<%xwMP(3G*)&&C*$*C|Mxc(fR|1V8+hLS%fWdz^M@8B~JjR zTz^x^`8*9x-C18=0bl)xK+*Oz?Qc|<&Ynv`@D|~0K(E5kw*vHGy0>BBi3wS zDsIr4Ve5evnss{cxwBI1j`CCu6{|aaW z7X7a@SmjNWL%j-ci__ST-tj!X^X)D4RH<3domHtH^GoGW_xg)`m1BkOV5aTpX@Psf)FD z{ShP_hW=8DqgAX-FON^-BlAlWyG{3pO|i&1cAFOeK^vLl0I$~jUWNwW)!JIX__K+| zpe0+YNX1?AI>`KIO0$sJ*9Q(c$=eeik~8_L>KPP#*QdfGW1O~1vZXd z%Uhuo757MxK!%-zf-Nk5ey{fj+LF+*0hjk=#e%pCJV{S@I)AB)N0o-RV zaoOetJ8+3YJ5SyI9opFljZs4!@HygOYowdu8lxv=Jlm)N*2s0a1Z%uK<^-b!;SR-J z@v=nflWTiw_sR23J3ibdqv5_7`y13de#cK2Bhq=Yp5}$!=u7keK;lo*eJyWRg8()@}8;>6ZKgJN_I#1Q?RiHPgoUoE~VeKb|x&B9cLZ_a}+BF zdOh`KsInbfsCjsmblNC#y_GE~Iq~kFoA4NX)@}dVg#IMZjk)f!ZAbEgS?fH}`<#)+3CQhgl7NZko$XU^iCf6y<)fH+1;|7AC*t-|B^li@Q1GadfbJmqpK* zkd;?k2y^Z;x2ILBS^GlguZkf>6&8B23^-WmS0*t<0alW(3VPiLGm>Eahj8hRQ{p{r z0S-e>K(|Gh$pT33929hQF@G(+dxEKr)x5kfLG)%#Ea& z#x!WY4Ja#UI~0cnYm-6&2D;2=8K9zQ_Vg?4O`K(?N*;Qjb8L&R{Q`N!;+XWO&3kdY zusVwWURcz+7s~))M<3 zr3e=-H_*`x#`mJ@W)E@w=7pCz+9ib}ji2Nb^wVGk$$zAT_v;-y-Q)i_-D)+MJN04i z0afF@Nz#E!;ZqGIA-%*^)6*>t|^G=2o^4GfR72KUYb zJ%rY{UCYKC!%aJ52qX#zkiFhcj34E^txG|>h~wb|VU zE-U<%)|+foVkY~o*j$y4mrJL#!&iPXJ)@GPzU+@3B+CLQa{HCP*@piCS26wvI$40_ zE-Wm3e5Cxx0e$G~Sy;%|;}P+1VnGfsnZ56IhW)M?kelOEd!5UiSU|R|wKa5U$?9H# z$}n>1?eCiT;yWs4_!Wj6E%1v>B`PhYdGzyCfIo+=y{>VGupFCq~A4f?;CC9Eh&EdcU&?v0` z7|?*S>6w|U9O`j_;wQRyX%_59d@M!PK80=c| z`Qxpah~?Ymt;^MzcyiC_Q38gO{~v(SX4@)62A`Yx#_0js`t!Zk&NMYOIV!KxdVKWw zPJ9ityYtUsHdDr{o#Dpx$2TkjUn}|O=oMF%>aH-_qlusrqW>JWyIh-#-*`OO{`kg~ zbip&Upn?IFg%Roe>5+f-U5afF+b3Mo*h$v<7*CT!63ag;_;Ioi+0{Prtpn)m%kqDl z#L!w6(GenO1rZb%Ir#fcn||)ow{@o#n-@eR!*?I#M;zu}1?@`wBO9E~c~mbU|73mza99KZhXrnx z7I>i4e;)XMLxu|~`TaoGz#+%)rM+oRw(J}nVL;dWHku>C9q}tVOlO9MhI&2P4}0?_ zW_!z(pYI|U)LaNTWf>|;FFqNwH`ArvADAoH5QyPTYnEP+uiaTTv-j$!rMk1q&SEN(Y>g)CUNoi@6n8BaBXks%y5oC}*u-78iZ_qZq_2mN*o?>&o$r$PW5>Z~BqRHM zFv-@9ZgIwmrdmd`M+2vIF27e4!hyK71)?H3HCpkwKI8qJ3ql~^pMvYnpkD~DL<+cC zcYwU3xsLp`TeDXU%?I;GQcSW?IGzTpZ|~43S2A@Ji8b+qFd#M8*VnK40eQ%S z-L5+y{V1%zX;p0Gil!tcKA;9^-kL)r+^3UCR{1p7H#SU0%U|-D;y<*Mu8&*Q?#|jD z63-2d=_57;U3O=VP)@QwWd_Ji^+LHh#cPDcyO^dx>h|3^gIgp=Gls_ic1g%ua&m`) zf}md7TWYOSft#hH@Y8c2n&Gn^#(yR(WXHLG!4-B2=|Hu#qHiKPUQ+GN2aJ0Ma#udt z!!JMY&S0A7uGmqD7PgH?t{yripI!orOY42?9zZj=?mWyesH+__fP^%iEdT&BMPa<{ znThX3;b`Y?ndSEq8v9km9bv z7s?|K0(@yB!MGSSBVu2<=gA`}KhC3qJ&4CYXr=D)y5I4H4(|i*GM8% zD|W&HF&cUCeCAWk6)TmC?L&wIYkh6H^%!C`0GlN<avqS>iMpIrhz{1W*Rn4On?3hxWa->oNN#<9i6zae+Ar%Pt93*0 z(zs54i$Y69D+i8ek{=|Hm7DfLn4IAsLO5oC{|nEkgDHx5arFT{){sNLGGy4Y?+LC; zbVa`M(o;Z7kTCHXwW>=hnLMczxYB23GD6MX7|XmG8F0*zP4PS)j5dwR9(8N)Oj?AS z8;Bg1Q-m!)qWd>P@PHfu2l5`?zpIQOi)L@uesiS8hp!*AYQE2Pcr~t89|SwC`Ni}w z&{CQkQcxfCO zpD$2w3b26m@+p0(D)oE#yTzD*){SB4YnW#t)a0=ehdUIz+eJr8Zu^O7l2)K>b+|KQ z-h7Pa<Qo7Ni>Qkg#Gn-7HJ$d5Ux+VwEX+QD#)(cn-+xI zTq|OqEs`960ngxB(=iw8m^_#j#+a`%7}`5fV+0ys3>u7I8-N^6eXZrjW2{=JGX}~ z1BhTrM`FtfU%=<~sL`NJNku%0A6_`K3GRhTm5h$wtWwet)2sx(Y`7C6T?H`J7j`?| zNt|%vjb##@R>$qvSZLH2jGs3L3ql!2bu*rGRPxuWxUze(O!)onqA($$ilivK{1|Z( zOv2ncacvHL2x?|z6pMtWp^-*118zcYD+)R&fGm1$J#`j1MG@3sJd(8l6b3S3gp}{UdKhqEwk667oDN7-$ z{_|j4@_mTp-k=iCsP*>P^mp&eh0ogecV}zSP7kLx8ZCoJpeyG&4s>fYhG{C{tE^QQ z8R9<7Vqh9o-}gWIZ|EU|T$09EV+XebX?RMRitq^h!WeXG9Pw7KTwC}HHl*!weoAs! zZq?!NXR~6gK0;659XIp2ge9xIzIWb0rajnWyl2G`5KT*nYhKj_*A7~%oI4qfgslslWMK;wnMClNtwFaP6N z?V)0TYC@9faLPb}^ER(t@AtWek2Eqek@LbgT_>LmIrPURJQ8d3Atej$R@Rm9E=jM#(@4Huf(&Rit_?tafxMsu{O3Z4=aT<(9&t#Nm`6X@&j3eeLhCmWC2fAS<5ykfjx zzGfd4t(3m42X)R_Gh|;PsZ8*-Swpz=bqdRmlv*!~;Qd|qjK#UYg;r3CD;D>iRz&7l z8hFQ2Pp8CdKn^~i&CNUq-HT|XcN(qFRmCJkTE!%mHbZwNJl#F?40Xhd_l0JJE7sex zti}!~R`R$jWe>%-$I$`+88%9|884N_taM$n-nV2Wz1mLnMAk7C#n-D)T3+>HUZad8 zmFS5O!&YIIzll8A36(xC7U5gq+4<+oO=T11H9*tepDnup0#}nb+V>cb>b)v)S@K%; zBE`{~zJ5Msyn?q6@8J0nygJ0|4Xm}7aW|X|RvK$*nV&MT_T~qyn2f(_qEByM3tQF; z&us|v2MnemdCm8RpAqH;;lxlIN#{ldERZOOb6xSri_RYmtjAyIc9;&+Q5pO3)7)aM zDKm=}RFROgsm1@I6^Jujv)vl^d#HRp+b7Uwu|{;Uqv(#MEPOt{;Ko%rTD-Yi@(5Hm z2JVok=NWp7`RQG}%HYzk?8vMITne&qCivedNVBxgAo*2@B+>p16?xRai}VzYj<*>6 zc93D~_U+%KLH=Ig!B@twlW#G|j^rVDfhiZ5IIH}wGpW{oEdAPc<8nF$vJFe6vCmXc zkpuvh*SRIf!M|7ZbR+C4l|LQI8G74T;jG(s!K+Zjw3 zi~*`KMX$>77^E*DFG;24Pv9!}s6gf(0~?mR)8Vk`1elolV#eWTZ%j_%~%bw0rF=~xGMd{hPaP@jKzJvqiN~n^sb&(l|!kx zy0=B@9#;}x?nV2f0*IiMLOsv?=sD=Yj& zABp*Vfsyn_5O1KoWsfqK_IXqXWs!V#fpJdn<+}E# z7|MCvTD)w+#Td(m6yNPOtbDKJ(QE!hy9>N%rB&$cpQC|?xzzW1Ulun^a7~?~TkAaU zQvWWoXY+MK5^TDcIHUv!B&^iTN!$>zHwJ8(4WzHu2y>w7J_RsP)MYa)87c>($Lt6UwTni)vX2TvVb9(@7n z?~D^sJ$7I#fY54+mODRP`9jjzWJQC-bTHttIZw(m!_RLAd6d>V9qG9J^dy<#+#q`R z%f#58G6E+5^po znRB6#S8pbRbI-nNlFZE?iFaFPCzS7f4pw5};o(^?&a+dk1k9_+C}Kj~5vz7oM*?)m z4ZHBDw2V*=cn(bf2E-0-VLO?o4Fbd;>3g(D9)5l&=io2_e8s+SrU<*7k9At(Ge(4E{c!7*)l!fhjH z)MMhTb_t7Cem@XsuUJ^%T;4M9IQS-^Zriys9!Qujr?V+n#%CaZv7tcf+*hF8_iE4r z2-t)re*oj#n!~`MZ||uEVb>kKf5@a&_pp2`g!|BKO`4|Ni@1mVu{dJuJ(Q=a-}mj_ z=X~MLy8IL})Tneu-OdEfI^g%d@f*@0=dhu3)R}s@W&;FS-(WGSXa_wuC(0J{v;>Y3 zo2ndfn28tWZ$8N?4Tg3fzOl6vaF}7vggV^AHZE1lR8oH>$4-3D!8m;PBx&&^p*O3G z7hT}g0-onHzL5Pf_8i3KB~9UgbQb(`my+q5uP;qg-lKpHlTz;claTEzMRst;p3T_e zBXvlA3e!8AI;5si4W^j^p?gd<*(+vvVHm_+TTG%1EVjQ{k{`uZ0FW(|?K|K*;S=-q zLTWk`Xuc`GTm!PS4PGsOOL}NsJ@I9GM*Nr0*9lx9k@olb|m)Gl!C z??rO55FUc`yrD%+t@lbMjU*C<@>SgWhK@;wW%RPk7`U%tv`EZ-mZ~>yiF6QMr`0#R z;W)B9+iER2RCy>z1Hx_DfkO`m-M?jTZVaU*#Jsk^TpVBsiFto|=*s`o-djdR z*|q({iXZ}l0mubNC=EkM3P>m=458%EAl(hp0sIbQK{>xJ`5XF2uYDdnWDzmVj~ z{+f?Z$K>IS-OUR9USwnG>)r3&{+=u;bto-Ez*66vCL7Nh{O*Px_7GsvE7pyHWl-v%A<$hs-6nezC)dp zMFcn)m#m4|bY7i7oZhqGJ|*{FMDh}-;&!|>ghTQ9St=lMScNRX`uF75#+qWtWGXg0_nXJ0Ej-`-(m zHy>Kl${-+LIj6@Poz4d}>tapJRtr{E*oaYL?cB2+(F#Q|&sY9bBGV1>iFJl0?Y<4h zQHNVq4|i9Gi`PuwqobjXkoEVg7m&vi+p=1DAVNN;+RFO5<` z>gaf=&eZvOw%>>Hac=3a@5sZA>lUYREZ#&Lzfo#*&B1=Q+S7{GF75KXq-(~>(=&U7*{`p0AM1I&Jb#AcBF zT_eE%#iY&!Ux#yE`u3b|=4((ms%BRnX~MgeJ@_TqY0Sp|^Zn0Lj<`1V)KZ6vIR%>9 z7s<^a!DE!U!b5?!@jQn!FVBt#60QsJkDQB$8#pzBc=wH6TV!}9^ykHc1MlWN{`MT@ zq&Ur>#&;~9ZY*G#_K?hF=-$3WjaDK{-d#A`!yboJdx6ZCJu5wCcoMoxiq&tW1GAqN zL@aacku+u+YR5c>+z>dlo-P`r+mAd@te7$+=+Fxmgg;aU%oOfjszpm_v9xGa)+s?R zT>4f|)>^EZXiwAOA-S-?3w8eFK z7c^p`bLZ=XVQg-;0b`u2%+&PyNLpb1ioGzit}7^^HvuopdC22HDOCa_4f6xT8xg4liI;#kLao6#MnP~?4 zS!!0E!URGlEw7=L$&Q&|@ zlurzxd!lSV>sTDgYS8_o(=PJBb#$Qe{Zl>4R1f5aNeln+SN;YvfE>F!1*nMq+jX+WMYdy0RFd{IVX#&sZe;54k_mB<%;PeBI63tuN z22^%vjYA;0BL`DrqD^rH4w_p3B1s&6(ahOtMcWxO57pJx#gKb;;7A3_ay^K%diPJY z=@J@g9U%5Qc9kxeJ<+FzwXtVDS1$Yd^zlbUWi?ua0d4LBl$6Z4;;N8E7A_5Nr$BW` zvLIsK@D>Eopo{sUpC^^D?)lkmLll*r%(+5-g08#fdRC@gPE8j z>5qzWwrA9+5)Yh)Fe~{{bx>V{LFJso6m<*0lLU6X z5s+efyC7A$OjvqdB>Y$+M-OVT9D9U;fvjR5JFV>(b19Yo6Ds;9=3`Ef##<4C)fB(VnlRNw?$YtAFNp6<)hZ zU(68zU=y8IsE*up4gNaU`MfajCLN~8)J$S&MZ<(k#{Jgf! z6!2)N+Vq%uLj3?Nfc<*g(r=G?Q~0AAkUlp{e!{$t>%QufzB(rEICdVt0_?zU!V};=R3-8LJTG%IDXZ^;P8a^F1Wb{z@G-p5)lBfFf#xyvb8G5{Q12s7XT?I z0FdIj2a|g7D0)Z#^Zfc>%a^ z1!7?Jq#)w+Yuex6X}JpgZt@Cvdwg#MH7)1Q2k^IE8U#CYO8!iyK_0GeWOS66kc>!8 z<@^HQn;gqjkjNbTm=r+}+4{C|ZUuGa2>tivZ)Ol)9D+p_Tqjd0d!VRCob)J>+>9Zd zy$3}s;9_qM-K$*#*z?)hdC8vT+un#}y@l}Kw<%-mVhv_MgdTkp@3zW|~oUFq&_MF~@zY>cD$MOOk*A7QwFOqQG8fYZvx z(Pt~?Zs(`^mE45%hmbZH{Hhy)hHkpR|B=e4_#l9zAmykG2l(kWP(erJbU;4Mf&$%& zHH?>SVf~?8|?v`J}bi=!;`8|1LVz>f^m z>EE~j(z(hW@XgP6Bv1jjCoCstwZ*3D$x9QHXy6S!o|gMa1$+B^>&|ama2Y-4;{0!! z+85|wWs>YpsO?Y~v0d$*rbY3oD&NT~nM`)xnMdYnvay>qcw?})=ZvR*0YE`4J2m^% z-nWEI(x0f21-euxS!-bX;M$$M<6h6up^PHGw0K{3&37anN)j| zd;35)oWw}#19EQtw9o2a9R$p z>n5_)OoaoPnc&W0b?z3;Z)Ev`zd_#H`=8XtkE`(z+#9^FF{Y)M&~us`3kD96cXwjG z1LU^O?(+)7o_H?8A$wqdZLHD`@jOKwSz)8MQzs2j$aht*kKw}GI_!CHlc#&fZEbB+ zC4$KvXOV4@+0vW4W{1y#Fn#>^8$c9@YY^B>pTab?HBg3@D9dpU&;|;AM<2{o+A>_4 zsI69|X8Oy3z%q{CDX1f!pViGw8vx0Nkp>qH5iR?hG7DX?A53g;*VLc@IF1vG1;2e; z@powu{x6bf7w}g2bh7W>v2C+5I779x1UT9iJ8Bit2oCjR~{j=FtzIe;hTzm-4n~dK@=GChUFF+?Jb09`1)4{B` zE9__iKIw5H183D<=N3!AE^m1)#UWD>kz)@41u@(fFX-mqlW}kt0_XOBI?vo|@a4gL zt3g4e*#Kqc^AtbBsWtOrLHW#gq&yRkZsl=qb&lPFW_L7>@sTj7_He~+Z`*d_FH7l9 zf5r;XyavBb@E>*+kPh3j4Jewq6+}eR7+N57ur&Z~MD>PAob!DRg{5!0dMAW%h$dri z97ff+j-)>o&@~Dd6#}&qV+M;6^pr#pYLKgbkJV|7O#aO=0#_pmY%YD_e(8u0qS9`m zZMna}Mcj;4&q7Ax-qNw8uE}U#ZVABAn?L2W6MxZ}%A#2{lwP&up^$#g0`0{AUh>(8 z#v&GkED)`lp}wNjkCc;ftgsUGa+!ovGyMlP-ZV-{e{8=n@Sqr2wlN_SYub$?aCVvC z4%9nxfe~(Q^Py)K>SBdSB`=~id_dN$*Tft^s@O)0Qv0NRW7#}voQu?fhsg+mMEK#7 zfmGTB4iob|uF~dx0NG5O zvUo5i{ZsT^V=z9+P#|^jDV=+f`pN+5uzM6l)jZ)gkHBq6CtJgFFqJ5Je_$Y|Re!!O zmw`mIGnzx<4h!rrZW^s>#}(6rM=Ek}m7`kTHZC@P4~YNsz6rr#5vwZW zsYcsDg>6Zg9z!(N?}+;PDgrvq2X;?G8hD*z^lev#S@L+nd(RKa}CekqghwmY}V=xgY(yoP=wVz1x>=wJz!`*YAhANj@3YtevQTtuWrBO-1OpXGmCT8SEl z>Wl=lktnFj^h7fxLed=qZr2nZL6OP)S=Re;U}4iVx`jcn@0poxFC6NFSVa>tR^@x|H8C`lW4?&ziW@4?Z^da+|>QW#fkXxa}a{D)N zzKlLl5AL{CT&NC%ty(-|Ijs&dLvnH$)sy8;u^wL;!C;%#61!R4=KP+lm$N>a(=0}= zKoO5L_LuMzESdqmaCgVMUKS9v8=uN)Ofs+7U+(d-|1AIbF^)H4&prR4(C_bG`t;&( zRDa-~|GdioM`us`$A$+7iH~-Je#kucE18p&)$491bqr`Lsvj#d6z98CnPq0@9{u_wFmuA?abuu0S%d5~fG@}*}IgLJ=qVf5ZJ0RSFW1s+_` zyF-`4n$1<|qxp8R{+))EB?TZ@FaQR=eWpzbB5wI--=1LO;J82dMb|s*p$;`Ff9iRJjv{wX&iSMRVe~FY~HA9C5&imi)>an=$zX z4&#F|*mhd9F(*k%Vc^FX!89>1%-KiAukx7;%XD1$as(goKh}lUR#;DFs)Zh7K`7j40OFp4PzkWth-10_z zBl2bbDK|jvE!?gwGwbDv7vi|4faqIFDj7tnc!^estzY)~aHqu>{=xMY3L$0BPCkj2~bC3-`twD-bkby-i2)EMlc2C92tN(RBP>Cc%8ug|ys0tB!e=y~-^nV&byKRf4*NxI>ra!Q6t zpbFKrT%GmC#;!HUFQ(jwv4d8xr2MPuKZ)|wyI!N~OLR>)ESB6p`roq-*iozue@SE< z69aK|jB1Nc?|2`pe(}VLU@u?mFzoj0{H(hJs5V=P{9E(lY2?!q5ih{0f4KGS2+neH z_C)pcEa8KRg4hKxp#L8D?sHTHo3qnmVB^pEhG`|8?_QmA377{_)A#3<-wql*t;SdR zDA}v;JRRD9#x$ zayxA&JtV#WS>2i~Z7Dacu|*4LMig1Yk{Cis3e%5h?B9=#Fn z%Dpri8=FM1Yrz3JtzgQDZykyGPv(R20SIhw&+yt31%P;%0M#9-)A~rn8*%6vS$X9r z>)Z(ZJ6|V|S1kkyZUP*+Btr{I7`q2Ll*{$~Ly~{Aq1OAf8{5@`p7qHj@7Kr{XC za{n*)jxtj$5Pq&mvzWj*MyyzFnqBH-I2rB6^t_CI@xwf``qRL9W*Q+Op*H+yxc@!@ z%I6p$Cb_5g^)6kl>%m0@L{dts$b7U+liPBPGSQtIdWTgjE~A`$&mCa-Dv?zVW(ugx z^t2WLL{AYc6J)#%>Gx+Jd_!F@cyu!FG-(NZQ)H_8LC({Dk~PPRi?J&y6O(rJ3*(lj zLVxX*D^sVT@$qY?{)O)ez@Rau!LXSh!s+#r=&6)c7#KA#0b2Bxr*d=D%VpD~oky@@ zxRqh7p-vOd3uIw%xS{3N{^&+XXDm;1-`ZETf)YEU(3-tt#v{iGWz|yKast9gsctRi zRF#c8?8g1KT?_3r8amhd4!l9<4YfnVE`P#3K z@iO`*C*P0eT-yJzl8LW0W0rKgLEiq&h@C+jzEI1R12^@l%R;=R)u&tCKB?~h@32?C zjC84T@JQL%M5iKX+mon92Gw_DiFe>Rs#!$yZj3M~~OYuV3_hqvd=n3(cc`xYlsDy5yb{xa#g&y{st_-yHok9MeltCX~Y zAnMp&5-OJ&Whe#+&-DB#24u-k2XBRG$yxN8)g7+NSI)pIk$iMA>#i?T?{ZR0@bC<6 zw|PdjGxKyl7(|^RuFNJwF}Y#tyN&2j+%|0{B0x9&7Zx0H{p}BnCQL=R_$|pt!>+S` zVw{M8pyhKw`NLjnf|sLXjiD0c4C#sI3QkJ2fS+R04Zn`(?Y_6^Xjv|&)r3Zw_x!Y`bOld01TBEE!R|FYFpTA(l@Zu&Y~sz{Zi9YyQGNYnM*fKNAeu zUhLwn57w}oxoK4^h%M%e2#X7wJ#~%Opoq%eBteG~ZYx%CaB<0C2VxtHk8s`Zs*l;) zvNA%HE2V&Qx~tqdDvNl9T>)$;3(W86+G4lhYJr2=tQ2mJ^J zJd&KS3*rWYukVQK)~bM6e=0Q1*^m%A6RhM&+r0h^%i3w%uP-!ttId90oudCF8h|f*-z-lC7W7or!acbX{2uES4 zF83L?6{9t6f^1|Q_fpsFUXthgfhjB3_WiabOqso|&84VxNtc*jz1HY#NIx+NktKtJ zi;acj2%nHaEk_4_VBzt(~C9hH?BhC^|9J~>iWT!ZZ0g{uQpOy;i; z4pQ-s((WdeMq8fsOLU$UkZ*dK$z{G~Ru&d1&GHtK++)ty;1E}D8XTYdKm7J@Pcc?Q z^pAImX%92sB!gCJLs;Cva2c~og2%Ct*4|7o#mw3c_fC8I2C~56fh@_>$Zvkk6S9w*@WyPQWpAiVl$U%z_+Wh+#t{hY>(V{ z-lWYjm*ig(idB9CKlfyAA-1CohjpFRv*PrU!hq0(yIJW{=FZFw{u&FCS8?`IPL;cI zm>&vSMs*1tSLwr=&nus59c{2%8ON><=yjhuTlKIdD>>>EIgVQ%C?XwPd+xdC*V!f4 zw!W4OJ~Im?zHhj(*q`pJ;nDA98^J*&uLL*tror{bBh?^xbAPy_$ibPLm4-9F(3XON zQIlL6Y5(YBJ6j&)Sy49WG{~bRS7IIRWX6^*(4XLJTF65bo}fM%seSI~d31!~-gs3^ zO~R+r8t&s?7HVU(8__Gfk<{O@jl^l!M|NsgX5Xtnc=WR3uG5nDn5v_1eB*>r9V`h2-0Vrf1))JSsUdFs0k(0A62loU7II_aK@IlUa z)KVK0YV~>|_U`STfG=RMJil|xH=oS&8ibO%ZB>>EXC+^=o|>;#7nw`y6wR7hk=!>*9Hevm;;znh z&1I_+VJPF8ces$L{w#=iOGsfrOO6I%@WNl*v0yi=m&suIy_d87e*C~e%DtWx zIf^wmX6Dgy_akJyZG$SsF&d3FhLKpXvwa)=29uc*7M!!?sK1iJmAqkLU{AqwM1*$Y z)*1RB7@+N?B3W_ycK0V)uFv{Dt^wv%l7%fLl{y^ibwOr zz}L=dZ*5RM;jr7d)pQ+|rO635iXThT;3(iXeK-bfPj)Vk1Xjtir$YEoWtwsTDM?I7ORjYj?x1Va z_I!6DtK6fl)M1AKRim~ke+tVsz8cwj+j7?f%L6uIF4Ks2q)suagZCUj7w3D98alS; z#p7Bo5NG|gk0Kxa$To}0w*rjB+e3WLn(o)eM-r^w{G6LrtA;0(>{DWvcuyqmqiDSw zx82Cq%3Y`4aYoxyNzFO71ttr=oV7I`6=&Uut9QCFYT8`XJuB`?$XC-K?Rv zM6|Z>P_u!(ai0G2?tpohBW@{1sd_Fhv2J6$9xt8W#GI$qctBLp%_`Sej@HS!18WtJ zd|*H`@~t<*^U-1aqvc(^Ua_XS@OV}B_tsIuy?Is~LTb1{h@$H2@-WzN<9qTcnDXk{-sIX6j|>O^v6ZyQ}CO zv0WT5$`6+m^xv&-=NVvf0ia$|^k~cI62Yq8Ud^DUQ|)kWQZH!3n%N5j8lc($Fy!nf zApwMx7j?SRS++J>-bxjGIvP>xqy%~qrH{@}C_+HhuF>{#DLV zy|3nO)JL!TN{}!b=ikv(hD;jxNttY>Ots=8)VwC%MG;&_A?S2`H@Vh!|36BFMmIw9%)B1nS#`CCm}bK)BG6U z?D`y!EZdy1bm_DKQD?|fVh&I9BHL#Pkd5O}3G>(kvpdoPN0y%PI|UGc*5dEGuZ~qe zVn$4C%q|3n3c9OT`L||8R>zae&*=^X=996KTwP8U__$kBwOH8A-!0X|;#5c%IH>EQ zp!M+U_}q1y*=%caaW3p#7`7M{tO!iZ{8a}pj+ADf9(Aj{bjrgwS{dv!tup@JTc{_o zG*TM4gD7>R9a|bL59ZO3slS~r5Ht1#&y@2J?EJ>K=6tzK?A^*KKT_#oyiZjQE3_&a zTXeyoQ}@B zkr;LyE~nSosoa5Ro~5g9pYxk_Jjkzg4YOa-5=`wC2$j`X@6sk%KOb}1&nJT{=`R3| zRi0`GEyS0}jgaVGo)$Yf)FRn-HqJp*d){6Bfs_Z#cC@rYrZ8t%I=<)Vy`Tho)_hS} zp(C>4ihGlB2W!Ee_sRIUIp&@My07OXPnVK+42E~^MZfQ&aC~LIlPaP=*6k9bsiMi< zzQjOSaGmE=*0oJ0hE2tu-AeQ8q~jZ`k0sKe&eN|A5)W(tNzJlzaKyh_P~PYQVzE(V zZ}O4IySxw^12;=nV2@x4(0mOB(vM9M0)i*+n0N24SDx()-!#C4j$Dy)YfF*}gt(dXrV*P~{4C+^mMyJ=|mv$|%y$M<~|QLYBQV{YT- zcHcIeMp}s%&|Rn^6G1B+V#ymfmuJe~@S)AdET?_R_Yz=n72embI zmo=uP)AB^F_(W0MvEackSaFQ!Jd^X}{iayRyock~a8GB`c@<0mR!><5;O%D|-ZbrC zfLr6of0Lka%6pxxpJWrEftECN(EZ?*#2EU}9uENuf*&`EIi9H zKbj6?o%JQU24}Pznc4lT=hGKWEn7dGJx9M6N=AhuH`gAd2pD-sjnZ{RqSj*%`Cn?M z?o|eM*-!L-nh>ZCoWn?`>kRB>*>af_<;!DiK&HJvvTe-R6qvdnuU+q#uKgw3Jb)X9 zlx(o7nbWb7We~99Oyl$KD^>BZj7ic~s~%oD!?!H-PduAHIGaN<;j#7K$AI>fjn)oi z^u&X7W>5s~%Fb+Rj~6T7@*~)W8~Z@+?S9qQ;Cb$U?R9Mn2V zT+|<4e?0^sJz?6YW0m=e5o~ygQ6C~o>qVDpWRmsq93L5WdOZmvKn>x3O4eK~R4j}b z4`1l2C#R)5O*QkyBzP!NQIa0+C&1SnBHNM!<-FJOnRLD-o0avTD_>-QQQdwbeKvx6 z7{oX%=bfCBqJ1to2`N_f%Ai9})+*jzo2PdTcuoU36MA)RY0XQwWvV?qmxL?7t0;l0 z&-V6NTv-(~y{l8Y+Lhmq2=VaXuNqOk<9U>_i$INsqcSVLEJmWlp!Q3{fHCKlN5$>r zmP8D&B3H7d$C1%@m!&_Q5BiILn9$P;#&N@9m+$84eRItdOh9`TU<+DN=>Zju0pM5B zeJ1*YT8kv}(>?#YkcD`s1gC?G<_PJ8(};3QqN3trV3qQm&KqN1aMy#TlWowj8&f1; z6zb7$ad!OabNxCX(|B)JSK=6ilpjL2jeGqGAZAd29`g=@vcIc74;=)9e^_LQcN4cN5#`wLpGXOA230 z6G{-N7)XoWlLT`S(A;Huam-a{9F^HMJ666P8>cQ3l$}Qbp$cB5v=}w`pkORfmUM<% zi3c|{jNEnhUj7HkFMDIXhWxt9w#MIP;%l%msu$!+cGxS^gTLBG@A#G_zQ;Xv6&O0& zo(S&_a=dYHHiG|hbcb9F8=hA=ZRfnP)<1u@TZWA40sDs zxzmhbFaP>;FAHCh711|=zN=Z#{S{8e@A#7O7=w4s24IH_%S_}FW33V>fos6NLb6%m z)vFgQzyiXD%^-{6B1Cj=i$GbKH%;v)khY2I&cO6jGug-hq$kI;l=ZV=LT~VTdkuP$ z#kMy*g-qLsG_32claU;*R_r^*a4tD&ze?TV8@Fv2O~;hM--)c2pm3K4X+QHI8W{Wa zTc{6bUuciUQSQrY^({*QJ10=gmn)8seS#ACwbAV8yz180r?&AI@OP_3@x39Zma%b8 z;yQZorV13> zJJ0xpBkZE26@myL!G@$*o73mp{_R&p_Q&*APIv?aR1Kv^Y0D={QtMbXb60={DFTE|ziE(L zI3*^%U(tn*xp-WMi;aSful0efXlq+rkyC2~g8~3*<=0wxp3WeU*(%>z-|`Vy9`7y{ zIj*TKv|Eqs&$issqC{Z!85Uf0TpB$bLm0wh6V&qsJkOoxNdT3fO`X)BGEeMWBI-1X z2(J|2Jo4(#`SLZ_Z9sex3HU|Qo%-qV8JE1AosVpLWq6#M=B~lf5(v*s{2A5cP{~3d z2}Or4y@%J!+H&EyCu=+Qin;FBoNd8OCXzE%gK1&NS2N#y(qfK}n^Rr!BE#jD=5x)a z`lI0OpGg-!SO7N?7az?ld0!c+1+CJs+4I^C)IQ)aI1_0i6cDGwbgB?nZoG8qKD(so zW5uZNI!m8ZCO6Rvjnc{K&M@_>l{z={P-@hkp5OTu2Hb;XiRW-aI7N9^`VK^!h~q`1 z{N2~eJ?Cm)F7v^VSG7-9Otz1VNM%M#iH1dj?=G!4?3dSfMbS~LhT~;3Lk;ofwue1%^v4ud*{E>&(eP9B#HGx7D5@1OS|xP52@CPVIt z%o5dKyYAGxXWiZro!AOxjXY@l#z(@Z2~w0=a@p3+OJ}Axa(r=!T&l6)kKVrVWsb#} zUA5V8))up4!sDZt0Ce_KZtfOQZURn$)x)QP=ZQV+yCK{YWgxSWdpgob$Ub#EJYh3} zZ@5@c7S>;r*%4FsIKgQi%{Ho@S6i#sIl$f-70+e6mx!kO+K-U0x#!cBqWFX2XA^D~ z2)E-cz5})$(z}qQ!Nsxfl0He{vP+g|_j#@lR~A3@aBZN|vQE=Z<=>(k*GHY_>i4F( zIgeo_jFAf+@0BvJ-o@{?t~|a5FDV~j?LKO`KGz#NSTKJWULEskA?0AuB`JKpSjIs> zzCclV{PJN_jPZatrbM#zSokl08G?yd$>a*EX+Lc}~~ zxWA+U9Vxc>emU2m!Kre4H{5IDb=8iV(bL)CfsmH(tb_^ddHz_4F2Q`Kr*aUxZN76K zoy;Jwm8o4|*V%sw(}ab01FiJFzQbD5P37dPEXBicJwGCH6PY#Vj+a(%qH$`8t(FTu z+3hva+AMM2G31b}sGh_#wXEIaZtd)JaEjIzNF3-98?~8>REaJ+Yc9}jn(b4N!&*{B z)aFfioLKbeFpMQ@zX7zLcC`V`<9sCa06r;84hS83B-_>yMf)QTq{(i}OKb5Vsj(3R zQCy$rYR&Srqv)cvA2s19*N{EN!2QcIfm8Zx+|ZYDx)Cr`A?9@G#`gEx$>X3KT0NhP zrpcOWI!R7Xr*ne!=iYv@mbGfG^Y-xSAWKe<_4Wa3p1TE6AG^*EIb3mwjlZm9{a*cxZl_B=}5}pbX-{=M+FuOg&j?rJE(MS#2@hDxAW_& zy0fA~_n5U#1}{RbUlQ_{&;-3YI-~)~YWz;-wxVjW;rm{@du&l}^W|R?l5r1$=9qM% zCxtm`rBe2IDaUFcqYf-tN6k~0wdCaF43_a6RgMLZ(ZKWN!7Xl!5yh#&tzks$$SF&e?w3A;q58m>#k0mX z-xU?xX*}$3mVifhVY@HX6ctSa^PWR1@k|63P zuT%ZLAo8BgI`#K;M~mRA&rt`l9upytoD$EM3!3<8yTUHIgk@juxgob>u@WruKHm9MNq#uFTG1tZS3)w%hSZ zJdy-q%-q;?*SLl3e*7;^@-1bW-5% z8cJL?)Ndmv8GxtXz5ZgMJ=|G-^%0MNtiOPGv2k$bp4q|Em>t>0;vzb`;Q7Om43Ppw z(zm#-cp$7v{3WabU?A^npG^xQC~L;VY0w;lvw#X>^1*v+`9_;2UFO3$I&=#~4}c#= zPk(VnZwgaBz9>)6KK?pvu{b!m%j9~z$K!N#y3#ANLFp8)ZR7Hdrv07C=&K0MtxWg)?p`Vr zd;WKT9aotPI|V2lkKmUYKrRvhXW&m27=WBY2f#3?5KLmD@+rXe%y0->STW~g;D-X- zpnQg8jRl}?NC4j8fA^t68?&Hoy^w^^`-yG^ zO6wH{CK_YUOig15?hv+Bm70l$b)de8Rj(9*?j<oCF;!l*eo#Dd7S zd{^Ixfrq zzyV9>Z=!&|$U~_>9&h_`bwcU>7qQn+to@gj@egl*yJsz<5H2H!aGD&uE5S^3f!fgk zoBrnt1P@K^&7$qCgobBcLw!5SBVNgUP=D)ic`Y+y8XYPpRHzIJL7F){JgLBV-lGOF zF6bWlP31oGy60aKvQ@qpskp#eaqRR8d3%S)3%yp|631)kCgAVx=eciXxOycg*A^K%ctPUop@yAf zEJw}=2hSe9Iy4ZPvi*k(@LvIcB0wz$H|6}1R{5`Aqu<=TXlHuZf&ITr{O?};fXZB4 zj{i^Y#ZZI1e3+F=iYAbBmtEI*dj@`fb+vL!Dh!OH$F8csaf1WX`;`%(&yHuY;NGAz z;4KXM<1a1)95li4{hJUBAn+Jo1%E=B#ev!16$8qN9egR8?r%-m;MLv%GrkxImeB{8 z2J}Y8A7y(0gZ>v>S6JU77uqFs=;Mn|+`N|k0~7P(>nL@A5A;ME-5Ws(+Vm)ID*r(L z`~Zare*!RO-@0pH36R-%OquiV$oI!muYkvb?S2bv+5Z*W_8A?@T#Rs#C1s#*xiQlI z=MHl!d-auYGSEXp_ErX@Ll61;>D2R3Xk`zBgL^gCX-Nb z19q)^u0p3zd$Lt1K-WOz^z`&cl0SD>SPvgq3wTG){PtP$hGGS*t?61c_YW8LTfLfI!v}#Yn1 z6&3$d4E*z=8AH$jpJ?bi!|0;j<_$zesv4z|NZ{IJrjWK+SX_8DYOR zqPZQ%`Wdt?Mye$L-e-CV4U0KsdRI|O&Wg6OOXYi+`S9$Rna=gQmGVb=bTG#9&B!s3 zczVFW0p)X8uCij^xDVRe_xcTfZCC!=a7s|NE`>$Jz-diPmWn*aNz&7iW$ru@R*3KE z(gg&NBCGNB(phDb(X!f-E|VE_s6p2l6hUi@jsDCM*W(Ytpk%>_vwX_8%FN5~1uIg% zv!J|_l!wobu~K2?n>xdo9blG9pEhT@0Wa}Z-7)3vZVR(FLgtn9aV{XBTV)Dwls|0{ zuRZS*`L{LvTfEXTm=5&pQ3{(_bYhg#}EZ`=re-c~fI$=ribEDyBE$BR2wN7h_j z760`k))*w3Rktg2>(CeKE}d(GW*~`{m{ygVkS|QH`}BUBwsPU9#eAwG=sYs9cUFrC z4%1=4re~GiPM3auSCa4#mGwr>YnwCR8N)Wd^pFk%6_uvnb@HN(u3F=koR!xa+Fc12 zb?bMcY3=2V^Jayt7H|EGA^z7>dL7;>xSzVM!Qc@yd5KwONGDT9Ht0Gr`w&$>TdS5~ z$Eh?nHukE_^T^ubmly{HA-L;!|KY&WFiyR~xcf(L_cB{80?fM74AyJWr}s!#!<8#~ z^PUp_xVC>E#KnKh(jUDu=#5prnZ}pW-;$LsP{ffdY+R(D?s~&-nj{v7_S+}CzCv!& zl3*9N5@zW{sryb|Ljw~;kSFE-O-fGm8tBa-osnO~BbBf5B1)6QG1V86{#~5=FTA`k z1iO!NIdk@#lwrE8>KEqDl-Sq?!HUVy@4Ze`~+ytcKqF3vp)0|* zG&#YPOp%D~L2pP^1#eftzirHgar^v1`1%*tesd|V8-axjAw!*+Y%nP~Xw>dId(cZA za(e2`7xgrZdcnmc3?4)Kh33nAjDdkce-$VY+$Cn$w;s|f9h8S0z_3S+&GbsAqfN>5 zHA}kQJ{T?FtJahKg*)R~U!CxE3ATQ7HLe@k?rL4Iq*p``E=kEyty&k!W?3>CE-t08 z@Fx^WSJ}bfh$4?O7uC8Kz63;3iZ8d@91RT&Bo6@hASmcdLZLY7n)#~o^7qxt=Rs$s znf~a$h3*Q5mGrC*!=cvN9!WDNm!Q`;N!#yd!gP~_RB=h!?B&bIJh8bd{HJYgriBNe ze6C75W-Esg5YSfc+!CvDv$V|Xh&?Ech=7Y{-F9>>erL%3a`SOmWF)bprx+;?Huh|+ zRedBV?kFqDfbz%grzH-apG6`Pt!c|BIgJ&>(* zi8VaDyu9Y^jDR?ck}PX~t$fE|CQU}S`&Lb%Q8ziVTrTl@r;?U7pn8TJpZmXQ=Gxbh z)CG-}S&`wQZqlp&mW6-m_BWVbYEnL?OPpJj1I8mCI2~7quv2`D8)^Du_?;5WCyEeH zD#!(@p!H|_91h6>R$_D-W#*L-)hbSNLT^L?XIEQbLElqf#x#uF@U9z7YVrJJBel(tHxBcJ0qFZ%a5~C(-G|%&n1q_ zmfn&Fw(JdG|H#%AC>NH%htz${! z>Q4$`h7~*;$Wu4k*lv>yqn03ZNX2JCxQu$^>@2W`?2!(faD&dyhs*lD1(~uiUWQ+M z({Ge$ub<*Jk{=N5VL-tcmF=zOMA7S!W7Pu7EmYK0R85+DXUlA52SSJ6$}JW{8US(r zA)6_HL~nnIDt6!VQ30&(3{C#HI1{V6`PMGV%;#GYR+>0qj7X4+`aSb39#fWIO~0c0 ztDBi4_ILlH{*D8`!+flzoTo;pNMo-g66hI?exP;qvhaxQf~7Qs|C-6QMrQI8RJbtwDhZ<=$t?8sZ9Vxvn*%Avd$uw z8=0%F(%R7xktX|*Ad^R)6Bm$JhzIcfq7D8Q2H`bq5DD;1cHB5BQd`rKqGn)_Jm%H* zUl~CJf}VsE*$t0-UF8qjfOyg;W%&InKo^?3FBzy$cV5?^+4=c_>CChAwziHiksD-p zY_w>Bn?PjtAHFl^BKlCVTWAHd`c_hFJK1AeTSEQ)cjd9`U=B@)rvh+4JhJMzPS%l>o4=~OAFx!YZ}#jb$^UV4vRJ-jK##f#3gm?1@9Ys@-QC!5 z>&aCeI^LOgr=mg77=j|74?=UaOm}7JD;RFse!5W?STQ;NV7@}Hb9QpQ>P#I_B|7*t zfrei75cXdr?e9?VnFDxcq)56C^kO1`;w1Ww|kuI;ZCfo2LqUo&zM<{UaLgQpX?iy&kVdmbR@eA9M||% zD~ywNxXRckvA{62d+sN@p|i94#pAdpt5QrVxnUdisD@F_F|4Gbcs534SZpklU0uuy zhM;5Z<+Fn*7R~zy?`&6;0Ry*Q2`Cigk=Oru4Tbm68$oMw78pM@TudhiT0E(N0};bz z2KYQUw=`)0w0Q4^;NjD@eK@B4$Y_R9FnQgKw@S$Z5|FsXvo_92io3*=m`1K?ur}co zc&}jQ<3lh43;rZ>xYk!I{8@(~28xLZ17%MS=l!k>oiYE^#gfK8C}P@?HDyluO@|M26fW zE$q9sp9^>+-r5iSH00)o?DxGF&IQw!Do6GA<9G?nHs6F&fxK^VBj1#xX~FK==@Gm2 zr%PZsE0zk)a(?45Cg_eB`1q>}_P0N)s7Yx8nmt@y_m-9RsN$*Y$!X&=T!Ab{l23ld z^7SKsq*$b0npKjg-XMTl<}#ZF;)f5ZWIO#M$8ZVl0cA*Es>!leJZ2^ssMAF>#0Lco znM@YS&!2~ykCaFP1j>D}FJh4c`SawfZbe?(0e%r;=?(A$+}iJ9O0Z?KY=ABeF@tQz zU~ur)|L{9pI^lvo>wS$sW2>8Q%r02rJlr_R|FL*KelmXOg~Ghr7~gS!tlRh!_$MhQ LE1LI2$NT>Q2jK4% literal 0 HcmV?d00001 diff --git a/docs/mint.json b/docs/mint.json index 6628316f8..5c7012745 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -154,6 +154,13 @@ "documentation/platform/dynamic-secrets/aws-iam" ] }, + { + "group": "Key Management", + "pages": [ + "documentation/platform/kms/overview", + "documentation/platform/kms/aws-kms" + ] + }, "documentation/platform/secret-sharing" ] }, From 9aecfe77ad3311e3edc242f1c765a6a28db035e9 Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Mon, 22 Jul 2024 18:34:09 +0800 Subject: [PATCH 34/77] doc: added aws permission setup doc for kms --- docs/documentation/platform/kms/aws-kms.mdx | 61 +++++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/docs/documentation/platform/kms/aws-kms.mdx b/docs/documentation/platform/kms/aws-kms.mdx index 9a546b277..0bf33bb0d 100644 --- a/docs/documentation/platform/kms/aws-kms.mdx +++ b/docs/documentation/platform/kms/aws-kms.mdx @@ -5,6 +5,67 @@ description: "Learn how to manage encryption using AWS KMS" You can configure your projects to use AWS KMS keys for encryption, enhancing the security and management of your secrets. +## Prerequisites + +Depending on the AWS Authentication Method you intend to use, you will have to do either of the following: + + + + + + 1. Navigate to the [Create IAM Role](https://console.aws.amazon.com/iamv2/home#/roles/create?step=selectEntities) page in your AWS Console. + ![IAM Role Creation](../../images/integrations/aws/integration-aws-iam-assume-role.png) + + 2. Select **AWS Account** as the **Trusted Entity Type**. + 3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead. + 4. Optionally, enable **Require external ID** and enter your **project ID** to further enhance security. + + + Use the following custom policy to grant the minimum permissions required by Infisical to integrate with AWS KMS + + ```json + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "AllowKMSAccess", + "Effect": "Allow", + "Action": [ + "kms:Decrypt", + "kms:Encrypt", + "kms:DescribeKey" + ], + "Resource": "*" + } + ] + } + ``` + + + + + + Navigate to your IAM user and add a policy to grant the following permissions: + ```json + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "AllowKMSAccess", + "Effect": "Allow", + "Action": [ + "kms:Decrypt", + "kms:Encrypt", + "kms:DescribeKey" + ], + "Resource": "*" + } + ] + } + ``` + + + ## Setup AWS KMS in the Organization Settings Follow these steps to set up AWS KMS for your organization: From 70400ef369ed77da04e5841110ad18c3dd8e4f3d Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Mon, 22 Jul 2024 18:39:27 +0800 Subject: [PATCH 35/77] misc: made kms description optional --- frontend/src/hooks/api/kms/types.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/hooks/api/kms/types.ts b/frontend/src/hooks/api/kms/types.ts index e2cfabc42..5808a71fc 100644 --- a/frontend/src/hooks/api/kms/types.ts +++ b/frontend/src/hooks/api/kms/types.ts @@ -90,7 +90,7 @@ export const AddExternalKmsSchema = z.object({ .refine((v) => slugify(v) === v, { message: "Alias must be a valid slug" }), - description: z.string().trim().min(1).default(""), + description: z.string().trim().min(1).optional(), provider: ExternalKmsInputSchema }); From 761a0f121c32641035bf7c47bf901ad5ee1e7c7e Mon Sep 17 00:00:00 2001 From: = Date: Thu, 18 Jul 2024 00:09:21 +0530 Subject: [PATCH 36/77] feat: added new secret v2 data structures --- backend/src/@types/knex.d.ts | 38 +++++++++ .../db/migrations/20240716105646_secret-v2.ts | 81 +++++++++++++++++++ backend/src/db/schemas/index.ts | 5 ++ backend/src/db/schemas/models.ts | 5 ++ .../src/db/schemas/secret-references-v2.ts | 20 +++++ .../src/db/schemas/secret-v2-tag-junction.ts | 18 +++++ .../schemas/secret-version-v2-tag-junction.ts | 23 ++++++ backend/src/db/schemas/secret-versions-v2.ts | 33 ++++++++ backend/src/db/schemas/secrets-v2.ts | 31 +++++++ 9 files changed, 254 insertions(+) create mode 100644 backend/src/db/migrations/20240716105646_secret-v2.ts create mode 100644 backend/src/db/schemas/secret-references-v2.ts create mode 100644 backend/src/db/schemas/secret-v2-tag-junction.ts create mode 100644 backend/src/db/schemas/secret-version-v2-tag-junction.ts create mode 100644 backend/src/db/schemas/secret-versions-v2.ts create mode 100644 backend/src/db/schemas/secrets-v2.ts diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts index 8aa00ec79..be98cd212 100644 --- a/backend/src/@types/knex.d.ts +++ b/backend/src/@types/knex.d.ts @@ -227,6 +227,9 @@ import { TSecretReferences, TSecretReferencesInsert, TSecretReferencesUpdate, + TSecretReferencesV2, + TSecretReferencesV2Insert, + TSecretReferencesV2Update, TSecretRotationOutputs, TSecretRotationOutputsInsert, TSecretRotationOutputsUpdate, @@ -263,6 +266,9 @@ import { TSecretVersionTagJunction, TSecretVersionTagJunctionInsert, TSecretVersionTagJunctionUpdate, + TSecretVersionV2TagJunction, + TSecretVersionV2TagJunctionInsert, + TSecretVersionV2TagJunctionUpdate, TServiceTokens, TServiceTokensInsert, TServiceTokensUpdate, @@ -291,6 +297,17 @@ import { TWebhooksInsert, TWebhooksUpdate } from "@app/db/schemas"; +import { + TSecretV2TagJunction, + TSecretV2TagJunctionInsert, + TSecretV2TagJunctionUpdate +} from "@app/db/schemas/secret-v2-tag-junction"; +import { + TSecretVersionsV2, + TSecretVersionsV2Insert, + TSecretVersionsV2Update +} from "@app/db/schemas/secret-versions-v2"; +import { TSecretsV2, TSecretsV2Insert, TSecretsV2Update } from "@app/db/schemas/secrets-v2"; declare module "knex" { namespace Knex { @@ -645,7 +662,23 @@ declare module "knex/types/tables" { TSecretScanningGitRisksUpdate >; [TableName.TrustedIps]: KnexOriginal.CompositeTableType; + [TableName.SecretV2]: KnexOriginal.CompositeTableType; + [TableName.SecretVersionV2]: KnexOriginal.CompositeTableType< + TSecretVersionsV2, + TSecretVersionsV2Insert, + TSecretVersionsV2Update + >; + [TableName.SecretReferenceV2]: KnexOriginal.CompositeTableType< + TSecretReferencesV2, + TSecretReferencesV2Insert, + TSecretReferencesV2Update + >; // Junction tables + [TableName.SecretV2JnTag]: KnexOriginal.CompositeTableType< + TSecretV2TagJunction, + TSecretV2TagJunctionInsert, + TSecretV2TagJunctionUpdate + >; [TableName.JnSecretTag]: KnexOriginal.CompositeTableType< TSecretTagJunction, TSecretTagJunctionInsert, @@ -656,6 +689,11 @@ declare module "knex/types/tables" { TSecretVersionTagJunctionInsert, TSecretVersionTagJunctionUpdate >; + [TableName.SecretVersionV2Tag]: KnexOriginal.CompositeTableType< + TSecretVersionV2TagJunction, + TSecretVersionV2TagJunctionInsert, + TSecretVersionV2TagJunctionUpdate + >; // KMS service [TableName.KmsServerRootConfig]: KnexOriginal.CompositeTableType< TKmsRootConfig, diff --git a/backend/src/db/migrations/20240716105646_secret-v2.ts b/backend/src/db/migrations/20240716105646_secret-v2.ts new file mode 100644 index 000000000..630f4a61e --- /dev/null +++ b/backend/src/db/migrations/20240716105646_secret-v2.ts @@ -0,0 +1,81 @@ +import { Knex } from "knex"; + +import { SecretType, TableName } from "../schemas"; +import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils"; + +export async function up(knex: Knex): Promise { + const doesSecretV2TableExist = await knex.schema.hasTable(TableName.SecretV2); + if (!doesSecretV2TableExist) { + await knex.schema.createTable(TableName.SecretV2, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.integer("version").defaultTo(1).notNullable(); + t.string("type").notNullable().defaultTo(SecretType.Shared); + t.string("key", 500).notNullable(); + t.binary("encryptedValue"); + t.binary("encryptedComment"); + t.string("reminderNote"); + t.integer("reminderRepeatDays"); + t.boolean("skipMultilineEncoding").defaultTo(false); + t.jsonb("metadata"); + t.uuid("userId"); + t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE"); + t.uuid("folderId").notNullable(); + t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE"); + t.timestamps(true, true, true); + }); + } + await createOnUpdateTrigger(knex, TableName.SecretV2); + + // many to many relation between tags + await createJunctionTable(knex, TableName.SecretV2JnTag, TableName.SecretV2, TableName.SecretTag); + + const doesSecretV2VersionTableExist = await knex.schema.hasTable(TableName.SecretVersionV2); + if (!doesSecretV2VersionTableExist) { + await knex.schema.createTable(TableName.SecretVersionV2, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.integer("version").defaultTo(1).notNullable(); + t.string("type").notNullable().defaultTo(SecretType.Shared); + t.string("key", 500).notNullable(); + t.binary("encryptedValue"); + t.binary("encryptedComment"); + t.string("reminderNote"); + t.integer("reminderRepeatDays"); + t.boolean("skipMultilineEncoding").defaultTo(false); + t.jsonb("metadata"); + // to avoid orphan rows + t.uuid("envId"); + t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE"); + t.uuid("secretId").notNullable(); + t.uuid("folderId").notNullable(); + t.uuid("userId"); + t.foreign("userId").references("id").inTable(TableName.Users).onDelete("CASCADE"); + t.timestamps(true, true, true); + }); + } + await createOnUpdateTrigger(knex, TableName.SecretVersionV2); + + if (!(await knex.schema.hasTable(TableName.SecretReferenceV2))) { + await knex.schema.createTable(TableName.SecretReferenceV2, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.string("environment").notNullable(); + t.string("secretPath").notNullable(); + t.string("secretKey", 500).notNullable(); + t.uuid("secretId").notNullable(); + t.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("CASCADE"); + }); + } + + await createJunctionTable(knex, TableName.SecretVersionV2Tag, TableName.SecretVersionV2, TableName.SecretTag); +} + +export async function down(knex: Knex): Promise { + await knex.schema.dropTableIfExists(TableName.SecretV2JnTag); + await knex.schema.dropTableIfExists(TableName.SecretReferenceV2); + + await dropOnUpdateTrigger(knex, TableName.SecretV2); + await knex.schema.dropTableIfExists(TableName.SecretV2); + + await dropOnUpdateTrigger(knex, TableName.SecretVersionV2); + await knex.schema.dropTableIfExists(TableName.SecretVersionV2Tag); + await knex.schema.dropTableIfExists(TableName.SecretVersionV2); +} diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts index 06c735cee..f0d43b98f 100644 --- a/backend/src/db/schemas/index.ts +++ b/backend/src/db/schemas/index.ts @@ -74,6 +74,7 @@ export * from "./secret-folder-versions"; export * from "./secret-folders"; export * from "./secret-imports"; export * from "./secret-references"; +export * from "./secret-references-v2"; export * from "./secret-rotation-outputs"; export * from "./secret-rotations"; export * from "./secret-scanning-git-risks"; @@ -83,9 +84,13 @@ export * from "./secret-snapshot-secrets"; export * from "./secret-snapshots"; export * from "./secret-tag-junction"; export * from "./secret-tags"; +export * from "./secret-v2-tag-junction"; export * from "./secret-version-tag-junction"; +export * from "./secret-version-v2-tag-junction"; export * from "./secret-versions"; +export * from "./secret-versions-v2"; export * from "./secrets"; +export * from "./secrets-v2"; export * from "./service-tokens"; export * from "./super-admin"; export * from "./trusted-ips"; diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index 5747fb381..44d0cfd91 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -90,9 +90,14 @@ export enum TableName { TrustedIps = "trusted_ips", DynamicSecret = "dynamic_secrets", DynamicSecretLease = "dynamic_secret_leases", + SecretV2 = "secrets_v2", + SecretReferenceV2 = "secret_references_v2", + SecretVersionV2 = "secret_versions_v2", // junction tables with tags + SecretV2JnTag = "secret_v2_tag_junction", JnSecretTag = "secret_tag_junction", SecretVersionTag = "secret_version_tag_junction", + SecretVersionV2Tag = "secret_version_v2_tag_junction", // KMS Service KmsServerRootConfig = "kms_root_config", KmsKey = "kms_keys", diff --git a/backend/src/db/schemas/secret-references-v2.ts b/backend/src/db/schemas/secret-references-v2.ts new file mode 100644 index 000000000..ed339e65c --- /dev/null +++ b/backend/src/db/schemas/secret-references-v2.ts @@ -0,0 +1,20 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretReferencesV2Schema = z.object({ + id: z.string().uuid(), + environment: z.string(), + secretPath: z.string(), + secretKey: z.string(), + secretId: z.string().uuid() +}); + +export type TSecretReferencesV2 = z.infer; +export type TSecretReferencesV2Insert = Omit, TImmutableDBKeys>; +export type TSecretReferencesV2Update = Partial, TImmutableDBKeys>>; diff --git a/backend/src/db/schemas/secret-v2-tag-junction.ts b/backend/src/db/schemas/secret-v2-tag-junction.ts new file mode 100644 index 000000000..982e11f50 --- /dev/null +++ b/backend/src/db/schemas/secret-v2-tag-junction.ts @@ -0,0 +1,18 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretV2TagJunctionSchema = z.object({ + id: z.string().uuid(), + secrets_v2Id: z.string().uuid(), + secret_tagsId: z.string().uuid() +}); + +export type TSecretV2TagJunction = z.infer; +export type TSecretV2TagJunctionInsert = Omit, TImmutableDBKeys>; +export type TSecretV2TagJunctionUpdate = Partial, TImmutableDBKeys>>; diff --git a/backend/src/db/schemas/secret-version-v2-tag-junction.ts b/backend/src/db/schemas/secret-version-v2-tag-junction.ts new file mode 100644 index 000000000..4679116a0 --- /dev/null +++ b/backend/src/db/schemas/secret-version-v2-tag-junction.ts @@ -0,0 +1,23 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretVersionV2TagJunctionSchema = z.object({ + id: z.string().uuid(), + secret_versions_v2Id: z.string().uuid(), + secret_tagsId: z.string().uuid() +}); + +export type TSecretVersionV2TagJunction = z.infer; +export type TSecretVersionV2TagJunctionInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretVersionV2TagJunctionUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-versions-v2.ts b/backend/src/db/schemas/secret-versions-v2.ts new file mode 100644 index 000000000..160ed1c14 --- /dev/null +++ b/backend/src/db/schemas/secret-versions-v2.ts @@ -0,0 +1,33 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { zodBuffer } from "@app/lib/zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretVersionsV2Schema = z.object({ + id: z.string().uuid(), + version: z.number().default(1), + type: z.string().default("shared"), + key: z.string(), + encryptedValue: zodBuffer.nullable().optional(), + encryptedComment: zodBuffer.nullable().optional(), + reminderNote: z.string().nullable().optional(), + reminderRepeatDays: z.number().nullable().optional(), + skipMultilineEncoding: z.boolean().default(false).nullable().optional(), + metadata: z.unknown().nullable().optional(), + envId: z.string().uuid().nullable().optional(), + secretId: z.string().uuid(), + folderId: z.string().uuid(), + userId: z.string().uuid().nullable().optional(), + createdAt: z.date(), + updatedAt: z.date() +}); + +export type TSecretVersionsV2 = z.infer; +export type TSecretVersionsV2Insert = Omit, TImmutableDBKeys>; +export type TSecretVersionsV2Update = Partial, TImmutableDBKeys>>; diff --git a/backend/src/db/schemas/secrets-v2.ts b/backend/src/db/schemas/secrets-v2.ts new file mode 100644 index 000000000..18fa3b476 --- /dev/null +++ b/backend/src/db/schemas/secrets-v2.ts @@ -0,0 +1,31 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { zodBuffer } from "@app/lib/zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretsV2Schema = z.object({ + id: z.string().uuid(), + version: z.number().default(1), + type: z.string().default("shared"), + key: z.string(), + encryptedValue: zodBuffer.nullable().optional(), + encryptedComment: zodBuffer.nullable().optional(), + reminderNote: z.string().nullable().optional(), + reminderRepeatDays: z.number().nullable().optional(), + skipMultilineEncoding: z.boolean().default(false).nullable().optional(), + metadata: z.unknown().nullable().optional(), + userId: z.string().uuid().nullable().optional(), + folderId: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date() +}); + +export type TSecretsV2 = z.infer; +export type TSecretsV2Insert = Omit, TImmutableDBKeys>; +export type TSecretsV2Update = Partial, TImmutableDBKeys>>; From b563c4030baef8ae47295ca2062944610622e62c Mon Sep 17 00:00:00 2001 From: = Date: Thu, 18 Jul 2024 00:14:41 +0530 Subject: [PATCH 37/77] feat: created base for secret v2 bridge and plugged it to secret-router --- backend/src/server/routes/index.ts | 27 +- backend/src/server/routes/sanitizedSchemas.ts | 2 +- .../services/project-bot/project-bot-fns.ts | 7 +- .../secret-import/secret-import-fns.ts | 123 +- .../src/services/secret-tag/secret-tag-dal.ts | 3 + .../secret-v2-bridge/secret-v2-bridge-dal.ts | 393 +++++ .../secret-v2-bridge/secret-v2-bridge-fns.ts | 553 +++++++ .../secret-v2-bridge-service.ts | 1319 +++++++++++++++++ .../secret-v2-bridge-types.ts | 267 ++++ .../secret-v2-bridge/secret-version-dal.ts | 124 ++ .../secret-version-tag-dal.ts | 10 + backend/src/services/secret/secret-dal.ts | 2 - backend/src/services/secret/secret-fns.ts | 4 +- backend/src/services/secret/secret-service.ts | 194 ++- 14 files changed, 3001 insertions(+), 27 deletions(-) create mode 100644 backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts create mode 100644 backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts create mode 100644 backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts create mode 100644 backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts create mode 100644 backend/src/services/secret-v2-bridge/secret-version-dal.ts create mode 100644 backend/src/services/secret-v2-bridge/secret-version-tag-dal.ts diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index c0f3f76e2..625790da3 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -182,6 +182,10 @@ import { registerSecretScannerGhApp } from "../plugins/secret-scanner"; import { registerV1Routes } from "./v1"; import { registerV2Routes } from "./v2"; import { registerV3Routes } from "./v3"; +import { secretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { secretVersionV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; +import { secretVersionV2TagBridgeDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; +import { secretV2BridgeServiceFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-service"; export const registerRoutes = async ( server: FastifyZodProvider, @@ -229,6 +233,10 @@ export const registerRoutes = async ( const secretVersionTagDAL = secretVersionTagDALFactory(db); const secretBlindIndexDAL = secretBlindIndexDALFactory(db); + const secretV2BridgeDAL = secretV2BridgeDALFactory(db); + const secretVersionV2BridgeDAL = secretVersionV2BridgeDALFactory(db); + const secretVersionV2TagBridgeDAL = secretVersionV2TagBridgeDALFactory(db); + const integrationDAL = integrationDALFactory(db); const integrationAuthDAL = integrationAuthDALFactory(db); const webhookDAL = webhookDALFactory(db); @@ -719,6 +727,22 @@ export const registerRoutes = async ( secretDAL, secretBlindIndexDAL }); + + const secretV2BridgeService = secretV2BridgeServiceFactory({ + folderDAL, + secretVersionDAL: secretVersionV2BridgeDAL, + secretQueueService, + secretDAL: secretV2BridgeDAL, + permissionService, + secretVersionTagDAL: secretVersionV2TagBridgeDAL, + secretTagDAL, + projectEnvDAL, + secretImportDAL, + secretApprovalRequestDAL, + secretApprovalPolicyService, + secretApprovalRequestSecretDAL + }); + const secretService = secretServiceFactory({ folderDAL, secretVersionDAL, @@ -735,7 +759,8 @@ export const registerRoutes = async ( projectBotService, secretApprovalPolicyService, secretApprovalRequestDAL, - secretApprovalRequestSecretDAL + secretApprovalRequestSecretDAL, + secretV2BridgeService }); const secretSharingService = secretSharingServiceFactory({ diff --git a/backend/src/server/routes/sanitizedSchemas.ts b/backend/src/server/routes/sanitizedSchemas.ts index f84cea4b8..a5751305f 100644 --- a/backend/src/server/routes/sanitizedSchemas.ts +++ b/backend/src/server/routes/sanitizedSchemas.ts @@ -62,7 +62,7 @@ export const secretRawSchema = z.object({ version: z.number(), type: z.string(), secretKey: z.string(), - secretValue: z.string(), + secretValue: z.string().optional(), secretComment: z.string().optional(), secretReminderNote: z.string().nullable().optional(), secretReminderRepeatDays: z.number().nullable().optional(), diff --git a/backend/src/services/project-bot/project-bot-fns.ts b/backend/src/services/project-bot/project-bot-fns.ts index 0f5d229d7..9269c2936 100644 --- a/backend/src/services/project-bot/project-bot-fns.ts +++ b/backend/src/services/project-bot/project-bot-fns.ts @@ -22,6 +22,10 @@ export const getBotKeyFnFactory = ( const project = await projectDAL.findById(projectId); if (!project) throw new BadRequestError({ message: "Project not found during bot lookup." }); + if (project.version === 3) { + return { project, shouldUseSecretV2Bridge: true }; + } + const bot = await projectBotDAL.findOne({ projectId: project.id }); if (!bot) throw new BadRequestError({ message: "Failed to find bot key", name: "bot_not_found_error" }); @@ -31,12 +35,13 @@ export const getBotKeyFnFactory = ( const botPrivateKey = getBotPrivateKey({ bot }); - return decryptAsymmetric({ + const botKey = decryptAsymmetric({ ciphertext: bot.encryptedProjectKey, privateKey: botPrivateKey, nonce: bot.encryptedProjectKeyNonce, publicKey: bot.sender.publicKey }); + return { botKey, project, shouldUseSecretV2Bridge: false }; }; return getBotKeyFn; diff --git a/backend/src/services/secret-import/secret-import-fns.ts b/backend/src/services/secret-import/secret-import-fns.ts index f1a3a3464..147347e25 100644 --- a/backend/src/services/secret-import/secret-import-fns.ts +++ b/backend/src/services/secret-import/secret-import-fns.ts @@ -1,8 +1,9 @@ -import { SecretType, TSecretImports, TSecrets } from "@app/db/schemas"; +import { SecretType, TSecretImports, TSecrets, TSecretsV2 } from "@app/db/schemas"; import { groupBy } from "@app/lib/fn"; import { TSecretDALFactory } from "../secret/secret-dal"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; +import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal"; import { TSecretImportDALFactory } from "./secret-import-dal"; type TSecretImportSecrets = { @@ -18,6 +19,28 @@ type TSecretImportSecrets = { secrets: (TSecrets & { workspace: string; environment: string; _id: string })[]; }; +type TSecretImportSecretsV2 = { + secretPath: string; + environment: string; + environmentInfo: { + id: string; + slug: string; + name: string; + }; + folderId: string | undefined; + importFolderId: string; + secrets: (TSecretsV2 & { + workspace: string; + environment: string; + _id: string; + secretKey: string; + // akhilmhdh: yes i know you can put ?. + // But for somereason ts consider ? and undefined explicit as different just ts things + secretValue: string | undefined; + secretComment: string | undefined; + })[]; +}; + const LEVEL_BREAK = 10; const getImportUniqKey = (envSlug: string, path: string) => `${envSlug}=${path}`; export const fnSecretsFromImports = async ({ @@ -115,3 +138,101 @@ export const fnSecretsFromImports = async ({ return secrets; }; + +export const fnSecretsV2FromImports = async ({ + allowedImports: possibleCyclicImports, + folderDAL, + secretDAL, + secretImportDAL, + depth = 0, + cyclicDetector = new Set() +}: { + allowedImports: (Omit & { + importEnv: { id: string; slug: string; name: string }; + })[]; + folderDAL: Pick; + secretDAL: Pick; + secretImportDAL: Pick; + depth?: number; + cyclicDetector?: Set; +}) => { + // avoid going more than a depth + if (depth >= LEVEL_BREAK) return []; + + const allowedImports = possibleCyclicImports.filter( + ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath)) + ); + + const importedFolders = ( + await folderDAL.findByManySecretPath( + allowedImports.map(({ importEnv, importPath }) => ({ + envId: importEnv.id, + secretPath: importPath + })) + ) + ).filter(Boolean); // remove undefined ones + if (!importedFolders.length) { + return []; + } + + const importedFolderIds = importedFolders.map((el) => el?.id) as string[]; + const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`); + const importedSecrets = await secretDAL.find( + { + $in: { folderId: importedFolderIds }, + type: SecretType.Shared + }, + { + sort: [["id", "asc"]] + } + ); + + const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId); + + allowedImports.forEach(({ importPath, importEnv }) => { + cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath)); + }); + // now we need to check recursively deeper imports made inside other imports + // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level + const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds); + let secretsFromDeeperImports: TSecretImportSecretsV2[] = []; + if (deeperImports.length) { + secretsFromDeeperImports = await fnSecretsV2FromImports({ + allowedImports: deeperImports.filter(({ isReplication }) => !isReplication), + secretImportDAL, + folderDAL, + secretDAL, + depth: depth + 1, + cyclicDetector + }); + } + const secretsFromdeeperImportGroupedByFolderId = groupBy(secretsFromDeeperImports, (i) => i.importFolderId); + + const secrets = allowedImports.map(({ importPath, importEnv, id, folderId }, i) => { + const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`][0]; + const folderDeeperImportSecrets = + secretsFromdeeperImportGroupedByFolderId?.[sourceImportFolder?.id || ""]?.[0]?.secrets || []; + + return { + secretPath: importPath, + environment: importEnv.slug, + environmentInfo: importEnv, + folderId: importedFolders?.[i]?.id, + id, + importFolderId: folderId, + secrets: (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || []) + .map((item) => ({ + ...item, + secretKey: item.key, + secretValue: item.encryptedValue?.toString(), + secretComment: item.encryptedComment?.toString(), + environment: importEnv.slug, + workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend. + _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend. + })) + .concat(folderDeeperImportSecrets) + }; + }); + + return secrets; +}; diff --git a/backend/src/services/secret-tag/secret-tag-dal.ts b/backend/src/services/secret-tag/secret-tag-dal.ts index 98cd9af22..b1dd1a00b 100644 --- a/backend/src/services/secret-tag/secret-tag-dal.ts +++ b/backend/src/services/secret-tag/secret-tag-dal.ts @@ -10,6 +10,7 @@ export type TSecretTagDALFactory = ReturnType; export const secretTagDALFactory = (db: TDbClient) => { const secretTagOrm = ormify(db, TableName.SecretTag); const secretJnTagOrm = ormify(db, TableName.JnSecretTag); + const secretV2JnTagOrm = ormify(db, TableName.SecretV2JnTag); const findManyTagsById = async (projectId: string, ids: string[], tx?: Knex) => { try { @@ -38,6 +39,8 @@ export const secretTagDALFactory = (db: TDbClient) => { ...secretTagOrm, saveTagsToSecret: secretJnTagOrm.insertMany, deleteTagsToSecret: secretJnTagOrm.delete, + saveTagsToSecretV2: secretV2JnTagOrm.insertMany, + deleteTagsToSecretV2: secretV2JnTagOrm.delete, deleteTagsManySecret, findManyTagsById }; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts new file mode 100644 index 000000000..b41e2c250 --- /dev/null +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts @@ -0,0 +1,393 @@ +import { Knex } from "knex"; +import { validate as uuidValidate } from "uuid"; + +import { TDbClient } from "@app/db"; +import { SecretsV2Schema, SecretType, TableName, TSecretsV2, TSecretsV2Update } from "@app/db/schemas"; +import { BadRequestError, DatabaseError } from "@app/lib/errors"; +import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex"; + +export type TSecretV2BridgeDALFactory = ReturnType; + +export const secretV2BridgeDALFactory = (db: TDbClient) => { + const secretOrm = ormify(db, TableName.SecretV2); + + const update = async (filter: Partial, data: Omit, tx?: Knex) => { + try { + const sec = await (tx || db)(TableName.SecretV2) + .where(filter) + .update(data) + .increment("version", 1) + .returning("*"); + return sec; + } catch (error) { + throw new DatabaseError({ error, name: "update secret" }); + } + }; + + const bulkUpdate = async ( + data: Array<{ filter: Partial; data: TSecretsV2Update }>, + + tx?: Knex + ) => { + try { + const secs = await Promise.all( + data.map(async ({ filter, data: updateData }) => { + const [doc] = await (tx || db)(TableName.SecretV2) + .where(filter) + .update(updateData) + .increment("version", 1) + .returning("*"); + if (!doc) throw new BadRequestError({ message: "Failed to update document" }); + return doc; + }) + ); + return secs; + } catch (error) { + throw new DatabaseError({ error, name: "bulk update secret" }); + } + }; + + const bulkUpdateNoVersionIncrement = async (data: TSecretsV2[], tx?: Knex) => { + try { + const existingSecrets = await secretOrm.find( + { + $in: { + id: data.map((el) => el.id) + } + }, + { tx } + ); + + if (existingSecrets.length !== data.length) { + throw new BadRequestError({ message: "Some of the secrets do not exist" }); + } + + if (data.length === 0) return []; + + const updatedSecrets = await (tx || db)(TableName.SecretV2) + .insert(data) + .onConflict("id") // this will cause a conflict then merge the data + .merge() // Merge the data with the existing data + .returning("*"); + + return updatedSecrets; + } catch (error) { + throw new DatabaseError({ error, name: "bulk update secret" }); + } + }; + + const deleteMany = async ( + data: Array<{ key: string; type: SecretType }>, + folderId: string, + userId: string, + tx?: Knex + ) => { + try { + const deletedSecrets = await (tx || db)(TableName.SecretV2) + .where({ folderId }) + .where((bd) => { + data.forEach((el) => { + void bd.orWhere({ + key: el.key, + type: el.type, + ...(el.type === SecretType.Personal ? { userId } : {}) + }); + // if shared is getting deleted then personal ones also should be deleted + if (el.type === SecretType.Shared) { + void bd.orWhere({ + key: el.key, + type: SecretType.Personal + }); + } + }); + }) + .delete() + .returning("*"); + return deletedSecrets; + } catch (error) { + throw new DatabaseError({ error, name: "delete many secret" }); + } + }; + + const findByFolderId = async (folderId: string, userId?: string, tx?: Knex) => { + try { + // check if not uui then userId id is null (corner case because service token's ID is not UUI in effort to keep backwards compatibility from mongo) + if (userId && !uuidValidate(userId)) { + // eslint-disable-next-line + userId = undefined; + } + + const secs = await (tx || db.replicaNode())(TableName.SecretV2) + .where({ folderId }) + .where((bd) => { + void bd.whereNull("userId").orWhere({ userId: userId || null }); + }) + .leftJoin( + TableName.SecretV2JnTag, + `${TableName.SecretV2}.id`, + `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id` + ) + .leftJoin( + TableName.SecretTag, + `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`, + `${TableName.SecretTag}.id` + ) + .select(selectAllTableCols(TableName.SecretV2)) + .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId")) + .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor")) + .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")) + .select(db.ref("name").withSchema(TableName.SecretTag).as("tagName")) + .orderBy("id", "asc"); + + const data = sqlNestRelationships({ + data: secs, + key: "id", + parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }), + childrenMapper: [ + { + key: "tagId", + label: "tags" as const, + mapper: ({ tagId: id, tagColor: color, tagSlug: slug, tagName: name }) => ({ + id, + color, + slug, + name + }) + } + ] + }); + return data; + } catch (error) { + throw new DatabaseError({ error, name: "get all secret" }); + } + }; + + const getSecretTags = async (secretId: string, tx?: Knex) => { + try { + const tags = await (tx || db.replicaNode())(TableName.SecretV2JnTag) + .join(TableName.SecretTag, `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`, `${TableName.SecretTag}.id`) + .where({ [`${TableName.SecretV2}Id` as const]: secretId }) + .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId")) + .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor")) + .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")) + .select(db.ref("name").withSchema(TableName.SecretTag).as("tagName")); + + return tags.map((el) => ({ + id: el.tagId, + color: el.tagColor, + slug: el.tagSlug, + name: el.tagName + })); + } catch (error) { + throw new DatabaseError({ error, name: "get secret tags" }); + } + }; + + const findByFolderIds = async (folderIds: string[], userId?: string, tx?: Knex) => { + try { + // check if not uui then userId id is null (corner case because service token's ID is not UUI in effort to keep backwards compatibility from mongo) + if (userId && !uuidValidate(userId)) { + // eslint-disable-next-line no-param-reassign + userId = undefined; + } + + const secs = await (tx || db.replicaNode())(TableName.SecretV2) + .whereIn("folderId", folderIds) + .where((bd) => { + void bd.whereNull("userId").orWhere({ userId: userId || null }); + }) + .leftJoin( + TableName.SecretV2JnTag, + `${TableName.SecretV2}.id`, + `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id` + ) + .leftJoin( + TableName.SecretTag, + `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`, + `${TableName.SecretTag}.id` + ) + .select(selectAllTableCols(TableName.SecretV2)) + .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId")) + .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor")) + .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")) + .select(db.ref("name").withSchema(TableName.SecretTag).as("tagName")) + .orderBy("id", "asc"); + + const data = sqlNestRelationships({ + data: secs, + key: "id", + parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }), + childrenMapper: [ + { + key: "tagId", + label: "tags" as const, + mapper: ({ tagId: id, tagColor: color, tagSlug: slug, tagName: name }) => ({ + id, + color, + slug, + name + }) + } + ] + }); + return data; + } catch (error) { + throw new DatabaseError({ error, name: "get all secret" }); + } + }; + + const findBySecretKeys = async ( + folderId: string, + query: Array<{ key: string; type: SecretType.Shared } | { key: string; type: SecretType.Personal; userId: string }>, + tx?: Knex + ) => { + if (!query.length) return []; + try { + const secrets = await (tx || db.replicaNode())(TableName.SecretV2) + .where({ folderId }) + .where((bd) => { + query.forEach((el) => { + if (el.type === SecretType.Personal && !el.userId) { + throw new BadRequestError({ message: "Missing personal user id" }); + } + void bd.orWhere({ + key: el.key, + type: el.type, + userId: el.type === SecretType.Personal ? el.userId : null + }); + }); + }); + return secrets; + } catch (error) { + throw new DatabaseError({ error, name: "find by blind indexes" }); + } + }; + + const upsertSecretReferences = async ( + data: { + secretId: string; + references: Array<{ environment: string; secretPath: string; secretKey: string }>; + }[] = [], + tx?: Knex + ) => { + try { + if (!data.length) return; + + await (tx || db)(TableName.SecretReferenceV2) + .whereIn( + "secretId", + data.map(({ secretId }) => secretId) + ) + .delete(); + const newSecretReferences = data + .filter(({ references }) => references.length) + .flatMap(({ secretId, references }) => + references.map(({ environment, secretPath, secretKey }) => ({ + secretPath, + secretId, + environment, + secretKey + })) + ); + if (!newSecretReferences.length) return; + const secretReferences = await (tx || db)(TableName.SecretReferenceV2).insert(newSecretReferences); + return secretReferences; + } catch (error) { + throw new DatabaseError({ error, name: "UpsertSecretReference" }); + } + }; + + const findReferencedSecretReferences = async (projectId: string, envSlug: string, secretPath: string, tx?: Knex) => { + try { + const docs = await (tx || db.replicaNode())(TableName.SecretReferenceV2) + .where({ + secretPath, + environment: envSlug + }) + .join(TableName.SecretV2, `${TableName.SecretV2}.id`, `${TableName.SecretReferenceV2}.secretId`) + .join(TableName.SecretFolder, `${TableName.SecretV2}.folderId`, `${TableName.SecretFolder}.id`) + .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`) + .where("projectId", projectId) + .select(selectAllTableCols(TableName.SecretReferenceV2)) + .select("folderId"); + + return docs; + } catch (error) { + throw new DatabaseError({ error, name: "FindReferencedSecretReferences" }); + } + }; + + // special query to backfill secret value + const findAllProjectSecretValues = async (projectId: string, tx?: Knex) => { + try { + const docs = await (tx || db.replicaNode())(TableName.SecretV2) + .join(TableName.SecretFolder, `${TableName.SecretV2}.folderId`, `${TableName.SecretFolder}.id`) + .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`) + .where("projectId", projectId) + // not empty + .whereNotNull("encryptedValue") + .select("encryptedValue", `${TableName.SecretV2}.id` as "id"); + return docs; + } catch (error) { + throw new DatabaseError({ error, name: "FindAllProjectSecretValues" }); + } + }; + + const findOneWithTags = async (filter: Partial, tx?: Knex) => { + try { + const rawDocs = await (tx || db.replicaNode())(TableName.SecretV2) + .where(filter) + .leftJoin( + TableName.SecretV2JnTag, + `${TableName.SecretV2}.id`, + `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id` + ) + .leftJoin( + TableName.SecretTag, + `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`, + `${TableName.SecretTag}.id` + ) + .select(selectAllTableCols(TableName.SecretV2)) + .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId")) + .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor")) + .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")) + .select(db.ref("name").withSchema(TableName.SecretTag).as("tagName")); + const docs = sqlNestRelationships({ + data: rawDocs, + key: "id", + parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }), + childrenMapper: [ + { + key: "tagId", + label: "tags" as const, + mapper: ({ tagId: id, tagColor: color, tagSlug: slug, tagName: name }) => ({ + id, + color, + slug, + name + }) + } + ] + }); + return docs?.[0]; + } catch (error) { + throw new DatabaseError({ error, name: "FindOneWIthTags" }); + } + }; + + return { + ...secretOrm, + update, + bulkUpdate, + deleteMany, + bulkUpdateNoVersionIncrement, + getSecretTags, + findOneWithTags, + findByFolderId, + findByFolderIds, + findBySecretKeys, + upsertSecretReferences, + findReferencedSecretReferences, + findAllProjectSecretValues + }; +}; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts new file mode 100644 index 000000000..200791382 --- /dev/null +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts @@ -0,0 +1,553 @@ +import path from "node:path"; + +import { TableName, TSecretFolders, TSecretsV2 } from "@app/db/schemas"; +import { groupBy } from "@app/lib/fn"; +import { logger } from "@app/lib/logger"; + +import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; +import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; +import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; +import { TFnSecretBulkDelete, TFnSecretBulkInsert, TFnSecretBulkUpdate } from "./secret-v2-bridge-types"; + +const INTERPOLATION_SYNTAX_REG = /\${([^}]+)}/g; + +export const shouldUseSecretV2Bridge = (version: number) => version === 3; + +/** + * Grabs and processes nested secret references from a string + * + * This function looks for patterns that match the interpolation syntax in the input string. + * It filters out references that include nested paths, splits them into environment and + * secret path parts, and then returns an array of objects with the environment and the + * joined secret path. + * @example + * const value = "Hello ${dev.someFolder.OtherFolder.SECRET_NAME} and ${prod.anotherFolder.SECRET_NAME}"; + * const result = getAllNestedSecretReferences(value); + * // result will be: + * // [ + * // { environment: 'dev', secretPath: '/someFolder/OtherFolder' }, + * // { environment: 'prod', secretPath: '/anotherFolder' } + * // ] + */ +export const getAllNestedSecretReferences = (maybeSecretReference: string) => { + const references = Array.from(maybeSecretReference.matchAll(INTERPOLATION_SYNTAX_REG), (m) => m[1]); + return references + .filter((el) => el.includes(".")) + .map((el) => { + const [environment, ...secretPathList] = el.split("."); + return { + environment, + secretPath: path.join("/", ...secretPathList.slice(0, -1)), + secretKey: secretPathList[secretPathList.length - 1] + }; + }); +}; + +// these functions are special functions shared by a couple of resources +// used by secret approval, rotation or anywhere in which secret needs to modified +export const fnSecretBulkInsert = async ({ + // TODO: Pick types here + folderId, + inputSecrets, + secretDAL, + secretVersionDAL, + secretTagDAL, + secretVersionTagDAL, + tx +}: TFnSecretBulkInsert) => { + const sanitizedInputSecrets = inputSecrets.map( + ({ + skipMultilineEncoding, + type, + key, + userId, + encryptedComment, + version, + metadata, + reminderNote, + encryptedValue, + reminderRepeatDays + }) => ({ + skipMultilineEncoding, + type, + key, + userId, + encryptedComment, + version, + metadata, + reminderNote, + encryptedValue, + reminderRepeatDays + }) + ); + + const newSecrets = await secretDAL.insertMany(sanitizedInputSecrets.map((el) => ({ ...el, folderId }))); + const newSecretGroupedByKeyName = groupBy(newSecrets, (item) => item.key); + const newSecretTags = inputSecrets.flatMap(({ tagIds: secretTags = [], key }) => + secretTags.map((tag) => ({ + [`${TableName.SecretTag}Id` as const]: tag, + [`${TableName.SecretV2}Id` as const]: newSecretGroupedByKeyName[key][0].id + })) + ); + const secretVersions = await secretVersionDAL.insertMany( + sanitizedInputSecrets.map((el) => ({ + ...el, + folderId, + secretId: newSecretGroupedByKeyName[el.key][0].id + })), + tx + ); + await secretDAL.upsertSecretReferences( + inputSecrets.map(({ references = [], key }) => ({ + secretId: newSecretGroupedByKeyName[key][0].id, + references + })), + tx + ); + if (newSecretTags.length) { + const secTags = await secretTagDAL.saveTagsToSecretV2(newSecretTags, tx); + const secVersionsGroupBySecId = groupBy(secretVersions, (i) => i.secretId); + const newSecretVersionTags = secTags.flatMap(({ secrets_v2Id, secret_tagsId }) => ({ + [`${TableName.SecretVersionV2}Id` as const]: secVersionsGroupBySecId[secrets_v2Id][0].id, + [`${TableName.SecretTag}Id` as const]: secret_tagsId + })); + await secretVersionTagDAL.insertMany(newSecretVersionTags, tx); + } + + return newSecrets.map((secret) => ({ ...secret, _id: secret.id })); +}; + +export const fnSecretBulkUpdate = async ({ + tx, + inputSecrets, + folderId, + secretDAL, + secretVersionDAL, + secretTagDAL, + secretVersionTagDAL +}: TFnSecretBulkUpdate) => { + const sanitizedInputSecrets = inputSecrets.map( + ({ + filter, + data: { + skipMultilineEncoding, + type, + key, + encryptedValue, + userId, + encryptedComment, + version, + metadata, + reminderNote, + reminderRepeatDays + } + }) => ({ + filter: { ...filter, folderId }, + data: { + skipMultilineEncoding, + type, + key, + userId, + encryptedComment, + version, + metadata, + reminderNote, + encryptedValue, + reminderRepeatDays + } + }) + ); + + const newSecrets = await secretDAL.bulkUpdate(sanitizedInputSecrets, tx); + const secretVersions = await secretVersionDAL.insertMany( + newSecrets.map( + ({ + skipMultilineEncoding, + type, + key, + userId, + encryptedComment, + version, + metadata, + reminderNote, + encryptedValue, + reminderRepeatDays, + id: secretId + }) => ({ + skipMultilineEncoding, + type, + key, + userId, + encryptedComment, + version, + metadata, + reminderNote, + encryptedValue, + reminderRepeatDays, + folderId, + secretId + }) + ), + tx + ); + await secretDAL.upsertSecretReferences( + inputSecrets + .filter(({ data: { references } }) => Boolean(references)) + .map(({ data: { references = [] } }, i) => ({ + secretId: newSecrets[i].id, + references + })), + tx + ); + const secsUpdatedTag = inputSecrets.flatMap(({ data: { tags } }, i) => + tags !== undefined ? { tags, secretId: newSecrets[i].id } : [] + ); + if (secsUpdatedTag.length) { + await secretTagDAL.deleteTagsToSecretV2({ $in: { id: secsUpdatedTag.map(({ secretId }) => secretId) } }, tx); + const newSecretTags = secsUpdatedTag.flatMap(({ tags: secretTags = [], secretId }) => + secretTags.map((tag) => ({ + [`${TableName.SecretTag}Id` as const]: tag, + [`${TableName.SecretV2}Id` as const]: secretId + })) + ); + if (newSecretTags.length) { + const secTags = await secretTagDAL.saveTagsToSecretV2(newSecretTags, tx); + const secVersionsGroupBySecId = groupBy(secretVersions, (i) => i.secretId); + const newSecretVersionTags = secTags.flatMap(({ secrets_v2Id, secret_tagsId }) => ({ + [`${TableName.SecretVersionV2}Id` as const]: secVersionsGroupBySecId[secrets_v2Id][0].id, + [`${TableName.SecretTag}Id` as const]: secret_tagsId + })); + await secretVersionTagDAL.insertMany(newSecretVersionTags, tx); + } + } + + return newSecrets.map((secret) => ({ ...secret, _id: secret.id })); +}; + +export const fnSecretBulkDelete = async ({ + folderId, + inputSecrets, + tx, + actorId, + secretDAL, + secretQueueService +}: TFnSecretBulkDelete) => { + const deletedSecrets = await secretDAL.deleteMany( + inputSecrets.map(({ type, secretKey }) => ({ + key: secretKey, + type + })), + folderId, + actorId, + tx + ); + + await Promise.allSettled( + deletedSecrets + .filter(({ reminderRepeatDays }) => Boolean(reminderRepeatDays)) + .map(({ id, reminderRepeatDays }) => + secretQueueService.removeSecretReminder({ secretId: id, repeatDays: reminderRepeatDays as number }) + ) + ); + + return deletedSecrets; +}; + +// Introduce a new interface for mapping parent IDs to their children +interface FolderMap { + [parentId: string]: TSecretFolders[]; +} +const buildHierarchy = (folders: TSecretFolders[]): FolderMap => { + const map: FolderMap = {}; + map.null = []; // Initialize mapping for root directory + + folders.forEach((folder) => { + const parentId = folder.parentId || "null"; + if (!map[parentId]) { + map[parentId] = []; + } + map[parentId].push(folder); + }); + + return map; +}; + +const generatePaths = ( + map: FolderMap, + parentId: string = "null", + basePath: string = "", + currentDepth: number = 0 +): { path: string; folderId: string }[] => { + const children = map[parentId || "null"] || []; + let paths: { path: string; folderId: string }[] = []; + + children.forEach((child) => { + // Determine if this is the root folder of the environment. If no parentId is present and the name is root, it's the root folder + const isRootFolder = child.name === "root" && !child.parentId; + + // Form the current path based on the base path and the current child + // eslint-disable-next-line no-nested-ternary + const currPath = basePath === "" ? (isRootFolder ? "/" : `/${child.name}`) : `${basePath}/${child.name}`; + + // Add the current path + paths.push({ + path: currPath, + folderId: child.id + }); + + // We make sure that the recursion depth doesn't exceed 20. + // We do this to create "circuit break", basically to ensure that we can't encounter any potential memory leaks. + if (currentDepth >= 20) { + logger.info(`generatePaths: Recursion depth exceeded 20, breaking out of recursion [map=${JSON.stringify(map)}]`); + return; + } + // Recursively generate paths for children, passing down the formatted path + const childPaths = generatePaths(map, child.id, currPath, currentDepth + 1); + paths = paths.concat( + childPaths.map((p) => ({ + path: p.path, + folderId: p.folderId + })) + ); + }); + + return paths; +}; + +type TRecursivelyFetchSecretsFromFoldersArg = { + folderDAL: Pick; + projectEnvDAL: Pick; + projectId: string; + environment: string; + currentPath: string; + hasAccess: (environment: string, secretPath: string) => boolean; +}; + +export const recursivelyGetSecretPaths = async ({ + folderDAL, + projectEnvDAL, + projectId, + environment, + currentPath, + hasAccess +}: TRecursivelyFetchSecretsFromFoldersArg) => { + const env = await projectEnvDAL.findOne({ + projectId, + slug: environment + }); + + if (!env) { + throw new Error(`'${environment}' environment not found in project with ID ${projectId}`); + } + + // Fetch all folders in env once with a single query + const folders = await folderDAL.find({ + envId: env.id, + isReserved: false + }); + + // Build the folder hierarchy map + const folderMap = buildHierarchy(folders); + + // Generate the paths paths and normalize the root path to / + const paths = generatePaths(folderMap).map((p) => ({ + path: p.path === "/" ? p.path : p.path.substring(1), + folderId: p.folderId + })); + + // Filter out paths that the user does not have permission to access, and paths that are not in the current path + const allowedPaths = paths.filter( + (folder) => hasAccess(environment, folder.path) && folder.path.startsWith(currentPath === "/" ? "" : currentPath) + ); + + return allowedPaths; +}; + +type TInterpolateSecretArg = { + projectId: string; + decryptSecret: (encryptedValue?: Buffer | null) => string; + secretDAL: Pick; + folderDAL: Pick; +}; + +export const interpolateSecrets = ({ projectId, decryptSecret, secretDAL, folderDAL }: TInterpolateSecretArg) => { + const fetchSecretsCrossEnv = () => { + const fetchCache: Record> = {}; + + return async (secRefEnv: string, secRefPath: string[], secRefKey: string) => { + const secRefPathUrl = path.join("/", ...secRefPath); + const uniqKey = `${secRefEnv}-${secRefPathUrl}`; + + if (fetchCache?.[uniqKey]) { + return fetchCache[uniqKey][secRefKey]; + } + + const folder = await folderDAL.findBySecretPath(projectId, secRefEnv, secRefPathUrl); + if (!folder) return ""; + const secrets = await secretDAL.findByFolderId(folder.id); + + const decryptedSec = secrets.reduce>((prev, secret) => { + // eslint-disable-next-line + prev[secret.key] = decryptSecret(secret.encryptedValue); + return prev; + }, {}); + + fetchCache[uniqKey] = decryptedSec; + + return fetchCache[uniqKey][secRefKey]; + }; + }; + + const recursivelyExpandSecret = async ( + expandedSec: Record, + interpolatedSec: Record, + fetchCrossEnv: (env: string, secPath: string[], secKey: string) => Promise, + recursionChainBreaker: Record, + key: string + ) => { + if (expandedSec?.[key] !== undefined) { + return expandedSec[key]; + } + if (recursionChainBreaker?.[key]) { + return ""; + } + // eslint-disable-next-line + recursionChainBreaker[key] = true; + + let interpolatedValue = interpolatedSec[key]; + if (!interpolatedValue) { + // eslint-disable-next-line no-console + console.error(`Couldn't find referenced value - ${key}`); + return ""; + } + + const refs = interpolatedValue.match(INTERPOLATION_SYNTAX_REG); + if (refs) { + for (const interpolationSyntax of refs) { + const interpolationKey = interpolationSyntax.slice(2, interpolationSyntax.length - 1); + const entities = interpolationKey.trim().split("."); + + if (entities.length === 1) { + // eslint-disable-next-line + const val = await recursivelyExpandSecret( + expandedSec, + interpolatedSec, + fetchCrossEnv, + recursionChainBreaker, + interpolationKey + ); + if (val) { + interpolatedValue = interpolatedValue.replaceAll(interpolationSyntax, val); + } + // eslint-disable-next-line + continue; + } + + if (entities.length > 1) { + const secRefEnv = entities[0]; + const secRefPath = entities.slice(1, entities.length - 1); + const secRefKey = entities[entities.length - 1]; + + // eslint-disable-next-line + const val = await fetchCrossEnv(secRefEnv, secRefPath, secRefKey); + if (val) { + interpolatedValue = interpolatedValue.replaceAll(interpolationSyntax, val); + } + } + } + } + + // eslint-disable-next-line + expandedSec[key] = interpolatedValue; + return interpolatedValue; + }; + + // used to convert multi line ones to quotes ones with \n + const formatMultiValueEnv = (val?: string) => { + if (!val) return ""; + if (!val.match("\n")) return val; + return `"${val.replace(/\n/g, "\\n")}"`; + }; + + const expandSecrets = async ( + secrets: Record + ) => { + const expandedSec: Record = {}; + const interpolatedSec: Record = {}; + + const crossSecEnvFetch = fetchSecretsCrossEnv(); + + Object.keys(secrets).forEach((key) => { + if (secrets[key].value.match(INTERPOLATION_SYNTAX_REG)) { + interpolatedSec[key] = secrets[key].value; + } else { + expandedSec[key] = secrets[key].value; + } + }); + + for (const key of Object.keys(secrets)) { + if (expandedSec?.[key]) { + // should not do multi line encoding if user has set it to skip + // eslint-disable-next-line + secrets[key].value = secrets[key].skipMultilineEncoding + ? formatMultiValueEnv(expandedSec[key]) + : expandedSec[key]; + // eslint-disable-next-line + continue; + } + + // this is to avoid recursion loop. So the graph should be direct graph rather than cyclic + // so for any recursion building if there is an entity two times same key meaning it will be looped + const recursionChainBreaker: Record = {}; + // eslint-disable-next-line + const expandedVal = await recursivelyExpandSecret( + expandedSec, + interpolatedSec, + crossSecEnvFetch, + recursionChainBreaker, + key + ); + + // eslint-disable-next-line + secrets[key].value = secrets[key].skipMultilineEncoding ? formatMultiValueEnv(expandedVal) : expandedVal; + } + + return secrets; + }; + return expandSecrets; +}; + +export const reshapeBridgeSecret = ( + workspaceId: string, + environment: string, + secretPath: string, + secret: Omit & { + value?: string; + comment?: string; + tags?: { + id: string; + slug: string; + color?: string | null; + name: string; + }[]; + } +) => ({ + secretKey: secret.key, + secretPath, + workspace: workspaceId, + environment, + secretValue: secret.value, + secretComment: secret.comment, + version: secret.version, + type: secret.type, + _id: secret.id, + id: secret.id, + user: secret.userId, + tags: secret.tags, + skipMultilineEncoding: secret.skipMultilineEncoding, + secretReminderRepeatDays: secret.reminderRepeatDays, + secretReminderNote: secret.reminderNote, + metadata: secret.metadata, + createdAt: secret.createdAt, + updatedAt: secret.updatedAt +}); diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts new file mode 100644 index 000000000..5d94d4930 --- /dev/null +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -0,0 +1,1319 @@ +import { ForbiddenError, subject } from "@casl/ability"; + +import { ProjectMembershipRole, SecretsV2Schema, SecretType } from "@app/db/schemas"; +import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; +import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; +import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service"; +import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal"; +import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal"; +import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { groupBy } from "@app/lib/fn"; +import { logger } from "@app/lib/logger"; +import { alphaNumericNanoId } from "@app/lib/nanoid"; + +import { ActorType } from "../auth/auth-type"; +import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; +import { TSecretQueueFactory } from "../secret/secret-queue"; +import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; +import { TSecretImportDALFactory } from "../secret-import/secret-import-dal"; +import { fnSecretsV2FromImports } from "../secret-import/secret-import-fns"; +import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal"; +import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; +import { + fnSecretBulkDelete, + fnSecretBulkInsert, + fnSecretBulkUpdate, + getAllNestedSecretReferences, + interpolateSecrets, + recursivelyGetSecretPaths, + reshapeBridgeSecret +} from "./secret-v2-bridge-fns"; +import { + SecretOperations, + TBackFillSecretReferencesDTO, + TCreateManySecretDTO, + TCreateSecretDTO, + TDeleteManySecretDTO, + TDeleteSecretDTO, + TGetASecretDTO, + TGetSecretsDTO, + TGetSecretVersionsDTO, + TMoveSecretsDTO, + TUpdateManySecretDTO, + TUpdateSecretDTO +} from "./secret-v2-bridge-types"; +import { TSecretVersionV2DALFactory } from "./secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "./secret-version-tag-dal"; + +type TSecretV2BridgeServiceFactoryDep = { + secretDAL: TSecretV2BridgeDALFactory; + secretVersionDAL: TSecretVersionV2DALFactory; + secretVersionTagDAL: Pick; + secretTagDAL: TSecretTagDALFactory; + permissionService: Pick; + projectEnvDAL: Pick; + folderDAL: Pick< + TSecretFolderDALFactory, + "findBySecretPath" | "updateById" | "findById" | "findByManySecretPath" | "find" + >; + secretImportDAL: Pick; + secretQueueService: Pick; + secretApprovalPolicyService: Pick; + secretApprovalRequestDAL: Pick; + secretApprovalRequestSecretDAL: Pick< + TSecretApprovalRequestSecretDALFactory, + "insertMany" | "insertApprovalSecretTags" + >; +}; + +export type TSecretV2BridgeServiceFactory = ReturnType; + +/* + * This service is a bridge from our old architecture towards the new architecture + */ +export const secretV2BridgeServiceFactory = ({ + secretDAL, + projectEnvDAL, + secretTagDAL, + secretVersionDAL, + folderDAL, + permissionService, + snapshotService, + secretQueueService, + secretImportDAL, + secretVersionTagDAL, + secretApprovalPolicyService, + secretApprovalRequestDAL, + secretApprovalRequestSecretDAL +}: TSecretV2BridgeServiceFactoryDep) => { + const createSecret = async ({ + actor, + actorId, + actorOrgId, + environment, + actorAuthMethod, + projectId, + secretPath, + ...inputSecret + }: TCreateSecretDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Create, + subject(ProjectPermissionSub.Secrets, { environment, secretPath }) + ); + + const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); + if (!folder) + throw new BadRequestError({ + message: "Folder not found for the given environment slug & secret path", + name: "Create secret" + }); + const folderId = folder.id; + + if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) { + throw new BadRequestError({ message: "Must be user to create personal secret" }); + } + + const doesSecretExist = await secretDAL.findOne({ + key: inputSecret.secretName, + type: SecretType.Shared, + folderId + }); + if (inputSecret.type === SecretType.Shared && doesSecretExist) + throw new BadRequestError({ message: "Secret already exist" }); + // if user creating personal check its shared also exist + if (inputSecret.type === SecretType.Personal && !doesSecretExist) { + throw new BadRequestError({ + message: "Failed to create personal secret override for no corresponding shared secret" + }); + } + + // validate tags + // fetch all tags and if not same count throw error meaning one was invalid tags + const tags = inputSecret.tagIds ? await secretTagDAL.find({ projectId, $in: { id: inputSecret.tagIds } }) : []; + if ((inputSecret.tagIds || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); + + const { secretName, type, ...el } = inputSecret; + const references = getAllNestedSecretReferences(inputSecret.secretValue); + const secret = await secretDAL.transaction((tx) => + fnSecretBulkInsert({ + folderId, + inputSecrets: [ + { + version: 1, + type, + reminderRepeatDays: el.secretReminderRepeatDays, + encryptedComment: el.secretComment ? Buffer.from(el.secretComment) : undefined, + encryptedValue: el.secretValue ? Buffer.from(el.secretValue) : undefined, + reminderNote: el.secretReminderNote, + skipMultilineEncoding: el.skipMultilineEncoding, + key: secretName, + userId: inputSecret.type === SecretType.Personal ? actorId : null, + tagIds: inputSecret.tagIds, + references + } + ], + secretDAL, + secretVersionDAL, + secretTagDAL, + secretVersionTagDAL, + tx + }) + ); + + // await snapshotService.performSnapshot(folderId); + await secretQueueService.syncSecrets({ + secretPath, + actorId, + actor, + projectId, + environmentSlug: folder.environment.slug + }); + + return reshapeBridgeSecret(projectId, environment, secretPath, { + ...secret[0], + value: inputSecret.secretValue, + comment: inputSecret.secretComment + }); + }; + + const updateSecret = async ({ + actor, + actorId, + actorOrgId, + environment, + actorAuthMethod, + projectId, + secretPath, + ...inputSecret + }: TUpdateSecretDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Edit, + subject(ProjectPermissionSub.Secrets, { environment, secretPath }) + ); + + if (inputSecret.newSecretName === "") { + throw new BadRequestError({ message: "New secret name cannot be empty" }); + } + + const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); + if (!folder) + throw new BadRequestError({ + message: "Folder not found for the given environment slug & secret path", + name: "UpdateSecret" + }); + const folderId = folder.id; + + if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) { + throw new BadRequestError({ message: "Must be user to create personal secret" }); + } + + if (inputSecret.newSecretName && inputSecret.type === SecretType.Personal) { + throw new BadRequestError({ message: "Personal secret cannot change the key name" }); + } + + let secret; + let secretId: string; + if (inputSecret.type === SecretType.Personal) { + const personalSecretToModify = await secretDAL.findOne({ + key: inputSecret.secretName, + type: SecretType.Personal, + folderId, + userId: actorId + }); + if (!personalSecretToModify) throw new BadRequestError({ message: "Secret not found" }); + secretId = personalSecretToModify.id; + secret = personalSecretToModify; + } else { + const sharedSecretToModify = await secretDAL.findOne({ + key: inputSecret.secretName, + type: SecretType.Shared, + folderId + }); + if (!sharedSecretToModify) throw new BadRequestError({ message: "Secret not found" }); + secretId = sharedSecretToModify.id; + secret = sharedSecretToModify; + } + + if (inputSecret.newSecretName) { + const doesNewNameSecretExist = await secretDAL.findOne({ + key: inputSecret.secretName, + type: SecretType.Shared, + folderId + }); + if (doesNewNameSecretExist) throw new BadRequestError({ message: "Secret with the new name already exist" }); + } + + // validate tags + // fetch all tags and if not same count throw error meaning one was invalid tags + const tags = inputSecret.tagIds ? await secretTagDAL.find({ projectId, $in: { id: inputSecret.tagIds } }) : []; + if ((inputSecret.tagIds || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); + + const { secretName, secretValue, secretComment } = inputSecret; + + const updatedSecret = await secretDAL.transaction(async (tx) => + fnSecretBulkUpdate({ + folderId, + inputSecrets: [ + { + filter: { id: secretId }, + data: { + reminderRepeatDays: inputSecret.secretReminderRepeatDays, + encryptedComment: secretComment ? Buffer.from(secretComment) : undefined, + reminderNote: inputSecret.secretReminderNote, + skipMultilineEncoding: inputSecret.skipMultilineEncoding, + key: inputSecret.newSecretName || secretName, + tags: inputSecret.tagIds, + ...(secretValue + ? { + encryptedValue: Buffer.from(secretValue), + references: getAllNestedSecretReferences(secretValue) + } + : { + encryptedValue: undefined, + references: undefined + }) + } + } + ], + secretDAL, + secretVersionDAL, + secretTagDAL, + secretVersionTagDAL, + tx + }) + ); + await secretQueueService.handleSecretReminder({ + newSecret: { + id: updatedSecret[0].id, + ...inputSecret + }, + oldSecret: secret, + projectId + }); + + // await snapshotService.performSnapshot(folderId); + await secretQueueService.syncSecrets({ + actor, + actorId, + secretPath, + projectId, + environmentSlug: folder.environment.slug + }); + return reshapeBridgeSecret(projectId, environment, secretPath, { + ...updatedSecret[0], + // TODO(akhilmhdh-sev2): fix this + value: updatedSecret[0].encryptedValue?.toString(), + comment: updatedSecret[0].encryptedComment?.toString() + }); + }; + + const deleteSecret = async ({ + actor, + actorId, + actorOrgId, + actorAuthMethod, + environment, + projectId, + secretPath, + ...inputSecret + }: TDeleteSecretDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Delete, + subject(ProjectPermissionSub.Secrets, { environment, secretPath }) + ); + + const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); + if (!folder) + throw new BadRequestError({ + message: "Folder not found for the given environment slug & secret path", + name: "Create secret" + }); + const folderId = folder.id; + + if (ActorType.USER !== actor && inputSecret.type === SecretType.Personal) { + throw new BadRequestError({ message: "Must be user to create personal secret" }); + } + + const deletedSecret = await secretDAL.transaction(async (tx) => + fnSecretBulkDelete({ + projectId, + folderId, + actorId, + secretDAL, + secretQueueService, + inputSecrets: [ + { + type: inputSecret.type as SecretType, + secretKey: inputSecret.secretName + } + ], + tx + }) + ); + + // await snapshotService.performSnapshot(folderId); + await secretQueueService.syncSecrets({ + actor, + actorId, + secretPath, + projectId, + environmentSlug: folder.environment.slug + }); + return reshapeBridgeSecret(projectId, environment, secretPath, { + ...deletedSecret[0], + // TODO(akhilmhdh-sev2): fix this + value: deletedSecret[0].encryptedValue?.toString(), + comment: deletedSecret[0].encryptedComment?.toString() + }); + }; + + const getSecrets = async ({ + actorId, + path, + environment, + projectId, + actor, + actorOrgId, + actorAuthMethod, + includeImports, + recursive // TODO(akhilmhdh-sev2): add logic for expandSecretReferences + }: TGetSecretsDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + + let paths: { folderId: string; path: string }[] = []; + + if (recursive) { + const deepPaths = await recursivelyGetSecretPaths({ + folderDAL, + projectEnvDAL, + projectId, + environment, + currentPath: path, + hasAccess: (permissionEnvironment, permissionSecretPath) => + permission.can( + ProjectPermissionActions.Read, + subject(ProjectPermissionSub.Secrets, { + environment: permissionEnvironment, + secretPath: permissionSecretPath + }) + ) + }); + + if (!deepPaths) return { secrets: [], imports: [] }; + + paths = deepPaths.map(({ folderId, path: p }) => ({ folderId, path: p })); + } else { + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Read, + subject(ProjectPermissionSub.Secrets, { environment, secretPath: path }) + ); + + const folder = await folderDAL.findBySecretPath(projectId, environment, path); + if (!folder) return { secrets: [], imports: [] }; + + paths = [{ folderId: folder.id, path }]; + } + + const groupedPaths = groupBy(paths, (p) => p.folderId); + + const secrets = await secretDAL.findByFolderIds( + paths.map((p) => p.folderId), + actorId + ); + + if (includeImports) { + const secretImports = await secretImportDAL.findByFolderIds(paths.map((p) => p.folderId)); + const allowedImports = secretImports.filter(({ importEnv, importPath, isReplication }) => + !isReplication && + // if its service token allow full access over imported one + actor === ActorType.SERVICE + ? true + : permission.can( + ProjectPermissionActions.Read, + subject(ProjectPermissionSub.Secrets, { + environment: importEnv.slug, + secretPath: importPath + }) + ) + ); + const importedSecrets = await fnSecretsV2FromImports({ + allowedImports, + secretDAL, + folderDAL, + secretImportDAL + }); + + return { + secrets: secrets.map((secret) => + reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, { + ...secret, + // TODO(akhilmhdh-sev2): decryption missiong + value: secret.encryptedValue?.toString(), + comment: secret.encryptedComment?.toString() + }) + ), + imports: importedSecrets + }; + } + + return { + secrets: secrets.map((secret) => + reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, { + ...secret, + // TODO(akhilmhdh-sev2): decrypt this + value: secret.encryptedValue?.toString(), + comment: secret.encryptedComment?.toString() + }) + ) + }; + }; + + const getSecretByName = async ({ + actorId, + actor, + actorOrgId, + actorAuthMethod, + projectId, + environment, + path, + type, + secretName, + version, + includeImports, + expandSecretReferences + }: TGetASecretDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Read, + subject(ProjectPermissionSub.Secrets, { environment, secretPath: path }) + ); + const folder = await folderDAL.findBySecretPath(projectId, environment, path); + if (!folder) + throw new BadRequestError({ + message: "Folder not found for the given environment slug & secret path", + name: "Create secret" + }); + const folderId = folder.id; + + let secretType = type; + if (actor === ActorType.SERVICE) { + logger.info( + `secretServiceFactory: overriding secret type for service token [projectId=${projectId}] [factoryFunctionName=getSecretByName]` + ); + secretType = SecretType.Shared; + } + + const secret = await (version === undefined + ? secretDAL.findOneWithTags({ + folderId, + type: secretType, + key: secretName, + userId: secretType === SecretType.Personal ? actorId : null + }) + : secretVersionDAL + .findOne({ + folderId, + type: secretType, + userId: secretType === SecretType.Personal ? actorId : null, + key: secretName + }) + .then((el) => SecretsV2Schema.parse({ ...el, id: el.secretId }))); + // TODO(akhilmhdh-sev2): resolve this decryptSecret + const interpolateInlineSecretReference = interpolateSecrets({ + projectId, + decryptSecret: () => "", + secretDAL, + folderDAL + }); + // now if secret is not found + // then search for imported secrets + // here we consider the import order also thus starting from bottom + if (!secret && includeImports) { + const secretImports = await secretImportDAL.find({ folderId, isReplication: false }); + const allowedImports = secretImports.filter(({ importEnv, importPath }) => + // if its service token allow full access over imported one + actor === ActorType.SERVICE + ? true + : permission.can( + ProjectPermissionActions.Read, + subject(ProjectPermissionSub.Secrets, { + environment: importEnv.slug, + secretPath: importPath + }) + ) + ); + const importedSecrets = await fnSecretsV2FromImports({ + allowedImports, + secretDAL, + folderDAL, + secretImportDAL + }); + for (let i = importedSecrets.length - 1; i >= 0; i -= 1) { + for (let j = 0; j < importedSecrets[i].secrets.length; j += 1) { + if (secretName === importedSecrets[i].secrets[j].key) { + const importedSecret = importedSecrets[i].secrets[j]; + let secretValue = importedSecret.encryptedValue ? importedSecret.encryptedValue.toString() : undefined; + if (expandSecretReferences && secretValue) { + const secretReferenceExpandedString = { + [importedSecret.key]: { value: secretValue } + }; + // eslint-disable-next-line + await interpolateInlineSecretReference(secretReferenceExpandedString); + secretValue = secretReferenceExpandedString[importedSecret.key].value; + } + + // TODO(akhilmhdh-sev2): decrypt this + return reshapeBridgeSecret(projectId, importedSecrets[i].environment, importedSecrets[i].secretPath, { + ...importedSecret, + value: secretValue, + comment: importedSecret.encryptedComment?.toString() + }); + } + } + } + } + if (!secret) throw new BadRequestError({ message: "Secret not found" }); + + let secretValue = secret.encryptedValue ? secret.encryptedValue.toString() : undefined; + if (expandSecretReferences && secretValue) { + const secretReferenceExpandedString = { + [secret.key]: { value: secretValue } + }; + // eslint-disable-next-line + await interpolateInlineSecretReference(secretReferenceExpandedString); + secretValue = secretReferenceExpandedString[secret.key].value; + } + + // TODO(akhilmhdh-sev2): fix this + return reshapeBridgeSecret(projectId, environment, path, { + ...secret, + value: secretValue, + comment: secret.encryptedComment?.toString() + }); + }; + + const createManySecret = async ({ + secretPath, + actor, + actorId, + actorAuthMethod, + actorOrgId, + environment, + projectId, + secrets: inputSecrets + }: TCreateManySecretDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Create, + subject(ProjectPermissionSub.Secrets, { environment, secretPath }) + ); + + const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); + if (!folder) + throw new BadRequestError({ + message: "Folder not found for the given environment slug & secret path", + name: "Create secret" + }); + const folderId = folder.id; + + const secrets = await secretDAL.findBySecretKeys( + folderId, + inputSecrets.map((el) => ({ + key: el.secretKey, + type: SecretType.Shared + })) + ); + if (secrets.length) + throw new BadRequestError({ message: `Secret already exist: ${secrets.map((el) => el.key).join(",")}` }); + + // get all tags + const sanitizedTagIds = inputSecrets.flatMap(({ tagIds = [] }) => tagIds); + const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : []; + if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" }); + + const newSecrets = await secretDAL.transaction(async (tx) => + fnSecretBulkInsert({ + inputSecrets: inputSecrets.map((el) => ({ + version: 1, + encryptedComment: el.secretComment ? Buffer.from(el.secretComment) : undefined, + encryptedValue: el.secretValue ? Buffer.from(el.secretValue) : undefined, + skipMultilineEncoding: el.skipMultilineEncoding, + key: el.secretKey, + tagIds: el.tagIds, + references: getAllNestedSecretReferences(el.secretValue), + type: SecretType.Shared + })), + folderId, + secretDAL, + secretVersionDAL, + secretTagDAL, + secretVersionTagDAL, + tx + }) + ); + + // await snapshotService.performSnapshot(folderId); + await secretQueueService.syncSecrets({ + actor, + actorId, + secretPath, + projectId, + environmentSlug: folder.environment.slug + }); + + return newSecrets.map((el) => + reshapeBridgeSecret(projectId, environment, secretPath, { + ...el, + // TODO(akhilmhdh-sev2): decryption missiong + value: el.encryptedValue?.toString(), + comment: el.encryptedComment?.toString() + }) + ); + }; + + const updateManySecret = async ({ + actor, + actorId, + actorOrgId, + actorAuthMethod, + environment, + projectId, + secretPath, + secrets: inputSecrets + }: TUpdateManySecretDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Edit, + subject(ProjectPermissionSub.Secrets, { environment, secretPath }) + ); + + const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); + if (!folder) + throw new BadRequestError({ + message: "Folder not found for the given environment slug & secret path", + name: "Update secret" + }); + const folderId = folder.id; + + const secretsToUpdate = await secretDAL.findBySecretKeys( + folderId, + inputSecrets.map((el) => ({ + key: el.secretKey, + type: SecretType.Shared + })) + ); + if (secretsToUpdate.length !== inputSecrets.length) + throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + + // now find any secret that needs to update its name + // same process as above + const secretsWithNewName = inputSecrets.filter(({ newSecretName }) => Boolean(newSecretName)); + if (secretsWithNewName.length) { + const secrets = await secretDAL.findBySecretKeys( + folderId, + secretsWithNewName.map((el) => ({ + key: el.secretKey, + type: SecretType.Shared + })) + ); + if (secrets.length) + throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + } + + // get all tags + const sanitizedTagIds = inputSecrets.flatMap(({ tagIds = [] }) => tagIds); + const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : []; + if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" }); + + const secrets = await secretDAL.transaction(async (tx) => + fnSecretBulkUpdate({ + folderId, + tx, + inputSecrets: inputSecrets.map((el) => ({ + filter: { key: el.secretKey, type: SecretType.Shared }, + data: { + reminderRepeatDays: el.secretReminderRepeatDays, + encryptedComment: el.secretComment ? Buffer.from(el.secretComment) : undefined, + reminderNote: el.secretReminderNote, + skipMultilineEncoding: el.skipMultilineEncoding, + key: el.newSecretName || el.secretKey, + tags: el.tagIds, + ...(el.secretValue + ? { + encryptedValue: Buffer.from(el.secretValue), + references: getAllNestedSecretReferences(el.secretValue) + } + : { + encryptedValue: undefined, + references: undefined + }) + } + })), + secretDAL, + secretVersionDAL, + secretTagDAL, + secretVersionTagDAL + }) + ); + + // await snapshotService.performSnapshot(folderId); + await secretQueueService.syncSecrets({ + actor, + actorId, + secretPath, + projectId, + environmentSlug: folder.environment.slug + }); + + return secrets.map((el) => + reshapeBridgeSecret(projectId, environment, secretPath, { + ...el, + // TODO(akhilmhdh-sev2): decryption missiong + value: el.encryptedValue?.toString(), + comment: el.encryptedComment?.toString() + }) + ); + }; + + const deleteManySecret = async ({ + secrets: inputSecrets, + secretPath, + environment, + projectId, + actor, + actorId, + actorAuthMethod, + actorOrgId + }: TDeleteManySecretDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Delete, + subject(ProjectPermissionSub.Secrets, { environment, secretPath }) + ); + + const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); + if (!folder) + throw new BadRequestError({ + message: "Folder not found for the given environment slug & secret path", + name: "Create secret" + }); + const folderId = folder.id; + + const secretsToDelete = await secretDAL.findBySecretKeys( + folderId, + inputSecrets.map((el) => ({ + key: el.secretKey, + type: SecretType.Shared + })) + ); + if (secretsToDelete.length !== inputSecrets.length) + throw new BadRequestError({ message: `Secret not exist: ${secretsToDelete.map((el) => el.key).join(",")}` }); + + const secretsDeleted = await secretDAL.transaction(async (tx) => + fnSecretBulkDelete({ + secretDAL, + secretQueueService, + inputSecrets: inputSecrets.map(({ type, secretKey }) => ({ + secretKey, + type: type || SecretType.Shared + })), + projectId, + folderId, + actorId, + tx + }) + ); + + // await snapshotService.performSnapshot(folderId); + await secretQueueService.syncSecrets({ + actor, + actorId, + secretPath, + projectId, + environmentSlug: folder.environment.slug + }); + + return secretsDeleted.map((el) => + reshapeBridgeSecret(projectId, environment, secretPath, { + ...el, + // TODO(akhilmhdh-sev2): decryption missiong + value: el.encryptedValue?.toString(), + comment: el.encryptedComment?.toString() + }) + ); + }; + + const getSecretVersions = async ({ + actorId, + actor, + actorOrgId, + actorAuthMethod, + limit = 20, + offset = 0, + secretId + }: TGetSecretVersionsDTO) => { + const secret = await secretDAL.findById(secretId); + if (!secret) throw new BadRequestError({ message: "Failed to find secret" }); + + const folder = await folderDAL.findById(secret.folderId); + if (!folder) throw new BadRequestError({ message: "Failed to find secret" }); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + folder.projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback); + + const secretVersions = await secretVersionDAL.find({ secretId }, { offset, limit, sort: [["createdAt", "desc"]] }); + return secretVersions; + }; + + // this is a backfilling API for secret references + // what it does is it will go through all the secret values and parse all references + // populate the secret reference to do sync integrations + const backfillSecretReferences = async ({ + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod + }: TBackFillSecretReferencesDTO) => { + const { hasRole } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + + if (!hasRole(ProjectMembershipRole.Admin)) + throw new BadRequestError({ message: "Only admins are allowed to take this action" }); + + await secretDAL.transaction(async (tx) => { + const secrets = await secretDAL.findAllProjectSecretValues(projectId, tx); + // TODO(akhilmhdh-sev2): decryption missing + await secretDAL.upsertSecretReferences( + secrets + .filter((el) => Boolean(el.encryptedValue)) + .map(({ id, encryptedValue }) => ({ + secretId: id, + references: getAllNestedSecretReferences(encryptedValue?.toString("utf8")) + })), + tx + ); + }); + + return { message: "Successfully backfilled secret references" }; + }; + + const moveSecrets = async ({ + sourceEnvironment, + sourceSecretPath, + destinationEnvironment, + destinationSecretPath, + secretIds, + projectId, + shouldOverwrite, + actor, + actorId, + actorAuthMethod, + actorOrgId + }: TMoveSecretsDTO) => { + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Delete, + subject(ProjectPermissionSub.Secrets, { environment: sourceEnvironment, secretPath: sourceSecretPath }) + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Create, + subject(ProjectPermissionSub.Secrets, { environment: destinationEnvironment, secretPath: destinationSecretPath }) + ); + + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Edit, + subject(ProjectPermissionSub.Secrets, { environment: destinationEnvironment, secretPath: destinationSecretPath }) + ); + + const sourceFolder = await folderDAL.findBySecretPath(projectId, sourceEnvironment, sourceSecretPath); + if (!sourceFolder) { + throw new NotFoundError({ + message: "Source path does not exist." + }); + } + + const destinationFolder = await folderDAL.findBySecretPath( + projectId, + destinationEnvironment, + destinationSecretPath + ); + + if (!destinationFolder) { + throw new NotFoundError({ + message: "Destination path does not exist." + }); + } + + const sourceSecrets = await secretDAL.find({ + type: SecretType.Shared, + $in: { + id: secretIds + } + }); + + if (sourceSecrets.length !== secretIds.length) { + throw new BadRequestError({ + message: "Invalid secrets" + }); + } + + const decryptedSourceSecrets = sourceSecrets.map((secret) => ({ + ...secret, + // TODO(akhilmhdh-sev2): decryption missiong + value: secret.encryptedValue?.toString() + })); + + let isSourceUpdated = false; + let isDestinationUpdated = false; + + // Moving secrets is a two-step process. + await secretDAL.transaction(async (tx) => { + // First step is to create/update the secret in the destination: + const destinationSecretsFromDB = await secretDAL.find( + { + folderId: destinationFolder.id + }, + { tx } + ); + + const decryptedDestinationSecrets = destinationSecretsFromDB.map((secret) => { + return { + ...secret, + // TODO(akhilmhdh-sev2): decryption missiong + value: secret.encryptedValue?.toString() + }; + }); + + const destinationSecretsGroupedByKey = groupBy(decryptedDestinationSecrets, (i) => i.key); + + const locallyCreatedSecrets = decryptedSourceSecrets + .filter(({ key }) => !destinationSecretsGroupedByKey[key]?.[0]) + .map((el) => ({ ...el, operation: SecretOperations.Create })); + + const locallyUpdatedSecrets = decryptedSourceSecrets + .filter( + ({ key, value }) => + destinationSecretsGroupedByKey[key]?.[0] && destinationSecretsGroupedByKey[key]?.[0]?.value !== value + ) + .map((el) => ({ ...el, operation: SecretOperations.Update })); + + if (locallyUpdatedSecrets.length > 0 && !shouldOverwrite) { + const existingKeys = locallyUpdatedSecrets.map((s) => s.key); + + throw new BadRequestError({ + message: `Failed to move secrets. The following secrets already exist in the destination: ${existingKeys.join( + "," + )}` + }); + } + + const isEmpty = locallyCreatedSecrets.length + locallyUpdatedSecrets.length === 0; + + if (isEmpty) { + throw new BadRequestError({ + message: "Selected secrets already exist in the destination." + }); + } + const destinationFolderPolicy = await secretApprovalPolicyService.getSecretApprovalPolicy( + projectId, + destinationFolder.environment.slug, + destinationFolder.path + ); + + if (destinationFolderPolicy && actor === ActorType.USER) { + // if secret approval policy exists for destination, we create the secret approval request + const localSecretsIds = decryptedDestinationSecrets.map(({ id }) => id); + const latestSecretVersions = await secretVersionDAL.findLatestVersionMany( + destinationFolder.id, + localSecretsIds, + tx + ); + + const approvalRequestDoc = await secretApprovalRequestDAL.create( + { + folderId: destinationFolder.id, + slug: alphaNumericNanoId(), + policyId: destinationFolderPolicy.id, + status: "open", + hasMerged: false, + committerUserId: actorId + }, + tx + ); + + // TODO(akhilmhdh-sev2): fix this + // const commits = locallyCreatedSecrets.concat(locallyUpdatedSecrets).map((doc) => { + // const { operation } = doc; + // const localSecret = destinationSecretsGroupedByKey[doc.key]?.[0]; + // + // return { + // op: operation, + // requestId: approvalRequestDoc.id, + // metadata: doc.metadata, + // secretKeyIV: doc.secretKeyIV, + // secretKeyTag: doc.secretKeyTag, + // secretKeyCiphertext: doc.secretKeyCiphertext, + // secretValueIV: doc.secretValueIV, + // secretValueTag: doc.secretValueTag, + // secretValueCiphertext: doc.secretValueCiphertext, + // secretBlindIndex: doc.secretBlindIndex, + // secretCommentIV: doc.secretCommentIV, + // secretCommentTag: doc.secretCommentTag, + // secretCommentCiphertext: doc.secretCommentCiphertext, + // skipMultilineEncoding: doc.skipMultilineEncoding, + // // except create operation other two needs the secret id and version id + // ...(operation !== SecretOperations.Create + // ? { secretId: localSecret.id, secretVersion: latestSecretVersions[localSecret.id].id } + // : {}) + // }; + // }); + await secretApprovalRequestSecretDAL.insertMany([], tx); + } else { + // apply changes directly + if (locallyCreatedSecrets.length) { + await fnSecretBulkInsert({ + folderId: destinationFolder.id, + secretVersionDAL, + secretDAL, + tx, + secretTagDAL, + secretVersionTagDAL, + inputSecrets: locallyCreatedSecrets.map((doc) => { + return { + type: doc.type, + metadata: doc.metadata, + key: doc.key, + encryptedValue: doc.encryptedValue ? Buffer.from(doc.encryptedValue) : undefined, + encryptedComment: doc.encryptedComment ? Buffer.from(doc.encryptedComment) : undefined, + skipMultilineEncoding: doc.skipMultilineEncoding, + reminderNote: doc.reminderNote, + reminderRepeatDays: doc.reminderRepeatDays, + references: doc.value ? getAllNestedSecretReferences(doc.value) : [] + }; + }) + }); + } + if (locallyUpdatedSecrets.length) { + await fnSecretBulkUpdate({ + folderId: destinationFolder.id, + secretVersionDAL, + secretDAL, + tx, + secretTagDAL, + secretVersionTagDAL, + inputSecrets: locallyUpdatedSecrets.map((doc) => { + return { + filter: { + folderId: destinationFolder.id, + id: destinationSecretsGroupedByKey[doc.key][0].id + }, + data: { + metadata: doc.metadata, + key: doc.key, + encryptedComment: doc.encryptedComment, + skipMultilineEncoding: doc.skipMultilineEncoding, + reminderNote: doc.reminderNote, + reminderRepeatDays: doc.reminderRepeatDays, + ...(doc.encryptedValue + ? { + encryptedValue: doc.encryptedValue, + // TODO(akhilmhdh-sev2): fix decryption + references: getAllNestedSecretReferences(doc.encryptedValue.toString()) + } + : { + encryptedValue: undefined, + references: undefined + }) + } + }; + }) + }); + } + + isDestinationUpdated = true; + } + + // Next step is to delete the secrets from the source folder: + const sourceSecretsGroupByKey = groupBy(sourceSecrets, (i) => i.key); + const locallyDeletedSecrets = decryptedSourceSecrets.map((el) => ({ ...el, operation: SecretOperations.Delete })); + + const sourceFolderPolicy = await secretApprovalPolicyService.getSecretApprovalPolicy( + projectId, + sourceFolder.environment.slug, + sourceFolder.path + ); + + if (sourceFolderPolicy && actor === ActorType.USER) { + // if secret approval policy exists for source, we create the secret approval request + const localSecretsIds = decryptedSourceSecrets.map(({ id }) => id); + const latestSecretVersions = await secretVersionDAL.findLatestVersionMany(sourceFolder.id, localSecretsIds, tx); + const approvalRequestDoc = await secretApprovalRequestDAL.create( + { + folderId: sourceFolder.id, + slug: alphaNumericNanoId(), + policyId: sourceFolderPolicy.id, + status: "open", + hasMerged: false, + committerUserId: actorId + }, + tx + ); + + // TODO(akhilmhdh-sev2): finish this + // const commits = locallyDeletedSecrets.map((doc) => { + // const { operation } = doc; + // const localSecret = sourceSecretsGroupByKey[doc.key]?.[0]; + // + // return { + // op: operation, + // keyEncoding: doc.keyEncoding, + // algorithm: doc.algorithm, + // requestId: approvalRequestDoc.id, + // metadata: doc.metadata, + // secretKeyIV: doc.secretKeyIV, + // secretKeyTag: doc.secretKeyTag, + // secretKeyCiphertext: doc.secretKeyCiphertext, + // secretValueIV: doc.secretValueIV, + // secretValueTag: doc.secretValueTag, + // secretValueCiphertext: doc.secretValueCiphertext, + // secretBlindIndex: doc.secretBlindIndex, + // secretCommentIV: doc.secretCommentIV, + // secretCommentTag: doc.secretCommentTag, + // secretCommentCiphertext: doc.secretCommentCiphertext, + // skipMultilineEncoding: doc.skipMultilineEncoding, + // secretId: localSecret.id, + // secretVersion: latestSecretVersions[localSecret.id].id + // }; + // }); + + await secretApprovalRequestSecretDAL.insertMany([], tx); + } else { + // if no secret approval policy is present, we delete directly. + await secretDAL.delete( + { + $in: { + id: locallyDeletedSecrets.map(({ id }) => id) + }, + folderId: sourceFolder.id + }, + tx + ); + + isSourceUpdated = true; + } + }); + + if (isDestinationUpdated) { + // await snapshotService.performSnapshot(destinationFolder.id); + await secretQueueService.syncSecrets({ + projectId, + secretPath: destinationFolder.path, + environmentSlug: destinationFolder.environment.slug, + actorId, + actor + }); + } + + if (isSourceUpdated) { + // await snapshotService.performSnapshot(sourceFolder.id); + await secretQueueService.syncSecrets({ + projectId, + secretPath: sourceFolder.path, + environmentSlug: sourceFolder.environment.slug, + actorId, + actor + }); + } + + return { + projectId, + isSourceUpdated, + isDestinationUpdated + }; + }; + + return { + createSecret, + deleteSecret, + updateSecret, + createManySecret, + updateManySecret, + deleteManySecret, + getSecretByName, + getSecrets, + getSecretVersions, + backfillSecretReferences, + moveSecrets + }; +}; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts new file mode 100644 index 000000000..1964aac05 --- /dev/null +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts @@ -0,0 +1,267 @@ +import { Knex } from "knex"; + +import { SecretType, TSecretsV2, TSecretsV2Insert, TSecretsV2Update } from "@app/db/schemas"; +import { TProjectPermission } from "@app/lib/types"; +import { TProjectDALFactory } from "@app/services/project/project-dal"; +import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; +import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; + +import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "./secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "./secret-version-tag-dal"; + +type TPartialSecret = Pick; + +type TPartialInputSecret = Pick; + +export type TGetSecretsDTO = { + expandSecretReferences?: boolean; + path: string; + environment: string; + includeImports?: boolean; + recursive?: boolean; +} & TProjectPermission; + +export type TGetASecretDTO = { + secretName: string; + path: string; + environment: string; + expandSecretReferences?: boolean; + type: "shared" | "personal"; + includeImports?: boolean; + version?: number; + projectId: string; +} & Omit; + +export type TCreateSecretDTO = TProjectPermission & { + secretName: string; + secretPath: string; + environment: string; + secretValue: string; + type: SecretType; + tagIds?: string[]; + secretComment?: string; + skipMultilineEncoding?: boolean; + secretReminderRepeatDays?: number | null; + secretReminderNote?: string | null; +}; + +export type TUpdateSecretDTO = TProjectPermission & { + secretPath: string; + environment: string; + secretName: string; + secretValue?: string; + newSecretName?: string; + secretComment?: string; + type: SecretType; + tagIds?: string[]; + skipMultilineEncoding?: boolean; + secretReminderRepeatDays?: number | null; + secretReminderNote?: string | null; + metadata?: { + source?: string; + }; +}; + +export type TDeleteSecretDTO = TProjectPermission & { + secretPath: string; + environment: string; + secretName: string; + type: SecretType; +}; + +export type TCreateManySecretDTO = Omit & { + secretPath: string; + projectId: string; + environment: string; + secrets: { + secretKey: string; + secretValue: string; + secretComment?: string; + skipMultilineEncoding?: boolean; + tagIds?: string[]; + metadata?: { + source?: string; + }; + }[]; +}; + +export type TUpdateManySecretDTO = Omit & { + secretPath: string; + projectId: string; + environment: string; + secrets: { + secretKey: string; + newSecretName?: string; + secretValue: string; + secretComment?: string; + skipMultilineEncoding?: boolean; + tagIds?: string[]; + secretReminderRepeatDays?: number | null; + secretReminderNote?: string | null; + }[]; +}; + +export type TDeleteManySecretDTO = Omit & { + secretPath: string; + projectId: string; + environment: string; + secrets: { + secretKey: string; + type?: SecretType; + }[]; +}; + +export type TGetSecretVersionsDTO = Omit & { + limit?: number; + offset?: number; + secretId: string; +}; + +export type TSecretReference = { environment: string; secretPath: string; secretKey: string }; + +export type TFnSecretBulkInsert = { + folderId: string; + tx?: Knex; + inputSecrets: Array & { tagIds?: string[]; references: TSecretReference[] }>; + secretDAL: Pick; + secretVersionDAL: Pick; + secretTagDAL: Pick; + secretVersionTagDAL: Pick; +}; + +type TRequireReferenceIfValue = + | (Omit & { + encryptedValue: Buffer | null; + references: TSecretReference[]; + }) + | (Omit & { + encryptedValue?: never; + references?: never; + }); + +export type TFnSecretBulkUpdate = { + folderId: string; + inputSecrets: { + filter: Partial; + data: TRequireReferenceIfValue & { tags?: string[] }; + }[]; + secretDAL: Pick; + secretVersionDAL: Pick; + secretTagDAL: Pick; + secretVersionTagDAL: Pick; + tx?: Knex; +}; + +export type TFnSecretBulkDelete = { + folderId: string; + projectId: string; + inputSecrets: Array<{ type: SecretType; secretKey: string }>; + actorId: string; + tx?: Knex; + secretDAL: Pick; + secretQueueService: { + removeSecretReminder: (data: TRemoveSecretReminderDTO) => Promise; + }; +}; + +export type THandleReminderDTO = { + newSecret: TPartialInputSecret; + oldSecret: TPartialSecret; + projectId: string; +}; + +export type TCreateSecretReminderDTO = { + oldSecret: TPartialSecret; + newSecret: TPartialSecret; + projectId: string; +}; + +export type TRemoveSecretReminderDTO = { + secretId: string; + repeatDays: number; +}; + +export type TBackFillSecretReferencesDTO = TProjectPermission; + +export type TCreateManySecretsFnFactory = { + projectDAL: TProjectDALFactory; + secretDAL: TSecretV2BridgeDALFactory; + secretVersionDAL: TSecretVersionV2DALFactory; + secretTagDAL: TSecretTagDALFactory; + secretVersionTagDAL: TSecretVersionV2TagDALFactory; + folderDAL: TSecretFolderDALFactory; +}; + +export type TCreateManySecretsFn = { + projectId: string; + environment: string; + path: string; + secrets: { + secretName: string; + secretValue: string; + type: SecretType; + secretComment?: string; + skipMultilineEncoding?: boolean; + tags?: string[]; + metadata?: { + source?: string; + }; + }[]; + userId?: string; // only relevant for personal secret(s) +}; + +export type TUpdateManySecretsFnFactory = { + projectDAL: TProjectDALFactory; + secretDAL: TSecretV2BridgeDALFactory; + secretVersionDAL: TSecretVersionV2DALFactory; + secretTagDAL: TSecretTagDALFactory; + secretVersionTagDAL: TSecretVersionV2TagDALFactory; + folderDAL: TSecretFolderDALFactory; +}; + +export type TUpdateManySecretsFn = { + projectId: string; + environment: string; + path: string; + secrets: { + secretName: string; + newSecretName?: string; + secretValue: string; + type: SecretType; + secretComment?: string; + skipMultilineEncoding?: boolean; + secretReminderRepeatDays?: number | null; + secretReminderNote?: string | null; + tags?: string[]; + metadata?: { + source?: string; + }; + }[]; + userId?: string; +}; + +export enum SecretOperations { + Create = "create", + Update = "update", + Delete = "delete" +} + +export type TMoveSecretsDTO = { + projectId: string; + sourceEnvironment: string; + sourceSecretPath: string; + destinationEnvironment: string; + destinationSecretPath: string; + secretIds: string[]; + shouldOverwrite: boolean; +} & Omit; + +export type TAttachSecretTagsDTO = { + projectId: string; + secretName: string; + tagSlugs: string[]; + environment: string; + secretPath: string; + type: SecretType; +} & Omit; diff --git a/backend/src/services/secret-v2-bridge/secret-version-dal.ts b/backend/src/services/secret-v2-bridge/secret-version-dal.ts new file mode 100644 index 000000000..e4922a57d --- /dev/null +++ b/backend/src/services/secret-v2-bridge/secret-version-dal.ts @@ -0,0 +1,124 @@ +import { Knex } from "knex"; + +import { TDbClient } from "@app/db"; +import { TableName, TSecretVersionsV2, TSecretVersionsV2Update } from "@app/db/schemas"; +import { BadRequestError, DatabaseError } from "@app/lib/errors"; +import { ormify, selectAllTableCols } from "@app/lib/knex"; + +export type TSecretVersionV2DALFactory = ReturnType; + +export const secretVersionV2BridgeDALFactory = (db: TDbClient) => { + const secretVersionV2Orm = ormify(db, TableName.SecretVersionV2); + + // This will fetch all latest secret versions from a folder + const findLatestVersionByFolderId = async (folderId: string, tx?: Knex) => { + try { + const docs = await (tx || db.replicaNode())(TableName.SecretVersionV2) + .where(`${TableName.SecretVersionV2}.folderId`, folderId) + .join(TableName.SecretV2, `${TableName.SecretV2}.id`, `${TableName.SecretVersionV2}.secretId`) + .join( + (tx || db)(TableName.SecretVersionV2) + .groupBy("folderId", "secretId") + .max("version") + .select("secretId") + .as("latestVersion"), + (bd) => { + bd.on(`${TableName.SecretVersionV2}.secretId`, "latestVersion.secretId").andOn( + `${TableName.SecretVersionV2}.version`, + "latestVersion.max" + ); + } + ) + .select(selectAllTableCols(TableName.SecretVersionV2)); + return docs; + } catch (error) { + throw new DatabaseError({ error, name: "FindLatestVersionByFolderId" }); + } + }; + + const bulkUpdate = async ( + data: Array<{ filter: Partial; data: TSecretVersionsV2Update }>, + tx?: Knex + ) => { + try { + const secs = await Promise.all( + data.map(async ({ filter, data: updateData }) => { + const [doc] = await (tx || db)(TableName.SecretVersionV2) + .where(filter) + .update(updateData) + .increment("version", 1) // TODO: Is this really needed? + .returning("*"); + if (!doc) throw new BadRequestError({ message: "Failed to update document" }); + return doc; + }) + ); + return secs; + } catch (error) { + throw new DatabaseError({ error, name: "bulk update secret" }); + } + }; + + const findLatestVersionMany = async (folderId: string, secretIds: string[], tx?: Knex) => { + try { + if (!secretIds.length) return {}; + const docs: Array = await (tx || db.replicaNode())(TableName.SecretVersionV2) + .where("folderId", folderId) + .whereIn(`${TableName.SecretVersionV2}.secretId`, secretIds) + .join( + (tx || db)(TableName.SecretVersionV2) + .groupBy("secretId") + .max("version") + .select("secretId") + .as("latestVersion"), + (bd) => { + bd.on(`${TableName.SecretVersionV2}.secretId`, "latestVersion.secretId").andOn( + `${TableName.SecretVersionV2}.version`, + "latestVersion.max" + ); + } + ); + return docs.reduce>( + (prev, curr) => ({ ...prev, [curr.secretId || ""]: curr }), + {} + ); + } catch (error) { + throw new DatabaseError({ error, name: "FindLatestVersinMany" }); + } + }; + + const pruneExcessVersions = async () => { + try { + await db(TableName.SecretVersionV2) + .with("version_cte", (qb) => { + void qb + .from(TableName.SecretVersionV2) + .select( + "id", + "folderId", + db.raw( + `ROW_NUMBER() OVER (PARTITION BY ${TableName.SecretVersionV2}."secretId" ORDER BY ${TableName.SecretVersionV2}."createdAt" DESC) AS row_num` + ) + ); + }) + .join(TableName.SecretFolder, `${TableName.SecretFolder}.id`, `${TableName.SecretVersionV2}.folderId`) + .join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.SecretFolder}.envId`) + .join(TableName.Project, `${TableName.Project}.id`, `${TableName.Environment}.projectId`) + .join("version_cte", "version_cte.id", `${TableName.SecretVersionV2}.id`) + .whereRaw(`version_cte.row_num > ${TableName.Project}."pitVersionLimit"`) + .delete(); + } catch (error) { + throw new DatabaseError({ + error, + name: "Secret Version Prune" + }); + } + }; + + return { + ...secretVersionV2Orm, + pruneExcessVersions, + findLatestVersionMany, + bulkUpdate, + findLatestVersionByFolderId + }; +}; diff --git a/backend/src/services/secret-v2-bridge/secret-version-tag-dal.ts b/backend/src/services/secret-v2-bridge/secret-version-tag-dal.ts new file mode 100644 index 000000000..f1a3531e9 --- /dev/null +++ b/backend/src/services/secret-v2-bridge/secret-version-tag-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TSecretVersionV2TagDALFactory = ReturnType; + +export const secretVersionV2TagBridgeDALFactory = (db: TDbClient) => { + const secretVersionTagDAL = ormify(db, TableName.SecretVersionV2Tag); + return secretVersionTagDAL; +}; diff --git a/backend/src/services/secret/secret-dal.ts b/backend/src/services/secret/secret-dal.ts index c26880e38..aac01d393 100644 --- a/backend/src/services/secret/secret-dal.ts +++ b/backend/src/services/secret/secret-dal.ts @@ -20,8 +20,6 @@ export const secretDALFactory = (db: TDbClient) => { } }; - // the idea is to use postgres specific function - // insert with id this will cause a conflict then merge the data const bulkUpdate = async ( data: Array<{ filter: Partial; data: TSecretsUpdate }>, diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index 419a41b10..d4ec6cc08 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -689,7 +689,7 @@ export const createManySecretsRawFnFactory = ({ secrets, userId }: TCreateManySecretsRawFn) => { - const botKey = await getBotKeyFn(projectId); + const { botKey } = await getBotKeyFn(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); await projectDAL.checkProjectUpgradeStatus(projectId); @@ -787,7 +787,7 @@ export const updateManySecretsRawFnFactory = ({ secrets, // consider accepting instead ciphertext secrets userId }: TUpdateManySecretsRawFn): Promise> => { - const botKey = await getBotKeyFn(projectId); + const { botKey } = await getBotKeyFn(projectId); if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); await projectDAL.checkProjectUpgradeStatus(projectId); diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 39b9ea332..ade727c99 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -35,6 +35,7 @@ import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TSecretImportDALFactory } from "../secret-import/secret-import-dal"; import { fnSecretsFromImports } from "../secret-import/secret-import-fns"; import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal"; +import { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bridge-service"; import { TSecretDALFactory } from "./secret-dal"; import { decryptSecretRaw, @@ -83,6 +84,7 @@ type TSecretServiceFactoryDep = { TSecretFolderDALFactory, "findBySecretPath" | "updateById" | "findById" | "findByManySecretPath" | "find" >; + secretV2BridgeService: TSecretV2BridgeServiceFactory; secretBlindIndexDAL: TSecretBlindIndexDALFactory; permissionService: Pick; snapshotService: Pick; @@ -115,19 +117,20 @@ export const secretServiceFactory = ({ secretVersionTagDAL, secretApprovalPolicyService, secretApprovalRequestDAL, - secretApprovalRequestSecretDAL + secretApprovalRequestSecretDAL, + secretV2BridgeService }: TSecretServiceFactoryDep) => { const getSecretReference = async (projectId: string) => { // if bot key missing means e2e still exist - const botKey = await projectBotService.getBotKey(projectId).catch(() => null); + const projectBot = await projectBotService.getBotKey(projectId).catch(() => null); return (el: { ciphertext?: string; iv: string; tag: string }) => - botKey + projectBot?.botKey ? getAllNestedSecretReferences( decryptSymmetric128BitHexKeyUTF8({ ciphertext: el.ciphertext || "", iv: el.iv, tag: el.tag, - key: botKey + key: projectBot.botKey }) ) : undefined; @@ -951,7 +954,23 @@ export const secretServiceFactory = ({ expandSecretReferences, recursive }: TGetSecretsRawDTO) => { - const botKey = await projectBotService.getBotKey(projectId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const { secrets, imports } = await secretV2BridgeService.getSecrets({ + projectId, + expandSecretReferences, + actorId, + actor, + actorOrgId, + environment, + path, + recursive, + actorAuthMethod, + includeImports + }); + return { secrets, imports }; + } + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const { secrets, imports } = await getSecrets({ @@ -1103,9 +1122,23 @@ export const secretServiceFactory = ({ version }: TGetASecretRawDTO) => { const projectId = workspaceId || (await projectDAL.findProjectBySlug(projectSlug as string, actorOrgId)).id; - - const botKey = await projectBotService.getBotKey(projectId); - if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const secret = await secretV2BridgeService.getSecretByName({ + environment, + projectId, + includeImports, + actorAuthMethod, + path, + actorOrgId, + actor, + actorId, + expandSecretReferences, + type, + secretName + }); + return secret; + } const encryptedSecret = await getSecretByName({ actorId, @@ -1121,6 +1154,8 @@ export const secretServiceFactory = ({ version }); + if (!botKey) + throw new BadRequestError({ message: "Please upgrade your project first", name: "bot_not_found_error" }); const decryptedSecret = decryptSecretRaw(encryptedSecret, botKey); if (expandSecretReferences) { @@ -1180,9 +1215,29 @@ export const secretServiceFactory = ({ secretReminderNote, secretReminderRepeatDays }: TCreateSecretRawDTO) => { - const botKey = await projectBotService.getBotKey(projectId); - if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const secret = await secretV2BridgeService.createSecret({ + secretName, + type, + actorId, + actor, + actorOrgId, + actorAuthMethod, + projectId, + environment, + secretPath, + secretComment, + secretValue, + tagIds, + secretReminderNote, + skipMultilineEncoding, + secretReminderRepeatDays + }); + return secret; + } + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretName, botKey); const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); @@ -1234,7 +1289,30 @@ export const secretServiceFactory = ({ secretComment, newSecretName }: TUpdateSecretRawDTO) => { - const botKey = await projectBotService.getBotKey(projectId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const secret = await secretV2BridgeService.updateSecret({ + secretReminderRepeatDays, + skipMultilineEncoding, + secretReminderNote, + tagIds, + secretComment, + secretPath, + environment, + projectId, + actorAuthMethod, + actorOrgId, + actor, + actorId, + type, + secretName, + newSecretName, + metadata, + secretValue + }); + return secret; + } + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); @@ -1283,7 +1361,21 @@ export const secretServiceFactory = ({ type, secretPath }: TDeleteSecretRawDTO) => { - const botKey = await projectBotService.getBotKey(projectId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const secret = await secretV2BridgeService.deleteSecret({ + secretName, + type, + actorId, + actor, + actorOrgId, + actorAuthMethod, + projectId, + environment, + secretPath + }); + return secret; + } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const secret = await deleteSecret({ @@ -1323,7 +1415,20 @@ export const secretServiceFactory = ({ projectId = project.id; } - const botKey = await projectBotService.getBotKey(projectId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const secrets = await secretV2BridgeService.createManySecret({ + secretPath, + environment, + projectId, + actorAuthMethod, + actorOrgId, + actor, + actorId, + secrets: inputSecrets + }); + return secrets; + } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const secrets = await createManySecret({ @@ -1384,7 +1489,21 @@ export const secretServiceFactory = ({ projectId = project.id; } - const botKey = await projectBotService.getBotKey(projectId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const secrets = await secretV2BridgeService.updateManySecret({ + secretPath, + environment, + projectId, + actorAuthMethod, + actorOrgId, + actor, + actorId, + secrets: inputSecrets + }); + return secrets; + } + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const secrets = await updateManySecret({ @@ -1457,7 +1576,21 @@ export const secretServiceFactory = ({ projectId = project.id; } - const botKey = await projectBotService.getBotKey(projectId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const secrets = await secretV2BridgeService.deleteManySecret({ + secretPath, + environment, + projectId, + actorAuthMethod, + actorOrgId, + actor, + actorId, + secrets: inputSecrets + }); + return secrets; + } + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const secrets = await deleteManySecret({ @@ -1517,7 +1650,6 @@ export const secretServiceFactory = ({ actorId }: TAttachSecretTagsDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - const { permission } = await permissionService.getProjectPermission( actor, actorId, @@ -1620,7 +1752,6 @@ export const secretServiceFactory = ({ actorId }: TAttachSecretTagsDTO) => { const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId); - const { permission } = await permissionService.getProjectPermission( actor, actorId, @@ -1735,7 +1866,17 @@ export const secretServiceFactory = ({ if (!hasRole(ProjectMembershipRole.Admin)) throw new BadRequestError({ message: "Only admins are allowed to take this action" }); - const botKey = await projectBotService.getBotKey(projectId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + return secretV2BridgeService.backfillSecretReferences({ + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod + }); + } + if (!botKey) throw new BadRequestError({ message: "Please upgrade your project first", name: "bot_not_found_error" }); @@ -1779,6 +1920,21 @@ export const secretServiceFactory = ({ message: "Project not found." }); } + if (project.version === 3) { + return secretV2BridgeService.moveSecrets({ + sourceEnvironment, + sourceSecretPath, + destinationEnvironment, + destinationSecretPath, + secretIds, + projectId: project.id, + shouldOverwrite, + actor, + actorId, + actorAuthMethod, + actorOrgId + }); + } const { permission } = await permissionService.getProjectPermission( actor, @@ -1803,7 +1959,7 @@ export const secretServiceFactory = ({ subject(ProjectPermissionSub.Secrets, { environment: destinationEnvironment, secretPath: destinationSecretPath }) ); - const botKey = await projectBotService.getBotKey(project.id); + const { botKey } = await projectBotService.getBotKey(project.id); if (!botKey) { throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); } From 8eab27d7521a93475e302009733d652c1bb7b96f Mon Sep 17 00:00:00 2001 From: = Date: Thu, 18 Jul 2024 13:01:58 +0530 Subject: [PATCH 38/77] feat: added kms encryption and decryption secret bridge --- .../secret-import/secret-import-fns.ts | 11 +- .../secret-v2-bridge/secret-v2-bridge-fns.ts | 2 +- .../secret-v2-bridge-service.ts | 203 +++++++++++------- 3 files changed, 130 insertions(+), 86 deletions(-) diff --git a/backend/src/services/secret-import/secret-import-fns.ts b/backend/src/services/secret-import/secret-import-fns.ts index 147347e25..eb6a94bf5 100644 --- a/backend/src/services/secret-import/secret-import-fns.ts +++ b/backend/src/services/secret-import/secret-import-fns.ts @@ -145,7 +145,8 @@ export const fnSecretsV2FromImports = async ({ secretDAL, secretImportDAL, depth = 0, - cyclicDetector = new Set() + cyclicDetector = new Set(), + decryptor }: { allowedImports: (Omit & { importEnv: { id: string; slug: string; name: string }; @@ -155,6 +156,7 @@ export const fnSecretsV2FromImports = async ({ secretImportDAL: Pick; depth?: number; cyclicDetector?: Set; + decryptor: (value?: Buffer | null) => string | undefined; }) => { // avoid going more than a depth if (depth >= LEVEL_BREAK) return []; @@ -203,7 +205,8 @@ export const fnSecretsV2FromImports = async ({ folderDAL, secretDAL, depth: depth + 1, - cyclicDetector + cyclicDetector, + decryptor }); } const secretsFromdeeperImportGroupedByFolderId = groupBy(secretsFromDeeperImports, (i) => i.importFolderId); @@ -224,8 +227,8 @@ export const fnSecretsV2FromImports = async ({ .map((item) => ({ ...item, secretKey: item.key, - secretValue: item.encryptedValue?.toString(), - secretComment: item.encryptedComment?.toString(), + secretValue: decryptor(item.encryptedValue), + secretComment: decryptor(item.encryptedComment), environment: importEnv.slug, workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend. _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend. diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts index 200791382..1dca5b28d 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts @@ -365,7 +365,7 @@ export const recursivelyGetSecretPaths = async ({ type TInterpolateSecretArg = { projectId: string; - decryptSecret: (encryptedValue?: Buffer | null) => string; + decryptSecret: (encryptedValue?: Buffer | null) => string | undefined; secretDAL: Pick; folderDAL: Pick; }; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 5d94d4930..4c7d18c81 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -44,10 +44,16 @@ import { } from "./secret-v2-bridge-types"; import { TSecretVersionV2DALFactory } from "./secret-version-dal"; import { TSecretVersionV2TagDALFactory } from "./secret-version-tag-dal"; +import { TKmsServiceFactory } from "../kms/kms-service"; +import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service"; type TSecretV2BridgeServiceFactoryDep = { secretDAL: TSecretV2BridgeDALFactory; secretVersionDAL: TSecretVersionV2DALFactory; + kmsService: Pick< + TKmsServiceFactory, + "getProjectSecretManagerKmsDataKey" | "encryptWithInputKey" | "decryptWithInputKey" + >; secretVersionTagDAL: Pick; secretTagDAL: TSecretTagDALFactory; permissionService: Pick; @@ -64,10 +70,22 @@ type TSecretV2BridgeServiceFactoryDep = { TSecretApprovalRequestSecretDALFactory, "insertMany" | "insertApprovalSecretTags" >; + snapshotService: Pick; }; export type TSecretV2BridgeServiceFactory = ReturnType; +const encryptionHelper = { + encryptValue: (encryptor: Awaited>, value?: string) => { + if (typeof value === "undefined") return; + return encryptor({ plainText: Buffer.from(value) }).cipherTextBlob; + }, + decryptValue: (decryptor: Awaited>, value?: Buffer | null) => { + if (!value) return; + return decryptor({ cipherTextBlob: value }).toString(); + } +}; + /* * This service is a bridge from our old architecture towards the new architecture */ @@ -84,7 +102,8 @@ export const secretV2BridgeServiceFactory = ({ secretVersionTagDAL, secretApprovalPolicyService, secretApprovalRequestDAL, - secretApprovalRequestSecretDAL + secretApprovalRequestSecretDAL, + kmsService }: TSecretV2BridgeServiceFactoryDep) => { const createSecret = async ({ actor, @@ -141,6 +160,9 @@ export const secretV2BridgeServiceFactory = ({ const { secretName, type, ...el } = inputSecret; const references = getAllNestedSecretReferences(inputSecret.secretValue); + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const secret = await secretDAL.transaction((tx) => fnSecretBulkInsert({ folderId, @@ -149,8 +171,8 @@ export const secretV2BridgeServiceFactory = ({ version: 1, type, reminderRepeatDays: el.secretReminderRepeatDays, - encryptedComment: el.secretComment ? Buffer.from(el.secretComment) : undefined, - encryptedValue: el.secretValue ? Buffer.from(el.secretValue) : undefined, + encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), + encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue), reminderNote: el.secretReminderNote, skipMultilineEncoding: el.skipMultilineEncoding, key: secretName, @@ -167,7 +189,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - // await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ secretPath, actorId, @@ -264,6 +286,16 @@ export const secretV2BridgeServiceFactory = ({ const { secretName, secretValue, secretComment } = inputSecret; + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const encryptedValue = + typeof secretValue !== "undefined" + ? { + encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, secretValue) as Buffer, + references: getAllNestedSecretReferences(secretValue) + } + : {}; + const updatedSecret = await secretDAL.transaction(async (tx) => fnSecretBulkUpdate({ folderId, @@ -272,20 +304,12 @@ export const secretV2BridgeServiceFactory = ({ filter: { id: secretId }, data: { reminderRepeatDays: inputSecret.secretReminderRepeatDays, - encryptedComment: secretComment ? Buffer.from(secretComment) : undefined, + encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, secretComment), reminderNote: inputSecret.secretReminderNote, skipMultilineEncoding: inputSecret.skipMultilineEncoding, key: inputSecret.newSecretName || secretName, tags: inputSecret.tagIds, - ...(secretValue - ? { - encryptedValue: Buffer.from(secretValue), - references: getAllNestedSecretReferences(secretValue) - } - : { - encryptedValue: undefined, - references: undefined - }) + ...encryptedValue } } ], @@ -305,7 +329,7 @@ export const secretV2BridgeServiceFactory = ({ projectId }); - // await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ actor, actorId, @@ -315,9 +339,8 @@ export const secretV2BridgeServiceFactory = ({ }); return reshapeBridgeSecret(projectId, environment, secretPath, { ...updatedSecret[0], - // TODO(akhilmhdh-sev2): fix this - value: updatedSecret[0].encryptedValue?.toString(), - comment: updatedSecret[0].encryptedComment?.toString() + value: inputSecret.secretValue, + comment: inputSecret.secretComment }); }; @@ -372,7 +395,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - // await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ actor, actorId, @@ -380,11 +403,13 @@ export const secretV2BridgeServiceFactory = ({ projectId, environmentSlug: folder.environment.slug }); + + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); return reshapeBridgeSecret(projectId, environment, secretPath, { ...deletedSecret[0], - // TODO(akhilmhdh-sev2): fix this - value: deletedSecret[0].encryptedValue?.toString(), - comment: deletedSecret[0].encryptedComment?.toString() + value: encryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedValue), + comment: encryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedComment) }); }; @@ -448,6 +473,9 @@ export const secretV2BridgeServiceFactory = ({ actorId ); + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + if (includeImports) { const secretImports = await secretImportDAL.findByFolderIds(paths.map((p) => p.folderId)); const allowedImports = secretImports.filter(({ importEnv, importPath, isReplication }) => @@ -467,16 +495,16 @@ export const secretV2BridgeServiceFactory = ({ allowedImports, secretDAL, folderDAL, - secretImportDAL + secretImportDAL, + decryptor: (value) => encryptionHelper.decryptValue(secretManagerDecryptor, value) }); return { secrets: secrets.map((secret) => reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, { ...secret, - // TODO(akhilmhdh-sev2): decryption missiong - value: secret.encryptedValue?.toString(), - comment: secret.encryptedComment?.toString() + value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue), + comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) }) ), imports: importedSecrets @@ -487,9 +515,8 @@ export const secretV2BridgeServiceFactory = ({ secrets: secrets.map((secret) => reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, { ...secret, - // TODO(akhilmhdh-sev2): decrypt this - value: secret.encryptedValue?.toString(), - comment: secret.encryptedComment?.toString() + value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue), + comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) }) ) }; @@ -536,6 +563,9 @@ export const secretV2BridgeServiceFactory = ({ secretType = SecretType.Shared; } + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const secret = await (version === undefined ? secretDAL.findOneWithTags({ folderId, @@ -551,13 +581,13 @@ export const secretV2BridgeServiceFactory = ({ key: secretName }) .then((el) => SecretsV2Schema.parse({ ...el, id: el.secretId }))); - // TODO(akhilmhdh-sev2): resolve this decryptSecret const interpolateInlineSecretReference = interpolateSecrets({ projectId, - decryptSecret: () => "", + decryptSecret: (encryptedValue) => encryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue), secretDAL, folderDAL }); + // now if secret is not found // then search for imported secrets // here we consider the import order also thus starting from bottom @@ -579,13 +609,15 @@ export const secretV2BridgeServiceFactory = ({ allowedImports, secretDAL, folderDAL, - secretImportDAL + secretImportDAL, + decryptor: (value) => encryptionHelper.decryptValue(secretManagerDecryptor, value) }); + for (let i = importedSecrets.length - 1; i >= 0; i -= 1) { for (let j = 0; j < importedSecrets[i].secrets.length; j += 1) { if (secretName === importedSecrets[i].secrets[j].key) { const importedSecret = importedSecrets[i].secrets[j]; - let secretValue = importedSecret.encryptedValue ? importedSecret.encryptedValue.toString() : undefined; + let secretValue = encryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedValue); if (expandSecretReferences && secretValue) { const secretReferenceExpandedString = { [importedSecret.key]: { value: secretValue } @@ -595,11 +627,10 @@ export const secretV2BridgeServiceFactory = ({ secretValue = secretReferenceExpandedString[importedSecret.key].value; } - // TODO(akhilmhdh-sev2): decrypt this return reshapeBridgeSecret(projectId, importedSecrets[i].environment, importedSecrets[i].secretPath, { ...importedSecret, value: secretValue, - comment: importedSecret.encryptedComment?.toString() + comment: encryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedComment) }); } } @@ -607,7 +638,7 @@ export const secretV2BridgeServiceFactory = ({ } if (!secret) throw new BadRequestError({ message: "Secret not found" }); - let secretValue = secret.encryptedValue ? secret.encryptedValue.toString() : undefined; + let secretValue = encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue); if (expandSecretReferences && secretValue) { const secretReferenceExpandedString = { [secret.key]: { value: secretValue } @@ -617,11 +648,10 @@ export const secretV2BridgeServiceFactory = ({ secretValue = secretReferenceExpandedString[secret.key].value; } - // TODO(akhilmhdh-sev2): fix this return reshapeBridgeSecret(projectId, environment, path, { ...secret, value: secretValue, - comment: secret.encryptedComment?.toString() + comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) }); }; @@ -670,12 +700,15 @@ export const secretV2BridgeServiceFactory = ({ const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : []; if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" }); + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const newSecrets = await secretDAL.transaction(async (tx) => fnSecretBulkInsert({ inputSecrets: inputSecrets.map((el) => ({ version: 1, - encryptedComment: el.secretComment ? Buffer.from(el.secretComment) : undefined, - encryptedValue: el.secretValue ? Buffer.from(el.secretValue) : undefined, + encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), + encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue), skipMultilineEncoding: el.skipMultilineEncoding, key: el.secretKey, tagIds: el.tagIds, @@ -691,7 +724,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - // await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ actor, actorId, @@ -700,12 +733,12 @@ export const secretV2BridgeServiceFactory = ({ environmentSlug: folder.environment.slug }); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); return newSecrets.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - // TODO(akhilmhdh-sev2): decryption missiong - value: el.encryptedValue?.toString(), - comment: el.encryptedComment?.toString() + value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), + comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) }) ); }; @@ -770,38 +803,41 @@ export const secretV2BridgeServiceFactory = ({ const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : []; if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" }); + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const secrets = await secretDAL.transaction(async (tx) => fnSecretBulkUpdate({ folderId, tx, - inputSecrets: inputSecrets.map((el) => ({ - filter: { key: el.secretKey, type: SecretType.Shared }, - data: { - reminderRepeatDays: el.secretReminderRepeatDays, - encryptedComment: el.secretComment ? Buffer.from(el.secretComment) : undefined, - reminderNote: el.secretReminderNote, - skipMultilineEncoding: el.skipMultilineEncoding, - key: el.newSecretName || el.secretKey, - tags: el.tagIds, - ...(el.secretValue + inputSecrets: inputSecrets.map((el) => { + const encryptedValue = + typeof el.secretValue !== "undefined" ? { - encryptedValue: Buffer.from(el.secretValue), + encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue) as Buffer, references: getAllNestedSecretReferences(el.secretValue) } - : { - encryptedValue: undefined, - references: undefined - }) - } - })), + : {}; + return { + filter: { key: el.secretKey, type: SecretType.Shared }, + data: { + reminderRepeatDays: el.secretReminderRepeatDays, + encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), + reminderNote: el.secretReminderNote, + skipMultilineEncoding: el.skipMultilineEncoding, + key: el.newSecretName || el.secretKey, + tags: el.tagIds, + ...encryptedValue + } + }; + }), secretDAL, secretVersionDAL, secretTagDAL, secretVersionTagDAL }) ); - - // await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ actor, actorId, @@ -810,12 +846,12 @@ export const secretV2BridgeServiceFactory = ({ environmentSlug: folder.environment.slug }); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); return secrets.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - // TODO(akhilmhdh-sev2): decryption missiong - value: el.encryptedValue?.toString(), - comment: el.encryptedComment?.toString() + value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), + comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) }) ); }; @@ -884,12 +920,13 @@ export const secretV2BridgeServiceFactory = ({ environmentSlug: folder.environment.slug }); + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); return secretsDeleted.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - // TODO(akhilmhdh-sev2): decryption missiong - value: el.encryptedValue?.toString(), - comment: el.encryptedComment?.toString() + value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), + comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) }) ); }; @@ -943,15 +980,20 @@ export const secretV2BridgeServiceFactory = ({ if (!hasRole(ProjectMembershipRole.Admin)) throw new BadRequestError({ message: "Only admins are allowed to take this action" }); + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); await secretDAL.transaction(async (tx) => { const secrets = await secretDAL.findAllProjectSecretValues(projectId, tx); - // TODO(akhilmhdh-sev2): decryption missing await secretDAL.upsertSecretReferences( secrets .filter((el) => Boolean(el.encryptedValue)) .map(({ id, encryptedValue }) => ({ secretId: id, - references: getAllNestedSecretReferences(encryptedValue?.toString("utf8")) + references: encryptedValue + ? getAllNestedSecretReferences( + encryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue) as string + ) + : [] })), tx ); @@ -1028,10 +1070,11 @@ export const secretV2BridgeServiceFactory = ({ }); } + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); const decryptedSourceSecrets = sourceSecrets.map((secret) => ({ ...secret, - // TODO(akhilmhdh-sev2): decryption missiong - value: secret.encryptedValue?.toString() + value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue) })); let isSourceUpdated = false; @@ -1050,8 +1093,7 @@ export const secretV2BridgeServiceFactory = ({ const decryptedDestinationSecrets = destinationSecretsFromDB.map((secret) => { return { ...secret, - // TODO(akhilmhdh-sev2): decryption missiong - value: secret.encryptedValue?.toString() + value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue) }; }); @@ -1154,8 +1196,8 @@ export const secretV2BridgeServiceFactory = ({ type: doc.type, metadata: doc.metadata, key: doc.key, - encryptedValue: doc.encryptedValue ? Buffer.from(doc.encryptedValue) : undefined, - encryptedComment: doc.encryptedComment ? Buffer.from(doc.encryptedComment) : undefined, + encryptedValue: doc.encryptedValue, + encryptedComment: doc.encryptedComment, skipMultilineEncoding: doc.skipMultilineEncoding, reminderNote: doc.reminderNote, reminderRepeatDays: doc.reminderRepeatDays, @@ -1188,8 +1230,7 @@ export const secretV2BridgeServiceFactory = ({ ...(doc.encryptedValue ? { encryptedValue: doc.encryptedValue, - // TODO(akhilmhdh-sev2): fix decryption - references: getAllNestedSecretReferences(doc.encryptedValue.toString()) + references: doc.value ? getAllNestedSecretReferences(doc.value) : [] } : { encryptedValue: undefined, @@ -1275,7 +1316,7 @@ export const secretV2BridgeServiceFactory = ({ }); if (isDestinationUpdated) { - // await snapshotService.performSnapshot(destinationFolder.id); + await snapshotService.performSnapshot(destinationFolder.id); await secretQueueService.syncSecrets({ projectId, secretPath: destinationFolder.path, @@ -1286,7 +1327,7 @@ export const secretV2BridgeServiceFactory = ({ } if (isSourceUpdated) { - // await snapshotService.performSnapshot(sourceFolder.id); + await snapshotService.performSnapshot(sourceFolder.id); await secretQueueService.syncSecrets({ projectId, secretPath: sourceFolder.path, From 9e314d7a09bf6badc6f7dc2e398ea27ada62fe18 Mon Sep 17 00:00:00 2001 From: = Date: Thu, 18 Jul 2024 14:19:23 +0530 Subject: [PATCH 39/77] feat: migration updated for secret v2 snapshot and secret approval --- backend/src/@types/knex.d.ts | 24 +++++++++ .../db/migrations/20240716105646_secret-v2.ts | 53 +++++++++++++++++++ backend/src/db/schemas/index.ts | 3 ++ backend/src/db/schemas/models.ts | 3 ++ .../secret-approval-request-secret-tags-v2.ts | 25 +++++++++ .../secret-approval-requests-secrets-v2.ts | 37 +++++++++++++ .../db/schemas/secret-snapshot-secrets-v2.ts | 23 ++++++++ backend/src/server/routes/index.ts | 8 +-- .../secret-v2-bridge/secret-v2-bridge-fns.ts | 2 +- .../secret-v2-bridge-service.ts | 4 +- 10 files changed, 175 insertions(+), 7 deletions(-) create mode 100644 backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts create mode 100644 backend/src/db/schemas/secret-approval-requests-secrets-v2.ts create mode 100644 backend/src/db/schemas/secret-snapshot-secrets-v2.ts diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts index be98cd212..6b77af1c5 100644 --- a/backend/src/@types/knex.d.ts +++ b/backend/src/@types/knex.d.ts @@ -204,6 +204,9 @@ import { TSecretApprovalRequestSecretTags, TSecretApprovalRequestSecretTagsInsert, TSecretApprovalRequestSecretTagsUpdate, + TSecretApprovalRequestSecretTagsV2, + TSecretApprovalRequestSecretTagsV2Insert, + TSecretApprovalRequestSecretTagsV2Update, TSecretApprovalRequestsInsert, TSecretApprovalRequestsReviewers, TSecretApprovalRequestsReviewersInsert, @@ -211,6 +214,9 @@ import { TSecretApprovalRequestsSecrets, TSecretApprovalRequestsSecretsInsert, TSecretApprovalRequestsSecretsUpdate, + TSecretApprovalRequestsSecretsV2, + TSecretApprovalRequestsSecretsV2Insert, + TSecretApprovalRequestsSecretsV2Update, TSecretApprovalRequestsUpdate, TSecretBlindIndexes, TSecretBlindIndexesInsert, @@ -251,6 +257,9 @@ import { TSecretSnapshotSecrets, TSecretSnapshotSecretsInsert, TSecretSnapshotSecretsUpdate, + TSecretSnapshotSecretsV2, + TSecretSnapshotSecretsV2Insert, + TSecretSnapshotSecretsV2Update, TSecretSnapshotsInsert, TSecretSnapshotsUpdate, TSecretsUpdate, @@ -694,6 +703,21 @@ declare module "knex/types/tables" { TSecretVersionV2TagJunctionInsert, TSecretVersionV2TagJunctionUpdate >; + [TableName.SnapshotSecretV2]: KnexOriginal.CompositeTableType< + TSecretSnapshotSecretsV2, + TSecretSnapshotSecretsV2Insert, + TSecretSnapshotSecretsV2Update + >; + [TableName.SecretApprovalRequestSecretV2]: KnexOriginal.CompositeTableType< + TSecretApprovalRequestsSecretsV2, + TSecretApprovalRequestsSecretsV2Insert, + TSecretApprovalRequestsSecretsV2Update + >; + [TableName.SecretApprovalRequestSecretTagV2]: KnexOriginal.CompositeTableType< + TSecretApprovalRequestSecretTagsV2, + TSecretApprovalRequestSecretTagsV2Insert, + TSecretApprovalRequestSecretTagsV2Update + >; // KMS service [TableName.KmsServerRootConfig]: KnexOriginal.CompositeTableType< TKmsRootConfig, diff --git a/backend/src/db/migrations/20240716105646_secret-v2.ts b/backend/src/db/migrations/20240716105646_secret-v2.ts index 630f4a61e..4aae70513 100644 --- a/backend/src/db/migrations/20240716105646_secret-v2.ts +++ b/backend/src/db/migrations/20240716105646_secret-v2.ts @@ -66,9 +66,62 @@ export async function up(knex: Knex): Promise { } await createJunctionTable(knex, TableName.SecretVersionV2Tag, TableName.SecretVersionV2, TableName.SecretTag); + + if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecretV2))) { + await knex.schema.createTable(TableName.SecretApprovalRequestSecretV2, (t) => { + // everything related to secret + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.integer("version").defaultTo(1); + t.string("key", 500).notNullable(); + t.binary("encryptedValue"); + t.binary("encryptedComment"); + t.string("reminderNote"); + t.integer("reminderRepeatDays"); + t.boolean("skipMultilineEncoding").defaultTo(false); + t.jsonb("metadata"); + t.timestamps(true, true, true); + // commit details + t.uuid("requestId").notNullable(); + t.foreign("requestId").references("id").inTable(TableName.SecretApprovalRequest).onDelete("CASCADE"); + t.string("op").notNullable(); + t.uuid("secretId"); + t.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("SET NULL"); + t.uuid("secretVersion"); + t.foreign("secretVersion").references("id").inTable(TableName.SecretVersionV2).onDelete("SET NULL"); + }); + } + + if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecretTagV2))) { + await knex.schema.createTable(TableName.SecretApprovalRequestSecretTagV2, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.uuid("secretId").notNullable(); + t.foreign("secretId").references("id").inTable(TableName.SecretApprovalRequestSecretV2).onDelete("CASCADE"); + t.uuid("tagId").notNullable(); + t.foreign("tagId").references("id").inTable(TableName.SecretTag).onDelete("CASCADE"); + t.timestamps(true, true, true); + }); + } + + if (!(await knex.schema.hasTable(TableName.SnapshotSecretV2))) { + await knex.schema.createTable(TableName.SnapshotSecretV2, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.uuid("envId").notNullable(); + t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE"); + // not a relation kept like that to keep it when rolled back + t.uuid("secretVersionId").notNullable(); + t.foreign("secretVersionId").references("id").inTable(TableName.SecretVersionV2).onDelete("CASCADE"); + t.uuid("snapshotId").notNullable(); + t.foreign("snapshotId").references("id").inTable(TableName.Snapshot).onDelete("CASCADE"); + t.timestamps(true, true, true); + }); + } } export async function down(knex: Knex): Promise { + await knex.schema.dropTableIfExists(TableName.SnapshotSecretV2); + await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecretTagV2); + await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecretV2); + await knex.schema.dropTableIfExists(TableName.SecretV2JnTag); await knex.schema.dropTableIfExists(TableName.SecretReferenceV2); diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts index f0d43b98f..d0aa56727 100644 --- a/backend/src/db/schemas/index.ts +++ b/backend/src/db/schemas/index.ts @@ -66,9 +66,11 @@ export * from "./scim-tokens"; export * from "./secret-approval-policies"; export * from "./secret-approval-policies-approvers"; export * from "./secret-approval-request-secret-tags"; +export * from "./secret-approval-request-secret-tags-v2"; export * from "./secret-approval-requests"; export * from "./secret-approval-requests-reviewers"; export * from "./secret-approval-requests-secrets"; +export * from "./secret-approval-requests-secrets-v2"; export * from "./secret-blind-indexes"; export * from "./secret-folder-versions"; export * from "./secret-folders"; @@ -81,6 +83,7 @@ export * from "./secret-scanning-git-risks"; export * from "./secret-sharing"; export * from "./secret-snapshot-folders"; export * from "./secret-snapshot-secrets"; +export * from "./secret-snapshot-secrets-v2"; export * from "./secret-snapshots"; export * from "./secret-tag-junction"; export * from "./secret-tags"; diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index 44d0cfd91..c4140eeda 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -93,6 +93,9 @@ export enum TableName { SecretV2 = "secrets_v2", SecretReferenceV2 = "secret_references_v2", SecretVersionV2 = "secret_versions_v2", + SecretApprovalRequestSecretV2 = "secret_approval_requests_secrets_v2", + SecretApprovalRequestSecretTagV2 = "secret_approval_request_secret_tags_v2", + SnapshotSecretV2 = "secret_snapshot_secrets_v2", // junction tables with tags SecretV2JnTag = "secret_v2_tag_junction", JnSecretTag = "secret_tag_junction", diff --git a/backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts b/backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts new file mode 100644 index 000000000..6ded05a5d --- /dev/null +++ b/backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts @@ -0,0 +1,25 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretApprovalRequestSecretTagsV2Schema = z.object({ + id: z.string().uuid(), + secretId: z.string().uuid(), + tagId: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date() +}); + +export type TSecretApprovalRequestSecretTagsV2 = z.infer; +export type TSecretApprovalRequestSecretTagsV2Insert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretApprovalRequestSecretTagsV2Update = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-approval-requests-secrets-v2.ts b/backend/src/db/schemas/secret-approval-requests-secrets-v2.ts new file mode 100644 index 000000000..ee25ed6ef --- /dev/null +++ b/backend/src/db/schemas/secret-approval-requests-secrets-v2.ts @@ -0,0 +1,37 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { zodBuffer } from "@app/lib/zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretApprovalRequestsSecretsV2Schema = z.object({ + id: z.string().uuid(), + version: z.number().default(1).nullable().optional(), + key: z.string(), + encryptedValue: zodBuffer.nullable().optional(), + encryptedComment: zodBuffer.nullable().optional(), + reminderNote: z.string().nullable().optional(), + reminderRepeatDays: z.number().nullable().optional(), + skipMultilineEncoding: z.boolean().default(false).nullable().optional(), + metadata: z.unknown().nullable().optional(), + createdAt: z.date(), + updatedAt: z.date(), + requestId: z.string().uuid(), + op: z.string(), + secretId: z.string().uuid().nullable().optional(), + secretVersion: z.string().uuid().nullable().optional() +}); + +export type TSecretApprovalRequestsSecretsV2 = z.infer; +export type TSecretApprovalRequestsSecretsV2Insert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretApprovalRequestsSecretsV2Update = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-snapshot-secrets-v2.ts b/backend/src/db/schemas/secret-snapshot-secrets-v2.ts new file mode 100644 index 000000000..d643f7f8c --- /dev/null +++ b/backend/src/db/schemas/secret-snapshot-secrets-v2.ts @@ -0,0 +1,23 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretSnapshotSecretsV2Schema = z.object({ + id: z.string().uuid(), + envId: z.string().uuid(), + secretVersionId: z.string().uuid(), + snapshotId: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date() +}); + +export type TSecretSnapshotSecretsV2 = z.infer; +export type TSecretSnapshotSecretsV2Insert = Omit, TImmutableDBKeys>; +export type TSecretSnapshotSecretsV2Update = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 625790da3..3e4f940f7 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -160,6 +160,10 @@ import { secretSharingDALFactory } from "@app/services/secret-sharing/secret-sha import { secretSharingServiceFactory } from "@app/services/secret-sharing/secret-sharing-service"; import { secretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; import { secretTagServiceFactory } from "@app/services/secret-tag/secret-tag-service"; +import { secretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { secretV2BridgeServiceFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-service"; +import { secretVersionV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; +import { secretVersionV2TagBridgeDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; import { serviceTokenDALFactory } from "@app/services/service-token/service-token-dal"; import { serviceTokenServiceFactory } from "@app/services/service-token/service-token-service"; import { TSmtpService } from "@app/services/smtp/smtp-service"; @@ -182,10 +186,6 @@ import { registerSecretScannerGhApp } from "../plugins/secret-scanner"; import { registerV1Routes } from "./v1"; import { registerV2Routes } from "./v2"; import { registerV3Routes } from "./v3"; -import { secretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; -import { secretVersionV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; -import { secretVersionV2TagBridgeDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; -import { secretV2BridgeServiceFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-service"; export const registerRoutes = async ( server: FastifyZodProvider, diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts index 1dca5b28d..11e3c81c9 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts @@ -388,7 +388,7 @@ export const interpolateSecrets = ({ projectId, decryptSecret, secretDAL, folder const decryptedSec = secrets.reduce>((prev, secret) => { // eslint-disable-next-line - prev[secret.key] = decryptSecret(secret.encryptedValue); + prev[secret.key] = decryptSecret(secret.encryptedValue) || ""; return prev; }, {}); diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 4c7d18c81..793c8a4ad 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -6,12 +6,14 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service"; import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal"; import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal"; +import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service"; import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { ActorType } from "../auth/auth-type"; +import { TKmsServiceFactory } from "../kms/kms-service"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TSecretQueueFactory } from "../secret/secret-queue"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; @@ -44,8 +46,6 @@ import { } from "./secret-v2-bridge-types"; import { TSecretVersionV2DALFactory } from "./secret-version-dal"; import { TSecretVersionV2TagDALFactory } from "./secret-version-tag-dal"; -import { TKmsServiceFactory } from "../kms/kms-service"; -import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service"; type TSecretV2BridgeServiceFactoryDep = { secretDAL: TSecretV2BridgeDALFactory; From ef2816b2eea4a565a5adfccdb387768d79c0749c Mon Sep 17 00:00:00 2001 From: = Date: Sat, 20 Jul 2024 21:25:16 +0530 Subject: [PATCH 40/77] feat: added bridge logic in secret replication, snapshot and approval for raw endpoint --- .../secret-approval-request-dal.ts | 141 +++- .../secret-approval-request-secret-dal.ts | 134 +++ .../secret-approval-request-service.ts | 793 ++++++++++++++---- .../secret-approval-request-types.ts | 28 + .../secret-replication-service.ts | 340 +++++++- .../secret-snapshot-service.ts | 189 ++++- .../services/secret-snapshot/snapshot-dal.ts | 260 +++++- .../secret-snapshot/snapshot-secret-v2-dal.ts | 10 + backend/src/services/kms/kms-service.ts | 36 +- backend/src/services/kms/kms-types.ts | 15 + .../secret-v2-bridge/secret-v2-bridge-fns.ts | 12 + .../secret-v2-bridge-service.ts | 75 +- backend/src/services/secret/secret-fns.ts | 47 ++ backend/src/services/secret/secret-service.ts | 408 +++++++-- 14 files changed, 2205 insertions(+), 283 deletions(-) create mode 100644 backend/src/ee/services/secret-snapshot/snapshot-secret-v2-dal.ts diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts index 855442e6f..ea5241188 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts @@ -356,5 +356,144 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => { } }; - return { ...secretApprovalRequestOrm, findById, findProjectRequestCount, findByProjectId }; + const findByProjectIdBridgeSecretV2 = async ( + { status, limit = 20, offset = 0, projectId, committer, environment, userId }: TFindQueryFilter, + tx?: Knex + ) => { + try { + // akhilmhdh: If ever u wanted a 1 to so many relationship connected with pagination + // this is the place u wanna look at. + const query = (tx || db.replicaNode())(TableName.SecretApprovalRequest) + .join(TableName.SecretFolder, `${TableName.SecretApprovalRequest}.folderId`, `${TableName.SecretFolder}.id`) + .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`) + .join( + TableName.SecretApprovalPolicy, + `${TableName.SecretApprovalRequest}.policyId`, + `${TableName.SecretApprovalPolicy}.id` + ) + .join( + TableName.SecretApprovalPolicyApprover, + `${TableName.SecretApprovalPolicy}.id`, + `${TableName.SecretApprovalPolicyApprover}.policyId` + ) + .join( + db(TableName.Users).as("committerUser"), + `${TableName.SecretApprovalRequest}.committerUserId`, + `committerUser.id` + ) + .leftJoin( + TableName.SecretApprovalRequestReviewer, + `${TableName.SecretApprovalRequest}.id`, + `${TableName.SecretApprovalRequestReviewer}.requestId` + ) + .leftJoin( + TableName.SecretApprovalRequestSecretV2, + `${TableName.SecretApprovalRequestSecretV2}.requestId`, + `${TableName.SecretApprovalRequest}.id` + ) + .where( + stripUndefinedInWhere({ + projectId, + [`${TableName.Environment}.slug` as "slug"]: environment, + [`${TableName.SecretApprovalRequest}.status`]: status, + committerUserId: committer + }) + ) + .andWhere( + (bd) => + void bd + .where(`${TableName.SecretApprovalPolicyApprover}.approverUserId`, userId) + .orWhere(`${TableName.SecretApprovalRequest}.committerUserId`, userId) + ) + .select(selectAllTableCols(TableName.SecretApprovalRequest)) + .select( + db.ref("projectId").withSchema(TableName.Environment), + db.ref("slug").withSchema(TableName.Environment).as("environment"), + db.ref("id").withSchema(TableName.SecretApprovalRequestReviewer).as("reviewerId"), + db.ref("reviewerUserId").withSchema(TableName.SecretApprovalRequestReviewer), + db.ref("status").withSchema(TableName.SecretApprovalRequestReviewer).as("reviewerStatus"), + db.ref("id").withSchema(TableName.SecretApprovalPolicy).as("policyId"), + db.ref("name").withSchema(TableName.SecretApprovalPolicy).as("policyName"), + db.ref("op").withSchema(TableName.SecretApprovalRequestSecretV2).as("commitOp"), + db.ref("secretId").withSchema(TableName.SecretApprovalRequestSecretV2).as("commitSecretId"), + db.ref("id").withSchema(TableName.SecretApprovalRequestSecretV2).as("commitId"), + db.raw( + `DENSE_RANK() OVER (partition by ${TableName.Environment}."projectId" ORDER BY ${TableName.SecretApprovalRequest}."id" DESC) as rank` + ), + db.ref("secretPath").withSchema(TableName.SecretApprovalPolicy).as("policySecretPath"), + db.ref("approvals").withSchema(TableName.SecretApprovalPolicy).as("policyApprovals"), + db.ref("approverUserId").withSchema(TableName.SecretApprovalPolicyApprover), + db.ref("email").withSchema("committerUser").as("committerUserEmail"), + db.ref("username").withSchema("committerUser").as("committerUserUsername"), + db.ref("firstName").withSchema("committerUser").as("committerUserFirstName"), + db.ref("lastName").withSchema("committerUser").as("committerUserLastName") + ) + .orderBy("createdAt", "desc"); + + const docs = await (tx || db) + .with("w", query) + .select("*") + .from[number]>("w") + .where("w.rank", ">=", offset) + .andWhere("w.rank", "<", offset + limit); + const formatedDoc = sqlNestRelationships({ + data: docs, + key: "id", + parentMapper: (el) => ({ + ...SecretApprovalRequestsSchema.parse(el), + environment: el.environment, + projectId: el.projectId, + policy: { + id: el.policyId, + name: el.policyName, + approvals: el.policyApprovals, + secretPath: el.policySecretPath + }, + committerUser: { + userId: el.committerUserId, + email: el.committerUserEmail, + firstName: el.committerUserFirstName, + lastName: el.committerUserLastName, + username: el.committerUserUsername + } + }), + childrenMapper: [ + { + key: "reviewerId", + label: "reviewers" as const, + mapper: ({ reviewerUserId, reviewerStatus: s }) => + reviewerUserId ? { userId: reviewerUserId, status: s } : undefined + }, + { + key: "approverUserId", + label: "approvers" as const, + mapper: ({ approverUserId }) => approverUserId + }, + { + key: "commitId", + label: "commits" as const, + mapper: ({ commitSecretId: secretId, commitId: id, commitOp: op }) => ({ + op, + id, + secretId + }) + } + ] + }); + return formatedDoc.map((el) => ({ + ...el, + policy: { ...el.policy, approvers: el.approvers } + })); + } catch (error) { + throw new DatabaseError({ error, name: "FindSAR" }); + } + }; + + return { + ...secretApprovalRequestOrm, + findById, + findProjectRequestCount, + findByProjectId, + findByProjectIdBridgeSecretV2 + }; }; diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts index 8dc06aaf5..b7174b96c 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts @@ -3,6 +3,7 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; import { SecretApprovalRequestsSecretsSchema, + SecretApprovalRequestsSecretsV2Schema, TableName, TSecretApprovalRequestsSecrets, TSecretTags @@ -15,6 +16,7 @@ export type TSecretApprovalRequestSecretDALFactory = ReturnType { const secretApprovalRequestSecretOrm = ormify(db, TableName.SecretApprovalRequestSecret); const secretApprovalRequestSecretTagOrm = ormify(db, TableName.SecretApprovalRequestSecretTag); + const secretApprovalRequestSecretV2Orm = ormify(db, TableName.SecretApprovalRequestSecretV2); const bulkUpdateNoVersionIncrement = async (data: TSecretApprovalRequestsSecrets[], tx?: Knex) => { try { @@ -221,9 +223,141 @@ export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => { throw new DatabaseError({ error, name: "FindByRequestId" }); } }; + + const findByRequestIdBridgeSecretV2 = async (requestId: string, tx?: Knex) => { + try { + const doc = await (tx || db.replicaNode())({ + secVerTag: TableName.SecretTag + }) + .from(TableName.SecretApprovalRequestSecretV2) + .where({ requestId }) + .leftJoin( + TableName.SecretApprovalRequestSecretTagV2, + `${TableName.SecretApprovalRequestSecretV2}.id`, + `${TableName.SecretApprovalRequestSecretTagV2}.secretId` + ) + .leftJoin( + TableName.SecretTag, + `${TableName.SecretApprovalRequestSecretTagV2}.tagId`, + `${TableName.SecretTag}.id` + ) + .leftJoin(TableName.SecretV2, `${TableName.SecretApprovalRequestSecretV2}.secretId`, `${TableName.Secret}.id`) + .leftJoin( + TableName.SecretVersionV2, + `${TableName.SecretVersionV2}.id`, + `${TableName.SecretApprovalRequestSecretV2}.secretVersion` + ) + .leftJoin( + TableName.SecretVersionV2Tag, + `${TableName.SecretVersionV2Tag}.${TableName.SecretVersionV2}Id`, + `${TableName.SecretVersionV2}.id` + ) + .leftJoin( + db.ref(TableName.SecretTag).as("secVerTag"), + `${TableName.SecretVersionV2Tag}.${TableName.SecretTag}Id`, + db.ref("id").withSchema("secVerTag") + ) + .select(selectAllTableCols(TableName.SecretApprovalRequestSecretV2)) + .select({ + secVerTagId: "secVerTag.id", + secVerTagColor: "secVerTag.color", + secVerTagSlug: "secVerTag.slug", + secVerTagName: "secVerTag.name" + }) + .select( + db.ref("id").withSchema(TableName.SecretTag).as("tagId"), + db.ref("id").withSchema(TableName.SecretApprovalRequestSecretTagV2).as("tagJnId"), + db.ref("color").withSchema(TableName.SecretTag).as("tagColor"), + db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"), + db.ref("name").withSchema(TableName.SecretTag).as("tagName") + ) + .select( + db.ref("version").withSchema(TableName.SecretV2).as("orgSecVersion"), + db.ref("key").withSchema(TableName.SecretV2).as("orgSecKey"), + db.ref("encryptedValue").withSchema(TableName.SecretV2).as("orgSecValue"), + db.ref("encryptedComment").withSchema(TableName.SecretV2).as("orgSecComment") + ) + .select( + db.ref("version").withSchema(TableName.SecretVersionV2).as("secVerVersion"), + db.ref("key").withSchema(TableName.SecretVersionV2).as("secVerKey"), + db.ref("encryptedValue").withSchema(TableName.SecretVersionV2).as("secVerValue"), + db.ref("encryptedComment").withSchema(TableName.SecretVersionV2).as("secVerComment") + ); + const formatedDoc = sqlNestRelationships({ + data: doc, + key: "id", + parentMapper: (data) => SecretApprovalRequestsSecretsV2Schema.omit({ secretVersion: true }).parse(data), + childrenMapper: [ + { + key: "tagJnId", + label: "tags" as const, + mapper: ({ tagId: id, tagName: name, tagSlug: slug, tagColor: color }) => ({ + id, + name, + slug, + color + }) + }, + { + key: "secretId", + label: "secret" as const, + mapper: ({ orgSecVersion, orgSecKey, orgSecValue, orgSecComment, secretId }) => + secretId + ? { + id: secretId, + version: orgSecVersion, + key: orgSecKey, + encryptedValue: orgSecValue, + encryptedComment: orgSecComment + } + : undefined + }, + { + key: "secretVersion", + label: "secretVersion" as const, + mapper: ({ secretVersion, secVerVersion, secVerKey, secVerValue, secVerComment }) => + secretVersion + ? { + version: secVerVersion, + id: secretVersion, + key: secVerKey, + encryptedValue: secVerValue, + encryptedComment: secVerComment + } + : undefined, + childrenMapper: [ + { + key: "secVerTagId", + label: "tags" as const, + mapper: ({ secVerTagId: id, secVerTagName: name, secVerTagSlug: slug, secVerTagColor: color }) => ({ + // eslint-disable-next-line + id, + // eslint-disable-next-line + name, + // eslint-disable-next-line + slug, + // eslint-disable-next-line + color + }) + } + ] + } + ] + }); + return formatedDoc?.map(({ secret, secretVersion, ...el }) => ({ + ...el, + secret: secret?.[0], + secretVersion: secretVersion?.[0] + })); + } catch (error) { + throw new DatabaseError({ error, name: "FindByRequestId" }); + } + }; return { ...secretApprovalRequestSecretOrm, + insertV2Bridge: secretApprovalRequestSecretV2Orm.insertMany, findByRequestId, + findByRequestIdBridgeSecretV2, bulkUpdateNoVersionIncrement, insertApprovalSecretTags: secretApprovalRequestSecretTagOrm.insertMany }; diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index 68e0271d2..11e24f104 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -5,7 +5,8 @@ import { SecretEncryptionAlgo, SecretKeyEncoding, SecretType, - TSecretApprovalRequestsSecretsInsert + TSecretApprovalRequestsSecretsInsert, + TSecretApprovalRequestsSecretsV2Insert } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; @@ -19,6 +20,7 @@ import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal"; import { TSecretDALFactory } from "@app/services/secret/secret-dal"; import { + decryptSecretWithBot, fnSecretBlindIndexCheck, fnSecretBlindIndexCheckV2, fnSecretBulkDelete, @@ -26,6 +28,13 @@ import { fnSecretBulkUpdate, getAllNestedSecretReferences } from "@app/services/secret/secret-fns"; +import { + fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, + fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, + fnSecretBulkDelete as fnSecretV2BridgeBulkDelete, + getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge, + secretEncryptionHelper +} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; import { TSecretQueueFactory } from "@app/services/secret/secret-queue"; import { SecretOperations } from "@app/services/secret/secret-types"; import { TSecretVersionDALFactory } from "@app/services/secret/secret-version-dal"; @@ -47,12 +56,17 @@ import { RequestState, TApprovalRequestCountDTO, TGenerateSecretApprovalRequestDTO, + TGenerateSecretApprovalRequestV2BridgeDTO, TListApprovalsDTO, TMergeSecretApprovalRequestDTO, TReviewRequestDTO, TSecretApprovalDetailsDTO, TStatusChangeDTO } from "./secret-approval-request-types"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; type TSecretApprovalRequestServiceFactoryDep = { permissionService: Pick; @@ -62,16 +76,29 @@ type TSecretApprovalRequestServiceFactoryDep = { secretApprovalRequestReviewerDAL: TSecretApprovalRequestReviewerDALFactory; folderDAL: Pick; secretDAL: TSecretDALFactory; - secretTagDAL: Pick; + secretTagDAL: Pick< + TSecretTagDALFactory, + "findManyTagsById" | "saveTagsToSecret" | "deleteTagsManySecret" | "saveTagsToSecretV2" | "deleteTagsToSecretV2" + >; secretBlindIndexDAL: Pick; snapshotService: Pick; secretVersionDAL: Pick; secretVersionTagDAL: Pick; - projectDAL: Pick; - secretQueueService: Pick; smtpService: Pick; userDAL: Pick; projectEnvDAL: Pick; + projectDAL: Pick; + secretQueueService: Pick; + kmsService: Pick< + TKmsServiceFactory, + "getProjectSecretManagerKmsDataKey" | "encryptWithInputKey" | "decryptWithInputKey" + >; + secretV2BridgeDAL: Pick< + TSecretV2BridgeDALFactory, + "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany" + >; + secretVersionV2BridgeDAL: Pick; + secretVersionTagV2BridgeDAL: Pick; }; export type TSecretApprovalRequestServiceFactory = ReturnType; @@ -93,7 +120,11 @@ export const secretApprovalRequestServiceFactory = ({ projectBotService, smtpService, userDAL, - projectEnvDAL + projectEnvDAL, + kmsService, + secretV2BridgeDAL, + secretVersionV2BridgeDAL, + secretVersionTagV2BridgeDAL }: TSecretApprovalRequestServiceFactoryDep) => { const requestCount = async ({ projectId, actor, actorId, actorOrgId, actorAuthMethod }: TApprovalRequestCountDTO) => { if (actor === ActorType.SERVICE) throw new BadRequestError({ message: "Cannot use service token" }); @@ -125,6 +156,19 @@ export const secretApprovalRequestServiceFactory = ({ if (actor === ActorType.SERVICE) throw new BadRequestError({ message: "Cannot use service token" }); await permissionService.getProjectPermission(actor, actorId, projectId, actorAuthMethod, actorOrgId); + + const { shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + return secretApprovalRequestDAL.findByProjectIdBridgeSecretV2({ + projectId, + committer, + environment, + status, + userId: actorId, + limit, + offset + }); + } const approvals = await secretApprovalRequestDAL.findByProjectId({ projectId, committer, @@ -149,11 +193,14 @@ export const secretApprovalRequestServiceFactory = ({ const secretApprovalRequest = await secretApprovalRequestDAL.findById(id); if (!secretApprovalRequest) throw new BadRequestError({ message: "Secret approval request not found" }); + const { projectId } = secretApprovalRequest; + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + const { policy } = secretApprovalRequest; const { hasRole } = await permissionService.getProjectPermission( actor, actorId, - secretApprovalRequest.projectId, + projectId, actorAuthMethod, actorOrgId ); @@ -165,7 +212,55 @@ export const secretApprovalRequestServiceFactory = ({ throw new UnauthorizedError({ message: "User has no access" }); } - const secrets = await secretApprovalRequestSecretDAL.findByRequestId(secretApprovalRequest.id); + let secrets; + if (shouldUseSecretV2Bridge) { + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const encrypedSecrets = await secretApprovalRequestSecretDAL.findByRequestIdBridgeSecretV2( + secretApprovalRequest.id + ); + secrets = encrypedSecrets.map((el) => ({ + ...el, + secret: { + secretKey: el.secret.key, + id: el.secret.id, + version: el.secret.version, + secretValue: el.secret.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: el.secret.encryptedValue }).toString() + : undefined, + secretComment: el.secret.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.secret.encryptedComment }).toString() + : undefined + }, + secretVersion: { + secretKey: el.secretVersion.key, + id: el.secretVersion.id, + version: el.secretVersion.version, + secretValue: el.secretVersion.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: el.secretVersion.encryptedValue }).toString() + : undefined, + secretComment: el.secretVersion.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.secretVersion.encryptedComment }).toString() + : undefined + } + })); + } else { + if (!botKey) throw new BadRequestError({ message: "Bot key not found" }); + const encrypedSecrets = await secretApprovalRequestSecretDAL.findByRequestId(secretApprovalRequest.id); + secrets = encrypedSecrets.map((el) => ({ + ...el, + secret: { + id: el.secret.id, + version: el.secret.version, + ...decryptSecretWithBot(el.secret, botKey) + }, + secretVersion: { + id: el.secretVersion.id, + version: el.secretVersion.version, + ...decryptSecretWithBot(el.secretVersion, botKey) + } + })); + } const secretPath = await folderDAL.findSecretPathByFolderIds(secretApprovalRequest.projectId, [ secretApprovalRequest.folderId ]); @@ -300,48 +395,165 @@ export const secretApprovalRequestServiceFactory = ({ secretApprovalRequest.policy.approvers.filter( ({ userId: approverId }) => reviewers[approverId.toString()] === ApprovalStatus.APPROVED ).length; + const isSoftEnforcement = secretApprovalRequest.policy.enforcementLevel === EnforcementLevel.Soft; - const isSoftEnforcement = secretApprovalRequest.policy.enforcementLevel === EnforcementLevel.Soft; + if (!hasMinApproval && !isSoftEnforcement) + throw new BadRequestError({ message: "Doesn't have minimum approvals needed" }); - if (!hasMinApproval && !isSoftEnforcement) - throw new BadRequestError({ message: "Doesn't have minimum approvals needed" }); - const secretApprovalSecrets = await secretApprovalRequestSecretDAL.findByRequestId(secretApprovalRequest.id); - if (!secretApprovalSecrets) throw new BadRequestError({ message: "No secrets found" }); - - const conflicts: Array<{ secretId: string; op: SecretOperations }> = []; - let secretCreationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Create); - if (secretCreationCommits.length) { - const { secsGroupedByBlindIndex: conflictGroupByBlindIndex } = await fnSecretBlindIndexCheckV2({ - folderId, - secretDAL, - inputSecrets: secretCreationCommits.map(({ secretBlindIndex }) => { - if (!secretBlindIndex) { - throw new BadRequestError({ - message: "Missing secret blind index" - }); - } - return { secretBlindIndex }; - }) - }); - secretCreationCommits - .filter(({ secretBlindIndex }) => conflictGroupByBlindIndex[secretBlindIndex || ""]) - .forEach((el) => { - conflicts.push({ op: SecretOperations.Create, secretId: el.id }); - }); - secretCreationCommits = secretCreationCommits.filter( - ({ secretBlindIndex }) => !conflictGroupByBlindIndex[secretBlindIndex || ""] + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + let mergeStatus; + if (shouldUseSecretV2Bridge) { + // this cycle if for bridged secrets + const secretApprovalSecrets = await secretApprovalRequestSecretDAL.findByRequestIdBridgeSecretV2( + secretApprovalRequest.id ); - } + if (!secretApprovalSecrets) throw new BadRequestError({ message: "No secrets found" }); - let secretUpdationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Update); - if (secretUpdationCommits.length) { - const { secsGroupedByBlindIndex: conflictGroupByBlindIndex } = await fnSecretBlindIndexCheckV2({ - folderId, - secretDAL, - userId: "", - inputSecrets: secretUpdationCommits - .filter(({ secretBlindIndex, secret }) => secret && secret.secretBlindIndex !== secretBlindIndex) - .map(({ secretBlindIndex }) => { + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + + const conflicts: Array<{ secretId: string; op: SecretOperations }> = []; + let secretCreationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Create); + if (secretCreationCommits.length) { + const secrets = await secretV2BridgeDAL.findBySecretKeys( + folderId, + secretCreationCommits.map((el) => ({ + key: el.key, + type: SecretType.Shared + })) + ); + const creationConflictSecretsGroupByKey = groupBy(secrets, (i) => i.key); + secretCreationCommits + .filter(({ key }) => creationConflictSecretsGroupByKey[key]) + .forEach((el) => { + conflicts.push({ op: SecretOperations.Create, secretId: el.id }); + }); + secretCreationCommits = secretCreationCommits.filter(({ key }) => !creationConflictSecretsGroupByKey[key]); + } + + let secretUpdationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Update); + if (secretUpdationCommits.length) { + const secrets = await secretV2BridgeDAL.findBySecretKeys( + folderId, + secretCreationCommits.map((el) => ({ + key: el.key, + type: SecretType.Shared + })) + ); + const updationConflictSecretsGroupByKey = groupBy(secrets, (i) => i.key); + secretUpdationCommits + .filter(({ key, secretId }) => updationConflictSecretsGroupByKey[key] || !secretId) + .forEach((el) => { + conflicts.push({ op: SecretOperations.Update, secretId: el.id }); + }); + + secretUpdationCommits = secretUpdationCommits.filter( + ({ key, secretId }) => Boolean(secretId) && !updationConflictSecretsGroupByKey[key] + ); + } + + const secretDeletionCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Delete); + mergeStatus = await secretApprovalRequestDAL.transaction(async (tx) => { + const newSecrets = secretCreationCommits.length + ? await fnSecretV2BridgeBulkInsert({ + tx, + folderId, + inputSecrets: secretCreationCommits.map((el) => ({ + tagIds: el?.tags.map(({ id }) => id), + version: 1, + encryptedComment: el.encryptedComment, + encryptedValue: el.encryptedValue, + skipMultilineEncoding: el.skipMultilineEncoding, + key: el.key, + references: el.encryptedValue + ? getAllNestedSecretReferencesV2Bridge( + secretManagerDecryptor({ + cipherTextBlob: el.encryptedValue + }).toString() + ) + : [], + type: SecretType.Shared + })), + secretDAL: secretV2BridgeDAL, + secretVersionDAL: secretVersionV2BridgeDAL, + secretTagDAL, + secretVersionTagDAL: secretVersionTagV2BridgeDAL + }) + : []; + const updatedSecrets = secretUpdationCommits.length + ? await fnSecretV2BridgeBulkUpdate({ + folderId, + tx, + inputSecrets: secretUpdationCommits.map((el) => { + const encryptedValue = + typeof el.encryptedValue !== "undefined" + ? { + encryptedValue: el.encryptedValue as Buffer, + references: el.encryptedValue + ? getAllNestedSecretReferencesV2Bridge( + secretManagerDecryptor({ + cipherTextBlob: el.encryptedValue + }).toString() + ) + : [] + } + : {}; + return { + filter: { id: el.secretId as string, type: SecretType.Shared }, + data: { + reminderRepeatDays: el.reminderRepeatDays, + encryptedComment: el.encryptedComment, + reminderNote: el.reminderNote, + skipMultilineEncoding: el.skipMultilineEncoding, + key: el.key, + tagIds: el?.tags.map(({ id }) => id), + ...encryptedValue + } + }; + }), + secretDAL: secretV2BridgeDAL, + secretVersionDAL: secretVersionV2BridgeDAL, + secretTagDAL, + secretVersionTagDAL: secretVersionTagV2BridgeDAL + }) + : []; + const deletedSecret = secretDeletionCommits.length + ? await fnSecretV2BridgeBulkDelete({ + projectId, + folderId, + tx, + actorId: "", + secretDAL: secretV2BridgeDAL, + secretQueueService, + inputSecrets: secretDeletionCommits.map(({ key }) => ({ secretKey: key, type: SecretType.Shared })) + }) + : []; + const updatedSecretApproval = await secretApprovalRequestDAL.updateById( + secretApprovalRequest.id, + { + conflicts: JSON.stringify(conflicts), + hasMerged: true, + status: RequestState.Closed, + statusChangedByUserId: actorId + }, + tx + ); + return { + secrets: { created: newSecrets, updated: updatedSecrets, deleted: deletedSecret }, + approval: updatedSecretApproval + }; + }); + } else { + const secretApprovalSecrets = await secretApprovalRequestSecretDAL.findByRequestId(secretApprovalRequest.id); + if (!secretApprovalSecrets) throw new BadRequestError({ message: "No secrets found" }); + + const conflicts: Array<{ secretId: string; op: SecretOperations }> = []; + let secretCreationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Create); + if (secretCreationCommits.length) { + const { secsGroupedByBlindIndex: conflictGroupByBlindIndex } = await fnSecretBlindIndexCheckV2({ + folderId, + secretDAL, + inputSecrets: secretCreationCommits.map(({ secretBlindIndex }) => { if (!secretBlindIndex) { throw new BadRequestError({ message: "Missing secret blind index" @@ -349,80 +561,56 @@ export const secretApprovalRequestServiceFactory = ({ } return { secretBlindIndex }; }) - }); - secretUpdationCommits - .filter( - ({ secretBlindIndex, secretId }) => - (secretBlindIndex && conflictGroupByBlindIndex[secretBlindIndex]) || !secretId - ) - .forEach((el) => { - conflicts.push({ op: SecretOperations.Update, secretId: el.id }); }); + secretCreationCommits + .filter(({ secretBlindIndex }) => conflictGroupByBlindIndex[secretBlindIndex || ""]) + .forEach((el) => { + conflicts.push({ op: SecretOperations.Create, secretId: el.id }); + }); + secretCreationCommits = secretCreationCommits.filter( + ({ secretBlindIndex }) => !conflictGroupByBlindIndex[secretBlindIndex || ""] + ); + } - secretUpdationCommits = secretUpdationCommits.filter( - ({ secretBlindIndex, secretId }) => - Boolean(secretId) && (secretBlindIndex ? !conflictGroupByBlindIndex[secretBlindIndex] : true) - ); - } + let secretUpdationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Update); + if (secretUpdationCommits.length) { + const { secsGroupedByBlindIndex: conflictGroupByBlindIndex } = await fnSecretBlindIndexCheckV2({ + folderId, + secretDAL, + userId: "", + inputSecrets: secretUpdationCommits + .filter(({ secretBlindIndex, secret }) => secret && secret.secretBlindIndex !== secretBlindIndex) + .map(({ secretBlindIndex }) => { + if (!secretBlindIndex) { + throw new BadRequestError({ + message: "Missing secret blind index" + }); + } + return { secretBlindIndex }; + }) + }); + secretUpdationCommits + .filter( + ({ secretBlindIndex, secretId }) => + (secretBlindIndex && conflictGroupByBlindIndex[secretBlindIndex]) || !secretId + ) + .forEach((el) => { + conflicts.push({ op: SecretOperations.Update, secretId: el.id }); + }); - const secretDeletionCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Delete); - const botKey = await projectBotService.getBotKey(projectId).catch(() => null); - const mergeStatus = await secretApprovalRequestDAL.transaction(async (tx) => { - const newSecrets = secretCreationCommits.length - ? await fnSecretBulkInsert({ - tx, - folderId, - inputSecrets: secretCreationCommits.map((el) => ({ - ...pick(el, [ - "secretCommentCiphertext", - "secretCommentTag", - "secretCommentIV", - "secretValueIV", - "secretValueTag", - "secretValueCiphertext", - "secretKeyCiphertext", - "secretKeyTag", - "secretKeyIV", - "metadata", - "skipMultilineEncoding", - "secretReminderNote", - "secretReminderRepeatDays", - "algorithm", - "keyEncoding", - "secretBlindIndex" - ]), - tags: el?.tags.map(({ id }) => id), - version: 1, - type: SecretType.Shared, - references: botKey - ? getAllNestedSecretReferences( - decryptSymmetric128BitHexKeyUTF8({ - ciphertext: el.secretValueCiphertext, - iv: el.secretValueIV, - tag: el.secretValueTag, - key: botKey - }) - ) - : undefined - })), - secretDAL, - secretVersionDAL, - secretTagDAL, - secretVersionTagDAL - }) - : []; - const updatedSecrets = secretUpdationCommits.length - ? await fnSecretBulkUpdate({ - folderId, - projectId, - tx, - inputSecrets: secretUpdationCommits.map((el) => ({ - filter: { - id: el.secretId as string, // this null check is already checked at top on conflict strategy - type: SecretType.Shared - }, - data: { - tags: el?.tags.map(({ id }) => id), + secretUpdationCommits = secretUpdationCommits.filter( + ({ secretBlindIndex, secretId }) => + Boolean(secretId) && (secretBlindIndex ? !conflictGroupByBlindIndex[secretBlindIndex] : true) + ); + } + + const secretDeletionCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Delete); + mergeStatus = await secretApprovalRequestDAL.transaction(async (tx) => { + const newSecrets = secretCreationCommits.length + ? await fnSecretBulkInsert({ + tx, + folderId, + inputSecrets: secretCreationCommits.map((el) => ({ ...pick(el, [ "secretCommentCiphertext", "secretCommentTag", @@ -437,8 +625,13 @@ export const secretApprovalRequestServiceFactory = ({ "skipMultilineEncoding", "secretReminderNote", "secretReminderRepeatDays", + "algorithm", + "keyEncoding", "secretBlindIndex" ]), + tags: el?.tags.map(({ id }) => id), + version: 1, + type: SecretType.Shared, references: botKey ? getAllNestedSecretReferences( decryptSymmetric128BitHexKeyUTF8({ @@ -449,48 +642,94 @@ export const secretApprovalRequestServiceFactory = ({ }) ) : undefined - } - })), - secretDAL, - secretVersionDAL, - secretTagDAL, - secretVersionTagDAL - }) - : []; - const deletedSecret = secretDeletionCommits.length - ? await fnSecretBulkDelete({ - projectId, - folderId, - tx, - actorId: "", - secretDAL, - secretQueueService, - inputSecrets: secretDeletionCommits.map(({ secretBlindIndex }) => { - if (!secretBlindIndex) { - throw new BadRequestError({ - message: "Missing secret blind index" - }); - } - return { secretBlindIndex, type: SecretType.Shared }; + })), + secretDAL, + secretVersionDAL, + secretTagDAL, + secretVersionTagDAL }) - }) - : []; - const updatedSecretApproval = await secretApprovalRequestDAL.updateById( - secretApprovalRequest.id, - { - conflicts: JSON.stringify(conflicts), - hasMerged: true, - status: RequestState.Closed, - statusChangedByUserId: actorId, - bypassReason - }, - tx - ); - return { - secrets: { created: newSecrets, updated: updatedSecrets, deleted: deletedSecret }, - approval: updatedSecretApproval - }; - }); + : []; + const updatedSecrets = secretUpdationCommits.length + ? await fnSecretBulkUpdate({ + folderId, + projectId, + tx, + inputSecrets: secretUpdationCommits.map((el) => ({ + filter: { + id: el.secretId as string, // this null check is already checked at top on conflict strategy + type: SecretType.Shared + }, + data: { + tags: el?.tags.map(({ id }) => id), + ...pick(el, [ + "secretCommentCiphertext", + "secretCommentTag", + "secretCommentIV", + "secretValueIV", + "secretValueTag", + "secretValueCiphertext", + "secretKeyCiphertext", + "secretKeyTag", + "secretKeyIV", + "metadata", + "skipMultilineEncoding", + "secretReminderNote", + "secretReminderRepeatDays", + "secretBlindIndex" + ]), + references: botKey + ? getAllNestedSecretReferences( + decryptSymmetric128BitHexKeyUTF8({ + ciphertext: el.secretValueCiphertext, + iv: el.secretValueIV, + tag: el.secretValueTag, + key: botKey + }) + ) + : undefined + } + })), + secretDAL, + secretVersionDAL, + secretTagDAL, + secretVersionTagDAL + }) + : []; + const deletedSecret = secretDeletionCommits.length + ? await fnSecretBulkDelete({ + projectId, + folderId, + tx, + actorId: "", + secretDAL, + secretQueueService, + inputSecrets: secretDeletionCommits.map(({ secretBlindIndex }) => { + if (!secretBlindIndex) { + throw new BadRequestError({ + message: "Missing secret blind index" + }); + } + return { secretBlindIndex, type: SecretType.Shared }; + }) + }) + : []; + const updatedSecretApproval = await secretApprovalRequestDAL.updateById( + secretApprovalRequest.id, + { + conflicts: JSON.stringify(conflicts), + hasMerged: true, + status: RequestState.Closed, + statusChangedByUserId: actorId + }, + tx + ); + return { + secrets: { created: newSecrets, updated: updatedSecrets, deleted: deletedSecret }, + approval: updatedSecretApproval + }; + }); + } + await snapshotService.performSnapshot(folderId); const [folder] = await folderDAL.findSecretPathByFolderIds(projectId, [folderId]); if (!folder) throw new BadRequestError({ message: "Folder not found" }); @@ -779,8 +1018,248 @@ export const secretApprovalRequestServiceFactory = ({ }); return secretApprovalRequest; }; + + const generateSecretApprovalRequestV2Bridge = async ({ + data, + actorId, + actor, + actorOrgId, + actorAuthMethod, + policy, + projectId, + secretPath, + environment + }: TGenerateSecretApprovalRequestV2BridgeDTO) => { + if (actor === ActorType.SERVICE || actor === ActorType.Machine) + throw new BadRequestError({ message: "Cannot use service token or machine token over protected branches" }); + + const { permission } = await permissionService.getProjectPermission( + actor, + actorId, + projectId, + actorAuthMethod, + actorOrgId + ); + ForbiddenError.from(permission).throwUnlessCan( + ProjectPermissionActions.Read, + subject(ProjectPermissionSub.Secrets, { environment, secretPath }) + ); + + const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); + if (!folder) + throw new BadRequestError({ + message: "Folder not found for the given environment slug & secret path", + name: "GenSecretApproval" + }); + const folderId = folder.id; + + const commits: Omit[] = []; + const commitTagIds: Record = {}; + + const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); + const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + + // for created secret approval change + const createdSecrets = data[SecretOperations.Create]; + if (createdSecrets && createdSecrets?.length) { + const secrets = await secretV2BridgeDAL.findBySecretKeys( + folderId, + createdSecrets.map((el) => ({ + key: el.secretKey, + type: SecretType.Shared + })) + ); + if (secrets.length) + throw new BadRequestError({ message: `Secret already exist: ${secrets.map((el) => el.key).join(",")}` }); + + commits.push( + ...createdSecrets.map((createdSecret) => ({ + op: SecretOperations.Create, + version: 1, + encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, createdSecret.secretComment), + encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, createdSecret.secretValue), + skipMultilineEncoding: createdSecret.skipMultilineEncoding, + key: createdSecret.secretKey, + type: SecretType.Shared + })) + ); + createdSecrets.forEach(({ tagIds, secretKey }) => { + if (tagIds?.length) commitTagIds[secretKey] = tagIds; + }); + } + // not secret approval for update operations + const secretsToUpdate = data[SecretOperations.Update]; + if (secretsToUpdate && secretsToUpdate?.length) { + const secretsToUpdateStoredInDB = await secretV2BridgeDAL.findBySecretKeys( + folderId, + secretsToUpdate.map((el) => ({ + key: el.secretKey, + type: SecretType.Shared + })) + ); + if (secretsToUpdateStoredInDB.length !== secretsToUpdate.length) + throw new BadRequestError({ + message: `Secret not exist: ${secretsToUpdateStoredInDB.map((el) => el.key).join(",")}` + }); + + // now find any secret that needs to update its name + // same process as above + const secretsWithNewName = secretsToUpdate.filter(({ newSecretName }) => Boolean(newSecretName)); + if (secretsWithNewName.length) { + const secrets = await secretV2BridgeDAL.findBySecretKeys( + folderId, + secretsWithNewName.map((el) => ({ + key: el.secretKey, + type: SecretType.Shared + })) + ); + if (secrets.length) + throw new BadRequestError({ + message: `Secret not exist: ${secretsToUpdateStoredInDB.map((el) => el.key).join(",")}` + }); + } + + const updatingSecretsGroupByKey = groupBy(secretsToUpdateStoredInDB, (el) => el.key); + const latestSecretVersions = await secretVersionV2BridgeDAL.findLatestVersionMany( + folderId, + secretsToUpdateStoredInDB.map(({ id }) => id) + ); + commits.push( + ...secretsToUpdate.map( + ({ + newSecretName, + secretKey, + tagIds, + secretValue, + reminderRepeatDays, + reminderNote, + secretComment, + metadata, + skipMultilineEncoding + }) => { + const secretId = updatingSecretsGroupByKey[secretKey][0].id; + if (tagIds?.length) commitTagIds[secretKey] = tagIds; + return { + ...latestSecretVersions[secretId], + key: newSecretName || secretKey, + encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretValue) as Buffer, + encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretComment) as Buffer, + reminderRepeatDays, + reminderNote, + metadata, + skipMultilineEncoding, + op: SecretOperations.Update as const, + secret: secretId, + secretVersion: latestSecretVersions[secretId].id, + version: updatingSecretsGroupByKey[secretKey][0].version || 1 + }; + } + ) + ); + } + // deleted secrets + const deletedSecrets = data[SecretOperations.Delete]; + if (deletedSecrets && deletedSecrets.length) { + const secretsToDeleteInDB = await secretV2BridgeDAL.findBySecretKeys( + folderId, + deletedSecrets.map((el) => ({ + key: el.secretKey, + type: SecretType.Shared + })) + ); + if (secretsToDeleteInDB.length !== deletedSecrets.length) + throw new BadRequestError({ + message: `Secret not exist: ${secretsToDeleteInDB.map((el) => el.key).join(",")}` + }); + const secretsGroupedByKey = groupBy(secretsToDeleteInDB, (i) => i.key); + const deletedSecretIds = deletedSecrets.map((el) => secretsGroupedByKey[el.secretKey][0].id); + const latestSecretVersions = await secretVersionV2BridgeDAL.findLatestVersionMany(folderId, deletedSecretIds); + commits.push( + ...deletedSecrets.map(({ secretKey }) => { + const secretId = secretsGroupedByKey[secretKey][0].id; + return { + op: SecretOperations.Delete as const, + ...latestSecretVersions[secretId], + key: secretKey, + secret: secretId, + secretVersion: latestSecretVersions[secretId].id + }; + }) + ); + } + + if (!commits.length) throw new BadRequestError({ message: "Empty commits" }); + + const tagIds = unique(Object.values(commitTagIds).flat()); + const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; + if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); + + const secretApprovalRequest = await secretApprovalRequestDAL.transaction(async (tx) => { + const doc = await secretApprovalRequestDAL.create( + { + folderId, + slug: alphaNumericNanoId(), + policyId: policy.id, + status: "open", + hasMerged: false, + committerUserId: actorId + }, + tx + ); + const approvalCommits = await secretApprovalRequestSecretDAL.insertV2Bridge( + commits.map( + ({ + version, + op, + key, + encryptedComment, + skipMultilineEncoding, + metadata, + reminderNote, + reminderRepeatDays, + encryptedValue, + secretId, + secretVersion + }) => ({ + version, + requestId: doc.id, + op, + secretId, + metadata, + secretVersion, + skipMultilineEncoding, + encryptedValue, + reminderRepeatDays, + reminderNote, + encryptedComment, + key + }) + ), + tx + ); + + const commitsGroupByKey = groupBy(approvalCommits, (i) => i.key); + if (tagIds.length) { + await secretApprovalRequestSecretDAL.insertApprovalSecretTags( + Object.keys(commitTagIds).flatMap((blindIndex) => + commitTagIds[blindIndex] + ? commitTagIds[blindIndex].map((tagId) => ({ + secretId: commitsGroupByKey[blindIndex][0].id, + tagId + })) + : [] + ), + tx + ); + } + return { ...doc, commits: approvalCommits }; + }); + return secretApprovalRequest; + }; + return { generateSecretApprovalRequest, + generateSecretApprovalRequestV2Bridge, mergeSecretApprovalRequest, reviewApproval, updateApprovalStatus, diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-types.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-types.ts index db3dc176b..50a70fd60 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-types.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-types.ts @@ -26,6 +26,23 @@ export type TApprovalUpdateSecret = Partial & { tagIds?: string[]; }; +export type TApprovalCreateSecretV2Bridge = { + secretKey: string; + secretValue?: string; + secretComment?: string; + reminderNote?: string | null; + reminderRepeatDays?: number | null; + skipMultilineEncoding?: boolean; + metadata?: Record; + tagIds?: string[]; +}; + +export type TApprovalUpdateSecretV2Bridge = Partial & { + secretKey: string; + newSecretName?: string; + tagIds?: string[]; +}; + export type TGenerateSecretApprovalRequestDTO = { environment: string; secretPath: string; @@ -37,6 +54,17 @@ export type TGenerateSecretApprovalRequestDTO = { }; } & TProjectPermission; +export type TGenerateSecretApprovalRequestV2BridgeDTO = { + environment: string; + secretPath: string; + policy: TSecretApprovalPolicies; + data: { + [SecretOperations.Create]?: TApprovalCreateSecretV2Bridge[]; + [SecretOperations.Update]?: TApprovalUpdateSecretV2Bridge[]; + [SecretOperations.Delete]?: { secretKey: string }[]; + }; +} & TProjectPermission; + export type TMergeSecretApprovalRequestDTO = { approvalId: string; bypassReason?: string; diff --git a/backend/src/ee/services/secret-replication/secret-replication-service.ts b/backend/src/ee/services/secret-replication/secret-replication-service.ts index 01f7d066c..dc165612c 100644 --- a/backend/src/ee/services/secret-replication/secret-replication-service.ts +++ b/backend/src/ee/services/secret-replication/secret-replication-service.ts @@ -1,4 +1,4 @@ -import { SecretType, TSecrets } from "@app/db/schemas"; +import { SecretType, TSecrets, TSecretsV2 } from "@app/db/schemas"; import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service"; import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal"; import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal"; @@ -13,18 +13,28 @@ import { ActorType } from "@app/services/auth/auth-type"; import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; import { TSecretDALFactory } from "@app/services/secret/secret-dal"; import { fnSecretBulkInsert, fnSecretBulkUpdate } from "@app/services/secret/secret-fns"; +import { + fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, + fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, + getAllNestedSecretReferences, + getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge +} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; import { TSecretQueueFactory, uniqueSecretQueueKey } from "@app/services/secret/secret-queue"; import { SecretOperations } from "@app/services/secret/secret-types"; import { TSecretVersionDALFactory } from "@app/services/secret/secret-version-dal"; import { TSecretVersionTagDALFactory } from "@app/services/secret/secret-version-tag-dal"; -import { TSecretBlindIndexDALFactory } from "@app/services/secret-blind-index/secret-blind-index-dal"; import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; import { ReservedFolders } from "@app/services/secret-folder/secret-folder-types"; import { TSecretImportDALFactory } from "@app/services/secret-import/secret-import-dal"; -import { fnSecretsFromImports } from "@app/services/secret-import/secret-import-fns"; +import { fnSecretsFromImports, fnSecretsV2FromImports } from "@app/services/secret-import/secret-import-fns"; import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; import { MAX_REPLICATION_DEPTH } from "./secret-replication-constants"; +import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; type TSecretReplicationServiceFactoryDep = { secretDAL: Pick< @@ -32,24 +42,42 @@ type TSecretReplicationServiceFactoryDep = { "find" | "findByBlindIndexes" | "insertMany" | "bulkUpdate" | "delete" | "upsertSecretReferences" | "transaction" >; secretVersionDAL: Pick; + secretV2BridgeDAL: Pick< + TSecretV2BridgeDALFactory, + "find" | "findBySecretKeys" | "insertMany" | "bulkUpdate" | "delete" | "upsertSecretReferences" | "transaction" + >; + secretVersionV2BridgeDAL: Pick< + TSecretVersionV2DALFactory, + "find" | "insertMany" | "update" | "findLatestVersionMany" + >; secretImportDAL: Pick; folderDAL: Pick< TSecretFolderDALFactory, "findSecretPathByFolderIds" | "findBySecretPath" | "create" | "findOne" | "findByManySecretPath" >; secretVersionTagDAL: Pick; + secretVersionV2TagBridgeDAL: Pick; secretQueueService: Pick; queueService: Pick; secretApprovalPolicyService: Pick; keyStore: Pick; - secretBlindIndexDAL: Pick; - secretTagDAL: Pick; + secretTagDAL: Pick< + TSecretTagDALFactory, + | "findManyTagsById" + | "saveTagsToSecret" + | "deleteTagsManySecret" + | "find" + | "saveTagsToSecretV2" + | "deleteTagsToSecretV2" + >; secretApprovalRequestDAL: Pick; secretApprovalRequestSecretDAL: Pick< TSecretApprovalRequestSecretDALFactory, - "insertMany" | "insertApprovalSecretTags" + "insertMany" | "insertApprovalSecretTags" | "insertV2Bridge" >; + projectBotService: Pick; + kmsService: Pick; }; export type TSecretReplicationServiceFactory = ReturnType; @@ -90,9 +118,13 @@ export const secretReplicationServiceFactory = ({ secretApprovalRequestSecretDAL, secretApprovalRequestDAL, secretQueueService, - projectBotService + projectBotService, + secretVersionV2TagBridgeDAL, + secretVersionV2BridgeDAL, + secretV2BridgeDAL, + kmsService }: TSecretReplicationServiceFactoryDep) => { - const getReplicatedSecrets = ( + const $getReplicatedSecrets = ( botKey: string, localSecrets: TSecrets[], importedSecrets: { secrets: TSecrets[] }[] @@ -119,6 +151,25 @@ export const secretReplicationServiceFactory = ({ return secrets; }; + const $getReplicatedSecretsV2 = ( + localSecrets: (TSecretsV2 & { secretKey: string; secretValue?: string })[], + importedSecrets: { secrets: (TSecretsV2 & { secretKey: string; secretValue?: string })[] }[] + ) => { + const deDupe = new Set(); + const secrets = [...localSecrets]; + + for (let i = importedSecrets.length - 1; i >= 0; i = -1) { + importedSecrets[i].secrets.forEach((el) => { + if (deDupe.has(el.key)) { + return; + } + deDupe.add(el.key); + secrets.push(el); + }); + } + return secrets; + }; + // IMPORTANT NOTE BEFORE READING THE FUNCTION // SOURCE - Where secrets are copied from // DESTINATION - Where the replicated imports that points to SOURCE from Destination @@ -139,6 +190,7 @@ export const secretReplicationServiceFactory = ({ const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, secretPath); if (!folder) return; + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); // the the replicated imports made to the source. These are the destinations const destinationSecretImports = await secretImportDAL.find({ @@ -191,8 +243,270 @@ export const secretReplicationServiceFactory = ({ : destinationReplicatedSecretImports; if (!destinationReplicatedSecretImports.length) return; - const botKey = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + // these are the secrets to be added in replicated folders + const sourceLocalSecrets = await secretV2BridgeDAL.find({ folderId: folder.id, type: SecretType.Shared }); + const sourceSecretImports = await secretImportDAL.find({ folderId: folder.id }); + const sourceImportedSecrets = await fnSecretsV2FromImports({ + allowedImports: sourceSecretImports, + secretDAL: secretV2BridgeDAL, + folderDAL, + secretImportDAL, + decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined) + }); + // secrets that gets replicated across imports + const sourceDecryptedLocalSecrets = sourceLocalSecrets.map((el) => ({ + ...el, + secretKey: el.key, + secretValue: el.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() + : undefined + })); + const sourceSecrets = $getReplicatedSecretsV2(sourceDecryptedLocalSecrets, sourceImportedSecrets); + const sourceSecretsGroupByKey = groupBy(sourceSecrets, (i) => i.key); + + const lock = await keyStore.acquireLock( + [getReplicationKeyLockPrefix(projectId, environmentSlug, secretPath)], + 5000 + ); + + try { + /* eslint-disable no-await-in-loop */ + for (const destinationSecretImport of destinationReplicatedSecretImports) { + try { + const hasJobCompleted = await keyStore.getItem( + keystoreReplicationSuccessKey(job.id as string, destinationSecretImport.id), + KeyStorePrefixes.SecretReplication + ); + if (hasJobCompleted) { + logger.info( + { jobId: job.id, importId: destinationSecretImport.id }, + "Skipping this job as this has been successfully replicated." + ); + // eslint-disable-next-line + continue; + } + + const [destinationFolder] = await folderDAL.findSecretPathByFolderIds(projectId, [ + destinationSecretImport.folderId + ]); + if (!destinationFolder) throw new BadRequestError({ message: "Imported folder not found" }); + + let destinationReplicationFolder = await folderDAL.findOne({ + parentId: destinationFolder.id, + name: getReplicationFolderName(destinationSecretImport.id), + isReserved: true + }); + if (!destinationReplicationFolder) { + destinationReplicationFolder = await folderDAL.create({ + parentId: destinationFolder.id, + name: getReplicationFolderName(destinationSecretImport.id), + envId: destinationFolder.envId, + isReserved: true + }); + } + const destinationReplicationFolderId = destinationReplicationFolder.id; + + const destinationLocalSecretsFromDB = await secretV2BridgeDAL.find({ + folderId: destinationReplicationFolderId + }); + const destinationLocalSecrets = destinationLocalSecretsFromDB.map((el) => ({ + ...el, + secretKey: el.key, + secretValue: el.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() + : undefined + })); + + const destinationLocalSecretsGroupedByKey = groupBy(destinationLocalSecrets, (i) => i.key); + + const locallyCreatedSecrets = sourceSecrets + .filter(({ key }) => !destinationLocalSecretsGroupedByKey[key]?.[0]) + .map((el) => ({ ...el, operation: SecretOperations.Create })); // rewrite update ops to create + + const locallyUpdatedSecrets = sourceSecrets + .filter( + ({ key, secretKey, secretValue }) => + destinationLocalSecretsGroupedByKey[key]?.[0] && + // if key or value changed + (destinationLocalSecretsGroupedByKey[key]?.[0]?.secretKey !== secretKey || + destinationLocalSecretsGroupedByKey[key]?.[0]?.secretValue !== secretValue) + ) + .map((el) => ({ ...el, operation: SecretOperations.Update })); // rewrite update ops to create + + const locallyDeletedSecrets = destinationLocalSecrets + .filter(({ key }) => !sourceSecretsGroupByKey[key]?.[0]) + .map((el) => ({ ...el, operation: SecretOperations.Delete })); + + const isEmtpy = + locallyCreatedSecrets.length + locallyUpdatedSecrets.length + locallyDeletedSecrets.length === 0; + // eslint-disable-next-line + if (isEmtpy) continue; + + const policy = await secretApprovalPolicyService.getSecretApprovalPolicy( + projectId, + destinationFolder.environmentSlug, + destinationFolder.path + ); + // this means it should be a approval request rather than direct replication + if (policy && actor === ActorType.USER) { + const localSecretsLatestVersions = destinationLocalSecrets.map(({ id }) => id); + const latestSecretVersions = await secretVersionV2BridgeDAL.findLatestVersionMany( + destinationReplicationFolderId, + localSecretsLatestVersions + ); + await secretApprovalRequestDAL.transaction(async (tx) => { + const approvalRequestDoc = await secretApprovalRequestDAL.create( + { + folderId: destinationReplicationFolderId, + slug: alphaNumericNanoId(), + policyId: policy.id, + status: "open", + hasMerged: false, + committerUserId: actorId, + isReplicated: true + }, + tx + ); + const commits = locallyCreatedSecrets + .concat(locallyUpdatedSecrets) + .concat(locallyDeletedSecrets) + .map((doc) => { + const { operation } = doc; + const localSecret = destinationLocalSecretsGroupedByKey[doc.key]?.[0]; + + return { + op: operation, + requestId: approvalRequestDoc.id, + metadata: doc.metadata, + key: doc.key, + encryptedValue: doc.encryptedValue, + encryptedComment: doc.encryptedComment, + skipMultilineEncoding: doc.skipMultilineEncoding, + // except create operation other two needs the secret id and version id + ...(operation !== SecretOperations.Create + ? { secretId: localSecret.id, secretVersion: latestSecretVersions[localSecret.id].id } + : {}) + }; + }); + const approvalCommits = await secretApprovalRequestSecretDAL.insertV2Bridge(commits, tx); + + return { ...approvalRequestDoc, commits: approvalCommits }; + }); + } else { + await secretDAL.transaction(async (tx) => { + if (locallyCreatedSecrets.length) { + await fnSecretV2BridgeBulkInsert({ + folderId: destinationReplicationFolderId, + secretVersionDAL: secretVersionV2BridgeDAL, + secretDAL: secretV2BridgeDAL, + tx, + secretTagDAL, + secretVersionTagDAL: secretVersionV2TagBridgeDAL, + inputSecrets: locallyCreatedSecrets.map((doc) => { + return { + type: doc.type, + metadata: doc.metadata, + key: doc.key, + encryptedValue: doc.encryptedValue, + encryptedComment: doc.encryptedComment, + skipMultilineEncoding: doc.skipMultilineEncoding, + references: doc.secretValue ? getAllNestedSecretReferencesV2Bridge(doc.secretValue) : [] + }; + }) + }); + } + if (locallyUpdatedSecrets.length) { + await fnSecretV2BridgeBulkUpdate({ + folderId: destinationReplicationFolderId, + secretVersionDAL: secretVersionV2BridgeDAL, + secretDAL: secretV2BridgeDAL, + tx, + secretTagDAL, + secretVersionTagDAL: secretVersionV2TagBridgeDAL, + inputSecrets: locallyUpdatedSecrets.map((doc) => { + return { + filter: { + folderId: destinationReplicationFolderId, + id: destinationLocalSecretsGroupedByKey[doc.key][0].id + }, + data: { + type: doc.type, + metadata: doc.metadata, + key: doc.key, + encryptedValue: doc.encryptedValue as Buffer, + encryptedComment: doc.encryptedComment, + skipMultilineEncoding: doc.skipMultilineEncoding, + references: doc.secretValue ? getAllNestedSecretReferencesV2Bridge(doc.secretValue) : [] + } + }; + }) + }); + } + if (locallyDeletedSecrets.length) { + await secretDAL.delete( + { + $in: { + id: locallyDeletedSecrets.map(({ id }) => id) + }, + folderId: destinationReplicationFolderId + }, + tx + ); + } + }); + + await secretQueueService.syncSecrets({ + projectId, + secretPath: destinationFolder.path, + environmentSlug: destinationFolder.environmentSlug, + actorId, + actor, + _depth: depth + 1, + _deDupeReplicationQueue: deDupeReplicationQueue, + _deDupeQueue: deDupeQueue + }); + } + + // this is used to avoid multiple times generating secret approval by failed one + await keyStore.setItemWithExpiry( + keystoreReplicationSuccessKey(job.id as string, destinationSecretImport.id), + SECRET_IMPORT_SUCCESS_LOCK, + 1, + KeyStorePrefixes.SecretReplication + ); + + await secretImportDAL.updateById(destinationSecretImport.id, { + lastReplicated: new Date(), + replicationStatus: null, + isReplicationSuccess: true + }); + } catch (err) { + logger.error( + err, + `Failed to replicate secret with import id=[${destinationSecretImport.id}] env=[${destinationSecretImport.importEnv.slug}] path=[${destinationSecretImport.importPath}]` + ); + await secretImportDAL.updateById(destinationSecretImport.id, { + lastReplicated: new Date(), + replicationStatus: (err as Error)?.message.slice(0, 500), + isReplicationSuccess: false + }); + } + } + /* eslint-enable no-await-in-loop */ + } finally { + await lock.release(); + logger.info(job.data, "Replication finished"); + } + return; + } + + if (!botKey) throw new BadRequestError({ message: "Bot not found" }); // these are the secrets to be added in replicated folders const sourceLocalSecrets = await secretDAL.find({ folderId: folder.id, type: SecretType.Shared }); const sourceSecretImports = await secretImportDAL.find({ folderId: folder.id }); @@ -203,7 +517,7 @@ export const secretReplicationServiceFactory = ({ secretImportDAL }); // secrets that gets replicated across imports - const sourceSecrets = getReplicatedSecrets(botKey, sourceLocalSecrets, sourceImportedSecrets); + const sourceSecrets = $getReplicatedSecrets(botKey, sourceLocalSecrets, sourceImportedSecrets); const sourceSecretsGroupByBlindIndex = groupBy(sourceSecrets, (i) => i.secretBlindIndex as string); const lock = await keyStore.acquireLock( @@ -372,7 +686,8 @@ export const secretReplicationServiceFactory = ({ secretCommentIV: doc.secretCommentIV, secretCommentTag: doc.secretCommentTag, secretCommentCiphertext: doc.secretCommentCiphertext, - skipMultilineEncoding: doc.skipMultilineEncoding + skipMultilineEncoding: doc.skipMultilineEncoding, + references: getAllNestedSecretReferences(doc.secretValue) }; }) }); @@ -407,7 +722,8 @@ export const secretReplicationServiceFactory = ({ secretCommentIV: doc.secretCommentIV, secretCommentTag: doc.secretCommentTag, secretCommentCiphertext: doc.secretCommentCiphertext, - skipMultilineEncoding: doc.skipMultilineEncoding + skipMultilineEncoding: doc.skipMultilineEncoding, + references: getAllNestedSecretReferences(doc.secretValue) } }; }) diff --git a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts index 3e1142969..8487d9d8c 100644 --- a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts +++ b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts @@ -1,6 +1,6 @@ import { ForbiddenError, subject } from "@casl/ability"; -import { TableName, TSecretTagJunctionInsert } from "@app/db/schemas"; +import { TableName, TSecretTagJunctionInsert, TSecretV2TagJunctionInsert } from "@app/db/schemas"; import { BadRequestError, InternalServerError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; @@ -24,16 +24,24 @@ import { TSnapshotDALFactory } from "./snapshot-dal"; import { TSnapshotFolderDALFactory } from "./snapshot-folder-dal"; import { TSnapshotSecretDALFactory } from "./snapshot-secret-dal"; import { getFullFolderPath } from "./snapshot-service-fns"; +import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; +import { TSnapshotSecretV2DALFactory } from "./snapshot-secret-v2-dal"; +import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; type TSecretSnapshotServiceFactoryDep = { snapshotDAL: TSnapshotDALFactory; snapshotSecretDAL: TSnapshotSecretDALFactory; + snapshotSecretV2BridgeDAL: TSnapshotSecretV2DALFactory; snapshotFolderDAL: TSnapshotFolderDALFactory; secretVersionDAL: Pick; + secretVersionV2BridgeDAL: Pick; folderVersionDAL: Pick; secretDAL: Pick; - secretTagDAL: Pick; + secretV2BridgeDAL: Pick; + secretTagDAL: Pick; secretVersionTagDAL: Pick; + secretVersionV2TagBridgeDAL: Pick; folderDAL: Pick; permissionService: Pick; licenseService: Pick; @@ -52,7 +60,11 @@ export const secretSnapshotServiceFactory = ({ permissionService, licenseService, secretTagDAL, - secretVersionTagDAL + secretVersionTagDAL, + secretVersionV2BridgeDAL, + secretV2BridgeDAL, + snapshotSecretV2BridgeDAL, + secretVersionV2TagBridgeDAL }: TSecretSnapshotServiceFactoryDep) => { const projectSecretSnapshotCount = async ({ environment, @@ -118,7 +130,7 @@ export const secretSnapshotServiceFactory = ({ }; const getSnapshotData = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TGetSnapshotDataDTO) => { - const snapshot = await snapshotDAL.findSecretSnapshotDataById(id); + const snapshot = await snapshotDAL.findById(id); if (!snapshot) throw new BadRequestError({ message: "Snapshot not found" }); const { permission } = await permissionService.getProjectPermission( actor, @@ -127,26 +139,73 @@ export const secretSnapshotServiceFactory = ({ actorAuthMethod, actorOrgId ); + ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback); + const shouldUseBridge = snapshot.projectVersion === 3; + let snapshotDetails; + if (shouldUseBridge) { + snapshotDetails = await snapshotDAL.findSecretSnapshotV2DataById(id); + } else { + snapshotDetails = await snapshotDAL.findSecretSnapshotDataById(id); + } const fullFolderPath = await getFullFolderPath({ folderDAL, - folderId: snapshot.folderId, - envId: snapshot.environment.id + folderId: snapshotDetails.folderId, + envId: snapshotDetails.environment.id }); // We need to check if the user has access to the secrets in the folder. If we don't do this, a user could theoretically access snapshot secret values even if they don't have read access to the secrets in the folder. ForbiddenError.from(permission).throwUnlessCan( ProjectPermissionActions.Read, - subject(ProjectPermissionSub.Secrets, { environment: snapshot.environment.slug, secretPath: fullFolderPath }) + subject(ProjectPermissionSub.Secrets, { + environment: snapshotDetails.environment.slug, + secretPath: fullFolderPath + }) ); - return snapshot; + return snapshotDetails; }; - const performSnapshot = async (folderId: string) => { + const performSnapshot = async (folderId: string, shouldUseSecretV2Bridge: boolean) => { try { if (!licenseService.isValidLicense) throw new InternalServerError({ message: "Invalid license" }); + if (shouldUseSecretV2Bridge) { + const snapshot = await snapshotDAL.transaction(async (tx) => { + const folder = await folderDAL.findById(folderId, tx); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); + + const secretVersions = await secretVersionV2BridgeDAL.findLatestVersionByFolderId(folderId, tx); + const folderVersions = await folderVersionDAL.findLatestVersionByFolderId(folderId, tx); + const newSnapshot = await snapshotDAL.create( + { + folderId, + envId: folder.environment.envId, + parentFolderId: folder.parentId + }, + tx + ); + const snapshotSecrets = await snapshotSecretV2BridgeDAL.insertMany( + secretVersions.map(({ id }) => ({ + secretVersionId: id, + envId: folder.environment.envId, + snapshotId: newSnapshot.id + })), + tx + ); + const snapshotFolders = await snapshotFolderDAL.insertMany( + folderVersions.map(({ id }) => ({ + folderVersionId: id, + envId: folder.environment.envId, + snapshotId: newSnapshot.id + })), + tx + ); + + return { ...newSnapshot, secrets: snapshotSecrets, folder: snapshotFolders }; + }); + return snapshot; + } const snapshot = await snapshotDAL.transaction(async (tx) => { const folder = await folderDAL.findById(folderId, tx); @@ -199,6 +258,7 @@ export const secretSnapshotServiceFactory = ({ }: TRollbackSnapshotDTO) => { const snapshot = await snapshotDAL.findById(snapshotId); if (!snapshot) throw new BadRequestError({ message: "Snapshot not found" }); + const shouldUseBridge = snapshot.projectVersion === 3; const { permission } = await permissionService.getProjectPermission( actor, @@ -212,6 +272,117 @@ export const secretSnapshotServiceFactory = ({ ProjectPermissionSub.SecretRollback ); + if (shouldUseBridge) { + const rollback = await snapshotDAL.transaction(async (tx) => { + const rollbackSnaps = await snapshotDAL.findRecursivelySnapshotsV2Bridge(snapshot.id, tx); + // this will remove all secrets in current folder + const deletedTopLevelSecs = await secretV2BridgeDAL.delete({ folderId: snapshot.folderId }, tx); + const deletedTopLevelSecsGroupById = groupBy(deletedTopLevelSecs, (item) => item.id); + // this will remove all secrets and folders on child + // due to sql foreign key and link list connection removing the folders removes everything below too + const deletedFolders = await folderDAL.delete({ parentId: snapshot.folderId, isReserved: false }, tx); + const deletedTopLevelFolders = groupBy( + deletedFolders.filter(({ parentId }) => parentId === snapshot.folderId), + (item) => item.id + ); + const folders = await folderDAL.insertMany( + rollbackSnaps.flatMap(({ folderVersion, folderId }) => + folderVersion.map(({ name, id, latestFolderVersion }) => ({ + envId: snapshot.envId, + id, + // this means don't bump up the version if not root folder + // because below ones can be same version as nothing changed + version: deletedTopLevelFolders[folderId] ? latestFolderVersion + 1 : latestFolderVersion, + name, + parentId: folderId + })) + ), + tx + ); + const secrets = await secretV2BridgeDAL.insertMany( + rollbackSnaps.flatMap(({ secretVersions, folderId }) => + secretVersions.map( + ({ latestSecretVersion, version, updatedAt, createdAt, secretId, envId, id, tags, ...el }) => ({ + ...el, + id: secretId, + version: deletedTopLevelSecsGroupById[secretId] ? latestSecretVersion + 1 : latestSecretVersion, + folderId + }) + ) + ), + tx + ); + const secretTagsToBeInsert: TSecretV2TagJunctionInsert[] = []; + const secretVerTagToBeInsert: Record = {}; + rollbackSnaps.forEach(({ secretVersions }) => { + secretVersions.forEach((secVer) => { + secVer.tags.forEach((tag) => { + secretTagsToBeInsert.push({ secrets_v2Id: secVer.secretId, secret_tagsId: tag.id }); + if (!secretVerTagToBeInsert?.[secVer.secretId]) secretVerTagToBeInsert[secVer.secretId] = []; + secretVerTagToBeInsert[secVer.secretId].push(tag.id); + }); + }); + }); + await secretTagDAL.saveTagsToSecretV2(secretTagsToBeInsert, tx); + const folderVersions = await folderVersionDAL.insertMany( + folders.map(({ version, name, id, envId }) => ({ + name, + version, + folderId: id, + envId + })), + tx + ); + const secretVersions = await secretVersionV2BridgeDAL.insertMany( + secrets.map(({ id, updatedAt, createdAt, ...el }) => ({ ...el, secretId: id })), + tx + ); + await secretVersionV2TagBridgeDAL.insertMany( + secretVersions.flatMap(({ secretId, id }) => + secretVerTagToBeInsert?.[secretId]?.length + ? secretVerTagToBeInsert[secretId].map((tagId) => ({ + [`${TableName.SecretTag}Id` as const]: tagId, + [`${TableName.SecretVersionV2}Id` as const]: id + })) + : [] + ), + tx + ); + const newSnapshot = await snapshotDAL.create( + { + folderId: snapshot.folderId, + envId: snapshot.envId, + parentFolderId: snapshot.parentFolderId + }, + tx + ); + const snapshotSecrets = await snapshotSecretV2BridgeDAL.insertMany( + secretVersions + .filter(({ secretId }) => Boolean(deletedTopLevelSecsGroupById?.[secretId])) + .map(({ id }) => ({ + secretVersionId: id, + envId: newSnapshot.envId, + snapshotId: newSnapshot.id + })), + tx + ); + const snapshotFolders = await snapshotFolderDAL.insertMany( + folderVersions + .filter(({ folderId }) => Boolean(deletedTopLevelFolders?.[folderId])) + .map(({ id }) => ({ + folderVersionId: id, + envId: newSnapshot.envId, + snapshotId: newSnapshot.id + })), + tx + ); + + return { ...newSnapshot, snapshotSecrets, snapshotFolders }; + }); + + return rollback; + } + const rollback = await snapshotDAL.transaction(async (tx) => { const rollbackSnaps = await snapshotDAL.findRecursivelySnapshots(snapshot.id, tx); // this will remove all secrets in current folder diff --git a/backend/src/ee/services/secret-snapshot/snapshot-dal.ts b/backend/src/ee/services/secret-snapshot/snapshot-dal.ts index a16b4548d..e53496127 100644 --- a/backend/src/ee/services/secret-snapshot/snapshot-dal.ts +++ b/backend/src/ee/services/secret-snapshot/snapshot-dal.ts @@ -4,11 +4,13 @@ import { Knex } from "knex"; import { TDbClient } from "@app/db"; import { SecretVersionsSchema, + SecretVersionsV2Schema, TableName, TSecretFolderVersions, TSecretSnapshotFolders, TSecretSnapshots, - TSecretVersions + TSecretVersions, + TSecretVersionsV2 } from "@app/db/schemas"; import { DatabaseError } from "@app/lib/errors"; import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex"; @@ -24,12 +26,14 @@ export const snapshotDALFactory = (db: TDbClient) => { const data = await (tx || db.replicaNode())(TableName.Snapshot) .where(`${TableName.Snapshot}.id`, id) .join(TableName.Environment, `${TableName.Snapshot}.envId`, `${TableName.Environment}.id`) + .join(TableName.Project, `${TableName.Environment}.projectId`, `${TableName.Project}.id`) .select(selectAllTableCols(TableName.Snapshot)) .select( db.ref("id").withSchema(TableName.Environment).as("envId"), db.ref("projectId").withSchema(TableName.Environment), db.ref("name").withSchema(TableName.Environment).as("envName"), - db.ref("slug").withSchema(TableName.Environment).as("envSlug") + db.ref("slug").withSchema(TableName.Environment).as("envSlug"), + db.ref("version").withSchema(TableName.Project).as("projectVersion") ) .first(); if (data) { @@ -149,6 +153,101 @@ export const snapshotDALFactory = (db: TDbClient) => { } }; + const findSecretSnapshotV2DataById = async (snapshotId: string, tx?: Knex) => { + try { + const data = await (tx || db.replicaNode())(TableName.Snapshot) + .where(`${TableName.Snapshot}.id`, snapshotId) + .join(TableName.Environment, `${TableName.Snapshot}.envId`, `${TableName.Environment}.id`) + .leftJoin(TableName.SnapshotSecretV2, `${TableName.Snapshot}.id`, `${TableName.SnapshotSecretV2}.snapshotId`) + .leftJoin( + TableName.SecretVersionV2, + `${TableName.SnapshotSecretV2}.secretVersionId`, + `${TableName.SecretVersionV2}.id` + ) + .leftJoin( + TableName.SecretVersionV2Tag, + `${TableName.SecretVersionV2Tag}.${TableName.SecretVersionV2}Id`, + `${TableName.SecretVersionV2}.id` + ) + .leftJoin( + TableName.SecretTag, + `${TableName.SecretVersionV2Tag}.${TableName.SecretTag}Id`, + `${TableName.SecretTag}.id` + ) + .leftJoin(TableName.SnapshotFolder, `${TableName.SnapshotFolder}.snapshotId`, `${TableName.Snapshot}.id`) + .leftJoin( + TableName.SecretFolderVersion, + `${TableName.SnapshotFolder}.folderVersionId`, + `${TableName.SecretFolderVersion}.id` + ) + .select(selectAllTableCols(TableName.SecretVersionV2)) + .select( + db.ref("id").withSchema(TableName.Snapshot).as("snapshotId"), + db.ref("createdAt").withSchema(TableName.Snapshot).as("snapshotCreatedAt"), + db.ref("updatedAt").withSchema(TableName.Snapshot).as("snapshotUpdatedAt"), + db.ref("id").withSchema(TableName.Environment).as("envId"), + db.ref("name").withSchema(TableName.Environment).as("envName"), + db.ref("slug").withSchema(TableName.Environment).as("envSlug"), + db.ref("projectId").withSchema(TableName.Environment), + db.ref("name").withSchema(TableName.SecretFolderVersion).as("folderVerName"), + db.ref("folderId").withSchema(TableName.SecretFolderVersion).as("folderVerId"), + db.ref("id").withSchema(TableName.SecretTag).as("tagId"), + db.ref("id").withSchema(TableName.SecretVersionV2Tag).as("tagVersionId"), + db.ref("color").withSchema(TableName.SecretTag).as("tagColor"), + db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"), + db.ref("name").withSchema(TableName.SecretTag).as("tagName") + ); + return sqlNestRelationships({ + data, + key: "snapshotId", + parentMapper: ({ + snapshotId: id, + folderId, + projectId, + envId, + envSlug, + envName, + snapshotCreatedAt: createdAt, + snapshotUpdatedAt: updatedAt + }) => ({ + id, + folderId, + projectId, + createdAt, + updatedAt, + environment: { id: envId, slug: envSlug, name: envName } + }), + childrenMapper: [ + { + key: "id", + label: "secretVersions" as const, + mapper: (el) => SecretVersionsV2Schema.parse(el), + childrenMapper: [ + { + key: "tagVersionId", + label: "tags" as const, + mapper: ({ tagId: id, tagName: name, tagSlug: slug, tagColor: color, tagVersionId: vId }) => ({ + id, + name, + slug, + color, + vId + }) + } + ] + }, + { + key: "folderVerId", + label: "folderVersion" as const, + mapper: ({ folderVerId: id, folderVerName: name }) => ({ id, name }) + } + ] + })?.[0]; + } catch (error) { + throw new DatabaseError({ error, name: "FindSecretSnapshotDataById" }); + } + }; + // this is used for rollback // from a starting snapshot it will collect all the secrets and folder of that // then it will start go through recursively the below folders latest snapshots then their child folder snapshot until leaf node @@ -304,6 +403,161 @@ export const snapshotDALFactory = (db: TDbClient) => { } }; + // this is used for rollback + // from a starting snapshot it will collect all the secrets and folder of that + // then it will start go through recursively the below folders latest snapshots then their child folder snapshot until leaf node + // the recursive part find all snapshot id + // then joins with respective secrets and folder + const findRecursivelySnapshotsV2Bridge = async (snapshotId: string, tx?: Knex) => { + try { + const data = await (tx || db) + .withRecursive("parent", (qb) => { + void qb + .from(TableName.Snapshot) + .leftJoin( + TableName.SnapshotFolder, + `${TableName.SnapshotFolder}.snapshotId`, + `${TableName.Snapshot}.id` + ) + .leftJoin( + TableName.SecretFolderVersion, + `${TableName.SnapshotFolder}.folderVersionId`, + `${TableName.SecretFolderVersion}.id` + ) + .select(selectAllTableCols(TableName.Snapshot)) + .select({ depth: 1 }) + .select( + db.ref("name").withSchema(TableName.SecretFolderVersion).as("folderVerName"), + db.ref("folderId").withSchema(TableName.SecretFolderVersion).as("folderVerId") + ) + .where(`${TableName.Snapshot}.id`, snapshotId) + .union( + (cb) => + void cb + .select(selectAllTableCols(TableName.Snapshot)) + .select({ depth: db.raw("parent.depth + 1") }) + .select( + db.ref("name").withSchema(TableName.SecretFolderVersion).as("folderVerName"), + db.ref("folderId").withSchema(TableName.SecretFolderVersion).as("folderVerId") + ) + .from(TableName.Snapshot) + .join( + db(TableName.Snapshot).groupBy("folderId").max("createdAt").select("folderId").as("latestVersion"), + `${TableName.Snapshot}.createdAt`, + "latestVersion.max" + ) + .leftJoin( + TableName.SnapshotFolder, + `${TableName.SnapshotFolder}.snapshotId`, + `${TableName.Snapshot}.id` + ) + .leftJoin( + TableName.SecretFolderVersion, + `${TableName.SnapshotFolder}.folderVersionId`, + `${TableName.SecretFolderVersion}.id` + ) + .join("parent", "parent.folderVerId", `${TableName.Snapshot}.folderId`) + ); + }) + .orderBy("depth", "asc") + .from("parent") + .leftJoin(TableName.SnapshotSecretV2, `parent.id`, `${TableName.SnapshotSecretV2}.snapshotId`) + .leftJoin( + TableName.SecretVersionV2, + `${TableName.SnapshotSecretV2}.secretVersionId`, + `${TableName.SecretVersionV2}.id` + ) + .leftJoin( + TableName.SecretVersionV2Tag, + `${TableName.SecretVersionV2Tag}.${TableName.SecretVersionV2}Id`, + `${TableName.SecretVersionV2}.id` + ) + .leftJoin( + TableName.SecretTag, + `${TableName.SecretVersionV2Tag}.${TableName.SecretTag}Id`, + `${TableName.SecretTag}.id` + ) + .leftJoin<{ latestSecretVersion: number }>( + (tx || db)(TableName.SecretVersionV2) + .groupBy("secretId") + .select("secretId") + .max("version") + .as("secGroupByMaxVersion"), + `${TableName.SecretVersionV2}.secretId`, + "secGroupByMaxVersion.secretId" + ) + .leftJoin<{ latestFolderVersion: number }>( + (tx || db)(TableName.SecretFolderVersion) + .groupBy("folderId") + .select("folderId") + .max("version") + .as("folderGroupByMaxVersion"), + `parent.folderId`, + "folderGroupByMaxVersion.folderId" + ) + .select(selectAllTableCols(TableName.SecretVersionV2)) + .select( + db.ref("id").withSchema("parent").as("snapshotId"), + db.ref("folderId").withSchema("parent").as("snapshotFolderId"), + db.ref("parentFolderId").withSchema("parent").as("snapshotParentFolderId"), + db.ref("folderVerName").withSchema("parent"), + db.ref("folderVerId").withSchema("parent"), + db.ref("max").withSchema("secGroupByMaxVersion").as("latestSecretVersion"), + db.ref("max").withSchema("folderGroupByMaxVersion").as("latestFolderVersion"), + db.ref("id").withSchema(TableName.SecretTag).as("tagId"), + db.ref("id").withSchema(TableName.SecretVersionTag).as("tagVersionId"), + db.ref("color").withSchema(TableName.SecretTag).as("tagColor"), + db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"), + db.ref("name").withSchema(TableName.SecretTag).as("tagName") + ); + + const formated = sqlNestRelationships({ + data, + key: "snapshotId", + parentMapper: ({ snapshotId: id, snapshotFolderId: folderId, snapshotParentFolderId: parentFolderId }) => ({ + id, + folderId, + parentFolderId + }), + childrenMapper: [ + { + key: "id", + label: "secretVersions" as const, + mapper: (el) => ({ + ...SecretVersionsV2Schema.parse(el), + latestSecretVersion: el.latestSecretVersion as number + }), + childrenMapper: [ + { + key: "tagVersionId", + label: "tags" as const, + mapper: ({ tagId: id, tagName: name, tagSlug: slug, tagColor: color, tagVersionId: vId }) => ({ + id, + name, + slug, + color, + vId + }) + } + ] + }, + { + key: "folderVerId", + label: "folderVersion" as const, + mapper: ({ folderVerId: id, folderVerName: name, latestFolderVersion }) => ({ + id, + name, + latestFolderVersion: latestFolderVersion as number + }) + } + ] + }); + return formated; + } catch (error) { + throw new DatabaseError({ error, name: "FindRecursivelySnapshots" }); + } + }; + // instead of copying all child folders // we will take the latest snapshot of those folders // when we need to rollback we will pull from these snapshots @@ -470,8 +724,10 @@ export const snapshotDALFactory = (db: TDbClient) => { findById, findLatestSnapshotByFolderId, findRecursivelySnapshots, + findRecursivelySnapshotsV2Bridge, countOfSnapshotsByFolderId, findSecretSnapshotDataById, + findSecretSnapshotV2DataById, pruneExcessSnapshots }; }; diff --git a/backend/src/ee/services/secret-snapshot/snapshot-secret-v2-dal.ts b/backend/src/ee/services/secret-snapshot/snapshot-secret-v2-dal.ts new file mode 100644 index 000000000..6d5f5896d --- /dev/null +++ b/backend/src/ee/services/secret-snapshot/snapshot-secret-v2-dal.ts @@ -0,0 +1,10 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TSnapshotSecretV2DALFactory = ReturnType; + +export const snapshotSecretV2DALFactory = (db: TDbClient) => { + const snapshotSecretOrm = ormify(db, TableName.SnapshotSecretV2); + return snapshotSecretOrm; +}; diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 0e8e94682..d988d9aa8 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -22,9 +22,11 @@ import { TInternalKmsDALFactory } from "./internal-kms-dal"; import { TKmsKeyDALFactory } from "./kms-key-dal"; import { TKmsRootConfigDALFactory } from "./kms-root-config-dal"; import { + KmsDataKey, TDecryptWithKeyDTO, TDecryptWithKmsDTO, TEncryptionWithKeyDTO, + TEncryptWithKmsDataKeyDTO, TEncryptWithKmsDTO, TGenerateKMSDTO } from "./kms-types"; @@ -678,6 +680,37 @@ export const kmsServiceFactory = ({ return kms; }; + const $getDataKey = async (dto: TEncryptWithKmsDataKeyDTO) => { + switch (dto.type) { + case KmsDataKey.SecretManager: { + return getProjectSecretManagerKmsDataKey(dto.projectId); + } + default: { + return getProjectSecretManagerKmsDataKey(dto.orgId); + } + } + }; + + const createCipherPairWithDataKey = async (encryptionContext: TEncryptWithKmsDataKeyDTO) => { + const dataKey = await $getDataKey(encryptionContext); + const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); + return { + encryptor: ({ plainText }: Pick) => { + const encryptedPlainTextBlob = cipher.encrypt(plainText, dataKey); + + // Buffer#1 encrypted text + Buffer#2 version number + const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3 + const cipherTextBlob = Buffer.concat([encryptedPlainTextBlob, versionBlob]); + return { cipherTextBlob }; + }, + decryptor: ({ cipherTextBlob: versionedCipherTextBlob }: Pick) => { + const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH); + const decryptedBlob = cipher.decrypt(cipherTextBlob, dataKey); + return decryptedBlob; + } + }; + }; + const startService = async () => { const appCfg = getConfig(); // This will switch to a seal process and HMS flow in future @@ -738,6 +771,7 @@ export const kmsServiceFactory = ({ updateProjectSecretManagerKmsKey, getProjectKeyBackup, loadProjectKeyBackup, - getKmsById + getKmsById, + createCipherPairWithDataKey }; }; diff --git a/backend/src/services/kms/kms-types.ts b/backend/src/services/kms/kms-types.ts index 5ba6c1343..335c67868 100644 --- a/backend/src/services/kms/kms-types.ts +++ b/backend/src/services/kms/kms-types.ts @@ -26,3 +26,18 @@ export type TDecryptWithKeyDTO = { key: Buffer; cipherTextBlob: Buffer; }; + +export enum KmsDataKey { + Organization, + SecretManager + // CertificateManager +} + +export type TEncryptWithKmsDataKeyDTO = + | { type: KmsDataKey.Organization; orgId: string } + | { type: KmsDataKey.SecretManager; projectId: string }; +// akhilmhdh: not implemented yet +// | { +// type: KmsDataKey.CertificateManager; +// projectId: string; +// }; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts index 11e3c81c9..24fbff609 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts @@ -8,6 +8,7 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; import { TFnSecretBulkDelete, TFnSecretBulkInsert, TFnSecretBulkUpdate } from "./secret-v2-bridge-types"; +import { TKmsServiceFactory } from "../kms/kms-service"; const INTERPOLATION_SYNTAX_REG = /\${([^}]+)}/g; @@ -551,3 +552,14 @@ export const reshapeBridgeSecret = ( createdAt: secret.createdAt, updatedAt: secret.updatedAt }); + +export const secretEncryptionHelper = { + encryptValue: (encryptor: Awaited>, value?: string) => { + if (typeof value === "undefined") return; + return encryptor({ plainText: Buffer.from(value) }).cipherTextBlob; + }, + decryptValue: (decryptor: Awaited>, value?: Buffer | null) => { + if (!value) return; + return decryptor({ cipherTextBlob: value }).toString(); + } +}; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 793c8a4ad..2a1976ca8 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -22,6 +22,7 @@ import { fnSecretsV2FromImports } from "../secret-import/secret-import-fns"; import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal"; import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; import { + secretEncryptionHelper, fnSecretBulkDelete, fnSecretBulkInsert, fnSecretBulkUpdate, @@ -75,17 +76,6 @@ type TSecretV2BridgeServiceFactoryDep = { export type TSecretV2BridgeServiceFactory = ReturnType; -const encryptionHelper = { - encryptValue: (encryptor: Awaited>, value?: string) => { - if (typeof value === "undefined") return; - return encryptor({ plainText: Buffer.from(value) }).cipherTextBlob; - }, - decryptValue: (decryptor: Awaited>, value?: Buffer | null) => { - if (!value) return; - return decryptor({ cipherTextBlob: value }).toString(); - } -}; - /* * This service is a bridge from our old architecture towards the new architecture */ @@ -171,8 +161,8 @@ export const secretV2BridgeServiceFactory = ({ version: 1, type, reminderRepeatDays: el.secretReminderRepeatDays, - encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), - encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue), + encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), + encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue), reminderNote: el.secretReminderNote, skipMultilineEncoding: el.skipMultilineEncoding, key: secretName, @@ -291,7 +281,7 @@ export const secretV2BridgeServiceFactory = ({ const encryptedValue = typeof secretValue !== "undefined" ? { - encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, secretValue) as Buffer, + encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretValue) as Buffer, references: getAllNestedSecretReferences(secretValue) } : {}; @@ -304,7 +294,7 @@ export const secretV2BridgeServiceFactory = ({ filter: { id: secretId }, data: { reminderRepeatDays: inputSecret.secretReminderRepeatDays, - encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, secretComment), + encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretComment), reminderNote: inputSecret.secretReminderNote, skipMultilineEncoding: inputSecret.skipMultilineEncoding, key: inputSecret.newSecretName || secretName, @@ -408,8 +398,8 @@ export const secretV2BridgeServiceFactory = ({ const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); return reshapeBridgeSecret(projectId, environment, secretPath, { ...deletedSecret[0], - value: encryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedValue), - comment: encryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedComment) + value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedValue), + comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedComment) }); }; @@ -496,15 +486,15 @@ export const secretV2BridgeServiceFactory = ({ secretDAL, folderDAL, secretImportDAL, - decryptor: (value) => encryptionHelper.decryptValue(secretManagerDecryptor, value) + decryptor: (value) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, value) }); return { secrets: secrets.map((secret) => reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, { ...secret, - value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue), - comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) + value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue), + comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) }) ), imports: importedSecrets @@ -515,8 +505,8 @@ export const secretV2BridgeServiceFactory = ({ secrets: secrets.map((secret) => reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, { ...secret, - value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue), - comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) + value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue), + comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) }) ) }; @@ -583,7 +573,7 @@ export const secretV2BridgeServiceFactory = ({ .then((el) => SecretsV2Schema.parse({ ...el, id: el.secretId }))); const interpolateInlineSecretReference = interpolateSecrets({ projectId, - decryptSecret: (encryptedValue) => encryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue), + decryptSecret: (encryptedValue) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue), secretDAL, folderDAL }); @@ -610,14 +600,17 @@ export const secretV2BridgeServiceFactory = ({ secretDAL, folderDAL, secretImportDAL, - decryptor: (value) => encryptionHelper.decryptValue(secretManagerDecryptor, value) + decryptor: (value) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, value) }); for (let i = importedSecrets.length - 1; i >= 0; i -= 1) { for (let j = 0; j < importedSecrets[i].secrets.length; j += 1) { if (secretName === importedSecrets[i].secrets[j].key) { const importedSecret = importedSecrets[i].secrets[j]; - let secretValue = encryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedValue); + let secretValue = secretEncryptionHelper.decryptValue( + secretManagerDecryptor, + importedSecret.encryptedValue + ); if (expandSecretReferences && secretValue) { const secretReferenceExpandedString = { [importedSecret.key]: { value: secretValue } @@ -630,7 +623,7 @@ export const secretV2BridgeServiceFactory = ({ return reshapeBridgeSecret(projectId, importedSecrets[i].environment, importedSecrets[i].secretPath, { ...importedSecret, value: secretValue, - comment: encryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedComment) + comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedComment) }); } } @@ -638,7 +631,7 @@ export const secretV2BridgeServiceFactory = ({ } if (!secret) throw new BadRequestError({ message: "Secret not found" }); - let secretValue = encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue); + let secretValue = secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue); if (expandSecretReferences && secretValue) { const secretReferenceExpandedString = { [secret.key]: { value: secretValue } @@ -651,7 +644,7 @@ export const secretV2BridgeServiceFactory = ({ return reshapeBridgeSecret(projectId, environment, path, { ...secret, value: secretValue, - comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) + comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) }); }; @@ -707,8 +700,8 @@ export const secretV2BridgeServiceFactory = ({ fnSecretBulkInsert({ inputSecrets: inputSecrets.map((el) => ({ version: 1, - encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), - encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue), + encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), + encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue), skipMultilineEncoding: el.skipMultilineEncoding, key: el.secretKey, tagIds: el.tagIds, @@ -737,8 +730,8 @@ export const secretV2BridgeServiceFactory = ({ return newSecrets.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), - comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) + value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), + comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) }) ); }; @@ -814,7 +807,7 @@ export const secretV2BridgeServiceFactory = ({ const encryptedValue = typeof el.secretValue !== "undefined" ? { - encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue) as Buffer, + encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue) as Buffer, references: getAllNestedSecretReferences(el.secretValue) } : {}; @@ -822,7 +815,7 @@ export const secretV2BridgeServiceFactory = ({ filter: { key: el.secretKey, type: SecretType.Shared }, data: { reminderRepeatDays: el.secretReminderRepeatDays, - encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), + encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), reminderNote: el.secretReminderNote, skipMultilineEncoding: el.skipMultilineEncoding, key: el.newSecretName || el.secretKey, @@ -850,8 +843,8 @@ export const secretV2BridgeServiceFactory = ({ return secrets.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), - comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) + value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), + comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) }) ); }; @@ -925,8 +918,8 @@ export const secretV2BridgeServiceFactory = ({ return secretsDeleted.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), - comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) + value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), + comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) }) ); }; @@ -991,7 +984,7 @@ export const secretV2BridgeServiceFactory = ({ secretId: id, references: encryptedValue ? getAllNestedSecretReferences( - encryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue) as string + secretEncryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue) as string ) : [] })), @@ -1074,7 +1067,7 @@ export const secretV2BridgeServiceFactory = ({ const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); const decryptedSourceSecrets = sourceSecrets.map((secret) => ({ ...secret, - value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue) + value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue) })); let isSourceUpdated = false; @@ -1093,7 +1086,7 @@ export const secretV2BridgeServiceFactory = ({ const decryptedDestinationSecrets = destinationSecretsFromDB.map((secret) => { return { ...secret, - value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue) + value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue) }; }); diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index d4ec6cc08..5f6f9bb90 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -887,3 +887,50 @@ export const updateManySecretsRawFnFactory = ({ return updateManySecretsRawFn; }; + +export const decryptSecretWithBot = ( + secret: Pick< + TSecrets, + | "secretKeyIV" + | "secretKeyTag" + | "secretKeyCiphertext" + | "secretValueIV" + | "secretValueTag" + | "secretValueCiphertext" + | "secretCommentIV" + | "secretCommentTag" + | "secretCommentCiphertext" + >, + key: string +) => { + const secretKey = decryptSymmetric128BitHexKeyUTF8({ + ciphertext: secret.secretKeyCiphertext, + iv: secret.secretKeyIV, + tag: secret.secretKeyTag, + key + }); + + const secretValue = decryptSymmetric128BitHexKeyUTF8({ + ciphertext: secret.secretValueCiphertext, + iv: secret.secretValueIV, + tag: secret.secretValueTag, + key + }); + + let secretComment = ""; + + if (secret.secretCommentCiphertext && secret.secretCommentIV && secret.secretCommentTag) { + secretComment = decryptSymmetric128BitHexKeyUTF8({ + ciphertext: secret.secretCommentCiphertext, + iv: secret.secretCommentIV, + tag: secret.secretCommentTag, + key + }); + } + + return { + secretKey, + secretValue, + secretComment + }; +}; diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index ade727c99..1a157ddc0 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -73,6 +73,7 @@ import { } from "./secret-types"; import { TSecretVersionDALFactory } from "./secret-version-dal"; import { TSecretVersionTagDALFactory } from "./secret-version-tag-dal"; +import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service"; type TSecretServiceFactoryDep = { secretDAL: TSecretDALFactory; @@ -93,6 +94,10 @@ type TSecretServiceFactoryDep = { secretImportDAL: Pick; secretVersionTagDAL: Pick; secretApprovalPolicyService: Pick; + secretApprovalRequestService: Pick< + TSecretApprovalRequestServiceFactory, + "generateSecretApprovalRequest" | "generateSecretApprovalRequestV2Bridge" + >; secretApprovalRequestDAL: Pick; secretApprovalRequestSecretDAL: Pick< TSecretApprovalRequestSecretDALFactory, @@ -118,7 +123,8 @@ export const secretServiceFactory = ({ secretApprovalPolicyService, secretApprovalRequestDAL, secretApprovalRequestSecretDAL, - secretV2BridgeService + secretV2BridgeService, + secretApprovalRequestService }: TSecretServiceFactoryDep) => { const getSecretReference = async (projectId: string) => { // if bot key missing means e2e still exist @@ -1216,7 +1222,37 @@ export const secretServiceFactory = ({ secretReminderRepeatDays }: TCreateSecretRawDTO) => { const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + const policy = + actor === ActorType.USER && type === SecretType.Shared + ? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath) + : undefined; if (shouldUseSecretV2Bridge) { + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + policy, + secretPath, + environment, + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod, + data: { + [SecretOperations.Create]: [ + { + secretKey: secretName, + skipMultilineEncoding, + secretComment, + secretValue, + tagIds, + reminderNote: secretReminderNote, + reminderRepeatDays: secretReminderRepeatDays + } + ] + } + }); + } + const secret = await secretV2BridgeService.createSecret({ secretName, type, @@ -1241,6 +1277,36 @@ export const secretServiceFactory = ({ const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretName, botKey); const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequest({ + policy, + secretPath, + environment, + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod, + data: { + [SecretOperations.Create]: [ + { + secretName, + secretKeyCiphertext: secretKeyEncrypted.ciphertext, + secretKeyIV: secretKeyEncrypted.iv, + secretKeyTag: secretKeyEncrypted.tag, + secretValueCiphertext: secretValueEncrypted.ciphertext, + secretValueIV: secretValueEncrypted.iv, + secretValueTag: secretValueEncrypted.tag, + secretCommentCiphertext: secretCommentEncrypted.ciphertext, + secretCommentIV: secretCommentEncrypted.iv, + secretCommentTag: secretCommentEncrypted.tag, + skipMultilineEncoding, + tagIds + } + ] + } + }); + } const secret = await createSecret({ secretName, @@ -1290,7 +1356,37 @@ export const secretServiceFactory = ({ newSecretName }: TUpdateSecretRawDTO) => { const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + const policy = + actor === ActorType.USER && type === SecretType.Shared + ? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath) + : undefined; if (shouldUseSecretV2Bridge) { + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + policy, + secretPath, + environment, + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod, + data: { + [SecretOperations.Update]: [ + { + secretKey: secretName, + newSecretName, + skipMultilineEncoding, + secretComment, + secretValue, + tagIds, + reminderNote: secretReminderNote, + reminderRepeatDays: secretReminderRepeatDays + } + ] + } + }); + } const secret = await secretV2BridgeService.updateSecret({ secretReminderRepeatDays, skipMultilineEncoding, @@ -1319,6 +1415,40 @@ export const secretServiceFactory = ({ const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretName, botKey); + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequest({ + policy, + secretPath, + environment, + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod, + data: { + [SecretOperations.Update]: [ + { + secretName, + newSecretName, + skipMultilineEncoding, + secretKeyCiphertext: secretKeyEncrypted.ciphertext, + secretKeyIV: secretKeyEncrypted.iv, + secretKeyTag: secretKeyEncrypted.tag, + secretValueCiphertext: secretValueEncrypted.ciphertext, + secretValueIV: secretValueEncrypted.iv, + secretValueTag: secretValueEncrypted.tag, + secretCommentCiphertext: secretCommentEncrypted.ciphertext, + secretCommentIV: secretCommentEncrypted.iv, + secretCommentTag: secretCommentEncrypted.tag, + tagIds, + secretReminderNote, + secretReminderRepeatDays + } + ] + } + }); + } + const secret = await updateSecret({ secretName, projectId, @@ -1362,7 +1492,30 @@ export const secretServiceFactory = ({ secretPath }: TDeleteSecretRawDTO) => { const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + const policy = + actor === ActorType.USER && type === SecretType.Shared + ? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath) + : undefined; if (shouldUseSecretV2Bridge) { + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + policy, + actorAuthMethod, + actorOrgId, + actorId, + actor, + projectId, + environment, + secretPath, + data: { + [SecretOperations.Delete]: [ + { + secretKey: secretName + } + ] + } + }); + } const secret = await secretV2BridgeService.deleteSecret({ secretName, type, @@ -1377,7 +1530,25 @@ export const secretServiceFactory = ({ return secret; } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); - + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequest({ + policy, + actorAuthMethod, + actorOrgId, + actorId, + actor, + projectId, + environment, + secretPath, + data: { + [SecretOperations.Delete]: [ + { + secretName + } + ] + } + }); + } const secret = await deleteSecret({ secretName, projectId, @@ -1416,7 +1587,33 @@ export const secretServiceFactory = ({ } const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + const policy = + actor === ActorType.USER + ? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath) + : undefined; if (shouldUseSecretV2Bridge) { + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + policy, + secretPath, + environment, + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod, + data: { + [SecretOperations.Create]: inputSecrets.map((el) => ({ + tagIds: el.tagIds, + secretValue: el.secretValue, + secretComment: el.secretComment, + metadata: el.metadata, + skipMultilineEncoding: el.skipMultilineEncoding, + secretKey: el.secretKey + })) + } + }); + } const secrets = await secretV2BridgeService.createManySecret({ secretPath, environment, @@ -1430,7 +1627,44 @@ export const secretServiceFactory = ({ return secrets; } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); - + const sanitizedSecrets = inputSecrets.map( + ({ secretComment, secretKey, metadata, tagIds, secretValue, skipMultilineEncoding }) => { + const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretKey, botKey); + const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); + const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); + return { + secretName: secretKey, + skipMultilineEncoding, + secretKeyCiphertext: secretKeyEncrypted.ciphertext, + secretKeyIV: secretKeyEncrypted.iv, + secretKeyTag: secretKeyEncrypted.tag, + secretValueCiphertext: secretValueEncrypted.ciphertext, + secretValueIV: secretValueEncrypted.iv, + secretValueTag: secretValueEncrypted.tag, + secretCommentCiphertext: secretCommentEncrypted.ciphertext, + secretCommentIV: secretCommentEncrypted.iv, + secretCommentTag: secretCommentEncrypted.tag, + tags: tagIds, + tagIds, + metadata + }; + } + ); + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequest({ + policy, + secretPath, + environment, + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod, + data: { + [SecretOperations.Create]: sanitizedSecrets + } + }); + } const secrets = await createManySecret({ projectId, environment, @@ -1439,28 +1673,7 @@ export const secretServiceFactory = ({ actorId, actorOrgId, actorAuthMethod, - secrets: inputSecrets.map( - ({ secretComment, secretKey, metadata, tagIds, secretValue, skipMultilineEncoding }) => { - const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretKey, botKey); - const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); - const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); - return { - secretName: secretKey, - skipMultilineEncoding, - secretKeyCiphertext: secretKeyEncrypted.ciphertext, - secretKeyIV: secretKeyEncrypted.iv, - secretKeyTag: secretKeyEncrypted.tag, - secretValueCiphertext: secretValueEncrypted.ciphertext, - secretValueIV: secretValueEncrypted.iv, - secretValueTag: secretValueEncrypted.tag, - secretCommentCiphertext: secretCommentEncrypted.ciphertext, - secretCommentIV: secretCommentEncrypted.iv, - secretCommentTag: secretCommentEncrypted.tag, - tags: tagIds, - metadata - }; - } - ) + secrets: sanitizedSecrets }); return secrets.map((secret) => @@ -1490,7 +1703,32 @@ export const secretServiceFactory = ({ } const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + const policy = + actor === ActorType.USER + ? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath) + : undefined; if (shouldUseSecretV2Bridge) { + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + policy, + secretPath, + environment, + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod, + data: { + [SecretOperations.Update]: inputSecrets.map((el) => ({ + tagIds: el.tagIds, + secretValue: el.secretValue, + secretComment: el.secretComment, + skipMultilineEncoding: el.skipMultilineEncoding, + secretKey: el.secretKey + })) + } + }); + } const secrets = await secretV2BridgeService.updateManySecret({ secretPath, environment, @@ -1505,7 +1743,56 @@ export const secretServiceFactory = ({ } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); - + const sanitizedSecrets = inputSecrets.map( + ({ + secretComment, + secretKey, + secretValue, + skipMultilineEncoding, + tagIds: tags, + newSecretName, + secretReminderNote, + secretReminderRepeatDays + }) => { + const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretKey, botKey); + const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); + const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); + return { + secretName: secretKey, + newSecretName, + tags, + tagIds: tags, + secretReminderRepeatDays, + secretReminderNote, + type: SecretType.Shared, + skipMultilineEncoding, + secretKeyCiphertext: secretKeyEncrypted.ciphertext, + secretKeyIV: secretKeyEncrypted.iv, + secretKeyTag: secretKeyEncrypted.tag, + secretValueCiphertext: secretValueEncrypted.ciphertext, + secretValueIV: secretValueEncrypted.iv, + secretValueTag: secretValueEncrypted.tag, + secretCommentCiphertext: secretCommentEncrypted.ciphertext, + secretCommentIV: secretCommentEncrypted.iv, + secretCommentTag: secretCommentEncrypted.tag + }; + } + ); + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequest({ + policy, + secretPath, + environment, + projectId, + actor, + actorId, + actorOrgId, + actorAuthMethod, + data: { + [SecretOperations.Update]: sanitizedSecrets + } + }); + } const secrets = await updateManySecret({ projectId, environment, @@ -1514,40 +1801,7 @@ export const secretServiceFactory = ({ actorId, actorOrgId, actorAuthMethod, - secrets: inputSecrets.map( - ({ - secretComment, - secretKey, - secretValue, - skipMultilineEncoding, - tagIds: tags, - newSecretName, - secretReminderNote, - secretReminderRepeatDays - }) => { - const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretKey, botKey); - const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); - const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); - return { - secretName: secretKey, - newSecretName, - tags, - secretReminderRepeatDays, - secretReminderNote, - type: SecretType.Shared, - skipMultilineEncoding, - secretKeyCiphertext: secretKeyEncrypted.ciphertext, - secretKeyIV: secretKeyEncrypted.iv, - secretKeyTag: secretKeyEncrypted.tag, - secretValueCiphertext: secretValueEncrypted.ciphertext, - secretValueIV: secretValueEncrypted.iv, - secretValueTag: secretValueEncrypted.tag, - secretCommentCiphertext: secretCommentEncrypted.ciphertext, - secretCommentIV: secretCommentEncrypted.iv, - secretCommentTag: secretCommentEncrypted.tag - }; - } - ) + secrets: sanitizedSecrets }); return secrets.map((secret) => @@ -1577,7 +1831,26 @@ export const secretServiceFactory = ({ } const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + const policy = + actor === ActorType.USER + ? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath) + : undefined; if (shouldUseSecretV2Bridge) { + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + policy, + actorAuthMethod, + actorOrgId, + actorId, + actor, + projectId, + environment, + secretPath, + data: { + [SecretOperations.Delete]: inputSecrets + } + }); + } const secrets = await secretV2BridgeService.deleteManySecret({ secretPath, environment, @@ -1593,6 +1866,21 @@ export const secretServiceFactory = ({ if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); + if (policy) { + return secretApprovalRequestService.generateSecretApprovalRequest({ + policy, + actorAuthMethod, + actorOrgId, + actorId, + actor, + projectId, + environment, + secretPath, + data: { + [SecretOperations.Delete]: inputSecrets.map((el) => ({ secretName: el.secretKey })) + } + }); + } const secrets = await deleteManySecret({ projectId, environment, From 643d13b0eccc1e85e43e9218752d1a2a1c09a79b Mon Sep 17 00:00:00 2001 From: = Date: Sun, 21 Jul 2024 22:09:24 +0530 Subject: [PATCH 41/77] checkpoint --- .../secret-approval-request-service.ts | 2 +- .../secret-rotation-queue.ts | 163 ++++++++++++------ .../integration-sync-secret.ts | 18 +- .../secret-v2-bridge-service.ts | 22 ++- backend/src/services/secret/secret-fns.ts | 162 +++++++++++++++-- backend/src/services/secret/secret-queue.ts | 150 +++++++++++++--- backend/src/services/secret/secret-types.ts | 18 ++ 7 files changed, 432 insertions(+), 103 deletions(-) diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index 11e24f104..db805df8d 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -730,7 +730,7 @@ export const secretApprovalRequestServiceFactory = ({ }); } - await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId, shouldUseSecretV2Bridge); const [folder] = await folderDAL.findSecretPathByFolderIds(projectId, [folderId]); if (!folder) throw new BadRequestError({ message: "Folder not found" }); await secretQueueService.syncSecrets({ diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts index e9eedaee8..b10873e5b 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts @@ -39,6 +39,10 @@ import { secretRotationPreSetFn } from "./secret-rotation-queue-fn"; import { TSecretRotationData, TSecretRotationDbFn, TSecretRotationEncData } from "./secret-rotation-queue-types"; +import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; export type TSecretRotationQueueFactory = ReturnType; @@ -47,8 +51,11 @@ type TSecretRotationQueueFactoryDep = { secretRotationDAL: TSecretRotationDALFactory; projectBotService: Pick; secretDAL: Pick; + secretV2BridgeDAL: Pick; secretVersionDAL: Pick; + secretVersionV2BridgeDAL: Pick; telemetryService: Pick; + kmsService: Pick; }; // These error should stop the repeatable job and ask user to reconfigure rotation @@ -70,7 +77,10 @@ export const secretRotationQueueFactory = ({ projectBotService, secretDAL, secretVersionDAL, - telemetryService + telemetryService, + secretV2BridgeDAL, + secretVersionV2BridgeDAL, + kmsService }: TSecretRotationQueueFactoryDep) => { const addToQueue = async (rotationId: string, interval: number) => { const appCfg = getConfig(); @@ -267,62 +277,113 @@ export const secretRotationQueueFactory = ({ internal: newCredential.internal }); const encVarData = infisicalSymmetricEncypt(JSON.stringify(variables)); - const key = await projectBotService.getBotKey(secretRotation.projectId); - const encryptedSecrets = rotationOutputs.map(({ key: outputKey, secretId }) => ({ - secretId, - value: encryptSymmetric128BitHexKeyUTF8( - typeof newCredential.outputs[outputKey] === "object" - ? JSON.stringify(newCredential.outputs[outputKey]) - : String(newCredential.outputs[outputKey]), - key - ) - })); - // map the final values to output keys in the board - await secretRotationDAL.transaction(async (tx) => { - await secretRotationDAL.updateById( - rotationId, - { - encryptedData: encVarData.ciphertext, - encryptedDataIV: encVarData.iv, - encryptedDataTag: encVarData.tag, - keyEncoding: encVarData.encoding, - algorithm: encVarData.algorithm, - lastRotatedAt: new Date(), - statusMessage: "Rotated successfull", - status: "success" - }, - tx - ); - const updatedSecrets = await secretDAL.bulkUpdate( - encryptedSecrets.map(({ secretId, value }) => ({ - // this secret id is validated when user is inserted - filter: { id: secretId, type: SecretType.Shared }, - data: { - secretValueCiphertext: value.ciphertext, - secretValueIV: value.iv, - secretValueTag: value.tag - } - })), - tx - ); - await secretVersionDAL.insertMany( - updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => { - if (!el.secretBlindIndex) throw new BadRequestError({ message: "Missing blind index" }); - return { - ...el, - secretId: id, - secretBlindIndex: el.secretBlindIndex - }; - }), - tx - ); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(secretRotation.projectId); + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId: secretRotation.projectId }); + const numberOfSecretsRotated = rotationOutputs.length; + if (shouldUseSecretV2Bridge) { + const encryptedSecrets = rotationOutputs.map(({ key: outputKey, secretId }) => ({ + secretId, + value: + typeof newCredential.outputs[outputKey] === "object" + ? JSON.stringify(newCredential.outputs[outputKey]) + : String(newCredential.outputs[outputKey]) + })); + // map the final values to output keys in the board + await secretRotationDAL.transaction(async (tx) => { + await secretRotationDAL.updateById( + rotationId, + { + encryptedData: encVarData.ciphertext, + encryptedDataIV: encVarData.iv, + encryptedDataTag: encVarData.tag, + keyEncoding: encVarData.encoding, + algorithm: encVarData.algorithm, + lastRotatedAt: new Date(), + statusMessage: "Rotated successfull", + status: "success" + }, + tx + ); + const updatedSecrets = await secretV2BridgeDAL.bulkUpdate( + encryptedSecrets.map(({ secretId, value }) => ({ + // this secret id is validated when user is inserted + filter: { id: secretId, type: SecretType.Shared }, + data: { + encryptedValue: secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + } + })), + tx + ); + await secretVersionV2BridgeDAL.insertMany( + updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => ({ + ...el, + secretId: id + })), + tx + ); + }); + } else { + if (!botKey) throw new BadRequestError({ message: "Bot not found" }); + const encryptedSecrets = rotationOutputs.map(({ key: outputKey, secretId }) => ({ + secretId, + value: encryptSymmetric128BitHexKeyUTF8( + typeof newCredential.outputs[outputKey] === "object" + ? JSON.stringify(newCredential.outputs[outputKey]) + : String(newCredential.outputs[outputKey]), + botKey + ) + })); + // map the final values to output keys in the board + await secretRotationDAL.transaction(async (tx) => { + await secretRotationDAL.updateById( + rotationId, + { + encryptedData: encVarData.ciphertext, + encryptedDataIV: encVarData.iv, + encryptedDataTag: encVarData.tag, + keyEncoding: encVarData.encoding, + algorithm: encVarData.algorithm, + lastRotatedAt: new Date(), + statusMessage: "Rotated successfull", + status: "success" + }, + tx + ); + const updatedSecrets = await secretDAL.bulkUpdate( + encryptedSecrets.map(({ secretId, value }) => ({ + // this secret id is validated when user is inserted + filter: { id: secretId, type: SecretType.Shared }, + data: { + secretValueCiphertext: value.ciphertext, + secretValueIV: value.iv, + secretValueTag: value.tag + } + })), + tx + ); + await secretVersionDAL.insertMany( + updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => { + if (!el.secretBlindIndex) throw new BadRequestError({ message: "Missing blind index" }); + return { + ...el, + secretId: id, + secretBlindIndex: el.secretBlindIndex + }; + }), + tx + ); + }); + } + await telemetryService.sendPostHogEvents({ event: PostHogEventTypes.SecretRotated, distinctId: "", properties: { - numberOfSecrets: encryptedSecrets.length, + numberOfSecrets: numberOfSecretsRotated, environment: secretRotation.environment.slug, secretPath: secretRotation.secretPath, workspaceId: secretRotation.projectId diff --git a/backend/src/services/integration-auth/integration-sync-secret.ts b/backend/src/services/integration-auth/integration-sync-secret.ts index 4d32f819a..4fc69b76c 100644 --- a/backend/src/services/integration-auth/integration-sync-secret.ts +++ b/backend/src/services/integration-auth/integration-sync-secret.ts @@ -26,7 +26,7 @@ import sodium from "libsodium-wrappers"; import isEqual from "lodash.isequal"; import { z } from "zod"; -import { SecretType, TIntegrationAuths, TIntegrations, TSecrets } from "@app/db/schemas"; +import { SecretType, TIntegrationAuths, TIntegrations } from "@app/db/schemas"; import { getConfig } from "@app/lib/config/env"; import { request } from "@app/lib/config/request"; import { BadRequestError } from "@app/lib/errors"; @@ -275,8 +275,8 @@ const syncSecretsAzureKeyVault = async ({ }; secrets: Record; accessToken: string; - createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise>; - updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise>; + createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise>; + updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise>; }) => { interface GetAzureKeyVaultSecret { id: string; // secret URI @@ -903,8 +903,8 @@ const syncSecretsHeroku = async ({ secrets, accessToken }: { - createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise>; - updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise>; + createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise>; + updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise>; integration: TIntegrations & { projectId: string; environment: { @@ -2464,8 +2464,8 @@ const syncSecretsTerraformCloud = async ({ accessToken, integrationDAL }: { - createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise>; - updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise>; + createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise>; + updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise>; integration: TIntegrations & { projectId: string; environment: { @@ -3612,8 +3612,8 @@ export const syncIntegrationSecrets = async ({ appendices, projectId }: { - createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise>; - updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise>; + createManySecretsRawFn: (params: TCreateManySecretsRawFn) => Promise>; + updateManySecretsRawFn: (params: TUpdateManySecretsRawFn) => Promise>; integrationDAL: Pick; integration: TIntegrations & { projectId: string; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 2a1976ca8..0753a4f50 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -179,7 +179,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId, true); await secretQueueService.syncSecrets({ secretPath, actorId, @@ -319,7 +319,7 @@ export const secretV2BridgeServiceFactory = ({ projectId }); - await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId, true); await secretQueueService.syncSecrets({ actor, actorId, @@ -385,7 +385,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId, true); await secretQueueService.syncSecrets({ actor, actorId, @@ -717,7 +717,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId, true); await secretQueueService.syncSecrets({ actor, actorId, @@ -775,6 +775,7 @@ export const secretV2BridgeServiceFactory = ({ ); if (secretsToUpdate.length !== inputSecrets.length) throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + const secretsToUpdateInDBGroupedByKey = groupBy(secretsToUpdate, (i) => i.key); // now find any secret that needs to update its name // same process as above @@ -788,7 +789,9 @@ export const secretV2BridgeServiceFactory = ({ })) ); if (secrets.length) - throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + throw new BadRequestError({ + message: `Secret with new name exist: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}` + }); } // get all tags @@ -804,6 +807,7 @@ export const secretV2BridgeServiceFactory = ({ folderId, tx, inputSecrets: inputSecrets.map((el) => { + const originalSecret = secretsToUpdateInDBGroupedByKey[el.secretKey][0]; const encryptedValue = typeof el.secretValue !== "undefined" ? { @@ -812,7 +816,7 @@ export const secretV2BridgeServiceFactory = ({ } : {}; return { - filter: { key: el.secretKey, type: SecretType.Shared }, + filter: { id: originalSecret.id, type: SecretType.Shared }, data: { reminderRepeatDays: el.secretReminderRepeatDays, encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), @@ -830,7 +834,7 @@ export const secretV2BridgeServiceFactory = ({ secretVersionTagDAL }) ); - await snapshotService.performSnapshot(folderId); + await snapshotService.performSnapshot(folderId, true); await secretQueueService.syncSecrets({ actor, actorId, @@ -1309,7 +1313,7 @@ export const secretV2BridgeServiceFactory = ({ }); if (isDestinationUpdated) { - await snapshotService.performSnapshot(destinationFolder.id); + await snapshotService.performSnapshot(destinationFolder.id, true); await secretQueueService.syncSecrets({ projectId, secretPath: destinationFolder.path, @@ -1320,7 +1324,7 @@ export const secretV2BridgeServiceFactory = ({ } if (isSourceUpdated) { - await snapshotService.performSnapshot(sourceFolder.id); + await snapshotService.performSnapshot(sourceFolder.id, true); await secretQueueService.syncSecrets({ projectId, secretPath: sourceFolder.path, diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index 5f6f9bb90..f4c66841c 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -39,6 +39,12 @@ import { TUpdateManySecretsRawFn, TUpdateManySecretsRawFnFactory } from "./secret-types"; +import { KmsDataKey } from "../kms/kms-types"; +import { + fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, + fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, + getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge +} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; export const generateSecretBlindIndexBySalt = async (secretName: string, secretBlindIndexDoc: TSecretBlindIndexes) => { const appCfg = getConfig(); @@ -679,7 +685,11 @@ export const createManySecretsRawFnFactory = ({ secretBlindIndexDAL, secretTagDAL, secretVersionTagDAL, - folderDAL + folderDAL, + secretVersionV2BridgeDAL, + secretV2BridgeDAL, + secretVersionTagV2BridgeDAL, + kmsService }: TCreateManySecretsRawFnFactory) => { const getBotKeyFn = getBotKeyFnFactory(projectBotDAL, projectDAL); const createManySecretsRawFn = async ({ @@ -689,10 +699,7 @@ export const createManySecretsRawFnFactory = ({ secrets, userId }: TCreateManySecretsRawFn) => { - const { botKey } = await getBotKeyFn(projectId); - if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); - - await projectDAL.checkProjectUpgradeStatus(projectId); + const { botKey, shouldUseSecretV2Bridge } = await getBotKeyFn(projectId); const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) @@ -701,6 +708,62 @@ export const createManySecretsRawFnFactory = ({ name: "Create secret" }); const folderId = folder.id; + if (shouldUseSecretV2Bridge) { + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + + const secretsStoredInDB = await secretV2BridgeDAL.findBySecretKeys( + folderId, + secrets.map((el) => ({ + key: el.secretName, + type: SecretType.Shared + })) + ); + if (secretsStoredInDB.length) + throw new BadRequestError({ + message: `Secret already exist: ${secretsStoredInDB.map((el) => el.key).join(",")}` + }); + + const inputSecrets = secrets.map((secret) => { + return { + type: secret.type, + userId: secret.type === SecretType.Personal ? userId : null, + key: secret.secretName, + encryptedValue: secretManagerEncryptor({ plainText: Buffer.from(secret.secretValue) }).cipherTextBlob, + encryptedComent: secret.secretComment + ? secretManagerEncryptor({ plainText: Buffer.from(secret.secretComment) }).cipherTextBlob + : null, + skipMultilineEncoding: secret.skipMultilineEncoding, + tags: secret.tags, + references: getAllNestedSecretReferencesV2Bridge(secret.secretValue) + }; + }); + + // get all tags + const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags); + const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; + if (tags.length !== tagIds.length) throw new BadRequestError({ message: "Tag not found" }); + + const newSecrets = await secretDAL.transaction(async (tx) => + fnSecretV2BridgeBulkInsert({ + inputSecrets: inputSecrets.map((el) => ({ + ...el, + version: 1, + tagIds: el.tags + })), + folderId, + secretDAL: secretV2BridgeDAL, + secretVersionDAL: secretVersionV2BridgeDAL, + secretTagDAL, + secretVersionTagDAL: secretVersionTagV2BridgeDAL, + tx + }) + ); + + return newSecrets; + } const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Create secret" }); @@ -715,6 +778,7 @@ export const createManySecretsRawFnFactory = ({ secretDAL }); + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const inputSecrets = secrets.map((secret) => { const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secret.secretName, botKey); const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secret.secretValue || "", botKey); @@ -777,7 +841,11 @@ export const updateManySecretsRawFnFactory = ({ secretBlindIndexDAL, secretTagDAL, secretVersionTagDAL, - folderDAL + folderDAL, + secretVersionTagV2BridgeDAL, + secretVersionV2BridgeDAL, + secretV2BridgeDAL, + kmsService }: TUpdateManySecretsRawFnFactory) => { const getBotKeyFn = getBotKeyFnFactory(projectBotDAL, projectDAL); const updateManySecretsRawFn = async ({ @@ -786,11 +854,8 @@ export const updateManySecretsRawFnFactory = ({ path: secretPath, secrets, // consider accepting instead ciphertext secrets userId - }: TUpdateManySecretsRawFn): Promise> => { - const { botKey } = await getBotKeyFn(projectId); - if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); - - await projectDAL.checkProjectUpgradeStatus(projectId); + }: TUpdateManySecretsRawFn): Promise> => { + const { botKey, shouldUseSecretV2Bridge } = await getBotKeyFn(projectId); const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath); if (!folder) @@ -799,7 +864,82 @@ export const updateManySecretsRawFnFactory = ({ name: "Update secret" }); const folderId = folder.id; + if (shouldUseSecretV2Bridge) { + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + const secretsToUpdate = await secretV2BridgeDAL.findBySecretKeys( + folderId, + secrets.map((el) => ({ + key: el.secretName, + type: SecretType.Shared + })) + ); + if (secretsToUpdate.length !== secrets.length) + throw new BadRequestError({ message: `Secret not exist: ${secretsToUpdate.map((el) => el.key).join(",")}` }); + + // now find any secret that needs to update its name + // same process as above + const secretsWithNewName = secrets.filter(({ newSecretName }) => Boolean(newSecretName)); + if (secretsWithNewName.length) { + const secretsWithNewNameInDB = await secretV2BridgeDAL.findBySecretKeys( + folderId, + secrets.map((el) => ({ + key: el.secretName, + type: SecretType.Shared + })) + ); + if (secretsWithNewNameInDB.length) + throw new BadRequestError({ + message: `Secret not exist: ${secretsWithNewName.map((el) => el.newSecretName).join(",")}` + }); + } + + const secretsToUpdateInDBGroupedByKey = groupBy(secretsToUpdate, (i) => i.key); + const inputSecrets = secrets.map((secret) => { + if (secret.newSecretName === "") { + throw new BadRequestError({ message: "New secret name cannot be empty" }); + } + + return { + type: secret.type, + userId: secret.type === SecretType.Personal ? userId : null, + key: secret.newSecretName || secret.secretName, + encryptedValue: secretManagerEncryptor({ plainText: Buffer.from(secret.secretValue) }).cipherTextBlob, + encryptedComent: secret.secretComment + ? secretManagerEncryptor({ plainText: Buffer.from(secret.secretComment) }).cipherTextBlob + : null, + skipMultilineEncoding: secret.skipMultilineEncoding, + tags: secret.tags, + references: getAllNestedSecretReferencesV2Bridge(secret.secretValue) + }; + }); + + const tagIds = inputSecrets.flatMap(({ tags = [] }) => tags); + const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : []; + if (tagIds.length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); + + const updatedSecrets = await secretDAL.transaction(async (tx) => + fnSecretV2BridgeBulkUpdate({ + folderId, + tx, + inputSecrets: inputSecrets.map((el) => ({ + filter: { id: secretsToUpdateInDBGroupedByKey[el.key][0].id, type: SecretType.Shared }, + data: el + })), + secretDAL: secretV2BridgeDAL, + secretVersionDAL: secretVersionV2BridgeDAL, + secretTagDAL, + secretVersionTagDAL: secretVersionTagV2BridgeDAL + }) + ); + + return updatedSecrets; + } + + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const blindIndexCfg = await secretBlindIndexDAL.findOne({ projectId }); if (!blindIndexCfg) throw new BadRequestError({ message: "Blind index not found", name: "Update secret" }); diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts index 0f0645f58..337eba8f5 100644 --- a/backend/src/services/secret/secret-queue.ts +++ b/backend/src/services/secret/secret-queue.ts @@ -36,6 +36,10 @@ import { TRemoveSecretReminderDTO, TSyncSecretsDTO } from "./secret-types"; +import { TKmsServiceFactory } from "../kms/kms-service"; +import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal"; export type TSecretQueueFactory = ReturnType; type TSecretQueueFactoryDep = { @@ -57,6 +61,10 @@ type TSecretQueueFactoryDep = { secretBlindIndexDAL: TSecretBlindIndexDALFactory; secretTagDAL: TSecretTagDALFactory; secretVersionTagDAL: TSecretVersionTagDALFactory; + kmsService: Pick; + secretV2BridgeDAL: TSecretV2BridgeDALFactory; + secretVersionV2BridgeDAL: Pick; + secretVersionTagV2BridgeDAL: Pick; }; export type TGetSecrets = { @@ -91,7 +99,11 @@ export const secretQueueFactory = ({ secretVersionDAL, secretBlindIndexDAL, secretTagDAL, - secretVersionTagDAL + secretVersionTagDAL, + secretV2BridgeDAL, + secretVersionV2BridgeDAL, + kmsService, + secretVersionTagV2BridgeDAL }: TSecretQueueFactoryDep) => { const removeSecretReminder = async (dto: TRemoveSecretReminderDTO) => { const appCfg = getConfig(); @@ -195,7 +207,11 @@ export const secretQueueFactory = ({ secretBlindIndexDAL, secretTagDAL, secretVersionTagDAL, - folderDAL + folderDAL, + kmsService, + secretVersionV2BridgeDAL, + secretV2BridgeDAL, + secretVersionTagV2BridgeDAL }); const updateManySecretsRawFn = updateManySecretsRawFnFactory({ @@ -206,9 +222,82 @@ export const secretQueueFactory = ({ secretBlindIndexDAL, secretTagDAL, secretVersionTagDAL, - folderDAL + folderDAL, + kmsService, + secretVersionV2BridgeDAL, + secretV2BridgeDAL, + secretVersionTagV2BridgeDAL }); + /** + * Return the secrets in a given [folderId] including secrets from + * nested imported folders recursively. + */ + const getIntegrationSecretsV2 = async (dto: { + projectId: string; + environment: string; + folderId: string; + depth: number; + decryptor: (value: Buffer | null | undefined) => string; + }) => { + let content: TIntegrationSecret = {}; + if (dto.depth > MAX_SYNC_SECRET_DEPTH) { + logger.info( + `getIntegrationSecrets: secret depth exceeded for [projectId=${dto.projectId}] [folderId=${dto.folderId}] [depth=${dto.depth}]` + ); + return content; + } + + // process secrets in current folder + const secrets = await secretV2BridgeDAL.findByFolderId(dto.folderId); + secrets.forEach((secret) => { + const secretKey = secret.key; + const secretValue = dto.decryptor(secret.encryptedValue); + content[secretKey] = { value: secretValue }; + + if (secret.encryptedComment) { + const commentValue = dto.decryptor(secret.encryptedComment); + content[secretKey].comment = commentValue; + } + + content[secretKey].skipMultilineEncoding = Boolean(secret.skipMultilineEncoding); + }); + + // TODO(akhilmhdh-sev2): change this to v2 expand secrets + + // check if current folder has any imports from other folders + const secretImport = await secretImportDAL.find({ folderId: dto.folderId, isReplication: false }); + + // if no imports then return secrets in the current folder + if (!secretImport) return content; + + const importedFolders = await folderDAL.findByManySecretPath( + secretImport.map(({ importEnv, importPath }) => ({ + envId: importEnv.id, + secretPath: importPath + })) + ); + + for await (const folder of importedFolders) { + if (folder) { + // get secrets contained in each imported folder by recursively calling + // this function against the imported folder + const importedSecrets = await getIntegrationSecretsV2({ + environment: dto.environment, + projectId: dto.projectId, + folderId: folder.id, + depth: dto.depth + 1, + decryptor: dto.decryptor + }); + + // add the imported secrets to the current folder secrets + content = { ...importedSecrets, ...content }; + } + } + + return content; + }; + /** * Return the secrets in a given [folderId] including secrets from * nested imported folders recursively. @@ -467,24 +556,35 @@ export const secretQueueFactory = ({ ); } - const secretReferences = await secretDAL.findReferencedSecretReferences( - projectId, - folder.environment.slug, - secretPath - ); - if (secretReferences.length) { - const referencedFolderIds = unique(secretReferences, (i) => i.folderId).map(({ folderId }) => folderId); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(projectId); + let referencedFolderIds; + if (shouldUseSecretV2Bridge) { + const secretReferences = await secretV2BridgeDAL.findReferencedSecretReferences( + projectId, + folder.environment.slug, + secretPath + ); + referencedFolderIds = unique(secretReferences, (i) => i.folderId).map(({ folderId }) => folderId); + } else { + const secretReferences = await secretDAL.findReferencedSecretReferences( + projectId, + folder.environment.slug, + secretPath + ); + referencedFolderIds = unique(secretReferences, (i) => i.folderId).map(({ folderId }) => folderId); + } + if (referencedFolderIds.length) { const referencedFolders = await folderDAL.findSecretPathByFolderIds(projectId, referencedFolderIds); const referencedFoldersGroupedById = groupBy(referencedFolders.filter(Boolean), (i) => i?.id as string); logger.info( `getIntegrationSecrets: Syncing secret due to reference change [jobId=${job.id}] [projectId=${job.data.projectId}] [environment=${job.data.environment}] [secretPath=${job.data.secretPath}] [depth=${depth}]` ); await Promise.all( - secretReferences - .filter(({ folderId }) => Boolean(referencedFoldersGroupedById[folderId][0]?.path)) + referencedFolderIds + .filter((folderId) => Boolean(referencedFoldersGroupedById[folderId][0]?.path)) // filter out already synced ones .filter( - ({ folderId }) => + (folderId) => !deDupeQueue[ uniqueSecretQueueKey( referencedFoldersGroupedById[folderId][0]?.environmentSlug as string, @@ -492,7 +592,7 @@ export const secretQueueFactory = ({ ) ] ) - .map(({ folderId }) => + .map((folderId) => syncSecrets({ projectId, secretPath: referencedFoldersGroupedById[folderId][0]?.path as string, @@ -523,7 +623,6 @@ export const secretQueueFactory = ({ projectId: integration.projectId }; - const botKey = await projectBotService.getBotKey(projectId); const { accessToken, accessId } = await integrationAuthService.getIntegrationAccessToken(integrationAuth, botKey); const awsAssumeRoleArn = integrationAuth.awsAssumeIamRoleArnTag && @@ -537,13 +636,20 @@ export const secretQueueFactory = ({ }) : null; - const secrets = await getIntegrationSecrets({ - environment, - projectId, - folderId: folder.id, - key: botKey, - depth: 1 - }); + const secrets = shouldUseSecretV2Bridge + ? await getIntegrationSecretsV2({ + environment, + projectId, + folderId: folder.id, + depth: 1 + }) + : await getIntegrationSecrets({ + environment, + projectId, + folderId: folder.id, + key: botKey, + depth: 1 + }); const suffixedSecrets: typeof secrets = {}; const metadata = integration.metadata as Record; if (metadata) { diff --git a/backend/src/services/secret/secret-types.ts b/backend/src/services/secret/secret-types.ts index 16bcf6172..cac5adef2 100644 --- a/backend/src/services/secret/secret-types.ts +++ b/backend/src/services/secret/secret-types.ts @@ -12,6 +12,10 @@ import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-fold import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; import { ActorType } from "../auth/auth-type"; +import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal"; +import { TKmsServiceFactory } from "../kms/kms-service"; type TPartialSecret = Pick; @@ -341,6 +345,13 @@ export type TCreateManySecretsRawFnFactory = { secretTagDAL: TSecretTagDALFactory; secretVersionTagDAL: TSecretVersionTagDALFactory; folderDAL: TSecretFolderDALFactory; + kmsService: Pick; + secretV2BridgeDAL: Pick< + TSecretV2BridgeDALFactory, + "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany" + >; + secretVersionV2BridgeDAL: Pick; + secretVersionTagV2BridgeDAL: Pick; }; export type TCreateManySecretsRawFn = { @@ -370,6 +381,13 @@ export type TUpdateManySecretsRawFnFactory = { secretTagDAL: TSecretTagDALFactory; secretVersionTagDAL: TSecretVersionTagDALFactory; folderDAL: TSecretFolderDALFactory; + kmsService: Pick; + secretV2BridgeDAL: Pick< + TSecretV2BridgeDALFactory, + "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany" + >; + secretVersionV2BridgeDAL: Pick; + secretVersionTagV2BridgeDAL: Pick; }; export type TUpdateManySecretsRawFn = { From 36ac1f47caa7785a2c9191584a242d35928a5bb2 Mon Sep 17 00:00:00 2001 From: = Date: Mon, 22 Jul 2024 15:59:10 +0530 Subject: [PATCH 42/77] feat: all the services are now working with secrets v2 architecture --- .../db/migrations/20240716105646_secret-v2.ts | 32 ++ backend/src/db/schemas/integration-auths.ts | 8 +- .../secret-approval-request-secret-dal.ts | 4 +- .../secret-approval-request-service.ts | 24 +- .../secret-replication-service.ts | 20 +- .../secret-rotation-queue.ts | 8 +- .../secret-snapshot-service.ts | 20 +- backend/src/lib/fn/index.ts | 1 + backend/src/lib/fn/undefined.ts | 3 + .../integration-auth-service.ts | 381 ++++++++++++------ .../secret-folder/secret-folder-dal.ts | 4 +- .../secret-import/secret-import-service.ts | 29 +- .../secret-v2-bridge/secret-v2-bridge-fns.ts | 2 +- .../secret-v2-bridge-service.ts | 282 +++++++------ backend/src/services/secret/secret-fns.ts | 12 +- backend/src/services/secret/secret-queue.ts | 48 ++- backend/src/services/secret/secret-service.ts | 2 +- backend/src/services/secret/secret-types.ts | 2 +- 18 files changed, 562 insertions(+), 320 deletions(-) create mode 100644 backend/src/lib/fn/undefined.ts diff --git a/backend/src/db/migrations/20240716105646_secret-v2.ts b/backend/src/db/migrations/20240716105646_secret-v2.ts index 4aae70513..e2c0e976f 100644 --- a/backend/src/db/migrations/20240716105646_secret-v2.ts +++ b/backend/src/db/migrations/20240716105646_secret-v2.ts @@ -115,6 +115,22 @@ export async function up(knex: Knex): Promise { t.timestamps(true, true, true); }); } + + if (await knex.schema.hasTable(TableName.IntegrationAuth)) { + const hasEncryptedAccess = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccess"); + const hasEncryptedAccessId = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccessId"); + const hasEncryptedRefresh = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedRefresh"); + const hasEncryptedAwsIamAssumRole = await knex.schema.hasColumn( + TableName.IntegrationAuth, + "encryptedAwsAssumeIamRoleArn" + ); + await knex.schema.alterTable(TableName.IntegrationAuth, (t) => { + if (!hasEncryptedAccess) t.binary("encryptedAccess"); + if (!hasEncryptedAccessId) t.binary("encryptedAccessId"); + if (!hasEncryptedRefresh) t.binary("encryptedRefresh"); + if (!hasEncryptedAwsIamAssumRole) t.binary("hasEncryptedAwsIamAssumRole"); + }); + } } export async function down(knex: Knex): Promise { @@ -131,4 +147,20 @@ export async function down(knex: Knex): Promise { await dropOnUpdateTrigger(knex, TableName.SecretVersionV2); await knex.schema.dropTableIfExists(TableName.SecretVersionV2Tag); await knex.schema.dropTableIfExists(TableName.SecretVersionV2); + + if (await knex.schema.hasTable(TableName.IntegrationAuth)) { + const hasEncryptedAccess = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccess"); + const hasEncryptedAccessId = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccessId"); + const hasEncryptedRefresh = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedRefresh"); + const hasEncryptedAwsIamAssumRole = await knex.schema.hasColumn( + TableName.IntegrationAuth, + "encryptedAwsAssumeIamRoleArn" + ); + await knex.schema.alterTable(TableName.IntegrationAuth, (t) => { + if (hasEncryptedAccess) t.dropColumn("encryptedAccess"); + if (hasEncryptedAccessId) t.dropColumn("encryptedAccessId"); + if (hasEncryptedRefresh) t.dropColumn("encryptedRefresh"); + if (hasEncryptedAwsIamAssumRole) t.dropColumn("hasEncryptedAwsIamAssumRole"); + }); + } } diff --git a/backend/src/db/schemas/integration-auths.ts b/backend/src/db/schemas/integration-auths.ts index 0a980edc8..709d3b1ef 100644 --- a/backend/src/db/schemas/integration-auths.ts +++ b/backend/src/db/schemas/integration-auths.ts @@ -5,6 +5,8 @@ import { z } from "zod"; +import { zodBuffer } from "@app/lib/zod"; + import { TImmutableDBKeys } from "./models"; export const IntegrationAuthsSchema = z.object({ @@ -32,7 +34,11 @@ export const IntegrationAuthsSchema = z.object({ updatedAt: z.date(), awsAssumeIamRoleArnCipherText: z.string().nullable().optional(), awsAssumeIamRoleArnIV: z.string().nullable().optional(), - awsAssumeIamRoleArnTag: z.string().nullable().optional() + awsAssumeIamRoleArnTag: z.string().nullable().optional(), + encryptedAccess: zodBuffer.nullable().optional(), + encryptedAccessId: zodBuffer.nullable().optional(), + encryptedRefresh: zodBuffer.nullable().optional(), + hasEncryptedAwsIamAssumRole: zodBuffer.nullable().optional() }); export type TIntegrationAuths = z.infer; diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts index b7174b96c..998bc4bcf 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts @@ -16,6 +16,7 @@ export type TSecretApprovalRequestSecretDALFactory = ReturnType { const secretApprovalRequestSecretOrm = ormify(db, TableName.SecretApprovalRequestSecret); const secretApprovalRequestSecretTagOrm = ormify(db, TableName.SecretApprovalRequestSecretTag); + const secretApprovalRequestSecretV2TagOrm = ormify(db, TableName.SecretApprovalRequestSecretTagV2); const secretApprovalRequestSecretV2Orm = ormify(db, TableName.SecretApprovalRequestSecretV2); const bulkUpdateNoVersionIncrement = async (data: TSecretApprovalRequestsSecrets[], tx?: Knex) => { @@ -359,6 +360,7 @@ export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => { findByRequestId, findByRequestIdBridgeSecretV2, bulkUpdateNoVersionIncrement, - insertApprovalSecretTags: secretApprovalRequestSecretTagOrm.insertMany + insertApprovalSecretTags: secretApprovalRequestSecretTagOrm.insertMany, + insertApprovalSecretV2Tags: secretApprovalRequestSecretV2TagOrm.insertMany }; }; diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index db805df8d..7d2197a58 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -15,6 +15,7 @@ import { groupBy, pick, unique } from "@app/lib/fn"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { EnforcementLevel } from "@app/lib/types"; import { ActorType } from "@app/services/auth/auth-type"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal"; @@ -28,13 +29,6 @@ import { fnSecretBulkUpdate, getAllNestedSecretReferences } from "@app/services/secret/secret-fns"; -import { - fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, - fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, - fnSecretBulkDelete as fnSecretV2BridgeBulkDelete, - getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge, - secretEncryptionHelper -} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; import { TSecretQueueFactory } from "@app/services/secret/secret-queue"; import { SecretOperations } from "@app/services/secret/secret-types"; import { TSecretVersionDALFactory } from "@app/services/secret/secret-version-dal"; @@ -44,6 +38,16 @@ import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-fold import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service"; import { TUserDALFactory } from "@app/services/user/user-dal"; +import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { + fnSecretBulkDelete as fnSecretV2BridgeBulkDelete, + fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, + fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, + getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge, + secretEncryptionHelper +} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; +import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; import { TPermissionServiceFactory } from "../permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission"; @@ -63,10 +67,6 @@ import { TSecretApprovalDetailsDTO, TStatusChangeDTO } from "./secret-approval-request-types"; -import { TKmsServiceFactory } from "@app/services/kms/kms-service"; -import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; -import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; -import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; type TSecretApprovalRequestServiceFactoryDep = { permissionService: Pick; @@ -730,7 +730,7 @@ export const secretApprovalRequestServiceFactory = ({ }); } - await snapshotService.performSnapshot(folderId, shouldUseSecretV2Bridge); + await snapshotService.performSnapshot(folderId); const [folder] = await folderDAL.findSecretPathByFolderIds(projectId, [folderId]); if (!folder) throw new BadRequestError({ message: "Folder not found" }); await secretQueueService.syncSecrets({ diff --git a/backend/src/ee/services/secret-replication/secret-replication-service.ts b/backend/src/ee/services/secret-replication/secret-replication-service.ts index dc165612c..52d10b690 100644 --- a/backend/src/ee/services/secret-replication/secret-replication-service.ts +++ b/backend/src/ee/services/secret-replication/secret-replication-service.ts @@ -10,15 +10,11 @@ import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { QueueName, TQueueServiceFactory } from "@app/queue"; import { ActorType } from "@app/services/auth/auth-type"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; import { TSecretDALFactory } from "@app/services/secret/secret-dal"; import { fnSecretBulkInsert, fnSecretBulkUpdate } from "@app/services/secret/secret-fns"; -import { - fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, - fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, - getAllNestedSecretReferences, - getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge -} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; import { TSecretQueueFactory, uniqueSecretQueueKey } from "@app/services/secret/secret-queue"; import { SecretOperations } from "@app/services/secret/secret-types"; import { TSecretVersionDALFactory } from "@app/services/secret/secret-version-dal"; @@ -28,13 +24,17 @@ import { ReservedFolders } from "@app/services/secret-folder/secret-folder-types import { TSecretImportDALFactory } from "@app/services/secret-import/secret-import-dal"; import { fnSecretsFromImports, fnSecretsV2FromImports } from "@app/services/secret-import/secret-import-fns"; import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; - -import { MAX_REPLICATION_DEPTH } from "./secret-replication-constants"; import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { + fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, + fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, + getAllNestedSecretReferences, + getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge +} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; -import { TKmsServiceFactory } from "@app/services/kms/kms-service"; -import { KmsDataKey } from "@app/services/kms/kms-types"; + +import { MAX_REPLICATION_DEPTH } from "./secret-replication-constants"; type TSecretReplicationServiceFactoryDep = { secretDAL: Pick< diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts index b10873e5b..11b6c34af 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts @@ -17,9 +17,13 @@ import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; import { TSecretDALFactory } from "@app/services/secret/secret-dal"; import { TSecretVersionDALFactory } from "@app/services/secret/secret-version-dal"; +import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; import { TTelemetryServiceFactory } from "@app/services/telemetry/telemetry-service"; import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types"; @@ -39,10 +43,6 @@ import { secretRotationPreSetFn } from "./secret-rotation-queue-fn"; import { TSecretRotationData, TSecretRotationDbFn, TSecretRotationEncData } from "./secret-rotation-queue-types"; -import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; -import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; -import { TKmsServiceFactory } from "@app/services/kms/kms-service"; -import { KmsDataKey } from "@app/services/kms/kms-types"; export type TSecretRotationQueueFactory = ReturnType; diff --git a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts index 8487d9d8c..39d3a0997 100644 --- a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts +++ b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts @@ -10,6 +10,9 @@ import { TSecretVersionTagDALFactory } from "@app/services/secret/secret-version import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; import { TSecretFolderVersionDALFactory } from "@app/services/secret-folder/secret-folder-version-dal"; import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; +import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; import { TLicenseServiceFactory } from "../license/license-service"; import { TPermissionServiceFactory } from "../permission/permission-service"; @@ -23,11 +26,8 @@ import { import { TSnapshotDALFactory } from "./snapshot-dal"; import { TSnapshotFolderDALFactory } from "./snapshot-folder-dal"; import { TSnapshotSecretDALFactory } from "./snapshot-secret-dal"; -import { getFullFolderPath } from "./snapshot-service-fns"; -import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; import { TSnapshotSecretV2DALFactory } from "./snapshot-secret-v2-dal"; -import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; -import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; +import { getFullFolderPath } from "./snapshot-service-fns"; type TSecretSnapshotServiceFactoryDep = { snapshotDAL: TSnapshotDALFactory; @@ -167,14 +167,15 @@ export const secretSnapshotServiceFactory = ({ return snapshotDetails; }; - const performSnapshot = async (folderId: string, shouldUseSecretV2Bridge: boolean) => { + const performSnapshot = async (folderId: string) => { try { if (!licenseService.isValidLicense) throw new InternalServerError({ message: "Invalid license" }); + const folder = await folderDAL.findById(folderId); + if (!folder) throw new BadRequestError({ message: "Folder not found" }); + const shouldUseSecretV2Bridge = folder.projectVersion === 3; + if (shouldUseSecretV2Bridge) { const snapshot = await snapshotDAL.transaction(async (tx) => { - const folder = await folderDAL.findById(folderId, tx); - if (!folder) throw new BadRequestError({ message: "Folder not found" }); - const secretVersions = await secretVersionV2BridgeDAL.findLatestVersionByFolderId(folderId, tx); const folderVersions = await folderVersionDAL.findLatestVersionByFolderId(folderId, tx); const newSnapshot = await snapshotDAL.create( @@ -208,9 +209,6 @@ export const secretSnapshotServiceFactory = ({ } const snapshot = await snapshotDAL.transaction(async (tx) => { - const folder = await folderDAL.findById(folderId, tx); - if (!folder) throw new BadRequestError({ message: "Folder not found" }); - const secretVersions = await secretVersionDAL.findLatestVersionByFolderId(folderId, tx); const folderVersions = await folderVersionDAL.findLatestVersionByFolderId(folderId, tx); const newSnapshot = await snapshotDAL.create( diff --git a/backend/src/lib/fn/index.ts b/backend/src/lib/fn/index.ts index 381ecebf3..82a4c4914 100644 --- a/backend/src/lib/fn/index.ts +++ b/backend/src/lib/fn/index.ts @@ -6,3 +6,4 @@ export * from "./array"; export * from "./dates"; export * from "./object"; export * from "./string"; +export * from "./undefined"; diff --git a/backend/src/lib/fn/undefined.ts b/backend/src/lib/fn/undefined.ts new file mode 100644 index 000000000..00f9d8e51 --- /dev/null +++ b/backend/src/lib/fn/undefined.ts @@ -0,0 +1,3 @@ +export const executeIfDefined = (func: (input: T) => R, input: T | undefined): R | undefined => { + return input === undefined ? undefined : func(input); +}; diff --git a/backend/src/services/integration-auth/integration-auth-service.ts b/backend/src/services/integration-auth/integration-auth-service.ts index e5126532f..bccdbd23f 100644 --- a/backend/src/services/integration-auth/integration-auth-service.ts +++ b/backend/src/services/integration-auth/integration-auth-service.ts @@ -11,6 +11,8 @@ import { BadRequestError } from "@app/lib/errors"; import { TProjectPermission } from "@app/lib/types"; import { TIntegrationDALFactory } from "../integration/integration-dal"; +import { TKmsServiceFactory } from "../kms/kms-service"; +import { KmsDataKey } from "../kms/kms-types"; import { TProjectBotDALFactory } from "../project-bot/project-bot-dal"; import { TProjectBotServiceFactory } from "../project-bot/project-bot-service"; import { getApps } from "./integration-app-list"; @@ -55,6 +57,7 @@ type TIntegrationAuthServiceFactoryDep = { projectBotService: Pick; projectBotDAL: Pick; permissionService: Pick; + kmsService: Pick; }; export type TIntegrationAuthServiceFactory = ReturnType; @@ -64,7 +67,8 @@ export const integrationAuthServiceFactory = ({ integrationAuthDAL, integrationDAL, projectBotDAL, - projectBotService + projectBotService, + kmsService }: TIntegrationAuthServiceFactoryDep) => { const listIntegrationAuthByProjectId = async ({ actorId, @@ -145,18 +149,38 @@ export const integrationAuthServiceFactory = ({ }; } - const key = await projectBotService.getBotKey(projectId); - if (tokenExchange.refreshToken) { - const refreshEncToken = encryptSymmetric128BitHexKeyUTF8(tokenExchange.refreshToken, key); - updateDoc.refreshIV = refreshEncToken.iv; - updateDoc.refreshTag = refreshEncToken.tag; - updateDoc.refreshCiphertext = refreshEncToken.ciphertext; - } - if (tokenExchange.accessToken) { - const accessEncToken = encryptSymmetric128BitHexKeyUTF8(tokenExchange.accessToken, key); - updateDoc.accessIV = accessEncToken.iv; - updateDoc.accessTag = accessEncToken.tag; - updateDoc.accessCiphertext = accessEncToken.ciphertext; + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + if (tokenExchange.refreshToken) { + const refreshEncToken = secretManagerEncryptor({ + plainText: Buffer.from(tokenExchange.refreshToken) + }).cipherTextBlob; + updateDoc.encryptedRefresh = refreshEncToken; + } + if (tokenExchange.accessToken) { + const accessToken = secretManagerEncryptor({ + plainText: Buffer.from(tokenExchange.accessToken) + }).cipherTextBlob; + updateDoc.encryptedAccess = accessToken; + } + } else { + if (!botKey) throw new BadRequestError({ message: "Bot key not found" }); + if (tokenExchange.refreshToken) { + const refreshEncToken = encryptSymmetric128BitHexKeyUTF8(tokenExchange.refreshToken, botKey); + updateDoc.refreshIV = refreshEncToken.iv; + updateDoc.refreshTag = refreshEncToken.tag; + updateDoc.refreshCiphertext = refreshEncToken.ciphertext; + } + if (tokenExchange.accessToken) { + const accessEncToken = encryptSymmetric128BitHexKeyUTF8(tokenExchange.accessToken, botKey); + updateDoc.accessIV = accessEncToken.iv; + updateDoc.accessTag = accessEncToken.tag; + updateDoc.accessCiphertext = accessEncToken.ciphertext; + } } return integrationAuthDAL.transaction(async (tx) => { const doc = await integrationAuthDAL.findOne({ projectId, integration }, tx); @@ -212,109 +236,210 @@ export const integrationAuthServiceFactory = ({ : {}) }; - const key = await projectBotService.getBotKey(projectId); - if (refreshToken) { - const tokenDetails = await exchangeRefresh( - integration, - refreshToken, - url, - updateDoc.metadata as Record - ); - const refreshEncToken = encryptSymmetric128BitHexKeyUTF8(tokenDetails.refreshToken, key); - updateDoc.refreshIV = refreshEncToken.iv; - updateDoc.refreshTag = refreshEncToken.tag; - updateDoc.refreshCiphertext = refreshEncToken.ciphertext; - const accessEncToken = encryptSymmetric128BitHexKeyUTF8(tokenDetails.accessToken, key); - updateDoc.accessIV = accessEncToken.iv; - updateDoc.accessTag = accessEncToken.tag; - updateDoc.accessCiphertext = accessEncToken.ciphertext; - updateDoc.accessExpiresAt = tokenDetails.accessExpiresAt; - } + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + if (refreshToken) { + const tokenDetails = await exchangeRefresh( + integration, + refreshToken, + url, + updateDoc.metadata as Record + ); + const refreshEncToken = secretManagerEncryptor({ + plainText: Buffer.from(tokenDetails.refreshToken) + }).cipherTextBlob; + updateDoc.encryptedRefresh = refreshEncToken; - if (!refreshToken && (accessId || accessToken || awsAssumeIamRoleArn)) { - if (accessToken) { - const accessEncToken = encryptSymmetric128BitHexKeyUTF8(accessToken, key); + const accessEncToken = secretManagerEncryptor({ + plainText: Buffer.from(tokenDetails.accessToken) + }).cipherTextBlob; + updateDoc.encryptedAccess = accessEncToken; + updateDoc.accessExpiresAt = tokenDetails.accessExpiresAt; + } + + if (!refreshToken && (accessId || accessToken || awsAssumeIamRoleArn)) { + if (accessToken) { + const accessEncToken = secretManagerEncryptor({ + plainText: Buffer.from(accessToken) + }).cipherTextBlob; + updateDoc.encryptedAccess = accessEncToken; + } + if (accessId) { + const accessEncToken = secretManagerEncryptor({ + plainText: Buffer.from(accessId) + }).cipherTextBlob; + updateDoc.encryptedAccessId = accessEncToken; + } + if (awsAssumeIamRoleArn) { + const awsAssumeIamRoleArnEncrypted = secretManagerEncryptor({ + plainText: Buffer.from(awsAssumeIamRoleArn) + }).cipherTextBlob; + updateDoc.hasEncryptedAwsIamAssumRole = awsAssumeIamRoleArnEncrypted; + } + } + } else { + if (!botKey) throw new BadRequestError({ message: "Bot key not found" }); + if (refreshToken) { + const tokenDetails = await exchangeRefresh( + integration, + refreshToken, + url, + updateDoc.metadata as Record + ); + const refreshEncToken = encryptSymmetric128BitHexKeyUTF8(tokenDetails.refreshToken, botKey); + updateDoc.refreshIV = refreshEncToken.iv; + updateDoc.refreshTag = refreshEncToken.tag; + updateDoc.refreshCiphertext = refreshEncToken.ciphertext; + const accessEncToken = encryptSymmetric128BitHexKeyUTF8(tokenDetails.accessToken, botKey); updateDoc.accessIV = accessEncToken.iv; updateDoc.accessTag = accessEncToken.tag; updateDoc.accessCiphertext = accessEncToken.ciphertext; + + updateDoc.accessExpiresAt = tokenDetails.accessExpiresAt; } - if (accessId) { - const accessEncToken = encryptSymmetric128BitHexKeyUTF8(accessId, key); - updateDoc.accessIdIV = accessEncToken.iv; - updateDoc.accessIdTag = accessEncToken.tag; - updateDoc.accessIdCiphertext = accessEncToken.ciphertext; - } - if (awsAssumeIamRoleArn) { - const awsAssumeIamRoleArnEnc = encryptSymmetric128BitHexKeyUTF8(awsAssumeIamRoleArn, key); - updateDoc.awsAssumeIamRoleArnCipherText = awsAssumeIamRoleArnEnc.ciphertext; - updateDoc.awsAssumeIamRoleArnIV = awsAssumeIamRoleArnEnc.iv; - updateDoc.awsAssumeIamRoleArnTag = awsAssumeIamRoleArnEnc.tag; + + if (!refreshToken && (accessId || accessToken || awsAssumeIamRoleArn)) { + if (accessToken) { + const accessEncToken = encryptSymmetric128BitHexKeyUTF8(accessToken, botKey); + updateDoc.accessIV = accessEncToken.iv; + updateDoc.accessTag = accessEncToken.tag; + updateDoc.accessCiphertext = accessEncToken.ciphertext; + } + if (accessId) { + const accessEncToken = encryptSymmetric128BitHexKeyUTF8(accessId, botKey); + updateDoc.accessIdIV = accessEncToken.iv; + updateDoc.accessIdTag = accessEncToken.tag; + updateDoc.accessIdCiphertext = accessEncToken.ciphertext; + } + if (awsAssumeIamRoleArn) { + const awsAssumeIamRoleArnEnc = encryptSymmetric128BitHexKeyUTF8(awsAssumeIamRoleArn, botKey); + updateDoc.awsAssumeIamRoleArnCipherText = awsAssumeIamRoleArnEnc.ciphertext; + updateDoc.awsAssumeIamRoleArnIV = awsAssumeIamRoleArnEnc.iv; + updateDoc.awsAssumeIamRoleArnTag = awsAssumeIamRoleArnEnc.tag; + } } } return integrationAuthDAL.create(updateDoc); }; // helper function - const getIntegrationAccessToken = async (integrationAuth: TIntegrationAuths, botKey: string) => { + const getIntegrationAccessToken = async ( + integrationAuth: TIntegrationAuths, + shouldUseSecretV2Bridge: boolean, + botKey?: string + ) => { let accessToken: string | undefined; let accessId: string | undefined; // this means its not access token based if ( integrationAuth.integration === Integrations.AWS_SECRET_MANAGER && - integrationAuth.awsAssumeIamRoleArnCipherText + (shouldUseSecretV2Bridge + ? integrationAuth.hasEncryptedAwsIamAssumRole + : integrationAuth.awsAssumeIamRoleArnCipherText) ) { return { accessToken: "", accessId: "" }; } + if (shouldUseSecretV2Bridge) { + const { decryptor: secretManagerDecryptor, encryptor: secretManagerEncryptor } = + await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId: integrationAuth.projectId + }); + if (integrationAuth.encryptedAccess) { + accessToken = secretManagerDecryptor({ cipherTextBlob: integrationAuth.encryptedAccess }).toString(); + } - if (integrationAuth.accessTag && integrationAuth.accessIV && integrationAuth.accessCiphertext) { - accessToken = decryptSymmetric128BitHexKeyUTF8({ - ciphertext: integrationAuth.accessCiphertext, - iv: integrationAuth.accessIV, - tag: integrationAuth.accessTag, - key: botKey - }); - } + if (integrationAuth.encryptedRefresh) { + const refreshToken = secretManagerDecryptor({ cipherTextBlob: integrationAuth.encryptedRefresh }).toString(); - if (integrationAuth.refreshCiphertext && integrationAuth.refreshIV && integrationAuth.refreshTag) { - const refreshToken = decryptSymmetric128BitHexKeyUTF8({ - key: botKey, - ciphertext: integrationAuth.refreshCiphertext, - iv: integrationAuth.refreshIV, - tag: integrationAuth.refreshTag - }); + if (integrationAuth.accessExpiresAt && integrationAuth.accessExpiresAt < new Date()) { + // refer above it contains same logic except not saving + const tokenDetails = await exchangeRefresh( + integrationAuth.integration, + refreshToken, + integrationAuth?.url, + integrationAuth.metadata as Record + ); + const encryptedRefresh = secretManagerEncryptor({ + plainText: Buffer.from(tokenDetails.refreshToken) + }).cipherTextBlob; + const encryptedAccess = secretManagerEncryptor({ + plainText: Buffer.from(tokenDetails.accessToken) + }).cipherTextBlob; + accessToken = tokenDetails.accessToken; + await integrationAuthDAL.updateById(integrationAuth.id, { + accessExpiresAt: tokenDetails.accessExpiresAt, + encryptedRefresh, + encryptedAccess + }); + } + } + if (!accessToken) throw new BadRequestError({ message: "Missing access token" }); - if (integrationAuth.accessExpiresAt && integrationAuth.accessExpiresAt < new Date()) { - // refer above it contains same logic except not saving - const tokenDetails = await exchangeRefresh( - integrationAuth.integration, - refreshToken, - integrationAuth?.url, - integrationAuth.metadata as Record - ); - const refreshEncToken = encryptSymmetric128BitHexKeyUTF8(tokenDetails.refreshToken, botKey); - const accessEncToken = encryptSymmetric128BitHexKeyUTF8(tokenDetails.accessToken, botKey); - accessToken = tokenDetails.accessToken; - await integrationAuthDAL.updateById(integrationAuth.id, { - refreshIV: refreshEncToken.iv, - refreshTag: refreshEncToken.tag, - refreshCiphertext: refreshEncToken.ciphertext, - accessExpiresAt: tokenDetails.accessExpiresAt, - accessIV: accessEncToken.iv, - accessTag: accessEncToken.tag, - accessCiphertext: accessEncToken.ciphertext + if (integrationAuth.encryptedAccessId) { + accessId = secretManagerDecryptor({ + cipherTextBlob: integrationAuth.encryptedAccessId + }).toString(); + } + + // the old bot key is else + } else { + if (!botKey) throw new BadRequestError({ message: "bot key is missing" }); + if (integrationAuth.accessTag && integrationAuth.accessIV && integrationAuth.accessCiphertext) { + accessToken = decryptSymmetric128BitHexKeyUTF8({ + ciphertext: integrationAuth.accessCiphertext, + iv: integrationAuth.accessIV, + tag: integrationAuth.accessTag, + key: botKey + }); + } + + if (integrationAuth.refreshCiphertext && integrationAuth.refreshIV && integrationAuth.refreshTag) { + const refreshToken = decryptSymmetric128BitHexKeyUTF8({ + key: botKey, + ciphertext: integrationAuth.refreshCiphertext, + iv: integrationAuth.refreshIV, + tag: integrationAuth.refreshTag + }); + + if (integrationAuth.accessExpiresAt && integrationAuth.accessExpiresAt < new Date()) { + // refer above it contains same logic except not saving + const tokenDetails = await exchangeRefresh( + integrationAuth.integration, + refreshToken, + integrationAuth?.url, + integrationAuth.metadata as Record + ); + const refreshEncToken = encryptSymmetric128BitHexKeyUTF8(tokenDetails.refreshToken, botKey); + const accessEncToken = encryptSymmetric128BitHexKeyUTF8(tokenDetails.accessToken, botKey); + accessToken = tokenDetails.accessToken; + await integrationAuthDAL.updateById(integrationAuth.id, { + refreshIV: refreshEncToken.iv, + refreshTag: refreshEncToken.tag, + refreshCiphertext: refreshEncToken.ciphertext, + accessExpiresAt: tokenDetails.accessExpiresAt, + accessIV: accessEncToken.iv, + accessTag: accessEncToken.tag, + accessCiphertext: accessEncToken.ciphertext + }); + } + } + if (!accessToken) throw new BadRequestError({ message: "Missing access token" }); + + if (integrationAuth.accessIdTag && integrationAuth.accessIdIV && integrationAuth.accessIdCiphertext) { + accessId = decryptSymmetric128BitHexKeyUTF8({ + key: botKey, + ciphertext: integrationAuth.accessIdCiphertext, + iv: integrationAuth.accessIdIV, + tag: integrationAuth.accessIdTag }); } } - if (!accessToken) throw new BadRequestError({ message: "Missing access token" }); - if (integrationAuth.accessIdTag && integrationAuth.accessIdIV && integrationAuth.accessIdCiphertext) { - accessId = decryptSymmetric128BitHexKeyUTF8({ - key: botKey, - ciphertext: integrationAuth.accessIdCiphertext, - iv: integrationAuth.accessIdIV, - tag: integrationAuth.accessIdTag - }); - } return { accessId, accessToken }; }; @@ -339,8 +464,8 @@ export const integrationAuthServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken, accessId } = await getIntegrationAccessToken(integrationAuth, botKey); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken, accessId } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const apps = await getApps({ integration: integrationAuth.integration, accessToken, @@ -371,8 +496,8 @@ export const integrationAuthServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const teams = await getTeams({ integration: integrationAuth.integration, accessToken, @@ -400,8 +525,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (appId) { const { data } = await request.get( @@ -441,8 +566,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (accountId) { const { data } = await request.get(`${IntegrationUrls.CHECKLY_API_URL}/v1/check-groups`, { headers: { @@ -468,8 +593,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const octokit = new Octokit({ auth: accessToken @@ -505,8 +630,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const octokit = new Octokit({ auth: accessToken @@ -537,8 +662,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const { data } = await request.get<{ results: Array<{ id: string; name: string }> }>( `${IntegrationUrls.QOVERY_API_URL}/organization`, { @@ -571,8 +696,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessId, accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessId, accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const kms = new AWS.KMS({ region, @@ -629,8 +754,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (orgId) { const { data } = await request.get<{ results: Array<{ id: string; name: string }> }>( `${IntegrationUrls.QOVERY_API_URL}/organization/${orgId}/project`, @@ -665,8 +790,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (projectId && projectId !== "none") { // TODO: fix const { data } = await request.get<{ results: { id: string; name: string }[] }>( @@ -706,8 +831,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (environmentId) { const { data } = await request.get<{ results: { id: string; name: string }[] }>( `${IntegrationUrls.QOVERY_API_URL}/environment/${environmentId}/application`, @@ -746,8 +871,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (environmentId) { const { data } = await request.get<{ results: { id: string; name: string }[] }>( `${IntegrationUrls.QOVERY_API_URL}/environment/${environmentId}/container`, @@ -786,8 +911,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (environmentId) { const { data } = await request.get<{ results: { id: string; name: string }[] }>( `${IntegrationUrls.QOVERY_API_URL}/environment/${environmentId}/job`, @@ -825,8 +950,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const { data } = await request.get( `${IntegrationUrls.HEROKU_API_URL}/pipeline-couplings`, @@ -865,8 +990,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (appId) { const query = ` query GetEnvironments($projectId: String!, $after: String, $before: String, $first: Int, $isEphemeral: Boolean, $last: Int) { @@ -933,8 +1058,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (appId && appId !== "") { const query = ` @@ -1007,8 +1132,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const workspaces: TBitbucketWorkspace[] = []; let hasNextPage = true; let workspaceUrl = `${IntegrationUrls.BITBUCKET_API_URL}/2.0/workspaces`; @@ -1056,8 +1181,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); const secretGroups: { name: string; groupId: string }[] = []; if (appId) { @@ -1124,8 +1249,8 @@ export const integrationAuthServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations); - const botKey = await projectBotService.getBotKey(integrationAuth.projectId); - const { accessToken } = await getIntegrationAccessToken(integrationAuth, botKey); + const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId); + const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey); if (appId) { const { data: { buildType } diff --git a/backend/src/services/secret-folder/secret-folder-dal.ts b/backend/src/services/secret-folder/secret-folder-dal.ts index 1803f8977..f9768ecc2 100644 --- a/backend/src/services/secret-folder/secret-folder-dal.ts +++ b/backend/src/services/secret-folder/secret-folder-dal.ts @@ -312,12 +312,14 @@ export const secretFolderDALFactory = (db: TDbClient) => { const folder = await (tx || db.replicaNode())(TableName.SecretFolder) .where({ [`${TableName.SecretFolder}.id` as "id"]: id }) .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`) + .join(TableName.Project, `${TableName.Environment}.projectId`, `${TableName.Project}.id`) .select(selectAllTableCols(TableName.SecretFolder)) .select( db.ref("id").withSchema(TableName.Environment).as("envId"), db.ref("slug").withSchema(TableName.Environment).as("envSlug"), db.ref("name").withSchema(TableName.Environment).as("envName"), - db.ref("projectId").withSchema(TableName.Environment) + db.ref("projectId").withSchema(TableName.Environment), + db.ref("version").withSchema(TableName.Project).as("projectVersion") ) .first(); if (folder) { diff --git a/backend/src/services/secret-import/secret-import-service.ts b/backend/src/services/secret-import/secret-import-service.ts index c20c2345e..d2d189c2a 100644 --- a/backend/src/services/secret-import/secret-import-service.ts +++ b/backend/src/services/secret-import/secret-import-service.ts @@ -9,6 +9,8 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services import { getReplicationFolderName } from "@app/ee/services/secret-replication/secret-replication-service"; import { BadRequestError } from "@app/lib/errors"; +import { TKmsServiceFactory } from "../kms/kms-service"; +import { KmsDataKey } from "../kms/kms-types"; import { TProjectDALFactory } from "../project/project-dal"; import { TProjectBotServiceFactory } from "../project-bot/project-bot-service"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; @@ -16,8 +18,9 @@ import { TSecretDALFactory } from "../secret/secret-dal"; import { decryptSecretRaw } from "../secret/secret-fns"; import { TSecretQueueFactory } from "../secret/secret-queue"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; +import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal"; import { TSecretImportDALFactory } from "./secret-import-dal"; -import { fnSecretsFromImports } from "./secret-import-fns"; +import { fnSecretsFromImports, fnSecretsV2FromImports } from "./secret-import-fns"; import { TCreateSecretImportDTO, TDeleteSecretImportDTO, @@ -31,12 +34,14 @@ type TSecretImportServiceFactoryDep = { secretImportDAL: TSecretImportDALFactory; folderDAL: TSecretFolderDALFactory; secretDAL: Pick; + secretV2BridgeDAL: Pick; projectBotService: Pick; projectDAL: Pick; projectEnvDAL: TProjectEnvDALFactory; permissionService: Pick; secretQueueService: Pick; licenseService: Pick; + kmsService: Pick; }; const ERR_SEC_IMP_NOT_FOUND = new BadRequestError({ message: "Secret import not found" }); @@ -52,7 +57,9 @@ export const secretImportServiceFactory = ({ secretDAL, secretQueueService, licenseService, - projectBotService + projectBotService, + secretV2BridgeDAL, + kmsService }: TSecretImportServiceFactoryDep) => { const createImport = async ({ environment, @@ -489,7 +496,23 @@ export const secretImportServiceFactory = ({ ) ); - const botKey = await projectBotService.getBotKey(projectId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + const importedSecrets = await fnSecretsV2FromImports({ + allowedImports, + folderDAL, + secretDAL: secretV2BridgeDAL, + secretImportDAL, + decryptor: (value) => + value ? secretManagerEncryptor({ plainText: value }).cipherTextBlob.toString() : undefined + }); + return importedSecrets; + } + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const importedSecrets = await fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL }); diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts index 24fbff609..a7717eed3 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts @@ -4,11 +4,11 @@ import { TableName, TSecretFolders, TSecretsV2 } from "@app/db/schemas"; import { groupBy } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; +import { TKmsServiceFactory } from "../kms/kms-service"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; import { TFnSecretBulkDelete, TFnSecretBulkInsert, TFnSecretBulkUpdate } from "./secret-v2-bridge-types"; -import { TKmsServiceFactory } from "../kms/kms-service"; const INTERPOLATION_SYNTAX_REG = /\${([^}]+)}/g; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 0753a4f50..9656221d2 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -14,6 +14,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid"; import { ActorType } from "../auth/auth-type"; import { TKmsServiceFactory } from "../kms/kms-service"; +import { KmsDataKey } from "../kms/kms-types"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TSecretQueueFactory } from "../secret/secret-queue"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; @@ -22,7 +23,6 @@ import { fnSecretsV2FromImports } from "../secret-import/secret-import-fns"; import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal"; import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; import { - secretEncryptionHelper, fnSecretBulkDelete, fnSecretBulkInsert, fnSecretBulkUpdate, @@ -51,10 +51,7 @@ import { TSecretVersionV2TagDALFactory } from "./secret-version-tag-dal"; type TSecretV2BridgeServiceFactoryDep = { secretDAL: TSecretV2BridgeDALFactory; secretVersionDAL: TSecretVersionV2DALFactory; - kmsService: Pick< - TKmsServiceFactory, - "getProjectSecretManagerKmsDataKey" | "encryptWithInputKey" | "decryptWithInputKey" - >; + kmsService: Pick; secretVersionTagDAL: Pick; secretTagDAL: TSecretTagDALFactory; permissionService: Pick; @@ -69,7 +66,7 @@ type TSecretV2BridgeServiceFactoryDep = { secretApprovalRequestDAL: Pick; secretApprovalRequestSecretDAL: Pick< TSecretApprovalRequestSecretDALFactory, - "insertMany" | "insertApprovalSecretTags" + "insertV2Bridge" | "insertApprovalSecretV2Tags" >; snapshotService: Pick; }; @@ -150,8 +147,10 @@ export const secretV2BridgeServiceFactory = ({ const { secretName, type, ...el } = inputSecret; const references = getAllNestedSecretReferences(inputSecret.secretValue); - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); const secret = await secretDAL.transaction((tx) => fnSecretBulkInsert({ @@ -161,8 +160,12 @@ export const secretV2BridgeServiceFactory = ({ version: 1, type, reminderRepeatDays: el.secretReminderRepeatDays, - encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), - encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue), + encryptedComment: el.secretComment + ? secretManagerEncryptor({ plainText: Buffer.from(el.secretComment) }).cipherTextBlob + : undefined, + encryptedValue: el.secretValue + ? secretManagerEncryptor({ plainText: Buffer.from(el.secretValue) }).cipherTextBlob + : undefined, reminderNote: el.secretReminderNote, skipMultilineEncoding: el.skipMultilineEncoding, key: secretName, @@ -179,7 +182,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - await snapshotService.performSnapshot(folderId, true); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ secretPath, actorId, @@ -274,14 +277,16 @@ export const secretV2BridgeServiceFactory = ({ const tags = inputSecret.tagIds ? await secretTagDAL.find({ projectId, $in: { id: inputSecret.tagIds } }) : []; if ((inputSecret.tagIds || []).length !== tags.length) throw new BadRequestError({ message: "Tag not found" }); - const { secretName, secretValue, secretComment } = inputSecret; + const { secretName, secretValue } = inputSecret; - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); const encryptedValue = typeof secretValue !== "undefined" ? { - encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretValue) as Buffer, + encryptedValue: secretManagerEncryptor({ plainText: Buffer.from(secretValue) }).cipherTextBlob, references: getAllNestedSecretReferences(secretValue) } : {}; @@ -294,7 +299,9 @@ export const secretV2BridgeServiceFactory = ({ filter: { id: secretId }, data: { reminderRepeatDays: inputSecret.secretReminderRepeatDays, - encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretComment), + encryptedComment: inputSecret.secretComment + ? secretManagerEncryptor({ plainText: Buffer.from(inputSecret.secretComment) }).cipherTextBlob + : undefined, reminderNote: inputSecret.secretReminderNote, skipMultilineEncoding: inputSecret.skipMultilineEncoding, key: inputSecret.newSecretName || secretName, @@ -319,7 +326,7 @@ export const secretV2BridgeServiceFactory = ({ projectId }); - await snapshotService.performSnapshot(folderId, true); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ actor, actorId, @@ -385,7 +392,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - await snapshotService.performSnapshot(folderId, true); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ actor, actorId, @@ -394,12 +401,18 @@ export const secretV2BridgeServiceFactory = ({ environmentSlug: folder.environment.slug }); - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); return reshapeBridgeSecret(projectId, environment, secretPath, { ...deletedSecret[0], - value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedValue), - comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedComment) + value: deletedSecret[0].encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedValue }).toString() + : undefined, + comment: deletedSecret[0].encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedComment }).toString() + : undefined }); }; @@ -463,8 +476,10 @@ export const secretV2BridgeServiceFactory = ({ actorId ); - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); if (includeImports) { const secretImports = await secretImportDAL.findByFolderIds(paths.map((p) => p.folderId)); @@ -486,15 +501,19 @@ export const secretV2BridgeServiceFactory = ({ secretDAL, folderDAL, secretImportDAL, - decryptor: (value) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, value) + decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined) }); return { secrets: secrets.map((secret) => reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, { ...secret, - value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue), - comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) + value: secret.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString() + : undefined, + comment: secret.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString() + : undefined }) ), imports: importedSecrets @@ -505,8 +524,12 @@ export const secretV2BridgeServiceFactory = ({ secrets: secrets.map((secret) => reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, { ...secret, - value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue), - comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) + value: secret.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString() + : undefined, + comment: secret.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString() + : undefined }) ) }; @@ -553,8 +576,10 @@ export const secretV2BridgeServiceFactory = ({ secretType = SecretType.Shared; } - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); const secret = await (version === undefined ? secretDAL.findOneWithTags({ @@ -571,9 +596,10 @@ export const secretV2BridgeServiceFactory = ({ key: secretName }) .then((el) => SecretsV2Schema.parse({ ...el, id: el.secretId }))); + const interpolateInlineSecretReference = interpolateSecrets({ projectId, - decryptSecret: (encryptedValue) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue), + decryptSecret: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined), secretDAL, folderDAL }); @@ -600,17 +626,17 @@ export const secretV2BridgeServiceFactory = ({ secretDAL, folderDAL, secretImportDAL, - decryptor: (value) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, value) + decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined) }); for (let i = importedSecrets.length - 1; i >= 0; i -= 1) { for (let j = 0; j < importedSecrets[i].secrets.length; j += 1) { if (secretName === importedSecrets[i].secrets[j].key) { const importedSecret = importedSecrets[i].secrets[j]; - let secretValue = secretEncryptionHelper.decryptValue( - secretManagerDecryptor, - importedSecret.encryptedValue - ); + let secretValue = importedSecret.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: importedSecret.encryptedValue }).toString() + : undefined; + if (expandSecretReferences && secretValue) { const secretReferenceExpandedString = { [importedSecret.key]: { value: secretValue } @@ -623,7 +649,9 @@ export const secretV2BridgeServiceFactory = ({ return reshapeBridgeSecret(projectId, importedSecrets[i].environment, importedSecrets[i].secretPath, { ...importedSecret, value: secretValue, - comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedComment) + comment: importedSecret.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: importedSecret.encryptedComment }).toString() + : undefined }); } } @@ -631,7 +659,9 @@ export const secretV2BridgeServiceFactory = ({ } if (!secret) throw new BadRequestError({ message: "Secret not found" }); - let secretValue = secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue); + let secretValue = secret.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString() + : undefined; if (expandSecretReferences && secretValue) { const secretReferenceExpandedString = { [secret.key]: { value: secretValue } @@ -644,7 +674,9 @@ export const secretV2BridgeServiceFactory = ({ return reshapeBridgeSecret(projectId, environment, path, { ...secret, value: secretValue, - comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment) + comment: secret.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString() + : undefined }); }; @@ -693,15 +725,19 @@ export const secretV2BridgeServiceFactory = ({ const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : []; if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" }); - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } = + await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId }); const newSecrets = await secretDAL.transaction(async (tx) => fnSecretBulkInsert({ inputSecrets: inputSecrets.map((el) => ({ version: 1, - encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), - encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue), + encryptedComment: el.secretComment + ? secretManagerEncryptor({ plainText: Buffer.from(el.secretComment) }).cipherTextBlob + : undefined, + encryptedValue: el.secretValue + ? secretManagerEncryptor({ plainText: Buffer.from(el.secretValue) }).cipherTextBlob + : undefined, skipMultilineEncoding: el.skipMultilineEncoding, key: el.secretKey, tagIds: el.tagIds, @@ -717,7 +753,7 @@ export const secretV2BridgeServiceFactory = ({ }) ); - await snapshotService.performSnapshot(folderId, true); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ actor, actorId, @@ -726,12 +762,13 @@ export const secretV2BridgeServiceFactory = ({ environmentSlug: folder.environment.slug }); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); return newSecrets.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), - comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) + value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : undefined, + comment: el.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() + : undefined }) ); }; @@ -799,8 +836,8 @@ export const secretV2BridgeServiceFactory = ({ const tags = sanitizedTagIds.length ? await secretTagDAL.findManyTagsById(projectId, sanitizedTagIds) : []; if (tags.length !== sanitizedTagIds.length) throw new BadRequestError({ message: "Tag not found" }); - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } = + await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId }); const secrets = await secretDAL.transaction(async (tx) => fnSecretBulkUpdate({ @@ -811,7 +848,7 @@ export const secretV2BridgeServiceFactory = ({ const encryptedValue = typeof el.secretValue !== "undefined" ? { - encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue) as Buffer, + encryptedValue: secretManagerEncryptor({ plainText: Buffer.from(el.secretValue) }).cipherTextBlob, references: getAllNestedSecretReferences(el.secretValue) } : {}; @@ -819,7 +856,9 @@ export const secretV2BridgeServiceFactory = ({ filter: { id: originalSecret.id, type: SecretType.Shared }, data: { reminderRepeatDays: el.secretReminderRepeatDays, - encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment), + encryptedComment: el.secretComment + ? secretManagerEncryptor({ plainText: Buffer.from(el.secretComment) }).cipherTextBlob + : undefined, reminderNote: el.secretReminderNote, skipMultilineEncoding: el.skipMultilineEncoding, key: el.newSecretName || el.secretKey, @@ -834,7 +873,7 @@ export const secretV2BridgeServiceFactory = ({ secretVersionTagDAL }) ); - await snapshotService.performSnapshot(folderId, true); + await snapshotService.performSnapshot(folderId); await secretQueueService.syncSecrets({ actor, actorId, @@ -843,12 +882,13 @@ export const secretV2BridgeServiceFactory = ({ environmentSlug: folder.environment.slug }); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); return secrets.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), - comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) + value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : undefined, + comment: el.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() + : undefined }) ); }; @@ -917,13 +957,17 @@ export const secretV2BridgeServiceFactory = ({ environmentSlug: folder.environment.slug }); - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); return secretsDeleted.map((el) => reshapeBridgeSecret(projectId, environment, secretPath, { ...el, - value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue), - comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment) + value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : undefined, + comment: el.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() + : undefined }) ); }; @@ -977,8 +1021,10 @@ export const secretV2BridgeServiceFactory = ({ if (!hasRole(ProjectMembershipRole.Admin)) throw new BadRequestError({ message: "Only admins are allowed to take this action" }); - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); await secretDAL.transaction(async (tx) => { const secrets = await secretDAL.findAllProjectSecretValues(projectId, tx); await secretDAL.upsertSecretReferences( @@ -987,9 +1033,7 @@ export const secretV2BridgeServiceFactory = ({ .map(({ id, encryptedValue }) => ({ secretId: id, references: encryptedValue - ? getAllNestedSecretReferences( - secretEncryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue) as string - ) + ? getAllNestedSecretReferences(secretManagerDecryptor({ cipherTextBlob: encryptedValue }).toString()) : [] })), tx @@ -1067,11 +1111,15 @@ export const secretV2BridgeServiceFactory = ({ }); } - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); const decryptedSourceSecrets = sourceSecrets.map((secret) => ({ ...secret, - value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue) + value: secret.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString() + : undefined })); let isSourceUpdated = false; @@ -1090,7 +1138,9 @@ export const secretV2BridgeServiceFactory = ({ const decryptedDestinationSecrets = destinationSecretsFromDB.map((secret) => { return { ...secret, - value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue) + value: secret.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString() + : undefined }; }); @@ -1151,33 +1201,25 @@ export const secretV2BridgeServiceFactory = ({ tx ); - // TODO(akhilmhdh-sev2): fix this - // const commits = locallyCreatedSecrets.concat(locallyUpdatedSecrets).map((doc) => { - // const { operation } = doc; - // const localSecret = destinationSecretsGroupedByKey[doc.key]?.[0]; - // - // return { - // op: operation, - // requestId: approvalRequestDoc.id, - // metadata: doc.metadata, - // secretKeyIV: doc.secretKeyIV, - // secretKeyTag: doc.secretKeyTag, - // secretKeyCiphertext: doc.secretKeyCiphertext, - // secretValueIV: doc.secretValueIV, - // secretValueTag: doc.secretValueTag, - // secretValueCiphertext: doc.secretValueCiphertext, - // secretBlindIndex: doc.secretBlindIndex, - // secretCommentIV: doc.secretCommentIV, - // secretCommentTag: doc.secretCommentTag, - // secretCommentCiphertext: doc.secretCommentCiphertext, - // skipMultilineEncoding: doc.skipMultilineEncoding, - // // except create operation other two needs the secret id and version id - // ...(operation !== SecretOperations.Create - // ? { secretId: localSecret.id, secretVersion: latestSecretVersions[localSecret.id].id } - // : {}) - // }; - // }); - await secretApprovalRequestSecretDAL.insertMany([], tx); + const commits = locallyCreatedSecrets.concat(locallyUpdatedSecrets).map((doc) => { + const { operation } = doc; + const localSecret = destinationSecretsGroupedByKey[doc.key]?.[0]; + + return { + op: operation, + requestId: approvalRequestDoc.id, + metadata: doc.metadata, + key: doc.key, + encryptedValue: doc.encryptedValue, + encryptedComment: doc.encryptedComment, + skipMultilineEncoding: doc.skipMultilineEncoding, + // except create operation other two needs the secret id and version id + ...(operation !== SecretOperations.Create + ? { secretId: localSecret.id, secretVersion: latestSecretVersions[localSecret.id].id } + : {}) + }; + }); + await secretApprovalRequestSecretDAL.insertV2Bridge(commits, tx); } else { // apply changes directly if (locallyCreatedSecrets.length) { @@ -1268,34 +1310,24 @@ export const secretV2BridgeServiceFactory = ({ tx ); - // TODO(akhilmhdh-sev2): finish this - // const commits = locallyDeletedSecrets.map((doc) => { - // const { operation } = doc; - // const localSecret = sourceSecretsGroupByKey[doc.key]?.[0]; - // - // return { - // op: operation, - // keyEncoding: doc.keyEncoding, - // algorithm: doc.algorithm, - // requestId: approvalRequestDoc.id, - // metadata: doc.metadata, - // secretKeyIV: doc.secretKeyIV, - // secretKeyTag: doc.secretKeyTag, - // secretKeyCiphertext: doc.secretKeyCiphertext, - // secretValueIV: doc.secretValueIV, - // secretValueTag: doc.secretValueTag, - // secretValueCiphertext: doc.secretValueCiphertext, - // secretBlindIndex: doc.secretBlindIndex, - // secretCommentIV: doc.secretCommentIV, - // secretCommentTag: doc.secretCommentTag, - // secretCommentCiphertext: doc.secretCommentCiphertext, - // skipMultilineEncoding: doc.skipMultilineEncoding, - // secretId: localSecret.id, - // secretVersion: latestSecretVersions[localSecret.id].id - // }; - // }); + const commits = locallyDeletedSecrets.map((doc) => { + const { operation } = doc; + const localSecret = sourceSecretsGroupByKey[doc.key]?.[0]; - await secretApprovalRequestSecretDAL.insertMany([], tx); + return { + op: operation, + requestId: approvalRequestDoc.id, + metadata: doc.metadata, + key: doc.key, + encryptedComment: doc.encryptedComment, + encryptedValue: doc.encryptedValue, + skipMultilineEncoding: doc.skipMultilineEncoding, + secretId: localSecret.id, + secretVersion: latestSecretVersions[localSecret.id].id + }; + }); + + await secretApprovalRequestSecretDAL.insertV2Bridge(commits, tx); } else { // if no secret approval policy is present, we delete directly. await secretDAL.delete( @@ -1313,7 +1345,7 @@ export const secretV2BridgeServiceFactory = ({ }); if (isDestinationUpdated) { - await snapshotService.performSnapshot(destinationFolder.id, true); + await snapshotService.performSnapshot(destinationFolder.id); await secretQueueService.syncSecrets({ projectId, secretPath: destinationFolder.path, @@ -1324,7 +1356,7 @@ export const secretV2BridgeServiceFactory = ({ } if (isSourceUpdated) { - await snapshotService.performSnapshot(sourceFolder.id, true); + await snapshotService.performSnapshot(sourceFolder.id); await secretQueueService.syncSecrets({ projectId, secretPath: sourceFolder.path, diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index f4c66841c..d6a860b93 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -22,8 +22,14 @@ import { import { BadRequestError } from "@app/lib/errors"; import { groupBy, unique } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; +import { + fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, + fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, + getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge +} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; import { ActorAuthMethod, ActorType } from "../auth/auth-type"; +import { KmsDataKey } from "../kms/kms-types"; import { getBotKeyFnFactory } from "../project-bot/project-bot-fns"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; @@ -39,12 +45,6 @@ import { TUpdateManySecretsRawFn, TUpdateManySecretsRawFnFactory } from "./secret-types"; -import { KmsDataKey } from "../kms/kms-types"; -import { - fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, - fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, - getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge -} from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; export const generateSecretBlindIndexBySalt = async (secretName: string, secretBlindIndexDoc: TSecretBlindIndexes) => { const appCfg = getConfig(); diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts index 337eba8f5..d5af6d137 100644 --- a/backend/src/services/secret/secret-queue.ts +++ b/backend/src/services/secret/secret-queue.ts @@ -18,6 +18,8 @@ import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; import { TIntegrationDALFactory } from "../integration/integration-dal"; import { TIntegrationAuthServiceFactory } from "../integration-auth/integration-auth-service"; import { syncIntegrationSecrets } from "../integration-auth/integration-sync-secret"; +import { TKmsServiceFactory } from "../kms/kms-service"; +import { KmsDataKey } from "../kms/kms-types"; import { TOrgDALFactory } from "../org/org-dal"; import { TProjectDALFactory } from "../project/project-dal"; import { TProjectBotServiceFactory } from "../project-bot/project-bot-service"; @@ -25,6 +27,9 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TSecretImportDALFactory } from "../secret-import/secret-import-dal"; +import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal"; +import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal"; +import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal"; import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service"; import { TWebhookDALFactory } from "../webhook/webhook-dal"; import { fnTriggerWebhook } from "../webhook/webhook-fns"; @@ -36,10 +41,6 @@ import { TRemoveSecretReminderDTO, TSyncSecretsDTO } from "./secret-types"; -import { TKmsServiceFactory } from "../kms/kms-service"; -import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal"; -import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal"; -import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal"; export type TSecretQueueFactory = ReturnType; type TSecretQueueFactoryDep = { @@ -557,6 +558,10 @@ export const secretQueueFactory = ({ } const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(projectId); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); let referencedFolderIds; if (shouldUseSecretV2Bridge) { const secretReferences = await secretV2BridgeDAL.findReferencedSecretReferences( @@ -623,31 +628,44 @@ export const secretQueueFactory = ({ projectId: integration.projectId }; - const { accessToken, accessId } = await integrationAuthService.getIntegrationAccessToken(integrationAuth, botKey); - const awsAssumeRoleArn = + const { accessToken, accessId } = await integrationAuthService.getIntegrationAccessToken( + integrationAuth, + shouldUseSecretV2Bridge, + botKey + ); + let awsAssumeRoleArn = null; + if (shouldUseSecretV2Bridge) { + if (integrationAuth.awsAssumeIamRoleArnCipherText) { + awsAssumeRoleArn = secretManagerDecryptor({ + cipherTextBlob: Buffer.from(integrationAuth.awsAssumeIamRoleArnCipherText) + }).toString(); + } + } else if ( integrationAuth.awsAssumeIamRoleArnTag && integrationAuth.awsAssumeIamRoleArnIV && integrationAuth.awsAssumeIamRoleArnCipherText - ? decryptSymmetric128BitHexKeyUTF8({ - ciphertext: integrationAuth.awsAssumeIamRoleArnCipherText, - iv: integrationAuth.awsAssumeIamRoleArnIV, - tag: integrationAuth.awsAssumeIamRoleArnTag, - key: botKey - }) - : null; + ) { + awsAssumeRoleArn = decryptSymmetric128BitHexKeyUTF8({ + ciphertext: integrationAuth.awsAssumeIamRoleArnCipherText, + iv: integrationAuth.awsAssumeIamRoleArnIV, + tag: integrationAuth.awsAssumeIamRoleArnTag, + key: botKey as string + }); + } const secrets = shouldUseSecretV2Bridge ? await getIntegrationSecretsV2({ environment, projectId, folderId: folder.id, - depth: 1 + depth: 1, + decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : "") }) : await getIntegrationSecrets({ environment, projectId, folderId: folder.id, - key: botKey, + key: botKey as string, depth: 1 }); const suffixedSecrets: typeof secrets = {}; diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 1a157ddc0..11222ec2b 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -14,6 +14,7 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service"; import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal"; import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal"; +import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service"; import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service"; import { getConfig } from "@app/lib/config/env"; import { @@ -73,7 +74,6 @@ import { } from "./secret-types"; import { TSecretVersionDALFactory } from "./secret-version-dal"; import { TSecretVersionTagDALFactory } from "./secret-version-tag-dal"; -import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service"; type TSecretServiceFactoryDep = { secretDAL: TSecretDALFactory; diff --git a/backend/src/services/secret/secret-types.ts b/backend/src/services/secret/secret-types.ts index cac5adef2..8628e12f3 100644 --- a/backend/src/services/secret/secret-types.ts +++ b/backend/src/services/secret/secret-types.ts @@ -12,10 +12,10 @@ import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-fold import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal"; import { ActorType } from "../auth/auth-type"; +import { TKmsServiceFactory } from "../kms/kms-service"; import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal"; import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal"; import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal"; -import { TKmsServiceFactory } from "../kms/kms-service"; type TPartialSecret = Pick; From 641860cdb87f02a3f06062bef4c9ecba357e3a72 Mon Sep 17 00:00:00 2001 From: = Date: Mon, 22 Jul 2024 20:51:41 +0530 Subject: [PATCH 43/77] feat: resolved all ts issues on router schema and other functions --- .../v1/secret-approval-request-router.ts | 55 ++++----- .../src/ee/routes/v1/secret-version-router.ts | 4 +- backend/src/ee/routes/v1/snapshot-router.ts | 6 +- .../secret-approval-request-service.ts | 10 ++ .../secret-snapshot-service.ts | 60 +++++++++- backend/src/server/routes/index.ts | 90 +++++++++----- backend/src/server/routes/v3/secret-router.ts | 92 ++++++++++---- .../secret-v2-bridge-service.ts | 15 ++- backend/src/services/secret/secret-service.ts | 112 ++++++++++++------ backend/src/services/secret/secret-types.ts | 5 + 10 files changed, 316 insertions(+), 133 deletions(-) diff --git a/backend/src/ee/routes/v1/secret-approval-request-router.ts b/backend/src/ee/routes/v1/secret-approval-request-router.ts index 0ba7099a3..0f5f3f3db 100644 --- a/backend/src/ee/routes/v1/secret-approval-request-router.ts +++ b/backend/src/ee/routes/v1/secret-approval-request-router.ts @@ -3,16 +3,14 @@ import { z } from "zod"; import { SecretApprovalRequestsReviewersSchema, SecretApprovalRequestsSchema, - SecretApprovalRequestsSecretsSchema, - SecretsSchema, SecretTagsSchema, - SecretVersionsSchema, UsersSchema } from "@app/db/schemas"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { ApprovalStatus, RequestState } from "@app/ee/services/secret-approval-request/secret-approval-request-types"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; +import { secretRawSchema } from "@app/server/routes/sanitizedSchemas"; import { AuthMode } from "@app/services/auth/auth-type"; const approvalRequestUser = z.object({ userId: z.string() }).merge( @@ -261,43 +259,30 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv committerUser: approvalRequestUser, reviewers: approvalRequestUser.extend({ status: z.string() }).array(), secretPath: z.string(), - commits: SecretApprovalRequestsSecretsSchema.omit({ secretBlindIndex: true }) + commits: secretRawSchema + .omit({ _id: true, environment: true, workspace: true, type: true, version: true }) .merge( z.object({ tags: tagSchema, - secret: SecretsSchema.pick({ - id: true, - version: true, - secretKeyIV: true, - secretKeyTag: true, - secretKeyCiphertext: true, - secretValueIV: true, - secretValueTag: true, - secretValueCiphertext: true, - secretCommentIV: true, - secretCommentTag: true, - secretCommentCiphertext: true - }) + secret: z + .object({ + id: z.string(), + version: z.number(), + secretKey: z.string(), + secretValue: z.string().optional(), + secretComment: z.string().optional() + }) .optional() .nullable(), - secretVersion: SecretVersionsSchema.pick({ - id: true, - version: true, - secretKeyIV: true, - secretKeyTag: true, - secretKeyCiphertext: true, - secretValueIV: true, - secretValueTag: true, - secretValueCiphertext: true, - secretCommentIV: true, - secretCommentTag: true, - secretCommentCiphertext: true - }) - .merge( - z.object({ - tags: tagSchema - }) - ) + secretVersion: z + .object({ + id: z.string(), + version: z.number(), + secretKey: z.string(), + secretValue: z.string().optional(), + secretComment: z.string().optional(), + tags: tagSchema + }) .optional() }) ) diff --git a/backend/src/ee/routes/v1/secret-version-router.ts b/backend/src/ee/routes/v1/secret-version-router.ts index 0604135ba..11443ebfe 100644 --- a/backend/src/ee/routes/v1/secret-version-router.ts +++ b/backend/src/ee/routes/v1/secret-version-router.ts @@ -1,8 +1,8 @@ import { z } from "zod"; -import { SecretVersionsSchema } from "@app/db/schemas"; import { readLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; +import { secretRawSchema } from "@app/server/routes/sanitizedSchemas"; import { AuthMode } from "@app/services/auth/auth-type"; export const registerSecretVersionRouter = async (server: FastifyZodProvider) => { @@ -22,7 +22,7 @@ export const registerSecretVersionRouter = async (server: FastifyZodProvider) => }), response: { 200: z.object({ - secretVersions: SecretVersionsSchema.omit({ secretBlindIndex: true }).array() + secretVersions: secretRawSchema.array() }) } }, diff --git a/backend/src/ee/routes/v1/snapshot-router.ts b/backend/src/ee/routes/v1/snapshot-router.ts index 6767f8383..aa1e66be2 100644 --- a/backend/src/ee/routes/v1/snapshot-router.ts +++ b/backend/src/ee/routes/v1/snapshot-router.ts @@ -1,9 +1,10 @@ import { z } from "zod"; -import { SecretSnapshotsSchema, SecretTagsSchema, SecretVersionsSchema } from "@app/db/schemas"; +import { SecretSnapshotsSchema, SecretTagsSchema } from "@app/db/schemas"; import { PROJECTS } from "@app/lib/api-docs"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; +import { secretRawSchema } from "@app/server/routes/sanitizedSchemas"; import { AuthMode } from "@app/services/auth/auth-type"; export const registerSnapshotRouter = async (server: FastifyZodProvider) => { @@ -27,7 +28,8 @@ export const registerSnapshotRouter = async (server: FastifyZodProvider) => { slug: z.string(), name: z.string() }), - secretVersions: SecretVersionsSchema.omit({ secretBlindIndex: true }) + secretVersions: secretRawSchema + .omit({ _id: true, environment: true, workspace: true, type: true, version: true }) .merge( z.object({ tags: SecretTagsSchema.pick({ diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index 7d2197a58..6bd9bbd40 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -221,6 +221,15 @@ export const secretApprovalRequestServiceFactory = ({ ); secrets = encrypedSecrets.map((el) => ({ ...el, + secretKey: el.key, + id: el.id, + version: el.version, + secretValue: el.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() + : undefined, + secretComment: el.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() + : undefined, secret: { secretKey: el.secret.key, id: el.secret.id, @@ -249,6 +258,7 @@ export const secretApprovalRequestServiceFactory = ({ const encrypedSecrets = await secretApprovalRequestSecretDAL.findByRequestId(secretApprovalRequest.id); secrets = encrypedSecrets.map((el) => ({ ...el, + ...decryptSecretWithBot(el, botKey), secret: { id: el.secret.id, version: el.secret.version, diff --git a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts index 39d3a0997..c5d8bd4fa 100644 --- a/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts +++ b/backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts @@ -1,9 +1,13 @@ import { ForbiddenError, subject } from "@casl/ability"; import { TableName, TSecretTagJunctionInsert, TSecretV2TagJunctionInsert } from "@app/db/schemas"; +import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; import { BadRequestError, InternalServerError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; +import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; import { TSecretDALFactory } from "@app/services/secret/secret-dal"; import { TSecretVersionDALFactory } from "@app/services/secret/secret-version-dal"; import { TSecretVersionTagDALFactory } from "@app/services/secret/secret-version-tag-dal"; @@ -45,6 +49,8 @@ type TSecretSnapshotServiceFactoryDep = { folderDAL: Pick; permissionService: Pick; licenseService: Pick; + kmsService: Pick; + projectBotService: Pick; }; export type TSecretSnapshotServiceFactory = ReturnType; @@ -64,7 +70,9 @@ export const secretSnapshotServiceFactory = ({ secretVersionV2BridgeDAL, secretV2BridgeDAL, snapshotSecretV2BridgeDAL, - secretVersionV2TagBridgeDAL + secretVersionV2TagBridgeDAL, + kmsService, + projectBotService }: TSecretSnapshotServiceFactoryDep) => { const projectSecretSnapshotCount = async ({ environment, @@ -144,9 +152,55 @@ export const secretSnapshotServiceFactory = ({ const shouldUseBridge = snapshot.projectVersion === 3; let snapshotDetails; if (shouldUseBridge) { - snapshotDetails = await snapshotDAL.findSecretSnapshotV2DataById(id); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId: snapshot.projectId + }); + const encryptedSnapshotDetails = await snapshotDAL.findSecretSnapshotV2DataById(id); + snapshotDetails = { + ...encryptedSnapshotDetails, + secretVersions: encryptedSnapshotDetails.secretVersions.map((el) => ({ + ...el, + secretKey: el.key, + secretValue: el.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() + : undefined, + secretComment: el.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() + : undefined + })) + }; } else { - snapshotDetails = await snapshotDAL.findSecretSnapshotDataById(id); + const encryptedSnapshotDetails = await snapshotDAL.findSecretSnapshotDataById(id); + const { botKey } = await projectBotService.getBotKey(snapshot.projectId); + if (!botKey) throw new BadRequestError({ message: "bot not found" }); + snapshotDetails = { + ...encryptedSnapshotDetails, + secretVersions: encryptedSnapshotDetails.secretVersions.map((el) => ({ + ...el, + secretKey: decryptSymmetric128BitHexKeyUTF8({ + ciphertext: el.secretKeyCiphertext, + iv: el.secretKeyIV, + tag: el.secretKeyTag, + key: botKey + }), + secretValue: decryptSymmetric128BitHexKeyUTF8({ + ciphertext: el.secretValueCiphertext, + iv: el.secretValueIV, + tag: el.secretValueTag, + key: botKey + }), + secretComment: + el.secretCommentTag && el.secretCommentIV && el.secretCommentCiphertext + ? decryptSymmetric128BitHexKeyUTF8({ + ciphertext: el.secretCommentCiphertext, + iv: el.secretCommentIV, + tag: el.secretCommentTag, + key: botKey + }) + : "" + })) + }; } const fullFolderPath = await getFullFolderPath({ diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 3e4f940f7..0627cc932 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -66,6 +66,7 @@ import { secretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/s import { snapshotDALFactory } from "@app/ee/services/secret-snapshot/snapshot-dal"; import { snapshotFolderDALFactory } from "@app/ee/services/secret-snapshot/snapshot-folder-dal"; import { snapshotSecretDALFactory } from "@app/ee/services/secret-snapshot/snapshot-secret-dal"; +import { snapshotSecretV2DALFactory } from "@app/ee/services/secret-snapshot/snapshot-secret-v2-dal"; import { trustedIpDALFactory } from "@app/ee/services/trusted-ip/trusted-ip-dal"; import { trustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-service"; import { TKeyStoreFactory } from "@app/keystore/keystore"; @@ -235,7 +236,7 @@ export const registerRoutes = async ( const secretV2BridgeDAL = secretV2BridgeDALFactory(db); const secretVersionV2BridgeDAL = secretVersionV2BridgeDALFactory(db); - const secretVersionV2TagBridgeDAL = secretVersionV2TagBridgeDALFactory(db); + const secretVersionTagV2BridgeDAL = secretVersionV2TagBridgeDALFactory(db); const integrationDAL = integrationDALFactory(db); const integrationAuthDAL = integrationAuthDALFactory(db); @@ -285,6 +286,7 @@ export const registerRoutes = async ( const secretRotationDAL = secretRotationDALFactory(db); const snapshotDAL = snapshotDALFactory(db); const snapshotSecretDAL = snapshotSecretDALFactory(db); + const snapshotSecretV2BridgeDAL = snapshotSecretV2DALFactory(db); const snapshotFolderDAL = snapshotFolderDALFactory(db); const gitAppInstallSessionDAL = gitAppInstallSessionDALFactory(db); @@ -665,7 +667,13 @@ export const registerRoutes = async ( secretVersionDAL, folderVersionDAL, secretTagDAL, - secretVersionTagDAL + secretVersionTagDAL, + projectBotService, + kmsService, + secretV2BridgeDAL, + secretVersionV2BridgeDAL, + snapshotSecretV2BridgeDAL, + secretVersionV2TagBridgeDAL: secretVersionTagV2BridgeDAL }); const webhookService = webhookServiceFactory({ permissionService, @@ -689,7 +697,8 @@ export const registerRoutes = async ( integrationDAL, permissionService, projectBotDAL, - projectBotService + projectBotService, + kmsService }); const secretQueueService = secretQueueFactory({ queueService, @@ -709,7 +718,11 @@ export const registerRoutes = async ( secretVersionDAL, secretBlindIndexDAL, secretTagDAL, - secretVersionTagDAL + secretVersionTagDAL, + kmsService, + secretVersionV2BridgeDAL, + secretV2BridgeDAL, + secretVersionTagV2BridgeDAL }); const secretImportService = secretImportServiceFactory({ licenseService, @@ -720,7 +733,9 @@ export const registerRoutes = async ( secretImportDAL, projectDAL, secretDAL, - secretQueueService + secretQueueService, + secretV2BridgeDAL, + kmsService }); const secretBlindIndexService = secretBlindIndexServiceFactory({ permissionService, @@ -734,13 +749,39 @@ export const registerRoutes = async ( secretQueueService, secretDAL: secretV2BridgeDAL, permissionService, - secretVersionTagDAL: secretVersionV2TagBridgeDAL, + secretVersionTagDAL: secretVersionTagV2BridgeDAL, secretTagDAL, projectEnvDAL, secretImportDAL, secretApprovalRequestDAL, secretApprovalPolicyService, - secretApprovalRequestSecretDAL + secretApprovalRequestSecretDAL, + kmsService, + snapshotService + }); + + const secretApprovalRequestService = secretApprovalRequestServiceFactory({ + permissionService, + projectBotService, + folderDAL, + secretDAL, + secretTagDAL, + secretApprovalRequestSecretDAL, + secretApprovalRequestReviewerDAL, + projectDAL, + secretVersionDAL, + secretBlindIndexDAL, + secretApprovalRequestDAL, + snapshotService, + secretVersionTagDAL, + secretQueueService, + kmsService, + secretV2BridgeDAL, + secretVersionV2BridgeDAL, + secretVersionTagV2BridgeDAL, + smtpService, + projectEnvDAL, + userDAL }); const secretService = secretServiceFactory({ @@ -760,7 +801,8 @@ export const registerRoutes = async ( secretApprovalPolicyService, secretApprovalRequestDAL, secretApprovalRequestSecretDAL, - secretV2BridgeService + secretV2BridgeService, + secretApprovalRequestService }); const secretSharingService = secretSharingServiceFactory({ @@ -769,26 +811,6 @@ export const registerRoutes = async ( orgDAL }); - const secretApprovalRequestService = secretApprovalRequestServiceFactory({ - permissionService, - projectBotService, - folderDAL, - secretDAL, - secretTagDAL, - secretApprovalRequestSecretDAL, - secretApprovalRequestReviewerDAL, - projectDAL, - secretVersionDAL, - secretBlindIndexDAL, - secretApprovalRequestDAL, - snapshotService, - secretVersionTagDAL, - secretQueueService, - smtpService, - userDAL, - projectEnvDAL - }); - const accessApprovalPolicyService = accessApprovalPolicyServiceFactory({ accessApprovalPolicyDAL, accessApprovalPolicyApproverDAL, @@ -822,11 +844,14 @@ export const registerRoutes = async ( queueService, folderDAL, secretApprovalPolicyService, - secretBlindIndexDAL, secretApprovalRequestDAL, secretApprovalRequestSecretDAL, secretQueueService, - projectBotService + projectBotService, + kmsService, + secretV2BridgeDAL, + secretVersionV2TagBridgeDAL: secretVersionTagV2BridgeDAL, + secretVersionV2BridgeDAL }); const secretRotationQueue = secretRotationQueueFactory({ telemetryService, @@ -834,7 +859,10 @@ export const registerRoutes = async ( queue: queueService, secretDAL, secretVersionDAL, - projectBotService + projectBotService, + secretVersionV2BridgeDAL, + secretV2BridgeDAL, + kmsService }); const secretRotationService = secretRotationServiceFactory({ diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index b24bef1a0..b0776d150 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -18,7 +18,7 @@ import { getUserAgentType } from "@app/server/plugins/audit-log"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { ActorType, AuthMode } from "@app/services/auth/auth-type"; import { ProjectFilterType } from "@app/services/project/project-types"; -import { SecretOperations } from "@app/services/secret/secret-types"; +import { SecretOperations, SecretProtectionType } from "@app/services/secret/secret-types"; import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types"; import { secretRawSchema } from "../sanitizedSchemas"; @@ -442,14 +442,17 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretReminderNote: z.string().optional().nullable().describe(RAW_SECRETS.CREATE.secretReminderNote) }), response: { - 200: z.object({ - secret: secretRawSchema - }) + 200: z.union([ + z.object({ + secret: secretRawSchema + }), + z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled") + ]) } }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const secret = await server.services.secret.createSecretRaw({ + const secretOperation = await server.services.secret.createSecretRaw({ actorId: req.permission.id, actor: req.permission.type, actorOrgId: req.permission.orgId, @@ -466,7 +469,11 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretReminderNote: req.body.secretReminderNote, secretReminderRepeatDays: req.body.secretReminderRepeatDays }); + if (secretOperation.type === SecretProtectionType.Approval) { + return { approval: secretOperation.approval }; + } + const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ projectId: req.body.workspaceId, ...req.auditLogInfo, @@ -542,14 +549,17 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretComment: z.string().optional().describe(RAW_SECRETS.UPDATE.secretComment) }), response: { - 200: z.object({ - secret: secretRawSchema - }) + 200: z.union([ + z.object({ + secret: secretRawSchema + }), + z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled") + ]) } }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const secret = await server.services.secret.updateSecretRaw({ + const secretOperation = await server.services.secret.updateSecretRaw({ actorId: req.permission.id, actor: req.permission.type, actorOrgId: req.permission.orgId, @@ -568,6 +578,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { newSecretName: req.body.newSecretName, secretComment: req.body.secretComment }); + if (secretOperation.type === SecretProtectionType.Approval) { + return { approval: secretOperation.approval }; + } + const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ projectId: req.body.workspaceId, @@ -628,14 +642,17 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.DELETE.type) }), response: { - 200: z.object({ - secret: secretRawSchema - }) + 200: z.union([ + z.object({ + secret: secretRawSchema + }), + z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled") + ]) } }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const secret = await server.services.secret.deleteSecretRaw({ + const secretOperation = await server.services.secret.deleteSecretRaw({ actorId: req.permission.id, actor: req.permission.type, actorAuthMethod: req.permission.authMethod, @@ -646,6 +663,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretName: req.params.secretName, type: req.body.type }); + if (secretOperation.type === SecretProtectionType.Approval) { + return { approval: secretOperation.approval }; + } + const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ projectId: req.body.workspaceId, @@ -1815,16 +1836,19 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .min(1) }), response: { - 200: z.object({ - secrets: secretRawSchema.array() - }) + 200: z.union([ + z.object({ + secrets: secretRawSchema.array() + }), + z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled") + ]) } }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { const { environment, projectSlug, secretPath, secrets: inputSecrets } = req.body; - const secrets = await server.services.secret.createManySecretsRaw({ + const secretOperation = await server.services.secret.createManySecretsRaw({ actorId: req.permission.id, actor: req.permission.type, actorAuthMethod: req.permission.authMethod, @@ -1835,6 +1859,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { projectId: req.body.workspaceId, secrets: inputSecrets }); + if (secretOperation.type === SecretProtectionType.Approval) { + return { approval: secretOperation.approval }; + } + const { secrets } = secretOperation; await server.services.auditLog.createAuditLog({ projectId: secrets[0].workspace, @@ -1914,15 +1942,18 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .min(1) }), response: { - 200: z.object({ - secrets: secretRawSchema.array() - }) + 200: z.union([ + z.object({ + secrets: secretRawSchema.array() + }), + z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled") + ]) } }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { const { environment, projectSlug, secretPath, secrets: inputSecrets } = req.body; - const secrets = await server.services.secret.updateManySecretsRaw({ + const secretOperation = await server.services.secret.updateManySecretsRaw({ actorId: req.permission.id, actor: req.permission.type, actorAuthMethod: req.permission.authMethod, @@ -1933,6 +1964,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { projectId: req.body.workspaceId, secrets: inputSecrets }); + if (secretOperation.type === SecretProtectionType.Approval) { + return { approval: secretOperation.approval }; + } + const { secrets } = secretOperation; await server.services.auditLog.createAuditLog({ projectId: secrets[0].workspace, @@ -1999,15 +2034,18 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { .min(1) }), response: { - 200: z.object({ - secrets: secretRawSchema.array() - }) + 200: z.union([ + z.object({ + secrets: secretRawSchema.array() + }), + z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled") + ]) } }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { const { environment, projectSlug, secretPath, secrets: inputSecrets } = req.body; - const secrets = await server.services.secret.deleteManySecretsRaw({ + const secretOperation = await server.services.secret.deleteManySecretsRaw({ actorId: req.permission.id, actor: req.permission.type, actorAuthMethod: req.permission.authMethod, @@ -2018,6 +2056,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { projectId: req.body.workspaceId, secrets: inputSecrets }); + if (secretOperation.type === SecretProtectionType.Approval) { + return { approval: secretOperation.approval }; + } + const { secrets } = secretOperation; await server.services.auditLog.createAuditLog({ projectId: secrets[0].workspace, diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 9656221d2..726314a45 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -995,9 +995,20 @@ export const secretV2BridgeServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback); - + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId: folder.projectId + }); const secretVersions = await secretVersionDAL.find({ secretId }, { offset, limit, sort: [["createdAt", "desc"]] }); - return secretVersions; + return secretVersions.map((el) => + reshapeBridgeSecret(folder.projectId, folder.environment.envSlug, "/", { + ...el, + value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : undefined, + comment: el.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() + : undefined + }) + ); }; // this is a backfilling API for secret references diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 11222ec2b..ea29f7c8b 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -51,6 +51,7 @@ import { import { TSecretQueueFactory } from "./secret-queue"; import { SecretOperations, + SecretProtectionType, TAttachSecretTagsDTO, TBackFillSecretReferencesDTO, TCreateBulkSecretDTO, @@ -1228,7 +1229,7 @@ export const secretServiceFactory = ({ : undefined; if (shouldUseSecretV2Bridge) { if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ policy, secretPath, environment, @@ -1251,6 +1252,7 @@ export const secretServiceFactory = ({ ] } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secret = await secretV2BridgeService.createSecret({ @@ -1270,7 +1272,7 @@ export const secretServiceFactory = ({ skipMultilineEncoding, secretReminderRepeatDays }); - return secret; + return { secret, type: SecretProtectionType.Direct as const }; } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1278,7 +1280,7 @@ export const secretServiceFactory = ({ const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey); const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey); if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequest({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ policy, secretPath, environment, @@ -1306,6 +1308,7 @@ export const secretServiceFactory = ({ ] } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secret = await createSecret({ @@ -1333,7 +1336,7 @@ export const secretServiceFactory = ({ tags: tagIds }); - return decryptSecretRaw(secret, botKey); + return { type: SecretProtectionType.Direct as const, secret: decryptSecretRaw(secret, botKey) }; }; const updateSecretRaw = async ({ @@ -1362,7 +1365,7 @@ export const secretServiceFactory = ({ : undefined; if (shouldUseSecretV2Bridge) { if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ policy, secretPath, environment, @@ -1386,6 +1389,7 @@ export const secretServiceFactory = ({ ] } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secret = await secretV2BridgeService.updateSecret({ secretReminderRepeatDays, @@ -1406,7 +1410,7 @@ export const secretServiceFactory = ({ metadata, secretValue }); - return secret; + return { type: SecretProtectionType.Direct as const, secret }; } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1416,7 +1420,7 @@ export const secretServiceFactory = ({ const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretName, botKey); if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequest({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ policy, secretPath, environment, @@ -1447,6 +1451,7 @@ export const secretServiceFactory = ({ ] } }); + return { approval, type: SecretProtectionType.Approval as const }; } const secret = await updateSecret({ @@ -1477,7 +1482,7 @@ export const secretServiceFactory = ({ }); await snapshotService.performSnapshot(secret.folderId); - return decryptSecretRaw(secret, botKey); + return { type: SecretProtectionType.Direct as const, secret: decryptSecretRaw(secret, botKey) }; }; const deleteSecretRaw = async ({ @@ -1498,7 +1503,7 @@ export const secretServiceFactory = ({ : undefined; if (shouldUseSecretV2Bridge) { if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ policy, actorAuthMethod, actorOrgId, @@ -1515,6 +1520,7 @@ export const secretServiceFactory = ({ ] } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secret = await secretV2BridgeService.deleteSecret({ secretName, @@ -1527,11 +1533,11 @@ export const secretServiceFactory = ({ environment, secretPath }); - return secret; + return { type: SecretProtectionType.Direct as const, secret }; } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequest({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ policy, actorAuthMethod, actorOrgId, @@ -1548,6 +1554,7 @@ export const secretServiceFactory = ({ ] } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secret = await deleteSecret({ secretName, @@ -1561,7 +1568,7 @@ export const secretServiceFactory = ({ actorAuthMethod }); - return decryptSecretRaw(secret, botKey); + return { type: SecretProtectionType.Direct as const, secret: decryptSecretRaw(secret, botKey) }; }; const createManySecretsRaw = async ({ @@ -1593,7 +1600,7 @@ export const secretServiceFactory = ({ : undefined; if (shouldUseSecretV2Bridge) { if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ policy, secretPath, environment, @@ -1613,6 +1620,7 @@ export const secretServiceFactory = ({ })) } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secrets = await secretV2BridgeService.createManySecret({ secretPath, @@ -1624,8 +1632,9 @@ export const secretServiceFactory = ({ actorId, secrets: inputSecrets }); - return secrets; + return { secrets, type: SecretProtectionType.Direct as const }; } + if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); const sanitizedSecrets = inputSecrets.map( ({ secretComment, secretKey, metadata, tagIds, secretValue, skipMultilineEncoding }) => { @@ -1651,7 +1660,7 @@ export const secretServiceFactory = ({ } ); if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequest({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ policy, secretPath, environment, @@ -1664,6 +1673,7 @@ export const secretServiceFactory = ({ [SecretOperations.Create]: sanitizedSecrets } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secrets = await createManySecret({ projectId, @@ -1676,9 +1686,12 @@ export const secretServiceFactory = ({ secrets: sanitizedSecrets }); - return secrets.map((secret) => - decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath }, botKey) - ); + return { + type: SecretProtectionType.Direct as const, + secrets: secrets.map((secret) => + decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath }, botKey) + ) + }; }; const updateManySecretsRaw = async ({ @@ -1709,7 +1722,7 @@ export const secretServiceFactory = ({ : undefined; if (shouldUseSecretV2Bridge) { if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ policy, secretPath, environment, @@ -1728,6 +1741,7 @@ export const secretServiceFactory = ({ })) } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secrets = await secretV2BridgeService.updateManySecret({ secretPath, @@ -1739,7 +1753,7 @@ export const secretServiceFactory = ({ actorId, secrets: inputSecrets }); - return secrets; + return { type: SecretProtectionType.Direct as const, secrets }; } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); @@ -1779,7 +1793,7 @@ export const secretServiceFactory = ({ } ); if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequest({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ policy, secretPath, environment, @@ -1792,6 +1806,8 @@ export const secretServiceFactory = ({ [SecretOperations.Update]: sanitizedSecrets } }); + + return { type: SecretProtectionType.Approval as const, approval }; } const secrets = await updateManySecret({ projectId, @@ -1804,9 +1820,12 @@ export const secretServiceFactory = ({ secrets: sanitizedSecrets }); - return secrets.map((secret) => - decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath }, botKey) - ); + return { + type: SecretProtectionType.Direct as const, + secrets: secrets.map((secret) => + decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath }, botKey) + ) + }; }; const deleteManySecretsRaw = async ({ @@ -1837,7 +1856,7 @@ export const secretServiceFactory = ({ : undefined; if (shouldUseSecretV2Bridge) { if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({ policy, actorAuthMethod, actorOrgId, @@ -1850,6 +1869,7 @@ export const secretServiceFactory = ({ [SecretOperations.Delete]: inputSecrets } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secrets = await secretV2BridgeService.deleteManySecret({ secretPath, @@ -1861,13 +1881,13 @@ export const secretServiceFactory = ({ actorId, secrets: inputSecrets }); - return secrets; + return { type: SecretProtectionType.Direct as const, secrets }; } if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" }); if (policy) { - return secretApprovalRequestService.generateSecretApprovalRequest({ + const approval = await secretApprovalRequestService.generateSecretApprovalRequest({ policy, actorAuthMethod, actorOrgId, @@ -1880,6 +1900,7 @@ export const secretServiceFactory = ({ [SecretOperations.Delete]: inputSecrets.map((el) => ({ secretName: el.secretKey })) } }); + return { type: SecretProtectionType.Approval as const, approval }; } const secrets = await deleteManySecret({ projectId, @@ -1892,9 +1913,12 @@ export const secretServiceFactory = ({ secrets: inputSecrets.map(({ secretKey, type = SecretType.Shared }) => ({ secretName: secretKey, type })) }); - return secrets.map((secret) => - decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath }, botKey) - ); + return { + type: SecretProtectionType.Direct as const, + secrets: secrets.map((secret) => + decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath }, botKey) + ) + }; }; const getSecretVersions = async ({ @@ -1906,12 +1930,25 @@ export const secretServiceFactory = ({ offset = 0, secretId }: TGetSecretVersionsDTO) => { + const secretVersionV2 = await secretV2BridgeService.getSecretVersions({ + actorId, + actor, + actorOrgId, + actorAuthMethod, + limit, + offset, + secretId + }); + if (secretVersionV2) return secretVersionV2; + const secret = await secretDAL.findById(secretId); if (!secret) throw new BadRequestError({ message: "Failed to find secret" }); - const folder = await folderDAL.findById(secret.folderId); if (!folder) throw new BadRequestError({ message: "Failed to find secret" }); + const { botKey } = await projectBotService.getBotKey(folder.projectId); + if (!botKey) throw new BadRequestError({ message: "bot not found" }); + const { permission } = await permissionService.getProjectPermission( actor, actorId, @@ -1920,9 +1957,18 @@ export const secretServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback); - const secretVersions = await secretVersionDAL.find({ secretId }, { offset, limit, sort: [["createdAt", "desc"]] }); - return secretVersions; + return secretVersions.map((el) => + decryptSecretRaw( + { + ...el, + workspace: folder.projectId, + environment: folder.environment.envSlug, + secretPath: "/" + }, + botKey + ) + ); }; const attachTags = async ({ diff --git a/backend/src/services/secret/secret-types.ts b/backend/src/services/secret/secret-types.ts index 8628e12f3..e6dcf19e2 100644 --- a/backend/src/services/secret/secret-types.ts +++ b/backend/src/services/secret/secret-types.ts @@ -444,3 +444,8 @@ export type TMoveSecretsDTO = { secretIds: string[]; shouldOverwrite: boolean; } & Omit; + +export enum SecretProtectionType { + Approval = "approval", + Direct = "direct" +} From d4747abba8daa9aa16b640db32e53ffb6dad6c3c Mon Sep 17 00:00:00 2001 From: = Date: Tue, 23 Jul 2024 00:52:36 +0530 Subject: [PATCH 44/77] feat: resolved concurrent bug with kms management --- backend/src/db/schemas/models.ts | 3 +- backend/src/keystore/keystore.ts | 4 +- backend/src/server/routes/index.ts | 2 - backend/src/services/kms/kms-service.ts | 10 ++-- .../src/services/project/project-service.ts | 50 ++----------------- 5 files changed, 14 insertions(+), 55 deletions(-) diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index c4140eeda..37d4fa699 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -165,7 +165,8 @@ export enum SecretType { export enum ProjectVersion { V1 = 1, - V2 = 2 + V2 = 2, + V3 = 3 } export enum ProjectUpgradeStatus { diff --git a/backend/src/keystore/keystore.ts b/backend/src/keystore/keystore.ts index b674554d2..d7bbb0c79 100644 --- a/backend/src/keystore/keystore.ts +++ b/backend/src/keystore/keystore.ts @@ -40,7 +40,7 @@ export const keyStoreFactory = (redisUrl: string) => { exp: number | string, value: string | number | Buffer, prefix?: string - ) => redis.setex(prefix ? `${prefix}:${key}` : key, exp, value); + ) => redis.set(prefix ? `${prefix}:${key}` : key, value, "EX", exp); const deleteItem = async (key: string) => redis.del(key); @@ -65,7 +65,7 @@ export const keyStoreFactory = (redisUrl: string) => { }); attempts += 1; // eslint-disable-next-line - isReady = keyCheckCb(await getItem(key, "wait_till_ready")); + isReady = keyCheckCb(await getItem(key)); } }; diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 0627cc932..d8c3926c1 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -620,10 +620,8 @@ export const registerRoutes = async ( permissionService, projectDAL, projectQueue: projectQueueService, - secretBlindIndexDAL, identityProjectDAL, identityOrgMembershipDAL, - projectBotDAL, projectKeyDAL, userDAL, projectEnvDAL, diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index d988d9aa8..4555bb0e0 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -391,7 +391,7 @@ export const kmsServiceFactory = ({ if (!project.kmsSecretManagerKeyId) { const lock = await keyStore - .acquireLock([KeyStorePrefixes.KmsProjectKeyCreation, projectId], 3000, { retryCount: 3 }) + .acquireLock([KeyStorePrefixes.KmsProjectKeyCreation, projectId], 3000, { retryCount: 0 }) .catch(() => null); try { @@ -399,7 +399,8 @@ export const kmsServiceFactory = ({ await keyStore.waitTillReady({ key: `${KeyStorePrefixes.WaitUntilReadyKmsProjectKeyCreation}${projectId}`, keyCheckCb: (val) => val === "true", - waitingCb: () => logger.info("KMS. Waiting for project key to be created") + waitingCb: () => logger.debug("KMS. Waiting for project key to be created"), + delay: 500 }); project = await projectDAL.findById(projectId); @@ -460,7 +461,7 @@ export const kmsServiceFactory = ({ if (!project.kmsSecretManagerEncryptedDataKey) { const lock = await keyStore - .acquireLock([KeyStorePrefixes.KmsProjectDataKeyCreation, projectId], 3000, { retryCount: 3 }) + .acquireLock([KeyStorePrefixes.KmsProjectDataKeyCreation, projectId], 3000, { retryCount: 0 }) .catch(() => null); try { @@ -468,7 +469,8 @@ export const kmsServiceFactory = ({ await keyStore.waitTillReady({ key: `${KeyStorePrefixes.WaitUntilReadyKmsProjectDataKeyCreation}${projectId}`, keyCheckCb: (val) => val === "true", - waitingCb: () => logger.info("KMS. Waiting for project data key to be created") + waitingCb: () => logger.debug("KMS. Waiting for secret manager data key to be created"), + delay: 500 }); project = await projectDAL.findById(projectId); diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 261d6cc1f..a00c04f25 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -8,8 +8,6 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { TKeyStoreFactory } from "@app/keystore/keystore"; import { isAtLeastAsPrivileged } from "@app/lib/casl"; -import { getConfig } from "@app/lib/config/env"; -import { createSecretBlindIndex } from "@app/lib/crypto"; import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; @@ -24,12 +22,10 @@ import { TIdentityProjectMembershipRoleDALFactory } from "../identity-project/id import { TKmsServiceFactory } from "../kms/kms-service"; import { TOrgDALFactory } from "../org/org-dal"; import { TOrgServiceFactory } from "../org/org-service"; -import { TProjectBotDALFactory } from "../project-bot/project-bot-dal"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TProjectKeyDALFactory } from "../project-key/project-key-dal"; import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal"; import { TProjectUserMembershipRoleDALFactory } from "../project-membership/project-user-membership-role-dal"; -import { TSecretBlindIndexDALFactory } from "../secret-blind-index/secret-blind-index-dal"; import { ROOT_FOLDER_NAME, TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TUserDALFactory } from "../user/user-dal"; import { TProjectDALFactory } from "./project-dal"; @@ -69,10 +65,8 @@ type TProjectServiceFactoryDep = { identityProjectDAL: TIdentityProjectDALFactory; identityProjectMembershipRoleDAL: Pick; projectKeyDAL: Pick; - projectBotDAL: Pick; projectMembershipDAL: Pick; projectUserMembershipRoleDAL: Pick; - secretBlindIndexDAL: Pick; certificateAuthorityDAL: Pick; certificateDAL: Pick; permissionService: TPermissionServiceFactory; @@ -102,9 +96,7 @@ export const projectServiceFactory = ({ folderDAL, orgService, identityProjectDAL, - projectBotDAL, identityOrgMembershipDAL, - secretBlindIndexDAL, projectMembershipDAL, projectEnvDAL, licenseService, @@ -138,9 +130,6 @@ export const projectServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace); - const appCfg = getConfig(); - const blindIndex = createSecretBlindIndex(appCfg.ROOT_ENCRYPTION_KEY, appCfg.ENCRYPTION_KEY); - const plan = await licenseService.getPlan(organization.id); if (plan.workspaceLimit !== null && plan.workspacesUsed >= plan.workspaceLimit) { // case: limit imposed on number of workspaces allowed @@ -168,9 +157,9 @@ export const projectServiceFactory = ({ name: workspaceName, orgId: organization.id, slug: projectSlug || slugify(`${workspaceName}-${alphaNumericNanoId(4)}`), - version: ProjectVersion.V2, - pitVersionLimit: 10, - kmsSecretManagerKeyId: kmsKeyId + kmsSecretManagerKeyId: kmsKeyId, + version: ProjectVersion.V3, + pitVersionLimit: 10 }, tx ); @@ -188,18 +177,6 @@ export const projectServiceFactory = ({ tx ); - // generate the blind index for project - await secretBlindIndexDAL.create( - { - projectId: project.id, - keyEncoding: blindIndex.keyEncoding, - saltIV: blindIndex.iv, - saltTag: blindIndex.tag, - algorithm: blindIndex.algorithm, - encryptedSaltCipherText: blindIndex.ciphertext - }, - tx - ); // set default environments and root folder for provided environments const envs = await projectEnvDAL.insertMany( DEFAULT_PROJECT_ENVS.map((el, i) => ({ ...el, projectId: project.id, position: i + 1 })), @@ -228,26 +205,7 @@ export const projectServiceFactory = ({ tx ); - const { iv, tag, ciphertext, encoding, algorithm } = infisicalSymmetricEncypt(ghostUser.keys.plainPrivateKey); - - // 5. Create & a bot for the project - await projectBotDAL.create( - { - name: "Infisical Bot (Ghost)", - projectId: project.id, - tag, - iv, - encryptedProjectKey, - encryptedProjectKeyNonce: encryptedProjectKeyIv, - encryptedPrivateKey: ciphertext, - isActive: true, - publicKey: ghostUser.keys.publicKey, - senderId: ghostUser.user.id, - algorithm, - keyEncoding: encoding - }, - tx - ); + // const { iv, tag, ciphertext, encoding, algorithm } = infisicalSymmetricEncypt(ghostUser.keys.plainPrivateKey); // Find the ghost users latest key const latestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.user.id, project.id, tx); From b7b0e60b1d6eef6c571e48527d3d47069358cafc Mon Sep 17 00:00:00 2001 From: = Date: Tue, 23 Jul 2024 00:55:18 +0530 Subject: [PATCH 45/77] feat: ui removed all private key except secret rotation to raw endpoints version --- .../api/secretApprovalRequest/queries.tsx | 60 +------------------ .../hooks/api/secretApprovalRequest/types.ts | 22 +++---- .../src/hooks/api/secretSnapshots/queries.tsx | 60 ++++++------------- .../src/hooks/api/secretSnapshots/types.ts | 6 +- frontend/src/hooks/api/secrets/queries.tsx | 39 ++---------- frontend/src/hooks/api/secrets/types.ts | 13 ++-- .../SecretApprovalRequestChangeItem.tsx | 27 +++++---- .../SecretApprovalRequestChanges.tsx | 7 ++- .../views/SecretMainPage/SecretMainPage.tsx | 7 --- .../SecretListView/SecretDetaiSidebar.tsx | 11 ++-- .../SecretListView/SecretListView.tsx | 7 +-- .../components/SnapshotView/SnapshotView.tsx | 7 +-- 12 files changed, 66 insertions(+), 200 deletions(-) diff --git a/frontend/src/hooks/api/secretApprovalRequest/queries.tsx b/frontend/src/hooks/api/secretApprovalRequest/queries.tsx index 68db377cf..d990797b6 100644 --- a/frontend/src/hooks/api/secretApprovalRequest/queries.tsx +++ b/frontend/src/hooks/api/secretApprovalRequest/queries.tsx @@ -13,15 +13,13 @@ import { import { apiRequest } from "@app/config/request"; import { UserWsKeyPair } from "../keys/types"; -import { EncryptedSecret, SecretType,SecretV3RawSanitized } from "../secrets/types"; +import { EncryptedSecret, SecretType, SecretV3RawSanitized } from "../secrets/types"; import { - CommitType, TGetSecretApprovalRequestCount, TGetSecretApprovalRequestDetails, TGetSecretApprovalRequestList, TSecretApprovalRequest, - TSecretApprovalRequestCount, - TSecretApprovalSecChangeData + TSecretApprovalRequestCount } from "./types"; export const secretApprovalRequestKeys = { @@ -117,48 +115,6 @@ export const decryptSecrets = ( return secrets; }; -export const decryptSecretApprovalSecret = ( - encSecret: TSecretApprovalSecChangeData, - decryptFileKey: UserWsKeyPair -) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const key = decryptAssymmetric({ - ciphertext: decryptFileKey.encryptedKey, - nonce: decryptFileKey.nonce, - publicKey: decryptFileKey.sender.publicKey, - privateKey: PRIVATE_KEY - }); - - const secretKey = decryptSymmetric({ - ciphertext: encSecret.secretKeyCiphertext, - iv: encSecret.secretKeyIV, - tag: encSecret.secretKeyTag, - key - }); - - const secretValue = decryptSymmetric({ - ciphertext: encSecret.secretValueCiphertext, - iv: encSecret.secretValueIV, - tag: encSecret.secretValueTag, - key - }); - - const secretComment = decryptSymmetric({ - ciphertext: encSecret.secretCommentCiphertext, - iv: encSecret.secretCommentIV, - tag: encSecret.secretCommentTag, - key - }); - return { - id: encSecret.id, - version: encSecret.version, - secretKey, - secretValue, - secretComment, - tags: encSecret.tags - }; -}; - const fetchSecretApprovalRequestList = async ({ workspaceId, environment, @@ -245,7 +201,7 @@ export const useGetSecretApprovalRequestDetails = ({ UseQueryOptions< TSecretApprovalRequest, unknown, - TSecretApprovalRequest, + TSecretApprovalRequest, ReturnType >, "queryKey" | "queryFn" @@ -254,16 +210,6 @@ export const useGetSecretApprovalRequestDetails = ({ useQuery({ queryKey: secretApprovalRequestKeys.detail({ id }), queryFn: () => fetchSecretApprovalRequestDetails({ id }), - select: (data) => ({ - ...data, - commits: data.commits.map(({ secretVersion, op, secret, ...newVersion }) => ({ - op, - secret, - secretVersion: secretVersion ? decryptSecrets([secretVersion], decryptKey)[0] : undefined, - newVersion: - op !== CommitType.DELETE ? decryptSecretApprovalSecret(newVersion, decryptKey) : undefined - })) - }), enabled: Boolean(id && decryptKey) && (options?.enabled ?? true) }); diff --git a/frontend/src/hooks/api/secretApprovalRequest/types.ts b/frontend/src/hooks/api/secretApprovalRequest/types.ts index ba7cbc38d..9d9e46a7f 100644 --- a/frontend/src/hooks/api/secretApprovalRequest/types.ts +++ b/frontend/src/hooks/api/secretApprovalRequest/types.ts @@ -1,6 +1,6 @@ import { UserWsKeyPair } from "../keys/types"; import { TSecretApprovalPolicy } from "../secretApproval/types"; -import { EncryptedSecret } from "../secrets/types"; +import { SecretV3Raw } from "../secrets/types"; import { WsTag } from "../tags/types"; export enum ApprovalStatus { @@ -17,15 +17,9 @@ export enum CommitType { export type TSecretApprovalSecChangeData = { id: string; - secretKeyCiphertext: string; - secretKeyIV: string; - secretKeyTag: string; - secretValueCiphertext: string; - secretValueIV: string; - secretValueTag: string; - secretCommentIV: string; - secretCommentTag: string; - secretCommentCiphertext: string; + secretKey: string; + secretValue?: string; + secretComment?: string; skipMultilineEncoding?: boolean; algorithm: "aes-256-gcm"; keyEncoding: "utf8" | "base64"; @@ -37,12 +31,12 @@ export type TSecretApprovalSecChange = { id: string; version: number; secretKey: string; - secretValue: string; - secretComment: string; + secretValue?: string; + secretComment?: string; tags?: string[]; }; -export type TSecretApprovalRequest = { +export type TSecretApprovalRequest = { id: string; isReplicated?: boolean; slug: string; @@ -90,7 +84,7 @@ export type TSecretApprovalRequest = { commits: ({ // if there is no secret means it was creation secret?: { version: number }; - secretVersion: J; + secretVersion: SecretV3Raw; // if there is no new version its for Delete op: CommitType; } & TSecretApprovalSecChangeData)[]; diff --git a/frontend/src/hooks/api/secretSnapshots/queries.tsx b/frontend/src/hooks/api/secretSnapshots/queries.tsx index 7709d3785..f45d6db5e 100644 --- a/frontend/src/hooks/api/secretSnapshots/queries.tsx +++ b/frontend/src/hooks/api/secretSnapshots/queries.tsx @@ -1,13 +1,9 @@ /* eslint-disable no-param-reassign */ import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query"; -import { - decryptAssymmetric, - decryptSymmetric -} from "@app/components/utilities/cryptography/crypto"; import { apiRequest } from "@app/config/request"; -import { SecretType,SecretV3RawSanitized } from "../secrets/types"; +import { SecretType, SecretV3RawSanitized } from "../secrets/types"; import { TGetSecretSnapshotsDTO, TSecretRollbackDTO, @@ -65,55 +61,33 @@ const fetchSnapshotEncSecrets = async (snapshotId: string) => { return res.data.secretSnapshot; }; -export const useGetSnapshotSecrets = ({ decryptFileKey, snapshotId }: TSnapshotDataProps) => +export const useGetSnapshotSecrets = ({ snapshotId }: TSnapshotDataProps) => useQuery({ queryKey: secretSnapshotKeys.snapshotData(snapshotId), - enabled: Boolean(snapshotId && decryptFileKey), + enabled: Boolean(snapshotId), queryFn: () => fetchSnapshotEncSecrets(snapshotId), select: (data) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const latestKey = decryptFileKey; - const key = decryptAssymmetric({ - ciphertext: latestKey.encryptedKey, - nonce: latestKey.nonce, - publicKey: latestKey.sender.publicKey, - privateKey: PRIVATE_KEY - }); - const sharedSecrets: SecretV3RawSanitized[] = []; const personalSecrets: Record = {}; - data.secretVersions.forEach((encSecret) => { - const secretKey = decryptSymmetric({ - ciphertext: encSecret.secretKeyCiphertext, - iv: encSecret.secretKeyIV, - tag: encSecret.secretKeyTag, - key - }); - - const secretValue = decryptSymmetric({ - ciphertext: encSecret.secretValueCiphertext, - iv: encSecret.secretValueIV, - tag: encSecret.secretValueTag, - key - }); - - const secretComment = ""; - + data.secretVersions.forEach((secretVersion) => { const decryptedSecret = { - id: encSecret.secretId, + id: secretVersion.secretId, env: data.environment.slug, - key: secretKey, - value: secretValue, - tags: encSecret.tags, - comment: secretComment, - createdAt: encSecret.createdAt, - updatedAt: encSecret.updatedAt, + key: secretVersion.secretKey, + value: secretVersion.secretValue || "", + tags: secretVersion.tags, + comment: secretVersion.secretComment, + createdAt: secretVersion.createdAt, + updatedAt: secretVersion.updatedAt, type: "modified", - version: encSecret.version + version: secretVersion.version }; - if (encSecret.type === SecretType.Personal) { - personalSecrets[decryptedSecret.key] = { id: encSecret.secretId, value: secretValue }; + if (secretVersion.type === SecretType.Personal) { + personalSecrets[decryptedSecret.key] = { + id: secretVersion.secretId, + value: secretVersion.secretValue || "" + }; } else { sharedSecrets.push(decryptedSecret); } diff --git a/frontend/src/hooks/api/secretSnapshots/types.ts b/frontend/src/hooks/api/secretSnapshots/types.ts index 2eb956a8a..54bf152cc 100644 --- a/frontend/src/hooks/api/secretSnapshots/types.ts +++ b/frontend/src/hooks/api/secretSnapshots/types.ts @@ -1,5 +1,4 @@ -import { UserWsKeyPair } from "../keys/types"; -import { EncryptedSecretVersion } from "../secrets/types"; +import { SecretVersions } from "../secrets/types"; import { WorkspaceEnv } from "../types"; export type TSecretSnapshot = { @@ -12,7 +11,7 @@ export type TSecretSnapshot = { export type TSnapshotData = Omit & { id: string; - secretVersions: EncryptedSecretVersion[]; + secretVersions: SecretVersions[]; folderVersion: Array<{ name: string; id: string }>; environment: WorkspaceEnv; }; @@ -20,7 +19,6 @@ export type TSnapshotData = Omit & { export type TSnapshotDataProps = { snapshotId: string; env: string; - decryptFileKey: UserWsKeyPair; }; export type TGetSecretSnapshotsDTO = { diff --git a/frontend/src/hooks/api/secrets/queries.tsx b/frontend/src/hooks/api/secrets/queries.tsx index 5864102d8..1ad710db4 100644 --- a/frontend/src/hooks/api/secrets/queries.tsx +++ b/frontend/src/hooks/api/secrets/queries.tsx @@ -2,19 +2,15 @@ import { useCallback, useMemo } from "react"; import { useQueries, useQuery, UseQueryOptions } from "@tanstack/react-query"; -import { - decryptAssymmetric, - decryptSymmetric -} from "@app/components/utilities/cryptography/crypto"; import { apiRequest } from "@app/config/request"; import { - EncryptedSecretVersion, GetSecretVersionsDTO, SecretType, SecretV3Raw, SecretV3RawResponse, SecretV3RawSanitized, + SecretVersions, TGetProjectSecretsAllEnvDTO, TGetProjectSecretsDTO, TGetProjectSecretsKey @@ -166,7 +162,7 @@ export const useGetProjectSecretsAllEnv = ({ }; const fetchEncryptedSecretVersion = async (secretId: string, offset: number, limit: number) => { - const { data } = await apiRequest.get<{ secretVersions: EncryptedSecretVersion[] }>( + const { data } = await apiRequest.get<{ secretVersions: SecretVersions[] }>( `/api/v1/secret/${secretId}/secret-versions`, { params: { @@ -180,33 +176,10 @@ const fetchEncryptedSecretVersion = async (secretId: string, offset: number, lim export const useGetSecretVersion = (dto: GetSecretVersionsDTO) => useQuery({ - enabled: Boolean(dto.secretId && dto.decryptFileKey), + enabled: Boolean(dto.secretId), queryKey: secretKeys.getSecretVersion(dto.secretId), queryFn: () => fetchEncryptedSecretVersion(dto.secretId, dto.offset, dto.limit), - select: useCallback( - (data: EncryptedSecretVersion[]) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const latestKey = dto.decryptFileKey; - const key = decryptAssymmetric({ - ciphertext: latestKey.encryptedKey, - nonce: latestKey.nonce, - publicKey: latestKey.sender.publicKey, - privateKey: PRIVATE_KEY - }); - - return data - .map((el) => ({ - createdAt: el.createdAt, - id: el.id, - value: decryptSymmetric({ - ciphertext: el.secretValueCiphertext, - iv: el.secretValueIV, - tag: el.secretValueTag, - key - }) - })) - .sort((a, b) => b.createdAt.localeCompare(a.createdAt)); - }, - [dto.decryptFileKey] - ) + select: useCallback((data: SecretVersions[]) => { + return data.sort((a, b) => b.createdAt.localeCompare(a.createdAt)); + }, []) }); diff --git a/frontend/src/hooks/api/secrets/types.ts b/frontend/src/hooks/api/secrets/types.ts index d82e2203b..fbc67b92e 100644 --- a/frontend/src/hooks/api/secrets/types.ts +++ b/frontend/src/hooks/api/secrets/types.ts @@ -1,4 +1,3 @@ -import type { UserWsKeyPair } from "../keys/types"; import type { WsTag } from "../tags/types"; export enum SecretType { @@ -79,7 +78,7 @@ export type SecretV3RawResponse = { }[]; }; -export type EncryptedSecretVersion = { +export type SecretVersions = { id: string; secretId: string; version: number; @@ -87,12 +86,9 @@ export type EncryptedSecretVersion = { type: SecretType; isDeleted: boolean; envId: string; - secretKeyCiphertext: string; - secretKeyIV: string; - secretKeyTag: string; - secretValueCiphertext: string; - secretValueIV: string; - secretValueTag: string; + secretKey: string; + secretValue?: string; + secretComment?: string; tags: WsTag[]; __v: number; skipMultilineEncoding?: boolean; @@ -123,7 +119,6 @@ export type GetSecretVersionsDTO = { secretId: string; limit: number; offset: number; - decryptFileKey: UserWsKeyPair; }; export type TCreateSecretsV3DTO = { diff --git a/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx b/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx index 0b6e9ac10..3fbe4357b 100644 --- a/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx +++ b/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx @@ -13,16 +13,11 @@ import { Tooltip, Tr } from "@app/components/v2"; -import { - CommitType, - SecretV3RawSanitized, - TSecretApprovalSecChange, - WsTag -} from "@app/hooks/api/types"; +import { CommitType, SecretV3Raw, TSecretApprovalSecChange, WsTag } from "@app/hooks/api/types"; export type Props = { op: CommitType; - secretVersion?: SecretV3RawSanitized; + secretVersion?: SecretV3Raw; newVersion?: Omit & { tags?: WsTag[] }; presentSecretVersionNumber: number; hasMerged?: Boolean; @@ -96,11 +91,11 @@ export const SecretApprovalRequestChangeItem = ({

*b2mnAg^ zrlb3x?-lFSAzA;I%Buf{`(GPz2)>h2cbVyO-ZxR>Dggur>()N&UQ6)hpL{ z0^G)N4+?nXUWoLPPwx+>%L>I1eybSG)Nuvvk4r0vs$}7fYUhLSSOc%PilYE>-WAoP z5UZF=4&4)8%^#$Ll?bQ3(OU(V2AkFj&E`ojTW-} z-;~@f9dWa9PDeSU4c`JUpMUMSGu0ixEu__*=r`#Jo7(W*P&+!sYD+hpkzX(WO*2RO zB)DPqZFTqo9+29yVdsL0+WvP z5XSvpcwW5u$A`XjgnMdoi z{IGTr=L#b*qLz-BS2dnXuq%zLz%5&u_oPZ49(KePb;MaD&lyHAiw-_azT1nc-D-n( zyyJN6Y^v{PJ6gU~`?%%;fMd%<*DJ;u)73|xM8`La|6)OpIGDyn^chBwk0RxK$t9{B%f^j{1E<7tZwHk?VPo z3(oPW6637;JHBv0B_ZQ^vuC&X+QtT zs#;d+!Ps>MrY=VN&SwHd2NUz}9xD&Lz7U&!tH^wEnhdip13AJkNZ8oK=(}n288@Do z$;|^iSX?)3=U9>HlG^F>h+SfwT^TZ*Toh5%RXP8B1t}o&{M6|kZ;y-9>^q&+bnPv#;#o(dm2?OmcyK7->JE5tVxuKJT0%?<+HcSQWd)JHj;nuE( zuqRDY8tvT<3}bRFYgF6M|yR5fiLrXQCrMjO`jOd-m;Q3hGX!g0+(xN zxmzVeUW8!OH6=ktLt8Qor)IA-Orcm-sx*eNV4Ha{b97EHppjX6h9!R43V= zoTNu$Na@A%6>3lW(2F3WzuuLX_2nylgs`=W-$4%6&BQ)6V3}Dg5{SPVVpUnQMv5t+!e}b-J^lzoeRMXo|6FK3 z!qOhc_KGnf*r8^w|KeSb{1NN+h&VZj_jvX9hLa)L$nxn>^CpHD*sewU20}JSZ;jon za2UDs%B~u>qCXbw%Zxq}oM^mz(1GeSi4e2SlpoP?(D!los}B_F?914QXKAMr9J52! zl(ff-ZdA6XjBRn-Y6wKEiMBnRdRT(VCAKge_w& zr*>uhaI$mK2CD0-fqu8fFSe2G>69oSF&R+Xn{8D!OSM(0TL5ZEe8tSp*blC~>dR64 zYT41@&V9CCZ9WSe)lM`OW^ADO#c)xA0NR|-XU`Ebd)wQb{GwxO%)sg}q9wj{S<)|K zO;Tb2_VNnHrUGY)>r=E=aQ`^J;Y^d=CW919Oxonv&LCB%f(5xxYsDj07AFUrWTf4& zlc5ozpC@k>R`>2JvUv9^d_|HQ!Y+v>QekR5T~;Rugs|wT#I^qmqx@t0QFjag7}&8( zxMSSHx{_0m77cj(qbG}AcJWakVW=?L@MjOrJF;9-ktY@rsUs90_-Mn&yONW2kvdZW zhx;Yc<~p0(qc#Y$OMZ9?=Wq8IFWrI-8edQKyPs&zkDy>AG0kg zSsV9@Ou=RF_zfgF;>$XlnH)@y{H5l2=w4qE8+_sCxNa*U=!-jrUWOy%pHYi{&Mj8U zcvYo~A6-Ev@O9s9$1hJB-t)lL?X;IWi6)qYCqKFW`rHQ=2mJ}5NtdXDlf==~Wa{?N zyb)9o@|nXRHr}y?<46?~xk< z7FU$>D4w=><=nFqPDI}0L!qh96Q|A;Qt_V{-qg%7U?OjD)!;I?mz!MKwj2C~Tl&|6vm7Lyqz$~LJ?D)8 zSJb@2@^LOn4K#Bkoq1+^xC9ozTr|CO`vVoG|6^SC<6Qq*ul?{bhwbT2Mnj+8T72_12F`MT&X zOYrW_=d0njUR-?Y=;PIhTKbq0@7yic9T5TpOsq%}5GRJUtj)z5T8r=WM&J$rvJ)+` z>=iw9b@9z0If$N0F&4*spvLa=)Zhz8EK+>e$S+Nn*7BatW$b~I9B7o1)Oa7qJEzm+Av35cfzve7WS)Q=j`%%_21+*(&c*W1+Dr5#Fx4rG)JRciJTUB68*9CEoAsg zgA12DHN&iDs2pVOD)*A$~D2TfR!^1j8p&W+lB@iWl zR_1HDP;#%>FPQT~@eko%_n>H*|!gNrlu&-hFKHNA+U|NiXBj0yQP+{yXYHSji}CA*ievY z4~Xc@ow2EE+p1i0%?tzAXS@3I`Y`Gdy!5tcz|p7;a;<55o#Ys&&+4E_M?uR)lR-m2 z-x=|*w|tvlw^c452UjSNp?71gCM`mI@b33Il9K!%CnuPh_|)3&ZZV=Xd&H6)yY`G% z8tFFSnkbBZtuSUV|u#Bsu;3&a^v{ym~BSFF|RtpgeFa??tVXpdRlOBE5HQ3 zTGXvQWtPf?xjXzpo*c(zM~=&Wd^OQJ1X|i(N(tQ{cYlhqZe*{uD@2}9An;BuX+C(% z$Xg1x=(z(yHZ4|AVVNU`GS8EU)2?S~cYg70+L^%}{!#zr>dp329j1kh&2SxtMV+!&2=o7(Q#wUTVD1|@9;XpHKsMW0R&7|Q>mN&(DEMT& zv;d=Id-ME$!-RY6ia0V49UZyjyG@Lf7jr|V%Q_FzaiX9qclSYYZ+1&X4Y=QRzoDPG z-SjF}mR84m&9$RL7q%>8;N0oLXSKyfqZKsruU!Bo`=6elE+NJl;=Bzc{k}CZNFgA% z&A)tBov&QUy)|JlC46wodEc&Vh{8VB(8v?LvJabE828?64~2{g>0A`No=;P3-3O2l%bQ4R0Hk9F?!6KBE?hxV!bz@1{Li(YZD4C2!_-52;wkF?EnJ>RB3UQYm;3x~8ghb02wmAjUo9-Ek4~y26I6h`!0^2X~88xVy z<5lHw2syjrY=-qwPvy@yq|9Bl8xg3atX)^BPs9ht%!@Pp##r|Cb60eg?(_w~M)~<% z+jecF`^MnJxFJKoPpie~a@h}<@d^f~9iEMf7J#WjO7vem7wIvy5bZHMw<39j?S@!W z9nA~*(8TI(0XayL`!t#7)TWd4jvU1I%d7E;ujNk4l7>sohieWHhxLkGO}FCOL-K_# zr~XbE>VvL}utu64jp9QUpXr(TMCYy@XXU$_tZ201a5#3`s3U$uyWbXDaI>>H!PZpp zLP_L^@hj@M4>B)su4UTaj+XNHs&y@p9^kAjjfZsvmnD%EVXFh0M?HFOBXgr&Dt5(_ zuDeIG2HqN?m>0{`3>TIp{i5l5#w;YMi>Fu?NRlp!*G*>SzxEb6s}u!PR2h9yVAyt^ zAgKT|({?a3#e{mFm!D!yH7PyEOzI(q)N;W&vYE1DkR=U7oMuDA6wtfOw?g?f5BWT#F*%p z43Vg(SoE_e!wlF=xDMT(I@~GikdxS=DOxRTw=VCRbQ`lPeOB9^p{A9;p#MRP3GyV3 zYRg_`H@Au#Cp4Caew?Y}e-lt6bBb?ggHjjvi%4OXoH2Isc-20FX4pDq*85)M4% zE~ydraCX(StyfwIyAE~%Cx**#N4xxcIXUT%c_fGS<)mGJ_%qmrFbOnoQrUeLzLjH8 zy`|d}dSZt#Nb)DU$-H=y*u*P^pp{U8Kw4#f&piL;(*SY8#4zQ~wYRo3L{kB^_X^Y+ zoFHS9NRLX=(~7m(+TfJ+ z%5)2T0yon^M1ILOv&JSEGh@xX7$LTP2c0l=_pACm16v-odUjbJQ#CD8hdosS#hFU& zo_Z9qdnm!z>1IrQav_#m-+Iyqt;Az`v|@NM|blF`)yuf?R0X zD4$VwUbf1_4vB|*jNCFQD<#G~pgXAHLW0?F=IFMR2S?(Hoq*0-{hO3eoYf!OcpOU9 ztlGM*nm)0sd%~<;o01d8XE>Et=E~~LH93sD>g1#k`QdRi0bY=~s9?Q7Sm#MRr8f3~ z+ulooB}pE~VVDXy6_kWA<$sbOmBDwA5F!efHY*i$&=wn2JcK&tS~a9BdBn_>IwW-uR6;1z z&;ctK5&n;RuQ~+BY-6?jrURfSL4n%C4M24}$L+fxK}hc`rAKv6xF2=Q)7Lc5uS!A| z7;!FjyGpTsmz>^~j#EFL^;>26 zY$1!d*bY7^VgK2g%>}mk{s4o_Am$T*Nu~~Z{PF&Oz&=+I7;A1nw~ZTMBpb_pyR%d% zFP-z;hC=`CE{dm z9FZmBy=@Y8dq#I9)$lShwQ8t}n#JSrI>8`2nbKMlKsS@>WshVeHWSAF0U+G0) z807k3NAn2@R{ePxlZ8a@WbBfPL-=?sA25o{1br*1UV}T$0PZqmFf7|O6}gssYEpo@ zD`{q7+;xb+n5vW@)5v260}dy>{jBuJ56DiQeb4NUmo<$WGp|}J6JRuO42W0*=VRpT zG&Ty)Tk$o!!%}rQSER?A2wyt(qUd!l{CUnqEX2_8JkoL4=*3zG*+R<33j#ABUNUt! zKXn8f#6|CSc@fo!^o(`wKOW~xCD%zH?SIxNb4TV|;Jyyrb4ziUcg$uiH2RkQ5*ZC! z-C&YlY5Sfji$+Pj=Ee|VN+Z~ShyWui7hRQy+j(I8=wds*RaY}E{|CqAN*ESQ zM80{%MDfKvb(gr~4Ji~By3M>`7x-3qz92`g>NEA&6=L@x&qEz>GX=%~1@hIO1YzU; zXtFJTSx&UaAyLOa#s2DCHe6M#O-ZnZNp=+i;wD)DD|0e6Gv% z==lVPcsTO#1NIxW-|Sz7i-1ohEXZ-zPX%U3F@$2Z`-yqcZxdbB$qCP$4xabkC~|Ox zNy2a#n~skO!>F@QkYn~$oo=b_73%AmZmB~=IE?{f_{Bbv&n=$VjCDoVBz)y|rD_SG z83mnOO^uM>p-)lEr4)X}7;Z%Hh=>KbS8$k}Av4t;DTTE;)tJA^&EDKwVRT<6)Sv@a z1z?^=yj>R>MY{ZJa5~P9GGm^%lk9$6U95TuZi-24?ap^e?LOAH2D?W{Zz9T}0snKF zTmJ$0j^?G44@yELWhD(Cp|p5^hSyrxZKgFzhkN}4W>$cKP4UT%QK=^JUAw<{k0tD6HgU8_pM4vBN-+Swz(w7vI5eBJ+iHR4vg4ohuSv&#D? z=H1CQhBY>#JrV8ek`5=cR*oad;nw{kJz$G&h4~9+x9|Ihpsg2@sF=Ti{yYUKNE&T< z|B3qO<48JZvO66x-Su~$nX44zQ*K4Ra(|;4FCOrPC)D<#%YmC)@DD|4cny94&QR- zb`T(-yy%aAqC5x%wm;Y0i|dl_yB|0&r^Axf3ZHQ9~4 z$TUvoa8dn(VfmU3wL_9x3c(0ajMdXQf^Hf~lHu zD_~yicF~^-6CMO{6X>|)`D`MLqOyL>Y}g zXUC3aJb@edFov$juZ42a)xJL2eMC$J9<~B|nPK`T$3WGgo>`_TxG&KCthuu$R3g)tw85{EuIse0e zGH9;muQE{&fAi>0N;2rgG%_A-_1l%E>N^~x7zbVVF9Dg`58`yvH#&vQ^tXAb=RNRQJW1GOje;yNe$!#i!S zC6?t;O<7@r2ugRm;|6t1Wz7%INldG||$cfnC9*uGZGW-f_g z!SqVM+qlyUW}EFwDwnFY+80jSvY-K-BgO2TKXYOPN;wz}bb@$#X&8*_TZzZKVKxKJ zPbn4xS(_XYv~LBy>ta}2hL}w&bDEqUvcMK=IKsMg z#EU6qUk0^b<2fIfDHBx0dt##dE8T;;#W#2jQZFYZ{}A=X^hFsKbjp^}0Eb?@cWLG_ z|6}m1rM#YOD=X0_%2CzsV_zy7aM{O0T;5afy;S6eFR-7uUX4WzUL$xAES4kRJkeij&d+=lBF!|_j{+moUEcMKjMx~%KDYBgG?b%; z2HM;Ppv{fBrOzjzQv1_@q8pjh@g~)9!{uKcP6}0wDD&m7jpz++XC-v=3X))ff|H0A zlKsjy{*s35UturwtmdNE47t39s_**M9vr*oSCWNH;lTc5gNvgBRpnrbKb!3pKnf{$ zg*hExyQltHRoqRYsYH;jp6?jTTi`F}3>onE0sk6Mn`9vxsA2oY?+dm4zW#K7$qn-Z zz5RRJz@MX`qC93?Z^xQ=^RmU+(+eRo!s1HiXE?4e1aPX3T%&xnL&<_V57&yu#D~yN ze|z>Ef5j+`qSYou;{s(2Fbhs9d`-50=AK7&*Hm{CAJl*q3JqN%PGHrG&6kKJ*jMI; zAhI$Ykq(zNxB>AQNN##8^A^ErZn5Ut8A#@EIT=#dO_cHL7YFc?R=zq-=Wn7j6c>2GX&B!>p?ZUqR|sVkk%1ki{wQ zatD|h_|B7#Aq<$;<-!YzaWVQi>`gdQy9OGjS)_<5dN8Umfx5r2&*$=5de)Y+4#RBh zt7ooHxm6M~)oE?{jJCBnY=M^fi?v)BXn{pLrTqu*Oc!BUp=+0+xoPvmtpECH^ z;+EoPl6oc8{$J?h^09zxCvwaC6wE8;G;blR`KNAZ7p8~E-}t?~`Y&BHf}jg`y+N?g z7K(xv=3`LKc4@A^KCiq*RNifq`w2D{dNU46f3|1oR>I8kGNV?m?naOuw~Wg~$YTeb?f6_|J%Kk~Fl$E!e(xw28N zKBGx0+>DCEIXf+fXa1*A0YD>>nxAy-mdE!eMLQxk3E*9?y|A-gVzYXGpOIa^pW5OU z=m?>N*?c2D`tWe-+#gye%zs^{-)HcE7&?$)o~Dzo8WV>wFN($^!Mkvtx0mg-vP0k* zPwR-Fv)l(cK^0qTx%Wks$a;C%6E%0SBhK>|Ai7bMWA{Z{=w9z{hwN{yyl@`SytCa% zmLn$w>>Os4eNwHQ(WJV(@DnP*VGfMDTuHA~n`^H_x$5N<(K;E~*sXqqM}}_XDUlBN8Jj+jVO&R=(^C!VI9M!dwwae1WXcebS8o>~Vn#kni+N`drB~(bY-L6p-$@yZ)!QjW z-ApsI%R3(Vm>!rOXm{FAUV3@UYNhAt>A4Q+Jz9iuQ(3=<$(ZSJ#MiV&GbZ+n74TJo z>x68=F!nHgFW?2e$>wm#)!QTK4{-?9d7O+if^_S@(uTrXzIcQyebWi`J*Z%8 zM_s!;;L%}zLRO=;!Svx!@k^x##k2WaLr)3bkMHfS$%CyGcb$^eD1v(*@fq2yE9_l?)iXH*J{LsnW zz3b>7o`EpZeXs*0^K;S;t(L>Vb|;*tQ%EtE+iv5&?B6s#i$ehXTrh<)i8oa5;n5`` zG`&NQz7zj5dNm;U$rw|M%#bwKCj-P)H*bQ|*8p9`t1ouCd8Th4K>1fO@pYbnVY^^I z+7-uFc0pS-D0lhQ@av_YhFX7C;}7^5(bC8Hc4ZoSf!g;9>8UkXes2un{Amms^AsNy zMrvpPdHsa>$x$}FSYWGtQlk4Z;(4DCRg5MT=l2rm%$9fkabmX&cA$x-i;Egl{vDY7 zTU(CdAc(cUI7Qk-_gD+|iwxs!6DXwMd7O}g!2$jK z%RT1c&m24T{`;>x|Ku1=)``WG5{4>27KGl*#e2jj|2f<<35srhr=1lg;t}S>nq&Qk z5YN+yoAoOfxR{@3$haP58eTdu_a>5ej5DTNQ4^CIQTw=%oeA|5c<8*HF^dSAhEm{^ zoG(f0G_b`AomePhpa$0H?z6MKRN@MHrBc&v(4X##Cc*O+4BZjspFxDTJ$9wM0$h2L zz?GNCPTBL9D^IEg>mLDF$`1=I-LZrf0&I*$U|>L0zjh9UC9_QD{a-&db&8O*HzM8> z|LvUr9hm!u5@c+ydaPrt0gY6c(2?T@aOoGezZB@)NN%pQ?o)P?fw2Yn==Zk9%uKnlSP;?wv<`82vldmy|EZj+1eU{xIg<$Y7Be5iE+D_|WO|)>#>% zArQ}ks=kTh?USmB3n~_z3b1xlv~}Aak>2JH@RLo=vn>)*FR!z<HY>Ymy?dPDUxw^4pB zSTX3Pz@sO-5Em`&ylWDdm7GW+x17zRsd@#9ExnJt&@NFJ<@R#y(eX&)RgZc{oxGQ1 zvF!GlT5URD6U3>Xn;-;97_>|)Xk#_XFG9yGbAEWa`czqeE`vb(6gwNha|m|V=u~~& zQ*6Khv#V)rilrzXpVj52O)(78m(>_4M5JehK0k@=d)|oSr^xxHg_M=m($&A&VS0Ed zNQu2PllRNq_DhWMHnsnlp#cU`CbU`)Mpp;M2;r$2R2uU15swG7FPh$}03_{7prKJUy75{g1E?BcK&dUu(y+kvi~FNe7oemKvQ@pYlka$-{K1&V5A zeD|jebJFPC!1xfPBD&O(tM>tccj^T9-yl96I4B{ah>TxX_%{R5 zh)rKcC5FvGMjn8aOgm`ad85n-xCY+K$0*#>2Bv|MBJ*}0tDjzbIjJ@^#aST}26$o3 z6)SbvgE1rVHjzJ*u!3dYhA6?6SMk#>Ah>uDxlF>noS$M=!pl9p+iiiXx74oD*gC(# zBhqt{zO;yN4P%6=ej)ULLxSq`NZc^z*}o;&za20}fRJlPLn0mc2#3k_0#S)(sScmhS* z@(pT;0c>EvQ5){4lQM5}*E)ftV}00MyjO2U%nT{IrE8J!`b+x{FIUOWVl$X=EB1~4 z&*p8mgmzEU@7QpeU!Bd5=~N0MEBarXasFa`PI(YNAoe290B_)+t6!R+OabCrW&U1}hjEnrh zocB?LXNCS$8aC2#?$hYd{|H+wrl_iChPEXs*)Cu-s>;gMaY&BZFW}cjQ=kJ-8QVRsBItWsbgo>(1 zPXEd{7zbiiq8j+XLF}3TVQkWX*yQM2?LSR8&Z?u7yvXo^v=HwAv+Gx}G)%0yMhssM zzLq|}3VLrwETSMxev}!_n$;Mpvg?{d75o4#V9;Uyg^>kuN*cPoucWJ&8kW7P9)*YM zG%1%Vt$#5WZxzmr$hpu7NZ;dJY;`gGqOrgR4c2eucy$7iGzAW=>-6fxmxJR7KR=F* z$$WT()-#}sC4$v$g!seiB#4jw)fU|(*mi<%QT)a4{(A*E<1g7yh}^I@$9!LcBlO~V z6m~M1t?^+|jHCt;r?1WB6VcUt`O_Ktvp+4C5anA2FOpUqZ1i9cHw^rA&E#_3xGkcQ zP+-?VU-YkI*Sg75;T`m>feQ*cM-zCZfFkSxoLG^2my9#|uRQBPfJU*!%=2lv=+SA7 z2QTwBBz^=W>4AP1`>V7)D}#RK`86i#@hikIJN0JHieaHsAQVsiuY}@L*Hj1dXR9S@ z>QDe8iRIJc1)nhKxZw?^(?0V6@NNLjEZ9 z@elj6b|u07j1h;JffH5uaiU(^gFBb* zlbwjgyF45fi#;98wOLrTw-?WPE%?yQgH3i&-z;f#H zJc)JGFa2<(ru|RejYrDcifMW#!jNee43vgAo`}lTiMQk_NcQcCJz7dH0|!E0Nt$Q z!9`E7vW4%_+MkPC^shU0TAOE{ zp@wkJGE%_R-_i|E=t0M<3khR0*VdkA(G{f2o8)Of;9yQUm6iq)K}?VdfH^e+QyPJ$ zVYJYM6dVUDDQb+#kTTYz=he+O``uO@^<@MidOsWcjIAjkGVbztr zTt!j?meM@1M&RicUtnMA4YYeFh{C-d*d0)9qI<(ZlI40R#Z_ZhZ+5!uq?u-51TP`U z60G|P3sD;Wg`9DAGT|bwO?kuD+*fa!eKTVJOF@D`&S22J{hA<=$wx;|?>IOqWsE&=dBTZkO zPzQ75Ct)sOH%GbH9@<*)l)vNGA|5C|P0O9ut$tU!k1k93m$-CuH?%YN4^5h$tTBL-!WYh?&ITK~dOa^a{I^lNS_~8qC zs%4j!P4I^p9^`~28>D7K{UMJQ#c)XpzOR(xhZvU- zZoUiPA_-5flK!gjI0+C)2S=~7&;0tGzmE3TKf2r#OHgVnX5P!|q$OyDIQhK2UIW!2 z@#9uGk}+G_u%Q;-%|OKj2N|2I(Ael+3&F0;#R;uLg@;gAS^Qol8x6vq_n!^`11xVc1y-cK%KRHPjHKYYs8uy@YRjhh>3y@5`?Uo%(rQR zjs2!taA}0jy`EjVAMiD+tZnfAS;%R!Z_Baw=qT205MVU*Ov8)vrbPa9DrR<}EOhNE z=C-)h`Zf~unji>Q3U2j5iPw`tKzs7?@9hbpB_mm_<6!*9M=(dgg;=6U14Rn@4M`p{ zcjd9ymr-K40m=9aClmlw4{_C=FEHE6kW;E)?q#=$ombB9B`o2IP8GB>ulRl)DsuK) zEBG}E)i<;r-A%iO<@c^rGEXtt|7lsL4$A4ji^ba2oY7a?mS&!BXHShD75wh~ExO!l zr7vl2EouoHoD4bAf51dvpm2X`Fh`tuk?i=GF!6f*z5k6V)9 z^i>0=P{0$huUA?8;s+l7*!$AzaIftg*pHFf+ySL=?1m8IpuMXf?*Qcyujp!i&4_t| zT}K-i()N<)EDbshaxi>Dr#LI2ZxyFU(BH=sq?+b6+k*lGC(C@i&Bp}bh!|WrnA|;l zfo+jEv^sl3tH*^I@p{08m-J5{#ZM3`L><%qt9AWVm;RQOB^3$OB8PIIt8l&O(`U%G|XHcK4=8>ig1T2>xk(8Aa3JUqzM0s6_al;aX6`dZt27!1Tyt zo-9csAJ@5s`+I}2Q(5S)ebt(IEq;z?AlMnjSi3U{pO3RRw7cZB$l|<$C>!XsnyUk2 zH}kw2w@Pj2PJydN5{H{f9bCw2+Vd+xMN1zO;x}NsH&6qu>?yXFV0#-k$95X&B7}5p zH;vHa&fW1>!|&vnIZcqC;jS=!JL0v1xO%%=ctOt@=rI#G9_QTxyL>Z_l8*XQ4qtmt zhp=Bkhu%TF)-avg8!ueo2l|=4`2FmB5S{Y({`qdd-ivO-LUgg^yA1*4m!70V zQ^!SKm5ZB;VKSCDv6+YkqC;z70j5gvo|ZoTgL+9N@Dv&O1^>KrCP0wT7+lK_T2mkv zOS^BUrg2Nh=)J}bg`V}I(^v}Jy`_s|dhgu^1-IaXC)JaP`*DI(pUsS1I)(znjM_!yi+;%cc7nsR`I>z74Je!+$~?6fO%2pq^>Tm zOLXHs!Tz*bAm?UZa_^>30T8gfckU7%lS{ny&C+?w7nOGpBK$Oc#I8)g^DUcV2Q|#G zM7!F6K-F=N8vvI_ zVq*$#40%YyKHs^@J91@-K82}WcKbRBmd3_Co4en!k=owoj&Zb!4cT&m$Q4m*_9T`2 zfghGOZ`DpdBHD6ZzeK%o@TeRt`86($dlozC zU;UqTRC}WPKDwD!N8Z{`eMZIK!t9>g{V4>QbfW6>05{QrlF-Bx!BNYrDQ(|gK#WA+ zb%&?Beo>XXz)tBm7p>U|jKL{Nt~(B9x$LEe2}r(Jp^|C_duOjJdgeftlI#eYM9K-^^bJw8A~w`><9~m#&x!@ zWEd79>cP~V1;OdR7cI|Kt*u!e`HW+O;oe0CwXM5YsXj;no8aAna8T?b;P4g zFh1P}UBCL(B>Bn1?Me!I%oRPI(C~J(e)_a zMe;En9PVQZ5rQ{JC&2=OPSoMHi>bs=0iMecTX-ZVjU(8>fH>x%sR3VCzR{M{|xk?IQ+MO7M-8|Oq~cxo_jN31fP%oH~suUtraoF;vNVzF%0TG6?QA$CZ1{l|(5 zu$~Dq`7<;HM@PF<|KJY(MBwC+Ba91uGqoY#v z(v~Le%fCGbWfo@KU3n!PB4n?5G<4xgl;e*AntBU7>)^?z&%P=Q-n^oM%L!JjPstGT~~#@mB_ zl;dg>7ufNEXAZ}61A$;klZeo41+JSD z`BFThKF7()YxeXArc2*gw_Ob~02$GKJn7`#zZc)EqdhE>1Y_()&uf6 zx#w4`{$yh90FZErixa5+#vy+X!v4E4lb;}TV^U8=S2+Ka$S5#TDaOGL1%`n+=&53OlJRON^>v209Zu;3#O0RfD;1`c=bXB zP}6|6Oz|`zQgRTi&4m#dybT!aTZG3?q*4L!2K5Nwwj}{LpZ3Qlnv)1wV@}LBsx{EWQ1M{?z^B-HBe;-Qgl2AP@51LmCV_q1uK?v36L-E{#9lwFTZa`z;?Z zq&W7&j&@GnR10X=r|!a+{xReJPR&x7`gy4gtu#LsYyT`mr>Entv$EDNTN!lGwRv?S znx9}lEzQM1X)4BF3%EKg0y|Y(dQHuLkKo4gwq8Rrrz7Z+QhzI5|mD;QxPVsuWv&-y1Bc8Si7na7YSS<;sQ`UC3S4}_9Np(2Cd}vwto_fXer=_p( ztGQPHzDR$pmFspZ{k-K1Af(6G!~w^VT^N2peuUOwv$79kL6{SSVS{%6KblHfm2 zZds-Wr@slD_8<4X*n||{=CExjq!3x3L<_B&FmOjY3S=9eegBtz<}{q=k7dwnw$FV$ z4QzaBWqdTtRfC7)>zs{kS51&`BY*=S{K`ggJ+j*gm-3s-7^H$YKg2i3l>lpJ8q<9G z!l6M8f(KR*fX_SfLxl70zWtjLCQx;p zdk(hgk5>p7qEGgy;AhzP^VBOm>X)5m@rU={BvZmu-ksLX$Vj;;&F$P1bh|@_mBL8( ziD!C_#@@(~!ymi$g6494tPwk;X4@-*Qa`sSInC}ht5D&aS0Z}B=OW|49e-1KOl^_5 zYp>Re=Iw!<@otRYvYTr+pRm2ZF|Qa$zw65x=zbz4eZ;p`SAinLsqs-$s0NpnW&0v@ zy`(+S7jvTLSgl9wgKEY9o^Tccz@;=&1}J}y0;5~(kA9f1K<8b24t|C70tmU36Lz)A z{zcU>$bo&Z;va>7aDmjiGuT0zhDQA|K;*fVc=ivm`K~9{*~6rj{QkWAHwjZQK}gTr zf8fIZ|EC!ZfHSCy7Z|Jy4PY8j%Sl94R*~MionPnGG~fqvv@x>7Sv?C~!6eBX=-+U;iaE zbR+EK-Qfby{ylP5Hw%pnXpdm~=z{^xyV4Fn?+QRXs8f}F=YFWjwlxP+H+UViuunIe zx+7y7yQ}EgrHJ-G@v#N|8n0YeGD8x;K5aV&!x+vcBg!crS6$Bl-Zu_tcC5Zo`q88v zG{>!K#xevtOr1NmCOx%0RnJS*kUU>RSljdn#y1`U5c$jq^MY)79@_rOv)_Hmll|_? z`1$378Fv(GqwCSImYkzE`y8gGXs>9ku5Rc72KeXPn{Y;?rq2g$4CnOU1u%oX7if$}=y}VI@pxZ*=k6^#yG{+;tl3*^-SsXfM@r@%HE%N6BeE1BlS{lmOv zqsEx+S7u84_i3IVTb^%lp4|2NaZxEzO`y{gz`dCVP4(uZ4t zL|jY?%nZaC`I(ugO47mXgLCp4;!1&s zLHBQSP{|weQtk+*AzG<0G?)8_853zsBVM=~#G4GH>3!ckspoDY$DDTp&uP>}*MYeKroq_Ek58F_48(^zv%IB*yjok6enz;{wrR{9K9jTr)@jPi>LwkN5 zQBA53W{_cf8xvX(??t^e?~lYjq)79#m&Lb)=6|n`nM`{xvr1Fhv{0Q3Zx2ieSIuEWL>w?FaY8*!X;b%U`D7*mTErg1z*Wb3BgY<#B^q7*Q)@<>@+4 z)!ZT&CAdlk`HavWtlKwIeTkT?(4?O9oNzSQ!}mGFy`ho(;lpSS3^#B)3g`28PtZv7 zy!|8VPHz47<+F$N$2+FO4Uka$Uc7jH{H|*jLi{B_erLhfMJg`zwuy5?1%oZPIa}(o zs3ZjTnV7|#{4C;q?TMTTF&99(b3>j8I^9wI=P!SK>3{w+BY+T|*G%8?OAs@}#`bEO~w>5P)1YHF!>C75S6_S!%|BX zAL;2YzJqE~bkkJ}pW@bW&Rt7#pMV@bHlmZxJFG+}b5#+gsJi?+W|8b5c>mcU_ zSEK{HHVeN#IkYdUEH7u-EI#IoY0$9St8|RKFjX_{oBFDa{fkP>jYk)NN!)eRe1BGD`jd@udMJ(srBc^2Go7gNy@&kwUT1v-flz2$F`2>o2mcaj)4eIKGRO zA%#|;jzrIj`OEJ5sINOPWH=Sm(_xK8$hxH~5B9DF1{^oM=Ts18btgm3n>qP8EE+~| zSkt$2>fgI+XXmUyBbQ#RY|7`k-R#Af+%HOjsi25_b#UvdYe>*cy5C{7eJ56%HSIgC zvvBb8!Tz;R7IKub;^Kyv%E)-DE!R3y7my0RWH^5Is}D<77k&n^Oye~O{{HiQYXY$Bo=>)!RrX3liK^GcMC55 zwsNYWTA3(+erF8@S7MHX{t7lKZK07$pjjYLZz4s`pQ%>Zy%#K7x8&*7U<#IlpIh@t zaMy=7CNb31K2M_p*f32XLU^X?a;E9&#rx%Ylf~izK2}Z=b$roRW7B=2mvfMG0`VKF0==Y1DNKETD)#Abb#H@=~@PAYR;Vp#^-^@4r^t*E{_OsuI%AZ z7qRf`D{Ik8YpXTi)>XxYbv}jPmG}zMhSMO!NNY=jT9>xf4BMIuB%(YQ}YYNYfw-V+QYn`7*{$x zA6g&ZyEm9xoJxF9d?;1tCWQhPl$!6$ock%tKn3bT8kjqh9#p(Qc6mhv=3UDOxp`GY zVxuQf*czZb)hF^ZxjI~l(%v6O@(ucHVh^*=@ZDe+UV63X_hBtDJ-~m$u`1R8;yu=r zEV{u=*uFBecaaET_pipTp_IzK8aerF_f5c&R)}Y(+qc*bt{J4Yff}bFQ68#c#>%0h_cxVxwAH&QA z7hB_DZ=KeArOMK8*)5`9CpnEaX|*Y4Fk9%PcYmcsFKYR@?8L5rr|?(Wfk@jKv-yK3~WohlYOmZ_V#+^wPf0HCFdF zIw&SNVHDqbfynmfP*anK?{?mZ>i?|{pZdrY^j$LKE-?-me5jt_CK6#hG!hGU2S3kl zRLwvjKC2J&&+$?9xtqBoXRJ3Ty={&8!7Q8c=;pkYfu<&m51v(>}aDZ8?-Vv z7|E~`34N!vEr|Uc`Ub0rO*j8eZYH(%2-a-N7JPHD4Ir|_VqYFb#$lN972cdht1l-= z98#^+d17t=>MEPTeCCq&Xr`w!2vHe5VlO00uBf^V@kPd>=7E;2_t5v8|9h+FH2My7TejZaV(y zW){WDu*p?d(Dsh)|yQOrrsWZH=iqwZr7YQk9);Iqgrz7m_>qVrYYo6c{JBSQ<-gdP0C1$WE8wGkszl zy^#;GPijoM_G!j_bhko?$UtQ8-t0=`V&EWqb_1XDHPX?<1-bzY0`I?bFmI(kR4eQq z&!1yV#tW&}E~l8dQ(k$)x~7vm1FX{>EzZ876}>nO+Qdn>VU3-oWPCX%x^J>Oj!(ot zDgZ*AS#fRL_dK(ZVXeo;i?0+mp*__4TU+4ZpE1Y$Xr(4V)i3cJu@v<9eW zHSc{4K^I^4_o5E0b=($+hM$2_Bjj?+v>7Ka%xsD~?-Ippk8YnP9B!59u*I>iyt-Z9 z%9UY0Fm!2Pt-hYqN9Jw*$d6q~0gAvqs3_41Xz6e3ewB7~UuF}0`bGM;p{hD~&FnOi z?nPq|<~gJ-N^6;6YN2l`?i%9zy%*^Q5ID3SchU4C_Y}O*c!gAR&B&zG!+r?S$w%%` z^*&5vohfCrFxeFF@hJdiI{Y^@F9GKgh~4|mfb@R755%~Q$_dTULX&u%x4PA*!2awT z{~okAgXRwr`;wX=G(5%=q?9Y^{ycmK<#o2-~x^AdP>q zTrjFB{XtfEOj7#L_dRaZav3AVN=bZw%dKouaB9&?I;~eHz3L1+l0=aX;DW+_>h~`} z5JWuWP2bq+u$*6C5Vv>`Mn_}c!W}l&$T%_2al9gmQ#Byp6Q{IvB=);-yP($$>Xhjd z^?in0TZ~d-I%o1KSAkg<Az{MZPK}3*iFYkI6@yB%fo0U(JCB`x1b)g5hBALQU>^1o zg6k&3sh!37{0bg(0W(AZT8SEVWnNNk_Hypof%)SnqcYoE_NlxJC-%fsweFs&ctA?? zyg6$Yy4oiCY(V~AnWQ`VGGc((r=b%B2Up!jW&RkrU*WBKDIM2JB%EpIUcV6RZe zSUKO#IgUaB&~1R2-U_Ng!CsSM`^?3>=EGqf?0B!hiZ<{01!>!!c_F_8ie;*|>$8B~c6}ecqD9QE%zjtZOcAo`F?_l*Pwil{bjJTk zt<2V!xv7i|4_skmR}R$=0gX{^Z&v%}FpRmMnWK^|ManZxJ?WkbIMwGMISgFBD~3vK z)P(Wi#TR=D|tt zjC!Gyr@a&C78Y`|B0gr`hgSt{5!#Yg_1zKEJvcouV|;^VI{&o`^fb?Ek+dvci40og zd~X9F%R;V8=hm2*-kz`1N%Qw9{icF%T5dBz_%HbZuRp*ms^sfCnwqV@0Y=gGsJLKi zbK%s*J>#hwf9#5{HGwTMoTv=R7f4TeE_txFjFUWE=-WA5PS0UE{fk6dJJ8A1yl#8M;M++S=_sk zT%8u<`T9X(o2hLRa|ltxrYU~Xb(qf*;hNe=5FkACv_u&g5;dgdw<5u;DWMkF8E(A?U|JfN0{ty93hGruT831WR-(|DB)xs~Jh(X- z-FZGt)ESnI<%spWzyCS5mV5z`?nLwD?2>OF_IPqy%X5ZQ~+k))p7wr4&Xj`SP0m4w@JhU61QXW-7hty5hvyUs8he zG~2n;ORs5;YIya1$c~my&dFZp?Ji$k7z>nLzvTjPA;nUguo2@HUhtbDS*NsrsLz1ooa8*tDTjc{-UCF zl=cc$WVVoGU(|PD8nHJDQ#UwPcvB=OVfwNuxYS`x$TfW}#Z*Nq1t@2x>Zu8BId*+) zV*3Zwcgp=fAWiygx00P3bwoVx?%#iFdPmY+4utbv$MH+~YW2GfLZQfX-%Vz|KMdM^ z&zyY-7?x&D`eL39KK1jHAa%tG-16IQWpY`~CgD?%OB?+7SJmSIRnN`CROR2QUKAmG zW9+)#WvhLsSjpTi)J|P#p_tU6`O_oa>?$SEjA5KaG+z+F-Sn@(tRL=B}opbG51L(94Mg=1U2YQYdxWv3bhl z1&1DGlLXr8po(0^-CyJrlds)x_HbB-I6EY66UE;JX{SYdF2$O1Me8;IenJ|u##xWT zt%0w3ECDI&7Z`FlBTgbNnzT=;v=6h^+K=Sk0^7&2{c>8A(=9)ctUa{i8QGl=spDg+ z%c~E+lhA%5Wc7vwqg}v$E-k4M)#l?tIaxfyAR>dG1KK1mj&I+<{7EifD3bssG7|v^ zQ5O(w9kuRj)_@@^aeb#JPsvM|LVt0bXwkR<>@AIF1>`@;=cxx0GJaPQ=rnDhe(Gue zlK=Bqz)PJ!8C{yeOF9QOJ1A&wJ;McFe0h8IRe;EA=*<{G4Zeq;?uv2+KOmQ8&Y-bQ zxSxUcVJVgULd(0AWu$f5A=SZYS!UD`6rCIC9;_?4+tcPLD{dim@QYXIyTbuTVSdJe zpL(D&chJMQ1S-&^7JPbmJ*=7bdDUHZYu3@X1zp>0pxsEUWoZE%gF)jWeu>#g4d2}Bp;5*G>A z_wu!8Q|P;^C^)>rBh$F<0i0EKDBI3`MTk3>EzEZ}blGl#**%xlMZLv!MeDw%Sa%en zN){gJeK_VP)D%Gj>fzTHEdH{V(RZ7h4Hzx&k`jR1spyjCtmSK-{&u!>Q#hVhLh;e9Skk{oE1og=eYY+;sQ<=bmY@{ zbsus4_b(ra)&TV%4LvRRw*XKL2a%HP!P%1&MF;>fV!fL&9N&9v^i-ac-NY7FUc0o@ z_i1AWkxuu0f7|A+%YvDZUl3h0xhY9$0a6jiCgbxh_9wH#tQ0+V^o`Bs5X_*boouCt z>*nj!ETad_FF>g;BI&qzwwr4+EjFatE{)4WJTyq~s{eyfVlMvvsxuBT+P{l7bfxL1 zGdujga~C|U_{A5ra^OkP=(v6TQwD<25l}cKFx9ox`*1b&a?iFu@&=*M{%wFUGQeNq zR)zqZ^X7xUQ;J?X_=WWFVMZMPg2q14gV66@El;pFC1#kW!DbJ8gqMfNS9rpI$ zri;&jgw8U3D|uq)QuP$N*u^kv?3RW~U4OM&;lrZnXehmpyWHQec=3bY7D<8H%e5jN zuEEL3@PI4s-#O_)t9;Ch{(k#_gAXmz&BX|2JJBDwSl&j(f@Sh_B6etlrFO+g-JaWlj7%rCxw{QmOl07tZwb}arY zyZN3DkYG9~=k(|P1p#DPw+a%hR&Xus5`HVSg3SImP>Eze-~OYAYnV=r|#mN z^pced%xHO}^0Q>}QqTjWc(dhATaTixcZuoYi9}Q%=+9EVxq5s-w6Ah{&DuDLI zdjM%0D4$BdeJDvmBv&8&UFPRFUMTZS2;VE&S-R2JSC=MO*WMh;uVCz1{mzLvWbjH2 zyb*HTrdVN$BF4>aFKPb$+iUMpYRjAN^(Qd=Rh#~wz+GN~z~H24hSs!kYyaAi$80V@ zGEKSt3bcnFa#^b%y)X!g7^Ewbvd%18)`?l4LBP2);11)H3};hUl_F}@00CuV_o=VU zeXYfM^5>_HMy3Ag(r3Rov#m6cnXUWA7VzMG;{f(go&(}^O|GDs(r^KSr`QQ_FCfSp zi2Q6;ij#Ra8DCMTZrEgEYdCW1`uN6h@;sV1ZgY(Q(0AkBFR#BR2d<@yaY^vr6TZyW1*;Y*4HvL0xZy z9(gY0e@uFP(_V*+t(n%DqrT1F2_7_iMN4t)`oXM)rH<)E-n@4GN_ke~8w0P<*tWQf z?BGE(ktd9m=#`0}+g`3be|Ma@IDjnRIJ+JymH&W0z_&6|0D)qznbT@IPxpr;t zwET>2xcJV#Y6o;pTP@|iWSm`oyI^mH>GBu&8vH6J!QZk5l@cNG+v{*OCq0b)nEbuP z+2b>zq`g=c@(Z7etyq2$d$=N34ddKdVl8BkUos|Ii27B@08{;iA|0-5%~Z*R1WPf8 zpVvI6_7Fn;uj$^`#V;@0J*XtVz{s`r#-UZ;q%)oWAWLPrX0^X_+1xLBV?$*3f|Sig z=B%yz#_qE~BKdqN~*4Ez`P{=iXVKZ6bwg zJ_{Y0O3g>b=^t#p+Gbm5u;L5^fk8S2)kp#t5)UXS=WjH-H6J~}eT1)H??)MP=#%53^GHsVk$|Zb+&2B5HDBUSt?uCNG4gL#*N{iFJo30xBR3Ecew6c&F z%c=Grmf!pyRMp>aVyDmk?U3a%zx!0V5<8$!v$G&IF2N$Qrr}3sE05FB z_h!12=742rqzS#Ln8c^AjeFnDtlD_3?`*VRj%)ceiwBWsDg`^)Lk*P--zq9OPGvbX zVJ7Vfy;a@nvcOubR>WH>tF(T%5&#G5rLg5M02JEdJ}|I%JY+KG1vpX9Up2w3?l)$k zRE@j?w2Uv7Ry=o(FSh@iLat$ zec!}yl4fl=9^oDi^3NT8MHK7fftNJTCc=#@<<#&kpgRiu(DKzhBCT!8q)7%?L& zx?U)#ScFhL{*dC zzI`Y8)?&_M$d$~eUo|Mlhr858Xo>eN0&gv3RffkbRF`NeuZPw$_w=ZuZ~P*s~s-ZZ&%$^jjp%D;=8~KkaaV^$?vx;elO9dVZycD zJn8;D^@Jh2OK z1z1;*OXh*!Nn<+MoBO^sfrJYn4A%GH67@jAU#c(ofZ^SFlR6K+K~87`2DgXE{Y5pr zeL8TTHk#p%en*msdA^|aQ!sih12;q(3~B|5}?ABuA` zm9qhEvmsUQ963J`s!Eksgl8*fhMYH`KSM?LIsQ8^0@3n>&h}+jLG<6T^fwatN2Tc^ zu!Fy`SaEH52@7ApWT7DJ8g zfW=t(EBa40aY*6~6Q@((wpu_^b=~7eH|~v2SP$Q*&@`JibFP1tzykJRRA*DsXPlRA zDyzlu#uAb6$C}6HPAW_kAZ~RhoxTXyJ>x9ueo`WwYg88ZtH2&fysi7m>$DED-nXkC z7;$c?UfiT|q9|=;oW^;A|4sXLJF5VolH|eZnw9ar31?In1-DbWgwH2!sF?f~aW zFT1_gK-vWwq{8Xjt3_gK6$cP=$*RtnoQ|zuT)h6cFdog3e#q5$ukFz zSWN5fUJiAfoVIBKW9+L3l!jm4Xm7PlsB=hCb>_GDVM&YWCdN-0t4YKhSZm7a!KSF( zG08XLr1|!<9H7ISzw|6rNgj~^0wq$+^Y26*m`6y-d9b#Ef8#*A-V*}F&A3N|Kak3q z+=uHKN^!beTRQ%`3^$Kjw$7Q8d_8mgDYO@w-$GN?hSi`&DnL93oTpU7b9N!+UhiWO zMOpX&|3{rus=cq!LQ3H*+|+tZJ`1eYW>?!hQkcJZNY94}ThH3WCv{{g&2UAAdz(U1 zPU?XoLJM4IWqJ<73MQ&z-4bwnS3AnT#qb4|oBJ4_gN=Q^Qy?j*}XI3 z;cM_s=aW0$dgE%?mgf#BX>@I_n(@EGDwXP0?PqL5ALJz&JV`~-F47rXo& z82sOQj*Ka+%;V6#A?NsGw&*>L-Kk&2l1s%6di&cEY+B|y>HbNkAS&B@w_7DtmHjnF zZE$W8(r9G~Q)rVsb#Taxgz2es3!JgNWujak;eXe(!Ncb(-n})}pmVZjmxWgBj?Rhe z5DuapA%rnyD3r=T^ zL{Pl>+BnUrZ{iy`!>Pg)HKfc|!`pWJ5?9-(mGjB6oRE9h z6CA7}eoeHSHkTwB~NyA+x#))|`%PB({TShAQlt#z2MH<4Tl0 zk*Kj;(RPKCRfByU&*w9Z4ci0>{UB@Ka$ho!65Few6nA~+JMqkUyEu20dE~~zf@bQ% zxIKBYJ3H*SM0%$qYiBNnDO)8*b-33bz!Q=FqI$Hm(0+E!S=22ayQ0LCxzM5V(#KBv ztXrw}kjM60X$kVOu(vb~5Txg8Zx?XetZO)iC;y0L*NOlsit0y6vI*`(!YFKsxQo%PLH|sk|M`WShUaqt$6(-}rI2 zPsZT=Xx&_N`3qzldI{dTg;Qhbmlj4!!@w4@%|dRS`Vb6Y z?fV!hhf|itKaDNWGk-ZC0eKaSn+vRUYd>NFckE))d{lpr?yw7m`)E5;rMs2N^;xJ9ekc3XDISLdxW8qYR6`G?DXN#L>(q?ZPG+GC>s zS;%f?EKB{PbN?UP`Rm%Mgz-)Gumykc4Q)%$3f8T10*3*zHt(pT_P*s=)iq8Zw975PVGSK&Iiwxm&bg6qJLUN{ zB<{XVa*a-!S2l&!Sd4UBTsoXk{SHl|b6IOAFP}6A^g5AnQQarcb+1x%K_gM^lW#de z<7H1Yfq0B=D!6_MNY`tQFjeW&Ai*u24)@FIa;|U2Rh!TPCV%wN0Nj2ERnqQWT#J%> ziHEv?8k=w!QYF(|;#7wI4pI9mC#5l3c%;Cl?cJLuqf|J}OE{2cr6E=E$S(bMv2E{_ z7rny2lb9gov_E|1pX0%XPV^fZ9D8b#+hf)plwZRQhQ6=^yvoK~GsmM5U7Q-NZ_>k- zkjSW#`8JbdtcTf1{Dq<#ob%FQo?iYJ*LdB+Wnnw@s>Ww`J=VpUWfdE;Mk|con)()| z6f{a_z(WOAxj?zr^Zce>Irg=vC;8~3wK^$c8!#w`x=j0N;W&zSw8HRqLOF zslyJ;!63VTo#T$2=_-}5X{#e)$YY1YuDYD;9nb~8D`#__tZM6!zSqCya`9RGhO0eP7uZd8l54xy zO;cTtNEvIWQ+d8JV7XI(K8RQY__>2dYW><(JpKX64>%u|NdHzMQGVTatoBr4ymfJ{i&dMm@ervu!_|vDRWP5(W6*TXiXx~)7`jh zJN6m{5i!4OSTaYlI#_1c<|>0PX=jTDlPR$ZbNdQ&pQ~Ww8gmL%U9PG5)3)(#;f4IW zTGHEJyx}F#DaXp__~kKT+ythY-jXkr23vb{Vwv|whX2VosROMP@#%AG2V5gyXdH0* zx_L5wNjX*0{Q>^z_f^<{`H1qvm+l$tUnB>(UOrjVxZqFBIQe-(nrwNRiF@{BTeBPe zhUB1G;5C_;L+q;EPT&Q(PvK2KI`)?oNRH@#sh0vKLv(MASQm#?HM;k^?5F%EucxfJ zi+NA!O?yj7^$9>qA3O?Eru09uCxXs=3VFf56(KNUWZw)d}Q;R^#?oZaki(dx6?<0eI7$V z!UtLHF!WVhn78Ta{$?E#8cesoFWP)E!W+%N?spB8?dxUcDSTipBj$=`dtios__JsP z6Az+h*ymZm02Ib}(NNxy3HoNu@>u91u@D;Y`^`f@cVoQLS|}rI=lx znhSEKNOTQb?}*N$!O{?&u&T;q%xD5n37F2DNjr62<`>XNNbiN7{U$8AQ9ir~XhC6L zZ@lzD#wl3j+hu@oQwp{U=FX5y1W^(vnDv*U<&S87k1$->lXTWs z`xh1}TN5;1kL5U);;$2+nVq$rnt~%y&f~9FIPAV6=e+qoqrhEG&rSd~NXTmDW3NH_ zk;J}ypF*bfB3JEjL-U$Mjm+x!!Cjn$Ch6z?ZdeIp0>VEnBg^o{&&ohrl5+o(H@H;YT(MPc#}PXvG!_G%JR(PNPL; zcZBWwKI)+B#qx?)`*_)O?fo&pZlJ<8&Nyr4;?#39bHk8oh;REwRcEx)*Pz)Ga?{)J zhDv!2qV%mwlPV{d!|&bd2cZI+pl0x^IA;r;5nyn_#~pQo-5Q59FwTDFjV)>K@wiaE zCM*Ng9;+2y;#7v8NwExQYTifkFyu^u#6&I)R+9)?3C{fb^DwYmT4I<_5QMqm6{p(! zGHsS6V+`@MpPZ)Lmc66twa_=sVJG3W6TC$<*f)S(4WoGXh1YB4nh)FYR&}o`uUNZH zm`qvc7goB+fHyPsBDPL)DF2-1hEJaHFxOF%1MBK=@ZJVW$!8yJ^E*X+`&P|K zgw$j5^{(cPC%G*4$bxUBKY0;frAGJl57z`BD{IZvcut^I`1)&M5%n~^VR5@%*F35k zb4tFDNzN{`YulH=AAUuIjw?ehJJc7QVZp$$?|4h&>>sfmefJ>SaE#HryxHdA?_V8YLZ5+yjytt~(TWMPq20hL~) zSf23zooPz|4K~WYqjC?VJ~XnjQJHdvDKtsRe#1+pO>lrU=<^pfX(SFTBsR)*7Za=^;;x9iNZ_Vs;(u&6I8)K!opHKykCw)8*r0G5 zq5Y0PZ7(K1*X=3Sl0AH&iN7!A9=Uw#G5M1x+o-Ie2bdi>2(0OC)NNMgtEUQ$g-!Wl zpgU2ULYT7p9J&+QmGrKBPfVH3p>KC@{kg!p_Y0@=BY}-YXnFjOw23@BINWW1>X!-R z9qhet0U5w+4y|Y_sWIz-?oa1?v0n#Lh2(N4*XpD!t?zIWnK(NbY^eL7ldmEk-FDssm&UZwgo?TKL1c zME&pd2_H;ZSIk(KkxoX~usB)K7mrtNraLy2P1HNL`*3SJPPKtcKPBZ(*|igqzCtF? zcGuOpf0!4L9`;F=bleGP^}6Is&;o0S(Fgxd(#0V@2mP)!IRY{& z9-fq!A4MFSe{2s~_siIv;PzawgY8{kdy|E(yr`0^ZCEck+AP&Cg#J#n(=dyttyk{@ zic?z*sGj#_Pu9!A=#0ysaey;kxy-24KEeoy1X=5}>aN7@ngXV8TFh(MtDg~yL{*A@?~6 z{xG4(1ocf+A!G#a)1#THC{V?O#}Wk2NPlTOGh2f_`aPs3&?Tx`Oz5t^2}q_m^}h7@ z(@U;xRj=#zDt9N_21F7V-On12iz7IxpXqQ{27n!-VMkeS_k^nHS+^h84`*fW?~ql3 zk+jA4bC~<`FsGXt`$R1q|DgH<-x0Q`C?dN5iFyCWqaxA5A+W`K@c8{`Cu+aj+u zZt}$j!wbs5FydzIME#~DJS$A^^MPog37ID9wHIHlr$-`fN&%aN{}zi$7ZqiGwsVn#AFP z=8``+xBg)!dx;I^@zat#@pSzjm%90O6FDF?o%fWXO&RX?%pxv9iIqSJw(90$hqO61 zSe#()@wbc{ft#EApX?b7rlQ0g$5)K^2bI|G=*!p)w}toFpqWTdZ z8@NCW5cu3I!42=2@=;^o$~eCwIbWjsI?-4=3{0w#3qV=g^WjzsF4u zkm=_}CvG=JE4QdET%TkO_3%9-XQ!C@b!6;!O`Y%Jp;u(q8Pn#sr0hK*>|>G#_Z-T> z)$#3i3Jo>lhu1Rj55dTuBBO@v@8;vlRWL*{NY1j&{Fm-Sn~^}MgjzlQNO>_g*I`^b zo8rDamo{OTr%`&pVe=*&AHQ}*@aZR!hy55-mDa2zU!{4uA*H{bS*>ux<^yL+=LSXH zMOt>*A^)%)q|;bXxxNsGb2$ZW(OZC-XcxS}L#(J0ao3#rNGS-=|2C;7$iW&-{af|W z{$*&I#zOUE$%km<#Hh4M^|NR?s8&=q9Ko+tE~WVP95b&wdPK0ls1bK1ad${9&i^ow zd^4Ve=GpT!=vT>sNbh4xBs28w6VWL(rzgG}MYW@A_I)Yw3(hYJ8}Ai`uvZ4-0a%Wf z7F~KJoZ~cA>oRDL=gdj@9JG!OB_Y%ZH|?n%*zvYf8RKiejh++#91$vZ4*d`TpUs(oswI>Lo*foGAX_#5P3W=D9|0@cK z+-Hx+c(W-&uTrjs&puWw9A-K`Lrv6}$ojarC~Java75NvdFGM3z9+<3yQr>z*^@&^ zze&r4fQ|a^9oW_`Z+kDNal!PSx%;|!Q17kE!!ok~6J5%%pE$269qC-R=& zN&H+37jv5YDK)hS4%R+yi(s`wy3eWbbe%_;FDK2rmq*o^?6d8Jqapu?wYQF|GV9w% zrKFUUlGv1jG^jM27C}-(S{hWkyHip^0Z9=7rMtT&rMtUR8qT_PW}NqTp6ASa&YA!4 zX7n?A-)nvIid;*(XT~`_`GyH<{hHa|$+s_9ue?ck51hdC8vi_+`;o2xy4hsU16|w3 z9?N99_z_{ho8)UT366XwBOx57WB0$HzB(r%U%4M`V3TbBoZV#Qrq$e=tqF;ciYFAx zT3)^Tpmo5dNXNdqE)ne*%#(eI=X3cE;ldbc2s7F4kMYQQ-O^JoEO_W}SNX)r?X(v1 z4jBYc56$@f+(6CpV4&R@LB);~5`%xpy{`i?tNZGP!ui@Wy{Zshqr*Z9M*R5lkOaCt zOH=?LS<W+g2P~?ci#RdIE)Jfhk+Y4OV8tHWDFoW4YKp! zap@|;DKq-cZn&a9pZ<;+kwdbF9dWR;YVt6neAPhVAZxUs{c6-OmRrXQ&>kraS3!&0 zrmU5nk1v*zx9TGiN~~i$x;^dg!K6{vw&HL&fAxH_*MG{Q+M#(z%|y`gn?8x#GMbq6 z==H<(%+NFYZ(wz>&Y%aX);&O=S7%X3=(oMGUEIYv-qwcO_!-cyvspG{_5u9$8<6&4 zHox3YTBV8~HsrZHo;LuCu5W-=5w_a0c5!*q<1RVvcA?*RW%_tEvMUmU=dw)CV5Y9a zYxqEk=WEV(PD24&Xm|*gJCObRvb96hLE)U*-Cz=Xxu0;_SJxJ9-+r*1*x^u{Fe}Hm z`CxVY2(KS^s{Arq%Psu-SH5$H!=P(h9a}h8zH4ODpVz;v<=@w35Vc88dI&%^H9vSC z(j_>ax)O6Ns2!qsM@pl*kh{+|_y%gZ-@l3IieDQPm_#y#!R63PxjOLW6W{}g`se37 zG#(1L9Q5LvZsJi3LndFb9ll&QCw|>9fA9EFsmhz8*=4=(5C$^XvCDgBM=Ah|>T7xq zAv9~dP(>~&gJMg>5BBE0JBtl~_w&suB7cud+NVNVWJ43azlW?}Q6c<8D^H=+?=$ir z)lcY&ApApzBzq4n8tt?vT>1H<-ZlA*2JAc*1b4M<0E&s*9?#9i-CFD3AIDfqkUeqIjI#=8!^S>)&KV9`AC)P$GtEIu zw@+$*0p(eb_YJ#JB@I5G=Kyp{_0e?X(fe8=w{k9iycTX3*xA|i)r&XNr4jbink*H1 zE`%GNg9Bex6@MsgcTIK0wI5CAMgk4cCp9X?3<5CRe1L^x8v5#`u^oB4hb}nUf4G&C zovBY4?YN$^G?|hM6EE<;{z>LQ$khd5DlX`E}A9CJ1A$hb{I^P1s%Ks*_vj+$^a6+#>4+94iyc?=v_C&Y*EdgN|ulWzcF#j;-n>=)b z^|9_GqXxda?X7}3$>;|2%BZu&%xx{2wCcJpBEmM(h;rkGd!818ZC<2_f2;(m=f!7C z!_ijcZlfHCdv%%qF1?f0a6tW}Ms`2wpU~6=kod(Y83DeGhtMnpu}FJ5xP>2k*IS2(s)e%jR;UTbfJW++2HK)^m5&@srN{5%6=UKrj|IL_}_#$kC&pVRW# zvcXW2Sce_OErKv#k<)O2b_z!JAd9bFh2pCy&hacW@>)rAEoKek0rUA~a<_=8g($$3 zF9S^ZEIN#o$E1-Qee zx0YMw6jR-=YWi}`rTEQx+rx<8VXcpTM`M|^Ei&s@vsrf1cqbF5`o`$H5n&OHge}@!u`8X$;rA3Ox#WUdl94W#nk$8a8{uUsSo&xPWwGz?&2;S&D`*go(ptYr zJlEvY@n;%R^7zKoW1$lIVNZkNHD42!Q8%!Gz|HtHUSQ`2}y;zX}jppo^hHcKJ}p@jQaRK_qvr`hTMAEy9UnSDg2LA9ezn& zIp;gB`woD%k;2#OUn}2hI9Okki#xkcEZ}rtHSjql_Ejv3&lgnNI=>#~PHDcY3B>Wv z^J)xhh*RerU3oCkJ`i+Thxq@7P*OD;y%X7(Do$k20p9nq_LaXYHSAmI0_{c}>^gf+1Nq=vhNaN>cy%sgz;yYa^Pr zEcyPTynaFk(e!ew#lWUMbuK2KH41Bi=ld{+_+-8GtLhiaSLjj!$<~b_vc0Q5e?W`DER{`D7m)vEV-mWv|MRz=s#0>wXgG;YM{YSuXJI{NI7#0rEmU zrT^u`|33Z6QP5|XO0U~6!r2zCm*9CJsLSo+c@tyXHPq2eeavN|+|a3wLT-l6NbeED&Y5>bWI+bu?$3dq zZM0BzTN3Ml0$K;wfp7A+m{GuCqDDCwCE30A`_#V`f=+XfKjHE}fZ?y9--3umzIQv1 zKZ}9)43D4TGCO_il{SBj(WG=Y$MT^vv+-n_(rfO;Q@gJcHtC0kRba^^w`H}p&_*gU zNQU@gSdXbk0cIt)RKyv{%mhbdA% zMb`9?D%(!4O-}kB%Xyi=JO5lfq?)p zx0{htXF@y;N&8nX`FmXY*R#2|*#Zr0@k>Oj)pVH~tzemcf%YFM^si4FDDkc~vHyhb z+Ns_`^5i<#H^EA|J4=R6&F-3Y%H1f(Wt)PPg$V@ak^qT6=mCd?3P@v0^E>v!`(JxW-foy!4Tt;???~vm3OWLPV{Tx%r z;XNCOx%0V(EEU*TT?+k!woe|=xm963h*u4r9c$JfUYB`6M}1OZcItqnv$lAr|K zn>F`^%>`cPI0joDQ@GkM=|yc8jPQIAuTi-vn0nLt+O=)HeEzvD7A&+dl@~z2f_bfl z=})l}zzS6{@&5Aj67P!rEr_2eqfqf)UU-5Cj(%r_)e>IL?FCzE-eSvze-i7~4YkOUs4uoy`y$kM(%h zYYLwZ9nsxxjx}5eTri6zEJe#cO zHa>(J@BrS=Nkf?7epZh<7Y1A0a?Wt&#IOWas0DFgtm)8Zp8xpWd>U$A43QD~A>8g; z$bw!W1p-r*QR2vLeNboNu(~U3C`_m{2PpU=7H0dF=)HpoPOhCz+`4g=!^<)P`CJVJ z6NCtsZ+Gy)h&72#-VYP7ekkdau@M3le+MQHWD$tWLrX9Fn;7;N`0aoGK#u{Mksz;(uhcMVlbC_pF+-i>ti$yof{opCCboBKR35FGm1TAFSIvB%^BfbY@I;Z#`byy zDwio_c8W%7avu-alp)3lm4<)U*T>*J|Hb36wnk(f@e2Xf8QIV3tp4As&eFOR1M`wq z9@Tw``hviD=VfV9C2vJ$434y6p|CpL{jE_FTgv;#EXH(Zex^j31!@Zk!HL6>pb}jO z+2zOYw&u07R2?AgN`Ytj!M>+Z;$v-pw%SAYf98UPqr-**@tfh}Jb0~H+ zw7N%t660SWx1}MuPEe{2lh)sfO8o}f#tpXZh|JrQ_Rnj0U?RLhZ+4JO8W2@|Fh`hK zHTkBfpUpvS8#R8X7pyOZvXE@M&`N~mC;@yzAWWq2Hf)z3RN92NK$|L+nFFRzGL(V= zrm#~Y4xv3?syV8(VU6?5ekWWZTSykemfK+HA6YD-U?Z@{!)SOrNl4tl;QnVc-?#Vs3mW--l1otR#4~pg z?P(~RWx10MT87H&dx}&K(&qx!`fM}l(O+OS8_$Fa$8xVdB!S3NDYs3Kv{ZfSaUjJd zmy$*r|B%8+Z~r$dP((Iq_@$sS2NYC>UZ5kCTu6#Fs4~H?-TfHgQZ)+*QCXU<@`E@B z0Jy&JM=j0TfZ4{(|Ff2M!oF4UJ0=MsvV))mL!yZOhnRE?ofg7JG=+0$qvNxYuaqXk z9~enEfo&Mg3Tp3LClzVd;4Ugl-)mC_N_STci0w{(=-n_X-d+0^?mm&$8(*U~M2jeNvag;Nt}| z0jy_fa)^34K!hk24^g65ETMw;%KbWx?QVlq${Ns*0ba z@87TY=O3f6L7?ea&Wd^E0^}xS;?i&F2x;x*OJ*=P29C5iM@mzVc21meK$e)R?FG zXHGSJldt94`rO~2Lvb07tAG`8y4d@LO-rI z4ubEwGvXg41@z1SK)i*hmq8Hq5-a1jn?umZT@mzMAf$Pw@1P9I3TT@9FAVs=>z(&+ zr$M|mL1juN4EHH<)F;yY$}Cfi@_7UuQ6pDL=T9oa=jj#}s)$aGJL8bnLO3OLiz*gV zz-N=hS(jzL2Jy0xSYc_nB{sL=52})|@|WeCz>ju zPFbP-s|LNsPASJ2rI?Cxp$Q7u9N)t8*4Zsmdk{{XnPpMtcOvsMu)ojv7tyydVXNX` zpcgzASJn5Vf+R(BoR2RF`DX8(zb&bAd8?#C%3&Pjymb!VK9X|tYb}}^Xk^JOQ<4{$O|NHPhbA=kgi~EMYf4{*0;b(bSs1Z!> z*Uhm+kHI>?`Eh-;EKXkwd)3J4J+8%9X`u25LBso>p1O;n>lH3XZYypC*zWWb+6qyd zxbV4aA=J)OYV_xK>gC^mUk~*@P*sfFWysC7xIohK5cY-+)@|aw1A3o&K&LnLJXv5s zQ+?DqWy>^m#0V0q4ki%v%HzCxO{Mbd<{~%P9itExIb%Oy@y>|GIKL&O5@O)%mg}l(fl#sGP0; zJTiFZ=_EIAue0wKPEp+3*AyHE|ib43ue5QcS0t;!0rXUre1IR9W*_+P!7JI zSl;>lhTnQbgP8S#`rsd0TMy(CT5$YJX_&c0wb5e$4WdpnCdyeD z5H8TuJ>U!iIe)Ly+aO%_UHs7hBZ2v}@Mdm**yZX45BarRJX^{WIheqME%YN(67UpzU_g ztOVGOxEp~m{fBVH8%VfcSy{uLNKn!ZtGNw(zzU7 z(rAtVD3&Lx8r=H&UW!lt$zt@jiQM&?Lu9%e0$=H*hECs7<$(c{^+qtV%uWERhZuPW zK86wZM>7*7pjLDN)QVDNV&rO2s5$~h&uWZ7jTGC26&f((o2QUP6CXs>q6gS%I6rk* zd68G@2`hQvl=Y<7{de82Rl!T{r4;jZ(wKreK0HUct_SOYQWRSJdP_o!U*&{^9~0Jc z<(nnygGUb-^>=3K_qHlKGG#5ZeE!@DQ4)ekqc=OR`?uiyKO40_(ypfukS~B5KgL&x zvE(ZubxN2#N>h(KzL;foZ#YeCeiE&GNZwH}l7c5(LyuO|@in*)MSEm%JdAy#AS0d4 zX^>1G3QA(S+%-G>G6@;1BtcF%;5x<`UF3Kp5v9)Q(HJg{UDv4|cf1(j-v|Kp;~3(; z@OxoG)p?%t6+%W+Va_e;Q80=D@+6g~0~p68fQs;7235UNjLzw}1uP=2e6iJ?TKMgf zdxRQ1z3_XJ9$>6shL&TPSu~)NF8~2iGlq4rj|4LA=L{-$p8Q4J3lIS*hJK*T@6Rvg zzYXA$p{&JvOSOer9E4>7n-JlWj5nn9X*Br92!x1kk)PBE#kXTkTuY(`?}+)Pj+J7) z6Rsw!3EkumEv&`Px<_cViV2F&rq=zB)nu@8Q>j!T;HwGb+gZpwOLzi=7JYbMmD;2ofOa1N;i35Wc|KPEu<#~fZh zFov=1j(GRSl@;m(|G#n{=;wd)_Wx6b4F2mTXstr#q@iwx%)!^Y{Iw2^`=d#>DU}7_ z@`%7+k89j(a^7mEeJ1d_^`LsBFteg;MT%=i%Dp0^xJko%XeD&{tbEASQ402JhbFo5=hqi+D$()#^h zM>zsg*Y6V}3HztFNQniG{Cw~Hm=%pSZ!giqS2SeS#@g% zWk=+XkbIv>&o(E2onv&{1vopfrJduXLE>wa`T>d;7uc>D#qTxQrhT zgNTbFdmI{o{*dD>y!+0>b{XB(uASs1Y%qJ~Sc6Ul^S_FAoBtQ3w8Y(PWTg!C7!k>H*$iB5aFQS!4{*`j&lkG;*=AJWLpD9ikL(k)ku%f@ug0^7;J!@-twvYry%lP7lgrhd~JAWBcns z31^h{>XOpxBhyzg7Z6O6rjtJ z28CTvtC8~D1i3C$dInV`+CwmP3ja`>=(t@){o8BIr}>c8K(Tclhoaq%-n7B)8rtI~ zd%6K%as}l?bebC`vkkEfIPiEB>`uR=u;#IapM3>264X$A4#oUKdK?Q5^~pVFkwMrc z=*Hn#OF)tl=j*R97+Hn9Ig2mkFs_>&P1F+f60Fo8_bee&2$$&403N`cf+ZsWe)io< z=EA`PP9{0E$8(qkhePV9kATi)wauo}2N#f^4ZDFy3^f49CY2{~7<`?uXp|ow0}9{w zAW1nAbqIdAVv(|blBXjIM8-o6H-O>e`_ie?uyR2Fyngrg>UOlnRJpwUtL=&M%+>QP zGHmB086iP!A$Oj$jY4VqN!!{d(K$IeN6{~Mg}Qk&?Ps2oa+v`VM0Zim%bjIGEqeEp zj-;-0Ae*4IRn67hK{69>-TnUZ;w<)KD+MVH&7)u&_>#b1?+X`tUt%K@|4f&ogWebQ zoDYK-Wg${^DL1_+I|Zfw(e}m*9bRpbbP|1BP%sg-q$C&JR0{jn#6zAV#T{HH0IB}c zb>-H=Z}YSAX!hrWtLU+GCvGG zy%OZ5gCgk!UKyKc2j(5Ksj67VA3!~bG5_fEPzgYKMyM6PZU_D=-z4ciH|?B$B%EUf z5acJw(`hp5->F?R)beuqI@j4RZU8%0>r|lap5nU)5fC6)otj5(WrG&bRhH=-%v8?2 z;MI|Q!TDHdI=$zP6;R@jRRLbIg{K8|U-p1Lta^T>-6l2A95fb4;&&|2NgZ98faJjU zO$NUz_2tjEFVz6t;@(>3zD#$wC1XZKEU#?=B=o*i`+dAr@DUJ>UUunp{Q{74Q6YD#kQ7U)DzGb>@UoIYf^YS+BDmW z9(PB_r}-AN*O48K36FGe_j+;7J|&$0nSV2+bl}N*DX>G3Y(9I0YD@Udi*)Wv(Afyl zeAwae%GUgPELz0vKnqFu=Z7{zUSFT%@8huFUBZfLd#0wQ*p>ZWI{P`!XIj4@GCWZ+ z?+LNhotn$slsnH}2fRgob7RLNAl<0SNe*>@JYww-V*z;_9&O=_1l=Y&iU) zXdaR4ve@zbT;OGIqL-@#1y844xV`sE7sQ)%KkXN=%K$389QIp^KLC6h1#%A>IRjR& z&kVa=My93#9^b0{PJPag^n@R-JhMLYi@rpc41(vgqtErtiIjI}q=d{Xn&QlMmpJB5 zbQ(jWz+d3P8Dv`lX203rZR#ZG+?Y-$w{s#rkxZK$Tg&#tH3o-ZZ{WkVyr5hryk#!Rhnz&ZR@W*ofzp zocB>NmG%o4U}0fsDz=xl?|fWwG$q&$l@rE8S>cm*)?#ypA+?N^T9kqY-wrFxlo<&@ z#Ed-Hnp77*b`S5D<(u^5q&_a}vEv<0vY(REAIg&0ECcRKNmo^O{3)Db$XSo{fMCqK zL;>d}7U%g8E+8%T*$&Q>3}e&w2qtq(OE_D=r%4q2`k2go4%lhik3S^Rw8`fOUT@+? zu{me^O9FbWFh~6~;5xZHeujk2FO*ZYhvDoF{?U$y!y4;b56KT9w^7w;)(U%~oxke; zv#b!s4FGF~1R5p=tTW==ufB7Yse?B#yku8&`d9ce z6(#8L2XJHa@URGQEP~Q;?`SJXz?A7ov5ka&;4s8@WYVQ8Y`c~@ zn+^i+qMbUba6WzF>$~?T5;?)kg=5nGPX{~yM!WkD;=}Wg!c(-v%&;% zX6KkA%&!H3yoll!1+akfDcR%*`@&$@c)Lm_`cTtuRNQXLk&f{L@TS`Yl)}rBClx2U zOUktsna)|NmD<9Y31=NziOTF{{mmDk)O^1+S=j-M6{s~U?ZWH5Q9A+&7y+53*6au< zIWZT2cc_+MgS&7heg>ovl${PNnsykKa|S{W?wc;3UR_KRO&13}*Z;=Q%MI8dR)Qa60b}k=aOq-@d z$V=5w0lP9jQ)1iIK5^i(#3bssu^kG^BhiABrMPj{yEn+nBs{z;1GxUWWDg-LoG$r& z%0EN%f9z|)Lr-L=ioN#c3GWThIjn<4DQ|iF^{hIj&xP!qz2OucHmnU|sy=>9q;9q* z^xkc}Z!Ihl?0C}f$6VIY7GZZuALnsj1$Q)#XNR5cIl5(FE6marWlWo~YPstR(<2jp z@o^=Wc&>sd7$lzcGN>)aH>r0B45g%B<3FFZVto;YyV5#KggKN?txXy)#}k@CxIW`d zNGAXAe1S0E6nSS4OK4_+5P=4+6~h4)&{FxqG zo}0TnC)~KbU^{iR9aOF#GaHY#8L!vO~bKY3_=KkUyZ_s>pzP=EJ;DAZ0Gu>?s#it&?jQ-Mo1fyP? zFQ89hjHEs(7_QM4zgTv7wrwfwe_=()x5*0wpa{9sTV*VQh)Y}m)9JViz^KLxzy;ip zassG0G@;dl=1UNir5CAkN$?-rXXoTAU4F3h85^DpoAmv2U<}19LB{?}mV4G=TxrrK znrm3=vY-xQ&b;~%8`!3V1+5C1=KyY2M;F)C)YO@~Ny(@ohuMV6D6q*(HIhpwt#$_z zN@h{(IcM2?1GQInW1emT!`RbR``zPvmuF8lEaE+;q-&1nfx&$84W&eNQ zWHV4oyCq)zJTK$v7%?eM5!W63G8!91SGMnt$B34 zHE9~+po`9G%|t>UUnFK>A?iTnr2azY|80P%4cW()QyvE+vp40okFS;vu?e=iPoqP8 z*lx0^3A|n-NI*Y~H_zGm$r3f%R>IN8*1BJ za}do@)a?Vzm1q{tyTCp;qci>_fN>y+)3o9o7{z1w5cBLwZ>C*o@^L!s;3x;fRGziO z-d~nnopeU(7_>=;I5eBlc)+jd?%BqEHb*6o%%90i9uvA_UK~CDaf9~vhmWN|m!6th zmP3P+N4`R}5mHEhYkwzGj|zoZtQ1jJpgeW3*w^&cLE_*SBn1VaO8-_&^TlNb5~sY} z$)X*pY|Fi!{!#hM$4uSSI?gH$KH)EYZu<1c5E$Z@Q;=DZo$CV|h==DsobvK^@Dica zh&t*gOunEZd9Mcnt?zt8G zOG`rbj{P5}Y`&Ts8!PUfob8qOxXMns9%+ucUm*o`b0AeaA7P;#=c9?Z&1>0>E?NP@ z7+r?^L(COmC`BhHaA=4=f}ny7nAl^3ZM#Ma3}u5nF9<;1|Te}En<(} zUnS#zT!n#$)SwrHz47%Xj}o#(J+<;xLrBNHTocI@8Y11~htXMJ+hhzgZ*iK0cHlyGIOeN?sm627=V%y zp|7pZNI{UpM@v!#IQ{GlQs3~KS$>7fH)hC>&TnGDjN^7kCtL*?CVi)vn{XWzj8ol@ zg)7dGt8H=emhY-au=DH)XQUE>EwW3GNN>`FSJ>j4qh<>E@gp$7+x=PcyI29}pZ8Jk zN6|$fc~JE6QOIp(Il&8Q$_?=T7>2d3_%6nuEKi#p4CZd#j^XNVCeor6^{1d9=F%Jj zx8rr|>5omuFab_RHrO397@u9RT{etGv%)4E*ezH7Ok8=WA};qGx_JcO17lKZwxp&v zc)fA166Cf~@$Q#$CTRU{+#%VQA$9X|swDSI9>zSaa;wh?&Oir!g2#IQU9O92nrt;_ zbC31Lo3EDQ++i`>{YH8hDfN1GodFvmBU2in{z&>7Su@!Q`>Wt6hprw!xhP~;rZM&dc>6*XCQ=vSE1SPF_!Ky>P_2NDBm<*Q7p z1!6T9n^ZaGW=oxpPx(5`XF|y>o5J^i4oYQBISJ$QJNH4`la5cjZ4?bI>B*? zWbb0zy=N+J!mMoeQ7rqs4rKLWGWF=(+~;cPHjh;lpa2&Bn7Wz={u_g8r{$uM!U37x zi2U&K?}?ZzG-1)YmK8MOPol0u1l)&f}h+mkfl&ra}CqT2k|Ygi}n*e z%)?msM#KgkwAluDOTS7}U`arL>hU|3jYEQG?RNYxRkXOzxM$MyRQoLYgdx8cOyEog26DTkzFDMS>RCVMVL`!U42v zh`gX3)8*}I)igCVEje=n)xd@`P$B#5e6+>cl%-m@P_^%N8_mA!VQqx#(Zzf6`-lg? zsg%^yksC7IHK{pSvY^Rc-2!f@3vK0A-k*^V47WiIPYL{3eQ)lc@Aq^-Whdz#80WkL z&qoeFnI*c~C1R}f1b&E^4}*P7*zd7hc00^8UidLy%}P;*U-g&TW(FphVXb>5`2Qnf zsR_U+;n#2Y^U->WpgIu*uDesl_~fv64@LPXv7K>v!t}B|1gkXgSw8QJ35;A9gsHFT z3$Pc29{X(W9j~_W77i-hy=uc3#yeDs$uqCK8HVUG%NE66X>sfkc3)~dm}JIt?(Kuw zJfeviy1ZARjqG{ccgK1hL=sMtOSps9*sul553iRUq)h)WG>Tj-N}6- z4EYsF6&2HHPsxMtd%?767TAry-4qKeTiTxAs=Y#39n4I>0o=*$T&~83?HX z4M4gn(o0XeL{iP0DX%-9a(34g-^Sk@iRZD_pWv2zyruP$cTO&b?ZtJhiOIkp7uJs) z+;^J=Bk2-jHeop{Q>@8?`<>w&<}Zx3-M6Qz7r#pw1-3V8)SfTq>W>wzZhZ)1spz#^ z0!?@!pP?Dh-uUb&7q!~IjTU@HUTAcA?pVUI|JlbA>Bxd_;%s>LFCG762&VA_McQdgG%!Y&L?K%T zG(qiZ#EraVU1iB2mqstWU}Zzm6Mwl!Q^dJ!vl!9yQ6AY@i94?c0Q=}3Ge*Je&Wo># zlH93yyVr29KY?m<0?T+-%dBr!5n=u}m-iXbgPx_}x0p}|>E#o5Qf*$4+9(iF++W{Em#H@>;BS$buRa`Gs33N3n8-)bBPnP*>fyF5qP1J3I2 zWwMQW5`Rvio?y&w{V?FNM)-3MC^QI#8QUiQ|A&$LuU{o2f`U!?TF{em0dTfYlikYF zlvE)sT|D8UpN)K%UkX0DUH+jf-q`Lb%s{1a{Ra zaC*pkFMb%XZ5wrT?D6DjkP0}?ct4NxONf5t`SpCl`LULs2bV|8aGWcJ_ImOt;m_x_v~feO$x3W@vOPdN*soU z%a+6qpiS~CoRpqm*Y+H=;fkZS!pz|f^$!-80kqe4`=UonUtz+cU zwrfwosOblSaaPp$CLEOHbHu+&^8Jxt!zTWdnQD>OJSxw8<#*+_*E9YO%J}#s_-2VvT6Xq6lCIM{Hq25) zJ7nG`HHY068Rfj9FpoLJ?IHD>8=@c2!-<*J(2rkS68mLa@RXo11-47%2A|>(xZNRi ze)#DD_6^^<(}vN8*-Y{0#9q*V^w`0OEIc0r`n{_Q+cU`+3ojiQJ0nN~t@)t+Wa z2gNB})_wRfT-zk8L)mdR^K_drc&^SNQ@7<*?6!oz0;v)-x*F`|_?wp1U*FvS_(2E* z+_ZF$7Us?O;FMI;UHgIj{$b8dj4hubw1e#!w@SwMf@a6N99qqLZSET*>|?QRQOvq! z-Cg}W8iU_+=N7!g$=lG}>RvzkXu7jmaQv#0Y1&B_Pgq1J2svEr{U*<9Dr$!=#zxU^;ylcRbpdt$ZT8kG#m9NfRQ;TdMRMRPz3?SHFfLGk%8(35)fg zh9o}dkvQGOX?)eH%QhbcU$k02 zwY;pC-H#b&M#1VWM0|p`em9~+CKlh+YxcD2TmjW2IdRS^pGjNcx~wN~L~#wcF8EPg z*v`4ZOa5`ZIK%636hA2W_|DHtsK@)Lfe_nv=JFDEg~;!PnC ztG9%=2-H`!rpL>ZGiIAoLV{I5nE@2mkzxq0n-2SbgG8=C7T?>){|kE%XGrtT*$Ie8 zGeX(H%SPFE_xZJ41#;R%(ab-!0O~)Vp2Eo;7=66qRFq*73kJ1J6e#e*c|!;@bXZs%qDmG zRRaMjE>I5M3PAit}6CXrL>c@fZY+Ji~szOSl?j zzy#f=_l-Y|r9Wohhv_E_q%dUp!_2?OQgGNFCpO>k+1kluc`0|~DYRNX^3=;6z;{sC zy`PEIxkTJc&P5|3`Yrc&4Lu5is7dn2{{u}J0WSkO9mY4}TL<6$3>$rgh{~VzhkTz~ zeBoLI=o!Os?P;Rxvw56AFCr81^!ulcEP`H%EXL~VZ}e!+y=>R_hd&!{+RS32;(WM$ z!;mEH$p~}F#M7M1=AO-uwdGs9jzINy)Aa|;x2hU7h02xWBSmMlWLf8fl&GQ%bk#aJ zBL$dUBdfU__a!okz$sJZ?r`l%$ON!IXosnM*?D}Y;r-Zkig#*cpg|xH!e_@2{M@yV zA|yqiq8|dtqb(gjk*4&uNQ^Y52_Vj@scX2h!_bcAnaZ>&YKoPh)#|Gx-lNZS+HiId z0+w5UM-LE2bU;|}f7AP0dHTQ1zB8be@w#M^(eMYMk4UaX76NL?>WjCsXP(N1=Jlsf zvv^;>87z}5UfDr}DIyLgm5p)B#of^;`$TQW==hC__b%kGXCTEAoC_3%qT{!W-#7cf ztCXhU?w!ts;-KBD^f3bg_U41BOjp<5FHiHigK8Jku*4bR_s6YKx=`P;z&TQ+GOpMjW zhKrtOb+5m5r5J_q+Jy;wKNE7#PN;ab*2Q5E2qK;4mUr)9O%n$CkB#r5Kw)y?Q3ddw z2AbJQsajP`(M~v=3S;>}^4NrRxf57|TihgI*M8HcuRXo(32XJj(5sz|;^9QAK_%s} z6HL~s$BC!=Nl5!Fbg6g>lm!iV$Er-a;=m}A={$iEM?{i&p7h}?&sP-@YKa)SepMm86H_r`T$a915@}E)dy@^o4 zlbA?o-6fUW>six|p%BM#t7G{_o*1XmQ$7p3 zsm#wT;PfMkP7~oG!K$kmesjYWSd{^m zy56qz_@!`nO(&<1*9P?VB~`-eA7qH3p5|y)JRUwAiUd+5ZQtH8nyz#w@O790FYesS zb*()hT|LUajJihvde`X7T>lC8X;-_oOH>L-CT`s|vPJdd?vRt$xX9(wiOJL9AA6ebxs3xA`I83FUbT>#()L^|vhID~TO{mo(yV+OowMG)rj)s$ zcmc~XtC$+ldCgHAYpk5Tx*unrHaWBWt?%=b{DERHp?yzoH!^h!><3v@t40RQ(B@91 zKg97#hEYr|mg$AP>z6&NN#LIE4BzWZHYeVLJCheQc-%rR-M2Xr5nXd3;QTY_8kIY5Uzc6Y8GY9WR%m zp(U*?7ipW2FAY7`pKfwRCD@OuPC1^Lx^`c^FaFlnIS&@H-wAQqF$F)OU{`9&`6O95 zCnxKp(|ms%q{ogfSlukU1F8cr3GW?*XwZ7;LL<_)?Oji8fo|Q;3AvCiLaXA>VoCDj zzY~Z+OqXxNoMbc^5@i_2zGtKpO`y-|h96? zt)?{Bu_MDbSWf;W7|5t#PDYzW81pNs*?9U(^^bTVc1k7D}3U zb=-Q@7SW0|d!oyvC{VHhpg{4Lr~4MSqmeo#$>Br*Bmcbtmk9f^{g$UGU`PWMW*o zJ01@Hz$EDUfRw{YP$zgaq1Cj(t|exH*>?l1@~~ss+^RI48s5;gznZ?PnZ!=>TL$*Y zH0cR$6~zi(2OvLb`~a)-l;u3_dTS0K)UI0iyw+sK{l?=P+X5g_nf|JYtof;RZvE^) zbU(vpGW1+#nYfO5RLJ~6n`P=KTyf=!0bkicGIN2?L<~5QF9{=5eNzXMJgM0AJsNHJ zD(JBPzsUFZJ_dEBc`DEj_$rgUhjoC0P)4_+B&^yOy00cv)q4x^+e(D-kmpo(k5+Uv zcbdXuylPg4y$+ot`tP1@Euz>`(>1O|H^jDc8IGX0N89FpG^{jI zSNRxQ?a-!OzK21#1ac+qxUs}#Mu$y0FnZT15UY*yII43| zn1QtWyNZ$ACk~A^JKcZq2=2+uZpi0l~v6^v+vrd0+UHi(#zdF?&b@9mFv!W|)m z3*NI8)xV&&|0N$hfS5w0d--f%7;s;{ezlq#D5b=rMy3DpQ>Bzkb$8t(3zA+Eq7$WW zU3Pn%`KYh_kJ&#-jOs~8JB)i$NbQJBwF#P-`a97Ea18n<4@`Ty`Lwi@P3tnz=$ATTL!TQY4pkiX>*=aN4xRqHtBYJxz6|dZhQFE)^G)| z`3=y>+Fw!wKn>~YlcT+3y|5=8CCqz4Nm_T*P4ayc_>QXf^?%^Y>8d*#+pl6T6Fa=g z+P8B8Q=HO~H!)!EgH~e7y}Um+^v0<}HPy=&3?(|0RbTXmqLSRxwx6D9kaXNZAR1w? zki3oOP7YF53z*$x^g`uZ{J&Jbfv~bD%S7`s48QEmH|>!ITn%Oa5jU*HFN|AQO?}zl zpKN-4>P^-Y?8UeWs=h~U?w_uC#;Va`UhsiN-q=ar|t}g!g7z~8+d=jrZ11>{K$Ns`<}+1{By&(J(7Xk zo42y73LwNEm469p|C>&CG&!;;{_+eXB_NjRxF6E?p^67XPY&T#}D z(u)HDSO-f_ZW@J>-Ra3B7H~-bIm7BaV78$CI%(UzbT^61FVqfKw%Y>kMGaQ?dNaua zw%?qs{b2U-!K7S6EP|^GiVL5kFG*rx9Qpxv$+ex`Nv@$Fjh+R&=J2f&T{o-Pz0Oyo zfwJ=`rq=NAHjz50MPg6d8c)rUMtXBd1Prr^y8Bs?=)0-B1r#npDRzj7D!PcY$r09p zb_R2`NwZlSkOV65wEo!SOYjg<^BC&Nje^1pj(Q4bx5*1?A4jPKUi*@S%V=hG7On{k zZ+-w3;}>rN$TV!VurT$vr0BR(BXyYB;r%|MBHY*AFoNdu380y|G_5=~(n~fdD6&UMfA%7_O zj&;ym+%lTw|E$1$Bj!7YVK5N%t?CJ!D1PE%*?Qg}#eB_4M(!F0PrBZBOE{VHTvI!T zTSL>11qO^xkMZ2A7@boR7>zuOwW`J_!^GAGFxX-wSFP;D`=jgY(-wTK^CvED`(2AQ zBGD(~=1F%W@5y!$y7C z>h>r5igIJKs)dH_zC;(&+k%n%Mfj(AG=5{dA0=)m3Lm=*%-9u4@{Pcljgl@z*GI7q z(qE&Vip*gWa+9x2pZB_*p0guw+YR8dwT}KA>>`p3b!i2IO;MGJ7awZ`&~$9m z?iiqPBG2d6G7oF+;aLCJplh}Xvd3h(b#OK<_m0(d^+|zRZC+kF#$x!+K%99*g5AXT z7P5!0i!S2`4uYsY4&RZ#CNx6c?k46d8k0&$2iEnihWrRH6;f$A4`}y)D}mBbQ8m@G zYbSDCcb4achnSb^P9A#d0uoCeeHs?wghf&9Cw>RoVz3+t{J9*^{*>1F! z*-@e?@_}5Y$BWi<*=hy5XH;hZFSf9L>Wfm!W>Lr|2JObV=7ktF#Cb(x7yAr!*4MUDDk=}@!UC{;Yidm|lvQ=^`yqQxiBDLa3h&h6Zjvl9UU?ljx^;cF)b_dGAuI8Y3x{y zc)=o1z@U>d@*h>oK={}_NL}0W{s(TJKSKdL41yyEK>h!dP@qu;U$4u(gEAYh^k$Pt zDLQ)nl?>d)72K)XejP#C`NPsZLk5IPcx22d-V9!{uY*>=RfdvRTp$*hRy%&qYsNa_ z>WO-+_@s_XGLd!ZK0(@Pg!8Pc1QzcL-Uce%WUIu}Jb?;oR}sV`!K*H)_4PH@kux}{ z7T~|NiGT5lPabKf!F^F7nn^pSF}MIlg6b!%R(uOvlPV>dt8gTrxd5Jj zV@|GZNA=FvoecP^p-G=vBmRrP4kKW&Iu>>w{9`Y*wWXu#dd7L?@swq0`4wC<*9kP5 zjCsdgP_@G@&5*fvOW~>B&DHk#j1vWMY~%6hTo2Zijm_$%U^D|%=v80BW6&A-P|-j6 z-0PNKhpRrzPUxMPg=~E|2w|{V-~Ky)c^H&nuw z24L+oPGQ*^ccLVU?QRgQf;oqjHM3;!HsGEDj!^Jx^JmCz^eK&JCY-O%ItC@k9toZgPWUWcdw}Ot4C6a66)X_a zA38=S1~Bu)Jirob*blXtbQDE$PxF`>(Gi1Q_wb$eFxNgiaRzDt$ZmE0tzpD;9Tb8h z71OV!r;g_uy(UVG*_6btddjKzM-2tGc$Zv;iqIg>(VN}6w+RIm0%eIy1A#8E!C4oh z|GGawkuwoz{LHCV*897jbpbN$N zmwD2^t1_P8!AgvEGnN>0eA7vB-T~1uwA-Iok&jx%;AZP0;{~=k38Jyf7M-YGSE@d^ zUHeK)?QPhh3UQD=<`btaViNXOQJC4x24a$k<=; zWs$92Oky3qHAi-15Ajcxuwr~S9O;m9I_A`lEgJ(&8QZYPZ0DOxjJoh{9KP1a+=OyX zQ}XWCMdqn2T6t*V`sF0 z)0O{=>tn}~wfxGL4fi}cn}Jg((Ij**9sIHdm@YaMU%%TF3TN6ACvL37ZST;Mi^ID7 zG}U;0%>2~4>hOzi5bwZl2H6@Ww);9Jx#{i00^N&G7^F`ATeZ6l6~T?_oHnz3R|Z{b zF;p%!qo{;Xd^zmMy~DD1+iK6+X)pZ=`L<3BKA+%LKj{Dwmf@4Xen(aUcaFw0a0=)lI`y6vz)#iLq&_6&Cu?V08VGd zwa0rY1jEB4j_`njm(qpXJQqLV%i;o!^0I;A*&9NDqQ zH3K&$foeK@J->9Nv;4xvkbQE=jxS<=mwLLm`;_A_Uk8Z6k^nIi8@4Gy=9vfcfOg`C zc(}%B8+Av`!J4iNjg8AH)nYd$1wgV}2WEfd-U$3EYESbkuhSbuH>T#UE3_P!37lpx zZ4r*ZAHdS6*H8$5)keg-gfnk$!0&z>MPnkUU(pTYp9t3e_|Ozwxgbv3eRVoRKU3>m zX%XTLndQrbuP5O?=+p-U1;Gk?)tdv=gO1u8VwVOxvNh)^N7d?`8r>;R;1CfFe25+v z^}pZ)Mvio8bG-%7!SKG1PvxG5Eb$IZeK}uZuih$=UiQ8M9VP2paGxv>rb}>D14C>h zKs}09)$vpo4`CtOCJQUFzqyQZ*c_Fab?^V-!19K^Qu2`x$L`xMIHF4i!s3LDpTG%? zxeNT3m;`)bP9BH)MDfHubYu4d`d;!Mn?iz)8{b}EMUhVPnD8B?(4>Ig zj2GKZJ#KUS&W}M;Bv#^MqyV`M6FI#K;p0juia_{dG{Xc+P zP0VhBTadcB*ny%=gZe80HfaHc=F5e*WYp>6p-T55M7)BaQyMpx({d^T1sd>9;>wa}hx5V7GM+NSp07SiF)F(M6P5-Rl7AV`nDTG43msMg|z_+EWz0-cx9h<;!24xkpb zPqw2N7>>7&B6FS|+~GK$2DXU@oxO2vMtgcs&tucS+&E25RKuu9vfT2udqgg=P0oMo*pY;eHKjmYp?O68V{#3X|mcLx=m(du3> z;-(sI(fnYF$AeTTl04&^|Cc9Jf%6{DEu3N3T&$_C3V{BDIQ#zzt)%pEglVR2w)|de zcmM($#zB$@*uTl9n2~M^VUyAG+;wkA$8TpPeyhudbxCrrb!WM98w5(ara3UAP z8V)v9n76biOoZtBg%yP&eRRAulvU-nvpKOg^#|P`E)(qJ# zvPcJ+?gn;c)rVgcTTZ-wdQ!DyRGhR;7}Q3458^LI`0D`Rd2qjdwC#AjH+D32c^2B{ zLWd^GxBWBlY1soU{eaNcXF{@Neh4|yZlT1vjrib=|CN9zS403h5jB6%CgAA9t;l@w z7C?TFA^ZzE^Ci$V4Ge*j*DD zQ>rwIs*4>q$$*t>`Ub_i&Lgu*f_yG_8KMi+hQ8xhy z9?VoHggA*@WpL|QyY*bz5~tR$LClxDxxSjIQq?}T zuRfiQUDRSvQ?b~bB-{5*l
A}$ta*Q#7!pL(sur5lgr zjQCWi;Ct-&_`=b&WHv|_$Y5PCVKfn;GJ`IOGXRbi&J{1Z+p1l-Uf$jsRXW%nuPb2gOQ0V z13RdjtDfeaCU9OkO<~SDq)?<~o}( zs@Hn*O;kB3w;Z!t`3k8Mr(pC{-A2fyx@RaK7{L7iIl$Ks2%J&xlUN!ZlL%67ws*Z^ zU=-qnv>W<7QD4s2&srL6r^+lDbuTu?j3y3@OZ2YoOB~{Y#yk(HEh!V6gB-pyBW{%( z%9i}_!(Kif(?PePUq9U#kp>t=iS^16m4oEU*$+3+jvG^~9;^0cFG}G&f89yz;Z&fd;f}bPM&NT zwU2-mI1nZmN_3w=5BtLBw2gZF%%j`x*|FNHV;a%=(5XG>ow0!Smfoyn1Y_j}jdV<% z%}ppR2TyFruT`0Y5Zua~f8|2E=Z~w?*<I$-fsmh5_pMD?+AS z5a@P=bPJH^Z8=(Gv`w$4`;Q%)E>ZP5<-SME`a>(}Qv`((k0zgLF_Y@#ud4{YI-=!$ zweq6F)$nTRRSAHMIfdRJ*NoNz4r=5IIW&#(?6$?|`px_I{gcM~Lr(FsQ|MFktA>Vn zqAgND=gItZ+MfC8X~$}(S>}xpFk2#1Z36udWpL!+Y{LEqbVze2fMXQz0}yZ!wbulh+cKB;+wwn&fO?U}b<= zUbOVvhegN{!#~+Zi$tl*>S8}}cH%!f7xzmhUd4B1(yOdBk{Ky)hy8jcgy6`+gaA|P zi+gy|!2+_hM|s?hVKcO`-@~u&w{%oWpHDCyXX;p2Nk5!F%3|(~2{nEfOoTb$f8;&! z&>GooN($uIMD3wuyw)M~DWKOgV50%}N`0YrUyn1;>(`%PCzck=ldXx87&+V*6C*xD z+{|sg@bxJuA8PY8uH}R9D69lW4ypg3KPWHsl!3U<6j~8e-Q&CQMPJU&Oj4M;?>69r z+=WPVsl;P(>TI6~IMY9Dye>#H6xD|<;5V?1A_4j?lA{iEcmX~!iV!hln*2=Y!52Kj z4zRc&S-qD8YYshzp}{vlR~+O}KI`bX-C)A%H`lR8W#xDHxC8gH2#ai`RiOQN{c{;^acLsA__=I zx#QZT$n`QF7Q>iT<@D=POCXHI{bF)*(kQ@bQ5(=~wHE5)E)S=x57O-+mf?0pnKi;> z;}`%3dfTbiRnC#3DYIO%jR;G$lWxn9FBHb=eis{{8`!3!EBw(C+x{q^=N!&Rs#OXd zcW)dJbvzLlu9{yy(r-d_2g_(*CW(C?)B!D?;n@Bcc7*h-;p0wqZ$R*#rRuNMz&m@v zZ2Mjow^P3o};mSgfv+E1GG+j;F?n}`$dwCd4 z|F4k$A4nSIFbE~1*IuKyeSj!41z=M}5Y2pd!xynBG78HYrr= z=tr#8Kw&*P z=1T6wrDDn7U$#zIiG>K*UtTE0hWSEsG%nZ<4rAjuFR+drKZNss-+n-$;f-~isz1iz z>oJrla4v#`7|ipYoS}=E6|L7pLK7=8HrO+Nc{lkcp6A}vb=xo zjm{91>mzo|jn-h&gMQwONqCu;OhtjVwjX6`AuS|`c|Mo1LOro~sM!q~HxH8wwA82W zxZM5a2n*Fx7wJ@5e=jv*RzHB8&6yfq-yf)^O+iN0_-*E?0h7szE^}3>M}1t1 zM|m_y$NrJ;g-5xK>8t!dlu5ORkubs|?~up&<2Lj9dL%MEw5|vzIy09z{lhdFu5%Ni6~V^#ll_o$9mg;7q({>sBFBSbH`Mzs>ICwqW~4QGG8( z=qHv5rXS(7dxn+)sL0WqxUBN;+zJD@cMC!|$1c#8!A2Bdwr z#IjtfE_<+FgzE{3E^64Kt8XhFM;5F^h%qpauy6r}jxjEKF77ofYb8=i8snj16HS!AE^wiLJ*C_Az}Gxu#$=cifQc zpwN7W`PU8P7~>5U`2saq&XE)R_z|RhL=0oJ7*{mek^yy48l}~sg!YHO%|LFUD#6&< z%D^=qQ{rdu!{%nMASJ{JVGFoxZ*DYG9k+7i=e#$0S%kGdI5t`|-!{~XA{fnpY2pfA;j4tB{cf(=p z0|+*2+!V$aM>Ed|nY7-00XmU}a4S}hkVn2mArVXS49L`-TX0@UK zcqsYY>6egSApT_={=2czd!Z#* z0&JIr$eu0Wvjrq!IeTxA{Zs}}@0%3M4B3$r_p(AI2XR=t(^7mH73I_h(7_xp=o=~Y zt(6ktdPjFch}(PlIDhydmxNDR*^2LZH~f>s+q(WH;pV=?pM)Dw5qr*KQxsavO6Pq zgL==e_Yj+CKEUv~<{e+CO?xXX$4K!@@2&BuyMFe zTao4pb^)oUpBw?>R3z9U7lf$MghmI%KHE1lsd>KVFmcgn2FO^bYHs|_jCUasCi9M9|5#t6N_1QYZMyoZbaFT$od$LTNGEx#Z&~=wH z%LOtB?LgNZ%1yDf%;>-N{!7f9&&P<0K98nH`HTe(v2t1_ZXtfsT1Q zHE6AfF>?g)c7$KVnabN9Mr&GS!=0b{`f=>loUVap_}DO54taVw0KkeSNcPamU2?(t z^C0C7AuRIt!3RUVgzJJqU_;#f?aFMxR8!AwSF?}r50r%hiOU_9@Vo z9P($QwpnbhQwG#yp3UoMnp)p?%UeNha|vO3iBzVdlkzc!7@9wz9=Nw4BJtGvd?;%7wsVO@ zQA^(q?~D6aZsPF9fl{o`gN~6BP+hc|zb(Y?`va98Mmxe0eF2~uQykF5KkL?QUso(J zH4jcsDCk9Fa_nR?-aZWMTb(q|g@DUvcLhJsmv+Xz2;LL1YO+mX$OqC!Ls1^A75DJZ zv*Ex8w~{;(#0(VL<81#aPX23*`1Sdpf&>~AKjTHu6f9n#Y8z*PE%A~f7yGnjt@?dn zwDkQcK0Jv#psO;vS|~j>X(pFq<4g);^WkgMavg_@B<(=XSUKP8LH*%-@JI0r=42RS zNQVRTKItfS!+!T8jTX z%~s$Oy2M`)@L%8em*))$SVSmZ?JB1kxU(a)>kzBDPb2JlTk~t{PUy*0jmKKIDuK1n2a>zXZp7`;$;3M6+wr*<#M8 zK?2yiJAM1)^ewCl8J38s3qWJZ*8G&#{w$M(bP#$45ou~^ljPb1bAKBq&85MjOdhP5 z9Y1>S1&}~dz+)NhMI3=Ga?6sM5;-ib z1^V=V#0xvX{3VCDq2J~dz+9)AKyf_?grv~&69t>&Vl(`TQ(`7e=Hn~|9XEWaDr>qy-8>=Pm> zNJX`*cNBEpO+0rSp!~I8})(A)R zSYi4Qagr%J0)s6A9*~lU{`Fntv?{9x^8CKdrwj5^@7?g$ zDaFPR`8@0>jDrhMuH-=Ir{Y%}75O9d$0E?i+VrlrcZMlr8gZY2Xnqed5n>Z|OsD=L73Slik@gLO9U8 zA@_JsY{}C6;-|xLm(~8R=H)AyhvPQ3Fr>II>8MwR4KcUBRdPdoXG;Kjaa1${&y(9! zDY}=|+q?sXWBIj*Tra+lra}vN+c>5gzk1ZXZmUsbqyK%A{g(_|@&!2LU$d%;;Bh(| zLFdCEM}gqE0ftDH7HJ2?qMp!YiEIFXZV(d1g zMp&el6ppz}!TtC_BpYg)hyUZ!dq6udxd!J;%Q;-!8TmUPBZJEsDrRn8O!jjNv<&%C zSlQvdg0+LVyae7Q3_q~QdkbUu2*iM@_D`%&FkLZBfJyE2%s*gLpMsu0cx_}E(6i@X z!1h3lcY|~c)A#A@((ATRxO1%iBn}SgsY#9!x8n^gd92`nd&~c)A9lhFgrEmTW$n}h ze;jxIW#&6WtQA)dSH zi|b_>{n<(Kr+h50hq@0UX!OZx(hAV<#fir^0!o!BJ=oC6)i41JxE^}=SQV$_84~P7 zye235ld|@QD8{?f%zG5~B8MN4!3h05=#%?CZ;QwpOzbq44uvzM7yz(^)=oy^ei4vh z2YcVyTt_w%t)TXFjR|mp@}U!aEMBlY`2#_6-asSb3ekgu%$|3D^=kiZ8u;rE2d-f= z&Fkd*^pdiaH&{mtrKuQgE+oRd{@X=TfaC9=b`!Mk!T1M|6bW=*J>5oMDlznHHU>vV zYHI3UzJ9TZmOB=pn?ue=qgFdMktABrO(GBEP|VOo^osyT{{j7rW+1#vf9~?Eoeow* zc%%X6*g%FH81&MrSZ@YDjj9>#k0De=tmYpC{WE=X$c8R4;^iFx_zKb*!$ldE7P1+4 z)VAR_v$h_kK3d^|D?E9gl3gtYn>mbRCRdE%#d7_w-2Sx&7y1YrlNdK)%)LbTq@i)1 z`#^ypP-RWs(hu&0nt+@1_Lp4bO5fEY-61r?16d{P?tBaWHoOr7pT~Fs$9UpU7aX&r znu#RUIG8jFUfEm1F+XD|#unvRF-pFTG0QEOWaf9mI6VS@NI{&~o`52ti98noJyHZg zx#00IF(aTOXA0Ai1CRx{&4r&3#!G>BcT$jNjpi;4@b{oy_)T_6VyuoulB5#6URSJM zWO%TFC#+5SV(^2|Tk4l`w>=}T`3)*}_>XLICu!4cGHv2;`{TXho4N^-*X*A(3cLQ* zH2wAE|I@P&O!5JwkDr(DK!EtEp52Xhq`YSKFrtQucAS}Un0YJbU`SXP(E_m!C!<|G z^WLEh{F zFa03SE7@F@!h;Jxo?PP|Rcv9ex`6Kj411Lj7=OmId={KWYeodHtvZ;3oomDV$s z$o5WYHeb0O3eZp`aor&Ke56->J~dgskN)%*ufyM;iK0GmKR^<_5Jw;10`~)aLi7PG zDVmw8dN!B9?K*<0x1KYbOk?hAM*6rsV7`(wnopzlHr;Y8gmRDJ4$f=oQRR3y5hGxN zhyL)MZn&`)AE=(KDpv8k8-GYqZj}0*KZ!(Z)#o+OvUN{e0!4us67bsnBIfhBatbcu zIb5(|(Vd@Ab47_?BnJOPvrO!}6M~5%K4F<5ACNc(epKpcYw20GdFgmrmENjLProPG^Z7=hSu0rJmzqmBi^Rcf;{U-hSbzzQSb1nY$!z~Sb*ypcCOTlR4p`Z6J zsT~IxI75xo2QQ+;OeNl<7iw@u2^;ZCR#kaFIUn($NBv)DICu8_PQ&?u^zC|yFqn)H z70MdsGW8XlaSWI}+pqRjkk&(&p>c=lOM?C{(86_|##i6&s@I!;gseAT zDlCirjl}>9^92?nK4F{i68dCBM_=bSD18YfVB%Dd2*s5|^vItWWZ$T}mM}qYF!VuK z+Ose~ccq#$4faPrZk934)s&EY9ONcM3~6!;oYH^zu46@p>bX?#_Bu!#KF~n%zUr%2 zT(l??Q@?+tAa#1ZX!Oh{`8yJMR{INlr0j>ZC=11ie^C$qoG!yOK`&j#aKHUQ04bEkj#1-5D=~e8WI05yjb##M?{r zFXF?78z`fh9ncterZ>`)7+vC)Aa@XWT9O0=1YalkcHC{8PFm3<-(yYs7M;zkWiu`T znhGi2?}*r>$8D=#3w%eJ3?Wg9lVce(z@9Kff%WV<0(tGZ`TQ8ROGe=7|yG9h@fe_vqnsCdo7h~fj;$pjXzfrIW3Lc%a<~+ z=1(OgfOg_c2vMAeb&n#{62w|giu{3`0SYNfCM$g}^=p3adG50=2DT=1Py?r=Y7AkRPLaI@I^(je}pK>P`X0T1hf zCv2+-0g^;moNm<~nbS+dvw9}4!g;6Na zBQ^Jm`Pl0OK`$VC0DNEC6kVbuHjCc?vHtZ@XViEX2} zMHZQ^SJ()j2X1$$M|r!RDHp4Fo5|8??MZ8BYrgarXmO zUt%A00HadMMwh$B$N+X@62a`$DrY*xck8g~%Eh*fD`Z`XaKRP>=rubUa)1h$iUR!> z5R&c0`?o@}0du8iSMYPCvCX@NXAzuo0_y@eQu1O2@PaQE3q{*Ay~&kK#}L7nDnyt2 ztv&kxb-N4wLz}g}0wD*c5Xi0Uiu&j?DD3@h1*JQn8!4iT0c)KUh|Sn)+7^}TMA#0~ zYqHzMEU_gc!o#$hYTE^V$$g6mTW=@~;ZdXIxQn#H-v!GvXfQk z=RhTrP(EZaHzd8D+U7&s3ut}$=$?l@bF*U^!;H~B&L z2E`_CGw9;|@Fygji9~NO7 z3e_q;Hm%g@gcouCRP49R=HOfKB^4>@gh3%6LH1Lsjlk|+h6iVl)YE<8w4Y;aF^)gR z*luK_5vFj#0GIc9bHQC-dShmW=xZZ++ep)*+C9X%(tQ!g9-8JI%Z_HM+b~$fo&U)$ z{+X{Y;)?Vc^k5y%!u#-zl6EciMJ9V zkV{ycOR&h@WNfz3(k$}BLf z_e$R82JtDHY^6Rk#i4sW8Gr|z+wg{678sKx7W7Vo3HE{+k7l_a1%}FSj6C~*FU;1G zcFWzV>Uzq1PKUuCjTo&ItOEgZ%obP% zQFvZ8hlZ0!Q~6HGOu|*Uy#vBZyH`zrrvvLqDw%D}5dj1rXaCI3yZ@33{OdXUH~*AU z3@b3l``=D1OQ)y_>3+@{zO5>W*_>tK=X**$^7L-1u^E|B!=tFcXoV)5^t4|8Ru=@R93Y3i}uhz?NTLTlZ-54#;Bmm4w<0L^%mRu zLl^%iJWppGzMb`{F$MRmtL4+=_cRoBsg52Y;!1p?> zwK`0E{-)HKdj7St^5iU+&wCtdKgp?qSW51+>rg8^AuGfdO242N`r@@@_Yn}jR)|Fn zrrr-R;AKa!MffbHL@g}kyZDY0g%}s%*~+a~lsA*L8@cSmPaQLI+?l&H`DP18$wzfI z`9H?*tU}F^;je;Do~gxl*ZR354gLNO(OP$`1we(fcljw-&ZK2 zs#ZZBsxtePD`Z1Xoj_H7dt~)V9;R8(KRNiUt39PROYt*DrZ= z&Xig{*huH^?(M30fInUJ(&WY4|N3o(^gg5NrBJNXG(lUX^h~>>Wa{Bd4A*4u)^Cfu zvOmFcBpG)cs(Vr~qwwfErU}<|o?cUkatgOZJn@0!b1%)1yzGcnC7QTbCkq!9H*L|6 zv3d?OhfZdnX%!YGh$y|(P)@Tw2+M`t!o+GLHKJw^$$9EMM&CFCaV^o1+q}KeJ8C>z|}|& z@2PH{r-_TAm!gZC^nm}j-}Ilq;4>(53;t>iBA_&;3+LD9Be3IgRE{i~scvTfWU456 z6I+frp%k;`3UO3fN|vJQ+GFlSu$&C`ZLa{M2GavKu7sWd< zN*s48Vk{*?e`G&rRVKKrF#YVKbO(K(O5$hrwnvUl9!kpU$|D+uRSo8uTWdkm8?;MQ zOvcLE=Jkt`#y`T(Iy;jyHR8??iLp#iR?*?>lkjTTaGHb~+4zjz{Qt{M3to^)8oXKO z!Rpb%qnDN`*l%9iIFz;cijK`1O-oV`j=LO)pAOoJ)}z_@Z68H$QBCb7?a;gt=4LDN zR7ifP>~%z`L6b`n+S5c@;Yh0F&Quw~!&qSckPm`b&XJ@};+}Pmy6Siuscst%wyycE zSIsjwvLVej(cC*R!?zC~n@cK><_R3`KUUpj<>b@%hi1i;Xw**`h}L3ku~pGyo%1c> zufFpUko7yI=edn>M1PK-A^7{l_>T|Aa)7`x5Pr#?;=4eFgK=cmxW7kcLxTvP>C85D z@$y}LAjwfWbhHZNJhh#v6~YkuJs`mEGPT9=&0>Yqxy8ubM#t!z^$KCZlUqMbWQ+s% z#z)5wSPCL9(hQd}PI$C@4Y$H-bL?Sl4YIww2XU4;5x?gdBsBSTZ|4c8X@M3uU)Z?MI z&o%UHIE&;rA?F`&3BnU!BiPhl5Ps$yEAc;$;}Yu%AD6UIZ__MWUL}zO#%7JW&fO{N zY`pbPBdVUxELs|fkCfkBT2q-iQ*7kA$tyd3rjw^Ac}6drwQOTEWcwg2gCpUk@>ue< z!ZD5PcT`qPM4~&ynn|*m+o{N!nNp!mdg2ItVe8cDP}Bq_zMcQJyAYKzg)Fy!)LXsplev#h=)_=aGPsAf{ zABYju{(KJ)g=+x&Nb)H;uepr@(pA|Y|5VZ3{#)>;-6uD_((d979S^~%gWf%luvhD` zG@+C3ugdiohexDQb(p8Y*nD)M2yIELO3IROmkH22>8jqMwxA4^H3fP|R*cg-u>qX&# z`=sY-wy)oUy!eFm#|8fBsOjp|hDu?r?2GwiG+8$t(p~jkkMJER66c_K_Pf7G@$IndW_ zFMlr%>M@Iq9Kvi{q%%`C4MobimwqJni6L_V)${uDp@1A+nNJSym(F00*?hLDRg0FU z0zuX9@_iCoC3oOG2?^R&l;B9Mi+tP{_dBLbjC)ju3D?p8`)w?whkzPF#ygr{e!{cE zd^*GBt8DuO;Z3+uix9Kn=AUObaoX<9WPA(h##9ge-4o=Y7&KLGmNnGLBRBBuH0`JRq@rXLW#yaX7K}0uZNOxQjYmI`hvpAY{AU`Hvq3upYx48|3>djOjNjb zixGRyNehgC%MzS%)O=9u*2I`!OB3F-GG2EGs?0N)Vg8*}_>2;wX~j{wQ8h9xip~E- z;gKy9!kdpx15uCTGYZtWG7VUYG|8Ina;v_`SSJ(?O&qNcP1m^|x?3Mxq>a7SY@{Tl z-VDdMD2DuC;M`sq>*c7Bc#FB1I6@-$^iGz@mx_nwFYF>A{$JEpp9XwE$9Q|^G~LQI z2XYa`bT9pSbN}T{cUo1DxsAPmGO5DH93eY=4>|3Fb`9{lf9 zj9YN@bUuL=dFx5#J!Hu)i-82?V&}d>zCw#g=U;nMe8X-}W1%3uu(w^A<`(n}Ubo%} zSbh6E!?Mn7T6`xX&g{BK{cX)>R{`}huGxOwqNZ*37Alc}%GF0o zcT956NAngp&gE{77WbsiHsQUjXo5M^9wk11Jm#%}Ji>ZcNlUl9RF33gABszq{hZW0 z=i-3Q&;9fH)q68NIWOO22@jS5?0I;JZh09!Pxb+3?YeRPi!Ju_8rdMf|2}cSae?3x z3qpJ~jiIv=lO^S&*+&D2Ql}y(a=OGwteX(o!=&M@)rZgH~D z==ou`#Nh1IpX!{}&dqEzK=W;C1!wH#CRaYaYfBT%IsYhQ7uIb%WubwcajeGM|Clpj zjfTJA`I7?f{3#o*Rx*bH;q?U^;Kn<&6Rl}&H>T}XUkk)-I!1ronJs;wY>;#Pu~?R8 zTUnzm<9X)&HnSP$Mo(T{&ZnDsr88swyn->MuZ{0zX2)j8AWD89LwxPN*DS=mvDPi3cX_tI6R=sZN$&Y$mtMN( z2=#AVN-P)%IxJ?|r+afZ)c+Y4bmq#dUa+z-&sT6iFuWF!!m^7-+k#`NoEum9cftgxBP5puIn+l8sV$jZ#;j|r z9mf)XK%hOk)$v}}hbN{g?RAlC?Nc7qa!Fei@vNWMoq@$^m4vG4%>ZUvn zzqQ5ziKWb`j+=>>JRI-CIA%pjRVZBOJkQTmruY2ES81N)RY_?OOd~6kJpWQv=R`Vi ztY`d8H6eQu7mZ~xsE24EQRQ2RcaEjk6Qpxoms|IqE+XihwGh>?o_M7*x@~mf76!om zS4HNZX+qKs0(C)ghI^lfG4LtcJ8UH3@fJdaTR=KT+l*(%M3S}nQKr-^Y+>^n<3gRQ z?*h&t(xb;)vu}=sYiae+7=-8!c z<}g!m0<)CaK{4Zn6Np;ov4?^U=jDaf_Wf6LveS)R8#EH4UQQZ?>*Id3YDsb8^)C{* z2esY5g^RlEKZ>bRluJy{RyYqdtoOOL(%-&1o!gCO;)txSf3tO1UNAFRd%ltTcKl|~ zeis^kS~F#RSUG6&1V^QvTut_7|4l*tiTSE~RmXLkcm2sHk}sIm8iG;cqCvq9yK(Nd zR9MMm6=b$e!aEgHHoHpO$d!}k($3voGy%|?>$BpW^Gz?jS?8MpsZa7+V&#>0lVzJ( zr@_!>?)xwK-S!wv z6SLm5dQ~R(as>ku%ZXIZ^tyuj&FQn^FMb}c@o5So^ixhZj}>$YO+E+C3ElKLH}n7l zKhHqNB^AvP&lC1!M@>ss{)b0%v6K5&yv|9QNZ;}dYesWxHVu%@`RjcehNVMIix)rl zB~-_dtYKpZYapFZZPn9_&dz%9^prEo8Ls0|n1*&JDVs~e@(C5!?$7dV%1Z8r9#51W zg}Rv8@Qk{^D?fdn%B_3su9A$@7GW;l7)~IOGbAoZp}au=@0ozKt4a-b-Qx&6iyGWl z*2QAiR5Os}{>C>+2}h`Ng|uwo&j7cswP*(Q?;X9LeVY#bgjfc8km;1yL9*|u{8aSg zlUJ8X*5a$xL`j8lOvfwGxQi{-HS|&Ox&G;DqN??w%z)IeKpph+H1n+dV#uN{-`N1N z;QYy)SEKEsnf*$YG}E>CUMV%kw#uG_pj(LhMM3QwM`Vgi>(h&=wD^vtev{r`oX4$~BXWJNUj_UV~|w zEj5moyQFhf%G@^1-?%_MBk)bbB7a*48l*bTJl?j$746>j;Y-{EO+oP+P5aQm9iZ2N z`3UCoxS)G?@6Htw#%1V!4mCsP8E&J`bz<%I&Q5JV#*ud6@(yW?))okc_Zqf}+oCmr z_4{Gw=cM>H;I}F}zi4w=KV$9TwN=~!5G3%2FZkkjy>8IBAeS!AySmqlSY?`vp3T8G z#lSyemi>Ee`Pjat4hbFbiM)x0%B5gT*e9BDtpcSJot^sKtNx-Bc#5<4wO80)MF~AK ziYIMocIrdK=S)e(t5v{so@eRP>BgZ<99x@J*5crh`|OPa14L-if0S7@58#mQpv zjg$0njcY@t94AlSnfB%A+0ljq(wSbuJ314fWuhT?g6bY{gPob1$UH2f4PipQp8c9+4Tv{fhZ}qLVer)s=T6|4o*Xwct); z{?TAKr1xrPbWVME!>~IlbQ>MP{>ouxbIZQZPWNWgRU;`^ook@uf}mXeE%|roK}+ge z@|BhTWM)3$%J|}Z-o_*~er!}6ZaU{Jb`~2WN-tiun4NWVnUUk0F#NK)@Dq#BR5`M7^%~e=S||IZ zw-6C5c2!Q&byoxbS_JsUn}e<@yQLPk8+F%tA7rab&z(YSKAa1sob%Ur1=%N42X(v- zjt~rTkjX2isuqLH@F-9|e*ZH$=zdqwLAu@hB!%W~;6Cvekg|msq%eyHa?rEgzFB6v zIUPP5Q9;*Da09~XDnFdo|4!MMa^Giv=_>y)x7OrlKYSklm|RE)M@=2opLFeQxhs_4 z(UhgCdwe3FQM5MHohmD?O~cNpRJlecC;js*f=9&6|6%RDqngaRzTp`WtcVVxAYybZ zD5xkM1cIWVB0ZrO73sa#B!dVjQd9&~NLhq1J0tqA}yeH1gQ@-bY zpLLJ-_n*s!OOkV4XYc)M`!;xsIsBYb^LOqi7F7{BrW#E%wpMav25V+hdA>K6w^}F)I0NGkkDpj zY>0QPS>+Imp5>q0QR475f>J*p7zS$%9`hHQCDK{jp7W}iv{%eP2rcQx+$VoF2IWRg zyS#0uw~-hF?LM*Z%={6ELN~#=AzVl#%*5X8#QcT~h(z%tko=aSE3}ZH`%H*0ALQI- zn*H|GcMDZHCa^r*E)Uj*2Y;6?t9+|_9;eVK0n;!t;_2_F-C*0hx|iJ`FciSmVu-O6 zm_=#D13nrV4tZWu5B)Ns6$k+MB8}G`0NdOVL2sh&HKCF_b_h#5jj0@W=-o;O#d%RiWOS9pK>jS4a$y-dog*S;s4?|oP7($eI~hRBaS z`PML{B8AcvR}grl$iZ2oxvac+c!X677u<7Jk#?UIous-tBeYfFJmIc=(9*K zSd!2Ts)lk$Tq(j4yAuN4eqFs@)VjoQrBY11Ty7B8%L-6g@986DJy%JElyI6|&h_uP zl{1EBhoB(Gl>3)4jrhM zGq3)txO`l0^-C0qjNYk1nC5wjptf3v!Nyv<9p9UaW~VD?3wFcToBc}yWzLmA;LP|h ziMEf?uB9{4S}6bpUm{0stlmGW4NJPekb)6TgT?2I7A;;EihzmPC{;Ic%Z6?NNF-xd zkmAcfc49TRkK=2SN8;w22X+wO7h4}X{}UKM-({b-)0|st40}%v^_l{?P0aIp3iZ+2 z(_ePW1w2gZBnR30>uY`E!zcv?^ay>^+6giC@bssb>Dd(ZW>BQM{La=&-J=`L?V;X> zA6_(XE+@`KFg8(w2OVFw=OC*I6h;b!F<{~e)_%t=O=LoawFgZ%7WAs~{kL8w+dDlO zHSeq?xQcnweRkG3WSx}Fn!{+!Qeqg90CvaojhMNv8cX@CO|3B7iaR8GHiO1%ktY%B zuSq7=#ABa9e03}7B?XEqa!jIfqbep3d42kIPbpgUU71FYX2m_z%GzX_q1bve|2uFE zCB#utv>tR-L!@+(SZ&jn7o-n%Nc(T`)thfrhix)C=GU|9aA>oXS<)z7kHWd0E5nGd z1nt&JgH?$0YrfghstrlXh?OfTZnWY{?bLbxAZkW}WV4C;>UoNS?3Tc?cL+T{@)Y;X z4j3P*%CQZ+L9=|pOS-gd!tKR+)a!@&wU)~4We4QPJ~0S&^rgu@L%SaGhw7WdbrlVw&rQ8&b9 z=y5Mfoxau`cE)kljc&!aeUQKt#GOpP3P?@Uv5H;@`i-TSEft46T$iEc(#|*+>TsR& z7*_nSx4US$#`D#E^rP8-$ezF~zD>@I>60-#K)sz^IL0= zx0v~B&E(KMNkTeVJSswmY?WMm;G|b)n)a|EZU=k)ld`6rz?7^}rt05u6kc^fWeBh^)RbF``I z+Q7R7jqFY>s)R+$Q7^E=q4JxE&po~UowOPB&M*S>d9Glt)OiDl_`+$X+Bv^_h;HwU)Fm*fx)N77dL=bS31V@a=7PVJlC z;`atQ{7Upuj{32@51rDJ54`FSK8l@WD`@Q*=dDS|a*+sp3D4K>izR_*tx!K)w&`@t zpj2_XQ(<)aQ&TU8CrP6{{BsSejB=&P>y~Z$)s4vaoO4q#r#z-!d-iOfdNd9$Qar(T zahZs)+i836S9$gjRIW|nVdqj=S%9gxmAzegBijAeJLur&fa9FxjRLj32HNT1k@ z&{40*Ugg0O<0|w`(9(QqPr%cDYb>wZxI&%RKuJF6e0OBJX6Az(K}EqeEMhTpcGZ?H z8nR~5*e*m|=x^UPrNrUT5O}{noh=N6rWtBl|W?*MIkV#h1WBNXnVC zMZC5dVsW~CXlH8#;FzPnc60ra$kmr-&iSSIMusqNdqee9Bu)=)4La)JdU6N$Qv!k_ zL%QSHLA{CaI!Ol=sUz z?zg}Lv!@Cy%wq4^&~@^6(_coVIwe7Ij!F4zp`(gsC7oj6)^Zvs(hU*`#WBGidRziM zNMs;B(aP%m4Uhm%I1}Q3F?G~#`8_GIdU@WtLeerxV^|TQTi)$)Dk&(=zUT$LzkLVi zAZHQkH?L~8Ac(^iyjSsf$0X=Sgj*dpV1$2eQbQQYhPc*M4my=J zy}BvW;z7%fomLK)KB0RIGZdlJaRVnTUH;oM%blBxuS<}m!Pg{L{J*rGGz$F9OA&uIapLOfcNM>7Ym0JaTLj0_`*Lz;SUiO;F_O z3a}ey=W%0u0<$-xUoY+(Bin4t_3I)Cq$|xw_Z!641(?!5Pf#MSEUBIe`2hC*&Q6-W zd7i(z4B*BKVqMugQ>_0F71uuh?2K5o)1ta<9Kndgw>n^CCcl!VGVbQO!=P4|VOd`-4b$)2RBn2%LGwAm=)=+H{`T z?Xt~5^CFd1v!;O(oPf)hrIobZQ0LhMuQDeCs#f+V1U12C=lA-{(6JGE9an`JVtq7>AMMTPbdZ`F_Jh5}3 z&uW{m_v&a=0wnv|luu);*(u9zFvgVd&vA+PurWfQ{;BkPpztl`RbTK||H10yc@baJ zrLWe_eRe*;1beg=N7iS`pPi^u+magcUJE#d+7=`n!k2Td>tuMfdnrK9qy#)in2N5X z_moc*^dsl4U(8F!n6jomYpe7#@{QTqH^Jx^E(dYBl)YfO2wDy$ln*ZOklde?%*B6A zRQBJ?2Yj#lsG`VhO3`k%l&}QCkZ1wddo^*#S4%}NF4(8uH<=2loh999=vFT8%0>!c zDl KGoBTJTS#M3z?>}jyQP3dbdUEFd$oEtK9+c=se2olWN!ov(~bLYuj}S@@s*+^Uq*MUXK=*}-* zbO>qhG9wZ^WC<@Qaf^6MPY82!A)8=em0*5h2dm%f`w-;j7n99)t>haNA1dabo5fcj zLl5)M;r%WDY7qwb9g}um5RN(7bkb@41YxtS{r#d%JJsFiah@h9Mrpk@s^7$`vKFlS zn|go!Y)ml%$gFhrA41n0llrSfF~(Q+4<&0gN|b({6(k4H&G&3#Mxv3O3py#%+U;*e z*QrsF$mN5t^yDNsXwsY`O8>Id<-c6|F+lqOZDTg;h66RBpjUh6W5LDcGc`S%J4;jhK=Uz9$`oOHo_y~U|o%5Vb+OtB?#fe7ikG-Rdfup*S;n6xaqbc6MecwIZu(9tb^ zQV(NuDLb5hmiY*=NWK70ANB40sB=c5ui;oyOQ<-V!}qnjBNjmn-ZsePU)uqIcV&X- z2u|A;>61x-MvW4Dv;9D?V(x}{Ajma{-Rm6V$5=Fj)U975jDChVc=em&s{)uBC|VTW zt+O_T7-LB+?em1vzQfOa7eTtbq<`9@z&q2}tl__);~7Ukl#3tkk?LA@km`bbuM1#; zSX@smmRP3lQP<*NWxuE{TWFCK34Y5jM?&JxAoHC;+WTk^ON?`98Ej4@yfoYHB(1g9 z@dsb6T@v-0cp-?VPhaJo!^;F-8g(qy5Vz-X2h}6^vGH#~F?@P1HrprilPn^7t`A}k z`o;sL=KeD7FDgp#?o36ZTJwqJ6pUON>||CL{Ro7QN`?tbBp~9oA;EWrTX(oPj=e)m_YrWS;J5b_eziBt;L`d79H2xONBveoKPGB94{kdA&ty*Kb&U zK)QS-+lWn}W~(g|9i7P1BXx^cN#+oG{>c8{-+cSc*IyJLl&j zPnt``?cCP6iO_%^QeHdb)uSd=3HH?tH5t8c3O8!6(|1Pbmp`m;C%sa#8l-1Ja#b@A zek;4Y$U$4DKo~1Rh?u(c_-(JP>Cpq==2#x$T<0H9TW5Lqo(?d-PEXH>0+>m#Fs6=b6yAEC6!i#F4$h}2YaiyA1rZS zc(AttG#ouOK9oA#4rzI)9Wiw_G1?8iwKO{{g`MAl?@GA##FF||aa6P#&$%wS6O8h! zy)heK%#fs?lw0x~cFEW*dj&$5MT$Ecpg|I#l9g1GeEm2)m%@lk9KL*W49;~aLv=It zrRcf<1xcQfGK}7FhE~G&g}U*5wC#&F3GPGL&B+y97}vM=U3{YJ<;|)U4i|RftR=V2 ze_$>DKw9y)=s9UWKv4SCKE1vWo_AmR7gVOU6-MesXYI=Nwd0P-qh2WCww#opU`8er z)O9hja>%+&?R8W^{##tB$xe)sx>p9XbH_b`xsi_|Uai{vjhb!7Y;hXEY*N<@;Xw_cVmpaNtsTL( zU$2-{^*Uf1@WWtV3Qu3%j6_`J4&!sBBcRmAFKmGL>tO`hXw;QUVe=KWCX-ynlI2-hr+y)kVkmPb%ZfzWb3;3{-squ@eFMh+(kZXsHf09S!I(l4no4n#9?i zWNtFH?R0m6=h42}{ zL}&lKiAdV~LwBmxR{xG4VR5O=?bb3NUk-TC<5prX8`zrN9>CWU9h?sA*#0r=nu(Bk zRR0u>&zsvyq;GXrw@dBxzgi3xW_BK&m8yb@Y!_EAlBz!!LAJ-}$zG_DSnM{B*WfgO zCpE6PIuU4BNGpTIfm;gpWe^|&*s@Hb&J(BKZ!v)AhnA5j+YID2#gv--L&mJaHT$Hv zUGjh*$mI{J_upX%qsGd_jsc)D1pg!|HnRCa-Cf!Ew`M?T#T%K^sWQuU@=&25 zA5%{M@T0cjJ~vbLeocXFK&IQ3=wLO3CC;5nPI^7dk|z`FfIOKTzC97GyLw>qx&t<(eglK1n_lt_%Dj*aJ|P$IEF0|LvpppmIjN59~B?sG*T~* z>zZwoNm-|C&fV%t`8x}Mlj0KxD7SOp&9IK|I&X+5Fzcwb{k8P5zzL=I%MjGIix=Rs zsz8tUbtYwxI6xYx2~MbDw>bY9Oa6E_+Pr7fPUE;w3#w`|;>OUG#pW4@eUoO}6S2d` zvFp6AhU0xTooyy9==9TuTTGL2*$~%0$qY{c#X;F5$=nG^gYjT(ZR`Lz_ zrW3lBu_q539c%95>#PbeWhnQ?6V{P7vrQZM{u_3r;Z8I@xr#u+S90&Sg^oXqdb(u- z&mO24H#W!8aQOsO9Tjm#uB+~_%hxlIZdk0ZdF_sNAgcX?$2)*Q?KB2ut_jz9RT`lf z8x1wcP5x;JliuJMjQBpD8l}Fs0X!Gz;jVE}%Ozf~d9M_dhoavktsE=A+i(TMIk3UM5`$sejdTz2pgw3Sr5z&5_fae@tQIA@v=?tUpwWG1X6?ZTIxHePTORoOGD`Uf~CnSIpFMF3d2H2bfccZ@osH`dDA>2V7l zt+jodcv2*kx!a5A(T~^c9sMSlFjY1}%N_UJyizvM@(J&god2b0MR8=6;>owd)t_7jEd-u($$|muKJ!SlboWV^1$`S
$YYr zKR^Xj^=rIe_)W%**e|DefL}N+&SUP(_=W9F8K#f_NE_w2nd?1&A6UisfJdy!Fkr8U zpwvm&BS6zJT!we-zu%Jxop~4eEN*GC5@b13Nv_qenJEzY3kR{w42UzfW;(VI6CYPW z+fBdKaGa1HHxR2Zlpm$8(Ac&b%K~Jh!Z0U60kXxIcOk($tu}`7k5^ z$*b_o$zT7o<^5OOHmt!&|JQxz4z8!s7DXk86r1l}3A9cfSN2jJ9!if};IXpP6*!*u zV4YF*LIFI>t%pzH&=EL|Os!T~#s;Z5X3rr5##W(P8!sbRYCFzvE;(el6X_X64kk{3 zT-ay(CfiRk7MzQ#uxi^Zz23;l#5^pIQQv^u@RJ_3VXzCKK}%|6v&Y%dzRLWIF2jZh zpPc$8;v#|?Y#n}AXiiv0(r>U-5pN6=QQcs$5R&q2V~HKS2HNNPRCUku94xOb%g*$c z7|B%dX?Y@rEX55&NEJN9Qv3n%pio-V@g zI0x1OD^T&H+huUGw{r8h^ix(lna zLV}PgpRUfMODLzv$F>jB7Buvdkm9DA&W+P8A2cPBJF_NyG0YMp7arWm0J%pqT6{jZ zyKov-bzweQ7h^nMAu$rkZ7w)RPCk>C|8XeJq`*?uCfeM?So=@kROV>Lhi`h(w(nK= zAn=%s1zmFJS>g<<##ORmdC~V4^JYODDX$v&&_7Ui|K|kw_Ozxy8)E92Jss+B+H=yM z#Tpc6ij?pC9{A+RHu1jR$FG}j28*pK8-`}6o0~x0P1t5XFkF(Q)3D+$)|p{8A_tu< z=^-pNa4k+8p3Uo3f8d~V8EV_%{t>w`+E0Vu zO~ib1wswKOw}Cm^R|orU@T_S4z~S3jwW_ZHB;xJ<;$m5uK^+a@@u>Xk|o zPpPPBLUooQmlvd>kUK&hy+0KHZ~5nnGp}*{^EdYo#UlZ|oai?XQC}9)32u!#{`9G&(?=AC?v{bCgIgS`RDs z&4cPX7tyrtoaqpezMk9s9xDe{9}EWDw)ep|G8mz%m=pW)s*I-o2v%|%Q~L!z;*RQ74-kn1RgX5J~>}`_M<;>&H+NZL!FXD zT8CgRkm*PvD% z^ODmCoUpQtb98Gy0s@U3?h8itFxE**c=z6i;z!eW;WrkhNVF)%(aVuV%8@tvo~gg! z#CgYIpe}FJpJyeiNM9nLIdvZ#@5^3bW~iq2U$2F8T1Wr*{C7CBT0Y>c6cnay5&KUh zUi<9dt7?!t;!v1ug6(?ZtasA=D48XU(rJ+W2NJ0Ncp@ft4@q^ke!UvKEGwdxQ zoUF@75_S7-$LA#(7_&~BU36^5Uih7EOdteXq2PS%R!E3Wd-7Zh;?!){cjUT|t#CN!_C zNBN#!P>Qi`+$Zsw=x{>)%lDFCZp>`Y&l;^3)P;Fs_4vBaM%T+ZNcVf+QW=HpO}+?o zOcJ^MW!KM~n&{pVr=;c0>_B-bbHZ3~Rs2WE!(ww8;iSP}#uJ9<#C*L$NRaGKXL zTfX9RlOa6mHo_O9)2!sWXgw@D;Bj7O?jGQ>g0fszp{bt2d0Dm>Q-ud#op_CT>ux`Z zxvzRuN^81B*8*4xewU_~6*d_q0<1nx~f^#y=0_=(K z5BB8gPqHVgoa^)UuIjdOyr(SAk#zY+YL9qix+x)^9M!F=5b_Ad>gyn23B&3JT^eiq z-Krmr_GNbz4K+_(fn%8J!>2lzRPgIHM~x)$GxWXrq$uHQFH{pNZiv1_(dV}hJ|i$AkUC$vU? zk^rm`br%jU%|o41-hq1tA*A^;XNEa!J*w!W>`d2?+7&BNpeq9`!4JnuLS;KN{dByQ z5Pm*)8j!>jevYtl!_mP4R1b%$E{@FWVHlC2-g^~XobR?WTjb!l4?nI_ zh~Iy|N@;!c|#C_U4PblX5v|Eo#&8z79 z#^_1E*U_)~^h%{u5DRf=)!D#jxR3Le>PLpq^p3HV$#LYYp;s6f`;QjMTPRAIWyTgj zD#%vmV1#q^;`1AW-TAu6@W0GY+Vj7m1*eyyz%+zbe8ch2t3|<^Bj6Cxi}|Ngcdqk$ zH2>n*14R6XI*Oz^@G+vu&ZWRT;us|C{lqinAUo+oxgXXgpH}CbOfy48@uS9?N&8=J zxg997r1YaB+>44X(>K;+DGW z5mGW^D#g5a=@;1WTSJyj+}+JTF%&(+vxiu}2O!_O_W#Gl{;$t^iafg-rMiw=yo`@> z7){|kdSWD`ZA>^Nt$(D6`tdiKEaYHZVd&9W>%}I9Cwp0L$f#I(XI&q~2lYXs-MN zP+hI+09huENjdwb1tYBjch0v#yjtf?@x*y*z|Y@Lsepda@$L+T-OD+{qa&C=5z2k6 zlh*TU;sVB)uh~W@T}}Oj99lm)Z3M%AMc3FYB_ZwLLW1DXNCp(Dw!eGCl?#?l|F~fK z?WoF-!`$%h5TvV)RSc%^Ow$0VW*V1+p_#*1OiZ06yRc%;{o?QJi7AK65zU=89^jIw|s4 ze9o?hN1PBv`)XSeY5DJ7n-%z`5+OZ#2mPDqt!Kf);@v-*Pt2r|O9MBpUM1)r{2>HJ zxD-9HHsqk#F9_ps|I5$+Z($DL+!W^X`_g~iyb~>J7MR?lPLjS$RJ*ohm3@$uFdbvy zF>AvdXS~xoPc%+I7A-mfMUovJnB)xTS{}$l8&N4j75(l@H;-OE9{g;kU)M@G$TlB5 zogAM%cVtQth0NcAVg>XrrDJX>u^z^(lZ}IzDDiBTrE+KMqT7Gi`cG8@L#3^9Vx$lt z3AO(u3BRZ)Gv#nCccW{iz_>N>vq}L_>+THxKKlf}W6c&6Og$sEztwtPLiCVVny@T( zlw5yUAp5RM#D#;~wT#3B1$dFV)-a^~_sl5RLqpv`=<-=RqVz`T>@q zgYPdx2gRLb=-}{be7zuUXMGfyZ1QJ+wvYqrwj^0zK#+lxefSGgGc5wvp&35KJ80CT z&L?+Pjd%D;NOvPVD(ZGyViS>+42UjESa1_mJh z@(&=MOvMI3b4Azej934vYL|`nFaGQI<9~rg6*Owq4?Gf>7`o#j_!KO_r)hX@A@(ymgaISYu2tNgIz@aIg4L9B`adp`eHrS{Dcgy zxwq^c1~PO%JjPy``K+GcdeKA#rxp0U_ZvH-By3x2e61MFcT3q=#L@U1BuwjOJx{FQ zHlCOy0O?mj*Pjn-?_CLzohR7b! z*N`%6Ul24Q2TAh-6wesE-`10~`w6Ui5ItF)VaQJ8n4&J>B5AJ~erC5_7ONEGX5>9M z0XNnOc^`?nn!Rv;kq2ncmT2b>%D_P75sl|dA)Hx9vhLq&{@#2` zSai$U$bfjR)&K0F4=`hG)(5+seZG3G-hl7P4ZUFp{r*r#cq!$}7vcLowKa3~P2K02 zpR8*lF{07hE~yhql1Gm({@qd9{>+sA>)yA&vtGUUi2E6=SI>OOk$=2G2}Hu zc{0f#>?6~%-(Ap3yAN`Ej9p}K-weT=df}9H^=TemU3h4paEB&5>k=z;!mwEww3q$8 zk7iOZt(dBA-^MMW6rZ|ZP5zV<9?u8Lw~TtfpP39=e%s68yY(cb?T^}F=F17$;ISf= z*_MptXL%>;V4SE~W`Z*=FohbE=f8cQCrv(0b|i<5IP{izd7 zn}!Ex+fQxPFiSB9+=2+3?Dbd-(mXR>5wMVb;Zc}booMuSViphxe)RD$Az^g3zL~xI22ecZxIL7u@uvw z_rVrhJ&)o-`y?9~-{U{SoIie=cq)8#dC&|+yE3PNn8`Y^zu+ak^Fhj<=4G26I%7+GTr7$m$JV*`Lc zA)Z*BgdAL`9p*$%rTm!QrSq_6>mPUOl|+^qRf09eE`aDRvus8+VntzJ6Y z>zASYb8g?S{RC0*ha%T5aEk5Dgx0Y<27&?=a&Q7B?HiSo=Srmt`N=&Tt5f0R1>rJ+ zx(=j!gk3xVK2DTdP~p6!o|(&u|2+^nK)k+5kucG27#V_UZ)B6?{!BFSX+(ZW_OyFs z-pCZC>#{d8EFJaEc89s2SWqdIRmKbt4n=ZD531*oKfyD_W3H~ijFoUE2%I{j5@vh{ z?j05xj7jDD1rq%_Lr4Rl+tDu2iL;Z)MBB8P=o?{+Wb;69>%1Np_~*0HFT1Aq!LR{! z7rmz9?dhi-lDbx|rc}G1<6O?-2z;c|0pl|!OYm;?v|h0|evH3IG~pd^)j#k{i0=g%BCnjSTO7wWaCZ7f;u_074-63Cm881rxl+1R|J@92n79?Uh7}|BTzsjhf9t0 z#z$F(9aO$c@E(!8Kjgir?8S#qyN4=0^tM)ewZOXC5eLv6{)H$+CbQ&F8DJ>jjIWP# zrIU5F{ET>Yt%C#~hiCMDUeQK}F4|y_JTVy-`(cmH(_dWalq)qg^Qji1#O2*(gse;O z!)$DgU4kWZBw_g_=OcMdU*A$juD)?) ztG)Q~e`jI-?~D!Xj3$GF_I3U%Cwayz8eMwer9AuKqYcIG!lt+^b=_l)4xH>5&8%Ft zD>}yMkc~6AZyT^6>+*?{@PJ1?F3<&Gjp(bhB{dH6&A5B=3YgmltZ1`dL4{3 zp#5opX;aJHD5mZC9IL&3qz@+!){D9x6P9XIiKmlmo_vCvHp&RGdA;i+7u8zC%!;Vm z>z!v^iN6VkJ_*K*YCdqmzPG_W?-rJXd;Caa6aG=pzTLZi>Wuki$2XF?Cb)80T{`PJ z%s`@M_V-<^l-=UC_Q`(BfX z`~19bT*{21!2Cu=`KDMrIZ3*&=Z?hA1_l&YllpLE!sLSB+hmX`m$}R=dv!-sFzZvv z%<;=myPJIxtN4673dU7CM+B~!F{XdQL63_wTMNDqPIATUFEMmcg9l2KhbY5BD=u|t z3Z(o$+mN%>_6wnBaSyUYc88q?BdPDgPu=bCy$2m?R?}zV#TRX^-TDwffHi$P!ykL5 z#^P(6WQCqg!Ll9RBb!+gOsl3XI&{Ty=?_sqaPQO6?SG0iWEec9loiPBml)RZ@JG>9 z{|rm4Ng4}njh09boYycoKvRRgxnN&NTh^&^j(2^Jk^MpTM3d4b^4bj3z=O9uwl$Yp zWSDkf^&SR^ZizW%(YtKWK9!9TK={K95-~>YKT>-tj?Vwvy<`_4D!=Xh?18EjrzQ$@HbCBYvCbpk)_xR>)wJPau zh`pOlW4f~tz2MK3H=J3o<>3DTm&|+r1(&2AdKZZi%ElNj^7QKw-wK$x+!OdSQ z++>AqA3<+py$sC?x?7U2D-0`&wEW};69=VguH>Qjy7FTq-jh|73zN#Uf=^9RQdN<` z{0ngJ>hJ2%Zwf`6%k#*`ywA=m;RQMG_G%d6B2T?Khbb&#_GXN+Hq(=)!VHX+S3vg5wbR5raFbA&a8H=ebJFoR(h?F-zIcQni@4FTSz z{4Ub>QZ}yoie$;+@jt>yp=aS94fHK=CAz4b`By~|e{)iRXwJO#(0VdlN@7o%l)_Ni zm~^QW9|v{1Op&7{<~mLU%;S2Ol2(TvI=AOTZR{ft632%@2I9d$=P&zVqlL-8))3{M z>#_r)ptCXkbCD-hsLgz(Roq0|!2n{GMN8p|Nl4yh&U5T&{JTESR+#hs$ENM`u*MCT zpk4XIhY!|Wu6_4Xv_(tQWnEfy1X6q&ui##=#@0P;D)5;sOrO7L&gx^_vKB+;%1Cnb zd)d#x3ZLicHQFvn^HWBRmH={jQQHdg6Zhxz1=jm_bx$hi6W*0Tu?lm2jT2`qzO?r| zLfo!@WgGprcPe~qdb=}_D7c~68xlVl%5BS2T5cnKM5X71dM52VS;tsI=YNDA>i!ja zxM0*Ql$W6<#0SnV*B3r~J6br-Dyj{{qSd~Idt_{|8jtzcEzd>Ft0o=@AW)~DeRg3( z>|uBM8B8cs@igz8MQU4r1Xh+eNO;PruB7#nE!*`#p&SkroN|IFcs;TinUdsLq%nTTUcBdo_^o7~fCRW7Z1c*2!@N0!AmyXvGG;cz`3AeQ$wq2YKyqbNh zA42p!9V4lG&k|a8&c27NJxtlkE+EZEBoyEL0TIiqua zk9rxQl?UwXBSQsG70CBi7EHX~Ip`xU=n3E_23MXPnMpBSgAr_45uN2NV~P1MMvvP} zoc$WYKey4V^)n+k<}mM&_oP~_TP-n+)Ccgbu>SfvM?rV~>u2LEqIaFh2i?C}xdn>^ z*BQ|GLCsAXig9N;s|h*UWnjI{$|N6@bJCKX_1pMGD+BIXqTCg#Wijfq~?`e{$BzhOix=XukB#9RZT&T=XJ_dLVV*#B#u zVadPIME)pxTLYeQLy91skncx2;XWm1=Cy(hm#k!p_q80uvoau&vlt|DW*5Ev?#|8# z*WtMAs#ibSl z%O_i+Mh-66X51_lT+E#?7Pn9LQ^(V~ywG>>)%>$X$EC zcH8cCr5xiJg(G$~u z5Uo%VYVaNUl(+hfGT9lcAk}^HcW`uU!H<6C=zM=;y^*m#8Bf~2JH)iUtFN{AMT39H zL#$T3Ox`oTyD6AsN3!P^$LOiB)-lsYYuSMd+R;{|cHgi8o zBA4sUDf8aEAyO9Rw#`whirfBWgV#bYBvK!PVbnAYZjW*QZ{tJYEVpn;uaQSeBTFw` z{Pt!o`8J-uKAUmx=8zF7z}CYIMi72Karf+5?B?Cd0Mp)|6#xKx>y*2_*=>8a`ahg3 zb}OY%#8~pLolSAls}drtTjUB^3kqK=X#E4C+q_-ZqODBV_7r@f-uuTynI*;CPN(%~ zD>_ar*J2;;8{_-aDELF^oN>124thlP3_;o z%viFq&UJMrmezO8hbP3GIcn+jSZYSl$x;tmI6c&-WY@22o3h_YgtXq1&1Hli(QWQD z#N-UU?A3_CjG6Wna_QH*KDuj7>=u*4XsQWa&9XghPetqCk1vX7c@MfoKgI}&r?Rq) zTeJZ0a<7{vX+KvZx(*X5IJE8&?2xXEX>7@$F9*4r_3T z-)&yI6%kP-0k<0bx)m>(J0%{A?&{xq_&fssQCh`A3Gqp@n=9MbBXojk-OpB7B72WL z9S1TyvnRQn`c%}<_^=1NBxKgD(dXYQzvGC#s+AitpF5HKBPYITla&&GP~i^eB}CMu zdk%n}U7+gEEqeEuD&04`Qz~Ur(8QnFqPf3u%h2Ase|Zldffd1)ll*83oaDs6K`LM` zdoB z7#CFv({u7t$ ztY@s|z2WDCE$M~d!##`=$3RnVrs001JBvp2z#hcKKM_3mXNV>)oE4(E;l;s5|BQ8Hq&kXJC478>(KeI(wNMOkqFZcy-`6KE>jL=+^e} z#qeZI1&^?+KuR6<1=GDcNI}@>=C7O?I)WU5w(D};X3}>@zg~gb38`8_K6Vw1^-`Wj zfwX*~ixm@Vui)(AcToUe!Z}^k?!-OaW&dL96sJ&l%tavMghyCKMLm}LoD8_WAzOAk zkMsq7HKD)qP`?C50{3m>#6^d`{MxBm)%F3(E7R3$)-LZ^;&X{M&h>_sUu1UughXf8 zZ*x1G>o#{?H33YgLR4${gz6-C1>>yZU1DxHbj)9;`*k1xKnYBr1R;SQ1R?aPYHJd^ zx;gV0twltp&JSbZKoy31WFX?S2|k9E>Gwgva%N=P)7;N6w*3vS2|X>{I>OQTQfWA< zGfH%CcEAUl5)%vDgPvmB>8lwS#q7TrYU>ASZvkrar+hoHPSl1KN^GfssrpNr1mbq6 zZzk?a=qw!gm5uf4`eJ@^I0mL(5pu`Zi27>$H#^;GF?R7YIGSE;(NtCwnGa*kb8~ax zNi=dy$gY>M8Ra4R?SquV%OIST{V%3l)${xKNUiDFqBP+jX))!Pp?Vb3T^kDnr#5l7@urEeDGA`l|3*0mgrY2* z^^^?#fsSx+vfFw!?|Ph|h)O3YLipyywm-?1s#P9KW%$h^S_6C=cXM&uNJ=AYwM z_TYo{U^sG+M)|U>m{2IGLZd>!Ye39&arW31!_@f?Lq3Pgpt|LkYu_^lyD4SY za-&M+KlBwPVu%~!tjFgu`$EBQcnyW=bLH)QMj=*G9z(~*w}Oa;?&rIw6uhDz&))*m zYLftaMbiNax8V)C&7R1g#a6) zWZoz}^XPiUXEKaa0?Zbo3a`|jA_{Im=Fx26l%`?`H5qSBJ zZ)T-akD=T%3Jv|Y`v8-Ud;EKYo$a^wPE4TJCk8cV*cI z%q6o~g0#M-}Ke-~p3!g+53H~lbJgTTU+u&0bJP$0_A|$rHp%p!&q0;BVMZQssg64DF)A=* zf}p3j1=MmZBcXaW(QnA_EE@?VzD}|dUqd>3h`M<5NcmH==lkt9N}E2|J@Z5}LU5%| zY$k4gMc)v&42zR?*;uI!vPwh_T>-!J#qfkB4HGM3DM1*dziKu^cD!Th^aiewRnJEW z8?{bJ{kE;;9kL{kd_*oQH+~p|@Co=jCA__0bVgTc{GIMj!snKBtrv#*1F&_8)Cx3< zGh9jimHaJF1_k)0AeNJ>ce&@wo;vdG6pt5MT1`K=e4tNw-L#W(}YsRubDQl%#$8)3b9}dA|;;q4zRYmK`!0YdzG-R{xHnV(O4x?d&-w z*(c`zG3jRBN}_YmP5Z-mM#e6gI~ULJtw{u!UfP8i4;nq+5CP>nRpTktoS*3163mG| zTROvr%NGna!r+%=q#H8uf@W^7ua38kfp}hSqtAR3X1??1L4IH%g&~~3A~oXCPmrX9 zxm3xgO?L3wRgU*|hCuQhsuR1uiqyv@rmZv6_C2Q@`8JmRjoyitpjG*P7#Mk3m- zR(cmjLj32>+?Y=lsqFk!hVg6z?M5*;HpPilSD1#yT{jP=_jb~#%T^$CY}WqEb2bM) z>VaL~&{$yHmPBsvW|@yukWZ<-w!08r!2KNW0D`5%&5L1guX^VL%WFlr40CtfGV;ag z9HD5*1t@(a`t~BIERNldjS_H?k{OrL3g9-YQa0l8`q;v=2D^|8+-3-X1jphQOuoIk z%3n93zmfVj85`#>#0+}43o+=lkNz`w>D}L)x##-bI_}LHuPc8I9>2kVL)ba{1^K@I z_nl00HQKgYF=Ht8-f`bRkDlPETPdW0`lZWhFKD<}aR=*VE1h)X$qSuMkHxGyT+mn0Gd#Pt9p~oSJN4LOh6wzNs=-_KiQ3zxX z>k5JwJHnxyPzDl@-hJ0IawwfycRc^@FqVGGZ!pfO=JkS8Uz^G{bFdg)xY2JWLbWg8 zlLiqd2h5dnpRn=4|rnCkB#+y!~_ByR{&_4qHPKu?BqL67#EGD@byUZ&`+!j4b)Rk*U6`Xo!2lT4Fn8)T z0hV~@nvN#i;mpD`SoJrQZA)rl1yJNZ3xt*ef;V^Xkb6Ew2Ge44qp_%^Qhe>D7w&pl zEEoBG5tsv@5D)XGM*=zky=t3(w;YfhgvtbLg8-no#8DtIkQD9ux8Wro-4r zGi%~Es}$ur#pij+aVSUk_%JK4u;5)dZa)$CnmYtaIe-*ackp;DdX$$1wJQPCSdwc) z1pnIXGcli!kd4K+u3NzknuSUiM#h6ji0x!V6k=*xJRoaxay^YQK#j2vAu5R0(NoHA z*K>G4gy+jvO29GkteQQXcxjGW-Z2(3)LygXt|u#KU@HzG-An}3yhtkI-D6G~%&*tb z0gW8+rQ>;gmSRv_>5NAG5c`1SCDX z;{(25UZTs`2=F-`iMnM#pJMuS($izwpOLsULfzA&w@MikYg+t_UIVfTL1_45(@}>A zasPWC+`*RRl9A=g25QN7xm`;y9`Y9hOiMSE2RU?m&eq=#-5_*JJ`6ek0q?%FP%q2z z)MaZcFfOXIrKXBu_~*TQz# z(;wYUqwI2aFTrW=YiD zCb1A3*V_TNKcm$)YnV#_IV524nfj8K{4mtF4`x1cEfzNrcrXfi@plVh=$!|ED#S-J zamV8wsCXhkRITpi=wXP3kci_Zw{PK?drh`z(=pIHP0>f+sofplY_GugZc1;h{W$z#t!RDUla#o$=7{D1Apc7pW-5FPUP>93EXe`skl$Vg^~(GFY@G-?tVWr zGGl@+e!uY3L$WhO%e6mMWB@&4=wEZLk}JxZr~DXd>&OU-#R%1NPWF3_P9W`~>fG+M z^C;_cXKrmGYea=8ZY)g%QQ~<1JXxz--l0@ zm&7UbhaX2gYm(cN=YF>SIdWzrsbtz^#oD7bnlUZz!&m@UZ=0E|9}F%v?p`A8O%K_~ z<{vipe84Da?}fgTY}P#v zhM>94UDg_uHBF5$4mm+GIDz5%xqjQ2NvM;*0Xl&s-DNL9F(9%VdHOs<+`CQ~KGId^e>rT@#{|_Kj z?~x5%Xq6lRDK4>v$F4@VR0X1C9m+cebbyd;gtYbJN zK&%Z{;CzrKIA$8%0Whu03`4gZ6a!aoTRY?ZmQaeLoe!E<>pOC~9Nd3=w`BTs?WSoR zqfd*J?Gb%wzq_&vAJkDx9U6hN+6o+X=e`8nGqc=To)?#S;`OIHB(Nq)O4v-fh2n*h zB5xO4uR8xg2gpXwEf-{3rdeOKA`muLn}2fpDNL2dhx$e*5W~LWg%}<$fm2gTKwv&( z<@5D_XARKb7K9C<-#ZyxWMZmc^ITU9oRY=W zs;jw#+q*%IP13}*Wml8{__|??ad2~EtVepZ;!l$?c1W9l$4fR;Tg^BYVzUy(*>=_3 zGU#-o1|k8v)*y~|9H;%L*edVT#JM)S#_2fjjvogZ8nr0afIADH7=2W^<*xdApn-o0 zUvjScTe8?zDD{1_KM2HYv?Qw)aHgAB$KY0k?h_ zEFU3hH2J~Hha}p`$b3l0Ugs#}iCwklD(`V1UaS-H>fqwcm59Xd-Bg1_4ZMWG$4`f4 zEPhiT7_jDvR5hBF%C6RB&zaPACN!DYThvO#y-Baujyc56jO_|g9>@w6R@|Bm_1x6){`xd37t9lGR)2|n~!|*q-Zra_j-Zc z{Z##$HGdok!;q1nu&^-(czm~)3=PVt{CM%b(Mp}Q4_Aba)U7n86NLbp+`6x=2zh2z zZ+E;+@H<=N&}>)v;%E(5*0+uTlg)}zZ#U}?_ruh;dLp(CZ7TcNl`_`Hp?xF(sdliZ z8Q&W=KUVL^su)L(FlPw7o{Y{2jT!MhoHR>P&4EyOltkybrj(GSJA04$rZVPG%xuc? zxP7bLc<`e12*7(Yj!iyXfnTYDKUX@F8AV~1_TH&}9fk)i34`uD*IaL>>HD>Q{df^OKmLF&t`MQ(1d>c0e1nZ_iSO7yCp_odo?cm73PV zKgEMrezgu>$V3c-;{frCe(>uq&iQox+DUCy*4C;~Qj#WWi%W9&WQ>}Kx*l>L@5-*^ z1I)4kyOOkq@EV;vjFP+IbO4Ql4uM?=!dPe8U{Llk;`d9qA3e$5ExC#gUw1JBT{##l z>cxt7^caQy5A5s;8nD_JKR9b{BRn+6_+vWez+SNl<~WBoeg1_Of5|x0-=7>f-^or! zvo|+J3sDVYh`D2`i}{xj?Byv^~+lE2`l7tSw2QM;xvYHkM5l#*6PC`HCJK1k5)>aDRJvJU#tp#ZV04o3$r=>xFBe ztqqKBv9Rb8m*_1;UbcqR%mH;%|ES?=cQ8+Zx4r=-caf}yu#JE`i7*_dhIZG=>kteK zx2<#zeGoHkzs9QSeVZ4;?BF}~6en?!+k@X-EN#7RnXfDA6SufVEl<=$CtZNLbU#+S zGj$4mrpit}XiRiifRQQD8Kb0hr|CKIJw|RkH7~o*mrg7%@o86X73aRWkd2(pi{9$QBl`7gR=9=jB}@zs%~xm**t%-Nk<#5 zpUR(Ax>sOnu03&}_iA^>UlI4gSt=rC$QxQwQb zs^bUNXF8B~!6okAn{DrlO4=;*dOqH+!OOe+Ys^G;-|k?>g9cE_GVBB^f3}<(vF%y* zMZsvGWUg~jB^{cHrgzs#5W^>xLiE#%HNR--v7>2s8GzJ47ILRv4Lkfr^B{r|bU)*9 zU_kJ@`1i(S+>`~_n7nz2vAkbk{@Q^Z`oPD)C1xHCd8FdzIg@I0uLA-q5Q~6hOXUln z_6p2rS2nNGxFovvHtEEOEW~p-_+HSjdp23|b9b<=0{8dIJ<&hCoJ$Gy=5>Wp5 z6bCGo2vRpWGVqDKX>d_5YTw1}oJY-mN$=a6Zu zO^;URMt&s1e~gE8I;=$PHq_Y6IEMJ{)$CC|>fJi@jJ`~93#bnH8ck22AC0vMnvGj( zsu*=omxl@5_1_CMTc8 zIZ~FQxUVUG7Uc>F(@-jNx&0m|qxkTg$?X(zug>G#qWgb*s$6*EO)%6?4Ve3k6loF- zXH=rEieyH?xqBq1-pACNuI;@$I@dM)m;qV#NY-~h%T}&`hFSW$EBL#S9&rF?_xw0hQ&g*o^Bu%>;}V0@x0i|sbZyE z`k^BX^uBe@LWK>H>aqz6XYBgk{YU4shwPD!asG=j@UjXPGr+l*RT?dP>8qK=oy{|b zw^Pxxb?54<-gA-buhQd29qAL2IgA9i!VObtFqk8YlK5OUX3b+3Yy;eg}xeOm}v)0@CP^~Kj=Whp|9 zR`5bvfa&;~b;;68=0X?Qke4=mQz++ttG*xK-$8L zc>7&uS6u*2k#|v6UOzR)qq*64NSBj);K)H~K)&MH9Yi_1H>0?lNpV`QUbb_Y%=qhcoFk~%oY$%BI-7aL=tq^3! zAxF*S+%eFckzd!MVWzx}MnbNKwqUFPkE93xP6 ze1uQ38Bq?tSk7o z(-m_hlgZN}-3lu2E5YRL)}m_jlHB@5af-27U-J6)0C5v$`6cq#8(vtMD;hUb2dsB! zVNM-?aom%mHYwXKnIhLTk&<$uu=!_qDXaX(uR$TL;D21D4;lLME-j`6C^4fFHj1XdSobroXGsXRGxYc2EJBE7@zH7|3v2%&Cjt8R zF$C2%QEl@NXq<*n=rjefsV6z4L0=+vj3H|-t)cz=yZpiV&H;H zgH@r(%_tpl2Pl20gW(KrZyMgWMEX^ed(*LsidX}+E;CD~xZdCkMlA4`Mk%_I&p`TE z2^2pkKs?DgWUoJw)UPl!udR@{U8Xb+f`L99+|-78KxRdkZ~U zw?=S7aOaM4=ey9Jc7E(lY54}+9b2#t0UV}i)&RI@^{K6bhJzsUnDn0c%`A)=ezX25 z(QT_qWPOsw{7_K&nR|V3I)<6AD06ol>#wM2Vo&Lx6benWCQQp=d z0`hu`dFm)-m8$(Xi^sTE5EgL5?2ucnrPF=c{vYAJZ+pbHH5aKJYA&n0gOgpoZ&g43 za+TKk+gXPU-id^(vL5O&*5-mPaa`nU%J2Q)6TAe!b7KSVNRkR+%v3F#5HOz#pg_LP z=Fpt`r(qvE+tnpgG;x*}l+}X`JqySC1EF>BimZYD!1KEpwm{aga85OJkMdd=9>xU6 zX?lf$eaAUaxrsMJWAk}AG4K6g{l{QwE$qeWD3sdT=SY!z6&VX6Uh5Q)x~CNM5dmto1vkqDj2qy~>C(8pD@+1D48;k1w+2T(&mp#buli!A*6qkqxZ{7<7E|MeeV zpZLu%HRjoK(nCmT&Dt2hu*likX{Cg3DT)>?a~2tyQo8PhdmOa^N_!tiP=tg>%CKBy z0ZH520+Kf)V-^CROWYtbbSUX9hg1Pfa%nehun9d(!aTcwilz%t5L{%uht%?qFOWuR zI>$rm;ZW8gh+AS)6=FS0+{vTI-t*d1&PDmxN~E5=?K|5v*f!6t*sBsNTBhfvPyA1> zU$}>&P>9Z5x6PEc-pEV%bUE*0nBDI?a#P+AxDNVUyI77s zcZz(9@BCtW5A^rk5M=W9w0oLzHV!Tskt6v9bnVE7rJuU8bRqJ)}lT- z8?pdwk#@4dXWF70M=Oef&jc^PWk0SwsAYZ?eT?v{5brC@kK{4kQxTjLc)+84Zum3o zY4;%@F=y?0JZJWv`yeLV7jVf{@=7CY?hT+XY_DJWm*;EkkEOQr-WWB z)7K}Uw5?65)4qR_=lW4|qK7BExju8PBQ7rmw8Y{!O+9iN2qptgLE&Bz5Z{L}+_C*3 zT~*n=$zoD6g{!B6gvlktKh48~o3r_3B{~-ic52UufBOv*W~Y6v5U2A3;Zg+HZSjz-d&3!w?0@Jei3bneHN#6H6? z%!FBtfNVzF`bJreieJ8WvowFsEe~UxYkrCwDb+qwrC6zC6Ij}5cCL`C*0_mDB%88Z z2c$KlAH^67}n2Wwz5@-ccu^P_pZjEm^}H2c;6@%fc?ej%M)Gx~K< zdFcMl>OJs@j)B){cyB=oFP3|to<$C z43hgPzgl`vQwurv8>z>)U+41iYkRUhP3;>Qr8m>Hdo`&&nV3F>0)RBqWB;hDT2`1> z5)p--hf= zI0NFf7G7a`5#5I64~!XK9=GBMi{|vzY4>%1=G`*8%ds<8^B-q%d&-y+^Hvl`%A_-; z>|o%Dm@PqImd!#LpQB8p=d1q6#u#iXC@ob6F$ag6^-19>vNiy?rLWi@yaxsWnSEV9 zbb)W_uLfU1wYbtfm_%p%o@R}m3}Bq#$OYx6t1MJr`2^@1ybu@p!|9nHXQ=ZpafL8} z=hI4xzex717jI>aj)9h5VgXb%o7QzPUfvQ_j>}T5sqQ4)6@1%QdAqETjXF|w%hqQ| z-NbM(G70BMIwLKZZdm?%r{L92s-~AR>@?tkW?+t^KKf|Xfg$vC%ncx~o5ZP_I`w0K zP}CG^>I7`jppX4g(J*P?R1kxnr({ll0bU{H&5mvw%y07$$0v!vtLTYUS#$#LFF|R! z-z5Bg{Jk`~p`w1=1C_CJ**OP;w6dRlYQrEuKCaD0_kZ=L8+(#zuKy z!RU%=)!F(6=bK+(-IxULJ#GP5f|a_djs0{iK*S9#o5bLtgc5U+0JK|E0KTPjJbxEJ zbML0v)gIXi^N9JBYlDmYGwuex)L!|FU+&a(d_;a2RJ5j~%b#kAxE`k>>QsNiwR2!_%fiyi)tLc1e)c^Vz#H_;R|e<2%Zds$ zy&NxP{P2dg4(tXOEZ74!`c%q%qd!hJ4=ffHUo+}+g4w#@rv8X~Y0GMtdJZ$Z!MLKi zH}tJ$VZ~0Bb=>jAN-lB%GBWu!A39^C)A8QGsbH5G{tg9>it4(>j^3DqA-l4Z@NEeR z9}1gD`Q0q9xq=c)CV)Bo5At5O!w$P|) zx~Zkxm@zbrawNcmOx}M=*b|UGKF@$C<@yzzlgTF7gEm*Mr+kj_4fzZyzpLzzb&}GO z0Rsz@z)vO=W3Z+6UPWM1R=jrG{R0Vi zWH`~=zPjeb%DetP$1|jBmD%bVwMagbcFe5PLF4HaA1EeR-E>r)c%kRSHYFVI3O>^4 z=q<)5>y|VS689f16%m-Qrj_cHpjy(fIyLV_Jr^u=2+$X9#b$SU<2`qWe*7VhFf z4Re>!QELP_%}tI!4fd4#M$^oR3O#3%&1a4KfPGJ@)3fn3p#08-8uR659L7kMU1Pt) zG^toK!T8>5+xERzwx{b*avv7a1xgQ}5rbbvGlGRcXQXb)`tA;9w}0W#oBUALG>0+rR30zoFYvKo-$`f;pdP`F}b8MvdOKt+y;UW`e$k z3E$GYH;(d5I4pas&n0Tg6XQMS76GBWHAJ>G<`J}20q9keU|S#q0*$l#*zPx_bTT$LwO z+nnWgZav{X7~Tk<;~puBVH#r|Q0flVXpCO;ia{2hKqifV8z>uNo(*1*X}t$`v`7?n zA+T-4`e&zKi>*Olg+Cj``~es;Q~$LgQ^D|Uyq7%&H#uanc$O%E{%*eyT>Ol~A9hrU zp9({2g@f=KcF_o`|6H%)H{~?Z@MZUhH0pK z*&$9pulb`dqBNVL^BCf31hq0xGOie)ii(mM3%_V})``WNqRQ9BISO}2^2oz((;t|O zoLfJ+ACsSg;ZHUL>1#Ox7fh5^kW7AK3Ii$4F&H)!rmYTRC${xEda!Os`#?prc5bV= zU|Ug)-28GTurfZd)n+{IG>(&(y6Id})L)Y$Wq4Mw3B$5|x;c+>28u*97nvhsM|Q@9 zKhc`9T7TrbGz2cV;|GtZN{T+$t$1-^X-;&^$u~Z0k?m%TmeZSC2{*$pnX)a6DF2$8 zd|+$pQS5saT{iZvyt*n!Jiwv;;${es*qqp+3!@4WnL*Pty_I=Cvujl*)5OZ3h?{#FS>3^aXu<;isTAR)i zN01_v)*J#~4fYiWg#jukpFKKCqjO&za9Ct1wo(<77^m;0xqj~U?aCrem z<8kLqjxP@vIA6szybPXX1uKA5I{{vy)c|_jF#XEFpId$U7NdtjqEO7f`pqDDpo|pd zc^;q z_r&#Q!d5^9IwW~jml1LloIIhV&ixx~F9F|7HRB8N8;5wt$cqb=*}TNA zN5Px9S`VE*YrOl}Q7)D43@*$bm}zPqI*ZwBs7$mZYIyzFBMA1;cN}v+3MSlP(BK#V zC(B|_nnH7xu=cIjsyE1zDjqax*Q<*l@9|YhT;qTxmv1Xsb1Ky9@BTx}GjsDlVDuDq z@j7ektFWGMufV&|@Wy9`s?P~#^jE7=56zr7YCr90Z_I0n3CYg*F?>|C_f>6zh9lqN z&|sTgOmt@b?wP@G(M&HltL1A$kCkgL!yu|Ko773!qor8r%eIj_eii+K0Xmm~?vN5iQFAvisjSB|2Mn@0I=K ztW56T?p5^#t%Q~5A|kt*pGkczI!uWrodjkGBBiOAQA$cr3RAYUPVOLNrxA2yuY29-i^;=v z`MZW}S+t&o#o-rZO;7|0{EJ)m_uq3g3if1R7i?8f(cSST3h(h?+%s@v`g!8it0ohh zN4A+@XhG6+;GXV3D~{7JwXId4zHh@-x7GLI#&dL>Bn|dU!MW$K3fMF|aBA%^a0YQ8 zYI^j+#W%r6B&7!2lG?8zU&>y4azITqVv%@bp5Oz&&-W~GlcMu{`KyL78NsI?&H(lR zy+fiRHwAdqH;*VBH2aMbkCa`g8}0vkaT9ULlB@(uO6|l%Fb(Zua-ZO(fb!h%Gm!tQ zptSJP*H<`#)0sRAUbYS_PV6jOUq)xkx&4=(cw0DS@QKWOLEi&lExk%Lx4``3?P=bB zpQ|)sp8`@C-1W2a%G&rVBV228V|pi90a*J=L;6~{sq<~=T)7#@o%`2>hHi(97-k)$ z94`h3Ps;UZkGIrwaW~~mf(`?alitxxAPeD-Xb(mXy&X)^&z`O`t1$FxlrnbdtH8o+ z3{`V8mPL)r2r%~B+f-9+9;LFE(!c`PdQHm*@jRxJRLU9I?(Ms7$Abk4V7A21teQ`m zllr)w%+7(Y@5S-p8%$|Lj@L7x?Lr0V!ne`R~GxsozGLKc`~N8vV3=g zF)+^Yzw}lKDDyuwXyfr=56w!HeSXZJ*~#f+gZftl=AEuTQ&1e{)c&f$cV)oym2sIWQ!CB1r~a=?+brQ zu4Ww)CP!_3tuD?c@Fj&^9L7)aob8F(A`)c1Y+McknJN9VpI+~Ei_5+C#j@0IaJOD` z;IBVR?iOFIm?>bVUC&esDm6{^a4xqI^?K3LrESwo>!TKNemZ^e#ULcQeiMg-a!||C z4xB8o<>aSGX5Y5SjKDUTv9-gO7|^R`o6PLldrtl~nQ_w1g-fLb=35^)?5OZP5C#Of z(qGkrhlRvvo;>SCtb~UKR0WJm?S~1>AsPiG+o{)7FE)Sm7-R1?DWM@}&i6Y6$bUZ0 zD_!bk5_8JrDb47y+|1qbxX^r$v#^u@(W1l|+O6%$>HGrfgEbfiZkrCWOVoCDsn~Tp zZd%GF;d;F5twpXr1uJ8=)MoMg?`Gw0acP*Y$-@}z**qy7wiOw`N!*& zLwTNyGN59JI=7QA7BIhNB|CNY>rp|i&;coB#Tq09IG*Gsm26=x3x0B_j3v6=i#LLa z2&L4hgQ^zoYKo4mN%wftGC`_PpvFoo0ThUREm6mJm>lo%yXb(+^=Mr%;^1$QTxjM} zG5{R8XwTlWKxs-0{mEmNR)xV(Zh0X*6!V2xdg%|W=l{}ZMu7m8e-Rx9+DsBVYBO=~ z2AWPuIMp{lwAe+8BoLh(%O{=-LrUo@eqjuIFAs{CJeSLpx!k@!&oRestt6A%rE34k zzL9;p5f7--1N-5Gi|DO{DD%E(|1<3A1!GRie6(V_^j$y)e1`qJnmaMw<@5QKxf ztFY`SD_@La;J|Wj2qGQ+`0Kds0*~=g*Sh0SMVeyfqV4RScd*OTMUb3oZEjP}P@MIM zO)78%q`pXKtu|^BgveLKOg)(GXmfNKLVJ>)mseTtp|z@n{`zzpQ`<(AR<87AR(bdJ z>_0cpDXws$p!0e}U-pJmA^-G#xW$*y;WX2L;cT!;FLuVMv%|I3UYM{gcow|>_bbs~ z_kogIEzGX{hLh1zUIVqLg1rZ9i3lptx(el-I{hoyXLjbPp1NPHOV%Qx(z z4L|`gG5Nn*E+*&F&fXFnB@}TBgjd>@;f+=EpdnU|U2WNYumrx-ff+|_pSsz&r84 z!DDN+s;SprUHZ%^sstr7vDe%SD&0fYNXFUqy)jt@dM21*-5yuf-;eeO2qejY1*=@| z$6gT6>yEubc6tDTu3xUCRQp ze*f&*4B)DIS6`qO{+u?PTa^w^;NrT{B5xP}5uo7~bmag<>K7KtthC+x?kt znLyV~sH!rBdQJW;q@Cx2x=FZUI!NnX1PR2+g9%bfB&|IdhUw@>{TLq@W5KKu-^JET z+|A)fi#-Xf-c!`n{1B(`FmJUZh!e-V8(EmH#{>H#(hEuzWV>y6K1DqnZO-fG%& z3WV&$Df#WUdpA?#S5@UJ-3*l<=J^NcCT^vA9>4RgLu9Cj(_fg}XIST-+wJW#Ga-|k zi@ZTYwF(*snD_8_Jteo@3bXXH7HR7BXQzr)nf(Q7Y6Dr!r8c=k^aeuSAN7`Mlo;o{ zHLpSQt-}Dv&wiDs%UZXE=|>nT>9eFPseqi8eAqwQDHs_L+JpLJH5ceY=w8{Y3%Xc; zc8`{Fc!v$Xd(beAb)6ry<7<3GFgkOoE}M4}jB9oR|FzpB*Md?LDaUt)te^-rd-G=4 z5(T>+dGAV}W}CbUR?IbP;eGc&R`wY%Ra&iG24-Ct;cIzOjw3~(cYG|SHtW)4z* zi$uxZ)(zP{+$Xjg?NQIpD9`OMqbx;hj>}jV#THLK^c79uC0eE<|7!A`OUvu%i+L6N z-#7WJHp~-|2ht!6M?%LdeZfH+RF}VD4P$-DOMFq^FWa7yozDgjEoU58H~~95G+2-) z0^TDec7Tyay8zkD9XPuAvR%h4X{$-Jk&xws2f z%dgm1oy^Nqd^;)AqBI>iYM&LQ71{2ai837(h%+*27G%FZ-i@?+6KzBD!b_nT1AY1D z(;s9r`>VJ6ebI|;{boP}r8T!)9dp-8$Vea|iD!S(%7E#N5JG0vw4cUjgdnD`6RWp;U<_!s07^KJVxZ2FF13Lxpt)Dae(YU zSa>8#-s4c=3*1_Pw}DhF0RG?2CC)ad9O}Y;U2$rwQygNBu^OCcxAK;Svc{LLVz<16#( z9^mGdr5_&JyOS*Jl_s##H{*lQ4k*WliwlQ8hT%QdnU>Bu?sBEh(KMF^GMGPf@6DP1 z>A5&G{N&;OqIZ{^0kM6*BPF)bNus;;+j*D(hy%7T`1L-01HtTG{2*BjpHMCYHP}q_ z(=%U`mAbhoH%g<82myRpE3>)>{%as*KsKrL@jqAq27NCg#_Cw3zQK2t`Epgj3Dt*@ zLW$tdYny< zba${3Yh&)ztqWlq#B5Sef3nxw=A1KiA+FvjEQtB(z}^6s9ejc>DKlCe@Un>%PBUs0 zrzbiz*9m6sr!$)YQ*7jGBc8-URnzcrS!B}BS&Tj2#t>F$a1LCl4`6{oeX9u-6*ERL zF*K6#HP>4%i#hBy--QL+6+;laa|>GXKXa*{`>tcnmN7w}KR%-yD-%Jp%VfI&G*@SQ zcqf_LJ$A_utb9K1I@`eH|2b6A|M1FV5>(E#Wv>*>wXp*#Br?CtgbwgV*e3NZw*Rht zAuBO(7vjQW4b+vIyzipwC7?GS$9%kta-66;X=GgcFoA*(-p}{bpTDw6CPQ%Kn(q`4 zLOVw_MqfU7&bla^#in)Gv90K_IHgP!s^{-!-~)E9WVTZhEifzCmfvl1 z{K~(ec#4-KR~oXn%-TFD>6X1?YJ5Sltu8FZu!@v02!<0=JD7pHvTLd`!WoBX4b~#w z0~XWJrNnWy4)YaqA-cSzLm6VNAFZ_Zpf^IwD9Jb=TD6?9J~H%DM{HqP4PZNn1r=lD zBjLPa?gPr63_7(!620~ASjduB%MaMK{vdl*Vrlv@`sXK*TV{HA`%;V6P#UZ)ceD?H0Vuk3 z?>V~*+5auY`I9;RTEh82a?Z<_VN6X(SluF2E~|AVUrDDaTD1X8lsMa8=^WUvN^*qb z7}WB0ufBYwU;qZq+L~L+IT^F!63#c?V27Zpo>fdEKrM^j1zhJc&AgGRzwH{_&>SPC>Jo)a0u}}HX6K^$_k9BxK zhm@9@0tWgAvB;Kw#c5`U2RLC}>&qyX6n(5Q{;C&qZ*A&VlRnwSvZ>eAwb2ep%d}z7 zFZTC2X<$P7v*dnWa-s4r#C>-*0V;REun6!bhOjs!M!$OE3Qlsvp=$O`34OVysmUaJ z?Dkv?`Zx7f)(b2O3_3S*(rT$i@wH)gr!MW$9#@UGbdgIS6b4!o0+Gpn=9l(ldfp(z zO0k?Sl%EOEP^1FZoI%4BiS zS-TIndb`bR_d9YRq_d7b_`ltB^iRwAR-V9hFzf0T$S>K)V^z2nYl5x$YWR3S9g!x0 z&!9gQkO&g>u^$z}Px4_I?y-i5ZV7{%iEZF>!wq((HFzU0r+HOp*jog^5cZn_^KtqK z<&`oOqs8r-s6x~{A9*guuuq(MLwJg2VRe*gTyM{VE0Nsav8|~#m!hBN z`DZqNWy4BfhKr+b15I2%#L7$Au>A}M*fzWP=!V6As?O-CpO~kVB7*s^H}v!2{|`z8 zYst)!-}JdVZf3ym430bY=)dP$25p?LYXD6~ihwN;`D28OZ22Hq)(U>a)7;AI zG<^ky8bn1P*G9&NMGJAq$31U|j`$5PqOe8b1tlbvb(%fPm9@-53L^L)G9MJySj-7y z;_ZT6SYqQL%i`W!IH$6^LI>hDSVLO&i%Je>9|oU@?fCF^)uqu(5cs=3H(dJnJNdut=H8bf*{Pa$ z-~HQ716~;=yijYAcv}xs|pGpb-;+Q^Rw1r8-yC^SyA~Swx;qBk4H~i`IBd3)iRY%U!T$4 zK~QM_&d5I&`YkQ^(86Sd_+6b!mdrFSnDype1rO&Pq*>f=<^VEia7BHo&)nV*t@YrN zIAX9i9C^4G(%%OOTp9Lf@Mmq*2BBggier<4r$`-Ph+HKvR&#_4|){?Ny!J zxX1w&svar+cRMn@uP`NV8N3>TizGz#m)!7!Z1;?f z8aPH$17{Fse$oAc5yR}c>VLMkMOe#M`#+$gO;C5pRP3(p>CK&XMrr@isC1AzBvD~`CEh(ej6@TCr2VmzCZ7;^jTE|p^oVSB}HJA8d6qjI-HgPxz*iNm5adfQDu znN$>{oJaQUOxut8*A%+*_Yb1*t(OI*-I3)@q?(b#*6w1S?pwl!sr*8Bop{OhgrBXl z%QsoABhrxZ83=gGMF09dLbPfScPfYs>RgTN^Ss{)C-H_W4AGF_KR6g;^vb7OvU^)| zsV}1+w)R^(Kd}X{1Y{)YwkbdI_|#WX)V(#K?*X{f4>8NxC>C?<3-TXmy@4ZJ2aYUD z%0Hw28bv38Gc@0hE$wb8r;{4oTcs(jT$3+5HCd57w4tA^($3Txd*gk`v7otQHCsQ= zEtQYJD>CD)h7D8}cGCeBg@^{kO?>+i2-feU>v!~hRHX&dSvX?x-U(YWv#j6FFWsNL zZs3#nGJSjRlMgPSMX(OL-5CJw?SioaCiM#{`Iup25kYtLOE4^+$pjgZ%??xW91W0y z`zxPkw@x`3`C%#@skk$|pj;67#vrM;K7-3=EVy= zB=TPN4HO~f|A_UGM#vj!gD^S)d$9xMsUz-VbJFEJxYMWS>a(-B$b5P$G4QHpjg>I| zjW&DLweyMobERKHxalg4(!ycS8id3R#ZmoK6h#4W69SjaVg=@#s<_CWLxr-UM_NE~ zgichUaH^uV9-Yy7$KNI}&w8PpmDnAuwW7Drtzd!r9DSh+i(>{;l@&)hafj|>=$Vfu z=GY)bVo{S_*R-l9uFuTcLxHtK?r9pv2aF3)1V#^jI09y;QDR#czk@%zQGc3W>8SVo zasSbxrVZyNG1YD{)D#!X5_L0W%htMw;r-=Uz^F_8A?7-ipr^_PGkr*CQr`#0MsDQk zY?sX&oI%}CwzjNL_Mb*aTHcB=5xl&MG*dmHOBz!L&wvRY`3>Hk$Rd^;49*%Lxo(N( z@s3ZbYo@6v0rLUlz)a*^FQVKAvZyfJlPPu_;ge52d9c_@AVM?Puf!7 z`&_BgTKdr3YPe~Dk5-KMrQvmu0N_~pB^^cJ0i7f)myaNqqVe^nh?`PXMKG-o?rL!8s+Uf4@H{`PRNQ@Nc>hakM@Y|6XTk_Uvm;?Ty)_;~E=J0dPq6 z1bg;f24cx@^VF%V8!c|t78t4xV{WaU9mfuvpR`1g28*6@kwd^smc=bC^D{d`q7EMv z7h^6wEblee8!G8gcRtBIHvJDUp7cc3&=2dY!p<7BCwqDpP^+!>!*fv9<9qn=!80p$ zA^SwQeQa-Y@RMP&Gr_XKOu%UDanO^9(VPRqA zdLnr|yE3IeR}+4s3rKgSmEBV9Mz-nO@3I9~7yBLY_o^-i+x|)~BFO&9q+SIRm@7gL z{s(piFikw(Z@Hj2b7b_P?l(D8#k{3~G%%emAYp*%Hk_>mNwkC<8znK;d3M^ZKxTxo|ls)1_1WfT|aH(1=t;{r{ibV1wN>iUzA3&c4-eT+XdG5 zi>VD}*+Co8$!eP+{^A_b{T*$nc5q;RPnmJwiTp?bm(pIT=;swCU;qZ6nhji& ze+|HtM185y5++w@dg0WmU0~7}LEb2IcDOgLv5{f%yho&^W3AXw%nWV*qctY==9WqKQU8Nkwpz z#mKg=DJgF?aTST0tnSvAFV%<4Z#KK*w)u4`UE@Kc-;CA=9b)JmLr`WDL+%scK>mow zg|IVAOdgTVdwqE_X3Y)l(=&%!$m(pxB!NGg`3mqSrk8<{ka2EOgIX)95S(!=wDU64 z@@EVHY7K}5&HR6)y?0cT+uA*Fr%D1js* zA_@W)5Tyk{=_DY%BoPr%=_Q69dO`vOQV8ky#dCi5yJOsY$2gqtpZt?D-mLYk`OIgo zXU%2FYf+jQ)&bSMy_yu(w)kqD;*tHr!*t?sjo(AexZi-YTufi_urv2LF?NxmT=~*9 zO8@X3F#Xd-Qrd6tm0z}iek6@jMxO95ll$FC{$DkG0+-PuWsrKcyWiXbu6Pu_e0LG( z#LD?|zWtE;j$z;rUq?BBy6YwE+g5(z(kZt)%oigcVhb8shJ^%Z2jV z*aR;-Z#;ad>1*(BYr2u(J&1JR!-!c3-~kY%4+{RWRu92BAQe?jTo_OWN;Z|$FzEa% z1tN=t>sxR>D<+Jsgf|XAvUi7Jnj_g+U~B<~<-LhNqcru5+P4M)naae>2Q zSMnWSLgo)y+p~f>|GW_bjW7EvpPSj(+)A@b#no6sRg$b17n(ym%xty;S1tNCa&0v4 zEyI92pW8C2S(jM>KmkT|cHXr5){r&fdg}z6fJ7lYrB#gSbj;lZ`Fv%2-_cO<9$6%g zd1)GBFe8(4)cLw!9u)%;{rGdma87JeU*>ny@r~i_FUKv_^@n`2kW|s)D_74xSODUIl3PK7=pZn4Y-+kCDll$#p`+o^oMTC zN^^k@mClUXq0hi9iTgKjw9kj5VW|5i8b*4@!cjW<;gYH84V-)%B(|hUEs$*v;j~a{ zm$&NQlU(+^H1kYWsrXpz4`I}9#5?g)Whvm3CEuSGG&Iix9P+oN7#v(yJW$%}@e@uS zs9|6kyiNZ~K%{BU*tv+PKPx`e&fN#BE0c~eg4aR33Hk7alfSTL$ttt zKECQ!QG(_0M?7$cRQnQOV|88SckA?I-ipWL|C~bc0ZySPT2CE_9KS<)5`vU&YtGkf z%pc5O1WZ_~{@c?S_zj#_4c*8EWvau@f0;i-3=~n#Q-MP!hE3*XLb1K1%*$uPOTiL3NR2}P($Vsui2TugF$X?q7R{J=Vnv=+gbZM-Yq^#6C~mU0P?)G z_q(LQd@c5}hG$6U`B;B5pa1%P`#v=OfOX5i9@BxFPUt88_?4UXMTahF8oeG!y3Bc&`hB(0Y&Zt4kZ(nel zas^bgey`d{llgKUcjn_N7bl1T4qNfTt44H&XB^T3SVGTUU8>}ZPV3aC!_;FYJ2q++-Ugi4 zDX*_c*ns(5nT_quM)ZhZfv3m(5W1>k?LqNgZ?{MBhqSf?^@QVIZyj)kr)PENrDPh| zlVb-yRb>ahfmW^oyqUIBD39nWTXpBG;RH~jlN;CkVEQ>V9T|D~@zaKQMxAbigW zXM@1)=e-{(=~5Qb({JFOT+XV3TF3po2#|@R+U8v4odV^#+Dzc!lq%BRm;b5av`dZf zLzISBDJCS_*Bt1Je14+J5mlYCjySen5>iGkLbCuvWrh9b3k<-?|6Qz_$$pQXBGKUS zmcCv_PM}-c6r4oY`rr-IY_Fx&XE89>M zzD4{&9z7n>tbrc75Vv~@9P`o2yRR*Ou=@bu@d!}Eb|9@?0hqpWe?aSs7hS|9PJKs} zuj@csPd2|p;8N>ZS?(P+VGkkztfFGDa||(=-QuKdo`fC^mtQeSQ!`;uh?o>F>7Es% zimdXL5-mp9zb`4Q11xwI-v>B6dmGJGmEu)JkPYkP1Q=A{luD8?NHvUEF@SJS5ypoc z+-)g~I0iJhzT0MG?$t7JZMwR9rf%Ht*7W*&?Uqsr{7onp@aVV(kC|AeER*Um6>VbVD?O?`L z5O{g?Z2KrOTDtq{Cp2J6ZJ4@tgMSYh?O8bzm{L?eovi24cTFKXlcAYxN~wAXSca8( zrw65@cfTV7zo(bNiePwtQh}ApD)v!U)G2kY;s2CzNH1WKqEdk!E4(Am zlv3LVxZXkrT5p#6X_n<^`=0ib5${WKypIFwxBD?($Gy{$tRI@gY*a7Kgw)|6O(_LtoOmwT@c-Hb!q#@FPp zxY2ml{Mavd>fRqDm&Om;0qZ-b!QJb_xPNatZvO7*r46Bl3Udn$ilsWJMFmMZU`f^3 zE}X7ZyI`}^)+KSR^g|Tt&XptO32kY>cFu@f%J*qOqz-B%&Oo#BJ^R?Y4bo#xMKXF^J z)uA~#Rr?2I#~_C?^G)9|1(gPY9>(F|#J@Cyo6P4Rw9%@Zw4i~mb~jPx>2|=&cj**W z;I#c2CQ2WNUrG)fE+-?J7E2d;09VgBiO{uAyLNU~^&+wE9StGU zG>>vH0o_TnW5C8eqQfHXUfPmp|Lem5 zJ7p#Fn4SXF43Seprp`I}u=UuV0G-nRZz_gx*1CLXMpEhZpaXG054Q63@OoyB`HsU^ zEZ(6d)%`z5Tn+uF5AOn8A2;j?y@93$zdcs39*B3S88p?~8hO;-}68S*C%9Lva(*Xjca-DN8PPz?~Aa`b2)L zI_k-Zme2;bq2@)G3xgw}%*5o+8du|p)5-4Q1g;KxW-rD+$pP%*UAK7QZUkwaU=X-+ zrrl7uo7j9WR@70ymk*GbM(7hI4KSUqeqwqZ5k~?6nq1M6T*u>dMWfkg36LP139k&O z6iNYNr3V)Q(n$xAn!_VIKi_+->`7CjB?ctm_ZY<0WOeL}^>_K|8lb06<7zzn9Q_D54EInK)NO!cHy(o#!81ESNX@Cf4@11o;*d!8d! z zX)h?IBC8rmAV?TrLFZN~Kg6HO_%-NtOef_;v-Hf5u_&pnoBqBWUcRq>$>?aF@&jt> zjo0W;_Y$7HCHGxOvq(DWrCe^?9$1t3%ro$_(VzXAzMYpThjy9&stWOteAKy(xefO7 zeWl2`w25H$A4l2mkPOe4+2h|l?P)`$Y_aQ0r}#QXezv5B9C0lAVpCesT>J>ky_>Dk z>v(b7WK`r_1pC-@4dZRI90#w+$rC>{S&+*=GGKFOyir?$%E%Y`kgnN?Go?j)A8FIN5<3$=zWq@j*S7ewh}Z?9_sG zmIrPt|BQ9BKNeRSZ*f!ikU|@|3SsREvcVs?)wwmYwLWv|d z5R?(m*yGRmTYh^PPhrUhy<3H*bT|W-ZujZ^lse7xvC2jca{c?T1oG&OnT%LXIi2sS zx%tJ_2L{>@@pEA{F62UwP}V)r@X!5`2NmGe^!rA*#KdH7qKt=dSQ{rHs@+Uq9I z%wIqIEh@K`v{`IWBHp=U?|L&WdmvobNZ-wFxVI|g1*XtCLql@=Pd?QwL~&1dIBG|J z;qz6Ez?UVRqsR61DCK`zY#SPQeAVfw7mkmxf^XBWk{*j%-%cJt3ft+ssd zG}mi>Z#ygBzJD}_5!l%0sZq~A+uyskl&X}&1Pt`=*VoIZ05`k6hcn3Uh4aE!)k17- zn?F%tBht9SvPKQpL8fwSbb%#7MAsQhJNE&0+y z#H@oSY}_!DfH*gyXX$=^(0!i+smgh`D=4kT&Du5@=j&_zH$lRAu-k07iyG5ZUGlVp zw%f3iVX|e*f1Z9lOiaWJE*kw!JBmB=(*Ur{I@AdpF1*7HFnpI6R+gYc zE7LsqY(|lNI=t55Y|Fl^w;CAHYa>dP=9*vCu)FivrqqMN@tHEuf;mhCNYVP<99nYwy&^a|XPyXTx zN+imQP`^gVnlXhxn=f0Cbv4ddS9m=%>{MF&Zr|$u*}HWzdt6-D4h5s&;pNC&E4TcWn2pY~?Y05l@SM%Eg2k$oUKZ`n zKY^F@HEYpS^8++@GiuuP3{w<2pa1%2Rf+zQDLi~hoz}7x&DayljbA!*BLj2rfsz7O zUR5zk{X>uNr&)~PF-%3q)g}Kd9(f^NDf(8;&G6E6><&08?dpW}VQ>}3Hq6L|Vw@Vb z{t_KYdo*@~Jn`;lPMF|}sOCrIUI@N2Gxv!{v_vVR3I3MbaUniuYeiDoi|hwO_j(8T zB~uoxg&0`a7@{QF@P@%Ju9{^(ZA)xQ^YV}J#{ufbnt@}=+69xhE*N%JuAB5-9Te@) zdo*VX>8My&p%O>9*1a7&n0uyWe1~d#4Xf2xeBC5hZ!XP_s^oGAl;WEBIPgeO4Ky}N zIpWD>)^k>==3=}}i&@Blz!Wnd3F;D@iSPn1@_YCk)SoflQ3b+9AC{%#zAkExEIA%w ze=1@2Z3=OuAoJJ8<{Gd8eO>Y=--g_EyTFb-Iro$}3(NqRH5(kIjZDV-SWaEIXJD-#xc3U%GT?H_a>Jm4lLuI{a}=nbEX7RY|M0)N|8&+!1}Iqn~In$hFC zJ6AcQ?^kA&VuPi^0)>dnp|xeB4w2*0GgD2ZlU554b@sMnoEEVDTG<^S)(dYio?S5B zuUaKgeUp;JEXEiV)16No*4toi1qPyYu<^8!>XdWP;o!o{;GbuGbE!Ipxmd;*!*iz{ zlhb!`3#(36l>G4Xv+VT)J}uw;R+HA(9PuaEhwjzVLlwA3d@r3+9PBfz-gf?8j_|yT zLr2r3j>Qa<67WKr-3@)P&Fp`bKKrA8WN36-T-;VAl<`Rn9Av0LMT*=R!p)%34s}Urxm-2dqg3Dsyr8W@`!~YN@2xAU%5~PjG*(dxmdi^f2mNq2HJ39{(Wk zB&X$o1%hAD)xDcXU=q|#Bj|))%Tu$fF9r`694@m5W+lL*I?Gs;*}%JmF)_NXSCi$- z-T}!&FYZ}Z==a(;lWGtiMl;1>HvY4UVqyi5dbjL&Z=~m~r9Lg>juM8d6mK)C34iHY z=H~mJPOVa(-nT`SCO9)RWISsRIbxSFyOQ>E(^Af-!JzK;o8hJqlTb;qBi^HMYGa^Q zs4{lZ{M^xbBq1Rfb&ZS+hjBctK+3Pk3#2t_Uf#Rrv*JWYul2(|B z(T69%cB1Oea33Sn0*im=zbn!I74d~3KQ8rFf#&p`qxe1^MjAcNj*lG7@XtnS4n2U) zlsDx)pbDBfI%_yliE3}PB62fqv$BsF5ZfKLS*grKDEK&J&GiO+a@d-3|FzVA?12I~z*%4&TAw(? z+TRrphDN%tlAm1L|8L?tZ*$Q#iy4fS39?&GS7RWgCApg&Q`~OGHt)Mnzc3eht{!E5 z%o94TVAjI=;kq-)xa<-$)zJIqixDW(`P0Lwo!di?gh9q`m_1OHpDUDoTC)5lpLgV@ zZX)wq2WH^Xtn5eS0Za@2NBXcWdZVVnX1V%r7Q38BVu~K`Kv^)SYvA zS2hkI!S6-uRm%$6ZGcs;r10em>-omzx#tLG`6VQdHM5`i8gz83XW@&oCL}L$vcNbd zbE{ivYI<8pxM3QQxc0jhrOwSBDJs0FrvKvXQrE$Prl&VKHsk32v-f5eqwmSl5&x)Y zzEo1D6-c%nQ(BeAv3A{SnfHpEL$`U6d69CnmO1>YH7BYk4bUKR#1h?jF0%Nx$!?wz zRV%*gPyNy%gPb1bQQX!WPQ`9lq7*U>+o@@Ga?Q@xmus-T`o|2Ox0@UV)%q{IYsx1d zsVaJy*QXtCXf%U=(EP2c{rIVP#`Uy&9B@N!d2-`h%}xbQN+oYmr{=;xN1&Ji3+xOq zJH@fc?&`Z{KP`ezVl^h(S&P*3dw0fJMG6GUCjZJ=T*v=HUI0?or^Lj-GY?PKZX8tU z;gU!_jN93)uIq#htH>|?eIF<4-nQ#>l7_LFTj`Cj!)j&?DCXK5>)cV)E z$kP4ia5uMs-`>Ke)RjdmssVAfH}KW9cU5tBvI5EbVh7I^ee%?8j~}?SLieKp>SPmZ zSU&B(qDLiWx!WJJI0~wsJa5=Z&GXr`%1QdU?zlQlsPb8ixFU?z39h`-zYzw{rMPLv z^)d2%iKVq0J+ow%KcD@ROVIfPE+5|x3iKoM#ZOS+SHRlf2vzVRlJYmiz!V0YSBx%SiOkg!qiFQzP5& zFCSib%N~5dce8x{prT0y0Pcxj(23~y9Q$v$tS2rG&~u(ySJWz>-_jaz)SAiv*C!^J zD-81IWwx$%9Q_(dRa9^SpE>_zqN_h3Bk9DJRSrYGLI5S4;K97Q?-TyzflemuqVTJw z%A$r?hK19X!fW_EI~is)%xa1J1dV6Z`-^|PL&a7nk|br z{7eimY#j`+f~Qv`^r}vpS@M^Ej-u*oHZoP@$(zV)Jx$1}9|xWsx}Y)%)5-8eetj+X z_{{+&oBJ!I>c@ynO{!XRCH#~M{4ep22SbO~Q=xMo)wgzmswN*jpBeK*3}Hy^Jyp{O zueTiX_AKx%?VH{^fq7|BVE?;1C%C30HdD;1tz&;$uywH-HpL(_ain@+0-0;QdqMur z3SazRtv!qITAjYi#07qdlhd3+WI+zOzV#}2h8-0-4-mx}cEM(tWzL_?H6xyXZe{%z zw4#^R;hWd@mS&^l>%qrU!ydC4x1)b*>c(~8TB7s95>SgknS-Ar*8G6-AK1k1y0Gt~ zvYWl@DfNAtr;lVE{2hxBw|m1tZJH3}gdJB%ipY%H3ar};9`7PiVV=Dk1?+6!27~&r z^_GAv^HPzw3U&B*d3y1$o^XOwd_Rs@MycDTFp^lJ^M}m`554?RlVM+?lTP|nXN_Lq zHAu>hBAOkLvBj^$x{tKZ>Fn*}8@iHi1iZdaj$lV+R`dJPL@o#?wZWG8W=r`WBZ@HI z#5Ydw4Km~Wl+`i4Q$EX?0bkA$YOEKxRcjAiaF29x0PVI*&v3!i=u}P3_&ZFggj5VU z?-CwJ%FLY&AU-H$^zR7DhM5VDHlcgynkS>PN@q-Uf>ukUtW{}%xKdSlXg}Ox0#!!Y zyO9%PSd(Ma1Jm*$zdajE_(Iwq@av};cZ{@gC<-Bw)R$j@YzeKOO5~wtk3fooBq0KGNjko{_<{o~=Oikym<-Ku4S zW=Q1Skf_@#6^Gt>4$O$J4!a6O&TFd-+l6QBfI>}iE-k%s{th7n7Mb5q>(B`vt_Zz* zW48QTS+BUpEMFgD@SN4P!Mb?&)q-HVp6ixWD*{k<%gJjEloUt<+%=JAqAQu|K@N?Tu`88$T>suDnH2keq zp`^u4bIL`B|8S)Ur?F$A@{G3@WMc8sA==44|Ey%$7yw;G!E>hcoX^$}})d zLD%y$uakA>&4lKb;V5E;i9?2W%SEfHs#~`JB`WEi-5Tr}vWIneCA z6XM*nztpz@!Om1S!^rz;hN#e@d~bh1<(on*i@hP)7pQfu#**cUL0QnL)onpN`eLvV z;1-UN%lN(7SKqs3Gt1r-{m6NM+D*~2`x~e!2hWW*sydxyq)QV+#v;wTh*yt&wCW5; zT`WEvvpOw5Pi!=|zPUvgUzV36Y+H1pE-v zrk$Ne(B8fRpN?uWSY>f(N8vHMIq8s8#kN~Z-Dbeuenps;`R2Jg$-;drWk^64N zs+s8d>%2OilyzzHg1lf(N{#w+g;&8X-2B(9*_w0d+-d9o{F!z<{nBaJ+3~KVwBPw> zf^+J7-QOI|QAP&1%3ZIc2)W-dk3Mc>sQ=%|M5Yywz+Qh8Zm&OGrtG1KDBsr3ya>5- zzkQ(bdQJ2t!tdq2KkJb&EEs6^rR6vZ7RROMm3cZTG#4{<1~8!k8O&1Frq#+En=h(# z2KE0HJgr^owmTy4cWpkH^(EN}JS>eYICrm(K3Zz|$3D=-fDF}bt0mj?KVH0uZ3`+w zDk$uZF>Ljo3)*M_o;Q@Q9jR}cJ?;(z@s(Dd_sgWp4R%b9GMw$J$=@QZS4KLX1DTE) z*xmG|_Qx#=qReTgkPvkC_uZ=^`{8;rd5Rp*?He(lWRVBH?f}00E=&gdXaqf@T5kAH zhAh(T<>83ct-QU;-?w+xu4f$zXpP0n7BklEZquS)gZTd{ymaAG&F|6sU|J)K{LvgE zzWv;=%iU2FzAZ2}2Y7(Cl?PbO-bMZ&cNJ&_#x~9XZPxnhm>lr+zIM4^qV7OoBXiVd zr_*jNL}xhRpKU#>`q|BRusMee!L)C@)C9 zeRY-F+-r5NIhuO!>QJIzV;XhG_g(&8G^5Bp;oA22_we3+tx%=N5p*|S0<=L7>t=z+ zM_K%~=c|>R%)Y30#`kUH7cHTq;oA=+8~Lklq{Vnt#Q}f)>h|!f@(6f3PE8?$X6m%2 z;oj<|b@Pq`zlYzZeNd6LB=x^z8O6U_j|WP$B;?|n6Zd{@^PhgGCGXX4zVf@_b9P_g z8SxNDPRuPq)pI6|eKsiCW%4`#XF}@J+11Vbj<=7PrWEctrH;LsIN4!xV>m9RKQEl%SYdXZWkx@&wIP$7b~eU_p-Kw$AvD!dRu?dXwRmyVO8Z zIB;wxqU~Xfg>Fa{9fZnOIAW}LTUFKyHmJ;lhBF3y2HV1oL4KS zCa$~C)HGfDi@=Y3af-|~Y%f@FEQwL%Nr|#ikV1`l*m02Uy@b55zTvX{rFHA;G zdxfUy{En9ATGs}`31eL|rj*Tb&8v%!cat(xa-7DZh|t(ab5FJm<`eWg;JMy|;gWo< zr1xjH@1AvP3zt7aBWB7i4N&JycvI1I9pZSYIMkE)VFyIZ04*_QFHb<<#qQF-@9lSQ zNN%a$)w|S<^ya=;z?~rI@A{|H8W<0964>Hv3Dz~su(yC&*JQUzo%ZQ>c&y@a!wqE! zk5J!U^a*%XM=cd-HBB}ygNhv9aA+lk9(@mU;)+iE#_95)&sC1(nr9QkU6Lss^!w_C z$Lu+#MxPV-4+7BtdVAif71$OXR{}4;tmaSKwM{^ck4-9{w3CcOMX{%7 z8BRRrM1mDGrI_mRRvqfuA@fO{HtZDM|1-p5NG;wO;Sx?{a?5n#E5$eNj~aJs!kkoBoE%e z*XDm~oOY6MQ)*6XFD?yw=~?Aia6=t{^Cs`zakVJ>r6U8Ab7s=?o$A94L%b|u8=faA zelYNbp(*(RO5vsXgpKWX70193HM zEg<4CTq@>FF|)@phdm(TvdH^gU#&#G!(1a~v>_?TS5oU)A_+$AQ=nmhPT6xtHbpae|7 z+S-knvqm^f*w4&xf3}yS&q(#OKAP==ZV8dhxPMyY2a-_}rXFy9JoVJQvCQ6%EBBA9 zZhmLFqNE$9ppIRcNCs31-THSc8D}+hh+{_GBSID22lsbz+HIq*L0b;EW_+?jou=C7 zHH0Dh-IS_STX5!ERMHrXFA>{mgGqOB?u3M&E>Y@%M?nUQ;%TM$P#kgI zo`UEdL^ex%zg;?>d;N*yxf0%p%XIXoB>vzoeXoLIjsZt;KKLs#0#+ zv%cQbsIyl5W_TK|(WsPO*ZCr-Ie2c^=CD=<8H|Q6nYF$$tNWoOW$kfI2}K8Eq^NI_ z?#GPp^BWl?^$|E=cwOAk+5|qTvs>~We@y|qmv4RyszH& zYo#xCo)Aq@F=%kzFsN3S+BVocd)!~uUmC4)zjH`(7VjN642MZ)1#m{2tP*&~$dXIY z`k=SFuufjtP>ff480(V1APPLo#4mhRxDTw3>W+On>0#aSt-egLEc)S$N=qwnk|v>U zSSmqd_|E>lmfqZn6B16t^jH+So0ufZc5An3Crrc{sa1}=Zd6SMERe{=4i}2Lxcgg- z4&lKsoD;M1moPBmV+mFhtvHk_s~B9=U+f$aGWp7ExVW3F<+w;`?Hj7T-%fmve-IS?ruPa&ZDv8s|&+F{@nIG zFr%Yl%{)B0lCk{Q%&0ynHNFY!1B>KE1Cz%11{8`Pq7EOG2Z?so+_m`J$c7V!)Ras5 z2yScfT2Ba*ObHIk2Tqb6OF~ZjNyRrod{JS>Y$7Wbz-o9mHB9kJCdu z+Dv4|3$KRa1*GY$idw-?HEzbqpHd~mvGW!u`<|Z~OG=Su>l5l#1Bg?eW>J;qUCCJB zEH#iQoNC2!ttV9jT^c)p9*3!|Htn1z?r>d<7q=t;V>3>7zT>KkKVesf_ z|7od!J^5*f*#Tzgv@tb8o&ab0zxK5LOpK?t`x7564C2suB5#fvMlN)y)zig!t<2pl ztEIKC?}i&_ll@weQCvt8h>kSMnG|-ydHy~_i|D(Od2h(WrLZZjwuFOLBL8_ogp$c! ziAblN)pW~fC)7Zq)V84+L`9!IO|JClze6Y!8M1q=pgSw0goa~CralC1IKO`$t1c8a zzf+zgCKUTKla37O^0-bAao#DOG}Rj==&|XNlNddevzHf)$EzSwG?xn#26T%ZGp3M- z=#LjySz_4&q)%Yma$YH@E1WQQ?5pBZ&@eK-nwk!J_bJIWrg3ndG|A7G<6v7v=K3g- z_n4mnH46mT(}-NC@AO6O-onfWum?q6i}UwCKN?ZVbMog>+boRcCNV9-4o|1rVW9I4 zn&Y*P4BhTgdkNba#@B@@*|S3_#GWwG5c|4&O}H@fX``y+ZM1xYSntA8i^?+{;cVhG zNV0eV&33OGxoe-aREGl|foZtJTVaRXD?=gV;pr@pk-m3zI5~OJergtW7~eXJ4+>d} z>;h&3c0k&C!o4l^RH;9E`3G8(b4vUI(lQjvtBuo**`EHo8mkZwUV6v8%xrRAD?WvW zzdbc>?%msaH6U#^-bjLsj1<0?uPS!fm=Kr&`z28=J9!`;SVa1F)~|9A-Ie>PKqDF6 z=y0>&QJL&L0?)-DIj@vv@_b`q4%MwyGTb^HvO4mgZC$V$+474w4=fVGSh4Qs)Kpq8Eeo7E``>ObN`nvGhw znAMdyt&{e5INT$!Na#+#3ydiB4hQ|^DRNkSYr49M8{h<_)HW9sHf+rLo;BU(4eqXb z?4eSJ36eOaFvECKE;)=;;CK%l+UOc)7E+02u;!zA4wW32_>dfF(t3Mmd@XM&NW&d) zx0ysA`%)A%%+e7k&J@6Kdak0G_oz02KC1Dg_nd0yDpIP)1XE({ELK*W11aqt3ZlgS z)Zp?`re{%kA7*Fg2`NEck<=9N(lD7SN#|)Wd2okO3|bN*{XLQU#y5^64Yn`xa5tPs z?#2v4P52*C^3s^?K;jowdOysUp766|ChZ(@qzHK4DJkC7q*+7vx2Nd2mG2vrVkEm6 z;dj@H0fUn^h!>+>^W3Yhqkla9YV0R|l+%s^>iOoq`1&joTdk7F+UF@ynU90R&nMAs5l5 zkPaK3y{{j`(^&W-50kQVq(&$d-74K4DMU*umic%l(uw=b%mgvPH>)Uqp zf(Y~iubbju-o^!nGaujNLs2Xi-I2$aki-g@(9>|hLZ)faAHx&T6LAPG-BCPtEFNVI zry3pctD@~wh3ODz<0LUeB!IJ$qe}s zsYJ;d!dfuf-+^MxdBMb@4wEB}p$!;9iGbuJG3~hxNI^QJAcgGx+UVc1I1?3bEfflebPr`blG%7* z6))#yLR~S)f*OC6xM#3$$Nncz8J)iBF2lFe^hbz%&&n7^tY-$%^MN)F?ZrD%8SDEU z@*n}1LIrJAo8sq@!z66&XANwfVC^K>Vh{#jRaxWn1yrHiN#SI>T2lgrgRr1lhC_bM z54?o`O%rT6EF?gRf9CfaIOsQ#H?jB~avhR6`fO6fI#&0^uB5|1SPX9(Gp+qiIgmPbSXC=QA9b2pd=fdic9^ zR9@@@k6=(T1Wst~FFH;-?QPrg_T&fL{-ChspQY{j5=Mt806zUbX1`>*%#cj1o_tMD zLh)e*Ktp+1NI~*-fBdye^ZqA0A!5~ZOZ-fmbk7gGhG-EaM!_R?4c*SFm&AGpJBT74 z2NBo~qzMh_lUOQUfhbLe**J+Ba~eb2)(b#Y6dp_oF)BOGtvd#YM4*j_<+O#%%@v#$ zwlIQ#XkvU%GuAK+d%B5(YT0(pbgkTf{&Ktciz8A-Jeq^hc!!V?M}FwSdmY8Ftn`0S z%@+rM4RiB2z!MM*A?)`Z)=I&nXTLt5$Jm?Cx%oJm{{eCoMiF7d3s3b6B{O(tkp@4v z`J{Id7=sd+=feo1Prf1+tnPEo0$=9^ruLU>8x$?*`LSWKK&~NbkRpNDQhesC7q264 zg(2NUJI&&(b@0oLivwDY{Cs+dDj|b^kx6~MpEGj)tuo!7AQdvLkc`R^Y|YG0*S$I2 zPQbZfk_%d-nIA+HniNbm{c4rjSKZNNiq5GW!V89|;O2^gWmb}-wK_P=K;rxb$>c>W zBE-$>Izs39i)^;jawh$rPH3YWirs*NFkl5ZaWXD0DR~oz3;KIO{vfyQicW1IVwfTM zDCp6b@aRrbu2agDW&S$VXPTX4;yr`Y;P^dA<8aj8)cAv|SSuS3_&iqN=y&!k|FLZ% z?gnPkgu70#0)v_dm*7-{X5k&)`Fb`41CmK-Ti)Zw%Am)p&FJJ5UwL*H1i5m;{%Hg8^GCJY%^#sV>)WkLZIb@-ui7hgZ$R z=SP`v>V0pC?R>)<8FA#g6Im@JGIE&Q zbfrU-=u|MW>?*|r!|d*)yo<&R%Q3Qz58-6piH3&Id-910hTSFo=TO8r)S9xW9`uaN zS}zccS5r|)?x?)P2i|_FGMe&Xx`F#p!mTAtz9xD)F0nW4?+leeqW(dGn_?I(C7PYG zF4n6;4AbzxWl}Ud{ns5WI6D7~`-5E2BeR^Q0eY)0v9^m zDUQ?$`y1sYY;FTgludXZPxO&5b$?_1kkQ=qmzJ*++{jh zont86Uiqw{Vm)G-w5Zi#SRlYM1?_Z;52vKPKA+KIfBsYwj916w zHFroRzHQ5eW-ynzU4Cg4O@=a+|Bbn`Dcux(2ZbrTwHhck4bPLgBrC2t?K|+f8Mr~j zkUjm7-F6v!u#FA3sC|%u9`WypH*bU4`<{oBYbgcgAtH?+q8;~Hl=R|V#8+jEwF9dX ztqKX!?Ifd9eWu^L+F}H~Ir*VO41%whBwlb*SaTCEafzPp*d>`PCtcD^v&K_F(h@jjyp#768r=ALxH88F|C;ld_t#P9al?Bz0z3WxE+2 zLRfChk=oZ$jLXrN+qif3RWobC3GFeEKbM!AA&$dLiBey%6Bpe$I;DgBLBGqdSTE3# zjO$?O(mQ7)?0i^VS2f?oGuxE8fm3`}v(>*^3n7C{dO=oMWiCrG?KUNP zj?*2PmS3Cm_3?9oz5;dT!aT{PdE)HwMRdwwnE#NVp9;xA0RA7o#@!Ew{Z%({Ad)Ij z0f84vFq)T2MIDva5TQR5>X!%oo4A~*+O&SAre6$55Ecdd>DcuGO=F4gSi+)I3(FpW zpd7d`Mk~F|oOx3?&#Qy7OGY|Q=8%;!>>-5$7+#>et7B+%y?$=HbeMvr zzhN;jYz;{+9Yc{ymP3FM2hts6LKWjUJe@*3I1iJSG`ND<@0Z`B1Mu-!hB2%;i7^xV#ktwH&pr zZUW&bX4?_@h4f$4RAnL*E{injz$jY*kW64iIcW~L4ylthdqIX_9|tHDs%6&d7~{qR z*Y_U=9hBVUWIz;M7kcvUM>Fhd%3G}hilm^h+ zA$}YMHY{0^9t1CqDWN|iI?rk}ZEaG%_E)+oh@nV4O_v^$BVKH3`t(7w6Z6Pv{}tO+ zWs2MD!vP1F+IWelXISB`59}tPeus|?a@bh9z#iD;jZ-k^0I-H5g7jEQen&aCB9#jo5|Xd@;Zitg zCJFZpZTh7NBc62y>dm=y-##w523vYTy;hCJ2z7l5K?Jw+i9G^w72pL|AgBe>?6MBG z7x3E?C@E=&&C8K~XkvCV%f(p|MNw-HsshN#lwW~^?wZd`0fRFhP6dTtU_>q&`bAMr zyiigHHz?DfFPSgzt&YAN%~?SKf}L0FP)Wu$tQ5K_06m3>#6#9KH9ot`IGB@GUK$9%TkdS*M?+;7UbM<31N>3 zln&9YS}~%89NQ#^rRUQ{Bx)^1j3q^&me&?2Q>ra7B1x-Lh%FaFVQtsmw-`zg*5)@G z3oHw==YabitVkyFaLV2Gih55kb{h!_9@ETE8JcXml!Xwt0f2)V<;r66ihPhS!EIjlzoYOCh)5$E*&y{Ik?@)OMzhmy?ro z38*Vd3H=SGF3g1oP}mEkB0x^b*Qw zS_ZP=yp3}7>r$9_&V@&adBZbUyZZ>nz#$*NcL)X%mSLWo3y4dFlm|y9rgZSRhGEM- zOwjc*@a%cH$EJX-&E+TCmj&_e-Eqrf6QA-mJB8fqtAaJt@MAJ!%}$=i7JL13-8-sP zcX?8b7uO*G#ITwMu{znWYpRm$Q=L116+#+5lWX=7ScRqe!eJ(X6f`tO{5AyHZE+e6 zU~OPgLBkWF99^2+@ZMEhqOgX!%pm4T20J7o`dlz55Tn`2xp5a5J0Rh>~_&WC)- z9%b~l9fz&~CZt05y@zXP1x}cwn7C?!<4ot+37`_CwfGQL8O_#3nw=A$AKboct&x*% zN-@4i=6wf%}$V>t= z?(h&>;kz;|{P^nNFaxOOB!D@gt^30lVLgL{ePDRAQC%%_=9jP%i12(tz^o^Pikk4O z99|l^xK@pZs~V4{tKh=m+}ANqhJO1%wR(RH2~z#@F^F#E{1l34x@ZQq5CO{9;4N!f zCpn=)7)YH%oti7-%x%Ca%?HI+kGzOd1Od}L`eIeO7{GE4cLK`F|It;2witli;!*4} zei%_6!l|Rrd85rx{fmFfxKhTqlbQkHNHD1hIo05%?d!S4fZckcz+3dxzo4{(aNb6` z_^oz?t3;vz&U{>^RKg_xU!=WxG}QgyKYo?sl2BB3%951qTg*_AB{D^2&Ax^hS;jIX z*|LSQgh44uSw`8iFEcduU3QaoY=g0krQd6GeLnZ+d+z&p&aL~u>s+Ut-d?Zg_E?^; zc&6r6_KPk9?|2x&T8h!=pb|18_cO+bMzWSM2`p`p1pC2KErzjJ~ubSmbKB@;JgVDtB7439e zj{Rn~`YY_8W|w2g)|d&@?+MzqYPJK;CF%O<0BfjtD9U-tS9m9`@lb6zd~|NQYT4mq zoVI+n_dK6syKK+){>-ISla5{4@A?PZ?1_6Mj3h!Ywa zIc_@oSa0o@$#R@LYA-wegut~~K?!VaX ze|WbSTh|iB7vz+_6u3%BZ!W_ucHqb9U9Qqj#FktJ*e57D2hJi_3$EgikU#zyq}yG_ zM&0un{}mPVi}3tYD-zRUM}^d_Yoq*{!i4sNE2#KuHP%#aoCUVAkc*uo{ON=bDu?G9 z)I(aP^NIhD1mC9aAzu^9ogFh20WZD!jpfBHJJ_r;md=zYxosW?ZAHAltd{A4Zgl|u zTswH6YT!eoS50^vI2OE4TOrz#7@DK##%V@ z%*ID4G`WcCsZ+XI(+AK}q?Ax%pLpB1@F;iqG6(-oC2f^S=U|W}EFIfH`2z>xER>G~ zg9JYx=;-A3iGz3JBF9WfIrTK97WLf<0Kc>ya=H#?I7VsaO&fq6=k_ZsxB5ZH+*5Sm zEfZV8md7i;#D|e#GVQWrJNuvV@kS*jlX9po!zVXuSt@To*bBpbw8YMtGFU6^u$#-^i)LuoE*vx=n}uGr zOIMoKpNE@zTsc`uEDL!@DEf^)<-R?fwzrlATJs&_54n4M zAB)axx>P*M9d-RiC?J=CqNY|Q7ys@+7q9vd-EpM=l%hJ5<+%^lXUZ!+xOHMD2GhbImeofJnHR((o<POWZ)3Pa0&j3*jQr8gBFRr+u)0F|0j7J7#Oz*sCcW^maWjQmpUx<1$(;I z9fQ5D?5r24@U7rDKDFLP&06cMaU;i?Ec=g*>(VXW_a}>sE-z&=$Yh{;61{)mCw3j% z(l)MJ&H6Tz3@jbnt+P(B35w6F4;yfHjVd_oJqUwCHC~X95oXg`MKm%M@3KXQKUtN+ z*Q)Oli7`j-{2g<51zw_kU&|aKfWGfzWxXgN5}~ku4%ex#-|!vzSW$12>Kumf3puIn zkTQm+U3=#|;B}ysdF(>_DOSJ3yJbq~uRIbw-_mb$ zdM^+o-ycLQNt{fZuV;u`ltGP;D1LU8_T40POq|gs<9Kd-0L>=<-m$*SUOGTL90Rom_#cHR$jS+$=?Fhd_1YYQ69;NMP?qXR6pP4&Kw^y4r(BpybQ$&t~UI^JUV} z*=adHi0V$n%GHMr2>5NSY?Tx^;qmpyV_6i@XVF5Mi38%XP!_f}7QtM%CyJ=6ZAP*O zADYI&*!p>7(3$Q0noN1ujJ6hs)3#0`X-^gUlgA^BJ}-hLhIzvhL&Y&-+w$$P_%TCm zJEs$jL6`He-gfhou85cSZd%x0EF5Z-NavQAw;x+5ZMmqy@1)Nf9d5AKq&?pr$`5G0 zt?Om+bPf#7@7)y{9P3JiV-FRwv0##r76F+$Cz@ijBeGO_4OQ+>T*TKRQYgpvC@WI%|Z@XH1uibxuD*y1vmH*C1-lZYW!&qV**P-W18xEuD&ZTG_tuKufurs^Bf-9BX0HOQ^H^q0-21{$mEVUhro<0 zLi0HlqCt;dbrL#-uxK;3ZFwU zHcVmsBum<87Ib1%G~N=(aJ>qP9wJ|X~a45T;Mz9 zlp=1|D`7uzA`#PJsU`8Y}8A?s(V(Z-BT8AN~N8WRTuk-Eze@J-OfeSq2H7g($;=L%Yx6+(dFHpG9?l4 zn$eEE)#7tL$xFTwECngrP$_vyZHq(>9z5g4`*m-qnl&Q4L2fkI`#F5tl8dmj&7}Q) zRUeiah1W4Pkv&?Ud0jQaoP(L;D4H`tUxeo|Qp@V|dgJpUYY6|!{Ei~gJ%1-uF7sHW zv%S^P)>pO={@BfO5OmQwcMjBvA37TRw-$JgVl=YyX0GI7Xv!G3(FbKd2;MT|vDYulL0DUc=96&zZ&b*EF{h%2(xCMfa|rgOt0a zAMy?q&@#VQ^c`!QcBXh?=pL-U0ACObvJ4`9%TwSxNt`xLF6MA;;$%s8P5t7Hn6H?I zFt*$6FRj%f8x!PsIqN~+Z|lT*uH}qiaU9VRb+%7XrPG`ivj_SWqhu6Un5B4`GfBzL^t3F=MsulT_*_D2;=6JHqZ0Uxr|zfF*gs5 ziIOtJbMlIKAC2m<=Qv`;@xXJq7dLTqR&4LZKrzp;{-!$7{2HxW$0yRq3L^9F59X;y zcdU%gONvDA_>D2z^uktXZVw4Pr>aznr>i`uHAWyRt_)5TNn-9m{`;C2t1zD_o z>@~#mEy^XM<4Kwv{3 zSq)AKo;@c$<`JJVx#!Nd#wq2v@vGMIvu5dhvfpFNWOic#*)o3ez5u0HF^@_0 zdJdPo=J6&Yn`X*v)T>=G+2V1rWiX>^L;HhHPx_|9fLUSabn0J^)F)Kk84!BnB<>=@csM{qsn$!7M(=1us6(3&sY(f9R9UO~Oihs+ zO$g&mMU)N5g~Fp&sm}gt4F+F{6U5x)2t?%Q@%9HtYZo>lZQp-3Ce9a^w~H5<2_@(y1K7|EpY) zX-ppPWwCz!Ltq3e=%rJj7&&c1C0AC=2886sfBm`_|Fzh}6~qOz30E(VFh(JUa4Nd* zl8JB6GI0~13fiP?esxxYhv4U_ob)o~7bQi)KpA*_@G|g>n*2DbCo-8RDAS({W0*QJ z-lDFw0=IKnTKIIF*_-1>7d4VyFU)10UxzWdA-HdoH&$LQ11j^y8RSU2XyJ-v@&!9K zpE(0}H`%O^XNC8QqOzS){e_aG7boezb43djdwqtI?qF-mMVYKwD7j(+A9VDNx*q?l z6HQMwDLt2k4`v}IwFFlp#+}b-@CsA=NpEp?HK`_GIf4!!0m_>x`LYY@U=YeNsiW@! zhGP7A;jy!+bz*+U36yNfG~WHKQ^k(9|A&xUmdbX+>YO6=48!Z*6VGnjdcRR{m*%!j zQnktn4CAjfM&5%N($MeN*ZG*Vt;>IBPYk)AG+E_$(maD)Axs#Pr!OapFNS2}tc$cw zVV2$zRuCAnTbDIk@O*&*EcOEJdV}gUVbjE01dqr`Ced8y==o-0@b!l$@T=Qvr&Z$l z3PqPwO6uV2HSeTka=wBfZ26NQWYnkxd`v@czHIYcGsLQsFAip-vOT(IUzNJ#p*5P5ao_XHr}UU)=24L z6UBe5w1JvGD(4zeD>1E7oXZ-OH3}O19Fsa72362yOj_d~dYpW(NOkUM7_meh328xC zr4(M(c~~D~aBJC0E!GSoK{-p08|W!N(3kGU{CY}TrA=dnFWfZboF`hHe=&v3auGWT%<0FGf<=k^O`9SBAJ2zh87%la) zPKSxHC`y=WE<@looJm;~hb>8o=qoNwQJG6Bz6Q|3>QEAQ`m&Me0~^!HaXXbU*t<-E`? z2oxq86HNr1;zs+6GFDHuGuGT-5|50+foh%JrZKO=KExu3o2FmbLUhu)!tW=FbkDA4GdwYR4YY?QMhaF zE%$wMh=fl2%Sl9h9u@vX)ARkXdl>zx`2msGCgx%X*AdABM#ylQN0Nscu- zLXwO)yc;U|EczhOC1_c$N`v~QSU;kO6FVnUEy_zjVPB^Zxmf?7v3DW0I$1p1)~s$D zLf_5*%*pQ_Q zdt+tN9uou#oo_*?WnYAOrVBg_QW9&L6_x1{6OlQW9?^}4DS*|^4`-j> z#qLh^Q~!A{`F5%+Y7HZ2|5vnNk7pWqyh^=ILYax3(oh;GH6u>fg{TH93U)CM5;POe zWuBTnW#WmkwZ2=aCYL4Rq z-HrKB!S6s*!~@0b)+ora@F&sqYvs}hh2xH&O!PYpMaIm3FOdx9hzwp|r}of(E%=_k z%kgVm$sL-lkYP*gW&91TIX1+^j`p0vS0+)JFv^1+LqT z684`39aC>vYE?bLQXrJ;X66u)^?9wQaAJ(;6BUl=wlBtR8IOw0jn8DK4S+;XIWb;b z%z)r%&XBV>%8~}{;Co2lL(5S(0Rcx|=jVzy8#)7+E}ey?CCT3a@gEcdg@)VbL-(E+RdP;%n9~jUkyv$?RmTr66@}1Ed4}uWl6!y zk62kWU1eAQV13(j3DU)7Qtx_YF5_MzoT+YT($ZKPLl`vH<_*&o#C!3Q-0BluU{Cqa zR7Ddu+DlTp<4n`C81838fp#dYRr#eWAn_FBN7wHCS^64O+gOPW)&7M?aXxDQ5w8#>L{Ud+1YAi0muPSzB#fn~{0D2i6W2kOj z#C51WZ>PYdxQ%)x6B}wn~;k$RC+(uQ9J~ z^>b4AmsQr84*u~L6`?e1@As0I!%o#M0_=f`a7*Hn?=}9B(?ZX-|Jzhh%TVrepRdi&qMBzri$BAgpsfdPB?BkSW>$sd2tsR^nkqVc9CSD9S)Y zC4QU1swsmbPbG?16r9h3(= zceo3vst29aO|9p%AZN&!gwMID^h@^2NLvzlPw440Caau%z zZ^Gn=%x<#Cbks6Qs=}JP8;SFJ6|zpZj*3<(nio%Ro{VTXclwu{S4pv%jdIC(cmL z@JF$&wT(D8+w__}EKwz#_nuf1-0SBC)i0BHr6y*L-+kmh`FfBBMfu1S;JExW&}Ks? zL!|Sw=(i--!egyH`JHXV_LItsQNIaDBtdElOx~dGv2xrEv@+LXU-1&=FPr!~%}caC z@U!J$D}N%^z4qm;Lq=qG*}2zQl_<)*`t;lu*k`Yq6fes5={kN zxjwy|AvO{JtSMe7VmjheMJTi0NCE7%&#%zA#HM|%07b2Ad*GCR>H<^0T!7-bUZ)(p zg+`!)0(=DmI?1Be@2Y!VmIxoH)RSV_l7Gk?IpZ0pcGD@aLY#iloIc(`H9k0uSW`dM zN~HVx71gk9D5zcKTy)dn0gW!Ktu^^qt>fO&Lt)b2v!29~5u(C%2vol=PngGzV`q~n z7@cN-F!mHim)GH|Blfdu3YuBecfu87vX7bcxB$#VZm(%m^ybR0J>s-5fp)F@#vk+~ zzmAYAhkZEs>YnwBai4j<`x1LSy`bXK`^brZ__>$C4|DS{;bj(qK5x(Mz3yAqK8FKj z&97^<(s|=hoRag-d+uB;9C5xfuZ4O9HTWr3MItd{G^w5%qe`uDh$_L}C4XYhflK7} zXm{fe>zLz-lyPQ;*%Xp}N(F6ok#ZT&ECswO`HrxnG+PNO95b3PQ})@(1GFHelxn6S z=%Q&WELegKszqY3wSf;J7ahO5MtCyGl2z-1R0I7+PK=nqex$>=>M3JdcOknj%twoT z4Zl6->}xYS+^u#E$I9WM@sd^I`+ITju2D@u;Y8INGIQ#~egPbk*F6Y}cgNs)Nkl-u zHPStgjusBR9-0{&UFVLrIJO^Ge3u?4{B9fLF|`-(FD9>+*8W-)Gx=3HroBI&A!m); z4nA*#xbhq38Ti4N z@+Ba=>ROHXjy~I|gRBTg(j@p+tjyhb))pyWqP@?-ku0Ib1_EKEToNNmRMqlV(!W_a z**{_7iW`)FTS>M4#7fE`*exX$KvYV>=p48xyDi@?*$Y{0V>@_R3v9eEO<+phB_a(HQvvNmChR@ew2Z&JS6CPh=T@|Qe=L8Gk^ry z0@fR7QW7p)Q9B^D;Y#T_j1){}-6D72W3ThAtz@p>qmmOWF2?$HrAF-sTKP4lD3(5Z z7o{_2@4E*-lZ~hCGaGP%+V4qCc{bdD4z6Y~Ou(~g#`~)|s_bwZcl*Bi9U9VppXdDe zN?3QD1n3k8E7`g`;?9QAr*RW98RBQzA0zeWvqfXh2dbvLJ(v8}mbRYqEl-DDk~KP-0LHYgpQbZC9L8;$i_S!#FfO(_cqc*w#7=6a{K&X)=4NHv zd9-9%MF7;f*;KZ*7q_$);@$6-B)c_TP=S*2CqE4nPK_>Abm0F*qO+IE%^TG;)N3@G zz3P8S*eS-B@jbVP6$=KZj@01ypR+9AVV4*xzcrv?H4TsP^?D6A7xp?-U97^*Q~G43 zOYvX30DLB@S3bRpF0F*>$QA;?;FR17k-~wi6q*0dnW+Duz<+b8ppEpK)oInGNazk? zqIyH|U@g#(c`5tIk7QrwivK60JlpbZ4kPE3%rU~qwpi&Sas7>845(`jf)gt{cbdLk zifaC}48Si}dG~hj7P&C9Y!eKVwGHfY8mw+*(Y6%+L=6F;wH{Tfv^hFGulXM&$%$R z4Vih-xgXa~4;#5jp}RIK?d-BvuWW{Ftrf&$7F(uE;wsM0Wsm@HS67L{PE3+s;EebT zbd~UMah%ds%1;pJeyX_QUFRlBaoIv{3 zn5!O#ksXqC=Rg08inFg5e7{>%$Mjmx=QkAx-l&Wr|9~~a2%rgZN5Bity-HQK8al~B zzh$2Mj%xQ4hp_pvoY=dHQ{*otPSd&GwNYHruez1F>b+KMUq#icCmzAO%@J}#uw}eB z(){XU;JL zKj@fxwG^D@+wmjb@(+wGe5m9AnP1?$&1O^Ne*e7tKS%j5QtlVsbNcc~mU<9wgOfh* zMvFJ3L)7$NWv+_%h1~F%62i0`84#-HANS?#we#^^byd8~7S{w3*Ss*0eMhg)eJ-+T zt#7dGcu+nUz$&ADW0eC@Mv-#XS;1)Rj;enU?6L`_@2|UI7jqi?Z;!>CQ0I90K zyDB1U@M@dGfknxG1ifI9^}mZrjsIOQ-zWQgKl5t2JGAx zKv6F3bF1M}tfIV^9={^KXe^}X5urCY4-?}loO%M%XVC+d`(vZJ7?S_yGbO~$G_xuB zSeHcXhM=+hKcSd>P@462y82m#fXbO9^SIvKSb|^U<=t2*UqG3mfEYk5p+rvmd(g*4lE%q@XECk(fBOMy5=bPUgTHv>&}$N z+DFIK*$r(Qi~MQl%xxSIlMRlT{`Sf{rndeF9Y%L_PmRhkLk!CMKG$%|?70HUIeHOh z29mrRL#ZdDu(5;Xttj$`X|oZQFf<*|?p-4iYoA`oycByg)T%~+GUgRP@#~G+Ljd<< z><{^L)6%^6(#GCa^BAKoD+}h3A_zNE^6S*B0|5?C4$}ur(yoQ~-eDi-*kIhV{Qu?a zmM6&%%RhuOZ{YvU*D(@0XEgs|?4UURjxm$I;tzsOh&IB23AUy?j>6c{X{=0nbA}iZ z#pf)_MGD=?-t5Je#}n{v5Yio(c_z1nneiqe+Y=H^@9;BPkMr zsKDJlHn9u=;StTHOz>g!x$byppFMj^pGMi{ zJY0lQ&PERcGBj3kBB7A+!V5W^qzUF8(wuWtm#c0F;bYMDkW)m~S@N?WdKDsmzPEyp zv|Q`Wvq!2tXwE&d9`9Otlw^*W4u^R(YPe4V5d8(>AFa2mZv7}yA@dgyqia4EZ zdoo+lro1B`)u;Tx-YO@xzCWMC@G~7B{Z`J3a;(%t&xXLye7I-wc40Ot^)EVB#6<-0 zBqtHU81D}W|5j+SGB0Z6i$hJLu$H;z-1qc%paeHdmKA#YX=A)08!YTo&*By9 z$>HtWn)XBYhcoKHq#-X4J78DZd)P-UI+%H8w%IXE>IqgA)9>6wTRR*xxlvn73R?iu zx0#aTEbR1TFU!p`K&Y*b`IKsYa<*(>j-B}Lncl{^WkIjW@K!GsR+ye0C2G_v5?4%&A_~;Hs+(iNS zha$oqMI^lFKEC8VW9Yz464LA0w4yl8hkT;#M(3?g4R<|~jO z0j(li^E@-%Fv`W%(_;N|u4DdhvOFWc2smJppZ6VTdN_4E9R}oJm+NTPTG9e`<29%@ zSL(M~f<3fdVX#b|KCwZqqA^L5*el}2V8%%5-7hC0KRMXdWeEnP5W!uvLUxFJC?L$| zjagYp!mHB-`MuBieBU$h8gXe^+1|G;kNE5!R7#XtvfXkthj!oi*VLpIL3&n-+hJLX zB-&`bcODrbk4$BYI=42GLKZl?InsDG`hf<63$N(c@V*)ar8Q!8rjL#H0P`-sa%bJ@E*+{1B=a>&}V(SzWqzZ-o^f zRU$`(d?~|VzPHbCTcG?EZDz}_#S>`QW#|58VHcd&r2)hK!fqeUYyZm4PUNeTfc2sB zHxBOGZ%Nsg1f#u=gMF}_MN^yEw4JgHyp-Cq8$-QuZ|fXASmr2c{i8rDUgHkbJbTj8 zlI)|v#O9T>zx7JxMj~z_WH(#M#DixD#uRI0>fXp zO;oCiKYtq#))r)Z%L#yf@c_&0)ZPljyu+~@CP8)ghlrnTO)K@8=lt)rm34SpmL_!y zo1B-K?~TRrV7OwacjOen*zRn^Rh|Yx_dsG&4I+sWMZG7dY`R#ND!G|v8`J7Tfg}^= zdngi1=P4Ne8R%(mKvXGm_6(|HY)S4DO&&Wwb%>Mu?PsTB*AAEG$zRo?{x^3obY7do~W43oOebr`Z#Op@G+++y!Bv9wDu5$yO+i#r9ME#v88 ztV`-CR*KC$=D^lQZ7nlnR<9Z&aSPe_Q7Tq?l`T3N(sX47a9`+wMM|l=dSJiR6X3f? zsd`S3x6tvOq@9y#!E5(0e%~8t*9u-06^=ulW(0G%?$+HW{6p)tabV+u_Z-$}Nx0gX zzm`HZsD7>c_4kazpLmKbIRMCIq5ofyi;^1!a{1tF%!y`pFJN|e@9TOkhC9LdsI&x% zOSl069E1ALfh{EY7_X)TMO@T7;a-G(R3ubbknG8CG$*h5Xs&Q>;>{Q4W zY)k(T2f%u6Z zFR8fi6Sp7d79+0T#_ERM4j^CMVJRGcy9!YTXV3pW@b=%-Ju+-io zu?L4XK~l7LTzam2CIwPlJSw3TDp(ehYEfnHiQg+jeYxZ78l`+Dog0;*{F;zMe3RQh zHX>J0nK_>N&UPlvI(r3>c`{|rGDo@?zg<+CR~dOw07(*;EY$iC61>bmj`EgqF1*Rq z6#Ls*0qj2c0_RCV$EiiI_@9c)#5W82-}b#e{{uojdicLQB5E8n$?W_40uInz2Iv59 zUGZ_Su4S98U$0b=2oYwNmto_fOU)!u`b$%lqO6t#qV|L;a{T(+Yf8?4JLlQ@j1qx` zf_cs$GCK=;o}NrZzLNd2G=;p=E`bStz$6fCfnV@7_Wwl&enMV1ibbp38lvGM`75kz z6^l%W4VXYOqx{C7Y9ul#izFNx%hqn;~>-|^;W|M5>yc;E!jIz!lNEaySH z4~^ubWX8G#H6bFT{8`HP`MvQ~WM~uNe!EZbVY4cwe(f+G>trCk@VDC(XzNr*(l8gY zFmc3kBz2^7W(5(N5YUKHr;$fa$KNw}0DYJZ#o(hId1S!xJ3exfS|rX&tmNj|%4TI5T0JF(QB zGFDy~g)lc`4~&cDzPWDVO$-wGR1tq;NQ2AqI#&+-^{+RFAeD*wdY$dub6S|+RQgEE z_QS>UR)x=jDy405KTQ*=xQlw@MzbotfJqc}P3uK@*f6aiX$=~&94Kis~x@;U7*8bxxw`ubVw1*U2 zsu^;5H^0SRD;oay#&YQZ-5WsjX~>n{8X&j=ZuaNjbo*%hKo}Q$%rm@A5UnhCTLSFA zymq*MdF?XOXDR5kP^eYYT?(FbnHN}G;pUK5VA1-&hM&-UPA0R*aJ%*|H)J(bu(TNK zG|01Au@Ca?vweLeX~K^YIo~m9DOuq40YFL#tHKKqf$=HoFh0qG(%}IA_uR)U0I<-2 zHu)E@z|Qc#vM2oS!F**t%rhUR`PbaJ36PO{JUCZ>V+!AAgH_FZQsQNPEfR}g;cs=v zoQvg3U~OYF_y*M;ntg)&@p!TFrgXE}zEW&Mg-|7!BU_5{|G!neU7I?Kj>1(f!wuy} z?@w;qE5G%2rt%p{ta_C4Ibn2`k(6)m_#`su8CeGZGI%H7uv4iyzEE`~E8rEew?r$# zwNLrJ2JaTP7L-Gj-w~_LpQy$(C6E7Pj$HN7(JSG?p3~Z#ZK`rt^AORZ04XAsQ>yD$ zk^*SXL11^CZw7W(zN1mTzB6<-$w_Efktw3Jye`yfut%iOya!Y()G+otBnZ6-R z5Hyu91!m;t$mpP@dnHlZb6?^AjoA|)VZ^s2YK@i;muV)R@pl2KhT)TFTj=4&P;p#T z*s0DjJQHrxGB+ADE!+k%-}d!Xr=)(uO{4(F=gSqLRxe~P+-ZJv&oPMjLVY3|=xa+3 z+OPn3KZr%=x7W&Z#-U5?oamm$QYbQB3helpYrodAsXxQ{pzlVVf;-?VW0E3$906Tq z-m`Tpa7O-7p5SM^TzTq?Y6*Y#EH=-2ea0{yn-@c7w0()xZoi2l(8O3$9CzZo<6!>N zdt=NKCnow-{g9aWqK(DIn|}RA_1GwudtX+yj>fnzHjpmEE!GQe#xIVyl;`l`l#AFfxoHwy^I}r{-Q-d9aozpS6a9b>ZgXoO zd;DaALqv$M=EVit$Hf=Wm*c?D0N8h`52Uot7t6e;-RZ6K)U`Kc!UxV z49WJ-6r0e&?(D=c`>F*<*qL15t^i8F>a07d>c|DbsVw()MZ?4L}vqQ%V zo+1D>19ErX5HozH;``Zkw~1FcfbX^Mmb)J0)X7rXzsE`r&Jp@A}` zQ*6tQ=Uv9qd1!{!>EMU{5B~e28JK#9$CO0Kv$e(Q=Ba&&+x)g}h;S03V>q=UDM3WUNQQ+l# z_lF#Uyy%7VU8c?iiBq*6|4oGZKU?$AODbEWwC>yLb$sW$SwpOyfRp);iX{qz$t^K? zfx(bo4JdUuH`PWc@X{|4k8F$tZ`@E;(p*YsFEYeN%GU;|QYitke^;>Q-dXcux$=S` z@2p|po9u)3E(=lJ%yE{6tY3Nxk~a$fHC|->MQ-r9Z|xn?Wzzj3^@LNsIBhXRo1VE) z!?-{AD~^{Ky)jTkYt6~Or_3q4u0k|{J=LQvm+df^J zV`%j*gOwI?9|9~9Bz>Y7mS?F1xYbAAg=47uUT6T!(y?0&YF!}p3ciYF>AIt4XxeYT z)t|UG0{8NO{-?QwQ!W)7tNwn~S1CLC9%XLDZG8E*mwDn?qorl3TpHZcK!mY)8q=bd}uP?@6JcC-wK1@M%;i&j&q^{B|83 zyW0RFR~^U&tIUYuugVj?N{cammcaS%^44A_`55%pxU(bhmP3rX z2{^~pN)%>|wFvb1=uWSz)}+5O9%f%N)T3N(X1PZuvaETj^t3guvZQ83AJb8fIW|VU)(p8 zo@~C6c!J`pp<@PnzWAK?#>}85YX<-Dedhury*uUYP64mFVx_lfB-Y$c1Y{+N~V8IP@rT9?bX@S~pX09H?E<(mE_!5!f4ZczYl-NI4p- z!xz>3@Ts6e>=Aqn@d>gKeJNIY;~U0!DSC%REB@ExZ#RB`P4<7V#skO?KR=i9&0|T- zdgoDLg3B5K>q#;?s!>v(^4QD&aqJb(d%Glj2;pMQ<0T36lIkP$z*dOWGi8)r1DN39 z7aHaiP}ENyox_mJwO}Vf(GX12yEIy&mG@s3RO*tCI*w?};gK z?!+7Dc{oX3VgPxq#Jn1ShnG$G@HbM>D~rg^q2g%Je|?MgJm7+h^atP&y~&r8+JGSB zFK%b7pQiSS#VFy5f&8{qst7LkPumZHHaWj4lt6w>YKNuD&Wq;qn5`#kI(NrSrOB4* zQtZzATwm$zHIt@eZ!9bLFy1qq+yhGr&e8^Z1kwBb!AEe+++F$F(0RbAWO4(O^KZjm z(YvevDcdDBQo_%GUG09yW^dtPf4Mq@l_QXS{+VJIEDe-Gd)_eQDIGN)t5(`rHwdP! zpkIA@L68?nN+_QU6Gz|)z7wVo3U*bXeP)yEyQBV*;w2PD^M7uELVIO^qgLr#tw zA6}uK^k0nAq;(j>CHA%b>1ndhiu;Nm;c^qkZ3RjBY~nH{!KpMog()UV_Y-(}4WZnM z)0QB-8e4ydR}gUy3aCAg&B~x{_ex?`KFW*0XBrE<1I)`5wV-);)V*R8!9p)ywtV*A zl8HTX@fpm2xb)1viM{%te0pq{WKbIZB+S6ZMf(RsO<}8RH)5snt*npgRcDv4&gXsR z$lPXM?Q_Z@p($He_*(oOl=mofo-WJL%fP5tK{4v}S8Lmf7uUW0L@~wY3J3OjmodLj zyJBSRfb6CMb9{lVEmK5zwC^GQ9|+&~lW&;a3+eG__1$J0V^-UBHp6`_1jz?uNY{47 z!|qck3z(nw9nLJOuyoO9t_KxG@KbiyGCIC+REk0R1p35wTx0wYf@G!aSm{jXF{;#~ zSWN~wYJd5!kH`$VG7lC-ez>M8r}+YIBu_BqOW+sb$ku#v^)UbC?aIF5!7G-xXs6U{ zownQh`QItN=@=tVx-s;;35@re`%b?w=vtIIqc)ZP_o~%wmmXNgV zn2o2VXd@I)tEh%KUK2BcpHtm!97v%@;^=$;otf24y6e4C; zHiw89-RvtDMCo~~K+kjQIj2wGy-TZp^)SsCsHXfZ`*)y#0O%>{ew)CFwvc_;EgLaF!4dZ!0=@JYmtr6k*h zWbNL^W00E-)jS4|9nZ;`(Y7UKb=$VhzHxO&dDOwZw%y%ZeOB9*3_=xN1>@I~X<{AI z=BHjVj#9byy(;z6gk&?WhEa7IhIC46hE2apWwhQo%L6{B`42zHc=W3OEBas7S-tdQ zlaY&FzCE>Xmy!ZA>yv{S!)l<(S*zeDbkNRfMSQm~wIoBzcU}HUX!xXA<4bLI<(&u__BQ!+*Bfl1Ha49F32XJ& zG_ZUV3O93aUNI5y&eHj?ERmMkksGa5XEEV5?70$hdxxWuV%V%e+{P=wQxYvd|EBa{^ zZ`3X72@)9L%Hm_#9&--AQL6a-G0D|CUL0rhj8pl9&5bhB(n6@&cM~Ez&5Zq4|B78m z?ZG|zC|){siaU-hmL@k=eKziaEvFE6iIMn5_R>y^?~1_+_>{-ost3Jklv}xWvZOM= zuiZasxN$`6i>0I5wjt8)^y-T!MAz~;@eiE;4P$t-&hgSq;(%X4ignW7=T+-e7eBX`^$kOl zMO}$**EH((&!yd|8D^|^kr4d93^egHpNO96jFfGEeDULf;^v9}g$GD8_L~ddiJ}no<2&wk zJ|jxVVmHzC0N6dO=S;+OkgGDXz8c*=bx0F|@zuJ6fmCJLzOv8nzFknTuo}Ff%J-RC zQd92n*Xb*_bh#T>XVH(gTiLijo#(!@?&o*5ER%|I^(IRi>vbniT07T=GxLS4ELdJHRlXB(q9~A ze`G0Ha6_-ld6s2z>+N?4|KwG9X~~ih&P>f$-8@NI^XU#z6~vMhG2-_7RWX|HzHKuG z0vFG}me#_5TajNsQ*<)=uDQrZrZ%Bh1GgaAl2qb<-@J7C-6fNgqjy|;aB)fZ>f^}# zY2I~GKi+B8SWNg$R?%!u4=PjyaDV^v;}RF)c86^~sdI(h|Mko?wz!_2OEO{`i*h^_=9u#>5ouc^ zS5jjF&E80{hD-D*GCp3rI7|Jlu~Sm%L6HS2jgYF%#9g4yG^*j#DQ0hQeJ3;4=Z?hc z%M#ry%O$%=MK=Ro=k&Zg#H2sDeR@Z7ozt;;8s{g1Rs99D`)BeX>?@@P+yd@wt2_6c znhO+s>z>w+naIvt{*}iuWV%qL)e3=3UuFLefjOm760o0A=&IuD+h!Vkn|pMoB3rcB(QKI#XNL=(ZAQiB=tSv- zjby)E4rPl&@LwKYlWv~-s1u)1zbaqV1zs{adhfsmiT`ZC$;0E+WF>$9t&4crnym$5 zn%ZTe2))baJzIR7?#(#VEv}_&k;hbs9CPJDEyO5gBaNd@FL1l2-T#rBAZb*RXEnus z#%1zJnm4_d@5knis57Z4^8I+0DAN?ucEU4kUr%WwK56wLIq!a^&J9}zevLX0o3eph zUwvFRgt+owBXrnYTzxo0@5{fG5EiI>`_nKgQVSx0>SozOP(f`o|167-k*Uc!j)9fm zcQLCk?^{{#yIzK^5T7YERnlqCw&q&WhlStf<7?m_!GmULwhphWQ_9}&9nn}%D;yean z3a_^C>x8YG{iw3$M0K6k3|+cVI(O4%gvoO*WUJje&qKQau9Q1X>mPc3XFFN8eFOEB zaFFidUw>AemeNIVJW3a(AN5LkgxFnOjII~=`Us`=^+nGRBr}gDhS*Z-?_}hPHRrkr z?h4Dq4UOH6=7bH?y=yg0l2>PxSp8-T^^%sjh8cJ>8M$sKyLPfsPnJY%G#83w72pZX zmdkrzZMIX+?3&)Q;(k6npm@dkx~zxhC5YgnF1497F>~anr2L5oirvU}J9VcOn`uO( zNz`Qa(`g!iP;^~xfaCJsNl1OYb?I$Q5wZ}1LB39rY)AX(h)y4)V+i($n7*25F@qWKw%X9k> z__7t-wi?-Xw7ABMI1G_K@Z`pB%ws%}*NZd5u4I!S%o2u}UHm+eRRnfe!}~1bs#y1u)OlYy{pbq4xkvqt=`SH3Xg%&&@Vvy0wf(hPKM1AxXpiLc z{g{TVr9Bt<_lMViT))`5--8#pW{XQbw?*7OTONoR&Z54jhHMwyGDQS|wkrhLmNZ2X zNICB5T%l%jpAuxCCYZX=-+F>O;GXwzR}#yXE(!DWu~p}EG^jSFgiI||!@H&^=VPRE z*1d6qET`f#FJ`@)j9|Rm-atYvz1_Opz9V0g3=_E4bcvJy1c6&+UG8!+;k7sO7GFxto+4hDXOtXN-H(mZf?d?|oxPCo^e#l5b+eqPA)Ynx1 zsYma7Gd)^w&_<1?g5bR1`FuF_0ke6?nlMB~hmI%Ktz*8+xUGh^89iVMBtaD)x3s=V zvbKiFLimna`K9GWvIadW8F!>4grMcsB|ZtBmkylvab8I0!V4-^e{WVRY)@udI1iR7 zr;!u2Mw9X*AFZZ6)d#ePm8ayzw(|&y&GPngP;otp>Z{*si{^L~ z9d<=AoB74W^pUx?WW2O?QPqp*9~%YQ#;h}*FLBGfd==562G8^!x;=D~A&5`I|LvHn zikrFfb2`STiQ!E%%-&V*<_}!&hh_WR-6>t~JnWZUOm{pc%NpzWc>3$ruBDAv#7y!C zs1UP?*G+Z&lLg`5)5e2cWH<=E%6iHz>M%y#i9VkQJjYljtO8d)@874~kCB ze0%q)Z#5CheG*K;QU{X5hLc~9<-9uAPTV!&V(K^C$_%!5wS1I1+9G^+CdteB*2Iqb z^AwLoF*4|B=5(%Fk+fASpqt-V_K}sf7Eu63G&~eji%Am{z0ADa!KPR%vj}rn8Y0-2 zimNMXPS&XuwzLctWQ#?;g@LLep~_|l6)7B^vbxxO+S%TRJ180LqZ_g3z??%6Wl0b( zCn~2F2XPH&cXc+2L&dC6tRf6e9_dWYYMJkEG*8Npmi%o7IVMuwA?WaaL7=ZB*~fG< zeN2_rkk092oJv~2U@EWF=Iq=X4>-~NoKbvWIk44=s|Qv!63h3t_*#R4roV@5TVM`# z7Hff8;g_5+at$hGgBLSD$)f;%)ed)ys-o3`G<@JAM-yWO0nnYv)g0U%9fv4A)EFSE@S#wa>R4=SH9$s8=rV_zq1}?2%>~+ zR|jo7&zUYVpwB{f-<3(!5qEsv57a6)O{!k3eB$U?TVg%hydXMeMk3!Nbb9wt9cH>1 zF1yCh$*I^@3|>o7ZvL@spg@~8q$YlB^c)l->2Dfu&2aD)t(@kowOd#jQ^kH%O`xMr zm_Ml_L)L6IQUlvNCU_%T*Hh<-0(i#F(gY(*+=Kf*&pAfQ5EmK($5fQ{*Ai;|;-*%d z?bGlQe55r8mvin5&yWrs AYuiu09c(ZGLaL8~?&q|17O&n8+>8YP_Y>(GPZv{$$ z!B8u{CNn#Q!RoNg6?P^;7HuQ=DKO-Uw8OBi9U}i+A=?<+lhYU!3{a&Jt4t=qri$tT zSB~X#4n2#%{C}y=cZvF*! zkOy~&RlC8LlW(uvTy~GQH(`A&+RfE_{-G(Jf)5!AIDjJPp~yE6TeB4QgKk~bbYZHZ zkfI=-y>>nVuYFtd#2^2PHl z2uZ$cweF@e+Q+AKZ89oq-1!+Dgx~&}bBLF=8DB?L6y2N>bISuTV3BV^k+B}Uco7g{ zVKJZ^>l>Zbod>r5nNO)g%|Mm*? zj|M;fKpjvzgnEMlXJsE=!%a3cfI|`r-aC0}IkxdF*xjl)!WYXM}aBQvKWZnHK-GCHq zzp97)pwjrz)z%N(!%-4K-0`3Pr5S zpUCr`RVk#-%kDYi6C7D#%8IN}#Y#&^(R4>r4(W-J+pvOOuSB3(>4s1Ox+mgUM?)Gr z#H{*kd%hHVau_~->pQ?X^jI$IgzI{FA_b2-JodR^hEq=x%Xu*N(Gq2LE~tBbX*dQQ zh}SSp1itEsR}2w%LyP*{4;;hE3EKr_K_pcy+G#I_HVgj2j&#wVc(G zMcEv+NfkHN-D6ltlGrR-%T5ced`KCQ$h;x57(&p8@%HRJWqoPaGldou3CEuW7AwKzs2)~0=$c-blOMa&!GAg)BOQV zWpj%*J1SrmQ&g~_#MTO7#uJz4vWPldV!S*u~1QTVs9_kTP-aD^}YG9E*{l9T{OMpu3lW>pS9c&&I@3waFAPBA*S+Ibnu?I1UZg6QWm^j&+( zY7@S5OgT=$JwxVMuRTDIE(v~8R`P5UTN)``IYmR`U(wmC{~8fpQaJ078q|*0X3#ak z-CUzlzHw<*m;GTM8R+~gE9qAT;Q&I_R)bEE+X;hJ!zji9)ra;d&#i&-Vxl^7cw?n9 z(rhWH;A%ovoKtPFW_yS{+S6rA0WMx@XeELbKK}jMNH;Utvte+x3o)jof}2nKc)Cl~ zZD)OVX5;=%Ny-tz<+-!NWFA#a7sb~D`iTZ#F%%SuLS z-6j>FACg|;ds8nb6=lnYg45UFd4c2y$NAn}w&UBi=$GHAMcS3_H9ndvOePRKL2Ty=U6XMF?o4o-3ZHZj*PB zlizm8RpzTmB&)!KcmME6sVBf7x`&;FGz$EL&<7R(qks``YT)Q@E3S#N0{srVKuw zuc?_zR3t+rMl9#67Fey-1w#?Z=LUF@f${@?=e%J5;JljB0HEk~_$1HqqfwAhBldP5 zl?u4CpDjyiH@JKL`gV-kEB7FB-yzA;HaFVJr)K1j8*BW0bAKHgm3L*hyK8M4j{!UN z3SC(6C>Tlpl#vrj50q`6jAArO>l}DiAHb#ZUTs_~;B}wo%dEH}#KkwB!;zSeJzsuUZQCijsXLGt zJs%!sZ?BIPPLB;CgAD-XsXFsa>TqYrD=XMsIPyibR-<>kNy5Ww?KRyT{Ye|;E7|w> zQbL*wgn_8FCZXjMyN12CWpDds95)zM8|uNwc}n;w-sA$f0y#GAMeC4c(Jz_M~u`Q2h2zw9S$ z8__Q=31d9@hq6ov4st=jCBr3)_>>;}UhvoDaaEOBOd(etiEBo(JX?^WLVbq#a<$rl z3|6r+#2&iJLYbKZQm_T*SijD^JWO^}yxv`t?NMr53>|7PA0(A{jb51E4DgE13W7cm zhLpY4Z?@iPdYEXl{jn>_^K)g-^`q?WNyEBUy}zA-#L)2HsbV%YgZ#!{z@Sec`F|NH z@aXiNLf8lf!Fp9)lqsnv$Q z6(L2az^PZ--kML&$Xa(|?~s2X|kZI!oQOpp-w!$J&jw78evw(?V^0@`|m z<_i;_dj$5-2lC=l#CX8^rLIi&Tz;8z(kqa}xD9#A_qX2rZ~v2n-<1k5d`ou5E4#g9 zuLZ`Hk?vZqh9ta^7<_xr64m?rn5>@j?|I{&VQtfP35YLk!5;VbNtPs$d=)9ZLA3#H zziBsli>b|Pcng;JEmTjL_RXs@50aa`XFM0h90hpuKbzb}>o$cvjS^Ztihnk4w14ySIMl_gCpB zeJ>jKnK69GF6-4YH#_bwivfx6KZ!9&*g{qRc4H{{>7S<+&rAO(6I&aU8zb+IN_L6# zndkd8M0Or%884ov>i^QtmrTf_79Mq1l?ewzLNAablCU(m3)ib^A0zFWa6U0?Om72y zIzZWop}XJuBc~QQL3>%l<<`Ck0ISz^nVy!Vyx+3c?rH|vOie6GR!ILTi)9PClv12O zsbT3_j76TTaCW7B;XY;&E!MRIivnPk;P39XjGM7Y4?FFA@At1e*cWeZHWPPF80+GF zy`m%9I@Gk-A*|vt#wnp@I#YIQmdd#M!lY)~i=mAI4m3*4;r2xUW*Z8(6kH8*f4Pq}6>7HNe-f&Iyn+tQWcsMNCX;i1t^ zwnM{#?H?vf_@QI!?;KHH)H8{KLyKMYaL2lnog^_++%v{aWF~cFR`)*c^j_ErN)qE< zuSDmj8<&dA6;STIqqEp>^@maCxfMF5lp>XQ&EjSN{$aEhbSM8}MY5fjqV&jO?j6)f zfHu=#c(Ce!;lVR&t$=#IQd1B1X?X^^e%uk-d12mMm<18saMtkbOmfHfTJYaJ^xf~j zxH0JG6oR*F^TTZAfRAfnD|><{Pe#lGUW^Z0Fy7r&4TfM&`+ocHIoD-wMi;mH$X2i$ zztLRs##O#fl=oyC{y1b;Vp@g`xroO&HpK_Yc06yUUtQUuSDL zzIji3JDUr37F5Z4Eq#q9nQX@Boe20qm69i|qyafZX7%;j$c8Z+dAxeHP(Bs4wYt}? zBJ>60nn_*x?G@J4rq@$fh|Yi$Q8MaXKu~9?feno(L*LSdzWScN zbfv0Z#yIKyFP>A%IZ_4Tg69>xW8Kd}-g+=!@-06M@C31${qv*zN2;3<3=nqMrO@cI zjiHGyRh~eDMCH6B($n9V0QBp14DG}T!=fLQ3$T$&WOy&b!yH*6r&2PNI#QZWGR@tf zk(%e;j=V%_BJ{YoS%>$zKu)o3Sokfh9RX97)*L;Z*lv|3inT8{$k z;mD5?WEfpsmI=r)xsehhtLT%$dapcw8KJkERxS-Ddl#1srfPafB~{sA0tWCdb}UmJ zXin}-uwV)J+R3a}tUKT#B%vpv5ZQOS;Kwy(%jgPy|+PdBG^sJ#S0wq#9m zjQriU-FNnQRp!UNuAHHGkCvlTf(av@HO6x`%Im0My_AsS|M9#S$~7Ak*#31kAaHuu z`TTNGP|)O4k`%NW23edj`Q)~7j-nNm9GXQ`m0;vsk3NZ+V$Yp-*QQ#ZR_-tHnK_)a zbTURS;RbdVAj5aQ@L&bJM@WHu{Hb_ymBIjR_9(t3iXYy=+%c`SGque~Rn!)*I=u`! z_h0gX9~$R)v^f)x(%u(*|9u5Kj{&T$CSA*lz^|zN_XUWSq>v3bFXzg}9o)$yv<=Lm z8#ZlTvB$HwRXc}c#qO55hnPcCzuLP(61YgBAuGk3?P=c5Y3RijORlKm_TDq1r}8YcQ6WQs3{0xtZHO z3szBhgG9cpaQ3mQZFJe&KA;iY0H3VK?M5@bXu^|zxbH&p*r2y}@DW-g-Eyo^QqHO# zbw^R}m>=78ko=O8sXRkK2ZX}}))?FHr4@xPDywc)6 zrR>E0^*H-jL#UIEx~uYS?`2%@wokeItAkN-`t)I~`Xj0_HV;oXO$@1F0R0*L zoTn+Kx)I4UdN=SV36mn|JK=7OcqilRbr#5t@qlE2TyS(gbM*IhVmBq!!z=OxA}P0ow1q zkM_TbpEk_$7C8gAY(8BZcVW(XO~7VQYb0AGaBmW__Q-&qA2xf|wIZ08>L4Ql#x5*` zbX%ood3%%HR8DM%d4Yr2Gb*%`um{i&1W>v>GJ_7L6bD)b?z5Yj!5@MOTY#jI)NS9r zxWmCR^+-^jyZlTHFZp)C+pANG4spwxDmM}X8c9`z9~g#7 z*t3h<}~RN%9%Q zOJWIgwDs)#O_Pt3UMC2}KzUWX5p*Y|l93C?|6-}bRgLr}b^f0Us~GC%5lr$Qq4%e& z^AcEcbbc1frP%Pi#yDRjtxz)3Sty@z%?fg-8uhOjmPS_?EQD9PO6FTGUokDgN`=;U=_?0k^(Y^hh1we9^G&ZjGKt z4PIzFPcj}+>O(-c%uYNkx6yVPU<`%#=ov}sE>5g6ZjY{XHnmc_ zx$uhV$sKHOOHzY*rhV^GzrorqidHgY3X_Ol?#iUa=5h5ZJys)6SF1&(eeTTawFYN? zBqC7n(Bpf6h6c15FGiN4EUlM)1S*oi=wRvUceQ0qqK<8D;?avhT|36Chw}PIV_xOB z^&a(}z0BF0q|J$9gZY+S^qR>0g?RZ6R0O)l=v()i9!4i5 zYkPoHmhH?=PluN+TB3H(lFZFn8G7yR0vb&^%FEV*H?f7Ge%AM^9Jam$y%~c&zAtk$ zw#hJr;e;VI{(KRlId9<+W=kps@o7w07_`f@Oi9N70w1Z`-SlSepZoLvnEYYn`}kXr zdw<&pLxg_Hf-4LF31d{FJy1wf)Ccb10FP!!PYL8WSu(DQ72gd{AF?`(U-o7G5x*T~ z+I8dvH}m8|=h7r1pmx+AR6!R?c*r13z-{)Fg2w`>@wZ{PC{=JoUvK(clM~86dY6^$ z^H4<;$pWPuuu=VNZxeZ&ifn*y zadV6$A-;7EBhC!h#|q_)U55%P65kB_&%rI6{A-|V0Qn}|wH_osdE2^5PHV%?YS`d1 zvm-)areGmWiKqO``SM{v;v#kXU0*;7zYx=JjPMOJ_EsSGG2bKg4i|4 zCX8l6Y1~-=N}|Pfr3;_AFb$9K4oY7EEWBtNyoVSduQ&Q7aI_J5F3UnT@ZC4}R(yR} z%sz!CwuFzzuA6^MxCvOa2KH#VzF6DQ=4qPLK+fQ$xhYMwwBNkHuV^4!SEYD{t%@yp zi016ZcW}9)#I&)wA0&nzu`=2~*^d}&-4&;?GC$~KWeR1xV;n1QM~uI)X@oQ#;5F02 z%=Bc$Jm>ir>9GBGGY>Suv8dCGr>`0y-MbQcV=9_n@d(S7R0|aXpMdzCM1NUv#?SA@ zXhT*r!E87gEjk>tL$r9dSEenK?D25&GREhgEw(o3W~J;YQtVTpt)10X*to^`>Rcji z_v}yTs0PZ~B$^skSNFL;thJ7ChDdM$WpZcOEQr!S{ERL|YOLyM@Df>LN6}$cl6|w- zMjz-g^>uo^(kD1|!K~C-_?xXV_U$oUl-KE2(Xsev>+C$E_2n<6rg}q6}1JD;lo(^gzd4 z!Rw5^h0kX<_O@8bVy#z4x;qZ=7WUd{QhGC}!49_sWE*}}>NvuCTDBJ!J=<+86K#0_ zhHvYOr3jGpneXk4;OBvL2QB&F_UAHeM?^fWuLe^VH@L#&QqZ2WmBua{DB-V8gIzl}~W2QI@Lfw=v4 z!()4U)*P^Xe}6XS@{qp)P`p8rWcv*!CZuc^tB0qRFvDBnDRxobMqlxckM?OyE24+) zw)SSrzFhi#$3s6oZ`5^Tr{6TOQ^&v@XafOEdE*!OS-q(UCmX0GE4wSM&G%H^^zCI8_$8r_H?GGtRsFs?mvO zadzw>?&P7r$ThL?)J)25^Hx(u+wQULSZBr+eb|N1K()%eLp`nTS09eZlICP^$+y7z z2KLYFJV>7r7BGFAhyJ<1J8@W-?CBi$o~DmRn`|Xd?$s&Aaz;`g-%6M>WXmJrEyo0R&F6BP9 z-efa3BdGMSw+N(VNtX5Wpz`3gbwAZ2Wz&vM@u@2T$v|QJO(DL>SR06A{Dr0ufN~jH zNzXk5;^KZ)%9H}&F+{OKae@w<7XdVaQ>9Swr zs;~z-=0gD!>UP2G9OI_bZZ{)9EHibv9G>Y`;r__~=ESf!=G3Jr5EnCtUTTEoOqLC_ zs+ou~spooJgihJL@A3I|FyUOAs*H48bj>TUv?=The+=7*B0Y);7oR3=osRMfu!f#s z8vr_rOnMy&JH=)}f%lGM6x9ypo!V=oxb4_(jh2|6<#upz6^nWoRgu}#Jt|dF9Hd&u zEtH=E`aEqHxV&9F{>5}pO^xJ}eUMC3#{_29UM^ArjpPxZQK(Z3VHyOya(}s?O0JVd zf<;^B`>k0OJ5-h=G`C)m<$!3$1FKBmq_cBpl`r6y-d{MwV%!CGoPWonRlYBIzKKAT2Y;)d580>=(mj|HE`|Gt*UU4ecn%<57+^K? zaP{sy5@IIbIP)ZPQWS^CJn6p@$}smef)T;PwU`#_evz{X6u{h$CQuw~>ROiu+2a$B zo)O#M0_Nc~;p3Hn7kV`o(4`x>=8|sLfUZEB&N;c3y1kB15(tp~-RhWTHbx2&w075& zYiKiMe~e_))j7&0>jCCxj^Qi7xw+w|YOjbU#8Fs(khf{KOLckv5d^)TlYTV@%s_yh9UQ z#Yn;8_)mfZt#^T6>vIsXnK7pxm|8?G%*z0 z5&WVm60!GYimcqMUCl&>Dp;!ab_u=p5SsgGib+%0cUcGmppmzk&YPGO94Px3CY$k5?5jY&;sDFG zNM*f}ZA{421EgZQ`NEmKFkYaw%?ei97e2Q6V~{i6DoLGurssbNvSxWEfjxnz5P}}X zc9m`LVHe0tQzrU1k|eQcL&iJjpXwH?T$mP9N2t&hr=BY(GfAy1w%#9N{~9ii4cdoM-v+BU$V zrt&sk=JGqm;W!VZL#epKnO70m@SXTJ8a3)O_Tx{5xR50thUX|TniNI{K~o^y_~~v6 zr*i=D0qA4MBmLO7r$Q}^F~{!tnroi*%klv4IX`q(qn*6_uW2#H4biOYRacW|G^mQ5#_KhaQ;V$xtC{h%aix&clNN#oQ!>)xorc{_Y{%}601&V?@S zRH)!Q4b`@y|AkVsWTBr@WBAXW9It@lOZgXCJTC?MG2gtlMT|oa!kr`b`u4cyweI>^ zQ!Hu$NH^Q!gQ&$Ob$Le5Jy-UNyM$a|CzqU5h)u~WYKOOiv)up_SurqE@-v0kL%VPcxrx0NPA8ioW?_M|yBlzLSdaW9(FHCGXrq{Ox<%#(rP3J-@99aQ646JCZOhVNpOp#zR4g-><0g@Mw$r+xQ**9QJ zp~;Lnfy@|?7AWi}tnSM(|8ac)_t3p+GH%C-Az4~FV!0?UTe#*h>>PRdtqW*z zTtgk-+t2l6-88PT9p;r{?5g2}gq}|<#|BUvuOmbpF3w{nJuV77pfYRjlWEO_@iFh! zWXBY0(k2$wH>rB`h0N{yOWa9Lg9IZ#V_>53pTg5LKfki21C6mM@8LO)AGY2$+oHM6 zl>iC>R*b{W`&NwkIRh^Tz^1W*<70K8Q#sP38YJ@`287atKLoj7?%-qmQG(O)h>u|@*{QuBu zyE)+J9jEi>?F+*fo{>klQWTDz!%C|=tr=~MNSK|4IuLO~?TExZfdekdF~Ba~*izmC zySYl?cYZC~!RPXokHNGE$NmK02$?ZE;D*>`uX~sILrzv}OQWiJp zpI$Q)%Eey8K_|{KXHDS9{YjbCY*K&rXES)`i{8eW;RzrR6Lj!DYYKt4*xa1TT>w{7t+MWTWojV z^tMV5C1>B^%nFxMb<8C_da?A58M%`7KN!v;L6bU0XOk-2e>7d1yM;UD4;Xe$Yp^$} ziqYgtR*q+!?W>7!lOC$#E~y5guB16^!;=rVGTQD1AUDQ67vdv{-jG1`tLWW>pLwN? ziu~TO`ipFf?ZB*X;pvjLzq8!_ERC~%238p*rGl%-oDg6N1cJE$mTlO2|K8oGRsY;c z>jUM|>I{eabL0P#UEO3%8{uWj1#}s+PB>64gifKcVrOx9MR7&7Y{sbQ78# zm?t8Rzrg!lOnbW%H;i5}d=XY*AdOVi+(b@k*(yH^P=(=tKSYxZV{N}#BOyjVmg7NVq93j>o4(m8Kr9KM(W! z$)LGu-Eqml>V2kD;aCvN``~mN4%{K6uSI;L9_KmDpqUS9RG0G=W*r95ddWp9%dP%W zf>IZypS2gG+XOF+WID=vN_t+}C=G8;JIK3F_ji`UeLq@!h-qz%Mq=-U^rqqsw4rv_ zQ#?Dwu6U3as+<~w7?X#I7(CsFehJ)RYIn5Hsm(p!*Luf;oi)KnXN2a7DKO1>@QrQr zwQRTgHTo`O9g%VSp{%YZip~3ej9S{K1<6Q*c>!N}t=p~=Pl{!GL-FfdUfD}V+n9Ah zs4XV4F*9Pe`z@A@-H}w1mbw|fu)XXrQ+sO=*NU&JLvxMEqkYFY5_Q1&ESPjO9JFwa zF2-~%J?QGbj$IAlY|oZrbqK?IIGrv~#Xai{5(QscW6f=C>j9oLDbsj)BSzX9{aL`7 zx=S;q1$c?3DOV-}aOywoSTSxjIVni*&z1_k-MBB-Y3WA=Ds=xVqcF*Zu=cAJB1J+YUBrDRaDJ??DH-EZwM7sd~bs+jCv#;`A#) zQ_oab`nkfW;sJ!cj8NeCsrG0=$7_i#_?v;6FcE21o_jL>MA|-M(s2!**U{n(@Q;V8 zceFi93%KCMK_)9)|j9{jc22AB}}1~dCQD0 zk@aSC5?-)2E)*eM$tr)8WT<=(u%!QuTT9q>QBmkt_e}_C# zJg&ZXQ2lZh+CbUp7J-;C`$V4HbgD~6=AHAj8%=$XCM+NUBLWqqUBc^Fdq;9sy)_~w zdg`O3{j=bfeSAWY9wdH+t7=$O$OohzH`aD@0 z`GwxbyZPw;AFXPr20+CSnilCYs2%;KAXpi3Bd~Gui#siC=xlRe2FIHqrgnjljT@3H zq_i6}>s_irV(_h{6hTgv+%1~88YRZUdbA<1eT5f`=X3HgV-o4gP80O52&K+EDyfCX z6mWR#3+#qoA?M*1S4K{JYuaq|v-~ zLYAc8GYNQtZv$VBIucJlp5yX@%>}Bw1|4bmwVk^Fqwr&-_X(CSB~-q<^MEdc5~(nN z6}ln3Rd_MBu(7}yW3KwQ7y&E&sK80`{3P(CAiT(YU9r$T;wp!Q}2Ri(XSO6WrM z)FbXPG})eIErfT+)z5B3zd)5XdgdH;0Z~2#t&u(DpYIVx)&bxoy?JHPvfb1Arw_TQ z6Yn+;^te=V^-C5eJ?l@!1EInN-1mTTkOA{P)Onv&3j`PtH?DQZjJek>R?Z0UYSiBu z6pl+&OzI#>tar)geutYy#mNxygRgZl!v##b#5=|`dWi4T6VYIsV} z%COg^MtBNRF|ddH_^rD*=~hyx(J=AxnVuENJqbagG|&&qU(AWHsg5D7!(xU}DM(S7 zJI!#uuPMQDLcp@2Ky$90aWXE7O!B;G&HlH%#^vjPg?dRR2n0}eqfdTmQF1CsUP_8m z$mZ$#LnlTZFX1Lnx~YTsV(3J}7A@swjxt809DQ*tlIicErx7Q#8P?oG6{*a z6K#au?EM3%(^guREQX0Y$y?LXR?>z-lt^Bd)30)l0xlp?raT~!7aGjyme=b#(v`Nf z^~T*mVX!N^OZ<(4dKEd%1gI!Y^1lGlKj7Ie92P?f-7BMIaXjczOj%{10-MA5-u6N< zyyiJQ-1gB5{=>{`)Sam79zEIhJV=;qH5LTwUuCaEw<7vRU*>kR? zg2m44+WoEsvH%oP2lhHk*YRf7YrWn&h2|mFP?}z zX`pZtLX;k|hc7&8J8r}OGUZB(X)hZSSi@--Q)I>`VK!Ym^K-lZ3(Zf;Qk?@+L6lu} zh5+{S?DT|6#U7O#Q;ku7XFxPsZjWK~kK7bGF{h+^*Ox3E^*pfxSX0{TYDd4IxQJIq z?d)yV)dAZ^z{r%+J`>Ej>YYtEIjZjDl^1UI8usEJsgB{}A1^TB4McKK*G1x@eER3P zEu7v(%89#R!1tj*tLKWk{+!Y3T`E(oW8P-OyocMHA20h-dEgy_ED91|I+x2H?vCjP zhP&LVsK>Vedmh%9E)Zpn?KWgB;`l?^_f`p)cGy^ox!25W8COCw)8)G-QOl0zyblk9 zius;-8+b)!XWjo4%5P7`7vGnu4rz;`MLk+0?4xV%Zr`WgoqmwugxWP(mH#~CImU@0 z*nt41)A2fAXs5OZ5;)fex9sB!fzq?u&5t9pLY@UsiU(8=T)Cun)7|d^hl%|eAqSsJ z|8U~uHwyfV(T$e^4W%PtAqFMyT_Cr5w!0|54x)>U5gDP|7OE`gAG^^$#)sa zA(?**9C@+lp6w&C%+w$mEsauntsXGG=)QnKv?-OdgQP!8=qWyjf94LtZpaZb+jO?|KfDBmy1A{+W*eC zn}6hqi3SY%!_%?E9aZ{g12N4YOnIwCBsU6+~hMDDOjgCw~x}! zHS71TQkNe8*ArTHrQ8WFC?$bI3slR*fsllKlY!A6YPt9HNpx z23*nvAO1Zi)9kpjM+nwC+=jVsYH2^DYu@>h=X^S)``8Va!buIFkUGOe}ae8!4*j5dkIGww;T_7ARK2UiZEI{`2C$^BTm1XE*Kh`N?>b?Cd6=?A50^EF$~_VmuF$@EyF z27x%aEcHI(AK{NKtKkei+M&H?eu69pf&gS`S#Qw;ojZ%3&aJ8vY@R_KCp30JcM~~2 zOKP(b+EVZB9HJFT!-q(}LN-Q$G5ip|ZbDbjm46S&McIK|bZO*L%m(L(iUMm>)j21tNSuqCLqnbS# zWU);rtp?3kp>f$;~0`G%_cjx`!pZ+A0%%5g0nER1x}P3Kw+oS zF=*u~2+VB}!MAFX^L7s%p_v-^k}M|RG$B$-hfL3R1inHIAI3bnZe>F9e)5tmUNJ<>$8oK+34UP z*)@Yj2C$uO&VcQ7h1Yj3Ezc&FQYUjf+hdICCEyDeVqSjGLbY$$(RNw-lqL|0~1ActWd)v{l`GSU=gUMTlJHqqA)$HS)y-(ASqc;Z{ zf*%6V8Q4gdzdB~@{7bN)2F)j>dyTwHo}-t-pB4P)=!oJPCGk*Z&fWqXoZIJRMoK@P zmpO@pcvqpP-~BEN=_yl=no4s!DWKM)$bEXnz0=G38RGzK+T}JE=4^+-0E%nw?)U|i zx5s(R69h*X5bOq~CRMUW0VB$E`HI3`H4x6zI5=h=Yd8CX@2Hwu(?ErBY0?QuBE+nT zx$%#~F|Y1LyHF#3oBEY6Mzi-bUc2?)K&ba$; z`_TWEO#-SVZ;NH#J{_kx;>x=x9JTm~w01CbW;VsN<2Yn2iE-m$(TF#EsQ2x9hx!X2 zeh#x3-08ZCz^8>7yTka{4c_LACyLbdU+!xhemfF(%YxI^}r!E&>MN)t;Y|Y z)lv83+^6MigJA7#|ICT>d7pE4Atm%QEloB@4HJo+RG>B>!5}jKGbIwlkIXc~BM$B^ zP^9bvr{V5rhSj+`f_1&VRYo-r%=`@a1R+(kDsbw&^qz$6?_Y+p7nZMN{xTfS1;uC7 zFNBoMIDXPsK;U+hku;QgYyt6!r3eIDco;Ur(KN|&Wc8VSZI|HcY04ASH6r+-f?-t} z^b9Jr*iw#kd2YAvvoARxW}A_G1SmaqdTggp?L9K>2n|-blZzy#%gI(-9n*40t~2F+ z*Wt$f0YDXHP4D;0K#raFc)3Y=ML00?HFtbPrW@)Z!k)CBIQW+*XXYC`)6(khzRuMt z=)*r*Io>|$0~KM4cvxS8N$2kDnl8vanW4B5tX}h)e`Q&KCLf z2=Kr$a?DaU{iGE_Sjp$T?@sqjM1SDO-Z727x)ax;vJ}+n zjzN)hiOI9C1ie!rObzbK{8~gj)Wp7UCkgnUK{4@rC#!rMSZ7n}E7Q)cy>o64MBgr_ ztvXlhs~g?#tf39FE@l}wut#}y#aS2MLZ=pdc;Gr#Du9cb6J&aIo>8!9w$s^a^VO0N zd*WCj`By%u2B*0`bq2DAY%~$4CwZ2gmORTuNhF_}E;o;DTnX?J*y%Y)t#7DIj@ip5 zzIV6{iy~KETSxZ&c$%$to;jIgrJZXi1*U@5epw9DA!A@Be3WoAA(0l?*LC>JYWK>Z zq%`Yr7`msd?JZ&mVuvwXvKg%2#L>jAvhj@54{-~Q@eG&aJ)-UprnQ#$;je!71(z|mIowtxEpL2<7J=c{wZGx93e$ye2L95cioLcfbZbru zhX~pZPY_UU2YKUTv3lcT>9h9(+h^bwYL>1o-MnJs*BSx=uu}QggM0*XBp0O2_EYam z%etJJ4ob4>+Du(lpZC1$fAtHw5dw*sW+j0XcuHAnMJ5tr*RCF}`E5}?9iFXp{G{=9 z#;{HgUj391H6LB>_~rlF?fyzx@E3II9i7!`D~+khr8UN@^fyL~_AU1dQ@bEw;akA) zhl7DG!B1#6wTB}dfVq=OV-tZ6K4#8u1i?E5H#1Zo7#Zu#FqypB60%Ed1D>=@f8wFz zm%aXGj!OW^pV+J3G{>nEO}RXT&!FBQ0FeV#*cf*o+xID*)7i^FOlw&=hv62R-h4-J zIZHDB{jKX&KaPVmf`J<-5IxR2z^4K*zh`v)GRm)ygZF|kM8j|E_O2~2+93o#d8tJ` z=b+C-s>pi*ivr-;#g`*AX**+;%C%T1S2;05Rok6c6W0L9a`Ta5M{dBpHJfIctJ+h z^K<`*22Ha?=-S>o0+!ivym}5VB?;t?n?H=A2Pyh3n8-D&<(~wSOAhi4E4kg>a+3XN2;Nwv61Qf{#BDAbh}MJ82CF%H zp%ah~O!sJPM9ef7PHq@E{WzM=>)vO zj-6&FiOQN=y@D|AN|+B4BmuKm^A=tjjktV*)tZ1&*muSO_TX>MxIt%8y`<2PXQFw; z0uTq65{j2}mQAa{-5#bbcnEwozs|oIGP#>WdtIV*-9d(5n`vX`v^^L*^ENmdC6}$Z z0rE;SWKNj>Zszie6}v!M(i|>c3tG^V=?LTuS7-0Zyo(kT|BkcRQn348?7JPePzjFLQ$n2@-P;fz zB9LawbV#4Qj>GPj2Pdp8?Hu=Q4H{or2@Mk${DiHw<7Tf+^r`(Eg9btk9XjjdI2B9X z8Xq{0PepQI&XzZi*Z&d@Xg-b+?ye11P4ezvf3>=mtTKz_Xtfba0was znwRU8sZ1(N^mbRowCMDHT;b*2i%*+BR<7>3Tlvk(7E+)&b9pD$|p1GVz#(wU9-wTpG#$RL_;Y(i4m2V&0CQ z+Tz8m%P&;t_%*c{E=TFzPJQB?Q_2;}QeK(xgRy+`E)(mBmYI!6b#po)SfwS1MJdY_-LZHo#Wqt zwp95$JnFP?ie3La-0=`k3ysrb<27?(B)r$Y;Xfsi@*QZ<*Hn645&H4ExS8vA?1tj; zCyf9KYU1Lx0zNx5i)a`eP8~I>ykR~mZ#KD)z2wljzwcu&#fPwN3R43kPEi!bO^WmU z9%G16F9%mR*GmvfX{Z3LhsA$2KN+Yom->UYShPm1RUYAH@R1+zO5=Wz3#hSX*iC+U z8ElpRO31c1F4L`)t+=X_eQGJ~^AOoriLdrD5N9S5s|@ntc@NOTwo@Ut`#L{DT3%Yv zgQe%J9U4;mQN9%4J&GUCg?QwVK5Y%fPYPn{L(vZ{gpUt`dc+5UV9(Rq;Xn!bDm}}@ zpW7+)FN{Jp+vqxf#f7^yv6tn} zo3Z-WZy!(<-z3<_@~88g{z~3{W82a1MQG)(SLGHg3ruh1W?ZEnIk@rSXvnt(B0~hs za{VbrW13I@0Lo_adR2$Le0`axq*|X|(8S_q0Y;S6zH6RYo7=QIsH-^fZmWnFeycpQ znV`O8dDq`;I`~MHKKeSU28%B|nQQ&ayrOpTQ^E8K?Ep>01w24&^fE#t={fB>c<{`x z+a=0PoC}W>wa(?KDqc762yEy(*JmE-_Ij=nvHJA`pMOT4o$qRJn^{H4p^9n2+Dx(T zJ?dKHR^5lsM~a9EnR-)v8>hOvtiPt@f+a&t?_*_}uypmbi>eGu$0Li!g*e~d`lXJ6 zPk|X1RtD0-TAKs4Vp?`0d%IKnY?e}9I<@&$c10Iv)xI_|l|yDmK2%G2sg;je3l;1} zYS07DPyG77NPF{msMr60*e(Z6#mQ1kooIAg>`S)MQ8{EQog{k_vX*@t4Wc4bQFcSJ zoopdHGm<9j*s^3d_I(&;F}SbMXZwEd-~D*pzxn*<-?wY7>v}!c3%LR7L?x{X#BfMK z$~qi6I7Z_mpgdRt_gJr(rJ*`xUxwmEjkcdDXFboRLvFe$b2=B}_(p-w=Y3 ztgZMWL$z2>o-#AZ|9CK5;QZ+mhN)inRyA~H zm%aa1eHyXJ&?|Fg&PHoVe$D1$tDOCjQP`&Z58@jGYzKeSp+*ZQTxnU(K|Qq#*TF|B zmJ|96SC<5R{1WkQoeQ`S@Xlk?7hYzl(rBI(ICA&i=<6W+0GHFn^_Ss1WhmF-+YL5l z=_?N^yLgLz*{Ee{yk#Y{lLbLCA#+gfcUEO$-;6Ge{XL>>*HK{`y7`QPJUmtKh6Q2K zzHHoSe|6R&*{nGxKg;UVd=A`WXM1xVE+aJ~-7IHQ7P!H=B)-~t)))Qvyte`Ou8sf@ z{M>v$e`}vFUH-i2)T`{P!k|Ts(&5Cvne)`?o!|iP1{$nA>{1;!lu+jUu>rHn@|O!q zF zkKoi;{~^)7LX_B4aE;~|@scUsD-MZrTebRTb5U5%{la0sXQ}e(t=}r+A+!* z_K9V!K$Srax-_+U<9i$D(FIdMxWX#O;5F-BGpq(FeZ0*SnW&LvauZnUxwH{$y0AGEEf6S+* zem*F@G01;shazp1UXiJ5Cq7P$@UM7LS@`L_ml*6<;uy-Q?;cnlV$>ETfEtQE(j zHV{~a!=}%qdc*24o_n}h*6l_el?Tpelrk$j3h_4YxeukBK^SxRea-W950W=DQfEfA+(^| z)Ttfx?)p_HDU*j$G~F!nJFl7FLE|oXHdlj>sadq+&;eHPGMa#(tFxF#(WxpIUG4?$ zI19;wTs6^+H_?a7#2jGobt|!^qtx|Lzz&OexFHs z7V8FLU3g4jD$lh!ymxtkj%?Wj95-wx9`*<~ZCm`V)pjQz)zCq)eb<16#p4Po{y0Vf+DAe--v4E!eiFZs%>QicWNGOQ_U{x_!Y04k*qTY@GJ%f`kLrDk z+Z&9#&pp-9BCGJbz?>~p!E29*pZjlFYSq&1%@@a1yu_hVNTnxiKJk@dVS(oxr=e`L z{ch#8N<7aTCTv2`aaMv%zZ~!*HDzsdJp)sm{!7{HhPl6MgMA9XlEIE$Gm& z^(a2c-NDT7tIv=ZR?b{%HH{kW~)J}cS&7IY{pyF(DZ_=szY=ml1>h0tG? zu;-C8^4P^^mS|ZM>soR~M6xWZKW{cJ)yyFHIw3IIwDYX1U(n}6%l_fCm~Q96G_a8M zxoVneS`ZVaP`^CKACGtOV^imb?r?trFWV=cH!75LXtwJW8<{@aul`5_-VhYmXWzbQ z`iXFg)1fi+_fEr?Vv-K#eWq*;$|IAJN@i%)(9$o{z^Rk=H9I&W2wkV!3=;la~+j9h_4h z8X1Vu^$GA~v!bLb>4(WK@YtKby%941&le>snM%^1K%QYEgGZJtPELIDUWmC*Z97zK z!Pd*sFr@c*4=v^gVL83?^6ZsM_MZtnH{-C9Cg*Yd?jsv6SI0iL@fxC^ zXG>tv_$6?bw)2h53h>Ldgv&`@%UhMIJDLTqLFY}50AZ$#1}Wgd6H^uB?%BB!{pU&> ziSn@Ocz%4e*CW@|4-(d6H`&ICALrb^;+qrGEUc)!Lf{ykgY~s;PPwms*bczYIIOBg zv5rfxW&B0gU+d{>!n<8WiAia%|9S)Sj?!?*JKJ`)-JO!yP%jfSxH8r;3Rz6s>=KDa zma^j5(H4lgRS^t(2xaL^#BZdJd-so7-EKV8^D!J;629i{DZNB|VAf`0c^OxfK+oRZ929ACe#zIn{fH*hkNllbHiU*V?V3Ct^@ z`~9F?Y5vdPT-%3Jheog6#-)_D+`>C<{_)4qh=c*uX;%&jjVHT9XKIS5B5h;CA4xdu z?5~)%4h3*p=<90aEVVsYhu%%VoGU-uO4Lv(i9{M=-@4IvfaR*+FA4p)ZKm zl#CAN-A1+*nCIJN7C#Y3yt7BpWn$xf1|nz?m}ynzC=7|*3mz*I>%<&AaKAW86rNiI zIjauk{SxYzWBGX>}#z{4aRqWJwySpVU5MhiS*jhARDdIRDIPkP9ppdf-)uE$*yz%B3#L zns2eR_W^7>x;7W$nJ5ZAaYV{6U0NUpV*DHCVxF0%{EQ;G!GrC4RrVR{1h}I6p2FId z$MDmCYp{WK#QcM4n8g6+))10Rpc0Yw3jQ^&^z?y?QrSo3dq4nvX?J zT2C?qGsr90j?a(`c3o=LmR84kNH3Xcc~D`%JrA~>w;ZQgt4-DuWxom+I(QG{{mKEm z)Anr6>BRnE-HSJuyOr&U+)_WWOKH>Lk3@V9wZw|SWkrYimu4Gm%lEKDwjbUT!zLR= z7bm6B=&HaZr9eW?B6it)!2;Pe~TJ$DgYi%v=&0}t0I&C~5Z z{Xv^)qI|}!t+Kn-%A#qYNtkW0k zXU5C~s?FBKLyB}BQa0i`RjO{^X4;V=V?+{gMXk4dM`Eh50peI3C#_|;F8dAI!&V3@ zZRCiv-ib0yg}9ZbGy*p(eiyVKkU{q4$GQaQLStxrNHwkYxMB zk_|=sLuuJ7QtV%+Ym1D%-l7V7RwfDUTPjss^@-sZdSjnwL{ct?MRyx#Pu?n;q5aC3 zLdOACvP@%~olGVBQcfOXBZcgqma3l4)s7T&$Y)=<9M!|KVIH~JEPpD+BALrBTHBQy z+o~04g-)3RGYh)dCQ#P4<52O=r1;oNSQ~1+fjnvulq6JE{+xAoglw2PzaCI;Wm2ne z)@LED5J!a87=z{89dY;B5SpFB4zA0bs1ci2gx2N6_=Jul@17_}2VJsPyGl^?HqIs- z*%Zq%wNrCjCUqF9iGL&%*7x`*j|@Tww-zq~hI$RmTw)6DVGn}p@KIv^g zDd}KZ zB31#+3}^L6}rUeAreOq?I;dG?|AQvjPrG*gM34v^+Po1%r0 zMDiG~c%|SOEBFY0!~pD#uO$WSL6 zLSLX~&V)SZLOZY{a(fLh=jQ*03jU4 z2&KE}@@r9eeSanW@RJutT;fFzYB>4kXbc+%yxDxT^GwWFt+p*PwZ2zij;uguYU7!) z;n7+~;+{8}&9kSyPoPg|CbfM!l`+4|4$o@He%-+_U?=FqTTBk6hG?I_T)qKr_7-e_ zneQI<1m|P2YwLOI0s?oF?_sdEt=kXqb&DmO$(SG_Y8znIv|%^IX-C=tH6he>-1N@S zxmHpds^i4q!IzCtwH0uhh@w2_^^-?#4wjLsvz1}voL}341@x<-aMi`&aNX!z_#>{u7*y0*fDylmQMBKnM(ML+Onxy~(~y~0ch6VpT`)0v@Jq44@m*D-8YIXwa?zz}^Co7k zr&H&4F>f&p-hey0*0FQQqF|?1W-r%%8Ul}+gq;qHMEsymbR9sAqL3q6em8igOocxi z&udKAi>FpRxTPNoc|F*h7;$>h&Z1+%E4ejMjt!AlAn6h1nIl_XfuoG8oH+Wok^NwdK?bHwAt0VQcm-v>Xljvg9AM4*gw(A5H>rTVa z7`|!(%&?YoYlBMt+qnF9=R)|0Cm9r80eJpW-BkT&jzzo8Ra07l?d}chRCI$e{hoIc zy47)pn{Q{DC`%uYr6sLv`X$lc-IXd&RtP^FcfCc`!r}L~45I$in~q@sal!U%`LDNU zx4{1Pbm|VR&h$o*rG)EKmJB%tv1%{frBd!vq&^|o>~$oR{N$ZR|B`6b7*>Rk(6goNT^EDMkZT2X-X2APd2%PQX2 zp3=E{7&>%X_>S}!$hrEbmX9^QKSW?XFRJUsi;R>brX%mN(PeD6cyB^9D-GiHKe8TO zaK6)qUM^!7PhMSUu(Ln*fUenlp}dK#C@!4A%iyrLgE~a->YYw!aMym_U~I7igJ%Mh zCyIEE*=pa{t&vr>Q`{-BS6i zST9E!6q1?i<135Qtu%ZWD3;PHe8$c5qRDAL+}LABr4#j^FQ?*4rWxpn5_nZ4+O1b; z^Z7|D!4@h0I+ed-t*b1}q=!mRH5yw3+k}ig;Kk~%G&wUfTt*+rhjj{kTAI&of3^+t zO!C(BJiS&=q5R1r4nM(=gbuT>MICv(C-&RNHuK*L{MCA)T`fAAA>x9wmuZUFJ(Ok! zLh&fPSgRZiDrUN+=i(SZk8H9~y6RNy*`pIOP9uL%us28oLD~A-3Nflj z0mB|(Nlh%kZKZwM*yzb!vC_@gsXOHH#=D0`*i3*>C>Pie?JeTNbra3?I1cB+M2 zDUV}VdE55SnU(n(&F8w=LE+E(aFpQZ@?7k_S4`jP1ouJIy53Z0hOvIcW5cG;wZ`fC zq3et~SH5gG0ERj7l^mxO=X1na{(z$Vp}@-V?@;{tlXa|8^{b~ zhoIFPbsyySIM+=&D;|(L6E<8EY=VD7*l_qeOM<#gPc=cW#4hUK{aYocobyawY4Z?^ zJp^&62h@;XjiO#F;S*M_p|bg)i#Tsp5X%US?451^_u+P zwEtyaiT$YIZ9e#{rq?0P0X?fd`(NK=q$BobW}Z6{Y0XZ6`>VnF!C27QfwsH7K|ltw z$YIEPdl;1rP2pkc37OGd_9ueJ-E3LGd6`I=(f**wyXL9J_hbD!!qt8!8k3nSQrx?X z4GRkDnbm-XQ6auxOvj8i9$IlcN6rp4Ejz(;)@=SQ=k<)s%U#}98~S)&uPAHfzadr9 zRgnlmElH1K$~-(e5AMcbwAl^abV^TEmR`OulBh0EoBHu@HILZU)2y3j76Glk?k@4&Wv)P zqHUvr+-*Ar>rZ1ydA$$QH4JV_oa=cpi}(x?V_eV!+Qk|lDg;P82%hf&u692~iyG zz^vk{@==4|>-?jnGZgu{wynnJyl##BrP`q^0W&NDw?KJ^jK{Xx znFg(m=7QusJZMu8^Duz|<=fp*DiU@QzNh-1Yga}%ybov-@4MOD3fbTQ4<^Eyc*;it zDCvNrXl_bNoAdLTKjCP`{fMVF);eotaqyK}0hFS9X`%R9Tk_WI>0;~pH|86u!NPEL zojNB<2H#q|x1W!>IAVo5p=us{nTkEAD00Fmc#0c3$G8~QScxvEdxug*QxSJF>={lQ^=#qD&#uo^re4+te6)V^J|8_@&@(?&0bX>YZ1r1* zJTzyvVKt%moEy%Co75Cw~fB9?S<1TpZ%_yBanJMp>0(k8W@kC%w zH$o|{_CCDh_P(G;QlAx)6E?cx8Gw2Cx+k3%EjzOO{t`l|MHVehfLk{H@afGr4 zUne#Y00O#?+&VOjU+4_;3CvPN%WtYxk6m0EAilCT3d2q3xzHN8Y5AzTyN^P%(Ysj6 zGx^X=jQUCh8q;JwUy(1XfW4{t_B%K5Nj@>n;~skGoTCi;X+F{cc8HhE*&%osP{5v} zG#{qge&J+Ma{zz?_~_Qg+slttU}ymk>lv6#$1P}A3`#JUpLddH#WqP7E?xgZ_H~O9 z7&!T0n}8`wTk{?pJ^<)@~wqtuk4iCS+E})FNYyZhiv}znSXtz zXWf!PzVEugdz^oPTx!oIvt0-c*MHmUB->^WlwV=j`dtXC#inF3fZ|O~Iy4 zL$^Oc*&eap+Z#MW*rwp$6nSLu&EW#7z#P_{VCt=1mD8OUk-L-(6JMhl>BU-mc;#*d z$NIGm_7K@|4Zh-8*j#Mp6$YD0Y&=bT60WNn0DHN2IHXNu9tL^r`3~`mT-fZNg9{?| zuBH&SjVz%BMl#P+}=g(c8msypUrq${@E;$YxY z8uuG_p}vp zE`j@Nq+(x_HRIM)aNYW9)WrK4(q#h{_4uM4QBHCzPfhd!E`*ZB@Er5?^|*`|6UK?L zz!p(RUC>Yj-^2ReS6Zrk?7PDcIZ@ZVV*%Ocm-VvF_vZ}-cY8c z_JJAvdtBg~VY-p-Iw8_H0Kzu zvucX?{KS$4qn;raLVZRB!k^Bpm}1m_2!9&;!k=&klfoZ>N2mcv)u% zSR7bt#+9>-3gh1g=VVjja+A2C328$$Afv+duZ%#1HU^>p8}i` zrBz^5C}gUMs?D)bp53mwX2SQU!2hSZC*x1N)ZezM0d)YnrC|}@u-|crz6ns{-;t6` zd;l!GQr8UIj^e76y`!D@+MHp$YTfdpZ7t*QaCM}(3R9km9>#QPq=H23Nly#Jf9Mqx zo0SJ3qiYhyF`Re|)f=0{Ijk+A$~AIUQY)2vcyRqMG1>u!QxJHn2k^5nSX900UamhK z`&mNl1>*M*N@7pf0rHBFbS~i(S;)r%dW=C)#Krle{eiN;7cmL@&_lOanTO+`y(}F4->?VRGhB} z`V<50U1>7*_42n~uJW}kPawui?> zorr|{41=RXL43A5QK=@c#0l7{-3_t4(aB@80xwc!9(mGS)F?AUWM2v>ze>|WH2W-kOATVH&b)(55h_~Kt};$GnOy?!J)T$2!WfpXTl5JKY77S>_XlDkh_(a;c_Ow zE^FUG`jqB@wOOR^u2zNydENX=e>_PZam$)A!Fk<5^t9@oG`G@oCiL-mhE#G|k!F)q zv?`;HJ7Kz6=kw~=@+^2SFFWm~-xnNuR$lH)oKOzFUfv2;2VUC*HgaSJGdA-5vvMz7 zU=FqW>T$}=^&}@Mg@dF@3{dE759GUg>>m=*uGd$5cP(E~$@GUi)C0h0w!_dDQckGp zrB&z0FEVWOC}^(`#p4uPlaYBm`IAx}+jfmo+0ZgMk^D)-?DPPAc_-Zb;b8n~(PHmk ziN)telDsQ7$1wn8=+Hgt5`a?VQ&ZkrqTO^nA-CwvE<-4~&!vq&>nfa;QARk*@J=Md zQq8UeUw2<)2o6Z5;FAa&k%M+F$VqA! zPe9+&_<7iDO~EJwY@;0CuRkikHZnvz)qggGVkQWGIGF(rnx-9wx*TDznW#y)$wvJ( zq7zm0;U;h?N9nFzl1o zT}P+<<{af-4rT)1)709N*-dBnztsV=fkN*A*>9XF5kg-8G~om5VA|AVcpvLcwq=gz z4BUTaQpxAv7>_sEAgQh^+g>aNbO+Wp%n=zX~RZQzWI>Yz-V-w#I=(Wf@z zFZt5HT&5fy7+as<(H_VlneNZ3gkc&ZJFz_1y_^Au|yw zLyE`Y5;)Mk{ep0Yf-5UHWFY$aK#P>USfTu{*K!%^rk=yfjeVtJ`oG<>Mu(2?INpm- zIW1t~Th_6<6}FOvzF9iRT}H6G)^gYJFSf~o*sVnL@Oc`mkP|Q6BP#*J_uK)o+l3^5 z@5JIKrSo4L|Gf9)ad8@1=0kem)ek~Peyp5!qUmnTBKlI`VNaBZ58wKFRjBh~J$G(% zZ{%3Vb>5$iS_JHO;_*tC#>X|dsxMyPa&)<-k>l%gfq$9d-Xet}<%c>E@1r*evrs_A z@i9fkIsF4ChLGG}K9)e6&zSYtZLpFBUuuZX&1i6C@_Xx)viKcX6Xza^-!40SKyT-{ zoN_xO*s^5!-ug(FZOLZSr=0@oTBoP80Alwk2rUKK44sfi^i>&gZ4IuQ*?UyqD5|Co zZU5p-SXNAj_*osRfW1jAIbd78hTgqyAHmsE?5EpL^t>)0FE06nZjBfhn~VZa~u^8x7@&&9sdt;5U>GQUvU>4 z1Xd0#7iEM~lHhecVMj=hKFy!#8vW`fVx7t}nOTcYVA<2*7`PTCe5VMK zP`^BU0#fjtaSV4#AB;ekUs!dhNWmQ>W$4cS7~f|DZhf%6;NV@|KCLejPX2Qz+D-bm zGCRhB)L2k?&I13S5GFR<5%lqzAFUyTk|7DkzPktPq%svqlQ%_le!Lxevsn@&=Fb?B znsbB)z>uWFsP3@h-zb_-`R0E_xhJ31fd)!1UISrtMk7SgIf`-|rz`pzB39jbA4pDRYpHeJh-qu|7KRfO0qe&|E^qa@q_u*c5SJJZEM=5#xVL`k7u%Ow`uwbu)WwC%|o|>xg zp>00(+a2J2^>Fgwhbn}jT73!6KvjnD-JY|{es8yWFFD~P|3`pH8RUC*Run0j%rsi` zaDeG=kDuqycds>4SCp;%?Ks1_LaRSaT$RR-@=Wz4RcP-V zW+Vm&G!9;_15aOanV*1j27mB@%6=RR=jn3>%Xn2)j|E-`mT^ulb9-cUuPw&w9S99( z?uQ1u_C!hCVKVGjYm}|AE5w5uJ{noTzSgv@_KBenk2wW?{+8<)in)+>z=HHZ%50Wkw!k>Z&uFal9MxM~RIfNbyyR zvKJ+=5Y~{2QeQ(HAD=BqPv3re#0!69Imq$TeO829M+sl9;YLkE(D?HeR{@9 zHJ?+H)z;V ze^-hbB2EDb@_5Y;*~WWybGB2h{p3Q-X3yi0TME4v5()*FH30;}>I(*0j-k>3-ZFtW zOGCH+wEIqZcB?0G4_x#YhyTm%J0<2k6FF_$_RF=(twgeCnLPX3B(ATTTnl4GQ^1Nk z8h9;?D#B-vtvplz8v3^V_hm!FhXdl`9`DjjPJ`&@`@2$_pk77+_)hG9ce@VHBU#0D zjManuvEf%Hc<~d+i)@=bq$vT|o7(#!{(!T2oy@k)7kK_rOOJuQjN1*P2Wp*$hiduC zW);or|JH^wsGBtEAlo(vmUyLZ?!yKu2?vQj;ZXpBgSQZmph1>d|1$kfKN}{DNh6Y9 zk0w_HRVQGgV+fIpVMwD3`1PUMibtOVH?h$AfahZ>9Ager9c4{gjVE09Q-j|JV$9X{ zV}nbTjM!k(T^n#mFc9lg0Hq2vh|Z=#3&8{w2U#+XWnJ&pL98JeX>tze zAw1VX0ekP?3DKLb)yEe!0P_*4cF8N}3Hk$yFfpUhzC5pyqmKmfeE}^a@jBsXWI5NFf`c^;Lno7&`t_U7UB!Jw_&K^D@qkK)%P3+;`Je+DCXRdy;NT zZ|;w6{)~)Shc0Q(0=tum7&wQpAzrzsNzo3Uh8*gnnjKBk`25ErzP9M@>wjhg=PM$p z*P6!U@3dLJZs*FMT|JK~eX%bqT2r#?vnd28U{VVSqQ5&CogRGy>^_s9yRX1&=ECOt z(QyI~NrpKQL;FOE*524lFNtS^J@Sn8nmT7!|48|$e=BJq=<&|fz5cg34PS4E6#?B% z8tKEu&bxW`IW);+Ujm@mi=|n*zPlA5U;a^Vh*D`>4WYcJD@Rpp^ZWvY(OjW(D^cYO#^}>X14;wS%Wq64dMAA5DaYimP4_i6T__y!cfdkY{ zU2*Z#6~3=My?|vq5W|(q1J+Ss4ydGJ(0Pp~oaWuhEGn0Lye^FIUWdDU<(+pFcf>&v zKlGfffUtO{Ha!L~6 zS_}0LE}Z(o_Y@~oy4@Hq)7*kwJ$z0cNW{Q!sDChp+Tc@iEnc6v(YF2jPpH426C58Q z*l*{LV9A$~^OrR=*V1`6-`|f|0j7Il`#%z2XZ4zre)6awcO4;`KU)6ksR3*7dXGG!#Q=WWbocWUxpZsJ9~TqFN7g6I4hgG6 zy#%-oe=a2+ZPX?GPmzeA2Lkea|aYgI_cfUVFF?1 zA2Q;!{^MZXcaxqE3V{$qZ+c9Y!KPuLk3P+rWEyTZK%xk|Jh5I1I}HuH8ao2)OCK^~ zP{Y=@k6jEWAL-i=zyGV(ztVzmkQVF|2WdfNyGcf{#eL;A&2D_-xwX1XJBSUK00nqo z$-lccNjMD8)R!76j$>F5CvTT@`DwBF9Xc>`mK@7H)T*Vn>U5!aF9yP8 zT|V+|B}g?p`hcZ z95cn@(-Pjg8V6KtJ`hApEO3{l z%)6h_STzLlho|KUb{`9Y=o|CzsG!bcczp&?4R^&VEh zug7^M4hgY+>xnJmrDFYJ0^l~Z`t@*)eqbp?_>{?o=zAC@#^>a!wLE_4uMxskf4uB^ zPhsiMppOWoym4^f$%dE0kIu%5yjwO*e0~iWXHDZqqq-+RP%$0fe4Cl1v5Zc-CKC95 z;|~I4{#aBM%n#;c&RMWWVQ64lNWm!m_(|Cf3 zdX5~>)c-U1qve;HV{er9jlM|)e}^0~ln|p_!~F(R%fyES`wI=0>3q@9Q(QL7G(#GE zJ|SJdzyjCoFqO%4#Q&0ZI83Ixa(g-Ftc_tdne6;Hh0=IW4N==I2T%94`@H5 zRt$K0EB}n3T&c`B#eN8BvX}S?1j1QwyEC&)os!0Atuf2$(G$dPstYkO8;M|*9Emz? zE5H+y!#7;czD#{an$mNIyU^ZE7JZob%0K`jTwC!rl&Bt*IfQMc%V>I4r88}`A4dOG z`u?~B&l>l+MZ2G~KijW>h%QU`S2#suXO#Mq zy#hhtoS$LxoM*6H$G|1_OOQaZ0Xz$<+@%|Lz9nfwtG|KlbUfKx zeXr0wsQvb&>ZbgiL-$rlNc+_szNu2a7pM?ho;{SmP5>U4nEF`)P}Czp8kAXEc?imS zdI*2~!=e2JG7C^hy#9TZUd!pF{w3_}nszG%Nxb`@?$M-r0h|EQ z{&0})!b;p(m+|PDF8(?uuR0(C*N@xb&Ja%-dZ=XOP#5iH5d2lha?P~Q0y-xUK{<5& zDo@MGzy0(j0`a-9%}d}&#H%qi53B4?{thZgO-}hm;d^5Fr=1MPlT_yu4|6$-JhktQ zRTVhourd|du9*(N=q2?AjkY6JH)nDJ{|MgIgpa?&T;Xd&@YlDE@vh-Glc8_-1PpT> z*1k{9M3TF^!CifH2C|3>!BA+gw`?^Za>GANMhaa97Q@hj?{4Ml4An@VpZi~j%M12W zlS;$j5`*&gz~xD$GPFrF!<{y97#fm>|8~g4Dsfa`E+d<{dmBsPpj}sHP$yRM=Zn~B zzr{?3bE%F+w#Mb--}U277vMu3&2gVOhf-JU3(<;EDw1nobv zew2W((rP_#7}B4SXtKY1tVr(&{(47?yf6iq5Qt<>X2K9&xuu7m#8iS^16L*>`yu`lk7O zn8WD{v#^1fN!WLnE!Jhq!0Qs> zJ8vHQExr$)ksh1nws?Pjt?|v>U3Fn`!%hgfqH6Cy^}jV=(somSyx>1kf>1Xpb_T!0 z0nHfc?*Zi=$Rx`<)#hoOoRrZ-roBI9nFsrHaJ-Mz zmyLF&)38?%M9;jsxu4x;)cGXn6zq&M1O@8bHyDqM!<~5c<>@`i#{?}3T?Udb!BS8C z%y3wEtHZ5DXxO-o^J}r1#aE5tW#&6d@i`#xA7?vCtf+fh%n#DV+YqhFwC|haVMB@1 zJ`H2?&q1&T6g5Q1M9ArBOB=p<_}-O~7F-;7m6IzC-lzXB?n;}B;M4APK1};~Fj_gR zwEgK!VwbA3(TsvK{QoTJIsQT-2X`g)>ocUGsSQs#jU*~n2W^ZIje-heR6ZRUN99+E zJqP6U*X=W#gTQE8^|M0qI~iFNh)6(#-jEh7k(exfk4$NDN&+>Yg~X((&fzMBvJb0e zO`YK-{MYi#7kEgSV+jDtZ-FJHcPT`A;Q8qwde+H1=Z@U!HWfbrSoqO{=91Iw$v4?nl6N|v{i6})?&~v9 z&<4X$f$lZ1cz3;-zK-^8F!aj$pVglZpbzEZGNt9T&1}Torv^o31hXF|+*xArx#*h! zxz8AKgAujfV33dobd2Yc%*E4?ylC?mZ! zx;(oQ@j`4~tL_1#d6z~$TNh6WXw1wi+1O`ufxa-s+tGRR#M-=p9hV999pX_)=W zTYoWlibwftI?&hun+?Yy0VGmA&3K73)b_GkAmTOrUyFDlRNm)~_ZV%$ATzk-zogYz zAhajjT+NA*iDVRl61N4>Uwx|EOZ59w%hT01<)5Qt%$ftl$+=vv1VAf-?$<7*+L@ryGg+59RE33yHTf@fu>ag zM&TK>5FF=RpZBa&jG=rhL5ITeY&%0xDHkg7obWCXoy~RiI#YFXL28YXJZ87&9Eh`? zZ3LsxlCSu&DMB(zGQkwFz}G#TC!s=R^UKeP-U+Ii3k59{kXsBZ`iRIRFdnW=4uVm^ z&mX&N-N6QvzoL)#sIyUDi2e{fr=da$@^7CE>{G0$(518K5J$ zPBM3gCot9tK9jIQFMyTh$S!cm=yu#6Ejc(vU^jT`7+0viE1>D9Khkv$D;~ORW|`Vq z&#~dO!>a7^rfmK2g(Ws>iULY}+ll)JW72-cL4JQ9NuMF#4yj+Q&b9h;AVxY2bhcjW z!xg7~pI3^9Y^Grv=+hk%ON4BS>P3%dvoylA*T)F%A!Ga*_1hpd!7$Owb~7lJUL!D> zX#d3|9|4M=(fXRN`uxbx3Dfe-Bb;2xm$EX(aff&mI}W%9yU@3r+)cXGdiwB3H{^w% zqw@_nJVi9B)HT2A*D5bKc#WeP0$X^WH-_`%;mex-{67kIupht$%Dl?~7?d|>O+)L% zzPZkb@YD)?OZ`*T5anq*VY99J(j0G8T$dx1UA_AaYxK*F$n%ri4ft1XMPzm);j=2D zQvW|9g7pI(5AJM;n1t+S1ocZqzpeMQ13j|nHIVI2M4_6IL;;5sQe)sBtJJfgV9;#8 z;WH*O%JpDQ7CA+Z^#d5AxuiA4U&yxn*Vo!O9gLDI1@BMk4o3V`?Vd8cf&Zb}3E=Hm z)YT8sAF)b`)UeBSogAOM`b`RP5 z!x!o2c=6rYS!KIG1p!S&w&OoQ5A7R-a{}fjT_dxJE;;Ce4cHxBR~hp2r~2g+pSUkL zKZmCQXDc0tlm0)s1C16~86#yLlOyHW9>`Z2bv(KrI?Cbd5E|o9u3qI+9NcEQ!uPU5 zA2pFv1cOyqsPl7;Yp3#z!?v%br?OTV?mVB2oMDKrKCD5Zi;Oznkh{h7j7z`J5T7Q- zbm+w*E!;k!g^+X%!1x5u()Q&TaJ*F4J?%s!pEKwt{WW~Qc+Jlu&CMOTlxgWlPZIYA zR-~K_c7n8z%AQ{=&MnCgfCM5QXtA{LOIKOp-v9L012vY1Nj0_utra3i{nM&+@3xpr zQCPjhxm1f*8}+LrU2~D+j(h`s8}YFAo}@)k)Bu`yN&LL!@0CHD&yo~!tHi1>1R%e0 zhYuT|RXNi?T`Yv+bhg01y_XU4WK`73G$Z^O1+{n@Xz=!Rqs>8%$IIK$cmCdU#s*&U zZ6&OL0xIl&M$ikiChIj$&{E6G&TiT;O3!9E{!7bI{oXGirvu3rpA}ieQi8sC2Ndr9 zv7VFxA2T`tyMyE6MgJ0+H zvltZ!iw zaFz0JC*2n7oSpJ1JGg|3sD23NzvVteDs6-MMpJu4;L0;K+m8DI0@`2c8hh+vToLDl zgM7c3;0ckDlOPLuS$;e%)fk#KK|GbESf6Koea1mqz)Z^WE;V zFiN6|{0~X*+}AyL4r!m&RN+H(6$>mzd7jtrn&0!Ef4#nQ9LMMLUOj3O5X5Nwn9x4zb=NiYj=j`W!IG|&#Uz@{F<}w< zQTgd;<1q(sAcHUfG6;0cANhors80H4tev7>W9oqOx8?Yu6}1=DK)T#llg6!inj9*N z=k5Aw5mb1LoLZ#z&-Lo1_WOFxXTOIQ9KMGj*BkN_qlz`Yq<$-nkP0cwo?6%wBTo>e zcd!2>(fL+762u0r;$h|H?2Ln_?XDvgA5J^c006bJXzTn8`|G!tTnF_G5)a822B9Ho z-Blk2>(Gr5-Mo^ey6AIhE?1>s7g1wfz2j?d8l9C{K;{8hq^XG7MqcOUK(~ymffI~0 zkOf-xa_SKfL;!nW(2eV*C#MH{agdJR^@W`mgG;&{kP6+qR3b(WwAHyHnr;G@hy zyUI^wMS>!H^vfNl-$>f$-&7wvZITpmV=@DjMhsoKReJa9CZA-{2OL<~j+w~&rE}dY zV$XbJUy_Pv)7L8|venLe)GX`p7OyAy=?N*#WL)VdQ$0fos4+Y{8+39`2%Z9fQF+_y zi=0$fzS}A;-;RvAb<@UJ@9vZG%yBj1ybYHIz(^PPLIlf;cM&WZUl1+@B{IE|lDu8} z9;aeQP}bEdzSY0l5g;`Tba$MK04lnlNLlHd-b?1_Gk==|5u4U}8`!2r&<&u4XZ}Nr zpnw0`IT6BQiPPkm>y{|>OvF5|wWD@M-+n>_z4lO)&|N!#-)vONwkgY>g~RoMk6hJZJguxQB``0`W# zpA0Gs{@CW(b+x6caDRdep>N);LSRTU!DRWC+1Fyqx?|L>imsuOqod4SV8>A4G#V|{ z5KdAsHhKn}^IW&Bhgw{FxI@jJ8O?rG0t!zVSgZ8yRkd^&Y)Z(IVl@`M>-RW7`CP+% z25DO^9*+ld5J|X-!G}Vna7G9S`t@K0yNQOlN0rln_Nhn^( z|BjEAGX9pK+IF?)6%sC*yznNBns+kfE-C{w&aC-<$4T>|ld)c02CZl6e14IzOQ#(` zcs58f+#7N^8d{P1N85(g?SIQH;bN_E=fTDbf&C@r#6}H*{>9`7H&g4{O7I7`gLUN! z?l0)hQU`hdqZ&u2^>(YSdT7GxhBfBF*61=BvvGxg=;Nr@P3IJ_BJO%i(5NbMs2fQ; zA#4V48vTBtJdo!qKl7hEw)TcUV%K53-`%ifC&n5i&2o1K=<*#c)>#Fh8egqon6hz; zc&~G@kf5n-+K+h1a@pHb-jUC+tUN}GsISA|@3ZQRiV9~ObPjbW-@r6N9zovsOl2<< zTBD!mYxYp0^=8Z~Gs3aU(09zxrZG}9imHUkk{VV7qfkABfDjG2%Pwyr3p@-*hOCL7 z_U|XT)oqGl{+&;h!J-);o$=k@KiD_z(ae9c0RA&oXbUj-Y(AkFt9UIv>{wiCyV=r- zLF4en+&bC;Ue7cdw<(+3c=~(7^{o?_SonB8;>W-}k8HkPqSOq3?@AcTV-{nb4=Bcg z=-m^-%2UDDJme>d4lMni7Y1Vyregw0RgYT`8+;7ny8qzVqKuVS8g0)p+pmdOkn=9# z3+g4Rfscd|;=^yBaS8NGNFK^C=!yc<5r`O-qCdaDCK-7G>RbK!fpXF_)&en=?0yRa zRx*yo7woXxZ+r&=Td7yo@~;UD%$`>=cyI~04na=&LtP^PHG&cSZ_i=23}B{)y7Z8P z!}Lg9>MP%neIZvrmhx__(?kB;RMWH_VJC}%;*b!`+2_YEr~hE5O_v12tYN|}^ICG4 z=&?nLz(=)&IpLqG_0bQGH^mD*H!~xQ|1JVKtb6xi&?Q9W5}L6J?jVi;IQC}*sRA%j z`of`0-_+KK7+y_(*dRK3N@3+$(@$&X_n0XVN4Xv03F*2| zd9gm7Zr(O)%R_>ZItC7)?2r-clsvjuEztGy(Q*d*2WZK&!Z^PH`jYK+$(~017rH&8 zHXr$Ar>y;;nm46<#Q9IUilA>6Rj~AOMc?vfJmohv=A-rEv|jscuaQB%ZV+rTP)Sg_ zb9zI&VJkajNR~vZi3?gL#R~NTO6M~UBysK}1Mimp9~>(5t^z&Ow+HDis#hxzdYw$e z*^ry?-gKUMr@C4b|2xEJ*=`xr@HGukjD6f6;S#4fgSoY7a$fy(-zUU^uST#aldrEi z=rc$KbSwIve6JGhE#Yg_fL*=#D|v3@e=(2&@y&HLXP?)B1lcJ&XSzxU;2!+~xUcC? ziy_-8;q(qbJ=&_WvneH;{`ko*vbpVn06G9HVe`~-_RRd(NsV_uxYR1xdwA+RSE{b@ zp0N0CXySZ8V$h{xuHdN-5XtsA0d^wT4t1T(4wD6}MFMuowlqxhq;F!_>Lp4k^DDUt zhT7eLNDTm~WS>!BS*thnrYapuGDJo0TP4mONy;7SxUnp`O1-wKyo9u<=3F~ms@#sfcBxfAImC_kox34+uWtXjxara4tw$=(Hb5e} zc|qDN46kt zo+ml^sk1bG-+&$2NUlOX%6TUI96YkR6n$?V>^-ga?0-`KaLg-H!3Pvv34)c(C~F0r zrQA~8`5$N*ab-HaC!EsSUXNH8Tv=j8hpANKFxNythSulD1@1j335XXvpGO9gw0(~_ zc+3-5`)_8~e@;swc|XFQeai~?dZTVn`j|lCvFynPrE+VnsH&M1l0#KrZC%JVTYMZo z+h}lO3vEl78AtiZ`wBwC({CN>Z>ccwObipoKWRI7lC3DP0z1&iBH1rn(Ixg_H}5f? zk$o>hq}|Z^&a;|7`K{#NdYpUbFM@VNz8O|_t0==&0~&hm=O;llx*lR+Zd*|GWEb3O zSe|!7di_JER>dWc@{Q)u$j>Cw?sfsaYE4e{~lmhM7mAB!%Wo}T_}nYRBe|nzqY#4 zIPgNwg`UX3urp1WR(!qkyNN=(m2Xr)=~e1DkG?J9iw?czwJYU4H$pmVTk(GiP+vtD z*CpWRE-8paMAA|&GobQ6aTCDtJ*c7WHl5t$ zN3<;*gYe*cGFzVBRx&n<%7G>s-cB(Po!TrcOspHu$WgsZj!xmBjptawsfNStWZE+j z1=cP&^*nrS87A#1BxmC>5uQwn+?FjcY6>zf!5Tq!~$9^Yc%>;j`9p})|_^En+dHrqE+M` zYHd?J;kExg;4Qhai)ipqa`pm$5W9slL>`boed_oG)cC@sXa?Tv>j{-1k?*^8KWOTu zY2W!UaPDQB+XfJ>7Fqn2ZDWHCgZX91-VWH#yQFLy&MZ_eok#&fia1OWi?QXWZT*)v zkM&4e({^}9IGe+KjzU(38e^;EY0g(>Oe+k&{Jbscn`(e+DLJLRp3(`PRA^EZarq_m z>9Oiw)7rPp&>jtE>Dm3!3*SDz`hY8*_o{2Kj9-^jH$-L>{eOSIQB`70-zYtNEFm0lkXm%Uz+gjF__GsI_cwk?U zNt~B>jk?rVkxxL-n03nSlw=)_?%5sT9<0Sh7L(R=I^oTMeC>FR((pyhxkvao-+^0< z5(c5x_rwkQ){%K*xgpzg) zwHH#`equYaz|Jv)Z;9xZ6?xC*vJag01g`a@^_}KCO+xc06GtV-CM94y{$iyZ6=|%y zV{2HNIwYS>81!*n12Ox$0rwCimn3xU$IU2krn(`T=c6Sj7LDGmZpe)4S|9_lGKT<8 zI{f1DOP3%iPx(iHlh)k%a`p3HIja3y-TS!=wgO+Gjr*@BfmD078JjwoY6k33eT}Cd zEI0#f_|OR?19NXaR?KsFz8KJ%nVL+DS*aYgR{Hjfiep5I_!Z}H55M`tH>rPGz%#4F zv|S2oXS?K{IfoPop}>=|%V|E4_0#*68#J+N4;Yl@8Z^u)NeKZU7xh|j%VY(2kRfNh z-`=J9#icDY!teO*tS+1Jv#ww(F6;`UzYgSF6*TDKVAu^pI;LbIa58bu~14+~wA=A6Kd; zg~+wkrI=MbxBqr<&mU`I6lg<>-kq({pR4sVYO+}Dm>E9^%OPo{6>V(XMiQMv|6sH| z*e%i(aA~f%)lsKwTf=bh5IzAF^L@ASgGP4$-NFmdf7ch|_iiJI@n#Xuq!B0Euncz@ zPVh}b9$ubS=#*eahUoPt4^q=uLXXRo~JjOuO)9~k9#!1yn zb&c!?f4$C7w|4PLK^nV?GV|#PgD-}Y7gtzBoE8lE!O-V5-?H5HtmxOZI~xtW;YRXZ zcDXtBb2l;=p&w9xJGzto+VQCwpTBv1T(?<|xYppt zGgkle3QuCppl$LAZJfw>DMQQ+Hl0+el%GsBMjAro>)FKSvv98x?YpT6B`#!lA z244@3TRBS!4eE`?S(N6vHV*$)X%{W2^ML;gykP6fl=r7rVmR(2>m}>tgHjh2iA;m? z{6W^l^IwG37Gv@^sMPn;TIH(YxvXHRxvDIm8n?|}uI9{r*RPq!uczD&Lvg>b6SxPDsG*_7T5U83Cxl)0Mkx-hR{7H#(m6*Csyn!}#Ix#@LW z!4K3~+gL`!3RVOSqQ{@M1*b)1&Q!l*sbCEJ2lQm8tU$KfyYdCvg}6q%xwJkMD2saDXi??1kf$B_NxU=crzH&!F@*^g-i%b6} zN9VIg5PVxCQYG#4(~tvK_as(M1YBd^qo2F-@(>xSU@*J2YDsn7$gfs!1D^?fM!?`w zr>047!q6s8;A99dhJ9Lp01>TivwhBh@vla-fit~kS7F@;N*otE=#D5AHPg5@G;)!t z@h5|DX1!KCg|=uWpf1ta6+>Cnr)ZF_NWGg?gx=qwPPC9n_q1QXrmq!ml#Ii)`SY&s zab|Ip-JS%#Ax&ra8eyf{tN{LAgvh5^FZf zl7wM1>~U=*I{pw?fD5sk3oti`Kgp#jn~mK!anX`3?e#3J9K!V~%>@>{TnN$fJW5XK z&LKmJREk)Xuxx6275+5NFJ}2Ac4U<#RLJdCD;yihEBV}PSUG>ng*FAJHW z%#&lEaAKjCzsB-XLjBF$h&y@0pG0J2G1!1VZp9dGOYi-KM*GCT8!a{an|^w7`SOdvmid)>>8s zoXESvmN~&RB7%3-lOvhrRe2RE4}-?vm0UG0_pLoc6?=_f-&Nu!?S=?nbBic`*qRf5 z`_%2D7q>x0pv1F4EV+ugNBh<`YhwMUj2>WBY}i*%H#ejFPRK6`zESX^ZqWjZ?eaGC!nk{OX5%ES5R#^Cuw|37%0!-Q`4DY|#m#SQOa!tvR}XzHdK|%y9mZ zZ0+#OSz6hZcj@p28>6eUDOq=>$_h*4`Vk)nm>@qRr$TcTdt#BLL4xv*b^(vESBY>e z1%m3jMU)qIWKeh)SL2>BycMTj>MVL(EJ&+YBO4+qyGr}DKJe9RQ}vlCLV|d&OYM1> zZs6+L1@Bw%+QZD7euI{jIxON%O`5;D$#s@Wk?i#bP@`=xWdPUN5{ae=tqM_Q#X0Hj zy3G@z+%DE|=GtX2sG2XQ9DOBw>q(n1-ZFc-8tCUVE|13=8TaWT-wBLb?Sf06s&b{u z{mpM``L6$B9M@{;fmGVKeas_8jy0srHY57rp%|a4WJNVf%+{DwPVcM+vWl5%t%qXAk4dJhmruzLR0Y#CkePqVGkRo3;dfZ52+fMPLAJdy)CS%G z)6vhj(lb`5NGBa;IUkf z6!!7wnX3w}g`B*+Y8xScMHBVKum{aJyOP9ZV9=f*Gx$;#sbD60LBE|48Y!nK+OY8= zDo{F!Uz^Qrp6ZR$@hDi^HPMKVwe(oCyhhDnU1x9l%I|Xowk>H@&7*ThTet>9%ycVk zQZZujuWT)Kz>dAgX+G2-a$jj{VxENLkJw2X7ziRb8VE-C!fT;Zh&gk_!O^c^I|9S{ z^kC(L$8Jv;RpOx22KUmE)7ldHaJy{}NOBpAuG<9PxG5iNnCTGZ$3WUhSjh( zaqc@K5N9iGFrB{^7apLqI9bmHRqJf|*19lr$Dwsi8Zk(CDI>kKekTlv`Dww)&s9|L zjdHtMTqV)aA^pj?qxo`N#PmMTJzAzcm@5YFYSoj8!FWN_z5{J8) z>YMY>RZq#>Tk3WSLknGvKF^xP*}ep|3`(0z$?g$!m1kvu8k~AWLuM_!x*YzZ8$I0C z1MNE1XD8@DW^|L)7UIpaYOmu(K2_(BM=)KhCLKE2*2p-<2PKSb(fpE6aYcY$Fi z?HW+sDEf1acU~E`+IGx5VnI%ayyK7~H|0y4dI4)&6uKTi^_Y5!bmOBWL!BAVJ3oyx z7|k!wc!;G5bTiX?c;~6ouWY39X&&gk`IHz^f(SNM7V&D)nNc`fuWVrS=oP2|DRuaJ zi+t~G9Z>(h<#qZj1%?KRS(Av}9Fgzm?H(G^co=*0&)cdQhzfpvEo$_JOSg8Q!~(b_ z)6Pui=IyC|H60+S(_M%qJ)ay9@mSTh3hHlrzbIiM!{6H+#{3ZZ$-sji8Lm@cOBi^* z99SI?bB@--oNXlvCHbBLM-#4fUUiJ$s24tPtT9gesn?8i$xIkdP{$G~X_oiQ0`Ee^ zn<#>I#FKIjf{%qRM3CA)fNf92xp|LHv1!kr9mh7mA?TNt1h~z+4H#N710LSV5v<|H z#}5Dm$P=>}p`gSt#|@Kju8mFr zK=1+9eY%JK5KD;kRDCsU_t*e`ed4_b+22nUbrl~eyxIhv>`QUYLSb&)>I%m!r=OBv zU;X1aTcP)kmXBzJ5DR5BTZp}K`M&~mDt6Ok(Q`T^E1#!(${Zd*cf3u?@TuEQmT}7e z?xok1m>}`mwtMai*qntq!ot6A@8wzTd)go^XKb<@OLTItNdZKr>&%;LaDUbt)wNf) z-AQ3uq4IF)HSRRpRVlI~_bVqu{zVgt5PwCi-{}x~_m80T-05jSxbQ$%7K_JiKN*he=V92+3yQNV2ZfP#Q zCoA9!IobB>rAN&W2kW9!WSBKrF#3I?+J|&{lBhRuQkHE$Va#5@V(#XzOTSY3Dk;85 z2D3?G1s16lzq29>t*US|<$-eKfnhX@qFAUeZ2NsBnGg3cJ3GT+TL3|zeLoQpnZ&CX zs@|Oq)1Me^?!9BxlLo$Ru6YWZt^0df zai~k+FP(k-A$EVo+>+t_ z;^!fb1M#KoAXOhDHW&$;!{(aPyETYOS%$$=N)r~A!^L3+ZD2FIPDUOGCWb}|b{XoP z4E1Tdf}aOkiqn#CCzfw}+QuUp0jwgofBcv)IJK9f#vq4qR~xDlai`=5iq_+%h(JPCvxmUGhO>ipbl#6O_#5 zCwb6eabA36!z(;As$m~6E}>#NHD6jTN;0>eTtsb8RW4gO806D@C0d{2{$&_Oihv|S z-8>u{+IlEAK$65zruz4V?w1S9yGZ*xA(exWkl{zJdq$ePgMQbtqf(q|Tu??N zcEtZ+dpt&`{reM-AAnM~1C)A(zE9y)Hg4k68q#BkdUzv0V*Mu~#2y{P73}`*uYXaK zv~Nlo0kFEuBIzp6OfhZm#b8SBMVC%HCq&6(`reug|8w#FkiSp6Q0JC#3{!QJd;!{b z;_P$kgf=#{;G5Fxo{lbqj~tshhViE^fj$#%=dxLV)ArAd3OLS*;8# z&-`lKU8sm`@DbNMuUd@t^NuljC#M(jne~1gf5bot`uGF-E9Ooojc|MUD z*xW8qZauu8X{e=*Gf&Gv_1;+-{QJro6$iruAlQ$|kID--xcIgPbgorH8}39Zn+d*$ z(P2QwyQv&eO}wlVRQUd$+&~Zh2ia9tzUUFH5>S(zR+txTnSwksxf?gh``O)&p1FhY z5W9bmp5tAvHbNr01-t#V6 zO4Wh;`j%q`eJULDT`NbtEwCe}i3(9i7z@xT#r@AX0iQo?-^xuxqn=oXOec+uH(5kz zOXD48!k@Ms)CMX6Q;&#|Gj}aBs(e~HJUY51+@)tO01f7p6;0Ot5iFg36eYH-QVeyG zSw_tv8dlyHyI~f#1!oVA;07S3os{##vk_*cmd`@&e;zoFLU{SA7`EntdYnxb5=13r zD2jCUzQ(!*)t{1&#oTUeo34REk6Y5cr@%ICB_&LB!;8bp=0k0c=pI!d z^k6ZD^XmgIT(}I&aUC$G%@}^rw(?{yi zSKGzT#h0^2!HW3Uha&;__N~Ya2sbU0FElpbIOE>aFvr7WL(t856m&CYed6|~A;LYM zrYJ;LpR{x+@p^Zb3#7sVBt0q*5AdEn-4#*r8-{R`tpP&t;EXD|fcQ_I-)u?}^aCj( z|B_(YVi&SBP``rxc!+(n^n*JM=N~{-W{ic717`9QhBD|~O$}@d{l%W|)b*0j5#_V- zP9RpoC2{Z_xLu&i3UynePxUD&*r)(KZC}iZcNk4XSA7}o-;4Qf^)y&rD*x4of5=u z-nj53)-L2b2)`PPuQA4u#e|4o@+^zq;sfgdtC{Um#2(ijBhJ@vl}tw1kN{IS+?AQ& zQqbd7H^2CvK?a6!S5~wmDalu*wqr2y)meJq!nPZ3ncgS z^7(4fDFV4wwCxxk@_rLQs9i&4Ff?hW^g|a>O-#WFOv%==X#L)W^V&1|*V9^r{NCkw zp^#qB7Z%@##$m}8WVqaQ_0*68;eoS*W<;+mBs@9_i2M^!v!e3M+37(^IhhC_a3;Zg zlST|koTeVAHpJR5BRD||o(YC*Y%GEv#Zto4YJ1th)__x&F%I$5g0+kOMxH{HY3f>U zya)ZQ(~4oR4o0NwD-qoxA;l(-3!?3UEi{q0&|3!jK*5UE5f`GIuwyt~=PPP1n{_?A z&R_{DxNsK44(M9ZLaPQ&d+!@H91@oNpkdPY%)a7XmqQe=V%8ahIh`)BSN2hUf(RiX z4>Z}wXy|E01(}Z4y3L#oeSxrl@a*_o#i-?eKm(oSga#TB4ySIR?cW|O(Wh5Two?-P zdiG$xcKQ%M=ojYMSiK8!RA=%!B_IIChjA%a11vcgmR@O*ZSdv((Ggo}GXEMLpeiBa8^m0Dudy*IS3$C|y(!F`2S{Y?(yy!EKmkUT)aroIZ znzMwyw!TtkHsvRw9u|j56nbPDC7RRb7Hs#}eUp85jhiGVfLZ(v=ewoAMY9R1m=I^p zMdOh)!-Xbp0mfjc`o9>}Fk~YbA^>J)QoEX*g1LHwG5;4pOF- z2hLh2=Ms3TTTtf%Yeh9ucZn>q1j4JVn=Iko({?ZAipXfL8J%CX#EE(0Sb7=uxbp3+pmlGLdqsD!nS5AVfbC%UaB@kau;&M|2#C@+Rj>eFZ^cb z8|HJK1^I|)?gqu+jFl3PPVap0ny^%NdnUZG#$Wh;^cGd~SZraD21szhU%C9o1FT7^NJ@fsH z2~t^OydY9lNBc7sVmN>vROoW>SeYg-UnS1&sirzy0l&*H+s~O_&zV&*yJGSRs62jX zFD#t_f=_J@eQh`fgMzMp+H!c0w(+T_gxIbx<*yg+sPz>*c$4lD>a{RV?L|*ilM@80 z>Yz1sthXbS_qKE6$u45>;4i)}36Kv2gED3(D!1#OXS}PX>;L1+3 z80x4>B6QBYZhT5}6*kc^dFLgb_t!hh6l#b4MpbdQG2sgNMdO!cEq(nwB;ii$va8N? zwZRj9qP?aRuBXis z2I>FiquFIE8C7}BVH-vaPYLMp_T%mGaQbRe?&q5`lw1Ft&NR2?v42B=7HE4kW3jys zWn43vmP;$?8#+44Vi2E(n%dFIwbp?pjg5R#9G3r7=ymKBm6~24{~64^CQ2 zynbt14P>s59=zpbp;Y8M6~@FO`Hmq|?ma!sW&8b>T%MxQvG2zCPk5hA_-6;7v$pT0 z^aD0?^Gzk)S9S7;5qw9v83BL1Fk&d0j2PUm>g;iFl?2;}=#*x-AMOlhVck&9}9E*=T?lKxFd|8wy=oz$Li{R`*Au)RC9+riY{e|sfm7WAtORt+uq{Hih16qE|t1&EWl^-Sef0(WSE zNpQIuH+=5o<`pzmy|c69s`TQ9B5#))V+UM1YWZH;axocwyrAt#+mX0pMRHa}wfQ1N z9I!%%GhkP|-Sup{%hn26*)!G5QE?Xc3r%Yi`1E8lWe5Ck@-o-Uch;?fnyRBrU|q!^Nqe#PD^MGl}>(Q#On$7J-unzq~wEV-Brh+0y^3@vEz%9JP3yb|N`0&hWD zkwv#g-Y06gj61X|bm1{V$kcn)?0YtNzr6Er_Hv`$@0vg4Cu`T~YXX%S0hL8Eu6=&* z0rt#s%Jb%Cd2w#`!q^kJzHr*TyV4hPHkEdyZWkJ$z7TP{w22mGpIBQc#4uf;4g?Ry zrjDs5^jJalWF2fPS6A=ZIAw9=9&04!&$YJv8*iYxR@SA+GcT~@HX#BTnsul7(Xd!^ zmqXUB3l8iS$KMx@OUKfij>z z)0{cmU}*h4c+aDTUxR@qPu=U<)7%3wz3=n(C?|>SdAmt>tpluzqoa3J3{WEiE8kR) zM+Rl6E*jsxdw4PVL<+hiEzV_v+Z3<)%z=qRJ(5wW-`l*?Ld@2zJ}79$ku-3)ZKQ= zd!N0PndJIbOMbTVrO?X1PahU>u3X*;7l3*@>L&Hf2r|+nJUFN1m+bD()(_Y%eLvwN z@+o&sXf@1&qo?BZUcM>T`dOvIe8q1@@s0vBLQP&rfy|CAB7pk#W(wbn4%4b7Wbl2_ zK62KVy<&-kIJ&<*@fzDL&nUehy9bT&*B|nnkvHjuyW4JA%?@Wg&nJz-0(K%5Y(HE^ zg0c(dwmEN@E6o=AV+#W>2`4KOsV@O3vwb(`H!9*WWzyhnHXW>bddM(hnbdSCCTHmu&- z3y&uc-#~g=V zm|#^B-JzJwq*$TT@)fgwZMM=E2d|ioANG9@zUn#7zbZEO5dNzkz$7WsdZOXYC+tiU zu{9dLmqgKqF0r}qpuWfU+VYRE1$cmCuQv>sI&{EV2o9KBigHE5C)7Ia0j6UgY0JiK z`VaITVFUv&SOLrOR_+d!kzurG#d%cBZ%(tHftrUFDt0xGoQyN77;(0wd!Fo$90Og0 zbGy3$Vj%QZECkS4f3e06u>CMC#`dYS@e>WIivvosb!(djALS!@W6RF#06$+i!y#O- zJ%crQWw*ewyQ%pk@kD8X{#lvtB`V1;;}PrYw6YI}0Fn8TJ2WI?zA+(vK`%>n4TvkZ z6?kY<>>lHcntJrInE<8yVz|3~Sge!udTW@Nqmkf!0@;-=XQ1UctHw~-H2t{8ysR<6 zUHGM7>#(_~R8-@zI@@KlqZ|L)EQ2sHYlO&{N-D`l3n|Q;#ZrSOm`nJ)ZYY_ZTv5_# zQ9ibVeQuegIXWH&WO?gsSzdA;CqcJ+!w>SzL#HeaNFTY$hLh_iJj3FB<5M7ed@15!Uu!CvxUcS+U!KwX^;pzwbuL|SU&uSc^p)=(vk9jL8yNHg75A_ z1=+*BvJX6EW$MIP#xy&YTV&@|8#P-n0a8uELqk6P?Y8`jwZBhl z@vzAY{(iyIOs6m!uTtlZIBXG1XX-nnKAwUOGhf421;j)j`k z=`GB#xy;Q=`OWBC7O(n?F{DA4?|75jcMQ7ZR3FW5wTmEYLBn{h>Ih@43p1CIo! z*o~u8+{_06w6DOwpwajO zDE?ADz~N;l5|CwJVW~Lj{EsXs;0!YTpDcjA|H0T~zH^gR+3{h{b(?t>R{;9ZNz(Fz zmw)OQxT8Jw0$WSm^heS~%lcM2?n*j{k`00ERF-S9c|O$1RmGzE?DWe`?RULl@Qdwi zwqaD+Bw!1rIn2Po9Iz0L&?BiosfR3-ioS+Z9JS)oW30JKDSbj;IcF(BVTC=;O>Erod;niz9;z;+| zbmt4Bx9D=V_J0*3sx`+8w9^Gqg4Z&tV4GT7?j=asc_Vc;WSy5ueJI1)&AsOMcH>G& z?O4pmK_RBCBx6ab z6NFbEA^Rfn3_^7ZoAP`ubqk|>d3P^lz#Ufso*%H@s8Qdbz>i#T;Ocn9+BbmxZl` zj=M|EN-QMFueM$P$B#*#WVC8h8$;v6=6V5@kSRw( zx6Lod(7LtJbj()JEZrq%^UJZ#d*3WT-Exo=AKq(QiP*8T+H{c=$;`OZz#Tn$@h973 z1SrjRa==BpN<|6_`oHa$Awfd^heo3H z-$hHx#`4TX7#di4x3U#c0*vS`htu84$C%-@vR@G=hi_J3UVMeTig1sGwHpeK;QKCC zD-Yq`tWQ%|d9-15 zcDJJ>ylwarUu$sAE7Ilw;2t*bNG&O=w3x z#_@Qtv4Fv&Gsp0|UjCKp^D^*7s@7O;hQ)(J$Z1$S`}&kAJGk{b^@8Wq-7{Yg5#`yNj3Dr07VEf2VBcs- z%|1l6nVH7ZVfjv;AFTeS|w@ zHWMa%QPx-ge;J?ep15c4YI)OQxz%2`D zAbg8*)gwG73^qv0N}sOETCzJqer?c_t#an#OWGFNHqJozi+s=6#>E>DxtAB6Wf9j~ zTsrv!TS-MHM&hyJz1eSFpIBb@PihP}U-gc`rB%D81H|pp>zCO=)1t88QD@0s^sf)Y z{VX@{okP40h&dlh@nl_~Da5zuOV#9$Eg~U_tfjrFWyfB!a8!+hRRoW!@)>NSIbGa$ z25Y}MzFHO=KeU95_R3V(vs6+zu}9}kx}9RFzRK4Vo5a}1M(>c$->1%wqi5o%82jcd z{h>AdV&}&L2WLZ^ZK8`&k*we?1J`hOYd(CFYLmx*3jYamLTGYT9fRv{#o&j}%aq1b zBCv9UD?O^uFIrmblC6No-E0$*UXn-Wd*P;V2*^hJ-)7Y$z>A$0=rE)Th}+ACE|do9 zwSQV;-FEZ5JEcw=^Rmgt17#k`jWQNmIk7U;+H35P@#70}Bj9EjAX187E_nURrYY16 zuv-5NPL?pws2b)LTG_3`85bU>WRNZ_lT0oqd{)FeeeOAd?E_IR176R3I=j;FRC@@Z zJi~lU&P8t_;g-}cm+}jdjeJJr4hGh3S~Th8gA5;KCqod>_HUdgEMzw~r9fcdS5psA zj$@_GfU@+uOX6?RbD9=}!G8PJfadCF&Ynw_U9>Z(vXz~6UWB0MfPfVtF*f$^eCMAq z3ImS?%ZL_-%g6*06yt<|Vw~rZ^$r%%rTz2$PsFYBrXwxb);|gJ~ zj%I9g<~AQfIJtac$d>3MxO?W40;)F^JpV?!Yw~$Voa|(f)WE}5AQvV2729lk$mn0z zOa-GVBjB_dSWJ6sR*w4%ufF>ketO!AQSRpoteHT7@K9X>Qqi~6@JqufM9r)!i|TxW z%$6S1BV3dICns}FxgA4%N|ZmWQsL9n|0aoe{*lra^MSD7nU`@r*DKV8;77A$6#^aZ zRsiK|DN~j3z4VG9)~{*_oIVAUN=yItt=h+%2dFh z2_5kGS;KVB2mjd~pzvWsd=;oh5u*HB>FO|Md~DN@xsmHCJlMw{BNO3Y>Qr$Z0xr}n zq9~35AbLiv!+0b6>paDoH^Z)Q4S}a2no# zeD${>^X_N+Q^J+ececTa%;5kjZxAATv-0uZYW8CzLwvO2X;9CQOEPBc7-V=V>x-nh zp#ow48>2fyF{@Puf0->6_j-;_&R(ycldk|dFQ^wrY)msIL2I9-WNdV#*G$5Ir*QK$ zW9)<*G^uJTCCGF-tgk!fxV-j=WV;JUiYPV>s|7^w5D;tH<~Uy8MBsiB=)olZk$n zHcYsgkFs8rouyD~31?!WNFVb6mpNXNhhEs_ln-#HtJ7iEx}m!wpwD48U`Cyc=g^y| zP;CgiT&j)t8&|PMB?jnq?eUh!<3kP^cVxKRdIKCF#0w~6$Fgx@S4Lir&{8@zuD<)1 zqu;Pv^bZOnX>s2__e(b2je!-O^Byn0Km^z0^n!BthCaw$^4d0q|1mgxh4#Y}{_*az z+I8|U)2=9LLgW*x>g%(JSC>NAGT^c3AE3efV=^-8yPKudU$X`B1A~3(?!bsSORWdv z&a%*I=&g8;o)E(f;2paDrm)u|)gx8jqRwlD%T+4OLo+K=h*9kGhHBOQ1+hw4YkNM` z;j=15L%gK0QmBu(Df(AUGlF)HBTf$F&%n#p@}`y_bA;Rfb#pgwC}1<~ z{$VqxDf+1YGGm_1G@0~bBV`I6bdOH-$>S>xT2MoQE2R$Z6VG2M4*akwf)cx3gNh@h zLg+k z(aa$Y`jag`2|ODcvyz1cWL^)bRjzButAN4@AagDP9=+)xwJSFlpgVRuGgiL%G9q&Z zipD5FF#N(LvhyHN%ewqPd+n5Wysob2;?sdB4W_KR;?BKaYW4;k8QPkOiiolC{am{% z+n4b_dmH}(3}Mfcu<;$_e{q>wt$G>%CzT0VttxM*AHHr^B|5&iJ}nWl8EeBPqPHx~ zDyL9b;V1jxwbqFSAZx%#181Hpo=5|8j#Ts}1gW$TZ7DmChCj4y=!ONW8=k&g(>2a&w?-;DV?A%dk6lU0ix%< z9EqNf?)VMQRnE;Oj~viFnl^~7_tJX{5|~=Fs$LT4tvn07u*@@Va4uVc{$@!Zm<8Qa zg1s^x9l`DH9R}Ab7d8A-j1u9a6xSq(r}0HPvB1JlzM0oDzQ6P%bu=cT(=rMJ>l%EXnXaZ_I{r#v-X4~CFwn;6X|C|?nQ2`R{WMwC z6hBMXUKrWHRMUAvqhFlngeH<^Pp`~?&Z3_BqU%64N`pHhFekuh6}s*;r^?{E*fAAYn3i5_M2 zB7&+`+~L4M1FV>asiX^;Sf73QF82AAtT`{~NrlE7Y)58-kwGKdj=A2poQ^SOD`hp; zip%wazLwT?wJto`aBlMkM^X`5UiA(Y&irYrZN+|O1I^pARF=nsPS%0Hp^VYXT`r+7!*uSuH$ zyH^wAx3_{I-=#^Emom`SPrrxxe=%tqENo!lU_$rg=pA_`n9AbOH$ESq0j9QAs@8$M zF*f8&+SApYVuh6(Z@BAn-_6;SEN|77vB~h0&^&TpVABeaFStUb6$J`GNyvpUjDB*CW z9C(Npr#rsM!AI+B*?y>yc66@CeDxiW{PT(`wUP52pAuF4OIW19=TnZh`EOvSF66E) z_^kbLn!gZu7HRsK#{h(von?rU2q#+2v|^1)5UPw@x+idk`sL(EVV zqE5(A6&4TsJVmf=d$bQgt50*JtH{oJ)#=6S`>}#mnfYIW7lhE}nYJJ%#a{SrlCa$A z7#lAso4>u8Vk|0fgF9d4Y?5_iM^HUfdfhxb@bK_3HRzna`Eq&$exGL_f5XF)odsED z{iVKv_Zxe|f-DICi?%b5hx+f|y`LGh=HoTlcj62ou}JhHd}nDy)(Rb~Q8KN~6} zNG(KSoy)vMdh;Yszr0Y9iGSD_*V( z?LME1-vk3M=2@9*u84jnR0p1ng=I;+c=J>eeFee>7z?Gnk1Wve6iPJ0%%)6k>l6Ve zng#boiojuhbcuidaGKc_5RO?EWz3`b-O z_9#?ZX3=^KUQdqu=RnTsSG7>GaV8qLP3Xeri5guh9^@JIZx{oLRdPvx3M5`%>a(&3i~l>*|Cd(A3dDM$$zAY%d_R65Bb$ zK2@Ra#wJm=T{)0qLa0%pdu~_Lj)o{{3Jd`+)I#8`@>t6fP-J$TB3rqr<24@)CCKj{ z@16hUFTy#{Nk78q{zCh_|13BBB^QG~B8^jBQF_hMTfZ{@{%5+trn)Iaas7Ow#>&Jh ztuP_ER{HVWwjylR#4S!`BJd;(urMV4$g@>a;2=~@yScosVNI7aMO$)aJlMNTE&)Ld(thG9}0quK^?UZUBY`;S3;Us%R>mqO^WSzQohh$k4NT zu+lI&y5G1PExKKXg|sPUN`Q@teL{bhazACP@^c^2n|sn$poLo5ns+$$lZ&`GUl-%rhpqcL2a_(PU%v2 z?m%U3TqrQwGTJ%_VURNqeA@#Efn2W-9&O^h+nYqx70(6J!if(*@&I7ZU6&9&&0pT6 zU&}WG>0n=&$mg5bh%oQ?$-CylFdJH`Ogn9>!1`P<`GmjCLrDI@>sk)8^sGHCcFLK_ zH@?-1aQi#EiCH@-9z?ZwOj8hv9V~z1xL$jw)V!ecvgy0v?-gcEZ@A>gX{(8jO7N;4Bz3%AtZNUIe~$o6$UcI zB(41nnQB!I%K}l4Ff!j3x|jBNw*KEf{&)y9R_!Nej80_>iRhzKK_rRhwk@46cAS_&E%?b%WHvsM~zH8O2o2^P!k3HtSXN>x+Tt7UYsqW#tE^-@9q< z>kt%^4$vcsqo%jL@Jp-1xql;Sd7?vVCBVkk?e2E<<`gR-gKxO5-V_W;!A}lYH3{{g z_v~?XSflMD-y;9a-Vqhx7`VdVN8>j~{?PtUnWKt0>GOf@&m*!E6OY2{brA=x%TQY; zqgMXhp{$w$mJ=|MawSe~-HJc%7d@<>q2FeQxc^@Yc*_3 zJ^u8~o|WCe|LtwoJ|$NZ>eDosMk9@O$-<>Av_r)2c)6`td#N-=*U3< zx7CGph8!(gfsiq;(^yQ7DnmX_b<;fj=~y(YSo3pS0ozocfv}@Mx_WId{s0<@SsxI6%qO&sV)4o@qfJa|7Qte3Z zW*WgwBq{}n1}ve$jAUrS*uXX8zalaKY%v8e10p?h|FP+ig%UyX5j)M$*Xc2xz} zvTfV-7ZRqpXp(s8#=RBfMiyEd$_{V1BRE!u%hJO zetttqxRjEaOw(<0A@2E|g1OTE!oOpF>X7Ue&fwRNxQYQ}V~r;!@FQX55wIRPBuaZ8 z;Hy@-rKh7ZlN%jqwso?woHu0Y;MCqx_(bCB(zJ5o&V}qbjPLQOhx?=;LbU+LjR4IA zecFYj*D@`szKO3Kq@dx34dEMssoaB1Lz4X86LbeErSgBq9}oH%l886A-`F?@8XWdC zM%TcpZ-xHS{|x>Pinz1f2$1!&e_ywo3NYQ&Yv9Nw__z`3Upy!2AzC-}Sfbsy9h^cK zZ9xO45Zf1*-9QyR#5(FPKOE?MzetkvvZm&B{m6O)jm2iZN)!Kr{wa&iaNpWiZ~n_L z`>k~-sf|e*z9t#^mP|7NXY|LsDPk&0!qjWAO2Y?JClD^+kS4f=61om(*9#6*hY8Ao z&x6-#;Y+NK+q@HBTo5ZfpNz~vQTS+i)6+ClFv5M|0=|O!{_6uHFJBM%>r1+ytwC!Sxhk`=k-Ccy0{&W|3n*)oFZ<6N(+1@S z;#G;HiSx5Z44&!xlrE_#zKEP54xPaBNAWCOWtsm_Uj(c#5cv^JpgU;q!DdK`pvhzt zI?E@}N+?```Q@_pb(7@RfFcI$|ELqX1XsV|$7?Zb?|XtfKW2lsEF2CaRU5Z{HgH&D zMcw|3AKf46?Y4*aW?NZr%g&`t{-XI~=}j?nFO}c!)dlzPL53DX0P$3*ZQ$;jW?Pgq zp7*KeBb zCJ}m%US=V`0UN0S$3R>10-5_{@813ZZ@-oiO&vsDrvyoApgy0yOms@UUqN&z^e3HG zs!0fjv+x1^nLA0_- zxF=mHqut(zJuOct-UE3k(}!kjiZ6N%c0fyce>vLj?T3$uka%S*{b8d4y5EvDGEiZ4 zuq|-*H(Kq@4R!nV&mXD@ZdJ|zgSpw3vWpYE9nk3u%s9NP4N4n=IRm-{XaNm|F~+k&n5vk&{JEpZ|KA` z8uQ2i>G+Z>7oe9?>P&_}(%~)CR;7G&HV#+Ik8q;84}c>h;?B@;2GPp&UlU_&^u(AT zNQ|MeGC$pR#G}dhl#2pF<8?M<)&~`4qyW`4)^{URK}5zCXlXxbt?rFp$TXEoFODk9 zcwkRJ(;j0>#d(@{D0byejxWq0CLHUx_x@7E8OK!I2Cy#09S)4yfxs0sSmrnHzAYR2 zqDPTr zyZ4E&^v(>NrCp&kGa^bhpEC;=yldq>#+cSHh#j__!3??kRhz)_(w00C*K2Aw1h*@B zAImw~7$Qb2^f~~K@Z%A(ArT45SchAODP9ISl-G_breehzgzt!x%4L#8n``+X0q~i@ zlyTWIBJAQ1H2Vco*UKl)1w5PCxA&a?an;B-U@Nc~cb!S`LQ~LCo~8QPdo05uwcc+B z@y550igFf3f`vTbKugsO3Inu^>Iy%AC3=y+WUc{Rq6}M)1Li!~#FtBfq4wnsF1M0m z(pTG=xBTSh{T|5;+F%u*z3n*_Loi-JV)O>XF^2z!L(Cgb~ea(|h>Q4uLBd_tB7B@*!~Po+{|;LnR@AVN;S%@^2`Y-5jGC+G#as!{cozU%ZM z^^Jo^9$076^YIq#ob>RCHiKKraqi_&VFBEe{V&0E`yy9I>AL81oFD*>4QB|Sablf6 z6$XZ*jjH-BZhtFdEm;@{b%28(&ZKn3F!DG~;H+7Qf$6B=j^cqX!iB)SH%$|@gCw9*6RUS>H$(CYyn2w9$1i| z?iX08Z#cl03BWK-A2j01?wY{^)GRuH@pVrz^V(TwW3e_t2Y?j;r;9W0Jf+6pI$(qv ztI2j<=qLghKb9B`MQSGU+eO;rMOL9Bs2dp(m{#4@o;`@RHPTyYyP;HaC?|CN5)#h= zSju(8AE+U|VQSXo2(<)4-yyC-okq7Fk>wlZ?%(Rw!L=XnezAXA5-79DnGBf-LaK(q zj9QdA{_Mfcmq5U?_!vKUuu9*NE^-}I{wI;^d4Rh~2q_z zjODE4%3b@YwV3JweD>{u2lGnr)uFZ)#kWh673v8bAM|fMmydJaKi0>6$Os;kFX*KMx=7pB! zjEk1wL6d8GIi}s99BKVbWBw+H zh=D@wCYkGTx48=Mhu(YgO=r!&jVXA%r(&upuY6_Co*i&24+mrH%0q`=y>ZX#uAK+3M|e%?PVahyt;=p*obE%o z=O8L%WK6!fic^BQJdLd46VId8XgeO&vtyZWimV}yM)D06FboPYboz&J0+Uv68M?n8K$Qa5E#2TvC1X)FQ#O_I?1zk)$`dZ;sobzsQx+W* zYqMuX+h5;0-iCfRSJ#&N^LK&54gfo<;zEIydi6;PU5gjA1%7_#LXeM=%j*Hvx02mXT%Crk&$IE{hY&IqAl87ClM+-nTle> zk#LkBfRj=8{M8AT2ks^|IkL{`-2W(i!KqhG^FB-oYKb_xQ)%3F3hWi47avq9Lwdb1 zN{D#oTFrx_RRerE{ARjbe$Fer=2698_~bK@k1-bj6zLAj%trtW{C1I!p6dr9(XBk& z((z^u+#1Q-{EO!Stw{(_zw#-3I7L5dFM!f^603075l6)9b~?%mwHu92fnZu z_@MgI7&?CLpjYwO)m?b87$Na3j%7&wQL|u@M(fDUJ8D{o0=y#YktU~~ydG;md+%9H zqRK-O%Nsf9@n*&oRR)Y9AK&wLd;d;xqWzgchHFbc=bNUq(X0*TwJ74y69|v^7&Do~ zHH*u>97zhl8j`qXILPg>T$6X)kJjpZR>`bBJ&a_6gjfg)FFiV_!G?k_HFCY86rs;> z0%QV%?>@QUSa0HTi4y>>GC`ruTL1^>JjGDL!|tCZS%>^;k_on)n%L} zKWNq58#nCNyCc_81VPA@)lVWBPs+1@;RuDcs`h0*@A#npw(@Ec$_^Y<>KEEp zdv|&{z`Xoj7ggUNuNuir$A#Q`Zy5QLeC$J)PV9Nx4V9>h&gCE5Jb@lY`Y7!3f{{Jh zp+NBZE<5|}XwqKmryioKcW}?Z8qlk>!^Q`Gp%GDl(ZU1#^d`vIa03B#6Q`cb?WolS_U#M*U0gAxd? zA+ihEEwd7n<~F|eDqW2%)rFj3Tj0iRnS%t@7i)gJLfOLMp$X+oLO)(0KbX(%q(Qj_ z$Q_+>H_-LoEf=d#$fVFu3_hYDO%?5I_ErAQy_@$_LzmAq{xTD?2J^dXG1n?J&ZGVatb^CD(9>0qfHSF=^bDp$8Tc!o9DtN%r0*!o&CCMMltcG zs|F^~Ma%i1s~4DPbAr!faG@8nkU}U>07olBzU1S;Ib0%5ajtGukCUWQIr_mXRl_R^ z3mS;cdEGDon~0nOG8#DDC@5VLx^?|c*R6G^udiY?(e8|xL0RfrNm?VN&kKu zo3Zh>q`jUgTFH`t$1(@+aH6p-T}(Ix8H6g2!>L~{xb3Gfd2cBVrQwZcpn)%en8iBm zfLdIW6Qu<9p5=5q`n!R#rKSd)ZH>J0N5vJzGK}g5^Oj9d(mswX2+i%tG59|HTjn&q zcG`b*m!IojE2?8R!MU|vo(?+DoqDX>PCu}w{}-wSJ(h#_ zNshdGrcGliyAzIfSMCxYFM#B3&b6Sg@jMpkRpxDeO68&QfwtT{Xrir$ih9el z7gQ6Lkr)x-@h`R9UtPY;4VYCHnpgN=bepXd8zpeS0Bi=$uf@n#D9K=-e<13KuODJT zwX0-{{%X9sV(DG87yD`l=_PMLl^JU0rl+jGr*F!h;MiK=0XA3JK=Q|GTm(b63m^NC|_Tq zDA67Uq%oqU@U$CbZ2H2bZnCagmM{QSFlzYbNr=kElS)wjw2deX0$uQwk$DGlsQGOW z7Iq~?Nq&_pNC0b(VMxW-s3G_Fj&$RgRA?~V69U$WmQa|Iv+HMnce8fUO zI<^@VMS35()Alwf7bbLv_dBif%$j=?26XW{wpjMk;@f7%-jBb{C4?b7-&kBG*Ml-} z^M5K~EX@G#*K-WMUmwUc)8IGx&mN0h{`%rqpT(l9yPhB%OjZ{VYOX_nh5+vL~c}p|99!&kx-BJiQkP{Z>+ZY z+ODSz&Mx2a`T!1`inUCI;AqXPg@mHvnGEd$bNGp?I9;$gX=sRiW*hGM6%Q(GRGsvm z?YRH0-M4fA?>;^tCy!=D%n5YQM5LR)#<;W^Xvhw9s=SPnc~!F;q&GpV%8q4@t^49Y zP3b@#M<{i*-O z%l3cwf~7;~5Hv^TTKPadPnBe77SQaiB5Hj0O<8E!NydY_I~e1_EQxflHxLb&_-g7g zB+h=j=7FF$pZQVJe!;MT9(2V$T*fSx=P|zv+LMG7^+pRt$XqLbI8iYq( zlZ`4f5w9phDb+O)C8k|dgJH7a8TIBKlpmAUwRP7 z%I68{biOxtf?f}ALW`HiULjjQloT}=(O+#J6$IjigaqznY^-b=I^D#aNZwkSExO~j)i2opt^KQb4*UHxh zxq0RFDMbHoDAOJQPjsNe6Xzc#ly_MwRSayy!vCRbRyL&0ZwYdYpXvngBh;KeW6Gxf zP;V4$n0xu)A%PEH)I3l@cV?iEp$puu8X2EGJ=mltH%B z4ZE^u`W@NyZ zs(dd5qz?eCGrn-5L=Rxv{0=c;O082B?rs=Bz9Rl#`?nZSBu`ndEe4tu(+FP?|KUK_X$J*(Jy+aFUbAaW z?Lwz_Pw<-J6jnuIsg@WQGUHV8Q1+)MPenIKl+E7LYx2Uc^vg8EtmhmVQFXM{?!Zm!SU+nJD{l9_f<6RfgZtlvhb;+5N{qaE7rUXQI3sN?9es8!iYoWzmJJ4ta3t{Pxn zJ)9BW>Bu_2ylx8R1;xL!^))hii*Au|X!bvqfr1eJkr=_TRqiE1&q77U^!*VTy;T8L zkL2XkiGuY70qljdgc^zVi5Tkj3$K;Go?SsQfo#Uw~K=q+M` zrmReS7O^|L4UXTK531DNTKeG_IB)W+bc6L6+kkZdTF86wKH2eyFG$R9Mgj+ECp3>+ zQTMZWAfefT7<|2bt}-#KhW$Glt1>C=Bz;ii3*Go8(PYylJ-z&L*xbLVJB`*KP4LJc z7BaXs^y5xx|E*pb@)=IOH(I&KL12d3#gL(|15`>77QkhzKt!A2Hkf}kFv}Hu>Kv-J z6{$Zq9r%;=izG60LiX9ac7Y@Qg}YZ$0G49A-aI-hQRD7j7ie1e(;aVYiJirmYCF%N zi&U}NAg$uw407U?KTW(B?)?F~!?j|6ps|lj09R5t?X+FyRVYP790FL(n2nNg$|wr7 zzCA2Za#tWA1*^5+b$bGCj$!GIhyNYJEsRT-x}5SjmF=Lzwj;fTfT^ZqA^+iGyH(UK z;$gdZrID~XjkDi|i7A!9k}#zbIdz123Y2S&;#e=37gz~>B4@OB9S7}vl6cLnZvlVc^^AEer|ecKKHDP%=9XCZmr2QB#F%Q?`D zRFT@>GQ;n1Aowa;UMC3h@S};JCMxY>j5Zs?K&&V{=IZ@c_LJ?ljJq>`e>fxVM)eZo z>~K%_y#2%(CBC2vH2oZ-X8+Oh>8aPx>bin_0Hw8~}U(>c{Q|GK9e*e)_tqkJz%cQ7KDJ8vB@i&B-;;_EoD(EMa zKj<|!G-BlZO@Fy!YXm0OsNdbfM~hR%ntan)FERPWkZ=0s4F@%~5`v=+9B+KzUu7@c zT+i8a$1lHLyp2#J1lE#FwB0;t-#=RDiOrW#aDeZ!z)pPp&MkQ}P7vx897Z)Pa%8s$ zj%4KZ`fCbc=Os;lD#dBp4jxqax!P{vzfK1wx(>k-5xIOcGUejjXI$>xMMX8$y$JVX z_TGyx%{_M`EmOc>z*=$TY(?unDVx&H=g6cc?RD_b{jseD{9pgGkqx*PY5d0?pOQEB zxJUCGu{coRM%KV|b951wo-(PUTtId4Bz!53W!Al7B($dMA&CPti98wv_L_V+;vL_7 zP;Qp2;)Ns&{uPcI+ zb%9*z3YivO5xf0@^%EPtVcj-5c`MbAX3tUDb77>3flL_Ipx60)-#h>Cxf81E2~d}{ zz=~c?`L!duwy3=(vnfN>MMr#radE?^GAIwUP@ypI3>bM{CwG7q!yx!|ebL*-g&Tb9 zY=DEI9OS5~@mJS`w1|#(HP+2`rUheN+AZj+=Zh3hUyWn_Bb+e19ZY;XD2fQvlQ5U1 zt#`586`(XuGrTKumGZ_3)=QWWN2&0PvHPx@03ivX&{r8%Of72mNLTo|eZ>g5S=}fy zQ2f6tpTI)LE6`T6BgovVeri_e4XbA=ee83imDTN$cFB_jx3DNf*e@_5fuFrE)l?#I z{UG6*q7?uHjqQT5R6s%)2YM^6Ys*oy2q`R@ml+(E05ToV>K z8VG41G)Z3u6(7SqQ?;@M>Z`_cL-dOJ@VZb%W~a^M~TT7Z)Vl zx}TCB%!~3D!3Xzx{hTHgxH4(6+f6Oqr*>}@ReljU(UpqvK^s=Nkl8a!MKCe zsJ{jz2yS}j{8}a=1vqY>_*)|{5ND_215`X(^^wNBZ-Ckxhf!lL+X)H)eXeAm z-xvyQ*mNU+e)184>24uCkbgKp{K2gR(hxEm$!CGK2C=YSkRL=QHWD`utUjEBa-0@3 zq10|b-BKuDQz?7cu>4t|aWV}W6FDQi)RTksrW>_W?HoG%s9McD0It6#?fe zk9!o$?EW5#Bsr8X=G~`5n{niul%+$SAGVBQ$!ST>h5fpEH-T$v`uO5{DEJEDakFm* z^U4Obwp8*wfO*T?<#)&iLqJnx?VWy`1V4TIfM4ybZ>m*9k;#I33z2S@ixQH>dmoII z^%hRZ`4()YO}Yp-DjcM1TP4g0SC%-IZCq$RIoK3I|yR6h()e93;PO{s#3xJUCs zAYSb;=`^kIP1gGd*;-oJV3mN%*IbWNbRBjh=O0=*U&D93ssg`+SP5RYlpQ!f6`G`V zu8LxVu~FYz>Kmhd`rGmx$V+I%VUu2r=MVznwGERwbJYSLV-9~qs-NrQi5~%dc z@dQNE0Ya?OIc8VVDb;dt7oBV)D168Ukw^t{xT1&GNt*rATt+nNMvSMRw+t&qWPOv3 zDZo*{gccPsSbIKbuyvbq@0)0?B_m~m=+|Qw_E3N0Kjd4io%`0EVNJI}+>#Os|cEydvm^fMF9~LdIm@G--JhdNWvW`MgM`=@KZ0hnb}O9|kENZm zcGS~swq{iXFMbBW$LAp#ky+hl$g@>csn&P?E!al9C&O>JH1?3aGU&BeKRtJ(6M z)i<}jMPX{1x4ex9-BdswoT}3IM?|%5e8ZU4^_D9g7ervc!WU+a1GipWvdcqYiGa@; zG4h!pv2}nR>#v%Xm^BecGdB3f4~&qxs`U9MBhFx!D-mEGJaE_NEsmn2P2y%ykr=>S`{Gp=6J4*X zRA$z60A+x!x}`(TKlO@%@e6488Wp~o>GXkw>BFc?Pt;~F6Zft)NhP(3K7r z?fhmC>s+jCeev38rPnrb1uF}L;uZ6aBQwpzZ88hEM$~u^)uDD!)5PO5#a$TH*ITnt zWw7zmd}}RduOVi$KBKGUTT}PgGWC{nKd#%C4orLpnc*2aaRA>ijm5u0SoL%rR4%0+ z%ktJfb#SMPLA}87-aE%W%!KY!Y5Z4BbCZ|&JonN1CG;r>hXl$Br{3?MzObI+yUr(J z0XjAn=~K(Zl~_t__3Cuka{roKh0O}3T~XH}ThQk(=Cu~NyLpHd;W@#G!n0b zkmCm0&8I@6gIG3BErI&>=6P z3_GE*coy2YR`V@Ec9~4<5oD*;oRTQAJ-$FOPi{pQ&{fK>iPviH{%Y%;0vTyfsT`ic z2t**0R3av_tiv!P~PDez~ zk0=_Ezvz$nf23qss-uc3yT>^Ma8eo6&kqha1FGrRz%)s3pLgGMD?eFQ)#6O~!_S<^ zSAziVRR}`ZnKfdLv680f@ybO2F0+f7Xiui)CukY(MuRmh`oafaL>6t{U98x1X6k)q zUAKGz0Q{HMC71>LJ;z0s$l`jepN z^j?#atX3305r_k9^jP^Y+^h-cc~;hsT_DMKl8oT1NAP}z9ZZ)%VaHj6z-Bx zBz@5%3S~FNHnW?$o7v5);39@I6i=mJM1(15xVs0)gEeO#95aS}}WyWG+g+)hBr zu&^GI11pKB9d_#O!76apNa2&d&*W{k$0fsOcIICd%>`S8O8LNdc6l843KMMgah^KR zGuIo^3mtW3Chz)llPw>XHs|;M?X&!WFJ}FpHBAdWzTRCcmco86)0wx(FQt_t15M<% z^O-9=*bx&lqZZx<+$I0fs0#LCj`?GIm%bk0s*fwE;nMULS%;|D#D3n-l_{^HUQ3hZ z@8tAypl)z7yCLutDff84kHY3%G{@{m*e;qvl?5qlF!wrltX4f=d>!{AfgQ5NJy^^x zvQ3#;w-Bbi_z0y?btN~X;g7ay%9yq(J_Af$c{{uqG(oR})0MjPUx7bV{3U3gN?i9O z9F;1+PLFK9nSrx+uYdM?cm1ZaHSQ^{{DZ~Ko6;;j2yw!+6Z(^TwMY*ZK{+< zR;?y{#U&PuJSdPl4?=(Bi9gZJ&@DgAl0a4UwaCT~c>cN#q_zxpGO_gLzbcxq(N>t; zPngTjs zxb{vv{Yd^}b0k4!k&Gyqz}gpyh4q*8EN)Puy^5&?a(nOa6zGke3wtHM>d_Yn4MP(Q z4nqKry^wc473XKIyj@@0&Af>XR(KJ-e&KgZ zfm3g9bEwbELTl)iI)-Dl*wPn*DgHYhGXvk=ykG1gHcV+*^S`h;k$MY1*OnI{HS(W%Xe#Jru9m{MkUcsfVL) zYN?p5k5dcOXLFU%w(?DSr6+AX)Tcb)x?UxUkaP9Jb1zM>R6AdK2<%N)vs(;s3)d1! zKeoXep-%?g#NIejprZH4e>yN^m^krjBL(gGMr^V=By4K4#Y8rentH;TOc6^%zSFNF+P;nAfal7N642t{qr;3#!xMdBNFFp4z6V+?nhF!NlnbeF-OQNgU_v; zaBii|HxSjjTq5A|creJ`DV!5PrLm@8Dh6u~t2D;e993lQ<--0RGizn+xq`cgT;j*n zYYG~e3F|oxtWBzshuT?RZ`iZWGo1_c-&Ui#!hUYhQKuqPr%ID8dIR|u9%aVSr@Hue z!NSCDsLgLrv*`xLN&mAi5RPzs2nRKX;eTpZAet%BC?mxZQ@)gr>};w%Pp!el4C>y~ zeEPQ6lij_4Y&-%6J*|`+UeVW|WW$rXJzG?OhUvpYnG%?kKSn+BZ;e|2XLY3NufSlL z=831Z0JGuyjo@+M88AVc0u%IyuMVC|@oZgOUFi{^x>1Xs_8e?>*WjJIz12^i7h!#& zzaOMM{WhjPV47)?Ra$iElG=`xHRJ4WctsWbw1XGzM)a+q$^`h(R9XVZ9Ro0KwOisbk2RE4ddUspr`vfK{$`p#L`Px6F`L5`}DaGUe1UZ z$joyNPWXji9gdm+$)MyCzn1N%PoI-KK6M{hK~M}=(unK>L^UmLrDsvI?0X9B^OA6R zvl+X#FEr^j@ws0!Fn2yWW?mzPvvI0=rNwp42>veKCpBHJ2-qgdF+2a*w{Tnm)0;2@34ImU673Jg*C#WyY5d zmZn20m%%oFOizNwWM+)IA)!q@SQGT0xKrw zA-$#3{oiPqnkxoaZRC#k44qPftAM{<7C@#%5cWZX0;g2?#FU$Ci(?+URe;>WTGdIg+MEy5<@>TH{|bPXGiZ=$fp-M)^ZY5G31Bc=pFnf zJ_9z3Zu|@l0=io?fIGhMLE0gsOimw-q*qEppmg)W5ooIO-Z@>?!(j;e(Zkgw44$lJj@3XmbVB*UMSPlg71f+c?w#8Z9`D8AGQrYI*~5K1{;{F$D2~S|R*n&^+ zA~j@0(<}Gpfk(BD&(x4lfs`DP1Op? zHC0!scYcQq1^^wvvlt2_%Mp5p9C8@s8O)QChl$)@@^mkgzktO7V3wkqn$l?VkIMI6 z57HI-`2sZV&Q&d^e-5?I>fEITwm~Gt`#%||*F2MS5D(7MEvG*ud@%j^sqVlNlLHmT3|;R5i}>!yv@t~-AALsOV(v;G34(+J2;1=3zcq%{o%YJ zg#oC&YCI%B~n5|de`1pc>Z}JNsF-?TR|`P{KO~E z7QVFycQ-?*d>@#!fZZ&vA`qSB`-hzTCc*t`%>H3LLh!kN|H z#c*Hwvl<;>9ke{;I;vdX*i+>$EK!+H>p2!7r?1)EVbF`-igHHU)$`#*Ji=O)JsD!J!hpf*Omk&a zxs!E8r?JOzb3}5`ZJ`x)RMlc4_PDi25Mleg{cNa>c=>R9mz@U4))0fdciHm zpG>r6gGT4IgZ5mGxiY4hxNU09XidN*$pEZ=GnTjSuu4Pv7>Q>6_FZ81a~}e$M|18E z{EqN^^vS_gAXBEyRL)t!>Ncd#YK+0m`XF;?Op5TGUHr=o%~4d{&bT?j%N z$Z38EbkW|iJwx9oW#QMMtoQC_;~Dx@02H(Wk|#bNpPwHe4*ik2ne_|C)XKCMD!v37 zErA_Z`%02|Etb-J5KvGpU{~Ph0iCVMW@#|5WAGzbahrp)K#gxyVc1JO&XdXRpOxA> zCzA*%torjuLhQ!Bd*;||*iu0KX=pfu$CW|qZoqnyc1;^YEgam}`1-|LU?9N6De7Ce zl{<=9I;R#pmbXv!q`6x6<4h4C`nJ&GnfkFq|Ho&(uq;j?*8Wr`--n(EDvTEdHCK3x zt2?YAt7Q(l@=N5NKyoa`m|7;RE(Sx@M0d)3cXQrMYu2!TSg_tGay6LzC|$DM^9|~D zr|wJB3#rs{n9$y31M4HabyLn3+C_c@_tLH_t7;i|74UFUMO=;l)ZPA{=k|Z`I#KiZ zy}=JNg#@YUE@EaHJ8aV@=L4xTS)5Td27QOQ)6$)MnDJ8Q5?F>!{m;@qVoLQR-r%Nj zg{3g21Boap0MMtrzq$ zQdpWw6*Q0}S58>BqFpat*p3W~C@8-QBAWdz*g1J|h3636`(-90NDh(x;A=_Izkhen zy@O3(v)aSd_%e4Y=rg;bgd~3qg^?bB`r1ywx@K+%-iUR(nIJ8hNer0m2)Y((>orZK zk&%@)ej^#%?ys@V*=Pg9>{MCqUhHK;O}g1v$XvVG`Swro%#e_FmB;-K(6y0Cc@M8Ka+1zJG1Q9%emgFUT#2)1iZY<3 zL34$ZI&Ur-P(TZS+ds!DiJbTToKES>+R>0S7)e9Crq9&VxF! zHtej5h)quK-vboEMfL<~3$xvih3U9Jz7FivpQfPC|yHYYb@x(DzUrBF$U6?Qk^ve)8_Xp6u`9k=L6G21+u! zhaZS(?y_jNPa@3L39u!bTiE zTmD2BXG&`@5Zw2#b#MOb-K0E9d!YS5eJq_r>ysA+ka8}^b?C`V9#PHMi*;aD)$9GW zM!rH>NQ_bZslk)b7c%Cp@`<6pJi=Xu7U+tB69SX!)r|+HugUag8CAN* zpVBmBc|{;x0*=X;N^g`EO}%3z)!lE$2Pqeuxn0!H96+%(9o%$H7N!q)qq>?pY&GP5 zLu2NvATKP)ehFG`a)HLe=BEdGy*6S+^O z+Nr2&<<7{G^P6xw6&;{yfD*Ecw}^sO1yzg=nU^?>SdhJ5sfscw!2>}$(b(MakO^WKB zgQA+ork`#O0OIwNInEBO&00H0m&}x#2axnIP->bKw&)?+ai@)-Qz2oxr1mEub&2Nz zwZ@NR_RH75T>5}W^h#4$$4V%sistIC@D-G7nR`AT0~t;9T3XI=kkGtW)L-rNSlWK9 zn()5qJtE=zUyvi@cLdjvkyw;A%Xzj$V77ZzcHuzh*PY;dZ5R<1%M$On9M3W@g3S!Z zR;8JDaDbN0T`!gGdJWZHd~rx8K6?FSCih`r7XsuGX-jaI68CRug33Sm28wrW=j#V4 zO|P&`HS;r&MJXNV#li?Tgq$3e9@QL`c>s|c{-~Kv(RZFr-^U+^M~8&f6Z}VuZF2-a zfkF@{>elMwc;mg5(45_S^R6XJ<^J^rLUIs-Dyz+RmJ#(mP#n633kTt0lYK3KZs8%+@h$y9@ak!#GTwkb7vTCbirBYmc`aY)$@qTM61T@`hqo`Es5;zQ(Y~ zpr^EhjxTB6Ux$Fwx|S{{3UlY5$0l zxv;K$&zI%fd@4l8!rEiZBoV~2`sVlBG+Xy~}Kj!SHg&R0_3w7|@ zchM0m8=r>#}g9rzK>lLc-;tTV3FVFUi5tBT5srBCHJde;YPfsT9{8aPX&<*r?a zOB`TXKeIC_wujwDdSy=3eBTk)M03)>$pe5I5S>?X*)@YcNHo?VZjG659`pM;0@Tho zjv08`m;Fzs&3RjZBK)zgQ#WYs)MbY%?|T(-kbc%T;P5#J`Izpt?0N4G+UHY5ou}n& zPR)8rx zp&LPlPz)$mCCxpq)mTM=u~>@_72CdsKk)}`o7z2^>d~Flt@@Hj0$QpGMRm4QWgfft z&bemyTf28lLw>ky+AQBtcqsNGXjCUHPOfkrxdJt#>$&tQZx8^nptVnrO}0aY_a6c1 z5C|jb5n^Qz579oOx#B44ds{q(E{h!9zva8Zi)6+V;(pxoA*)3t&Szw+5lVFtWA`hf zmXD!uTzm6RJ9Vp|Dg;+FbE)`xhON(%aw(n6Na~B|UA1ej1`w~(oFSb+lPVU3=ejik z+hUz~y0X8jX5J4(g2ybV+*Gm5C-WwL6naiJr@pcwX3+T=O;YNz>mgaBK{MWO;9EQp z_>pGj`TYsGFm%YQ!1saPkJuXSH9rn;Eae_&9^ID(X58B98A%LHaABk8vM=Z~2a5>`@jwh2b(T z2`Q2|KVi@9f}QCxph!bFCu}uRFq$CU!mBNvh4jNK;6VAc zntzejA)TP?fxDXLz4XV4KoqRq3Ch$Y6*@nOB?ntQ96oi{Wjo}3#22AI^C~uiaMbaj zT@(J`S?hSTP1m(o-vEE(R$#$p{GrVI^+JvANX3_*bB8J6u?r&Fm%xOIUiDf7qVK*b z*tCmArDL%{Xbw_lvaHm*oivE8^Y*yqCoA>xj4VeG1%#QG_-5wdyDtE@3FNVjle|MK zs51av^E`Og=|#oa@7nLcc)F^No)!9-LVKq9h}$>6_{M7lhuxqaAz-z+2lbDcMx#M zI`~<)smX)C`n?cUXOwpUAb?fjahlw)NFm%?yWF=Xp!@{6X(Cux7BVgAo~G}`Ww(JA z`nR89pp@un-V%x&jfn&AY#@r64l<*bV+}=>K>|&spZ$OnsJ%JNYPYwWp&DgnGLjXx zqfW;#%*C|TV(vX|?pMLhRc8Xl>ZkYwCDA8a7Yllb0N%`A7rY7Gs0@n8W9{~ytw{wu zX!oJ5HM6lFjyk1)ZmIDRRl#hLoQo3gcr?AgxV&bZo6pjuP>JMkjsZwLu=y! zcrEFi(4>@7a%#m1DkuFqoB)hYuHz4vL_hw`lc{Vu^|vuk(Eg7w0M$+;+|F{%qCq zU@X8gt`@&qT~y*q|5wpv6ijI{^<`Hkf=0 z>_1g8i*QXGJsw}0j|L4mfc0Y*c!04Cwym~YbGc=vh@BA+79IR%c`Htg;5;THYsK;H zjQRfI9I*JIxWwljkqo#syt#f0SeksD&)>Xg`k z9OQi+S|2ApHs}4I%RRh@E#g4Da11TjG zSImz{qhCpao5uWG%uWJR6cA~SDP8EvOUC|Vi?JGA&AtGY^&X$ezv!z z64qRs9zLG)%|_lO9@EJJ5_sB=?SRoXG>xHXKPQ&rYR_pQz=JQ}F;K;`O5KYdlysn- zchO|-=-;v!8~d-cS}qUxujJ?Z4tWB@RP;+OZRGldlg9MWQ7!yaOJd;wJ3~7Y-sc-1wK~S~?zfB5;3hniKu3lK{tU9#{#(o&V7P zu%zOIHZCKLTfyon-wV=emDSw2(MeEZ>*#h=dJ-~K47=vpY%_ZfK;4jafx27y`naI3 z>a#1p0mlQh?p_nQ8$IcH=GB2fgQh*JcI!%zX(lHV%X{c;#tTDW-)t81SR+B*FaV?{ z8_<#?SBw4xt$q=pb#b(RC>9jKSz6}XZwIWK#!3J^3yt?7D1L)$JgfWc^@v-Gvu3rv zrnaB$yM3l(Qm)vXbI)sfrgE8ifr~>q7t3js+ok+)IjvbIe)9&h$aU$CH1$GRDQ8%8 z%>1S2dM<%FCrxMhv2S1Ou~`y_NnW@PeAd!hGW&I_r=)R;>aoQNK3AFV?oIN#`cC_U z)Lrkd*H3CU?&gu^t5Mj9G{_y90yF1$RKr@HBIDkcXdbtzw0ihQsxIimt`&0mMmpSQ zGFs_=QD{}3@gs(jDu<89^;`k@(oQJSC(w<@P2;O%wbs^*hTv{o)NXuR0lKdj?W;^X zdK@&0&WwBateNP$Ik5^{$L2awY;NPkh0<4$JkyCgFF%|;vnIP`f354%S?Sr@{aGbY z;Vf4KSD%o}TDa%F9R;>3Y^+=tEA{!2Scq`R5yp>RO=GX}lQ`}hi&uS#pAA@`zh7p( zh#wW4;|~y>D;8zi?BwvCcHsr38o8!<+9jkqv(bs6Orp!qx?XN(EdU8y#LoRigO<1z zxou*T=E_k;mpF{U)eS0rWL;Nt;$OL<#pmy z!caz5vZLf6$oRy4aJk8~ZsMwOYD{1tr{Er3#6%}gwu6EZi9%_+XYl)%%9NRnf@9U9 z%fPeA8Sr!|*$Vq-*QQz78!k^s>pu-z%rD>=_tyGuh7U{!GIo01I@JlpsDYdPb%QOn zP-@z;MWC~>(E>#NT_TCq&Q6H~n4x=JId#BN-2fna$Do{VC!fTb8Tbd2-S+LtISrt} zeR_IcCzgZaf&Epu`b8KQ0aiOtw7%fw6C`0p9^+;Zj|JsQ+-h955L(RuBa4z0cKA;B z^K-46|HYt*QD&_ANWCj+NX8q)--yr>dF}0>$KlP?O|7!_>Y=;L-!*L2z|Bb3lQN@? zS|rJWi%X>gJxcWTQPhtHS)zDW)(khat$bafZAV1DmFkcpLuK|mnQzq{xmWl>n|z&(egx)F8U2_=E?aTgY&^dn9pgO(EuWMt45L0c99CZmi!uO9 zy4vdyfJrg8k~hGg3ZSUUbzT?DFZ=1ge>EB^MdQZ22$(@NgJEUuAdUAhRmak8#=&K4 z@VM!L5dF?4jGa=-CJ)PNq`quvkn99m7m#&%Qb7U~h{qlhHw#i2k^;GL-F2#OpiB23 z`UZc|9~SlpOz3;gPg()d!P`snD6(~qJ@kyoXS9s#Vhi>rWDrU z#po{R@ZBJ@5N@EfUPvw*Frk~z{`Sb+yLSp?$7#$S=X?S*Hp|pwUP*)b#DSTu@-H-K z>Hc?cU&aAIVtc)rIxseEpy59KU9LX!Ndf5|6ZxgB0;N*4w0IL9U7iUfp~_FEy8292 zlYT#k=s1A*2-GD5s{B9Yip!RzS#UE^>@(9eZf@wVl-AbbhP*pN&m%7nI%wQuvL4_)W_?zJYKIboc5H5OyDVMZ``K|~ zPckK-C6#m#@iCH-7^|?T44mu*kac3#Nx!B{JqhlVDN>ks^jXt|IT7@4gKIRX^721u zP)&BTA|J!-Vn((B2na&#G&7sIf(}5fVRud+YbBo6{DpJ|Uf< zFHJkZA@YKi!ydx>fgsaD$XeXfV*cS}$I3ooXif9+BwFCbCk_*W$L!b6!Q%Bi95@HZ zg%;B_wsASo57ZrLT5dY8;_fCxu(SEQ`+k6Y`mf~jl@aAY_}KDTE0+PaNdOF}=EQqx zoAC^~2e2p^1|*|B>6o327-N$gM!)EJNcq zal)6EX2rp2k?=x0mk^Qrm(4HQT?~+)b#wNP5{2W3JUW2Z-D-FHzyImv6-?g(m?93I zP;a(0dSQd25pw0#RD|x|D9~QPpdAJm!4v}cyvAHLS*zq((IC$6Y%=4%`l^1KJ74;< zti8TY4S2mPEg;-fUz0syfb40>9&7y+dj%k1AkB3qGsMA+s{LNOV? zC~n5%3BZ0nwk#khmg9cq4|C~;R!m6NWVTCGkle(@ACVp5zjEte-H};@j{qL9cXAN4 z4uq%UO>#0(%nfY9WWw<`$y^&J=##h#u)BMk9XmDaK28bSUU{f@7#2kE3S#x&y=Jg> zf5kJI^kC?^o*39|xY2>=vwOGMNRBs~koT_6ng@8>XljxekXq&V_^q(pzDV>|2@Efp!xf%G|_S;7@L)F_#0%5U*Fs(EU3l(!JiXi&`vS-Wwcu za6eX(0$c(J_5+Bs*NCs%+@(!_d;){!`UGHW`!{lEUya}EVB;Fy57amKXvy-gkN=AY zMK>95i~aP^*3O(y^QT>zTf|0F2>+N%+_+?D!Q8QtvpZ4uIQQhEy;nXCawf`GS~T#x zem)3a8M;(Vune!h6>}12e#ZGYEiPEE^2;C%IZsx)RybU;iW@9y|Bt@TTa&9mkk{rf zH~Iek?dx-JHM@2Bo7R2&_fs+-hd;u9#Qv`aPqKw9h*k+e=0Dxu2)iZFohrRj7(Yop z3KUUs!ee%42Hg5cID5B}2%-C+fRh*b^LLCZbJ2Mr_@eobpyqvL7lHM0l_OK5534dS zn87x|$b;1m;$BJw?&bANCCH$=K9!saMb1?mONg8^)0p!oy&6DC7g~&20);rd=-|2v z4YRkN1uXy#i$&dkPSYtgxKTQ_=)t z{>9=fAeo|B6y07WKQWu!(2$?~byNK)rq;rzEXrbFPoB}BKVt3#?TaNfMhA&hpV;vZ ze=NDTO`cw}TE|&bYtUigwClFfw@=Fk`={MwH*LptRo}v_x&PiTg)xX1vxtMDAm1NU zZ{50_br8Xs1GWato{=N#0W#06Mp`{OwcFt9)uXCEGQO?ZJGFDJwD!ljM7i9ZHqRS0 zgCV%K@|;No4A*gdHp7-BX*JjQ^BIxB$KahUh4D@MGu&Mjah?8LL54;grlWt^Y+oG7 zjyq!x3N5+4|7`i*r0Wb;(uItXI zv|+anXVj2SiPa&nJuFR$x53cwuwqMW#R<}=wz;sWz3|)8ILYd36F%2)$5>QM3W5>^ zS&?+9WajJ~FV~H#d)F)MP2iiVqc$}Wj8TgsLeBxMc9~17Wi7PTvwV^(4Q{jueGPC< z4=BUpMx-r~KcAsgU>i|%{6fpTR1>DMXlEZqbNU z&ZH@&K~P5Od3=ighaO(D@V6DM3IEVZ|NLa3t z=A_ggSI&9txPqQ|U)Fs9+V1N8&ig=RcO0D-J=>#RIxjN0(R0S@Rf(NvW%tLU!b}A` z_P9T{;1lnjVXj+n@75?nb~`U~pG>s$g~FgR27MDg$hGWN^_v!Srvoz}g4eF!UuF-$Y6NBsagsYb+u0)4>nq!|SU->1~gz(_9E8b2jMj z1a7Tz4~G9ne;-%2&*$do>UyA3`mSqyfR8yP+B8|NNwP$pWdWDZXW0GAbHTZ2R;k)p zYF?Iyi~|saLUMPWHz8-=YNHov->A<)q~M%_Tz&MLDkp6({l)h0>1FAgZvWDiqzwjG-~|u zEyz#L2rnb@9@I@&_P_~=>vogV@SQ(7TBylU6%^j!<(Tx?JbQ`+Vs8hMGYZ(T$6${N zTv=7m8jej&%n&LRM@p(mrdtFagz}0H3@x<=mE5KTx!CJi;z3Xb>&BhTu)k^L|8Hrb zlz_FZd2mAbWyGU>R*2m%bIgROiNHiEH>xlEbRqe@Vtp0!h}6Mq^n+nU5K%CH87VgM zgl?(Q48hR!$cIsb-bl_YkCYVa8x?}0hSl$R2^WZPN_Q@0yeiNIlqqXbr`hjmM^eX7 zaz0YTKA8&b%>|UHoc8R;{e^YIUSYXbR|jXLZAP;655+<|=)9YAujc*0QDAVAmYl%w z_6fZ&m%5Oa8}|f)M1@$Nbq%-Td|5m!&=7CDm)>5Zb)fDyZMC@T5q?9O3(`Fr?vn1L zxm=`aL-dBs)Q{4e-3O3p^J^WN5=U2v*enpsWy1$3o8)Wue!64 zn_jjndLmi4aH8Dw6}w5=tmd>lEv;iBc?rC#kFH1M&UxmJ+Ris;aRPR@))#j`P;y^j zc-U3^u0`J2p5ad05KExpxEMu`@JOWT`BQOc$Szq*G}ct}`y3GGvCf*AliVH3-ktxf zeY3uRV%k%)9?Oq!wN+E0SY%wJ#4wMVzHY6&ss%Dul9Bn^yn)OBwGNG?{hOT#H|52a zL6{MLX9tg3#f;566|_GnU!gx0Iv58}PWDL=&0v1<#mu2bM(9IW!ROqpqFKKiUTq5< z6-$y9XmZEsC%FA+ig`%IxIU}74KseYJ&7!b`T`llV^~?q*KtdBN>93*?z8V*5(p~5 zAoFqZvlTXlKMz$7L@^=<2tBQ$&ed_i0rP&HYutz9un3BCP=ndVICywml6@k)^$SK@&aUk&k=mlgwU3HA zzf)+kk_b!F=o@i-N2`#ds&L=xfk!7=%At@Qbz~Q7^vACn6Tw&hu$gOk-)aupFNym` zuQ9owUW@l^7-`25-{-M2wwf^K_{{y3rCxWIdLXTL8NEj}X9qbXqgcnRd* z{&dIr{ygCNK~Xg@)$S6raW(k1Wl9XuL7NC|{{c5d#zEk8X9EAh?6R>J@K|uI7NtM^ zj@ITdPA_!8gizzIr2I_j#f+T=$c$Ed@y2%{tE55 zA|S~Mj+XW>o6F7ccAJ`Q`X=k=473AWbo-1$pf4dI_c)$ZBPj9C(Qh8172}{}=+`dI z@j9^mfR=Rr&7i5^+PljKO2^J(tSDcq*$t_7tIJWq4#r5Od`(SOt z(gLX9oeQ>FHSP~}?Anp2<590T?w{<9D?g2VyKse6Ch?79w4w83=rCFgdkZah9lIrK z)VJ((3re0xtM1O>TlaHfD7}RdrY$5l%IXY5zlY1dglW0Yo=D_#djKlz$z8`;{+zHb3TdzPxP-nDiqm$cw1LF?~!b%&jJqAfD8_}<3R2qA6dUzC2gTk8@PkdQv zqE{GZ)QK(z3@hASarw07AO-4O%Og1Yu;bNHvTw$3;+;Y$IvTb^nJ}x71Ri}}AOD?^vC&jaxkt)3GR&S6JetqC()2Bir ztZWbsMGR&&&y`#Lpt%e~@G}LbxWY^5Ly+VtJLJndD_<;K=)j(qvaU#*=v^;?-pJm` zNYJGD4fo-6Cj@(}&KI4i@%U~Rb)zO)@|4$c^`MMaU|zZ@U43PA*h?nbLV?#|B3+X0 zJyJ36U`lSB;&EF!yKtu6B+-#e)iF98B#@#R{ikry`32Ex_=-5R zv$|>EipY!{a<&EO-3!*U!ecwUpcg)#QACRec@$UTJhqz>RHqG@gaU(`3*jK1Acl~C zsh$+p*>vb-8RG~07E1+ZvH&5#8+8OJ$-@fv9OQg%U}(a$f%L|n6ingxp7vvPDI6qD zSm1(7pC`|kC0_09=*!rct7SU)H{p}((T>q}gSEsYh;2}C-Sf)Xzh~m^$^vg&Fmx}b zNMxpONbQ;dEW}e*%>!@5JG<{t45a^j%${nnio%}q_%t%_?3Ag;(n5K6!W&vYlKSVI z|89y2olazY_7uC2r8l*jZ|n7mlq<#Gqg1;$Yno~5qS9WPJLhq(D4<;RR^FmG{9%vA zdm2k|)>J=6z1BrQa5+CV=^f|@v>YD4tY;m>Ri2WD>Zb!kwdcWvQiaEpNO!3Af1 z1BdpE=DmNtD`h$4)850Wh>+YP@1zgln&%se5k9U1KU;4U1cz42)sxy^346|Z-fZA? zNUC!ZvA0u!v&xwT^mzo+J_Z{{(|a~?n^GdY*usF=svWW#-2-3+obU7jHt=s}(dU-t zk~H8;J}8_0rS$&AoBXr_DKi(aHCH^l7}BmD2qn|BK_B|cV4T(PvNqgY|AF9u)z9Re zAyXN5C~TLum7k(xycz2f#y!zt0N*HEfiGZ#q9w@kO@F6EeKh^)-L3d)-m8558|(p2 zq|e2Plt90y#W13c#q^3RvAA^lLILjf^pB%ZHbYAVH{$FPV$?20+x0ET7Nl-?BhkF~ zzUPiGGM>XD=XLgj=~Nfi6?$%xK(j=I&%c7A>kgVx{v5$381&LGdct=!vGOu`E#ASn zE?^*ap0Ik3a=C)}W0S2lxU|c!tN2IlWE=?5I&;Z^wWuUmcfxf((9cG)JRDG`T|$K& zxwFS*MN#9403WecDm{6Z^SO1wNH_?+Ad2)rRUco{+7vhsz=KC{03IwFdwU7yau?2V zAo`>x+@T*xigI>^qf0VCBK$CaRO_LaDC!Ef>-4hDfKKlw0c({v#kseO{#>w;otf|u zhJh>Gh@AJs1Eu=H-2(-s+86!tT|o~rxdF`UYo0ad(oP)`8}B-X{skB8y`d*nEopst znv`BFzid%g?~u$~be0Fsdhp`O|fZFBoran`|tYR{P_2%fg{Ag)Dzlu5 zUh{k*?0kML>3;7=*o#s1XW6;fwbySpxN9G(p48fE79%zM#u+xa;VW2h8}*vw6-xZ-rG8b?rnuKuSiWN%rEMtH^mL5c#or7CB8n_y*BO zVp#02fK{dW%>7u=Q(DR!=Z2$Njr3`!?(=Ywg^`5&vl{ItE(sKUVSL; z8?~@MbmQHg+j(!b13);cj#5u-t;fij4XJ4xW;XDiDN3Z%2F+AiTQ-<$I$xW{WC_BRJyPNrH2!z?uZPJI%0@2A7KREnPQd znXTs)9f|F6wD*j}4`t0O34b63Io1_IP{poeE~YG_x#%|?Mb;j5(H}3Wg;QJ8zQViY zYPqZVW-tKz>u>~b=yRWNRJ+1xI&#v?Ym38$3y%m)->al#me8)F<~q4%u9rbF_$oTk zRvrx50sFHH*JRfud-0iF<`sA<5LoOU@>Ay9rK`z2olG1x`tsJUmzw*RJENcxKfZ>SQ&k zL1CA-j2q1t=PyJSQIFr^@7j}(X>0OxdDjer{Ye(?j@bACx}>Fa^z!@h595>KC@8`X zNz}q?9>8t0l7A7FJY{LaMB$&6wd)v}jqzM5no0x1l-7-PF6V9?I7p;iA(-y50xzp{ zNcrFekHCm^Z6@w`T`g z?q_Myl!IP9#7)oz3lp@6+if^T&|XYCUFf!<*;K$uDsrT*ySLTs+f2HJ^cH0JkSS%t z1q-KBUxZq^%cW*nDxsVRAwDg)gCR;|Pp(b99j&oE)=^mjDi2Sr6J}oIX9RYe{cfBt zVe(7|j2nl$J_4=D24!g8VR!(kSP@!I+G?6}a99m63J+$oU_c!|l~4fgHu?<8@hv=P zGM`6gb*XeXw)EbpoNNv+Yan2Z%yokx1YQ_p$2=65Dg($K z4Dh3?qODm9v+iHyWWz_K-icmW&0jQHpC+ZAJ2RU1yO_?M+x|L81p7hTry=L4K<0#6 zrdwP=aKYr{zuJSI&T!ES>y;2wGXj-z-(^lXFz#{k*QI#O1pM?Glo*M%ai9?BS6;h`UC)Bhj>i5lu)Wbie}@bpH4reM#%{b=7&Qc|A&~ zTLOL#ijbsXnx?uuY=AX&;p#zswI_vOjO^R?{>?gA5>xKrp)HgL34r?4Z};k+Det)$ zV@WavVG01BV_NGM<6jM4KMg93(#MyQ$|B_IMZJ4thy_4(Yp~BWz#$hxv570m)YU~f zvKrAx4)9IW^aLkvo0feyR8r+u{6z8Eo8*}MA}`IolmROZ7~9aV01p7vrOSV(E|nTg z2>-|e_#bIZ>?b-q3KLg0D&BSa-{<*eNxK{IKJ0Itn&Q3mZ%X8et@mBHZ*h*f2zLc` zL$N>QRCnUzV=Li}o}TPPR|R}%dQW}U5--j(&i%p8(ZhMb>#3Y1eZXgVk$<_ed}Z4Z zAbz^-|7ibbE|at6HtK8)Y^9t?tGI9o*L*i>#*DLba3Er|P5Y%N9kR8v9|% zcly&&$Fxm2f}TBK6~_{nN6XL7aziwAEuUZfM|7nDGK2T zdnP|aNxgb^pITX9=q8|cOE1|nmw5CjaD4JxtFpG5B21$IEu`u6R1D&62vu@Q%ZItCoEHT%b4p^5d~V(=S3Y$?$1CaL zZSN^#jTQk;MswPKvOmj5M8|&QZxDZ`vpQy;-~JkV(z5dCgxwGhXubn-^LhBtlDPgL4gWUwOUQ{k$3)j8~ITT$hX+4(WlL@TBf> zB18`OuZ;U7LbqmJ%&I{HL%QMk#d(QUr|xs zW+QEmerBsTH&?J-NF$tTTAUMKtTfRkQdIdC{)7JP#Y&OIzW9$J6bBOb93Co#3( zFRbmm$U@$E^lA-Y2JD)M8;N(0@A~f!HvUDIl*Eiu5zhN%dRMr{&v?T1M*hzjOd?^D z%$^8ef*QXdP@p-C?xo=UCM5_eXifN`}VA1RvUUMf$cB&{+P`m-I~Tm1N|Mq+Y_G0zk+v{>8yXi^u$-`#zoFF=T>iV7BQ! zhG)VzdD=(G7ClEXuVAh)-$yZuah!h8IF_;=d`lipq4G0gHbV=}%%|>^Cqa+FgyS6E zt&!B-@8NtuH`pxjZb$?u-Y&bRiH?#-QxPiA;s{|B0QLY;z4|iyBkvsFYD&W0VXIIs z+Dq-5Eon_iKslBy_!Cdh1@A{L`eof*ZA=!reHk1$#l=_m45ygqxXaKeGw_LXX0JPr z$r?JBHVmJe^TAA5b=6~HsstY=`M?B@yvdvDjJ+S|+=@s}=^BVKOEsbjEgs!!wVomL z{zhxive)aj@3$MSof#IS-9V88OKE;8rbdlbtlwPdx=FC<#0t+L0B@m=yM$=oh=}^y zs(OG+9bDq0jJv!Dw(_K&oBT;Q3~%%yM9&8PH|7$*^4Nu$c#5{O6SL4Selog|VL7Q) z6@!1U>I4mj3kXf&G2Hc>cOP9`*(;vCIS#pgc?@qbyd>Oz^ZblF7>d=wBazw+z`1FZMsTVGKfAN=^c1D;;PY)44 zhp<%&Q$Vyk>PU&=LS-DDscv7|nYS+*k3#z5(2HrUKL{4SYx z(JV7u`un>Nr5-LHkP}-4))DQcBX%Mymg*Uwd7N85&DYFZoilg20{D`osbEMR>`6kv zlyPMA+kxXA;3-e9>nW8sfGvyGaY&@{8t#7i3u<>K1w#`Lj80dL+Dc0jncHD}cz3c| zXDnpuv|rJvU5}zz2Ul@WzGqvBXe$Z#W+Z?ox;>K>iW8GO*D805b-DzZd_BsxY-IHGZ(uD43!Kg04qOBN8bZ&xyuPoj}Ouw=4(kG<&0ms`KzqgSj0bj4`Vo zZ(lSS0gpb}hEh|bf1%HJjK942>y%?ofQr!U4woS)-|@mt1Q^tU5~)YeA&<% zI#N;a;?*Ckl;uJ7#|&w084V>FzsIr0v7WtyezG)6t4w06)PH+^w?^PZz3Jlel|f(qlPP7oX0Cc zWFh9(bNG@0Oqsv;3J-F}CdiC4Pi(u^@4y&1Y8Fw%Qq)%QVPoccXSKpT61fi6@yCbu z13&w~=qL4DD!9(({@ydgrdG-HK%QBBc@~BIN=DB3(=ita%$#L$H5>eb&vtUwg+Xv; ztaF|&2U^se)Q!s9K5AXNW`6`+W8Y8?{-Q;Ov`6zAvg#{-JS)&WuNJfd+K`CnGe0dG z3M7Zgs5xy*N%~$3marVUkXI!Hl(GZl?)TwtDLypBy5Dx(xTHEaE()Lx_Kyz zJ_Bei#vWw*N%_UXav0a#*)ma6Cg-LgOUj z>SZ>#dqMfrV9E?$n=%Xb>UrP?y>Y@hWfeqqb7zVl-6(^P;-{mDY~+s6{_seHteto< z{>2U*4~bTwf6f^>2>iM36#}?7=*;T7S z{O8{LZ;QBuYD@cA*d zy4q;vB%BV6`6_CEUXc`!UD=pP2ke5jtvh$=Jo2*MO+bkBL6#bx}Q{r*(97 zYp(O$U%lOs>?{^ib*c37{m0MU=W1k48cTBbo)P+j*04PEG7=`!*{kaaq`^h|;C*l- z+JO3ioZX%{RJ+!1o4LB@DpLRzj1}-`g3;KL&8w>JfLs*$DqN<9mSErJrRIY8bmfvu z%u7L^ejECzB_O5M`;c`5zREPaoBlM5<9JDNj`S_K%A@?^H-!s-F`f2X;*2LIs^_HuyMP+3sY^=b66ST2Ia>PJV!Bv%+4z4Wm@ zqU+sg=;(-hPHmHx)C6HHz6?y$UG#0*g>2?A_?peLy)d>+I9C;uh$bB_yQ)RFX4&98 zVZQyO+&+qlWpuRdvH+v6qZqIw00pu;t73}cShz<{xw#iHUPv)@lZe+YuAF zE=`Y?PlxE3>#>(+V9ZFoM*lwMP#pNXx$xa7{^5K*pjHR1BAy~SF_r+>0%C}21ZwYX zR~99$gL`JUQj)zYaE~jF*@J&E?0g*SjkxPDI3EVp4-SokGU~?UO&Vk~UuMKZd?nN;R0X49061Wco zM-I!w8|O^vw1F?5(UE&INgKK&B98%?*-8BSI8fJcS9g?e8cwae%>{N0=#=vdbqnqd zaAcYW*1A8QY94E-RN+JXV)!@0l2Nme=Qn`RhDcAkxp&33f8{KM(X2M-s606)@5N~V zM*g4c(hZIX76ZxIL&rqT&4S0kE{q#GUZXcXw5LdCRIw*cVY6yzzwB7eU=V94P7`y2 z)YK-#B;EWBTLB;*{n^|I-%J4ECt)=ui2ms*|G`=5j~5u0#9FBF&>jsGmARqEAQt^R zmy-dRkqclx&Q5#3^d%k(U$|#$_uvV=iWmuf1lzAJmR}gtTTL(9>?YUe)K*XG-gA%g zaBQf2Q(^qoqA~aTJIi!9y}_<||Nhm6LOe$ylYmYs@{h7`|MdQtXF9J_(lvix%Q4>y zsAmg6J+mDXBzergzf!E{A6Cn~49o^{Smtw%!t&Xbr?UR2xM1Yj@7n-r*}M=r2LxFk zSEr24W69WpSXO8$U@bo;bbpXtWi5@cJ^#g8s?$~eP1f?sDuOfPUj1|T|HxqdfA$s7 z%(sG6D;$*1UH8o;*dnWZByR3ZoTBb6@o6A&&72plrjqO87W4A^vc5U>iRfh*lO(I( zpJpGUo^?jyCF=1H*|qg&94K=9#W2XvI;Wb_iP3zA38%2xN-z-)RxC2~Wl)9h@?IrK z8;m4_Le5fwD5ftGc?o2-6+ySzs2_aTq8nRw5$Nl{MFy`~JUVE~ZV)lTZ}K#m3xFoM z>y85-*MGDDuU73-9Sl*vD@A>4_;zj3_uz}Nl%Th(nRegzO#ZF*nv@Fy>AFC1VtttX zM~(bi<+_JT$1k`TU+Vf8ioHyLq!(;GK8O5V*Do3iHPVeF%n*k2PaH-$c&!MHZAcSs z&}}(@ac82T>~PfSqz<{*j)eu|5AD2@)!HG@hq!?gTRZ!Ni}QfK!2OVgd-ot-Uv4|X z|1wNjJIlp=(+@7+Re93Li3K8S-G>l>?MlO82Jf{k>5gXU`G z&gp!Ny+2Zpg|>w>$9`!I=CWM1KF(@{wd=w6YC=%pWGL~EWnNFuxPS1McCy(f&{-ob z?guDyK}7U94~~mGwt=}4rRv4i05uC;-2&L&`4(BiM~x#6f%jfC1EvM79wFN**R#0Q zD(YUVC7pJx?$Gd%RjtfVz?uQ_@^}a~yLe{^^wL-qS(Q8poaF0PifnA;(9^zYP7Ca~ zVF;HGPQP320-d&o85z{tJ-5LeTh+#gWoksttD6n}21V z+eWasZ(cI^$7zpa0I8uLwC7UK8()m3$Ofu0c^j&is~tV#ONfI!p0SZ<=(SV$&#<*> zPOl1<{A{UbYHT~VCFKU73F0@-+5ujZqKxSRY=~zklwAdkmSLmR$ivb)9OP1#f^4k2 z2>^2j)t>Ph1@7~+QNlf+PTkDT95;R0fh3~Ao4{@Dvc*!mo9|~pIuJgA7fPIkPhA%-qwmKWmJV{h__v)`le9; zmisk5$6ikJ_9#v{IM#b`#$3vN^qVdfnArdU9ZFQm#*j!?bl@?Z6m?V_FsA~GQ~h|; z#+e>F>Be$h77RA<7fD&~L0Yi-7n0KJEBqFWxg&UW1FjFel1GE6Kn7jlbgTm6tX`1q z7+vR(&)NX_PbSMMhpSTBjuZ*40t4Y}CE$&>X`req!$~?tk&wP4D^WNHT(jsuGn8ds zIWbxJjRNgtEDg4)-Pn!#(T3oe(|f^wp>o{W-GuD4FliA=FVOcQ9E07hMMrmACroon zDXz!bmpwNL+>W~@E-zKPAiiRmmmKK>pm7cLi*3DN0~)Mn$O4XF?gk8q8&7vE{}8)z zuVE_CXGfnciO=cZK}~$k0ZvO{A1*eq%1<_zm|0+eb~#gIBguy0t@-@}ccg?jYF$Uh znzb<~EzMkL8?1!q`@wG}i@t!iSk1Ta15>S; z;qMQVR60_L2AfJ2%h4-xCV%!B4g$z%)#P+qQU5Ef116AZ`;k>HisSl61_-vT!O!D6 zr$MLex`-_MCu`@WE_UFlpYafIT)uBQ0TVuOZDhmpGdlSlg0N>sy|*2j9uXX;;@s|% zqWVA}fuEZAeM41*=6~lZb0Gt8`xbZw%z|1lg}7MExXlhDjTPDwP)H#76)ChygMdS(7CBE z6llk}Eaic9QXZwO7jliR&wlKdbKeKM0khwy_ZOSBAC=4;KBLZKqMY)YXlx!Xp$zXs zM5$*svfZh?UTepP^rv#z^4~0%Trmi+O}yk|IAFN~*;>pI+V31Q+gNmF7|*KX=U>Q5 za)q6z!yn*cU~(()6j{xIE9Ek>{80z-dShM%!(*utw2%6Gn^ACxaqbjRhG}V z_D5QRkaHFQw$7{**aDHf__wEtRzD$;dk@R;E5n3k4%{4HTii6hl%}*keQ&8F?)L8mo_a}Exu8Cw!-_%e6AF^CH;L6V`%$TBTrykJG*|1 z1qwek1W%*vo}7SWp4tV>dB0EHIJM@qTn(*#@?-z!o`Zl=So*u$Qv5G4XhZpbb6fgv z6S{1QZxTmo@h?JT=eNcXvFs(GDPX^tRmmp z{~_%=!>7kbZ2}!so=Jvh23t^1vJz3#sjBMPTy*(8I({jooq&<>RUYi(`&>et&cOBk%ca zzqkgM6=CPY5r5iIJI1d{12k>LANp(^yG6jER4S+D6M$JdO-cjz6(;%R;KQs`F8YP4 zQD3$KggkntYO?`6Fg#;nh0`T9TY)}?@bXY%Zq4g9*Ve(ra&wnN)O0e&aPvJ*y&z@0 zKn0hb%TCTEZv%URg!(GB(8n%6BUQb0fx_!-+J9Z#{tLmMCPlOYZQ8plB6J~MiZ>s> zw3e%iitXpYqtspVD8%x~I(nT;MNvz!%Of7kC8vXyB8$Q1PARatb2ZkNeeKfG1{!^) zYV^h+E8YsGy2Ad+lQH2U2Td$}Ljkwnk7Ji3(!Sssn8oTEDx=33jgd_oCn2FYTsynJ z#S79$EUw)kL%kTjLN8yig&d#MIgd4?*8t8G4ZxW~AFyamL~7TRE%Uq%!(9^RflT*d!|Ddoi_TY@-m~g6p}eLPBsUxkivmjmL$^kPV2bOltKJ5nL0`Jkzg)jPSokM=l2(C}AJJI#nhgTvHDw5q zVu4x)f()cNo)`hN2{i2`EJv)By0sd-qL}&RV0Rz9Np^r+KN)iC;%?WEo=z7mPSgA~ zge_Gx5-OG0pX$@sFz5}kqnyf?2^o;76C3?8)=`b%&UUo536u-JSXb?$nXlxzow_I0 z5h|XbSCyYR+EdA6@Q&uV(NNvV<+5;eV)7_n@&N#xpRXSr`*0WU0)jAN$voQPc8f3( zKPmVrto>|v;$4SNp^!V;>|zc{yT~7=S*H%}-U9E*5SUEr0zY&&c|38;9jCQ*DZ)$? zC0TKyW%9=Rer=%UI^L4f<%Q{}u8T(1(67@%(7R$Xh&X*!E{!dw2uD;((0k5FD!VyQT9Y1>KGT^25dQ|4J(rl zIl<>@Ujkzoz^x2dBR+j**1sY5@z@u@hIl)!yg>M(?DCO!s@kW=YUH;>&m*pLeX7bp zZG>xT;iTP;+LRE5B}URCtw&t-L*j?t2I}u_Qr+Dd&Xk-wndMK3W~z;4j}N7v9kpJf zK24eD-AH?#8{LwE!Nf~H4>Q5MUmUnc&Iv}OKC%F+O6&C>krOsewrZ4vb3m9F6SwDs zSpf;q@A%M7=;E;TL3k}A!%>9&IMWp^x(yq`#OC*Y@gJ<$=Iv~Lw)L-><-1UK!FHDBgdUO&^M}<)N)?U1;_OgU6;E_ z99yw=np9_0KafQA%3Va4y&3(a0XVYT=q2berJUn==FfuJ9zCRS_#x*m2t(hJ?;mQu zA|QYO#+HR5NshC{VqZbAB1IamKEp1{6Ix%-`h%u~rXiTYb8ET!t~4X3i*?v_d`g@b z(Zw5~K$bOYu|3x@Pjwp~z1+eCqo3QNo1%zLC1LJ)E_*HLer7UF6Xe9@4*oBK6eL#M z!L*ph8?V&_AX0!^*^>;=pt2PZfc;8=wBExJshjPxWtHi#Q0pIFpvK`NK6;n%! z9+2>RI?&B$P9#F!!6e|+ujVE+yPSY6+{RVp(evI1jt*0qSX_NDDSm$QK=yT3V?UT4 zaE@4cvPpZCPfN>70>Z?gOw?{;9`=E)%H?6Y#$mjd{QimI(+$snIc@KN{3WMW;HCV< zbcc_IBMgYV;qZE1MsDn`NyYeA;%qsc43|p4!n_Q7na4<_^}hD3)_QosTrtO9!B2hJ zBO3Y>qkz^f?R=s(;FnYsJw|1o3AmTS>qOC{}EPAe(?$~>(1Q>>5|a!8eoBC zBmt$n7DInA{TwwyqO>BI5GShE@kEpjL?0mFdUu?{&LZDadj{8)$ z6FrR!-5}Q#R$=tMeBP5=hhJm=2uvf0!C!60p`kK8yz5~GCcu2ba^jONisa)3sk1zB zTz5ErBLS?R?^wC}qIFI|rh4s$&ETGa-@|wQ$sL24Xc9cOp-o^>SiYb9)AkzJoT0g+ zIW2fQ0my)XGuQmW3H#RE^V(GEdjzDJ?91`ox%G85T^diy;swL7IMbEW_@HyMOs+%aNJY&ECc!!t}Mi^0gZp?GW)$Qd+>whOkDjrJnWX-pzq|| zVc%H_s=6~59hsdX4t|dvu@w8xtXg0NHWOieCf?xWZxaG4ehc_+}F!R_yB!P`2{ z*ssU-l}r~2)C`_ux*zYk?^UTDX==F%Jbi$?_UOwmL%n7NGQDTi zr@5v)_wKNbc7exhO0`TmooO|MeAmbV3!iNT--!Q_?WX~G%_8pXi2UM31m6a?;}=c+ zZ9Qhac>$RBNm-Da83t@9>uj?@Z5LWKUh<5u|M=11N=9Dyyl|ohSln=0vtz*M%-TRG zb9D0Eye=$pypGK1l$2d<7}1~(+fY~_v^5TEw3V?6hr!r-{^E8qnf2zS{LZHv`+o^@64>LbBc!#&3&BJ}JZ_E@>Km(1rF zx5eE6jJx!xPA*Vvxd#~e8hdDpl)D1Dt;^c%>fzcVI&?!JwfIr z9^1E4MW9DJ?_T?+w5A8EWlH8P{>m=gPXF`2L^#nD#frY9|2M`Nr42Hx*bX!6en4Wb zdUU4sRz@E0NMrNdepg(wbZ_PIwMwx&q5UrwZY%btU%Nai1J?9zC@a~Kh|!D#?Bv@= z!!e^o=bYFos!WyU{5SUgZ5bx~9Sz-FKt785!G+?ntH}BdZJzoMXtO&gy0>m5yKq}u z3ltZ@#8Fb@-0Cpb6X>RPtLsg88I(mZ2RL(d`P9-IGzcOuGM@nKba^o6$p9m~2RqC? zz(8z^tRgf|c0X}{pm$*Sy^YeP70IoVWB12fKQ=Y`685K``zRNjCP#}fvpZW_uJ|lgvnrX|#H{p1T+nr(RxW4nL96xt zPD^a!?GMfOKxXR3qf_EmoC~Bkfx<#5qa6D8OoW$JM`*V$UR+`Uj2GNn%_G59QR6otKNe$YW`yU$3`Z|{c)H$k9NMX|@ zJk5WrW;qGij2#OAHe;4m1u>JH-^__^u6?Gx)GvTT)4C%LjmClRw2gR2>pTy6$1qDi z9&%G~J#)Nd*taZN8rTS57?;!JU35r#J1VOB8?)wST3z9qU{zRX2H-PTT77O_d2KrT?bN z6bp;`?eciT2ffKkU`Qbb?d|L*{c)IOUQC%=+7*h1pIGhe?*^jGmlFQ}0(+{vd5mlN zE8e6p>ds~}IchEwe!0nj0@`Z-8#}7|7-&zaJvBEItH58lb2U<2w}2hC*`b$XuO;c}@SR&hw3xiGF2fZfmng2!7eG1IZn~mfiU2m4r;Bl7E z0kVYaptJr4{im<&{~z*{21i}VhfH{xqwXZ8P|iE21gsu6hcK>e`62}tpBOa zEU(vf-e%60b0u`rj|Z>tJULo4l{X!j(Lc2Np7sYkg#(JT=$Zi8fqPaRmJA0)u4aJAs3@l4+#iL!C)OT76EzfG$I6 zd#Z4Oru3qD%T5nnEPxg)b97^+o4@-~PB_&X=|4%hNT5dmad<~von~CL0`(PbGBoas z0qGX`sFJmaV*t?F|ABTgeGcxLc?)d@#z&6ECjt{9fiVJFp*&3ekGZUz=tR{-u^or33je2rd~7glsZ{!&Q+6SX-RVn zC7EAoq_IZ~hPC~qDoHYPsIHZq*b?>L9t+O@fIDASj_~GxWz{1dLnTy(+MuhxZR|xU zU^Rc+j^cxe#q?xHa$l|U{sqwu+v@*unf*r2t&CkyoVPv`Mrsq(fe>Aui z%F=vDUx0lS|0Cm*I+vx3vD4*QdAJV3lwN;_Vd@A2YpA9)_i$&Aotzl>D>Xv)lH*f5o5dJws` zqYysy?i4Kx^B;P4o!iPaeLe4K`KSW$o5h+>T$+nts;Qq{`AVK^53kkR-8t3eC|K3( z;`!~7PwZsZe$NjRl0{mY5BGaa5~H}sHL|2;w~dsqL2~2w=2*d&On&&dbAO$by3nnp zgdRfx`|IFeg6iH=Oz=V!&25+KbJC&j3!>LyLs|M#_+$2Gs+n-!_|EJ-N&oNy_;>xL z=D%G0zv?$H>(b)7n>TkyQzR#_(vk{rZ%u|1R&*f+X;E>#C4&j`-M0%SFA)@4m~Pu# z=ZmD-&-y`%K6ur(R<_Ff^f9e6=OqF~!_Of>c> zn&8{r9cy*I{Y+olzO7}e4udh;{T)_P8*3{tbsy9vF6FD?-eXbr1aB+1*BLa%u3-PD zAmKb+^r-l#4CL7qP1WgR-_i0%)5&^pU~sZy=qvkwBkMG%ltyIP|7w9O`Ln;_vg5g5 zLz8#fZ*IJR?1As&JZ<4e(_Tj;*=G}vy%`^f>oi=eL4%ui+>5TRn1HE_7&KU@Xvicw zzU%L)uLBt15-_|N<{K0Eds3MX!y2<4z`T8a9UGJyQ;R<3^IrN0!Hio2{y4)+IFeK9 zp_=-(XVj>|Lx}alq@}|u&D)e_3aKCryV$H2&jYiMkL8DS0WC6HDC4cw7(WI9OVWB%ajY1@E896pjEJ#s$vXnynk9m zV)gz|_=)=;#YTne>Px>kxYC@5i1wbA`+XdJ`cLM_puNIrhz$TtA1R>!z@;Oncf}Qb zEO%I7f=totwiM5jzXgW)pm?me(4=p~_#Z!?+RkNL@y_oPme}%Bh3X&dY4LZw&{8Zx zxhNnHw1D&%DQ>uE)yj)GOfylOj2$sG*sV1=jK2Z94#@U|?#!F|l3 zy+Yg$TEOB_Lr4#Of|SW}q8WTd_@_aqhAuX?Twy1@Va#+T0Ne>198bboWR zgm<6w7gw53cIqR3#u2V2UurJ&&dTj=dJclx#)U_J^IDm6qy&;8b65SAXuL9cX!}4Y zt(*0b&m7u}*{?CQdYSjr7BU1mG9w3T)a1e|TaFY^DwvkR%e!*me-WA>7cIjczcfkY zo!a!gbzGCzknuD0`c)|hoh6A9+2m+=RAQC~?)SEoGcfahV9cWEG|}k0_Cb*#d-T^$ zo{gh-yf_jSsUFr_3Y{g*PwLi-YgbtGnV)` zSy5v88F_;fC*0+Ir1$59C4QT{Ib@0i%9VZTlbj(Pkq!KG6)C?ppYM`?Yd)DOt>u<% z&8LxlM02X-seRWgtO zYRXu}csA=+I9!xAYyL@XxWf2(3+|mD&vrz9?+XK8 zDgkn~b2oMEqCX8gO}$442sOK@JwI?^qs1Y*^8_)E+^0#7q^Hb#`X7)-=#ecgG~RC4 zR@f!tuA?qVP7Y2Gxka(GAa`oJam^QhUlzHE;7hm45(zmFyHGYpXjdRSmGZ5RVy8)v#&6L zFdb($TUV*w_mQUr_B>wQ<4aalGX z^ZzPJhc_4Q=Par4=E+lmoxpLL-hSJN25>hpEUAZ*&b*TW7AlJpqjw{czLXHwrzk7fib-^Z4|6e3pERlv1ooQ}Cp`yK7g4Nf#1@z_2jz?b^Lp!F-Qz zNRzsZZ)M_SBQv+y1z(E<-gap4Oq)tbJtY6Vu{q~W-Epf7(o#q8YTO~8Eq{jjDER_d znjV^Hi5E0n9^$13{3RMW~ihOCRPa5qE zW1P30Q>rUCd5oL2uM0yuR>YENAAvg_ZKstSW;o^W_DTbJb>yK(=Y`_1B07;19tQ9{mBJ&@)7M&z59k<+eWMg0W~Mw%Y+)+NT&Z&%@=0{m&f>zk z)zZ1|2G(+bBX+MJ^-KPoxwaM4TB7nLhw!TA^G{qwgOVGzv8^?Vkq0CN*b4U5S?uK~0A z_~z}S0By~mV#=r*m4#_Xu4%bz@qD`sVx_S6BFwLmYy{@aVZa=R^m2~L?CN02f&5Kv zivGt1P1MkYPPS!vH)h|)XOS}e0&}11p$a=J`vN}LcyQwmN$U`ERexn?OHPPJYVpyz zyi$rHJZ)9H4*pCJmVO;|U&J}t2_}N>hw2Vurv-K2v4pa$vYTuX^zTm3b+)WV&1l|r zMQ07>yF&z9TLNpm|NfSDF$kgQD3U?UyORUnz2bS6>h%5;%)$yU!^DslRi$0=`f+{w zC&t-E7j1Mz7Oosh=GFUjli^4z%(NY9eWil5bho^!2#yQb$fNk!928y^B(2abDDN%{ zn9W;~&&na8tOK}VZPlJ)^&W+6Mz zU9Tu}7-~P~o&NJ^5q);UWDJS1-9M70uMqYKhQH=kh)i8P6HIFJKLg7X?}oBcHo6|_ z7PDr;%N8+7sIJ)jN_I|hQ>QDY4QDd$7&TMJH~aJ5VS=r!;z#~6j%nYu?>#yy1A>{y z*-iF6L#TzD>{SI}gj3-O&Tb!I%o`OS`T`c0!}?beDO3H1qH(Gfub0eV;;jc4*;$7K zTp~key0gA#CC!^?Z7H0~HzFQ0-cqRc6Fc!?@*>+zQL#$q`Q=CpFYbGH-=6CZQ?ENO zJe|TJhj+|HT?!myQLEL?+qT)kCw z?rw@smz$ks=_$hKEq^m*k3ccwc1^2Ng28Krw>BTij2Z1VY2+6nq+_$$P=?4VgU?PM z+dUQy7SDAk?RSofH~qZWmlcoq{$7W&yQ(yjg(~-x7VZfnbg5JZq^Ks;XI36yu^)t+ z;PB18%lD2%McKV1wbBd1@*+}HaLZj;gtEs`d6%>3g-2TlL4X zUmD!!Gz%Z+>YJu6)2&sm7Wv@t=L-Xod#yUd-tt$k_dJ`W$g2b!e=dJU^`_9%t>vN$ zSo2g<^JK4QL%63pF>$T(<*-buasP2}xCqe>nAWLjNa{4IeOmt}dvJ)&`*byAh+~sb z{)g|58KmHhCiUdHu%T@774>!fD6V{=>satOvaEI#!YA%0Yla99v@Tb~C}gWwU;VEh zrGJ0GME$F3CX!cI5(i9{Fx$?syn>JCS5KzF1IK3@ z{Sv1W=1f*oae;l)B06Yf+4f7kuyk(+r`+XxZaaFVoW=K_I+=KLJj|#`B*)_J9+rX9 zs{GS;6$eYsv1D&9U;eS)G3^YZ_mM=i8pFQVL?_lRnL@Ul#FU?-DXUYD5ww zBvyeZ+|M0-ijp*f{37~Efl&Cw;f+v_8H5(TTMcnq*<4nie{6D!$8X85K`g3`n@|Mt zukGi;d#h1)Di4g5VX;%ODcYvZg;7@@GbWD)A0D`p17da3;mFEKT8;FVhZF^Acsp3T z)sRW6FXfX~F%vHWwGqrRj*WUK^Ha4$Fd< z@s+icQv5cV8inc%hc&Zd1l?(_)sNxOo=HUgG zuThRS_oDBkw<8oGci!-?4+`q9=gb=%Q(|6*IZ`L9PTbZPy5}2v3{`2a%X~YSd=Xpn z<+_V|t5AkReM?U&Wcr1@{ktrVK7pKl?tVU|uJuBm;N4^uPcl$U6vwx$e?%>d-!Aqe zU0Wn|%%bq6l>LQtYcZl*5Wer2*_PuPj5BE%im&2&30r?$vPs$k?!J(sb;rXQ0`ajt6O-S{8yNWjLQ)nDUz|567^$@t$XmcqLA? z!x{aR;`UaU*B|!vjjw(@i*I3AjZuJ}-O;r^H~bv*(qf4i)V=QXhI)vlEO8c7Qi1Iink4sHv+{+EQ2Dd2HIDUz zTcXtyBujl7ch};jd@K2_SN&>V9bo)ilXc4V32&b15i3lTQ#w`h)0?Wh zE~f^)eIM>U$}nTQE>M;2?8lA%G-eFw7p0a!~@6^{#nGFQkJq z%++b`xlZP{HBydmr~*#!mIV8~sqFqpUfa1ya$nX*c7Zn5jkK6I0s6_NGUHFmy6viK%%;75>q8w}3*X~d)D?McCl}*}%;(R}w;?$* zg~l|EG~zL*z9M%L$WQiyKn`*U$d%IhUUKMG!=-~}B;%%FhUkt4``+t*)td>My_g4} zB~toq&1`?oubdCA2hD-p5yHBpWiK&vGYlo5xhoJqZMY0CVLIDtkvQe-`L4f1olm{-tD{-*px@z^#UOfl8ZtE330-jjcH#eN#F!OsmXYLOQTEE=qyP;U>=xjiVIMm=Hp^(!WywKEp95iW34 z4GAS}sjMY;<^Y#FbIsd_w8r1V$L=%k!-(l3t=FGxffbHa*qrT9IzLuif`ZS%_vR2| zYcJYi)$2l72Onqfirxqx?g4MHgD#pBIGG~+MvM>k>^Pw}YQAcL4G}Wvm)x}3pS{SGZd$SzfAMN&=9PQGS^_@`AP%&Viq zmp?Zsre!6)=09llB;341Ddva!O}eJi_fgD=d-;)L4ozw))a3?}-x^=Yk%i8Q=f>tH zfxp{@rOmEv_-9um0*AMNv47L*L0-q`5ym-v)w?j^fe;(M3b3oh+0Q$B*H+4boD`At zga-pKa}@u3q&B*c0E?fpQ&^R~v-bvfz71moAsjqWZ`BXWJ~Gxmg(U^vpxzTtgViS? zwZ}qXx##!s!zrat!DE%RqfdC^0JvF*(WR3vF~DtN|E0V~YtI7O>KRYRU;d(+V^n#* zk&Vu&D=Pn@uTfmP%`5WN{)KF)(*kQ>hx{9F#-bc{xg$TndQPWpQmo(-Ztr%N(_eiupu8R>+K;uRq+q|roU zo;3n>r@&hZdGywSN4@<5p~*oJQT_2PDi>$3((h4yPOwP>gr5ntEs-P zA4d2A^C(^^VazIXaFK4KZ;v9n5*qj;>pMJnj&QIW!un19lOy+;dG4)F!A^+~B9j_a zWB3Qx<;o;eurYRbCsa1g2Q4lEt6J;rs1b2c)}aj#%&@WmaS zSc;Z>1!CXmJ?$)hG|eY=169-9dhG#2I*Z9W(L(|3o!O#NSeHP33a3UfzTRq2nr&8( z-=mKmw~5DQHV=yDQ>fB(5BqZ+V2AXBN;z-U8JJ&2j)^MKEhf`u55lR^5FLv36Y`I~ zAdo;f3&Jp3*{!xcJRe!WC?nx*RfYZVskHf+eRcXv=hBi=*|CX6$?J6n5B7c6{P3`} zxMA*U6fFU098O)+Tm0&x9-JZ6hMMpWX?RRmam##XwTAg318Hg3u>{N0&)yu?aXbC1 z(dm_f^U2-##(>J~SELjN^`vO1LKADxO8c+0Q&t0*DM2LL2TI-*4JQmox~&P40eutc zoRSX74966@@e7)_>|N$89kFli9Pc%Qqz~(C_>FaolYAA0zdI6!r`Hf@&uSoPT7&w2?Qw}H zbBa-b=fN6%|Gi=TubLx1fz}v>;bRfJI@gvjyG4<{OIx1N7HWLq&1r0I^~3-@-T*H2 znJumDQ%Tuw`}i%LlwKZBUT2(7zr43kW;a>>ERn_TteWMEzFWKE4i;e9dubJO8tTe5 zl>{J`=yTv_pbgdymTBzD*xT@h>*tpA$3w_WLBD401h z!~~LV1!iG&%(uY=Y~>hNPi_uNcdj=2NF~nXsuQ!p=4BT_!>+XJ%Un4E({E}3&=4h! z+M9^-+vn;|cjNSt)G`<4vvxUb!cXxXrK6uSWM&!Nm#4A;g75|WT37E5_d~Nx7 zl{J{W{UG$o(>zZLz+*)GgJ?__;Kf@0X1d8KRrYLt@*(>(t1|TloHh*ZZlCNg3 zg!+{EQ@gBizaU=o@(gQ}pdS1(tHYub9p#5xXxHD@622U76`biPw>DYv{FJ<_$gx{) zWqLYQ9szA-96yUMXvN+d+2qc28ftp&60)mn+U28F6Lf}kKw$B0tK8w#s=N0aFt^{) z)jneK93XiMI-G|V|P+=q+V1KCENo#`&sA(ez-%I+G4HYlSSLD>R%G_;c z<1!2l8`=nBipZtSrKas!+-wQS*l?2GyA0AZvKH=%rIp5d!|hjV>QsFZ!B)q&d^0;p z$AV{ktGBCQql9)Ou`u?4oyxOgy^>eQ&c*Bj!$l(9kIz*f3E26V*r*HmT5-N*k=jR_ z*++_0UmCyWGZ;8jBiO#qSVAEQbhh*g+&1F9_W{F~RP+*s?reEyPxwJi6M{ZqzT6dd zwazgUd5e*p=4jhLy=FAbn#U4LIu1|kq8ERd>6h$F-RxWdg=1C$it`Ls{uG>Gd_$T3 zF*1bG|NPR!;vd63;V1q0_4ly_{A3_y&aq*4a#SJT2?o-^-HDO#gHA~u2HQabo)Pt^qj*V4I;8W*$qJ_RQQ%1ye1oZPW4;abjI zIVuL$iKsn{sfQ4%hQ^0Hd`nd$)sogJQ;Nsul#m2_n{%pB5^b6!pDsE_<}PRb7E2`D zm4%je2#J6C0B`1QOa9$ulwa{wuKk^w_M8Y2%Gsz4-W&i6A#q@wp&M)8UmBaMQh2=I zAt2CEnDs5&+S>vByF~+A5rXXh z@Yw|{iz1;uP_GV7D-)MFr3qq{I?>bovb?~n1);j@!pX7>hPgBd>wrODkRKNFBWxy8 z6fS9hBw7OIqX_+vqG8jycY>S**wj8FjW*6Kox1=Q&gytSlhHTV~lz}r;JXTL;L z#^QH&d*M5sVWfdRd4b&aGSB2#Zy{` zPa#5gSzZ!`P3NLkru}@M^ltaH7gq#+gzh#(ve}F+3;|}M9vG&oxkR(zY8}4M^yUGxa z)?#^8hB+4dwh!y-qpF4JaK-VkzT}+GsLr5_KQOKkfD7cWQs!8@0+u>fikWa-ML%k< zQ~Zy0P;W2F(!Sk(DgA3Z2-MqjQDE>SN!?BQuHm+sN;lC%s}KbD<3BA9n9;JgJ3IfC`Kjm_63wlZtavQ%Uw9@<0%PAyQbsx8)q698-)tgWXTi zF3{@MSpn0saA!BQPZz{boI{Z+1KhP3+uo_uS~rSFfhz-_lkfDN2S%jxkaVZ zpDqAj^i2xeS~u4x)e+%@G94S)4dIP9)BNi`l!h2B%v^&5fOzn=IBoF@FnLcHYPf(^ z)uZ%q`T(9aq4fvlE3G0Cfj)Q@RacYBF6RVb56}0OD8u;?+T@UsBBTo+U9r=_u{89i znsde#Uru3v&_wvcyef6+#ST7HKGB=;^1ee4UeukfrF)UBCJ>hfJ75$z6+wPsdObd^ z)m7}|;>3i2+l&Wct$*RV{)+z_u@`D69S`+402tY9VC}h9@#_MOVZyrEN`Hi4G0w(X z?)uu(eiL~AVRi%ic(<`fo6) zL^T0834uHB@#Q3f_e+k07gp!Z4eH|z@#}44?yPE?c_q}MnsJFaCJFpCLJAG0O*f#y zv_6~D6jCsY!|@RY#Kqbj0klD&7Osf6b?4l0hRe(2p!sUgd>Fg>I%*pA{wn+Zg~K@> z4BsGm(M%Fp|7fNl2V$-j#QzW^mQtS_{Sr-kk6lATnC#2byv;CBMNs>~C_ zy9juEcKEpEwL!cRm|a}EODRwp&K00TfFTM%TQTPXJdt0kElvx(qdxEP4`@VP>RYsa~MB6$D zf~daCm4jDOn!M1#E6K-9BXYh;U4?2~;g1bJIpA)!y05 z(C+*orW0de?XYI}fb(6ScQpcc=EF_Ogpe>dCR~|8#x2QQBOcnn`@s(CHNFG1`Silx zBmC1zHKR9PN$5h($t8u|{W%^Ms9pKq-(+`1roLF zXJhB0Y@Ki%$yI(0Mx~ z{b;jdeTX|>>*V`$=&y0EYerq&I4Yr@d8(t~83BS^ZNra8!o_`E0FKExKi&6sgCE(+ z;t<_>@RO3?nsPO&B1|}~>`LkuU2AYhaV5qKJva&7+dGqzwE$ZBp7Q(tXGqGpMU~2} z_R8BSHDL4~PLgpf5(IM|`TUWn4&)KS#V)`M3qHKV86)_HYwy2dkvwnRsnYZs_CTz- zDl|}Ak;ho5N7iNVB=mzjr{quadKJU0`X2v>X0c0xn?v@+MK<- zPQRORx%fHtgsewS>1^TT#m5sDOJFSM{v#>!?FIwe-eYP3=&o^(HVwm#qI;Ci-2++PFcL|`oU$W zSgT?_=#{0niuiR`EFJMxVR_vpBI*vcDEWq)t?7N1XP2JF7=f0=jqE21l1O3fJ+Z$> z&quBcyp-}qF(~=wC9Sxp=EDtW)6}Q*v?SXDfKo&NMKIz;{ecJaDZOh}^Kj5t|(Qki=hHI7474_hy9yb>cvO{E+;!EG@7j=8t#N%*pVjw#)GUriX{Qkm11N|i`) zXG>kUro2&!`{~louszYGdgzBpm|Qi=1Q#b{6sUm=fp(`S)M%{gu3K@sq%awLNp$;2 zNQvqStEs?14U3T>i1RBQoML&wYqiX)!LKcNc5o42&*bEmc$VmntTDv#swVI~K5_Sy zWJpqY?ANvpkFQhn*EdeeO>s5L0voN?vW8fB^swVXaGpE%@h?w7{EvZQ>RRzyu8c+M zE*LTwrv7P)0U;OpffvZdD z{4p1Vdhv^4wMBMCZSo?|ydd%gtFV#NdltutVlZRsyy}iq{3&L=o z;~E30`KxJ}n;z5t6RFLTqioRYTT_W)>9jOMTET3YAgR5RC(A$f7UgD^j{g87z+hM(UgCnVpovo3u>0VCDWa;_M(hZnj=q<`RH{s4+)Z#DyuI3JReV|!~ zV*zqrSj^pD?3kTZzN~`jeMaVCa-SQ<;Yh{k&0_pY3oJX%op^7fr zi@*KUkH0lY?|xy0h<#jtuIpo@89pdha`0lsVpU*QuT|`vE%7_m(yv%;YGG}1#iA$( zv5Q;Sw^9bVrI5dVVWKTj3A;Y*g+ovSCxy8Z{p%*BJ5cwR$D!zw%-$u*^#NyLiFrJ7 z?3I$YX_i%YblJeC%{Je%Qp%?90H(++dIaK#O&WTtXuRIRAbj|fa3MR?%Cbnc9j4`v z{JMGn+m!~{(BB02w}9ZDzot6M!KhRmXi-gVrvR4Z_`Gb}HYxw_x=2A5-w=O5`we&| zC9~h+s?)gy%lp3>J1w2gMS8OmK;HTcWYD-Gmy%|Q^qJWtgy3bqyH&o3 zd4{@e?m|Zy48roCdCZ%Ycf`kCGk&WiR$*(YR>>YELUyCX0;hSsZWHGw^Ik~54FUWu z!niVRKNs2e_d$-y{wW{gjZp)G?iMK+6vB0_*Q$8E6oLW)i+JUh>=b57=Xh6YGbSJF zh~Dg%Z|p#O_bs%5pT{ns)@7*o5$<2QNb9(*LHTD-G4jO8KHF@DErP>l8j+y zEHjoFGxIyAKA-ElfA@Xe*KvG&@BS)vbR6&Z`#jIr_Iy50<)6q`6I3s#dnG;(y-}&u z#Q@1u`KLZnm`Cm6m1zzdwvB#r^78=?vc{<_fz=w5rJgqKA0!Zi@E&62Vb+G5;hgY53zVA zb)cfo&Pu)AnV!wAOO!!=GxKGqa~9yJ3zJRYcj1x_osNcS73W|IbG&w?1R=$b#Y$ou zO~)WqPx0-312htbbh)b~`l4EWAD)v8TG7JukCv@k0%`?2X<;iZ&E9YC`@N-KoJlrG z@f~(%^n=x4c1R`2@AWm?kKgS4us(gl^$VQP9|n$o>~KHhni|muYcKHAP|Q4(26YfA zn6NrbKxkik{hY2Es9uYvgwP;4W6Tj+zd2oFt0ku)T>O>?pvW`thM(kZk zTe+@Aj%~-ml~1JlWtS;A61lb$z5TfH%(WJ%8S&i%Wmt_Lq0qf@aa;V)0s#hQ{Z|qq zYKmY`>X%3x*oy$i4y}y%6KT%8IFs7LIQ(%M0nWLNuWLlDBSelMTVl&Duqp~iwaG;v z`Bc^#ihP)@4LycXTic+;=6I!$G0My-zaRBVDdV=X^=ofQMsN-nrAfr430QJ{A7cH4 zs~w?2L0zQn2D*;4R3$~3>$=U<7p=Ss@kE+weE4R_SNK?qa9>Fq3~kVmD8s!6vHiXV zkJ?9bS|B#-)`X9d{VpG5LXh8DD3$>%LgzCwS|;MGCT4Z!Du;QLYlhXpr-R|%~7 z8LB}27wmn2V2i3?aE)MK>ruoVREUZ#aOCbPYmX?0AaIj-io9J#{e?V&Qn`7J!MN!m zB}6`TWPH?_TxLJY-Qtxf@P;|T13}&NZEp&{%ZS>oeJbj0yx_O zJDkVPL%3vB(#_v_+_LN?673!(_5PAXA0HC~DOX>EZIGB|q#?fjqYMHb{KNiTDaK4J z2~k1+_));{l94hv>)h}9v`S=`9!%LyFRURxMLe10AV-JSL?2Qz!}^Z6^?B0R!t_R! z&yQnkR?RVaW9LJHq<4(x_|6Y@G4wbMRo34j4HaXYmg8of(FKNgkmn2;ck?ggL=a&j zZI|x46~fF;OqfGT+6c#Tp<;@IS~(b^38JT*XYb>CN>N05JNe7N+9foCr+{R*??>px z5IdVqPC~#5VQ1W#d`QPA=UJSw3H8gxwjc9eW_c(D^?{MmNW&Dr)#PCM>ukdHdoqys z_?DK^2TRMQyT+?PZ8>7nRzryoss}k)T`~5%k9Zt%&U$>Q4Y8awz9#S`LnMJg8$e<} z)Q^FNG0ZU=@g%R2&*k_8YtVF(9p)w%A_qDOE)Y3Zh*X$BAaY@q&sFJRFqV51vy3HO zr>&AI)?4&n!E3(HugoUyVtBqK7J-C-achOh;a5_vq->i=dml`#24!rc#Hwya#L|H| zP4f79yI-DMyMl(?QShh2fdM<@_ry_xlwjxFnQOsd&82K%gm8&=zU(KCR1{Ges~8eo zTr+WdeIR=s?R}%I-((;9 zSRkb7aZ0@gMHl|~Drv*}Q@)%4w4dK86$e7$_kao>}`=@0C zRA43RlK0`B?C|IvQ=4hKM(!C@xC0_dXtM-T+Fpy>r6=p?EJOPfx3W{-avV^Cl`br` zG@h(cdcf%P3I7>j?Yk6IdMhGAEKKq$wqo*i3~4*)y(C;)`sq+j=$&GRBx29ZY|vnHbu~hA?3}3;3)a zY^ibCyFj43CU)7@&h|wxqhggp-KQ8bc82h@3%Ob|Zd!y{sV1nea&b`#6^>L3ysHsd z#9s0v5WyzaoHzKU;(alF%`S+0^lX z+@*yUPDPGUhjUIT-ZS#)>oZ?p1U3B3itOP^dQZgs_dplKS8lS(7brdk*+9PBSrHvk z)`f8MLAA8sqn;O7N4v?ahhBr`*}t8L76n@wD%h*)d<_so5}4I zLmCBeTBr4K$DHuWTGR19f&$#UM}Jmd^u}HD$%?@F#3x^ZYLJFDk`MQiIEV(?Sd*J0 z{;M3+rf@!Uh$7qamubymR`&Y;? z!}Ot4Nd_iGVPljOcPMRzPymWG()ue9@zR9DVy0E5<4k^^^oE{qe*vu2YWy?ON>hpm z>6G{`X0t59=;96XSj4_dC!2mJ>y?FOhsu=sr&*OYvD9_+3}XT5y% z2K{NNtw8A`Jr9i+Xs8QD%yanZ32@_(2qz!%R1Cd*?B3MQzS(S)UGf^}D;12vSCs|6 zc=)H+TCc55#hA+~O!|81s4|z@WX)O4q{qkR?kj$*su2yGe~)h#hLKSeo6P#F z+|0%#A2P=dKHYcau$}2lN}xNXzy&i+g1f@$Kaj{tW@a!rew*&XE2>w`SE+D3&sxe4 z`86N>ON>DS@e$MD8nJN1y{14ghK~nFQ5YQ6R%LcJ^|c`pL%cD3Hr{F2Hq`L!0t&HW zxjYdjfW>CN-l(~)Nj-tY5J<#sNd!H zn7>jQgQuX4l)5$L7h?{_97bp_Mk}9hse6v)?q)6}V*Jw|;Ii964UlarkM)lA6GaSi zkXN>D^*f}nn}d96Y-FV=GQF+9=gepfJA#6StxMGSkwA_Y-Mx@XigqCBp{7)y!Ddh$XX1d2)}RenC4pGko+`#vM_x!D^tslh5k ze3>XXd!5j){J;i9b~v*kYK^~A*xiG?G6S4Z{>C~+P#`M$l?^cRaJ})B-U0HoMPJb! z;3eaX!4mfZDWJ$vwC>(3Dxl%avB`$>gohR$Lh_O zigOy1)k7VZyfEC!<6pmBol6*xI=#GnO-*PebQzopXqtHE3@A9I{xt6m5!uiXMvibk z%zvU0-zrr^o`TYb4)uZJ>L$vxA|G>zJ_Ks%pWqAsBz__qd>XaWhbG$kTKX(D3)60_ zIy`b9aR0jSuGF!wqk<1!qez?o0MAE_GGg(|4k#Km<({oNrLfp`ome>)z0$(I|3Hbs z69$RNATbh@B6S16PR!43JfsuO6%y$2Tck zIHkbNe6T(P>ppx?@^jEba2hu>k0joQuFiX1P$o|cDU9)#)C`a2GKu$n=8hx9N15L} z5K}EZ(83Dkz?JKepanG_FtVYIu&Qrb#@3cuTvx_y$z5hWy>GRMSr5U0S}YGFV@_Dm!d!^44zl5v^c5BwYyX;`dX`0elJ%UdMTAbO`!3OLpf z)$U0dC&kQi6CC1=x_-+0vNX*Bn3pFr=n~8K=QSN!0-TXx<(2vS?DYG-5hwq74i+L1 zp*q7sJ(KRh6_Mqvjri;itR+02@p-#tvy8v{uD)@cS6*Afea7d z8qtmIJG8oWr6pnpD?uf;g4fM4Vla_PoROa|U6TdL8-nnVPsO5+ibpe+iMF6rjFMmL zAa;;M{nG-l5u-^6+e@ns&x#NPG@>1)U&`!+h%Uhi*bf!dj~He{3MfdM!03x_U5o0k(|EL zkv#apT*M0Mfg`1T!~+fgpqpm(6Zi;CZ?1Eea|eFp1aHffE`S@k|Ky#ODhHG{f(#B0L zghG^SFNSQl>F4P^zgSQ)mIvT&Y_e|?ch?&^j>Nq}uHJgE>cHmLN`rxRQfnW4>8rRo z$QPH7J`gYQOMFH!xIHkf0H>hKuF*joAD!IE{KBP`my%7&x9Naw{18507O<8c4vx9R zI^)4J{dU#dr^X?K(v^yN%?IMWe(Y<@vN@|0UtSzzcn795U|d!US2zMH`ng-N5-Y@( z-3LBT*DklaAQdKwptCfHQYZbYo&&8tgyE=D#b-i1ntnB~9gEpLkzX^q23`OjS_4&P zgVSWU4{kdVy2@lAnH>W^mTE*i>ekIDi{cPJMA~lNtTL$*w{D-H1=+~6N%5%nFM?q` z1?}G)=3Dw6gQ0r#p|*T>lO)-}iWH3U;7mXDRSxo81~rct2r3H*9Gg^Qf}XzmwWIfX zN7>NR)nZVGV{A_OF|N}c7Y=@v6s#6C|4Takr3_P5WqI*MSxqW@WeES;DK*!_n;9Ku zS{WTh{h&afCa&@xNLdWH62wkd_Px2j$GV_F^5j|-Xt`V!f9#jt3A*Igyn+2Gdzm2q zmr#FB83w&!CI1ADfW$G1*IYrx+AD(~BFCV?7iDi{=Eia#=zZL%xbD>6k4_O8P5Cqy z<@e1%Wx#p0b&)|MnX}sSzJ%fF@KI-iK@Qa4C%C3(I%SKUcpYE6$F}iuh>^k#Mm7q5 zx37kN(T*@!pFtf1K_cbGO-6cK-?YJopE;2uV0G)`!p`~wEfl;#wjX<-t$PP6{F4;f zY8~QgMrTPL)jhLH?0zjv)VU&$x&2mi2!%<+$uz8|R{%Q|lvVD;vH`mhbQ>XDX(w{2 zn{nqY@<#s4|0n_HdAJc-HYsMOLpRaP2rY=bRW&@Y_S?+yW=;j=9tq$K+cpJfILLm0 z3%o^c0c&i*Wo_^0FN!#<#4+W64K{g!ZAY;8eP*b>-_nN9z@fXm{=fEd>wDcC=Ho+Y zmJKuM#@-TF_05i{f$#=VXR{G?G!x)Rv0epPeV|eGqbc`-XS1J{iSNj`kF)c7?i-PE zE7w7uXdZafM|c^W&kN!>s7v67_XR?a=d{>5lvk6d16yzViACBGkFQG=RyMv$?oFC8 z$U=e~Vs1Fl4~>6!NZfS1dd0d9va5D!#yl^Zv3A|3M_+#36zRXf*C$m}|HIO|83%MA zf#9a|Q-v2~hawRt7b-CH?-H|q7YvqMzMTcAg$bwyjlN?b%Zd^ z(Ua}rEzyS%QM5_b)fVpP+_}D#Poz&Y#@*DGtz5g-de*RmF`$ye1I>t5;|BHP2Z)fx zj@2SAoBOk3ePO~j7F7_5%DLZN_%m$u&MAU;{#;Do09`Ev-)=czNP9KRg&Dnj2(Phh zHq!cA#&NB9*nBHc=g1BfP~?p;Jh8xRm`mlM-+A-l_pJNI=4Ra>yGLBbDTF$?zTW%l zkQDqK>_TCTYgqoVA%d9>+teQK)qZP_J}u=ZLF4*SF;efnOfx8|*Z2vG)I+S+SOFx*?su4fYHm?1vCXewefV%eFV zOEPHi^Qop3~&6W^WgnA9wZk+!Pdke_O8zvx&ma zR@qW4quxHdv*vcYiko5XG>YC}>IdsQ58{sy#4elOJ>c&~ZB4#k;{McBpMx1D4%eYU8wLS} zxl!`^s^c~Rr>2WO zXH zB}9}4j)s12Um{NdSK3(5&3Ne;lZ1S2&e#9qM*TJ_wRT*sK!~L!bSgki%NeAk0us-oW_!o4>;NUZbHdRhF0aR#exv&%xJM`k_DEcAQh>}NH( znd7~qfW9L*oP$zh%X>7&-=DydYQCB;fD`Z5GnAe;LYkRLlMTYg%b-P6nf6p1uzo0p ztX>wjy>9E%XR5Lo1M;J(78~>7?80DWVoM#Y=Bg@kDoUPOwmQU3_Q+zV%9Lj)j+_R< z?KIP@xe(q9{KZLoF+?ebijnI;3@@f%k0rZ*8Z`cI>j9dOU2!C#u%Ht!I*huOgDGGy zbDQ+7p*vWX2Axq7s_F@sd~LLl3I|8uU~2JZjMg^=iUn}8emqw*PM`2T7;>)M^>9A< zg;zrJP}!f?BxDiR1&o_$#0L3jNZzBKx2fC*3E@vILuGUZhU6&&w!RaMylA(P3Ug8& z&7HEMk15!jP;p1 z?HX@_j*>xMJ7yvXN(X5IT7|lBOj#kS?22_}1;>OlG@$1EDNK20ne^?{mCGOh;?luv zkWNY&+4@s|mJ_f#2vu8)VP`+~E#%m`Lv-lQzdj%$O4W9w?2bzVF-J`0TBdHX3GBQd>Lhwl04Iff$_FqnXY1dHUTI=6v{28J>!8KXU!o|#t9`h**SL1X`}0MW3_Ple?%@7O6uf4Fos56sGC zGy1#w&oe{6QC^aRFXxAV;C(3Q|FHa@@d!2;Pin;l>Jkj`kI+9g}f#i^nAnfqZI{<9kukOL6s6x08x=|hl zo#j{9B`y_lcs6_f-f?K&Z!ld3B8!q@1ob)px*_A%AHYHmRBr$_CLGM=TMIAPzf~Yw1hoC6kHfscX zey4~u+jL6rS6Gz({x>*r!AFVY43%4nBU;8t>SMkY2f?-5!}9AFT&MCrz@?iA=Roha zCx-f_*yy8Ydft>O0lCOVl}&k{G(mEOkeQ15sr znVIKy<84k6%i$mw)N2UC>^C*ywRAe6y&fY3yXOV)3)!ZlC)jOxk)ShmPuWT7r7h-d zT3&PZRdTGm>hUcV2CY=f+S(zhz8E2v&*4sdXH>8;W#okQ>_vOzN0{cFcy0olYnmRs8X zp;@!wzkq|a!F95AG809LdTuu$jUs=n4i1w6n3(P#38y{YLSf9{U}d5F7Wy6GTZz|h zKX}4o4dz0X)8YQe;UWPyms@SmEE}&fRU_UZ)3Rtf+1C4%r7vVTvoL%0=h5Gu9>u)J z%L39Oi0n&P+Fra_oyotA4uD5Tqxi|+>`(z&j_IbdoN11E4r&|k@pzt-tl>nr+Fj7V z)Sb!o>DF`1qB-*@Kd&=s__1d%vJ2Jvc4 z7&mw8!BG7z^S`VOXZ(>!i!G@0>~~LPBKJy@%UmOlUlcf&7$Myc z&%4dhpUwepW6iKi=^lL{O2(=c;ucU#ICjKGRrsLc*!IB_CN%~uoCwTkCZD7crVsY< zKnb_?Fqe2|;>(+&n_1ho0O01!4o81-jZeOi*=4G`WmZ^!POMD21pCNs!uJ|``Qi6S@dwc;Lw-@eQVKlk<};}09;Y5K~=jKJ#Xh36#K^H+P>7I5=b9Xm9#LVulx+6 zbm2cLb=(+SIXA5f1gEoA7o?yLK0ku^9tsXc@KZ9WJ}}08SK|o08R!3C&u!HMO8 z*s-aR)O~i)Tb@2~**o;Itr)x3_d~^2h1P(|A;sQq<(S(L#$9*K#A|N*(l)};Nx}Yk zZzO-H-gERL2eWv|7k_iFa!?-`y@thjX%ArlXZWg##J7Ym(;rofeL>yzTBbk7eZ-GkHb^$V^Gv9Yz8_X-su7if6Q_rEF2B?~V59;-h&Ug>rH!D^i$zSrNd4XAGU zHl?9({RQz#YZ*KH(V>`mZc2a)W1m4z%v=Ze8ob#J#H43DIf)+vhtp2HLEhN7a*pSim^zEkKHpm8i#FhQ&qoH_^6T4l>B|7lsbQk3?Fb-&yt}F;tHj>hs@~ zljK!1xF#Y8)>HyOrQ?uwU@ApaDe0a2=W)3qLLKBL{jj zTZmr{D}ER|Uj|^@TtI|6kq#M2G@Fn~ug)iTmtjKl+B8`ArL4~VM?-%nkcyq>0U+LJh-ubfrl?}=? z@YwH_?Kl6GiE+hOZbTP*attS*PVm))ye^PzSCLC6$^9kw?Eq*QQ_k*FUmzbOuh32) z*_0BlOe&RQVDJ!xq$>+T`G29+;Y}D;uAt{a9e%_X61aBcG6q5jod;a+mv&%{H;I3f zj|Z9aqK9mzl_63`gQ_l4W_II4J`)jE0pv4gbeWbD6!d9J%AWOf#LhO5$WFdMS!Sv9 zW^eS~XNT)@KsHe>hVTRJ4^AxT+mQB_izd4-+H^j$_bPrqsr@iRV6ra;W<415D5We# zySR_qljWFY0=V>WHHwv3jpS8$YX_jAI&E#`AW_&kNTIcyXt>dKH|@_?Xv>B&{vP{V z$$NO$-3n*ynd-scNtdD@dISc*a0$Ob&Pw~ZXxx333D*|X-hY{;i@AIrbPP6zp2Jd3R zCRk{?C}=<6)uXvw&7j>CXbkceRMMuDB}eSo@I|>6Vz9kMT)8;f%{~tkV~kzU-v;pE zQ>B1s?8LLl$w;htr|i*t2W9QmgC&kQ-qJeSz9SnE^vM~XU8Fwba%k?`BO{K>Z*DmK z_1ywt_pSZ*e|G9sI&T{0%z7^BZw{S$kY(SYzd3YHNfTk+|0jnI_29>b_Zg{IlaSMx zJ>OZ~Rx0G0_l3g&q6NvKq6g-#j^jsQo%f7Gs7AL1I1NY5;=bga{QLCPm3uWV;m=B# zVUZWno5`XsgoFs-^f;pUFSJIhCU2KFAzhR#%16J_w%C2+UDDa+{Nhgm9jV3Tas?)) zIneD5;ecXBywf}-A8+vCr|@ueYS}EH(wV2MBmO|?+*B37eIj@Si>}UTnixJ0u$f!g z=@y-gj-Vg4WunSNywhMm?L4VWI=tr5Yk;Ps-h5tm>AT7o?2XmLz#dlX>uSL~wcW@325ILly@aFs1g?@)vlAe_k8~mM(CvW5o?*Zv!!?NS%7zAim z37%Zz?X|4dq~EFE$S*r!w*}C$aDWKhIV=cDfjSj{8WiuXS#_L3Ej^;XJHiZ}ZJxE} zUQ>3#UJ#EsizYGven+UUXQJtnAV7=cLCeHKegCp{_r*AV0ey@wfFGeoTjQpHdH`#bXHN+h zv|{ngWL^Rm!*f?b)Jxr`)MCXqw*yc?xBG)Pj^||sqEGb}Z8YbfbuQb8l##d=Cb*I@ z3-+pV!zQimAS_*^wrCe$w9!6cbbLKd)7V$xB_w6vsctVJo(og+asooTBc{a1G!@5V zP76|Eg^Oo0n|1W9Jpqsy^6(Bux(He|dc4!Y44!|vp%C#&6VX2$l^m?xllZ4IvqHT_ zPrwQv$CLvnn3Wm=%`~VOpt;Ou=)ZmZhV5@E9T_n@%UiBr7ssbVm+1PaBKhVvf`6nv( zm)_msR{AZ`dFaEZ^<+wH?ArpqD9CdC+hHI5yUA0MDg9qSP>CsS4(NBpEV0uM-yv~m zqac0nr9r27RY8+|Au`Pt{^b<9_pJh6E0%Qz`-jx)FVK31V$3>I8C#C@n@g4Y>M*PT z7RU~Ymn!G4tmv65_Zq3eXMZn2zkF;qVrb(B_YPumcCUuPuo&zWb0H_60!K_Wi*gM3 zgXaWQyr?*YCwrZ*=w_C6!$H;-E_kzBU6)T$Yj0{*+#S!;aqN%b7zH)!%V zp3dz5Ukl+|3@f~sn!LI5#aa>}`9u!%Pu||5%!>zjcxU4r8-9U^2^v!)e98YJP38+f zVxkn%$M(;Yk9=HP;M*HIAGG~hXF)TSD{nasG*Gk~Jld!o4h(0Lgz1&@n%7wtW90QI|~(>^(t1bOfe&D;kaVjb0KYUQyH=YgXnn{?R#TR_w<~9&Gdv-e@P%a9L-@jyo%tnf zssS6Ost}@*@hp-YBgdK4eW>Mhy!P+$l+fV&(~>z384T&5uS=Cr*QI_?1nhLyLJ&dM z51@#$$Di*G>f;~HnR;H2D(^|WkTu>>nx_2Iq~UZ4*$}T40$TFN?d5L-{xs(=nXAf& zhuLY!>k7IS@g2ZzUotsD^JgvQBSZUD*12?LTT9~)kDF)B{vsC-4hF0^Nq^wE>UPqC zfCh{+LFzSVE=5|1A@^t6o)81{R*yH?aTXi|+n=EV2G;6usMrHTYx&P1}Mmbr$A!Z?%b!~~4P`t&a zapiiaC{4G@m{s?IW@HB91SgFWSjl4S&vCYbDT|aFZJ%)IoJ4Gjun_t+FxFXSk2qMAzSw{8kKm0F{ zMfO^8*0TZA)89xlsRGO?>DVDj3VhZVA3jq5nL)_KbuCv~pw`7%db(q+lK*_~HbfX4 zRt&Lg?C?DKK+OS0wc73JSgB2N4oi@Zp-EV#SKs~@quUf*%aj?5dhJfvRh1cDfBh!i zIN_#VH}{A=^k2X_dffR@N{JaALAQLH_w8Z{cv{9~>M76Xwjlhl=^n8GJdOi6onyKbgESEcx>H zWf`DplVuH7>IP%4zk&L9+XhM7^eF1TXJ1!K1CsNNUjS`(H}kIxLU=NAm*mPbR+BFoJ=hZN`Gq6;v*|Z}SDk8ubi6F+ z-vFR9Jn@>}sYg6LaG)`uMNsDkWN*~xt7q4LHopr#Z%fmk&kKO6|g_e+C@_4ZI(&f#reAZ^{Ri67c#I09a5GT92| zW|{qo=d*6b{U~+N<9MDj`(jH;(uJT@%ZBTkVJ7T=Qlp&X{Z@=F;f-}VQOv%}>as;c z`&D_YAs{>p*LI9_S=#18WI#8E6_ZOEBZzs`<1vqje=a3Ec1h^MN8Yi5H#w;HDpqx6 zd>;~2;xy@{2pgpI4i65ZvKrC`Nu2Gj1osl)S-g3%om|Q>jm9_4K`08Lo|IO=w?Jb8 zik8gi(oPsKBC7yb3kW;^=TSlfkg!#`$?ux7x<~2w$z(3 zM|2kAX3bu$=&2G#%o#@$t+C+gFQc2C>ru9QUY=~^@D ztQ&)ODx7gM?K}>$gD|QYlUf%}i9@76tLCJiHnuCizq_a&=h5S>0nfj&uC4Rk*Lt;Mn` z?dybylKy<`*MkFkfR_~P>&`&2rgjbt)z)=VvB zu+>^+%vSdC;fXRAh0cwpB6O=yqQ?}F^BLe)l&HYwOQ%%`vL~+YoEI7D3X0~tjy2SQ zemlu!yz40C+>%ym8=$%{v9uR#xL42bWm6IktHTnbt zHLQslU-V3>`_w_!fWax-sDWRT^x6OM^DdZge|G@akwiQo;%C-oQH`o-`*d34)3Y}_ zQof%OF}A*q))$t?_n~4BWjvcTf$DARdv;*d%{j$21}Yqsi%Fv(7a>ythB2hBJuWfzxO9}rU|&qvA!TNWdLhb04U)HUi7+c{^WeP!ZMa>^xK82S>ib>G zl_w8Cd&VbKZz}oXDP0nAv-Fl+S>JR_M=1;=--*1^Yx>WhG6Z9gHmVxawWn@drpLYf zE8o?wB*=wTW@ID!Ek<6~+h03W;2KeS<}#nRn6k5m`HqU3*{<={ZM`kJKltJZ7P_NG zREZu#8Vw>>=|{!gP>~O=c)W7(A<;YzF&Md4u-MW*QSUg|fs!{KU+{f#*LGdqqL)y6 zpWch@q1;q?y{_`a;u{y3Bs#;+P|6}Z%(*S?AaXJirX{?KPQ$$@-<#nnS)t-#2GqrE z)DDAhn|s2E@d5KuRm`${IYVnBDH2A8Cfs)TBDL-6*=r{kBVI;peL6(ffm)wW`LspJ z^r`i=Zn=1WqZ#_4o%57%z6JOAo9>;>Dh;ow5hZ3j=35Z%If3V!-(k)-1zebb`tM&Z z+(rM?&>r0JeF?X|UP~W8=+gaQk9_+{+1}`ro>~>lPwB9O-875v2R3nchr-rGr&YgP zsg*4by5>8x*Q?Fpa|COP8n!KZ;^$HkITa?znq!=wy*<*xUvKKZYC-ntZPZ2f9nr_c znj$h^-UesT$$HbE*flYwp0;zwsCm(tD^iwSlKX_oH>vT6`{#w_wKawC9@)i*ram3Y zM4eUU5ijhC*+xe$K8qqHEqA5dmhTQK3R-~4%vZW?gQcPlGfhTu01-WnW@W^S2sf~hO^MOv6qFxotRc0fy9@7ho7{4$J?`rL9Ewr#Z2tGk` zG0PS`PBnLS-RU-@g(a%MjPAq|&Sjy}j8g@WS+R#^!*x#yU3x>@Nk*l-LjUK__g{aC z1h$c)qRJ4)h|X6G*T(aAD)O!+M?O6H^Ig-^QlfVx)i@8TX$%EhfgjqO<(EC_{91Rk ztJlyq@y8b~kbjb#7(vxn2ZR%Yjjgg7jjo1FBF3#G7u!{evIW zFcp-dNC@>=NdNQk&x>Iu<28i2ndc{-A}0uMj!DSwRSM_#Ba1%{@_jArbNhyZN)s(^U^MNMWMn(d-%q&nVn>uZ^F8yA}w^5Lb>S5rrB~vJ6 z=A%2OVi~&78kL@%1g>NLE<2b=->IMq)O=BW2sMDGJzVghwidL?Gqv}i+@hSWhAe^n zB8q186%nv=pD4Z#evVS1)WbI=Mil-wWjr;zdYNhc@c@pbZ23XwpFbCaC**Wz%T6+> zCe={-odD*ziVj&o_dlz4Kc@4>-7 z(~Q8thk*yijiEjnd;32}8hSS`7+}jF7igR*y|AcWBfT>sr1p$J4Q0d}Gc*Kq`7;*| z>$Kr{{}?=X4Qp74^2kgrw;nrSvL-cGgBsOR&L%CsvQFS+zGCj$mx^=A4u6EO(}f1{ z?GZ2FluOPUXxSm2xkq6)GOG;Xk;aTn+uX`ktqKu!a4>9no|o=9b1+IQV^QsMS4k}U zvvjW#>l$ei!n3K{{O^p|PCln!vv13o@95{fUJv^TiP21dJ0%T&izuzf^y-g0eO8S- z`8pz$taeh3Z0!p@F|x)3%Qt@tlRLF`#5FpQmfr042pHo-xwk*_?}6dox_{*Qg*7jP z9vDHV*Bw_7S@D7d-5t!2+J`Y8kJ21oQeV8e^ITSa!XYTE$N^h&MrJmHlAYp9KdmC6 zpzOGgw)IHEtp5CV;=d*P|M^5-lj2~&;mteA3L3(DH5}M_MfL}_wVXcCbn5}tPCOzPl*Gyfjv!3t*hJc00ePT4LVb8_id-# zpUk6u?pIG2ey8a!<8xf<5DKT>%m;eI;qJPG6oaCe*9mbqaj|Q1Zg@kb_f1*gMBaD9 zd^1a2G35SMx=3Sny64yDL1%2wcwY%IPnbp&=6_0iEw|%Xw_HSJ#=y?Jb^JuV+HClBa5B?1FMgdsoDOx;P=c2LM{{-zmF+3F ziG~u$gpmwHCf|jNkC#1V=ao`rcB_a z3|}p(eUS0JfP-Ame;6RiQ#;Aeul@Hr?mvIpO7#ioHuYs6hh{gkE#Q~VWdqGZb^Fl& E4@D0w(f|Me literal 0 HcmV?d00001 diff --git a/docs/images/platform/kms/aws/encryption-project-settings.png b/docs/images/platform/kms/aws/encryption-project-settings.png new file mode 100644 index 0000000000000000000000000000000000000000..1df97abaea5173d8ad5117fb6fe121b50b2490fd GIT binary patch literal 490888 zcmb@ubyytV(k+Y=EI@z+7%Y&W!QBQ3?!n!i;O+zn65J)YyL$-k?i$?PU2pTtdEaxM z@BVc;-#jx+)6=_~-LR|?kT6-_7h%vTAhW)Yd_H=` z^7#!>G&VF}XXq!&y0`KIEq*0|Wqq3Ccop#@F-MZUce0sFq z;h)RH_f}`-zQ&3_zsab`u=jLH=)mm z4OaK-Hi@@#!LY~!AK8QD&;0hEcv81?vBQFfVvpYHGAu@$Pb#5L=IpbP>DaMl`T7Aq zdRex9_6;%2%<_Q>M28qTLIR(Q5KiDBr8iOO#d^bGy89nwpe<;SrjWOJ_j}f^{Xd&Q zSf|l(5=*q^<{&`LqP1gr523A>uMti8I??m65-F}!igGavp(B|~U{uB>~3Ze?R z;Elu@mfvn3TCT*pjW^{JQYY@f3>Z9vML$kd&T{VdRf2Qdqxit|5Q$} znK2Dlljk?LLuFJgY{J5k8=}6mpop+eii~}7UmlCT;n$I;IcS_)o86RMs|e0ke0>)u zOfs7CNnFyuiJ~yxd>n??f^368x`yTmZ;3_B@s=Rk-u}AlqjZ|W+XAT@{`$H_vlTf+ zB>Ljj3jJHmZ#?f;edbrJJt{Q8J^uI8I*J}u@Fo?DZnFWOjxks9&=4zDss&iY*zl+! zxx9jx2}jw>taX}Z%S7*;oq7` zYbM18?MV2u+tIU4?laj6`U*#SkdAO3A!kr>$B>?I87XgfsNSG5r-OW;ztS|u>@IHL zTatb0g`ub9MzH7mNld0D^f-^YT zIoP3z9-4Zzv@A0WmQVz8A2@4|Q6YYZqP~7j@Hpg)2d`ZUa=S-$-zvg69#2PZspnV! z!KO8|G6oIV^l@T2DhEFJ8%~+unKe{N3&yoK1R4}EAD#$Ql+GoNRdP_P9UbTsL}wai z5yV&Ck29}ozTs=L&cOd{LAQF71o^JjzzTofw=fs<8{%OZ|2mlH6+${OlK?8c&?hv` z4g?*dMG=TMejP-jB8ZWpuh0<~Kq>*z#0DZCD{%4!FNyubqk5dPFzQ3N1Y9Dfd&n^P z6~0hUpj8V9XCg=c@XN5?{=kHv?DsZJaGRkDs+i9)J!D(-oY)2b;Imd5G>2V5eA_O%YsSx9YNcQ=q+$`;2f>z_=BM1*(!29YL7wiOIFP8-?bN zqZZH!%RS{I+EI5idL9h4H-4*63u!P}7Df(6Ai~CX^Y1?2$B$KZNq>{P`N1JTl>u^l z8x@eyq0*7vanS*{il9q<~*|fOscjUqmxYl^FE>u*m#+OXa*3i{{@o@8{$ zFi;?oV@134ne=h@feZ``rH?AhUCdT3CRI%Vh#hC6_1K<(|Q@bO((^C@;Q&J--=^EMY@(tqf zR&Tg<{?IPq12@si~&b}0+k;y$TF(rB!52kV^0rTK@KXxWbr{Yp{) zUL!fGai{Um<8b45hM0_gDnDmUD-|m}Z1v8p&Sp35HyuCqyhRQ|4yt}@M7^k{szRzt zQ(;!IUp`i?tA?dKsj^U+qk5+-U0G7zWXNBoGowFSR9kNrH1})9a7J-fvx5IX{Q$;c z?|?%XU8p|nO=tm*{kUdlib<-ameJD)U-$cg^pW)5l?~&w(cVm@P%!6hVrGzD&6;9& zgC0}&_h1UVafZ$6sA7!i{Jxzz<=vT<^0O|MF!v3!tpUfyWw(Cc%{PY?J=v2Rg@uWQ zGu4aL(}VNWoyBtpr2IkXoyvV|TT)h6wy9el9S@oQg~BP_;IL+{1MW&LN0-asO5AS3 zTKjoDS~=R#X~R+)%U_OxSENTYgcyXO(jmhnT8vsLM=VQ55+FlT+jnQ#shO!WM`=s0 zvG8AC?|tXlBwW{8T|!U8K_mQvb4)bCM8{o5Q^wQt(O7ZhhxTVHNL^FPtIF0^8 zRBNOJjIp-`Z*W1XIJe{jEE0HAZ$kb2zn3C5ztcf~A8Z^56S3c;5OI}Rl#wHdA4)1D zET|;N6M}=m$hm3uiP}MIe`v+L->2v8%;`_KfF84_% z@1oA5U_=Ldv(~?_oA*LvK#>+DjBt+{=$>?dqKZfd&;HS0rXrKZ}S; z%qE=rV)W*(AZJy`70TV!e>zk>L`tExWG;<6>ZD!c5kC{765kWO64Q!VOk9bQNf{;6 zMxcZ(W$pUklnn+HHT6Srq$DUg8qL0lY1e>l~N*kW>DRk~n$RRjwI0ua8Ml=aGMMP!GwJO)2 z4vVH{Nh{wCc(D1i8=a}^TkOtHIUAk@ZrTr{{%qERG~k=^UP8i0>PK9nkx-wJ)mLU} z-aet_Yo5R=d>a&GNpq@RWli6tTvn&oJM(cb){SZe}~`+uHN zcTnG`rC3PLxLmS!Syul!uZ^*|`=wFW_*Hlyv_`ddZY~*)Gj2NFKJwS128N@?;z4sm z{bG}ct&bG{4ndi4#n#PYbR+Af@8Q>l;TbK@mQ~&hzPZ*&p)6}dJx@6yIVD?J+pY9) z{$lDBYIsymyhV?Wb&*M#gUtRgnNTcz5SONv+w%8qfu-K_s4%tMszq+*$BF8i?V8Z> z^xWZO1TNd%PiOllwwha^Nmp#1+fZwt#|5W@LJnvS;5{909<=?x3a@>v6(5XSpslqF z-Q#lT-0JHsd{i1%*VAfn;$C&x3b_W=T1fq#wGVPE+;X@)P;xvya%O77EDxiH;-9q%+bq_ytJ5=t z;RdY$O}9g;N4d4(-MA@Q)ccJ)CD*6x$3vx6C7;r`rcu|*hvKt8Q(k#q@JBX_?jBmF zd`In}VZmWWJRdz=E}d`Rjl~6)vS_I_`Fb?4#xt^!uLiJJXh9;gFj1p?oBjitMheO6 zbH~^RbMq)|7~nQc$-m5_b3-6wSOPK8{&ckszIL?5_{Ocaa*4ECC<#Lph{&7737{8z z3w~GT*(O<2fjZO~%o}EAGOT-0)DgR9&)pVdcman`>hKd3rjDD#g0D>{P*DULD2p0O zNMSrL*!&` zW?{?W#7+Fq5gfqw^KM#VqJIvt`^rtMEcu0q-_pi_h=qoZhK?AFNJK=$WutG%AuAyC zui?ON+{DIqc2*p;w2qFBG>(ikmNrJT^z7{Hv~&!#3=Gu35!ANM7Ir#L)E2fRe^2s1 z=MgZl)w40NvNN%?AbLKpj;^J>9XB!Y^M(HR@%QgEa5DM#l`L%kH7#I*w9lW=($mn< z{_nYgpz@Jt*GK=p;>*L7?F$if2{^a9BW$e z2Mmd4A|NdfyaUVZ`2np2{2>4P4s63{ja8f-YXoyU@`T32y!@M%41`Hr}tKg@I^lQdjKB+&MEsvUcb+zF7Xg3QNL)DRgcXe2FYrj=sdRP053D+A3u}x#DM7g|PQ>@|WpjgkBl4LSXPcjF1RlAP66-!H7B^m#;(m@CPZ=$Dq6IGMjGjv-(3kJ6 zf-d5!8)khQoLw$=>Od1KUQm{(fBjoGx(P*@*Igu`)AMk4*h9rtNk@eHmCCy~{pGI5 z6-oohpv%EOgil@CsyVuqf_0wZbDHIl1HAj>*DFD9t&0loy0HfpIF5S_xRw-AZmCtP zR}jwYit|43LcQ!c1v7wfK9wnlf{ZJqgITSJ9eO6}^NR$z`X&n{w;wArIBipfFX9H~ z>tOH~ZWpw7QfCA5t!^!yisfp-!g!_iA-h)bYaPxVLWS6bR^kH8JJ}O65~jj}f<=U+D-Mgw$n6RC!q}6MeG7P!_p>Jn zM<5gjP*;23q?xK!&&M1+`lRDu>e2FNc`dLqY8$h{#y&mh^>;epIfR|iX=g43wNm@v z9;UYZxX}FktyT$Bi2@VEM<0L>OY7!E?4WQ$-(}B??`DHDt8@Rq{`CGcw0pJ_zcS1V zXDH7OwF%>bJ-CM1@Yz#6_);H{UtjD3#}pcF{lm@|D<_`-Sjonasm6fdgc} zHm?=;;YiSOl`L~&_!iuS`!^LBz{|RYGu&MymrVZeHBKN{$&2z+6hStd%hojcb>?$IG=?=RouG0yX zjnm)}C|@|OaNaji_0nn5dhx#K@)S9ldH4JAq2?I%Wyrdmg0R>jY}vX#6uBTCRBVt2j?}U%r*@lfnHC)tN zNFo%i!ON>Ar1arqh#qu#&+~!rI%ONAOIr)V2wZKWpX*nsJcE2!40upPWMrgGacEG) zOP8U%J5&VOh@P77iQF8B_(4c^nj8VTm_kh9JGRMqo~4h7KWP?Hx3P3)4_0wcfM$m% zrY+KN?kdXT^0x+P>o>(*ZeM;B>&9V+&B$R-aD(fScd>t1_n6PEfzcMd;|WSdl;dg9 z^u_bZ=M!F&a5QP587T!T!Z~(!V^1n@RB~r2AwqK^@0AB8%YO#XuXasZW2sCwbTfvDK=bsZtW2oMu}aWx>M1hjc}@D zAV_%Kz&NRxkq_@e_xn0?Sf@~ZL%ob7#ozQp5^yC5v$@g znx_LdSTAr!a62T0g*o4q^S%+Je-3#ZjfP9F>RQ@DXB0Zg%&vzG^t-QEyXvcz7{E*; z4M)iTO~62NhT?XMtof`fu`IM$JNuO?=G%YPGzscjFcUv^oQxP;trOW^ZcE^uOY5@3s#<;G@;Ye zJ7vCdyfT799V9jI7qV7|sli9NoAE@9WL!eMQ*sk2Ve zu?$7#1?(C0INx75N|99}?-bWRbFLZ>+6rO^OWHhJ&_pI)qZJ!JU-@lvz<43+_+naU z$TeU+xAHia(F5!z&$3}%lS2ku&{!)f{!MTZY^9_j6^v zUq>v+Tx>oWqhWQQnXd5t?gXjo>ba<|zdQTt9rHH?y@w}E;XR66MSAHRy~s{scSD}ME(&*&v01kNQq?Z0ubJD6K8luECi zJ~Z3_g=`0wf&H~eGd5eZ6f8_#esW4*9hTu;5~+A$`VlUrJZk5L|T ztW3vER;OPKG0IQ0t;`;SZpPG@z+rgT@<}eowI)JMg5Tai;>}+5pa&hFR3s6|gi{B~ zuYGw-+TCe2H+HUMb`hEqWWJP|4E)pmcJ*!IvJyV&9RH z0WakE52#fO#fFDwsdFjshF2$6IHCBNzOZ`c>y9bS2S-KZfcg9QA($<1dvJK#X1STX}n9wl1j$tCv{bR35 zn4FHLB|q@2cO6kz3N?7UERCc_v6IYgl_Pk|SQxJ`K~Pa!{2Ap@*6I9q)om0*BB&9A zc86VrQ~&vrSO6@s0y;>8w4=1*AX6kdAwMQ*pHDd;Ayb@=bcI#LFf({d`4G0`O*zpU z%U6@SrT>J6%>?O9pt5b8F->WZyCOs0Nm)I^G+{$s8jU%E)(IL4hUSsz3+AR-ju0ti zBeeRVgcdZFcSqGCebQ^d);-PH_1*!%vYwD>wcboWgC36*{yIvQ_wH)N3k|{xr4aM% zC^Hf|_tA8`#8j)%i2UZ@9lGhQBO#0e#Q#8c6xA(m!Aqd*?2+h(|L$u-dQ6t0}=<0VQJzN5WZ3xL?0?zoWqH z^wX<~E7XNn#w<@ZvlIOpr(g^4QjxHoJ4lmsYp3IJVBi5yE$w+;WU4 z`*bDz&~Oe*na~M-m#591Wk;VWu8Fk#AUWHPQKcew8$2a=bU*25lEblrSH;q2Ss^^G z!9x25t2)8krnJk@dM-(;`Yz`U*pxVgxZ4YkelL$}Z_u9o2P~>4S(eiI1zU(7^B>+J zrx2g0CW+vZHWB-;6TLHOr=Rl)#QG1+gOi*0oVKV8+hRj!WT|kT>(u=>Yv`_s{LS5D zWATTK6?z|#XS%e_-{xK4!QXvK@{W!gWzM*B(%;BFOjY;0K=$DPUt6oz4Pp_=g+KEY zh#uRHy3sO{?%Z)FvL-q+wFI{Qs_ULc4AXY#(!h#eXfQ@XhO*~JW* zsbvE-mo4tK3}W5;5;R!UPoYkQRmPJ-Vq#(=FQ-+AAgQ1f$wt%+DhObpKadhh<@++} zXMRY{DWY876Xf9Jp;YYn1UOTV+ZThR4AXNGsnU3aW~S9>)xUIvc(Cw3Meq(mY7tq^ z-JyJNyF{k%y51FJ%T!<%(MFa(I{sU`j;Vs{4=i~;(3qSk-Nv*^D5sF`)L>bIhqt~v zTiMqVuC`-rYcRO+z1TS4zR{1scenE<$O4RnXv`Y=b6L^DiZ3ZT)?$hC7nXJgZUaHP zwLR<1oKBP@TDKfBt24R|`=A$#v5hK?J3W?>P(E4F_K2o79pCRl1iE2(nSib;(L2cV zDQiQQbC^+`lMyXfap?hrtsHy>@~wR@XU-}YZB35Xi!KbnQ8)+tr{yLnR6Pl$9jJ0K z_;wfNV(B8`9~)UrBXJnUH2g1|-5+eoEnwx9Q)Lsf&XFVf7)$x4v!pUPjkh9{%Vr5; zJhNTIvHWq;XDYo{ek6K7?c%>G(FqAt#tM_Ip6?ERk6;^rAJRsGc_j^o)u9<9p@Hu_ zEXUN9=7-xWTj3yvBHfd@%E=aP8KRvEFY(?@R@qL_YKTdB#w^bHXnfT z;OyKyijePomwi}Y2M)@A^9IF+GRF#IpS4n@fx(dN;J0F#OU!(=rEyDH64xu#jjO9%oWBZe)eCE;*Grci#f|@=NdvdH#KGflZdXx4>t&@hHpgfoE+|>=r&+Y=wUoZF^bGDFxP@bTaXd~DvWE)+*E$KJ*5=N*F ze%F~Y|8r!-)iQ%Uhq=+t{Tmns9Q-`2d<>6+(_1jM^;*gjUI;Wqh^Qd-(ojRcd5y{H zjIf9zn$=Oeajc=D9ZhqnG_s^rIv$>3Q!8!9cwk<$_L1Ds~S%L`O9rqOTwb#&V7dFNpIR9vT z04fZ`*W1GC?*mb^tvf=!3110xZ(rcd0VJ)LHMf+Gu_IPCfGu&iPlUdRzNn@Ga8x9k z6~MtnMZbUJah)cK0XJaW=?$<=x(50{C>b|<1@g*>ekG`|{W&R&Sn2$47%~EiDr$2U+7)a2aBGJLac+iRA!;zK7$eOo*yA}Wf&@p4N2gSKD`x7T9j z$F{>g3WnCrpgOvr<_1Oaf;wq}^d@6EG_ia|m^&li0S>w(U}I!s+)YuI3NsIYB@i z1ZZ3YQcNoW$&1Q@M(Cx<3)#!`V9tJGNMkw<=Qy$8l6M~k346?a9NNR6YD*XiPDY>4 zEPv)(LW&Ll%qz_7?|PG=1pu)Q4pbiv9M~2#%ijR1ths^>8ui13wNa=)?5h&(96~Tv zk!QV~=nb6!w)cj12w~HtAH%-?TbP8~2(^TVN^`942afiQlsL5pyzacRWD|1r%a{o` zBD9N1g#*H1&8`)HH9$#xEMgk*0mZyH{2@TvL%G9meEW_u{u$a&r5f`eWvV2W-;ABx zhTRN%lB7niD0nnLj*=x>nq#1P2Cbk2^PgDQPx5bG{jZ#en8^+n1X!f77)6_BUMZy< zui>h0`TK)kL7>!re!DA={YOZf#v> zR!JupVX~C$|Km{w*)OJB!oOiX2a7r^a4%bRU$o1Y5jw=oyy`ZqBx&4<*AM|Qn^7!D zG)ntwQ&$Ybh=Bv$O2+Hr@?laPzT;es3eSbT!v5Pe^zN?~?HqWUbQL5ls-4$BY-kGr z?4$ct!EF_J$9R}7Z!HKSP!}i)kg_HVmEz|9n3GkT?mSIK<1(9yUEngyKe*@!@*Wt7 zo8(8wTEt2wo|D}$yn~&mTjaLZGNAh-X9BQH_U4<2CxAc)!T;jS zE%Lbqd%IG)j8UqMZij%vGLo`eF9l9rLO2AW@JE$9u~JXik4?NlL^|a1Y&e!^9>Pk# zXx;R@H-G(*9MFo(vjHYR-n=lj;dH^DuBzQ(-yndg?9T8f4nQLTqAGV+>$eaGTDV%g z-8BGGE{eZ8z6@NY^wlLHhXatm?~xw zMqFs&%4x^v~uGP?K}{7~2niBG=MBH4-!QnOH4tet?Q=-OD8UQF%0X zCR|0nnnWt{Ei4JOZnlUI=`&*;I>n^~g&Oty*e&C0sAZ=G9h9}pg`q0W#DZg$ndZl} z=W2ODk4snD7JCc})yk*MnSd@Y5tj1tu@#JzOF+?hMDD{;Cs6Rqb3k;jfan-8_4nb^ zBg&EoX_p~!ljjIl_63M3`W6LORX@ zM3hHo38*r`%vL5J(<6UI-FQzl&piQR)JEXEImM_WL_gatIoS4Utx@Q9=2em6bs%fN z@C2W+Y1b~t$RhQUrSsvtQWhD$fu<;4_CM0<@F-TRO<^*dQ8t|@Qkfa+tBA2!{6wWx z5`M8a_4cFZWflQ|Un-+?XV{%tg+{)BiSzZT&{DH6{#|GDvR!%|igU zFa5$A^qNPK?uXlmKUHgIzCxDoCHjlwK~1S6nk9iKY(Z@SDT8URX;O5nj$rJ8Di(Do zW)^el_-sinRlNc;-BL-)^_+qeTQinu`JzfEbSN*)Mqq%Y%}^-Ka2mr^|M*z zKG+-Hv}@vHKGWyg)jyrP`u32plKWG*fQ-b)Wgl5CdluPDArzCbs``lnjX!&o{z@QL zi|`HcI5CqQ!y^`IfBTC!|7|S@q|*t6^I5kOfPOehY%@X}48u_rdJ7PhAch@z-+-tr zehPHZgo%Txn(!^&!e#c+J+f=^td zZq6trpeS+;e%M?p?H-PdTh)_NRYHotL;XF$z~+U&)V+dzpi`_;8Ovlor4B6eofwVK zQZZJ`SOf96p3T9;iGpQ=++}}fHInOZ{K_V2wB4);;xE*LTUZ2mlX;i;)L7ls`gGjB zuZ$0fn3VZhvpwxZI7phoJ~NsS4Ye(pt@X{fKp6u#+R zDdYN?RJqdEZ78lIf=1fAZ1%7bsC>PV|Eh8rY8uI0OTV4_5gCUw#mqCbDx4y0-*Dpw zWh}R1YzKMAiN3HrS$@Y0bi{C4_>RsiBK5=i^+c<_;%8xj0rGMNCDZ%YdrirpUKCcx zNR~gA{^^2~H%|*htV_q$14-qdi+$Qis(RcaE#A!2p+3j%InacA5@Kt2T*(Mf83xK( zURgWxS@3hz@kLN*e_@5q3-MMu^o<~uTVs)fJka5PPTyPuz1sy2K=6)EIau5AXuWp! zhCZa~K%e_9NR_Y9;2u^YaO&7*?{}cCS;0vkY zGHNtBxZ8cu2`A^uwnUmUt_3|l^QMZVVl(AbPYIyb)%1BJgZh^U=EO}W$JG0d=Bi8z zk(=xk6MigOEDY>2J`5r(E_~CPPf%LMvVtZu$F1g%GR5p`)$ce#tDSv zRGZnt6jaNRjjVmwD(Zzv9Maf0Xe1v!hJZj#@vekfo2np2i) z=cQ7*rP6Lc+}gss5f>_2(0mnZg9Y)k5E3$NB+#@Vv11tj+$g6Kj)1(P_y;%ZQzDkQ zxqVSd(yiSFXgfCT>3{>QdPz9!snKof@31yho2wxL&m}cmPL5ZUz*9Acb$gI~7AJnaIia@y_w4;$wx!f~r=l6A2^G@r5D)w1}0B z@uFJ1Sa$aM07ER5cE!$N%fa4{mpb?E2UY6MO>WRxV#Y7bpYHtAnoBZLyGx{ki*1rP z%x+Ed_Wkoc-)9T2aGWRiC0q-~!#aRD8UqTGO*^xLKQ~Fuv;+x<2pNYC*c~$dhe2Z< zl%^LbcF2ND$8^V|^&bgv8-&-0l{E@7nJoyJ$Wy8GHtlON+u0nfuxjz#C!u;0DQTwu&{bt4Yh38b5&A2Y@R(Ai&cFs>W=Sz4oC$~678 z15X?CcBypp4xxX>IPV&OUSjP+A^gQLRO;0>zC|jHVhe(=S>0&=s)a{u&{6=A#5AH* za+NgsvL>={UWNB))<7HCm^ohR4QS5wV*ev`u$QL(P!cF zdMmQ}Ye&v4Tt%9PFz~ex*TpqgcWxjSHOqHL47q2$bmLPPQ2UzY(-9@^>?|JNqU=&J z9{udO>t;KVQH2EBxF`YF)??}8-=}cVo)I#uf^gFo0W>SMc^+)lPri_U*0!u6!-`ZT z_+4R7OePIo^EDfV%ERA%IEo#URViEETE3FuV{jEUPPC;>9$HfR@s##}*)axjE8YSmOmrJ|BGnXRz5h{#E+w{nakpie9ymV)?>LIf=L9=zS;#slvf9_E{7Tp6hC{EpC`@N~SF3F#U zu?h%kKoBL}n<`O^ne|L*8Qj2Wg;zIDEB$WCAx``!t#_~Me&uUAI+l745=&9+LN=UiGuBd1sKxl16hib zcfz0ge!dLpf*KFK6F)yJtn|iD;QQnD^+nesmQh9fOnfU|rQoV5{RW={rK~@#3+un0 z9(=0I|FGB;hk#i7K$gELSeI-HT>^MZ-&DQ<6VWeN1NSnIr~`hmQ$9L`nL&?hBwY4i zTC8oA%Gq04*9MN0b}E@+KcF<;Srrs441l}MNH@@ZVN=XZ4gxkbw_9}$A~ALtTXGu_ zcC!lE(Yq&0+g=oaeh({y8w1>-1ey5vP5vK|0DQM z^5yKj+~m$!^#WTjl7>+jG-)9PI}2WIdb~*#nPfDFJzo3aT=iGMRNNy?3X5+%Pd7pa zX*`Qr+Zo8`*}E_y!gL&@-Jt!`}No5^)P zrMLW0AgJ0A!>h4YO*zrmLO`&!rngDb1v1K92J~%!@hJ2-$zU(&6?eQ#l^QEu5f|OCzPRWaGOooH0D>0 z!@$lS863`wMk(Fe)4xLCK=4JS#AZDbN(TWLIim)@Q~kX>=4VnjYI7gD<;x#lU#vIt zl*Z7&S4T%!68MIEoI1R_lTPbC{|B8bvHU9N z?(#ZLkV34TY-DeKmL{teyJH87QAZpwHyBI`t;^ha=}>Jj@7X1$VPH2E$I_MRX5;w@ zb0jm2L(HQ2fyGSx@Yf!J^X2T;e4R3FnfUs%5W7qM&ic2meoLCg+n%Gd4G-G%8L@Pt z4a}&a<*+bm=8KEWIw-jW-6dn;`7&#ae641_MNEgK1JCtnIVl$BSXwO_El+MG7W2gq z_;a;!2ep=Zb7Yc_yj>xQ;a92v0~4u0rIg3D{8s*$zZpYs))>6}8Je3-=7lB9v%(@` z1?4_+{i;3lD=%wd8$yA1{L0E@Pt+D!Ues2#GuZi;l?w)RfY`f$(G-nx^x)6G6-eFZ z@k4%G^of)9=B+ICLu#n@#3&t6Z>7)=t;Zj){1|KEZ|}G{|9*G}FkAfZ3IrKf)l~}} z%x|<$1@w|q+0QWYWh(vdO^+J0tE%K*b8VyP6*xK(N7c5y=G-T0Zob5wHNRTON@0ki zRjCk2u@afx`ZgraEp;J#j1+7$Wcs7{XN_c9dw z{xQFSaLm{ATP$yM5}}?m+TX^DEkYrn-izsn(*4FO&8{!^?Y{~2$L^vwB7_N1npz85 zT#xG2fapT1*Yz8NE|2GW+1>CEI4P-KcN5uG(wQ3j^|D1p`|CgbK;AZ(DpIl8D{j|6 zm|NbNO=$3SS6?q$N}`xnXYANF8vI#pb3W>BaPf0;mqk%XdlFHTP4oe^xmj_DP462{ zvwpAa&Vn!x*Ge!RgMQh5p_5y_6X3+$HYXq7i4PMj7X@D#Sw_g zwjn#A+qL2a$K>)uL({-gz%95w<{RoEyoPM$CiMhAuKgDcQ|`MW#>rBKDuvYQ(v9pD z5@_dNgf?Y(4$8E%b=H~l_E%ca?k3(SpsD_`P8rnC*}ZR*_@Ujy;YnVY(1;*8p>W7X z+C6`EIGWbVZ{}@3uP~2tORGq+Wv2_1pC~suMz-_0++H3Vfgu%+-Ejj1mi3i|N!FJo z6_&Xx6)qQ~^|zi^5q#74eYKu5DSforbo+}*(c6UkKr0L_;Dv(N>uG4Zh$O7`e zB4A#UN~7V35{-uI+@I5P-=Bub98h6M}O`LS?;hSzr+W=sFZHdS!K2$v~a~NqiXu_ zP|ZJJv|7KV8Ex5oM-wi*B%FKBDQY@ZL_s1H8Y!8`0(%<;mz~JkpW%C(;!x+E2onA) zjk=FH`mDV;7%@QxVQjajdBe$Jzb~#Humahi-s{@$-e+`roVht2%$I}fHMjU;OfU=A zPtT-ouhEbtvuMGbN+mdKodXH2IAhD-JD@OOLRQU8UrQS^q&SyalLQuu)f^cuR1L7P+~`a;q7}Dpt;{p&d1VdP$Iphi5|v^`{TD@A(csZar&xOaZn<055#1w?c`6$ zz?NpK1hlivzf-9iFG*hCvutv3P7hTtSSl=SRy;$rbN2g6_I`Cj_3|OJG65b6t-Fzr zYY9_v?b2xDux-fTl;>>ryF!1Kp9NPtAm@{8^jW{nh1{b*H#|@AjwyLCOe4ZF zI-nN=0-EO-;g8?krM1gAmvfSs@ha;Fhckg5V)`5}kIpJg3?h}`C=-ZMJnjePSOee(_aUc9d znM}s?ah$Sk-#oOVKJdThDl0TOTDT)usc}pADnETSIR12%wcj|cnezlVZj|jX=Mpnu z01Y*uh@%GTzI3%Tu$M;=hnJ=no0n$uRBjoe=Y8oy6NVI<=HqD`$Ud(AoZ>Q0-KO5T z*fCdnfPmxN1tTn#PNoExtD`aGfovqTSSk%Z1hpTCJW+;2_X0zlPf*=oiiMa=CzKa) z7**{CZ#hJ`dCRQV;4Ub8dOPYo<&T6Jb3i_4K%UAL4%3WiUx4aEyjj?Y>-T*}DYfge zlfAMV{q$$>YqOW;7Uw|~<)^cg+JH|v4JjyRbjZK)7+C>)5YFj1bU9YB zQLy!6PSC9ftjviH9s4LmG?|j=bi7^PxO)V3Sn7{;FJR=-+*nkf@1F)HT-Ex&j_}B} zrz;f~uN8~q7Jdfq8w0iuF@KJ@$*m9n;uj^ii<8Ggke?>m!)>w|gN9XW=jmuSVdAtu z-n=A%+p)*l?ae#QXwJhr@y1KVcn*UK`sA^!$PKQ=Y3p*06EU{M z#UU;Uae0 zVaYE9xA*(WQNqb{!IlJG9$;9q%{jqitbX4pK0S0glNlE8yw)Wh-s)40(Dd{7Ca2fq z0OK%2?m?n+({S9P?ch&lgWkw&oAn6c{@CJO9T+XIK{ci*ddp^mx^38bjO{_wlc#OD zb$HF4_>~KC^9;g=&FvWk(XLFc5B+q}g(&)ryGFtAs4-;)$>gYTvsfK9l+cZ5H$C9R zl3MAb_Kh^3*T~3IsFiMa3yusXW0)5=RP*^KPY))V+R2|`nMU3PemDznp^f9MG#p$n zX*i7JzMN^l2fCX&VZCWXSOU24@1^1LWathaR@& zitvS5V%c5SSBb+JLv#7DC#orCqanNmMxz?BQkGalelUSwQ0W(|QAraiz2Y|TF6B)oX4p5>S&e!|A336ownun+0eS>y8I2~5?*Z=c zv00ImP)75F374Hei3#a^|N<}a@Vqd!%d@?p+q+76E?0X$#GC1m4cdh5VNvK z4FhW+_equl)0d-DANz8$%La5`?!EMFXhZ6qkY|&!)5f zkCPMdxf%@)UIzeSgo=aedjnsjUO#p}7Q})x{FAw#>%+#;Q}*vE&!Av@&MEAzcGsqp zF3<)55|CLLOJHEmmw1{V4lJ{!Q^8}u?7v>657dnT8qBA)?yxw|r@N(7;K&XXy#`n> z%|@5rc2u6ER&~&hG{??|QO~E-|2MkLtKc)hvfZj@li7Xi!mhcR(Hlm_cvuw-iav3d zvhbl03qJOwm1nQA<`9i(vNI%DRp;1QvdXIK0;eCUVr z!*c*W(QN`_A7-2FZBn_U9B`D9g#9^J^}s=NB=7@Q8!sDE>TyQGxv0tF)fS^)?`b_1G);$5%+#Fwr~))l z)4b!7do#IDIg7mG;XHd}reVb}_)g%myj=IyK46DaAUBBIT^`82qw{=p!(lQGce~xm z&9}XeB$G8T2K@aq)1iiAiYWNK}117K&AKILKEpV zSm?cmj?!yFNeCo_+!gmd@AuyE-S^zH|3k*WWMn;S&R?4|J;8KyJd|FWAzjZs7Ji0x zzt2@q)|cs*v3PCh7U|}To5jxX56JDau?-m0iX)?@L%Tk8JCq9skTuIyYmp!rYrEfp zOmEc@@!L7{lziaQrzkE%tc4e<1@D;@1pOp(g=4b@NJ0<;P#hEvLM?d)S;+}E5{^Xf zG5cZV43RB8)|r9YY4V(y`@6Fc-_oh-G?U9~Q`IRB0<&8T?;j}O4lSaSwOcX9$fq+W z1e7(V=XKEB@%h)bn3G-BV@{u?rykeVa*PX5W8Bd)x$0j8{Y>wJ*P3Ix#MiMLd{7v( zHm}7qgqnJsCIfkObvTj!gGb{E>#wCn`gejdG9vAKmKoA-8FD5vDy5J-O+)WXb$6dq zDof87Tb@@3TG3Yz)}p7}ljU01Ep=+0*z4_f;@S&|-Nofys~OVp_n*Y*+7m!_CE`lI zK3AQk{;MC}j;)lTBm=N})PyDI0qYv!STTz27Q!U38E%^rARB;lw;jy9zjYENhqD7^f95^OTXLHMRn_wc_lKym??U#T=dBCRn-4!sd+7WGT^Z*hibdB|1$oLNYFLdZ z%D^g%tqn&KXse{7!5Dk>i5+3#EuID`wS|iPjv8heEAENC6_abF){)C9VZg2AA+BzMdpk}}=c@i2HBk}#f$1dMmQ#F#;iyMV zvKVo7YrXTLph_q$dvDz#{TfgWPgt)mp2iJQl&ELw^QsxRKjQfLA|nvVJQ;wU zeS-K^To%8(*iMO52z{_~8ne4N@20W8HL}Y4yy<0FvWc2;#ND8|fgEt%M3%`{3F#7! z4Q}Brp_7EB$N(%mmXX{XXp~mwVjI_SEdlrjfV?^GoJ86{-j;bA)<^Xi2ENZAMNp@ z@O-YXqT2tKZX#Sis36qH1Eic%bus5IkI0v=A0O`zh?utiH3WZ9dB=n^0R3sSl$9u{ z2Zs_;O&(3fb3NPI230cFB3c)|Meh=@+r}v3z4PmR`ggH)xFkk_y>WZx*ikpJL_NOV zZM8d$Cp~f3)Qk(PH%x%mEgr3AcoA>Xt>P9riHT!_NKTXYhBT}av9=@mMHmet8muQ&V-N;j4AzGuZ+Pjm+Aa!svnW zz<}(T!vfY`sUM-y9|3(vvQ!Y%cL312kA4jfFMQ{RbC z(q)Dc-8>rmz?j^l!_&T13XbZT5Y;sKXqrA{@W^G~ADt6I#J zJLm2=q*L;?(%<3D<2}z&=X}ASc)?6vU4QJ`AgA18*?6kC!mnxK4l@s%=XVQkOq10e zBp3Gz-ta%(eZou_XTrpG%1usC4suLhGjIXQge z>7^2;L3<+#;bLTM5`*^XIQZjG4qux*aYn`k*+2pYVVPj$8TKR(&WHv6o1-uB6Kk{$ zu$8<^gncm^W5dizkB(VU)G)I9(GbY_Skn zZ8!17Y!5x6VKDZr&@jV)FAT4$`uiQmOK~7w_DA1`eemK55{~ zHg(fA)k)@HXK3%JKs9f~DbjLlY0;wNopb}LT>W}9*#!jzk82LYVl?R$0_fhtBdTaRyv| z5C#c45fZ;y_X#jCfbeT#Z>YwrWN=3x;Ch_?DyCl>0Apkcd1<@9#fErN)H6=9+sH5a(Bq1~-b`Mi^;@bXt zB+kcReypFtk1Sv&GWy`_(Nl0cWqmlrZ|J^imHAo3U~-j1?^m_{W$l-xIqE7-!=p$3 z%ax-+l%Ais@o0%#5-_~g@9&RR5Z7PS*xjPpKuB(bBQ9z>q2TzS44?X%r}~o6P`yt7 zGU+jSz?HjOQ~Bp&LxYUT*&xs+Lm+@m-|iu&y(^#Yvy#+Fh-4Ce5JJn&GKp2SFX1I8 zFz6d{!SS=G@F+ZqO9GELdu{W&QKn|TSF=-=tC8oVWp?1Fs~apLFW>uSN)X|!*{+q5 z|4fqzzkk)8tl719MJSe{!Ho_(86XScleo0E%12M&SP5K1NCAGh4+%8b5l<~Ar6ndl zCZ#(lJO(ub`@v;zE-@qbe(;OE^%?CvE460)+NMc#z%9v>U4@Z*I7mmgFcwm{P1^bQYb6Zr6}E)~FkNeM999jCaM5<*o=xo+eg{%d#><}b^Q69N zI$jo(O#Wmr`gj#+xUs(lBV(`JG3c}{IM6ScJa}+XvC&;txhB?0xSS+}3m=v|uT)Gk z^?7ERO8XrwdHKuJf&{n$1NhKkd(71)8rGb+8zuI+iLS>kbX9@OV* zfs5=<9t3dmD16R%8@}fJdulja)B5R7YYfZ#N`6IsQ6Bi>TMu5RMiz0HYR|az<(FQK zTfvZ zpIZe(RNa(Lyth2lm6ckK0%0AOgp}082gB_(mIDZdV~^NsN+4er%6q zO+n4~0g>EoK$ZvR?rcmO6fQKlNy%p2oA~?0{OOEe7LkGgl#EBjy`kPD(Pcaeo&eB7 z7Zks34K>OPz#q71&mMq~Mv=+GjnBK-Ptuuhj4yYi%X$P~mPH6OC=0-kT_>Fyw|nO+ zaHsaHverukv`c zwvFQBnO!{}Vh*xf=FNe(QJs8}+X0&`g`xK(a<9NZs)J5XcAwa&M>~VJ6kS=E-{w+q zmb$v>JzEseEsH*f&Y~L2W_Ec-Y3%bZ)eCvgYJy%v<`x#RV|v?K)}~W8cxkJ0KxC2A zZ_DMVLm@g5p%8jfo(dEPA9l-Fv42P8uxM-cn#an<^hz zB|$7!ZI&F#hhD9=8~gmc(yHgVHDTOVpV*)H33=N0cErQ?1gT%>ktMpox^eMN3x`-J z0VA1TM#Cyu=rofxwp6We;>pRoHn*rbreE`*^`n4R^9v83y{kJHRH48Sj>f z*4~(R$KXWEiXcthR}=7ZZPQrl9*ow=%O zi?zR~0BMICXtFU!A9_>3{?`}PFw=TThi8JSjDmd6T3%gC2LkB#!-NM{6M|aYR{Ott zIvxu`MvJtSoLY{o?jh?IT~EC1kTdnJ$GZpcx7xb%BjEog;@O>a)~eU~q%nIfm8 zrM_}0oa7*{ru&uoA1xthScy`M+JO^?`* z4tul**@}A-96v8c4HhW!%-AqzNX~n!fefj|9;c_b^YeOhOT8Jj6tTDpi;l!y2mxIw z6>x$;9;P^-M4)wf;x_3Yx|BZU8J+i>78xK=qXJF zswiq9QqnkXyLR3<{`PY|B@Q3=c7a9p%nT9B&-WY=OlxE3(7*P7qi<#RLFUe(zcKis zHF>(`S5vPO@sQ)EbIki?jgXY-SAib5bq|ue+^{Jie?imH$sdUEd$sUcMjIs|yHVu? zB|3{tC5-!U40ob{TQmB^6WJ}Ie84Siri8Rw?N zrG|RftJ}|1$M(;Rp39N1+s>iu#}Dp3uwc)8m7Z`<*~3P_giU1;5(ZuPdG4!CmWcDw zaBBw@814ueHhp&Ok-+WHyCqmiLjv2Nc;oJEnSy7#N+bH6tr3t=LGi+KSI$75+)vf9 zA1%4%$6Gl}EA1ed5pYruC{AFH)-~;J1~O;wV?xXZjnd;Yqw(E?P*a4!uuDRemUZLy zLx@8r=h>sR#iXaTm3*uro-@c_?>q(N(1Qwj&qwmVdd^Du;J0ga$3R!58(Uib^kXcH zxNS+mVTQMVA;00tB)tX1>-knVx2_Z`?FLoMs{~-9nWLGg@}6GSSD%9Q9c=u*yjr#7 z`a)z^#9;JRKh>4vtr_Pq>uI&jpt&e|B}c#0=Pff4FAt{d1u;Sh)#n=7L@b zdDT!hSLG$&n#gxhxZ9YF!-S9z5Q|E?`CkeYpP>>eH2V>F;m2C_YuQwNn?Q-pGB&xihB)OJP5U$5w>@B|EAN+8yY5xat)jY(Ps8|-Z=5eL zcEJA3Sv-29f4JmlNJZ7b$FJX=C~UFRf=9+I z_as;^DUW0ZPObvxFGj~ZT55neZis?JujF!Oj}+8EP7W7Wns>3GCd3s<_@@{Rxk<-4 z@CoMT`|^q)fh(z(X+H+jbp;mbnW@hdfW$rDO2!e!;o%?AzRPj?)H#Jd$wMHB!92z= zt+$3X5QXk_@jRNB#=%VBEmh9*b4^h=rFn>%MZLr*9Jf&%VwB~2glGX*qfhYh(ew_k z8euG&asQ`g3hKP99^|E48-so#>Y8IZmKYufwRr$p%H(`FM2BuV!EGvMJgYW?{%Q?c z;XuG!e#2`k`fKN*_AQJUL8;%v85MPSBq(Zep`1`A1q)r&CSa5afSTzM9*mVS&)fQ5 zYeC2zEz$2c=W~9%Qy%JUPGwE`4+@<_>9gnW3jHod)X$MDpI!WIi^3qEYXg8$e%w z2^ZIsZ#IAJPn^8P_pf2y!gSB?q%=7$Ror__nl!=qZ1i{7pGjgD^4wG>r@vygPOBMT z0b3!ST?La7LNIRHVu|YJo#RSmS=Bw%YDS=hVttyYU2(5I=1GRc;xW>T+;WeS^C3QA zmU@{;cKqe5wOEJKpY1_ZKEz!7_tx?AxwIAWrBm-u;zGN<N{pfHyi-D zVt*c1C}%Wqr*`IAZ?Q;9gCPUAji(qcZ86sZvCHB1)Ft}#cVIx3^1(GuVa3k0vcHq8%%AY z#xMFwCJQh-qU!{T4<;+EJ5KoCoETVV1f+&imVS<-8HP`}&3YgnsXuS>u2`d_bSN`# zp2u-rBz#ekOMu>0nAd*SyIj5s;;tH7!J@cRG>)`%CiN}+Xax!DRF{x?9zy=nD~`aD zd+UBC5T?&d4Zz^Z3nZSL8u6d;Cor>%+r`ej`azQoH$bo6Kn8_?u#O6puxZkfC$hQj zr?Fo#%l)}j8!qAjw2uy`v2fHsT72^{Rlc8oZRAknsiN6&e$o|#XZEF+S%n@IgzdUTO&8{tR63@jdXLdtKh%;X$}e22zhczl z5LRMRdquhzMk~4VeuZ4XEH6k7A^q*dF-|^<20eAQT&>In5zfG$3z|<5(jk8WJi5l{ z^_j^Jvn~`kDuFurvKHLNvwio>_lc&!e|80OS5N9aH*>|ieMc;7n65FL*cK39B{!ue zrK*{a7a|1XZ)xYhWWBOBf=ZBkEO(rKn&SCsUp2=Ew8TsDmO_IAsrN(=ep5A9QwcU{ z-c(C|S<&;I=GFn;NO{DM%kAjgl^^oufzQobU!OX$EHU1MJ7ZR5ro9+1*^b~u2V}T$ zzf*G)^*rmDM+NH&JDC}5Y4o5C~Ut(pa5QPmXo}~FH6^iXpz<)8^;vscjw5RV2VACn-9 zozb4Eo_-D}{-=8;y`OBg3wjQB>0g!#izeur!oPSyvi_c}e00Q=F>W@5 z{c&RMju)aDs-Ehy&Jpw_$O+wX{C(#pPIiAIo>JgI-F=3>_4{2N`iBZ`$;Qz)vT;v% zP||sBCRKel`%y$4dVITK9Ken+xq1j9udlAWX)pY;xl!{tsN(z}B57zk*=?Gc0iqpM z4wE9936McLja0eYvORA&m94MfO999{@I5dJ0!PO$zP&j^we;l&?S2B&k<|41 z?kD;OkvR8&KCz;p79dM!2Qp;d52ncau>Rd;vAqkZmGMp@*8gY_^5q3y=^&1N#XORUz0phaS}U7Mu{_S4k?8|C$S)x#Gb!hOi2IgQUGQ%`6W$jW4CWrY zMKdk1zbwlWZL9uX34UKm78>7lnY1_Y&lISR6yl??r^#B~^L?;uV+BFEV1HYEAU~4T zvTNbpz0Z_KzqXF(Xa4c5h~{V+bo zso^m|81;vzwz&Su)XJBez?PDwj_wS*t7vv8_9JfSFPGjOWu@i=p4i9%H>u&%m!-dn zfZg=0-)wm1%H6o@f3K)71071v=VXPoB|eF>OrGl#i&1HWWa}B3&vvhV%jo}Pb@~ib zAr)+zD~bAVmp`2b`)HIMx0b@;U=iz==rMjyP8}=Ke(E1WfA$c}gd3WX`?d$O)ksQR z(mQ{KxgZfNVBn<>P%XOX=IZVfXV~CVDKa4Vc~}dh%Czjhdm86T)@RAbPO|qJJvMI= zaR|6Mwuok}gEP=S6aJ9`2QZEiu>FcSE)AP>*Oxmej_)`)o}k8x699L(F>}L~1`R@L zVbmNlcezdK%yN7SZ2*MZ_}%?t_>0+(RJ;M`p6IPf(bV=xOxK9Mu}>cBs_&<_BY6qN zFldEU)8nJ17>(}xlI{f5EMPLsK-nJ`KTZRXG3NSzSl(mQVWvT|N;rHJFly+u!gwhk+KuE#f`o-0 zOuw81$!Eg`h>|@V7zocHSe)NFs39MLzuWJxRP8)3w@NO8lU@d<_iY=(lYio7!*$4j z8(h5oBY}BX>}2`-cWQ>q`Zk8r5~kr=E4P0>9yV8)n$BB26387=qhTG3Ri&tj0j>8S zlJ~gh=?})vAJ~LWSlra@H|MqZyc0#J26)zy6;!(9x`EF zF*+?vjW_FaRHl^V6*>K{b-O!@ZXu*~yFICF5C;Pk|!pjvwM)m09HR9vFhXR zeOTVN-xDt&AX;t-Uj*}6w%;gIzpIeTI-TASj3hNzFc0>H&37%Uf{8~h`8uPqw^=46 zEC>q7{@!we2}_I(pbn3S4~16PH3LZ6DL;cKLF9ME-erUIFaDIAmjVM2R@Jc77To(q!(T@E=q0;fuuxG3n2nbxO0Esh^V+{Fq zQYHvcH6Db{2&ZKxCx}t3H7p1alB73FDqn)862yfQ#gA%hSQ6AnGuFfCc_>!?nX9R+ z-b#w^Jg#KDX%_oIm#I!W|C_r`l8BlftCZ{Xy53}kqtUvXJJq_Ysl|Goy{zp_ZoF{M zR3BZ`F#cbQ1dd)!o%g|(KH3|J-n4L0bh@4>Vt*RSL|U{Y(1D8hFCqcf>HS!X8a|)N zOI38CgP(dEEH(SDLF+$DqkJhGtSLxi);mKyLz1>rhIY$BpQl`F*lR%!^?8d!kqx~p zHPZWPYviYr)(kg=@0*ar*CkYh_{uzatoB7{dLJ_F4@C z2dnM%NumNljk&zq#UC&;=Iw_2tn1)3`%0{|10G<2>YX4Ai3~DM8Np*w8K01hcHb&^S%qgsCt9cbw9hZKjOQCVs+T1# zBUI1|G;S-sE~~%Z$(=LKILql_TiG*8oyr|T>q|H_cl2JK$2XL=E~;mJZl18E8pj@o73c1arno9 z>4XGm=Q0QhM-ocbD{y8JtWI@Yi}z2@7OZZjf)Z6nTWS21!q;fzq7vK1dm81%@R;m_ zVjeO3@h89_VDv+6qAn0jss5Q%a(p%xWJ|1bhS@^2MjRnB#Tl%&d(&hkot9gT`A6Y62e!bqiFwO6pLaqBDTHkMm|D!9;Y^j5X9en@D znq7OZ<%d)ouM!;NL@RvTTJ*FZMRLOt5J z<~H8zt%R5tYHl{+-k}z&X*HMZbe@J+hK!GE$)wIeq*RtvWY9@4o!o_h2Y#b@YE!tS zjlPYbY=;E7KH^4kc@%p#r&OY}ms4io#%R%sS&)2=pf}LNNpqo?>X$8}JiYTk9!g@j zyn{1-zfsOh-YifIk{Q{7TwKVY;EBGM>w|QjGP^(NR|21hB$b8x!Z8c)M4A~z^o2nz zlvtNn{jnE+XNj*qcMShdZ?hymC9eQPT3*quu;SM%#T%*Xe_{+`<%(A}jHC!uM z5f1ZDeO+UNj3HmXPCGR|S{cV?w$xS{k)ndjg*j2-Y$BH3m+zsP_OIb5{)=Gj5J_Lw z^HMji2Ah|1l{q>8{sRSWA>K<5KfiesMHWT&y;lhA_&Lq~oAJKs<%^oPM>TIkdB!GJx7=XJQood1|Mv26TKjU$c>OXFGN9kc z_1CGh@_&(Cc>UMutN+&@7tU4H19~x%5^QUjUdixTu@&8H zOFF^d?GkVI2k(b#AVr@!$e0?9)LRxGfA)ja9rJ3xGCnm1i3BSUNVr9tB1KNnGjO!z z@ctE47SMLe`eR1m$x*})InP?LM%Gji>-sc&w3R8^iK-lso6MTQgGk^wQ2ER1EAlCP zy&~}UR#RhoKGD$LTe{!|EPSibH>hIjUHDO-b8iqON8*-8EnJ%3Zw&+Nt>j3FDPFNO zR^luQYOQDJ(l(Pwraux2IW~J2MmsEz3V#MYTJEzgNVCdUONk#Hjh3X7MSl#e0qLBf zVfSEMlWuQuo4mcuT7aH9Qpf0R`AOF1=cF1Jh@&I1_bj7X)J*~iWk3G?UOHd?r6yhH{6 z{W<@))A!{TawTt88{Ynb4ta5;L8uZ}URh|Bh!c~7sxZK`FDt=VcBZ*mwYa%-Z|Uj2 z3%QKV?#^3eNGMhxE?H1!x0HkN>2VjU*CEOg=a1SLls4`zYIi&}vNhrz_qJ2kIErN% z5pDMF$&_3b0vGdoODoz;?C=lzqHs&PccQ@Zb*Fo zbFNor-am$nKbdAAO}azI**P3o0oMEyD@VEW?^yH? zgBlGo_;o(OFmt0$b(xz@MfPT@86yw8ti|rMz^KuJ&FIh1y=FZk3>wU>1w3w!4Dyfv zf)RAZn|Hobt*ANs#>D$N+GRq3)%GSt&r2J=X$@8=)Qdg{YPbx%DTK zP*XygM{rikVvhtUIviH>0oXe!B9b$&6xO3}P&j7lS0GoQ*g)0W6>md)^|0k<{C9#m zZwItfVtk5=^n-)u0yN$|Sy{O1QCk)&hyTht3*MZTsK0pr-dXl%&F{r~4J{@3ZQ(FM)Wpj{}o8-n*K9y4F`GcQ4Yp zXtNdN^ma%O=)MSpsi@sTK8h>;p`9cKyQ@XntEAfjYZ&%zGm8^8knm_LvQt#_YBT0x z;&chqW&WZKy~Vg&sMAwmGZF7%6yn%61Y4L60DD3+&NXr_5Ra{qD_f`ll;6s>bD-b)3&}OR^Rw9;Goz;F zO-yULd*cSqj&eIebcsNjo+dh{v`@qEF7FmMo%RM=D8Pw@fD?mydr#C2h^{Q3U?{!# z{U(chi_^~9$n9S~(JzfrKp_Q%omCkp>a1>DtA8(PvUPegjbr~UU+=BbfG zZ}CnIAScilr*CX4(6sY_Sng*-`|f`##{W9Te^qN!_jA;0CYB+U52mygZx_zJGWalJ zdncwlL;9=1k4T+68#-;@S|f$XB=p9IG4gPI7S+nBEwe$31oWR1Hb}i<`ZjzskYFnjyQR%QPFf zhVi7=t9Doexu#zIywc<5@x#of2xS^llUh2Kd?d>rn(JCnc zK=1yUF}Qwublp!_T|GuSUtP4{zk`abT!PHPEYmBbpWSnU>wQhPJnBOkCEF|cSLHXs zxpMATLQAi8Uv)tPMzQ-rff+*?3w>Ekg2; zxWEWMo4noQG>-BzTkMn1*mjQ7)e{C%L)xTGPGnQPl)HkDr^ck87rv!2Ob*X7x?0L& zOhbX2K%MVc;(;86O?odzzT+tX1r~-X1nNW4o{2~24bF2U+rF}uj4D0u z!T9h+$;evFt2s7qj7%yTrOz2R>xdlC6urQd)G_Loxu!S2Iadl5|w4|NTX z7++iA%Vy-~y>hRoUOlZiEguNX7jFyv)?{VyLs)MS(1~1^`}S0DapnGPP1t6X?nGV| z>r~^FDC(`6X(uZp0ZXUG>a|E<_nP_CD=9umqJdVR+ioRF)1QD~O+qi-#=hRE zatiW*Ew6VLdmwT;;qbNV=J%M9uW)iKcjjQvEE)-I9a&m-dT(M^l&4brmKt3)$4OXI z>Y`&%l|)cCpneyZHFW#`rZN!%GexF-cKQEtt+aVyYJ+q4BX9l?ePgOU5JncO?jjv0 ztkcL)t0O+DDz#lr6EbZ3xQEY8!giTYKP~fl+a2*y%@}vSJUTl07z+)F>pvH6#Q zGMXMpayl8)nkl>Dq1$awu9F8`d@GvO$Z1#7h-_#pDm$!Oj1ry4jn{tO4)*4wSpvU& zbIa7|>}Jwd=zmz?dV5a4n2|U6$(57a&Y)!1|H_^{E1bL5ub@7v-vOZ+Bes`wMYmq8 z?5?_BiM-6QSrSD`u5Q*H78}onOh9p%qrd@ygD!SP8~n`6qxX3K`+Pr<|Bzk0aEkEc1Qd24JVLOk1W z_w|Iwz2Q?oCyDGQW$!!HL30t4mO`y=4 zO3eGa?GsRe^Czfyd|*~QNof_S1OcF%F}gD`j{Q_#QGxy)5h%PN zBo@HnM;@@?P}Tl9HK>Yd+W!p1%E<@o?&4!>XkeLhhEFqvgbeqlH}Qgwokwn8JBng2 z^$GAhMMTEwZIaO8Cr;9x|${)DoMv2NTTq@qs+GHr;QwZ!X7>dNu zg9Cc2n=8ftQqwsfhvStj+1!+}(L^u?i5YJFWwqx&YOCC)wx3p~eGpqT(z~;>^Ox^0 z<+IfB@@YXQB!?Re)SG|l1OiX@Odyf40z7ch{_i;()wbJwmL3O#lmvt9}K zQksjvDM%C_sQd~QXdh`}#H(Wn0uF=dm*mgn4Saw2d z`%XIxr?xJ+l#Yv1o1n8iSeuK_K!?&L_c0wfO3kOMap$yDjklI-DJIcL4pNEX?6@_p zGv`f%X+DUWMXwZdQutb%5_+xW=x@7$`yzxKU!6#3G&^>5_A_|pvm1}fr@+OiOLaNa z{SL`H0-=eT)b(cfr#;^?j+c1u#~jbpyY;coA1W@oR~cJ4X3jfQ_C49H)Nv_wh818yI}$Sdvn%TJH?9xG-87(GSmD|v2~ z!QlR-)-Qcl?an`bRuUwaVp^0JFM{$#G#-16PuZ6{f^`gbD=E$`Tc3a7fh9feP&K6Z z&FAKSe39OBgNxMA9AvE6an^CsB#QrrXB>6*i}Jd>8r#Co$9b_fJuugH_q?%+tUA#$ z`f3#yRT824uPf6nSX!4yn@ECB4WqtoMcvQR_8v!$KU(zQ8CNOQ-m1><4-fpy&io0u zKB3+31*jSpY^wcVK1tZX*D={Qsg4ovE^!M~@HxF8s+{9=`6gdZ#}QC{F;Sly-M@u= zg33Ywv(p*0WB8yu;!qr6XaPREiZU0;oxL8x6p!)eJd%h}dE&pIK;N>aP;$t4PPE*V z12`iom?~s9Oe1lgfb=q2v?T8@Yy|WuK`jY#vK!r=6dO@qAu&i?*9bg6*B`K&=9LWM zc`eV(-M64?LQ5w~xl79@XM!ASCT}J&gIhx;^sie3s6ZmH@|I&>Uc*|1O#}v50CFV` z0JXK1*NG!581q!%afNV9`mClA= zp|PpfXV1Ccwyi6Tk9BGFAAJPA*Y?Xe>y+g)LGdrE(C|+_#{NM`cMV?;hl{4;c3)upx_x7vkMKKLHaTfK-b;YrrsdfMQ>PAdNBv$mEBr>lS$(5} z4zdB=ww`UWHE9!7znZ?KX)=cbEqw)yz|yU_Lf8%mL**`~4ydQT`hKoG$-T!IJL{F< zGvGHjA}&5o;fuZ3Fi^R*4ArRy_FoDqUGLD~+Dmx7@Bx(7vigN^{$4Pbnf^Ci`_~Pd zKWvxm1p-W*#^*2rP>(AS#(tKH-Sbl1jd)h7Su2z$rboW~e7v!*tsBS{CEbXB_CUc1 zHxvyWCFT8%7ODTOF7@AU+yxDQ)c6i4a6h|vl{^&fsdJ%HP@kdxO^dizmYtEO>q22&rAqGHO z!ZTg$i}Jg=%*Ttm^O7Q_`0|XMQ!hC5wj=$1Rr`JryRppj@uJbZWO%S$M#ktDxxLkV zNaMv)9F8McaDwCB3eX}xs3%GFQPa_3z2&C4gm%yN@>BRKoq#l0>2sguxM0rj;77-O zAR9^EEe`{j7txz2tYDVF0o;xigL#~uQ&Uk8H0aC~Au!yLb8eP8U_?#wXgbF&^fZ|l z)iKD2>q+^6j-NuJO-U(Ywx8?45k-ywWZaE(vM%?%Q}^r53J|qKV|X+Kj1Iu4>C`b$ zg-j5JaY3XInHX?zp@?*23b39@sB%PI`iyp6%ED|k1L$w`hT5sGGLrC&G_dq)QZZ)p z7=79`em`K2FSB2s6JPs#55teRkzi;ZZ{Tz(Fla9+Q(x{+=3gM=#yL6NCQ-b8eQDANqL2-Eam$ge zXS%etKzN~r9S>=KelPhyYn1=}SpXvD>2rsyYr&Oy^dd5LS}yW#6z2CJ+jFgZ!!GP` zlVw>qZMP1((cP0z{7Nzh{9QvP-z)l-$a$q6u0(I|zCE?yg&k%ulJ4UL+T~(>>cZ0y z0(57Hl1EpRToXu__buuJ_I?&{Y~ov9n#p!lgV?;lQI?XMNwB7VqUW9wnz z|I~5(MLYS@A_ z&*bMo-)L~P{RPC0f=R0s#}6Ze#bpOzYNnNhQjDgH`#l{@fRXIAy>8h`P(6jLEb^5l z9`Da>1r9x8)V;IsW?xpHfApI!&?f&$l2-lrtQ^WIYoKK#F>-u$+b&Vc!)}>o5gD?l z5wM{>=^Bi}$Jt+FUSp@m{-DPyydShb*qUr7sFL>|n;f`Gj)DyYbC%lm71=@1U>XUb zf>c)(CpC#z1B*Z?k73{NHSszKJnjf&!Y-aR{*TYLis!%j=cVd7CgPrL@P_mA~~##~*+wBuJELmGDLWtx!fQxzul5@8gTo+1;7O4=Cxj!C>RQq>62+ ztv~Znx9`_c;pb<%34d<ZY4#dyb#VC!!aG+6T-TS2bzjKiOw9ufY$h%g3OQI?fCKufS5xsFNzt%7I~pBMjvkD0&ax!-m*D}kT7jqvk7 zetMpTZg!8$o1m=^C=@BWZ^GyuZxF<04j^f@RK-(w87NEjW*%01ZLw;_!Q@>8VTNg| z>OlXj3$t?$i4IB5UB8^0=K8U~g>$ZmEl-P0kGWDeYC%VwJGf>+$7AYnHAlrlmtrf{ zr2CP~hPd;@L5Qcp>p-^QpSRRydAM|U!Pxr+fS3&dV%9j_ZP8~%y)BV;*m=mQMUcPx zG;WxilNwDH2B>|nD(JbB+i>EE6<91)Oke_%;u$y4ll}JVMe|#b9_3UlI&r zvR7>pqB)h>A8427F_^{agJn^$s7PrO@h(HzryEux1$dsH zryJuD6BQ(ilnekNzMlPbF1!b)lPq41hTj#JvGM5Th*-vp=*WT)% z7PD-GDCE0s16G>B(+%sq2Hx*WOww@?b} zlsgW%rR&$Xe~V~xnqjJRVdX##V1ty0(}?ftXP-PF+fN1-zAw>VmZocB50?y3>Xu-?8zcb~Wy`b6@$od)3Uvzxc|GtszuM-0wU8RIQ(zMF- zszsQ*`gW!oVr=V@dUV(UahkFIM)e;nm~&@A-}O`FQh1r$Ewo8jP4T$x)3lp@Ywe72 zl_e}NGSoa$-#$js-CVKl2d8-l1NL)GwrSqjr8a`jGSVhGsqF_3Yk=I*)F!t_L0tG^ z^>n7d51*n_v&8$<$fKtjIe82D$0C~cGLdbiilPJ2t3`L!cxQHD3+?Y<7a4Nuau#kZ zHY_~6L+9LEJKd(FNccz*iTAy&tCA7Nx`wBYb*B$$ZL-NUajIW#x&_vQtfHn@H9b-q zrE^Qc?ExyTQJ=NkJ~OsPP|%CDy73)RBM_%;*#ctl<7~jEi?dIDGM;o`B;Zwf1UvzI zaJ1X*?)TA~A#!7g0s|iSG0e1o%gMQs z{RN$wOX&>$LW7b-u?b=43yF+0Xk^TDk}Wy_JrJ$z73o1A-#2m}dbC2Haria~xcEZ) zg5U!gO`43B+9+(9c^Ei&pEAh=tYG{0qLSV@5I@~~6u7t4HTk<8mF5El)lm|Ve~;}s zua^C^lisO!+*CN=C=?k+1Bev=+#*ukJUYr4`2W}>0G7Ws9WF#X^#kRKq*k9ebLV%0 z1y=Kd{tSW1G45F&v}4Z9(b3Y21(MGB)6T9HxurStVpUkK3u{LvcARTTvwa^LuQ9Y^@&QBsS0ul>SW(_2 zD>b^$yTW&lOQ;;QU!El=Y0^wcAE>?YdYp-(y@4dZk>mtypBRIadkvoNzElv>u>w@I zM7G@F8xa4^NP_~PO<-fyC_84NX}~^bF;T~lFd!(*rmTXA?=F~Sef?sTbiYGI z+m-qX%|Su(<~?chulP^j%p>mPXN}{&Qwb&tLU$vEAkR8E#NH41fz~AnKWq~`jy?x+ ztj*=3gV<#IYpiSR&{gU(>zSHW5|KcjxI$1fPCAU!@gr z!(CMi2y}%g43rNxlup^gFrL^|7ztzw$4fnZrU|g>N zd`tnyB0Pce-7K{RxpszBRL4(}{`(c>j$Am!+sl~d=vikgK6O|n(e^9Dy99}D5r0uagh*+>hX=?T2F}gZM?n5`z5;F>va44aPJ>q2{?LiM>23Ye z*_9kFdKJ8j*%oI6Ji^Z>60_Po_<$-&f%e`{2LOWNhzs}Ag61$Ys%2o5p!G?HT=V5w zU40`JKNEDwmAF~1IfrR-cym|_d=S7S$ApDUoOp@z~ zDQ+mA`~NO2^WT~1pb6Ot1#V8O`zlM3Nax02r=#oL)f$87&kG^8vHis=F7Z4G1(T{g z_6ZB|un^zJ13bV>~PbJl1waDcSx#euugH0W2LIX7? z(LV&j!63t?6{krI5f2VkU)*~@7pp)qW3 z+l^utIM$Q5t4FowO17z6`d|7jMoK1=V4&^P6b1~i+qfcOqUq?&WiK=&Vct|FsX$SgUv= z&*$^y7TY)v3Ky@+6R@P$iNkM8*zE_6WFkpejH{ngkHV~OGnK>KZX7h;ON$hVId znQ@S4+e!kPW2NK#K%F-;qIF}QWbjKfCH>O!A;RR3${TJ17s<6ZbkWpxm|=XQ7yT(D zqh!WSWKZpu(>aaZiZR@QgA`DFA&Q(_9rC6eH(r6-eK=jvGv!91=hbr;7!0Q7mtH~k z?gG-)e5<)67!der5N2Yq)HbppjZP8uIT~&%QnY|!VqD-Pm)OAF{~<>nsj|hG z|K09XfN}7r-Gy<_bDHz74ZSYjhSh^O8HM+Os@tlkvq0XZ?=v9YXyxA>UEJRkTQ#eExRMd^xglHh!abj7m9mV0S zj4(x=4+~M@`sSv!1JUWlI^xnV;py8=Eg@uli}3MV>Nx6Z)2I7*|#Bk5n~(s*v6ROJ$lYL&-tD6 zy-xK{*QD#xd_MQ~e!sT6I1MN`3O1@A<>Zy~EgF6LcKBC&llPyl{DW6Bjk+e5#uqj1 z9pj+lVhO9HjE;GLcDdY}{Z4zby>!krN&B7EXJ-0A72c%d{T0SJNG0hYe0GaLzId`g zi&u;F$#5h?p2~<}ZxY`rt-ac-DKnqz?3-lujUl7fwG$exl>PnMwnP@g`?Qjh5+49E zsjaS-Z)e|aR5tqbC~#v7Zvo4*?$xfzLJ;pP>A&I#~~iHSXpzkQnQ z)LV-~=X5PDuK~%-aD`qr(Anvfd^HY+ls^F-VnP8(EsnN+`~1M6CZU6_v(l#arExqX1x$dKfqaM0tRIaP|5Lx&GB)?I6i~}5wHL-m#>clTLcyF{_5^}Q-Xx@ zd2&3Ykb|mT%;xKo;pU;gTUI+Y+vs%L*Yef4L9<2{efQ}`E(lfmNV2sYm`q{ducXq+ zjXhF^7S+c)orW|ibJyZaZZ*pnhO~cvn_r>Pd^<%XY$DS+yIX%WL;q7+#73lYH4kN3 zKP&e7bv30%WeVrUJAhH?qt2$>jn_)d5}D^`2Kb)#S+Y}EEQLMt9C5&oRtVGKBPqfL z#uSq{r>PEIy2*Xa28dUtpPx~Bncq$~6SzP$X(AXc1OsiLTCV>u^5G$pWTQe|7)nIH z)azhd@>TONi*`W3c65$1OCpY+)^ChJQtWQ*_$UBzo?7&q2bq^4kPyK!ndlt-Xh2vb zWNnzyTNNAVr^h)}9=SV7RT|4DGIhh>rV0GhaVB3c4IMc&xacO6-QS}nvjd(Vt(!UG zBeuC|X5Qmpnr9eYxFu%kr3j&NIvGu45XzRXnO9EX`ct$pp4_8HMc>zW2e}tq)YPnj zetHseF_RHCF})nC^@t&=9gR0*Y}9rP33HE6_w8Xe5@K^ldPzkKF9!=9j6hq7KKju}~L z_L}?BK%=_Wc|LsU)4oXcE(4GTxHqn_`+I70FwX85%*YB$?=pMw+6eIq?uKT`a1r<` zk*C}jsC2;d3C-ZBgq|@$}>Denlh!O^lOqBu8AqX7^gkFtQb$+oYNZLnjXT@sM z3gu~$Hi%iO`6~?X2;bDjWZFahke-YPVRT`HQB6=h|CaI-z{dASMa_%yrVhK_=SCDw zMbh_+3iZ3v^~ffNe}Wr&83x%`d_CCqgCx5gom8*z^Er@0EqfQ79WQyi#sS~HUrho4 zv-y+F8zdO_OMcYeGt$%QDLYYdK!WRUZG0VM4O*TAdK^d4hBtGXg9Y+m#mE2o)5*8s z9H~R?nA&KZYdnZ8xuZEtmU%5;{rcM6Jqh(jdt_v(u6;W4a{Z_#T-d?WvVk3OFIrO_ zY@)Urm7+*WddS7>iSMXz31$dg&fML30O*AD6-Q@^LbLi6wVijiCevC-Tc)>_u-4`T zZ9&VF`<#2v9b1iK%`cD#_fZB`ld6dtt8$aBSQ^Rn%jES!t{8kM-Hr1+urk`YZF7?eTlW2t!I4p@tR6YZV*QkI1bvx z&>Ot#K!F2Y{vylk75#A@@G1?gh;>0iE$2h$UeSoJeU0{^wlutd-Xt_UyI=D0pd{tW z12@fOP-tW@Uk$wT=76(m4Y++(Q0ac zumQw~87L%g0e5(*4gdq%LCf}NB-|?T&K}4vxdk|-^h%(JZez<#GzL|Egv*hlU&p8H z72c0a@uWcIJag*e{M4Gh+=G6D#mNk#rCSA5eIQAyd7#xkyWeVic0?4sVb^H3*e41_ zI#c*8HS86ztjq+ztWt@rDm8YXgnegFZUU6B85R};Zc5F!ffN?q_jGjdT}4@kiPxJY z^dXC_2acT&xP*W%c8jNJ=it+(YGZWI^3n!SuWIG428~7r90fx z&Et)_rEh4Zs6{RU0qV3nK%FL}ip~4keYU4_(0_$Q$J`)EdELCs_2Yn^;0$_9T9elS+e7>h%-D@X9Pr(AWvl>%uWfK~W zcc$3Fw5B%bu3tzg-RKgHm}_f&&COChVTHD`wm^B+(2QoRG1vF#anbj+)^#|J3z;nM zKF>;@w31>8ns;vLvov#a(`HcpMTq3z&%{&r!Qd4{6IRsw8JMAE*uclPFsL%BAI8Jl z4Oa34!OEi8eJjF8J+JrTn#|t^_PIQoq1Q;!c8+};!k!QP=*{uE1K7SIOR=Y}6B%ha zp%{CiEYGychciSmC#f?KUaq~mQs?#3st8@5jU^7j1#`;XTX~fD`_cABlMn2?ryHo& zkLis4ZA5=*PNMY5V|OGiMA0Z!s=0JXa6~cSft8Bz)A`JK*`>U`T)Va z*P`Xh$x$rei>lW5%zYHK9W`)~30stKI@z-6q;g|~NXORmFV1Ft(fu!sLo)-cw`Z%V z_V_jw%6jGxO|o#Wu&Yhzb;>5zkd7&j*vkgM^G0v9dm*=NEgSzTGFd3Eb?kjTrBGM+ z2TUW)?@vQN_i)l4+!2^vUPe+x`thmB_CB#@P}})zB~LlP_QJ)>sd)7Uc%W~naBpd3 zF%(B5<|+1gzk^9|@g2`4(~J354@hk=Z0HYoL8yZADR|v2Pg^6@GVrxf}bN&covF`!T8dct=Gu zLw9mSZp14O>EgstO{mIAo18dqK^602ygO~CJpglFSpA!D8uEV#r`@<1JP0TAIMD|| zUtT^m>MfK~$XjdDb?*E>C;|3;O2ETPf51zHiy2hee5qi!bhUJiAiwx!?ZKXF<_`wj z<3e53%Z?KkzrQ-(f4cU~4z9I56=2m4)LO42hSKh64tqP7A8d@sjQz^jD{%qOq7S`orw!4R#-5m(rFH>>i zERdo`?MV})l~f>mST8q>PNMY*c`ZEke}D16&85FS3S0v3Kem%EooY3jGg?(mJ%~ln zyrPVjJ#1t#sYgVl#6bFCPv1&+jYG3#IPJ?oNzUF!k)`aV_sJiIsqToh$M#MhBcDz) zyo+2EU=9)-%j2sEg!FH!0Zi}{BF}}cP=S&dEqV0w^2+>KSKm_zx8QNf$_iU`?@_JM zms^K@Pd#!^4ev)EGPKEPVyNkc?WtU_xIg-~l#=SHbE>9s%1hBo_9-BHxpF$cra`kbuQw8e@7%_+UNw{-mf@dupnlrqsS=%bHmE_@PVW4de+VM2 zti<+fLy?@}_jcwVnL|!4^b0&Tub=SCqVM`1B+Bk%rD1OURU}_*yTn+i?c6RhWb|Csijds2gb0&vTf<#@M<8{ zcbtXaw{iE$J-t`Z+td<;xyMpEU{H%<%iDz@d7W4kFE-3hupt z=mO>q0670*-mZFn1c2XJdYtB{MbX4Y{9*`S7VH0q;Xs$ewQhIplWzY-hUUBd?=rOL zJK|Y$PGrk8=QBru%JbJvMSnwJ;K%%W7-kZ#&KPn?XPKQnB4B?D0FHj-5$I{tek|H3@{7KzB!6uRWI^AQ5ZCz5_W?}Jg%!{N2iRdESr zFyXkFZU+75-ut%&^4~uy3X=h4AYI3C%M;WWxS%)l;yY{#bPPS@eY3Mwpr9SJdT)mc zWeXcI9Dw(f=H~O&N>EI35BO-n+X$GnwxXeM*r&WS%Osj~gTz}4^M!RA8c#mD-YJ_Dps_13 z{z|l)Pdzj4`}gk$*WX9{Z6f{hM@3W88gdP3$Q~`bu-RWo8TC+ubz|_!Fwtr3TfWt# z#zoKsgF3&+P7Z=3+lRc8MM;Fhb!07_1Q@jp_17*LzL#d@I+rxUPP3iN2^nOUwMWKB z`03drMQnH1R1rn&hbaunFpd+c^;N$=V!z(HG z+`%>~++T|+pP4Kxie6$wibv(fpDd<_M}bm9%Teh|8;2b{N{}y0P>7`0ctjNul#rM@ zVYM5jtC=RE(+YOBTU6OJ+45|v5Cj|P5u=$4+H?^W2(XX2e_$7oN54475vD~~I29ZA zD{2i4EWO|*S4t|cL4Z>z$4O++Lc@5hTG@bD$~WSowgiAV>cq`lei@$p*M?`77(DXY;KD5fv%O z5k`nvD0>(Qr(`#Q7+BO!xM6Q)wLUSlk{WPiAr%MLG#ekzt4~&Dz0^uK+j2_|a#mr0 z*iYU?KMhhHQC*3&H`o^wPY+`!Skipt{F?|9=aKS38o+3FsFCmYE6oFk9DY`9j%rFx zr*RZLZEm6OO24nl`+MZ~^xqk~#BO3yiZt@An}Sz7&_#2H1m*puzJoXZg zFu4wUqlx}Rn~O#uO$4(mYRkuGiTUdQd7$V7cy(DF-ovD-&M1h&m#&a7(0OPIn1`Dj z2?&lbP5f>jU4KqpUGujS`iU zTR`Lq9q^!w(#z;}!S(Sygr5IB0)7Z8stGu{pa7Rp%wIem)z>7(Aia69CRTzEZTE8I zbaJFFEJk_8%p-LE$N^A;BGa?L*S~s~@>f}dzct2Elm|V@3057KbykqKRHp4r3tYcp zb~A9T3Zb*?<@FRk(7aicb_8(c=-o<}NoPk~7`BIGUfVx-w7_kre;IN#S*qnKTnh$X z+F*jJspfSfdhI)as-p@m(wH6OU!{4mpaskSQp@A%>E@i%F}vQDRtp-TPD)Xrx10^i zf#l@98(oc{F<@u$_!k>3G6i_XKivetn4moRI0&Kw!S(R~6|X z6+anG4$dhK-BfsIWRj0TK)A0&19M2Zb52nB7QUyaTU`)-=B%s6?s|K{zj3Fst#A

OLD{secretVersion?.key}{secretVersion?.secretKey} - + {secretVersion?.comment}{secretVersion?.secretComment} {secretVersion?.tags?.map(({ name, id: tagId, color }) => (
{op === CommitType.CREATE ? newVersion?.secretKey : secretVersion?.key} + {op === CommitType.CREATE ? newVersion?.secretKey : secretVersion?.secretKey} + - {op === CommitType.CREATE ? newVersion?.secretComment : secretVersion?.comment} + {op === CommitType.CREATE + ? newVersion?.secretComment + : secretVersion?.secretComment} {(op === CommitType.CREATE ? newVersion?.tags : secretVersion?.tags)?.map( diff --git a/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx b/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx index 7e8e30483..45de6417c 100644 --- a/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx +++ b/frontend/src/views/SecretApprovalPage/components/SecretApprovalRequest/components/SecretApprovalRequestChanges.tsx @@ -230,7 +230,7 @@ export const SecretApprovalRequestChanges = ({
{secretApprovalRequestDetails.commits.map( - ({ op, secretVersion, secret, newVersion }, index) => ( + ({ op, secretVersion, secret, ...newVersion }, index) => (
{requiredApprover?.email} diff --git a/frontend/src/views/SecretMainPage/SecretMainPage.tsx b/frontend/src/views/SecretMainPage/SecretMainPage.tsx index b9258225f..8a7a21bbe 100644 --- a/frontend/src/views/SecretMainPage/SecretMainPage.tsx +++ b/frontend/src/views/SecretMainPage/SecretMainPage.tsx @@ -23,13 +23,11 @@ import { useGetProjectSecrets, useGetSecretApprovalPolicyOfABoard, useGetSecretImports, - useGetUserWsKey, useGetWorkspaceSnapshotList, useGetWsSnapshotCount, useGetWsTags } from "@app/hooks/api"; -import { ProjectIndexSecretsSection } from "../SecretOverviewPage/components/ProjectIndexSecretsSection"; import { ActionBar } from "./components/ActionBar"; import { CreateSecretForm } from "./components/CreateSecretForm"; import { DynamicSecretListView } from "./components/DynamicSecretListView"; @@ -93,8 +91,6 @@ export const SecretMainPage = () => { } }, [isWorkspaceLoading, currentWorkspace, environment, router.isReady]); - const { data: decryptFileKey } = useGetUserWsKey(workspaceId); - // fetch secrets const { data: secrets, isLoading: isSecretsLoading } = useGetProjectSecrets({ environment, @@ -248,7 +244,6 @@ export const SecretMainPage = () => { protectionPolicyName={boardPolicy?.name} />
- {!isRollbackMode ? ( <> { environment={environment} workspaceId={workspaceId} secretPath={secretPath} - decryptFileKey={decryptFileKey!} isProtectedBranch={isProtectedBranch} /> )} @@ -367,7 +361,6 @@ export const SecretMainPage = () => { ) : ( void; onClose: () => void; secret: SecretV3RawSanitized; - decryptFileKey: UserWsKeyPair; onDeleteSecret: () => void; onSaveSecret: ( orgSec: SecretV3RawSanitized, @@ -64,7 +63,6 @@ type Props = { export const SecretDetailSidebar = ({ isOpen, onToggle, - decryptFileKey, secret, onDeleteSecret, onSaveSecret, @@ -114,8 +112,7 @@ export const SecretDetailSidebar = ({ const { data: secretVersion } = useGetSecretVersion({ limit: 10, offset: 0, - secretId: secret?.id, - decryptFileKey + secretId: secret?.id }); const handleOverrideClick = () => { @@ -428,7 +425,7 @@ export const SecretDetailSidebar = ({
Version History
- {secretVersion?.map(({ createdAt, value, id }, i) => ( + {secretVersion?.map(({ createdAt, secretValue, id }, i) => (
@@ -438,7 +435,7 @@ export const SecretDetailSidebar = ({
Value:
-
{value}
+
{secretValue}
))} diff --git a/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx b/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx index b3f0fb890..a9597e214 100644 --- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx @@ -10,9 +10,9 @@ import { usePopUp } from "@app/hooks"; import { useCreateSecretV3, useDeleteSecretV3, useUpdateSecretV3 } from "@app/hooks/api"; import { secretApprovalRequestKeys } from "@app/hooks/api/secretApprovalRequest/queries"; import { secretKeys } from "@app/hooks/api/secrets/queries"; -import { SecretType,SecretV3RawSanitized } from "@app/hooks/api/secrets/types"; +import { SecretType, SecretV3RawSanitized } from "@app/hooks/api/secrets/types"; import { secretSnapshotKeys } from "@app/hooks/api/secretSnapshots/queries"; -import { UserWsKeyPair, WsTag } from "@app/hooks/api/types"; +import { WsTag } from "@app/hooks/api/types"; import { AddShareSecretModal } from "@app/views/ShareSecretPage/components/AddShareSecretModal"; import { useSelectedSecretActions, useSelectedSecrets } from "../../SecretMainPage.store"; @@ -25,7 +25,6 @@ type Props = { secrets?: SecretV3RawSanitized[]; environment: string; workspaceId: string; - decryptFileKey: UserWsKeyPair; secretPath?: string; filter: Filter; sortDir?: SortDir; @@ -88,7 +87,6 @@ export const SecretListView = ({ secrets = [], environment, workspaceId, - decryptFileKey, secretPath = "/", filter, sortDir = SortDir.ASC, @@ -392,7 +390,6 @@ export const SecretListView = ({ secretPath={secretPath} isOpen={popUp.secretDetail.isOpen} onToggle={(isOpen) => handlePopUpToggle("secretDetail", isOpen)} - decryptFileKey={decryptFileKey} secret={popUp.secretDetail.data as SecretV3RawSanitized} onDeleteSecret={() => handlePopUpOpen("deleteSecret", popUp.secretDetail.data)} onClose={() => handlePopUpClose("secretDetail")} diff --git a/frontend/src/views/SecretMainPage/components/SnapshotView/SnapshotView.tsx b/frontend/src/views/SecretMainPage/components/SnapshotView/SnapshotView.tsx index 734159382..8658c0da2 100644 --- a/frontend/src/views/SecretMainPage/components/SnapshotView/SnapshotView.tsx +++ b/frontend/src/views/SecretMainPage/components/SnapshotView/SnapshotView.tsx @@ -14,7 +14,7 @@ import { ProjectPermissionCan } from "@app/components/permissions"; import { Button, ContentLoader, Input, Tag, Tooltip } from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context"; import { useGetSnapshotSecrets, usePerformSecretRollback } from "@app/hooks/api"; -import { SecretV3RawSanitized, TSecretFolder, UserWsKeyPair } from "@app/hooks/api/types"; +import { SecretV3RawSanitized, TSecretFolder } from "@app/hooks/api/types"; import { renderIcon, SecretItem, TDiffModes, TDiffView } from "./SecretItem"; @@ -23,7 +23,6 @@ type Props = { environment: string; workspaceId: string; secretPath?: string; - decryptFileKey: UserWsKeyPair; secrets?: SecretV3RawSanitized[]; folders?: TSecretFolder[]; snapshotCount?: number; @@ -45,7 +44,6 @@ export const SnapshotView = ({ environment, workspaceId, secretPath, - decryptFileKey, secrets = [], folders = [], onGoBack, @@ -57,8 +55,7 @@ export const SnapshotView = ({ const { data: snapshotData, isLoading: isSnapshotLoading } = useGetSnapshotSecrets({ snapshotId, - env: environment, - decryptFileKey + env: environment }); const rollingFolder = snapshotData?.folders || []; From 4a06e3e712181c8925e7914ac917c8ddadc136c4 Mon Sep 17 00:00:00 2001 From: = Date: Tue, 23 Jul 2024 15:53:06 +0530 Subject: [PATCH 46/77] feat: testing v2 architecture changes and corrections as needed --- .../db/migrations/20240716105646_secret-v2.ts | 4 +- backend/src/db/schemas/integration-auths.ts | 2 +- .../secret-approval-request-service.ts | 24 ++++-- backend/src/lib/knex/select.ts | 9 ++ backend/src/server/routes/index.ts | 1 - .../integration-auth-service.ts | 13 +-- .../services/integration/integration-dal.ts | 16 +++- .../secret-import/secret-import-service.ts | 5 +- .../secret-v2-bridge/secret-v2-bridge-fns.ts | 17 +--- .../secret-v2-bridge-service.ts | 33 ++++---- backend/src/services/secret/secret-queue.ts | 4 +- .../IntegrationsPage/IntegrationsPage.tsx | 83 ++----------------- .../IntegrationsSection.tsx | 23 +---- 13 files changed, 83 insertions(+), 151 deletions(-) diff --git a/backend/src/db/migrations/20240716105646_secret-v2.ts b/backend/src/db/migrations/20240716105646_secret-v2.ts index e2c0e976f..97ecb5676 100644 --- a/backend/src/db/migrations/20240716105646_secret-v2.ts +++ b/backend/src/db/migrations/20240716105646_secret-v2.ts @@ -128,7 +128,7 @@ export async function up(knex: Knex): Promise { if (!hasEncryptedAccess) t.binary("encryptedAccess"); if (!hasEncryptedAccessId) t.binary("encryptedAccessId"); if (!hasEncryptedRefresh) t.binary("encryptedRefresh"); - if (!hasEncryptedAwsIamAssumRole) t.binary("hasEncryptedAwsIamAssumRole"); + if (!hasEncryptedAwsIamAssumRole) t.binary("encryptedAwsIamAssumRole"); }); } } @@ -160,7 +160,7 @@ export async function down(knex: Knex): Promise { if (hasEncryptedAccess) t.dropColumn("encryptedAccess"); if (hasEncryptedAccessId) t.dropColumn("encryptedAccessId"); if (hasEncryptedRefresh) t.dropColumn("encryptedRefresh"); - if (hasEncryptedAwsIamAssumRole) t.dropColumn("hasEncryptedAwsIamAssumRole"); + if (hasEncryptedAwsIamAssumRole) t.dropColumn("encryptedAwsIamAssumRole"); }); } } diff --git a/backend/src/db/schemas/integration-auths.ts b/backend/src/db/schemas/integration-auths.ts index 709d3b1ef..1c0600e81 100644 --- a/backend/src/db/schemas/integration-auths.ts +++ b/backend/src/db/schemas/integration-auths.ts @@ -38,7 +38,7 @@ export const IntegrationAuthsSchema = z.object({ encryptedAccess: zodBuffer.nullable().optional(), encryptedAccessId: zodBuffer.nullable().optional(), encryptedRefresh: zodBuffer.nullable().optional(), - hasEncryptedAwsIamAssumRole: zodBuffer.nullable().optional() + encryptedAwsIamAssumRole: zodBuffer.nullable().optional() }); export type TIntegrationAuths = z.infer; diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index 6bd9bbd40..d351cfc8e 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -12,6 +12,7 @@ import { getConfig } from "@app/lib/config/env"; import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; import { BadRequestError, UnauthorizedError } from "@app/lib/errors"; import { groupBy, pick, unique } from "@app/lib/fn"; +import { setKnexStringValue } from "@app/lib/knex"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { EnforcementLevel } from "@app/lib/types"; import { ActorType } from "@app/services/auth/auth-type"; @@ -43,8 +44,7 @@ import { fnSecretBulkDelete as fnSecretV2BridgeBulkDelete, fnSecretBulkInsert as fnSecretV2BridgeBulkInsert, fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate, - getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge, - secretEncryptionHelper + getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge } from "@app/services/secret-v2-bridge/secret-v2-bridge-fns"; import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal"; import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal"; @@ -1086,8 +1086,14 @@ export const secretApprovalRequestServiceFactory = ({ ...createdSecrets.map((createdSecret) => ({ op: SecretOperations.Create, version: 1, - encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, createdSecret.secretComment), - encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, createdSecret.secretValue), + encryptedComment: setKnexStringValue( + createdSecret.secretComment, + (value) => secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + ), + encryptedValue: setKnexStringValue( + createdSecret.secretValue, + (value) => secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + ), skipMultilineEncoding: createdSecret.skipMultilineEncoding, key: createdSecret.secretKey, type: SecretType.Shared @@ -1152,8 +1158,14 @@ export const secretApprovalRequestServiceFactory = ({ return { ...latestSecretVersions[secretId], key: newSecretName || secretKey, - encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretValue) as Buffer, - encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretComment) as Buffer, + encryptedComment: setKnexStringValue( + secretComment, + (value) => secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + ), + encryptedValue: setKnexStringValue( + secretValue, + (value) => secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + ), reminderRepeatDays, reminderNote, metadata, diff --git a/backend/src/lib/knex/select.ts b/backend/src/lib/knex/select.ts index d7dfa77f0..feccad4e3 100644 --- a/backend/src/lib/knex/select.ts +++ b/backend/src/lib/knex/select.ts @@ -12,3 +12,12 @@ export const stripUndefinedInWhere = (val: T): Exclude; }; + +// if its undefined its skipped in knex +// if its empty string its set as null +// else pass to the required one +export const setKnexStringValue = (value: string | null | undefined, cb: (arg: string) => T) => { + if (typeof value === "undefined") return; + if (value === "" || value === null) return null; + return cb(value); +}; diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index d8c3926c1..daa679dc4 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -694,7 +694,6 @@ export const registerRoutes = async ( integrationAuthDAL, integrationDAL, permissionService, - projectBotDAL, projectBotService, kmsService }); diff --git a/backend/src/services/integration-auth/integration-auth-service.ts b/backend/src/services/integration-auth/integration-auth-service.ts index bccdbd23f..41bb929c5 100644 --- a/backend/src/services/integration-auth/integration-auth-service.ts +++ b/backend/src/services/integration-auth/integration-auth-service.ts @@ -13,7 +13,6 @@ import { TProjectPermission } from "@app/lib/types"; import { TIntegrationDALFactory } from "../integration/integration-dal"; import { TKmsServiceFactory } from "../kms/kms-service"; import { KmsDataKey } from "../kms/kms-types"; -import { TProjectBotDALFactory } from "../project-bot/project-bot-dal"; import { TProjectBotServiceFactory } from "../project-bot/project-bot-service"; import { getApps } from "./integration-app-list"; import { TIntegrationAuthDALFactory } from "./integration-auth-dal"; @@ -55,7 +54,6 @@ type TIntegrationAuthServiceFactoryDep = { integrationAuthDAL: TIntegrationAuthDALFactory; integrationDAL: Pick; projectBotService: Pick; - projectBotDAL: Pick; permissionService: Pick; kmsService: Pick; }; @@ -66,7 +64,6 @@ export const integrationAuthServiceFactory = ({ permissionService, integrationAuthDAL, integrationDAL, - projectBotDAL, projectBotService, kmsService }: TIntegrationAuthServiceFactoryDep) => { @@ -126,9 +123,6 @@ export const integrationAuthServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations); - const bot = await projectBotDAL.findOne({ isActive: true, projectId }); - if (!bot) throw new BadRequestError({ message: "Bot must be enabled for oauth2 code token exchange" }); - const tokenExchange = await exchangeCode({ integration, code, url }); const updateDoc: TIntegrationAuthsInsert = { projectId, @@ -217,9 +211,6 @@ export const integrationAuthServiceFactory = ({ ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations); - const bot = await projectBotDAL.findOne({ isActive: true, projectId }); - if (!bot) throw new BadRequestError({ message: "Bot must be enabled for oauth2 code token exchange" }); - const updateDoc: TIntegrationAuthsInsert = { projectId, namespace, @@ -278,7 +269,7 @@ export const integrationAuthServiceFactory = ({ const awsAssumeIamRoleArnEncrypted = secretManagerEncryptor({ plainText: Buffer.from(awsAssumeIamRoleArn) }).cipherTextBlob; - updateDoc.hasEncryptedAwsIamAssumRole = awsAssumeIamRoleArnEncrypted; + updateDoc.encryptedAwsIamAssumRole = awsAssumeIamRoleArnEncrypted; } } } else { @@ -338,7 +329,7 @@ export const integrationAuthServiceFactory = ({ if ( integrationAuth.integration === Integrations.AWS_SECRET_MANAGER && (shouldUseSecretV2Bridge - ? integrationAuth.hasEncryptedAwsIamAssumRole + ? integrationAuth.encryptedAwsIamAssumRole : integrationAuth.awsAssumeIamRoleArnCipherText) ) { return { accessToken: "", accessId: "" }; diff --git a/backend/src/services/integration/integration-dal.ts b/backend/src/services/integration/integration-dal.ts index c98c7153a..66a124a29 100644 --- a/backend/src/services/integration/integration-dal.ts +++ b/backend/src/services/integration/integration-dal.ts @@ -123,7 +123,11 @@ export const integrationDALFactory = (db: TDbClient) => { db.ref("keyEncoding").withSchema(TableName.IntegrationAuth).as("keyEncodingAu"), db.ref("awsAssumeIamRoleArnCipherText").withSchema(TableName.IntegrationAuth), db.ref("awsAssumeIamRoleArnIV").withSchema(TableName.IntegrationAuth), - db.ref("awsAssumeIamRoleArnTag").withSchema(TableName.IntegrationAuth) + db.ref("awsAssumeIamRoleArnTag").withSchema(TableName.IntegrationAuth), + db.ref("encryptedRefresh").withSchema(TableName.IntegrationAuth), + db.ref("encryptedAccess").withSchema(TableName.IntegrationAuth), + db.ref("encryptedAccessId").withSchema(TableName.IntegrationAuth), + db.ref("encryptedAwsIamAssumRole").withSchema(TableName.IntegrationAuth) ); return docs.map( ({ @@ -152,6 +156,10 @@ export const integrationDALFactory = (db: TDbClient) => { awsAssumeIamRoleArnIV, awsAssumeIamRoleArnCipherText, awsAssumeIamRoleArnTag, + encryptedAccess, + encryptedRefresh, + encryptedAccessId, + encryptedAwsIamAssumRole, ...el }) => ({ ...el, @@ -183,7 +191,11 @@ export const integrationDALFactory = (db: TDbClient) => { accessExpiresAt, awsAssumeIamRoleArnIV, awsAssumeIamRoleArnCipherText, - awsAssumeIamRoleArnTag + awsAssumeIamRoleArnTag, + encryptedAccess, + encryptedRefresh, + encryptedAccessId, + encryptedAwsIamAssumRole } }) ); diff --git a/backend/src/services/secret-import/secret-import-service.ts b/backend/src/services/secret-import/secret-import-service.ts index d2d189c2a..c69fec6b6 100644 --- a/backend/src/services/secret-import/secret-import-service.ts +++ b/backend/src/services/secret-import/secret-import-service.ts @@ -498,7 +498,7 @@ export const secretImportServiceFactory = ({ const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); if (shouldUseSecretV2Bridge) { - const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId }); @@ -507,8 +507,7 @@ export const secretImportServiceFactory = ({ folderDAL, secretDAL: secretV2BridgeDAL, secretImportDAL, - decryptor: (value) => - value ? secretManagerEncryptor({ plainText: value }).cipherTextBlob.toString() : undefined + decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined) }); return importedSecrets; } diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts index a7717eed3..cdd1c8f6f 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts @@ -4,7 +4,6 @@ import { TableName, TSecretFolders, TSecretsV2 } from "@app/db/schemas"; import { groupBy } from "@app/lib/fn"; import { logger } from "@app/lib/logger"; -import { TKmsServiceFactory } from "../kms/kms-service"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; @@ -204,7 +203,10 @@ export const fnSecretBulkUpdate = async ({ tags !== undefined ? { tags, secretId: newSecrets[i].id } : [] ); if (secsUpdatedTag.length) { - await secretTagDAL.deleteTagsToSecretV2({ $in: { id: secsUpdatedTag.map(({ secretId }) => secretId) } }, tx); + await secretTagDAL.deleteTagsToSecretV2( + { $in: { secrets_v2Id: secsUpdatedTag.map(({ secretId }) => secretId) } }, + tx + ); const newSecretTags = secsUpdatedTag.flatMap(({ tags: secretTags = [], secretId }) => secretTags.map((tag) => ({ [`${TableName.SecretTag}Id` as const]: tag, @@ -552,14 +554,3 @@ export const reshapeBridgeSecret = ( createdAt: secret.createdAt, updatedAt: secret.updatedAt }); - -export const secretEncryptionHelper = { - encryptValue: (encryptor: Awaited>, value?: string) => { - if (typeof value === "undefined") return; - return encryptor({ plainText: Buffer.from(value) }).cipherTextBlob; - }, - decryptValue: (decryptor: Awaited>, value?: Buffer | null) => { - if (!value) return; - return decryptor({ cipherTextBlob: value }).toString(); - } -}; diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 726314a45..dbf5be00a 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -9,6 +9,7 @@ import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret- import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service"; import { BadRequestError, NotFoundError } from "@app/lib/errors"; import { groupBy } from "@app/lib/fn"; +import { setKnexStringValue } from "@app/lib/knex"; import { logger } from "@app/lib/logger"; import { alphaNumericNanoId } from "@app/lib/nanoid"; @@ -160,9 +161,10 @@ export const secretV2BridgeServiceFactory = ({ version: 1, type, reminderRepeatDays: el.secretReminderRepeatDays, - encryptedComment: el.secretComment - ? secretManagerEncryptor({ plainText: Buffer.from(el.secretComment) }).cipherTextBlob - : undefined, + encryptedComment: setKnexStringValue( + el.secretComment, + (value) => secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + ), encryptedValue: el.secretValue ? secretManagerEncryptor({ plainText: Buffer.from(el.secretValue) }).cipherTextBlob : undefined, @@ -265,7 +267,7 @@ export const secretV2BridgeServiceFactory = ({ if (inputSecret.newSecretName) { const doesNewNameSecretExist = await secretDAL.findOne({ - key: inputSecret.secretName, + key: inputSecret.newSecretName, type: SecretType.Shared, folderId }); @@ -299,9 +301,10 @@ export const secretV2BridgeServiceFactory = ({ filter: { id: secretId }, data: { reminderRepeatDays: inputSecret.secretReminderRepeatDays, - encryptedComment: inputSecret.secretComment - ? secretManagerEncryptor({ plainText: Buffer.from(inputSecret.secretComment) }).cipherTextBlob - : undefined, + encryptedComment: setKnexStringValue( + inputSecret.secretComment, + (value) => secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + ), reminderNote: inputSecret.secretReminderNote, skipMultilineEncoding: inputSecret.skipMultilineEncoding, key: inputSecret.newSecretName || secretName, @@ -732,9 +735,10 @@ export const secretV2BridgeServiceFactory = ({ fnSecretBulkInsert({ inputSecrets: inputSecrets.map((el) => ({ version: 1, - encryptedComment: el.secretComment - ? secretManagerEncryptor({ plainText: Buffer.from(el.secretComment) }).cipherTextBlob - : undefined, + encryptedComment: setKnexStringValue( + el.secretComment, + (value) => secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + ), encryptedValue: el.secretValue ? secretManagerEncryptor({ plainText: Buffer.from(el.secretValue) }).cipherTextBlob : undefined, @@ -821,7 +825,7 @@ export const secretV2BridgeServiceFactory = ({ const secrets = await secretDAL.findBySecretKeys( folderId, secretsWithNewName.map((el) => ({ - key: el.secretKey, + key: el.newSecretName as string, type: SecretType.Shared })) ); @@ -856,9 +860,10 @@ export const secretV2BridgeServiceFactory = ({ filter: { id: originalSecret.id, type: SecretType.Shared }, data: { reminderRepeatDays: el.secretReminderRepeatDays, - encryptedComment: el.secretComment - ? secretManagerEncryptor({ plainText: Buffer.from(el.secretComment) }).cipherTextBlob - : undefined, + encryptedComment: setKnexStringValue( + el.secretComment, + (value) => secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob + ), reminderNote: el.secretReminderNote, skipMultilineEncoding: el.skipMultilineEncoding, key: el.newSecretName || el.secretKey, diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts index d5af6d137..01bbc8c36 100644 --- a/backend/src/services/secret/secret-queue.ts +++ b/backend/src/services/secret/secret-queue.ts @@ -635,9 +635,9 @@ export const secretQueueFactory = ({ ); let awsAssumeRoleArn = null; if (shouldUseSecretV2Bridge) { - if (integrationAuth.awsAssumeIamRoleArnCipherText) { + if (integrationAuth.encryptedAwsIamAssumRole) { awsAssumeRoleArn = secretManagerDecryptor({ - cipherTextBlob: Buffer.from(integrationAuth.awsAssumeIamRoleArnCipherText) + cipherTextBlob: Buffer.from(integrationAuth.encryptedAwsIamAssumRole) }).toString(); } } else if ( diff --git a/frontend/src/views/IntegrationsPage/IntegrationsPage.tsx b/frontend/src/views/IntegrationsPage/IntegrationsPage.tsx index 73c443ca4..5601a7f68 100644 --- a/frontend/src/views/IntegrationsPage/IntegrationsPage.tsx +++ b/frontend/src/views/IntegrationsPage/IntegrationsPage.tsx @@ -1,50 +1,39 @@ import { useCallback, useEffect } from "react"; -import { useTranslation } from "react-i18next"; import { createNotification } from "@app/components/notifications"; -import { Button, Modal, ModalContent } from "@app/components/v2"; import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; import { withProjectPermission } from "@app/hoc"; -import { usePopUp } from "@app/hooks"; import { useDeleteIntegration, useDeleteIntegrationAuths, useGetCloudIntegrations, - useGetUserWsKey, useGetWorkspaceAuthorizations, - useGetWorkspaceBot, - useGetWorkspaceIntegrations, - useUpdateBotActiveStatus + useGetWorkspaceIntegrations } from "@app/hooks/api"; import { IntegrationAuth } from "@app/hooks/api/types"; -import { ProjectVersion } from "@app/hooks/api/workspace/types"; import { CloudIntegrationSection } from "./components/CloudIntegrationSection"; import { FrameworkIntegrationSection } from "./components/FrameworkIntegrationSection"; import { InfrastructureIntegrationSection } from "./components/InfrastructureIntegrationSection/InfrastructureIntegrationSection"; import { IntegrationsSection } from "./components/IntegrationsSection"; -import { generateBotKey, redirectForProviderAuth } from "./IntegrationPage.utils"; +import { redirectForProviderAuth } from "./IntegrationPage.utils"; type Props = { frameworkIntegrations: Array<{ name: string; slug: string; image: string; docsLink: string }>; - infrastructureIntegrations: Array<{ name: string; slug: string; image: string; docsLink: string }>; + infrastructureIntegrations: Array<{ + name: string; + slug: string; + image: string; + docsLink: string; + }>; }; export const IntegrationsPage = withProjectPermission( ({ frameworkIntegrations, infrastructureIntegrations }: Props) => { - const { t } = useTranslation(); - - const { currentWorkspace } = useWorkspace(); const workspaceId = currentWorkspace?.id || ""; const environments = currentWorkspace?.environments || []; - const { data: latestWsKey } = useGetUserWsKey(workspaceId); - - const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([ - "activeBot" - ] as const); - const { data: cloudIntegrations, isLoading: isCloudIntegrationsLoading } = useGetCloudIntegrations(); @@ -70,11 +59,6 @@ export const IntegrationsPage = withProjectPermission( isFetching: isIntegrationFetching } = useGetWorkspaceIntegrations(workspaceId); - const { data: bot } = useGetWorkspaceBot(workspaceId); - - // mutation - const { mutateAsync: updateBotActiveStatus, mutate: updateBotActiveStatusSync } = - useUpdateBotActiveStatus(); const { mutateAsync: deleteIntegration } = useDeleteIntegration(); const { mutateAsync: deleteIntegrationAuths, @@ -95,12 +79,6 @@ export const IntegrationsPage = withProjectPermission( isIntegrationsAuthorizedEmpty && isIntegrationsEmpty ) { - if (bot?.id && currentWorkspace?.version === ProjectVersion.V1) - updateBotActiveStatusSync({ - isActive: false, - botId: bot.id, - workspaceId - }); resetDeleteIntegrationAuths(); } }, [ @@ -116,16 +94,6 @@ export const IntegrationsPage = withProjectPermission( if (!selectedCloudIntegration) return; try { - if (bot && !bot.isActive && currentWorkspace?.version === ProjectVersion.V1) { - const botKey = generateBotKey(bot.publicKey, latestWsKey!); - await updateBotActiveStatus({ - workspaceId, - botKey, - isActive: true, - botId: bot.id - }); - } - redirectForProviderAuth(selectedCloudIntegration); } catch (error) { console.error(error); @@ -135,19 +103,9 @@ export const IntegrationsPage = withProjectPermission( // function to strat integration for a provider // confirmation to user passing the bot key for provider to get secret access const handleProviderIntegrationStart = (provider: string) => { - if (!bot?.isActive) { - handlePopUpOpen("activeBot", { provider }); - return; - } handleProviderIntegration(provider); }; - const handleUserAcceptBotCondition = () => { - const { provider } = popUp.activeBot?.data as { provider: string }; - handleProviderIntegration(provider); - handlePopUpClose("activeBot"); - }; - const handleIntegrationDelete = async (integrationId: string, cb: () => void) => { try { await deleteIntegration({ id: integrationId, workspaceId }); @@ -195,7 +153,6 @@ export const IntegrationsPage = withProjectPermission( integrations={integrations} environments={environments} onIntegrationDelete={({ id }, cb) => handleIntegrationDelete(id, cb)} - isBotActive={bot?.isActive} workspaceId={workspaceId} /> - handlePopUpToggle("activeBot", isOpen)} - > - - - -
- } - > - {t("integrations.why-infisical-needs-access")} - -
diff --git a/frontend/src/views/IntegrationsPage/components/IntegrationsSection/IntegrationsSection.tsx b/frontend/src/views/IntegrationsPage/components/IntegrationsSection/IntegrationsSection.tsx index 1b6473bfe..c5fa0704b 100644 --- a/frontend/src/views/IntegrationsPage/components/IntegrationsSection/IntegrationsSection.tsx +++ b/frontend/src/views/IntegrationsPage/components/IntegrationsSection/IntegrationsSection.tsx @@ -1,4 +1,3 @@ -import Link from "next/link"; import { faCalendarCheck } from "@fortawesome/free-regular-svg-icons"; import { faArrowRight, faRefresh, faWarning, faXmark } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; @@ -7,8 +6,6 @@ import { integrationSlugNameMapping } from "public/data/frequentConstants"; import { ProjectPermissionCan } from "@app/components/permissions"; import { - Alert, - AlertDescription, Button, DeleteActionModal, EmptyState, @@ -29,7 +26,6 @@ type Props = { integrations?: TIntegration[]; isLoading?: boolean; onIntegrationDelete: (integration: TIntegration, cb: () => void) => void; - isBotActive: boolean | undefined; workspaceId: string; }; @@ -38,7 +34,6 @@ export const IntegrationsSection = ({ environments = [], isLoading, onIntegrationDelete, - isBotActive, workspaceId }: Props) => { const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([ @@ -59,21 +54,7 @@ export const IntegrationsSection = ({
)} - {!isBotActive && Boolean(integrations.length) && ( -
- - - All the active integrations will be disabled. Disable End-to-End Encryption in{" "} - - project settings - - to re-enable it. - - -
- )} - - {!isLoading && !integrations.length && isBotActive && ( + {!isLoading && !integrations.length && (
)} - {!isLoading && isBotActive && ( + {!isLoading && (
{integrations?.map((integration) => (
Date: Tue, 23 Jul 2024 19:56:31 +0530 Subject: [PATCH 47/77] feat: secret v2 architecture for secret rotation --- backend/src/@types/knex.d.ts | 8 ++ .../db/migrations/20240716105646_secret-v2.ts | 21 ++++- backend/src/db/schemas/index.ts | 1 + backend/src/db/schemas/integration-auths.ts | 3 +- backend/src/db/schemas/models.ts | 1 + .../db/schemas/secret-rotation-output-v2.ts | 21 +++++ .../ee/routes/v1/secret-rotation-router.ts | 18 ++-- .../secret-rotation/secret-rotation-dal.ts | 90 +++++++++++++------ .../secret-rotation-queue.ts | 9 +- .../secret-rotation-service.ts | 79 ++++++++++++---- backend/src/server/routes/index.ts | 4 +- .../src/hooks/api/secretRotation/queries.tsx | 44 ++------- .../src/hooks/api/secretRotation/types.ts | 13 +-- .../SecretRotationPage/SecretRotationPage.tsx | 76 +--------------- 14 files changed, 206 insertions(+), 182 deletions(-) create mode 100644 backend/src/db/schemas/secret-rotation-output-v2.ts diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts index 6b77af1c5..5b2f1f2c8 100644 --- a/backend/src/@types/knex.d.ts +++ b/backend/src/@types/knex.d.ts @@ -239,6 +239,9 @@ import { TSecretRotationOutputs, TSecretRotationOutputsInsert, TSecretRotationOutputsUpdate, + TSecretRotationOutputV2, + TSecretRotationOutputV2Insert, + TSecretRotationOutputV2Update, TSecretRotations, TSecretRotationsInsert, TSecretRotationsUpdate, @@ -718,6 +721,11 @@ declare module "knex/types/tables" { TSecretApprovalRequestSecretTagsV2Insert, TSecretApprovalRequestSecretTagsV2Update >; + [TableName.SecretRotationOutputV2]: KnexOriginal.CompositeTableType< + TSecretRotationOutputV2, + TSecretRotationOutputV2Insert, + TSecretRotationOutputV2Update + >; // KMS service [TableName.KmsServerRootConfig]: KnexOriginal.CompositeTableType< TKmsRootConfig, diff --git a/backend/src/db/migrations/20240716105646_secret-v2.ts b/backend/src/db/migrations/20240716105646_secret-v2.ts index 97ecb5676..dac414f5b 100644 --- a/backend/src/db/migrations/20240716105646_secret-v2.ts +++ b/backend/src/db/migrations/20240716105646_secret-v2.ts @@ -128,7 +128,18 @@ export async function up(knex: Knex): Promise { if (!hasEncryptedAccess) t.binary("encryptedAccess"); if (!hasEncryptedAccessId) t.binary("encryptedAccessId"); if (!hasEncryptedRefresh) t.binary("encryptedRefresh"); - if (!hasEncryptedAwsIamAssumRole) t.binary("encryptedAwsIamAssumRole"); + if (!hasEncryptedAwsIamAssumRole) t.binary("encryptedAwsAssumeIamRoleArn"); + }); + } + + if (!(await knex.schema.hasTable(TableName.SecretRotationOutputV2))) { + await knex.schema.createTable(TableName.SecretRotationOutputV2, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.string("key").notNullable(); + t.uuid("secretId").notNullable(); + t.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("CASCADE"); + t.uuid("rotationId").notNullable(); + t.foreign("rotationId").references("id").inTable(TableName.SecretRotation).onDelete("CASCADE"); }); } } @@ -141,13 +152,15 @@ export async function down(knex: Knex): Promise { await knex.schema.dropTableIfExists(TableName.SecretV2JnTag); await knex.schema.dropTableIfExists(TableName.SecretReferenceV2); - await dropOnUpdateTrigger(knex, TableName.SecretV2); - await knex.schema.dropTableIfExists(TableName.SecretV2); + await knex.schema.dropTableIfExists(TableName.SecretRotationOutputV2); await dropOnUpdateTrigger(knex, TableName.SecretVersionV2); await knex.schema.dropTableIfExists(TableName.SecretVersionV2Tag); await knex.schema.dropTableIfExists(TableName.SecretVersionV2); + await dropOnUpdateTrigger(knex, TableName.SecretV2); + await knex.schema.dropTableIfExists(TableName.SecretV2); + if (await knex.schema.hasTable(TableName.IntegrationAuth)) { const hasEncryptedAccess = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccess"); const hasEncryptedAccessId = await knex.schema.hasColumn(TableName.IntegrationAuth, "encryptedAccessId"); @@ -160,7 +173,7 @@ export async function down(knex: Knex): Promise { if (hasEncryptedAccess) t.dropColumn("encryptedAccess"); if (hasEncryptedAccessId) t.dropColumn("encryptedAccessId"); if (hasEncryptedRefresh) t.dropColumn("encryptedRefresh"); - if (hasEncryptedAwsIamAssumRole) t.dropColumn("encryptedAwsIamAssumRole"); + if (hasEncryptedAwsIamAssumRole) t.dropColumn("encryptedAwsAssumeIamRoleArn"); }); } } diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts index d0aa56727..9c5754f1e 100644 --- a/backend/src/db/schemas/index.ts +++ b/backend/src/db/schemas/index.ts @@ -103,3 +103,4 @@ export * from "./user-encryption-keys"; export * from "./user-group-membership"; export * from "./users"; export * from "./webhooks"; +export * from "./secret-rotation-output-v2"; diff --git a/backend/src/db/schemas/integration-auths.ts b/backend/src/db/schemas/integration-auths.ts index 1c0600e81..1e38c2139 100644 --- a/backend/src/db/schemas/integration-auths.ts +++ b/backend/src/db/schemas/integration-auths.ts @@ -35,10 +35,11 @@ export const IntegrationAuthsSchema = z.object({ awsAssumeIamRoleArnCipherText: z.string().nullable().optional(), awsAssumeIamRoleArnIV: z.string().nullable().optional(), awsAssumeIamRoleArnTag: z.string().nullable().optional(), + encryptedAwsIamAssumRole: zodBuffer.nullable().optional(), encryptedAccess: zodBuffer.nullable().optional(), encryptedAccessId: zodBuffer.nullable().optional(), encryptedRefresh: zodBuffer.nullable().optional(), - encryptedAwsIamAssumRole: zodBuffer.nullable().optional() + encryptedAwsAssumeIamRoleArn: zodBuffer.nullable().optional() }); export type TIntegrationAuths = z.infer; diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index 37d4fa699..2e91608e3 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -101,6 +101,7 @@ export enum TableName { JnSecretTag = "secret_tag_junction", SecretVersionTag = "secret_version_tag_junction", SecretVersionV2Tag = "secret_version_v2_tag_junction", + SecretRotationOutputV2 = "secret_rotation_output_v2", // KMS Service KmsServerRootConfig = "kms_root_config", KmsKey = "kms_keys", diff --git a/backend/src/db/schemas/secret-rotation-output-v2.ts b/backend/src/db/schemas/secret-rotation-output-v2.ts new file mode 100644 index 000000000..28d45413a --- /dev/null +++ b/backend/src/db/schemas/secret-rotation-output-v2.ts @@ -0,0 +1,21 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const SecretRotationOutputV2Schema = z.object({ + id: z.string().uuid(), + key: z.string(), + secretId: z.string().uuid(), + rotationId: z.string().uuid() +}); + +export type TSecretRotationOutputV2 = z.infer; +export type TSecretRotationOutputV2Insert = Omit, TImmutableDBKeys>; +export type TSecretRotationOutputV2Update = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/ee/routes/v1/secret-rotation-router.ts b/backend/src/ee/routes/v1/secret-rotation-router.ts index d951eb744..936459fa1 100644 --- a/backend/src/ee/routes/v1/secret-rotation-router.ts +++ b/backend/src/ee/routes/v1/secret-rotation-router.ts @@ -1,6 +1,6 @@ import { z } from "zod"; -import { SecretRotationOutputsSchema, SecretRotationsSchema, SecretsSchema } from "@app/db/schemas"; +import { SecretRotationOutputsSchema, SecretRotationsSchema } from "@app/db/schemas"; import { removeTrailingSlash } from "@app/lib/fn"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; @@ -112,18 +112,10 @@ export const registerSecretRotationRouter = async (server: FastifyZodProvider) = outputs: z .object({ key: z.string(), - secret: SecretsSchema.pick({ - id: true, - version: true, - secretKeyIV: true, - secretKeyTag: true, - secretKeyCiphertext: true, - secretValueIV: true, - secretValueTag: true, - secretValueCiphertext: true, - secretCommentIV: true, - secretCommentTag: true, - secretCommentCiphertext: true + secret: z.object({ + secretKey: z.string(), + id: z.string(), + version: z.number() }) }) .array() diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-dal.ts b/backend/src/ee/services/secret-rotation/secret-rotation-dal.ts index 57d86ff04..8927928d5 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-dal.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-dal.ts @@ -10,6 +10,7 @@ export type TSecretRotationDALFactory = ReturnType { const secretRotationOrm = ormify(db, TableName.SecretRotation); const secretRotationOutputOrm = ormify(db, TableName.SecretRotationOutput); + const secretRotationOutputV2Orm = ormify(db, TableName.SecretRotationOutputV2); const findQuery = (filter: TFindFilter, tx: Knex) => tx(TableName.SecretRotation) @@ -31,13 +32,7 @@ export const secretRotationDALFactory = (db: TDbClient) => { .select(tx.ref("version").withSchema(TableName.Secret).as("secVersion")) .select(tx.ref("secretKeyIV").withSchema(TableName.Secret)) .select(tx.ref("secretKeyTag").withSchema(TableName.Secret)) - .select(tx.ref("secretKeyCiphertext").withSchema(TableName.Secret)) - .select(tx.ref("secretValueIV").withSchema(TableName.Secret)) - .select(tx.ref("secretValueTag").withSchema(TableName.Secret)) - .select(tx.ref("secretValueCiphertext").withSchema(TableName.Secret)) - .select(tx.ref("secretCommentIV").withSchema(TableName.Secret)) - .select(tx.ref("secretCommentTag").withSchema(TableName.Secret)) - .select(tx.ref("secretCommentCiphertext").withSchema(TableName.Secret)); + .select(tx.ref("secretKeyCiphertext").withSchema(TableName.Secret)); const find = async (filter: TFindFilter, tx?: Knex) => { try { @@ -54,33 +49,65 @@ export const secretRotationDALFactory = (db: TDbClient) => { { key: "secId", label: "outputs" as const, - mapper: ({ - secId, - outputKey, - secVersion, - secretKeyIV, - secretKeyTag, - secretKeyCiphertext, - secretValueTag, - secretValueIV, - secretValueCiphertext, - secretCommentIV, - secretCommentTag, - secretCommentCiphertext - }) => ({ + mapper: ({ secId, outputKey, secVersion, secretKeyIV, secretKeyTag, secretKeyCiphertext }) => ({ key: outputKey, secret: { id: secId, version: secVersion, secretKeyIV, secretKeyTag, - secretKeyCiphertext, - secretValueTag, - secretValueIV, - secretValueCiphertext, - secretCommentIV, - secretCommentTag, - secretCommentCiphertext + secretKeyCiphertext + } + }) + } + ] + }); + } catch (error) { + throw new DatabaseError({ error, name: "SecretRotationFind" }); + } + }; + + const findQuerySecretV2 = (filter: TFindFilter, tx: Knex) => + tx(TableName.SecretRotation) + .where(filter) + .join(TableName.Environment, `${TableName.SecretRotation}.envId`, `${TableName.Environment}.id`) + .leftJoin( + TableName.SecretRotationOutputV2, + `${TableName.SecretRotation}.id`, + `${TableName.SecretRotationOutputV2}.rotationId` + ) + .join(TableName.SecretV2, `${TableName.SecretRotationOutputV2}.secretId`, `${TableName.SecretV2}.id`) + .select(selectAllTableCols(TableName.SecretRotation)) + .select(tx.ref("name").withSchema(TableName.Environment).as("envName")) + .select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug")) + .select(tx.ref("id").withSchema(TableName.Environment).as("envId")) + .select(tx.ref("projectId").withSchema(TableName.Environment)) + .select(tx.ref("key").withSchema(TableName.SecretRotationOutputV2).as("outputKey")) + .select(tx.ref("id").withSchema(TableName.SecretV2).as("secId")) + .select(tx.ref("version").withSchema(TableName.SecretV2).as("secVersion")) + .select(tx.ref("key").withSchema(TableName.SecretV2).as("secretKey")); + + const findSecretV2 = async (filter: TFindFilter, tx?: Knex) => { + try { + const data = await findQuerySecretV2(filter, tx || db.replicaNode()); + return sqlNestRelationships({ + data, + key: "id", + parentMapper: (el) => ({ + ...SecretRotationsSchema.parse(el), + projectId: el.projectId, + environment: { id: el.envId, name: el.envName, slug: el.envSlug } + }), + childrenMapper: [ + { + key: "secId", + label: "outputs" as const, + mapper: ({ secId, outputKey, secVersion, secretKey }) => ({ + key: outputKey, + secret: { + id: secId, + version: secVersion, + secretKey } }) } @@ -114,12 +141,17 @@ export const secretRotationDALFactory = (db: TDbClient) => { }; const findRotationOutputsByRotationId = async (rotationId: string) => secretRotationOutputOrm.find({ rotationId }); + const findRotationOutputsV2ByRotationId = async (rotationId: string) => + secretRotationOutputV2Orm.find({ rotationId }); return { ...secretRotationOrm, find, + findSecretV2, findById, secretOutputInsertMany: secretRotationOutputOrm.insertMany, - findRotationOutputsByRotationId + secretOutputV2InsertMany: secretRotationOutputV2Orm.insertMany, + findRotationOutputsByRotationId, + findRotationOutputsV2ByRotationId }; }; diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts index 11b6c34af..ab419e4c9 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts @@ -121,7 +121,13 @@ export const secretRotationQueueFactory = ({ try { if (!rotationProvider || !secretRotation) throw new DisableRotationErrors({ message: "Provider not found" }); - const rotationOutputs = await secretRotationDAL.findRotationOutputsByRotationId(rotationId); + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(secretRotation.projectId); + let rotationOutputs; + if (shouldUseSecretV2Bridge) { + rotationOutputs = await secretRotationDAL.findRotationOutputsV2ByRotationId(rotationId); + } else { + rotationOutputs = await secretRotationDAL.findRotationOutputsByRotationId(rotationId); + } if (!rotationOutputs.length) throw new DisableRotationErrors({ message: "Secrets not found" }); // deep copy @@ -277,7 +283,6 @@ export const secretRotationQueueFactory = ({ internal: newCredential.internal }); const encVarData = infisicalSymmetricEncypt(JSON.stringify(variables)); - const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(secretRotation.projectId); const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId: secretRotation.projectId diff --git a/backend/src/ee/services/secret-rotation/secret-rotation-service.ts b/backend/src/ee/services/secret-rotation/secret-rotation-service.ts index 9b0109a35..d346c5bd3 100644 --- a/backend/src/ee/services/secret-rotation/secret-rotation-service.ts +++ b/backend/src/ee/services/secret-rotation/secret-rotation-service.ts @@ -1,12 +1,15 @@ import { ForbiddenError, subject } from "@casl/ability"; import Ajv from "ajv"; -import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; +import { ProjectVersion } from "@app/db/schemas"; +import { decryptSymmetric128BitHexKeyUTF8, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; import { TProjectPermission } from "@app/lib/types"; import { TProjectDALFactory } from "@app/services/project/project-dal"; +import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; import { TSecretDALFactory } from "@app/services/secret/secret-dal"; import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; +import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal"; import { TLicenseServiceFactory } from "../license/license-service"; import { TPermissionServiceFactory } from "../permission/permission-service"; @@ -22,9 +25,11 @@ type TSecretRotationServiceFactoryDep = { projectDAL: Pick; folderDAL: Pick; secretDAL: Pick; + secretV2BridgeDAL: Pick; licenseService: Pick; permissionService: Pick; secretRotationQueue: TSecretRotationQueueFactory; + projectBotService: Pick; }; export type TSecretRotationServiceFactory = ReturnType; @@ -37,7 +42,9 @@ export const secretRotationServiceFactory = ({ licenseService, projectDAL, folderDAL, - secretDAL + secretDAL, + projectBotService, + secretV2BridgeDAL }: TSecretRotationServiceFactoryDep) => { const getProviderTemplates = async ({ actor, @@ -92,15 +99,25 @@ export const secretRotationServiceFactory = ({ ProjectPermissionActions.Edit, subject(ProjectPermissionSub.Secrets, { environment, secretPath }) ); - - const selectedSecrets = await secretDAL.find({ - folderId: folder.id, - $in: { id: Object.values(outputs) } - }); - if (selectedSecrets.length !== Object.values(outputs).length) - throw new BadRequestError({ message: "Secrets not found" }); - const project = await projectDAL.findById(projectId); + const shouldUseBridge = project.version === ProjectVersion.V3; + + if (shouldUseBridge) { + const selectedSecrets = await secretV2BridgeDAL.find({ + folderId: folder.id, + $in: { id: Object.values(outputs) } + }); + if (selectedSecrets.length !== Object.values(outputs).length) + throw new BadRequestError({ message: "Secrets not found" }); + } else { + const selectedSecrets = await secretDAL.find({ + folderId: folder.id, + $in: { id: Object.values(outputs) } + }); + if (selectedSecrets.length !== Object.values(outputs).length) + throw new BadRequestError({ message: "Secrets not found" }); + } + const plan = await licenseService.getPlan(project.orgId); if (!plan.secretRotation) throw new BadRequestError({ @@ -148,10 +165,18 @@ export const secretRotationServiceFactory = ({ }, tx ); - const outputSecretMapping = await secretRotationDAL.secretOutputInsertMany( - Object.entries(outputs).map(([key, secretId]) => ({ key, secretId, rotationId: doc.id })), - tx - ); + let outputSecretMapping; + if (shouldUseBridge) { + outputSecretMapping = await secretRotationDAL.secretOutputV2InsertMany( + Object.entries(outputs).map(([key, secretId]) => ({ key, secretId, rotationId: doc.id })), + tx + ); + } else { + outputSecretMapping = await secretRotationDAL.secretOutputInsertMany( + Object.entries(outputs).map(([key, secretId]) => ({ key, secretId, rotationId: doc.id })), + tx + ); + } return { ...doc, outputs: outputSecretMapping, environment: folder.environment }; }); await secretRotationQueue.addToQueue(secretRotation.id, secretRotation.interval); @@ -167,8 +192,30 @@ export const secretRotationServiceFactory = ({ actorOrgId ); ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRotation); - const doc = await secretRotationDAL.find({ projectId }); - return doc; + const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); + if (shouldUseSecretV2Bridge) { + const docs = await secretRotationDAL.findSecretV2({ projectId }); + return docs; + } + + if (!botKey) throw new BadRequestError({ message: "bot not found" }); + const docs = await secretRotationDAL.find({ projectId }); + return docs.map((el) => ({ + ...el, + outputs: el.outputs.map((output) => ({ + ...output, + secret: { + id: output.secret.id, + version: output.secret.version, + secretKey: decryptSymmetric128BitHexKeyUTF8({ + ciphertext: output.secret.secretKeyCiphertext, + iv: output.secret.secretKeyIV, + tag: output.secret.secretKeyTag, + key: botKey + }) + } + })) + })); }; const restartById = async ({ actor, actorId, actorOrgId, actorAuthMethod, rotationId }: TRestartDTO) => { diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index daa679dc4..2d096221c 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -869,7 +869,9 @@ export const registerRoutes = async ( projectDAL, licenseService, secretDAL, - folderDAL + folderDAL, + projectBotService, + secretV2BridgeDAL }); const integrationService = integrationServiceFactory({ diff --git a/frontend/src/hooks/api/secretRotation/queries.tsx b/frontend/src/hooks/api/secretRotation/queries.tsx index a3c8e270e..d612189ad 100644 --- a/frontend/src/hooks/api/secretRotation/queries.tsx +++ b/frontend/src/hooks/api/secretRotation/queries.tsx @@ -1,14 +1,9 @@ -import { useCallback } from "react"; import { useQuery, UseQueryOptions } from "@tanstack/react-query"; -import { - decryptAssymmetric, - decryptSymmetric -} from "@app/components/utilities/cryptography/crypto"; import { apiRequest } from "@app/config/request"; import { - TGetSecretRotationList, + TGetSecretRotationListDTO, TGetSecretRotationProviders, TSecretRotation, TSecretRotationProviderList @@ -19,7 +14,7 @@ export const secretRotationKeys = { { workspaceId }, "secret-rotation-providers" ], - list: ({ workspaceId }: Omit) => + list: ({ workspaceId }: Omit) => [{ workspaceId }, "secret-rotations"] as const }; @@ -53,7 +48,7 @@ export const useGetSecretRotationProviders = ({ const fetchSecretRotations = async ({ workspaceId -}: Omit) => { +}: Omit) => { const { data } = await apiRequest.get<{ secretRotations: TSecretRotation[] }>( "/api/v1/secret-rotations", { params: { workspaceId } } @@ -63,14 +58,13 @@ const fetchSecretRotations = async ({ export const useGetSecretRotations = ({ workspaceId, - decryptFileKey, options = {} -}: TGetSecretRotationList & { +}: TGetSecretRotationListDTO & { options?: Omit< UseQueryOptions< TSecretRotation[], unknown, - TSecretRotation<{ key: string }>[], + TSecretRotation[], ReturnType >, "queryKey" | "queryFn" @@ -80,31 +74,5 @@ export const useGetSecretRotations = ({ ...options, queryKey: secretRotationKeys.list({ workspaceId }), enabled: Boolean(workspaceId) && (options?.enabled ?? true), - queryFn: async () => fetchSecretRotations({ workspaceId }), - select: useCallback( - (data: TSecretRotation[]) => { - const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string; - const decryptKey = decryptAssymmetric({ - ciphertext: decryptFileKey.encryptedKey, - nonce: decryptFileKey.nonce, - publicKey: decryptFileKey.sender.publicKey, - privateKey: PRIVATE_KEY - }); - return data.map((el) => ({ - ...el, - outputs: el.outputs.map(({ key, secret }) => ({ - key, - secret: { - key: decryptSymmetric({ - ciphertext: secret.secretValueCiphertext, - iv: secret.secretValueIV, - tag: secret.secretValueTag, - key: decryptKey - }) - } - })) - })); - }, - [decryptFileKey] - ) + queryFn: async () => fetchSecretRotations({ workspaceId }) }); diff --git a/frontend/src/hooks/api/secretRotation/types.ts b/frontend/src/hooks/api/secretRotation/types.ts index b8963a95e..07a4c70df 100644 --- a/frontend/src/hooks/api/secretRotation/types.ts +++ b/frontend/src/hooks/api/secretRotation/types.ts @@ -1,5 +1,3 @@ -import { UserWsKeyPair } from "../keys/types"; -import { EncryptedSecret } from "../secrets/types"; import { WorkspaceEnv } from "../workspace/types"; export enum TProviderFunctionTypes { @@ -74,7 +72,7 @@ export type TDbProviderTemplate = { outputs: Record; }; -export type TSecretRotation = { +export type TSecretRotation = { id: string; interval: number; provider: string; @@ -85,7 +83,11 @@ export type TSecretRotation = { secretPath: string; outputs: Array<{ key: string; - secret: T; + secret: { + version: number; + id: string; + secretKey: string; + }; }>; status?: "success" | "failed"; lastRotatedAt?: string; @@ -103,9 +105,8 @@ export type TGetSecretRotationProviders = { workspaceId: string; }; -export type TGetSecretRotationList = { +export type TGetSecretRotationListDTO = { workspaceId: string; - decryptFileKey: UserWsKeyPair; }; export type TCreateSecretRotationDTO = { diff --git a/frontend/src/views/SecretRotationPage/SecretRotationPage.tsx b/frontend/src/views/SecretRotationPage/SecretRotationPage.tsx index 405cf004a..535fe1bf0 100644 --- a/frontend/src/views/SecretRotationPage/SecretRotationPage.tsx +++ b/frontend/src/views/SecretRotationPage/SecretRotationPage.tsx @@ -1,4 +1,3 @@ -import { useTranslation } from "react-i18next"; import Link from "next/link"; import { faArrowsSpin, @@ -16,12 +15,9 @@ import { formatDistance } from "date-fns"; import { createNotification } from "@app/components/notifications"; import { ProjectPermissionCan } from "@app/components/permissions"; import { - Button, DeleteActionModal, EmptyState, IconButton, - Modal, - ModalContent, Skeleton, Spinner, Table, @@ -48,22 +44,17 @@ import { useDeleteSecretRotation, useGetSecretRotationProviders, useGetSecretRotations, - useGetUserWsKey, - useGetWorkspaceBot, - useRestartSecretRotation, - useUpdateBotActiveStatus + useRestartSecretRotation } from "@app/hooks/api"; import { TSecretRotationProviderTemplate } from "@app/hooks/api/types"; import { CreateRotationForm } from "./components/CreateRotationForm"; -import { generateBotKey } from "./SecretRotationPage.utils"; export const SecretRotationPage = withProjectPermission( () => { const { currentWorkspace } = useWorkspace(); - const { t } = useTranslation(); const { permission } = useProjectPermission(); - + const { popUp, handlePopUpOpen, handlePopUpToggle, handlePopUpClose } = usePopUp([ "createRotation", "activeBot", @@ -77,13 +68,10 @@ export const SecretRotationPage = withProjectPermission( ); const { subscription } = useSubscription(); - const { data: userWsKey } = useGetUserWsKey(workspaceId); - const { data: secretRotationProviders, isLoading: isRotationProviderLoading } = useGetSecretRotationProviders({ workspaceId }); const { data: secretRotations, isLoading: isRotationLoading } = useGetSecretRotations({ - workspaceId, - decryptFileKey: userWsKey! + workspaceId }); const { @@ -97,11 +85,6 @@ export const SecretRotationPage = withProjectPermission( isLoading: isRestartingRotation } = useRestartSecretRotation(); - const { data: bot } = useGetWorkspaceBot(workspaceId); - const { mutateAsync: updateBotActiveStatus } = useUpdateBotActiveStatus(); - - const isBotActive = Boolean(bot?.isActive); - const handleDeleteRotation = async () => { const { id } = popUp.deleteRotation.data as { id: string }; try { @@ -142,29 +125,6 @@ export const SecretRotationPage = withProjectPermission( } }; - const handleUserAcceptBotCondition = async () => { - const provider = popUp.activeBot?.data as TSecretRotationProviderTemplate; - try { - if (bot?.id) { - const botKey = generateBotKey(bot.publicKey, userWsKey!); - await updateBotActiveStatus({ - isActive: true, - botId: bot.id, - workspaceId, - botKey - }); - } - handlePopUpOpen("createRotation", provider); - handlePopUpClose("activeBot"); - } catch (error) { - console.log(error); - createNotification({ - type: "error", - text: "Failed to create bot" - }); - } - }; - const handleCreateRotation = async (provider: TSecretRotationProviderTemplate) => { if (subscription && !subscription?.secretRotation) { handlePopUpOpen("upgradePlan"); @@ -174,11 +134,7 @@ export const SecretRotationPage = withProjectPermission( createNotification({ type: "error", text: "Access permission denied!!" }); return; } - if (isBotActive) { - handlePopUpOpen("createRotation", provider); - } else { - handlePopUpOpen("activeBot", provider); - } + handlePopUpOpen("createRotation", provider); }; return ( @@ -391,30 +347,6 @@ export const SecretRotationPage = withProjectPermission( onToggle={(isOpen) => handlePopUpToggle("createRotation", isOpen)} provider={(popUp.createRotation.data as TSecretRotationProviderTemplate) || {}} /> - handlePopUpToggle("activeBot", isOpen)} - > - - - -
- } - > - {t("integrations.why-infisical-needs-access")} - - Date: Tue, 23 Jul 2024 21:56:39 +0530 Subject: [PATCH 48/77] feat: fixed secret approval for architecture v2 --- .../v1/secret-approval-request-router.ts | 49 +++++++------ backend/src/ee/routes/v1/snapshot-router.ts | 21 +++--- .../secret-approval-request-secret-dal.ts | 2 +- .../secret-approval-request-service.ts | 72 ++++++++++--------- .../services/secret-snapshot/snapshot-dal.ts | 2 +- 5 files changed, 76 insertions(+), 70 deletions(-) diff --git a/backend/src/ee/routes/v1/secret-approval-request-router.ts b/backend/src/ee/routes/v1/secret-approval-request-router.ts index 0f5f3f3db..bcc4a36c5 100644 --- a/backend/src/ee/routes/v1/secret-approval-request-router.ts +++ b/backend/src/ee/routes/v1/secret-approval-request-router.ts @@ -261,31 +261,30 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv secretPath: z.string(), commits: secretRawSchema .omit({ _id: true, environment: true, workspace: true, type: true, version: true }) - .merge( - z.object({ - tags: tagSchema, - secret: z - .object({ - id: z.string(), - version: z.number(), - secretKey: z.string(), - secretValue: z.string().optional(), - secretComment: z.string().optional() - }) - .optional() - .nullable(), - secretVersion: z - .object({ - id: z.string(), - version: z.number(), - secretKey: z.string(), - secretValue: z.string().optional(), - secretComment: z.string().optional(), - tags: tagSchema - }) - .optional() - }) - ) + .extend({ + op: z.string(), + tags: tagSchema, + secret: z + .object({ + id: z.string(), + version: z.number(), + secretKey: z.string(), + secretValue: z.string().optional(), + secretComment: z.string().optional() + }) + .optional() + .nullable(), + secretVersion: z + .object({ + id: z.string(), + version: z.number(), + secretKey: z.string(), + secretValue: z.string().optional(), + secretComment: z.string().optional(), + tags: tagSchema + }) + .optional() + }) .array() }) ) diff --git a/backend/src/ee/routes/v1/snapshot-router.ts b/backend/src/ee/routes/v1/snapshot-router.ts index aa1e66be2..a716aabd7 100644 --- a/backend/src/ee/routes/v1/snapshot-router.ts +++ b/backend/src/ee/routes/v1/snapshot-router.ts @@ -29,17 +29,16 @@ export const registerSnapshotRouter = async (server: FastifyZodProvider) => { name: z.string() }), secretVersions: secretRawSchema - .omit({ _id: true, environment: true, workspace: true, type: true, version: true }) - .merge( - z.object({ - tags: SecretTagsSchema.pick({ - id: true, - slug: true, - name: true, - color: true - }).array() - }) - ) + .omit({ _id: true, environment: true, workspace: true, type: true }) + .extend({ + secretId: z.string(), + tags: SecretTagsSchema.pick({ + id: true, + slug: true, + name: true, + color: true + }).array() + }) .array(), folderVersion: z.object({ id: z.string(), name: z.string() }).array(), createdAt: z.date(), diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts index 998bc4bcf..ab0ad7ed3 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts @@ -242,7 +242,7 @@ export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => { `${TableName.SecretApprovalRequestSecretTagV2}.tagId`, `${TableName.SecretTag}.id` ) - .leftJoin(TableName.SecretV2, `${TableName.SecretApprovalRequestSecretV2}.secretId`, `${TableName.Secret}.id`) + .leftJoin(TableName.SecretV2, `${TableName.SecretApprovalRequestSecretV2}.secretId`, `${TableName.SecretV2}.id`) .leftJoin( TableName.SecretVersionV2, `${TableName.SecretVersionV2}.id`, diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index d351cfc8e..f0cdf0951 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -230,28 +230,32 @@ export const secretApprovalRequestServiceFactory = ({ secretComment: el.encryptedComment ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() : undefined, - secret: { - secretKey: el.secret.key, - id: el.secret.id, - version: el.secret.version, - secretValue: el.secret.encryptedValue - ? secretManagerDecryptor({ cipherTextBlob: el.secret.encryptedValue }).toString() - : undefined, - secretComment: el.secret.encryptedComment - ? secretManagerDecryptor({ cipherTextBlob: el.secret.encryptedComment }).toString() - : undefined - }, - secretVersion: { - secretKey: el.secretVersion.key, - id: el.secretVersion.id, - version: el.secretVersion.version, - secretValue: el.secretVersion.encryptedValue - ? secretManagerDecryptor({ cipherTextBlob: el.secretVersion.encryptedValue }).toString() - : undefined, - secretComment: el.secretVersion.encryptedComment - ? secretManagerDecryptor({ cipherTextBlob: el.secretVersion.encryptedComment }).toString() - : undefined - } + secret: el.secret + ? { + secretKey: el.secret.key, + id: el.secret.id, + version: el.secret.version, + secretValue: el.secret.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: el.secret.encryptedValue }).toString() + : undefined, + secretComment: el.secret.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.secret.encryptedComment }).toString() + : undefined + } + : undefined, + secretVersion: el.secretVersion + ? { + secretKey: el.secretVersion.key, + id: el.secretVersion.id, + version: el.secretVersion.version, + secretValue: el.secretVersion.encryptedValue + ? secretManagerDecryptor({ cipherTextBlob: el.secretVersion.encryptedValue }).toString() + : undefined, + secretComment: el.secretVersion.encryptedComment + ? secretManagerDecryptor({ cipherTextBlob: el.secretVersion.encryptedComment }).toString() + : undefined + } + : undefined })); } else { if (!botKey) throw new BadRequestError({ message: "Bot key not found" }); @@ -259,16 +263,20 @@ export const secretApprovalRequestServiceFactory = ({ secrets = encrypedSecrets.map((el) => ({ ...el, ...decryptSecretWithBot(el, botKey), - secret: { - id: el.secret.id, - version: el.secret.version, - ...decryptSecretWithBot(el.secret, botKey) - }, - secretVersion: { - id: el.secretVersion.id, - version: el.secretVersion.version, - ...decryptSecretWithBot(el.secretVersion, botKey) - } + secret: el.secret + ? { + id: el.secret.id, + version: el.secret.version, + ...decryptSecretWithBot(el.secret, botKey) + } + : undefined, + secretVersion: el.secretVersion + ? { + id: el.secretVersion.id, + version: el.secretVersion.version, + ...decryptSecretWithBot(el.secretVersion, botKey) + } + : undefined })); } const secretPath = await folderDAL.findSecretPathByFolderIds(secretApprovalRequest.projectId, [ diff --git a/backend/src/ee/services/secret-snapshot/snapshot-dal.ts b/backend/src/ee/services/secret-snapshot/snapshot-dal.ts index e53496127..399aec44c 100644 --- a/backend/src/ee/services/secret-snapshot/snapshot-dal.ts +++ b/backend/src/ee/services/secret-snapshot/snapshot-dal.ts @@ -505,7 +505,7 @@ export const snapshotDALFactory = (db: TDbClient) => { db.ref("max").withSchema("secGroupByMaxVersion").as("latestSecretVersion"), db.ref("max").withSchema("folderGroupByMaxVersion").as("latestFolderVersion"), db.ref("id").withSchema(TableName.SecretTag).as("tagId"), - db.ref("id").withSchema(TableName.SecretVersionTag).as("tagVersionId"), + db.ref("id").withSchema(TableName.SecretVersionV2Tag).as("tagVersionId"), db.ref("color").withSchema(TableName.SecretTag).as("tagColor"), db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"), db.ref("name").withSchema(TableName.SecretTag).as("tagName") From 3e0ae5765f106ec3d2e6d9370fff33f7f9793065 Mon Sep 17 00:00:00 2001 From: = Date: Wed, 24 Jul 2024 00:56:23 +0530 Subject: [PATCH 49/77] feat: updated kms service to return only kms details and some more minor changes --- backend/src/ee/routes/v1/project-router.ts | 10 +- .../external-kms/external-kms-service.ts | 48 +++-- .../secret-approval-request-service.ts | 24 ++- backend/src/services/kms/kms-key-dal.ts | 2 + backend/src/services/kms/kms-service.ts | 178 ++++++++++-------- backend/src/services/kms/kms-types.ts | 38 ++-- .../src/services/project/project-service.ts | 7 +- backend/src/services/project/project-types.ts | 3 +- frontend/src/hooks/api/kms/mutations.tsx | 6 +- frontend/src/hooks/api/kms/types.ts | 5 + .../EncryptionTab/EncryptionTab.tsx | 21 ++- 11 files changed, 200 insertions(+), 142 deletions(-) diff --git a/backend/src/ee/routes/v1/project-router.ts b/backend/src/ee/routes/v1/project-router.ts index 1f8c5b7ee..7d0d5f3b3 100644 --- a/backend/src/ee/routes/v1/project-router.ts +++ b/backend/src/ee/routes/v1/project-router.ts @@ -7,6 +7,7 @@ import { getLastMidnightDateISO, removeTrailingSlash } from "@app/lib/fn"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; +import { KmsType } from "@app/services/kms/kms-types"; export const registerProjectRouter = async (server: FastifyZodProvider) => { server.route({ @@ -194,7 +195,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT]), handler: async (req) => { - const kmsKeys = await server.services.project.getProjectKmsKeys({ + const kmsKey = await server.services.project.getProjectKmsKeys({ actor: req.permission.type, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, @@ -202,7 +203,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { projectId: req.params.workspaceId }); - return kmsKeys; + return kmsKey; } }); @@ -217,7 +218,10 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => { workspaceId: z.string().trim() }), body: z.object({ - secretManagerKmsKeyId: z.string() + kms: z.discriminatedUnion("type", [ + z.object({ type: z.literal(KmsType.Internal) }), + z.object({ type: z.literal(KmsType.External), kmsId: z.string() }) + ]) }), response: { 200: z.object({ diff --git a/backend/src/ee/services/external-kms/external-kms-service.ts b/backend/src/ee/services/external-kms/external-kms-service.ts index 59e6e5bc4..491971a04 100644 --- a/backend/src/ee/services/external-kms/external-kms-service.ts +++ b/backend/src/ee/services/external-kms/external-kms-service.ts @@ -5,6 +5,7 @@ import { BadRequestError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { TKmsKeyDALFactory } from "@app/services/kms/kms-key-dal"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; import { TLicenseServiceFactory } from "../license/license-service"; import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission"; @@ -23,10 +24,7 @@ import { ExternalKmsAwsSchema, KmsProviders } from "./providers/model"; type TExternalKmsServiceFactoryDep = { externalKmsDAL: TExternalKmsDALFactory; - kmsService: Pick< - TKmsServiceFactory, - "getOrgKmsKeyId" | "decryptWithInputKey" | "encryptWithInputKey" | "getOrgKmsDataKey" - >; + kmsService: Pick; kmsDAL: Pick; permissionService: Pick; licenseService: Pick; @@ -84,12 +82,12 @@ export const externalKmsServiceFactory = ({ throw new BadRequestError({ message: "external kms provided is invalid" }); } - const orgKmsDataKey = await kmsService.getOrgKmsDataKey(actorOrgId); - const kmsEncryptor = await kmsService.encryptWithInputKey({ - key: orgKmsDataKey + const { encryptor: orgDataKeyEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.Organization, + orgId: actorOrgId }); - const { cipherTextBlob: encryptedProviderInputs } = kmsEncryptor({ + const { cipherTextBlob: encryptedProviderInputs } = orgDataKeyEncryptor({ plainText: Buffer.from(sanitizedProviderInput, "utf8") }); @@ -150,13 +148,13 @@ export const externalKmsServiceFactory = ({ if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); let sanitizedProviderInput = ""; - if (provider) { - const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId); - const kmsDecryptor = await kmsService.decryptWithInputKey({ - key: orgKmsDataKey + const { encryptor: orgDataKeyEncryptor, decryptor: orgDataKeyDecryptor } = + await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.Organization, + orgId: actorOrgId }); - - const decryptedProviderInputBlob = kmsDecryptor({ + if (provider) { + const decryptedProviderInputBlob = orgDataKeyDecryptor({ cipherTextBlob: externalKmsDoc.encryptedProviderInputs }); @@ -179,11 +177,7 @@ export const externalKmsServiceFactory = ({ let encryptedProviderInputs: Buffer | undefined; if (sanitizedProviderInput) { - const orgKmsDataKey = await kmsService.getOrgKmsDataKey(actorOrgId); - const kmsEncryptor = await kmsService.encryptWithInputKey({ - key: orgKmsDataKey - }); - const { cipherTextBlob } = kmsEncryptor({ + const { cipherTextBlob } = orgDataKeyEncryptor({ plainText: Buffer.from(sanitizedProviderInput, "utf8") }); encryptedProviderInputs = cipherTextBlob; @@ -266,12 +260,12 @@ export const externalKmsServiceFactory = ({ const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); - const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId); - const kmsDecryptor = await kmsService.decryptWithInputKey({ - key: orgKmsDataKey + const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.Organization, + orgId: actorOrgId }); - const decryptedProviderInputBlob = kmsDecryptor({ + const decryptedProviderInputBlob = orgDataKeyDecryptor({ cipherTextBlob: externalKmsDoc.encryptedProviderInputs }); switch (externalKmsDoc.provider) { @@ -306,12 +300,12 @@ export const externalKmsServiceFactory = ({ const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id }); if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" }); - const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId); - const kmsDecryptor = await kmsService.decryptWithInputKey({ - key: orgKmsDataKey + const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.Organization, + orgId: actorOrgId }); - const decryptedProviderInputBlob = kmsDecryptor({ + const decryptedProviderInputBlob = orgDataKeyDecryptor({ cipherTextBlob: externalKmsDoc.encryptedProviderInputs }); diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts index f0cdf0951..5157c78c0 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts @@ -17,6 +17,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid"; import { EnforcementLevel } from "@app/lib/types"; import { ActorType } from "@app/services/auth/auth-type"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal"; @@ -89,10 +90,7 @@ type TSecretApprovalRequestServiceFactoryDep = { projectEnvDAL: Pick; projectDAL: Pick; secretQueueService: Pick; - kmsService: Pick< - TKmsServiceFactory, - "getProjectSecretManagerKmsDataKey" | "encryptWithInputKey" | "decryptWithInputKey" - >; + kmsService: Pick; secretV2BridgeDAL: Pick< TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany" @@ -214,8 +212,10 @@ export const secretApprovalRequestServiceFactory = ({ let secrets; if (shouldUseSecretV2Bridge) { - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); const encrypedSecrets = await secretApprovalRequestSecretDAL.findByRequestIdBridgeSecretV2( secretApprovalRequest.id ); @@ -427,8 +427,10 @@ export const secretApprovalRequestServiceFactory = ({ ); if (!secretApprovalSecrets) throw new BadRequestError({ message: "No secrets found" }); - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey }); + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); const conflicts: Array<{ secretId: string; op: SecretOperations }> = []; let secretCreationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Create); @@ -1074,8 +1076,10 @@ export const secretApprovalRequestServiceFactory = ({ const commits: Omit[] = []; const commitTagIds: Record = {}; - const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId); - const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey }); + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); // for created secret approval change const createdSecrets = data[SecretOperations.Create]; diff --git a/backend/src/services/kms/kms-key-dal.ts b/backend/src/services/kms/kms-key-dal.ts index c2b1c0358..004348722 100644 --- a/backend/src/services/kms/kms-key-dal.ts +++ b/backend/src/services/kms/kms-key-dal.ts @@ -10,6 +10,8 @@ export type TKmsKeyDALFactory = ReturnType; export const kmskeyDALFactory = (db: TDbClient) => { const kmsOrm = ormify(db, TableName.KmsKey); + // akhilmhdh: this function should never be called outside kms service + // why: because the encrypted key should never be shared with another service const findByIdWithAssociatedKms = async (id: string, tx?: Knex) => { try { const result = await (tx || db.replicaNode())(TableName.KmsKey) diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 4555bb0e0..08465284b 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -1,6 +1,8 @@ import slugify from "@sindresorhus/slugify"; import { Knex } from "knex"; +import { z } from "zod"; +import { KmsKeysSchema } from "@app/db/schemas"; import { AwsKmsProviderFactory } from "@app/ee/services/external-kms/providers/aws-kms"; import { ExternalKmsAwsSchema, @@ -23,12 +25,14 @@ import { TKmsKeyDALFactory } from "./kms-key-dal"; import { TKmsRootConfigDALFactory } from "./kms-root-config-dal"; import { KmsDataKey, + KmsType, TDecryptWithKeyDTO, TDecryptWithKmsDTO, TEncryptionWithKeyDTO, TEncryptWithKmsDataKeyDTO, TEncryptWithKmsDTO, - TGenerateKMSDTO + TGenerateKMSDTO, + TUpdateProjectSecretManagerKmsKeyDTO } from "./kms-types"; type TKmsServiceFactoryDep = { @@ -42,7 +46,6 @@ type TKmsServiceFactoryDep = { export type TKmsServiceFactory = ReturnType; -export const INTERNAL_KMS_KEY_ID = "internal"; const KMS_ROOT_CONFIG_UUID = "00000000-0000-0000-0000-000000000000"; const KMS_ROOT_CREATION_WAIT_KEY = "wait_till_ready_kms_root_key"; @@ -51,6 +54,8 @@ const KMS_ROOT_CREATION_WAIT_TIME = 10; // akhilmhdh: Don't edit this value. This is measured for blob concatination in kms const KMS_VERSION = "v01"; const KMS_VERSION_BLOB_LENGTH = 3; +const KmsSanitizedSchema = KmsKeysSchema.extend({ isExternal: z.boolean() }); + export const kmsServiceFactory = ({ kmsDAL, kmsRootConfigDAL, @@ -61,7 +66,11 @@ export const kmsServiceFactory = ({ }: TKmsServiceFactoryDep) => { let ROOT_ENCRYPTION_KEY = Buffer.alloc(0); - // this is used symmetric encryption + /* + * Generate KMS Key + * This function is responsibile for generating the infisical internal KMS for various entities + * Like for secret manager, cert manager or for organization + */ const generateKmsKey = async ({ orgId, isReserved = true, tx, slug }: TGenerateKMSDTO) => { const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); const kmsKeyMaterial = randomSecureBytes(32); @@ -93,6 +102,11 @@ export const kmsServiceFactory = ({ return doc; }; + /* + * Simple encryption service function to do all the encryption tasks in infisical + * This can be even later exposed directly as api for encryption as function + * The encrypted binary even has everything into it. The IV, the version etc + */ const encryptWithInputKey = async ({ key }: Omit) => { // akhilmhdh: as more encryption are added do a check here on kmsDoc.encryptionAlgorithm const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); @@ -105,6 +119,10 @@ export const kmsServiceFactory = ({ }; }; + /* + * Simple decryption service function to do all the encryption tasks in infisical + * This can be even later exposed directly as api for encryption as function + */ const decryptWithInputKey = async ({ key }: Omit) => { const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); @@ -115,6 +133,13 @@ export const kmsServiceFactory = ({ }; }; + /* + * Function to generate a KMS for an org + * We handle concurrent with redis locking and waitReady + * What happens is first we check kms is assigned else first we acquire lock and create the kms with connection + * In mean time the rest of the request will wait until creation is finished followed by getting the created on + * In real time this would be milliseconds + */ const getOrgKmsKeyId = async (orgId: string) => { let org = await orgDAL.findById(orgId); @@ -176,7 +201,12 @@ export const kmsServiceFactory = ({ return org.kmsDefaultKeyId; }; - const decryptWithKmsKey = async ({ kmsId }: Omit) => { + const decryptWithKmsKey = async ({ + kmsId, + depth = 0 + }: Omit & { depth?: number }) => { + if (depth > 2) throw new BadRequestError({ message: "KMS depth max limit" }); + const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(kmsId); if (!kmsDoc) { throw new NotFoundError({ message: "KMS ID not found" }); @@ -189,8 +219,12 @@ export const kmsServiceFactory = ({ throw new Error("Invalid organization KMS"); } + // The idea is external kms connection info is encrypted by an org default KMS + // This could be external kms(in future) but at the end of the day, the end KMS will be an infisical internal one + // we put a limit of depth to avoid too many cycles const orgKmsDecryptor = await decryptWithKmsKey({ - kmsId: kmsDoc.orgKms.id + kmsId: kmsDoc.orgKms.id, + depth: depth + 1 }); const orgKmsDataKey = await orgKmsDecryptor({ @@ -303,7 +337,7 @@ export const kmsServiceFactory = ({ }; }; - const getOrgKmsDataKey = async (orgId: string) => { + const $getOrgKmsDataKey = async (orgId: string) => { const kmsKeyId = await getOrgKmsKeyId(orgId); let org = await orgDAL.findById(orgId); @@ -313,7 +347,7 @@ export const kmsServiceFactory = ({ if (!org.kmsEncryptedDataKey) { const lock = await keyStore - .acquireLock([KeyStorePrefixes.KmsOrgDataKeyCreation, orgId], 3000, { retryCount: 3 }) + .acquireLock([KeyStorePrefixes.KmsOrgDataKeyCreation, orgId], 500, { retryCount: 0 }) .catch(() => null); try { @@ -448,14 +482,7 @@ export const kmsServiceFactory = ({ return project.kmsSecretManagerKeyId; }; - const getProjectSecretManagerKmsKey = async (projectId: string) => { - const kmsKeyId = await getProjectSecretManagerKmsKeyId(projectId); - const kmsKey = await kmsDAL.findByIdWithAssociatedKms(kmsKeyId); - - return kmsKey; - }; - - const getProjectSecretManagerKmsDataKey = async (projectId: string) => { + const $getProjectSecretManagerKmsDataKey = async (projectId: string) => { const kmsKeyId = await getProjectSecretManagerKmsKeyId(projectId); let project = await projectDAL.findById(projectId); @@ -528,21 +555,58 @@ export const kmsServiceFactory = ({ }); }; - const updateProjectSecretManagerKmsKey = async (projectId: string, kmsId: string) => { - const currentKms = await getProjectSecretManagerKmsKey(projectId); + const $getDataKey = async (dto: TEncryptWithKmsDataKeyDTO) => { + switch (dto.type) { + case KmsDataKey.SecretManager: { + return $getProjectSecretManagerKmsDataKey(dto.projectId); + } + default: { + return $getOrgKmsDataKey(dto.orgId); + } + } + }; - if ((currentKms.isReserved && kmsId === INTERNAL_KMS_KEY_ID) || currentKms.id === kmsId) { - return currentKms; + // by keeping the decrypted data key in inner scope + // none of the entities outside can interact directly or expose the data key + const createCipherPairWithDataKey = async (encryptionContext: TEncryptWithKmsDataKeyDTO) => { + const dataKey = await $getDataKey(encryptionContext); + const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); + + return { + encryptor: ({ plainText }: Pick) => { + const encryptedPlainTextBlob = cipher.encrypt(plainText, dataKey); + + // Buffer#1 encrypted text + Buffer#2 version number + const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3 + const cipherTextBlob = Buffer.concat([encryptedPlainTextBlob, versionBlob]); + return { cipherTextBlob }; + }, + decryptor: ({ cipherTextBlob: versionedCipherTextBlob }: Pick) => { + const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH); + const decryptedBlob = cipher.decrypt(cipherTextBlob, dataKey); + return decryptedBlob; + } + }; + }; + + const updateProjectSecretManagerKmsKey = async ({ projectId, kms }: TUpdateProjectSecretManagerKmsKeyDTO) => { + const kmsKeyId = await getProjectSecretManagerKmsKeyId(projectId); + const currentKms = await kmsDAL.findById(kmsKeyId); + + // case: internal kms -> internal kms. no change needed + if (kms.type === KmsType.Internal && currentKms.isReserved) { + return KmsSanitizedSchema.parseAsync({ isExternal: false, ...currentKms }); } - if (kmsId !== INTERNAL_KMS_KEY_ID) { + if (kms.type === KmsType.External) { + // validate kms is scoped in org + const { kmsId } = kms; const project = await projectDAL.findById(projectId); if (!project) { throw new NotFoundError({ message: "Project not found." }); } - const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(kmsId); if (!kmsDoc) { throw new NotFoundError({ message: "KMS ID not found." }); @@ -555,38 +619,36 @@ export const kmsServiceFactory = ({ } } - const dataKey = await getProjectSecretManagerKmsDataKey(projectId); - + const dataKey = await $getProjectSecretManagerKmsDataKey(projectId); return kmsDAL.transaction(async (tx) => { const project = await projectDAL.findById(projectId, tx); - let newKmsId = kmsId; - - if (newKmsId === INTERNAL_KMS_KEY_ID) { - const key = await generateKmsKey({ + let kmsId; + if (kms.type === KmsType.Internal) { + const internalKms = await generateKmsKey({ isReserved: true, orgId: project.orgId, tx }); - - newKmsId = key.id; + kmsId = internalKms.id; + } else { + kmsId = kms.kmsId; } - const kmsEncryptor = await encryptWithKmsKey({ kmsId: newKmsId }, tx); + const kmsEncryptor = await encryptWithKmsKey({ kmsId }, tx); const { cipherTextBlob } = await kmsEncryptor({ plainText: dataKey }); await projectDAL.updateById( projectId, { - kmsSecretManagerKeyId: newKmsId, + kmsSecretManagerKeyId: kmsId, kmsSecretManagerEncryptedDataKey: cipherTextBlob }, tx ); - if (currentKms.isReserved) { await kmsDAL.deleteById(currentKms.id, tx); } - - return kmsDAL.findByIdWithAssociatedKms(newKmsId, tx); + const newKms = await kmsDAL.findById(kmsId, tx); + return KmsSanitizedSchema.parseAsync({ isExternal: !currentKms.isReserved, ...newKms }); }); }; @@ -598,13 +660,15 @@ export const kmsServiceFactory = ({ }); } - const secretManagerDataKey = await getProjectSecretManagerKmsDataKey(projectId); + const secretManagerDataKey = await $getProjectSecretManagerKmsDataKey(projectId); const kmsKeyIdForEncrypt = await getOrgKmsKeyId(project.orgId); const kmsEncryptor = await encryptWithKmsKey({ kmsId: kmsKeyIdForEncrypt }); - const { cipherTextBlob: encryptedSecretManagerDataKey } = await kmsEncryptor({ plainText: secretManagerDataKey }); + const { cipherTextBlob: encryptedSecretManagerDataKeyWithOrgKms } = await kmsEncryptor({ + plainText: secretManagerDataKey + }); // backup format: version.projectId.kmsFunction.kmsId.Base64(encryptedDataKey).verificationHash - let secretManagerBackup = `v1.${projectId}.secretManager.${kmsKeyIdForEncrypt}.${encryptedSecretManagerDataKey.toString( + let secretManagerBackup = `v1.${projectId}.secretManager.${kmsKeyIdForEncrypt}.${encryptedSecretManagerDataKeyWithOrgKms.toString( "base64" )}`; @@ -678,39 +742,8 @@ export const kmsServiceFactory = ({ message: "KMS not found" }); } - - return kms; - }; - - const $getDataKey = async (dto: TEncryptWithKmsDataKeyDTO) => { - switch (dto.type) { - case KmsDataKey.SecretManager: { - return getProjectSecretManagerKmsDataKey(dto.projectId); - } - default: { - return getProjectSecretManagerKmsDataKey(dto.orgId); - } - } - }; - - const createCipherPairWithDataKey = async (encryptionContext: TEncryptWithKmsDataKeyDTO) => { - const dataKey = await $getDataKey(encryptionContext); - const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); - return { - encryptor: ({ plainText }: Pick) => { - const encryptedPlainTextBlob = cipher.encrypt(plainText, dataKey); - - // Buffer#1 encrypted text + Buffer#2 version number - const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3 - const cipherTextBlob = Buffer.concat([encryptedPlainTextBlob, versionBlob]); - return { cipherTextBlob }; - }, - decryptor: ({ cipherTextBlob: versionedCipherTextBlob }: Pick) => { - const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH); - const decryptedBlob = cipher.decrypt(cipherTextBlob, dataKey); - return decryptedBlob; - } - }; + const { id, slug, orgId, isExternal } = kms; + return { id, slug, orgId, isExternal }; }; const startService = async () => { @@ -762,14 +795,11 @@ export const kmsServiceFactory = ({ startService, generateKmsKey, encryptWithKmsKey, - encryptWithInputKey, decryptWithKmsKey, + encryptWithInputKey, decryptWithInputKey, getOrgKmsKeyId, getProjectSecretManagerKmsKeyId, - getOrgKmsDataKey, - getProjectSecretManagerKmsDataKey, - getProjectSecretManagerKmsKey, updateProjectSecretManagerKmsKey, getProjectKeyBackup, loadProjectKeyBackup, diff --git a/backend/src/services/kms/kms-types.ts b/backend/src/services/kms/kms-types.ts index 335c67868..dc7de10a4 100644 --- a/backend/src/services/kms/kms-types.ts +++ b/backend/src/services/kms/kms-types.ts @@ -1,5 +1,25 @@ import { Knex } from "knex"; +export enum KmsDataKey { + Organization, + SecretManager + // CertificateManager +} + +export enum KmsType { + External = "external", + Internal = "internal" +} + +export type TEncryptWithKmsDataKeyDTO = + | { type: KmsDataKey.Organization; orgId: string } + | { type: KmsDataKey.SecretManager; projectId: string }; +// akhilmhdh: not implemented yet +// | { +// type: KmsDataKey.CertificateManager; +// projectId: string; +// }; + export type TGenerateKMSDTO = { orgId: string; isReserved?: boolean; @@ -27,17 +47,7 @@ export type TDecryptWithKeyDTO = { cipherTextBlob: Buffer; }; -export enum KmsDataKey { - Organization, - SecretManager - // CertificateManager -} - -export type TEncryptWithKmsDataKeyDTO = - | { type: KmsDataKey.Organization; orgId: string } - | { type: KmsDataKey.SecretManager; projectId: string }; -// akhilmhdh: not implemented yet -// | { -// type: KmsDataKey.CertificateManager; -// projectId: string; -// }; +export type TUpdateProjectSecretManagerKmsKeyDTO = { + projectId: string; + kms: { type: KmsType.Internal } | { type: KmsType.External; kmsId: string }; +}; diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index a00c04f25..bfb7fcbab 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -650,7 +650,7 @@ export const projectServiceFactory = ({ const updateProjectKmsKey = async ({ projectId, - secretManagerKmsKeyId, + kms, actor, actorId, actorAuthMethod, @@ -666,7 +666,10 @@ export const projectServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Kms); - const secretManagerKmsKey = await kmsService.updateProjectSecretManagerKmsKey(projectId, secretManagerKmsKeyId); + const secretManagerKmsKey = await kmsService.updateProjectSecretManagerKmsKey({ + projectId, + kms + }); return { secretManagerKmsKey diff --git a/backend/src/services/project/project-types.ts b/backend/src/services/project/project-types.ts index 43156f415..1c2279c7a 100644 --- a/backend/src/services/project/project-types.ts +++ b/backend/src/services/project/project-types.ts @@ -3,6 +3,7 @@ import { TProjectPermission } from "@app/lib/types"; import { ActorAuthMethod, ActorType } from "../auth/auth-type"; import { CaStatus } from "../certificate-authority/certificate-authority-types"; +import { KmsType } from "../kms/kms-types"; export enum ProjectFilterType { ID = "id", @@ -106,7 +107,7 @@ export type TListProjectCertsDTO = { } & Omit; export type TUpdateProjectKmsDTO = { - secretManagerKmsKeyId: string; + kms: { type: KmsType.Internal } | { type: KmsType.External; kmsId: string }; } & TProjectPermission; export type TLoadProjectKmsBackupDTO = { diff --git a/frontend/src/hooks/api/kms/mutations.tsx b/frontend/src/hooks/api/kms/mutations.tsx index db2248a9e..c15ddd1d0 100644 --- a/frontend/src/hooks/api/kms/mutations.tsx +++ b/frontend/src/hooks/api/kms/mutations.tsx @@ -3,7 +3,7 @@ import { useMutation, useQueryClient } from "@tanstack/react-query"; import { apiRequest } from "@app/config/request"; import { kmsKeys } from "./queries"; -import { AddExternalKmsType } from "./types"; +import { AddExternalKmsType, KmsType } from "./types"; export const useAddExternalKms = (orgId: string) => { const queryClient = useQueryClient(); @@ -66,7 +66,9 @@ export const useRemoveExternalKms = (orgId: string) => { export const useUpdateProjectKms = (projectId: string) => { const queryClient = useQueryClient(); return useMutation({ - mutationFn: async (updatedData: { secretManagerKmsKeyId: string }) => { + mutationFn: async ( + updatedData: { type: KmsType.Internal } | { type: KmsType.External; kmsId: string } + ) => { const { data } = await apiRequest.patch(`/api/v1/workspace/${projectId}/kms`, updatedData); return data; diff --git a/frontend/src/hooks/api/kms/types.ts b/frontend/src/hooks/api/kms/types.ts index 5808a71fc..7b726e6d3 100644 --- a/frontend/src/hooks/api/kms/types.ts +++ b/frontend/src/hooks/api/kms/types.ts @@ -29,6 +29,11 @@ export type KmsListEntry = { }; }; +export enum KmsType { + Internal = "internal", + External = "external" +} + export enum ExternalKmsProvider { AWS = "aws" } diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx index 66fc5c617..b32111792 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -31,7 +31,7 @@ import { useUpdateProjectKms } from "@app/hooks/api"; import { fetchProjectKmsBackup } from "@app/hooks/api/kms/queries"; -import { INTERNAL_KMS_KEY_ID } from "@app/hooks/api/kms/types"; +import { INTERNAL_KMS_KEY_ID, KmsType } from "@app/hooks/api/kms/types"; import { Organization, Workspace } from "@app/hooks/api/types"; const formSchema = z.object({ @@ -207,7 +207,9 @@ export const EncryptionTab = () => { const { data: externalKmsList } = useGetExternalKmsList(currentOrg?.id!); const { data: activeKms } = useGetActiveProjectKms(currentWorkspace?.id!); - const { mutateAsync: updateProjectKms } = useUpdateProjectKms(currentWorkspace?.id!); + const { mutateAsync: updateProjectKms, isLoading: isUpdatingProjectKms } = useUpdateProjectKms( + currentWorkspace?.id! + ); const { popUp, handlePopUpToggle, handlePopUpOpen } = usePopUp([ "createBackupConfirmation", "loadBackup" @@ -239,9 +241,11 @@ export const EncryptionTab = () => { const onUpdateProjectKms = async (data: TForm) => { try { - await updateProjectKms({ - secretManagerKmsKeyId: data.kmsKeyId - }); + await updateProjectKms( + data.kmsKeyId === INTERNAL_KMS_KEY_ID + ? { type: KmsType.Internal } + : { type: KmsType.External, kmsId: data.kmsKeyId } + ); createNotification({ text: "Successfully updated project KMS", @@ -287,10 +291,9 @@ export const EncryptionTab = () => { - - Default Infisical KMS - - {externalKmsList?.map((kms) => ( - - {kms.slug} +
+ + {(isAllowed) => ( + ( + + - - )} - control={control} - name="kmsKeyId" - /> - )} - + {externalKmsList?.map((kms) => ( + + {kms.slug} + + ))} + + + )} + control={control} + name="kmsKeyId" + /> + )} + +
{(isAllowed) => ( @@ -357,6 +344,6 @@ export const EncryptionTab = () => { org={currentOrg} workspace={currentWorkspace} /> - +
); }; From 5c8d6157d74216559d4241ab938e0c754aaefe7b Mon Sep 17 00:00:00 2001 From: = Date: Tue, 30 Jul 2024 00:31:42 +0530 Subject: [PATCH 70/77] feat: added logic for webhook and dynamic secret to use the kms encryption --- .../db/migrations/20240716105646_secret-v2.ts | 43 ++++++- backend/src/db/schemas/dynamic-secrets.ts | 15 ++- backend/src/db/schemas/integration-auths.ts | 1 - backend/src/db/schemas/webhooks.ts | 6 +- .../dynamic-secret-lease-dal.ts | 4 +- .../dynamic-secret-lease-queue.ts | 73 +++++++++-- .../dynamic-secret-lease-service.ts | 76 ++++++++---- .../dynamic-secret/dynamic-secret-service.ts | 90 ++++++++++---- backend/src/queue/queue-service.ts | 1 + backend/src/server/routes/index.ts | 16 ++- .../integration-auth-service.ts | 2 +- backend/src/services/secret/secret-queue.ts | 114 +++++++++++++++++- backend/src/services/webhook/webhook-dal.ts | 2 +- backend/src/services/webhook/webhook-fns.ts | 82 +++++++------ .../src/services/webhook/webhook-service.ts | 83 ++++++++++--- 15 files changed, 471 insertions(+), 137 deletions(-) diff --git a/backend/src/db/migrations/20240716105646_secret-v2.ts b/backend/src/db/migrations/20240716105646_secret-v2.ts index 020c46b78..84a151586 100644 --- a/backend/src/db/migrations/20240716105646_secret-v2.ts +++ b/backend/src/db/migrations/20240716105646_secret-v2.ts @@ -1,6 +1,6 @@ import { Knex } from "knex"; -import { SecretType, TableName } from "../schemas"; +import { SecretEncryptionAlgo, SecretKeyEncoding, SecretType, TableName } from "../schemas"; import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils"; export async function up(knex: Knex): Promise { @@ -143,6 +143,32 @@ export async function up(knex: Knex): Promise { t.foreign("rotationId").references("id").inTable(TableName.SecretRotation).onDelete("CASCADE"); }); } + + if (await knex.schema.hasTable(TableName.Webhook)) { + const hasEncryptedWebhookSecretKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKeyWithKms"); + const hasEncryptedWebhookUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl"); + await knex.schema.alterTable(TableName.Webhook, (t) => { + if (!hasEncryptedWebhookSecretKey) t.binary("encryptedSecretKeyWithKms"); + if (!hasEncryptedWebhookUrl) t.binary("encryptedUrl"); + }); + } + + if (await knex.schema.hasTable(TableName.DynamicSecret)) { + const hasInputIV = await knex.schema.hasColumn(TableName.DynamicSecret, "inputIV"); + const hasInputCipherText = await knex.schema.hasColumn(TableName.DynamicSecret, "inputCiphertext"); + const hasInputTag = await knex.schema.hasColumn(TableName.DynamicSecret, "inputTag"); + const hasAlgorithm = await knex.schema.hasColumn(TableName.DynamicSecret, "algorithm"); + const hasKeyEncoding = await knex.schema.hasColumn(TableName.DynamicSecret, "keyEncoding"); + const hasEncryptedConfig = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedConfig"); + await knex.schema.alterTable(TableName.DynamicSecret, (t) => { + if (hasInputIV) t.string("inputIV").alter(); + if (hasInputCipherText) t.text("inputCiphertext").alter(); + if (hasInputTag) t.string("inputTag").alter(); + if (hasAlgorithm) t.string("algorithm").defaultTo(SecretEncryptionAlgo.AES_256_GCM).alter(); + if (hasKeyEncoding) t.string("keyEncoding").defaultTo(SecretKeyEncoding.UTF8).alter(); + if (!hasEncryptedConfig) t.binary("encryptedConfig"); + }); + } } export async function down(knex: Knex): Promise { @@ -177,4 +203,19 @@ export async function down(knex: Knex): Promise { if (hasEncryptedAwsIamAssumRole) t.dropColumn("encryptedAwsAssumeIamRoleArn"); }); } + if (await knex.schema.hasTable(TableName.Webhook)) { + const hasEncryptedWebhookSecretKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKeyWithKms"); + const hasEncryptedWebhookUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl"); + await knex.schema.alterTable(TableName.Webhook, (t) => { + if (hasEncryptedWebhookSecretKey) t.dropColumn("encryptedSecretKeyWithKms"); + if (hasEncryptedWebhookUrl) t.dropColumn("encryptedUrl"); + }); + } + + if (await knex.schema.hasTable(TableName.DynamicSecret)) { + const hasEncryptedConfig = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedConfig"); + await knex.schema.alterTable(TableName.DynamicSecret, (t) => { + if (hasEncryptedConfig) t.dropColumn("encryptedConfig"); + }); + } } diff --git a/backend/src/db/schemas/dynamic-secrets.ts b/backend/src/db/schemas/dynamic-secrets.ts index b27da396c..83c4e308d 100644 --- a/backend/src/db/schemas/dynamic-secrets.ts +++ b/backend/src/db/schemas/dynamic-secrets.ts @@ -5,6 +5,8 @@ import { z } from "zod"; +import { zodBuffer } from "@app/lib/zod"; + import { TImmutableDBKeys } from "./models"; export const DynamicSecretsSchema = z.object({ @@ -14,16 +16,17 @@ export const DynamicSecretsSchema = z.object({ type: z.string(), defaultTTL: z.string(), maxTTL: z.string().nullable().optional(), - inputIV: z.string(), - inputCiphertext: z.string(), - inputTag: z.string(), - algorithm: z.string().default("aes-256-gcm"), - keyEncoding: z.string().default("utf8"), + inputIV: z.string().nullable().optional(), + inputCiphertext: z.string().nullable().optional(), + inputTag: z.string().nullable().optional(), + algorithm: z.string().default("aes-256-gcm").nullable().optional(), + keyEncoding: z.string().default("utf8").nullable().optional(), folderId: z.string().uuid(), status: z.string().nullable().optional(), statusDetails: z.string().nullable().optional(), createdAt: z.date(), - updatedAt: z.date() + updatedAt: z.date(), + encryptedConfig: zodBuffer.nullable().optional() }); export type TDynamicSecrets = z.infer; diff --git a/backend/src/db/schemas/integration-auths.ts b/backend/src/db/schemas/integration-auths.ts index 1e38c2139..85368eff7 100644 --- a/backend/src/db/schemas/integration-auths.ts +++ b/backend/src/db/schemas/integration-auths.ts @@ -35,7 +35,6 @@ export const IntegrationAuthsSchema = z.object({ awsAssumeIamRoleArnCipherText: z.string().nullable().optional(), awsAssumeIamRoleArnIV: z.string().nullable().optional(), awsAssumeIamRoleArnTag: z.string().nullable().optional(), - encryptedAwsIamAssumRole: zodBuffer.nullable().optional(), encryptedAccess: zodBuffer.nullable().optional(), encryptedAccessId: zodBuffer.nullable().optional(), encryptedRefresh: zodBuffer.nullable().optional(), diff --git a/backend/src/db/schemas/webhooks.ts b/backend/src/db/schemas/webhooks.ts index a7aac2933..084d72e8e 100644 --- a/backend/src/db/schemas/webhooks.ts +++ b/backend/src/db/schemas/webhooks.ts @@ -5,6 +5,8 @@ import { z } from "zod"; +import { zodBuffer } from "@app/lib/zod"; + import { TImmutableDBKeys } from "./models"; export const WebhooksSchema = z.object({ @@ -25,7 +27,9 @@ export const WebhooksSchema = z.object({ urlCipherText: z.string().nullable().optional(), urlIV: z.string().nullable().optional(), urlTag: z.string().nullable().optional(), - type: z.string().default("general").nullable().optional() + type: z.string().default("general").nullable().optional(), + encryptedSecretKeyWithKms: zodBuffer.nullable().optional(), + encryptedUrl: zodBuffer.nullable().optional() }); export type TWebhooks = z.infer; diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts index 339b2d626..7463d3b9e 100644 --- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts +++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts @@ -48,6 +48,7 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => { db.ref("folderId").withSchema(TableName.DynamicSecret).as("dynFolderId"), db.ref("status").withSchema(TableName.DynamicSecret).as("dynStatus"), db.ref("statusDetails").withSchema(TableName.DynamicSecret).as("dynStatusDetails"), + db.ref("encryptedConfig").withSchema(TableName.DynamicSecret).as("dynEncryptedConfig"), db.ref("createdAt").withSchema(TableName.DynamicSecret).as("dynCreatedAt"), db.ref("updatedAt").withSchema(TableName.DynamicSecret).as("dynUpdatedAt") ); @@ -71,7 +72,8 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => { status: doc.dynStatus, statusDetails: doc.dynStatusDetails, createdAt: doc.dynCreatedAt, - updatedAt: doc.dynUpdatedAt + updatedAt: doc.dynUpdatedAt, + encryptedConfig: doc.dynEncryptedConfig } }; } catch (error) { diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts index 9bdb1c24e..44134f92d 100644 --- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts +++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts @@ -1,8 +1,12 @@ import { SecretKeyEncoding } from "@app/db/schemas"; import { DisableRotationErrors } from "@app/ee/services/secret-rotation/secret-rotation-queue"; import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; +import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; +import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; import { TDynamicSecretDALFactory } from "../dynamic-secret/dynamic-secret-dal"; import { DynamicSecretStatus } from "../dynamic-secret/dynamic-secret-types"; @@ -14,6 +18,8 @@ type TDynamicSecretLeaseQueueServiceFactoryDep = { dynamicSecretLeaseDAL: Pick; dynamicSecretDAL: Pick; dynamicSecretProviders: Record; + kmsService: Pick; + folderDAL: Pick; }; export type TDynamicSecretLeaseQueueServiceFactory = ReturnType; @@ -22,7 +28,9 @@ export const dynamicSecretLeaseQueueServiceFactory = ({ queueService, dynamicSecretDAL, dynamicSecretProviders, - dynamicSecretLeaseDAL + dynamicSecretLeaseDAL, + kmsService, + folderDAL }: TDynamicSecretLeaseQueueServiceFactoryDep) => { const pruneDynamicSecret = async (dynamicSecretCfgId: string) => { await queueService.queue( @@ -77,15 +85,38 @@ export const dynamicSecretLeaseQueueServiceFactory = ({ if (!dynamicSecretLease) throw new DisableRotationErrors({ message: "Dynamic secret lease not found" }); const dynamicSecretCfg = dynamicSecretLease.dynamicSecret; - const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; - const decryptedStoredInput = JSON.parse( - infisicalSymmetricDecrypt({ + const folder = await folderDAL.findById(dynamicSecretCfg.folderId); + if (!folder) throw new DisableRotationErrors({ message: "Folder not found" }); + const { projectId } = folder; + + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + + let dynamicSecretInputConfig = ""; + if ( + dynamicSecretCfg.keyEncoding && + dynamicSecretCfg.inputCiphertext && + dynamicSecretCfg.inputTag && + dynamicSecretCfg.inputIV + ) { + dynamicSecretInputConfig = infisicalSymmetricDecrypt({ keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, ciphertext: dynamicSecretCfg.inputCiphertext, tag: dynamicSecretCfg.inputTag, iv: dynamicSecretCfg.inputIV - }) - ) as object; + }); + } else if (dynamicSecretCfg.encryptedConfig) { + dynamicSecretInputConfig = secretManagerDecryptor({ + cipherTextBlob: dynamicSecretCfg.encryptedConfig + }).toString(); + } else { + throw new BadRequestError({ message: "Missing secret input config" }); + } + + const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; + const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object; await selectedProvider.revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId); await dynamicSecretLeaseDAL.deleteById(dynamicSecretLease.id); @@ -100,17 +131,39 @@ export const dynamicSecretLeaseQueueServiceFactory = ({ if ((dynamicSecretCfg.status as DynamicSecretStatus) !== DynamicSecretStatus.Deleting) throw new DisableRotationErrors({ message: "Document not deleted" }); + const folder = await folderDAL.findById(dynamicSecretCfg.folderId); + if (!folder) throw new DisableRotationErrors({ message: "Folder not found" }); + const { projectId } = folder; + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + const dynamicSecretLeases = await dynamicSecretLeaseDAL.find({ dynamicSecretId: dynamicSecretCfgId }); if (dynamicSecretLeases.length) { const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; - const decryptedStoredInput = JSON.parse( - infisicalSymmetricDecrypt({ + let dynamicSecretInputConfig = ""; + + if ( + dynamicSecretCfg.keyEncoding && + dynamicSecretCfg.inputCiphertext && + dynamicSecretCfg.inputTag && + dynamicSecretCfg.inputIV + ) { + dynamicSecretInputConfig = infisicalSymmetricDecrypt({ keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, ciphertext: dynamicSecretCfg.inputCiphertext, tag: dynamicSecretCfg.inputTag, iv: dynamicSecretCfg.inputIV - }) - ) as object; + }); + } else if (dynamicSecretCfg.encryptedConfig) { + dynamicSecretInputConfig = secretManagerDecryptor({ + cipherTextBlob: dynamicSecretCfg.encryptedConfig + }).toString(); + } else { + throw new BadRequestError({ message: "Missing secret input config" }); + } + const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object; await Promise.all(dynamicSecretLeases.map(({ id }) => unsetLeaseRevocation(id))); await Promise.all( diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts index 1e5487d22..d85b69006 100644 --- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts +++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts @@ -1,7 +1,7 @@ import { ForbiddenError, subject } from "@casl/ability"; import ms from "ms"; -import { SecretKeyEncoding } from "@app/db/schemas"; +import { SecretKeyEncoding, TDynamicSecrets } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; @@ -9,6 +9,8 @@ import { getConfig } from "@app/lib/config/env"; import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; @@ -34,6 +36,7 @@ type TDynamicSecretLeaseServiceFactoryDep = { folderDAL: Pick; permissionService: Pick; projectDAL: Pick; + kmsService: Pick; }; export type TDynamicSecretLeaseServiceFactory = ReturnType; @@ -46,8 +49,32 @@ export const dynamicSecretLeaseServiceFactory = ({ permissionService, dynamicSecretQueueService, projectDAL, - licenseService + licenseService, + kmsService }: TDynamicSecretLeaseServiceFactoryDep) => { + const $getDynamicSecretInputConfig = (dynamicSecretCfg: TDynamicSecrets, decryptValue: (arg: Buffer) => string) => { + if ( + dynamicSecretCfg.keyEncoding && + dynamicSecretCfg.inputCiphertext && + dynamicSecretCfg.inputTag && + dynamicSecretCfg.inputIV + ) { + return JSON.parse( + infisicalSymmetricDecrypt({ + keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, + ciphertext: dynamicSecretCfg.inputCiphertext, + tag: dynamicSecretCfg.inputTag, + iv: dynamicSecretCfg.inputIV + }) + ) as object; + } + if (dynamicSecretCfg.encryptedConfig) { + return JSON.parse(decryptValue(dynamicSecretCfg.encryptedConfig)) as object; + } + + throw new BadRequestError({ message: "Missing secret input config" }); + }; + const create = async ({ environmentSlug, path, @@ -94,14 +121,13 @@ export const dynamicSecretLeaseServiceFactory = ({ throw new BadRequestError({ message: `Max lease limit reached. Limit: ${appCfg.MAX_LEASE_LIMIT}` }); const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; - const decryptedStoredInput = JSON.parse( - infisicalSymmetricDecrypt({ - keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, - ciphertext: dynamicSecretCfg.inputCiphertext, - tag: dynamicSecretCfg.inputTag, - iv: dynamicSecretCfg.inputIV - }) - ) as object; + const { decryptor: kmsDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) => + kmsDecryptor({ cipherTextBlob: value }).toString() + ); const selectedTTL = ttl ?? dynamicSecretCfg.defaultTTL; const { maxTTL } = dynamicSecretCfg; @@ -164,14 +190,13 @@ export const dynamicSecretLeaseServiceFactory = ({ const dynamicSecretCfg = dynamicSecretLease.dynamicSecret; const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; - const decryptedStoredInput = JSON.parse( - infisicalSymmetricDecrypt({ - keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, - ciphertext: dynamicSecretCfg.inputCiphertext, - tag: dynamicSecretCfg.inputTag, - iv: dynamicSecretCfg.inputIV - }) - ) as object; + const { decryptor: kmsDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) => + kmsDecryptor({ cipherTextBlob: value }).toString() + ); const selectedTTL = ttl ?? dynamicSecretCfg.defaultTTL; const { maxTTL } = dynamicSecretCfg; @@ -231,14 +256,13 @@ export const dynamicSecretLeaseServiceFactory = ({ const dynamicSecretCfg = dynamicSecretLease.dynamicSecret; const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; - const decryptedStoredInput = JSON.parse( - infisicalSymmetricDecrypt({ - keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, - ciphertext: dynamicSecretCfg.inputCiphertext, - tag: dynamicSecretCfg.inputTag, - iv: dynamicSecretCfg.inputIV - }) - ) as object; + const { decryptor: kmsDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) => + kmsDecryptor({ cipherTextBlob: value }).toString() + ); const revokeResponse = await selectedProvider .revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId) diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts index 1aef3cc86..f25a79c35 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts @@ -4,8 +4,10 @@ import { SecretKeyEncoding } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; -import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; +import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { KmsDataKey } from "@app/services/kms/kms-types"; import { TProjectDALFactory } from "@app/services/project/project-dal"; import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal"; @@ -34,6 +36,7 @@ type TDynamicSecretServiceFactoryDep = { folderDAL: Pick; projectDAL: Pick; permissionService: Pick; + kmsService: Pick; }; export type TDynamicSecretServiceFactory = ReturnType; @@ -46,7 +49,8 @@ export const dynamicSecretServiceFactory = ({ dynamicSecretProviders, permissionService, dynamicSecretQueueService, - projectDAL + projectDAL, + kmsService }: TDynamicSecretServiceFactoryDep) => { const create = async ({ path, @@ -96,16 +100,16 @@ export const dynamicSecretServiceFactory = ({ const isConnected = await selectedProvider.validateConnection(provider.inputs); if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" }); + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); - const encryptedInput = infisicalSymmetricEncypt(JSON.stringify(inputs)); + const encryptedConfig = secretManagerEncryptor({ plainText: Buffer.from(JSON.stringify(inputs)) }).cipherTextBlob; const dynamicSecretCfg = await dynamicSecretDAL.create({ type: provider.type, version: 1, - inputIV: encryptedInput.iv, - inputTag: encryptedInput.tag, - inputCiphertext: encryptedInput.ciphertext, - algorithm: encryptedInput.algorithm, - keyEncoding: encryptedInput.encoding, + encryptedConfig, maxTTL, defaultTTL, folderId: folder.id, @@ -164,28 +168,51 @@ export const dynamicSecretServiceFactory = ({ throw new BadRequestError({ message: "Provided dynamic secret already exist under the folder" }); } + let dynamicSecretInputConfig = ""; const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; - const decryptedStoredInput = JSON.parse( - infisicalSymmetricDecrypt({ + const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } = + await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + if ( + dynamicSecretCfg.keyEncoding && + dynamicSecretCfg.inputCiphertext && + dynamicSecretCfg.inputTag && + dynamicSecretCfg.inputIV + ) { + dynamicSecretInputConfig = infisicalSymmetricDecrypt({ keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, ciphertext: dynamicSecretCfg.inputCiphertext, tag: dynamicSecretCfg.inputTag, iv: dynamicSecretCfg.inputIV - }) - ) as object; + }); + } else if (dynamicSecretCfg.encryptedConfig) { + dynamicSecretInputConfig = secretManagerDecryptor({ + cipherTextBlob: dynamicSecretCfg.encryptedConfig + }).toString(); + } else { + throw new BadRequestError({ message: "Missing secret input config" }); + } + + const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object; const newInput = { ...decryptedStoredInput, ...(inputs || {}) }; const updatedInput = await selectedProvider.validateProviderInputs(newInput); const isConnected = await selectedProvider.validateConnection(newInput); if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" }); - const encryptedInput = infisicalSymmetricEncypt(JSON.stringify(updatedInput)); + const encryptedConfig = secretManagerEncryptor({ + plainText: Buffer.from(JSON.stringify(updatedInput)) + }).cipherTextBlob; + const updatedDynamicCfg = await dynamicSecretDAL.updateById(dynamicSecretCfg.id, { - inputIV: encryptedInput.iv, - inputTag: encryptedInput.tag, - inputCiphertext: encryptedInput.ciphertext, - algorithm: encryptedInput.algorithm, - keyEncoding: encryptedInput.encoding, + encryptedConfig, + inputIV: null, + inputTag: null, + keyEncoding: null, + algorithm: null, + inputCiphertext: null, maxTTL, defaultTTL, name: newName ?? name, @@ -286,14 +313,33 @@ export const dynamicSecretServiceFactory = ({ const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id }); if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" }); - const decryptedStoredInput = JSON.parse( - infisicalSymmetricDecrypt({ + const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); + + let dynamicSecretInputConfig = ""; + if ( + dynamicSecretCfg.keyEncoding && + dynamicSecretCfg.inputCiphertext && + dynamicSecretCfg.inputTag && + dynamicSecretCfg.inputIV + ) { + dynamicSecretInputConfig = infisicalSymmetricDecrypt({ keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, ciphertext: dynamicSecretCfg.inputCiphertext, tag: dynamicSecretCfg.inputTag, iv: dynamicSecretCfg.inputIV - }) - ) as object; + }); + } else if (dynamicSecretCfg.encryptedConfig) { + dynamicSecretInputConfig = secretManagerDecryptor({ + cipherTextBlob: dynamicSecretCfg.encryptedConfig + }).toString(); + } else { + throw new BadRequestError({ message: "Missing secret input config" }); + } + + const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object; const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; const providerInputs = (await selectedProvider.validateProviderInputs(decryptedStoredInput)) as object; return { ...dynamicSecretCfg, inputs: providerInputs }; diff --git a/backend/src/queue/queue-service.ts b/backend/src/queue/queue-service.ts index 1f58dfec3..ec222f0fa 100644 --- a/backend/src/queue/queue-service.ts +++ b/backend/src/queue/queue-service.ts @@ -216,6 +216,7 @@ export const queueServiceFactory = (redisUrl: string) => { const job = await q.getJob(jobId); if (!job) return true; if (!job.repeatJobKey) return true; + await job.remove(); return q.removeRepeatableByKey(job.repeatJobKey); }; diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 023e13000..9b90ccbab 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -677,7 +677,8 @@ export const registerRoutes = async ( permissionService, webhookDAL, projectEnvDAL, - projectDAL + projectDAL, + kmsService }); const secretTagService = secretTagServiceFactory({ secretTagDAL, permissionService }); @@ -724,7 +725,8 @@ export const registerRoutes = async ( integrationAuthDAL, snapshotDAL, snapshotSecretV2BridgeDAL, - secretApprovalRequestDAL + secretApprovalRequestDAL, + dynamicSecretDAL }); const secretImportService = secretImportServiceFactory({ licenseService, @@ -987,7 +989,9 @@ export const registerRoutes = async ( queueService, dynamicSecretLeaseDAL, dynamicSecretProviders, - dynamicSecretDAL + dynamicSecretDAL, + kmsService, + folderDAL }); const dynamicSecretService = dynamicSecretServiceFactory({ projectDAL, @@ -997,7 +1001,8 @@ export const registerRoutes = async ( dynamicSecretProviders, folderDAL, permissionService, - licenseService + licenseService, + kmsService }); const dynamicSecretLeaseService = dynamicSecretLeaseServiceFactory({ projectDAL, @@ -1007,7 +1012,8 @@ export const registerRoutes = async ( dynamicSecretLeaseDAL, dynamicSecretProviders, folderDAL, - licenseService + licenseService, + kmsService }); const dailyResourceCleanUp = dailyResourceCleanUpQueueServiceFactory({ auditLogDAL, diff --git a/backend/src/services/integration-auth/integration-auth-service.ts b/backend/src/services/integration-auth/integration-auth-service.ts index 5ffed26d2..e16f6bb77 100644 --- a/backend/src/services/integration-auth/integration-auth-service.ts +++ b/backend/src/services/integration-auth/integration-auth-service.ts @@ -269,7 +269,7 @@ export const integrationAuthServiceFactory = ({ const awsAssumeIamRoleArnEncrypted = secretManagerEncryptor({ plainText: Buffer.from(awsAssumeIamRoleArn) }).cipherTextBlob; - updateDoc.encryptedAwsIamAssumRole = awsAssumeIamRoleArnEncrypted; + updateDoc.encryptedAwsAssumeIamRoleArn = awsAssumeIamRoleArnEncrypted; } } } else { diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts index 0fbce0964..a682a0bcd 100644 --- a/backend/src/services/secret/secret-queue.ts +++ b/backend/src/services/secret/secret-queue.ts @@ -1,13 +1,21 @@ /* eslint-disable no-await-in-loop */ import { AxiosError } from "axios"; -import { ProjectUpgradeStatus, ProjectVersion, TSecretSnapshotSecretsV2, TSecretVersionsV2 } from "@app/db/schemas"; +import { + ProjectUpgradeStatus, + ProjectVersion, + SecretKeyEncoding, + TSecretSnapshotSecretsV2, + TSecretVersionsV2 +} from "@app/db/schemas"; +import { TDynamicSecretDALFactory } from "@app/ee/services/dynamic-secret/dynamic-secret-dal"; import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal"; import { TSecretRotationDALFactory } from "@app/ee/services/secret-rotation/secret-rotation-dal"; import { TSnapshotDALFactory } from "@app/ee/services/secret-snapshot/snapshot-dal"; import { TSnapshotSecretV2DALFactory } from "@app/ee/services/secret-snapshot/snapshot-secret-v2-dal"; import { getConfig } from "@app/lib/config/env"; import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; +import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { daysToMillisecond, secondsToMillis } from "@app/lib/dates"; import { BadRequestError } from "@app/lib/errors"; import { groupBy, isSamePath, unique } from "@app/lib/fn"; @@ -60,7 +68,7 @@ type TSecretQueueFactoryDep = { folderDAL: TSecretFolderDALFactory; secretDAL: TSecretDALFactory; secretImportDAL: Pick; - webhookDAL: Pick; + webhookDAL: Pick; projectEnvDAL: Pick; projectDAL: TProjectDALFactory; projectBotDAL: TProjectBotDALFactory; @@ -79,6 +87,7 @@ type TSecretQueueFactoryDep = { secretApprovalRequestDAL: Pick; snapshotDAL: Pick; snapshotSecretV2BridgeDAL: Pick; + dynamicSecretDAL: Pick; }; export type TGetSecrets = { @@ -122,7 +131,8 @@ export const secretQueueFactory = ({ secretRotationDAL, snapshotDAL, snapshotSecretV2BridgeDAL, - secretApprovalRequestDAL + secretApprovalRequestDAL, + dynamicSecretDAL }: TSecretQueueFactoryDep) => { const removeSecretReminder = async (dto: TRemoveSecretReminderDTO) => { const appCfg = getConfig(); @@ -881,6 +891,37 @@ export const secretQueueFactory = ({ await secretV2BridgeDAL.upsertSecretReferences(secretReferences, tx); } + const dynamicSecrets = await dynamicSecretDAL.find({ folderId }, { tx }); + if (dynamicSecrets.length) { + await dynamicSecretDAL.upsert( + dynamicSecrets.map((el) => { + let { encryptedConfig } = el; + if (!encryptedConfig) { + if (el.keyEncoding && el.inputCiphertext && el.inputTag && el.inputIV) { + const decryptedConfig = infisicalSymmetricDecrypt({ + keyEncoding: el.keyEncoding as SecretKeyEncoding, + ciphertext: el.inputCiphertext, + tag: el.inputTag, + iv: el.inputIV + }); + encryptedConfig = secretManagerEncryptor({ plainText: Buffer.from(decryptedConfig) }).cipherTextBlob; + } + } + return { + ...el, + encryptedConfig, + keyEncoding: null, + inputCiphertext: null, + inputTag: null, + inputIV: null, + algorithm: null + }; + }), + "id", + tx + ); + } + const SNAPSHOT_BATCH_SIZE = 15; const snapshots = await snapshotDAL.findNSecretV1SnapshotByFolderId(folderId, SNAPSHOT_BATCH_SIZE, tx); const projectV3SecretVersionsGroupById: Record = {}; @@ -1110,6 +1151,71 @@ export const secretQueueFactory = ({ tx ); + /* + * webhooks + * */ + const projectV1Webhooks = await webhookDAL.find({ projectId }, tx); + if (projectV1Webhooks.length) { + await webhookDAL.upsert( + projectV1Webhooks.map((el) => { + let { encryptedSecretKeyWithKms, encryptedUrl } = el; + if (!encryptedSecretKeyWithKms) { + if (el.encryptedSecretKey && el.iv && el.tag) { + const webhookSecretKey = infisicalSymmetricDecrypt({ + keyEncoding: el.keyEncoding as SecretKeyEncoding, + ciphertext: el.encryptedSecretKey, + iv: el.iv, + tag: el.tag + }); + encryptedSecretKeyWithKms = secretManagerEncryptor({ + plainText: Buffer.from(webhookSecretKey) + }).cipherTextBlob; + } + } + if (!encryptedUrl) { + if (el.urlTag && el.urlCipherText && el.urlIV) { + const webhookUrl = infisicalSymmetricDecrypt({ + keyEncoding: el.keyEncoding as SecretKeyEncoding, + ciphertext: el.urlCipherText, + iv: el.urlIV, + tag: el.urlTag + }); + encryptedUrl = secretManagerEncryptor({ + plainText: Buffer.from(webhookUrl) + }).cipherTextBlob; + } else { + encryptedUrl = secretManagerEncryptor({ + plainText: Buffer.from(el.url) + }).cipherTextBlob; + } + } + + return { + id: el.id, + url: el.url, + envId: el.envId, + type: el.type, + isDisabled: el.isDisabled, + lastStatus: el.lastStatus, + secretPath: el.secretPath, + lastRunErrorMessage: el.lastRunErrorMessage, + encryptedSecretKeyWithKms, + encryptedUrl, + urlCipherText: null, + urlIV: null, + urlTag: null, + encryptedSecretKey: null, + iv: null, + tag: null, + keyEncoding: null, + algorithm: null + }; + }), + "id", + tx + ); + } + /* * approvals: we will delete all approvals this is because some secret versions may not be added yet * Thus doesn't make sense for rest to be there @@ -1193,7 +1299,7 @@ export const secretQueueFactory = ({ }); queueService.start(QueueName.SecretWebhook, async (job) => { - await fnTriggerWebhook({ ...job.data, projectEnvDAL, webhookDAL, projectDAL }); + await fnTriggerWebhook({ ...job.data, projectEnvDAL, webhookDAL, projectDAL, kmsService }); }); return { diff --git a/backend/src/services/webhook/webhook-dal.ts b/backend/src/services/webhook/webhook-dal.ts index 14d30a35e..ba2745737 100644 --- a/backend/src/services/webhook/webhook-dal.ts +++ b/backend/src/services/webhook/webhook-dal.ts @@ -20,7 +20,7 @@ export const webhookDALFactory = (db: TDbClient) => { .select(tx.ref("projectId").withSchema(TableName.Environment)) .select(selectAllTableCols(TableName.Webhook)); - const find = async (filter: Partial, tx?: Knex) => { + const find = async (filter: Partial, tx?: Knex) => { try { const docs = await webhookFindQuery(tx || db.replicaNode(), filter); return docs.map(({ envId, envSlug, envName, ...el }) => ({ diff --git a/backend/src/services/webhook/webhook-fns.ts b/backend/src/services/webhook/webhook-fns.ts index 4690edba9..32476fe9a 100644 --- a/backend/src/services/webhook/webhook-fns.ts +++ b/backend/src/services/webhook/webhook-fns.ts @@ -3,12 +3,14 @@ import crypto from "node:crypto"; import { AxiosError } from "axios"; import picomatch from "picomatch"; -import { SecretKeyEncoding, TWebhooks } from "@app/db/schemas"; +import { SecretKeyEncoding } from "@app/db/schemas"; import { request } from "@app/lib/config/request"; import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; +import { TKmsServiceFactory } from "../kms/kms-service"; +import { KmsDataKey } from "../kms/kms-types"; import { TProjectDALFactory } from "../project/project-dal"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TWebhookDALFactory } from "./webhook-dal"; @@ -16,40 +18,12 @@ import { WebhookType } from "./webhook-types"; const WEBHOOK_TRIGGER_TIMEOUT = 15 * 1000; -export const decryptWebhookDetails = (webhook: TWebhooks) => { - const { keyEncoding, iv, encryptedSecretKey, tag, urlCipherText, urlIV, urlTag, url } = webhook; - - let decryptedSecretKey = ""; - let decryptedUrl = url; - - if (encryptedSecretKey) { - decryptedSecretKey = infisicalSymmetricDecrypt({ - keyEncoding: keyEncoding as SecretKeyEncoding, - ciphertext: encryptedSecretKey, - iv: iv as string, - tag: tag as string - }); - } - - if (urlCipherText) { - decryptedUrl = infisicalSymmetricDecrypt({ - keyEncoding: keyEncoding as SecretKeyEncoding, - ciphertext: urlCipherText, - iv: urlIV as string, - tag: urlTag as string - }); - } - - return { - secretKey: decryptedSecretKey, - url: decryptedUrl - }; -}; - -export const triggerWebhookRequest = async (webhook: TWebhooks, data: Record) => { +export const triggerWebhookRequest = async ( + { webhookSecretKey: secretKey, webhookUrl: url }: { webhookSecretKey?: string; webhookUrl: string }, + data: Record +) => { const headers: Record = {}; const payload = { ...data, timestamp: Date.now() }; - const { secretKey, url } = decryptWebhookDetails(webhook); if (secretKey) { const webhookSign = crypto.createHmac("sha256", secretKey).update(JSON.stringify(payload)).digest("hex"); @@ -124,6 +98,7 @@ export type TFnTriggerWebhookDTO = { webhookDAL: Pick; projectEnvDAL: Pick; projectDAL: Pick; + kmsService: Pick; }; // this is reusable function @@ -134,7 +109,8 @@ export const fnTriggerWebhook = async ({ projectId, webhookDAL, projectEnvDAL, - projectDAL + projectDAL, + kmsService }: TFnTriggerWebhookDTO) => { const webhooks = await webhookDAL.findAllWebhooks(projectId, environment); const toBeTriggeredHooks = webhooks.filter( @@ -144,10 +120,38 @@ export const fnTriggerWebhook = async ({ if (!toBeTriggeredHooks.length) return; logger.info("Secret webhook job started", { environment, secretPath, projectId }); const project = await projectDAL.findById(projectId); + const { decryptor: kmsDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({ + projectId, + type: KmsDataKey.SecretManager + }); + const webhooksTriggered = await Promise.allSettled( - toBeTriggeredHooks.map((hook) => - triggerWebhookRequest( - hook, + toBeTriggeredHooks.map((hook) => { + let webhookUrl = hook.url; + let webhookSecretKey; + if (hook.urlTag && hook.urlCipherText && hook.urlIV) { + webhookUrl = infisicalSymmetricDecrypt({ + keyEncoding: hook.keyEncoding as SecretKeyEncoding, + ciphertext: hook.urlCipherText, + iv: hook.urlIV, + tag: hook.urlTag + }); + } else if (hook.encryptedUrl) { + webhookUrl = kmsDataKeyDecryptor({ cipherTextBlob: hook.encryptedUrl }).toString(); + } + if (hook.encryptedSecretKey && hook.iv && hook.tag) { + webhookSecretKey = infisicalSymmetricDecrypt({ + keyEncoding: hook.keyEncoding as SecretKeyEncoding, + ciphertext: hook.encryptedSecretKey, + iv: hook.iv, + tag: hook.tag + }); + } else if (hook.encryptedSecretKeyWithKms) { + webhookSecretKey = kmsDataKeyDecryptor({ cipherTextBlob: hook.encryptedSecretKeyWithKms }).toString(); + } + + return triggerWebhookRequest( + { webhookUrl, webhookSecretKey }, getWebhookPayload("secrets.modified", { workspaceName: project.name, workspaceId: projectId, @@ -155,8 +159,8 @@ export const fnTriggerWebhook = async ({ secretPath, type: hook.type }) - ) - ) + ); + }) ); // filter hooks by status diff --git a/backend/src/services/webhook/webhook-service.ts b/backend/src/services/webhook/webhook-service.ts index 41dacd34b..84b4baadf 100644 --- a/backend/src/services/webhook/webhook-service.ts +++ b/backend/src/services/webhook/webhook-service.ts @@ -1,15 +1,17 @@ import { ForbiddenError } from "@casl/ability"; -import { TWebhooksInsert } from "@app/db/schemas"; +import { SecretKeyEncoding, TWebhooksInsert } from "@app/db/schemas"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; -import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption"; +import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; +import { TKmsServiceFactory } from "../kms/kms-service"; +import { KmsDataKey } from "../kms/kms-types"; import { TProjectDALFactory } from "../project/project-dal"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { TWebhookDALFactory } from "./webhook-dal"; -import { decryptWebhookDetails, getWebhookPayload, triggerWebhookRequest } from "./webhook-fns"; +import { getWebhookPayload, triggerWebhookRequest } from "./webhook-fns"; import { TCreateWebhookDTO, TDeleteWebhookDTO, @@ -23,6 +25,7 @@ type TWebhookServiceFactoryDep = { projectEnvDAL: TProjectEnvDALFactory; projectDAL: Pick; permissionService: Pick; + kmsService: Pick; }; export type TWebhookServiceFactory = ReturnType; @@ -31,7 +34,8 @@ export const webhookServiceFactory = ({ webhookDAL, projectEnvDAL, permissionService, - projectDAL + projectDAL, + kmsService }: TWebhookServiceFactoryDep) => { const createWebhook = async ({ actor, @@ -64,22 +68,23 @@ export const webhookServiceFactory = ({ type }; + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ + projectId, + type: KmsDataKey.SecretManager + }); if (webhookSecretKey) { - const { ciphertext, iv, tag, algorithm, encoding } = infisicalSymmetricEncypt(webhookSecretKey); - insertDoc.encryptedSecretKey = ciphertext; - insertDoc.iv = iv; - insertDoc.tag = tag; - insertDoc.algorithm = algorithm; - insertDoc.keyEncoding = encoding; + const encryptedSecretKeyWithKms = secretManagerEncryptor({ + plainText: Buffer.from(webhookSecretKey) + }).cipherTextBlob; + insertDoc.encryptedSecretKeyWithKms = encryptedSecretKeyWithKms; } if (webhookUrl) { - const { ciphertext, iv, tag, algorithm, encoding } = infisicalSymmetricEncypt(webhookUrl); - insertDoc.urlCipherText = ciphertext; - insertDoc.urlIV = iv; - insertDoc.urlTag = tag; - insertDoc.algorithm = algorithm; - insertDoc.keyEncoding = encoding; + const encryptedUrl = secretManagerEncryptor({ + plainText: Buffer.from(webhookUrl) + }).cipherTextBlob; + + insertDoc.encryptedUrl = encryptedUrl; } const webhook = await webhookDAL.create(insertDoc); @@ -136,9 +141,35 @@ export const webhookServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks); let webhookError: string | undefined; + const { decryptor: kmsDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({ + projectId: project.id, + type: KmsDataKey.SecretManager + }); + let webhookUrl = webhook.url; + let webhookSecretKey; + if (webhook.urlTag && webhook.urlCipherText && webhook.urlIV) { + webhookUrl = infisicalSymmetricDecrypt({ + keyEncoding: webhook.keyEncoding as SecretKeyEncoding, + ciphertext: webhook.urlCipherText, + iv: webhook.urlIV, + tag: webhook.urlTag + }); + } else if (webhook.encryptedUrl) { + webhookUrl = kmsDataKeyDecryptor({ cipherTextBlob: webhook.encryptedUrl }).toString(); + } + if (webhook.encryptedSecretKey && webhook.iv && webhook.tag) { + webhookSecretKey = infisicalSymmetricDecrypt({ + keyEncoding: webhook.keyEncoding as SecretKeyEncoding, + ciphertext: webhook.encryptedSecretKey, + iv: webhook.iv, + tag: webhook.tag + }); + } else if (webhook.encryptedSecretKeyWithKms) { + webhookSecretKey = kmsDataKeyDecryptor({ cipherTextBlob: webhook.encryptedSecretKeyWithKms }).toString(); + } try { await triggerWebhookRequest( - webhook, + { webhookUrl, webhookSecretKey }, getWebhookPayload("test", { workspaceName: project.name, workspaceId: webhook.projectId, @@ -177,11 +208,25 @@ export const webhookServiceFactory = ({ ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Webhooks); const webhooks = await webhookDAL.findAllWebhooks(projectId, environment, secretPath); + const { decryptor: kmsDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({ + type: KmsDataKey.SecretManager, + projectId + }); return webhooks.map((w) => { - const { url } = decryptWebhookDetails(w); + let decryptedUrl = w.url; + if (w.urlTag && w.urlCipherText && w.urlIV) { + decryptedUrl = infisicalSymmetricDecrypt({ + keyEncoding: w.keyEncoding as SecretKeyEncoding, + ciphertext: w.urlCipherText, + iv: w.urlIV, + tag: w.urlTag + }); + } else if (w.encryptedUrl) { + decryptedUrl = kmsDataKeyDecryptor({ cipherTextBlob: w.encryptedUrl }).toString(); + } return { ...w, - url + url: decryptedUrl }; }); }; From 83eed831dad54810446781b3f6c20c44a1f312cc Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Mon, 29 Jul 2024 19:52:08 -0400 Subject: [PATCH 71/77] text rephrase --- .../SecretV2MigrationSection.tsx | 18 +++++++----------- .../OrgEncryptionTab/OrgEncryptionTab.tsx | 2 +- 2 files changed, 8 insertions(+), 12 deletions(-) diff --git a/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx b/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx index 16ce2ad27..a56ef6d9c 100644 --- a/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx +++ b/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx @@ -83,7 +83,7 @@ export const SecretV2MigrationSection = () => { )}

Action Required

- Your project can now leverage Infisical KMS! Ready to enhance your security? + Infisical secrets engine is now 10x faster and allows you to encrypt secrets with your own KMS. Upgrade your project to receive these improvements. {!isAdmin && "This is an admin only operation."}

{didProjectUpgradeFailed && (

@@ -106,7 +106,7 @@ export const SecretV2MigrationSection = () => { >

@@ -123,7 +123,7 @@ export const SecretV2MigrationSection = () => { onBlur={onBlur} isError={Boolean(error?.message)} > - CLI version: v0.25.0 or above + Infisical CLI version is v0.25.0 or above. )} /> @@ -139,7 +139,7 @@ export const SecretV2MigrationSection = () => { onBlur={onBlur} isError={Boolean(error?.message)} > - Operator version: v0.7.0 or above + Infisical Kubernetes Operator version is v0.7.0 or above. )} /> @@ -171,17 +171,13 @@ export const SecretV2MigrationSection = () => { onBlur={onBlur} isError={Boolean(error?.message)} > - Close/Merge all open approval requests as it will be reset. + Close/merge all open approval/access requests. )} />
-
- Meeting these prerequisites will ensure system compatibility and a smooth upgrade - process. -
- + diff --git a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx index b39c04391..0cbe86163 100644 --- a/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx +++ b/frontend/src/views/Settings/OrgSettingsPage/components/OrgEncryptionTab/OrgEncryptionTab.tsx @@ -94,7 +94,7 @@ export const OrgEncryptionTab = withPermission(

- Integrate with external KMS for encrypting your organization's data + Encrypt your organization's data with external KMS.

From c821bc0e1460a0e56cd5a4ad30155bc95315134f Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 30 Jul 2024 13:28:32 +0800 Subject: [PATCH 72/77] misc: address project set kms issue --- .../EncryptionTab/EncryptionTab.tsx | 27 ++++++++++--------- 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx index 2d622366a..6218d1b98 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx @@ -318,20 +318,23 @@ export const EncryptionTab = () => { /> )} + + {(isAllowed) => ( + + )} + - - {(isAllowed) => ( - - )} - handlePopUpToggle("createBackupConfirmation", state)} From 90637877726a1ba3253c1c9d66b24ce8825bb109 Mon Sep 17 00:00:00 2001 From: = Date: Tue, 30 Jul 2024 22:30:17 +0530 Subject: [PATCH 73/77] feat: changed webhook and dynamic secret change to migration mode, resolved snapshot deletion issue in update --- ...=> 20240716105630_add-project-data-key.ts} | 0 .../db/migrations/20240716105646_secret-v2.ts | 225 ++++++++++++++++-- backend/src/db/migrations/utils/kms.ts | 105 ++++++++ backend/src/db/schemas/dynamic-secrets.ts | 7 +- backend/src/db/schemas/webhooks.ts | 11 +- .../dynamic-secret-lease-dal.ts | 10 - .../dynamic-secret-lease-queue.ts | 50 +--- .../dynamic-secret-lease-service.ts | 40 +--- .../dynamic-secret/dynamic-secret-service.ts | 53 +---- .../services/secret-snapshot/snapshot-dal.ts | 17 +- backend/src/lib/crypto/encryption.ts | 5 +- backend/src/server/routes/index.ts | 3 +- backend/src/server/routes/sanitizedSchemas.ts | 6 +- .../src/server/routes/v1/webhook-router.ts | 37 ++- backend/src/services/kms/kms-service.ts | 2 + .../services/project-bot/project-bot-fns.ts | 3 +- backend/src/services/secret/secret-queue.ts | 114 +-------- backend/src/services/webhook/webhook-fns.ts | 28 +-- .../src/services/webhook/webhook-service.ts | 79 ++---- .../SecretV2MigrationSection.tsx | 17 -- 20 files changed, 398 insertions(+), 414 deletions(-) rename backend/src/db/migrations/{20240717114407_add-project-data-key.ts => 20240716105630_add-project-data-key.ts} (100%) create mode 100644 backend/src/db/migrations/utils/kms.ts diff --git a/backend/src/db/migrations/20240717114407_add-project-data-key.ts b/backend/src/db/migrations/20240716105630_add-project-data-key.ts similarity index 100% rename from backend/src/db/migrations/20240717114407_add-project-data-key.ts rename to backend/src/db/migrations/20240716105630_add-project-data-key.ts diff --git a/backend/src/db/migrations/20240716105646_secret-v2.ts b/backend/src/db/migrations/20240716105646_secret-v2.ts index 84a151586..a9188c608 100644 --- a/backend/src/db/migrations/20240716105646_secret-v2.ts +++ b/backend/src/db/migrations/20240716105646_secret-v2.ts @@ -1,7 +1,178 @@ +/* eslint-disable @typescript-eslint/ban-ts-comment */ import { Knex } from "knex"; -import { SecretEncryptionAlgo, SecretKeyEncoding, SecretType, TableName } from "../schemas"; +import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; +import { selectAllTableCols } from "@app/lib/knex/select"; + +import { SecretKeyEncoding, SecretType, TableName } from "../schemas"; import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils"; +import { getSecretManagerDataKey } from "./utils/kms"; + +const backfillWebhooks = async (knex: Knex) => { + const hasEncryptedSecretKeyWithKms = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKeyWithKms"); + const hasEncryptedWebhookUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl"); + const hasUrlCipherText = await knex.schema.hasColumn(TableName.Webhook, "urlCipherText"); + const hasUrlIV = await knex.schema.hasColumn(TableName.Webhook, "urlIV"); + const hasUrlTag = await knex.schema.hasColumn(TableName.Webhook, "urlTag"); + const hasEncryptedSecretKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKey"); + const hasIV = await knex.schema.hasColumn(TableName.Webhook, "iv"); + const hasTag = await knex.schema.hasColumn(TableName.Webhook, "tag"); + const hasKeyEncoding = await knex.schema.hasColumn(TableName.Webhook, "keyEncoding"); + const hasAlgorithm = await knex.schema.hasColumn(TableName.Webhook, "algorithm"); + const hasUrl = await knex.schema.hasColumn(TableName.Webhook, "url"); + + await knex.schema.alterTable(TableName.Webhook, (t) => { + if (!hasEncryptedSecretKeyWithKms) t.binary("encryptedSecretKeyWithKms"); + if (!hasEncryptedWebhookUrl) t.binary("encryptedUrl"); + if (hasUrl) t.string("url").nullable().alter(); + }); + + const kmsEncryptorGroupByProjectId: Record>["encryptor"]> = + {}; + if (hasUrlCipherText && hasUrlIV && hasUrlTag && hasEncryptedSecretKey && hasIV && hasTag) { + // eslint-disable-next-line + const webhooksToFill = await knex(TableName.Webhook) + .join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.Webhook}.envId`) + .whereNull("encryptedUrl") + // eslint-disable-next-line + // @ts-ignore knex migration fails + .select(selectAllTableCols(TableName.Webhook)) + .select("projectId"); + + const updatedWebhooks = []; + for (const webhook of webhooksToFill) { + if (!kmsEncryptorGroupByProjectId[webhook.projectId]) { + // eslint-disable-next-line + const { encryptor } = await getSecretManagerDataKey(knex, webhook.projectId); + kmsEncryptorGroupByProjectId[webhook.projectId] = encryptor; + } + + const kmsEncryptor = kmsEncryptorGroupByProjectId[webhook.projectId]; + + // @ts-ignore post migration fails + let webhookUrl = webhook.url; + let webhookSecretKey; + + // @ts-ignore post migration fails + if (webhook.urlTag && webhook.urlCipherText && webhook.urlIV) { + webhookUrl = infisicalSymmetricDecrypt({ + // @ts-ignore post migration fails + keyEncoding: webhook.keyEncoding as SecretKeyEncoding, + // @ts-ignore post migration fails + ciphertext: webhook.urlCipherText, + // @ts-ignore post migration fails + iv: webhook.urlIV, + // @ts-ignore post migration fails + tag: webhook.urlTag + }); + } + // @ts-ignore post migration fails + if (webhook.encryptedSecretKey && webhook.iv && webhook.tag) { + webhookSecretKey = infisicalSymmetricDecrypt({ + // @ts-ignore post migration fails + keyEncoding: webhook.keyEncoding as SecretKeyEncoding, + // @ts-ignore post migration fails + ciphertext: webhook.encryptedSecretKey, + // @ts-ignore post migration fails + iv: webhook.iv, + // @ts-ignore post migration fails + tag: webhook.tag + }); + } + const { projectId, ...el } = webhook; + updatedWebhooks.push({ + ...el, + encryptedSecretKeyWithKms: webhookSecretKey + ? kmsEncryptor({ plainText: Buffer.from(webhookSecretKey) }).cipherTextBlob + : null, + encryptedUrl: kmsEncryptor({ plainText: Buffer.from(webhookUrl) }).cipherTextBlob + }); + } + if (updatedWebhooks.length) { + // eslint-disable-next-line + await knex(TableName.Webhook).insert(updatedWebhooks).onConflict("id").merge(); + } + } + await knex.schema.alterTable(TableName.Webhook, (t) => { + t.binary("encryptedUrl").notNullable().alter(); + + if (hasUrlIV) t.dropColumn("urlIV"); + if (hasUrlCipherText) t.dropColumn("urlCipherText"); + if (hasUrlTag) t.dropColumn("urlTag"); + if (hasIV) t.dropColumn("iv"); + if (hasTag) t.dropColumn("tag"); + if (hasEncryptedSecretKey) t.dropColumn("encryptedSecretKey"); + if (hasKeyEncoding) t.dropColumn("keyEncoding"); + if (hasAlgorithm) t.dropColumn("algorithm"); + if (hasUrl) t.dropColumn("url"); + }); +}; + +const backfillDynamicSecretConfigs = async (knex: Knex) => { + const hasEncryptedConfig = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedConfig"); + + const hasInputCipherText = await knex.schema.hasColumn(TableName.DynamicSecret, "inputCiphertext"); + const hasInputIV = await knex.schema.hasColumn(TableName.DynamicSecret, "inputIV"); + const hasInputTag = await knex.schema.hasColumn(TableName.DynamicSecret, "inputTag"); + const hasKeyEncoding = await knex.schema.hasColumn(TableName.DynamicSecret, "keyEncoding"); + const hasAlgorithm = await knex.schema.hasColumn(TableName.DynamicSecret, "algorithm"); + + await knex.schema.alterTable(TableName.DynamicSecret, (t) => { + if (!hasEncryptedConfig) t.binary("encryptedConfig"); + }); + const kmsEncryptorGroupByProjectId: Record>["encryptor"]> = + {}; + if (hasInputCipherText && hasInputIV && hasInputTag) { + // eslint-disable-next-line + const dynamicSecretConfigs = await knex(TableName.DynamicSecret) + .join(TableName.SecretFolder, `${TableName.SecretFolder}.id`, `${TableName.DynamicSecret}.folderId`) + .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`) + .whereNull("encryptedConfig") + // @ts-ignore post migration fails + .select(selectAllTableCols(TableName.DynamicSecret)) + .select("projectId"); + + const updatedConfigs = []; + for (const dynamicSecretConfig of dynamicSecretConfigs) { + if (!kmsEncryptorGroupByProjectId[dynamicSecretConfig.projectId]) { + // eslint-disable-next-line + const { encryptor } = await getSecretManagerDataKey(knex, dynamicSecretConfig.projectId); + kmsEncryptorGroupByProjectId[dynamicSecretConfig.projectId] = encryptor; + } + + const kmsEncryptor = kmsEncryptorGroupByProjectId[dynamicSecretConfig.projectId]; + const inputConfig = infisicalSymmetricDecrypt({ + // @ts-ignore post migration fails + keyEncoding: dynamicSecretConfig.keyEncoding as SecretKeyEncoding, + // @ts-ignore post migration fails + ciphertext: dynamicSecretConfig.inputCiphertext as string, + // @ts-ignore post migration fails + iv: dynamicSecretConfig.inputIV as string, + // @ts-ignore post migration fails + tag: dynamicSecretConfig.inputTag as string + }); + + const { projectId, ...el } = dynamicSecretConfig; + updatedConfigs.push({ + ...el, + encryptedConfig: kmsEncryptor({ plainText: Buffer.from(inputConfig) }).cipherTextBlob + }); + } + if (updatedConfigs.length) { + // eslint-disable-next-line + await knex(TableName.DynamicSecret).insert(updatedConfigs).onConflict("id").merge(); + } + } + await knex.schema.alterTable(TableName.DynamicSecret, (t) => { + t.binary("encryptedConfig").notNullable().alter(); + + if (hasInputTag) t.dropColumn("inputTag"); + if (hasInputIV) t.dropColumn("inputIV"); + if (hasInputCipherText) t.dropColumn("inputCiphertext"); + if (hasKeyEncoding) t.dropColumn("keyEncoding"); + if (hasAlgorithm) t.dropColumn("algorithm"); + }); +}; export async function up(knex: Knex): Promise { const doesSecretV2TableExist = await knex.schema.hasTable(TableName.SecretV2); @@ -145,29 +316,11 @@ export async function up(knex: Knex): Promise { } if (await knex.schema.hasTable(TableName.Webhook)) { - const hasEncryptedWebhookSecretKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKeyWithKms"); - const hasEncryptedWebhookUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl"); - await knex.schema.alterTable(TableName.Webhook, (t) => { - if (!hasEncryptedWebhookSecretKey) t.binary("encryptedSecretKeyWithKms"); - if (!hasEncryptedWebhookUrl) t.binary("encryptedUrl"); - }); + await backfillWebhooks(knex); } if (await knex.schema.hasTable(TableName.DynamicSecret)) { - const hasInputIV = await knex.schema.hasColumn(TableName.DynamicSecret, "inputIV"); - const hasInputCipherText = await knex.schema.hasColumn(TableName.DynamicSecret, "inputCiphertext"); - const hasInputTag = await knex.schema.hasColumn(TableName.DynamicSecret, "inputTag"); - const hasAlgorithm = await knex.schema.hasColumn(TableName.DynamicSecret, "algorithm"); - const hasKeyEncoding = await knex.schema.hasColumn(TableName.DynamicSecret, "keyEncoding"); - const hasEncryptedConfig = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedConfig"); - await knex.schema.alterTable(TableName.DynamicSecret, (t) => { - if (hasInputIV) t.string("inputIV").alter(); - if (hasInputCipherText) t.text("inputCiphertext").alter(); - if (hasInputTag) t.string("inputTag").alter(); - if (hasAlgorithm) t.string("algorithm").defaultTo(SecretEncryptionAlgo.AES_256_GCM).alter(); - if (hasKeyEncoding) t.string("keyEncoding").defaultTo(SecretKeyEncoding.UTF8).alter(); - if (!hasEncryptedConfig) t.binary("encryptedConfig"); - }); + await backfillDynamicSecretConfigs(knex); } } @@ -206,16 +359,46 @@ export async function down(knex: Knex): Promise { if (await knex.schema.hasTable(TableName.Webhook)) { const hasEncryptedWebhookSecretKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKeyWithKms"); const hasEncryptedWebhookUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl"); + const hasUrlCipherText = await knex.schema.hasColumn(TableName.Webhook, "urlCipherText"); + const hasUrlIV = await knex.schema.hasColumn(TableName.Webhook, "urlIV"); + const hasUrlTag = await knex.schema.hasColumn(TableName.Webhook, "urlTag"); + const hasEncryptedSecretKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKey"); + const hasIV = await knex.schema.hasColumn(TableName.Webhook, "iv"); + const hasTag = await knex.schema.hasColumn(TableName.Webhook, "tag"); + const hasKeyEncoding = await knex.schema.hasColumn(TableName.Webhook, "keyEncoding"); + const hasAlgorithm = await knex.schema.hasColumn(TableName.Webhook, "algorithm"); + const hasUrl = await knex.schema.hasColumn(TableName.Webhook, "url"); + await knex.schema.alterTable(TableName.Webhook, (t) => { if (hasEncryptedWebhookSecretKey) t.dropColumn("encryptedSecretKeyWithKms"); if (hasEncryptedWebhookUrl) t.dropColumn("encryptedUrl"); + if (!hasUrl) t.string("url"); + if (!hasEncryptedSecretKey) t.string("encryptedSecretKey"); + if (!hasIV) t.string("iv"); + if (!hasTag) t.string("tag"); + if (!hasAlgorithm) t.string("algorithm"); + if (!hasKeyEncoding) t.string("keyEncoding"); + if (!hasUrlCipherText) t.string("urlCipherText"); + if (!hasUrlIV) t.string("urlIV"); + if (!hasUrlTag) t.string("urlTag"); }); } if (await knex.schema.hasTable(TableName.DynamicSecret)) { const hasEncryptedConfig = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedConfig"); + + const hasInputIV = await knex.schema.hasColumn(TableName.DynamicSecret, "inputIV"); + const hasInputCipherText = await knex.schema.hasColumn(TableName.DynamicSecret, "inputCiphertext"); + const hasInputTag = await knex.schema.hasColumn(TableName.DynamicSecret, "inputTag"); + const hasAlgorithm = await knex.schema.hasColumn(TableName.DynamicSecret, "algorithm"); + const hasKeyEncoding = await knex.schema.hasColumn(TableName.DynamicSecret, "keyEncoding"); await knex.schema.alterTable(TableName.DynamicSecret, (t) => { if (hasEncryptedConfig) t.dropColumn("encryptedConfig"); + if (!hasInputIV) t.string("inputIV"); + if (!hasInputCipherText) t.text("inputCiphertext"); + if (!hasInputTag) t.string("inputTag"); + if (!hasAlgorithm) t.string("algorithm"); + if (!hasKeyEncoding) t.string("keyEncoding"); }); } } diff --git a/backend/src/db/migrations/utils/kms.ts b/backend/src/db/migrations/utils/kms.ts new file mode 100644 index 000000000..b4698a42d --- /dev/null +++ b/backend/src/db/migrations/utils/kms.ts @@ -0,0 +1,105 @@ +import slugify from "@sindresorhus/slugify"; +import { Knex } from "knex"; + +import { TableName } from "@app/db/schemas"; +import { randomSecureBytes } from "@app/lib/crypto"; +import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher"; +import { alphaNumericNanoId } from "@app/lib/nanoid"; + +const getInstanceRootKey = async (knex: Knex) => { + const encryptionKey = process.env.ENCRYPTION_KEY || process.env.ROOT_ENCRYPTION_KEY; + // if root key its base64 encoded + const isBase64 = !process.env.ENCRYPTION_KEY; + if (!encryptionKey) throw new Error("ENCRYPTION_KEY variable needed for migration"); + const encryptionKeyBuffer = Buffer.from(encryptionKey, isBase64 ? "base64" : "utf8"); + + const KMS_ROOT_CONFIG_UUID = "00000000-0000-0000-0000-000000000000"; + const kmsRootConfig = await knex(TableName.KmsServerRootConfig).where({ id: KMS_ROOT_CONFIG_UUID }).first(); + const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); + if (kmsRootConfig) { + const decryptedRootKey = cipher.decrypt(kmsRootConfig.encryptedRootKey, encryptionKeyBuffer); + // set the flag so that other instancen nodes can start + return decryptedRootKey; + } + + const newRootKey = randomSecureBytes(32); + const encryptedRootKey = cipher.encrypt(newRootKey, encryptionKeyBuffer); + await knex(TableName.KmsServerRootConfig).insert({ + encryptedRootKey, + // eslint-disable-next-line + // @ts-ignore id is kept as fixed for idempotence and to avoid race condition + id: KMS_ROOT_CONFIG_UUID + }); + return encryptedRootKey; +}; + +export const getSecretManagerDataKey = async (knex: Knex, projectId: string) => { + const KMS_VERSION = "v01"; + const KMS_VERSION_BLOB_LENGTH = 3; + const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); + const project = await knex(TableName.Project).where({ id: projectId }).first(); + if (!project) throw new Error("Missing project id"); + + const ROOT_ENCRYPTION_KEY = await getInstanceRootKey(knex); + + let secretManagerKmsKey; + const projectSecretManagerKmsId = project?.kmsSecretManagerKeyId; + if (projectSecretManagerKmsId) { + const kmsDoc = await knex(TableName.KmsKey) + .leftJoin(TableName.InternalKms, `${TableName.KmsKey}.id`, `${TableName.InternalKms}.kmsKeyId`) + .where({ [`${TableName.KmsKey}.id` as "id"]: projectSecretManagerKmsId }) + .first(); + if (!kmsDoc) throw new Error("missing kms"); + secretManagerKmsKey = cipher.decrypt(kmsDoc.encryptedKey, ROOT_ENCRYPTION_KEY); + } else { + const [kmsDoc] = await knex(TableName.KmsKey) + .insert({ + slug: slugify(alphaNumericNanoId(8).toLowerCase()), + orgId: project.orgId, + isReserved: false + }) + .returning("*"); + + secretManagerKmsKey = randomSecureBytes(32); + const encryptedKeyMaterial = cipher.encrypt(secretManagerKmsKey, ROOT_ENCRYPTION_KEY); + await knex(TableName.InternalKms).insert({ + version: 1, + encryptedKey: encryptedKeyMaterial, + encryptionAlgorithm: SymmetricEncryption.AES_GCM_256, + kmsKeyId: kmsDoc.id + }); + } + + const encryptedSecretManagerDataKey = project?.kmsSecretManagerEncryptedDataKey; + let dataKey: Buffer; + if (!encryptedSecretManagerDataKey) { + dataKey = randomSecureBytes(); + // the below versioning we do it automatically in kms service + const unversionedDataKey = cipher.encrypt(dataKey, secretManagerKmsKey); + const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3 + await knex(TableName.Project) + .where({ id: projectId }) + .update({ + kmsSecretManagerEncryptedDataKey: Buffer.concat([unversionedDataKey, versionBlob]) + }); + } else { + const cipherTextBlob = encryptedSecretManagerDataKey.subarray(0, -KMS_VERSION_BLOB_LENGTH); + dataKey = cipher.decrypt(cipherTextBlob, secretManagerKmsKey); + } + + return { + encryptor: ({ plainText }: { plainText: Buffer }) => { + const encryptedPlainTextBlob = cipher.encrypt(plainText, dataKey); + + // Buffer#1 encrypted text + Buffer#2 version number + const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3 + const cipherTextBlob = Buffer.concat([encryptedPlainTextBlob, versionBlob]); + return { cipherTextBlob }; + }, + decryptor: ({ cipherTextBlob: versionedCipherTextBlob }: { cipherTextBlob: Buffer }) => { + const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH); + const decryptedBlob = cipher.decrypt(cipherTextBlob, dataKey); + return decryptedBlob; + } + }; +}; diff --git a/backend/src/db/schemas/dynamic-secrets.ts b/backend/src/db/schemas/dynamic-secrets.ts index 83c4e308d..d90f1f7d2 100644 --- a/backend/src/db/schemas/dynamic-secrets.ts +++ b/backend/src/db/schemas/dynamic-secrets.ts @@ -16,17 +16,12 @@ export const DynamicSecretsSchema = z.object({ type: z.string(), defaultTTL: z.string(), maxTTL: z.string().nullable().optional(), - inputIV: z.string().nullable().optional(), - inputCiphertext: z.string().nullable().optional(), - inputTag: z.string().nullable().optional(), - algorithm: z.string().default("aes-256-gcm").nullable().optional(), - keyEncoding: z.string().default("utf8").nullable().optional(), folderId: z.string().uuid(), status: z.string().nullable().optional(), statusDetails: z.string().nullable().optional(), createdAt: z.date(), updatedAt: z.date(), - encryptedConfig: zodBuffer.nullable().optional() + encryptedConfig: zodBuffer }); export type TDynamicSecrets = z.infer; diff --git a/backend/src/db/schemas/webhooks.ts b/backend/src/db/schemas/webhooks.ts index 084d72e8e..3f670497f 100644 --- a/backend/src/db/schemas/webhooks.ts +++ b/backend/src/db/schemas/webhooks.ts @@ -12,24 +12,15 @@ import { TImmutableDBKeys } from "./models"; export const WebhooksSchema = z.object({ id: z.string().uuid(), secretPath: z.string().default("/"), - url: z.string(), lastStatus: z.string().nullable().optional(), lastRunErrorMessage: z.string().nullable().optional(), isDisabled: z.boolean().default(false), - encryptedSecretKey: z.string().nullable().optional(), - iv: z.string().nullable().optional(), - tag: z.string().nullable().optional(), - algorithm: z.string().nullable().optional(), - keyEncoding: z.string().nullable().optional(), createdAt: z.date(), updatedAt: z.date(), envId: z.string().uuid(), - urlCipherText: z.string().nullable().optional(), - urlIV: z.string().nullable().optional(), - urlTag: z.string().nullable().optional(), type: z.string().default("general").nullable().optional(), encryptedSecretKeyWithKms: zodBuffer.nullable().optional(), - encryptedUrl: zodBuffer.nullable().optional() + encryptedUrl: zodBuffer }); export type TWebhooks = z.infer; diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts index 7463d3b9e..97a682933 100644 --- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts +++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts @@ -40,11 +40,6 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => { db.ref("type").withSchema(TableName.DynamicSecret).as("dynType"), db.ref("defaultTTL").withSchema(TableName.DynamicSecret).as("dynDefaultTTL"), db.ref("maxTTL").withSchema(TableName.DynamicSecret).as("dynMaxTTL"), - db.ref("inputIV").withSchema(TableName.DynamicSecret).as("dynInputIV"), - db.ref("inputTag").withSchema(TableName.DynamicSecret).as("dynInputTag"), - db.ref("inputCiphertext").withSchema(TableName.DynamicSecret).as("dynInputCiphertext"), - db.ref("algorithm").withSchema(TableName.DynamicSecret).as("dynAlgorithm"), - db.ref("keyEncoding").withSchema(TableName.DynamicSecret).as("dynKeyEncoding"), db.ref("folderId").withSchema(TableName.DynamicSecret).as("dynFolderId"), db.ref("status").withSchema(TableName.DynamicSecret).as("dynStatus"), db.ref("statusDetails").withSchema(TableName.DynamicSecret).as("dynStatusDetails"), @@ -63,11 +58,6 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => { type: doc.dynType, defaultTTL: doc.dynDefaultTTL, maxTTL: doc.dynMaxTTL, - inputIV: doc.dynInputIV, - inputTag: doc.dynInputTag, - inputCiphertext: doc.dynInputCiphertext, - algorithm: doc.dynAlgorithm, - keyEncoding: doc.dynKeyEncoding, folderId: doc.dynFolderId, status: doc.dynStatus, statusDetails: doc.dynStatusDetails, diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts index 44134f92d..82248bd8c 100644 --- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts +++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts @@ -1,7 +1,4 @@ -import { SecretKeyEncoding } from "@app/db/schemas"; import { DisableRotationErrors } from "@app/ee/services/secret-rotation/secret-rotation-queue"; -import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; -import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; @@ -94,27 +91,9 @@ export const dynamicSecretLeaseQueueServiceFactory = ({ projectId }); - let dynamicSecretInputConfig = ""; - if ( - dynamicSecretCfg.keyEncoding && - dynamicSecretCfg.inputCiphertext && - dynamicSecretCfg.inputTag && - dynamicSecretCfg.inputIV - ) { - dynamicSecretInputConfig = infisicalSymmetricDecrypt({ - keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, - ciphertext: dynamicSecretCfg.inputCiphertext, - tag: dynamicSecretCfg.inputTag, - iv: dynamicSecretCfg.inputIV - }); - } else if (dynamicSecretCfg.encryptedConfig) { - dynamicSecretInputConfig = secretManagerDecryptor({ - cipherTextBlob: dynamicSecretCfg.encryptedConfig - }).toString(); - } else { - throw new BadRequestError({ message: "Missing secret input config" }); - } - + const dynamicSecretInputConfig = secretManagerDecryptor({ + cipherTextBlob: dynamicSecretCfg.encryptedConfig + }).toString(); const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object; @@ -142,27 +121,10 @@ export const dynamicSecretLeaseQueueServiceFactory = ({ const dynamicSecretLeases = await dynamicSecretLeaseDAL.find({ dynamicSecretId: dynamicSecretCfgId }); if (dynamicSecretLeases.length) { const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; - let dynamicSecretInputConfig = ""; - if ( - dynamicSecretCfg.keyEncoding && - dynamicSecretCfg.inputCiphertext && - dynamicSecretCfg.inputTag && - dynamicSecretCfg.inputIV - ) { - dynamicSecretInputConfig = infisicalSymmetricDecrypt({ - keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, - ciphertext: dynamicSecretCfg.inputCiphertext, - tag: dynamicSecretCfg.inputTag, - iv: dynamicSecretCfg.inputIV - }); - } else if (dynamicSecretCfg.encryptedConfig) { - dynamicSecretInputConfig = secretManagerDecryptor({ - cipherTextBlob: dynamicSecretCfg.encryptedConfig - }).toString(); - } else { - throw new BadRequestError({ message: "Missing secret input config" }); - } + const dynamicSecretInputConfig = secretManagerDecryptor({ + cipherTextBlob: dynamicSecretCfg.encryptedConfig + }).toString(); const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object; await Promise.all(dynamicSecretLeases.map(({ id }) => unsetLeaseRevocation(id))); diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts index d85b69006..eb0c6f171 100644 --- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts +++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts @@ -1,12 +1,10 @@ import { ForbiddenError, subject } from "@casl/ability"; import ms from "ms"; -import { SecretKeyEncoding, TDynamicSecrets } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; import { getConfig } from "@app/lib/config/env"; -import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; @@ -52,29 +50,6 @@ export const dynamicSecretLeaseServiceFactory = ({ licenseService, kmsService }: TDynamicSecretLeaseServiceFactoryDep) => { - const $getDynamicSecretInputConfig = (dynamicSecretCfg: TDynamicSecrets, decryptValue: (arg: Buffer) => string) => { - if ( - dynamicSecretCfg.keyEncoding && - dynamicSecretCfg.inputCiphertext && - dynamicSecretCfg.inputTag && - dynamicSecretCfg.inputIV - ) { - return JSON.parse( - infisicalSymmetricDecrypt({ - keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, - ciphertext: dynamicSecretCfg.inputCiphertext, - tag: dynamicSecretCfg.inputTag, - iv: dynamicSecretCfg.inputIV - }) - ) as object; - } - if (dynamicSecretCfg.encryptedConfig) { - return JSON.parse(decryptValue(dynamicSecretCfg.encryptedConfig)) as object; - } - - throw new BadRequestError({ message: "Missing secret input config" }); - }; - const create = async ({ environmentSlug, path, @@ -125,9 +100,8 @@ export const dynamicSecretLeaseServiceFactory = ({ type: KmsDataKey.SecretManager, projectId }); - const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) => - kmsDecryptor({ cipherTextBlob: value }).toString() - ); + const decryptedStoredInputJson = kmsDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedConfig }).toString(); + const decryptedStoredInput = JSON.parse(decryptedStoredInputJson) as object; const selectedTTL = ttl ?? dynamicSecretCfg.defaultTTL; const { maxTTL } = dynamicSecretCfg; @@ -194,9 +168,8 @@ export const dynamicSecretLeaseServiceFactory = ({ type: KmsDataKey.SecretManager, projectId }); - const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) => - kmsDecryptor({ cipherTextBlob: value }).toString() - ); + const decryptedStoredInputJson = kmsDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedConfig }).toString(); + const decryptedStoredInput = JSON.parse(decryptedStoredInputJson) as object; const selectedTTL = ttl ?? dynamicSecretCfg.defaultTTL; const { maxTTL } = dynamicSecretCfg; @@ -260,9 +233,8 @@ export const dynamicSecretLeaseServiceFactory = ({ type: KmsDataKey.SecretManager, projectId }); - const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) => - kmsDecryptor({ cipherTextBlob: value }).toString() - ); + const decryptedStoredInputJson = kmsDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedConfig }).toString(); + const decryptedStoredInput = JSON.parse(decryptedStoredInputJson) as object; const revokeResponse = await selectedProvider .revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId) diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts index f25a79c35..508c263ee 100644 --- a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts +++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts @@ -1,10 +1,8 @@ import { ForbiddenError, subject } from "@casl/ability"; -import { SecretKeyEncoding } from "@app/db/schemas"; import { TLicenseServiceFactory } from "@app/ee/services/license/license-service"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; -import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { KmsDataKey } from "@app/services/kms/kms-types"; @@ -168,32 +166,15 @@ export const dynamicSecretServiceFactory = ({ throw new BadRequestError({ message: "Provided dynamic secret already exist under the folder" }); } - let dynamicSecretInputConfig = ""; const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId }); - if ( - dynamicSecretCfg.keyEncoding && - dynamicSecretCfg.inputCiphertext && - dynamicSecretCfg.inputTag && - dynamicSecretCfg.inputIV - ) { - dynamicSecretInputConfig = infisicalSymmetricDecrypt({ - keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, - ciphertext: dynamicSecretCfg.inputCiphertext, - tag: dynamicSecretCfg.inputTag, - iv: dynamicSecretCfg.inputIV - }); - } else if (dynamicSecretCfg.encryptedConfig) { - dynamicSecretInputConfig = secretManagerDecryptor({ - cipherTextBlob: dynamicSecretCfg.encryptedConfig - }).toString(); - } else { - throw new BadRequestError({ message: "Missing secret input config" }); - } + const dynamicSecretInputConfig = secretManagerDecryptor({ + cipherTextBlob: dynamicSecretCfg.encryptedConfig + }).toString(); const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object; const newInput = { ...decryptedStoredInput, ...(inputs || {}) }; @@ -208,11 +189,6 @@ export const dynamicSecretServiceFactory = ({ const updatedDynamicCfg = await dynamicSecretDAL.updateById(dynamicSecretCfg.id, { encryptedConfig, - inputIV: null, - inputTag: null, - keyEncoding: null, - algorithm: null, - inputCiphertext: null, maxTTL, defaultTTL, name: newName ?? name, @@ -318,26 +294,9 @@ export const dynamicSecretServiceFactory = ({ projectId }); - let dynamicSecretInputConfig = ""; - if ( - dynamicSecretCfg.keyEncoding && - dynamicSecretCfg.inputCiphertext && - dynamicSecretCfg.inputTag && - dynamicSecretCfg.inputIV - ) { - dynamicSecretInputConfig = infisicalSymmetricDecrypt({ - keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding, - ciphertext: dynamicSecretCfg.inputCiphertext, - tag: dynamicSecretCfg.inputTag, - iv: dynamicSecretCfg.inputIV - }); - } else if (dynamicSecretCfg.encryptedConfig) { - dynamicSecretInputConfig = secretManagerDecryptor({ - cipherTextBlob: dynamicSecretCfg.encryptedConfig - }).toString(); - } else { - throw new BadRequestError({ message: "Missing secret input config" }); - } + const dynamicSecretInputConfig = secretManagerDecryptor({ + cipherTextBlob: dynamicSecretCfg.encryptedConfig + }).toString(); const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object; const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders]; diff --git a/backend/src/ee/services/secret-snapshot/snapshot-dal.ts b/backend/src/ee/services/secret-snapshot/snapshot-dal.ts index e59497368..8e5014fdd 100644 --- a/backend/src/ee/services/secret-snapshot/snapshot-dal.ts +++ b/backend/src/ee/services/secret-snapshot/snapshot-dal.ts @@ -791,10 +791,19 @@ export const snapshotDALFactory = (db: TDbClient) => { const deleteSnapshotsAboveLimit = async (folderId: string, n = 15, tx?: Knex) => { try { - const query = await (tx || db.replicaNode())(TableName.Snapshot) - .orderBy(`${TableName.Snapshot}.createdAt`, "desc") - .where(`${TableName.Snapshot}.folderId`, folderId) - .offset(n) + const query = await (tx || db) + .with("to_delete", (qb) => { + void qb + .select("id") + .from(TableName.Snapshot) + .where("folderId", folderId) + .orderBy("createdAt", "desc") + .offset(n); + }) + .from(TableName.Snapshot) + .whereIn("id", (qb) => { + void qb.select("id").from("to_delete"); + }) .delete(); return query; } catch (error) { diff --git a/backend/src/lib/crypto/encryption.ts b/backend/src/lib/crypto/encryption.ts index b7a4e10d2..258a6d285 100644 --- a/backend/src/lib/crypto/encryption.ts +++ b/backend/src/lib/crypto/encryption.ts @@ -226,8 +226,9 @@ export const infisicalSymmetricDecrypt = ({ keyEncoding: SecretKeyEncoding; }) => { const appCfg = getConfig(); - const rootEncryptionKey = appCfg.ROOT_ENCRYPTION_KEY; - const encryptionKey = appCfg.ENCRYPTION_KEY; + // the or gate is used used in migration + const rootEncryptionKey = appCfg?.ROOT_ENCRYPTION_KEY || process.env.ROOT_ENCRYPTION_KEY; + const encryptionKey = appCfg?.ENCRYPTION_KEY || process.env.ENCRYPTION_KEY; if (rootEncryptionKey && keyEncoding === SecretKeyEncoding.BASE64) { const data = decryptSymmetric({ key: rootEncryptionKey, iv, tag, ciphertext }); return data as T; diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 9b90ccbab..4e0dd4e45 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -725,8 +725,7 @@ export const registerRoutes = async ( integrationAuthDAL, snapshotDAL, snapshotSecretV2BridgeDAL, - secretApprovalRequestDAL, - dynamicSecretDAL + secretApprovalRequestDAL }); const secretImportService = secretImportServiceFactory({ licenseService, diff --git a/backend/src/server/routes/sanitizedSchemas.ts b/backend/src/server/routes/sanitizedSchemas.ts index a10a962cf..ab0557e93 100644 --- a/backend/src/server/routes/sanitizedSchemas.ts +++ b/backend/src/server/routes/sanitizedSchemas.ts @@ -129,11 +129,7 @@ export const SanitizedRoleSchema = ProjectRolesSchema.extend({ }); export const SanitizedDynamicSecretSchema = DynamicSecretsSchema.omit({ - inputIV: true, - inputTag: true, - inputCiphertext: true, - keyEncoding: true, - algorithm: true + encryptedConfig: true }); export const SanitizedAuditLogStreamSchema = z.object({ diff --git a/backend/src/server/routes/v1/webhook-router.ts b/backend/src/server/routes/v1/webhook-router.ts index 7423f9f3e..377af135c 100644 --- a/backend/src/server/routes/v1/webhook-router.ts +++ b/backend/src/server/routes/v1/webhook-router.ts @@ -8,25 +8,24 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; import { WebhookType } from "@app/services/webhook/webhook-types"; -export const sanitizedWebhookSchema = WebhooksSchema.omit({ - encryptedSecretKey: true, - iv: true, - tag: true, - algorithm: true, - keyEncoding: true, - urlCipherText: true, - urlIV: true, - urlTag: true -}).merge( - z.object({ - projectId: z.string(), - environment: z.object({ - id: z.string(), - name: z.string(), - slug: z.string() - }) +export const sanitizedWebhookSchema = WebhooksSchema.pick({ + id: true, + secretPath: true, + lastStatus: true, + lastRunErrorMessage: true, + isDisabled: true, + createdAt: true, + updatedAt: true, + envId: true, + type: true +}).extend({ + projectId: z.string(), + environment: z.object({ + id: z.string(), + name: z.string(), + slug: z.string() }) -); +}); export const registerWebhookRouter = async (server: FastifyZodProvider) => { server.route({ @@ -228,7 +227,7 @@ export const registerWebhookRouter = async (server: FastifyZodProvider) => { response: { 200: z.object({ message: z.string(), - webhooks: sanitizedWebhookSchema.array() + webhooks: sanitizedWebhookSchema.extend({ url: z.string() }).array() }) } }, diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index d5a48ddef..351098f9d 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -575,6 +575,7 @@ export const kmsServiceFactory = ({ // by keeping the decrypted data key in inner scope // none of the entities outside can interact directly or expose the data key + // NOTICE: If changing here update migrations/utils/kms const createCipherPairWithDataKey = async (encryptionContext: TEncryptWithKmsDataKeyDTO) => { const dataKey = await $getDataKey(encryptionContext); const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256); @@ -753,6 +754,7 @@ export const kmsServiceFactory = ({ return { id, slug, orgId, isExternal }; }; + // akhilmhdh: a copy of this is made in migrations/utils/kms const startService = async () => { const appCfg = getConfig(); // This will switch to a seal process and HMS flow in future diff --git a/backend/src/services/project-bot/project-bot-fns.ts b/backend/src/services/project-bot/project-bot-fns.ts index 59d0493ac..d37d620b2 100644 --- a/backend/src/services/project-bot/project-bot-fns.ts +++ b/backend/src/services/project-bot/project-bot-fns.ts @@ -36,8 +36,7 @@ export const getBotKeyFnFactory = ( if (!bot || !bot.isActive || !bot.encryptedProjectKey || !bot.encryptedProjectKeyNonce) { // trying to set bot automatically const projectV1Keys = await projectBotDAL.findProjectUserWorkspaceKey(projectId); - if (!projectV1Keys) - throw new BadRequestError({ message: "Bot not found. [no-private-key]. Please ask admin user to login" }); + if (!projectV1Keys) throw new BadRequestError({ message: "Bot not found. Please ask admin user to login" }); let userPrivateKey = ""; if ( diff --git a/backend/src/services/secret/secret-queue.ts b/backend/src/services/secret/secret-queue.ts index a682a0bcd..49ebbc7a4 100644 --- a/backend/src/services/secret/secret-queue.ts +++ b/backend/src/services/secret/secret-queue.ts @@ -1,21 +1,13 @@ /* eslint-disable no-await-in-loop */ import { AxiosError } from "axios"; -import { - ProjectUpgradeStatus, - ProjectVersion, - SecretKeyEncoding, - TSecretSnapshotSecretsV2, - TSecretVersionsV2 -} from "@app/db/schemas"; -import { TDynamicSecretDALFactory } from "@app/ee/services/dynamic-secret/dynamic-secret-dal"; +import { ProjectUpgradeStatus, ProjectVersion, TSecretSnapshotSecretsV2, TSecretVersionsV2 } from "@app/db/schemas"; import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal"; import { TSecretRotationDALFactory } from "@app/ee/services/secret-rotation/secret-rotation-dal"; import { TSnapshotDALFactory } from "@app/ee/services/secret-snapshot/snapshot-dal"; import { TSnapshotSecretV2DALFactory } from "@app/ee/services/secret-snapshot/snapshot-secret-v2-dal"; import { getConfig } from "@app/lib/config/env"; import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto"; -import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { daysToMillisecond, secondsToMillis } from "@app/lib/dates"; import { BadRequestError } from "@app/lib/errors"; import { groupBy, isSamePath, unique } from "@app/lib/fn"; @@ -68,7 +60,7 @@ type TSecretQueueFactoryDep = { folderDAL: TSecretFolderDALFactory; secretDAL: TSecretDALFactory; secretImportDAL: Pick; - webhookDAL: Pick; + webhookDAL: Pick; projectEnvDAL: Pick; projectDAL: TProjectDALFactory; projectBotDAL: TProjectBotDALFactory; @@ -87,7 +79,6 @@ type TSecretQueueFactoryDep = { secretApprovalRequestDAL: Pick; snapshotDAL: Pick; snapshotSecretV2BridgeDAL: Pick; - dynamicSecretDAL: Pick; }; export type TGetSecrets = { @@ -131,8 +122,7 @@ export const secretQueueFactory = ({ secretRotationDAL, snapshotDAL, snapshotSecretV2BridgeDAL, - secretApprovalRequestDAL, - dynamicSecretDAL + secretApprovalRequestDAL }: TSecretQueueFactoryDep) => { const removeSecretReminder = async (dto: TRemoveSecretReminderDTO) => { const appCfg = getConfig(); @@ -891,38 +881,7 @@ export const secretQueueFactory = ({ await secretV2BridgeDAL.upsertSecretReferences(secretReferences, tx); } - const dynamicSecrets = await dynamicSecretDAL.find({ folderId }, { tx }); - if (dynamicSecrets.length) { - await dynamicSecretDAL.upsert( - dynamicSecrets.map((el) => { - let { encryptedConfig } = el; - if (!encryptedConfig) { - if (el.keyEncoding && el.inputCiphertext && el.inputTag && el.inputIV) { - const decryptedConfig = infisicalSymmetricDecrypt({ - keyEncoding: el.keyEncoding as SecretKeyEncoding, - ciphertext: el.inputCiphertext, - tag: el.inputTag, - iv: el.inputIV - }); - encryptedConfig = secretManagerEncryptor({ plainText: Buffer.from(decryptedConfig) }).cipherTextBlob; - } - } - return { - ...el, - encryptedConfig, - keyEncoding: null, - inputCiphertext: null, - inputTag: null, - inputIV: null, - algorithm: null - }; - }), - "id", - tx - ); - } - - const SNAPSHOT_BATCH_SIZE = 15; + const SNAPSHOT_BATCH_SIZE = 10; const snapshots = await snapshotDAL.findNSecretV1SnapshotByFolderId(folderId, SNAPSHOT_BATCH_SIZE, tx); const projectV3SecretVersionsGroupById: Record = {}; const projectV3SecretVersionTags: { secret_versions_v2Id: string; secret_tagsId: string }[] = []; @@ -1151,71 +1110,6 @@ export const secretQueueFactory = ({ tx ); - /* - * webhooks - * */ - const projectV1Webhooks = await webhookDAL.find({ projectId }, tx); - if (projectV1Webhooks.length) { - await webhookDAL.upsert( - projectV1Webhooks.map((el) => { - let { encryptedSecretKeyWithKms, encryptedUrl } = el; - if (!encryptedSecretKeyWithKms) { - if (el.encryptedSecretKey && el.iv && el.tag) { - const webhookSecretKey = infisicalSymmetricDecrypt({ - keyEncoding: el.keyEncoding as SecretKeyEncoding, - ciphertext: el.encryptedSecretKey, - iv: el.iv, - tag: el.tag - }); - encryptedSecretKeyWithKms = secretManagerEncryptor({ - plainText: Buffer.from(webhookSecretKey) - }).cipherTextBlob; - } - } - if (!encryptedUrl) { - if (el.urlTag && el.urlCipherText && el.urlIV) { - const webhookUrl = infisicalSymmetricDecrypt({ - keyEncoding: el.keyEncoding as SecretKeyEncoding, - ciphertext: el.urlCipherText, - iv: el.urlIV, - tag: el.urlTag - }); - encryptedUrl = secretManagerEncryptor({ - plainText: Buffer.from(webhookUrl) - }).cipherTextBlob; - } else { - encryptedUrl = secretManagerEncryptor({ - plainText: Buffer.from(el.url) - }).cipherTextBlob; - } - } - - return { - id: el.id, - url: el.url, - envId: el.envId, - type: el.type, - isDisabled: el.isDisabled, - lastStatus: el.lastStatus, - secretPath: el.secretPath, - lastRunErrorMessage: el.lastRunErrorMessage, - encryptedSecretKeyWithKms, - encryptedUrl, - urlCipherText: null, - urlIV: null, - urlTag: null, - encryptedSecretKey: null, - iv: null, - tag: null, - keyEncoding: null, - algorithm: null - }; - }), - "id", - tx - ); - } - /* * approvals: we will delete all approvals this is because some secret versions may not be added yet * Thus doesn't make sense for rest to be there diff --git a/backend/src/services/webhook/webhook-fns.ts b/backend/src/services/webhook/webhook-fns.ts index 32476fe9a..7f91ca2db 100644 --- a/backend/src/services/webhook/webhook-fns.ts +++ b/backend/src/services/webhook/webhook-fns.ts @@ -3,9 +3,7 @@ import crypto from "node:crypto"; import { AxiosError } from "axios"; import picomatch from "picomatch"; -import { SecretKeyEncoding } from "@app/db/schemas"; import { request } from "@app/lib/config/request"; -import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; import { logger } from "@app/lib/logger"; @@ -127,28 +125,10 @@ export const fnTriggerWebhook = async ({ const webhooksTriggered = await Promise.allSettled( toBeTriggeredHooks.map((hook) => { - let webhookUrl = hook.url; - let webhookSecretKey; - if (hook.urlTag && hook.urlCipherText && hook.urlIV) { - webhookUrl = infisicalSymmetricDecrypt({ - keyEncoding: hook.keyEncoding as SecretKeyEncoding, - ciphertext: hook.urlCipherText, - iv: hook.urlIV, - tag: hook.urlTag - }); - } else if (hook.encryptedUrl) { - webhookUrl = kmsDataKeyDecryptor({ cipherTextBlob: hook.encryptedUrl }).toString(); - } - if (hook.encryptedSecretKey && hook.iv && hook.tag) { - webhookSecretKey = infisicalSymmetricDecrypt({ - keyEncoding: hook.keyEncoding as SecretKeyEncoding, - ciphertext: hook.encryptedSecretKey, - iv: hook.iv, - tag: hook.tag - }); - } else if (hook.encryptedSecretKeyWithKms) { - webhookSecretKey = kmsDataKeyDecryptor({ cipherTextBlob: hook.encryptedSecretKeyWithKms }).toString(); - } + const webhookUrl = kmsDataKeyDecryptor({ cipherTextBlob: hook.encryptedUrl }).toString(); + const webhookSecretKey = hook.encryptedSecretKeyWithKms + ? kmsDataKeyDecryptor({ cipherTextBlob: hook.encryptedSecretKeyWithKms }).toString() + : undefined; return triggerWebhookRequest( { webhookUrl, webhookSecretKey }, diff --git a/backend/src/services/webhook/webhook-service.ts b/backend/src/services/webhook/webhook-service.ts index 84b4baadf..2698b1ea2 100644 --- a/backend/src/services/webhook/webhook-service.ts +++ b/backend/src/services/webhook/webhook-service.ts @@ -1,9 +1,7 @@ import { ForbiddenError } from "@casl/ability"; -import { SecretKeyEncoding, TWebhooksInsert } from "@app/db/schemas"; import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service"; import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission"; -import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption"; import { BadRequestError } from "@app/lib/errors"; import { TKmsServiceFactory } from "../kms/kms-service"; @@ -60,34 +58,28 @@ export const webhookServiceFactory = ({ const env = await projectEnvDAL.findOne({ projectId, slug: environment }); if (!env) throw new BadRequestError({ message: "Env not found" }); - const insertDoc: TWebhooksInsert = { - url: "", // deprecated - we are moving away from plaintext URLs - envId: env.id, - isDisabled: false, - secretPath: secretPath || "/", - type - }; - const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ projectId, type: KmsDataKey.SecretManager }); - if (webhookSecretKey) { - const encryptedSecretKeyWithKms = secretManagerEncryptor({ - plainText: Buffer.from(webhookSecretKey) - }).cipherTextBlob; - insertDoc.encryptedSecretKeyWithKms = encryptedSecretKeyWithKms; - } - if (webhookUrl) { - const encryptedUrl = secretManagerEncryptor({ - plainText: Buffer.from(webhookUrl) - }).cipherTextBlob; + const encryptedSecretKeyWithKms = webhookSecretKey + ? secretManagerEncryptor({ + plainText: Buffer.from(webhookSecretKey) + }).cipherTextBlob + : null; + const encryptedUrl = secretManagerEncryptor({ + plainText: Buffer.from(webhookUrl) + }).cipherTextBlob; - insertDoc.encryptedUrl = encryptedUrl; - } - - const webhook = await webhookDAL.create(insertDoc); + const webhook = await webhookDAL.create({ + encryptedUrl, + encryptedSecretKeyWithKms, + envId: env.id, + isDisabled: false, + secretPath: secretPath || "/", + type + }); return { ...webhook, projectId, environment: env }; }; @@ -145,28 +137,11 @@ export const webhookServiceFactory = ({ projectId: project.id, type: KmsDataKey.SecretManager }); - let webhookUrl = webhook.url; - let webhookSecretKey; - if (webhook.urlTag && webhook.urlCipherText && webhook.urlIV) { - webhookUrl = infisicalSymmetricDecrypt({ - keyEncoding: webhook.keyEncoding as SecretKeyEncoding, - ciphertext: webhook.urlCipherText, - iv: webhook.urlIV, - tag: webhook.urlTag - }); - } else if (webhook.encryptedUrl) { - webhookUrl = kmsDataKeyDecryptor({ cipherTextBlob: webhook.encryptedUrl }).toString(); - } - if (webhook.encryptedSecretKey && webhook.iv && webhook.tag) { - webhookSecretKey = infisicalSymmetricDecrypt({ - keyEncoding: webhook.keyEncoding as SecretKeyEncoding, - ciphertext: webhook.encryptedSecretKey, - iv: webhook.iv, - tag: webhook.tag - }); - } else if (webhook.encryptedSecretKeyWithKms) { - webhookSecretKey = kmsDataKeyDecryptor({ cipherTextBlob: webhook.encryptedSecretKeyWithKms }).toString(); - } + const webhookUrl = kmsDataKeyDecryptor({ cipherTextBlob: webhook.encryptedUrl }).toString(); + const webhookSecretKey = webhook.encryptedSecretKeyWithKms + ? kmsDataKeyDecryptor({ cipherTextBlob: webhook.encryptedSecretKeyWithKms }).toString() + : undefined; + try { await triggerWebhookRequest( { webhookUrl, webhookSecretKey }, @@ -213,17 +188,7 @@ export const webhookServiceFactory = ({ projectId }); return webhooks.map((w) => { - let decryptedUrl = w.url; - if (w.urlTag && w.urlCipherText && w.urlIV) { - decryptedUrl = infisicalSymmetricDecrypt({ - keyEncoding: w.keyEncoding as SecretKeyEncoding, - ciphertext: w.urlCipherText, - iv: w.urlIV, - tag: w.urlTag - }); - } else if (w.encryptedUrl) { - decryptedUrl = kmsDataKeyDecryptor({ cipherTextBlob: w.encryptedUrl }).toString(); - } + const decryptedUrl = kmsDataKeyDecryptor({ cipherTextBlob: w.encryptedUrl }).toString(); return { ...w, url: decryptedUrl diff --git a/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx b/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx index a56ef6d9c..b99200930 100644 --- a/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx +++ b/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx @@ -22,7 +22,6 @@ enum ProjectUpgradeStatus { const formSchema = z.object({ isCLIChecked: z.literal(true), isOperatorChecked: z.literal(true), - doesKnowSnapshotLimit: z.literal(true), shouldCloseOpenApprovals: z.literal(true) }); @@ -143,22 +142,6 @@ export const SecretV2MigrationSection = () => { )} /> - ( - - Folders keep 10 latest snapshots due to migration time limit. - - )} - /> Date: Tue, 30 Jul 2024 22:44:49 +0530 Subject: [PATCH 74/77] feat: removed replica node from delete db query --- .../secret-approval-request/secret-approval-request-dal.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts b/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts index e5b2ea8a4..5fb5da0a1 100644 --- a/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts +++ b/backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts @@ -491,7 +491,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => { const deleteByProjectId = async (projectId: string, tx?: Knex) => { try { - const query = await (tx || db.replicaNode())(TableName.SecretApprovalRequest) + const query = await (tx || db)(TableName.SecretApprovalRequest) .join(TableName.SecretFolder, `${TableName.SecretApprovalRequest}.folderId`, `${TableName.SecretFolder}.id`) .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`) .where({ projectId }) From 29060ffc9e14f6024c8ac518ca7618ed7b14c75d Mon Sep 17 00:00:00 2001 From: = Date: Tue, 30 Jul 2024 22:56:05 +0530 Subject: [PATCH 75/77] feat: added a success message on upgrade success --- .../SecretV2MigrationSection.tsx | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx b/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx index b99200930..aee61be19 100644 --- a/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx +++ b/frontend/src/views/SecretOverviewPage/components/SecretV2MigrationSection/SecretV2MigrationSection.tsx @@ -47,7 +47,15 @@ export const SecretV2MigrationSection = () => { const isProjectUpgraded = workspaceDetails?.version === ProjectVersion.V3; + useEffect(() => { + if (isProjectUpgraded && migrateProjectToV3.data) { + createNotification({ type: "success", text: "Project upgrade completed successfully" }); + migrateProjectToV3.reset(); + } + }, [isProjectUpgraded, Boolean(migrateProjectToV3.data)]); + if (isProjectUpgraded || currentWorkspace?.version === ProjectVersion.V3) return null; + const isUpgrading = workspaceDetails?.upgradeStatus === ProjectUpgradeStatus.InProgress; const didProjectUpgradeFailed = workspaceDetails?.upgradeStatus === ProjectUpgradeStatus.Failed; @@ -82,7 +90,8 @@ export const SecretV2MigrationSection = () => { )}

Action Required

- Infisical secrets engine is now 10x faster and allows you to encrypt secrets with your own KMS. Upgrade your project to receive these improvements. + Infisical secrets engine is now 10x faster and allows you to encrypt secrets with your own + KMS. Upgrade your project to receive these improvements. {!isAdmin && "This is an admin only operation."}