From 76d2cb33d18e58fac7b1bf5b9d50c9fe14c5deef Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Thu, 14 May 2026 11:33:50 -0400 Subject: [PATCH 1/2] feat(images): Unify combined sidecar images, drop client-registration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Consolidates the authbridge container images down to two combined variants, each bundling spiffe-helper that starts conditionally on SPIRE_ENABLED. Removes the in-pod client-registration sidecar from this repo (operator now owns Keycloak client registration). ## Image layout (after) | Name | Built from | Contents | |---|---|---| | `authbridge` (proxy-sidecar combined, default mode) | cmd/authbridge/Dockerfile.proxy | authbridge-proxy + spiffe-helper | | `authbridge-envoy` (envoy-sidecar combined) | cmd/authbridge/Dockerfile.envoy | Envoy + authbridge (ext_proc) + spiffe-helper | | `proxy-init` | authproxy/Dockerfile.init | iptables init for envoy-sidecar mode | Both combined images use the same supervisor pattern: * If SPIRE_ENABLED=true: start spiffe-helper in background, append its PID to CRITICAL_PIDS. * Start authbridge-proxy / Envoy + authbridge in background, append. * `wait -n $CRITICAL_PIDS` blocks until any critical process exits. * On SIGTERM/SIGINT: graceful shutdown, exit 0. * On any critical-process death: kill the others, exit 1, kubelet restarts the pod. No silent process death. ## Removals * `authproxy/Dockerfile.authbridge` (old envoy+everything combined) * `authproxy/entrypoint-authbridge.sh` * `authproxy/authbridge-combined.yaml` (was the bake-in YAML for the old combined image; operator-supplied per-agent ConfigMap superseded it) * `client-registration/` (entire directory: Dockerfile, Python script, requirements, example manifests, images). Operator now creates Keycloak clients via its ClientRegistration controller and mounts the resulting Secret at /shared/client-id.txt + /shared/client-secret.txt — same paths the in-pod sidecar wrote to. Workloads opting back into the legacy in-pod path use `kagenti.io/client-registration-inject: "true"`; that path now sources the image from kagenti-operator. * `spiffe-helper/Dockerfile` (standalone spiffe-helper image — bundled into both combined images now). * `tests/test_client_registration.py` (covered the removed Python). * `TestAuthbridgeCombinedYAML_Loads` (asserted the deleted YAML). ## Renames * `cmd/authbridge/Dockerfile` → `cmd/authbridge/Dockerfile.envoy` * `cmd/authbridge/Dockerfile.light` → `cmd/authbridge/Dockerfile.proxy` * `cmd/authbridge/entrypoint.sh` → `cmd/authbridge/entrypoint-envoy.sh` The proxy variant uses `authbridge-proxy` (lite binary from PR #407, no gRPC, no envoy types) and switches base from distroless/static to alpine. Distroless/static has no shell, which the bash supervisor needs; alpine is +3 MB but has bash readily and matches the envoy variant's pattern. Image size ends up around ~48 MB (vs ~12 MB for the no-spiffe-helper variant) — spiffe-helper bundle is the bulk; size optimization is deferred to a follow-up. The envoy variant adds spiffe-helper to the existing UBI9-micro base (already has bash + glibc, both required). Image size ~165 MB (vs ~141 MB without spiffe-helper). ## CI matrix Drops 6 entries (client-registration, auth-proxy, spiffe-helper, authbridge-unified, authbridge-light, demo-app), retains 3: * `proxy-init` (still needed for envoy-sidecar mode iptables) * `authbridge-envoy` * `authbridge` The `auth-proxy` and `demo-app` source files stay in-tree for the standalone quickstart; just not built/published by CI. ## Out of scope (Phases B + C) Operator + chart coordination: * kagenti-operator must flip default mode from envoy-sidecar to proxy-sidecar. * Operator's image-name slot for proxy-sidecar mode (`Images.AuthBridgeLight`) should be renamed and pointed at the new `authbridge` image. The new image bundles spiffe-helper, so the operator should stop injecting spiffe-helper as a separate sidecar in proxy-sidecar mode (envoy-sidecar mode unchanged). * `combinedSidecar` feature gate cleanup. * kagenti chart values pin update. These changes don't break anything in this PR because operator/chart pin to existing image tags published by older releases of this repo. A new release should not be cut from this branch until B + C are ready. ## Verification * `go build ./...` clean across authlib, cmd/authbridge, cmd/authbridge-proxy, cmd/authbridge-envoy. * `go test -race ./...` passes in authlib + cmd/authbridge. * `podman build` succeeds for both Dockerfiles. * Built image sizes (linux/amd64): authbridge:test 47.8 MB authbridge-envoy:test 165 MB ## Follow-ups (not blocking) * Demo manifests in `authbridge/demos/**/k8s/` reference deleted image names — update after Phase B + C land. Most likely require rewriting the deployment shape (proxy-sidecar default), so delaying until operator semantics settle is correct. * Doc references in `authbridge/README.md`, `authbridge/docs/*`, `authbridge/cmd/authbridge/README.md`, `LOCAL_TESTING_GUIDE.md`, `local-build-and-test.sh` — find/replace pass. Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- .github/workflows/build.yaml | 51 +-- CLAUDE.md | 85 ++-- authbridge/CLAUDE.md | 47 ++- authbridge/authlib/config/resolve.go | 11 +- authbridge/authlib/pipeline/plugin.go | 4 +- .../authlib/plugins/jwtvalidation/plugin.go | 21 +- authbridge/authlib/plugins/plugins_test.go | 41 -- .../authlib/plugins/tokenexchange/plugin.go | 2 +- authbridge/authproxy/Dockerfile.authbridge | 54 --- authbridge/authproxy/authbridge-combined.yaml | 45 -- authbridge/authproxy/entrypoint-authbridge.sh | 101 ----- authbridge/client-registration/Dockerfile | 27 -- authbridge/client-registration/README.md | 386 ------------------ .../client_registration.py | 358 ---------------- .../example_deployment.yaml | 108 ----- .../example_deployment_spiffe.yaml | 165 -------- .../client-registration/images/clients.png | Bin 141887 -> 0 bytes .../images/clients_with_spire.png | Bin 145011 -> 0 bytes .../client-registration/requirements.txt | 4 - .../{Dockerfile => Dockerfile.envoy} | 28 +- authbridge/cmd/authbridge/Dockerfile.light | 33 -- authbridge/cmd/authbridge/Dockerfile.proxy | 49 +++ authbridge/cmd/authbridge/entrypoint-envoy.sh | 58 +++ authbridge/cmd/authbridge/entrypoint-proxy.sh | 48 +++ authbridge/cmd/authbridge/entrypoint.sh | 40 -- authbridge/spiffe-helper/Dockerfile | 27 -- tests/test_client_registration.py | 243 ----------- 27 files changed, 276 insertions(+), 1760 deletions(-) delete mode 100644 authbridge/authproxy/Dockerfile.authbridge delete mode 100644 authbridge/authproxy/authbridge-combined.yaml delete mode 100644 authbridge/authproxy/entrypoint-authbridge.sh delete mode 100644 authbridge/client-registration/Dockerfile delete mode 100644 authbridge/client-registration/README.md delete mode 100644 authbridge/client-registration/client_registration.py delete mode 100644 authbridge/client-registration/example_deployment.yaml delete mode 100644 authbridge/client-registration/example_deployment_spiffe.yaml delete mode 100644 authbridge/client-registration/images/clients.png delete mode 100644 authbridge/client-registration/images/clients_with_spire.png delete mode 100644 authbridge/client-registration/requirements.txt rename authbridge/cmd/authbridge/{Dockerfile => Dockerfile.envoy} (51%) delete mode 100644 authbridge/cmd/authbridge/Dockerfile.light create mode 100644 authbridge/cmd/authbridge/Dockerfile.proxy create mode 100644 authbridge/cmd/authbridge/entrypoint-envoy.sh create mode 100644 authbridge/cmd/authbridge/entrypoint-proxy.sh delete mode 100644 authbridge/cmd/authbridge/entrypoint.sh delete mode 100644 authbridge/spiffe-helper/Dockerfile delete mode 100644 tests/test_client_registration.py diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 293dca512..09cc047c6 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -22,53 +22,26 @@ jobs: strategy: matrix: image_config: - # Client Registration - registers workloads with Keycloak using SPIFFE ID - - name: client-registration - context: ./authbridge/client-registration - dockerfile: Dockerfile - - # AuthProxy components - token exchange and traffic interception - - name: auth-proxy - context: ./authbridge/authproxy - dockerfile: Dockerfile - + # iptables init container — used by envoy-sidecar mode to + # set up traffic redirection. Proxy-sidecar mode does not + # need this (HTTP_PROXY env var routing replaces iptables). - name: proxy-init context: ./authbridge/authproxy dockerfile: Dockerfile.init - # SPIFFE Helper - fetches SPIFFE credentials from SPIRE (UBI-based fork) - - name: spiffe-helper - context: ./authbridge/spiffe-helper - dockerfile: Dockerfile - - # Combined AuthBridge sidecar (envoy + authbridge + spiffe-helper + client-registration) - - name: authbridge - context: ./authbridge - dockerfile: authproxy/Dockerfile.authbridge - - # Unified AuthBridge binary (Envoy + authbridge in one container) - # Drop-in replacement for envoy-with-processor - # DEPRECATED: use authbridge-envoy instead - - name: authbridge-unified - context: ./authbridge - dockerfile: cmd/authbridge/Dockerfile - - # AuthBridge with Envoy (envoy-sidecar mode) - # New canonical name for authbridge-unified + # AuthBridge envoy-sidecar combined image — + # Envoy + authbridge (ext_proc) + spiffe-helper. Spiffe-helper + # starts conditionally based on SPIRE_ENABLED. - name: authbridge-envoy context: ./authbridge - dockerfile: cmd/authbridge/Dockerfile + dockerfile: cmd/authbridge/Dockerfile.envoy - # Lightweight AuthBridge (Go binary only, no Envoy) - # Used for waypoint and proxy-sidecar modes - - name: authbridge-light + # AuthBridge proxy-sidecar combined image (default mode) — + # authbridge-proxy + spiffe-helper. No Envoy, no gRPC. + # Spiffe-helper starts conditionally based on SPIRE_ENABLED. + - name: authbridge context: ./authbridge - dockerfile: cmd/authbridge/Dockerfile.light - - # Demo application for testing - - name: demo-app - context: ./authbridge/authproxy/quickstart/demo-app - dockerfile: Dockerfile + dockerfile: cmd/authbridge/Dockerfile.proxy steps: # 1. Checkout code diff --git a/CLAUDE.md b/CLAUDE.md index a1f3fde72..bfb5b675b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -30,18 +30,20 @@ kagenti-extensions/ │ │ ├── routing/ # Host-to-audience router │ │ ├── auth/ # HandleInbound + HandleOutbound composition │ │ └── config/ # Mode presets, YAML config, validation -│ ├── cmd/authbridge/ # Unified binary — 3 modes, 1 codebase -│ │ ├── listener/ # Protocol adapters (ext_proc, ext_authz, forward/reverse proxy) -│ │ ├── entrypoint.sh # Envoy + authbridge process supervision -│ │ └── Dockerfile # Combined Envoy + authbridge image -│ ├── authproxy/ # Auth proxy support files and demos +│ ├── cmd/authbridge/ # Unified binary + combined Dockerfiles + entrypoints +│ │ ├── listener/ # Protocol adapters (ext_proc, ext_authz) +│ │ ├── Dockerfile.envoy # envoy-sidecar combined image +│ │ ├── Dockerfile.proxy # proxy-sidecar combined image (default) +│ │ ├── entrypoint-envoy.sh +│ │ └── entrypoint-proxy.sh +│ ├── cmd/authbridge-proxy/ # Lite binary — proxy-sidecar mode only +│ ├── cmd/authbridge-envoy/ # Lite binary — envoy-sidecar mode only +│ ├── authproxy/ # iptables init container + standalone quickstart │ │ ├── quickstart/ # Standalone demo (no SPIFFE) │ │ └── k8s/ # Standalone K8s manifests -│ ├── client-registration/ # Keycloak auto-registration (Python) -│ ├── spiffe-helper/ # SPIFFE helper Dockerfile (fetches JWT-SVIDs from SPIRE) │ ├── demos/ # Demo scenarios (weather-agent, github-issue, webhook, single-target, multi-target) │ └── keycloak_sync.py # Declarative Keycloak sync tool -├── tests/ # Python tests (client-registration, keycloak_sync) +├── tests/ # Python tests (keycloak_sync) ├── .github/ │ ├── workflows/ # CI/CD (ci.yaml, build.yaml, security-scans, scorecard, spellcheck) │ └── ISSUE_TEMPLATE/ # Bug report, feature request, epic templates @@ -68,38 +70,42 @@ A **single binary** providing transparent traffic interception for both inbound **Ports:** 15123 (outbound), 15124 (inbound), 9090 (ext-proc/ext-authz), 9901 (admin), 9093 (stats and config) -### 2. Client Registration (Python) +### 2. Client Registration -A Python script that **automatically registers Kubernetes workloads as Keycloak OAuth2 clients** using their SPIFFE identity. - -**Location:** `authbridge/client-registration/` -**Language:** Python 3.12 -**Detailed guide:** [`authbridge/CLAUDE.md`](authbridge/CLAUDE.md) - -**Flow:** Reads SPIFFE ID from JWT, registers client in Keycloak, writes secret to `/shared/client-secret.txt` +Keycloak client registration for workloads is handled by the +**kagenti-operator** (separate repo) — see `kagenti-operator/docs/operator-managed-client-registration.md`. +The operator creates a Secret with `client-id.txt` + `client-secret.txt` +and the webhook mounts it at `/shared/` in the workload pod. The +in-pod `client-registration` sidecar that previously lived in this +repo has been removed. ## How the Components Work Together -The kagenti-operator (in a separate repo) injects AuthBridge sidecars into workload pods. Once injected, the sidecars work together: +The kagenti-operator (in a separate repo) injects AuthBridge sidecars +into workload pods. Default deployment shape (proxy-sidecar mode): ``` ┌────────────────────────────────────┐ │ WORKLOAD POD │ │ │ - │ proxy-init (init) ─► iptables │ - │ │ - │ spiffe-helper ──► SPIRE Agent │ - │ │ writes JWT SVID │ - │ ▼ │ - │ client-registration ──► Keycloak │ - │ │ writes client secret │ - │ ▼ │ - │ envoy-proxy (+ authbridge) │ - │ - Inbound: JWT validation │ - │ - Outbound: token exchange │ + │ spiffe-helper ──► SPIRE Agent │ (in-container, + │ │ writes JWT SVID │ conditional on + │ ▼ │ SPIRE_ENABLED) + │ authbridge-proxy │ + │ - Reverse proxy: inbound JWT │ + │ - Forward proxy: outbound │ + │ token exchange │ │ │ │ │ Your Application │ + │ (HTTP_PROXY → forward proxy) │ └────────────────────────────────────┘ + + The operator also creates a Secret with client-id + + client-secret and mounts it at /shared/. + + For envoy-sidecar mode, replace authbridge-proxy with + the authbridge-envoy image (Envoy + ext_proc + spiffe-helper) + and add a proxy-init container for iptables. ``` ## Unified AuthBridge Binary @@ -146,17 +152,24 @@ Types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci` ## Container Images -All images are pushed to `ghcr.io/kagenti/kagenti-extensions/`: +All images are pushed to `ghcr.io/kagenti/kagenti-extensions/` from +`.github/workflows/build.yaml`: | Image | Source | Description | |-------|--------|-------------| -| **`authbridge-unified`** | **`authbridge/cmd/authbridge/Dockerfile`** | **Unified Envoy + authbridge binary (recommended)** | -| `authbridge` | `authbridge/authproxy/Dockerfile.authbridge` | Combined sidecar (Envoy + authbridge + spiffe-helper + client-registration) | -| `proxy-init` | `authbridge/authproxy/Dockerfile.init` | Alpine + iptables init container | -| `client-registration` | `authbridge/client-registration/Dockerfile` | Python Keycloak client registrar | -| `spiffe-helper` | `authbridge/spiffe-helper/Dockerfile` | Fetches SPIFFE credentials from SPIRE | -| `auth-proxy` | `authbridge/authproxy/Dockerfile` | Example pass-through proxy (for demos) | -| `demo-app` | `authbridge/authproxy/quickstart/demo-app/Dockerfile` | Demo target service | +| **`authbridge`** | **`authbridge/cmd/authbridge/Dockerfile.proxy`** | **proxy-sidecar combined image (default mode): authbridge-proxy + spiffe-helper. No Envoy.** | +| `authbridge-envoy` | `authbridge/cmd/authbridge/Dockerfile.envoy` | envoy-sidecar combined image: Envoy + authbridge (ext_proc) + spiffe-helper | +| `proxy-init` | `authbridge/authproxy/Dockerfile.init` | Alpine + iptables init container (envoy-sidecar mode only) | + +In both combined images, `spiffe-helper` is started conditionally based +on the `SPIRE_ENABLED` env var (set by the operator when SPIRE +identity is enabled for the workload). + +The legacy `authbridge-unified`, `authbridge-light`, `client-registration`, +`spiffe-helper`, `auth-proxy`, and `demo-app` standalone images have +been removed from CI (the auth-proxy / demo-app source is still in-tree +for the standalone quickstart). Older release tags continue to publish +the old images. ## Pre-commit Hooks diff --git a/authbridge/CLAUDE.md b/authbridge/CLAUDE.md index 0f2a08a5d..8ddfa2819 100644 --- a/authbridge/CLAUDE.md +++ b/authbridge/CLAUDE.md @@ -38,27 +38,26 @@ authbridge/ │ ├── auth/ # HandleInbound + HandleOutbound composition │ └── config/ # Mode presets, YAML config, validation │ -├── cmd/authbridge/ # Unified binary -- 3 modes, 1 codebase -│ ├── listener/ # Protocol adapters (ext_proc, ext_authz, forward/reverse proxy) -│ ├── entrypoint.sh # Envoy + authbridge process supervision -│ └── Dockerfile # Combined Envoy + authbridge image +├── cmd/authbridge/ # Unified binary — 3 listener modes, 1 codebase +│ ├── listener/extauthz/ # ext_authz adapter (waypoint mode) +│ ├── listener/extproc/ # ext_proc adapter (envoy-sidecar mode) +│ ├── Dockerfile.envoy # envoy-sidecar combined image (Envoy + authbridge + spiffe-helper) +│ ├── Dockerfile.proxy # proxy-sidecar combined image (authbridge-proxy + spiffe-helper) +│ ├── entrypoint-envoy.sh # Process supervisor for Dockerfile.envoy +│ └── entrypoint-proxy.sh # Process supervisor for Dockerfile.proxy │ -├── authproxy/ # Legacy sidecar support (iptables, quickstart) -│ ├── init-iptables.sh # iptables setup (outbound + inbound, Istio ambient compatible) +├── cmd/authbridge-proxy/ # Lite binary — proxy-sidecar mode only, no gRPC +│ +├── cmd/authbridge-envoy/ # Lite binary — envoy-sidecar mode only +│ +├── authproxy/ # iptables init container + standalone quickstart +│ ├── init-iptables.sh # iptables setup for envoy-sidecar mode │ ├── Dockerfile.init # proxy-init container image -│ ├── Dockerfile.authbridge # Combined sidecar image │ ├── k8s/ # Standalone K8s manifests │ └── quickstart/ # Standalone demo (no SPIFFE) │ ├── setup_keycloak.py │ └── demo-app/main.go # Test target: JWT validation (:8081), TLS echo (:8443) │ -├── client-registration/ # Keycloak auto-registration (Python) -│ ├── client_registration.py # Main script: register client, write secret -│ └── Dockerfile # Python 3.12-slim, UID/GID 1000 -│ -├── spiffe-helper/ # SPIFFE helper (Dockerfile only) -│ └── Dockerfile # Fetches JWT-SVIDs from SPIRE agent -│ ├── demos/ # Demo scenarios with full setup │ ├── README.md # Demo index (recommended starting order) │ ├── weather-agent/ # Getting-started demo (inbound validation only) @@ -116,7 +115,7 @@ with protocol-specific listeners in `cmd/authbridge/listener/`: - The operator-supplied env vars (`KEYCLOAK_URL`, `KEYCLOAK_REALM`, `TOKEN_URL`, `ISSUER`, `DEFAULT_OUTBOUND_POLICY`, `CLIENT_ID`) are consumed by the default `authbridge-combined.yaml` via `${VAR}` expansion — they land inside the appropriate plugin's `config:` block rather than a top-level section. - `jwt-validation` derives `jwks_url` from `issuer` when omitted (appends `/protocol/openid-connect/certs`). - `token-exchange` derives `token_url` from `keycloak_url + keycloak_realm` when omitted (Keycloak convention). -- Credential files: `client-registration` writes `/shared/client-id.txt` and `/shared/client-secret.txt`; `spiffe-helper` writes `/opt/jwt_svid.token`. `jwt-validation` reads the audience from `/shared/client-id.txt` via `audience_file`; `token-exchange` reads client credentials via `client_id_file` / `client_secret_file` / `jwt_svid_path`. Each plugin attempts a synchronous read at Configure time and falls back to a background poll from its `Init` goroutine if the file isn't yet readable. +- Credential files: the **kagenti-operator** registers each workload with Keycloak and creates a Secret containing `client-id.txt` + `client-secret.txt`; the operator's webhook mounts that Secret at `/shared/client-id.txt` and `/shared/client-secret.txt` in containers that share the `shared-data` volume. `spiffe-helper` (bundled in both combined images, started conditionally on `SPIRE_ENABLED=true`) writes `/opt/jwt_svid.token`. `jwt-validation` reads the audience from `/shared/client-id.txt` via `audience_file`; `token-exchange` reads client credentials via `client_id_file` / `client_secret_file` / `jwt_svid_path`. Each plugin attempts a synchronous read at Configure time and falls back to a background poll from its `Init` goroutine if the file isn't yet readable. The legacy in-pod `client-registration` sidecar has been removed; workloads opting back into that path use `kagenti.io/client-registration-inject: "true"` and the operator's bundled client-registration image (separate repo). - Outbound route config: `token-exchange` reads `/etc/authproxy/routes.yaml` by default (path is per-plugin, configured via `routes.file` in its config block); inline rules can be declared under `routes.rules`. - Outbound `default_policy`: `passthrough` (default) or `exchange`, configured per-plugin (no top-level `DEFAULT_OUTBOUND_POLICY` field anymore; the env var is still expanded into the plugin config by `authbridge-combined.yaml`). @@ -236,9 +235,9 @@ Sidecars communicate through files on shared volumes: | Path | Writer | Reader | Content | |------|--------|--------|---------| -| `/opt/jwt_svid.token` | spiffe-helper | client-registration | JWT SVID from SPIRE | -| `/shared/client-id.txt` | client-registration | authbridge | SPIFFE ID or CLIENT_NAME | -| `/shared/client-secret.txt` | client-registration | authbridge | Keycloak client secret | +| `/opt/jwt_svid.token` | spiffe-helper | authbridge (token-exchange) | JWT SVID from SPIRE | +| `/shared/client-id.txt` | operator (Secret mount) | authbridge | SPIFFE ID or workload name | +| `/shared/client-secret.txt` | operator (Secret mount) | authbridge | Keycloak client secret | ## Build and Deploy @@ -253,9 +252,15 @@ make build-images # Load into Kind cluster make load-images # Uses KIND_CLUSTER_NAME env var (default: kagenti) -# Build the authbridge-unified sidecar image separately (from authbridge/ context) -cd .. && podman build -f cmd/authbridge/Dockerfile -t authbridge-unified:latest . -kind load docker-image authbridge-unified:latest --name kagenti +# Build the combined sidecar images (from authbridge/ context). +# Pick the one matching your deployment mode: +# +# authbridge-envoy = Envoy + authbridge (ext_proc) + spiffe-helper +# authbridge = authbridge-proxy + spiffe-helper (default mode, no Envoy) +cd .. && podman build -f cmd/authbridge/Dockerfile.envoy -t authbridge-envoy:latest . +podman build -f cmd/authbridge/Dockerfile.proxy -t authbridge:latest . +kind load docker-image authbridge-envoy:latest --name kagenti +kind load docker-image authbridge:latest --name kagenti # Deploy auth-proxy + demo-app make deploy diff --git a/authbridge/authlib/config/resolve.go b/authbridge/authlib/config/resolve.go index 78dc970e0..3448a9d4d 100644 --- a/authbridge/authlib/config/resolve.go +++ b/authbridge/authlib/config/resolve.go @@ -18,9 +18,10 @@ import ( // ReadCredentialFile performs a one-shot read of a credential file, // returning its whitespace-trimmed contents. Used by plugins from -// Configure to opportunistically pick up values that client-registration -// has already written; when it returns an error, the plugin should fall -// back to WaitForCredentialFile from Init to wait for the file. +// Configure to opportunistically pick up values the operator has +// already mounted from a Secret; when it returns an error, the +// plugin should fall back to WaitForCredentialFile from Init to wait +// for the file. func ReadCredentialFile(path string) (string, error) { info, err := os.Stat(path) if err != nil { @@ -45,8 +46,8 @@ var heartbeatInterval = 60 * time.Second // WaitForCredentialFile blocks until the file is readable with non-zero // length, or until ctx is cancelled. Plugins call this from Init (via a -// goroutine) to wait out the race with client-registration's secret -// provisioning. +// goroutine) to wait out the race with the operator's Secret-mount +// propagation. // // Polls at 2s intervals — fast enough for human-observable boot times, // slow enough that a pod full of plugins isn't hammering the kubelet. diff --git a/authbridge/authlib/pipeline/plugin.go b/authbridge/authlib/pipeline/plugin.go index 9428828ea..199fe1aea 100644 --- a/authbridge/authlib/pipeline/plugin.go +++ b/authbridge/authlib/pipeline/plugin.go @@ -203,8 +203,8 @@ type Finisher interface { // ANDs Ready() across all implementers to decide whether the pipeline // is ready to serve traffic. A plugin whose Configure succeeded but // whose Init is still waiting (e.g. for a credential file to be -// written by client-registration) returns false — the kubelet keeps -// traffic off the pod until Init completes. +// mounted by the operator from a Secret) returns false — the kubelet +// keeps traffic off the pod until Init completes. // // Plugins without deferred state don't implement this interface and // are treated as always-ready. Pipeline.Ready() returns true when diff --git a/authbridge/authlib/plugins/jwtvalidation/plugin.go b/authbridge/authlib/plugins/jwtvalidation/plugin.go index 08740aafa..cf1449be3 100644 --- a/authbridge/authlib/plugins/jwtvalidation/plugin.go +++ b/authbridge/authlib/plugins/jwtvalidation/plugin.go @@ -61,9 +61,10 @@ type jwtValidationConfig struct { Audience string `json:"audience"` // AudienceFile reads the expected audience from a file. Used - // together with client-registration's /shared/client-id.txt. The - // file may not exist at Configure time; a background poll started - // by Init waits for it and updates the plugin when it appears. + // together with /shared/client-id.txt (mounted by the operator + // from a Keycloak-credentials Secret). The file may not exist at + // Configure time; a background poll started by Init waits for it + // and updates the plugin when it appears. // // Note: an empty-string value is treated as "unset" — applyDefaults // will fill in /shared/client-id.txt. To opt out of any file poll, @@ -100,9 +101,9 @@ func (c *jwtValidationConfig) applyDefaults() { c.AudienceMode = "static" } // When neither Audience nor AudienceFile is set, fall back to the - // Kagenti convention: client-registration writes the agent's client - // ID (which doubles as the inbound audience) to this path. - // Deployments that don't run client-registration should set + // Kagenti convention: the operator's webhook mounts a Secret + // containing the agent's client ID (which doubles as the inbound + // audience) at this path. Deployments outside Kagenti should set // Audience explicitly — the Configure-time read is best-effort and // Init's poll will give up silently if ctx is cancelled. if c.AudienceMode == "static" && c.Audience == "" && c.AudienceFile == "" { @@ -146,8 +147,8 @@ type JWTValidation struct { // bgCancel stops the background audience-file poller started by // Init. It's created with context.Background() (not Init's ctx) so // the poller's lifetime is the plugin's lifetime, not Start's - // 60-second budget — otherwise a slow client-registration during - // pod boot would orphan the plugin after the initCtx deadline. + // 60-second budget — otherwise a slow Secret-mount propagation + // during pod boot would orphan the plugin after the initCtx deadline. // // Held in an atomic.Pointer so a future caller can invoke Shutdown // from a goroutine other than the one that ran Init without racing @@ -173,8 +174,8 @@ func (p *JWTValidation) Capabilities() pipeline.PluginCapabilities { // Configure decodes the plugin's config subtree, applies defaults, // validates, and constructs the internal auth handler. If AudienceFile -// is set but the file isn't yet readable (client-registration still -// provisioning during pod boot), the handler is created with an empty +// is set but the file isn't yet readable (Secret mount still +// propagating during pod boot), the handler is created with an empty // audience and Init's goroutine fills it in when the file appears. func (p *JWTValidation) Configure(raw json.RawMessage) error { var c jwtValidationConfig diff --git a/authbridge/authlib/plugins/plugins_test.go b/authbridge/authlib/plugins/plugins_test.go index 32ddc905f..850ed2f37 100644 --- a/authbridge/authlib/plugins/plugins_test.go +++ b/authbridge/authlib/plugins/plugins_test.go @@ -3,8 +3,6 @@ package plugins_test import ( "context" "net/http" - "os" - "path/filepath" "strings" "testing" @@ -50,45 +48,6 @@ func TestBuiltinsRegistered(t *testing.T) { } } -// TestAuthbridgeCombinedYAML_Loads asserts that the in-repo default -// config consumed by the combined sidecar image parses and produces -// working pipelines. A future rename of any plugin default constant -// that silently breaks the shipped image fails this test first. -func TestAuthbridgeCombinedYAML_Loads(t *testing.T) { - yamlPath := filepath.Join("..", "..", "authproxy", "authbridge-combined.yaml") - if _, err := os.Stat(yamlPath); err != nil { - t.Skipf("authbridge-combined.yaml not found (repo layout changed?): %v", err) - } - - envs := map[string]string{ - "ISSUER": "http://keycloak.localtest.me:8080/realms/kagenti", - "KEYCLOAK_URL": "http://keycloak-service.keycloak.svc:8080", - "KEYCLOAK_REALM": "kagenti", - "DEFAULT_OUTBOUND_POLICY": "passthrough", - "TOKEN_URL": "", - } - for k, v := range envs { - t.Setenv(k, v) - } - - cfg, err := config.Load(yamlPath) - if err != nil { - t.Fatalf("Load(%s): %v", yamlPath, err) - } - if cfg.Mode != config.ModeEnvoySidecar { - t.Errorf("mode = %q, want %q", cfg.Mode, config.ModeEnvoySidecar) - } - if err := config.Validate(cfg); err != nil { - t.Errorf("Validate: %v", err) - } - if _, err := plugins.Build(cfg.Pipeline.Inbound.Plugins); err != nil { - t.Errorf("Build inbound: %v", err) - } - if _, err := plugins.Build(cfg.Pipeline.Outbound.Plugins); err != nil { - t.Errorf("Build outbound: %v", err) - } -} - // --- Stats aggregation --- func TestCollectStats_CollectsOnlyStatsSources(t *testing.T) { diff --git a/authbridge/authlib/plugins/tokenexchange/plugin.go b/authbridge/authlib/plugins/tokenexchange/plugin.go index 439488744..9809c0bed 100644 --- a/authbridge/authlib/plugins/tokenexchange/plugin.go +++ b/authbridge/authlib/plugins/tokenexchange/plugin.go @@ -333,7 +333,7 @@ func credentialsAreReady(id tokenExchangeIdentity) bool { return id.ClientSecret != "" case "spiffe": // JWT-SVID source reads the file lazily; existence of ClientID - // is the signal that client-registration has completed. + // is the signal that the operator's Secret mount has completed. return true } return false diff --git a/authbridge/authproxy/Dockerfile.authbridge b/authbridge/authproxy/Dockerfile.authbridge deleted file mode 100644 index b09b1e115..000000000 --- a/authbridge/authproxy/Dockerfile.authbridge +++ /dev/null @@ -1,54 +0,0 @@ -# Combined AuthBridge sidecar image -# Includes: Envoy proxy, unified authbridge binary, spiffe-helper, client-registration (Python) -# -# Build context: ./authbridge (needs access to authlib/, cmd/authbridge/, and client-registration/) - -# Stage 1: Build unified authbridge binary -FROM golang:1.26.2-alpine AS go-builder - -RUN apk add --no-cache git - -WORKDIR /app - -# Copy go.mod/go.sum first for better Docker layer caching — -# dependency layer is only invalidated when go.mod/go.sum change. -COPY cmd/authbridge/go.mod cmd/authbridge/go.sum cmd/authbridge/ -COPY authlib/go.mod authlib/go.sum authlib/ -ENV GOWORK=off -RUN cd cmd/authbridge && go mod download - -COPY authlib/ authlib/ -COPY cmd/authbridge/ cmd/authbridge/ - -RUN cd cmd/authbridge && CGO_ENABLED=0 GOOS=linux go build -o /authbridge . - -# Stage 2: Get spiffe-helper binary -FROM ghcr.io/spiffe/spiffe-helper:0.11.0 AS spiffe - -# Stage 3: Combined runtime -FROM docker.io/envoyproxy/envoy:v1.37.2 - -USER root -RUN apt-get update && \ - apt-get install -y --no-install-recommends ca-certificates python3 python3-pip && \ - rm -rf /var/lib/apt/lists/* - -# Copy binaries -COPY --from=go-builder /authbridge /usr/local/bin/authbridge -COPY --from=spiffe /spiffe-helper /usr/local/bin/spiffe-helper - -# Copy client-registration Python code -COPY client-registration/client_registration.py /app/ -COPY client-registration/requirements.txt /app/ -RUN pip3 install --no-cache-dir -r /app/requirements.txt - -# Copy entrypoint and default config -COPY authproxy/entrypoint-authbridge.sh /usr/local/bin/entrypoint-authbridge.sh -COPY authproxy/authbridge-combined.yaml /etc/authbridge/config.yaml -RUN chmod +x /usr/local/bin/entrypoint-authbridge.sh - -USER 1337 - -EXPOSE 15123 15124 9090 9901 - -ENTRYPOINT ["/usr/local/bin/entrypoint-authbridge.sh"] diff --git a/authbridge/authproxy/authbridge-combined.yaml b/authbridge/authproxy/authbridge-combined.yaml deleted file mode 100644 index b4bcf5515..000000000 --- a/authbridge/authproxy/authbridge-combined.yaml +++ /dev/null @@ -1,45 +0,0 @@ -# Default config for the combined AuthBridge sidecar image. -# Env vars are expanded at startup by the unified binary's config loader. -# These env vars match the operator's ConfigMap contract (authbridge-config). -# At runtime they land on the sidecar via envFrom on the Deployment — -# injected by the kagenti-operator admission webhook (or by the chart -# template for pre-declared namespaces). Keys are listed in -# authbridge/CLAUDE.md "Required ConfigMaps for Webhook Injection". -# -# Plugin settings live under pipeline.*.plugins[].config; see -# authbridge/docs/plugin-reference.md for the per-plugin schema. -# Fields omitted below fall back to plugin defaults — notably: -# jwt-validation: audience_file=/shared/client-id.txt, bypass_paths -# = .well-known/* + health/ready/live probes, -# jwks_url derived from keycloak_url + keycloak_realm -# (internal URL; see split-horizon note below). -# token-exchange: identity file paths under /shared/, jwt_svid_path -# =/opt/jwt_svid.token, routes.file -# =/etc/authproxy/routes.yaml -# -# Split-horizon DNS note: `issuer` is the PUBLIC Keycloak URL (matches -# the `iss` claim Keycloak stamps on tokens); `keycloak_url` is the -# INTERNAL service URL that the sidecar actually reaches. The -# jwt-validation plugin uses the latter to build its JWKS fetch URL, -# which is why KEYCLOAK_URL has to be passed into inbound as well as -# outbound — even though pre-PR-#378 the binary derived jwks_url from -# outbound.token_url via a cross-plugin pass. -mode: envoy-sidecar - -pipeline: - inbound: - plugins: - - name: jwt-validation - config: - issuer: "${ISSUER}" - keycloak_url: "${KEYCLOAK_URL}" - keycloak_realm: "${KEYCLOAK_REALM}" - outbound: - plugins: - - name: token-exchange - config: - keycloak_url: "${KEYCLOAK_URL}" - keycloak_realm: "${KEYCLOAK_REALM}" - default_policy: "${DEFAULT_OUTBOUND_POLICY}" - identity: - type: "client-secret" diff --git a/authbridge/authproxy/entrypoint-authbridge.sh b/authbridge/authproxy/entrypoint-authbridge.sh deleted file mode 100644 index 57c125960..000000000 --- a/authbridge/authproxy/entrypoint-authbridge.sh +++ /dev/null @@ -1,101 +0,0 @@ -#!/bin/bash -set -eu - -# AuthBridge combined entrypoint with process supervision. -# Manages: spiffe-helper, client-registration, authbridge (unified binary), envoy -# -# Startup order preserves current multi-container timing: -# 1. spiffe-helper (background, long-running) -- writes JWT SVID -# 2. authbridge (background) -- resolves credentials lazily via file polling -# 3. client-registration (background one-shot) -- writes credentials when ready -# 4. envoy (background) -- inbound JWT validation works immediately -# -# Runs as UID 1337 (Envoy UID, excluded from iptables redirect). -# -# Process management: The shell stays as PID 1 and monitors critical long-running -# processes (envoy, authbridge, spiffe-helper). If any critical process exits, -# all others are killed and the container exits non-zero so Kubernetes restarts it. -# Client-registration is a one-shot process and is NOT monitored -- authbridge -# handles missing credentials gracefully via passthrough mode. - -# PIDs of critical long-running processes to monitor. -CRITICAL_PIDS="" - -cleanup() { - echo "[AuthBridge] Received signal, shutting down..." - # shellcheck disable=SC2086 - kill $CRITICAL_PIDS 2>/dev/null || true - wait - exit 0 -} -trap cleanup TERM INT - -# --- Phase 1: Start spiffe-helper (if enabled) --- -if [ "${SPIRE_ENABLED:-}" = "true" ]; then - echo "[AuthBridge] Starting spiffe-helper..." - /usr/local/bin/spiffe-helper -config=/etc/spiffe-helper/helper.conf run & - CRITICAL_PIDS="$CRITICAL_PIDS $!" -fi - -# --- Phase 2: Start authbridge (unified binary) --- -# authbridge resolves credentials lazily via file polling (60s timeout). -# The gRPC listener starts immediately so Envoy can connect without waiting. -echo "[AuthBridge] Starting authbridge..." -/usr/local/bin/authbridge --config /etc/authbridge/config.yaml & -CRITICAL_PIDS="$CRITICAL_PIDS $!" -sleep 2 - -# --- Phase 3: Start client-registration (background, non-blocking) --- -# This runs asynchronously so Envoy starts immediately. -# Failures are non-fatal: authbridge handles missing credentials gracefully. -# NOT added to CRITICAL_PIDS -- this is a one-shot process. -( - if [ "${SPIRE_ENABLED:-}" = "true" ]; then - echo "[AuthBridge] Waiting for SPIFFE credentials..." - while [ ! -f /opt/jwt_svid.token ]; do sleep 1; done - echo "[AuthBridge] SPIFFE credentials ready" - - # Extract client ID from JWT SVID payload. - # Each step is validated individually to avoid silent failures in the pipeline. - JWT_PAYLOAD=$(cut -d'.' -f2 < /opt/jwt_svid.token) - if [ -z "$JWT_PAYLOAD" ]; then - echo "[AuthBridge] ERROR: Failed to extract JWT payload from SVID" >&2 - fi - CLIENT_ID=$(echo "${JWT_PAYLOAD}==" | base64 -d 2>/dev/null | \ - python3 -c "import sys,json; print(json.load(sys.stdin).get('sub',''))") - if [ -z "$CLIENT_ID" ]; then - echo "[AuthBridge] ERROR: Failed to decode client ID from JWT SVID" >&2 - fi - echo "$CLIENT_ID" > /shared/client-id.txt - echo "[AuthBridge] Client ID (SPIFFE ID): $CLIENT_ID" - else - echo "$CLIENT_NAME" > /shared/client-id.txt - echo "[AuthBridge] Client ID: $CLIENT_NAME" - fi - - if [ "${CLIENT_REGISTRATION_ENABLED:-}" != "false" ]; then - echo "[AuthBridge] Starting client registration..." - python3 /app/client_registration.py || \ - echo "[AuthBridge] WARNING: Client registration failed, continuing without" - echo "[AuthBridge] Client registration phase complete" - fi -) & - -# --- Phase 4: Start Envoy (background) --- -# Envoy runs in the background so the shell can monitor all critical processes. -# Kubernetes sends SIGTERM to PID 1 (this shell), which forwards via trap. -echo "[AuthBridge] Starting Envoy..." -/usr/local/bin/envoy -c /etc/envoy/envoy.yaml \ - --service-cluster auth-proxy --service-node auth-proxy & -CRITICAL_PIDS="$CRITICAL_PIDS $!" - -# Wait for the first critical process to exit. -# If any critical process dies, restart the container. -# shellcheck disable=SC2086 -wait -n $CRITICAL_PIDS -EXIT_CODE=$? -echo "[AuthBridge] A critical process exited unexpectedly (exit code $EXIT_CODE), terminating container" -# shellcheck disable=SC2086 -kill $CRITICAL_PIDS 2>/dev/null || true -wait -exit 1 diff --git a/authbridge/client-registration/Dockerfile b/authbridge/client-registration/Dockerfile deleted file mode 100644 index f5a8145c0..000000000 --- a/authbridge/client-registration/Dockerfile +++ /dev/null @@ -1,27 +0,0 @@ -# Use minimal Python base image -FROM python:3.14-slim - -# Create non-root user with UID/GID 1000 (matches spiffe-helper and fsGroup) -# IMPORTANT: These values MUST match the runAsUser/runAsGroup set by the -# operator's webhook when injecting the client-registration container. -# See https://github.com/kagenti/kagenti-operator -RUN groupadd -g 1000 appuser && useradd -u 1000 -g appuser appuser - -# Set work directory -WORKDIR /app - -# Copy your script -COPY client_registration.py . - -# Install dependencies -COPY requirements.txt . -RUN pip install --no-cache-dir -r requirements.txt - -# Ensure non-root user owns application directory -RUN chown -R 1000:1000 /app - -# Switch to non-root user -USER 1000:1000 - -# Register client -CMD ["python", "client_registration.py"] diff --git a/authbridge/client-registration/README.md b/authbridge/client-registration/README.md deleted file mode 100644 index 55675283a..000000000 --- a/authbridge/client-registration/README.md +++ /dev/null @@ -1,386 +0,0 @@ -# Client Registration - -Client Registration is an **automated OAuth2/OIDC client provisioning** tool for Kubernetes workloads. It automatically registers pods as Keycloak clients, eliminating the need for manual client configuration and static credentials. - -## What Client Registration Does - -Client Registration solves a common challenge in Kubernetes environments: **how can workloads authenticate to OAuth2/OIDC providers without pre-provisioned static credentials?** - -### The Problem - -Traditional OAuth2 authentication requires: -1. Pre-creating clients in Keycloak for each service -2. Generating and distributing client secrets -3. Managing secret rotation manually -4. Tracking which client belongs to which workload - -``` -┌─────────────────┐ ┌─────────────────┐ -│ Admin │ │ Keycloak │ -│ │─────────│ │ -│ 1. Create client│ Manual │ Client: svc-a │ -│ 2. Copy secret │ Process │ Secret: │ -│ 3. Create K8s │ │ │ -│ secret │ │ │ -└─────────────────┘ └─────────────────┘ - │ - ▼ Manual secret distribution -┌─────────────────┐ -│ Workload Pod │ -│ (uses secret) │ -└─────────────────┘ -``` - -### The Solution - -Client Registration automates this entire process: - -``` -┌─────────────────────────────────────────────────────────────────────┐ -│ POD │ -│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │ -│ │ SPIFFE Helper │───►│ Client │───►│ Application │ │ -│ │ (gets SVID) │ │ Registration │ │ (uses secret) │ │ -│ └─────────────────┘ └────────┬────────┘ └─────────────────┘ │ -│ │ │ -└──────────────────────────────────┼──────────────────────────────────┘ - │ - ┌──────────────▼──────────────┐ - │ Keycloak │ - │ │ - │ 1. Register client │ - │ (using SPIFFE ID) │ - │ 2. Generate secret │ - │ 3. Return credentials │ - └─────────────────────────────┘ -``` - -**Benefits:** -- **Zero manual configuration** - Clients are created automatically at pod startup -- **Cryptographic identity** - Uses SPIFFE ID as client identifier (unique, verifiable) -- **Dynamic secrets** - Each pod instance gets its own credentials -- **Self-service** - No admin intervention needed for new workloads - -## How It Works - -### With SPIFFE/SPIRE (Recommended) - -When SPIRE is enabled, the client registration uses the pod's **SPIFFE ID** as the Keycloak client ID: - -``` -SPIFFE ID: spiffe://localtest.me/ns/authbridge/sa/caller - └──────────┘ └─────────┘ └──────┘ - Trust Domain Namespace Service Account -``` - -1. **SPIFFE Helper** obtains a JWT SVID from the SPIRE Agent -2. **Client Registration** extracts the SPIFFE ID from the JWT's `sub` claim -3. **Client Registration** creates a Keycloak client with: - - `clientId`: The SPIFFE ID (e.g., `spiffe://localtest.me/ns/authbridge/sa/caller`) - - `name`: The friendly name from `CLIENT_NAME` env var -4. **Client Registration** retrieves the generated client secret -5. **Client Registration** writes the secret to a shared volume for the application to use - -### Without SPIFFE - -When SPIRE is not available, the client registration uses a static client name: - -1. **Client Registration** uses the `CLIENT_NAME` environment variable as both client ID and name -2. The rest of the flow is the same - -## Architecture - -```mermaid -sequenceDiagram - participant SPIRE as SPIRE Agent - participant Helper as SPIFFE Helper - participant Reg as Client Registration - participant KC as Keycloak - participant App as Application - - Note over Helper,SPIRE: Pod Startup - SPIRE->>Helper: Issue JWT SVID - Helper->>Helper: Write to /opt/jwt_svid.token - - Reg->>Reg: Wait for SVID file - Reg->>Reg: Extract SPIFFE ID from JWT - - Reg->>KC: Register client (SPIFFE ID) - KC-->>Reg: Client created - - Reg->>KC: Get client secret - KC-->>Reg: Secret value - - Reg->>Reg: Write to /shared/client-secret.txt - - App->>App: Read secret from shared volume - App->>KC: Authenticate with credentials -``` - -## Configuration - -### Environment Variables - -| Variable | Required | Description | Example | -|----------|----------|-------------|---------| -| `SPIRE_ENABLED` | No | Enable SPIFFE ID extraction (default: `false`) | `true` | -| `CLIENT_NAME` | Yes | Friendly name for the client | `my-service` | -| `KEYCLOAK_URL` | Yes* | Keycloak server URL (auto-derived from `TOKEN_URL` if not provided) | `http://keycloak:8080` | -| `KEYCLOAK_REALM` | Yes* | Keycloak realm name (auto-derived from `TOKEN_URL` if not provided) | `kagenti` | -| `TOKEN_URL` | No | Keycloak token endpoint (used to auto-derive `KEYCLOAK_URL` and `KEYCLOAK_REALM`) | `http://keycloak:8080/realms/kagenti/protocol/openid-connect/token` | -| `KEYCLOAK_ADMIN_USERNAME` | Yes | Admin username | `admin` | -| `KEYCLOAK_ADMIN_PASSWORD` | Yes | Admin password | `admin` | -| `KEYCLOAK_TOKEN_EXCHANGE_ENABLED` | No | Enable token exchange for client (default: `true`) | `true` | -| `KEYCLOAK_CLIENT_REGISTRATION_ENABLED` | No | Enable/disable registration (default: `true`) | `true` | -| `SECRET_FILE_PATH` | No | Path to write client secret (default: `/shared/client-secret.txt`) | `/shared/client-secret.txt` | - -**Note:** `KEYCLOAK_URL` and `KEYCLOAK_REALM` can be automatically derived from `TOKEN_URL` if not explicitly provided. For example: -- `TOKEN_URL`: `http://keycloak-service.keycloak.svc:8080/realms/kagenti/protocol/openid-connect/token` -- Derived `KEYCLOAK_URL`: `http://keycloak-service.keycloak.svc:8080` -- Derived `KEYCLOAK_REALM`: `kagenti` - -### Created Client Configuration - -The registered Keycloak client is configured with: - -| Setting | Value | Description | -|---------|-------|-------------| -| `clientId` | SPIFFE ID or CLIENT_NAME | Unique client identifier | -| `name` | CLIENT_NAME | Human-readable name | -| `publicClient` | `false` | Client authentication enabled (confidential client) | -| `serviceAccountsEnabled` | `true` | Allows `client_credentials` grant | -| `standardFlowEnabled` | `true` | Allows authorization code flow | -| `directAccessGrantsEnabled` | `true` | Allows password grant | -| `standard.token.exchange.enabled` | `true` | Allows token exchange | - -## Quick Start - -### Prerequisites - -- Kubernetes cluster -- Keycloak deployed and accessible -- (Optional) SPIRE installed for SPIFFE support - -### Usage with SPIFFE/SPIRE - -1. **Ensure SPIRE is installed** (see [SPIRE Installation](#install-spire)) - -2. **Deploy your workload with client-registration:** - -```yaml -apiVersion: apps/v1 -kind: Deployment -metadata: - name: my-app -spec: - template: - spec: - serviceAccountName: my-service-account - containers: - # Your application - - name: my-app - image: my-app:latest - volumeMounts: - - name: shared-data - mountPath: /shared - - # SPIFFE Helper - obtains SVID from SPIRE - - name: spiffe-helper - image: ghcr.io/spiffe/spiffe-helper:nightly - command: ["/spiffe-helper", "-config=/etc/spiffe-helper/helper.conf", "run"] - volumeMounts: - - name: spiffe-helper-config - mountPath: /etc/spiffe-helper - - name: spire-agent-socket - mountPath: /spiffe-workload-api - - name: svid-output - mountPath: /opt - - # Client Registration - registers with Keycloak - - name: client-registration - image: ghcr.io/kagenti/kagenti-extensions/client-registration:latest - command: - - /bin/sh - - -c - - | - while [ ! -f /opt/jwt_svid.token ]; do sleep 1; done - python client_registration.py - tail -f /dev/null - env: - - name: SPIRE_ENABLED - value: "true" - - name: CLIENT_NAME - value: "my-app" - - name: KEYCLOAK_URL - value: "http://keycloak-service.keycloak.svc:8080" - - name: KEYCLOAK_REALM - value: "kagenti" - - name: KEYCLOAK_ADMIN_USERNAME - value: "admin" - - name: KEYCLOAK_ADMIN_PASSWORD - value: "admin" - - name: SECRET_FILE_PATH - value: "/shared/client-secret.txt" - volumeMounts: - - name: shared-data - mountPath: /shared - - name: svid-output - mountPath: /opt - - volumes: - - name: shared-data - emptyDir: {} - - name: svid-output - emptyDir: {} - - name: spire-agent-socket - hostPath: - path: /run/spire/agent-sockets - - name: spiffe-helper-config - configMap: - name: spiffe-helper-config -``` - -3. **Verify registration:** - -```bash -# Check client-registration logs -kubectl logs deployment/my-app -c client-registration - -# Expected output: -# Created Keycloak client "spiffe://localtest.me/ns/default/sa/my-service-account": -# Successfully retrieved secret for client "my-app". -# Secret written to file: "/shared/client-secret.txt" -# Client registration complete. -``` - -4. **Use the credentials in your application:** - -```bash -# From inside your application container -CLIENT_SECRET=$(cat /shared/client-secret.txt) -CLIENT_ID="spiffe://localtest.me/ns/default/sa/my-service-account" - -# Get a token from Keycloak -curl -X POST http://keycloak:8080/realms/kagenti/protocol/openid-connect/token \ - -d "grant_type=client_credentials" \ - -d "client_id=$CLIENT_ID" \ - -d "client_secret=$CLIENT_SECRET" -``` - -### Usage without SPIFFE - -For environments without SPIRE, use a static client name: - -```yaml -- name: client-registration - image: ghcr.io/kagenti/kagenti-extensions/client-registration:latest - command: ["python", "client_registration.py"] - env: - - name: SPIRE_ENABLED - value: "false" - - name: CLIENT_NAME - value: "my-app" # Used as both client ID and name - # ... other env vars -``` - -## Installation - -### Install SPIRE - -If using SPIFFE, install SPIRE first: - -```bash -# Install SPIRE CRDs -helm upgrade --install spire-crds spire-crds \ - -n spire-mgmt \ - --repo https://spiffe.github.io/helm-charts-hardened/ \ - --create-namespace --wait - -# Install SPIRE (Server + Agent) -helm upgrade --install spire spire \ - -n spire-mgmt \ - --repo https://spiffe.github.io/helm-charts-hardened/ \ - -f https://raw.githubusercontent.com/kagenti/kagenti/main/kagenti/installer/app/resources/spire-helm-values.yaml -``` - -### Install Keycloak - -```bash -# Create namespace -kubectl apply -f "https://raw.githubusercontent.com/kagenti/kagenti/refs/heads/main/kagenti/installer/app/resources/keycloak-namespace.yaml" - -# Deploy Keycloak with Postgres -kubectl apply -f "https://raw.githubusercontent.com/kagenti/kagenti/refs/heads/main/kagenti/installer/app/resources/keycloak.yaml" -n keycloak - -# Wait for Keycloak to be ready -kubectl rollout status statefulset/keycloak -n keycloak --timeout=120s - -# Port forward to access Keycloak UI -kubectl port-forward service/keycloak-service -n keycloak 8080:8080 -``` - -Access Keycloak at http://keycloak.localtest.me:8080 (admin/admin) - -## Example Deployments - -### With SPIFFE - -```bash -kubectl apply -f example_deployment_spiffe.yaml -``` - -Creates: -- Namespace `my-agent` -- ServiceAccount `my-service-account` -- Deployment with SPIFFE Helper and Client Registration - -**Verify in Keycloak:** -Navigate to Clients and confirm a new client with SPIFFE ID: - -![Client with SPIFFE ID](images/clients_with_spire.png) - -### Without SPIFFE - -```bash -kubectl apply -f example_deployment.yaml -``` - -**Verify in Keycloak:** -Navigate to Clients and confirm a new client with static name: - -![Client without SPIFFE](images/clients.png) - -## Troubleshooting - -### Client Registration Fails to Connect to Keycloak - -**Symptom:** `Connection refused` or timeout errors - -**Fix:** Ensure the pod can reach Keycloak. If using AuthProxy with iptables, exclude Keycloak's port: -```yaml -env: - - name: OUTBOUND_PORTS_EXCLUDE - value: "8080" -``` - -### "Client not enabled to retrieve service account" - -**Symptom:** Token request fails with this error - -**Fix:** The client needs `serviceAccountsEnabled: true`. This is set by default in the latest version. For existing clients, enable it manually in Keycloak or delete and re-register. - -### SVID File Not Found - -**Symptom:** `Error: The file /opt/jwt_svid.token was not found` - -**Fix:** Ensure SPIFFE Helper is running and has access to the SPIRE Agent socket. Check: -```bash -kubectl logs deployment/my-app -c spiffe-helper -``` - -## Related Documentation - -- [AuthBridge Demo](../README.md) - Complete end-to-end demo -- [AuthProxy](../authproxy/README.md) - Token validation and exchange -- [SPIFFE/SPIRE Documentation](https://spiffe.io/docs/latest/) -- [Keycloak Client Registration](https://www.keycloak.org/docs/latest/securing_apps/#_client_registration) diff --git a/authbridge/client-registration/client_registration.py b/authbridge/client-registration/client_registration.py deleted file mode 100644 index 97ba9f82c..000000000 --- a/authbridge/client-registration/client_registration.py +++ /dev/null @@ -1,358 +0,0 @@ -""" -client_registration.py - -Registers a Keycloak client and stores its secret in a file. -Also creates an audience scope for the agent and adds it to -platform clients (e.g., the UI client) so they can reach -AuthBridge-protected agents without manual Keycloak configuration. - -Idempotent: -- Creates the client if it does not exist. -- If the client already exists, reuses it. -- Always retrieves and stores the client secret. -- Creates audience scope if it does not exist. -- Adds audience scope to platform clients if not already assigned. -""" - -import os -import re -from typing import Any - -import jwt -from keycloak import KeycloakAdmin, KeycloakPostError - - -def get_env_var(name: str, default: str | None = None) -> str: - """ - Fetch an environment variable or return default if provided. - Raise ValueError if missing and no default is set. - """ - value = os.environ.get(name) - if value is not None and value != "": - return value - if default is not None: - return default - raise ValueError(f"Missing required environment variable: {name}") - - -def derive_keycloak_config_from_token_url(token_url: str) -> tuple[str | None, str | None]: - """ - Derive KEYCLOAK_URL and KEYCLOAK_REALM from TOKEN_URL. - - Example: - TOKEN_URL: http://keycloak-service.keycloak.svc:8080/realms/kagenti/protocol/openid-connect/token - Returns: ("http://keycloak-service.keycloak.svc:8080", "kagenti") - - Returns (None, None) if parsing fails. - """ - # Pattern: /realms//protocol/openid-connect/token - match = re.match(r"^(https?://[^/]+)/realms/([^/]+)/", token_url) - if match: - return match.group(1), match.group(2) - return None, None - - -def write_client_secret( - keycloak_admin: KeycloakAdmin, - internal_client_id: str, - client_name: str, - secret_file_path: str = "secret.txt", -) -> None: - """ - Retrieve the secret for a Keycloak client and write it to a file. - """ - try: - # There will be a value field if client authentication is enabled - # client authentication is enabled if "publicClient" is False - secret = keycloak_admin.get_client_secrets(internal_client_id)["value"] - print(f'Successfully retrieved secret for client "{client_name}".') - except KeycloakPostError as e: - print(f"Could not retrieve secret for client '{client_name}': {e}") - return - - try: - with open(secret_file_path, "w") as f: - f.write(secret) - print(f'Secret written to file: "{secret_file_path}"') - except OSError as ose: - print(f"Error writing secret to file: {ose}") - - -# TODO: refactor this function so kagenti-client-registration image can use it -def register_client(keycloak_admin: KeycloakAdmin, client_id: str, client_payload: dict[str, Any]) -> str: - """ - Ensure a Keycloak client exists. - Returns the internal client ID. - """ - internal_client_id = keycloak_admin.get_client_id(client_id) - if internal_client_id: - print(f'Client "{client_id}" already exists with ID: {internal_client_id}') - return internal_client_id - - # Create client - try: - internal_client_id = keycloak_admin.create_client(client_payload) - - print(f'Created Keycloak client "{client_id}": {internal_client_id}') - return internal_client_id - except KeycloakPostError as e: - if getattr(e, "response_code", None) == 409: - # Client exists but get_client_id missed it (URL encoding issue - # with SPIFFE IDs containing ://). Search all clients instead. - print(f'Client "{client_id}" already exists (409). Looking up by listing all clients...') - all_clients = keycloak_admin.get_clients() - for c in all_clients: - if c.get("clientId") == client_id: - print(f'Found existing client "{client_id}" with ID: {c["id"]}') - return c["id"] - print(f'Could not create client "{client_id}": {e}') - raise - - -def get_client_id() -> str: - """ - Read the SVID JWT from file and extract the client ID from the "sub" claim. - """ - # Read SVID JWT from file to get client ID - jwt_file_path = "/opt/jwt_svid.token" - content = None - try: - with open(jwt_file_path, "r") as file: - content = file.read() - - except FileNotFoundError: - print(f"Error: The file {jwt_file_path} was not found.") - except Exception as e: - print(f"An error occurred: {e}") - - if content is None or content.strip() == "": - raise Exception("No content read from SVID JWT.") - - # Decode JWT to get client ID - decoded = jwt.decode(content, options={"verify_signature": False}) - if "sub" not in decoded: - raise Exception('SVID JWT does not contain a "sub" claim.') - return decoded["sub"] - - -def get_or_create_audience_scope(keycloak_admin: KeycloakAdmin, scope_name: str, audience: str) -> str | None: - """ - Create a client scope with an audience mapper if it doesn't exist. - Returns the scope ID, or None on failure. - """ - scopes = keycloak_admin.get_client_scopes() - for scope in scopes: - if scope["name"] == scope_name: - print(f'Audience scope "{scope_name}" already exists with ID: {scope["id"]}') - return scope["id"] - - try: - scope_id = keycloak_admin.create_client_scope( - { - "name": scope_name, - "protocol": "openid-connect", - "attributes": { - "include.in.token.scope": "true", - "display.on.consent.screen": "true", - }, - } - ) - print(f'Created audience scope "{scope_name}": {scope_id}') - except KeycloakPostError as e: - print(f'Could not create audience scope "{scope_name}": {e}') - return None - - # Add audience mapper to the scope - mapper_payload = { - "name": scope_name, - "protocol": "openid-connect", - "protocolMapper": "oidc-audience-mapper", - "consentRequired": False, - "config": { - "included.custom.audience": audience, - "id.token.claim": "false", - "access.token.claim": "true", - "userinfo.token.claim": "false", - }, - } - try: - keycloak_admin.add_mapper_to_client_scope(scope_id, mapper_payload) - print(f'Added audience mapper for "{audience}" to scope "{scope_name}"') - except Exception as e: - print(f"Note: Could not add audience mapper (might already exist): {e}") - - return scope_id - - -def add_scope_to_platform_clients( - keycloak_admin: KeycloakAdmin, - scope_id: str, - scope_name: str, - platform_client_ids: list[str], -) -> None: - """ - Add an audience scope as a default client scope on each platform client. - This ensures existing clients (like the UI) include the agent's audience - in their tokens without requiring manual Keycloak configuration. - """ - for platform_client_id in platform_client_ids: - internal_id = keycloak_admin.get_client_id(platform_client_id) - if not internal_id: - print(f'Platform client "{platform_client_id}" not found in realm. Skipping scope assignment.') - continue - try: - keycloak_admin.add_client_default_client_scope(internal_id, scope_id, {}) - print(f'Added scope "{scope_name}" to platform client "{platform_client_id}".') - except Exception as e: - # 409 Conflict means it's already assigned — that's fine - if "409" in str(e) or "already" in str(e).lower(): - print(f'Scope "{scope_name}" already assigned to "{platform_client_id}".') - else: - print(f'Could not add scope "{scope_name}" to "{platform_client_id}": {e}') - - -client_name = get_env_var("CLIENT_NAME") - -# If SPIFFE is enabled, use the client ID from the SVID JWT. -# Otherwise, use the client name as the client ID. -if get_env_var("SPIRE_ENABLED", "false").lower() == "true": - client_id = get_client_id() -else: - client_id = client_name - -# Try to derive KEYCLOAK_URL and KEYCLOAK_REALM from TOKEN_URL if not directly provided -# This provides backwards compatibility and reduces configuration duplication -TOKEN_URL = os.environ.get("TOKEN_URL") -DERIVED_KEYCLOAK_URL = None -DERIVED_KEYCLOAK_REALM = None -if TOKEN_URL: - DERIVED_KEYCLOAK_URL, DERIVED_KEYCLOAK_REALM = derive_keycloak_config_from_token_url(TOKEN_URL) - if DERIVED_KEYCLOAK_URL: - print(f"Derived KEYCLOAK_URL from TOKEN_URL: {DERIVED_KEYCLOAK_URL}") - if DERIVED_KEYCLOAK_REALM: - print(f"Derived KEYCLOAK_REALM from TOKEN_URL: {DERIVED_KEYCLOAK_REALM}") - -try: - # Try explicit env var first, then fall back to derived value from TOKEN_URL - KEYCLOAK_URL = get_env_var("KEYCLOAK_URL", DERIVED_KEYCLOAK_URL) - KEYCLOAK_REALM = get_env_var("KEYCLOAK_REALM", DERIVED_KEYCLOAK_REALM) - KEYCLOAK_TOKEN_EXCHANGE_ENABLED = get_env_var("KEYCLOAK_TOKEN_EXCHANGE_ENABLED", "true").lower() == "true" - KEYCLOAK_CLIENT_REGISTRATION_ENABLED = get_env_var("KEYCLOAK_CLIENT_REGISTRATION_ENABLED", "true").lower() == "true" - # CLIENT_AUTH_TYPE controls how the client authenticates to Keycloak: - # - "client-secret": Traditional client_secret authentication (default) - # - "federated-jwt": JWT-SVID authentication via SPIFFE identity provider - CLIENT_AUTH_TYPE = get_env_var("CLIENT_AUTH_TYPE", "client-secret") -except ValueError as e: - print(f"Expected environment variable missing. Skipping client registration of {client_id}.") - print(e) - exit(1) - -if not KEYCLOAK_CLIENT_REGISTRATION_ENABLED: - print( - "Client registration (KEYCLOAK_CLIENT_REGISTRATION_ENABLED=false) disabled." - f" Skipping registration of {client_id}." - ) - exit(0) - -keycloak_admin = KeycloakAdmin( - server_url=KEYCLOAK_URL, - username=get_env_var("KEYCLOAK_ADMIN_USERNAME"), - password=get_env_var("KEYCLOAK_ADMIN_PASSWORD"), - realm_name=KEYCLOAK_REALM, - user_realm_name="master", -) - -# Build client payload based on authentication type -client_payload = { - "name": client_name, - "clientId": client_id, - "standardFlowEnabled": True, - "directAccessGrantsEnabled": True, - "serviceAccountsEnabled": True, # Required for client_credentials grant - "fullScopeAllowed": False, - "publicClient": False, # Enable client authentication - # Enable token exchange for this client. - # Token exchange allows this client to exchange tokens for other tokens, potentially across different clients. - # Use case: [EXPLAIN THE SPECIFIC USE CASE HERE, e.g., - # "Required for service-to-service authentication in microservices architecture."] - # Security considerations: Ensure only trusted clients have this capability, - # restrict scopes and permissions as needed, - # and audit usage to prevent privilege escalation or unauthorized access. - "attributes": { - "standard.token.exchange.enabled": str(KEYCLOAK_TOKEN_EXCHANGE_ENABLED).lower(), # Enable token exchange - }, -} - -# Configure client authentication type -if CLIENT_AUTH_TYPE == "federated-jwt": - print("Configuring client for JWT-SVID authentication (federated-jwt)") - client_payload["clientAuthenticatorType"] = "federated-jwt" - # Add federated JWT attributes for SPIFFE authentication - # These tell Keycloak to validate JWT-SVIDs from the SPIFFE identity provider - spiffe_idp_alias = get_env_var("SPIFFE_IDP_ALIAS", "spire-spiffe") - client_payload["attributes"].update( - { - "jwt.credential.issuer": spiffe_idp_alias, - "jwt.credential.sub": client_id, # Must match JWT sub claim (SPIFFE ID) - } - ) -else: - print("Configuring client for client-secret authentication") - client_payload["clientAuthenticatorType"] = "client-secret" - -internal_client_id = register_client( - keycloak_admin, - client_id, - client_payload, -) - -try: - secret_file_path = get_env_var("SECRET_FILE_PATH") -except ValueError: - secret_file_path = "/shared/client-secret.txt" -print( - f'Writing secret for client ID: "{client_id}"' - f' (internal client ID: "{internal_client_id}")' - f' to file: "{secret_file_path}"' -) -write_client_secret( - keycloak_admin, - internal_client_id, - client_name, - secret_file_path=secret_file_path, -) - -# --- Audience scope management --- -# Create an audience scope for this agent and add it to platform clients -# so their tokens include this agent's audience (required by AuthBridge). -AUDIENCE_SCOPE_ENABLED = get_env_var("KEYCLOAK_AUDIENCE_SCOPE_ENABLED", "true").lower() == "true" - -if AUDIENCE_SCOPE_ENABLED: - # Derive scope name from client_name (namespace/sa → agent-namespace-sa-aud) - scope_name = "agent-" + client_name.replace("/", "-") + "-aud" - - print(f'\n--- Audience scope management for "{scope_name}" ---') - - scope_id = get_or_create_audience_scope(keycloak_admin, scope_name, client_id) - - if scope_id: - # Add as realm default so new clients automatically get this scope - try: - keycloak_admin.add_default_default_client_scope(scope_id) - print(f'Added "{scope_name}" as realm default scope.') - except Exception as e: - print(f'Note: Could not add "{scope_name}" as realm default (might already exist): {e}') - - # Add to platform clients (e.g., the UI client) - platform_clients_raw = get_env_var("PLATFORM_CLIENT_IDS", "kagenti") - platform_client_ids = [c.strip() for c in platform_clients_raw.split(",") if c.strip()] - if platform_client_ids: - print(f"Adding scope to platform clients: {platform_client_ids}") - add_scope_to_platform_clients(keycloak_admin, scope_id, scope_name, platform_client_ids) - else: - print( - f'Warning: Could not create audience scope "{scope_name}". ' - f"Platform clients will not automatically include this agent's audience." - ) - -print("Client registration complete.") diff --git a/authbridge/client-registration/example_deployment.yaml b/authbridge/client-registration/example_deployment.yaml deleted file mode 100644 index c33a5f0bd..000000000 --- a/authbridge/client-registration/example_deployment.yaml +++ /dev/null @@ -1,108 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: my-agent ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: authbridge-config - namespace: my-agent -data: - SPIRE_ENABLED: "false" - # TOKEN_URL is used to auto-derive KEYCLOAK_URL and KEYCLOAK_REALM - # Replace with your actual Keycloak URL - TOKEN_URL: "http://keycloak-service.keycloak.svc:8080/realms/kagenti/protocol/openid-connect/token" - # Note: Without SPIRE, CLIENT_AUTH_TYPE defaults to "client-secret" - KEYCLOAK_TOKEN_EXCHANGE_ENABLED: "true" - KEYCLOAK_CLIENT_REGISTRATION_ENABLED: "true" ---- -# keycloak-admin-secret - Keycloak admin credentials for client registration -# Replace the placeholder values with your actual admin credentials. -apiVersion: v1 -kind: Secret -metadata: - name: keycloak-admin-secret - namespace: my-agent -type: Opaque -stringData: - KEYCLOAK_ADMIN_USERNAME: "admin" - KEYCLOAK_ADMIN_PASSWORD: "changeme" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: my-service-account - namespace: my-agent ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: my-app - namespace: my-agent -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: my-app - template: - metadata: - labels: - app.kubernetes.io/name: my-app - spec: - serviceAccountName: my-service-account - securityContext: - fsGroup: 1000 # Allow shared volume access between containers - imagePullSecrets: - - name: ghcr-secret - containers: - - name: my-app - image: busybox:latest - command: ["sh", "-c", "sleep 3600"] - volumeMounts: - - name: shared-data - mountPath: /shared - - name: client-registration - image: ghcr.io/kagenti/kagenti-extensions/client-registration:latest - command: - - /bin/sh - - -c - - > - if [ "$SPIRE_ENABLED" = "true" ]; then while [ ! -f /opt/jwt_svid.token ]; do echo waiting for SVID; sleep 1; done; fi; - python client_registration.py; - tail -f /dev/null - env: - - name: SPIRE_ENABLED - valueFrom: - configMapKeyRef: - name: authbridge-config - key: SPIRE_ENABLED - - name: KEYCLOAK_URL - valueFrom: - configMapKeyRef: - name: authbridge-config - key: KEYCLOAK_URL - optional: true - - name: KEYCLOAK_REALM - valueFrom: - configMapKeyRef: - name: authbridge-config - key: KEYCLOAK_REALM - - name: KEYCLOAK_ADMIN_USERNAME - valueFrom: - secretKeyRef: - name: keycloak-admin-secret - key: KEYCLOAK_ADMIN_USERNAME - - name: KEYCLOAK_ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: keycloak-admin-secret - key: KEYCLOAK_ADMIN_PASSWORD - - name: CLIENT_NAME - value: my-app - volumeMounts: - - name: shared-data - mountPath: /shared - volumes: - - name: shared-data - emptyDir: {} diff --git a/authbridge/client-registration/example_deployment_spiffe.yaml b/authbridge/client-registration/example_deployment_spiffe.yaml deleted file mode 100644 index 2ea551b3b..000000000 --- a/authbridge/client-registration/example_deployment_spiffe.yaml +++ /dev/null @@ -1,165 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: my-agent ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: authbridge-config - namespace: my-agent -data: - SPIRE_ENABLED: "true" - # TOKEN_URL is used to auto-derive KEYCLOAK_URL and KEYCLOAK_REALM - # Replace with your actual Keycloak URL - TOKEN_URL: "http://keycloak-service.keycloak.svc:8080/realms/kagenti/protocol/openid-connect/token" - # For federated-jwt authentication (JWT-SVID instead of client-secret) - CLIENT_AUTH_TYPE: "federated-jwt" - SPIFFE_IDP_ALIAS: "spire-spiffe" - KEYCLOAK_TOKEN_EXCHANGE_ENABLED: "true" - KEYCLOAK_CLIENT_REGISTRATION_ENABLED: "true" ---- -# keycloak-admin-secret - Keycloak admin credentials for client registration -# Replace the placeholder values with your actual admin credentials. -apiVersion: v1 -kind: Secret -metadata: - name: keycloak-admin-secret - namespace: my-agent -type: Opaque -stringData: - KEYCLOAK_ADMIN_USERNAME: "admin" - KEYCLOAK_ADMIN_PASSWORD: "changeme" ---- -apiVersion: v1 -kind: ServiceAccount -metadata: - name: my-service-account - namespace: my-agent ---- -apiVersion: apps/v1 -kind: Deployment -metadata: - name: my-app - namespace: my-agent -spec: - replicas: 1 - selector: - matchLabels: - app.kubernetes.io/name: my-app - template: - metadata: - labels: - app.kubernetes.io/name: my-app - spiffe.io/spiffe-id: my-agent - spec: - serviceAccountName: my-service-account - securityContext: - fsGroup: 1000 # Allow shared volume access between containers - imagePullSecrets: - - name: ghcr-secret - containers: - - name: my-app - image: busybox:latest - command: ["sh", "-c", "sleep 3600"] - volumeMounts: - - name: shared-data - mountPath: /shared - - name: spiffe-helper - image: ghcr.io/spiffe/spiffe-helper:nightly - command: - - /spiffe-helper - - -config=/etc/spiffe-helper/helper.conf - - run - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - volumeMounts: - - name: spiffe-helper-config - mountPath: /etc/spiffe-helper - - name: spire-agent-socket - mountPath: /spiffe-workload-api - - name: svid-output - mountPath: /opt - - name: client-registration - image: ghcr.io/kagenti/kagenti-extensions/client-registration:latest - command: - - /bin/sh - - -c - - > - if [ "$SPIRE_ENABLED" = "true" ]; then while [ ! -f /opt/jwt_svid.token ]; do echo waiting for SVID; sleep 1; done; fi; - python client_registration.py; - tail -f /dev/null - env: - - name: SPIRE_ENABLED - valueFrom: - configMapKeyRef: - name: authbridge-config - key: SPIRE_ENABLED - - name: CLIENT_AUTH_TYPE - valueFrom: - configMapKeyRef: - name: authbridge-config - key: CLIENT_AUTH_TYPE - - name: SPIFFE_IDP_ALIAS - valueFrom: - configMapKeyRef: - name: authbridge-config - key: SPIFFE_IDP_ALIAS - - name: TOKEN_URL - valueFrom: - configMapKeyRef: - name: authbridge-config - key: TOKEN_URL - - name: KEYCLOAK_ADMIN_USERNAME - valueFrom: - secretKeyRef: - name: keycloak-admin-secret - key: KEYCLOAK_ADMIN_USERNAME - - name: KEYCLOAK_ADMIN_PASSWORD - valueFrom: - secretKeyRef: - name: keycloak-admin-secret - key: KEYCLOAK_ADMIN_PASSWORD - - name: CLIENT_NAME - value: my-app - securityContext: - runAsUser: 1000 - runAsGroup: 1000 - volumeMounts: - - name: shared-data - mountPath: /shared - - name: svid-output - mountPath: /opt - volumes: - - name: shared-data - emptyDir: {} - - name: spiffe-helper-config - configMap: - name: spiffe-helper-config - - name: spire-agent-socket - csi: - driver: csi.spiffe.io - readOnly: true - - name: svid-output - emptyDir: {} ---- -apiVersion: v1 -kind: ConfigMap -metadata: - name: spiffe-helper-config - namespace: my-agent -data: - helper.conf: | - agent_address = "/spiffe-workload-api/spire-agent.sock" - cmd = "" - cmd_args = "" - cert_dir = "/opt" - svid_file_name = "svid.pem" - svid_key_file_name = "svid_key.pem" - svid_bundle_file_name = "svid_bundle.pem" - # jwt_audience must match Keycloak's issuer URL for JWT-SVID authentication - # Replace with your actual Keycloak public URL - jwt_svids = [{jwt_audience="http://keycloak.localtest.me:8080/realms/kagenti", jwt_svid_file_name="jwt_svid.token"}] - jwt_svid_file_mode = 0644 - include_federated_domains = true diff --git a/authbridge/client-registration/images/clients.png b/authbridge/client-registration/images/clients.png deleted file mode 100644 index 96d9190768b02af36bf687a016eb7ec5bb403f88..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 141887 zcmafb1z1#F*EWrUgrJ}xAqWTv2og$ncXvqF&|LxoqS7S|(hS`-gh+S845>5>-9!9` z_xHgd-&>s*Hq$L5_rkGW7rhxZ`-m zU4?{%Rct9Dq9`RILaFFzXJ%<*ii9K?8kc~nsxm_qJOtrNMSFmpO=$Hx;E6wyvakj6 zlkC8-NHhZJ2mZsqgCB)2YAQZPb`h0G3dmA6Dbg%^`}%}m2;-^gi#O9{P1tXK^*0^Q z>)4f6@19RKBepAtv`$T~kU#zGh?5*OR6`o=m>JzeqVTlQqtL9832fWTc?Xl*8ynBPV|f&71f5>Jj+ip1z0Q$8Sg@jHuyU;L!AhI$`~28jOe>llbbaIT z;s!Q4W};&KR*?=n$A4)(|9jfZZo%_5EF!u=?9`8s{iyr`f+||`=~qq5|K`1CWD0oK z;ay@^_ER3(6iF{naL(u`I+M~(Ph@f~CR@%O?jvYw)SmNA(sbv*Q#r(wn$uail zC{~pe>aS^e>r5O}?%W~8Ut~;|zCs@SM&=*ex?mi9$+yMgMeOjzsWK?a|EtrY{3#25 zWv;bZ2ZQHdZ11aFr=L&GqirZUw4`@Fa=jDBg>~>^l zB_w0sk`aP1S}j?zDDsS@xR5L)5IMibSj91r*qv|k$lTd12TdNmyKep2@_<2*%mNkF z5arD$9BAr0d(8P(JT!kr{D*&9KenO@N8)B%3krYo*f`DHY}Ep*MNO2A~I~fPWZjmM3ZbXWME0_EumRkoBgY% z2lB!1mQd=R>Emhqs^0Uh!{Ns<2)6s>c!tjV6-o5ri0F5G($Aq~QHrm~rG&G)9kZVl z2wFv%WfN|Qmry&JJUjo=W@PbUt8zLnDY8*0vmK!ikhchxL$-jUwlH^m)IR1rC>AT6NkvOF?AHT!&|Et z<(Dq(QR|d=$xFj(JG~Y~_I15Eo6%axS}6Po{BQ)m+z2XCJtKJW;QF(Bzz;>yd`fl# zdHj;cX#|~L3Ps=jBxQ~5rduWC!apV83Dx)#_?wj=?l+}JB$X6>wpzBd^1F=}8^{}B z(b3W6(cn>Uny69f9O;}uY2w(6IR5B~Zgmq*kC$5F`U)k~=~N3eEt!h1SD)BP^U@?& zq>T!G5b+Q_&yZEAQCod|7^m@CgRz$0K*hH}Sd~@9sNjt{y<&mlhayKYQ_Z-1tCC*z zl|p8XVs*YkPaT(7=`5&s8W9m6~JvWcb z;Krk^!mWm_17{f*yp8#>z~iE$U&ryA@R6+%(h06%yy1j(yD5Pz0h3qIX^akyN_;>1juK`f-WcW?*7^N;r&6a_CsQY$oFuJm z%&QnCT0L6o+~8a%Ic&LP+1hn(B zuBOGWF2@dfOP>A5S;>_;HL#bp0&}*rDs!ZB=>tankNanM%v;;11GmayB0Ey2vU`^! zDm$jj9mj>op4+y622SVKu3}Alq>bR_kfZX$sEewLCiBMfgmQ&*s%GTooMwoxm9LVo zns3Bq*j3C`@}&ey3Q9ai3f6B73``JK)4<5u-g}&sD9VHkQz7%fp0>wrYHblBMZ(!H zQ=OLTg`BvCeBKV(q`B*Ry?(Ir8HDTetn)$NBZMhG$ang3^IYK69W zyx4^(=t~oY>0_F2n_tyK^`Fh*U-5TxXOkE)@zxu89dGZ@UV@$I_J`A-e|+xzJT$8aVsc}TiqVXD|I7HW zW?z2~a;|eGf`TVhzi1gPq3khQX%ewK&?6$uViaVr`I|^BR6hqTcU#&cog_&+;ev^Y zwwNY0GA+_qwTM>!Y5Kt1?(V+z7)=@JR|m4S{l$sYqlO#JZ(ds~sY}#wGemlt5LN7& zTzyFUF!6!HG0O>WP3iEr2j98+x%FW>(HZe&)sxED+A8pHzP*~!4clbJTwmr&XkVlH zkD}N5taWULrdJH3h2v^1L^Dt0h#`7pl?|1eE$*iKt!~H*9C5D`BxOLQ4hEH5Uj3&( zcfF>#OXiwStm#{hloR!|#Aeo9np_fm%Wg6cLhQC;CQm{3^JPxdpe*;l#d7+|n|%c< z=qsqnYakFzctN>g1wKim!=m0_GF=^3C08S-|6F;de9jrs2~P)qR^tNu6zW(VSxrth zEwn8-*yf!MuIgPh_PY99C>{MxokMPfSq)e-o-Cd$Z+ld5dD@*S^rw@YY-}^aPIKgS z=}PfR1z?M#!^8Pgb(s%A(HuB%gSwkddZ|09#Vym<%5MGZn#T@de@W#d<)5UV zxmGMLuhaJwERFT#VK&4&&j}EEt#;0wn|lqRr#ITq-&`hw)K7b`$%(`DoEzPb2o9AI zrfYq+eDZw7E!f>}FuY1_wdeN|Ze8}~li+Lf%t#Vg=yqKq! zcs_n%X~Dyl3%&#P`f%F0Q|kT6NAW`O*rE3>LwSFE&$9hph6YoLZX*wTuIdx!Z zc4;$2|5O|yHwT-sYZPx6r+~=#ah)_D1)hXlMD$0@rGMn-BkQ~RexrNdaUiocwOESR zoa2X}U6QURR7Mgalb1$WbRk2EeXq)>i~gy~P+3Fa8T+|`VL+?jA1OGW(IC>e2P%Hp zMctdi59puHrB!1x$b&nnAjsS6`Fr#@yqQy71MX-@2zb8Zr;Z;8Vre(bN>=WMSv56@r=sG&N27NSa^iO9qxx3~Zs7X%HVYNyzlu0p^HFKaDN>5q zIhs;(GQVYhOT~{xNlD4;Xkx~#EGqsV)q!t(R2I(8_S`HiZf`j1J}Ro)j{fWK z-{UlOxBTy(Ku-TLEntEyw@+ADncuSfSKB~U-rKv}ik9xCHd>;Vwt#qmKKQxVxOo3n z{(n9B?;ih0P0jzV$;!dW`9G`vk4OK1RW&D5M-e+)pigK1|6ZE^sQf=4{zpY#mfNZS z4^jME&i}d#2$~;@m*u|}jUOvnQ{gWXk|2_lsF12V^7h=rPx2EtUHiM=%gwN7upbLE zM5|UY6uim_Bcd1ks($gE??{Kf zvqFY;xejO7=ADN4PF>R1 z6bC}eJ$x={tbdv@3Z6H{KMa!+1WfjixRlU6Q@xde;G+M~y|Mrv{FeLFDl+?;{=q-Y z_W|$T^ZV8W7@mLKLwxryq%`O+|6#uVnEa^!FidMM>;aM)m1~l|I{z(Hu^#^LhIC>RYy`DHm4d|E0)HdtGnKc$8 zKb;R(e~Sle_dYZY_rIq}%1?r{Xe69A7P~Ds&2ous9o#OPu|~r}VhnE`u8yY~eZ<3G zSmKbdcmIy6V8Qke*{;knxnJwqXzb6HLSWP7#_+5N{t8;TBonK2&BSnlYj=(C-a@@b z*P=Hw&Ec8x75;UOE4?*NYl9Hx^U{{8gFLV+vkc}PWIQ}WK?t4(2 zYH7$wmIO?USkGj^@5X1gcR*GMjhrnjHi#DxEIT^+pD3)S3?_$bLlF{6vG-0t5*r;_ zYiEaw@u=+c=g)OhCGPuwIL-Q>ZH?x9gPhKLIj{&6qdd2wXG-MLOplFSHX~XH)HB|3 z92UZyLB@Q6??lS@_&$9*vGdQBONO@kqgK+aFPZ{tZ9c@0DB`f5>@V#-(eUK`9d#Bd zg3GG++dWqVk8j-fa=*)+NJ{Ho-9u;!;-%qH@bjuv4-a4WC9u@0fz@ZA9M;8#nE~o0 zx*xa-s>BC-WP$bkLFUxYn)~v)lE>6*Q3!$*&VOMcBl}%p?d$Tg2^aZ9I2lg`j8t$vjvP#i8K0iM z)@)TT)rZe(fYk>IHA>T#v@EW_L{UpXrRY*kV6}EbZ*S&Jx=&i$pK9nDxy`vu&5t|O z`T*_udhK@*yXmyBXyls<7qQm)7U@p8q6ra)4XR!3E)=f^a}*RNru-PXwsB8dVbmNh zW;vX5mziy#Q6oRjR(vHRL`-ns_SSmMWDhj16Gppx%$TRc(=JN%8f#$ZYw3P94+&}Oq}&sjbmFT~dcp*W(6KP^G8epd zA&F4yUN;pgAxwC}q~Z-0f9xBr(Q)-urO|SU@6R67b7ft6Rq*lurO0tw#v$d*u5=mV zEH-HI9dhjthOmEDjbl)AW%Te8=0_A*1;!rha3zyD1ZWkD*ZlmI8P!DkmE1yxw3?kK z|0`M5AG}&$*Q_yHopR+UUSA>qkjwK!M6JiBS};jOk=Z~JbL&r#_)L^)iD$&RCze(*KW2Ib%-^%JWIF|z( zR0Ho7;*?9ws(s_2kHu|d78rWcPh%3oB9%OOSEyy)Oq_=P^Pa+rI0@4YS}=&0L|l5e zIwE**bE?$9L>{|%cOHTOi3k;x;PLK#0!L6eTtpvjjCGMo?5d?xhrj zJ0iircOPurys69WypF#QY_`RucuZ!ihNg$B1MpT5dxj40zYMYtS84Il` z&6qDY`x4Sf3~FZcciAA@ai5@dN1toSz10w7Tcs@^mX^zkt82t=i7sEZ=kbKbzcyei zfh1PrU_H-`oElqL4TKxS>sq3=_5fje60!f&H^HLLaH8%CWPn_$&<=7Uw}hs1T>=g|kI43xPw`U{gu^T^kihYC}i$@*!KnRvd4 z_z+9bcy?s%9+~21q>T~Qd3N_+=yzhvA3(T4tC$l{VYySy(wFV7@T0L+dbgW z1!uw*9%Y62HY^5UQz^Zfvrr4h)3i9Sa%op;72?8#Fuct)4EB9;u6AxkdCI3rtC04B zUg5ZIDVWq|I76sedZ!wYa}-M?%5$iMlmWxsF#Ah4=h6KqCQ1nz)+P0w=;-V{U!!TY z>6Lzd)*0*4vGG!qPc=Cq1_jrPr&qcbG?$_Q@jTu}?6wT`={kJistz-wUC#(Ckekf& zZqsc`l(M4074S}-;qi*v&%K5{)z1x0VzUx(-#GSckkZABLs<-8H7DJiqXA<0(Le?N@Bvw_bn(Z^qk zg0>`nQaQ-oH>cQsp6+{Lnau4{sIx-a>@$P`FLjaTu8E(JEX}r+&XR}-?@uZ@?ILs2 z&Gt9gJ#L%ep3pGBA5hpIk)WvWJmJ}GdS^B)gg8IAIw;6X+w`vB|@JJ{ERq?xFE2- zQ{1f7$nq{og%uh1cyl_-+0zHqTnE}V7C-P5?U$4<8%f621_w0$)Gj!czZ%4Rk(0&?<~#= z*0T?evwWOw(w+O2b6f|OGRa>VcYb#`_a@iB%L4mDcYEwN{$g($-JYqOtALiVw^fO6 zXjYnqc~Pnn%2`im>^36?#luKU*V4R7QvI&aIoi#o)%wTquc9Fu)vndV^3owKQ=qLGw99jj>(7 z$jECyK|@&Sz5T5mYJ#BoFoI#nU_$qF+KPt273c9XX=QuY2@Z^bWm`8(9A|4RPodCd zb0dS){C&{rh$l{H_Bu#h%89_DBSmQ{X?(-ujT?P1_w7&G^cn!84rmL3V1Hz9xM!Gm-C86K4=&0j+vZZ2X*C|PY zrQmL;n7CDdUjZEm%{1ye#^3pbjH=t1+PgE?Ses0$X6qw|N69l*xR~xH6Jz-e(rkrXex-(`s?67L;LcZ}@#@yCdUTM7w<&pz4z|3}{WVie|^XN~)`1>O9U7tAi`ikZhtMBTRf>Ojj>rDa!lX*vq z`ARuI2V^7@yX%biK6&N5!pV$XJlGWZlb$wZJvwNzW#E{1toyv50^dZZlIBMhtzTQl znn(bo`DITDOM|sC5l8rzX7gkHuqoe}go41=B)Q$in|YVqxggFFAtkY2apF!Tke$@^u_e^`duX~+<2-=PaV_1#{ z+MnLCpdj+$JmcGDiPQOVjKZv3``Xge|9v6}QeLC@jz`;5H_|4lk2d9#%!rD3Zwcw5 zlg0X8pPQc+Vp^VtWK#-FWGor@KdDaEcbQO|%#k4`{orVl9VV9r$|u|IV`*`w{=WWF z>qf9dKq72sc@2W5F6I8HaQz?UH(q#Vm&0qQuX{Cz+eZ zwEMDHr$#&Tms0!YrOpp1?VvE9XUit8k5={J#64YsZ1DQF|!L!)h3=d;=@LZk++kpTHvJ7th^LL zWBj7>NIPyJi3U{Bj=f95DT$!Z$f)>*GrP0`m|gQ6U%>u4IDZ?Knhtsyo1vD?g{*pn z+h@U^6Yo;SMPBOKEyQics>nOcIL9cJwb7vyUn+_&eM#}<{odu3QSv|+qC2g8f6V>iZb;lNhO*9YX|vyqb^E5Hu{ zeo!^;`yZ$F7E1JZtcNrFvAG{TXM4q_+8|Ccvi>?L{bdTfYCQ^uv=udCF%VC;>{sd7 zI_<5yPa4cn?8=31e<{-49)joQWSKv}G>O`@WNhxD1>w}LvDtt=&kDrD;^!v^&sU09 z;MVQgs~{=jplfZGzPdR6#(uJun{%8*|XiAPv$^UJkho~ zkzEVRqlJjF=;ZB#I3bqM41ceV+*D3;bNnx5qKzx*zc?9gFsAly4ah>S%2~eJQpbv;#L7_<-=jTQKgay6kj7#wK>U!6ee!)IOd7(zIa$2*-85HF zw5T<(h4Y%EPWbvNF3~gSu=4vI@K2dJO3Tf4qb05aUr?#IQ~G#kta?N+U{E*MEa?;Y zw#=RthWMA({lOxBqNwVZX6(#wtae!0hyrm*SapsAk4F z8F|9cqSe3pT4+*7cdNn!mnue~0*qV6=oG61$!n|dZd)PD)C4Hiu~xtIsNyNfk~p4X zseUz-vuI(F+?Cl;@UdGM$MSU=TF+0ISfz5__k-Ly&*YJ`#MzSk1pXrrnyZVgQrA%_ zy82)jpEmEp7e|iv8yTZDe?BSK(9o}3<%%9VPyaapM`?!*TScCP&G`C3n6G%&dym@* zYOUnLtjxrE>sLIb=tU?jDJXRJlr$!U1e(hYJU((bTMweSSd;L1Rx!T2?3?OHcs?JW zXgVRKSIw>z(R*;L#Lk}bs}0YufA8db{1rcUnn8GV#6m7hascLY8g!LkJ(%k3qCfEL zUq}AzDTs6Sz8V=Bma0%UQRLd+`#jss3opG~%DyO|6RT2qkJopnkNkMp8yAZ=AHJF9 zwG;ZJkdvhPxIj)8)-L4~!C?75^Xg@Rtvofz!WSboCYbX8Z>{k9`k_a)gDHntt*xbB z^-YI%y86sME~h93-3#yG4{2`m9`z-8fu)tS?}w}wg%I%oRv^#2FKQsGtAAy(**8vFO~@Y}o930uHd5^A=jU8H z<$i&v7s8vltEl+oCf08mJtAiMROT^6n3)7JZ1!+)=V`aAc)sNvy&Wdj<`VYtILg9s zTIenzQ_Ceeb$P_$&dB{d&Ey=gh+PRKBqS~_!-Pv26#f$cP!qp z(s0aMH`UpX4hvrg=Uo(V2|4TiI?qb*;bUtk*m$3m&_=q^xf%Fy#B>uv6|l5Cr1#j) z1EK#)g2Jb2D?ZmV|9S~2qO)rZXP%Bs2SI<9$+ld`eYU^j3?C=7=#8cKCBD;etPm2U zcGPtm;Fzqj)!|a`Pj3+lQRY!_)`@}I3<}(MPt`mjAD|{JBub!~z|9?zocG%0Yustr zqB6Y(V1X!rmjr9}@oEHo!EFHK_*S$KlebLGvsQs#{VvUAQfntEm!s4MlwUzUuEAra z9&Lvw54KgGDhF^!E&9MxejQ?2{HxiE09TnMJtu)}{9QK53aL36dQ zsKK%T%K#jpTnG3^nnVi=`kS1%1pqoK_Px5;i3qnj%CcSw#3=6_*^|YhJp-9AXt>0I zPt;P`g`z+VzL3rQhX(BPxBr{ampDOSmRgW& z4kER55!5%L2_k8h3_Fk}DU@ut2jIXr6Xyj9!9Rzwl-K)yJ}mUYBJ%&z7u3!RpPc@WIb;g+rqz8U+B+OTC6w{ezXV#AmEaA*;~-@iK7s2{rnwarNvIS-ywY zd+m7Ua7x76S||f19{G#sW_oZrD=t-@%xHZM@1{Y$c1ilh3`~pTj3Q{;ub$n%Qw2VZ z>IYj{u&pXTv%W8CAbkVk9fz37daGBY)pWsYFiA!`cgX7Tux}EcFvM`2KS{rLFf*PY zUCvgYBp2t3SBG@dSr4j498`UygLa3j$+?*QfBNwd7)S!NQ zQZ*oidgKtwv%OCRR^})}q}pBY;~~5^8e(fDI3DewC8GCSe0J+ z{^A2$MI+Ua?*SQ^%JBt2`=o+t-4*xv(()~KI$c6o-S&n%eU~>yKhjnJcabM z!YeMb&PVE2J37^R7n!?Rm41LHIs^Sn1M}iN>zrCAge9L^8o}ifwdOSRbjR%t03=Jb zF@CUitc0n4AWer14bSzJb`Y74jgj(81m}lzpK?fKYKossp*Z5XHJ4ZbE)8CRiS;!O z_c&AC#3mhPWiKYqDu8w!sSgV(tbwEWX3I)3JYDD-0XR@ssn-p_oa$KT*eL>{hf1%& z82(rbWjj-ivNzYthOJz^5~WjK6JmNzA8Eok^6JT~CJI-=3!1FzG*oBk(B-{HiRF$p zlp#+Y)aO)L23E=CwM&D&<8J;&2sA7PQhD*8mx%kyW3HTvyxI7HrMd3&jfhG2yy4;2 zkIjxqbuOj}Jwmswy57>EK)m(!I_?$=@GXonr&(3HNvYuSw@dj%r!|11KxO zyS9(Ob{RS$#7hjc0UPV7IocSd4<6bA?`X~A)$6EDs>5Biq}26=1eTy+Zn_)uSk z(F8Ed3fW=i%(RJ)J$21}BT#*g1UuNB#qsSTz5F~Xly#h>{Pac-GIl|%{kL-aq_A^y zJzIR&e(xps5a9CcknA1%k42z7x5e$u~1jC6ocD&CLH@0>TCkUzUR5MJPds;K#a7yvxDa;v1PFA<$dgvM?*y z0q1eHIGoh&g<)WHA=(z9&B%p|dWPmh9h=aT&I*@Fn?3{Pp>Z4@n=1i&g;U~u-H{p$ z2vw{+tYVy#`EtM)kEGe9x%u$|*Z3A{mbe2AnGA(8$M2yej=q(tieToi@=3cwgz_P$ z6BV6~V=5O6Qxtu>;Dfl!`T_@ou#NI){xXt3k_O>Nz%f)x>opm%DyGPS9LAGN{*XHy z1vg2e9q)8GBIkHh=ylCv+2SZ-`fxcS7;RqHn({y_~$Hi)k}5#ePKxR z;=E+;1`XL^2!-z#G{(#0QHr+$G2TUs$&Xy-o)~F7zwpif2HTtfkMX>K-AyW>#CtI7 zJSJDLTBAmqneOx|EidnbEm&2F=eWfAaDZ#qGe%BkhQCXMbAm_XDR{~IBhC$bq3zqQ zHla8@JwmS13W7F5co!e6FM6`nWy|%|D`-ep6&s`C?;?4T%F8wr3eu?=t#(hH(Qv(X z9QsO#9s>TYS)(=po5#YLXu76ok^7}de}CBEu8gh z8@?yw8~c=ukuCt2`y~)|-Z<2Pc)D;EI5<0idsS=&s?rqCcMtFGuF0|QxNf;7&w?+U&oP)?ut3TBQ4L8RN z3I?V9zZ8A{lw}y`DVgu~xmULqq?ZlR<|A`tThAbTxfi+VxN}abrzrRO#qQCRfnOqR zIqkiqkYzq(bS%%)9oyT8#PafqiF;0Vc6Rr*_H>PHGUMS+Cx+SDS4kKt8S43&10OUivqMj2U)9*j$7bsGZ1W@#G!O3aeB5;Kr4(1Oir z(Ul{U00jsYwiibmTFi9hJOF631WVLjD(DrK9c_NpmZ3+{+38M^*}l z<>+r*zN2B;^eRu@H=1Rw&DR%O-Psd~^B)GEC+cz!W-x#hekzq0W;)cdGZWusg9Ado zPDZI+@Hq85{Oz=%C2+9l^Fg~3;0D!Eb9~~=M+gsQI+75a)GLDISN3G z9|S}pogg$vZ@oa0XylIVY8kk9ZKwafxBM8HHeryOIC|_ZBjexqD7gUQQa6rqDdKli1N5bX?x1D%e<*_kl=;8sg@Wg?EbK_~ z4|B&rM!~CJVo=1q`xkdR`-3k4tBcq12#bzQe!=#sWyhpO;E-@nwXrq&({VWo7|_*Gn#4^vyd0XaBJ}g5-}W z_aY^jU*+9P*!d&~!UxKbmY}%&gK9)Pc=eP?i6J5d>$W9CR%<}L(@B?=iuv8*k`(zw zj%V3gMsn}yka`clC$Ng*jz(kLdeyg!eA|8!^;0^0pf!?m9 zwa195da)}Xqv{{Q%HOYK29|7r86m7@7{Q<$-le0 ze@k`@6BMo{skW#e2=0r*MYSF(ycUs#nRm+>d zTip1!QhXE((Tj_Ww8-g=uY_F)e8i+s?~*2xtonGa5`g2S!->d4dpT(fv$U?Eh3z_- z!?O77YSkF89|hnYy_}&Cpgm(V-W6fQm(=<6fqb-PCX4A|XsGKlYZp{x2x7%y zJyk7@xm<~gP1`_@>!nJ`1EE|~Rwhu;F$1F7P!6ID!`w)Ved#5)T5SE;*=st6Y8vw{UB10%$bxP` zvmhe~PkYAhSZn209rq@(I|bKaZ+47|eJv0eb5O~{dq+*VhJIkOxKyR0P|loM`t6%p zo;5c#(VShOwg`G0UPWNqr&E5JXt#ZBekG1Dp9^;GyJE4q^coO2S^dHC$F;Blqk*V_ z_I|0R5Z|)ahAPc8Tbdy%sWaF^c;)9U*EVY@b8HhA?vVP1cD2cq0PH`?x>KawI+eL{ zV@%)`u>`Fp?}zbEcpcL9rRC=>+vl%-hub=3P4E{7PViq@)$%SM6e&P?`190g$tgUM29P+}*4~r2>$YYVT&+oq#I_vAhJ zBd?7pn3I@Kh4w=|Y(2tz`E-JV*vpcOZRzoN+|Dg4oTMC{-whxOEkq0s8Bej&Dim0J zE+YF;&KUF#$nN&Z%&m%?2snxhFC7lz-#9TW^~IxqLcD(uSk9{ z@H-CD^Xw6ef-eQNTaA|`j^#mz*DyjfFe_!~OyBp99@_a@z+vnPPo4LIREt#ydlRHA zU)%Zh1#(`4Eq!CIPP)=v$Lmw)6lJjhUo7V5WWods{&^3<6lnrfJ6VL|k9U+p@$H4%|ro9~9DFIU257p~vN zWpRVU`N&DEWCF>_M|#p1DoZ0A)(R@rhR(mmHy9U`9B5UWP1TDgWS)Y$!HY@%u#M|e zN}%8oS6RY=ZDsU0cP?0i<4o>0V-~H{ug#3+^lhi5x#cm4*a1{mLu2u< zs&um(8?sUe|AgznVC4J}E|1$zRYB!y$0P1+hS%?ao07CnGaNZe2bqUE)}p^OY=>kU*9{E*_|Pq(zD4*YnepJcE4k5=VU#NFeU!sD{+9&tXTaZI%eQeUO=#yC3$HWyc-=dcgJ(w);XEzk zDv?(c)o_Lmzv*_O-mbBRLO)NDS68>anjxOGFO8#D`_&0?Zqf7F*K&oS4vC?>#(ctT z5<;#!um3O@bYU_bc!H>SDwMHIZJ@h6k-or!9Y3A_@@ji2!xxYLs=;NQwUxXMlI3#& zr5?=NjcKPs{MH_>?$&!}_PdZ~>z>2LzllDQIwEMTFM+Kq(C;{w!n|%5V)@F*Y-e|Kdi1Ww2jRNq>_g1>f<2t>)hq2&%7xz# z)1j{SISDxTyo97OpV&wgUtZrANk9_Q|iguKP6$ga;E!{UF1=^r9T%B8g=To6dr z_%ycXDc-Da^+Z8Am`-wuDyaCTSVQYN`^lPl;5=Tffm3EGbXij4CbR)WB?nJX?XUDOC!#0*J;@6KM zI!pwpHjPV{=ty0vN`!&jqy?ibaBBXhfAD>IrrH|~D7UVAF!m=4{cm7cO&N^*#YaeE zb%a{goU@uWqegCas*kj>wX>=%Pl3`^_ql7`qAcmrCW7_!kkN%{l;W&+ZTT*G#J`L^ z%6XIz1n%x@bEie}sob3Fpecioi>H-S7z9_^o#ycQCy5XPPaup*Fuok{I0j1l+|HVVz?dd3+V(r@U$952-2;QTN zrwppo!7V2ZK4fS}v4b`q;Y`|9?^kDTj;Ev>uN$n3KL&l}G+vd}ftZE$U<=F&A7 zC4AgD+wINii`SZ?Tz@Q&L;AuNh>^K~F>u{~OUJ$jNxYb71qgcEtFdR7G5br~C0xNL z=NA2#lLsk>x-6mg!2{MBu+^VIqmOuB?>=2i2f6Vd1XNo(1du6#wcXux_D@NO-@h*t zEzejI=!t)0kZ9$lKL3PS_3g8U!lF69tqIqQhZ5$dQ+$J7?#CiUAbWX=mIK3nHc#H8 zrqpM$`B$AWZjFmkt7Yr6jHVWOKX|rRdI3v0>7T75N0V?&KW$=t=TM(RxXIR3ZLQu| zxyW0CUp6`r&uR$IA11IyY01+!n!}*_`sC`yBZ8K1kdq72T&Wy9?)>k32kWif7eoB% zh8h^{GzBSarqVjKq>a#N)~wmz<59A0zZlzt8!L7<9YVI~9b7`dMIDLe)7^OD^)@6{ z^sLV&3+$Ju)C*PV8&8tLm*(aU0?@JH0U0}LVAb+{im(}5^3WhBvzd#GT0zeO+deZ_ z?U<~h<71z><>7Au^(677y0+8;*U%*0={XF@fj;N&Vu3pr*$&Y8Yo{nx1s_4%t8yj+1WOla%-4O zs(lZ`u{&z>+MNc>#X6UjzJv(LN8|^(!|rL@C{M7o&&JP#N#Wl@4YVU*c9px$i6&gG z@INTed%?>F6P14w+eEf|8KJN$`UPmJ+pO6xrcj9Q)vnvQ=kX4qtR`e4SN&??6 zZ!!A2Sc3&8JvvY-)$h_FKGm;HOuax^4B@W3Y1kTK2QfA0bKcf$*^}Gc_Jwe4D#`09~03w=EJ*M1^O6vn%&B*E2VjCV~}b|2FI{ zupItq6ch9w75 zc1Uya#g&H;_%@0#@oyFXwqDP%k~m?Cel z2%Wq<83_YFyhw95j#UHe_Tawx;oDxvV(#;H#@TULQoqUKaSOx5R;Qd!K<7CM5ol2% z?j@leJJ+wmjQti>{AXW4twR=W$MTxxj$v^h%Id^0F-Bo-B5!rog!fvgg0OeuZQ%_# zx##rkYhtcB6FLF&xH8vepoA3Chy12f<*&K;Q2=W-R6!^<;BIWUUYHW0{i)L36F}8w znbs9=4cCiVL$164PyXyUHbUp&W*~-9Wjj%*=Jf>l(j$a=gV}CS#-S5q3#R296lKuP zwod|5M@oVbkcZs)kI+e_6W*k)WCWh5*=GpPC~E;Esuol%;;+x0hieEraJwfn0=HfM zZ*RmJ1+QHG>e~>1xu?sP_HOglti5FU!SYuZA?j0NMEOn%Hu=ZE6pFO#?HZug)DkVC3^XPydUmKFR> z+UMfZ-}m&wt1sNpB42ItFZ86ws^dWQP-}VRa1eW~Q&GlaiNW!1pmCd^dxDSrBq1a4 z{hT)z<8{@|mRl`we9VvI%lAG<*6N#`!JHDDx)*7uEVDy%bXhc7h}=F`a@&!uc|O)$ z+2u9Alh$m|>>!c5<~@Cwb?tUKo`TD!u7H`?r$6=SUI@5s_cqmY#@E~t-}}c!D(S)6 z6yW7hkh)H9GWFE(#l*;W)pL7Pyw?KodbY_uX|@Eud%a=91+3-G59B9I1M_5hPW;O( zio^0&4mH)cUiE`jzt<@&ZC`0=v@;hu=vmtWZerM8X8Z^Xz)5!7t~!Rr*sAO`aQ^68 z3S45T3(c;zo%^*XooL@*to7sX%Ub>Cn?ZLeXKNaeS2_Kzwtx328YMws`mNU;PpoG) zVKr4LOoPiVBg>XHH1tEM{5f&D)I2D8s-)(2!@u37oXiHwOa@k3y>XvYuO7SrAk=g8 zpPqL@Iwnd0qC?cy9gc*u{}f0`HBgWixeFpQG{An_)!y8U@`3^x?WCZ!!nDuk*XM_v z#+{E~6{a#tE?O3>rpIO=!4{J{+k z|I7}{`{wGD)36l@0njI8k%R2HFV?f*b$`PFo@|2_fPPaY2jfwIfMg2CUEs%RLn9qq zX4i5xsaA3c0oL*u_B7OKutl*POG8yGl4Si+$%Qg7d^@K#qYj`hzsUzy(5R z`a*4J12-9&-*5#k?E(7l*M%zBR=VG{CAIi>`z;Rku_y`hLkI{(>X zU;zr=)?{&|3=3qO{YKci;cqz4_H9~jFb=6WXHZ|EKBNH%G6_`3VJFRMZvfe@m4x!| z+nB&9>qh{SO+vlk1v>faV5&8c)8!%}DaIL0q?+dG@p+37+D~;Sq^w0CS*Ti|9Pdi` z4tQSH^6)dAZu53UUj^jiHV_2Ri2$y}CP!u(I>6wNFiAy0#^MJk*w(cdXBmMgn9yq= z=|eOCW0Q&1=ocDTB`@4E{43CTJ#b{Q1Vx|FYgJ_HsP8@)IJfV3sv&w}H&c-V{)R#Z zEL}aey=)SD50I89w%As%kBtOgv;5Eh1#k!C2uL$}9RFV#{0IM!y|;>rt6j5&1A$;c zg1ZEQ1P@+#f=dc_3mPcg-6aVc+#$HTJ0S#jcL?rI0fqdF-Mzowz5Dym#koCwkufrA ztg&j<;(dJ1`4sum#$B~y03Gy3fKkPtH`087`(Z=`xJKJs??*=^0a_9Fr7yjD znNHml7wO_PU|;gWyKkljFk@o%gsd2Wk-7xXHYr=iej-+`!-WFKqoQ;DDHE$@9US{2Z%X88)%}x{ESSUF}YeU{lnqIc$D(q+$!Do>6`_9 zugkc7s~?TD%ib_64**aqCrI=6jp2jvXECzJ;p8yjyS%9~S393$3SbpNM$!eBPCoSY z^?i5p{sbK8=|%^$ec*%xSpR+iO}WZrvZosJK7m2`_a+&efp5^Z=LurLm=7>oez4Nf z2TpO5wi~gbMPKxr!fCoUZ{`5vk7a_cv!?O=6Xbh<>2JqR75PBKnpNhz`tZ!}UM3SD z8*+Q!xjsRRbz8X>#{r~~4S}xX_b1YDonbfX6UA>IvBLY_JwZ|s&U7$wjn;7Zpsz?& z-{Gx}Z6~62!V@9zs9_z0|FCAF#CGlH6#x)=;??V}uH8dd>ffps8Q1M_p5KUsy!%Yg z(8{V^SCTT41t71ShxxV}`f`t(_E{iHO||@a@D$0jx3x2R4x2?T60V5_oS45~{OvI1 z-P4p24lCuA2&D}&U^??BYhAiso&XkiQ5t9?^pd-6d{3m)$p1)2BH&sv1+W^nt}fJo zkU0sEchjU!*49EOxbMaCAMRlbfOrT&D`?=DD?tp1^}4pAf=r&HANHplx{#D6_o)}p zyC|e!&d1A3?VEqw81ieyHYmt#{bK}-FK06lCP{wCCa`dukJB`7M9Y@AU+xtamA|;g zXV#hpocO-GWMBZs&G|MsPTj_^^gIdIlaSxJq>xV3QAtFkm3flmXZ}V1nVZU^Mj_y= z%eMW4gHiL}2cb5SV^o_CRRO3)t?qAlT`9U1@3;Bw{)j;UibRoBi|F5;a4;fv(NsaL z1K7n>_-Tw|gNQ$vR$VWCF!k`{@}F4C=o~pz302fUGSL^$s&9RBw&@W5XpV^W$Ig-r za{8xREl28AvBD33aSGW5u9Xj+{)kIh$|xu(r@Txie|x;JfFUu~4+9`iy9(-P!w@(K zb=dmb#0h!B1P+kD7*J1e_}e`3KRRw9fRS#n@rL{#E@6Edw*J3)n`rxMS5l0BbD)0r zN~=SKJ_~O~hB+1*i*IY+64dc|?Hy}%{@2{d*Tf?-#5qCF(CcW|^5uQeD9QYFq2^>`Y!|Z4xf*de0(>;F2kv|M>wBVY76k_qghqEy)~;CrabKN&p6#1_C=R&2w!-(RIX zrCd)bI|;jC;631q@U43j**^ILiUIWYzL7$=y#SEEwbui`3Tyxz|6%W|gSjJ0K9daP zo<5<*8rcWHYbht?rE!?mZ%CZ)jOY)4v#q%oUmcfatp$kpZW*dP`EC4sPN{?M+fII> zP3K7CFzUCpFzYn1RX1p1meM~cmbRp3G$ra-QW3bzY78colPV&EU zO$ksgT}S^bv+6j42hf3?6jfTaMb5uoUEVG9?lbeaWU~uqb;83V8z*%94ksxESf0*6 zT$tyY(J{)F2(RKlYUuh1+NEi}I~%at?2kJdb=R%=te8WLDR>cedAPuHCZvaE!F%%n zn|zE4SD%AH_yGRB-4(w}UYKqa*;VCY^*V3kCb8vm3*Xc>U;QLRKV`o|tJtqMZN-djeoR z8&OL}ICh4RHa>%Oik6XIrI^oBD0w1~lh+FlxOd?P)MHfk-2#A8^p~uNATdkh2KEyZ=@1A{HGm(~ z0OFM{I7B*z_DPe$oM*+e8VK>0^&i^KhxvhN#MRRD@!_}SR*wZyBr;<_-ez_o>+IlR z?i0m;Ab&)R8LLd{M@#*b$0xSYm^eY>>dKSWOMbNs119bx3Fp(A z)qW0xbuYTS-y~jI>GmBxUV|5^s2(0m6HVXD{)LY@pnDny%#sTbai85QI*X=EJNI@X zHH!pzmL1u~0XjInx0mfJ!7sf*?*ZhMYV-ZHcFCtvO7%QB^NE=Ln6`)C*2i`UfO5s~ zW(uEIk^J2mW3hIA1etwr=g}_5=I-dJR(-38AN+K)I+(w$&kn$D#pym@A50R~%J9Co znl8!EA-@L|YAWwfo%^WO%HYj3T;Bw;9t5tZ%)+uIw97qi8$40Jz4YFCEZO=L(g+2L zv-*9T9by4-VwiNoQyX49AUMoqAVGTq2V5~%?Ng_=t-tEexEtrt-$%E=MaDn-s?(DY zC}wN%eC|z-k*qNVE-Lt~FIb5@fj)JydVPdyfkG#@^}O*Tbduw0$z^43H9y1N8DMPG ziGl^K0y4<{I42AYuwtNFMmh`1*LdCaP-vGgdszW+w6Ty?L3p?KtEKhJ_M##A>F)jW zbxU}6a&mGtfG$rmG1s`oAU&Y%kh{wAlmOW#{lL( zc&T)v|EQZfy|OzPD@u;=hl*`&#>u&Vz1bh5+@IwAR=OQ4Bv-j(H#$T~n^nu>QK{h*u#^ndh zT9*})U2lMvU|}TDdQ5yp9TbF*@iIN9O!J(L0N2g2!{}<1`Z*KFrpn7LTLl9N(a2_x zrS)L%#;fFFBMimduD;Bh-Tb+2eL2TY6!c@;9;^D<{jQL?2Fk>f)en)g@udv=cN@!* zLU);D3p<1!dr6(sK=0dX@%nUHprRBjEJ^k~WjQMSsx6?Ml8Xuo98vXa21@)ub@BM) zR;b>@M5a(7G_ao^P>nepU2U^Hteu$$Bw}`WQrun5BfhX3{ccz zt@k>Ztt<-(Is^JT-PTV4;=^DPYun8tOGIfQ*a1g9^X&}qdk+AKoqEQyhM$|lK%3zJ z(B9!%LW=bi6uLY4@DGT8IY&6OJg2gm>to|yp3&#o!kTDePuzya-Mo~Nk61gZ|Bx(F zZ(GR+>K$&!9R+olO}_h!i9?_vQxDXuH%xiwaRFNcC(gj(l6Gk*{Op03S2+dfC3&j5 zkeQvVc77*kz@htC<8jp3gBY{nvS3v|cd=>{sN{Y$)-$F6u8J!Ro3Djz?;WGwLKB8H zjUoobd!h$`%HgNxViaXjcK_(?26V|K;bU9yxrOGr`SnOhS(=bfJMgY(7J!2806?xf_e|P7<;N4-lXSW> zF#(y4LMy0$%x?fO4X1%IrwMnfneEr}I-9vJRvfp>eJ4P3#BN4(*=`|bIShi!yj zo#V|bKp8WsyA9Ox4IxI3Lzg&^0_LUq3%5}-l@+=rqzTvpEwyIw#Pw?X*RG7+8lh0{ zjIg7~Tkqnd+l5RR1jzaC%J?2`$9a4-mpptN9SA1(I405`EyQy$7GhlHaWa_ex4?IX zC~5f`f5L$nUV&J5avb}ZuJF4!09u-n1gVeE*f^{4_|&%0E;B+jZFUhI>&5T2eWjXS zGtRhD#yOO5a_|dJtzv;w7Ws;AyHMZCXw+jhT~YS+zShgzZf;9y!SB~3$`5ta$0?h` zKYr>8YeYivwG}RZz0zh|w}0&mz;_oovUZ zV|+EG22pGQ_;I~zORDA_LUI-9fQWwr6;CMeksqoV%%a`jhCN>6%%rRWazQm}+v!FY zi$1HJOBq}GXFU|t*Vj0uvNI_Mhp&z`W>T7(CCbjVGZKob^u4+ItXo?{(0%UFA#O)* zWv7Lj6FAgv$r*FwED)cd)_0Z-m+0=Gu$vQV0<0$`r~wE4M~?uBrc&qe!lA=uZ|Gc? zsPAe6PI6xI=c_Gi9j()HNfUkDP@M%MT31{Usg&Y*!>Hqr2$iiQsujwbe<~ zw*NA*zP4#U(Zl@y^u>mU_jo{TZgY?k zy1Y}c38xytthHXUv2)W#3}=)HnJV}MdA#X)albMlI=W`myjjOzqIaKdb=2Z!&EJmI z3xT&-R1OdW>Z7ZjNdS*VEbOU-^&UqVM#Vd+ywh?%T;1rf-NbZz1c^ZAVxy-&1u_S1 zptjLnzie6c07TIQdE~xqCG&2^Dlb+Mi^N(387bwLrVc%iL#_!0P74D!pkb(!oiTuQ zo4ZVGp)l^&3bc2u4!obXj@M8-d)#nNDnHGeTqe>y9_Fsy%fhxWPXu4Ye zJXARSE-wGMTu%iFNmLP$-~rnH*tqIP+~K9w;#vvO5n$TE%cD}zs<%G$#{s$ykenlX zB`gsW$HV!lbk{#9Gsvtx8Q$|#XhR8wGoN7qFJqR7%w^Gzg)r;1t@bDeEM(W*r@qaM z#1;MU>W*2__5-^1ZlffHWVj*-%w@0(0@`>3Ts0O-_8E@D#11+$JK;Rb70O`2soTr_ z?f5uJ^jm;=WdFg_3lL>tp*#Z!a?3UvW3trPGZ-X>lY25DE{GEZM=t}6JXA>E3OmpQ&I7jAa@L?&Kjzgt9Z zDg(_tv40@hFSxn(_V@{`FDAGYI?C*@7H5$l|h zICrg~ADgUE6&QB4_Bo0(zkyLpx^IsxJS0|{!}_m!Mi)tnvdcb&V2~|tOJpb_HUd=Y zKkhW9TOJ9^W}_4X?Rie%-d;6WF`R0TQg%t3_U$6{cx6S`L%;1v*WwF0ovvA0B$#N) zXB@V?)0PFv&GCqj$KwqBm~T z?axeA%x|JD)Uqq9TcKr))BO8oA9*P@+vLmLh9yV z6KZpG?IqRq<)zjxbp@++%zCX;w-I+;A4^pye>)eOm+r+@_!%WE7-i(tT_Tn))pR{* zHV*~Ah%xjTEo@qvs`3v{YMcM|qVr3oaH-S&(aY)Zl*-?rwx*6_Q&bI|+XDgq7EdaV z`u$JSyVvioP7+O=*P>z{uatgkIO){8g-o^k#Cu(zYkANRVoM9JZ`~P5UOe_apwyXg z18s)zv|Ei6sD}sEF7m_Wo#;%mvuJ=)(o&k|KL;%xK5CSb!CGfcf&srzI7U8OdwD?Z zKirpKJbXV9J#q9Y$yt7B#o9u7-6M{eB5=d6jl)@|5=nga3$r=r{?c)-T(nDnQzq_p zHyHpv)U|Wt=ilq4KFnXGz(##X52$j^qtB_l`D~d)DDY-019gJ?v8EzEE`qhjM zhr5;|5lbujTt>@W^+c>-cqD%?Hv3aP3wpYz5OlG6$r^`N&JirO*H>B-{jjz^5nHI7 z_TicoH&s!0AWoLyL+2N`NC9I9?_~3K#PDnm)4R{lUkI5FJbGczCv-EyyNMgPv27$N z0o6D3Hr5++D_b$3%=^NzDw9JrluPg< z!g2Nl#Cs_{Zy}DDswm6x8ke!q@!pJ6f1LtUQlBkm)iOVzZwVFpshZqQR-1tdTt{Pi zW%f|AzA8<9CSM-eo`GB_cUugqMv0+ISR5!RHM-yGONYl;h)ogRCigab+p=Em0{J`_ z`b}O=ejh6^Pg2(Xx&7xnSbs_+$DMxFZq6j3Q63aQJcBo@IF8f4mXprpo~#p7-A~61 zJrS~?nW~+bI5SIgieJciH@R98JX7%dS2$k&%30*$eqMX_4?csA2S9Vxpo})8S{7+bn)Tr8B6egw>R?6XB6iSxD`Ey7W5|(3-3Qu$UlD_bjF0B?p+PkK@ zq?_f!1b?|?9-AYk3r9Pxa8Dpx4;L`VLnu7=Tl`?Fx#clkz z{1xTnT;=zs+nl_k5--3zjOL#+;~$~Lx)ccbATIeEXy*=zMPAWzQTRgXHovS6IPf(h z_EKHo&l}5eE2omrov~2wkR!AB`ev=1JJ^00=neCVyz=28Wuoo*E<-0u2J79es=`OV z90dMqYw46a*X;0&#@}r(r}6GwmNtS&4qB5S)Xh44mOpeCb81@0*f);{ZzSWYKzOJN zZvwXG1|7Jy?q$SvmUloHw|8LehZ+172Ys(%JOrKC;X(YbU+ zFK3*pG=+ySh{tKQntI|B>g3od`5oesPcF6Uvd2Kd<{J zvVcF|W25q+6?}tz-bnX3|3x_KS`JjW$JL%Im98Z<$$r`U+^LxC&ggc*U^&?BoB-jm z!p2lH?c$w|i;rjN`Th#YO&dx2UNB2qsop4?gZIAL^w!<^!3D=iRS=rbdGpCPk@Qz5 z=y@Cf?2==c*Qk6L0?1ofKb8mR$$4usUI^7wT;KA5CM3d*dd3$v#>bt9LE`3__D{6^r#e=40MJ{_1Ws zn9L<>vs62w+-UJd%~yP84G^$$0%cZpEc{$lm+&<-7PUE1feo2E&R~iF69ToMUHPW zJp33#He|mYvg>t>yBby9hID&CMs&yH>rb%;!S!0KSq@1v@^axgZEQq z!0-k_PHNJK*!5kOa6sGO&diA*6-S*A7-(53$!C=Vli|*&~Lg$C0-rSZ(A)WIW3Y+xNA6u0?O>@JkjA2@pQKys7y-g}*>_ zAv6k!Q$m!#Sx&#I_hNTxCG**V6MaUx+0H+0y=*Q1;H8l%+Wo#6kxWJJD<$PxjG?~O zenQRhyToG=QKSs5X~s2pKu_sZ!PZcGwAnN!mZY;vE0{+MFvj$O9$t@$|}R^u!*}P?|gcpdTjpjf{a34UH%+ zJ2(~8iBp*^5m{-?vqH?^HXj@NyRP>eFB6ki&Fm2}?Vg%aS7)TKT=nn_5_C=^$HBJ81?$JtJ z*yh(SrvwFlMXsp3#kK>g)+~|4^PDYW4WfhFm*s5_?$|2m?}Q2;Kxz%I25pp$e$*A) zX*o@_Dt$mRp=GGRf`r|lv^72M6?#yRqT8UcLOx^X*7&o{mq|G4>R)~t739j+!(BVO zuM+-vee7FzGa~Q4y?##LepG6qG7&|G>Ry;H2~??;zrMU`Mu*kr|6W_aaSxg)Bp=)U z;k1_1$TX=e5&pTTd`o&%`QY}uIG{nkc!_zOJra=qN1nBC4BQ&VSsswyJ8f$KQY+aQ znrNzfa7bB(e#|gOKh8N0f`3lTA`QL*qr1Zwxr{C6oVd7v+gvImN+rg3Ab7(Bkt1Ra zEj95RM*EL2`rF%Ix0W|&hGZi)vd0fGfCZEoebzNS^z<5kOUJn1H8Y-&vb@bzTGf?N zTXPmT19NlqWaDj-A9yO)i@mi7?lsTSAKLI+^-G|8e);4WdnW3&7OF1#6N2*4;+p7o z=&$+oF*7@xqsYpL1l|3*!cGAxx@md~NtIbVCV^a28F1&HplF@0hfgj;6%wN9vXKlX zB>p$}FAyEr4$S*0P$`Y`!tO*_{dZ!8kzZcdsCJPcGJrBhDos49Mw%9ihucN42v4{7 zId;5C&lm)`@0&Er3EHtz)Lja^8QqjRngwppMuRZw5^X!!GeOk zi3^$TMSX>;)6|g|HFOjdpEG5`cTbgY*kJ z;ZrfaU27i$%J5jeDGXMYDfdodkbLX_0b(%z`SK)*zc*UTCTgw8UkZ-lmvfpTnisVqkf4g}7c8Db_%bQz7 zQ30#O*WcflQXW^_{dgQjaB`IYM|}rW$l<`QadDF+eDTf5-OI*>cl@xG)(=}tNiG4* za1b4`kV}P*1O%W2G)oUYnyb!tvsh|$KtiEmPpD~TFfVba%=`E=<_~~@s=@EM=E?iw zz~VYjKt@NOXhxoPe=TI|okc1gH#QdGP>l+*c~X;a4Zk2s>n05H#SoLT+mIKHf=jzj zeEW0np#8KlOfEM;4u%K8&Z z>+8qRJ<1)1Y^N%qt8F9f@|ilX?!9Ofl5#4Qeo*b;RAqJ(fsPeL+K8@-(>m<=jpV4b zwftq^x+c^?XA!4t{=Ur?BrdNcAp^hq0L(4XbrCJ7|_=Mr?3A9|9G7f|{G3xsp&Td~Y zA3(+uh$Wu+VU#P+WiGRbavxUHSnAtX(Aaaahd1rd4UlBaUS?a=ILx&3l?Q?H|VSzAqG#5(Oj+ON~bRfgYPv>9oi2{_y;D*70x|UKZG|`DZro zA}beMppxAyp3qjy+y2q= z7bx}|ywe^RJM88UDzY&~f3h*T3ioRIXl)SusgF?S*EEpo&hyfFmOZuK?Zq-HduLFR z%-rY0MdIh-{E2t~bIG_~A4-7{`6+tldJhVGG#0{1ghf$zCslELNaz?7nB(KY^=#Qp z-Wi;8^Rev=Q9B4Hfy~ig ze%zKGT!Ar$#Gi<1j#BpDyiQfvCCF9_Z3kN;%_B=F{f&BZoL1`ONDnFI`Dhee6d zearXH?-=7Vk|zlqb`L`k?P)6ZH-F9c8g73~!Z9}Me5x^1&+(e7kK2-M@0s!n@5kyu zFSZrlJj7Vgd%79#T;0otPMsoZ)(V({9Cd;u?DuX2$gGC0>g z#lE8sXLBOKHlyyWH#)tzUmx0jVf7ozbtI{dY3gdUEw4Rh4eqfQ;MuR`$(ycA_x8AL z`}x2oZs>}zfOVn^blH-o(Hk8+4?V_iJfDngg_&0!ftdZ0GP-{K+)UnM(^IEK(tv2? zRj*B8dp%Z-H_*U8OmS}_Fgm;c@(iU-c#f;W_ zf=IV9RET73Cy)x5N@tK|~^;!W*#L@#r*V9y39;vB7n-b4)#EDSl`DusLzF z*%L&U3$0Pm^f;*s)ACj#_Nmq`LNbm1hFE)VEt4POAhjjOkZZhR&{-p$SZ976jicmn zg3*|xtl;*x^sPw@e^*h{OOWe)!af6Fk^gC&j;o(NsRh*PMRPt-&IC9xkZb&IqgQzx zQ>fKK@0^fI4DOP_fUJn<$I`1#pO(7aI~LbnnOtYU@R=79BO(A9xZS(WA6LUJFo|2k zgNBts%m}mi?+dtI>k5m+yYsfG-Er zIn?0?5Rwq)kfV8NTP4JiqgQ+0mc5jTXE7_SdvvZ5_k|ONgG(C1B~Bmi)*%(L#iU`NKvq)hy@3985otMJyo zT>UE3)5Jy~43cJx!v+-1uB@RA zj@EKA+6cbf;6M2OlH^6irRF8b{nI^wY#LfYlVS_UkR(L{SFe9{lfwz3(_3-hXZGk= z1JFyM3arb#&Dlo%H@s5QVRRREWVYdJ-#!W;2$F_QeS{<#2_`N-CsUtpG$cXzh_zwQ zvP`(XYhot5y-q#G^>Fla2bX51n=f++S%%Lhl-pnf16z&yIv9f&SD>38m}i}XC@DJ} zSKEPM`IRRIThEnRC!bMLvA-wc^&-`en)8C^l8gr=Q?=dh;0*qa7?D4Q`{oWcC~%mJ zU;II&XzAEJW^jE?r_VX|`@GE zJF9g)Z*;IOt}b>GxT~wH_14}Om^1Y7q&<0*{>(c6?U=+fo-`(ink__Z4VgZRvcTVp zGys&|=F@Vs*nz0*M}-`mzhIX}7Rr-BXEXl|v_v*AH#)aOqC9!56S>|Re7WqYzt)V8 znXn3TnXULVJA{DyivFjIFRK@8@^8NTwL@s>g!T93KLVxg+m+ZWt;mbK`Xms^jm6GZ zRGy7W(J0ak@jJ4xKf8JtTd=Vk57?jX(5*J{BZi)Kk`nIj3+UbIxj)5rG&974kE0+< z`i!*9=h)|Dgq;WkYnWs5IpS0jnaR#{@LnrJ8@IX;IuA%imZzu*e=Sv(;e#6%D79-S zLsK%L`U+J-y@8S8q&H;(W15{5Dt%NVfBfR+;!#)Zb_hfpaEU}snO>HvO6$mMT|TTz zQf(&1ups=Fj#(m5%7NyK#8{Jl(K=sYjg`@Z^j`)`k455VEdC8?o;*KNp4q#_W*|Rf zoQ_XDDHWSH9CO77+$8XrO8KQydVACK$1}t~>IV9~_Z0n+yJn-J!NY6~fCz2`WpLa1OXNi$lIcj|)w zJrh~i0XXk$}tn93Qi(tjJUDvaX+kW07 z#zwJ~$lVv$SbunC+FVdp>U6m1b##)$QI=GH_^Yx4(_T|-y9GEcZrVI$Fg&l>jwv%< zmSYs~Rk~%RFsNZn4Z#_U*A3`x4w}tZTDxX7peBN>38tWt`6K9U!X^6$M-E5fX*^b! zTN)ADo7eLs$~}j=t#y004<0|K>exEBXXCyCr>V(;f0(0grM`e5gI@r7b!Y`LOAbX5 z8aZlX6N<$0wzz&kHI`m?UNL69GaJ~&N;8E#gz!_7e;X!WjQ=Zbq9O95 zA#)W8p_bsuwJVmy^i#4?g)5Hh0~S+4iIHlhc<|8DyljA{p&Kj$D@1Gn~iEZw5Anb$WxB? zkBA_GjsFE&81FfU52i;H)X)Ug+2nsH36MMabWz@(Y@X!VxMWH4kCg6Tvb$et9qOgz zSa<)L@%;)Hi6%eA;t4DXg2(+5{!CKfm&6Fq6)-?A>{Iqj#XUl`e@E%ZvZZeZoYFh} zXJ5Czf1dB>SbsG8#qpm><6qz4*MMuVO2xvZNq|U?Wd-+wJWKvJ*>HGV>c`eoVlT(%}0s3r@%?C@2{6rHQ$bcXoDuJ!^4Q`e(8GukN8k9g+7>r+WFz z1@Zq1;s12D|Mj>hAAqO0JISi-`@5U`^)&i;2CM&jv;Ta3{}=C!MjF5pVDyF&aclrN zd~~65em?+n-MBhja1I5Qm&pP|+rwkCq2xCJ5v#r(8b=Uu*y6Aq@sfmFj@x>1hjA!W zk)PWNBR;z)!lU(gtxM8mdhzB}Sw?XhkM;cP$I^vWi?{)k6-)|-(1bGE#t5`y6dJDl znEa0eP3R<>89v*+MO={0-tR{KBk8JjRx1n{o)5Whq1_JKtkL&K?@On?Zn-!LgHOHw zEPG@Aa^cqy{#Q>zFX9Jdjym(Ei0XMV3=zLxcz{Ur9q##yUI0b+SuLJHS>pYN51YVZ zyYWoX=fFZD8yd+7Qv2Hrb3WIT%vOJ(f%SekLzoqyJ5;cSh7tf}O#;x{md=%lGgL`4 z;#UL%a^bnaCrZF7sL0Dtu%Q&50i#I4ExQF+W9Q^9M~-u;B#r*EfF7Ciln(?kEfZ6{ zkO?3aalsB2d=%c94pKJSZ&l2&do05@dfx{NsC4u1PnZq6zcig?gq{=d*eu5`QF-LL zR=$n~ntz|u_JTO_{yRLvME6ts;FXNb@AN zrM|Z3(a{#o`tL?>_+<2_-J6Ag(LYf6zCs5`VlefslV}N86O&94xcEy_y z=p*U@+>s59@Re5YDsvpS8dE2aQ8+p_iwh0&<%?5fzYul(gLGqfl(E(?JrQY9E8ZEe zZCX!dYMx_`3C0UsN4`QA4kLV%Ka%=AFOnx36|Y}9_+ocRDuk@rc_45lzyBH~W^%xiJf1l8^F4nsqxwkx-@D-TL`J+yS3|8~-&Y7hxsrRD)P0T{?)0sJ%u z0C@<-ax1y6KCxz-EdSEHWE zWU7?uXzID|zA4nMFLR@qq5#;laR3##4?sX|)&WZY?cQE|*y%EcR_{aSJ?paA;SMug{5f0 z2g0*+A?C5sJ7#2>fx0=chpWi-8lgO%Nt=p<+xojQ$VpvfYf!1s5U~(8n;rdH+}`0! z!L$)^TKi)fGrvnvqSbR*e4cGTh8zX9rNLO?huBsaMj|v(4b>@uQF}ghMYwtk`OL&% zo`SS_zDqSn;xgn?hx&oFuY$sdyR2ZN`4jaUw=?7MKYe-FDs^E(W2{xSr%K8rN!4bE z%BVjgkQir=92^Ytg>BRDS+!Zn=If%f#8J_ZjoA@ z{Ath_P6I2C%^WQOi(V`eDqgI_gDElVvtLJ6<+*9W=ebc(*gpS3)wuJ|oAK6x>O8@S47!6aBTGNU2jo0}xIt$k zn-G8N1W5rcdeQ3EvL>Wc3r$c_!Q?9P6*}Q9)D=hD7}d-ASIgUD076x=$6|l(*nVw- z2{c{s>KJZc%pZ_8qoy9@Gah=4=ie_A;O>L~M~w@fRujCF|L-Y8M*^ay;LEnf_jTcb zIg7l;Z*adXI+(AO1s2qe5vIMdXCM`HpKN2zlX`DxAvY5kIK0#01Bj{BRu4`~hnXiu zQD@n#w2ilVxFqq~Wf@NouK>ZYpZt&#c)rxR;~yd9(ZKTH#2E_D6TiZCm*eFsn-!rX zfMR0+qCt3p)nY4W0I~Tpfp$QEkB@I6xa;(du!hL0uRytTmCO6x?%hS38rFem51&6W zGHQ*@g3@@NJas$x;RF8wIB`p_-MPzg^$$9Tp1-a-+_X^VRP_9Ittf8D85uvd9TK3( z;=$D};XH&gR_Fzpc-3aI&yCZ-M&fb(97esPP$g!!duAz#v#8PFnq=9;|0wL7aXP}3 z#9{NpxlPz$-tQSQJbI@)DR}=o*kBecyzgZzLOkg;cy}-p;emisreD8_naE~d^HS-Hjq>@>`O7k##O&<56~1$X9`RAQna{rp#_TWm zxXh=r8e?Z7R^o~uVx*NHD|nu#9iJ1haDNMdii6~+LDCDe{&;2+Ia@)W+f8*o=S64Xb#KXZWP}Mu_J0@X8~yL|mY z7l8k9GsM+jrd&)#=?5d5_}2KgLOhDvC^+oQb30-yIaArEpTZ}puy4NJoPp1gbEZc4 zak`_k71G4#TDjE~rGfoHZ1{X%ivlo4Td@}5hm(Pt4`(p?GElOV}i~QOWfD2av6m)a!ry{%j#C0lrCd)JpzqKTaej`vCnPlSTZNYam=S{oNQ@Z> z@Tk25zNDDb182c9SXX>^|di{mc`KtvdvDb@QTt!L4I^ccv za!oUk*2=+6)h=(h-{`5}#=@s6KGziKsPK)SuF0*&C<}szi7kX=4}@@vde3!S8=6J@ zJZV4Gw{~K%qT&zQU|LW~`D0k&hS|mRp4+L`$99BKcvU+%bKfPvcXa&Gm# zklYVy`-fC^rwwtvz5*zh1fIc#tO}HO@8|v4-tLxKt^48D&gVcSQ!!NhEF7Q3 zKxtyf6tng`5Fw<`FHi!tuK1_lFkKfPojt#ai$s{Z=itU)(s^Y!x?T7 zJJkB)y_{Ssr~KYzS?&rMG|w!wfBs-l_}>p-#k1#_LY{WBoIvC36b%}TBbP}Zlcx)XnZ5Qc#+HyQDRc&-45^u&j8Lma-NVo zutt4|^CLh`WCLF}%`Y!iH5B#e-a{SS<~hv|LI(1(ao-g&<`I9B=kvHqwOnfZkpBZE z&L0sqaW`IJh062|K)p_{obT`NpzGTZ16awXjVcy zk>?gEol^3&#yc`XrxR!CoPddaLE9(sJ2CO9NIn-l@y@JdK9dAL!Y-~Xpe&czAyOMs z)Gy`rjhyVdoAVec@3c^{Ezm%;O0d$dkh3*Q{9#t@5mEL`5m1A|4s26Zxucu+F6}S{ zxFff)RgqP+?BEh?eCN(E(~d8h3v2a5+=QE}8l(&B4W#7*yEQsK`vo~*AqpBPXI+Ko zy2#%&orf3r+gvOu;*DZ)geV%y6|ro8seJnMiD1aX=AmL3hnkHP&7Wb~te5>{)z!MP z(pdmsU-_>>`yZ{t27UOK0*kEX&0pNu87z;~dBNit``n(}RhtdlV2^?$$1vzjsYK%ypT|*ZU$^f^XIuz~ z*wMb}E%^*&n>8=?Z3#GuAHSs@1j-xHJpA&Z{W3E_8ev7Shs1icbh&casVJI0%5sKw1@-ZC9 zX2n66VHP44J-X801%jGYp@5D3v$M9zG8kra48qSd0 ztzbv*ml1kikxqNX(>f7%;>ytXrIm@kvwKXEjiIgeyk1@a5z}eB{}8#;n_$3E`bq*X zj)83Fs78k+qiDi|YR8vhoJ|Q{6gjMoL4&e=;82&j#RyEo@CBFIg-|H8VJ5;t4toF8&w5Pw6Bpgk!^<=^Ki-S4kw)-n>`4f^#2Y~JS$k`VM znJU6F(Vd=@21=Um0AWg^v6P2#jBj5Duwb)jF(W>EF@x9__8)Lr^%mVG=vR7F1r^DE zNvcc4;TU!AapgTHQZCWxgmbif5HL+uH>-B-L*?jy_O+}uV9qh2)c3#tFd}=tq)-*%&?e`9b3*!08O!0YvX83m!;rqMdzG7dUmx;kh%7i~M zvukZ0{XnhLYOr_JKX)Vf>$yaKE%^`I#ilj8q?lU_lH5OcV=@T7gI9BtJGU`t^OPII z@!qeKHV$`6L`4!M54-D7k$upLvLvCF@+K2jOh25Y8gHa@dndv3>1|Pg%;_KTK?|CI zy7ZDr3lH#qR#T7eVG4&N29BfnDn?(HF5ZT$NG3kiehtZzy1PQRA@rD`=l**pnVafK zfWIeA@uM~g)yZmME3zJNyWq=xWOxWYvIwQRm?LT)Q5PSjI--B5n&_Fm=SqBo2U*GH z|43Lf5Osvlc1Fy8)jgTo35VY|JjQ-tldCZRZyg6VClLYL`Yh+F#M!D=Hxu;Z0e)9+ zi`%(C`V^pjVPMbZc(ka=hPu}Ko!Y+z-L+jmKl1Cx&I{SZbQI|ym8{r9hJjrLirEM# zrQcHw$8)6f`r#D?sE$14Z1(!fz;@K1t^fkzQ03Tef(EJt+G?S>qdPT2sRKi%ADN?w z^(Lwi^@J@ENed5-0o)cCt-7zP%H;>!td-B7rY$k81r{SP-@Q8bEOy! z66K8&Eu$28ChciUT0fS&aXz=b8d~Qz3y`l}Td&7jkwG#&u4@Mxinjyg<8uTl+B+dt z988;0*j*wKU!@KX^-Qrc|4$qkh~?)-b%E~wt0Z=Z_!5oA-;?U<+v6dJiFWO~1z}zD z>B_WzP<_y2n=oD&Wubn3o!c$>5#Y9YlvzJ*07@qjJa7P!*u_=gjpH3P)y?(S82NW* zix~}VQl#O9#aYT##wctPfmH4AI<3sTrIi+!S`K6t6h}jq?f2FaJsM7#>l72_R0K$Q zxF1M*!qN;%BQ8k37PeCeDG4JX4c&iLM3syrn}IP$dTE0*q%FS~z`-T9KJD-CX<4{->SO{eYMaM3{hygu^t96WENw)P=J|M3$FRnf|Tbned(Q z7wMPxfFwZDGq`x_#P3_yEbtIwy#4xG3eYs^zQsaaDS%KOkjoA9{SEj9gaM()I|nyF z6>P{_;{m$jvp>lX-Ri90bFj{@C3T4RD9Q&EUzFNB-OQI4<6WHrMuGn;>^23a`i(wI zJCFU=DQ>3vc+K`wr)%A2HFSDXM_ROjoha>?o+lNrpSLg9KuUh6|@KB(;5QM8^J^28uR zXHMHw-c~+#Vb0l0tP1_4_vbq&usHejRWmYTX`A1LQ~8P#^ZD@M{&DaER9v#8*|>#} z&kw`Sv0y#FI|lqYYfWan(a7UweWYFfy&*zg)M$ffD=0aY=Z_S{07{<^dzR7GLE{&3 zsqj5a*#t9w3&RZ`lV4IPc+r^I=L?k@Fzo?D{Y@qElqir-&{ zuGqOrLG&TOc5I`K&aB)4)P>cmQNjpmH;ig!+;AL=HiT{!hH=c9frq5~ z%xXCm(o8~U36*Miv?pr%&sEgyE|Y$NdfZRi9D1DJncg7~oei<^NFD2yix>6KIJHw(Io`-l?nj=5{+bD818@}%w zF6N}q!#`%7QiOh9RCQu$C=M616kHnH7?`N2-@L>zxC|n0jX*(?Wjc*D)!emR#K-zs z&yRn7#koajwz9xHhPKq_s!E#5X9CJo?yzrcUf;;}t9ELbDjCxEItx%89f2M+7k9`j zooqnHrMoDiVUZ|XsBCBAA&J9edf0Y`tdkJY_NE`ts~?o@EFtl@I>OFB2+Bx;gn7&*Wun?vv>sR`D7RZHBBm7I$^u}km;(0{`TP*Mpzy&IQcTF)`~vV zi-JIIs0HX5<$cZV8p1hbFQsmR1qBEH9uRcX&d&jri_&_UvUdYI=yF{wf#$>Ea@NOS z@MSXS!UG;kamFN8uhZh%cL0poDTE}iy*moX<#;alWS4+uaSID((8xp(8i9P4({>@i zO5@3pE;jUJQ8w?OE~-ltrl4g|o|BN)fHmHRD+-%WSe(3mkzuEP>DK%*gBt(eX1J%! z9j`D?nFnv5AWUM)&&Z6%lG=JzFJ0~N8_5lo7pGpSr>UjyeYJuaIUJofvVvq!aa22F zc9&_jomIgqX;~2q&8VoZ&E#YYaPysqWny?QMSlJ%h{ori*)2=ksR-ZW9lmUEKeqT4 zQG9s!iRet#AW+s4Rj&G1mC^j<4`r6_8VzO3#(AIZGAy#R|Bt(~46Ab6{>q;}vvPM2k;cmUXhw;J20cG*mNVnogJo(E||Mf037n@-T?o!z_!7OFCz49=eyn@`GlkxIu<=$V$d*bMLu$<6d zT8}@TYH$y*n5vb%@}3@S_L^G$c(k*bZZvvzZ>ZZXdwjhVP%u3yR>jDEWw*Fd?syEZ zc%FG_Z?w0KHL{U~x_9mDddD?YW)+tIawmzy{Jm}$_FwMg4_*22*5!FEqi?{BvsGW| zN~gq%C^DSzY9uBkpE9{`m0EF4<)Rp|xY1_GFBG3c2baT)0>e9<4u85T7QG`R*%BI> z`3W?#b>p~Zy@R*lck6|?bg?_r1^xn01WzV;4Zb;{&hUGgX-5}Pc8gi6sS1;L5W7mc z)#N?RCVEkBF=gkvKE+^sxA;XDISSC?rgk>|M>l3Z+${pDe)o{|YBl`h`Mo(!w^I-8 zC`vhobkrLXg&n@_QMpfH7jI?LxkzD}FBD32nkZ6voXf2__9FO=4wuQ-Hv$MhNrB>3 zdu{$-&n)M6k&sPqD0ES-BqvHVDXmYvR0je+PVMZ?SB2p5*}dVr_!{w`-qms0!g_tC zyj74zr1qB{{L5s4$SyXM$2U9f#7U=d%S=~U7H8poUpw$NPRj7JXQ7nAV~nLy!L;x` zon`|(n5w&M+xh;+g)-adOOTQL{&;4tS-rwI7Lc%dW-pJmC;UIcJ$XJf{9?;+E-Cg| zbx$Ix*oSiu;Xgk|e?ItS__+ICKX(xT2gg_P(^Y1cevfYX_6YNpyT8c;Xo}g1iz3og zMOUbyTGKnT>^&{|!1oIvYL+MGAns8#LZ)KCnUxq1=fSSo0*Eb0M(odJ8(cg2 zX+0}#yvc+$9Iz;b=c1yCVYEKtB|;TR9LZVhTH<%{^l%sP0G85Uy7&*fn)r9-gNhBP)iROed%zx)sMAV{3?Q(?^QcSo9EmbsaCqe zBfUKN$b^Mjdjb3$DZ=mjkH+4V#^mi-WRwHy>%Qwgk%8r zeIA2GM(6C`WB7mQRPfeAZgDqy3T{3;SRS9?mssIGf>KR)mA;RWvnB^zeS6> zI{MEW&YynbMutcNNDlT$zBT=qtNo)r-p_#KK(_>Q<_{9Ye+J%rJ_9Mw%I)AiDD6n|k(qHPiST<@xqR(i{PT$wjg(pP6dI!1q)3orRg_5mWmHha- z!{3MSNkSxw*Q^)&91oO^$w5jj)}I~?n|lxsuDxI9{jFiYb!eb2lx!(xOLMaVPiaM| z7E-nUpJuxaI+(XeAFThjQ!xYU1bU6zCuh$2IB#69&71!)rT^pGVXVc#fX!fA_rD+0 zS>TRZjQd3Ue~0mp{Sa6JT+G8*D`$WF@c;g7?Strt9$ED-3+7+Gh^FluGd$-z^P6Ku z%omi)=?0FxpK>-fWxF#qa=_6-At)#aydoH8zskPwr#+wf-IR#7Se?xNC)apXI}u??gOR3 zDHL<1gKX$vi6ATh_`5Zh9}S%2WZ&JIzabHs`bW{>+#gzDETv0m>j4C1x#Nxs4nS>Y zOZVKzN^YOS41#Nc6V;))Y+qkAN^i%L8WL8$&QJF1o+TFfYv&~$*(!(93imsy3e5uC zm(`X_h%=p&$un0ivKK8BccqFRNEJH&8kZYEpL>n7fWjZ_K)3k~-34%;jR3PbHyqec zk^q~U18TI|Z4MEum+ARxHG8OcMi4S?jpoGzx@Xs>8rXdeH}>by-8Rb%2Vx|SR(t4u z$%CaH$ahM*TKkn|_GO{zoD%S;q4RaxEneCbvPm>M99D4;M#pDH{*XRn5%qZc zTxElkm)c5CV;tLcR(XFiht1t$y#YUL#_WWz(3{@#+Z&GJ7vhI)4 z*1UUy$cTGRj{_p=Xo;;xGf-#-vwZJ|V;!24qHJ0dv17|L@p!OF%ygFz&(}LZ#WBMl-NO&khMr`~2qMI1PD_4da%oz)>|bdkIEvCU z}4_bii z1;T#M7xI2wVFU^2>1B+SXlnu;5DBpCVnIB!57cbMu!aa;&vrUc(+sK%nw2cdq)w21 zbo$}wLKP6|mK#|4vP$eu06~*CUY5q&*hgR*B*=dGv5mBwwGmGiwxIa^zCxn z$}nhEyf)(Z?t;T%zyA>PGg(%rB$cPrk^8`9t<&<-dB@dEjY5DqPiCo+TcSlQuK~-U zJBd8@>HD|xY2IXcw-rxP7Ff|HwkB^$wgWT#8|*e`9qkX2Qj5(Jt+s98@XJ4Q3rkKN zdEp@Srw+{RN5;vidy7((a*?*DQPXwUcjyvrC%~(qD=u=NlVSh17738~LLfHkwKiY$ zPENtt^&{?T)!B(m4~+T&!xbdXYie1Y0TEg+;Bao(X)EZutaKu?7&!|F_^kd+o@C?% za)aDkMSbHWTVClTw2!_4ALKWfsDa9j!UshV)1xQ+B?p7h5L90XHltOVT8V0Dnw}(a zsK*6>nSbjAd2lIc4v2K>S~{B(A`u4H8ciOT!P4o65k)!`6R-r01^r#@)98)LM;n8n zq@I!-B(7=Z8rj!TEB+9JBJmjw*v+aemWxpr$P?0v#Ucop?boGQ-WLG4v9Y?)?Vy&& zd&XUDjcrqey{nU2c5{c7UAF>zfbV{^CImacmYRqQsJ65kn zD3{qFi?iz^>9A6`p26HDeK7?D=G$UWu!9-t zy#XKb06CF;f4a0x;Mq|^kmjTN_A}tD?gn^h2EgNIUcg7>BeF@P2($JuUS57YMvJZI zhteRc6-$$Dg*6=DQ(XRr=NQ_}`m-DNse%Urev!fa!2&|Khg-Rt4QMy8o&Uf>qR|uu-W8=_?20Py?+1#jz2k*Zuie?z%N^>J+#rHmv-zn+ zgzc4EEQTS~E6W{HQ9RBJu9>#N`C40o?#Zt#N7A_;uiRX|Vu@P19Ki1%lRrb=Zx-PD zNIiO2DK~g>=1%zj5lOMf^tmt#jp0O!>(RnAvYq5TG_6vZ&zNgb9IsMNc~g>Cx+n2C zK>>~X*?#mMk5g~OU}Z$v{Pa*VyXMS0L!sI`)ZvQM>0}X?dV@~>`(EzXdB@yU%HJ|Y zvRy~Ja!ez?8{c~GO!TFD|BQJq$7b(30D=g>(?a=%vkOFudae%|&CWImF?}B8>hXA7 zlxaTYrT=j76qfT47CqOp-4s!`dvCdVcvy|;tC3)ZW4;^-Jbn?)cSoy}I?Vx1Yx3P| z8fJrIu6!N3EX=-06~07QwJT}~j z+Txk{a(BiN)0fYi2~4?znUaG@>KrD~z1wlFkN1We~8(Wr7ZSzPFH;jkWjZB(PJF&qu=?c-j!_Tds+WhuTt{p4zB z(A*~*PvWQ?2>HstmW(4?lFMcm}t6nK?#-XE@M8{mmvX#l6m zxtLw|yQVyB3*>0s2CV3TaXXhrIU7Ppye7G`_k7QWtH-DlB_K_^FE)kz_R92-t{E5b)2m&LJ&l7__d-X|EfxPf3|Mr2<=blbu?zWsR@;29|KA0M?xwx zR7@JG9thRyoZads)8+Qg!Otrb?&|T?2{FUrC?mW58`rI?Sr+3$Qn83$OBt_U1s%~8 zj6Zhkj@Rv{l@}EnK-G(sc>HS*JD?T5~R~-2&__`;{`G(zW4BQ&d3)_TI3fgk=}Qy^!}ebD0MxD`GsD7v&@eo&vB18F}l*d?{+M1 z(B8@06Fx$Fq;|W&Z8lQti%BOh07I_1Hff8o7DwUbm3`H|F5hkIoADrNNw|;fPUbk$ z?VqondVl>f1pAcNTEqG@0YiFZr;DICKj`~$-**uyqs^N3RRCRhC5W|JDUgQfyb-$N zZ=b?xmXs|Ut)cPWheWwIFjeBr|4<|f%jKb7!;z~s)T?&|0N77)vADE1#&>nR9d$v}0$)=SwYR@(jfvMW2Q#9MV?r-dc^oD7+7 zbF{6hie(RS`I6bN&6YZrr#O+)TPXgW!rhAA7Rzy<^t_9Tmuv3VqG@l5JXtR41~yx| z;I8^q+*A_J$6QzHa6M6cIeG+64mw$+=cDUzM!8P#-0>Fm+PLNe&f0ZLS>@cRvhaJm ze2j%>+9OWuO!ythCHt(YL0bwG9D*O`k&n#Emq`6QUNo`Ez40#gj&;(Jn{tt5&_Rv2 z*5J>OuyULu{9?CN;9Namd3<`FAo;k*(_65K4>b#It*ZWv@H6XePIDGQd7rt$uTvJ*$m@2O+dt)@!#&YWe5?zSnyWu19$PSx zyjeee8uM)LNnfug_S)Wp@R}HM8s^W$PJ*$r@MI-#RMWTOkd^#U*OIS!GP5OJUq2>l z4)$!=M@U_g;7AW)B8~NVH;=fY^6;L|+A~xKUS`HnD?YxGnkZRV zERQNsrnz(&f?^TigvUp-36zjUj;Hh{#Lk@CjOVsp{_y(3r}5(eYEP$X^b40jM)e6P z5M}=$0L1reAjRY}$dTy-M0xKcHG_w&7Y zwrQq_rC{}PSn(MZIrCSUMfqTRuOI^=(2?t(lRx8mMUhtf6NM>cE``(HpMAjTfVgDA zKMN0tM20~?j{W@FJ;xA9v+L>h=H+(C8MU@bkp`(4+t)*#10CF_Ww!>k%l>OQj)l*o zh;N(n=I34Zj3iR0C+foQkrFt~3P9XptU1DQ(Z{F%-K|zbuAE(5rDKfV2N*w;7y5@b z<21(hDKGEPlX)%cUqgJbj3ncuz#3Ok5PI@5i?PwnJ{#Y$ttUFqLZXx{@Ev(_2@u3J z9^Z8_+n;G|4WDvdTfI%S*Q4<4RmuC&TO{YGwqd#u$w-AJ?3*x9h1=fVv15fZlKmOK z>r`UKG^Q!9w5NUgnF$t|>3m6#$FnyAf*Z%-gS}FN^{$q_2-+&^?SVaeLreFee8?%% z>Cf*NSEDWk7xmlQ`k38%s1;G~Ah}l8omcPVk8g}IzppIpMNLg_g&cMC8$4vFA6MFp zFF#8UXMZ_+3$sJ>yq`$d+~$WQ``pGsmfcD~!BMf3Ui_Tf0UqSd$=8l6%!atB=`W3k z{&q(xX>ul>(*%3>(qd2<2J?qn{hdLOh&AhYCQ>Zi*q@pB5Y>LfM5FqrSu$l7KkxdO zJ*9qR$dz`w8j91-AbwYgEtjYw!I3HP$C`eoTcJk55=9gcPNH^grS86%kJ?oyW3+DpHl29PQ$sX(_L(Tu`v=!5GHV@Wx*9%Zltc=qrrepsv&d##y^!Sm~m++ZUXaKlrkoG<;uJt&?6jY!gXz26Wi zYqdG_B{EL^$t&gEx1JY=K#UfDg5rrVarNu2a~GlJU^edbCA-Mi$1E&r6*zCy+Bkwh z5DcE6cRPl7)09>rJ8;Wpy4EbZXngBc(T6Yen!M!r(>1YimKKU;4%@$UMsg)+v%GLp zHy2%nFf&?jp9vh1!xFrDvk$=N9C9QpJl!-2gwN!tG=(=naT%lH;0bG3xT4la+yqQH zBi0ys-4R)$QY{g8dG`uMyb}wwN$7Do8esPE4)d0MTWitNxH=Xv!aHE`i^PbjZQrk-TKTl*QoG$QZ z?4622N~6;rLC3w7se+9J$$Py(oAXq*SffgMKi~(6<9;tab!r#8V`$Ar<-QO7C2Mu5 z8moWeGDWmephzQoRZK*v-1G z96jB*t)FWSP1-hOL#A!rvMHtygY)a~Fq}9TlGUH@)uQ>5*lXacEXt#Kw6d}svz8)4 zqgFV5=;1lFp8*HpN}DrQg*tJ!#ELzk53T+NLv3GrsdV>87jZ;iHLCMRyx#P|e+3uC zVH7S~`eB&gQgr_M8tME|FSNF5W$vC=&#KbGD5`O+H+u>O8M~~JqmR3ND_QkVs?>r# zY~XgtdV=?)hwT!$}t!HPO*jrX_-Z%tu&%^zP*})C;AOBGw5?_x4Jbz4nOf9^zDC z9J#yY?;1I-6}ea0@<*Jgyo{ma342f3@ShfbL?#Ra(q-7wniy0&{MWcQ7y1h~W z)t{&Vb}}*96I3la%U1%vBkO8v%?WlP;#{(eKEz9c2Yq_3%5;Nw3li^aGk(c}z3XYn z{Mkv0vNzBGJ6;RKywV5x%Hzorp9#{fBo>*?)6cb2W2f&d zb=6aui)4EO@qdJ|nSP9Xx*zN)*PuDL#tsFGud-LYc2F)2kQW9`p(pNv>o$TzP&x1Q z&+j&Wb#-IJBy}+NSr-m;-#ct)QojyPHcGfcB*jcArJYAuxApd@s3_!btd&z~QB-Nc z9yHTi@#`^R7Ru9b`=(=sQ=({FN0V;=xpykrUSj?&005DLy3xDisc%5Upwt zlYt&dap0OChx=&^?UfP}4C=QJtNWM`4Bv-(p$^+}$?P&1jJlX)a&`;}qY&UW8Y$M~ zz&Je^&I&lDU|1mJ_IT4W^IYP(nx6F5$TCbpfB_cMA%?UC+V61*Nxx>z-YZumygX?k z6n|B>=Dnj|6GGDFtghP*(YrW;%7wEd0)mnOdL>o7xh*hK(|3nqP8y?PUrMTW*b|Ng zt)5s*Sxjqjmt}KFpINBqq=e4~S_YYk8Cpd2-QKD`BK-=%X98|edvru@qWqKFyY$+N z=N8w;I$Vb$B1jXi$04UvbYlDKDrMo+v8u-OL}UQV5QJE= z7_`)YA3bobcHlh@Tf(^23{pPw4;-5Bem!Swm@#mF(K1VTyu%ZhgF7pj_AHcLFdsWX z!b{U#<%*47FPHf{^D2pY&Zym~wSKY{T3;s3ThD{!w|v~V`aeb#&%#Z|K1L!^pAhz4 z>Bi)IS^xOUb319Cv2J%S#0~+Kw*5dBENm5I4Y;nH6b@A~>T98|w2#|QCaH(z?F^;p zjv88utrbx(NII9N*e4L-Bl!GZ{2dufB998KOTX-baqLN_cd3t9cT_ldaOA(D+2^xX%rGZJFfESCb3U zcON`lj}r=TIf_b=GUWPDNkw}>5|HEjObiO&DmSa?5Yb!Ed5&`C%(L;7+q|pX3VQdHScdzWz9TtKvTb-b zeRry&xn`NOxq|9s#RD}5C3+f|p-Bm+q8VdUvFb^x1IFv(2hKJAE^G54xunhlA>(`4F5u9OYw)e^lgk2QKt4%QeIoZ zs4L;lYiN98%F-SV%g22g)o?OAI%c0W!%_07*s4}oxYx!yG>y~lr>7%PFyaECyJ47> zFe0r--ZGP(-sQhG%#(m<7S>v(U3>jJ>VuMDpSx(7^Ls|c!k!-83saMrH{37=;XT10 zW&SzmIZT#6pPOZ?6-zjc8I{j%?cJq&_86K_ks~G6kI*7+zh%$4%JqYhXY%`NR&mvX z9qlBdt0;=jW*TeR*Hm+$;PvFU%tr3<7rmuPnvX{Lmzwp1=*pDDU>aH99-E{zTj>S? zV_}5Nkk;h=4{ z4eFSD_261$0eUu4QklKEexZ1_c=Y9d6M=r^H;kpsr?SJ>TKL>mPc<`j+PQP z>XTf1uFo#z?dDPocgmeEZu5O3^G9?H`i0&Y6(I3&ELO3R{vDoJS^L@Xg zi*^gY+xh;Um3;-CM9MYxr92w104494phPT9j*|P=;7ZHUk;X2<1h1{Cc=zr%b54+< zgMPc!_b%n?7{|CssWax^4at&42Vi5i#|fBQqRA^df|zboj$;Ht3_JRK-b+~2d_NGW zMUKf=d+gdJ>r<`){zB@&z2dv^jmB9#x?p~t?P29kxs;-;$z1dKP)!Oh`wB|jCw?^H zaPx0tH>;=Wnz0+4BSD}nIeWqsK@y~7`SGGs&8OM#X|Ng1oTVO3wYE_lo-g{|{=B>K zhu()h+Zi*HilbvH1o=*M{P#B%x;GJd4abL-Hvn5`^v$X9u28~lC%%^iS#l=rMW^DH zy>m*u=)(K1`MH#*U!RcT;q^U9%EqqPawv&Y#9i>5z5pTZDfiwu)uk*Pv20(b)|N@C z^vkyPITayu2Lg>X=RF(Y?`CB0Ma8V@BB}%P>We*#7d8eKVxn%VyN@`e`Wldr6MYcU z-lanp%#cu;Xs{08SwGi6t<4Wxvc=rEgcRKZi{+X>ouaxr3^MJ#UQZER?TPS(0n^-j zMu#1vi*gsCpO0pRH6OCfAr+L^yaqRO-c;4Ze_w4Z%goZOX1$*#Z-?#8Naj2ZpS+B8 z)?5+ZliU)J#C4kf^|OfALGJxfLjyhf9tq-v!FR#@<24jT9%vOQ_t>b$Bv#yx@xz~w zZ&$+VU0J`Jx<*6rkov7bj9kO$J}iXHfn>-)h2APW@>xv8RkMYjiLKqWlPo26oSOp9rH5F4ET2t79pMiUC3v#)&g4U z8?V|oqUseJQI{Dci9B9MtK#(Pr%C%mtubtVkDo6%(^%Z!*;d;&dre%;CMB=CB3F_i z-F%+-*iRL(M;IIZoKz_LvZlc@d24`iJczr-Upf8QmUoWwqhpN7amJ&qn~*!r%YA35 zrA9NOTrcdb+WM|j?{n#Ie6-chH~$c!p(nR?5qi^I1jz_8o86STF#3ew08WW}i$AJG zq8K4Thn!HHVd-Fl;l1;C+tOf{nI^Nz0GWZ7k=HYJdzju^}_o^9s365{qM0`{b3 zz&)fmTQX6yzR8DGokSSHoBCtbij@>ZWeOjiB~Mdv9S9E$%dHjj_5tZeDJ2`S{Xx6;Y66;@gV% zsNN4{j9TDIE_K*C^OJ?rqh#J&Bn0X9vq(2wmUcxn!f6RUk7iDud@I=89{|;EIPCG3 zEm2adO+lTT;ezLiTuZbt3*K*I3sp;#QV=gt?3KTNXGl1x*@TCGm9)EEWxjshuiRu? z^>iWRqNM*bv1d_Xs7x|IByXG&$Xj>e2@adZo|)yTa=O-F;mBo zhJ8pILJ{V;pNS>5r=gCbkF|K6Il~FdBQF-?ID@(j5sHYH;d$O9LAO^Hzn25AAc;Np zbjbdbQ0e>C(%isDWI~ zbN-7v1uKnJtT|wF-Jo@06k$*&eiuh!n`wV7-u~7*2x9k`pQK*B&gjzAsn!Ez$_rMMn2n@-9 znZ`+G&%&Q7cjGXr;K5J~kgfY61Z53Z@36JJmm6f&pdFwkC$sW1=$#v0jR?`42D>SZ4pgmwpT~aL6>Mq`BkCwc?5@}d%fIa!*5}$hq(+^ziX{M zB#3nG8J#u;wAZ!#d*fmkj3kQ&8jOG98s8((#>AHfJT0HZDv>*1?}?tdBVc6E8Pl(E zmJ;tKNJUxAH9Q?+s(OElo1fDqK(x{wnN@B$#Vq(4MsB$rY_$?n8Sdx%euV!rAs)Qp z3(p0FY(k^-{~51;h`2%MeO-`wXNOSkX}MFy50|U^rw||gsLUSILVbu?O`1vX!@)T1 z{xZvz3NFy`{Mv7D`F@jwg5wRqYyyf&NWxppz3J*ml+?6SKp*+D2Jao^t71(i>Qs*H zXTINfpwEFO`40lX{dj>!cmf-A{;(VMd6!$|%e$E`M@NOPW$xg*qIag(xVSv8LY=Pe z_i8yucF3jTrLsOD1H?<#(K$a0X>r89pJAp!QEG2mllxkTpl)K0c<@}|hB+X|JTA8# zHO`~I{2d$l&`_WS&Z9LB>DyKV(8NCoc0c<(WQ+)ud92>&R?Z#>HL1j{<(zCLB4v*S`XWSN8uM;M zp_+vqx^dv!@JjQa{#bzbAsaiQw&?eSC$bL$5n|<(KlEMuujyKMJkr}-|BUBsHTS*d z8;_c#U-|TKtwywqtqmp}iw+q8{>Y|~uN(0%_iCqT;kB%6+Bc{&7(XNA!DPC=uRIFv zu7aqIccgmC3y5(OZR%;85Lyr?zxh*>$ZUPD)3msQ+>cMdX_(UY7e%~NLHK`_2K&N3 zUsRGp@_=%2`MZu0cn2iL#7x>UX}@WB{@YiHd>>F&i%(kH|AH6zbAO{p12J&W*83x^ zfA{>KmXCjaibMxu`_Q_N2-5!RfPp{zoB*h$;?k?E)GC`P2CQ z<#&C5kb&QPSD(a-{omU7Fna``pODci@IqvvYkUKMP&lfrwfS?Z#Ko@b_J6s$xCb=e z;pdAI>cPOjZHyjJijuu}jrzM_`9E|KxET0Wvw1HI(5L^0|Nm!i-=sHHJc?M}{tkhH zmM9Y-s%=oj3+BP3R>>H8mxH;fJ3FU2n}ey5t@Z>nmjF37jEp*&}0IC_lk^ogoPS;kYxAf@4rU|X+xAh zgtQG+=%W)s{oO0j12%c4?75Kl(2(fk&`kT@W9k$wfax z`oQ3u!e#%-3Z^I(R@~>myojWchQ<{VmW>Vm$33IfA;}-2)s-@eiTzz4fUD?B`UD5O z>iF6DUw`x;H$!BHk+Do{r>h$t{$FnHUpM_d26U``aB^7We{1(YJ{MS}Sj3ELe~_nv z!VjY5CVezI8v{KP#WRNOoiaz;OaSK(SQTC?AbBnl6Y&XL3f3W2iK7GN-N!QR* z{XcHl2i8x5NE#D$e}A9Zywjm4j;(Niy~1QL+h$2<1k!h9cYS7Q22nQPa=fY}lZ#VI zNtt&9RaHB$IJ2=(MU-ZGlr%%0Ga^y2KPUa$Q3rFPOoV7mn;sO|mSMM6D~v^Xa(AI9 z8AC&>ZofLAf-LNXOCvAYpZI!IWg+|hX_7**D1GwAJf&^_*T|8AHRl6GxW1^r@2W>g zzlb0Mjjf$MpT%)`%UXVf<7=)D=n^%#omVL#ol643AO(-pew2w^y81}5^MH%1I-y7ZHjjfm7k&hkGVng6!Akrhw#nCAsohvrV`rLqBw7jOM!=j)NqbBeN2&h zdH31h^NHZ_%D1Ty1Rw zJK`-oz?cM`?9MBvwYU(si-ksYMG$IkbMRmRYdSaVWzRO7xlzwZ3%PTN*2w10CxuKG zCSNSkyPHeHv;KwE{9t7!=XsCuJJNjJgC~is`bDcZWa*eRYVx_ayy~=Cz(GWY6vLBW zuR9j0OnVo{yhhU-mdrt}!^;u0wN2yrelmv3etj!ZUPeqPRKtzev+K7%RZ z#aT2a-DllSnFOk?h;+1*Ccmp>)=QIy$M`I=RucbucK>s~5oIHNC|D*2rc-^3SU7>_ zf!9V~ylPia0+V@lg5GGt7{7;2`pNFF3@w2)=`F(3C@x9jM^n|74Xt*W#$kgwo?QcW z`fVa+3)Nw~9w+kaj2G>ghgCm8rU2i5zLs#ChQVI_DYM5al@vj3gkRxTyEWRLs+~#4 zD?n5viwp=*aXLAe)TAYsq$O|95{o#wg!86Tns^zKt=M%olB0<#r7aR1Te*tEJ)EY?_n# zl>(KV;F2u0VbGW5Iak&_nfz7IM2-bY&D$;R2We{;8F_iU-gjEO=oFRNaFxf$jH3=s z?oL+m#mOAKmHCR5=&dnQ$rNF`(@is(4g%a1w_)hew^QE?@7ms1tarM%@!3_U4bXCPN}A^>WCq0U~+ zZiAl4((6L!Xrqr(?>p%w=5zF!ql;4uKg8cm-p6h+_eF>2RK3!d;s>?PM9B{nBxXFoPyZmGLkX)KTRTUdQeQ9K^Pg4D@ zxF&tVVXkDNLKK+xPY7v`REu>;sTH%)Y8h}jjAN7vHALziwuv;^t%n3t z_)B%@TfgkjSBSl83wJ?j8Y6_}BYku-us4$}9{C+Au4dp-$S0r|6Cal2AAbzJWB*I+ z*4_D*vdVlM4Yu3r*P@if=T_~3l*18qZ(MdQEv*!zmHP3KA~TH3Oj*l^MO1)mX?2y1 zR5U!U)^?@0ew@}3|7Q|w99CbPY0eWr0nNS^O%AD44K_!@};^7U8hr%so_%12Wsv5t+f_RA-UEF-zv2%fc8xA0rP z>IzS`<`ii`C8)hyC2Bm;tt+5`qXrWo4y5O(Z`ax$=dxbZf8#$F1FLtWegPvI ze_x2u>|isqe}3jNg+iOJu#`So>rT^_P2r0FAo9*Cv@KNRb5bL}WRDrn66*s5FS;i8^9gVM8;Ee=$svfHYkYZ|`35QZ zG)F34Rv~}!B$>l{V&e%WRR&$tfaX!AH%QjSKA{Bgz&MBf&jK#wLv{8hiCp%%PeBw` zqtbM#F!_QPuvV14DLqpcp^!eeB9Pla76qwwn;YBtc9oeX6lgdyV*=$`XY+oFN0CcW zxZIh})_%jJRp}=S*m@q)4LH^XGmS;h6Gb8jUbmh-ld@?Eb`SVS&ZX=jC~nHz2lwll z@xvPAtB1zvu=zQLUQ82+Jo5U1rnjpOX0F{^oeFDpP-FqS&tm#EGwx4fC}ds_(4c zy;M-BcQB(?FVFs^$lL0+bGXtKx88q;t?TjS01Et7#6z{$d$7#QMf5}^@{pmSASHA_ z0gUzthMGM43)icY{Em0S*|t*9WRN8!GV#v>kOl+T32(F=RudBw`=l8}SDEc zh1`b5W6+^zg9FqXS!n$dm%x-4Tr^ zLPj6Q>K)Bndahoeioea|M3J|y(0hdr;M4RNlvh7KwLRffIXFF7(B*d8r2;^y^xFD* z_$-y@#J**ekU8gtp6M!cn45n1_3Jf`hy{b4VJ>b^T>ct7u6(cxUu!Maoe`+zdG)Xw z9W}(umz`P3%-~xXr~+ANL+lWr8|jS@(5eA7MYj ziW41SAf7IcL=x&lL@&C&i!dASUMyl6Q-iJ$z-Zk@Qezb;a~q(-w|UwJlTc;c8-oyDx$HY~Q!q@YKc1>MuArhSy4VQge|-X7 z2)EmQ!ul23e(V95E(hPLjj2MWAWlSr=F>48gh5%^N3MC>u~7%o^QOmetzbY9WxvnE z{Q|Ods$DRww=jR&4Ly{Td90MF1bMugp&i-D$(l9wgI3~ z-LU%$Eu}31YHg;lEsht+Kh7~!KCN>+Yw^FhTdJ`KxzTa4VN_iQU%z1ARojSg*{zDt zF==s-%8QQ`s><;rEV;F(etK40(&33W$Z3NgH25ejC$#l7c3P@UOXr5+Vyka&Y;nzi zKXYvhSjp5I)V??2t{rMVVj48O;QivsYp`_ZbyFMBAX|IvUnq^3b}3J&GM;2NF=)r* zwEG!UtkXD$NtdD;gIs=0xB-RY(L9=mRYNga*f4(^Iyu-yH>7jQPb{p3Rzf{uy=&b^!~JnF34?CydPmnprINc5i|5K zw%lY=It`g%V`EEA>Q7a8UOVlDBUv%OvPHrs6kDi&^Mk25B0;`Dx23ri>uIwtNb=3s z2@2_~a4I1;60snlr1*ZhJZA>~q0aZ&BM`u zE@bg(f3Cs2a0KLjn5p7Xp*rJt`(JZD*Kd6c!_)xb{or9^fFuG3D~Zf&qQBgKP=Uvn zb8W0U~(Pd|zYA%>^Lk zqJt{&AIHpI_FsN!*V*L^V2^DWQ|T_jJvv>+uL9Ya+_|u6bzw7Py7-98Q1e}=c$^sr zdGg%pT=t?}K7pWK0-E_dCouGZ;yxvDB+JSM>EOHtEweb^;XN=AOw&HZ)@a(Erm7Vp}#X~|es zzQESV(TPEaBZ5qAu~$$?eE~q&rqbe~w$b&5+^?WL^@U13Nd`4VKFFQURIN^Gyl5u= zO3+`G%w|quIa583q31$9U2B_#QXkML!+otN%4a!RxZim)*o^mFn#R&yvnmiHz+9QkO?3P&XMVetxz}s{kj7ok9xWy0|=AyW&D_;V8>!wT7AI zfF^%TF-v6p7KyKY;<0^n{BJfGq6Bn8OilHo$Xpr9E5B<>%$nMG2AxK=`%WRG6b@@0 zPsaA!NpZdOWVuvsa!}ZIBu=Ny!KZZ%f7&;5B2M$2rpgbBPJgoni$hrpdH^mO8-$rK zo27(84{U@rJw$UYr56*0Cd)uf(5p@u`{A!)10vRiSH7qii4Q5+(m^-;f!^ocYy~#1inHABisGI3N(Tbt)c*CY2ijXR%dCniHy6_jhWOvL8H4dW|7@aLvXsB*nNws2F? zaz3-CHvYux2hCXz`E}E3Pni zVnh8%K5wsOc`Z?UzMdH=31gtrm8Dz9hJ#j1>bxRLbC<(R$1sP7?EVH*sKzJM(Siku znLlHY+Q*6iVAB-1D{#3OBrlN+MM{zS$KZ~D9CoMHnoE4Z$Glp@j)RoTf2%y~i5{mj zbK`tSN)cYepXl2I{dJOa6bV#UpT3cbGczy)LH-7Pviw_@t6CYy{I^R+^qzKbIMEcxsXq7}DHj>}(nOKcfWntZSq8Rl%p>dTPc?PFT8YJ&W z@a)qr8r6CYz|Se&>ATUru}X!3aePrxQG46b15E4Kt3tTegjh z9-SlvAs2XkzV9M_y-B7Ss46;7hxYu^r@G?fv3alH)Vsw<<40{bPz z!LzM(w$j9MyzRNDuL(mFwiq_c>-&f|j`er#5bvZGNP7_>0yeo-mPlYYAc72{;Us9f zjriNY9FmH$qGR`x2(lvwdAksFW}$Q&V6$7LJTD0(A_%lA!0ZbjzExYh#Q<;`?M9`( z-+oO}^$B@AFWqYy37X?~LGw*IElErlpz^WCsKX_sJq^z0T+P4u9w&V1jqF zAdEpedHZ!p<22mz==DlxMLYm8{hlF9m60eEW~YeBy?-cLXp3L z41rHr=#)kvK&B=`mWN3=LAi%Vv%Gx>XhI}CokWPSgv9!e{W*hr*V%k9(ZSxL_I9+Z zjJ|cXSLr>P-sPAj46vIJAO$n_)$RBuyx#f!3X-L@Yjkw9wNj4+%QWFzdk!S}?d_BQ zDc3%{a{VVC128}H@4IMJSf?IFkZAINvG+Kd2nF^BOuK|#iX}tlJ!`*Y1IMBYxbIw~ zpwBjEK*G!c4N5(ZRah8#m}%cQX2;Na2p zby>o}s2Z>cb>7%-c(dh7`ArQ{WeHCSU)dQCFo>Nrvm(>xP{C7~U=J73ZxCQNx^&ea z7!rqh#w?_@y&_5`EBNz(bK!m+!?`}N0lYF8V zqSl^pLNQN0tmqCR31`0Uq|So+PEatA0^Zhhv=}9xoQ4Xwz&&#N%%Q~~V5@K4>AyN2*+ikQ zjHad3$vIM13465JXqYva#`+sr6Ue>{CkVK`^<&8nhSNg){FY+oG_mrA%eS?o1}m-V z&~xXP?B$y_`0#Tg!avHS58!I?4Gj(7)v(Tn!ydAmn%pz?x2#<#_B2cNiVjMHiw-rDTGZB-7z_ zKhK!!zuI^tjhyW97>HmokB;)Vt3d|X+1!gATq5tIe5jR&E7yINA}S0VLmhKPUK1M=1Zjg1MTc<^LfpmiokAnki5#|kp{qBqX4<}BtP;+rt%P`-Ng<) z4ghN}tbnYO*<*Bg8uu>7()r^3pe}}{&1a3;GdfsIjy(WV&b%<}`xxnrpfVp9B;A=Z zS~N=OD4eP<@CN+D51w&APLv9T%(MEJ(R=NU?r{3HvB!}w_+k!@jIobO|Nn10=_~2!r zdaq4vi#te)#WG5M_{iDlSb*vwb$5cM=efST+S|>W!`(VpDi7g5U zH5ALGnZ7*xCLUw_w4e--t7S&NkO{X1??TcOX)f6SiuA78jTL~f!nr+ef6a2(|7x=K z2CUY<-y^G_A?(k_JimF+m@w!Gp$2HwXbbf!I4%D9Xm~6}i60BPYBDvC$C?~=m-$K$ z&2i*M4>R;Nf)KW}wN?+a(N+Kr4P-F7I?MopX@kp6&c^>{GZj<*n+Ev*PZ7Qm-`W8) zSL5j<$1If-$=E>*vb1E)Z@8`rR0Pc}>4T>zq^#If_--_`0Uva9CYnD>re2F5FD*#R zLpVFDH&_%v5usz2YcNTGt4VykZ_Fg(qj*l|aWB1~kVQSg4FMt{ufc%zJ*WMSg(R-i&&S75hp)3Lg&r#N=^Gs&+mEg3-iZ_= zNo;XETy;Z$chq+GKn%;>Zb7B<39s(a>EF)K09=Xc^0*cJ4u?%*n7cM_S0CqBU10l= ztZ)?Y+H!kdD>ZSl$c50}2#`yn&z|8h6%g{cIe5ZhB2mhue4M9S1k4h@8h34chX=W5 z<5jv|@GU?oV`0L^V**j6Mlx~DSw3+kgrklg4S(^UKq4=^K**0*ms)Nla(g0YB8_75Z%Agyt zf``xecc%SBErcpBPR9!+4-0EU_peHJ$tvBMq9Q{TAR=Ng`im2A&Rd>YAJyePVhfz^ zm$jPl_xOW%(*M_q@+Y9R)6jC~QHVtn4KE`8czecRd$PhK4v?^4mBu*#y{;08L6$Cg zGr&8o#$9hmzb(*G`=ZnQ5>6IDCg&k8$qa4$fd`uWWMBH78Q9W1CPWV=FJUjT4JriDmjh z8Qn7~<_O-|O|+O};rwbV(`s>3W_zjX`4SI-OX&CYWcez6s#IBMqc4IH0nejA=Xhy* z7>6Z7Sy?ZiXS3OX;k!h?rb_|f+3ZdV10&FC&i!=ey51mS`JvtNclf3uxa}Q}KyWE=; z?Gvjqs;qj&Q47>6vH-$XP+e#D*CxyUWYOaB9=Lq4$~(J>hInS z%}$s;Lp9v>x6MXpuwh}>=6@htbeIy=e1a`74{|#4lzD$eoinQcoHhJ=b7RS^E@yw8 zT3+KQPW(mdMwzEq!*&VQR^D}K@h~dIA93LLBEoZO)+#%uiR z>+8SWSUv3P=F<{{!IS8g6#DDX1hE*M`aHWWwwPFlp6ibuCbF1ze!5~=Cx$tE_bSwQ ze|ZVQ9BGU4e{dQ~hu?wq&=%04mV_lOPw`2pRxMjeb-!9LS>;4f!9=c_hW2_+2rzerby=AXwF1{FM9CC@Ifbb?^NdJL%+qt;vF@?KJw_+aOw z;{^GS1MILOR2@*s5u*5Jk%kWjIjZtyq1fj~CAI^>qmXFvY5UHP`61)zD3CG5z$6p| zqiswmPNW1goWh|9*p!k2u$O|B4Es=~P@vJT3;`C)g^vY*{bAYelH8t;a&9kcq4++~ zOs@fQ;0MIX~LBtQm;k7s?}zBElAK#3W1<1(M2E0E8AW%EU5%5)himAPvQfWYHY z?WPJ=}g4n^o*B}{@wYlQWvQW=Kl+&SGdyJR{0i1}&OCh4(7NNGb) zws%`2TM(74mK1kh*BrVb-;)$&1~6iG<=Woc87mP`M{>rY<2f$PW)1mug-c8yTAlCj z`kiY$IWi=xg*-bbY4T+tm4BmRIj=`oGA=9RkDZn~N|&8KG+2#Q%~9lSxm3N4uAUQAn0_(Ab$Y?lvSz#3@4WFjHfB(|=Hns8Jsw0e(miEp5$)!IGcEajR-JLX@1UTKGXdB`o!TP%xRL;T z2t2ryUaje*2#}>q36PEPKw$H?hfE%~t%n|lCFcZuGGAmeo1+C*fM=dK@@j%Pnq^>Gc z8jwn}cL6}*bt#N0#R&kdBiKCUEB$i1UlkA_6#&!a_u9In zeKGZ_yyX&hnWSQCp14%E{oJS|M#sF;Sd7zpU1%hUp?IDXwq1ru@$J1YR!4mRqGsJ0 zhi$?OkF17wnhK#ek)c^0sGfoMIA-vRZHyGPmhn@CyGF<9tS?vPcDE46jiQzK(eY-$ zUVMP5@qFgP#8Fu&%ihpOJ85e2G;R-S&mxNWd~3cu9$L!yXGw;k%puv!-HOF%_-M5T z-K4@n5yiyl?jOWM8phGp+DQGY&?gdCOK0@i8unX2>gJ1}7ZpA;##goBHkUn?`Fhh( z0>z$l<6O7t!ML-}-%@Svz9HmxYv;O@lgsg^@VJkz3b&Os>qiA(;j~Ev`Ya%P^$?v3 zp`gKs$m+i!Lw139qpB0PRY!SLYNa_7x`C>etk)3NH@TC|(bf)#e&5`vOVaG9axgF|}{RV8o?PEgXr1mp4Jgzg+D?7fdNrZ4>t!GJqWlTBUim&w9|O6O4Ry<^#R_r zW)TF$I}8C#@f8#EIGe+7Ick90)U&IQ&lbU?h2%zh_x_Vylb-JbmQ*w@J209qUzyme zgA*zD7l1%9U2d!?#VX2Pw=(Yh2D>l~HyDA(E|ad=;#R{D`lfhaglBg&b#nJM0+JUK z0^kg0&>nyuk66HhSF$f0-xx^ex(D6y{s3ee-nyrr_`DwVjLuRv+Hal3Zh1Q_C(8A^ z=u|p?HkX`auht&ncdZ`%9?u5i&YvrmNQ*B7#UYA{0BS*<^1u@`lK3Hy9A5=p*Xu5~ zm2kRPT~VdP4Xf=4$ZVdz!L{k&DFE~>8kuHrbpV0e8;(y)1hRV@X=dNxL1Ty-cK>oij@47L$*YZ}^^2$!OgQ~z)vCk2xJGaKDRF3J zV%;(t{-~^T|`;yI$-4JCAc}4$sM( zhkycT&rYu9S^C9YX9{`z-jDCzGc;{+9ggr}W((Md{z0Zb=8wMNp)a zrS3y{T@m}W?IR10sJFt(>6BCO1yLW;hL=72CRDZjV^q^5VpDiSz&scvOn#Wlb7s6l zhsGZyiS9$tO2VlZBB!kTHx8O zr}J~GQts&x7ii&L2VbiE%sSdh!%7Gj6e(>hjBr<$q7a4Nj%FAPvwqw;SO^;%Z|Epu zkYwKuv^Qu`va`^W87LcmghS*d$+NoUZr5sfQJ_VAhu;z{K#fUM7CUqQD4e&|Xy$3jj@{VA?yuX`?oKLi4m! zGENef*!?bmSF*+9VuZcY{l>}^01b7-5pv(CP%x@j3X6olFVN1`BSCy#A*QMVPK4xl9!QWhk95SuH_dl!)bo>W3w+S*XOhx)$0!94Xb9TLZY$SETz zO|6Ibu|pA{lt^sk)He+5xI#+Equ?Mx@HS8W!44NdN+(a_bE}|wP_S3M5R2alEhzG~ zl|%%xweNORK+08fRaB9eNs~(0pfB8VG8J#BdA-Tfn)|0$SQFs;q`?gP9p+f{_QTCL zV8;_=D{uvfE+pnFjdKBO2)mbOPwgJSVA~jg&NcKK0kN6oz&qn_D5CE(m`VWE&kp#F z1As$E0#@(lSgLXffIv}5)xUMFa-Yf42GH@m@(%*A`2){t%vpoEg!V)AjRi)R`{sVI zvz)HWS6sv*HTj?2TGFX2LJxmOOD`yik*F&)?pITrUDdgcb(0e#BD z*!3F40lqu}i63W_+eLn`-S+%4)M>ooAZ#b8U7@>8tQJrDUwGyFA!!-m1oR?9mEoC>p55733Sic?

iK5>9&bl9{2dlNK2VGZrZ|;+23oXyg^gQFJPDp%w`*8rvU@iO3O!bi(>_Fpn|I zOd_7&q!A*d%`bDl4!V`{r#_Bl)8w((D5+-VVdA`_cx+pOu zUUO7c(-)`Qz-;?BQ~qmHBBnW3t&ojNptq*egW;kqn{CM~w-+E^2#&p>DTop7XAO*t zNM+HJ1HwroE9P!>9(0PJZL+z%NPc1RwWA~Y*CbYE!(J*$UTdCrw_&15>MdNh8^V^B zKCvCh#S#Gzm{Rrn8wi8nt4$~O?E%mKNlhwb0G=o`6lvck-U13IOet;yyARSyA2~IxeJRH^CbMM<;dUoHn!)TEc&k=x#y`W5) z4ez}Lu9A`9(5M8GKbmIA3hcocLr^?r8u_d}D*u(y?;F-fpexF?!r~&K7vWDiZ7n_5r%1&`2!&LT=?!32g+yBrTR> zWFna+XT8kC=q~EP&PtC#m-d(*=kXA7>SuO?U;8EWNKYt^H1`UP`!H*>%S~b$-D)<) zeN|ga0N<=Ez3#J}$d`{Ylrq+;ce>3FS_;(8pHl}Zt1g#jcDwB+%%Eqfls!!De&z@A zqbPmuQKSM<)Q*nVco^)pbW+Zc(W$RcNromCYEy+&QhlF&mW(h4-CKC&Vv1slV`;u5 z7G|QW+h6)tD`37gMeCJ|W4hT^HLg(PN^i14n#H(y@743!Gk`dusv{}>*jpR59>rY# zW2TDPW93uaW98LP&?x$>2})mo`(5lB)SGl;gwf?>x6CK+=jOCIVX$35FLI9ufexeAVgW*&!Fe_Dr=r(b33zXqfd&D(jx7&k*%?4rXgKRa2934v&2aC090m<-FxOnGq;>Irjk4 zLnAoo%@TAmIY6I6#OKzMeOm1U+NK5pRSBf;`jZ5Zq3A#d-L~fyp?`Kdt*Uz`A)-zt zW(j*NAH)jY<44bYL!xGY&*!COQqc$A(WEbK079(YhyU@BO89-lkMGv{aQ_0g_~+32 z3n)_4zw#ceTEN;W9^ZFH0o#R-LfWZsTJ=Y@0IL~C;tPw(NG0kB8dwU2|9 z8L}9Jxj={}APZnvbtQ%c;SrcOWIgT+aTa{`9En9;!^%~{u6a(ff|o$KeF*&0MTK8H zq;ay@!kyu4T_0kWvxJn|d?yv%cOkzr1Yfku$hyv>dga-m!D?*)uU5D2%$LE2KZ21_ z3ihyBCs4G>v+KEoCPAe-JcIf{<>OHtPDh(_5w~$)Dzdyq#+iPb%cryD@Q=DHPvPVKpjCF$6ar$MfB+MBPK7iWQPE zY!rah$fqAeYch_rtara6`?y_SFII}HcL+NaC}$^u7}T}0@=t)qkvbUm_kc2BiQF*o zRT&@%rg2|@XWid};!5_p85@G$eSw$Pi(-A3F`$xWu0ZPf@$CrQZ!PrMua&wyMv2NW zzbCD(+TYM~L+%6sh1`q$H02$zB|(KKCut8^13I#AahZ$Z$}6#LaR3uEa({JV3ziLR z3AlPG76GG?1|ZsHA6BH>-%l9=QsNC2zTD`*!0y>w+SsQ!R>#*8MK2v}DZ9gX0vN## z&2J7;64v?(A77qMyk`bluQP3Y_-((c{O;QC@X#&!pxMV?E`v14t8&;yLL-~Ty>LEY zt*)jC!ScOy-myp9PQr$#ZR}jRUhTE^B~6Q)Qi;+ z;0Qh#9fwm>55c6W+b~ON9CjsLVqy`_Z zlJl=&cd|g!DwJDnW!G%Yz~lNuEmT+b##TD#AxmYdPM*QHFr1HkvB~(NMq;(G?90E0 zUpUxjkO_h?cyYtDGFB(*lCooA0Dqr7`7q{E*7bjl@tML@4P>=h3<=MDgx# zR@R%$QWF_IhDf-)P;x`|)nD6^MnR-8bxWXRv$MQF4P>~E`v7W9Yq8*WyqH+!!{X`v z^FT)uftvW1Vn~H_9>LchA!=o$!N)Qs1J9PI-TN-AN*$=W=h}pbI9kgL9@&b}vIhp=EUkv@p~f1K>oyuStiGI#R`owWc|$)TX*pQO$by zkk7kc2Y;m5xDZkmOvIO&bCX0?gQF#Jd-5Fkh?8%rg+-}+9ef-JJA zQ$`XCy}bj%j;kNYy48FYkZhHZ9dND2PoK=jv%VWA+=lBb5Hcj4F84X3F$Axzz{H8$ zC{9%xOE$P&6+X)lj}8IwAKkWpqyKdV=<@u0LPBcEM332r=uG77t2QMl7Ut^@HCQ=* zBF1Ct`V*xh73n6=&O+~QHJ=0EcZazwBFHJTUC+T2J_G1NRb_hH>5x;>S>XVEmx1JCKEzXbu-L}%H%fL7gu?(TZ`(upoHg?0vBZWX+Pd>wBJ`ZpKkH`aUtR#7x-|ZWGT8b!H zZ%#8Pa%@uK^*ec$8?Nz%x5bkm^U+WMkv1pK}|R7ELQ zn*y1Dz_;dJ<(W)c*__$)q6wz9G1jtpKHn|LZ5oU|!uYQJ_kL=13HB;7OKuEZ=D8D& zGb*+M$iF?#`DSYrAcEnqsfM5&r4NeEBcleDr^XLtbGMtT?(M^!XsF;L1x*bHv0Tx9 zbAY@CS+9w>I>sHzQMOhMF_LZi%jGLQ`xxe*S7q*Oe^UiAuyk#f14>hZGPnmo6o701 zIam;jp{^OCO73j9yu0Ma3SA4-he_A ziAiu85+O$sX_hM{c!OQ3k!XdB@KS$YU_4u%9bNaLzs#WW;}&B(e4(_R(cr1Tq`RPp z0Y`-~_dL<`VSUUBidz7JFaeAX7Y>WTVp17Zh0stCfp>)2H5jAsG&DSz?bhvNrKPD| zmurKKNEe`3YOda>kQ%a}p94WLX6A6kHUaJFkAT$8fl2j!7b~1cP4>HD8a-p%`%BZ5 z3DnJ!GA;W<=TM^Z1n!>I>!U>|v$0#27Gf2oDeCss%fII9n#Vxz# zLJsA1X0^ZF24G@Uy(ah`oC^BKHkd&J0K5INAL~WOldRrYA{=B(jQ5D|Lp6Pg^w2V))=BvgrDcS8wI*s zUait7xE8W2fe6rKg8&8If#;IHL>wJ8(8)CW6u=Vn??ogSX71(gm%l|xF~Y(yN8Sr! z;q+-kbl(*Cca%0Jm4jskjk`VFJHB*mA!mZN=p1|xEy50ru_zsyQUA*KJ_Z@P8$y5fXO6_(=(4&Cp$4cLhox;g zHsGeT@)g;Pit?GIUTuXJG7nSZ0sAcAfzdvY#vf{Z(%fRtgwVYYx9R=MdRYwvS+c}{ zDFm@?7azY%VPhs6YXK>D`lKzJgj*B>B?%0os5f|XQI+y7WYL>?1r~7266j!uTcSF4 zTUcl51Q>+yr8aNf2VUooi8v{4>H&}>xZuUz-axC?NU&!%f4A@_EdqUmmAGl}-go4i zXf<{RLeR7#d^T;&Rv8xBNNRc=ZZsdsh!FJyDIQ~y9`iG|i` zLq6PY#GW@;Z~H;V-K%YdXu*>`#l7W-}06-m=EdzF2f`>mGtBHGrO%Ebqma!c9v ztC~hISWsn88j-9NhTIb8SI2kx=>0qF;?BS#8yHzz2&}DO@ zwW`T;gJU02gMLF=P~$UENEs|7_gAwrn~V_GOF&PpV}koTt4E|hkRdBTW?WX~-d;6oJG{sHzpBlV*i^v%!?oRbtW0;3gc}m!Z zg?$liT*m1>gtLSkxao%a`q~s3o?Tr!tv(CF9PSq|0(-K9x6i8&%z^r4i0KUws}kfN z-nOO3`1F1q! zv%q=t0b{dc+}^>nfS-~S?m!|0)=#;l{P308#u@w2Eje)Qq!B5{xU z7F#kk?KZ_8%9I!Bx01C5G^ZDlX2b`r+gk`gue}yQ7yVgv*`(US1|sY?Oy2>T$g5eJ z_G+H*(qC)vlCBz?`r^xQr{G5@1Z%7sHQVKYTSZRTnzdr zv7!v1=krLJP0juXVVbWTF@KLxzMgUJ-<-kguTE`IGd9*Yn~&eK{$H2&|E>{mlz{`! zlPidg{d;ebZ|)E^c`4C7?#F8Pi4+B)DfkJCcEk9nFt3_&KcOGSf2kBCNwLq*L{rss<}ctcbgkHgHNvwJnzi_ zaOJOVIU$ZOl)Kds9_!h1xn3s|p6fV@Xs)0NJB}QEk9!@5(KH5i6l-Zt$jRf1qh}DD z!IO1_#X*vC$j^w)GFSK6o%VUk=zgAnYO3qwq>c?@(_%F$n;N6ubkc9HESvU`*?3{r z)R8BAv;#pQbaia-u*JFBSZq4Qilxey(>7w8%sFByG$8^O<1wo92E9k8c1XM!+`KnfZ03PkS-5+n_{L}TB#@IXy#VMj~4sYsEeVrhX$ zRa>@!{bOU=HvQy~KkVK1E~Dbm^uvh(SjOn{P?^{W#BuZ|8HeTWhNdy&j@G8iOzAK4 zznDWU6bAjbQjx@}WYGo-IvU8VLlP9+E@3C}1D_b!pL0Bl2A5SWU-I_d9xrQh%QAEE;(vaa~lkO zUr!gSB`fv2g?>`ejRBVs01wUs;aTll|5Ttz5hY;t)ip_q=MD6Z?Mwe95%_szGT4MK zw_XfG^2_tCVq3O-t|(y)LLNbX9FXN8dt-6mxP@z{rrR_Nlam3WVqDb`t-e^>lWe$e z5B$IjUw6zM|KIFg_5MYtr*n>sjx&!JNPUW=Wn~OB2NkICsDl?{W$k{LRJTQVFSBQp zvB;I{-@+nA>6-y87R34834iScB^bg#MRmSgheKvaf)!l0wERxTT{}QYlEU$#LGpNu zc^kF$)GvH5C||l0D)`(~MNn4ulFHy2aYz z?m;xY9X@7*S2CCR=c|c6+TSlJDS8>BrF_x%~0N+_gnC78wgT^x2LspWy%v`w^wCj%>$PeHU36b) zW|=(z)B>2SV7JmBOc-Ib8nssWNlq_Vg|p?QINnQ!L;p=o#00U*drIF4;!uTAIWfRx z2{3mPLo@dLtM!NsSq)-5OU;0STY+|CeLp|XuIb~~k*46w1T(+esULZq`KN#oVQ|XZ zT3jpsYqW6gsyrr`tS*hE02si$vk|F1F`|BEvQAy%X}sP`UszW6GL2SgWN0D#5!*yq z%`RV3Z>`X6lI3-~P!uiHfOjvf&O8@0ECCBP`&ndycKgj%Vh9eH?bJ!^AQZY5p0r;m zG3(vRPX`j5i_d1k2Be_w(hDYm1RCTi zK{dX~3YqsLKP%SIq%h%L; z$x+cYlcHPDO>3lEQ6 zo)-nxN^$5x>0oudb2)H$1O|JE?%BT+8M5GWJrnqn>fe^GlU?khh#<&(Bl2I0TWD zSeEU9i`l`XwHk&tekd0{0zA`1H~WdsI_ws6VM>i zYWCHJM4ESiA=nZO$D9-5zTF;v$ujYlC!RqJFzSgPEhEA!EOdce_d8+C} z2`I-bIJg@vV}j6U3_Q2;S9wd*h3&4n4i&Yeed_3v)dr26Ci_YxT*Uqh)N^1+m*RFe zi7$+i33gBB;Y2bZ1}5;<9EA#6qAyDn&mF#A9FC25v(ix8I*ymE-B0N>Wxe5Q*pd0x zuEcCYBh-0hZEyw%{%HBP$*RQn8K;!i&J>f)v5kFWRIO z1gR+$92OXvm6k$i<~R1&R_@83)wLNVlco{NWnSAn$`}5X~Y%LTF9YJ*+g39Whcg%A+YI}$$WHzFBhuIAtlJ4)d-hAhgD0hWd zbR%C2wF6=5Atc+&uo>nsY;AzTrqUFtg3*e{Et4Lx_zDjRRP*NN2}ZsfXsPX`P)$eh_4}AC&N(d&V2E7dktfIHu6Ga^DP6 z$i<;X;?l}M?Js}^cPNr$9s9f~l}``AAmi{|QHuNoA&B{bCO2fCewx4DF|wf4=NnKQ zaz6;~c*hV6BASmsb48QsI21&2-BwU{9<=-0S+Y6yqv`~9czw2ms6F!J{gt7ZCqw>X zq4DZIIq3~JO@d}hTB|N80J|ubr+8|+Ir}!=myVx z8v=_#z0xR70)tj9Toy2yT%^+cS)B{)KmWRcWd%j7V1v9lQHy^fKVtwz9v4%JO4a+Z zJ3YBD=o4m}XZY{g-V+y>_Z+a_XnVSvIjYEg;XW-}w-fD6&I^fK=fjKtvB_f7gvT*W*ufD9VXtp@kOu6W*v0wbG zy88JIOJV^!LVmVJEDfh@MOOOYpz#Sh>Zf>4Wg6Wp>-okJyVq{M2B)XSckh46F4Q~; z$fWX;%6)xou!$l^`nw1A$Fmd+;0Gj7jUIO)IY9L27i&p$#-EeyR!hZomW$4yG4p8@ zD#VQ9-??-+*F~R@kn?`?az>{%ISm2+?eyMqL{h3V@4~kx4aj33e)`%ycEb*&P-nk; zvMnEeN>xD$PdI!34-Wt`kUw9O`%w7|dw;5sdZf*i1~6s)vS&zwgk-!dr~KN_1++ZU z?FAy@$IZN$XGfTO=xB@lz^0Is17chM@G^`g?*_aKHO`@(OlA%_{P_CEVkjjVDvcpD zL3e*MV*mIRg!rrV-u)F}J_h`9lT%cIB84~*4wK_tMo{T>L}Tmd7*)FL{=2jnu!&J; zKa3Vf>lN>PhvUEG1cD}_VB8AUepwHfiT=-b4A;)x6q|*L@4UjgMkD46l z0v?31U1<-wLJzeN#-e))xm${{FDsseH!`(@Oh5hs2@@l7ffQWcSOir5f~(ZTa-EG%CNcUGL6wN9|vp-*{@BRTWm+ba0zyp(6qf zY2&8x47zcE|J2@-Dx>b5h4K>W zzfNR{Bo^K!t~PtK`j!!E&J@3fYWrq&q!ImgsLmhX+Q^k;s}lZ!t6XU`N@vpCyft5C z!gety@r}G^+1+^?@GGvB`2bx0+8g9kPRGYL)q@oOZp!+L5TU*{Qln~1Ap)HaB(I** zBHdP1V}ElCoM41&Vn&Vrp#>8_0$^BPA;GXPs6QR>|GLOS;2b&#aDM(Jr1YO@3o;St zVHXhT{f9>coc%Rm!mStaZt`z#?H{M*Cj~4+M5KoQ|F!ae|HK{GB9w~;?ETHX`Qujt z6aY9E8CCJ0v;NC6&xZ%V(&k9J9RBHM`Vyhpz}dlK{tv$LzfbPpp8&%O;e5Ol3*@u~ z3kQ=Z)2K$eSXpJxsC-qD>Jj=X_a7?fFE0W49YjPrcNB4#NHAa{!Em(as`mEsh#0Wp z=*U0nLeDJ9Me0f|`Fn^s(uWVC&T6?9@RvIu-|Vw{>Xr7s>$Haep#Ho4a_iS)14`q= zmQ%IoId?9<>$GJG-wd>Rz{ZH%{hIDKlu$u;9KGfi(1Vbv#8vb(2cs7|eY6<0n+EtE z+c(&5_Vzj9aOnKe0AnMuHu$v5;`TIcv%r;ZMZe-L>Xhb=PT}eCBx01aVSBMYbYsO> zZXr}DEt-mG;r)IZWo3-V`%Z*m#qm++Qfj;5VJo&Pb4hX6n#b-Dr~cwLH>0$l=HG3K zL#IH4FL^LGszx|zCn5$C$~sL&1aSU@_`a(91G^oHeSF>PID?no)`N_TR^N9SDy{X! z)&LWYS65GJKsAnCd+#MJ5bQG`E_yDU*m@0g0RjzV6u^uS5A=2IGh3}R&&yXZaj+Y7 z!vJ2|HVM@|A|#C9ROP2F(y5#^Mz7YEGon9m$r*JyyKOcvu}VzqnulePC~3bV*Z3lAxu_7%layB@vcPVC7FVM$4 zHyjtah1G1-qitlJ1N1E^2Q+^4@-E@Sp#4^19odl=|3=*+Edl zG60=2G5B0gVnFX+4qz%)>2_t-WbEn(_~H2`elU>$BtJO{xe^e@3;(OB5AcfS91b|! z_dQzpE~{Dp%RCqSX?`iiyZ?{4 zw~VT?UDv-!Y3Y*g1_63-O|DYL{dp1XI)2BYM2Qs?X529wj33$LT}faaXu_tdA9WqqL=b81$c7k+ z?;ftK9~6RshJbRjE;wNDeBgB=B!T|m$Fa@X-12&hH?Q|ldg=pV26W3BLPA1jJ<-HY z!2k3!fY0g&d&e(=WP=gafaz5bbC1uT2{QzRl+=c=9@GS&-NWE)|+S+Y9?Jk;GoUjEj^J&+~n5k_JQYv(kfH*JRrnN7oiiq-Akw5us(+Wx=MTb}7fM4M z_M^qtskEvq{uZk|-&LXQIG=uQ948o!ovPcWtJ}`1YKqqs7*+Fk`H|Sm?W5W~Kc*J{ zRBY|@S-0VndKu9roLn#m2x3@N>)`~;kdGsRapp^^z@bnWf~UW0tP2RArm*VZFy)_~ zylF=g+!iyPs4G9Je0vF*il-EVlSyIEaM_tud2TyR3$UolvailK5zi1nCJhaU)l4#M z@dB?fs5XZHkLO%)5s!dgxe(IaA3<$Co5*HDD_NUX92s#vPO&F`?qS*ZDDEWRcgYV7jbyD; z$kjQ?(Ah;7HjZ)WEXm~K4OX4bi2Jr~)z|Gb9!QMW4btxQnaB>;|5~jJdqY>IhPPR{ z6~^u?4PZScLcQA}`V_{koQ-V57G^p^m16@bkF@eR0Jo@qyrk#&ZcJo@;wnxGzk8(^#QAl2A{_#Ah}d(p4s7L|o^Ak?XzJy?)-Wtm$P>`jN~ybZX| zwthEKlwLpHA-%H$izN$yke>NVYbS>$Anbht24TjjC2=Ys^o?}QMVo!B+{kF&oyU57 zG*W`*_<_G_ORBDph1CiVL796Xe@<)!W8wZX+2_V@OB#8T(%orn5}iwPrXm2dhFX6 z;76Cr*&05VP#x&cYQzv$NwJ;1-YeJNE?j>hgtUJ*vGUbnBdd;fJ0KDELjVgyGzQw9 zM~$|FWcp~VzmUBj&q+0D3--_5Se2={FXx;ZNXNX>m#?=ZFVFqj*D-R)qEUu&Qd(@* zNmdW+%9U1-&d|wc4xgzEO?QW7iK|^bq2KV5r|2|LZPB^kdRE_d_2w6TAPXzlq&EV6 z6o~-XipQz`+b8k4waTR@9y4c& z%=}B+J^%tVk74<2ka5C)C!sMNs+fm6;D(tfD8q=Ozbu_X7d}^>$11wThQk)QB2TV1 z@q6!3VnWP7e3;fDVX0`>U|+;r%Bu~dE?4JJ0!NRDmpaE|u7Snhe%_q?YK`sp=ze$m zgu!=2nxA4Tv=o6bPK;pV#m)+d`jT_Pnx$?R`;E;P`q?sEasnYg2MeL}tLHvy-^$KH z`mjRkp~8%#R@&jz07=zm@`8Ls zm3(?#5Pe)UB$rw_A*WgUol^R`K@Pp9GcWq60XenlzLiyFt%e-l>08S$qrSLMoNu$e zf5r&*f` zAe=cQt64({FsyK`mun;~O+@U9l*x7x@p0W}uYY{#1GPdfs93!icnH`kf3|{}f>_wA z+ASt1l<&ejJbMrn3ufabI&gV#P;_ORY;yhfnO5K5%@uEtB6O<0mQAjox-i6LAkuoc7CCy zSfU??VJg-8d|i5dw9?n@zz@%Y!@6Sf3TL^;!~sYzSJ!@E-olG-26X=<7xwygb-G<+ zk^?qESb{Ly$C+=9SOdXEw$W{iWW)W1N}0X=6q8`s(SFe{s0!np1sbZo5iUq8?mz)S zd3%jN{-Qpv^8I7ZhlL{Ms>8Ea7)#L2CT(wKVGZNl&G?vey0;m~>dWvGl_M6ekvWzH zJAVJxLnlBugDF7JzCTE3e<$xy0x*KL#U>!~sRC^xZ0IpG2mPLgqSGC8{BCF12r0ldby zwx2I+ifP}PPV;deXI*dkYvX-R>g9p(ryElVXk;a-GU@3P>j)<8G+#(q$)CjUA2Y-! z!aKjLJaNpuh;VKs-O6e^6l#Ce5}0PUjksm0LYAAL8u?ufZH(nZ!N{Idt1Q0U+MajY zf{hFL=ofd=nobdG)$Uw5g59r3XmhvYE%PO&)xnZyhE~q=v9UU|1~0Dtj)J#F=D0l^ zdb#(SMysl7`eLXvuZK?h%EEQMX88GiZc}ZnQ*<<+$uY>qUc6jxNO3j%v!X;dEYDu} zkTxC4mlav_9A7`s5X{+2DO`@H)C6)##Vo1%3EVkU>yjMB$m9(#2xP3!0Z|DoEVY3d6 zsZTS{i6b8|ayx;;3hTZMu6$C}LsfMCa*<*rq0IjBcasM1OXth#W8cY;(u^4MYd%y- z7esJvP+95=yE6^Z+7E;Ztg{m{3HV#m`c1=jaEZezr>cEJ-MHKNUmE%4dff$ucUCdf zMG-8X$fPwKZ+^6d!0EE(zd@vQQ*s*=GI~M5>I@enK)nGY1`M<#00PB@%uWf@Sd5TO$5=WUkWMu zd+o0J-`l#cTvI}srAU0@(h)L6f%gs}I}|JpsqTlJ7DB_(vrQGG0X490kHjljh@+OY z9Xh{~K+)ce3!$!C=-}$^dcWofb~83Mc3J>| zwW8@snF)HJDuO2kA&NyMWLK5>=p99I}BII5*j0i&LGJSp_ zIP9DB`WeH~!FDN!Ec#i^x3(yD-iGsGf#qbR?1S;!YPVh8-ORrFlm>tuF{#9RWGLyG{Y0;QGS>z43u9zx@|heOOTY4|Pja zs95cLVqeHd>l54D!#~+*AY7%8Y!<#K^?B36r7P4+GYAeAt)DZAnj}HOc7-bw^CN8p zE=?p~v6s}7%tgw!`*;9S^4yls&1(RVa_@|+sI-5Nohx6_%An^W7{fCy_WE1p-G1o< zN2#2YJ3SVo@^~L<^pjn z;S5@6bxzAo#N{0esw>E{Q7&^c4z1ihq2bRXXkT>57!wS)O!5j+)W?-GuKdLnCLIzifRKOY-xS9Ai|w-4k9*;-KJ( zX{ZZ@!o4xsZr)o>c$tNfdBs<_e(_?{1kErE!c=v+WBMkK6@8dKx{UP|dEb7&Nr9W8 z)+|LC%Q$}tUDy@6c*W~rVGd!fSv&wp>d-y_lKIbN?`p4Gq5XIh)o&$A*}5Xg#~O*> zmW@C0G5Wx2^^RZt2S(P9Y^XfNGrT~Yghsk|TzRtJYIg-s3;R=8*z9EB?qkRU!|cdW z@iAZH2|cV1`Y7$s9DB$)cCCN1#pZYvlU?|g&u>uBA5druIJc8gECf)nogEoowI+YH z;tkKk8zPcEV^W)l!#+0~yh747cFijG&yKs17p0BiLN3FbUjCln0~;9n2ri1Oam~6a zKw0P@2V2zbAjd2V)n;7hma-Q5iFoN-VW~S?;>n>Hf|%OrtQR?Ee2V(5L%z=(LIrZH zHVO#Km=Ju&sYl}m=XPcK3b*O9?P{wS69Negm>uYOk!KFe`rh>8u(ALpCfdh}h<5g! z1x9k#-<_NUs4;FqiF=(k1P#Mx;*T?S zk1bakF?D~CY51A*!bxW4_Wg}xm!7?o{3?OCA~T&PO3j@KlV#JlCY~n<*_mzUfi_y2 zPv03>jTO@8$>QN6xwh4JMGZeGe{=bqmI$+I@EXba*6bd1&7dpw`e&ceZGL{b?#U!^}q*_&+I5%w#yM9rfC>Vs4Q`OepE(sSt?8>B|yr^F){W0@4mf2~fpiMi?n31@Tx8 z^x_B!G%9m^K&y8eNr+V(G_~LuU${O~5{CG;o|07c+)-_&$>SUJ!XmMo1LSs#9fI=NRFO&9fEWbRkl6 z-@euPO6>HB`9tFmjdmT|bYmJ(yE&Fb-OJl{t+es>F83VfBjnpB(6!Tkdj$P@%>20|(k& za=7BtmhN@{j2*)HJ6C%4f$H9&zXHZyvAo1s<6&Fl9pQ5K5qmf~lpQudnuN;&;l z$?hoAASl%guZJ_q-B?ne6@A@ zCiSH)a;UL?XZ7rPuE(RqRRmV&VFouY7Bb~WnmC?GCN|gIy}F0Wsx`p^wsQ2pCP>Wp zL_F#AG#s`GBo*w67;Mh*>JWbAtu&nyL*JGx?e5Z~J-7e0MybJ^6z9^9lqf7`mN(@1 zaKr<_Lcsb0b955g_SmWVZdAPCm|YQexG7nNwUj`AOpu-Y`f`B!UySG3kwB6>tLXQp zPX?49=K?TzSHC4$3>U_4QW!XzJMq1#OQEd5bCWnR^v0b<)LZItPr?T@T^>Rp9Sd`J@5wm~l?x?80_2r2xiX1X{=3KoF^J+jPCZM+Zpx-eqCwpz(xNjQ zRG1tmgg70FuTQMIqASXx>amD8*1|JJC&ywYF)LUZfkjlUE|{(3wz^p~@oY2YkaqZ{ z1PswEV`N2;@WiL=1_E7z7G}obdX$fhd3mSX2d%Cm>hims<=}|9%;F!=Xx*t$Z5rh* zs#w$@#ZI;-d*z`0@}YQvyz`R?tBu3{@?411|^l zfF8Iesu8pVbFQ#~i;AZmWb9Ypy9oE#q&~9I@761ufFMgiYW$BzC88Z+G7l!At9kxniedGd$;;F3p8N3t1=vl}65g8Ki5hZ=vmq=uoPIb*yVUqYm(qBI-F$R_ zd&9Y36t&g8}6|^cwUc+broHY49J+Gk3gzVSwn*Hq2qi`Vu&tmAkjQQ)nHIXrQ zyv!-G;{YwqV5yf`ywBi4YI}rqP(del`evV4h;NzmDtZ}DgW})NQl_YI7ED9S*yBHF z>5g#DHk@V_uDA2(>h2B77XMt;u8-_H1Vrr2OAIZY0z1*fxozRRS0W=kKbFz+@70m;yIahy|<81Ii?*KZw013+3mZI*XFv6F!-H70i~1hH$Cen$L>(J#`ruFx$ARL27&7#3TF=|7edUFx0rkw*@$aJc zWzWrdUA$&Iewh`Zb|HR_pOt*gE5~4)Y>-0WT(&_$EN(@Yk~P=e4ojgX|JNlZL+|rFeAX^qRG-ZKnFh5uq^K)xu%Zefvs+&T)bT2I3Zt!A$u0H7 z6klFkUT$7$mFj9BHA?F2JeL+AaR0@7C7EqkZ^hMRN$3oj0)3e6D&?YV5&c4Ko;6AEyzy`Jp%m3_^aT0j0yqBPisaB%J-Ofm=XMe*LjdY zxJEK<!7(tp~)|6}Qemg*wLjr?Y3j7GJr(*bS2|5$*Da+21w=OePB4*yhAj4*>y!F!-k*y9=>=eg#Bain4m7~c)}$hbzZ7+AE^Orv zW{|f-2AIhu)&dLiZZ6P{>bykKCxlv_8TlyqsU~B@bL|}>l-Wfa?CxsVNHQ`sCb@DW zAxkwFWPFkN@rICYeu3MoPAHR?@ZR!Lk04JX$m=ZgH)AOtiMv?xozKe@j(9O0HAesY z*PguuyOfV%f{ga}GBxhhqb|iqzj~xp?Pt}*WUc<0`}NBm7Y<}xp92QGT3(b&KAed? zCVd>L(zr*j)vf(AYvgH6W^9Xv3tq)t`iShll-XFYEfUP&+!&Zu*<`R{{d2N_>> zW~D~T!O~GzWoPU>+G|PM6H?92Ty@Au+HdoBkG?<$Chx2=B;Nd7SlfoAlnAuaU4@dA zi3+|>*5&4q*$$mJQ6?R=a1X5N=WLdvjoxLvZhD=xhF11oWZlZK;62cwNa}f2_W^w=a*ZWvt){&+d6st`ZI3L~wvPm)yPt-((v^!x)vt6?llMNWyx2 zi32en<8y?&+Ul}-`$(nLwW`EXhk-TAyas=q1>Y_1Z(Ype9f&0;FQmJ=` zGNlO>DSKSSQ~QA}7&5V`Gx^<_tMXucQ__o8&Kby55R4qPwo+&)LN{zl$1lz1a4@wu z9Ye<^znZk#B>ttnp>#nOQg(b~bXh#ulA3WBSiZY1(_*FIA9t-asTQ~N+$JeOTw0+FgIEZU# z>bKXXQ!mF_T`#meyi&12>L_>>Z=WI#D-MU+s$K0?UlJ`-In<~yF7@mcA|Ah%)5L#<5j3leh_;gQ=yc0!0#@O} z^OT%kd3uSDlWb}KEt>&Z9IoQIY&xGK(OG-`zr;jA;*h4F>P@$cXFZw5?zgb`Sq?H^ z(AP|q1<*?g8u#>s_JmVd`&T(ju%kZOpJr#c_7aB@NpY3T0EhP|yBes!2& zK3uG1#I57+?_U}**>)e$<@{DUFE|zb?{mIxq8SI zrl81zkwqFXnXsRUS1V9|cI>{imuVn0n2~H}AkbIYiG#D2VX zQwI0E=V^*ehCtF_+lr&&fq>UVK(*azB7YXrKSt5tEB9(qLOw6SR+258pMs3=TJO4d zTOj2aG(d-|B%P;jheUN>IsWC~TN&)KHEFmv*Tm8p78ef$pK_b3bmq4oG}birm%0-} zP;fpBIWFJ~N&d`#IG9oWY=Q_*TpFXF2x~qj6=IZ(!b^_X9^ZnHG1hr3`p7J7G2bFR zPG+C=`qmvqn0JUN`u;ek_CoRh(yw8~L*6&)a6Z$YLa(yQB!w$v!11kJpK7hfz4SrZCunkRHE{eBs9S!j$gPi*r4ei8=*Q(KJ75= z=0;7<_LWMW6P-?-U$CaYj;I3&R@W{ZDA8?^YCFdKA0z0$iPr*r;a*uCI-F$WiFd#u z!bQVvir@3j+;|-<1U7q}GDC9_sj|mdR<9p*M z>fygtpWsmdqyG^$aN(O zr}C240~XsOuG8*2tn;HqG|GOI2d?`@-i02xNH0do(f&96Au#Vz_MVn>wDfDgk^Q~y z+dLB?;ug!XgoCWs4WA#whZ0d)VSX${*3^L`33MN3-BoncAB-0kJ|^qH#$u8R<+9;` z0CGag7Qfm3u8t0|=QcCBBUx8hk!fjqFp?708}#Nu=91za#<^n``HkeAM*g;(2`=p* zVc@sSTUGNswG=xXaG1tqSW@`Ejd);vS^^$-k;)#OoM6A}>8%VA4FsM^17~P)@Xe16 zPcfdx8?i9pf?m;Db#bQOnkjjFdoK?12oWaH=oXK4o=xhoYJ;jIzmIWwE%js`oOn}H z(>CSMTO7JkNBr9T$ye@=S+q)%1!}DOO6K$XhRp})_O*;;j$ey1%b_SuRXV4XHJSFZ zKg3M4YV}9|GVPHCq9lZV6l*4}+GunVu9r>f%&PSjPI;r+&CTTBbn)k@6w~>ttgoL> z)%mwYlktk_iQVMF8Hg*U3%!}e8~WFp``=ZhlrOM0>X*V?m@_0$bKjEDFCY5n2!&OP zQh(VhNTxtzKur`WA(6~#<(PjtL$puWQ#ycfeseRso=`I()9{?D4sh6bGgjF7Gu+)& zMMq~#D;FPoQ`*ZErViIvE|M%LzAyF^3MG8)UXfhOP)o(^e;SA&68a#r z3WCnrG>X;7IdZR=(GU^h4bOU=(yb2tckR8-d0X1#lI?{3@XhBa$BH%I0bRcpS_B%Q zP_E+a)zW?0PQ@Y(t@~bj0*Ad}s_-_i=iQ9b+0HBjSU{eC__Yt@ljF;uuV?E7q`FpF zv{ssc15KXOYDn#KyDPQU>)Ki(P71>|KQ`YhjCi1JMzRcN_}ew`AP-C1>msn(_g3@C zni7$n8avlk33TX*(j!f|!#>}~vo3m(7BM7DNsr(AJV?W`_H^=IUhz>>An!~=HsdFG z8mn2a?ml!oMKa4Qe}F!gF29xyR9Royb*>>G5$EsqJe2BMnY{}Z0jB9xR9NhhNa)DP zm>yK*;!*A2FH$MQK0H`?}N(dBE&qN*_*ii)2AFA|D&>ap_BF62P zv@zKH{IFN1GiO?N-*BXP{{4;kh2Z8PlzjDtLvADp#cbn|60spesP3c^{euwim;ZcX zuaco$s*R($*oe#0nO*o5WesEV&HK3Y<}-O!I=A7nr0Ep5Yh(1=iFs(SR#soC@ZSSm-0ecn-U`uN7wiahx41p3)kZ2%n44j`^_ zZT5OB>bfNfL@p&pCT>&{yg=!pVi!5)#<1>|L~AOt1K~yi}=$!ggzO9=jj!( zw(p-F!CW1mB~+zUvmsVzYXH6LPrX&Wrw1 zIz36tN?);(Y}KL8W~r=UwwNfF8+ASD+(Gad1 zZ>RF?t){@q?+qs0HU&Cx#z3!RbR`$tVS#`)hec>1y{RMed4}|z-j%vMGZ}$Fq8_G^ z-_sLs**BFkOo(1Ah+j9w_~~lZ@ErG@Reydz{m7rEg~+?vcoLR==)*qIY_#DvexGhg zuGG&kqJfSyBn|tUwBoLI^k!Nkq3dn_b>r5tYBKrhJKJ5Zf!aYGvnEw?+I=tm4+M&g zgyAdDa@8)Vswv0&UUT~ya|W-MXd3(Pw!E{f1}64n9&mU)ac7yoaQMxxtBY_rlx{gh zxxpfj`tBI|-m6AyM47bE39}AZj#}_j9lAXG4ub6hF{y`uCeDRADwir+Fdf88l(C` zx|gb8l#(v4v~7L1Pxi~OHZ1|t{X@e|EN!y9us`UwRY4A#;KOTM1^VUF5p}vJ)l^tfda)MCk#6J;n71b8qZ^h`Jdw$%WB&o~M{TPD(mBu^+@WIX>a&fz;UJ`ILKF&>t z=%6p~C97tZ@GsKXCsD&DBj}7Sd83W($93ZX@xs1v?ur71oR@}d**dZKk6(b$uFqzo zd=B>vQ|*`~nW{`RS0V+QN3CyJx*VaSz@8;^pmro~B_c9UnMc~E@14Akpih=&kAKRv z-JC)cHPtb&yG{h%MvT)C2Y1i16YZ!~Wgjg&+Hb!=^=uOHt=HF3O8p1P1Sj zy_;!))^;g>xFrcOVBR{94fzF-q&-4tx|bwH*dFgQ$a#}>2ZVMjb@XrYu0Ny=Yd2hr z`6rIWUekxlqn!dtFP{6V9b;XU39>vF3muF;A#s8s69pxQ`gfR!7Dsz^_UwgeOH_UI z&)w&4c{l_0_G(eVZ)^=Fc<)G?^9c^|8R{~7V`y(P)!Dw0;E1kWo90s8iMdBj;yHM$ zn-+!dTxm5}sX8m<&%6+OIu4&%{J5wCFZC==m6Oo}QBp8fKM4*TepW8iztZf-xK`suv35md7J9J*B8gEDQ;_iiKW2wAjd2)xbcy1D#RVFmn-bv5z1B_v%;d@RmnTz_7$2(Hv{jBYD|$iEhl$r8Rsnx3)vpmuz|eUWvtb zkMRMLCmXqRD5jO=cb*zh8m4>3q!b-_cH~s-*zpzKmiUkli-?2((pl>bx4fFXy7 z<%FeZ?tc9pRm1apMtAKYC`(aSf6SO)p3BR$g_Z=fo##rMZCA-VAY@3ATlo@e*t+A0 z0_S2$pUpQSfa&k93N02VvWvzc`jf#HYUFzK<&c(?EL1pAaTC4|@-UgL2NO{z+ZqQe zf^kN^NA345`wXHia;RNO0eTeLYLHKiiNUG&GbtO)rLXNK;`Vyy>ML{FrfvoRCC~j2 zN}hi2U~q=Y4qckxZ8K2FlyyE{r@-K5)Nzfft z`=J&b^NiL(yp4CN_zP25+N>)wgmS3Sd<@cM*H-i`6LVMyy|pRfk^qv=$opQ8_6L%$ z3h#=>*U&2pU}BZ=D$XAN)@gk~V7`crqv8{5=zqrkIwa&``bL}Y-S;=iijSFBgYt%9 z#XU;dUP1S|s2@qb4C|?)HC9--C9}xrbpG2ijxw-<&bWrnqdt=NK%Xs=kiyq+|ABxv z>Zc_D1biA#rjHh7pxJI-38{LcUeJbBuOA-ihwde1ww1I*c&KNVmB5P!0$yfxF~W}U z^YMp*2~PYg+h(@lV)~lRvu{-#j7+TEN8jh_6&?uq6H(iuGJ<5NuF>b>pJHfI&u~)F|4lY-j)nHI%G*aK&qNCn?MZTo8GAnTaU@1mSY3Hf!Gc0& zrnac{gP_SP$fxGz&`ETj0t2WIa|92R(lLo8zgska#C&I!Y$Ma4h{;^MCzHWNr@la- z9L`vee*xeI$#-E7b&4|Io-~;gz>eG6=lNSbN{P$=+10(z9oisXQ=2x7&y zC?zmA>N7}s&UGnB1JS%zFOY3)<;a=kFjC^0-H^ZD%1XkBek_3mIopzcp!m7hgvxA< z?(NjKoj0Q<_T8QFAB?*a9V9ATiSFCg-_N#wgo^e|bh~gHWVfG!{9$Fou(Onz;!gO2 zU*r8q?D~}GaHsS=c>6Lkc5ErwrW@?T}P9oz`?`bM-c5&X&4V<$VE!M9G2N;RA7o>k>Qvb)YGbB2|R@#)x zIymodi!?3eKZsQ+k5cOPMo^X0rx+D|JxU1Sv`2K z@IY-M{;w7g$lLXM^xyjc|N8j<{N+UqfJ8rrC1CuCMEj4I<$z7{S%1f(BOcgLlMZe|twG{f)We z+21}q#6v>pAzE_SS4R#Ge|staTx+a`hauNcMkxLFTlJrR0bE4^HuwMAzvK(+b>M#e zjgqJJGkb&cDqcAfCWuk~Qss1Nb$H~3MLsLnjk=n*=RV)BR66|)NZ>m2l-&NKVaLA> zG9zl(@CW}@jDfejZ%%?wHgAiYeXlire0*p@*51;}O72jd-L;;8+aB{!rZCz7)wgL4 zmabXhrqLobt=KF+?0nx!$G`4Lz0aY~|9MZa@<9l+v~+{R8FZ%ERjx?Am`W*2Wb7#b z3z-w?qZ7ZUat%x%qJ=jsQ5iPZFJ;aefIbh&M~+8G(s1CTGLyG<6%X?NU5)B9i12lE z3`d`opO5d`0d~%JS)}%6-`{F_6cElsa7O%e{d(h~{Qv$4GmBUN@kWMxvRLmTARW64g41l%kcfcM6P zFFAj;5h^~jCA(?4k~0anttFA$HV*j+t=;^v&96_mBk!sszPGU$gs~#i^Hn} zPK!a|P<9Q~CVkxopU>#z&mh^x5jb?l6WvkxNlc0K5zf&>T;^LY{5~rYcxJ zzrGnlNVH3 zpWljj$Ck`js7#~^yJz|hCG%Kkd)DUjWcyPbsu32cPocghRF+F&OQ|W=dYLjvmZukI z^kb|aTFwZP5q_<67`5Ud46y5bs`v1kLs7|Ed*u0V^XWe>Hi1|NM_$?ELs@Cgpojfn zRY9lGe@^cGJr(T3p9H4jrfS;>v5JWKFW$Tl#{_#kfL}g3 z+tt$nhX6MEby98Uby8zR>hHd+5B6n%Oyr;KcTSe~~Ttcx}F^L{!N z4)1K{8`M&mN=m4%FiC0GIrQVf0@8o*O1v5lF7@ol#XL%MV;k6~5HRJ7`{Qp+b6PD( zQTqA$!ES}*4#D7qGLRPQBZ`ZjtGJty59tyo^XzBZT_^o%_Le70jUA;97e(bRx{hju zqK?O@xm#ZPnq=pX?Oc;-0`Eg$pcf$TIvD`!kBaY6`l*iqBi+Glt%FQL1QOF(Onag$ zkB=l|VM;aZlA8`B4`jB0zThnhx{5k<* zMpAxguK)hfH%z@W6<|skqtm}KWuQH%M0f}g)vg!v zJjzYiAPCcLMn~)D3F3ENd)er+DN=L^h)&DyuK@Hy?1#T8?0jJkLLHN$B$bGt8VA@B zHsuB5*i>hOd?0!lI(;DgLqt1PegsmUA%O6tY4JWE-}eVWqez^;zgo49lY}{N_<^vy zAO$hNwkHFMROTJEq}lFtjqV#uYf{FMJUK#N(Ku3mRaGXmjgbPS?aPO>h&zCWIHbju z9wH`%?JF`GSboOFV_N(FHmCM=aTx1W4Hm6YT&K5$9K#B%;7ATkMx5reojEEN&9a1D zLAQQxe4-rPF=kb8Y~8~BCeAB6Jo*W@CVeagzz1hpX{2Ju*Jea(Y^XRhGFF?eFkB%U znV@JF#*uvrBvg!Ht`MmH+CUd<3q9j!~HJ~NL*6(LgsTTB5y zIWE0It;T9_b^O_-7`!~#{VrHhM!)Yqu{(|=7!&(|FN0@yTSzvF&S*7OW2$Yt+;X2)^UMGhu3By=>}=>k4nav^)!~|@!;8^?>S;1kKd8x+ zL8!|bd>;Ifpxch+U{6cytIkIaK9^1*ngYh{J+GOL7yipSd!U0GAbH=88jp`-(3S|auW%w9s3`)?3FBURjBVW0Ao2XhX!Q_1I&^Ed} zF$cGc0fj?bAJXU#d*Rg4DW1abe%G8X>TWn)eWi1@Kg;&TFO7au0ofYW+p}=zeo#2* z7jcl<`PPWmQm^~Fcb)ePE#9Yi5~$^Bb*=ghP8x*A=l(gSibSpld-pxn-q@Z%^Q05k z3wDKjwm>lwdzmt-g6@y2VluPWA<_5OiUF`OGfsL5XF_Gi12JushOPVV%;!e_YRpPU z@n30%BE^s46KaQ0_?IvBrV`pruO(I(}L1^hC99~CDO;#Mm`(7RD{bCgk@Z) zsEE7%rCV`{qzQ2ld(?4@bS_!1v=~;R{P6``6x=}Q5!jcIXQ-$s%DziQ6MgjW)f>+O z^mlDokR%=}>kH}wcQ7`zr#{boF;r&PDMggU(Kc}1_}L*Kr~DU5eF7q7dKq9jz=epcf8cf zLyGXRhsE)egqOwQDGBd)$>x@p8WR{4;-q==tZe^oO~n(w?3xs@jjY zEzPaxR zS?!7Zy;i?P6a$J0;@v5LZj7qXh1mELn0Yybt59BOxa;~UoEdsit1J#}W^7=M%U&J` zpa<)a_yU$pBpHU4v;ubu7_-Tyu$QJ?9uJBBh_Y0cFcx!K>Uul9F5uIj6H8SG^#%k7 zM?c_sYQBEd`SRLp(J8V@yUT6|IKvD86u#Vm@8e^FJs)3RSJ%-{mL%|!&0`VYD`bL4 zY=k)P0yAi()onh9VUTP&-H5{(3BYz~cPu@hNtwc7B$SFHx4px_STzAlmig({SikR< zYw3H4P>@)#d|Tefry(z}&#C>KmklM_w?LrDrt|3iUei9p`8}8()h3)4gXz;X@uhdR zd16!#a)Mg}m|}Ffz%*X%Hwe!ua#+_4TD)9Ki2{!h?9#L2^_x8^AM(c!gy7K1K(?s$ z_FJIk*xtwRk?vMYEBG_|DjlpQ%1YT}7cw6^nrHI~yKX@>-?x7#21(Xc0LVbL&v*rz zoBviPxA)>!oc=z=2#S)TM)6r?L8k}Wn^WT&D>BTljW|%^z_*~TIO9-DXG9w;!Vv1Ud z?q03TW&t6->=Sd>0759bc6y2Sua$M2rr?i-^&mZkRwkjV>VwGLYKjrZ`-rW%`@lRj9_##I?Q=p8O%%Y{pg7h%}vJ(o7 zN#sCr=9;K1RBid|#X1e_=|}aD1wpt&qHJ^t`QQcA=e$(xXwUI<(1uNV&;{;rSZSWd z(kpz}pvMY%(vQ#;3u15J&Q-(YcwDLDp~AW+wk66~hcNeo}m|&)%ePHe%h! zw-d_$;qa)QA~;AxMSQ)EeQgZ}XJ-u<7VpBWpCPv*u_B(c0|*a?5iQtRNpHNxX*IGc z>@1-~=Zh}=wyCz#!ZjmfU^hH8Ejg%BIer>PTf3c3!x(m*t<8CmrLHo*ov*zLHkmeT zxI@$b)w@Tb5v%S+u0Xhv^XFMRgbkK403*skPk2fV>o+q9AE68!3WtLA`C_X3%3*;Df-xo}f0nUYpb~BkY zUu&!P(1KOwgBULw@B9oO3oi9$tf*&!eS*G(fW}qtkBv;uo>GEHpb5|u53b1$dnV;4 z?M1MrlKO}bB-f$x;aYaYr8*~TIoxtQog9Hqja5>tFRZzx2g;JG@}EZHogQ3-e+c1U z{9*~pLklAR2Xp@W;9&L7>LSBT6rZ$}BGw`AF>?d z{U%hRRaiGl`e8v16h3+36cN3)qRw~zj>AxdNJux*ARrCW_06s4oY(Wc=N#|2|K2+WgRuv(_gZtUHRpVO z^(5ujsu7d&ywQ)(XSV-t#vw+b=P`96bJb=)&VcSkhTOyWx+viD=bULz78IN;9B$m~3=g!+5Z zff~l!?&5sEZ((ii-L_||dy~jjssE+zY&}~NhvBHaqE}zzBLs~ZyHlt5kx~GvVU}<%;WmLkZFD3sQ6>-W01SdBN%3hWI^gN z6AP-D$Xp_IwWBfNy&74`xX_WEyH$F5{4-K>M~n*c79ho$Ilj~U*^|sH>_|j^Gxu&2 zrvM3ZsOnZm?|0XvmqQ%#lUp4wYpIqda?F|x0xR!`d1oU!NV1l-0v^Adfa2LA8x8oO zcy7>E5VLNXNMP4n<7Xp=*=XeilHEe~3&JGs7T4LCwhc8C94zRIF|X1cFJs@^K!>#T zri&S(I&TiYi(|)l%B_WV=Sy~mSoqK+GbE@ZoOBDpDW6%Ss8t_ zE!05?+Lejh+iLlf&Tv-PBgNpAz++ddQpZPU>Vl>WjW*Q z>7h7BzW%~-54x)^9|Hm~NVaKc^$8>C714}7a=Gr(@>}1TuL5=FM_xvb3T>!W7gSuD*6xQ|KGdrW%H2kkG z1o-2!+obFnOR;{G^m93S>;eLlpk8wNy((AQl|!Pl~@L zG#`hf@e6fCr|AoIwu@a2j#ee8hogEnT&G(Ye&-e%su}ddj`bIo3zHQ`2wT;|ibB5e zTzc>zo#UdT$75i~H2IdTjXr#YP|R z{B&~vNv8Y*+d>@gzC#2i_ zHzd`Z0#v-MCCP0>z~VP#3>qDX)(phg;{6>3@_P*aPacQ_&I5%vmTCXyqmK#DRd#pi z4P1I({0$fU-$U6P>Ssdo;pbUXYaxRjGf{yfD`?yJZ}2Og0DR~LimuDZL4fO#T)@$* z!fCPff4}n|KY@>zrh?&u`bz3=M)v=^7u6ms+x7Ej-U35qZu6eUq8~+*dA);wXi;DM zSoi+K9NZD*mx$z$%z(3vqti`hyeWt(_x(9MrMUvtel)D>! z8lK0+Jt5gQss6T?qj3VprM+pWL7j( zWr8}b)Pb|P)YG}>c(ULw;P|+KklD1XJbC|2ahLz8PLkbtM!l#3zi*Lfu~ud+oNO99 zIcnCPsPfK_XVUNb!uz*P!atlhwJ@5Sy9g%>MgQzWL&GZ1Z67yhiYMLxW~T{$h-G>rJjn5Gb14Jyxu%DIIx}Ei92WfnWX|m)#-jvzt75iZ8j$l|ryHI`eAC>?Yr-#1BV>_|mPN!@^I4Ex4^KFE;saQ{ArlgL|NQ znBW3VOA^)yESyUl6Yn$o2~q%p3A(6llmSnLg#B~r=iGpoi3i5Bd(TT9qko+e3~#}J zK3c9Px%X>l$8#bD0tWfVqET3=^I2|i9K6oM6?dm=KCPw4V&fQHN1(s#-fgGJk1kKv zGlm$H(&8gGeII0)$hSz}&++UtI6d%Qq@sWG{yp&0ysyH+fwMwRUq2_!c%OFq-wSi8 z0r~SuEg?~#VqbSVYqM(1xy@c8>AaZFI5+*1bu#aJ#Xv8gkRW~k<+aC2a3y+7Tw~an zUCvCoZ`(sAOi2YC!-E7R7TaJAC+iSoQC$c?wUPk4fa=C$H>1aEH*+rMM9K3cK2_AF z?9q8nuojp&8`%*VPr4G>@(aQrDu9SIdff_Z@PLxIUz~oJ_Q-qzf`Fw@PS=Y+-v^j3 zH}Iymj{)XjcXyX734Ox|5HqTok|=VStna3$rw_cUUDj^_t_!_DK2YBG{MaGzCNAo) zjok2DkxSBM-diy+sm)n2slN3)pR9{(4aKM10O(I*%e`H{xxuyDX4pHE^(GDFo*IBwV*W16`{%qopvaBx_u z$cg`CsWQTsJ13l0%Kc4#A-crZBz`tshGW^zkXf(&2)#;siH5`NS&kRnX0cSmS7#<2 zk=`DQ)-VtT-h z5#*4rVMQ-?L}AuH1k)80a1A8T-h2M3;p&nsBXzkG^i?QA(w?UL{2=Jp9B zc`O00OSMqvgZ-th)tZq-rOJI>-ejdY7a%ZRE z$mTnhVfgFrM1`=g_vrymxz=C*Y7P-85i|PjgRF0_)I*}k(K+Q)(}jFR#a}KzOHWT< zw#?`V3QLTZ7P}MgXx1&u`ys{ZxP(UaeLLUa+?h0N)cD$;+YRx4EKJWe` z6*jS_yp-{kW1G%vc_LWsdr&>WgI~Qk343xClGp_sz@UGHw5*eT~mUmMp-`(>r4{*G>R9k}g(;P}pqL|q9n-_%)xd}NHr9|fKSiTEr)>xSMM zrq9F*X)2vK?Hhi5CF40_d#lwqS-`3y^0S{7cDvOsLEKqRG^b<9t`V2rrQ}Jb!^6&$ zhUi8}w)o}It!Wy|6f>}*)82xu)ojbv_R6$nj?ld0-}R?f3ZS8vPLHF^FH-n6!{97B z$l-Y+*U7a4$LOB{Jlz=poZ8x?Jdk?ai~U6CH&?|m_e0ex*Ov#y{N)1B2R;Ir^et5oL+HFhpeL= z8&chQ9PL^R8DrN%!0u`L1fKNQ9tYpJ-S;l>&p|ttZ0R@0A^)p;sWfsdNlTa&_tdMB(BB+smwL|j_(U? zn4380C-y0KekPQ*8E}77etAc(Mzpz3z_=NC-F7prWp)$9xx$&W$?C3Z&UmQ(jgd?# z)OA*gX>x&?8owZ-djMTOcq;q(C65^hQvE7;T;F_zUnxHS0Hmw}ekV+TYL*K;HaCU? zQUq!Z>pVtM?V^w{Xtn|ec=?^TXY^~L{a>RO@K76}9sNyb2kT4mTX|Ju{u;@=+P$0i zz%!=lwOHl1(6;`&C{`5*&$kz{y2U&X6@hIKYPj6V7Fxw=eJtxF^ze<+P#9hcUttmz z8DFg4lTrxAb6;268`FtS8 z_V)#k6O|IlcVpU}?jKN!9VH1J8Gc%u@>$^G&n;(sxfE~+3_KU?V=24W7FccKRA#pNmfiaUd&!$5*xpVsO!4 z!y$jWKR3e!g#^iNjF;M6OA~wdsJ%&^uH=N|!e~atR5Awq1`yZ>R#O!=)oAs_AjlGA zZpLt%b)gZaM$L%u%?X+Rnq+yyYn${@6w;Trg)>ZHI2jBkml4Fe`2`G&>srqxIEi&N zCk%b`RQS}?qg%^ZBfoM(=4vmY8`@T8UeG9_6Q*7{FV+ET`RC2UP zC)1VL9ZfL{y9&sI^2Xk>?SH*w_x8BTiyPRwL_&?AeKIyoMzPN_^}-Q(TsOS>dfrA6mA9(i?Q zI;PR9krg+bdLs4#3ws^H{v-fV@4YxscoY>e( z8Gt#&=irHqMNcwt^}6cZNBp&gBsVu#+#j$E1BWe z16e`6GD2@>3$$;OfAb{SC5dEA%A+3%&X~i{qo*0CjHem(FHhz&(P8kl$LU53&z6h3 zC5S8WHdC=NODrA>uQG`lsKG?rk8lg#?s%(d*_iu_mp<3xZRh&(u<7}F=5u$8C?rB6 z6;Z`kg6b>|Dpb37u$rDSA=|!@e3&u!p{-{XX*O4SR{G}b&$>=B3Bl)R;Y!>nmdixC z=}H}(RAbUT>UX*XOb_z{t*7cAD%W~d4K5@?9di8VNJg{Sv;~h1BXgD0W1LCfkCPL` zBL_Vv9K*$CQiWQ|Y#Acp+5-Y>d@9 z(nKYnS2Ck?2;Ge)u%f_`h~9>jre?_|E^#f*jpUlQ1y~gv8HSvxd+a)wei&>@_JG|f zJ(#Z&>boyjJo725&Y-N``xfX(ysf>SnI=g373}_iMoBnBN&0nqatC=HlRV= zR8GY_Ef6W&MuO(Aqv4T5kQujb=Db$vrs+j-x4cg=X3mm_V9wVPNNx z|4AgM?cV)I5jXgXhOjpZ-+Y#<#yK*fN{^!&(FGqsdc){T1^_t%eIXp`y+Mm(X>wbH zT$?zD`%7Fdq0s$aq$H~Kk#Nd^A8dR2JFI=_25PHH1W^6m&(2t-Xoj+7a48J1XC74epQCX)_ondmeZx14hYcVY zV6U=Zr3M4n)Ar(`36I;&Dbb~=N?(*#8mF&4g5~6nhI2l|I)La&>VNWl^C#kiERJvz zwe!Q!=f?&Udg|3?RoKP!MlwT#)v$dn95==qwbcc_2S$rR_TXrMj%|sJ%||oeKYZYj zL?_qTb6D7>?${Q07Il%cwr$~39}>{Ds$xK~e{f@q;4>ku<@v{VISLa{Rip6-6CU4S zIZAl<%ie_3v?X-3XfMz2G;e?CnQ%}TrK}>Oi~%q>9u$H$0ilD4e)_;^(Mw)fe%FoO zGxm<9Dn(eG%lfDeDHnTaDAG2x_kqYCR5qHlU=zc#eqr9g z3jn&U$QIZ78TYUEX9k2*is+DCMgzZIZVVsF{Lo82JKI9MF{b#_${A2GF;)8D$D++g z%+(=tK;47@J*;jRWi?uW-hceKaJUIFSp!I`LwkQj0`%p1F29`NqN45Ie1D1S=!G#X zh}Y2K+Z25Ree?9H%5csCwXZ&v`t{3!Z>2_8aK-?%SitePUak*w5I??Ej*f(}rB6bI zm5(NX!X#0wJl3gE^^*A*CM};jcdGH z@S~f2lhWK;*jQ}&zNp-UOG9eIzGCEe4R=blPxMlH;V1{M)ZAG%))VgYrdD#G3vI-t zBH<{!3okV@-v4f=P$%H577;)AUQ(5bdm;JU^AxtRny4=P=w1xS##0z3o*A^?5~#Xt z%=zv$wKP>-c^5Jtj}U9z#E(EvFDgqN;kNMUy&p6`c)WM(0;uF%6dj-;?O01wAMLt9 z5#gMru}ISDBolg_5iKV4CWdMcp_KJ;y3eT`88aR&O6eGtsMlliTl|r5DIY)Ll9EK0 zDF+7!6Oh#Lo*!&Y>xRfni4y6eT!F0+$~6h7x%AsN53;4T$(mfYLBi+9#p-*JsL&_8 z$a2ZEGSRd2APaPFMANVn?6AIb$BK}hm~M;&l~|)ueek*Put9^NN`?`$eJ>r4^pvXi zI&t26Ov1#O*!xOoU5|SwnX~oK$IP0qo?_aB+(DcY&lIFHTXYQmU3FwuuU$ zed)n{;*mZ;+3+jI*vx=M1y+8Sho+|hWoFhzg=R1xdT8e#79S5VlF++2^` z)d`-YW4sS@>)>@WKTa}oh}HJ|drbn7=V1+AxG;)<3(%Q8@l5#~`e5U!g~7FDw?t4P zmq3f|dF>vl%llIZv*P)RlrO&CuZUjK-W2 zT6BT;FNQmx58y%_d7H&aFK+wNjk@+EA4+k*?DqcTXhhz4lYDc!!S+jK<{6Qy_gVDr z4$1!%xzw;ZhMlF(higLip&mXJBvd=+d?j|u4o*&(m+g{orJuA)qOsAeK%jH!2n4l@*OTvt z5q~zuC&3qMjb1Go#2tSo%FivB(G{(>f!f|Q(47+!(t#SD9P$Sk{R3s^CxfjHOy^jP z^_F>jo}Co>=-;(Fw<^HJ8W|NFQsSmD&hX3eBNEs{ASzi8Nw<(0p6mZg8`uj%wzhU( z8@!6@<2!tJtye`M{kiZIIF){6$=kyOG5;g~`vu$oc^rYlh~`>Y?(J|q;y)MzP^e-d z-lU}MdG}TP*L&n2{)c)Ay?+O9FMI;>XSM&oKJ@2D-z9a4MJOloW4BPw+?PoI+64F~XX-|>vmz{waZ z@u158JEs40{Z{r14vDttA^wLU`E_8aoAK-;IO&$*!`KXk*H%HDKBW);^$0*SBx&%@ zxQp%C;GO-S`Q_$XaE`P-`Hzojh9Cy(U|?Fny#E@Re|`b8mjrKZ??@|v^_!7J!vrIX z_W!@-zYh}_%SN8m@PL+o9_l}#Hfor?#9S|h;jT`NQfu2i=0py<-Gz3SJcoguIknud zSO0zEqV*wDiukZf$%MxMLDH%*rLddUwZpRqU{U&dr^Wm&eXfA|2IGG|cj9gg_8^ib ze*n?M`*<}*ufbvHUGV*ufQPTxT@&GRfM{A{f@h!E#%Vs4A-)wjn`3GSgHmd=@8!u# zK;*InbcYGeC=v8?`zUsAh-UCB*xxOKg^Wg(kL7O%51XT&i(!lb5bU&$dQUP}8{GrR z_3GQK{X2757SFuF{AG^;@hLXwzR2}4t}m|X6N&8&V-Gs4ueoyxEB^vwg z!2uC2F0OAnC=umTcx{l+L^S|OOan^qi}5FJ!svngFgD!^Ss>?ys^_Tz*A8)$3nv_B zKG`!1{b+Ni1oZ4U+3V(rP=~L;4OZ7L*1C0lv~D;3p&eQ19H&Y<~`9s``QUwZ%7tS0rSbu*r*>Ok||IT zl$mtkSOUG%#&nG)1~Drm5OVEl_SS;lA=d9e$0HDABsp4a$RR2!%55`w2TpT_YorT0GlF2UC8`0E5T@8?(J>Ge)6GgXao#p~H?SbFE{mZqp^DR4KSks+rw zcv0{QHX8u39GzbY6AjI?cq=Q=Z_9b)7-$qLyug-8@Ghn>Eh7}q09~)f^?tSMCNn^5 zV{s@1wL-LkKCv^NDUJ|8?w3HmqHG?j5KRs9I-IbmHU!-g5`dihn-v_wEwi7OwDOHW z3111J^1<8K2BM5oZQw_Oa&k7mC1Fw>Pm3aYX>dzJT<_Os?${I=9;_3VR2c2cYdhf0 zs9T)_lt7np2P;xHai)~Vskmt=e=rBPAe`6kKKZEY!Cv>aL0@MxRtdAOyQw>hUVR&B zVbD3(4M!BJxvfi>^pUDAessT2ZqMNCpuSj|JjSJCOUH`*s*mT{sBzRx(%UJ~7nQr! zsWlghdXpQm-WHUd8AO`j_xf~MOS6+Gb`lgXaCN3YiD1JYl9e4L7e#-A^+M&s5qj8_ zR(W|BBV3r7{c|0P_lvTV>JQJoZ&1kj087_@HM&R2c?TnuFa^rvwaQ8}jD z=mP4)WzcFkmPL~t=v5=IC|YChdvxMw+9@S+GaQyuUd)_3R{E>H6{-d5Pn z8iZI&^af>w=I5K$2WMt{0mOnAFeOw+0y+lc^l@l*DT&!mM7{Ic;JqUvlYEWBm#HG2 z8X@l`w8+9aptS-$-gDgO;{=TdkT%gGeBI7Owv@}y@T=}|qsUm#q;hoE^D_t%4<{EG zG~|B+uKAk1?0D4rQ!s1z<5}V@9s|^6tzYJNS~;0hVjJ@tRcj6C@K<0xQ>(q9-^UqC zt)~VWS!NzaoS*zKw=4l$mEkpXgK%Ohx%V>M=@ z(if)4PEp?{C^rgm`cEu^z3Q+hU4;# zg5}PXwn&lN0G)!~!3%Yyh=)78|u7}b6@fWop17) zA2>Zfez3gPpBl?!hGnVWEX6U_m!!g*?nSN6a4K6@i@uccq{hB_T-CId3)Y0-*n3ok zbyR(8@yVO$FtO#~Dafgb?%`-lQmokyz8nF=^NsZs{nNxN#mOEKj)v{p*ZHBF#M)(0 zmpBSB(?qF@_g2|b4Ma(^?=HPhY9Auc|fZsM$ScOu(saBu1`Md5MEx~A|uJenvm4v1&fR!wT- z4kv%QJww#fqm;~`9c?efxB_-n&{X*%JGn889z>D8s*o3vR#UDRDz1Rsi!o+W?8Z^tfU0Fx%@r zwi0e+B$k|u)4k9X!L$sqI5 zSWO?imOkO10MTyw18jG)48;(V4nVW%M?ZWt*9h~V^10fk;|!gvmTIs@p&6QcjoK5a6 zXqNV({MeveDf4PeY`{~qq9YqpErF_;(T{r;s%%L$AXfaSYA>VmO;Uu|$zW^Q7GKiE zazo1A>4?>f5zfN9&o*dZT(9Y@SBNt03AR#ICKVZEaE!Z5i0y8%D2AF3%MRx2slF3h zFX*vJ?R`5r`&8xRSSXYQiiZpdZAcSzd2#`ZL41C%H9W+~e4EPmoMx=pa7-GxH7=z2 z0?4NYzj{QH3zY9sOwHRMEK|nHwiv;1k-Ov>g~6)Ig4O_$ICpIg+#bq}62-awiVM>N z+%h_uq1-?v*N<_J6&0#-nCTP9FW`GwtHF7=KBjylWC8ag?_qAFL5EfbUZ6uZScyCg z#Z5|Wib2m%c=^5dne&d(HJ2LK&GJD47n+7ZI;3Yd-g*qMD0+mJv~2rFmF(2gTPP%p z;n9kfGcl-HU{aiXkA@xto}!|Nh~OC9v0LF`Xv@e=yPWkB_WCqbEoq=BJFR6M7n<+f zvp`c%&fsy3il(5!1!4W1J+WhEK+!~5y*<`FWgh}*S% zNC8msI(K*m8Y*hQTRI#7(H$d5v29u6+24U0)Vg^LRQ8chi5-%)Q+xJ=dpJbhp5(3A z1!yOzN2uM<8^wW;8&M847yW)U;&dku2h8#8hs_*tvXSRZF_Hh z{h@xf3W6{BF8Umv?JXEJz8_*^YBaBQndvFNl>4(Cmi@1vhveCpG%EqlrA`yv&oUnM zqE$sz(h|MJuTGmfc{kjI%W8tv{N57~65CU=!Oj6%gOVwhT&K}AI_D&`caylQ=O#sJ zsb=K%nEz(jgV7m2!dG}CY}6`mXmi5o+A`Qbi9zwgksZJGysNtb$s;fj1?^piD6buM znf9gW+W}uldD@34B9eg~|8=UW8yo0^NA2ECGd`YEb3}pb914l7+Z)07*Q>}O*WHAZ z>q=B8JCxFdC$=&HfGnHmx7X8%h6LN)1O1>p1bza@&y1b>gQVthv1q@ZmD$9#*L`vo z8v9w7`$r+9?Q>S$qMmm$5;v`Uh1@I#hmaL^v)~YNY((y@DS?#Q5jO$dz6rRnkN^!4 zBF0|xR*G6AC0Qnm88_I9`ABN8*A5%?KBhaGXjJ^5Z@Vww(wSkeEcWt=U%zxkEQ7lu zQw&XPk8OOfYtr<=9rUcu;ceBaX^WcOFhZ_2{UEn$5$=zh>~#iG%TF1T=!?j=lcbo; z?}ZrU6`#t}z)Iv1GL!J=DCf0|oc(BVpQU0;Fw!jvit8N%vU&XrhAdW?+ipdyfRlM4 zYv78MJvzbQqg%Y@E-n0iCG5ZnIpVNxGlgc&TCrTE1Tl_4C=ww#vHwgn3)9Y+>nJz} z-SuAbo#_TQAwqCbO@c+u&p_Vjtf4?bvJ-Xf``e*p8PRY7JC1v>)sRLs6{0(X(fFO( z_;BvZvBrEv?;wT*V`|RBv*TklEG{aR;2U?v$?az)$9cXi(#rT8y;v}r!d-P+O8z4# z&Pxa4miFOD@yyb*Z4_SAL;eS8CKMv-PI3@jM2b@g2{Ob#1BC>hIojQa#$l9VzVveM)5r%{_$Dej2o0NE^W8r}h~PUbDAi4m#|wZEWVyHo26xK$`xwmF(GcE)hWL0Bpy z8fkF!T{OFRs2ss2X`nD$Gg0Z*fOZ(hUlA59vS<&JKs}e3i$~ zf*8o|#QGyb%(#ZAq?R&X>4( z^6-FOzFR-Gx&u+bY5iR&cb-;TE7FvISBHo24O!|?WIX0icvB^^Uk`vURu(|T$g?U0 zk1BW;J}tV@4Wl;Sq}jj|#s)Q7UYu06EhFX)HXSI~c8|zua^-sflbWFR?dGN&VEqn> z0JS(z^@6>0X_et9(y$~DWw@w*19tLn+LobGS3}BT=#uT!C5^@D_E- zVUwm*C|0IL7FIgbVH$XpTVTP}@T8#;&aFM!k_DCp|05-`mZu`L=Vvy<+aP zzW5X)&cDuHnUAWL@F+P3MeaQlbPfx7ZW>h9fXMX8t>F|09Yu9lv`f@I9s$9=vXqo2#^_PY_I3*~V#+`r-Wj-II37k}#b7Hyr^|!e8XTTsw%ox{Eg$s4e!dkXRr)>?0|a z)JOda>A$_{-#+~30psDofo&XR=8*r;cmMd)^ydiJxPL(Kf1Uk5ynxxu!tqx(RRQQP z`~AP5!e3q-s{#D=SZ!&7{a?@I4?JHAfa-xQaa}aO$xdp_r4?^!$))Xc{T-f9P5{t% z@-#J^XTPBcM2P@JAWGz3@jJ!-e6*hxKlyd|IL_Tg2B^@|-8wVP|2Pf^9f0eN0xQ$O z#`P|`n}wtlOUC?|#n>NtZ>Ybinl0+?Gyg(tjo;mO(79ys zP=+L>SpHJ$iE@ea^K;Y5a6{99EP8;>5m-)Sy>nily!WU*oGH5_(&is08B;GU!*VF5p{) za})^K=@O>^p%`U}+f%tohr^A*H%Icj=8-&6qzTJK9vv%Je+hIjL3S~odgD7Pm#4;5 z*x~eB{)`re$0H1mMfSFSxv5-+^%#>BQmn+&wMl)Q@+Wi-i>*Y~U~PUWPq@ikR8$lz z^pySG?tL55J8o~i67RfIOcB&}_1KPeBw}7Kkw?X)80-!R!HFa3LTdi}`TobSekEVF zWR4hGnb=XADTR-eV)CG_8@_z(Ayz?0>H<*Uf{Sn>mc%(E2}2_iu)2Tndbln`dfPm; zaaE;WPy5Agx82|yeN?zYzCfo`@#sd!AMVP3<(a5y3D5>q6jVl~wq|R#quH=<yvh2C^0=BvoLdfFwGnaOvHk@2nB=+_+dr(H*zP^)%k>P+Mb6ZXB-!_$B#{O_&K z)74o|X$73R9K0DcV_DtPdPcw(<;$;?%uB$hF{T+8~ zC-pQ~TBP8u9hUP(5Jy`m{`={L;-#SnzU^rF%BIUxbCZV^Jsk<6U7&^Ue()_}WYy2H z{^@oXfP`Kf!OmTAh1~bz5B*DOhRhdlq^~6Aj}>W0;PBQ2lw-66;1greq|H%0015jO zbxtXltor3DW9jrxU#UkrB!6=ZMo}P&q@MffWjgm!RFLD*jELvG=I<5Ywm1d}Oegy{ za@>b*38DtDJVYS$FNFn3`dEyj_yyW87(Yht#X@l#zeLyD@wI+-s>u94q$Abul zGQVzm+q$LFfEhQe^Px{-&xGUgSva}K*H?RAex2$5>9qvSj_mzURDzGft*7SMfOR`Q zJvb@`ps*;*{hSZm>u-sY)Mz%$9|`*UkL3{!7Fykq15<<&n#leb>E0B_(Cho_iH^rR z_?z=3Zu5}N7jz-L2PGbDj_$y?QlPVWFi`hm|4h$jPOD;xW7-Ee#&cY{6GuJlrmG9< zh$cT;Wlu@3=00EU);*d62FwFP%c(aBYVY*qqKZ}9Fu2`R`la|L^5ft-sQ>t)djwn04#3FbcolO=LZNIO_;1PV$p=YsxAtu(Pzw_PkB8G> z-hCmt7~!f6@8SgF?BEB)v-&kh@t~#1YK11dA?*!zJvc#oJIO*P$*cQU6hsA{+X zQ&zoYE9RW|_47;lQ^m^`mie5SN>b-_{ARw_a<6oH(}Z&O)x4~)0Fie04g|!$MLm}K z>h{N4+{lCm&)fk*T1JpcGJJ6#Ah&lw(8}aTJE|o;D=MLW5M-s$;B#RL;*6^Ez_z{< zP)da(UsYxXQ7{OjfgcWiuS6ggFm0W1z6uWElC(d3r%Denyr|Ylim8E2<43cg>ZgZ` z$+I{%e$ChfyuWy4$cWYD==Euq_#Z?m_K9>rX%OC#TgfI%EiMG;D_9BmLjngfwTIdT z3my_`Y9^Fa`*~^BRBVVDxj*AR+Vu{{;m46HRZbU>$_^l+J_Z-c| zFHzb9z#(=6aw`X*4`olc4Vbh_GExOyy7YQx_khg(^^=i2)vUYd+6_K+$H&K?fKsOw zgw`=@7Ln&I?v9mG7d4K@8UzKr{&i1qm;8rnLp8`zH8XXel)^qykFM*TWb$jfhIdT* zf-b`x#0q}Hc0;u;ENR}YdvoQ2Ic^yu|B?)$C=M-X=gHUgZMV&NGV}G0X zIAi$Rz@k@L=Du$(;IJ^g;z=S0&}Vu;d3ohhlCQ6=Sx)0{Jm0QAQvz*ua{wc}u)J(G z9pZ_B#XaZmsWaakWClXkMlUK?BB;a+s4U2Rm4ZxoTJcfiC1%jGZS7ZQ>T1AR^F;Z& zo0WJY-jUM(UG5%Cx&UPWoqmmNfQJE=hlgK@I72fDCDyp?EsNS!lBr`*dg1w?Q?H%> zKjXZfefvgBf4epD!FsU{tUz>wC8<~}&ThX__v3_a=#6Q0k3>1Mi zz3G+eRZuybZNh3)`HE}E$(ES(6>i0hI`wwiO|f2aLZ3p9(MN*l%ORaAy_0r9oznlIeW}7iCbU+ zJ@HE9LR^FL`@vY1p!;?CNK>vH{oPjov#act;v7pF+_n0RGFH{J>zfMDfn^2v_Bit= zLQtoLRma69OwzK$JTF7)2hoS?k{~8YNfu#u36n85YK}y#teB4+6l2jA;Zu+3(?3e(gAPh^;&9j?NS` zG~7iNBxFN5a@kQ*+$%tkv9^vyX73eu>;8Aqr37)&U=hzlw4$pF3`zR=mqA>u8YOHX z9IPT`Ry)K3`E&pzq||X#VT@pyK;kdK$=EByG70^6?t>(t0cj#=WpE=BJdAPFEHJmZ zH5cSo3NHD1l857R4mXovG+lg(cH3Q8yBGKZLkY(9iSl-KgrLi}(1D85h}oYPvPl6D zf<;w9Sft#mD-ZX1*@3_hXusv+poy_2DpoS)A1`l#cd)!YD|e-k+x;diEjQ;g{(qzEJK%7G&f|H6PI?gx`u8PL+{T9 zRJ5HJZVMi%#L`E8wM%iQFS+bsoFJkJj~(;iRXW1nvLCm@M_anks6-JHd~>G6Pb7f6{aFAIkj7uQ8fUoOmQ= zAfg#LI5~=_1(TK<2Nckw0*{Tii`JEr&nlNzXIdJidX5>p;hWtiyWLY?6A2*M|p>IxmIx78kk)?*&fobKDCb^@(DFH5RZ5=)SrPF#te8&J*2rM>%Om#_05I@!BsFfL8ciX;+SOb zMpOh4B;Moe0z4lMdX93s0kDz2X^Ey;6WY5)4ZRtwL^tpFM)5_tOe~kP%-92fwvZQGi5esN+*_;Z9}s!r0=!_ z+GwBFK_mYW%jEAwYCQZ;aFl# z&U7;-^8**?gEV^$xwp+6JjvclSsy3qM{?5>saS3$D7~J!$paSZ!ca`;oGCKi(`me^ zC9R5eM$HBvZyQ<8M+IaZlV{Ryw;0i5SZHk~%l*f9R48Ar-;bdU!YK^Y+6=A3xkrhG zX+BZukWGz6xF>03zW???c27-}A_PBH98ml&KNR(w50G2nMsXCm$(S$W8co})f|8Vo zBm@rLGcf+v4pYteyVN>^EtOZrG9h^iixrlsEqXW@0*qdBEqe)SC~ zdZ03>xpW>;hI|+>`{t`suiBYw!6Q$$R3zegqC=U#G`MSWj2qMMaVa3+zWAbGJz9=Z z_#kea88=WHj4*q*83EchGN%b?rfdc|R$k+{Ux`A6v7V85DlPpj|g_cft0lH}Sxm%tL~N@6jWvPa*Mo~1@`svP#R zJ+c9jM?*73Q8UCOs3q+epA70l{@>98u}{5Yq_Wj3fU{d1VjSNHG$5u;TT=^8YtL9M zW9I8TNbd*fJ^%V`_N|dFtZ-o7`)De0MG!sk21FJbR=EQ%xF_)J_Hb742#!0Jf^S<< z#B6h^EEQ&e0LG6%s14geSA^6=&Q0vp&tStooY0&Npvp+24wJ?{zi8y=_jvJr2kp!C zeW~QXI|54X{VC`yFxdZi*jt$4D9rDngr!^e@q6%J3VfKd^xV{1ZtMD-KB)@Z3)A~I zD`V*yDIzwB<-XX|QulPARLtrncEi<} z$00x?Ks1n%Xm0&GQnWJzxUNNoIzg&*yNx)`3p&Rc87I9h^A`#6Y}B zE{SrRj0Uj=`LT0JSPJP1Iu=i+2Uvfy2+sz|Z>SD_DnK`+Zl{*Qqip}{3(p)5@|!DT3;mAc z>6P&dMqLrI*x>rjXM?8?&@2-VTOxl$v-s`f+q=}WzlR^={IkYPsgUL&dw$}-74yF` zL!mox3&V~WB7_>Itk5_#v_ItPSNI=ehRgyN`)i~Yg#Q;v1}-eX$$)|5@MLB6AFlYX z2phE)e7FkuwMl<72zRaF29AyWzJdQZz8}}L1WqAoIh1k#>v{higV1sK*^jTJXaBl> z{W?B>yoMRU?~;-QQ?viN@Zh$&aQuakpAa~)Q_&) zM~t`pei*Isf9`FHt~)ry0F+Y}v@B@RKt)=^#>RyqEZF{LEYR2>QIukd@KqZWD9&*J zfJ=m3_{2X3&Si}oqSdeP_=JZqiYiP$MK>AB6zf&dT8&<^-C#HP{_(;@^U%#MsqpHO zfkNnNr&Qg$Y_Z05jdj4}ZW1gY*sDym#P~ly9i}WbH(EHQk&Wc>C#agE7;`@4yo#iQ zy-SY!IfXCb+QGW~wBU!rbjsOUx!-V*h+D`;dl6ko| zcv%$JZALWMEjyVD|Ct5Ac(6X|p3BMy?h$@5SXg~ub1QWskW1TGQ2MAC7ESxIbDSIa z_Lmx;WUw5ib&nrtwm9B+Rc!}vAq?Oz5IQo;K+yq2@k_vqpI(j&MDAs_uN)ID5SkQ| zz<7Bz#$4jMU!GTe0V99au3YJQc4%_~N=i{<+;L|k@V)$RaG?IhyZ&B4StzwEBl8F!eoT0Uh2yZ0tR3m zA!#l0ab0PKdDIDH}d=1|}Mv4!Hltih} zRdi+scDkdmx%8#nXj=vLuF<%o*_ySnZ&&VvREG*vC@V8(<0U?gTTW3q`&kOcbty_? zVupr>mi-wps6wKmI z@gd0V@UEMG*@F6qQKO;60~`5(5Vhli`K?VU`Hxvid=($9tLD?R>1nJL1oJs zx(`!q4K_8F6mG9OMOCd%nd)XN2kuSm!s5mXh^{%zpLA>PwNTwy`r2|sLYQ{$k%Vzr zcEJ13ex7uXip82-a0YC}8?MWEV-$HGrJu?@EA61yS=W!<>j+o?D5c_r*R50{3eB_~HiD3!76|!KzPc^}!osfx zd<4GRvRTVH(}&j$wu_))KPC>>hwrm^+m{o19D zE#Cj|bHAyS6np9xER~Dk1AbD|i(WB~yUyK`%qq_!W6C_1 z@76laUkO+3Z&wA(z;#HWniNv&-Bn-LAcbFEtLVCPiCTix(9Rb-BjZQ8$YG|3yU}WY ze$%AuQ^0Cx|FTDgVMFo;w}5c%aF9ePC^5!cuZdMHx>S6TJ_SvRJtnN zl#C|bOTGrO?eSz15t1?F*)OMw#KMsL8{plBGSg1YtX_bVh@UCG^whpJ)YH6@eLkuO5BS3%Uh*7sU6b=^L-jPrww~GH z{maxq6Q7FjnG^0^pn&`knVdZ)T&6Mi)F>-II(@1hjthHyC^nMA5w$N2Hmmqh4}rn(B+CJN6?b{Oh~P6gnC}^ z2Z_|i$M`*`NlE;Cvc2paRw2}dyGn%0=?Z1mkUa0uq{q1uPu6!F<)VO;11o=mZd7-r zws8s%XGn3E%5-hcC-HgL%?x^V{ruso>pq=Ehm&tLbjNA1?6PxuHI9v!`&^Pf2^E*D zD5Eq9g8f=1@|f28BSU)AD1BnynOu4SA}c{^45@>|sr5!fb7%Vx1?(0JpWR>PL{B8> zX8>ujzE4-A?6#+<$-E~hSL=r~x!+N$5pi+a^xxc;U)Qs`4UDonT;mHP2j8`iCdd=; z^lcWs#A;OgB+i-7Y@Add(jk0Ny=~KnnlD`%0<_oY*u3xLSdE8>#SpM2tkyjS^5D^Q z8XIMmu8vl!C4gQn#B?jz$dq!)v|bM=Q^q$(f?0`Fav7u$RuUbqb{kTV#>4*DhF=$M zJ*H>5S=|pmKmd_$2lA4W&VR&NZ#Le6Fs~lp>qX?Cgr%6Ie}x*10j86>g|oCn_T;v=*4| zJ#5|uUyaR0o-7W0s=Ru1m=W;iSPw4sxQJY)=CWVLJSq-8OC^tb=&)!vB3|x%N9lYQ%7T5Z4=l4clOc<_V?XrT}90{LL$B z`tSMg7eB-U>wQvR`4zg^RRmPOI`tSqo1|aCZLMm|B6skAxJ7VDW+5UPy`PS_zxN6Q z6*?y>7N{oAyYut*mnQ`xfFqgZmTI_lK(+$3U_uEa?W z#2y#qeR`IF=ukUK%f`AF(a8l|ya>_GJq@k=Cf< zj5DK^a^9I6lQgJIpj$vrp;#}xj?5Xo9eKP5d#-y(X(?j5jBB4bk<6_YHrmpLM7*GL z>vZj7?M;MaoMa4{##^r?@l3dTYo1xt%-8-i zpvj_F=SjhxtJ{V*RbhH$uvdkdC*KOo>M^2?!~FFZfTE$mi6nQq&t<-F$@%1Zxk4L#va_(-x>#zwD$oVAKfwnxgMH(M-E6a1=ZmHD z?jG#|tyeOio<+oJm9o6MdIpGD_2{1X<4L~U9P^*|LJnFoH%J(|Jw&8KSl3&DKNB(A z{(42p;3>A*EXmrGt6f<<)t^CDpXRt4Va=ZeA;?jM(HoshXO_`h{kSzQ zXdvlJa7NLo$y5Ax-V>BjrqmUAT>ixp#3o-|I5uWKZyPn+y@1KWtr!jBK z(qtowSrYm%WR7p!yrLSiP0(ElTIgB_eJF$Aw#Eo?<{$7eWHTC>*@G^X8AEiiw5NJN zs_t7Ih;Fx2tj7+;8D@*t{p;I%#y0JT>jfsgajIvyQ0RPf3HWZZ2nFF3L8_VFHc8?M z_ziTfzJIzT|JYIGITN~Y->Jy&Wt+%)z6|1At?IKdX0_AZ+)LA4o!W{Y^>)dnzobvV zCSAB>>|NAW8S^v>(nLOuq9GCU<3Q+`h=j)pvM2cc`xl`7>eJ%~c=|H^F%(xuuwGevC?fAW zek^i{S8>N7LA0F5uVi;cr<;v*ilL3i*g*>e)% zPL8$)DU6z6$_O5tjQEtavEp4if|lq$Jg-i-KznSba6nxts0EkD@#pgK zhkLm>eqX$R^f%s!iq>$KseX14qje1hwq+fw?*T5UMw4UFTOtANtX+u@SJJ5y2O|G45{Dy3TlwSzdYc@L;jA_~wYG)#aXA==WkGCsa&IdvWZ6ifzI38Z z7Og*xv}xtKI_1f#B}gRXK_N)CDqqHgz@Ks_icB*Z$>zKKAO1Ya?;oC5kv_YL6?^S5 zh8RkWFPi>znfO`EH0{v*Ko^ABLRYAI@?)#ICpwx#IW*VB9N*`09o=_H(GY{AC~TsC_E}K)s0jNhhjLh4Vj*QFF5AWfy{jl_h7~} z{$un%!&STw1NXN5h}=qZN6A!TstwcfkUNj$q4X)fF+35VeT<%PV80zcKlbY$(SW5> zxcZ=Eqz68nP~UqCFrIDFeM7+SycNDD4!P#<1eewfDNTJ8!cJqo;}pBX2eRm(e9J{PuD(`_zr_n!XFa= z@&QA0t#@dnewDhlp^MPXX|AM)BZDV zlP2EyDQF^7BM9z~_jsvY88>3jlq`)*9GdsPX~Vyl9aWFwCaQvi1Sn-=8I2e2j40`xMC zMyw7&Vj(tDD$;)xN~8EQbO|&m8dZ~5$p8j*%-8)6$1htLtlbAGmV!@0RX}7@_B%_z z0gSBvbgPMD&nyZX`W%8+aYvV-fTNCDY<39HnOQxwlh1X`TZya_=8*RaViMM}vECAc z4g%qNGvi8Zj+oGQt@7h4J6u5-+Pt+xDm{@$ri8&esW_srflV$us!)!Y4L007(VMAsh%%iPO?_(YqEH&Y#TOMX1*~QN(8!j z_38(4y}{V*`i>O)+MbsJ*W`v#uT4A1N-DO;o^aLe4H*o^tm2X|4wuuuYT49Bx?m=h z%EB+Rys|!7fq`dG2ufP7z<9O5u4YtyE#joUH=@uc`?*Bo&#*&zbyR&=ek`O$=mJU6 zOI5})d*Jr=-@(4jvWhFB^PmpwXmID@)f<$z*p$S~?7uCtf#_XRKLj5KDAJ*C_A%e? z`rABDmFsBX@&5`{ls*j>!Y+Y?K}h;xw#9spo+PC4mP`_8;peDCp8cKF39xkwzx=`> zYT*@NL2pHw5jwB~P@s3-`8!0y6JsNq40e&h5Yn5#A9CpjRzyp-8^1 zpdi!6X-WM;9`MRd(<=m&|7K=c&`5ckM(o~3^xB~Kx1gO0_^+Y%{LVsHVfg|I{0pa( zR{^on)OGbronD5aC*#A+Sk`BE?CuzULXIcl!|iU++l&8l3zb{JZz4YJv_Dl@XJxtZ zuf7{XAXG)RCb*w2ijvLiA;xj;rv4BR2wT`n3@2eB@sM+_K7rA1VvBQ1Ho~l2Q34({ z10hPc-A;oDa7(+-c>RA6n;0=iG%EX^e^*?oYEHMWgAjhMr-hN-djhNC#9 z^3CjImGZZBZh#M*Y`Ua{I7bgXQ$VHzv7!%kfRa*Ohy~hj{>lIJy%iiX{OgkTl8|OY zVlq2RA5{GF65{(xj>lg2glW7nDI1@LZo4}}^%O7jTe0N$4hwL;1grQH=fRc?_1*MG z5zn`NN=8TH5AHEvQUaCYsfPIPKJBrXd#;rO$@gy&9coKcHrS9}Jlj%N+V)bY;-zjK zfeQd4sr5tw?5+}O8fKV`k$b=So})906Xhmd;jtZlvHbiv3)xs6hXFV|?^{me=(H9zDX9^A2BRBGE0OG~En$wfA0K7R zz~$kack77#6&O$yp;)o{T@na!cfa^LsC`joOy=9Xf-F_bS4b$f+nU6kKlPvt3Sv2U zY_kGQsbgEsDK%4P%E+7T^(xeALscuTYvX9Obcb{JOa;P#;_)$vn0u!DB9fl%Y&rl$ z=$XaWBRG?eMcBW^%S7&HkHbEQi3x>@!Vt{xnKbrgo_O2dkD&{1%`4BUvYU0`px8aj zgWA-F_D{&Y>0(~iR^|ZzmayGPc%h#XRk?#+{O6*5RiZ8BTSc@U=T9iBG})<`8klHcBY<1iG9=*8!$|$RNr0296NJ^1)*2>?Ap8 zqTtsbR0FME=XmC_AMRtEGTE1v##8qP+j29;e5Fz~l1)CYzG*Ae;f{LFQn(`@7+5eO z`_1bVb00&Df($f2@?+pslPmh2**YCAXc@BCov5{ANk&)pUe%vbi4XPJ%YPd%h(HXG z9BX44B&a?+^D`i*zF{dLV%rbzhY&|I&+P$f2YZ{7r`W%T%sswC<(B5!P?LafJ_m}4 zxF!?wyMH}_p;iEpgirEpK=;lm;KvVhhg-h>eW|{`q?0&wD^|2dhh1nZ=ii74cHa^q zi_v1-N5uJyV=`9}vm;}q)j>w0U(zsF&g$UJSzniw7&gqlYz?Cs>Veo|Sv7ZNfE;e|TemmN15TtC z=6dlNNM*NP2UH=!zLV(R3V%>i+&94atAOXXO14@=>BaAX-nngP9$vH(&r0QhZgVAI zB+JP*8>EdquhJW(-On)KLq_R+kRvtp=knY$|BZYZAL6}Q4PUiEF5uf8z6i@LSrmu8 znT%J`AG)__VsPCfTM^XdM9PI4SU_({+(@tU4VC|rK)O%h(u}|c)A8T{g*h@O(JD&y zj`tIoyO$&>LRelNw5k{`)7c1BTI#7+^w%;5*+%@CAWV^n~rzkbHk{h3kRBzbY z=f`}p-raDc?NA>yO#20Tsd$JXHB`-}4I(U~-bjtIlX;!#JOy&ku4kEN zaH|rEJy)JeI~|s>qY!kUu{rDRQ)MPySBhBXM6M<4*>0P{`{Tx3DzXCEbxOGScO^f= zGoYNXJTG{KA@{i#tp~-oU^WhwTg{DWbZdS!{5+u0U22f$N(0z_&JdCV)P&=2K~uFl5lH6 zom7-Od6_zWnM5LdkCr!{H;W|~tPQ%#XgNC;lygYF(Gl0~Trx8pFv1+!JB_EB$PyB< zU^O3ducRv5&O{I7bLV7<%s}#Gp**r=$s>-g{lV(}dztwc9FK>S&rlt^IlT&|gGY>d zbs*->_rjP{@2yB^Bl0(|;b*gX!b&ogW6d#c|o_wxU$~uK9hT zlPm~pLHdcvwl!=prpN_;`aRP<>*B}rS zsh0(7f1^XO-0TdeQYE!ozQ?Bhjj9U@F0-MQ2xk=-SVWiJ%>s2wuU%a3sqk0htq_8m zp($8Jz9w%0T_4>sze5KOv34iX5RTb&Qum%jQTV1&fUux*aqYd6U=X}rNouVYXIkdL ztN>v0u^hlcLZquaiVLWHNeifCu1AP9$F3c6`aZ+)#d^}2`xm$__aWU%r=u}~j}6e} z1sJ=2r!uSgDFoh+3vA6NHA#LE+Q^_aBap#57ZNe0HzMW_pM~p1+93Z(?2Judi=X|Z zAFl73RA$mO3UJ%phUu+HO3~2BNoW0YarSz6j|8sdzq;n;Ry4;|La?opaHx6**=wv1 zoOuJ{H@J=12PL+xYD#STi&!^N(&!2Ub%YvE!xQxhEDX>yl-Ilyn9vJEDq3|vgx#=^ zfMuvP+gt9FjrM~K+<6q8z?+6YP~BbHWk=eq-8xI$I-zS zok9-kz(38bUx^~!W5_^19g^C4H*D@GgySmZnf=xfPhn;DdyqjfA$~weDzlnUc}djR z!6*9zlW+9n`jnO}v{Gmv;|*-Q$r6-D?r#3Ad)OSH`Y-+E>smlnh7q-{&tulQzd+YE zIv1kqv_fnkmpF6i(dqj$qk3JK<*i4!68KEGEqY{xs zK+`%oTVdoVR-Z^wF;H+|EP|MTPh zbaoEkr(>Xf%!2hH%D@fKfBQ1*SN@Op(m~f&`9>k@tcDAtF|6Mx_z?F$*BTTd>&G*l zB>LloJUv{`(BB-_Qd0#?AP+|QR-=7xIf)3neF&A;-XbIm{T+THcS&KULLWVJcatEi z@=_Cp3eOGcts2tc*apk7T28^AH+`~mX&LsQ@MM%BO|SEbqS&A7jmfCOg1b!A2Lv`k zK!*BKH`qX;np)`{T0dXxR*bb8Fq;yqLDj81l+41C1qrn9>;_6bii~x3D??GidCxAY{g?{JB^oGlpUznW{X`(k&SSkc zEw--B4vyiW6ldaC@*2)vg;;GL3Acfa9&;Xa`Wu5{vbXPA-~h1I%SDtA1W8y{5+k6u z_?!u?01BiMu_lf4>jVR&D6T+7e$XA{H&T0$kZ|}IAE*OT0b!^(NdHZB+L>SWsu#4A z5Cn35{u+&Mi$XXq$ArEi(3+VHs5!e9N?)RLlODRU{a*EbCX+=MDb4Z$>0j=Sla)WS0au=$uO23L=CR?+t6rO0YnOI#bc!qO)cfymsv3xhN1` z>iswh$3HJ7Tt{#S%pmSzf3;_MtD`zByTy^f#}X>dfa0BY2MqUG&x@x%-Qkhco|8v0 zDT^mop+}a4Bt*hUm8OpJ(@|OTCq_@J?6W4Z2Y=jA;R1xg;4K4@4Rd)4Yp2hm#%Wcj z#t-(FeV#R*cqMp^Rm=N5%?$duGO5PyQ=V!0W>??DL{#OpkBP|`Z{^^ZiRF28YS1B*M}{QZ^i@RXTD)3ne5=T1oOOB5GAI8@2Ouy(it z;~xbGxjUf^bf=c>fAh`ReXl*ZzlGP6beZgB5+tf9ao+5^#9=eMoIKvdgA}HWnhev# zzTEQOW2L!orXO2crI*w2_*%Scl;OdY&4tc9(~e&dTgI0^D>4?h<9*^s^mr2-Q0lU*n}VKBDP7F68wZjS*eT@ zYb&)Fet)Xw;Y!A4V_faXdx-aZY~$!!e^lziaiKo4avEvmVV8dtv~4lAo~E^P%BO#? zYr6aX0oGrhBVPrU+XnWlj@+9q3@Yl4(uaG;iWBX`3inE@$-R;`PXUpP7xTi)By&j4 z?L39043*2o@`bIc!NSqFC@jh+iqVK=eIK_ya8?wb5BKQzx;=028;7sQ-#E4td-*C- z_D&e}f>-nibnz2NT1$`BVLwH6LgE=N+;mqmQZPE2Z?cr`JcKeT(rux65#?oicZVcjG{dv}T1J z_SrpMfD}Z|^C|SboM#%7o+Ghz;hPD!wJSNV^y~a4c#~aGtHQ6S9j&{FZ;w@&%mm=P zKI_gwA6#|hv*kw#d<7)x8-`O?`6omcC!rheSF1DncQ$oum=@HB(X%1Yhox9-SA`y& z8?KdzcAKc+9c=W7CLZYAwJm$^dF5}+n8m;iGw*QRhcz8HLn0K%zC>kc75<(W$4$A^ z(7DpxeVVNQlfJ&9XPWB0?~KH}$DNiHFfv&&sk1i=aAPeYZRD8CAFi@%DBn4UKD3_S zu&qt)u-(D16NNmt?0Zd&qi9~5iWkaG_~zU|dCLuzcQCZJ zJT*=+G2EZXUC`~0mRCfp)WzH-EWN;{UEDsn9FCHdzpU)FHuSdisRH064__~U(*PJL0cRhGyL;j}jL6CwTT{i5Pd_pGzyWm83t&%@qs;1MO! z$0C7)yqU3K*3n0+qZ1o*tDSg{T)pxGOWi7m%zI}gI5y1NKFK0WG;9lYu@|+M^F6e3 z72bAS6i%s9js|6`Q_6R2(qt|pm#n?Ashcf2g5_d%Mb|4P$#W*(_^+>nnJ)&57WIk~ zt!fE|p=|5no#~I2#kZ5N2JchhHV7gLY4_%LQ2+?RII@Z9@YMcSXQ221weRk^Kv36*zHt@lJut?p>GN`GgNde``q z*R$Hl+~PREttVSWqTNV$8~?K)&(AD5pBH;Gv-^I|qOnCj36>k}!aL2G%CJq=QLCC= zc5Me;Itrwrss1AYuvz`Lq|9ab(Rjyj+x~QlvVI-qo;KC5rXI{bi?ijZjCwV+W)-IE zph-zW>7dSczEOSz z60#Cx8Oh$x2c5OM_>Ai|`yzEm%frqjQBdRDM5_0|ktl*ZOtt!neV@pLFiFpQ&hR#Zua=8?WBt;Pp8zFLZ7HmeGJ+J*jg|z;jF%%Dfk*7u|N)oiRh*Q(FXlHz(40 zU~164bvw90zQm^b17msk+2^r(U*x0*4eI6{QPUm8CyhR%l{&kZ{Mq@Pr=nb?h}1{i z5kpp@4m!1z{qDCc#@5K~3=L^d3?=bn)?nqlSdkZkLr_uZ3cl+uV_tw)Vk& zr*B(-8H#FpP$u0F`*&Q`G4inyb{4x@^jYs#&YkeBhJDH#@7kHX<>zuaz2~uaB=8J8 zxF03>e->8c*mRdTSVFwLF{b2Eze#lFe_@M89wf5pZ3QVq2KiCBua}ObEBMw37 zoHSl6N8Z%qFM_88t@$WxSLW%P!Hx6rpv6{#bY$rZ2=|-m)(FN_L7KxpSkq&llP8{U z3i1~*I-buX4iQd#X-+4j4I@QYh8}8BQO~Y|SYysl|5`OSqf*+lKX*b)cEQ`YF{gDm z({CIm&XY2^vNXP{%FG*qgY6;9W7U zo%%Rx6QgmtYSVd2a^{**LN4S_9R8Dr?zFQ`3c@DW-I4B4%;LY?ZhpdZiTYiUb6DZM$-4Nf-n%!kW^U^ zXhYFM(9f!3$U7h+dX%A06wSGKj2!9wC zV)Ex)v*`B%&z)TeNKm&HvCGbG3!Pw_Bb0EEYl+f3zdZD@z*zv1Tm^65477rCM4Ci{ z6sFH2`+UAVjMuH+mrvsR2C(3^R-ic=?%_cT9sp6EV>8Rd#*NnIPTBcME&v&dP-UM~xH5hlxWqgY1>gdYB5PXZ!F74`is`WB6o*jI=c2E+%goa*qeJNSQ& z|MxGW9w9R{Ok!R<(;!|K1n`Xh?#2Hza5hx1HY3vC{~h>^pAaIdE2!qfj_5y}16Xar zuUB$5yfyK6|KnfZfog;ngfgQp{`O*DuRSm9w;>ss@%{i=c`O!Pl#=sh*{-H3gkK&i z@o5xBXpP^$$K!uS26!j*2D;$MTlL&Xj_Q+)k<{t@HGv>iW9Nia(^wQV(I7-W*{}Ty zm8zrF_H);KZ7F;IE-I$Jh2=v21%yFV+Imbx2P=1#J6>IG)uiaKE8gf5wKIG4 zG}9069ckR(8-;}N+kF3}ThtzLQs940hyS^K8hTU%SZ-M>ED}rvV|iNz_u&PyWs4n! zQ@apu;=@1jRe3Tvjnzgo-Ry>uav{%DO_O%)%wMhv8=GZ0X=2C%B!)S78>0% z`cnPLEKw}kOIl*0IfmqEWeCrz@&q4}Lgh2n{`wP<=i#Lo&dZ>F@@!?zXefn4VPYE! zRz#)EFt{*36rM+$RfYbW339wK!C+tePHrB!beUzp3c{}&0o7Hql(?7dzoz(KA8j!q zgA{b42*FPb;4)sy=9|p;MVmfSFCtoUAXYdww;GG|*j#plGXk$UC|7GY;PYStV&!TL zJL%!ds%I75Av7!-L{H& z&*uznXks+lIC}T-UsArfnl$6(S^CMAI~<5qBsXs*H(y95yfriGNZ6S8ddX?#=zx4@ z`wY>K|DHBC^?fWNR&L&Kce?$;<_0E7N)I=6Wx{T zlF^~|EdoQk$8MO$3d_sdZ7!R03oV>sRYfQwdTM^tqj=uX@BRMQ<0xCp4;A6a>GcY* z!^@_v7d!pL0Yt6xDa-Hqc~;9#Zu(XmAGV_QMDy2^x4H`cY^hBqyswQIrmM4PtZ;1L zcTQ+*PcJx*LGnqj8)=n|fN6zm3*9~)+pDR2^b#My8l)$~#fmk5mys**eHcu4=a8R> zn|M-E;oMShwi2|svO>HgH%2O&P*YXqph08f?OZeDT@>fyH1kff<_$L?nw%um|IG0J z^^RPd*rPxZo=a~d1uHQ?R4dzEed8>#3G+= z6Gd6C8bNnu>Tdl>oF9+zob$_P#`z!z>(b(84?adZf3Wt43yMgK%`u_POt<+I*Hgb4 zRX}7FpM7!DPqaMHA6NH|wI3SoJJVc6kjzY2wsH?NdqN7=#mlaaZe0rbKx=_SyN;ms zp75RdmD2pVI1Kmc2*dd$L8H;j*~P?ZLRyuFkeJ6~+>Z3Z7T&or1`^LDtMIoQJk03) zip2QX9Y*PI-UnMP@S57JQi$wI=MO)S`*LQb`!`L=4$oGee0B<3&-bx-hijBzj78h= z@-MvZHoYci5ltM$Ugn$g58~Rl0;od!dfG7as^C8?&G@u_Bn*~sIUEHZ@3=fY=S|*< zM{2&^RvH@juN=qLc3(a#NKw5qW(cf`D(3URDIcF7d~RBd8WzVc9Bji=%QiM~!`lKM zwsQ6?PPiZP6k7d93O)#O9rKdKgPYJCKTlpskCBW76#4%C1gzl(=?}<%yNM99K=ROj z`SR4c9e!;Y!(`#^_ApLrza(pshcZ;VyZAtsf*D^}vK`HO$JYO{j}e16)c59Q;=&J- z^NXELk>$j7IiE7Q4Xl|GMLoeM=35rF<&irX7Bp1eUJId(?N0sc1BS^+FSyZ^B9|N} zbWMp1(2@$Lw)E!6Ek+eq11LuZo~rDdfZ6^l zH#Vt8$mIM~_%EK7`@zeJGuq7wI+Sl>hN1O%R`e88QljCKCkvzf*T(Na=f*OoiM7@* zMAxZrWQE;Yl;w-Qo~z2TcEBL{)4yEgSxL0Zxl@W*GbMPL*}x@9_1o`Ds-{6Nr} z!%cLFO9LVgdgB+gshBVKw}ZBh>gu(?$h$Q@e?zwj*Z&Za84G!oOT=R#{|)tm*y~Sb z;gI%Y^2S%1Jr`a#=(I;vb%*c0;#ToI#+}A06?hcgd{mjg4x`w)Cf}Nk!|jlzU{ve5 zFEe>IPQub~-n6mw6yg7XAO10~^lk-nNy6;IL(4;jRUV2A-Jo+?6&YWe`~6-``vTuB z(@w&M!8iD{ZmLNCc8elMoupFsMuMe5n{7VhVGPxk{Hh{A4$y3~x=`Bvr0M{-Z@%s! z%yIYg%#Qa-xXci{0h$IIJ!J{lK}No|6nfY>EgI7s0%`O=4z$ z1!4c~FZ#KHj6g`ylRJ$4^N5L?-R)S$>jS%H!D*s;EK=!O;V&v}dOkxDzGG(2b%!A% z+^bVk5eih1LhW#f6vcO8W|K+YdhCt4xkfwD)vOjzg5}o*^xpH{6O^IO9J_U>S}(lIiRugTw<>KK z4j&`%PM8viSjpr`#SZE#GSpLi>O>PPdG&8v_3fog7wj}Om)@njE|lG2|9CFXPj3v; zOVY;8O~n6oqZli3liVhuTYk)qAcE(W?M{f(z8U4&a_cJx6yPd+ng?-rpSes9qhU=J zC{1Z;mbWW*F?0+wX-Ed;Y&-aOvwFYkA~NjD2orNdW1mIg7uSURt(%JvsUtTMFpu{f zZOK%Q;kB;|cryH?!&~a#z*e7C<&$Xq_unp)@?=KKOT=;0Pel;grZ{KXQiUVa+0tcL zjPr^t>xy32>RHV5L2i4d(2KJb#)D5qlkg8``T|N zPW1NPzTGjoX0Y6pZBmxO^Jt(({zx`!ZEN(UMz1{;ddepG5zACIYWvuQbG`+0|0)Ka zJSpjW$p`Dot9EeLH#y`V)Mm`)smVSAn^nvm5fG6W>~i1wR(nI|h!tx)#*cP5bD_6e z>;qJ7@vP8N6M^Zd!`SR;PWar;yvO9`e2B~&n(q@JlG8|-w!RemFldxGs+kx!V{+Mh zLD`qH)pow-yinqR#ngYuAz>_cf-s_gc5mq>@n|pHUBW_367|L}YW-dQ(z6@os$?-K z;44ZI|Kgu`L`nDmuMz(3^I1rOcem?=nT;T-B8RE)K=fwr`hka%Ws%gqEMA;z=T}Gt z`ecN|p)lLBf;>9&xY5Fj7?2`Vm1?Z+_7uGT)o*9F!e=|0$-pyTLs;VXy_JU|etsL% z)Q*E7^Vz~X96wo9r}qQmLR-W{U-2Cs+UG}|ADsEQ^p?6|t~Jds-ERHSG-Y&&T_v&3 z14|6OTaiF>ZWNNT#Q9ZmO!T~S^*RC`DmYpDV;B>J0*}6n)yPmUbsE$Qy~|IW-TME_ zN%~LB2qKQM^=lxsKe)ITf+0xbgFM<;9x4<~~Tq5VP8f*w3YdMt$%%Y=*D_3f-W@x91usGwhOR2X2e(T>*McQ##Ime$y)DEmqdRTq5S(h<&QwT8~V#Z`ESkiUy-W63UG++ih4Q1Kc2@A z;~nVhYW6c3ip)s{fP7x-lya}!=naqlcHtvE!HGWcIenpab5cQE3J^m2vp|mZ1{Sk4M4aq5lj-uJ*-av!I)^ zD4VwQo{5vZH*fHNN_`YorQ8|KOjJ{-z1&?K+5-=8sZhFE zdTecB8E-U!kLuJE1SzyQ%VYW6>}5jM{~VncW6J1UiIRU5z~dDsEb-h0hL^MQzjQ!er`1|4 zGi7IIJ8Rq|(kqEHIq#7l%#>e$l_?CoKYP%qa=L(hxEhT4rkv~Uq$MFJNF*qK>A8@Y z-%js*MUlPZR;i<<@q92^m+sX5LYXT_X!fw$YYs(SmyQ-V*xgIYkwfE+mBVScV zuD6F^^;b~jD9{a(G9)y#YH%Uw2@YA( zwazkz#!y_HH=a&C=4?YC9zgQ;VFA7=kr$sPYf|?l*>{xMTz>Y3Ecm)YxlH~0MHN8J z-RMC%TjUNpy|BxoLi%A=m&I$22@34KsC(1OQ9KxC25z{IA@gu<6d>)a2rpqp{QEig zy5`80iHW%hIm`6u0Fk`t2lMI5Wd?w*Ig}zG*Oq>rUUP!YzrVU8b|E(sL|vrzq&rJ- zwLh+-S?8)Ot*y6E%TR}p!fn4Dr9}%qF23nXOLk`W-!>T2M&m&<=*{$zF5|hS%99ps!f^ zRjIL1TyDPJr@f@C#qGRd=BQ^7Jdv8!{atV->30XI+x9%?nLy;V%jEX(`4}0J_HgT1 zdH7c$kqZ5@n9N)W?{57Ko+KD(WuY$%Q~flyYVv>UOT2;Xr-Ol0{;+se?Odk0-Mr%{ar}T@<$1is9l6gVLb`qz6T_&(L!;7ElkQEeK9a_{x&~Ck z-=x^&SSGVp>2HWP-*tzek67dVnnS~(IVNM%=6#~aU{aG!V9+~$XEe4NgdW%zN0ZC$ zwhr&Mo4rfi=MVD(5Z+^p0dQM_W$wpKMFwIXasb%-W{%}NS83vTT0Kv98P0N5*yX;O z+vB>l_pFo{^{XFHi-Eq6OZ!{j5&}9#iFh6g#cJqM8~|v>)%uiPG=xP(p@vXvC=-^d ztD6j^8Qq2EMKN5)*}4NK*;A@4t% zU3g5%nct$%k9St2yNwsygVm$;SG!sOR(&gyqa;r!b;oLTEw6t$%MaxB<+vp~lhMoZ z_wNm%>YR`~bY-Nosss<>qYC>Qp%mc2M_|m9x5&_f2YBH zSn~OR1%dW(Gu42z)n)ZB%R2-QIk{AJPN`&XD^vv)rH2-V~pf!m# zB>4DFg{-(8cYo3O_}~2T`fzTD!)?&;Rb)=B>L$Ru~bNIG~V6oPvF?JVo(v-R|*+I`-#6>tlr$$~aBbzTo+atfGwjWIZa>p_whGqXd~T|v zPix6?{w&*Vx{Fn&o)uW>JF=SurO(y3WtY=c5;l%WH@g!D&ymT-g9DRWiD16RFZ@MH ztxZSG@)XmjA(YPUbXI%hb#Bln9#14dJt{P&jspWhJYLxcG8;`nyN{`rvqJ2d|puKyY&;{Q7||Nn-@&j^K&Z{=rp zjeBuE_<#=ZsVwIklCs@Aoo~Z+rrX|sI) z%SetE1Wqc;hA*BUc8k*xusn5QE35&$xFWFCtXg0#{(l$+wAXtemtsO6?_0D%igR}& zvaS7P*qb>~>L%mXV#hXH$C%C|9W<+JSEgry*jB!$*$jLC`?;(Ilhaq3{fkPw2fLtYg4?bq+TBP2^gdC^*4g zIWP`Z>EQ?7iFTRZ28D+9wBG!Cba&p@Z|^J*u|t+>R%TKky72pffTfJ}|Fn1AZ%tzg5*OlsLypQG=Txy_-vvPGzPWc*+#K z=MAe;`9V&BW9IT!naI)|d~2$fTUSrDQ|PT)|7uXzl`@7+u+S$*4cl)|SIJmKTvR;g zh?gs1zVZ&19i*Ud6FvQB$GcK(@~>pO^T9y8TbN3E(|LUw_{s$p@}-(}{zC2=?`~}k z1y;877Rk9y5%><$5l1?=T9D`o*t4H^E38plZ;Ts+B}?fWxj3(_45A_a_W#swMYR*P zSx)LowTA<5(Ao@RyI%Z8ezH2Rc&i$dGJtoxo-W|nGZR{q3}`6Gp;P@-*A(D+(gJJ` zUIqQQcb)r?Mqz{ewwr5V!v`HK;|ZZ!VjPokFtQ2x;}>Q)uUgOy8DaT439L&ewN8oiysq zI?Dt>3W4_3gLp%UeIVuh%B0rKyKnWFd1o=e5gAuqW)hrkFcli?`-Lx+anYVP+2X{8 z4d)XUD(&m1IRsG$2G&WbXm71eQMw1a%ByF< zB!74W^DTKllb!-5M@2%{0I0^+f?~O>|~g zN9Y5@KS+ssYNs2g_Z}6R&j3p>5LD@1W;=*aQ9x*8XD&GUH82kTz1_P$diM{wG-`8`E#H zo-WEawH_e>3F1|>_!npxy{x3K+DWt;H}jm%A38_l3OFgL=;t7=q#t#pQ~CK6g9?Mj5^@#A78`3q^};tE@?T4XMEa-3tK3Yr^PcNaKE7G*x>r`r zECb6h2;>qyZ^?$A7dk*trI4kh9H7tq1RKE~{qS|`aL}B@V#F*6;t%7xVFflhFZGNz zRDqofFHITKGkS)iEFV67iU#*u6$Q-)^DSvM-h0eS`R(ZuF8$OAuwpX6rR~?}AZ)V; zQ>Eol_ddG`P!YRIjEr8$VxcZV)NQN3{09A`xt!(b(FlDPDvBOt8-GM?^yEFGK|T#o z!fh72$mwGt#g{%j?8>ukYKG62|F`h^pTapmEF(4@8v`ieEe|=55yxDmRsusr62v~a z7Tok7{=qJ_auK|L#La}i>kDs6HQZc>pa<8FuaFpZv}{U&B=T6 zy=d!W8{C5@f{u3AmrB=hVQU+0rK4V#gbyGOBBF&WF`p~Ql0@SNfx;JDJDw{iKy>=l zwO5Xc_vWr82YhPI{m^qw9yp*mE^`Mx{Vkve<*G^KUx;c2bQY@2|CJ?Xv(Oq<>(S@R z^x-641O9rN)+dZk=~vA?`^|}*?4!>gT__6HB%)*?gw?1|^tqwclb7UnEdmO%?|4cu zV_6u7HWScFibEs+vP^X_VAx$Ezo;Z#df$g?&ABDEgCasA=+4HGVhJ}^ z*JD`=(}nKs*N=B+91!a=$2*&{27fceOE**Mw_XAz?pK4FdLQ#c)6pB4z(J40zWRs* z23HFTdj}-GPO2tHpRVEw<_}%GOTMP!ao$%heZHkI$*y8LMePMtw+uUlzL;YgnB0dT zWM9-f^Kz5=FQP|DSY?D8<2BWXgYnqRJ84r!_bi^;2#vz|SX=Vj$0b^RL7wefnB-!L|KnaIURlF!_cgZ6--X;tpB-ADdOw zwy@|Kjy}7!fgR9O`fMX%Pv87(OhaSgbbaSS_Y=1@9b>bREe2^MmM5b~C0QlhgJ%i% zfCxN&#H|N5c*Pw2+u|oDj2f5Cbf*2i%!H36>i8%_5;lw-gJ;YfwtHm*#vk!;h9)uK1DG<~z-&%yNknkQ2;g0aEv8}9@`0;wNAmbhk|?%I&zioQJS z@H%@#)m6wDB&h^)bxS)ogYJATdd8dT zQUPyz^;Z#SXvo|cB{BBgn)1_l5p7j5R7u0~N9!A* zs?9s}sHtg^w2pOU>ezs2AB}~nu2ekxvn2>DI6P3A;o7=f>B(G&QwaR!-b&9KIeY>8 zL{~b!p4EZvn4iC|c9qni-T3FV*)1p6XKJ^oc?8R?jA`6Y`p2Ffk}O-YEYOWFKB*gY zj-u|zWr~jd2-d9&ZxTtYTKuzi64C9XEshO)ENE6XWKIrdPu5$slA^0h$(p0;Awv=; zbpE-n@sHqRiG!1ulkkohdh1Noqy4g%%UwHAsoxF9Vm+PUM}T4Huay`Eudo`!P(RV$ z9W(nP?Wg0oFIC=|SpkCXKTV&r=m)Za&rX`mwVoqcoJ;)IF2%uh$NzBTA~}S*<8{&! zaFlh7Fut8{N(>9vw`*sfmemy`}jG7-x0i z&0~yDAKe!fbNAh2)Xx97Sl(qJiPK;*{LH0c5ZSmbZ2s~7p}4Z_clm9jRCoEWd72uT zI!RWxsm=^vPk06e*Jjg!HJGZ`BXGN@yOcXoi!*&~KqMR`2tf#oNkn+C9WdWK16ph2 zSNz0FruRaq88bxOTA4Wnxr7j%Ik?6{~#*iFSpwq?kBKTjn*``v?cA;uv>T2vLl0_Of{CxDs z!TbKm*#97`|GI6AG@b|jSYkt=Z7Dm{x__h8gZF^|CZsa;a97kSwzm{?y^PepMIGDu q+->h6Az7eY{r`{I;W!D&t{PEZRx8+OrM2z>A4@ajzbGbmAN(&tNSW{e diff --git a/authbridge/client-registration/images/clients_with_spire.png b/authbridge/client-registration/images/clients_with_spire.png deleted file mode 100644 index cc91e091d2685fe3b4e0f05ef6bd71577b26665f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 145011 zcmeFZWmp_tvo?x`1cD?X5FogPph1H}a0njUgS)#02p-(soq=G3dvJHR;0%M?pr`Zf z_j&jGeLH#f`Eh<8u4|a4d#%;owW?~Zy6Y~2qhL^~`km>`1)t!fmxizDX1_O~ z(RB+jhz^G%U7GS6YOcEWS1y)-xmFp-ZHtmK*%R?)FT$)C#{8c@{CV#ye= zZLrVLzDB)MOeGIVFW8}HBXi*j1O-VMu7xx|{sGT70lB6fCgp`Ny5rhn+gJHV`GnZ7 z%3LyHRppx-b-i_4NAtMLx6j6gMOzSesYh2ciL{W=3p^X?50)Do66GJ>t=9`-`MCDT zU;5o+B)u;fufL%6BG$thpq*6qaI_CcZb*srby#qrHJc)Ei49hzNjQJEw?WXoU6%2} zu|D{?C?+1mMEJt$QJd*IRN?}C2@W_Dv75Y(iFcxp;8-0V3J6`8O@|GhvfQ_2w?2L= zKxl%9sEa`N1${n^#Rg@$4HL;n4(rL!w$E*dA0jbwO-B56U%r7i)Fq!qEpB7@jxyC^ zd%F!q(_@(cmNkUBSK62=9W_T@b?AKPIsw)lc2~$eA#lP^#)Q9N5qu5)9wkRXB=I4) z*De>kNWd)0DEGy#Xc@Vk!7Er$yPnA_uI@+c;ZJ@D>$xO;9JCwc`uH-RXd-|!v_5>d z=bLWJXBt)BQnqRIf%fjtF%|W*&n=Lhh`}%2G2CBp2YCi|uCdxaO+{nC!VQ#ar|$xF zLfdLqW!A235bNZ5h|0riyWLlXjx{~lTaa1_TZz4&d!zFQJqXB=y?Xxo@%>j9-$Xg# zLK4>JGFWBL(w}z+6$`Uu6TFMwr0t_*}}G# zkTP$vn}%boWX`;zP|@zBjjaf(P*w>rm%i?R}1xh}Zh(PkEsVy788BWC)R8S{qAlEBG+B6tf zJr}p*@a|JcF{A-<;vnUSxw|~!cV2qdaUQ=19fOP!OmU22jwb9_&+zB)TV$H9T1I~U z-nII*J(6^2bVAOcuIngw&A#DLnuu(U%J|5**tfH92w?`IjbUzK-QV!K<-0|?>ANwd z#i>5VP{hzvX;G2q2jtsJqe-WHJWP5vlxXy!%F<}b=x_*c>)n?5;KESGyXsf3Md5RT zkK24duNg*}%A4DEJ~!^G{#di9=Q@Q7wyS)uuB4$=5dca9iA-~s-WYv0ZWzWMDNS=- z2(aj^?5i-X+^wCeMz5f+w5;{y9B@#+EtRfnF!rpmuav41~;~uknjR z9Lbtr3n1?rTe0=m4_q&qo328xavpA37q(A^RCgB*?1ol_R!!E=x%PHVQnu%HZ?Y?< z;dN{FG_8g>p4)1zxecD@q*Q5u7f5UQmn;_*mk5?JhV%xX4bE{Jw{_0?K`Iu64kRu= z9^H;99vE(Pofn_G?OXmFx?JAAi#6<%)Pou~pH-YjT~}W>88=oWRLH`}THssqTAIDg zyyU%5U ziVUB8S>#&SDyWIr@EK+3UWjtA_NyhVJHBp?d>&CEZdxa`{mu7j@8vbcc=-6ZymW4N z5L%HnaGx?bsH;{UO_OzJH;LflLg-{PJUoK?pC3ebKAHWR__h1%$fBGTy)$c6jB3pL z4*gT`vG!3jOyf!j0aLJk)ihd6!F9aKAYx;vPv`@qp1+Oi4;-an?L4IXeM#30{ABfn zYkGPr5M^3qdZgE@m0HPk*@b!jxg=rx`d`xVP2VRk5|zC8LElN_r2>)0ImDS)0KF zjmn9oZ?xalG3y%My&W%}RBFYUdl`q@tVLMWP^H@HVtCx<48Ot__a;GH%BtK}rwZae zc$t0ZKEqYE)N)}?(|V?mq@^Y@x9!;EnBevOA?qa28WJ;oX=Stg-JaYk$7LNPt(~$r zP_&7>iI}o&Wwr2OMWJC6I!&p;s61FUTN73-4VKo%Q<$q*a=7V+W|VwY;wbSf)-XFW zo1Si3X+HRP^Wcu^xoy}wflQTpzk;jq$M%S!OAMqr=nYMZp&q={$1}}L9 zxnFs1c}uhQrRa_H(!!i|qiClnakG>+$3@GT-$mec#9+iy#%DfW!hySQ51O#96RGW) z)pE?1JntK-HOcxH3UGpiGLi_Zj)ZWr??2IMB7dpYRZx+A#R}8W^=|d1)RV9q1rQzNJ$B*IQ15M$OfFpR|gAaV*;1Ht&;81|? z=fFoe6XEZxkAyQ3|2{^T{nb!VQAk1p_*T@nGc>faH?ej=g(9v3L(Q0eQgu+3{>Y_o zZONc#VEx&U!Nt<%R~I-Q7cSt?($GPV#KqFW%AU)Gm+Y?=T)^?K(~M*!e>HJ1=Ot5> zmLn0ewlgGQXJBGrBI83PAtB+hGce*(5ElJcci=BxG7|>}8!kphXJ=;yXBGx)J7dOo zoSdADOw5eT%=ADDdV5zZ2R#>hD|_<)8szVBgbnTW?M!VPOs%a*evPa5+1k;8myGP! zjsE@fU(adiV*1~Ava5Fqjz}oB*7Ju;3>b`2D3PUu32pdX5jjRT!bo zp{Z3VQ52adDM*CisOMtSK=*J-B?;*7PMe^iKVidlHP#A`OrI5O?ygl6hxNW7Tumt|_%kH~?2L>O94EjH` z!LmU>622lK`2vUV`1ijA!f{DRqSqPUQ3w684cxCmp8mf7U!DH{LH?(7|G$!nc<-@s z?-Q~=&7eVpzr4r>DyUl*JB89wCgTCmp+&Eg5`H+{i z7IT$`?AFUoo^N>VoheD8>(gTc{xI#YnGsNmpWR2o%WMZ99Ik%yM}4^;Kw$M<8KkZj z{G3t&v{|fFVzJR1#qO{pr_tnMTkKlpMlNJzSi`hQ{->uUi9|%&n<=*@_Bis9PGKM7 za@tQcViGPW{n97Rv9xi4$7U8gRibkEMFI7pzD=x4CR|`uI3$0*~_DyRk4Du>JOMsY9R595O04lczW{cTu1?piLH2#Y#z9ted2N zR-BIlme;@3CXYJt_^|b1zIMgKJcYyB$#A1Drsrg1NZ)+A)b@~8sn`Gzn2fSlDMxaK z!DOMl)4XZHTsR^3XT!c&M>Qg>`s=+CXv@vPKy3f@2O_U4J$KkQJdseGdb{x#*hT6!#k;e+ z(4=T1WPO9)lP}`RgFf=#b=zMR*sUtRWYk{#JY}laCwbxCwI2NzY?(t}x)_ft!<{n*6o=jjOl3NNKj zjwrhG=hoYkQ0dh7W72%h9*4X?QIk{Yu zvFv=Ov+C$@Ub~H6@p{wEk)4Y{yq>plIaZ5x@8Ur2wWfeRxYz3A?B`{*z5P`9U96A$ zr`_DhO9&-s1>99SOk*@fFx$^8CU#;)=Tb*+KDxLcgzEI8pMU9^6MYyA^$!s_xk5%3 zw%Z(M9n#ZE&<&x9SU}|;12+LLHPG8rP& zX$Xtumff?Q3B_f+P*e1rssJ2Eidnkn+$-Ec_X=|zRB`i_RKCF87+F43bbMBur^!5` z68fp9jaXK>SuTz!vW~i#7RiL;2&Gi!ktIN&s^Kd=+~_f%QsD{*LW?EypP(hK?rF2`a@O zGV2YF`?F)iToAg(tz>gDH6`##A>ESh)TTtI&u;U@7?z3W^;z&>QucZ6lG6f_kXupN z-SxTsxx9m%PNa6TTmAY@^PXaX4511x|6*eQcxAw2_sb<`=yry8_#~vP@xV@y6gj}_ z;m+9|TC>q?Nrsn$6V83`o*T9iqs2&c4nCGh#~+Y+cA?{aH&q@EE4DXXY4QBwywu=m z^|3KA$uAD@@im>8{EL>;t`P(r3~I`8Gfl4c#yN&s>lt3xefPI4G)(byEWg!IyV5W7 zD`&z@L^#R|vq8_u_oq~JYWVN3I@79%_L~nHAf>?Q`Cw2Ii}CzR6-~W`T5JAQswwm7 z3Sb$Gr978&&+!%7W2>s&^+jX&4mjN;e3)TMjG~cN=viJtjH4MH?|P^8$&-C3xYQM!{}TZlmuw0i z?G(iFD%*SU8bJgz6iJBgkfE_b_&}F0D%V6UheRw!y3u0%S~nmHYU^~O$GxBO1BsxD zwpAyGhB zUVqp%$`9Vji3u-QjcAb7^1eG~P|bSc5z87Z8$~9vXy-=tea6NTwc)DiEqAKJYfJN~ z;<&q`PE2t0hdEzk+cFP21IZpH5L2u+{`ok z1}ErVli5s}<%;)%r_5G=ti58RrJFA)SK@rAXaCE=n6&gx%%d6?TD0?iuf!>-ym9R%Sf#G-vk79g#zb$ zQy{~Ecq@ZMnKZ6?-JtoZbeEq`ZmuEamH@11RqwDn&hC7m*?4!ckoMJ$x9~13wm|?g z4T6qKF;c#Y=2A2;U+)ehA26lAy7;`gaITZ$q<-^t!E2&FC8{A;N!i6c{u1j6F&#C1 ziHcxp$}sN0%qbjs$wViZ&+FrY7)#W-9;`6ii4c_xU~e5TA1^VrPS5&hw8$$4dNXDkQW zfyP)J%Gfgd2p!+SL;$*})^9zYE8$*$nN_P{hWSOzyfDnZ?`NjIK%~>%3?~Vf>{YYq z#1j0_anIR(0`-gS(#@Su6`w^WY}EKn-@iq+?ufbV-2)a^Tl=^-;#s*Tvix^vya;5d z$-)cQw;`Wo5}Dee#P@lOwV2gcj12)xDiEL=XKVUZ@ zknt56_xd8E?E?nOGNfNZ5=8VJ zG{yVryzULIK2zF-XJcZ-^;|o8M~X6>UA&`BHftYnzl^7LCndR^?da7m+DR3Q@SRU8 zUI3oBAlca4>eDKHa}lr`W8dE9EDKY#tZ5ly$-85N3W+L+?nOu0Rq>EybF$;Jja%R) zB}|%tx~~x9Sc~df63r-7zI>3t_1L*>9b~6C-zikcDjkZDN^WZu8YRut^bP0;v3EU( zKW;`pOa4wfc8#-SxTJ!7s)#f@I;~z5ud*)p&|hE#n54<>C1u}wSv_Bh zJ+Jb*b4w7>pW1Df-RsKc=L<0@z6{-ZHiphUKbX=1RqAC{TT-ca6h-5-XNgA#ftGzFp4a)#xyqz{=tGnJTNwpeHwI@yfCC);i9n2g^OLz1+H;T1`_ z4SZ?=0xN@DW)vZ9>0%H;lxz#B$9cTvMeja;jPmw~{wdl$?lCF?sWUdFs5}~e`*{vY z$i-OYiVAnlVCzJ~_7f_N6&&kU>+mY7dcQ(-EPlK?u3EO>6^ovY72eyJ3&l(!Lw|zh z&H;`khZyrhmCi=|ea9+SKq?+JiXKYjtyI=0@JLfEsgpV6n$|1O{ckM8HggVs@>oBp zk$G<;71rKl_R9&glS}9@6Mq>GW5~-TNVAC5DQ|$~#T$*JL&-Y&$%XFT9mmkoD9|B- zW=hD0Uobi)wfezKiz|QB+&*N0I-`!oE0oFJlO(~@*kZrjDRxa1(#eIs$<6>j* z-YX10C(4TTLF~Qhdk!4_RT(-K7Q8pWv-%xpm|f{q14TJ!6}?HMxB$) zATFH3JJxHK^yzoZ>Iv2TrwhMK_8s7uO(NG`T)h0|r6km_mHJ+;NH&8nisY-6YH@@Y z5zJJADO_X4bO^+)C&UKHz!ISGV>fQrX+4knsyjX>RQYe zXHd9PwY^}56S?cxHV~Ie^5Z5U zN{&&a~JHODh;FHcs=&n9V8GYo$>b*a=x zJ;dILTjfgS$ZT6TxfkWJZeKo?C=VH;UA{fOG3-&{74STtQfVad-z&%rnD1uYXo<#j zJA=%OG+(x|URpVzmZvZqhM12mHaMD7q|ApI7RYNUNRDBun>*ko6+@Xdl_hVC4LnOT zdv9Tt=5J;h~RDh;dlbh7^F)gsv5%E1Q<=W{% zA&sS0Mr_*Jki-2BU`ut(ovj{P9!YDKyK2g5lOX9Bfg(B`ViA*0n%A+%Jx{G=&F2nt z)?u5fH&>R|*))Yw$_kOxsUB@&Ld~$YPz0XjSS^X38RFOIK9uGnw2p|FvciW06ZieZ zGQ}Bg>B2W(PrrZr8=3eIfGYA7nN=qUfy_+BebonrjJouKyhfB(KK!iPo8$(lGETx?L%Y%vJVHzYcwp?Y`0Kx3stbMU;;9E+| zw!??SxN?I~jxIH52e+lqW~E@t$t-7mt!mbTFU~ddUceS2`MoBX@}SbnUYVj9Jz!Yf zR<&<+fuJdD!SE7CaxW^2vC7K#`sa=qI;`bbhr9SAGNHp$wjZ>g@zXVL8z5!&FY?92 zi0`C7l)shL-|{E8tXVFIwZclq6pG%Famm~hY? zcC0*}of6?~qJM+a9w(dSJZmdj`S0+ez{D@2D)sl*5RfBe+KT8YKY!4x$wx1jF!C>Q ze{B(K-2KIj`pPWKawdA20r;zB$z?q($_(gG9%abOx>%;g-3Z%Cf%Z{nd@Ef^(MFC+ ztD5tj7Z~9_LpH;=o6DQqeir^3$ngHkCAQzd7kN^VG8A8CiE+**IK1H z?v8h{!Z&5Kepqn7Jb+TsqpE0gD6g25pYK`Ww9xpU=7UQQj8KEF8br30K9##1|2zmS zw`>^mx3(LDu|31;$8@gc2c=Q@z)-dT;w0*)tUtx@;w>WgFx_~4d zy=@F~h_z^m2ZNNt1LhPWJDuwl>x)Y?Ys&X>`^p`Jjv-27(p0(cUP%0QR?^!#{L!Gm ze%-NCl=tEGbh^dUed6ny8UKlpzU#|#Y`ph2neHX^jFo2Mq~1+~E?TW#&E|~UcV`pO zA1`Dbc!jO%H*sciba%(|4zQB#1P9D|K4~Ov5dsKVg{fCmYOFE{b>6$mRUsnpEFXy8 z=9*kjH3=NuF60|4h(0o^G4DK%49^`AQO?bszA1eJYh|8#1EPj>%1#^(tWCZLJ+b%b zd}xWSsl72v<(5`I=&3*5Ox2{QO{=#I^lTy3UBWSDJF%#$KX%=Rrol=@ej1e|)6%G} zokBDx>mDw_X%`*04^*R^O+la##@JZO-W7(G_{<6~4T_*l^tCTv4ue+*VypTInGJ$c zPP4@#h^)rRMD*h(AFtGytGENm@f`z$cO8nqRozW=$2nR;&hZuN(>PybNqjrW&LVUI zcDgxOkxD4pI%@h(Xm;?Nr{sv^!^MKN7A`&V8wZBub)lZA>z&-4Mg+qCf=W-DYyifO z(iL^%Yn<0<7VhYY^qU@Vnl4p47{zyzih1ms!{xX)+aE`(2yK6^WxV{`-TiAH6k?B2 z-qaGf-d{mh7{{^=)YZ&JSz#d_fzqr;L8Bx+)qB692Lm6jCIwL##ei8de z%4V|=gtW#0L`4!|OhU-o=bAD9n3bM##RZMhjTy08O0$Qv_-7@HsVxkPLNs~yQ-#82 zkf$Tt(F)5)ZbJk)cdRQxZsrxp`T(jf*fl$1oTpXTV74>(pI`)di@fGSf$g&MkKZ{LoNC zNX#;k3V$7%3A1CBU|@NbzB81Qrmkgl&vkV|!@7CX>N$Y^*la=q$a3&ljOyrs$hn$2 z-KFE4YD`*ye{bz4wb}SkHQa=*&qa~X*aeCr;jNne40|Apghg(=qp>D{9Qsmm@inpwC zcsbJlKa43~a?L zllR}G-d14mp9ZY3~J)pIND)&P%lAw<^@G3cuspE^r`}huWG6t7vFQN?3ZE5f2V` zO6GmKL~Q0GpCPMhDE2%{wI2>n60vOIzdaJF1n(x|O{f;RW=xgs6{rLa-ve&dKn*jC z?vV5+fq#yyna*+nQVpY_k%NvSih@8EkQ3{3qE9zZSdw#SL|1!(#OBnkk(8!kDgS{l zB|34SWie_*W~7--jY)5-VJJ#hd@QGbZvMfSwC2RBsv($QijYDLM$;^>-{gz8HcMn)k8~ zY$~F=(Iyv30pIQ1^GO>S8+-Rc0-iAAj8gF~?vu4hyAsC~wmLOP#r=;&%aqUUK);Swv0FKKZTBP3Q)CYZDGlk&xv zkP(IE%%g8kX%e!Y9^_tbCq{L?i<+W5A4^FQ6){CYD_tJalQ3W1q3pi(F@?7Q+=7s7V=Nod9$Qju6sxKzVPG@$v z8zrF>u^jT_U%}srxtfri2=x$kcJOrPjhWi|agmB&|9Q{JO|b{1w-qW^VHCgec%YJy z(r##!I+oy#S+xC~$ujzR@#w7WUVGO18?0Ja0y0LHK<SJv2PaL6SJ~+GzFF1b8cajJ717bYr0os(ihQ%=udekaz`zo#2C>_bF0reepqqEe}Bq>ej z5v6r9O%YiMeNS#YCFALK^My^8o9a`xNa8*-8@}KbX7+zqgc8VL;qVr0Rz!mpt-vG< z3oY0D3GP7+FuBPV2|fGpXTE@L>tholBjmUFvKi_7F3HARJh#hI=k6s zJStjJQqsy+9I*AuL4VW3{mrG+2$uKJM$M7A>k_RGu<$1~Tx|>_unJFWzkEI~ArGdM zivK$O{m%rSw)>Z_fYi)TGTQ({^O*uI5E%qurgJ-6;UbNN55&_~*{*lbVe;QbuGw8U zq9BmnynQvlg2Dt4KycI>FGH_&-zfY8S7}uM^&`ObII|y@pjOKf4ciA6AsJ`KNg)Fu z4SNBkuY{@0WiN-55~C!hSe{Mb)^I#yZneHr(l0W#V0-=t?T=hSI%v7P-&f8PYT%3D zKNW~oW|RRL-Q zGL&mn8;{>W6n`sSuN^#<(umz>j6d=cfD0(?1D{=3_6GBlN%U%rUPzp#h< zhr7KW1&CG{XD?T;eiw}V>s;g}(5Nys5%E7l`2YLq+I(yY zi}|(r+P350WljF| zOe6z9BLmKND8CWlzaJZsUO-?&KnFfN;x}N%-;z*c0K(aUV9tMN^7yq0{QoNrKp<0- z8HE4){=b>yRRJ`Bt~9FhW&L*n$-m}FARdhZn@)jl0JG!QSU#~xIKwF^<5bgs>XSqz zfEo2MCzs?OG^V%gmoh-&vb6s}^pU1OBj&JZ-+y=ol15Z4tiCdp0JlF=aJ~rSKLHxC zN}~SR55oEEzXc@UsExPh{|~YU-c5jF;tkE?-$?Usb*wBA_}~Om4KGsBOzlG9XEP%< zA6n2fjWe4Bdx&6ggvx&Z@!CFG&6&(raO}F`2O-#S315TN8SHs>LBQ^O@lk5AX5b_L zKRDKLte}!ld0h1UrXq;i+(kG zlLWtiMGP`P`P6JGe*XLkQteZ4Qd#MN_7<~&OwwIwW4UP_MgEw zc&gBF6Jx+Ia68PI_X9IbF3`euPm5e}u3vSUIf3`d?*{tooR2C(HA#=c+<@aAo}I#Zs0PRMYz+zarZd# zCGDrtknN$G1j-5xQDg&pdt+ivL@l&G`F+5^^#IA~g?Xw@Bkd)#Y#eolK6^Tc($l=8 zB=~F&g1@64`DZfMY^L?n@DEV5o(RSmL$k^Lz*WE+GGiqZz$Afs$Ptx5rzHVWUv5nS@vXTDTf>x333mLKYFr%$j>F#~y|>5y1DOMkn9)@S!C=qdXv=LCxMmvXaLBlF%+P=$`s ze9<28dOOMg@PbDO0L2Yvc<~W3(OAHr?(VtU)ec^*)!FwwO`+DvP_r&G_XgFpY(#&g zDH|9{E0tL9E{dOO8j6eOS4pKr;>A{w3Jz|xn03#X4+dFP;2YP};v4I1$D>4C^;Xk! zQzBbjh$T0!V!GR`LXw=`XaO^&_2M7qN}Hse(O}cu!=p_67&RbuI=5oUaip2uXkRSq z9Od*w9)1l-_rrWe9z*k^`K$7lS`_Qnc^Qz-!pY{4{>nX5&w+=__dD1O|MU&Gq!PK4 z_E6?~u%gjCZNy3%{a(zNc^Up229>8t@PM?NPn`h)v%;dxjA;{XDsw%KXco{MkO>86%x) zA7$7R>v%HdLZHr6XaU%7KlO@wAEgha+*I9N3|P3E|A53tMy>`-jNhQX3=eq?n{9B^ zYMGGb9|A!Z3Tp4p)}Ly;w=Nq>hc!Dk*GN%VyQ~#ESz2~GuQYh@4_^%*w48?bZUMxa z*(1Gj(SFz#gb^AtupkT$#4T1X`dsCeXeAW*6t$c^R94)+t`v9Wx_7?DESc`rPqZS{ zve-C=sL3xY2jOBC9WyMqR5y1ct^0Lo-1Ve2*oC7u8lC*Ni}*lt+3Eo1ebJc;bMgv2 zVBZ*uC_TZOnI|CjSi4YSj9^(eTCD;#2ruDVLMGLm@qy+Ye!CZ!gAguOP#Uh9&7}IE?l^3R;_0ZqNh!USrVDS?e>W%?y1wY0{?h8`xhb$%j!faF#C;ON~((~0rZ%{O{<=5m(GY8hAXu@X1IDa5aK!jH#uoYiY(5;S6B!fQqX zc+D;yEC`E2bw=+aF!4;CwN~b-T8_Vh(5M1iH?~kf!WCrf_i=&HfPvwv#%uIoBqxl4 zjFE7@%IapEr|svv-^KPLHfjCfhI?A-dQ13Qb#NJK#{6z(^#$*UT&=#=98RxXFDD0qdkYbGb0$1XyfCZ;v%`I)Ne&kK2ht+Y%r$t31H z%YkVS*mRw$wngCnHj3GNrq~n+e61-8pUiFK;dD5K9^Um zFP4pL8|jeuA&cvl$GQU2m7P`DQDksTb^uL7)sT(g?JM~90SS7{&xpuustknK2{kQ=5ZtKemf>cr_*xFejE1eLK-Vk zj;j`i40btwu2W!8?)}i*Z`E-8h*l%NbSRZ=V7gQb0;V+?&pj@(x+*o`7H(Dpd(=;% z`o3HH)Vh2Owp!w`Sjz@pkUw zTT@>KqcszfnuPn+Fl2vUF?^)A%suTgv0qFLw3^E23XMuMbZ|ct;buz|zaKI_a2BK= ziW)Bx8^_Xm=RDgJr{Q$K{Lh;P-PS?UpO{XjDFe_28by%oVY-uN;6=N~YkLa-qqtb^ ztpzzj)#Ev=wHwzj%BC+u2JRRxx`Q~RV~U7vg`c?J2E#|4XL!FGD|-^qtiVYriCtS( z>ri2GhBN;Ffo(Qq-NUS&U0Ax|9cG{t$qp@+*9}RboQgDe@xls27A5miu4`t}qFc@9%Fl15zvL(G=D%ztqkmA-TF@}p` z?^CK;(=F=V@ zcN^fO)8U&*(Klz(8Mx4WQ(8SW|`^G!Jvy4f0v(IxP+ zpG!*I8FoE6<1~F)FT3DK?;!mTl?X0AclcOif(zP?VbZsD(RYW-R!)jN1f`}`r%Oyq z#4QhHcg*hj8Y&GAraJrttS;iCg&8{t)TsGale=3Q`vVd>YPF4rm4_{97PSt$`v`RX zB^x?ZFE(Lhc5GJhF7vBuFiNjkjXR8_$Et~d$j}Qu&^JcZAYKla1J@8;K%#z=~rUo)ez5L2Jq=TR4(I$ikIw{wvEAq~GwK_WC1qG&_$9)h9f z3a-bJ*k}kiV?O@XPAb;naV690!JTLt4sB#Lo*a)l!@H0lXe0R#iRPw3D<;Vg!uG`m zO6pZ?JA{>IvJf|ze^jQbGGVA4il2Cs< zy*{u*wX=6BED)EZ;cdr)rT`%80+0!8R{8bEDV zXJqUP%2(OU*hn&@*9b*OqxsqrD7m1@Zm*rMh&Yl}ChRq3x_8?;>MUI?;K>JiFh{%g?3-6-5h z!-_+s(s@ZJCQRWgW%7~Jl16vDm|&1 zS>E7-rvX>$mP=M9#w99c;_Nz-GJJ=rHdarQ;$D=IZU2p9{U3WGfeYN;X)CwYq`vZvG7Wag9Z)D%?17p_K*O;r+9TQU&~6|D}|v z$>DPi05JegP8dGNhGrjRFheWU{990HLH=6x3`-q?bMT!ndap3RlUI6160J91)P!#yIwFB7L zhHkUn??E9SKPdpR!6<`>SUwW~3J~KNb*x@c%T)g=Z~^p5kZ6sv1ljt#yI`qQ}9nn*lorGIqm$Z1b^fe+}mq&r4vJy+YLIO@cFBre%(d zhEx3&$qI_nk)i*)`cwmJc()*fLx>O*OMv7BGEjGF0n{T^7!4)QQD=BmiZKZXUIUEF zeb{zJ?Jss1m2`6K-WX5^fIrs)P=0z(?zOKD8V~n@G<7Xd_Lbzz`v+iYR`E+u&?T!L zI>O@(0eEy%pqP+0<(%Y>JfcBMh^P!dZIp*>JGdUHPe`swemF&{q>0QzsY%PXWt zc)TCe*5-p4gDeCPJ184hebJ)hT!+|Z65XO44wsjJY@89LWbF5R=@hDg7hW;^-d+$O zFXZxa;Qui3e``>r^e-rU0!^p}5Z)=0*F9|8z$X+}$HO*4H;6yk_jR(4u#g;~{op(0 ztPjYorV%r(_tyiW;jee6&4WPt5xneb=|6r5|Em9h0yJk<^m3&-8@&>xl6WnT<1Q1|aH5fgr^|J$RWxn=O}!#^ z8~`4~ETFL#Kq+N}1!{s)y`7=PcU?h)6dcx~#&Ll6VO@}F7owreIkpRw7+ll z(s2G7s5essDgepbvCf(0>%0_!e<<-^{|i9&8~?*COQj4vDzZqiN_k6&KkU6_R94;EHY|uDT>?rs(x4z+f^;a--AH#gNGK)UAky94NOw0}r1V91eUtsX z_r34E_r2fe@Au;!V~yb&<65}ZnrqH;o^c$LZx?6v}1j@J9g`&25K^*V#aMu1%?2UT*W zqeZ4KkKX{||Oxd1@!S>BEQlf$QfYkth= zK^X;Kiy#k-a6I{kW{=zMBqCpUv??NA7k!yl76}A+hVgWvMqxS02M)5iZI+qoY(?&l z%4?4srwwMyMV|9T+`H}k;sh!mPe6#erTtq@6MDBb*d}e}Dc8RMW2E{6WXZxi@4O$w z*AbBca8K}H%A2|JmEv|J{wWOezf7BtUg8tBD+=pL;BN6=K6qf}1r_WpHrC^d(6X?wlnpW!Xf-ba zD4@PZon0v)Q%nPt=53Z;qsi+NOiGEGhTH4&>VqV*rbkc6!A7+MG2Gq(dDF93vO<0g z8g;BQS6{xs{R5;4j2wW=0uZ@={NL}NHVKb-g>7cB*WJLgWC>iK?U}cIK{x|cyqZ10 z-39+vyfvSl4i_adrc)}acwh}`V&T6vvvMA{)&1QcZvlH0=hvy6E8zQkx8?!OHF-S9 zJp`@YAmZLBD5v+ly8+md<{1DWQWseBMdK?0Waai(lzRDYk3?LJ#h4qJRLU|EnKA+C z-l6pgZjJcFe*He5=}cKBcNXmHgyGujP@;7e zpsNQ6_3PVn$b!{JJT5xA(cc4!=0F4?2CQ-1C^4Fn@Rwbar7`p>x<0aS8<+2NyT?Wk4qK-|jbMji7RF=J_>;1eQ~6NdR8hri#(%Z{5g8u$o}l8sPqW zE)INKJ>WB}O-uHD{qO$2mlrToE0j*}|0uKmrz!O&paW*5OH)u>xn4eK3nRU6$r66f-vP;B~tj-tMr zH^6?5f<#l{)MMTPkbI&cQ@8T4jopZfl$BvY!|%7KD@}hW^St`Ycyg@4VPavS)!P34 zQl2W{`|SyXthag(?b*)gK+odwKTSHxHKM+=K!#q|&K}4?&yGF5>XH`|6Dxs{<@tS7 z(U9}LpQk_y^OaIna8D4}dt8|gfU7eXKwsjrod2t@_}C!C!y{ zy$5D&Sc4Ji4xD0<`qu77fBY(HS@Z7sly#X5<9ftB@C@~{Xg21X)ymSHPc|&?zgboI zzF+!AS5%^;<$mg=;OOb@cs6A{igXDm!Vkcm0>B}z0h_hQ)VeO&aPDSVMZa{(waRQ&!gw>nzi|6eiM#>x!|5A2Z?+{iy zW`^_sY=s3VlIRxT92bDt<3XZf7C0N0>7rp(fIHarz`Uv7&dYz034so~XaKdD47@PD zs~q4dav$-Pb9$i-r<>Qt{cL7GlA7H+zK&1!d<|^k;LQ1kRC(p%94cyfqnrh5LMl33rKvquc(M2RjNxxR=1YtFu^4Nf1Imubm80 zjVNl+|7YwB;;`$?`c`0?3V|TcWVVv5sk8WwKH?M{O1LBtH3$XyzZsXshh$1TN@78MnT zEX5NN2C4J?jTF~GTE&96b)ypgFzg-uv#DDXPeSTR&Mc$kI~h74B4HlG?Fc>DeMba$ zCZlaM`uJtNrdiy|oz{SsrS#K&wmBSR2#(QYy#c4|MP#$tPG|qUWyf>6)~A13KW}%; zX(pI(!q!N;biNnnu@xr9qJ+*FNM1RUQYV!e zw_#F#OHA2Kxf!T-aIC&I13m#Gq<}bU4v5cHsj`{QeiS9#N}2qWazi(mk;ro7OL%|_I7r4sR3_XI)s6St?W6ICXeU~f?(>>e=K*@ zPSfuS_MJTW`ZVm>NV~=RgLhmqE=93K62qRj*(Z)%yawOlz5CJQF6LagS92Fyzhe;Q zPp_kVgXgE*?V_xAB{1wPef9WH50qpFZl%0vbB&UJ`kWLuYIDx$eE5xq1ytYj$-)x< z^-Yj|e6{5q)Q9wqj}8X(R?G3)W>m>RW~{t$hk;%62lu7o9>t4T}eLoYt>kV zBUzld=7jZ?1J6?Xa}t*Nhj(2>cb$of)fR-VD z#k1ldEb+9%W{_)N2f2$lcb+q$e7BR4v&HN5dD%<}Z1desH1!rzIpxpG2TMK2Acs(= zJ%DwaS|LijZ@ER2ZN@Ab2rGivIS*NdVgE9OGNpxUo5MmV^Hh3>udnICCITtpb6lt^ zwC_zL|Yw?3*c@P*D&z}MOWi1g+uj`CKY^^yk2c?OYO*7H?W!Mdu zH^)N@RhwEMlCA>Tfsvx7E0fs!2gMUyO{Z2n;txls7XWX$8zISP-FU*9`X!>%e~RNG zFEKQ2`Inr8NuZp-7SN=qOb~pedg>06A{v(-sShsoaGH?DLi7fZ->%9|ap`>ko0i87 zDxoHXb!4-dpkAw>TolTybX#u;b zo@WHJ6uh0YN9jT zm8OZ4=Q93b{C73=s7EpNyp~`02jEy(pDMQ*9PBaTxqh$&&uVglli}bdSi>^am=C)j}D2@Ta z^P(E6@QZuv4VH}Yf+s75T)}=wXtrr)#=cKXs?*9>s}T!MUI*g|wn9B1OT;*_@1dG? zr@A`;`Kk;dT!4U>yRN%Y45D(+J796%v56Ejd+Pw?+@M^JJCg&v73ro$smelGTTPim zzI^Fdd|P~RvyithdtN6|!QD#}+(~7hsGMA9*n5tjtJzOMo-Sy)o^G!@0;X!Q+jaGX z%K?Ioh=)k!hVlyO1_(tb- zz%y`L;i8jLc;PtIj1ul6r+l$8<+&FO(@b%S{FNPlCN~es|CMWH#AU$%0*^o>EMfj1 zageteHTuoQJdh5VVF6ZDV?XFYj!0GA$(v?#ct4!im7o6hSk~0(D0i~9ukdWJ+p(~( zu)4OhI!H}3s-R5Eop%P>P@jlGe3-@7d_Xq!Y7$gk!+E5K%q^6v>Ss0a-_E-PL4Rr%?@^{M)t7Iv2WZ%jjet^yqPXvDS@qazTf=z z;64S(hctDX&~ZVpa)-$B`1g?G+@+s@4AzJAbUcX!R^u|I>@3drlk$!cvTjV9q`t^!qg@pkK|G;Tc9j zfwCG&P5tnq(<;gsAZA@SuSYAX>t*zzUu7;bm~4(ZH-Z4z!pwdk{2>Ps+cza72*Y-j zw=C_g!lrBzSdt#f)jLrLkld4LLh$S(ZaEj-xIwPm*fS}0u9+g&dHNm*kwb4Pfuplm5P3CVRcLKJEEuM*ztep>yF7{K8 zZa|(|Brn@`GVZKS#Ior!E7|#X{A9K)adm+dBC8!x;X;{s&=IQ>0FV<8Q`?QFvN0l= zCol3tujq3~75yFOtpiYq`R3WGE?36mveTAX36gyD_GT+>`8-@t@(WI8hK&Sayg_VT zLvK=|D7P>5WblOZQ+kR=)7_P+BQpQFe^LIReTx?ibT(&MHe}#x&<~&79_6{1*$W=K zAK4A*17men#_s#9^9vw(v=57%fG>=4c13iHf72KwQ)hvgM6;#3^Cn+AOcwE?;|glx zstT#E=soKio@dNUFVX>tjfD-7)Q?XfF^n49E>?NfM&N>RKHod#JGM;McdAvhS}65g zF?d0z3!@uNK#dGKdwpcTFZbA*V~cCY%}rwGE^_u<6EVJos6)jjqlhT!I_I@ZI^>Q<0`6eM&*gMy1)LlANFms$QXf`F~ zI=yHDB)fO-{PPyC28jb%?T#Rm9-Hs-U4;4Yt@W_;KhicY9Q2am-zdm^pdjTNNH^y`&^J9zJgMADBK8`( zVQ;a}*jjh^W=b_+3ioP3$~%fqGtROrYS3ukKG%d$mQg1xM8hH$Rp!c)$skyv>r~A_ zbs@lLPPDn8yvsMO@Z^mLv{^BGf9TAzgrU*6ZOC-5pW3$>!tL`+>Y#W7tzN!davNK6 zAG-F>IJw&p_S&GE-g9ulSLDie$k?RO^~_4>Z6U(l;gQZTJ{g#4VUw|%m^bO!!P3cB z$%QC*-n6198mj?AqjxTN`_(@L%iL;h!dF5I)uxJ?@(KwZcT3M~56}pn@JC5Ry@L8L z=ApB~N+YJ^9m|dwCwkVY_DN7Dj}NnD8Q(=($*szy|Ine%tl)C;QQX-0usWhh4$H?@gaOi@2C2_qeDJNpyNRxll@JeE1hhC+eOnM% zNTWazTXIMt)ND6-QmJ*0`%qXi7aKKkUL#h)61?MI*OxagAs&coA^nJpIi!*yRuZ&I zjg(R2pYu9321b4$?Cv~0*G*k?-RB(}c9(Fux&!eu+XST>BOhS3peW@9z_KW5I%m#h ztmcep!BA83k`l^nU#4g8v(c2g$=RUor+2DpaGx@AJP49eMW^{&u{{e2dEPA-_J}gN zaPg%{QdBkG@2K&X!bP_(0$ZsJo@&xriX1o0`?KMN+%rO z@lx4^efl9F4&j~nbUGmRU`QshKJK*NgdJ#Mel`K*2gFU;3QPN3oiGg{2F zscN`|C%Z$PL8fWn16LEHn+3Ls)Dh&;9f0`Y?wB*E!VT=*OAqh#F`4=`WxLq$CAC2o zYy^KOqBxcMOCs*uu7AQJC> zVyWiy2-&A%JW9yihrTPQLg~sepgaj{FjzLNr_uOfsQqfB^B%4d?G~z>g11yrn>nVGMp&+YKE>6G4 zWXsxtM|o4ectdPSNrM_NOi!+!=LE_aYpC68Nbb32w*)1f@(vsAPcJpYJdZ-qO5a?~ zI^o+T*r^B0T0_F%`ZS?h%$t@N`Ech~>c)v1Roe#c?aLDbk!JsgrF!a|z;2mR@ai-L zEYhJ{(es92H%mD#50_oJS$5u?Pqycpx$c^`ETdNimu@tTSFY8t5qy9=y4-obYo`^= z7ZyBknSLJPQJi*>C6l~;r)ZoAy~kS|K*N5S%wKqJ?2a?$>NyVaIye>EsfllNzk{gx zWH(}(FXt6Hh%?Ja$p$G|R%!@ZqBJVLikXVqPkwnn9eezCx<`~42aYP@u3m2;hEQ>- zIpD>1^guO07p!9=z*6$jP)*fYe7t51xnzBge3rfAbwno~v`5)Lvgj28#({`L3JXIn26Gu177h-RrtUc$);L|R z;A%Fpk#csTkN@=jq(K|$D_Czc@*mmy6X^MA8LS&Vo+b{Kw43;Qzhu+$2zU)r6n#aD z)a&t)<+!R+pi09cvMDA`G$_75>jDByj;?9LjvTkgd)7Zb{^5^+z&?K2a5pifB|Dgx z)=fR3)rH7Dcxi6ZKJLJlkZ)0^WD=NjLh*!0cVHQPQR!UkRPI1V z9#Ee;RY1dB_%ya{kI4vOx?cSPww}cM`3wg>zObX6#k@{F6peK4B$v*U?TH6yLv7cA zxvMDwUrMo(Q}Q;3JCQ1`Oak3|-k|ZC>?;!@RNm8KVwEUbg}@IO#}y&oh-c$iAA1F(;fcmT=)Hx_(^7sE6rEhX*$K@Sh_C5wsMW7XOw=;^{&T_ zLH1^Biy~V2R!#jEQeXNcjX8O%?wZ4X7Rwe4#V|2V9^O=qL-}7`F1B;|Pi9UHPElvt zye{K&V{oqpi{KM2_l=4qjjU5+YIYBN?ytFuqy=bD>2|jLNGj$2*1qY;b%#qaQP4KV zPtC7@uWNVCwlHSbEJ1VWDqFAzR>JxE-HRP3l}d|xydz&blV~5s?0zW8@0Sx1E{ZsV zu}iS13j2x1C_X$&Ngw*(K0S6uM*e*IyJR|8$p?RyA5 zd(Uf)jvYoq1;{Stc!yN_23~L5`ylCq6WZ-MS~BCENpqjqAf+3t<&Qcw{nGE<69Z9= z$M7gI#LdL?lDJGCaA|(6<;nCmUJuTtQO*0C931{0NQu3)y=P$&d22aCJH&3T>l4pz zF-sq%R&a2&Ab&@dj{jgJt!7m|uj_wLHrsNav{ z7iPDtdO{Rhp%AjodUG0t{*+%eJjjYG&)~^GlVjQl7WR6@FC+BtdsA!JNvQ%Nx3!%YzrpPIVpp zt%&Z-Od8lDP=M?|>YZh-!a>yhK-L=wloYG4+MmS|2uUa-40tKvvGt)Kyj%{QO|W zN~peYY%?yq!+7Hr6hQa~&+VMfb>$bspjXeax+K>=uz&2q%+JmiK2jXmWlX$S+t=&- zraJ&n`Q%Xed){*?I{T-4*75vRXl-mboyA8m}j* zxqUJ+5qW3EC~ad0_71HHk;M8w!W)FE`j0b0ajA$`(wM^^A$$>@3w>n>; zxw!GN3i;k%KSwcq|IU4GZ7I>xp52<4L~(bqRQk&EG!p?1svdhx{PmnDO0(JZEjFkGPFS2f0ANqD-wLNj&LtQYp8IXZ1{rFO|5oJ$g<@*DT($@l5;u zYo8@u8-jO_e3C4t&L1nf>d9fksIiPdX>^Vd4oT4yA7OQr^m^^!@BWIG6UJ0O)ILIQ zb^nNyU!s%gt#A^!_vl<9re>K#$D|VGTqLd{K$1*qrR67FBzFp?;(*?0x6M5q229MG zxC6)NCFo-u0*){~U0B@6wn2nbT{6tp_133~cvd=Vn~X>XOG89O)dzwtj^jvay`Oye zJ*6tzu*U$tDEPwrQ1^%!+CV=gRMYvaC?gg5)iHr}Ob|={GE2U7wT+Cq-5VC--sg-vdFIH+r3?9l|6~ra(+6CX`p5 zT>Y`Sp0YB@W+j_A0t@Q=G9Hq9*Db2&jn$q%i?c+GB*O{(6k%l0KNib?Eqp72#S*&d zBSs%9OKm9tfwG^-z!0#8Ra8*6TOvT7Hz4KR9Iy@OamYB>u1Y~+hP72^nlG+N9ZB7+ zqm~kFyIe+5Q@&bS_;USnhy#i>4+*t6ABJ0@xdk=e&euqc7wF7H-g|_R+2>*GLnv3l z=WI|>B_xpsoegQN5ldNf&d`C`GymM^sj=$pbL?K``Bo{X{D>Nk~?VGp}t`jsQHe@Vnut9U{Znu`edSP6QARme> zyC$pm#jn(KC^3%odgy7NQMs&e2`)?G?HsO6U$Nw%MDdn)+483S%gXHn)(f3fd72oR z-t~#QdU3*(ezL7G%IKf&uyD}gB@ff-qc?Kq!xpt!MeRJ9IO}hEZquUGzmcZ&9`XEh z9ex*>r$k@HAsZUc!#6w$q+Cft#HBOlf1cynFQ2EbP~w6Fl?OtRXUKIQGn{C;G|F$^ z1x=pmU8JY094i{aQUTHIZDRgmM#SkiTb(tBo^fcih@&lg2i2&!a-sR{XFJ=wvSjwLECpHUwi#}oZUM5}Sc{j~ z1s;vaO#Pq*1^o*WMIgN*Jxbqcz^VC!FLq9-J?Z3QD$6BIB&^TMJwbX_r+U(?D;$b9 z_1_-DU_2JoD#V_PLvCxQr1}zGa8_t(`@vIS*xTw`&lE_|#s5+s30_(&!qk;)05Ugc zEe+bfJs&B$>a3C5VBm1pTDR3psuUMh?SGASls$js3g->~xa+FGh0uBV2B4Sv_n*Ki zb_u_lZQb@%e$ldktN5%L)XE)5*8pM|Re{MNsaCJ8zm^b=CgA7Fj$5C$M<^V4H{7Yd$k=Z66 z&B`495cPbTd%pop2ZBZE8pc5QwE^3Wc_pJFMc0d}BUQ*Gr>t2x@etfy@|U|6&DQIu zLzqQ{(IhWYxa@nMC38G2g?A?CppxAuwoJjd@|I)|v@LnsV(%ce$RoRWf^A=C+83Yp z#?dnFr^kj1!9H8k`EPeWM+Th6rCV;$SLgYgchqq74UbnwT}SK&w*sp7)v|SU99U#_ z&Us{37LWvcE@zdWV2mOB2v)JTvnpbOyG1q_S=sS_! z?ZJdtLw~`ME%h?8&(C{Z%IX;Xw(-7)KU=@MVT?)*x=TY5mLlr&xkP^-d+YVp_e+xB zBI#Y`inw1-FGYRU#pG~{3aw;h{Ul06tYagzX;MDHaAL%C>}a7OhWNN&P`2RiU@eOZ7gP`mn@=2ur*Kwnd+2+txwSANx8^jNkRFAihC} zAopM;*=d`bN`-}VeI7T;HxR}FS`@?$9W*B+?hJMyOKd^8^`7wJ=D$~5SZ1j@a=H%r zS{-=se#vS$pivFt!&U3OAey;;E2Tr?wh2PkbjV zEWyn57hBvyPWAoA6AY;@ZFq2z@`8d&Ct=x9hBg2p?|x*KP8D`BTH=f;28cj@BoWNr zor|vspI|r^av_pIj}ABxz6;!tF3F&O&fs8>)d^*H|-N z<{4|AzjX4469d2h&p|SX5ojH&Vr|imO4#;|@xF^r?7GT)Tz(M}NS59e$_A|@D6@|I zEtR(=!ZEA(3HQ?)Cerl;kp!kf00colrAVg?KgRMaSN<2l=pjo6`+SV>8*pKCi zz`~Etfp>Qs5AMFg@4ea;miTB#ks$qopDgsx|NGAq5>oUZBoXLEue-!xt>Yd&3FmOL zo@V=Jfb?gi^gkyDq_8^V+n2*j9MAvjHGlreBN#-o2DE>U!=E?(*AustM^7+Po7)LU z{_>svaAN=TX8&>W1Y_~>KUeIZOZQ(-_+-6&0*AD8QNRCX-2U~Je>{`Vv;99J!9Sn+ zKTcAq1q9nSm{{P&{xB8)dcVIskl>f|zkl$*yqVV!)(?`Ez6#v`3e~`4f{{4gh z<;_|)5I&$EUP|`EMEq~}{(!#B`(K~^kC$6IhIcyEe|?(g!cJ)a`oaG)ZhySo1rL~3e4bx91^)d`|M4hb`oaI- z-vIpj|EAx6jNAViSTPB>|M_I$)ZcUZuDWpzdz8toF6&oHCvot}U}WK7A3vr9+N>#M zhdc=F&tUlZn_uL{M*sUX6mTOEKnlOGik=qz-@cglD~ul`n3QhxQhz@|{yBrtiJuJ{ zD7w{1?2-ekoJ3jD=xTC!ejZkStJftA3kw_Q{a@$q7aXz%g#R}!{&i{n|G_F*2etq# zu|AMnJ_59to(khJeb8UWW`B{_6)l!QjS6&WDBB-O=2kN7kJEvK(cy>QHhA7QAro@R z1CbLav5^CAxv%1~GRcZsM&-=8Z)ciKJDvQ|rw-yfez3Zi^0U=Qabc*#n zUA|}t6s$5vL&>oriPhcw_k*#OJM7(Gv9jTYQlcH8v*cQCw}mqu%TI!0dY8$)Cyi4t zLpP6~k3Bv=<3%64)xQ1bbo|4Py@eG=@cGBgTN=Rvts(tS_90pxx2H;D@t_BUgtqn% z^?CB60HiLwFP7<{x5sYRPrX$@gtXZjrKABXEF;f$ zmwFqJJHi0e<0D|LZE<%#Y47b#fy?S8%!MbJn`Wo%ViY{ zNa9}`uo|Ee^3j5dX}Fn6`Sea)wN)u-TcDPbvq`vfjLYcqTxB=9>o^49YP*|m;WMq$ zU?a%he|r`}m1fn}_{R2(V5Z7FU^$XeL$%i9*1uNNW}}yesmhXJYb-Mop#H?I4j3Xg zW=~CN^9m!%HwMMMZ!XE&Cq5aDe?3E5^X&gL`GS*pWTR)|&C8ikjd}--(5FO^a+E=H z`BtYyC8=vq|8*h)GcQm8c1X;f?irGYpT1B%Li!FkF5PwZJ8OV^7X`W%iTNYH?Emt6 zdm?{5GgdPKu#LKb__Gl1cq162zJ+?nUj$*>-iwW{l3+5CGX!!}rP6$&QUT)VYu(Gq z-@RCF0cx?#en+v(WM#o&Oax_p%S2&U_t{fslM@c((ao6;KHX}?_R`F-qQXooxu1;I z!uYd$UH6+_>IhQ&H1FuTDS32haPf-MbJ>U0rK%~4K}~fuL<5$YFnh8tXoZ3X4i6 zoLzH|z{F{5G%MN>;vxO|;?j?ch>&~CsQ>LxNIIr4*%eQ%3l({v&aJ<6na%0!2cN+F za{>JwBhLRYlioQGBVzAg@DHo@Q&<}Sctwx_3s)-xpvuqcFsWtefxaYeAQ|W?S5E9W z-<`x+zG{)Q!1&>ZK+>L?ls&!kk$wcP+S{-Rz4!cB2*Um?3HJ9dSu(7DJ(bHm5>j#j zO)w)OI)Yx3(uhY;Fy;?t`D8O?)tvD-UlSd4n6|R~HM97zM+>M^2nbRzYGR)O_mo5s z!wX%m-eK>9ZXmfA=(@lK^`E_431Xt4pb)+~+cORQHLE{eqCD>nOZ%-%6>P|9c33(u$?pWzPjGpIY?H?016V zt9z%MBW?$1jDqQ8&mk7I^lfx%&a0qUhS;KH&DXcqZYdwohZZ6->7+dY-I6j>BI-L= zrAZvuJa1&tRjhPZppnb{osh_v-dOgqGCJx_2&e-Y44?D&?9Dm$^ICM6Y#pBAm+iN} zT)Vd5iM51kbVjrXlj=RC+0g<+QAC4Y_MNA+YI~XeKaE&B!n7eDnPw>E|F{}Iy;}g1 z(O`eE@d&^IMf2XaZ*w>wWi-;OYmky~&s&gw=ltRa_$S*GDdtCb&`NaQ4A75f6wqhm zS&btyro^`Zakmd9xrR=ou7c(qbaxN~QZxf+fXS}Ay$^_V1YCAvR5D4Q)$IjKymD4v z)XXemWTQkOAtEAHr;KlJ!@G-Ujpj)bo2^F5tP;0Z!eJm{U7@p+C{~y+sLN$Zk$TEp zN>U#V#X%Plo6Mwd;lV5xUSf92)v$O%qGuSjs-d-bwgF$`5Xn{I&*nZIrZ#Jcd^=I!|H6 zysB2WcvcjU2@ew&;YBkn3XS?VN)QpznJgB{IUJumFrZg zl(X1I9%1kIk})r3nCw62TT3DK_9~c4^SNe;)>vPknb$hp)(L$7Cgto9ok<`_-BJmUNiN0XY z?^~g5(0Vhp$5t4R_RTGLy;^W$ytFgt>o7}#2|80iNN~Aev4#N$1t^{bo z!GW+W=1r5nO@8wzEYh5OvgnP5H@u>>+sEg>^EK9LpPmK}JIVPiAEbyY-PVJxI*HeH zF;F&HbDQL)Lbt#@qeh+Ce63EyU8ZE-kC^FT!fQYZe%^Kdi0fIY-e}a8p<9h3T@G`F zlwTo#HebUzPpLykRM&qx$_?b`E}U7825~|EaCAr#o+a_Q&yE8kaoVdXr`>55tSCb7 znL?7ClA0X3%x}RjSl$7I{b$R^iZtlF-@oB9SriBtI8mZ=p`Sly5vHd@S(~f1&HidH z2iWwxF4!as`gT_sn!KOUU?xaMIjZ*L-zUwO&*k|&r%@k1p{`avLcY2)nyKISivQub zs~QXS;D&VVhl>k>z&2VUKEdaMIcDjgNQ`Q+-6riZB12^Vvp~LBU2s zwXs;o55_d@0BSw%cb(pWBwb)~Iy<1W6SC6j0}oHi7@W$X($V5~W{PN?Zr6i3S|p9+ z$~mvakA`mmah&I{Ju8^$xJ~A9w&_Xc&c01){R-yY#$Bdt>fl{LIz6-}x&Ex%6Q4cT zN@*_myn95ibCjl`bSUYzm`Afyi@`KSl0*69C+B4xXbQ$1R{c<3%9rcHEstm??FwRu-SfwnL=D#;V4%**4FcbNqobpJe2QM|pecV?K&mx5YN2gs;XLa)MiRstQtHWpn$OHbTvH6X%eAemeHd0K-yc9TO)62g zmO^(fFzWt@ZcU&jugqQ5VgB!~uh=HYMp2w_d#zH#U^->Mp|iu_-~tKtSm5)2`I?R% zKB&`%ilFPKN2}G;;NCWOShHGH-_jTA{Lod7eD($qRRQxJ#~3K>Z(SFtloOOY&xaPd z@Vq^F_L@S@)HjDhDz2>;?hqfHZna9)kAy0)8X*R2>@I7e0wsFJ8cw+PaFdf z+d+JTs_ZTB#U?g_LS_Zj28l%*aG4>EuBjl@@c7~<-i4|rMf!u&ro;aI?sG?)I;Su5 z<&E{|vA;%EI_iexC}c^k{QRP(x9})1&xh2%J?~i`3tLp$$$W%>%##-L4yKbAyP!lO z=GAWtWyUbsPweLCLQC7IF_h?{+J#Z~%un1MoY=;)20o;TX)>Uas{D%eWwH^ryGTP6Hh0U-)n z^;8T}0Rg9tSf$BC+rZ9%xD*~Ya1(9fmo_;~o2=0ahH3e=X6i5ELZG`G@4wu&r zadi1ph3r^!R?&K2apJ6Q&HJ5-Mas=CP4uF@AMGi&eL4KiFxOwSzG!+KN+@@CSf+?m zenohmoPGQr33v4Ck}s72SAotvWxG<2#<8(2UJN6-2fpcw1IZ-(JWVS$HYSzV^$GqD zi&2N^uy`yPekf$@5d|71)n547?wrv)N<87MHwTTj{{^<9i^ys{3DIM92EX}6BiNc% z0(Cq=H=j&ob;FLSFC@n$H7~h!A{xfiG~!B0K64bbF3Hh1$k$lG*y0HeGe~|pICAB} zUF3!4nN8BG1iwHQ#1I_Splo0D@(On4yw`i%$F+uJeVAfHpDMrLLTZ7=Cl=^f4sAwB zgTs)$^~-r0t9!aV{`{GT7`h005Cs_mbcOk8`#bMVa?Et7=a{-pIz$Nus2a5#2Vt8zc>%~wH>`bwU?WHX5(`Od8i z+$f$I`FQFi?9)MWmrt^W8mFNGhd>7Ajk(_IQ6g$7_R>B@NGzd5XxocsboDhQ|%CTY4SZjlHmY%CPg{1hX+dW$Y_K zdP9@z2YSyB24fjMsZvjW>XQ``{ag@rYe-O{{gTb4!P@8x-~GX{6^c_+8(dUCetPAO zdC~l9gMNKj(O;CKGqxLSKP~~>BIJ;)=vzLVqn6kbjOH`5WDPw-ftvV>4OWzzMwR{J zPo1Os(NE!uHOfU^A;DLYvmDBq$a_i{4#b0bS-^feF{+HB&24x?Y|>$)er-DlS9Gto z%H5s~7nBI1jTfd*thDOfqOH@ONTxx$WSHL#hZ5HFq9XVRkC6Epv}Mpx1#&`V)wSTH z0+7lAGmu~21lO~-?>|zq#L}%U(5P-zhmZQz$O#SO4`B;efQLhbV!$6T7%OEykVq{zsHk)L_Na62HZ6wWufceR&V8~R>j z7d4;d?yv;I4E?Zedx0Kgbl2ALdvT${IUl29X_PMe+lc1QxXj9wzvOcu|2`MJd90?6{+ z&u}?V!znv_m2qRZ33lda0}%MT>VPy71JL3D(4Cy@Rimrj_5WwczVQ_%j1i5tOaL4k(OoKDqXX4;v z`hbqq3Rx9`?i=M?^Bo+nw3}jU!Y|6ipC7{%FzkFk7+mFZIj&@+dUP_4;F&=C5wzqo zV-dF^Zr#?s`$#Xw>bHz>D406xfuZe@z4)yu)YZMOaG;XsiTV-s6 zwZ*}CYr3iMhRwDLp&g|a*}Gw9vM5(DS4d4nB?xSIv~Rcf4a8%;`thHd&VpSgEc+Qf2I zS(?KRlQTC`zQa+hHjSxgQ(9->`%1)vmQ&vw87-f~@uO|JxU+F~gV=MaOgz899@BeU zC%4qDLqet2rI0gN;QX1P1!a4-cXx@)02le%vWIVG=XT}WG^9&{9R_)l=DMEQB1P8K z0@`2_Wl_I3bRd;wJy=S#>u3fM>6D6lEw1VinB@$=!kPp+DlDv6;7@c$W1e|bhh`=KW8PNh@$p)wHW z-;#FgN+kVjWZcB-D(f61{Ssv8IHVyDEVK32AAw6SQL5eaO4i4qVc>ynwyt*eb zMr^#jy;*Ez7e7tu#wy&jy+Km?7%r}jXGbZfSC?Vy>gkdCQad>}%xWh@iC z_^AHde9Zi$d`o5VOsU+T5)>)cN~g}Q$U_)d|32yz@}Rmbo}-kq`mnE;!!hgNVzA2> zJ@uIw2&BY}UMmXSOprR3mzBRJjxO!eSCLv-!P0D#@UZj^uFs=x=uz#uDQZWw9MWrB zkfmN+$UG26gxf}CQm(d5hF*RBx^^&YUDP$vM2AGJbh+}2rCrGT{Rer>IK#k|FSWTs z8b;ACdLQ+_O2q@i+ zpfmyk(jnbl64IRl(%l_ONef7Kw@6EOcQ^b8=iYsfd!N|vhxglDbFDS!m}8E7o?ozF z6x?dm>*ikQRVa6_+i_s#5%2!~w>DE)j#8tjf!lF$?^wcc|z zn{3A=Ao=a_{-}Zhh`O-Ni8=#6hc+(YwHln5rgUq9V1TV`{_0EX^fm5uemiIl-&<}h&tI8um??GZ71}s6 z(7L*a>5c9BHQ3laCVAHl`fT4>l(c+l8d@#qCvzCSnMsqodB$%0t0LFX0;}07U1$N42 z-3-?EwN|cukcaM)ELK+gwKsm1c)y-IZZzxx+nIh47V{MaEV`X9LXHMWuiT}4VtJRR zJmXu}`QYw-AWcNK53}Hi8gM{>2L8M_YH|9PK6J|+iY%AXoKSDV$#!T zb-n_r(_Xxz-g%?NVB7cOV}*A9HagMYv~KTkr}5Zdy55QOGx_pl?$x?2tRe5T6; z61WZWzJC}N%a#D)#<@ldT}Pr_0Gw7vgqhSJmo})ib&;e9eopFk<;tMtJ}AuaJ~$Gj z@_yy>KR5%4n4Wx^#HL9I_5LrW?pT(5JTCX??W2F4VE;VIftn`^|H`+Zd$y!Hj!yO3 zt;W{+vM&L_p>l%C{Lxtu87=V$0Ljf>Y88{eg#dutQhwzc14A-U;#FJ@Og)o%GgW-qZ zHH@l1_oZnQ!GF9tA3sqzJ2A?TQ}7dk5zuuA&x+W))_c%E~h^7!#D_xjh5$spulMbYB+r?USs;r)IxjWqlfP}1UIqeAun zo0-A^B7W5MMqK-}LuLqH(h%lEnh}D|H z^4G)Hb8t=Inm zTeZZTpEOB*={S;pGPtzh76+=65~ynhk|3^?+GPHvA<9tl#i_^`bv^s%dm)lSe-TS; zl_$I{ApxDY3q{Pk@0!1Z$C~2qVQMS+y(RybNhXtkwT+5-QN&ej(^B;VkNnRKiSPS8 z7U%<&3i_YV|K6+r=a^5OJpB8?H_6imeEicux1_(Hfyw4+A@7M7X_X?E{`(67-&%?T zIHB4r?!O(r!8Jki?TJ}t|I>s2UI~93Ph)`o`1G;#e;hRac*t`k&&&p9Xy`xIKrN(} zceif$$?OXV1k&|cz%TRNXa2>#Jw{-39u4G=eUy^de!ur3j%O|LnL)=`5VPS9T(#{| zsJ>*9#I;RMdrDkM@k zS>)BALi_hx!nW%_-#kJiz}w_@FoO_L5R;3wiNZZczm-^rfJ8hw(1QyHa!jH_nb$e; z{EdX{?f^0^ETG+Td34yZoMC;^GxH8VzWgF`Vjz~f`g)=|T%IvmYSXn*xMx|EoVVf! zA&rH^&h)Sc=Yp2xb&i|_x?%l48zIyQ_L`RGa9cSN%rvP`$F0IjeV{3qT?sHQF{gya7sjP1&!8nGVB#02kW8gWsxXTJV4d!Hi^jko=00k1HfiG)zo@{# z5@RB*fLe(s9myww`4M^u0-i~R_mCc-9LPE#EKzy&b!#AwH0yhQyr{`~+hY532ZP%p zT4wj*x78jmmt`F2Cnp)d@VU2VSDS=!`T`3gy{q84|45;v@5-Wzw98jZHK7VU~F_v^@#)DY42Vh{1+ zx_AlgxoDz@*s=sQt}J;(ijjGDOgfkK>EegnlNs||b@sx7DF;b&ziF5FyXLX1=fup$ ztrzb)qbQ`vRz_Mf)n`Y%cKkCIeKsj1rPjW8KO%!%G_o!7r7)@|`#nT}Oe$GiAi!-J`j(+Zb)E_g~bY9Cnw%_i!t)&VMp2pnJo^ zpAI}#WPuci3NVzXQ~t)sX}?VcRO^m3WCYh>J8fyG7!|rristd{q@x5W5vE>8ycMcf z=9>)WB=XQ%Wb~EuGf`QduU0Fy-y6j-Ma0bQjwHh{y*;|A;ULf56|N+bEq8S8PUEP) zF5x^TGYfu9_mpPVgF$%~&qGjbMGSupE+Qqzyr(+fVL9Q;2C1asUV?TthFO`I^7pGi z6b)M;u@wn&i;*sZ4bBwg*(x{b+ZijB&6wk;W9lgOG^w9g(1&zPWO}~(%->WromO%S zPK~fFZ{K+qwf<@)=|R`^ueIGCqPN*gY>9O#aUuF6nPUkq6re0Nrd7hN48q{5N>Zr& z+gPnCguytH4|yRI@CkeS9;OvQ%&rNv;LBP7U}zF{{N1-F7eGzWss{vM)d7M4i=M97 zej{_|muCKW@mx4=*=>Z~78}l+w)~z&e_<|ELl><#ih^i8-YKQ1xnj9p;XgbYddWoN&wf_jh7A+RuaqL}kT_Ww z4#_nLVMHVu?5CpGaIq6SOCS()0g-&zE=0uv0P14Dc5;W(o08>_z>G39DZ59n9r z>vq+p#AO}qKa}06eQmuvWxb2cnQ~#eMNXZ{7E?zMvKTLiIZggQYYI9pvRHkqfWSQj)x7~&w%T)`l^+~{`+~R zmoj$%b+Mz1aF{I`rONsJgTaqxSu!4qfafdW>&tE;YDf3>l8d%}s?49br<=vX857;@Xt_`EUV%AyI#uQat)8*1Nl${i2h z^>UoWX`8BUljSrS=dnHt@3oXz z+dtI+F9-z6{2=qFh={wTE#mD#*lbaWAg;GyfNaA6=9g9FrqC2wqB}jEA6!Ai!l93P zwmEDJ=5DA@mb zsK}s&${b5rY-?tu?mF?3`xjqbXzsAlRCgbK(XAcF zDK*qNWv;#)T?q)p+8#Z=*?gXRElAE`xgWkgSud>VT=L=Tk)n{rrP+!Pxv>AO-g*}5 zhkoJ$_Josx#!{J1TNRCHEE;9L#8=KhjI_(*$6cjWRNu8r=qs0ol3phG?O)`2loBW` z9TEx5-JOKTuU0O+A$$*tjzbA~cb`5|e6f%Mvw)TVW!@cajMR$QK72|_c)qP^)k$)9 zQR@?E4mA8DXSZHEafKR)m(^eTChbM@o`})xTa}yS2b-LwCAO03=z8>-5W`gp15z6Md_LYMtVy(4Zh- z8n;sKgdH*)X@)oVEfQa>WD_f)>o#!MV`k_c_~k5fIlx8!e1wK3;rkH?OO&H|qk{@0LdWPqPdMZN1J) zGamRg9nRzcHg%l&^WNy(%itKral1cKWY8oCaCo6T2d*aAgOl3@Dx9648NOd0Z;)=h zQZ%(CmuR_Tc8ykJd}8T$JGM2mee`N@)ZBLLArpijw!;g8Z2*#7VLvEzzcW;wwzy7! zPlN$f{BOvF7#V5rF%Kh)>%>Gc5txSnetasAOmJK2uL z@5?f5au=|pd8 z%E|q1F{UeC^SKjpH7}PXSY<62 zrRID?dSdiy%xgWffen%5jUQzh&Ktd^y4F(tIjoI2=3-ZQ-Z)5d9kDldO5~~Yt-#E9 zBU9$MKGs`X7Q4qO%Ute2T0zrQHPA@fc=3hAw!BD>D*;jcT5>qG8bi+>cD_mSt{i^E}@l9Qf<}<&{w6R7-%F!J2 zYBD7YpDr|d!r}QJ&b!5Y)%L?&6+hg9wyrD@ebdJp3ppsuM&AB9yiv-!HCG&XyW;~x&d^9Rv?r|M(NjiU!pyZRw$X$L4#-UBty90R%%JV-G9E-RxeYkuGo_1Y8LlUpBUOMqrt~P^FYj!`w zR-t@}Yw}Zp`TkZJ6i+BdLOeYKJYf+0phaIo3WrSxLm-i1&QZ%^{5l2*oTm41g80=U ziYJXiUKengCGU-;k9zHLia_@!Sq_AUfVE@`UJ)>wIWi8rg1*c%O%74WAMb7!@H41K zdh}waFT7b=wbJp;+eq2$P?fvB82MaTvEtOdcx>(h8Za7>MCII)53sraP1Yc&6Q zs*T93JrAAmm`{H~ubcFOAIJqe_wObeolKrs%eKdcIiI|XXgL*j1~7V&-lzR!lAC_{ zkU6)j$D*mztQ%n-4GU}RUa~*lieQX5^bsIMEUe5E|6E+pvdo;VsZ^me287T=}udDkK zD*0;c+$S{Y>X@*_bMhlc%T=5;jCDf>HN&5iK}BIBPU4<-uj+nRPJAM&e`c(afahtu z@A{297xR-MzxJWVv$ki8k1#0O9Xu3-YQ}qvF$Is6yQKx-r9MFqz7(ZOW#;GKO?mXY z68W3)IBN(o@)~V6qgiZL7>$K^N?Je94>9tXq&>1_ezuXskwYfev218(m(}uFDJlsC z&3#_Iy3Tmn1?xir(N?`tTJ%(-d?cZrZv9B8pI#Hvp-ivsXk)e$=V1Lx)X-sRXikPI zW%`{~?kEKEu(Kq-kLO%(^ol&hK=?)$S01NIhb~ZYlSz4P{?}#exIxG1PhI)2M;!W= z$Vu%6L5B&M)}G%fVmnN*5c06ZjOZ9kzmB&1qKQwyg$UKiHa6W=ba#y!$$#oGpyZHV znvS;f--*!B6V#XM#V=SdJ|fcm^t!B7NbPaQ<2WniT5L8F6e&B!Ew5!!0tRc#E&`LI zR@_dq>e*T~UWN~J{Mv}`1l!vy@7PKF65;cMa-u0b2Dx+Pe^TpLpx45BPToy8Pbibh zQ^zanIZyRrm^>9{d@J9l6Q}}f_h=8Rq-YO6sVasMUXU&68;D&wak%ZqZV#TtVd>Y) zBm~PYM(r>kG$Nbi#!6Zni7+@FV?J?Z>$~x}>aLl^5yi$@ZK;(GW{FVkJNX);k+zIjN)B%1JnC;aFPbaF=QZ+_B{q_Dgk~vJvdOxOm;_SMSrjel&v+NgDwS2U0!5a%>+G=O&?B^k+Q|WStWLyl|oD6=Mp2oD4BZMf^ca0fY@DU0Q z5%88{vjkRT=DI=WNV(!{yJ7)&tk`_Bp~g!Qeot9ekg}PI0!wp)J{P)O?w#z!yVmiiu$}Zm8+@DwofXK=a^TAmCFiSVK}Qn_=8Y z-gH?w2tFKG75Dl$+g%XgWbsTw+es+5w|;K)u#0I_W-FNS*_su%{#?h)v<)|nn_R`` zX|H~e-y}||!%Tu5+WPRTI1Rybo29oG0uM_W6;1KCE>gqhw>N9Hml8S!ut)Wfk5fMp zVQA*9l2tj^NY^O#Qb_0Z7C#a=MVdZXn6=0q;HSsx!o%EUp=D9j*|(eF!2jg%Y-v(i z{ao@N$rvabg0dz@!R#j^ILo*7uaCFJ2ig)WQO3+;LP9O*wq3LIT;yWN1Nl&znS`YY z2L}~x$0G#$W6}MmOEEls;4V?ns1K+=&siq;e0p1pBj|Fa{#BD&$Dv=c<%tFZad`oZo8IIhM?jO96uv$yC`av#0nGZ@shx z{VDG;>PsYB^9!v)&}s)p!8sd_6LJf+5AR38KVM2 zM(!b>i)yZUTG4ck>6}CPg1DkUQODX2Q_yF{v($kLLS5SmywT;D zuCzd^y$z0|DB^y2of$x5v$97*)?&jySJO$#-@P{@+Z{m!t=` zQg>@<9(6^hz>N*7&3k92wlV?xphg?=QkMq?7Gbegx7MkQ;`1sFiLyq4p|G~Ku*~vz zhIelR8NVQ?PmzA*j3oEfmMDqQRfl?(zI0uej#Q;QeafI(;OTtFyenl{XO*$Gyb_AP z+}lvUvhqWtHMn}sg%F2IM@sO3Z-8KC#kZ&>n+W4=IGq&i!KWqwGko9X3pk^uO$Yg2 zP3k`o-KnLM*@;2uhlv&)5KdQ<+gEN&mMD*BD&!|C%n4Sp%MC_7m7j~mHwj;(`r{YL z@8NSfBvoOD78OHDm-=`2YR#rN5zgf0vio1W`9XZDx>1CLBZ@C*xaFwd7=%?WiIkoe z`~1a7xz3W|OM*731J<`$1LT2NEdBaFqGiPLv&7})^eII$CK-A=wP3%ow{q!%z^Wk> zDgc#u&3Xre{rp(<&i>sGS2-!zR}2E5XQ!6iyno>A1exe$>YC6q91l&8Yx!TWb-X%H%cQC*7!Cp z^2LK{>uw?2`I&?MT(x$+R_VkQwmA$Mr2s+IkHc{K=2W5NxPX)oMV-mSeLv3yZbr)S zWn(3}SE`3_lgp~6h4B(AO^sd-Tn;{US}BpBZc}DAF8Caa^-|Qn+&ReP@RY~t2XDr_ z_whlW-jLQ(Y!#;9mr2Ul|4qPpR`ET+yaIWMXaIp0ovL6(<7b*+L?EV5;w6ldY*U^& zzbXTnHA5Z7y0DKLfNQ*XJ(qRvGAV=7jH7#HVeH3CueW+xcc98f>f5LF?VUUBX+FBZ zPmF2(o7bilb$1JQ%K*Zo!RoF~Ng0Osdh-wu?Oqh&V&T^jtHP3qnkw|MuS-|9~_n|VZIX*N-z!Lu-OXS`_1m@Rjn%r9LzDKNQA3tCmdC5XO{-v-L|T!o zi?n#;#%MZj@xm@+`ijt<1e-zqSblozh{I<29k%9M10YNYXC)5%Fs$3`@sH3Fo-?z0 zgu+aJv9x<1&@8d1N)GyZ`XQ$e#~+aNH#PGm#MtIFiEOMB zCI!rS9=TRdA^{R?^w_ghA9E;;^^CA?WOFAoeVm-Ex zp)*~)-kBqgsJj@`Q%ybkyS43^CI`nunfw$>-i>?S0b4Ba#fgZkxBZ9l@x)NthWF3x zWuNDlr43iiYxZi*bP_q`O;rQ-5f3q&JWvJCFG3H$aZ33m*vS71)n6gU2G^7jw(qvA z`A{JLn)#cZ=5QF>mSJ3!cdsZ*N_dC}r^8860I7@s<$3cb>Q^vr3Am-}(Pj$yUm~3E zMsVsnAr(cMzn%(zwpg0B7W6J)J2y^i(lr{Z5SP_yk}7j17?pEHHoyG1`?C2d zrr=F!&CO(i)tinFRYdJJe)fadgZ2r3;8S$HKjy=w&sLcBx4Qz?i4V8@6{=;;J~886?TV7Z|U3=8XTo@EDLHEP#W@4QWYCauKAv*~xkIb^U4>_Drz zL%kouyB3;jM|Qc?n|V6y^SNCQ!gD65h{>+QbqdbKTP?AKA3T#223Eo=Q@2{VKM%u3 z^3~M7EpnZY(I+r1Sv*$dmP~yAb1_bHTYK8tK)&7VGFr4lcDX%{>v`juo3jVa1i`sl zZ4qX~ONDOjG`mB%-O`AUoq6a7{Y z#yzEZInS>!Ru2rqfk*?*J%hMVjfL&%9EMHRqH$1?!g%(LfID+1I&!A*lCR-&&%P;> zbW4beumox*`1Omq0E~%a(<*dZ`ACn{u1-n(Sh^M zyA9~3RvFVJ69Pga9VUgOjAPN68olKq%j?`b=?2Gowi&FGk+Ndew zxh_5B>y**o;GvUQbgE}KvrJT*hPkq6ha)=jzUSkWOXU@5!uM?5gtY(!>s4D|zqbr5 zK!ULE)@|7cq&qz{tQBK7KJ7O?ORkYRK#{Hd^udQk@qqD{o66?hSIkf}UH5bbgXz8AEi3^A`HY;pQ&zpBc#V>k6Yo0y5t6-#Jkl)IA#394o8B zVdE~IoIO*#J-`0o)Wn?XQjh}wP;7hgj9)j0yDJdu&TTa{GS%ZzV*KNQn0_J;`$67A zg5|d#js0zAC85HOQ^l->{Ss0#-*-g5f>VadCAj8C3Vfg^a+K=S>t>;dMS6a zhylP)o#kBbgKr++`ij8L2S?)SyY=ZdpI}j5*^d0v9%WEw%n5u^0=(TwX_=RFC|x&s zMosx-p;v-|)uX4p4qX-=ckE?W4en!3%AR#!VE5No*7PlVT{~#>$BnYGCiZWJmOI@l z%v8@$5*IpAOEzuHJBQsOwF+eu&#y!~=T0nE;P+y$Ipliq+^|WjYdTNTTqslq0zZWD z{x5`y=oG;fn0I?g%VT(bU20u^4TFFJjKKFB`0%UP0f5vKyitnE z9PJnJ)#+Z`Wev?skSaV}QMxfWiY=r#x4bKEcvWOIpGYfsGr{&@s0)GAt?|02-~oeL z_V>C&Sz$~*r)xsYdyK0}wMqFkt92F8gM%tWkFO%u!w57SHmlK68k!19sP=-{gx3Is z19gKKN~K|B^+5f)1_oAzNX4*TQ*oR9da;y)QL8d?Gg72cOCnFNZoLrWd8XyK0nAb< zRv*pk6v@8(iFM>2^i>-M2+lV*uL3dX*>z6eGm_aDAbJpL9V4^x^3rOfboOD-6w@OG zK~96ss>~8(TRLh55#7Vbu!A?|mYIiuP}m!a&$SF(b3@R_QwImn1U1IE>^UYYf>tES zjqI{G+kE^fBvw;~N-OcaLZ`Mw5=9OTM2S6(Y)OXud25FfSN)S~fb%PK!J_A#jkvV21@~{S8*lOkOMn<~E zlzbLn`grxx#*LZOM#k>9Z!|m_Vj7Tn?x^h-GzERa+!6jAS512x8Q2!0tFJ`ML;Mbq z@$)JyH0#{Qm#wfW+fuvxA9YyLE^9`s(={_MU+zGcD!P5Lm$O&mIq;xRqTAbBCb{ak z@&+c56dOKktE&v^1~KEzaS+q(C5Fd#L_KMe9NVMueZ`<>!?9vXBbMY3q+&KdyxERi zucAoZjaqu9M_oUgbN(kuV!;%?U{(KR52*j~&xKZ*UE_eoc8PbV9;7NxBJ2OJi<9@;` z-2Bq+=Zsz18EnffCtMw}>sd4^nGs0D3+u+G&LlN3Fboz#d%M7m{M0sWxm&x;^)Q=Z z^>=c^z66obon5`rfadVSJK3yd>4eQ{wuR-diiLR`SB?|Rhd1+{r^&=M&p3rcw@=;7 z)a&zBhtY;^Z{SA?d-1#1bz01JYEEP|ram@VFSdySnobs$PspGoEIE2PJR??p_*tdDx(u!FUs#QBXBGO zC{E(U)DbUTk$b+DHx2#eYedlAkVrmq=`LFw?s8dl5AdQ!u+46oFS@Yv?@ezQaCqE$ z1)`VXqxnr}Ht5ET6oYg_GB-7Vxnr)n3Zju=l*c%T!J`sHTRd_%3MIjD4coO42SMzf z*utq~YwNf_LmY`X5$oPD$k{4(*8GmbyFVsEx#x{QgO&osuvT(uVpy6ksYn?L?kv2C z*nvi>0=Zg6ffo*GDkMUq)}c3dIA_#4BSU|buaj1(ICk-EP!F=nAk*>{p=A2Wiwql^ z`M^iCKY*S@H2so=x-LGqt+Eix)mzwCe4A~eU9HBRe`oiTu=m{SF zsaS9rSwIIYwfwhq2mzNNB%uo4Z=h`jnBVi>;=>moYe>QpjVSw zdPIL<3hRyH7J(fUAtEB;yS}-}C=pV8`zLgBi8PTS0E+v;^#-|JopBKa?z7SfqZ0C9 zELexay@OW=u^^kZ0WQMDzr}9zaZ`q~r=F$F{0<(rqzGpYI6~jOB7xB~(yGhD`@JWE zohBa&0GMKUTdJ`96FbX|1Ur-3b4`_KkW?b^ahxO8v+OTIQ=X2}L}MC;?Jl}__t!`! zd9hf@WR=IejRHPR6TSO7ybh&d*6BH z2Qkun3xs>q3jdXm_18uL3$W%T4-zE*a{gaGa;pN6A_2Weh1C6vyEEEjXv$!pWdGRM zjPa_fmaDz6s+_Mxm+(nWdtfcsleh}@C-k!E@1~L3XEeOHAfn+9JS}c*wyijJ84wSa zc?Y7VXM47{_gv>v9H{tUkluZSeUknF?k|TB?*|V_nm_hw{QIx}I14R>Me+Ysz`ctM1L(lrhD*Zcf&q5mleF>TXFk*-Udy?;}p-+uZ3y>L<+%!U`xQpx#Q zYCcbYx_SEzS3w?E0Ytn1~l=;U&%g{neZ+eS|^33$$|k?{{rU=8K*;vs&PX%Tk{xjU;tp zwE{3*00yO>x}9N|ot>@0EmXT9)8MoV@0+mRyqc-Ck635=(i{G{)w?WV8vDN&c0qzj z8J6T=sS}v57>S>nO}t8ri;H_gEvx+Owzz@Y{aX3i^-n7B%R$zBwcVhqV5Bm!P;V@bSU?u9N^c@nadan!hI0niZB=5Af;SqK=%PFn3t#ObIVbg{a!5+0aZ@NUq(;5wsuUlkiRtgP zS?wdn9!QBLn5pdvzVT{BC$6 zCK|(><>WN}BgJ;=(dnKMPihKRMfVwyZ5wa?WYLL7ulh=*?!70^Q#{5=Zk=fy{7;86 z=zIUy_WxZSkbL6{KZOQhGp5dex{+dWyo`&kDzX|qmFZ6^x^=16?@d%V-JPQB3`>iC zbeB&VMG=gNhK6=wvBqF!Z$G9N`rT|+!aa>s5-3Vi(vR5Ygzl`I2VepLNmi$e!>r?- z8M)ayH(I@p&^T;H&G;=g3L1q1qW;8Ju^~yUy?LW|BB|5WSymaovZZa~!14l6Qv?1HAl-_5_JY$t zv}o+TIKqZ}DE@kzEdf-oe(K{xS?BzFv4Be317d#tTSSj>WZh$m_d}*@J+uZ0*>t{;Nkxmm z>pVi+EcPZhkl$||9+qPS7_;ilol^c9yB)gM&L>Rc3ddWrt9BGOmr2`mWpY1FAu#BT zcsAL=xGNJ!YlmAFa?1cH2i7W2ZDx}HbsGM?sWg#6GpWl$30`NP$!1zEJaF+)$_gx6 z+FESazeyauv=|L+wACh&+#KQA^f)}uy|@jCqFez&evwo<{72k#6xjpGSzE7NwTrhW z4~qK|nIz#UgLj6qBx&K%@R{KSUJy1Tkg|K7ZqIo%;jK4WLwpE$oXLEUu-Y_im|!X5 zJ!fg3EAWx(v_NWdg0w=NItnH*#zz%?q;XIuu@w!!mWZSf)h$ZH{O==$Kg1XfoiRoh ziSpWJttU&)i1@`p7P*+boE#92A|sUFZ>I7K!$X&TZd@F^QgySx;Ju=ul`}IlLoVIm zHT2nyi#nXQ5v*?ndt#~S8-t&bBJc?YJ`tU5a5JhTproWMzuqzGtye%Qri#FiYDJmS z+lDsc9nIw{_73WGW@=2aM!s~hAH~d09LZDB=ux^vM+ZHa@877i6 zR@irR411gLFH5=K+K`~OCy`_VoYJxOuWwdSnPLgD;a(<(Z3l-MqclSqYS(fZF`0u`0*Urx%6WFd`PB{7cE<-%!FU{P2Jac z#AA7$=b}OJadXrDmQN^^X$&KOgr(l7?~kiBZYOY3pwk8^NF$TF96(;3fw$ec_ zQ-)?Hl(s z?Yp1IdXvYv%+3YIP1Y8BXFNk{DmgWI^3{2CS~bdvd3*@4=v3<=I>D_AH$O&(Th^^U zE4{m$ZM-AeqaQNV2@Yq<5bE)Avat;(v8hPz$h)-Psd+40eOT$tjjGqYLaUT1ki&4f z3pU`Hre~?l=^k46+|7MJ2ri$m%TZ%)(r$~~ep`8{%!SPcAB}(~`cX)tYi!5n=?)jO zYB?Mn!4joJBpfpK#?|@S6ceNJdCu|Hlo~*)rdN7SB$jV&qvBW;#bZA4Z-O02zWHN+qhD@sP|G9wSLqKNF>Wy#rcxVRs*31r*0BBFujvJAv z4_rmlkNIk(GR2 zeivtdOySD9ju$J*FC7(MRD!QAshI=O3TYqP)Au^kw_~?(ha2!;PDThm&UU{z#CqLS zTY_&v4V{FWW=KJcr2vL4VjZFQw6ux^;ebWH?nbgdm?e%)tyx#a?R+d!ns4R!jMa<^ zlR_dKWX;9zZf{PsfOYr7tPrCg$%CG;Ab&Dh!02{)9LZ^CGEt)Er>P0JU!yN~Yn(K` z7X#~guhUG?s19y0q9NqNcG$QA_EjXK7SEB6y6hbKe$6&e{I%Vg9KHWRI^Q~W{A-tr z3V`dvj~_z zfzb19IDk!_zu!>Oa?9Ey`yE;8X%~4I?A4w zTf3m+4g03cZ};PIV-}a)rvB~BAkaU%r)r|wFIBQ5!%;!4AUqlb_!6DLw6>x7j9D<$ zd!y-_Kztlo1dH>%rI5zT(pPP$2`Gn&GsWPIyU~Wr^3z9f~_g04E%=jcI&j{ zY(7B@zOZm$Ii28*4CK_tVZt?P?GbN*hH|C{m0F_f-OZV^E8+Ab#b&ev0C5SZ|A^pR zTkm+#QpcrNBbCB=`Fg(b?l$V;Xl<(z@Kd(*n2Y-mkv_eFS>gyKe1!l3sp;WPnL78I z$xgS~&kx}E8y~}bCRjd=af9Cf&=2lWta_jY2kZxL^NdtNh_#>zL`_SY% zPRIT9d6(Wq7E}4jMfqm;d5)2G$Hr^m6NkPE5k5iLT?sBE{GzsUB^dxlLtA5zNw*$PT_J8 z8_t%rLxS6Sw1gB{@nK4JVC?JwuD83pd$qJFH6Wkb>wN9$>z~4* zud=>&+9TLXr*JB0Jqh@T@Q;QDNAh-B0BwR)tHRYsBKg>~i`B~|hYtef%cDDf@aD}P z5-El^vLEwj}JKg8-r#%g^RtrJ&cd8PB$u(n|0Sa|)B=~7L zj)ki31bSQzzK`pFx&)zmXbMnWJ| z=U&`-#npiQ85;?S2Y&zh;%I=E++w!Qxh~Algig5cIge{qm>qB$AO^MrL&gd~#XR46 zig&m-!XEAph$Q|SKhWEg~frrSy``HUw!kzbHGnY=~rWUEU+nHpk$Kwq>(8D_#EQ9Dl zK~q(&FrUfuAbY+PP80&k2BY}b%Bx5ZoOOIS$^aEA=onl$54=;5%>HB*;JF$3eKJ45 zQOX2rjWrGilT!3;TaKdE%;JGL@(3Cc<_r45G7QB*98Atqm+Vu_J&Y+?y=p<{kZXtC>nA8 zikX3=^jbigw|6n_tl{TjJ>K5b`E>IfU_16T?*ai6RRWA05br{uYKm4t-+!}4EJs9w zh{NlS-gQ3YrAdJE9={m{!a?#jFjJ0Vei`M_m|*eaC)dhCVzkkK-rOV2dz0DdszW4g z+ucr7R@ENY^)VWPh_T)e22hM}lPY>R{t&(*_3C5Od|(H02wLM+l{H>S8=`zLlhtp0L>BS81$eZg2OV3`hg)CnNzHR#&Xh~_yN~B1 zfcWh&rM4Awkk3EfQ1Ws|fKg@vU$JPNkQMBs*NB#%J(((?+32s{gfS&Q=u}8SNY#~i z(ctU7dw`gi7_!IU=yAH^g5`YrIo-%C@Cmi8W$Ulo!EGz#7+VjR zw(SNUPqR7O;`9cqao<5v-ZZZbOjq03?LYQ>;@ZhyOva5Ca$pg>V;N+x{qY1$SLf`_ zzD;ODWncU-12gt~o#Fnm$c6?&pxQk4+wn6`FV^ZAsT$*+>jfyYj*M~F4J-|m&a*)p z&dTn0sA}`Wl^y;&O&K{4;97DY6kQ86caJdkiw4q;Ss9?*hPyYH0`_l*>v)wl`pe)~ z>ao<$eYB4(VfFmdmjUPXBa4*{(kB9#O!A3(mr5xO7K5HAgpYyaT{vpwyzn!r#AlQp z!OfT@%$goTdGzWm!5Azi@@`3BQR8M>M}S7iQ?R#WV%w_=k)T_%N(8m*3X^Op#0PmT zu+Q19aE4<9yQGT?gI+flGXCn(V#ivwRitn6LX(GtSB+4eN5*nrg4`Lz_P9O|n8^ba z7&b1idmVubWQrK-%QPBnn^k2I4Vco;qgK__;}_MMZThGX`iP0VQrpMoPJ->|EJEyY znxE4NNI!kD2Tq4 zM_VGH$#8UZTtCxu~Y>z3Rl?)CC+EPRr24^x- z?Y%{;abCOM6H_DY9;m9vo0Az+zAR%AKiaGPj;X`n<4bh3SzJ!QM+M+&JB_0)%LJG# z$RtXr?>DuZD7kI`%<0$sSRXr9W6rCy>EEStv3b%c@1g&d$zXM1kHR$>sOhHZ03sH z?=0l&)wh!hJtp@o`SFq2)f>JT9R0ZiDa`LsOIk=fUzMrl0Og1_Ae6vDI`2&|{_?mn z{NV1~#%>bM5%v6=!^W2b=xB2XrR2sDnnWJz1RVOhpvS@EHO~NNL%nDp^ewiNR`Xl1 zI8BC%arWZ!AR$yg3rLuTyrs=FD=pM&KntBS9&YyZa*Y8p&)+`-Yfq@5ngD9-sApbj z4^5v2ME`GQQfje;(zQ1Uzs6$x2Xf=gG) zP_sy+yxr>IPt(nK8og*O>;OoQ2bRZR_W{TwgmU96Wo)w(z7)>2QjI&X3}6% z4m%xbHM_=3E7jL(!{#gZX3)ZDVc&k2!DDJA?G78T+~)V<$%Kr`6hIuW)BL@i)!Q`e zWFdEiqxN@O)VVOcX}AmH;??Z;wkr5Rzdhwj1`npNjq+~8y~Ur8=32wWu^FZ~6)~^D zex5$wDl+0|CBO_q9@~i;YsU*e5zeq)9CNh+SS-IE zC1&yB6@cn1YXfsph#&AH()@!+_O$$VZZHjTNjRH5TuFcnXFgq~zU1~}7F3#<^x&+J zAFFA5xnO=uscz|_QXYH_QX}Oz_cqVz(OU2?bESNKHlb-e5q3Y8$1OL%TsyX*0M+CJ zwL2R3!Oy%1(sw`ZQD(5e@4bHE+W_MO?1wF@Pd_xXu_K)N{WiVPR}#0wwFpIbG^r&$FCv)?MiyYX8{=!0U7v@Dm=-lXUt-Fdo3`J`#KgMd(GYF3h+=t51zo8_u_c1O)YpEU3dXc z{OrcMZ6OW8o-A+u8+<<7Oxg3@9t%pD@d$Q2udn2#wDtbFTmzbBpN_a(JF@>^U_ftE zkX)Fdq6W%CZHuwO^$eV^s9}UGu_^7V`(<1^%FVdQu3iiM>LvIh@A}mKjkf&p{f^3; zk9!#5y*Z+q#F&B6TCZnZso-*B)m)k8y3x&T8hwtxCGut7fkYRdsqJN%m4dTQLw%r!a(lJ z?TUSM8*=+#uhgyQkN?hz4F;!Yei|TA^D0yzFjm-X_x7Cm-@n9{3eT{skV@1v=1(8^ z_j+JQLVqDXzSuJM50?u56%X}x3Xzx#GXMFvJKjY-BcZu}qhY{p+O@QpyE9!wOU7dr zOU7e!9uFB1kiyxH(yKd>&S9TH)>iYWHsG`g%~VX%mW^S8%-3on{qYC=^)r$1G538s zlte0{Rhd*iS65fpWZjZ^`a*RZ^Dm>`u=O0E@IPQsBnO?bI&eFcdgYT@Yj_0&F3k0c zU;OuR`k%=dz(SSlDr8Vfk+x1A7>x!woYH|ML2?`FB4}F=%ANmdG6A+)FItNF zqA;dES%87f>m3_J*drWkxm$~4<^O|OWyH%xrhbUm@}S=RL=n>Af3nkyG16d3+`>y` z9oN?lXuC|8e##Y7a6pe*knry~E=pY9|5#zaH*K!f=vW5o($@OWWz-epBr%lp?z}}Q z$0QK07=etoF9&?PJqMxWze-lMtS$LG_a|N_@Ol+)p1K4TXIQQ(!uI;DraD?Y-4E-B z8A7`X9}T1CHIoxcwfk?KpKQ>YDN>F*>GQhF#&YP;JQ~VzQKgUj_if?-F70^?U%a~k zOPxtNL_JBgii(QmyZvpo2_!0+3L7a)3$0SzUO(uZE|k6AP3oQ>t!KqGxgAIX?2pQ2 zXC{ie^;37cNSrjVh?#8W8oZ-?4Bu&XrMW3E(C|v(RsbO}uVFlT z{)6B!S2?fz)yKvVvT?P1jSEGi_E0uTN=o6_M=s~MEM^c=e4wX`hekuJn|@tYky9$_V*2KQjjbu~R6)1>7td`bnT_EgJkMAEanq#wi8eix(g8Xzy*P3WXP#3Bq-!zt z?Bk~Aw*>tySIK4EzW$t=WJu%a{5wFo*}N@^Ry|`F!W4O8sJuM1n%-2_Y++`m#`!-e z6zz`$3Nx%RDbXL@8zK5UfHHGNp-E0oUO87U(a%7+{XFh|ojU6VoPbREgdf(TONZ-E zR*pid`Vy;~1#$6*v-_jjllWz0y5_uy@VKh%96g53`XX0)zjQ31xG(o5)!8rnewo1U z`3ZEV7-{!%_5b5;d%J}_MCQO9%L7KwbVJxZDI%!gJ+j2`_WVF|JtZj)H3yn zRyI!s$>(Y9H=?D~79+W^2e1I$@3w=Qy&fCe+r{sxSmHR;%=0NbLMd+6Rn_NI^9}Xe zIq*TI*44Xb#+2x;CvtYqq1hS-P^Nm;pfVv?nkI1*IV6MsVXFHAbRqFQ^+eff5HaHGm4r+ZvuSD7qMQp6E7F4v_|cY#sPopTh9nLoe^`-% z-$Qe@pk;Kf;UE_2{U^R6Td8 zC|KD^KR5H2wlYcTK9(C?!JUM(mM)_)xS3jD%&MEcFq27UtHWFCWS_MKq=j>Z9WOBHH*qN6lF5#s3VUd};KeLg?~&aY57So@8X(+2s${ zx|mNHXo2|jktAH{1rC$htn#PHDZH{p<;&%?pg)YzAqt zmjtmj4sX_{Y?#%etrB?kVY2MiXi1y1JS)WPl*X^ti_y zS|;wcK2za;?~$PL_G|--!1a`Qg-jy_1U*c|-ZsU z5Hr9+E$B4sc>0KVZ&5VjMoLNfh9TdkS>5JJgF{Mda3GMuoFRvB4!?aKjoiZM6O;r_ zJoKP1Qp{~5QUF6R0AE13(}u8~G68w-`dm{JXp645gXR0Eeq8e!Ai)aY?3T^m16wWS z<4p!Vm}FY~(C9(q#z@dyQz*o$jFpuD)n4=ODq;+|;zTeyp$?+ee{2U~2rrT|ynZ9( zeG|i5DM-bW?7BXax-Gqh+YNDtbS1j%WKBhq?GGFr6mpDNVFh3Kmo$X4vsj}^stvid zDNODhGsQGD$f7u;93T6hjfFWG3V+I-8#_Qfc%SjL=0Y~|NSJ+(pCaOgUZ`wOpOi^S z%$2WYa-`)1lgz+g!1r%LbaR(5vE*OjA%0#nIQGsiNdYLXK?9gwvVodtqN)Oj3U+U`W z{^%K;#EnB6q9)19EG*c_LC2jdH*dHH;nqZq*ibcG91{m~K!It8DGzFqRn_7ACy=tF4h@aPzNv8UL@+U<_4kBWU1XM%^fas|~KFEkhBu0xh za%C4t{ObfTJUu83eYH7QGDKY;ydBOCxeWr83?@lKq3+-az5wk9hf5BC+X8(mO&det zw$mzTDEAOm+IeS|4deihmaKv`Gui7t4am94Z{|_Aqz44oYnM7cXtDX_D_{)6saiaX zq*%BD`Pf_B-q)8LlV7L)Djh{piJE1WXj=O^{Ix!MGNP{7j6ERRmhOCKN9QCse2OB6 zD-w&lBP`u2es{S6qB4E)mVD<_hKdu?O1)v-nUAlu{5IvQ*Dn{t64kedTIS&*jq*0} ziUT{wr4~wi27O&q=4kY?bPQts5$TJ4auwoxrgHwQ%+1G&q&+n>b4pEgH_mX-9RjmBG(qDR= zqsTjrrCXi~yG!T@hoM}!N=SGDm?kPe26)Nt%Aw?Ew1`pSG3kvR^FlD+WcHiDemuf8 z0#R>h-k>ldb~!>p6M+W%J=J>FR8pW6nJFEiTWrv@Ks)bq#BKUah>y$j@@HT_Lc|Gi zXm$|Z*Hud~G0Pb1M0#L5m0@Oc75CH}>Xr(BR)+IMHCJ`g-brX{?Q~$)$RKX0Jx)f? zX~lU|VcE$2N{iyF7=W(s`SKvTA=qd%es_d7Zq7G2CP7_!Y-^^me)Tw$^0f~Vs^kkr$hE6t;PKM5Hf9ae9KrW!C zot?2w<4;8p{N-nQrhl6F@8MAB|^YSC>M;8oDK2UjMe>HJ<+2j}!Xj@7<#j zv;L^+YU)tVtAeI#!6YUNlOdmY)06ea`NA>Owz*bdD8uMsU^bMr!OPP9rtxWF&=u7# zeOOw9#oUBj@`R2E=jxn_5U)P0KFU{3CE&B?+R(`q0k`X@6`#{Z){+9D3aqG>T1J($ z=n=EwL#?7{)vQ|W;l~x38*aMSe0wkQmjfAY^bW({a%HR;VlvwWlFFQ`DLy7-&>e9S zRu{@TXKkVn(lL#;*U~$xSEtACrsToR6FMl@g~UqrKe^Tt4hwNxSSF$%1X>u{8*3g@ z*?iTsuc`&4=icpP*Ac;i1CBw4fu@{4%dIejbsJz?6?Z-?^SAJMf^OH|)os;_0uINl z@2OkPsO$|E^bOa}r)m>3hLter6`Jt5*XP`YLm!=}919iKt)&Mor@v3B#TL+hZZS+T zBlPfyh{R1BN6-6pG4Tv1aXt%Lu)Vs|+>2_tC6Tr`9LJlNbps*zQ*lYQ`hpF!-IeY7 zum)pm4wJPn0x;OGJ`Blc^;x3d@tb8-zAC>^3W9i@iV?Bvt}T+-0T=kIjLf%#>5=++ zoP*!(jB9Kc{Pf!gxjhU-vDh=KJBy)?G^U{u?C{oBiJZL}fY!Phyp;mv;?Whz!0T&jRyP6_sdPQ8o^;G#wpHtMsjJ|dA%VdRttN59@LIHN+@usjT z_Qq`QcK(8IFRVtM!W~3`gig8$2caXhxY*P=wIe%(I+!WH!VAM0tFym|aV&fCsol8} z^6ddb*{gvkEtMOuW{&sq`>_>67kPM&n=W(f^f7Mmf?IaH7CoAqh?5ih@N-r5a!bbN zcz&wywr>quG6`MRPiA-TZ`8797|r$ZkZjDr&LvaA)*63*;_BWmvblI6;H~Sb2BGa^ zSR%924xN3P6t*kpPM+lQJ#{FKkjz0H!Z9SKaJDmSldTsg%j7lithFE1TWVj~gN*Jmh38oBe^Z4VCPb;)6-(5#%5W4F*0J`1-FLs29!+(; zL%g-WBMYO%slg?=Vc6i_A;poBcNr83m%#DtYPU18N_nVzb_aQr&6=7lMTL1VN(u7bfl zrzdF98b~QryE$E>lGE|%`Mdbdi82WTnb28QMiPNL!%QmNl}YFeB3K>-&6Xvud%vB9 z251)n9R;hYtE;23qJ+JjfA%TW4Cr8bj6(!H&s9MqP5Qg|k4Kma@JQCjiV~A0(IzO3 z-GLKR2k;rRV84(0bf2sXga~YI&y67;nuzt6fKGE4n!yEgcyDbT1>xv#+kKEw9A!Dl zv0*8y#kyM7Gu+G6QZwCg9OGj8nTQ{v2bhtmh9cu7263QnK`{H*&6vW)57xxo9LsQl#ZaKJp8dJF z|FyhI17~43%IJIJ*3O(ErBOH7TkF7Oav6JOd`H$AE}H5?@Ivp>J(~PVXM4lvKKlo&+TAbj*5fD1@6@=i zRxYWV7Zr8`Xr+Vtne{y^WR@Gp4%RcNucN*ss9iYvC(&9VLx^RJQCLD${7~)sBgl=Z z9I2jCQscpp;MCy3L_L%w*|vNekrhhMnpKSrbXaFhR2}$e_wH(BNZZNbMGJ=3YM4ekulDm7p5}>zyhS6uHnrS_+V33^ z7HCRB@ngG)yh}QsWpDFC!n@y@(|X4POxBK4>6)HF;qZ z2DtN$g475_4C6qmk3>Ubw`PP}=0#~cO9h2H;}9__H^&cdV;_>aMUXVK!cv{1lv1pu zn9S!OY5TI;293c$=iA#fjn+W*r5P!Axj1$!N@FVhde=xQ-~NL49tCmTOn9?sc(yML zk&s@xqb=G{?Y;%t@{J7w?e8goy`E7aXV@!H%}Z}T72UaeXc6#`{xcBdNjBL~1^6YC zFitdrqacj5<>6s)v*ir8UY!2gd+2_*0j3MpFYaJlFT&775xLD_Q(W>lCuw7eWvn6gsy&j|J`&w@t=h(P@hODO1XwU-{aOm*ZgeK~yf*G| z$ul|q*?&p7KdF;BN-A%&c&I^~Td(!>SKhJ>p|Y0aZW*OzxM%0e9M)b9$ZC6K5=urTDYd4vM0m(poTCAOdGoG~~u;N^8-< znjj7Uy{)zt%53I@XN+6MzVLRY0IjM{(4ipflOg_vXF-&DlDn-FnC5Bk2WR}Da{-CsCNCHdQofD*Viw#VPDL>FZ~L1I{+UOZxWp*L1dQI!sd8u$ij(;RfIT| z74z-LKYM+xD#RtGKEC8t$6N`U^w6-+4xu*4y1bOVmPy=^A&VJo!TdDOBj6QxqUWOV z$?80sNZ`|XZ&=TL%yL7)fCT37edEBN6nD-#?7JqUfTF4P?Hvau_I8vKr_82tN^q zl@=Es5Jh=G`|>h(Wp&1vjAN$x0nLu!DF%$_D1F z@Sj3qod#0VPM-@#Wb~FYv7BR|t5&StdpaeVr|k{`i)vx%(Z#P!4Nk~cj4ccv=VfXv z20v96QsaDkJ`j=uqj+?rTW`}v5UFwWT+HrJ@Ojl;-0DgT4+c}&7(9j}kEK+^!oq`P zE&xd^NZ#RNFuS}EwGQoNVOo?_ffVo1&)gXfyz4mllQ1FE@PH>`IAE#5%BU%vxgP1!!v=-T4npet4MS z^Cpanw%SBe-L{0>h!$6qwKiWrLv%$(BZ0-Av_s>X_M0N}+xc>w!C^cFrjI6Z=AQV@ z)58@}9oBA8O3?va`n&TzzZ`wJMCu zH|;z7ADNS0y%(<sacg{<#& zA`$l!MCYXc$Td{w85`EmgQ(<{`4k)Q+dN`g;P6h|8*t z2yzva#D%UHubb(8V*3V|!tnoO0g%TrT1>^&Qjp+H@ycZd^=W{pcwI<{QSwAo`Lr`87KY?rl1?haLqoK^sW3O6zKESpqbKXN_{j= z@<6bHYW}VCp7&bJ?-aj+fr#yHlBk~|Q}%jTA6$?!6C{4+0w56^%D3R;dbV#Ww2gzV zBgM?rO-Vxn!4%>gC@>x`*5kIF7foWvQd|@Jl*$PIxx2eNkXIG1h`osHX6`!~nQci&Fc2>nGCf3WhM z=tH2^Gp~+L+?Rf2LXg;`rKW5gOiDu5EiK*tvEVqR{xEj7z#5@5;>$&3 zkyj=jE{knCw(W1>Q6#-Gq6W)uYx;Heumf?Na72xmr+-e>=C*6u&CdbVZsrwH*7YZ%1q#(IL^7PJaKwcS@OHfVRSpz z;*LY6in!0})EtMbQ%pKG!?dTsoR23p+sU#opXp4^DookVINa^txfS12MZnhC~k8_sbKD;Mh23wVFM_M`e3eUrVLM-qhI4WlzN@(qTJ` zJj|4B<%`(Z)*q4*@(%XhVY_P7Sf4GP_M%rAy|Zhf`CKnN^nQaMf|xUlmof)xounqj zr_Irr-*>kmLIuIgtk_8Pakwp$NCi`JxSv3x8!m7TI<1^Fd||3ZZiLc6{lKjEQSsah-drYON8 zmFMX7r;eKdMCYhIgMT+X-*;eF%s_mZj_@c8R|DmpDvEPjH*43@x%txkT1BMIu6cvO zJxVh@RrLpTXehr%Q|w-*UpgvFj>~23zd5hxpWXhXE9%Qh<1#Mz%wY7KMHZ%$~(=fQ;RY0L#M@fr% z^m_VX@O?jgpwBmK55+>al4?ft21E~Gu=fw3Vf1(?nu=5+QLhiwtf|CQc!Be@aP%@( z0L>3EmE%c^max?qbFpJ$!Q6`U>eTt25Sa!A@%~h(a10PFZ;z2GK z7Q$ktw({G%$)RcY9?dsyK__JOHm}1EK=;_Sm##aa{SV#+-Aa|a0RZ7N_26yW1un9< zw5KUSCV_+MCfi9bH30Sb!v!7Jlqqb*2Z)TrNsMa@sV)EwjafM8fU)EIKaiOORr&j{ z96<#0MGsR(qL)g+TsI{93rtx1=1p%pOg{C}^D^&H`MvR?)Je5PPiRb${9KeB%@r{r zY75E3b$tGfGVxHIU_x%&D~dh#+aB`#+1H{q zt6$l?X$ORb>O$jAhkMewi@;;joBfqA`RX~ zk`~C>ns1p@=ut2AvmArS4-{c*M;6Or4076ELOZJu?!V(es*DXF5I~H^%%?Ym&A2oIMm}u@e5yUAil` zO#FFOKaHox?AWTpF1dKwbTurOoCuX_r9f;`hrN-#NOb@kZLv{M4T%|bkoAgFzZc%8 zl{r?(GUObAWtjUr6Nbm8+7J@VN_p4#WyIA?#rnK@IXmXJ%c|Reo*x}q=^;>zW#6ho$OF%G}+z!jK z-Q5|?Xorz2FDeU;wuzoV1fxgtE@MgiCfGBrlZH%t_PLyipbGO|;7ooSB_ZQ!clVPY z3jtnpfWJqsGgh%?S@rZRx5uFP4nD0?mec6>beiniba*wc`^J_nM1xFl--G2l^3U?_ z>>?+=FysZjJ3?IH$6dTNW^VPNv9A+x5g#o$ntiFT70JD1TGS>;Y$v6=kLaCj$*^9a zBGs$oU4A>#CKGTjoc?YnaZ=tay1``>@5MP~FIIw$`i#8D*s`uU+5hBz{qf?@Gmm@R zo7g*iBr0^dzt$5`e)&^UOWx_=^|GGl_mT<;jMC<`1xuc^ksO8sau-YB3zXrR)DRJeM-JOCUh9mYDX!QSGZvhU-SFsq3e{;-=@;ro>fJh9nC^8S?LcJ~s%`LdGRmEm zURyRUnJ3XxTfq@Dup;E0K5?a$Q5)!CMDnC0JNoc(3V3h2eW+X2cC1wLT|G|7xl^mZ ze?OI9B+?FRyRM-9Ru#Vm09VFcH00A%hfpIC5EFH#7!6zVNuxzWo zgY5P8OO~S zYECl0cZ>1eu$E(qq3JyT+31F5@OZb5yg`f=Tk(+AYUt&&x5slu+*<7WTtyfWCtU5v z6jD|P-Dl_<+7xKw!A=xg_#0GI4}jS|>ipU~tf5^wOwH)&&)-C2Oe3d-Raj7Stx!uN zj(9^$9jSxx{I1%G0|!U__S{yE4NZ}hV5<-vUQKifPLb4pV-V?POD0qsbhthHa?EDB z5N7i-vdiLLMCrqOz8oktuNSo7&;QMJs!T3{dnlhwAD_eXOydvMA=VO;V`6zB7uYQcf4n+oFoEJ<}zg}Ml?T! z8+o)9&fA$=+7d!Kg8lXxb-57Gfnov+9TFA^a!U+%_XOm>g$Q8IAxqDF@YBcsYh!0c zn~?YkeLws+FYgUwQj5>zuEz1w30ul7mkVQo-<4C^w*e$%~sZx^mg-#`8E>)d1f<_splUC zB)|~aX0{>DTF$ydqQ6?qd8x^&iGxc3a<}~4O6_vL*L@F`lP=_|ES`SlJMhkdaGPT` zA*YC;Z_b-ukqx&4RD{ArF)5CUU7>qt8m<%OHAjabZVkA;t(L`M_yo3e&9+6f6zqRA z$%}t%Za#9!G|0+q`4xLBxtI~EklDLehEhKl{?^-v?5fNUWn3_;qx8xCYxUQOYM~Rh zQnGJ?X!92NE;PL^5ppu*B3~{Kox~434)J7&7``-mAHuPj1dqSwxda5&I?ru1V4~2y zVNpbF1T*ey(?$BHDe@I1m~dRl`!3?nveiw8{Zso&nb6)BP5f@zF^2fmt2P~*3mhc_ zShrt8*z%mUmen?!#E-Y!-?a1lV=0=Bpr3OMJKSTKS?q&5>{E4~yImc>zo+AUQQ^e* z9@&>3EJ{O}a?1a+$p2oA)V_cU>r4F!vDR}f2q)*>4ZoK1b=FWXlSSdR#x7%!iMLcPK)ITyztz zCA4K83gq)@SLst2oW$@fZ-&JA`F3LDm+^feQpnuU_52;^c)IaP7jkS~x(|E8As4#D z&YdbN+v2bg@Cyg&?&dh>l|c*YkYjOT&(wwV_~OWR_|LEhFDb)13w9RgmbP5z&Hdg& zA3KoWW`1xMOQ#K*Ef-;B^R|Dc@pm_g``VeY(fj;c|L>_4T}59GqInV;1Nrv*e^`ci z&S;dm_~+fY!m&flqPE688j(Wgj!Xi3U&+-O;MIACZJ&wOO#}JM=1h_kg*zqy2%5-0 z*l2Ks%KMBlN7w6A8@>4K(&GBWLK*X3xaa1IT+MU3xE?6O0fTid!%H< z%Y79tL#MbZ&97&#{mYjo@N0N^;{-|Kl)mIq^<1r{z-d}e2{71UvMDz54HC%(wUC;o zh^Nei!$+^&GQApIhYZh66TV#~e?=rpsDJBZ>{hj1uBJF~s#}x{V=YG5=w~?EQ?%## zkye@|gm%t0TCN6hR7=JCVX%00rRF?gup4X%_ubg(Dsh5#UkgvR9fVYaOoYr}N`mp^ z`iNI#+np~68Eg55zBM>q80S(+hY0Tdw9>Sm9AS@=pF5I{rFhjsr3OS>Vq?@fZLJ$g zn_Dq@$BzAvPXuQ>W?3k4;u>E@+&trD)CpNWbyZ31TC3?PQx8tRgaEfoP5I~{>g9=o6+}g{-*S9 zr@3#&ogPin6YCSXM!PwxgvV4YAXk)u)9Y?7RrMd9QKBS-9Vyh=hgZ)(S_{D-RJ*pW zqKchqe&~$D8#xg-z4bH>iJ9X8nUjI- za{edmatfm?+1{qZ#)0|*n3^He9vX-OeM&E;Wi`A^b$yjOZ;b}OYt;tv;~F>VQQbYd z2t<;f5iiLRo6x1^$sG&m&k_8#c$*!fmhj7_ct2_`D%u(I+ec^5Xbc}U;X%rzO)$e|bPJZFBCssfhzYy5ZK&j)e|w>b+esu*7I=C6Lv zy%V@>3(<lzcx;rX!x>TH9<(^k1@QVjg#fpjA@Cw~ijmj(@ zv1b%blHVtXtDlHMvuEtZ4}vbPp16pFTYJw%jx(!iLMyju)y!H{xtyFXiea*yhh;qg zWruus`o3A4Hg0$@2bXO z0wif>9W4DW50!+xaqcyVS+cgiC{>Stk1KsGGrt5l-cU2|JU|92w@O|Mhit}u$n3(Yrw8KF6OhLb#W>!)5glx@tQd6W zfW*b{X_|6vFHdubi zWQD(7@=CrYV&OS45Mayn|_09&4nsDrhVGK6nB6a)m!y)~tA^wuV;_pH z7o+=2ec=qA^u2JO5i}iYN`VE%SF7Mx{n{zK_bNGW9<@tsv|=#;OP3@|GWoQ2RX)T# z&as5NTB<~CCswX}>+;F7?SLy&tI-LFwB0kgBVjQmqI>DWCcPBv%D+Y|GXoG#enZ~9 z3KRsBMR2;aol6Jf>c&~Pv$~L^s@NAUj?oG<)7@VJP`Rvi*-Ti?Y1UJgSm~8~J9C`; zRDV-W)TzdciH3HPpf-*pI|?k1K%cqfA_M3_yH%~r77c?^Qlvs+wTHSKP(f$4_HUVV zmYdpN*CQUb-`a2gZ*>kJJJdu`lY;K7lamg1HSZ?Ib$7~fE77okn)}0ub+?dVnY+(y zPlm?)53hbaQv1R{_^y;Sf)!EmRWj^h_rp#jbf|oYmWKh1y)I89FaxT6HO^OnrJK9Q zG!nQEfBEhZUOEvr+kt2_y=oZIWFYGkj^Y)85WUduDkzgz9uRiF7-Pxxwo<#3*_v*7 zzViXW_e3^CWM39dLpD^!ylpl=+91F2c=_Q*G9{e)kw3V5*G#$d#7NEa{FqPQ8?4av z@!$F2N%Q@-5X$4bip;z?C0SA=RtYQm{q_+w{3^}w{#NWvI7AJXK+w9?GAkTt2{$BU z9`Sq$E=tj^Wm>#zf#;Y>-<>?PIzchkkJhlz?(GJJhxb@qz4KH;9GX;*G;ffFibO2F zx7R9O*>H?X_ad|WIsW-OGFqeZU*5~?@L6K@`KdQ?eJK%u@R4bSD~RYE6$rYSEbnJ= zzdMyqc;Yf^)(vV{0?Zp^>o|`U`ujIhJ+%MVob|yA=@7a3J5E*cwRi3iWt+z0XU!Z( zthHBZX04WlCekF`j`v;Qz6@E4v#x$fgD4rPE||#lRZvN-ohf^7X@{e+i-xeLM$%4B z#Cg@fUktCevX1j)Q&d7IXeeQgF?0|N7M`lI`j;@4%vy16jtwwG=$7M)`IJOHsRn5`{hA0xA|*H=Ui3o zEZ)!nT4r|a)Z4JCyM`CvZ*7zRb*16;Aon5Y>Wd69zr42b5={)4#Xptcg6FLLZr@|N zEVq#oyVLEdGal1y6z*vJ2=<=NCFITY)#h0BF)e+32GEFpBmB3wW?5dpj&oQ z;FezbFRdSw1elMI3N~TX!GMxhHGbjpq!k3!!on>gPDia?Fg^*9+*8`e+lc5iG(0r4- zMTpH!)>r8-B2v8GG1WQm#5P`GbTqi1ES(rI1Olm=UuWV4a%UfqxGB}V={)A5t}}UgDD74hs{C`RuadTQUA2${)-G)cHs1>YH`6o`PX&v>GCgdPf@=kNsISiRk|FIQyfloj(!Ut- zfMoQ@R;keV8@!45BA7QXb6X>O){yP}m;+*V>DZnGlaY>v{Z;Yfhju1#(|;O!-(5Pq zC7~CgxqHI5ao}t^PoqGEF0qrHGlTD{xvGEb#H@F?~w|s zVhF-cHmRRvD@5#Aj)q@fop+4&lF`8&iPtCV!X5`x2vi~N+bd^ZKGy=_Yq{;%=2_@c zQhav%ndHDK1!VeZ?byInAXwudSMfMxxp{U5`t9w5hU6mewjjc&VTLf7xIPLrv3Tw* zIXSM%>tVC(r+QUY3xfYNH2|-SyWPERqefNFt3E5fQpVB3DeOYw5JtNT22gH^~SF$k$UHe%3l-}}hl zulnf$$G9QGD$XBZfWNN=(;Aqj{dB%w{1HF<>#9Ng7yuES?YG1K^mO>^+kNN3@X&p4 zs}cGC^~F)imhMCd{ND=X-v^vZ9_wGaimCu!KA9LB7Fk`5aZU$v;HyvY|9t-+;{iT= zZ4Qd#F#Wl3S-_Qe_?+4TLh&aEydy?n0AAyxIGcg|IpNTNnQ|t(fe1zr5=jZm77e zH}u@r_SiKk^KPwr$a9@7OpxL)dn0~{ z3nFkib)L)ZY^7o5nQ(6JjyA@WCJ+O9gC! zHA$1{Q++;ma_O|j=Z2WWczvAg&+TvmJT34e+T3Q4h)i$y`zN>K+5ji*{PHqz^YC6H zdmOANm`{H%qf_{zYQNgY2J|C;DZoKup~NLGNc3OlS$=Tf8vjXS>0AZfT0q%G2G zm77F3t`Ero$Gyo+ty2qZ0HgxNZO_zgc+zmbKOyaI0!s5v;M`c65oj0rYA1NG(i;U@ zgvf%_LVDoFfRRoaX=yTIE|vbhP72X3_owdvoA>ZCrJ>?Z*l)y--Md77^r$W_9BoY7 zI9V^XWz(c1pt_$g!lIF1VzX^;>t_BEM0`)e>84~k zR#seoWDk9K<)LX*EySqiCBo4t>ubamKe0ZtotlYo)BRl~LU;Bl8K$&1_(u@#?rfWVp%aSq+q!4h9=6lNgBE3hc zEfh2;yo|$)Ch?S%v^nFffL_Z@yB5BRY6gLXbYN(?!Q!BbxfijF>9Ev6z1p8rJ(UEM zz|yx4P#~%-e>cg!x4Ro&q*E}cG8_7JZqhQe~JFv7S!v=c~)vp|fKHZ`>3je>9baPl|HaYb|- zaz>Gx%L;NqS7k*Ies`NG84RQoJJlNO<(utSmB8Z@ktMK+@mISGQ34ttF_U{#I^F&r zW)xMR{m!y9l{x;G-?*&&js~;2k1pp3LiwNc6`j5KxP^O0hNJDG!W=AcGKf>R+wlZS z8&^>OMO#z9K&g7aGxO(7Ux!>g36t-#beTcF%z~rc@^L(}y^*MOO;(|3<5$G%?SuPS z;g+0d>8$T!U(L$1(hLHesGRy#<g&cwZm_Q8aM1}&L-;X> zS2Y24DrlXvRYM^N&zoQl@fq^+IyQr~JR^FO8OLFukNXWC@ESJl7lZjG%2H6rh8m;;0BE3HkG~VjA4n3 zX46s62TJi0B}TzQQ*ftgm(_Tj*)wUCXZ}CbePvKwTe>#x?gS4KoIvnEaBJLMg9LXE z5C{$dg1fuBYjAgW5AJT?=A1Kg=iWPW?(eUvs|y-xclX+Bul=s)eT1t4pkOJa^LtY> z6C8Jk1STk(`*&hvyk>oP%lfy6sMcyD`t77(Tlps^Lu7UEUjZo$+b5;-!|+ctuAm!G zKZOd?JJ;)9P7ganTJUV%V~_sVZxGAvQ|AU>$Zl5UON&yec1YwC|s=AdnGxl$E1Cq{u(sAY7EqH_eM0Rybq43X@_w{8{195UrIxh4T8$A&) zY40YMLx?^kUKYd((mpu}Sg)$aDzwqJ&>(7<#GcPOjXT6C-@0VI+jVkh-r)AqFyee!*@mRESumS-c#blqt4WY?WU{9_ z3d*CLr4U-(yuYmw)+PIGGMNz9T`(-L+^h9nW}w#o5tFO(?D=7hZ&6bO`B~}l8Kgksu?2HoL>-#WGQ?ycF;65<5$FNFBR{0iE-$B!Hs;o3;EvYT zF?_(KE`b2B1a4&4_mWS0ij!<^fCkcZrMbcB<@+ZmAcM=ob>sK#@DI&my=xc1*q3!P z>L&JwG#o{|o#huz&!Xz9{|yv@AxopmsMiz^mR3_k3fi`zpY`8PE~lx9V;6VjS;k z)LIlw+FA-S>%$EQfzM|M!KQ>Az#$|=hy%*y9Osi27ON%Br0!RHGQgA%IU9+YC0900 zr>Xlxtu3k$i7oxB&sg%u8>?K3V&gFwEE=0dzZ}~axP3RVr!Y=Zz*W67@#8*B03bCq zRn_|f+~7VLEVZqPh6+ObnMxH4Ma<_#gWa1ldt&Y)rfoBZg?jFO_35@du!@^*#RSvw zquEW0W3Qjs{ZsvsPtiT^jJkSEwfsR3l80KNu(`)tOZ=P7y4BdNAOnf{Vt9v-ea?F` zihEjQek--l3#AJJB+P-x-bOy=apa9B*gdJ3NMW1WI7dvp8=o1MU`2sXjJ(!31c zypubr$}iguJ}{8Hv%g#UK=WZIIYD|iXLjnMu|eZW2el4#-9r$X%s~S6`z+9Eu#}+b zkny`2=92~2P4Fkt>WBGqMY}EkenGPQGgQ|7FH0TcK#~J4iFut89%OsGXp^7n6(>v& zq<`r(R_Nz79@F$_$Qc&BBk2P6bstl$wIe);C9RI9XkvT0ZBgqpBqfWO`yW-voEg1@ z?|Xc%kvpt?P@x8pZ+t5Z*E^g)zrU|jMflNNu<@H`F{U!hz9Cx!KhrtC>@q01#%Q9n z?n*^Y1q2S-(=QipZFum=E?z+8veT9hR&->iH&lrKow8q~c(-NuG*ZRCD=W8KALIE$X*%dN#qxjtF$!Pn~&yp zlDwh(XvxTn9<+JUAB4_9&PFPC4=7AeV>{HAzx_2Q6z{N8=15DDiIT-WsT#-m1*GDj zo|rW1j0P}WefM6G)4lHi(eRL#O;1iH<&{O-tyd%;M`_MHMvK%I@vVh{n16~s1+Bh` zl?7P*;1vhU|ECQj|0&+t-Z-BhG9hJ|rkJ#1!R@2?TThwYHKN{AH< z2F5)ba&)JoC#+U#_z}nlAGKbr(cAfXV8qE@T_K43d?VY@kfIG@xwH=3x3OTJ0r_27 z6j6?VZMoNr=c{Ax)f#Oy$ro4<*6o8BL9DCc6|CU1yvjq~b7lzUH zeGIl1YRv7{+QBVFzI)FA=FGD^UqT*FClR30VZP}*8Vo@=J3NZ={h;)OM4I?jGYHUDc1jG!K%~1@s{4cjUR{|V-8+GWjvorMi;qQJhrOaK+rU18*Yo-st zM6-2T++NMxUtJ1RLSG5aWdz&ki&>se_xJbTjBpIDd|7{U(W~p-86AzF%#vXthlPoe z1l|ks0otl}fREc)FT_FAYjFyMP4aE!y93_i8vRXxY5b7_DhNYdZq{9n5cpQ)<)wh4 zF|G9m8AyR{g6i}@24w+nop7QHdfo`?JuD2D{`z;r8-q#&_X=~h=1)hqo*wuL$# zneY0*p|aW1I0gA6H}7Gm@?qp&yk&Fc0v^reN+#%L$#0mYPwA@kZa6K@;Vv}DKoW5p zCf1*{=hwF%&W3VV(LId#^)rh5ICgP{XP*;q@af_}{QpZt^#9yxJwr|QN z23mFPf_2;Ju*o;7YXxc2C|g5o;lf&8?8|4G zeA8sf_F;^(s-QKjaU zNf!=NNqL9x+{vy^3(gFj^f&1Xr;TL3Lz8jEgQ}Bb)zi8b%Gj}49<{M5(KtGO zJcYu&a?b8Dw=HzuNvsuFa6XG}clMnm*!NJpp)x?|N9-H$k*Ev98+`F@;YaY94j0qi5`xCp1iS&;$-pKsb;BrboCJC2!BtG~|=0#_D# z?-I1x4y(c{7tF8c;ZxfVQ8msijs(Ad%dBTc1K0=z0Gm${!0k29`7fP zwcdHB!||`fbwgkUUqc1+P!l72L!dBLlbTNEPUC>^y2QSsYQ2-Y>?j1^<%#}LZ_OVB zA&CSx0FdQDWt-gJjG#&#C7rdo$2;QCp)h8YV=dbq)&X~34hce@9Q>NoH&?U-Hr*E`7ul>Vg?EzMXLyjJ zjH^<$>-9jJqBETEOT_7!P!UwXiQ?rECqIoTlMm@&>g`>smw=omG%7+{`CXOo)+rgp8(nV&jbSz?RT8bzH zkgJ`hdT6#BKDNBL8o3^YKo16|uTR~V9$0~0Yo(eUc*HGr_ z^iON^hhmKch*?P&6DQV{Zv!_)0+(TuR^l)FG=}^?+A#|pHdS;5YWALP{VYCS$RcI16HwoQ=`we&IG3AK6VH2D^xa7;MX&`{eacio1WF0cQ zRiUvrvox$GtvQNS%nI0^eL@S;WWv3W3KK;At?J3$r{}~N9gjm*Q+YtU4l!0{=ahz0 zPt}!zG)g-}^-SN*a$`wA@gw+I_d0Y|2un^iv_I9FG?H>h)=giQrenq2PIZV>57owh z9PSv=vx%;kVVR;4Y9@)yQaBgRO{md~92fSdD8973qnqNI7x{t7s~Rh2vuVu0tVD#? z*^-oXG1q9Jv@G+JCn1_iQ=`^$wE#6kq1!H!C&5&UftC;x`>p)CssRZQ=J`uF{pykK zJm4NvGTld?QWaJI)4uG{yd;}m7Crl#Nu?Hh)LoVlxj;@wXk~q3h8|7M6jF4{fG{g- zw^35p83YQY6w!{d=7l}g`WI+<33Z(L62i;N{4 zP?TqbYxCuoE+;p^5H>+isI?w@H8ml5+Kciw6;pwd)&|PXxgL z8aZlg*u?t?R6qX=BmqyPkzb8aRr%ku&;;-$JHT@FJ@gw^XSlJLzQ9`LrL$JNT52kzy+md~HmU^~LIuR$>9`BIzU(?1r*>0I# zjwMT4Y3L5iTDeXPI0IR)r|NTn)wR9IbzhkbV8wxLLO(Ved@8p`LJQYZ|e=N zNKKYb+M!1c!^zMs|Hhasi&)YRDjFY8PMGWS8v3z$@j;CRdG&#uUHe3i*UR%cuuq3p za7mZx!s<)qZ8{EFe;)iY2>9!iX*8{~OfbaB-KKkf1#$y2OU&A_N_z>3+KhgO{-c3t^H^k0N5ba1=KnG&7nYWaHTN-z-JccI&=4Fid{>i zLje&aDhZt<&$r~#!Hqma_&X#AfU6~k;+bpCF=r?I5OE=BY>~V3j1tC*VY|VTk7#rR zCw0CItgQr~0)ei7#I_SEISaICdG0=I%`A%SW{$zs*3ZOQe`d4k1yGa5^UG4~qkGs~vQev9+E z{wlvRiI=;SdQ@W|P)=sanQtRJgty$}TyG&7s3qc=*2W6d1O=tS$pmwf<72{lzM#l> zS=5*wBJM8}4fswzodW=8AikphkgJi%mYH+$uY3;H!BOl7JN3-|!xPIi)L6$%ri4iD zq!=>s?+3L$po-e%&7UfP(ejv_dDPo#4=nvd11L;JmQ`0vmKQb`9Do`nK;# z<^H=lY=S#Zf>zpCcf7P%&MN&}+wFD$^R6_0FC42%oa)hDHmtDSIKE-R%TP2w(TcXxQ2JNa8}=yZJlZA%zC70nrvTt1-1jK&Km518eLB{r*_8?0EDmhgWW)2 zHJ_1c>hnhRP-7cR9s+ zE}9F`@o{?mw;ZVZAWmVM@3<=P!I1If{_vmb)7H3qo?scTNb64o))DA_L}-lq)|}AG z{(%yq)xdW-t3aNDMhZCbZ14>Ohn-b&rtoqgK5r7;#wY&J6=)Fl`N%l5(A%U}7Q=Cg z;Yive$cs$}Ra#9t>Ab2u+CDy1T68HBQg)w48L7-?G|kLE4wIdv!2b2aK`=@!ve0*4 zv#|xZ#4v~Yo@;r=^nlWq5(D)_Ehc?FnC@BPvly}iYf}yh>Hx6iR8+{Ok>Z$DY2pIU zIyvy6bs2bs)Iv-qam(#YM95=-9~|in_1mra8;+$PAH-p?Iedo5f7cm}IdAzvO&fEw z@#~U))}qPWFeOxp!a%>t8r>)0u6MV&|7_NMY57FJ?dIHT{qo%{Pb?WpZ7BPjyEXK3 zASJlSuqk%dc95O2Rr0$|_Lay@9L7HSMHI6Z?F0%IlN(;|BG%9#tqWJiw)~4;xUbgz zCz9L8M-wG^EUtNRTx+~b6&$_CAy=}B{nkLbdz2S(Zzv0u~P1`CdoGFGF29oO* z*dv}>W^}RW&}^?&68fwbUQC$#@V|>s53Xl_GRun$#^kM5fZFA{ze%zy2&*rSNFVu} zvWIzlu6k@8@Pm-t{hBC(*ZpSj6#et1y|EG(t45%3jBfA~01Lxmdn0gZZJT3T(1}?a zVP`&9N4*Qq`T9w8awk6DM!bY|fud@K75lgJQ-Z(+U$GM?=6LJ9Wi^7YKi@r5w5)xjgitPd~lk*G>mJy)FDZi#3{MMxS2wkaJoCRkX3vb&@y=(IQBeN`W`q93M^( zT?T!^!pQPHGl|`2N{$EIjHe)&_9|}utr)#oh?eJRnsmyN2c?Z4BjgttS{WHkbjCl} z`_D*HmaO&|2;}~@4oCIwm&spqXQOfrbPo_}M#1W#2+T;0=I2BYT>4 zABcEE12H^OcL+-yWWFs)eZXxTwf}i^;JWMEKfC}Ayid>_CkGU-baeJrC*8Rg9wnsR zge^>l&c%2_4CbTF%~AQV?Ke`Ir0a)u((k9;*4g%&9&?Y)zrQ^;p!V82+T<_@Cp=1# z+?TnE=;9-px!cE%*8Su-XfshuXBR)chm*8$ znIs0W%5Gk&G}4AJaQ02zkpNARfuF@AP12=~r(}528ljI`ZHXss00eZG1$I}f-?`Gb z22BfT;KMmTO@6v?)mDHD8^K4TD7Q%_iAC302c36D0<5a)1o%2U7`-864~^Sn10`4~ z;rpwVm6cWrt2|M6$>wECJ`aVr)NaYJHPj;Fg%lNAYHdpkZ{eHJV0Tg#!pPcrdLrKA zT&iA#p8HkudqX)AA4sLO&jJiI$5*}UCgw5ov&Kga{s_0<0+^s6Kidh#du4b z(Gx#C7&zh`AM%W&ysXA?)Oe2#@L#d*f}%-B3!v(SfM!lC_vYeC`zWX(D7_%?I@O-F zR4#!MPLNOn$G%`q-rBdf;E(|s=tIB!Mf|cj$?|W2j=WneyAS>%LA}T$_~p1xW7czr z9ZW~0Wd(qXFdRU?BOxKNb#_+0N!D9&pr>2ohMyz*W)8huTVierpex+QBY-np&6QX( zXD+U>rgFzV#BOdDPwjxmZ;yKGwS@qMiP$xbUu;A=Pe{R#_pl*o2M2gJZ`EenF-BK- z$7jxLNdCG4zO^G8t)J{;kdHN`ZGSvS#B5b?9}p>d-_hhOh5h9XiR78;Nv!QOzhiIr ztYMO!y+freaZ2;vC1e51u@BGlll?_|l~F_b%$bfAlx&@6=rH@5FP5@Zgt5nqm5+~+ z2cDj@a%o-hp!!Y+ci1##u41~&ThY|DP!2rTA36Gadc%F(C{JV2uqgzw--;mMMxGCR{iIr&Y`49y%$8+WX0d$DF0Yhp+dy96<`C>2m77UWjNHqbk>EkY~qw8`kL4@5D%iLO1wR%J@c2 zL@ag2dn%80WG(+o;Kche)H(?UW3AZ9?-zwGaVNdZ@bZ2`QV;@YaN!r6fmD2EECzwa ztM%&c#Q8Yg27z;`aUT5H@myTa*GPc2<*ndaQ|*_Zzb5MSA&;In9(EYE`o=$#l#8f{ z{MGsTv;RebHV@w({A+r8%Z#k@CgzD8xD5Vyl*@uu9bs~w_UT1yB=@y6UgwOL4D3+p(tim|3nS3?nn$fecUVM>?}*Y%5HVa z+=RAY+qo=#e<5uy8AJs!HJhhqlNKH!)Bc}D*2vu`XIHdzK`uN_eGW0n))??4jY#9i$NmX%qP z8U-3%%~~%-0Cc1TXTXwPk};W=a=FPVHY)%H&Nv(ZB&GA}tQSR54xdy{J~}=IO1*pr zrLScj%oIms58@;p{2CY~S{MXeB!?el2ze23+Rs&yA?O)X2m|3Nwcb|U}zAs@nDPb-Y}kpf_R*xmMx>nQ^9=&^Xr z2I57r3|nc-O*L<~fga36j-uG!(w@oL`E}$vx#+-%_KSE!rIF!LA@)w=a`el3R}e;0 zUB$-EK2`oC8ZItwfksZHR+E#q=nD|&&1b_8ilt^em@S?W(2KC{Xy%ISTh@j_dh-^D z`oIEW*-aO+gSeLSLnQy2K7UT4fAj2}FF>lLZHymFlsB3TFPsJ12CJFhE~T6>E<+muWAO)MRdjL{dhdZ|Pni(URcWI25wUEC zo1T9@P+54J<5p8xX?(<8f;3ft?p@Tys0@KoT z(+?GMpEEwk^UFid*PB-H_e0ca6{*rk?F_e~ZY9#m>0ABVDfh203cEq97oxd7KQ_Du z`kwC&67*Td+$=Y-JdNVtfB3v(VQX(6wODsD=eK=GD4EBL3I`VrJAekaWQUKzkQi0* zCX;d>@aWHFys*z>RA|!i@K%5UUwwF-Q0)FNPm*~bpYU%kq5m3#c4lv;JeNSlkf$A4 z|JIWYfsc&+N*Hil-ZsjC=^q0-z43@O*-K_C1n8Ua7&KVbYh5yGTk!y1xRFBo)e|g= z8Dba^0|B$Jn%^<=dN>EVfQQ54X=1lD|^{kR>199Lj>h$HLHZt zso>jhfNU|-F&sr9QM~D7v0Bl&Ucmsc#`nF{WuKGTMQ|8&XrcKYq%_e7=%CdnwWLJ@dpk)ySj^XB}Y{+>Pm}%p%Epi9HH%T<(3zsqd|M zT1>rgqvdi-i!jeRmt622*~tayRCK+iJj~VvbR43%5mQ!FWqj5tVE7VRk^J=-O4lr>uR8y6{GRyQ6!oxaH>#V z8;GaRVh|lkYa_iPV8tLmIYlR@^m=YSckS?D*&H=J2LeCtoJVzN)HCblf9R|u` zMcI*@Mn`c<1}_{a2u0+d1NSNL=I3iF_}V&|Y-)2E5s%Yjz2Q*g@(#1p$++aHwO-DvjA`NhNH$6Aq>|>NC$l3L<{jczBX1l-lA#E;O_1#>C_t(H`&?O&V0^66=@8>`i`=smEC6;@59&5QvQWUg2o~@4V?AW|VIip#p z#ql*w@?u`q=wL74?RZMIlMYA1y``H34qq-ONV6=gZ1J4HZs#6TBJFMMrD_FND^sj+ zUE6+r84z%yU5eaqV!WWYAkrVhQhQmHs$s)OsIr|N!QTWkDe8yOfAfK9u$cG8fh*4m zwwqT5sR4k)8&b~}ttHQeE3z$Spmsb2N|NiZgb~7d$eE&9y18_axTbjXwq*7)Lo9D; zH08PzWFRuA(ix5Zu|NJd)1ck!$G5sSW4dl@toZ zl_V?!f^6lh4l_nSs5}pUM+zZVpD4zHy@TC~4RKDBcwsvk-SH~%5p0K^7$=b3+E3?U z(MH}0Uv>}+rZNB4&A`&{-P+K7u`YRMxyc z)cY0-;A`|VDND_eg)1%Je1)J$vFmoQ6#is-t1f8DbCnso=qV<1JwiFSU>MsCYGBb1 z=ywlILYO-${8W`_IL6GFK9$e6>>zc$Q2LV4wDiVUff#_xCCW^saWv_K?#tR3+Pq>^ zuAd?mA0c!kh_^ul<>~eN1f=BbOFt_>@(!Qt3z{8YHmNDaQ@+A)pGP!T7HH!n+>i3A ze^sOT9(_v-EpRQ6w{>*9F9#3xsE z9Aeh#5H)I!XulshK=Xyz0MK2q$@nQn}#G?AZD zM`p4NSoWGmwo)klD}}w6KF8da|7?>RSm4=;-WOap-bwHE87{w=H7q;Ki;e0?_zRCr2&)GUDF+u= zhfu^S_j*7LglMPOCo+g$J95yF8Xvcqa~u`%F@m&>uqW#h_v(D7QLt11Hb$)fzyLX? zf&h)cKKA=7_smL!#Ij<+YaLH|wsVSTiUDqD1Dp5znhw8PYr)JkrVN7&4(sZCS+dt& zqy{4D&tiSmX*Q@S(Bz?>?Gb+R<-Xv{Tg;>UV@LVF&XBMf1pH<^OyhXJ(Cnk5 zuH;j$masb9(mU;z7cD)8(-gZjhxKE7iS6s!WV;G1!v0iNr*yS>^(m)zNo;=2ehxp( zL4j$fyR%(KxuZig%*D_xi=!U`ul9}?8bHi&PQBZ^9%WfzYa zv{jd)O$Ll+(eR3EdIdR&ZwJ}68q%4F%CL|kP*eU)VY(3#PtN>q$g zy04x^eL*~N=2BFLUo81v-H4)_63Do!ZDzY2E|yI8Ne3k8_)I7_fY!PErq~lrF zFWE%uIw^hZu95gD>XzpvS1i&a9IeUVxC_YhVDz+1DYy+qwVT~IWe%v);?$St2I6`# z0vc|T>3PB$OKsGRI8K^bO~7;_t_Ku^Nmy~r7Y!;g*7-?kSp}5zG$#fVhC7rEd*%u& zUsKsjhn7yVwB<#-%(*^SZ&H`&?bk0%C;Y@6B%gg!9>R=LmX^W}fwCHU)CUyxn?ik_ zM%ebR6x0belk&pFk|j4@`O=0+T2+&WXcnj$X8*_9qgo_2SIKAjYu2^|Gd`0;DzD5FU`Jjn=EiDsHg{O$>Wd(hA^9~^3FTldt322g?<^(o}t6O zdHnI(1vo&ze1Pmb&-%n-SCwZqs;yq!r7}Z2290+{<3IJj!5hI+aRh`9#-TJCBQo%L zJJ)QSjKp5~dV$?Uj)*JMpzs?sy{+*V?Qt3^Yk>L(WNC*GPmDWWdP@z zAB`CSIZ(M-uAqgd@Gh;XHo4$Kw~*$xR_l$FdYwyOtv#yp68eLwrSc(aeSKnSv8-Od z59$8*85d9h3suq2%z=HV3Fl$t5&5RK{>)zbKtm&SvW2d;oTe#u}}j!(<3tTF&l#2d2*23tJpRAKlI1L7!7MI)xBh~ z4-7jK0wU9&$h>oNe1eT21YQnnNbSx0aP zX%T4xt#Yl1VYvZ+z)nI^(#YFq)$&V=(nO<@f(JFw;qU+LZ<{&_?YVC}vGYD!)*AFK6{0@Hf%xL2(NM`O zh9kxbdw!J=IIqZ*cR5=9A^IGXsoK7Q`oBXOyitX~RKNlc^vthcw70MOw7an@oc6G0 zV)f@wrD*UmdOr-Wk1W0TepM#TASJyIKvN6gmp2$RigsL#J?a>q4pA+GY(W2BRJ3T* z52tzHZ!O}m_w%46jo%QEpC~m?Pau$ zNn)!iNCs4KAw`l%dv*7@7EPz(GS{}nfD*n!m(C=Z7CMx?!GVdt*#p8bz%EBQ(N>r+ z!$1QMeoT-e6ihw&KW@`Mu|bTOp{>NSK=qnhd#T~KyFriy0xOOE`%OitJWDYU*kEnR z0mu-YVp;qc7zt!Kx5F#R4iPA@E)EPpI^qvuPXd?K$A+(4$b7-8uB5yK>f!wjg% zcCp3C^+4*nGT|n!e~^uLPRg)yT zeT!&iBHM7oMzQtl*vLXYec{b&4_SgUgCetTWK;JPv-Hr%qhgDbqq|IZ_L)7=7Wj5iJr=m6Jn zOcN86mKMjw)rkU04giLeaB&h)DN~~Y0Ix{5D}ug?&EC!$1{E1V(Z&K1$2;Oz3}*iy zOa0dYr-t(_5~Kiv2JN1QBpO@~VwK9&#U39Y9dH35A{k~+c#MU5l|)8ncc(Vl#(pBd z-R=Ox%kexWf-pUxwLwdT%148jZ7fdu&nKas6s?r8YOQdfzh6Q$l+aSeKV4sTba6og z5+Mo@(Y^72uiNen2+v1?=V&aB|If$y0~~tG=WT;r=y_e-k1f;E=x7mHuHvs$swD4p zG)EQ3m>g4;7dBXo?}ZRe<$5qka#$d4Rp=6r3a~)ahu;wh_D!*@_TQP zYgD&O$K7XUOC`S7(K6_bm59n4$mk5nF$~(MG~TvD#ns>#!>Ql8M$f-QFm${55=x?3$AP@2O6e>H#{URb{)xu{q2+638{Vh{T%y;9A4%P> zkK@+Kd-^VRN3(`9T0XSF zo5SGK!}a)aRd5WwrBfE$7k<9G>!hB@cd}Nl0RHIIb~PKCQ0cVnrfu9)JnxnOfN)Kw zwJ7Fm-&)V5p2Usll-QfjHL6_-igg;K8lCnimffEX7*$#ouw5T-D^^h8;LxCgm=qhM zms&mE30o%8ZT$_J@yE_eSO5ZWvseB6AUn)^b8&mv}wKoD_L7cfH{r zOMyyN?H0pngW>Q`%>@8Om1DfzAJ+!3{5(xSy7mKL^ohP+fItgnf~1pId3b+%duYDO zu6Ixp2K5ao?9CJ1#qP*VFb`8?j5dH=`r1AhVP#1|y>rLD0&fCv3DS0#l1`aySZkUCY9W+~a@A*9!-4>It z{H>?P+mk*HV`IRPdjpI?vykyIrOl%wqC|s}7*`_v7vZp-#xS3h5WFdq8upiKkDHyl=4+m199t{*GQ0A#ca<5!VtncswS!hv;xDS|HgSHVD=iO($IW+@9=kFrdG(dV`0u}zCx7(PsWcjXOYV<4 z9gI%F4Vv_0XdRmg!DXVqj#tqw06SsMT;xb}y*^Y=XCX8FASdwJPXX%bW!0q!FCJpQ z`fyMl9Ze%~)OARyf4zkbB4Oh`Q%c~$P5gj0*p9J)d-w#I56^m3DI@m0T7RMT+IvSo!28C-asqOwC9{#i4 zho%C-$XJo1S~sFlEKWuvUmW;2kyX{DqW?ZKc#h=h1x)PQw_P}yXO9b<4UZeE^f!}0 z6S3}wItO;^{)%AZI8_b?8Gq;0&+t0g)d$sZe=A5K<11H77?YUkj+EKB16C@LEDC>)-IyAPEtS54#p(wjr`yjB4r&b zPrG9i5^+5T2k(pP{Te(>wXI?gs8uI`jh zFvt^-O)hKSS@Hmt*+9&WB|fK3dMQp6pHJl47JMN}ZWO;E)mW}H0l*y(K_Xz6(q(#I z(CbuXJbdXGc0iTc<+8%Dpjl=7BU^s-SuWymr9~6Sn4kxe?;>O9RQEZ(ML!K1*_3$= zvivk9x|uy%tQ!RU9LN>x=5YVzmg-Fn0^7W0D^wnDakh8-p&*7{itrQ2(k;Z-SKnUs za_XzxrZap9OF0*Y)-F)bYW%8RR_Y0Vr;1F$FB*O)?MZTz^w{DU6-szjlzKPcs4N+@ zx$#z)<6ab2Fpb+NlhnU&so~-^t5=~}O`fQmSYYBPXa1h;wVMi91l6;bYaJ*;|o3rf>J*MD`7RS&(svyIFLxsSL z(5f^HvRJH@Hk&Oii312&$l~k%nsi`y+#^wA&aDMe)g7c1#BETsC0zzpQ6t;HL zygbV!(|%o94{|@ZKyIV_%UA;S9SpdOm0GLWkH?nfEsqSl?sJ7A(c9);*sPCaBNz-_ zl!9`46I(#sfrfO0(^I3$H>uRyrlG{Mys08hu`nV&GD^ufwpkbs4PLK3@-b=wb!O`k z`Wz@4s$C|nG1rmQkMDLzQlp$KJ)=F`pMUb@Nuv*y`d$GyH!RPqnIC@Rcs`Xk$BVKU zR1Q({9;*eRR1U+vd~nHofQoKKrihRS9`Pv;tOl>+t7S1pL| zv#XI`g=B*iiy$LQM{V(MZc_M(-qds}DqM2sPSS;aWV(4=9X=*5zs^-kvJnUl=O&k7 zxR&&9?cKgS%9{{q=(aPnmrGtCiXJa)Ci8o7)-XP1Q}4>K7?!|=a?Ct>^^EZO-eG_7 zeU4O=t6I^dGQfow<#2!W<<5NhIp!gh+~9PVWgopgodyd5sMLO1w>_yyyTudyCPlNi z_&t`fPzYJ-+!IDbKuuINCKgW2AeU)46fgfigy6V(q1Ljfj!r3`^fms}Xzd=uu{{ye zr*gCB2PQS!njq{TupaNT9+Uy9CJB9|JO|%Px#i~gsvZ6~G1$N{D z-VX}pdIAZ2Uac#B%{CuQw5sGZHd^&)IINZ;0F#1!b08>dK!e#dJBvrlpd*I(7~EzM z+D}TH0x*e~XmYmp;44>Vq?qM9*8fd@fBtl{I>>c}@;NZe9R&-=rkBHhN6G`K=V^#V zEr%TC%VxP97t(Qkns+A!+Zo~vbA8>_-lQ12)l&Y6w+*@Ie=B~y$1v(WdIyV<1c?4n z24gGn7K#Iu2e1yIyMt1>fnnyPWU z@<~@_y*X;GeG%`N-ucj?!+d)k;8AN94uG-Fo7jVwmxJG zI9LdqO&@TDKET=~2bP6l(_F8X9fsqbR6HrL8c)yU#4gw8Ea@3UpfXzPnVti&()$7; zL!VxN%b&tzBw1tJhb6w-rxDp%nL31942T_H-f36Hg`qEj-hMx(mMIK>Kw$-3S97GV zV&s5XM0yrrVab);z$dY~(95U*^u~9`O()sFnzW-vj;a*e0oaO2Y;*9&3aoNuP!) z3MCqB4Xzitr4!@4utxxEMH+>WGyTL!u6WH8CWnE78U^_5ww+uaFH?oobReOGIY-hDt8%|SoJZbcd73M) zOTm)=+Ho`|t|&a~0~cNx0z!@@na@i{uiIOF%qH)<+FLmbesmvip85iAx6Ax& zPz>k>&z2hvY+eEIGodV>0Q8wu06o1!8P50z6HtZ%X?PR@K2WjUm-n)KPZaS)C>`7| zI{GmN_`Oga(aduDnM*DTz-SU;!i`+{+Lm$3a)x(j zYwd%r*Cm9gbL*R=av_zKzxnttT8;|U3b4rh?Ux$*5m3n(|LE8*_Y zyH@mkj_PeU_iw2IC!=4+^?gB@?;QA!lu>X^fnudPZs_SRKqv@|3Rk=J>%7&0(LnTg zROq3x9t5yq^9th+-s;c(IzLfq`5@zQ7(*KywbdUfijRU`h!(`6G$;RRv=YpJaHqNz z?sX#JGdE7@`iQr&d83d@BjTG@SqdjN^G4S&h~#i{IGMF})4+AqyRuhfjU5q(C?cJc{|v&f zuQwX-BnoM3Yg=X{O#x7V*IM!pZtZSy{OKd-==jf*{5f)9&`zo3%4DQzH182@6(Bz& z6%wyhtMk1gFuvc~X^rI1dRJHMK0AO*9N|dPkn2eLd**t>*SFc(1u?>w-Af)v+X~7Z z1oR_>plhDH0z!5Bw(wxhOVLcBO+hkm*@$)^<=pVqyuc`Cn|=o%$a0x^; zq)B48oG49pyZo)+@NtZL!-^jsz8_G5ttBotI+~~Rkk~;omb~hm_wa<}zNtw9l_<3# zQ~qs0`N(^ySlU2jj91wS=b~b>Z_UwKY_F|n;Adnj_aU)A#^+QYuKkGO4^pEb=oKMg zw@|2fNdAW~3FDYqSP&uV?sX@=CWI0AG_xHIsFO50%CEN|8!mqPH3X$8e+}QUFCEC8 zM6K@b%M`lV_Ayzz72O#^uYT>6Kv5&cax3y|6(YoY0yZN=N*;?15qCo2>Bp7$uR;lc zdu)DydQeXoi23c7oZ&eCNGEvm{SFcVz8b8 zWiKC{kAJU?iiF_A00AXQN#81AO=n2dQssc*;|GJJvmsCh43dDHor({Pv~hJdG=Ax; zHk3xDWDrKM^dP-y?>RoeSB#_g*&7<4UKkB?6FADkG|rM~2eQtWZ9pH_C__zWBP&39 zgGHk-_oD=T>7Wg$YPdb&urT9ILp*=^rSVE8L|pPwqv(aNu}0(%Us};bwD1owL#%zJkl&lVL&mU3bxyFY*4Vu z=N%JeJAML}_BDm9B+Jn`p|Uo;VEKu%p2N3_QsGx$Ut_+RqnKZ7qthZVL6@A;4wW&Og1vO^EQOm&1 zZp)&~z-KkcsCB$lm*rdyxk$%E+(6!cI-MSd_HhQ9_bQyhg%HRXa%qpGBAXPW2s~V)m#x3EHu!fPy>RQ++^V}kuk29WOF{&vt#K5Bx7hylQ zAqv2wl-Q<#RFH6(#d&iuI#WMSHE{_3vjz$Q-3P4Pt!Eh$WP%*{J^fcDS@N+{li2x* z&+*xek*5wkvIHPb5fCX-dd#|QTV|1lyX#c~qC7sbrMHu4oriA=V3WI*t*Xdl&l!y5 z2Yx;eqrph_#5!I5gw|H{hE{>_p_;_&?gexFav2Lav&bILGA4{5B#2(Q_ZF_-@i?37 zu}Qt>O+!tENXE%C+wI1(cVlpIk0TD%CP;{?mS(VV4`U(XRc?C?gM;P zXctMxKR5yK`VQSjrKB>|a1!95m}S>N7JX>P3~Z-}H^6F14AaKRDdHzJQH`;=-h@63 zbxfOAl6PUDd0B)2EgY;)6}cZ6nZVi+YT8Gqm+;wGj5hxTFW~$RFI0Fgzwz<6=fD=F zET9#&nRylTZgs-=zeqM8MNDrD$~vT2MXt}jzmCg)|49<(-RLHAQDf_es$ndqERm>= zF8+Q8?BbI^x4>L!!8w@r?`!|}#T`Cubiewo*8^VExPO3lrAW!4;Cpn{kH4iKpomqQ zB%ld;B-;li{nA@H->|r{5pn{D|R$w>bO5`Y}fw zqk6@p<(s}y!4;q$opqr8>%sWr2nnfyS_lzPm4_2U?P%t5vKjxir9`_`0F=i1BS5_MPiN?=S-REx6?nUB9%yzhCgY0U2S` zk;6p({JB!I8I>)7+1O?y(fp<2GTWinmVbXUlavd0E5Rs$O!y$+QSeW&&zRo)D08X?K33yeIkLGC z4IiEp@j|ODRw}x=x!rBju^8S|$R%G)IMmym#tq)dFH5+3%%!TkHiCKtC>^A|wsi5d z!v0EyPPe3}-s&Ie9Iv!CP-6DA53Owf7e(;mf$Te4F$3Q21ZW+=v2^OQ=zx{=bsB&O z#`ne3%Y@B2u zY*XFgjw7U|U*RmP&PE1h9Xj2;9&2Uvd)?|8n&FeE{DD2?6?u@;M={eKJU} zWJV~1zfMPctfoC6Cv@9f!q9X*+eFWUqZO{%o6J1B;k0U!OXGW?QGG2;E&rk5%tQH3 zmdN7fJQ$Pht)3SgcZB;`SvjGAyI3xZdW{wiOA?Lc^fj&D1JtpredRyUI8l4?2A||M zlqz=icI*I62j!NaWm%w4xC^}jhh!(Bqv5#qeGZ0t3HNNHX^v&0CSx>N@#XMk# zbXyVvUNZM>w7XDcc75exlyv%8(CVP$^pZze3O&J0Edg?S1nG;T`*auk5Dlb>3GX?~ z`<&-JXh71*<`ifGpjFw8;Y>fmXEs7JGczKu5|Y7U5+H=3rMbJ@Vu6}3LJhq`DvkQ7 z`Q1+AKv}+5U4U<1zV&*<}#OH|O(8b+&)C1xgKIxW3xN#kb$U(QSZ+t22kG0fEui!?fh(=a53wxGbXLOvi}@DqH$!WkrBY|hWukvLiQo|H z8foGlj}`p8-6EJD^J_S?hYkR` z^}e$I4)F7bn=-EV`JvYyy+kG3?=0UE9fIA5%qSs&LPGDjHJb2c-V--4cuQZi$z6Ak8TK!pla+H{@-$v9UlH}F?^vf#=|X}>mLHWFLt zus!(#7}!BQm|0`U9g-Q<*`$-%vTxfS7XzvS3=TH1-VC|EJ{sCPfx5v$9e>qZ-0Q)) zF_NlNYo$%6m?0FG^f1tw;m<6mI|A$zrC)fxM`B6IFT8#X^@ZcRQFK#_#_k&d;gpYO zd()DDzhofbvK*hzC^McHu>33lDw23k;SGH7(&3QhOG-sV`g;SUueQ05vZTMSDV5o< z`gF-efA$wqqB;UwyqF#A%ew=d31-Po;E9@lc;zBYh$bp?=c?jbQpXG&S|>Ipz5eBP z`3!ir+VT=549b?$$#Q%WTUad%uceee`_wQHdvEpQ)==mYuvZql+K8(9;3clp%!xf? zyBH0%XLc=Z$lL9-xx1WsbL?3D{6@#{c^sNH~nNfZ?8KjH-Q^`+TIvQqx0wJnw}l!^^O1 zwK>qf_BV@D2Gx=xY)lEBzGdQjsxEaU`r)wug3d1m?jv((vRO{Cn@&}kf?~sH7GSLw z!{=gW_;PJ9jp5&5dT6g^U3bPqS|uC74vYj_G+IU*g%oc49DxUMfy#Y=badotA+!~` z)aOt~nR&tWY{4@?+Q zoml%)p2C;=Ci+%n%Wm=Lg)51C)!=np%5&H~u0*AU|x2E~^$R+`id z{n^{Ey0^F7DchSd+E#Q%QZ1ReaDB)<%JcW|%NHX+qa6t=lpz{`aLYur=TdoYo7mY2 zS*g#F$A-)?G76T#FuPo{tF@Yq0m_N3_OUcx=i3QSBw`js_b0G*0mzPSK8MyV}KS zyJLlkHSd1ZSf)7a&1u&{|s7ayI81t;m9W7IV$r$n2$dp-WC$X^D04c)V+1XrbO6=Ag zBUen%-i5mrFoU0+e`+^))iiX3ax1kb*{oS(Rk;=%^fp76vWRz7qSFuI2GcZvQL{zl zJ-ZcUDDLgYC4a*Bnw|M5P|GKaik;eQ?A(uxxRl&<@|@-qLMu4GKET3$=f#SPX-Rks z(Y#EI3F~vck3(=GtLe*(Y8t2cKK^W+BCUKQ=JvMO{DpMN7jc>OK~i%!oY<*l)ZVil zWDV1*yLnc1*M;|~uVAK++#36n85S!z7IL=nlr&_-YdB7-uScAwSd%YujH(;+E^!=~ z$*oEvZ;#4U1|DKai9_5yJc@-Q7G>aD&KK8-cg@4_$deR1H!TpT&la}40LVM8{6jHA zZwcL2QigUS5v>#U92~N*p%%M2IBuayUr;My00u-E}IX-5ShKwEeHE z6xHS}pe$7r2ctzPH(}+lH`!o;vOy$EqPR}*cz51Q2nn0X3YRzzSGhnX5e1)33REMn z zf{d#Y)$tV>8YzrB(6W>%&1`>sfLZ!hx&z5nl+0IXFiGtl@?&780^Md9q%-hXJLl(h zOXq;^K#-{jAXufI`9Pgl%tL@+z&sSrjidcA6Znmv#vBV|;ajEIXv4$7smGH@kk$ED z(BMCPGg>Y@AoIZO!s4vG02bCiOnoFro?(a|SWxf4`hMr^!f<9ODIo*rMi%Mka zxwGvm16%pp+R2z_sg*^qnG&8hrz%>NQffcm(0-cBe$A%H`H-GYIS#ffZ*Ov+Ery{o zrM_-X01s;w{yJK07i?q0kTMwp%ow1*bPCqdRCRX%m z?}7q+A|tQu8yi!OHv@P(5vWLLnl8)XTvdhqYW5i{ZxA0nN&r5mh`W+?-3xPYTPUJ> z`3AIa!aWc#BEs)K<5g;+%xZoY*ZwSxbsUh5Y`nraDzYPDjM zrLCn7ABdgO8%gmi=SWjo+j7-6ydU9dJuXa<)xon@6k_dpwNvZp4$PZQO&God;Mi36rp9ug3&3~F=xv=yC5zPZ z?-8`P7d7|`aERNpv3xx{;^TgZK>8l3>9rLY0)@Sk8<*6AE!bcsYrd^qSe{&WuBkT zX3Js?CF(pvQLz<^+hPesy(L@D>myPt5sT^}SOY9b23 zsvGwSWzNDEUQ~<#^xghBB*Ubw8mT`NG?>{!TKs4Q)LuNCLG}KCS2u-PI6>8O4A^M6 z5ZM0EY}v%VtG!khpfw!7%6KQ_js{F?Zl+I(Go7a{47Ju3NAY|c0OL=e#^YGA1!#jn zHF3}%Yg~8`=pGB5KM6vGVn*fn&oE~Uhn;5(Z6bX|5K2l>f_I3QY56%H#nUUtfbgLY zbUdj3jCjV?Ny=(aFC@+9dHoi~Ty59==43)5@m&7*9PBrg@qql^kgN^9d5?TG-cN&l zs)PQ-iOKk)R&6Al1Fxhax1K?O5b%vbBH$$=Yon9=!WBy@tQfk2)X_0C-MBhPq%Iwp zzbyrKsyx_OJR|8lnMRMHz&shWUF_ncj6#F8iH9=^NSXe`ylGH?Y9t~m+BH2rU4Rfw zC-@!A4C2Upj5rxpZIsQ$a!F5wpQj5H7c=VJ_`LOrfT-XqnsvqjM^5A2z*5IfHui2V zwuwkL6dg3o!t`=mp*uZv16uE}7I85#lm5q@`XPHB-}C(D|C7>!+q1bkCBkQ0dTG>b z`66WDhka)hDjaj!OJAEDW-3Ce(`cahp@WRj%SMLnzR`@DEDVo4?9?LAGJk<@K>gVg z!$tt+d`BTjFXoA6jRhiIA9RmF1QrBF^Wxc-%H?!u`yb;8J3kn7&y;qmOm%)~e{q)) z=L`4fcZ11ayE$>7(B(1lq5fSXJ?D22>c3wI z6_B>|WackDv5)%GL;7E^IjRA$2{8?kf|9@7{{Huh-`~mi1r)*m|B=5xj=y-W;91t? z>@M0LgMX8j*PCzgke-FB`J3k&g#?iP7^FvRfl{!&$wC0lh_OGLeo#3HUxnGvo{^T zow|SdTmSVY^owGXEA;xTJo&XU{^n0Y%nXrER)U=Wp2Yt%x%sF7hv6dgh%!+4Py57JApo4N`FYQRVQU36p|B%)F;V!!&T0}Ig|M-#KkdFxO0(7FW z3&(@%>ZJT!OQmpFO7l8jw}|^ou?Y%o6aT|wri6#pueIv^X&bu&W&U{q_nU|=Dv06i ze6}*&tab(J#>&YJ9{khy^@)n=S202`nL$C04Q)?ULcyaKQyR!Lkc1xCZQKywlG*s7 zi4V@tjf%iMwQWE+Ehb3;E$!giToeU~326g*VoJGYN`5B0n@h)fpbP)bMi}AuCr)Zf zoYXji5Wobk=J-Gc-kVI(c;aj~pCLk7PeOJY2^i@vw4k^9iY4>GQl~ewwrp~j%zP=^ zSG|v7yekpJ#KfLCvf;!wa@((kokH6<0sA)5sM9(&{m+metzLJ_DjkQEQCSdTzPF@M zVfo=|KU7cyWzY+h3#mayTIujk|oR-ps0u2 zl|wQ>GLU8R?V~G!QFH+$_{!h4l|C zF4Ae%z+u*+4aH%K!PRyD_I?KRT+0VV1|ez>LB}J0^Va%5-hdD+a3ur+$cmq5f-6HO z1P&a(LCg=g_@BosR53D%eW11C1Z8OZS%^Z?(K!>3F7|7mUQTCEJ8e`h#BK9C%O0Z6 zQ81^~$RxkGTDf-Yf48w(b~WO$E8Tl_V3l@yU3b4?ZCKg7Huu^^cxHY&|GOQ^B$aMS zD=iI6V5n^5PQ}*Sq_ArWDQmAlA4LB!7rbs+^0rR$4Zkr zb>=8=t^1LeQA7G0ry(8}YkQ&N^iFArv7Fx{G%gE9Qrrn>C0S<6a|j3yRt@8pxe)o7 zVdMtePX=n|JqueG?aTn{0&Pae{{kuT6;SRc4i77uzXX&>+=Q-|HWD^{))AvxS=;-7 z9eU*g6LB$6O|c68B_4ETFmdJwDC;Q0*kS{GY*iHaKT_+1X^z@Gk-^VJp?a*|ZW1p> zK+=t$5OLdeN`)LukBwCff}Y0x%h)QfCje$!`wh?*Cc9Mzk3;LxkF!Cp(om}Bi#Q2- z>h%Cw3}oO*PG^}X>zU6qC7LemGi%%8_wi&BL}eKHukvG{C_LzK1%>w;ocBsf;{zTN zXq3MEBxf+~? zU)oE~<}HKI`c~35Jh#y92X`hi^YjmWu6~^mh*UP9uB(s@;#j0n`J4#_^q+Zm_?jEK zkJ`}tz{{B5>^r^N=CPN39zjb1P_C%nLT0IW#K4ur=l(|1G}%-?r#xH?zaY+9B^;Y} z$$GqL)=_*O&cZ_F@m;omquX&Rf7r(5ZvACNmAQWX?buVcYD-VF6i$_>Jd1q=Qksk&@6;wc)h{J=q_LW7u}{K=p4^E4hRklR-{Y$)wGt$kMz9NTpO`3nW;U{tHs^!5c9 zt~Zusz~a``*A}$%(-8LV{TvmAR(#%e3RWpulGZ!6`&atyxRy zI8b}3++M7c0OPsuG8l1OyTNs>!tKaiNM8(TO%0Z9_7{Xbyuf-(ZBbqDL`u|4WY)%@ zO|$WWb)JETN5Ru`Nd9wjf@TebM$D0M?bk{&=nVrhbdtY0Grwhojn%je)>U!dP~!*; zQ$weGDB~i%3XAWUc7N-g?2gSZ5a&ErYY8_2>Pp^I6He^Rf>Yl`(RzB}h*u&y1h&Uxu75Ij90FU_0=N|RZ zV#|ZV&*@&bF8Mmm4K?mUV?iAIW2(C9n(gmss2}dl)Kl!A0Z(Ri{tc75GSJ1b;*nJt z&%O^}M&*GMWbW*-9zliEjz+tgMNv$EvLuwkQ6Wu=>*}*Ypk^&6=cD$SP6y<;9V$(xj}2q;1czkn1>sF>+gJb`D6eBV%6JbCnRB>QaAE3|Q5AmBUQH|p& zaiQhX$F~LjzZ!Aq$0aN|!$_lQm`|73h(FOo)Vfbhw9d-3E&wl4Wd{%1=aguxW#LUL z4!)m$R{_g>z7M6%RYFLuEeO}XrqEbURiTHGz>1f&Lt6Ry`MYLkwdXMpcv&H=@xuy| zu(+n6C7Es9@5*dxv3of0g8bK|^bSz^U;h@r;6dE&FQj(fv-CEccx`Eyj^AjWKCId>3Wl4RZ}Gn0MY|co-PNP)nY*Q43SC_*1_317csegR9qh zbD+$|0`vDddfNM5pa;TpL2CS0mlMS|E5-EO4#d-fnhJrv^}}v4^7WN$vcuK1f^&1A z>ub+!P@vsTL^jEn7TyAF(E*p*vW+NO&7jMd?#f=Jk`qwy$Ai$xn?rIf*vKiGhKr^>at8^_y&%^(m^bM6C_v|;$A`Mc-o+K(Tc!x9gLmLN^ zb592@!nTMfYSo|M&?0RI+unJvCN0_xrJ_!7GV+j?+j=j-Aw_3l%>;h_{F%_n=Zr4U z1XN2xlSG+&$oK{gUWWRxzhxB`h*0R)tmT!w*68OYM*8P^GBJ6{b#bHSzocLo!EKVQ z>7c*D=T>)#nYgZQIBd<%TI)EGPv1ki;nJUEhb7%wmo?pV*qUZCiZ6WZQ~A)lMOPh? z6HPK-VI8lZ(yGVld{JWwGd=6%rP{YnH`k{;v3h{Lol~oLAgaT(NEH~EfQ@U^i=e7e zTG*l_MVgH*C$cex!+lw!)b!TYQX5tl z-5Ak;w5{Pj4vV5j+vaN!%{!@zc5~twp9G&o2`Qm_S7R{}f%Tbu3`dOGLKF0&)j=IyWOq?cM$U% zJSiSV(bd0PLo{)Sm;3a~4L!mo%OoWHcP~E96`ZA zv`iHH@H5)p?ZpDacrjX46`T68PZE!kZxn*uTUpiaBv4`^U)h|w^?Via5+ z3~nz^6~K8AwQLuqwqTSLp4!NNnlTcWdZ%F->6A!PcUmW3!G}mm2U8d5tB36*Cic!^ zs!Dn=y|%8wPxlt+CblL?Z4mvim(VEcxIH_laQgK9349-Rh(N50tY+#mwa?o4Q4JC( z0n(cz;*Z25#kc9*$Wqr2a)C&vVc<|HI*8~aOxWAt!byj1VV^w$+U6o}Y}}cVi_1%%u;Ookk|j#X zg38Wo;I&q?>uiL(&wL66J6U|&z7k{cE6V9*Gwm`Ea9Y@y(0xMgI#946Y$Ifq+ZVpZ znz3InKrMlg*(CeFl`IqGwsPAE#{oGOG()X8qUik11yhZP|lu);2?CvImy zG-H-;(s&+TdA;)a!9U9s?_BsnROjk8sjj6_{!4Xlu0i0+_(s~=hZtshPxve+QNw6)Y7mM5$~KztVLomnO1SmX0!pf%lP4WGyae_qk1?FP#LD}ztP zL39zO^*VrU1q9?+6x2c>5pq~?ki+`i>ecA9iA-%7T+o^I!B`*yM8d=hwyYp*+S72b4B?Xx0v zFXRC&M9<|Ls7{;}*Q$N`W?&eQSRMgxe04zJ4zpX5@k&Sw4S|s*fmxd#v03Nq4&Fq` zj|P+pPr$M}@)5gP6^0!GO+Y-DOXd^qb>n1pUTt=ea(B|YFSfIv_Q=S{G^COI(X@2& zF{U}T{{odJq>T?#V@Ak()Wr%~3#@}$XwHUCC@J}$pCDW)Oz~|-bN*GR5Ay?Ej8=CX z+@XU4MntwoEXJj~bJ_UVjAe@$kb7^C+VJh$R1hLCGH1}T#u2SO|NNQa{0l#JN=Jpk zY-#}M8X4D~w5PT6PC=hkW8R^${9eJV4gOW?iHG(HcEKYzt48M8I+nQ)rf}^`bYN3J zYwLScWCL>C?-U(AB)1^@kvZM|K_cyEgs37fx~MM~LXN3oyIjjZp%M8i#+xYU1pV=2 z`nkEeZ&TvRtl?BJ^5qDKl$x-0rx}w^u@crIK4Z^qe9x_phl4Hdc3`4DJu%x=m7CtL zj?mkRFnGAw(9KViQ{MT?%fj?upmxhd=5w{)c8o`7QXNW6H8n}Vk>n3ZT@A!)zJ)?m z!o8r0X=Ysd?I|Jais;ryvFYpH9WHG0-kqQ_LCUB;1WHw~M0imMng0bWQ6j=ricm`P zwEeg6drAHtt5`y*R&g`usDeJL*iSZwxxf^-|H8#mh3~0g>FD5`#SP{~I{p_dM=1bf zy;n4nsh!ekO^dDp7ALuoQ9St8wlqS>(RGyu&;K*He;jD&YoB+RWr&3-`ypyzJb#y- z|6ea+7=U6pW-D6%&xMJ9_1{t@0MwbA`C9ys5AQEu_d=bVdQW=FpjBXh|MQ$e$Uo@2 zVg>pCeLuhEvCoQ(H&XP9>+8us>p}ke?x9!bq64fGG=D_@2M91q$PVh^WXI38jr&iR zdVdEf@)CPo5df(E>goLFP11S{8~G9>2z=;=I*}}sX!01km(;na zjG$(Fq{8KC@>BBwcC$$#C=YKE`i~$tAk4+cmUecSyslfMB8a(Z3so57`R^vn@W%s&mcP#<;FPo(I*mJ6AM!2pPS%{t zZ$GYqJ9X}Uh&w(%^VehXhryC+hG2{tsQ?N~sm207nSb55kgYT9G7+w|Z)e*1xCG?O zJs)+~W!o}urmDv`= zRsLbq95D!cs;wtfPIu;jv%g&ONQLK)nf6)cjoV6My`X8WcF#QqoY5Ceb*&tCQ3?X% z2~3mUKDxa8(Yh|^V+U^;NpO`sc-FNd?b}ecS1LFmb$jhOe)#|5mINRe%4AAAUAQMw zxXe0)TR{`Fa0tE`XIp}b4GvpmI?2tDtC`tZWp4*nTSv!uB*_Z8lQl+IJ?!nCl z_urmtpWzz)S*7?_n^bS0(8q=WUkn(#o2e5#Nfhy*QY9PG+wOMJK!-WiEv`7CX-?T$ z)yJxNenJJGl~T3mXx zEcqqu1Djc=&2-TtFG2Tn#rK@nrqw3GtqIrVuX3KJl=L@!-_TYs!6J9mDPfXLWO7zR z#r)6q@_%eTANYL4s?jdoIwbf%;xIA#3=%yol?dNFTxh=!u(*p7t!8?tTCjlSRkkAff|R$$Y9xIghk5uUkyeNA z`3WoLKdhQ8cG%2J)s@`()*gi;oSrfB38hzOn95{ed17-rZdNr-=YNVg(3f4y-W;n^ zGCWEs=GkxHegMA|(DwOt_u!pHXxG)5k6)leDjLMOmZpr&CyriyMCXv=>Pg8}ANlH* zbxZ70cAvymSo*V#=; zJm0wf0Y^}Iv!K?nQBx8}laAluS>$Efi{w=bTl&@he67WuIe4MD+?PS=p!(Y|U^`vOy zl#|oqTGI9OCv`Xh$LO;8WJXKaV|-^^t<%jFfqyvoq)H%95+)0qkEv9P;{M4W8?z-9j$53`?E0w?Vgb^Z0_n7H0L94;jSl<` zk^?;x)?^Nc6Yg5pLo9eazt2=Zv(~NiRNVz=y7{u!lVoF*1}9YkT{nT`v%`&@IUobtzaH+b#-u&ruemTtQ+DK#bX{>&am3)H6plK&wJvs2;kr`kQG8yt?tSAN1Bg9nC1Li@}c^|G%qjaM4|?x$6SjgTKpm-Z((E-g4@tSC$xh0SNQ!QYI> zrC}AG`Yihdrmrokch{_MGtmiJq%&@+zk(`1uMQL@r@xQAUzfH#N1bNad)3Q)e`_s5 zHTFC(J*S`3r4}U1Qzd#$ebi?IvT-qaz0Q)Wi?u`4XC(s4H@r3r-cb7Q5iwt0xBuNY zsBw>g$E8%cLDz?KwMK^x^7T=X2%xLcnEujfyf%T)=?|^omOa7jLkEv?dY2-hDLb?&Q!y z0(<_!!E;bz+ynSSbAE+XZNV*BLf9bG^VYi?g_g@r21F#Jk?`}YtNsjOzbwGy1%J;= z)3Cjr18o++M3S&54rHLdaRIP#HdGi5x-jA`V;b;5MLo-4i-{{C_qx3vDL0h#@Z_=k zYHr1lUrTc4nJ{`|eD!Ni1dC=|&BS8h5i*<4h29E|%)D=QoQY z)qdBs($aFXoteAKLH{Om9`CFh?`mMpMfOhR4@!^P9Xq|(>U0|f955*v0ZWQK$$J48 z@O#lM)$S|J8ubPiKfqiXjoK-9T4NP!JROWpx?CQpy1#DS->*v;jhx6N6N2)=)JUGi z%Oz7$!u+Y?bI14gBB$w1+0J`&}gT=VJ{&p>_=D%`&|M9ScX zjX6JHHSX#V#=BZVu8;-2j*m5tERDDM)2w~Ay`!?vlx|c_X)|@>*>?4g zPE#BiZCK(b!|uqJ_=gD6Q0?Lq%r?L2<630tGz|4)t80qE9O8YYn7XDf2Bv2;F~ed{J)-*aRGw;wwtCi*7~| z@T-^3nO3t6y})>)8WtkMNjqcX*>ZC_&1SpQNrMDmemCH|1y14F3eOwY;#8<1%&`k` z?7ShZb>vmV0W2{+4>YI5CgvG#?9Jg>~hW1UE^L`t?gguoX`@c&GD{=Bb13= zYkJA^#8o`%6-%@_gQ()-HBsVfrbhexZGBwj(hMEx2OFwEz5t4ZwD`na%30ru^)Ezm z0ohHI2AlSWLLQeBr_lw5kNP~4@aTM2rQ(AFSL?4o*m)|!{opOCN`0w9%9Qg!Bfq0i zGQ~QwkB`IIuPdgu)l;H^)?c@B@8h9+&0(ra05IW?AtIM>cyJXah@J?6D%i^qoKD8WTNR7G?R}( z#diT!6mxN?L($`Ea?=Qo<(!Hv%E|J?VytmDv?ZAw+l;K=oQ0+7WEkbkdOd$e|?~=4Km?R24-9= z;BJEg0|Uz$et7aOdnQ=GcSroHuBD`hk=!eBHnin_UHWpL2kqjgwfq;clWqCL)gjc6 zAG!h=kz-&=&x2A5LucxZlZR_?76QH_P_E$dm|a_8G>iwB?`igBPbp@nDh7~f2$UpB z2HZJ4KTT_-!aj8A%b0&2svx0y(c&R2UC6eogah>94AgM&yEtk;*_jiSZy(i>S@nfV zrWjXj@bHafN4KANti})BKi=!_>+hCq{SaTT9U`@}gkv7WJO-?lx~--9O(j=H^XwA7 zP~5#AS~fvcXh(fZt9E=va=3o^(3SlcJ8u}#ot7GK)5#=gIp%D6mS^^?WA^Ynr)=u|m9$C@`n7gpqYoP+hK+g$FjI2h%>%=Z!!W+{ zz!@M5FegbTaTXdUY%rtT+B-1!g?MzIZ^?0!lj)<6AM48w$=sB}uJ|9opWq>TR!HiZ zAz>NarMK>}H+Tz6V#KBt>G<*!^>@N6`giZX}xNn>F7mNa6j0NVVTgaa$0}eL*&62 zX6NC>pS>ii9{b6%P4%a_AmP}xtyaUeyGV+qWPc|Kh&E!Q%MfP4Or|)=QXnxxio~7< z_KVR#G1CwF%onN}N{Wf4bp$!W_={$W_*aP-EwuSeF+D1J@nUVME6@HOW)&zioY(;r znwL_k4u3MR&|tm-JaI4AygLPjWW?x3(oaIZw`E0I^-2@>Yk5t&os4)7&-Ui;qFMFe zwS4uB_!t?>*gT1dF*!k`Q3hQR0>i=TY883@9^y#G;k(9hCp!hj>EG>zom4yrZ2G!Phi zYd$?bE3TbW8d7>u*k)jE-|hAVG$ekqdY^P!g$ZSDM3`1+s^Z4?gr%oT4e(L(L<|4_nhD5O#r8S>}DFyUU_3g zU~iA0@A0WKf$wUm_m;2olcscXqCKP8(VB7*k_2j-_Au*8_ww7OmA*Ae4T%>_cDp)n?3TT2fkHVRDv0zTes2$R+Gf@u6xGNkldTC3$OzcaZ-<@iPMgG79g2bVag?DuURMGnm z7)jNuF$2?%;;;dU(F?)Yt2^{RR+bzAsor|uTIxH?{j3iAAFua<*p!NGsPhGOqdf23 zdkC>|1Nsg&wXUgW&kBlA6sZ$+ZyjF<4#R0Tmfjr@j2;)@pOD^j$@ox3JQtz(Ca%3A zGqRQOr_40@+^ux7C$4n(UPeU;KlYIX9Rms4K`P8Ea|n%B63H zgPm?)11)>gsPXs~Ty?8*-I^J<_C;eD7Ol|(#%Bzl2v(#0%)+X#pUV7|wIAo!vOv5`IILvLjl zj8|Vr*$u%ReRqkLK|OZf@KVjvJR!8x%I0E<6`zvlr&mNtLwY#TZEia8+3u#$_;tY{ zmzz#i&-SfNSCx+jt^ztbm(4Fmy1>_Y<1pJSVf!&=Q|FK7*7 zuyHVLwyJ@ug(&ep4xX;pP4$O5G5DxEu<>9OG1k%`Kq3x|dSk>JKZ+33s-d)Z(#0_Y z=f?^DBou#hCQ+brKk0m8fMqe;pbS^sPYNWHDj`jQhd`CJf%y8#yBG-UY7~0iVwskK7OHyxF~Ixia!TcRm$Zuwr;70P<7ZPA>Iovv`%Twg$NAxE0ZR z>*kSC zIMBo#b~}Y~75IzjAL>smzJA>=NwvB*i%>m$;9VnaV^E^40_(z0n%1H|!xu6wlynh;!>4XCI4WH5YoBm2it;^+~c;t94h+QnIYYr9W zQl|JH*AQK=9r_yZj*U3HMlSrf?c|%St#?(mK9A0L7rs}YW6Q`o_M}RLR=lL6&eJiV zXa?`ih*}(Rl&TKq3^vksbqW>;8ct}9A`#H$%)Pf)>gu9X$Iu|v!edhw7YX^fE0@N8c*l>#RT(yK^Rp5; zsJ~<-cvh&Zrujb;WM%yMXTT$PDg_ zvHX!~A=dR4{=|U7o4jC8NH)W6tWH2)V2Ab8IxdB`YOv~2&j8a49PGSxqgCTd&ke@O zxNqS{GRrKmua)|*FNK}NKDi%mgdkU3Og^MDqVXoeVtOLzAEta`@{u@dcg8J)gs@f1 zTHWOn=2&{4%*Oph&Ggbn(rQ_^UM@@IpIIZDnVmLW9D0lRH~YvBqJYE+lE9W;EMTqe ze^8<1%U-I7D0g>a4!2@_64k7poR<)+bz!SRS4fU!wZeLcUl{1QrSVD-E%R$Nf2e5} zirky8u&tSI$tE+2?}f7}c*w&Yr8vpGX;GKr-xr@+c#mw$D-3x;_Xs(l_3lfm7+K_i0(!!u-ifIXW8lU5 zLIrYcfP}hz3jo`ZiYNetO{K}%@5c!%Orgh3ZMij?|LN+1Y$9+)P72+$EZY1+xd%KX ziW!5SZ5IvR9gwsG7t{k$DDYkgC=QdP|XWLVxTP? zX8C0OY*+EJZ3z;iTF>3p$*R&P8f}O}XkV1o?Xpm?^qEYcKbk_4U6u9~t+c|uZrl*K z%IrkT(ggz~8EH|QInobkokK$knlkzrBoh)^5%r&r22ZuPrYg@Y>zY3=(N%UD@k!j) zX;IX9>PN%2b7Hx#aoR@ubRh}=DcGUb))d-r0z> zBX;+qmo=8sNnKynqi^%gVR*>a0_mcOKIHmcy9^cPYH|J*!dqA2?QBLn;_9=xNgSN( zxrHnRU0(Isj#T|ui!5fW2Di73MkyNaCiaX-T-50l1{qjT5Q6w$#Cv30;55$~x0?p; zWnB$Q@PFz&B@TA((Bbf?T8Duo?HwCD$3MT~RzKIxJB~ofYEhQ|*xI@fhGMzE(D8VU zBVc(Sglm3d_kg)wU+US$cD+kD{y1Xx#|ceJeg9!9<}`IM3Q#Qr(jgv zbnLnv*IF~D9W%@K?`e{14q|HfMqmLILDN8G+ARIbF-7uFKIU6EZKG?`fqX8ccwl$_1h?QW!67(}yA#~q-9mypH0~DMU4uJ8gA<@}2_F2PtiA6! z``o+MxqlT!r6|(OIs5DPlXr|~cq!DZzz>&@uZc&Yw4>NTkhdwW1zI{gIj^ z5M*=g_w3My^c6Y;rb-N!Ci~MY%vz;e$0g%SWNONJiQnqj-q{A&eDG4KEkhVv(NC8C zx#SGHy1h-{_vCa&@)CfmNXL- zu|P}om>dE7Ii-H^z)}{`D5?2ZG!pi+832Eb>E3*mOj^xUQ#{48>s}v)H1#L3AC{R~ z-!LplT0r(E`758L`WXE~MXXQCc)njZ;eysN%Avo4-f0$hAFJsCR8z!CU&Ku>;U5?( zq!yV>pz13(wsWKks|PIcR{l%Fx`I?R~-{K)if0k-<#1fVg5SvN4a0EU43SWveOE zKL9l%{bH_mU}h_yJ-VV`x}o!iH2+HmwlR#w(q$}QH_BY%&N8HrJD4l8-Pj_}@R1M? zpC0ypuq?!(5XB_++>=DFoZa*aZojCVYnIkfYs|d;)UW-hJyILD0T2B&FtEoRR_0A# za7qylZDtuH@d}}G_zsH7<$|>%A?^O{vbPC-VQhdmZ#bWrl&ThYj9Bdkxo$9Ke4=doe{-C*X|H%aUWCiA8hdiT zQ{|4?CTs@1IeI-8LI3FFIiz2BP8LpcCGzt* zeupxY@#V3#((jz|2<4IPhnXL}@g2OGHB~tTqfOy00-o}z7k0`|X2;T0uChRK4#P8T zznb*bEBv=T;eYp8fJ_6#3N+=PDO7k0>WiE81$oQxvg1J z3n|f{G?BZZ3&fB{L190TabOh*yTA8pildexY1;fm4$7gJf3;$?NJkYpEUrl)jJd%e zl7XVh_;9cs`k6Jr@Kh8ADZgl?K99~Y%eZn zj=Wjrsd}rJFt<3arqhH#M;}K!asmD3h-^SCYUl$M@Zr!#DU15KMuEAtc`pskV-xfk562h0nA7`AH>^l%?$pS-s=Cb&aq20*SpF7rLwmHlp&aFBC zP9hjig{n|fhr~mVUd*Z_Bzc_{g7+qm068OKWXbIK*WvW7_~>n&d_QmhcWDZuD;z}> z=G=$Hyf<#0ulmE%tc7*8DN1PeT;5p>c$Ja+w3<;f9Xgol&mfF3jVDlWt+LK zCq(*}G0q0DdvLFLPK38P$^DDV9Z8}g<4fDH}lsgG+_*{sxnnt$9cYu zQHVnBG7)dJ;8gAJY;&G=(XE54xV|7lXBnH0Y*3loYDeFiQ@dYbwTjlYnq)~09q_dbmxf!FWcL&?D)~kLl7E%C_}+9bu&gzkMf%I>SOE@y z04drK4XzIw^*2PCm`@fWbZe6Ca|X@bX-^8(C(Oiq5+%aE9crmRVJjP2OXqlgd#Cj< zM(O7Uvsumx?G8ZdhFneMW~AY=MAJQ3s%~5ZIFyR!JQUeba8!PO)%iCPq1q$0LN_^( ztltwB<6^52tUs;(Dkbu>@)pnu(N+rh)cs`?kA~#M^bUZr7s^U7gJA@($s7=Z)fQ7q zKKCOsAg~N0`#(FN!_dRR%1M?Z`Jo&+@Tt;G)xsg zb&KP#z~`QBL`Z7@lU>N`&8qGZ3a&t9IM;mrW-|72vrlpXA6OiAL!6-rrY}fSnw`F%4PK#wl^swKLUI5s12U6l;s$T; z*$X#l&WeULn&;&GhnSox(Iaxr5XOojq>3yp&D z%&_j$Z`<*$aeU?6$I^pV51-Iy;ugH!=sfC=ofio z$td%U)lV+g54>EVzSUK}!rDvpR{glQt>-InCby2!r)g1X6w;ma#-ug8c)w_E>$Urc zSMk2WX!zpxjefsNBw9VxepMpsv3VwjCSvz6)EeWs$oQ`(0#*(oJum(K-cYZu=>5#u zS(Eb9xX^s07JTAd9)?wSHO9Vn^U9BHYl5Xlc1(OOdI$cvpHSIia@KcpP9<`GuIc^4 zheDyHFZ)x>H@7L${*0#YB!M9-!1Tzv)YEj#YNN{((dgi5e(mU+!7|9A+i%HJu_9x< zmY2U2^8x>N`v%I*I&v!}2s%6shE5{F)bG2KV5GjM{B??MZ0d5fEnnj;0lN@G5Wm|= zqfZ%h_d7!dmK&(DoQ15KW}&PS-2xKTWJ0~&tf>gon{SToc}6+vOerGT-<(mVe=Q!J zhbWIc=IeeDJt;f8db~=!UV|E?>}$ZEri_`r;ENDmd`?oADv=!&)lAVcl}o#&5-TZ(ejMU_Ev&_a*|lc&`K40S}kr~8xX1| z;loXqAF(Qk@CpqgZR}UO3i$H1Rw?SjQbTrJ?Fg|Py1O*shn&+P(lxWHY?$p9noR$% z`-T>}px(vswB5RJR)}3W2Tid$9nNUFzKl<~dQ6EIiJ!HW;cBTemu2?J=f+T$O$|-@ znmSe~I9naZ-)SZ%EuuFtf;?mr%b{>iqF0Y|v`}}3a7?`$cf)%K=S7@XGm38vyC_(9 zxd$LLRUMBGqFhZN%zd`gM4#Hd@)P&;k+mR%eZkUstspPy0 zFoIKOwLm}V9`j|XQvZ5R$^|?Y`$2Uy<3Mq=Xt;sbA{$OLVjHc9wiJK(%K4@YXi{Eq zBJbOx{*clD(RW9Z<>>W>G@_rxVVX=4abl!bULa^&A;$aw?a{g%ch;JazWlpEtIId_ zwT+aI-2^q{kz1AS=L+%I0eMg(bej4bx?hE*kwS7Xxd-&`BY6dy4KpBOb(4*N2=pt<+NZAYD>Emo&MHNs`F!gqH`iDv6?BkXjqcoVTwc2n-% z$ihJWV}ncAc-I=N8aIB*G6a6uG;1Amguz(NX{83dWhOWE&Es_Jvg3ims%?5nD0SLT z$vlXWFlQ?KZT8?aD}5tVX8&7{A3PPLJv^|iO+>dNl{d@x*vmdqsU(|oX?CQQL-7{Y?uVO4+~jeYJ=kt(G{!I84rt(myQc|byHDPK2@ z%3V=K+4+}d-q9J=JP}lC4-OK4V6Tw2B0v(r%3LY991?BSBdpDM_nYUa5ooY!qxrJQ z$4C<)m;1VxrEk3VcYHPBob~$cS=AX+XPS@sp{tX->CE~9S*RIotp`UOHDQF2j1*Xu zVx*P4Sw(VeSg3y;Cq-G3Flc=8eFX_%rHz@}aM*${G|5$WcK?aYnP9!zl`hC-uI^+B z8eVP;!=qN*?xVtJv(+NB)(i_M76^nOsn-sQ$G+VKeZ0d2-=z+E{zbH(S#$jW;01Vm z@9GHZ|# z*P{u!#ZzI>`N8-U*YbQ-spBWQIyB-)RE*Zf65eUS>9do}JT156Jv{iwaP`0-dFQ(k z+Y9*TsWi>zg?EyLC=QX5Kjoa<-AVFkvjGa-?tWF+0!@=`@WRpar~4+7W=IZ zT%*yUjQ2%cap-SehZb9oG6+7hl8CbNwa0Aj;j{8Y`UP^f^ZhAlCf7`~c+*E7vKz&( zwbJk&e#;~Mg3@Gp%_oY&FQv^hhc{J@G1`@K2&M|FagBWJmQ{k;6b@p621m%W*8FaK z{CX>EaOXM!kew{Mn+%02%<~ShadDbsAS<_>U^6Wl-bL_0K|ttSO9}i3=;ta2pX`2Ed!wO5byeM)4P|i23_PdMqhJ*iV?75L3s7 z*zc_qC;!FgPC@+C;A_UGk1MNnx$_Zsmt7;-Wx772Uk!&rp)sqO>Vj8W*LrbBVefQ) zCVC{iLj$ho=eO6=G~&q-^nrc6F8df!`XGn%4aAIx5xtOY7a2 z-96AX-`_Q*q76-*&6+wYSlGK$Ek!Dh8ITkz(4m#hxk3C8*o{u4pjR7zVOUtO z9R%D@GH$v5y*!K$eU(He4VyI{FU*gqh>wM?Ircx1@6uuc;jxs^lV;MSa2VAjzT9vw z8G8RCpy59x;s31}4{Ux(60R)xx54fo#J(@z7mwtged9 zHT3`Y@&OWz!`Xm9YBe>DNWSN9#qE{3HYB>yk71&(22D1XE}Q^yW-+J3?T)XO|F&2C zWMhKikAvqDKRZY1?D^Ky?OVQiTf10cBYO?w6r*oC>|fq|1u5y{eulu{g@*P zIf@5dD*GvW4T+?h9BGlt5Z-^n~ZbZ7_oXSE-HBao}c z@_&!x!-@gSH(`Uxoc~L-0u8j{7hzf~1N>SBDfsqH3cE_CGsd)y2X~4LZqaO-?~Zc*O47ttz)O;v|Dxu)g-;?5KQ4~=`tK+9U&Sr_Y;9crO`=& zcrc$7Y0V35Nz+7&`5(pNl*Z6)6Q74ul6E0Yj|#X|KV`D)6t6U zei`)y*^7{<(5V>Q?_D(#GV1P{%5#bn?>{7&6|0rz0LZLEOR8PqSOKM% z*K9Mp$4Rdr_nRJDU4VV1)FIkx${oAQBG102fMmU~X#vmOn)gXEKle$_iVD-r3VZ8F zG!#`~J#TU>ZpQ-=?v@{x18-mnU*t@gS;)VYH-BrYND`)wsaO8KAlm4osC$h{&j^rO z;&S~p)ekAYNQA{9z_PM50tn5~*0)Kv#d$%-LW+T;8`l;KsX9(hV)&_*)YtE;T1nLs z;kuatbwi_q3}BMKKOcz1_WILwBA_TT$5=xbS$l}K9t#r;8YSrnAMq;8@$m2YW>NBm z88zN)(#tvo3QJzUr3@GAFfra#uWPeaHtVSklKHk4v{7tYXtefP`Qn0No|lb=N@~VQ z3-YI=wzgDKDYcbV%x}?CtGMgIG{8k2Qt5jYX`}8Mvg%1%X;tJBkydj0D8odX#oUqc zPEWqm+CXu)>fefssq632Atq}R^yfR}TfE1uo3Hvuo^trGa+VGr@?zHPPo8lL5orXC zx>gXonA344{qMoCDBLF_MaJCQPLzkTBOy4^z2yD&=j-5tt&Ea8(T}I$#RQX!lOwc+ z(b+zo=Rv~1U;yKN!Q8_`Y&l9h)4R1BFcC@eY~b-|^cwTck!FuDKAX#}=WT6Lw#{ux z!AkqPTpTfkJcxkLS)&bVGc8Gn)jBV%?b1jtN)sftMrkB=)e7*=_Hi-$C;VTOTB$Fv zpODzf4fSc$*gF!>$4N=bq))PwsGzoQ1T-#h4sISGiw{}nM!#gwkFEW@vTrAWp7$nr zPLEf8oXoFc+Gx5%c6UWJLKgVwi@;&CvfQyI@vDVZE4kxKeU261bo?X&+nc4>ty*CivZnkrF= z`DlRh3-W^@%;ZsLAx}mrR^*@*5dShzvja|e?XH8#-x8iw3U9a}r6ZDc`c({)q|pOG z!aM0nu47$~GJ9JZ!;>mpmnt%GAa~QzFv*xvptU)&C-KtSw5J8X4}QoSfDs?#GW}*e zw1+Elt}M+=o49HuZgS*)iE1iU$oj@K)SOx)kgdRjDZ(@~pKV0}I!wB|(^l1}ap<4t zWPnkX@k*DsgY}{rmgevazt*(YUA_^oaAQfm6`a7FN!$4%jwEemB2?S~lpgd5fU{DY zI{JXf0Kb7e8hchYX${taB+Y%LIJ-HErMk}_!HIUc!X@VUV)+a^iV!h5LImNW1E)oz zD9Jh} zv|auAwnIY2dpnE5q&No^IPR{pKR)HUeo@NFf?rG&SD=GWrPK;B+DglH&Fotl4wJ-{ zbYUT%@SW~=e1}UXs%&9E+N(7^rSPocrEkY^z@;f)VgLWludz;u^(k(u|K>Z))zIzO zpvEnz@uNw3nv$`Yw}tcN?yO)AZc2|3nL=1ieXALKnjC`CL#_tf*cFDLAqQoq;`Rd3 z3+BWLbs7wIZTiaCXD=u4Og$L+Tfhl?VqrLVmNpI&$3-tjrxcCKd?Ce;Y68H8^(+mm zo+oJzBU5!mUA@iv5k@p#D8&wj%drAUAUtt3#Z!mQGXb# zF~04YD>dU?eN@_v7pxfb>q>v75(Z{DF1+@JF&mq^-~>Zu`c!BR~5Ic#y;UdQ*lXLQeXcmM%$!cWxB>;PQDPVZ@0tcMrDM}c$Ip(WXvmG zNtdEN@x4wTwLX(R4FDkFAmOv?KKJJyfsz0YykqYP7Tslt+bIGAIg@zL7Z|mUQvKYd*8eIS4UDVGy(_^smU6 z_M1l%iFNaUUM^V4l)IfVVhqw`>s4I=PHOVoSn4WzAMTIeIt|I<+QYG0jE!Jyv+4#e zMwl8^1}{@?*g)4~IC3e?|0|sF@17lPKzBJevJ5AumSESR+v@U&c%pcq(<7|NLnI>% z2(eu1{BoHpZ-u8rcLY?N`dq-u*wolSDQ&zIX!|w+L^Es1WL@dJcTUQAc4EE2)?ZG{ zvJi8=!=cG9YY8^s{f6Y{!%}G^c!Kw(aa#C^t@nBhL@(Mpf34&w&9D_LKHR-N8D@TS ztgI4sJ1N-jT7C6JCRNd5!%h!&9*2GT?bPyJOjvNo)2?D=F@|vG;;b+&o|dE*p!-y4 zsXHG(qHYsZKNC~czP@p@n*TRt_-BQXmHCnJB5!pfhw>xS-7jLja+ko@P99R06&5Yn z``Tk4(2Ub>hmYIP3+}`q1hQJmuhgrScp6;C|FT{vhm-1qe748wcs3I3s)W-|W) zFHHXF%Upk%3iS2>coH#@Acnr$rP<{o3oY4B=j}>h&t3m}=T=Fh!ftYCb#~9%X34tg z0CD(D1K}P+h0W<_mVWk3xiQRqrfT`@iT+he9UWSh{gEII)`C zNs`Fn#`93AG!1&<^^oI2CJkus}tQD$Wm1Tko(%0mBNxcLJ=V|{R@(*4)2K22Ag zs=k(z20VR#in!S14>x+qY!;)0X_Bb7-qc((Y>y?C{Ni@kB7Wl*4y%j~1yH>N2Gc11 zdAn6WiP1LGTyR9RO#M$=vj6`1dkiTTu-5T%Cp8c$8Z|!$u#mJ`tQs-|ovD|e1|Msj zm(3RcOg=BSVSmUhNQH&rRKz?*QYVYV6Z-i$~U`SVAr6IubjbQBF5 zNiBe?4(ot#wE1uUWT*}_YpuzAi2pMu`kyPZuBZ0%1M6DP(KntomnhQ@k2jmiQXH2> z{$0!kUJa!p+Se|+wpO#HLx-HU8XjUu?$J4b5y|(SuXHGDHUX|`gW^T*& zE4jHL`9KQjw@9pD;A37vBa#OE-8W%Xls*|@F$71z7t5aP?S9H@JpF*5h9Cx>0vyoV z`?EE{&P>wrl+(o;3R>+Bfk(?7D%VF#OkGcGTFAKP?e&So3%sjsZgIBh+-Y13Ra&%@ z{3^O>9m}&kjgF55&SNcc%M##;?BVE&^zo}Uce@0G;s*v#r(HKIwMtc`WJWE@`6O?cJHU>%INKYsKw34eRW0D>}%&R|XYNE{@!Wq>uTx zW8r0dNKHZ4U}4Z|7lg{<@o58j*(RF`38=q|iIzbTJEy|{vI}x35?ryse%@tvDz!T) z$hiw-h|*39-bZG9@KpA?KA}kPyVDBCp=E%%_uW53J-@o*3=F%wT8lmXf(owLdM{O~ z`px9L@9f<1aQ=MthQeg!PgwjkGO{co_ki&`f+LHiZAPtDn^X?_+uX=I$H;Ae{_I50 zn)+{5RlQ%(FuMw*O;hI9zC^t%yhJH9*?9~Ym@-@kEu09*t;(f0r5xw3qb6)bTlaH( zn*p%rmgAh)cxfFovj>N;w^mc!d1$uU{@a&iwrLz}_5j>oxjA+$liQ#Z|GdKE-UIaX z5Ccl9x0L0Bx%a1?O!gQcxNxvM>ycE?N`h0aF@hUTql(~}6#9oD1Pm)m7pUwMyd1&$ z1uY^s=|mb*w2OsJs`L9up|M}?>79)C*Qa2*IqMW(R00NF7L7Hl6)CS9R75Y;a@}#e z@9jm>3EEbj+M>#U{Ru!5BD+ki?N3*Hl})`XTbxV9LOtl974UL(j;2z`l09hG*FhFM z`@E;DUs?EbMj?H5vdtv{Ac_tJ3B4T&sOoepbvc|~9CM-7YAt8qDm1^ToGvkhp|ydd z0eHa{es|X=v_SZAVzz(krf%6TKao3Kv(4q+q7Jp((;}f(jZspn__=mPTCL43@@=ym zJ@%gE&*rdl{kr+tAFrlHOe3g%JZ@jzp6?_*GwCPVe??1Zn~x-v<5v**yF&BV&o&IP zLgNC4fINEB?(V9{GI&wJCNp1)%1Eg@!nMHCYy-R9N4}XvrJIrHzgfeWM8%Awb0N`QW9cymwdvCD$@%sRr0~ zxsh*>qApi@|G3ulP@Nq_Y5e8&j^c3qWcsHlqSrNt-=YlIgzD~lOGqGPP>+57gX%mU zd$B;InOx_cS8N8q>qzAU{XZ3$SI|h>q!Q5N3--F)Aoay~W^IsM65~bQa9oY=JsJ?S zNE({ME(TzPjWwM0C$oj@gGjp`?;W&`FS(}_q7gm1Fb6IYv z5?m8hSKJXHeseET>00zGDEhQkFD+=X_z@YGfu?HCOU4ylJ5Dzd8+fX2CR|z zC%`6K<78kL{&%JG6*M|nI1*NDMOx@|S}mFR7Sy>n1G1VeXFTM#VFB^1cKQwuxBT)O z*MPZ?5Zq?g=?qFG%iUcs(UI&tT3+t3N<0Bvo^!CmM-mGa`m{i%6$?~c@7EY9Uix*( z$u-|hs=6bulPdiiFcQk41@GF0Qbqs7co^T~%*2J!2aIx5PD zB&iPXg^7Xl(=Kiv*Ps7b(S=FLP{i(EV=fe?>yq*5gpE9B2ua>u9+9~oa>mMMyJLMS(sB@|nCEIRL`ZJ*8*%f)rvUrR$utM&|I2K74lqeQCOyl=8rI=cG6@Zf`XEdxJ1 z!7*eE-;!d;Wh%SV$qG+h#j|Y6p9Gi2yALlDo9rp8^ZXI%qYKj~n15R1yb6S+-bkXi zf65tVH}Z@HrrhL@bFG7~ygh7E#Lib!gtdU7vM}lEv=j;!y>Q{o{ST3jC@a5HKYA zc+Kwd59?jv{}Q7?Ife2Qp0elv^D6=OygO+S+j8-Yb9Nqophhp9Hv5fY)l8OCSeUY? zpauP(i~O19#t6VxZhBsDI$q*r4+j)uph>&zu&OHic062=S${-Rm^}I4-r`Gb#b|>D z-e~6_vZVx|F*@{Z#@wh$T}Q&32YM-yWt?8F)S6r@Kx{inXv#cK7uabPcs4WO-G&d6H}QX@)Bk42HiOt?{=X z4xvXU=6!qAAlIqmCNZJ!=P=enL-nZZy{H?_Oyzm-nVu`UxGCXj_dO$ zTK1OyI70C8TQ+TSb|%{*Ij6!9kHk!MezkOznR-;BR94=5L$s@UFDYt$PQ@2Q$?PQO zPAA8g-609t=%cBlO&Rwg+rES0Ih1!6!I4_H{+<25UPq$BVuW5m1DJ>;rF@BD6$JsR z+lyVWZi~}!1al`1!2XE-(doWFExyzQ7{R^;rpl(W!QFXY&1sna`Tfi3-figlUF8-& zw_Qdejnc>SopE|Vro_JNRgo2eE)K)<@*w}8VM&jfqX&CHE6Y+6ytd;kbDXE|Sgz!kFQxth$(yQ=O-zE+KlH z{pCsl53Q`z4$+e+FQ#eRkR~XN(ck)q-#US(_Dxom^r^Wp~i^GTO z$tR-MH}Z%gKzIcgU?zmT=%uHd>bxWS!V$L! zFag{IFD&QLNPPBfz%hyLwz`Eb_(ynWGMgEQ$>P}h@w@?mUXt(!fpp>m$rxf*uB^}% zi?I~eT7cRBh^>9Zn05*Ng zrB;vQXq+*E51YRGUc%j!DkFV?2Vd&*LH3@WaFwk7gI!KfT{`DVx8*y1UGvI%*y@=H zU4pb2%|@?JSKEzUxxz;(Xl&^D^}?+{H#cPGAgxi%fqd`c1hoqs+xj90>F)luPHzV`q0s7PmLQ2$d>$$?UUHeCpZ@@A;sa%LNd4oCoi*?hYO-p8Dtcl*U#{Y}5@R=rrf zr|@6B`;QNsnD9o{)u+QIe0E4x|LE9U5`8B_Ri`p1G-Lk+6+uMgimp)q zP#dF%YD8RZUaj$Z*6wm?ZIe`=xGz?@Nnd0?#p&ubra1TC*?~>HNw(o{XGf6o7VHGv z)Bv|1b426w`*kK>+eS`}-gJr^>0kPMV^Z<;OQf9@Fv)F8wv4W7R^9S5W&>#HCO@ZD zCM@p9g_yzwb(xo#7p85mSv{L%C8U47`(49ta)vYO1Xt`145+tJ?3r%0C;7y#6Qsuzu2NV~wOEuJ!VEtJ#Lvp+8b< zu#BqUjOhNRi2ojfRyPa227!r|-FI5sZFxF>+Jjs48E2Z-O&ax{wTvL#}T=mdOv zf;P3B^yc5w>da_aiN0QofW2xXb`FQueal)5eyuH=+;$?IX6p^kDGz=#>)0W5UII+2 zT^5~qj6GNDb|8b*^)e{+r{S!giereNUD$sY8T?!3{tEdVBGE8}4JsQM)+& zv#WACtN7pt$KznCaks4MWVJeeJt^6asdm@vp(o>o0^5*)S1XS@#+TwG6Z_NbcjGp` zjGEOsuZj6J0m+UzapFNO7hr2n1cG=Y<{1I|0Km`g+s}U@sn*c<6fcrZ-6XuIXLUQ$ zv|MSf0Yb`_>-k&{REw7YSvCZ4E+i*2>ZDyPWeN5*jIR4XGXkr(k zl=YLXB zB2?5lZb@ua+FHNs{esG#t>KjoY{^Ce)zO%FDiejoe{3U3^Pu0$XE_0r;=qH@+hNQ2 zQpv=GL!iV4mf+$w?LJ{ zhLdGS(0)=a#~?5$xb~!BIt`4VD6^Dh6CUcQ%Iql6Mu7^smq`-G8G7IC#CHi!*z@{S zYhdy$wUrE0oPTa$P)$}1GgVpmINe~yb^B?WY?sU})#uyx)_E$lFTKHqPWh^{mS7py zZwGCXKknJ?%3kV|Zx|$QMcPc_l8TMA(jRJbRYWdGyFzgUlwn1QOTIeuEQ zsMCA{H0fH(H76%U*2U$z>g|aQ>mbJU_Ba(kYy9fj6z!9}bCcMb{nvzgehlWVlujiE zO5ZdXDmd_J6yTW!X_p24m5UmN=vC&k5^_P%(6XS44YdmU8>xKrnNjsaedZl$TGP8z zHmG-Pj_#vv^P-pD^S*Cx4dRJ1QHIB2&WDZYL#NFS$eg7e9-Ee({i`^-=L`>&_I0)} z7cH-T6+X~zw_kaif@AOY_HQJsKwG;MnRKQ}`H$K0O!KE=>Dg$hHyV>f&!>&p?LT}k z{MONT_B!=GUYxKVHn*EGJ}2`KvZo(4<{zlR5CE>6cwhz@0z9)Xi9yrF3M6$I6JP^B zS`e5i31A&d16(F5fYY?oQz~dt|AG)Q0YX-kb3ek}#||#w&?={Vjn~#7DLH@{s56Io zdc*OP&2pOZV%!0>vHfaZ=Nte8@$sNl>UYoq`K@d>3xzHK_{1EV#nIQ2Fb0EAj1(Sj zzEY2#x&8OYYWG=ud|-*rwJUnh2Q0V$0t37RF4vhPJrVhz55G6lc{g>)*(3=>1eyS8 z80Y7s%;}%3JQA|3fA0XxYNw;0HNubclXR#YpE-!{p^qhjsdPO4(_Ly_ox)2z5->Az zs?{F@P=h(2{9ry54r4CQ5fGtL3IrYlXU(`*3zI5( ziAvV{4T(V#j+fsJMczuE~y?l|BLL(!tXCB6<&Enmn^7}ZG zFl;UKGT^*83zViwX&fF9qa=|1a~Z@zdn-Vn!&)hAS7$)#ti0%Q8Sc}uSHR)L6r4Dg z`TgOi?P1wY6O9f_11>+JX7uR9@znNhWaV7OasE6*X1QqOq;U&+GP<@xak ziV$7)q8AIb6J$rvQk^%!CBsp+NUP3ETgw>DS~_8jPt!gVj@|tNZgIB5K{GvK-m8^A zipe0qjy(&A=AZ>4GEy1yxaV|XM8BeO-YnQB9rgGtW=)7Wge$(79P0EUxqJX$g!S? z*37y2>#z%yKXB>QIo7FT6r{JtKK(%m#KV|^-6GKZeQ|+uZFkp{4<*_5`O>{45GGR~ zw~pW?JIZ__qt^Sz4ts2NkzD)I>+xtRuLmm=zs7hFErwlHmJ0p(r~f3ky&$5MbwhRJ zpq)H+x&OsD_xUu4IaQR`S=>C$lH3!u(du?DKSs>F;O8>Ikz+?OJiW_6*b|4<>=3MY zy`2S`(DOrG`|VD;*@LzLVAP{-%?5(!6G*6l2>RA{jQum_HHT3yVH}SS1%GW?`xv1z zMLYm*(kDK(N?o4a=WGO>FlVSbEKmf6+UQEy>$6)UAlhzS|inwsAu64b#)5uR%r1o*ds9PL-e`H z?_u6##D0vSN+>2qMNAeih}vtF0EhnA2+`x%uj$a01u&143R(QrXN~|bZJfL0N@%Tq zrP)!mQWr@RYohadA~T?H)MY1(X*>bg^9-l3<`W9}t;{wZwsal%e$Dk(c6Uc#KOjG!sp5~(n*Wnqi5dc_*?hjE_8{${Hw|BcWySBX=NU*t_A^lo~Cj zY<1rjoE<`hPGE?OWx`MkltNqPS-bUa6OFr&Mrh`8?&^Cu0fSFOzB0jYn@-ZsOr&vH zoJF0D3Hh97vmx2d z52M=p5EP`|D0Q56hnXT)1yQHz=Y9 zUH9IFA~ej_15&OewG&8Bh*Dz}1B6-fL2L-QQ(X2>| ziKq&lm;(D_>gTV1D!?lAE4h0Uu+-kI(P7Eqx*=e}9b3Qu9)c2FL9&S5T9CvvR}4C^eAU;n=j8Q*v(ah= z33=;|0$a23S}$Oi%2}u3f-k%O3VZ>ktU8t|!5D4Z3HD4sW#l z>)?>|4)!Q@=7&3iw#2Kz&omBC4{)h`&kC4_UBD=;z^MXq7Z$y-H`~6ayzJ~j8%=V% zh0j4-)C(V5O~NWnE3x*sk&0heC)X|+QWecZ^1UVm=|U2L~PpZFhTUK zV@VS(p10`%pCPTV%2%h?QnlM_=Rrx5q9g}GnS3q$=8&167UOwS?IfAcAB?cV?(blI zj-JgSKc@271?%M<#La1sKDhR3!yi^!kl#!VEcnhV-S&EwR6%}lbUF>*HFk|>PIGUN zCG7l~YOJ>ia(@hyy3Ns*NUh#1f2e+_A69YNdqBNCx}lIKPO8>yUFU9o^7g8_T$(p! z(>}ctN$uJ)NLUsH?=3k$w9eQ7^BdjTx|9_hf4y#};~-^BcEhm&{qHMMO|=1SC)<*w z3)7i6`W-*uV!fV6a+tH)CACI-sA`;s+OJhxh2KV!2(3}FF9f%C0&&{QW1f0D;tLZo z^y1hshcH6E4!3LGry)y>df5gMe$G1PkuT|G@);j6_jrAWO4lFeKZU_70-=p&$=_<| zEjuwY4fAY|R@)XRKP^B!#lFT#awQ1*gx^|)kUVp|gvb|!uT!Hj$H%4s%w z;P_gYw55gECp1o;<_U}+8F)Y=jtykHU+b1;Op_-rgitSss{TT;G8=wDxWK3D0DEslP81TL1eP0Lfq@yy3xi{mEdol=IMJ z?x5jZysJu7H;k+@4EDK?vGOYM>7{sKVn~5kB;jQRsfdaRSv87fGBuO^bh|BS6I?qL z6|6nqAEsaM)@?PRUr2{#Kmp{X+Psy@9_$XO7*D!u!_1nRIT^gCa87n|y)x7yt7r!4 zigqGPDoJgF)Vmv=efGo8KFVb2xQHLj&!gI}eBf0kCyuLmnpe=6$c`F_vJ(l^F(?g+ z8F#expoiCGHcz~t16y}+JZ=Bzdk)C_uB;PxSxHFW;R0EsHpUNezq^UK#iTzS-b(d_ ziJDo42=YdVIcrkdx9E=ur7p>k8<6&$6@qpsIKQ4^(_#!4-ch7d5f;4+_w~C&c44k_Fh^=IrR-NBk(?C81^6{HExUto9 zw{kcEGo!E}FJcf&_gRh!YxIX-)lr1&&M1}jemPz6O$s2yl7UgVJ{6VnbwTx7yrSoi z(_Zsn@(qZ)8U<7NVo4jp)f}z&0#SY=txtS~DNNF4L^ft{CMyvFTncNeJA~l1Dihbc z;)Men6gl0>b-#&p?yAd^Rh@%{D*Mhk0gEZpi*W$n7}2&)J#y{pNz~T--pqM@q2crj zs*H&&|5o@T{UrZIq*jxGfh&II!|g?SJACEMtZ9o&7=v%Xx6z}$URhL+<~MS(D@Ahe zX1>6icK+E!S(ve*2naxcLgla!7KTZw&~9MkytH=!PS@n4iSKKH5$(Fu4~*Ec^&F=3 zV(|-9ODvahp@ROIax~}f$0Yac{jNnRjdMUMpyhmd>Y!=a5w%1l9vL>ZEQ|C6(EqbW zv-ZENQ>mJJNdrvt5x>LF>zOUi_FIDe?6Oba*6jE6b5PeHn2#ha*iRl<5omc`9hgGP z-=!AwNFC`ir49LY2SDY`^E&SWoMz_^#^wJW+=!pGHjWmZC(h@+ewZGP3Kz>~#}O{V zoVR>w$<-{~duiSTRP7HaBQ!Jq)iVIPDT9asJKj@}AV82BRLMQQ=owM(OIs&BRlzPM zI}uKE6xI0cS3+VMN^hZV&0YM8wjHf~Q-$))e*L+4#nFyUI_+1JA6XH#70w%1gL+J; zwckLds|{v`dt+}EAdOcT&vzBx)EJvyYrG8R<+>Dx!^gRG6fW2O6!Vejd>eVTaNL3d z#dXT{3a#ad-aJO*$m9HVox+>{8g(s@f1yUQy&um>2Dx?U>WUT}Oaic%!o@&1 zBF$HHk~fcTP1GK4*;l#Jk*?I?m8(??Wx>U+PcWP#XwZnTm{a&DcQ^Uy`>P-e|F4x- zuJa*&TrJNPt@B}FwtCij2^GaMNh4dw9B<<%=pripzU<^Y&ft@|y&5_xm`I#S<-}(* zVadL@cKlC831Un)(BLn$o)nz-mju?370>H+<_q!@&LO|+ao@S7l3~3&SiuGkEOmuR zUbP9qx*dzDB8b)>Z!FDz-Es4aXuNR_`Po9`=Pk6cTvh3dV#!DP3giE@cjoa>ukZga zWJ?+xOJy0doDe5l$&$TcEJfM3$~Ga{LzYQdT4bLPvWK$9*d=Q0J7ZV2?310r_}oHN!kWDI1ee=Vcj z4IQPv_t3aY^2e0lEf4$5=Vm--s0)XkIp8YimrB?BN)DEBG4^skCUVNOL3VOj`62AF ztsJC)1y@HMr230oBa10WT(!9@wfm~d>Ad*N9PT51ke#o^I2GB!f)xl{^-WkOI{LFd4wmt8bs_!w3X^ydK zeR) zS-gW$G105{=1x~hl(;QDfKj$1n%y|#LU%kf7T4oWYGo;=Bk83$7czK<%e zU`W$rA^AiKuZb|5mI_yBdo2kk!X__L72LU!Hy{X-U zw(iJV0(lH5n-YakgJWfWFZ9OYRaScgT}4>`;KlJ`xLZGL=mR2gt)i>O%w(|aUdimm z?t`%c{mbr)klDR{tut1$;Z9a7pN?gos7{`t?20^ZqVL+#93%J?jYbdluMr*oIx?lG zC6kNC?!r-Rz&=0 z^Zbb_j84(91OMgW^5p(Nxtorf7@6@d$R9*@5LJ|}*jB{M7&+f_MbI-Xkfdcini+B8nW~_c00gQrX zohbiUhAYn*Erh<|3sM5x7THdC+uhzdC2ni9zeI!&Bz@1BmR&1b?pdCc>fW5}*XPo1 zV%^6lIM?2&dEFX+VRQ~YB!S?y7^~tQx)d|`U;pP{GwQ!n4T_{~fYCD?aF|RF6i%+X zWC#X<7c=jP+0M}I_V1FKi}NHbCr@0Avn5WiIW`|Epp)n_)Es>wt=Nfv z>_8xtS$MGAv6#8jkRM0L_j-j(+usg*@9k-KZ+Dlj!uI((Ho(Y&HW5s)!D7$+ zvUV$H?Vy5)g+h$gQiVJ65!dPH!oahBe(D*71SgFbr;paf@xf!8zz)p|_5$t?r?-0n zJraKbyuFgUGxXb8HH~4Z_Zfh^<%gyUC>NCj7tNc6K}BfhPl&1qJ>~bym-+M09}rp< zABFVt63ssFws5P3(k0}B>Z&SUrzF``jg7lv_M7akBG-BH72J7>UF-Q2QWY6~!jPkt zTNH>*VB#u<4N~13uW)n<+PP^PJ3{-dBD+>ImTYH@sO7(x=LiQGe_(($s2{1(U*FKW zJzp87cXHOn+*pE|+0?m~zs&ombM_yj?WY?annJB&ufPjl)5(7npIXb(axmt^&cG`;nD{Z0dxHa;VOVw)mRca$(> z`vBI=YkAO?FC(U>!Tn2UJKf4A{i_Hu*M0}YzOzi07nWkBy$&MPpJ(FqrT2}WoRHDJ zLzd0{#c{|9skS6>tn?R3(i;NMzdrEa#G0}gQ~HYYhO7|<2&1#Zy#54?Dk`trI&EE% zkgw+_7228r=wf62`4>>^oCDy)xMEl}Vj{r?)p&|AJ#`of2sZHzOc70qz#f-+Q#E4vv;izjz&sk=kINNm-Wh;8`ed)FBCoaMrMTe&M>X@ z8>M)tf$~#)$|}kaQlmry>ez^8N{{NUfbiCiBOa&!HRJK#C6}@rIfja0MTW}xxJ3~Y z&oc@+%K=U2@csauLPnA59t7*liJ1n5zqTK}=Q=L<09qe>f?11VtP+P>1>}W&gs*|KhZ^soVnl!n zNGjZ@57+`ka9G;?b9{`;b|VA!uHsNvsaeZx*PZFM3iphwXpx!wZA0!;VKH0{C3}cz zQ3SRo&24G5+>NlP=c<7b|B;)ol|1}mUxo4{UL%vR7bWdE(`sZN`rc$>=zGCPR()2o zQIB=iRG&c(e8**4bKG6M;IdQy#g=HqiWd#sPb=W4mcqmjQy zpfNs(qD`TG&A4zpL;o&t_<{9=p0U#zcXF4yK@v&svp;E!nkB(2@hTuMu|m`XzR=Me zrBH$Ze20u4#M}HuuKfKIw3#ARG8h)U5gGLN%fA*y!l)sTPzp{IX~HQ$VUJkTl`#Qt z66@p7B_)Dbh(=aK_17x?H>Qx=+(4)ItI}C#{NKfYeBvP%VtimqddEIOwxS#m0NZU{2BDr-1-l#FL((l-@# z_n`Tqmy|Jgu7+MNukx{eO3TJwm4NYeh+DC*k$+aW)zDQe~cyQI8t`}l(VqXChU(4mfmDucjzrN>{ zth=~Lsl&v=!ou8d7}7O?sFW^FNT_2qVZSDPzAxwU==S&I!0rNPCa*MeiD9-`QPNYZ>)cnS#21*pQiFV>GX|9`-~9L*E~v5v9w$9y?=ywOoZ_i4 z?Tf$JVttTg_S0zSEvPX;H%u`Zm0Cq)7u)Z$oVqx3wfJ4E*~*{igul)(*=V~uS@i^| z_t|0|>%T{#R6I{hy>%)T&|v&}*M@-YUF5sKKi8j8?A2F@IIze!YsuDo+Zi>($svyrN|1UN1(tl( zwJbaO@LS5kY{%tF{n|9_zi6EK4iY7lPMfcn5$u3%h;53LF4j!IKbyeinY?ObT{|c;@657PV-|w zON7&p?$<-TTraM!VGdoUO85X+4tnU{kv&(sCf+&d* znyS5Wy9il)<5}I+o$s%A5d}O3c^IpeNWPg@a{Qy$6TDn)G$KAdv0AR$S#1k<`aFy= z5wmW!n;$x8eMQKP7BbP7avZXH9c4TgNaf3C-BM+j^I#qao@KhyiK+$oy)telly+y~ zP?`6l(5HvnR!MJN3a^<$R``nL9R`&)mxl#na%(0m_sZ`_JZE32F3v9&CfY}QaFk@e zcPfbg>DP>;)E)3{taTjr(Aye6AVeAGV< zt10;(J6!&<*AltZ2)|owE;+V|WZRNKhirCStX0?C+2vgtO5zlThrYLJdCorgy(xX#`sl_s5_f})qOUdX1 z-v_7_d&X{S#IttE7=R;uFFKUX(uJ#R zk;?*7IqH#)EcYFZPIyu^{#8qD37H!4^bQ;ZmJ%PWSh0k8Npo{^G4EExI7y$dY%!aW z2bF^Pq<6dqbtGFNx9$fRL)R%*{KxSU)2ate?glPXjrVLE_AdCwx5i1=??nsmRAuX> zdAnyVgOnbLj-!Tl$Mn~4Rku%sICLFp0nBH*`eZ=d$%=QV(p<&B@TVMfU6&2=&11Zd z6Qb!(byFEH+YhcXYcu8dzr9r&Ot;@Ioq6U;80Q@_nad!wI!}8SHh2LD zq}zPC#$(jm^`!!R&lCh+JRNfXeCc)F@${J=tou|Ulp#Zg@UZL`?S?zumuIqhH`N`ENi9=K zXS6&T{4C)7(Ij6n#;0GCsS?<>sC?5xPq~`dBAdFZzOs}X?|u};S$E@}$rIz$y5Dq} za4xt)NLpve0hW-ifRJ{>PU|Fz@dhq&Tj@JG4%2=2&jY1A!fmcw<3F)RrX9ha!!5L& zD(Q54-r+PM>q|ZGqAU2fn(=$CZ`rB;sLTghR#PRjMlV$&FY2DhfGySWE zFUZ?od*wQx6^Gjlt_Eb}mO71d3uwPCaEb0^Nt{b5mRQWF9~m~Sy%iYKx-S`3Fgos! zb~WC;gE}Q{qY>!s)O>}C5YcsqJhE;0`=`|$uN#Y|f@fknPeCFqIS)L>C{gB4+T%Gf{KQa5#HkX_ZFeP+&HTV5Y-fU zE-H{;{G?k-Fh`rJ?wAI9UW+?|z@VcVc>Hvu-N@UNauh!kHg!iSj6+65G)C0+5feG? z`}U9CAYX^+RX$w|ty-0NWh}rkfqEyDy>o5XE!-e+gBTl3jFxqq+lz~HPdOUI3a_Z=mrv+#pEk#m1 zgI2YhQMUR}3C_;N`38u#)u8kG(#mFp_6w9f7%8?fseD7z7$u-1VkVE{Rj#3dN#r4q zVjE^Xaii|@!=p8xTXm7wHVZ-6l17_>eIw8?AMv`P7oKy<>5siLG4OUp&I}Xh zd*Rju@6LxiK7&=(xx`4E-AGFd$$;+Kan_lt8OV-zr)8JahmmrQ0^wNuaOIZpsxgADzaD5-Rtm16kUp>toNiO0tTYN2A9P zHl=^Z0DqY#$g+?IaR{vBV5QF;?{T8qLm;P8T6eA$0Xm|-eAMyOIu=?o z2Iflz*ej_h7mhV^|YkQrA45YUP3WqF*F>~!^N)!rNFV2eZE zy*Ek8l707~Ue+_;nOnb&eY`eKF_Z*%~2-TBmcHYCq9-M6o(!+SFUi&uJR zigSIib6XP1IM)8fYTt>9iuVR~kg09#xZ!C*eq2X2i3K0oNS&^eY)*6=R(j$}T^L_J zzpvL8e+-~;wU+OXMgo8qmZtWCXXKtz^)>S20A$0kaRDA%=Y*e~h2-z4<>gGbuRRV3 zsp;WtE}9ln@psPB-qn&=@v^gS&hMFOjSHAHvU8Uv6@IURRsgvZ6u;hAXpO4oxBB!~`a=t>v$VSLr z<>9%C4=8QMOTKuwM|4ji5Sp2b&N<9qJCh4yiNU?01NGh~Hb^zWHt!p_A_A&n8(amF zzFr@4=i=g0PZW%KH@=O=c)(@#gte)ZC1M`g|Di(8&CoPB;r!#mgKN7>)6;xe@1j{Z zH6!-)>F=J1ZrD;%;H{|*Tqgozhlwd60Rfa30ocSg)eMpmACtD>dIk9T7^oiL^N zWA|4kROd!3(M{st;@`<#BaayAilfmQr-e~CQK?F>rDE1iO-07W#`qb^<=`r|hIYvy zn3@e$$&v0fQ}f*W<`f7hJr|H;g2&k_f=CQx6_i3Guew$LJEL3o{2D?S zTy|Ei=lb6#Z13zm*{S%U{~?g)+~3JqU#!(Ze4fX@G9{<>xHbi{8_nE!Nb?j7 z=uf;ivD(9R5Dq=1a}+9!%`#1w4sAg|{@XEjQtg5$2V(fO`aZs^)-8roX}-o>C|-@J zy6x@}Za^Ru`5*X21u8Frc!jghas_W_zI7zY+203W{Z7b&FFj7?)Isr^$DR$n#IT;j zD&kZ^HVXSlST#b<_NORQb;a>Thac;O**>+iRJ09l2>$qJvuinbQ;xf)!@PWTrj~Wp z1Y-p51ZXn)#f_IWUl6AbzcHjt^dlXEAM;_A{&@{rcN}<^e>hzr{}-7A=s$b(q-+9U z7$`hqg+e30j^CyXA<=Kdf2L5`<~VGi{&@{aAqph4y4uflq>ZbiK==6}^HY@~@r%YB z$Y+oIpPhmpvWWlna1h8hPZE9cvsoCcfGk3Bz#^`2Xn*~u>7dY0xW8_ASljSE0L?~2 uIByd`(ww4(DkwZ2C((C5n+5iR?0|}bppy0QB~0`P_)%BYR>@PceDr^Hz;ez2 diff --git a/authbridge/client-registration/requirements.txt b/authbridge/client-registration/requirements.txt deleted file mode 100644 index 9efb5564d..000000000 --- a/authbridge/client-registration/requirements.txt +++ /dev/null @@ -1,4 +0,0 @@ -python-keycloak==7.1.1 -pyjwt==2.12.1 -# cryptography 47.0.0 causes Illegal Instruction (SIGILL) on ARM64 when importing cryptography.hazmat.primitives -cryptography<47 diff --git a/authbridge/cmd/authbridge/Dockerfile b/authbridge/cmd/authbridge/Dockerfile.envoy similarity index 51% rename from authbridge/cmd/authbridge/Dockerfile rename to authbridge/cmd/authbridge/Dockerfile.envoy index a038f7d3c..8828e8022 100644 --- a/authbridge/cmd/authbridge/Dockerfile +++ b/authbridge/cmd/authbridge/Dockerfile.envoy @@ -1,11 +1,13 @@ -# AuthBridge unified image — Envoy + authbridge binary in one container. -# Drop-in replacement for envoy-with-processor (Dockerfile.envoy). +# AuthBridge envoy-sidecar combined image — Envoy + authbridge (ext_proc) +# + spiffe-helper in a single container. # -# Uses UBI9-micro base (~24 MB) instead of UBI9-minimal (~134 MB) -# for a ~42% smaller image while remaining glibc-compatible for Envoy. -# Total image size: ~140 MB (24 MB base + 87 MB Envoy + 26 MB authbridge). +# Spiffe-helper starts conditionally based on the SPIRE_ENABLED env var +# (set by the operator when the workload opts into SPIRE identity). # -# Build context: ./authbridge (needs access to both authlib/ and cmd/authbridge/) +# Image lineage: replaces the older `authbridge` (envoy + everything, +# UBI9-micro base ~140 MB combined) and `authbridge-unified` images. +# +# Build context: ./authbridge (needs access to authlib/ and cmd/authbridge/) # Stage 1: Build authbridge binary FROM golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder @@ -14,28 +16,26 @@ RUN apk add --no-cache git WORKDIR /app -# Copy both modules with Docker-compatible layout COPY authlib/ authlib/ COPY cmd/authbridge/ cmd/authbridge/ -# The go.mod has: replace authlib => ../../authlib -# In Docker the layout is /app/authlib and /app/cmd/authbridge, so the -# relative path ../../authlib resolves to /app/authlib. Correct. ENV GOWORK=off RUN cd cmd/authbridge && CGO_ENABLED=0 GOOS=linux go build -o /authbridge . # Stage 2: Get Envoy binary FROM docker.io/envoyproxy/envoy:v1.37.1 AS envoy-source -# Stage 3: Runtime — UBI9-micro (glibc-compatible, ~24 MB) -# UBI9-micro has no package manager and no CA certificates. -# CA certs are copied from the Alpine builder for HTTPS (JWKS, Keycloak). +# Stage 3: Get spiffe-helper binary +FROM ghcr.io/spiffe/spiffe-helper:0.11.0 AS spiffe-source + +# Stage 4: Runtime — UBI9-micro (glibc-compatible, ~24 MB, has bash) FROM registry.access.redhat.com/ubi9/ubi-micro@sha256:2173487b3b72b1a7b11edc908e9bbf1726f9df46a4f78fd6d19a2bab0a701f38 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt COPY --from=envoy-source --chmod=755 /usr/local/bin/envoy /usr/local/bin/envoy +COPY --from=spiffe-source --chmod=755 /spiffe-helper /usr/local/bin/spiffe-helper COPY --from=builder --chmod=755 /authbridge /usr/local/bin/authbridge -COPY --chmod=755 cmd/authbridge/entrypoint.sh /usr/local/bin/entrypoint.sh +COPY --chmod=755 cmd/authbridge/entrypoint-envoy.sh /usr/local/bin/entrypoint.sh # Envoy writes hot-restart lock files and admin socket here RUN mkdir -p /tmp/envoy && chmod 775 /tmp/envoy diff --git a/authbridge/cmd/authbridge/Dockerfile.light b/authbridge/cmd/authbridge/Dockerfile.light deleted file mode 100644 index 731b4afac..000000000 --- a/authbridge/cmd/authbridge/Dockerfile.light +++ /dev/null @@ -1,33 +0,0 @@ -# AuthBridge lightweight image — Go binary only, no Envoy. -# Used for waypoint and proxy-sidecar modes where Envoy is not needed. -# For envoy-sidecar mode, use the main Dockerfile which includes Envoy. -# -# Uses distroless base (~2 MB) for minimal attack surface. -# The binary is statically linked (CGO_ENABLED=0), so no glibc needed. -# No shell — debug via kubectl logs, not kubectl exec. -# -# Build context: ./authbridge (needs access to both authlib/ and cmd/authbridge/) - -# Stage 1: Build authbridge binary -FROM golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder - -RUN apk add --no-cache git - -WORKDIR /app - -# Copy both modules with Docker-compatible layout -COPY authlib/ authlib/ -COPY cmd/authbridge/ cmd/authbridge/ - -ENV GOWORK=off -RUN cd cmd/authbridge && CGO_ENABLED=0 GOOS=linux go build -o /authbridge . - -# Stage 2: Runtime — distroless static (~2 MB, includes CA certs) -FROM gcr.io/distroless/static-debian12:nonroot@sha256:a9329520abc449e3b14d5bc3a6ffae065bdde0f02667fa10880c49b35c109fd1 - -COPY --from=builder --chmod=755 /authbridge /usr/local/bin/authbridge - -# ext_authz/ext_proc (9090), forward proxy (8080), reverse proxy (8081) -EXPOSE 9090 8080 8081 - -ENTRYPOINT ["/usr/local/bin/authbridge"] diff --git a/authbridge/cmd/authbridge/Dockerfile.proxy b/authbridge/cmd/authbridge/Dockerfile.proxy new file mode 100644 index 000000000..f171d6561 --- /dev/null +++ b/authbridge/cmd/authbridge/Dockerfile.proxy @@ -0,0 +1,49 @@ +# AuthBridge proxy-sidecar combined image — authbridge-proxy (no Envoy, +# no gRPC) + spiffe-helper in a single container. +# +# The agent uses HTTP_PROXY env var to route outbound traffic through +# the forward proxy; inbound traffic flows through the reverse proxy +# that takes over the agent's original port. Spiffe-helper starts +# conditionally based on the SPIRE_ENABLED env var. +# +# Image lineage: replaces the older `authbridge-light` image and is +# the new home for the default proxy-sidecar deployment shape. +# +# Uses alpine base (~5 MB) — needs bash for the supervisor entrypoint +# and glibc-compatible libc (musl is fine for both authbridge-proxy +# (CGO_ENABLED=0 static) and spiffe-helper (statically linked Go)). +# No shell would also work via a Go supervisor, but bash matches the +# Dockerfile.envoy pattern and keeps both images consistent. +# +# Build context: ./authbridge (needs access to authlib/ and cmd/authbridge-proxy/) + +# Stage 1: Build authbridge-proxy binary +FROM golang:1.24-alpine@sha256:8bee1901f1e530bfb4a7850aa7a479d17ae3a18beb6e09064ed54cfd245b7191 AS builder + +RUN apk add --no-cache git + +WORKDIR /app + +COPY authlib/ authlib/ +COPY cmd/authbridge-proxy/ cmd/authbridge-proxy/ + +ENV GOWORK=off +RUN cd cmd/authbridge-proxy && CGO_ENABLED=0 GOOS=linux go build -o /authbridge-proxy . + +# Stage 2: Get spiffe-helper binary +FROM ghcr.io/spiffe/spiffe-helper:0.11.0 AS spiffe-source + +# Stage 3: Runtime — alpine (has bash, ~5 MB base) +FROM alpine:3.20@sha256:beefdbd8a1da6d2915566fde36db9db0b524eb737fc57cd1367effd16dc0d06d + +RUN apk add --no-cache bash ca-certificates + +COPY --from=spiffe-source --chmod=755 /spiffe-helper /usr/local/bin/spiffe-helper +COPY --from=builder --chmod=755 /authbridge-proxy /usr/local/bin/authbridge-proxy +COPY --chmod=755 cmd/authbridge/entrypoint-proxy.sh /usr/local/bin/entrypoint.sh + +USER 1001 + +EXPOSE 8080 8081 9091 9093 9094 + +ENTRYPOINT ["/usr/local/bin/entrypoint.sh"] diff --git a/authbridge/cmd/authbridge/entrypoint-envoy.sh b/authbridge/cmd/authbridge/entrypoint-envoy.sh new file mode 100644 index 000000000..f86b44b34 --- /dev/null +++ b/authbridge/cmd/authbridge/entrypoint-envoy.sh @@ -0,0 +1,58 @@ +#!/bin/bash +set -eu + +# AuthBridge envoy-sidecar combined entrypoint with process supervision. +# Manages: spiffe-helper (optional), authbridge (ext_proc), envoy. +# +# Startup order: +# 1. spiffe-helper (background, only when SPIRE_ENABLED=true) +# 2. authbridge (background) — gRPC ext_proc listener +# 3. envoy (background) — calls authbridge over ext_proc +# +# Process management: PID 1 (this shell) supervises every long-running +# critical process. If any critical process exits, the others are killed +# and the container exits non-zero so Kubernetes restarts it. SIGTERM / +# SIGINT are forwarded for graceful shutdown. + +CRITICAL_PIDS="" + +cleanup() { + echo "[entrypoint] Received signal, shutting down..." + # shellcheck disable=SC2086 + kill $CRITICAL_PIDS 2>/dev/null || true + wait + exit 0 +} +trap cleanup TERM INT + +# --- Phase 1: spiffe-helper (conditional) --- +if [ "${SPIRE_ENABLED:-}" = "true" ]; then + echo "[entrypoint] Starting spiffe-helper..." + /usr/local/bin/spiffe-helper -config=/etc/spiffe-helper/helper.conf run & + CRITICAL_PIDS="$CRITICAL_PIDS $!" +fi + +# --- Phase 2: authbridge (ext_proc gRPC server) --- +echo "[entrypoint] Starting authbridge..." +/usr/local/bin/authbridge "$@" & +CRITICAL_PIDS="$CRITICAL_PIDS $!" + +# Give authbridge a moment to bind the gRPC listener before Envoy connects +sleep 2 + +# --- Phase 3: Envoy --- +echo "[entrypoint] Starting Envoy..." +/usr/local/bin/envoy -c /etc/envoy/envoy.yaml \ + --service-cluster auth-proxy --service-node auth-proxy & +CRITICAL_PIDS="$CRITICAL_PIDS $!" + +# Block until any critical process exits, then terminate the container +# so Kubernetes restarts the pod. +# shellcheck disable=SC2086 +wait -n $CRITICAL_PIDS +EXIT_CODE=$? +echo "[entrypoint] A critical process exited unexpectedly (exit code $EXIT_CODE), terminating container" +# shellcheck disable=SC2086 +kill $CRITICAL_PIDS 2>/dev/null || true +wait +exit 1 diff --git a/authbridge/cmd/authbridge/entrypoint-proxy.sh b/authbridge/cmd/authbridge/entrypoint-proxy.sh new file mode 100644 index 000000000..8f3ea8ef6 --- /dev/null +++ b/authbridge/cmd/authbridge/entrypoint-proxy.sh @@ -0,0 +1,48 @@ +#!/bin/bash +set -eu + +# AuthBridge proxy-sidecar combined entrypoint with process supervision. +# Manages: spiffe-helper (optional), authbridge-proxy. +# +# Startup order: +# 1. spiffe-helper (background, only when SPIRE_ENABLED=true) +# 2. authbridge-proxy (background) — HTTP forward + reverse proxies +# +# Process management: PID 1 (this shell) supervises every long-running +# critical process. If any critical process exits, the others are killed +# and the container exits non-zero so Kubernetes restarts it. SIGTERM / +# SIGINT are forwarded for graceful shutdown. + +CRITICAL_PIDS="" + +cleanup() { + echo "[entrypoint] Received signal, shutting down..." + # shellcheck disable=SC2086 + kill $CRITICAL_PIDS 2>/dev/null || true + wait + exit 0 +} +trap cleanup TERM INT + +# --- Phase 1: spiffe-helper (conditional) --- +if [ "${SPIRE_ENABLED:-}" = "true" ]; then + echo "[entrypoint] Starting spiffe-helper..." + /usr/local/bin/spiffe-helper -config=/etc/spiffe-helper/helper.conf run & + CRITICAL_PIDS="$CRITICAL_PIDS $!" +fi + +# --- Phase 2: authbridge-proxy (HTTP forward + reverse proxies) --- +echo "[entrypoint] Starting authbridge-proxy..." +/usr/local/bin/authbridge-proxy "$@" & +CRITICAL_PIDS="$CRITICAL_PIDS $!" + +# Block until any critical process exits, then terminate the container +# so Kubernetes restarts the pod. +# shellcheck disable=SC2086 +wait -n $CRITICAL_PIDS +EXIT_CODE=$? +echo "[entrypoint] A critical process exited unexpectedly (exit code $EXIT_CODE), terminating container" +# shellcheck disable=SC2086 +kill $CRITICAL_PIDS 2>/dev/null || true +wait +exit 1 diff --git a/authbridge/cmd/authbridge/entrypoint.sh b/authbridge/cmd/authbridge/entrypoint.sh deleted file mode 100644 index e74fb6401..000000000 --- a/authbridge/cmd/authbridge/entrypoint.sh +++ /dev/null @@ -1,40 +0,0 @@ -#!/bin/bash -set -euo pipefail - -# Envoy + authbridge entrypoint with process supervision. -# Both processes run in the background; the shell stays as PID 1. -# If either process exits, the other is killed and the container exits -# non-zero so Kubernetes restarts it. -# -# authbridge args are passed through from the container command/args. -# Envoy config is expected at /etc/envoy/envoy.yaml. - -cleanup() { - echo "[entrypoint] Received signal, shutting down..." - kill "$AUTHBRIDGE_PID" "$ENVOY_PID" 2>/dev/null || true - wait - exit 0 -} -trap cleanup TERM INT - -# Start authbridge (ext_proc gRPC server) in the background -echo "[entrypoint] Starting authbridge..." -/usr/local/bin/authbridge "$@" & -AUTHBRIDGE_PID=$! - -# Give authbridge a moment to start the gRPC listener -sleep 2 - -# Start Envoy in the background -echo "[entrypoint] Starting Envoy..." -/usr/local/bin/envoy -c /etc/envoy/envoy.yaml \ - --service-cluster auth-proxy --service-node auth-proxy & -ENVOY_PID=$! - -# Wait for the first child to exit. If either dies, restart the container. -wait -n "$AUTHBRIDGE_PID" "$ENVOY_PID" -EXIT_CODE=$? -echo "[entrypoint] A process exited unexpectedly (exit code $EXIT_CODE), terminating container" -kill "$AUTHBRIDGE_PID" "$ENVOY_PID" 2>/dev/null || true -wait -exit 1 diff --git a/authbridge/spiffe-helper/Dockerfile b/authbridge/spiffe-helper/Dockerfile deleted file mode 100644 index ac2d72aa0..000000000 --- a/authbridge/spiffe-helper/Dockerfile +++ /dev/null @@ -1,27 +0,0 @@ -ARG SPIFFE_HELPER_VERSION=v0.11.0 - -FROM --platform=$BUILDPLATFORM golang:1.25-alpine AS source -ARG SPIFFE_HELPER_VERSION -WORKDIR /workspace -ARG SPIFFE_HELPER_SHA=1d0551d63787b528926b3e17fac949a376040bec -RUN apk add --no-cache git && \ - git clone --depth 1 --branch ${SPIFFE_HELPER_VERSION} \ - https://github.com/spiffe/spiffe-helper.git . && \ - test "$(git rev-parse HEAD)" = "${SPIFFE_HELPER_SHA}" - -FROM --platform=$BUILDPLATFORM source AS builder -ARG TARGETARCH -ENV CGO_ENABLED=0 GOARCH=${TARGETARCH} -RUN --mount=type=cache,target=/go/pkg/mod \ - --mount=type=cache,target=/root/.cache/go-build \ - go build -o bin/spiffe-helper cmd/spiffe-helper/main.go && \ - chmod 755 bin/spiffe-helper - -FROM registry.access.redhat.com/ubi9/ubi-micro@sha256:2173487b3b72b1a7b11edc908e9bbf1726f9df46a4f78fd6d19a2bab0a701f38 - -COPY --from=builder /workspace/bin/spiffe-helper /spiffe-helper - -USER 1001 - -ENTRYPOINT ["/spiffe-helper"] -CMD [] diff --git a/tests/test_client_registration.py b/tests/test_client_registration.py deleted file mode 100644 index 25600872e..000000000 --- a/tests/test_client_registration.py +++ /dev/null @@ -1,243 +0,0 @@ -"""Tests for authbridge/client-registration/client_registration.py. - -The module has top-level executable code, so we import individual functions -by loading the module source without executing it as __main__. -""" - -import importlib -import os -import sys -import types -from pathlib import Path -from unittest.mock import MagicMock, patch - -import pytest - -# --------------------------------------------------------------------------- -# Helper: load the module's functions without running top-level code -# --------------------------------------------------------------------------- - -MODULE_PATH = ( - Path(__file__).resolve().parents[1] - / "authbridge" - / "client-registration" - / "client_registration.py" -) - - -def _load_functions(): - """Import individual functions from client_registration.py. - - We read the source, compile it, and exec only the function definitions - so that the module-level side effects (env var reads, Keycloak calls) - are skipped. - """ - source = MODULE_PATH.read_text() - - # Build a module object with the required globals - mod = types.ModuleType("client_registration") - mod.__file__ = str(MODULE_PATH) - - # Provide the imports the functions need - import jwt - from keycloak import KeycloakAdmin, KeycloakPostError - - mod.os = os - mod.jwt = jwt - mod.KeycloakAdmin = KeycloakAdmin - mod.KeycloakPostError = KeycloakPostError - - # Compile and exec only function/class defs + imports - code = compile(source, str(MODULE_PATH), "exec") - # We exec the full code but in a controlled namespace; the module-level - # statements will fail because env vars are missing. We catch that and - # still get the function definitions. - try: - exec(code, mod.__dict__) - except (ValueError, SystemExit): - pass # Top-level code fails on missing env vars / exit(1) - - return mod - - -_mod = _load_functions() -get_env_var = _mod.get_env_var -write_client_secret = _mod.write_client_secret -register_client = _mod.register_client -get_or_create_audience_scope = _mod.get_or_create_audience_scope -add_scope_to_platform_clients = _mod.add_scope_to_platform_clients - - -# --------------------------------------------------------------------------- -# Tests: get_env_var -# --------------------------------------------------------------------------- - - -class TestGetEnvVar: - def test_returns_value_when_set(self, monkeypatch): - monkeypatch.setenv("TEST_VAR_XYZ", "hello") - assert get_env_var("TEST_VAR_XYZ") == "hello" - - def test_returns_default_when_missing(self): - assert get_env_var("NONEXISTENT_VAR_12345", "fallback") == "fallback" - - def test_raises_when_missing_no_default(self): - with pytest.raises(ValueError, match="Missing required environment variable"): - get_env_var("NONEXISTENT_VAR_12345") - - def test_empty_string_uses_default(self, monkeypatch): - monkeypatch.setenv("TEST_EMPTY_VAR", "") - assert get_env_var("TEST_EMPTY_VAR", "default") == "default" - - def test_empty_string_raises_without_default(self, monkeypatch): - monkeypatch.setenv("TEST_EMPTY_VAR", "") - with pytest.raises(ValueError): - get_env_var("TEST_EMPTY_VAR") - - -# --------------------------------------------------------------------------- -# Tests: write_client_secret -# --------------------------------------------------------------------------- - - -class TestWriteClientSecret: - def test_writes_secret_to_file(self, mock_keycloak_admin, tmp_secret_file): - mock_keycloak_admin.get_client_secrets.return_value = {"value": "s3cret"} - - write_client_secret(mock_keycloak_admin, "internal-id", "my-client", tmp_secret_file) - - assert Path(tmp_secret_file).read_text() == "s3cret" - mock_keycloak_admin.get_client_secrets.assert_called_once_with("internal-id") - - def test_handles_keycloak_error(self, mock_keycloak_admin, tmp_secret_file): - from keycloak import KeycloakPostError - - mock_keycloak_admin.get_client_secrets.side_effect = KeycloakPostError( - error_message="not found", response_code=404 - ) - - # Should not raise, just print error - write_client_secret(mock_keycloak_admin, "internal-id", "my-client", tmp_secret_file) - - # File should not be created - assert not Path(tmp_secret_file).exists() - - def test_handles_file_write_error(self, mock_keycloak_admin): - mock_keycloak_admin.get_client_secrets.return_value = {"value": "s3cret"} - - # Writing to a non-existent directory should fail gracefully - write_client_secret( - mock_keycloak_admin, "internal-id", "my-client", "/nonexistent/dir/secret.txt" - ) - - -# --------------------------------------------------------------------------- -# Tests: register_client -# --------------------------------------------------------------------------- - - -class TestRegisterClient: - def test_returns_existing_client(self, mock_keycloak_admin): - mock_keycloak_admin.get_client_id.return_value = "existing-uuid" - - result = register_client(mock_keycloak_admin, "my-client", {"clientId": "my-client"}) - - assert result == "existing-uuid" - mock_keycloak_admin.create_client.assert_not_called() - - def test_creates_new_client(self, mock_keycloak_admin): - mock_keycloak_admin.get_client_id.return_value = None - mock_keycloak_admin.create_client.return_value = "new-uuid" - - result = register_client(mock_keycloak_admin, "my-client", {"clientId": "my-client"}) - - assert result == "new-uuid" - mock_keycloak_admin.create_client.assert_called_once() - - def test_raises_on_create_failure(self, mock_keycloak_admin): - from keycloak import KeycloakPostError - - mock_keycloak_admin.get_client_id.return_value = None - mock_keycloak_admin.create_client.side_effect = KeycloakPostError( - error_message="conflict", response_code=409 - ) - - with pytest.raises(KeycloakPostError): - register_client(mock_keycloak_admin, "my-client", {"clientId": "my-client"}) - - -# --------------------------------------------------------------------------- -# Tests: get_or_create_audience_scope -# --------------------------------------------------------------------------- - - -class TestGetOrCreateAudienceScope: - def test_returns_existing_scope(self, mock_keycloak_admin): - mock_keycloak_admin.get_client_scopes.return_value = [ - {"name": "agent-test-aud", "id": "scope-123"} - ] - - result = get_or_create_audience_scope(mock_keycloak_admin, "agent-test-aud", "my-audience") - - assert result == "scope-123" - mock_keycloak_admin.create_client_scope.assert_not_called() - - def test_creates_new_scope(self, mock_keycloak_admin): - mock_keycloak_admin.get_client_scopes.return_value = [] - mock_keycloak_admin.create_client_scope.return_value = "new-scope-id" - - result = get_or_create_audience_scope(mock_keycloak_admin, "agent-test-aud", "my-audience") - - assert result == "new-scope-id" - mock_keycloak_admin.create_client_scope.assert_called_once() - mock_keycloak_admin.add_mapper_to_client_scope.assert_called_once() - - def test_returns_none_on_create_failure(self, mock_keycloak_admin): - from keycloak import KeycloakPostError - - mock_keycloak_admin.get_client_scopes.return_value = [] - mock_keycloak_admin.create_client_scope.side_effect = KeycloakPostError( - error_message="error", response_code=500 - ) - - result = get_or_create_audience_scope(mock_keycloak_admin, "agent-test-aud", "my-audience") - - assert result is None - - -# --------------------------------------------------------------------------- -# Tests: add_scope_to_platform_clients -# --------------------------------------------------------------------------- - - -class TestAddScopeToPlatformClients: - def test_adds_scope_to_existing_client(self, mock_keycloak_admin): - mock_keycloak_admin.get_client_id.return_value = "platform-uuid" - - add_scope_to_platform_clients( - mock_keycloak_admin, "scope-123", "agent-test-aud", ["kagenti"] - ) - - mock_keycloak_admin.add_client_default_client_scope.assert_called_once_with( - "platform-uuid", "scope-123", {} - ) - - def test_skips_missing_platform_client(self, mock_keycloak_admin): - mock_keycloak_admin.get_client_id.return_value = None - - add_scope_to_platform_clients( - mock_keycloak_admin, "scope-123", "agent-test-aud", ["nonexistent"] - ) - - mock_keycloak_admin.add_client_default_client_scope.assert_not_called() - - def test_handles_409_conflict_gracefully(self, mock_keycloak_admin): - mock_keycloak_admin.get_client_id.return_value = "platform-uuid" - mock_keycloak_admin.add_client_default_client_scope.side_effect = Exception( - "409 Conflict" - ) - - # Should not raise - add_scope_to_platform_clients( - mock_keycloak_admin, "scope-123", "agent-test-aud", ["kagenti"] - ) From bfc3d25e6893c9ac01f15065c77281c64e530f37 Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Thu, 14 May 2026 11:41:14 -0400 Subject: [PATCH 2/2] fixup(images): Sweep build-breaking refs to deleted client-registration MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three files referenced the now-deleted authbridge/client-registration/ or stale image names. Reviewer caught the bisectability hole; this is the broader sweep. * local-build-and-test.sh — line 73 unconditionally did "cd authbridge/client-registration && podman build". Would fail "no such directory" the moment anyone ran the script after merge. Also: line 84 referenced authproxy/Dockerfile.envoy which was deleted earlier (script was already partially broken pre-PR). Rewrote the matrix to build the three published images: authbridge (proxy-sidecar combined), authbridge-envoy (envoy-sidecar combined), proxy-init. * .github/workflows/security-scans.yaml — Bandit loop iterated over "authbridge/client-registration authbridge tests" guarded by [ -d "$dir" ]. Doesn't crash (graceful skip), but the dead dir name is misleading — dropped from the loop. * authbridge/authproxy/Makefile — comment mentioning "authbridge-unified" build path. Stale text only, no breakage. Updated to point at Dockerfile.proxy and Dockerfile.envoy. Verified clean (no breakage from this PR): * tests/test_keycloak_sync.py — imports authbridge/keycloak_sync.py which has no client-reg deps * .pre-commit-config.yaml — clean * All other workflows (ci.yaml, project, scorecard, spellcheck, stale, self-assign, pr-verifier) — no client-reg / image refs * Spellcheck dictionary — clean * cmd/authbridge + authlib — Go build clean Demo manifests in authbridge/demos/**/k8s/ still reference deleted image tags. They continue to work because ghcr.io retains the old :latest tags (just no longer refreshed). The deployment shape they encode is going away in Phase B anyway, so deferring rewrite to that PR is correct. Cross-repo references (kagenti-operator + kagenti chart) are Phase B + C territory, called out in the PR body. Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- .github/workflows/security-scans.yaml | 2 +- authbridge/authproxy/Makefile | 5 +++-- local-build-and-test.sh | 31 ++++++++++++++------------- 3 files changed, 20 insertions(+), 18 deletions(-) diff --git a/.github/workflows/security-scans.yaml b/.github/workflows/security-scans.yaml index d40714868..0f49afb79 100644 --- a/.github/workflows/security-scans.yaml +++ b/.github/workflows/security-scans.yaml @@ -147,7 +147,7 @@ jobs: echo "=== Bandit Python Security Scan ===" # Scan AuthBridge Python code and tests PYTHON_DIRS="" - for dir in authbridge/client-registration authbridge tests; do + for dir in authbridge tests; do if [ -d "$dir" ]; then PYTHON_DIRS="$PYTHON_DIRS $dir" fi diff --git a/authbridge/authproxy/Makefile b/authbridge/authproxy/Makefile index 9440e6634..0e7181b4d 100644 --- a/authbridge/authproxy/Makefile +++ b/authbridge/authproxy/Makefile @@ -13,8 +13,9 @@ docker-build-init: podman build -f Dockerfile.init -t proxy-init:latest . # Build demo Docker images (auth-proxy, demo-app, proxy-init). -# The authbridge-unified sidecar image is built from cmd/authbridge/Dockerfile: -# cd authbridge && podman build -f cmd/authbridge/Dockerfile -t authbridge-unified:latest . +# The combined sidecar images are built from authbridge/ context: +# cd authbridge && podman build -f cmd/authbridge/Dockerfile.proxy -t authbridge:latest . +# cd authbridge && podman build -f cmd/authbridge/Dockerfile.envoy -t authbridge-envoy:latest . build-images: docker-build-proxy docker-build-target docker-build-init # Load Docker images into kind cluster and re-tag for podman compatibility. diff --git a/local-build-and-test.sh b/local-build-and-test.sh index ae4c395b3..f5d147c7a 100755 --- a/local-build-and-test.sh +++ b/local-build-and-test.sh @@ -66,27 +66,28 @@ load_image_to_kind ghcr.io/kagenti/kagenti/spiffe-idp-setup:local echo "✅ Built and loaded: spiffe-idp-setup:local" echo "" -# Build client-registration (CHANGED - UID 1000) +# Build authbridge (proxy-sidecar combined: authbridge-proxy + spiffe-helper) +# Default deployment shape — used when the workload's mode is proxy-sidecar. echo "==========================================" -echo "Building client-registration" +echo "Building authbridge (proxy-sidecar combined)" echo "==========================================" -cd "${SCRIPT_DIR}/authbridge/client-registration" -${CONTAINER_RUNTIME} build -t ghcr.io/kagenti/kagenti-extensions/client-registration:local . -load_image_to_kind ghcr.io/kagenti/kagenti-extensions/client-registration:local -echo "✅ Built and loaded: client-registration:local" +cd "${SCRIPT_DIR}/authbridge" +${CONTAINER_RUNTIME} build -f cmd/authbridge/Dockerfile.proxy -t ghcr.io/kagenti/kagenti-extensions/authbridge:local . +load_image_to_kind ghcr.io/kagenti/kagenti-extensions/authbridge:local +echo "✅ Built and loaded: authbridge:local" echo "" -# Build envoy-with-processor (Envoy runs as UID 1337) +# Build authbridge-envoy (envoy-sidecar combined: Envoy + ext_proc + spiffe-helper) echo "==========================================" -echo "Building envoy-with-processor" +echo "Building authbridge-envoy (envoy-sidecar combined)" echo "==========================================" -cd "${SCRIPT_DIR}/authbridge/authproxy" -${CONTAINER_RUNTIME} build -f Dockerfile.envoy -t ghcr.io/kagenti/kagenti-extensions/envoy-with-processor:local . -load_image_to_kind ghcr.io/kagenti/kagenti-extensions/envoy-with-processor:local -echo "✅ Built and loaded: envoy-with-processor:local" +cd "${SCRIPT_DIR}/authbridge" +${CONTAINER_RUNTIME} build -f cmd/authbridge/Dockerfile.envoy -t ghcr.io/kagenti/kagenti-extensions/authbridge-envoy:local . +load_image_to_kind ghcr.io/kagenti/kagenti-extensions/authbridge-envoy:local +echo "✅ Built and loaded: authbridge-envoy:local" echo "" -# Build proxy-init +# Build proxy-init (iptables init container, used by envoy-sidecar mode only) echo "==========================================" echo "Building proxy-init" echo "==========================================" @@ -102,8 +103,8 @@ echo "==========================================" echo "" echo "Images loaded into cluster '${CLUSTER_NAME}':" echo " - ghcr.io/kagenti/kagenti/spiffe-idp-setup:local" -echo " - ghcr.io/kagenti/kagenti-extensions/client-registration:local" -echo " - ghcr.io/kagenti/kagenti-extensions/envoy-with-processor:local" +echo " - ghcr.io/kagenti/kagenti-extensions/authbridge:local" +echo " - ghcr.io/kagenti/kagenti-extensions/authbridge-envoy:local" echo " - ghcr.io/kagenti/kagenti-extensions/proxy-init:local" echo "" echo "Next steps:"