From ed95764b51cb6ac7e2810a5005fbc227447de8f5 Mon Sep 17 00:00:00 2001 From: Shrijith Venkatramana Date: Thu, 29 Oct 2026 16:41:14 +0000 Subject: [PATCH 1/4] Add SSO deprovisioning, session revocation, and SCIM provisioning Closes the offboarding gap in the OIDC/SAML SSO feature: SSO login no longer silently reactivates a deactivated user, deactivation now revokes live sessions immediately, and orgs can wire up SCIM 2.0 (Okta/Azure AD/Google Workspace) for real-time automated deprovisioning. Adds an OIDC back-channel logout endpoint and an optional reconciliation poll as a fallback for OIDC orgs that skip SCIM. SAML Single Logout was not implemented (documented gap in docs/sso.md) since the SAML library has no safe primitive for verifying an inbound signed LogoutRequest. LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%) --- config/plan_catalog.json | 3 +- .../20261029150000_create_scim_tokens.sql | 23 + .../20261029150100_create_sso_identities.sql | 42 ++ ...9150200_add_sso_reconciliation_columns.sql | 17 + db/schema.sql | 196 ++++++++- docs/audit-events.md | 7 + docs/sso.md | 143 ++++++ internal/api/auth/handlers.go | 5 +- internal/api/auth/sso_handlers.go | 101 ++++- internal/api/auth/token_service.go | 8 +- internal/api/scim_handlers.go | 410 ++++++++++++++++++ internal/api/server.go | 25 +- internal/api/sso_config.go | 64 ++- internal/api/users/handlers.go | 27 ++ internal/api/users/user_service.go | 175 +++++++- internal/auditlog/catalog.go | 15 + .../docs/routes_guide/settings/sso.md | 53 +++ internal/jobqueue/jobqueue.go | 22 +- .../jobqueue/sso_reconciliation_worker.go | 88 ++++ internal/license/plans.go | 1 + internal/scim/token.go | 153 +++++++ internal/scim/types.go | 78 ++++ internal/sso/config.go | 68 ++- internal/sso/identity_store.go | 110 +++++ internal/sso/oidc.go | 61 ++- internal/sso/saml.go | 1 + ui/src/pages/Settings/SSOSettingsTab.tsx | 178 ++++++++ 27 files changed, 2026 insertions(+), 48 deletions(-) create mode 100644 db/migrations/20261029150000_create_scim_tokens.sql create mode 100644 db/migrations/20261029150100_create_sso_identities.sql create mode 100644 db/migrations/20261029150200_add_sso_reconciliation_columns.sql create mode 100644 internal/api/scim_handlers.go create mode 100644 internal/jobqueue/sso_reconciliation_worker.go create mode 100644 internal/scim/token.go create mode 100644 internal/scim/types.go create mode 100644 internal/sso/identity_store.go diff --git a/config/plan_catalog.json b/config/plan_catalog.json index 6480e0b71..e709a10e1 100644 --- a/config/plan_catalog.json +++ b/config/plan_catalog.json @@ -123,7 +123,8 @@ "feature_flags": [ "unlimited_reviews", "hosted_auto_model", - "sso" + "sso", + "scim" ], "trial_policy": { "enabled": false, diff --git a/db/migrations/20261029150000_create_scim_tokens.sql b/db/migrations/20261029150000_create_scim_tokens.sql new file mode 100644 index 000000000..07b007971 --- /dev/null +++ b/db/migrations/20261029150000_create_scim_tokens.sql @@ -0,0 +1,23 @@ +-- migrate:up + +-- SCIM clients (Okta, Azure AD, Google Workspace) authenticate with a single +-- static bearer token per org, per the SCIM 2.0 RFC - there is no user +-- session involved. Modeled directly on api_keys' hashing scheme +-- (internal/api/api_keys.go: GenerateAPIKey/HashAPIKey/GetKeyPrefix), but +-- kept as its own table rather than reusing api_keys since a SCIM token is +-- org-bound with no owning user. +CREATE TABLE IF NOT EXISTS scim_tokens ( + id BIGSERIAL PRIMARY KEY, + org_id BIGINT NOT NULL REFERENCES orgs(id) ON DELETE CASCADE, + token_hash VARCHAR(64) NOT NULL UNIQUE, + token_prefix VARCHAR(16) NOT NULL, + created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), + expires_at TIMESTAMPTZ, + revoked_at TIMESTAMPTZ, + created_by_user_id BIGINT REFERENCES users(id) ON DELETE SET NULL +); + +CREATE INDEX IF NOT EXISTS idx_scim_tokens_org_id ON scim_tokens(org_id); + +-- migrate:down +DROP TABLE IF EXISTS scim_tokens; diff --git a/db/migrations/20261029150100_create_sso_identities.sql b/db/migrations/20261029150100_create_sso_identities.sql new file mode 100644 index 000000000..7970a6508 --- /dev/null +++ b/db/migrations/20261029150100_create_sso_identities.sql @@ -0,0 +1,42 @@ +-- migrate:up + +-- Tracks which IdP subject (OIDC `sub` / SAML NameID) maps to which +-- LiveReview user, per org and provider. Needed so an incoming OIDC +-- back-channel logout token or SAML LogoutRequest - which only carries the +-- IdP's own subject identifier, not a LiveReview user id - can be resolved +-- to a user whose sessions should be revoked. Also holds the encrypted OIDC +-- refresh token used by the optional reconciliation poll (see +-- org_sso_configs.reconciliation_enabled) to silently re-check "is this +-- account still valid at the IdP" between logins. +CREATE TABLE IF NOT EXISTS sso_identities ( + id BIGSERIAL PRIMARY KEY, + org_id BIGINT NOT NULL REFERENCES orgs(id) ON DELETE CASCADE, + user_id BIGINT NOT NULL REFERENCES users(id) ON DELETE CASCADE, + provider_type VARCHAR(16) NOT NULL CHECK (provider_type IN ('oidc', 'saml')), + subject VARCHAR(512) NOT NULL, + oidc_refresh_token_enc TEXT, + last_checked_at TIMESTAMPTZ, + created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), + updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), + UNIQUE (org_id, provider_type, subject) +); + +CREATE INDEX IF NOT EXISTS idx_sso_identities_user_id ON sso_identities(user_id); + +CREATE OR REPLACE FUNCTION set_sso_identities_updated_at() +RETURNS TRIGGER AS $$ +BEGIN + NEW.updated_at = NOW(); + RETURN NEW; +END; +$$ LANGUAGE plpgsql; + +CREATE TRIGGER trg_sso_identities_updated_at + BEFORE UPDATE ON sso_identities + FOR EACH ROW + EXECUTE FUNCTION set_sso_identities_updated_at(); + +-- migrate:down +DROP TRIGGER IF EXISTS trg_sso_identities_updated_at ON sso_identities; +DROP FUNCTION IF EXISTS set_sso_identities_updated_at(); +DROP TABLE IF EXISTS sso_identities; diff --git a/db/migrations/20261029150200_add_sso_reconciliation_columns.sql b/db/migrations/20261029150200_add_sso_reconciliation_columns.sql new file mode 100644 index 000000000..47ca39f13 --- /dev/null +++ b/db/migrations/20261029150200_add_sso_reconciliation_columns.sql @@ -0,0 +1,17 @@ +-- migrate:up + +-- Fallback deprovisioning for orgs that configure OIDC login but never wire +-- up SCIM at their IdP (a separate integration step many admins skip). Only +-- meaningful for provider_type='oidc' - SAML has no standing credential to +-- silently re-check, so the settings UI only exposes this toggle for OIDC. +ALTER TABLE org_sso_configs + ADD COLUMN IF NOT EXISTS reconciliation_enabled BOOLEAN NOT NULL DEFAULT FALSE, + ADD COLUMN IF NOT EXISTS reconciliation_interval TEXT NOT NULL DEFAULT 'daily' + CHECK (reconciliation_interval IN ('hourly', 'daily', 'weekly')), + ADD COLUMN IF NOT EXISTS last_reconciled_at TIMESTAMPTZ; + +-- migrate:down +ALTER TABLE org_sso_configs + DROP COLUMN IF EXISTS reconciliation_enabled, + DROP COLUMN IF EXISTS reconciliation_interval, + DROP COLUMN IF EXISTS last_reconciled_at; diff --git a/db/schema.sql b/db/schema.sql index 894fa428b..294a1b7d7 100644 --- a/db/schema.sql +++ b/db/schema.sql @@ -302,6 +302,20 @@ CREATE FUNCTION public.river_job_state_in_bitmask(bitmask bit, state public.rive $$; +-- +-- Name: set_sso_identities_updated_at(); Type: FUNCTION; Schema: public; Owner: - +-- + +CREATE FUNCTION public.set_sso_identities_updated_at() RETURNS trigger + LANGUAGE plpgsql + AS $$ +BEGIN + NEW.updated_at = NOW(); + RETURN NEW; +END; +$$; + + -- -- Name: trial_eligibility_set_updated_at(); Type: FUNCTION; Schema: public; Owner: - -- @@ -2133,7 +2147,11 @@ CREATE TABLE public.org_sso_configs ( created_at timestamp with time zone DEFAULT now() NOT NULL, updated_at timestamp with time zone DEFAULT now() NOT NULL, created_by_user_id bigint, - CONSTRAINT org_sso_configs_provider_type_check CHECK (((provider_type)::text = ANY ((ARRAY['oidc'::character varying, 'saml'::character varying])::text[]))) + reconciliation_enabled boolean DEFAULT false NOT NULL, + reconciliation_interval text DEFAULT 'daily'::text NOT NULL, + last_reconciled_at timestamp with time zone, + CONSTRAINT org_sso_configs_provider_type_check CHECK (((provider_type)::text = ANY ((ARRAY['oidc'::character varying, 'saml'::character varying])::text[]))), + CONSTRAINT org_sso_configs_reconciliation_interval_check CHECK ((reconciliation_interval = ANY (ARRAY['hourly'::text, 'daily'::text, 'weekly'::text]))) ); @@ -3428,6 +3446,78 @@ CREATE TABLE public.schema_migrations ( ); +-- +-- Name: scim_tokens; Type: TABLE; Schema: public; Owner: - +-- + +CREATE TABLE public.scim_tokens ( + id bigint NOT NULL, + org_id bigint NOT NULL, + token_hash character varying(64) NOT NULL, + token_prefix character varying(16) NOT NULL, + created_at timestamp with time zone DEFAULT now() NOT NULL, + expires_at timestamp with time zone, + revoked_at timestamp with time zone, + created_by_user_id bigint +); + + +-- +-- Name: scim_tokens_id_seq; Type: SEQUENCE; Schema: public; Owner: - +-- + +CREATE SEQUENCE public.scim_tokens_id_seq + START WITH 1 + INCREMENT BY 1 + NO MINVALUE + NO MAXVALUE + CACHE 1; + + +-- +-- Name: scim_tokens_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: - +-- + +ALTER SEQUENCE public.scim_tokens_id_seq OWNED BY public.scim_tokens.id; + + +-- +-- Name: sso_identities; Type: TABLE; Schema: public; Owner: - +-- + +CREATE TABLE public.sso_identities ( + id bigint NOT NULL, + org_id bigint NOT NULL, + user_id bigint NOT NULL, + provider_type character varying(16) NOT NULL, + subject character varying(512) NOT NULL, + oidc_refresh_token_enc text, + last_checked_at timestamp with time zone, + created_at timestamp with time zone DEFAULT now() NOT NULL, + updated_at timestamp with time zone DEFAULT now() NOT NULL, + CONSTRAINT sso_identities_provider_type_check CHECK (((provider_type)::text = ANY ((ARRAY['oidc'::character varying, 'saml'::character varying])::text[]))) +); + + +-- +-- Name: sso_identities_id_seq; Type: SEQUENCE; Schema: public; Owner: - +-- + +CREATE SEQUENCE public.sso_identities_id_seq + START WITH 1 + INCREMENT BY 1 + NO MINVALUE + NO MAXVALUE + CACHE 1; + + +-- +-- Name: sso_identities_id_seq; Type: SEQUENCE OWNED BY; Schema: public; Owner: - +-- + +ALTER SEQUENCE public.sso_identities_id_seq OWNED BY public.sso_identities.id; + + -- -- Name: subscription_payments; Type: TABLE; Schema: public; Owner: - -- @@ -4520,6 +4610,20 @@ ALTER TABLE ONLY public.scheduled_review_configs ALTER COLUMN id SET DEFAULT nex ALTER TABLE ONLY public.scheduled_review_runs ALTER COLUMN id SET DEFAULT nextval('public.scheduled_review_runs_id_seq'::regclass); +-- +-- Name: scim_tokens id; Type: DEFAULT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.scim_tokens ALTER COLUMN id SET DEFAULT nextval('public.scim_tokens_id_seq'::regclass); + + +-- +-- Name: sso_identities id; Type: DEFAULT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.sso_identities ALTER COLUMN id SET DEFAULT nextval('public.sso_identities_id_seq'::regclass); + + -- -- Name: subscription_payments id; Type: DEFAULT; Schema: public; Owner: - -- @@ -5340,6 +5444,38 @@ ALTER TABLE ONLY public.schema_migrations ADD CONSTRAINT schema_migrations_pkey PRIMARY KEY (version); +-- +-- Name: scim_tokens scim_tokens_pkey; Type: CONSTRAINT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.scim_tokens + ADD CONSTRAINT scim_tokens_pkey PRIMARY KEY (id); + + +-- +-- Name: scim_tokens scim_tokens_token_hash_key; Type: CONSTRAINT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.scim_tokens + ADD CONSTRAINT scim_tokens_token_hash_key UNIQUE (token_hash); + + +-- +-- Name: sso_identities sso_identities_org_id_provider_type_subject_key; Type: CONSTRAINT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.sso_identities + ADD CONSTRAINT sso_identities_org_id_provider_type_subject_key UNIQUE (org_id, provider_type, subject); + + +-- +-- Name: sso_identities sso_identities_pkey; Type: CONSTRAINT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.sso_identities + ADD CONSTRAINT sso_identities_pkey PRIMARY KEY (id); + + -- -- Name: subscription_payments subscription_payments_pkey; Type: CONSTRAINT; Schema: public; Owner: - -- @@ -7598,6 +7734,20 @@ CREATE INDEX idx_scheduled_review_configs_org_id ON public.scheduled_review_conf CREATE INDEX idx_scheduled_review_runs_config_id ON public.scheduled_review_runs USING btree (config_id, started_at DESC); +-- +-- Name: idx_scim_tokens_org_id; Type: INDEX; Schema: public; Owner: - +-- + +CREATE INDEX idx_scim_tokens_org_id ON public.scim_tokens USING btree (org_id); + + +-- +-- Name: idx_sso_identities_user_id; Type: INDEX; Schema: public; Owner: - +-- + +CREATE INDEX idx_sso_identities_user_id ON public.sso_identities USING btree (user_id); + + -- -- Name: idx_subscription_payments_captured; Type: INDEX; Schema: public; Owner: - -- @@ -9180,6 +9330,13 @@ CREATE TRIGGER trg_quota_operation_aggregates_updated_at BEFORE UPDATE ON public CREATE TRIGGER trg_quota_policy_catalog_updated_at BEFORE UPDATE ON public.quota_policy_catalog FOR EACH ROW EXECUTE FUNCTION public.quota_policy_catalog_set_updated_at(); +-- +-- Name: sso_identities trg_sso_identities_updated_at; Type: TRIGGER; Schema: public; Owner: - +-- + +CREATE TRIGGER trg_sso_identities_updated_at BEFORE UPDATE ON public.sso_identities FOR EACH ROW EXECUTE FUNCTION public.set_sso_identities_updated_at(); + + -- -- Name: trial_eligibility trg_trial_eligibility_updated_at; Type: TRIGGER; Schema: public; Owner: - -- @@ -9899,6 +10056,38 @@ ALTER TABLE ONLY public.scheduled_review_runs ADD CONSTRAINT scheduled_review_runs_review_id_fkey FOREIGN KEY (review_id) REFERENCES public.reviews(id) ON DELETE SET NULL; +-- +-- Name: scim_tokens scim_tokens_created_by_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.scim_tokens + ADD CONSTRAINT scim_tokens_created_by_user_id_fkey FOREIGN KEY (created_by_user_id) REFERENCES public.users(id) ON DELETE SET NULL; + + +-- +-- Name: scim_tokens scim_tokens_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.scim_tokens + ADD CONSTRAINT scim_tokens_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE; + + +-- +-- Name: sso_identities sso_identities_org_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.sso_identities + ADD CONSTRAINT sso_identities_org_id_fkey FOREIGN KEY (org_id) REFERENCES public.orgs(id) ON DELETE CASCADE; + + +-- +-- Name: sso_identities sso_identities_user_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: - +-- + +ALTER TABLE ONLY public.sso_identities + ADD CONSTRAINT sso_identities_user_id_fkey FOREIGN KEY (user_id) REFERENCES public.users(id) ON DELETE CASCADE; + + -- -- Name: subscription_payments subscription_payments_subscription_id_fkey; Type: FK CONSTRAINT; Schema: public; Owner: - -- @@ -10301,4 +10490,7 @@ INSERT INTO public.schema_migrations (version) VALUES ('20261025120100'), ('20261025130000'), ('20261029104047'), - ('20261029134500'); + ('20261029134500'), + ('20261029150000'), + ('20261029150100'), + ('20261029150200'); diff --git a/docs/audit-events.md b/docs/audit-events.md index 3ce3bc80b..0d02adbbd 100644 --- a/docs/audit-events.md +++ b/docs/audit-events.md @@ -58,6 +58,7 @@ Generated from `internal/auditlog/catalog.go`. | `auth.logout` | `auth` | session | info | Signed out | A user ended a session. | | `auth.password.change` | `auth` | user | warning | Password changed | A user changed their password. | | `auth.password.reset.complete` | `auth` | user | warning | Password reset completed | A user completed a required password reset. | +| `auth.session.revoke` | `auth` | session | warning | Sessions revoked | A user's active sessions and refresh tokens were revoked, typically following deactivation. | | `auth.sso.provision` | `auth` | user | info | SSO account provisioned | An account was provisioned through SSO. | | `auth.token.refresh` | `auth` | session | info | Session refreshed | A session token was refreshed. | | `auto_approve.policy.create` | `settings` | policy | warning | Auto-approve policy created | An auto-approve policy was created. | @@ -106,6 +107,12 @@ Generated from `internal/auditlog/catalog.go`. | `ruleset.create` | `repository` | ruleset | warning | Ruleset created | A CI ruleset was created. | | `ruleset.delete` | `repository` | ruleset | warning | Ruleset deleted | A CI ruleset was deleted. | | `ruleset.update` | `repository` | ruleset | warning | Ruleset updated | A CI ruleset was changed. | +| `scim.token.create` | `auth` | scim_token | warning | SCIM token created | An org's SCIM bearer token was generated or rotated. | +| `scim.token.revoke` | `auth` | scim_token | warning | SCIM token revoked | An org's SCIM bearer token was revoked. | +| `scim.user.create` | `auth` | user | info | SCIM user provisioned | An identity provider created or linked a user via SCIM. | +| `scim.user.deactivate` | `auth` | user | warning | SCIM user deactivated | An identity provider deactivated a user via SCIM. | +| `scim.user.reactivate` | `auth` | user | warning | SCIM user reactivated | An identity provider reactivated a user via SCIM. | +| `scim.user.update` | `auth` | user | info | SCIM user updated | An identity provider updated a user's attributes via SCIM. | | `settings.auto_approve.update` | `settings` | setting | warning | Auto-approve updated | The auto-approve policy was changed. | | `settings.managed_ai.update` | `settings` | setting | critical | Managed AI updated | LiveReview-managed AI configuration was changed. | | `settings.prompts.update` | `settings` | prompt | warning | Prompts updated | Review prompts were changed. | diff --git a/docs/sso.md b/docs/sso.md index 902faa32f..2e9412f9c 100644 --- a/docs/sso.md +++ b/docs/sso.md @@ -373,3 +373,146 @@ and the four pre-merge security scanners (`make security-osv`, `security-gitleaks` no leaks. `go test ./...`, `go test ./internal/auditlog/...`, and `make test-sso-e2e` (both protocols) all re-verified green after every fix in this phase. + +--- + +## Deprovisioning & lifecycle sync (follow-up, 2026-10-29) + +The phases above cover provisioning only (JIT create/login). An audit found +zero offboarding story: SSO login silently re-activated deactivated users, +deactivation never revoked a live JWT session, there was no automated +deprovisioning (SCIM), and no real-time session kill from the IdP. This +section closes those gaps. + +### Phase 7 — Reactivation fix + session revocation — ✅ DONE +- [x] `jitProvisionSSOUser` (`internal/api/auth/sso_handlers.go`) now checks + `is_active` before linking an existing user into an org; a deactivated + user's SSO login is rejected (`errSSOAccountDeactivated` → + `account_deactivated` failure redirect) instead of being silently + flipped back to active. The old unconditional + `UPDATE users SET ... is_active = TRUE` is gone. +- [x] `POST /api/v1/orgs/:org_id/users/:user_id/reactivate` (new + `ReactivateUser` handler + `UserService.ReactivateUserInOrg`) - the + only path back to `is_active=true` now, since SSO deliberately never + does this itself. +- [x] `UserService.DeactivateUserInOrg` now revokes every live `auth_tokens` + row for that user in the same transaction as the deactivation - + without this, a fired user's already-issued JWT kept working until + its own expiry regardless of admin action. New `ActionSessionRevoke` + (`auth.session.revoke`) audit action. +- [x] `TokenService.ValidateAccessToken` now filters `is_active = true` on + the user lookup, as defense in depth (matching + `APIKeyManager.ValidateAPIKey`'s existing behavior) - belt-and-suspenders + in case a future deactivation path forgets to revoke tokens directly. +- [x] Regression set green: `go test ./...` (pre-existing, unrelated + failures only - confirmed via `git status` that none of the failing + packages were touched), `go test ./internal/auditlog/...` clean. + +### Phase 8 — SCIM 2.0 provisioning/deprovisioning — ✅ DONE +- [x] New `internal/scim` package: bearer-token hashing/store + (`token.go`, modeled on `internal/api/api_keys.go`'s scheme) + minimal + SCIM 2.0 protocol types (`types.go`) covering what Okta/Azure + AD/Google actually use for lifecycle sync. +- [x] `scim_tokens` table (`db/migrations/20261029150000_create_scim_tokens.sql`) + - one static bearer token per org, no user session involved, per the + SCIM RFC. +- [x] `internal/api/scim_handlers.go`: `GET/POST /scim/v2/Users`, + `GET/PATCH /scim/v2/Users/:id`, authenticated via + `requireSCIMBearerAuth` (resolves `org_id` from the token itself, + never a client-supplied id) and gated on the new `"scim"` plan feature + (`internal/license/plans.go` + `config/plan_catalog.json`, same + pattern as `"sso"`). `PATCH active:false` → `DeactivateUserInOrgBySCIM` + (new `UserService` method - same deactivate+revoke-tokens logic as + Phase 7, but with `deactivated_by_user_id = NULL` since the actor is + the IdP, not a LiveReview user); `active:true` → `ReactivateUserInOrgBySCIM`. + Create uses the new `UserService.ProvisionSCIMUser`, which mirrors the + SSO JIT-create path (random unusable password, member role) rather + than the owner-driven `CreateUserInOrg`, since SCIM provisioning must + never send an invitation email. +- [x] Org-scoped, session-authenticated token management: + `GET/POST/DELETE /api/v1/orgs/:org_id/scim-token` (generate, rotate, + revoke - plaintext shown once, same reveal-once convention as an API + key), gated the same way as `/sso-config`. +- [x] New audit actions `scim.user.create/update/deactivate/reactivate`, + `scim.token.create/revoke` in `internal/auditlog/catalog.go` + + `docs/audit-events.md`. SCIM-triggered events use + `auditRecorder.Webhook(...)` (no user session to attribute them to - + same category as a provider webhook). +- [x] Settings UI: SCIM Provisioning panel at the bottom of + `SSOSettingsTab.tsx` - generate/rotate/revoke the token, shows the + SCIM base URL to paste into the IdP's SCIM app config. +- [x] `npx tsc --noEmit` clean. Build clean, `go test ./internal/auditlog/...` + clean. + +### Phase 9 — OIDC back-channel logout / SAML SLO — PARTIAL (OIDC done, SAML not shipped) +- [x] `sso_identities` table + (`db/migrations/20261029150100_create_sso_identities.sql`): maps + `(org_id, provider_type, subject)` → LiveReview `user_id`, populated + on every successful login (`internal/sso/identity_store.go`, + `IdentityStore.Upsert` called from `completeSSOLogin`). Needed + because an incoming logout event only ever carries the IdP's own + subject, never a LiveReview user id. +- [x] `POST /api/v1/auth/sso/oidc/:org_id/backchannel-logout` + (`SSOOIDCBackChannelLogout`): verifies the IdP's `logout_token` JWT + the same way an ID token is verified (`sso.VerifyBackChannelLogoutToken` + - same issuer/signature/audience/expiry checks via `go-oidc`, plus the + OIDC Back-Channel Logout 1.0 `events` claim check), resolves the + subject via `sso_identities`, and revokes that user's `auth_tokens` + immediately. Per spec, always responds `200` once the token verifies, + even if there's nothing to revoke, so the endpoint never leaks account + existence. +- [ ] **SAML Single Logout (SLO) was not implemented.** `crewjam/saml` + v0.5.1 only exposes signature verification for the full + `ParseResponse`/assertion flow; it has no public primitive for + verifying a *signed, IdP-initiated* `LogoutRequest` on its own. Hand-rolling + XML-dsig verification for this one message type was judged too high-risk + to ship quickly and correctly - accepting an unverified "logout" request + would let anyone force-logout a known subject without proving they're + the IdP. SAML orgs rely on Phases 7/8 (manual deactivation, SCIM) and + normal JWT expiry for this gap; revisit if a later `crewjam/saml` + release (or a vetted standalone XML-dsig verifier) exposes a safe + primitive for inbound `LogoutRequest` verification. +- [x] Build clean; `go test ./internal/sso/...` and related packages pass + (no e2e back-channel-logout test added yet - would need a Keycloak + realm configured to actually send back-channel logout tokens, which + isn't wired into the existing `test/fixtures/keycloak/` fixture). + +### Phase 10 — Reconciliation poll (fallback for orgs without SCIM) — ✅ DONE +- [x] `org_sso_configs` gains `reconciliation_enabled`, + `reconciliation_interval` (`hourly`/`daily`/`weekly`, default `daily`), + `last_reconciled_at` + (`db/migrations/20261029150200_add_sso_reconciliation_columns.sql`) - + OIDC-only; SAML has no standing credential to silently re-check, so + the UI only shows this toggle on the OIDC panel. +- [x] When enabled, the OIDC auth flow requests the `offline_access` scope + (`sso.BuildOIDCOAuth2Config`) and `sso_identities` stores the + encrypted refresh token per identity (same AES-GCM box as the client + secret). +- [x] `internal/jobqueue/sso_reconciliation_worker.go` + (`SSOReconciliationWorker`, registered as a 15-minute `river.PeriodicJob` + named `sso_reconciliation`): queries + `sso.Store.ListDueForReconciliation()` for configs whose interval has + elapsed, and for each, attempts a silent refresh-token exchange for + every stored identity. `invalid_grant`/any refresh failure (what + Okta/Azure/Google return for a disabled/deleted/de-authorized account) + → `DeactivateUserInOrgBySCIM`, same as a real SCIM deactivation. One + coordinator `Work()` call does the per-org fan-out inline, same shape + `RiskModelRefitWorker` already uses - no separate one-shot job type + needed. +- [x] Settings UI: "Automatic deprovisioning check" toggle + interval + dropdown on the OIDC panel in `SSOSettingsTab.tsx`, shows last-checked + time when available. +- [x] This is the direct answer to "how often does this sync": SCIM + (Phase 8) is real-time, push-based - there's no interval for it. This + poll's interval is the *maximum extra latency* for OIDC orgs that skip + SCIM; Phases 7's session revocation already cuts off a deactivated + user's existing session immediately regardless of this job's schedule. +- [x] Build clean, `go test ./internal/jobqueue/...` and `./internal/sso/...` + pass, no import cycle introduced (`internal/jobqueue` importing + `internal/api/users` was checked explicitly - no reverse dependency). + +**Known gaps after Phases 7-10:** no e2e test harness yet for SCIM, the +reconciliation poll, or OIDC back-channel logout against a real Keycloak +(the existing `test/fixtures/keycloak/` realm only covers login); SAML SLO +is not implemented (see Phase 9). These would be the natural next additions +if a future session has the budget for them. diff --git a/internal/api/auth/handlers.go b/internal/api/auth/handlers.go index c18a643f8..69d410640 100644 --- a/internal/api/auth/handlers.go +++ b/internal/api/auth/handlers.go @@ -33,8 +33,9 @@ type AuthHandlers struct { onboardingKeyGenerator func(tx *sql.Tx, userID, orgID int64) (string, error) // sso/ssoState are optional (nil in tests that never call SetSSO): SSO // login routes degrade to "not configured" rather than panicking. - sso *sso.Store - ssoState *sso.StateSigner + sso *sso.Store + ssoState *sso.StateSigner + ssoIdentities *sso.IdentityStore } // NewAuthHandlers creates a new authentication handlers instance diff --git a/internal/api/auth/sso_handlers.go b/internal/api/auth/sso_handlers.go index 43f1bd721..ca6598414 100644 --- a/internal/api/auth/sso_handlers.go +++ b/internal/api/auth/sso_handlers.go @@ -5,6 +5,7 @@ import ( "database/sql" "encoding/hex" "encoding/xml" + "errors" "fmt" "log" "net/http" @@ -19,6 +20,11 @@ import ( "golang.org/x/crypto/bcrypt" ) +// errSSOAccountDeactivated is returned by jitProvisionSSOUser when the +// matched user has been deactivated. SSO login must never resurrect a +// deactivated account - that's an explicit admin action only. +var errSSOAccountDeactivated = errors.New("sso: account is deactivated") + // SetSSO wires the SSO config store and state signer into the auth // handlers. Both the OIDC and (later) SAML login routes, and the config // CRUD handlers that validate against a live IdP, depend on this. @@ -27,6 +33,13 @@ func (h *AuthHandlers) SetSSO(store *sso.Store, jwtSecret string) { h.ssoState = sso.NewStateSigner(jwtSecret) } +// SetSSOIdentities wires the subject->user identity store in, used to +// resolve incoming OIDC back-channel logout tokens / SAML LogoutRequests to +// a LiveReview user (Phase 4 of docs/sso.md's deprovisioning section). +func (h *AuthHandlers) SetSSOIdentities(store *sso.IdentityStore) { + h.ssoIdentities = store +} + // baseURL derives this request's own origin, used both as the OIDC/SAML // redirect/ACS URL registered with the IdP and as the final browser // redirect back into the frontend. Self-hosted serves API and frontend from @@ -159,6 +172,59 @@ func (h *AuthHandlers) SSOOIDCCallback(c echo.Context) error { return h.completeSSOLogin(c, orgID, identity, "sso_oidc") } +// SSOOIDCBackChannelLogout is public: POST /api/v1/auth/sso/oidc/:org_id/backchannel-logout. +// Per OIDC Back-Channel Logout 1.0, the IdP calls this directly (no +// browser involved) when a user logs out or is disabled at the IdP, so +// LiveReview can revoke that user's sessions in near real time rather than +// waiting for their JWT to expire or the next SCIM/reconciliation sweep. +// Best-effort and intentionally quiet on any resolution failure (unknown +// subject, SSO not configured, etc.) - per spec, this endpoint must not +// leak account existence, so it always responds 200 once the token itself +// verifies, even if there's nothing on LiveReview's side to revoke. +func (h *AuthHandlers) SSOOIDCBackChannelLogout(c echo.Context) error { + orgID, err := strconv.ParseInt(c.Param("org_id"), 10, 64) + if err != nil || orgID <= 0 { + return c.String(http.StatusBadRequest, "invalid org") + } + if h.sso == nil { + return c.String(http.StatusNotFound, "sso not configured") + } + cfg, err := h.sso.Get(orgID, sso.ProviderOIDC) + if err != nil || !cfg.Enabled { + return c.String(http.StatusNotFound, "sso not configured") + } + logoutToken := c.Request().PostFormValue("logout_token") + if logoutToken == "" { + return c.String(http.StatusBadRequest, "missing logout_token") + } + subject, err := sso.VerifyBackChannelLogoutToken(c.Request().Context(), cfg, logoutToken) + if err != nil { + log.Printf("[sso] back-channel logout token verification failed for org %d: %v", orgID, err) + return c.String(http.StatusBadRequest, "invalid logout_token") + } + if h.ssoIdentities == nil { + return c.NoContent(http.StatusOK) + } + userID, err := h.ssoIdentities.LookupUserBySubject(orgID, sso.ProviderOIDC, subject) + if err != nil { + return c.NoContent(http.StatusOK) + } + if _, err := h.db.Exec(`UPDATE auth_tokens SET is_active = false, revoked_at = NOW() WHERE user_id = $1 AND is_active = true`, userID); err != nil { + log.Printf("[sso] back-channel logout: failed to revoke sessions for user %d: %v", userID, err) + return c.NoContent(http.StatusOK) + } + h.recordAuthEvent(c, auditlog.Event{ + OrgID: orgID, + ActorUserID: &userID, + ActorKind: auditlog.ActorKindMember, + Action: auditlog.ActionSessionRevoke, + Outcome: auditlog.OutcomeSuccess, + Severity: auditlog.SeverityWarning, + Details: auditlog.Details("method", "sso_oidc_backchannel_logout"), + }) + return c.NoContent(http.StatusOK) +} + // samlURLs derives this org's metadata/ACS URLs from the current request's // own origin, same reasoning as baseURL for OIDC's redirect URL. func samlURLs(c echo.Context, orgID int64) (metadataURL, acsURL string) { @@ -284,7 +350,12 @@ func (h *AuthHandlers) completeSSOLogin(c echo.Context, orgID int64, identity *s user, created, err := h.jitProvisionSSOUser(orgID, email, identity.Name) if err != nil { - log.Printf("[sso] JIT provisioning failed for %s in org %d: %v", email, orgID, err) + reason := "provisioning_failed" + if errors.Is(err, errSSOAccountDeactivated) { + reason = "account_deactivated" + } else { + log.Printf("[sso] JIT provisioning failed for %s in org %d: %v", email, orgID, err) + } h.recordAuthEvent(c, auditlog.Event{ OrgID: orgID, ActorEmail: email, @@ -292,9 +363,9 @@ func (h *AuthHandlers) completeSSOLogin(c echo.Context, orgID int64, identity *s Action: auditlog.ActionLoginFailure, Outcome: auditlog.OutcomeFailure, Severity: auditlog.SeverityWarning, - Details: auditlog.Details("method", method, "reason", "provisioning_failed"), + Details: auditlog.Details("method", method, "reason", reason), }) - return ssoFailureRedirect(c, "provisioning_failed") + return ssoFailureRedirect(c, reason) } userAgent := c.Request().Header.Get("User-Agent") @@ -307,6 +378,19 @@ func (h *AuthHandlers) completeSSOLogin(c echo.Context, orgID int64, identity *s _, _ = h.db.Exec(`UPDATE users SET last_login_at = NOW() WHERE id = $1`, user.ID) + if h.ssoIdentities != nil && identity.Subject != "" { + provider := sso.ProviderOIDC + if method == "sso_saml" { + provider = sso.ProviderSAML + } + if err := h.ssoIdentities.Upsert(orgID, user.ID, provider, identity.Subject, identity.RefreshToken); err != nil { + // Non-fatal: this only degrades back-channel logout resolution + // and the reconciliation poll for this login, never the login + // itself. + log.Printf("[sso] failed to record identity mapping for org %d user %d: %v", orgID, user.ID, err) + } + } + uid := user.ID actorKind, actorCapacity := h.actorFor(user) if created { @@ -352,6 +436,7 @@ func (h *AuthHandlers) completeSSOLogin(c echo.Context, orgID int64, identity *s // login path until an owner sets one). func (h *AuthHandlers) jitProvisionSSOUser(orgID int64, email, displayName string) (*models.User, bool, error) { var userID int64 + var isActive bool created := false err := func() error { @@ -361,7 +446,7 @@ func (h *AuthHandlers) jitProvisionSSOUser(orgID int64, email, displayName strin } defer tx.Rollback() - err = tx.QueryRow(`SELECT id FROM users WHERE email = $1`, email).Scan(&userID) + err = tx.QueryRow(`SELECT id, is_active FROM users WHERE email = $1`, email).Scan(&userID, &isActive) if err == sql.ErrNoRows { randBytes := make([]byte, 32) if _, rerr := rand.Read(randBytes); rerr != nil { @@ -389,6 +474,12 @@ func (h *AuthHandlers) jitProvisionSSOUser(orgID int64, email, displayName strin } else if err != nil { return err } else { + if !isActive { + // Deactivation is an explicit admin action; SSO login must + // never silently undo it. Reject here rather than + // reactivating - see errSSOAccountDeactivated. + return errSSOAccountDeactivated + } var isMember bool if err := tx.QueryRow(`SELECT EXISTS(SELECT 1 FROM user_roles WHERE user_id = $1 AND org_id = $2)`, userID, orgID).Scan(&isMember); err != nil { return err @@ -402,7 +493,7 @@ func (h *AuthHandlers) jitProvisionSSOUser(orgID int64, email, displayName strin } created = true } - if _, err := tx.Exec(`UPDATE users SET default_org_id = COALESCE(default_org_id, $1), is_active = TRUE WHERE id = $2`, orgID, userID); err != nil { + if _, err := tx.Exec(`UPDATE users SET default_org_id = COALESCE(default_org_id, $1) WHERE id = $2`, orgID, userID); err != nil { return err } } diff --git a/internal/api/auth/token_service.go b/internal/api/auth/token_service.go index 65bdbc5f3..93e6ce499 100644 --- a/internal/api/auth/token_service.go +++ b/internal/api/auth/token_service.go @@ -236,11 +236,15 @@ func (ts *TokenService) ValidateAccessToken(tokenString string) (*models.User, e fmt.Printf("Warning: failed to update last_used_at: %v\n", err) } - // Get user details + // Get user details. The is_active filter is defense in depth: deactivation + // (internal/api/users/user_service.go's DeactivateUserInOrg) already + // revokes this user's auth_tokens rows directly, but this guards against + // any future deactivation path that forgets to, same as + // APIKeyManager.ValidateAPIKey already does for API keys. user := &models.User{} err = ts.db.QueryRow(` SELECT id, email, password_hash, default_org_id, created_at, updated_at - FROM users WHERE id = $1 + FROM users WHERE id = $1 AND is_active = true `, claims.UserID).Scan(&user.ID, &user.Email, &user.PasswordHash, &user.DefaultOrgID, &user.CreatedAt, &user.UpdatedAt) if err != nil { diff --git a/internal/api/scim_handlers.go b/internal/api/scim_handlers.go new file mode 100644 index 000000000..eb9159c12 --- /dev/null +++ b/internal/api/scim_handlers.go @@ -0,0 +1,410 @@ +package api + +import ( + "database/sql" + "errors" + "net/http" + "strconv" + "strings" + "time" + + "github.com/labstack/echo/v4" + "github.com/livereview/internal/api/auth" + apimiddleware "github.com/livereview/internal/api/middleware" + "github.com/livereview/internal/api/users" + "github.com/livereview/internal/auditlog" + "github.com/livereview/internal/license" + "github.com/livereview/internal/scim" +) + +// orgHasSCIMFeature mirrors orgHasSSOFeature (internal/api/sso_config.go) - +// checks the org's own plan rather than a hardcoded self-hosted bit, so +// adding "scim" to a cloud plan's Features later needs no code change here. +func (s *Server) orgHasSCIMFeature(orgID int64) bool { + var planCode string + _ = s.db.QueryRow(`SELECT current_plan_code FROM org_billing_state WHERE org_id = $1`, orgID).Scan(&planCode) + return license.PlanType(planCode).HasFeature("scim") +} + +// requireSCIMBearerAuth authenticates SCIM clients (Okta, Azure AD, Google +// Workspace) via their org's static bearer token - there is no user +// session on this path, per the SCIM 2.0 RFC. On success it sets +// "scim_org_id" in the echo context for the handlers below. +func (s *Server) requireSCIMBearerAuth(next echo.HandlerFunc) echo.HandlerFunc { + return func(c echo.Context) error { + authHeader := c.Request().Header.Get("Authorization") + const prefix = "Bearer " + if !strings.HasPrefix(authHeader, prefix) { + return c.JSON(http.StatusUnauthorized, scim.NewError(http.StatusUnauthorized, "missing bearer token")) + } + token := strings.TrimSpace(strings.TrimPrefix(authHeader, prefix)) + orgID, err := s.scimTokens.Authenticate(token) + if err != nil { + return c.JSON(http.StatusUnauthorized, scim.NewError(http.StatusUnauthorized, "invalid, expired, or revoked token")) + } + if !s.orgHasSCIMFeature(orgID) { + return c.JSON(http.StatusForbidden, scim.NewError(http.StatusForbidden, "SCIM requires an enterprise self-hosted license")) + } + c.Set("scim_org_id", orgID) + return next(c) + } +} + +func scimOrgID(c echo.Context) int64 { + return c.Get("scim_org_id").(int64) +} + +// scimResourceFromUser converts an internal user record into the SCIM +// shape IdPs expect. +func scimResourceFromUser(u *users.UserWithRole) scim.UserResource { + first, last := "", "" + if u.FirstName != nil { + first = *u.FirstName + } + if u.LastName != nil { + last = *u.LastName + } + return scim.UserResource{ + Schemas: []string{scim.SchemaUser}, + ID: strconv.FormatInt(u.ID, 10), + UserName: u.Email, + Name: &scim.NameResource{GivenName: first, FamilyName: last}, + Emails: []scim.EmailResource{{Value: u.Email, Primary: true}}, + Active: u.IsActive, + Meta: &scim.MetaResource{ + ResourceType: "User", + Created: u.CreatedAt.Format(time.RFC3339), + LastModified: u.UpdatedAt.Format(time.RFC3339), + }, + } +} + +// primaryEmail extracts the identifying email from a SCIM UserResource - +// IdPs vary on whether they populate userName or emails[] with the address +// that matters, so this checks both. +func primaryEmail(r scim.UserResource) string { + for _, e := range r.Emails { + if e.Primary && e.Value != "" { + return strings.ToLower(strings.TrimSpace(e.Value)) + } + } + if len(r.Emails) > 0 && r.Emails[0].Value != "" { + return strings.ToLower(strings.TrimSpace(r.Emails[0].Value)) + } + if strings.Contains(r.UserName, "@") { + return strings.ToLower(strings.TrimSpace(r.UserName)) + } + return "" +} + +// parseEmailFilter extracts the target email from the simple SCIM filter +// expressions IdPs actually send when checking "does this user already +// exist" before creating - userName eq "x@y.com" or emails.value eq +// "x@y.com". Full SCIM filter grammar (and/or/not, other attributes) is not +// needed for this use case and isn't parsed. +func parseEmailFilter(filter string) string { + filter = strings.TrimSpace(filter) + for _, attr := range []string{"userName", "emails.value", "emails"} { + prefix := attr + " eq " + if idx := strings.Index(filter, prefix); idx != -1 { + rest := strings.TrimSpace(filter[idx+len(prefix):]) + rest = strings.Trim(rest, `"`) + return strings.ToLower(rest) + } + } + return "" +} + +// SCIMListUsers handles GET /scim/v2/Users. IdPs call this both to page +// through the directory and, far more commonly, with a `filter` to check +// whether a user already exists before POSTing a create. +func (s *Server) SCIMListUsers(c echo.Context) error { + orgID := scimOrgID(c) + email := parseEmailFilter(c.QueryParam("filter")) + + type row struct { + id int64 + email string + isActive bool + firstName, lastName sql.NullString + createdAt, updatedAt time.Time + } + var rows []row + + if email != "" { + var r row + err := s.db.QueryRow(` + SELECT u.id, u.email, u.is_active, u.first_name, u.last_name, u.created_at, u.updated_at + FROM users u JOIN user_roles ur ON ur.user_id = u.id + WHERE u.email = $1 AND ur.org_id = $2 + `, email, orgID).Scan(&r.id, &r.email, &r.isActive, &r.firstName, &r.lastName, &r.createdAt, &r.updatedAt) + if err == nil { + rows = append(rows, r) + } else if err != sql.ErrNoRows { + return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to query users")) + } + } else { + sqlRows, err := s.db.Query(` + SELECT u.id, u.email, u.is_active, u.first_name, u.last_name, u.created_at, u.updated_at + FROM users u JOIN user_roles ur ON ur.user_id = u.id + WHERE ur.org_id = $1 ORDER BY u.id LIMIT 200 + `, orgID) + if err != nil { + return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to query users")) + } + defer sqlRows.Close() + for sqlRows.Next() { + var r row + if err := sqlRows.Scan(&r.id, &r.email, &r.isActive, &r.firstName, &r.lastName, &r.createdAt, &r.updatedAt); err != nil { + return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to read users")) + } + rows = append(rows, r) + } + } + + resources := make([]scim.UserResource, 0, len(rows)) + for _, r := range rows { + first, last := "", "" + if r.firstName.Valid { + first = r.firstName.String + } + if r.lastName.Valid { + last = r.lastName.String + } + resources = append(resources, scim.UserResource{ + Schemas: []string{scim.SchemaUser}, + ID: strconv.FormatInt(r.id, 10), + UserName: r.email, + Name: &scim.NameResource{GivenName: first, FamilyName: last}, + Emails: []scim.EmailResource{{Value: r.email, Primary: true}}, + Active: r.isActive, + Meta: &scim.MetaResource{ + ResourceType: "User", + Created: r.createdAt.Format(time.RFC3339), + LastModified: r.updatedAt.Format(time.RFC3339), + }, + }) + } + + return c.JSON(http.StatusOK, scim.ListResponse{ + Schemas: []string{scim.SchemaListResponse}, + TotalResults: len(resources), + ItemsPerPage: len(resources), + StartIndex: 1, + Resources: resources, + }) +} + +// SCIMCreateUser handles POST /scim/v2/Users. +func (s *Server) SCIMCreateUser(c echo.Context) error { + orgID := scimOrgID(c) + + var req scim.UserResource + if err := c.Bind(&req); err != nil { + return c.JSON(http.StatusBadRequest, scim.NewError(http.StatusBadRequest, "invalid request body")) + } + email := primaryEmail(req) + if email == "" { + return c.JSON(http.StatusBadRequest, scim.NewError(http.StatusBadRequest, "userName or emails is required")) + } + first, last := "", "" + if req.Name != nil { + first, last = req.Name.GivenName, req.Name.FamilyName + } + + user, created, err := s.userService.ProvisionSCIMUser(orgID, email, first, last) + if err != nil { + if errors.Is(err, users.ErrSCIMAccountDeactivated) { + return c.JSON(http.StatusConflict, scim.NewError(http.StatusConflict, "this account was deactivated by an organization admin")) + } + return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to provision user")) + } + if created && s.auditRecorder != nil { + _ = s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserCreate, auditlog.Details("email", email)) + } + return c.JSON(http.StatusCreated, scimResourceFromUser(user)) +} + +// SCIMGetUser handles GET /scim/v2/Users/:id. +func (s *Server) SCIMGetUser(c echo.Context) error { + orgID := scimOrgID(c) + userID, err := strconv.ParseInt(c.Param("id"), 10, 64) + if err != nil { + return c.JSON(http.StatusBadRequest, scim.NewError(http.StatusBadRequest, "invalid id")) + } + user, err := s.userService.GetUserInOrg(orgID, userID) + if err != nil { + return c.JSON(http.StatusNotFound, scim.NewError(http.StatusNotFound, "user not found")) + } + return c.JSON(http.StatusOK, scimResourceFromUser(user)) +} + +// SCIMPatchUser handles PATCH /scim/v2/Users/:id - the operation that +// matters most for offboarding: IdPs send +// {"Operations":[{"op":"replace","value":{"active":false}}]} to deprovision. +func (s *Server) SCIMPatchUser(c echo.Context) error { + orgID := scimOrgID(c) + userID, err := strconv.ParseInt(c.Param("id"), 10, 64) + if err != nil { + return c.JSON(http.StatusBadRequest, scim.NewError(http.StatusBadRequest, "invalid id")) + } + if _, err := s.userService.GetUserInOrg(orgID, userID); err != nil { + return c.JSON(http.StatusNotFound, scim.NewError(http.StatusNotFound, "user not found")) + } + + var req scim.PatchRequest + if err := c.Bind(&req); err != nil { + return c.JSON(http.StatusBadRequest, scim.NewError(http.StatusBadRequest, "invalid request body")) + } + + for _, op := range req.Operations { + active, ok := patchActiveValue(op) + if !ok { + continue + } + if active { + if err := s.userService.ReactivateUserInOrgBySCIM(userID); err != nil { + return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to reactivate user")) + } + if s.auditRecorder != nil { + _ = s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserReactivate, auditlog.Details("user_id", userID)) + } + } else { + if err := s.userService.DeactivateUserInOrgBySCIM(userID); err != nil { + return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to deactivate user")) + } + if s.auditRecorder != nil { + _ = s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserDeactivate, auditlog.Details("user_id", userID)) + } + } + } + + user, err := s.userService.GetUserInOrg(orgID, userID) + if err != nil { + return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to reload user")) + } + return c.JSON(http.StatusOK, scimResourceFromUser(user)) +} + +// patchActiveValue reports whether op sets the SCIM "active" attribute, +// and what it was set to. Handles both the common {"active": false} +// whole-object replace and the path-qualified {"path":"active","value":false} form. +func patchActiveValue(op scim.PatchOperation) (active bool, matched bool) { + if !strings.EqualFold(op.Op, "replace") { + return false, false + } + if strings.EqualFold(op.Path, "active") { + if b, ok := op.Value.(bool); ok { + return b, true + } + return false, false + } + if op.Path == "" { + if m, ok := op.Value.(map[string]any); ok { + if b, ok := m["active"].(bool); ok { + return b, true + } + } + } + return false, false +} + +// --- SCIM token management (session-authenticated, owner-only) --- + +// requireSCIMConfigAccess mirrors requireSSOAccess (internal/api/sso_config.go): +// Sensitive Operations Gate + Session-Only Gating + self-hosted-enterprise +// feature check, for the org's SCIM token itself. +func (s *Server) requireSCIMConfigAccess(c echo.Context, orgID int64) error { + if err := requireSession(c); err != nil { + return err + } + pc := auth.GetPermissionContext(c) + if pc == nil { + return c.JSON(http.StatusForbidden, map[string]string{"error": "only org owners can manage SCIM provisioning"}) + } + if err := pc.RequireOrgOwner(); err != nil { + return c.JSON(http.StatusForbidden, map[string]string{"error": "only org owners can manage SCIM provisioning"}) + } + if apimiddleware.IsCloudMode() { + return c.JSON(http.StatusForbidden, map[string]string{"error": "SCIM is available on self-hosted enterprise deployments only"}) + } + if !s.orgHasSCIMFeature(orgID) { + return c.JSON(http.StatusForbidden, map[string]string{"error": "SCIM requires an enterprise self-hosted license"}) + } + return nil +} + +type scimTokenResponse struct { + TokenPrefix string `json:"token_prefix"` + CreatedAt string `json:"created_at"` + Token *string `json:"token,omitempty"` // only populated once, on creation +} + +// GetSCIMToken is GET /orgs/:org_id/scim-token - returns the existing +// token's metadata (never the plaintext, which is only ever shown at +// creation time). +func (s *Server) GetSCIMToken(c echo.Context) error { + orgID, err := strconv.ParseInt(c.Param("org_id"), 10, 64) + if err != nil { + return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid org_id"}) + } + if err := s.requireSCIMConfigAccess(c, orgID); err != nil { + return err + } + tok, err := s.scimTokens.Get(orgID) + if err != nil { + return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to load SCIM token"}) + } + if tok == nil { + return c.JSON(http.StatusOK, map[string]any{"exists": false}) + } + return c.JSON(http.StatusOK, scimTokenResponse{TokenPrefix: tok.TokenPrefix, CreatedAt: tok.CreatedAt.Format(time.RFC3339)}) +} + +// CreateSCIMToken is POST /orgs/:org_id/scim-token - generates a new token, +// replacing (rotating out) any existing one. Registered via s.audited with +// ActionSCIMTokenCreate. +func (s *Server) CreateSCIMToken(c echo.Context) error { + orgID, err := strconv.ParseInt(c.Param("org_id"), 10, 64) + if err != nil { + return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid org_id"}) + } + if err := s.requireSCIMConfigAccess(c, orgID); err != nil { + return err + } + pc := auth.GetPermissionContext(c) + var actorUserID int64 + if pc != nil && pc.User != nil { + actorUserID = pc.User.ID + } + + if err := s.scimTokens.Revoke(orgID); err != nil { + return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to rotate SCIM token"}) + } + plaintext, tok, err := s.scimTokens.Create(orgID, actorUserID) + if err != nil { + return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to create SCIM token"}) + } + auditlog.MarkRecorded(c) + return c.JSON(http.StatusOK, scimTokenResponse{ + TokenPrefix: tok.TokenPrefix, + CreatedAt: tok.CreatedAt.Format(time.RFC3339), + Token: &plaintext, + }) +} + +// RevokeSCIMToken is DELETE /orgs/:org_id/scim-token. +func (s *Server) RevokeSCIMToken(c echo.Context) error { + orgID, err := strconv.ParseInt(c.Param("org_id"), 10, 64) + if err != nil { + return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid org_id"}) + } + if err := s.requireSCIMConfigAccess(c, orgID); err != nil { + return err + } + if err := s.scimTokens.Revoke(orgID); err != nil { + return c.JSON(http.StatusInternalServerError, map[string]string{"error": "failed to revoke SCIM token"}) + } + auditlog.MarkRecorded(c) + return c.JSON(http.StatusOK, map[string]string{"message": "SCIM token revoked"}) +} diff --git a/internal/api/server.go b/internal/api/server.go index 6207891fa..429e20dfe 100644 --- a/internal/api/server.go +++ b/internal/api/server.go @@ -49,6 +49,7 @@ import ( "github.com/livereview/internal/providers/azuredevops" reviewprocessor "github.com/livereview/internal/review_processor" "github.com/livereview/internal/scheduledreview" + "github.com/livereview/internal/scim" "github.com/livereview/internal/slackbot" "github.com/livereview/internal/sso" "github.com/livereview/internal/teamsbot" @@ -149,7 +150,8 @@ type Server struct { versionInfo *VersionInfo deploymentConfig *DeploymentConfig authHandlers *auth.AuthHandlers - ssoStore *sso.Store // nil only if the secret box failed to init (see SetSSO wiring) + ssoStore *sso.Store // nil only if the secret box failed to init (see SetSSO wiring) + scimTokens *scim.TokenStore githubApp *githubapp.Config // nil unless GITHUB_APP_* is configured githubAppSecret []byte // HMAC key for the GitHub App OAuth state tokenService *auth.TokenService @@ -326,11 +328,14 @@ func appContext(port int, versionInfo *VersionInfo) (*Server, error) { // Enterprise SSO (OIDC/SAML) - see docs/sso.md. The secret box reuses // JWT_SECRET rather than requiring a dedicated encryption key. var ssoStore *sso.Store + var ssoIdentities *sso.IdentityStore if ssoBox, err := sso.NewSecretBox(jwtSecret); err != nil { log.Printf("[sso] disabled: %v", err) } else { ssoStore = sso.NewStore(db, ssoBox) authHandlers.SetSSO(ssoStore, jwtSecret) + ssoIdentities = sso.NewIdentityStore(db, ssoBox) + authHandlers.SetSSOIdentities(ssoIdentities) } // Audit trail framework: recorder + route-spec registry. The HTTP @@ -392,6 +397,7 @@ func appContext(port int, versionInfo *VersionInfo) (*Server, error) { deploymentConfig: deploymentConfig, authHandlers: authHandlers, ssoStore: ssoStore, + scimTokens: scim.NewTokenStore(db), githubApp: githubapp.Load(), githubAppSecret: []byte(jwtSecret), tokenService: tokenService, @@ -1173,10 +1179,23 @@ func (s *Server) setupRoutes() { public.GET("/auth/sso/providers", s.authHandlers.SSOProviders) public.GET("/auth/sso/oidc/:org_id/login", s.authHandlers.SSOOIDCLogin) public.GET("/auth/sso/oidc/callback", s.authHandlers.SSOOIDCCallback) + public.POST("/auth/sso/oidc/:org_id/backchannel-logout", s.authHandlers.SSOOIDCBackChannelLogout) public.GET("/auth/sso/saml/:org_id/metadata", s.authHandlers.SSOSAMLMetadata) public.GET("/auth/sso/saml/:org_id/login", s.authHandlers.SSOSAMLLogin) public.POST("/auth/sso/saml/:org_id/acs", s.authHandlers.SSOSAMLACS) + // SCIM 2.0 (Okta/Azure AD/Google Workspace user lifecycle sync) - see + // docs/sso.md. Public route group by necessity (SCIM clients authenticate + // via their own org-scoped bearer token, not a LiveReview session); + // org-scoping comes from that token alone, enforced inside + // requireSCIMBearerAuth, never from a client-supplied id. + scimGroup := public.Group("/scim/v2") + scimGroup.Use(s.requireSCIMBearerAuth) + scimGroup.GET("/Users", s.SCIMListUsers) + scimGroup.POST("/Users", s.SCIMCreateUser) + scimGroup.GET("/Users/:id", s.SCIMGetUser) + scimGroup.PATCH("/Users/:id", s.SCIMPatchUser) + // Diff review endpoints. Accepts either an X-API-Key (the git-lrc CLI's // auth) or a Bearer session token (the web UI's review-details diff // viewer, which reads this same data via GET /:review_id) — mirrors the @@ -1331,6 +1350,7 @@ func (s *Server) setupRoutes() { orgGroup.GET("/users/:user_id", s.userHandlers.GetUser) s.audited(orgGroup, echo.PUT, "/users/:user_id", auditlog.Spec{Action: auditlog.ActionUserUpdate, Category: auditlog.CategoryUser, ResourceType: "user", ResourceIDParam: "user_id", Sensitive: true}, s.userHandlers.UpdateUser) s.audited(orgGroup, echo.DELETE, "/users/:user_id", auditlog.Spec{Action: auditlog.ActionUserDeactivate, Category: auditlog.CategoryUser, ResourceType: "user", ResourceIDParam: "user_id", Sensitive: true}, s.userHandlers.DeactivateUser) + s.audited(orgGroup, echo.POST, "/users/:user_id/reactivate", auditlog.Spec{Action: auditlog.ActionUserReactivate, Category: auditlog.CategoryUser, ResourceType: "user", ResourceIDParam: "user_id", Sensitive: true}, s.userHandlers.ReactivateUser) s.audited(orgGroup, echo.PUT, "/users/:user_id/role", auditlog.Spec{Action: auditlog.ActionUserRoleChange, Category: auditlog.CategoryUser, ResourceType: "user", ResourceIDParam: "user_id", Sensitive: true}, s.userHandlers.ChangeUserRole) s.audited(orgGroup, echo.POST, "/users/:user_id/force-password-reset", auditlog.Spec{Action: auditlog.ActionPasswordForceReset, Category: auditlog.CategoryUser, ResourceType: "user", ResourceIDParam: "user_id", Sensitive: true}, s.userHandlers.ForcePasswordReset) orgGroup.GET("/users/:user_id/audit-log", s.userHandlers.GetUserAuditLog) @@ -1350,6 +1370,9 @@ func (s *Server) setupRoutes() { s.audited(orgGroup, echo.PUT, "/sso-config/:provider_type", auditlog.Spec{Action: auditlog.ActionSettingsSSOUpdate, Category: auditlog.CategorySettings, ResourceType: "org_sso_config", ResourceIDParam: "provider_type", Sensitive: true}, s.UpsertSSOConfig) s.audited(orgGroup, echo.DELETE, "/sso-config/:provider_type", auditlog.Spec{Action: auditlog.ActionSettingsSSODelete, Category: auditlog.CategorySettings, ResourceType: "org_sso_config", ResourceIDParam: "provider_type", Sensitive: true}, s.DeleteSSOConfig) orgGroup.POST("/sso-config/:provider_type/test", s.TestSSOConfig) + orgGroup.GET("/scim-token", s.GetSCIMToken) + s.audited(orgGroup, echo.POST, "/scim-token", auditlog.Spec{Action: auditlog.ActionSCIMTokenCreate, Category: auditlog.CategoryAuth, ResourceType: "scim_token", Sensitive: true}, s.CreateSCIMToken) + s.audited(orgGroup, echo.DELETE, "/scim-token", auditlog.Spec{Action: auditlog.ActionSCIMTokenRevoke, Category: auditlog.CategoryAuth, ResourceType: "scim_token", Sensitive: true}, s.RevokeSCIMToken) // Super admin routes - Production adminGroup := v1.Group("/admin") diff --git a/internal/api/sso_config.go b/internal/api/sso_config.go index ee816e291..3179881c7 100644 --- a/internal/api/sso_config.go +++ b/internal/api/sso_config.go @@ -39,6 +39,11 @@ type ssoConfigRequest struct { SAMLIDPMetadataURL string `json:"saml_idp_metadata_url,omitempty"` SAMLIDPMetadataXML string `json:"saml_idp_metadata_xml,omitempty"` SAMLIDPEntityID string `json:"saml_idp_entity_id,omitempty"` + + // Reconciliation only applies to provider_type=oidc - see Phase 5 of + // docs/sso.md's deprovisioning section. Ignored for SAML. + ReconciliationEnabled bool `json:"reconciliation_enabled,omitempty"` + ReconciliationInterval string `json:"reconciliation_interval,omitempty"` } // ssoConfigResponse never carries secrets - this is what GET/PUT return. @@ -53,21 +58,31 @@ type ssoConfigResponse struct { SAMLIDPMetadataURL string `json:"saml_idp_metadata_url,omitempty"` SAMLIDPEntityID string `json:"saml_idp_entity_id,omitempty"` SAMLMetadataSet bool `json:"saml_metadata_set"` + + ReconciliationEnabled bool `json:"reconciliation_enabled,omitempty"` + ReconciliationInterval string `json:"reconciliation_interval,omitempty"` + LastReconciledAt string `json:"last_reconciled_at,omitempty"` } func redactedSSOConfig(cfg *sso.Config) ssoConfigResponse { - return ssoConfigResponse{ - ProviderType: string(cfg.ProviderType), - DisplayName: cfg.DisplayName, - Enabled: cfg.Enabled, - OIDCIssuer: cfg.OIDCIssuer, - OIDCClientID: cfg.OIDCClientID, - OIDCClientSecretSet: cfg.OIDCClientSecret != "", - OIDCScopes: cfg.OIDCScopes, - SAMLIDPMetadataURL: cfg.SAMLIDPMetadataURL, - SAMLIDPEntityID: cfg.SAMLIDPEntityID, - SAMLMetadataSet: cfg.SAMLIDPMetadataXML != "", - } + resp := ssoConfigResponse{ + ProviderType: string(cfg.ProviderType), + DisplayName: cfg.DisplayName, + Enabled: cfg.Enabled, + OIDCIssuer: cfg.OIDCIssuer, + OIDCClientID: cfg.OIDCClientID, + OIDCClientSecretSet: cfg.OIDCClientSecret != "", + OIDCScopes: cfg.OIDCScopes, + SAMLIDPMetadataURL: cfg.SAMLIDPMetadataURL, + SAMLIDPEntityID: cfg.SAMLIDPEntityID, + SAMLMetadataSet: cfg.SAMLIDPMetadataXML != "", + ReconciliationEnabled: cfg.ReconciliationEnabled, + ReconciliationInterval: cfg.ReconciliationInterval, + } + if cfg.LastReconciledAt != nil { + resp.LastReconciledAt = cfg.LastReconciledAt.Format(time.RFC3339) + } + return resp } func parseProviderType(raw string) (sso.ProviderType, bool) { @@ -148,21 +163,26 @@ func (s *Server) UpsertSSOConfig(c echo.Context) error { if err := c.Bind(&req); err != nil { return c.JSON(http.StatusBadRequest, map[string]string{"error": "invalid request body"}) } + if req.ReconciliationInterval != "" && req.ReconciliationInterval != "hourly" && req.ReconciliationInterval != "daily" && req.ReconciliationInterval != "weekly" { + return c.JSON(http.StatusBadRequest, map[string]string{"error": "reconciliation_interval must be 'hourly', 'daily', or 'weekly'"}) + } if req.DisplayName == "" { return c.JSON(http.StatusBadRequest, map[string]string{"error": "display_name is required"}) } cfg := &sso.Config{ - OrgID: orgID, - ProviderType: provider, - DisplayName: req.DisplayName, - Enabled: req.Enabled, - OIDCIssuer: req.OIDCIssuer, - OIDCClientID: req.OIDCClientID, - OIDCScopes: req.OIDCScopes, - SAMLIDPMetadataURL: req.SAMLIDPMetadataURL, - SAMLIDPMetadataXML: req.SAMLIDPMetadataXML, - SAMLIDPEntityID: req.SAMLIDPEntityID, + OrgID: orgID, + ProviderType: provider, + DisplayName: req.DisplayName, + Enabled: req.Enabled, + OIDCIssuer: req.OIDCIssuer, + OIDCClientID: req.OIDCClientID, + OIDCScopes: req.OIDCScopes, + SAMLIDPMetadataURL: req.SAMLIDPMetadataURL, + SAMLIDPMetadataXML: req.SAMLIDPMetadataXML, + SAMLIDPEntityID: req.SAMLIDPEntityID, + ReconciliationEnabled: provider == sso.ProviderOIDC && req.ReconciliationEnabled, + ReconciliationInterval: req.ReconciliationInterval, } // Preserve the existing secret/metadata unless the caller explicitly diff --git a/internal/api/users/handlers.go b/internal/api/users/handlers.go index fe7a55c58..5e3e41337 100644 --- a/internal/api/users/handlers.go +++ b/internal/api/users/handlers.go @@ -313,6 +313,33 @@ func (uh *UserHandlers) DeactivateUser(c echo.Context) error { }) } +// ReactivateUser handles restoring a previously deactivated user in an +// organization. This is the only way a deactivated user becomes active +// again - SSO login deliberately never does this on its own. +func (uh *UserHandlers) ReactivateUser(c echo.Context) error { + permCtx := auth.MustGetPermissionContext(c) + + if !permCtx.HasPermission(auth.PermissionDeleteUsers) { + return echo.NewHTTPError(http.StatusForbidden, "Permission denied: cannot reactivate users") + } + + userIDStr := c.Param("user_id") + userID, err := strconv.ParseInt(userIDStr, 10, 64) + if err != nil { + return echo.NewHTTPError(http.StatusBadRequest, "Invalid user ID") + } + + err = uh.userService.ReactivateUserInOrg(permCtx.OrgID, userID, permCtx.User.ID) + if err != nil { + return echo.NewHTTPError(http.StatusInternalServerError, "Failed to reactivate user") + } + auditlog.MarkRecorded(c) + + return c.JSON(http.StatusOK, map[string]string{ + "message": "User reactivated successfully", + }) +} + // ChangeUserRole handles changing a user's role in an organization func (uh *UserHandlers) ChangeUserRole(c echo.Context) error { // Get permission context from middleware diff --git a/internal/api/users/user_service.go b/internal/api/users/user_service.go index eb59b836e..b0f59a648 100644 --- a/internal/api/users/user_service.go +++ b/internal/api/users/user_service.go @@ -2,7 +2,9 @@ package users import ( "context" + "crypto/rand" "database/sql" + "encoding/hex" "encoding/json" "errors" "fmt" @@ -968,12 +970,16 @@ func (us *UserService) UpdateUserInOrg(orgID, userID, updatedByUserID int64, req return us.GetUserInOrg(orgID, userID) } -// DeactivateUserInOrg deactivates a user in a specific organization +// DeactivateUserInOrg deactivates a user in a specific organization and +// revokes every live session/refresh token they currently hold. Without the +// revocation, a deactivated user's already-issued JWT would keep working +// until its own natural expiry - deactivation needs to cut off access +// immediately, not just block future logins. func (us *UserService) DeactivateUserInOrg(orgID, userID, deactivatedByUserID int64) error { return us.store.WithTx(func(tx *sql.Tx) error { // Deactivate user _, err := us.store.TxExec(tx, ` - UPDATE users + UPDATE users SET is_active = false, deactivated_at = NOW(), deactivated_by_user_id = $1, updated_at = NOW() WHERE id = $2 `, deactivatedByUserID, userID) @@ -981,14 +987,177 @@ func (us *UserService) DeactivateUserInOrg(orgID, userID, deactivatedByUserID in return fmt.Errorf("failed to deactivate user: %w", err) } + revokedCount, err := us.store.TxExec(tx, ` + UPDATE auth_tokens SET is_active = false, revoked_at = NOW() + WHERE user_id = $1 AND is_active = true + `, userID) + if err != nil { + return fmt.Errorf("failed to revoke active sessions: %w", err) + } + // Add audit log err = us.addUserAuditLog(tx, orgID, userID, deactivatedByUserID, "deactivated", map[string]interface{}{}) if err != nil { return fmt.Errorf("failed to add audit log: %w", err) } + if rows, rerr := revokedCount.RowsAffected(); rerr == nil && rows > 0 { + if aerr := us.addUserAuditLog(tx, orgID, userID, deactivatedByUserID, "session_revoked", map[string]interface{}{"revoked_count": rows}); aerr != nil { + return fmt.Errorf("failed to add session revocation audit log: %w", aerr) + } + } + + return nil + }) +} + +// ReactivateUserInOrg restores a previously deactivated user. This is the +// only path back to is_active=true - SSO login deliberately never does this +// itself (see errSSOAccountDeactivated in internal/api/auth/sso_handlers.go). +func (us *UserService) ReactivateUserInOrg(orgID, userID, reactivatedByUserID int64) error { + return us.store.WithTx(func(tx *sql.Tx) error { + _, err := us.store.TxExec(tx, ` + UPDATE users + SET is_active = true, deactivated_at = NULL, deactivated_by_user_id = NULL, updated_at = NOW() + WHERE id = $1 + `, userID) + if err != nil { + return fmt.Errorf("failed to reactivate user: %w", err) + } + + if err := us.addUserAuditLog(tx, orgID, userID, reactivatedByUserID, "reactivated", map[string]interface{}{}); err != nil { + return fmt.Errorf("failed to add audit log: %w", err) + } + + return nil + }) +} + +// ErrSCIMAccountDeactivated is returned by ProvisionSCIMUser when the +// matched user has been manually deactivated. Like SSO JIT login, SCIM +// provisioning must never silently resurrect a deactivated account. +var ErrSCIMAccountDeactivated = errors.New("scim: account is deactivated") + +// ProvisionSCIMUser creates or links a user into orgID via SCIM. It mirrors +// the SSO JIT-provisioning create path (internal/api/auth/sso_handlers.go's +// jitProvisionSSOUser): a random unusable password and member role, with no +// invitation email - the IdP is the source of truth for this account, not +// an email invite, which is why this doesn't just call the owner-driven +// CreateUserInOrg above. Returns the user and whether a new user_roles row +// was created (true also covers "newly created user" since the row is +// always new in that case). +func (us *UserService) ProvisionSCIMUser(orgID int64, email, firstName, lastName string) (*UserWithRole, bool, error) { + var userID int64 + created := false + + err := us.store.WithTx(func(tx *sql.Tx) error { + var existingUserID int64 + var isActive bool + err := us.store.TxQueryRow(tx, `SELECT id, is_active FROM users WHERE email = $1`, email).Scan(&existingUserID, &isActive) + if err == sql.ErrNoRows { + randBytes := make([]byte, 32) + if _, rerr := rand.Read(randBytes); rerr != nil { + return rerr + } + hashed, herr := bcrypt.GenerateFromPassword([]byte(hex.EncodeToString(randBytes)), bcrypt.DefaultCost) + if herr != nil { + return herr + } + if err := us.store.TxQueryRow(tx, ` + INSERT INTO users (email, password_hash, first_name, last_name, default_org_id, password_reset_required, created_at, updated_at) + VALUES ($1, $2, $3, $4, $5, false, NOW(), NOW()) + RETURNING id + `, email, string(hashed), nullableStr(firstName), nullableStr(lastName), orgID).Scan(&userID); err != nil { + return err + } + if _, err := us.store.TxExec(tx, ` + INSERT INTO user_roles (user_id, org_id, role_id) + VALUES ($1, $2, (SELECT id FROM roles WHERE name = 'member')) + `, userID, orgID); err != nil { + return err + } + created = true + return nil + } else if err != nil { + return err + } + + userID = existingUserID + if !isActive { + return ErrSCIMAccountDeactivated + } + var isMember bool + if err := us.store.TxQueryRow(tx, `SELECT EXISTS(SELECT 1 FROM user_roles WHERE user_id = $1 AND org_id = $2)`, userID, orgID).Scan(&isMember); err != nil { + return err + } + if !isMember { + if _, err := us.store.TxExec(tx, ` + INSERT INTO user_roles (user_id, org_id, role_id) + VALUES ($1, $2, (SELECT id FROM roles WHERE name = 'member')) + `, userID, orgID); err != nil { + return err + } + created = true + } + if _, err := us.store.TxExec(tx, `UPDATE users SET default_org_id = COALESCE(default_org_id, $1) WHERE id = $2`, orgID, userID); err != nil { + return err + } return nil }) + if err != nil { + return nil, false, err + } + + user, err := us.GetUserInOrg(orgID, userID) + if err != nil { + return nil, false, err + } + return user, created, nil +} + +func nullableStr(s string) interface{} { + if s == "" { + return nil + } + return s +} + +// DeactivateUserInOrgBySCIM deactivates a user as part of SCIM-driven +// deprovisioning (PATCH active:false) and revokes their live sessions, same +// as DeactivateUserInOrg. There is no human actor to record here - the +// actor is the IdP, via SCIM - so deactivated_by_user_id is left NULL and +// the unified audit event is emitted by the caller +// (internal/api/scim_handlers.go) via auditRecorder.Webhook instead of the +// user_management_audit mirror addUserAuditLog uses, which requires a real +// performed_by_user_id (NOT NULL, FK to users). +func (us *UserService) DeactivateUserInOrgBySCIM(userID int64) error { + return us.store.WithTx(func(tx *sql.Tx) error { + if _, err := us.store.TxExec(tx, ` + UPDATE users SET is_active = false, deactivated_at = NOW(), deactivated_by_user_id = NULL, updated_at = NOW() + WHERE id = $1 + `, userID); err != nil { + return fmt.Errorf("failed to deactivate user: %w", err) + } + if _, err := us.store.TxExec(tx, ` + UPDATE auth_tokens SET is_active = false, revoked_at = NOW() + WHERE user_id = $1 AND is_active = true + `, userID); err != nil { + return fmt.Errorf("failed to revoke active sessions: %w", err) + } + return nil + }) +} + +// ReactivateUserInOrgBySCIM mirrors DeactivateUserInOrgBySCIM for PATCH active:true. +func (us *UserService) ReactivateUserInOrgBySCIM(userID int64) error { + _, err := us.db.Exec(` + UPDATE users SET is_active = true, deactivated_at = NULL, deactivated_by_user_id = NULL, updated_at = NOW() + WHERE id = $1 + `, userID) + if err != nil { + return fmt.Errorf("failed to reactivate user: %w", err) + } + return nil } // ForcePasswordReset forces a user to reset their password on next login @@ -1123,6 +1292,8 @@ func userAuditAction(action string) (auditlog.Action, bool) { return auditlog.ActionUserDeactivate, true case "reactivated": return auditlog.ActionUserReactivate, true + case "session_revoked": + return auditlog.ActionSessionRevoke, true case "role_changed": return auditlog.ActionUserRoleChange, true case "password_reset": diff --git a/internal/auditlog/catalog.go b/internal/auditlog/catalog.go index f1c47c707..14a05d884 100644 --- a/internal/auditlog/catalog.go +++ b/internal/auditlog/catalog.go @@ -114,6 +114,14 @@ const ( ActionIdentityAdd Action = "auth.identity.add" ActionIdentityRemove Action = "auth.identity.remove" ActionSSOProvision Action = "auth.sso.provision" + ActionSessionRevoke Action = "auth.session.revoke" + + ActionSCIMUserCreate Action = "scim.user.create" + ActionSCIMUserUpdate Action = "scim.user.update" + ActionSCIMUserDeactivate Action = "scim.user.deactivate" + ActionSCIMUserReactivate Action = "scim.user.reactivate" + ActionSCIMTokenCreate Action = "scim.token.create" + ActionSCIMTokenRevoke Action = "scim.token.revoke" ActionUserCreate Action = "user.create" ActionUserUpdate Action = "user.update" @@ -255,6 +263,13 @@ var actionCatalog = func() map[Action]ActionMeta { meta(ActionIdentityAdd, CategoryAuth, "identity", "Identity linked", "A login identity was linked to a user.", SeverityWarning), meta(ActionIdentityRemove, CategoryAuth, "identity", "Identity unlinked", "A login identity was removed from a user.", SeverityWarning), meta(ActionSSOProvision, CategoryAuth, "user", "SSO account provisioned", "An account was provisioned through SSO.", SeverityInfo), + sensitive(meta(ActionSessionRevoke, CategoryAuth, "session", "Sessions revoked", "A user's active sessions and refresh tokens were revoked, typically following deactivation.", SeverityWarning)), + sensitive(meta(ActionSCIMUserCreate, CategoryAuth, "user", "SCIM user provisioned", "An identity provider created or linked a user via SCIM.", SeverityInfo)), + sensitive(meta(ActionSCIMUserUpdate, CategoryAuth, "user", "SCIM user updated", "An identity provider updated a user's attributes via SCIM.", SeverityInfo)), + sensitive(meta(ActionSCIMUserDeactivate, CategoryAuth, "user", "SCIM user deactivated", "An identity provider deactivated a user via SCIM.", SeverityWarning)), + sensitive(meta(ActionSCIMUserReactivate, CategoryAuth, "user", "SCIM user reactivated", "An identity provider reactivated a user via SCIM.", SeverityWarning)), + sensitive(meta(ActionSCIMTokenCreate, CategoryAuth, "scim_token", "SCIM token created", "An org's SCIM bearer token was generated or rotated.", SeverityWarning)), + sensitive(meta(ActionSCIMTokenRevoke, CategoryAuth, "scim_token", "SCIM token revoked", "An org's SCIM bearer token was revoked.", SeverityWarning)), sensitive(meta(ActionUserCreate, CategoryUser, "user", "User created", "A user was added to the organization.", SeverityWarning)), sensitive(meta(ActionUserUpdate, CategoryUser, "user", "User updated", "A user's profile or settings were changed.", SeverityWarning)), diff --git a/internal/docindex/docs/routes_guide/settings/sso.md b/internal/docindex/docs/routes_guide/settings/sso.md index d46d5d84b..1c5088f97 100644 --- a/internal/docindex/docs/routes_guide/settings/sso.md +++ b/internal/docindex/docs/routes_guide/settings/sso.md @@ -58,6 +58,59 @@ real gatekeeper. - Flip **Enabled** on a saved config to let users sign in with it immediately, or off to stop new SSO logins without losing the saved settings. +## Deprovisioning: how a removed user actually loses access + +JIT provisioning only covers getting users *in*. There are three distinct +mechanisms for getting a removed/disabled IdP user *out*, each covering a +different gap: + +1. **Manual deactivation always works.** An owner deactivating a user + (Settings → Users) immediately revokes every one of that user's live + sessions - their JWT stops working on the very next request, not just on + future logins. SSO login itself can never undo a deactivation: if a + deactivated user's IdP credentials still work, login is rejected rather + than silently reactivating them. Reactivating is an explicit admin action. +2. **SCIM (below) is the real-time, automated answer**, if the org wires it + up at their IdP. Without it, deprovisioning depends on a human noticing + or the two fallbacks below. +3. **The reconciliation poll** (OIDC panel, "Automatic deprovisioning + check") and **OIDC back-channel logout** are two best-effort fallbacks + for orgs that skip SCIM - see their own sections below. Neither applies + to SAML; a SAML-only org that wants automated deprovisioning needs SCIM. + +## SCIM provisioning + +A "SCIM Provisioning" panel sits below the OIDC/SAML tabs on this same page, +independent of which login protocol(s) are configured. This lets the IdP +itself (Okta, Azure AD/Entra ID, Google Workspace) push user lifecycle +events directly - most importantly, deactivating a LiveReview user the +moment the IdP admin removes or disables them there, rather than waiting for +that user to attempt another login. + +- **Generate Token** creates the org's SCIM bearer token, shown once (same + reveal-once convention as an API key) - copy it into the IdP's SCIM app + configuration alongside the shown **SCIM base URL** + (`{origin}/api/v1/scim/v2`). +- **Rotate Token** replaces the token; the old one stops working + immediately, so the IdP's SCIM config needs updating with the new one. +- **Revoke** disables SCIM entirely until a new token is generated. +- Requires the `scim` plan feature (same plan entry as `sso`, + `internal/license/plans.go`'s `PlanEnterpriseSelfhosted`). +- The IdP authenticates every SCIM call with this bearer token alone - there + is no user session involved, and the org is resolved from the token + itself, never a client-supplied id. + +## Automatic deprovisioning check (OIDC reconciliation poll) + +Only shown on the OIDC panel. A fallback for orgs that configure OIDC login +but never wire up SCIM above (a separate integration step many admins skip). +When enabled, LiveReview periodically re-checks each signed-in user against +the IdP (silently refreshing a stored OAuth token) and deactivates them here +if the IdP rejects it - the same outcome a SCIM deactivation would produce, +just on a delay bounded by the interval you pick (hourly/daily/weekly, +default daily) instead of instantly. Not available for SAML - there's no +equivalent standing credential to silently re-check with that protocol. + ## Where this shows up elsewhere - The self-hosted login page (`ui/src/pages/Auth/SelfHosted.tsx`) calls the diff --git a/internal/jobqueue/jobqueue.go b/internal/jobqueue/jobqueue.go index d886dc306..a61209f73 100644 --- a/internal/jobqueue/jobqueue.go +++ b/internal/jobqueue/jobqueue.go @@ -35,17 +35,17 @@ import ( "github.com/jackc/pgx/v5" "github.com/jackc/pgx/v5/pgxpool" "github.com/livereview/internal/githubapp" + "github.com/livereview/internal/policyengine" "github.com/livereview/internal/providers" "github.com/livereview/internal/providers/gitea" - "github.com/livereview/internal/policyengine" "github.com/livereview/internal/seed_demo" networkjobqueue "github.com/livereview/network/jobqueue" storagejobqueue "github.com/livereview/storage/jobqueue" - "github.com/robfig/cron/v3" "github.com/livereview/storage/providers/pullrequests" "github.com/riverqueue/river" "github.com/riverqueue/river/riverdriver/riverpgxv5" "github.com/riverqueue/river/rivermigrate" + "github.com/robfig/cron/v3" ) // GitLab API response structures @@ -2449,6 +2449,7 @@ func NewJobQueue(databaseURL string, db *sql.DB) (*JobQueue, error) { river.AddWorker(workers, seedDemoWorker) river.AddWorker(workers, &BlastRadiusWorker{db: db}) river.AddWorker(workers, &RiskModelRefitWorker{db: db}) + river.AddWorker(workers, &SSOReconciliationWorker{db: db}) coordinatorInterval := config.RepoSyncConfig.CoordinatorInterval if coordinatorInterval <= 0 { @@ -2568,15 +2569,22 @@ func NewJobQueue(databaseURL string, db *sql.DB) (*JobQueue, error) { }, &river.PeriodicJobOpts{ID: "risk_model_refit", RunOnStart: false}, ), + river.NewPeriodicJob( + river.PeriodicInterval(15*time.Minute), + func() (river.JobArgs, *river.InsertOpts) { + return SSOReconciliationJobArgs{}, &river.InsertOpts{Queue: "repo_sync", MaxAttempts: 3} + }, + &river.PeriodicJobOpts{ID: "sso_reconciliation", RunOnStart: false}, + ), river.NewPeriodicJob( archivalSchedule, func() (river.JobArgs, *river.InsertOpts) { return PreloadedChangesArchivalSweepJobArgs{ - RetentionDays: archivalRetentionDays, - }, &river.InsertOpts{ - Queue: "preloaded_changes_archival_sweep", - MaxAttempts: 3, - } + RetentionDays: archivalRetentionDays, + }, &river.InsertOpts{ + Queue: "preloaded_changes_archival_sweep", + MaxAttempts: 3, + } }, &river.PeriodicJobOpts{ ID: "preloaded_changes_archival_sweep", diff --git a/internal/jobqueue/sso_reconciliation_worker.go b/internal/jobqueue/sso_reconciliation_worker.go new file mode 100644 index 000000000..6f9855f6a --- /dev/null +++ b/internal/jobqueue/sso_reconciliation_worker.go @@ -0,0 +1,88 @@ +package jobqueue + +import ( + "context" + "database/sql" + "fmt" + "os" + + "github.com/livereview/internal/api/users" + "github.com/livereview/internal/sso" + "github.com/riverqueue/river" + "golang.org/x/oauth2" +) + +// SSOReconciliationJobArgs is a fixed-interval sweep (see jobqueue.go's +// PeriodicJobs) that silently re-checks "is this account still valid at the +// IdP" for every OIDC org that has opted into the reconciliation poll (see +// org_sso_configs.reconciliation_enabled) - a fallback deprovisioning path +// for orgs that configure OIDC login but never wire up SCIM at their IdP. +// Per org/identity work happens inline in one Work() call, the same +// "coordinator does the fan-out itself" shape RiskModelRefitWorker already +// uses, rather than enqueueing a separate one-shot job per org. +type SSOReconciliationJobArgs struct{} + +func (SSOReconciliationJobArgs) Kind() string { return "sso_reconciliation" } + +type SSOReconciliationWorker struct { + river.WorkerDefaults[SSOReconciliationJobArgs] + db *sql.DB +} + +func (w *SSOReconciliationWorker) Work(ctx context.Context, job *river.Job[SSOReconciliationJobArgs]) error { + box, err := sso.NewSecretBox(os.Getenv("JWT_SECRET")) + if err != nil { + // Same "disabled, not fatal" treatment server.go gives a missing/empty + // JWT_SECRET for SSO generally - nothing to reconcile without it. + return nil + } + configStore := sso.NewStore(w.db, box) + identityStore := sso.NewIdentityStore(w.db, box) + userService := users.NewUserService(w.db, nil) + + due, err := configStore.ListDueForReconciliation() + if err != nil { + return fmt.Errorf("sso reconciliation: listing due configs: %w", err) + } + + for _, cfg := range due { + // Best-effort per org: one org's IdP being unreachable shouldn't + // block the sweep for everyone else. + w.reconcileOrg(ctx, cfg, configStore, identityStore, userService) + } + return nil +} + +func (w *SSOReconciliationWorker) reconcileOrg(ctx context.Context, cfg *sso.Config, configStore *sso.Store, identityStore *sso.IdentityStore, userService *users.UserService) { + fullCfg, err := configStore.Get(cfg.OrgID, sso.ProviderOIDC) + if err != nil { + return + } + identities, err := identityStore.ListWithRefreshToken(cfg.OrgID, sso.ProviderOIDC) + if err != nil { + return + } + if len(identities) == 0 { + _ = configStore.MarkReconciled(cfg.OrgID, sso.ProviderOIDC) + return + } + + oauthCfg, _, err := sso.BuildOIDCOAuth2Config(ctx, fullCfg, "") + if err != nil { + return + } + + for _, identity := range identities { + _, refreshErr := oauthCfg.TokenSource(ctx, &oauth2.Token{RefreshToken: identity.RefreshToken}).Token() + if refreshErr != nil { + // The IdP rejected the refresh - invalid_grant/invalid_token is + // exactly what Okta/Azure/Google return for a disabled, deleted, + // or de-authorized account. Deactivate, same as a SCIM + // PATCH active:false would. + _ = userService.DeactivateUserInOrgBySCIM(identity.UserID) + continue + } + _ = identityStore.MarkChecked(identity.ID) + } + _ = configStore.MarkReconciled(cfg.OrgID, sso.ProviderOIDC) +} diff --git a/internal/license/plans.go b/internal/license/plans.go index f87ced7ee..de5acaf8d 100644 --- a/internal/license/plans.go +++ b/internal/license/plans.go @@ -162,6 +162,7 @@ var PlanDefinitions = map[PlanType]PlanLimits{ "email_support", "priority_support", "sso", + "scim", }, }, } diff --git a/internal/scim/token.go b/internal/scim/token.go new file mode 100644 index 000000000..a4644fe6c --- /dev/null +++ b/internal/scim/token.go @@ -0,0 +1,153 @@ +// Package scim implements the subset of SCIM 2.0 that enterprise IdPs +// (Okta, Azure AD, Google Workspace) actually use for user lifecycle sync: +// create, read, list-by-filter, and PATCH active:false/true. See +// docs/sso.md for the user-facing setup flow and internal/api/scim_handlers.go +// for the HTTP layer that wires this package into internal/api/users. +package scim + +import ( + "crypto/rand" + "crypto/sha256" + "database/sql" + "encoding/base32" + "encoding/hex" + "errors" + "fmt" + "strings" + "time" +) + +// tokenPrefix mirrors api_keys.go's "lr_" scheme (see +// internal/api/api_keys.go's GenerateAPIKey) so SCIM tokens are visually +// distinct from regular API keys and session tokens. +const tokenPrefix = "scim_" + +var ( + ErrTokenNotFound = errors.New("scim: token not found") + ErrTokenRevoked = errors.New("scim: token revoked") + ErrTokenExpired = errors.New("scim: token expired") +) + +// GenerateToken creates a new SCIM bearer token in the form "scim_". +func GenerateToken() (string, error) { + randomBytes := make([]byte, 32) + if _, err := rand.Read(randomBytes); err != nil { + return "", fmt.Errorf("failed to generate random bytes: %w", err) + } + encoded := base32.StdEncoding.WithPadding(base32.NoPadding).EncodeToString(randomBytes) + return tokenPrefix + strings.ToLower(encoded), nil +} + +// HashToken returns the SHA-256 hash of a SCIM token, which is what's +// actually stored - the plaintext token is only ever shown once, at +// creation time, same as an API key. +func HashToken(token string) string { + hash := sha256.Sum256([]byte(token)) + return hex.EncodeToString(hash[:]) +} + +// TokenPrefix extracts a short, non-secret prefix for display in the +// settings UI (e.g. "scim_abcd1234..."), same convention as +// api_keys.go's GetKeyPrefix. +func TokenPrefix(token string) string { + stripped := strings.TrimPrefix(token, tokenPrefix) + if len(stripped) > 8 { + stripped = stripped[:8] + } + return tokenPrefix + stripped +} + +// Token is a SCIM bearer token record for one org. +type Token struct { + ID int64 + OrgID int64 + TokenPrefix string + CreatedAt time.Time + ExpiresAt *time.Time + RevokedAt *time.Time + CreatedByUserID *int64 +} + +// TokenStore manages the scim_tokens table. +type TokenStore struct { + db *sql.DB +} + +func NewTokenStore(db *sql.DB) *TokenStore { + return &TokenStore{db: db} +} + +// Create generates a new token for orgID, replacing any existing one (an +// org has at most one live SCIM token at a time - rotating means the old +// one stops working, same mental model as rotating an API key). Returns the +// plaintext token, which the caller must show to the user exactly once. +func (s *TokenStore) Create(orgID int64, createdByUserID int64) (plaintext string, tok *Token, err error) { + plaintext, err = GenerateToken() + if err != nil { + return "", nil, err + } + hash := HashToken(plaintext) + prefix := TokenPrefix(plaintext) + + tok = &Token{} + err = s.db.QueryRow(` + INSERT INTO scim_tokens (org_id, token_hash, token_prefix, created_by_user_id, created_at) + VALUES ($1, $2, $3, $4, NOW()) + RETURNING id, org_id, token_prefix, created_at, expires_at, revoked_at, created_by_user_id + `, orgID, hash, prefix, createdByUserID).Scan( + &tok.ID, &tok.OrgID, &tok.TokenPrefix, &tok.CreatedAt, &tok.ExpiresAt, &tok.RevokedAt, &tok.CreatedByUserID, + ) + if err != nil { + return "", nil, fmt.Errorf("failed to create scim token: %w", err) + } + return plaintext, tok, nil +} + +// Authenticate resolves a plaintext bearer token to the org it belongs to. +// Returns ErrTokenNotFound/ErrTokenRevoked/ErrTokenExpired so the HTTP layer +// can give a precise SCIM error response. +func (s *TokenStore) Authenticate(plaintext string) (orgID int64, err error) { + hash := HashToken(plaintext) + var revokedAt *time.Time + var expiresAt *time.Time + row := s.db.QueryRow(`SELECT org_id, revoked_at, expires_at FROM scim_tokens WHERE token_hash = $1`, hash) + if scanErr := row.Scan(&orgID, &revokedAt, &expiresAt); scanErr != nil { + if scanErr == sql.ErrNoRows { + return 0, ErrTokenNotFound + } + return 0, fmt.Errorf("failed to look up scim token: %w", scanErr) + } + if revokedAt != nil { + return 0, ErrTokenRevoked + } + if expiresAt != nil && expiresAt.Before(time.Now()) { + return 0, ErrTokenExpired + } + return orgID, nil +} + +// Get returns orgID's current live token, if any (nil, nil if none exists). +func (s *TokenStore) Get(orgID int64) (*Token, error) { + tok := &Token{} + err := s.db.QueryRow(` + SELECT id, org_id, token_prefix, created_at, expires_at, revoked_at, created_by_user_id + FROM scim_tokens WHERE org_id = $1 AND revoked_at IS NULL + ORDER BY created_at DESC LIMIT 1 + `, orgID).Scan(&tok.ID, &tok.OrgID, &tok.TokenPrefix, &tok.CreatedAt, &tok.ExpiresAt, &tok.RevokedAt, &tok.CreatedByUserID) + if err == sql.ErrNoRows { + return nil, nil + } + if err != nil { + return nil, fmt.Errorf("failed to load scim token: %w", err) + } + return tok, nil +} + +// Revoke invalidates orgID's current token immediately. +func (s *TokenStore) Revoke(orgID int64) error { + _, err := s.db.Exec(`UPDATE scim_tokens SET revoked_at = NOW() WHERE org_id = $1 AND revoked_at IS NULL`, orgID) + if err != nil { + return fmt.Errorf("failed to revoke scim token: %w", err) + } + return nil +} diff --git a/internal/scim/types.go b/internal/scim/types.go new file mode 100644 index 000000000..63d9594db --- /dev/null +++ b/internal/scim/types.go @@ -0,0 +1,78 @@ +package scim + +import "strconv" + +const ( + SchemaUser = "urn:ietf:params:scim:schemas:core:2.0:User" + SchemaListResponse = "urn:ietf:params:scim:api:messages:2.0:ListResponse" + SchemaPatchOp = "urn:ietf:params:scim:api:messages:2.0:PatchOp" + SchemaError = "urn:ietf:params:scim:api:messages:2.0:Error" +) + +// UserResource is the minimal SCIM User representation LiveReview speaks - +// enough for Okta/Azure AD/Google's lifecycle-sync use case (create, +// look up by userName/email, toggle active). Fields no customer IdP relies +// on for this use case (groups, x509Certificates, etc.) are intentionally +// omitted rather than stubbed out. +type UserResource struct { + Schemas []string `json:"schemas"` + ID string `json:"id"` + UserName string `json:"userName"` + Name *NameResource `json:"name,omitempty"` + Emails []EmailResource `json:"emails,omitempty"` + Active bool `json:"active"` + Meta *MetaResource `json:"meta,omitempty"` +} + +type NameResource struct { + GivenName string `json:"givenName,omitempty"` + FamilyName string `json:"familyName,omitempty"` +} + +type EmailResource struct { + Value string `json:"value"` + Primary bool `json:"primary,omitempty"` +} + +type MetaResource struct { + ResourceType string `json:"resourceType"` + Created string `json:"created,omitempty"` + LastModified string `json:"lastModified,omitempty"` +} + +type ListResponse struct { + Schemas []string `json:"schemas"` + TotalResults int `json:"totalResults"` + ItemsPerPage int `json:"itemsPerPage"` + StartIndex int `json:"startIndex"` + Resources []UserResource `json:"Resources"` +} + +// PatchRequest is the body of a SCIM PATCH /Users/:id call. IdPs send this +// to deprovision on offboarding: {"Operations":[{"op":"replace","value":{"active":false}}]}. +type PatchRequest struct { + Schemas []string `json:"schemas"` + Operations []PatchOperation `json:"Operations"` +} + +type PatchOperation struct { + Op string `json:"op"` + Path string `json:"path,omitempty"` + Value any `json:"value,omitempty"` +} + +// ErrorResponse is the SCIM-shaped error body every handler returns on +// failure, per RFC 7644 §3.12. +type ErrorResponse struct { + Schemas []string `json:"schemas"` + Status string `json:"status"` + Detail string `json:"detail"` +} + +func NewError(status int, detail string) ErrorResponse { + return ErrorResponse{ + Schemas: []string{SchemaError}, + Status: strconv.Itoa(status), + Detail: detail, + } +} diff --git a/internal/sso/config.go b/internal/sso/config.go index 43bcfc085..270da12b1 100644 --- a/internal/sso/config.go +++ b/internal/sso/config.go @@ -4,6 +4,7 @@ import ( "database/sql" "errors" "fmt" + "time" ) // ProviderType is the SSO protocol a config row speaks. @@ -31,6 +32,14 @@ type Config struct { SAMLIDPMetadataURL string SAMLIDPMetadataXML string SAMLIDPEntityID string + + // Reconciliation fields only apply to provider_type=oidc - see Phase 5 + // of docs/sso.md's deprovisioning section. SAML has no standing + // credential to silently re-check, so these are always false/zero for + // SAML configs. + ReconciliationEnabled bool + ReconciliationInterval string // "hourly" | "daily" | "weekly" + LastReconciledAt *time.Time } // Store persists org_sso_configs, transparently encrypting/decrypting the @@ -51,7 +60,8 @@ func (s *Store) Get(orgID int64, provider ProviderType) (*Config, error) { row := s.db.QueryRow(` SELECT id, org_id, provider_type, display_name, enabled, COALESCE(oidc_issuer, ''), COALESCE(oidc_client_id, ''), COALESCE(oidc_client_secret_enc, ''), COALESCE(oidc_scopes, ''), - COALESCE(saml_idp_metadata_url, ''), COALESCE(saml_idp_metadata_xml, ''), COALESCE(saml_idp_entity_id, '') + COALESCE(saml_idp_metadata_url, ''), COALESCE(saml_idp_metadata_xml, ''), COALESCE(saml_idp_entity_id, ''), + reconciliation_enabled, reconciliation_interval, last_reconciled_at FROM org_sso_configs WHERE org_id = $1 AND provider_type = $2 `, orgID, string(provider)) @@ -60,7 +70,8 @@ func (s *Store) Get(orgID int64, provider ProviderType) (*Config, error) { var encSecret string if err := row.Scan(&cfg.ID, &cfg.OrgID, &cfg.ProviderType, &cfg.DisplayName, &cfg.Enabled, &cfg.OIDCIssuer, &cfg.OIDCClientID, &encSecret, &cfg.OIDCScopes, - &cfg.SAMLIDPMetadataURL, &cfg.SAMLIDPMetadataXML, &cfg.SAMLIDPEntityID); err != nil { + &cfg.SAMLIDPMetadataURL, &cfg.SAMLIDPMetadataXML, &cfg.SAMLIDPEntityID, + &cfg.ReconciliationEnabled, &cfg.ReconciliationInterval, &cfg.LastReconciledAt); err != nil { if err == sql.ErrNoRows { return nil, ErrNotFound } @@ -122,13 +133,18 @@ func (s *Store) UpsertTx(exec sqlExecer, cfg *Config, createdByUserID int64) err if err != nil { return fmt.Errorf("sso: encrypting client secret: %w", err) } + reconciliationInterval := cfg.ReconciliationInterval + if reconciliationInterval == "" { + reconciliationInterval = "daily" + } _, err = exec.Exec(` INSERT INTO org_sso_configs ( org_id, provider_type, display_name, enabled, oidc_issuer, oidc_client_id, oidc_client_secret_enc, oidc_scopes, saml_idp_metadata_url, saml_idp_metadata_xml, saml_idp_entity_id, + reconciliation_enabled, reconciliation_interval, created_by_user_id - ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12) + ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) ON CONFLICT (org_id, provider_type) DO UPDATE SET display_name = EXCLUDED.display_name, enabled = EXCLUDED.enabled, @@ -139,10 +155,13 @@ func (s *Store) UpsertTx(exec sqlExecer, cfg *Config, createdByUserID int64) err saml_idp_metadata_url = EXCLUDED.saml_idp_metadata_url, saml_idp_metadata_xml = EXCLUDED.saml_idp_metadata_xml, saml_idp_entity_id = EXCLUDED.saml_idp_entity_id, + reconciliation_enabled = EXCLUDED.reconciliation_enabled, + reconciliation_interval = EXCLUDED.reconciliation_interval, updated_at = NOW() `, cfg.OrgID, string(cfg.ProviderType), cfg.DisplayName, cfg.Enabled, nullable(cfg.OIDCIssuer), nullable(cfg.OIDCClientID), nullable(encSecret), nullable(cfg.OIDCScopes), nullable(cfg.SAMLIDPMetadataURL), nullable(cfg.SAMLIDPMetadataXML), nullable(cfg.SAMLIDPEntityID), + cfg.ReconciliationEnabled, reconciliationInterval, nullableID(createdByUserID)) if err != nil { return fmt.Errorf("sso: upserting config: %w", err) @@ -163,6 +182,49 @@ func (s *Store) DeleteTx(exec sqlExecer, orgID int64, provider ProviderType) err return nil } +// ListDueForReconciliation returns every OIDC config with the reconciliation +// poll enabled whose interval has elapsed since it last ran (or that has +// never run). Used by the coordinator job (internal/jobqueue/sso_reconciliation_worker.go) +// on a fixed short tick to decide which orgs to fan out one-shot work to - +// see Phase 5 of docs/sso.md's deprovisioning section for why this is a +// coordinator+fan-out job rather than one River PeriodicJob per org. +func (s *Store) ListDueForReconciliation() ([]*Config, error) { + rows, err := s.db.Query(` + SELECT id, org_id, provider_type, reconciliation_interval, last_reconciled_at + FROM org_sso_configs + WHERE provider_type = 'oidc' AND reconciliation_enabled = TRUE AND ( + last_reconciled_at IS NULL + OR (reconciliation_interval = 'hourly' AND last_reconciled_at < NOW() - INTERVAL '1 hour') + OR (reconciliation_interval = 'daily' AND last_reconciled_at < NOW() - INTERVAL '1 day') + OR (reconciliation_interval = 'weekly' AND last_reconciled_at < NOW() - INTERVAL '7 days') + ) + `) + if err != nil { + return nil, fmt.Errorf("sso: listing configs due for reconciliation: %w", err) + } + defer rows.Close() + + var out []*Config + for rows.Next() { + cfg := &Config{} + if err := rows.Scan(&cfg.ID, &cfg.OrgID, &cfg.ProviderType, &cfg.ReconciliationInterval, &cfg.LastReconciledAt); err != nil { + return nil, fmt.Errorf("sso: scanning config due for reconciliation: %w", err) + } + out = append(out, cfg) + } + return out, rows.Err() +} + +// MarkReconciled stamps last_reconciled_at = NOW() once a reconciliation +// sweep finishes for (orgID, provider). +func (s *Store) MarkReconciled(orgID int64, provider ProviderType) error { + _, err := s.db.Exec(`UPDATE org_sso_configs SET last_reconciled_at = NOW() WHERE org_id = $1 AND provider_type = $2`, orgID, string(provider)) + if err != nil { + return fmt.Errorf("sso: marking config reconciled: %w", err) + } + return nil +} + func nullable(s string) interface{} { if s == "" { return nil diff --git a/internal/sso/identity_store.go b/internal/sso/identity_store.go new file mode 100644 index 000000000..194143171 --- /dev/null +++ b/internal/sso/identity_store.go @@ -0,0 +1,110 @@ +package sso + +import ( + "database/sql" + "fmt" +) + +// IdentityStore persists sso_identities: the mapping from an IdP's own +// subject identifier (OIDC `sub` / SAML NameID) to a LiveReview user, per +// org and provider. Two things need this mapping, neither of which a +// LiveReview user id alone can satisfy: +// - An incoming OIDC back-channel logout token or SAML LogoutRequest only +// ever carries the IdP's subject, never a LiveReview user id. +// - The reconciliation poll (Phase 5) needs an encrypted refresh token per +// identity to silently re-check "is this account still valid at the IdP". +type IdentityStore struct { + db *sql.DB + box *SecretBox +} + +func NewIdentityStore(db *sql.DB, box *SecretBox) *IdentityStore { + return &IdentityStore{db: db, box: box} +} + +// Upsert records (or refreshes) the subject->user mapping for a successful +// login, and the refresh token if one was issued (empty string clears it - +// callers pass "" when the IdP didn't grant one, e.g. reconciliation isn't +// enabled for this config). +func (s *IdentityStore) Upsert(orgID, userID int64, provider ProviderType, subject, refreshToken string) error { + encRefresh, err := s.box.Encrypt(refreshToken) + if err != nil { + return fmt.Errorf("sso: encrypting refresh token: %w", err) + } + _, err = s.db.Exec(` + INSERT INTO sso_identities (org_id, user_id, provider_type, subject, oidc_refresh_token_enc, created_at, updated_at) + VALUES ($1, $2, $3, $4, $5, NOW(), NOW()) + ON CONFLICT (org_id, provider_type, subject) DO UPDATE SET + user_id = EXCLUDED.user_id, + oidc_refresh_token_enc = CASE WHEN EXCLUDED.oidc_refresh_token_enc IS NOT NULL THEN EXCLUDED.oidc_refresh_token_enc ELSE sso_identities.oidc_refresh_token_enc END, + updated_at = NOW() + `, orgID, userID, string(provider), subject, nullable(encRefresh)) + if err != nil { + return fmt.Errorf("sso: upserting identity: %w", err) + } + return nil +} + +// LookupUserBySubject resolves an incoming logout event's subject to a +// LiveReview user id, for back-channel logout / SAML SLO (Phase 4). +func (s *IdentityStore) LookupUserBySubject(orgID int64, provider ProviderType, subject string) (userID int64, err error) { + err = s.db.QueryRow(` + SELECT user_id FROM sso_identities WHERE org_id = $1 AND provider_type = $2 AND subject = $3 + `, orgID, string(provider), subject).Scan(&userID) + if err != nil { + if err == sql.ErrNoRows { + return 0, fmt.Errorf("sso: no identity found for subject") + } + return 0, fmt.Errorf("sso: looking up identity: %w", err) + } + return userID, nil +} + +// IdentityWithRefreshToken is one row the reconciliation worker checks. +type IdentityWithRefreshToken struct { + ID int64 + UserID int64 + Subject string + RefreshToken string +} + +// ListWithRefreshToken returns every stored identity for orgID that has a +// refresh token on file, for the reconciliation worker +// (internal/jobqueue/sso_reconciliation_worker.go) to silently re-check. +func (s *IdentityStore) ListWithRefreshToken(orgID int64, provider ProviderType) ([]IdentityWithRefreshToken, error) { + rows, err := s.db.Query(` + SELECT id, user_id, subject, oidc_refresh_token_enc + FROM sso_identities + WHERE org_id = $1 AND provider_type = $2 AND oidc_refresh_token_enc IS NOT NULL + `, orgID, string(provider)) + if err != nil { + return nil, fmt.Errorf("sso: listing identities with refresh tokens: %w", err) + } + defer rows.Close() + + var out []IdentityWithRefreshToken + for rows.Next() { + var row IdentityWithRefreshToken + var encRefresh string + if err := rows.Scan(&row.ID, &row.UserID, &row.Subject, &encRefresh); err != nil { + return nil, fmt.Errorf("sso: scanning identity: %w", err) + } + refresh, err := s.box.Decrypt(encRefresh) + if err != nil { + return nil, fmt.Errorf("sso: decrypting refresh token: %w", err) + } + row.RefreshToken = refresh + out = append(out, row) + } + return out, rows.Err() +} + +// MarkChecked stamps last_checked_at = NOW() for one identity after a +// successful reconciliation refresh. +func (s *IdentityStore) MarkChecked(id int64) error { + _, err := s.db.Exec(`UPDATE sso_identities SET last_checked_at = NOW() WHERE id = $1`, id) + if err != nil { + return fmt.Errorf("sso: marking identity checked: %w", err) + } + return nil +} diff --git a/internal/sso/oidc.go b/internal/sso/oidc.go index 0c4fd72a2..894e8acc7 100644 --- a/internal/sso/oidc.go +++ b/internal/sso/oidc.go @@ -15,6 +15,17 @@ import ( type Identity struct { Email string Name string + // Subject is the IdP's own identifier for this identity (OIDC `sub` / + // SAML NameID). Needed to resolve an incoming OIDC back-channel logout + // token or SAML LogoutRequest - which only carry this, never a + // LiveReview user id - back to a user (see internal/sso identity_store.go + // and Phase 4 of docs/sso.md's deprovisioning section). + Subject string + // RefreshToken is only populated for OIDC configs with the + // reconciliation poll enabled (see Config.ReconciliationEnabled) - it + // requests the "offline_access" scope specifically so the poll can + // silently re-check "is this account still valid" between logins. + RefreshToken string } // oidcClaims mirrors the standard OIDC claims LiveReview needs. Most IdPs @@ -41,6 +52,9 @@ func BuildOIDCOAuth2Config(ctx context.Context, cfg *Config, redirectURL string) if strings.TrimSpace(cfg.OIDCScopes) != "" { scopes = strings.Fields(cfg.OIDCScopes) } + if cfg.ReconciliationEnabled && !containsFold(scopes, "offline_access") { + scopes = append(scopes, "offline_access") + } oauthCfg := &oauth2.Config{ ClientID: cfg.OIDCClientID, ClientSecret: cfg.OIDCClientSecret, @@ -74,7 +88,52 @@ func ExchangeOIDCCode(ctx context.Context, oauthCfg *oauth2.Config, verifier *oi if claims.Email == "" { return nil, fmt.Errorf("sso: oidc id_token has no email claim") } - return &Identity{Email: claims.Email, Name: claims.Name}, nil + return &Identity{ + Email: claims.Email, + Name: claims.Name, + Subject: idToken.Subject, + RefreshToken: token.RefreshToken, + }, nil +} + +// backChannelLogoutEvent is the OIDC Back-Channel Logout 1.0 event URI a +// valid logout_token's "events" claim must contain. +const backChannelLogoutEvent = "http://schemas.openid.net/event/backchannel-logout" + +type backChannelLogoutClaims struct { + Subject string `json:"sub"` + Events map[string]interface{} `json:"events"` +} + +// VerifyBackChannelLogoutToken verifies an incoming OIDC back-channel +// logout token (RFC: OIDC Back-Channel Logout 1.0) the same way an ID +// token is verified - same issuer, signature (JWKS), audience, and expiry +// checks via go-oidc - then confirms the logout-specific "events" claim is +// present, and returns the subject whose sessions should be revoked. +func VerifyBackChannelLogoutToken(ctx context.Context, cfg *Config, rawToken string) (string, error) { + if cfg.ProviderType != ProviderOIDC { + return "", fmt.Errorf("sso: config %d is not an OIDC config", cfg.ID) + } + provider, err := oidc.NewProvider(ctx, cfg.OIDCIssuer) + if err != nil { + return "", fmt.Errorf("sso: oidc discovery against %q failed: %w", cfg.OIDCIssuer, err) + } + verifier := provider.Verifier(&oidc.Config{ClientID: cfg.OIDCClientID}) + idToken, err := verifier.Verify(ctx, rawToken) + if err != nil { + return "", fmt.Errorf("sso: logout_token verification failed: %w", err) + } + var claims backChannelLogoutClaims + if err := idToken.Claims(&claims); err != nil { + return "", fmt.Errorf("sso: parsing logout_token claims: %w", err) + } + if _, ok := claims.Events[backChannelLogoutEvent]; !ok { + return "", fmt.Errorf("sso: logout_token missing required backchannel-logout event claim") + } + if claims.Subject == "" { + return "", fmt.Errorf("sso: logout_token has no sub claim") + } + return claims.Subject, nil } // TestOIDCDiscovery is used by the config "test connection" endpoint - it diff --git a/internal/sso/saml.go b/internal/sso/saml.go index 92f19802d..352fb87cd 100644 --- a/internal/sso/saml.go +++ b/internal/sso/saml.go @@ -95,6 +95,7 @@ func ExchangeSAMLResponse(sp *samllib.ServiceProvider, r *http.Request) (*Identi identity := &Identity{} if assertion.Subject != nil && assertion.Subject.NameID != nil { v := strings.TrimSpace(assertion.Subject.NameID.Value) + identity.Subject = v if strings.Contains(v, "@") { identity.Email = v } diff --git a/ui/src/pages/Settings/SSOSettingsTab.tsx b/ui/src/pages/Settings/SSOSettingsTab.tsx index ec4e12cbb..b8b5fd4ef 100644 --- a/ui/src/pages/Settings/SSOSettingsTab.tsx +++ b/ui/src/pages/Settings/SSOSettingsTab.tsx @@ -6,6 +6,8 @@ import { useOrgContext } from '../../hooks/useOrgContext'; type ProviderType = 'oidc' | 'saml'; +type ReconciliationInterval = 'hourly' | 'daily' | 'weekly'; + interface SSOConfigResponse { provider_type: ProviderType; display_name: string; @@ -17,6 +19,9 @@ interface SSOConfigResponse { saml_idp_metadata_url?: string; saml_idp_entity_id?: string; saml_metadata_set: boolean; + reconciliation_enabled?: boolean; + reconciliation_interval?: ReconciliationInterval; + last_reconciled_at?: string; } interface FormState { @@ -28,6 +33,8 @@ interface FormState { oidc_scopes: string; saml_idp_metadata_url: string; saml_idp_metadata_xml: string; + reconciliation_enabled: boolean; + reconciliation_interval: ReconciliationInterval; } const emptyForm: FormState = { @@ -39,6 +46,8 @@ const emptyForm: FormState = { oidc_scopes: '', saml_idp_metadata_url: '', saml_idp_metadata_xml: '', + reconciliation_enabled: false, + reconciliation_interval: 'daily', }; const ResultBanner: React.FC<{ type: 'success' | 'error'; message: string }> = ({ type, message }) => ( @@ -70,6 +79,8 @@ const ProviderPanel: React.FC<{ oidc_scopes: existing.oidc_scopes || '', saml_idp_metadata_url: existing.saml_idp_metadata_url || '', saml_idp_metadata_xml: '', // never round-tripped - left blank keeps the stored metadata + reconciliation_enabled: existing.reconciliation_enabled || false, + reconciliation_interval: existing.reconciliation_interval || 'daily', }); } }, [existing]); @@ -90,6 +101,8 @@ const ProviderPanel: React.FC<{ if (form.oidc_client_secret !== '') { body.oidc_client_secret = form.oidc_client_secret; } + body.reconciliation_enabled = form.reconciliation_enabled; + body.reconciliation_interval = form.reconciliation_interval; } else { body.saml_idp_metadata_url = form.saml_idp_metadata_url; if (form.saml_idp_metadata_xml !== '') { @@ -203,6 +216,46 @@ const ProviderPanel: React.FC<{ Redirect URI to register with your identity provider:{' '} {window.location.origin}/api/v1/auth/sso/oidc/callback

+ +
+
+ handleChange('reconciliation_enabled', e.target.checked)} + className="w-4 h-4 text-indigo-600 bg-slate-700 border-slate-600 rounded focus:ring-indigo-500 focus:ring-2" + /> + +
+

+ Fallback for orgs that don't configure SCIM below: periodically re-checks each signed-in + user against the identity provider and deactivates them here if the account was disabled + or removed there. SCIM (if configured) is real-time; this is a backstop, bounded by the + interval you pick. +

+ {form.reconciliation_enabled && ( +
+ + + {existing?.last_reconciled_at && ( +

+ Last checked: {new Date(existing.last_reconciled_at).toLocaleString()} +

+ )} +
+ )} +
) : ( <> @@ -261,6 +314,129 @@ const ProviderPanel: React.FC<{ ); }; +interface ScimTokenResponse { + exists?: boolean; + token_prefix?: string; + created_at?: string; + token?: string; // only present immediately after create/rotate +} + +const ScimProvisioningPanel: React.FC<{ orgId: number }> = ({ orgId }) => { + const [tokenInfo, setTokenInfo] = useState(null); + const [newToken, setNewToken] = useState(null); + const [isLoading, setIsLoading] = useState(true); + const [isWorking, setIsWorking] = useState(false); + + const fetchToken = async () => { + try { + const data = await apiClient.get(`/api/v1/orgs/${orgId}/scim-token`); + setTokenInfo(data); + } catch (error) { + console.error('Failed to fetch SCIM token status:', error); + } finally { + setIsLoading(false); + } + }; + + useEffect(() => { + if (orgId) { + fetchToken(); + } + }, [orgId]); + + const handleGenerate = async () => { + const verb = tokenInfo?.token_prefix ? 'rotate' : 'generate'; + if (tokenInfo?.token_prefix && !window.confirm('Rotating the SCIM token immediately invalidates the old one. Your identity provider will need the new token. Continue?')) { + return; + } + setIsWorking(true); + try { + const data = await apiClient.post(`/api/v1/orgs/${orgId}/scim-token`, {}); + setTokenInfo(data); + setNewToken(data.token || null); + notify.success(`SCIM token ${verb}d`); + } catch (error: any) { + notify.error(error?.message || `Failed to ${verb} SCIM token`); + } finally { + setIsWorking(false); + } + }; + + const handleRevoke = async () => { + if (!window.confirm('Revoke the SCIM token? Your identity provider will no longer be able to sync users until a new token is generated.')) { + return; + } + setIsWorking(true); + try { + await apiClient.delete(`/api/v1/orgs/${orgId}/scim-token`); + setTokenInfo({ exists: false }); + setNewToken(null); + notify.success('SCIM token revoked'); + } catch (error: any) { + notify.error(error?.message || 'Failed to revoke SCIM token'); + } finally { + setIsWorking(false); + } + }; + + if (isLoading) { + return null; + } + + const scimBaseURL = `${window.location.origin}/api/v1/scim/v2`; + + return ( +
+
+
+ +
+
+

SCIM Provisioning

+

+ Let Okta, Azure AD, or Google Workspace automatically create and deactivate users here when + they're added or removed at the identity provider - the real-time counterpart to the + reconciliation check above. +

+
+
+ + {newToken && ( +
+

+ Copy this token now - it won't be shown again. +

+ {newToken} +
+ )} + +

+ SCIM base URL: {scimBaseURL} +

+ + {tokenInfo?.token_prefix ? ( +

+ Current token: {tokenInfo.token_prefix}... + {tokenInfo.created_at && ` (created ${new Date(tokenInfo.created_at).toLocaleString()})`} +

+ ) : ( +

No SCIM token configured yet.

+ )} + +
+ + {tokenInfo?.token_prefix && ( + + )} +
+
+ ); +}; + const SSOSettingsTab: React.FC = () => { const { currentOrgId } = useOrgContext(); const orgId = currentOrgId ?? 0; @@ -336,6 +512,8 @@ const SSOSettingsTab: React.FC = () => { existing={existingForActive} onSaved={fetchConfigs} /> + + ); }; From b32f9f873c9f548a30cef1902ecbb39398e894fe Mon Sep 17 00:00:00 2001 From: Shrijith Venkatramana Date: Thu, 29 Oct 2026 17:16:20 +0000 Subject: [PATCH 2/4] Fix the full pre-existing test suite: stale renames, dropped notes, and env-gated Razorpay tests go test ./... had five failing packages unrelated to any feature work, left unfixed since before this branch. Root-caused and fixed each: - internal/license/payment: Razorpay sandbox integration tests failed outright without RAZORPAY_TEST_KEY/SECRET instead of skipping; they now skip cleanly when credentials are absent. - internal/provider_input/bitbucket: a capture fixture's path was never updated after a repo-wide docs/raw/ reorg moved it. - internal/provider_input/azuredevops: test asserted a raw trailing newline that stripMentionTokens intentionally trims. - internal/provider_output/github: test predated the intentional blockquote-reply feature for issue comments. - internal/mcpagent: classify_test.go still used the shape names ("chat", "count_query") from before they were renamed to "product_guidance"/"analytics", so the classify call never actually parsed and every downstream assertion was exercising degraded-fallback behavior instead of the real branch. Fixing the names surfaced two real bugs the stale tests had been masking: assembleAnalyticsResponse discarded per-report notes (no-data/failure sentences) and always returned a generic fallback, and the analytics-shape dispatch branch never swapped history[0]'s system prompt like every other branch does, leaking the previous turn's prompt into analytics turns. Also added one corrective retry to the multi-interpret call on unparseable JSON, matching the retry budget the SQL repair phases already have. LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%) --- internal/license/payment/integration_test.go | 1 + internal/license/payment/payment_test.go | 5 ++ .../license/payment/razorpay_live_test.go | 18 +++++++ internal/license/payment/setup_plans_test.go | 1 + internal/license/payment/subscription_test.go | 6 +++ internal/mcpagent/agent.go | 17 ++++++ internal/mcpagent/analytics.go | 42 +++++++++++---- internal/mcpagent/analytics_pipeline_test.go | 12 ++--- internal/mcpagent/classify_test.go | 54 ++++++++++++++----- internal/mcpagent/laws_contract_test.go | 2 +- .../azuredevops_conversion_test.go | 2 +- .../bitbucket_comment_hierarchy_test.go | 2 +- .../github/output_client_test.go | 2 +- 13 files changed, 132 insertions(+), 32 deletions(-) create mode 100644 internal/license/payment/razorpay_live_test.go diff --git a/internal/license/payment/integration_test.go b/internal/license/payment/integration_test.go index eaaa3f2d7..2c912eb0c 100644 --- a/internal/license/payment/integration_test.go +++ b/internal/license/payment/integration_test.go @@ -13,6 +13,7 @@ import ( // TestSubscriptionIntegration tests the complete subscription flow // Run with: go test -v ./internal/license/payment -run TestSubscriptionIntegration func TestSubscriptionIntegration(t *testing.T) { + skipWithoutRazorpayTestKeys(t) // Skip if not in integration test mode if testing.Short() { t.Skip("Skipping integration test in short mode") diff --git a/internal/license/payment/payment_test.go b/internal/license/payment/payment_test.go index e40073016..28c04d0ed 100644 --- a/internal/license/payment/payment_test.go +++ b/internal/license/payment/payment_test.go @@ -7,6 +7,7 @@ import ( ) func TestGetRazoarPayKeys(t *testing.T) { + skipWithoutRazorpayTestKeys(t) accessKey, secretKey, err := GetRazorpayKeys("test") if err != nil { t.Errorf("Error getting Razorpay keys: %v", err) @@ -20,6 +21,7 @@ func TestGetRazoarPayKeys(t *testing.T) { } func TestCreateMonthlyPlan(t *testing.T) { + skipWithoutRazorpayTestKeys(t) plan, err := CreatePlan("test", "monthly") if err != nil { t.Errorf("Error creating monthly plan: %v", err) @@ -41,6 +43,7 @@ func TestCreateMonthlyPlan(t *testing.T) { } func TestCreateYearlyPlan(t *testing.T) { + skipWithoutRazorpayTestKeys(t) plan, err := CreatePlan("test", "yearly") if err != nil { t.Errorf("Error creating yearly plan: %v", err) @@ -62,6 +65,7 @@ func TestCreateYearlyPlan(t *testing.T) { } func TestGetAllPlans(t *testing.T) { + skipWithoutRazorpayTestKeys(t) planList, err := GetAllPlans("test") if err != nil { t.Errorf("Error fetching all plans: %v", err) @@ -80,6 +84,7 @@ func TestGetAllPlans(t *testing.T) { } func TestGetPlanByID(t *testing.T) { + skipWithoutRazorpayTestKeys(t) // First, get all plans to get a valid plan ID planList, err := GetAllPlans("test") if err != nil { diff --git a/internal/license/payment/razorpay_live_test.go b/internal/license/payment/razorpay_live_test.go new file mode 100644 index 000000000..96429a867 --- /dev/null +++ b/internal/license/payment/razorpay_live_test.go @@ -0,0 +1,18 @@ +package payment + +import ( + "os" + "testing" +) + +// skipWithoutRazorpayTestKeys skips a test that hits the real Razorpay test-mode +// API when RAZORPAY_TEST_KEY/RAZORPAY_TEST_SECRET aren't configured, rather than +// failing - these are manual verification scripts against a live sandbox +// account, not hermetic unit tests, and most environments (CI, local dev +// without sandbox credentials) have no reason to run them. +func skipWithoutRazorpayTestKeys(t *testing.T) { + t.Helper() + if os.Getenv("RAZORPAY_TEST_KEY") == "" || os.Getenv("RAZORPAY_TEST_SECRET") == "" { + t.Skip("skipping: RAZORPAY_TEST_KEY/RAZORPAY_TEST_SECRET not set (live Razorpay sandbox test)") + } +} diff --git a/internal/license/payment/setup_plans_test.go b/internal/license/payment/setup_plans_test.go index 6d8dfa6b5..623711df8 100644 --- a/internal/license/payment/setup_plans_test.go +++ b/internal/license/payment/setup_plans_test.go @@ -9,6 +9,7 @@ import ( // Run with: go test -v ./internal/license/payment -run TestSetupPlans // Use -args test or -args live to specify mode (default: test) func TestSetupPlans(t *testing.T) { + skipWithoutRazorpayTestKeys(t) // Get mode from test args (defaults to "test") mode := "test" // Note: In real usage, you'd pass mode via environment variable: diff --git a/internal/license/payment/subscription_test.go b/internal/license/payment/subscription_test.go index d6accd9c9..e3a278e63 100644 --- a/internal/license/payment/subscription_test.go +++ b/internal/license/payment/subscription_test.go @@ -8,6 +8,7 @@ import ( ) func TestCreateSubscription(t *testing.T) { + skipWithoutRazorpayTestKeys(t) // First, get a plan to subscribe to planList, err := GetAllPlans("test") if err != nil { @@ -56,6 +57,7 @@ func TestCreateSubscription(t *testing.T) { } func TestGetAllSubscriptions(t *testing.T) { + skipWithoutRazorpayTestKeys(t) subList, err := GetAllSubscriptions("test") if err != nil { t.Fatalf("Error fetching all subscriptions: %v", err) @@ -73,6 +75,7 @@ func TestGetAllSubscriptions(t *testing.T) { } func TestGetSubscriptionByID(t *testing.T) { + skipWithoutRazorpayTestKeys(t) // First, get all subscriptions to get a valid subscription ID subList, err := GetAllSubscriptions("test") if err != nil { @@ -100,6 +103,7 @@ func TestGetSubscriptionByID(t *testing.T) { } func TestUpdateSubscriptionQuantity(t *testing.T) { + skipWithoutRazorpayTestKeys(t) // First, create a subscription planList, err := GetAllPlans("test") if err != nil { @@ -157,6 +161,7 @@ func TestUpdateSubscriptionQuantity(t *testing.T) { } func TestCancelSubscription(t *testing.T) { + skipWithoutRazorpayTestKeys(t) // First, create a subscription planList, err := GetAllPlans("test") if err != nil { @@ -208,6 +213,7 @@ func TestCancelSubscription(t *testing.T) { } func TestCancelSubscriptionAtCycleEnd(t *testing.T) { + skipWithoutRazorpayTestKeys(t) // First, create a subscription planList, err := GetAllPlans("test") if err != nil { diff --git a/internal/mcpagent/agent.go b/internal/mcpagent/agent.go index 7773e3e42..f45660bc9 100644 --- a/internal/mcpagent/agent.go +++ b/internal/mcpagent/agent.go @@ -181,6 +181,23 @@ func (a *Agent) RunTurnWithArtifacts(ctx context.Context, history []HistoryEntry // single LLM call returns SQL + chart specs for up to 5 // interpretations. No plan→finalize two-step. clog.BranchSelected("analytics", 0, 0) + + // This branch never runs through runStepLoop (which otherwise + // does this swap - see its own comment), so it has to do the + // same history[0] swap itself. Without it, a turn landing here + // right after an action/product_guidance turn keeps that + // turn's stale system prompt (missing the SQL rules, or + // leaking the tool list into an analytics turn). + analyticsSystemPrompt := a.interpretPrompt() + switch { + case len(history) == 0: + history = append(history, HistoryEntry{"role": "system", "content": analyticsSystemPrompt}) + case history[0]["role"] == "system": + history[0] = HistoryEntry{"role": "system", "content": analyticsSystemPrompt} + default: + history = append([]HistoryEntry{{"role": "system", "content": analyticsSystemPrompt}}, history...) + } + text, artifacts, debugArt, err := a.runMultiInterpret(ctx, userText, clog, a.mcpSession.OrgID, a.mcpSession.OrgName) if err != nil { return text, history, artifacts, debugArt, err diff --git a/internal/mcpagent/analytics.go b/internal/mcpagent/analytics.go index 6d83955a3..05a51dd8e 100644 --- a/internal/mcpagent/analytics.go +++ b/internal/mcpagent/analytics.go @@ -1427,18 +1427,29 @@ var DefaultAIErrorSuggestedQuestions = []SuggestedQuestionCategory{ // rightly read as a bug, because it is one. func assembleAnalyticsResponse(reports []vlrender.VegaLiteReport, notes []string, hasArtifacts bool) string { if len(reports) == 0 { - if hasArtifacts { - return "I've put the results in a file you can download." + if len(notes) == 0 { + if hasArtifacts { + // A file-only turn still needs words. Returning "" renders + // as an empty bubble next to a download the user has no + // context for. + return "I've put the results in a file you can download." + } + return NoDataAnalyticsResponseText } - return NoDataAnalyticsResponseText + return strings.Join(notes, "\n\n") } payload, err := json.Marshal(map[string]any{"reports": reports}) if err != nil { log.Error().Err(err).Msg("failed to marshal analytics reports") - return NoDataAnalyticsResponseText + return strings.Join(notes, "\n\n") + } + out := string(payload) + if len(notes) > 0 { + // Notes precede the JSON: the render path strips the JSON block and + // keeps surrounding prose as the message text. + out = strings.Join(notes, "\n\n") + "\n" + out } - // Notes (skip reasons) are only in debug artifacts, not in chat response. - return string(payload) + return out } // rowsToPreviewCSV converts rows to a CSV string for debug preview. @@ -1688,10 +1699,23 @@ func (a *Agent) runMultiInterpret( interps, ok := parseInterpretations(raw) if !ok { - log.Warn().Str("raw_preview", truncateContent(raw, 200)).Msg("could not parse interpretations from LLM response") + // One corrective retry, the same budget the SQL repair phases already + // get (see repairSQL) - recovers truncated/malformed replies instead + // of giving up the whole report on the first bad JSON. + log.Warn().Str("raw_preview", truncateContent(raw, 200)).Msg("could not parse interpretations from LLM response, retrying with correction") + retryUserMsg := userMsg + "\n\nYour previous reply could not be parsed:\n" + truncateContent(raw, 500) + + "\n\nReply again with ONLY a valid JSON object of the exact {\"analytics_plan\": [...]} shape described above - no prose, no truncation, nothing else." + retryRaw, retryErr := a.completeOnce(ctx, clog, 2, "interpret", "multi", 2, system, retryUserMsg) + if retryErr == nil { + raw = retryRaw + debug.LLMRawResponse = raw + interps, ok = parseInterpretations(raw) + } + } + if !ok { + log.Warn().Str("raw_preview", truncateContent(raw, 200)).Msg("could not parse interpretations from LLM response after retry") debug.RawLLMError = "Failed to parse LLM output as JSON (often caused by max token limits). Raw output:\n" + raw - formatMsg := "> **Model Output Error**\n> \n> The AI returned data in an unexpected format. Please try rephrasing your question." - return formatMsg, nil, debug, nil + return "I could not work out a full query for that - try rephrasing it.", nil, debug, nil } debug.Interpretations = interps diff --git a/internal/mcpagent/analytics_pipeline_test.go b/internal/mcpagent/analytics_pipeline_test.go index 9ad129b10..6e8f5c105 100644 --- a/internal/mcpagent/analytics_pipeline_test.go +++ b/internal/mcpagent/analytics_pipeline_test.go @@ -460,12 +460,12 @@ func TestAnalyticsPipelineProducesCSV(t *testing.T) { t.Fatalf("expected 1 CSV artifact, got %d", len(artifacts)) } // A CSV-only turn (no chart, no notes) must not also claim nothing was - // found - the file itself, delivered separately, IS the answer. Regression - // guard for the exact contradiction seen in production: a correctly - // attached CSV alongside the chat text "I could not find anything to - // answer that." - if text != "" { - t.Fatalf("expected empty response text alongside the CSV artifact, got %q", text) + // found - the file itself, delivered separately, IS the answer. An empty + // response text renders as a context-free empty bubble next to the + // download, so a short acknowledgement is used instead (never the + // contradictory "I could not find anything to answer that."). + if text != "I've put the results in a file you can download." { + t.Fatalf("expected the file-download acknowledgement alongside the CSV artifact, got %q", text) } art := artifacts[0] if art.Filename != "completed.csv" { diff --git a/internal/mcpagent/classify_test.go b/internal/mcpagent/classify_test.go index d84f2e22d..10dcaa772 100644 --- a/internal/mcpagent/classify_test.go +++ b/internal/mcpagent/classify_test.go @@ -6,6 +6,10 @@ import ( "strings" "testing" + "time" + + "github.com/livereview/internal/aiconnectors" + "github.com/livereview/internal/database" storageanalytics "github.com/livereview/storage/analytics" "github.com/tmc/langchaingo/llms" ) @@ -146,8 +150,24 @@ func (nopAnalyticsEngine) Query(context.Context, string, int) (*storageanalytics // database/tool-server behind it - every case below is designed to be // resolved by the guard's own validation (rejecting a table that isn't in // the catalog) or to never call a tool, so nothing here needs live -// infrastructure. -func dispatchTestAgent(prov *recordingProvider) *Agent { +// infrastructure. It still has to wait on the real package-wide schema +// index, though: RunTurnWithArtifacts refuses any turn up front when +// analyticsEnabled() && !schemaIndexReady() (agent.go), and that index is a +// process-wide singleton shared with the testAgent-based tests in +// analytics_pipeline_test.go - without this wait, this test is a race +// against whichever test happens to trigger the (slow, first-time) build. +func dispatchTestAgent(t *testing.T, prov *recordingProvider) *Agent { + t.Helper() + if dsn, err := database.LoadDatabaseURL(); err == nil { + InitSchemaIndex(dsn) + } + if schemaIdx != nil { + select { + case <-schemaIdx.Ready(): + case <-time.After(60 * time.Second): + } + } + session := &MCPSession{ OrgID: 1, OrgName: "TestOrg", @@ -171,21 +191,22 @@ func dispatchTestAgent(prov *recordingProvider) *Agent { // this replaced), turns 2 and 3 would still see turn 1's prompt. func TestDispatchSwapsSystemPromptPerTurn(t *testing.T) { prov := &recordingProvider{replies: []string{ - // Turn 1: chat - `{"response":"chat"}`, + // Turn 1: product_guidance (the old "chat" shape, renamed) + `{"response":"product_guidance"}`, "Hi! I'm Livi, how can I help you?", // Turn 2: action (no tool call in the reply - just confirms the // prompt/tools selection, not the tool-calling loop itself, which // is unchanged and already covered elsewhere) `{"response":"action"}`, "Which repository would you like me to review?", - // Turn 3: count_query - a table outside the catalog so the guard - // rejects it deterministically, without touching a database. - `{"response":"count_query"}`, + // Turn 3: analytics (the old "count_query" shape, renamed) - a table + // outside the catalog so the guard rejects it deterministically, + // without touching a database. + `{"response":"analytics"}`, `{"analytics_plan":[{"id":"r1","question":"bad","count_sql":"SELECT count(*) FROM secret_table"}]}`, "SELECT count(*) AS n FROM public.reviews", // repair attempt, also rejected }} - agent := dispatchTestAgent(prov) + agent := dispatchTestAgent(t, prov) var history []HistoryEntry @@ -300,13 +321,13 @@ func TestDispatchSwapsSystemPromptPerTurn(t *testing.T) { // UI would just render raw JSON. See looksLikeUnrecognizedJSON. func TestChatBranchRejectsFabricatedJSON(t *testing.T) { prov := &recordingProvider{replies: []string{ - `{"response":"chat"}`, + `{"response":"product_guidance"}`, // The model invents its own ad hoc chart shape instead of answering // in prose - none of parseToolCalls/parseAnalyticsPlan recognize it. `{"chart": {"title": "x"}, "learning": {"title": "y"}}`, "I don't have live data for that right now - try asking it as a data question.", }} - agent := dispatchTestAgent(prov) + agent := dispatchTestAgent(t, prov) text, _, _, _, err := agent.RunTurnWithArtifacts(context.Background(), nil, "are engineers using this daily?", "s1", "test") if err != nil { @@ -334,7 +355,7 @@ func TestCountQueryBranchRejectsTruncatedJSON(t *testing.T) { `{"analytics_plan": [{"id": "r1", "question": "q", "count_sql": "SELECT count(*) FROM reviews`, "I could not work out a full query for that - try rephrasing it.", }} - agent := dispatchTestAgent(prov) + agent := dispatchTestAgent(t, prov) text, _, _, _, err := agent.RunTurnWithArtifacts(context.Background(), nil, "what's our billing status?", "s1", "test") if err != nil { @@ -354,13 +375,20 @@ func TestDispatchClassifyFailureDegradesToChat(t *testing.T) { "Still not sure what you mean.", // classify call attempt 2 (the one corrective retry): also unparseable "Sure, I'm happy to help with that.", // the degraded chat-branch call }} - agent := dispatchTestAgent(prov) + agent := dispatchTestAgent(t, prov) text, history, _, _, err := agent.RunTurnWithArtifacts(context.Background(), nil, "hello", "s1", "test") if err != nil { t.Fatalf("expected the turn to degrade gracefully, not error: %v", err) } - if text != "Sure, I'm happy to help with that." { + // A genuine classify-call error (not just an unparseable shape) now + // surfaces an error banner ahead of the degraded reply, so the user + // knows call #0 failed instead of silently getting a plain chat answer + // - see agent.go's classifyErr handling. + wantPrefix := LLMErrorTemplates[aiconnectors.ErrCategoryUnknown].Message + "\n\n" + + "However, here is some general product guidance:\n\n---\n\n" + + "Sure, I'm happy to help with that." + if text != wantPrefix { t.Fatalf("unexpected response %q", text) } if len(prov.toolsPerCall) != 3 { diff --git a/internal/mcpagent/laws_contract_test.go b/internal/mcpagent/laws_contract_test.go index 828b5e185..ccf0c8b20 100644 --- a/internal/mcpagent/laws_contract_test.go +++ b/internal/mcpagent/laws_contract_test.go @@ -36,7 +36,7 @@ func TestLawbookCarriesMachineContracts(t *testing.T) { text string want []string }{ - {"classify", p.classify, []string{`{"response"`, "analytics", "product_guidance", "`action`", "unclassified"}}, + {"classify", p.classify, []string{`"response":`, "analytics", "product_guidance", "`action`", "unclassified"}}, {"plan", p.planTail, []string{"analytics_plan", "count_sql", "`id`"}}, {"finalize", p.finalizeTail, []string{"response_type", "data_sql", "encoding", "csv"}}, } { diff --git a/internal/provider_input/azuredevops/azuredevops_conversion_test.go b/internal/provider_input/azuredevops/azuredevops_conversion_test.go index da2ed7e4b..262f1f043 100644 --- a/internal/provider_input/azuredevops/azuredevops_conversion_test.go +++ b/internal/provider_input/azuredevops/azuredevops_conversion_test.go @@ -72,7 +72,7 @@ func TestConvertAzureDevOpsCommentEvent_RealPayload(t *testing.T) { if event.Comment == nil { t.Fatal("event.Comment is nil, want populated") } - if got, want := event.Comment.Body, "explain the issue\n"; got != want { + if got, want := event.Comment.Body, "explain the issue"; got != want { t.Errorf("Comment.Body = %q, want %q", got, want) } if got, want := event.Comment.ID, "2"; got != want { diff --git a/internal/provider_input/bitbucket/bitbucket_comment_hierarchy_test.go b/internal/provider_input/bitbucket/bitbucket_comment_hierarchy_test.go index bbe102bab..90efc6a59 100644 --- a/internal/provider_input/bitbucket/bitbucket_comment_hierarchy_test.go +++ b/internal/provider_input/bitbucket/bitbucket_comment_hierarchy_test.go @@ -40,7 +40,7 @@ func TestBitbucketCommentHierarchyFromCapture(t *testing.T) { provider := server.BitbucketProviderV2() fileStore := storagecore.NewFileOpsStore() - capturePath := filepath.Join("captures", "bitbucket", "20251014-194407", "bitbucket-webhook-pullrequest_comment_created-body-0025.json") + capturePath := filepath.Join("docs", "raw", "captures", "bitbucket", "20251014-194407", "bitbucket-webhook-pullrequest_comment_created-body-0025.json") body, err := fileStore.ReadFile(capturePath) if err != nil { t.Fatalf("failed to read capture file %s: %v", capturePath, err) diff --git a/internal/provider_output/github/output_client_test.go b/internal/provider_output/github/output_client_test.go index 7a2c381be..459d05d15 100644 --- a/internal/provider_output/github/output_client_test.go +++ b/internal/provider_output/github/output_client_test.go @@ -61,7 +61,7 @@ func TestPostCommentReply_IssueCommentUsesIssueEndpoint(t *testing.T) { require.NoError(t, client.PostCommentReply(event, "token", "hello")) require.Equal(t, "https://api.github.com/repos/owner/repo/issues/42/comments", capturedURL) - require.Equal(t, "hello", capturedBody["body"]) + require.Equal(t, "> @livereviewbot please help\n\n\nhello", capturedBody["body"]) require.NotContains(t, capturedBody, "in_reply_to") } From 132735c5dfe93c7b38863a33f95e6c131ba3e2a4 Mon Sep 17 00:00:00 2001 From: Shrijith Venkatramana Date: Thu, 29 Oct 2026 17:28:25 +0000 Subject: [PATCH 3/4] Add SSO deprovisioning feature screenshots for PR description Settings SSO tab showing the new reconciliation-check toggle (OIDC) and SCIM Provisioning section with a freshly generated, reveal-once token, captured against a running local instance. LiveReview Pre-Commit Check: skipped (iter:1, coverage:0%) --- .git-hooks-binary-allowlist | 2 ++ .../04-settings-sso-scim-baseline.png | Bin 0 -> 191444 bytes ...-settings-sso-reconciliation-scim-token.png | Bin 0 -> 209929 bytes 3 files changed, 2 insertions(+) create mode 100644 assets/screenshots/2026-10-29/04-settings-sso-scim-baseline.png create mode 100644 assets/screenshots/2026-10-29/05-settings-sso-reconciliation-scim-token.png diff --git a/.git-hooks-binary-allowlist b/.git-hooks-binary-allowlist index 4dad983f8..82b1aab9c 100644 --- a/.git-hooks-binary-allowlist +++ b/.git-hooks-binary-allowlist @@ -69,3 +69,5 @@ docs/releases/assets/v1.1.0-audit-log.png assets/screenshots/2026-10-29/01-settings-sso-oidc.png assets/screenshots/2026-10-29/02-settings-sso-saml.png assets/screenshots/2026-10-29/03-login-sso-button.png +assets/screenshots/2026-10-29/04-settings-sso-scim-baseline.png +assets/screenshots/2026-10-29/05-settings-sso-reconciliation-scim-token.png diff --git a/assets/screenshots/2026-10-29/04-settings-sso-scim-baseline.png b/assets/screenshots/2026-10-29/04-settings-sso-scim-baseline.png new file mode 100644 index 0000000000000000000000000000000000000000..c40707a8d7f458924bc889716eb2d9e24887b9a8 GIT binary patch literal 191444 zcmce;WmH>D8#Ub00xcA1(c(}jPAM)yio1s3Qi@wB!8I*Kio08J2<|SWxCM7B?!kle z=DDBydB4BkpYNNsvewBYXU#b?b7ro+uf0#Onu;tA78%x)Cr@zX<)k#8JVF13`jovu zL)B3B;Uk_rdHqCQN?g-D?O+Mr0BB2%dCWa46Apf<{^=>Y=JRI<#Lt?W0p*UvwgzWp zGfl3BXY)%x@mbz}LsL+QAgg_|@C`}&N6^N9hZXtImKkhWur6r1eJuv}z%^7}3H(nh z|0#uo8%+N_dh$&O_bKkb$AxFFSO0G{-v3Y4JB0sj@=gZ=fh^6}I9u6F4GkT~@}Puru$zxhCaHyjj+=W~aJg~jxw5G^I84F~E>N1#hysFsRm#CzB)~@ETCTK=;%{HG9uKqqELdHj=}-q? zF$<=&poPm6SV3yCF`-yRXt0W36>2(3nX);ro&MWYbmhI*L)%v}Mcty1b*E~l1beY# zP0m-`4dt}%JexOb#7h}iAev*zdKJVNz(RE zSKU1gAWh5lHZgiCmd-L%@XwX4iv5W5Tn4nXwz%?Zte0o_J|0USEWkDIw=RN|!Q8(B zARbQcCr3WzMeR}9pc8E(VnuD^%-EQBuaB=A@9xmdIBhap(u9HP-+zC$+TF>ee-Ei{ zh*!z}ROD*GK4Yo_Tw%y~JR)_FrHYppkEiWWx91T=$6r$WQp8$ZNCaEhsiEi%JsW({ z_&eN7d=pzCk{zzb2`(LL$b__R6_r2cn`4+;nr|F)VLjIkxNiLKbkfQ$1g;km$9heKUlQ(=Uojoa~?ry!Ti9$x~IxU(dJ@C zbHC*8a){EtwO^BtX_|Pj2NM&&;L5JD=B9WpO0LV*XF> zUa5|Af820n<-iGqhCiemHr3hdjy!3CX#u?qP3_UmK?#j{kglAH=eC2mJz=L7_!Lyq zXcR1L30R8kZ^pu@LwkqE$H&=ov7UR2H`0w_Z2~G2Y{tmdYNf;@@>ncicOyHiSwQr% z;#0vHO6n7%(;S~|_FRloGt=LCnA@pndBgOx~F?%3j=<_2auudbT1YWqwNFSDr zYgR|7iGxM~l8KEqwPC89#NHshm}l?5a_0WK+qB1YPw9+Q6T^)iYL7A#&Yh#n2m#cORjY&v@ zWfkexwMTnb_b7-IA-)YI45j(8e8TaAWsiY2ca_X}*?EH+=U$crz40`7W9}f-lG3UZ z)(nWH?=6c55`i{ZG(XT#4Rwrul9!i0jfcZSL&Ni)__7HKdh}|Q3b`Rvh=@gfzpfys ziaY(#u-eE`6I)gFoX15&;~f=KA(o+`{VBg-Bbfumw>=GuA}bp!hN?LUS}Ko+`aZ>Q zp^C{f`+GhB;}o#;E1NWWpr79t85uJ4M@Da2W5WPK%|zkn0W}E&1ciwFfbj-_4@MOF zg3kqDfeajs9G;d~e>(Dh(QrKUlkJgri5WWZt@@|=>bpEl)WltRX9*j@&_G$aC5yR5 zrA>h{CgLUr1_!;XH2uGNruk%KdUyo&WIS(zklzL8<_IVGK%m-SV8JdqS;8Lm+4Wh! zsce;pFxF~Ng~N1ywIEh)qB}S9IE*;;C7JP(etbIw(aH}z~@io+paO?qDF8B zqgDm+?&(rJ9=9$3&dyFlugHhX+YeYaM2)07)71qo1o|#6E~mA>etqi_Xvq}wI=l_> z%OwBtyD#>{+tWzmsw|I+qlTiM&DxBq*wv_`;6;A+JF#fh-;XcF_#=zTbzlX8)v*{$ zaW~+aw-y%8iA-6H=v=79;60C!VsaiW+pm4zT@qiD7a%p2+_bDdF2qNbKa*NZa+*js zx)1b+PM@x-Cps6o5Esm^dqniczK-r*S*e;6;go%>S4)zA+Sm1^XhgT>=SJmwpJmLe zOc9qD=P(LDSy6gxF0|gL^L~ zOU;RUwM@oqv$!->n-T43WV9R`gqP9W4CH|s_Ku7kF5ppf*BKV5&<~yLPRL@}L`GL~ z27{lsLlGB?KfLW{vgodFZl;Q_8U(O%C;55zrdojp6#DAXf)3MN`fgNXRy6@m1>P@i z;u3rLxwsmfRz!p_0Eha#wY5&z^ zF8rWIltOi;g_@e2bgU1Zo^X=D2z{-2K8<*h%#O&v&K@2uZ!RBy9(Y4uC|uZ;jHcg= z*b&}JIlfsfe2#inC1OocPpXxteN}eG%jy9S`AG4J5!YwhOhx)ia8=zm7lX}c49H&^Xh)R-ZvlG)_&rOd$R(5Tqh{pE%D=e%(s%|1%{ z-JjQY*T0tlxo>;(i`e`3cdY3b$Bf}s0oUrkMux(UcA18nz2LW65}q;F{T zjt39lxZT4Vk%>tq>aBEd7N)G^)pTiXWfILnc;hY#z1#U-cq0=ni$vVGd$}IXPZfbu zPk;r|{sBv^F6)oC87m{NTVqVl;|z zyHuV_Z*S>SUUm`FBMw`6*#$oK$cI|xMW?eHb9+EDI(m@$qeG8OAhnU$JIX;Vd(p2~ zJRrA1TdP-8qJHr0$68A_yP-rU;W*EW&H~fz4;ww7S1U{yajCO?!LbaHZq9a`KJx~9 z?f#3U$|*d{_McYLLNXYJusU4pKgrW^WXDO4B58(TOC#-(5H`711HUr438TEi$hndF#MGwT~#VNwW7=-tJcS9DsEl#pn^ z^VFmiScTM6+_9NR+P@}Qxjzzz-#^7ofZ616^KkJAx$OOH0I;&MiioVQ_o@crQLD0qJ%=i(Di-Xq>EBuyHo44jzvhiGhINPgW!I@}Y*DH|p|x+N?FWMnZyxlECth)8R;HewQTo(DeYd#Cg^BJ&E#T=*7^B0i^|d6X0@ z;1x0Ok3R`Qn`Lu6e)0gLjE2%CMAON%QP$V`KtTN^tSKWurL4)Ff=j}t%U0YqSmDQF zgLaP|PNOqONCd=Gpq3Q*1hY>=hsG0GJDCTZRM(L@t=$nzG24I%xSmVx6nw?O!7(Ms z;j`CE7xi)845=+QZqNG_#?jnFVUm@pk|`i+(b-kRZ9yqiQNDK}5Q1#aw@Bqvv7IT; z;ISqH&_=`B;Ob*eTWr~TKP`s!=zAEWC_!pbs^Doxzwg56WmMAExFNm^X-dFs&x~o~Qgat8=zlnp8PQli-3F zfsH_0E#A8Okb$^lO?#cw!E(*?ysRQ#yU87I6JN82!q?-oxuPJT z8FGBXDi8xh#M6bY+3hr!bh3T&7B3q!=hdroTuL#;V3<|EzP@f$L}cbW*CQfni0rFf z)d!3=ydq~Uvw7@-OWrCwrUx5M_&0B%ItQoAwOWN|6d*$K#9!c1f0%8Ji}QXe?=kdD z=*CI2k#4ck@rS{4iZs}p)!7Qi(!l(lLwz?>({)sM`X>-)z=yNzF+DoC2m}N`FysCV z`mWzfERMdtRzBLAM~(xRE<%r)hojg7N;{s^hBJ>hGin3}t$B71&^e+j-lGi@Jn;H1_$j83d z=;o-iG`ZZ_S;Ps_jQrD;<yY5TqK>$ zpPH{M?+f4-iPefbsk2r%nvx2ZlhxMdf`FnHYjaBi2|t48TYOJAuzSK&hv4h{V7sw) zs2IRYUl}L7u&}W878e7PXeCu8L-=vWU)c4;29NBHqz3_oyueXj)MdF_dclA3%7^yX9gNj zU7b|SH_V4ypN=j^itjcPTDI7F`$?GfG*;>K3}yqnbger%IiWX294uO_ zB>7;F{XmV{C^AKT?d~?1)0Q(|OP`K3lNr_*Wa7fo|+X zhovTc*E(0%I$(jyN88Um>*npp9v-V5e-{@G_7v}J9Lf_#yj&(GCids^+!}jBVIsQ8 z$-Q`#Hg@(C%?>LOhRp&s5N~&6#!7MGT6IR62Yb4n%l;G)1Y&3AJQ*1#r{~pj99g@+ zT&4WdLYfLz+Qa;ntAu z>vLMEn>R$H1(wpcr3ZpWW4zm5g_fF;CGdDwlI5%Gm~yifTnZs2E={echNLlO$F2J z=k&r&ySnv0iEq(oOdKXpNPRnleN9+*2B%}h4gHY1rtl8qrfFZBqprRdJlhd>;13^j z42no!x}ABs2N-3VZ#^N>u6`$YotrDA91fFV+Hnr74JQ%=IV`rYAJO^HzHdjHC{VWf zJL=c{B_JpOu>$=_zd-;RHnxQ5Ch?hKT`SW@x79n`!_!+|laYO(^0=y?y2jMcepj{duf!`S*#m`VRp^&nB3ymFpfYOk@Mu$y&U#H#TS= z)xN^&G}xoSQWAyteJuK~CT~$ualPHd$ofg^dEJ9yM3$dD zMFm8i{E_}$3XH*VDLgdsLDcu0Fqk%iOyo<~apgFX5bVow)c16NTZw}WKIz4ES0&K5 zd?o6~Y?}|@l$76>=Q`e?@(VlZ@ce-1_33*(p?P?Q=t89vM`J@Wzg>k-Z$g2p$PhW- zP+y-;^Q9YP6ERwuo}KO2JF(sDilAG!TX?v&ZFh^Ijx+6j5OUhOJKHvzuvD_1s|v_Z zNO)ZM_Usm~yE}Bey+zn(AnpVOb7m$c!XGF^+(xoXGFLaXLU_Wlf;e}HTjQlmcQ#*g z6YbbwDX=$vY`t@GlKQhzO0pN4L+EyKdMl%qUkTkBZu2lKd&PV%YTaq)#grDLv?tUQh4pryV9NIz@O5jN zek8)$ggO3s{-{ii_Dslaf4)Q-Tb`O4zU|${gDpP_M{(Jzt^EGG zuhU?1BYtAK9L)ZmpGpO|9adJ`H+>xw#@`ZfSJN!1 zx8IjZNn0F$-@di6Ri;<#eH)={+N<;i3;h)X9R~*@@~{~{HYR~%HD5bca<|5mCG zVAtVETjqjwOr964WVzKl*)WQet1nA}Q-ehS?hZZH7H=69PXp#se1mJ3Eo zr|n_fd%`9JyuD$rMN36x?d}daF*#kPUvAVS?XVJ8XR=>cF*<6S_#v-g>W+CLM^=@` z0bK8TSYB%cz` zPUGY{+fKnQHn!|899a7d0sWVuK`F_}jv9iB2_=1UgM~ZpM3a|Z`eGQEJ~wa2o0Jzm zEP1`65SnZ>Y$n&1Dy2Fn7f@Rn{g~R@>~S%GO^rxt<=_)*XVN--A0A01@&$Qxk66Ks zCLe9}a*OkdX%cfpjE+e|#8A5oa&}e+e<>=XG;9KR=^HEBYi{6V6Pgeaq38uEx1-tp z184m}Gd$cMO$C%uE(?i*%#Wl4e&(~!_YCE|H&{Q;_F?Vwtl6F9W51{#xz?RfzKQW+> z%t&kfYCq8RCJ5<3DO3nwRj(==r}v{f8XX%O8YYN0%(pZ<5_4AI>TF9V4}9hP9&-(7 z<)4v(tLsc&Ks=I;nV$=}d-mhN-o8)Zjry2%+W7{d%H+1r_|mA7W^(2$A}s&EZ!%f+ z&Qpla)(K*`s;f%K^rNnR25k=}&0fhQ;HXe9l;-9#y?!Cr@VL4>JRW=Zun;2-ZUt%x zJpG=%-=3A_+gum1!rVbCOJM%Js@i<&^@fGHwWeT)_&8ofS zyvlNeiK3E{T|GFR-(l{fY0sj+yXzD*yuZUwUPi5eAYLS`Q;9) z<7LAEXNj6R13xhE(zwh!5$z78Rw6FW7jjYB22BK{m%%7DSR_+)Z>)Ft-Z%KznJ>|H zsq6B3qBjQEAcRFkM3kPka4QToXlAb^CnL*u9PdhYs(iLxzPYtonkg2aSEAXSoNH;p zzVI+}-OTIo&SqzIY%Ky}dK0hlnd|ak4z411FjEdMXH9rTExL6V043AcPwInpMEd^@>g~OdOYh(G3vMroh_}Kz-9lD8C zq+L8ts~p(Ac=;3F`xR__m4L8#TIos~MgBLC4rh=>qln86WTH~H_?4jR7|6{abl)FZ zsPUtbnRM+*kcCfkmD84GPG&L#VfhNwe%g)Nqr35w3Hisg(iP6Q2j;sGy(+& zlc)LLOSi4POD|1*6mT{Z)5T)GQdU(IgKRXo&o9&?$jHercE*$;*wVz#2ea~y$c7Ws z2HnNOg-3d%4P2yE&SSFT?~fwHrxDWc7eQu`7VQ3kTf$dScs zcR4F-kov&Rez-Fho61*CH^&H}BY*Q|tVNm|f3>2vzSU=cd6o8=vx^INH5WU%ZpgMI zmsq`6K(Iq6m9V>WJJTc_)6ot>dDf= z&4oTL<#O}gjPZQEo1o8)fxA?$Sz2#ohN$nm`2~9UdS~aaE{7nNj=$684q))|mNGPo zU>M;tUqoPOF_b28scK{6I27<|fUW5nm7tBgG%DDAztM#NeEs}&^;Vn1$Gb&%rPX7p zQ9qLJ!wAqKSkHrrsSkO2OmoY^$QWesT(8#J7R7m93?>fnO{u@(1x?XPVsr&}k-z=9 zrkoqKvSLigSX=E>xI^!AHM(T~2^xdj%^n!DCIDGWOmS-W^<&wRlbxZ65=J+?@Bv z+k(S4gMN*MSX|v4dU4f994;tPiTQb-o}C%rw253JH_sBmQCVhs_)9dDp^5eakW*p# z;|C7J3_q{lN6YavX$SpT4lk7WS=FkRdTSmP523x73ec%GGGnOHtI zUYm2ac@`w6GtmD#hcxkQax>nWS82zc$iv+nz-^r zo+e~S@qBlo9GNmj-o<=)RT*mw)kmevP?&c(8Sta4OI}wcGGnP#q_w{s++z|;^L+rAtj~}^Dff?)qNX~r93AN`OKh5u-pEgUTJd021^KF^n9Uc z-9F>&e_VhbEc&$!xPuq`S!5G@h{_khYN`_PywX&)^NNF0--PyshZJjEOLb%WeR=U! zvrIsn?na*vOPxu3i%6X47m<&`NY*#i{vr)tmN#fu%W;J9JrU$nO|?1EmC@enLL`r0 zJUl&A)3_e4PJa0MI+$jgE-s1C^FGVTZc7NOBp~3eZNsRh>&&5FqWw)RPfC~E9vtjw zVUeHPm$)G|cOW$myo)D%6UC*Z(OFbT?>XVFGdmNKpOx9hH>#{KBqt!F5&CyZaRouR z8b!lsw>wY4Tl&N0U?;eu;zd=^?ZsiMX)l!{arbOPMtXXw^K@Zh!JGao5%*)OJAY1g zO1-OAU&$lh*qE5EMp5gFurRq*(~UxtagmFQ3jzXy6-wQmKQ8Jn>YtBH?=jpJrBRW&KRPdepAeI<@B zbAEcs@DvvaByjvjC;GuCCNs{lrEp#%hm@3*-^OlgzWe&}Vjsoqfma%~)(_`eEz3Lo z{DSa~LX9O&P3HP)p-`V^k{TiU-Hgoi#mZ~83-w2F=XlVQi zPz9SuJqfxhroRr}U;p?vyIEP;g%>1Aks(?vxBia3q7uJ z{`P16dXTS_B43$IT6C8*`RVuHXT;@sZINsm3F*n^=B8(>N9ho!)rl`V^Q`JFTP=)|G)^t$jTTN{&iE*1_x#!){D6no3?999au zKL$};PqCImorRkbVRz|Nm^k@_^hJ~41Se%5im=zTkMgcm~o7=Qz->l$m zY;JjY+&Cka!~NlM$z2J<+4VwwgA?0B$zTTuTe~l8;GOhyb**6d=h%Tk12*Q)&1C-q11S&a<0|eozrh~ajd+*BMI|mLvUe0}q#jLo zvoB-W$w^lJL^t;=%#=r08H_LWcixnh!=i=L67*m?Do3otp~rDf?e2r*l;Udn06IFmigs-||{?l_Z~OgdBNco#x?l z1*7$~gqkz`+)ChJtIW8*?l!)?JQVR9`l;OR@ZLOcbx#z$EH`(&K|9ov_wJ@Z&b_z;ul#S>Cnu!Rx+NF@?V9ouSA(>R)3@$5}aT=cOie>;!)fj z(-u~OO!05ua=Uiz0xjEn*Kcae7Wo9a??q7heFu`iaM$Ff0cBy~-0I#%U#Kd_&AlCQ|_I7rgE)Q2`=K~j`#k}^8 z9#+Mv+F{{gF)Nwwe1H#iT}##H6Y@mqxp7QqcP;wJ5&Dj?TH69t`ee}Ox)_Dpdj5yn z0y#zByt_X>uNgXU^y-a|c zIxAxV296TutDWt=`D%Awn_%eY;|WVqA5XW#*)03B=~hvH{}@w#^Uj|`Y#(BO(@=VN z+;#j?MG;hRYGaEcCNT)ooBF(He9oxJHON~|*Ymb6!pqIR(6VqPFP8h|S2-C0w-Y_R z`I!=N4G4Q~&`@?qa&G()$8R$A`c*|EZ8ffm=IhA&{{A9LKn))s%yMZqyH&9my8tOz zx3B0!4HsVYLLSaQS65Nga$HlfraFj{&-0ZS2SS?H7+-ZQlHOHDlpagi^oFqh`#mm| zsLYW-u#O4vhcICSyq^ z?f1bgYQdKUi?cgiwMSB*$1~?*`Fo4L-xy%EPNYnEqiv9#ZJwKBub15t?LAeZEi5l{ z*IPBgCHGCTkLdWU?;X>VWV^$Z=p7k%tDSXBWTvop-?~NPrJL!;WRzY8e`yucn9E2? zNJ=FmQ*CddI@LG&S5oe2QN!{tWdd6cRR;|@#i~U!&Rk(xE>xE4WU&z&g;}WhJwx*I z1Jg_G^PIp|V20iQaN}RDlSz{~IV;Ih$Z~fy7L9?xSVFX3!q)pT>j?%FbLoCNZG1;= z2Og`)7G$KSPf3OPEa{o<>oN7RCT_@tAGjpqQZ_pyXs;V;5PgN}PCNLByJvD+Uk_%Z za{+r!&awH^At51~5!V~RvijS6;pF-$$y4oKNTazo*`{A8^y--0^s2<Cdi3TVtb_FBI@XR3$(!r!uV3$|qLH2v zv+u6+eUjHr_P%Mtp)r<+BcDE)`FquawK$u^QGmhjQGjQ@{N&H~QpgoCuXvmao$pjJ~i1Q&-cyoN6xBP{if)KLSRm5w{ zclU5Ry~UnV1o|toHZ>02*^pM8iCyjf<|`rxhK^NTY%rRlBn10f9NFAEs6AI%QIUFM zIyLN56J~f4gBN)C(0(Ly5#aq*4Dw4}2BpLt`W33M-X&=Hh!kHN6P4}dFs_!qo2y#y zaB>))1u9z78vMf7NyiFNf8bpG&pxwonX)s63W&nqcQ}@;n}OLZ1nY?fuK?_v+ModaHErDFo#rbL!OH*qazf5k_O#0Ha`q{cWiwku^V>f&KKNfZfS{h zJ!DS)(|U_16G5et|9)x1Rj#(sKJg7*psv1tu&7n ziRSfbfNmvh`Um!)rZk?5n8kP%M>@03yS_HrL1#WjR*+`yul$^{GGhZVSr3ov*@jsK5;F@6KJa2v@l4sm9G?sMD8fiRXP?9PMg|&T)MWR! zO$566@~YYrE~l(~ar}Cz85O*qA8sog?KbKP#~eD0wdfk4EBCIncoZ8$XNrJ~lp>xn z8xl*4ZQ5hW{&f+q<)S`$ifJf0v4o@~KEdoHe}nH~&)R!zcxJQn?)VgH8!XkY-@7`Q zpceD3s<4`Em8}OdJ`m4HxVa&dc)jL3rO!}j4ibNRU7(u2)O6^k@!IX|GX1LIIb%V> zMny~#I!F_OkD^8@O>eoOnFUhP<=^R3a|;Sst@})W`w2!;HIndh7Jso{Dzre9lxk|p zXVh0 zQOoYp-HTovxo>uZRN4L|dcvim@lM=%pH$fE=oOK9o^0d*^I@E$r*L80zb);;5Rem&Q?;B=#Y$(B0sCkUTR= zt}f*UtU@iOpunqFXCva#Gt|=3GC4{3C!4rI&aE#9Z(2F^5=F-^-hIuJd-yuMw~0iE zjr0@O<|?kyNe1C!-Mo&AO_i)lK|B+?t8)JPyFCI0Xmj#mGF4slWhYz1&9Fxy<3`AE ztwVV{Yhs3om(gM$Q}9u|Pe~OE*93Q0EuVtU%|OlnxBy3}+KqZ>2+Xj8U=3{8CfDzL z3)?Vityt`y`c@l0RcGHG`)snK}m16ml?;HM&)0F zaLH>NB^`ln8$nm_GU%O)6&|xS_Wk*VeBu2qu4*dZ?qpGpkkI^EePL9F&&}n))=Af} z-}&K8P%gY`X$7Pr?%{|@*-d;XrH=KxIhS&Me7)=9&^b;vogZvY@37l5-kw72Lcdwm zy2D!;7FYrX=q$A8TIZ>EKTPKQd~wt8d8u37mRsfu9!0YYf4L); zB{8Z6!qQ@6xm_2TVonI$s70L(Zn9277Tb|gW}nN9TBCa8ouF$f5P+t-!RNWEsk5!& z#miocv1YsZE8Ij1)_6L^7 zMtUwu(%xb%D{EUot+k>k!su3{1seIB>+)!EEIZFsbw)HG03C@~eA7M}=P%xTdGOwM zCI&G`;#m7;HOet2MC8I<)ONZ?o5MK%*1`ZKLzqJ950?pwr4A;RH(l;ZU;bH_J>nV} zg#az`WW~u|veY6fuK&`h)8zvh;q)hd0ioNaM$LZsB17>t*6VzGfC?M7fy>@5hF3ca zl8V6ffpD)i3n^Y+-ay=)^rSd^!*gGQlUrkR?8u+X71waSQc4QS19=_V_W=aNZ(L5s zOJglVsP~dvtz6XPW=F++*oMd}G~>hqWbT|cr^6Szaqt~he5{sW0edzuT=s*QP(8DA zyjN}R*TkeNvwczCuMnDu_k_zF#_*JO$nUiNEu4L9|IPr#na5h$$&A9QtfcMbHu??m zg!fc}r%pp0gM4Z$1dV(~*V|u4Z;`IU`fo|et!?+aq4cSEJa8fLmPyZND+pklS&5c9%OpO4!WXTLOjWuXnRx zXZuPaHzXs*TrTrc_+vmIkggw5&%u#>gBYEfCQigdDfh{ar^fn(WCC9sa&LE{3DzQxfA&2E z8&kWzBdI~@JmvN9;)%)0Nyvy9m|JKo>zIKS3V{lG^}}$IqZMeBcWwbCFQg^c>#Blt z(-o@S->I69RjP2AV=V~N3pIl1yhaKzs-NV9HiWfh96c^KdP?f(jh|)g0@js>>YYKO27ylugDT;%8 z^9k!?^TnR>KnH(`p>&QF>vUOY@Wb8e2<2(&Sl38I-2QTd_jN!d33{!~Y~k4Duztyv zxwNiKP_hbTmSVoNruc{rUy=QkgtJ*UJ9oPQclC_2F2R0>fb(5tex1BW770sZQkE7M` zpbx6hi@U&{#7nyV_=%CCAc1l9`lt#yI|IK4ud^m|)Otm`FkWNMFAsOfvizLXRTgk9 z*MLK&$g)0j~HlA?n zth$jDOZ^CAiJy6ouV48=&BovV8)ko|_s~M*ScyXcnBH@g6{YeQ5&F2eo=a1ohLs%B z#K#uPcYvvQTE*2r#Qbdl6^JQu@qM5K#6&izDmm8(1W5`hDebGKh)OPIhRMj}|Ee?3 z4fR#=Y`DCBOQ?DDVp>@$lC_{9>!e^HdbN9-iBMcq($4ujy8V*hX0oBVnDylsAps!| zku&$BBbAW#d6$EO#kN*IKM4c7p+5jO)cwob3Ov?~k4tUd9SXUw5!G@sxAhD>q+~oO zbJ*S?gMWq`iJ56EOtY`A&22n9z{Pw~Iu|S$DKI>RGLY!iTh7(tw|Bn70of!6WzlZzVXQAEIvul$# z>V#^VLAZwr?8bLjsPtdG?P*|Qrnr{4cgS(t6y#>%&`ks??GcrwGH#7C#@aG#L8KseXEq;7$Dv1i87dw_4@|}1m+j~-DG`k6WWy+#aO-38P+Z(bFY@TRy|`zeR(!szXaa@yF3Nb$*L&B4@HAG$ z4ONrz_qEtl08VJ~X#gaJVZAj8s5f1xs@g45^9?nCo0;#&P;FYM;Y_nzr1b=2bqHDa2Bh)!k^-g9djq1&$06(Sc}O$P(cb!9 zADfuS&&3-a!KSWhI~P8CV>w=yxZF!9~A2S4pl{l`XBboW+P1vm2E{xA$pGdeA;1z0?t-W;sg z2|ZuUKolnipudQN68vK$nw<1O*@z+s_;4x03CLqv0#+k8y_Q#WybhmaqiD&X#Oh`;q3Iia^47)j?rVR!_`DP}O z(F}Lqbhe`C@hC~to)rWOWkOVDP*km7hlQ;c_qSmd?oHV9Dz>U;(jza>jBNNgN@*g2 z-7{{_o;;BQqBQnQY_E?`s6Kpa+Pg&;SY1&DDuznQb8&MsT|w2fXMXkf$Cq;2OStWo zG^O2$Qkg#xCq72_4fL^AI5QWLLCBMhKLIsATlBV$*>H-B_r~1L#j=z@jzJM7v)1f` zHHING)I8!0{M@zQG6REvPoDg;KqW%4PfzI3)PjmCG}Rej*wFAZ_KwcJ9rnF%pXBCL z`5DT-kZWZjp2nrDmzs*4mv`k~h|7owreQhDE4`nJ!`h>}lRnDE}`)akiOIsrwo zs$*HxHTr)g%SYOyUk6y1Uyk~>yi(B+75l*=RY{KWwRJ!V(J0hRC9*y#>ZgXDpZ!63 zqw*aE(8RB=8w7sqKl218c-vc4#y+Q|YB?mtseLGZ{xrgdWr(CzBY-0+M;(%!3GopA z6VcAHGf#+hcBT7rb8;)nvM{M>r#7W@$=hK5b|1Y`71Bt$sHF0pCYGfy=Ra<`)po2g zoI=jF!aNVMFBD=)Z6+dM3*t!a6VU=98EkK5Qk4*h4a#ab6xj?nOjVt_LnnFUwfd1G zW95u88ny@n4HZ>&mb*FOQOAZS#a;o(y5`UfJ@xU;YPtD3Muo{iaq>3dv3wfNA z%t*-mEk6R^COMuclA!&sUsess!bXJh>(#_*wta)chyQqi+Auw0_JL+xyI6WnLh^R5 zptTsRI2*6{fQzKzLI(mko_o(ihOD`|n)!>blWHck$`NG}Ijlt$Jn@=SA)ZX5C_yu5 ze{4z#8~g06dd)xC(eIo|FhrF|V{S3b4(yrrvEWl*PL}VR|J?tRNemQiBrW|O<^3`= z%J7?K7$S*TRR@Dr$bx`%OW{~V<9f`hl^O@qQAI~`DQk!y>HfmoiM9+W{> z`RW>UsqX4a^N&IIkSTY=>NJE$5JS4tlc%XrH7n|lmF+d**7o=@?7!~OZ;w=pGWGci z&;B0+@lmbX!?XVwi2t=_e?!Rqzcw>J{pX^dJaNgO_}3!+M6H*$SIl8lMS^s`}vd7f~*3&UD zq1|P&CUaa;oS@{c;sq>$5 z<(TV7P*Z+y6;r-;gdZL@o|{h?Bs?&J>-ayT`_-})(M2Mby)oT9qa~nPAcG*3kB`JTLiP0eURf7vcXlarcqFJ;fq7x-_eEN@E11jnDG2 z5K7{i@rhF;H9nyh!N#&QcB$C7I@IcY%LLK&dSyraSbj7E9y}JXU>0La0eR9_Oo?yW4-> z9)K!$PZoE${>KFc}2_50sR zV!<}*?H^SOS!|;GE~)Pdd-8}jNW8&d1@Y(*KcY1RWZW1g$~kEc*-D?!$XMw}Gs>$} z)~ge`SESpAh2Kr&6xXHf3oYyB`3*;N@6DKB5)u%D40$t-3v#RuKYHc;2*3vc;$AIj zUGACcy6HhRxJfVd6U!_hywq758o?EMUbp19;a?`0%VKY>?~bdJz&v(6S@xyjNt4K& zIoH|coIiS2>ZqnV6N?!+cDv}9id^nJ?Pa{9G^lj8X$q4a^jG|7F}#NQP9rylG-BL3K=>e^Jj z)dbtvOzz_$k1Du*ty;MRbG{oc)<~#O1iv{UV9cti1*Br!uV&?fm+ z>H^bd!|gg89i$U7>94uOpcDcb*)irR?TNV^O+&KQo?ozA$PR}n#{ic{B_k4`;;%=2}awAm{H zJz==|6|K;_(7|Joih@0i<$hINvP>e+;kPz;lmd@;av9)msun*ln&jc!mQ#5#23n!w z5;26%%er;C+)1=7AaO*9mvlL7=-7sQQseVsk|@cc6pA3NT+0Tn;}&yNO0ZS0fbZRY z%f^XKu+(d&ZL{DgzEqvisiEJhn9;=L4n=;yE6m(xwgA1n?_Gt2F?4P)CctaVqDpEK zMOw~*rKaP4`V8R_CpvzfA>{}yWNjQK6eg57{a&BtH09v)`HyS*!QE;+W-nP7_cmvC z^Xctf``_8Yv-gV-)z@u|?{F3?0y>2v|> zic2O_AZ)pw{IywJwUX+rgmh6n#41km;`5hu?Y4$z%~s)PJ$r;K7jxuuva(eh?}50S z=t0q?++gO#O%PWjj8s2Np)F`kxX+39eNtSO*N+)pIh%;!I62a^G>t~l>yiBH{7J4l z2-BtohnY)}B{hecheY*S=wiRrxNt9ezaYhVe=hkgNQ{@%@YgS*8!S}SBlgC{cVU41 z;zDTRvDaC*>E^A9Cr6omX2+1^Me~zktJen|4uZ}G7l4+}-h#!TO28zcU-K+!d~Y6u z8|li|(&|z&3hv3{hf+Uqpp!H-y)F(72yorMl*psLgdn3(>$Di}7HkwhtCLvwqmL+Y zz|>{EF3;-P%(N>1OnH%a202n+PJayMuz)aS5MX*8*|a6leuv@gMi6d)Eerk7ZPpkv zFvI9K@bzeEQW?*8w{4*ed@&LprVts1i>|`Ke$3t!nou4W16Xm}y_k5B9#gt1FgnKt z=$x7!Q#4aN$oI;7-BBS~Hg0q7ZA~ALXOY>V43I&0_qtH_4lc7GAx^nEurtX|%)r6& z-go|MVG;+v*mEI7RV|&& zU5KCyozjQZ&?e7CX5?QQ0o^KOwqM?oMw5kDm}^ z!AciK>e2sjoF`Dps@M2IKZ7SDUZ=@9A#cI^M@8RliZijH#B@eF==Sk;(2J$gk&f48 zU%c5fMTg@jD=q!t)8^{B628F%Wv7iI4R@tYjiQ!BN)~OOyYKDhAUIodsW?X>QKA0u z=IcbhPCxIq7N0DM?Bc>BUj%(MS-K(Gp_fht?VwPRxT2QtDEfVxpYO$WK|UY4nlTXG#=9VZ^(iw5 z&#|oR1)bCpg_Ra=uS|Er)D?iS03rgH@-K6(*zSQnbiL^UVQLJ*-_`kEi4|z- zpyI()tBNysXoLN~=gfo>?ry3pDONpJ)F#jytggkn1@Ftyj5wi>cx~ouav$=~!j&^X z0K7xrd4<#$s*EMb5wXR{VpCs7R2wdbfh!Tp6CUhaT6x`PoEKH9YS%Dsw~W>U7QQKb zYPsG=wtQeDf$;4E;un>+l4?NKa^3Oeyx!xp-9+#x#_zE z%sRi`c?J-HZR2Pve7apVl&xL_g**I+W{l&$7zE-D$Ch*8#yM7 zlmhUs5Z1NLGFuZagF^tr@vRxT!~7EtY)m;h9E#zq%V%=`n!6Z4;Rrr5A}Qk!o^2t- zN%Kpf-Q)ELwr(`jmX(KBs%%Fuh4rS)KO1actn|bWfk2I;FT9*ox!-M*aSw?9^$dnOWrT7Are-x?RRZw}X)*ice~z zpZGR$6;-!?v|85k8ZYqeeVFt2e~EJ19AXr*tI}(-e7zY@D+)GRvR>er`bfy)X`+Z? z8fZsx8|lDC<#u~Ns=pvleFfV1S@@%5aV8AB#!}3?wawugn>89I=pTyJoaJ;}ADE(J zt(aO?+Z(m$k@O`84;d2}VU>d43F8{mP{$}+CgQ&s8Gaa261UFziaxozuj$3&!=*H~F zEy8pV4xtLQZ#H$RoHT{MO+D=)N`#1_DjIl2+VZgYBAwH1Q@yXDGmpH*Eg~r_crncf zHXri3QmKll&F9D3;z5TaiB8Ps^k|WB8k|#~h&+UbSyB}GwVattt-9GNH91R#j+crG zpon5U9eEHuwH7h;fU-%FO>|pGbu@oXC*IgT&cvdfijizj)Qfo@f(YktKB|+<4qNs%XUr5y?ApCftnxA&rpg`=VCO=Vit#>OG8QhSDNC-r-B!%G>^f~CvbO)#)e?XV$U z#Fwm~8QP0kK!_5!6Ea#xvTKol%El-rSx%4yQj~Jbb{r(Kgq@C+S9Hye+K%ak?`;5%yGoe+ioI_)5QW-;hJ}8nG0(;5zK> z$e=o0&>EyXw%>Y519_Kp+Y`|=?qS*h36<{q9*t=CPMfyvjj&8Fzf*gswp1LDD>0J0 zGrx!fWH&zzOPGs+cgc(%5jdA!Itd?YVMS-+vD*L8H!)AVg&ArspgK><);;bVE1b!N zRP932jv4f2keN1z8!`RN2U0k9xa!29UFV2&OMfWBM&@|dyYjJSx2P*Z0HgCD0bGCx+J4aNaX=hT(-H{oH1D_|qb9VAghSSyYd(_6L@*|T`p{D=| z)=kUuRgL586RZnubju~TUwl%OyBx_T=&DIyOryR`avkz_1b7}*Z=(WDXR7S|Obsd3 z-3vGhBDYk*qso)oLeXKqG=*^dJHY{f6t_UXLYL{vLupRQZi*v3_J%(5& z6YJEws1MUt5~!)JX-Vw%%2}ZJsFVN+(I2)Fj3>>9>}8N?m;@eD%_p56|6Xz&+fI0o z4|xrx+85*NbFcy0(XWJlJvx&QHa(ft768^MxLX>_PrcWN4~=V&gf>~E73rhw7!o<6 z_@Ax>SfU`6`x{h&6TmcI5*1I=0RurLl-#*{7ZCyp;U%GAny)$>tdq2=DLI z#`qj2LI(UZH0s?}0}YRXX&r8jDm8(gRaxFO3c@F>N|}bXqNk$VJnS>|oF}bMcU92> z6I=kAXgr{+MXLtRKmL^PtNu}jGWLPt(Lxj#Gd@lXH-?(>H~?^v@2sv1uN##sCglz1 zdg4}?C8^4IQ1SiTUky(p&7==Vdu6%Na7Y$@ zb?P`{%GBDcdEe#FRb4?T2)lLp`EHn+H~+S?Zz(o0iLH-mLLiet#CN2SiUv6X?glT5 zUpJg`cyQg)bb^Zv)eE=9c6V4hFLE% z0!xlV>l|F<|CN2?yE8aO+!PW-HL%a6m@_eTpk0((*Xr{*CN_P*!);w9tfnBSrYSfw zh>Gdx=w_^pk}MXZdpKbrGJ%Kn&zzF47NeKQ>xy?&a{JHuvRo)~M;C4u%c}|*5+jIzwvgcY1BHUTr}A02 zOuG^oQ-tF$A;IICn4`3rzEN9V9<-8^ssB6lXYV*|Lvk{BX9pM3Ynt;>hKj6!Qt7)i zEy=d4yQD6Z?+5sQSb%Hla^5Gj1VW+%+#$L5k!K&76>T$r&~&QIvB0Ishh(C|Jv@b( zXTB+@NZrn+#0{hF9YmHZ$wlOjkdLopCYV z#bc}&o0icm;>zBML+aJ15^*~Y-a!nNdNQ}ATi~;Sx%HNsQ|5oNZVF7qS#uf%ilQOb zn|zi|hP4;++0L2flOTe;XDg=e^LcM;M?CUQ!;To=u#(!PU-^-a$X#BwdOv2jO?LdD z@=%o!FwgBtD^?YOE9l?g;REisrUPj##Sd+(@W%H=801fKCju=@@sj1`ReG71!F~t`ivt z1HU!rK-)kM`St^7-=D02ZuD9I3=hEYX&CBWV_+u`7Dz)sAIUd8dcoteJ>Pq7K(5RcIwDj`@TMfi2j7q>*CB}o6J%(UZ?>S z8g6Kv;DL+u>~Q-cbf7F$a7N5<$GkN~q<~a`-4E1apf?_g$*Ere49t;v6_uTin|hOd zx3q=hXZO5o5{n;rSOxSut*8oFWJa*Z<0s>HR9*W&ymfTuL}sFiWw2Y9NCFPf{j^}1 zkYe@m{a!j*hk~5V9n!;w=mmNBa`S?!rQAPs*1cq3)QjI{@w8<-+^>rhkz?yT#v}xM8)}>(sDX6k ztL)aBa%l<}HncuXP%|w=Ivr+-=OQ8L3u0q{@E%V5^^ci}fl($~l)k=>1IJ>NVgTP{ z=yiB1I2l~%e_A(;+IrOWMXVv_(CGmXmGaOvJR&`3Y0vDj>>aD-2*lagKIxwNLHlw} z;|z5&iBa66lAeHnMmC9OuB-ljeG95)$jq0Xp(&qH>^VUh7R<{Z*L5ho$ zwGET+$)92cT7dpz6t?K%rJry|%@s6IT!}Y!)CZ~?&hqd(gi?x@0SLtCBi%I-8SKaY zr4nR7&Ga)Ln~I6Ec{(tKhjSdJ#$csFb5}{8efwLP6sx%>VztrRNTX-hTnf)h>5)nOiV~(){jgTa7}FcQwXz^ zg(!b%%`>Qt>o>tNn6ofJI9{(U-4mt%W`ilKOHC+$HtB|hY6x-jvZ~PfwubuOtk9L} z9Yo4jgOdnJH9d{J>&6F5;P&r_m#T>bu-7_L4_W2u2(1XBC1<^EaIXH3LkViM50 z<=D}J#~Aas9B+`cDKxpdK#Hbq`)t#UGWCnFNOAP;`bb9@nzQr#q!6vTQhDkv>=E!BG?HF2T;An&;5^_EyGsxKRR#AOYc|<|F z|1-LrjGSclL6s_&)<9v^fn*eq2w7iP|4=3FviDd^;+dpfKh`9tYC*)wBs}gTbNzHT zCcTx_SETp5P2kP<&stA!WCdNi!FPrCRV+o{F~=-WsLUc=-(fw+$S^|ZIM}N@Dg<*| z9cTMlIqqDCRqdAsW8k_n8XJkJcCws{??ng;Z=19{lQ7fBwgqw#w8^vz132R;DfDbU z6;y7+_XqH*p$M6fjDyJHGBJ5=kn3xPBO=YOb>!s`GI{F}k*3JUlV4sJu^UBaTT;y&zA1)AW7az~)F; z7Tw$@s z!{@_?&IwVgG7c&@b-U_W&SfCr=Q`xB6T4Cz5qpBi-QCK><$s}4oTrLIEm4I_pGO`4^p}|J=MM~KBRkHp8u?08}RE<08zjGl_dRYZboU|7x z5Pz<4DXLSki`jEEOG``2%;%Vc;&RS47@Sj(J3@K-S-Rh~>-Q3}Aq`h5I?B4@aIj6X z81RjI*i1OfO0H@55`VL|jAVC-U&1>S=_`u5Cf($k7LxF=n1jC`w)($v0?@pq&FKI7 zy1B15cFIom2zm`Av;Ay(TEc89J})!Z!O^|DwnZI$Ml-)f(#E>KkWorkk^iU}a0UBN z!kF8dND`>7pM79(7Zag^wx|n?hy3;3(&FPO&zQ zLN0Tw!V8Lv6`fhyM~7Bm1ll{a%5(uH~{TA@Z~}go%D}f=!WI zEs@3EH^I@LQXziams>S3$1jD%26*VmC*9 zQblU6Ahr-kE!0Y0?b9V!aEV^4fd~>cmHDa#EMiR{s&C!&S9)(Bw>8vWIxlG+`9a$% zUzwBauQv`xk%^Fz>&FFTddk+KeES`qoS^J-UC)he&0v3Hb~VSKpPW@TrD?=F86ce! zkB<{eO?_Oys_jb+&SS9kV41Ns$Z66~pKz$YTFi(y?)c*d%fD6|k4>S^EGj6A9~cS3 zz2OU=s<7lIyqU$7%0;lu1?avM5z&cDVUc{o0)g$OOB#`{F3er!gNh&)#pcCKGz1xG zp!Bp1hCZOigvA%nuHOU0eX^_X9D|U4U_c`Ka|w4XW2%+MYYuG+b*emfNy))@)Qes_ zg%KtR6yQ!oX z+e#g@dskoTR7scUAGQYUCpNz_;2DWgGlB%XS*A1;`KV*etK<_ zj^*cCuyCKT>%=$pe+Eui7#W&=QJ8AL2vzyCjtR7$tEz04hT-&Ca*VMnVnTz{O*oU2 zzgpMO>d!XL5S6(4lw63iD^?sXw6F>vXel}vf74Dp%!?>v<0@Hp2`hSyeL+qu(}w2t zxn!yVT1^cw(wx0?9FLKsi;g~FkAyjXvx>ok!~B_I7{f;3uAD3vxL6Ndx1Zv zrK=WMIx_?=|DK=`PZ^}q;vcW})N&yPRD)P`nt9R>Sq-c7&-QmD>9X8tl^gb3>b}g# zNI4&%`EAMXo0?z-dsHbeE2~y|KH0xmd28t4?wx2n#M-z{6VrxcjjfmBt7nvkzdWb(K`a>m08RLazVFU2eOnYoMF)qc3WUO^z^`UIoPz za8x>-BT|JymjTaCAZlFD3U3*|kdu>*mjXHAWMpOK>F;f^aqpO7EyD{M>%lt?*tj&| z2a3l#R-68Pr9X4Y+sHn?w;L;9!AAM;@pL-g@eO1w`ptMl@`vt7hcb^U3D`M$sqA30zWqN zAgNm{JvJ+ag$+k;=TuTch?DPeDD+t^BKhUq)#&w9%9!`nmRbC7TpYlNQl8ZhJVIAj zLMWmy@imYOXOp?2{(VLVi3yG(2*w@7b{Bb2VU&tNSLEjfTcD}0dc_Z7FS4+0#cu zh8&mwD#1G{YRdQPn5o5pO~new%tBJ5Dr~kw6&I8Muqc4Q>+YLqSlRD0ul1!ev8SNY zuz{QY&%50UO(s2yvpQoQIqOYnR?@2S1pG|bdxL$d!BX3<0Gu$VKcJW98Ay4F+K%5n z6;Wnd4)0$M5xE`!vRm50^R%18^sE{5r)~1QPLO?#Ix-Vtij3ac44A2w7yaPXTnnH+ zc@ODeCO1$8{^f~5f#_~@cP4#cy9YvJhQk>|DeLFO-*2Z|D<l|k@=*-;T7sUGsM~8 zP}BGut)+JzlRJdwYRFNJdi?T2`zjU|s-<@Fpciue>ijaJiS%wkxt>7zRDW{?t#gub z+inyp$Hd%TY5`tQ2X&EywCPHpT{ygtK9{;{YnoAB%Ate#5W#7{wcFJRhI%--xxz0$ z17pU{087mZRzgQ(7F2dWR)kYn1TmX2=#NH5WNrtM4|s+DtT_qwP+~uP*!~0e#;Ns$ zr>lT0iR3Z(dG+qy-)$rGpj8)x8U_aGm}TY*g)+5VHoITF_U`?r^OdwxyLQUhQ?iAW zsYbYx16&t2_m3G_9+Ta#pvwZ`SJA&8T({}1<_{ctNpYIRHc#i&zDr3#2SDbc{SzxP z-{0$1YK`VDFoyl;;9Z>=J@QHrIemRq0u~=8`E`;g6h0tp(tAV1M=1GBUTBNXQe&!Z z_#YM!mzZXlrE!!QFhq1z-djPIuo zssOi5bZDqA;%GyU5u861seap% z14bR7c^T#2^dr~XAS3-(slB=t9y#%g%{cZWn5ib958xN3e{(wVlLK!&H$!^`mhB*1 zhasr9Y_vnmnep15+$rB4;dC@R|82&CduHxrZav(0stBx#OFPG$DyXx+RN>-pX%X{$ zLV3}GD_pzf>8o_cW_A9^y}`aq$0Vzx>nGtKUvc`yGnayF>E)Ln8tl$i*-5{I$sP<6 z-$UsPjb`VFCu{F!4mEjEjXA^8(wXBYET`*&v=xmq_0NP z8oX|4|AR$}8jp^hB$_qYXBRwi$*W|Gr)N$2>E|-ps6Ni}670T+nb?Ip%qv#Mo44TJ zS0MaKodPbg)wb`4_-lHw_AU-M29ze1MbP*!=d_k%iW?dYKkD+Ub4d2PX7SAR<83d0 z5Dxzb@{G`?R}ciHs2RvG@kQQ32RNq2WrtKZO;qaM7s&EP=Re=`PrIiSs^Mh$gq1Ir zr~D)cx~Sf?tP*FTpv`~9`(GBxiuu$mzb>n=aDBa{&^mup){%L_Xbw$nK9qJy!Z~}- zYIpeWzkR(}mI&mAf#&HAnIkvq>xYVU#bE{>kF6!AFmH%}ftpgAGNoS-W03f$h#Idu zrw!-IXY7BU%zyoXF3h+Xlsh~yt^5z7LeKUOTc-3IouCe=Q$=pms`t??g}C53q2s?p zWsZmt{{Lku!HnZ0|L-yu4H4<>-zSRy`@CZ9>i-6R@qeVM#s7gq8voxKGRhBA4akH( zK1bR`dU+^S^Wk4E+%sA7Wm*8e@|fK&mq)uMFcC+5Z|_4`j)I+;xS6_BTO>%_DaeP&3wer15~b>fpc2*@ie@yES`)1)PP!2Ax+K}2*2Y9w&q%-J z!BS;fgi~LRfA*7^L;Yzndw~)D$d*;Q*vD%uUQ=Dm0fTAami)34 zmsXaA(^O1BA4r!Q_q9C#C1}2QQT>9GhdwVqvyk~F4yar+7as9-d7aQ_P&Uts-}M4i z(ws|y8|EoqvoTRK*w;uD;`%Z+k;;?4a6c(dLFKO0u9<-9#C|R*eb`EzuQsgwOOao_hiW?jeRzkc1}x1j~6pt%4o#_hIUoZuSNXQYp8mlZWP# zV%(Hi#689MW;An*7$vh+7uL?}41#%~>#382AZX$GEGQTJ4+Z$2_Mc2#=JkigN@z%l z3+>2V5%(dRG53vPy_5rtHP#0M54ZGmRG}cLss7qk{X>`tI1tq6H~maw5f9Kie7Vts>+XR`&pn77ntD@AC%9CLapA(~*V%l_U5~&5(m3jFW40?To2C>XD zERCc6HdGxnQ3Gct!16hEwup;5Oz5u(14H+iJYCA`K3%V7Z#PHpF&*G~r@2k%&7{{Z zOTLwB0%Pydp$sOUQia9FVy)~xQZ|T_1xC=cUVwhFs&X8zTXZ{_2jlz9ku#`p(#I4R zmL^!67u5Fr(NE$rT3iRq@pz3s%_c1CT?~vQ6nwF?=HxzuRrmUeF(sIIOGZ9^TJbnO za`@jK>Gh1=NwY1bl1z2`jjbUK2J?dG6NyW=cx;AE^}<9^MW;xyoNX4geSH3k%$QCj zq*zlLU{AG-d@uJmRv`{TKNYSq6M-M9M2m#uN|DpW;&(=b&8W-C>BUMZc_Rrj=;-xd zd$iy(OU`fgeMAUsk!jVw4#sBUSc4T%q+G!hn)v@^Lchqw$%=(p4alHgw0QlzVDXu+ zhSd_Yp2qm~%ovI@EpVwqx9+hDVRqt7{ey9(vavE#IKJo2*m_=1o(EErMspx~t^>Y{ ztHH)aM!);Ze@<`z(C1$~r?C4!XM$>(67~(rpw(4uOU~$fiThgGi75Hgk;Em%Q(2y| zUtMh3y;gWTUGSE}kzJWhG6q~17hKqqp8P7|*7PIRq?|JrL(j%C)O9()@{$kP?%U{JMFk z7ThQE;k|64w~7Vt^ziB6I?o3jW_CD%I$uac((i>l*AXJ#@$!9WEuiIGZIV?@0{g#Q z<$Ry~b|tD0p5n}%iS;NtpC0Cgzfuda1}aY$nJ-KZOp7+)N5v}~tAwR%uKGE)?t@k* z)$W_Zz*7OOXnV)JKGP2g_L^4d0X4aSJ~Qcd6pIa-)Wo}6w@RrGqr*eeL)kXr>jbEJ zc_=>d&MGEOC%j z-qNUqd_WEs651zbIU4%d*l4Z5(wiXPE$6s17p-eATya1tWxy|%Ky7r^;9IcrbKZJ& zQ~#rwUOk!h+o;)#U%92aVR9k|`?B4r^?t|y7mS^ms% zoMy1+#L~y)%S6G*08f!#efg;7V5a<^f8glplqMqoC3;VC34oQ6>glBL6C&bve5}^a z)1q62reilf+`GF3(?i+v2Kr=gw6n%v6=bzT{F}dNns+yvUm8*4Ws^(bL zwNi3KV{1){uV90GGsSwKB5kOhqH5T- z;IgPF_rHCvJfTKL{0N%7C~jz|cXmn9g}sB#xE43#L|^~6zx(AZMPs{!j9@0mwxd>356u%)6VF?kKxAXLvvb_FHAv4!nb=PiNH{&zp+b0*op zgT9#ba2New>cgJE|F2W=`@eI2@&B&Ng@3b*mVB?{F8tE3w?_bt(MJ!6t1PBg6vr_W z#pST98ON?d;n7FL-=WL#!l*4FcdG zeSUy76ZWp0REmMIW+!)Nk60v z03JyW#>fMN$xN#XpJx_6_!R4AG!MLih`kMR!t|I_kngs;E`Ay1eLTn?jZ`^d6i|nC z&p(-f_3oelaANQOLL&D$_>Z}bUIWo5PN{s%_~l^N{VYyv7l}?WtDbe%;E++OCjWn)B_S z5q|sqqnOtDb(bSQ@};o*(<=We)qs%)tG=62OVpIhRsbx`=3Glwh?{TYu|H4(P7!ui zl*|M?fFEGBJn1GQGSMz6Sq39d1?$acHrqI)p?3{FGP;^3IV3tGmodql+x-wr!t~JB zB=pmE2wW70nz1#Bx9)l^Tc$#`xiUl3TKnnL%3BmQ2l(HKLDlEd5j@t#M#6r}q|B>? z5F6iQ>Yqs{H|r-BTg~e&+Ra`(APc2clOe=vyj0$MM6XL3mnkcq-FZ>Sog2xO3?sLB ziP4hrWShL}CD#@*W7uHm`^%=fr;}{Fba$_A_NRsAOr1P4YHe8|n!feE#6a{gsHbK{7SsDCUDV{XJJm~uPYl3AN)DP z^nv@e2Ur3{om6)|?x45jdA8WYWLsweNN;C}xroyte#V=JSIkye__@$o7(c8EFMYkA=9c-%cA+`~1 zr0%(bx0h_|=Y;})sGIqR&KRPb<&{QpX&3J-gqs~+nDe0+d^P;Z?!<)Cz5T~44c@qK z_D;(Q@LdOOq{1w2SKO|dKMoAG9|cu&C*>)xveN5ME#!3!-8t8=O|9J>>6YD^F;2|e zZZUFiuL)xQGTlx`JW8p-Ij|8+?B=L0%+d|1WuFYLtn-*}u$W5LrZPE7ydntr^CO#s zc4o!jB6%)0xfk-Z%NSc|H=@yGb5>$R_Q^%~Zu?j*I~-#ykQ*;ben{oAmwrpgB*edS zQQ|~GZ=%p&ywf>ZL0H#S5*?mK2O!+?FuNMDZjZyt(>fxHNlrAK@@ZN4#l{p)c)l@o z)|sw#dsKvT@Q9I?gNOR|2+j+-_{Gb+ zQ@k`K>raKgj|oBiRqEtl(25C1reS65JD#p*M-Q0z*M#Q3c&>y4v)Zv}-w3(67T3_6 zO3hk!*&GoYQ9XH(nYqX0B=$Ndsj{lZsWve_onSzbF4~-J@!h^Eng1j@7o8;NH(dcb zKq71&_g1i5`Xp%eC<$2Ue9ICNx~1T#A2@it|y)Ah(P9(7$kfIdzy(nq1PY7Kj$Zwm`l zoM#Hpn5+Z@QK%1xf~t?c%hp>n@MQud-WV)ZSjl}__8hCCQc-^rFVXd7F5?OPdchyL zzv5?ioO;13i_>jZ1FCg$F$ff0_Ue^K`Y6j+f1y{VA71Y~xB2c8AW~GXN5k^V)PrQf zPdM>SE7*fRftaGAu(VT)L_+=WbUQBp8~KFq9;ptp=C8oxjHa#8DW`*dK951G1f-%U z9P?mP+vKo^KXN+3+P_}GrN$$(s)~t;4oj-+o~1t{rZUg(nBi4zQ4brJv4dnbQNJyJ znvP%~kq#U&LcWWrs3$*du50kbhx!nj179-CsD$GX-D0@Kl-r>^$baN!vXw#dNae?m z$+w^JY5##im9?an>Y8*bh%*%ByX|0|@phu2v(0yct302#s5I0JqP0r)NfM&hF!q=> zS_0_hJoG}}<26U(b{Kh_0Z*A&Y7>5)gO=83tg{Xurs~bh>W{9mXu46Q_WEvq7BG!6 zreTm56W4>dgFXHw~r4ujgP<-rJ`N za}yBsfX`dHqn1w7~Bz_Zy~B@4WSQRL2dN$2&_loix9}e7jA3%pHJfnYkUOg z>2Dq@>|M}t)KG2Em7@+>v?D1o{(^WrqVSy^MgrDX!8eNze!UOIdHb^?Gxsb&CSQd! z{)&O)LEu|%mZjt-M0C2|A?HK7G?)yA9&VoQZa#x!3`i^Oyi4{Xejh8SD*h)hJ~5iu zu=fhiZvK$ACfPUa7Z!5*Y80w}YuY7I%e;tRXF51b!i1XM)sqwSCM3@x*NsAr&8z?G zF)KLm`}yJK$4i{UF#an+3a;Z6E^kqps}iB^kiVFYR@Ae*g^oT9Wx56GW{b=v*_Q_L539E&H?5(VvCy?-N;qo+5%@_ttBlJk&7L zMrjG0pllrLOuPN*EV+orFtsPhHjH*?w&fuyGJjZQ5`tVo(|~-Ru#3f$L#y8d4xLPv z$y(PAFFdp#^`EOU9cvyvZZ14nYrt`jw3cfcyM@~y;{?^(8w!%H@L_S-t}Za;Qz_@( zMYqfJv{GbQY2>Kw_D!AeLZL;!9qdZO(PwcN3NPQ# z;xvRFpJs;lVQ==ERW~l?Muh2mH#_~K2FK;pqcmB&;E;D14@a%*#m;*_OLjG?UaK+k z@g^y==D{hXB}9tiUda%t7ac(uj~WB-(EWHnH>LlRy!hh97tH5#?JyoSQ_3!T_Ul&l z(-krIRvDAz`8h&w50=;5J;Ji%*QQ1&A){ zN3BZQ98O&mySuIgLAcbBBj{0?+yc9;@ecHlMA%V$ddXT3c$`mr^kBE}W$sG+@Lbbk zD)wF-fn5KDY&rl%wa_cq-x?gtZ9VO4gJf%!uLD}E^2t{ysU1Pd)XCT*DWvPz=cdF+ zq3!ygb(x$bK1#_3VIE*BdpF@z+os7T!Gvm;d@LiLC2o&NI;O~raK(|1&|o53 z>aU5zeP5vIl0oMw6|=J_qHy$BnVa%bWui@0j7=$MAM&g(JU}V6v#*6M9v3rYss#VF z%+i=fwCd&yi-%Navt~<&{6@HFf7f=`B+tl&QZ4zT2;Q|+auf489Hv`f9;NGS6n9Uu zjWO`eT0UOA=GCqdOvWCT$TgI}#iW0Bu5F?8x!(#pr7y*PITH+8PKF_2HY^ZkZ~ez> z`KFeMEI}m+VThE`!rK81$!pi=-pFF(g!h}uv|jxgRoFNKX(xB%>%Z*YPH>m{o1dcO z(bHrxa&M77nbX8!SFH`+aKdPnA0ekrTp#ar111tN$hM{?z--u^2G8VGf8PPDYmJO% ziCPlZcR+$5dIO0~r+Vf69-950Jk7Yw-v?Qn6byYi?x|-rO5MI4_WN%wkUZ*^-SIHf z`&QWxC1eS6)T*`bWaY5U`Y%40kYup^EQrDXdwX_66^tX-Rp@S7ZwZIm^MA&YD>}P) z|EgtWpBjr;bfE1bI;E7#yd6dlrIyEz`kXb4{<5{TB?f;F$a79v3}CI*d48rdUmXQ|OF#9X_+!jW$M!ROTAV2l3%3G{znNSM}@x4^v3 zQ@ElaZblu0*1;n2$6!ru&thogr>|PzU`{FOq+4n+UOs9W`kZeC78Na9J2$#<55|fH zZ`n=7<=*I`X{p!^%>@D+Q{h?e=wizNJWW<)q_f$=8?2cBxs0HM)62TAwj%y_&N zO+YS{)n4odk9EAUiDlf27ZoZ|pE*UL=r@hDHKV0IBnKFTqY8}Mk!1Kx3Jqs0^Hu&x#dSpXQkEl^b)dioTzAEM76YEf0=WIUc~PkH6Hq zaM6QnRAtggwO!MaEz2_wW*hda-T#Ie6BdTOjg*;=99NB%eoyHFC<};q)1?YCD)1Jh zXY`R%lJy_m{#fYrPTFXP-?hRhSZ|?O>^>h&Y`5qd&G=s#_BL%MB4a* z!CCSwIX$&)F^J4}HFd=TZK~c>XM(+bjhb7vn2&2BkLRT!5s8=@FQ)zo81o@;T-@1i z*TR!YJhgG0!>tMi&VP6MQ>pqhBw>e`X0_Y?q>OgEAOt$zA#l%YdngBDr6KKBO@wZT zzq^iu1Eo8o1{VZYqJ}1UUo)VfI>?jTiD_1@FQSW)qs#eMLd(|uqdgfiW)PdKk2XOV!!l+ zpgKG$vH%cB$9~viU;M2N=<$xe;5DVR`{ayso`Nf`4Bt>3&cPAxVx`ViOR1&&E!@rT zt^#S(Rz6ZC^Ed9g)4mCLrPg3SWJ^23JiqflADrUnXaAf^(#yr>DKdEfRt{b{dUUoK z(oO{Ncaf2x(ee5?VEyo_^@Q@t>FJs)h09_$wF*E2^TrOB&-O}kY;x5{JWY2@b36^s z-193CHaep{<)Ei1mml*tVD_*3^h@L+37#9d?Xa2#2ycT~W^yL#-goAn-ET^s^SX>5 zMHNnNCMuw@(Xl&h^2uZajyu2%W zcs(1~hDQ|0CuT7_d|##b@=$_a%TwzcE_fZalk8?4X_88`3t8)-&Vxcu1mD47?)py(MYpNpY5~T!V4*wT8Q z!qRFH2jc#Pw>0sG)Q2-w#q5yhGkE@4L6vVY`q%aje^e4zYo0F^i|0ebLWg}CV!zz# zJS?}#HspZ^+4kAlsWen)D_5_C$xy3sODPU#4$nGl-D|vsz6o`8xIp_Jsuzz(gw;v; zezf2GiJ_%naLl7pl!Y=;sNda?L?5;&jzS{s=~e$W{wXg*cHb6T z)j?ydN{SQ9pTM1ecjxYBxcb%ixT}_g@D2$D0+?Y}K;oKj>epixnP`JcY{8cHkF7PH zFWsKOAY-8GPu3gwPE5)^I*CK{_2tmtFI)3_xs&%uB4(w>;%siP^ja1#S3Hwg^?Qyt z#}~0oZ?!%K4=qasJ9eh)3S4x#n6ZNpjrDeD=I28Wdi-*hb3lx0-@W}^CxjX=i0wPL z_mL@?J+JP;!HHap<8JCu&wQ8$T|Jf{h}88M-0HtSZ~@k3py@N-PYhJH_fHV4B5yhw zG(n}gXR}@#7y*aj+qlY}n8E^?1eVzsE?LbZG#^GK5rm_Jivdt85p>?tui9JP~$>W>HjNp^k68fuF zg^mtgp!bll(Xxc1GinmBTkrj%nE|D}{Yx;7a)xL)#?*gY|2)MbZq&5mr#>o8$Zu_t z=ZndYigS2S<_0B&vkahU;54q@kQ!8dv3v|rLd>{f%Js`fcx<+>YE%$}u1a}-ED}=T z!;9G%2|e|5{B={m&~93r@kX)c0A}#jbE{uQMwE>Gc<|1SUw-$STIdccV|dbpFNn={ zw4Qh4@14Qz9krh`I{s%g-?axPl4264=~%3e?O+cQ-4=wl!v$cEH~_VN^QG4rVj(EvLl^MbYy#64$nuq;Ae_mIynD5 zZgI)8yI#5ZH-?XIv3JXbHHl4M!+vSI)6OeoyIbA$WUa;AY0^g;BB4S9WaiTtu{JP8 zFInf%VVqcgdP7j8PO`p=&AqD|p7Cy%dPL@@DNw<)6#Q70rUmF||_ofe2Lv~wx6 zPwT%xw&eHU>omQ2vIjl#_+Na}s4|ETS`gQdYct9J_VeN!s{r`Fp@{$Eia`HQstx^r zs_(P_0y;*?Jc9KT%&MN z3`9XdN$KvAZkBX|bc0H_bc2F)cY`!6O1eY3yIFL1v&hByVDEj-z2lBE?)`Dk_X`!j zcw@#h=leW-h+x0m5^G^WLkZIgL4Gm@{)LcAHcvp&Syxw3@EJTDI|UV0-Y06>f7GEvx^H)>R;lVJq>^nE=3s; z3^db7MeIjJmD_sQo!xogt#@<)jDm=8X5o#EDJ5wnp<<%qVw(oW)2mr@Zz+|!M@7_y3-ZS5==YUySCDcG#2@M_IT>zdXqq>@YwM|!+;lSJbuH(uXC?T2YczQnL zB`NtqOHPHW;#NE#ah?B1xz`I4BJ)py>30}uO_fF>4*8m#m6ZZcogz?clSpw@R;Ops zSs-^Lg@;>0ej{PNvqM8er&NWp1`tIW6cnD7v;0F%#S<3aYiMfn5fg*@k%CXk#B}d_ zod!I7e#5h4f{m>$yShZ4dRJvjViL5tB;53Lf8wXI)*TWC7S{1~9e8)Qwj~z%S=cE6 zon@9Q>dK)257f|gWK@z=fZQKoTcIstAs&a2K7R0>^!gdRJ!SNhFx{`rOhv0hsE0oV z+`DxVC1vGovo}6}F%Vxq8IRT$?@v9(A3tF907(URwsiQ$&gu2FNyfY7hW_E<_+|qy zeF_wA7w(CrM09iax52sFLtOLSqW3b-#wk6>t$Q!aRTV8Ud_dk2NVqKb_jZAS9QM*!aQ3MgZk zo{Z$94nqlfsyv`ycN-FUY((NwhGdHvSXnCoWytWf`fVsj#LcUAfGE7mKFn_VFQ7BD zPA4sDxRMg6!&~V zVULF)WR$_AG%mZHwvA+fF+X*#s?OPLDVG2Ng$N`*`T7kxLn7#6z!ri-J2|b?WXH5P}rJ_yQdv*GC{Ix zwUbrV_iMkqJ9m~gJ8Qj`>7R6-iTs8`wokn;p2UyUQ_l#E@h(4i#3PVa4#0<(>SYC`iPor8khm=CY)3u?8)+=ylx=re5@NCBtUYlatkU zK4-R=*97YOSuNUpS;|-q7zU{wHF`olr{g9CiG)!J`RNW_E~f5__u_Hza5}omo_6+? z!pJKGxK`B6!mQMkHkwH#G^y>e3`?1S8oRx?Y%O8oRC}fb{+-sL3u``WPxrGcNEt|0 z_H7Q8c9TU|Y4=4dwiEP7-P*_u<6`A{)n%hwd}2}=YN2=Ax2CDyI&KUd3dfyF2mfeJ zLy3=PAXtdd6$Wp=$K1(zyFcB&cIa}l>+s#m;bLEJOMd@7>fGJDqE|X^$pWuHqfHY1 z^w!A+4Z7H8Oh9kfdFHnOu&QE3I6FA3mWKO>t_@)mNrTn$;d0jZpzmWW9eT)b&wG}x zeu?bZ01|+wS9enWXu+E@h)Cg4z<*-YYk>mCDF%A8Vq-8mJq{sWNqV0FDmteB+w4IF z(^Ir~_ZMJVNDY)KI9_-8g3Kpx?)_vFKi*@bqqnCfs{&*fdVF?cGhYeQn5OTV>A2Z1 z21XZbZ8!9Wao*lk*&#GI+BSRct&B}--7Wb?eE2)^vt%O-|CmH1Hplk*=*5d0$2{8c zoUF4FhC)DORn>Clr0wV+cgfTAixDZmcX|0(k*R(Szy?&^-OHU7h-IlUahEtx=us82# zkiQ&n9hkVUlb?m>ciGI!DIno4(k5i$BA>_!C3|wHpm&cnhoGKv_T;4-ukEG0`HNux z^ab7)n+sBZBU!@`B7C&V+v@u=8;c_~YZ%}6wt}3d#De!K6RMpv?_bEJH8nbS9;sPD z^eSwo11sW9*);1|6FF?Med}gJTnag?=AEwR7Py0_7aIZ2-jI`xu*Rd29aij;X!!d& z%i@;d)D}nU{qc&nIH@feyjzm1@qj=(Cf&Lww}%r`JGBUz=JVGIkdvXc*)T%Wj29^*cf=&@-PmwiO*wHSNgR&(Opl@cA1dacD^9AinABM}!NF4km@{``vu4oI_o%wOufzqv+^9K($s6nZaw1iHE?B*G)Q zx1vWv*7vp&oYAvZ^DOKu*(r!@h-`l3dQ*o6q~I5i&BkSxmP*5Nv*VoU14O>hITBR5 zuE~{RmjX&TB9|@0Ytm8Mfgu^TY;{sopUu>5&63K?qwLQp9*y;J6VRcSu1uE~2e9!g zDxytBZk{;1UE(`m?`kdKzkvh2kS7A2W(2WZ`@OA+12KDIzClRRA-XCIH=|UPl~0^JsXevphKO&BD5` zSGXJ*Ii?=#?&p3 z4wrPPvnq3TR22OBcPbS@`ofFoE)pzbrMq~cg(~@@y{K8TKrm3UfP6Evpn!2fNm|LL zzdr-~<#fO>3Ks`#ocAln&F4Ki>jnwP5#LtOrhD> z9YokuV_;!t2HR5y{`n>Dez?3Zk~Nx5MlZ5;X{o5lEueTI#l}9_!!=s==AR`_4J`4H zT)9*XocDFEgE!vZ&rc`E$Bl2NLIHW(^W-2ngx2uQ3BaQse2>z&K;=5xa!a^*MNUql zbKw2Ql-z8Jgq$q|9QFhCFL2_RV7|uDOZRSBvWD@14tKVFZ-eP9my*hE@umB3aEqT~ z_0+nx^ZJ&eeiXqeBXPcmR=2F)&CDDd2Xl#9CwJrvz^a^Ep0YCrVj@$FL7E7a)L{vV`RXOaA z7xovs$x9i6={hC*xh|ogamtW@u)y$8>Cb9v$!tcid!@Iwuww|Wk5A4#+#I=`R)_ni zk8YZffv9+>Sc{{kW{3NW`)njepk2d?{Y0p*iIT&;YwlKkay#?e44j|2zd6&i3i!R!` z3uP)8*W7VMjj_t}=~fKdvJ?mf4vhe7O6q; zCz|8F>|xl_TvB|NS#nu_yLOfiYj_uuF?js<9uX1A{r>q7%q|Nuo5tr>2N0QixH;&u z8JE`%OD{RKSk4V@ob-j=T@_42^gOjbny&_scmOK5mqgs-OI6a}6j@Z1h}ucrknsU$ z$>ibcnD)^~LYFXo-~f662qIo5gA25v>F4`%f~Oa~O4bCHgQ_T(=whfj;~O*zcsVv_ z@po9qB-vvb%A+KBA8l_=MOo|ZzaNfP5$L3)C8XG{oEBFlI~p5%d2r-y`<7D{P96Pz zvP%e=1$*SKExj_8yeimw3qXAm~F zv9R#{Rqd~>v_-WNZ7MQzb8|qLacNb=ym?icS}|RCIflp z!UeHa{&C;B4bqM$_b_46)lguz#Y)!Dv{f`q7`NKt%5kZPtg&WLo-P{xP3Ljv%*!M{ z5#!_S?W#|w_VY)4BH{GB!+dg0p6)F{o+pYA#PwjVu@4~NlT^LyW@Tq~cin2c1ff30 zvvKO^t^F2npijAig#@zO%W{0m z0#C{}3Q0+`dZzi^U~^@5!3L@<>jqo+0*czrvYWF_TG)uc86%?gBU%uH%+^bD48u7r zjp(TVNI2;dPLJEEiFD}0!;cbkyTI>0`1h|N@6NY3e)Y)s2>O}2y>e|kPIOy9Bu)KJ zle78*5DwCaNl3}vzr(M$zlaMNpx>oB+tTZ%3MZ0VMcEKAQQE`RVB-QJJiHpBr>=uz zeUjFbXelWf-3F_y$jJPYhuT_a@Xgyj98Gm~i}_~hyNg-YVL1ZcfGjjWzl%n9sTRA@ zj*ee)@u;+}dRdjOU49xG8bly0P#*gAwVk4(Vw39ytAJ&d zTCy_u*Z0p~=hGQL+98*D3 zLF?vLa)-B2LH{s(X*s!q8yVM&T}mbgpOw<=vZ!M0XK_ ztp~1+k8v&PX6EvH`w02HCH$gqiHU*#?d#%5hG8%Sk|H(DKoSV}T{)qT@bK^$t;6K8 z=(yOoxq?29Vqz%ROktAJ!5EuJNi*lz$1b*~Z}F00ZSJ15R6-gWZmmDsWpZt01`3ts z{$*bWJ#!I_V}!?K{m3GW)gwF!$-(8RhJiT;{!vEBg@bD>zyR!Bp2%JHm13r!b7QM?qi@F#P@G znMJjcbWV#Cvy?>CsV{`Ncx!YUO<;e8#g7);)DK^iGk$a#t7XuFIiHNhKfjtbHTily z1f8rw;Ofz^Ff#3xl*~2jfHazK4bc&T7T>);sWl;3XJa2gL_B3>(MLoQEfYoRCrssG zbh~rb5&6aYv?h;*O?I}$eEk5vi5G+l*MSKM2@x%TFyJ`lhIs0)=g+RqEzD#9@c($h z#4IVYg-=(}=M@1a#sn!@dQkFvmCv6!YqnF82UiTsXcXMoa{t|xZ10w@0!{J@qgyJB zAki|FcNB@-mX#=gV7 z{CHClUgu&Q7t|bRil?(6MmSs@DL_M$zSzv2nuII%_n{XY+rMv-+<59CJL&h=XTfMF z!FB7<1FV|LZ5PtMA|fgpPrzn&9&n;BE~QE1O;lQzvk^&l3#jEL0AQI}L}1xTFS>u4 ztMhR!d!t{>X)2mJ1DLva>ZatkK^pdwMAw`YYLo|8^V04;c{bSORfb4-xo6M4$>q>Mrmg{P`n1+=KPWiFJ=Sq`2g(fiZ96pFhV3^Q`Ft zix~iIgzuTXLlqzmq||xhk3z7%4{=>=)XRUUsWMkBpAGaP;FGz>|E90cT2ZUaASo#s z8WNCcrnQ|H5OTf>RZj)E*)G9+hWVRluB_r1bUNe=(z$GMX~~SY*4^)}nDwr7q>!Wt ztae^ro~2BTWsmQ+m}+bQA7W;6VNq1fVWrLMc(-0OpxL1A!Ha{JpOxitT*^P5J516L z@Ek6`;@vVFT*Ss?zwpmz@ra1NE_I0*clcrHSIJ<0`E&s)B5-x_z2ysdP+`K%4A>vH zWzxfC{GYK)*;dcA6O zU0u)iE{5!ez|f0?GP2#|gwyhh`@2PakPQ!$yfUg6^w3gQmx)ogkv@@}iqm+y#3TE5 z3}h^q#y4IqO9$8jry~%T!)}p*MljY;MUAzT0Kcm}i5@niIxgUZ>-J>)G!r=YCo9|l zHDugf-1Mxha6;aT9i@}t{2o$?FKs!N=H&qaJ^8H0OdZ|b;dq=~8KM;v6Uyc1POxW& zPD9(HWSVR>oXpG_;~Txz7Iz+WD(3-GfU5VR2ZCfxP|#^5O>|PtAF77c$--%RENSBP zU{13&zp7DY=Aa-c0~C1pYu!brFd~r7<@*+3LGw78fZT@K!1AZvmrM7$Exb;Lq&qOf z6K}wy$fmKdvd6Y7e@VN)y}Ch8zQ2DloWkvRb!-zA%j52x?w#4z=4;nW#mZ_2xmxv$ zdsTa}w@}#dKVxu%Q$=YK^u?BkC}m z{}P20^8b~SAziDqGvzhktXv`M4x}>u+yV0m!LTn6If_SpXEp0A|$Zs+@lbA`#xKRwZScUI7$c+=Kudq3vp z=Sy@dR@Vzyb$A>`CZ|I~19=_yl|O%%z*Owt;V9OMv{4-AGROclp3(Be3=JvD{X4TF z*PYgno3(0=0`-I$d1oceEllfN`fuK#=jG%D>#8jF6>Rh!BP)qcN~1_HL{#fg4CdGVC9 zT1Q7mnX(F?c5PHKTTUh(Wf;h5cD8wt*}1dh1;h8)ok+CZE33AgulL|JHs9-FOVa-Q z`B)DjJRm%2zpB_IBBWigq-?AqGZV>Fr3B6I;w`6@wlt4iDwhzf*>$7F^vsdchuL*M zfJ06WY-Tn(I%+(uOApPYqGAFW9RIjHNOiEUoZT0R`oPD>N74IbZwe$9@&R0&b$@8N zJgVOfgf;%Cc;6;#N4w>}BA^hG8}m?{4MZ)rD&iApM)c!eP$-Csip{fE7}69rdJ$C~ zwF;gH#4~T%%GaY1XuCQdi7~zh;y-3)W<1ZOzQNU09+#_{sul##t50HFHg{hf9ft-q z&Lo|r5&ZSy2JpCTpU);@QmmD~X-=eh129j!=j`R-ZYEoH^#Z;z#L7>qiUA2KqrP_>(fh6<6I)AD*1CVb_s%>0G@qiUf))Va)!sZnhqDbJcpE#mfCbR` z=q2Z>Iajtu)q6m%A$fwI9Z4@0eyAhC=sGYX*&kPO^Feb+y1{rL!R)JPv*q3pJW@R1 z*5>9oA_?a*n)$S+q1V zX}A4&+=T(Z*X;q6+YYp{@BGc)LvYCKQw+<8-!lnYA8m-Nv}=4g?hTuJ5rhvWXp zVe8*4R^uTu?yqR+iYn-X+Ky%<*ZEpChcc-G^9%Ram8Q`W9De73NE`F)B!D@t+Gz4t zDXXZssZS(HT4=l5mggVW(e{cZl_@mod1|~P#NxJ`OF_bh;gC7d8<0DIy|Wb$SFq^Z z6#HjV%KH}l4N=WSP211v;?LsgUX2z=BcMf)j)rQ^Vx~4!hKI{1a6ZH%<5eq8juvah z14`F}i47kqC>&so8XI9*VDRqF2CLKJYG{k~``5qd)aZ-tEe+pBMRw#o@pbjZFS4>|#94nmcc7PUJ zTGUs2T-Uh;!>d@Yr5T*GyQ{LNTB=c+lO>tCQof~qC@G#fY-cq59qP>C(6z5&hsEc9 zR|#nL@$%lDZ4JvFBn6;xH)Wf!QZoBZNZCSOCNN?n%xXmZhKXdsB>rBUs$ zCpW#g5Q`a04R>Yz=t-9!3c}5gwzm^n9t5D=JbvpVmxsJ22HNsbE+wzihoL8)vvo=* zIu6q%sdW(g^h|6C=;16GQ+&(q@O^e`Cf3x1adaZ%H&Cy-oK{6 zu4C-=&^ljp6qS7Y(sA|r47*phQM#d84|`=r^6-b`%8DLBn2D)r6dIo*wQMsXx2?DP z^eaePWs6^gHMR>ja{n2>#akP774dUqL=3_0UO6E~{U@6{_ z>M#3xduPke;`5luzQqa zb@`=8Sjq8XQ&Ma<`q&9{Qf<#x0NL#G^K(j8s+EKVuS4^Z)}pU3SZB@Y^gm0L*@fkp!I82j@zP6eY0GDb&>O=0O=vS=X5H$dn_$nQC~CXGlU zvFxMG)|0c=70N4{tWG3g>z$GY=*%{`9cAPg3ZHP54;R^1nH?mgL1Ioo*x}dKI^u=E2v2Jh9vTZEGB$FXFNNv+x+M9AIAZk zg9infs?y#<0*WfN9g=8`(fUXp9v)~vN%eYrsN_-wiFJ81SFNd#!Cpzes)X=Fym|0jT zuSsWF-`-=$d7Sak(bA&eapW5YZ?4nTRZ-lx3$+Y!?AqDb-IM!>z&yj~VN!>2y?V&V z$Tk!Pfoi4h;^BnN#?Z@}XU}ZP-sq++=9J6(y#j(7+49%r2;YGGS6m|2HI0vzRY_PW z`pE^nz9JTnt|%+xU}i>q1H<@m>^UYfszfrSs``wg&{~4$y49792GZ1pf|I)*Cs+-Shk z1g}3XO#xrO&hBofgSm@=r7eju3hu6M`Lxefm2_rzV~CQ7k_@i;snv0+v&L0#k+^`aUR&mNR9ubDfKc211~*=~r~z(-K^tmRf&Ln5=(^+}^S_ zSCfJoRG?EVe0|^9z!N!`E8->~#1ckZc*Q~rnB4ei{eA!qk!q&QA(uv*?3T~)_4U07 z*^Ttj9Zl)y-;o$0p{IA>+e9way#_#k-9~p&QZi+QAGPA)B?f?Odv9lGuK`Jv6ap?F(97vpjYw0D#r#ZBT}R8L zQrJfhU>OPu>6XcJA8>Hs{oTns>+0)y*2B^vztg$heuDcH5wnHg_+mC49*kyD*=-JS zIj^hdg%RAjFKw=4v^o z6Tnd$HKDls$$eH7m57f}!2SC;C5P%%Xf32DUe7iJja`D{8eVZ;eRZUVhu=J+z7K3~ zN2}V{s_0*pSt;o3+O$3M*Y_pYT#X&c3Yv`@a?XT>+Hs-XMTF{Sb>jP2)kR%x=sfLF ze5vPBEjuI0&klMC}|UF?lSbAjxyd$TQ(uAyhFVo%GU+X#?1-6ceR zY~eB^6VPiJ`t#@W>72x@v8sm5tM;kt-rS`cHMZx01mgxnb(zsto#3UOs^FL2k{F)r z$0RM*bFj+=UYj4afmJHwlvB_{fzQgy32df~I!ao$3FO1jUWqP4GHAB4UY*nQ8|E?*pr_j2 z*5-#yAYnBEa;MJQMW(UM>zyQjxLwV$c61CgKhhmcn&o$0XFS9qO8#9^QgXZT>|ME* zgef0Q3e^IRDGp)~q6~bl^Jfp%aau-dMu9XD;||gCF*GzZJhqR~?p1$2#xu&4@JLG| z*&y^v;o#v>Q3e?)R!j&XTI)3*??LMHx8w-YYeB$SxY^!Z3`fOpFA4|@VHDg7EYbCE zSx}s2qw9f`O7&2HUQ}$3IIXrJx|Cx|)pCw2_I7Mla|v@vPF_zPfihnpm7cIu-dJ!{ItebXaS zm@uGeGk9~5oJbn!ESXcJxS2_>zP2ofqBlL6)8eDcsq;yyp^%Vwby#&a&EIm!LV7_y zwbL$S@qTC8eRQD#wX%}ESEffcLuZ_lO#JQHsV7N^>OC`Ck%Ku^Rc0QEtNjs>$EkEq z%1L~SZvC14NwVUNwL=w68CF{%=O&Hs!4}zIaG? z|K+6%xBJYO@*IOer92sBCAA#SfZwQpRYUP2lXsTG)AKX)`cmhsV=E)nq<|X33szRJ zSek%`z_*U&m>3MjQ<}rGo5A^+nVC8}Qad}_+Y392 zh4oKPM^jZn(sdrUB~j&LZSZz@93Pd`)b?g8l8Y^s#vXkIj49g#6vwOq*5@D&`bh$buzv#xfT-}!UcfTL93>|43nBunpfYb$Eubdg@Y`^8mRRvf)ner7g4Hc@e{>&APr=S^xzXpa))l7R z;OGkmn@QRBRUb6uXBvt0X6&!c0mUI3$^Gn#Eyl$c!Vxy9FPGC|v z;27W^+RB^FCX*@rW9{CN)tyVCcQ<+7S3`Qu&DA2_+TFj(oi<-fOoeRjk+9NqO~xmwUjGQB zWNseOU%rZP$M@_{MSQ6n8zbCe%Bq{*|4JFK7aUgV$vtv+c1O<;gYaisZiku>41EM0 z;+vWd02tqBC@nokohq75;{m|H-{LXHrK`0Y;r5aKEm{+Q;IUt?ZD>GHfdcX9l0K2A z8n2Uu%gGqD%~u-Z?%X1oO#`;Kda{-$Mfy5REZk&tz;Sd{j|T4Q`k!jZ)IQ2J==r0F z@-BGu@{)r?wL3gL7uIfJQ6$N{&>vr_tO52xKvh;TT*8s5<6*`FhQ6Qq$1^T@XM>5be#gIPA0CoFt0#09V9@67>gq=;%XK=eb00|c^p~AB(ufJrp zkF{JlOyGyuHZA3+KLFD0L;ok+(*J+IHxE3B8QH<%^r zo|2Ni|5UNy;GRzZd^0ktw(B`_2lS!@xydDQIsWygcxpcS=N+z| zKMP9_sF21xbsF5g5Tg_eLJR_+@ZMEh$@IhuYx0UfL#_}fd`e-jxm!N!H}2%AYhl`lFyoyl!TWKT8Bpbcou z!b!wAT7)MAsx1J_^U?|^J&!auRfL6cB&Rw9_7@dZ{@?dr#sl8FLcPh%1*iwx*qji` zr_<5U$S3j%Ffko%mqi1=PY7-{G8 z^k<;w#cPWwBDR+z{i=2zQ`U2Hz{RG!U(NFx9v+ClB3^R!rLrr9Z4dP5P*PAl9Nm@*3%A>yA$ki70byivDrBMQwu7@vLrZJ4ruQ8f z3_ed{<27!ZnIS*6GRe9IO4Wa6fv8xm7i)84<3Ea7Cb(z*LK2d)ZpX_RrPfTSs5PC^ z0s|7mMd(wZgzSy=^+|(9;kevI)g>Gh`~aMOyOrLerlb@c5FjHfZ#_;*9wSn%mXubc z-DEY=`fPJE_rO_K!55-*_!&kO0EZ**yhiW>9g z+!{({jqdz*e>OZ7bb8wCaU1m>1~WcW)AN#dh?q;7la4R3Sg1d1M+M1B%LA=X2sA~7 z#rl2PB&+NDpA{5r&NfpaDcWTc2Ij`&N!(kTn_N6|oU{WyeWbIY@~GDTEzGrLL=<>M z6%9$)sf+t5baxVOx^$`hBPaSB(b>AXZ)FJ>aq;m=7f$8MN(3EKU2`?^N9Jm!TN~I3 z3AlK;jz|_JNMxLxYVvyFg}pReY7vVQF>DMB3qbRdwF)YVOuBo(`m;@gj?I{!PB#GtQd^0&i#qjiLydT6ydLlsfY~?C`htUl8FiZF{+TALwhLu)<7U!`y0w(i--|HA?R%iYLle}O!PhCUBPy2kuT$Auwb zr3*`{TB@z(!o92)S(8!#5R?tGjl|QTIp7Akf~^_qnOQ_p z*bA25zOi{i%-6NgNA;;nb(;kL{gh8g@4i!)EHpsV1w7=)u|^p@{vG~L(!f7dma`B( zHH82-8*YD;pntmRxnBOq6+f~;vi$Gg{$ND41mc&;FRoG*;T4CGusA=25!G*;%frKSM6W>`DZ%k@pJ#8NqB2QA#HjR*?qI%&m6a@&a0~D}1qJ`O z_Esce;I!U|oMuw)8l?r=8*{=gd?p6T$veTja2x zB_*+0?bL1!8B}u3N@UB?g7{%8zuqK&c&lnL5V*QZ9v77q7G^k{W=%<@7cC(&;Uy@m zW4Q^rzODn-@w2;f7DYffryw(vmNzUf-l_E-pZcB}hp@$C8 zQ#56ym|Cf)5abipr>FPyz$@wD^1LhF-9;OVjC_wl{lf z-aS!pdw0v&;AqLPa{+xw=u{SPweS=bZMIJd2+(;@sTTwcW&?q65p_H`nP>GpgfVYYVAh*$X8$uZ|Ad(x;+3u9Z|#0Tii z;7^dLE(kQ%hM4j!{C@M&khzRXk~{eNZV%&^kf6*y4HA;x*x;8xGO`}u*5rC~@qS6D z3*S4@_VxGb(cv}3i5(xGhPizZ=E=;;;%{`vMFw{9CYlnCus?| zZT#0j3_d3uZ7u}E!lvM$Wnv7W@~WyF&}2myV2U18T`|KoHB0)KIFOn7QYvzNYYTn} z8DHSrx*HLFGP@J3l|;C*vMO6RHdZAiB}Jc5Eb=hF=e0Q=o&z%SY;R}G`d9myhCJ-a z?^OL+GaoYkgn{MlKKwKE;!jJ25KYm`I#He8+QiPzyw+TJthxXO&snN-e~?EsoF$chc8BB>uU2?SDo%y_MNCd+)>v!@E!^V)Q0TJnWA!;zg)>b6jCvr3!Hd&fZ zB`vM!xFjK6&JvwORxiPDU5{0w$(pK_!xHuzYW7!0* zst~oL=;)lnynh<2>`@*!^8ra@z__9{FK-hTfrC1+Gvrks7+hW0f92P+c70${J_}|X zDy8Vq%ifAlaUX2Al(HR*?ducT;i9kZ^O}DvPR2(lucj7nZ_m1IWbw^)b0QENB<1=p zc`)gt3pgj%!BrEyPp*J^81CV5cVYgp(Qfr*Q=g~wx1Oi!xd;WqHj zpz=C@-}Jg5#>CU&<#qF4&lV}mhb<;rb%~*b4P}rBX3vjz=jHz)rsR=wyc-C4E6AFY}R@Yp+j@lEK7+fwI-13P=u?rzlGT|$GP zm#QjeHCylYC@8S=+t1$s*Df3T!IaPKt#4*Gwu!PzEWQBWbPcqjx>|T)A&(iS=&sTK z>(_Z$dv^yAm?R}6-d^AC;n+t9bW(_RPM2thyhhb8Q!lYPT=_~8+U13T&FVb!-Ow;r zmFXugn{&R!QS$;XE9=-lhp4OdO>pWz6AP0@HvQ3Fovi?1IpExN>TuVP01JH#etb5? zfg9x2HI~-wd^`r`KcWasNID)ql^r5{5ppPeqW_undcOaS9e;-KuT8gidE9PK*YEzv z_5aVML-=2W2e*Ct?tdPFj`s&<^PlVg%dIVdK!n{cgO7h?WTi03k?nDd(%#%nW(h1bWg(! z-0f3q25|~LfkeH{RnG|kO@W-&aaeQZ(%AkkF2XzwvQtKD@rPmx(3|-9&ymj&&yd#8 z(R{pxNDrswPfyBG@9uA3z5+1Zt)-kbCT%Y3f$hlAQRbzG4e9$#i zuVt)hV`HPBV5d7QJtWBWQB>&hx^n_N@Jkg;%+u+X6BOqSeV$*?VZ8Vk>5-&zOp3V-`&Q=#6(#M$_}dO zdB}%PH8>6b^+E82E`-}#+t@HKlvzLgjag??vK!A3epPaH7Yzkn)#m3X{2K~fg+C4# zxe~FL+r{a1|IW1KywhSc!OXsi&nx5vkTq6(KgGi2B)hFqk5L6cXUSg@18-%c>!RfZ!&O{?O0l^=qkc`29AU$k?%381FMd zCm$e1D_(#=8u|H~Z>{ck#*Ll!AzGjih0^+ZS~f0spaDEqWfGOBtE%9A=wxC1IDxm> zU!Y^~>)qjjm_2SXMStWz5TLWVZ@;rcVntCSqvD0ieOf-z&-<6I z{73wI;r+uvvd?Rk-G-kvO|{)c(YQ)gUJ$}%w8)%%abkQGQ~H2Vc%h?aFx;0S5Ds z@c$#%vvw97EM214;<9t9vhzCd4NYUY?QV-$=~l0jvE#vYLgF8=nzN$d;r{q4Ykg=~_Q zmG?{Tw;;u57TH68BkK*%{h8kxS)vI=Cs`8P7Y19<>{k z^|rf3`zTH&Kmu~Wo026to|JZ*$eKQoX4kA~IRO(iDYeZIXincwJC zN(i(x&z1p7h1^JSUd@`glJ7ijFI_OwYfX9)k~u8TpwMJ?bItKtaA6^VfbD*9O*{Y$ zv`@~OE;edpf287MqP!f9$as;Hg}i&@wI%m?%|7d=I{93Mlh*^xgMncH4_Q(1+w|1L z{XI0!Y0=|oU=|5LkIpX+XewMih02`gFHKKpZ7Sv{o_0KUcYp);#$`k zbIviw9H+!L*#thPYJ1B<70;5KlJlKXujZTmo7RsXbv^5T4R?Qjj2dzu9ukK&AjV>1 zU@%e2E6mlDm&d}plY9Fr+Af#Tj_N9Ctgi^cDgD}8mZ+q0o$t}lG|*P_Y}F;P)O zSh@aTvDq;lvV8aWs5q*ft3bHQN7Tvkk>WB_*UbZ0i6TMGO=1Ul3J9x;-q94FAssw#}iVgQ<&+5KSTxBuNPg znW1iT!=qr=wfnj11DzJjm_*GBkv7p_TweP_C_5%5bY=9>#JyshcmHAm36Yd|(eYRI zepgq}qdH|`N?J-q`Pt(2(*06^z6`^kA>$eXP2&H|qleTrylZ-z9XJljf3&fIi1zVb z9PAjG>$4m5;zW^2U%FpOC`|9-Mn}(-U%lwTYgRj&>6F%FwOo`Td~vZ~Vm9e65C)=w z)nYS~F@MWvt}h;U?#Ot&B0cDMcl6xcdaa3eU`f%?;4-*xMT?_)-gpRE0y`l2qki=< zx3kmlNaz6_qm}_{GmCy}KD4DEli)FW_qgK?JN(8#2eW);ZU%@@fL6K!lJ@oX*J_un z#iiRxBng3unHdKc*VwwsB*v)C?yf~&A64%adO0d52Uqyz?~MVjI*vNMi0;Wj5y!2L zlh_6)CoC?<=<>+pvz?m!&6$Ra&++jl_nsaG8wY3?BH!R`udt!vO8C>>I+p%YcW0V&-Z?cWFq2DTlL39fbAn|uB!`RaS@eY z@%1e~@>z$?TJ857I!-004|q89qr^ z8yh<~pr3IA`y0@RhR^<^rIMJ2X8`y~N=ilz7!JiTOe`$Km}Y`0zpA&o_EHwS?$w~WZ9RyfhMU0J&LRC7V>Hz(!Dk`G>E%UqC!yj8ZF*>Q-<$Pi+w zJw+XT5^F4{bXjfpFeW&G_WS%`M|4BvB89_4M_2Y>GqpJv`&TrR5iPR^T)&;i-5xTN zkyJ99)j17F@+7DIGQ%J<`kU|=!#~6xJj3;Zs&V+s zqg=q{Jv@vt=l|o*_J3K$EK^WIL4^Pxush2IW@dKEf&z2a(5QzG9rhGV2OFD`vI-jd znj|p_94De@E!8Vp|FOB6+?14*B%8pXAfc~qy;PLs0Kw3hoh3EIh>3|2j1c>|x=aAp zITV!hYlIixNlc20Q`YvcD51z1$0@`{R?Qv=^x^_a7ad1ns@WMMZz}63!=A`T4n4Z!rQc z-IL1pogXgf`*(~hx4rFf*YE zvxUBa*-1wH0^0Zed>FC!WQlrAY;23o7zP|v$_M&5a3g9RAA>%pvamsRe75p@8~Hrk z!ZN6RFkW08#OrL&e7)v;Gr_4_bg3k%xpN$22DShP2SFe(lD43MgVIPd`ydxEY4LCq z(@wyL??7ZJnyeUjt8@3C;?j>vWct)-QiDg9YTEC+vBE1g#Z!Tn?zU5oeK_!!=XJ8~% zgns^FZ^ljTR-Y0Ix^?9Dw|2e1J5iK4F$y9Q<`YqWp`S;#C~&^Y%F2U-NIRz3>pt{PO0qn2&m)XWpVk$suq$zr!}+!v%5(UqZU)} zmpp3zoI)zN9QQ3ab0Q*aw6wTAWZ^)|()GseOiqp=35h`#8wZE7qrTI{KI+mNBMXa; zbz2Au7?m&lABG2hZ=WTOjwpDJNJiD3vnkLgs(vjJAmcNly$Xp=llf))#7 zXAEpiH+mgLIBXU(wJvU+o?qOYrdZ6HjY1c*vom5a=oo0TYMSD1#l_Uw3+n0|DfsyR!ar#zX^5e*QRRWhy>z@MCnsm; z$Hb*yykCIn#LCO7Gi+TfY$=dZSBG^X-fgq|%Rrka*%y8jMDsc)r(^~X(+_g=9$pee z{|3vm*znVn3pa~ha!4AeF0XGc@R*IERHK+|*XZf!oFHj!qM)Ti_JHCwwl)J|ElsUixN$woRXQ;>R@%cAi!GN(624@T1*N zXvF_eLdjNZ-5(Dcn|_Z&n3g|YtOsw*P#d0#+rrHzoJmT>o73Z{07Sh2+uD z&}emzzxewnK7^_f5UL2czp4C$DUxW{!!+t*BW=_nE9&d%xj8BI>ULFtDt$rgzdEvz zpZKLDCDak@!7Yu994thftSPSICV7Qt5Qu@kaavA}hP=GGoRWf^8ns8uvHxg27nhoP z9QM}EDII!0`-ZeCNdGT#!u8&Yx+Dx4+<0kSGt%i^McC?NY+BNpX_V8SEv z{mk6EEm2;Y_Fk?#2_3{9U50!oG4jWDVtT`5JNzZnh_bNYF}TYSgQf5?fTje{TMp7y z4h~e!YC=yMT^qTz++6EozQ>RdXA8gYfb1B@$7A2zTp#vPjWSi_$0GS>@J0jb@X`l`i#805W~kI!xR03G(bb%KR~rL z*LQO~!2dW3Xs{1J=K0vf$o~5J_n0WBvb0R7{O6@b^2BTr>3Hs+i}CzionT^ zX_XP5kJC>nl?jaY^qfXyucN2H$Qf6wGNO}Ec-)89-JbN<^4ImVets`{&9lE|teDk& z&AO17o>9|?PsDZ{o03zdT8$+m&0Yu#&4w8nd*Ls-4KYr9gF{JCc5)1F_1tIJZht8^ zw>YGu$Zm)HW30yav!p7T-*;&kFSt9)o%NKq!iR{&?$YF|`r3%G!=_U|$l(P2L zK~9B@dgO;~=W>VvOfqA-XW9!H87Q7E!jeQk)Qi}32uccz9r!5ERrtlEEf&m(V6d>T zx$y)7q$R}gUt6r&w2K@Jzq`i5}LRn3bNyb=H*V<+XE?d9BW8IlT(+HbO=0?QMuU$BB_tWlb5U z^=^?Ebq01y!uV2YZh5(_g#`_dCsygL;|Fp`9>%y!ifF zk<@JiGs}Ox-6{t~Yjj~tQtom(^4VEgSv?cKV^vwP z!6qeYoAGre7t^fLikIdcPVe*&oSDR|n>wy&6(udoM3@IC>@(pb;~F3pQXf%qXJ0QM zIn;l2Zf`*U1|`7fG_ZXo`jpyL&cY&@UoJ{hjz1Si>Fx}AUCF~ECGmbu2VusIOI zTZcpaIi9sO2QGoE>L;ORC=5T;s9kYc6KUK>>5X(+#|qrk)$cNeDyx_wTw2|@e#pmU zO~kvyU{{!$Xma%Q%JKXc3)r!gw4!`_siP#-*c3t{&QL@%uxn9#3?C?))F9PDhwnpcu8!}6R{HfWZG;7W};XKQ9oVeRcqNO>fR3rjuLBggYc=#ftiXn(c7 z9+QBJ$gyfYKH-c$q$MGzO!I*;Es6MKL44U=BlkCJ_PK?z}HWe10ly8QIq#Gr%%373vlEU@WIkY%;K%qFvw zkr^o3*4|s*cBUflZ)(U)%ORy8NjAmmQQ7DD_KuD;YNo+I*T{)X(+nO$OoO=2!X2(0 z)tBy#qplTNFGg&tA;U7iq1Zy9&nkJdF@_?I7}C3K%30vNkCZ(Tu#HMi@|V;KeEz6L z&~;U*esB$KGcoa@6bSK4C@_ch&y@M)+uLhepsl2w5}%k*V5;0!bb1CFq?x_jGWSKh zNJ(=I*4HEw*Ua(6&D|rDLt+X7%Zp<=GTW6*yfcpjI#$}Vlt$lKbP5g*R|Zo@@=mL< zS*8f7i}y_b&~#OisR(*&0)GXF2tpc@CHI8v^b*5q>D2o*%UH0+5)uL>?qs6t=>HCY z-Qxhztq34=d^o+>Y1QYkV_&yruE*MvM+{+kv$fNs5@$g@(C6%)F801E$aiL}nueuL zi-yM1QRj)WSB=Qs9k#=-+;ow#>lSy0Fcfw3$-IxxqNjJ`YJI+oD5|JfD(MX$%1Gjr z6om6t7HEV=NABxeeVUddpJ?!h>7m;f?O<(aUx`#GSawA;5eK&vO`OdS;Sdm#$SK^& z>vdeGHdc2XMCgCR1Ik1FJnRV;;_C=xH`fMPcME4h1?{nQXBtjUJbJ;k`XJR#9F~N!#3PAQ$;m zNk#R>xmKsqQ&d|yM(M1os&bauC=xr%NPk96U4MP8C%*~#bSFQfATlOdRZT0EYs=Wq z&Bg8Tavg#-GlVBGVHN&{NpW>b6w&4IP+ndQ2Y^Ze}fAB z-Esu-349R9CEV7lXEo`7yP|S;|cP(f<++0UVW;k4&1oua#vbqT*SeO%CFWc)pJ)6J|z&$_y zUQiyaJP-!Arky$9rKQA)DqE{qsQ{!VN^41Z# zsmamCnM3Nwv#sTD5om-k;q-?Q55#Y{-OeS%C4g!A$;|YOsGn~yFSfVRcz!j}k{*@Y zO=QL|R_XQaeRZYN+fDC3{s4)@=uf$w=e!Mi!})Wly>>1|C^v-%<w0LLyH%=iuz(Y``r-xrySgJTR7a#@ay(=Z*O4mxIP>ws%PypC}z?Ku|T-vz{k&n+G2bh z>xWlEJ=|Ti=z#pPB%R0q0}$Kyv(W1+XE)2s6IEH{3q!ZZ>jk&yb!BV18lcxN&yHAF znBFa%EF}$W#zY}W)6gy?CdZ)Kv$4PZP5T!jgo0uOP|_8gw`Ra$P9C~GMUEmL`_O-a7ib@5Mnx@8|;~iw3 z#gt-Lb}^NegC&3ampeY(ye+l0Yu9Iqv9!9`Itq$8QoD0g7v9Lc*?&Lk_k=g7v8HEc z?RO?a?1v#QAOJ{+K`JgOk&zLXmX;-3@bmMlW}VEss5|NJ?w_x+BS;(|jGF#mJlQ{2 zr9%sD(btNo)taS}sB>307f|UmjBSI_8w>)lB)0LHv(-VPOH` zzNmy7olgDjos(`8tK(^W#in@a|0bavZbBCV#Cx*l+uAJl5@H%04{#WbKYvLVP%%6| z-)s1^iqDdK|1F}eD;V3*SYIt%)q4FpWGr`39#J(kudvYL?Cj!{U5XSKeIptTX@j<- zaW>u3f$r|##@5{23s>BW`AnN7+AS=g4+Li!Bse_0p0?0*w7N4haYf+hsPgPO% z=4^^@$>ZYg_m3ZREm|Lq_21&T{Qm5DZ$4Y?d;|j!zd}`-O;cO!0gInd_fAWmCzE?W zeXVGkfo1V+T?J^*5a^}Tt=oV=fXj_=*v4ETOl+ac`Y}s=jg>B6x>}>f&0tn^bVtyl z&Yu}Z9*e!E8zho;vIq_}jW|B1g?^g;Gkb@rqI<)ISu4bl`hj>JZ#11oXJ7M@;QoGC zD=8wntjEn53aS+QIc^{!14X>9j*OG!8w7ycFztMlqINMboLs8>WlTF%ju3pYXQ z;^IO|dKP93Sza|TF*q6JPXX`mZ=s%Qa&kafAm>^s;Qd16{XAW1UYgt3 z7?bDyU8!cxQ_mZVXD&qMtT$mTf9mYW4mWl0^9o9AZEfB6>y=fNt!C;0@y^D}a0E;Y z&d(hmvj@PKA6p0YQuVg?zgHK(+KTWf_a!089^G#zQ~fqRIbmR6fQ5t2lHgrdwp@mq zo7MFCg2?UkFsGqZtBKdXJFU$>%!UJ3mM$#S^IDlx!_Y9Nk_()}F-wIJ5EvB5QpKFw zV5!e+@=;wKiwE}aqG?x!3I3;?dQj8i+vO$@EL^0nj+y+KNueFl>KZCqBqF?C2?;|(!*}m4utUNV6Rj*PNcO5K zDhB%cavS=nCF#6aWFZf*9A|->f4K_KBwp-CMgeOk&Og zt_PwbkvgEI4)XHpm(P|?-j@3I7yBN?CVoQF+JHZg+Gk~9OXjxu)pU4MV+9kr_&;ov zcEkCi*Q<_oYd-|6(=B;-rEwwGTZ$;M<12K~RtLK8^cmDuOLeW7PfjptX?1STGcPY2 zTHo=wyT3R;s4-f40vV=KEiKkKt3%O*0R6WT4v*79LQG;}VQy*H#9H(T)xQh71E@gI zz&7+?H@M!rY)jSK2g%J~73Ayn37+f~5uxcH0Ejqk5h`%xUs;L74F_u$_1M{RL;*yg!f>l9=`=G>M;)@d^Yf^8bQ^XJbbR^ z8Su%eZ>Wz;h*yhCG}1Rbb~y_PHZ`?@EbbO1`7@L~ae7MO%Vsm`!})O`x#UN|-zjj2 z0;V6okKi(ZGrRld`s~iO*SV?>0^DB-_u`yUvV)!lzCV`~931Ppsa|9U|3R(YYlXAR z?hi50)i-i-;%8=P&Ym_#|C0joOM9Ro2unv9cBv7xLJw^tXD8)+Qt^aMb`o04wYMYo5K50~V`6DI85I(x|K7t!+SR1SX@{6=1NNcoqZ&4-oMf<#cuLLjuO~St+S0gKG)I zIiDW*T>|U+{RPy&lAOlghwP1cb+2YgN=9a`+CkJnIi@D8CN0MgO(vPOXE<+;uH`l& zIcjrzC9gP>#*5U|m2+pRxZZtzHZ&RRDkGOirNx>R+flMDuYx-C^XhzE#KmW3&z6q+ zF2~`mZ5$bym|ZP(Aw4rQD#@0HjV{%GsnI5gc6@B4XMhH{ z(7sy$1P`AR>8GyX!S3$)h6|{Ln<+nOf22J}N88|lkW9%xm#YWIfp7)dq`_Xvja&O* z_H;<9{!Q~#-#ny=hRwb#g}>^VPUc0)Q9O2BG6i0Zn!rUU3*lC&^ZR9$?=gtWj zz;H}R-2FxpuZL^YXK#BlV&X_l$ksw(*YSF)HAm8MU?Atm{}mRz*3(9 zl(UMwe7=eCugo*s6T2Q=7&3oA8rHY>kNfnq(y`S*xmgVtf*Z$M;+9qbst|^K&WEvB^%?5%6Y;SLYp(rga zZJisNedj5~6WJ6rF1t?Vnb*x)cgprs2#<;S;j!MovgYn{AlHqFj23&szghABLW(>B z{-0xg|Ep~L|E*AaTy6iWu_a9U3DnPuHwZbNHI~@exai8ttTO)0nfSd|Ga*f6Q40#KhSq`FtIowZtm~TV3~lb z>7N3M!h**`Te~ST66J3_M-+}~=-}Xxl?nX9N)umu_fS%Gln%&zVFg&d^Rtu^!`!UdiLwOt4rT2v1+GozBK@<8t(=sHOU&p$lU3_!9Hk=b--lu9=?G4XEU z7w7VR6U<-|$KU=00KYu+DB;4}RXFGtQ_|7`Qk1K-sM0Ex*J?0zz_3gvi5m>hW*TuWWPMZH)K#?;g5c7_koWy$ zWEAx(RV)|h>`io<$WOg8m6F?s30s^x)YZp(`KQ4_x(^jq!P#K_pJeu@)`=4e+OdymcV`p|>!C9SOXb=_V z$&$1!x0@=y|K6j2z6%*^X}O1gfm>daXU)vKF_5^vyx+NQiy9S4m(&8>og{jJGGk*P z-UO^{jO+i3TaP7IKN#_o^W#@R!e0bhf%oO>fcN^tK(;2HURTGFH~@zn_BI`%iTyvC zgp#}>gqH}j6&Go>AKgF4dbgB@C0DHvKI=-vE6DC~u>IlkCQ(iOY%PI0aHPTCO+>}g zQs>D8$BT=Tb>qC$X6NMn2|3k79*5g}_$f}SfT4-LxrK!Zlbw{d0VEa%R&Yd4_fbXc z34CB)?8w|n&O!r$$AJJs_D@cTot~-rCFe|?5$z_XtWx?e-9KVh`z2Z~a+^Mm=i zxeg#!zma5QDhCaIvkj_YuiN}@54x6sIRy2snzDZC zjIP1xU#N89f<81Io?LTnXvoPi5`Tt7>MbB)YPQ2kXGzb-68bGL=6qI7T}c)GPn*3r zd1>Bm@HLJ7Tj9&3%9yHb6GzKM$tX+k6MqH)*J8Nb>YVd2*_K*Rj*AiFUtFur2%x}b zXJiOEyt1N`g@I|%^_qKye)glFfRdekw>RcmvH3sIo!?c&P{naj7l$=IA)cL!V^lFB zf=;LL*Xj{a9}DvZ+t~jg^R0KSM@Nqt89|1AD&VfSGD1YQ6+tGA?*uun0u80nF-IAn z^uTXqHa>)cgW?P+lV@XLnTW1LFbSygH8FIgJxdLg6yrTv3q+BV3OwX6K_v|`F*T1) zNO@d++z$E1I|(gE^UP-+1*n z(E8b5R3x%aO4VUS6fMrlM^8k$QxAzSP$mEcXqN(-Z!5`&0hGj+5TqhgYsZYb772U9}2s{R9pG0{hsONexol=)s&F;v-KIP3;S2N2G1r&D^`2y=pG9t*c$Gs3@-mrL+) zFBDNrjZaKODlk3$`l|zlp=m%A0pheS@;Nams-)z*7 zK)gs^G1EcPxK??Z7w7CMCwUWOz6f1G78L@}KioZwZhs~oDlT$jL1FcL|JVj_2pCp~ zyH7WaY&{xe^F61_VH1oi=Paq;i?xA$!qjlnFTQo+Kow#^QzA#)J49Fi`W1Cvem2>~ zu{8_Jwn(R{f?jO&@xCyx)KIU<`Cg?-8{;;elWkd58SzaXU>E3G!W%C#A{AU!Fi1P8 zF{0c(&5Qf}k@u&zXya@${eT$<0f)nvf)?|@nW?F{(S9Xq?U;UlcOC+6_xE9w3p42e zlb<`seMbOWpXG!cwl9M;ca9%XL6Oj$DMH}M(GcfeP~0!wGZp{G{4aBD;RyQETkyE- z>T1Fo>f&v%!hmQ=wi;R8$W2pH8_%NrtYitc#P!(VAwI%A@h5DshXevpZoGS0CuLtA zIU`b0!RcVJG^2>owO@>}Qiu`h_@rj$_{R^oCC`gb72fUROi}dMpaC-0vvSw&zS*-= z#7{A&k-=ruXDGIm*jFDGpmBw z8-56r)%;!|m{I30Gf1NE5)c!(Ozt1d-ED16MTEq$cu-LQ#Fwwr=-Qz1c5AH9ZTIj? zmy9kYEe%m?`wkJz)YP*B9`YBa`)>3M zD*Z=E$vMZ~ZZPhwuCA=Vl1h(Xc{P2-!C2wQOB#!ioC-pgo}N|FNKUeR5*5{{TK1Vx z0+!Rm9=qG)-niQL@Jy(YS!ie}r9}mVCZXwH{(vC0RY2|Hv~6k{h7w6dSr~$NCQg$u zE@QA%`lUI=i=f!Q43@$qKC72YFWgH&o*}CBWyAe2zwFe&M0!S}g5xKo(+fnn5HSg9 zHilhRXa3Yysf`Iu0Sk@g9HJ=uPraA&=rPJ!f;xkxAj}4Q-}<~-chi^IKy)=O+`&zF z72Oa-l-NOdwugYi4L8AoYAyvz3P5*(@&}Bs%ye>3oGz? z^txL}1tZi{MHPjG)j0`psO(T&!kglgz6-Oy4sgqo9A7gH-wJ%sZGZ4Xz+*ru~S)SHHP>%pl%U=WoW23-8L8UoSvo_fulN{ zIKn-1?7$ERJtDQ!atl9M8XnWr>IkdPv`v^;^XW2AgQV;&{1g8bp!Ne+z?GGi_I7r6 zklX`Wt=dYLzEB!Xr*Hw{)mpq)ZwOMwnm!i=n@dYe+bNFq?;6n_4RrV7GnoGXp61}m zolTW+UFTcpI|EW6vv<2Nw{vtvdifG4PLECx0Y6X2M#6fd_d!iXXgxehHigNdG1D6n zp!A5jwaeyA`7I-=oUhiTxUTx>=!SY-HXNZMS#|2M=PWMvrVL+9(;k?Ds>&%hdO2YH_vV*O{kScI%5(ZJMPOlPxX9>DzR zu`KRC_+kqMs`Sj5lM{8V=#KZr)}xv)zbZi+Nx2Smwe5-UTenpTD0YV7^VV9)iTT7f zz~}EtmSVi?2|eu%jjjxi9#^!4fBP>M(0}yFKVm?1Flx-VfU*}X(jrr5(KTWYSc7iX zI(wqDkI7>kxDH%6@H3x@cqvF&c?0aT3=EeLoA}bKO5Nlcva=gmi>--3@0yvZS!hx- z|A7Dmow;~MmxaY)w4k&cWo}^t;wbmV!{W8NSEl8QP{&EeC!(vJ)CC34*`5h*a}_{K zVT_f=IyqW4pYmp&_V1dYc5%+CcaUXAE=o@Ai;)ql_XBwhQ0&)_{wPi`z4K#X*cRa} zydWf~sae>fA{v_v_R*)pw;ZfF@Ph?MARX*)Q=P z;B>BR%*e=w2CW3LLPEd>cMgCAyu2yY7*sXOv0K2<1!$o;ycUZjRZG^_H{9G@>S{S9 z5~ZP?Il@oMMhjFuKK<+<(ZEHT5D_NHw)bfMLQKUr)Z5rByd25snJmX{|9L61J-R*m zRD>nI$zP`DTthQH3irKh_Ok`CFQ?qBJz5ej?wDj;oWHGYDp!xF%5k>au3hUv{%8V` zje4yhi5bv=kwaRHz#bUbmxa!)up0TDt=Kg}gQ|ya%ijBYM7)`q!Q%uqFf@N}8oqty_o1?%6*)C4%&>N7(xE8N`Q}=+M@#jG1j>as@aTkN9#jK7r}U%0k!R z)b8!?iIM^5V1K+aj~ddi8?}tILp(jO(3>tc`T5SvH!&19HhjMF^}ytADRcZ;dMRFa zw=4FmXjLT%p=^=Vs4gqA9mpEs?6UeUyeTD}elN5_UtHBh z(&|^t*fWp4oXMq-)njKA`jSRkllEDLEzd70y5N4;7AOQBzzO5epM^#yCMQUUNh4z4 zQ|B;+!ei2oOxbV)Wb0~sqA$A%Gz06FTuC_kST)~$1WjQFEiGcYva)hC({*Na%1h-U zSDRGLNo+aST=PY(kKH%Jv8?N8{gDS`IaKeRwhgf*ym4eIg?HC z;<>*jaCtnv5g*vw&EAQh87eAHsMm=39nZ9^JfR%2F*!PE{2l}%@qoQ;eOaCIb;9^g zIyiXA-aaazV_SYbQXZmrda`F?@(~3uQBGalP&YfHh}-^yu5vt{DiP|yOB_PKSo%sZGOJ>^&8tO_zFIauQQRI`7Vz=wicEZ>BN@EMsd}Kc6 zA<1*ErYG3Q$A)u)m9*Plyqj~}{U#8v&Oxk|mseC&i0V?$5g}LrUA*)IY&x;3N)ApA zhgr4e}+w7ONx z8#Cg)^v!l!Udmd*ql>pYFwO-ox>B=xc7v$N?dyfv5Imsi_>BbRn8>8-e4!ZYepAWj*^kL7ce6VL4CShqBX?wBD=L&!!8*+Y`lql4jFXm5StK^F z6itmhK*9M#&0OJGSdf>yIHq>cMqa+Sru5s*H$N$9R`j`!L@X|?G!M>;nC zEJ=q|?cj>#^j*e^QG!4^Dk>v~`gIJB!04;iwt;}{mup1WuhE5c^xZV#5>NNmGdtGj z&1Y&$Y6Sv6l~9tq>#zHVc5-TJWMq`v?#S;nflla|_5)nUiS#tIM1N;884b!F z@6=$MI-U|W|9NCwYYCk;_E12`{j%cv?)gA35v+A1L+r})2?B+$( z-T8(yWRcy>3WsrW4OnxaOI zChb~?bMv!IO(IMj))DSN=Gvn4mF=UjDu1mgps>!&X>^cqhn{p-6Pig{QC-s_g95KI z2KQML2H)J;PSQdkSM}Pio`}#J1v2*pk{Pwc2M}%8=7B%3|E}O!Cq`^*`{N_S4r)l_ z*QW}b6f{&7jBEpRn?n`^JN* z6}pJ?K~`l~#s9WxUFV#FauNeDUb1s&#^YjN0NWwxWCSxRQ1eZk2)%pw8~GAGen&@k zM>aPJ$#-4Z(xmy@_Go)opR6@|WYw-;zaoFF=)q{3sT#QzG>M@{j0^iCAGf$N{m9EI zYKUrT3NgsE(U`?nxwHh-@m58?7b3#dMi+WGhinyJKLak zA`vBiTZ3NH1PAB}3zmKJ>tx5NVj)7uOkF#e^KO4dj2MBDW1ydHv~jw>EWXm1pphP0 zO?vfS_I#YVjwhC>i;G!)rA0;do0gYt zwbz|bkB`NL3zNp*#Y>T5ZO*SJ+TRri59Pi=K(RA6v4Ngo;kbeZNoyi+p#q3YO84F6 zStKFY6ybzSbTq30B#|P;ti0bs3k!?woE%nc#|zC&L8E{bjK8G+3%_|H^xfCqJ5wA~ zWMN8;Fc%luvpc_HH1&@ogl-DSsW#Ek7GaSH*6#b~!FZ2X)I5_rW5ZU$qhp^kHS3%1&LrOgLqf!j-_fkXJw>6pdnx}2o*RHZ2pAgjj ze`Q1lOmi4oL0s+oxh4k8siKOFL0Q_zRZCPYYx$q+pe)w4~g#FClq zD6Hve-X9y&l-8~SPzy2ju|Pi&WEfu63i9Xu&|K+4qV5jnZ6% zRas1vhq(O5#2j0P3u;Qr3?Sg@3ZX2`t0g}v8mP9dtT?(jo3Z&Fce-{GEM6LMjqh>v zm6}F+urlD&GjF1;55iBHE+;QzBZ5D)hkN?VCRw>ke_1hu*k$}+9-lCj#q-+!RW(oQ zB*?)vi?}_33DiEY-V=P z-ZDf*ndF=F&y(OZow1>SuZ2Ygi?yr#nS#%Fv=Ku^Ks#1+rPQO+rknO4NkC-P=zAIC6bNsq&RAdJ#a&I0gl~VfojL|nh?s!?+2uK3(4AjrU7d3hI zexWAY;6olCzxjOruZ(ye7T4qBug8y^EIHaryyn9*pyQ8^t0znrjuZQV5_bK%ZOWSX zmu<0UJg$hkz069>d}uh&Q&m@P)n5sJ`S7mf(A(XjqN234%;hO=pkZA3`V`4u=#is& zcvnT<+thz4rT2tAgJM&|!)XuigW^QIYK@PH5D_5ziMW{zPNhvZ+{m?@lvVFb$}Z_r z66}E0ky)vi_-G)H$5%mlBI9tbEv`*6!E)qmAcY~Rx|EjjR2AWY)8X%0wXO4ozH$cy zo6P6WnTqtv4$KX*o3o(?<;vurWAR`QqN{rP6xx32QWsIka`uIByv2xC(3Ue1FH<9C zuKH0>RD>4r9<=omM#w#0+Fr*8`e}34sGc=z_WzMSX0GNZTyNiav?`Re=l}-`h+eNP zvmxgjhBIp?zQ(LTN@Cc$HImSQ*U%&d#vIaX)4|k8*Cm`cv=h)r&fI_6$a$U#Aqq;u zhp9Z=ozIv8gYmEhg;Z2jj0#Z{TT++HixJ%}Iy5yLvzB&Z?~O7B)Od7e25^g$e)h?x zwhh-9g|mm@Dr7Kq=$fSp`TUCoBo_@(jM2Y2R5lrx`P0^fP_PprMl1~NBK()Pvd4PK z&Kc=9@e1#vF6&bfrWwTAz`=l$P{;bxR9!*ELeNlJy)N#lGnR>6Jkkc``37Z_zp)Ef z!M?lb*@a})CZTXW{)upmuX29uqh0{&vy9*8%(gsiSICX03}@%f4?e77B}J+$N7a#y zC=$JPaN04^vbM1~iwj<@!ug={f~+BSk+ZaVfU?tZid^Xhqm4tv+k=0c28ZLVp9%Xf zvrB#Wp+?FXOwtyur)VbP9#?(DK8omE6^?w%*CpBMnIzKubS;R#8A%Ew@e^O@Um|Zy zAN;Zxipru3^I-z=go!VAgx0zUNtLa(Tb;p-PaSLvR5K*QYqF#nPUP9&fByvqEE)eQRlxu4U227eZOYW6 zy?q14h{Xr;3(;5VsQ-B(4KSuj^Sju%{S#55G~_Ij~2+qYt>fzwJg|I%XxJ5w`X6j4d^NHcDy;mVI1eAEnq zl7&~B&f=Z{!*lWu8!wX=7bd#gqg53B{r++Nl&Hg`&LOM4 zS1sUF2fpxCHRqC?yrJ`KVac4zk5zLDZNesgp~1H(c11}`G?e1>Cc-c9jFK8Vkb?_m z%YWI=Alw}|{$tJtH~`p?V9JatO*pZ7Yq!jSWIs&EE6F^%nzb5FB$lekKvNrJBNlWL zksX*T_CgaA`g>j#YPYh^?B9VmuwR?^xBuazKWBhp{Kj~^BSJ0RaFQmG*f+XHZzZA> zdij>7Mr=AKzGzN^epr*pHf&)gmFE6-dU{CuuFktiI=W}60l5%+fReVjb6zgssdLrd zLc@b6ko`rohitwZT-rsh$xXQPqZma!M|; zgN*^rsgebAW(_?-xYD8|(^BBx4*bxp<}0&j(t)f@X^G#e1Ji7~A=cyf|4DQW1y%o2 zn7!mbo&({TW*4TG0-*qu)wqdy-NEcsu5FkFnJDE4v9Pxn>%>W4!mdJMS?fnq*mkP&) zsqq#PA||`3K@W4*zTx5F&Q8}qjWZtZZl&7yh|o}JhiGfH*BybfRh3n=x^>?Zqcl~? z0AxNqKA8ce^w~f}zAS}ZbhSrFM8dk-*%Wx%c&*ktDrORnyg94O+IK(58!U?vr=0JzkVp2S7wTcw!NvpR%4x1Il=9H)plachrxjj4r z92SdS+zU}6PEN;@?-m^$B>(NK5L~^RIixr?wqB&{pd7Pn()qtloZz7N%P4-?#0(g6 zvCmp9mV<+=sq6!G1(X$|xU2@Losij({G$>g>pi;mfkBdMcwIhZ{;Fbc&-@L7h>|_P zy2%t3#$NJK{v|4`feS3dCRW=Z~_d6 zBJegU(ya+hLZ1iXgR3T9&s(#d$)fAEF}ij{C-->GxE&q|t%^T5C7ee84{>i96=mDE zePdvtz$q$9BaM`FgLFxEE7ILVj|E6KNOzZXGe~y~-QC^IJUi%l-RE`P&%M_BuIG*U z;3w9AGski4|Jb(Q))!p1+!?nEbgY-ZQ4igz1AG6XK)HicyjjlFhs?hE}_X?1V zgN*G&4t_9mkBA@#x5vn{3${UgYf>Q4aP>+Hw?1nRSAotN1i!rOR@+?9dk#Ik#j^Ew`da(;}6mq{{2glk@z5tNOdK@kM z!2YRh)@~7M-plZ4?W(NIasS6Fa0#V2K7K@Ea= zuO_oc`yd-$Q!{pzDlip@Syu_>nuMC*^@W8Dk~ESiNHbxHY%PQTBfQTru0 z;TQj61vuM_746MwPhXkn>I#;~s*KcFz|ISRaAYkq{t%!JU-|m^*;reHDy=C^rbRJP z=6chn1q=)TtT43Fmu$bu4!n6l8D6wZZR(~RwifkuVx2r1?=%H&)f99AA(@K z)Q;WTNW_{O%%A+pF@5gb*{;1B%NU1jJzL)RWh?c!y~ZO_Q0Cq6~peSpYQFroEuX`(;Xf25%JJ+%Uy9N zwWzl;^BWrjFzso`3mUW4`&*Iy25soO|Fx7cq3Qt85L^xi1*b#nBI`$c8)jx;J}{{t z=VH9JHYKe#@#dd0cmPgCk$&Qz{ZAI*AuNHZq@+0j2Zw-w?ym>gCe;fZMUE!kaMytIRZ+@IjRvH;vDkvz9n&Oh*ni(W|h640vih4q_e6_$! z$Z^|08)@hDy6^mJrbmc6+mx&UiBwzx(21rKeS6iGMAu9i(vI&aiGxLNc)W;h;lL`yvC@>y6a9t4J1s17$U-=jw{8LivM9-FYyN)WaAt1XK z1AIKb1T|H8B(gmgLio}jSGTZjG(9{?`}@Bv8nrROb-#@$fXQ{e!Np6AOVEzX@9x zM==(SR?m?Vf?jateQ^QrhMYO}d`c}>XC_Z)Av0+`rIA@bbCoe{kn&SRPN~6^Y!Z-@fUrFw>xtFC$D+}4R1Bm9)rB2VwBUbxhkug{|NB(xcc=P)li7AXn!0)Ydnf!K1Fzpd za{bos&4UY;;nt*tq-57%lipadm$0x$3Ktz6V&)fdfz@tpZ4IEAszsW+RBzmY zB6v~+NH7+c7KA4PxGZ-v-V!EUY2H8H9@{xi``a`FCSmEfX|!BLG=H5rDgYiRJJfQX!eqYgSCOFq=w8!lO0&5c(F(|gc+!L3-?-g$Lx zjW&4R#r@Ma{Ig^q?(cU!&t;8`!BwT!*U-2qHRA-7msW*?9}t0h;m0`b`bFl`Xd@-d zZxL5lAB9m_Sy)ie9*$QVsRP@{B{u#j~U#L?B;+`2xuRen3=`C6n$t|`nlu$=d-W#0UwZMv-C@<3{029O>}_x z2=w1Z9C!5aLRrlxMu3Mzp-Pkl!~0i4RToXCgm}B?r+T{i5Ut?2H$OV<)@z>(47u#} z!4KD!>9qEOWGG0!R@$vE&991KV7lJ99M&c<)74E$OS9jq*L!5sKiupOY`?sat=rr^ zfVOQmT1d>mV7$}&*=Nc%J0*pQi)#+tqfC`Ti~k!}(eKj=$pJWlo_+cJ`D*;p^s@(d zp%7lS}$(w6xt8vx`nCk&V2zUm5N?wgxSy>@T2SoA?@<|X01-jRp7sqXI zcM)RxV0E@cC=U!iTs`N(1}*@-f$VMlKmQ(*R)MwY4yIa^mCr?B(@vGCE!xpjHkik&#K_68cdqhkvTGt`-K%!&4?HGbyL0 zw7T---uF%d1ev2lxq;py5FoTPH~)4+AR*C#%9fvkmiF{4nqXzi*SE9Q)kPYYQ?Yqo zOr&=RzPH&=#mpS5OTdfRbEYzoU}bpy>>)6|I&jq%S8t6X36WrMkDnj>D%L6JBz*WP zcr`iYxSDAY9*Dd`Xw1M%F;om4M=GL?HWI5 z=V)Ky0oZC{cCyXdz-VdbsugiEs2uhB{e-OxtxJlFA3r`=)iN`Kn+1l12$Tfn`h^vb zH;<(eZtv2tkOT#3#qd9>#wm0@z8cidT&5eQOk-<#>#o!b*mo^NqJvY37d+Kc{P8Ax#%jiH0aqu*b2-J|Ov z6dEqu#{4GWzX?S0(u#?Sa=4tl9DLZQvwN0b3ti4dHW|(Z0Yd?EPlxj^(?*5gE^s<+ z45YL@4X06$3W+}NX{G@Nw*EzO=~zdLwxr#8?PP+d*~!T@=3U~Ya+mk%UcIs!_Xqp- zn^)bV-;oH(S5{dJe{)9>mA_&AAKHS^Bi}8>L$9n)TCIYeWW3ja@0j=ULfz8xCGyVg z-*D1(^*+}xeb$_G)`9}O|Z^s+%_QFp<4h{Qf-r7`&L@HH8B_KJmV-^l*Z z5%Cm|iWKnYR{ewtoF&N5adE-_YJ9k-Oqq@V&gb;!OF}Zd1-NZ8w?Dsc3l8x0dn^Vq z*WyVXA(M;~`*Y3QWB@QV1+XA#Ve=;j{(8?fjskF01H_&p)`2Nw5B_mFUz1SR!17?! zRJRt4VhR8IPh5L=wDc5_L%altfRVCwwxF=^i!m{-@+~Aacx4%T?6htRmsiT4sy-9@gq zU>>@E{fjn{MST6^`Q>Q5dHfPP=#P=!egwNmSw5{NpuWMobNwZryhs4R?ccBegAj}V zv6T4#`K>iOIW1rn4t?s+Z2ir~udsMr9t@u1Zf*ioMh2i3*fD{at}}L%!5+uPoy2J% z3ctQ!9gqoUz`wp7v(zeYj`Mk;><*U0@i4@}R4}BvhKmvzhA9@8?q-zYcI`e>WL8$5e?Y*Che8SlAlj}n&%gWAt*h&Mw64Qn@^g|-feLu^=mfoC zWrazph}?Qh4ltMhEx^LQe)RAKlkG@CYwLZ$;(TUn6{)J)p`4S*0aABrt@gXGvm7Q- z62RLcX&Hlq(7&*7?_f2=)%kdBsOwW(4y@7Rf~%{C?!m){oR&MH067NIQ9k|Kq)`mi zCaW@gdM@*R!D^#y(L{_JiW zy5h!amn5|{WKwbOb#ygkRk8khSqw553Nj*n(C$6nAz*j;5f+x36$R$aOT*Jw`Ghc; z?uBWWn$nC6QFZl>p`o+Gvdlfua4anB(P@xtj!;Dl99anGcI)a|}0*E!{c; zK$V%D1~*M%9;1zE8(H}cRG0OWt5*ABv?!SuQP^$TQUgcvHo zjDd~80=TnzWa%;5H;rg@HJE>3vMLWZNldXYFuW5LeT;@CDJAyGePI~pQ?w6E(x+!f zV?RIiH~dfm)+As;%*o2Kwzn^LI&|t+o10)~yoZMSb}a@#HmRvQC%GrY62VA5!bEA} z5exzTBz09ax3f`Cz?x5wcS|NOC@!X^rM3_ zB|W{>7XIXNPqe%;`C}9mvbLu0vjSJg^A=uSV&O|m=5dqJc`0#m;0gFaj-O$Y$^cCL zyBDqR+}^$_vU`pgxv*O-gUS+j0%p=M9WDAyNO}Yw z63MwD z!thSst87U2bD_O6$gNI;BXr3b){ELc!(?_N?`lNs5srd)vK#jRU> zT=*cgX7`wvMFqrDE`luZED-XtILs?2*WcO;f@K3ogZIQjS~M$N{N4#oeYAboS$pYu z4;8=HwyC(dq*aLsCox7lC?wW->7b&%K51DB;8@*e>OL?$9K~Ml*2ZOUAk?h=9gonK zhV~E@WHnP{PIb_(2k>5z`49>$R>!8PsfB29*NEvK3~S@GakV*5SNur-vGw;Xz$QK` z>h&Sl=Exx(LqkS}r*1%CnIkJ3_1OpCQj*rG6q&Dg=(g{mVM-%eXML58t6cFF?G-_Veh|N~Co?PrLn`SqDd#0tzj*Joz zvkAk&H8wHX1P8_D>h2_D9b}$XeO%T$yB9d(Y30|<%D~|7;}hYACD6b>9m6|5FyL!W zn4FLiDERUq;pCg3m!OW0F;TdTuG0Dt&pz@igTr-lbW{+MF$Rt?Ti(~NIjLCR5Pr{V z=#W#ABZHcl5U{or8wBe|NWIIpFovw+%< z&>x+P)}YlFQ<(>Oy}=Q2C+1aHYg}z!r$HjXr3W}lWr;* zEdsu!t~^C50~HMgYP^u1Ws~)l-brf~1!6FOdi}Zw{n|N-R0(ij-q(2yt*VW{Ps0=q zb{GsrM;q)vXSyo(m%2@zyc~)=PzhXS;iFEuM5V#6MUN9@bl=HM$4QG&SZ2E8AxiEMaeX$AQoec0bHQEcOpe#Z?==!ffi@130 znW;&;t|&TDc1<(#=XRsJ;5JdJeZo(I(Qy=PCRD<&4!QK{l)2b22#AZWh^$5(e865F z7MAou4Sc)~ZD8mBz?8*#rcg|8VbG~K`1Tq(x%y1htu1it2U zZfuT2TAI0oc{7YmzJQL>0(O`N;!J#+NYXjV%*G=lwBPF+?|~>=m$TLOl!caD3|~A> z}_M$qoLu(F&=3gGU!2Y*U;_{|1onJ#X#o ze1;-Ko7Zi$id9Gq06j-*gYskR8ye7a6?=Qk$#Kc)PaU(p277pT8>-aT4s&58rP!a{ z>7J1OPswgxr|t&^9xrcA2| zzyhxpuah`p;-u}Rq<9gvDP?^^xW7r}k~X)3e=?0>FCdZD9IUn=T>Gma=ops8Ozd6l zWBg-g1{T2K!&i$|TjLDkH+!dF)DLxg7=Ml_lZWxx**zwkudpCtrBfCWQCC)uu2uSi zi>?@|n6Yfsl1Dyyz46j_)*qoJH}F(4r?B2pP?nb#7rmK%Xc-%R6?g?i_vBCl;TC4R z#=c&aGW*3jA&c?Rv0#wqBDjV~fs@wYtNVYxa~9N&e!2?XxBmo#5kz0ca8a?6Ll)ah zQa*N9yFZ=!Aq+>&s?DuEZMcU%RcW@&xm_!A`@3Q`Pg(IBiFs6GaDLIsTzErfBePC-hl&>v`$%h#c6+8xgue~~P zaen4;*E7gg;J14oWdDFv6zy8T?zbDPWX}H4spPtZ_4wZ8lD3%DY7!~I#o=(X+vO$T zj|5$0E_Fxlj*ZZ#+$)*s5+do7F_)7JE)utZUFyqzpr?%C+|G@yI)0=Ed4yq07~GqC zF~`Wu3!HD#d)RD-bthII=jZ2AGd0Diw*{3XU-Bs~iQ3Bf$_qh&G@5;D^CK-E|d*SJncK$25aivo;$ z0Z%l1Zl}9gP@ri6C$j?Ba!vv-)?vwmRh53|j=&|4vK}R+2$A z+5pipvNVDF_TRsJxotv4Wn>{?f`N%C3*cXEi9V0 zoc7$5Jv6P1tgI$S6eLiOF5s#I1U8D-v{Ej?x3BeQ)j5{Pp8RiC^xt0bxV#iN4&Iq7 zlI8`qw7i%Yr5G!SQtF9?y~H_ZyK;E>ba`{rXe1ZM^=TFE*ZYU))#}iAA+WOKNDRD? zi-=n{A(cDFW-_b`N+##$ZxGw|fU-C{RKSkL49~u}v(RkKBoZH}pDf3BaXUMKXUfh% zNDF;C)&Zcx^c(OwAMMaHvZ~kWFuM|*{~0r`2;H4R#o{(@JTj}w^dNu22EYd6&~LT@ zc#Isx#5UVgEyphc?Rabr%ZfrizB7%9DdRF7dH?Zaa)XGp==eo;W~LW)w#EK-*J)81 zFMHScvq`kYZcS$pXdvk%h9;!#O(fC%diD1>(#+6j79=n|yIB8^+yKusieMpHw+9e_xWI9_P?&a8lfLTH)U{$V(VPb(SrDckxj>{H@~7|hHQr>q}gxRe$|bZ?+OB!UPyX(b(!upmZ~qn%gjhp zR9~sJ-7X2d@X_#i^m}uoZOLk!4t^GwvJEbb7Hp0mM$l;;s;@h57+%(@AN4Kg z#(yYMgC(9F?~})mC`~zCUxvMQ*9R%{m$UxELYi?bEG*CxSHkBo6ZVmkw!oh&D2#7T;hyt;Bk zSeTxv;lTu7VeZ4IA6TIGZfPNh*JJ_`+yQ7>A1XrS+du{znX^;52+wzHw)aTvSQ5OK zzZx4y0DiA=_p9Gf(deg-^(Vt^KE@f*$P*8Vo(RM*#Un%PQV07`Seh|2mizr=n0i;eit7ThI zbjUc|K9JEd_UBR6Hq=zj?QqR*FLwz*v!lTi!&){4y25nokcT~OtQHwoP0Kbl8&pW21ThD8&_U9`eQTu>ONI3 zyC9|kYGPnc&|UJ2+InB0x@SP@EX~9IYILZnPOiWA`I|Bi5=Xl#0L~^%&Pe=VitMbO6v2}Lg zf;>MoJt-?GCrLwHp7*IlcKYT;Uy&XI{xnfsY=}htGw1u9tHiRV8>Ycg8VR&eE8F~< z8ci#!%S?SeQc_07qQJm(8pC!hlCY4l?9^0J*UFSqmQ@x)96x*~aze|km`M8wEP;jX2i)tDXCxf_{{rpsW3cWUMQtQ1)9t0Pni{16?K)CJ}jhFO0 z5;_zPRYk?YmkQ}8V!X+1R5Rgl%FcIg@$s|4Xh#UzyM6-JeO!as|P6ShYp z8hY|sJsa4a7Vf%=v0S16;U0$r5>`}j`0EVJ>Z`Mt@Z8KcJRZ{w+xm%WE;)&^vZ7RH zG42b%w3SbPx3{;`3x~&WJ9|WCwq=qH?{sM6nzb)@fn`u-<(LmicjvC zXba$pX*4Sv$KdeB0SAzbDj^~975HqRYz|y0sqUgmvkaxb5e9U|9q9&<#`*BULsZ0N4=Rb$4<0*fH@9Dj4I+5BQ^_rv zIXN7VtBdxq!`x}`RGci-YXLR-3pzI+w|5)E+K9l&u)(yZKJ>fn_7@Aw@ig+v%D`uX zSXd5D1!TEyUpQc6G`7%}PaT%zasxxv`Sz0iFuaRFK{}r=<(lHpi_K@zO)f z|68=$t3i%U!~Oix>#IVQ6c2CH&O|BrhsQO%&V0N8&=;>?pOpR;3vDLAcM}T@huKn= z$L4k+u8t-B67b(%h^t{sX{l9FTb_o*6N}0#~9HbFJvehgXy3yez zkd_NAR)F$nj;K%ASPewRAvo@R&797S_P8e^q!`xKY=v?CZesy4d6*CGDuz7=0PUVQ z8Ba710`M{Q^umW&=!<|&_?frhZG3dZgX^74ozMF>FBf7WqbfaYAjccNO!xsJe9OPH z1plw)vAqYvvfj56>gpmQWq|B)^X;wNT}V%htNomohKU@DbhBc)_tgmS;}jKvcn-X5 zqrBV286~KSpO0Z(`yU7XzX!PeKcvQ3adL93qKn~9O-&?g_VAgC`2dm;&ZPZtxNSSX z^VybB)`;Ijz+XF-b4X&du5CK@V|GTpb25-}bA3BKb&%j8$r^e6k$s9liw4@6ytL{h z2H4N4$z_1Mo+l@v}g3LgUn~#Ut(dO9PYsfhcLVw-J3{Rx9=(| zDfWLQ3&3g0&!C{1A0JgQ&d3hi?YQ%0dvRe&B7Jbd8d&gphX+3tsgmkdk3$-Kyv0-c z!<7}DJqu@J9|1odzI%F$@7Veg%4%XwH89?RK|1@pV-Pxyy0&a$tfQhxBP!VgGJ*nO z-BW-^aP3CSMT87ebqP448XJ~IA>_luxOZKpm*P05d1NRJJzg>%osk6 zL48)}^B60qpyRYDE@EL>OG|A7wDIoF_8J^~RdCs%xs5gR8~TC4bys6^?l?-mq9VQ z^xpLcW=nIu1{>>nD}4-tXFwPU;84lSE85u=##dl5*$DvfjDZRBn4I zC21y!;NccQCHT2KBeoi&=XXN}B7aR*TkLCK_CbF-JtD>qe`Yx38`-W{X5^@&Q>7XS zg{)4IIkLN$2r%}mG*bn5JEr8Ou5Qh>>KBOK4G9Xvd5Qbsqux-ybU=L)#@RhA3}HY# z;uaSLa6A^4fwGc<1xu!G&04XN*ceoyz-JAxvg6#k-lVzfK)6D2i)x;jl)sLXb+WUv z+r}Nu77{>!(Bk5YU<`&Z3-lg<8EdObASd9ei!k24$VbEVl~GHhA#!A}sC&gF{wJC+K8l)#rc|U3UyC zL~DQ7vg*lS@1#54zsZ|;3?5S{=gqM*j(~Kc65T?c#-es#{-eMi2V_xSSRZXwQmX4E z&q#d7prO4x>Vd6B%tphui05R0`OC=Hbom?0!;D0)ORMLseu8KV$Wfc#i*|8Sxn&sM zGt7O8f)5wA7*%XzssQe4?1bsq_c1L+FC|6apMcZ1kw}k=XHeLh*&0%Ub3vgXaKfPL(Dil)c(cTKQhuwh1%a=A~ZbEHUXwB{dC?O zzCuF7sLl~u8$&`&rL4wpd<8%F)}`-QQK1qQZERu%ux~5;vG&Ng;D7cC!$-b9J})d& zwhZJWaZDxvZ?l7QWw7XXQbpeMry?-M<)rPE7pOKNY1m znmDL92%?cv1pa}-AP$VGF0Lxgld=yKq?Xm8Vpe@5E~%L-zSGH}pr|ZMGh>{=7}!6Qr?uX|Qp{lAsfW11|S!@KH3EM%PcQg*|?7$NvUJ(B=K1AKw$5(gO742} z_(^FmzaZ7(!t;Y2Yeoj9)($9_0pru;aAB#Q_SMDt?nT4KW^!3N-?sM;*5g>5j1A2A zN+M!V2Nh(kGDRTdw4U->yKG)R3z+EUcT*t;#d0m?H=o9d#kFS85SB3GobQLv&^paZ z55kEYoJ{OW2p6XAtUj>g@B9AhvYu!y-^$PdGjlA}ggzi0)$0ethk@dUALlVb#QZe9 zx(W;5JoRdX3k$1LaDE=&cY{|b@^Gq*+P? z`A5|vjf}0k%Pv=G@TzXE!Wr1L{378J95LYOGFDc0-1_Q@Kd3yTd|@P#bCAIdP={Xt zSbzxHW{WOEhr@+UgoU_CcbKB0r?ke(a7#;5pOmI#NogJ}BNgkb3T{Y_M!B_#C3O0q z{&w<62?^r+p3}<_5fDge8584&qEQfR103nq_LHGjRBv+f^N$Bun*$dyF~dO0*Lg|M z*G&7MqQt1I++0rkv$?m>=~tKMKf^}!^r{(OB}-eZuxTD+>H*@8V7Vdbjlgh^A4yg>zGBYT@RAi{a)41f+oVisH;U9?6(q zq|y@*BS^G6RdYW$IE1o^(FlG5hPSZeD~3N6>WnsMMJf{v;`ZT5U{Aht30cp8D$B}R z8H;1zRHvZ(-mV9BNs#W~xLKK>NxKEYtrvb*d%zM<1y}`c3fE_}&8K z!9Weu@meZ2l6R50Oy>3LOPEVe0T>`f!y~&}wRmBZy~yC=Y+PIN1#1EfvBiB3*_zm# z+bBP{B#p#U1yeZEMbN97eKb3qN4NpDToj94VRW=f}T^U@1<{F)52jqHHee_ z?F>(_^I4)9zs|vE0qgSIj0|6YH_^)Zr%wUk=cMd`JO90}uZ%Qtez#Mb!fy7#1o1aP zK;B>4bYD}J7()OtD=4T*hknrhH*A&MpCFWmiG`l*mSZYJzuVnuIt&ET!De_MKU)P~V8z7PT=9Wlc{I6Ui&!m?uE-O_Qu+jD)#Ax~A-lB;@ z)we%r_i#EV2uSNaiietYcJwUocfc;4@O*Mf@PIXminH*W(-Jl7S3YKm2}7nec5fdE zUbUkNs5b9M;s#3jsUKWM^~)W~!Tcx*`-)168QC^Bvh7b&!rdy$N=i5QYYOj^a*_M! zcxIce0T>zfZT|!fCiD6GAA!lKwCFpcNq`sBUn0Yjrp;MVsc@{o@M`RyVxi*nG(Itp zj*i~d!7qzcyT%fpP{I>I$^)c_#lT?s(@7Vc>BVmyi zmx`tA9%Y~<>F(?ar|XxI@9A!%rI{aQX0j-9>=-JWRy*mLhGk}CXjHk$i>XGgF(EFB z9Q%^Wz$gaj!`8agAs}2O>veXdfP5;JtGzQITKS zT{o^Gh0+qtd-D}EWlUfHj?~Sx?}Nh`{)_VPSC8WL7X|nWZvBO$req;)vzCPna;KoK zrCs3C_&b;k%o377G^U;;H=o-wj{(&EUr|^@ z2<+dY<4vKz$qv0+!UhfKkQ4O4{Nwd}KS!W{2fYIWoMAX0k%tSp`-$kk!5U_G1B0VV z4R`PV(YwCA@95?OWT3xaC}^O7`u+MpOeni~lYax>{}UhZ|FY7N1MW;fZF77;gx5?) z)}fp$JKUR)u<3Mu=(;}H6si+g#1I}nq)S&cDjrI7y3*gHSqZVQ2Px8{ubv?UuJX-L zbmp~rX#BWhh7D(exG3&w0)4tYfl?8)%iwc{x`;(P#wW><5#O$Jc3<7#3usF(L zrl+y%2IuGJa`}%(X{OC}rE^sejU)sXH;(OB0-u{_g`L-ggwu9R4J{1~G9KBpRHXtidp?}NBC}0yuPk20%~}+Q03H# z^QDz@$exe=Y7n8I%9hzwl$Q^Qjiki%%JA=PflYrYdr`s^nzL3V5#AndXk-$^s$;SJ zw$jelcI8+|i-7vvcFcEFX-FEX;OKN3xTkM$zH2}gqoI+3;Af8qTMu%ByYljkg=1O9 z#sjb_26=-{Y#w8#)Di2#qHL<{OsU?L%?`I#L>D*QDYlGq>|2vgEU(?qQNC>&HPJ8k zvIHbwvI-Lg#jx4s$+Bn4AFi)gne^PMgbZ)pal0eDIZ_k9_KvtkicBK&$$(63TfQ{# z37ll1&L3}8n9W-#)8f`Rob~cTuNLMO2=R(Hz6z!LZ`Qc&Hm0HSMn^}Ab^wh=IdnK} zJwiH;qjDKKohR#jl)SaI;-L4#@5X=ri2dpQbRi+NAPHGe=lO~>{NnWLync{)8< zBn_g>amUJz0W>!#=vY&;3LTf>n{j^d+#GjR>7%>1#px%?-NLF%vXyBSm6au97$oH- zeB|C2pcBNgJI2U8Mk!&)wK7CZ4GidJ?Ng3dBZhxv%4@%DX`mMN8jHfNp`_7WtSm#eAik)}fK z+|l`%v?^w6YbWCG*45aU0<^W}GM{Xfz&&X*?Xn)A4b95R0bGJO9_MbaWY3HHj|T?( zc%4?>s;P-fFb)j%<8j%h6nFu4@;eF18XSj~#sSm1x?j3~xn?#EO1x-j;Ll)r-P)Br zttQ7`FOoNDX1YmCybv3pR(&8qs<*gn@h)vD;WZW2)y1KK+{)_aW`9vcsXuLgG1H!# zpo1Y}cArHZp*m;P$%#l@oK}?D7_Uo_mZGFZb+_N`R=R3*0Gc&z2gmS~!ZydfSCl^(E2!G(a%EbW=DY>?n;J#j%+#D^S;pFs* zTe=M3ArnX@+U|ggC^WcYMbO3&S3DlvTMk*#?=_q0{m|S@_Lz*3nKbepQAS?))~}Ht zFXQpK6$cgi`{8*ST-reAb+B0!Hge#pA*5Q-hc6~6h5yEIM;nG9aL)Hd}G0Vn9W&HQX~x@gN1)XnkaO?Nw-UtL{7Ky!0ja@=CFf=bgn z)qV6cw>la=`)-SNbadVwc0X-JP1n7HQ{hG1SmU7!NanJvtgIun?~B`&D^tb9Nn^_N z)x-e>PZ0jX?38O;)&8cbskcN&w{~^m$Km;GUXYPP;QF&Qx2h;ST;I^J(E@4)G{UZ1 zUy4ggjyFz#&Tv6iqh1QA_^x@y=18 z`RqFD9i`k;;mT02r&{MH4NV=&c~y9Sy^B~`U44m#1y)Y!2?^g1JSKe{Ec$Lc_5KJF zK*#6A!qh@MyqJyP?T#JU9?urBG%WY=Nq#G1vkPaI!|#}HX(DGE8}AR9sBmLph0R27 zyPY0I(?z>ROO{ppgfyr>S_*VjQdZQiwcp?N8(-Z^m6$3lDQIi&E-ff!pr_}s*@6#k zIb3kmTe@-(!M4+A74h^nT$x+KxJMho>XkCpSM(>$eO8D=MuZCa#$tgddI zH9$;~2%0Z<_O*FkVWnYITsk9!3{Vm0s+^b@*ZTo|G`!@c00c6Ae_v|sG}?(FK%io7V+c9%XE@-*UQTuqtyUJCeeAewzf9o)2D^3tmb38 zZ?>LjPQi~ghcbc$KySX~*`d_j2yE%zx2{J~jH0OCf=HnYR&<%QYO3nmFeg$f#)kIx zr~z-Gq{|aN@(ZKGLFZqLTIS-Q;aTU=W-_zEuQxv8a^~y7uez~hm zE+iOjb6j2P7sS@~6>OGhds@C<24b~ZYqrlj@M!;F*XRVMa%Bib?2fm@=dwYL29ifq zD!<)DO>uLW9~-YtGqZ=#P}*j_;S1lkxZ3j9nOy)1|D|%J?|tB_YU+KB6SKz>g&BP%u9=ZlH9tV zSsC(u?a0qSYBZL|E@tC99FD^m{49va$NKrO1Zi9y&gY-dPTwIt%9W=W;#$aL!=T z<$W<8qyFX28Ytb|Sy%^AL3x=){3`elj#RoEpY(=sXGDfMS|afGc5%4vCqDfW=!xU# zJJ<}76oiC^hqH_kn_@cm_9mi9Nmya5M&YI2jxRSiHeRE$O>k9{1Tnm|5hu=5 zF<9Ev+MveJQdh6i8;|q#%?aR9;j-RX5S~ZJrjHvq$eSuJGC5|fKz}H%g~K`5zqn3B zAQ*th?K1d+U^<$qENQlZINqc39=jjxR4i9zNd1vP2#2D*)Rc|E-WI3L<)tg^a<;74 z*B3G!b-a(hPA&;8s;pE~7CCR(9@eU`{&-lqJy})dR(znz5-l`^7rD@N$|&jU7Y;3m zYglx-YCD&B0jpWcCWxy_pbTjaLUECjnj$BF9sfGtcH7xSVV5BP%5!;g3FG?eweN(>O<%t>HWpC#@daCec*@BXWY9(35 zl^Gr~;4$#VwVI3f{G?`L;>*+YHIr7by;JzHJsEJZ8vz4I+%oeEzXc85Ro!0SitRwy zG<5O;$Fz95%~(XJ=`nV%Hn!zstQ9EdjJcko-h0aoL<0DhiP3U3X3ZxLc&`i}iqY4W zpC96Y=kHumz#IW-YFfHHO~`&^y4uJ#4Na`EBP`_9!NFF$YU?~^qWVe0{gC{&AG`ge z7;SY|Zre0kCmq|+`}f>^ad~VH_w-1LfFUQSJ8)neM~?!i{*5|dWrm4CLBD_ol8TZN zT4?H3JOS$B0A7u~bM5G@yHj}F#wQ?1GAlek6`~^{VPO<(Z|ZoeMZl=jz&qZ$q*if} z+{3F?X=vn{O++&0Fn?G;1-q#HS$=ZaWZ_z3-t>*qMyw)cyXx8Lvmo1#m&3fTCXw8~ zT$}vj7?@ep$Fo$<`p6f)xu`TeM@h*VN{*n*ydWVZ3q;vT7O_I#nm*pkEUZlgGqK59r|N+^4wC~#d{0O-X6|x-k+QM1cH|&HR#cz z@pCykcvvVY>I!de?yl?IIcQ5(RgDCDve{R^PAe+%CfB9QoE#ln1Vx$zxd|Cb_{8*u zh5JtfWj;0Oq@|_>TD3j~1!DW@qNGSj(X%Mq`QafR8v|?51%x!QFfx-*Vuptw*9*L( zS(6@8RZ|J7G}qV922Yx7<*j=Y{%(Ic9>Rra%*<#b#trWlJ{237n_ZMV2DdpW>xL6X za^Tp>WYuRev0Yt=HXF3GGAlTRBv;i?Vp}vkrYBuGpJ$|3py={m%kH7!GEZ9>z7M;5Ve8#-H3PO;nexpc{UpX*wF^}!DRp}NPag(%3-q^@4oZ+5cNuXi8`yreNvKCjcVJ;cKEw1xR`MBq9F-+ zdT97=E7nrQqv>>$iXJ;wl2B9HQIwaNcc6z|(sB5c5c6@%_dS@z0+;d7Z0Q`|$EdB^ zT3Co|W~vnl^meM(wss|%9<85%WF1Rh3U{i;u77*?q1QP&o=F!xdU9_ac4>6JbqUzY z5&2W!y(BHI+{SKym!aTtIJvt@h{MRSBnzv}<-lf|+>XefT5TUkq%~&lamz;1Et664h_LGTzgg$E^cCz>Ced|IPd{@ z%3A(=?~9!fIwE{Q1N}u@F58J-5HV6qOL}}R#lm>nQ}@>5GHOx1Y`f;^%XhaZFs?ID zcN9MG-D<-F_i2vV2Af9L&%iUA`pU}66n}2lBaKn|w(Zw@%Iebjg-KrqB39}_gUVj^ z!9b6@cKB`g<3rm+v9REQr3`=j`Ln_LY8NwZO^a>(7d^2?B2^D7IVwN%K~iek+QjV9 zq`LgYjJ@Ee>uc*lPnY6dcRN?}_pEtNvolj&5pLg#e-iTcjEtnT<%qYAo>%O@2(Gj; zQni{(7D-L*(m10vpk!KYw)l3TOHJKc^s|66KSxGZ9`#}6`gl5l7)57pj&+fG6>$pl zRPfvx)f6*R`QoCV{Ezb|v!FbK+}R48ULPtwBKIFa2oDeT5yyX9_|~FGS6DtU@C;A0 zMv1zp2|^;#y(}-S9B`MzZ!BW4uRnP^KQmAj(cZpy#7*v=^4{h}wUBn%+|tsMr%#2% z^1Yle#gbDd9UUv|?WNb9rD4o87TML+F~Lbh5b1bM*8J$G$Pi!3Gd{s&p<-wGR<|Dy zgLP$TI-IOWMHK}u1tlfJjPr9ga4Q8!&Ul?6w_Y|C+(UAp+uGX76Ab+J?SGN>mT_4& zU(~1)iZs$KpmcY)AdPf)Bi)U3NrQBEE8X2lNOyO4!x?>^=l{Ov%lUHr$j|$}=ALV2 z&z`mSTI;>v%8}LrtVL$5oQcH!Uap|JT1H)?#9J7sAk?77Mr{q5C9m4my7x}sC18*T zo||KxYFjER-MF3)hJNqw;V`o>vuCTRsj-*R)CsUW4VlI~-P|vyWvdt#H6r=BxI?Zn z${zIpI)p!*oMr<$AiE}}9me<;rJ(OZ8WU-u)CiP8mCM~nmX_4QQx*MGQQBc29D115 z)zm-a=0KI>hj(;SO}E~fi5`sm?Ig_HBN2k?HC!bIC>_Pl*LWhMpm>}OeN^R`?S|Vr zcv>y?mzcI4zV66c+lU>`zeqgz>e?`eJ6*Q$d_0!nc3n#IYr4eUYQ8tQ<^Hr*YkHVz zQz{H$Yb4ds%#6Alkss<+ptVR`TwHB!ZA^M$wSogewU%=GdEIO1WiPKoTQ5E6Z6x{Ms_Hi={y21nTsyD}mEXb4=?6s|A>|^HWZzy=Bn| zVtu`IUf57#NW8f@9NB2E9}QW0G*VK-%0ZdzoO84WeBaxNoa58p+2$1F$UZ#0|FvrN zC957#wCl|0@50TU{_?#6;;wwDH znNBp2OxTj1aQOh1lP0nL3Ketw_GZ`Q82S6oZ)pKJABX9grKNW4-?Ohp5kISH@j7gk zcwIk2vg`>HGSoX_z(S(I9!uqp*Dc|98pQQ_EIv`g_^GzCpza`>hAT#X9D^>2%Vq&fcPncg+e7WXy!9Dq%Lw6` z!*Sv6Zw_L3o-ZDOtDlSALzqA5FOQ2c08NF z5t_aClXh8ksB-8T?xP{~8s%H4o0^*1>(zd8y`x@Qm~dWR()LpY7m=;(lRl7rM_}!PCjA+OO;a(}4{%uh-A;^2U;aFvvF?#x_O)1Zc!=d9HV+O>#iX_xk+ zp{Xkx^2F6eYt=u;>+sc5uN?g-iwEdfeojdjc2@R?ncZi3`ANIA4xa}#%E|G;&>e&? z@2@R15UNEaB<{N@?d=O#Sej{ber5@R;G?WuzFlzFpav*^!^#L{BbuzfQz*{|yUiIH zzW2|xbaX7WReoRb4{Yg-_n}I1m7!f+8tz;J0!X26U7#8rfncPDgnI3}2vKie#MfEc ze5tZXiBZveI~(v`r>8a>Z8&Buu`|{7THLi+x!Dq>g{1j`7vH0zhyp>0OG080+2j2? zFC|5#z1`i=;Oo*fp|&F@F5;XU;}Mm{1MZxH3h(V~w)awpn76QJSR31E<1nA7B4d&B z3v!^a+Xm)Hfx^c20c0AQ$A^`N+>?-ZySt7@6cgxFR1~1U&RRr3>G}-MNY9{;he!3B z*V=`DTIim9Vo_!$3Z($VYUJfN_CX+?Fm>O<~b71DHYs48D>l7jiV{c2uS9pqn{&5pPO zGm-mf8=LIe?*eFVAGm){?Rmb;zhF@6u{(qa=fZpU=FMs2wczutlk@Hw0>F-uiNCJq z=Ati@cEVp=zT1yZ@5d4!sZoP4T76SC;!u6b*^r7!%hQZ`ucfAB**AG)v=v72juQznW8YgK+B~h8ti1hB$OD;ow{r<#+2?&U* zC2d2D%ggIBkxC_6nwc4W`C?|FzrMN~7nL?unF+NkCW#iy;pT`whR`Lz%&Z;Dt*@U| z`o#i2B}JF%3qIcAL8_i!R`Als_BO`WwoC%!R8{?{$)+bK1?9}mcdr`awa_=VLxJ-%TmOh5kC8@X zvazn=FP%}h7I=RhQI`qTk<+XE_~c2B;?&fT5VMEMVdHL7{3^dXW344#ksea(x@PwW z1%=71Y|eBjS{h16z1DIlO9ovW-JeQq5NBkwtwR@yb~E_?a_>?fd&0mj%N6tYUOaXb z{sb;C(Q?sO($a56^f|d_=jK#rEAGY}@HvNOx-NE62}XXyNf$TFHLPWIFs%1Th=0m` z|KV*pHAR4%t5gza>P~h~04YqFit10jBw0#%JvI+A78VxuN^KihXpW-<|8L)JWBb=9 zCKcJrw4qTV`}#0Vvog!>9@(@dQ?S~aVcR3DV0JvRtE;76T3h^1Z6vD9m$9*P06ix+ zH@=tE4h|dpI+lxw(Xp{JXYHIblsEGgj`c~D#igF|`b??PY)twNbzHhBt>3EaOTw6E z?;)?%?Cq=G5S^$uMtyDP^Ex6}GeOGttxpWDjDZx+3&QN5F)+yxWsUrCFbCOpl6e%V zQ8Ps+ZaMNcdVe2xs?;Syr%V2gE-r~u)4zO$H-eh)8S4lU)-eRcP#HL6l3FfXX^5RC4^WZ zQvzTdn;06t?8UJ?UQpE>hI{GKBJ(H9VJlJn;WF;Zu85Ad(Hn7&iHTZVV9@;%h$!K3 zPB@(9{IJf+kVKrfJ`^!_57e%ZX`_A+=5yh6SYz+|f_PO^Y1}e%O*MT~*H|x^%J@=G z=Bj3DUy0UV8@1hhn=RBkmMkju7zcOndVxF5cp+A7J)oh!E%B#y`vIBEdcS8VZgP^; z%qil`{tK_E`#A*#m2H;R^HiO{vc8IgAE?Ga0fO&o#{(j>of8jT=|3z0D!JgDAF}pX zRMgYUb>a>J9@ysPg@uEIy**6i(ccpbvf9rV*!xEqg6PIF>3D3qze5!FSGJ$VI%T`d zt_dGb)B#s-ypSZY`B7vI`~HzECwW5%k+{aIw3!kk*uzUd}{$dFZO5 zl8O)Z0S^v=&-5u?#xG4N3O%3ni5yX#?*qKQg~1{v(;Lp6pb%`B>&Zu>5@D>f+7~>} z*f=Pd?fANJYiIr*zpcz~c6Wd1f$F2^o1Bu>?X{~^IqvhGUG*Gxiyg`7m(L7%Ha$Q^ zjX7cfeIBeNB&bL-Rz9h76#Zf{StPTK3mB;Q450k8c5AM8TbiqUcxZvXxk*WBwgIOK zH{0A0A0KPIWHoT8`lTeU`d1Bp$+dv37AjTF!$VU5C;NoM0s^@Yq?OzKod5>0wukG{ zMR3yIaQ<5et7SYMqk}Dr`CVpCNh7_b?W0YojghH%qdunWhX>=KB)H9(y*GoORQs+c9HaEH|+T|g>|g?Ku#TWMBQY`It$AJci?_U03n&m@)cS%SBX zDmHcs=6+L1j<>oO4Gm3JM3#Q~QUf3;AZb%jQ3+6NcG9FzPB}Ot+Z}A&Zc1$N!0M(3 zJNXE<+_s$Go^Uw{K6r?FRCqeLeBAv0d@pc9rJ$8}{jE15J5P$hYa6HdCCY8uTjcFS&|yl)cPKkY1Ekf8pvH-!kR;Etu{8=ez=&|Hdmr!VPc4i zju-zVx#YBiWn5;?cASuerP=5VA!4|_LF;Oj>a932JqZd^wULYhwY2;gKq%%O2xs@5 zKW^-vo9zvxdtLoV36nH)-3q5`{b1~ZlYa9k)A}o!N&mhk;++{XD(>}l%dk`9QoT)@ ze09tD_^%U8%(Ww7k0~U-?X!?>5cZ9G@Gm*MA*9U!B(yewiJf`!)21 zoR{F?%$c1g`)dz?%F)y9NGliL;?Lt_ZKBv0WQfAq!rdzO1OzCT zgH~?a!$~zR<8$#-Q>{pNA8;pNRJd9}7VvQ1)$egft^3T^`j%%YeBm$*)sV~M=josnu{7}79$O^pZq-tt<0vfWwc zd8zLX=_?51_v&>>RvyCFI(rNIUVB@+k^X`A$b#i*!HF(-`@!Crah+)5UVHtk)U1qb z0KxlOrxRKpWidsoPHzxf(YM~nu09T#I!}HrY4cQ)L;|03uB) zY7+9ksFvgB)qrG}O+jyd3=?!HDh97i%&j&kE zkfc2#Q2#!V=ps+oTc4g0{9|SCJXt~cCgNM3Yq+_)n;0JMcwDYMzO+Puja{0Nk#YB6 zIN@^}aoUWJRZyI-Z!-EwGYeD#Z}0YxN3@%=a!PJ?$ zNQ+4p1!vhm&$GgL#r}$fM#|x)wxr4DVQy~j?pG~eK%gk#inmQ?t?AtW24C&;=BH2M z@PrJ^JHv|wK|9{wV~agNCXB}e!|8GES9!~wlDOJHw;>D>lnZqIam%BenCkBMVfuHp z?;Xe}pT{`tjGiv1%Z*0}?jNtyo0@t0DcHQKOt-@=Qm{V?3nSt`xZPb)oM7kO9wlq$ z%MjGN?+&Fcd;Qiqru%PJCah*&_v%c{&AoaCmp&V$2ageLSlF`@0p;)LTjb>AI}RM# zO`=M%${6V10bF{sPLm8M+S0slJCfU4%*YQ~l;ad*JylNma7x$5W%$ZVi%CRjRGCNG z+n;WJ$oKabB7(`K(Oei4fJ2Iahi$pu#GH?dMKd>7l}EI5iuk{Q1@u zVYc`0-}giiI^Fc0_7x-q^z>9z^fg`+K!ssTl~rYB*$yQPlZm>!i|}~d!RLKekONWg zTd0glffY3cZL{a0k)a{_*Z-|&D0d%yYX(N<8?$L+u*Ud~pJ;e_f6S`@2ERr67gpxc zXQ0#Msu^1oUXz$OE5r9J;^}d7@?(Vj_%#xN4e3mMW#!{1bBX=n7~_FKSFd~{Te%`% z-_+#BdEfiY4P<WA!ej(sLF}`za|o_Nt7TB_shv`&~u9n6BHIk^ctvF;Nsx$_qFxSSOd~6 z<-h>2N^!m*FPYB$hPzEiNqKktwUt9CK{78X$xKm^<@R!;kcnf~#lgV=2p3#zTV-tq ze#x?ZygQ7Ym;j(gfFY0bNhFi|V7yGFovqt2I-b4N(L$nQ4Xe@=#pT}hSR?`m` zpvN#gJT$GWMsDqlJ?y~{t>>%n_r`uWq)s( zf5&sd2nIt=PC+SXFC;CEk%hY&HAYD(ZmwJ&9UoOwU0qgOJm2W#WoHK`sidk&Au05h zUa#wqSSQ>z-Sjk@^(!@h^}C3xRVem5zXM<2uqus4*O(~*^-5R&y1JWE^{>k1i%Fb@ zdLAAg!omvX=JS0~pyjhG*KwG`KFoS=QQExO1Y*dFCYZ`Y0eaPI+g?%-qb( z&tLTIf7@hKqU}X*hK{LeS;jlBn;n}V%Qj^=I6GywDG7BdO3Id-HLsNGZrG8LX)+ob zU#^Cif=7$#EOv9UPSZYFdTX2f4_VpS`iDtzdTV;f429*zgt#luOKzci`#43##Sp%N z?D9bQL{S+43e(ntOutG?!JUE0Skiw4{uRlAO;`1P?f>52&IegE77Lgz|Nae6LyGbK zUp!<~G0xrG0Z5Byr-5LG;h@+(?+?j@AU&{dfO?)CXQ{IrVCm!Y-i$nXAuW3?(NPFK zBqSvEcJqfFcjJaqKrCwwA*FPSY;Cb93i2HNvrtCW1wKmg&@okdIrSaGfDI^{!GwKM zp7ymxQ;0;E4KVoMuEnHvlObERVl(ACjB@(zqND#CRgm}C;H}|dO$)J4j+^Q$`^v}0 zWUih(yqyPk_jeCx&w>5>@JORq{+P-CIY9<=y!B-ZN{iL2406A=qyd(K0V7l8&)`~Z z-OpoHyLNB>TfaM#oiBQI#%4w%qoc+DcP11Z3;%D1U@~j*Ua|idJ%}!*I{%!f6Ogwx zCb0WnXejO|n14g`9v`W1|NE7QjEX0c(PH11hyd8@FyNUL(Ixrk!>*>Xx+1!-SrbN9 zOShR7nT~c6e(ra$Htvfxj!P9J)9YcFDN~;_t@5fVcenvofaxe10it zz5M%s;huW_`=ekxD&>kG5>yx>%OixRzPAQoP7~UQi ziVyb6A@zq3nVDszIzK}Oil(Nn+D47xeFXoGp2$xN`_IQ@z4+~Yr^fEyGn7qJl$Mm} ztj%XO%LM;3+C8=}Sw6^uk3=*yQStGlL$UPOl9CU#LkSFqBWdZuPdI$K2g_d1(oLVa zc<&7!8x-l7zUp9LY+=%+$jQmQ*UE*4+j_VdXY1m(wyp?7h>v_I-&Fkb8=ATPPQqhm zSsrTzs*uagLE`$d*EI_fp1HXMdHBHKAZmGcA!?wgYxs(LX;D%C;4iWzqmLf}RJQr& z8NX;~cCizgalZW%^~<4IKMTNQ3bcDw$>`{ukQ35DLOuc+4?Sx*1P>^$uK9z$F;qH^ zuR0(7KhD>B3H*t=XF3;yq%QrTs{&3p}4o-2(vgFj%oDO$i+}(-W zEnQE#x6_|4#>?%te`TTpTJJx70mE{N^4}sPxSe+j0s`hzW|?SchQ^sHuMY2Po0=f< zfUr6?n`79w(zs|JJptWSAbriq_*3WR$-_%rT+H*N{nZT+NAs_Y2Jrh$F zRu+GM(G;LTDv;lKVrLwo-Re2Nv?L-UQ=XT%1#}zR+pqgnbtZo3=L2;EGXoQAvXi6P z%59gU`>6;%G*ry{tNC>H{k!WnZ9oxfwmv-zAK}fEEA%>CM1sVmP1rv;fH4Op#cv*W zVJT^D5bdV-oe`}=>1^skLXgDr0IC!h6Zw%JgzYS*`q2`UO3)vW>KD;mXgiwK=tTo@5Y5ST0FJtijEZ-9bI}{ zs>i*ftgr#|bwk&OE+@~c;Ht18Wo-}OrOE$yp)?~@1cO-8?6RaqLPbRx8X_S`$a{8z zM@u>-aZz7YW#2ojd7``PR%|?!f;5J3)1=oe$G80XH4>qEqoqDjx-p)w#lhOKGfL$3 z7|8C`&6iHAuAsj^=|mX(P6K2fI2^8;zP2o7eLU|sH83=^J3DK6x(ke``QnE0z0Phs zAFyEQ-6!`DEJ`g}AFs$t;IeQRS&dG!Zc)j?TU|GM2GIA3m`RA*vrz*B zGj~atlba`l#TU*5QtQ4w7OJBq1l8xKKw#Vyk?Y?b0vM$Fk0KEbo{v*Sll#8M0VS%< z3zOZ6Ot3!GKo9J=R0Z-B&GY_g=W{}~FQnhMKGl@eR5Ua+!6UwvB~~XVWiPK~5>Xjy z)rPb2Lu~^CgR2G4cGG>nIj7~XLdm={a*B%0yN}gSbU@$+&}bT4o}P-!Tc#&|YgAd& za=1U#G02n3uzPGhBsnDOWu*gysif@#O3Hy{_r~JV>c{=^*5xWw30t|4k`!tVaUrQr zkAi(rIiS^UF)}r5S3T1U>VtRS0(uq$ar+~hbye2wO{*jUQQ3|MGXT(jm|nhDE>ZJ3 zSIS69!Mkn%^V+g>Szk~v6OP|V-|#1)&8&s_6MJ`lou8hTF(O4r{w2-&Oo5q+nseH#*>$ z-5KMR(MuOlZD?tEI;aor&i#<`8RQ#p5F0SDoNH@pXel^uCwA>3aZ*4}eE^Ru-qOsB z{pH@b8^4^fY!8lXfF%b0IJ7v#XU1vuhzJR`FgM5FJQN#d{B0+!<|-nE5a%|pps1iT zNVExxCqxZ4s~zZB5vFcy8;KLKRRaT*Fx3Tx#ZjL#E!C3LpB}FPEdHj1nE4{JJ`tN^ zVS1X3n)>1CQ5NRILIXZjvgio}QRYdLT-_QpZ0*N=f-jj*gr9?5O$m%O_7Lt^s{Z%e(osR?w`Il$@*!0YmWPdzarc z8ai6bqmi5y+*|JcS=HC)8NTr~@&5j|7rXLx z`O3=5zRoY*`}+Gg;fH?p`ASEGgKt9N)VgDt=UR10ttXMF?>GJV* z+pP%at!+9JB^}%H#6-f5fU+`fw9l|*{kYUemk(rbKP#!x=D+J*GQwx4)pl=5brU}u z-QV9AOeid`1XUdxR|ts1mWXxm>z>OX#-B>j*hQ88jNmprRscxTOr6cG$Gs3Dnf*TAHxU^ z^$koCzCSy*et7*SH9CIxC5zEnDuJFL3s-kFN_K?R)7|?=6wz0J>Y$*YoL=DBoNuK* zdz_POmsgcgzw@3<%BZQ4mJ^o~{8_0CM?wNQ9Cmn!e=y56*x&sj7yeae$3iUA*Wf}i z7s6#*GhI^xeEgV1U=f61^TtNgLvy$w91-WEpJ-xJMMaQE_WYd68!g+9ivB--jD=b- zxtvA{+SnBO`a-s1*XIMmC~(<6;P|%UAtNqbR#bF#d3kk$^>kqBZfD07@vFF?$^CY3 zsTHZIRkt!L%ja8l^~s=@SX|s>Pmf4SxkyhF-DRYBB-(~PO9weM`Tot4T#G?ofAU*FInc}L`04TBR-&X_4d>6MGQK&< zw6*<-Nvq{@MIC;Qi9)cs&jj1EwY6DOQzf0oOu$P;PJR<{wLYYxr1UBZTKXE>!ouSE zIB+wHO~C^>pHU4Z3}GaCOAp z+|*x&`mcjaerdlvXGBPr7ZH;a&U!&PoALs=m8@|&<9pst*ftn9^xW>aN4UUK6C@2HX zk)vr602(eXXoE$dR{fdLlyx@uZ9ZGX;i^3E{Or3o z!Av~K4o&WJXLkFJkxf2p;EKvxqMaI_hT^=PR>>5xt!idg01QVi*FK)}J?k|#rD!M` zPL8x5pfqj7kc~`Dvp_+GY5lZ+>0VG)_y&=b3-v?G<5B*H&}}P~RuM%-Xvf`@`8dL9UTYPd`|)Q4(*|H4`ZYsN1?Y^UK*92_^kguQQ^jqOFN=usy z3dnDc9{IH#@j}Y6{>~e)y1^pU>npTmmq_D12mIPduAv&jO#Uru_Wgq{%^m%XM^;1lP&}c%eq7 z^&K(}J5A{!&{YOow^{m4OnVoUVACgYaS&}DS37$z9WJvUJ-B&9+#g#B|3MlioUm4I zj`bKNLL`90k;tv{Vx0}{t1v8vlICU}5)uh%>G%|b!@bEhy*0uwPjyWPA2qLc$1&N< zm4QsD`(4;2Kf53I)zjrXy%Sse%W$iwYeNCu%-GlqbJpi^7TV$YLnAbMNy`Q-CkPLZ`i2g#=ySB18xiO$2 z$-AGDvRF-hUU#jG?u9@BYD{}YO-%}`gWT)V?5e7Vk=CmZ@8ACes1+Rl1^p-~B~v;3 zyJl2`G)Vwzw$04SI`#DA$vLNXk|>@FTfcFi8R0JS?L8!3_MPCZb4szm(9hwY0WWWRTPE9Dyvok>#_EgNCLvc(H{2z%?|cxu~WCP*%c+UiiwX^YjXY?7R!8n2BMPd$>>;L z0oEG^8ylM+S2f|yZbmPi4IJbhRN#`$k{Ys!7ABXH>18Z?7V%81=<=Np7A3xpW>cc-s zw-!#z$IV~91?|(?hbf$f(Z0U;)iqZGllwgR46Mw4rr`WiQ%L}6-A7@OH}xlt?bnwV zm!Mr6R7(yIO6s}BMkmKGP*D1Zhf$0;o}OCf=G1`cT(fjyWTgGJ3XV|pe^`LDwWg+r zuz{qW+|OKpj*)(&;iR`%_DD7PAn#}3xZNnM$<9nv0p#3%6|9HJj zBKKQvfhmC3_2EQU#ZBE!Ummq&vnzO9b$0fIh@E{ys}C~$bGGYZ$EiN#oZ7tCawVn` zK4!Z0*3icYluoeF?y4UD1Dal;yZfyFlK=d9YI+(8DPrz%pWs#c6tW|tBXZcx<6v5E zhtqE{U9cI$!`&H;!nEb>B;@4&VC2T!G3|TOaqT*=Dm_3!VKssWd;K)~M9Ym8dQzjf zpuAjJPHBrHu_nF-TsViY6O)y)r4Q1X>zu z;`!si7z}Di!jW-qZYn+|2AoaeFkc1igA-1?XwzLTX8Ng=%TSxM>{WF{dqX{tu$Wx0 zhD?FvtFoynMb5mB|M|jV0J5MCy%too3BIO}xS$o^zvx}20OYad7Qc(GbkhhJi#6yNm^sjn*qX--BF$Q;E3_l_5|P&lyFXNZsR4= zfDU~}2QjG(PJZU>W-4`bbacvy0a-Q$MWLVw8?S96JZ+RZ2-ym4d2j z@VJiOrAdI_`&L6hy35VWB_kz``b?xxA_P*@D@RYdM`|i6mbIkcb8~N>XlQAP|Cvkx za8&;Z26*hw2JIb&>4!6lpFgjzABrI|GqK#Bk7z4VYu}y5BRP81d#vY0Oqb4I+=HN2 zWKFm=^}QPvD2Qq|85oXCQxkG|!ahA3UL(O_44+@%9qn-%jAh+=J)MSvgN|WTXFBX# z7`rwQ%ih^BxnBD1&)HB?#;>8NfkBss)R~>mohxU~W}$)9DJ2y)U8*jYed-Y`rsYW> znO#uuj+7Lb`Qm{F!Qq16A&ed#JSbWM;q$e=3JP(`B`QTZIXgPWTwY5l6(^shv$6hN zCW2NZ;3}ZP%*Iwp5Nl$Nin7m5-qNxZ{WcoZ;%x0J2thJ8@SB+9LmWI$Pzb!_i>!tQ zqt1K6=If=mBPg9<_Fsqo`ZNM?y@g_DhP}ArX|@t=E{DDMXDmN}n;x(Ze=JcQe|UU+ z=l2qA=xLwGuOX@36v%uJVEA`p_6lUH1PJimr2zW&y< zKWzmXs$;T!ju!AwH!DIhRZvnQcpv=S%6^`OXli>l8ua^kT^*TzF$-~d>$cJN2I61f zcXU21tH4y~9jzp(6DGVQ8QXPAiR7BYSGne@s)=;3Bj1rqNEzsrwU!m^e>C< zcSEL`v9?Q#K{C>o2eChnp4x~m~HVk76Jn1m!Mr&y+ zf4c_?iw?#$h>356asMuGR}WWSJ-URDBv&mXqi4WDK)HeHT>;iTyp9J6<*iRC4@n6L z@XvYq#{6F`mKIb~`sL*1f}d##36H1ZxBR*cP)XKv2QdVbbnO3wu_JY`R@j26? z5=%4N_bw}2T6mc+7~C`D_F2C?m~;i{W)Wv0?|zc}BrYXE_B1|Ks!l^jCYlSrc^nCk zUHD&A8(9zn6u_-_GaMFL3Fqvbfx5o``S)Na$eb4=!vCug-n6rB{}=v{|3A_6{~yqO z=5)KqO^{*n)YZemE{oaePxLN+WZTb_ltq=>G&5B$`+@4bL`#C|H5P14wePeNiD)g0 zr{0VqxL5i&0XNid+m1;?44Y{;cSKsGy*5z#%Rn`dS1i^t?Ux_Dl(W zJU^?2V%i>p!{UqDF6bXO3QK49$6_z1QN0swGi6*6`}!)*Q%eO!5JoDA@z-3hTODPQza!>*3>_^s=s9)= z;uE|s2lS_N*x1RE=`3VKN2cPodip}Xb#+k6JRFAYS-Eo!4Z){2-D4juN=x@}aF7wc z-mj+|lvoaCj$^N_t@Y#?)sKjBuyX(pR=|NrJx;L8mw8J^^nv2d6U;?A6IS>aDThnk z`r#%NIv3IwX(Yj;x8;NHWH6duv{e36HkqE9ivOP6$w3$Pq{ zvwMM5N@!5f#`czoA75Ds`Ld|<+Yk?^&cVgtU-p9_m~MMOo~5Mfnd*a{MC?Qw`d&?w5mfA(=7wgwUhR)lzj6%)D6x@CAAUdS9lm4!fwT5Jg%oKv`tKmUI;t|LL2JioFsU701HL=yLYn zET|Z_{k6dubm+2gj)_S@L^zC0Py|V!gqYZU_!S#7W55@%V{qQ$fhMFmJ4exNBHA*` zkbwb*iMgA){2vTs^rKD}SPlrkD)YlTjkk%)p7eVK)*=(lR@bi2&TI+!+}o_&`g|Rp zEi0O{W1^#hJ5zUaM%&ujaIe|T2cr>#lK^s!LEQFj3W+cwooeK%Qt6`g!%pVU=(n~(q4T3CX(ZQ2w{c6=q^;X6 z3F>Ny*I0#FC7{zNIw=|+JGtNBOzq9_;rpAE8;IXAD|R6^NwQ~xTTWqfrY zLIw@pcNMj&i~RjSl9>svu8+UvL-`C8p&BP==y%%Z^K0#uz~G1GPZDB|1Z%Hu0W*;9 zX82I#3JIG{%(PI7(9`{FM|Zfs!gE|Sg21os&EWC2x3*7A{!CoxHcxX?T%00Z8Xw7n z6+^2;miMy8a3cB2+K3(I)R!4@S|SF+J@~o~Ru-1W%X_*7+Ms;Vlx*DkZG zn%cl4&?$+U`)R?YAxKkdv9jTcasU3p6J`YNGIqC8xLcSmm8(;AtKl0Vx5rz^-A<1r zm`|{tZ|2PjgnTjnR98&iwey(FWRITxWaROHjEEvx-HN+MK}vgvm06l?x7B4+w~WJN z`7nXawEBb;0JtqVc{%(xpT$&XCnr6&4(fXm3H?@qg)iK)di?iPgg7$mWqn;!1SVTL zSt-pwRz9GK-&$hYLetIj(PjAI^TB?jkv?F8U9Bw-}$hjp`8PwI(?&jh`H&nPp^9zE4Rx;+T z$ub9UxTr`ei8(3d)Ya$bjhT&!2(*?e%$4c13rY(oC#PfLV)kp|Z;XEcH5VRr7kGSL zVkRE^BWKX@2-zb;PCis#T8M&<>I*ZNiaWiByGN9>w!XbQ2OISr-V<)sJDO;rwq5Ey zT0_d}QNM?ZxjHTf>``DzsYSVVvxc19#yXelRthvw87(g>dEYBoNOE!|Rmb7`xuoEi zmQoBXXXA zr?u?YNc{9ZZospV6q^H^+ycNe_UcJL3bA9a*~btNVG2()+!iWlx{qlB!w_DNjrC(k z1GWQ!rO+E*jX*><=VyWikGVOnuvGdtN5^({KXq?P>d*J~amzI8g-Z)-epIHjShfEU zdcD^Wua@}&o8A&4h1%v+#-il#U8I2V=(?VMrpe3V04(AK3n2>p8mJ>DqBbH@+PvKC zNBRrip+>XC`&*ZK163bU98UI*_M+S==li=~No>!@tylc*>ehO;WNx*&r(BBA20E76 z?vDp}co}UkRzCsCMvw@&dfE3E6_@%$Wcp?^BBBiA0) zIzUKEIuC0-8T>4(Q9@1?3hxCUh{9@h)dVeDLOdAJJ(lqw7LW^Z1p_N>J)y&h$>uc7 z;+IUXj!tixl@~u12e(~pUc}Aa{4FdDNFH(M>yi-qE%&)el>lRGvU48rt&>|M0P3}oK~89J$Z4Z&{(CaXG)~kt%#HFlDcYdF zQ0(-ygUo-$4?VJXG{ZkNjMz{1d3SGDz~a?yt^KVy))_l9+Q3J^Ih$3*jvxr=NVP17 z1FiLS9_u&?wt|mu6wX0+lt42Bd>||=IdTm%TPNKqV3x*chq!yznu z;NmW8c4a7Tv#;a%9eTmaz{ns_7X2Fc?c2fm(pC{AWd{MTw}mfu<^?n~cY)j2a*o;A z(~&e=3}P}eB)Gsc7dKH{G|`y1Yj0M8+(bvInVQ+aX6QE89M{Fgh3-4*XI+y|9F3P! zdhU1%Zv;2%=_Ty&7~gX-tplwr*&lc)R|O3XNqC5xDqL>81%1}+u@ysHwU$*?%=HZj zn?o=Z@Rw=`ptTuAH$*(7f{Q*EU_XQ(x8QdK~q!d z$md1x_>76BqcjseeGU_rfwxPac%afydZ##LMH zcNg}R1fZaP3e2pJc67LZnqO&~$JZoDxOL$;!F?(EayZHdG<|v~WeM1z)KG3%(r@5> zLS=V(yOtJZ{H-z+&ftCDj}7Yn1JQWDv8g#nx*fzX?_*7MBkb+%gIiW^?MC-0;5lmQ zDv$*ud4zKR@7)}D{}?)j@KJc0WuLl^<>{T@H z(13&lc8;QHzr%ebDVYv!@)b40s~sXd#2J=4Z!YUc>wHo&0jNmn>>r*1HyQ<%jEq2( z%Hn`4g071p6c$d`%U?1?3ss5#PcG1tg)CU`Tz9`>VmzHBh<{vxLXecC_M4G$!x|6~ zERjAs$t!D1EIIlD8Ki;?UmR)j9{xmRGrx;V1hlkko${O#s7^(Ni2-p57jBW^9DeAz zgTV?9~T_#p?fr0>ZVgS0_{Qlw}!KN*?W_Xh@lDJm&#NvhsA zedX6D+1C6L7(Qa;?B_bTS47EPCu|k0I$R8mKy;$8 z`Tc8sVNsDl3*`p-(%$|DDjt@}5wDWmY722WpUO~kQ?WPOr&*SD*U)cOm8ap%2J6YZ z?Fd8KQ}PsL3uq~5*J@Lt(owbfUC+3?VU!T{?`|V>N3nY&@O(PBIgn|cD(FJvsYiw+ z0~4r)hx*z?YrD?|KS!Dnq-o_DZ4FSC$S3Grw)Sz}LCB?X1s5Dt#Fmt}>kEA!ub(dU zNq@txEgs4t_Um9u1I28YBOTnv`lBf|+H{NG!S?ffh-)@rmy_k)n5Z%~Hb%fd67bae z=^mFyTHJ=@Qf`d(-EA;A2{+f!FzCNM^FhWFZsYq8XpOhGk6Tw7>?8ZutzKgd;PPne zslIA0(O+>#@YcHT<}0CgA1((+Di3ybb+wJ!tIMPcy4!t`i%r4L?dbOb{VUEkv;rTx z>0Af5oH7H{Nk5t4nsdP@3vhRLblg2P>j>`T?6BxUZ!j>M{O#quD_1APvmU3{zglRU zX9Hj$NJm)cnNyg&q6!iUR$hp*$&O1@q<00nFfq!}rEo!B*D-T?oRiIeoQWg)(lii) zW+X4KZzx|`+U%kCz(iz@i=`QwDp^+dMoQ=UW`XH1!qkJ}i#^}UdNLCS}Tj<&PE&&I}z zfr%kd`USw*QNh72X)h-VP(4Ixm8|t(*`1(LiXa%RF?rP3F4m)=dm+p&4-fEv%g2;{ z`9c`TyTWGpox1D&(K14KaQFeMl%@H8=3}Z%6B{!#dBt*t5dCcmW|Opg`)>a^nm!|i z>h3P0^f0MW-hu~m8mG;~@bF9G9LKA0l4f^jmiq1FY=|DI$hf#hmq(mfX(AIwuhq8< zpHYq!-!_e=AER(2ZSPWdDZQCE3>ix_p%z6vDqp$OKzEwbv(=n0*WyH)TojIgdpg(L zX(09y^<@-~Fj&!Wym`R8u!VIRbvB-Odc=Tx_;u*B?NGPeYO+XQhcRqmXa_qsPlQ^< zj59svZj-t5L09`JP~-;gqf83PWU0W1RydXil_9_bl~$6T9`z;`7n53D{6RkQXGPs^ zGWbquyXS^4D3Dor{5=!FGQNwv zMMC}%2HJ;8MJ4$Y<^TbjGiH-$X;Gp-KtjUHu!hL}xY0EA?JBAX0sDNvy_$#0d9Z&l zrt*kvzKx59ibm10#6A6srjm&2)|dWQU6v(o!?2()zPR(YWSLDCgs{5b@&(>+TdFbO z;iNhq$OP&yufl58%y2MK(fEc>de)FAiYQ6<2MMag7ZkAX(2}v;`bm`sYf)KM>=0z- z$lFHZOe97Y&MI8aj}SH^dhW$LE9t5IXmeQ_n4F#_qkqgvP*IUhUllH)p(VC?CLw&t zD=)8W%N5a%jYnC}V`63_B`jN`AW9S_pqN%W*xlpv!WFp)_GG4qi_#}JNJfJw(aq1# zA9&RY?YlWM?fpe`k-Iq!YHVyQ0Evl-g~6!fsi}x)wWmi$NlT)?LCA8?@vTIWnzD*g z?gx$doJVPyf9@EdG7la;-#r*+Ir#b{7VDl2SL(Bf_EL|iSR4jMP%?D=>iqP#9ox`u zRTY(3pBRH1tHKvxSg}JbJ~%YiVt>0aZx{FJP`7nIRW7&p2Va{D$L_eF5AZ^c(3drj zkP}ICvI{OWww6KV;GshMcFQ84{CMj`>RM`HsqsoqE74(``ax60Ho%hYp$rUHukpo> z+w8gE-BFv1H_jeV zB9)5m=G4@(V?1d)Fb&{1DbeNkt}5=MC}22dY>s=w-i2X3OZ`cKd1Z2Gsa6bh`m$l} zljY~TFXx?|u{7TM)d?C*c3XZ0UW*t6Kw+Kkn;nf^)_=Rd^!an-z`DYBIhoLF{5>l( zBZvqvy@cdJ$G{STl|6MQ?Ru-JsTF<+aighKOVYS-CSr-jw>u+9yzw!e71Coy5mLc_y^%q;*y#V=d2!7Y%-Eeld_~}oY{t$)n*!Xy) zHv&SUfw3{CGB-Vk;@^u086h14N+mwYU~bZC@qp+HHPyVUYmH{a#Yrr*%0>(Xsh8*E z)YKx+Vqh})p&}K2qGEfl!7qc#?1Y~`f2iFYVG91eHE^S*akza;_*si0$ij!9R%|G?5DHQcX|Ktmpamrle>IdPhWi^f|D+#J2EX)(S}v zfF#41bs7H8EWpG5qi1Gp4k26wjKJRr1|$pwhLDRj;CYCNDu15AxC!u3K;Cm=DDtCY zWc0C_v7kuT0NCZ7Sy}%_-`y<)Q?EzJw2;Qou!vWyO?-A|nD%#l1$|RLqTIn$B)tRG zJNm%lpdyCgWtGP$={%dasa$4KhZ$TCryPL*&1tswb`xtML|;^9i+*-!sF|JO1dxA% z%#jt;)I5$i;Rpr(%vf^7Fw!;=q7OSrQKbU}HZlp(u}BCTJG*FbNF)wVdw$T&F+q6L zFABNX*pyyPeXHfm(nOEZjPztUtl(7shorUh0+lGri3xc4@J$3I+CiyIQL&U{E%;hg z*iOOa#^^CKD(sor**;P6MQ%rD16z*M`i5x2(yUQ$!-Jq&O3RXa1t)6PHU*jtgK*A$THB-eD=5tbPypVz(IB?EuFPO#ZGj6 zjTe_1KVn0yK<)LgOH7q6m&v6C+@H+_xKa>&T1;C;rovfJ_CYl@Qqq>vVr~mTwS@x> z$-W@E@cGT2mASdGxiLL8HQWL}A3b@8o)w>aIIPd%`a0Y5AQrmA;hftvAA2WW|*$sI?1|IQwB>9v}&auHQ&EK+^;d%-H6 z!Sys!g^{7kOk7l)E3?I6jo8@9cr4=``Am{h@*tVvw>KH!8pPBvet$im?iGd4W5A+K ziM~)dxw}dpp??{Jj$${X%j2`<3o+9)MJe(5!XFh;G?Yj>vDG!g;^Zf_ukXdCOSmGH z(ZOp725pW?-DFNT+;s5}*y1nQa0}9~U)??^#b%y1FM`=sXM@dcG+u}OkvlW<@4P@x z#R_bO3#aHtA>>1+QUGOueZyh5Shj$UUbP?iu+(~0zmh8#O~`L%ZSL%B_xtkN#@xc% z%q-OK`UR3H>cfSg`y!ajkDKOiT+=yb8Zt!2QC*mcyDQ&n{~d2OmJfUbJVh&x7rwk`Yx zldv#5A37q4m4losdG(+HTDwStHeBBK1;(Km`y6dxpv>RnYLhBFg&k^RvTg?FIm8z- zR_u?8tNyHmmo=nxxb`T1*CK}Yt)1^*YAqIcW(hnv%-jYL5ry=H1hP0Ke{X?5B z)i%90h^5f1%}k&8xAW8H;C>;w`^X1WMpErjj%Q$ z4by})ItKPRkjhFb7)VK39UDU;%Ly>OVFPs`Hpxw~=Un+2y+kW*R^St{%t6NV}uS2)7N&MYe}Ny5`1Xrt}n(E>CE!@ejROUu$SDglrEJYN$f zSjMo*SGrW=c!9FY&Ch|qHtKm%=)bOoHXc9<@a@KP|Bp2T_WvplchOf=RARl{4!ld% zbJTNI58pc{!d!bzMw79byh)g;+}tBITR%bn*8H?kzdXF;?@G^ZwPImtD&ZX*&!AoN z>3sGGNb#t=iGJB=oA`>%o^$uKJznn3D1_CXmzp_x;K#GUcye9R^|8Cero&dUmulthE0nf7B7wRntsEel;_|hk zV#S~Qrxw<&3siYJC6*co~(u>^Lvel%NSWI_;z)QDoacJn?ES`pq zj6VAWL?K;z`lBj|Y=h{xSK5`i=cw?VGP05s9rk)!Sw(ad4DEkT1oXDyS82I4xGEL- zL7M=mG9ZU7I7d~3gR|R+{K%4w7EO5j3hJTdO>?%GC&qE4|_ z{`-CTn{nK~AlhW`)2#$k5_^6Tzrx0#t4{MYdyTU7z0jID+0#qCglV1i+)= z;nCrPR7CsY@6TJr^~u_TWIkGaOs8shqp5a^rk}4@`yzI{24onjR=Dn}0W&qiPgR?g|89ProQKf>AQ1$lh%EkJRQyX!2Ab{0LcTC~2|fe? z@m<3={A1=1Vj5s90=L!z2OQSPjGa7aEGW$cvALOmZD=lozF%&dy8E)1Sv z{_M?76gwMhWo2c+uh`7QAFPjCn_D~d+KBP_NRdbrXlQW1$NJaz_iU|s?lj1q9Sc$!V${z^Pt0(b@e)JvpDV6)k`D4zI&W<~-Z#Fh8gQ+xUXdfi z)6>&pVqyS$0EF48bK6rMzHEr4mCoNpE$DCR7r;9vp}xMX?30q=6aX}XQX8lON@5Zk z7PoyzQVb>T$c%(oM}bZ2vB@%DMAA($5mmVr0sXR!_I7Xy1a82#?>tUUbx@VV1AN$S zZT?fMQ$t!B8kZZltU!C?m8Y^Fl*S%)bBm5uQy3l@ZN|ng%F5eZ--D*5r)CJ2mRLT= zSeS5w)fUH$k2iq(tsov9Mxnmokx-OG*zj*nJGCVx=?bCH8cLl93P@6Mu zUkXFno*~=W0S9VD{s#@o{ms~n6bmz>9)~vg@Nn?V2jcA}B5@_Xg76CPw)88<@Z0_l z{3MwXpzWG@;$N$zDOGbG!;tu~k@Nm0l45R1!x5O5aD-yMe#IwX8ts|>EM#hATmbCg zQ)ch%rJ?kwz`UvcTfN_Ex@on%@JYyNOCwxA87d1y|5)9(>SLU>@yQ8|R>#}Sjz17; zaGXJpKceO)CR9`vfm2O1C@3g|Z=b#Gbk6Oiz>kNE);l{r=YACt7+(x&Wo0@pYT}D0 zK1(eR&LRB(*2xb6kTz2b(K)cUQ>3mlWuJ&iSimdTP)Ug*V6EN4?id4>*n1GJ!jnn{ z{+e_dbsr8AKOhA}FuQ`zLr`4ezQzPrhJ_8>Ul9Tys9vM(@u|Tv5Gkh$#>i2HZ9>0& zld+JJT07FRg#_9ezr)p%VF-$SUst8~+EJ=Pc<=_$9H*|1mLVatA6~fF6jO%*_p{!}eBvpU|uQnhu{vmF|Kzk!1ex&@YJ;A23&4E4Bsx2ek%(C7Q1bLloB`Yo>@ z!%G@9JUqOy4E}{KZ~VkngAJ$eVc}iNfCFfvT<`S6f!!WrS!C~MQq(6@bGx3)?dM_Oir=B;V}64D*fs7sm(fKE72fuiH6B^ z1tJ`F>##UZ!PU2Ba49I_>Cu!?V|y=w%L8|vi{*5*d~)L>Gc$81<@70921qjj`LO&>9=PckTs_>K zr`<+?&Fchad5%Fc|}cP=WSN!PpDt$ocub=hzIlM>~Z5zYwy?fu=VJ z=FQWaPUCm~nFUNwHruazI?2X|6gGgU0~8J%G2;0f9CZAoFJBlaX!=ezW-TfFcI%sh z^4GB3T;00Ge(i4|)Unk88ceWa2tHBQsu{521qiUr=wRYJr;qwVlimqpf1GukZCohiiWbVzTwaeN7FG0l15} zz+37Q%YQc)9vp&cXV0qvDw{Dpj$_aB5fl#V6~K#m^4zI6p8`NBmf~;Uc&T>Z`k}fz zWcf4jvE}DC;YdL@SZhy>Py6p1kE%B|g)DXj-`(|xGKrCkadEl5**)BVxRmp2uu{ zzs^IzJzl7`V6Pz%d{tE96-4B!q|vyWn*om4A8xH3170UgTmIE46ds%ldwu=YrW&3W z4@G)%MgoaGJs;Bbh5OYzm=AC?Kf>YRg$V;WIXSy+%{4TNghTF}VavWF_w|Vi(Vz+Y z!jl)Zg$%CkhT6jN?e6b)3N{`%+2O%ULRG(^`cP1qPtn8YfVHSz$2ufTWx`9M^M8p~u#)AV|VB{{rx74}H@B2hngnXVaZiQ4s@aUKf?xSX#|Y%^WzrR<8>!N~&NuP#5%tWP#A|WcjPUiv>Z0W&c4}=xvRJfe?Rr zZf;o~8IAvsfEU6U8TR(}V5lDR$6(`Y9+Y~4?*-Y+?2IsraBzrD@L9QGG(QWp(Hr6h z`2D`@UFa4>HN^fvj!M0tjhOs8Hd6?>?M<%x+>mV4PyP^GU-zLi6;O_sgD_&8aK*)h z?Fi0vm5pw|HQ}_dJXb`HwPyy2frts;`4(Kp|FsP8(vs%p<}UX=-3IlJRuol%sJ-HM z4Z5|DREQZnp=%gTB{?LA>yYoQ-k0jiyJh%8*a*cOJfbuRLb*NU4Jh!Fg^2XBrRkv( zk_E!->06>K_8t6E!Wl63;Ci1cNasM4=o6JXOSVE2lFA* z(+!6ph}o_kA!p-llp0Ltt zd5$jaouEJ2m~ZjR917)xzpmSvnOQq0wEJ~}d-ezQX!}6S%^iz_nkfIZ%#5>|5A*iK zYOlBmH-cksu8(0rL*G8mu1jiGrNCBK-f8K3jtk^2N=}$MfM*DekmLsKZk-;B8EFf6pQV-q}Iw5U1NDa)x)4wI0R%2o{_R^b45 z?nXxJV4a{G%ZFmNB|XdeYc~bVN)PY6MwJ8?=OY+${`a~XII3YfDq>iJGk|NjnSmY! zd%MJQh+XK`>f8O!cQ8}HRmPZ5TSMcvFBryqVC8&vYQilP*ubV2!lmC=CH5^EgQ(N{ zF=6K_U%U=&s67-6hbU=h@jJ6WFR)Z*djbWKE*VQwfbMK$ycN14sGna`v-Exb%_y~` z`M~aJe|9(TdV$93cu`s2*E0GY7gdw|LJ_Bvnt02#PbC#4{^KfRIqflpl*2sS`eoJC z)XHJqBYcH3kYg8QoqT*dtVZ78{=*qtPa1=V4XTMT zi~8kHM8CQvMg?^rt_2N(qa)BHgUTo^gNm8-+EA}FjDN$W9br^1COD1yA7ve?5_(h$ zKIntyu%tT0j_*}TUSsHa@@jASoQ!bpL{F~=^;sSnB~UvM5>!7ZBPQds(2NZPwvHm4 zi@+s*0hx%+9WReRMWyBBP#+&5_*W|dkr}rMchoq$y+Tz;F>Lp!aA!XsA#fb1fK6)j zLlt@JvvZmD1|QUK@DKx`o@rsP2{Zd2FYVMhp*Ue@Zy8OD&A)t!r(g3nz8+hB{Tl1f z)la=NV#B_ha-CZH(bir7)9CTV<(c)lEZI^~nE}bB9YlQoVXK4L5rS_~3$@s2C%%jw z^Pn^GX{;R*%H4E0xr2(7^s=jo^^{dUcZ$QOMn_cnD{KAF+LW(5D8tN6Z#7LOaUNce z>N^u$Zs394aSPNx9&<^5Z-i5jYIS?mBxtdAd+H+pn3GnA?iHVr0Pzx;)>5lT2{-^+ zU7xg1Ecf8i*PfQwl6Lzua^=!FElhV_hzSAX*B4!W?6J&s>w-}fmrh?vCh9VD!JP~O zuExw3#0BGu9XPqSU$FJ4%PMVu(z`O)W64PENM*x6P6j#fnr1ugg=d}^;0ij9w#Sqj z5x#mkFp3nu@s9xj(T%7|WYX?H>KsH$pp^`C?+tn-~pWR_KT=qb)}yB&wXR(_iy+)dv53oab5D z3H^@I6j0h3x<(CMo+uZx`{F?iXcK1yM;q+#z=O&;GZ&F6|JqzpG7JuNa&mmU)mcMf zh%ru&Tplo#kdcv{ znPvlm5s~gdt&0qC<$2eGf;h-HWB*(T_*6N8l=G932=97sr^6WXYHI38B4$V4IMaJD zNYY^4h6xq@1?$L9(V$09f*!QBRUN$}Uax&vX0vfKN5ElGnue(OG=3zv%5lE zFSEoEob_Z{ubV;Jd$EtYQ!Qq;cMUWd4~G|IKn_Gv;|L|KA=|V0a%M(F0cMKz-7Y&{ zhc++(PfUAGuta#e6C%TRdedoZ-iggrl%#MILv{Y(6A+M>kRSWr-x%{)=B+5iKOJLf zaS#)IjKEKOaIl|6!go3w`RMb9oR+fGa@>nBh?nnW8gBNr$Y>hx6B)(eVqXF{HOY`F z$R=ke%&pA#W`9RMPd8LM?Lr`->T);LaKOcGB7asH&FdWzCFZBvf_nCyQqYyUgM$jI zI5Ri5035~nBR)ri#-xTA)YR0SQ`f(ClJKC^OG{`51nfg&I)J`O)_K=p zVcA~D)+fRhGQ!L6hOSW5|Ed-vZ^`~-ITl+ zMesA~?SjwkWHM>UbyJfwdnJgX-<_S0MG^4XZrpT6H+WK2j^7TS`Ujmm|9Ln%TwuLA zx&JlUJGGq9M@EH6@i>udt4C;K9~v8*6PMea`y-m`r3q{%qgMM(;__-Hm)EDU6M@^? z$c^Erkw5JKHE~-Yix>5l%l2kmfL4_b%S#uD|6@-T;DrVs@j74V-Mom{8fN>Hgh#hC zoSX~ZyuXSRNev|4)p7e^N+3F{w%xZ(QAXp>|Cx&=N8pU#FT*O=tiSD!tokN!eRy?! z9i&)gdH=NFu=ZUqu25!;PTQ7SCX;{bd%J*qI`6|?eKhDz)4$n{X6NEwgoe85H2I!c zolWfbbbz~mkcyiM(sr=Ud&UnvlDy5GCm_#NmJ=He0zUw%TG8Gfk;*eR00w3I2M55L zOhez@+#AS^B-hJ{xtSHn1O#-DziKoD>0!d-bxG&KS1#=0;(b*{jX3EnUcoo#;{6J_ zA2dI(nD09#$pCf)5Fri;UX*;+uh!IDe5hyVqMjJ|GNJL64gq zZw}MrA`pJV^M*zF`v6a4dGEfZF9gp92T(9l^`94HmS<5xg&eFML!MeGg z#0@dz)v+5S2(+{{syOyv()@X!S1Q2b3{+Y?h%ADh z9P;@{2^rZDz%$KOn6_F6Zv{ZZA7~dKBPR#Zss5!QMm|Z~Ln0jV{Ct@adj0C(c4N)- zN`k>?cR64F^?Fb(cV-g`*x4HzdbwNBOh`c53-fuQ8=71FTHA$c`DA%wX1RlUPnN>U z&c+4TRUl45F%b5J#MC@~U*C6?#CZ{QXOR!wCKhqxB;6tO&Ua*4cQ9$>9W&s@YqQ(jV zDMfoz6aekUPRXODtE(!nchZ$#3MV-L)gq0&L0+a=N5{i+vepp-?xZ1&h~`$7r0TNF z@g0kGq*OO6>!d%3zJl~}o{rw({Mm2kGZ@8H!H$B0tD(yF^2)8{&)}_o94+8Q%1Ajk zKF?_~ynFF^cyJJR^w;Xf#>XQo0)Q_8)C@-#7o8f{mrE}t#QS0l+uC@e2?U%r`YU%1e*{S!e{=pxgoJ`|1cmRk%zazi(V3<2pmqz!azL`>v;gMl% zhP3VlL^bS0HcPb(UMHZ|YwD@lJUuMXCNeHG{6XcK?KTuWoN5dRiQ?qpsnBYHC*g@i zilmgwAYh+kkG3EmvmB8Tu`VWXZ%bZVa zr*6q8Vp}CBfrf3xnkDmda9hzH6u_y;z%LH0Wlimavefodt>>gKNU7@q&_CRU-^DlWC zJvFh0juKL@xi`w6a~_$;b2@hCiulXfBOcfaHT|<5up79c6Cfq~d2(2ZY3#)ny=Ofi z#an%L7ChcY{&f~~VPsyXjj>{bz+(oF8$@uWZi}C%P5)zzzWv>9zb)0LGR+1dZS4(> zPcqgC3N4H`jUwB{MMVmVs`Mre!y#I3{yHwQ^%o`f+(?dW^3!kMU zII_1kH@8Ri$Y}cD(-SeVmJyIK(=v#t`H{obfmh@Wi;R>#3tiLB$6Mp)(ZSWzQnC_& zAOo=swTnX`hu`6hv#lY4nz!u%4v2bG6ck``Jd5{tUp`uDMZzu|X0ys0*!=(GC` z$6>uBCx^!F$9F(ur)pHP<7Z^M3T?!>4B$1LBR|in4Osk`5jKvt_0*f zU=ncO*j@jiOKfuibII0T{6B0NFnutjaFTF*1nD^&=&(`2Vxr_^6qe@Z2?+^oSF_Y@ zr(Ip7s%7ecTBe|^92*mp)D@KqKo>t3HTBx3x0v5s5m>R5d{EWwV{I0y8q7^k#|z?h z<#hh6XDyfEpW|t^`^)!*&+z~eGRxwemY%%)hww}9v!yic(W3nl>}dG8xj9i-M@xqzvwuZMwI`Jk$Z6ZjGtJQ_gX*YL$V zYMf*=QeN zGT4p)1JiV@W`zI?1LOY4Mc}u#eh8{fzL%|l<6h1!!uFWk1ykDWrIYbXL-DZ;uA_$4 zKQ!QxQ&OT^Wt-9RGvciz&a%hm@x@F<`nux8s`t5}ojEn#DWF~n^H%f$uW^$!o!{FlN##q~ZQd^ruTTV&W>|%;XXmPS6cs1{E6;*{&-2|YV&};E}-YCG@ zVq#*wy1AEA)rYijBN0z+O#hNJ@*?{WpHFc=Kgnl)|L zmUBMNN>|Yjk8q|(gDwM3E*{&0cdV?xJi&o#XYaU)y@o3OXEHmtjUbitFD}CgQYaGA z=Z_>20HK9I*K~Gub|UBC;oxWxdVh1euJni^6sWsTTot&nwKOqFC@VXROELvurAq*F z0@HTSNAVForiMA_m3ACpEBR*dxDSdcPC48L1GB9w8X$S@y`Smtkw~-;#I&@a-U9wN z#Es|UBGS$ElzhEw_CR=K`}9CAosv- zadOUIH5ZkXq%=2kb8x8Ld@`}9v0kQ;bEKfU$pFLq*j@yEKhR=}LHT)W7?1JQ99%wWX$1@m;Vw}R-R$%Rq74Su zuUay_{~YbilqOouH#W7mub+=~05odmkEq`~4tHs5$7NHjtS*Q1b+!|&vZ=G68VnN) z`_JX|69AmW8iJ}1XRqHlw;89OKMw~0S7O;HBQF2##d&@N_NV2mFJ<3k>?E1%>f3WI zrQ^I?ypIx6O7@R4J1EuLY&LZOgn4F0T6H97K=$L8bp+?QM; z-?Lxx9dtHVex!exwcRKk)QyWw%*Lc&-3p5A~%>5(qiB$GAx7YIv@p`x3*l47GM4z8XO!1g$AQ({Qqqu zaaS|Ih(BI=kAbCcZ9)Uy&6_X|Rt_J!Ay^c%0bef$WL{f&d1Fy1ag~o56BwN@_8o%=K&VS} zjO1UdTo1-yPJH%Uc0u#qW_35z21?vtfDIs>1N{874@nM5T%jBX3v>R|t~s^jwa9U7 zG_Iz)=ED5K-abxfcqk_3CiHUCh})*FnAnWz#T$AnD>Sq(4@*m-r$2z8wloC%D=7`O z%)?FxcWm_ZRw$KZ>+;$;)5AP!lmWaD^*73Yx^#8?Lm&a$pqIow9xjfwq;##ODby>l7od-6 zu^Sf@0^kdvsDiXJ@-_bL+)0Q1qNZFjzmm50L)XGoj2TmPd-j*`a48*nHf|OYYGxt9 zW;i)=a0Jh5II%_6*Uy#>58o3DeM45QO=mXzK}}tn#^V*s8WE9t|J3H=sMYBEX`wtU zytt_sXyd@RAv-d1+q3}Gp($?eMr@#yavR@$Zt-)0IzfI$IIW=l1H7rNt`0!=)?cIN z;|s9Epl}}F12mq1^~p(=Vrpu?1{-Q>+Lq?#u{6Hx`Sk!MZ8=rzb&sL5n%ZpC`T2Q$ z19N(E^4>N3BLrKJ>4`0+Ol}S>H{WP(CGp~@jYnGY>Ivm9d&g_ zzy~fZ74GRNF_u=l)}Q@26QAA|Gtb2d18SP2%YR>8rn1>Qt@<3H6<7iO$NG}PLKP`!012nqD3l3$uCB);~?c^7NKFp3ch_tbiu%)O28;f@^=Bx zF?=4XX8AN;tJM`g{{~gt8bOQi+hBIssYsgm`VXC|xOlS`M!bf@4ydKpZm|#3RI)NO z6|h|KHw;0J;fpUSE(JKC3_h=#{9>Gsw7}vb$UiVT?5mjb@gwRJz;;ADATo#YAbIh> z`0p&BVuoW{WdHW&w)W2cqkLbSukr_FWzdx+B&RyNg|I_(!Sw&QI=rSW>jT%OFOqA! z-v;Y8*~$q^p_2rE%*k1LiEN4Y)7K88Qm-j3J^r6+1fe5RuwNB*SR7b%zZD4d$HAl~ zo?PGE6-ADY_DIP{nVekG*3|Yq=wm~YrFTM-eRI5Vys|Ru{A)3OFx>tPLcRu-c#TOG z6C4EyPPshgkWVP08971%cy@e3!tCq^;>MWRuj5>HYM_J#MC}y6tSbx$7_T%r<$^TU zj1`rszeM(RLSh@p^?(ZTof+a-a78~opDYBmhaU<1vIruV;Vfr4-q z$IAlzt6iU-uIW^gvxnNb}Qdmz$&+T7(e8g7J3 zWJv4Xg?V1`oTqT0g=D`Y{0zHXT1r|fYgA808=oc_xGMNsTY)_b+&KrTr3R%?rxg?x zf%R%@!jL_Vq%w=s<*6$q8wCKCI0L3WD2c!N3{oED6(z$%LtF1c*9ywYXaMY>I5H$? zXKNeKC>$u(l)FSOJ)BgqWaL5lu6ETtIAhYxvv60Zhd(6cvrTunGD|5r#FdrdH+{?L z5+2RPSXj^y3Gs-@R8djBL_!=e!NsR3DIp*@!h|QMq>R9yoSmg;>_r-DdoM40c}{3) zZiT>1YKpDKX`5E44v`C)v1zF#vX%@dr?4d(h> zfdBeeqpqs1Zg+rVV;hTjq$?hf1O|3&ER5VKGt`X!VVRxQb7&F>Ri6R*+);eRD}YXJ<({uE%QP$9-A zW+ph^;WJMj{O%qPt&-rK8`8IjmQC{46jz{X`<9BziycSH4cUol?>Z(H?(B8M5I12A zPZ6}+^o}C^fVFdY@O_8lx^_dag;~wpK!fqd0;8+-M~lr_;V^D4=1#Dg@v$uo_FdWS zLarwY`m}d$J}HPoSy@#!w|07gxb4AV88OyqB!b5QaF|U@D6%i4MG2>*3 z4A#o^^F_1w7E8P)BwF&975?qlZK4HGdFTNLW|K|PxV1xC2X`0y#u*E-11*s#wSX-m zk+`vWX#eW@(gHeu{AHD&xd8oV?2`Wk3(NCWgn&s}l9}PkT*VkV5+JT8Ut=A$&d*LO z1B2Qr-3{~ZMZ}IA$c$|>Xw!987*ZOWY+ z!UYy-&RR3`1BK#gY&|D#iLh{R%Pm$ct_wtU9fgjVnV#KVG}f^f1BX>r;a?yDFdzXB zwXWLBa|<&I+j7Ok^QMxT4{Gv2*z&+^Pml`A@~yYtVOOBStT~d;yn^WA4+}o~gNn_; ztT?gRBbsquli`&Gdr3QBV|gDUet=$ER7RBu_Pv>-woZi3C@I0<>iX(x2U|01>(P;8 z&uI{C%qq&Nsv;uH!Goe*wScRAmr?wziER#E8A+$5?9<#dG&Oy>Zv+o{1a;TSg;-4y z;Lh3MvN1ILwTB@gDPO zRPp!*S~$>`j|%gb2P7n+o^Vb61PVsN9^0UVh8P`P0rHf;Q3O&R}980ys5xd4^SmxYPTOT#W~3KiR*z|q%gtzv$M@;@>Rqo^my z;}O5)%FPh1UEGs-PDLUX2(sKoz9l6mpIKSSh)vtv+k%9nqM_IpaBj`}n&+!>`qSlo zH>hp?!q30AXMRLr#k&)96M|5Z0F?rEqwJcWib2>WE}u9F^=Fbk6e*AI$)TzPwz*_4C)bcqQORy|~(z zn`~}wR{9YQjJFOS@om{hQg||->6GImz>ji&)jz=h>Ny4dw@UeQLcqv;%5*u1u){&+ASp$tt19tsBbN(u76 z*}kj?3Q9^2mnRZMX4UhA*qj`XPCuxYUtyHYUyL-OJY^4;zyDm}_cr_?Po{_Av3@v! z>x_by*Iy+uWilH3^(){4f{{4pjtk4!MK=T%J42 z50A9oDooCFny|X-i_&17JGBc^T|h-~m*t}x5D^9fyp^FPN*GM>t6o=o&;&R1J2yoC z`Dy|RqyguMIA~z|4G4A#X&WBrWF8IbnPG$7_ zKk36~T;CX$alU*G$;fcfK5xD$%|BD_E-=2oTtwO|RX+}aipvE^KyXJ$<1}v0i6!~e zHTmuiCk%Y{taIJcC5Tazmu0!^2!+!K>C%tL5)V=Sf$L2Co0P z@^qXhNaDviMDhRNx<7BbyE;ZjpCB%ePChw`0L^ltmrZxKp}RemDgN&)(D`rm=>-G0 zIt2)9q`z}pL^Q;h`u3Hq<^-_^qX7NyD}sAoG@l0qRL4{Q?&Qy(tOXKuxN^2;OFVDz z&mZ*vqq^+>0=D|UKUohbH2JrLP8Xr|))TAe`A=o5Z~TRc|9(-Z?nrCf4ySPm(`rg@ zD9E$vi7QBm3+RXo$QTMBx_Qjlj=n8kA>Sk}F6wG(;LR>73M2kg3HQ(cNr5ud(v0fX zjLLmL3hyjUP)1oo^Fzq_jIybUh=a43ju|=I#fUif-xxd@Y%VJ`6o2o(XmNUqgFXi) zeu1)rHG`tM_qvN;cS+rFlx|pObX8ZsX6V_KH1nsqV*K-0;o~~ts(94O9yqkpZc+(o;u34?eE`8PohJFhxX7D|N9fDgkQ4llBF~r zhvMAKlOg(+O?M)Sh!5+)nfxef<(i^%SGn_k*-C2`4{xvgbg8w=#^-@__gG|O1~{km zO^wV1!NFKsN(qXE-#iR6;XuVfFe4AH-46WIm-h!r#(4_UUkEW)OLiV#WCR)%0P9U$ zQ4OKonk-b4(_(Upq~U)WO~3K@ktpzZJBGG_1^(T&{Iar}nM58yO%s;=o4`yrQ@Ac(6f2C@da~e z`|~rnz;Vmd)=EW+dov4Amggav6)M668pkZKRV_;#$p<-j9k&n0d$(fFu0qYm? zO+$WDKJcBjwMDvK5;YT3S6G-nj0{~j63T2uAo?8nM85X%0YYXI6=JbQuFD{)diIomN^GKw(8d zC7h(>T*VRqiW5CyfYwpRweRa-mWlSy8h)G;f>TwJmJm{`&dH$@U@XjSOBXz$feDxZ zb#eT46AF4-8mb@xOHEH}`O!pCO;1hn!&$4w(08I-JW$N`+C5cQ#4$j`pJY+kF?udE zygku{tncha> z@CGGux|H{45d@a1m1Me!V0!rQbT7Xo!oq65Z-MvkVt+dLsxnPyb+q_Xi*-urph)?% zb(S^JyrM+8-{Hi>iix>pWm%3CA}UMs%d*Rc!J#DdN-=BXQq>g|)kKf1RQv-=;g2+? zaWJT$i?^|;v@}6Y_3+`L)VdqxEw7aK_}tXb+8tBbE7G@rko1o42>)5q<36}ww=R%A zr)Z{3#l^t}x`Uriuz)cen~qmNj{ifV=MWs_SN$w5d69)wSDgx7Gk~7GtsaH73xBU{ z_ytzXs3`4NoL)8ZiO?fD29Ldp(YEu&4;}*`&55KPc6a6WLEj7w4p2}O917T00W|r) z7~8`VqQv8d@6MeG9n2K=JaD99o)W zO?6|_JhaE&Fzf#JI4NfI1&Qe0*w5?krO6WaAy~P|hPrYYrdZ&JwP76H5 zYf$TIDWo{D#8rEEWR=P9(WlW~nK>6v%Yh6a0F`phj^g_dF&`;y;PNc zXmph4=42goeGoH0SSPOWYqYqBKK);2Nii*!}gYE7La1}}AcNN?GEd!9@F z{u93QhLCG(pU2;=$M>;ADR0ESC5_J|@DUl~$$v!ui@O(nUMzy3bt!}Ez3ZaDa$-y} zjNZ%bX1bo|Q~RU?*PSg)>yetO>c~ignx^Uqj;G*1HqU0rYv^>tbj4v|=YW~ttIAPL zbMe$vN2sQf%q2Nq8~(Dq(xtqDE$Ip*tm)ws=%Grg956yYW=9y`n)L~_11Pz#h8KZ* z;?B-f$9gwRdyZ+7bKG-6jz%|(ZUlmel=nG}g-I6;wY31o*k{)mP__eVu*PVph=9FQ zZSB`STaCo|Eo5jv1$FfEZ)(O(_83JZOk&%dEV&re%h5()Ef7&rN=z01DHfDe@+{#SoIKrhO zQICR-MnUny{BAzeI@s}EAgtJuv?)JxU&8O=NLjBp0aE7&-d$Y(SYfnPR5Nip*_Sg? z(G_pd^gDd$Cw#`|7)sR?86Fz2K5_FJTwY-!BiaRCDxMF^a?8+3iPsb3)^5FFG84e| z_WXOs>l**o^d;l`91ezek+Eftfq|HUsij@`1ZNcxFb7$`03JN76D-ohGFDc_pGT9v zUN3c5nKJ&hn}Y=rr}*ZC7P?9)Ie742H=Vt@tM>Qx1E=ng(3WEkoHt_{X2TH?M^>QN zpXydB`KYL)zIkRO6Eg)bs^H@GO-Rfvy&lp@j_gfz9sWK$pWt7mx=& z((>7)3}0?=zy-?mx3^aZoc#(wZ$c!f5jfEUK8ipw%Q+ki+KcI_){6ICqriu88vvtD zqRse@frFkb<>)NNrlWcsv0S;&gNm}onpyR*&w#(HOv;lDW=b&4OYdJZ<`;lTlt*7I;XM>ls7-34K7<-k2gdaLp7K@2N=GIR{F#)!fq6EezLLT-6A z1zE~_F>Pg4*@1)wtX}N%Xe3~P8W{LY$O#KjF|f;FivDB1A&c^Aq}HF8&ZyI@e^47`oMRFy6gon~3%}UUA}T2SsJ<{FF3;%3*6$4-qM!E@oq&N~kbf@D znL#!~9vhn>hX%oY9mVkt2@W3n?Py|x0Ue`}u((Z*l(M*Et$|Xng&!9?L3!V|plW!L zH(;?}oOG2^9GL}k@a~)^pPiBCld>ubGaIUxO-*J73hlFkg6!%OK0ANSXsQ@T&3o}Y z(5#hyE8#{PK#Gd5uD+}=>UDp*+TEJ%5}o1In4DxKN*+n(4P({VPj*%dj)!781@AIYnB>-7Y1;~+?Q4O#4X4e^kEOf%)(-dmF@Wb+M0y;z%Rma1YVes z(U&|L;!hb)$fk1a+I*93`i|+)zW7r~wNW!FLn)MkmTAp_xqE7Y`JQ*?P8Rm7hIr*J zOU5#roq3CI^X;c|Gg8Fn!#peO`8l2MT5^gz(6g)*E?mY$eLWg$5`A z>EsLD&#DAx6tGnYoQ(K>JmYO{NSroLzI%*T^uue(rfZ!@O)q?a!>zaUo!-RCiYzg# zId)>)4kkbJcLWtzftHM1F5f*;4eo(Fy|3b&0(a#syh`$eXgsN0Zkg*E(g&PP)8ypT zi>=BUpzP*`2AkBV4)OPn2)36^lt88d&j1{w9&TLt-YY0-yRJW)Y(xz74+A#IXg*_2 z-pv$B>MvQr&4&l|uhG6-1>8_1pmGB58$ExH{1WAK+xcl8(`#;?-%s18rmRen_gS~u zot1`y zVTaPJm&fd~Jdl33M2^XmOM_5f1lsAzQcg0^sR)Ue*VD@@&g{SkW`piP_+FNV1F*4a z6x@vx*7#=O;$i>Bhq<09UCbscBVw_tee5T_64kpjBE4&Wb$qw;c|b#%iMp0*@x^^D zWSj)2IqfL2Od!9@>)3?XCk*#v41^QD_D>|gY5O-`(f?Yh8MXq z*n*N8F;$_A#kMpJl;Ds7R1abX+3@rZ*WW{(-{YEmKrr%LzSiu#T%TNBrR0)m+>VVs z(s}T<8-6^w1^>YvT;idL;J&U4SB(urLpIm+RmuvxCpebIAJK7lCmCo8a+^+UY=Q6< z@o~``X+u+8dqt^Q!^06_p^{N)T;I0ut*$?8GS+%+>DwSEL^s|Cc4S6>A7fI7MMo)1 zxQ;Z2T_c=q*)F{K|K9)8)V z8fMLt85*QbVRJaUq)wrr8GO%}z;1QUWq-Y>rXfcTx$IVd7lR4)FpN7JiF-gwNsCK> z{qQvErL26Nar2FS7!yH`Kp?Ww^9&IG@59u4kq%S~Y;1aLx-q>ix1OvWD&`ycx%^eK z+$8L?kR$1i`QtU?x5@cssr-UM=~S-I+Y{Wy9_dUt&kWiPF?#aVE}NlwXZ=hSu?@ci zS4c47;3|=Mh;{ijVPu4b6%(ktyJJIIuy%;)iQDgO&&^iTI>7QG**|!TNG5G?NYgz2 zkhcMmhlIe-xw$j90f(kh1=ug&|3LND&q`S_G4q_pLIiNQ4Y3{nFSdvw{eO4ll0MtzQJM?Vjjo z)yU}R=Fm`kOD!#N=%UrhLJNyJlOD=!i-?)>x;o!ch7rWA53|Iwz=W!*_$<@rc?DkA zu`%J>K?32y?~DJ#=bXcRJN$}(JACQm+6iZ6OUCoy%aiowJGyIg?aTvYiI;KGez0Ek z7ll(B4YBU5aw^yWTCwx_fjTHNzmWGM^-WrJqNbrNu@HDkGt&RFE zc-HkzF|g6TUG3;t=s+-Y0o54PQ6+Vzx6BxsjPMZ}jKx+KhH>#uI|k}ewWaEw3=xlo zg%odIRMnW%og>7t%QektttFOP#TtbU)c)-~Phuv6_LbbiFzKS*kIAz4Y`75J@ zvUG9QiJUDKcBL;=;(UX#qhC6u+-A$unOq%lq~7ry9Wlf4o<0P4q<=PB>sghknCO>c zx-DZ9L3gj%A3s`}l35|SYQLq+{S3BVxK!aXsc8J0{f@8?theem zd-Ua|$Qzq|dRmt7IpQMr(2SI_%(gpFE<_E0Hid+}!&pN`J6h~S0pyk+)|*o>v2Qo= zX{<$ZJnz!(Pd&r3$+p|<=&`tLEX=iVCl}T3JLP_6k!rR+MPG>5GLjc$noptZ2+LF^ka84rLeGE zG7#?EKHcMd{xpMOiIY`xf8XDhKp^zqaqwYcLNOAt_G@h%wK;YrOJyyGs`W@D^11ih z4wCzsw;#0)&#$zEPKilbao^xc4#0Iu)nhoHbVd|yZ5vZYUeQuhE2*mb+MnbM)&Qxp04A**VEyrdbRVloBY#k@j!VSXG&FavN=As`W`jzAWxWQ zU>U7k0O&do5P(QP|B3Da;y0B^Upi>McP%C$CxSbDIu<+;gjZ5IK5z5FZDOLKC(oA~ z=;~s-{Wh>w0a+v!xn*ki2{_cD^*mIyP>^4wA8Dsvf~0>`FNoS0(;v&=vWOi)>=6_*bza~0>X#aU)SH@ z;j@eCeFsNWVMjr$!emC2g@veQV_lEhrAi1m#3JJ_v5_;rbOLr3O2GXl7-})^bsCs` z7~|#X677EAneAuA1W6zg3QTn`OdQ4&ezOaNS$1=No?vgk_-wK(6yDj{`7}v?f{V3p zap3sdm6b95s@yLrX+MWG2=J!)>Um`(Ypq*H&KDvDi^VDl81J_0`-}1ah&AY@Tcd3+ zf`}Z6{k;91@cDN8U|=ALb+_#Mu;RVNR&d7FfzC%ln-?C27PpV&d@PN>^5;ItsVNAx z0EjHrH896EaOTLPrp9j`nrdpRR%^q*V3zdai|-QFPM$kI-l8%2oOA_reej0WbZe52 zf~}dnf6x0-)~u+^h>9w7NQ>@ec-JHO+X{)Q78$HpSNHYN896xa{H*m~)XAUR8Hb6! zWLS|!(IY)d9kjmr@^tEEZz1mFgaC4mP_4!yW*sm=}gOvgkBTm2_ zy_^4f;EESJv3LeJgo-0x&#*Mt9@(k0-4XNV{Q^34TK_GWW_F(arvz13@w}S1;u~g#8jY)QsRiyxQOs=GdhBgf|-IV`P-r^6lk`_U!w&&Yp}#*e4hBW$i=f3lD~0rwvBVp%xvXnCxBy4=){I@p3j2{ zPwF&TSJx5?J#&jnu%~p*&t7$0Yx4V!9^H+_bdB}Gh$0%ebMuZNLv#AGBWrdAg-oXO zT5}mOJqWylJHa@GJAvoPJXCNFg}-eW*bMN=l^IEtjNmY-ua1{TLLUD9Ks_EDymlt; zy>KwYmIY4QbxmyV&)>zepQJ*~Iz&0Qwy595(}ZI)zHb6y_+JY#ATq1KS#eoT_+fWu|bwdE!y^K+nt<7jxG2TvI4I?In$fgwQav zs-1p~`H!0OAAh1x3i~D#@|#(I*>ku3q#0;vPHtdD%WPMeQjACIs;KhmW&I#&AhZP} z2*t*hQ#)QbPYCl%g73fIx1^MXqpmm$QGN8yo(U6HxX=n#;&^;7!BkE4rcq`vE$9+WvXan$?NjNYr-dPO=3Vqb#&Vc zLDn=%&bG-5DHODn#(l6+me8_HwH5N84VjP6BSeq=2~;vzV`8X&3fxdCs=Eluc{FC% z!!ajR*C`ov27~{J%RUl{FZS9I9XWYMMk$4UW#~ZR%*=J$m}$7r9wyG~X~+f&PRIaN z-r3|m<`&Q#r~_oy>W~^I*j>XuN`3+?nN-v&^wK7Rk|h&defHFwxXE#fgc198Hbi)B}YUPl%8|l~<=`6KF|uWZ)4ahPlf>b$!5{VjL8L%@C5( z)Fh#&mr0;DU;&VWI`8QcE+*wxPx07|dVcb^zDQq=`*^*a-`s3+ORA_`_5FCl!P)O> z+PyvVTUh~Khb-k%q=0<0UbC&_r%yk2=NwFn1lkI4Zf zJ<1#-C=hN*M{Xe{7=iM%sHhnB z<#X#bG%*=Gib6%?Gl=&AK|xIkH$O!1-Zm?!m+6?eo17e%)0!9>AYbkV@ki$8J7Ye` z4h{{K0=;7BzBY!4sileNv>%_c#@8+mH6|s(v98;Lv_b?>J;jfwL3V(oic7;?7cJ2C z)LtF?0FNU~@w}UE!^l`RS7)PtY<;qVkSJhPSyu=6L>avyo_Q@1uSg8I((aNcHupfz27gg z3GrbCh6V%Uz18Y7)LCQm&h*>&IQOv6!D>5w<7i#_=i;d8?fQJM9$UM-uM6WUa#vE#h_@p*g93#)ra`8(EnLw0;aODx#@J zwUL$a_@cQ!nwmV7+;YqY&E-12utdiY0&E?++yJ+C<{MWVI7azs+Sy+ACctKrh)Toa z_>x}`VuujxdURj%>sQlOet{BYQzI8HE;a`TyO_8*;KUp{a#cKEocQWaY;0l-FdJ`< z1l5&vCawBOGBc|_OXG7-h^WZqG#782$6BT+hDJt?Bux(vNy}Is9F*#U+HI2g`2zvJ zZomq0YxYMP=}f5xx7WJcmKv!@=WIq9KhAs+1bGtu;-(tP1digw6nJl4vD}ThPF5i7 z?_WHg#0(5FvVT@rRYCZTz(xi0*l%%xdM{ibIi7)K_VVoJPbUT}Dh{B3Df5aAKc@wp z0D%Tn!)Cdqp8NA}B*AAEuN9#776E(-E@^6NKHcjP5F0p5D#T2^UFSl#lv)S$!NKq6 z>qR-B1NOK%>ZOlP=G%}sADP-jM>o{^@OAba!!iiLDV^1nBD~Sr2Se1aI9Zp|;W z@_bg$gF&C(2;#A6I3ZmRmJsjo2$LaU(khCpsHmjG&seYKoPQ3U-fH+d@|sr7I)#4` z6y^BwrLd3&kVKpFjzrWHHJ)1UO#MB|!zR{kZx0-VW=yuX%O6fKYFp2fK3Z>2iRSx3nOFiXF^74={A9aWKEnkVi$0 zxjEvU8@uX9?}KpI9oDQc#NR#p4k$+ema|Vgi-hYA(w8wn)2$7AmMJ04RLE@1kbg|b zK(UA>e;Q+f=l*jXhsyRgFy8q15HI^Om)E{phS=CH2r?0x7BcpaN)$2u3~Q}Jo4BKd zBqYqg`y2GQl23lbGn23Q_v{>IFEQ$~HX;&~OK>x_jfd?Iz@gC|1U71ZPG4E~L*9QE z8XTOGBK*~r#>W*F>%i-LYkq3#lKI(F-b`9jlGq5Yl4W9dL~o#fq@toGjoV=XAkHG; z^GJ>W#)#Gy7Uy@EdV~G_C7Lx~4&sn%J?>rVx*2r2M%&wuZ$l>g`>7EluTSVTrVs;$ zPCrsEv`(*7~HOsJ+2&u{DC9{^iLSMx$qPcGhpNUro?XLoi|aPIUaWc{ zO`1EZPmQFe^LgOFWRQr6_|a<#e2pY0^N1q z0CiA6E)NNx8~XRfb0B+>YU`*zQy(?ZmOJ0GQ+H4rtTvAke6;oZnN3C~c&)KiO&z1J z=lOicxsfv}YYf7lkI#mKxMMr7#$hmZ_= zM>8m;GQ|cc8yjFf&H&0Qzd3 zqDP#&!6ju|WZrqH-rJ_-iI|x9ZA)N~*#5z9fNd*84HX)ego8uq)tst5IBt~p)xD?b z1quP-YCNhgJw3MPJuWw@m@k;7BSX+CDp@{G!=VaqZNWemFN-ZZy zzB*hEfi(r?Re*8_(172DaZ%pL8L!zctDwy)` z5)B^tZoa+!yZsk)2Wew`wM5jl3+lt+PRWN`_v40}?YnCn=cbu#41*N6pfk!+s4Af8pAD9rYHztqLfi8Hv z8a6expdg_k(TGgDOWI=B+f6vQcid<%HQ!!-Pf8RQ(=`yX?3=Z4TEy6Uj&d5j)xCBm5jTg`{_O6Jd;Hb+}7L*oHcVsL7j0a7GEfdX_ zAVnr6VbV+1hebLeIE99$GD>>$=;lLmaBxJ&$B+gA@?{}}D+e&Z=}o+yuj0BLCwKPID!=}kaUT$Heo?s{mcf8y zQJWzuS&K3@JsFD}&-Lw^>*gmr`_xDTHT~}48}!{@`HxTE^m_S1=;`T$GBrorLR(s_ zJv{iam-i_2i(Av9>e5O}vwxDg4{z_gMe~kqD6mpLjd&1_m&iuSc|QS*ZfK%oYqpC0D#SiEaKDx504)r`-?xa{RJ;4?s2Jw zMFCuBM~fdRFK_&#{1Ah=Nb@f(?@d5UCT=)+N;#JJL5SQ-T^(|Cdutcu{Dz8^7RH{1 z5@~m9%T63{y2#DV5pwi<#KFIS6oznho*jB>dUJ=}Tzpxwwe z)^LGxAwlYEpe7o1m>eGm*c=;(C6&+?mQI#pPC)8(v+9wPoegVwbAIj5w(HpiK|&NA z9Std*-&7j$Mi>4#+z$CrmU|8&!K#Gbik|+^#+MMQx3_=wE8np_x7t)GhTG4P7k)ws z__o5tCBpUe+Q=kR>=P}lFEgrVlz=41{?pH9n?%S|wcx-L#OtgUGzdJ9AC{%KWOQ6w zOPY@Xe(b`^3|yTCyt_SoMm!M-4GA?dH8pw3uWV%A!(55VnxGi_4E_NA(#CZI5e$hDhE3TX@9IDzc zp53X*zbnbhgAto_aro?c(+PMG-db0k77OFDe!eWmR`Ob{!XzP;ht(_Bk4!FlXZod% zfAemGJq=gx63TC$oIl{MV8;c3Aq_#pz^2lzMqg3q__M!Q+C7(csI%)S}*ONZ}Kv zXC%8*i+o|e6WgCDKlJ$r+6nsH6^1*vF#CV$hi_W-JgCJTaQ;LaA!?kuQ>ce{12Ha{ zT#N%XV`e6D)fcAxcNhK{j6&M=M&Z%@|y#iE;{O0!*Nxm zS-|R9IX(^rt&_4Bd0&t!v$~e8uC~@VFNcGZz0z;$#MU|Mq?n!_XcTargfOwQuM-rN z<^mKEDFJW;0|N>g8p#NdRC$83fH*=xqaKPJQL`|t` zcFF|v@FxJ8U8w$)s4*`uD=RIjQDOK=#6zSGk?W)U@JcIgyyqyOjV;E}V*BmelktH> z3Vi?Y*vIsX`K6)kii{9by;$Haer(Oi<5pK$Nux{Tbw-Xww@$-)z@!+N?faE}XkmZFm039E-5FDVT; zxcNquiMvd&LG)r|GT0m%GmXHU%TuI`t{v>7szjKqQ`wq9?za|c4SRDd{-W>g7gXw_ zexB3?R{@M72HSQyE3~*AimS`kbVLWn@>*kLtI-)E6&awDW!EAcz<@rloMM$W9 zX^D=N)iQfGI0UV+c{JsdK})N_5ugS}>|6e29yKBG5WxpxpmVltHHpte*uz6a)EMCA z;L?c-3qQ^r5#^7U6qc^k+a1}oKE3VEQz?qKQ%i6N3w33&+u)KFCFNwStI2UX&pyLs z(Dt#qAUx_#v>)Ez&WP$zRGKh0F&UyCqM3_2pd=&9&B?VivhHX&h5`VTUO-V zNty`OK3f>_eMxv&cDorIqy>D8+1S`!ud7ZEHM9W)=&OVvzF_}vW42rCkDi{-3Cy0M zp>Q%X!&Rm-LF*OU~9p?ZigCks8fr&(oHiKpBG~9EnKxT_tWLN@tK>vom%J zMPBv?eJL502vZn5c@9+-rQf}a4ELOyK#e3cOo}8c9r>_U86hHqKMNPKiFTgb;q!8% zQ*Td?#nP>}+s(;^_QDab5V(;9qh1U8HM*ht#qLO;Gnz&pkU)Kdo3zR>CZ+yb>klTX zJ@cO2#T3?oYCsbOBBPWVK^V6NVYIQ=+P|guM9&Tk0z4T4;HJZPd0}&l(R42nAB&O0M2zj&T?TD7PCW_Pg6!MyyI?sXrjFA-q9RKK~uA$laZ8kD;c(9CKR>q;_FK!8;p6I=@#@s32bEVjtsQQIP$EKs* zm27Zvg{f*{WJdl>J?YYyUSt?y#;6C0=7Sgu#+zH{lxFdr9d?yikEC}N>?T#j2tyHo@qV9R=d4YG^j1+l|5yA8p zH8(#-3BIhuk55hAt_Qu8=rk4NMJw|}3Xbiemi z6Jd5osnLm{1JwWK{oKh0m_R#mGv?@-{s)W<@GI3cdHRwgRaI3W9Rx{?OlJvixdlw%18@R$Kr_Tae8Q zakw=R8D6P9q*@agfs&noLGY%|hxKI%o`BJp)@ZjK%qKfOubyCi56hE$x{?+suTvR? z8C7vbJxxUkNkz4!t2_t@tp!QVMW9g;rnMlIqgE*kGAo^fsY5v$C+J2A|@&3|jo*Uh>Ba85GnVAcKvl zQCC^G|NJz@YRZ5N`=o|SCSU<;&Et6>B^dLyft{x1_GK+rPiSovdp^K+)}yhe7}hL(Gn^lYk>1 zEClMZGyf}f5ok;{{uVj#K1P5lA3I|({QA2m{{WEQgyEc%QD$jcX1ZzidY=hDxW(>0 z?*yiFipO6Y`8bmmA0Z&l85~cGvWA8SB0|IL#DfJ{oGe%>yaepR!An)TdB8M-4D$Tix-rKe&DMHH#=4uUER{ znB`1KLeN>{HyD?E>arW?%N!#-h+6EfBA@?i;i6Niubz)MEA`$F*T%R`yG8uLvb<%u zP&fSp%>(*1s_yF%0-wgCI7eDAEW2JYW|=kN?XPNc6OhR)-C|RNb=E&X33%3vzc^XYOwwU@M)KMUPcMFNB{6kK-DKk zLU$KGw?E|BjgA%^5#>~%1g^eHg^m*L_*a+f*@(YFi0|Ymf~CAn3*Y(4E#i#m?fjn} zxa%*+=VPY%DCB>!!`XG^GlwN^`PdJyK&IE>`hSPR`}fYst_KGHa4TM)#fJYsEpC9p zT=IXLFpNeDd=C`=+(^KN=Fb;8P}Efv{q?s6ZP-qT_4jTo7XLa`{?FX3^L51kiQJ0o zf0oDpwlLlcy4`@!cFp&KKcarbGLX}Nqw#OK`tF`}F0V8tO({jO9pTTduAwtE~#`ERzOcfD?wzyYNp;HQrdlI!np zU>|n+mHz&^3iza_XiV@56;kqPts}4>%B0!(nnMjeUEa6Sg~byJ$7ai)dijCD{JEU_CVWJ=l_rm93!)bqp_cr2HC6NQEIa`;Wz2Ov9YkR za6Yxd$_$IwX5x}Kc8il;pg$54{d;2yAU-luL6}0LRA#5bZypadc_+*!*cC7$wrY44 zSfsuKw*_wSPiWT`jc2Av&YiHJSV+!Q>NTo%CWb!EmfNh|EPoF-PAmQWv3)o2-(V%P zu~mnL&7t=NZ*&L)`b*|J*|hsgm9iWUvuw7owtpVDt?rYI4qzV`^#)t$>-%{V#o>XU zcY9!|)GAak`%rQUf5PK!6XTnSng&ZN0+hDVF=De5V;J&2^m8>f!$GCvmahG|67WxA z&_B2SKTL*yqYMVdf&`BE&!@k;{PPH4VBSL_-hblwhs2^qfA{3A>L)e;=IOTL_YB(#>LbjM&16J!gql+|+Z^ zThaR&FXLe)b+gjy;doJGdJ|yt&VFKYRa~i3t^~#CgWKmKar=F^$Bj4E+Nd|b!z#fF zt||NA|DD5ykS@BB2xl0GNNE?A%H=n-t!^E4z`UI@o$wg){R)zx6otIk7Sv3L$(Zl! z$}g~56fh!4S(IUCT5tK*7Zz=I-WcBh6gw2g-2%QH0`-U*I@6a>n){)h6Z)SJc+<=m zyxk(l+p(uTuTt9VcogObn%4|4?)+vRDtV zG|NuYC+%{!71-LVv3|P^L+FzBuvjU>387Tf(Jaj(urEX#0>b)aotkp7YZB=aEUB?R-$5vwEKq2rXMQE~>CoFp_A*~-pb07BZAU;1f zf4j5o=ROgzD7ETsA)`UT-N-UBwzimz8*07jHDGVdSH9_YdD!RrqRUKflgXGDHvrho zaLJ_gP;F|rj>-(=VRM?mf63x1{pDDz&(8r0~-Ta}g`d-YNAFcBRHr9l9 zI)lGL?5g67qeB~I7n0Q)u=~ly?$!nBR-55&%`B2);{|`d$D9E%#G}}dym_=vBWnNg z>j5*%m!R%9vo;(1EihdIiw}NBWaS(R8xZ)@_`M^Bn*Z&|DOYHIP-O92vX5Iwb|j;> zk8(E3|H1Wp3Yl1|v;7tF)wuobRI`T@RR6YG=IxGbaY>ajhpfErSgJvp273WX-9{wi zt{5s~)At9G>`QyR)$9OmQtm>Mybi$_78`~Wr`Pf zvRlX_ycBwo-`=99_ilzH7Z#XaUe0_PU#w?p{d_H(Sr;(>J99m{gDgYh#ARUR3GCuH$j2&ZJ~)^GarD4 zqcv4)4T2Gj6pP8b#XxtL`FFE)7nSadk!n(%A$VCkTrFVExc^Kap1k-Chiks~DR{KT zi<~kxHO|apGEzM6qT8SQcIhUS${B;uF@NpiZhCdX?4%4QKM^OLf_T@J;=Qs-en4T~ z>l#&17zv9aWgJn-U8**`5WR8uBjdwVdsZv6Iz6`+CUVoyEb6S`!K2w(c zQs14L1xF&(nRC02f&#x`RImLl{uXD#WQ$Qo+VWs}vI#y=xK821A{=wYn2nQEqs-1> zyifcyJ+QYIjHX@`|KzfUn(eAoITEAc+TJikOXsxFLyJ$>8OlSaB8N(9VTg$7cERb5 z7|o%fY7E(Vuqvag(zNaWuH!<+2++sOCU z&YdS~v(F+~lUK>=jp16weW+}g@k{*XCJ{le3Ls8v31eu~b*K6a6*(nN5*3{727IL~ucb2LXec7S?S z(6yb?yAAE4v&XjwQ)wY)qGI&!VMHYN9VT%yQFBXH?Pzixrte(b9NGsP zVlpk!TE_NQs7O z0Ppg$g;;y5q4#%-V6pk?x0F-nifN^XW|xQPb5`2S@PyO_R%sfW>UQdU*fZ*DSPVWy z4&Gl|DU};-3N%^UX5Hr7QJH2sPKERdJs~tk)h1^IVk*ID!Ad{+xxdEXjD>L9e(!*E z@w5YH1T4vUtXs#y#-^@HsKLB#VADrAYs&lj2eN@+tUc`T*e3K|4WjoUQh&p)>eiIJ z2JA58%kF9%9nmtgaMy-qa1b5;W<|i~{}&`YV8#S*@cxX$sTB<^y#WoCJP|26I=ZBk z6p&`ADTwyh+vua=5d9|sRQ{e`mYXZ&6E3ebOV>9T^I6u@oQHg~#Ye`>8+q-|mAq|~ zbahKvqypYxXABu`Z|{6$r7UBMh_+j8qhR~+pUjV%fns7{A?^*ffr$|yV?#ci^4P2| z5GB=5Cr}oijw$@#Q^{LCU9*q+w7u8pY|bV4yv?xgvR{*w9URW<6QigSyN8`c?d+*< zm;Unrsuq%p;uiKr9Km*MW@L>&lA;shl1QFNmcHm&CrV$Ruf^s7R`N=xUPO8MnNr|j z?pkcsHBzBr)URJ4l!lJ(*Lc3Hjw>KF%!EAzXAKok+X=#L!G?o_(_Cn5bdBI~JVr&s zRw&zp7P_WpJb_BjoQ#z=+lrtAb~y}gxrY8(GezC}b7FE6RX{Sl_{*W1kkV{jE*Mw~ z@m6x@R0jzqZOrT2(K$#wE1A7&Y-~zZO%3RRWv*G$($iD-k=k!$X64ISoT@3XWEa(C zQtyo=@Ho1d6t1tUpkEAD-I{1LKOz@qd)lS!SO1wCC~M#U%~)?|&hDD)_dde4@RL(F zzaX=F+q^w)|L2(Wf1LyW*OUMQBf9t}q`bCebddO{<@Id&$yro4jFBu;8ypwd~qrUzc=YI8i~-(*b$l1jFtY~%zCEYh!=)sK=lRwOBSJit@5FN_v#BKw5Jyo3WW(3bZUt>_i$>T0II{%&?>eVm&v7i&H7a^~ z0L1=1B~g#V8o(h;&dlHmTAbQg#$*r>iJS^93oLjn50~if8AV$iHaVTeyDQ zqXi~5uy3io?%VFf7oTNZ@iBOvhv>!=j;0K(=n>Y-D=R0;EaT&T#ziJp5aDDe__4E%*i zL9I9VXkwiHB)SsmAZH!zq*dr4gXhqjDb)XYCcgUODOlKvM-8G7x9)z}&nL z34f0FtcLNSC!w(nSE!wlk$dvE`e37{@0HTPhgNT8nZf(^oWrb)74qP z9-GN}o6+lg-NRRFtfkgj1f)?6ORpOw_l7U+mpSipW6t`ie}fBU03%kGHucMs!Sk8e zSTRDSScBQ7XA3yI3TQT-*XePdgoj6x5(h4D6aPp;gQ)}Lxtg9@j9z}Q_J~K6rp%WC zq?x4lj94ov+@d?d#w!9oYJO77mr|MOycs5w$J4H#Q$ks$(y5@Ot}gwDlh$C0rzSV4 zhuV^;)Rtz4Rc6#BJFWl0+*?OQxrXhdY;z+DN=i$M2q-Bn%@9L(Z6t^84n;yhx}*h$ zF6joPySrnkfuXzR_vrrix6V52{B_nkYaRYpc;9#CeeV0d?kgJqJzR+cf4B7dT|G`o zXV!~vT;H=E2Ftr{qqcpfZ=nB3eX}(;#A~fMmW5esDYo|W;dp<0V;?(9DG_jKr8O&; zc7_*{^?I$0*7wa--~kkTSo3aOYxe#$du{?e`z7D&r6o+DInLMu^)7mK=B@rr)m_h{ zmRD9*h?ONM1>C3@xY093S4k7h7Q+o&1-Tk*m4>qu*`c9l6ug=q;#S(#p2vvkiIj(a zHhZq_lL={bN7;>TNgR%ImdmrfyAx7W*+ ze|hObQyY~`%}ew;EobTiAJfw1pk_Rd2jwheNlED%p2o=d?T=O%x&{&G41j{bc9U6Ct#eS0b1_HaTYe znYhQtR4z}Dyv}Xk3wM$|a6I9fmzVynK_y;k?s}>G-sj__E zdi7POI9}IcHp)uudI62QLshY6vPLS&Z|a1>DYH(5ueR5!Bx+mf5!TVsNad51m=x7a zTPK{s!@VbnFXx3gO8#?a#DRbAESEw4Zdb_TO*0FMsS~~+)*T*4-wMPcefHF}2IHFq z<5+T8czkly?gk}Wu8++&VSn-BX^f|h;%uGzAZx=lF{UkC&pU=eSH*Z(( zojKcaSy_5+nI4myAb8w86=rk*DAm1ei3%QV6qBwq*_Wo?`97MmdLm(+PCcZHU(9~!6 z7UX2Adcm7gq0Ug26V1p_CH1SN0rHs{E&ShC+65Ac!Pn|3xm7=jVPO(CosYg`r$TIX z^_NhOa@*4wdisFz4MjCI5^&1f_kb0@&odIcqk+%y%O!b(ulT8>{B#3w>KV9JnjR*&by@jT^ga?P&SR1Gr;$jwxdEP5f{SOO} z=&W;ezzwAmAI{HmYAY~9mLKAHf^f*mW*6?^Z^cm5ON{T}T8&8Sa(`E<-3@H;hup3N z2Mc%Bmgn;3KQ^&&^Ea@u62jh4oIIAq~3kOr?Q9 zWkUC1?qJVRy1ataW`I*K;`yO*mhl90VzdbTD$^^ZSD^au55Vl*?@sbuq-yWBxXB8{4d?T zzm=~{R?2v5v1!Z5&@c;tq#&G|#yyP_VwQRj*@QQ~kCW?PoDx@;P#bD#aBUA)M(00b z;^p#QtrB<`o}4F;R9%Ah+me}hopyCrbz*F6{4BCmv;%ZHy>P+m?s9cYv{(Q7iBROV zU&GgTwuru-EC<|ZkbM&$ z8Mf(k3o)=8$TBvz!Hag;1O^8nU}9j5!SiQw z?F<>X_&!5TXR66aDfi?u&5E=`d%J_y?08g7MTI{LdeG{HM_WY=F5Oo~?&wArs}EA4*3? za`*N;>iTxH!Jw&ivSB-Q->v)R(uUJwhM585UvU3pz@6W_lk@jb=f@WX@WPu{E6Cn> z)1KbxM3QWTs-E8YVf&W)v&k5Z8Q za(ErhWPX``fEiFt6_KRXXv?QwS8H>d=KoR&FBxc?`WExqn`Sw5p4?e z8y6dU&AEHBpLwM{yKN+Z07vQO+ap=&iQ~OR7j%=Z6ZFzgKKPij)n+`Nr{Uw@zc)DN z7%2lUdX?&bG0fqGmhZ*?6Daxm&Xz_eSJlD3biow$Lan2- zWkDioMiV2ap& z<`z^seD?gYS`HMecFtaZ(Wfh9aFv&bIVM{DOHfm^e#A&-XQH4Nm$H6%Y2eE@%bt6b0b9V=oF;r+VJRrojhuMAT-^o9M72?8Wm#BKx41c7ZbGp@PY(oz z>qWCw`t{Dh(B26d6J*_7n0}i^FHh0z*{+10vvN4T4SZ9#JLJL(`*sdiC6%ANZ%G1) z0JXpsrKK9^hvbqHfYAEgy9(SeDu!vGEzxiKJ7;MdA}dY(cBmy|kLBrpitG8%)gY=K z931D(zkVMAsuh)q3EwK@ppWYIYKt2hx`u{6b*p$EtmwF&)3K>4Li*EBXmzc6D~{tQ ziw8i8+GLHL2eaH!^4vRQ^IJ~N6gF6co3b)*%I%8yRMXvu-EL6zNj<~Pue8b~I)XB{ zw;soBPG?Eu@rj%s4=%1&%VI&8qwksb?b)u|?a`n!8_@esPHKqLcr`A1YZDO?J|iYj z<(p0yeaKe@v$8hPYBRaI6yWpT!H;Je$3*PT*9p2ERz&nu@c&4=s?6UBO?%_q_T$&M zX}$gU&H2G-xoN-InAD=x&4Xnrdp7g;&4T47tngQ?bW*aiYKq3wGZj+cfPT`z+Y2Ay zuctnG^3irW!L)lrux&}OWkI>kSHl_ZHx7aL}-w5NlKbd?U#r1yyh1X5wzIL0}k|uTl3`)F<-T}bwFPjkIyW$wTbEJ zg~5N=jZ(I>mzR}E$>zh99k2sex36{X!W_pMAd*h2c+8Ly3yZaLp&zw+JhO;7~x~u)O)q!XM3IYP=26pasBOEY_+mgjX1KhRr|3*;P|e(WrBzawEXUmrZ4hmPM`3)cY*zU4|Y5bJ1Nl zfv4lAAw*E{)S{BrI619E?46LuwJ|X<-O&tHc4o0DDPB8MjLW~l0t$9#KcELrPdAW| zxa2%bN=?Pd>)HMaw2IvY@{~k}&RbDw-(=URk`= z_lx$mQVEzQ#5&t1zLkq!RUyoV;H406VQ(p^m(zP7_p;KZt|qF)fq~>XiRIj;L^g$x z`=>qJg+0TbH1e}HJ? z;^Ly-h4QJMHGT0tbIQB*&ZwQ4dZIjZuyk-xP!K8CO=M)MW_<-GCnxuHRq^RSl(+cG zdZG19MYkLY_pR}~P0aUb|LtR#^6hk^d`)ap5(AnweSK zr_X`q+tL6o-ewe-RInI)_WWe9I^lu+nt3 zgF?+s6iwGzb$%OeeL_MU@mb=;#$lO)>fscWd^Wny-yy7<>@)8F&5uV86y?eaF8#C`dFgl&SfDV z2U4z#_%GTOyi5)qPC*jx$-&8dt%XZUHwaKlX|{!R^tlCMlb6B_IE{Pm!R(>lLmJgT z+>fVbC(mFsUS5Zyn(tDteevm`dPbo}ecS4hlyXIZGVw7nW8xw4HdFh7HEekf!toTk z5N+R>*6rL)!D0crLTWZPUJj1A;Zn|%x1h{$v9akid#?t^T2xkY_}rYBDlN4@=tJeY z;_7bdU?cD?&NzFs(K=scyW>rWT{n_@bDKY3>kq`lo74GM0sqyVc6nq&^cjxjv} zcQRg2$BCT_NKm)MXS_LL^T7pdHm4fvLXO97q#{=6hK%^8=>mlqJ8&}MfViP=TT}R465kknwQb1H zN8+XBU=cCT*1)g=l}nxFRA)b`1T0oxtEp*KdEaE;$MSiMg=LzTE7jZ${|hgE-{i(7 zDgL$YGcw#d5H^b2m_eKP){sJTUf%~rO`!37{)Jr4G`o-M@s#Q1*IEjfJ^2*=QvGJZ zjEjd)c4TJmUg1#0MdzSv9G5{nDM%|r3)p|f8Cb-%O~e5*$#^pJ2Pa zwfXg-%mM2W7V%!b*GUQsFnF2^%45v4n5c>T1X0e8wxWGPz{c;kqJb;RV|RUg40C{d zg{}D6(Z(tAZLFC4KMlGwS7T?fzH@;?;X0Ve*+10vF~6b0>f(^D^z8wH1_TWI2jO)p ze&|c(DYBa7^0}?Gm_AfZOeAr3=E{H=iG!%H*=n?a$LSp*AGE%=CS8Nq$C{g$QyGxe z2iTiFC&&|+P#=%${@>Azo2?r4EI|=846r+u4vtToj9(Nl4vd0=-n(7PR( z+@O;KMfsOU<~Dv7-F~Qt(`{=F#m0>MqNd*H2`|B1Y1+LyewM6E75PQefl#a=m~5!I z#OxVn8onJJ{Y|IBoJ-o%pj5JVwtj8vdXf_3dU1YO5HrI=9ClXyI{FJz;l#{}8dgC} zN>xmzSOv5F`@eZ)3Uqu7ygZCueSL15KSZUawQ6e*2z0_iPyQiIT6Sjc)X>H$UWzl_ zXk%ouz#(@Z8XIGLd*J2_eSNa{cynSr^--T&zj=w%0cC`=K?^!EvAqpaoczdIB6%!k`H&+?x zm(j(T2~5a&oRHtMvV^@oUG^4E@~@sK-NNrlk-ljD{?F1+Z==YCMjfft?pj7R!544# z7j7Opt-G~#{c_oLk19W=T^riBwGYVm2rsTQ^>}s|MKx#!W7^F6Fx&EK1tb9*q+ecM zBF0`48(LWroFXgzJRjlZHRbpjN=4YL$qUU)X_V-ku*3SJ-U57HTzqF}=m)Sa#GS8k zT@HSUW3$k};i)2~gzB2b6f8Qm8xAQeSt_Y#+got>R-<9S|>$2 zorR)V$w?;b+3kA8YHPQMquds0DeoRW7d!X!srpk(&|9$!qC6G_#)dCM3?MkqEZ zs=By^E3G#NE&SANbhOY}LwVm-eq; z4cFHe>NXKHMYcXcv*B=YxvDP}q?Cf5vcWG`#x2V9Uj|84={Gz^?d;Hc&bHUGm-tHh zwySuZ?&WxSspRD45t9M3p$`}^FaNg4JZ8GwOcr6)59nn_SiQnyD7~GfI4gX0x5l}uN{52`^=pxL zNevBibxx!-OK%-r04*tpBwsDOu1O?_bQ|C}NoXGn@AO0h5-qq`7mWu++pRXR^4 z+L&)Kl%kl6ULv#%2FuTAA1iLiHBq<;xm`~MUf+rI)X9MJNrzmmMDHsSR4ZZnKhS^h z8>(w?***8{P(KKGkWrwq-G=87SNJH6;anyY9G%z5s?)LQBTg2KymVuk+2z&; zNeKy2M_DazgM)+NFloqGqc+iDz1+L&^Ps^fx+5GiUJ-BezdIw+?lY<1oKw?&tuSF^ zZ0l(9SuZ{|URfDQxvs#~dnWD8i{5V)(nF|$cLL4RU9v3)^oEdZikXp7AImH1 z(0k~Ozgi9uon$bRO>T3sfRp2s6}*MCvXG#>t7(A;p^slDaZ|qalsbtt+M6`9jG%0~ zfB!z0^8{;aOQO~{bfYQdw7#9)0k##{is334t3~w#q`OR^P>Pe~RNO>fCnfRw@nYO! z+)Q4#b3QG8Z+-UW2(J%~?UnKe@$?lrXsMcJ*2OxbUNIC}((-ed^hsH46SnB1Rg9Zo zjr`zd~hFt`?d6qg!$CQQa{`np~5^IrB4Mx(iy@7SbSZ?lT z*bysqK8p>r??(i)?wx%ZetK$y1VfW)cri#lc@*sHaCKlu>C;tFV^y*z5lOlD>ldrk z>mZJX?gWFVPaZCmW0eU3g7RsT2_k>mg?3aMNnWHp9?YQFMO)j;NK4Bdbs`OY!*}GR z{7nn>LM5;sJtAx}E)U71E)diS=m?N~aJ1r& zL*2r|qdM6$UQ6k(TT0zROI~4dbn4CKvF>Ou^3C%xXvAm@J}e(7U*257^eM+L&IMBh zy@DIPdf{+<-1d-M9R+(#6`==F6Hc{5}*BiE+zkJGF1xG_^%U#@8Oh1ve1u zx$1(8l9vRKRAoPo&yc^ztFo-1)_@gracF#&E($dG7Sl7D?P8rlg3?=C#2Krkm^686 z60Sm8%-e-FBTrLZUqmV2SG>zC*AH}-m{$X>tG98?%`mgvXnE_&;uK1ugS7+K%IKT# zp77$|g&o-DfSG?$Zl}F>-&*&6DGnqJ|A3But#c^1EMW3to&o;=$w{Z@ICeGYkFdE1 z3md_0I&bq*X)jXIm6Ov+{}ulU(5HVse7EKsrvVH4p5vl|DB669Blkp^B0NbyqO0UF zSxhW}%E0L~1&K)0Ywnw-O1%);oa`w2tlC;e9xp{N&(Z94BYqx#8rRm1jrAx8-TU)( z@7xxAUhFb5AmT5Ps!U)!ui5+Aj4;)g(N1#OR%8Em7_~}DK2uHCj7i9xETfkZiO_k< zQvgvt{jOPmnRD&iB7~mNv`WYEWjh4sT4FssYvYU3%JcvW3A56U)^E%x!1y~pRe<*1 zyT^|oD=8`EhUX2#5%!Dd8ieh;l{ny2XEj=%tzm|iw z8F_@o#&Ob;!|U8nE+scSE~vjIFId7%)%#fJL-E+wRgGd&oUoL>B|n0?o)?6#mv^LQ z+!MNY*W+|^cWFr4l@-S~xm>I4IA;KwB6ZhkEY|?c*f+4XMC5#4KAu{Y{v>+mYUd(5 z)JJ6k6@0V-?P}bnq}m}rg(dNuo;oTiqHj(0wd$70PO_hDuOW!{qHg|y^2&{H7LA`t zg(9h5F&PMoD__L?P)>TGX|Lum_9dOqc^4`tM`x9EfY(uFvHc#BK42C9Lvbadyc3IX zVA^MM5kOE6&L76deBtp7!c6wA8Eubi@JrDkFS5^!W7a0PDt#G_xaUS`qCTb{p4n)TY;xrR$98yuqMBJ?vB!j zVaIZo(J`QJr#ui{LAjHPa?FV{8rq>GJjZhvGKl0_Kiu!;E&Ni`NLV~G)GFL4wJ|Io89MIdf0@7&?f~il?Dwz7;0Bn*%%m~u)WS0 z=!>ZEPq;9v#8+Pw%=gtkux|9lH{0WF3Z8YL9XvR|EH3uCbN5aX2du$(`;<4jsFVht zhZ)tpTi~N%?u9vV0EyK3kaqs|dcR(N%rqZLwiPB5<0uJ}z9vem3D2*Ijly_Hmp!!9 z`yOy}KH>oKv6Al>kAMVCZl(fZ*=%X3wT|8`DZTRej7e^-rn<8M3Ekfp+}VPG)sSvA zwSEG8r0eGEoMh1)p3O0o(t4u zCD1T9(OZmX@LViQC1xY~NFh})b_eN4^Yt!X7i>G#i(DakpdZ~{s6+-2(S;D1nZvB7 ze$+Nx-|U57``!T&R>RtOhBS6TGB2ZX4wptM;Wcn~iha=8 zHD{B!7j%rV$+}}j4JNVquT^z*bzv>kI1Lm%?9XosoOFw+n3>1NDuOnP_ScEJyAd%; zucnO&`;&s`6S&#s` z(bv?}j#_^L!};4MBB(cKibJ%u`liz1bZ2Y6jweJSYH47tchY%}=Z(z*u2KN=D~}eu zY?E=W&I}k(VH*fXrZyFa6%RD>ovki5P&oyN`TH>x-`|#lz_d_SUfk0oBfg$W85xFB zqLJN3BuNc>-&G>yU%`Vni%Pq%9%&9N4{h!V(SS5B6O-({^7%qoN<695KjSUP@og!4 z`>2ZGZtZgO_FhI-BA3B?cC#!7nQaFi>-su6BhC7YYDHQLM5DuuoSgpf>tT3XEO=2~ z@?(Dyk+O-7lHw=|U6mB!$Hk3#!A#S5DH*^qzn#oX#~I4ul-QUg9Usl^q0YY8OU z#CAj#KiAxR`}R$Wx_5$$*_>4=lSNfBY|wk~ZZe+>av`(eJC4@-2-^m~8|}<0DYx9d z!G1vad$Ez`Z{IHOJ?6ZE~C22Dq8&*<+5CellJI=pUcs=H^O!FWy1} zY;hqnD)E>p%6s6;5A`@TLSV1g5{(APr*>r-LmJKU8Z1hUO1CmbwxzRn0!fRize>f? zad$*bmv?SYMy{{~M+$O2!_+@ZNFW}+@&Onb9=6ma{0r-EFbcQn3Mq5RDr`sVc@T7! z8?2q@C-RvUm^6VmLri?0dQtZC0~B)FA*K8%N-;Bx=~X@xlSL?rS4-ZgNPMdG-3Plb z*u}&>6i#yBg*!uav76$FbCdHn5eEg{S|%_9VJJ<6KEY^?ykb#9>nTy3;+;G=hOX$*x?$ng)EOuo3w7Wq7`Zqe;Y>9-O))Gaq8)S^^5iK z;f;Xp&#TkgMO$y-S8rZu zIQGkI43Iy>Ay)7}eG>i!fk3c`2G}h?yl&S&%f4W_!P6w@J=O`&&eC^kehX`vI#})e zTOB!-eX=Bcw+p9c1@{+b*=+TmIm{x;it4@;G$oXjZ>DpSm4N}IfcN!oFK;T+fNV98 znJkz5ZeXfwUu(^QcX#24kORY!F`-na-D}}imV>)h4h(%3B312SwYuMIMddmJS4Wh51YT)Y1 z(ZndCCMs_eRWwThP2oG zb0sPn#Oj90_m-16l+0J`jEdf_!eX~N;4#JfsxOvAu-M1|os+AoM-V9m-+GEOkY5Rj zle&mdvqm>HZYLK3cb}l@y>G)bQqxg!=$!qI|a6fi}9LvQi?H zWT7nUJE9#WSted>Jx@=$Y&~BW(Mr$L6DiG-tdhwxzJET9S0?Y_xQDztzIi6ma$BUR z4d++splbsZIc$=#w0uu<$e!Nb9@ATo2}cVHVV!_>rK$?EM8)Y8X%Wn^_Y+b`2#uG3 zwCx_l-Cs29BiqleqP@jO1|isHv@z?OQ|oJ3!eTV9IWoNJs|eP7h>Wz?d~mj4Aqw75re*})%;@j(+aL2Bd)Y;Pk6fDUejgN zt&9R$x4x&7_wQ~{7H)J?pn9|$vvqB zgEw~<>FFP(6=__(E!~18gbva)VIave$ z-gE!9cN2v-mCj{XIAnSiW-J#}N?K~(hhx)VSAdE4Vxu|`n^?>ncYITPu{=jce2rbO zAe`2e6N~^|IDiacMgN)6^9?)#5c{cE_4I07jk{Ma5QRIv@#)n9yUr!fEzP|43rac( zUm~KDfsG`%gaW~+WE0Fs-ouUB@!Hk9U!?1Ol_T{PB2rQu5Su|DIx@(_dSi2{t?;0- zfZMzk5Nlc}^*4m33=B#4;JNI^c{8sTEZlfzGa zeIhSZBqt^HLV0wAeWKnfk>BmQNuWM>$`bwY{VHU&SM!N^ptgX!OtvDF5xac#7} zf-<>n@X%A2ljo(GkX2d+?lWNU!ESo3prLSdn~j)6+caBI@YtJ`=&``*ARjak$2KWE zwBw&EYL1VOTl503zz=vN>k2(QVZX^e}8>h6eLII zA}?c7QouH*B$^@A!9hDSKR+=xq0(sXH_N)@+dB)q(k???ihHy7huS3&~WX4<1pXE;hl7^e%`+E{ThWhI#ck;i%;iedG3S zwPQskdaf!V-_j5)1+@&S6ywbi zpYA1fx!S`oH}-~~Au`P#-7iYVQG=bsd0&D^Tt8*72{YisF(2=n* zjb`gme$gSa7arI9k(p64-vd@gM&g{gT0EXc(Buq8=j=`j9X{P9f$Jy=l&QFpVvF7t zT_zv{zzo9U4Htb=hFa+uz1)AthQ0%QO+G9a6yJiQgYFYKIa+!y=-lK@3g4O37lRS_ z0or0y8Xk2{BLn8f@|AmGBSKV^K#rdzgMKI7A zWm;81DmvnMup;~ZCl%6TBu_aIIE(au<7t-tAf!QDc~ipdJ$OBsQZLnwJu*TgbYQ_9 zZPX5U6?O*)fkKaEe#INu*qj~B#5!!S4oIQ-J0&pA(NvPX#}&uA=$$MKL3mbX(o=G| z=v%HgiFzz8>O$sYe%nn6To1yvSNnq_FRmIl5q0# zzor&kmLm;RTkQ<3^=S4s#s4d}2f74MMJ#OZPn!?kw@%J1EX>RxyCU)MF~%r=Q-dfK zm7+ww;<3s2MZ7YDLqZtjQiZ$kIH``GY)?ixa3&-q=;2VL#_pEZV^H5*ou%*^i%50# zdR;Y_SPWqp4KKHPxalmUw@Mm**uIgq!1z8SejlSrAgwy&4}Iyq=*QoLr5u2e{rUNS zLyI^1%}N=~mdn2VoHkjUEM%jW5{*r{Fk4@Zb#jr+dty^>^zmwY~+xC1E zn^S)Y_(k1)=V+sA}ciULfSLaV~F`Sp5eTbqW@Xud)dv`f|&Y4dqZJeGDI>$0_jK#YuNt9@m<3uneFg^ib@%Uw>7 z-);<~I!G(0uZ{3#d|_qzJ&UIv*edOZZErxe1%^BtKX+@fW|f!Qrt56N(u6 zaW#WGIppRf=YN4`i^TeUX{_-7N9ushKW0DdGD#EMuQ#a<&n}KWE`l?cncDhQiiCcJ zS(B)R2Sxby>b47_3zJ3NmO6!nf!n@qh($Nq(XnE5WCYl4oo)_C&+uHhp?c=#=6sy@ z7+M1)9yplv|1g{2U=`Zy87Cb#RaRC8yc7``4?Y5d*z=lmpK!A9u%N70B{j}w#v7|w zg*It=|JN-vXuU$o*`xYw*A6ug&lWQoit88oosf$luvbi?eQYXXDS~LVBka;(CK9N=da`)F#$!^MV+)vQr|?#Bb6VM74a~20 z%AeVx=9_I;ZzL{>VZ>(*6gB$w5R)rdyAm)t4Nbazn&oyrv;Yuh7QF_Y#+Na%v8Dsb zGac!i-6KaEpGNTg8yiz*>o~QmQP0`kYlLa;mbrlRpO=i+HI9*ujm&N*TQr+bD;&G! zTR=dKGdM?wCr5pb)=^;SX`#`>>`Y2bgeGt-G~_X+Kz$CVEf+t1_P;OAIZ~LC5D}m5 zH1V)3%djKtM`aZk2S;C*RP(y`=;)Dw7ki%(8@J7c6%wahij%PTGF<4EjL$iyD$H5R zc5~S$d=rTbBNiCxDdU;G0>)_a@&L#y&JY7_FW6hp{l}l!1kP1J^Oo?q!w+J}S7nit zpM83YnjOs<3~X?Pm^kmw!4~E;4Lekw=GiPp5G5#WlR@40YFZ`8SG5B|9u!lfSxLZ? z{>QQ*x3w)0UW^PW*vyP2w=SPw3evD+2?aQLk67$|uRjyGIzcJZ+|B4OVfO&^T2Q_J zF*asokn}lub-2Hr3ELv(>_IL4ntv4hNG6_zw#3)hw_7>i-S+Xn)P!-F_m}gE9!GR4 zUGAuN1__o64OVmK!<7YIDG*h3pBe-I7{BKx^VC%OXY$z!E^c<_59MArspLY=!8;_F z4__`Ttpuy<5ajDB&`U@}=RhmWOrV*=dI16YO^%!_g3F^l`u^>SY{tG`GJLA4s!EtP zi--Fs9(rE7h`Un3A_-ZDDsRKk%uh8WFA=~o_#zpJ+@`0aM_=t7d{Hm)U$rXKmQCiU z3W69q+u6N;|CA9`R#pZ$N}pY3r68qPRs!L8XY z=j6OAMnV9nJTnco{uXI^K{nC5bB*#H@~Q8tjAiQaI^_cco6TW1d`>;I*f}kelkz%o zU4z^D6UDDtSTyTAv#6B~4p!WHf~7O^Xaf=I=YZJ9z>wpJ+P&^&Er=`9ptHq$-l2I(MnLc| zaDuODFP}Y4K({VhLJCv>3W0jyGf%_75PyA32qk&@p$mLXF9eQEd)VuoQT!h3I1KVB zjUId6L>mL6IdXYRDqw}vd36v?Cqope=4EI1RP?7)aiRQ3xb+ z#CF#`ICjx(FkASldBiAOFLN|`VzIYy#BZ-M@DzV+kr(Y4Q ztgAcI4sY0*%60iVyQ4eGr!4_`=WaYT(vs1^-x~15Z3oqALWD!g<=P!39{fnQO#jYj z-@qs29IzHYz#&vtQdjKcvQjJ5aKCL?6RNt+D{MoKRI-ceHN|9@^nII|&KnI&K{teb zP2{(`o~Z;`=Bqv69A*rHmlQ{BdqSb9vn5H74uJVFUd&WAJI_>@y)_-^vxo9v zRx5rG+;ZCeetqrBE5s_6GVO3>%oz&RZ}v8XxlNbRVF3=wM(t7D7ZE=Zc9T9nkISiD zfvd)}^I!?&e|vYnkSu=N_dW)g3MV`tR2Drk2@Xe{bwF!|R434Hi5^#7VlJW=dLfe&FyFfBzldB5QNNF&Q`4s8}31(JE|QVU!)nA zfm%M@QF^lA73j}rcA89_15NWe-KhuvU$M~u4@9{_A1<)ps!?t)1 z7&T3%%kGR7&?G?LD5W9#XK6>4XwyH528Kz9HB?ntLRAAEU!H8sK~`_D$_vfpc=XtRSis`qgOkWJJSFTk<23~ShvueYupQN_bBt|MuwFQJJ?+zX z4VW7g`cYV@;>aXyYMP^7k_pVi3rc+bgn0Q}>Rgv!@s!HaN0PUx{3E4|-&X5D)Y?KL zB_sd*{RJ!V^^{Wr+`oUV-pssc>C3r${=fVluVQV=~6Y99>rD z?I^hiNC>nd=85}Y&2BT0%p?DbbUHbynqS9VrJwO4`nJ0=tH_Yl5O1{^JuM@cPfO~9 zZj@J7uXfl78+pyd$_nrdi86~W?86#|@Ou(@my~bCl33G4yl28_AmU;TJ$-$3o)@q3 zPC?mPiOPVBns^^j#~8&H9_-YH=+-;lZc;~us3*P}YxY?LF4E0ad(?~({j>)$Lql(n z(LHJR48Ubod3El_v$jeJQ2mlTc5UoyrcspzmkD}%AiT4Nz1{1J+|f00u=U5EWf9MegEeiBb4kW@Jc5vgMwHycnL$@ z$67ty#U_F$rbZ^_W@Zt8iHeFIvb#6V&LADKAq}6ig=s!FH1I1@fR5%J0on48^irzm zUk$FyDkm2X_W8bdrZuNCB5Ch)I&tRT^7HT7Odlo%1n^#X%~e`#bjo{fH_(3i5-Rib zNoRW}&$|l3#?Y`}uV$VHm+{3qfHRe}y1DuOL6_SA2vl&|9ow2H;yXM%1Zyz?_iL3< z)#oG}8N+76!m9C>Kc?FiBj2h<(-PjNs_Uo^Xuh4Z1h43Wk+{D+ zHDZDn*L}7@d}lO_cJk-uWGWu@M{2;DBDg3!0{4(Fk$w}&a@EweE_kVj7Z(VfxUin56*KK5SqVzy< znve^iG2!8~%ppHv2&SoB2o)V77RrnZK3H(7(b2WvyvTm>=xszBAR^F16ZJNfJcIRb zm_sGJe7{XiouA)RpA`J`*C)9|j)gL(`WP%VeeytMJuh6I`j;fd3nQ-AU8XlBfCkA~ zq+Rj7cNEY;kg~Ox)cktmT+%F$GAfFrbK53_TwcAo7yoH&Q|yKC{pyU%8JNm=c9cYW z_F|U%_kfq|xX8OaGW_OkL*#re;K4^>^qgZF&Q?0*zLi%P3Zaux`#Z2azj7De?YWj% zKtP|D5qnkWts0|$wuy5(TtBaCsK?`0i=!NsUnjjVOoknJ`TT)$Dn|yL&q(_?A#BWy zfAV}^`sb>uegy05PwuENk|fqVkqOgI)y6fSeKi#n2<0NioGsF;`~cGEuduIWsIi!> ztR{-Inddm8ATRau3KZsfZv75R*cq3l_88DV_>6zZ`1$ud2 zOMPt3Q||ov^93pCw)rQ5+tSq>kOl?)3xk99k6f5;b88#9iJYr$yOw@iys4Hs-A&tN^V5c#$CW!1rZttmrh3J()l$;K)4tj(BI$3zA%5C5imC9$XgR(!4DFp3OvHCQ~3Dq-wznuC696^GJ28s|lLuhmSS4hKZ!lZ<}D3T+OYBetgA zB0}L7ViOG>tnAmXNS*z;+7M6(A#HJFr55rxW>4@>N(|VZcXV`YZTWr%?2dd`R;_p8ee&MZgNZkHHREkZLWt5!sHryw)8?B}XkgrctpQM?24flRZZ|18Ibcx; z9JwRyMJf1Q`#vzb{0p|@Mxj=A#Ju$i@^c?ku>D+EI31X;tCyLpLoJWhita72(B1_F z95vB?F@fUC$U{^x5Rc|p&S!QmRL0YxE*KV?3?;(faI@3R@_`uuuvXDoF9lz5()72r zePa>tTdJ#H+T!}3Roc3Zxiy#9CB7;FLAMMf7YEY@SBlyQ4jhF+SEpT7kq&?16(B?< z!>QA-xsYdg_0~`V+(Q)J;c90%)vUIf+WOjw?Q!n2A{4571&<+&or|qO?c#fKjoJr@d8eesQf_2xQIU2;&1o_Z``V`cS>rvIvl_3f;2TVz z(UA$0xv62nCT|`dw-#|Aju5HJk~}MJl3yh1y1KrCzTCNd9rvRo;74YZ?L-|DL=Yr&|k?~PHx%nTk-gCRm9NB~# z6>WBA=Em>eU%uO<8GP@xOL@-qR`LAx6iIkvp@XPYZ|C4(vtgj~N-DuC$Agi|XEcE< zx^-{pIGy&IKL7RUm(zd*E>)=CUpKlra!JXNadww|7uwYe58qL^3XpL*DhLZNJD|Vw z5-t7)GOj?XyH1?w@sTBjPv0}fTx+fpZLw_Dgat1^A4eyKg941|Y= zj)%MCBaL`9k=@C1-4!#r6$&7N*{`%e15bWuN6VYxG5FvN=HY8x&c`6D`73~UxoiZ{ znF)Eiy4#hRjr^2J30zbm8*6I<2d98NOGbAP%_8@JR{rLsx*y~NI%qemLBno&*=G8! z4Bd3eO^fyZTP3LZ$Xcc#J=&f|Df~IKp2m+!0)Y`q$kuf@qZY{0vW(Zjz@5VF5@#Fb zcZWd{gE2%sd1nW-ZayjeFfyKi-28kKV-u_SD$zq~+#a9RY-VM8IgKCxU|-}$EzJ)b zGUU0OEj`uyTm}rV0~+{)>0z)ii`YU;ITp{ka9hkLbL zG(-4ewW<2EBoyUSSD;!Lrv61m1!v*pdJEK(U<*L|LaIqnB8+UNARY@-FM3IFtiIl3 zb8Cys;`ZP>KgLh=T{+#wM9_u=>|b~)V}&Fa%04ps1>oK-*jD}RG?R4zP$gMiIRqjC zzuoaPfG>2kcLGZ4Z%@8+rGG7hU}?@r<$HI3b1;9ZkNyj9PoV1mXitCo0J$ts;5v~B zHpF+Xk@I?T&~wH8(axUR`~j*te-~Krvq<5nc=7W8BU7sXKidR($_?n&%O`MszH~-i zna;Lcu;)Ga_$#8>{&p(&*=GxRY8uuwK53H|tN9!*S%CBI~&-C4t8 zgYEjZFE6KuH}KzY#Ud)m%k!A4BgVylA)Vm&hJ^UJyO8(h(fPBJ%9G9coLc|2rulj? z!!gdWjXr(Pt+|BF&6gm)Li335QD;0pQBF?Qg}@2qOE_K_F^B87x`2)#L$p#__wBsT zZTW_R*?9rUDxZ_3kZ0FNN}tPwOV0r8-NB8c5}kTYLw=ZUI63D|-$gGO^uC)6+i0GJ zzGR?UeH9vdv-mf+)#Pda7+TpYWOzuyXRWMVu3s)TCKeaW*R`(wt*cG8BR_Aw=;fYg zW@g65B{rF&n->JVRSV1(ooB`lLX)05@XYZBg_Hb;1)OsS`RoZkJ>Zp&`A3E?$;a99 z!fQKhc5fuFSfbmf?E4Z?0#EHqwiXAci!<_#*D1C1qbPQr5;*OC4f+KGUv-lVr1|vM z=gX)YYfH=HQ>&4S5OtgJN|0HIu?Xmf7#R7FDLLb^S{`9P?&}{|wr6rYK8aDyhb~1w z{TV}PGJ@C?zWs|B#&{^39ad}|Up!CKBI3rc7wQN`Ae7cj&>b>&_e)-Pcc9yg*>PQR z5~AS@we&7GA#9Zl<*Bi85%vc9tLY){X- zNbRo_aWy9TswMx&CG`I|TX z0w>8&mp_v9zeZHp*|?eoh#?^UayLW`4{$-!(sG`d8@muI{ets=8&} zYxyA^_JLiNhdoZObq==Qcjam|!&hBdfYjR;FAyH-Xh_wXL#>|tWld+MRJpzK7 zTpqqbS);~yNl5?*Utx0c%*H15mdpPGQZ^5azvTzkRN|Ju-BV5Zf){XdyMaBM7W4Oo z{8Wuq=Rt4%Lb+Y{#f1WB!)IC{bgSm5q~H*7Cw@h(>6Pst((i$pP3i&kjB2AL5ta&@ zm5{vcS=NTWEu%btrw~9y#D0F{zf0BNdT8t*br{4hZVKU>iD}t&FYI>GSy^vuCCjS+ z^W$$B-^Sm%-#VF58x!kBw0}x0N2aGWD}J!B-$>_wM#XcFSV@$A*0vz!H3%ih2;eqm`K<0DQklujBP3{GNm zy6lM7e8T-0Of0(C0zpH?koG-V_MkVL%QDQ7^wjc3++T*&dmK;pi~K!_glIHyMjrRH zJP21+GvhFiU7el}_x65?ynpMp1&$|`=%3#cGIj3mUVfUZI*H|At#s%Mq@snnORidi zKHrmkFH&W&F_T|Ctvfogkk3C4BX0z^tkwMU-amA?2G2!6J`|w$nGMi(O}+78>ST_H zkU9OE_PRt*2+=}6E%ln^WX8WTnh^8%c+X{G0t@L|$3sx@a+xAqg(LVd%NJG-|qAI<+ayYskfShz% z($dB#DNT5c7f2@dKY=2Q%w`KN`m6V%RPC3`GaO3~3F$gXAL+^N6*qRH#p5MNv9LaV zTH`Qg!ir;dG|4S->k|j+{m^MuL6Z-c@~y8{on$MM1~zABt3|-QNtHilBM7F0aF~nu zIfcbwsSVIg#8bI!%P+G=iTuLbdMqePR*$B#$M5UM!5Vd3K)p#K{*{MTeUt!`cO*+) zF+fqMUEzArpUN86_IsNahF1d5%6Pv2-j)l#iM!@!^b z=2G))BSXWU?k)iI&;(+%tyo=b+QOn}IH^&-wSZmGh;NX2O*to?zc=wWyf z8XbK|Bpz;=!`{3!J0JAm3ysC&a6cHLdFQh(Iy5~xHr(3}&^*3sL3-u@PU}yeXVthv zFn?S>EgB3;+D}?(Ym15^X3&zC5B$p}Coi8Ry=x$H{ELsj>2S$HM^9Zt<9p#M zeyezIn)0q}W3hGptMx7uH}^wO&^fEsTAw&uXy_HuS6w7Pyy~2coxVRV)yYzl5 zCoczZBlQmSan|hpd_0F)ZP03U&n_;Uo=dmb*qc^(2>%gaT$lFw$zH&F<7U>}!AAE> z=s>Zpse;0O-#DbN?L;1Odv!25Gb7>@+(!2KpszAIH%F9-nCZT{QvPl?H;2_~QE_;6 zLd*0#kI-J|tH_zv!nTgb5x0P7y2mmPfTL{C#;78cPOks<=C!^$kXBSzXRa-;Nnm#o z)mMOzKkup0q*0#>&l3Pbxc-rli3x?}CbWq!VCbc0XS--aL3{Mry6VVUwS--|P9pDV zMDyzhX)zA0_*tL^Qd&%`n8yafdw2ENY(HopRWl)1Qv9Z z;Cj&B;oov1&KgJ8TZu9!U`xZl!k3ZDOa4UCvf&4B12|!JH@gT03=1-0+P%OuO>!4C zF)_XdLX&%gMbs!=0BHjT6y2@{=d3G=`|fn<)smYh&f2-n&h4pzlkOOF4>@-5*5%ph zDeQ1^qt^4zc=h@jhCrExMSzEuU%H&j4E)$94#YbG4oCPp$g@WCvWq3(;GV(@L1;A-n9WM^vw_rNT?uhE z10bn)QP3DTaIR{*wx(NISs_w0&@Wb9Rn^O-MQo3m3(aYs0zw{N+%c|Atw0f>C?`9Ms&*P=^6#z8#=z^E)vUwzq4@49;%gt?MuT~swc~!Hg!x%zZ(dwj zXnVGmEG-^@qJ8>4`1~OSD!{PO=Ac`6oQ{GvopPP61FQxWJMe>^r1YT#(h0=$B3}6c zY5GceKTQ`?t?r83ToQEjEh?q@a5qVStjLw%IZ*5rTBRT_7tyzu4~{&fZN{CqciOh+ zCF6`8*fcRUnWV}eiKUx!v>Tgdt#i2f-i*ExE&?k_zcOd_3s!uyyV?wN1Ii}pS|^hV z2V@M_0|RFKkoGH0b@)B8hcz46*&W#*kN9-XHtfziL|RtX`nb)Vx6uOr z!zb^JOFXu*`E0XVS}8KAWH5MOdPJrf7`5q4GX1ev(gLB8FJ;hw4U}iq?8xeQs`kexh#6v+n4^cq*tbsP*x1vGOiZO__UwDj%$P znp$(Y2apaDFm?=2HI)0yLWQ~HQqg}?QgpF$)w-3-zy{Q9L(7($SarfcyaN|1+fv6x3!Is^U%gZxM_d~@eP-B(GCI@bUNb-MZ+-5G~=Z88!7lp}Co=4}nga>>hae$_lO<4#oB{O&eqe`bg`BbxhS;` zawp$Azc>Ti@Xpd^`IWqb^`y100PEwzX<<%I_ks`A$3=jL>j>c)OZVpVGzdAfTTM+h zKAxF`4yQ2&kAs7Rj8sWsX?!((nma(~f!?;pwiaJWiDod7Wp8ZJ03ZaYJ`$mnQ&Fii zSTF5>B#LzBo&fOR?_Uss#Ll_RL1I!AAg?La9ocG_W2leTPdyd3N`x7ph`?p0K0jrF z8!rLHuux>e$e~F~M&{SE&V6=qFj6jGIAswP6)keyHQb_D$YQ_X#dtbNg+hSE=A<&7 zGt?VXQ&!`!yFfyD%G~!ec^2;2!*F?y&&fmHGe7M!^_SJajrbsQ(^1#84FUljY>M*0 znXCtMqj}E)S5Mz?oy@DqnSH<<_t8Y7rdg`B2U6S^Ly75yh1~iwymv7y(ypnB(g4cK z=gja)#w}=LfOQw%^#e@lE~}aD7i`=4b<4ZU5U=+QKrmM-fqt%ktmDCVWrrBKG!wv3 z(IxN(GC2Z7H93-aM}==Th7LGe zV$@oPihbV;Gtv+OLB;M54eXBn!~GA&Us0SJ<`P*;aOl%QjU`M>On!_ElxO~S=?-2_Rxl8TCsk7amM3;a0I(a;Z;8|Sl)tjx^RqY?3X zu~s(zW(kMlPn^Wf+zxyR4?3?hsoXlPzwht)tA!EL>T)M^)biGFD47oYqsbLn4n*Vs z4WwFc8;kFDds&K0dv@AHwI8$gu+3*}ZEYqj9LwV-Hq+$;1;y9?yINUUNeKWIrsM19 zJiY}!Fu1cbZQplyJRoXXmr^3FdfdOs`Qqe{%Bqx(HJ zBV7y6WaNtN=VpoOOW@SWN6M-&S9)ngc~vr2Cwz5#_ILf^)s~6w8eEQdQwZ4DyL4KatkmXq}UX+oomm|XNz>|L$w|f*3)_hJ4tr7 z3ljdB>xyJIofezf#4%yUr`z*gzQhu*C&j&z@=<|Ot%c#?@(VoMq z{~Rr^pIy_J1AzSkpY-)q+CQjZSCqh=Xx(2v_u%>r38ggs`LS1?UOm%OF0I>uEO6%w3ku{? z`v;45{>bXt*xGU(E!wxbvX4AriN}*9%w-yt5_Sp$L?!^CLhr*^*T~365`)beJdUY& zR9~*nCKJX{%sVB-i-5{rCPl^Sjan;FJ1_X$EaGIgOS+dY>of8*)nZ;puB@oP6~K?x zXt!s5c3VBih>4SEcQh-nTq|p$Dk`B66$@E}l@bgFNem6aot_;nv`}E9qTQ%fIW;0C zd%k_UBpsZSA}<{;;gevNaRPF+bP_NgP%2*6)$9FWfIcwTl;7H_omg{VYGi)c(FIRx z+glbsK_4(gd+TzSs;^H44b4#Lo1^4zX({qkrtOU5R+Y_hZ*;C5U}=rq*)ef$a9(u2 zWT2xcFhl5;Op1t(AO1nkRBbF&frgBHyYlFUAF9mBOk+`u&#j37kFd?; z46K;)1OO4W9T4Cw;ntw0Q4f>s9Tf2ZJRHgIO+O#e3a6JE*GD_%rrO%l%F5b~cE)1~ z`G7Di?_iQ-4kFgq0_U|3GxZN-kdn({bt+17QZkZONr|#rt7fY!T80+KW%q;xHHcK| zr{S%cnr6Mm%MMXb$=-e$IR(pwEKw~>S{OiPRwYBv2r^YXPfn?nEj{V;$?3gk-a7LIK=}uTPw>fSM~sWJ~*K4RwQab2}Lw z2zj9n{YOZ^DHOcUecZtM^SI1N+O4vJp-@_GT84mIN7vjAVCrtPv%l~S#uZd6n=a8P z3V+jBC!*>jI0wdx$6_XpS7(AK{KR(#O<`(lX(<^Qet+|pOgfcMZ4L-OUl!v<3{n#5+q#>%QJ z=)>$Vwz1Ooxzxq6o=fWv5w9mC)oEjdPmWk$3b5jc^Hw)OJu`JD&lNz76(YnLLii%E zk?wKG1gQKSBtC*rF)>rb5PjED9yd|Lg;EWGfpR`mxKvh;441u5TA?PyVm@4gl!PRl zO?>(BEszWdi~HbjK&@WAbsH@nUJ6y7o-;%(6oN&T)T)TngP5GeWw{&_98ytHv$MaD z?GThNMXay^*>kxXmc);x)6o-U2Qu(pe>t@T1*$ChzYyc~i|x&D(rGu9Sxu^aS~1>P z2}_9)dxNF#G!a)0b>jn|)iyWu)#s~mfpVzP&O1?$bw<1Rrl<;A@|6SPuHuR=qxPM=!MbtD7=NA|5nVC_k6Zx*8A@cKw zsI{n_!bYO^yGX}%UKPDY03T^EU8+fl49h?k|8y|VdI}HXyql6vy#*K-Bf@K~7Rf0L zBg@+F)?nd-{6i>dDBO3?vZ|{7_Ra{LI#gR8e8j(HxZi}U&?MH1yuPF%Ngg~uCkw?7 z;|e>CEh{g^oBJyu7=ePSztgv#RMcSAh5hMRgP(uAS40JoNqs&holZN9(Dux*;r8}W znGP6UfRz=R>r7l)vbwxF_n(y!Ng3D!71B@oc-t?KQyjUvB@@Q#tRr{jnX9WrY}M?V zze$|$X}M`sSKH5+J6z26!W&7a${3boCo-`xTg{E;GlG)Y9N6esfoXGcBe&_jHtwx# z>fHiwd9V@}ACps5bWh1O*i!9fHz2Q;pvKd(lu=t={&grpUD1Lxc)8M%fHu_ezPB|C ziw-xxID4^9G&0(3T2Wd+UOka%qVF4@&TnJlM9r*>0wtH=IW>-a3JT_i5@Qq7fxc0_ z%r8DxeG}K$Y?3q2qWZLWy$6vH1sL_`T`n5)&4x-5$t ze0}K^2tQ#Em>DSxJ9+9e(~{;GY#J~F(#)q4-2-7C8MMTO6A8g8<+qSsMhqn??&p5G ze&Pef3)6CHt(JiS6+f;!T1VxgmHrN!_4@wyg6hg!(m{My_sZ_^TrEa*t_{h?^oyZeO0{_4oikx zDX82prx#R2dXZ_bJj60!Ed?*?_@ykRGKJn})cX4R5u%3%rv za(@dAr-%C(4OYQo(XIOZ8IzCb_uGo>jz(`WisO0$d0Cy6m2_aA1VBl}YPBW{bucg^ zP4F;>W7UoM@$6W$*^PlQHN$5{()rS8xVZXy(-G##v$PekXE~CBkr7KRlUDkl;c3IT zm@JkwG`^s)u&|MbWmy?mNGkI9b`K6}d^h~A?Q6F)mHC;Mmxo7*ZEGm;`Y)^1EfW4% zQG9k27e8Ro0GleQq(ooV{XG|LtkFoXNEKV(Q(pP{KRcwvv-O;2DUHwj`Sk~O_MBrH z_F9k2zbE+3&fxgkvaBj%Qp&M`Gp&Pc-OS8=b#}ns5tkP)%*rArqB-b@9|x)`I`V-G z`MA9Ny#42|VI{=JK!Ony4{h`4Y6rnR+^B`;0UGIGrcd-bZsyOi49M4Y{_?=3{&EOB zb%o^&oI z!_!Wta6`j6E~k40ig^5|>F7X=-fI^}OUHxNFCWeoct|hr<0IK;Q{ADUXJKO)3e9Q{ z-$EmZin-!^!u(;Wg|_Yl>@R=sM$^(eCz+W5;-@z$yjH3pkEuB^@qjLieIU^q0mi3o z)^x7lf^71fxtLDN?bCesdV8PD;fMeSSIl$TQO~H^;OMxsC@d&RLPu6xSEqux1n_#E zc|6)pu<;4-U&pD~OCoeOSWW{L^{ZE@zBwgUKuFV-|Jt=B-$!t`hZgk9>e~|^f1Cs< z47!XqetxjXW_cYXfN%9Dh+Fe@QPf-i09TKcmO(+dxDUF;z(2S>vTkc)kG zW)AA+PG0-%jRlb571xlU&cJ!T8^XJ1WXi9>m9y($9M;2)iF!}<@Wf=>&WHX)){_Yg z$jZ!AcC4AJc~H;6-V11j3H}+AvW)!?80D80QbV5Wr{_jqEvN0D{2L2+Zu@_xnDY5| zfVA*`x0ChktndgZmuKzOk3>uM26iiCu9&UFVjKscf=H}DJ6cT{A}_uF?aK@3ApPrR zLXZI_V*2PN`E`Mav1o`1QLaws^wE%Li`>cOCqQ-ZTK|lXjvVjnvm#{p;i;wf_ zKi5lQ(HLQUQ)U5h_`vaRBPoKwl}4trFDLE!{A^$T@js`KHKESRX*fZM7xN|f1)5}x zc^s$m>X&qGp_KMl&&`pb^jtnV8c6QO@qK3h)dKl2#fH2#c#W{%ZI1l>fnE7l@V&jv z42x#=a&B!PN+$GJ6WL_h$X1l^^sxKbnGAyLlomV+y(1{V zMC`VX7$5wMuH=<|j5uiN!7aBqtMfg}6})0{dSUXsRd$%P04};&|3}Glo-w8n$ufF9BMOTN#&NF0mk8cc%PQ_e?r%9 z4$nnPFBOoFT`p1|mNU4FvpXajo)!wjZE-oY>Vt#VW)v*Xc2qY6GjIro{NL@7<{{e3 z-9O+qLJE@Vm=05JOj#s({sfs7j7XJ?gvDkC&qoMn;6$A9<`k~MfKei%?kdNs^%SXt zv-@AvTz@gWd|jkK*-##`@{238^c3o7Y(0g9c=v=jsq&1{^#q=YN(TO-r&npX=Y~XHCYq!v%k9iY376v6d|ZxXv-F%2(qkYLEoE^m5YxNAac+F#|lmT<-TU@Z05 z#Pl1YrO`_uT-H$Swq??9afc})iq!jkci-`9HliD-LsvJhSoSR zC}=zgnv6$P9#iX0TT^IZ{b|HRAPzM;huV2LZE4Mo4QtJzTLKlZmUtlal1`#Bb7L|= zPWhYIlcQ4o@Gy^-ILY_V)Ajo3=Oz5B75T87$K0^1m27aok$t91$UiYaL;}SHNgO))f zFAaBq_iGbf${9Z-vM=zTbS=`e#zy0vCdq%SWK%!C zQ$Pc;tC_HS^eA55I)bU{QB^Matw>UNtMeQ~{U5xOJ{0q+*6C&i%)dih)zgJM${+6* zf9CBNCSl?uLw(%M6ohBT_P3UJWYoUBf0>@HTK{L28HT;;C^;iXSbe^}NWSOYuI)od1i6*z-&NuZmoLIPSM4H$E;)d~WL-?(-)7&PnhDP%52~d}$u>CBenTqBhL% zsuAY-)Zb^H?c1+dcfd838ToZmPttV$5AODx=JQAKaV0j#W+^E>?e#iw(nf5~zq{kh zj?Q|+P)Z)-`QCpY+j3X(AJgDPH(tQWfXi>Iq`oA<||Cjsjx#j;DV=a6DVCWM<59{-(YoU>CyLM@fun)k^uisnu_it`K zb36bSTX{Am;okU*{}uqY)Hc?;(dWzPkT z0O|a^!d1(cDD&q+W4m@FHGIXeSmEZobhx$Ne`D9H>8*M6+FDXtlKg=gCng&Nq0;}^ z_&4B_n{d7I(|YA(sc6Xu#iX-8E{47N4|sd)_(pLR9!d}jjoJRaSD%bbSY+oUkPZdp zkVdTQxujIFfZ{KOFl{9@Qe6L6J;JMB1700le9?Z@feC#hMou;K85!xHFCeBV)cA7) zAp-FEtt67%V>>xgK)0YgxAg7ua}^=?^LZSTIK}c}N&_$Yi#juZPaP2N{O72E|3`ZY`0KylZ+Kp3UXK4iH%<03%i18o zWM#6m1G1{|umPv1*Tp3Bl$4bH;^N`~fwq;E1p@ipfG*U;6gBx3-&SX=j*U!FeA=J7cc$@K zgw-C)og6!gOv(uOM`7$KIG~{+!S_8j*K*ldgf4=G1y885mJ;da7fRDz(*)pw6Mod1 znw&XtNwEV@E|V%F-l|^L_w1gvc?f2Xp2NeBuH0;G8XD~4U`6854h?#$>HJY6d}~w5 zh=Zk9``t^aRPC0#^I0S0)vKrIoDjs^qM%NS+!b|UsSHYT%4l>94?8JI3p|?!wCeAq zVT=6=3V$tqd?jxG$Dc(o1P*l3yl;hD2!ItdATile&`nqBg|AQt!1>wnsEueX=sRXR zSMUIu4VVE>0ZEGMQR_j6j=%Sfp#<~a;O3z*ylX_m=6Sg&)a=>7x-Q+=+&l^EJ$g4g zs_!VyNM`B--wxbZ`hU1FaM}N*`gEIeW`}Nme!kqROkwE}lk+}#QZ^0_a%CRGvd^t6Kvg*q zc1{2G#y7oi{;1OyiF$b}QrHa+&`-~iOx)j{ON7tO`QWLc*r5zN!m7dcCw9miV4Rm%Y+0icG{024u@)t(wM zvWB3AwQLe+IGS;@ag-zJK~70oqEh~MuAwW@yLO|qMX#r(cUo4x=3Z4!?u)yLLFOfY zPsmT3vI%(#qg*mUA1H3eRy(>BNjC%d@!ytv(Ee}?rd66%_Wl+l1c6t+t`|w}nqvf; zE91{mRG>I%63`8}yWz$_Y;0V%u~ip;zp%h^T&D<5-(RSYRDg-D1eEDC;MeJyna&4k zaB-dKmS;;IrVu!r zFc|;cv?1Z~ib;oXja$faN{w_fx@0ie%zlyw4@Y$A()Swudh_a^6{H2-W;g~630#Uu zd*7J%CkR=P)f7ym1#;H!txW5e&()eB@zn|4+{2JgJ*Kv4tX<)%7drbbZwPN{ln0E}GTrn(CWK-}F$R6)!h8vedL# zg$T`cM;)9mD{~5H!j9P<=wwP8csr-^+HrZWa=D+TIXF0PTDvP>?Kk6ep_5w7xbIJt z)3R(O44$5oABhVif&?NXYq1Y7jx_W)+$h=yC;OyQRii$+?u@*?N|P`=qflRL*pr_K zN;Wc-QIK7E>`HXS#1jg(x3DlW$)c!xzj_nTFWj^is9FtKz&kwbFSr-@>kYKqu*r;(wDmg9S+y=TfR*& ze>_Vx#)l0d=agmJ`^CxEDB_bxa-Q{6`9C%v9c}kraK2JxS{OM;!VBQ5*WSui#i1A) z&s?T()zrS7ZI!4XisZhsoaO&+1J4iXllQB&vMd3AVcdMLHCuO}@X3JDZ4Xwxl{ba} z2_vhU-cGaGofH?C+PdDJ z&jJ$%6ASBb?!suDwEGM~Lx?QxFJ2jhmteMaYd&ZDd3(_S1>EHGWLBkJV-mi#xM`^z zNd?zyetjEE+czI`gs7|RhDp{~!=gl}*wMo|JTXbj$0jOc2S6?z>E+UG*6;CsO&n|u zm7@#lLh1QS57I>WHE|Pg3d7<>J|3h7`=Q{*l&0zkUrtA?YsSbZ_}=Xr_;vjC9-}Ob zH#^j{Do8H$LS|$wI4$d}!Qpf-stm>_V%#1J=Z=QX>n|`szoqV+;S2NIC78jkK0N8( zobRyP%S*+U8mJj&x?C!|cTyxN;!3CvSg3I}l1ZsEm5;AWxys(?e+xxMaok?s3?aI3 zmQG!0^vZtEIR=>tA=2uLRwv8(L*A^lR}+%KMX)t%Z(B2w)hm0oHrhPhna>eobJa3U z75}LH>^lLw%hpf16p(ioXBBYS#c;0~k84*>pU}x+Bc!fpj}xrM0`f`RA}~YrDPx|K zTCV!*1Iu1x5$~u`pJHIfiSBh%UZoh6{JxyO35+YsYRQ^$Iuea&X3{@49@# zxR&`2L2XP(v&ta^)RE1P!|JoO%MOpp>CnYsx=tGE-A_E2gqIO|pwY~zJPo=XEVmWv zqT~Je$={@0!Z%o4;34ZF_KP zd8A=a5wSz>wzR-(#>`qW4-oV17vRWEqXS}pQczcqZgit@083f;=UDnSzJ*2zvu!t% znOWh=3Wi*6fzHm@aFA$Mtg=v1La5sMRPbp_gN5`@6oU!(Yj43qRnEnb4{9Bs_{U3< zTkgV{)icQlUfV(jZS<_sEnMQR%H`~>`?zWxlhyN9&{2e-P#W?SI!$?uZ^;L;BGoZ& zdMcTz@yyR{*opfyrgb{(jA9@u2$nkW5=1DbH#1!@o~B&Ogb(fUl8s&rm<}bGq%_(c z3w5hp z#O@vq=l}2lGK-MPvB0KZI?v137nPD7TrBj}um60mA%rA7P)riu&Ce1s{V^7CangKw z+5QlgF&19R^8A1iaxs5}&*We#w9&w?6Wy1GXEP-~VTj)(Pk+0S z?>{C1YaSOjVdjFUbZFNP69?v2fz)rtEpPjv@Jw)32-TJX{pdrN$D z7yUH?OO;XN?HTYfS>9Nif~!3>mKY1)ej^V~-MN*6w$de|r~Tc>^ckpFV(;qaBcl`NzwQDg<#l`h*z*2dQ2$9esRyP|uOvaFWx)pH%U!5kDC-#+ zq2iztfl_AboYd75L!sH?5;Ui9cfU9%-rZj^%0V&h-*RA)@M_p@8ydh-ZQfePbWWXc zQr#>MhbrhPb(A;fdb3^}^Vo`YTDob+ zZsE%!Y&syp!ou!NKP_bV7+8z;o#^EPm_fkLm@&VsGLhc`r=H!~Ph1`})}d)o$Weya z@E%#Rd;HC5_OfAQV2B`kz;AHj3N;chYNM`1#0#2nZ$tulZ@|!&uz^OW46Qd8ReSxi z1F_JY?*F)it?1&0>Om|lJSqw`{tzA#-CzIqCH0C#M#GN&9>B^&PLgu_Y4e2D(XxRu z@3%V^Hm8RTxksJro@9G986U`5JvSlVgx>o#qFi-|vLa0=Kjffh*zWMh7CxF5^Nwb5 zgd{cRZ#ib#b94E-V67IqnV6Q~Oq+QMU_)T_sA#)gR?HHvXrCrW0T@GDV&plt|p2Z9gMjI#RjrVCoJ*>4hB!Qx`#`ACfvCpTPBTf%hJAV;JS5yU{I zCk=_n5WIYNaT81|vpf~VMUaW{g(|-&wFG^e4w;~lLbQyvkUr_WVk{GjmjZE&sjQH` z+{2M^BE|tmw<@FF!!TlddN_;@ANZj|gfTG^c`K61VRx51hmUVGJbabU9lTB=n1+dM zD3p*O6o{0ps$pR+Tk_t^lx^vXGcq!B+8Fs~J;0^0P*GuHf|7B1A6gpkF4Q?OHrzd1 zpWHb^LfhGiR5EL$`91D;w%Ok`eSwyF$E2pL>!ytUSANHxC|Fk|uCwvsSmrvv`1gh5 z;<2_cBxzDwZT;kB^uKGU{HfJ;dLZ&nTFBZcAVNvRW$m98?NjtGV-&rpoOHz)DNw3r ztM3c1kIGJYUpPe!lX`nClA6}!fQXk++3_8-MhX!dYbi8y=2NGLO*I8Ls8B2^GBLb| zcI|I&EyAmiKc=$caTQn7mU zXdCfaEmUC`B-b!9LRx5^t(#olvm5CT^2wd!HwHrH3^V_303!CholmJBemt zLHGBgm;&2XN8YsoM$5+HB^;&7#X>>~US>lJR-+4rv$8XnMTZ^|vP#uOC9C9bqCTDZ zDYZzIvu&ktp`qg2J7dkaaUMu`o9>t^^sKCnE@1h9zm!MqC)A(ic_ZG%$1 z$W=MU8FEfj4V{>c&EXF{lUYmi<#av%(mD$cv2d0xZVFS_4S?H-@&c=)AMrDTQqRK=(B z{8P&F3mk|P^<1Fd3OBe5pMH5;AVi~BjnGSs*V!#WBFVt0D$vmA^E_0pD84!_(@MAd zKaYAPR2iP8Yw#l~s_>++){G`^&Cm?; z0TY`PVw%#wv4Ad7QS%&YD)k`_Fd3stH@dUpW)XEBOVVJFhE%gybQNcxc76do8QtUT z(7KCbk#^I{Ms z-GG#O95Du4p;PD$7NGjK?6GpZJxU}Lf?eZy)b4WCv`esf{mPHVDGD}F&=YI3p7>+e z*bhatj{_>wUKG@X?a04Q9zT5J88LM3pvrjH7(GVM;BlpDw4>HCe}%%^k<^suHywJk zRAV^1Pz+`_WQp-~<9lQDMA0kDipDLzUcfyt!c;Ml3G7a$+BT%+?&v+dh{Gdg*4D-l z^8v9-mlR^m8?1sMBfy0+0%m6}(N|awdHIm^f`a_af@1Y_^Y*fof^oA(rQFo2dGNR; zqw29Kuk?UPwp3|r91W>*SwjBacA@EZnBX?Nr1x`hvc;AQe|c)^wubE9>mI@(1qdDo*&_BpIZk82FE`{85qz4op}OIRY*-(*Ech=(hQ zDcS}mBPSErU1ebb(7E8pz#PYMqbY6(bYaLol{|5Ka80iv3X2f?;I`ob3j*EdX4crSPAUXajT|Lt5=`NL*-NDNP-U~ z5C?iy*7aD|M~s<&-a17<`=*Ur?Ec8-bD)AL#$pdmWeQ8OGExvyF%J@DqAiW9$|qVs zWx{KyWkm_HTFUhBE0}BRgKJ#FFJ0wwdn7i(;jZ8&cInK8ubRxpCf3$&Uk?JIH5q~5 z<~hsP;I%l-o<9yBEW3?Cq_)$*A#mb`aBBM}xa$tIo(LGOTJPD7mE1IDPEt}}f)Lkp zk<7D&`#~cUQYyp3tWcQ;WNkd3fzbedN32tsI3|7H5;KoJ@uZ!FA5(1y>_51AX zoEo#`?wP-FQkm==91@8v@k55=JLkj6oY65cISM=^3ZkkM?ChKCCSO%!h_*_xWZ5-R za4>c&ZEqBht_yfJ`tTcB8FB_OtMre8fWo1aS@+(|({%s+V@6Al4JiU%DF|}N*E~(VJZVsW{5k*$>0lz6)9r*$nKZKh_^b|RcTM3cNxid>B=W}m=#o1! zCq(o7?oU6okh3|r4XK3E8qOPlqx;@={)n^Y>Ex=UnKR8=#2+I@ zqZqsEomzj4CL7GAQC-jVqEQx`XT6@-t$Z!D8( zUx*s(D?gjOA?j*3@;M3z#~mf1S(9*^k8$eYhi}rOKMf<@9>hb}C4Q zkU1$z#?wguZL_Xl&!+FY)}j+8<9zFg@B9q64g@@lRi{`D`ba)?Ru7Pf+O*LWh@*Sx z>_lJSWkaD%eK^uW^Lns%?RZ+i`r^}UUjhece~zE=-RAyk?7rzR^8Qb$fUDufgy&$% zJWD*K^l9TBR{pBYBo_ama2&ri(~w3FVq8;`P00fJ6*t+#yJoJ_FWg7noYFH6hTFpU zsOofrCn@fmv_LQ(Iq(>z+5z<>Zb`Eei|e{pW7N)1pj;tPl1#$NhHU3AgowU{)U zjqwIL-m->4LS03*f7HU}=ND4Y$Hl9vPAIpJ*lV?zAnxtj)Fv|PL19~9SR`0&UGnu%(7FR8jW{YBDe^=C2;YiW^#qPftrZz8ZqA6%?QW+ zgwiuriNj>t@RspZrtG-mwbGeZ$yOJ@idIjJ6Dzu&%p3uB>LE&cRRQ-p#5uFCaAZe9 zlKX9n6b{N_FDy^WiCtsVz$x2)Z7n+UZj(miW?fN)xum6_lIa(1EuS@aKiTJj$jd(s z@j}=R&px&n6z&PbfI40d`{m>A2g3-^4Kz`RU2;~sg&OrYlKZA~&ZI{|V14_?JGmVW z9YcEvKj>pN%6x zDIPfn7Es|;*pS=wfkFnfPiRq-6Z3=AL&4%FYRbaPC=E#s>Df8{2&rJOI6PQ7IKzqg zh)@7sVZtQ+kUsF}LEOX|Ikm9A^rK60f@f#dU2N=JGGZTrsOT}|47r6ry#t9+?* zFX{ab;pxQP`}HryyR3I>`kP%me;Uf^*hvx#$fUZx@`P0<5`CSe$$(A+j%x?PHd!QB zo?zPCyprOcY4bjrDG8UR-`$YOIN^aJ`@|FVC}so!y#QPJx6%($s08=zu1x{dPj20A zH9sdUn4A^{qZsgW!-NWt1aUV<@%>_*Wu8=3O`OFj1p8zQU~f6Fm5AoCuz8m2iP>x2 zuS(Yp>V&mzbN{*fs}?p6D7nnOuRA~q5y;oHG9_uP$dj!UDQ9ex#s!R5xwY+G(mfTt zq&>sui6>I4JA(2y8ZJBp}lv=l-vlb{xsXQj>|mkTil!_?FD(m~fi+B-Nbe zhD;nxJz-!;-K3l0!QyPqGrpobHAxL;=L5Yz8H_d_Gy@xPC?`a6h(GItx1rU2mzKxQ zwsuKQ*gs`Yjn(-RlGOdp3>_MzdZ_h=UtC+X-Lm19BqcdAKGEwPY5m{YJIlAIzNqi} zQ;|?Xr5i-L1*8O|OS)S+hVB{=P*iH9b7&YCN@5sl20=O+@eb>IYq0__T-1(K+pRF>1psh-)X2h)p> z;)4o_NoWPF?EIKFPe4#-{ud4-mD*dE2uYHnoUi!r0@H4448; zP~aAW8C^agXb=r0Y!FTVkGQ4L`iKn&q3T-(p(u{eh_XWKwt}>yw>SwRr&}VFVc8l- z?DCmIV72@FcY&Yi;sSLY8zA=is4?&*98?dvJKT7^mu|Vd>}xYagF6l??kVVFAD67K zb9Hnr$~d@nOACGd!>MJIC|YohNx)oDJ1H&&T$BrlZYhncV3#kl!N!RR0eL+{zwbtT z&@G}V)m9I+eMc2sP zW+HK}FO3_2QC(B(yqo-Cp2Kn6idl_S-e?so)uM#YhD-;GYAxa0dRvF--Ks|hMLb_v zNYd@C9-sBnPmXvbB#`n@~2e{qB(| zmr#ZXJ12$=DoRBW|4Z)8NTxG%s`>sJ_vv(fQh~M=k1HN%(C&r6_(tqlwTtl*b#F1( zcxD>EmF}tX6*J5GnGWp*rArqDRZ=17iO(A?b}V$m5Umm&y|((hcDtE@m)Am@YkY4^ zHEODav_^&yTMvHyw;oJC6qt+Jd{lfFT&f(YTKl|AW5jh@K_0?SDMG9%9Zm4iKV3SX zdetSs!>FSm70h~4IO=Hg;H62|4r_jqiU23EWl6k^@^a20MKZdt=1St~__FC&qw!Xv zk|HY;^rX{v!CxMM!bFi2{W`F?4Y@^T8Z5{tf};lfTfc?pBh#0gg?AS#ZVY%=$v8>? zlmz*s`hd%;YJI`78YlV732qm4Vpi@4ogvo@t##9DZ&aqK!U1xRG6#=I za3t8cbuO~rUnNLmB8&SJ?6y_bL@kN@1LHE(xb@g{Y@vL@WPYqzgBT?zg2%`DpbaHo z!`;9c#rnHtc#i8>?Kp*sucX^phrFn4q1tMX=ROwA@LihSF`hA`6W0Kjy@bF`NqTKP z`Sod_2~bQL0s$=Gw&)A zL&wl(iD{lHRi0K|iF?$;II9MO89C=-t(bgf$&k#{!i3KXpgA+#I-4y@?JUn4HN7pC zEP_U2hDQ>IB{d^ST+lkcEuUa7CY@_L?*0tpJ}q|2yzm=#80J^u3$wWk76fz>ze*6v zXTZpb7|`rT{hZLOelE$u^4?z0;b({PC(EwY!a~-`%SLXjhkcBblarm5pI4EY3RZ4| ztI8@0ONc5@HypN&`{My)18Te&%tpdLf) z+!%(ZVzMXbR!-HERvN=M>2S_xTr#!Wl+{1g>IHQ1HpKc{u7(&m)p8Wr_00q6IJ3PgDHWxfO4kz2 zYZPU_;AcoH&?qx>cFw(H7+QhQAlkl$)yJHM-wqllKmEMTH(J z`8n`*btrAvqooiIWH8^gXOoPst)y}R;7oDA0$--jj4+KYw7FGK5%_1uWE%vQ8*Z~-Ozy%v=wzBM}o697s z=2Sa-JkyF5WDaw-H1d2C@}(?a+tT&znl`0mBTj^&lkEk6ye$@9dOyHq|I5k(F*1hI z*S0GKIQFmDeRx@k71?d6D=cg{Z}kQ$Rya8PiPo1~uoH1Pok@7{8!^EEA^DVIyTlaZ zp&d_|;i3SyN=ZGvg_fO!hcAW{B9*^|n@uT46y>Ru?LO#OOOm?slGCyaK9#5PF{-c? zf4PAg7X9+ncGolnhezx$tc}gtNE&bzB@P2@vyMEWFUq*2(rssvU1RMh4TcBA?Uv8R zG*Q~jywlBh<3ij^6ucuCz9g+9^ZJfC`mklylb`>SdYxl|&arzroSUZI6^pCaAneGK zsO5oUk$Hx*cUf_LZ%ru*_%@aopLHkF>N9OVNR55t`_c4%qP8%+rt#stIYa3)9a2HK zQYFcby3(FB2gKEPypQ8|esTB@7E5im>^_>xC&Vl-9-dn>cszJ6akIHTImkej|K7^9 zR_8Q?G*m?3`nALy(arB*|7^F=qc}V54xmnm_mBT_T1>n*;jIm0D6w<31J#4fxTq0o zLOLlQq}_7e!?>e;9yd5*{zUHIYxsTO<|rV3;@v9Z+TPI{iU0eS<%BKg`ZxWD>`Vg9 z`*G<{URf`XZN7j1K289_BSPD*CiLlUxZr5cH1EkNP!Als6kHZ~arg2cMA%?$9S$SH zYj6P~%z*!8@P}F74dRUzW{E+BMqQ=$WfE@d*i3$`r4RKvvo1PrL9Y#7zdj#rzm&1} znK)<&zNzgemq3`&{`YU88f5R&6c96<;Qtq9W;U1cURC11Hsa^xxH02_LstiT-Nf^C zOoAbUh3TqdQWcwG$4ds4yqG3leBic{OE{$X^>H-4ZzyK!{G*2C?4{$1fpjE2x7qLW z{7?3g=FT2jt>!IEzmgKfR;*Tx0v5x#+D3J6j~mhTN|Ob0_oBu_ecb1piE$b9NS{<&C5z^eC%`YC9bWgA3pEExF^Svy<$fz3SkV<^7fR}0z9``V9KsjO>c1zIfJc&sG%K3qP9HQydW zFe%yJKK9~!h4O9XmxFU?&_Li}CvVc0)P=`@P2OI4Sx`Q|sl*j7;PQlCDYdSac*Q>C zplve^w~4ijJFOUa*!HgN8=oYLcW{rhYR7^RU3C0D=;ed##wXb)4yz|OsRB&&Sz<0N z=hrzMJFD~fT?eZSk0YFIvT@$tmvgoXz4b^i1 zrJK@`OsCU4!wqZ^3?Kn@VzFt7Y+muo*4>t0Or|%`@qngAo!^4Lq~e+PegP~v-DNr! zG;%0NXzcigwxm|>x2-u{lwXgm6%&U_(!antW^@1Zrr#xGzk9H@JXLfvP&7zgb`oc5 z*sX*b1d?c+58raWb}5rQ%jwnt8fH;EeIm%iuqo-0fT9lGw9biDnxVV-RW@h9lU0R5 zBaekDCj=zSoIoQ>GsiD$a=$D^#`VnwEx1tFXL$<=Zu*K1y$$pZm=Ne+mb0H(6|G(| z-jQ_Kel-{>VmdQ9H8C~L4bQqbsyR@)IEEhe30Skn`1qMVt*m<$d=xO#@U5ELp7$(J z>N5YfCxvBW&7(a%@@&y#Z^JgP`MMv#D?W?lX75YR#eL2a``h;{mYD-VZf0S=zrT;w z|Fj=6-|L>55@I*y^?f+^Z_A=dG_)GMkWMtq9pB$*i8IQ1Eu7QsJ?cGQxojT@leTsf zsezjy#*8PYPAtD}2&^S^d*v0tA))qt+@pWF{X6c|cp^v`e_NP!VRgph7tBE{rFeaF zGp|GY7?MAMPk)B>1jpO#(dPc{)@yMVw%q2jo$#G#o;4LW5Z8(6(|@0tnap<&@{?2i zFzM;{xtDkE-HVVLG}NNubPDfsy1!6KSfqM-Q!)n~nVFfH1eU^Qh`%#g{;31qX((g6 zA3*MZFB(Y)5^mglOcK--k=!r+pG>a1P}k;hF+D=Y!p~wj8A-?dUGeX;?)Z`a*KM|< z%7Yn0@+{P9T}Dd2cmCIa)k={4Pjmdv72SWhfA2mFy8oAMMH1(?C8T7wR{Qt65x||f zhKAMQAELrre`eG!l+43f)LDbk9gdv!`i8>HRLF=K;Z4byWx(wG95Iu@Udgw0-gA?N zZghsFv}Hi&*;@R~vDC8L-M`OxAEW^=&$ei>%kI}tKwtGY4wE}qH?B-N&$hfaro#C1 zKWDTy>!qHMRovE?cD@X0cHN?xn@p5Kef_G}RMj4Gq;#E!m^psN)G_18tW=!jV}jPF zM~7^?oCmtLKf#Z->6LW90xx$mE(DwC4Z%ccxNA6O@%aT|h3$SLH}sddZmz?_-!}LC zUzRmxXb6eU^?`xuGcOb>e>s&&U8w&~a9jwSxZc~(c5Bg5k@AOlZwap7Qp7y}+pw_D zZ$TGNJXzzocZoTft+`5Lr}B$HwAcWv`NcWA8$%*0u8Ya?Y7?~wWK`GAfNDjU8}sjoQq^)fYj;100-1{;`Br9=bZ6QZrc z;YC}~{8@~NPs`~M6#l_YRupZn_4{(;zGGB?>vlrcV1oU{wC4uxz{U70K-)w8r7G2z z%q)~tMEWZ0g%lB|-p6nPo&EN?d#+sse?a0p=oAX7)I#x=YqPf6iK? z3K9cD`s(S&S-E2xE)I^ix2^%V{J_)xkF7HX^<^SKrx;qbe7E8~@s}N082_Ze^16oE z`B{CxT<>VuTv`&@#3oLe5rT1>%aPi5w?Z7ySEy) zJ@{}CbE8q@s62HWuy`-i%|r2GhdM>!a>6&bVCLrd1p>uPkPZQ;-#(g?K`)n<)86YlSzUG3#LdfgJjOU{5 z3>{&~;jf)KxNcfcAA1?N1dPJt*3ZRlGiyBINb8w|qf<$8_TaVekRZQxNIHT%*W{Zk zz`VtrymcRRyMd^tzhddl9XEPO07p7DH&JYyXHvVG+j;u@=uau1eP-cyHfO}*(SSl_ zq$2BpXz{bM9YCLOF_Gy3U-!b#<7`+f53OBcBsI9q&r#pl@>Y58(>#|M9TPr<(A|HF zmsFBtN#?XydH5o_cpWxU!xZbP=QEMx-UHng(PxrV+;RhKgmDA~_v6Wddr9&I$Fsf7 z%ybt$eo>P;Mh2v5Ke<;?*dvmt?+fiUIU{__UP~@F+Z&0i@gp9}!Y_7V{NGa)MWXXF z+InI&D1*^Uir}xwkVN=Q8QzPIL{i>vYuf^mS&F_WPZxr^Q627bX+TCCQz< zSFbO6?cu^ywXetu6{DO?VqscB+%ZCgS&C9S)rO_8>1j5ieL%yyr)unv0s+O#{V2)T zuVkJHTH1M~ZSHlGSd+Bm#8K>Tt`~MGt0lu8$3a#643F}Av@}`|a^jl|p|e*zipx2D zwLXuU&U;8Rk8*_JDHXs#k1ou0`|Q{+X(3@b50%*(`3z8BRCN86jkS~S{)iF^=T=H0g~jqr3A6mKA%@3#n`8wi%zwJpDBPAd@8QOwt~eAi*UA z@uAF5bhN0XghU~YYBC;;o2liP4dGp=&#BuDrK2D&I_m?lRt~? zRZ!#1HpN`cIGL(kk(@2WQ2mduQyp<40p+8%=k7D3{Tl*;K_@`V&a9I~zVX-H> zWtCke!o>nSGZSLoBwxbA%^~KVKNT>2qwg3$Zf%}G!Cb0-dFkV1Gjer!bNr!$MLv4) zz~EKTgV6M)%u7%D@h2;Tz!wq1sPoNtuEbQo5noZNKQ zx|{&fl8mU=+kH8nrvPSgmsr;+0sny__KC+Y?%ct*RF;$0{oL5gl2=@Z9jmqJELjcl zH-YU?50WSb%ugFc`R=iE_}iL*#X4z3<*t|mLveNO=SrK_ec`p$nD5y&OfItKpb<@T zT~qUolb#xppfnUp$ubbNcgW&8IfjC?E#rx=u$@Dn7$E)pp2fY79H;<~fb z_7sBEM|_o>?T+17PJh#&2Dpt|)6;w{V>75=XD%tu@T8YktinhMPr!M-m4m5oh-K4| zc?0sK$K`;HvL;#KNygclgoQIY+ja7iHTiZv>(Frb%z6Tq(xz!bXhL0EL)JyrmpQlO zp&ajI<^kiCLs7;uqB9Nl#acXnqWY8(!hyfdmd2@Qc+}EF8JW#>kV`OPSLvUW&mpt) zubK}-6CUCUiIFd>nd=(tNjKZi<#&|8si?jAmF-Z~*M<>rNSm$BCzr}sB2L5j{Z?vu zgtB$3k{;h)&bC-pq88)8q|23V&QurKkS@Hq<%}EgQJX3!V;EO2jj;=W*ww;*r?>bl z^Ps$hDD}fx#(Ee?*T4j<6L*dA8ehBGoE<+X?oo$uY}d)!XdabD_@0i>E+CWLPYSUk zZO!xoR!=m^3;PBk8A)ZVbiUpsLF1P8#&*32+~Y8xL5NfN!3<6IQ^n&2dBjfSLrStbbsM|*a z-f3@p2seJbU*XLFmOQgeJ7H5ED#%A30YR5ZP7PW zG=zHJrqvtjolVis{k54O{HR>EiXhMIDL%R2QGJ7pcOp+VL2D6E`j^G8U(8c6}AkP2DX{W2Nm}hpH)mCvPV^6+KKw*X*GewLSB|y8^VNsQ4sG z|5is$+p0x$q(vlX4VsMWl`~u$%a;+qusdaN=Cc`3Al zr}bTYx~l@;PF?gBH}&{5OO;C@(Xic*4`jVD&;TC5IG@Jmp@dPrd-6onz6ElKJs8nQ z8|NF#zizxnSke2eG+wHLIxU!JPQ?c{CfG|Q+Yqu?wQ3C3+SuD3qBDhxfsA)_6a7@O zk{pr%L=)&LMNJ8{LAqEE^YSJA(l4`C+<>Hnmpb;2wj1n_XV0j~C0Ae3x+Q2ced=T$ zG)W@i7MYit^?I`8Sxq8<v72$HAWoM1Wfdd{tZwBMsjl&tWXJI5g?f9C5LE+(4WY~6vw%iHH z7b=D_+5`}(_ME9s+k~SZY8sgY zn_^%8?3l7P1xS?1sz1uen|$$E?6~E_&HA;J*IVJSZOs`#IYd{-cqqYrO1zeKvk+12 ztQgD3YcK2Dgf7gl8fu3M87a$3yy$WaZ8jzxHssehD4*6x*(nWkp0C}lmF855$5*ZO zOdX<3d)BOB1gfJZx3|q0e*oAUw9t2<%WJH9^oftzu71qQ?Wn{P5GyOxHT1QTZ1D-C z$Tbic6tWz9>}O`_HZtbjEK2$Fq`a#TZAP@Ut=n zoj$*IsY{sKu<=mQJ%59jo4JFi-Z};{aZ)|ER%49X!Axf@JrWliDX*IqqQqyZ*yMaC z&f2&5n8kQpE5@!hPr>ON_51p+Zr{>YV>M8xHJvkj$u2;Xfn+Y0xSG&RF47n^m@%4VA} z4VuTJx1)Bd=5W3A53ahNLd$OEr~)i&kUpT(u~T*3Ze$CMkIz}(I5Vhfk`25uoi(Va z8rdR){vvT{lAv#ElNLutDwzZ1;bfI?Gl+ZP-89^2veO5xq@6T3Fxq(=I=cy_S~rIo z5Y3qSh&p8^ebgF+Jx1cgA*IErWI7gc%tQCjRMv8ZMud(03x^eBhhs@0f+BCVz_4UO zOP3LuV-s=Yo;ktk$xZlOM>Taj)PVp_QK{!bThmv=Q+-4qh($ literal 0 HcmV?d00001 diff --git a/assets/screenshots/2026-10-29/05-settings-sso-reconciliation-scim-token.png b/assets/screenshots/2026-10-29/05-settings-sso-reconciliation-scim-token.png new file mode 100644 index 0000000000000000000000000000000000000000..dd844e068ee3d8d814f8da92d6d6b8eb57f789d7 GIT binary patch literal 209929 zcmeFZRa9I}^DYiafZz!d9Fh>+f;)s@!5Q2M?t{xPNP-3r&fxCuPH=Yy2rz@&;O_9x z`@Q+j`rnqBYFAfxS3mXa2~k#*#>ODUKte*omiZ!~f`o*UiG+k| z@$%W9E2RC>I7mpZkYpsp)I3u6VQ6~z7SB*{@ z&4_FAI%^wfvos8B|0yo(+tAOpfVTmJ8sC1txQ4$9|M4m)r$^-JRL;KLy{VQ|Kk|iB`yV_0kxxVKR{qoY^HUW3?fKt!F6Fa72K`5VdcNfQ+x&$1pU(f| zjsF*8XP3>pDF1V#oMP^^91{$ivRjM?M8L7orj;|+GmBSQjj`tif0etDk@;%w3-qw=XI07vH^e|bfmx)KKp z6hCP+XHD9#RzH|vsTb15x|4HW&3s1lMwk@lRi0hUVAP5l3qNum6T~Y?&JGO%J701N zic6vtGt;F}tl>8;(}mGwicqO)UUg4n5d@@}@iQ=2kY!1WhmuXaP~aClxu}cze7UXH zz<9b4)JDr!ZkIYwzG0bq0PlfX-D_H;M+zFkep$nCd z%>9zXxQC)5XqwIvOGa0>t0zK;Pc+EjiA1;H^lDu2L~Z5=Z_eh7J|}tWqmGY2jgbut z`e^NXs2vQV>qd!bHIHoewZm)9;kGJ`?C?!!u%k+syRImTBr!*pxym!2*zTekffFGg#D`{ZeZ)&pHjVB%gsI%H^5`2sQ|;ZLArm={2Sf*0UT@ zHcaboHfY?`-b)XD>r{>%#q@UEy-yjk`9v@ZuA|y9vMn@7AbSmZ@Q8CTc9Pg5yGWUD z*JldCQ%@jVaevpk*#l25j#~`vfEA`Db?dHSnWI;T@e$f^odhRT-3eu=<+FrtMRJ-K z-y9teBNo89Vk4{KCt>j+WYK@V={#%cfuQ>JOTOBBu02@m@{a z0aDzO)RQBE$QY@X)q@uPy*) zSMt?zD+e6)kxiDUaL0O@;06>GC5m0R6jn#5?rq#uni6%iO?CzDFaiVx2 zlG<-LraDK7l@Y6zWbM(a1d2snk&oA;EjH+O);#pvm`-u68?aKNHO%BW#`rBCTdBbp z(-afT7G+iA4Sy26@;Q)|8I{Er{eBFjA)?o~cHWvYrx_}tXX=f66eNIk0 zYuN`Tp54pc)Oz-(a%q^3yH;$nT6}l?5 z;Fh}hJ;T-F5Z@@?LLZ0pX7H^HdiR*m4snSF>N%c9_1wwZN#tLaW`f3{9^8dW3WGj_ zS91IF^63ff3B?#}Hw%%|M4tnwT$76)Y6)}D>H+IC!J?5B%{f8lUpZ~vGDIlKUvjwnr?f#s)42IGCIa|D;@B8v*hN&FDCwM z6J|WFUnh6BZ9~nWz=bRE+uCVkWv~40U8t^s`RT@m2z{(MqS;f|oiTm%BXr7i!s)sF z{`H<2V}aA$%2gPfalv@qPe<)ES_Uz872j|dcLX>fA-y9iJg-w zS&p(c6f`CIxk3x^@Yy(*GlM(=!(%qK!i(VN8Tc0?XQkpPX8FyYsL8`V2t}nq6JqO+ z*HtY(XR0I|o(V01$YmcNd%N5EpNTV7G)**IX>mcza>~CEzImf_K`mR=-`b=aTEWUs z8~#O&8SNmcz|;KUxAYBx!tV)_wMvFG`MMnfw%_i<(WO~60!hWndryZF04oa(3M_<> z9VBZxMzo8A9wc|w8P-?ZFr7Jn!iGcH3KG@-G>K(Vem~118dzpxnOWK+=j*dGFWj-O zv&<3EO+)qqIoR|iAA-HTE_3!f^f^wD45r}bJ?6VWS3QsfCs%aaaqyhvY8_#<8><=H z(e;ti23f70u!Tg674y;PYcma4DsO}ucGE`9?~G9mjfU(KP~7JVnL|wZ>dPZ^3=9h4Hi)HNNDNVo>mAEpS+_ z%X)l$EbeD(H7KSfkQ8N-hFI$kD#@G(?+Oh`gO-W_I>*gAZmw&y)7z~!Pn-OV4qwLX zpK{by3BD!_oypfyAfo;NF+?bG4g82Drfb<-}zS&JJ#ut%aCwY1SYrs%gh$M%Z z$SO8J6$v(=1U=->UpmQ(QYcGIZqS?G=cPQ7(+JP89|T8^(V)q|@4|{6zQyr<|Fr0` zBf*3?iPi5USC_ua>W+UAqUJx-()FGjSJCJbk7KCgY#Uw6XE`p4G*m^$)&0w;>_0(J zsfz7=JJ+T+YLF&$`>1W;{`(dmn zy^_aeHukCTiqr(f_1?P&*IN(NZtMB|RcG@K8NH`d#O*W>6bJz9@_Aigq|8kBcU+m- zG~+_rj9m_^@uSGRTv10eVKEUVwknjsv{kBv_x8pGY9E-L2ZGHo*y@dUbSJ!LN6sub zY`1L5MVd|S71@T2)Sg)5o@OE6Cz;#x(_Z(!h7+7U^sT;m=gvFwgO$TIO&Hw8b-C<& z<5Ml?@h7wSl>MHC5JkhMEJv-ciOI#92BG0n7abkTB6OU2sbYzsWlad(-znAmPOGmy z9=Fx-jF)EWzgU2|_gA&5?DZt85&=j1eVAj#yy<;u=WxE0COMW#Q9}lAN$hM`*z&Uc z+!b-%ym)NdCum5%peekTL7=L?A)_hrmk}}PR1IViCt0IKQW9R}46RMR^w(6djd$8y znISr5#g`s8(^|@W>&*)s z)52+bktlsVeq|Z&&RakfZcIm3M-!uFeVJxDIo^@F>-HCrsq%gA&-*yPwNFn2m?3fM zHfBMsveLYEk-o=={rd#Sy$l1mgA4^WHdjD}8v`F#;d;J6h$F(2)C_2Q)p;`VvG#sB z!&I9(as=3U336@Gswr>c3ke}Icyk6%(VZ<$3wguodDR_$oqE5Q*!}!Qr;UX`ZKkd{ zIWGG1Ax9Xs`1`B7ZSI3PA^m76M`!Dz5t~|Tt1hKBUm63tT3JW?XYhXt*xo4iJB(W zwF+f*X50%}+NwnjO8tFi$0*Ny+*FLxB8*>##`s|nM+Tvuc7^8IF*Tj9jI;_Y%Yod! zI2mld4}cD`F8Iw8n2V*Us&YvN#T+*i0Tn4rzU^N-$r?mv(Fzg2pb0D@ajnUKmF+sN}o!v1mvaQJ&CK*Ea zCR)pBlvm|>2H`8RS2{VuILTRI?OwLm4|Mz>5(x4(b!=#f`9@D4+6z;2A_wg(b^|fV z0p-a8oa^BJ8vHgPB@~r1 zSOnKUfWtM1ELWUNS^F%2>n;J$Q?i>2w*BOE)w9*oQUE^gj$Ag4nfcZ~j@7LBn;1=D zZq$Htb8D1yReL0Ws9#A^g$Jh|5%)bJP2F)mgvki-TRWPS-T^g;e#*uJb&$zkH!=(2yP*bDq zR%?i)`gHyo7(%;1QifK(a{a=i*DEwXJC9i|THve9;~_VZJJW8t-tK+9_7jI9&(Xp5 z=h@nbi_|QZH0BvKrn_nH9fGnE<@WI24UG<@fbvq?%yRR#ofPCXF|XO+;O0VXoaF{0 znUC_N)@fl1@n@k;RC-@OGs3D{?>|QtK5FTaYrdb0SL>E3OJMYdP&Y%%Qb(EBw3HQo zGwX@u(U<1U79tG~l}r|{g@2w5HvBa@#t=KF5mO*bFQzSX(lXT1DpZCzCOCEqleAH# zeWiRl}Rk*JlSiX8xJ)Vsna&Fr@!Zw z7CXQTO{}bDC}y`OGWR(6n}? z7K_XMVxyMMbWknabtQq-n=n!6UktTWhQ<=wc>O{MyrofiD;M3}k{d8wp+j7dTbhMk zJ=@Ub8YgaH$z)yccz0sYdy;vsj3Ox#!8kBL7!T-DU|WGGD*!;lI-7=sq-m^h`K|`d z3uqtH>M^|u3k_j?0!GE#x?=S87q7lpsyhGTAQ0Wsla}r~NjVrZS3= zJKO#>Q)pIRo|R?omaO#2eruvN*J{~+U^XuIY#zS!kf*@{O99ijiD`y6;*#0`Iqjd( z`WGfaX=!8mqRR71sVa zie2?AeL5fS4ewpPrNyxAiL}f~aKw!(5e@J|=%U`K4vJuYQ|5>=UBPifl4H zu+C@=S5;PQP&WF3P~_@OkTrc7<%Qsn`z*)JFFXIaxHJJ7@=bwTM@CGKxgt$ft{coR za|Fv%VWnSD9kR|%&;_9y0K|0_e`-xN7B~@{@u8#+VB#vGbzIqH8~uvaoKsWJ*MhQD z6yD?A9DgC&Fb(275D-9ojKA1`tk&sA1IjL5ivjc;zT3V~!`7$eyCStqucZztjTcf-tkpP`%}#daZwMGR zl1g8EovgFoo<2}G9St~@EuN)h6%Vd!h`Inl&fuOyCFob#AB$8p*wqReQM@9Z$|NVP zQ@ysll%3)Nc%AZ2uS>V%1fo<`%ITZ$KVQ$rsm0T;D#mEq@%BxA*zUcFfb8;{3HXDf zxQm>-F`VE_@Q1DX*6b>|MSH1+Bcc>%k=jUK9t0mAygmr2xR`NHnilTShqa~AW$ zc+#oNBSVo;D>NY3z5e((f46v2biASTdgX)ew-mw^-|L42WvU0}jkTJjRnmyQ)fXZw&f$;EATzvShlQo35;>`@$Q>aYCv zH4sqL456kkl-n~ZP1a$zJ5DO+CHrNZ^Mw|favO<(!Ony#%jz?{ zE+jB`uNDs*14M??#ZiSuH`>SuX3#>=xI_@_Wkc-J}vm4Eu@|^u4D#FINH@6rzuM3vM>l{a6E~+P(~1&Np1xc8+-s zLTo$?ao~VH_VjjwYC1}`H)-`9Gt$R@lw*x&e@xkrownh)*tJ29D!M$Q`57@ zV56VKl6yXF*sitQ3)t?}`A%K2jdeuo{yj0GUesOqm%RktpCnHX_E|B5SkjEIAInhh z&oi;U2gbKml^!3405$p$+4dy-AdnBxR#62tQEuABK?MwM>Io*(&?tycKVBw9=1qZU zYN@d5x#<6yDWrbP87a|_IJKVF6AI0w)?V4tU|4Wltge&GnE(aHwr zbCssDg-a&_Sl{~+qjHN(S{-cf6YKdDF7|eYP~V%>GN@f)Svq|I@j@Fn8=S71@pPv8 zPz3B3QDrqOQiJB6X@Dm2=2ZIxnL$TCXu*1lAvylxSESBbw|^`iAteMdtXgwqmcw=r z{d6KD(5pJdt6b7txDIpy^uNOghp?*0&N)|G+f5vE6K3Bx(MEjva~j-&2ZL z%>pDXyqg{;H&J>wqFjC&6gysP`>ZzQ>kGQ65y8u+YBZTV&%+A6LJ28Ilx(;g+fZ)^ zfyT>&WqI_&uPS5sT~sku%|i2S*VyMHU0!Ow7n~K89PI7x)RoBVF{|;n$x0+(IXNR3L+l06$c8FQy$;e?z z+d5IcCWx<9l{WN1ufU>j2Xo9j=(LE|^8xO&JmwhI1bEK??<2MLQ>H75K zMzS#AdT_cq`|Q1`Rdpo*{}}T~Shy16=n|$#H>s*toESrtlFE8yPWRGEAWUACZPmawJwg&Lz}}Y;ET>m6w+_k{#Z+<-X}9^vZ=}QjCueJ;_Nn(UCyJ_ zQxpRnE`qff8)PD|nF_4oZX98@FYG<7(r9ld}CuS9xNtb_;)Fg8+YtjwZ9BC^6+k0Pi;6>?Y~$6 z%_+mMoWhkr`sn)-M?JHifOfgyX!Ri(iv%u~g53ENqDPEcE%x=KLTLFEZ-e_1R-yH^ z>dzAnp>C_8?;*0O=f{}3tU_<||G6G@A&AuQOSVuLPp|mYa>*cNiG$6BEgNoY!wU!`?jZYhMt= zgMDr;49NBMNznPGPU(Ms=_|`4K|#WPYqLKIwoS=h_r;*PnY4YGaWA08a(}$aYk2+M z6XadOjt_ly+4iOQ36LJcJ&t|HFks{I&^dZswSBYFr=R@+J0L3L!C>z&^kTKi^5;L) z50S(bql0rl!{HOr3v_BLRjI^rp#8$5&Px=$RScYOLD8C=`}30Q4+fraO$~H=Mlq@T zU5c6hI|NT@>G5QJX{*rp(n!_4OY7fPCV9NDdDq2)asX4JVTpTk#Z((7-Qm4+(jPtF z*s|;F_55lehr_6%{Etk%K%1E%-blaOw<}168KsI9l+JyHW}-L(L}~$E>(e)kyv(qP zoPG%+BROoE(wY7ONp~!nBFX11bKJ6nJ~D07e@sX6`T(_!)G;^uUX-sRJH7DkiIgD8 z+N$z&5=mNoDhHo~l8L+La4s28>RCE=k@}V^n7^Fx_fPZV_-?mEX zeEp2IwKW8%ITkEDKI=QH|8a!%vI;;s$R%ghA?z<-h0A7(O$DP?eGR5N=-7DvnYHXx zJ@TrKTSP}HalMG~lq7UR{g<-k#RtXs2tid+WuC>8qa~LoA+DV{ z|D(TD7UiEpe}xuAKR3C1Qt{!4M{w#7rvC3ONS_c{*#A2c4BfaIPxjybNVyO%5i*6E ze@69>d~@k$Vf?p=^!DP_-`YOXx0(M%2tZQ7MMnGES7%zU zvqfjiNG>t{5<7nReiuT)&dod!vfWx6JRH-ILLe|gOQkkqJ<0bSG~kcp#(33!af4uXC0)bH%g6`j=yFE;Kn7F}6rGyaAG(hG9z+^-_5 zQKDBkH6Hev*~tPo)121Oto6()6KPv=(d&vNT50moW(v9yN*hBcQJU|C_2@ToF{tN! z23#>p3^DR)zczT9$NJ^eJ>JPR|m%-=p26E!erY_xB4aSn~PB)+at`U4wM}!U0A4fq+mA+AEy*n~Db8l4~*{%&s{{F3ND=pOHucQn!Wulz|RSxuJVJ1y8R;EsI@~_r)K$pzXoNH zQsV1&+?Vnmk=9I*eL)arvt5 z2Ah6?AIooKn0V~LiNMyJImg?$NJL#+34#M;5aIHd&bKoBPeMBE>$-h@R<$Rf27Q1o zUZ&rn-Q+Yv>{XIvR>y^vG8)%O47I%9px|E-mcU`IF{{4D!`}td$7?PG&ePk!!UJ&P z?cC@WjVq0$Ad3D}Mqoj3dkc`W&BfTX{NyG@-p$D*120hzVz-e^OYrKz z+94xDt6H!S!Cr-8@5cc$ty1$hyUtj2=Wec5IBHT|T4q)2^!X-N;%^l1UT4`dp3MKH z;#R8BdqYn-)NeGC!Q?J!MkCuV(pxvDK^UdIWv)Vyh&WNED1{i3Oswthu)A*UZ_)m* z7k^p!eak_{=!z_d@A}wEQng*7G9gIn@In$gN>I2!0vi@=~ODYoG()T}G$ z>q$!y@oBTz)aCQ$Js;S7!k)UTRBQHYEK>(gb(f@f#7#Keit7FyduXJ!a@33^p0YO3Z4l?+K;4pSTL zBBwl-sp0mh5!|<#^Ih`h4A6QGUx16=_AaL|D+`SX*MKM&-+SgAkP0p9^1tr>Hjauc zEgo+km}Veya87EsheL69e#Bi^(9&`NRti=>;&uiqjf32szjS3)6x;#>vLlP?6e;o; z3rmVr42gLK6Bycg0yO_XOs@f-vdVKFS^F8}L&nQ_07hFSyh~M5+|KD!w#&{249|Ob zw+bOTv7%&G$Ru0l#S)S^83hCY2|PW?gdFDxNC8Xhk$S=o1Fv_xJE15G~RGdaiY|y z2FvUm9Ur56Ckd4#Exz@%#!wqubkEELX6I=2heO!PSs)H}A;*wvoI_zSF5+nI5JBHg zBMo!?L{(Da_`31O-**vV*Xsm`Uf`SoQDGf7{S9pjJKR#cb*@FT8YuCG%Ah@IE4QUH zi4#ezP`jXr9py!DdJL9Secipbmh7y|1t@__ug?1bm0}&)&s}lj?(7m)<}MxyjY^%M z(~pS_4eRt;P2&{i0DJVCkxE@Ux3QFuoq6Nq4IIlj>ND)>{WO0Qk>lM}j7U_#1g8^K zOPBZlTHJQl>PT(4mn@(n&|8-b9E%urFzs(2DsMFjB--=t=j|||ntWgkjfi`r_5LV+TJq}(R~c$&oU0_}vKi?fIcq-&JmQE@ zF);T*mQ?57&Vn25FB!?Sln3Q`McRm0XWN5l6f;x^P3h~?KnSNW_oxtPi7VxSm~I2x zl-%hB&Z##cDS0$)>z1V0BD}7l&BK$GZG9Ss_t&LwgTCbe2;>D_xDJ&22l&RPAFZ;- zrmh8B+;APVp;g5)IKuttWaM;Sd~#bYimQ_NBY$e}Yz`kODmSLS(R8r_&zoPbySJ@G z%c$JPa^!36gyk!{r#|*Wc70z8a+W{NU$h89X6WM9!N(Kb$WQndBnUe+R-mBrsSpO@ z4eRqiSRQdpV-G=TS^q{Ck_h)w_7u|6{>Z&2?clK}`$J1w`VnxC{#^Ka_#D70dEVZUP5+K3p;Z4aNiwmEBGT)kT*8^;oIYQ6PLNKnDHQKc4j z8O|5)MEP$*L-z;a_PJrh!FAi2bwyMNj^6}vV)nR#fj(~gXTNm&-Q}s~M~!-BhhHBV zrYI+GHCZY4!$l9zWWApL=7hl!$){VHPJA`4=wjSem$S-*a{?N8SRUSIm;V+2n zkMlx>JO)eS=v1Crf3=00Xv&(j;V6)wtnWSxbY}_JAllLld>hz~R$sd0eHf$p^`h)U zYC!9a53XZtc}yYd&$lEf|={L$U^F^o)(I zBw!51)z!@qEF0`~n@KIVc<#*Q+03SSgoN?_t0)uli8|-+kiNb6Uq=$Ca5MFV$Ac$>rNuh|SKw~1T;RapMEkk3U%0h`c=UIRT? zclEGRK}DJ&R3Y}(bCS95!S&!W(ug)*S83X=_ok)a$LXffU7mB76S!rm`Cxq~?z^(J zHy1fl`*f{;4w*cMnLl~1%&R*gc~I!?oN^!CM5(yWhw~JfMNORx^XRpKZOd~opq5me z6%s1WFaEO?deLk!6cP=-H80cR9!f~Z^E!eTr7%-=&vxdSphev<5%1sFv~dvp-WV$PpJaBkex@tQBqGN2E>ZeH^LU;FJ(>|cHOjLetAv$WO8YiYejl6G^>agpqqxS3z0aGH$VAjgsTNdfJ{|xW1xo61IZI;Ot1#F~dawwGA zm8+lq3hURr?@kQ}@f!~7ZAC5|iFIyu)TAczFnRrpt+x{An49Duf(axk^qT^1&z+uM zmc7hO77c1g_D^(rK!lL3Qh`5;)x7`zYw)(D6_$2mUy(cz_7GfcbFPwKVE%&OfV8(-olI7mnTIscxYz8g@z&>vunDCPO4nuoHb~jF^EdzGdeXIRp&{3*#-VNX?e*0Yn2c{`}P&3*8nqKn;~G8P8|F8 z(uHF(`)od1B)I;t!;oL+be@z8rm=5mhhOV?Vz2%>N_Laft%@6p2OJ*Q_DLMeIF{R( zX4aF&K67w(sKo=Cy2*Z?$jbrS2N0p#vuoA(HgW!r6t7RGe9!zHWOcIUU3!>;J2u(T zZawx6;P7eM9a3-U<1Vej+-oF>nmXU~)NUD7JUH+`oB{ zP&T()l&lqp1hW!0;p~2;TjCnYH%i z$8cwxt$dw_m>^L_Q?zUY1&{sX$A)4Sd^gbcVNDhU+slSA;raF`)w%{~r+PidzqKO0 zkyyE@wpr7Es`es@4`fOt&9vIC5Q25p;`k^5MK+{Rn0A}s|M)R9Xulkv>MI^)Jdu7of8$4UTe)QUB; z`pR|&K?)s`-F?v@lGHC1s=oV0x2@CXEm$PW{iB0YE}yE`x`C8ShD{(VT5+Dk^opZ4 z&l4*9X_-)ScH`|aNH`kPprQqq?Z)ftN8m+vOGE}=d7?kz&D2+m9%gtd5ZbBRy)nyd^!ZE6e6Qi=}^vH&_` zvB57gU^Sj5A2#_O?vMP}F#(LNQu>cPqj z-EBUnE+DxOVK1i}+35p^5lfg1Hvz2pNuv3vNTKFl+l7TOu$sJS>*@wat@SBSc${;G z=Rpc*xjMee_~dY933u<5F`1TDCv_*K-@XQP8wsRX3Sx!Hv*}c_yw%jZo{({=$Vth+ zuBlD6V9ltpWlC$fzLHjV{W@r}m;GKx+#q*6PuNI4Jv1+;CO$_b?FG3Dp{lNT^%foQ z!)dLp-cqv%vq9$y%d!VsJcWn#qE);)zWnDB9_nBj1CpbI_X-UtDZJ-U&$~Ww*ho4&k)0oJ??!ayG#bS%BBPpXT`v~Cq#q3M z51W_W#Ou_Z%6mZHeV#kw&jas3I^NiRogyI!gPX06af@Sd_#IO6zwYJT<+mMJ!`3<9 zWMZYMZpA5GJ%==Tyz0IhfP;%Z+{-ek6xmZnt5a}At~y&@94h0;pm6L&*7z<9EQR8` z9$iC~Bh!a}ig7lS1GHOj9n{UVrgT*uQ|m!{#7u5Uy!iB5AU+y$>rtD@o%X zf6}B730AfODVhmJjn8&bc@nUUu8&vyvdOfPIGn`UDB4Ey<;hzbn{W;5zUwq!|5{uU z>uR1n2ebZeU5XDq=XVxj7GKUc%{F0PuYnTT9I?%XEOi0-=vwJNWg9Joo6>rq`aR@9F;C0*puc&}JF zc|UrD%^51v8>8GxjOwgRO-peWBE-cw58&gWvQ0bGLRe(pFEp0R2wB5;OP#jw^hJI7 z8U06dYUS;SU23=flgGS8e-`OEL7dFkbyh}_D!{bG=tkY&_%R!2)X=;B)N9|n;_K{K z1a&`d4K{)1hSS4B(n#D?Fm$L23Q*XaBTuuPE-Dv=fqlhM&QH>JpCNUWv2TAVH+W0HR?*Q0nonks~)_%i)#- zimn^)?aaZp@*soT<8!e2aTc`G9(=gW=j*&RwtRQxID_T$K~Y?VQjIX(5j>}15}W4V zhh23pNWcOr4G8d0WyuhNf8TBacLpu0%M3(ds;`H3jhAabx^)HfvcV~3wn&-kR45pZc``mfIG}Sqs7{;fpT?#Mvuz)bt zx#{!HaK~|CTsnMvb7KmdVf2NX^`C}}BzwMISFF=zB~m!fO=J%{2VKA0rR&p*O3%#; z=g0I`jfO4_+H6%fkw1Y@q|4yVwj0FK6)c@ilb!G0tb>F?2`LE(^tH>5IGf&KICI_|aB>+eU7MlCj+ziBSwg`A3He8s1u}Ur z(5m3G)z0{S?|-YARDOQ8Rx%sbSGi|g(u>}9@^;e>BzY3$uR^a%l%k_4)tkE*t}Ym< z*GlWv6*kuk!hAMP`x`JPzX9#b&ZgL zThIH;;e_phf))wQR+DvD=Zx-dz@0XS`h>P%RWp9ZH^NH_g&rBW6_?f%ueIzNV(ebW z#|-cAoh0^7-|~~L4`Kh4!+s0;2MK%|U#^E^W|pbMDA-h&K3Y)nk=O;Nhs^03u z!j$vd3_cq#T=dbtqJ$SB|0bnilf%luw|S^V21Kq{=ei#4x(>i{q<;&tJs7~4Dthl` zcLeBlT&N%mvXQ*?F!cQ;Kk)TzCvtr|e8zfS{mw;!@b+$xT2GkL?3eO8l$XJ$9!C*n zsUd)?AtxvPqja~fid4-_7{v>r$Cd`=CVU2ev5sZpbD!6?Weep!R=-5nqSJUN1>Ztij4VPb}P?nkJvt3n!(NAsFQOls9o@9q)w`dm+{)GaWfIJMUBC z`=sEaE}Ca-Be?spCev1>GmPm{4Rk^1+i9Q9FE|FcieR$z1s4T|#;4Q}vf0j!Etf1X zXKE9N+y3e$d*8bBKD4|dPrEGbWl%z8k+jOXtx806mdrCG#DOGf{M`>zEohkMofJs& z!+y3Fa?9m)B^-R#8m^Q6Qg>P8_L$;~Bb1Lo@N@t!S9Cyysz1ChdXU!G>hJL=%F2G!T~c{=N7S(_8nGGUu_CX40U+3bw0`h}>6TsYdi zvZ{Ft(VrrLcuZgTzU?sTV8y$G1G6d^MhHBFC_C6&R=l~q6VrLluSKpv}`qjmi+s@+LJihJ?^BMd@9)UoP^zaw*pnjak2ZK zd4_cS?hg%QmGglWCEOVy0-F7$d}3nERFvdWl_!lxSDB+Suf}GfIjsuFrsY+$_2k=C z-LLd;do9V`h-WaI&H0(yx&O+^jlFG%09ww)qQ75D&j{es@%a4`CUqSis~V#F_+Km_ zpqS1>3+go2E!cD-l4YwYttxPKEpG08;hFv_gRb1WNb7vZ^7G`f&GO8zqOkZOXF#1s zZ*5o(GTWv>Egw^nvuzrY{xN?vGQd`IF}>?-mHSX-^(3I=gUGNV=fR4(G+u0jNnpXD z)wuu9}9Y!5Vu_;+3gonm^Q5n^O7$3yn+v4c_T7%)0)L*?T_=5 zJ|}h1gqsm%ds_R@Ds;MAbIXVLX{iHhqmxq0qc3AZs&WQHP#xfYmRve-c$Hb(jTO3w#7WrDsEJ<$KGNB(|dX%9h+w;?%-?BLhQCr#ETt0-68e5pi zViHl@G3Jlen{IiabF$ll7c4ysLP=}b59T}L(!p%>@#EVvODGq5&p!wq7rOVSiTu_J zN3hEQsU`xu9Ng>x4l{dk9y)t|HL2D4yI-_R=488D%%^ng(a2VG=l z^9$i{a@@D+xB$*aIUj+;cdR<8;2i_5;He{ivm`<`!~|rUgP*CT+-oJt*7 zEpfEI4F;yQKW0{4>1SjXV&TB1@+{Eg#-IwiRI~Ur$M{DSz7zI)$7W<6!DBBfcW?6} zDfF=LaP9a=X{@;UfWsQ$)3V+hM5&({&rm7)E_he-^klyJR=Vv=tU{IAf-YJUcSdL3 zNklCGz7L+1=eNKbnk6Cp{VLBXw&5@zLE;e}hqNY-B#O3lNL?x|ONtEaZC0{a;-D%s z==&X;GzPEZx?3kWg`S!*MurZ}p#NLjcOlg)cFb)|sxNvE;u-`;>xonD_l4}Hl^O0@ z2T|zO`>zY9j1GgWx(XJr18exWSo+&Haz@+9Mx~nnlZh$w{wWs!8b4pI`Sa0AF3EaJ zl;J)zXxwhgT zaK{rK)Sl~GeXi|3&VW)eg3C1YhsB&eHZIqaGSWr4Es6f!Pe)R7(meR+A&#Mr)AR2_vo7U&_ zl0Fst?+@%rb-74QS`{S`n$21Y$q)oRCZ&rPT#?f(&7Zs*KUyv+#hOcm5d>1|H}g49u7!m0 zoD+@>4t+(vtpr_^N=bdD9Un43EXGzqC6`{Ts`EJJGJ*HH%wJ%chZU1BGsaFQf2} zT6{OhO4JiGxPU~h4T0HX`}4g?oWPq-!7lH#6>oD<=K-$7D_R+^jZtzdGZ~BEWy~Tb zHmi--1H%em7@S<3()LC4!fe;$b~1(cl=N_aJ^cIM7kK|x?^)FLw-0~sbczUA+(5&9 zFZ5VPP0x?e=m7nRY{II;CWbUo@lMHO!*0M`;x_ZyqsKvnZN&JhofYp+5Lqg zI;A@VIR77eUmX-j7wt)ekU)Uo5+t}of;%C22<|q7;2u0UL~tM6Cb+x1%i!*VySu|| zlYHNMyIb}C*?P5ATeV&JBfw10boagIp7WD)A*p%XE}sa$^c?YRLcHTS{=V!z$8+v@ z9umXlx6Tt^hgTS#^Jx!~Bra41CZ7I%0YdJ7sDBW`TuT3;BM`hI|G)I*|GE%JF8MLS zCZ3CcfB=~g{gDL45DqrJnHf7_Qs(bBG`@kl2=Rsa`H8xkJsW`Y0I_~V zaobK&QDI_YSVdl0Sy?eUCgv~85zpoQJ4j1WTeGzv3Z_n;r8qBPFL_ zesa+^u;=o7DeI$wCr{j7Mo9HSp}nIfln%6ggM<1T@{mUw0m3L0OaidmIc*SKRe56KB1yAPnMU6%5TS~hjigD zzo+DiW47%Ey%Y?Ua3@cHPi43k9UX1BW~f0xux4oZXV`g_hl9c6<7|=PDT)yh9|Hny zb^;8l2UAJX|(FSUW1w0UTs4|zZq!dNo7tmidsLL zY;7BrveN#!?Q}6o;VBtefGg({*-F^+N4}J+LweacN8d8IeGmlm0s?GFLi2J9?{fsr zHD`E4l7UHbbwp;Lp%-T(hV6wkgd^6B5gQZPEpf<{LEA9c+0^~sO6L9I z1$*o@chfDqXV1^@f|;{a!oj{VldI(e-twx+kugbQ!^VIh)KI@^*F)0bsYwjEd)}{K zZb*@G293^7j~eRgDoQGtX=z`ghVr^CyB+p^-KGe7&0%nMjA-R9zP5%J2J#8$i9j5^ zIko3vAL{L8@C)=LCWaKR47Mevrn+Fn z#ZBcIG3%B?&+9)5$i_DhGC|$$&!Ne#PL^&2*V~)WK&hfQ-1STy-b$J_u}2af!b`nF zeytzS&JNyjvDLU33Hd6yt(>@*bk zmWoPjR#mkP>Eh;QND5O=l7xZ&a8egnCV~CBC-}y5S3t98rNXXww!~S5t4dZ{)rygU zfdY&F2p!pj18T#Vm#{q-8kAr zTxQtSD1elU2|-b_5<+*bFyD#qj;+4)l?!|Zs&TfS^}*>Bf0kpd{%5Ya(V6^sg0P4( zJU%?oV>F3R8-nTLj6^jE@Fy zn@g(9rz*PBQTVuA&hap4Htbs^6(-)_?3Tb%6|_8bNC>~W$~Tdq7s5rNUoSeFPLv-h z!}_!cLy37VM=JQ1?L`bm&l|)#sDzl}VdY$&IVj@-xuF9$)!Q+HSfA50ugJ!ldOf9^` zDv9s5;%@RB&61GyZp@z|&U8zpYasp{CPz)}!^c&G5vqB$QcnQxy1o?Dx@pqU;Ni(a zgOf36-CXblQ+uBE-3to93Sn-=Zv7KOYQvNi_-tR~3$T2}MDtjcnUm(Y+$4o^1shze z_hxFTnFQ?4I*H|e=vv*M(b%zpx3Op$82TY>S5-PUI+C@IJku%WKSHcfAYS?JPZOuNhI5YZx z?(6^50D0 zx0X64%`F)SYX4#Zdrj~u_G-^0rYPoEHXd?%$JUnPD2}$Ht7fW-o4I=CV9SJRmziNqOGl@v70Xenek?B8i9v$FK!SNn zZn0Kt`OKwO2+qwi20xFZ@RW_?jz~!z2`i~AV1k-&Cj_D6MP5?}*H@Yul96EIfER}{ zIsO1uy00FGtV_$v4)pc)jkU*8%cUW_zb;`d^_9D{x-BOKCak)4YZANF<#-tqXCX*) z@|2}5tsVBlAG$hTS{iXM)EPZi+u%O0^YL);2MTHX94}87O})qJjWYl0ewzf7OpvIC z6ePxmXEH8lFFrc+ zWA^*Gg5yl7#Z{c9H%-g~;G!a;k7S7Hg2VFjKQ(kr{4Oez29?>(*D?7~au>Rb7fzRt z9&DXdT55*xkuEwbBqmGZ0|8BIkWlq?OcXdTKVP}w3iDyA^ypN*XLsi71d+(+ZyMd_HbA9J8(3pH%%&6NI~rMCmN2S z9s|0I%S>ePd@=(`Z+_i7=_l^Q4AN{y<(|PyxJH={0$uE!WKySZ)Wr~gK|JHREJrq% zMEHTnt&*mW*}C3nIs4&f(hX>ZSWK*g@?Fk3?o+^noVuSiuZF#8uW%9M+`I33MXgpC zq#?Z$dzntSGukQ->DmbNm8PwH*3lyt8Tr-xB~8NqrVw5?=@yA#`U0e>;KpjbJwwPk zf}fLliG$#afx+R@_n=@+`PNtTV*H|G%yc4RHR3<0A8x_n)tg0=5Xst-FCC#67z!7p z{FDuM*XLvn37mJhx3@fq2)c<85r_0YA|kZ6!Q?om)(ct8#6Tzp0YqO5~MelA^lwYclTA6NDB%n(+>rITLcV-9m5k=IPnB}UGW@qHI z(9x$5eqOJ~S!Q7Up!hn9juNkEUx#bGBRsSPdLQO7?slQ52&iX-Xol7;w4 z!j9ebJSe?Aox_|fGA0HL(p~V{o8|0}V-xts`54WMr9eMx8tr^V(vX9F*W&At@HR!5 zWa_mc-cKC{y)v|6nA;|&fDX23oxtqqt)AaZBWoIa%x|}S~g#&pHUH26HmY50Q^wWp0cvR39q%7 z&zBk}O=mq$xKGkfbi8#?zb(dD`k;lMnVvb`E&T9M7t2005AT|ongag>J(d|hay=ix zAiOu5;u7hO>#MK76_1*jnQ>Xkbny3=>Q&26jrVmhS1VB`@H~KL2aq=#XXKiFHrrNJ zj-+FdcCyEZM4pQJM3`={d-u!IvaIA~Z&GDl+9I?0b6PzCHzs zDTKZ7AQ)IVg7NZI*_H1Ixo!JmS%a#ABG=)&&dT;gTO3?$I^5RuY#e*@KQw19ryAhx z!|t=)jG@U-yL)<=wb*^#grg=a(NN2c;V&+j2WZgtxE+tbD1WMtk2fo_Dio-5XtbFv z>nziMO-siUm0vGYQ7Pn$dW6sSB`oxyY=fm0(a_KUBXC`21LY|^u}1MgeYvmW^@=zu zsKlVKBE$JG@NI-ixt#@@O&^!P6rFEKQbD7Mxpdj@Mfv~8`TEhainD>3q@q%B{eFbu zRisK2S(Eqm`HsWJd;>_pwVa(pN>)!1L7tR}DKDI20r9K0m3Ps>L3&&BP>NI0c&fKf zZC{g{=`%hqf3u(@*ARQBo${~q>_2)sS)ep`%j0~ntM)PptxwJy*qv(*j6P9{Wt6dU z!5c3I7be0((6cC8x?<@T;KwVsAXpuc-Imv<^3!tfp8ndYz;(Sn&G04>@O`;iVc+s; zILug>tjX&Bhm!K?QhRdft;gloWXDNXD5=2DUM869<`~xx7h?k>1sNPH2>a*uF&T3Y z!nvl&a%+j0=wnG!_-v!oLJC+}30A)`-X!N_Q#488No?6KOH7m{LrB5GBJpCD*1gPR zx=0UW_$(xY-f8;q#X^BLZg#6|kso`rT)sX&*070cNUuHO z^)Q7ei*BXaWpPSI{m2uf&;SXC{Z&@COD@W@ZkBHJ7cYcdc1f9Iqz76;@ZXKWVEse# zLVGgTSi11un4)n1ii!%O!FVhEQB7G{PI~(F!zKOvmwE!*bv$J+U!G3h)hZ~jho$^@ zhJG4*0z*%CT~0p&lGM9f279jC7vApeet z4%y$S<|cR%nv*?ybMaW2yT<-gP-t3w`?R4dU)GB%D`tgB3n{Q#fPamOCcQ>qh+uy%rLELZ zdO)|jey?gFDoVN5!6^&cYe#3+v-(27#hyk_;_Hx|k`fk@1d;;J&crPv1;fowQ9^b7 z2q_-C*yC>7`2;U8AfmZ_Oq7q;YVTSmwBt`SdvvCArq<2 zqj$-I@YXFKAD`=y1LI2pRO&6vVDSVt_YVpR!#Q?pIqR!3nw=dCPV0m5w;hksfZDHW z#ivNSD){fJfdZ@=ku5!%^#)hg5QiO`>+H2555Chy-bPM5X%zFC*A$&!6xO&kLTzvlkhT(Sb^ccHAG7G$N5zYRyj z+d%82?qpCcl>Ou)m8@(HSf%b~ESq8zL%(toL`W++t!BzTea}%dwyLjA#%DHV!^iOxLAP z-MlT$^XRZ7B9xHgG3a! z;r4b>5Qw?-*g1H-;w>j5BV&+%PVI~k9S;v1TbWoO?pfh`Swpq}a%X2}vu!i%_hpk! za84|&n0kJr4|7ilWje;ski5Ni4&ZnM{gkLbywQ6CZVkdWZhisTzR+HDP(5s!?DYFN;^ zw>makHC&^_{#DoZ`)YKelzgi*VGIvlVDk7|A}-U+=vGfk$_6<(b9hO>N3*?InTc_$ z{+{P`jt-!Md2<;VK2uZ8VmqwAxbI~Z*`kS~%jxDhEHUo**p>zKGu`+(M8q_^XrZxT z6jE1taCfr^rtv_f6IE5MOsJa;)~XT#{q#o~hUW;IrjyC)7sso$Q@h`&12^d;fD4j0#TIPs2U1ukV zZH`_nFHNXMGpOEIe;dBoGR?pI`O~G>#$m7h^IK+6wW9o<$G6w;3HO^*%12!tfs>y1 zS6wzM;zHjJ<;S`=&&;_{coJu;4uXi;a;vLF=ejqi%QhfQ-{RuquiMa1LWy`)=@=cT~4!?94k4)6^2!#afuUW?P{pb3bkCQduK)>MBlEhtzo~ni)agR z1z)$$)#rsP_?~Pu_4mtQMjp*hxwmcLKzoLFcN;Mxk8G#>dwOQtd`Z(sqvHCSi5wsQ zl`{5wC6bH8e6KY%F^|EvV?avnpzGYxDAIn}U0)vnch2*59$n?6ZOZ0tS640`+Y;3Jjyn5c+ zN@2o&<^4o}S{8q@&MEY?{B&^FaMCvwA}oNHyXx3N+C<+3ehJ4Q|S^bZd3w9zwz8;KYWt zO*}44h>$@Hjf1i;boIv}s^qz`@bi)7yKD5{rY=YBAh1lV%)> zlbpPRh1Kw9@_4bdw)XH+(!P4+`?OjtgW%n}cVtD6g*9e5E3#xC3qtA%69|<6d;@Uy z%CH@4Do2`H&5H;NGtq5@XA>wOB05Otf#$wADv$+YR!Zo9{KMhBFZ1?FBN&!fqbWMs z=#S=)i}rbjhyanX*tMj|dLiPgDxf~rVR-!uMajT$O+17*Gy69^p*qm>`?XWdpIPE% z^u+S(*ot&z3kL2zJv(LJ>`h5km7IuL2R z5*>8x%zA_$728#Qka+l9>1n`JO6It>A01H5UG9 z;x)E-Fd?V){_d>Pz5-+{M@eGJ;(TY4jx;2m+w^t}iq&3#-4Zi7GjlzZ(r~dauxKl7 z9>n^NQ_y3#nSvBTK9F@a31=hz43XFA+NN2+j%*+7kccR*9G8%qCx%#`#rtntAFe`+ z4*N+2>qC3js3|Fd=SNrGqQIivG8}aHt=_Mj78&8*($tit8(;Y1}qjGj~YaK5utC%h~g{|hWp`Zv($BcJ@51%>MmtVjeTnC&` zx~WqU5YllUwn~tC3?Y7wUZ)Nsqg}(5AL1txaE!RNClPS@aGxz_2`hR{XHpoOlY<&c zC^TZs+bo#E;+%iK13`h-t>nR{K7RY5qs`akaYqQaS0wo!Fy1p-I@4tsGpd1+5vRkk zD2gJkeVkcx8%U(*};O-ZS}ChZd9)^bSGRNK3DA_&5uIBr*|8>#kP+8^zm?5 z6oW@37(82T%CKdnZ+x@2dc-92DKH@L#}8d1fpa<2oI~DQq5I4J!Go=CkWq)78o0ri@DrBPcmCQG16MTmnSU zC)XF|qZ6tkIutxqYlq=jB_%4MWn_VGT7K4<8<+aEr%z_dLZqdo6Ij<~(e{#TZEd?p z0Ju$XjvGuJY`rk>cXSTPB#&b{fgRGaaY`wjd%#5a-0F4-P_ zy7EPBQkKoQzZa@EinEy|M*=Ihkv1{81jafV3IE4jMI`in1$kxl(p98mHF^2BhGr@v z(rvz|#N59j$Rbqy{Kw5LZ3gFr(qwG&br*}v9eFBUQqrSId{s3i_n}t$j^e4QfT+CUAZ6n*DcCqqhe&!-;py#hG~( zVTA}W@!n*?-P)zUQiH4Gw7to%x2*2&E}-htId0CC zE2lA;0-8)YUfRbc{Y>hSt)-#CvAQQYfcHue|P^0kSv zuxJET6YA+=`?y}JL{(Z^XfQ^vu1eN30#B~guYqJ(W<6h; zB%3A^&)+EB6_RUaMn^}NB?l=wla^DJwE~uRSZ&SLrb(GP!RqJ3qaz&BXS0=ef*!Z{ zmc)BuF-yLoL_khM%;i`vv!nX1XWRf6FTQh;KbFsgFcXLLiixKcK;1jjo3cS(=IZzg`@$b~ae@Tdjy$B(O z>1u1UTHlk8>;V;xTraL{?Au_AzFM>ubo5JHaUZ*lzS7FlzTUw)+cRoJ1i149Nq*~E zUcoU5uca4!XLGiF#-N(dOhw2mb&hsA#hJ6rQ!wxIV)gl&hmQ#Ju2wuI$tAa1; z@i5rNnS78Zi z2UK0G062)B>&^LAROD%V`s;L8SUe;+Nb~l3C)1EY)zsXyP`61F)OgQ^OPxubPFQSp z2d9=x*3ieE&Pu4Vdb4x2Qv}yKY#UK4B3H(LnOo{{4BOoj484>5Zg+9tW~$Uk%snK+ zuh!;d61uN*u_wfDJ^w)wi~1@uH@^5QR01VO0#@(rdhWE~>M9h+X8bItGtB#f^jm~X zK}rg9e5Rd*F@WA6MHR%QH%j&PU?#g+b?Yf5l_&&4JTwzuLD-E4zT0guyJ=bKN^+0o z@S;U&I#qT1lA67+-Vmv3DTowV(hOSVinQ$J8*wvj!5`I5^_@ zO(RSQp^$vdcgo7$PBThynK4UEjpM{fE__Q`P|l51 z=zJyW7$}dGl_q)E*>5Kb_*T2zc^OuAr%zTT>Rr_)odOS!sG7W>(6*)v;*pUNO5?+B zDbo?x&7pTAd0BZ%`ofwsnnbb+-!2&d*G-+j5vmIEB^0sf}%5usV6v!wrZll#z6QS@_4Z$jHdusVf>faJ^G0Vz&`Z z8xqr`fqVW&r+WR<*OJOsWy4Ii;kY|POo$X#{42$a(KGxMQJX{u~?kblIE$4 zsjvrgdS5>3?lzw^7kztV(K@X1<7d@Lie^=c-?yrd+?;MCH=3H7VJ>whxW^TX7nPhh zM+xLqan9GLJgjOB3nUz2kD&=YJw1(XSGggDvIS>{t`{Vi*Vo`yDWa1uh-+VeKVx4% zWl_OT1ystb!15P$AYtJY)9W^A>pAL{RvL{bMBulEy?1=k7@E$lX&Y4 z42{9Jnq$%tez3ZW@M)=3m&+lWV??T%b%!WzKv}9IlH?{8Q6SMM&^;_kPFb3k)8nOn zTCu)pLMnk97B*FwM4>WmCS_p%a@?zk`{>caa7II8qoCApNtU?FsS+h%VZuhZty%(_ zFnM_@1>*Wx&P)XqhU2nX04{uRo6~{dT&=?so(pLYPw?n&sQX=SZ!h%glP7K2+4#d5 zW1^qs7f($W2nh(lF5#<>SH56nhk}fOlpJVR!&_x7;R2P@V&xay*C{Ci=f&^P;7}gN zCn}FidoY33P*G8b#k#+EdkX{E-Rxc0d5oT(wc_ZV+nu>G+4cCI(lCjZ=5gB`y9wC24grJUfzz4DT}y28DY9I zfkJyQoluqb6@%>@pS>?c|v`|1wDcA<>@H}MOufGYl9mJuiKQo zLe*-hF;+++`uL4wyBW-9?50kowFKie9wa(?0!UB*pe0NsW(;4Tp*~x#oG$)$2>A#j zLg{Lb!IG%}{a~DxeTbCHie1APNbhpb#wIB$G+vl9=qW#ux+k}6E#%7O@BZ=lhgidE znfNk-`;#Ap;P51|kwM+bf?UC{j-FReT{Nne+b?kgF|DpdkJxjAa*Hq?g06$TjmQ0R zMl}~3pR}8NM|&r*%$C136RvdDp_;r-p-2&Na|1fwzJBuL$EZdeFg+s-e&)XP6X3rN zn}!Nf=~~(I76d23R%kpZz4&yT7a*%e)!Rt?S2S-}Smf;4h*ho-JMa$a{tdM(D9A4N zP5n&@!J@LRR8$T73kxgGhbPfYGFA8Ig&<|nePKNPV$)7x_P3&^ieg3cy&EUl&+^QZ zHaxh%%A!v2GcE>-ABnE;g-+eIRa4SJb+NTvzr0bL$l{AOEoGpBz+=(a-(UY|#tqbi z_yT5^$2d)4-pW6slnxp;eE1~`$jY$s@R~f5EEXmPy1QxVd3_QGfRvA{=@N>5s+2XT zfU5D)`HVItwNRp7z-_Z)(YNLXop@_H&GqY0Z$w1yhVFzUIS?)KkX<|-d7Nvu8{8Vx zA@?{OA?QcB$US*Xn+#at6H^5a#IJuAEsT=DU{cM)1$lh_(xQ7DV?*UK zE#`ey5)J_2Iqqs`HXE?xsj~-2Sv(Ue8>HlD;ySME;N1-kTEeX}AMwYB9P(BIBd`5* zblne>;RX#1xyNazE1?Wn-+dSM{>1_?%?E>?8mi<3Z=PHiHU}UdrIAy4mI{hy4e##F zTHG(3*HXWkE(vOn*ts6ME4@}bhKYUu9MLL=&vosYP}TJE1qNcfrG+JMX$`I$jj5@v zK?F*~Gc#ZqWn+_EtKMzPBVCZb%EROT)AJ0T89Bzq$ytDnjV(yjv2kQbb#Lpjxdp3J zyAX7D5tHch8wgTpJ^8j}WW>}lIyHk_MCN%S{!K?j*uy)QUWC7As@=~FUocdyp^#oL zNvo>T0~cR(00+F#XwM6qO26+#rtIzOu64VbNp3(|AJolHNwLy$rtwqfWk^yk0QLY9 zYe*Nj{PN|KJ4X2MaHV4<5dD7s@;Uide|dRXqAwmsx`}~Nq3t3fThrUknQ;#waq>1c z(BIxqfQ6Jq@DvyIleCPQn%bnh>yzixjH?#>JUnu>Cw3<|K-U*!`{C?pqfAuop@eew zhyg!YsA^1dvYwR{^?pTZX}$+*%~F0rfhci0y`hCgVmKLNx~T*TkMqs0>DMBVfXmtL z(%N11gefH{Cr2?WTVI|fZEuw?7S)k_%=^~;`$G{}SQUlh4rjh_Yl-kTXIC(YPb-00 zhj-$7Xj!h2PB1ySu`r}?;D;+Z)YR=*xGdK(@}oMC%H@I&i5Zpx%e_Ubdj0KIxlFgx z_bp*PANhfHvcERzgSHhFm98Fp_?k^haR}=RY3%WFM@2^mXx?EDj}EICD&Of3*G6$n zuWxNJLLWi`klXCTT)%D(m52p;xFjXc<$&4FIN$7#XCYnXy5L|C;F1W3r~@FKP05Q? zZINR=ZQ?7M_ex44ZaZPlz0v8P07Pf@q3fL+&&Qsgy;&ZAczyw+wKiVmb))T7XhA`N z)ZN@jtJ`{CPO5J7*4EYx@62-MQ=!$pJ9RO!8sj3X`Ox|C!2P+JqKpD5WHKRS;+e|0 zw;uTrxYDrU_&b}UBt9qQy!zLzX}YAA#0Ad^9bKpcpCT<|9b-=L@bHYcG%{Ure2Tsw z9T6jS=Ccna(LqApE&@2zT0Z-)nD^Zt2`hfsI5;;*{I9tjv7NIF{L74G)RfdR8vVNc zXcHz1xehdfk-1y) zy;_}gL!oFR#qI0uH@vwKpi0BkrLmE&7V$+RhZ#s*?966)OV>E;ghZ5%M05zL$0p?D zA9%+-F!YGs*gJY$k(XbGA;$$EqO21V zZi3Gs@9aJ@`m@s?{L0B&)fBQ{eG|uRljz+@LLeC;zJz5tpJ}Tw+{)4ytG=Y8mg+SH zgQ=YAd>nVeSHr_T{qDxae5)rotxEYS?gVCE+TWqyl)z@UJ?0N2L0u18bT5{!v37&A zZJg!#!$Utnt-%P?j@zsLy{e1~3W^@!b84<4FJ0%IZ=Z)wu&I?!BU=bV{c*^eVj+U4 z+aon;n`Ga~^Mm?yC-1C#BKcje9b~HDhAffjsbJ#6_N}nUj6-lu3CS5;IFO=PW!e;yl#{mL} z6MbVW4`!Xb#xA0nbW^jlFS|FS)YV086yBX(g(E_{fIji|4y{76`4R@0~$cU5FL`S^Twc4Tl- zc`S1E8=cF5AuqKMvNJK>kea%@TZ6JN2$y9KNX#tU`4jXC&qSE6_WZ_cQO(1?TKI)& zUI%R{B@20K?Ce6!l){khr0qt{AcazWJ30wJuj%on^NEo^309rWimH(rQ_RmqUgu1pr(=`E zg6U`@Q#VT=6beWV@)QECc4_i-T)Xa&(9}pNhsUF+hqT*9OkkBt)}k8nsz@zDE7n7CUgz-VG(cb5@RY76}(H&|I^ zY9io(^_MrtE~aX#qbZ+AAAn$U@OxA*o$q?%k71~#UAAmanXS`a}LUZ;I> z#QtRW1WpFedzE)+-e+39J_m^yl2>qeIq8udUKc97a#-I0IG5pzHHC=@dpf&jt z(j?$1_ieko7En`w=YOn1keenREU#k7e|$|y-#`v9POCBvZUpohTb;(Nwqsu#z2K|< zq-QFZJ@X-@rKJFHI-bWx8-_`9&(puMvP6M!81){g*55>-kkj5-guF@LTvvrc4qxCg%CYy$H54Kuz4A4DP*n;XmsM z7m;5mAn#vLJ9iWf2n?i=ixcyXd>-nTJzr0Y;8hM}D-l3=@M3xKPovl|#H#Eulz-dO z{=c*(GE`|O2oQULC+lwkt^eO+8|Zp=70>V7T5RnDSU9vBT~@}RY=1PnzzfD6J(4&{ z%_`bi-c1C9Wx!deq@1T)qwfg_;uI(vr96@tUmaFdIDG&99U$5N+87WJvVo3&Y+sCw zD($*(ZLIakj29M=qFBUC66U49wG1@ktWdkJk2b4+r!QVx;{d8Y zr1|H3?+F1-p?HLD6Lk@xCLvH((+~qAER(u3odVF3L@`WCN`#WYx_5TcDgXTjxx&CV z=v^3Bbqcix*Wy9wF?1LcpT6QI|)zw?D$UI&UpM>mxzWD?mM8^8?^c-bQocNKj4 zrKNBrG?D?R9#{cZS9ftRIoX$=ks3h`hR$6!Spq3dFez7jP_6A1qqBhRF68y3H7e(Z^Ob4)4J}LY-=d12?Wf(0cr$Z z-Wh<#TI-#3b94L4=p%TAdU>VQsF%4I);We)&!=DUyQHS4^P8`a0YFllLEG?C<0EBa9*v5R)T2aNQFG&d4&<@LS|5_R#R9Y_V z(24jli_Zw84enZ0R2jW$R&({vzPa_8`hA-is<^lSBQM0H zdp0`qi@Q-w5GdufcIIRm1kWv$G6K(?~AX$puFGQl_nDcd2oiYfo zgX-83UNU>#aXLIwSz3Td?vG*1rP#xG`9CBRsvj(6g(JJVx zfPjEhj+_dE)}i8Gy6-;++iI4Zkg>2_?9{4^BbBNX{4+6|C4knxjFi+3XsGVvHFgpb z5;uUTDT9*j>hXQ^qq~nEKLXwyq|<}ml@m;`Qh7PM2i!d{B4Q*Ek4y>*4b~JzR8eS9 zOH95ky`D@Ks7;8)cR1J=)SKIcTh8CJQl@v-Q+IX>6=?&}@&~{s0*dpkq00W53Zc=> z*N+=tSHf(uR#b zL0AosMR|B?+;7lqkWpZBbKOr}FNmj#ZBWkq4?j8sq%pVs=2WVfP=l=O{ungw3HF*l7~Y1E5MRQBu9flsz#=U!(kDlqobNtm4)x#QgK8XZ~^iRrGLU11g#L5`~iUh z-R8m`kDT2vhh}?wfxNEzll(a~fT+|bz67K}=|7!HBjq7}8NZx2n3MQPT}oJ4weShH zcXqB+Du0D1Cl?l^736l(GA@SAr?*dTZ*Ldm7kpV+uB)v>BjEo{_Di?^+ua7llZeae z^am2USa1-i$+0Y~t;X^0yx95~9ya#Vr~E6n(ts2vZPc{Ndf~4t4gnz^`5`o#nSB72 zmDy?Q@a5&^Uf&@4#bX#|=Q{3e$3qfgqT<9{0GcaXEMCl9Fv}rcEigIv~RaT-3;)X zS;o2G`Kvbk^Mo34aaAYCguRt3I-mZVD8z@`t9H&fBmfBlFlD<-06KJ6gDtDKrzgT* ze{lZJz^}4WRaq4KugeZF0ueswg8=axpaiHBL;0b%@RDpJg9TK3eVD@aS6qXD0CWl) zc1z;6xxPNr0_=XN(Sm#qT}T_!6vf40NH zyU>b(ifS(c(@|CRlNWqHbvf6V=VJ4yjJ|CVXbdRnWS$@ltG$=x1r#MUbM+AsbE}bF zLoqanh8fEv*w|xyPS>&vL&6#w32HsiUgOTrIsecmxjR>TdwW=|BNyvCRYm2Vfq^fX zth&z-*VoqrXf{{3CkkAP7Mru?lhNCOILxup2L~R_a`QZF*&hfz8!Vb1z*$MWHbHR_ zjPdJ087?LD;!mV#mUy5whD5i`#1~#J=u*?VR4%-7G(;` z<{IxPRLIg=hsH-(&0%I<6)F%0wT(zyly2H*BA%CrcdV?o;TUSRw##cKALHYhbhI;R zD8B(3Z3Xxf;0K3nVTNx{CI9QPwU?y%5AXQWrJ5wM+ z>nd@-kw{KX1^GJeRa0rl)Bn*tB3!GZ%Mk=XFq*jfF~TM?gy z#)|3*jrn?K=6y6YL0-pQI;ScsK%ygARClAuqjB9KJ<6T<@`#-UL*ii*Bn_5_AsLWR= z3|H3xj?iRuCrkL=`dOZ}qEbP==3xAdyZP(a!`YnY=f4mUO-)-T#F39rMn@HAE1YnH zF~#s#IabArGcq_tqV)79*Vh8^{*FfDADj;#@?Ckax98~$?}Weq{J5|AP9=5Q$*~fl zqF=2~&hH>K^=5L@_Zk`mBK>}59^dLmCZ+sW2WL-OR!!Lw`5gWIaVsm97B_)7Q}$(C z^C&VmciThGEq5>hkc6zuY#)Z}pB&qbjwn`?SNv6P{c~59l_Q&ET`bJmDEW8!W3Nyzpm4Z3YWOsGwJDNn3+cN53XULXCZ4D9rpP2;r2&rD&rBm?J+Xkij9b4bz{Ta z)HEDTKu4erSDdR*hi)C)UmV)oi%Kd`nGxrFypz6N_VZUG5x;$G%tq5y@gK+hCCfvp zG9>CPj1(lp7fj@QIi4q7Q&S`s>Yrg?@cl9R1V>=Ff{Jt^GBP0Hl%r!Ef=7 zo!AK=uqDBOT?8Kjo4B~>pTL%1Yec~P)z#UVCniBnF(Tn~hURq5R9Isik+7p<_hci> ze*ZKn!;loo*QS)!mLOkESlAcd(bZn6zQq(IqYZ;qIGoY<^iEInB%|*)K1TyE26O#` zS45}zou|VJ7!B9wX`?uV^-pt+iv-7A<&wBNKS^c&StbbO#B~-zzViYV$sYwiP+MHy zmfPFwc6D&EW~{yoB6{-=FA z$QJ+kEkcejV9)z|{CB^YMh=);V$SwW((X+ASEqp87&z|rzaswUCKlQ)Kp~5b$pyaF z+^l;0=jwku_ex43F(nU8Q?X159-&fR94Z)#{Ek9Ns8LU)a)Z~B=#0&U^?Kr0N46l-ytOfsj^$+ zZ$oJ%4pfJusog{(x{@E5xf9;qQk5L;)YW@a3KvN_AaI+|t-V_n@IbQY}Z7flAkqDjV zIg};~)X63AN~x$s*~dgiex#KLff`lJcK~k(An|(7E^5Cg9u*K!&b5`B8$=>d2WUHd zUw(Di>svYcqQ64$GU~XL^{AZ^H|KXx-k|wZYgm1R{g0QFp7$R2fW&GCkV<|N{^v>P zk|d{&Fw)Y}2k-*yA|B8u)adM^jLg|KmWjD}xVI2v?1PQU&`|6JBJ$Jk%gbN1W>tY? z$w6ji?_|I%=lNs%QP7HYtlvcu-so(4GD=oWz`j6K0lUA5- zTu$op0nA-MCmQ~c^#!B}?46uEztSmpWqDKR6Y0FzjIn{X2j{Ud*@;F4KHPY;Rweia ziQpk8=Q~bw)7-Q)SY?4F7IRBjR8$hXDX=S#hGe(&KUKiu!VfLw_?U=@2$<_VK+CXu z-X|Wc_iYaM>!`|Bsxa&TZ~-yj{Yww#J`7P)NwKxOr*dw0Pm-T$YR1pb&Q>|u0u|rg z*$!7I2_GF14TZ9zBGDy#wQkcqU`j3miE-p&1dr#b`SDg$%>hZTQE}-%$b*+BI$$ED zeY@#=iY{&3pSZt0guWptkjc>^Zf6vJS+lI%1=OEbKkfU+U7eh%w zWJLrpHUM&Zd%|EXrqJi8s2fM$fa>f1UM{Ee6$k5o6u9U>()lZ(N1Rv4Vv&tSsA&mH zO+xKAyxczgBCTrGtB>;U6YdkYX}u`MTyTf3!*@RM`v-c zTa#aPl*ife{Q8C6tR^Zgap9n?J({d?>rqyRBg;&TwX*UzBPsgz2iJR((-G*)z87<% z_EHU)E58sE&t6yAZ|wrwSjB_(PthVnD6}2SJ>z)HNi>ZA4EIH$7Y|(t z_<*A9NIwgxx=+u}m>B!AWbP`ZH)MAvtTBUiE_TFoodMwF_1oVIfY2k%DFh<-4f4G_<0#3tAT1l&Rd`D|{n<1&Ax zwCH;7Y1e#_`J|m_Qc5O*6imWnaUE3i*n6?zih({gRUh^Aj9P{W4#-^0uz@Zw{8qQw zm5z=~n&rU$Y}Jl;(ODZ5!?dL?fQs@Zj!zmGAY$(;URUuqxOIk-j`lYM<|h(4hfWs3 zFlBNwGkG13DUl>xpZy4rj1`?1({}sodKe0N*e}bA7a*2?`ATr}Rpq^_SCTLWw1L1} zzuH?RV2CclmB9R&pcS(jTU~R4x4+;C@Hh@5={BUefOXpbzBL1w8l=4T<-rC0V>#gN z=5l*gQ3Lw}L4kJg+3x!Ns=sHyeVU@P#5BCoQ2&vRcmqAj<`GYE3pL z1CdZHJ}1YVN|(a#$HxFv)29SvrMp2& zy1QGHM!LJ<5Q21fBi-HI-7yd7`^7cikC|&`|2&+t+54$G*1Fe?fk7gf7!c@}%($vz zX_)7xT#%7p3hE>F>s1cuNez1ABClRlKW;K^I&a`Pa3j477)|33z<356PUeKPg9AlX z>gWtiG#XVPPA(zAX}#v6`DA^wBt@lS|7>q`xrJ6TkrfjIqmPW->D_ymvzfNN*%|&8 z4vxB+nHrFUEc^wsT1IA?ZVg{v<1(ug2(NgY+8&xM4atTv> zP6u>XUy^`eQ7KR&Cnrb9B6K>5^vD#6=ac>MY(;xyZEa|N=%M(C7((neoqCFoprU$4 zMO`5(JTX11K%iRXeMQRf1{zI5t~zmi;y>3_`@xeV1jweCsA%4&k0d1ahheLGW(6Qg z@xPKi%A&Z_|0wn|3GE#mck8%FgW>SXKwV|FFD?L z9WY|0k-U5wU=iFtX8i)A)+5sW@tD$-qDUE1^a zKX;}GM;^35@HyUHiG5rbfED=A)y)>LcTI-d$A-5DebQ;^im5f~%k}p?E|1ZS4ItA~ zQ~uuZvGM-dMaAWmlq{ z?8uR|Wqq`QuC1MJrZ$@!X^xDF#aE0NW)`9j>U87?G6}OkzK3H|`KtuO?euuW2ns7# zxw4TA&V%Yvg+ld9_KVf!4mSqk?ZNcz6rNk4dLwM_gCGIi3Bq4*0%<=npfj2M%*9Bz zCW+>GcJ1usI3B}9c34(j?L=WrF*G|mYumZ-WV9nIvm`A|i&*UaG5yEi85uFTl2)+C zApHtTFp&`*6K|%5npM@*#MRZ^nmvmU5KJKgu<-D~{y#78uJ>7OZL%l^K*ekOPxQ@& zfvCrT+o1iSF-9X>7BO+2V&R(u=u2p57M2~52tPbKyR@J+gR$RFZhqXy1Q ze0&+Z!Sq?;zmH-5*I?oQRd|yP0jLil0YP4R zc6M5`l$2aVbjLa2gTbOtR|IkDFh-UrO@8n-@(QEaFc^iz(4I|p(D~ooi0Z(mr-9|Uza^_ z1c(haJ^hINO+CM?Y{?uM$xoaToi2ZN7jh`hXYi(2R8*#n@#2qefeY-4Cwg)}307ui z=9JS5+F~oms*AEq<%e4Ulu~FYFmK$99np;pyYg$3{Ynea8oF-dQ)OjA#A5#~8!d6Z zHgqirW1A6e#_CE}%oz3kr%@9Zy|060eBG*+W#m ze39m<^Y=wT1R+1c6CdyDFLltlwC}asgG|;}AnAFDk)f!_nCtuZJHVdP8vW0@BdCL@ zpFd4rYs;$EJib9PYBr>^GE;dZ@8b;YZ5OD^RM+Wr-#?YvM|?BZ1o6IfT$Kdy1>l8e zWoI5=eg~AeQTh=wD9Def0<*VYDjsg~t-lZu7*zzB*eJrkOTs?s7#IG(#U?L`Y`S;_ zJIYu3Thf^})ruV)Wvr|)*{01&g3S%JzR0P5_;9ndQRFTnD%v$6jye7**8F`gIbekp zE9Ik7j3fLHpo-A`#Qkcg^-xw;C{e&JF4pl(e5lDGFOn)q}8jz22Z!KJ`UNP58JoQMatehAt zA8qkb*WDL{Y1qHud(bbSA_qp+c&xw$`^M@|)I5j}Zwx2#y~(u!FFCEK&dI*U>2$5> zhhX>fW-CxE3&PikH^~!Ofx8=n1X&V^HWvq$v@Q$W!5}p}=e}TZaJ&v;M8JC>HWKu) z*c(`^sVb33y0VCZ+r`z!Xhmv!y7R6_^i+&S8@KV1%>w~7)}k( zgc6^<3}Uu7xbOGlQ>ick#i{Io0JIfn_0>IChI$|LZCqPj_3`vhbN?c9-N*YpPi9WF3i-s(vXuYsNO*a z=Vxm69rx#+$+$UuZp|59cRJgWctTHibaYe+|0o?(4|P-$eshtrAlt%ds(v?fd+qbA zP?b}ZVGgJXe9QKTids86JKIhCz+|rOetXrM-XY<}oay1ADJS=HBMAlnBdNtzsX2fd zCU@9};zL5@T(w^MloJTLXq%a30Spuaa7#K@t!z(iaGW@hB%@APC%d~tecRGJh1 z0^x(jO)^~>qnot)omtAa`?&{Y?$b{Ii+5ZtZaBxexo!*vWlcWireg)Su>#TSR%CwU zLCMUvr(5v<#g@k)2&=s*bH+LD#e_i)@m=ias*nwgj*Wa!eaIfH)YWytmMov@6{b{h z>IkAjq&UXzno8e@;DZRa=X1gPo#5hFWYAN{zF|PCf_d_3CtMYp>j`Meo1m69ATvDj@0g#y5bP zI&~Elm1Z5l1WZj`>^*prhq}6ISN=;74yPOKV0cKW=6*_WEd1$(xs>k557Sc{n?{Dl zMiEC2&|ds7!eon~pGFi#_?2@4MA@FXssWihgltl}_(ZT2-5SC={7cJBb@hxg^3vtM zbQ5UvY4Gc=u862Z$}*M5`}*z^YP!*0VJHP@V`7d=?DnhGxApxYse5*1LxLG#Fzj*=1#UNke~a z<)fV3iEWvRGN{7659^R=)>j(_eV0f+@hE+^(GmOpG*M4ai{8b8t3jUzKW)1bG{6O;1S0ib(=&fokxlnXRz)bSLGlJw6>C5ak{E6Q{_QO!w+~9G<}tZo5Q6Hwg2rsNvJli4G;YR~fliJPI|(Ri;=6w(G;RT=IBPptu{}`cfGi)1FgKUe4L(9ytc~JM?t! z>~M@42a$M%cQ&k4_|;J)tl?rFV(d2D<^fT}fmp^SI=Cbx(GflQpAw$K6P_4qrU;ID z*YfZ^<9J80P4FiNb<#doc@o1YH*LnV2qPq#dClTg=KT>WoLKV8nOK&#K07?4^Maagwf}3>(lh$VYx}PQyqC zJ6%{JBKCMsD=;fk7OglH?)0>Cj&K$4 zVO6dXVdhInH$25w77AntArRa;5C{8p<)lfoV<-Qi0^1!W6EouA>N~H9QnF&NgENi5 zsWTBQEX(Dkm(JU?Z+wwW8w(@tQX0{p;XuThW(ZPd(B_zHI=c0F)$6M;I9O?^1;o`Y zUJ(O@*=(Ccnm*-GSwT@z*^=C9=H2I;$G?5w8wW%YwtX}Q7^PuUXsq?>nCl>07=8Jc z7BUQ?N#SZWuP&-?F71FL6GV7bh?s;#`t#PZZ;-9OITV83+MQS)`!<6hNbc1W#={y$s{=lNWbTC zR86FwAyRx$~GS)scBgZbPrhQC- z)0vyq{RWz8G>0|<&>=WKNXXBv5zL^BGKvm&=LE$0i%1Lmk>*0|ef$spc*3B-gI9tA zq2l*Pn3bC4G%%<SeZa~a#A}=k?!=7QdIs)vYu!dyz!tN|JSYU67prIEf z^6fMqA-S9FN63FRVBnRAKvsNSN&bwpMs_Y7DuwoujCoBx^HriZ+axT2iu5&lY~sIyNf-&I?CLmv(0(3l((?FiGr zaMkvur`VehNM?p+TZ4aYCyxjGVY`QVl*9uqukQ$Qb3m{H*otCeTHT#eYN`o`eA!G^An@jC293NoD*8I%v|&cCws^%^b2B+@CV-> z9EV_0H44HYI7Ws>E)VrJ75xef3&R)wL`z#zIDe|8`wGXnd-;$?tzo*Q&U)WW?XR(9 z+H=S(ic@Doa7O)Am`w-KI4>?f>e)$9ImhwaBYGPVIeUJzJJMv?o-s&EOWW1M^u&Xv z#?I1AZqctWmTdh6NadqnkWi85n~LC1&BLR^ODc?SZ*-aeI#h6v*&d^>4cM8PwFjLs{q~NX zf=<{Ni$Gkp3oUMjbDJc!px_6t43e?rndpFj2Z`4jG679cb^aixOd*Q0R4Vkj4l`up>QL@W4pe7{0md{|Ge4h>FY^ZkbU4g;mS!% z9}*KOg9P1UczR*diP$$1F^=N$;=!ur0w%}mn$9xo<0*6@CMPd%U0ebPEMymO18LYG z16j3`091)WbCji}rInRqxpDueHok~}fPgySAu2>A2#JadlXudjEP$94)Q%_Jfc(6o z=2Z0+xo0&i_OHi(jq@XcZaFFf1=Ug}42kq2;h+TzDkTeS`yDX_#>Y2?k^wqC56cf+ z-$wWV#8~!`He%p$_`ye`AUzbsT6)jrZ2x4U^|a&34gTrKY$8VH_Zn~o-cG)!)oBcY zpZNBv{ki@7J&8drsySZK+1XjG`)G9-!}u&iLuF7*QEYW2aU@~2Z@)iRb$`3Qzh~B) zarQ5E=Y}@;k*>KpkZM{}ZYtI*CUibxh-_VKE$ri+#X5_L6Mb;u*WcnJ`8d?zkwU&f z2|gPtP>c6^z2@gk)zeF6Em9oqGF5I$wQz`Y&7OJpnm_<)na~z@^L}{#{-=b97yZowRrKoLMM8gU_ct<44D;?)pkbwmt}|_uG3_M)Zw< z#MSO}MJ&_4^S>ajp8b^tJqi%#0vaC~KY~E+8|0-9Cz_j^4}3d2Hw=bM4Gav7wZ)zC z67|JQcAB0EPMW-nZEbIN+KTWqoh}7(Bv^lk9_ql6=UY0Dg_Vs`gIi$b_;8EsYIi2; zP`+}>U0E_$a=*Q;?PRTEOBfLaFK>%ZfBEl}1t2Q1GzX}dcg2g@9?!1Ss$C*aj0_-> zvGl32@f1ESem{L@D(Mvp*+x844f^1KumHKW^nJ)g(^ck=!Q`(*Xo z>oa3S%bbh=Akl`SVj@~+D z3A-~dQAM-)DlWSnhy>OYtuke?!pR4n{OJoAZH`$r9FDWy>6&Z|!QI~YMzxyrtZaQi z*|*+_2_pw)!7B0;7hw#1(Xv6QSzrXV_O2>?Ze(4its8V{6;;cxik(QQwbiMEHb~?($*`IWK zu}sTH;A*)qoNXLRgPDn8X0A%HJi(Fo~|(OKz?<$$M)vk+r!fYWl=O5Kv871I{7SQ z@jmtkVDOf0>zQd5%=5D6cE0bWv2VhQ<8We*@NFnZ)m7>B2pOv(Ld_Rh1l9C|&zS=4<&65@bF;hM~OA0l?3iBycR>NGzt6Iy2m zq6o9H_kU3hC@3&@yj}tVuVDkaG^$6%if)>DbLoR{-3iiBC#EN>E16AimuZHukg-}8 zEfNwxWR_!-i

4C*A$DAtfh`iH*Iys)vN&e)=>yH6=1*tgjy*5g}&3zP5UK#lAoG zD+d^jkUnR|cwQYk=!e`9x&XcDdV0mMDK8^~L_!J> zgz4E7Omq&L4G4R$1q71o{#`vVQ__$w6^oo3^|9{q}`r zdbU_>CAT6Q8Ck3+oqFBPfy5-8em{+JEw{Wp=oEOBo$Q|TfuYj<9uKAoZew2m>ZFTI znCu>#%@HJP50#L93P}PMTfdNmNT!j*S+(%#$z(vx#01~VGbsmg%EwV{jP^-2+z{hI z_2f;BtaBCkV(Pz9Ht2gy9K!LlN##zCX z{`)JaQ^a6M=aC=8WB&tGhN2`{oja!*(*gb_!CjZ%ODF zKM}XI75ct-xXlG`3h*Sk(@zc-!)xsK^GGQsCnhD58Cgi!)|*;7{*F&H>=WPwk?ri7 z2nM4Yn(L>hriLaa-k#6bByqT>=H{|GkI{pZ2EffoW?fa*zirve{>ueK2jOsK7BsQg zeCmj;fG)B- zTf)_l(pXZZFKzh=o!P196(7M5DwXm!62dBGHUmTBt|Y&Lg0m?G3Nxo!0QRsi~>O zw-w0YVZ!HiHRqci)l*Y`eq@@9Z!@kh0~AO5bhz)`K7A?@4Em7ne1GMQZa?@)PCYs>f$W*=;p@_4+tCofH|4`ieudjfYCv>=R7>-VtRawOl5FiRFppca? z!W=FR4$tTN$A?E@5MToR{hclj{B~l2y|1ZcPGoadwMr@S`-HV1BqEk;YxBct{)LZs zl-{|ST2g}p9zxv1I6=9@zF7c{nb!SX3my+%`B^zQQqu(xI4qBP{E)L}Oux<@<&ypGKTP``M_meF5do)|jKXTqqyPNUT9lJc-SB%aPbA;vK~A0v zICo3xmY5$TU6W1k*MofzAV3cEuUDr*{v5c|8O|rI(Jn$ABZlF?1r&e!A%l&OFv3Mh za9e>YidrqBZ*gU9)zVQFUfkA+Tulwj))rwF3mI)5G{689{iPvd_LbYjr_x6af z*%**uYiS$v6Qj5@8yWrGMEdXy55q7pHuj~&h((3RCJYV+252KeZGJ6MvaU}m+qk~W zi1)-SH@l6OsI?wXG8`sOX14TIX`U_FmpXojeR7bHFhlgmErHhXW-0Uah@9Lq@)BK% zRV8~8JH>Cq;r(=hU;t`(CMB6k*zMIcrUb^9udJg9i6+$}iFqv8hq1}Q6E^UX;|6FA#433A{e!Nl!ANJ+n>;J>Y+JNFHh5e&x zgzlr1>@q1CMad+y%xy?f|To0gXL{ie1wLMK&9h^MZ}iw%mKCGN`?Vvvu#ykzHW zAZ5e+k5lj-?nRY;R$A`bNU5@mn4Fy*BlPJraI$?vEVVfWg*9}vw13B=n%gYKvPyMG zT2(dQ_-pIe;$m9MGG&^Fn42429Iy;b6L0?2#-?D0h>ELmxWdDW!)`r!IFIn*UJSSP zq@|>MdkmZ)OpceAdQl2+FMfQlempvSgX-Pf)Uh82Ose0?+S>N?gbZT*up0|)lU)t!+DL$$&3~j(DF)!M;JJ{}RHV8dL-QfC059}VZ zY_!<&mifcXM-ixkeO!Srjp{W*64TmN%R7py%51Ta5< z0`QOpDb{Md<`jSb042(?qt*FfOg53bOG?#``_b^mn!RoI`(Ux+4^cEAt51@z{ktmo6Gr5`jlCr@G|ya1ba~ne4T|0c2`c9i3Pph zxU1`iOdrBlk^<$Lq%IwhKB|??M!-Q|2yyxBm7c|@+x@&kuK-l_rD`sY7pS}M97n)a z6c@+Q8rBB>LRE$&&rf63*sZUvgf4Eosbe8y0_Ne;<|6T%0}xwHHr#&%^pkWzd=h;T z7aw0TnZMqz5tag1S7~SZ1s;cGq_vZohUSP?c-Lkyo2D$L3V5`z@>~EWYmt_%bGSvA&CANAwLA%VJ#IEWkCZps zU7}2f*1_Q;DS~CJWx`x(eqIu7PMn<~ot&;L+g|H%y5^+;HTrFI*iFmGgxS|*MwBUB zcH3>4bz(B)nZoJZRpi)>}T{Uf;fe(6@=jaZBvl&U7qa9oT)>^}Sm@ zpSw(-*U!I?l+x4DA?NPpt5%75^j;nBV`*x>&A8!d{-BfczZqE=bvSfdi{4z+fckrn zd?@tkDp?;spL-6Ag^-f)mWufs8b;zh5Xt{iDchLMyKWa(;p1ze?Cn*XjUPIGIAs;B z^{{WxGYa=*tz}DqXgAQ|c3dxTMQM!Y5#^gLi51lWik^*4AXWnLqkJza`xBOey(r<#j|M0$iS!+ZNyAe zUU)X#%^4c$Ev;;DOY$RWH0(ttCLXu0PsUd~K@i{R;>J=-1dUCAWqgN<3hm>a#AzEO z!LGHk0JyyKm5YF4cT0@B0DPlryKS*2+;yKAX{Ds4gM9tpA{Lc@3=EXaxRc%IZKkO! zlzs{?%Qqou8*fJ9ubSvZf^!!WZmukIxzSWizgE<79=6HQUG($B9bAOKmpV1-*7dHGwTeFgyt>)1oY3Nn9* zvjUZGM$P6JuKS6b?s+aw>chd7jui^uELvJSgCU*P1H7=3q49CiwmQ{|T8Qa7MVU7C7^!Bud~Dbqj&62qLPCFBudS@= z>aI>qD&^+n>a4DCo;Zev#E40PK8M3Yzj9JNu*n92+8cjcdpN&b88Ktj8h}_Yp}lMh z)4qQXO}*=7LzIt*Bo0Eqx>=2nzQe(eFxZ^zNsm2VTwaF_@E0x&NUzH)`N1k!_Pdgq znzQS=i|%T!669GY7N42TxV?FcB`Rs4r^WtTQt`-EMuwl{dGTG9qvIyJ@>#jUhoGt1 zmz=4K(qYE(i*Hej71Y?uKQVlwB&GEK8T3oanA^@wE-STQE=TP(2Nocpfdu&O?TX`< zFWwv5%#-#;(??gP`<)xbB{Kt0I7UZDf|BcGnpZJ4wpk~X!yQ6EA39A_E@Bu* z#_!JNnT$w5Ix2Bn>|~(*ZFin3DQyYEQRNdKkQ4euxG<%$ud~PP@X8c`k0XV$=|6RS zbJBa$^jA`(REoxcbWb5OiS)_xZte1@Y!ajZVes^9>tXE6^rvi{lBs_CCc zvto9q9RLqG7eXF>8PYPmZ~7)NKSwq^$W&#A!^M9G=_F)~Y9@}AangAu;%7eOCXjsR zhL-WuWZthH@vcR&{pnOq>B70^BE1w>hZS_uX60scJu^Mb6m09_+#kDeiu=yWqgbcD z5T5U`ACNh?|9q%i)noPr;Yv%;3pJm7& zjhvQb4(B4b7UG=r=WzL6YNiJ z`257Begbxf$F&A@pPP5T>6vUQm#v8c&@$kMzzBEM_umRR`hEUXT+Clc-QCk&Wp%86 zudep=M@tKVwuq0;ARS)QTY1#g?TXsh0sd3vM;`|A{=^0_4bhbdebtgmHcPWwc-=5l z`&34qc4Qcp#;JLuiQkJKkRsk77SS`ogubFyQi%f;!5GiaGFe2cE+j8ix}bd0>)_Fa z1esJ5K}mGtbUVLqb7Hiq>UQ@dB=9eBN@18%Izw z!Q!()n(rP-2xN=lJ#w1aa z#o>fSK*;3eRTZlRO=+rf3{70B$m@YX8W0ATm60K*rjBwqBkRi1@AuD*1(hl|EVbiZ zU7L$79hR0bduC>@EE?CvJ$mc!Hk4Hj7ei(wljv_4(5`cX==QVM<&C`AJDbs!&pkd5LxgMF3;zBc?GrS}f zK6N;Lap=TN(IX=#^&D*R?=ia}tkQVM1#{IJi)-a_S?%5{)@|GBVkS@P^1*oo$;*?r zS`k>SDl^{YsmCI78H%J4lD3%f_2`{d-RC?ZOFTP-;N3de8sATxXA08k%S@q-zrzc~ zvg{4=g~a%FPT)Or3fmz#@7na}7V+1oR;MAo6<8r=f$0umud+PX++-EBX3n)^d>8g4 zXyLbS^e9+6Hu9VWMxaO(=^#XC`OV1FSZi{nSE8`fuMZt#ad4^yC;yw?0x5O`4$@=k2>Mmtce`^}Z&X^~SL}MXt%~9_i=%g+7^7)TpI4Hm_;MBN!a}8PcjS zqncQo%)Wf+kkJqufE?U`h!BW7OGy5i7f(mGS%lADN5#5|T~blsirJT9r;|7qRR&pZ z;_}*NgHRip%XyO~=_4UKEgMt+XpXS_69iiQWc|X;U2LrAkG3-w&X{@H`qanJY47nb zg9sCHArK`QnTJN0++-l&s7@X$0Iv4V)GzD#dfl=a;SM0}wBl#>H*Ff=Y;A4L*V5cp z2hu?Z@bJl8?t315f^C66og8PYYz}E*EGSiqH-MsA>f+*9rYM)?jg6VQy8P>{q0IES zxT)EiIpD(e#@Cc6<+lz|41(&weDyMytq2&VS~C(NVrM4@<{D<-cyZ_p_K@qMrL<_s zr-c(ZaRi^-)Y6|~)$AG~@1tXMbg7M`nF%O-{wxEU4>c)0K0SUlukc!@-|MitF@-fk z1pIexw^z92iBZ!MEe)NCX)^`-3j*?H;t`6#Hjc(lACn=T%W%_E=t zpaj1-MOA(i6j5DTj0{lE7!g@Qv$6T{4msYySeK_O6f-gw9WzuW?X$4FQ1@KaK63b? z`Z+fI=DhaTTaQSTl5RX6WlnzaJsDRQOwb zN+BkRdejI4FPy^A@qg$j2+dXy*}LUdi|6+((%ajAVjNLihlI|HIN`?kX7SOXhL~a; za>5DfDapwt#Dwt*GC_uz$%v*5N5f@@AFBIFAI!UA^QyO}cWAH_Zi@DY@q*cuZA-a7 z%`+|l%UhabGJoo(dK#|t-FDkOk=C#oBy|RdN2$muSuGA;5g92H*mo7y|?fD($t9s|g_htcpp zaZ#^a-G6p`>4Lh7!Sq5^u71l|lP5JUmz;>)cP+8bro>d#-YT!$R1{HW=r!>3!b#tV z;7flq@N4v_41Id|#%jFUltQxDNsRbUPiyBozp_ViI`J0;9_cC((B6W7#g3H-$Isz8 zgX50W*>%|TDyF^G@}FP7{BuRXSJ)Pzy`WLo6y(k1QZh0iDUEiPr6f3Ai!OfcG%~Vu zR@TQ13?s=6E(DXL0v(K0R8(Sf&%IaH!za;5$;i((hSZg{T2Mtj^&B$sypgCSt=^hI zD^!`|g*xlp3a7@&8YZqPFT(m|mjA{Dr&QQ`(T1KH&+A1@m;@7YY9M>d++OdM;N zj#l^^4KC?V1PZWnvVKFD$%*^Acu*D$w9GT}Gfo(P=X<>k%7wi|&%``U8C*oQtx6AB z%Ez@#NWFFT_c5PWe3u_RbE#{th2*k1U-LTn4?L`2CqaDq?}?d_f!Wbm(C^bx#!W}` z^UG$R4&F=NCyMxm8#CHPmUw_+aqz?q4KonHqpv-AtwKxP=kXke?#ovZk8;>uZY~U$ z%#i*}oQsihpzcLFfM2rKem^c@wHXg@{&AyP>_BAuMh%Oc+=k=qolX|)pB zR%UlRBd4lUr6aXz^%Rqc+Os_`V)k8F+Y%auE)J+aLBz!gOMbUTysN@6F1J2I;Yyy( zt3vnO&j4<3yrs3XF~`qT#HhNGN(QO#jn@Yy%EPR6h+l5OK+{_!M>KdXmkIZ_A{M_< z(rsM9r8eUVio)!b2Zv~T)6m%1NVVEcQFZ-~l!nhkwxaq6l%RI8e*Y6#C=A5vI9AcL z&d;zOgkoK}a=u6$(A=;P-E)6*y>zgrD|C0slTZQrojD)TlrMwhC z@)LmV2Hk{04uoE^VOn)?Qql^jb|gj22p#sfPx0QU{`ge}T{WHX+Gl%~w6G&!fyt-L35;p}!@D2nLDL6-umA4^?=aKds=ETKcxxmxfHR`E@A3}7;@ z9pBh`p%r(|sWZqsa^>K1&`~gPC7amf6z*$E!Qm-4oDaemFaCr-fekPk@RTj{_ZQ`D zPW!NHD(vtrY-|ipzFH&n)MU6hu{C#tn9cyWn}icO=EkSg8I%cvNB;R#iHaw(*k9td zmK3Z`Z1ZL+x)wjsbResM_$rlkog-B zW@d!YO6n;@MOGPFiC|RGiB)g1b*W-EfMB&>-JcwVc|yf{M9ysHT^XAYtgW~S6@m7W z5PJA$BK9~I)OVn@=}3;gBf}3XHYhB>GMjad zhzcDY8JwGIFXoNQwfccH+Ie7OzU6SS;)rC2R~PK65ri>i-!lMWmX_fmx~@bgiq~|U z8W!iNh*i7ub+Rfl7Or<&@WPJwspkC!SX$c18|}nhtjrVBFT4aSs@O>c*|Lf4Mmmbh ziaWdeh;Vd?yzG9lx8SF>^*RcL6*Ujl&*p(R32tNdG*bgt#l!S7?EKUh#kxKDnz|Lm zQ8#=)Pa14?x4CS=4sddL@%z_Dd%x&tA7aO6jRL*s)W@s6;`QmGqwk*RK-buqw2_*6 zFE7Jm4TS5w^+O9u7f=)of8M4Z#n`T#`U}0tzDW~nsuWlA6%zbg#Gn3t0YTyhv(1T~ z$Nr)YQ(rK2f}Ji|zj5w$nsL`lbd*z>&%29#rzbo&~ww&1RnUd zJvM}#BHRT~@d2m;m9mEmcuZ0nAYM0{bDWrIDbtV?eHUQ6)1xaBSM9nlJUy0_;RzbG z94vGlSL}ZdgeD{k|E>V~In&09g{^h>I@?@QQIPm(eH4n}la;N5{AR{uS)FUij+~dz z0Wu%{?mEg#c&Hd;ZwTo6d%EAf@q|$7@9o9LDqQ z)+fL3bg*QGX$$7huqU!HPv2r+v7g%jfO3$G@*x?NnVbO;Yll_5v(w>_Ol$xdp#bc} z>Eg-!p8SN2h~jJ+9dnvX`Lbj=?lt$tt=)2}+4veJd1;02zAgejt>w?Z@-njYL(-h- z^nId|3fMWhK9bTiPz{4xhbx24O=S>$0~VvsImog&t{i`NdoAWwuGh-joG$c@fSz4s z299L+ipsqB*L3-boV0vjKh1&b*%S?~5c}B_)jl=W7f{R*ZS&HLzupyXYo;~o>J`}3 zT{u=D-bc9#WJqlhgVcnV==`z0Ju(exSlx6#3V>9xPZL!Qhfii z036{eNA=NnLUH)Mn8jz8C7M4g(LY;Zf1J4*VCL_wN>j?xCS4}VDT zN{G9pMsA1zUt)Sr>Rj_|SxO4&$LITWPeZ$}g`Y)hNL6az7r{O|wY42#Hu}Y`N|2`Y zb{4$)MHt=#Q;*-GwBpcUEg>w*ZF?_0*hCj9g~xDwN>)RXgc@)2Zdv~U*K=t)@b#wz z@YjOul@`vU_6}eVVN2&A+76GffG<2;jqa}=0QASp;N;=he7pcO^Z)GQH;ac34*l;Q ze&q6Wr8r#GMMi4;;Wlr`$SHM7CLaMtZVrOz#FeG+e<+iX8xMB4pDg~vk4D(6CS#M6 z1p#0*$`18S$Vmj&r{$4f3bln^wIe1foRw1W@XomSD6q@gX`>?}e}OP3K5FJ=tu#`| z%LjBSqN}g3TTGIVq1Il1f;&GDDAJp_Fo-+e+UD>x{*Y966Dk(rK21q{}H|UYcc7!ehiqoA`~^H zFVws(>N6MCwK3^%c*%buqYF=PXEZo@V}76gSR*|EHh6j-qx1^?E@Kzrt$=xr|KDAq z3;lkfiQNYInl+*Y9!&PbK1C6!jn{1wN>{L#`#z7|K6YOX4rW=0g6;VuZt+yxSHEMRxRW zl{wUf9C$)!v2qOPgEnpQt$(mxGHjgx3iVCo&4Pgi z9DVGHbys#sklCAzWy`N!Cv)UZ7(Yutq$V5>j(&Ballqld^1TRw0`JE?Yr^_zZj4(W ze>-W~kAUXdCZl&RC>eAGtg;rGro+VbkB$RY)TsZyaAP*$o&5-pq*-`PYAR8c?IT1J zEGaOG+x^?MAgh4&_@pHbqQeKL@1n8VBFBWx>2C=yO5o9F^0Cu!FKWT;TM-!;aN3x}f8BgU?8ERTSDz>&78m0rS9PF3Zs9>Q|LJeN6%iAL8 zk8CVr@0qRa#Kk3Gd_cOoDBAy{SO^*c8I2qOnrlz|IS1HT$*_PK7+QsW+;Nx?C5|E= z`MD0dEyCQQD=ys;W|JYWRk{aNz5_Se6b)A4r#$93|LS=7rK($GIzAHr@{H*OlX{d; zU&r82@roBu4;<;}hvrYVL8l1Y+iFFi8VD4|Vq?2v1_^*hPvd$t+w%wH`ASYpOB)fJ zxm&LU4jvwG^|K{nC(6aQM~%k;@e5x48B5{a?;U4xs@{0@3S?xYD%GUSOfT;!(8&)f z84F~>5>j^~#>Au)zXrr%1PY_xo~dkC6A7v!~zRc ziAaUaxjJXADsGZl1qB6J;=qccGA-IzH#c+povFll0;5m*H=adFdj-MR*Jr!4vVrMm zYvKz9v(5ndct;(xzBU%&;&i?z5k?i$KuF8_rTq(_p$g6E)w(UO(O|k^FsIA|fo3wO zZ{EM~5)>y*?2unxgOC~^p8SZR>^c8uS~N%Z%!tj=h~JqVBixIYd-29ex^)8l^bOks z*Q+$ab806irxx$vNLC-v2PO!MF05x|W^#FDzy6sIjan^8Byw}`eM{Fo{H=RWE6+hB zdeGo*bwj{Ke>&L{SLa&LzJ|Uf-F3qxJ=#zxFCJU8OA+{*lOMV*&BD8Y)mj7*wLwT- z!b7T^bf{+4gj3mL_)nP-A^%O>!~*l(;(4L!lMB@%B}zrb^*@RQ!s=egZEeMA{?*k} z#^d?8_R!}z%%2O!ec;e5^+x^q=kIaf_-?7hs>E!+@GAIHBcT>ax9(m7RFuxI#~R$G zk9?}DtAFN>6a%_+y(98Kn%7IfBN=F92stJX?f@A)3o9e5?Xkpek4V%%(IIcT_8ace zagqnBi~%25wcOy4wzye`f$`=le14nBcr0JCztaG;ZNu>4ljI%4BOow7ojPSvW|8k* zyt1YFzesz_s3_yE?OQ=W8cAu91_9|Fy1N^cZloI&5Ts$~?k)l8ZibX@hVHJRc~7tF zzSnx!^L%{x;99y^aGvAL`QQ84$3A`lQ%fKh?$uc+@T~Y=OsCp0K1sKsYT^e8V|n2~ zL3WE+jdAsi#E|)WIuHRq5G9eI?k=JLFmQ}ZDZe>plBqs99ebWfl_Atfz1t-tC^ARg zLDx)M&`Jmr1+ya*wT5$L(A#9fud$n38_V0{1&2sYTb90ldg$xzCF6C9IC(le&7f5z zadL8b`_@M)l)>nqT{(-)^)%DHDs!czIVL`SYkeJf>T=kk@3uDE%(XAn7LkMg&~kAx zgFxpyqk1A;6s8{GJ7kHP_``nM5=bEC^p2zblhr!8q|E^(fPvER`}eou)1^HXsxK70 zJ$6gakkR2dK_uW91MvbMsF+H7S(@e%PN~a{g1WkQNi_3L%>I4v>&7a>469^K$HQ2% z-3*zivWOyc1<}?(XoI=0+CPi_po^fzng$Z?jE#>rHpJ(I@c|cQAxrNRusr{A!H?r3rxn({HHtC#VD3=vx*6>*2Jz zkMYN*7)~~}Tx$SOPH@O=3+9v6e*P(rhNwaNUn@0mEx{Ec8CsqKhTp!?-KB$k-2inP zAi@ZG+$Jka|Buc3zNWOeV`$rndU7xon1T8j|1++75y@Y`b|EAS5a58ueKpPbL--7! z)Bq7bUP2x*;Ky}GN5Fwh7#%*)+Xp*YP;g5fYNVzfStJ{{ajV~2-I*17&IMAU>JhyS z6=W1FYIT4J7}g0^AklXL!g^+){FCDx8JU#-k43e%Dx;&1_EPC?C(}Ax2_K3r{HyOi zKxH62OFG`NrT6K<@J*A-8abrkRW=z3-(yus$WkKIugz_Rk&gkG7tBK-)oKGbMx%H2 zrKrn*;Xe-b+)NH12xnyD5LjLusYn(xsrMch@7-~n0_jpV3?_a>eh7}Ox{eg$45y-h1KOJr9 zTx)Xf;PW^eWEApu#VGQIRf>poJwH2C={L=mX+SYn6D!Nz5qXt~SXsAg>v^>n%zytc6E`m{?di<$T!BqylX2f7 zB(A^0unkCO5@h1Eo7$;RB`}yF$pm@7!y)$G>m);|3Pk|w&;O%MoV8>~z#yQ1m0jE& z5@;Q7D5WICz!9%fmdG$9M9<{nu)y%~Q~ZAl!CU?L|FmxLV2{VhuFkw~+u5A|*(V1I zxqn?!v3CF%4P`An1pdGEFNpdL&q3w~7BJlH#=7u-s=e<@$giWCX$Pg6FkT`3x4QIE z{Z}Q6)Fdf?Ps-^eP#9#yqJsX@Er2f&-oKyln=Y2vHv;Z9z%efxB^>xGbYrCj zczyh|E=7)A_`rtV!m9BpxpW6j0v%<|nd%ed9d2(Jh`s^AvrBz*;LGQ0G_>hy9sp=% z%QY7F>dXvi@cLttxkw>qZQ?qa>K4h%{J1{`DPVpq25z*`x65SKosGXb8I;BVwS) z4AxlLt5>Qs_pK;1qW}Ea;!;LJLM+j6K>ZJx9wASXrNRFy%VOE%u`*?*f38t+9&3`< zi*4|)VkH0LeJlaqy?C#(8S40}MC(c&Ot0kZ_jPXp=j8RN2}Z*O&g{;hhN|Y6u}ltFuS zw#^`@HSFxv5BwToW~VHzzR+Rx?Cg*Kj>!LhMUws3V-Ec7@7})_`TzN!tLZH}0oTaS z|Lwd6fi^I(Cx-V;*Z)Wa--rG^1mCmW|J)9Skna?eFpK^;2UYiA}-uz5G zAyakZzr)azRKSLR<sjAf^{uQrWu}^P{i3)mX&-$7lA?Q}O}dL`vxx&Tv_R5juH| z;8!8Ib#K4DrKbrj8T|5_9x+bk{=$HQIy(q1Cx#X`9{BKHhnJD8+@6((DYsq@MLB+E zP}KGdPMCag4+0mKnG>;7FW=zl)*V!IPMhoBURP|H-UA07XwkMnnY|zTC&C z2-qW6F|>Wa9JzK%?Y7nUHFr4n#V}Ku z{`b7nLXmyuP#e_!*BA>E=%vg0W+XVAjWi_+Cgk0+Wj{7A!~glPg?mDPTN$8m7pyv2 zq^ekn+_+*Sc5rA*&5%;zyFs+O_w*C&*Vh^%@p**1A27NP~WzE%aL)Fsx%hupGoS%%CZ`=;moMmr>e|ulehg@dZw51Y5Se| zSWCe2QFp8DYZk3RmRw*`&oI~Fp>zSk^@Jy>VF-NGDz#O5Gq6kW?{WM+7!Vb|M^ELJ zY>u|+Q58r!ZJkH}*Bwpj6)G)Ff*UtcZ9OLUNWmpZfK)w2PRW+;|L& zDSeB)s`5lw+lAfNp)>~CHRsDb@|ftbuk3kIa*dvueSRSvt{OE{DR4DXiTykvW4qFo z65_R=2x98vveNEtMo*K>h#3FYpl-o?#6$%&n=|i?V(=A6OW)_^pDgIKm8a$9iYHJN zCjDZ7lg>g${#NYB!|==A2Z;R&4VI+I{~VW<#KQSnY|uLIqN6#?9?MjdNxcv{3jJW3 z?G>e;j5`?JWzJw7mP;JAcyFL}jtZt6R|Mm&~pk$bwKbWjavAIi$g$f?c6lw^yT zYkLx^|K!dd^y$s#%c3*xq9qAO;%2!`*(5J7jMvH)kDR!w<#Iw-Xf@5 zcIQ23sfskh5xoV@C?g`^U5Fn(y1SW(!NJ2*H59rW#4=d*?CE!FYnv=2S8<@#!?1AU zlEu0>J7qXp6Y5!JzIZTsxah2|9tFK(9vWw1W-eS4>LOq$E5#+yD35R$a&pK4DDOyK zC~j8EYx=Jld^G+oriFKDT2$j{aJo(lcF;@v#NOD_YA}|x`!g03TGpkjtu^E|7Jo0w zR&=Ztion;LX|$XXV^CBtiS~QUlO^{)r|=OXXbKecz(ycqr8J?$!{c;xkdblp(I-JT zvtmst$FIzI)tf&k+_DX`?7m4xD^&1r}`YJn5n|m6VK<^xx+fnkg$g zsPkGc>MlZLWCX~f1I9y|6D^dMt`fLkRHk(&j0_gp8HQw0WMyS}7j$qRrDQ#*iL6r> z@PbhYGl$|zyf$+L=s~A=2s0wz#XxBIaRuciHl18YAFyy~mvtn3gMz$;bkGGmKiih+ zI0>;csdQ2%$@<*EqvI{^;kLgFXAilCZeoC^22;uNQqQ;JSWSz-AXV)?s$U+1QW6?7 zO(kW8iG|7^-uOoiW&Q^>K|3TK~&CkaT==fA^zyaRNlPTbJcCo;Y zLd1oD@Y6V0|0j!|jLcUTOHE{I&dzmmqLSi#eN}bQE`MNVrad9t)GbWh$E<6MTDrPN zr>#Tp60rfw7N&W_v(^2@S$(F?1FpV(xbqB$lKw}$bW;G^K>ejD6RMVi+63y4n$1AA zyr-Tv%*!w*MjE`c4F{$MLO&kXo!HV;bF!+KjqR9UB083$bY8|1UJ4jFSFrLhq|d#O z_cb4hC&dVzBnhcD8S4CyD*kZye;lG9mWpI|Ul&#F$H(+MJoP_16PaXn+t?}`1qn

P(^)`B(3p3drQ&37OW?j#$8t`Lneg_8ip<>bPz6$cA z0KD&X^}@^Jl#DkgZcnl$iWCU<{hQ;wyEIo767)t**ya%T?x=5}=c%!><1fYdORvKRh~^ziCBfVrB+h;jM0$hVq}-j!l{x zxrhaPf@*3eDIHFG^Me4R5t9L_R8nD&WR(3%{mKM9l9N*ny=5_<>wb22A+xW(qw(}i zQoIxpm*{F3KNsG^qQlJSQYQVt#gjg2ydL@cg#vtMilhF1Uc8z>V>~_np0ZN~D4T)* z5{A-m9CU$PO)9Ic`t+lB?>UcWZRefv6yVRX%m!|PqmG%D(ENR!G-UtwpzJp-On5qi zY&Y>`t;R1e*?#7J52X{PPulkbR0k6oXLnj$x+|5!alWeg(xouZ8{Q96WG z5chO{e15i(ij$&yuSQ1&Qz*x+cm`c%g6|m*YzQ=JUYC4 z?n5Tn>bz98<_qLTI2gh_FN$qoz{*-(3Wo{6Ik}BwOnP3TEgCZtxSq>eVzkIBNa)KH zT%uJ-HQWucc$%1;rSLcE@DX84#1<^eJz3i-FDVFo6+)$D5rWh({>z)awq}>fP@xia zvCgV}H_K@M2k|WP{$F41FUs$)jerOpzsn<#IntJB|y>larNodwR0a zKYB0`i1*sroNCf*$n?EOC*(Z%o4KM6gmT_*;WG)eXI_$CQ&VW!06bDM0aM|xGfFrY zVq+`NTXtmK-x2yF!IgWQe`>Aq=%K-qs_2vZQ!mU$03YPc-#^*kYbd^+Y&f&j!t02J z0WCw6BJ(*8;WY;DXIyPt3Dsn+2HT`Z59jT3s^$r=(kr55s;vpP9XIIHC3sb{b!-@; zIeX69-f)qf&Dk&%j(W@Q7m0K~UvFU0_I)wKNBHebjo9m3WU+%k7g(|x5*pE2gPC!^ zCHFfltq*eD$PEQ96%=GBNE5qG0esLj4~e9eU}{WE_StXc$yi|E2uDKVs#wR)!O1D; zQGCQk$IZ>n$jHyb<1&8YYh|@Rog|Zc5U1{9)mjs?mfiDkqnOTTx07Dw?(iZt_CBN} zW&a0!%iamF(RFqDTB`@CBr~K@jPN_|ZA39jUCm=X|-W|{H z)lKwx5p+{FGE#CHj6CG#c6ctg?n~3t9?N_{-#_!d+n60CP9emrvb}J2W&s#z^A92o ztG>&E0y{nrE97b1le=N1XhhR5X$~EQEoy30z{)P^ygMBT^rI9N07EULMBZ{asd2*q zN6Gv5genE^3!a?Js-#wY$?6L8Imkr?X-T8cYHJPe8a*i+nc3^YVGlU)TsRIHry1YrkB-A@Dv7 zqmPfUOFF7HP<<+2{V8SOy=G!+tq7^mIMf6(kH6U+d?dTrvFik=2U+)^0?^oy#&GV( zJWTTYr2CB&#(LAi#)xS(Qvc=hx{~7BHLD?DErK45`JTQegJ%DlwAA{`kfug%Bk!_l z2OLz4Fq+JXQGY&GBALD(jj3G(5E<5r$pTAyHI=a$zTwu5T;gPE%{wnJ5RC>i(UKAk z#fK1H&R&k>drXk3E5O^K`zr9E%fyhK2k0rEShKJ^m!w1~fb=p(6?a(^=s*q2J@nx9 zP*}b|@kfQGS?(bPoxW@*8A4T>Vjd}8-J4=?d<GK?MqS=eT-1U2?uw_w6uF7Q<`=O8OuTa<8vB6jB(Z>7PA^A{Lx)j+UAI z1*4uGFvBj4^vV>{G=(a4Se-Kn^rdP18W^_J7XiL$$Ho|cpBEh8Rj+)tNY#;zG_inh-^U=D^32PZnm zs`nUV&udXyhW1fEa$=

tPN+N@{5u{%E=ZiHytUU3k(~x^O^#ts3^p5wx(lSa?QX z2HE{S%m{GP-CW>euV|mGY@on5*sk23zsA6tvfzwm)hsFqjsIRA&XwI_qm)t22d>zSd&qZC5DtQFsDay60 zM{@f<+(Y7bc1C6;sjJxX$OM>C%k&x-7V4a`We**bxyj$3XZvtUgBo}!(+kY{#$*9Y z1@^X|v)8jQ&Mv4Yxvy{Q!<&GyPe&vWQUe` z7kDEk0~%_>Q8SXfybw2fFFq95oVTR{5fv5C-)`%&;?a+Esb|b9HF^?hNPjN@^1g6_wBBX!i~2B0#xVn4hPk0G;?Y=9gzks5B$1;T`nl*+|37F%61mCoj+QNmUCAO52q$TAF!1pruXPL_CK{!n1@HW>%(NqS87I#No>f1sx(SJ|Jhewshe8yJrq_`?CMbq|>v)g$J9R-7Eq6kO?o{Lp{m;p0mA?Ae;v)>fEk zu4z8&pjUq<5DOF4@v|m6&{;?cm<$Q=)IV8o^Nv)I-&0}IZ2*Q~77FkrC6JN?2VSs2 z?#p+O(daW5rv~n+c7tDC&X2A+qj5^DkU0l^0q6VHG;j7A%%Y;A*tWx=?ZX6%rSg=+ zh!nN*@=uqSsDpm(CIbK_ilBSqx-3h;bFsx86COU$P!LIa#ZY|(G78~s^mfOg-EDt* za6efctbgaP|JA9H{{2qh1-yjWa7Q41`wXZf9T5y!U z`QXxb!Kn@`!E#a@I-fj3w8kY;#4giPKR4)VKCoQ9|68MJ2f?12%Q=iC1P0pp)1%dn^DNSNFC#)Y`!@uDk)fLN-DnjD+e8D zDzJ!N4Gg~T@Ub_U6PM6nx?NeCAADOH42)0(^&0%Y!ORULxPP_#iYu@`UJtl6qiBE8 zzB=fDRb&aJmGZKERTf9n5OZ0H+@!@Mo%c`HkB%hfHh*lS2jlT=vHEQNtu)}%(@mC= zlpyE(7SwAqD0wtp4Sy$}%CS1IOW!0W3FhVFW7esWmQsRsJt1{CJf)>C+uD_L+pm6m zX>W*(RB&?x!eNMke1O>!XCyN->eC0zm-!n^najgMR~DmI{Fm&bh0F1d0Y#9{ndOZZ zdnz~V@9f06_mlbV&B}SfgHU*1CaZ~4(HJQ@+LcMJNqZX1*B;)|Lormv^_z06-JFt! zi{Gc6ZMtgCcy)mmM$iQ#18$@VFVpAzJmTeFt=|4-_aMggeR|!xjrmwPDl2xiuS4Du z{?$OOlNl34j*Cl(LZok1;jp(*m(PC!Qu5b|`F6S=vV_X&_qBQFezBj=r6%k(Mh*Ec zwF*iqN|>yu`CS-s1S|tjOJa2|I9{eqt~15~EQ=>*O_(jLpH~P6y)A<6ot*4bkX>x8 z_kgig-a>aL^6E+X-lxS&1Viv%$;i(PK{kuH9q#&aWa5AYcBknXv7VmiC)gWmESJ-n zjCfCT`6mWWrV8JOdU(VugBEk&zb#mdHgedtSW2rEdbWYcjW z45hEHufy({l9#%`x23+;T#1(YM+oLH5&r&4(JlnX0?5`08Q<2?POj3edmKCV2A=-Z z9kbApG_jeO81NyrS|D~?zz%Pm z{=L^&YjSeq@84&DO(_(f#DLG;=W#GZ>zUxUYnmo>G)s=zm<;42$}C}*~sO`@AJ(H2ydwP0~F^^qQDHs?Swp~z?I(OXhed4fP&EmgAxzMY#*11DC zbsg@jBcx9}OltR4n_M*VLq|nz@z{~qG(XN_TWL7WZjq`b*J64wKM7c;3!5&`hW=OhH!{k$y`~(caeh&w5f_yHZvxHmHe5uiBch3G2o4 z7}2XdAwfe@a%ZxDv6j8IY|${F+0Vgdu%+|wTK25nlH1{g&EBur<3;yu=r-$@K`b$o z&499i^buSv(;5fD<*-*`(wRbsfYiU57WWh1mnTdG1N|MphxGtMxAyCU zmCb2LZT`Gilq2>>it5s=S^Hw2u@Xi;FRx>Mw`uOr*q9U|hRu1!zn4`$;LhIehA)5I zU#yF>T%44zJa}7xqg7||d_SzD+5o5F=Rl=(M?^#fjxHWaVGj?g;3|LN??nxA>{~1j#AQcOg2rkh}fG{-)n`xJtjn`)KPYq1wRF z{b5pU&wX_2SzW|k+*^#5oT4HF^=7=98t3{`zE6s0yNOwn7{^jv;?kBuKYkd(#*P>3 zulD9m#C5$2p=rY0S`$`G9~o%a+4(t{C>dy?T$Z#$OV?wn1;~Uxerzt4cxkjX6g8Gr zw6DwyBn^%B5b_}+PWs!sdcT$l)liRb(q~47ozB-AI)Ssa{DpkJ8P%jbLc?x+Oelc~ zkKU}>_dp01-VYQM(-|x(S~sR9Unn8W81A+|)`sfZmg?FIENhz& z4c<4zE-&UyXB@mZe0V2Qb;uLcrCyQaV@sPV>olxQ1R(xmAE~O64obcdU}S(Csmf-!I+}|8E{*2!B3>Cv_`rjPCPCjK%8lC;=j>zsVCDYY3*;o6314lAr z@;RBRQ-t0seB)h$=V{Gh*L7?x@=pR*-5~Wuo$*t3za$Tt;K3G3AVT#iZkn9U0q3+|6s=K@FoxkZ9pg~ z^JbqOQTH324=d{ueume^@pQ(fr;D45@=3>ZFZNsS{S~3=oT#_6L6r-4=rF({Vz7?3 zo?_8+JGo2yv^_hzw2-0$Y(*9owK;7AffH7ztAc&NN%cY1r=W#aDJ3~6t-+=ndb z%|k{y36M4?G7~jo&eMxP%w$KZny;?@cy_?$MB#eAoRWS-#Lf5Hz9)ou0+5nmr(q|u z=)_z>w!hlEG5_{Jv|605^`{D%0e4Po8#xAnj#OC_D*bNSMduWIAE@=Nli_0bc=)?7)8bv3o$J%#**dEzoOM$d_NszL2 za9mbpZaX(4qr?*46r;jhpw($I5Ls#Mt>P-KrB(IvH%G()3c9?ec&*Tp#L{xJH&f`_ zvhOUuF7V^~%ly*AiCtB9x2O}guPhbRMo*Zsxw#JLQ;h7)u$wqHjfF5x*_ZX}`Xn#q>{ z7Ikp_ZppzPoIBkUvUTQysPz^maEaSHYSMOIK%q&LG`q)5kD=EDio13-YKm7Xj2 z%ATupFnV884cDMaNd8HRovcy<@Yohi@Ng)Xmr|nTG-C_>UoC(F6l;HZT5>AYD)}dD zP?4QL3VWq-_sR5P1Yv=nxHR-~yy+3UW}^>BHl7PM(Egdb@akGtW}o9^(G(bBL=q zX66U}$1>WvPfYS1Y5d1a5@mpdy>CtAf6Vj2K9Ew7GR{8G@JiAde@^J%&7?gF*|!6yx!;cU_7%4 zCB9@;axhrDVL{qbSdz$uGH)wiT-Kfn`+T&)C`-^keHk%2JhH`SUspJrP8C|}Do0Gr z=wy(+LU3NmjL+I6`#BbklsG#R9+u)O|mz6 zocFAEYJOpP_T%*>%yB=4Fl8gcKq4VM0HV$lSwBB5lKVr1;7xxlkm9&1sU7f z*%f3)j%T#J$EEUmKMFK>Qb^u>ogyS4Rs1)EpMRgG&K&Lw9qH4AiuTcd~uzd$9VBYi=SERG$rw=D8FP{QP6SzF(Ke^C@6EnKkSuew zwJ=uSZEFc#nS8oHrNUuip?P8XBa>iS9y7Obq^pc88ZAol&HeH3#aXAa_#4n%RkAU)0*x7x%w8<$sS) zW@T;7_DvXCq4!c4PFHA7Gpe5^iyyi7BY$nz_3~y5f}_g;^LgH&Zkm;sk;#$s1Js3w4DmxLSM|i zxnRFS!+fs~I3e1lWHHNm<7J4Fk_~P4lT4)QSOf%R4wiJgXpDcl-o3+LE~+kpEH(Vt_`CtQb)~=eba$s?d;>DrehtU5 z)e~q~yf36FR7mCdV?TES2!DWRs>Nb(=J{AGl?4+0v34_>M!26l_ji7Qd!PSXc22CL zp?zh#lIkz5wBEUT=|3a)H+HX9zS?W9e~82-&)>r4VrH&%fUZ8=kh!?pSzB6ud+HxW zx#a#Bvb*%kkvh*pDJvYXP+TZT|NQAU&qyZd#pZgy)#lyM;c?E##dWi4aN1lEX=`sK zlS@pM>h@4ryiiXD%&_)XGfGj1lPZkqe;*&)wzwUN8)IDw6H3u(^kveUFe-1uBx5f+ zMyXo-9vumh<>PYSro^OIm+(oPT6uaRP$i1Mk+@WOoaP;F($W2@|R zYls>KEK`uCr?*xb#p%K|{P_d04zK*5Qo+Qbg`VC*_8VUg*H2b+B`zzLxUzU%?FYsL z^V0#8i^o$x0;HGlbm;>*Pq9$b_J{4crpH)0zYWMr_>imEuY4e3Vu6!_LPSh0uvAw@ zg+hnWktHNAHi`C-u(P|Hfs843v*!9byl7}>=$Oy7#rN2WG?+ITEqMCp02LMbv)BH4 zPs{amyx5arovVA@=ex5Wg0$qvt(m0(zt_=5?a1LJfiz)4HHZUe>tZb~$EJ36G7ax4 zOEhMuzx<3)kfZlrEG}-8R?-SljERer(+XDuhB$x!-r5bbY+PMk3p=WuZ%Tm#y>C9O z*G7>pIV{rgeXY?xYI3%Sv%zC`W^c}MXA{@>`KBO&`c!)w8G8k5fXCj;;AF=6m4=vY zX_(a6bb`PG1EVr7%;04Bt%#)0NsCA1Y$1x`le#O}*6j9X`59muoH2QeAYdN~$C6Z$ ztLABIFPpDub&SSIN`G3qvzM4rQ@aV(0M*v0Ul-@*oYINVz1Fs!?WLbO zCMDT3bei$l-tcr{Npfiba`#_4yEfc?f)J6&7aO#c%Np|Z^mM=-DzPeCr|y>>6B84Q zjpwl5-rl35^a?%h>V;fc7hq^qYvH$2U_+pWvxywnACdLh{ABKOQdZ7)`(P`M?)ylY zHiE>&UC20NL#B_P&gu6bPc-r*Enj>3ZyUu`BeFmyvMp|Qy^vl^qId=BYW;H(>wKRl z`u#E{W>#|xGqTl&q*BzcIc9d>#Dk@njjBCn%bOMos>nPpw)UeL3-qbuRQHHqUOCl< zzv1C?vp)5GiH%P|`Pt%r%A$qUm+XbvByz-Mo_d3e{!L<}c9s z#icP|U?>b;_XdTUM3I0r$)gYFcuVZQ{nf3vR#Dfc`s9lo6=5Nn9}G{0`H`$)*-xXJ z$(_Ht^jJe{a!Re?u|`DQCQs~vp4|cg3CNP#H`cX2faIAefe!W$VWd2RT@#`Du|kdh zr2pum@jBX<$4yUMBg?-a^6~o@Vz`Y!cj$*V|QW7)pe9 zG@cQ0E6-&M&Mht{w$|1hejCY-n*%=V?tY~0r=jiIO0u6?PBY@QDc&Coz_-X}0^ztW{L%K}AdS zYCCF)z2|hwr4}S)S?+YYa=V_%Mj-;d#nnm)j%4G_fRe%B$fGicv`j_d69p}IG`P5& zmau%io#oJJn83?_rACmGsm-~F%bccP5yLHm?+>5b+4yV*lG^p=4_I3}JR$}W-{Vn9 z9A15JYV-Y|gnHuDMRiE_wDEnbI(ku^X!NJ?R06dJZGQ1Mho_))_ zHucKaBb}XJAmE==J>1XDK#H)r!i}zu4mi#5aMt!$L=;UClu`FV(w6vkeo5jxaN z+;Pb>as3tL_?J|D6z?tj3_ZOoqdLhlEBlMOQ@urEB{n$QPc7k$Ixng zuC02xe9DB#jMfGn_VhWy%j0MI;;0zxGg(5+ZuibzCy2N{OuENu%TUC zjZ6(r{vVP`VK|aUeR~;JouEJ4ez&hU>~<7$iPv*-fCG8CX*(e+Y03XD7J`HXU=71w z83Z7-@Q~ucv(Mo25^ts~6>?rLaa;LM1`dB0`eK)PsJX3VTmnD!cVG0NLcm~EASe7^ zNiUzmBd4cVrc--hqqR7%8`eUao*JVKy6f%hx3RJzB#M6`v$U~^OY5w5%!RfVDx`tE z2dfP4Cpx<7-MBPHd4cHs+1dM^5mFmhawSzf0@DptPVnI|zw60tZPM*jyNSh5UCt0@ zNm0yDWC#vz6!pr)1S>Oh)D{hRI^O+s#bK#3QVhr2sm}2!H69ie8;&@>Gnp3d|1=aG ze<>A7NO;8@B+emSRU7UMw0Ij!*Fg<103QhhF!Wc;3*n@E^?5|KnSw11_A^fF0o0}} z8LTFyTg5atZX5P`{CZA8t=)e@&yl&f$Zr^v3UiSjOpNneO;m4gN*SrXI6fT|*mc;U zcpNIh5kfy{Py3%?;b~}G5PtS}yH5>RxXx*j?e&{JS-1o;F#P~hW^+Yd#8hqd_eJj8 zxgxhjWJB$pJ!1{$3YmfH=%B2y7RKfkuq*FvQ=q~aC)y@X89(3LO0Ts$$X_tEX>R7K z(fX3k>ztUb!tZ(@3=t45VYrcB(93~iZpiP}vxOoc0x$p%pav%PTR2+Z2a+ZgXQW+6 zqtFNiohK%_QMmOht@nkgBt^Ijw>}Cg8 zkUQFZ?1k*s`RdmXQ?a-JWmVZyI6YkSBDt|=hasZBkx??YU#}(aYtLb%m|4Fv+aZi} zEv`x!Xy<6CsKXdYHE`;qZK&@wWGoLhvbA(`^0Z)zU=tv44MrxwYIXl;?>jJZo3)4j zZ`ONcS5bU_KKS4#uH9%coM<$jW?^C@HGnX9e57f&G^TgkmRRrRq5a+FT3U+LJDDDMcXo$)>ebZj?RLB} zzBqQXABS}Ht)|Sv%=BuH`?qs62!EEV#sZw0Zo9cQ-(*3~$nRasSCuKKp{eTjtupO0 zq9QV~>8GddOwq#a?Hg1%RB%M8MVmM5?D7)keGDy98c$V}+eiSg;y}wtGZ6`ZJ^G6B zMn=#~Ogzi+!qjn^C$ z(Fg`!X$a_5FIY*iI3%p9D60})rA>6UGaw$I)n|eY+#|=t)TawHQ0Q@o9%z2B;9GxF zSEBpS@teAJna6eDT>>#BT3gF_YoBm^ZgJ>`hE=8-Fq_kqL<26z6$dB!@S^7i{+75P zuZCkiT47kb+Sgl7vWB2f0dO%gQc^BfuG`&rTc-D9CBOBe4O3Hd?|ay%VXTNJx+~(%C4C&?-E1gu-R#Lfyg!sz6}1d#KeRF>Cslj&iKstiV_9o zq~(C(2&CN^a-YV0_BrHY()pyRk2kjfE-x>qQONxEyo^xui$V<1po6&-`RMTB6AhpF z`6R;2V^eLivIbH7|7rnx7adJTKpd<$6sJz?9T^$uo3g)?LRM0mkkurQ5~jNo!Uxwe zV7f)Y`V3$I;+6)PE19?OsWlk4qwG^69rq3nZuW(QFQVdvKfFanS5%bEwQg6g4kuuV z^#M5^jigNNKEO_Ey{^OHk)ng%gv>82ULCD$o^|E9FkN}Ow{<*w&AOwuBcr3^L0`qT zws--FzefH~Da*fFe71E(MU96wnNpj$s98}uiV5uq9rk8*&U}^rhc^Q;AT2-@A>OO9HbDHW&KlE8o}s{WST1oG5oa7M&lV3g{4jpiSaENNh}70JjGDp1-?1v7Y`5* zM8d>k5qtJIoTw$1QWzbUa~ZSJ@EQwE+DxCy1|W~ni)MDmNgizBc*h`BjiZ#B22ljl zJPs>kmdYBAuie_%$=&L#Gr3D9gB1i|qUvBPK?* zV;WWHIQ4m+%nAYuNOo7(I>>wuy!V5EZe)Q zs8Go!Yg$Dk;;Dq$Q0kWf z$T5E%gtN#KSwPRH$SRb18H;hy^0@@EvUnukvZ*>QhDQIgjXZn}jTULehz_sH)TDBQ zmJgL$)bY)Yy5C&fmTwQoP2qL)bZu83!>2j;_;jhdPW^2kpC7inL}of1)5zxw~ zL7+#0JnJ;I7|KNR@6mg^;Y!dqR;ks?kA)Q-F71~@3E9ss#+wNRnRqa>TPrOJa!=S8 zJ|ePIfMM=DiPD z2D`k4N28{?l6+fgUolvst3E&&(6*B6@XzFe5FiDwqrkcX-IzwWlKZ5*T@M6!Q+3Gi z3-(@b2eWUl*vpYrXN_ zUMQX6MwMVn9Dj!Dmskz<-6w=Q8RX#@w77gEcRURzs7hkiY4_>d7(6RhD-vf)Mnr6< zZ21c=K(!c2jx)Gt=rS2lj3njuTEGn7+}v!if2wub3`dp;mBX(}7WBT)>G8g}xb)4u zJz1uIYRW%4vL#$9Q?xwXueY5_^m#OFZ*<+{LpFW99MFu$XYzs_v*4mge+u-=DT%6A zYykPL2#TNTdYv2+8!025@=y)nE@ZT)z^<#(=90+rMdaFzD0EPt+F|h6j^6iIDbv~- zF7ihQGlzvrS<4mP1Z-tJA<@kGx1?=(Lsv*{vqx46S0wZ8H?Wi_QwX4Ox3-;)GM1Yn9s?xrKjN+YHk3)QV zkW;&uVQ-g+`cZVG9Mx9@QoD*;f-0mpVcjT;i@JHiH*$(H;h{JN2%OcmiKHN!Zc3Bc zr+bUE*-yKsFJdH_~u}==?o&j`PeNDZ()-KSG#J##dH!(w( zsno9aI`|X1MN(YUkSxA2m~y$GHsQH5l5)8<=lKw2r*3sfY%#9?p@A=dOo&O)cjB>t z-CW_xY;znK7MsHK9;R5P2_%iQlG=q#zgm6$O3z3wV{Tz#K>j)kaGD^~=j^Sch7LH& zv?h>*OT7qw@VCiJ<9agm{30$s{cGK%uZ>bN0>?dWNzp~h!*uKHD><3_N7_H|NEqRI zmZ#&)$9{*BUD4feykmjDh<0tB7{a9#?_g7!zIB`enqkp#v$+Uv3j zIa8`DGFMQFu)<&ee z_7D{3e8KO@T~+79(H$IU=wcQqLuHRW!|IcB+||ZQXy){#y#_Cp7gYVDUQHM}xw$&$ zkh1P0Tspx=nd|B5kfvjluV zTN8-M#WwMHc07YrCBHDg~BhVf8Aw&B2VM6erpTs9lqb@ zL4l;!z`D@Z#sMF&CIUFRI<9dLo>QAzqKUXg+)g_}Fc8}-dL&JUA7S3+8kl=3Gry}j z{Li;a8x8f$%{9ZL;1@pCSHTb}V8>Em_9DGQP<8e8DeN;5pa8Jr&sboz$7zQo{*cr{jFsGD!nkCbp?iE6O=9ABR}c58D9gMAhO9x zdCz z)6E59ab{*#RK0 zqa5-yx`yrNl4>PwGh&KJ4%{eaXNVBywag@&bLW_CQi<=nab za^eeeJMe1o3w9!0J!57@>mIA8Y=GV4U}$;OlqqIOGOny*je21ccM%@?zWhY_DX@P7 z8G9U{!oL0-B*g=Qz?GGVs->sgSwSI^8h;gHAUUWZu0-8bd`V14;mrHQxKY~OC(Hs~ zGM7nH_}%O>1la^QZD~%s^eFaBapEDdM_4ruiA`_jpta5GxKvOP+x!eu-e|#fk zb_X}lo+^gAge(XoJ~q~6tLx3LR{|@X`NNhIqO-ZNaep>NOIM;MUlgyVM#kTLY;R-?n|f1D+S{z6mWVQ?Oev!P;%`SC9My(xOko6-Ba+mu#!y#wc*0D>;|6P|>S|9(1RMNUBh@BPdIez6^HM0rB%$8&DW zS$1|}(a0z-%vDd2m>Gonrh?9tVZJ35}AO5}%&rP2a(@|p(0BbIt5WSM3;!N1jU{wb>CqM(wv50JFG2*t*G?oP&-4WpJ)&#Mjnz^NvI56`Im1n~gerIT zEHuJMpK8Tl?9;uZ+ZDG!YWI$QMOm0Bp9YHAe8?H!{7wN;vHNVqr8K2$WAGbJ`)(n#aldgN>1lw) z>*G@}Al|?x{)CCv-{NagjK6B4;m59%04z+Lt*!Nq{x3FIZOV&swmyn|;%}g|>&I)B zn?;+9(l*f;v&-SU20y$G4H(fXm4QY_<9TX$zTS+)LSx-8Ulr|B98C{OR=R*z+3yA0 zln^X(9A=u{z`+pru8_K6onv5UzrK6_O(d6G`q>j5Bd@=7l62p3053oaDIfbI(wLQ9 zi+QAwk3ucGD<>;2FFiK-M@&MrFOG;dpFiJGKE*O~TN3!r-#@;BYeAE%)4z|QjhD&K z`g>_Xz*6#T1EzQ^rB@L&x40;?Scd&;K#u<4W_&60fDi9e9@bPLZWS4EsQ11LobwD^ zoeHn!&mUU9zutfPf$;a_fW%)kz(3R1M}yNRVTqFXrm+TJJD(Yunb|fFjO2Sa70W9~ z6_XI!=MI@gpg29Hn3p;1MFlR!A0VLt0Gy48p{?KZKP!ux!J$?E`gBcB9%&)K5ZFz# z5{nwul9LAV5&YfW&OQl8{x=%)sxiKFUJWAtM<;2*2r905UeV?*a>t4$^zk<#h`GoP z=lM-YnjMdn``#=6D?M06B)6kPJtfcBzIW&SM*qA-^y$ALCBR*dJ41192Ib`U(pNX{ z!}VC5TSe3+Va*8>{5LZ}CJ3BuH?XUJ4|4e|r}ZS!Np9bWj1H8F{)^uCvd<;T z;c6cTgx7Do<2Z-kk@h6Q{U`hZ{24cZsr~)iCwhNV7{vb*#sMBYKoFM074`8u3y=R?;QsOozMtt&J5J?*37UhV#??HBd}%4ZW-9Vb&JtP0P=UiH_x z*fBU?_OstLUnJU}dJ=)}G4l7m!YTm^muT=gO9;8#Z+vle%e2}Jg;nqB1RGpBiQ;7D z{8_RB>pUrujKwUZ3B6w8wLqd`KEx)al}-lf^h7C=S5?Gj)5(xO{GGBPm|5qZ0iR!a zEK>0SpEa+byVf{k_IX?jFIucvKob@>RhtV$n+&F{)-2xx`6Mur!!H=a#Z0XK&W48x zW?iS0#q0LQgt;dThoJ6a@BD>^LnK<@t@l`$7>;~UUM41Q0DgjZxdD;6bREGP!I>~& zE?i@<*<+D$&xCVEFx%X?_3gZ51W3+zi|d|Zm)%Tfm;%qg>d#fawi_-qe+)v7_)k?1 zeceSWA-S}1%0uWhCMp)JNwT3t5YM zED(nAci{akdY(QFH5rZj)pj$Np*PPJE33k{nuv#ye~k4mj$qF!4-7w5s7178(~hnp zBsVWuv^DxvI}~RB0()8tXDv%G4jLsv+qC+IuLmOG?bZ4=_V5Lo={I>zJv6U^RQnxH zpU7THE^%40U`k(MTvY;{zqr$p*Au!4=M_Jn_$6}>rV`V(MmJcYYw05TT*$nBu~UTK z!vzB3%?VB zx$?FoTdyN)RTgvOS>9Njrn6Hg+FM0oE$#OdC>Cy4suNPQ2t?5ipQ%D3A95g~OMCZm z`oc-hDo--0qkJ|t)zCTKD?ZGkrM-nxe)|1gdZSq-CMngWQaQM;dcd zlyhhheI5*z-^(_uan|C3+XA7TKe}FxhU^mlmWhbQ?n&EZ2$#7Oa_dyD+hlcDdxw#C zQ6yLwBq0-rd0Kr$9&?;Ee3MBc8e|AJli^+U){&wY-@F-071UtGDYjIdqy)TA5 zr-i4opAth}#`0_5$Co6jaeA1m?vM?4iMJ<}{_n zR5I(jL9kCeC?d7J%V$J!k>0l=TjTkmcy&@;djzb;`V*fClHW;p7P&phhqg#Z*4=mn zeTLXfkoTc06(eZmSl&DY$pG`i%hzhJ+3z5(cm; zYAcwdFXD!l90V=_Y^ns-)^ybNp`urCkMM#yL*=(WZNx7g(Dm733f!XY70JI#mv3n) zk~IkW^sCYxw#c58x3pb`c*E!v{>{*3?vJG&()p z!3CY2B0v%gc2=?d!IA|9C-v!xE`hzhWPdD;x<-oQ{`~D~X908!wl`H^zNbi~bT9rb zWo&FTASf8BVUM9*CtETyGe|>98F=#rz=98EtNI_C6D)Pi%6GeSK-^?lkQAV?x0Dzn zzPLN!xEyH$O(z`B`|BDS&zEp;D0u9Uy1d)K7}FgYYINXO@K~xjlGfoJ3oD4dzdI`# zr7w$#g8&q6{1 z@LIqH1|pcxRnyb6m;iTU&+p}u7RQ$_UMe!Pl{t;xMMsZ6_X{0qlF&%r8oW(Rc4Hc6 zj(aS<>KWBtiI4$rZITj+ZmgcP?y{ej3i5;2q)Z zsSEY?nvHrsPCZMW=4{rd!GP=zHL03D*OS=vgh`l~U|*Y@ldG8)>xktuZ{ zi3oOfbm8+@C*li8Rsa{I=iPN!K$*1yxJ8fw3rm0RU``&uCjYrUQv%_)LLk5EYnHyY zKHBz{P>d_(b$?-RYxvb!bEL^m%RUOc_xWSaL@CzM5uZq%*M)w>+O-!uh*GGx+fi4R zcY>ulZgf%r3BJk19SEwlfQJDbB$4l%o%y=6GTpp_BK?eX$Vj<;kUh_1pNzuZSk>96 zr_@NhT9p~SeV;em<8A06Gb^)NlfiYQK2^Nb2h&^W_XVDlM}L@{+>C?e4C2MoK@=WcecFtnRK} z?N)hqBOd@5uff1wqWVb~0c+RLP%J7YFJC*D`w@w;7G`=^XTt@aH#>2VZ6gti1Ve&`vZm4H?G%L+-fZr5{Od6adcX& zWiCWvu#C1#U;U8w6UH=ULArW)hgng z!S!s^rM%%1jfQW&j~7$1Swd2r&Z}be1*#;bRQ=z)Ua6|70DRci`a13xtMTEbw3{~n z*^iJ075BS{q=6NT7TZ7rtVr8G%)8F%h{x{p{ygn*a(5 z<6?=V#YX3bHYgyHifq12cple(cIhDuD^@SdcD4=s?RW%DO#bK>krPw*1!iVegoqdf zJf=ykFltKLPePx#=KH!5*G*=;w8hccZaSjEqXZSS{LW8(cuDv8R-u!`%rr5{+Lcwz z73DUNv9pZ8K+1~x`#kid)Zll=aAquWt4~?Wf0^AR^~Mv5bm)1+Lzz(cm-?Fn%ww=R zzx!{A$M}kUG1;Y;p?6XS@p$Pn1?>eJg8niqS^!QhaUA#NW8@@`M|3RV)!fU5uI^-mi zRm<%JY-D$T!7TwF!=#aQ&eT>RGTtm6yUVKIMnPnh96C+1P#a0PP(%zq;jgChT zBZOYFHI`z?y`&QRe#m&@q;;;apQ+7<-tf90^CKA#6aoY{s~dZTh4bZjd_S3OH<|dJ zKgTiMga6RYFCZW!&>gAbyihN+IbWoP@#c-a07;Hy3j5{usD#~%D$73=hODynqze`n z#Q-)!k!gaxp%^KS|6UJE^X|XBfcFNbhC(n!W)TH3427zmVc7BUN8`exLa_d(KD!R| z2#xMr#n?jTLrN9YG}JwT5fea${i&T!t8R05m%(8`m`Il|a%^GHd>pb8V>{e87U|~x z+}(XlLiWA!&Q3WQSvMS8mxyE}Uvpia5Kxie^PCX2>*}snRaTjsn+ZE6O%~mpAIiA= z(vj8QqK$RRU}%=ynHDcsTY$!Y=1ywIE!V_xCoyVLo=;uB^p*|(Ft4I^u&wU$8 zT!b|Wy%R=ORj5sN=V9>$&t4*F0|L-jrMn{8Qbl=ISmq1LRa1f%QvA?9q{*DBSI9txo#- zl{~T?mwvVvTS(lV?^GEc{Y<0@?PT{{iQJ}=9{>4Vh%?DGdu;igGc=aDhAwDY3whO)eLl4tMKW-Pz%SK7bH6e9M%RgPc&ne@M6l z^N3HTbU9p>F>ZGMg;&z5JwD-RFoLB?#7WCTPF$%LH$)to+a)6*Dt_sHdDoXyaP9^| zY?PGcIh}fbWBtjCH1~LX;A7wN&VkD!C8E;~-h2k9_}rZFP0Z zQkiHO{?{+QOM)-rVeGb>>K>XNVTT&PrIZ3%bP);P5Nh;L1G16u81z;kcCrkwI`mGtcA@^FhoFb-?IS`DqJD1s0&0nvul&GhiVz{5ry z4Y6>I-VQIaUsOaaErK-z1n{20&1ec}92*=C2G$TGqoM$Lma;@aM#TD0?hue{d|crD z`Fm<>CM2mwUrJK(^n_1KOswDY;em*Z<2L{3jM0!bTqYaWCWAp9p^JDur_9X~QH4aIsW(|`;YWQD1x*!{EoHFN-y+^+OAJ`S~pmd8aA zva=KC*?e6;p)facYyP$S^~?tU%>IpXoTZ$YH+{`j0c8=tezol>dDziWNWOrB!@3lIWJE@UleI#KsF+0mFdezt2f4MjU%yIAU)Qse($W$UwNFob zpL2WM>8<-~4<@p>pRuI#fowC%^FxidSQa3Ee1G2w+|_$8h+Bh}$G!&=%l2S0r4w97 zdkC$_Eg6R4b6YS!s+HG9M!t6mpwnte{GuHk5MZpRh>Yi!;m0UOgquA#Fd!}?Lr6?s zX|owVejZA!8BJl5HdWj@-i+fLX1de-&&jDM z6qQ=FRtavDNGR~|Y7Gv28|QYY`vWtGKqP@`z2-X=f}@F+>vFQnd@Y}<09SIq7>vnQ zXr45=PF`U09!reOwQ3!K$NfQ;lahtS0i;UDY;8Vn(p>jwmaS(;BV0=#tm~m&KU*a5 zyi;(FhTZ$E6X9>WKfdGIJA=G(!s)#vM$(Q*VV#11n?6cSrO1=i^y7cLk$7*dxCI8Gj9 zMa(fb+y$&v3hd6e14>7%Ow~+fQL$L`e$Uuq42wpGrjLThM_HYh*KJsQVv_9R=-6K0 zZJ_U)xIid0w0J0nYRZ&Jfv?|9_xYOpt58%l^nWNmA(}p~r8;HI0`N1&jhCi2)7_n0 zk$V};n z&El1Ntp=O%*z_S+LmHMj7<%bPQ>kO6(R;%7#Uqp+Di64+|jZ`yBRtWMMZ@t z$HzcnFI0ey4R^Wg-A>oYBVzR=VV5W#ik(0KKI zoh0NUT99%xt+6|e9*^Dx>QAcWaUF> rQmCiZgSJn@K*n@uq{OI(4kO3M~-2A zl_GdadCl#*qIT2e2Wp#Yiv_?_hR{ji;hUzd_rx?ki{!9cKnU^wNT9-4GMqDo_A;vV zYM3=j+{ed9YcPRq7dk4+QaS+hRC6&fy?RFnrX*w%*nYuMD=3hctaAg0lkeyCC<Xo9-FUC zI{TP`QC{{>d?Kdj*+DXR)_@l;z2PF$t)UFU6}CF($md5(Fnks}>3;Oo;nbG-W?fjR zwwKTwg4oDNm(6`P*V~e9rfWDKkT0U%==5~Q<6(7UbLruW)pAd~HId<9V&ABASV+hM z@b1)lUt!Y}Lu%vqV=!nnRX#uBC@4&Tw?!>hi{3#rW<1dt7Bkfe^4@uj*DqS`>h*8N zdwB|#+jQvpc-y8*mgL*k#&i*b5biZwj2ECAWovohee6P|?q&;qO^{Ccst5{_Ky-K& z6=~zTOOiE^j0c&C^Rg|JTb%E%M(3(605Hz!*iaLKZUbza-T3Z{fPM~v$5jNl zY`WSfs&-B{#7HGmhiGUcJW<_#R@z@=wYQs0{dmfzN^+aXZ21liU+~|}(H5E=+-Y&f zQIE0ya+unUh&~!Brrp6H*dcGoyQ2V7-23xCz9r3xClmWXA!`rsf`N;U->SnD(JoS}!u?!ICpUhXx4jb_y*`eJQIgDUU!0vyKWP_!qWDwrr20Qp zgR7DrHNC>!cW7_lab@bjb^s;rN2g9gQo`x=uZ|94{4}AbZioC~5budWB1#JyRsPj? zpo{^1!C>XN*=w$DBFb`kHLo=>7{MW(8#fOnyD#7njPI;m$}ob+0GFGWP!n7deSMZB zfqzD396hX?j*^mcU|38{g4R>5IQQ)kG+e{gVO;!j?BsJ|}u0D{-s9dH~U zghGhEx@P|U4(Ug4-VAJ^lwVpIq6H7eJ0haXkOodx+A1@Opd`FR7rO zL46qbYhR;ZEl1_I*P765W~HZpbw4rW{QG5BOg){35+$5VTB{7ie$pSGTK+@-1Hbv- zk!%01n*Lw@_m8f;7{dyz4?+selO5AmLzULPFI~nxO{`k*?_C{p8YFfU#vb_#);Cwb z=vXbO$aRUQeU3a2C18Wt-cFuF#tLyn{?3KphJF$NiKH8q6qlBqD9CJvm7oIF`ES<8 z*-Q>pU46ZUxIA~X+SVcn^LMb=*y{c{FK&~6ciqTs(Z@RqWulbJ=`{I<4pLy-v&8zd zl_G!VJUqz}|DVF(xbE)~=W-S%)^3gIMn+an?;4^kz;tmP_tKGP3x(j$vy#!#QBidd zb;(L7kWi7qGKPb^JM>N}K@dU8Y}Lr0QG*Hsnon2egC{cAPg57v@+8v$b}}y zM4cU<1a(BqyO>c8g8~&7hRZDiqogFaJDBd0%6i85-(J9YM`?N~IRiTjJ%zv}yDN*W zb!iPyFruTQ3GsJwd)x$OdY`-HO5utq%95k9PtQSY$1~Sf32vL^W#x@lMh6DQg@0o- zdYl~sJh=<^%bR*+hsiF%mq6|ap3-I30aB?gv=l32y02h+t!rl`^R;3MLJorVMt|mq zW=|K_3;{xtndwW$$|#KB8cJDUw=+HaRm!jE_fTJ-$K5`2O0&?G!)3K%w(iyM#mJ!7 zNXTSz6XdMm^gKzo{ssmx{qo%2{^i9%YI5Y}{dz)Rd3jLQ{c)>%Xi9wtjXT4yQYJKF>m5xTo3b9$1Hv8JU? z_IyqIMsG3iEUhj(pKspZ+{6w~?Q_2vB!BzQpx6!OBydusy&8)tWBR@vr@iIT-)mWiaG;5*{L(Tu9Cdm$;n*o}^f z>7{&wGakfGsCoSg9Th#Ygt1g=3Q@_Dj3h6TP!GyNGf%+jEZGdlD2`FFIK z(ErjR$2AK!2f;EzTzL#P?q0c+2qY66q3^Dqa**w$4itcgtWVmTQ_%IPy_P! z1%NJITtp0mC$nwq#54ux@8FCm|AXgsB`#kkc>C#)hMM}*h6#f-Cov6C6m4bP`z{hv zm4u`bF2KMhT!~nH#ojZ$J?+#F(+xNe7H6;j78AQ06d1(JJWf^O6%g?>0C{BejjFg= zW>E|rNk~EhX#6>y(aLjr^S@%RGBwsQ`-q&v-`N$^JvJc%ra~v5aIY3Fmv)5;e(_N3 zW-b6pgGh<k^;muW6R(^K=fEk%4)vWR}GE*mv_8=xE2CSS>W*Gr_;IkFKcw14;fcP50{p5yb!PF>SXhKl| zOCk4e79AC>AfH?edBsZJhnFy*LYi5ortY7o{o_9b9TPe(qW-?N^N1tF`nVSyNN?=C zh&7j?d09o!%scM&*3XPAqN0?pA4JXEB2$Y2kz7j?jfTI6f{-G|$FCqF!$a0)CV5ai z7%Ga37dHZRX0#7g{ceSMF&dBbGVC^ERF1ZJSi`kN!0fnsG8C zCWGfU<`@AS4|vinMMwQIe7B)k?8_QPUnt6`N>vom4cwZ)&i6o)S3g9F1ZOEtA=eyo ziT3xH>>62G>Z&NL1`klT)U@KwRfAaZ;1H>Sekvx0k*ad0mc4uayT13=5gXuE|34Ak z^5(rgkUjul*EKaCZBTm^Il)V)Z>pc0(ORc^R#P+nzaM~@xJZ-Lh2rgGs(ZcT@(CQU z)Em-rkw+V~f1+R`q2j2K3JVn{WuyY#gF)BTNL!C@t-ZEW?A7Ln```1Rnd)sDU0o!; z-cy?aF{YZZ278k~c|v3)0-f2>U5tfbaCHHrDLEO1omQr+f-FTdk#q=HkU13VAp@)?Xg27B&}G)04+3=ERP!p@)l#ylhlDeAx!7tzpcl ze~KpX8Kd?8S?2tuM~%nHVHC@Je5LnqEx|dy3_kYv2UJIZ5{ux^ZwH_KM?VD!x^F@SA@g&epp{mwjan>)8QevcmFGSF4g1|!aYMt+&YXUIsK)K3wUZ`Vp)~ih^l33zyQcq+zHZ~FH?$}>&Bqt`0PF+9G&w7P| zZ$4FB6%(^jg~NLNEF-UBFAF3;yTatxAWhC6YE5B_=jTY!J0i+G4^6xeI0c1;t2-;C zZ;uJME@xUEKc@|oWsQ%^8xAKQuIzvwV=A|M>xxxvVVr=sG|Raw@Ccrs?(@pb^6g6+S&$=V%z*TWB9zId%yH=(!IEL1nNKU_X&;af^X0tVzQC2gby>b;-p9jEG4G?eG>>}U`+}4?n zC5Jey<{)0Cf{E49-cs~G=i#qV%6D~?C~ZA^qpweNBA1$y5&wZUubsOUA_mnd{frO@st4S0`&^T=N|jC*_t3JPFGq9jPzAfZ?92GH*H<_Pkqq87|Y{a0HgZ zq9jYQ3ZmlT9sy8t3=bDulpFPTUfbFUCX%moGs{0$&l8gnb%)3xDTG~YF!*p$z4FrG zrncndpds$8L)xl#Za#nZUoH zfQ`kTSK3)SDk{eM=K79zijemA_5$DlI?Yf|JnrynLKNM592_A>9`_rwHg9^*hqCLK z7Ed?z)hxfTv(qz*A5xi+((pk8+dB1sCVV<~M8BlXiO4q%065Lqo+;>7s>tn4aJmg$ z0J)sGCL8}UA)%aZLrRR`nf7pJDkN)TBPn@!lQva4jj&p#ZV{lTL#S{_%j)$_gai^E z3>9>7*}Q`jW3RL{G}HTHGF}=%&@88!W!}U;m4-b4edtjXN z{dA=Ljo6-cS2NL-3@3TqNAe$V1p{y#;UZ%X~#s^2y;hKUY?1OHNaV`EYpI7 zlmx+t7j*M#uUwp~O6zsY6w z`TbKEd|g?~cq@1;|Rm3Pn=ifx6X&qk$9DzB^FvhSgD9Fq-u_L2V zZznG&*WfzUke;6IZ0m>~6cZmV{M79|@gacg6`6jI4||pM_fD3+82(90T^tqe;t3dy zw#6ZbyQ?y4^orSNx8~)Z2wm-!iC1^j1B1ZJNqOjgM!MXsz(b>Qxdya47<3xxxtZ8$ zZ_^TD+G)%e4WiwwTrOIvA6aE!(*#N-OO19X2yj{~?^XN}-spdZnimNK zo?7y}tFJLbd#Bi6a||4uiK@yQTLACwh9Bk!gZ|yl@9vLNHD)YHy?QoZl5698lJ{|; zie~%!T0E|lGu7G$#mPLnkk(OYZ(pAh%`?UeeJclt@=7Mq4c!w zWK1Dq{LkM#VZwfG_1p8~CkB(Dsk47Mk57KE%en`l{N3xnKW}jVU*rA$pD+Ud&%Z=E zZgWU&WMIL|4l^m9TBA%6-ju~ohH;Q-_oyd3fg!6~Vtb;7V4{?yqZ?xrL-r!QZ7OcQmuCY#LhD{% zAf!~eumB@e43F7y2%9-}N*$sSB@&rFH1uE&m(wlykjrUXxnam12A~&E zDfgGb#9|b*l)1Zd4b?@Sw-q8UhjyVst|}%X)#GZpIWzMURJ+!7 z3;o)prqKcw9UX~)S&&aI%H;R6rRFBP2kME>Opus}?f}m)enDTki;|3k^%(c^!tkQ} zpbt@P!3q5sYb3z4=&#Rx|Dd|Vi5Y>FwbYJ zyY&)-VU75Rh>O9;KImdN_3lhj|1gdR4u`X%s_JIfMZwO>`sQ6BRusy;t4&XjNWbEp zp0)*x{i$E6e9aJ^B8^tZ+8I<;M`PozY|YTpX(5JPw9BF7E8r8(MxPM*B1cDTt|=*Z zacdPxm1ad^ir%u&Y=mX>^ju4o+C721V*%Ch5%6;U>C8Bm7F84LFAiuQG*uFz^J+Ev z)0|aMP*9(1peVQ*B?JQZ7e}Iu_O{P=SVur>mxt%Ecg=5A1uH3DJe9?E?kEZI^b9~Q zx+RnC4$lLSQyR97_ENa5K~ zNOpW;qTB8jJ$e+I^{ySmZi7!y@6vL*}U4t`A~V1+)t;M#iRj#AHiN z_KdW&)x4?U@F2)i5|8J`(NK zFq5}=VddTx*u%Gtn-f~XgD*VqMK4)1Mbr9gtq%|a`lS_)(!75*e~ZKC0zvSY;s$#B zUlOt*rP7UX&!0a_tTDd7#{)eLu^a^}v-ech})|u9{JWRKF zY6TbrN&z+L-g$4})OnDn^2**>$Jm(Y((li#WOG}+x~F(K7PUYInD2aX@JoPO3ZKjU z)H{`s?U%ve_2x)37d-rleI!~W2O~+;54!2QepM;QsqFP=4Of)KGY|2XL&@BLK4YEj zHUF8+6QtX{42u`eYjIs`j4YQeh)o5{;{LFeSI z!glHYl~jjVS>S7x zE=urrb`mCNg~i17jvqXMv-{VgkJ-chkw3&}M(k)ZXRT+&D`|R;n3ROa^V+4m*vrn! zeD0{F^4RXf)^Um}ic+B}nP%T{#&Zl0*u~g}X(PeS2%nvO6+q4$&3lALMhd#5H94_4 z4%xZLKXP-0rm;Ql*BPPQ+4omdZ9SO(f%**p*%}%`77*y1vYaPve_mm`27?8{(UGu58u{vg&SqX@6xZE2qM*+ z>@JsPwCJ2Z97}?m(S$=>**Ubj0rbOW$_Ld`s;a7pyk>$h*j$Mi1y-m9yb?ye4?WA_pnk8&+P)&Y-wq1J_&kUMlx5n|$t z8#a+&4jGT*gmS@^I49-7%Xhxk z;ac1(9HpxQJQk*OI4#XvUn(1ZxHIPO1qP~8Cj;^>~ zKQq=A`QnT4Xo@$a@hG-I-|?hPrJRs~k#V~eLqYX5nJ0(cE-of!cwEw-OohFle7@$7 zdtnGmzsy?cKafVG1oAfsTYm5(rKB`@DA9^MOl`W23~q8dG;`w>ud(0~3P~yTgoRdC z%0t-|+=)aOE~U!zLQZhE!GMM z^f%hwT(tb1-Z($+e_Yz9RRL{8aJud4?G?aXwz5C#5f&pF4XN)#=uJu34$a7`VTc)Wi!;L2R+1p zazk0^SyXS@RYTbgdowMY?_DOLX&yxm-?9XeNa3!$y|V=nw}x&v3!D+-dX?F+F7Deb zB~$8-+xybQLqb}#u6SfWah)ECFx<^ui($~+O^$p8+Q*n^Tv@q4Ao#aC6kpSAducT? zvN(mK+3i3oCKX&!5_fltW4$)zwmQ0N2m59q6!%EtNmOqYm)s%fz6&KgMWGcH9 z+1|AIkNr-CA!k`?G8r7%HnYQ(W~Y_;j*e(s41N+lZmq8f10b_(v2ueBhpL~8qdM{n zh6+0tv&E^|DJ(86$Fmh-E~T)##q;abP)f(s&_fM&fE$R^3V-a`GWILJ&mR-SU02rz zHVmJ$N1;qi9?om$>5-p2)TsoxsOVUD5(*Ms+)@f<3k9m|3KtG!XV$i+^)7>S@Bt!C zuJ%NJB9DZ+KD^p-k_Vd}T)O=PkDM<1b9qW(F=80u@jj19Pfn0T>Y8|w1iFY7Hty!x z7=we)x9%)6e*Id_gnRseVmVcP(RTCz>(=5R;B*-)u`FROh()8;kg)84#%fLwSM@m0 zyu3KNhg~)iH^kDVwCJtW*fyh8QS$QQw7-0#{IE8hzq7OC#&wp*-0vHjDDK<;WwEnI zlRp#3)N?U-`y~^(6F=OO<>w%4qP{55a*OU0>v~$ur1VFDD)ge+@HQ!Bqt_HqUcoh; zxnA_O%h`RH8yZR_Zm>DwH4qdO6+KN!(hL+0R2aN#y>}%}{)RC2jJpMj#bP;;n_YV~ z=3}d8vA&5;-<|{XBZMM@dBAAnN=u>yN5N%{MCau5z4YMKKxo2xV?#E*$gY__{j?2ogQPc=D*5Q6uN zDp6R0NCH$JQHrgg19mWaKfV*xJgiAfmiN$X{>rZ%SYWuYBm*^xUx4BzMXz@1z_rEV zfryhcFm?Sn;zNtstf)n26vN6v14`obTwleL+P_4&WXiQGReoho-0=p0m zC+8%_DKs1iTKmEu(I}s5Tpx_Im$p~EUewA z77%^KQ=}@W#MLv{4^$PIqI@s)^hrZ;><`y7xHukPBg5arIdCikBLXMp{65 z#cH|m<~5SF!_COE*J0fp9;diF9}})gKSFd}>xN#&)Z7lv!GO3&l9xr^*asQIFwgXK z;jW~yjTpc3`$`}H*c#{=MEriiw(^B-Mvmayu0x5*4nsA^3=;^R(tanSGQ&nDnR3MH zgfvsG=k(azl*a9DeKKYr*)9~80+#l6mTL0WWpgF5l?Z)h4~S!`jAvHca!gw@RxF<{ z;qka@a=P`Ta|7EJr|SblFYEi-`P1&uyI;>{#7aye*@v&YxrbA)xWhsNI9&Fb0^S%K znMh}1iv?liZ>mJIP;u1bCB%*TmG2ie zaK#d2=Vpi3dSyobstUmq(pXDK9AjAjZ!e%^JGC@46q!OdEai&|14&)+C(kN7dyoJj z>>PlPiG@YGM!#QMTW^21FjC3SuJ+0Fdmk=p0E$bZ|mXnpabid1%m zwxs%)@E66-#WPmGd0O+h&5H`&|$U#z`lRFrEQKZ*f}2&jORgd$ziF@%bM zbc3{XcjqWb2m;bw0}Kt)%>dFhbT9&pBVuI`fIef_d`3?kj#V3ZGh+ zE(ZJg+3hdJe1Lq3$%E(Ymee&gU_QK1T@_MBL|MevftZ*^hLGZ(s6Wc8uKK{vY?719 z>uir+UZhmzc7AT`wRT?7{@N<-Z*lVewU*k%>Y^qE6C+zjem#}K~t26 z`8hf30IIqH#Lc3*^sa1H;?n|>zZvPrZSDm}rb!>x*`ug%e)LAiJ+i85e`7V=6nI^c zyQGzvQZAD+p`@mkBl-cc&u$DXuWLjn_Z2dCcSEi61VH^C zr!s)tW*$rZ;JYVS0VET#aYR!16yuP<;BVjjW@-Vd#?Q61w#?5@uzozCr>D;la818& z@#UW;&%1dnDF>zD#KV|b*R7L_EPg%uxms@qrf-_*-wj%xuo68gN*0XlXOpFM4vPKV zC#V*v)2^<>dYtMJe2Ond-bh#XhdP0rT_5_BQ#ZMW%y+>D`l7Xcvz?L(nV*>1)|>@p zXm)inuzjxLTGkuR`C*K8vQGzB^J&SHl)bx+q^z~`27!1jclLOEXTJlwy^X%-_tc#! zXRFI=D=)2(uZ3a{rp^|+@lkG$PLJ>+-*~r_mY$V12loX3933D2BoEJ&(Wzs!eYnD- z?q#57U;yrl#i7Wzy8lwed2y)A>$K0*oI_vxygwc=3M6m7kzg*E(>vkmi^*GPaCvht zf@(o%p~2Z8T}xVTB`W}1E{Vr&Hvb!mh~V+tUwORn$to-<+_nzjJ{@SbVfD!Bq$XUKOX!rklD>({gUF z@NMdo%cUVlN5}a(1S+BI2GIO;ptbKjn=fIS&OcOvJ}`@?z$LpWygxZXn-_ z`uUY@ew}e)OHv zho{8ljn_kypk{pdE)ukKj1-0=k?&a5J`iCtMa3hL)90|Cr7U~wxGz#+C`UiHyv-zY zv&~DfW8v(=!u^Tat+^E_FatTzw}wIpw#(#Q4OCi|cgq&R(jnv9UOs z_gnkJ;|;ky0uiq*a?&l-e5DvYdwOUfU;OiG#qF(GQ&Ur$VpfRpYJS(n8XP9#wKqOJ zLW{Xc9M>KcB*Iw#a4DFXjm<=*p-ZI+u=bmnnfXQu$;&e~GIBY_D*L0%v^_b~@?*|# zUDl#+Zf1sum%rqCNix(<$w*r(87Cswi53>GFQwB+15>(T?s$1#d5`4kba!7g6Bd=# z_CwX26z9>x7b#H6^mJo)L`D`DA3}&%ofyp+n$<5R9Qou#$Dmb^@@E{5USr~#0`?~b zg|nN$Oc=k7*6#yepz-rKYWN^E)u(OJP(=PG({4q^45`dqjkb~5v(QqwX)Yp2l7L;e zt1I$Mgn=Kfmbow(+q-rfgl}iQ|Jv+X%u!ml{lRiM(Q&+;>P!yO)Y=t!WBOQSSOKu3 zJz{v_+QQAY5>=c!zcgt(U158EjcO__7|Av0!{T`LcL?%bR$ji8k>mK_D9dQ#^w+O% zNGji}21aJ4nv;~_yhz+KX&)yi6;G|1M8_D5y29k05M|?!6Y@CED_cVj-U?z~maj4F zY@cQ-^Sp*jHp&y~K`&JqaGkCdW=hfu6EzkHc`eUdxq;DFrU8sF>+cYum)Zx@hlZ)bNa{;sHq zivozk4c>TMyu8`UK-ba9!3ioca^F&s?R#7p;|{0A!58L6E;jqN;qh^!{$5kl+}Lrf zE6M%RT)p$Lv0Q?py-p>d~UA#+z3fYlMv zaJ#H^*cH?TimGk)^%)#s+j8)}#-A9S#DSrgrI%9&ibdH_ELl2o$&%5<6QPMWy=NTU zmVGDj5g!C&hs1*kG?gs!qyrNd>|H;8=Hyg9dVHkddo}M#I`*uut*tykq)co9{QxUj z=ksC%)4G<|p{2Tpc6?kCU@*$)DHvFnXt9w*7uc9^K8+KTh+kNo4_TJs(9xHRkufD_ zlV8#TfctK2WdgbWsb2=#7Z<&5>Y@O&Mv(@4)}v3Kr?YuR#wO6nUB&L7ha|dz7v20F zCoRf4I(d>0`L_2i!^Y^t-S?NK-Wi}4_%-6=>Sx4(+ ze@!lmX+xPyBk7FCjG|{+bn!vRH3q*7J9eWKUG1E^QGY*+2CH|VrKjm$JEk)iS7o%y zD5<`6R6h~N7HU)~V-me#?RbbI&D8X6bAlzShHvsu(7|du5eu1^+xIUi_p?6c`ly@c zHl?P9SJPo~F>=;F(bU^lUhVJcDb}w~jCOCYQ*KV9EDfwuE~M)+&Idu!xbD(YBh0cky#|adFcJ@wNAFMMOlhH907RCS$$L<$U*=p2lo~s@yoc zZ>vqi7WJE>71VioCzNS#O-xOWa6KGbxy|8tq{HC(>1QrE`Em+#!0;&GA|n4wMxxe7 z9GItddty}VOlsOosJv$t3ZOZ-I=d#l_2cPGPkp(k!K(ibM!!16ZuNqb32p>h0>ln1 z8$Cb3>kf^j@Eu&UxJ`%lEcxvv%5Pt2YN+c}b$~3&Zf`wM)?=fqX;Y9PcPO1pXOL+v zYF_j6=M$t(88?O=PI5j5MhFqri;Yb&E}n~>iA-4_we`I|r`|yssH*D$==NPc6f*t; z@%7mrxuDk`gpOrv6TK5hbJ~p(`}nN7wXd&mL8tcO2_>KNnJ_?>s2Clk#r9OprKh8R z@nXFawQO^pJPo{L`#N`&ANt8fB$cHLAjLmJ{a-;qxOEgHV&nD?JMHcdr4m&}O^N#h z7rljC>20CsW9LgY;w*iDbrDXgrJ?fN<DIYcMJ8mllpj4QF-@;4dwgmW~xJmQADH! z@)O@R>C1!A*00>6;z24ej0}7m!0@3}2(}{K!&E_Dn~RWIvCm`U(;s8BKD*a>3vymo z)c*Vgx#u@W+g|mN4!O{5J=dRp_rfIWL#bZ2xUk{q z_$s6wu!GCXc_ijwG#a{c+D8VO2b+vGd*6`k3Ww!n>VSQHeW3yEw03Et-snvf3%z(uGMts&(vEv|5q z=bVRIPn9aZ(|N9b;fX;smDsmsQcpG&pyFx zcf085cu{xsD2fe*oooA7QFFJSWNc|Lq=#VA?{Wm&K3%w>-+rA4tv!?qf?Z71_rKt< zIPDs)`B);tDTwG^n&i-FXzgqN@LqXE!DTOKaPHEXQp|O7w0-X)D~*R)kj@p!!qQO; zX)3n2t=>HD>snv3a+kW}V+jX&%Q!E~+c5gerd0y`JIUW37ciVAqGW zNn;FUm&YFv?IW^6%!IsA7c^`~p!{pLg zc>bJF^&_SGWM{voxm?PdY0XD*8JKf4sR9Guhnr`5*LP_1FhD8LWqtjNy`l_@&@imz z8g!&E&?GpPlOvE)i>w@^%luz2V7A5@b!}fJT4j%m!qdom(1eW_Yqibn|14!Q@Oky$ zh?2K-=VN{vN~we9;u_zyox4LDt_hF?_@AEC4kq#LhfgJ#nwk0DZ1eA>1a($TJm(F| zkB$5pie5v3#n1<7c)&<8>!FY%BRL)0pSkm2!@IDXv(29cgiHF(P0*UNvhcZSEMB9@ zf1=CXTSpc9g_dLZ5{%1sF=Bq_XN+CB`CZhMCOf1RKyCHGVdyr6dgt>N#mOd;=PvZz zpv_~BmJE>h>=O8<%IWmFD)IyTT%+Y`BVq8a^q5-o&GNhiR;KlG{`qh7cMsVUtj%oo zSlf25FqV5Qx3{2l^iBe41r*?>de+*=A{`l(*AEu@wt%%P6T?P&$I#o;SL(I4|Me?( zxjQ5=p{uwaS4LJwAw!tn%Kv<_7?=uyjaEgls37+x=NG(pzY{Yoi`gJ50)4$e?D}Z> z2N*Q|fpM;HP?s}O?)_SbyeoEn*>aSe4AXV zsGGQc14;eTH*p5VR7z*3_Zfyq`69SMFPdLE@)RYWHqKcGAB>=YBd@uA*{xgM$FK z(Q$VYXs9e0ieslFB?SfP->q~TkbS*-$@4GU=P9PV+H4?$Ktq08Kr>SV;7oCN3rH`E z6(d2uS9{hh@%Usy9s`L{42m)*U4Lnvz~^hiy{qLdNLM(SmXgxJnj%ca<I&Uh_7Iz#l>DV&Q^IXF9T+{My&2CR98& z9IsxLyW4jIFI!Pr838V?CNN6&yWp}qya^%@Bz*eC#KvN_@>Hk7eSh&9k+4K5;G!n3 zdi&>mX=G%?>32Iw z@aokRfC}BVHq&@FoVvL4MjJV}CHp6$ZV_h!A;4;EcvcllEluzybzBP~c&paBB#(5`^%7I#=i z?M@aI6pUii(&{I!p>MDE+0B2$GjE#w2a5OlHA|bXhjs>a+0J1a|H zyD!BF*jLomt6QB(00xXc*!EJ4f~tf#IXcb{e6jQtaVKDDzD=0N}K3|!()@I?E+pVO8si}j*^d%tE9!y}Y znVezp*5@LCLCVJ$d#S-S1*$xyln@^u@v}iySwAT)&Uy8sz~BGFKafm7DHCTIC!(}- zplXvO0}SXJos7X@00p9!9FX3+XuGygIpeuROx;yCGCmN0z`{~Q4ZaG$^+NRVF13jQ zGE4}?gTrou*~sz9apZh8KS%9t?FulG27y2g4fXmhL>>5?JUp>cQRth>YX2CZzgkXx zA8zoHZ`>V_)hJ|U_PshoZ!;{;*)rw7FHfOvxn>r=F;lSfn?5}NP>BEM9BEod0+rTR z!#G5hH8dda-hH0NbISx;dj*z?kI52~QX;7NC1q8QFAifg%dl!2tDU<7A{D@ zj}rPPMn>3KS&d-G*=Bw^!II))R<>Keu|NDHq3wLif{v>I^z~+!C1JFJ-Jk`K*%<;+ z)92;Xq_G^#2a<6^1%#&0D=G_$i|eTTVkprg-5IJ?ogE!L-QCucKMR(8uE+L!KK*y5 znUznMx0o+R!ZW~EY$t{;f9B?n!zaodsm>za8;1Omia^a)*DmBrOG|rtd!`Gx3LQ;S zqFV!TH!mYeTdX&!&RFJp8OPoOIQ0^Hi_fQ5PFh+?t*v3_+}sr86uMXEgyhTl`Nd6C zZq7Zw+M2y)bOEVxv8I+%Q5u?Gw>N791_Y$Tfbj0WOT^>(BL^28fTBmVprot}-IDzD zxh_7w>nK;2D2|BoC*-cfAK8lJiN z6JfC7{_MG_sRqf8A z4J0ee@Uo(ltAdM&lZk_cdIfdf$Ku@I&kP90Js8qkSM=OekW)5vG*spk<5AVq+1*=z zYkKtX3b3_%>BDw%@nh_Nv5)ZowejjQj))T~wvYL?f>14&YXmT*uWPkSemwh@A0EK2 zkqmx$#0v?4U`V_?`0f}LFH3Muhxt@OR*IjEGm7>syc6P3@6SQ8apveMD=lO4&qG18 zuof57+AD=$WH%y)76k8tS8yWOvwqCU-I1U3I2PyUY)NWq&7|cg&MCVmBJGc2f8d4V zMW2NJN0u12{QFGZ*H9xcZgV+PSWxg1pu!g}$8TmUpY?d0|igo^K-b$4AFU~}`L&D;p^Gqi`(}SOCutml{$oRj%Yrhx^=K1HFfIZ%h;D5^q zW9#hyCdd5$^J~SRdl+9MD&0>hg)PgWesH%u*4}3DX#l>a*-~ z&C<_DZwN!ojg5V`mhAv-t_`hZz(yrf%x_Q_Z)ixNs?F)h>F=|DcmDTFTgNnYw7d-0 zbh^RG2^r*UE39gOIjDQL`;s5i%88p>jT#`_pl+HTwg9Sqa&)u|28f9YvhwB)l>pQP z;E*vSy=ww`i{HI}0LjTeuaq#!7NC8-%w%n6)pUSrBwEXa69*=FZ74(!AovIPX=ogN zm$}2!>CaK-Z}oJPhSjf(8!AiY+(cI%u9}*elxiI_{rj|V|2|_yt*vjUFs{|@fRfEO zvQtsf1Fso4_=kO4gQ`{fpvko#>*~BKJOtHpr=_6bHk6w5VE(G8u)x&B1i4tr!5n&i69Vvb@-lob)*@j; ziJa;>QXpn7udxkVFE637Jo)nKa)nQFv%goCnwor)M@L7E)j6Uk2T&a77h+DV!||rA@cl?tjcNv#G@f2W3}2*uCJedb>$^EQ?FST zNG0f0yf3PdB4oLxWI$|+@RpW7bacm*swZ$s;qmm(YVk8wS9kcdHKcc)oRVyDf%XL{ zqzbI9o7mgf=<4eF>|GSJw&L!w@>pG;Eg+E(2IRcc@dRM@OZT#_(Tk1teLa0X$AghK zuD6Yjw=D$t19!tPcQw7B!O zx3`r|tN?n7qhnLHy|M8vkgsy+Ry9>s*_`cd`(6nIfBzmyDypWXE=VtAw+7P*3k{u? zPZssv8Ga?&CnICicY%KhSpT@rJ>=o!OXdgH#N}d2$uJ8Eo%O631BvHe{*Sfp2-1}) zt6r7SQB?*-Ql1`F9Vr$L{=1%$wfFC*rnk2l2QtLwW_kfhXI>`3%Yh{4EW;K5-RQWO z+l%aT;<(tBi`6+G+W*~#GePeNi7~$BF}+&1I11-Jc@LkTalNs^**rR=Qu}4_D=CiB z1yPun(D+jhG_skRnp#Z_R-k^-Q~?OaXb~-B!oyy$kqVg{K-uOJ%09;>C0&jrpL?D0 ztiZV}M=y$|{M}Krz_L2sNGW6UarKk4nMe9!dnJ>?(?DTqK=2l%W83fNfPr_@2<)UJ z!8eD&v$L~2KE0z;J65}X*ZTz8Boh4EwgXM|m4Kd@>)uvxXPAbHg`|SQCkA{p`VU|^ zbJrdo&6Ro|~O!^>P&j?+qIUD5eTDn{4;B z9+M=n=}j-?a)602weAmLwp3Vc9-e`E2H!uEO0PvX_vT-GeJ?5x1kBsI{7An+w@=sb@*|N8hFKR^FbsjQY3fDR(-{9iAiA1)RZAFtJT=KPWW?{la4OTu6Nkt3o1 zWaf_Yx}HXa{idhvigaN4cuFoiY`UZ}UtjuMB+*2yzM9gFP0FlWOr>=f@h{Iz%*BgX)+)U<} z(l-iZOxI`BeSN(fk;z=1KFjsE_wH>1ifl$k#_p&Y#ez0!Z-mUjg!QYqIQ8y`w4V)x z+&0rs(fLK1;ubc(dcNYu+4;UOKUzp>DNxanfcj}TA{%keL&Ibr*2?S1hSj91wA9qZ zLnwem(o`t12IRgU9@(g)r1UB41*IM(AM?13yz3xfLN_=x1XX{CsaIZ8VH8Y2wo38x zrPH>`)4=Bn8G=$N-H*gyWz8nf8i212WUR<-|IB=SH@l1-{7z%15)R9vmF-T59_gA* zw)A`$5P>UUTWSD%UqJHwr5n246b#Ffla1}3ojs~`-9^p+C@3w3;xKxQSG-}rEh~kd z4NhewXvTuCW;9)0UH{#OzR@%5r6pOypEvAsu$W_H?)FOmtZUeHwsVe&js01<Lt^yh%ez-W8Ge5&l2e)As4u99GY3Nxi+ANg6#TEJ%jD(dIY-Jx zPP`8oJ}F2Wi>+@Q3Ju9ADEMCR8k`zpwg9PHm1T_X)hX}W;RL%MLvQHl!VJoO;FM`e z+3e{Z#%ynIVd}MX-N{H;X9T~;281Pn#8f(_3s<46s7UpQz3~!zoMeZmM6j2LklG}`(78}fEn8zdM;8~c|>bwrfup2)8Z?E z_l=hQde1$6nlQF!)GFL_(P9=u8WD3JK2D0C8v88)eIa?fCc&ISNThtXLv> zHa2(dUO3CL)N3c_Beiig?V6ci5&d}?#m`csMNa7HC5g=X26}8N-{9ZgAxJWEpitkt zKOFzuWcL6Jsj1w80(2)ZMNAqRt&$@(KPW-cbQFfv zva_#m^D?9IwI4#J$2_AXD>ERVIW6|*_(ajGl6Wm$-J`QPY7Z|j(yd+jBq7JX^&cqk z@0tl!s-M$Uwi}{naT)3Ub#m8ZA>D|_itF^>zUMwT{L;%d)^ffm)qDTh>u(Y`de7~* zs+Wfi|M(2b$&ZaTp6fUPfn%BOJMiXBZH;6zHavUzT=LW=TkvznffjV(s=S3(SUxF|45 zOA-C^^c0V+QjC$o+;o$NpMUPN&Jn}!-&H-k%Q_0SHYI=l*uSBtS9THCP?+rL2oWpH z%8H_;%aKcuikg|8UjMQrdlP+(dptNeNM)PSnH@}2QQ?%DmL@UCD3DtpsHN}se$KK3 zy>DFI9S z0KZsC@RFgEd2IQELd4X>jE{$}?vabuk%gLMd~$LjAcQzfcD^s>akz?ri{6D8z5M6x zsr3imo(XZy1oZ9Y<`Q7RK5$)F){XIQD%;iwWQ53g%uIeV^Lwhbg*L&(!p;5s9y4LZMFoL`0=XFC_4;tZs_Hv^Olf}+> zFVK-xedY_~XOcl!0L#WqXw}avC? z&v|oTHIi~2q2R3iJe*oAh#o}pblPoYA9-E9tYmLrw&jYK(+uj%44=M0~og zKgn8v_x5fNA7ylOhBd_=o}L1U3FQiEDlhUN;c!CUb91TL-FpvoZy$Q`y_%~<;o~+( zkp7jPasdI|(`r&ua=A2~_nMI;vu`;$nE@pmr}|EbCdmbEa|H?!t2e&QgoMsFTfJ97 zSXgh&tZi=>&J9|Qc2o)p%rVmW@O+P>iqJTV$8qQL973}vU$%a=;o$s0ARoawz0r)uJx8IA7OY^l2AbjfGb(b9-IgxPaN5%P$iz24WV^}mk4>ksda}-|6YdeX@3r>gEewQl49XQ7QEX;QEO%ra5 zK-OhBM&CSpwDaOI!~S%At!-rlgQAWyu(jnCLPeds#-}vcn^PP(miGc%d;^8yDnN+o zWiS{@0qw>pP5~M?L@$WYC;dW)vWwN$2A*1hK$G(l*K8~pvbx&(u7+EABgGz^DrP@v z&5~egZ9T$nKi769+uq+`g9Xir2S(|n-LsJ}4{h(ib?ia0lTunyu(s9fHJi%DacjUQ%{Ra^S*Q%4#Z8c9PbL> zb=6+PRMOPUNJ=8}K&yQH-7pq@R}AxFOSHP_u!k=$%uU|auk2Jm-Kf9V8>B8wQKQMyWnP4FzCYm`%17&tASO@6Y2SaOrS41>DW1nWy+C-+_ z{Q(KNZSos8zv@VcsVaKKGvNdOxA z_wV017nCH;Hn6Gv`Y?n==<3gTPrYSCIUmscY-+k0FNi7Ct=G`k5FLO|^^dLfm$jG! zPYxqX*JHATQ4BQJH=x}JFy9vbPqM}g%LA`RJv?`V37?Q ztr(@1QdCIcvs`Kk*c{T!RK_OQ1AGP&g0C^SxyQKgZQ@f23mI<^NqKvVi~qT~X)^9s zEC*mDx05@I&6L}b`_RJ@{-uPN7(yG!>KA){_eD9?m~{1t2|$Wqw!#(rI$A<`4vtaf z2=pe}VqVBTU(4LW0=f~8{@B{pR92=57}|&%iz_HBQt$H5*Aou@ybnDC|9Tx#-Z8S z`{OwltG(||cUR~oyDH7(b($Q|L0~=rwcvAfhz%5F_RZJdAWiK}o|SP#M3@O;KnMav z*#q@puNY`qSXfjIrVchUD43qEZA^mEO*25V!_bi54~=jKerls<2F5rybSJ}8x9ejB zw04VVWMc-9LM-{B@QBspfDBZA;EWr?wqv30BlwB1>=+boir(F!AQ!#b;{K;KoKCt3 zIa*a7U+(7+O@HfGTv=%>ZMi*S%rL89Y-c4i_T=oaqP!d+B;nvSvahtmvGutCj41bh zL3Z~3mIcG~kD#cmZ?UmzPEMh3`VWsOjJ{-2KO>t!#=0XrQbi~}YiLlByU_~KPfm7e zZ<(kU8e>v}d(<(VsKY;$l*xuYfR4Oho+9{7Hk? zeqY@3Rl`+ZA+vV>P#WM!60GrFS>G4Q9_uUcF4CWFkF0=GZNj2K1MM^Po^6 z;k}K674f1%Ya^poz>nZ!t$wgcfh;AZ-YA~av0dQGI;r?_cH)cK{WS-?FtBvNr%EdRM5?ahSd200m7B}<&c^}pgKnX>P{u5}ibmI50p-(&*$(915P!pLWFm9O}GhWs-@CBslgVO1{qB+EvnUn9o{>yN?!nU=u!^g)5 zbaQj`BfA%SUjqU0ZorL;oP>nK&_(fE-TZ2YdoP0B za1B~gx!H6zG7CRGKKAu(n*Lia1HF)bNFeT_?`Ak$OsCT7w2?)l811`|K~(5Ku{9gj z$sLwZoXQV&oSR~`Un);Q-y$|q=J2F#1Y!{ehSfWp-yXsYfZ{qSFWhZ#zSir7`u}{GtC{ zB=V8GT0`j0j@4qob5~atE&}{MApbscI=Zu&pP!qtY{i(;ui-0qJha(*uf4PVkOp`V z2Hv+Nn)*p71gFFNbX3)}H;#1U`5yQMha`Zf>;Q5I#l*MqzVbF|Y9|Q>e*CUGAH`r< zMD0Djz4Zx+A7gm=`25h9{4DVt=+gvL3PpFNBMXHaY zuw+n3-ClxmfOh6*j;S*6gk64-w0Z6ho?`+cSN(T4mG&F(jN9{!UFM=fyZN8f4XzCT zO$!#tq?&_89=vv_*X6d}U2VU=;hCk<444B_gKaY5V^DcFhuQ-$v-D={ zRiiam7gvok?Q-jLG$1w4&2g`ps(}K1MJ>UoGB!qbQ8qR@A}=c!yKdWIJ2Jz3QSvWt zVeFZTiU$Pm?}m|{Q4={GW^QOo=}D{mJEQe~W06t>a^d?k+92>Hf?;oJYwPnB|Em=$ z;zhHe#J&txQTFsp)Y0i_K}kUiA*HpUS?d~6E)EITD0A4N8(b07m-@_^R0a?m_ zK1RT9R?Wl1r`td@?&jg9F$7G<5)&TeejWb!-(Nh%v>p2Qy}-zv`>Uk+@25fJ@6h3& z&;OTSFMB#TpL@9W9@S(tH(|rQU7sEEe5wN~%zaC4^D@8dX8tA5jP0Ps%P-+^)p*AP zC(e#~0FV&cSYA<{*7#**4h8;*J=H$C)67fF%@M9(g45>wn!18E3=6*x0g8t`w7+>}-ez@UB z-d3R&s@MFy$j7Qj6kC24?}>qLl~wfyT|ANL`fg_tDg5X`;cs~rPjR-lwptoYW(byi zE>ovK9zDac>+8VCftQyLu=zGMHRIy&&yA}N+rp`4SgL zOzK|oPT^2SUK}yPv%dbx&8ABrt&V}F)Kt<2lzxNm;Enm~3A$8K-`B6$O9_oZS-&%v z$!_avZzTxj;`3T)74b=06JGqCQlv?_KPQ1_tbqsNyI5kmR#sM3X$!9#?nSGrD-ZV7 zDURS>0rh*e_4SL5dT#F8L>||xv>qMD@{u@VVxYFaf4ZIuD7=%Bk^$B#W`X9D6O%hT z+sZuOk&&v=G1_c-1qE6f8k6&*%%>}io1(rz-a*JE3 z?`mR2Xko_PBV$5BCZ_FyfuFed%=`OflH##V*@}yw6Czb+ROIDvyX|3C)q|2<^Z~*6 zV-q8QMh9Tk0f-#w8b2s=5pf>6fwcQzV$#K=LvwTKT(ISGby00Cfx>6XU!4%?HxGE$&3AmtO6VlVe_9Ca^y=Gd25Eap=!l zVmmL=%V02^tO_{+|BQGFrrv|P@bG#LRpM&BQCapXsdia*3eM8Qvvxp}$sY%&s3oH-A4 z?d%lhX1ve$H%FJ$^;9d1b9k7KG&;f^$OTNM9rT*1uH8_XaNq0Ga|*yXC3sNHd80WR zaJk;^GgY4ZLscxh`5?{fd}Mf-m308-z)r)m+h)uQd0uH-@i*YLejVErX~f> z4?ydlTaT^rUfP~_&Q4A)IRA==y4l*w`{=To+OQ|E*wD4t#yoRe4U<-s>|mm=;}Vhv zuEqNc9NE;Q>y6FOfWN!F-QU|kQsC}zw|G=hp+UjGETz1-JGB%Z(O40!;`d$@FK=0| z(c8qziqE6xt@6~<_~DZ0!WDn}JvUO?pS1xjG6UUWoTieEjm>&S4-amd=|+6~yxE4G z?m%wX=FFO`r34Iwub@z9Wfi;s=Yu~J`z6gtvCYH*4%1Cnt%MHhFbF(lr-&e>m;s0@j6&O9!^hzM<;=65Qzz6WiMenGUl$+fg z>t!IMsYwo4dqYdmE@-3s8he^pH&ubV=x6Z+B^{8rP`#bh{F4S3<*h)ko1B7CuF>Fg z6oSLKvyk6zq3QiLtw(Z*^kZe5IXkKV_J7n!^L`-T2b5tU5F6wvCnqm?LhST0sSlrq z`ai=83i5VGW?q-9&`QZC3I`(ZEb1T-z^eWwF$pgZ@AbKR3YTry8C!})U1&vLs;0iY ztOB%;umM$GUY$*bNs^yk#1A0!0ZEsJTFR3Q$9rw&G~?#(ra z+4XE8O}bL+@6fjl-nfwLA{{NQdV6?jGGF8duum$c@Pg==wtL!c)jSg4dL~04tB2Xa z)8!G(*SZ9Fc*5>M$TwA<#(9f%ROEglfW=*Fw>v5LRr;c6m34Q-OI9{^UM@}z4Q0#f z`24wNGBTmII-XA)&Ogb0$^=niOEKIjXQRw>5?+wV_V*}#N9^^kA&3z~Du97sXkB0Vn-)vz~2daH9 z6*+S2XwrP4(gh8eZd5do2@S1qYQQu7xFz;w8PFuyLXNfddUkA;yMQy2qvihO4JB&n z>pR|TtwgWB_Lj;k;5N5kYAWA5RAC{exs{55#?W!?#5bqWVsZf_sMoZw^DW*NK}laP z*s3z6)qF>~Gqt{=Wy!X;aG=|IKGeiG(cTjWslorYdonEtqqHK zytqoJ`gTT#O@6$9nf?JTxv)uob|p74DdS6^VizA_bn^&i*D}q`Rikl1E+iP(Il4GO zpL@src6;o9{h{8sBfngeT~AIpooUxekq1cpX8^Yg!dS-X&09zzFHcbeYW} z^OrwLh0{Abx~>_BKa{ReN7Hr#tqU=)gLle~S$PSONlBh6DzCw;w(E#65=KYHHzH>9 z7ykbD`QCn%Y8{xr84WyE>&R1K4?HHPpxCOU`pu=mm_R&j#3SudlvWP@`7HcC`-!#3$uJt?|DmBVGiP}d?+|Cs z4ZHIWQoZo3mxHKz?`8XkQb3%iXS!|^u=d<~g6B2;+c9%9Gwj>Fb0l5Qr~Z%zrS8r} zGJeCyogC8!ghDVt)6xh6d87FF5Ql|6@_j;}0$@EM1n-$nwBnwIVd9dE{jz@lUX2}C z!14+W?x!+O7q)8}p9*T#b2CJ$(lJbADDjp>MR870j5!o$X5KfHcjdjUNEh|gEejR} z&36u#w3H&(53?~ZJ$d5oKvd&1PIXTbtiM?BSR-!^cC&1=DQrguMHb>l+bxyV)C62t zNhNe__V+FbQ$_t^gT|0m$>n8X)~e!b1pq1CpGAaieOzA)>)I4EB_mSY2Bn4!%pVlP^H-%n%wSC+EVmP`DT#33A$cC+-_i zUXFv8gD}8pNSqqIq8DP0E__&Uq#K=kik#vQJY3w@;V&=}#V9MnNedVckG7Fi;2oBzZt{=1lR96IVt*v~n0<#ZzBaCyWbR zq?P}HjfM6&u2a@PujwaqOMah%f<`)}M0J~|r{~WO3kgimOCp*~xWbSxgjzJ}mCW;n z@UCv<`zmQvfr3{j&RO3!Uc?J|c`-y#LCDRp05|og7}6i#s}TXcoE9>_G#L z)#{o7>?4H*qTI_T1si6iF@*N+9SqPf6}ap&0|m^?4{#xG@hBsfSu~A|A(p*rU@D*e z$DqRO1XgA$)p8|m?PSYs$Dq(jqVVTJxyvne-kwV>t^uW%E}cD1V6m+u3G>Ys%Gv*x zdtkZ|Pij9xDVHrUdRqxO-S7iK!K0)MNPcMptjf5Gd%15X6vnhBt&Tg^8D+%#?y49Y zqR041Uc4BlD_;-<4H&Y2M3&S;i(^tO7TFw^9Dh(;E zLAKXdRz;~nb49p#c#MQTY{B0*=DkHs7yo?n_Q~`V)vxU2TwE1<`EGnF2usM<*vYH9*`Ya0H|06JB5f}-97a$3*P~|(@j0W==}Iu1E;K`|K$jn|Ou@~x47EZvgub^vZ5tCLrV__iqgO#?$MJ1*lqUsQ~N zKjkh7$;F_MURVf?PfG$C`r`aAewsX{I&=N-LrF`kwD^SP_h_TNSRofgNM$BIh~W7d zyX1sv`F(eYWkD}K8>Vt$Zw^F4WmN>-Fsh;oGyyMF<3(*~l(c#q6I3*mZLdGokS1#< zyUz)a9E@wqBr!1WC@V3EacC~J{)+m#{C<3L6#Cq+h`&;4!}9c_2qO3v(CT7hQHAnW z{(iZIlm<7}*k`?_E>oHrFn!Z*m@yvGLO4^KfgAT?OAX?!8yfo~i9vJu^H{u&_RMb` zMi$!ZA#7?K1!*$qL{n^2)~l%t1J&qg))Jef_&nLIp~k#=LAvTDh>ypo>961PU9#B&mK~#}V5jDY>Yo!!B?y?ON^027d|UgR7ecG=JaZ zW9o&`sOlC|*MSqMd;ZeF26Tf`hhNn&o$^xxXf~n#n1r65UP&(gwVBOw_JolHf>DMC zsHbFEtmWAjnFbE74Av=q0pM`rM>;k`CR5XizR+%kzstyve#@t~ca?#+R^3^mFn1GN zT3Bi(Tj+8xuLQ!Fvm8suCJUvNK#2RvdpkLeVz?`w9p41XdYvp2UofGn@zx&Od8)hS zLMon*J^KL0pA`u#SZA{O_J41QxFr9r8Pi<4nF%y@ji-gR*VyR}+um+_uHbS~;Ag>85VoWzOHg@0s zKtt=OQkC-C=!n!s>n|AAMZZW?U<+z^R7D2VfaxIbhT^KKJir1*%Q@FHrxRO1J1bcq zijek6K3{CU2)I5U6|pl`9h*ayMOhU*v3ylr+_M4{125FnK>~sjQVa3FYqBm6jTkg( z>_!=DynWipQmDYGEm`j&l26qPE3B_IaAjo+0l=VZ?!ou(BJns_?sZMA_^1bge8SkC z83JAa(IC;T8YsQB=cc)$Em!$)^#o8wt&AIo!GCl_ScbMQxTAC>J(BK{O4W!g3%cX! zJf2#D3fRvN+HQY7%qLH>>8+FXyZeYpmf~Ll-drabNMfYMXs06h%2% zG7Udv5NT@dU7+Bv@2=os5#2QDBA5dO=I(r3Vpp6rdYAmEDW$A0HuW9UXar z4`bcy>$-7@-=eY4({QabRwmngB}C~q0;6T*M4!8e#*HIGs6!4VmMmLaY6|omQ;G1YQX`>Zq{r z;KkX@LeGfw?}WcXdFtLu#ZjhK4V+HhyM)ORhV9ps!v+Vxhwinnw#+0Ts)GqWiX+>K($>u z#H8cJ4Y!yketKU*w7ii7k*P|SvJ=>yH7lN6nC*B`hhlq$l^>z&=4oj^72i^3+u2H$ zFSV%84V5elE0Vb5BLYV@s=E-wu_WnH&sdj_y8Q{6DS4XO(_ut?K0z4s#aV-C`Yam! zYjm64gAXLGY&v@8?EL(64&5B<yy(xHpX}X(Z|NdmezSPwl0N?j`@O!$W%(s zL`y~s)%hvRyRxUP&9h9KoctXYxKuOvuFo0AS$d-xB)**ojXNm#f$qPJhpWA2 ze;F)}h$KRJ)`a+3^9T8uhO~2ea`9olGE4MX5lx295ZcETE{0~wv0Q-Kz5ZE=9bU`z zl7J+{Eg6lcX=G$X|EWW4j9yvo9ow-B)YDTA^(i01!t;Eyi$zu-x>p2>3n3Irms$Fd zughXaxWQp!VoE2EPL}EAEhl; zb+Dyo$i1RZUOV^}1Fs{HfQ?ae^_yddVBwXip|QVjt@YAPbsye+|G+?L1#HZanvTu4 z!mYdAzIqCTV96fgo7&iso@HSkD$6N#bC^FDxbf&m8_VH+rJ4)VYa8x{?q-E{6i!|} zp%NntD-!gjmJ!XA)J;7-BFqMD6HF&2>6yf*2og&bt=h&?QD5j9szWiZ`~>)&$py6U zKQDJ2`LJoH6kYcZ;JxintsScVg?aBcZX-xsE4hg#Ect?cb% zJS@!|9XrC)Rx8RmG(%G`5Rg>=bPOcK)Jy|ILw^KCI+80pUf-EMC5iFtSpsNCaXvm7 z^@Z(pJGzD~y;f5Gc?<2pH1p*xuYS&^H*;m6eYqZLPfjzPtN74j86<-pFPKLEpEy z>^kSFs&c&X`;k(VEybuz%odW%vcW4VwP_GE4105lpJhA#jVzs-jOttkzo>-;8s^q2 zCg${98c>&@*U9CQ8p9)wMcLIczmR-@k2l{mRFU4qIaVDL6Ia@j{S)7rwA&~+C_4s@ zYTU7iX16n7JK4XrwUCAJ!Z#lR@!t3+$2R3kfQFC|isy0^Q88abHb2kCdYaLfl*jA+ zlZS$XawJ261`bZ`aZ9zWIwn&{ex8}vu@a|PJZFA-Yk%@fA@6zL9Ta==<__j9%RdMo@4 zx$DaySy{t-lkPIPrQ~GOr(Bz{gTwDXdG&X5Q`fq{zc=I0GSVL!N_M8Brvpz(t%RJ} zJmU(Fr_h~|(|~*0--G|-(m_W*^%M9^rs~%DgYsXOjwBloHM7^z^EnF1t;+yx&~8YQ zN$V%cyHGEy;CR2}$t$Q3C61_+mtKy%R+-f~!%K=`nXIeiux)N-lc60H5V$2NZS`Iw zd7JM~THfmk1`zadIb3SP%U%|e9`s;ky&c|Dk$oBy6?NVnnm+r%R6yWrY9uo{68=jN zScGdGXfWf!!cm-REY)lG#~Tn=SCp&PyJk*&$EVjD%h%AMlddB;75GTWp?E)05u6ZG6xC}v?-clTUiRY+|3N5glrJ;^n9Ml#HvfnVIJo2w|`{H#^xFHxUH04SIu%@Az)KaI1}*ufL>SNJcfTRS0?jK7VD~<>jSP?6k3m2?aVW75>`609wvE=9mOB0#ZGQ z)XLi1x4GZUK6SJy9ScSOpo{ljLXHmSo8(|R5*5T51((j@ttx4XvRe93waA;6?RO-; z%Q?F?cin<;IpA<%|MDo~)l2^0WFmSz4t|E$e;+^Az80*;+i$$6RWbwd@fl1tWwbE( zzxIhzO{(!`^ap+8@nZ5!Sk=L)*5XpDHeN$ z?nAUbh(kV*3g*^_CB(|BPq>W2rXzaBn8ut{RlF`P$7JOcWM#ipoOFlYQ2mz{@JLMW z)$NI-!!!r$(7-D(fwu4KFoYMZTvpNdar@4n3|#J19`W-|Edl9@n9XwrJ*=2t6}|0d zUHI!LHIQtR8No?u=!~g&HxQF}E7%9k?yQV(KZUL`JDZM#oSco$hbIREf$|PZY%}od zkL2GzzM~@(nQg-{cvyIpTc>Q+`~AN57-`r+l~`*JtwFRyB2wSMH-rbHQm06BvOWy~9(vxUpFlP+kbu3h zvGj{|vK8s=G3o-d(3$kSX-AJ^5yWGqz2WYAlAmJj4O7l`WKp6)BgtWm;W;lIaLa0E z-_jLkxZqfwD856Y-0s9%^8e(K^w)6rA^=uAm8}E~kroEjr>wm4{0#pGX~|Q}=!0L{ z+B&uH*8oCDK~9creqLs4p4N=|^xzp8&8anvkYqVM=pcS*tXzTzOGihCy$?W|Kx2dK zgxvZ2Qs~9(BJX1w#0P*%V`+L;8mHD7XU=yJ>j?_S$c(7~#{Pq9(%LmQC0&l2X z*8;AZO{Plm7V^ftbF`ju_esoMYCElJXw>8c#&!VOz(;=bo7vSJTm)-V-Ap!=`r^tkL2b7|WU8q8Go4 z6>v|1K;uQT!A9@8gwEjze^$C!&MzVoS3tqI+Gjhjmyqs8pyn4zof&R>egb6Y$sPMb zTAC+3Vdkvy>6Gd$Or@{bW9pONndF3)&>z1QavA68(%C@psW!Ae;r>iZ_=Jw;uCgB;>UE zCj8?lL3Jh$7f)GCz%y((blFmGfcD;6^|(qwK73X9$-4e~>PT7{fnmdgRp z9z2QyYcZSD>EY}_gx_yeLv)sjUPv36(l9KzI(~dBerJ3}U zyk)M*^NSEZ+m#g@ubE19S2i}qbpukqDjzOyqs>(!@6g{v@4)rcmOa2n7*<`M!sTUB8ho|bh31oA18|S z3J;G#JG#Ng2Mo(Q(gQ%GyKNei$-BqVL|@jJicmdfNxH;xGi)Na>nPWJ15)qw9q zG`+Jfpba#_!l-Xm=jxsVyHO$MPBZGk_y#p-kL$DFN=RcY!+lrai5G(qmYb6^et(CA zTvkzTef~BrJzG^-neWtBfm&S~3ormjGu3&xxSZMStDD_#fQ%6t#bx7+0cBifZ>&r7 z%XLp_zC9@e?<-l48p}9;aSpchG<6BdiRA;I`Xezb04YK4AgJRiFJJEHm`QAR_w=MA zgV*0PeEME+-l?ti4-|1wiXA*rkdlM2=@H09%FD|C^7fkdf%c(HjE$v+kFwCFMMy^& zHv*gWm`3(XaZ!n|Xw~*?Ce2vQ-Nmj#3W^LRxIfU)E;5e!P<^ZVC8l?E4xZw+Deo^w z0LX2qch;S*a&x4R$9b;S;wi`M=%_JxOEo!;&eFyrCM6Y|G1fE$Ne2KkLnnCCJ^rq8 zv8uWTjJxL=8HT^clp6ADN9^PGK|o-f?VSAOwY{|oAXNY`r3SStD0ah2wYNT`&k009 zu5YKdYF^DgJv{~Q?OH)So|YS%Rb|2&QXLQ`VANAk?#1&&Eeg$jCs{Q!=oT zf1}FYO_0zDZWgJ)49fUG_0G3@lcgC)?JR);SeVgAl=5{J+v~_mp3$Y>dfS2vQ#XER zVc4(7U-EliA|eWZ;1UxN5y?8CG!&KsVMF8qf7sR+$3B!Lo|?}$f&n3sq4P)k3p!5} zY8P`qn;bv&e6hK@yRi%iCyGka%_76x)Ch-%8M?Z>6S)}$rr-6gb~@kPy*iubC0Ug- ztLKaH9rmV92&bB|l>B*ctmzd}7 zE@vrYDZQ*}57*Y-E?^_ls!j&9r?T?W%mv5{8jAT7EYu&zm_?Zm@1Ha=fq@{@02 z(0tzA)Ai;KNtI;t^%)*r_u$}H8Ij!N;w1-j^REYE@*^TH5UgX%kHRy#iHkbks!TeM z*o)KBb%2KUOcnZlWATd~j>$n?&7s?4y;vmz{*Z%A!J8cWDPCd2lgYzBp#_11oVEsu z@5C46de4rMiOFYute)yW#6QK9m5uu275DZEKqT^niJjf1g(nUS&#d>xEO8I!3kDHj zkoJ9lv1xfoHLooPuA*!lAdy2k%Zr@M-qVCtI^aiy=oF zlT6K}12iH}>X^N>%)V$<1%*nTV*x}9u#NB;7)U%eTmCU?YnUBD1k~izCALQIR6UqHOVK2lYA! zWjca}&6SE`sxQ-#HcILDMpW@JJ@D}G$h2Gf$6OmfK`;Gk@rNebtZ&k~UJG~j^>Go} zRWxk>99sEsQ@v+fQBoZ7c#lBVAye6KTJYZ~fn2g&$x))C@q9n5Cm=AIElaC4UTYG^ zTq2UxJ=Wdb4aPgh$~Xflw`dVK7DZju<{x5r*%5E&d)P(^1hPlGnejJBKT{CM^KU}C8wsg zP_l4$+T~lKjYt!5nT+p*r=<~r{q3zS@n}vlDXGJYAwE&Zt7@oPz1=%XB9H#pE{I56 zdrq?9TXUI(;o-06^kgo>n4_6J5RC!e10MK{Ha z;kINJ^er_zr>5YPRMh!butRy>AcAe?=m7V%`I(ite5Aj>{{=?(Tnpug577Do(g4s3V_v#3Lo*1})jwm=d=Z!{skBU!l$EiR(f;y9Wd~w`ks-ww8<>R+8FqADA!olA21&)<$C`(_7dIzy|Zz3^c zAXZuSoB7@BRD~8lWPiC7gTLx*cP=|AiPrFh^-S7n#X(t^k%o+H5&lXs^d{Vv z(UT*@^pQz&*bueJuHZiE*&)0A(awar>qAQf9==9``|kU4ngzff_jPq~*zP@f`iKTa zZjhw4V@y^-CVTOuYXxY)*$y#0k*0gu6-6nvoF5s#sq(4v^G7^Cv$jZf$ox5ysb7%h zh*12*x)!AJ@&K|v3(?Ql30V4A1Mt$PFF3kqo23OM_FISe$_{`h6Sp*R{KFFeEhHv# znQ(4Fa@C!Jz@tzV)MArxe`KV;*3j3sTAtL1{kg}HJ%~wlVD(e7EW}C=Y~ZxIl-ruG zGFxEmwfiWFDDSDwSDMWw$)MNlSr+0-A1c^>mvB0_Efu@jM5$}L{_bXg*+2djSs zp_2o-&|As^ax{Nh6s*i*Hkjy^{EkDc;jX~yaq?1G5BTxbM!nh}UI_3aovWD`lr-Bv zIcQ$qjE)JBQj{ZK|MuVguO zqGb9Su{V%$cYgIBZff!=dEC)I@5byS{#Z(8cqzlF*(x~e;f*0DH$U|eA#$dS&v0ae zM~b9S^g43=8-Upo$9iCHBBQgk`UM3fzmk*DA~H$%d)@N#0M660!WSNRMh;JeExavh znNY1~xYuRxyR6lY2!*?bnx-2ZvG{Qc;Na3fkj9+s*qblxvCgNy#RAzvT#)S+@)k?4Njgc+63q1XL)TwP`T0L z>q|my6+nz@8@47^>A=V_XG2@tUuS1KJk8E-<*1+{+iLY}P9BAj&UY&v)*rf;pWW`i zi^n^v^lJyGa3LX;-kFt)pX8XBpl!*D>;39qd(vxz;eKd3}j zc1tQMP}21TM2bEIXQ_OFNnjiYi5%7a(r~#`ny&T1DW>Qqlw(qmQy{0zrQJ<#6#o2K zO~TTWJ#!Uvt%a`{sOBkgx)?I0vpa7qDpW=lW5RWj?{L3{pQZRgp-3Oi4jLWIsxFKt%nat!?g|Ca(OZl z)ezMtXV?S;zJOi1naN32=qoapbWLin&{qzDzj;EApCxQy@uZW^w6yS&_ja4CkD0Of<*&K?YPl8>5;x2$tSl~1w^Ka9w{SCvi8Nvw`3wlYhf_Yo z!8|&D-1pFn@ zVuF@8Dm^;oN3vHcXmUVR{9*sfd{KlXk}$ZZ8MW+Qt2xrMoU2{~v)H<8qe-@bh-v+EMR`*aRE zH+APWd|EAK29_~Vje3a%fDCZ$*dp*;4R=JZ5Aa*=7VkhUYhiNqrvJ9_Zn%yEfd7+Pt|BNzD$o+iE>5iG;2xTCVqeJ)Y>c zl5L)2MKnJtu}oqgOUTFoQDHMzs-Vw0(ReKr2b`OrzHI~vcZ3VX`Dgr`@QLB zk2zZ{dZP!|3=~G#M8B$K$t7xj_M7vnd&xO{#`Ms#ICt>}L0)*yAS&T3ja6iO2XqmW~k~b%r>q+Ie}lx+_EY-t1H)&M6j6H6&AD;w3i z{55kkxm@*D0A1DubP1(Z6=NbogvNeWS5L{hGt%t|xjnaeBBiIJBexdm$^sz8nb*1! zW@bRh=cq7Fam$aS>4FLA{P1PP#>I(^js=Q)y$uN&h{JKfrkI(u)9?s$(_ckt5ZCFK z2}`?G%JPDd&m)`{VZ#u@W$LVU!W6}5tjdA+}P>R2{h&R^8=M;hCq z1>J6e>`7aZbMpXNG3gJFPabH8GQP@YG8p{un=~JZ?ZCmFy5OlhwW>bMvMfdzhOZl?AQg7YvZg2d8&Ufa!t#ASY#6X|__WFDU z6^FjHvg%uklH$+3-&@{eOrsCR{@5G2oRdM8;K)V2=q=(?ht0!=EkC=G%CxGl)o|Bx zf(jDr8oL;B(x5nii{O~B0E7u&8(=b9DgQ%6#V5D7W1dqeFD(yz7*i%L<+PCH7YoMF z&l0t^6M$zwG!Z+{Z;Y13jXuTlAGW~NM?U_QnSC-N2-U=)|A)BPiq9sW5f3pFz8Kn`$;Jt8a ziJ#w7_BjLd?v$Z}RCQKbRh3|nAXVvP<~b~hmMX}Tl7c&DdTe}1hxnhns?5wx99+C} zMuq`>dwHH?7xuB>b6Q$$!Z|Eg`N*gUDSii_W!>MDt10qNW$A4@haa2}TN#1_b(QS| zs5uqPOmWbrjD)3=27dvW^>QYreD->@Fb(2a3ids#pIJ8Hw>fEfqD)YdHcwG_t_Td@ zifV7S$M?A)GH{Rc3Q-E=$kO@Ax zhqMGTpw`xSS!Z@VtcN{8wfMkK`@<8yNg@k0|~h_bxo6#lKyeI62Ezil=8?( zL*wyv2TI6+LZM|GvD$__RhL9{l8wx_P#^wk0lmF0YR#5h?(_S-`O1^`{QLm>fp$7# zW4drgUT>xA%z%;BZg_2q^cK+-}%W$t)mU|k{S zSiWo(DE%t@BG+1T11>In`mcAVy&5J=W~*FgFNSVB{Up2rHpp!Dpkq%}nfqo@)x?Af z_wGzN*YVuussfP4 z{6$4oROWt(M~24Bs;O~1%s%5MnWy?NW^h2+p8by?$uB9b4v^Oy#4q*r&8f-6nt>3^ zO-0AVjD*5;t$=t?f{OP}CO}x+<_w%+_31$anbHWa!uAnJA+~L8 zt*0D3jLs^jrLrxCK3RhTsmltUuRID@$tu=7Yu?KyUW^(<4NfCB3=Cv@IG+3}Lo_XC zlp>n~<)FFe4kvrt!$+$PFLzZ5v9Q*0sz4m~4#H|5%UxLb7-hE;Ab33IpZT$gLipDB z@Ksd>-0>u(y5@z|)Tl8(lecX;Y{R%FM`!)<#bG!WE6|C52toV7-X0Drb#}7M^@^GT z3s|e!c{#kWPnS)tt)q?yuezy>g+Bg`I8?~T{0Q-lr678I*a2C_m41to&sDb;5^z$+ zXf&fHTiMHu^U6|wnuGmpcS5}&{qT2sI%o(pV)`mksWgv_47k3YIrpxutp(`cI7j|; zQolfalGNH1cVMMcF;g7bB<|F&fyRm%LBM7F{?e0o zv@L&5G$pezG2BYxMgZmHAmxZH6HZ55SoAO-8ZCbN){k_lP;G?aoTMkq4Ra z5}~j6RG^Q`+yOEPckGK;EUW2B78-dMAjEXHe`tqCC9J`~=qa=6YT|Sw5m6Hp7oR!V zkIdQHa-qHj{vo!SjA$PXx4I+sL33pO40$+*M)TwVkLq=QjnO3Dm#~BnZEfj^&WB?5 z*$29-z#IX*?m{^^SqchDZ&boabDH9$r0DyL%Dg;LXVsQOSJRJVAI&Ydd0gj>p-)ke zYMKI156`CSwa&-$XLfgu73%8gS6p-(+2$Q9K$@!%&in54T)_F3KuaJ<>3Zn8jEix$ zEEAy(A83d6JCj02l-q2U8OJQC4Sqc(Ykq*7?Rx7_bKf-)vJx3ZscOrKdbg*uYB4-4TW64yYnE9T|!k$W78$Tn~T;ddPtkDZpt3_Gf zn~XbWpkTA^i}LR9egzn z0c$loj_aG^M)wJ-1Rk}Z4kySjnd8)BYQKOtHWeGARJ5CAAhEKdnT=a(^1e(7mk5_c z%UaA@9V_aciwl$77$zoWNTnIwz@stp-N}j=l!Y|%k=3rGvDvcaO?x@lpB5acpxSwE;E zD=!aqoe;+bOOZx9j(pUrFSRpKQIV3H+y5hhK|HkQ$Fmo%!lbM9Us`}YaLLLU%S*xV z{763Mh_r2A1wWRhJm5$;qTudK93i4lUx3-o%KV{-gA-XPsTew=g0h!1Rtb<8`**aT zoE$=rOH_Jv>aKV1W8T@u=KGSUG^Gx=JSVgX{X zY;vnJ*cPmdk_wv_icV**vkzNpT&>Y@7%4OWw9j7YxW z7Z(h~$xWh-Fn}!qS}BqLGxkHvk6x<{4vV;CZ%R7?!w~ZuiBy(hV{q|VE8jErVABuPbim1G%jct zE|DUOTFB4nX3aJMewKFAW5r_u97=Ap3>5z(sLq_owgrSz<< zPP3#F(V;m5e*3n7LCN)WJzdj~gh;Q==d~|^L9P`4_U(Ev#6U;qb41tc0TBt2Orz53 zY8(z`5|TA=c-t6I57(BmE=TqaI?n{A@a*JdYkjX-PbB_1paYjxSQYIvnQXN>U!(5M zbU50M2H>Fq{Cnyk9P`%$`RSf0_cy%|CdcuUTm@cSLRZz8|BLkE>B;{G_2N8AWMH{X zP)&HTd>q7A;O%;RimJ%QR@QiXZS(b@3fFe#OjR%_;T3yivt930%uMv^;U;RvC#-P)Kv01SiP6c0nsg4u6?L7r>z3c=@R@bdD!zH+#~+~CO< zI4#-6bY*$R&hB+4}m6-P2zgp2}J~yJYUnTMxrd_PzHTw2VxEVWVT9QLjJrL=F=( zgJ}GAf50b9H*H}+pNW%-E8q=~$3GAe@g=|2)AP2$lKb{eMP7b=YdVozSy3tPTk$VK z2pg7NQ)AA&aMF_IywQKe?k0d zo+W@q0r`*WD$>$NYZD6!@|=cjin6jdeU&_SV1-8{s{U#^rxMJ5abK?XEV$kqv>qfo zp6_5SK&*K+m#51U2VyuZPq!kDe*B10R0K%fjiWWnoo`}dfWdS7+gakG&e12X!dS-+ zqApu|zeI|(-siIKQ5lXIQBqPWEZl=fU}i9E@V^3P3NI7^jk^ANZv${`Sez~-?d_|@ z?oFLFHYxIG;-&Ce2 zapsZg5p0J6(tyuVg+4*o59$9?k~wwj<`B z+}NYLFmOxZ{UC}h;+oPufgB^`ZhsZrw!mj>=@0Uqr$9TLZ`{;B`<;g=saD8SP#A-rs~3L&ib``{uo1A~+KPdl4xF|R>^6U`b&}2kJNHM$UpZo4LKbV0*Z;L!;R6jiX z=^j{f0o5PZC6!O|@)^W6x*7&-oimlYDj+yw3ER&p0I(HlTuggP_w#sSqQb0CGo?l| zZ|<}y6&kEhkJ>n-LQXCp(n74Z1yOZeyW;#hV4HRmk~OoV9VyQYj_dkVe<>vHcuBdr zEFcW!{FD#HJ1jC5-TdtJb?d{!oc2B>QhprJbA^0tIiOg84+7o+Dzs+SXLpQkaQ_Xh z$X%?d1er>GUDKv$Tqz&?{Tk_P@a=R% zkd3;zLESa<<7_03V)%&`*G-lytnai=X|A@Rj-W-_AE~Y;1uF^ivCXel4#o1AM{w;ONf6 z0tnmV%v2huEKzh*SgP4GQL)7!xeFj#J?#c#%aCEf@lPuCtD(X$)w z45ye1g1lRWVG6x=V_6dDl`0Y(mUvU4&fyBCvN z$PFHnJyfK{r{oG5SbiE(7fuLJ}<+rb|u(-ImfdK*>*0Sav zXY_>y2%P+F#7oizMcSX8bOA8(UBS}}3>9Q3AYlRIFQ)mGtR=%lS2hcg+ri+grs}s4 zh{1Q@3>##Vmr+lz%>Wrl4I+(aZ23_B!q(8d?sf43^x#4*MC8k$jkv# z1(=7!K|d1YD$}Gt$z?7Egr0S~8KA7I->3!gmB4DFB`jMJ|N|gcZDT%na34 zVOYm?w*%q)L{U(%(!1Veb@xn*F;4`m-}||GK%g(D>s}tz3+kJb6P<5jYhaaRa7@wN z)57avFCrsl!VysInI4!h@004S-~FG7hRZ)#f)sx1@Vs&+D=RP=JGm4t3Hl$v61oy4 z7mbUGiV`8zU)le{&(77GoAO&Yy`H*23^^cE{B3?gPD-lzY4@7i*%=5JiNcr1QO$AH z!H5wN>V@Hjvh8HwlrkIoa7=i9gj5R^=uq{!0sx7~ALf^kn2B zdYo)Iq{+uuaG05F=p;g^EEFj(b+_3@CO0P64KlvN^bGVDLE<2X30!Dx9$@OmoiOUe z85|fG7_l&pTC&E6hZEa;RaJ#tykX%zfB%l#C2Qe@G6%db4oJyMzz5!!iPRh^O?w50 zro6vWP*f~0N#PwGN90m-C;Qayl9iXYN+rf$UQ&`W##r`N5ogMl`{JuPD7;*Hki5p? z`FM8R+R^@!kWN@hAS1gtq!|O`&2DV#CBHO+Iu|}Zz9L(7Bz~7pD|&=5pj_eLoKG>6 z6JM$|)AG1dnLu(->TxsXjI*=Tg)Y@6^WGXM&(u>C)Yup=(L8&&tp1EAz(OOJxcGSh z`^NEn8Fg<#WNn~5BcpObooGxNW1jb0DI7{=PEJWu&U8~3Is2B4vojaR#jxim#K-@` zL(3UFWwwNK|Da+)MZ_9!GcEQz(U0;KB>6icNA2$WbVAo%>dMPv@~XEPyTestPZDuV zhwFZ|z@Jwt<*A|0d(id;Jdydqap1yaW0d^`AJ4gCsEh3#H+WrWDNpJNrAdY@Jukg( z2|=$c-*vb-ZAXn9w*eX0KV@Iu4kqsTk`GI!Z{b)Srr5yEY1_ciVYAUgEM?GZ98_2?#t}kJmp%H?oH6cM5bk*~%b4}%SPyS0iGm#-p(zM|C8K3Zs7IAP zyv02F`RHLaaFes5wvV2cF)tq+hqL8m6ci>TgZ!)Hz6As0b&_x4lhRdFTSZlsr22xS zep6v}Hf->YE8rBFVZArZC|gU9WWEN^3bs72$^jnY;?_ruX~`iI$Zn%8!{$OlXmGeM zU%tF7-NeI=3=ikLGQ9X64j#AiGe?!O{`h8zrl+@Tc`9+|@`gMI-+AsGf&jnB`+*+23OkCN^u!xs+StITNiVfUj zI|KxgAW`Q#PX$xdg`|{c*Z>%;?IYsRF}OJg_)nW1JZ!I$wMFBH_KxP13NYJ042Ygc>asC-K+JJ3tIXKw&P*QwTnyIRS^79|5p-4-qsmUqo z=m5+6%O`;VoF20P_1egz4#J>G{`VRHt!XoJ)otfw}htVmDG;cO~zljuS% zDl+I+@wrG-J^bHJ4cW4mwk9t^C!sY%{DipP@~Qz<+jkU_72taSXxi5HHdxuMt#u}U zoUWq{-b6wbg0V^wrLM&dqQORW=LFzfnmY4A2JOl3Qd%feEThkUPb+1}`1<+Dj*XIe zP8FVyjL`2d5Hi`+g2?_ZJzUT%SKTCmgr{$SPe%OWY|Z{$mEbN1kYdQ``KLTm5W+uX ztm}pv`wYrL@hxN&T`(3_gOg?pR%@p0=17bz=j zYzPuOfT>+pR$k}i^en6_FVFZq&?GW){018yA||8Ps|kLDizHqTof`-i24;3ZXS?R51N{?rIdZn;@-+V{w4&p6(A(o2;;EyhLBCButMK;JvxwA3QOb%O zy2f9@I~VvndZ=fwj>!neZK4&CMAwMp9UEP7QPEFlWZFMp!1+ti>-oK4jwy#Je73cf zGrFoRRhpTeF*+(MrN4gSqjlrP($X?EI*RpCg*Wlo($Z87wX`HM>o~k3`(JwaLb8iU zR6~2c@7i$NCmUG@C8f@CO09MY=?TfqzAEb#uhh)~(YCj^@}SZKl7O7G&%q-tI3g_d zhVV^u{nv}no!Mn++5-h9r5n`W1%kL7w|;qfLES>o9?s%4bb$`2j?cd&;h8?v*La0E z5}*DgP5y(2?_4TV*O(t)amM)ri2vW_T&L^tW&eiN2V$-XKbIp z@RS7-+D}t>G1=D77??jd5X593Zb6G{V0%Ua-*of;e~jzHZ~y4g|3?<=|N5Jx<}v_2 zctJt?-+%k)r#}5lD><+Ppzd^5TCAC}mT?{OdPe zf%Pn@yLH`+myfInug`a}X&WQ#aqF*+MikT`G%g?+wao`_YowpWpxPx!SXZfesrg65 zSe$CXc&n;_s;YW*zLDs9eq!Z%oiE3Aaw*t&*E~etjc+e3mcE8GL0-PkMHJ-LhPwC z#Nu{fZ02C+>XHwAKRrA`p7zn);BdO1cDl~I!-fYCNbef!98r%_@swg?)m;vK(mmPW zD1#DNo%d$#ZK?o>@y5OsU}3?-M@D9(!gwxZ^v8G@7y=;`$DSBzt;$Q`q@d8<9>*^) zFL$T3hD~hbvnZI%L+i#Y-!n6hFSs0EHuLv@%9nmuqRY|JInNEf(K;g+SKakFL&g3i zJ{A^F^Mcvc2|43ovPTVU0c`9guv#dMwih8?!lJB4GR5f!C+=-W#&vq$)Scf=udcqf z2}temPm?O7R-q;(Wzo8N4G+)p^r^?q%?$>rL_@G1h}1sZ^uc1}|8uy(!>9NVYRz-1 zZ{NDoumpCZG#^3V85kIl3SNV)p=YUhX$1v=_x3jzbb!n~0H=0vbo8y{A|g7vYG=n7 z_YQ2W0amul?QYOco^fK62e;ZaHynyS8#VRq12_CBe9(ieDBRu6?ZFB7R&ZE*ySvp^ zhs_K3=cH5>b5tjI%-Udo*%J8JfY}tA>VfY zgQV5i!oonuj343R!3j1t0m0DZBzOy#Rad{?P{%_;LYh;#2CHtlB_&%|r+5zwIFA}F ze?96D(Kw5bxxHeA^Hw2*?Puntyv4^qA7~fj=Whc$9Z*{{!K-7C>IkblUBAwT!E|+X zfv8$h#26MDnu566a6k1;N=-;B`z0SqZvCx;jJ=mI6JX6F2b?zCRwMv-dQ1-oN0B0@ zI}pXDy1JUs=>pd3vvOT?QclZ~o0o%#Py;M7>YNb*x@NO=|7^zFkQPVSLZ7m2JgbXv zkZEYkqHv3vpU|$sGdXM%ntaEYatqxXPG>D5VC+1I1u1}Ua zL$r8q4geyb8IE2_j7V2&65(u@=QSRlAR)l-@$t3@1iY=c@3F~9w+{>`A4`a=1FB`F zb@2#%LWBPItbLA2yuZ7gcKtwoMIQzAHc@ON4by_mT-)bdP@B_l-Bk9dG}Ff^XOUwywR_Typ}g+Vf{9AFs}u3W5Hvfq3HP z^0MXDi5dLR5AB%O8MfRS92-mE)B;q)TCN{rP*A0_vyV%}a~l2j;)rE6<8p~K4jlpR zq^Gb6Did~D*+h4^otfJVmqo$FVqmCJp6mA=W|{Sqq5XdYlR&2KyOThR!udwr21}{? zWj5^rvY>&Sm63l8=N=A~aI3I&u{GGSpTvbV;=>9(J)wr{$K_oMmh9%{*Fb%540_c9 zocck!XHr_&I7ca-%q~+%em{b>WU{{9oCEJaQ-;*W%oG6RIRl04#>Nytt!|Hvtm%7k z@thF9gQoq+o*RefFT_#*>&O?WEl@-#ioW4&yt&z%S1xa1y$H)JlYxyT-6*U22d{`w zi?^@(-nxo$jtMKg#^+i*J$wQB)<=?6AC?7nAp70vCg`=!wXfS{`P6Z-gqYN+CF##y zclTNUg$M)qL}iux4b+QiR;q9O`e%9cf*tWi66dM&Sx?65szM?CT1D~Gma>MxBL4#* z+7cHQBdmFI+R)&Be(XX|?{Kn!Av0B&ogE!#O-98Q%2rzk{eYB^lDAESqPo6y`h-cM zgkLFDjV`LmX+IhGis4=qjcZSF-y|!Cg~{gS(?Zt7NahWTi73wg@dd21qC!`G=312K zS`jwADYFZ8MoRuA;(DdNCy;%|__klqmNnX~gKyRibFH}SIaXIZPjD-zu$!`>9@8SlNfpR22#sfj5lc-J2mRaJ42lgnAgEHBIdF6`|M`A!wg#>OTGWLW(G zFtl`&rsy~)7#-{!&z_NB&jPZ2Ahm#wj^1M74wOPugixJN?R&es>usnw>F5&fIMS`Z ze)RY;A(Q=bMDEz(5$ahJ2taH#^L_|VNJvge(KaxkIkUV^Lq#>#IvT?P(JcT8&QiQH z*T+hU_2t$Rq+2)ooVm&M0&fP%^mV+e?P+ayr=ueyaVaTV`L1DvTtAiQr_O3l&!lVs z-i-0KFZ$xK@6oH+*`X_>Ony{7v9cc=7{KL3kGR@E=xPvc?*K#aN5~Sd2L0Qhf3 z+D9oFLw4o>zY@yeIYvLe>Z5FJHQ{yL8(g8;b3f}?&MpCpu7m`yXvUz-`6IC`u`w}I zGjLi}`@Bmt9v?xXZ5Ov=AQnLQ7g9p#4s9RjHEgJSudDSLZ^4nR(93wrZGMMb4s z4cotlFmZn}Ko6{$mF1Pvva(Ex_;(Bf1a|BF45yyv;lYqyBU5c|mr+|B96flDlhZk= z`=LSu)a_O4Z(Bus^MdjaT)x9sh_1jTqNbs#ah+HU2VnI)Q~OWO&VbG-y1F_hD5yIx zdMGZA=++4HSi_LA{726th=6BtDU>g%Ft%cw-D(k=D`1iM-h)bT>z@s(jE|4s*=fyI7Z2cZtF3?}#0^w*?fhSWG5?QrFzD zGc7$^Lv709=*}wwlBZT%nTb%K4bga3lnP{wu&};k5c9VF%okHhaRwgDMAs9XmP5{K zqK86nn05`!XNo1Y)Dhj0*Q_6=bNh!6JN9}AX z&`dw5=FLYEk%ShMrBfikj)`>&6$6K4*j*yh`kUSao=dFn-+Ow*-TcnBr(Axf6f?er zT?B2&1)v5_ND7Y(D+tjtu}}mH;;@b?g7_rRoeCmmIvm)vwl1|RRTz;UXDfLWP-(}- z#AGv)6A^neqcZlfVSNM{90+8;wH7Pffl|6s!GpGz7I277sHm>;!5bw#4Dt~%^Xg+k z5s6q{rF|M7!LvlbYkza?klSC?STOg<hZKKQ8dBU+GRYX)m0ZQN^H+bVSbblY(Wr~m?h zLaieWsVgs#6kYu-0C3!XDTM#KRLOSgp1e#qHwEBcI6X6+2ex9gU!gxxj+Dafj=i3J zXaS+2*3&bH2#;hdt!-N_Y=8q%-wv0(hV-N)OOEx;c&?%mg%QE1=qmA_p3QFr{*b{Ps zD4KCG)Cz<^Nm!Z%q1J~F$x^qmO-Jas-#Wz~g_5|ZhKF-iTx&OPxPK3nP1nV~(Qe)c zO1IwEo%Inf{wIMFxKJ%k^XzQz@bL1*v84je2tp$4Y$_-Jq#z3w(luBi;`#ks(L+430L z{0%NZ`geIyZZ+5ea290wO93WY4GjU|)%2PIR&e1M83hzWI5^9E@Oq8gZ(Vx`OfnCu z6hyMSuB?K>$oROts_MzJ$bCrtTPm3g`V78y_LF-cIuhyf5Pmv~;v|%)e_}phft($jHf$p4C59 z6bxtl*Jlvni`()as=Xu;{@``mzR;{+bcZjk(f=8_CmxdX2pt@UxsR(1zkH0G`rbP^ z30WDPuh5WX-lZ$&(y_AoVC+nJ+X$q;UVvBHSJTs9*`9X!sG?Hsmk?5=+y~gIYpPDJ zVY!JdeK?LA1OWYmC@=2DWR(Usft$;rY@GQBOWBx(u&-JuyY*l5Q8#8+7k+lV7WA4G*W_x}4bO$THO|ii#si@kx z#g>FGjdF5PF_H^)gfaAPzfXhcKKo>g9@0FA6TVc%dZl;enTy*cdyyv2G7bhQPl@SB zOb^$|X>k$Mu9unNNMBdKZBC3}bE$)Lac4s~`8&`=Uya6JU^|Q87^;VF^GF0gWWc!K z*Tn0MU0~DwdsMw%{2B-WWC*^WaZb##vdhJ`6xZ;+7){iHj4|bK*EUEGjA6)ic4dWeMk4zHC_IymaMMVRhjq+g>agS?F$GV)SU-6;%s69f_N(gLBSu9Ju;lEkM!IriCEJ*Ta z6`}f2Qtud=8fLwsm61`%&2z*L)IjR<3&^34Hw0#Cw;2Bi87=-B-faW&x1ar&gr`FS z>MS{a)MsSODapyD8wy>`ywkJ@m1%OLQ2r#W55UyRM&Db#MWzAdMLPix#W?T!stvfc z|GZBU4Zp`*A`Cxp`|J_}P{W**0!3ww4$D}4B*y@DS!!cyaV$9vmCn*Q+iv&xqHn(+ zS`-2ej@R^sujpv!iq`t8P%*0kDw5u5sJyO_UL8aafsk&)+WbL!VQ-{vw9@CM9kYCT z-oiGvvqKb=+jZ+v;F&txlyIl$RjYs=9XhQUj$KdnWKOGZYeuUuodzlD{(W{?K;`=S zo1ApcYj7KyL z-8Upe(iKf32XR)skhQUC%jpBkIOG=IL;1|^?OoDb<7AFrZ~v0FrG`-F6y(Uu$N?S4 zC;-|BKAC6FT& zwm3g`t>_!*XT73f+GhvRrM#faKNIlC2XV|$MMOnJhGQ>qU=e(YwS`^qYHoC-`XI7b^i7@sE@9+-EZj<=lepx9#L6Yi3E{f&Knpn|=GI|B$rp z_CNl8)8;>9ep}|WDEr430P6W~d`|)z=#6|!Rrtz2eCfT_pJmj$$ZAuCcFjOEdxOT! zg&6!t^M?thOQoM~8=df6;fIyVUBYQU%iQyz+hhI-Uh=I-o}=Qps)V@>6JDq_H{tr{ zdr0$S7@r?N5RdJPTcxEvnQ;_GtfBeeC0@55y6&5ERiSa)A-<%Pe+e7$p(C9mx`O4> zIU1tsU!Ui1XDK%u5wo1rgFg>j+|D8J5yoT|w;STw{UkRO#IuOcP?n@f2XAWvAN;=& z)A(cHAnL{kZR3;-Sh%=^DM)`E8X9@Zqzo0%GBb1I@88k){j;O|V)~3&;s(;TsYS^r z`nI|?awnT3ft0*h!|-rKqmlZJ3{&m``!68C+F@@tLRT~rdUUkGYO?N1-q{xcU6R3wAf>J#LO#R$*{G z`)Sc|9tURhy6FCWMAO$d*SYik=bUXKGS~QjlPOP3mE7+9njg`u2!-tx9a57n~O#NY8~Lq`?^QXxS|V|eO^LA zKx8E;_pKkAFhT*b8UwMQfgjAH&Q0|_6*1_r@p7}ZU!M0~({=}niH7_g{uuUtymV0m zV_{>;2cB(I)VX>c2N14tZ_SpYyf{Z!P?Qbu51iZY%UDcVR1}L0i%j5jYD^MHnB-J( zsyY`5Az6!(1-|PjTDOtT!Q#@|ZJ;-vQa;f&RF{^<%*7RZ&Dq|i1Cr`XR%;ufEKDpw zx84G{UOyWL<>$T5lu9(!GfD>RtBQ(n;PJPZ4N5Xv-}>LfG2!9erKQCiLv826j?G`m zKHJ%rW{Ss4lr=Y9`$k8f$V~1xKv*fX0N2A4M?Id6S*1z zYzZ>O^vYK#X1?_Tp%=avsUlLlQw~2z8X?ypb^_AFjqU-+{oAGji;2S**G_(vOkzSp z6TfHa*yuw8c27?1L4;u4NL$cA^j&j4t*Qga0tv?Fu|5ocjEa|U2z4Bubvs2DLT;h2 zzp_7EKH%m3d=@GIB6>#a(wd!Qr(t1>OC)8lv21YrWyb5>Drzo~I_(VZ_3n*Vsah_L zL1EAjA384hZnQF|tKFh9FZp8_S!mtH65Kc@IDjy$)y7n2R;3}xwvdq-5Et7b=|tm$ zpKS%<%az%crv8=6W;UCVnaSifiLFYw<=vcyP6$uuZnE8+HjOwFJi1b~DA?TDeoyLq ziJt5}2fb`6h1oJO$#Fge42{2fj_h_cI*VW?4beF;oWO*+3KXnw;YQY76jPtLDT`NoT|`;APEZEdaRsR%&KDDYNbOM`nV zlK1YpJMaU}hoW#hd_$oE@rH+(#MwC@&ACL&Z*Q`0uQz@jFz8dK?#?;%PfdO23-qdO z1c8R$o*p0(KU=I`zCNAJM2!zf?G4GVS7tplpC@l&=QX9+-D9ziDoFWDrZ%EW?uUu2eYrI zE0qAMA_+FRU#L+k68wZuNFAce&p{{@_$4PNC&gXf5!>=kw!tn>(m+ThG`=0^(6&do2eD8ZGn-yW~CxJf?3qcfWY&LlG@jFm^2Lk(&Ot9Hg0+k@ZhFJ+^>3#@=V=iH z5E)B~$8OF;lfMZRYLt5oF%PqO`)H7IkNaJ3ve~`|9;)%CCuBZ?)HFFkXvg5%;!$u% z3Ye|6j`1lBVAs^zDq$Fw8E|+>R%3lM7 zw|}{uhE=K+Bqx(ad^zi4U}Oe_T5#C+w(7nlSyb9->u8b2M(SAHu5T$yHoTQ(?LMdJJm}Q zfX#Cie*AbYbHKtxUa~WJEpmo_d<-y>01TK}n0?nx3XldJ@C|JfG?FkssXp+6Ij^Uu z&#bvim>cPle{rMqsi=-@67_NaeT+h}nS>e;+F)QX7sxBk!7;z>^w3WOINhScBUxD3 zWP13>J%?crV`l(@Oid*vgKmS1J?y*O1g0{rl&hh!@gws$Rk%bKy;He%r7Vz3847nx z%dGyDv`il7yRR4^KGuwUn81g1AhNM_`lZ380suI!37|`>UdT2GKIH>P#wbQXvrwR~5+WuFaqSdI9uR!NrAt%mZ;Z52VV$#2CDCv_Zr0J1s;+j`tc$Ktuuv zpHtBD&2wy{T=r6z!{w8Q_*l(KzMi~DODPsqP*@qz z4V9vxCGWWb@PH6+Z#K}IbLh@Pv8YTiWC)PiLL@={jII7 z^33rZZk-i#H$?dOBgVK|J&KMN#c{xL-P?kvwLijXH0Vp%ot*RGD<4U)dM-Id@o2^| zgFL1xG@Z(?>DwnxasKxJbMv)|X<{S@SZ=yk6#jqviXYhi- z(13};#Wi(yc0YrswA;huVV%y^{(t=JY4=8xpSNdhENKlq37ZUUF# zeqJ&nZh{wz@)#V`3pdBRJ1?QmIUrv`uB3eR7@q;$i@+}HrBg+;yH!X#Hnyh)5)C$U zkFc`u$Ho1{eka0DDvq7U{AwK-|3L6az7d~w*kQPRL0l}@TuWvkN1@B8vY?7}C;R zUj&h?^l{^vvJsK&?wWq~8n0wWF^!Hz-Sha|*$QrvIkd!u_V3s9<2dzF{4S9oMn)H@ zJ`0O^-EhLgWiOp;n9zkmUnRW;)!+)dVUBWP?mq~ zD}}vWTwkB(8s~b+thT-lQppctu;;^r3Vt___^8?*I`MZa@89J)uYyqa0jhj_Lc$Lp zcq&i1tQOIlTxdE~L12yft7NGUDxUPKoE=7b_4<^&6lTYtV=G;ub*^LOQFbyiRoeM+XE=cP)zm$zUR>nMq+>lW z4xm>XY}6k@h`Dmo(qQf1mI85Uf$)TGLfzS!3oiD6p_6WEeE~0oqh)$p-tZw2oB2E4 z>AvY|y?f;QF&{sa#xSTCpRP))=}Z(00dGePFCH#79DbQ7NL6FIkyE8CrQ&F0q`Y7D zb*APNHU2d{{Y@Z!eLSDVNuv7|*yr4i^qWV`YR+`X$y33ewt;q`bNwK>6cdNLe57S;+iGHi zH*apUV1i;MFEr|$KQK~A2xBqb2+2p05IC#v)Bd2(G?Js5n3{qBsgT3N9{??KjvDpc zi=Gxgdl}hBGV($kD@qiNi=?o%hjf?{VgBO@PYX_d5Bm0z<9WygD zU9l}~5xb?gyN3Z}GoU<7rVjUNY!r*~I@#rEN4iony>f7~(E<1QDHXewp%V#VL=O=G zv5{ZyzmF_{?+=vym;LWnvYXI(5Wj%(U-7TsKKP$@(*OV7c+g+}4d?lPQl8~@Q2t#{ z|E&ieZK$dL$87|`QRA?f3Ewg2kE0v&*3r#hahteuThIU3&HYcja|c+Fh;m~mJ2rme5@KYTK;vfmJNWd=JudlM(Px_m@0y~G?2eU{bdc!}YP3E)G&Uv(=|Q@C(1xw@=@1yW)$VAB5)%N6pTUjV(-SfZ_Ce&@cn`^-_YG( znW=$!{fns$e_ixdxBSPiZP;({jUaAn52U~T#YK~P@2G35gFqrIY)q>fb5cZ^xKAIa zt95%xT%Grx6d?kI0*c4Y>$l`O>O7y@zgRw~{@MOz%lUyYNZt+WYm~8B*BC(Og&@04 zIzC7MWGA-|%r|@xRhj%v7lAd;_mJ)#zVik zJAOpqCynXA(sbdOnVIXGL0Ym>iAPtKB9*6AY7^a)AjKf;+}=Lwsa2SYY-&wc^eRqG zC616m#2S-!weMmlBifbrKh4YvCmlXW$cuMxP3+g^H@y^&Y z`>ys&vj@So8-v9t+x&I*ZiMW|as!O*q9K5zuWRI-D7JoozC>irVbrW&v2UD_i#&Re zCs94qR%c82GoEQ(vCW5ED3(GQT9}StqQ*ED@p4D65QhbqrOI(!pno9S4r^nM)k6j1 zCYblDn+nXiX$}^d+HCR=C6io%PYSXJ6f3=CAlv|S5Rc92YtAAu6*1nrP=P#Rq#VnuvP){ z9Qw>Bwh*r^oUzka)-ASUcnB+s9ugQzTYpj8PZRIyPW(@})$3KZ5r%T*%+Yx;)tW9JH(K*{& zSwz56ywomCX7c3Lz8xj1&+Z*xRV#d#B=+lp(9%I~))~1ZKHFa>sL$dNFDn$9%}J)> zzI#xgIZ~8Lq;l$PX^kqRJBgk!ptE>bhkA+H>r^8!WEyLip7kzkjYi_0oKCDT^Y!fc zb&gs}<5uj^Ng+)yZI{l=VB44BOJXIWe56zmN`;TEM_NYW89$Pv<@+8KHx(bAKwkxh zP=7FdHPbIWJ=Borogo`#nAY*GCWq*@He50}J6hM?&So9PRtTCOHF2&_|Q ze$FR0=+;0%dNi2Sl(anlb1mv*U~c%Vy+-6lb}ZM-&|E4NTY(wtuj`@j+DA5wZkjW} zFo(;@QC_or7X9^n4tZ@QTj7FR&Td;D1m=Y5-Bh`2O-DzzFbUocGd};zwBNvoYP) z(hzUo`v#2a_aNjM-7H~P+gUo0^lyr;3r%;X;p9ovM~mam8kVSK;|SlI{(UiikKM%*`;{zvzYR zPW{BR=q6UNoYT*wwDvnHVZxRluCic~T^#p}L+g!aijXfW9tt~OseQwzBq;kA<$PDw zHJ#JtX+&fdPxrAaow@F-g-_IaCe&O#lC4Wtv&oox6wek%?FZFODI`W((#QRWnpa+B z$;ht~%8!=#%YR+|wEmATfOuuGS_MtOlVCMd8Q!2N(fOr^$ zUTc01k=BeTzwo>r>uYOutd3z+Yxb>vXX`&c;*VMx&f36o2}Ly3`Tla0$$mW0${O6# z+|qUK&Cw~wr~Xbx@o)kefKFCwEn1p+j|sA>ORX91aE!4Qf1(zo?N+)duf2XL8qnF; zw65SPp^_ryevV-;D=gq6{ z6KhpD?1Sp--`G)+Yc1G$4H|JDJAX+bM*)pKM0phUjMV6pITeIlb!i-_BD0Tfm#4xi zW2!08j<8gZ9eqRaf~GaIY~|*nK0I7}N?<5At%MCNXke=_D`uwl`#;l2?&{>49V zYq(&G*)$~YZl>py(XwDFXWSdlpxTsre+B&(yT3L%7_fQ!nTiUmjIs}&7GULGxdw^?-b&9g;@*4j6nA$|J?v2_)Lf_ext`JX>|3UCyF!=+JNSuw2XOQq%~EU4f=R(2tT zhDlCYIpWUKMBSr@4O*(|PN7#RmwaIo>8JVl@kH;fQfef{-s zs(Sshe{eGL&QmQT9X#A;FF{rKBrAI9LG9G^G_U*ib?06FX+Bf}Tnl&;c8>{IwdOOG z8noo-PaR5!ykn}_Q<=~4$%{q5Cor^Zpt)N7(@=UEUOGw$Z@I?3W_GAC_RN>iK*=wm zSkTBp`KUp`Z?&DNd2i~OcZl!td3fig;NC;pHyL1g^Ii&T^R6W5#t;3O9iA>QOkY2tihSAbQaW z;!q;(XM7lc8!7u+H1zbSs2IBQW8X=YB5&;K_~w;-TtGPKw){Vt6G%v3xc|N}fUWBP z=ydzPt!k+-a6k7Q7+}-A?PWN`---dvRS7X2E$2~hF>3s2|FZib{TCPM|82eY-`=(U zPj<-JTB+gSe53!2M&aIl7oIAIowE!UF=soQ#dv-Nq4NqSIr{kNrL~h^Yxy82)4s*k z$%%ttW&IN&@jRnl<0Jb{K;hRv_3B26vQ@ZNY<;GVJbfs)L@t-$=vQxh{VT%L!o=rH z+DJ$D)Obqvri}yhV0E3G!MP$w1r9A&&|H2YB zoWB3XQ0}`*4*{3#MKD+BIFOk&tUKtV(AMtGMrG^Os7_AJA4$`yTljnlf`as#CF!kt zxVX6J>qBNk<=4~LD3;jR*qxo7k9xZU%2byYpD{BJ`(kchuN6Ciyt{{?33~OpNniID z7sKc!S2uR>62CTI&1o-T@wi>xqG-A2;uk=WBjj>K4Y{e1^a%d2wj&u_jT<8wxzlZ3=qzoWlhJn&pge-zLw z@5JQDIVkc)wT)FCaJ{i_M&eQ5iN6f7NhN&U;4yC#Wqzm%+^CpACitx8^S|nM#!76I zjV8XY72+qatl?EwU9N8!=H_O@b|xU4zkJ{t9Cdwb`A0TuHq4$ur7$qwvpjXUi`TG~ z&w)&tAzB8^{bT<7ZVWDyA7|5P95(=LyE7UN>gH=&-c(`Ps+ zuzug}cn0X+DBoN|E&dsNV1k^>7=OcxD&w)C4AdOckWlG$^hlWwVNAWykngR(@5^h% zo(v}=z4B6FHv74?HxhEfI?^_&GLqb|RyeI)@2e?o$S-Z!prJlq!BbQ2ezvS2Bl8p; zA?;Z81jP&+2hTu%<)?+x>x7l7^=P?Jtw1Hyw2I5}!i|}_CE7KSz{u;B&E2|BtKLpb zRMO6-YAI7LiM#Pr2Xr|~Y?*8Y3Cua2)RA;CyjHNUHK&O^s#j~ITNMu<_{n@pc9wi4 zYjZe13No@4+|8!kVR^}(yCWr+3JT#>SnQ)EWfetn4DJe7)Agsi(_cKr6wSau8cENYH^Szy zv6p?~qW*d$*NSd2khc);A_bIECz>CIYLc)wR;f`yIP#rz+AwxhdR2>87e~0l1@U{k zx)8IoNDgmkkg0IasnUGqZZ4-jTp*dbTsifkwG8c)gj2yyD0p*<&*j{H=;R*A#SGOL z{*hQU)FvX_0wZSiadTPmJu0bLGY}^!(_f-v6;e}ky{N_EsH$SFH9XhcOVHRG7}*%E z%4MPJ;d`MwlflFM1S|HZ&R$W^RwTg~I9HjL6=V6 znsm19xZ3p;7u5gAd!dxAY$V8=8$4(O(su2{^M z_hBQ1yHk~CFZVF-NDz)JW!!(@Q#647Eb(hxbVQE}x)=@#_bCxNdSF_Eenu-SDuocc zr^@XH;;>z!wD%nGW>2iv0f2r#)cJfeSc5q!JK6qIn@vgOp2rESyKdTHsX zG<0vCYM81m5-Rm+%y22IM$gq=zTdACsv6JCT3%hbJbNJf!^1&d)|%Skqml>>BH3Q- z10=5K!9_JJN*g^iv0-;MotRcaRyM_?jTJMocJaXrM_P?4GCDG&=K0yuIsr1Rinzo$ zZWjs)mUssObz%u4!0rlrJ= z!nf!aRq1R%=ZkowFYK^+U}ZW;AHh4sBrT9_uyigi=R3q07>e$=)i7%At#%{-y58Y zibv>yaV&b`X5?Q9@e*gVb)T(9p!wg(%e@XSS{Fw8)% ztefk-iHcs#M5@fRlg-g0sZ&Yj{rwF*y06KvTBA|fyu6yWKK_u$7xIkwH7}i6PFo3) z$3EW9zrOk$z1KN1qY8$}C9`}woRyZ~HjDDb;-4d8x%K=rZ@mD$+AM{V+R8wV(-Mh# zyg3J-q-a4cuXfX@+Z1bFrQN|kI5-6bo64A3VpwzLDwCUhax2WIonC(G087%%S5hD9 z5$iyTiNA0DyZbQ*M-_~biDh>x_XwV9K%SyK@%R*C52>sL+9Sz=vX`q zS>uh=GTOl8V%^4lonNUs))C! zlhLWy)aWls?%sDG)6ba^7TyTM?3Sjhc#?B&!n z1Q2mO_V0*wAepS%W8b^4WX>Ln&*1T(S9AF?NcHB|licdnohfD|S@}m8=$ez=Fny{ksneC5H8?1;A|=7{z1tFLo-x^d{3xNNZs zqOGlsw$BfMA4q3?_)OaTAFLj`|_n; zkI!+4Yux$idmn(DSJ7lDJ)aB*j zbqgr;Z?bMa8pJt!-)LGltZwEj;Gv`6voSAtcxw+Kok0*wK{_HV%sgL(*4pNKb4xn$ zwx6$G!xNq6%`rm2DWRgMl9!Z3jDO5X#q|yG^m!plBD;xiNE>~DNr7LKVr&K8!9Y%y9czBR36!N% zd#*56>|$kQt|)9;u^TJiJ(*GUw@YBZ80Vz4Ar@e0fm5J_D#YN>;=pw%@Mw%gS%?Cn>)Uh736}3JXhSE z_BAJ)3F}*7;cvdEs5Tn))3~@N?}dGtMAZa+&qYB_$>^Z0X02}e*C9-T;Rd0=j1mL- zWj0R$`t?505toq2!vFp)0w0$Ey1rkuyc~XGQ`Gn!&`{djHh5PypZN~~oZS!ijzhh` zot+(4^XbLS)n19TLGy`XeDrYaC|!NM^o$H1=oM`C+OHdPwAN^8*3H@2#02t+IxQou zrL|?w2KpJGKPn0{w%ERh+Qg)5K!;LaPp<@0%9hCM0^J@rT5Z^w zj$W!c-F811^f^CJ%vX#2`nA%+eMQg8>HOT&(=(kSy_>#yveSBJQX#cfyuG(m3$Bwh zoDQ(i`#&G8sw!mD?w6b=b7dJ6?$XAxU7H51*5rlqyEnh+{HEFQ$A)&KCm)BFBhS9gHP9Mov7cPrXGG}#kgZbrB@TIRUFe*ol* z_U7E*HH8aqbo2TA^{A-G>W-%XF=x3BoWizXsvbO;`6BXuM0OJq%WqzDLe)mo|Ju`D^a-!IR z;^oWkZV)65BO=}^g4l*3n5L$>qCDNDY{k)9_)BcyHl7|gUjS37>1_39kdsIHfCsEU zYNM=JLVT8hV5gh?fzFf^A~!b?BO@pJ!lU~7D5Jc*xMH1a85IIMtY>wFnz5_PrNxT* zl$*vGMjKk)H*J7VzB_9nL%$Uym1t;?o)ELYU*iC{7hdJl+w@W`5Mm z;?()>g3JB);_$F-?CKhRiXSG_Q$Sz@Xx&@v`J!*e z#ynqJUahWma#=jv7?e$xd{JRCwYt(ZHc?eo=VD)DRmbSkB!WiVU&ywnt5i4xI8wU9 zJFx8R>=g4gnkWZ5vPfn)r2s8P_PXd3V&dGav`;2F5nsRZqt_C2rL}U~ZVXN|H4U8? z9M$u1MPTDNsrsHfIqmUqS6RgG&1l|?CGxn~);Mipkbm{{y-4$4dQH0}`u@x10eB=P13E`%r;-w8vq{78et}8O$;Su&V+C_@ zJSG?6Mod^(VY#oXoQ7JjAD)bijikn(9Y%C@$gOqe>@<6LydV@4vmYNFt$xukAJIjq zN@!wiD--aRr)Dv15wjk8_fXkQ>VPh>GgHp*1X~{EF*>n;p2FPk_V)L(vR;ut?PrAT zPXOO-z=!DQXk0wJn#x)pYuJ6&i5P&%u2w*$$*tDbUW7v7K#HfcyKtwG*N{@)w$hZ z;}Fh#V^g(QYrBi?^UBJ~fm9Jz%e<(V80V`qBYVEit}aY`&R?UGDw>*n5Xiwr@Kh)X zj~?{}J_q~wV6Ke;l{1&ct_6USZn0f)*iY-)ADK+s-yu{WpG>1$oe-3gqM~Dkw}|0QW^LLT{qo>7n<`CUupx1Kg8sbUVfzd+Em~u^payKJ5%;{M z3isTx$o=;BTD;V%Wv0AtlgngH!X*|G#$&U^cK0qBw6)BEKmdQvC*ZyS!(Zb-`l%-N zfW~t((Gw&LY!7CWkGLyyOsuc3vuv?aQcx<5A7GwXS}EnO}5i*mS{H$9ERbYZn<`Y>}ujQ*AFREx&(oz-75_2~Z;jRELF; zcQ*-@j)|KyxW*@fpL4tuQKbUzUyxZ=4~3g@HWWfHevz_4sTIWR87~Y|9APnKgpOkh zb*|o5gV_6ae1_6DA;gn3)UWO%KfJs^wlsKZnfB-v0~zL9=$sok7;_crW?-k~WS=j$ zHZ}+R9_&?c)QGI#D|afPlm~h}H6Xd=%#H5xIizR*d=bksi}9+#_dYhk)jdSy(L*c< zPEXw%5g~KI9h_QQ8@F&35Ruft$cWO?5=Xk&u{J z;k?3l;kmedHNRaIC^InN2C~1DBG!G=(q6K#zDkk7pUL9qyWX2|dA|V*^mNd^;J5@j z^|jzs0eOwVfdIN&V|j4c{9y=_nA2ECk3+xvk(RY2pCM2KN#t=~SUglw67hq+D%pUc zhN-jH83u=bYzp?E6}4 zU&~;lq_K9&Va_V}6Ssl^r@MB^eABqQds4rOFOgO;C8fZE`%X1ENk-eMcSA?BOk<0DUDF z%%H~F-#lz`(Zf|@Ra{h@%CF>zh+{}xGMV<-x7Zht$V+mQ)uR|-mlO2#5(#=G))*Q> z*(dQ*AV61wOav`iMff=OFdK)?_uh1sjnPmjzI1#I_;PCM+=%4|OHJpSD*uqqTX)0? zxL7Q8=%A6vQv^UqG8$KUd2s18lG4&3Mn=sE-#})1pV&hpo`U^dR)k;ki-bj~~b$eE9@kM}FfC|8c1r@*<1X@5G79O-*sx^sDRQ@On<_UdPGQBhBCZ)stXE~oY+Gq%Fj z+@V_>&^K3$4tpu*%~V((SEU-n$&%3e%t2K3V2iE0=ES@e0uO*&izdLw`nI|VnfBmz zK_mhpze2wvYEXIbg|>-^HU%7zp9zRzyPi-GmmzM{ZJ9@H5l6Gy^|HcBA8r+hxW1c=n%i?GBd`exy^nE%7?4D1r zg`cg+N6+FVxC$yZh&{Mnf^NI3jL>M@SA>U%mK4QVXK&Cy4G%Yqi}{)6IKn56%8N;K zO=qf8N~qZACA74Xp|kF7ZS+aWv#DvG%r^-D5fu^=O5nC(XQtt%U=NhKCVaV}t~!Rp z8{x*kny#o)YEmgE$TcH+gpS4u?c!pJ;7h>wN4sWzSFI1kSJD6F&{j86LYl0*wq49VUY=kEeL~HC9&#>wXy>Yb-_}!^=>X z-GdRU{o;6ONq@G+CUri7Q8RYRWnK)Q`$i&N>w)xeh7O7#S#w3kSGA#$X`7E1T;i>sba za*(&NQM}ln$7xIA+&C`vx7;@pUKpZ^6;e2 z?&f)1YC8Gl*~JikmhCoNA)%*xSY1r63lVM==9?RqnowVV`iKNXCUCQfQICyF>|$cycdJ zEv44>GO$?wvg{kTLHx;U`tSuAY&;ewrZg*miPqX35HeZ*ZRSI@dz+j`UwTs5n=J~* z^XWQRge6YGFZ-S82N!o|iWIF@Xl*v9TH$bz%w-Y^LPg_d>uk2ij^$n5`&8tpR@aB| zE>DPoB0Rb0m4HPwf|%Rd9|18j9%2o(%Ie3y_~Z5nlUU$8vP2VJrmewPZ+bHoP-WE~ z)t6ip_RG1e95S=8euy_pN%$^td~+PkTvmUcZ(56dd7(0Q;=M4leoriZRx0NsFp^R) z&$G4--MEvxFq+MQNy4{1o$0lfGWS4^{VVFxb5K#^WI?w?KCLnkWvW(tVv ziO`6d6SxX-f)iZsY~u;P?kbBYm+n@gpD52&FQucUPX5Al$aZ-Ouj9AR%*^!k@*MJ| z5|B>d)uWAceeuOY07X$j@hdzNZG9jS+c)yC8g*pYh%x9D|NcU2_Aw!c{D60EKvVvj zpL|hGEsQ+%ttkzzRN-}XA0{2`y$aj1vQ&dq68^Ko5K%F)9F5A8oteuB22HEFQ`b6j ze9|m~fMdy*?b5MaF4sd~KoOIKI}hY$tUi2seHr+%Ctnj$230=S9Qz}985_Gb9yV){ zf4X(GwL?68@Vt&<@3Lxlq%baK)A7P789imXt+lmi{azsUU2=*g9jdwNAR(^vxlIwB zp9Ii@-j?EgO3iYLin>wZkidNj;p=gEjgnQnVD?7RJ3 zOdzg3fY8`PuUAWdzxN3JxTv@|^FwQ0YB5N*5S=dg{L$%N{UupwSi~^&>keEwUwe3x zok(+A6sx_E8W^8mU%Ppd^as~j!8pveKBJ&CPshH3ysfCS(i>iHf5paPZEa($qAtS2 zyD&^${p(kB!c1~{wsN^t+}*3oJ&GYj{?J4sNu8>yD!c6%0`${0uy+9E*qSb~Qx&Ulv(i&JrUKg-rYTT2 zz?Ori8uek=(UCQSc5NT*646{d-(Kt>(b_9HahFExg7Dk|B@@fv}Q*@SA?+* ze~C}f)nVDU?d=UaCmlwXU72wBIy*Vq+so4V5Fo4#BboQ+u0x{PD>`%bxIy>~U9CqXu& zsU2V3NHv4$BjUyNLex5KV6n z4>OJW70^GOd8BYaXA4RDHr~9Usb-OZNr_9#XWG{V?a{vACC6iPr}luDKx4w=8S-Dd zEO!Oe0l4UE27F4@>%O-IW@<~z+nrTH&)`s+H#OQh;cR0ZIt7%(pTF@^LK5@R!hip! z`7+DJBQRYsFAbalxh>%(#^=aXac~73w>m5Fe;mILEP8?5L^{E_N}{J5UT#V#wIw(Z z+*IGXCAZiQfmv$Nx&C3GA4GqqznDEZd zsQ7uB`_3RKC1avM7Irb(z5U>QEJ%8JHa9Rl45r=n>Qcl)ib{@#gSrZOJR#`9`ydzu10XbYW`BQw zqzs>5_v@l?p#L+-Ee6nv8OImTWwLQCC^A)Qy123toY23z=qEjQbQsrHzVu-0la?+H zVdy zTvm6<8x$_lG^(7~6luuFP$0gTgv{nM+Afav-<1;lPRTsO`*-N(mEYQnY1LidRSLIZ zVPQc*x@W|Ddw7lI?|v~bUcYM0Z|fN-n(T2ZR6EFqYAeX89az-HlK+I&?1jzNCG&cF zi`+tAGrhI8+iHaDrnwe{inbo_*gouy^X)duZHpIpkqMdmz!r7R&h1D}qcaI`o}N~= zJU#_|^3B4cUB-br^#jhA{GJbQ&@{mO)E+(?o1Pbzg)}phv5E1dxSARhJs%wzi=3KT z=TusLrfAIc)_pImgZx$}Oj)MF@NgS_eTea=&rQT(pdu3-LT?Bw*gyd+P&mk@$kAkcBP9J0#{bGktk!MZ|GP2pt=6msUP zU16Kmr>`RUVGLn^6kEggS|&Vo!ZCVk%* z7kcaw&f65@xh5Y(#AM7Lvtff=Wb^=j&BV|!Q5?D8%dvqqc~3eT23)KgYyXyZ%IL_K zE?s4nssS_T_X|pjjxZmmgoKRHq?J?fwyJ9=wCu*CBFi)zg!d0ua!mk9eQKt;Ia=(} zvHCIn?2J?G01vM<|Mn(1v2rE+=U~879RH!4UtLI1pUlsHZJ$1RJ$jOND>~ScVKrVJ_B>`KA=~#}>+zZfDJoVd| zaWn@W5?ofe!k>iMjfZ|cj|RJmvsgXmwGBP}H`AQSkQ-;`yT=<`0~Rf|(pV)==Ce}2 z+{0LfWMh@=67zpw7^#!=#@I%=ckkTB_qnsN#=W|okdP4j{2M@1>O8tnM2!@e=xCN{ zu$vu!aV`Ff6|VdBm4W&v@q8F2Rtm=(o$N8LTA1mzvyWW=ycK%c|AR7tUjbaUsG=NK-CMS zF(dy>iOR;x78;6UqA}7bpT3SZRF+Hl2xDtJ$C&IwygAfzVFVx1xwd+oB``h|1U2(d z?$T{;ev`qc-Tve7se4_$23}$kudlBIFPzvRV`IK5yG)BwJO(XW^8z9s!}|u2 zVmUhQ4@(vyu?L{4p%$f1KiRI(jHrb<9b4N_A2mzPM@Zj=O9`BnnZnsjr{1!+eQ>F^ z+ie;ve~7*zTOE2yIFk`R2wc4~F4#%<&1Vogi!g*-kai$m# zw{2aCto77*t)yRCQ;^GQbVgpD^l7f*(#P0tEPa|x8_f4%a>sEgHmUH4h|>el?q7{48Q(IO1q_BbX&|gd>{=MPnMWw*1~ylM2R%K++^|KVwlq3^-4Xp z?D4rQKJIg^U)lrN%64fBndEWY&QfYZsz<+8vB+TAK#Ls6Uvc~mMlny�(ttO@ z@2gEX;tcBfjP#vI_@kt-6V%>L|nRVGq0WM9U9SR!W1~>a|3;(Sr+ciPGA@2y9W2_^< z{P&&SKn}c~6FR$mtF4UO^71sL%!*!;ja420Sm`zN^AYdpqT+L`^O3{GX2n{lwJNIL z!Dh$~4<0;N_N#=#oSc+%kcZ{uv~B(bbzk>+A8?&dR7@QC=PdZrD$iC{i3o`l_bcUG zM^3bOEP=I5@})qUya=TtP8gs~8XD#Vy@Oy?kK9z2S+v&B;9ZI)<9Vtdm;zI~uQTc< zK-@@wJYRtGPi$=5IBuBPMM>w@y)~rmEPw49rEFOC8rW`WGVR+ap>N_wd%C)kNVuan z2!`Z_w%kcoxAZ{RT@9mF71&78xM?@Hx2?v{oq6K1u4~q6$m^NslR{#F@u@ck$*N?^ zFx@U+4XB-9t9^WC#u5MKc!~II4}drSv=1T2Hx+ow*s)1@R!$s&tP8Tz`JiP#TZu8` z*E7t=Xj-KZ)8{v|^7eozV5fVVBAuW`6gxGv+mW>JMqt);)>$3*`STBYST919^3^y1 z8wzu@T>`9NRizb4rRCn-;PYfJsTlTPm;xf2jW9`%lQQs4auSEx6tmOX7f5VMYPxo% zC2Xk0Vp3Ic7b;eN4T#381~(Xwt#wlP+tz}$BWM6u%EkwJ22;~*OhnzcCs){hKYy|^ zF`ew^IRSRfX)Grxy4GQ_O0PYBk|ljuD{&0_$}qL7(>(8lhSTDJt{n4lQKWyphC{L5 z-`_uiQ7eug7N5BmTmq)^LHj8C?1QlI#oix179%CCi_qxkx^I&t$s*|LrI1XJF(PK! zl~!MlTHpBygE*Siq6xtVUu!>2ZkJ9?Nv%xI)2z))&8#!x2>5MNXE(c8JDx5(4(*HN zFO^P+-%92K$ckvOytOg%Y)}+c)TmGE3vJ{c2#rk6{8Md5KY8W{<7JS9<94R(F-kw%u8zcrsD12obl}U&0fh znLL=SvpP+5yYj{$j*N`7zHUn8wlOS721Z88`5H9Tt;QGw!~#x7k)Sqslb_fC49aUC z-Gy1!eLufw>t*EisD47Ke1xN#Re|nZ7tarOUv$qWfnj=ic|<7ChHrRehW|k2jLm+A zWD}uxx%gx{R$>tlBz--VYT@bOwSQSvZ?}8b^QCYAffTvK?DKIb!g##w;5r#B9M0qv zNS%(|>i=coxcj$6zK}kza8cg8KQ{)q%UOAj5eqCbL z@A$vDBX9Bi%=PXSFK^AWnLB6aqju&6Wo5kIkKUr((Y_U+yE1n4OY2>SV7%h(LM8!q zh;TrB$Ip8>J)v1Ex41exL7-Q3|9_R1ze=Ys~Hl z`gkUoWk50p2?CxOf^~Qm%MVL2g)8;+i@len(|89WVt|;VwXtz$Bg|@ud8nrz0ytO@ zl8bBDRfUTissmt#ht6g|moS4oL z5AV!*|CN4g8=4x33UG&o;?(PGmHU80`m?^X>j(D>=xm)22RSDd9Sd2^ITPW*&83CV zz7SwGW0)P@ka1_}b217Dyn9zrk`nq{bu@cZI?N5)hp1#}2Xt>AGU<${cshvS?tQ2C zz|J@S1DK<5y@^b2mtwjJRm>iLCs628MCHsh$i(Cqk)wa-S``^M3BAlX?-WP`!}%uv z5+oWUYK%9PfV239uaD2=`S~u~g$l$D{SQodZ=C0>3gBcWi;XzP?0}mOZ24dXNFh>F zW3kp3Uc3N4OQthbo@r^qA3rXD6fv-Tsq#^Rb1o$=R;KSj{b=&{Qi&qsE?nlZtOZNH$h^DrN ze~ZWb9S?1K7jw2z+b}%6?c%*UxBl84brTa9>?$RtWs}1UcmN%lu+Y)d*E%;R=(S6x zL3;AOFShjxdSeU?jO-olaXBqzfW%f%*3oZ{{i&_DySZ-h&=+2#5d#R*2$17UmHIOm zGxPDm0*QH4Wn^B{le6iL3>XFw(o)lk2nm7o#m3?87z(q|qVpr;5O1{X8td*9+iiMv z4v8rC5Ty$ckZm64a@kkwF0U>r+3S4eou^q$LryLPe7|~nfWP`g>oUD$53v^;@%pIU zz?FAUmCd#WIm&czK9eH>!A1y0U~x$fEh*{FE{XlwULmksrCGM!n=`{#jdD0N90c(> zCP$H7w44_w>!Z0Ql!zD4ob425o$lfsWZS+{r`R07;rn(rw=r7RCbUmnTr&|A4YW|^ z>}CI((#UvATZcZyy(T8X ztG8aKfgpnjSpIwu37efz%8iy!Uf2uPv)NFwUY};-rda_xyioq{OEQj*)qpKNySRY! zOav0KWK~qOv@WC9(+&1-;&kJ#E-&}1SEwkd8G_~SpvZE%FjVjYr_N@xZ(^c?eOoP8 zrBJ^yiToSOXhwLj@cX?kfiap+TB$gG_3~{?Tj#`_oarQ?;mKk=XA8l#abRvK z2>fXekms~g^Hen4++(w4HX;G%TXQ3U1f;;Nc$=prj@v+2O^y5N+E4^&TUPgi7s2Ky zCN5TLJZ#yOVgZB*)qraUOB1C(iM*VKO6OoJhml8Lr`j+jA=xDWnNbh)93T%p`E(AR%C{|!+Tw}HZD3^E5h z(l|4w24@@HFXiQ<#zvDJZ+()aV|m@@OR8^mA6wV%A|gQ+(F3rHBaK>1e8qSWn7ARn z(u-Dq0opHB1(h13{>G(H5CcdUNX*8|!ExG4IG*2SuKCoDX834xeDxeqg_RCh7sv5D zc4ayKtlM~}r^HtmCj@M|Eubo7{-`|Yg-$@H#=6_oN(+Lm!XxCr&ZMP=rs&^omWbsn zGw@r1m+d}zj7Gp`c~)dl-zcPPqM2-fnbuc6SFPz^d5`7j$b_L8mz+8;-Jn>(- zI8bZUIIVw_j0Sz!HjiygeUK`7$jk8VG zP6Fc#KnCYMJ&kvt1COTKnB4leFso~gR+H)pNuMnMtdyoR|s;8L!x63L>SnUS$p+6_P1o+^a$ zSbt3j3Aws3?KRy3N)i6flH5g{+?xs*f`u5d7dIC%^34 zhW9~dtBQ;|fV2Y-7uOt0K9QyP^u{$2s5TLbGH1yK*((tYTFF@5tiHCtO8i6L34Q2G zs6T2P4^sR7?auOz1+oQSZR+2As1Rj08&z;L74VErmx@b$s3Y<1Ra`auyOHvu9QDN) z6;Xe@@ar$$hy4o2eL*0G0yLq{M`zT#D^4tsbg++a1Im@dY`UjPuIp|F&vMDLf__U zArMihhe_`NA-H5`W$R<#HEW)(P0Ikhran zy(vx(4*ui}5%kB^kEGdjGxoiyu=mXT2#Va^{{Gn_n@99+>>&%({QM-5P#TvfO=FpQ zbvAG_=q{#$G}YPXcIwoKh=^frU>JYAdEL>~rB-*)zcGluBF?sV5umOxg`GE5zWW6P z0RgC#s!%2sN> zentQ8l1w3|%BEt`?w>rL_d<68=Jx};i|nRq{4VQqdJ*?u5a2cvVLZjOvd-y;5x&B{ zFt+-K9TkrmF8D)+KH$(do7a|AkP$rx5{+Xd?|#kI|KP?pxZXiplDad0qF zy-TqSZAf}O&5uz0Hd%vcX^DLJ0t*Y+@%I8cn$@4^XFyPD{RRX=O`Qqc#jW2&Z!6yz z>m46g@SQtYu#i>oTki~I3SP1cdwDSz#cELk6{cdipk(#=ANc{on!TOViK%}mbjcJlc(s<;;@^;0@y zs3Gw2jrB{wT@D#rsj5!?_;IgMgu8y~KEx+h3~t~u-!9! zu2IvZK#BspDj3)siq0E6n>yggF?hfK^vR}zDh5oLDfW?ZZpr}s0^KRW_HD((hmVw< zi*Ru8+FM%I*3E4_^77*AU0!p9>}t#g5b_K)H2hk4&8Srq%WV9k#Gkb_7<3ma8yiw6 zI3|PH>gj#1*D!nK+|*Q2HyY5>%-&{hGzcsOjdp7y>eS0^^}adr#%b1@U#EC1aX3GY zICyxktGkuv8Yi2xviz1?g9Ipk@T0k+OKU)98fdb#v=k1EmRZzTmf+e|XJT3*^Z?=V z|1Z`G$5I$E3Zmim1CxsVrgaeEZHGqrN;icPf`YwMU1Az?$W}jPHijs>@S>tFQ)~_F zl*F`<4E^DiZDx>i_F9qQ&9lUm5)Zp=U5Vv1xn$iL?T>si?lJgxkKOuSVE%_N#D4z| zVW^nqaDy<}nHJhIeQx?cMBU{!@#?62~f&kWE z+D>|4Y;b5~$jN+{^y)1=4Gl8~OR9YI7S;D|g=vnGHv9)c%Q!e#@)~l}iGRq*O3pm& z+1M0;)ar!(N;f<>ug33_f_`XHQc`Ic`5~LHpKohaw9Dmq1u2jPSwLpf1ier0-gN`Y zL?o_>A*6?hosCKI!v4^YW?>OaQi5O7*vzbrk7#>wGv@d2p*$EooL;@g?li~Q=Dmi~ zJvQPV`ksk$&@)m{lupb;X`iGm^pQOemOb+I3CQLztH}7QQNgGaJv&qsxW@swD7@K= zFUAJzB+ot@4Ni7=`dDml49h$(j7rCIl=a%fzxJY2d`<$KFwI6Com$#jbqkmS$xgh<)iO4%v}x{_V_;XmVLXQ0p$ z67mG3I224jI|kKDbuyhq_283LjP&mq z7-)AIq#yq63_gm9sey3uWMOpUNM{Rxlls7w-|&-y_{fo_>72h`u~0fm{%pl?x?K?9 zEV44F5pfNOH0>22}$=)wkZTcXeZ>=J)@q;p%e>22nWz& zfH|RA1VYK2cwuqzUksJ!^e=#}(*m8G$?Qev@ajEWIG7{2aL5JPgKBBaM~~o+rzUk8 z3;#uN;C~&@ll+I{AQDgKqfXU=RfDocAt7SwkWsq=4WGARq$RS<4wU_t2bMR|vQDyp zX^%e@&zRg}I5?%tRS)1l006^U82Jz$1|9hE0@X_&^e;PukQe*)=O3b%1U8d9!eBFxnn0WIVK}JDgIF_?M zk~7LN5W{Ar_WgTwcQ%39<7l7-*8SGw)XCwbTX0{YBY(!?-be+N@Z))%=h#^p@`L{A z{Q>cORhA;CROa)35ee|}-68Kb;90!J;=vvwHrgjOknZ7n;Icc9|LPUD-40roGeFlQ zW7sz)3i)-Zg@d}D|Dqq8`9Q<<*q9Rbcs#ewZ!o6S+#Xx)I9=;nQG*+Mb%go5TX;j!xx>@OsJXg?AKqmnDZOF(wTWr(8EF5us z(0Zc$9T%q@@M$^TrW!U4Un6j$)|QZPEX8v9grp3vsz$32HV{@=Vcv=H>ET|Ib?KbVc`X) zG@~6y&`mm3-CEsY^GbHKR-Luiyo1EI0IL3adQ~RFkv$>5RqBq;_O{kEBYm8w7L!lw zFU$|yh$PVidR_93Xw=*}pa|26f@{183Ma36QgOwK%4+CTi9v%aP%|C>3Jybk@}$n` zoS@m^;l_XXjHxxiXG~mT%WO~8S#gw3d;NEO+lh$6#ps zCcLBrD2a((>>VWTu@LDWolDGD@qCWa9v+`Q=nQ5Kuck@I^aQ?;nZthYtjPXcR8msA zY%6Fm*=x|~=YJ6x@j~y<^EJzL!1M}>kyNT+*blq*zyw`>guDB;dlB@8lv-5O*Md&7 zD!Tj~SlR%HaRN_rz~=Dr_eWawem^NxLiG^^5xj(a-_O7}mZhbY=FBv>pjzWvn}A=I3<{A^?6)YL)W%s;__H;-HF&{~J7w{;zb?Yk}Kw zSLX+}Kf&Q_TJdSw?{;?jU&sGnJ%2>O$T2@9nJjzD8-yC$xCEQDWLfCH5O}5a2QNtR z51iKzjNFg?x(7Pv9{mNiS)?9PA8v}oVGh{8`s2haPFpPF`_D6Im|IH~p4cosh1#A@ zpVf^msz^R`M!TH|=3mzhols-6TA1PfJImj2`ku1K>353L%U18_1S|wCV!mNBL4$^K zkKUiYyyGec{ztAgi*5Dh-zoJw0u2my?k5k|x6$PA&+gue=;wX~Q^jZtK>8g~{!UHL zc~7nz?y0*!7A<6cSjTbuKRF+&zm0u5@a69}1Oh|X$U;O9W&u<^ z{Q(OhOZ}@yj`TDVrlt-n>8I|tjYmF#?WZ<+&ZuunIKT&*yP>=_)w%f~FK9a!Dm0{%CHhHMh;^Uw;7MY1`|*olBpCk21^g7t|Jec$@|B zfT#-mBFh&P!dZG=le3k0N(u^X$opn9=&5)pAD?1$Msf~ExoO`!p#X2t<;m@U_^erD zj_}aX3%xXik8j@s1u^G}tVWNI+1fgFPuy5XpPIOw+;lsm@uk*j2UVZ`FeNv;St21p z{A6NXVA7A0bm;{zQ)tNV1OI?9X_75A(`!D)U42_wvWIa0m)~X_JHnchq|+0}bH2_L z)bXPqtwE$*+WRY-(>TmB1T6gB;{$b7^xNtLiSu@`B7MabxVfUxh^^whwoOah0!y+@ z^8RGKi3wIMFusIS_9xqOq+k5LLXjin+K?hv?jKQM<4IrZtv(~V)U>h^&k7aX3>T(# zF)2KBg_p*Vf-^7QHkPfICuKpx(eF`TUN0$0J7;!095Gm19YssiX>U(yHnUBD7a?yT z+Z(fXQ#)q79&LmrqBw&qr)L;DHKtXSs2bsnN0p&(mS?N09dsGgq;z%co0h;+E35gm zl-g>C<)c->_*8YOc!Ev@yo{BArzu`egE%my-Vvitzy=Y)6IJwkWLw-Fmkx#;qmM@* zDtX^A=G!-Pn6OTlDdsAQtJ!W?1s;%9U_53BAg~h&n-&xExhc((Y`&-xYE6|+5HX!y zZ4(}2Wz#p3fXK{#5K$GS;AAx&cRNLp{LY4M^>hXX5UfRw$OZojwO=G)fp%i;WDGW& zUfPyt{N_+q?Oey&EQc6oB)uUd4s%$mi0F<{5fiA(hntL7z`Xg4BM*kt407)#=MB+4 zIr!bD{OG1^!KWKu0fTc32^)2GiVaH9(K4>~(le?P_B!)za8H-Bk{gt036Zb=PAXb9(H_WPYBr5wA1Z$*pYFSlR6NQ<+1dJC=@=5o zNNVyLT)#gVrf&fjLQ!!)9_}?n4Pg`E%XpjUT7Led+r<>+L3QAW~15Pd36kq_5Txk*X8jmfI=Y>-Nufj13L_ z1al-JFq=yZiBZ=#$!%q5A5&{?=kPqIz{|T&%(qPRJghPNA=KJk-vH0sGhP0^n^$kI z!m>WOO$pA?G0wUvAJ4XHA~xj9(>xTU7#TMOEkBd@e0{P*sfi-(8yc&QiOm?h>N2Rj zIs+i$CkV#Bt7!oz-9B= z_jVsU6K*S2XlZRdpPBz5wK&c!H(9WaUP>s~%zQm{AS@zMm>j~yQ&y7$R7?!dgQKjq zVC~L!*;Q)nV+5hjm(E||W2F=91qMVmR`SQ2qFsjPcai zfE3*&%`6!T9r;06E{Le{yIf$tJk3&9Q8`!@#(Tm#z;&pX?le`FlbYOIX+ZYCVy)f{ zw%HeluwPH;PvBj)euzKa&rSD6Z}s}rt}ZapDQak(CL$KvF2`` z^Xp`DT5)veO+NFM;ceJQ35mYUr*$Rt-@p6bV{UFEc(rLUw(uq0YM9F-fQ_m{e2i&) zZ%^urGn!O3B78UtDkD8EK*dJ&w$wt9&uh48TtAuS$L5{-p~N8`yH4#6-nVa8wgeWU zqLuc}M3=&1K4|hpGvg3JBuugyv=5t(VIM6m5kAFrjXLX^+>uIA%Icc@wCQWPCK|T3 zOw03oqR<^GFv2-m&&TUR?)oBs7PYKsVM+4Cha#&-@?C`6o1vjdn;2~)LtL~C6VYT| zrx&I)g~a4S>(!V|8^#Iq=fpZ27{;*t>2K;miqwe86NV;6jI7(q0J zKdz$DH2xl363>MGda4i>29ymI9T2n=;8PhG;MASwY-viT&t}rAbtfLseg7zDruLnb zXX}tOv!-UcLnbP^5tCS`Cvt6~G8y&3>x+{d!2m&D>~~H3hxs)RN#AgXTmyfb);8y{ ztLt??D(+&igK6n2q*WXJfL}6}BdI0kwj+9KDVAF|BiBO+B1e=YC3>*1^wikdfD9<1 zaF72qnm`am=m}H7xV1Sx0d?VcWJ=141(y8qQ-x52vs?~#{urXqQu94YsiboE7f zrit$#Zf@PXs56Hn&qvKJ;+>QG)fGt&C)) zOP*Z+dP_^DI;*tW*lg~b^@_g{758x-N>hZ_oj>zY(>hu7U0uv#VsfSEVIb`w9)aJ- zL+*)_)pNO}IO4&CVH9*^2_qrFk2_y8e*56@gzP>l*R*9C>`zilXN-j@4l3%t@~-ZL z^%He_d-8SVmUxYsMR4Q2+FT!FmpeI@{xij9C5Dog^r+Xd|LqPzh{M6JDAkNS(ryL8 za}t4}KgMJ*6d1W0QR@Bssl(c2f;hl;$~CdejH1M-nT)x@ip?ZR;9Fv;XJ*wwyKc&| z%v@SmQ@wZ;@GNeSetHYrK(UGAW!2OS6SG^OKZc6>cNk^bD6yLYUu0LHxl4%&*uNN@ z>|8>)@A)2%lDzyQ8xllBWptBk>(ezhV@7gME_Wk?XTms$0OE)&>37r9>WK&qbDr{j z5wD{r{@y$~tU_fs&!*xohM2VjVeuF6P2wqPrQUCOc}<(^Am$w9aN~w$l40_PftGB3 zK5p%bw6#&#J9=O%^^GF#&H=^u=@R&sxvm_;VeW(y4E9LVH%p@$|1B*gmx-9WF#3^0 zGR?gW*S*wz#gx>yUm2H{u)&7^VJ{Tb$3ZWBW_@C8;=Qy*&%5ei!EcoPwrQVM4lP#{ zDC29wuwA;??KZ)5DOl4sz;4Z~uzw=?eKkHYIrWQf&d0)dK}vobw9KMTT{hFhBvnc3 zz5Vg<@j{D9>dXh1<#yq}ksqP*Ppw96Xs5m*j?KCm#@8mc+R%@#wT9!n+;p-YayrZW z>nz{9?cSWoAnp7xVzz>y)Iak^Oc)Oyh(1x05foPx8XG7$;C>FOT_XDPjESyln>7e+ zMz&%+Us>^J8q4S)Q&=*?EShz}C^2(`oUqzK-&Hh;tDJ@g#fhY8@uQ$7yDggp_S5U- zO*d0De3(V2g$0*k8f3cs8>7!&M;FVgHNVqXk~b(~EO-DsWiY8`EQ|V1z}2;>j}L&1OqJi4D+$Y_?}Nq~bB;d{vVwM=m~IRsxwQDe5fTB&3M zUYfN`qJppZT;q|)ek+lwVNw%Op2?r!IL*jtrDwRoc^Op04YCpEzat~JlGB~WzJ2Gj zMxxuWRes0dzDE)GvxknBR*z9xM>R6LwN?4##lgOK65q!{7P}x1q!Z2jh(+`E`b&$` zvnp|qoLshqdf$@+(X=(M*jNSAcpduK9 zQM+B=0B5v93!*rdm)cb8kp3&Y$7HM^X)rtMjj5tC89(W%pLm@mi;TRc^L$R*2q$#t zvr7}zWjbT>3oL=-!yw6%O(p-_7D_lA~M;;|$i0r-&dq9_nf{Yvpz&5LH0=7e+q zNVKSQC^R^HFJs~XKMuLP9wtF!(;H@jk>Rj#-1OQSLkDrL%C0Y}!iIyz%7c0$6T^Aw zvVMjf%UWMvVE;}_d$ahZy|Vb*cwZXI#fU-O3&ru~>S~q9>|0mm*Ij=t;L81i`iYqK zS8}KWrpnlp3~|^#UEPxlj6cyKw0RmX5XDhD7+$(fPTneT|82kKMaJBsyZDw?yf@7{-MnH()39(%0Mip}7++eUo31 zG>qtSy1qjH#&zVpn^>AqdlwmuQ04N3YAo7rS?Q%?V`bO0xJt$JUvD?|1;kOc?YDa= z%dgJFaMxW=8RX(Dr6%h#4>LdY6|c+l>6X@4z^(6jhf|I$c{gsq+gmv=WTu7MN9Nrb_vlhz9?d0c{*FASeyP$>qBScylrus zIWgzQ!6+0FKBud?y_TqYyDF&!6_>^yVIaD8Q9ozpjHdk#Zk1bq}jCJT0dQib+&EhsvRkDv{o1Tnz9r?~**K=Byu)I!-wR|$#AXndj zd{+R&WjF3uNW0G+Idk)Ft?}7aj)>3~z{`f;eA;R-C#`2(Mk%y3E1R5=vK4&0u2fk6 zh*C8ixOP*ImyZe9FrGd?nJ3E;flZ6dAUCk;XALhtwYQ;Li%3_JefeQ)3PFEq5pdTv zTE=O6p_6~y?4fcHH^2jadSLOP#O1M_WvNQ^((`K0?jt^lNuY6rUZ8ykmd!|wl9DAy zTQ(j$)rm)*_mCp2)+1~zO0WwWF-29|B^h-b@+h8D!I!shD(G+N>w_$C z(ymv~D8B_`?#)pH&Hmrxe{^d9zeZC2dFi*n$?i-^)ziTE+(0N*0-vny_JIZ$A5M7& z`o@fIAKLE3%?9be7IaV$_>3DN-}k!Y79HA4_>^ApL=3+V^J5{ifpH7xHEaUpM9fmr z=lkD2?s~(Eq(h3{N_QJLXlM*>U-!;l@gAky?c&PO1mn2~*NXBd=#V#gMf<3#(o;Pb*c4+&G|! zpJ168Yy=vfJ7=DAOohPnv2HaVWdVyN(&c`=4ZXGtDFaj7rR}P=9t@e>);GnYlQLXm zJk!=U-Hx2CvdiEwQ>h*two6Z2HPhnLMU3p2uxrnA6#h=q*bR0OaM|v6HOKAWs9jyV zG7}tQ5hyqI3motxLLl2ahKA&9RTLFJD2oe4lD|T*pEs3`>ly8u%(NT~jENq@8T&eV z^ggxwJY`&K#W>xaw7(u9_VgrYb(-51?F-^Fu2y5uvijQn$=lYixacrymz0dwt|c_i z0yTl?440zn7ProSaBJpPS0669p~c5^)0moiR4!fa_3ceu%1o*Aw+gszKP4f1&dWB6 zA|oYOJaoFwmetO-UfE@LhL!(pd(3m#u|fd3IXC8WZ_GeW{c`93;qJYI;cnl!(MXX< zB8?CPkwmZ2yM!QmS-nQ@R_`Su2!e>-d+)5eRu9q3uFh)FS-rP&d!FBK&YUx6=A1b* z@B7ZY-@nXat=;>3-`DlIKBe|Ilk;V2#f(+Fx-GJ@Qb~8_f^Ggn7PG-oEG47tBM{)R zx1X+)L|>7glVNUR1#_78`<5vk^uZ>BB%BQ1{?JTha&fENb+x`B@--FJ;c-{FIv!sI z9)CT|60Ic5_45wWEpdX&S0<6Imc;qEgme^fk#4YnMAzJz^xk+OOkJQmt$uNcPKmtx z=9VL;!iNu39E=IhQtRVH5Nt!Etg-5(iE(e2vOw&}sK23`@oPKBC1-@*R|Y$&$TQh)!?Yi{K%V!PED5h zx+OUA)bey2i*bDO)M9)9N!}e&wSL|_&TeCTCC$5o0k=++&|*rLjEMGXwK~EKVNAt~ z&-{5WHIqgP52B~T*SWg--qB!VfO8`~f3)=jA^{CA{l*1NP{GyRJNrx=D_D$Y-t73$iyj}Yk?rt%*Cc{VB?0l8y$#&qVTx*brQP)@zs_R*$ zc04%t;0%A{F;UbHEzUF-Nzt}U0{h|(cDTg{ zHH6``Y>ka`uY);%CP@tJj5A+afIq(2DCFaCM7sy*)}4e>*%Oy$o8(~MEMDTSGw9mm zy6lA)#lkn*nyv86bT|?20d7*GNg4d?`6kxN;wdwALu_`m;W~X`{I!8jBbE9KLoxkZ z;#NZDn>LdLAa2~T=fE`XP4;FyUoCxQdUtns&V`fVNLz8cmQ(U7PzcJA z`{rez1dz-bZ27Dp0Rq)(gn9)KViIY}NC4~P^ z-W4$?^*GNR_MM$1B)?}mvD3L{>*4x(^dmizp5b-9_cn#$KG@JhX>&8bZrbf02k=ji7T&V*b~e4OShMlXZE!LdztHgr_2;q7f% zLo9v>nmrhf<)v9LP53-v3HnZv1}cTFHCjllSKaArzJ;D1&M-l~3qGkDXCug)P7ZLs z-MW07ufr7^^tr1LN84X|YS3)94*Nj5n_jWItNY=;62jxn>@9sEBY5zcJiFRiC7!hP=||(juJ8jacp0ik-JaiuvG>`Kk-&v9{Aq0?2Q)?LgeK zRhyORN-X$a{{!hf;)>w}CrQz$<3hGi)7g79&;6Zj7iF~uglO2)9Q%jYtEWu|b06JN zzpkmmzh2h~M=?=JGfmB?=4^tbAEew~Bne{(gA45d%*ox~u3q0AOwT3!uC9;0q*R;?-UC0ckIPYOmR`@{`s2wDA}#7pvGo6%bw5u(9*S^2{)HQTY;*0 zf|w3>%@)JQl4=qW&@WWFDPea$#YRVOZjSw}jUyi_NgJnrVrMrb-Y@8Rcw)qQ(+M}} zllOVoRx^Yg2!$E#CmJH)CWYg6esDwc%EOHwv-tcxI+(Sw<2kBI@%S~fQCwN_V;@Qe}%=V+{YU>lFCkaN_ z`7@#R%N;uPQcuK?*h{KgHeW5EQ@*S3e?B2J04w<8zjM5q`bFyJ_=e0cllL&__?_0t zvcUK?Ni!lIVWzay((f9ql+UZFQwc%Az!iT*)lSr1$qHyLm@r+U zw$J8UI&dxcJUy1Z464hIWCn(m%#>z+^ft~E^s=%lZWKLP-8gO6=Ayk7ASbkQ7;HY> z^Xpl^me+7$xL;_r2JVqkZ-WDMyEaqQP| z{jHSvw$W~xbTTK~ow`G6RH(8a$wqII$w{$Eo1LyL>8*>vE&S!}1<%$EYmX*4y@{b~ zNmtpg(X(2MUAG(k)TiS*-Zm($s%g~rg#aa(W4~*8+Fk8~FF7!xIEOCx!6$eQ!Itdi zzM!QEo`1$sElk_>Gby2elFV4SBmjst-`Sc)FP#z?*X6B_qpG-A2euysDX2nb2`tUc z7Z-&&sD2SG@ChLrUQ=#2WxcWg?PvNT?8R8uf{3Au;jh_F8e`|(mSAhrHRzOU1lL7f zMS@wYx{}BtG|m(<`V*8K!)jbgkZv=>O zQ3vdeqUC2hQL#5)MiCY3EYl9PX){1&O~aT|Ms;;$c^L&_xS;rSL&J(Z-WQC}bpN`c z;f1}DDW^&MeJrl<5CKLF&v;xzn<8Do{Xr>m>-Qmt3!8VhXm5V9*cj~Gc`bK9@GI!o z&7)#+rCm@>f62YhkDEP{lIbSnuyO|5X>?Iz>1j3A#`D(>UD`6D;Ym$k*W{>=yV4Z4 zGq%>jnp98nB<0@ue$wbCPDxMOS>Bph+Q7+j8HrxEwfPP>&WE%eRL_Ews9xtMdwq5XGAr#eFt`2}3rLQS zyyecZIh?i2`{-9xR8Fp1?R^T?QTH1O_`K*ZF7u16G(Me;w9iOto# z7yBQiDdR~&XK0qBfVBmU5Z6|tZf&kmg1%*Dr5%Myti~+9@7{wTE3oy?IDxgoN~4g* zsvvg;F~M_nHLI#Iwa?6=T);zKi0B`{lqcD%FWvhY=^yxNV8>I;;cT=GuY0KU<^0Ys zpxd?nojna`SniEhy)@`Hry|P>UwvA-W|?S6sZq&own}7rYmNnFATB45Te03r}Ysss^#5L_fA^0Bm&}YJkSQa zZC*OefrMYdc6Yx$0Jqe)bVoKR%)wK%mx3i;ObbEMgqK^*QXG9rJa0VY$LvN2iPaPG ztK6F7eQ=u9&7CJ#JKu6&loFVn0G0ks%^fyf5fzoS*^y5Bn55L>2VCzMSS2JB`i8#Z zO{NpDawVw{lP0(=j_^5e*AqdIQKK!Pz zp{UF+k4c6<)dbI}tUmCT5YS@QvPn7h*7H>+i@m#|2=+u@FS|7*l+$clZ+UyyxAnBoa3To$E4MoUQW>uAy zwuo~Hi`S&G!L-fZ!;DI#A^x8iBaL^sZasT8k0)kxsyVppE4)C{CW3YEesFFc&Bu?F zkf!fT_a6qD9HU&JGk;_^Uz)0^YW@zS<`;M8XLuc+4J)?z1Fv&)s;s}2?kY74&im1= zI;)Zzhv49wM3oQO^S|-aq;f(fk8tcCv!uB14ppb7y6mb^TOZ4PsXu?+9b~tpQuNqo z&=YR^=$kPv<65kjwkH@O9TU9*yru06Ql2vh zVz^+kKwHbVUwZ-8KQ8`uN)SHw=e;jN+SmQv_n!d%SVpyD0Mc`}S~?RlPn$P>o_(J0 zD5K+I+EdDDE9egA9Zu=H>LbQi96sp|W)0aI0v4 z+`_wxxpmg77x#bzz(3^{M_yIo&p@kB)hl#7x|>$r$DqMmvV{mj_Bq&jp@Z<~2_J!e zN6<>EBOK`j(M-}_2yw?4Q%!8~3)gB&hKH`iMw)P`Bu}tipd;jt8t>uCfz>fGBtMUE zzSUZ*jJ3>g)cK&lmKIpjqe_L!J%d1?R7bzi*@XCEC^2dxyLc|iKDbt{GF8P|Obin> zxs^Pl=6dn>Yix~@HT01zxlhoXAHAHj^?H+Fk?&lhyEig7d37O%yk_*?Il}JP*F-R~ ztm$V>Dfu0u$C~&e z;=!F*{uE0!R(OAeYQq%zCH^HaA@Vw4`p#92AI@Wc@O=0$D%ICM$0k{d)ysv?iZQBE zv*bBJw6wZ|%jT9ZZTg4S;7jfb8?pZHM|^TyNju9+^d(psbx%8teVbxbo@l3l^K0IHeqdOX|G_#(l!YR>c8Ys( zdj?^a{JU~mzQ^20o9Lf=_zB|()0FFBM7o%?Xh%F2NH0p6F-`q9>{HkI*`)&ckpfpE zMm7;E4HE;B*aUA_(~8i*BaW$<;2ccYvKm#ffuo*c5rb82- z`fxuwzd9bq1y~j{+Qt2JxBCMk-p%X#XYjtv#(V+o-Ised2luiF_ikBgv*o*H@ID>v z^tOVxBOdAruNEQ5#tHxrbS{En-48pqw8&0H);Q89^T zI`6j0n@X%LXSVpgHNrrtC;BmmLESwRpr~JTZvt@ni!Ro`5c3!Br%VbbM6*;G;5A%d z|3AR>FVMGrk^j&*w^IUA{Dg3>xtR^&`=bI6{-J_;$sDU6NBrZiMUvOO@CN_-?*QQ2 zgyNcg$fXcXV1nO0wA&pd8OJL2AE^A9ZMK%iSA`h7<#UE_DL4M%|H-P0CF=b1j5p3F zx8Z;i_|NtKmf`yU9XS8z>HduZ{qhF!URX3c_8PdqaooIOVxr;m_SOu^^$U3kNV9+i z`%mP}7xKa?Nxe^XFaP^Juhsj!_y6UBHa*TMP&=m3_VL-m1(n8)(28a^ks`(a{GMg5 zW7qgA&;L?cgSy+e8cH}a^ccWV0N$R~9`hF!he@_z0MT^h50=LJtd6pHIfLO9`hb65 z6xI@ZP%U}U4ug)b5BUu)>pM4&|LXj3(u-@G!}u&;a6Gd!e8XnM`XK8XJOJc`tk)1N z%`ADuKN|AF9^%o5wX6U+g37FL{Olop>urP+1;D>pm}U^hE|I`GUq z{LM5_<9cfUYT-nKIf+GB=tW(r115B=M>dru1a&Hbl(6}-~EL#ZI#WHQNH#W4> zn~knD*d*+J?C0LKtbP54fUWY}g#f2wt*W0VZZozb;Jx&cxEhta5AM*w!a~cv5vv~Q zUNB%{V;eF^&$xAQ(b_6P-_g~{=eS~MswAZ#QC3>|ii2{vV{*^8nlL1u(>}DMq`#sg zjJvgBiH5#_d!}~t1RVl5ysx*iw%X`&xj(#T($iSvnbYUUu!fmL_$H*M=d(JtCjy&d z?7Me?7qd*VV6aSof47wMCzrib<&Q2e5{3$#g`O)9M|6a-%yeE(Cpd5N{9Rbrr9=Q< zjf=DW*sDpqrL)yZxVx+C34p5#G9l}3E2&;4%v!WeOlj4TaZ6TpoDPN62J5;#k6W!L zLW|bp$X6|b6?An?cD@37MLUoM4Jr(pFl#$IdHo4p8%ONrJ{4i-7{;5&JK7N1ogYr< zQf4<}_uAOjsKk{DmTG;I;fxWSC4ADRor*~6Ew&=LoPcd&Iu^I{6?bPg5CN)o8oZ5V z1jgA#8th3dMx1YMHxpgvi{i|lZ%b&HpN{rXo=>3JE9C2FoWQ-p6Aw97n;c;daa79IJ7nwGIBFKf6? zhOhClAV80mqa%`%tW2OCxHhI1>!#)wg!uR@=?k3;0TMenu#=@Ff{VMjJT*{f6=SNs zTe0yY#qXxei+T36%dA!xa{5%EQjpm<%tDQBvkQdVmA|VhHvYA3kWL zY3@sgw|EFpjG`N?3Ti8|F#Mu> zI@~$^CY^m9R!1Ph!n@ne0&zqs6DQ0mLPccLpSy^>y;HDp6Y}%&vU2QYheqrzpUf_s zSX#dRyxFS(%b!X0Dg0rnWcY1wT9ap-M_SY{^TPrNjUb_?p?OP5$zSI!#KaVx)ZnN| z&1TOg!$=CqUO!V)r3m{J(_>@RkOV~=8yk^IN~}Xex{YqD%j>NkctO^s333loEDS8n zjhiPa7A>NpqAw7akAVRV(5&2jMDBe$<@c;s`|aV@c#ABj{(fZX_fOgBx*{UtcZqFW zonkHpy-w}MyDHgPEKWbNL6EUyY7jgFPtWOu>Mc@UyI;Llg0{@tVJQAy(S@pAAa<7YnFKZm`y}JP)iOtVNJGIKYhgtV+(GBhM&q|#h*dy~I+JWF)MMH6I z^>CwYn+Wn zJ6fosYT|~al67ry#*G`DbLb&S*Lxtf8}17=34=3m-jvv{-!@)lCpjJW4E}M|Bn*dO@Np zJB>Ip?QeJ^R{5}Gy2kUeMOjkFZo>i2$+)pu_;eQB)mQhf+1p<-U@%x|>A*m4bdAgK zV=>7*E6e#+fW=O~qV$Mw0}_0SW}gER&~eUFaXL8(CX+q%rpq^XJ3Td#CF8T-t@)a+ zKXZ9&+<}MZr0v`B9(Yu+hKqsSa(nwJNGgd0p4&0$6k(W|$$?yl~&-^vPXoZN<_G1UCj>a)zwmDwV$}nnWX#f{w!v0x;6=NET= zSdg5Y-nF5A@bErIk!cn+b&kKk-(%9L#?V??D;GFt5!&6Y0tqvpF&G%I#eX?hUA#uw zUs7{>AE}4mN9*s5x*j6>nNoC3mAgt zba$1$>@7<-Ivgy`&MlA&IjbY=aJX7q#pJRd3VF}9!2gz)D{7K-S1dC_^aX7 z7rxNXDd_1tg%{`xY65~KrKOEYg5LPtg1qVaMd?;x<2GGoAe11>p$pM|LrWQT%|(D- zM=^ep1ZhNTLjVRjc>wtp0Wx;@r=}O?^=Y(aWRmn>?(EpMFn3KNGsH^-!?tFs%gcJZ zyMurHc*0T!i`-927^N@P1Imtm*S}*s6BE3^s3JUkZeKsg^LpI``a{;~H+a!7rKL3|re}m=k$Ai|JoA>553f8w@gfM0OAE!~1CpBv)uXC{$b_5NOLIa{7R^lc<=j`CtY$GjA32O-~S5I9?Vx)obQ- z=msy#86OUBE8}kwk%@IKt81~bF6g#R_~F)c?dsM+fhjjNm-FJxk!Uv-7&ZQdUN|=CpRJYbCIPV^pp^@?O z(jtzIm)8fMu#(24Bu6{R`=aljJ$qK$985ean;B4PT|#?$95AH3G(Utx#2j&P@7sKml&G|vo|vi+jjzl8 zb~{H`LQ9n4&D%eXNfF3zosiZRVF*N#X422^&f3}^5HNStD%7FISUVk zg0jf;U|HJUW`b_L&nHuxCy3*akP{ap868nJIa%506BX2UMiUlaVsdzKR#7J(2#+~i ztB}`pdq0!RA@+`DJ3KkuR<%ZxWo^|AUT?eD5E2wPJUp0&_2!K)U=z%IdCw`p!X4>u z_q_@y^Xej!Cp0Lrpoi!-)yDfH|!+Kh7s>}N6!H=FFU(f63 z-gJEW^hw@LRu(gN>x`kuk|uXB-*J+lNF#;Y?q^8DOP(4b+MNeQEA#34v}Uwud?GVh zyt>>K$V@<&yUn+Eoq>U#*bn((-sDDKPE?G9+x@*BdMP}_@_9@F^2xkk=DL1u9AO9x zl!>kWTwCJZlp8MM=CIjz@57(@`QnS_j2w`1dGK#=H@C){vsVg zB6Fg$m9^NQrl$B$R#JXG5pTW&+*oB~7%>d$adBJd8qh;kLi=SwAd^VOL|z^(Wfr9| z0YML8HT@gy4<8hiWug+&p@tv5kwfOD_e8}-jWcsVDp351ZCl$nxsl;vy)B6k>>TXB zgrM~t)+?WiWYG9kjM{tCTn*W0*sZHt5lYEMc;X;G>0;Qx#_>wpfB$ z-G4eeE3L;-sN;&9u~Je$mnao2C;TV)`W9BbGO)6;(^*3Kcb>RX%(N#hn;I4juFbzG zT^dJo+jSm4T*f>Pqip*<2{T9MyGFP_{#NJYJClAK<>4W$zd4b@#6mRC=q#R7)l&`b z=X@7I@^fD9N+4;Iw#3LaME3D;JOxM$V$&QzHS7#YTU0^5sY8A)2bdx#Dm?P(y>*69j*kR=ck5Mmzfi6ZXXm z8oh)D&07TX_Ffn<<8Fk*%5MN3@3xjf~X02G|<~1XM#+R1RUZ2IGl8$k~8-7w20B;U@oW z`hQoEYR91)w^zA;1~WC+=wjviPoIl6N=gil?X5>%!O!G(N3FTJtWl|QTNqfG6Q>H2 zDinBx8Z`ud!PVnNC?rFS3Up`CC+IiU^DE&ZYih9B< z$nY)Ij}-o*dRYDZyE3lv{WE7M0Kp7)VMM-&X(tHN^uT!_Yk>6i6(M?8h8J-7J_`9#H1YesOsldhbqhwhS@wFR{zL4UQu zbnjn!J&y70D641JvD>36yqrFx*~Z&vq+p$bAdzdIW<5de*L3Y$`lu_qYs030uWRFg zNO$s@|6&3EdH9Lz|AXzswV&I+*Z&Z3`+xpZA4lPm@MHt%5!f+*&}m*ApB6;ay%TB= z?x@zNw(Rn_m?&agAIPN&A!cd(S%ycYK0d}GMBm{bk}aL``-TT9!+EAkmh>9PPLlvr zr0wv+#Ck}8tiM<#eiS~iU{!=Dde#dFxwyZ(s%dT&%go7{ZggKJX%G4dvXt!!OZ@%) z*{-m$EaYV5aujd^1M35O_%5ly2vQ znGl&7cn^W_@zLAQU`XpT42_K34_Bd|4S_EdF%g;9*;2@_U-}p|P4|E$MorSOitfI& z}6Wb4$2s?YrN*< z?J85qn5dK)W=F9N4c)qVj;?o8*U+HjCIJxG%ZXb;f%8m{ri&%r^X^o5)J04+TqJLqAq3=r?E{e7I`$;Vn za;!gnV!`F+G<`uxa@O1toc`iqZJ3CZfD00FEQD=tUIl9w$=&@3C>#Z{IeZ? z_Ym{9Dz_2_Q;t;jy>+X|(yEf(@%%zCGbbx9UY#8}s39r2yP6^XwL;He`BnROgy({A zRPV@0gKEm9-^rb{G>Q!^5wRaA`B4Y&t>`Bts!S?<_X5&c9w#P^>v@sOnCF{EM@Oeo zq!mNaE5s{E^e76&@49g>B!;OKV3&$K!~3Ja%>t(lx$Aa`ye%25n0qr=drtTWb>$sozH`Nz)h`SoDYL z1LNGbkD`1ii|ySL2ryZBfA6|pQv!%a&bM!W=X~8+*;s1>_gmxRpOgb*pCx8q*L@pH z%SH8>IQwNG_ua8cq_02WMZ?CR?^(18CoeBA22%`N-;I}+e0;D_p^7RB)1`-xtr$0} zNO^(NVsKz^K!6__?hbz?l#<6yBn3G=Ips7R`yOu-{`BeN#I1oXciw6zzU%H1SlL^^IpXh}{&#V4VSau}d*=2X?DCw&5*^-|av4oWj$Wzd{&woNQ8l^DEF+C7 zGYGt@tj^z9Ol)Fuv}8O~mP19>>mY^QVm#mL0vmYVmAxxd7<_uZ>y3E5Y&F5BjAMh! zSJsr9nO$kVKt0Q@mLnH>$>Ne5U&s6V)k+aC)hr9_%-UOiA$#>zWU5xs#l1hCZ>Byp z3N&RBv=Vr1$d1S4x9{E^q*>;xmg(&Q&B4hmTH9%!S4CxTPyu!G$iaERspQ`F5onIe ztI7;+y}Vg&yFB8UeBc(6!X70|X8Fa}cofOS?_?^pHOTldDC%24!2M+ZXxDvtqi;;F zno@4kfVNn_;-g+tVq({L-uKgoFJ^aljY1wsNXpiEMj$O(yN2r8abCY}aXIVW78%6t zVnN(I7wU6JMPyY+-LM3ax2Z+R*X;#%t( z6m(xiJmk>E`|7y)VyL{FN+to9RB(4C&G%s|kDe5SuH$10pZ%{1mua_sYh*)f(Yh*B ztMPTttNxM{?}IYBd^%t8A0ThL!Nc}$k`0E-<_U**i7ujzFD5EPX4D#Ct%U&a)hFm( zT%!1>IM0QyMHo!Ug72)kRh*2kK4tolxT3AtXzd3NSF!fera^yt`+3b^tCwy=dv`~S zKgi-ZpYv_hy^-^~#&~!OgcI2lG66PA0*_To{IHZs&q>G-1cFQe$n-6)lH?_AC0F&h zhGa};o;_4YAR_Tsl}qOuq~nN`&oMfCS@qaTgCl{{XlkhlK2wWuHlHyb-W45uSBB-& zyfOCSmK!;*9V-))Uh_Fog^4VXGz5OBj0iW#d6$S?zmL2->WWO@G@qS2m^)5O607`? zo?%dh8QWT26j{y6GQuT6%~WjN6V;Oru^<<$X`SwEokmWM3T;pM6*Mv@^MR=V2ghP3 zo|rYdAts%qr_pE4$=X_0Whtjlz;p%Vmb8h4f3@o2l~A=wi=NwBR&D$M zK%jU60(@3okuOvSPT~@Jt3FUw9+$D*3f!J z@a%l{QUIfd1&RdV)GY>4Gz=1S8bZ>+Wye6nTO?jWs(IDdT{KaaTbNkU>38Rj@=%eb zCHN>2{8P2GknH}TdynlK?1P`S?2p@1Qc^}lJk!>xHxyF)MnQFGHrCPIjYj+6+Q@ru z@9Ze4j{Z%0O(9t984$|K%IfE*s|sX`vyC`hM0ak?%0nPIFT_1OUhc_w2pu1voep*O zgn1UlX>t`S?)jrRO{W-mXirX%;aqy6#GpHmrJhT$4V{#gN zu=WmKlCU$;GG%ipwoMlsR>4_LNssL>FLi7G^=H&u}cSW|3$As zSl@ksUfVRaH#+mX@5Jlh{mKQ1XWVbt=-KG$U$M|Iy#6(jQa3SiGkXhNiHzvzht7EZ zOiXmcoJT!wxDZ>YsSegqca z!ctPcq*2k)UaMWW#HmwM)H$)5vE{4yYMq_ENqqK0K}HXN+u;_kkl`g|e!lsXEM8k% zTTj!#HVFL;4}Xf1&2IV@7DMg45o{s{C;?qvT@P_Xj)x=8>pk*^P?-AUUt5)vq|&r!ISB;qK!pt(g%{j!mx5PxdHjI|KWip}Gw= zm|hY>SJ&Ei3)H!Jd1V=P_V%my7|&cZpD?NO)T&rboShsG$QH8Z0~?&5sb6j;H;D@i zd$_sr?opoHISC`1%K0;zadrfbA?$}l`es%aS#fO>u=P(^&D*7N({d|#{#_rXAi+U( zDpq)M&PQ~6AjUj6Fi=7Inl$s|=CzF3CXy|YEpgGPMF(3~^t?k#RSorXp^Atd#j&Ea zId4SoN-d8Z_?}l2uJ@>an7p=je0M6hZB!nj8WtKf@5G6N^9cB`JmA2wqnG_VQe=^r zn`yUptcPK|G0ee{`8JE-q9M_lVtibE;|54!7?LFuQZ&Fu*YAO3abA0m#%_yIuC1wL z0q4#vpy)M#^cu3r1xcyqJlmgnQUyR?pSX!5F$^UJIC1EYkLkf(U-LN?#4iu-=E z<Re1vm99oIx02xep@rE~29qss!#X0UD{>Zb&R96g>y z;;JB*7y;zsyf^V2bB9)cU)S}-uOeqW*Hpt?at6y+d02_fB_HB==@m5?U0V9&$axEZ zc-sACa}nZ?X(-vbX<+lhBsxKoL9Jpx`Z_zaN_62rRSITpN^sfS6&1Uu#4t7K zB+v8kC2PIHf-#nt7l$mr%ke#@FY|(+P%(55vJDcK{xNUy0SgO;b4T<3A3u6n@3Hd| zviDU;v;4(gNS9={tG^I@>$8?+p-&n&2gUq?wawngGT+SvF4h@ZDHv>ZRhA<4zgR$p zx5ZRbnXLAnjzFDs3ai%;toB{mjx;XikU}s^9@_U$^s=0 zK0;DjdT2oYYFnt@oSK@OCGpt)K&WE}6JJ$BbsCpFG}YC47&$^F)`-aAEU}|`BDHw7POJ+W zmBzimO)2w_hiYJ8XLfu0RP|Ce6|hS0Ia*p@hbmV;;sY)&1w}JW2pRXi~bs)s{MkK~WOj}!EiQX^3 zU;a@oTYPM+JU>0%>#zQd42*ADTBTfzM^{jl2@T1YodyA}86;Zx8JR2CR^J2j%;aC? z^oRfW!C+c6!0Bbz+A9|u<{*bxuKYwm-<8#DhS8`4mmV3KkA*{HFkt44w96FshL-fu;x$KAtD+}piKQC*lcX9{fXS>*4EAK+_|Dp zNr}c0&gAxcbttiP7nzFaBJ)vBg4j2_QTZ%(``mbV6>Ay1j+WJCt>nDC8YoG#vDD<+ zKncZX%MLKz_diQ?n>L6dXxl$zw1<&m)cOVa_ySIfi>Do|XHA7HKY0gLjE$>pPBo-8 zAQ<-$z}CA&uhk9V=8(qSGVfO*DJ2QAu_#=k{uL~FC?R|GAl{Hm&$;I}bF^edmM%PKP#5bD7y04hoM{oMhkAa8@~9N8*Z zYg8jw)=3_bb5K$7#%tSZ<0rI_YolE-8peZoF1ww zC}+KppFB*Wx!Hog`l?S4`c*TFbtUGYLsGstbyV7-y#L*Y#IGqRR!`7Tq@t@1-^z`o z;Kr!fo&8Y&ZrqR7u4Is#?H_7a5mOmiM`%VZ0Z zoMw`Ip`?=y5EC~0JuW7up6ZDT`^iJb1oI6Q07vTDB1fS0E>CXUxU{%-<9VNzxRH3_ z?tIPWw6ZD~gXMjzaj|shsW6cns|W?O63jqe_xbNeNcUkg0-jAkAj}j!!9pEMYQByt zyK169{gIQA>Fn%e%yW9vLMi)CwLs!3Udo%!=q(G%C>(p?x zy(!j$XJr&1R!fvY2oG`sGvn=XW^IHWU8KR~-3Kd57|G4gcX2&qI`w>>;N^1VMBm-@ z=qVTa2b|dpKAhjc9}T@99i9~ z_g7!uTH>AN}C}el*#7Oj+i$ea5%_LsMZDDowtlZM=Io~smzCR_&H3-jw!gN-r z7JOn^$?x7rOSqyEW9s>;0Nt4BUJ&s6JHh8@w>Cz}_U2+UVbtl6Lw9Kwl^5LHakg8| zTX_BHN(A{f+6Egx!h7 zMZm=!YgrwuO!)d$-^t0z@MFzh(xheM<6vG#5tmb~*w}>5&hF7X3*h-Vf67rHM4*H_ zK3h0C6#qK2NTYhO?->bcFS^@*#BQx^kPP7#mcU(GlN;OeE{seCbBD)u+_+bhimHv8 zl2V2CK47Ia+`=BJ`fF$ciCjCLyES!JNa5bEPM}24IyP-*N#WWCH^p=`(hv|eb z-PBH-zMvrHTOH#)u=_rR44%wumtfuSa!Q%0OuLqHa0m)uz5gWUf4VG3PR8M+@kxz) zPbwAf3`F(v+kMtO;M^?95nbm5=Td)?V6z83NbpnNBhcdYELnNxIm0O&7c5_Jh0tkm*FtJoxoG(dpIAstZI_`@W|07RUOk$_P^uU9vA+UkhJxj9N=No(^HpG zE7*C;-EF-G)871b%{DF4^I;gi>%ot(2%vZ!KL>t29)$EUj2lyBo_ZhByx$Krh;)Du z>T59jOUf-b8;_@e>a$IMeHMYs%jzC@B>Dd`_PKr>Tu)s8)dher{}mbh^XQHL1tXq+ zY@e6gp05X4@CA003`$9B#Q8v#bt09c3ALlim7|Yq7^r`qs9eW*7&|H{4+A*S&~PzU z_mkcSFBM~e4Z5j)`s}Js^v}OMbN?FqBGVswRv93?cfjA!JQ{yg#f)cpq#*1KqF95%pVjua4N@(0}- zkSts~9=xY~=W1ZqEjqvJ4~)3+S$=U6zsg%u!-o~|GYcOR9pGAkrc|)T-S|d@tnonXdanJM_U8 zHR28%fiKlLa=#FGx_LYlVX_jCzjPk*^2@&gSP487@c5_Lcq_%k3(r);^ll8=wq zkNRqbrB|q>@~oikd=^}rT$}b+l4U>ccgx@Q|0BWYpFjLZeQ%x90KXf}>)$=p1Fm(L zIFc>gdtzuu;K=W&sihpG7A-dTaNxwoe;n`6MTLj~Wn0GE@mT4Dpor}vD6)iT&%XKc?*p%IlXM&j6*H{(ln27H*Lh&MauM zQ=ydYUZ97D<;O(wk5xpsvfhORYY4JUp4fUgv?Lpw=Q@fs>FZQgDh>9^LiDtBz-+@Q z5p2?8vL9cF2)m>0eRlnTO%#Dsi_Ql^j1s+j7lETF+?GLLWzuHvuFRg8TuBD_W~OMTF#*pIXjsPEG3aZP?zb)vo+r zgy{3sjuJRcR=K<`Q$0?Q>3%uQGiTGE&w{y|qHTn&r!w8fcS9*Z7jVAGjg_dWw6wRh zSM|~=h6dt48gQyhVYowOtXhNVmgflHPYS(CZ)FJ&}2rFZ2wsUUBv#1H!1K_p%ZXcB!Ux($VZ7HP-BWV#QU zY;lz1fgozt(_2s5MMW!yBCA0zO^gM^K(g4 zA1W#5HrrjyW`J7RNX}w(0sY_YFM5~@^*q+RF47`aE@xmX6?2RFU|pPDWKPLvjbtyx z=4gsNOGeAhR)DN$%}V)>Q<+yW>!nl-i}1Z_t=@H!p_CWe-W4oaciUeww(6JU+a@;a zeiGw0*)~`edPb_}{PgT24Q>=LZbo4h|Y?ITB>ia9`B`?O1M#NM+@+4Sby2RoefDaWN4}{ zzdPp=gcR(${JPA{m%YT!dzuGY$r>FB=kYQ?av?qM+P&0W9P!-Yl%cy@2{G+DX0`uf z0pak+0jHMx%U|mq(S?u5of)$so*ofw`bPN5NdxI(kA*+s1_OiyabLd6Vr3S{aCU3zK2zx8-Rn)j%bV z?q?6vNcvQJG^wmo7CVDE_7=LPG?ftNUl1lj>f>g8^*)@k@u@;R*3MssYYnITw*r)j z=Vv|kF#W6;=lZ>{>k6}eeq5o4;BT-fl6sYqkPqZu#(NHEfKomUIL$fSk*3f?$lurK z@Z7e{o^|~hoPXD_R_v#$4%~as-@y))RW)=+V#HDFWuz7^W#nL9Y($3dK$-G)7us5R z4k<}oq3dQ1zrA&@{#3C;cGuQ}J@!IQNTVlzWFSd792i^pPu+dvi*U(a8tK+uuI8VX z<H?M)P~;1%nBynJqUNb^^@ z(A%Hmqc$h|Xor5UAvUDT@f8~vdBHD2r^{~@iGTRt`-?;RG%=@Chs^D;aGic~^(=@z zv2SWjp8jRD2}x$0>yE=;?@cFklu%fwGT!RfB1RW(bJ%mVLL|l-5*8%V-BM66nkD%N z_XV|TS48qy=sYIZNW^kD{boByjbKO!AkB&)IVDe8zwnNokn#%}eM3HaIJ#_5IcMF9 z?(rmyzueW|H7lk*RQ)pZ?P%**d5&Kdz(})#dP@}ML!}%6HL92s5D6q-Ij2FyRsq!C zhdM%U>Fg!_bTgc{QWXwV+YXO*kcC{kwPh~3TB_rF(x@v48e0A6KPrMCBfE*=;EU&G zPXAtamq352-1wxzuk~7zUeK*$c`EAq(7A||t>t&;5xC8tOs&cv5|+aL+Jczmz+24= zbb*s?mX53Q)K7qEB2RFYl_a=wo_jUJNEWy^(!fVV{&A%s#cyNYUm5#}VW)3|mlmO{ z3~-vL&0=G&o)X6FbzMf~rT3EId4tR4LGQPU(sUjzWUR0kACPSi))!sLoVrJPZCMxD zL7a~_gKv8G&w_b&-7nZh#n#tz>1-&7?#w5A2#)jEP!qzEGWpI5%zuDN zu-^@$rjeG;Cw1aq-|^&IHdSHE|B4ia)&9iD(re70fu<3UbyY`M_&eTEDH9nZ^9{aI zj?6bWzOw(mz5lrOXKjm`M2!2Dm#%=Xo4yNt7ei`Fiizf=)*< zZ>b7ns}G#=!w=peLXm|;1Vf)p$Y>`DPG=k$jInxt9A9z%WG)>Ndj(BzcJxUc5mU|` z;P!Co`;oAFlaG4)nTyr(&x#&lgR?$s($WpChuxkpJX$?E;xV2l>S!p3E&GCE}N^dvB_3_3g`h3E1fA2cho3P1kEK z=h20?vKU2zi>2CZQ=Zo{pi?6QLQh54E%BwVfh7{fLg_S#0t3_T$1`|!#e#`uUJfXN zN5b*G-lxSUUU8&xIrf46dTOm~J=P}*q%G;2{by!8ywVqYZdsn5mfe7u>p*pGRTW~n zJjILyrIZYV$>ktAlkv7I&F)L2T@HJAA~3GZUH5o<Ax#1UHG2Z;x zY@u_HlLkS*jMh{Khf5P64zW-ZaMPtlS6$b=igm}%qvA{%10y0yvE+AOqfL?L8s&lz zDJOKQfG{DEait>5?woI@Higoi(OQS$}BmcDBvwJJ> zw|&mj}L z^d3H`-g2E5Iyk&WJ-pobdwulfbp{?6m=9bM&@EDtKKU*bubTcI@8SInU-|I{a^t+Q zK_=nWJbwMGfqW&M-xEEMJfkcUFxmeY^_k2T?h}zl5VKABzVKn#L!mdbFcIGEKIX;W z3VLtw2;QS2nyepRQ+^_;essv5-8!$}{wF$mZic!A{wS(fzN~%qz#{2>8CQME>mbv0 z3-fmZclI!dxB&0=?u?<;ighv63Xv@?8;Wi1!=z+9A{PlaKJsDy@)gsGZ4MtCoaO*}Z6-KFHbO5UuL%B4nihUWZ| zhiAr<*5M75}> zitaMk9wPu%KYenX@Yd2M?Ats*VEZ}acLkjpLW=Tc_biT#yEdmb^fkhfw6_uHyh|Tq zml^2~p2tL@E_v-#Kf^gSWOPSMfsLW!(KmTWwB-X=T%*RK(a@1p#VxROC$we722Zbo z|2-38FC#ztE9hS36h<=}t~iVLS9o+|h-3(SE(|$#YbHG4&1q-CwdP`G!h#5))$xt@ zUzzjO3svyrLL?3v>G>%}I~2e7*1_b1$q&-9SVns^OFKjo}%)lOI5}O@Q`;59_=VRgr8#8vNk3(G&{TR8^;G! zo)W`rH-V+GPY4SRjY}gm2VI%>F~i&Cvf~83JtMWDWt4s$1q!i)g98q{dgD62Wqt^2m(a0#Reljh zV|>rTG{yI<>GHr);FR9182-Ftq$fY+CUg^>*GsNyYkz=nhtGY{NEGqK&&P5(hdYI_ zWTgevJZmMwND5MafOceRdwJ67OojUNkjKA!jwi-gCxy z%3_vjU1E&;DD-`+u7U>`MWnZ2o!C=W45oJZiJFjgi}^2sE>KseKgrB^IA9#Y-lw#I zKAZZH+xwh7oQF-Ku%9vC6dF!`U+aU;H`?!SM)wU`*s4F*-CL)k_PbEH5&iPV2set5 zJxf-4okgRp&cWFA-NwzORh&1GBE5`5hI-ye5cg~qRgYV#31{;j#3`5Z;2Z9rtI^U? z)eLs!q7Y;r?HO54?>4B?V4Tq3m32_1$ImS^tFbZiU+n4WSpqkG)%vWpe=_!g@rXda zVhfc|-Bovf?35I%*I4J--*UNepCIW%U4sPq={wj^r`imk2OM--gAOV4?E z>>HYK4AiVxT}lZj&IXqXar8KtL5ZPA^9;NW0r4^{B3&qd-H)l z9onrPeC}Dh`yWG>1tvW2nbH)(S|#!Q2E=Fg1=!J!GC3@58XG_ag!nIZ(GIRIatyOC z%ctbXu%Gyq>WcY4Ze4QQ)E;DGv8)^v$zB!twh+@*NoBQl*pd8c<|FHm{oUDmkf?uW zWR$qa<;pWnTT&rMdkuFGsZhh-7eqAZ;ExXqOF4R4R9dud>-yLJ3!BXreYfX+AR+O% z5$J$@26;oC;t%>d^AW{`s?r!TQ)r#?B$M;y9AT1b>-#z9%fi`&6I}f$QYN<_ui=i>8tC^c!PD#$Ae>Do|LSAT(;oA*tbA{BUUE>}fO zCe!d68y_myIQ}53P*23_69W_T$Za9VL%JT;RxTn({b#w4=UaR*jzU!nT+v} zy+PE)aoN?J*oklRvhQopnfx7oOfpq(&tkhUc<4 z;nip|UcbPRjWc`O7#1>dQJ02~k08c~m1yYv=Y-N3h8}>gDS*;@IPU21kd!%GBnYKu zKfPF-w@-*18jmm5qnCu}aRQ97z)^$p3vtpbjN|5*5xp9Xi^0n*2DwenmBR@?#Zc#2 z1O-@cYQ6IdK@4OY(tq#`Y;=D(W)JJG7W^)FGo8JFqJnZB=R@_7uHS*?6H)aDzUdNO zLF(qPS05$;E$ceG54g|vaVJXiWGR5SgpDqsD9)@Esup-2@+OuayX9eHnWy*M+kdeD z_-cvHikIi^4wIhMl?y7f5*qzNl!QR3HIW@o02E4QZZqTSh93d&Q-E$|Z zyIT6KSD{(LLkgOjZ|y2gsUDdGOwP>Qs%e8g}TofOK6I}OI0J6OdH86+kJS< zlD#zwaroxQhEVSuM!XM*`fi-l1OkDa&kJJ*KP8idi5r@}^}2^S%a@n*J}u18scBK# zjD^i2t+lvJKexeYP$@KLVb&|@f-y3@-l#z07?&Lqp8y{NhiJK#hBONthLh3SyH*a| zCQRpX?qBG#It$7I)WI;1V4Owu?A8K0dU6^vOL%ARPx`txA!w~O*9KZ6>JRn0c- zT;uTVEQB0Ik@l@TOZD#>E}+hQ(aK={Kc$EpjJf&Qv6P~W9}_EWH@&bnaCRV2Sa=PO z@8a-AAY6C0B?Sh8F+RiH6U(Q@j~lr4?YxS~Z(D*>wE)|0VE`c^@FNVJW&!YMH`sZ) zbftd7tBu1QQorKqK-lEj<}nIK-tbZvT-E}G@(JbOH;bvMq%bBOe%H>~#pc^!@U{$z z(6*oRN=`=dNyIg(sz>^jcC72UNSk%O7llCj^HW&F5Y+Cy-;1iNnu2lpxl`yJZ%m^x zB7se_iZC{dv?44#t|^7v8i{*a`kp#{sm=lmaUrCAJ;!o`H;#pYgN@h@ojOaKA#4Ld z-K;(O#eqdesI@?$O3}(J%sO|J9#Fz>%p-EIGROsx-8+z*joz?dK+r|^)>0pGhV)d4 z#dypgbnWcbQnT6F;Uh0Wn~2Sr>L| zs^;f7j!4Sd+q`q@h(^8>!a@<>9;@YVE(QSO~aE^Ph6w^A6vjJ>H z2uHgvjVrEhQWuSzvay$e83_8NNT3V;p~Q;vLim&Uv@Oj*8_Ls8&$q%!Niz>X=f9aE z#f4Pc@OVo&Va6R{Dc3qpE?_(sz2QkS#|Bp}nUoTNH(db%DbCTH=6@8#{MY>=W;ic< z!k!prBgU8D7a5-2`*S>nJK)YIXXHHm1~bcg5P$gyBCQ+d@5f&0CpPxQEM`;au=(zo zJJ+M54Ag@sAnCz@(Hw1Vo1FdnarrdC7!v2RQQyvWLG-+=S8s(|qN7=E-B$5j{i7GT zN}xz`58_=B(H+x2543AvRRlz2Kkb(=Iz7kc%Y^IG=B6;M>@6PeZ?Bp)QW?*+qgItkZJ*VJ`O`1jQrVz~U(YShy{| zECQlLs5w(L3=y|i8qv{cfS>w2MCGk41GI5zbAXh*t6!ztc;A_`h4vqSi)mNVk!4)E z=jYIuf~>K)+;``&tzvaXkkbK}hQFJI8!RAXeQ~-^GD+)= zDh6WPyX$Rul*uZQWoRU}Rj?Ly*13X*5S|CJy3a+eIJ1Q{VzVr z1Cw0l8!_pawFhRsR#`nHqFvK)xqrNqu*1XcK^z;OF+2d>RT+v)Vm%Xk_ZHy_+sS~L zaYmAI<(7`fDazyVovTYBp2wlyv3rlDu2uwCPX6_4BGvoR*#W2F{G(G3#~OScqU3Sh z3|*WjA>GyM6D8ZNM7&E-I0Fm&uz|X!e!)_5#TWf=tb1@~RW*`bBxj>LV`0kYKaKzT z0`t}$?cbjJ2HmUId_-Z`jEb~eaqcW5u8~m+6D>>}hUSGlT;g9`d=_dnjL$&Flq)o` zTkY6|F{G@>3^F;6r0py!wm{iugv`k`p^2c-8xGVaUpimQhm3yV!pfQGd?$~0iFy&c zp(z-TQa~7k%qxYJ)4+xZVd>&2O3wH8SxMY~g8vinCd63A<`tiydS z&DlfmgeYKS`l!lN63>`wvA1c^`t;=b_3$lW$guniuxLXL08cqlNjHynI@3A2`jz&3 z0yGLbSw};|$Z2HVGnDYg1V8YuuG;+8u~_j0J7hUI)gtTkx4=|XqkzPSf~Z!g0-4^^#&L{KwCJ7g~jFwpc`tA+Ai3gYu@26sGk z!?*%!+}I*cy1Z^1EMRx>GsBJX;O+(c-La!w={pE`YM~2UvR2jLdVMBONVwzCRI8@0 z&H`wKyUFQhGv#R4zdj$b0ST^rV@;Lg?cG_Jz=8zk6k>7@m7)|7=3b$1Bq=#JqH}XG z)AM{f9TG(u5U8Qa7Vr2X8JgB?*!h=CoK&{ z#W~Y8A1YcB!Bm7fwwdm2KQ(;%i_eSE5o)N#o@_G-#wrscZ+b0KLl0@0Yk}2?B-QBu@WN}0TorV3 zl08@`R5lrME;ZRHoZK_eH1qU{o#bReN=aFth_OgldJ4J3wr;E)iUU!l4*VD810(Lt zT2FhAW6mg|ds9kq^m40rqnW3j!ZSadoHFBkn0%`bQzvAwYqWiJmGw}z<%bhe-i-Bm zakU{HZa_AG5_R?7HP7R^$1guG)EuFAO;49P+w`4VynI0Jmy*u~ISR?Wjwd|arnLD4 zH3)lrnux-pE-y5{{2r%GY%))yD|Op2nhWDkqbYuLwp|L3zzP+!-iG|ri_;{v(e4K* zQv+*nB2@JN1}N~Ef1Tt`R&@3rPP_y-)+DnMYvU$N)GpM#MccD=)rN~$$vW21Y?KYg z6;6krBpz{rb8;r!(`X<8E#4nb#RA6-uVwNeQVf(#3{{*N-?60 zwRiNo0Urn?wQNleL*F}w9!P&@8yp~^(+MuxZfvg&G}@B&>Gl@p%yFt6F9btD=WFMC zU2z1v;gls(+={tM(;k|p7QIh*yP@QL9!|dmR+i6DW!yyD;2S3|lN@K{v*@POIT|bH zo1jO+l;e1?vz+0rUSV*zo-`WzcfMhm#(E^3O0b)WkSd9<7S_CRTzT^^ zo;*(|rf5XN78O&~-2Ah>D-W!sosI)(cOZx`wzG4hqhp@XVuu%2zZ>thYV`N_Kv?UM z$B(eFl__0wIhL0G4x+WPvLp)s^4`NjhheFz@51tF@H$nRMo3_@dK@Zl509b^wQF2kFOgUASzS_OGiGu85lvLxi7@i$QUHBFM2R_os?@k&F+kR=C zzRX!$YsbSD9vFekeRc7GAZ6H~;%i`5KE%O1E_$NcQ{Z)SUw=bmk<@#pH;$(RHN0kG zI!sXd^yMXc3W!T7sseB%wE4UMQfD|t{a@_;x1n&mKDNWf-GB%t;sBLB+q(ywsX z>Ere9+2O7{!%=i}@}#h^lH%fpT>Ji-hVxYc4$Wrg$K zINklBL*%@|62097azg<<$$Rt2L4sQFq z)HIx~^31FiLzlxeX#GQj{}`PJNQHSi{c3!-+zc& zXse#=TnbYIA-<%p?`R28)vU60fvkz8ucXkd*G}qjaXU*}Jf@n#ZYB2&qHTcI7#ThehX`2Hx4Ur>SY-Jj`=fbwM(vsl9&Goz!`{; zMzX%dP1s+X>h2y6vz}8`Q!zC!a@0yIz0mXP_`G`D{+(^^JsF&m6u{@>N2OCZ5E6=o zWo=G3u$TxY5BnDjK;#!X_-V{}Wb3PPEbUb4JbC1<--RE8Q5-zji6JiwiJv%-40ZhF<{oA7R| z;Ugmxm>cceVvRW|v%p0CD+~lnXa{ueT#rIdKIW!OgTjl)IWB6KRD!DpFBvd6@9^J2 znpT1OxchYUN?tu8j>uTZ5=Xog?=o32S21%~3yb@!GI1|CR@l=|nFJe$SlD&)jr!A;J#WjQb4#a2w1Mb3Eph7U zP0R>!%{0m1@?1~<69Mza7;2Owt4kmTFa}O;j8C6DRwR;TvdXQI??q=)>lQyRJ~pMx z$`m5E=RN^NT_|L=N=cAD+q&+dvL-PhfX@AowCf289M<2+J|ZBBc_3?Ax$&eT2PSTT zj$!s`BNK@qD(>J2TJB)>u2%Jj4}`5#O25WDuMj8wU%HrOYS?4jYd}pNQMGLs_GGlS z`L2XJ(<-KOQm=isId;(2(TQmH;5oD1(~a`0oKLZ(O1iG4zfWXbw=|{Hmsg=2&TonA zg#OnDDKrUeBGr_zvyHk}Uv!wBt*C|6Xct(aV>B>qyb0@-=Q()@bb}K;?{Y-CHi-}WcrzB{M?`z__Fg&XK<;}q3icBF~(bG z-NpREBm=G4(16pBY8TWXGA3|HQvTVw?JX7Gp8RO^tr23f;94FOW6!j&I$H!#Vz82^ z3xRzb{m%`hWj0iaHZQD+QdVZkBMy^|vSm+$tBIQ=GCtpfxu|yeJNIYT?B?^=8%v?9 z74|cqR1ceDi>4At%o-_3UrURxtcwH!%)#~5jpqZLL6Kv5IJ5JuTCkF$=h6TY# z=|+Ys$qS;={zTB2t+)UF&TE^K)Bx9%#p)~i{Pnuvsq!v98h7lA=MnO5_;2;i1?AzZz>wy`$X57SKjfA;hrvTqF+R=0I# zN{Qlp-z-bK;{ZU||LjwjNRrz9=T4tRF0+SMY&I^{R_1wZ-d>{ryN?3171{AzdpEXQ z-;>C;YD*LtUcz+#o#yUy3LASu3K2Z#)Ja6?+P|HmQBdItZo9Cq-LvEVHt*gMzhEAU z?`_oo$`dW3@P^Qy|LX03hl)mFajyTTg_a!8mY(>(Kl?UOJ4oald2RdRzwvCtw8Kh4 zng8ez+F1X;!u-Dpkq7?g{B_?4szx*w6y{1dQFoPz0d#3-TUJ0^JkC4!=J$y zI9*-`r|K}^KQr?0EUI}F{>A5c&99A@yiFfu^J`H5W23buYz|=Z;IFVe(D}(Fc?&pEz5WfWqX6raZ$;&l6NXY=ah%4eWcuFX~ztS3<5= z*8AEo;&F?diJ^&wq$EJlTr6KWLk+;kCoQ#J-PvW}%H)yy&mz{VpVgUbJzLooB-nj5 zTvhR5^>fLtsEt!EBL?qMg8pm zlXT%7*poi$Z1em%TD=KT*FCUt#OmtiR;e+R!gWf@1e@pvad8ip zTT;eNo72@YxW;e@F0Kce*M`aFQ_Sjwz~Y!dGEsA6YjB13C?h~ama+JtE$q_ zX51V$Q6^$<9}t=Z`1{XK>Ef1G{<7;mnm;ady|MFr( zRrW7&@FiAmUZllrdDhwJ!#2wKMn}@zsh7LeSMGcSp{kmN971PDHk7QHLLR-tI@;RQ zRA@GM|JWIRG9Mq05Ti<#*4vOf&*d(#$5}yCN-NyApSs(>n-5vnR8St&|6MMfpYB6} z{2)3;+fJy(jKIFmWsp)oK3o4>3*RNprbA_qpwL+j4$u|qb?LWaSFIL5IdIBu|2;$^ zduepbW*V`hjE7g3#^+2f=w98dEyv>2%vN>d>vPQY#3hA;ttb zLHT1qNW3VWQOyiS%G3(}?G%~wrBS=)^cx$f19V%AA$*VmocNv>?g-y0Qnj$Ow2Wue zT+Ek;H7}B$vD^gU>{F|=tC!u$J32a^S}eHw%O?xcyyN(6DPI_R$_`c@JzN2CNXSyK zg~RLzg~(R4`#z8nwK&-->?Mn(F!P@Yc+@i@88EE;{@RY!EIN96IVoO?);2F>$JSuN zxN|&$|M1Y(oPK|1zByDQ`R&1w}2SM=Z5m z1Nh$=kGgi~Fy8I#13AeuMSIB>oNr-Q$3k3|8aJI-$SbG8%M#$OQ;7{u2$_K3_NU4- zKdU6wM-&tUp;KkRpeUjw#`unJV-T4(2=YsIrG?%tA{7pT&^NqRKeIwx%_c1L5GC|R`e z3dmj9@k{)1uQy#DVvjz@%!Bp&3uJ(7@2-T=t+l1nW2(J+w-JOxE#%yt?FFvvJ%JYv zRr#B9sKs)2&ro4W~74bRj2jp4}au3ZZ(~6kM-jYuve9lCn{`%L4RY3pL1Y zd3mu77ZZEbWUG3;b7_5N>}8Hwhtk3XJZGx!o(Ch>KMF=XT1-{nnH*I^6cK(8n?>^k zpPD#ZFT3&Qhj=;n*AQpHIEj9BUQ&Lv7&+^k=Zed)J-8|18%^|0-_~su`GjL-Wz`$* zx;@C!Rw~bx?nWPNees@}dg3zI-ygZuY}DbazFRJmJziZ~u~73)@=Ig492U;Sd{RyY1o4GIj-q(!F%X1 zlt4_KmHzsx>&m#U_Ii!=j;R|4^@>-y15k}!B9RK4L;wWeRe;~xL0)OvSc3P$9H@Jb zf2InU*tv{aTe~+#-Y&8*%s~67eNLyDF{QL#RWWr{e+oC5oWRSsa274&&0@7GSh;d# z|Mdl7UVQ8?kWzOSult2Jr$hb+y9V}qKVrcT2W4#|zqM+51_w`1N0H#E-kb9o0&uWN zsKsfE2q{>VJTnHFyfj0pNGAp$sBCe`E>$1 zLAc|s8Vx*L9NS&j9cR~C%~rDpU%uZYwAS#nBz-8UO&05qppFz)%+l3%HHK!8J06`8 zgQ*^Nr$$e<0Jx^_e2Pl6Jk3nLFK6X>m|kHm6ilaS6IU@W)da)oe!5sd2bVD!3~HxT zJLlVs5!CzfJ$dxW#hf*ygtP}t1qhL>VIe{!B2VY#@vdu?1Rn15BAVb8;H+D7=Ec${ z`=FpJ2;Q_Ds$$&--;5CK=P%%8hv_g*M7(hF6@&AcEwtaE?LQWL(=^v)o%wYjZV0xG zY$P2Df~+*JRUf%yAv_qh4RzltnUjtWoo;Tr_SNFHSuX0P>i37uw8TZq20w&joboJA z*IL2IKk9nC)!&&mfC(%2G`I4zrPBMrCQP^fHIVHHnXaT;aZEJRetbj6DgfQoT%etn}quIccr; zM`|8x!P*P@!P{b^u`M^U@Fg0a^t#K44bt=JO8<@!kqYE8!&<-y$ZD-=P?SL^NI-ew zK-xJci%D46qnZ~%=|xti_mV;|2)AJf9Rs>MzQHn@v5+rccDlo&)vT)D-Y4v-9W65T zUQHmsrRkO~x*WLFb9()U!Tn@tH}`gS3n0s+-}&M(p4~#*`BF_1_3E5ImagW=jCdJe zmMOF#oJ{isk%t$bpOhDQRAi|iB=zt%ePc%!t8b;1lb1(=3HvF|>%kg_fp--A_PW%_ z*&h5suynny!{mh4&Libdo&wd}o;yV>%0{WH1!h$S1orBsvkM*YqN8i47cWF~UG(Ad z$b~M03IfJNAaGR3gSRmAv)kdKtI|S7agCJ%eM54PyI-@8GJZTQx05iKu=nQ)Kp%Wvam(8!T3(kYzN(-%A1`c@#qO=adnQVzm@C1Sit7hJl+)(wxZe34Fb4|sn*Hzu!QK^#xDZqV^TWsKou@@ zaf?9E?e>g^tsf%=Y{6v+`@~(~edn*E%lI=DadMC=-8X@^H)7eP)%!xCn?qBGJv_g7 z<%Zew&YPPihH6i?i;L})@GRv{BSJ_7 zfx5=Lo`zkXoo&yAg#KFZm+$fLQSF`YxjF=|68**ZjI^YzNz}OKO?2xT%IYN(R>I zs`YVm2d+G!Zs14HQcul~X+s<1EOk{E%fUIHwj#gnhx zdDOLUQBgHVY$b2UWPX=KISpJbrq+wgcT@>*j9?zwTWB*brI z+jXPUAWT|LaI_x`F00O-V#L6E9M_A-T{iLFIvefp7+ZA$={4-ltlM<@Vcg+RRNYsr1P@Y>fglM|JXcjb@$~(48 zl2Lmj$y*_GXc^wv{cPxxlz&z_?QCni9_yL%P6!m_`+#t2WaJC768n^Dr`BpI!+h`O zt4l;_W@eqAh59Hj+FgZfC3MOfjX3Zs+~HC^#ZD}Cpt9$ zFt3%i@Y(S^kEiFCaGur7;_2GPBK$g6^`rR&DvTTG=uiP@Pp!matxh*OG7A?bGz3&P zcEex05r2Y(UwHOnBZw-cgtO*`R;bF=!^*Qa>UmjBm4EaW16R`B$*j?pE-BEtg&+_{_|X+!-}gp{3v~MOoagP5r#0Q`YDn`B2MeB>%)`g8lT7S3{knDE zg{!h4#>!{Igfi4;CL{R*>4?LgP}EJ8a@K9HMw(tboC0%zcb5PQL%OVlx-r3TN(al5 zIH7stnu(BbwX_VHV!kh`Y?8se198@tdGmEHDyV<8p0m%>S4L0Nz($a)PDj@qlGbi} zb2$!;NhNW)wA=C-RSwxebMtu7=%{1|&ivd*Ayj9lFN2#2td<)JI+WtH``(iGLTybL z391xBKbOr6ZrOzeRDKr`jcSH2x$^n9qIaOO%Kg6NvrzExY_!2j?@Ig=ePDatGXvCh zBWY?;8QBU`Psq0Q2qZ5`Hj0^}`X;x%vr*>ITGCC4K=aJ)ARtIZ(%K2`|04%`|J9cg z{&wTaRDzU_QsXb{3fG1bT#1e^mYW!NEq} z6aH9EL9{?2-iA$CmRpxeowSI$$$CSpK_*Mh%synQ4mab=ApS{1D#6`A(nx@sEYkHi zAFI|UkBAYjr;A=sx#xYx`@Y#-$;6Y#^sn2vS~BabxSoY23O+F1O&K|hVIw*d_lOfN zHfCicmc&A7&6raj-io%>NQwOHFvsT)2Aai1<5G3g=5|{E%5}QAtSxD-TrTU&XMp(( zaWM=g4c>eJyi|6uZHW1U!fA$9qtp9}AhiXXmBYnh++`MiT0ZB=zBQZ#%emXMyAkhf z09PBT9JOY7#XJx9$cMh9Ka;mJYQyR5@4OJU#JRcEMb+e?@sy_gR~Z|iOM+dmeSq08 zrD{pCd6%tf>RdesFWoz~$rTm{?V(t+xf=@!xh*n{)&g(q77UCl@!@;-@j6U;=Fd`E z#@Gw_B@3n4+k^Sta}(Y@RfpXp14t9)B%WeLO_dQ_;zo~{#|_juU!JybYI@s3tK=Pn zfKMxQ!zB#R>NJvAklxF+wX9ji^TVr&$79B};$WsVNl)L--NV6CbaS=c+gljiE0dgl zF?gcN$F^{ku*n%(26C5Z5U(jsf)|d+d{q?<5Wm92y7GH?{WuttN3{m=Gr5FQ_Abo4 z(U;3P=ub|eRl8q1wGEyOf?dOjk(4k!Ev7gjVs=4&^?>>4aPai0VWWWX$}Zo7vgbZk z7>L+V6ZO)PAZD2|gE>om)KZ~Ybsl3!?Cs=@e2t7vY%OlBp0Ij-SQ7Mu<>GRi zK`Ej;-*}sTQmeFX1uD=|wMo7ZN%-MImL8%m*WLCrSF4uV8yK}!*ujA%0I(2+!xmod zljYa>WuG#fBH$h3Yc#J7JXZLNm8xfJ^8OOb*U8PxezMlOw)#Wvg`}de zTG972T8=6ZCt3vf7k#$sW-3p)6*vHou$xgR=Lnbld+A55IsXk%Td+=zgZ|Johur89 zn);W*E%Q#oxhbo7hKu3_!ji%i%oS%F???wrhe+GaK1w~WQ|Rfad=f7dn8Jy;M7e6y z`J~QcMY0J>Yo`!azi6=VYrVcQzR&K!ibxB=FL`ZfsS94{yLzTV6%7)xkm{FN>UDs& zefJq}z)owoo_@)@(?7t4R_)6}0M<`$6yh`8At6uv)idjqj-HPh!)NpZSnz<}bSODv2NKaOEAuzmC(Dztr0 z)nsQB!rr?DIhPYzcEa@h6k4OG}BivtGXCF{o<<`pE7er!${$IUh5yj3O8y zL&Kz8!K#xDwt;L7Ya8Nl#b`uZP85p!v;Fhw$)-JbXZnj6li{arQ=FSlq=H^>Wlsb7 zw!Wm(?B?&1$A!;IK1sw`J0zH1>n?Xrzu$O%0kU4kcBACZ6R!iBdPfSDpdPxy=P{hN zKf8pc&i|kpOOe}nt?H1X6atYCe>gj(Q}edmVF*3=lQz zH|siwakn&`8r>7EPwI+2D4;0*TH!g9ciqH5?(IqFcc|rJr?` zattfav>tbv_Pc*UsqE2HdU{5(*MjX$p(vvC!F=4gCRl%{tBLH$F*iLWZ1f0FeBaJ z*ZIDnJn7P5)AFQf_LOO0>L(MoGg@VH79!$0r~Q$$k!WDzZymy$3`f)}x^3G?!4**x zVy`<*=eJ`h;6b9TLg9Ukl?L*0MY3AF8?|Z+x49kCa6h~hP?{!aF>$b!O=wG}Y8%Xm zysd2nuGDl(N>J;v8*qj0hEPk+HaY?9poH6~Diiw=}ixOxapgAr|1v&fH=U1@Nn_3Am03azqdGlm z``zB}76$bqlhMTH)g`(M2b}x}g~N}M7|;sCv3-`*w#i-dF#_;*zD{Hqv7l=@5c8>>wJxeP$7?wn_L2F*o zE$l?$YdCp-aB73~PL3M$D+_$pkqT<_?@-DQs(06E`>i}`W1C4<6`tnyucGaGM-L@) zq0%Lk2~)UJd2?-cO!fO^WX!J?M*hYcH2OKxK8yx;RoI^#u?4{!uoJV3nOXRdY5ax} ziYpFr#^tWR+6zYz#uZj+Qqf#h_^3j;kF~7gbd^Wm><*&HHe(IvyRSa9L`feG$HK!#r&rDmj zHz-tg&#^7%)5iri-Y?kzqSgbc6 zxE2T!TnZEq1b5d0DJ~m6nVs3${jvLR&*aCQxtaIQd+sauobx=-8`7tiK{AkHFYa_G z*nV{BuGLTihvNuIIIowHee3*^g(XDkTJ!q9TtFmY?x}RU86U=6cK>>GH#G(j&Amz8 zH!x$r@(*!^-DrsuWvnL+`5NU(!uT%tH)CA`?}?xF3|D=e^q8o!O0TUI<-R14H7tUK zWsf`ng)9ljW1Yts$&|Pznn2f<8Xx{ck)Y@VCS4ufNwVbNT>wS%tbS};%n6Z@8jUiG zjP|g_gg~Fm4%e@~-ijoZo9gH^KO)%ki8t7pepAAFJh8jVq9m7QtT|rznfc4NYQJ;w zqr|fyj(7tfMHy;t@r%pwce)YWXn>WHevDjGFk>< z)Ra?ZHBV76qmkhbm-a!v6Z@TG{B+U}ou7n!F(R9upePDGL$T4FDj%&yBVNGrDYzx!O+{ePneiE*O7dGj2s9e;)u17`<}I zF(N%bNuG_#7KzEeK=xZ$Z9{rFu8Wu2P4Q629?;(YCJCZJgMGK2=Rj&EEe7g-lG(CH zD}?Acof0*yyhiy%)L%F&{_d;fGM8kI^_BYvjhA)#gdM11Gjj4!J8U<5ijmZ}a)Jys z-y4Tgz2UW zif6!~jWG%a2S`emh-b-{=_hzpvpvZK(6IPtgh}bK=6#O7Ls7TBx2FO9jXB@%m$>wS z-v%2hKD=PI_K3ldCg|X~H8x(T1?K+cqwMR72SLO}0`ukUqxMTeUywkSA5DxB*HrJ55&hBX?c78)za%Yy765qs zac_@#^P8)p+{SI=CQ31=JwSdE?hK9Gp}|H*q1ZD2iziU333i+__Uyoo(XiB-C=hOr znT!3knn}MY_h4x(KaP=2^~p#Mz{W$qf~pcRYDz*Qa8-Oap_{2EAXf=9Vq&SF@pzuz z>-u~1CpdlAPnaYoy3xVgh*B*7vGo<2!<)^ zUJVbwqI$z4wviYM5ZI2;O4&Tg0frA#_I%>re(cUQGpYHka zx$S+vx|v-MXx>oD1|>n5vJUI^)A$B=V`j0Qgxek0d?Ax|NuBQ3-y>Yazy`lrD^c6y6G|PfrmQ)k-U-bV9& zqBrlJ;^JbL;p|D<0%(Li;{IBlWw3xuRo*ax^DC@-hDwQWb;|)NSMDyfS=O-^C;e73 z7a!H~!Q1Cr4GZ&BBzTZi5GMKvZLPN z;yvg`kxNCn`a(6qTgcrOY+_#J?$VHchx<28ZTJ~oda{fa4_|@wcTE)tBc7rDRWXWr zqGqHyHA*W-54QP;J`lZLE)b1%oc>afF;x*IGB>{R1PD?$N&qUpWJxB^2jLX%%M`0f zl)o133tVeHdjXGAvngs)F?(LuSir6NHVU|*SSOrcSr`d0$Y!9&Gc)c8ED%*SW-o`n zr3c9PH~A%=C~s^$>qL8$OQ@->!^raLFA}cL?_LGCvTV3&TYxu8Q|-b~AP;oHMySsB z!AT|5%Z6?n7|=FUd>5}D4e4Tb-!tx-EZ*_67qN2KICxf`zg%*Om*6zG>Ee+-mt--H z@8drw-?N*&+MId^Du>(f6&@0>xlvwpjQEjEj%cX+cuXXY9B#AZGpXMF(ddcH1IfS8 za64q^{UF zF^ORU3oFgx8s8gt;eMvyd&j?=MP?2|IW$YQ1K9ZEGz8f_su?hxbMu@D8X)~~FZIz~Xas7?B&Ocqc>8${=mNIvY176CVe(4dq_f&r?< z?@5su3GCuTC$2C61k4yBrIyQM&aF?$4(u@#d7c%0;#88N6GQ{j(n96>;L&(bQOJ*0 zKhy+aKur)%a#b`;87K10PPfA`&gD@?<(SHB*FC=E{!hqgoMF){fOgvI(^EPSQu<2V zD42c9IfS2GO!a=OcxQ+_uKX!w=++cC<3mWF7*#(NT7*sVK*xG?9*9y=ZueNCVltdH zJ(C7xLOZyqPs!(U*_V>m7i4fTa7Ck;as4N^WZ0?S|D!^rlk74N0r+0Te}y7Hi*$i+ z8+->Vpzmi%3|cY)TEGsBS&GXMt8=Rs*KuP<Jfl< zsG0j<4xfbt%S?H#f4q__QRX9h>VNcGeuO!uwvyq-6xAU48Q}3%FVrKrc2z(?Nx&K@ zZ@cajs$w1BrzuGY!vhKN!DgSxXq9!Dia0w^g?&`(%NvX`b~^|P zdUMtMHrKRx^Am1ToXeru=f$D(d|NL1#R!d&%I2`Jj{*UA(7lB@dVZ&&`9G$MO8=5C0ejdt#b!y^1+$-$2Td>KaDK96n$8X>{FTYO8nt-1E2^k? zyH3TAX3l`rvf5zTWB>VaB4D55K9lpWkMB7=J2vK(j6zhOH=UiCGY{Arw7SQ{Sq0~m zXYU-YjGv~dSB$gB6#{GU(?zZB%C_V~p~aQT1=EyL8{*7t{X_CQhvQ)xm zz8rSFReM%3oal$?MNs7+r^Qt3XZ@(315P?K3{#~y+OK1tGtQQ^*+ZoK9Mon`Yq>K6 z8>p2Kg^g1*rjSogCbKAg7TcO~LbT?;VPYF<)-l%3a=Vkp`d}KO z{P_X+_RznOU=Z7OWLIvAU0wQkentT=7`d(llixU<2Z|F4G~@V(Ep1>`i~>9AEvgQn ze@O^mIFntJ9CfpauZbfjwURRpEm#%V*;;utAR#%CDsT zx2aLU3+Er`pl_TrXE^n!TGl5wAJh)lwNZ_t9g|PyjcFj`#?{F~I!xi(WbVuu>{t)Q zER>B_a1wkH$wkKo8Ot${V7%3>tR2&;B@0#j#TEVyAc50e#ItJ`>x%%B;4HmXM2`D_Ibg!bk1Q^ViT9t%{$Xh8HMh0*EHmv zbfCXo_&Yf5BvOvRr*!GA%VIZifhNrNc%Y(?a{eN)%mn#GZv0##o} znC;q?F(*$QR0umSW=NxfZDB0P6F*V=a5}~doT#p3SIU>(tk63 zF?*w>J|8Wx_Vbqh87a|5n#VTuH61gY=TQDoER5;E8Tsfi{9i%Z-=;1LZ}KzM9E934 zE)VC-!j@Xau8Z@MKmzoNV6x^0x<*;tQ`ohi&u(v}Q=6d23Z`BC;T-G@zwgSm#JV$z zuA!+2`HGd~t8T^LL#@)!*7PH2;tJ~8Run~mbYm;)@t`>#KcyW24Q|3NjrUtk@EN)f zBuIfej>mpQG@s09xVJL8&2!`@@qaCQW;Go*bPr8DR>6i2n-NOfnK`ZYOxRfAA1y&m zy}Ql}S(W0|A|?EtuV<&@j>Fh#yQB?mbBNsIqVMeQtGzY1;zO4FMd?T34Qug3Q>}ml z#_$EM+oy58;k=Dax%Y`Vct;Ry#KFqSkJ=@+=k)?&&r|C+rWg4}pba;H==q&SuK12i zE;Vqk{m4gtA91&=#ADSi4q@9~4K$+myXYq>z;GEYX!Z(6`I61GKDS88;~W9U$=I6fx>l%xBQx|W8b}Cw^xOh z!&+`ueg4T`7%GYb#*#y`GAu)%KhwkgmwYJt-Vm5gOUDO>Gcd;jZzc;DAhiRGO6i`) z`31>|JpFW4z!ABIcwF!v<%{Klenps`?V(m~V!b`{vUnL-$C8-v+ZpN#w{7NKMaIPL2E-ytJA5)h5B? z)gwMsbuJ)_-)6@c{o3?*Dkpw^p1S)L=L+c05iTUYuk~_1wXLm*e$c4{!cutUR-C^M zWo0&u{~Ms+2@&ZEx z>wBF08t+4&Nev&vOB0j&21R>ge>XH;9*nwm@_bpdGYPWYMp_)7U^p!XZSE!zN4z== z^gH93SiDaORU@4?9mZuxu&iDZv>+F%DO%%nuT&$AxqEUxeE)siLIhD71O(iiqXk4f zNw|3p*pU#hbX1s8G~Kt9#>G{G*uqEpkd;1?SscmFepC%4r}Ymd(|^GkPz( z0jC~egJo~3RZd#{#Tr#HxGp5fKsW=pLG(Q1O+>no=1>;ZglS3jk&_S8a`qZDuJ|^qhONl4rXi>?K5)iZe)VYl4(C&hQbdZDKO)!?Nj=14yl+S144uh z#Yce7KiCvRlH7Roo9f+6_BV_p^C5OqhtX=yw5rO})Yo0w9aT|g9uq#lePLA$Gw^rI z$O;Sd7GB-8b0cODf<}}tmdasF>9d_XiE>5f=?#)DPH1fFX zmObEC>H}rnP*LCtNV+WhQZwyhviIOv-$F^d%Z>dvE)Ah%qJYCRX%796SR2dPT=%$$ z&V&LUyPw}iI8`%$ncn3ADpKlhi@JzWMxZJAGOcMi`lRu)xZGDPKw{GUCDKbV1-hwQ z=(L$q=39p{sj}OJ_&~0gQ{r;WA7m=kl?;bqsqYZq{1QbZa(#Y5OYULR1}4x+^7g zb-|(%ob5)dWQ>d=LEBKZpTC?XMruBH04!`!=L*rBV&%!c%rNx(`Qj2*NGwhR$qx%XNr$E9HKr<|Bge`sZ~Tju=QLH1f=lyw zwJc5w$*{fnvJ;a&h^)vRP*T2(?(WIqFuLFItK5V&o#BkVh%0nP+RU?rapR&l)x~X&;L%bLw`NlE*;+>i{p1LL8l3rWkLGJ^ zW)X!WTD4Yv;$>$6w!Gyn>egicD*UyF$Pv-^rr-wHWLjPiOagC~u6JZ-XJ96B_@_vm z%&YO`acI(zVP2QJ#S9gB5KW=kx#_QBjJrTfJ|bM=J-(8A9A*J^_715U-z#NpIPO%4;t zhf{56gtq~A8>Spzv|Q1Na)ej8{&B~bEvvR;yGD~~&bIH@5i)zX)s4~O@uZPl5 z=#?&Q$X5cfr{8mi3{OWi+pK{hgbR!#|brJV-tIwX1{Kq z-t9JKGuai&<6%+r-o{Z`5K2TJX4Kfo_$S3VK&rOY1lX{&dXJO~Z{CEz!=s@lBbchI z&(jOsL6}syc9F;>;GTNmlSz1)C2Ioa#V1~WBc94Xi9Zt8-xWGL*si8+HR`gIZKK+t zi<3y5ch7lJ;r4TRrLGjQc!kNEUK+xz7C)H#_$@p65vbrpy$1!8+TyJYH(AT}+IBHA z##Qx{wdGaq>yqM_ZUxOiMXf89454W`-;=p6xok~fc`6~uato5bWb9Qk?9A5?1@E%7)(=RqR* z!9=}FltmVUw7ESGW9c(2iv}W-B-1>s4@BAudBp?@n9QDGyT2BVz*3$9K4sEir`JVTMcVcdEk(dWRcwXXDoYpljxTbWzym$H*C`fHEy94FIW5{1H{-`zJ8;E7 zFhhor&PLQw1t3L9!;QDgccajlj}NLX)UOZL6iZH=#S(;yN|@Zg0Bf%KcfmDfQd*c` zW~tJOnhDB3=hVBT&u*M6&6$cQ+A8#DBlUT`y3XCA-fmsA$^bJlG|C;c(~kEJPt6xU z1bk$s1-~<26qLM?hl!nro!jM9AsnVsNtao9mVf9YQQ5sscJqnT{2S$8jDK`^r`tx5r zji2SV-Y3DjM|3~@5IJE5dpsyp{%zFcTUAjUPm1Ch3co*>hOp^z%71O(V#nUW`0*cs z_K|m_sI;-K+2P9xF;%JE3L?9DNb$4aKb*4v<^)lMQ$xA`dHsJPpSJX#ggknLW}ql5 zrG+Z)|84)5GSL5J!%BlDFI76&LDA!^ Date: Thu, 29 Oct 2026 18:12:04 +0000 Subject: [PATCH 4/4] Refactor Configuration Access and SSO Reconciliation LiveReview Pre-Commit Check: ran (iter:1, coverage:0%) --- internal/api/auth/sso_handlers.go | 14 ++- internal/api/scim_handlers.go | 107 +++++++++++------- internal/api/sso_config.go | 32 ++++-- internal/api/users/user_service.go | 22 ++-- internal/jobqueue/jobqueue.go | 6 +- .../jobqueue/sso_reconciliation_worker.go | 43 +++++-- internal/mcpagent/agent.go | 63 +++++------ internal/mcpagent/analytics.go | 37 +++--- 8 files changed, 194 insertions(+), 130 deletions(-) diff --git a/internal/api/auth/sso_handlers.go b/internal/api/auth/sso_handlers.go index ca6598414..50833705d 100644 --- a/internal/api/auth/sso_handlers.go +++ b/internal/api/auth/sso_handlers.go @@ -216,11 +216,15 @@ func (h *AuthHandlers) SSOOIDCBackChannelLogout(c echo.Context) error { h.recordAuthEvent(c, auditlog.Event{ OrgID: orgID, ActorUserID: &userID, - ActorKind: auditlog.ActorKindMember, - Action: auditlog.ActionSessionRevoke, - Outcome: auditlog.OutcomeSuccess, - Severity: auditlog.SeverityWarning, - Details: auditlog.Details("method", "sso_oidc_backchannel_logout"), + // The IdP pushed this logout event, not the user themselves (there + // is no session on this endpoint) - ActorKindWebhook maps to + // ActorCapacitySystem (see auditlog.EnrichFromEcho), matching how + // SCIM-driven deactivations are attributed. + ActorKind: auditlog.ActorKindWebhook, + Action: auditlog.ActionSessionRevoke, + Outcome: auditlog.OutcomeSuccess, + Severity: auditlog.SeverityWarning, + Details: auditlog.Details("method", "sso_oidc_backchannel_logout"), }) return c.NoContent(http.StatusOK) } diff --git a/internal/api/scim_handlers.go b/internal/api/scim_handlers.go index eb9159c12..9dd05ccf5 100644 --- a/internal/api/scim_handlers.go +++ b/internal/api/scim_handlers.go @@ -4,17 +4,18 @@ import ( "database/sql" "errors" "net/http" + "regexp" "strconv" "strings" "time" "github.com/labstack/echo/v4" "github.com/livereview/internal/api/auth" - apimiddleware "github.com/livereview/internal/api/middleware" "github.com/livereview/internal/api/users" "github.com/livereview/internal/auditlog" "github.com/livereview/internal/license" "github.com/livereview/internal/scim" + "github.com/rs/zerolog/log" ) // orgHasSCIMFeature mirrors orgHasSSOFeature (internal/api/sso_config.go) - @@ -97,27 +98,46 @@ func primaryEmail(r scim.UserResource) string { return "" } -// parseEmailFilter extracts the target email from the simple SCIM filter -// expressions IdPs actually send when checking "does this user already -// exist" before creating - userName eq "x@y.com" or emails.value eq -// "x@y.com". Full SCIM filter grammar (and/or/not, other attributes) is not -// needed for this use case and isn't parsed. +// emailFilterPattern matches the simple SCIM filter expressions IdPs +// actually send when checking "does this user already exist" before +// creating - userName eq "x@y.com" or emails.value eq "x@y.com". Full SCIM +// filter grammar (and/or/not, other attributes) is not needed for this use +// case and isn't parsed. Case-insensitive on the attribute name and the +// "eq" operator, and tolerant of extra whitespace around it - real IdPs +// (Okta in particular) don't all format this identically. +var emailFilterPattern = regexp.MustCompile(`(?i)(?:userName|emails(?:\.value)?)\s+eq\s+"([^"]+)"`) + func parseEmailFilter(filter string) string { - filter = strings.TrimSpace(filter) - for _, attr := range []string{"userName", "emails.value", "emails"} { - prefix := attr + " eq " - if idx := strings.Index(filter, prefix); idx != -1 { - rest := strings.TrimSpace(filter[idx+len(prefix):]) - rest = strings.Trim(rest, `"`) - return strings.ToLower(rest) - } + m := emailFilterPattern.FindStringSubmatch(filter) + if m == nil { + return "" } - return "" + return strings.ToLower(strings.TrimSpace(m[1])) +} + +// scimMaxPageSize bounds `count` - without a ceiling, a misbehaving or +// malicious client could ask for an unbounded page. +const scimMaxPageSize = 200 + +// scimPaging parses SCIM's 1-based `startIndex`/`count` query params, +// defaulting and clamping both so a missing, zero, negative, or +// unreasonably large value can't produce an invalid OFFSET/LIMIT. +func scimPaging(c echo.Context) (startIndex, count int) { + startIndex = 1 + if v, err := strconv.Atoi(c.QueryParam("startIndex")); err == nil && v > 1 { + startIndex = v + } + count = scimMaxPageSize + if v, err := strconv.Atoi(c.QueryParam("count")); err == nil && v > 0 && v < scimMaxPageSize { + count = v + } + return startIndex, count } // SCIMListUsers handles GET /scim/v2/Users. IdPs call this both to page -// through the directory and, far more commonly, with a `filter` to check -// whether a user already exists before POSTing a create. +// through the directory - via the SCIM-standard `startIndex`/`count` query +// params - and, far more commonly, with a `filter` to check whether a user +// already exists before POSTing a create. func (s *Server) SCIMListUsers(c echo.Context) error { orgID := scimOrgID(c) email := parseEmailFilter(c.QueryParam("filter")) @@ -130,6 +150,8 @@ func (s *Server) SCIMListUsers(c echo.Context) error { createdAt, updatedAt time.Time } var rows []row + startIndex, count := scimPaging(c) + totalResults := 0 if email != "" { var r row @@ -140,15 +162,21 @@ func (s *Server) SCIMListUsers(c echo.Context) error { `, email, orgID).Scan(&r.id, &r.email, &r.isActive, &r.firstName, &r.lastName, &r.createdAt, &r.updatedAt) if err == nil { rows = append(rows, r) + totalResults = 1 } else if err != sql.ErrNoRows { return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to query users")) } } else { + if err := s.db.QueryRow(` + SELECT count(*) FROM users u JOIN user_roles ur ON ur.user_id = u.id WHERE ur.org_id = $1 + `, orgID).Scan(&totalResults); err != nil { + return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to count users")) + } sqlRows, err := s.db.Query(` SELECT u.id, u.email, u.is_active, u.first_name, u.last_name, u.created_at, u.updated_at FROM users u JOIN user_roles ur ON ur.user_id = u.id - WHERE ur.org_id = $1 ORDER BY u.id LIMIT 200 - `, orgID) + WHERE ur.org_id = $1 ORDER BY u.id LIMIT $2 OFFSET $3 + `, orgID, count, startIndex-1) if err != nil { return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to query users")) } @@ -188,9 +216,9 @@ func (s *Server) SCIMListUsers(c echo.Context) error { return c.JSON(http.StatusOK, scim.ListResponse{ Schemas: []string{scim.SchemaListResponse}, - TotalResults: len(resources), + TotalResults: totalResults, ItemsPerPage: len(resources), - StartIndex: 1, + StartIndex: startIndex, Resources: resources, }) } @@ -220,7 +248,9 @@ func (s *Server) SCIMCreateUser(c echo.Context) error { return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to provision user")) } if created && s.auditRecorder != nil { - _ = s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserCreate, auditlog.Details("email", email)) + if aerr := s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserCreate, auditlog.Details("email", email)); aerr != nil { + log.Error().Err(aerr).Int64("org_id", orgID).Str("email", email).Msg("scim: failed to record user-create audit event") + } } return c.JSON(http.StatusCreated, scimResourceFromUser(user)) } @@ -267,14 +297,18 @@ func (s *Server) SCIMPatchUser(c echo.Context) error { return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to reactivate user")) } if s.auditRecorder != nil { - _ = s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserReactivate, auditlog.Details("user_id", userID)) + if aerr := s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserReactivate, auditlog.Details("user_id", userID)); aerr != nil { + log.Error().Err(aerr).Int64("org_id", orgID).Int64("user_id", userID).Msg("scim: failed to record user-reactivate audit event") + } } } else { if err := s.userService.DeactivateUserInOrgBySCIM(userID); err != nil { return c.JSON(http.StatusInternalServerError, scim.NewError(http.StatusInternalServerError, "failed to deactivate user")) } if s.auditRecorder != nil { - _ = s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserDeactivate, auditlog.Details("user_id", userID)) + if aerr := s.auditRecorder.Webhook(c.Request().Context(), orgID, auditlog.ActionSCIMUserDeactivate, auditlog.Details("user_id", userID)); aerr != nil { + log.Error().Err(aerr).Int64("org_id", orgID).Int64("user_id", userID).Msg("scim: failed to record user-deactivate audit event") + } } } } @@ -311,27 +345,12 @@ func patchActiveValue(op scim.PatchOperation) (active bool, matched bool) { // --- SCIM token management (session-authenticated, owner-only) --- -// requireSCIMConfigAccess mirrors requireSSOAccess (internal/api/sso_config.go): -// Sensitive Operations Gate + Session-Only Gating + self-hosted-enterprise -// feature check, for the org's SCIM token itself. +// requireSCIMConfigAccess is requireSSOAccess's SCIM-token counterpart +// (internal/api/sso_config.go's requireOwnerSessionAndFeature carries the +// shared Sensitive Operations Gate + Session-Only Gating + +// self-hosted-enterprise feature check both rely on). func (s *Server) requireSCIMConfigAccess(c echo.Context, orgID int64) error { - if err := requireSession(c); err != nil { - return err - } - pc := auth.GetPermissionContext(c) - if pc == nil { - return c.JSON(http.StatusForbidden, map[string]string{"error": "only org owners can manage SCIM provisioning"}) - } - if err := pc.RequireOrgOwner(); err != nil { - return c.JSON(http.StatusForbidden, map[string]string{"error": "only org owners can manage SCIM provisioning"}) - } - if apimiddleware.IsCloudMode() { - return c.JSON(http.StatusForbidden, map[string]string{"error": "SCIM is available on self-hosted enterprise deployments only"}) - } - if !s.orgHasSCIMFeature(orgID) { - return c.JSON(http.StatusForbidden, map[string]string{"error": "SCIM requires an enterprise self-hosted license"}) - } - return nil + return s.requireOwnerSessionAndFeature(c, s.orgHasSCIMFeature(orgID), "SCIM provisioning") } type scimTokenResponse struct { diff --git a/internal/api/sso_config.go b/internal/api/sso_config.go index 3179881c7..31640e343 100644 --- a/internal/api/sso_config.go +++ b/internal/api/sso_config.go @@ -94,25 +94,39 @@ func parseProviderType(raw string) (sso.ProviderType, bool) { } } -// requireSSOAccess checks the "Sensitive Operations Gate" + "Session-Only -// Gating" + self-hosted-enterprise-feature rules from CLAUDE.md in one -// place, since every SSO config handler needs all three. -func (s *Server) requireSSOAccess(c echo.Context, orgID int64) error { +// requireOwnerSessionAndFeature checks the three rules every SSO/SCIM +// config handler needs in combination - the "Sensitive Operations Gate" +// (session only, no API keys), org-owner-only, and self-hosted-enterprise +// feature-gating rules from CLAUDE.md - in one place, so requireSSOAccess +// and requireSCIMConfigAccess don't each carry their own copy of the same +// four checks with only the error strings differing. +func (s *Server) requireOwnerSessionAndFeature(c echo.Context, hasFeature bool, resourceName string) error { if err := requireSession(c); err != nil { return err } pc := auth.GetPermissionContext(c) + deniedMsg := map[string]string{"error": "only org owners can manage " + resourceName} if pc == nil { - return c.JSON(http.StatusForbidden, map[string]string{"error": "only org owners can manage SSO configuration"}) + return c.JSON(http.StatusForbidden, deniedMsg) } if err := pc.RequireOrgOwner(); err != nil { - return c.JSON(http.StatusForbidden, map[string]string{"error": "only org owners can manage SSO configuration"}) + return c.JSON(http.StatusForbidden, deniedMsg) } if apimiddleware.IsCloudMode() { - return c.JSON(http.StatusForbidden, map[string]string{"error": "SSO is available on self-hosted enterprise deployments only"}) + return c.JSON(http.StatusForbidden, map[string]string{"error": resourceName + " is available on self-hosted enterprise deployments only"}) } - if !s.orgHasSSOFeature(orgID) { - return c.JSON(http.StatusForbidden, map[string]string{"error": "SSO requires an enterprise self-hosted license"}) + if !hasFeature { + return c.JSON(http.StatusForbidden, map[string]string{"error": resourceName + " requires an enterprise self-hosted license"}) + } + return nil +} + +// requireSSOAccess checks the "Sensitive Operations Gate" + "Session-Only +// Gating" + self-hosted-enterprise-feature rules from CLAUDE.md in one +// place, since every SSO config handler needs all three. +func (s *Server) requireSSOAccess(c echo.Context, orgID int64) error { + if err := s.requireOwnerSessionAndFeature(c, s.orgHasSSOFeature(orgID), "SSO configuration"); err != nil { + return err } if s.ssoStore == nil { return c.JSON(http.StatusInternalServerError, map[string]string{"error": "SSO is not available on this deployment"}) diff --git a/internal/api/users/user_service.go b/internal/api/users/user_service.go index b0f59a648..850a193d1 100644 --- a/internal/api/users/user_service.go +++ b/internal/api/users/user_service.go @@ -1148,16 +1148,20 @@ func (us *UserService) DeactivateUserInOrgBySCIM(userID int64) error { }) } -// ReactivateUserInOrgBySCIM mirrors DeactivateUserInOrgBySCIM for PATCH active:true. +// ReactivateUserInOrgBySCIM mirrors DeactivateUserInOrgBySCIM for PATCH +// active:true - uses the same store.WithTx wrapper as its sibling (rather +// than us.db.Exec directly) so a future addition here (e.g. an audit insert +// in the same transaction) doesn't have to be retrofitted for atomicity. func (us *UserService) ReactivateUserInOrgBySCIM(userID int64) error { - _, err := us.db.Exec(` - UPDATE users SET is_active = true, deactivated_at = NULL, deactivated_by_user_id = NULL, updated_at = NOW() - WHERE id = $1 - `, userID) - if err != nil { - return fmt.Errorf("failed to reactivate user: %w", err) - } - return nil + return us.store.WithTx(func(tx *sql.Tx) error { + if _, err := us.store.TxExec(tx, ` + UPDATE users SET is_active = true, deactivated_at = NULL, deactivated_by_user_id = NULL, updated_at = NOW() + WHERE id = $1 + `, userID); err != nil { + return fmt.Errorf("failed to reactivate user: %w", err) + } + return nil + }) } // ForcePasswordReset forces a user to reset their password on next login diff --git a/internal/jobqueue/jobqueue.go b/internal/jobqueue/jobqueue.go index a61209f73..fc18d9a77 100644 --- a/internal/jobqueue/jobqueue.go +++ b/internal/jobqueue/jobqueue.go @@ -2449,7 +2449,11 @@ func NewJobQueue(databaseURL string, db *sql.DB) (*JobQueue, error) { river.AddWorker(workers, seedDemoWorker) river.AddWorker(workers, &BlastRadiusWorker{db: db}) river.AddWorker(workers, &RiskModelRefitWorker{db: db}) - river.AddWorker(workers, &SSOReconciliationWorker{db: db}) + ssoJWTSecret := os.Getenv("JWT_SECRET") + if ssoJWTSecret == "" { + log.Printf("WARNING: JWT_SECRET not set - SSO reconciliation sweep will be a no-op for every org") + } + river.AddWorker(workers, &SSOReconciliationWorker{db: db, jwtSecret: ssoJWTSecret}) coordinatorInterval := config.RepoSyncConfig.CoordinatorInterval if coordinatorInterval <= 0 { diff --git a/internal/jobqueue/sso_reconciliation_worker.go b/internal/jobqueue/sso_reconciliation_worker.go index 6f9855f6a..d3cd472f7 100644 --- a/internal/jobqueue/sso_reconciliation_worker.go +++ b/internal/jobqueue/sso_reconciliation_worker.go @@ -4,11 +4,11 @@ import ( "context" "database/sql" "fmt" - "os" "github.com/livereview/internal/api/users" "github.com/livereview/internal/sso" "github.com/riverqueue/river" + "github.com/rs/zerolog/log" "golang.org/x/oauth2" ) @@ -26,14 +26,22 @@ func (SSOReconciliationJobArgs) Kind() string { return "sso_reconciliation" } type SSOReconciliationWorker struct { river.WorkerDefaults[SSOReconciliationJobArgs] - db *sql.DB + db *sql.DB + jwtSecret string } func (w *SSOReconciliationWorker) Work(ctx context.Context, job *river.Job[SSOReconciliationJobArgs]) error { - box, err := sso.NewSecretBox(os.Getenv("JWT_SECRET")) - if err != nil { + if w.jwtSecret == "" { // Same "disabled, not fatal" treatment server.go gives a missing/empty - // JWT_SECRET for SSO generally - nothing to reconcile without it. + // JWT_SECRET for SSO generally - nothing to reconcile without it. Logged + // (rather than silently skipped) since an org with reconciliation + // enabled would otherwise see it silently never run. + log.Warn().Msg("sso reconciliation: JWT_SECRET not set, skipping sweep") + return nil + } + box, err := sso.NewSecretBox(w.jwtSecret) + if err != nil { + log.Warn().Err(err).Msg("sso reconciliation: failed to build secret box, skipping sweep") return nil } configStore := sso.NewStore(w.db, box) @@ -56,19 +64,24 @@ func (w *SSOReconciliationWorker) Work(ctx context.Context, job *river.Job[SSORe func (w *SSOReconciliationWorker) reconcileOrg(ctx context.Context, cfg *sso.Config, configStore *sso.Store, identityStore *sso.IdentityStore, userService *users.UserService) { fullCfg, err := configStore.Get(cfg.OrgID, sso.ProviderOIDC) if err != nil { + log.Warn().Err(err).Int64("org_id", cfg.OrgID).Msg("sso reconciliation: failed to load full OIDC config") return } identities, err := identityStore.ListWithRefreshToken(cfg.OrgID, sso.ProviderOIDC) if err != nil { + log.Warn().Err(err).Int64("org_id", cfg.OrgID).Msg("sso reconciliation: failed to list identities with refresh tokens") return } if len(identities) == 0 { - _ = configStore.MarkReconciled(cfg.OrgID, sso.ProviderOIDC) + if err := configStore.MarkReconciled(cfg.OrgID, sso.ProviderOIDC); err != nil { + log.Warn().Err(err).Int64("org_id", cfg.OrgID).Msg("sso reconciliation: failed to mark org reconciled (no identities)") + } return } oauthCfg, _, err := sso.BuildOIDCOAuth2Config(ctx, fullCfg, "") if err != nil { + log.Warn().Err(err).Int64("org_id", cfg.OrgID).Msg("sso reconciliation: failed to build OIDC OAuth2 config") return } @@ -78,11 +91,21 @@ func (w *SSOReconciliationWorker) reconcileOrg(ctx context.Context, cfg *sso.Con // The IdP rejected the refresh - invalid_grant/invalid_token is // exactly what Okta/Azure/Google return for a disabled, deleted, // or de-authorized account. Deactivate, same as a SCIM - // PATCH active:false would. - _ = userService.DeactivateUserInOrgBySCIM(identity.UserID) + // PATCH active:false would. If the deactivation itself fails, + // the identity is deliberately left unmarked (not MarkChecked) + // so it's picked up again next reconciliation cycle instead of + // silently staying active. + if err := userService.DeactivateUserInOrgBySCIM(identity.UserID); err != nil { + log.Error().Err(err).Int64("org_id", cfg.OrgID).Int64("user_id", identity.UserID). + Msg("sso reconciliation: IdP rejected refresh but deactivating the user failed") + } continue } - _ = identityStore.MarkChecked(identity.ID) + if err := identityStore.MarkChecked(identity.ID); err != nil { + log.Warn().Err(err).Int64("org_id", cfg.OrgID).Int64("identity_id", identity.ID).Msg("sso reconciliation: failed to mark identity checked") + } + } + if err := configStore.MarkReconciled(cfg.OrgID, sso.ProviderOIDC); err != nil { + log.Warn().Err(err).Int64("org_id", cfg.OrgID).Msg("sso reconciliation: failed to mark org reconciled") } - _ = configStore.MarkReconciled(cfg.OrgID, sso.ProviderOIDC) } diff --git a/internal/mcpagent/agent.go b/internal/mcpagent/agent.go index f45660bc9..0495bebfb 100644 --- a/internal/mcpagent/agent.go +++ b/internal/mcpagent/agent.go @@ -183,20 +183,12 @@ func (a *Agent) RunTurnWithArtifacts(ctx context.Context, history []HistoryEntry clog.BranchSelected("analytics", 0, 0) // This branch never runs through runStepLoop (which otherwise - // does this swap - see its own comment), so it has to do the - // same history[0] swap itself. Without it, a turn landing here - // right after an action/product_guidance turn keeps that - // turn's stale system prompt (missing the SQL rules, or - // leaking the tool list into an analytics turn). - analyticsSystemPrompt := a.interpretPrompt() - switch { - case len(history) == 0: - history = append(history, HistoryEntry{"role": "system", "content": analyticsSystemPrompt}) - case history[0]["role"] == "system": - history[0] = HistoryEntry{"role": "system", "content": analyticsSystemPrompt} - default: - history = append([]HistoryEntry{{"role": "system", "content": analyticsSystemPrompt}}, history...) - } + // does this swap - see swapSystemPrompt's comment), so it has + // to do the same history[0] swap itself. Without it, a turn + // landing here right after an action/product_guidance turn + // keeps that turn's stale system prompt (missing the SQL + // rules, or leaking the tool list into an analytics turn). + history = swapSystemPrompt(history, a.interpretPrompt()) text, artifacts, debugArt, err := a.runMultiInterpret(ctx, userText, clog, a.mcpSession.OrgID, a.mcpSession.OrgName) if err != nil { @@ -322,6 +314,29 @@ func (a *Agent) RunTurnWithArtifacts(ctx context.Context, history []HistoryEntry return a.runStepLoop(ctx, history, userText, a.systemPrompt, a.providerTools, 0, false, false, "", clog) } +// swapSystemPrompt replaces (or inserts) history's leading system message +// with systemPrompt. Swapped every turn, not appended once: which prompt a +// turn needs is decided fresh per call, so a session that changes shape +// turn-to-turn (a data question, then "trigger a review for that repo", +// then another data question) must not keep whatever was baked in on turn +// one. The rest of history (actual conversation content) is untouched. +// Used by both runStepLoop and RunTurnWithArtifacts's analytics branch, +// which bypasses runStepLoop entirely but still needs the same swap. +func swapSystemPrompt(history []HistoryEntry, systemPrompt string) []HistoryEntry { + if systemPrompt == "" { + return history + } + switch { + case len(history) == 0: + return append(history, HistoryEntry{"role": "system", "content": systemPrompt}) + case history[0]["role"] == "system": + history[0] = HistoryEntry{"role": "system", "content": systemPrompt} + return history + default: + return append([]HistoryEntry{{"role": "system", "content": systemPrompt}}, history...) + } +} + // runStepLoop is the ReAct tool-calling loop. Extracted from RunTurnWithArtifacts // so the count_query branch can skip it entirely (using runMultiInterpret instead) // while action and chat branches continue through the step loop as before. @@ -337,25 +352,7 @@ func (a *Agent) runStepLoop( schemaTableText string, clog *logging.ChatTurnLogger, ) (string, []HistoryEntry, []Artifact, *DebugArtifacts, error) { - // Swapped every turn, not appended once: which prompt a turn needs is - // decided fresh above, so a session that changes shape turn-to-turn - // (a data question, then "trigger a review for that repo", then - // another data question) must not keep whatever was baked in on turn - // one. The rest of history (actual conversation content) is untouched. - switch { - case len(history) == 0: - if systemPrompt != "" { - history = append(history, HistoryEntry{"role": "system", "content": systemPrompt}) - } - case history[0]["role"] == "system": - if systemPrompt != "" { - history[0] = HistoryEntry{"role": "system", "content": systemPrompt} - } - default: - if systemPrompt != "" { - history = append([]HistoryEntry{{"role": "system", "content": systemPrompt}}, history...) - } - } + history = swapSystemPrompt(history, systemPrompt) history = append(history, HistoryEntry{"role": "user", "content": userText}) for step := 0; step < a.maxSteps; step++ { diff --git a/internal/mcpagent/analytics.go b/internal/mcpagent/analytics.go index 05a51dd8e..ee7c96a81 100644 --- a/internal/mcpagent/analytics.go +++ b/internal/mcpagent/analytics.go @@ -1426,30 +1426,29 @@ var DefaultAIErrorSuggestedQuestions = []SuggestedQuestionCategory{ // right next to the correctly-delivered file - a contradiction a user would // rightly read as a bug, because it is one. func assembleAnalyticsResponse(reports []vlrender.VegaLiteReport, notes []string, hasArtifacts bool) string { - if len(reports) == 0 { - if len(notes) == 0 { - if hasArtifacts { - // A file-only turn still needs words. Returning "" renders - // as an empty bubble next to a download the user has no - // context for. - return "I've put the results in a file you can download." - } - return NoDataAnalyticsResponseText + if len(reports) > 0 { + payload, err := json.Marshal(map[string]any{"reports": reports}) + if err != nil { + log.Error().Err(err).Msg("failed to marshal analytics reports") + return strings.Join(notes, "\n\n") } - return strings.Join(notes, "\n\n") + out := string(payload) + if len(notes) > 0 { + // Notes precede the JSON: the render path strips the JSON block + // and keeps surrounding prose as the message text. + out = strings.Join(notes, "\n\n") + "\n" + out + } + return out } - payload, err := json.Marshal(map[string]any{"reports": reports}) - if err != nil { - log.Error().Err(err).Msg("failed to marshal analytics reports") + if len(notes) > 0 { return strings.Join(notes, "\n\n") } - out := string(payload) - if len(notes) > 0 { - // Notes precede the JSON: the render path strips the JSON block and - // keeps surrounding prose as the message text. - out = strings.Join(notes, "\n\n") + "\n" + out + if hasArtifacts { + // A file-only turn still needs words. Returning "" renders as an + // empty bubble next to a download the user has no context for. + return "I've put the results in a file you can download." } - return out + return NoDataAnalyticsResponseText } // rowsToPreviewCSV converts rows to a CSV string for debug preview.