From defb8660c08a904a385b584280f72fc6a5a94c6e Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Thu, 14 Jul 2016 13:19:40 -0500 Subject: [PATCH 01/11] Added the ability to block sign ups using a domain blacklist. --- .../admin/application_settings_controller.rb | 4 + app/models/application_setting.rb | 35 +++++++-- app/models/user.rb | 40 ++++++---- .../application_settings/_form.html.haml | 73 ++++++++++++++++--- ...omain_blacklist_to_application_settings.rb | 22 ++++++ db/schema.rb | 2 + lib/api/entities.rb | 2 + spec/fixtures/blacklist.txt | 3 + spec/models/application_setting_spec.rb | 27 +++++++ spec/models/user_spec.rb | 53 +++++++++++++- 10 files changed, 228 insertions(+), 33 deletions(-) create mode 100644 db/migrate/20160713205315_add_domain_blacklist_to_application_settings.rb create mode 100644 spec/fixtures/blacklist.txt diff --git a/app/controllers/admin/application_settings_controller.rb b/app/controllers/admin/application_settings_controller.rb index 23ba83aba0e..3e27320ee5c 100644 --- a/app/controllers/admin/application_settings_controller.rb +++ b/app/controllers/admin/application_settings_controller.rb @@ -64,6 +64,7 @@ class Admin::ApplicationSettingsController < Admin::ApplicationController params[:application_setting][:disabled_oauth_sign_in_sources] = AuthHelper.button_based_providers.map(&:to_s) - Array(enabled_oauth_sign_in_sources) + params.delete(:domain_blacklist_raw) if params[:domain_blacklist_file] params.require(:application_setting).permit( :default_projects_limit, @@ -112,6 +113,9 @@ class Admin::ApplicationSettingsController < Admin::ApplicationController :container_registry_token_expire_delay, :repository_storage, :enabled_git_access_protocol, + :domain_blacklist_enabled, + :domain_blacklist_raw, + :domain_blacklist_file, restricted_visibility_levels: [], import_sources: [], disabled_oauth_sign_in_sources: [] diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb index c6f77cc055f..84b1b54eeae 100644 --- a/app/models/application_setting.rb +++ b/app/models/application_setting.rb @@ -9,7 +9,9 @@ class ApplicationSetting < ActiveRecord::Base serialize :import_sources serialize :disabled_oauth_sign_in_sources, Array serialize :restricted_signup_domains, Array - attr_accessor :restricted_signup_domains_raw + serialize :domain_blacklist, Array + + attr_accessor :restricted_signup_domains_raw, :domain_blacklist_raw validates :session_expire_delay, presence: true, @@ -62,6 +64,10 @@ class ApplicationSetting < ActiveRecord::Base validates :enabled_git_access_protocol, inclusion: { in: %w(ssh http), allow_blank: true, allow_nil: true } + validates :domain_blacklist, + presence: true, + if: :domain_blacklist_enabled? + validates_each :restricted_visibility_levels do |record, attr, value| unless value.nil? value.each do |level| @@ -154,18 +160,35 @@ class ApplicationSetting < ActiveRecord::Base self.restricted_signup_domains.join("\n") unless self.restricted_signup_domains.nil? end - def restricted_signup_domains_raw=(values) - self.restricted_signup_domains = [] - self.restricted_signup_domains = values.split( - /\s*[,;]\s* # comma or semicolon, optionally surrounded by whitespace + def domain_blacklist_raw + self.domain_blacklist.join("\n") unless self.domain_blacklist.nil? + end + + def splitter + /\s*[,;]\s* # comma or semicolon, optionally surrounded by whitespace | # or \s # any whitespace character | # or [\r\n] # any number of newline characters - /x) + /x + end + + def restricted_signup_domains_raw=(values) + self.restricted_signup_domains = [] + self.restricted_signup_domains = values.split(splitter) self.restricted_signup_domains.reject! { |d| d.empty? } end + def domain_blacklist_raw=(values) + self.domain_blacklist = [] + self.domain_blacklist = values.split(splitter) + self.domain_blacklist.reject! { |d| d.empty? } + end + + def domain_blacklist_file=(file) + self.domain_blacklist_raw = file.read + end + def runners_registration_token ensure_runners_registration_token! end diff --git a/app/models/user.rb b/app/models/user.rb index 3d0a033785c..b0c5d84fc40 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -111,7 +111,7 @@ class User < ActiveRecord::Base validates :avatar, file_size: { maximum: 200.kilobytes.to_i } before_validation :generate_password, on: :create - before_validation :restricted_signup_domains, on: :create + before_validation :signup_domain_valid?, on: :create before_validation :sanitize_attrs before_validation :set_notification_email, if: ->(user) { user.email_changed? } before_validation :set_public_email, if: ->(user) { user.public_email_changed? } @@ -760,27 +760,41 @@ class User < ActiveRecord::Base Project.where(id: events) end - def restricted_signup_domains - email_domains = current_application_settings.restricted_signup_domains + def match_domain(email_domains) + email_domains.any? do |domain| + escaped = Regexp.escape(domain).gsub('\*', '.*?') + regexp = Regexp.new "^#{escaped}$", Regexp::IGNORECASE + email_domain = Mail::Address.new(self.email).domain + email_domain =~ regexp + end + end + + def signup_domain_valid? + valid = true - unless email_domains.blank? - match_found = email_domains.any? do |domain| - escaped = Regexp.escape(domain).gsub('\*', '.*?') - regexp = Regexp.new "^#{escaped}$", Regexp::IGNORECASE - email_domain = Mail::Address.new(self.email).domain - email_domain =~ regexp + if current_application_settings.domain_blacklist_enabled? + blocked_domains = current_application_settings.domain_blacklist + if match_domain(blocked_domains) + self.errors.add :email, 'is not from an allowed domain.' + valid = false end + end - unless match_found + allowed_domains = current_application_settings.restricted_signup_domains + unless allowed_domains.blank? + if match_domain(allowed_domains) + self.errors.clear + valid = true + else self.errors.add :email, 'is not whitelisted. ' + 'Email domains valid for registration are: ' + - email_domains.join(', ') - return false + allowed_domains.join(', ') + valid = false end end - true + return valid end def can_be_removed? diff --git a/app/views/admin/application_settings/_form.html.haml b/app/views/admin/application_settings/_form.html.haml index 538d8176ce7..9443fe5e1d3 100644 --- a/app/views/admin/application_settings/_form.html.haml +++ b/app/views/admin/application_settings/_form.html.haml @@ -109,7 +109,7 @@ Newly registered users will by default be external %fieldset - %legend Sign-in Restrictions + %legend Sign-up Restrictions .form-group .col-sm-offset-2.col-sm-10 .checkbox @@ -122,6 +122,49 @@ = f.label :send_user_confirmation_email do = f.check_box :send_user_confirmation_email Send confirmation email on sign-up + .form-group + = f.label :restricted_signup_domains, 'Restricted domains for sign-ups', class: 'control-label col-sm-2' + .col-sm-10 + = f.text_area :restricted_signup_domains_raw, placeholder: 'domain.com', class: 'form-control' + .help-block ONLY users with e-mail addresses that match these domain(s) will be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com + .form-group + = f.label :domain_blacklist_enabled, 'Domain Blacklist', class: 'control-label col-sm-2' + .col-sm-10 + .checkbox + = f.label :domain_blacklist_enabled do + = f.check_box :domain_blacklist_enabled + Enable domain blacklist for sign ups + .form-group + .col-sm-offset-2.col-sm-10 + .radio + = label_tag :blacklist_type_file do + = radio_button_tag :blacklist_type, :file, @application_setting.domain_blacklist.blank? + .option-title + Upload blacklist file + .radio + = label_tag :blacklist_type_raw do + = radio_button_tag :blacklist_type, :raw, @application_setting.domain_blacklist.present? + .option-title + Enter blacklist manually + .form-group.blacklist-file + = f.label :domain_blacklist_file, 'Blacklist file', class: 'control-label col-sm-2' + .col-sm-10 + = f.file_field :domain_blacklist_file, class: 'form-control', accept: '.txt,.conf' + .help-block Users with e-mail addresses that match these domain(s) will NOT be able to sign-up. Wildcards allowed. Use separate lines or commas for multiple entries. + .form-group.blacklist-raw + = f.label :domain_blacklist, 'Blacklisted domains', class: 'control-label col-sm-2' + .col-sm-10 + = f.text_area :domain_blacklist_raw, placeholder: 'domain.com', class: 'form-control', rows: 10 + .help-block Users with e-mail addresses that match these domain(s) will NOT be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com + + .form-group + = f.label :after_sign_up_text, class: 'control-label col-sm-2' + .col-sm-10 + = f.text_area :after_sign_up_text, class: 'form-control', rows: 4 + .help-block Markdown enabled + + %fieldset + %legend Sign-in Restrictions .form-group .col-sm-offset-2.col-sm-10 .checkbox @@ -147,11 +190,6 @@ .col-sm-10 = f.number_field :two_factor_grace_period, min: 0, class: 'form-control', placeholder: '0' .help-block Amount of time (in hours) that users are allowed to skip forced configuration of two-factor authentication - .form-group - = f.label :restricted_signup_domains, 'Restricted domains for sign-ups', class: 'control-label col-sm-2' - .col-sm-10 - = f.text_area :restricted_signup_domains_raw, placeholder: 'domain.com', class: 'form-control' - .help-block Only users with e-mail addresses that match these domain(s) will be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com .form-group = f.label :home_page_url, 'Home page URL', class: 'control-label col-sm-2' .col-sm-10 @@ -167,11 +205,6 @@ .col-sm-10 = f.text_area :sign_in_text, class: 'form-control', rows: 4 .help-block Markdown enabled - .form-group - = f.label :after_sign_up_text, class: 'control-label col-sm-2' - .col-sm-10 - = f.text_area :after_sign_up_text, class: 'form-control', rows: 4 - .help-block Markdown enabled .form-group = f.label :help_page_text, class: 'control-label col-sm-2' .col-sm-10 @@ -353,3 +386,21 @@ .form-actions = f.submit 'Save', class: 'btn btn-save' + +:javascript + function showBlacklistType() { + if ($("input[name='blacklist_type']:checked").val() == "file") + { + $(".blacklist-file").show(); + $(".blacklist-raw").hide(); + } + else + { + $(".blacklist-file").hide(); + $(".blacklist-raw").show(); + } + } + + $("input[name='blacklist_type']").click(showBlacklistType); + + showBlacklistType(); \ No newline at end of file diff --git a/db/migrate/20160713205315_add_domain_blacklist_to_application_settings.rb b/db/migrate/20160713205315_add_domain_blacklist_to_application_settings.rb new file mode 100644 index 00000000000..ecdd1bd7e5e --- /dev/null +++ b/db/migrate/20160713205315_add_domain_blacklist_to_application_settings.rb @@ -0,0 +1,22 @@ +# See http://doc.gitlab.com/ce/development/migration_style_guide.html +# for more information on how to write migrations for GitLab. + +class AddDomainBlacklistToApplicationSettings < ActiveRecord::Migration + include Gitlab::Database::MigrationHelpers + + # When using the methods "add_concurrent_index" or "add_column_with_default" + # you must disable the use of transactions as these methods can not run in an + # existing transaction. When using "add_concurrent_index" make sure that this + # method is the _only_ method called in the migration, any other changes + # should go in a separate migration. This ensures that upon failure _only_ the + # index creation fails and can be retried or reverted easily. + # + # To disable transactions uncomment the following line and remove these + # comments: + # disable_ddl_transaction! + + def change + add_column :application_settings, :domain_blacklist_enabled, :boolean, default: false + add_column :application_settings, :domain_blacklist, :text + end +end diff --git a/db/schema.rb b/db/schema.rb index 8882377f9f4..25d94f283c9 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -88,6 +88,8 @@ ActiveRecord::Schema.define(version: 20160716115710) do t.text "after_sign_up_text" t.string "repository_storage", default: "default" t.string "enabled_git_access_protocol" + t.boolean "domain_blacklist_enabled", default: false + t.text "domain_blacklist" end create_table "audit_events", force: :cascade do |t| diff --git a/lib/api/entities.rb b/lib/api/entities.rb index 3c79a00eb8c..4cd388658be 100644 --- a/lib/api/entities.rb +++ b/lib/api/entities.rb @@ -413,6 +413,8 @@ module API expose :default_snippet_visibility expose :default_group_visibility expose :restricted_signup_domains + expose :domain_blacklist_enabled + expose :domain_blacklist expose :user_oauth_applications expose :after_sign_out_path expose :container_registry_token_expire_delay diff --git a/spec/fixtures/blacklist.txt b/spec/fixtures/blacklist.txt new file mode 100644 index 00000000000..baeb11eda9a --- /dev/null +++ b/spec/fixtures/blacklist.txt @@ -0,0 +1,3 @@ +example.com +test.com +foo.bar \ No newline at end of file diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb index 2ea1320267c..582d9a8d8cd 100644 --- a/spec/models/application_setting_spec.rb +++ b/spec/models/application_setting_spec.rb @@ -73,4 +73,31 @@ describe ApplicationSetting, models: true do expect(setting.restricted_signup_domains).to eq(['example.com', '*.example.com']) end end + + context 'blacklisted signup domains' do + it 'set single domain' do + setting.domain_blacklist_raw = 'example.com' + expect(setting.domain_blacklist).to eq(['example.com']) + end + + it 'set multiple domains with spaces' do + setting.domain_blacklist_raw = 'example.com *.example.com' + expect(setting.domain_blacklist).to eq(['example.com', '*.example.com']) + end + + it 'set multiple domains with newlines and a space' do + setting.domain_blacklist_raw = "example.com\n *.example.com" + expect(setting.domain_blacklist).to eq(['example.com', '*.example.com']) + end + + it 'set multiple domains with commas' do + setting.domain_blacklist_raw = "example.com, *.example.com" + expect(setting.domain_blacklist).to eq(['example.com', '*.example.com']) + end + + it 'set multiple domain with file' do + setting.domain_blacklist_file = File.open(Rails.root.join('spec/fixtures/', 'blacklist.txt')) + expect(setting.domain_blacklist).to eq(%w(example.com test.com foo.bar)) + end + end end diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index fc74488ac0e..79f77d116a7 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -89,7 +89,7 @@ describe User, models: true do end describe 'email' do - context 'when no signup domains listed' do + context 'when no signup domains white listed' do before do allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return([]) end @@ -100,7 +100,7 @@ describe User, models: true do end end - context 'when a signup domain is listed and subdomains are allowed' do + context 'when a signup domain is white listed and subdomains are allowed' do before do allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['example.com', '*.example.com']) end @@ -121,7 +121,7 @@ describe User, models: true do end end - context 'when a signup domain is listed and subdomains are not allowed' do + context 'when a signup domain is white listed and subdomains are not allowed' do before do allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['example.com']) end @@ -142,6 +142,53 @@ describe User, models: true do end end + context 'domain blacklist' do + before do + allow_any_instance_of(ApplicationSetting).to receive(:domain_blacklist_enabled?).and_return(true) + allow_any_instance_of(ApplicationSetting).to receive(:domain_blacklist).and_return(['example.com']) + end + + context 'when a signup domain is black listed' do + it 'accepts info@test.com' do + user = build(:user, email: 'info@test.com') + expect(user).to be_valid + end + + it 'rejects info@example.com' do + user = build(:user, email: 'info@example.com') + expect(user).not_to be_valid + end + end + + context 'when a signup domain is black listed but a wildcard subdomain is allowed' do + before do + allow_any_instance_of(ApplicationSetting).to receive(:domain_blacklist).and_return(['test.example.com']) + allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['*.example.com']) + end + + it 'should give priority to whitelist and allow info@test.example.com' do + user = build(:user, email: 'info@test.example.com') + expect(user).to be_valid + end + end + + context 'with both lists containing a domain' do + before do + allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['test.com']) + end + + it 'accepts info@test.com' do + user = build(:user, email: 'info@test.com') + expect(user).to be_valid + end + + it 'rejects info@example.com' do + user = build(:user, email: 'info@example.com') + expect(user).not_to be_valid + end + end + end + context 'owns_notification_email' do it 'accepts temp_oauth_email emails' do user = build(:user, email: "temp-email-for-oauth@example.com") -- GitLab From 8382cff34590648c76fad4ff18a1e1ad74418501 Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Thu, 14 Jul 2016 13:24:39 -0500 Subject: [PATCH 02/11] Added CHANGELOG item. --- CHANGELOG | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG b/CHANGELOG index 7bf2c7a5587..4c8eb90151e 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -21,6 +21,7 @@ v 8.10.0 (unreleased) - Display last commit of deleted branch in push events !4699 (winniehell) - Escape file extension when parsing search results !5141 (winniehell) - Apply the trusted_proxies config to the rack request object for use with rack_attack + - Added the ability to block sign ups using a domain blacklist !5259 - Upgrade to Rails 4.2.7. !5236 - Add Sidekiq queue duration to transaction metrics. - Add a new column `artifacts_size` to table `ci_builds` !4964 -- GitLab From ce58437cfad3c82371b1790e47f97bc5e1d9a889 Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Thu, 14 Jul 2016 22:47:36 -0500 Subject: [PATCH 03/11] Fixed `signup_domain_valid?` flow and added documentation. --- app/models/user.rb | 37 ++++++++++---------- doc/administration/access_restrictions.md | 22 ++++++++++-- doc/administration/img/domain_blacklist.png | Bin 0 -> 178444 bytes 3 files changed, 39 insertions(+), 20 deletions(-) create mode 100644 doc/administration/img/domain_blacklist.png diff --git a/app/models/user.rb b/app/models/user.rb index b0c5d84fc40..d27e2374f18 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -760,41 +760,31 @@ class User < ActiveRecord::Base Project.where(id: events) end - def match_domain(email_domains) - email_domains.any? do |domain| - escaped = Regexp.escape(domain).gsub('\*', '.*?') - regexp = Regexp.new "^#{escaped}$", Regexp::IGNORECASE - email_domain = Mail::Address.new(self.email).domain - email_domain =~ regexp - end - end - def signup_domain_valid? valid = true + error = nil if current_application_settings.domain_blacklist_enabled? blocked_domains = current_application_settings.domain_blacklist - if match_domain(blocked_domains) - self.errors.add :email, 'is not from an allowed domain.' + if match_domain(blocked_domains, self.email) + error = 'is not from an allowed domain.' valid = false end end allowed_domains = current_application_settings.restricted_signup_domains unless allowed_domains.blank? - if match_domain(allowed_domains) - self.errors.clear + if match_domain(allowed_domains, self.email) valid = true else - self.errors.add :email, - 'is not whitelisted. ' + - 'Email domains valid for registration are: ' + - allowed_domains.join(', ') + error = "is not whitelisted. Email domains valid for registration are: #{allowed_domains.join(', ')}" valid = false end end - return valid + self.errors.add(:email, error) unless valid + + valid end def can_be_removed? @@ -895,4 +885,15 @@ class User < ActiveRecord::Base self.can_create_group = false self.projects_limit = 0 end + + private + + def match_domain(email_domains, email) + signup_domain = Mail::Address.new(email).domain + email_domains.any? do |domain| + escaped = Regexp.escape(domain).gsub('\*', '.*?') + regexp = Regexp.new "^#{escaped}$", Regexp::IGNORECASE + signup_domain =~ regexp + end + end end diff --git a/doc/administration/access_restrictions.md b/doc/administration/access_restrictions.md index 51d7996effd..08bb8ff4e19 100644 --- a/doc/administration/access_restrictions.md +++ b/doc/administration/access_restrictions.md @@ -1,6 +1,6 @@ # Access Restrictions -> **Note:** This feature is only available on versions 8.10 and above. +> **Note:** These features are only available on versions 8.10 and above. With GitLab's Access restrictions you can choose which Git access protocols you want your users to use to communicate with GitLab. This feature can be enabled @@ -35,4 +35,22 @@ not selected. > **Note:** Please keep in mind that disabling an access protocol does not actually block access to the server itself. The ports used for the protocol, be it SSH or HTTP, will still be accessible. What GitLab does is restrict access on the - application level. \ No newline at end of file + application level. + +## Blacklist email domains + +With this feature enabled, you can block email addresses of an specific domain +from creating an account on your GitLab server. This is particularly useful to +prevent spam. Disposable email addresses are usually used by malicious users to +create dummy accounts and spam issues. + +This feature can be activated via the `Application Settings` in the Admin area, +and you have the option of entering the list manually, or uploading a file with +the list. + +The blacklist accepts wildcards, so you can use `*.test.com` to block every +`test.com` subdomain, or `*.io` to block all domains ending in `.io`. Domains +should be separated by a whitespace, semicolon, comma, or a new line. + +![Domain Blacklist](img/domain_blacklist.png) + diff --git a/doc/administration/img/domain_blacklist.png b/doc/administration/img/domain_blacklist.png new file mode 100644 index 0000000000000000000000000000000000000000..a7894e5f08d77da07298ee6449bea6b1229b9e6b GIT binary patch literal 178444 zcmdqJ1yEeuwk`|=2@nDa0fIZho8T_NHMqMr9^4^72*HE91b266NC*T7?(Xicjl4zn zIrk+0{r9O?_tdL;^{Aq|>D6U79d3C`jhQ!t#>B!X)zcwx;G*CNMA(K>=|t>Mthnehl=Ui_Ms9K`x%6N*u_# zW5t^I=9HEzSC9)KkOhBwOzrofP@i>F9YcX09u|QfjExK@^#of`l=2b9>xPB_$O7*M zSL;Tq!~E5HFYyVSpuHIt)sOFRFcj|;>-ptsD}}z1R&o-3g+u;|H2R(-IyMEovbOg0 z^R>gB8AB)x*rX+|X8G&@dS3-kP8O{JBdGhBMLlTt#fJ;>-T1Vq`ZlA-BlQwWj|WPa zJYo$_Q3A^%l~^#m>nf>84Nx*I!>IJhEJb(e{0H_~@HHratK{6^Txc|DHa2 z7p&VN1}BP?5CSLK_E(K}MAg0_i?sEy`|n|yo)A4EN`MD_BT$Et#(-ZUK@kaPC&86K z9)5pHifD|?CAj|?{l$|2A*)Z1a^B2*fyfgnKaPD9E6;bzHwvp0U?b!|C=4b@@|_nX zHh3ZP(Y*Xc@spjePbLwa{cjh;nDFKNSeC3VNwneAzL_nmUebCZ5q)$!ly)UTkf(S- zNEtZ%=C!;t^;_k~v?v{-dm?L@!3rw*RLZXkah%XQg!?l2Gb+Hen%E@)?BYCGw?p)f z&)r{f6YB(*3fEJO=!sxe7@E{oDGmFFelvzp1%4x@>OGz*G@(og%Qbxzy;9-f#XAR zJESxEklEF%nVcVf;G5Y}$PwCQ&n4;23-2HjL3y%-XS~SIK9qcbd&Bl6`dvJeq&gYO zbCplnA_9i=cIXu!CPkX%2*_I~BPEV0l%hCjK2|3yzu^{dl*D`GMS>bR*6qA1Z%=zg z(hxT*>Mh|d{Y5^8W;_N%3T2HXC(SKB;Oiz-n30x|r|+lVqVK=R@Xeew<#Xj{ zfB6scwS(qgEZ<-%zfkeD5I0e{P%J8#D2QgImkn5d6Oyww)IWS}?$Gw8?PD8k8*ZCP zTl@z%#}_(@`)?xha0UlP#5ajWvqh{#$V8uhVhwr{L?0~mNi#$&cs-as--O**0xI%1Amp-Q`FM`U1u+@&?)CYUA|P=9uc3 zXywdNy8=tas$oZS%PsXSvaOzB7G`B!>BN_bWQlalAmacNYvUCYX=4xLja7=Zlr_aQ z+O_MoxK)+a+qJ6IRZGM6cy2HEShm@(t*i`t z*=(58UMsL7v(Rwhnhd_w4fXsXs}x#Lvc)(Ol1tnh+NaptpL}atYC>c-ug?#WGtpUX z+;+mmKE{>_kwQ(&DK<%1qmfRFO~D!|{JEW2wt@wy{=w275-7 zhoyWxH-WtuyxcMQ;3T5ZE|V>4Y_O^vBdTmL$~xoc^??u58cT;;I4rxkP6#b^5_w3PjzMW#TM)q4l_IpC$5*)SRK(MckEWe)g1dN`*`jC zp8d>)74d>WRhIp$Y8Fqk3&sGQsU|8Hp1sl;;aSYOjXe6f;PzLznX29`f9i}JC!5Ng&2$mxAcm+|scYMXy3(J$ENh2k-_|c5 z33m#_ip4*TpNeCPmyRQ**5iFU{0y zBX=U=+5=djxI?qwKw^< zMth#Ty8SK9o|Gp)J=F{+c2&;Dg7*97BFYeSnif{(MttV>uKV!AIZDr_ zPjws2?M{{%sd4WNPPxL28kPK0!^2w60gyH;BGz) z%6M_`q>Pw|;E33b36J}y2gZ^9wZYBziHKn$2EKW|kGMTvWQW<81*;>4>0{nD>$oS3 zVKWgId?#M#u6}Gs$MLIr{IaG3dAy*ssKmnb@$?qX6;75z!|x&8@j;+?QwMLXo0^;0 z?IL3Ds=E?fMzGB>+r`;&@=cwgt>pr4%TC%wl27C3^785gsP3-U9MX@#`3PU)ytrY3 zCH`1XRp{(h$6n8*ecQ1;S#*zf7#y|nR|N%_<^qKG&qIv^VJT3LN=!-xj-Q;?8K1oJ zpV`y9`ZTA>sKsCeV^IQoxPbPaCrUw%Oc>dKnYm0vM8FaT|K$zaUH&TdquUy@&kYi+ zZmrEXswgnpuVB&}dU~W^#l;J#k@xY#XV7ikpPv&q$04bqgk-NOP1CV5ab116Kwc2lBrr`R6<$CJsjS=I4|3gcmW0AqWEt|37{pDMiqR4_m%I+gN?} zpG;H^{}}H`>_3?S7)uInPySCf1B?Y$LG=H`D##ZL3kr@%d|}`olf3^QKO8X#4pO)1 z`ScV02N;2Ym42V`%ohHCjW_1Afl&Z5_qh;ZYQ?qh92P z4~%xR1QfsH)sf#fI2fg%v^1` zQ(aB-_)VWa{e3#_bU{123M^(RIk~vrUYVjozn-;iPo$sEeo2D_!w8NjqO*`nT~(E; zrluy-AS)#$tP429;F;}nkHf$;w^VUAqB*MwR* z;GZ3etwzZQlS)t1Nw|DGB`8S0)fFqrj!sA)rF+wj>FptlQ||F8+wUjP1bHDj7YeWG z|87AtPEaPtLhT(KDB0L*PKc<*KmL-2U?{4xii)Iy!ZVdH!yBjdQ((O<2#@hPE_Mc{ z9!~df)J_oRdH(gg@R*w`bh7pSFD-Ei)Q~ifx6kd5Jwv!hL~d(|a}Kv1I+S$RUDO*c z1Zd`d5N+3m;{IV4Nm9Os6Y>8;{Lkd;8QrwF>p^D!+4te`R>$H4`ZBP zi`WC~b3UYFiumu=^sv}L0@xE+?=A8Rsg4;C)OOEaay*tp`g-errL{S_SEc2|r_yp= zM@T%{xeYh!wrO!qh*0CtUA~0n0gsmH3Gn_ydKvx*-Zw|$JC7gZIUS;Y+kf^+$+t$O zX%+gDOhZS748N!+yS!G>d2B)=wyFQQq^v~LZoADe3zsZnw(-yMQ6hU8RUb=@lqgZJ zY51^ADx*h#$lx~&Jzyo{7J+w6rE(<`vt36Oulgj0JUljKCO3qF3ZZ0Y6M@IaC32Ke z56|&s&=rKzb{sXe_PNp^Y}FsLa4Q3-3OufI`0GYDfSDn`-Veic2ubji`OL)o{FdD0#fOZrg4hN0`hec+S=X zUIK6tP-lSlZ{=?eU&!w+E_HW<^sJ6&GvRrqyTtr=kd$Fri_i|Yz0h6~mLl^WV!^^X zR_~KPCdQBgwn2>*_m_eXz6J~)_m5Nv8Ab%$i8MzKzNqEu zOmJ!+|E;-yc$D4LZB9m^GNaa2X}v79xubhpN*a&yk7OzFYJFHgv2RrLLVw8Ucg+AU zaHk4(S1(A8@a-oDV0zMwO@ItnL0ew$8OU2_)ZnS5yIG>VnlI-lHII>~rcDy!a=?^V zrV>&e6{*Uqh;|ZjKDI5ku2F=`XIh9mwb$Yoz+C6*Uzd&;&V0O)@4x%O|f>>4A-9Zh#^QE z8!-N)O(nb72LZ?8@&9uy6y>!R@x7OJkvH-h%X|!&Pw<{$FrhfLgt*woo5?PM zgOG_dR9x}ih~mi&TZrK?+1Gk-crqR&2TKsy+ICCJMQ;g5#QM@CD(dOk1|+21uGl4I zDDbvyr?C8i;6Lq(BaN@lh;8)G23vNwUOt=KkZdBaH_^A#S;8G!Ajz!-B8-y)?W`tg zfi;5e#`W6&-Mx^Nms=Ih)?G;#*iR%X4cC9}QD&Nc%gC$}dSmovY2dOi)zWxi_PUzjjs-Zq*+`n&QCPU^{eaD5eH&AB1E+JIv(f(V zPKWMseUEc@{|+eTniw^SceYwGPxAa=pEL^o{6(NG26PlD0wz-E_EUMtxWk)q2c(W$jL5g8U;S?2KfMJs>FBD_Vf>fI zrYZqOZNpQClNP=)^J{pcR0DX8-~=|1kQs#+)fT+j_3`V_r&Ddcz%VNP(-e^YDtph~ z>*g7-EBMFYim}y&Zi{v8gmRZCovC!HICSRLv4+oDAY_*7P=brMD#CWgHHifL;%yoG zM)2QyZWuTn>94bqWxEGHk;iK35xez$NOn^bbEM`1Ty&Lp)}uwk%FNSe8v-J{?$_oU zlH;~ELG=QJze9oK4)7@*3zq%3zoh4=3+yrVqGk(4Tvbt#OwaSnn5D>5o?WJ`p)7GV zPOI<=H2CV_!P()k;|;h2DCsUEtAO#bz_i{Y@w|1kNc3RTVid76RekFAIJ6mX7qC^M z66+e2;o?5Mo}GXqVJm%XHY=kt8CjXA)~87%!iqfS>o(^{)f+5AS?8msdjHNA3bMkT zomH;HzmmQUFL`Dg>)snQys{1zeU3>!pIgI&z2F2<_F)Gt8(?~zM>gMkbt@Y#KU(`V zwE5{@0u)R^1`t|>lQJUu3!$SA2tDf=*+RDg;*(07Iqn@!By=MBSLvSic><Kus@KR*jL{>N&30V9Xz#;keoM>A+$Fc` zK_e3Yxl;;SG&so?Vm15MACLCD?`B**#g`+O3b>9BKd%%ktZWejcsjLkDE&9P9?Sup z@U5WKej?ejv$*FhGS^iU$4PqTQffHZX-7@^D0M>ec3d{{U_O?F%cVCa=6k1j3mV@a zM_l@F#A7{u-M^9oM|04OIXXI!J8 zGXO^ytdbn`WyGpRi3S9UZ)xI~L%p|X_w$Z$!Di_0h9Q@61L1&__0 zh)TeCEd+1xMY$r2IF)#|LgphG6>>EEKGw0&d2qgIc9DOQ5&p(C%kjsbDqcSjog&r{ z;KK~B#@1&4bi}`_o?wPFYRuip=!VfCqc_C+7 zbQsyOAu@44Wq2%6*kmjb$Q{yDVY;@B*L$n3!7x4Eswf^FJ^jTa);2`03B8l2v7_#@ zEiGX-Mti+CD-1Oh7YAO|1p0+!9n$3B7oalMji7%){J*`@k;?Gia8~Nu6f4kaq1axL zOLi?ZzQ0S$ud@t8lQNTy4(2Ko;Zv>~LXzzFdi#lvhHKk;>MvLOk3hmu4={DRtv^yo zADp6~t8Y@0WX>4Z3G0wm^&IjGCQdCvNKGtT-K95enp;&D! zEkFEmcCrS9h2DXM4Mf(epSyT>Zjg)y#zd{>sTkd+rUM-oxV=OdULUWsP6>Hk%V)izdnL@OY6K#!k+R9`eY663oeNcFZyOF;pxi1~5P;%w+scVAuC%>I zTWLcD#YB={y{n*WS>QDNL#Ka(nC~XS&$JZMwfhU1Q~V@`hfL!f%|-I(Gt8tKF9(jo zU+L+Z>T5LtR?APJRg6)+bT(GwwN@W~KeLJl(yvxeum2a@pdaxbF_gBbutR$r-%eUm zGA?De_Y<_Pnp`Mr&`od!tmpX1M>S%aZDlEfg4oQa<>5p{FFUa%3*$s~wY7GT=0w34NOw9D`ZLHwa z;&IibvTsu3#?R@Y6iTgC#vTOE?3y`>rQJ}<72-L$4sH%hgPdB3_Sol&)IbgQchDJY zpU7Q_g?v5ltDN0=$c$8;s)~xn+F>=kwk5~hgg-hzHJxg4`N#cGA##T3i{qYoW@Goy zfW2lm`tf9I9^zr?Q0>Yq8^Wkw{uRYy3x_sUU^_ocq{wXO@9pU))vrn|TF$yYzN6Nf z#Cy3dcUyUBuQb#amXmEykWZ$*mj>QZ#NK9Jg7BIzmqQd46^AofMwrI0Hqt>sLDu(aHbcI(Lq95BvTEvTP)wBF z4!&Y1<5QFC#wR-oMm0X#-&5V}GI=AO_VM`5K?K*tL>- z<*9@PbEtP-3@#d(EL3ZIsPytr-&y>E1XsA$e&@wFZj=H~?Xdh$9X%H5vNo~rOaMpG49ksoGUAUK$ zszXx{1zo(4UR}yc2}u;9lKt2*^LY%4{IcX=favj7eH7f{4Lgwq6&N z5Z!vIE#P=eO|Rx>0g-(dsr}_rVBJr39qZ5PPw@C^oeG+39m0^0SGzhO;@y!N9<-_q z3=5=hZExjHHLBo~wyzf7JK*PDG`sh2i_UxB?Kt)~XhUaucCAYg(C#-YgF@KAt8;n$ z3w)R0qNK?1tR0S|La}(@_ssOJxA}{`O8V=5QbYSjz+l(S+J{)pHP+18b%qntP3XAj zG#%7c5L$?)cLNqzf+Frsr^%URd)==)L_J8(#ie1|mqbZJvv=YP&ThBB zeHlD#-5H8&1nJxb$wh{X3;eCo;lyF`ahbmzXw`_omP|lzb-!5>lH^h-{CjR__9}ENUM|8`qid53+!SA7PpttZZg;o-t9mRW;8gz{jU^e0*$(r!6cd z9Y+zB`(hX&DOTtAK@K0POBJy56Xja2`3au;BD$y4#cVdn-FOa(qP}{)Rm&eeawP`ELi-#AitgTHSf&+?sXRm+{%v5b~%`5 z;M!xKs?E%7D-==D(b?nhR#c1vf-K=imxKMfls`GdKj4msc{n=W)o~y2>Rhny?+ciVdczI`;_gRrDXnH8q-y$!}hyjqT8pBlqZl>M@>#IR!j}c{l?mlI7 zi;~=foOjUF>eB^Nj`?7*33N_%xjsU}z43;=%HuZ;27SCm3t7V9@uUS)B~IW}`;@2X zcurEWPdW2-nw&KZuo%2vPEyGvki=`-OD-;B_qhaQD1^wB6LRP_Iu`Jr4hoZAxQ?l) zY4{jFZiou_8*2rau@BFwH7JpNc(jbg^J9lV&?9L3CWplj>|3!h4x=KBfdqg{^DwGAt!R=zsg>uwMOU@F~aMm7#Ny)-8(oo;?7O=a=AktTWb=1)o zEZdl?sA~5lMrqmP=i-t)wy(tF`yQp!lvCJ9Wt`qTOE1aJ(PtYX2FTWFBvAPp<2?O726Unl2q{Vpv?H1%yLm&DGJ5hODTwZ*e6U7Wz4ADY6;j zZ<{;bMfF9^B%vcqsh#DV`)Jp}Zj+z>SBCqKseJ2SfI~7Ob)hU~{RC4GkGg?svw<{b z{jV@Ul?odoUt3>4S!V;NN@RtR(N6AT_%Kfp2=hT10v~@UG9B&v5Ne3d+$kT~()WaWV)joad1l*s~JMFl_vSw4Q* zP%;?N1vMHtE3xfCwjInjK&P^0HJYqouJr&dFxLH(KI!y)YIv8-N8?hiZPq4MF$>W9 zerjs1LbF~MbH8$WupG}GYZ3e&8prHnlhThcj(O@Vz@Bb{*$y*}Y-VcvP+B+VSWn~i zWgWNqiCq_AHEJwk*>dmvJb_FhDDK*c9ikL?UX#p1S=1_FJ6SG7OG`_^#-@UZPDH@Y zP>7YRTBghJkTY|cb1fNs|Hy{>wPK{9(PyJ&Z)IrXNBGcu8Ih5SN-Pj$3jYYjC3g>u z90zmn$IvJh3(#-6D&@)5oExceN-;|w;P?ESb5L4o+J{F&Gi2PP<+yO2^n`$u$@u;q>X}zoS;?K<59g7Ui3>evXRCNu zRI@hwzj1&Wdfm4o1@L7$3k|#D&O*T{dt{Pe6!Jiq-{VobZ}-= zB6iK1if)U0YNiAhc;b;59ZHkyS1B2kjRP`HHH5`{2%S@GQ#6uW<0eqmW|F%$Lp>Au z!Ogb(*sp#e(`lnW)gJIXP=J+I9TM3F5{h$+decz~H znSaQWKQaf^{0|rS{*v)4noIQj`b#chcK1g{5H0We+=ijEPEQs@vi5{C;a9-_m?2|9fR$v` z8M^TG6*->@b5ma6JazAI@J|aG1{SR0N1D1eaTLk;6Lro2_d|dEldkMTbM5q$QrXs+ zWt+#@HYH%i6IHsq8t!Ht2CyKxO>}jj)*I$sw!S{TvhPoMWS;V!4zAnG7u1fBVGQt| z$aGoW%q$C@ZHPhcT3M>4RUvdU7H2y#AANaSwBOdd>F~Ska_!k~M#tUEa8p6md(rQh zz48kzVuqBQM^%4z~06(f1phSd%kE9QfGCXQR=(Bt$-KxP+w}tKsc)*w(>3B_H@XyPO)_VvWpY=4W zMyoeu;rPeh;NhY_`t=(HJk}8@g)dUna%sF8r-6@~%sUD__8amPjGD?m7QOL`9wRSKU8rUu(<=h}9z?*v?`vTpzmCv?u)DEK{AkQ(%lx)_fGK_5 z75|ErM&edfTHLnwDD4P**g4a-Q@?v()t&Y;b4uddmXZlio|&({k4n--Q+gVgPdkZy zcAIJ&Yr^$VIl(n~>fq~z@Kkhg*~w5Q?$BN640fmU`Y}iLu#QKz#cA6ty^x zpk+CjZdcZ8z*mSIqV;3I=gwil-J=bcwKAS79jG)|d9jS^^{2}EY>f#gV2}ACkvG`=em|TlAUXgrJ@N7Hi^T-3`*%PXBn4c;x*uc-{HHQF5#H1DHLi-d5GN z&T+u<@&(g!2?60r-|77NGkM4Es*8eUE~_MoHz#-D2a}JYf7c6)M{w59Scil807Bwi zXR!p!C!A-Wa|bU)qAQMG!%&6U{v56O-J}MMWErOWPDx#Huu#AC={1Rt8AqzX(g)09 z%lEq`{eqw8Nz~~`xU{^zTb$-TtG*sa^-Nvif=-Qadjnoir9r}9F_N`uS%Jc9>lZ^a zSS_gH6c)2Py*HuIiUh{Wq&TVJPg+M~h)pQFztb`?F-^!&2)=JqO&|xaijICBvMhs` z>V$ZnPnq=qf%-lUeE7%f6o>u_T0+q(S+m`u33(*l*4g2eQOm(Ivv_sz5dkar7E}!) zkhML~vfkmC=u=%9={+|B(wztCG146xF>nl}UC0hnj}FwF4-A}F-OiW)U}ovJ-ZgP1 z_Ij#a1|TYZoZCSLkEYRW(SX@#L``wWPHScoD$TUB5z5`eW!x+4@)v`+hoKCC`l-%r zZPq$$$TeK8Cwuu4n2q7e7FviB-v+2^)eDAuJ?;M~ab6kymS5u(KmKD_^%f`r6^HRj zq0|f6L5cfER~;a4QgK437`D>8&ePM8w_2?k(@-b=o!4M$(V|!89zZ6ymJ_dg>}02E zcg(#5ZC>L|`)ZE10hSQg(l?<(Q#KzXZemmAle|p< zwuA50a@dAi(v-A$sTrkSvMV4algQiws?PagmgbhbKq!A20n@)NC;ahAMR?B@g3^JF z{fI1whQVtzuG`Z*0W4Wj9w>Z^sryFM)<~X9uw&6ki23g^=kHLJMjeflY)g(7v4Etb zUZ#fV3e>joz9~N5!7Fqo*8RRsNz;g5ypJm^z&$y^`^Gvwfp(uo z;JM__$&qxL-{=3N^$^q2tT(%z6ywwK7@TR+Lc+zq^DJp9C;%nKJ7`PD3!r{PxAG&b ziWbFO^iheX@j~`h`S+*MK#fR4cnj@QJV?*xY{b&-v`qtoe3UDjT)fk`3p4Z{_EGWC z?k$hM*f}%W9Ra|+DQaq3sE`fIN9*qHHk((^Pr3v2UX{)0&Dn%r&qp-;Vhc%khNN2g zmF=qtBEIRyib_?}L5H#23Cyh;efMV8hjshLp;mhjQrB}o#|qQD;|{?8_7r!kW^p>4 z{~A1Wum@^B^jo-CemBDtPYlF+EpOoa*L3VO%btPg>8-|uC(^rtxUyN5uqq2NWFuq9 z7!42C744972Ft6nD_Sc~5(2VV)hY540OtjZVFDOR_OkNr+(Hvdl#jVehwKyjiN$Fo z-(nsJWi>c#`~=)MsE0#&Eg3j#G5+f=&rhbB04z&UpHOa9-e0BPBPY*~+FEGNiM4i{ zhp+3VOXx5?4nVW2?Q;nMfixgteN2IQMjrMFkufkjcPI~b;9hXmCWRjTQgk92&Au90BTVz|EZoDVMfiD@#J zFL<4ej4fij65&ztoQ*2^^CVIBw>0{A-NH#rSR#Yb(6@-O+G>FEuOk2LsnWuBfl{8P z&*mY6{+~@XzXMMcuGG(^z2*@6S)C+8fCV12rV-J+z+T|?&}LUT<#sqCYJ;3l3C-ruXbmeAhcIg zvSt3mhf%uexw3TpTQ#QtMAqiSBq5LgccCc_+^D!hAKsAW0OF!1T)I&mZ!%&YBFz^dH!H*~B+izp{&(6A zQzr3O!MfGs^@OkG#NoqAn~#5Hr1S7B&km>`KShcwK95>Ei_FvL#4oycbQR44toXQEMIK+| zgR>1#n083_g%0cC9Wazu98x8oU+a2g_z=U|s^p(o$cd8Qie+|Aw)*%i zO!gz2oe}BG&t@oSXe5H!D4_eqnh2XQN^*AlQg;A{tDY0?^kv!{A!B#fs+FG`^HOuO z@<%uwlX9*P>tICkRXFqeVtwYdGOKF$ORmVMpzXLsw111i-MBp0|^^o5uwj%{7J#zfFWoDXHreTv<0lRD0DN#{|2tfeHUEJZWGm>oEVy;3z zZ0Rf~aO=23H4M1vB$B->9I~DByj16;1F9eW-u+t)TD9sNSmV}bh9-n+=`~!BgxteM zC10hk;=CNTHXTUYYr+O8Uv@WuJf^uyRV9XZ;^30!sXbeeHoKl^XkR6Hja(Ei(Ag-_o-8;=tF80(9kkE#WB6*`V=n!1$WAO zYimoj-n9&J9tC6_G7k|(8H)S3AByG~6VnTV(F#-sbs+d}zCE9@wr_V&J1PnQnD z!=+B>GiBD{vYhL)esAY}l2K+ITToqkgl#@}b(S4G-H)4y1&JP6OI+$}l1x(Nud!vs zsE(k*-kb;(M(3*z(k-casD%8pbWQ3bWSOe;geV7K2abWdxCr0|u$wChXI`0-itsVOU~`(ig85B@WR)gw-|Q{^AN`tgRpQTIN}_3#^#Nk=diH@<>s z){i!3?vL|RD{Ju(;`iI2dKS~(L#T-=bW*l85=_!%^W_a)A2J@BQ)pzkIk8&38Dypl z^DVDI$v8;nOCkIgp_pUC9IK?qsDk)ZRm;ZLi8n=J=I^@PHZb(eSibnk*Po4Rd4;rv z?d<4N5xK2C)2IeV)@)v`M8u;q)_-ki?A`)u#Fo%jfDvqI`J&6RAVu{%cmGErAQLmc zEb0SSUP#RS=^le z9HB3^&To@`GWV^0iZ|uz&KLX9mX^*RG(K*@e|2@GnjkLB=ROyqTb8Zzem7X)oU>8e zmbt_WPFQ$aJibi3LGkp>9?&^IwBwK>TShvZ5$ScZlnW=soknOiY)4kYJ33m=9jCjH zH$iVs4mN&$i2hLLv49ipSoaVtsk2CNkVkt=$?-upwMSTX=i)sfkF<<__x*t*GBV>< z;sm+Xke|GfXd}I@znD8;9kvNI{V30y09#GZH*{F$pJd8#ChmA#_G3mzmAkvUBLV(F zE8>vcv5zg?`?>(kp20Bfi$p{Xgddh6UuL{yyxw|3_v$jae19Zivkcw02(x*CwxIbH zxd&_|aj}VsQ|fijS{x>G0MBJO;KM^c?6CG4NRMnT%vG|M(dIQ6K*n->Q9x^emvow! zP}axWZFP6gyj8SFw+@6#*9+&?CGotCp3`qDw{fB@BPrzy9v?$bwSjc%1sb^c%nP7= zR)LnGa=D@k{qVTY(ADU-#opJbs{pnsfYgNl=`Gyx*GK4Gg(^jD=SNO934_*}JmBos z%WXTbCG8>R%Qj>z%^=nnt4}!DY8E6qt@Kf@UV!t)qFGsUe96s5h@a-lB$8>0N^0c? zt2FYCx@vAo4NxkhR*w|w<0YZq7zIE|5O+=k@fg16msD6tHtH6!ZgEiE3J3C^$}#ww zyY1m@vyH6%a%jK1+kfH&XhYBz@TM+}C}YF_csDp`+wRU%_k&mJCQgjC%E;PpRQ2kf zk0%pN*ilOEOk#la&P5Ath{07MT!Xcp_qo4XfaY@AWpRViw9psTiYLF{VOb&r;wQ#l zfM{9$^T8uPx*F{c0Xl=eqoZTIhSPoSEd>J;xY}xpc?WSQ%(`r5b8aIUlXZ9}L5_0? z{-OCUI#7HtUy|%szoj*;ysiSJNt6F~#Ot$GGhJs9C?hQmi|^QUMvHj?O)j&d*x>QF zI!1(0mV~fa?Eyf@gH}2@1U~6UjHslYZ6rN#aVYY29k0zyOuB&+d+7*q*4izq3cUi9 zG!VkC4K&T4^s?~ud=YabK)1fqTz^r*fsAc?(S$^34YWaUdEHwTGDb_ws${v};?Aty zazXtoHm(9nQYLnG*trjG5~pB>lc^LB*c-7--#^udIvu3R6&Ui@+;SR?O zwC7u(AmhBF$w;c-?<6C&*K9Wo(g`z+;p>1nBDUq}zJusyB1uemG+%*ZrbfsU z`Ldqi4Ds{^h=nsC(yUh@;Gegm2y?f&_{M4=kp%6JL@Ar zD^4k!s)L`HZS&E`O*XZ2yXUO-%@{Hd9e}Co`r-ybqshrLNVVsEfepKue!)1E)n89 zQ}L-B@%_YP)h>`7N3I40?zPi^dc1s5lD2a`vn=m% z#n9H9HPCJCh+@E7{;TW-W)D-K#K3GZO5NSp7YigaKXA&)z{aRYfA=M%YVEIQLuDN` zXVII8!^swwCgf;@qLbB0k*aJKVYy?W)rAV}vIkY{ZM==*%>i{r`(V5DL&F&SA;RBH zhM{am7LWs2M-VP5D4{*c$;<26ovJE9#Z*#KS_886h)-I!QhYvlo_auyYEJERebku_ z1iA>DNy!)j0y7$S(rR{ySibE-%lV)|dI9)F+(#@RRupVPR#sM(HrH^Qyv@mVj1E0j zR_gt#)g{=<5t~FSp`yZO;9oi?v!IR1YEgv!R*3wKSR^Dw*Yikps=>j`I5l|+xXasq zf%_X%o4GUghkEODq0VtK+kqCS{p=BXq>@9R`Uu|kP?_cQug>%$f%4q5^acYzv3_gM zR4t~X-P(iI%z5ZkM_dv?L4D&JX3QqGDNxkYuz)abTI1|afFX%eD?_{HEIJh7X+{h( z?M)!X#hthRcukCr6{cJJ^1BLJWf*x$l<@_+r>doyAl*AJr4xT7^tc(Dralk@E+-IF z@~yQ%_feA#b<6dAd4WW)MJLsLyMWoa3qud4tB$N!1fY#J?I!mi7xU3Lx~|{SYSNr| zZy$X^4BbW1(#+YaYrQQwhD7w6;@M~9e9ERdSwEczc}UU zQb7gD#4BB;navF60JPir7n0I%rDKbGPbC_~=3eRgiG2tq^RO(|tdTl(Up)tF(pa=V zhGePi)~Tc7ZP7V*7rK~e=>&xKZPJVc679IiLQ2ygYUT>y{ql97SB}w5KxR+^DmHw& zlXF`$G9~ctib4tK$1e6(70p`8tyHMDW><|*T+w1^-G^+L!uH!G^AOTnjYg7^^F_!# zW2L31ulDA$V6>{9F_#zb8FN-1;aGpDmbnL_SkE=N#M6~E568Eo@|KDy9UlUqKZ3$} zJ`~D?kO+;P#*R{!aBg#4u1~jG-b*aHaue6f*1rp3!5CBi^pG8^notr7B(+QnD1#}7 z<>gsBUv4G1%Y2yzdc#(8lWmRz+)u;F9*UOWpcQ#py(TqXH&LJ!*s??w2Q9!nbKEAf z1>4!DMB52yRhp_&H7Q>A{{DoQn6HIKDfiPn17$hFbbxywT%Ez+yAEd9iHVC(J4pA* zZ$xWzwp8?q<|7Emrn4PA{B{`~MMpWb^Y*WZy0@`J8zswx@SodMi^VlPZ)Z8>JtFY5 zBu`Zj_&s4eA{m?p5M;Um^bD5oHlt5uSGkKLCf@P!sqn5 z5~yuotveY4b%ya8_wzHc$j}{LH9s-$lwKeyZB#XS?#Ygp+^k6d+0h-HTDz9?PC(k zs+hZ&O||ln4bZMOtQ~bb_dFjQ&QQoM+diTK8`qKJ!-)e??4D@lL&w0(Utb-`OO}#R zJI7ton$X1TFCY36NJNXry4^LtB$Opi!ACyVF;buXVC=&X$Z(3WB{oGp27)&2$K;U9+2@srSH)?h%>Xe*)5{GqW*qssJ( z9Rd`3O@I#R7Pk#}A@V%Lk$>g!f4mZ;Lml0HKC!&DJk2SdUCP|}?My7sy|qXu(ppt% zD+(Z(BAuR&(D{^WHRgyqZzyjWAP!lcHBbBqz3ngQWImUSU{oIot^*h}gnRKqF%dPB(vYR}iW37nIeJb%6u4O=gCXaeGF6UD0to7#vc4`IHq;P2u*^2q`7QIg8#_)7Er zJxb~PkUdaVJr5a?sbTY*_A;_(4^x4kM;(|a^ttO2ucM063f#`);^22aUmpwqsfCiA z-ySdBbuyNZbSq9GVy5cKZylWwWUKUvKKDv7dy(;uH>HtI@WELo=g(?TiBXuXqx+tj zmE>qxP~WsLF1&I{#m*sPX0;_0)lZPdO}ATJTr=%R1nle={L;V z_Z{6W(dULTOU>kSZ8&D?jz>v19>902dW2qKp1KKE0I^sPV0g#P+U|%)C)EL%VdLN_ zF~(Cv(If{XfONkDofyeOs`bCQ*;W*hgYPermj(g#oQ8#X&4(g(r!U83>8WuepSt9Y zKCfwpNg$5ChGNuod&?^cm)4G&>~${&2Csf{^5!-dH*XN zG!{2iXa4H8p?Vcrg0TDb8C!QXN*;^dMuYaH+?;JGw&6xMtM<<+-r-O7HXr;OJgHEd} zKV$(odJ9hBnV!>(Xh{M}hDpv|)jik3t%zx~kx+di z;YO7{NGL^S`|?aq-&79Qz65z7C(dtfwotC)>rL!KkB0#*yY}CINPsf?E5ZRVo@KyF zF6+0fT*q}_<-T)%)@sVoBa|NS9{u3OhSnQ{hQ^kQn#In`%Ej2v+6ivVDl`JY#aP0n zO#daO6cDs!#`42c^K|kEI3DP&5t^8oXu+j3m`(ZtF74PmClcm3kda|_YWNz#QX&)N z#8ygmzQ|kmr^RYSwq7tXJb>H8@|V@KSC|h3S;t<#ap`=${Iu)W%a7Kk8-Bt_>eSja z&A57mUay*eeKWvzD+9VbU;^R=7Q1Yj2Llz zsolR%eeY0l6?1;YHuW)jf>kBkJ%)pG{gq>n@XaJ$ZSuo(+#jr4^9Rfq&LcpHHKg9( z=}z|b)O_OCZxj1ZbgNN+xYT6ywsf#Amkn}{0)c%TK%fQf!Q@RVp2c8gxmL}iW?dJ zHeBrdYp@J$UYGu#sJ z+bn)%8_mF3@2Vy(l*|Poc`lJtxa+kxzPaFp1bT+vzRf0eVx*WWy0#XgZ^y^JLWJKf z6>n3iWEMMhh6y5iMCj}pPoQ;ZD=@@*81_35#6QWx`Wz*H`nC%g9(KSAtPL0p!VG3xPS}lmdN&BrfY}=*DvmqDk`{Yu z^W#^9=Br6{E0qtE-UHCxhdYbO&vuWMmWI~YP0A6chsT;|n8BKD&R0KreElH09f0=v z0uL~zIUBf4cbcRWdR#F{$PzQ9oDB9~eBE**zU(vHJxvx6*LQEPI-b7h@q+s!16C10 z!;?BsIZb#BQoCOeFuAHLM@U2zGQJraw=xH0S6p0N#J>AH5_I?B`mALLv1zUg$f1^a z;h0#;PITyBcygt-zU0hS?%lw<*NAo;Etr<*kk=r~bJsuN?nqnEp^* z`7QM1F+TW9SAym@vyJ^;w)nJ`YPjc!po2?-|8l-nR88usl!WOHNEQ z8OJZz8V4vX0jgc5=}E@egBYu{T*=#GF3NHNTd~c}%@q_v(92h^O0ULk5AT)EY~6Pz zzuDsc2#`rdT`_Q7hi&{Ed=i{hSfOX+(CGA~AXm@`$n2Gt;+e4kj7pgnwEF-X2(MOn zO#0;0sfGf#8J8pX8g+b4WacA94;so?;rsB}4ZyLzPZ7B20y=O&Y@?;PM~Z|h-MUFT zo0dB|#g7O2j?yJCrM1MTM!2Xfbv(fT{>juO7md}Oqt;s z2{_9yn4ZKw(j=XrZCbfF>^0wR+L7nSQCM19YrG@JAhtPgeW(SxVn;kvy(^+#9y9EsGK<>! z5REpEOBK!x&wJ_k#cq!MPl@Y%g+S`4bh0h;&qzMBjBmi?^L4@6G&@KCav6`Volo}% z)I3-B0c6(BvGX+*PmKi38oYB2-w#N9NHs3Q=@dEFH+MQl%M9ss_9+Meb1*2U!Y*g}>IKUk5$fudyFV}VvOD2X)6d%xGJv*j9V2a6rhX1_SO8q#QyuiM4SuGv?4;a+mr(LgrA z6Lwo89$te7DP5qeoM*+isr2qM%Xp)sx@Np8O8jx~{arL@bIjaxr_uG!^|MbuYa7&< z6{-_QO@@VU1azFGP?ZZ>)aPdNGdsWeMEm|p@!t8qn-~+x=?CGwT&DIJe)Ts?Uq?f! z!f*Gx=tq0l@Q7=P{R4kBs=9v88?ZtePsuV12E|@{W~U|P>Bl#lhp#@>3v z?lclDTy;Fsqj7~B{PfMnd`FLP$i}OJXoYY-zZpofXBq%Q?`c41V$;THW>5frbgejc z-lFhG0&H(9-+M@%r;84>dzCl`Mb?^Wk}V;lh9O7JTW$c2atAnXYr^0u4Ksh$qZ)5h zBdh?fw&>?1m#Z4#lD?-6CwOn12P$$9vQzZU2ff2OGTH|KBl3+8^3a1C>oJa|a5Gk* z0b|=u8Pz{Oa#rknPAJ#eYXBZmsb#y$1n23zK)C_O8pZ8>Js|f)C2{u4l+UlxRC||63a}##q32etdGDVH}gJ z%vUEV=bN%pH7UznXmZbTEk1*Voorr%Xlq8y#K*s7Yklfm=&*AY|9nB^Vm+HfEuZq=#g(Rgtl^NaRY7XbJ`!lZnbIwxyg z+g#3xoYEX#cnRd*t>_sT>;Wve2y|~ZmO@}A0Q-7lLHa^_UTdu@x{J;*k3A`a?7S+* zLelzEjnTdAlON|RW)>S%quRD(02pBH@L%PDKp=tes07|Hm7BY_T^X;O<#s-GPwBS5 zzrVG5xO!Sy4uAi&fRqt6?a`+TuR2JL`4m1+-y};R1$;;1cFg5J0&|Z0=AV_ z8k+PTSj~$b+hP^D* zbJBP6s5v#QM2wn<(hQLvb*=7IJ~8fVhwWk3nJ?$AIxVzX|LTAMto>HNz|5jy-nmdU zl>nE!ieV?8(O@nVD`poJ@%aPT?NV2-qq?cFdRb}@@pB>MQp07EF$bQ}MHC zzq#@L6#E@X5kyl}E0CA;ZX?CyG`942Gw<}@0eKGGh@D|xQq4hk+vcUl&8!UB*8G8sW3h@1J1++?HH^)A0{%0)I@t z{Ja{KoOj_?7IPq>va_CPbd${LzpqGnio^&mece^iNtUdM7o^eGD}kkp&kXs<4rP0C zkg<;Kmj02NQCucv1dCG~LmF3@Q0{i@w@zKr*PUSzlOi^2MP zb450MOwYd3*<@bRocCQ#C)f_EI{nhf!bUA2al|Lqv6)%1vP_ykPz?P40~8drPS(3>4=ihY2|_hKQpbFd zpa^)p_Fp|UlkHNc`SKL~?ea4wsZGh|`b}hLJsKNtn-}p$^_{2scV!jmMr89n*>IE? zML%r3n)>h#DFZr~<5tNp60fX`WA~+;auN^j^i>C-c}OJa#{>TJ!~Gv`Hp!H_)c}Z% ziP|2rDi#1gnp0)2faXfe$U}sU2GWN=iU0LoV0k<)6h1 zGS{)QZ?CO4{vQ2U&l(zNQ0lf-LUUQLl1jC4q>0V*M<-Vu?Jcc#M?zgw#|%JcQ6JbP zW%KVe67T@enE)93H#1UfJzVe%RHN46bwpIRlHWw5h~6~e?f8TygVy5$l)Q~}Zi*F0 zZ+7MC-M!Fn@(+sC)dzv+k$W8_DsPv02f389$XD7O8$z>;DMUM8Fzs+J@ar{4sZApgcT9 zef?|P6-qPP+D<9fVJRX-)eo5)&4jm^>jXb{94YVPX}6J)B8eWRJ$M3e!=0aen)_=P z9zFq@?xXKI!cKl{d3^jiJw1KSkb$sdIYlkW`23De06@@@BER)H>!k`aeL&ljr>l7| z-^+2Mx||d@E^z_MxUr9?|1* z^e6Vflm___&F$VC;zg9Aeva-ktqQnQTzP9TIP`iEyiqqWp9;Zo*nduBqECmFrlfT?cD#kxN*Rf zNrc&(P@nrwBOo+)4TUoinoGJ!N^l5eXl_Oy)fdX&-NbvWU``Os?xJk!?Ka+mk4|>tdm;{Si zdJ5n|6b7@u_0i}z@GIZ%e5l>Ct){d8_`H6S>CF*Ys?&@O@mj6R-uU{Vdp9*iSpVc1 zU{9VCb756g`Bgc}5(fxaY9rWff%GQl0pnR0i_Ca;9V7PxyW2{`wMB6>$8ZIuiLbQ9 zv(4&4zQ2WeIyH9grMG2niwVqBTO}_~FK-1&%{+-|cRYK;r$zyIq)_(W|K*T=qq=$Z z%Ot6=UVcAY4WdAk&FtgN-`5tWSR?>Z-{3ZAysq5C^d+fApaZwxn4-hc$045Oqv7er zCTGd%8Mz}Myk&C4{Kg?L*hyspfL-A}pY$(JcVOwD^FRF!EAU8b(=Da@LE3-+1Bd#fdl$)-s^c7?3dI=sxD_5THr)yfFR^`O^zQcIhvxsOd{2Sd#;MQ%0P@ydsDC0r2<9>FCSE<2*5i_rqac3;0K(P zKbdaIHl)20|D}%p`bnXO`qV|u5BYx2@0D#tXYaf{yHwdGW8Toi^(l>^S@i7w(w3j5 z8JyQIM{rJdTY}EuN2iN(_$RqFo$B4Jh-0#U>`wWO%AE($MmRSnrk_$4>ICo%-r-k) z0#cvl3hXz=to)+t;fwVrXF&{{1=q5G&2f~m&22{Oxn>%rsy^lQwF^@;12C)W=XT!Btjz`cv*`l!d)fr#bN3}_6 z)vACDwaLoPeDYaf{Wd}7ET-E({9HILU|$e969@1xz_Hdo4cxuS=U0Fq6pR70HS!uP z7k#Mw|A$1y&(%AXDVTb=#}2pOSQVV5H{aLJ)KL^^xz(o{*- zUb-Z3TrZ;U%;B~UCou5zIBehSuaTX!fO}&rUGnpyv;cayY@gZt5O30-{eJ~K^>pnw zvj=tcr>qz!zFiXgJfK&3E<(LKV8m_{_})~q^CxqmC%O$M*4QdV6@<#uh6!USohSN zpoo}(?6X}fS#r9)ieIfYo!eoyv>L5eT4n-n%Gg3E1mv8;ZT{=D2ZD~oba0r%-71eS zPgFbNPu$l$uuGvj{J<#_Uo+-336jUyuf!#W2fQMeT)Y!M zG_`T{GvlGJo-@m;uQ$P9Fr1Q-#y}UZlHYyafBZvDg96YJe4dd}9Uw&jBAA+;z0XGu z{-!`axE)ZR?f)&*IQdZjNKE}cCD6wW68~VE!v4addHjEfYJcr}XgxzgK|$>1rnfr4 zwF{6g6)}IBk$KGUvtYA)hRUq3;2<1yb>-sVP#PL;P}g&OWO?iOfw0ydNDln^{9)<- ztM)j2MvadxM*%|(bc)5t$KU=^F#4M5mpd40edO#VLt|r20Q<%$@-9`c;&;uTXHO5D zy=FN#I_%Iuhh^u_vwkd40GPQFlae$nEiEH6ujT)$f-9ge4#esi86|OYbNlXvFP{7f z8BRSAJX5#BR6&0p@z3)O{7%Kl$Y^AEj7pXDElU39K;H}%j;fex-vCH|t!Qp}0-JQz z}Fm zCscgLZ#aIMK3?V*xnBkBXRj zbNdg!`!7baF8w{$sb);9mX+(j+xCA>cf&&A-QWWjga7*6ehp9}4lI8xH4mQsA0PNX zXa2R`h|_9f%pSI<{)=b+!vLYRD!}s1hDUr8|C>AauMt`w9C@MA=B{<^@9kd2*hw`p zGuPC~X!`&1+W%t-mxQhkI@L$<{>|MRV+NM*s%|Mp;{cXl z>g*z;@vklYZ-)AR!vBA*@V9!OuiqnK(~uOLXP;o*bk*fzKcNeRNsH6uJUllURYD(?q-$Qt`*$8M>15(yB>eOJR}R@x5@wp)0abqZb{0>!gWf@NA^qtXA3u>V6vn4CTa)VM&9Km^d<$JFO^dlHn*Z0S2;Z|M#PPM@Z5bk|7f z-QaG38Oz^TxPo;*71y8>P^p698%wPBsD%()Lmu|@QA?yA^soPj8J>-?+3gq4M3A% z6VyLs%DoP26&1E~saIK7MWgu05v58h9VbgKdIfI{tgZsCVzS|GJmpNBd4D<091rEVgnHlKpzM^CE z(el}0+y5MO5(joV25Vb$l2?5uev>K51nJh zV=B!IfFWyt7bUJD);*^LCT%7Qf3ectE8=3-4q++0_Gi^@egD|r=i_0NT>uS!U|1ax z5})noo2GLC%c`Afx#o{@04B}+93Xt}lQ+-2A7Y->z)v(}B%5t!mHehdU}S0RCBX_{ zm+S-Ylg2&3<6uvOL-Eb%V(I|Pkex*Xd7v|4=Ofo<`X0_xa!wjoQx>g0>yI~|llFq7 zQ@Oz|69;1?kmQ;5#yYqs!?M+8RkFH7QK*V6YNoFoFs&ZZIgaktIJoUZE|fx^+n*Jz za~b7(59f%~X4d`E4Bl_t(N5#^ZaXU}*1)o7If+^Y0Oyqx{>hf@=AjJ^f&gd2?pyU6 zo3~)L1oSLtCRr*%K1B7M9=(42n|HfPSsqBQNiv(J&`fnXg$R`d{n#TmosuQ2=z97B ztwn|10%%wBaUp}gdOKZ*0Qu(qVud-Ed(+i1_VM~ zrLJ>-F)F7yzb7Mib9c6QKogwjLQE$1*8DtagZq8*LULFn<}?D3v@LxhG_4td*pS5@ zum=EFDe<^N^GS3v-Mg6mRMHB*C-dMAyt4tOuAjgD;sItB|&c(gV?F1ZGRD z`<%>_1s;&I4rv$NG=~w5-@fL4xou|ZQ3NMj@G1uzliH8e@fLVfsP*0$ae_hD4e*B> z9m3B_IAs#UE{Xw!7x-3tqoFkVC?kE>$%}thimmJ?7oOGVhJ0giogQ@@$YZch`4}q* zpY|SDU?f_B3O3%-1v}wCQixzLa>E;$dnb?%O)=Asu%${ePO|D0+up#l)Xg?Wht;_Z z=)#9rVjDG{A=NwmEBSurJ^t|@Ge~6%5by3=FL+N|;%sB2@($qojeQG2Ap}>e`Lzk# zcf|0Tb$FjdA3vB-6sI}fq3UqH7Zl&~@pmea?0n=>aek)s{b;CGz~|XON!>@^81^^X z+2xDFi+FA}I0&65)V>E=izbhu^5@u$Ferq&EDKqmT0N%--{twCsV*HB7nUr_-(71vEDh zyzYtA`Rdo1a=m#yHEz-z#~k*Mdcf9i8KOc0)*39|-Svnz(D3+DiGxq+P$<>SbI{&C zL*b^aq0taxA93R%;>V{xIp66@5cy?*<=$)yV64jvD10*2{o0ZTRGjJ=G|vJ6I5pJ2472PJz-ecMTO<-Aw;z6j z?Tz3tWlcD^#Oh|)nl0;Y>RD~c)P8`JdZu|Dv5s3)G2|PgOBGxfCd>oP%Acplq90Tm zlIPvl(hZZPV*}|ib9?=h3%jW2mu1$gG!xhcUT;ui;JvIQ1K=FwYF%$&pHUqWTla zU4n+pEH*f8O;n)I9J;3c?#@iU_I--OgO|PJl6)w6YDUVi{87g?U7xVq{ukMQPRgPn*?xrl4*FwcY`>0BewY+p^PRh_xIeyo+-VjK)cN9l5R5CY8KO? zxj^#1$BrH88?@rLE8OT`va=-+WNHuMTz!u)V2~4{{IZ8$%cQDq>%#?40G2 ze4e@<_rkc;Z1j^t$--a+7qj5Fs0QLM5#K9;*e^ssB-XMIVE3PLmpXz+1@GaT9xsL% z_DiADmlhIqQUl0Wi1n)Ycgf9mm|7m{cE*BmaF2+v|3pvY+tnT{>1H;yz1W*Z0hLx$ z1Y+mW-qhS4Tx!pj4QoWG$p<0)Ti2RU9WJG|G}M?c9aTH3>rI{s&~S~lm%dsue8#*h zuIqkCviJ!QK4nobhPs`;fZWDe-@F&)dHK>4QdBtZk9h9El%D2 zlH?8aGCqun}xB83D7K&2CL4 z!ip4h9kz3msqbqG5#gDD%S-g{uA+2sTG}_P&T*%?4QcCSY=+x+KkRXQ@&;h(t!FW1 z$97q+`!%5Dn(VRrBAXupmfVU-U(AZX6(*idl%aE4m?nY`l-2IsK+Qh-zT6%L^p(ae zW#!A2Hm3(f+R$uf1XKr$SPr@NJ^~%M!#NJhE>m5Ho0Rp))d`ORk_QIw>I^0WS55 z%L$9qOf{6xi?>RNTz=-dU%+cWGJ+e4i1it_I?DFb2g|l90gX8`AxT{`4Wgv(2%N2@ z3z0-o50bw=cwI5OZB2R~%mbU=%|U1eTjrh4(Sg0Tz2%;0>yrRSYJnwOI2(HXz8yp@V&35Y2D8!&q0?9 zbO?<@$o)JyZV{0?DnpYt&sbBNXfK_0xeIMF5rPEstoYAB<(J>nd1US;=0{p0^w5Eb zcsnEeuij z6G@h%(brR|oTus*s(H{$^^3dsepjKU)v7{yzi03{UGR;Pk>JUSmO_gZ<=vLV&1i=vCI;j}IyRLfcV(LE#|+)MtlWfEemR!YZb`ZemC zBKA7k)!nk}rccNMez(Q_1EvBy-&lU>VPB$jWT3lwojaz{J`i}9``ayYTQ}Pj>aFG^ zb^|+!eRo-ACvw^rC3hk^^Vaa*yU&UE5EIrVEVE1AcvzvXyF>zN%!VvNvyR#hDqx5b zVfSbOmwL(9jI%aKTsAtMVL<~L3NUv*DM0-y3Yhet7s@xh{Ub>cbcxzuwc$8DlvYlcMPwSWnF?x-! z8?hN6Zr5~ZwMgdDrK}J<5yBJ18dOkXN&e+$_H5{?*~|GV85ys#4yV(sd5?9kZ)Jz1 zWolAFruGn<*&SD8JSFKSfWR=-7(p7HnM*|Lm#c$~-VNr|#gcyib4G_-Ig9pwBM=PC z+TBah;|euAFj@v(f?Ssm^k>yF8ajY)i+naaNZ^yh0%ZCnOP6YKYgxeW)Vr8S@+Gpm56iPqh{v$BC+^_ zygnzp^_EUB!8ov2wj=0!_)H)T#=qz5Gry_gqYEU65dRM!7KMNh9iUmxf=V#`UE+s} z$odI@JHJWYD^e*eRzJStwe;BHyH`S(kjs666VKY_w&CJoks$!jmn3+vd>?b63CwbS zJJMc6S_81|R|lzU(H&EgNJ6RQcW+$m$D|*`o{Fp{YDDm!4-88+P3~EMgn842w2O}2 ziWVuY@u8QZKk2`D5&3zy22uP7$$4`9j(gztQ8#?JFH_}pMZ&Yo0Zw(xV1(AN&ni1Cl^VPz9d4Ur|W`B ziwR!fu%xoCQy_q;N*Nx=6>$D0(iO?|)pbC25kX4lU)RRivL?dtO_8T0mo0RV#OOL? zFyH%ktHTx6ds@O2vy{4!X*6uVVJEpm9v)I0xK|Bu+%4s7)BXrwYtPh^qz%9rq+L$V zUARQnnv$4ER^(Dwk`nUv7+Xw-?dBAN!wgQmeuhK%;h*rxdky5QS%AL&m~T=p2o=5O zNlS_}Ig?y;ieYDqKRfC{LU~ z`MwY!ko_|i7H_RJPI*w&EkWNm=A*H*Y$KAnF@ft%b8@w_h)Gm&eho#by8zy^WfQEP zrybCRw(HMGj8uN(S{sy?&pCK?+&8?NEOJUeEho{I10S^Zk>Ny0NS-!$I+`}s^=;!q z1ae2pyKvwHBE&&7W6Go zOS5V4@6K0VcHNOraGkHQp?^o_qH$vqtb@w$mLXc?*P?${d}hf%Hh1$xpO1ea>)wm) zK(hv`;<}7^k#WO=aD#+f+tF&7E3JI69+eX0F%pc*!uv@ONZrZE>2x4lVhP?DN=7#C zgpf0KfQDWF@}xTGdXN>_QeM*Ok`V@90YVj^imEJnp9OpB>buhqs=Ovm!&V6ES%f6& z0mb2Vf8k&-RelI*7$(7Wmxm_e8N4H~OnXVcYL_!6Q!+WYTHsKYqa-NwsgBr7>u(G# z8-#MyX@`)bvsgvC)MSYErbhSrMROo6#%b&`1~Jd4#BIY(h20hZ9C-ogm@Hb~ZWbDO zZTj|yxjKA&?`s=ecW$zg?$$Ylb;eKMa1x7*)c^j1L1%eM(>1Jw^`Be-=Z1=>-gYoJ zCF)bfG+tEN>#+-x>l#;s^DQADiKN z^gVbz*fY6vtWRtKNnK(8ne2uX%FV!AMdQ5l_X9FFgYG`|$_Uaw;o>Ovgqk{<57Igv zgj1!rmT*m&ieEKI=A7jET2`Z!N07trU3CRvh zjpTTM(7OJ@ei1^sb^S(7ro1`|3)hJy5RpWL$JXn{x$6W$iW2Fu);^GS5EGYfe~(yb z<@D!#%l{%GTO&BgzNIQkuV;i}49CBx3(8VwpDTz*JqeOX)aS`hA|98M{}vbHwjDS< zZCo5dCu^m3RqA>A48g|9mi;LfEQ!h+ zo3mN?0#2jI>X?SSzMVIaWPLX9B0?`_3g8WKe`nD@s*kZP+h>CLcZ=&%ChjKn*_P=g z1YLNh$HnoQ>zWiq$NQej@szTK2AP`+JdrQ)Pt>(*9TTq zkH6-;V>u9gH)ROa?`U350{qp!y}YeTgXhy`Ys_LXBasY0a%xN`zcIR3Y*w=E zJ&C(VWh&M?L+3{smMpQcgdBiO^9c8<)p1aD;6S{G zeWV9AGACY7pFT0eu8`AgtSgr5+6~2ACc^?w^RW)KiJ5p4W2+7szt1tjDwXQ&ioC)> zgRfFq{U!?oP1%~5D1sbXxgaE_sJPJ z5zz?lwM&fWEamdYm%GowC>m3Fb{Ui>!;Sm8->g-3KErW5WDebr-~Dj~f|7L{`qK!x zE8eOxhWz~4q zD@5h2ye}_S?@7AHK3rRaRRLvKNZ0eanqd(+%8ZcTR;YTrK(K3cMo@&q*1IhwrqH(~ z9K)DF3MK%;;=KRrP8r)lR(2^-IN15ibIS(qPVvs;?)3JgN>Y8_$_!kKIPd(a-xI3L=V2Y&shE0exWaZ zB-6Ezvzn+GTxM^UqzTUa{kP%#Tsf#-6z34z>niz{?nWPhg_v*ZjSXe2&ez8|7gO2s zIddqIW?@Xjo?{RY?rF{BHNpFKcVq(>IqPM}XpZhHc$PU@29aoQR^tKTLvf?>vf; zIO06qG+V3rsDC5H2b8Nrf~iB}>{W5&w=I>T0tJ_YF6{?(p1mLv??{ST>3=o}F@c)H zL@E9lTW;9z>RJ7SJMv8$&scXJ&@sCK!_N}8L(vjzaFESF7lroCaWFNhM4 zYOm?D=;n1-Fpw9;#G`tYCf83&wWG~8Q_@&K*ALZa6s#L)1eD+D?d7GWEn5!mAta#1 zTJeKf>)Q=dL+^2F-zn=$rt&vw&=k_R>w~4bY}Hz1xX0*TStfMnEDsXW4_{aZ^W1~V zr1b@ClJPC>8B5hbnnhO|`tW$x!}Hk{aQ zIzM%0^&7ef3()ln+6ZBY+HaeKs;r~OT6mmzj;zwSXsw(O;4&$sJLXZgTh6>lI|q?xqoZ-!gcEM3P1XK zI&BVK?vtLo74A^Is}BBgTT*ae4m*KbqZ-Yhb%O1FAsgE>pvbOg=0#UnyZ@DG*dus))WfD~yXpQ-TXocrBDv z9G=f_L?~BBTFX37SS{;*H&E-77VkFgpQv$Vy_!4^%GTxD5vHhyrB_EU>SN$K@ARm0 zL4n_1SQ4;t%q|@@N_!P?Uj`HRZpKr`$Dd1Cc_xpRnz?S}Z>5ou^=6^QjXzgMOG}3H zMYa%)itabXn`Ky7+>rM;snHI)H+j4&-yIVlBKv}kEQ`@|b<1AER`m`~=^4Z)Cg~IR z{bxW#jJ?kq1)DY}3n>xI)5O3pcV`WL&|gotRgctqyq~3a47-=RpAx@_^({cHOk5GZ zSjXWLyztq!8YA@eOP23KLP#Nl-Ox5=0p1JdDIBHIhag12@pGHc+VrbH1T|TIP#67< zu|{z862j)ikp14~XK-0FsNZ&fx}4l504hM~z(`+xKW48QXsA>5;G2zk0(oA{FP1<0 z~>M+g%L%Kfz$ zkqcY~!DcDzK&@bst8fVtO(Bu;p+ULYnX^}>a_LYa&P2ET>ELRp;4O@(d{45pLk2}T zn=~mgobcHUOlQ9n6w`?g+?hrN7HZ1pduKYpF#6y++R3F`lsjXRE=Y{L5FU8*Ll*uk zo8-OcP~Jt89<1OL{_7o4SvHq(n>kagPaa4&xc7_(Z7)Gb9;8WSk1>TE72OF*wtx0o z57H~59@Jfsywh@*MA~cV&9$mk>PKB%X!cMg6>F+=YkNEM62x&9pyI0jMp}QlPKovW zNIb$hZyZ@y?oZekWxii#0Em7DckmQip4hO)93amSwb|5>g>7sYo7nu5Hh6pN0{h@~ zNd$ROIOJv(W+%;I&q!jG{4j*B`|QkSU~j=@#rAr@j+`@`3%b7lAh5cxVRt*01uj>M zF#QsA;e`sm(Ao0vn2&!8W#oJCeg~}^RWhhs!c^M>iM_{q-Grx~^HCuv^$r3deWO~( zX!(S}DB-%_2ucF`BtqJncZyZaOmEEK1lyROzVMV zq>ewNQMAuktkj{sPQyxR{la;52El57EtlHgK2WAE8^zfwL^e8MJ&q0f$iX&YcZ;~F zuaRcIU!@CmPSDY~K{|q?gEzGKYtRVkW{sKCf|{FpeB+<$zqBR3qmQ2T?*{I zyVX-b8tK^1Qhr-fEFVEes|2?=Du*l59JdE2I3@pvwE_JgV&!PcvGD$aYed8xCADrJ zxj#;+%<`xkTK|YPbblNYwkw)yps|0c@F*X7xLdxXIdapGm`w0OKxI;U!l!Hl?-fqv z@4nBy!fHQKm7RB1283DYvVlnwHr@_E;rI_I>$uk+K%l$bw+cW4G@o{`DZ1jU{usM_%o${5aL;=mXJk-@RM zir{4kOS2ES;-llR^(4^-co%RbseFy2xUM5$vaSGY0vo5i9>tHoxUc>}ZZA4#x(4fN zMQjwOKT=)R2w1lBwf2QzIcO4F;;sow6c(%wuS?9`-!X#mL#BwVni)M_8QYx@owX+u z!cuHKXqCLh>V+e?PH$dArC_%+GHjT6I7pYmTE2It z0paVq2QKG_WOfmo#K*T|{4j*28O|6xN^YVax*IDyHm8bNbTj~>h(dB&K%l?XTzYoU zl?6(`PK#GwvOdZfYGfZECrCk8tm7#DCkQqv`SQsffE^a0#Ji4g()1atztf9f01`IW zjR<{LmWs>9ln#SsE|^(gqmPPqXYlhDh3hR|!}Y1)i4l5SQ1H$UDn!C1i5tna=(o|3 zxEli9?Bdal+Llj%*x$=_tdY#>b|T_UIhp(N^B{l8T^bcAfG!CsM$p_(DccH9$0)p~ zS4)CysUEwo&XHoolaRjC#wL*;vdHh>wCsNijdxWrdLV^&^hJ8F#Qm|?aw>)7xmVJ9vae@*xuGp#@u$hqdOm^Ygi~zy1 z5WA4K84^~%spJ&#K(|o!B<~Aje~@45oL7Fv=0nrOA%{<*@4L8u)NsBXJ+eU;Fc6-~ z!}g%n#oh8my8WzQGX3mm2LvjXEMS1iL_=6N8)=`E z9L0+W0=GX!evTXmamY!H6uDUtS)?1>vXy~>FjfyGeJWW4A2+pQwV!w$>y-HAJ1U4Y ztgYhMwP8Rns9E8l!Vo}k1yAJ&|M=n60eKRftQ)jD-*@by#ejD4`qepv9);M#5wjYv zIRxT-EEmF4(_{6hqbdcG4+p7je%ie^w`B*iXJ5mxhVU&vUr6 z$>|rY>8%kqbATLK8qyS6S^JhbfyHO*h%sMCH)D$-cs0EdQu6hAH`lUEM6So*fX>Np zYfcg>I9uTzU|ulr?)s$?QPir{HpmBSy&AB91dQr1;l&DmmJsbH#-x1}QmXopm(XWR z%HG;waxT7dv(jq6;z_#~{U|2R6}aeSN`T>3bug1}lKA|fZO_f1y!^*7EU!OG54~5A z6CEJ-;?ZkV;W~6Zux}i>UF%`qMqegU*)rCJC8gdM?~xuMv3XbQ7wSbL+Jp2!mZIDVIM^MynwZ zHe~U+@w)^mBTo?O+35S70kP9w@*^GX6|T=o=_@D$=(rY{Yr}JYn`{z4c>Fc#@}-A+ z$@US!Nd94R4B$-8bjN8X}MgC6jb*XR9 zh3?+y;mVTtvjbx8iNf$utU_nV4KLQMbjX?0-sS6?7BK;LPY4ha(yCe-N4lgS=Lq)6 zmSdNJ{F86BN5f*0rL`|rfCkfrNK+mIyIC)c)tq{hm3%gn{k?2zX$0AF9kcc%{kQt? zDH%pe2Xa4fT!-s3KR!`Udx@FaY}@N5n`YXmVkIGvMnZS<1CP$Fx5Y;4m-+AuebQe_ zbnahbyp+1Aa*UtW6)j-gT_J53fLI$cvTu-$Hj@}e2ZHY3oRWDu{yvuSxNoF3(Z+#r zlC!Ymt7qVp3tCk!c!bpB%Z;n_z+3iqRX0exKtA#_XcE=E_F!-kC12UCYQyA z2|Q9zjdzZd{9OTD6J?LM?uv(|2ZDCLx^l*kb=L47ftpylaXR`JKJ?>04HN$Ee5^IN8_CG9W8Nf zbvZj4Gntcl0lPVo;3Ls9y(r|DVm9s;oov$)XzDzJUPSCI)7rOKDCLCkLZCNiNTU0< z@LJ=Nj&c-zVw`$~){t`W%m55}?}LFHds_kaO+XsKUmvV`Rq}Ya@E#1=U@*-td_ore!HNzfS?te@7#qf-b z;78Rx2oUF)F~Uu-uzBYA6m!yZa2+9Q5hFb|o|he;-W@=S*||(|AghwtD9fr!sx(Xs z`fT9@v@MhZnHnJ*5_z1fH*lbccQW#i5~^8?ROe zt_9y&{?F7;#MZ(y3fFm66Wc51q5h#S_xSkvZg`A*J8oy}%-|^E@!(|I*lR(37Y&JC ztBpf!q3Rmsl2(=TQwYkZ*ay5~tJT_pxG+iQaVf2ild9jt2P%RbXN5mZHU06%vJ}qy z+g=aPFGFW? zC(Cth#d7m@8dLXic2)4`1j3^C1dM==$!})S;mTz6vJ~@nny6+eZKhSCc6Jkz@&oem z^c|I1A+CYjFG5;^so!Kf6b=n>zB!?Gk%zdAzz>d<_!Rol9gh5jLHBJ1iic-&)gXi; zv1fL{5`S}b#>|6vEy6NldFnbpuL6I#B-Z`!Y0Ya!q0fG9((=%el7Cl5gqizC>{0u{ z88G}A-0bEW&miJ$V#?f^{jIl~$NiDDXVWC*wArz8UuKCDxjnk?mrEn#-RnMULMB;3 zlQ;VA&sFTH^QIki{%Y0%+XgW(zgn+Q4eUxUR+T)t?4(LIlbg;NgyXJ^`J6nUpB8lC z%jfxSDY(B{jm@%BHf)4P3XX`$5^M@+xZ3-?C;Rvw3Wwii;}TN6B5*^7SC;Q#`9X^5 z93CSXWctK1^L@gXy(H`ehEmXGgB zTX?h)*oURHX7$m^jU3)ZdRMfd)`Po}nx}EestpW5nh%61eyLf%7CZ6y+$Bnp4VjC# zAS4uR->}`@wwrePMY)DYv6U1&Nfq~rHyub-N=ckdQunviN)Au7JmJ-)fOXW|!N>T- zFYq!r3iID;_G}3mX;*Ji9N3Iof^co5&TVX4e}Bh%GjRR*11E&x7F(KqC%to_P9xPD z%Qngyz`_0<^B!t%RyWsG8YNgK^&a!3Wqt)$YIgfFd3#Wz$=hm1HqhKgmY zG$E*93fo++&Gllm8qv_-^dPPc<@13%{&v_7m*)3Wr+8gim#ps}1p{~=bzaT4+&<@1 z9MfUYJyk`)5e4h-G;ZRMAr?@~Bk|FB-pXv;egKTdm zIV}(pG~L}QnX{5{I&`BziSfRB(mMwUSulf!X^o+3|v8m+UN)%u@H`PMO9S5MwUVNcnbh>L=TxXL}%- zeN+7#cp3CNv-1oW!${Iul9w`6zD4iRK$889dWz-g$aAh6bC(y8sq~@_{sgXEX(_|? z8f(aTcG=%PR2^xe@eeps`SH42pTT$}%=Kb)s~jjzuYJl~y^yd6Ha6BCbw#9sA${o7 zaPuHcO8;r2Px8u)M~HmlkRwHH7_61Z@i~+9?~`)2YAg#z)oU4?L&p{81`~MVP^Y+3 z!Mf4I9at;&Yg_Nu6zA1HTC=PKkS8g9u2b?tcN?sCS5ETG%p4wNEHarr9xE{hv;W`^ zbw%rxKBLzl{FK`_@BRB`cOZj+nG=aa}mK?M6 z)oI9-yEk`9g*ipPI39CvC`s=V-0OUj@)H10y2Op=Op zHtHpE&7=S2bl!NRYl1BL?rBY_)QU(2>l$}x>v%`6Lz_P)6a6gC(xO10Xj+Mct0X#f zr#g*zTZ|3EIU8d{QKQq}#_LtOc$&~ER&+LI6|mM;uB+?MJm}1rdxrEJMm~`gM6%r^ zp!+C%XF(P*{x}}pJ0*O^p3=0ifSLZ-DfQHL4sM{xJP9zvlKL7+E74K0XCyX1lBR-2 zUWF0}78M_c1e2t2wbgyYUNNLv`dvS4v*9XLs?0ySoX^a`VEBf#Aj z2UE}3-13LsoRyVsQ#o;x!0N#DVYhT$U&;#_mJABHpRLa%d5pviyd(x@OHlCCDd&;> zdp2EyD4bFh|1X5ymq*N+X6avX_yMq1Tvv8)t%hov9|I z`2Fo%`J36#e@u=5Q0*3@_H_P&nt89E`ZrDX_duJwWfFg7ye5nre`J|HS2dT*@W75| z|E`=iSJ_D0AT_ytl93bYNA!^m?~-OP?S+T~4EJ&hBeZDR`e|k0#G{u2xkvNPp8nWJ z{_s@t!bKCv-QKX1oIwxenl-XwESM)U35BaZ=+J-;PX^BNa@?1m&{^`_Y>`HjZ`jj5 zW@jaL`h0JE)x>t9EdC_t?uALx(P4+Ckw(k|g4Jg{lRXZq9hx{;x&>2x<8P`sj=yaD zQsHicC$c82Z8e9lt*_CP3~U|qq*^SJTaU0EOs`-@!2V8gUW zBP6bO&CQbgaNNUc+5tISxXh`yB4{#3D-{*m{fvCZb)Lh3ZK7PZ;^s%sYO3tX^6TU` zizxap%ba52c>jA8=(J+9!^dVAo4-yXA37|cbunLJjhU@iR!Zvr{xACQ%=r1C%5lRs zYOvzFFO3L7`Evf6ym3tQc%{BF=}QjN8GPQ8$ocOy*fIG4;Y60-nZc?ekD2LMd35L;JHD9Qnkv9Cj^_z*kC8?fEd)fJ#%y-c5*A_(f~+7&S~DY0L~T8Y zIcF9lbKge8Ar#zVtP^r^qUY6XVR=UBpKaMXssnn1v-zTC$|aW)B;ZXg*X^^=d0y=P z?)FykriNJFx&47+CUNVD=$d-FbQ$TQyhD-KxXrQ)xhN;Qxx;ZeWE02hQe?D(BoY}0 z4a+Z=7BQU4x6wkT5y=df36dsoy+r>61;;i*kv2g{Gd0j?%fifrJBB>boyONy$QOHf zv}I#Xx$=;sp}+4w&$ADth(6ltfNEb{ar}O_dguP*&}(@2ftLzBJ`;i2d|iC%0uBNc zqqrQ5??)zG<{Ffbyx=m4;`v$fUiP?yg*;KaN74|kzan_Ukz|Q8&Q|;Y;VV%#tW@Z5 zs>n7rv$1-qPBB~-&d&;*AQnh%P0pE*prj3k3cqzSO}8dt7^XKg$rHa`rdHwylCXfc3EIKcF)O*5mrPhZDx74{mB+ z(PZ-r+$?K3*QcMeSZYndg&!TE*%qeLpBu|R_j8)~Lt&IdsQ-Br$o(G12!bYTpx)9{6(koMg)1a?Td)bBjHwHG&w_^-GG^(hx%lM zLhGL=f4}2W3w!KVVs!HL?sTna@;+%8*OKW(qOs`CME7qS>g^9Dr_nm^S(LkCpcr}< zrOh@v;E-kDU-ZnL9KL9VPpn{+2K5Hs%Pd?(dqQ3o$RY%fL-AGfc(K6@|#witJR4pMB>V`r!h{xt@c*_aM`k1 zd~l6UTo!i&aW1&oys1XlNQYUE?W_0&jZA%quind`JWL|&@N}>7qI?LlUGl_i=%=d= zgX^149&z{Ly0zr1l*ds#O8D*T!*-d2uW+~PcGxz&;+wrZG=#K-q3U4E;+1e;bu$k^ zO<$`vXi#*C@s|pzVDz=RCA4y#u--Br{(Y%da(fLRJluBr;rl3?W~MpY^dbGq-fpE<3C$_A*AxE(OZRH^ds^rX} z%B|#(QLJ8EiWJTiQJ5U3A||)6_X|1mWC zIg{^9YNb zs^Mz`vXtHp`!UJBGHaD>el_{?Vyw zPBV#dec4y{50x-9&T4l9L#F15W<=XU$ofFmlgR`rcFoKq3AekTJliSan!;#b_k5)G zcV{h9Bw6*#(f*dX&FEs))>Yb+^8*j{`?BY>`>^FK)quulo3ixj;h#P5zv8}L5fG+m zdqy!tQTQF@sTbj`#-M^l%hv3093M^`WJ6UAM3>$ez}aF@&?1 zi|qoRjaC8ISc8lACo%Gu^g6Y8C1Lmp0TAPPLACmq6@ZlfbR* zs5;eTb-sVWZuGKgC$X5wmqfa3-n)Gj+iRe~JqhK$SZIk~d{2Eu=E6V4K`y6S6MHnN zq%T~rZ>J`qGcDmW`IOZID}b&>k3=@48VWvK=FGqoTRihe;e=qT@#?hvP;;IS6yH#B zLP^YYO@EkE8$9$U?_WX(oOYURV^{oZOjD6?W!YhLN%Og91DKjjB|T!>N{q*J68)Zc z1^lHImj8V5Iv%Icx4i!|AN!KxFl6m!?Vkyy>FqxYurJ9CGs3Ku)S#(wH@c1!;R38>e&qOQ&Gdov*57tXE# z{&>CoqCDD6ti2w2kM4KojKq&QhRh>`#ksqh4(8nCKzwE4C|X+Nm$)dcRLyonGXZii zfT>DfT1*8cmX5=mlHJ z+~)|R%wUx(wf!zTQS-A3J@M+@^Hro#)ToCw+9sye7>R+y+QU!EGS0YFR+9(fuB2__ ze_7+Pp((gfMaF}m&eP+9_mud%H~t_FSLg<@7w%YTF@L><5(r*CzV_`g!$UELw^k*E}S}vm$r$b>l`Ir;3$)x0Y@=-4~Gff zRpymRM0k#1195S;_v`lkc%ccf-0aT=8~TUAhnC{Q-769}-{M30c!Frx&5<01zWPeh z6Y+pnkNrh{tZTAS9s5fXUNCcKJTWhquXf31R!}fp4C6hllB+ck0i#>CL}CbyCIk49 z{0cibB2q1R5H@^5m_N0$Pi{J7wA;gMysBGyDt6+WE4e`3K|I^opX)>>lCV23g9{yo zPNiQS;iZhC#?UB&*9sZu5}dW+;F7*C!apbkm|!O(brjOq7Uh2ByZ=u_MFv1rH1IS` zLYnCk$xAx@TO7aRF?(I3RF#{<{yL-sAb8RCd?e<_WDk@a-qO+33Ow_&nJ0`)q;oly z5p6A0?$A{Or1H+b9C9;ixn)g=RhU7jZx-I*qS1HR*hhm(Gn*)l>bkeA|5z8oKmuzx z*Lt<|VW71nK+p^BlFpu-jcN{+?1vNXp5t(@QfCd5UtPb=|Gweieae+RSPxf@zU#3t zwCYAHHE-P?;uk!#z=Lrgi$3yM!rxG%;3swuL60~Ceyul$Ire$f5J7^!yeuU6TuCTb zMiSqzV07RTH95aC3aFGEN8iCYv6p)#IWg)E837d=i?fVBS7>apkGz<4WbTS~(|BII zaXE`f=Jgldf!U|$4rJ2LECp$QpUoMRt_ka9=;py#27P^Q^~Fb3t+sA^%~$UbuKM~h zi9g9RnlF?SKI3h5+;M1Qq~n0Cnm=%n$0*MIJ7(?E&rPThq+c#)JuhO-n$XEmrd+SQ zj*lJ0EpgAxbsWCd4;eCg5?qiu9Q`U*w&cRkC@C7P)A#Xowj*DDb6zFsuA;fs(}(yt z^vg&@&9-=pAMYan4aA0F`Y7sLXjV=yeW#O5j3LX1e0R4vo`v*Sqk+8+#uHQ~vFxT8 zcMX-`KI8$4ogt9`<9{XBBjs=#fmJ!&?^oUkMu#L7V{7HDYaWk5X?!lrndo`LmpN#Id^a# zXG=Abw0#^owbDoM?0($i!`lb%0_ut+8W^=QuphgF?yb``Y@8zG@$s+MISFQ z$G<61+<8l*J;k>A_D~)JP}4+zKe^el|`eVyl}( zt-hrPm&8rwkJ!Dfd<&rwfvBg>Fi7b7IfabB|%`!NeX zWTt148WbW2j-@)u3O0Hlr^Ic{Q;;8au{|3VOJ3`Qx|vggxwe&y*9M*W8!Mo^KMDxY zpAvnlM(0@Jbu4hq>zG)j%d@i=E;smx5=osR`j_`N18gdlP??!Snqx|eLB3w>pjKSQ8ry4sF8#1>N)rtmi>v1H;u#&4;dZ&My-=CH6n`+f0AV<%@NnnA24bkIE%w^RYW{z*~5W zg>!9n#xVheX1m*Y-XyF-sua96_))r0P@(K)X|k~v-D7E6^`~{(!7C`6Is1gCFtfAC zR9Qg+foB?4Q5Q(}tDH+r3{X(;EW?ehNv-e8r7!R&_F!$N#JcAT){3Bj2tE3luju-e z-7SW5!YjPKl-Tb2;)5n-v7rNBy;T}djKT#dojFUWQ0?HKmcoR}Z|qg?crRoy64hi9l<_fQmn53uh+8@WVQF@kG z0Cs$1)6u_(I^9Q%!jktr(npj^KJMf^JI5aMA=UupU``^_Yy3GE$)6VWduO2IGaPdt zv6H{<$g|(}?a8j<9`F{OJIJG03~Oc|9;h`qarxZ!Jp?tcJbAS?owh(Dl3fr;RhL6b zI&C$7EZI!cOH0OFv)skzpPEbBnXl@jp9@@!wYulSe4G(JJ^dp3bgaQi>H_AlO}n`_ zX0H-T!8=|0wXrW~tQj}fQLZU9<=yUVe>^|(?wfJie3Z885{XwDs8v(0X|FPHUk;9c zpz*N$JdJ}~(|e0S{icrUpb#$;TmL(jt&Ah#si#NAZS|p~;g%=qsTFql1KCWL!y5wy zVL;KtZGc1Sowpgrk~u2wuH5Xm5C_FSuSN41L?Q1CcI7qiI5o=EpfCwO+vtQDqs2q& zG_qXscYlP_A^Z?~s55&?OjFKge=9ltWdrYp4MaEhY|V9wDi9NFd%nhV^vB8c-)^sf zX%1h+qWH`q9)7s7?m6?UB%O&lIs`**R*d3*v)=Co#eWVyDYntJboD!EnZ0NlO)b6L zyEv0TUhlId!OZCBAgp3~BzVbBzFZoaml4G^jokHAwW9nlSRG!k8kD%{11^Tz?F1{?MK*@ zHT)8){7t=ocxo_fd>I5^4^JrhpJtdes(3g*%Pjy#0SbQN z_?buXAL9&Z(uvDecM~i!2*#dRkZQk$H+!#+PaF?_?O!~E_WsXoG zZSD;j`}EDTaW2G-cf|+d=P01|@KrmFKHN`(P0JCAJ#O@aTdiV0P)}S#*1w(rB9z;= zkCY*)q>6rlcl<_Af2cQ?uT_lz2@}Odo)V;TdF_Bgzn^en@>%XCW>`;LU!N2JZ+zuh32Gp^xqGt2urBlXW7;u|!X=HTPV21+wIl*bO`OM-C|4rpjix{!6*Xhx`nDcS++&l5sqfTLlGg z(~`5Yidpvf?9Z$f&@$eZ2D)J{{b8IQP^e;ozkD)t z8>qrKKf?bzdab73bYLHiNsAP3yzKCYiYfqebWS9A{IE?w5`O0bkhpdpk)C>UJD1Hn zHT8!h`@?VXe-;kyYjia2GTH&T38E2(_18tcz~=k49Va+sKronlT87d3F`l&>o(2kL zT9mKTN&mhc`0#0a`&>S*SrA}=*2=(HAS~;dY?%-n`6oH?DnpvAp(EpM zcTf1UI-?ClLhGr){~yYXf37Rfn^ymEI$Zw!)A3KQ;$bIvifMfXi9lv_?cIYPE8qX~ zdj9F({g)qwU%C#io>V#z=df>xF#jij`+xJsfA}vSl>H%7Y5woaRQ_*&7^gZ2&;OwX z(BuC9@xcIrT@ZHMfZ$~2rIu`zOSdQZ<1%n%$CtFy=75DIF;?UL!2Ggcx+`ls@;^BR zN9oRpKOQwUxkC7GndJf@(#`X~T~7nJou8x9VU)VAbK!tN#zaMtJ=%U%)bT12P)>xK3s*lRh_6pdM&;=NGqM^E7@pc+GbD z;(zcaXw{V_O{BP3EZ6!!J2&(!20)?suh0MM`TuqP{*xQ@zu^8o%+wZdT5Py8lcoC~ zl@B0(-Uz4FLRAJvum8=c{-;OXZhNN8*TRA&G`B(HzZ5tBZ;oWUJp-tv%69K@{Me-Y zH)-WhzX15PwXcCfN^`>FKlMiW>+}D5{(qgn|IPRB`(bUM;KP7R4s=!58Gb!-mEjRa zJ;7N0#T|OCPLGf3=kM)xs&^jeaxl1OcHm&c$)bMmsJcOtx;MRsW&0y0CZo?b=lQN& zJ8{q!zAb$#qe#uYNa@U)= zA%CJt|C{Bm+Cx)%diI~rwCMc@wJa?t|MmHQJ^#PX-(UCdulVz)!2IJd_P?!P|BAnV z<)6Ru?_c%Df33eRGte=r%*MmQ0`;3$s9AnQJ7HyI>3jpOtRQ`_HU{ndy05-AqNz8j`=$n>#z1PnFfw_TTz#2!ENZSL~h zJ+CVco?dkZ2Xel8TGM5*LkNo)J&Ov-cF2jLx6Pn)Ha$xZFm=^CebVSW{$xuj-IN`4DeZlE=F%0(<^txgItyJnl=hT+p?dokQi6p$UEkwCzY4 z_LHX!zB7TEPc-D(FBp{KAcPnZyHh0XhN2bMQ+5H`+cE5?#_l#4uDGzEWdotupDHa# zL+-iEe|-HD{@hZRkL5yljJ{x2(7ZOzOyTkaePx1C$j+d~@agMiZv^zSlrHNwc-Y-Q z9Gg-OoIYp!=6Zs!FlUVXa!TEZVVld4f>36V-vSYOK-~jM92x7a+XFDCreQtBpZ3@W zE5jche2yCU@ae7F|2W)uc#0NUkJgC)?a_xPH>in@Ko?^*hGv?4IkG+tX-i}#*}(Q+ zkRelD08b#B38(Jw*YQTQk0W;LubN#^4c%Rpfs%G!%xH^N-yU$T0`u_vAWRvMPdx*` zEJXdy=B?iAh4K0-!4t=#Xu2VJyfI2rjQizYP`41UJ;b>0ZF|rt0~rXgH(p!=vNujc z00}&2BKS1&+^sK9cEICY@(A5%3k;c_o*Qe#q(5i9)hHJ~IPSTwi4v9nekC_(c?4Bt zkZb6kDXEyR?=CF@t&^)Ae3L^~neYs+T9DwCG`axf5^JCcP?z9(jCvCjd5wSLlc*~L5GTXQJFAnsNIY0b4 z>v`w8?=Q^%eic}J!}rEF?ZRE@Yh|v-UUI}{1`c$vS6_znC7FKaOqDCpNsZHo3$d;m7xEMO zO9uBvR~w)RRYBdAD5!<)lT9^mp2WjDPYe>xuFoMSI5ysUdzGR0TVl*6t}ZV~AP=_u zCLNOfM;^=!#|r0h)KEV@K?S$wghNK9OVbC+!;%7q-z%i?J-b&N7I4Qmn>1251ia|v zPl+{p+JeK|TRnbE$%2S*-WBh&bX_uN;Nayc+aQa4m(21nt!Q@rZ9F^yJT>J^zah>2 zH@5;R+jg~R2BpnQNftwjfU|Lt?RRS}2LpLz!r92g|1ox5<~|w@`LIx7^0#CEg`e-9 zc!P)B>ZcUny{|6|OR_w+4*NAT5n`q&|7ADcd`9aQ`LC();IbFgNM4o znJtpJgKEcw&BcPU<$WE`WkvW#Z>fkHr(OY5xq8$8m}Q4 zasAM=0yL@W@cUHt38hahLa4nQ8a^uMs z%sk^*)ciHk-)K+KTRr=xDnP~#0lPtp62N1iC2D$VPjOgZ9Ef=QK26|%9A>gy01qsp z=eZyI-v*rR?=A?j^3a5}Ru*^;gRFOW)bB7V@7yEx=)>X)^fITsjuXTUrAVCQ4thA{ zT3Y_X7AHES!t#9k8dp`@>zy={;ZZWXzR_E`FES!Dxu@Oo!!-6_CH?GU$yvd zLkI;IxZu8?Jiqao9lO|7O~K5BXC5UA)~uOoY>&T32e$II0iT!5%39Mhj`2m1JwA~G z0H+z)RX~d>t%EZ)e$Fw#yk;CqC$G0iaCv`ZYPuN?5pFAy`|Lb_B^lmC9N z{;y3;_|a3RWY~`+mHhogeY*I~uiC@@)$8Y-2CBUQ(;msxZPmkCVRQSL*GKZZxkE+A z&47pCFhF@EgSYwmFF;ul&hI2s~gf~Qy@FOoX+55AP(Y`CW$tv*zIvFXH(nv^z$mgO#C6~bd z6Wdwb-?j?|DNNg&S)uEi!v(r1v;J$P=6#((0i)U}jC`kZTY2Wq?|gAls)WRFTX{7v zpd|-X5BJgg^2~N1s02~(e8JI7m1S@74O|@{f;#Gxuh5h!V1)Z}jE1?$q~PSOX4Ah0 z08h##QK*4xR}}yW5YLoEIq8Nu>1L}aqep46RT$wlmFP_Nf|D%}0-K@?Ex>v!6tRm6 zC<(rVJ&!I7DMp}5oJ?*~U-H0i*${&e-TpkE>RooZ&Z9|t+>w%t@^b ztsi{=6l^oHy(#m^J-z6&zizgL^+|T;?O9#Kp3i4D8TF*x#L+w}_mLAOFh=9;Rwc(O z*t0vk<);>Zqb?|J8CQlFPY1JN&6Nx1-!ohg$h$diS-awut(Q?6dPT|u!qBpZsDLdP zVXdu8ZwbIoCJ@bbE}@^MWP4XaIB2j!|Df*5%@*l_^3_V%}i)$y2` zCEu3GjTF-Ru>UzS8!|iFv;3n}m^$TGGtuBW4^pe9Q-(K$dO1Q76pSPLEPUO+qd+1R zu?pMl9DPKww)?uPev&JJHEVZzko*<6hV^ydnFd5tlOYMf^nJ1RaUSK&%VGw{Dq?!n zuMiq&Mprunfrwg!JeYll+Hl573?(+V$;V!(Wrb{fzDVc+K5x7TIA zfOSr-FIILf@-X?Bf!S?bx3scz{9LBTUXwPQAY|@ z5`kSJ%4gX25HYNl`<}(Xwu88s?^w98*5+;=uv#QzH#W1=AYGVWxV#Iq4w!_6o6j;k z%a{^(o~n3(3NcHV$r+f4z?ChME{Lvgo>F-A1zj_;@r?Eeh3VpP`J<_ zaozPK&ZBahR-4_bRBwbUQ_*Aaps;I$uv+iV+U>ewJ$%a{>V@q9XV~`+;iuua{4hN@ z5PCp|pW0L^qI*z6qV)mZaEZe~^b+ ze5{vHW_Q@Xjy0f=RY)+jD9U+U3yQPDDs?g|WQc12cz2&P4(^lZ{_DI!`G?s*T_pHQV}0SR8lMnlYT9 zASq#60oX<8?!C6l5U*gA#Sk7y<0@e}W+OI3`PN5qjh3VOrPzRxVpz9dh@Nqa_5YO5 z+wU@+ca|}%sN3fITe@d4&6%~GuKBt*j$;xEbgLOw5tW>CLNzDD1ivmmM8porwz#GG5&xGWkNpgn6NEU1Ic{+ zI|F4IzV9AEiM>=}_Bs?uE)1-&7LAvAj(V-e5ZAQqi4hMgq}tzdTFk;8VM8Oa08XV3 zN-=BH+s>eCY9dmM4e1NC>^z(dSQ?1kc}2d8z=U32YYwPj(smIQ%7Y1{m4p`EH-2-6 zo#Al4m>Nm*ltXM6A&b}1-!DgE9(vmVl@+f{iC5xuoiR#VpJ2Z4IJLt}xS>0PO9lIL z;~V=A2D~5B>st8@-hr-tB*c7a|Fk$*5XPP7<07 zxG=cZ-X@b#FM>Ie6%~xZz2D;kGNiC7<4ffKsgrDfbqSnZTZy&{e}@MvToPhck~Md? z@WQUvqV;Ij(sP{Z8kNEQZln?#X#>T^UGh`4n&MNdc^l**aNSO?{bY1znfHwl%g3&F z!zBq3a-|+1!1xcGyQr?WDM6Jp7itD0h9!6T;X-}1|9r+f8S{%4yG&>lR%4CsYPxe{s1&?HrS)4FSNG~CN-P~oSj@P=n(m|* zz3QFwMrO8GDTmaJ!veR8CIPSLvSUtJ!Hxq{_eR|UGdF-#1*g#kf}MfePVMfL8}|5j zZ>vfK30G3=H{;#Cv??$NB6iFe4*$0dXBX(NMYUL^~>m%rKZkWJ0O zEX2^>D#Ewosnx<>yq-d_&4cVM?#d}sC}Gt1Me1I33$O%cca)C6THB{ZI6Y8OMQuC{ zsk+DJ%#7jj*1dLFN=ocbKwc2cIG_8-*t(hJKx#=8u36*B9i@m~tT$!fgzG+Bj9k8Z z=ldOd?bngwn_QPM8>3;b6pW8(8zVU_a$zXSvCIv^mBgw@%;n9nsEzlxHbC2dwQV!X zt1sMUGtA{?H}Ar|J}gd7gFd2@XlSez13^N2gN+VhB53L52lUM4fE%~6kImLcl13}H zIAgp`I;thT7KoaA5Tv9R?}9;C5-C{+E$ioFOa&?X4UhYc73Y*J^DUh4DIl9tah6p) zn#qo3lImhYn)T{9Y(~-we8$Rok@GP{|dZLEiJZ)a~5o#(Y1d{W0gPT)JPf}6x5pt|*m zx2fsV4%3;|QbY0eG6``pu3Q*B9kAVE5|(;vl;8K1$xh-KU5P@JH44W2U6>{B0e{WQ zkMBlGJ|bv?0192Wt&KbaGA_@u1YwCaz0G;loUqmJ1(OEy1pdLk$`dPKY=(}Yl-j8P zBXaDWu2F1I)bWYxdm*$|Z`v};WW~(UHWUaN`iVB6JBIAY`50$>vPs+kC)sb&QpN#L|)@@;lYJNyf;>BJ7;zVJ-YKt z*V9s?TSN5NZ-(etuPVb{&*dbxCF`Ojq!s$phU4d8%g0s*%}~oZk?%E1pXBvEHaO01 zye1bCMXt{>D`<6^PdVOHcoH9c0pe`~`lbNN3m){xp!F`(+=SE#^VyRIjc32TKJrfF zz4)#%ztrp7kXWIpb$p36!5q#qlKs^{qATpv)t8IoBnq2dG?X@A@sy%_I1jrnZQY-C z^ZI!4Q$2j@-QG|o_Sa6@^utEmq9mc({5zSStXa&qN(_;^QS1As(tZosHh)jF#h>B->c!$j@ciA}hiXdO+!fFk7Is9?r)nZc>HSHgpbEOUBUZ+HX)O(q!7`GN6M74ALTbFm#Q!OyeN`+rHI_k1S)ULabzvJx3 z1+Jhf!tWJ^Px2&+8FO{h{ra&)yRuCy7B(KcIgJ|@mz<5br*Y8Ijkk9;IYcYqmqbTh zEvqXt6eVr0RaH|tuGgHuQ)PKGd;a}{0otefJP8>o#bB$~0Hvp&_;YKeleZ`qvKoVD z3QuHGvr0^+P<=jglku>)SMjE zmN&tT7jxd9Z9029;>Z)dTCI9qrAkBW_a<)Vi^N&EK%RJ6D}U>*^jgo1Sj1*aRv4O_ zJjOqyD4UwhwwhO3P`K?GEJ<6eIAsYPyDQT8^^}b3PM^p|Y6qgQ)Ys}WR@XnQHL2s| zQrj#}MTmHZ!=WK^&oc4U*;`gU&A-Ug{OUMDnN#1NVI%o&qh zFNzKiTQG+}ih>>(tLx+kx+{WS7kj2XS~jh} zXJWi8VW9*ag-dyW9rau{_K;~|MPV^&ux_KZkbg3h`$rr8k23@|CaK5%jtC8Jpvx2w zDr0x8YnNj2%kmwNUjclszESq$494Bbhd7w1eL2gCZfeaMBtk1UTZC6_#H;RelclA( z%}4I;5p8?!JwQxIq5{5Kfy;2gk|>WcBsYYdDb88$R8>Uc{5Dat&Kg+-zxI=2CNSReClI@}ujiJjT(&UzbhZk5^YRcE+rI9 zyMuK|9IKL+WaVjV9#oHY#GKX=n~4Nx#LEus$Fl$CTt)>-i5TYBCm*| z5HZ>F$WteNGh`GH(Z!SB!S>5s5;TQz3D^nu1A|IY2jr5HF#aPsg~K>0nH1$MeP{K_}fHp z`8j7d+B6EoOIv7Q0zKU&wB^T|-OMUS$&S>)-G_%KA~0-<>+kJKzxFkP+=N~yb6r+k z2yOwB-o~@+Zc7Kxcn+>W!G;V?kxBDfy6Fyr>tVUsxza4*CUeiBE0s zbC7m8>{sc375@HyQ2+SRPw z^{4jB=AIy&lJ!vHE$-HPHphEM+gOZq27y!UKHxNSjJCLun&LwXW-TMSat9u&diAO& zn<-zrZ)C6aI<$IpqL(Z?#V+S*De|nWWH)#1)VtTr=qSfjoGpCPvD8Vu)H^Z!c>mL1 z-&NK`?OCdnqOe-~Wxs_OujJ_o62t7ne%pw(0h>_c;qA7u?8dcaV?j!Q6qTelMX(r^ z@K{hJA*p!eA8YKuK&ggXu$=9-VZ3!zHJEX-`-=ZR?7e4Llj+(utcc1Cic$pW2r6Bq zO9@3FC`gI)E+8F5x|D!mr37T8cPRp)ORoVGP+FunDS~tXA%qgzcileQy_xOa&-lE@ z_jCSvFghgneO+f+Yn|)#efbWbr9@n%@H7|hQk|&CJvAp9V9Pp@#q+rov}YN9JLP`y ze3a^9{R-sPLW7tF{k>3bY^4wL(N^*Y4CBWw^Z>@Xwh}c^yX=ND3fArnNAUP+$Pd{U zcdQ|eeH|l?n&8`SCwh4ZWVX2kZcg))u7%i$Zld=W0Ej#OAW2>iWZqvuQ;r;^MYaDp zkunDUsx*>txuUru!*+d(@aIe96BPbe5N5CD0je20K5!sk_V^gtH5NYkJians8pkNo zmNt>$zHGks5QR-j_Rh8}iY57(L`pSDeye%Tkx?)()}w9U5NX!nQhK9I>ZvxVnS_(Q zXqmI*^p5sk6n+vJOP;dBLr8#2oL+BjhkkQ%FUF zda{l@gu>SvpD;W2#+8GgT#`zh%N$m_>wI*mUVLDIRd& zyu~nZFP|4Zt0Fcd@R4IVQa480cXunwoO@;DO`i73;!#0-RhMPtD9=Wdi#t#^JHXMbGT+`Dk>$#cezPSrj3W;@lOO60OwTRNYEX~JOI0-oW zj-7>j;9OPvrgf<{k2~I}W&VD)W?k)feo%@v)uV&du65A^wMt4!Ox^&$=6}YArFNRvael-Q<<=U(=^26_zl=O*P-8R0 z>~N;fv5@+0TeTTaI0AiY3mqD0M|m_EERo|ztMJY`?@~+5r92||usyd6gKfOmOM@f} z3|qQJi(Yq}Gsik^?VK2#Q1NUJkTf6es71G}F_;;6@-@%;?}rAO|J%Utf1u*-Bs~m) zTN3@_w56bAGD(@zV%d{@1o$o%P`hg%Od@%n@*I1CUP4t}*$Gz2w78>G`JmYFnsHfA zzG~&wVy5>(9?PE?zEB0fN|QhFSobkBYdIUjRI~(n?N3yg~=o2F_V+Ju)Y2Gb*Om9g2hI(&e0baKMw{T7wxVHus2;l(7noh>CI_I z->uKvNO0_WcrI_(4=1nHppDx2Fg|2gy@23iW-$j%S&%o=Ad|oh{-P^*{prvgroEKH z(+mg=Mvmy?2Xt(RYdxoFUAohq_SCKssQ|{Oavda(^qw(c&RV-*&!fJZFcI$BsjrIN ze@r#c+JhFQj7x1Je+V=6u-{Fe(PY^mX0d-cDbQEHqf}wLh7-%b9QnW)&iRPc0F~!E z&g9b0kHpr$Sz16!so79%k>BRCE#0%0XJiM7;qBSXT z7liSZwx`sajeh&Helte`37fLjo_!w@c#{*SaTRoGX#?(i+AR^X*7$bKyymj2{|sld zw@Z1A+3sH>@=ARtmH_EvfDmKb1)rIynAyz#6cBLVKy_4RD~0jhonlraub|6du-hxY zng6jN8A_t+dnXp}#8fKnszR@;XFA$sj4wsBv$p+@zRqo^u{^2(-j1J%;;3qEd~Df5 z!9S8Fbi`J)H_f!zjV1ONHJGMgKjPGX(-@qe2YM(t;ne;8|H-F6;u(#JkCTZ^^W)zr zoo7OHh3H7dA!5cAI6hDBLp56oz>&bRzb-{)6|i1m*16gLecftl0W#0g-@EdG3xb$# z6bLyuse2XmoSM${6tyr(j9=fY&B{Y7AW$S6Esv`5D!72(i4V=McBM_me(_c#VxVOz~Q zRRFN7I(?Y{y)3E|w3$Zt8;;L|REmvnZNFOdDuG7pa>2r2_*T`Zn9G_?7!w{_947Oq z!X4oK_Hlx^O4mjS_KfHPArZ!nx0uYGBx5dKF#Nhr*COnoJ+sk1;?mP%OaQd{nx_U~ z)VYm!TaRI+)w`|_0L0#Rqk?xtmbW1yT$-}Y{Ukw(x=Du?6*pSmWtrn-1hC`zT^tr` zw87sdg6SGOvt)ObRNegR#wBRAraV)o+dMn`>2$Ah(NUm3FxmH0#zz zxnvJh>p4PVt#yd(8NL7Zw5Lm2WpAgsYzW)=9f(meX@0lGgsP;Sy&WoScv2#*3mmwd zgp+H8OzAz&YWaGzh|QW=m<=S-Ss4*iWcdaeZyT2Hvm3Ix^u~{^zqU7AUg@oVxszuv zI_5!fet_qiM5v?aW~yq0_U2>_-QGdj4r33dOzm)y_Mb#?ckYq`R()t-eCQvR8H^;Z zRTHZ}ic*tcNFEiW@JWkvGmKF}BoXu>Vp%ERvPLy1S!|#N$3FyM-QDzguk1DP`G$AG zHa|&50Meyn9@Ln3d` z!SepZqcgAN$iyx(Qy#q=o^8H9*R>Z{w^Fy$O|HlgUfxHuk__ZDoB@of@|Od_l4tum z1&pT^)O!?t6Q{mg0LG>(wLO_EzRCB==PZ__bUGOl>!~D)3!gL*GPq-6nVr=v*loPI zy`Lat;pKQ=_rT^4)*~0GUn+jn-=%pC0m?^_tA<(FoT`yv7w_4RN}P$99cAf{)>o57 zJKpR(cKjsj9TSsG_5p38h7 z5eT8c=7FN3h)-F4Y%5IKBI+fHI!`fsBsP*zjJ8dCDc+I9ZxI!K-fx{z*3}|Vd^Dkp zqwZLvNXX)}_xO%60XXZ#hz?-5<6`BfpTw?M2v~Rq|L_9P&bMBymo^^-%SS!c zC80lh6R{9%nF%0oRp5q>_8K-1gLO-cZ+F&VS1-@BD9{*1u#WU?txnJbjS%PZJgi+hCO z4wy~sn4%0!^TIA$@pYaPVVkQp&ktI~`rfneKN|@ddrXr&XsJn<>n|mF4L|8xn3ur* z1D2GyW@{X&y?LweMoy(j3^u;PiVX1P+cRI!=@^Dzsa@}uOd!dBe##P($?Y358;B*R zU61v@EG0^s5}Zp%-Y)1g`7W#fO+>?G1pk|X+6CasD{;A*iuBtQhJ&BI^~l3Plj9ef z_TNj=(3(Z*+h%XYD2K4;TNoyDKvb!-_RHN@n}8i{m05^z$=tp2d{&-V4hA3+&s|d{ z>@NCUG54GK-31*?Yy86aNl;1_`{ry+mA-W0S!~&PGakdenmb|{??BMXk!}O&e|#MP z78=&v}iei5#5BI$0FiAQpaFOFh}-88VoFUsN$G`&_QhEEuuC|@HORL>gBkxZ%;+jfijqN?+d&1d|NB!4!|7CqJotT zco`f@ti^`ygv$oUb0hYijzEMrmA?Wawc}dBdk#&9;H7Dz*)78>*Yl~%_S-PK%494Y zvogJ?TQ|rDDK7~m$zPSzTbMOY($V4*pjW6z+%2vI7|-pyAD*u&d~5)f?vNw~@MYz+ zOA-DyA9bV&5K0%=B$QoqV=BPF(Sb3~@QAb2KWAc~ZjKwaH`1T_(US zQ)ROIn!EGF@$S7K3g4m|;snr{_{C$hnMxwKuQdBH`BaIrd>O8sKUhS;=&R)mZY~*` ztIEs3YnpNCMwin_1mf^!N(XPeloac1T=kLHYn${>GWzl)(>SfXD-Gor<|1b}M>+xN zS!PD3kwq*3Jd$!mufjJ%AVEThzd^X$42Vm}QoFi|57)2)*6c|hrVxkEu>15F9wE0cF$4>)JhK4#DEt(1$gz}fIS`x`vAj2} zT=N5%eK*X?-1~bp4Ya0)k=oeNCy6VNW(4PxM+mAUkENWd{<7M_j5R04J=lj+7sR}r zE(Pn0%={upFAXE7=*MHEfZ^Nh6@4T-{E20=1q&kN(sB-oVJOS!)#vu1t4N9rCgRP1 zk}xI}Os*egzgONK+CC@yA4NGgO{!H_@&l4A=<~X_!HGD9!mb^#iLL}9=&iJT)O>-p z6zGTBSa6n|U0cV_NWM76Gleu9_rUCoeiykV9a}{*jZBK#tkZ1jiRp}VpsWRzBzinc z2?t=KRZ|j4NX{EN1sUh|M{j!l#v?Y(B*Ug$GB+n1cSAW_zWhox4sfh>+KJtN;8*8P&!pC0)!Z-912=NBdR|eQfG8gI^yX;~^&7&}WtF`=p1icsOA{TXCu!zy zNn9y^IY?EhvO;p9T>q@W75)5^*_z0vL3GH8BAGG<1FcLb1EuZZ9mqMTNO8*Jb2~5O z$ZkT6jR}4M)Q5Ljv#4b@wXD}(*IA386<)ya8hV0WE{;Li5l3g28y*T2`;yOEakjmd zA&b2lYD=X1L)K|1=l)<4caBFdQm5aSQTWRg6~ww29=!j9T#sTnQa7Ovu*>UO!RBla zCjs-lIHFx^BeY>VKDkS%wt>wr*2bdlEvsCAqv=SL+f`d6yE-n@`e`gCdCSq#@zW;} zyYv!A$IEHF1LyCs@rr}H!;8i*aTROveucq6o~b)3;z;`i1r4?9HITqMc@DhWPeG25}3Ya*RuowYnmN!*C? zm*Uf(vXdgUq%G7HO7n*7_I6T6Yi#=*`xI#-dggJNU(0PXhwO?UPX5ms=8qCsR4FcM z+Ta2Orrx;qmBC;^(05N^s1bGG1Vs0QfJE&tkzV#_z{(cW=5jPC;B+L46Ig~x{y(n38)JBWPP2xet zr|kro{@!xv)Fd*8qCq44T+Z*yCNbmud4!^$%%J}rRR|FR%q!bckc7$qsLAit6QKmu zBT({%t-ug9o<<4&;s*OAYE!>OgK?$Rg1YDo!oYzCP|H81Rb_R76W7R#{X=)F&y+N7 z0(MHwgGCRm2dPNnT=}TrH}599xklvEp41f$ic>oPVL|P*Dd(HdKHnZOx9d@`w#o49 z=Z3v9EZl{}%}YQXgmid31&z2ILzsQuL6q97Ao!czH-@Zcn|e{r{R6s7DliRs2ao;p z4F=y;8-s;}g<2a^x(LGciTCdc0U|pc$6xmT-KyWgrr%y@$nh%Rm+ZYZIr=`7!aO_K z+fAl~T+g3XLbFz0BK$Z9^?0-7^V?qV*O6Sow>`fCsZ(sR)H}0L4st5;0Z9Vav5RK> z_wHH+wi6W<{H`9fME;O!=rWo@ugWX|C;;!5X0Hg(Y_S6#y_Z7{L5xsH(T&VY70>Fi z=hND2nim$J-`iSFa_!lJ%`cB_)n;0~7Ft;-lWrT^N)bSVy?NK&F_L*(O4Ddf| zt8&8Zu4hVjI7I7pq1{>U^CumJ8sO6GCA+)GK<~nKW2%!1GvOqI27sl&2?{J@Nh(5Q z8oXk~-E74-Ke=es^eam)g6Es;yXmHt>60(ytsRN&eIG~Ze*}N~1dC<^r$wTrEPuGu z@-gNu8M1FdUoYcV9)Z~Ya-{*dZ+2D~cXSpp*wygupk^KJ{vKpyjx%@GyTb0h&_jmdfKrN9R@F0jpv)$1@cwF z@nuWQfxcMufJfblc>CwGZFa`Exa}GEo`;Ov7UX8Wn-GWvuC%in#Mj+!o7s2x3O3=y zXY`1D6z@ClZK|BJrYcw+ae$PTvBT(D*FL`-Zzoy57EK55zvRl;jDSG?M)J|lXP}a$UF9nbqZhq$((zs6+C7eTD&ykUnUV^;gNYd@*Br`v_bJq#SBu4{gkDc*xO6-#&(?q#r{K-se;i5n&gEjj z?&PO8YfUJLQETJKO;(tT)^X+wSk3;PyMl)4qav zA4=O`h+usH8B@md<=ojdu7p~m0J?IZtYuh-4Mueg2aD19N3Mnh+YNnKc@fjIvx4zU z8garVI=6Cemn%#1opk1Fj-meIajV#+DDg*A_oKM|DF|MKg5bQZ#Lv=y|L77K+7Qa2 zax#gpg|GeJk%>mTFb*l$6qL`ad z2}&qal(|iO+0BLAy0=58W$>S$^*{gNPC7Ig!KpLs`Lkq!hnk4S$Q4lqh7t*#7EnVE zqP2rQ$QeEB^F2MMML)eb7LNWM5b_$s04~f4GuqKVfygUrrkj6Esd^(#F>HBwmG1oE zFYuo}gf0X4!n~n6ePTa5H}RAa!Cr)=6|_(ugKr~VUa^`}$C293%*uV`2OpzE9#S(S8j%3Z_Llfa>DS} z)x3N+Bwu7i-?EvkK-e_i=2S7hoDr?YB;1&hAoW*G<&RT%suURYyrLdByrYLrl_enX z9x{s^wr;QHWoc=3RKAV3@1-`qG*_)xDS|WL#a~Oie)MI9Sy1z8Yr1r3X~E+i#?(H?mRgc7* zY2DPd4e*!I@TP;NMd`_>US2sf2e;K0R31lY8@p?I4SfNCs*@(!_1_0? zPQf#l25#C!t{z-_E^?H}i0xyK_c3Y6QVE!L*Z@RI3E*U^Q_Xnz8LnS?aK_gGY-4<# zrcM3OeC?dCKZ!uqa$SUF`vQu3f!7b2%09Y!Lya)f!^z7pP87`gF3T;Djm`RVQzd7f z*o6$8d;zY!>fM^OC|U`wrNXgE8has^nfC9ZV4SfUM&Q9vN)?BgB9S zF}hUact_Tfe!?++9MwZ8TD>}i`uuKzJoIv}vJx{TcfIr-qraXCGCR|#pVRcUEJ)rjr1 z{-Jy&RvXOpMLkn^*aDoDx+Rh-vtJT;>Fo*yiG()5fHp%`(LWrRwlC3GyY8;G%*v#Z z(24J@_w=OSd`XvJbD%;lnAzCLEK;2v)SXcd-%X4*D1i8 zY!B7OhQN7sS=5be?m5bQ=vIDRvNxR8UDbxQbHQmTX7CQ^7H+g1iJapWcxw-&`1pG} zQqi(ZcDY4x@z0MbPY6$`5A7=pr*#Do@A80e>dDCVNHz1QDw4*Xyhbm^Zm5;56OjCB zDqzOVfC&$g!Zv);_9DAD zVP$$ug}P+CL2}c}0KCo-&vqb$g!E^SL7PHK*B{Co@Nr&w&OPdj5A!9Z@^?5h6aLUP zbZYWtvlX6kpB*WMCVXGcC4YW}p}@=zH1 z@!8KeK+@K4O&$w}!u_exdJB)vHcKHpRVC@F9Cp~gj~X2e?fFgZoFP@M&Ptn1+8Pr1 z*v0$U%gcN)uBDQ$EFt$>O5uIhBtsH%V`v>n zeZ=Ns#jhz48Y>U>70wtx~!svH64Loq`!5@O?TFt)~; z`}B@APGmFag$IAhr9rQ!un^)%v_GyMdRHOV{?gK8FYhJ9bthE9=Eqtz2pDOsLu>~J z5pimJqC`0u@MLHZ?ekl$)GI_p_RZz-F(>vXCv?YjrFCyCrmwGk=r|UiTI&_)l<;6O z&<2wB4>X>jgM4!4f#+FU12ucX{p(eLQR{~0YrV?Fu6}vW7W%$HY`Rl5KqGY@i0q=E zSjsSnU}9c*`xPQYy>Rj4hU1aaAOr2qLn8?dGAJ&4FcM{h+1qHF{b+pvqOtS19}srW zjxZk8EFbsv9viz^uhu6+YrO_JV?j&u=D~cA7ulWcg?DxdBfw&1wFJlqBja6Ul-(HP z@$?N>0Y~5f=>nbaXkkuxNxySC$?S8Vj3{R%M`|3*h|B|dZ=$1NkzeiDkpgJGL?J~r z!hJwsW(+83k|BRGL+OBblMIs#%3s46Z^l_l#ToDtapX^mVCaJGgbRD3G^SX=A5QX3L^9N!eR0u#UE^YT)e6A8cQlv zWoo;!qv+jDQQIJmQaX2+%AdK74{tW?5zlY4`x02OvD zw798mX$ib*GhzjWvl`WJph+W8Ulp5_l9Y&n+qvUlw|*f&9TG7ztlwVt1J0Mu{h8;j zs=Ik6GP|6#Qf@L(;!=%ktzvV%UWS zr*POJ$Vj1b@lmaF;0>#hf9pq=kP3-^Eqv?TpAC1Am)1%_u@AnJ zM=}=Vd+z@=Wz|2YsUVCc2`$Zgf=PXe40ag7{w}R;JB2KL_y_CBKZ<+GH_k_ECw`RX zm{`Gfs4&;8KVh(^8bZY#r|XD~?{1ya7`B)K|JLr-jd|Wh50jKGNIA~H^JaIgEfXxq z5`!dNbC2{qrz3lSe_Suk`K~M1ra`R#a8wYmVVw>o zK+TLWat|6XmmxwHB$ zXwTw^vd=vlYt3;CFn3FT|A{Kr{rhw)5RgoWyJEJSAkcX6eaDC}~Pv&eTWlIRNv=kD|YIeG?N-3W0 zeq@i6UJJQg_?C<_-!udd zN@Eq1-AS6Ae3QF=zYG2~{|L(3`bN+K=%0tR9J=yXCy&=1v{cRy>7{iijPc0P?AEb& zET|~;TzrKfyZ2zViKeGvWHTLRT;7LXr6$_0Vp5(26kypGtEQAEH$_0k>Dhi>lbpLxp%M%sYnWZrnyT~+CfOs z$ho4)yd3mGnb@XvQ(&3dKbnL^YgS^UjpVXIX%?Ch$oXu500mt)gKheaPC+4=Q{(j) zw|6e`^?CNIxpL3Q^6~`pn^vYEJ1~bdu8&|6NZgRGMN~X=Hu;*9S=GV*PVtiGY-02y zxW)LIN80{o?hvl|lSRG5IC4`3*di;6xs73__UYHSo40LPmK*)CaduysbB zvlA!Hl*a%sAvT34sa)1Q94Qogtzwfqzp*F00N#R(&y30hZfWLo_cMHcndM8#i#`f@ zR+6^sY%KD8E3Qx3pzH{^Y;gcZH6t+Zw5_T6C`d^jfwx7h7<4dBv1JJ$3G2tvmm-hG zX0>aaC`YfNq}q^K{dBX9dBbnvuVQ0zxWk-ProE}Lh~p@;B)DneHIs3=JYhovhrBJ1 zvY86S;#uBDdiZnot$3{ql@C^+F%ZK%bj@9rK7)7h2wJTFSnBbI_wEoj5=~o4VEs=1%M0%cg<(GkzGbGM$IG!k*5&pQp6%^ z2lVkGHcAw4pMMAfaO{-K$xTbdPNs<>fgI=n+cg3vMy$4z&7VI*o}C>PJg!*7)f)?cfBkd5Cm)_xYa zg3rs5ffpaSA*SYuFd5NrJxDa$T5AY~^uBwW9<$VH0risL$%p8b>DftQ z)Ff@%a9^%oaVuv}q3K%)bV(dL*x#JJukBf6Xy-vn2RY=-19Q@RUXO`-|I(>7ma#6h zoAy#p)$+?AMiS(x<|m<>8@Ui67Voq$~mJnZyw)%23)*r z8D|_m-mJ?0FkArSOWzal<~71x8q{=k*{tLf(OT4J>RD%>qC+vk#2Ni|SGUFDJ5023 zfiF}ZBU!0>vOq!aFb|-j57Djl>Vt}IG2_6Rj`1n#JU=TaQC5@@eRJiQy(OY4Xo85r zI2M$Qbt0yXk4u1X-y?>tu7qwYn|V;H@b!Yp2~=vF#`#lpLRlF*@CvSe7y$lktL*oa zHfz{Xw1StvJAe8hKhA+1@O`+XuHRnG?&bbe%5d8jT??L)a#VWOR@jtWIK( zca&CQRn-dQ#|yk43eqcGMwA^&%fs0eUpq}TX8@zhk z&pN_!c%SY1E#MVmoEM-iDc5eoeBR(w3c?NZU<}~BeBWn9L1kZ{I=h1eE#@r<&5|1U zTAOp)*7;+k-zkTU>aMSzj$kFZA(DG$5E_&Nu9Ke`s2A5)uJ4RTL58kn1^lYN0*yfJ zb^x4|`?d5T7>D?G|7RxF${r=N=TlR=*!a@danEKm&gslWdYwbIzV*b-WDFHs%@!ga zGq66O;tf#P+u2m(&MUc{Z`oVzG4^XX*Bw#qng?&{TO=WM9AIOJpy9l*+U zTeZw~T^$-luG-re!DW1JS;2d|X`#yzzzar+%zU3Z`&jvhy-7t3`hafYMjE{I(Lkv- z5xbk*+Cb;B!T2T^B>$ilGU=l^mK|VhG`b0<*Oeh5VA4Hc8Fmvgl6;0-wD(DXiW)MO zrU{bA3RiO@wU;gWq`54CZ^%mPW&v6b$~R)YTKGV0zN9`9+bRYOEitblzq(v4*I_Wu z)dMy`gjYw{@g6gr-m+{-+>SJl%c~s1je!!r)K-I>DCBAi{9kwDzsI>dHl!e{IGExN z(Lo=lj^}UVYSz0KIXmw0(Yd@e8SW-6D9;#6)MWcTB&$pSvS$bOJgy{k_@xoirUSf| zu~NO~($N>Mj(KH-g)T=D@?UhnILf(HYcr*OTP(lJNsp6bnKse^I8BruuY$*<=HAoL zW<`rfn+A2F$06_#s&7i`6(6gyPEh6PO|UiUK@)yKt6kzbb(+$CrJTy2KxYW1BaEUeHEK<1yWVCZhv2}N|Lqj~&C{4{5qaO+Z_$=Ldej`XHQf@v=7 z>oY(T>p2LyjqF}&iq>^}9Q*V%eN;hHSa;f|XK14w8@?oZ3Oo$?*QEj{Hwv^ zeSL?HU9{Nu_X4V?;z~NL_MWes#Z_TyzYycVYRu~($lc_K`{&3gK=!BgCq&gsGCl~V z_Nyyxs@N%es5sc^_i+#uWG)aXlBWhvkx;xlNYtWgH6Qkq7f##E@8PcXez*HO2xKdf zW97?@I)XvllViX-`T?4&J%m9_;H3TuGKTZfF2SWnU=uSZ*OYv)FkCn>3#|caP=2uc zV||*>Ppl71ImP;o+yTVV&U0R9bw%2(=apDVTsxU*${PW-+|Llc4KY3rzZG?6iGY!f zGt({>eaR&DK1+5cZDUU3By>#-THe5_yBpN@w~7Bqjg*bpGCpx{(!2d!pC_7nvkoL8 z+=0`T8RLkQt`ylv-4L_{`BmF4>~2FHsSyzJZeJSLzFa&g` z6S#ZB!ADPa0Td{zKuImPq|fjP0Vts$>T9^NEDfrZ60jTLHLxS+ zz=BbVG`}syC$Ftn^WO>TtRRagRMz>%iv_HyaK-?;t7L_olXT+wn&qo;of18ui+>RY zqW!GUy-yWBh9*nsF+LC5wX`uzR~;ywW6Ge$MC$=B0p66cHCAAP+0wV`S^?zRd(4?g z^QF{dzx4J=Ia#brUfiiVbT4I6j3@A7oO@qiZEK+>x1z(^m3xMRSJszDxq0=8v-ZiB z8qzm3a5JSD)(RmudWi{3y}%pn6OT>Cun+emb0bSZ=aAd zv)8;D^iAoUd>m+s#DUA9ofaw;3z1i!*aPIDNXj)U4S2t9Fkv6JqI1Gz@*T9@1!_nO zMggSD86atqbB0b~I$Kw*U858Xz`~xn1KKgX4tUBATvu|cl`7Og*{tiGP(d$}pCHtq zlzNe4@ZT5w#n`+&YpA;}}0Cjb-KBMd0v!oorM7YDT16^ptrciCojz zX=W)&sJItPr;;tra-~{981mJ!F}M)sGd)O9eJ5iY-9bCtwunm6ef%Ent#Anqgz9|( za?@U|DF{u6pd%V3k=pv4NJ39?=MM9^Mu4`Af5%+Jtf>d4V9>sU$*a$nSg(nIu4@+w z7M)<>1vP6*WO+>zpLlADD`eC1lge|O&yj|}c6Vo`lSKf4WJt@?tb<8|5aF?rT^8R% z{pb%y;b%fySN^DMn!;njki!8zqkbjXR(Vre5QFYA=PS#Q7|vl(n9K6;X0g0k;<==y z%xYL7=Z#OrYbQ$2#t3_7HSJH?S+s6zr97VBO2qCrylm2Y_l6wz;{M~+Bbx+yQKiAE{}d$P$; zMP{W&uIO$1LQ9M)yET@3zbI;|2c6Yl8LPFcoveM{s)o;tM4n0p_$seTtiYv$(lNf7 zul5~Ic{#HvsXVEX!6Ne>;PFl+C-h6#F_;Hj$M>!$4uMZH6Ujs_BRQw{#?v@q``x>R zUCBuf%A1lyQDX_Bm?~^)v%gsxiQu{oR>8j5y`W@h0cS-goUTKdAS}s-Y@lx{r>Z1L zib4J%jA$Y)9DHI@FnRkHAlMVd^OkQv<%G8OP@QvuJeRaIzF=c!l}!k@he1;$o={NN zdy*?v91GeVBcsk_gw17i&nJL2GIq8^XC+bM3IOI$YDoH)JHLW;4;;Cb`@H=nz+d9^ z_uWmP$-4+#wjKllPhrUb6Hm5xx7;x3Ug4G-8MU=sHs#%Sjg#thQWs`7g%^2`Ot2W z7t$)2>?*(K60L)U;v6nn{tc*4K_IeE-O`$xDjtfP^7`swg{2=zYw{*H%_0%%EB8Nk za>gon9IN~2*QzEbVqz4vB3AeC*`Xrhs}Yg5U+*42pcScd)Hm>QaQC)I+mQL#2oEre z0`<{r|D|n|N7$Ctd+Qqq+ZWPa9iwq?HY-YGkOB$|XcgD?LX9V`8x%M_!1Kn4G|yEa zSFSHA>(=+_jR6xs*vX3!=YHZeU2nG}*e1|!&U%&K?A>#QNgG#ej3Ao13C7AJWItFa z+Mu21_dCTuUv+TlH?5@V#0USy~yao|4Dw>!r7Rl?BE zZ~TzV<>yHE<0qP+afp2Ur-F&+sQ-LHNrnNl%F^f5ZPT6>l3+HS9$PG;dkM_?mF;LPLC%F&Cef6McZ%0eNn0NgHU_J)*S z|L57P!`;dux_XWbe5g@Vnq2>Xg<*fDOJ_~fB$(8)(e~?vgoxLY15x`M*Ojn!!%@S* z^rg>G!w11wzb{XQT@=8_-Z&UJu;Vj}&^F1|@ly2mPeSP|MxMyMmdwsYyL1)3^CZN~ zEdUN%IJa^2Fx>Owsr;NQcrw9fYMXENwm)1f9KILPD9>EuHb|mw-DC3*PcMZJ*G zy!l+u&gY={aM{R{PL9AQ7T^u=S*Dz0r=db{DQBcrX^l`k2b0K8Q1~8>2(_i4S`2 z!}qQ2{L{D7s#~yn#g-XmWo1J5C+d3va<*K=k@M5<`T6yK|A~LpablGI>+bMhd_n(q zvShI5&I&D5dM|$X-@fC2`Q6YXDgimNS0FO<-~PY9`f0rK0Su2FHBkGd5d8C5NU;D< zKPubxA4@0xuV3P$3wU~7%VS;whu_}+@^%0HKkVUp!9?0a{kfK9(UzRLaEnZnv)Vs3c*P|ku0d1F9=>UF|-*^8#aefX<1juh3 z*bx{9)}uhnnw+Q6PvY+W<`G&y0{N-so@8`YhZur3kF4hW!p7fiAOt#j>m9pz2&&$& z26yZvS-V!HxZ!$6%WtlDDW2sOwXkD2nM2R;=ivVRC;sLB4^z5E?!4qVR3P}5XVyco z<~rm^NX`a_7PSfLa4rlKn2?=OP-nXixA@4>2q%XJs^8X>3OYyz{-r_y4*0$+5>QcI zf!87Uw&@_RghUYlEj5w(Ff{i23L56!iIdy0bzrf`Yku=)o?e{7$2qXbt4%g-5C^G} zPSXn9eKn)oop`WOj>!NJ0jC;-uVn&iqtqwZ`735`1d{=@W+@^f*WnOg8H6_Mn$%zK z^2(Pf-n@|H<>cq*m7nk{5!=-SB)8>iQSC#eMg52_%XK&~gk|mq2R-4KI3S>JKpX>d zXG4YjTA(d_)o+M3g5p4NkmEW%AcV(zAnqDMryg;EbrI7Pr|G}5C~?Pq^7V!Ht<0+5IlZCYb(FKe}S3ZV}*;M+rHD% zyv>fkrSWMD-RS1hw@@Md%{AxzPdLJa-g)q9v1^laV!x2lM{k1TEV1;o^w7Ki$VLoy zjmAOZy!G!oK;UyACQo@GO$tf)@;e-VG>z~q^uEI5@79zIB0<0NlfMu2>%{;ov)69@ zdYQiOS&@8lM~qYoh0v=tprM`zpl-*xgyvAjcrx+1l>DgGC=)&ub!lqX8ii2M?}kOm zp#(t& zeBVVI5#X+RLN}S-$T;0))exd$eCyzS>eM#fmn5@f)g5_ zM^^RsD ztSwAu^!1U-Yyee!1XuQA9wS?M|A+5Pd5;fx%9*2Y{?vUOIuD1678yHGZsdv0AMU99 zuN;T41#qyVs3JokaU0ZwG?CG2iJ}U-fZh-^*lQmQhvrNU@Fp7Lb;z8y;PuLi3vpRv zLVys0nw8z$qUS&-mIN;uKnC6NVXc7gwZ*q5_#p3!vWJiCxW0sCqVPX+z zJXFC8HuT+pP)8D_(3eS|KCv27G((aAnYLCAYauaPOm@M0NFWJ$VW~d%j@MrETmv{d6%D zwhQF5aeHRV4UbM{0wkR8G^4msSdQ;I!{D`0&8Zx0w27}6v-V=(4%i0jr^;8me%rS! ztEL2~?KDSmvp}7&mZW8F?iXLn-Zv401KFT0vZaxaD-0sjK^RP5cvEjxqlTO5Xv4^T zCikZ4T)m>{Vh`TLkc)rA68ogbWiDxjoFslfPT!I@d|j|*n#i8X&1+-+x@~h^X*A!m zUoS5pt=D%b&2xlXR&M217Hj8M`<#(jT=`QE{9iJ2{UpQz*1e)V{NG<3pJbjp0MyS- zpiflEw=AiUP4VjAYS|`NssMKGYts8+GCh+eo!5`#wd-le4FT{Gf)Za|R!xXG#(pGGe3Xpgf!0QPt%wM<+lK0|)HkTQ75(DNJE0xORE!p6+0mf?&-@N@P* z=tU^@1zhdghE^vN23w^1O%1m*3>RNLV~RV*BE2`S)^=t4+I3iFf^#d8e~5MfoZPk& z5*PqYWJP_AlNpq@p^flFvI%c+km2hU;O@hq&4q1Qg+?zRX|1H14~V`Li@#-Z)lf)% z?(G{SSV4X%62$hC1W22`4y5(cSgiv#A}z2nl4ea@d6VGVw@L6w7dP>JYEvUfz9tST zq8=zHJzY^J4xEhj-ds-f1+HW1aPJx*QO!p$)(LmJfm>Mp%x$j1_*zvcmT zvU1fAZvlvX)z$r$tv7D?E0H_8TExLejM~rnmpsT9?7YSXt@WBNDV>s7sS$+mJssMa>vOdo-4_a&sg`f-hvEp zdaEMrLQ>vAVyuG#H*4u@&~Q{=@|vONr&j%({UUaL6V3P8`pB)@%z$JBX8VHO0VRC9E+z-esCHLv?IiLKi~1n66Tr zV2=x9eY%Q$t@we1eTC$1%=BUd4}-6b*Kpa zukT2=3dC&Xfq}1wDm@-WB49#y5Y0WD3wSV2G;QPoi{H(w@1$$O&~P=W?Ylt_TTg=3 z=1p;B#b;%>Uq&5$hV~<7WSzr7i`Y+!Lz@@-(382q7)b2vStKO0V|p;*57~M$a0ITd zcnwrLE2L(*Qw%%@9wWb!OmD3i6AstBxROx|yCpHR#JT%vkcO?TXVSwpa z2hN62dqcvc-CR@v3s_~ZpRY-2hf29ge1-KRd87lYq-N({wi=QPq6SL6n;IZnr^_mF zni4b@G7mNn_D$%dd>;5J)&ceM>#R6j1|O1B+RoLUnk;aq$(w;UX(hL~Qwhkh+Qz38 zi;FsvN`3iKiL{8lfpywTITdIl%gY>7h4;{`oBo_fdRcwdBlr%@xt7!_tr|PT(JaK) zTpIJ9HMFF&2b#S|*7Ym-hPtY^U2QbR)+oZfRey5L7;ceuKqxq9-8pN{#!Xj_Wo6f)LYVYA# zekk+*2{VZTh+9`TURdG~=+G7}qiGt*B?lzA9Y=!%LJBXQXT5s%^K;<5dO-o7PWbqt zaV+iBQ6YNz3$MVn5ytp8TZWDWm(82{O@gY_- z>J$bipmCSJKN@l0$5B!v_Mq`12F>R#BaRrP_?H)QYtsbb<_}!&|Bxv8mL?SR;w>~d z_V(`d$E>U8&Y7d#!EEFJn$GRq+H-#L%YmhJ;9%vv&O%0EwJ~QhR8Bp=bBkEBb@R&d z!F#r_FL=#a3DRc~kq%}URt{>dhpqiXgL6G!_1bDVa=0U16elwGeWxXQha_%yBK!=O zO$>v%3?aj?JcC+O$xTR$I|jx#`U&zZyc;lm;EDwaw*6=I4gc(D50oPxSIh)m3Y462LnA($KI?B5XX%dK-CBO|YR9&{1k2X6%* z<*dBUg(nqQ;18DoEls|5EAh!`)^?|@&(AVr1+Cn(I5hM5n-wGD)O;o>od%t`QLRBd z)5NO@lS?7j9{ zbIm!|$Km1~FJ6f~grc$FnMO%r%AzeWYX%t4C%9DG1$Vtq<8LTZnr5yQprIW~;B#%s zwN+WQb^|)v2UkAN%R}NZ-C46r8|BJ0bP$yU-_F)yXIl>(%t74okDCtQ)@2jb#{|3f zPHBvvEq^oTU9u~d)~y6|x+ojCpVd@(dSKQHj@puFCf>znRg{?tjiw~nwq=T0s#kmo z_IPvYj`50ecS8FRqQ_(H&&JPm-MNC0gG+QEbSg&J@oR#8FEIaX4LR}nb6Oiv)py{&1@8sH zLbuxC&T%bfMh!oQ$2K?2(D(PE9A zsBO72e<_HbHSQ(n)n0x*xg|nAvt^owp%qLhHz%@VGF3HraQWJPrfG8T;FPPoo9$47 zz}XUhh4|AyJOiy=Do%V-WbjBiGQx&wP?I_MS_Aj-eI5}k<0*%bQ68V|4NSKc)gH38 zwrTB4qv>roF;is-XL%#?5BA!Us#a_gyRSJ29X!R>U{tjn8q1DVA$5zao#O}bkL6}5 zxbNfenUQsvV$6-Y@B#U06>sRAbkSr^Y!;o^`<%Jw_cG)7Cig_#V>+)^=sd+_-(U5O}R;qf*j~rm7O%U zH(5O{tKC&spS^d@mQF82JktOTh(V*-1vwBIyVCb-(UDWCXcuGWoUU}XPhC*UU|;w5 zw_4R}{*zm~hX&TP=yki^mS5J~g})9okD;sYP>I8o-caT=b$Gc6D#~-n>G5mGEc1bS zt>y>nHXUljn0ApX&mQe~7H(8Za?+kk`R3Q;SV!%Q7u86jC>2Z-5&yJY!QnuJEtBPO zx5a6MI+VL7O9kkxOu9=ImA^-@h+z5VLRSIF`8RbeFa24Dp2V-pHHFU3?6`Q;x znSh3@bYCCKaB=@?1WBVD@(wsyv`8P3!gO+P#`@D?b5HFY(ZTyhjrnFD&70pcnNl|g z>jR`fIkmdq!o88ibVotNN}sWt5^80 zOIMfB&=uu+>dl$W>mpZnA+Rf$&Cme0uBE#ArlTWG2c1K z6i`5&1QB~NyVuZnXPVAXow0?bBPXGN>-^{uWOab_#51i(BC`~W^??b(MFt&^?PD{= zwp@Z+;jv$0M-Lv_<~Z$~TerCwKJ*~MP}aCgHo$D3-51DyEGJD$N$~KXC;YVWONe+J z`;%9zK_9iZvbLpjn||J0-(jM~YI+eHlb`##BUng~C0Gbc zL)q-YG)}RyX977fpaf3L+L-)#PKy7YFU*H_M+74%NF;N)LF;Tnu|6ShpI-6sdZ2pD=;2(3$$(U|Y?nm9g%HXx_*mjXs%7m_=w;8I!J zbN9%{LP~qqh2nB2KAXHDwgp2tf^ulIRocaZI^)@>I*lo<3-#locNUo0+|Qm(YI|=3 zM1R)x`Ebsjtb{v4X&3j6pqY6}N-Wx{VS!HB6}xp*6=}si+$L2jUuU-TjEg3*ec_tJ@KdfeNLk|`hzU}*<>N55#`jbEI z1qJhcF~H2Y3~3_b;yl-vcB#cdVE@pb9w7y8yz*$bethP=&Ej<5e&!ut5syDU2vZM_ zKL(3mb?dq>>LW}+;y$gZN**|^dE?CJX{wwdL_A%F!3=x4_j0F^ojfbUjCc6BMsweK z*pUlz0Nr1C$tF4X{BE%cl}Di9DEnbP(#R(9F;FpvA);G(`2B_cFa>!eDn!y*>_D>^ zSNZe{d$@4>rzjq_14uJ-jeSbS>K-A{z&alZMOEl#oC3wKaDd&VIFL|^(b>K|cums+ z&6}`WOeT5Mob~8|37>4I$oz=6|JK>0qu zE9nd-(V)^Js7BWx=W(D+y1-;>%Gpp8K&#{t%3jgMv8ots12ImFVn-n6f`~yrF$HuL ztXW@Ze=b0Ci)ODh-#>|nYu^z3w^`y!Tm!(cIc@sPTa$W>q>C=Q#Rs~WRhHn#I_c~$ zPEd5+ntpvaO81^Vm?wAaP>Nt>n^NW6Aul)({tcCSDo9s@#MUYs>ubU{Li;YMK3;-y z`Mx*EYr6d8bo-%)<qcJu8b{SeL!Sq# ze_s0UeBZ0%E^RwRC@vSj9IDX#6f0H}hfSZ~Gh4NO2ZoAO?m-x)onPLl*jKGe|IB%& z*Y3;h?%9AMyU%X}ff*^1;-BVFN7UfX8!!q*OLrCt3UsKnup(leX!U0V`l4ih}3 z!-v=&Si+Pygvaak!_z;I7OHeZYg2#@sv}+^`AB@T{n@5hDv0sUDl%$onX%w;Q=Gp= ze!BhAnp#0bu{sFTJg%)Fqy>Q-f*cI30p^*2O4?5pv>vO^T0f(;GdY5 z-ZISS(Gou!m|X|4MN^o;I|I6a15;PdKGY77-$f%B@EJ@$^hv+kpWvOkpc=3r8YH7^ zUAyh1+J*oTt^0WPa5AW}j%h^RA`!T#>-X}KK>~@q>Pxf2-i*m!Xn@7|>NeYPd=OR+ zW)*+Gh9z54T`L{kV{tQ03|zWu?+myeh={%;wmf_QCwSKR~xuzlj-r?ST2g!H@W3hLvB$=xG{ODW$?HiEB@q@ z<~lJ8sJiF!xQTeoX*s0_Pk4s*kvE&5AzizuLep-E!9a#Y;^}W7DTI)kYVZRn3a>*Y^-&mr-orE} zMy)$%;I8hMP{S8QMK#1seV#M}iyMY$S}G;(ZJ-7x5!=7IUzB$C6Z8BPpiBsI=Rp4B zRN7*Gfgz$=(grCeL(P&N@l(I}!M^i`Vx_2zyW3Nz*$;F<#wS$_`LoeMCVOsF< zJ+1O6n=3(;bYJiI*{sr6O)2hY88zq3VL+(DI<4wcVZ8}iK9jtKN7@>z6|c%;*D7>j z*RtX{H0*-0o(R@a{kZZcq(Ns=xH5ZASr%>0ik9}=lsJp;$8<9XsOUqZQWU&tFQl5q z`$If$8~EL3GNn|zeaRAEiYbNCh!2Y3Z)dz0g`I{U1q_myeJ#qZpix(FGp;-HcLDmJ zMaFO@!2jJ2Ch1$|KX}tKZ<2IU7LP;7(Ve&q`B%wqc~#$Afg%l$>rnUU8|a_<19>Tg z0@=8jrSGKAjT~pBzX6H1-!nKRjR-rhJ99W8#WeAc%6VG2FRpx<%-nik1mHpET^0=! z$W;FZlShU|=_t4Zsl5}BXl5t9$Vm-R8h%Sn)O(LQeK_R2mxRLJn~Vbpvso3GLNn`1 z;f|PP&H}Q_$Zeil#pfBxl{j&~oh(E?+=7UkV4P7wYpisSkI=*B1%sMq3*p))nVZKZ0-7sVx=MmgsF?8Uc59;sVg5xh% zZ}acG2b3`x8JtfcFpt3fCj*gQ_GJK>!qe+>+Q&FWcz=&%VagEYxri=@ehbjDrEvQD z5A}}^{$2vahWjyPhkyTGf3`c+W*}E|J?xpjR60R0RO!L{{MUhta{?$;B0KzAA9xf$MEd&Zlcu#XV*5q z$}&cL!#fmyL-9PzE%Io_i74{uMl5fRAujIOq{W225lk1(dN8q(M=Rqe-lQZQHaH{a z6whq*1VS(atZ71FfMUxFVP4~rQgd7lqUN-HAIWLA8XG`k6efyC%;<&ln|~Y* z)u*Z)ErM=v84#6=^`BmER(i)m^8K$y@bGDpI;VI2@*0YTUU)%(Fn@_Wrl;*lZ+Y`~ zZ?X9)=uTtKMIFoZ+*lWzPBCh_slEBp>{W5`f`!cAD|2mK5>pLt=$5=8+CLKXqUWh= znRR!m;93&X?q5E}-+eRQfM>vi9;W8fA0MoXH`sTY8=5AADIx`D(7Kyy!W+^Qj55~NP&v06wx-K-$IdA);{SbW`*ymzbp;I;QnIEnd9Gy^; zdKkV$eF{7zKJ)iV)?42sMaLURrowA{j}M;q=Z;b8F5FFU`cJ;j1U~N_i7(rQ97g-! z?8)zrYv1#Ip^~yWzSFCRgU z;#1Ib<$TS(fAWI={e=Hr!_BDm|EYbr04zeG*qC#X9M`%_9qd4=akab5Nt*DtJKmHB z_w}Cq{d~fk0WU=YP9({68|5#5C$k&Q&mpSFgY_PGS(WRh!l1_Q2LI#w$K*%j-EuoY zUDORao<1R`$#DR|CLw^RYMOlQtD0Q=60#sE2fmik!rw4n^}01(wg1-Wv6HpF#b8IK zX3h(uy~B5JNF2u{XiCp-l%pd0@F8BjcO-t(^JstDV~P8K;R?|u=#|=E^CcoXrv4%A z=?2(EloY}e)&kkEo)9#QpL z>X(~aqEtf1{dfxFO+V7TrDubv1#8M5KR8c$RpJ!m1&O>l7V;#WBI``)5PC6*6ku4J zVNH&KLrrHlu#yH_;Ti}j1AAZh9$DI_08~%58HG5&RqRmJa-pN*-W3>Y8dL^t5;tmi ze7Oh$(rwMub62d*ESnrP;UM9mW4%8Na&MNVgu8gb$aAI))CeoN1~9Ypfww_~b1vua zo>(|nz518!)m#U4m^N>ZPY1lE4iNnM6(b1D*Qzi+w+3rshEQ^0qCe7%jUwx*KY#oX ze&BYNHt9EYa7VitYD4pC?P~&KqH-fRP`WySfQ*V?5IU#bV3|acHL-^_8(Aw9gJn-; z-~I^8b+bB$%!i=WnS}1hJl3@EF$k?F)mvAf0h;3q_BLy|&=PA!^F?D&z+XXOiLU|0?U0)4nOLq|XW(x(^a>5Tc})U_~?20PfMF9N14 zcHfsVflWX+%sAPQxyCvlaNV-W?y@0uVsEL7+va${0ylOAdW-w0spvb|4Ug`6ro|8^*T9vMspzPVr=rovp#Y%^n~LC0OnTD1DkkK^8y z>P0AmhQ(S#Yu&^D=DA}fiTw{wr0Eq@1??>ZrbCZe{UUfRu{wQgkRIAq>;k0hZa~i` zeI1}{E#L%wj{=ss(G@^|7uy9<$5XhM`a#pDDzKR!%q*X&rWUk#eHXk~n&yTZUOxT$ znl{sp{ZqZ8OD`Lf1oi935dH{1mv zSSRD~YmF8wufS-Ybk(%@7K7rekDQ2~8x6DwV0Fs_ek}N3MPx=V2|fb!prQv3Z6@;G zgVd0hmUPB<{M?Zl_`Jo=aImeb0;w{3K6+W!I6m@ji>5ou$r=JQ_c~Z0!y-H#(8op< zUXS4jAqqm2FpqkdxLEd^!+>~CW99F2Kd19p{Onhws!RDlI5oCNJ+g*lm4R7K(LZ>lSs?wTQK3Xe#l9w&)N%*<6ERAT zwA0pRcqAlB;;DvlwXwoO9VhW=STV*BLhZmoH>}sX+o5&N-I%zq;YBf71>nzn7G}XL zN0=bleC=dLZZ+E^5JT;e#&%U5+d41QG+Glv-DdF-Xgoup^cmI=h5;yDpz0!x>E~R4 zj)GgsX>P@Xz9Dgzz-5|zZ?JAVX(8XH{#+^dJ`hcD-y9|XfAQK=ON>t!Ym z_M&+Jlh9ORwcHcOvMAe{nyFXjf0mQ}z16me&v0isfK#$j(CQ1)2@S~#S$B<8kHQLc z>3-x}0}j|RY{ertk?-O6mkfSukf^7|E1*%Rr@mssu=(Q}X2_&x^ZEGB{z#>5x0@dE zfum8#ZFj0eiiRb<9WmN_&9jT?aMGW5A;xxDooTpJwzIN(9-fV5MTa_%M)>Ym;rZg6 zA2Az;&qXfoKaTojh1z|#OYy++kk2z@F&m6Q(}X}m-CcJbdT$n#c*)<^fk!tEjz`3z zbFA2ki*)pP1m<&aL+qn;!?a5_`rzlDdtF9+h%}|LAzg5ki!$ZjQ9lW0f~PEugP`W{ zj<1pKjNFrL2i}D%hIcQmsD}bY!03dAinwz%Ycgf^o-E64!KXy?o7?xnNn3;FEc!OJn@{x1&xFEle`gBr-up-9 ztw6bYHrB_^id#p}Bh7}`G}70&uhD^rGpSj?%02Su0oc0G|9k?9?B3eJM^n^X-fb2p z7(oJJUh`VVJ#+0la24l25Q^OHVvH!TOGS7hY!KPRkXx4dAad5iyPRNJwT0bY1mTab+QPgcf!^ zn^?q{M)0!#iRs@U8xlGsP39t!IxXJr2hkI?cSB%?2d&EKA87#Q5U#MM=C&JrZCZH* zEM|s!Sf6$6lq8pu0zh^N{zxV0vq0NTI&0Z&zNmGRL$OkN4ZNVkErP z!n86SVj1yxCA^D0wd)k=Q z?L?xfBm~5mE(kIs@o(1d#qO7Zq!HqfiQdQR1gT)#>biN?QIi7s`vpg)cJNgTS$OQ$kMjWPxL%3D}zz>+WGM$ zj|x@XPX&%?2O1>J?Y#1d;%A!hBRc(ps(BYur!+hJ6lM~wYyuy{ZIGlnjL#=I{ybXm z@Eo(Rs)xP@_v->8)a6+H%-$A*=VpO*ncual?)x#gNt;M|X}Dd_q5!4f*r zmQ+pmB0ZJ8YCk;SSxcAbkXqYFiqap2OLEABS~<2!yy|&eR>g9fFw9q5v(B$Ulg%a+Qo+b$!uS- z`4u^&SzD3Fzjzj=n=#H5JCnzN4hG;qkQ@khJkb7m9hDH|5~_8cr<}eD^x$R5FOJ+L zEjin~J`y^1mV>tWGw&y7$gSjk=ZJP480LpbExJ70%%~qh2Hyat_BB%)dD}B!kV6Kc z@la}1wJ0Rk2E03)TE_Rtx!~ETIwr-5x*n-jeWoFZ#Uv_)pZd-Ny zEZ!{b!n!DNrDdFqL`1PY+_K~a|GZLX-2a$Yv#sw{ z8Z$RwR*dBfmM>*@cuRqzr&74@CiCjJ`Zd>)eX88&-EOZB3RGSrqIbrufZBijj^N;Z z=e#FwYd{QM`jmbtg3MTGftNj^wg3zzP7*A#7)s$92ziP@L@foO*Hdnt3psAsIS)R( zVAV*-EqX@Ulu3BV+9kqI8V-RtE^h@mGCh~vH<*?c)-c9I%G_c1;`YXLv)9d~bV($D zB;o^N?p1II9c{9fW$n)zd*oxAw=5kq1lM2}nqv6aQ@+~Zy``u_u#%SsNY!;R=&K(K zSYnittT65OAdVJOx7LG+XlF33z_FYI9hDgtsU8t68Y@RPqupO8f}3Rq{bm|L?{G1G z^Qh5jpfaPguxZDS6U%arQ9o+?=6A9VT>EKr(s zF3LQQTDH^7Ywk#lW#gq1_eT%Zcu(rNRLSz>n%3vxIfMr`pSvP9RX*DV46xPZXvtGN zvMe~snxBG=1L`>_RutPrzTEAIM)hj?H&Y!%2ec zMdUcn^Ol?{xZNoVC%Q`VvO4?Uh3zqE%O1GTebGl4%FD1^J7C7n@Pr&H=mnbQSOv`Q zIvUAyJa1QFwz|O%b@qCehY6s}SRk1pX;Z{>A!5mk69i|5MO3EsWx!P4rW+JPkWk?) z4J$pr1M_pdweGEcgA{dUEqWDEMj6heyg?zw zlQ~g|seVa|?Y4;p*qQU#tRCk76OWu;HKTnm?@a-DARUF5LGH5FhbnKfaI(BUN?M$B z!&^|VRd6RjO6Hz{J6hd)WB~C-Kh*gfM!l&6vBqR(=_s4Hrg&y6DvU3YZ@^s0K4c{m z?}wL+1ne(3c2wcn6b%F5Z1^I@tjiF3k@x!Uf>H8UgJNIaZMuxwdAqJ$G%y8wNY#a4V87k}yvKb(UEk3kX5?4iy-r*f?^{VX;;SFXHx zTB!fyu(woN{Yx_OaiDn87!;8gr+&IXu)PXb*pWXLX!pqkuT}SD^^1d59LO8;;;(V&A02Uk$61zN+OY=NXf)L{ zgcmD{?0wb3_QQ${Hxp+i-c9nPtBfCCRMYOgwDQ^gM{4pHaT?X(=7$xrU-1jrxRy49 zGjB4Ew^U90WE0Jgqboy|?VI-U(=@q6VlXwQc0Z8MD~l1!HuMe1Q2UTo#EY>@+q}Lk zATe7J_*Ikv1+E09T-2}<%M2(s-WIR!jrOLe>n zq+(x9w;c@$mj{)*)5h9D8G>rnFn1?D(wa#z>sZIK!{n+Uak9n^qxRe@*0Az*mRvC= zk$%#A8&$2%AQws}=de&ex0AQJ%%F^6fELelTntR`q=A;!`_PBx<(%$&2kR6|p}`5U zb8~qEGNpIS4CKsOheCP>Jb$y(I`lCB3U*W+8Q)CgFwCUnrcHNsqDp^;nk&R@pZ4vH zqzBjXi;DR^2aIc?)!wT4x*}KJq8k2A%E%GfINWF8#$6cyRl+yu%YK_4_XRyCU<3;h z)V|twlh0Wz@1UQSD`mee_+?O4@0-u^+AECH+wz`}hLw8++}Jt8H$b3x6?9OXy{4v4oK1WXyg#8(HXXa3ExwsV-rr0=SwX-fi{sNq3oTP_;L;iN=l&gJCc!t zbYT|9^K?f8_uHrn*UPxqRP8kw54VvKx5Ay1rWw z)Xo%}3uMon=1Hv@Yj3Su7S4!i2^bUYj88icl3b5VCC#m@j9j}8sL>}K(p#{n+m41A zSsj0=uSqXHn3`NDi?!hFlvrslaRdR(sM$s8LuGZ!Yit==T*Mnc5B!h9>{qO@e%EF? zxl8RLj7x($n@$tb$z5H=sylyd5EkiYyV6?bY4WphyX805K z#_bb1K!;tRIeb7TILx`eRbK z8O0r#XZs}(|`6dq%DP_TE*5=Wm=W^SEo90Od zm#VltK0}sbpRDB}cj2IfR3|IBv^Tj>oI^SLeR&>oR#4igSObQ&USdqN+)`9A5Z?>T ze6eEbA>ZXaH8&H#ob{F@iPW;lD5&m`T0yg5-8V1~tSMC!zbK&5PV;ju*HSQy1f{0@ zIWW@UZQbR>XY6#z(SEW^y3oq;GYm=Bigz1iSTorctQsKl{K)g;3Yfdq3GFSHzm@f_ z)tb%kJv`wAqSm?Rp|W|5OA&I5Sy1_O6zn{*{p_uk!*o$X)O>qlmEA5hoTv#$CKP+| zPQM9Zm;#3wnWqsC0_U7MPJYw4ZtZ(^P6#U={651XX!OxDk(m4*7zp?od1<|}IA1=A zvIx|F*t;;={GLc)ZmPF8bFgVImu5ER>dp@;3RgnaTZ@k+6?)gw>Z$O(>;@nF_Q&bh zFJ^UL9DL>+pM(+}b%M*dziHuE9YTqYm8zSg?`F+%2(@rzPpe$`acwbX0q~X~SsAT$ z3K#d9vSKLSj{J&7{!Ys;U}KTBG~_~r!v*b_Zg~72pURCd$jb58v(Sg9OAe7xz74Z{ z3PU;Q1l$&{ihluU7gquaJDuD6j-#!3PYbdapn#>0>pU6_Q=zz1M9QuG-=N@PhPgXVwff|N zp$91F%D5nbJS-qh9J(Ly{dkI0=m+|VP#@DBhGBUV+YC;5-MRB7qp+j8?sY=D)v0Gn zZ8CXtmZc+4JYp1|*cK{bULwGi-ld;H+%9mZ&qvqMJW5_c%Qo&xi<-<_$lnB;jllF# zo+r^S(e8{S2kZpBOs{luQ_4bx>rEb%Zb^m*lRjy3)W6m4g4T-P{+JhH;mNCg5*gDT ztRV#uW7k2$JB&tto>IEE%oodpG#eM`3YsD7bLiEmggZ*?*I{l^ttYx|uDi%bOD=IZ1wnu5>_*0B*tn`un%1One&W0~GltUF^q_eWGgY*DGFHCMntE)M2qwG? z8@yThFcy`pSKymoI7jel^Q!p~W&WZ~)uAa-d6yN8&hmp7K1_bUyxwxb#pJ=>^0T!S zeF~!)8hAE)+l`55QzF~E_!hM#&+|W%@qNN)sGo;fg#`LrStG`%X7JH|mGCUWfepBx zr>ClT6xwpD>P|n+*RA`K=#CX3$qZD1;M2m%AF9PegIpCoj-;Hlale)*ai~U{LYW0i zA4b?8FxN;QWMz=PGZ)s0@O*dXV_3*Y<|s|SfljNn&hT=l^qZEw z71IO@ScA1{KZyjCr4!L#CU|jUe+ZajOf8B~Q6?JtDHkdUf(*pa={;xBBGX8D<2V~s zpK)WYS@E1tJToQE);!CHAqI<#H>udwDO*PVf!VonC*eg}LmTDAxQt)KhcFRuDWNDT z?mfm&-oe=H)qG)srC>VY!g`yuUS&)qok}ePJ^#o@Zhv>Up3Zey)>Uwh?B~}>5ld(su8lg1*RClgSU(lmD zEsK+=?st$D>1H+(l$%GknT-rm0Ho#85gq+cNDDuZAhqp0Z@tF03IkBkQ*SFS(3KR9 zzV@7u#1GBm+{{y{jhB?NYe0MUd9!dDmqj_@M~qY1Q##G`^6J53VaA*4Bn@X9Uq$)>yqkO_BXCkOT zLERl3=B%BdX|d8h0hN?BbZNdyl94#e$VJN;iXnF-32-8EgKKpr#=x~P z-xUI#)w~$_5X{fG22IhdF+fv1xlZP59{+rnMWu_YP3<%tl|;e=S2XA96t|+L!cfu9 z%R3y7@h2#~748q4+xH=_<=yqHCJE+dwLGeKQtrta2IUO2i7ES??I&bL1t>2+F*+A= zt>aP<=c=XTMfH@$wZzuZsZ(C&QOESUpiJvw%2w$Vf$2(qpIQ>fw#_Rk!NB|?>D{7%*$DV_kcNandLxwK?s5@p&^O%>6whnB*L zHQB1xwB^wHU0$0mh5OtG)B6}8k=kZsPF*|@G66* zlY6K?_*IG^p})H)6<)CY9k;bH1E<^za;N=wTtiMSL1JwBT=?5qxkMGxjLI+EGkPn% z>x7b`>h#BXwq#?cb8@JUP4-EZT%jbjNg}~^AUJ+w+f% z4bwcDE!EUQD8>5>4^3Qgl5|?|WFGvglKw1L(JOOi9P;pZiZo7+YAavVnlu#G;xMS_ ziYGI#OnjDGJXtUuwD8>GM?&y7h)IXaW*wU+KTeBo3d|QEN;ZA%2&ehEDX6wnk}Bss zu)rxd&QTogD8Q~D$g>piEE9E^mJrT9^qaX%&|{jU42{g!(e0=Q_KhpU7m|ohr8fSt z25W-}3FaEgg!Yv1%SjKCf!7+Y_V9^Y*7rv`9OAi}&t+kWsIdUc)HfA7P;!2e-1X&q=SZ zHD`G=qsh;oIX9dkOqbl+b98x##JIuZ1qXff#m~Sx;2L*AJTRT!_W&>b4hi2e*=pZ#GBNnksGC96WRxF;OH zoP^TvM(wo;Y439|cGp|4yB+fw3~XEK*wkzJFCJm0a|Ht;EZOxP!pgA%9j45lme>Pe zTu@R5I>fcxrqE7yj5d>fF2WDTcVmV}ES0PsFzE@MjJN=tN80!_T0w~zmS&yjcZB%o zyPXVLfw-(b@V*Rcw{m3=fc+*tCk{V~p6oz`f5!JmDFciWmUh3SA2p)HN0K(i2yoJ> zGBXYa*2Z3uCol+P9hxFS1gkeF>+mRv62>9$dq`9o3oGaH;FxuSvuFovv9vcUFeMU5 z4bn`zPu8>a=x4dkjSg&!1XjYh371l6BZ|N0rQyCU@$79m_xw1jZ-cH^;hsm8HQ8&$ zbrPnN;7BpoG~@tI$R$AMp~5q@bRYk4h96@N^q*^BP992TT+hKyVp}hs)Mf*Wmr1Cg zGGheoo_HE`R+~QeA*kSpU;1D|vNF$pW~03{a*wHMdWAW|{u_xi3@FY*`(qy0utT4R zujc;omuQ&ttQBpGRpgtiJIEm0OjFC0!rUdX2RynMeCl3CU3l{rk^Mpzz%8=92HI9; zg&An>`1%@jmln0WC_@ue%`tZimtc1fgiwgKmN6iTw* zW4zuVMp^$20I5oO9-nvPkUHBThmkq;i|R=*Z?pug4Vs7;ka=p)Wr+D6YY5Q+!vcK| z_lVOxm@7%zgfwQAEqyR$_nN_SW0V_X#In&G6=Kqm(S#Y9Ca2Flc`6OC(~kGQNwT0- zI7*B<><)6$$G$&zHx3C5g*4vJ%_BjIOPko(7aYD99N+EH^igcP1m$?bgIlLMAhdO( z%*vnwxR4%K%kiuO4-@3P;#p=19YI*{MfJpdk^BrF8p`pDCfnsmDwOEK)+e-1qpr+; zr0-N{BUE-nyk8VqvSylh$Xt~0gzl7&0OYfdSE3%k*fE@Btq{xW&^?XCi|9*qf5Ssw zHTKG(dB=&4V~3WI-IKf|y*B*{H8yMJ0k4@d_JP@{_4#W6=}b#fIBM~TpjL7-39mBk zDqzwq9sEMCp<`5u+VR=-mQ{GclxMy{Le*4fnE1dqoVTnMx!R(sdQ>yF;!`Tyz-WUc z=zY5s&pJ4&3;K!hVjmbEAz_VE8Ucr@Ye1h+aV~34Fy>L7zCe7>vfza$b(2uN3^hV4 z$QsYHzeG)M${U)pO!Xa zD{QeblcSCEB>oLM*hv<*ONw3;6$PJ(1ToD^BaKOpIiAQoRfu5PexjqfQvE3?mYs`$ zR1(FTa93R!rxs?x4Vs*79784q*5Il1Q3Vw$CwKOf$>t@cOv>>~jDV?wBeFTytf_0X zhfKH(u&^iD93ms_dC6qo+8~vD@%TkT^<&1QM2VzJdH9@A*+T>FT193w>nPyFRt-|s zD`4_Ak4tG*p*6SDuPMra#9#TD@gBO;|P}dDpo^*zky9^mV&2w((@{A*fu?KY`BBl1UUUPzzREn@Yzbn@t ze`2a>OlZH+r#i~7Z7>v5>p;NkpZMuT{A&MEYq*-Mj)y(yi5GFnHQ4Ybq9?|#tPcX{ zHaC=fXW-H%5ir{2e4aR~rgUC9)j8Qa7uBDDfTWF8^JDE1AZ^ClTzrxmTDdIvAOMq@ zUH(uSlqyO_w7F2_=_+INM>Ox5GlY%*4KTf6M6E8e{aDt)|x2T2w z`a@&!K;!}Y&?m6eVQjE>>SMA(xm-gl7|G4Jm@-!QVElLN@7oq0Xsy{tvYcxIy%-P2 zJp}TsGDmIh`Qb63{LMs4SyZi-+&LmLWIlP#+#p)*3OHD^<0~XtsbmbejA4apQ2rN@ z`VcG=oXn>#IbhWV$BxG%lw?98!7%xmcx(X4@JBJq+fhd~k60R1C)D~8kWw!iY3JP- zab}IIZbuoUn6skGm@`LY{yJ)%T*J=hh0m60_B6X0P>=5ArG0?Mifxz2r%}sGdQ19m z2jpK*jwvU)!7>(J?f$-|)q9~vbQ3Q82@Guh!R}2~oADHwd87f>Gv{_yzpqy7ro?_c z5^gjIwhQJl*N5kYMo7Ls^5dxeTa;t~2wie&%1l-6k5sjo!}C@wv+P zZ^(vNpO;RZ_!TM9CTW@pk{l4V=@CIKhDhN7Dm*G;)RM@Aq4$VNOV$74$#1_K4xScX z!2yNP0)w9KLM99)d^x#>OM1U-S;hbf&dPnNp$(|(ySy+p1@&spfuxI6__+jNF~=!j zQhPuEP%Q?_@TdG!Kg;#MfBSHD#rKeiMBbYCz63WR?ggH8-pn_DuD>da;(IQ_C@zCZ zl!d_9TRNak8~OyZSz?WQbtR=fYr^c^n>uDm5z(Q}lU$&1H4Tf)WI52l1&o)nNd7Qp=-RjBl z3f3=Og>*;$Ig{N`tpiwIT$>%LTgc+;YyeGO8@Uu^t~)-GmYHxWE21%^dO+sa1MZ1? zsP<58Y-h6KIMwgZ)oyR?kfWx%rP6Mp)lf8oZD79R{QNH;#SPEuE09HlBRRDCHq6v% zL|aeb1xHUgvnRcVD_24ZBo1qqn%A4eeQwJsUH)|o{Z*ld5%DhEr=Y0+u8m~#1A1?e zkehxpAdUN3+OupKEY{?x9N`UA=uCAXNZhG-ql$*eP)yM`>PfH zZXY$>W9;a&`Ai=H?SKj|SMbM`vU$+RNvEp}IbQs(ApgFSh9bCcHV?~xKOI_z z|HEsCqMX?3^l5?1Z^>IzRg(SLg#CV>Lc){r9wjwB;Qe~f=0Bm|A61G5oZ!)dD=d4r zK5pLhXNb4~BI8lQ9s523T+)+0hxxSil>ZFB|B4YP(s`4KEj~jn0EdyrD)84S7J6`x z^!v;6A^IU<%H_@I@#7_GII|6(;|ahWwK4DsBk6m;Ii-Y*$ov;k>R-QgeLr4wjcH4| z)_O?f{K&^QbED1JcV|+bgd%o+SF>8pMzQK>d-})l;-UQSfnx9aTM(Lbb zse0y5MAL`^I^2{RM#eGPkPtA|jMcDHjs8vtM!zq9v->R(0SKmM6_HHvRtp$E3E z```cd!)V_9KfD0`CYG8y!}`)xY){<`D*x+$BG85?IVkwAJN93m!2kSz>!(q((ru6O z-+b2J-{+gl!iEx3+tapx`0IbYl$g(GS1cY$++7yr$Fm3WCb zMAH{!2>$xB{{05{Wg$~gMN_@=9qunb{SQ~k+aIm&=a^8E|9mmF{Doo(9ES+nd)xkR zE$>d$lYA*~km^7D62C40#uknMo4_HWUlQ&=T-2ZMOrsC0>u+<4?Kcnee?DRo18@Y? ztYvm>jYa?QEB?O{Y<^wTpUe0ESb$L!z=NdR33_7bE8r+Pa{b$|l6pxb)Gjb_%?#b> z8(Hb++y32oL7N!qPuEs@HymSyozTr?2fWSsI-T@aq`zzlOe~5CLxhG4|MGMS_BccH zrVD0$=|bY)4bsT>9SzWz(m+D+$_YfS03TU3bur6uj%ko&7R$#9A%L}D@%S7vzu1)H z$%q%C-aTiJLT!dsB-C^no5IV12n|PMxBhNhu~j!xNT6{GrKvid#4Wx0mN8A8U)4Re z=QJLJacr|FGzTlVwCrm5kZ8E0JoJ&lA`pMNLB%;{Zylyhil1z|Qr9BL-*V5qE2=-^ zE5LapsH*eK5CSUr`_kHBp>jZ=S_>>R7E0>eYcoJy?&4(daSq+hsLTXw52qqfvgNmF z4&7uTfjQ(x=@eM zJ-dw2-5$jn>o9%C0U9+r8IBRrHc4xz0MQr^Hg-&FahHud{bKUmf>wkOK8uZGX;|ZFcij&9pO^!Jj5oA^bs)=sWg@STuK%Pur|@}J^`VI-*VqbSXHh!zXT-8DO=t(N zKc;bcHJ1_9daYL}D}F6^`EBtoH}&Pk;p!9Y3yY)+v|2-{HNtf+R;@#VcmpJtyN&ji z$%mII6rRQ;khImc7v33NaR_c^X4PTDDpdF64wPwCUdY$YE7xddGjVaXSq3iN zcUtRn6F6ILai{l~pZcfNa6#4nssi zqsOE0W&WAcn(@n1N1Oa*7Y;X@cXG$vC5&YN`|w+9`f={8IQo*Jqs&x`kINegvxnYg z(Tugt>Md10_nTi^6wNT0JZ?HQMzoWrAADE2u0-9Z#AME^H)1yG+y;4WjhQ{dD}m8i z{o>mWWhC-<0jX|He5Im0Kre2{CFcYynQOUY_)4#Br`Y|%)~Bc9>ewIMo>()j6OTAN za=>!xgk%0%=M+VgLE;+44QMRA6a~>DJk&RQAN3j;Te$N=)sd5GH_{~r7Fh5t2buRP zWm$FVyGy6iYq?)eXnNEnq*3Y-sa4|Axw5lDnnNSU$R=uG)~tYPynwNyqH`g?cX7=; z%5Rn2^fKX2x%YHj>g+b0q^zQn}9;EFN59P54HI?EUTjvxe=dWX2P-ato&oDWAK%C8@ zco4f*y
  • CX19?^9T==aHUFh)|$<7paN^)vrF}dnD$8>-<)eW6; zUCqlYPhPxus4(;GIo;QFf&7alYxb_)?EOpS_wq(8DztNE^9Bh_U(mhsRpWaZV|+a* zY$s!*;4}zcTaaI?e$B!;ngc0ltVtQ7Q*L|>PxmOISv$)&W2*K*NUI(_;O4qfX4<4( zNi8Lfb9o=CYlQn#CxYBJE_eD(QM{+JDW4b@HSAcREl5#oS>tTo(7qXFB2A?U!uySN znRpWig+j2dF9BZ^$EMMibbT#% zeZQnahD3++^S-K}Zs_-p5Rqo()e2=o*W7P+nx|`Oj%-D&|(LgzPeii&v2ID-} zUBpezKv}rJlc;ttOVnu=KSeb+tGtsdV8DOx(4nX|kC%YpSVil$y#lwQ@;u zp;c2;bI+9;Get#nK~n@OGiypI*V5EV6nET!T!3~`OA;3pR4O9`L~;QX1i#ncIdi^q z{_pC-3*P&Ep8L6%Unc7SGoP`g(GVyPx#5=BeCutEjIc4AKaA4Xr2#-~y(S|AhkRm8 z8h!;FlmgHXG#(hfH~PgJ_H<)S0FZBhoO!!r40wT^`~#iz`9vlV)77yr@ zyjjv)c|=8CCgNWb?)v3zzy`7_umt?SnT2D;zuq(*B)0qwQNM#6(FTh2G9Cr9agDC+ zxt|>TAyx?B`Ffufn*u<0j^ZejWHm@4Zae#orc?X!h`-#jqTqy? zB;wY3sk_#%6+ca>VLrFP!RKN)nZi~8to4%*h<6EJ zgwnSy09r`F%6tp8mg)h?+~IfsVTT^=JRI?94;fHBW)!MDP(T^R+-@!d_M(=W``+va z@xLBsk4NCtKK(Kk@CDBMztK6FhE_>l=7-6+L}%n5vje_w8)&UAFp_o{99i~Ay4cE= z5|#C`@af3H{H4uR;j1{w2^c8ag(t{;WkIwnnagWQ%TSCq>x_!LZh8I>dz@tiY-kfC z?E{YgKC8eAdmX&vS7=S`!$GY*KLEvzlIB}S`@3P4j@BOY=;21+)muZgHf|auXHt7R*dMu_2hunn$?b-?)f8$p8D$(1r38%EWD5VI1!s8` zXhm#SvpbCMYR_*&ztO~;4#C_BVJKx{(Ms8qw|joYc|&5>KRmp=zNEVf2UK>MYz*@DB`7S6K*ay2f#eFP(| z5<}?)!m3BbiH}#_6DEHm<1SqE>;QVf23Jmnu%sJ6ljayB@`Ahq{wk#k1+x>o@c;HT zB)T^#J*X*+l5}%+qgXo90V__x%r4Np|hb1l{JN)zev{j5!wV%%bUha-oL+7OH%!)RVArjk;oxBQb2mH2fmdxPrKI9GPnqJ;CMXtTn&BfERo^eQ;yVj(>RFI~Hri%YQRER^mfwTL2;%7Oo>?(MyM zsgT+YH4;Eq@(sJDo&)40kpZ0`e*B~`wPKe;;z9ibYt}9t1r+XM$!&7?ZbO0E4+Xd! zDc_Zsh%bQ^(hTB096$K142b4$r=bN_x!CNzV_43vBk)}(b_rxI`Bs|9u?eNVM~|*U%!2 zMP$9d@{x(~6o+~}_v>$7Fsmu>iLYnL;+lD6Wj1TQ%8vkzD&mzu{||=FT+y_L4vBMv5f!&k1P(el0+f3g@sZd6R{koi; zuUFANlp&|BF?OsOP$4A`_5OrL3YGgS?>DS$=ci^*iBoG9rC|RWt*~IdR#e1p@l|IW2h(svP{uKS=iuB(%|J8@PUqffYCTi_MoG$W!d(Uu5G>qMIYITzg2S>Ocwh zE!A%m2XJAK+lLo{ z#ThULAGC0`0wSQ)mP0YS1uDk z-cl0K*;=ppOH(Wxbj)5_?Y?L_Y;pB{B~UojyL_z*^kJF1ti-74F-mHw$T2bB31VJ( zAm0UZ018!$=K*E;&`i(zZ0}D=I7#=iv3AgRW^{J^{T4yRcrRDeQp|$ta zEiW2k*Sb}YE3VH0BYLz?c*-=OJv^Yf(+Ho%?AA8bq(Aw&b;U~{2WTYwne(4CDS*bg zeEG{t?4A^BX*%c%ubwz)ATW(^2TB$<-`hgiI*Tn_=~$nEXhi{{q1b7_E9-UsfaJ-e zR~p~%pdY3JnGs9Jl3Skt@TOO?4PjSszD&*Y&7SsgOwI8xjt*^a(i>kX)(xykwbrjr ze;scpbiAlKSBC>Nemz$HDF(br6S8zA8PKio7-Cs!oyE&GKt4zP1ehIF%C=d^lv5L%1`(<3W2oXBG0S3) z*UOt)`n8}t6WiFfAv!b@-a;SgOQ#PK_T={E9iLw0TM59G@{=PI@*ZnwbHl!F=<0Yi zAEU+(+P9Fr>~f~Je4TwqsO`fmx0OYmc{lj?5(fmg`zTy+-=`s(clZAe%q(^U1QcW1rF{hi>+Dk*En z4X{thn$5$P!pA*I5-E4r?%^ngS7pi4?kXKQpkeqcs+a_0{b+1JZQ#I;6{=y4S`bQgd4CgS~w9`%K*e!;fEOo-J6qTv2k#X`wR}LUL zTT)%V$_3N;_#uxDfmXfpzO6wJx&DrQZr2fUh)r~^-tyIwb7*7t9!HkGw9iR2+45|9 zuebZgZ$qHqPy7)a@^`6+aP=!Y3ZwDf@|5&6J^5GMdjE_$f7ZD*J0}ya4c#Ri0Fz5m zK-H4}pLJS6t-+%Wdol2bf9%|g1#(4RP=Kf5>G=%Dv8}LUq0gtoc^=)Wr%C4oeD6U& z)}=A7(J@0@qwW0G{4`mQP>)D!RX#uWhw^;A{Sm5t0drY^G#b;?J+LO+;DR+SfNOeF zbrV_lgKaNV8cGeEs-j}PPBuGU0anI}$Bd0GtUKMR?2E(xh^l7!WU>P?aILtgh-m-X0boE)2QY%5^0GQ=*{4zDa>*dzHF4P|l8 zHtszX_f|2U@wL6|lj>rcX$;MUDc|c<7A7sJ$=0lo@`~`w4=w`&5royRe-8O!2F7am(u?%AH(Jt?3ZOYk~5*p_Z>mt4EuV29RF@a^%P` zc&JxkYl?okEU?#(3;=xYRD7VGax@?_)U^7~!RG`ruZh>n>q`jCUZB(=^REUg+Xrmn zpbANWH1L7?43vp5SI3MF^%uOfCr>A->bM{xD42s_M3Bjg!W3)y2Hv>dTjh6)e~&t! zHmn@zJ|XZ!FGe3Vk<^e!+crhdYdcV4Y~6{i+XEZ4%F9%@kky4 z=$Uw%&Br0O>{Xj)+7*4y>3C+g*+}G`TR;0nuWL~bhdD7OUPcDc+3)zb;k3G!k7ua! zjauu|Ujs1wljjBZqLb&{vEBOw3q#mIt!oeU4h$N%7Hf=ErzxTeEi+yk z1QbZiFAh79#P&+=_rBeD{j7 zn8xT!X?QVp^~a?)R9m*$#_4m~(Vzlfdt=r?IAGCgfS!g|ShjQx`Sn;#9#M;CE$;`V z|2~*(kRieecR@4ZnEU4U^&ZzcaTFiC)ayA0!+zKQYWKT;clM41+uVIYR3FvZz=&kj z;f`OP)s)B0*yWB5t-#~!hGOYxfmsygM~J7=r=zUT`YF}g>LyChPB&k#^&(R-a|Fml zv1TW{F9pirQW#BEFZPYo;PeH`4>mfaui06_xF5dskZ*O)dYk^v?1{QLuSKJX!@r0{ z#Gf~8|MNi-_xI_+x;xVk5FwW;Y*`AN_~fEAgxz*I_$y*6E+-Guc@}f+m^|gBDH_6v z8WAjPGJElsjT+dFmnHD8kI`h0}UojF#0n}mibOh)d`E~s0r1#6zyKW`r<^BVcX{ag0>DeYr2#5 zb^+b+m~q;WChZs1)-8 zVHzuQl&3i8_E?v7G3&zmq#l@7U4urex=>orZ#`3#Q%$JJj*ZedA%W@n9MdZCi$`;2 zM{LD&3#G$UJilGj6I2muZ7_mVcA}a(rEQQ+mh1STrIP&IZss3wo$e|XK3GzR?9BcT zg3aREVULKt>`c4x{@Lc9+-VU!CEEIR5>E!dsKn9Z=USzMhbxc^trI>j1=Jj+=Yvp2CL2f#j}+|Z0ntCs_QoD z!~0FHss4iKJimzf@o9(9W~wp0AG*E&!fsW@_)3oO@hcZUx6ck?e^UG&BGMPQEdKCw zw9t2f9J=-LNGe0UJwsn=>zsaP{65L(7i<4 z2+PeMul@z{&&V4n9dd+hfZ3=b>W)j+0dTBuz_mK_A!c_+7!j)P&MddPoY*NO=+^dX zoyR}ga-ukjBV|Fk%lRYs-A8o;?3c%w8H8QRl zh@q%!IS2*^KYWB|#|4scPcQqqah|1J1j#&Bcbh*yp1zzIq~GP1{`*IyRKMxN0-MqB6agrV;-7Bok$9@3T_;4+cpRnCE{$~b4 z07d!(h1r38F9O0AU(q@%dgyV#EE}c0HIDhyCMh4BWIp*yT`};SU@RYHe!f_8be-Eq zI#qG5q`0P7-Q~isW}l`PY2U7C77Y8S@NOjm4?Wyg-+sNpz=>r%=$Z~2{4S(VwUy0J zprgH3I1RD&@3YJo-l`uB$D`Y)*-`PM$$3cXaJy)@@7hJNR|8lkExgH#3_sQiTU|29pB(P{ylT+J36Zt-?FvpG;mjV8sz|Xz3g?RP*qblG zPK!nmG-O3Tl@!Ahj~Lh41G6kqzPqPM*lgFC#b=QN}j6=}G%`9cZe!%gLu z5{_c3Am4eh(-XG*$a_;DlwxYMW`l5)6@98m|Mjh&3VzYF5mKCD!&v} zu#!I2jeAkG?p405iF8LsN1-a52~rTBIlBx@vssX`n-=0lU@hx_?aud-Ujko7JdRLa zIXJ1py=)8!ac1%xKIx4x24rei`KcmT2gJbQC8Y_nSC<%k#VOUa=Om&rtUs!xMX0&$ zJw9nr`f5`^wyTe&m^Pq18Q9=#kFWXQ4Bo`UPlRj|VhmMN;n*nNuHHL!%I8>@e#LU6 z^nnvR8Y{v@x#XlP)(3N>rR)>fy#k$JE?$3d7QOeE3z;h6T;{z&zNn>8fxAD&H$&Rr zlxG%Rh3+O9Ne@4cVw>3S_}babeyg*b0-2*rhnmg_h@2rk2_?L(?C!TvIi6LM-r%9I zt&ehUibA!O35cc~om6cma4?>NzRh|9gZdgPx(B308vm7f^$4ztiD^WO^^!&k*9+?*sFWJY85G#prj zCm?uX$dS=Zk=PiN%aUnmPr#_Z98!{XF%?A@!{f$yHX8}bso zhwQ(S3caf3Qh%N|8hB~2EsgVw!#z<5s<8AZ1K={A2Ns^wELlAx!II88$)E7X&4!a0 z$g*wSUHkrhFMPVUGUtZYdWHXQ#X-c@>$Z@GH*Z`*!D46&zAw_z*P5MH2hXRssb8g@ zkvX1H?YXdaXC?w*v+O~wPgshlPLR!pZ=v&ec;$H`DGD^ zSRRF_XEc|Yo06C}7U(}4?^gHygayPEf@=4q3;$@u!j6@B7F3V3un8z7KlPchK(EKLB2<_I@BuLS+X2~5Z=1+>`uV1~1%jz)ZLytvv|lrNlW16> zXWiui*(n;nhh3$5fqcF3=r;A&tG25%KH8{XHl9~z%pS0dd~v_K;>g=B9n(0}-B`M>sJ75S_I8uo+E;lW2I4t?K*^ zjaz~8PLy*s9~oHat_yQY*GZ%rz^*(&Kf&hOjn9{6XRSo}zCEj<*b5cc;z+JVVQ2U^ zG{E~+YXX#hUvo7IGig5vofZq{SGUboK3~!rt(&dZ**k_=R%ILm8Se(-uF5iA%aEj! z?Kdk{C0phrV+=G!h2EI@t!3#>s(OvE$>EiNR^lD^8HCGf<88Mui7qdv*7w@j?6Lor zJO7Zs(3d3Z^x56rTi}6Wo-#`>6VDl1L!-wAE5R{v=7m2tn)e?ox*r**y2EK0P@7Rh zA`THYKJgvdu5Zjg#PLaEoRjdc8$&(0vC7MXM+FOvcJ8OR{U9P)qfd~kqle5cOqKkh zc8(5M-XU>G-}|}_0^T9Mhn@NC2(Lx=^iGEoF3!ws?me1+fVzp3@Ry+UU=-*1CK++e zO+Kh~0q1|~)dkDl(GPrX0h;3ewI%wo9L-_W0Xs6?F#uE}o}%Vvx8OQ+3r182q%ih7 z*@0B}YHu-;P0eHc)oo;Ku*X-G)rp7&I+ZTxWM_T4#db*7L}X7sZ*gMH9I7pvZA{;D zx8$`<=aBtnq9%u75WD8lTeCKH^JEI37qEoFb6X{UtMH_|x%GtJFMyT1`7OdnB$_K# z>@L2M;JN$ewbS*n=@(zgWOFdv@@zX25p6+`UR+Myz+=s|CJdBErC}wPAYFp4m?audci7 z^N;HU@*YkU%2Zt>0uXx^2EW8Wj^rsu7&@#J$%J=lt9O?Dk?O38iIZhU;=^!A_G)h(qU{@(ulz4nkq%8(sNHSWmi3gn)i z1jlj$BnPxL-%bN8@Ldj+x2}a733679yK-q6+gNt$m|mGbTX#CyVt1we`Y5O~xHl0k z&=lRgBuSY^Gx^x~Ub{e<=k%SEZC~ks%jL3CH;&l1!VJXaT$Ya~Wqs6l`G^ug-lg&sh*75p&c^`9`WlP%T`LKyN1e11|Cn_~ zwnE;}A?pG-3wD8|g-l#4isv7LC0jv7+chtcQ!=HOF0Zx10LCL@4Q;)RPrU7uD9<;f zLcS6BGcyfg&Xy7TYJ*=bK5f4B;vvARdIG$v372lzwH&S;esMjra|ERGTA4ba`EcE~ zzCHJzi^Zuh#$D;wr(-=`HtvgXZfVkoNz-zBz=lm-m!fPw$E{0n5e=*GJnapw=ppMW zIlMUq4-a2^xU$60lJUcqF;k9!kK`%>>vM-dzVX!Im*zEvKU-`|dz>Hb??Q1r)5H4y zXh?%?S+@hkCvB9D18nq|;Z+|FM-fR`W{j5{8}rCp1eqQ>bLPbP-*=w4ckT9`yZX=X z8U0nXW!tCY9&fH@-=p`L-QMs{h5dD%&Yyp7L0qve4?ndndGqlLzXaWS|C7lzt}W?cIkQV(+x;YT!c@skT#ep<&3 zb}U^E32-N5n<2tva5r(6u&bcu2rR_p2`l*?6WBgol#Mi!mwMgbo_J~Ethn7tRX7Ao zQG!|RHrD8X5cMF)D=*gPrwsR438jVRHk1~%+y?%^$>Ksj}>`$QN2NQhJ6vp5K zE`(|BDm6=NYUxXT2FQ5^%e`S#a>TV+m5$>^lz_Go!~ILE~P|{Btp;3%~hgl ze(i45IVFNGJe&+VY+S5@(^0CiZ`7xdKNi7FOH+f{q0MqWl5=YmUCVRfr}jYP0SY&X z=wy%4{fIBGGTQ2z%L<2{W-QHA*JLfAJU1mxx%&-ITik(Y`iZ^9?d@(YgeA~tnAV-e zs6^=rP8j%A9fjK??>ly4W`F zBfqa#Wy-6C9TAQe9)@dT3!bHQ&V|*1bqB4F`aAa9F15M98KBiJys7WQmwE2cj;{XL zSiJllO2xp}2H%d>`b%6^e6OeyBLmy&J>HyKaA8&3_Q$uf) zd{&*YY|iCUYe1I5?}2S9Y)Ko)uG4=I8(2_CNeXl>$y^;r3Dc`tdI^&6lFKcf zHz>1@F#c%67uq=B#C?1ZGQ5CR(3Srhv}5T^2-+?+_MIUXv02(<=sI@zG>kpQRe^QO z(+opnj;#LZ&Us`!A;Qh?>l}2A!89$+*IdH^-d_v-^X|&)>=LkkL=D)jH8=Ug8x;$; zq+UBb3PhewWPN$H-t?ZeUw&Wx5%V!}^rQ9(9K_}$e882X?0qD~ ztsr9-P92|uXrWDZNre&Nx$N&ipOaQPX8V(3w{d?MhvIN%uAfV>LMyIi1@S9t5Q`6H z)3o{Q1@Gy#)HEOXCo&d5o-}oviVOe`Ay#y6_}fBwkN=D3YT5DCvbI0HGqrf`xdeC7 zu^LAI#BmsAj-GCq31lYw#nc3tz?GKW4%Hi|C(k#O)^>m9I1VO_96^uyh(9m~DGDjC zx1{?u_K$F$kRGS&7ZS`F0}g6&m$ZY^O`ud;jR0?Ae+{^s|Am4$) zfEPZe*EW}af)Q%cFSXz25)z~%cPGNzLsa#tt-VE-7>*V!4dL{6t-zL+N2oplm z;Sz3bC@z*IXgb49?gh4lt4loyXJY)K?6W+y!{l6hNU-TbROx7PWWBrmaiXa+Crq<- zru;}@fw6c;cSmm5>_Br{=zU&b%?_Ho5o#V}Tk$)2%k)GxeP zv=80zBiSIifxIYV_a>)8K>;)x1h(iyA+>BWF0%;<7+1CH&hRgGd~ZPriI*gWQY95S zuB@Q%;$}N5FSSENtNuj$*Ap5xDvm75DOSKWJsO{N-g-&>G^z;@aK67B21Uk|4CB;A zzZ_loJTbrUokLu9n>_l#VHGP}tu=->Af7C9lN3)Q)mlBX5%I3kuzo-8CMK!0p?2HZ z?~eA)1nZB-MJ8f1*vOQmt11EduGQ|mby~-n{)HpH+PTiX1+)+s(T^0|J9|xNtY8uE z?S@G+9P}D&`bgl?B)W`BP86arrndXb+!+qp6rXIMQlIZ;fVOfdmw)us1R+>X)Tz$@ z(M!Ga0EEnObqLa~e|gCjjkCh!vyCS#On}`BTjhN8W4;Vf_5I_Hl=lcOs{xVGn}_5Z zSE6U#+5O?E@r}&NT(D!!GLosJ=mT#mcBui~)#^0)8vjzi%7_Qe2fB~#N4TlsL}U-iC5;a0SfFbN5Y^0A%i3otb~SP55uH%G`1WK~(dIyU(0&LNGOZqFm0 zkDPlV(J|e|e6j~G1!&9Ixw-)}Uk-X(7hQZ1%6-&cV@9iRffk$a$y_KOw>YR8!`T^X z((I8}jzhA|sGX5?pd9gzh$K0JrjGj&vx2lMdlYW>|FEqzM}u78D4TO^T~-*3^C@27 z9e}S8zn$ryb%qkTwZ`~f;RZko-;n`yiB${!dW$;y^1QIBw%YLO>$N*8wa=gedq#Mj zOMKC`g$J5TZEx6jn2QWme1+;Y!3eHruSp>zswwQ%tC;5EC9&g9uVdMdrxt`|w1W4a=UBd_77pz`W7J|!$hhA)#)^V{l?AzS3JnEgNz%}#ipm(y4$q381R+<9AsL#sRSJZQKIb{eCFw9gf)#^$D z{Akqd&U)^eoJqF7oudDWO1mCw3x((B7x z)5a7o{{Tz{8w`^2#Q2vgP z09a%0Xy2adO6v{>GTE{Fw)M@Wu$fZl?=9?hw!J=9-MS&&aQiNyq+#fB9)P7_UHjaiqJwX?BIbZbzqqK7wlSH-I=j#*b2 z6z??Jn`kp|XCa@E7B+QgvZOz;jizd9Hgq-3E*pQ*JL4l_hO2+8|8F3vj&d)VUW*X* z5;Y~~42vas-iUj^$Fwfs97!cUh-$@DmN=z>m&apU)@(31A3LFBFa}Zku$f_i=p-M?0P`jq;q(WuY`j1Q7w{6T6$6h&&%U0#15jtZ=C1( z5S6X&5^dR8>DaIVor09GDkLA*QH7VCdnzRMmcpmnvH3Jm)<<@;!*8E%Lz>Bb_tX6A z>UD1n2opUxkTglsJ^HTqvgp zvD@dabWvmc>s!9D1nRmMr(MOZFP|TKiy0^GptpPOu0D@idM^P1`{Vk>Fd-GWkU*kY zMtWjgnR)COSZRv6lUHQs*fdfcvNf=+pXC`C%WtPcGjZbTZ}$uELW!<)WWQ^5Z{58B zT5K%Uwt^=bg2uJ>InL-^+u^bEG_;w^Uht_w0GRNlJg}Vf! z)eGMX4JdNf24~iE?7oW5NB@&&cdr@nU6coPMDPBW^Io}yo~^#Ne0cxH8&2yB#&44Q zGMI^qz~jHKq&q$bx)1d}ko01d*_G{I2>4yKThGU&0=!A+j|`Rmr+Eh&!#!mQup4A8 zw;Ef*R4XykD*=B~<=uX3s;gF4fOP}tzat`)b7jl67h4Y~_r69S^Saivvarkz^nYDS z_3Q`wG0eZi*Hjh93exPpqZcAsb;V$&W^v?d7+-q?-rDC7cS_%=BgIGcqu<=Ms|#!O zWT~|j$Op5q{}L3|HxF5!gM0xLw^ zYF(H!z1dA}Y?NdWTj7MgE4D=dSi|F9Qs$eK6ani`|H}F!jmLO|Z(Vahv?S0IdFO%2 z$gIzEt-!R4PEBX_pC!7r3<0AD%#*(I!|^(*JU-T*pcY6j{hI|KKFNW3RY$7>YI@Ht zS^!X!DvjhB1$!;b%f_*dPoqw(*eaw#x zFh|%?OPm0QbMM%b?Uf-SzLHcj?N?yJKOk926|PVETOjt~LhCmAFIt$gWG*XMLoz|S z+T@TD#zIqY1pE6gtfvYcTyKK# zWCiI6W^mPB5E?$RPuc|(1GV?U#_@6ecIbTi7e!A@mepR4?{A~fGLbUKLpF@!_o&F6cciC)G@XNz^m*P~*!)zN z^`^icWlT&@YCv|jQRR!=9Oq52lp3`xMQJ(JZ~5P|%2{Am!T+CG#Zj;VG$GoYC0Sx_ zc)ys~Udv__efNl;;dlXi4j0^Z`G*K5CvTx0l>9r8T#p0NOCtV^d<6eLI$(n>KOo-2 z`gUzMmZpq%k@2pa< zC`$VPjoHaet)CJ^u^+*KW}S5_QFnU#dw8{~ci0GAuY4s&^=6nD`}h&2=u-9Em4*$7 zMNS%p{r>mV*j2xzazEzTRGz2z)O02&l~3~A!(`%vN85vfONL2&p}ly+lfHwAQ*&Np zaeoz(8T;f^r^RAiSAJ75u+>b>H3+v&r0;M20Q^Oi?599CnxZqIWKR)Lkw;L+FwuDp zPO8Pur9~V_dAHXL>^Kgj*c*mSU0R9HqGx{|3)=VQL(Xz)+|s;8MO0<$L}RR;tMIu~ zQ4ms?1gQ#4Za`g~4jMU_MLf9%YjgoG$g?R>^6Jw7O=IANlvoru4ve3Ka!~Ixi+hz-<*iZ50-bM)os?r~= zwn)}4M6+Z)^T4wo$x<)i6GVG6|IFF=%)7D5PTyhQRl)E@F9Kml+GnO&>CC;I4!tsuz)H)-0XbeT2K*J25c_tt> zx)bE+N6ft{;b#zwN@bS;K%+nS6AjY_C-?}#nI*P%retr=1m?}{DV$*YuL4vI)&1sWeqp~f6BESNJH(@XPI#R(?b4l z`h}O_XB+aQ<9p8+*yXs2n$<}$C)2|J;$DBBJPDIKAo~Gcv%Q*%oIxr_kfs&b#BMw}s5{_Sob+N<{k#*Re^ zGC_ePldNQC%%_=>>wwX0N11K(B0H*!V9p?r=U?a5I}(K35`lho@{OsQ(yR66KKry_ zDJ`FrOmw-MV%-fF8-v&ms*D-hpEpVph!j3;VBD^v_)Cdv>}Wv;ZGzpSa2B=sI(yfDrPZ zbtGt4#~9h$p^WTs$QtN1ou9ec^|PDwDY#evP-WM*x!#fl;MpH+Uzry8BGZj&jcKS5 z_2>{mby_R`0C(YB_wioMBN7m?Y!H z)g0B6n6Wn5msRm$E#|@t)X2e_ZZ}?mu3QMOmF=qy#ZVsg^k5pYhqbIv_5%UK6N_dW z_sg}r2GQH@mG@o%msVc?)=lsBM3mN<85-AiCU}j-3oNejyut)F0e^p4pmx==pXxk*;#N~MaLZ@BX0BPXx%wy5tjT8v$@M`sewfZPc1xYi#n)@Q za4CuLs9}brdW-PEGIIhQLzBawl_Wjt$ZnD12^3q0N@WB0Rx72FP8-#?ZMXN}`@st< z=SP_$(HabL|v_tTMoxbhZ0HRy1 zjWK7sjmnYCqaj^l(OAPt&J?!Rhdz~9_CdS2X34p1uq2a$O5IQ$=qoZ_M6^H(N!2wQ zzccX-C4Y*XIS&H~%cCGYX^LQ#6X`J*Kku){Z7E)%GpOQ9zJh7XDOmYIH11HA=I=vE zS&4$A3YauG*yac8S?co}(-XMd-ir2RI4eyM>tqdV+@oAqVT)6dXUU>?>RVAqjB4Ck zZs*K_8kRHmQPeX@)QvcSGjEFCR9|eXl6~(DWl#T$4&y`o!h){q9QR7Nl^S>!k4d-K!6Qw})_6+R1;X`!9r(AMB{*!vr5wZ@*SMfU75%Uk; zJ!To`BiaJwmjB`Sqp#{Tnz<2y7$49)tA0n8Jbp6o1F;t+Acnl?f7vaLS5_WXZ2$HI zAgcf)#ZX@omn4VygNP+A~;TV6D)*SUcCqCYJ$yiA7KFHUTA-kmm)_E+VPu zhlI!wWDWtjVRTaNw2PMiG38zG5X>3#WLBGL&P{$e$SpDf5=Ngq*kN8F_9|NhIa@$= zfjG*(I;-l9wOb#eTbX$U$IAdLVZNUS%H?lslceNqQ!UB~f&e#h7gSQ68|vJlR9-4H z9lN|tmOOtb(jRK2@PzL`cM)d?&uA!)4_40Kx$Q$g4Z2b^ZB*bs4Y(zMSwp+09l)Fz z%!k@Yx$}h0RZ;AkyvRg-h{3Vr%BQ7Mk^KIkHdQ=8sp84<6-xCx`xdX9HF}s(tU3*M zFVO-LDhMk{bhP%J^AXxygl+TOW5RmlPrVkeZf<`LX}3dHYDDf^_tz}lT)P8N@|I>F2)e9H)lwfVf1c|sekc8tq zavN%UjY+Y!wgL8b>gp`P)xTGzcAwNt_1H~zf~BTV?q~0*idt6^1;>!2HMykeyMpI` zdy!ehZb!|oHlQ$dLiGY@a59_%Y@MPy&JZ8!m3grZJ4t>?i37#vfPw&0At4KV zxGHoU2z5{n_4Cak8;5>CZoz8(Y$uLd3xYYC+IHUY#n%Z~wYpM&x$^hi*`a#Fl zdS*E>uxP07P0%bRAHC32A!O$LsY)_}5XE>PX6d-L1)*J7a|QUY?8vWCiuB;Fq2)sr z8Pd@4hK}g~jzK@kv8QS^9(=^;zS~Qnd~wLc0;1|Wh%zKHtJ163WYTHQCCFq{h|k(} z5Me<@ANG~-+p}vRadITmvLfsgAb{~%qeQuGA%G{H7LgNOk`+cAfC~Krd>%t$n7)h{Aph4v6&Z@ap*C z<+IkGYkdw;O{(o31H59vQ)vN;876^N;|d#dWiFt=#^vyi*~nxr^9bxvHTbk(=}E6^ zQ7blT*<0@o&_!W{u3Wy<2rRO{u6ir<-gC;%Z-t*YUifZMY|)*Fq3~`sz7RfKT&78;nG$SEilrVHLs9elGaIy9iV~wjsg2td)JC)7*%o)(1D;Dy2!jF!dT*1m1Q}~ zoxgJpiD*{cU)f*{uVK40-6+n*9k*IjtAL5@12f6+yazqi)sUvi9OP?xTm<@+|Cw`H z&L4vH7+}`?Kla``p6dVqAC@R-ND+xN%_L=%-Mb>?;AC%-?Cp@9(IQm#mSYQJ>F>Wqm3mJ)eK% z9Okl20DJ1gAsjx|AU_Gk5rNj3GB{z$&%k0dZEKTWO_u&*ItG`@eP)RAmZbD2@np|) z`J(YQiIUB1+@9=NLTTLTXA|s3UiWxRQeyQS2zg@na4@d3tL2U1q-K+9S@dsF_G0yR z5kA#c#%)jc)Rpo?Ley+(GCJ2J>&Kbf4+}u5KKc3#pGfn9ZZ(eIZu=^P6{#t_e8$_f ztE87>gxsDv($QS9#OcJ`;paMcVXzZ`y_$FAP8;yNQf;Ks>T%Uun=V72Y{WdQy0UaS z98zJJ+`gDjBin=K?h!Ln^|LYg!;B6N%KrR=Ji9*xTrj&$-Bs&A+hlE4k3<6G#DbEo z-?W?8hJ-gcTkl}mmiTUCKq5erMjq*~>yNHJxKPNNWm?#fB*LW8keip9b;Ki6HRAc{w z^Myudc!%%{-01=u?o6&cBRPy%LQb{%@GA|U)x=p&zUJkgSH4D&IaB4g+}&4ip1Oyn zM|sw=an;>k$;&$_MS4$KGWYs?H+9GRwUI=ejx#PaKCV0?L?a}5UFlGqLh|~DW@moC zS4lDEk884IIs-=SU1==i=i)5#wIKUSr?XI(#7pl%hst6`nuDb^O21c3 z)lS}Y^vLSrsAa8ekJ=0`{1Yn}pL{H1VYB#!?P1X~`66~mC@Re`IcqgPd{wbI3`e4` zyTlhSC8R1FqSTyl3e!9Cx#f1Nzs)E+h~BKsIE*h&R&t(hRCqX^S+a35aV+q8eWzmm z_6jM!6+zA0-;iE~kkmW+g>>e(mLMeczU>->IZqP}O{j9kZGFa#j-7T!4f!Y1rq}I3 zadxWA7DtRzKCjMr?4bK13Zc?n&=^)Y*nd8M?m~BH@LjV?TT2)R{G5tWp`* z^#N%PYgL&>xo;9VYMxRD4IeS=2^)p~v8j1cwMO)Zk6?5>vu{O9rHKA#cXP;E% ze3*2`PE|jCgGQT9u@&3SM|BP=v-v|0aMnztQP)i0TVRaphvh}%orw>by zH;Oe*wsNN|u|pQ(f{J$5jrN7A?e;X%;|6(P!1Tn1$u`e{N1D#sntiQo-Ef{I@%X5= z?(pogBlq|~TU2vhq((s%E4P+!xq%fsTWb1RhR8B{=|=0zm7yy7(J|JcTgN2%Qqm2t zZ6#YWLFASsjRz)_6~#TL>+--rnSNiC(Ty@m$n5zfCjo#$o=Kz0NUz!~|0P@~C`+{<(zg9{mroeF8qCFrskCMUcDTVR_WB z%+65Jg3cBzp^65Bn5jB#b$j--8S9rrcLpoG^2N8Rnp4*}^Q>GA$`rNU#gv#Jl|0C% zGOUoUjUGOHcW4#tGQ-}C*FGf$(b0j;V-OK=o*TA_XHDp^Txw4a8h)L=YbmEy(8w>hpuQU5*NQTmO`L zbxL~t!6^UDMox3H(U0cxIi706ud1r&EC(}&He%D!{o#g9&qsBZR@0lo25WAKn!XHG z;iF^Ks8)32e3(+}V4qxby8GuQgRtfC+jH`b2@ZP&xtbrLhLT07)>n^h2!Kou5sflD z8o&B+{E#slRIBpeLLex8YltO=20L6{7m2=sVF}n4={E-zdz{JNum7-z2+o(T6MIc_ zWG-7pQ~O3$w85!78T49KoEMB^ML|)J9ft{$u}z}W)U|%`O7DJjnF)>X%6OsAsinsLL+fHZ>H}2 z*++butuggpPgUnq{YuatEB$jS0{$&Td*=f3aP=;;Gdw}I{gLr8-SXTR${R6Md|PsL zabr*E9}nx84tgp}>x`z&=vWNaFZhTFYzu~|$cgkG{oGtbjOj~gu{VUo-PY~HDzfsv zZ6vIjhU+~Khpvk6MA2i2B+IB9#ot3-WzF!FhkjPJ>~KReXCKeUrQU|4^5QbGe1kih z1|?TVg*jI78kSdC24)r7T9L z2l*2)On1b@4@yG;UX>(jsImzwn;|gjCjDj`Q(EZD7!OqZeiVqC?2n!FSX+}~;`O*o zf!umgWomj`iGB4Jfm(}AUbW36x z)rwMXH8Rbe7Vm3HSx2UaAInr(CCQTxIRXA^gNT$kQ!~k^{WZRf)p*uJEJslZJukVr zaEnpzttu?vrCPu0wOf-OAI5o3>7;fp(MF9@dnF~euU@H81>B+(XDexAUk^57iJGib z-J#jV7>Y7+_rG4=djAYl#mrQYWMzK%WjJX8$~hkqQDece1_q{i>ix6k-n&>j2UFU( z^%<)nNtvEnoIO>I;uc`ME76P(wFQoWG2s$BRg$;`6xJ}ytq$w+4&sz-Z^w3#PKp@cSP7&<;KC<9zN)Wr=iN z0*8mPg^yR7pOv?1n3NxGUSy|rK)IVwyl8Q0Oqmi9g)u4gu5OnGIuQN-gLY324?ewu=#xl)y^+FL=WsiT6M zOlgo$g7@NFzq`M&6$ZfbcCEQ&f|)dEa=EvLQ+EbX6C$IpVdL6|i|y^j?b0uMu0n#W zz%Z%jF!LMic=iRMrV!d7>h<*Tfjd#?$8~XIfl`Auc6n-=H5Wu3F-wPo#hCoKd-P_q z%!m52n^foZ!Xye+t&>kGt1it$0#3BT(4o~T%WL_5h%IZXo=m{-N+fAiy@u7GQgV-I zOy}V0g`^p~v>=SXp4WKHwbo(1XLTGFgS@pBW_NOy&A1F|a_gJLJTa)&tJ(SS1(@+Z z7#tR7E9fRf(eTb>8Uo8NwPO(3HxAu*kINhqB??TmR|g}<39?Dz8SVDE+RfMG&UB>k z*MHt>gArG2{ru+mwI0tcgBe%3mP2>p^5|r&;^`a`WiesxzGy3ll^)u%cOamd8~pbzLnHz z3~{YZZ=%?>s6GDDi=w?+)^#!5Pv1$=yql5I5lC&g<&&t2VL#X_TXtetBGSVPf?b2} zb?w^I>pL0`kVl5oMmALO=!_5T!rBRq{zY@80iE0~BJeq3S2@=2v~;fo{l1K&m^zsU zgLK1s^Zs>}Yy1a$6HF(=lp*SqvOnHKa>(|1_&pVIoLB}8hCm_*os&3RI93rZwq2J? zL8a_@mRUb1f7P<>(rkY7vM;xc_WFynb=eKkvjo>sA!85nQvDy#X=sk#azNAXrg?zb zC9#Zd)v-P`_P4a4alkwt`W#qBy*!I^TMbv$oIWlUN%LAiWR$wXPS_mNr@L=LZ#bY_ z7Q*5a*&WH;7X3}l6+MqV z*v{6^?+&TJh>hQ>V-p&~(Kj5J@$Siv8_bBClDdGQi52NTV^?4sk=N=WQ? znr-mFoRYAq0fQ~PHP0yAqONLIy&ykErtvyg=W2GA$MuT3LAE+vC{Cwwv6lA1wa!W( zPh75wkF3{t)F9_fk5L9;yQd^iGs|(Ad9uwXnvxQdQiAj?lk3uR1T5>fnQ0z&(FjS> z(0p!##~n7*ajkuvATM9+!{V-?{`L`@_-VuBN39riYopNtrdJ)7rZgR6-1Izl^v!KD zrF3N{99D14^Oa9E>aivbvlP(vO5rR#4SXF2Gia@Ro3y66F|T@gtQzej#&@hP8NAJm z3t3JK(cfP24fo!e4ia18jYPe_o*qePN9iKt zUL;QBgwJ2Yz_m0(WXKuhf<%sLwr@!qUcP(H_q$EeT10c$exWN#h+_%H((YTE zcp&f=lQ$E^x*KxwD3iPoNTGo#J~UkTM+};H+9)B=+(k}=JLyg!{awW{Mz+Ve9>rBs zO@7J>aGBorw79rzUD-~vZ~JRg1}c1_$H+vF#9`{lj!)CVS zIx!sn)w{x+SEAUowN%ZDA}AfCQdu36eE?7j1tBFGxSg!IXWF1SLLF4_&h-V)^_ID* zQ^=0}3&Ery%b&|gzK4J%@e?01e65a@P8GozzJ-@JOI%;tE>2M%(b=)KHone3l3HpR`B29Zn9!#ktc|dJ?Rk*D4d5at|GA(A8e<4@?q`NV|))+q_ zCC?Pz-GSgdcLAoJ+ZN&ZP6r3-k^zJz{CO-5Tht%WbPwMp&r0lmp_0el2IzTgg$Vkb z0n7E9NQJHA7y+4fa$Kw0^4PUEbsJB|9x24EGBg}({m!B_iNG!G#HqZ$W`^%C{>x9t z0WGhVNa|S7_l5t9PlB(&t-&zAoBHK*e&-*L?;`v!@ksys*wSB8_#gh!4g<#;5|31D z2J`)gumAkb&fp`Cn&8RQ9Y6p7ZxYEIL92b`bm}+8BmH{CLLwL&#*Xjvj_&6Y>Nhv{ zhhcs};y(=Ya~}W0Fn<{47ZmuzFh8fjFUa*r!u*_E|4&L7XJ*9we6T#0!^#WYuw7jb zXb-nJ-8lQThv`49%pV++fw)4j-zWe>>;Na=uAk9sdJ)=(y8ZVqX0C(NVE_IZ>t@UA zamHPIH<=f5q+rOMYucm#duEvnfSMn2spM=uwe4`%--DqGkHBm;_IDXSjzUz^CR~Fu zq0%GA+ZhlmzWDwjL&}-RW4|<-f7lKsi6e}aJE~zpBkPMg-NpA9g9Iz3KD*7_ z2tq&+Ip&1Fr|E>B1CyWIOoQ= zr$Xr+gx}rPU!S8|IUy|AD=oNXBl<^$OvlB0bmE7t3G(2#QR)l3rT_5PUzog)AKJ{$)eqG+PXJ zWn!-=Y`&|%;+xV-ch?Ad(A9rm^AY5l+w8t!zxk(>=V84)N9NJJt+_mx3gs3%`6 z|G@{`N)PKfChQ~rmq^0K;|jfZ!h+=qckwqK!;Z}5-Lg;Q2X1h*Ab8Ez;&DLddvNQA z|8M57y_6(dmi9ju=1cQ|GbwzDD4Y?FtBad|s`d%iJ8vxgm*cOO`A$%OQ&>>cid+H@ zA-Ll^D3QZ*hRyjp9IvHbAYZxr54K|K6_7KXc`3X4eusLgxSpnFRlz~pwp z046Jce!C?J!<`Urbi@$8W_z8qBkadTf6k?6#t@F5KTtS_FnRG&5NpN_`=h?J4LOqT zdp#H(R3r>JN@M6k7H^54&l|T>_fxhAnE1%B@?0$*5cE9NA?~C;ocQYSJ=D!Zdt=E# zsFshV1eB{odjwV{UP821 zE*P?W{M2S2*wjJiRU8-(>Rh>f9$=?>R&?s4OO6Bs^wuQO8@W5#em0?as<%SpQ{A>h z`g=3M64B=`KHCFb;GT3c9e#Nunq4R(Yp>P!dfV}lfdj8$_CgVaC>t1FCpt@;r@ssL zO~ASjzWJ+-a%9Uf`QJL?o5&HT5Nnzt+)0X9JC~V#E5GO{$F-eG_KUq;-jZTEiC3}v zLTsnrt3#mHz^<>8VQ){1hUe}IUluo7R+ZfIBT(F!cp?xc9ux?)0Thcmpz5+2^uawMA|*LRj@u8P{}9C9t2w{L5Fi0%?^GyuobA=Tv1MC^lH|Q&_cw9R zwDNw=l0ROGT}hyXw!JcBIEc``Py;R(-|aU%UqxGZ%3UWX{>ew;F3icfrbTCs?1mMK zcd9NF?FjowtI(%GyDTS{ZLTAMS1UpvLe^ImqL=0z23Q0u#zi~mU6AlFhl5<_3xy1( zHfU%uiKKU5lA@Z_k$Yuwwjwb+(K5G(=3??riqpHG6F%@mqgFFVY;XC2*VX4h-e{?% zZdU(42$}EFK~RkdQS>f8LQjFM9ob;qmi8{@5Y(5vfa4h97(_~q8_>cfYMus}AL$0@ z3IjRxobYu#F7)}At5MNjjTFR+J1o_!_qcNzlJ`OS_Az!H#+LG_d*iz+9C{ZNO01@)Q%8fL!M)1JM}xOg{PyGa=h1x)%$ zJOAvd&?5S7EdT}6IQy~JJ?&#YFXGj=9Dbr=1v=~8kDq|Kp2rv@L>5OOq^=HrgYT`P zg!1s&g_R^gsg#R`i*pZn|Ma%&D7n~flEnG>f^|C(20Tu_L3}nAEzovX3}Zg>#dH;8 zZfhShJx zPrng5|J%^Ag!?*BA{j)#JtuZSL&`|??xktHC=VrSqJhJ+l|{e4~cpuGp{CczQ`PjftkMoaF@rm3DrS?jqijRoEojYQ&t{BHio-AbSqPp ze@7UZBThxts2t*?2&zqiH5bUM*YwqjIeyF-DwazMeK_=*-ab_)yBhJ-u46XIvV;YZ zEyZkQ)b&(Z!ds}3n)2dGuFkfUyCm#4?8BBCVv3O0ziIzP(C9|hnjV;7H|ofhn`2IT z9l@b$q%s}Y>;h8OxJYZwlkUxFrUWNrb_EaB7<@%3L&6ImBNypI%x}CNicc89o@eqB zT7PQPc*{|UD(h-hU?xndH3s!8bJ8=6v1I@fTX#hLP%{qaY|o&i1AJZ><^-OXzaYhF z@BoL>(R~&JFU4awpVLVr{F13xFZ7xjsDpd!^XqG>%vnO8a4>dH!9fwvhyM<)KJ);L zGNuL$D>*Nfs} zLa8duA%FM)#?A?B3uTDy0eBrZYzxDkQlVLNQRnKIr3o3O`?Yk)Z~6DZXg;$Rh!1G+ z6LZR^+`O_dPU)wpbJe`(Jn$l`GunbWW}+v$ zDGJW#H^1WuTW;%TXBOj^xcr8VGvaAw^Dwi@r0aR>N~kB_8@lqDUYy~Tc>h-8nJgic z_26|?Dt7t%yJo&(0Wf*uOCj0Bl2P8J0c^2k=#=;CSXC|Qnkq!~hogPib@H85Lf2+u zgsa0~u`UEQL2;U0_bK&fCR$o;vi*EhoxvB(oRpxSt~ET@z^YPwYqEa8Od~Wl2KeL~ z=EOTWsZ2fddwW(N@T9sxcm_#ivb<_LyX`L>yDX7Wp)K-MPp@IG>ENJsrTd*Uj1N=O zm&L6iHQXt-kR#TY%hZ<_jp4Sgw&~ap{arDXg|nkZ4mmy#LJ>DVwld0oFc)3xDgERx#U6xsaX(ip-~S#TD1tMU>akfyyQiKS9kRvnimFso3**j0#S%1g*%YKx40h)#`1-+RH{Msr9=mfWQe>y!no3S*FuWuEDY zFl$Of&w@%j9kQxrM~)j=)Lx;;aC#L;FwJ0A5TX-c&>J;+gNjx=@<M5UKSqk z1ZW&H)UNInu-dvvnmu$Q(?Mm26>aCAaD3eY_n!jhsqC$Yn2lFE;hr8P;&@q?gt%(T z>y=$=YsZ05P)KDTbss>W>WmW7tfET*GH%sx`ZNXliK7hsd{6)^c%n0WYvRGK5Vyx7so-*>>ju6=g~Og;iM(T zJNee%fzE2BCHdTLTy1WTrvSea*nK{ZvgLxrcfA>miV4d(+lCB6TO?uLUGM+zpKZks&wS8pKho3Of$ z6gwcosvzSe@x&cOh{B+#Ov>|Sbt3c}hueh%7V!L(!k^Mg({bT@l$(I{b0Us*wH_hxWUpwy{B0oSZlgPw zS|EpR(Bx9++xCthC8~IEt@BWUXp$1JC?^Wv-FvLtjdhReQk~ySrk0~nJUt-=V~yy= zzrp}BzgXyy0a6C1^xHR6QKAoAPD1~Ym6-Uk4ZeG8`QHW`nF(!B)f_LekH0VH;F*tzrG&I1n zys8)DDGA3aTYN0xcTL8$f`#L7LCL)K3Y!7d)kqR@7pxjJYVe&P3SV(ZRHO90gMC1} z^^K|QQC%wS&s*c_)WRa=5(S1cTRnNB?nR4-ql|@B=6#I95w}l`OZ0+zYa>k8|7%c{NU0j-0kvZl|fEP}t%Jts+f75Yh#!M^suLqx0zBKMf*sZtyJqUeJ*UYiqwX>a znBMRz^yRL{aDIY5oUJ{Y>#YvvWSTqAI{{Vv0_rr9~zIJlkuru z1{>|kHZOU5OmC`r&s4el8BQ*J)5in$38?I7+(21@*cMzF4EA5{MU&vy8;Rk zKW74(ic?JD$Rnp7P*-}>HN6> zf&rz1SeOrVtSU~?A@$B^81ea~#cGGcfQV>>qMW@Au4H|{ne zE{-rqxn^u(R=_zeF{17p3XQ|ajoIP0m>qJa=c&L@xlc6hY(W;=`5}%EbH5WOtjPy2 z7ssWsV?)5aM*@#imGa-Lq342BpS=!!yfVnYIw<}C={Yov!WSkJjEFluP`dr~XMFds zF7VmDm|BO>>EQmi^Qg51MF%h5_&SD8r2J{6*yZw_(Dz$l4nFii91>-Cl_0>Ir` zg{A^D-edfDcAPjj#}56tbExTtPJW4)PDdd`auk(Ns8YKjT{SPYYa`;1p%y+ESxOt% z4K*edlL}Llj%D?SQfga(h`R>`o?`E?V{CxV5=eg*p8K^QFFMAJx zKgyq9Z}h2%p?NS5(dY*Xw-0?$O`90yfAW&HI0P!cCL7dr5!;)}vgvE-+9kS|5Er7H zh(J4$nNQNLPttxw-?WFartO3TI)MTX_U9320>Uh+hs=ANZ?2ezmV4gCf-3fpRP(2k zEWmfyZ?`81E^(uH0O;p=7C}g>pUZx6UbfrM3*%@k+t`qrCX*}_=f@Ktg1A_bTu7$t zj%5CqCn+L(Pzg@2=x!}II3UTklqA_i1)tpw=$gt6^=2AREX3U(Y*utoE11;m17Q@S zr)B&IPbD`iTn+jsGt)-Cd!O+JSR{q4T-@_h4A# z=*PsX!f(-Mo;WED;oGg465n20=@+1N4qS1yrLs#p@{Frsv2vK8M_VcghDVp-kt*gJ zuKJ#ykH-rpaabru%rT;B`?<7ckv?ZdcH&y_4drtxwL-0KFCc#7R%`Zs4N$$EE0&){ zVykwYb*uYlbC`|!0EYN-CUMie5x%HJe7Nr6#lRtacXq1!g0JnYEj^L-DGm(&)6|x2CW-oFk0Zk)&2Jp4DMD^%4IP*Sl*x1lr0)z^TpRU1FR|5)_`RwL< zggXxqxKGU>z3glCyo4Rv%l#h$By%di8hq(;q7F3|wPKV5ZP_bR6^hq&+nJCk&SB>oV2rSPNI9&2 z!RlPsCE6tkY78@t<{*}KReM9sA12|Q5Ttf|kN=`$;y#xP1bbfjICz<6?DKqc2weD! zC(|DNt2Y9ENjf9A@SJb1dLTZ^nUfGsMD5^V{*nQ7RNse$n2Nef+%(i4IH|BtJtiFg zoT>5t*~zX3NpbfygBib#nBff%CrL5>#m_GxIxhCENN6EoqU*RroFXAXpwd1`w@lDCS0dy>u-H+(+7cA!# zxH)jK$cplATQ|`#-o+Gv+6)x-KZWn#;mmLpVg~OJGTqQpjEEV0two;ks~PN72*c88 z_#q)sc1%x-(w+OWa8n%afWXh)#XlWj{87^{asT;SRt$2NwlG1bc9I>L zs?P&_FS1=X>scKZE5gzDAv~l>o1ucl-4ONbg2-fPnO=kAEQ|t#q6WE>rHKIhvk0LK zN+`88di&I_Zsy$W4@5>*6^cb^p|dZVUSwmUv7gfqe8@!`yAA!dh2xty=07E!Y%N`* zeRc4&@S~~Y^O1w`Yx!OG4?#dU_@&rh@62)4wO&;xr}y~~R(p%~tIM8r6oT+CvFS3D zKA%9WehQBl(cu_+=A_FBvDxrii`&(q%0B5@VT|FI z9T}lKM0J;1?Gm)kG!yIUrXC|qTp;!3UwA`uAHXAY|5EdGQt>^lOeMxMnvUc+{71h= z7wHlPxZTTRpL(U|5$At|QVKc(n_ihuTirXrF1(KbLMja2emYh6P);1`ka1J-3eAbH zI;fEHkcwz-iN$!QPw6yNQSfevaS+|8ClDPC2=Ce3Pl`j{@)}BF&+i!1+l0X!aF(R- z-pEHEVTIIh$NdZ6328?rfmaP7xBboGwSLGb#t|GMVoGYAy#+4{5pz;~e*d?d>2ZqV zU2l|r9tC8r#!>G{f5rTpj1$NVL*Dso`X5rVg4nO63x7L4=eM+y#^C_R~ zbpArO|J+0|2}!k8m09=l#Z^y1?8U@@_skSr+vuwUztmIwnECk6(8`%pNFK*GFd`Us zS$GG@TXxJ=H+@S^OVSy)W18J&5-)N*f1uoA<~4dW_bU-j38Xu z5!&N;JS5WfKc;p^z;ImU1(rWw{X$U^r1jN$0UqJd}%?5^z z7bA&43kX9^q{r~FfRNOZaK*i*wrt19)>wS-XFDz$#F;p0dV+d4r1d?7_)^LLfe7C? zXyyjINnXPVR^-`^_Q=p6R{5#Tg)WXMkf;6BBExrRLlu7e<@ZzE{7Fy-)|02Yz45nQ zPaveURq7zw4~S7hm!Nb5i}utf{Gt#x|NeVK@XMz>vT%WmtQ_xmBKIv^74-1zbzj@f zj)0mz|_io#TH(4(s{eKe$1httTMPh$p@6%I10>$J)KHVeN+FihtLd{f}4r zfv$qAND%EhYHB0uG2jO~UVU~__3Ke0(tuJCIT3@#w5}h1`HOXL!Fo@k)VCqTDa3;V zVHfndh~69~S7S%24yb0|$^0YbzC5hvI>PTaymB{|SUL&(UU2I@#b)tUDg!5?p*X95 z{&!A99@e|1K*VkKf z=5Jq!k0&V%qI6Ls+OhYq*VbE|k6u1X>_awjBT`Tz-RX$w2^dul~w{F;V{pk0fs8QmB6M^-N|L0}k2?oS>Lc>ug zGg4$FS$roU<@bSp-=FNLPuNEJA#;|P{`=xTf3XbwQ2N*?wvDgx?c2*fgg$rb-lm1r zi9oAA=8t#!{^iBo} zIrSBjjsI;S31--u0@YUJSZj`NxrjZ?QG8?5BPs8LrBXbAW!m(&pPry#5KvoNvR-Lp zC7-+DXxY@hli!c%h~gHmZD|I1e;DZxBYo$JpIqEOjPyq${gFsNxfq+3%OBPDN45R2 zk^b2x`C}vfF}D90+dnndzp0WxUfUn9?T^>?bFcqfoa2xC|Hu9R6G!@IW9v^G=}$oN zPeAfty!Jnl?LU$2KPi%bPD%Vpk^KKVMKY3D2sMErhaFZX)1kVtmMoN>5`E_qB3bzk zKn~Bu?3DXA_Z83aJsE($oL#=%_^Z6+*YAe!b|gBeY*xuJ2n{AE=*!Vj$gwbBON2C9 z4afG4G#U$}(K22xZcd|#K^kpDAxZ6@d3Ns+2_mUWLOTzfx+<$`hfx4r1GYXZe1Uz) z&-@|ZiWM1n#-#&3T; z)6PxFyPv;Z+5vx&cMPYyt(@c~0jU+%n{&JyUdu0Nv11dxruIQ{G}%7k-?lnM?yvKX z!G%}+$@uu?UW9Nb5W)@lW^5)LDMGl*L8qR5-~P|Nw-49UERSL-fsM-Q0ky$(_)e&r zOk2Jv@}A3(dex@An6qosPZuE>>@S`yeeLIa{YD@w;twZonOAZ&M*@yAr?T~6l+GwF z!-BnhIwnFFwk;YABzT+g!D$m44dg&Nw3FwS-M3YK@j-2zaPGvdbZGH62bk-asOx^j zRHJ-ZMhFE8`N{UO;~un}-pE4#y@23hUG<<)X5vV9 zH9{`$NnN5rm{`?uQZ(J5HFE}9VIq;PcW8yZQ*OC>apS$0PJr-;F_hc6iKU$Pwq#@U zaJg1yCT0^*W6ZkN`EVQB|JbH?{4NqU@7htpF?;Wgk=ru>WkJ3k6P0qP4jDDjf9CHm z@$0~5#k032iGL?q;Ss`eW%us&M+2XnNyN5O8{aLgJ;Ia7u<0WH^s#611PLA^-Aw7w z?RxCiEiUX}i0#H5SVbx(WCdQ_|9;aP9f|Z|U@gE^$Gt|MfAY-x@4f$Y;V=6ci4t^q ze1Jv48xUS{{LU>+U#_DjZn|#(z$wiF~H+TQ`?;rOM`#duVY`(wqFT(%!_49ywBfBeqy}^HcF|}@BUAp{x#Q*rM zO?Tu!IOvQGQ19cRK*#@%cMIPF>!NITlK;1_KL^xH<6;MR!yl;no6G%72>f4Jsqp`U z7eAeK0uYwy`2caXDOLTNx%`g4y?(i?R0X}#XckI*h0#H z&tq~qyf4D-^ffmMR>Mi1*#kDEsK7f8cnxLZ#* zkw-K_ki&&^7#X=6lJvUUbq0Zy(2_$JvGSiZXBvl$ zY>n&_oP-Xp%6b2rxs5#P3@IW;Yw6q&-TvhYtL-C7u|CQ7|`%uSJ8#OAqFjOaCXE_AHO5W1gTe#5Y-l=PS4AbcL4m}m5qaI@jP zIW{s0NPJ|D!3gjm84+VMsrqvm$C9vOHp8u4!+_7=$vbs*L#7pe82G%N_vlCo005v} zu9ucU!)_Sa#V62a9gTpZ4FVtvGrmAC^vG3S?*w#3Ndj(gA{@JW2JtCLTOPiYAW-Ul z_^BF~q31R~DNYa_5qjQe<>8YuxNp+7ZDj1O;UAE8=<5sd!K_8h39`wj*H1N>LNg$F z)npgam49sE9CsI%3wqj=vH{b`&9fV)e&%qwHT1{VVLka3f+Z94(s@4J-C74|5a=B6>q@J@8zzG~V$g0;5%8g}_Xajs%)^ z3p*fSiit{DrYk+&ZF#GF(hfZ^lT+5sxZa#jouA3*GgGCPoFS*9_(-W9(U|+5l7F@aEOwx$=OUKq`P(Yt6v+=`9?)8?JNFS?R)pXkwB(l>$EPiNgq*FcR(k!^`S>%!iPui@ZQY0g7+ z<>3$lv(97FECA!u=Y62mNo8U0}y0VG7UGmFyemo16(MHe&+>G1_Sp+i`x`4Lxd5^p2P@fT+0 zj4_cEDtC^SEFbqcAHk+AwY&TB872!s*AVmWhqG6R7%kYDJQ2)@!Ss4D<|gtj5wR>) zZW`I)=n*IL3YJ%*7w9dtUH3{ozNd$YiEI(+hbDcNzJxI$cIB2Bsspa9-f!Z&D`;0G zN3XnKSpnBgb(gr7eWiQBk&9&7mLHLd!cB2JmU~c6cQN z9FNW$C&EF%IP^DNCDJZ2l$gwUq+tmbZp-5bjYXQ3fgD#Ph5@}%WK!{wgpw5zmCwH4 zl0>EumMqU&*4@;P5H9I>)`j%B7f}!IOwFai#r`nXB92K*f@|FmX=IOy?kfXa7DWR4 zV@LLt-Kk;Vw^{72UHAU(z<}tBWDl$9wfop@?MYMO_iux zV4r?Y@`D2apG6Ug`3R5T$ojp7IS8ce4;+0S2IzHH26VGI)`nyYn1Z`k21|RUW7+;X zZvx$`^vakvvMqr_{U#lEv`_N89aggVsEKX&kGJpP;gBA^sSMDes4^N$ zB~eLgTHA?>2r#E`4hq$rGu1XU4Dh;&E^oWjCiP0SNCmT@J>Rw6wL2Tp!=!zWQYL`| zEXZ;WTp8^}kAA#ULthn8IUcv-UdCG=@V39lF>EMFC}$_tXd-H69Rc6fZcZdBx}tr` z{&?f@wV<|_>X#;;hNGoRZ8q67zcPj#mB7C-9nH<&q%Q`P!gr}(#yf8D{878)vGb&5 z@zM!(w3w;nJ?-lLEp9|PxgdeBOlY)cV{~dG zuJlfL)3_hAHG#7c-x1|aFSGTOCf@NTG7cYMf)Fu4t(mIs&Y&s{Fcf}1^?54yW!6Hs zn;T8QP5stPgDZlOZS65bQubUb30r&?mO&$m(udyZ_Fn3lChA4-h$k(`?mW^v4DH2N z7??X$A&hvXkiIHz?BNVxEU|@v8lE&U@z(PYICcxcT5;f&SbRnGEKp=TezsKMW=sMo z`rNZUWkw0Z@l}eWk|CBHwv7$b%BPoVx92SL`4mhpj19(wg(6TGgV7=gT!Z#}_|!ZZ zz05M@(O5(?&e#OIqd0OYnirALW5ik|oxPKQ+~&R(^dc#Ndj9{Oq-Q8*2lIe(RMZSW zBFMV1L#NM^Dm}uxzL+Pc%^`K;)dUz%SR$s9Jpy0?izFAUS(EN%OwIu-80=E@fT60h z*!^qs(Nt;|=2|rB0nW(n$qfSWZn=D0EAF1h=hiIe%2*piEW5p;7b`H2lP9D6RIU{) zl(4$a3QsUO(f8!kcvG-!RhYDNd2~#QOc+BE4B@RPfd3R-wwqaKmXQI^%45|iiF?t(!7Ms&1PGFY?+jK$7jv#(3dPRC!wctoEOpUs_G z4P6Pntzd+ajnWN|(J@F%Sp$%FZNo(I(jQQyV0Wc)vj-rt7@}+5U15{m@y#q{ z@#+CBnv6x_^)!umrGV1uidPS+>>M{o5f5p1++oF6hA2c0xE7+7a&*>)xZ`=Kq%Bdn z_Awsm7~QLp+`=v|5Pa7ILcL<*XmOWkFq0$uW@4|UMtif0jR7v-&L$;6Y~-}`?hB2H zS-KL+lFH-p{j$weVZyITUz#QK>LCA3Pe1U@DwZgt34~@EDAipc}S_d8n05O2`2=8HMdYj58e&FePoh z0vNs1Wjz?nyoAt0;|a4Ko{g)@i5a+2jCqakn+5VL~$FD&XibCUF5GZA5`)USo5>f^_x#Z}D7V4M@-X9qO}4pWPSg zPdwV;ef05Uq4+`LxYPQ8usjI3HVphs1r!dCx4Wy@%{Ioo2RI1l?_IBn>6zz1|Te~znyweMT8!AcS?w!X9qzt1Q0L^MW>ve-GIWzI{ z5N5bZi7zJj9RHzlWw?oU866068BAKS8ic5Pa{EUH3q@B!c^9qj*g2iH@LVBDf5aRM zXj0t0CS^&ftI(>i51db9Gm>&oZxC%4@aJf z9}HVc5-RCS6e+JKC#P)KI1kIjZDY9E9D;ywV(+4ZX@w<^MC*+77&)vMaoi;hdrPJ9 zAdH5`;<3f*qw3})N*1VY;CSpqS2;e=E z#L&*aBl)UtNCXA!CYzt!l#@dfTs|(PnqY?u3a{075I>hVzaa_7T{C2xKa#Nrx}#z=w zKf5lZcdCGb78vWBE#4n$zce`b*-QMeU9xRG*+U&F<^tMe;G`GpFi}+m!C!NgjPLT+ zHKyNIvDjlrfI(0MOInpZU?ynUATYtllecEU*pH@N9T2_}&X_ONJ{ZUS9{e$%o6Qj+ zJeCJ&lfT5Vu#(5v%>fpg+<_M6r&mSDV zc8F7-fj?+08@Zl-2^ZZb@q|W{%vWcdJ&OcYSGpR{zK~_e*ISenzu$s{KN}VvSRHrn@PVc1-7FoMYI*fJL|!~QX=3_${vbGPaHcS zXV2QXg}NG$F63>7UY4Clrsc+@|c_1*0`1P)H7iM?lJ%U9B;=@T9_bs zf2yFFt5S0KORP}pp+na5ee+VQ_F2&g;ICcRPF02^o{oe`W2KQJ!>Sk2T)ns1Um6NFT9<5=ex%zUzP(@X7Dk=G*G5fGq~o#BpZM-C+FFM;*tr` zrrYA%64wX(bt?Zrmpgd%kwjt!ZLd>^u1ohP*w7BY21~mhhKB&qYz|+EA&(}WX1Q9g zCtw>=d&)=l?1^w^fCsB?7wV4C%a7<+o7e&s=E84eLvNg|Z zXQvEZ>83)44NukrxRzIy!1~IN@gzS!HR)%DOX7_gLU(&%NJvm>@eNx>{Id|ZsHt`) z;g@R>1yj=OmHx*Y4F_{5-DxLR)2g_cuiS|mLvq*Ii+w@DVkz}i5aEgmKKv$hIJtm7 z4k%)u5zkAsprI~s@Jz$)Zf&w3XsWQf-{ zQtU4o6Gv+hwC>>^2sa0)In)lt%D#EB9EB_4%=Y5{XTWnf{Wh+?20BwR^{?T#tLy8w z{fdww_dVc63UZv$(#QiWQH?S-2_coJ63Y$%TiOvUDxiD6OI|E&U*^nbxum@Hn3VDl z5yr(FJCCe0tgbqeXTI@sz@Bq6jhA!Wk^y$&s;$l*nIqr0pa9tUi{ALG!1_^#GH?R_ z%F~P2-fRAnwGPS!&YJ^cOy9LZ{nxdUBkNoR{krdavaA9Qeb~Q!S)DDse=e{Ky)Pp8 z%_|Yb#k;b7suSgr(g=D>1W`4daB;YxG1*OfGBFKkOf?Rma&U5=ArakeY(a`8IpcOJ zX2U82xW*vslA#--rGV)|+#(9Xz;Q+&skJ_2I^Gx9oA9*)uU8?%0VztrW{&6Lsla>m zu!RiHR0mbOz!Nxm<9S?y9KFECfDb6?W^OS;O1hZAi(AA5II3v+QbL)O$U>Mlp%a*B z)Oy3z$aK6KFy7Q;lL-Y8j({~11lBf7E}lY~4Z@)kYu$ALv{GkDat~Rt*5IH9Of)l1 zqGpom_*uYsn^n?-)aN243Pv;gXl5rp-HvAV(acUt2?;KdMr-!bnjKN&6In?$j@Im> zH9MkjLR|V8ZN`r_<4NzqjW**)`|KolKS%rQ Date: Fri, 15 Jul 2016 09:54:04 -0500 Subject: [PATCH 04/11] Make sure email domain validation method is private. --- app/models/user.rb | 54 ++++++++++++++++++++++------------------------ 1 file changed, 26 insertions(+), 28 deletions(-) diff --git a/app/models/user.rb b/app/models/user.rb index d27e2374f18..0168008355b 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -760,33 +760,6 @@ class User < ActiveRecord::Base Project.where(id: events) end - def signup_domain_valid? - valid = true - error = nil - - if current_application_settings.domain_blacklist_enabled? - blocked_domains = current_application_settings.domain_blacklist - if match_domain(blocked_domains, self.email) - error = 'is not from an allowed domain.' - valid = false - end - end - - allowed_domains = current_application_settings.restricted_signup_domains - unless allowed_domains.blank? - if match_domain(allowed_domains, self.email) - valid = true - else - error = "is not whitelisted. Email domains valid for registration are: #{allowed_domains.join(', ')}" - valid = false - end - end - - self.errors.add(:email, error) unless valid - - valid - end - def can_be_removed? !solo_owned_groups.present? end @@ -886,7 +859,32 @@ class User < ActiveRecord::Base self.projects_limit = 0 end - private + def signup_domain_valid? + valid = true + error = nil + + if current_application_settings.domain_blacklist_enabled? + blocked_domains = current_application_settings.domain_blacklist + if match_domain(blocked_domains, self.email) + error = 'is not from an allowed domain.' + valid = false + end + end + + allowed_domains = current_application_settings.restricted_signup_domains + unless allowed_domains.blank? + if match_domain(allowed_domains, self.email) + valid = true + else + error = "is not whitelisted. Email domains valid for registration are: #{allowed_domains.join(', ')}" + valid = false + end + end + + self.errors.add(:email, error) unless valid + + valid + end def match_domain(email_domains, email) signup_domain = Mail::Address.new(email).domain -- GitLab From 7943767267873423acb1eddbf00b6c5684f7849f Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Fri, 15 Jul 2016 13:20:45 -0500 Subject: [PATCH 05/11] Refactored the domain separator regex, plus syntax and grammar fixes. --- app/models/application_setting.rb | 21 ++++++++++----------- doc/administration/access_restrictions.md | 2 +- spec/models/application_setting_spec.rb | 10 +++++----- spec/models/user_spec.rb | 6 +++--- 4 files changed, 19 insertions(+), 20 deletions(-) diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb index 84b1b54eeae..03c2bc0b57d 100644 --- a/app/models/application_setting.rb +++ b/app/models/application_setting.rb @@ -4,6 +4,12 @@ class ApplicationSetting < ActiveRecord::Base add_authentication_token_field :health_check_access_token CACHE_KEY = 'application_setting.last' + DOMAIN_LIST_SEPARATOR = %r{\s*[,;]\s* # comma or semicolon, optionally surrounded by whitespace + | # or + \s # any whitespace character + | # or + [\r\n] # any number of newline characters + }x serialize :restricted_visibility_levels serialize :import_sources @@ -164,25 +170,18 @@ class ApplicationSetting < ActiveRecord::Base self.domain_blacklist.join("\n") unless self.domain_blacklist.nil? end - def splitter - /\s*[,;]\s* # comma or semicolon, optionally surrounded by whitespace - | # or - \s # any whitespace character - | # or - [\r\n] # any number of newline characters - /x - end - def restricted_signup_domains_raw=(values) self.restricted_signup_domains = [] - self.restricted_signup_domains = values.split(splitter) + self.restricted_signup_domains = values.split(DOMAIN_LIST_SEPARATOR) self.restricted_signup_domains.reject! { |d| d.empty? } + self.restricted_signup_domains end def domain_blacklist_raw=(values) self.domain_blacklist = [] - self.domain_blacklist = values.split(splitter) + self.domain_blacklist = values.split(DOMAIN_LIST_SEPARATOR) self.domain_blacklist.reject! { |d| d.empty? } + self.domain_blacklist end def domain_blacklist_file=(file) diff --git a/doc/administration/access_restrictions.md b/doc/administration/access_restrictions.md index 08bb8ff4e19..eb08cf139d4 100644 --- a/doc/administration/access_restrictions.md +++ b/doc/administration/access_restrictions.md @@ -39,7 +39,7 @@ not selected. ## Blacklist email domains -With this feature enabled, you can block email addresses of an specific domain +With this feature enabled, you can block email addresses of a specific domain from creating an account on your GitLab server. This is particularly useful to prevent spam. Disposable email addresses are usually used by malicious users to create dummy accounts and spam issues. diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb index 582d9a8d8cd..ebcd9b0f947 100644 --- a/spec/models/application_setting_spec.rb +++ b/spec/models/application_setting_spec.rb @@ -77,27 +77,27 @@ describe ApplicationSetting, models: true do context 'blacklisted signup domains' do it 'set single domain' do setting.domain_blacklist_raw = 'example.com' - expect(setting.domain_blacklist).to eq(['example.com']) + expect(setting.domain_blacklist).to contain_exactly('example.com') end it 'set multiple domains with spaces' do setting.domain_blacklist_raw = 'example.com *.example.com' - expect(setting.domain_blacklist).to eq(['example.com', '*.example.com']) + expect(setting.domain_blacklist).to contain_exactly('example.com', '*.example.com') end it 'set multiple domains with newlines and a space' do setting.domain_blacklist_raw = "example.com\n *.example.com" - expect(setting.domain_blacklist).to eq(['example.com', '*.example.com']) + expect(setting.domain_blacklist).to contain_exactly('example.com', '*.example.com') end it 'set multiple domains with commas' do setting.domain_blacklist_raw = "example.com, *.example.com" - expect(setting.domain_blacklist).to eq(['example.com', '*.example.com']) + expect(setting.domain_blacklist).to contain_exactly('example.com', '*.example.com') end it 'set multiple domain with file' do setting.domain_blacklist_file = File.open(Rails.root.join('spec/fixtures/', 'blacklist.txt')) - expect(setting.domain_blacklist).to eq(%w(example.com test.com foo.bar)) + expect(setting.domain_blacklist).to contain_exactly('example.com', 'test.com', 'foo.bar') end end end diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 79f77d116a7..5f130234df1 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -89,7 +89,7 @@ describe User, models: true do end describe 'email' do - context 'when no signup domains white listed' do + context 'when no signup domains whitelisted' do before do allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return([]) end @@ -100,7 +100,7 @@ describe User, models: true do end end - context 'when a signup domain is white listed and subdomains are allowed' do + context 'when a signup domain is whitelisted and subdomains are allowed' do before do allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['example.com', '*.example.com']) end @@ -121,7 +121,7 @@ describe User, models: true do end end - context 'when a signup domain is white listed and subdomains are not allowed' do + context 'when a signup domain is whitelisted and subdomains are not allowed' do before do allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['example.com']) end -- GitLab From a3f0f2cc4d9a4c689ae0eeae73e6d4ef19c39cce Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Fri, 15 Jul 2016 18:29:23 -0500 Subject: [PATCH 06/11] Move inline JS to admin.js.coffee specific file. --- app/assets/javascripts/admin.js.coffee | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/app/assets/javascripts/admin.js.coffee b/app/assets/javascripts/admin.js.coffee index b2b8e1b7ffb..4dd30973d11 100644 --- a/app/assets/javascripts/admin.js.coffee +++ b/app/assets/javascripts/admin.js.coffee @@ -38,3 +38,15 @@ class @Admin $('li.group_member').bind 'ajax:success', -> Turbolinks.visit(location.href) + + showBlacklistType = -> + if $('input[name=\'blacklist_type\']:checked').val() == 'file' + $('.blacklist-file').show() + $('.blacklist-raw').hide() + else + $('.blacklist-file').hide() + $('.blacklist-raw').show() + return + + $('input[name=\'blacklist_type\']').click showBlacklistType + showBlacklistType() -- GitLab From c71e658ccac85f111517e04b79d915c10867c7e3 Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Fri, 15 Jul 2016 18:30:38 -0500 Subject: [PATCH 07/11] Refactor and rename `restricted_signup_domains` to `domain_whitelist` to better conform to its behavior and newly introduced behavior. --- .../admin/application_settings_controller.rb | 2 +- app/models/application_setting.rb | 20 +++++++------- app/models/user.rb | 2 +- .../application_settings/_form.html.haml | 26 +++---------------- config/initializers/1_settings.rb | 2 +- ...tion_settings_restricted_signup_domains.rb | 21 +++++++++++++++ db/schema.rb | 2 +- doc/api/settings.md | 6 ++--- doc/development/doc_styleguide.md | 2 +- lib/api/entities.rb | 2 +- lib/gitlab/current_settings.rb | 2 +- spec/models/application_setting_spec.rb | 16 ++++++------ spec/models/user_spec.rb | 10 +++---- 13 files changed, 58 insertions(+), 55 deletions(-) create mode 100644 db/migrate/20160715230841_rename_application_settings_restricted_signup_domains.rb diff --git a/app/controllers/admin/application_settings_controller.rb b/app/controllers/admin/application_settings_controller.rb index 3e27320ee5c..c5b44ff8c44 100644 --- a/app/controllers/admin/application_settings_controller.rb +++ b/app/controllers/admin/application_settings_controller.rb @@ -84,7 +84,7 @@ class Admin::ApplicationSettingsController < Admin::ApplicationController :default_project_visibility, :default_snippet_visibility, :default_group_visibility, - :restricted_signup_domains_raw, + :domain_whitelist_raw, :version_check_enabled, :admin_notification_email, :user_oauth_applications, diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb index 03c2bc0b57d..d923b4d5235 100644 --- a/app/models/application_setting.rb +++ b/app/models/application_setting.rb @@ -14,10 +14,10 @@ class ApplicationSetting < ActiveRecord::Base serialize :restricted_visibility_levels serialize :import_sources serialize :disabled_oauth_sign_in_sources, Array - serialize :restricted_signup_domains, Array + serialize :domain_whitelist, Array serialize :domain_blacklist, Array - attr_accessor :restricted_signup_domains_raw, :domain_blacklist_raw + attr_accessor :domain_whitelist_raw, :domain_blacklist_raw validates :session_expire_delay, presence: true, @@ -141,7 +141,7 @@ class ApplicationSetting < ActiveRecord::Base session_expire_delay: Settings.gitlab['session_expire_delay'], default_project_visibility: Settings.gitlab.default_projects_features['visibility_level'], default_snippet_visibility: Settings.gitlab.default_projects_features['visibility_level'], - restricted_signup_domains: Settings.gitlab['restricted_signup_domains'], + domain_whitelist: Settings.gitlab['domain_whitelist'], import_sources: %w[github bitbucket gitlab gitorious google_code fogbugz git gitlab_project], shared_runners_enabled: Settings.gitlab_ci['shared_runners_enabled'], max_artifacts_size: Settings.artifacts['max_size'], @@ -162,19 +162,19 @@ class ApplicationSetting < ActiveRecord::Base ActiveRecord::Base.connection.column_exists?(:application_settings, :home_page_url) end - def restricted_signup_domains_raw - self.restricted_signup_domains.join("\n") unless self.restricted_signup_domains.nil? + def domain_whitelist_raw + self.domain_whitelist.join("\n") unless self.domain_whitelist.nil? end def domain_blacklist_raw self.domain_blacklist.join("\n") unless self.domain_blacklist.nil? end - def restricted_signup_domains_raw=(values) - self.restricted_signup_domains = [] - self.restricted_signup_domains = values.split(DOMAIN_LIST_SEPARATOR) - self.restricted_signup_domains.reject! { |d| d.empty? } - self.restricted_signup_domains + def domain_whitelist_raw=(values) + self.domain_whitelist = [] + self.domain_whitelist = values.split(DOMAIN_LIST_SEPARATOR) + self.domain_whitelist.reject! { |d| d.empty? } + self.domain_whitelist end def domain_blacklist_raw=(values) diff --git a/app/models/user.rb b/app/models/user.rb index 0168008355b..6932e750fe0 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -871,7 +871,7 @@ class User < ActiveRecord::Base end end - allowed_domains = current_application_settings.restricted_signup_domains + allowed_domains = current_application_settings.domain_whitelist unless allowed_domains.blank? if match_domain(allowed_domains, self.email) valid = true diff --git a/app/views/admin/application_settings/_form.html.haml b/app/views/admin/application_settings/_form.html.haml index 9443fe5e1d3..35fea2d8fa9 100644 --- a/app/views/admin/application_settings/_form.html.haml +++ b/app/views/admin/application_settings/_form.html.haml @@ -123,9 +123,9 @@ = f.check_box :send_user_confirmation_email Send confirmation email on sign-up .form-group - = f.label :restricted_signup_domains, 'Restricted domains for sign-ups', class: 'control-label col-sm-2' + = f.label :domain_whitelist, 'Whitelisted domains for sign-ups', class: 'control-label col-sm-2' .col-sm-10 - = f.text_area :restricted_signup_domains_raw, placeholder: 'domain.com', class: 'form-control' + = f.text_area :domain_whitelist_raw, placeholder: 'domain.com', class: 'form-control' .help-block ONLY users with e-mail addresses that match these domain(s) will be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com .form-group = f.label :domain_blacklist_enabled, 'Domain Blacklist', class: 'control-label col-sm-2' @@ -152,7 +152,7 @@ = f.file_field :domain_blacklist_file, class: 'form-control', accept: '.txt,.conf' .help-block Users with e-mail addresses that match these domain(s) will NOT be able to sign-up. Wildcards allowed. Use separate lines or commas for multiple entries. .form-group.blacklist-raw - = f.label :domain_blacklist, 'Blacklisted domains', class: 'control-label col-sm-2' + = f.label :domain_blacklist, 'Blacklisted domains for sign-ups', class: 'control-label col-sm-2' .col-sm-10 = f.text_area :domain_blacklist_raw, placeholder: 'domain.com', class: 'form-control', rows: 10 .help-block Users with e-mail addresses that match these domain(s) will NOT be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com @@ -385,22 +385,4 @@ .form-actions - = f.submit 'Save', class: 'btn btn-save' - -:javascript - function showBlacklistType() { - if ($("input[name='blacklist_type']:checked").val() == "file") - { - $(".blacklist-file").show(); - $(".blacklist-raw").hide(); - } - else - { - $(".blacklist-file").hide(); - $(".blacklist-raw").show(); - } - } - - $("input[name='blacklist_type']").click(showBlacklistType); - - showBlacklistType(); \ No newline at end of file + = f.submit 'Save', class: 'btn btn-save' \ No newline at end of file diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb index 51d93e8cde0..693507e0bec 100644 --- a/config/initializers/1_settings.rb +++ b/config/initializers/1_settings.rb @@ -212,7 +212,7 @@ Settings.gitlab.default_projects_features['builds'] = true if Settin Settings.gitlab.default_projects_features['container_registry'] = true if Settings.gitlab.default_projects_features['container_registry'].nil? Settings.gitlab.default_projects_features['visibility_level'] = Settings.send(:verify_constant, Gitlab::VisibilityLevel, Settings.gitlab.default_projects_features['visibility_level'], Gitlab::VisibilityLevel::PRIVATE) Settings.gitlab['repository_downloads_path'] = File.join(Settings.shared['path'], 'cache/archive') if Settings.gitlab['repository_downloads_path'].nil? -Settings.gitlab['restricted_signup_domains'] ||= [] +Settings.gitlab['domain_whitelist'] ||= [] Settings.gitlab['import_sources'] ||= %w[github bitbucket gitlab gitorious google_code fogbugz git gitlab_project] Settings.gitlab['trusted_proxies'] ||= [] diff --git a/db/migrate/20160715230841_rename_application_settings_restricted_signup_domains.rb b/db/migrate/20160715230841_rename_application_settings_restricted_signup_domains.rb new file mode 100644 index 00000000000..dd15704800a --- /dev/null +++ b/db/migrate/20160715230841_rename_application_settings_restricted_signup_domains.rb @@ -0,0 +1,21 @@ +# See http://doc.gitlab.com/ce/development/migration_style_guide.html +# for more information on how to write migrations for GitLab. + +class RenameApplicationSettingsRestrictedSignupDomains < ActiveRecord::Migration + include Gitlab::Database::MigrationHelpers + + # When using the methods "add_concurrent_index" or "add_column_with_default" + # you must disable the use of transactions as these methods can not run in an + # existing transaction. When using "add_concurrent_index" make sure that this + # method is the _only_ method called in the migration, any other changes + # should go in a separate migration. This ensures that upon failure _only_ the + # index creation fails and can be retried or reverted easily. + # + # To disable transactions uncomment the following line and remove these + # comments: + # disable_ddl_transaction! + + def change + rename_column :application_settings, :restricted_signup_domains, :domain_whitelist + end +end diff --git a/db/schema.rb b/db/schema.rb index 25d94f283c9..3d769ccac50 100644 --- a/db/schema.rb +++ b/db/schema.rb @@ -49,7 +49,7 @@ ActiveRecord::Schema.define(version: 20160716115710) do t.integer "max_attachment_size", default: 10, null: false t.integer "default_project_visibility" t.integer "default_snippet_visibility" - t.text "restricted_signup_domains" + t.text "domain_whitelist" t.boolean "user_oauth_applications", default: true t.string "after_sign_out_path" t.integer "session_expire_delay", default: 10080, null: false diff --git a/doc/api/settings.md b/doc/api/settings.md index d9b68eaeadf..c925fa1861e 100644 --- a/doc/api/settings.md +++ b/doc/api/settings.md @@ -33,7 +33,7 @@ Example response: "session_expire_delay" : 10080, "home_page_url" : null, "default_snippet_visibility" : 0, - "restricted_signup_domains" : [], + "domain_whitelist" : [], "created_at" : "2016-01-04T15:44:55.176Z", "default_project_visibility" : 0, "gravatar_enabled" : true, @@ -63,7 +63,7 @@ PUT /application/settings | `session_expire_delay` | integer | no | Session duration in minutes. GitLab restart is required to apply changes | | `default_project_visibility` | integer | no | What visibility level new projects receive. Can take `0` _(Private)_, `1` _(Internal)_ and `2` _(Public)_ as a parameter. Default is `0`.| | `default_snippet_visibility` | integer | no | What visibility level new snippets receive. Can take `0` _(Private)_, `1` _(Internal)_ and `2` _(Public)_ as a parameter. Default is `0`.| -| `restricted_signup_domains` | array of strings | no | Force people to use only corporate emails for sign-up. Default is null, meaning there is no restriction. | +| `domain_whitelist` | array of strings | no | Force people to use only corporate emails for sign-up. Default is null, meaning there is no restriction. | | `user_oauth_applications` | boolean | no | Allow users to register any application to use GitLab as an OAuth provider | | `after_sign_out_path` | string | no | Where to redirect users after logout | | `container_registry_token_expire_delay` | integer | no | Container Registry token duration in minutes | @@ -93,7 +93,7 @@ Example response: "session_expire_delay": 10080, "default_project_visibility": 1, "default_snippet_visibility": 0, - "restricted_signup_domains": [], + "domain_whitelist": [], "user_oauth_applications": true, "after_sign_out_path": "", "container_registry_token_expire_delay": 5, diff --git a/doc/development/doc_styleguide.md b/doc/development/doc_styleguide.md index fac35ec964d..6ee7b3cfeeb 100644 --- a/doc/development/doc_styleguide.md +++ b/doc/development/doc_styleguide.md @@ -359,7 +359,7 @@ restrict the sign-up e-mail domains of a GitLab instance to `*.example.com` and `example.net`, you would do something like this: ```bash -curl -X PUT -H "PRIVATE-TOKEN: 9koXpg98eAheJpvBs5tK" -d "restricted_signup_domains[]=*.example.com" -d "restricted_signup_domains[]=example.net" https://gitlab.example.com/api/v3/application/settings +curl -X PUT -H "PRIVATE-TOKEN: 9koXpg98eAheJpvBs5tK" -d "domain_whitelist[]=*.example.com" -d "domain_whitelist[]=example.net" https://gitlab.example.com/api/v3/application/settings ``` [cURL]: http://curl.haxx.se/ "cURL website" diff --git a/lib/api/entities.rb b/lib/api/entities.rb index 4cd388658be..ec9a56afde8 100644 --- a/lib/api/entities.rb +++ b/lib/api/entities.rb @@ -412,7 +412,7 @@ module API expose :default_project_visibility expose :default_snippet_visibility expose :default_group_visibility - expose :restricted_signup_domains + expose :domain_whitelist expose :domain_blacklist_enabled expose :domain_blacklist expose :user_oauth_applications diff --git a/lib/gitlab/current_settings.rb b/lib/gitlab/current_settings.rb index ffc1814b29d..735331df66c 100644 --- a/lib/gitlab/current_settings.rb +++ b/lib/gitlab/current_settings.rb @@ -39,7 +39,7 @@ module Gitlab session_expire_delay: Settings.gitlab['session_expire_delay'], default_project_visibility: Settings.gitlab.default_projects_features['visibility_level'], default_snippet_visibility: Settings.gitlab.default_projects_features['visibility_level'], - restricted_signup_domains: Settings.gitlab['restricted_signup_domains'], + domain_whitelist: Settings.gitlab['domain_whitelist'], import_sources: %w[github bitbucket gitlab gitorious google_code fogbugz git gitlab_project], shared_runners_enabled: Settings.gitlab_ci['shared_runners_enabled'], max_artifacts_size: Settings.artifacts['max_size'], diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb index ebcd9b0f947..a780c04abde 100644 --- a/spec/models/application_setting_spec.rb +++ b/spec/models/application_setting_spec.rb @@ -54,23 +54,23 @@ describe ApplicationSetting, models: true do context 'restricted signup domains' do it 'set single domain' do - setting.restricted_signup_domains_raw = 'example.com' - expect(setting.restricted_signup_domains).to eq(['example.com']) + setting.domain_whitelist_raw = 'example.com' + expect(setting.domain_whitelist).to eq(['example.com']) end it 'set multiple domains with spaces' do - setting.restricted_signup_domains_raw = 'example.com *.example.com' - expect(setting.restricted_signup_domains).to eq(['example.com', '*.example.com']) + setting.domain_whitelist_raw = 'example.com *.example.com' + expect(setting.domain_whitelist).to eq(['example.com', '*.example.com']) end it 'set multiple domains with newlines and a space' do - setting.restricted_signup_domains_raw = "example.com\n *.example.com" - expect(setting.restricted_signup_domains).to eq(['example.com', '*.example.com']) + setting.domain_whitelist_raw = "example.com\n *.example.com" + expect(setting.domain_whitelist).to eq(['example.com', '*.example.com']) end it 'set multiple domains with commas' do - setting.restricted_signup_domains_raw = "example.com, *.example.com" - expect(setting.restricted_signup_domains).to eq(['example.com', '*.example.com']) + setting.domain_whitelist_raw = "example.com, *.example.com" + expect(setting.domain_whitelist).to eq(['example.com', '*.example.com']) end end diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 5f130234df1..41e531c684b 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -91,7 +91,7 @@ describe User, models: true do describe 'email' do context 'when no signup domains whitelisted' do before do - allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return([]) + allow_any_instance_of(ApplicationSetting).to receive(:domain_whitelist).and_return([]) end it 'accepts any email' do @@ -102,7 +102,7 @@ describe User, models: true do context 'when a signup domain is whitelisted and subdomains are allowed' do before do - allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['example.com', '*.example.com']) + allow_any_instance_of(ApplicationSetting).to receive(:domain_whitelist).and_return(['example.com', '*.example.com']) end it 'accepts info@example.com' do @@ -123,7 +123,7 @@ describe User, models: true do context 'when a signup domain is whitelisted and subdomains are not allowed' do before do - allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['example.com']) + allow_any_instance_of(ApplicationSetting).to receive(:domain_whitelist).and_return(['example.com']) end it 'accepts info@example.com' do @@ -163,7 +163,7 @@ describe User, models: true do context 'when a signup domain is black listed but a wildcard subdomain is allowed' do before do allow_any_instance_of(ApplicationSetting).to receive(:domain_blacklist).and_return(['test.example.com']) - allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['*.example.com']) + allow_any_instance_of(ApplicationSetting).to receive(:domain_whitelist).and_return(['*.example.com']) end it 'should give priority to whitelist and allow info@test.example.com' do @@ -174,7 +174,7 @@ describe User, models: true do context 'with both lists containing a domain' do before do - allow_any_instance_of(ApplicationSetting).to receive(:restricted_signup_domains).and_return(['test.com']) + allow_any_instance_of(ApplicationSetting).to receive(:domain_whitelist).and_return(['test.com']) end it 'accepts info@test.com' do -- GitLab From 23afb02aaa957dd1a5ce35a141e4e8ecd80052ca Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Sat, 16 Jul 2016 11:44:50 -0500 Subject: [PATCH 08/11] Refactor `match_domain` to a predicate: `domain_matches?` --- app/models/user.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/app/models/user.rb b/app/models/user.rb index 6932e750fe0..516934c295c 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -865,7 +865,7 @@ class User < ActiveRecord::Base if current_application_settings.domain_blacklist_enabled? blocked_domains = current_application_settings.domain_blacklist - if match_domain(blocked_domains, self.email) + if domain_matches?(blocked_domains, self.email) error = 'is not from an allowed domain.' valid = false end @@ -873,7 +873,7 @@ class User < ActiveRecord::Base allowed_domains = current_application_settings.domain_whitelist unless allowed_domains.blank? - if match_domain(allowed_domains, self.email) + if domain_matches?(allowed_domains, self.email) valid = true else error = "is not whitelisted. Email domains valid for registration are: #{allowed_domains.join(', ')}" @@ -886,7 +886,7 @@ class User < ActiveRecord::Base valid end - def match_domain(email_domains, email) + def domain_matches?(email_domains, email) signup_domain = Mail::Address.new(email).domain email_domains.any? do |domain| escaped = Regexp.escape(domain).gsub('\*', '.*?') -- GitLab From 6b8eceda395ae25b7ea189627b04da1f223c57d7 Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Mon, 18 Jul 2016 17:49:33 -0500 Subject: [PATCH 09/11] Default to manual input for `domain_whitelist`, syntax fixes and added new tests. --- app/assets/javascripts/admin.js.coffee | 3 +-- app/models/application_setting.rb | 2 +- app/views/admin/application_settings/_form.html.haml | 8 ++++---- .../fixtures/{blacklist.txt => domain_blacklist.txt} | 0 spec/models/application_setting_spec.rb | 12 +++++++++++- spec/models/user_spec.rb | 4 ++-- 6 files changed, 19 insertions(+), 10 deletions(-) rename spec/fixtures/{blacklist.txt => domain_blacklist.txt} (100%) diff --git a/app/assets/javascripts/admin.js.coffee b/app/assets/javascripts/admin.js.coffee index 4dd30973d11..d5d34e6eca6 100644 --- a/app/assets/javascripts/admin.js.coffee +++ b/app/assets/javascripts/admin.js.coffee @@ -46,7 +46,6 @@ class @Admin else $('.blacklist-file').hide() $('.blacklist-raw').show() - return - $('input[name=\'blacklist_type\']').click showBlacklistType + $("input[name='blacklist_type']").click showBlacklistType showBlacklistType() diff --git a/app/models/application_setting.rb b/app/models/application_setting.rb index d923b4d5235..8c19d9dc9c8 100644 --- a/app/models/application_setting.rb +++ b/app/models/application_setting.rb @@ -71,7 +71,7 @@ class ApplicationSetting < ActiveRecord::Base inclusion: { in: %w(ssh http), allow_blank: true, allow_nil: true } validates :domain_blacklist, - presence: true, + presence: { message: 'Domain blacklist cannot be empty if Blacklist is enabled.' }, if: :domain_blacklist_enabled? validates_each :restricted_visibility_levels do |record, attr, value| diff --git a/app/views/admin/application_settings/_form.html.haml b/app/views/admin/application_settings/_form.html.haml index 35fea2d8fa9..23b52d08df7 100644 --- a/app/views/admin/application_settings/_form.html.haml +++ b/app/views/admin/application_settings/_form.html.haml @@ -125,7 +125,7 @@ .form-group = f.label :domain_whitelist, 'Whitelisted domains for sign-ups', class: 'control-label col-sm-2' .col-sm-10 - = f.text_area :domain_whitelist_raw, placeholder: 'domain.com', class: 'form-control' + = f.text_area :domain_whitelist_raw, placeholder: 'domain.com', class: 'form-control', rows: 8 .help-block ONLY users with e-mail addresses that match these domain(s) will be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com .form-group = f.label :domain_blacklist_enabled, 'Domain Blacklist', class: 'control-label col-sm-2' @@ -138,12 +138,12 @@ .col-sm-offset-2.col-sm-10 .radio = label_tag :blacklist_type_file do - = radio_button_tag :blacklist_type, :file, @application_setting.domain_blacklist.blank? + = radio_button_tag :blacklist_type, :file .option-title Upload blacklist file .radio = label_tag :blacklist_type_raw do - = radio_button_tag :blacklist_type, :raw, @application_setting.domain_blacklist.present? + = radio_button_tag :blacklist_type, :raw, @application_setting.domain_blacklist.present? || @application_setting.domain_blacklist.blank? .option-title Enter blacklist manually .form-group.blacklist-file @@ -154,7 +154,7 @@ .form-group.blacklist-raw = f.label :domain_blacklist, 'Blacklisted domains for sign-ups', class: 'control-label col-sm-2' .col-sm-10 - = f.text_area :domain_blacklist_raw, placeholder: 'domain.com', class: 'form-control', rows: 10 + = f.text_area :domain_blacklist_raw, placeholder: 'domain.com', class: 'form-control', rows: 8 .help-block Users with e-mail addresses that match these domain(s) will NOT be able to sign-up. Wildcards allowed. Use separate lines for multiple entries. Ex: domain.com, *.domain.com .form-group diff --git a/spec/fixtures/blacklist.txt b/spec/fixtures/domain_blacklist.txt similarity index 100% rename from spec/fixtures/blacklist.txt rename to spec/fixtures/domain_blacklist.txt diff --git a/spec/models/application_setting_spec.rb b/spec/models/application_setting_spec.rb index a780c04abde..fb040ba82bc 100644 --- a/spec/models/application_setting_spec.rb +++ b/spec/models/application_setting_spec.rb @@ -95,8 +95,18 @@ describe ApplicationSetting, models: true do expect(setting.domain_blacklist).to contain_exactly('example.com', '*.example.com') end + it 'set multiple domains with semicolon' do + setting.domain_blacklist_raw = "example.com; *.example.com" + expect(setting.domain_blacklist).to contain_exactly('example.com', '*.example.com') + end + + it 'set multiple domains with mixture of everything' do + setting.domain_blacklist_raw = "example.com; *.example.com\n test.com\sblock.com yes.com" + expect(setting.domain_blacklist).to contain_exactly('example.com', '*.example.com', 'test.com', 'block.com', 'yes.com') + end + it 'set multiple domain with file' do - setting.domain_blacklist_file = File.open(Rails.root.join('spec/fixtures/', 'blacklist.txt')) + setting.domain_blacklist_file = File.open(Rails.root.join('spec/fixtures/', 'domain_blacklist.txt')) expect(setting.domain_blacklist).to contain_exactly('example.com', 'test.com', 'foo.bar') end end diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb index 41e531c684b..8dacd1db447 100644 --- a/spec/models/user_spec.rb +++ b/spec/models/user_spec.rb @@ -148,7 +148,7 @@ describe User, models: true do allow_any_instance_of(ApplicationSetting).to receive(:domain_blacklist).and_return(['example.com']) end - context 'when a signup domain is black listed' do + context 'when a signup domain is blacklisted' do it 'accepts info@test.com' do user = build(:user, email: 'info@test.com') expect(user).to be_valid @@ -160,7 +160,7 @@ describe User, models: true do end end - context 'when a signup domain is black listed but a wildcard subdomain is allowed' do + context 'when a signup domain is blacklisted but a wildcard subdomain is allowed' do before do allow_any_instance_of(ApplicationSetting).to receive(:domain_blacklist).and_return(['test.example.com']) allow_any_instance_of(ApplicationSetting).to receive(:domain_whitelist).and_return(['*.example.com']) -- GitLab From 4be1adea21a5994be948b42a04cb20ecd3714db1 Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Mon, 18 Jul 2016 17:57:19 -0500 Subject: [PATCH 10/11] Removed escaping characters by using double quotes. --- app/assets/javascripts/admin.js.coffee | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/assets/javascripts/admin.js.coffee b/app/assets/javascripts/admin.js.coffee index d5d34e6eca6..90c09619f8c 100644 --- a/app/assets/javascripts/admin.js.coffee +++ b/app/assets/javascripts/admin.js.coffee @@ -40,7 +40,7 @@ class @Admin Turbolinks.visit(location.href) showBlacklistType = -> - if $('input[name=\'blacklist_type\']:checked').val() == 'file' + if $("input[name='blacklist_type']:checked").val() == 'file' $('.blacklist-file').show() $('.blacklist-raw').hide() else -- GitLab From 1a057d2b4013feb151e77aa71dd0b5a83412d2d6 Mon Sep 17 00:00:00 2001 From: Patricio Cano Date: Tue, 19 Jul 2016 17:08:40 -0500 Subject: [PATCH 11/11] Reorder allowed params for `ApplicationSetting` and add more details to docs. --- app/controllers/admin/application_settings_controller.rb | 6 +++--- doc/api/settings.md | 6 ++++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/app/controllers/admin/application_settings_controller.rb b/app/controllers/admin/application_settings_controller.rb index c5b44ff8c44..9e1dc15de84 100644 --- a/app/controllers/admin/application_settings_controller.rb +++ b/app/controllers/admin/application_settings_controller.rb @@ -85,6 +85,9 @@ class Admin::ApplicationSettingsController < Admin::ApplicationController :default_snippet_visibility, :default_group_visibility, :domain_whitelist_raw, + :domain_blacklist_enabled, + :domain_blacklist_raw, + :domain_blacklist_file, :version_check_enabled, :admin_notification_email, :user_oauth_applications, @@ -113,9 +116,6 @@ class Admin::ApplicationSettingsController < Admin::ApplicationController :container_registry_token_expire_delay, :repository_storage, :enabled_git_access_protocol, - :domain_blacklist_enabled, - :domain_blacklist_raw, - :domain_blacklist_file, restricted_visibility_levels: [], import_sources: [], disabled_oauth_sign_in_sources: [] diff --git a/doc/api/settings.md b/doc/api/settings.md index c925fa1861e..ea39b32561c 100644 --- a/doc/api/settings.md +++ b/doc/api/settings.md @@ -34,6 +34,8 @@ Example response: "home_page_url" : null, "default_snippet_visibility" : 0, "domain_whitelist" : [], + "domain_blacklist_enabled" : false, + "domain_blacklist" : [], "created_at" : "2016-01-04T15:44:55.176Z", "default_project_visibility" : 0, "gravatar_enabled" : true, @@ -64,6 +66,8 @@ PUT /application/settings | `default_project_visibility` | integer | no | What visibility level new projects receive. Can take `0` _(Private)_, `1` _(Internal)_ and `2` _(Public)_ as a parameter. Default is `0`.| | `default_snippet_visibility` | integer | no | What visibility level new snippets receive. Can take `0` _(Private)_, `1` _(Internal)_ and `2` _(Public)_ as a parameter. Default is `0`.| | `domain_whitelist` | array of strings | no | Force people to use only corporate emails for sign-up. Default is null, meaning there is no restriction. | +| `domain_blacklist_enabled` | boolean | no | Enable/disable the `domain_blacklist` | +| `domain_blacklist` | array of strings | yes (if `domain_whitelist_enabled` is `true` | People trying to sign-up with emails from this domain will not be allowed to do so. | | `user_oauth_applications` | boolean | no | Allow users to register any application to use GitLab as an OAuth provider | | `after_sign_out_path` | string | no | Where to redirect users after logout | | `container_registry_token_expire_delay` | integer | no | Container Registry token duration in minutes | @@ -94,6 +98,8 @@ Example response: "default_project_visibility": 1, "default_snippet_visibility": 0, "domain_whitelist": [], + "domain_blacklist_enabled" : false, + "domain_blacklist" : [], "user_oauth_applications": true, "after_sign_out_path": "", "container_registry_token_expire_delay": 5, -- GitLab