From da567138fab58e6eb9d39d845e7691ea8c6a22d7 Mon Sep 17 00:00:00 2001 From: Andoni Alonso <14891798+andoniaf@users.noreply.github.com> Date: Thu, 8 Jan 2026 10:19:16 +0100 Subject: [PATCH 001/337] docs(developer-guide): add missing compliance framework link (#9736) --- docs/developer-guide/introduction.mdx | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/docs/developer-guide/introduction.mdx b/docs/developer-guide/introduction.mdx index 9d1ea742b1..5377991fac 100644 --- a/docs/developer-guide/introduction.mdx +++ b/docs/developer-guide/introduction.mdx @@ -32,6 +32,9 @@ Prowler is constantly evolving. Contributions to checks, services, or integratio If you would like to extend Prowler to work with a new cloud provider, this typically involves setting up new services and checks to ensure compatibility. + + Need to ensure Prowler supports a specific compliance framework? Add new security compliance frameworks to map checks against regulatory or industry standards. + Want to tailor how results are displayed or exported? You can add custom output formats. @@ -213,4 +216,4 @@ pipx install "git+https://github.com/prowler-cloud/prowler.git@branch-name" Replace `branch-name` with the name of the branch you want to test. This will install Prowler in an isolated environment, allowing you to try out the changes safely. -For more details on testing go to the [Testing section](/developer-guide/unit-testing) of this documentation. \ No newline at end of file +For more details on testing go to the [Testing section](/developer-guide/unit-testing) of this documentation. From 8b2dea52fa4089a083c20a8e403268328f382d3c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 12:52:42 +0100 Subject: [PATCH 002/337] build(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 (#9709) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/api-container-build-push.yml | 4 ++-- .github/workflows/api-container-checks.yml | 2 +- .github/workflows/mcp-container-build-push.yml | 4 ++-- .github/workflows/mcp-container-checks.yml | 2 +- .github/workflows/sdk-container-build-push.yml | 4 ++-- .github/workflows/sdk-container-checks.yml | 2 +- .github/workflows/ui-container-build-push.yml | 4 ++-- .github/workflows/ui-container-checks.yml | 2 +- 8 files changed, 12 insertions(+), 12 deletions(-) diff --git a/.github/workflows/api-container-build-push.yml b/.github/workflows/api-container-build-push.yml index c6952c42a2..f91ad251b9 100644 --- a/.github/workflows/api-container-build-push.yml +++ b/.github/workflows/api-container-build-push.yml @@ -102,7 +102,7 @@ jobs: password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push API container for ${{ matrix.arch }} id: container-push @@ -131,7 +131,7 @@ jobs: password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Create and push manifests for push event if: github.event_name == 'push' diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml index b5905e5311..335555975b 100644 --- a/.github/workflows/api-container-checks.yml +++ b/.github/workflows/api-container-checks.yml @@ -77,7 +77,7 @@ jobs: - name: Set up Docker Buildx if: steps.check-changes.outputs.any_changed == 'true' - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build container for ${{ matrix.arch }} if: steps.check-changes.outputs.any_changed == 'true' diff --git a/.github/workflows/mcp-container-build-push.yml b/.github/workflows/mcp-container-build-push.yml index 3821f226aa..30c9e2775c 100644 --- a/.github/workflows/mcp-container-build-push.yml +++ b/.github/workflows/mcp-container-build-push.yml @@ -100,7 +100,7 @@ jobs: password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push MCP container for ${{ matrix.arch }} id: container-push @@ -137,7 +137,7 @@ jobs: password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Create and push manifests for push event if: github.event_name == 'push' diff --git a/.github/workflows/mcp-container-checks.yml b/.github/workflows/mcp-container-checks.yml index 35c4cc6ced..f15e63d401 100644 --- a/.github/workflows/mcp-container-checks.yml +++ b/.github/workflows/mcp-container-checks.yml @@ -75,7 +75,7 @@ jobs: - name: Set up Docker Buildx if: steps.check-changes.outputs.any_changed == 'true' - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build MCP container for ${{ matrix.arch }} if: steps.check-changes.outputs.any_changed == 'true' diff --git a/.github/workflows/sdk-container-build-push.yml b/.github/workflows/sdk-container-build-push.yml index 22cca521b3..9f2f19bb8e 100644 --- a/.github/workflows/sdk-container-build-push.yml +++ b/.github/workflows/sdk-container-build-push.yml @@ -169,7 +169,7 @@ jobs: AWS_REGION: ${{ env.AWS_REGION }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push SDK container for ${{ matrix.arch }} id: container-push @@ -208,7 +208,7 @@ jobs: AWS_REGION: ${{ env.AWS_REGION }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Create and push manifests for push event if: github.event_name == 'push' diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml index 7b729ab148..e4f95a7836 100644 --- a/.github/workflows/sdk-container-checks.yml +++ b/.github/workflows/sdk-container-checks.yml @@ -89,7 +89,7 @@ jobs: - name: Set up Docker Buildx if: steps.check-changes.outputs.any_changed == 'true' - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build SDK container for ${{ matrix.arch }} if: steps.check-changes.outputs.any_changed == 'true' diff --git a/.github/workflows/ui-container-build-push.yml b/.github/workflows/ui-container-build-push.yml index cfec354e89..c039418de7 100644 --- a/.github/workflows/ui-container-build-push.yml +++ b/.github/workflows/ui-container-build-push.yml @@ -104,7 +104,7 @@ jobs: password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build and push UI container for ${{ matrix.arch }} id: container-push @@ -136,7 +136,7 @@ jobs: password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Create and push manifests for push event if: github.event_name == 'push' diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml index ac41eaab81..2f19f89899 100644 --- a/.github/workflows/ui-container-checks.yml +++ b/.github/workflows/ui-container-checks.yml @@ -76,7 +76,7 @@ jobs: - name: Set up Docker Buildx if: steps.check-changes.outputs.any_changed == 'true' - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 - name: Build UI container for ${{ matrix.arch }} if: steps.check-changes.outputs.any_changed == 'true' From 64c9dd4947739a825386315566304da9ffca0c05 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 12:54:03 +0100 Subject: [PATCH 003/337] build(deps): bump docker/login-action from 3.4.0 to 3.6.0 (#9396) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/api-container-build-push.yml | 2 +- .github/workflows/mcp-container-build-push.yml | 2 +- .github/workflows/sdk-container-build-push.yml | 4 ++-- .github/workflows/ui-container-build-push.yml | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/api-container-build-push.yml b/.github/workflows/api-container-build-push.yml index f91ad251b9..17693785f7 100644 --- a/.github/workflows/api-container-build-push.yml +++ b/.github/workflows/api-container-build-push.yml @@ -125,7 +125,7 @@ jobs: steps: - name: Login to DockerHub - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/mcp-container-build-push.yml b/.github/workflows/mcp-container-build-push.yml index 30c9e2775c..130ef90129 100644 --- a/.github/workflows/mcp-container-build-push.yml +++ b/.github/workflows/mcp-container-build-push.yml @@ -131,7 +131,7 @@ jobs: steps: - name: Login to DockerHub - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} diff --git a/.github/workflows/sdk-container-build-push.yml b/.github/workflows/sdk-container-build-push.yml index 9f2f19bb8e..d510ec8568 100644 --- a/.github/workflows/sdk-container-build-push.yml +++ b/.github/workflows/sdk-container-build-push.yml @@ -193,13 +193,13 @@ jobs: steps: - name: Login to DockerHub - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - name: Login to Public ECR - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: registry: public.ecr.aws username: ${{ secrets.PUBLIC_ECR_AWS_ACCESS_KEY_ID }} diff --git a/.github/workflows/ui-container-build-push.yml b/.github/workflows/ui-container-build-push.yml index c039418de7..6f8c232185 100644 --- a/.github/workflows/ui-container-build-push.yml +++ b/.github/workflows/ui-container-build-push.yml @@ -130,7 +130,7 @@ jobs: steps: - name: Login to DockerHub - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 + uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} From 319f5b6c3860bc24ab689bfddcf24a23b3951ad9 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 12:54:40 +0100 Subject: [PATCH 004/337] build(deps): bump actions/cache from 4.3.0 to 5.0.1 (#9706) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ui-e2e-tests.yml | 4 ++-- .github/workflows/ui-tests.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ui-e2e-tests.yml b/.github/workflows/ui-e2e-tests.yml index db35056879..196f30891b 100644 --- a/.github/workflows/ui-e2e-tests.yml +++ b/.github/workflows/ui-e2e-tests.yml @@ -126,7 +126,7 @@ jobs: shell: bash run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV - name: Setup pnpm cache - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-store-${{ hashFiles('ui/pnpm-lock.yaml') }} @@ -139,7 +139,7 @@ jobs: working-directory: ./ui run: pnpm run build - name: Cache Playwright browsers - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 id: playwright-cache with: path: ~/.cache/ms-playwright diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml index 530b3e1212..b4ac0e88ce 100644 --- a/.github/workflows/ui-tests.yml +++ b/.github/workflows/ui-tests.yml @@ -63,7 +63,7 @@ jobs: - name: Setup pnpm cache if: steps.check-changes.outputs.any_changed == 'true' - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 + uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1 with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-store-${{ hashFiles('ui/pnpm-lock.yaml') }} From 5cd446c446ea16345e149a64da40548e8019e4e2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 12:56:04 +0100 Subject: [PATCH 005/337] build(deps): bump codecov/codecov-action from 5.5.1 to 5.5.2 (#9708) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/api-tests.yml | 2 +- .github/workflows/sdk-tests.yml | 24 ++++++++++++------------ 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/api-tests.yml b/.github/workflows/api-tests.yml index e9b2cef4c5..dcf97fa18b 100644 --- a/.github/workflows/api-tests.yml +++ b/.github/workflows/api-tests.yml @@ -100,7 +100,7 @@ jobs: - name: Upload coverage reports to Codecov if: steps.check-changes.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml index bcc407d3bf..c86885214b 100644 --- a/.github/workflows/sdk-tests.yml +++ b/.github/workflows/sdk-tests.yml @@ -189,7 +189,7 @@ jobs: - name: Upload AWS coverage to Codecov if: steps.changed-aws.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -213,7 +213,7 @@ jobs: - name: Upload Azure coverage to Codecov if: steps.changed-azure.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -237,7 +237,7 @@ jobs: - name: Upload GCP coverage to Codecov if: steps.changed-gcp.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -261,7 +261,7 @@ jobs: - name: Upload Kubernetes coverage to Codecov if: steps.changed-kubernetes.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -285,7 +285,7 @@ jobs: - name: Upload GitHub coverage to Codecov if: steps.changed-github.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -309,7 +309,7 @@ jobs: - name: Upload NHN coverage to Codecov if: steps.changed-nhn.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -333,7 +333,7 @@ jobs: - name: Upload M365 coverage to Codecov if: steps.changed-m365.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -357,7 +357,7 @@ jobs: - name: Upload IaC coverage to Codecov if: steps.changed-iac.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -381,7 +381,7 @@ jobs: - name: Upload MongoDB Atlas coverage to Codecov if: steps.changed-mongodbatlas.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -405,7 +405,7 @@ jobs: - name: Upload OCI coverage to Codecov if: steps.changed-oraclecloud.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -429,7 +429,7 @@ jobs: - name: Upload Lib coverage to Codecov if: steps.changed-lib.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: @@ -453,7 +453,7 @@ jobs: - name: Upload Config coverage to Codecov if: steps.changed-config.outputs.any_changed == 'true' - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} with: From e9ca8bfda67f27aad3a78d569ed98b3fee502899 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 12:56:15 +0100 Subject: [PATCH 006/337] build(deps): bump trufflesecurity/trufflehog from 3.91.1 to 3.92.4 (#9710) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pepe Fagoaga --- .github/workflows/find-secrets.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/find-secrets.yml b/.github/workflows/find-secrets.yml index 4796630e11..c525d8faa4 100644 --- a/.github/workflows/find-secrets.yml +++ b/.github/workflows/find-secrets.yml @@ -28,6 +28,6 @@ jobs: fetch-depth: 0 - name: Scan for secrets with TruffleHog - uses: trufflesecurity/trufflehog@aade3bff5594fe8808578dd4db3dfeae9bf2abdc # v3.91.1 + uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3.92.4 with: extra_args: '--results=verified,unknown' From 858446c740e72289e88e49ad98dbc0e7f2a5ac03 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:00:44 +0100 Subject: [PATCH 007/337] build(deps): bump actions/setup-node from 6.0.0 to 6.1.0 (#9707) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ui-e2e-tests.yml | 2 +- .github/workflows/ui-tests.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ui-e2e-tests.yml b/.github/workflows/ui-e2e-tests.yml index 196f30891b..aa269af1ce 100644 --- a/.github/workflows/ui-e2e-tests.yml +++ b/.github/workflows/ui-e2e-tests.yml @@ -114,7 +114,7 @@ jobs: echo "All database fixtures loaded successfully!" ' - name: Setup Node.js environment - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0 + uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0 with: node-version: '20.x' - name: Setup pnpm diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml index b4ac0e88ce..0d2b55fbd3 100644 --- a/.github/workflows/ui-tests.yml +++ b/.github/workflows/ui-tests.yml @@ -45,7 +45,7 @@ jobs: - name: Setup Node.js ${{ env.NODE_VERSION }} if: steps.check-changes.outputs.any_changed == 'true' - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0 + uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0 with: node-version: ${{ env.NODE_VERSION }} From 8d78831d2966165174a1530e9cd7404a97c15baf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Thu, 8 Jan 2026 13:13:32 +0100 Subject: [PATCH 008/337] chore(aws): enhance metadata for `s3` service (#9552) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + ...ss_point_public_access_block.metadata.json | 34 +++++++++------ ...t_level_public_access_blocks.metadata.json | 32 +++++++++------ .../s3_bucket_acl_prohibited.metadata.json | 32 +++++++++------ ..._bucket_cross_account_access.metadata.json | 34 +++++++++------ ...ket_cross_region_replication.metadata.json | 29 +++++++------ ...s3_bucket_default_encryption.metadata.json | 30 +++++++++----- ..._event_notifications_enabled.metadata.json | 34 +++++++++------ .../s3_bucket_kms_encryption.metadata.json | 32 +++++++++------ ...et_level_public_access_block.metadata.json | 41 +++++++++++-------- .../s3_bucket_lifecycle_enabled.metadata.json | 31 ++++++++------ .../s3_bucket_no_mfa_delete.metadata.json | 31 +++++++++----- .../s3_bucket_object_lock.metadata.json | 33 +++++++++------ .../s3_bucket_object_versioning.metadata.json | 32 +++++++++------ ...t_policy_public_write_access.metadata.json | 29 ++++++++----- .../s3_bucket_public_access.metadata.json | 29 ++++++++----- .../s3_bucket_public_list_acl.metadata.json | 29 ++++++++----- .../s3_bucket_public_write_acl.metadata.json | 28 ++++++++----- ...cket_secure_transport_policy.metadata.json | 28 ++++++++----- ...erver_access_logging_enabled.metadata.json | 29 ++++++++----- ...hadow_resource_vulnerability.metadata.json | 29 ++++++++----- ...ss_point_public_access_block.metadata.json | 33 +++++++++------ 22 files changed, 411 insertions(+), 249 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index c42eb0728e..711a17b046 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -37,6 +37,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS OpenSearch service metadata to new format [(#9383)](https://github.com/prowler-cloud/prowler/pull/9383) - Update AWS VPC service metadata to new format [(#9479)](https://github.com/prowler-cloud/prowler/pull/9479) - Update AWS Transfer service metadata to new format [(#9434)](https://github.com/prowler-cloud/prowler/pull/9434) +- Update AWS S3 service metadata to new format [(#9552)](https://github.com/prowler-cloud/prowler/pull/9552) --- diff --git a/prowler/providers/aws/services/s3/s3_access_point_public_access_block/s3_access_point_public_access_block.metadata.json b/prowler/providers/aws/services/s3/s3_access_point_public_access_block/s3_access_point_public_access_block.metadata.json index 4863f43409..f22c40c8f1 100644 --- a/prowler/providers/aws/services/s3/s3_access_point_public_access_block/s3_access_point_public_access_block.metadata.json +++ b/prowler/providers/aws/services/s3/s3_access_point_public_access_block/s3_access_point_public_access_block.metadata.json @@ -1,32 +1,42 @@ { "Provider": "aws", "CheckID": "s3_access_point_public_access_block", - "CheckTitle": "Block Public Access Settings enabled on Access Points.", + "CheckTitle": "S3 access point has all Block Public Access settings enabled", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsS3AccessPoint", "ResourceGroup": "storage", - "Description": "Ensures that public access is blocked on S3 Access Points.", - "Risk": "Leaving S3 access points open to the public in AWS can lead to data exposure, breaches, compliance violations, unauthorized access, and data integrity issues.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html#access-points-policies", + "Description": "**Amazon S3 access points** have **Block Public Access** configured with all settings enabled: `block_public_acls`, `ignore_public_acls`, `block_public_policy`, and `restrict_public_buckets`.\n\nThe evaluation inspects each access point's public access block configuration.", + "Risk": "Without block public access on an access point, ACLs or policies can expose objects publicly despite intended restrictions. This enables unauthorized reads (**confidentiality** loss), writes or deletions (**integrity/availability** impact), and supports bulk data exfiltration or destructive actions.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/config/latest/developerguide/s3-access-point-public-access-blocks.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-points.html#access-points-policies", + "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-19" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-19", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: S3 Access Point with all Block Public Access settings enabled\nResources:\n :\n Type: AWS::S3::AccessPoint\n Properties:\n Bucket: \n PublicAccessBlockConfiguration:\n BlockPublicAcls: true # Critical: block public ACLs\n IgnorePublicAcls: true # Critical: ignore any public ACLs\n BlockPublicPolicy: true # Critical: block public policies\n RestrictPublicBuckets: true # Critical: restrict public buckets\n```", + "Other": "1. In the AWS console, go to S3 > Access points\n2. Select the noncompliant access point and click Delete access point\n3. Click Create access point, select the same bucket\n4. Ensure Block public access is enabled (all options On by default)\n5. Click Create access point", + "Terraform": "```hcl\n# Terraform: S3 Access Point with all Block Public Access settings enabled\nresource \"aws_s3_access_point\" \"\" {\n name = \"\"\n bucket = \"\"\n\n public_access_block_configuration {\n block_public_acls = true # Critical: block public ACLs\n ignore_public_acls = true # Critical: ignore any public ACLs\n block_public_policy = true # Critical: block public policies\n restrict_public_buckets = true # Critical: restrict public buckets\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure S3 access points are private by default, applying strict access controls, and regularly auditing permissions to prevent unauthorized public access.", - "Url": "https://docs.aws.amazon.com/config/latest/developerguide/s3-access-point-public-access-blocks.html" + "Text": "Enable all access-point Block Public Access settings (`block_public_acls`, `ignore_public_acls`, `block_public_policy`, `restrict_public_buckets`).\n\nApply **least privilege**, prefer **VPC-only** access points, and layer account and bucket blocks for **defense in depth**. Regularly audit for public principals like `Principal: *`.", + "Url": "https://hub.prowler.com/check/s3_access_point_public_access_block" } }, - "Categories": [], + "Categories": [ + "internet-exposed" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_account_level_public_access_blocks/s3_account_level_public_access_blocks.metadata.json b/prowler/providers/aws/services/s3/s3_account_level_public_access_blocks/s3_account_level_public_access_blocks.metadata.json index a2caeca720..d9caa2a338 100644 --- a/prowler/providers/aws/services/s3/s3_account_level_public_access_blocks/s3_account_level_public_access_blocks.metadata.json +++ b/prowler/providers/aws/services/s3/s3_account_level_public_access_blocks/s3_account_level_public_access_blocks.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "s3_account_level_public_access_blocks", - "CheckTitle": "Check S3 Account Level Public Access Block.", + "CheckTitle": "S3 account-level Block Public Access ignores public ACLs and restricts public buckets", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsS3AccountPublicAccessBlock", "ResourceGroup": "storage", - "Description": "Check S3 Account Level Public Access Block.", - "Risk": "Public access policies may be applied to sensitive data buckets.", + "Description": "**Amazon S3** account-level **Block Public Access** is assessed for `ignore_public_acls` and `restrict_public_buckets` to confirm centralized blocking of ACL-based public access and limiting buckets with public policies to in-account principals.", + "Risk": "Absent these settings, **public ACLs** and broad bucket policies may grant internet or cross-account access. This risks:\n- Confidentiality: bulk data exfiltration\n- Integrity: object overwrite/tampering\n- Availability: malicious deletions or malware hosting, triggering takedowns", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + ], "Remediation": { "Code": { - "CLI": "aws s3control put-public-access-block --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --account-id ", - "NativeIaC": "https://docs.prowler.com/checks/aws/s3-policies/bc_aws_s3_21#cloudformation", - "Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/s3/s3control/block-public-access", - "Terraform": "https://docs.prowler.com/checks/aws/s3-policies/bc_aws_s3_21#terraform" + "CLI": "aws s3control put-public-access-block --account-id --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true", + "NativeIaC": "```yaml\n# CloudFormation: Enable required S3 Account-level Block Public Access settings\nResources:\n :\n Type: AWS::S3::AccountPublicAccessBlock\n Properties:\n AccountId: !Ref AWS::AccountId\n IgnorePublicAcls: true # Critical: Ignores any public ACLs at the account level\n RestrictPublicBuckets: true # Critical: Restricts buckets with public policies to only same-account principals\n```", + "Other": "1. In the AWS Console, go to S3\n2. Click Block public access (account settings)\n3. Click Edit\n4. Turn on: Ignore public ACLs and Restrict public buckets\n5. Click Save changes", + "Terraform": "```hcl\n# Terraform: Enable required S3 Account-level Block Public Access settings\nresource \"aws_s3_account_public_access_block\" \"\" {\n ignore_public_acls = true # Critical: Ignores any public ACLs account-wide\n restrict_public_buckets = true # Critical: Restricts buckets with public policies to same-account principals\n}\n```" }, "Recommendation": { - "Text": "You can enable Public Access Block at the account level to prevent the exposure of your data stored in S3.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + "Text": "Turn on account-level **Block Public Access** (prefer enabling all four: `block_public_acls`, `ignore_public_acls`, `block_public_policy`, `restrict_public_buckets`) to enforce least privilege. For legitimate access, use private buckets with **CloudFront**, VPC endpoints, or presigned URLs. Regularly review policies with IAM Access Analyzer.", + "Url": "https://hub.prowler.com/check/s3_account_level_public_access_blocks" } }, - "Categories": [], + "Categories": [ + "internet-exposed" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_bucket_acl_prohibited/s3_bucket_acl_prohibited.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_acl_prohibited/s3_bucket_acl_prohibited.metadata.json index b33e90e09e..3d20a8d11d 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_acl_prohibited/s3_bucket_acl_prohibited.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_acl_prohibited/s3_bucket_acl_prohibited.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "s3_bucket_acl_prohibited", - "CheckTitle": "Check if S3 buckets have ACLs enabled", + "CheckTitle": "S3 bucket has bucket ACLs disabled", "CheckType": [ - "Logging and Monitoring" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have ACLs enabled", - "Risk": "S3 ACLs are a legacy access control mechanism that predates IAM. IAM and bucket policies are currently the preferred methods.", + "Description": "**Amazon S3 buckets** are evaluated for **Object Ownership** set to `BucketOwnerEnforced`, which disables bucket and object ACLs. Buckets using any other ownership setting indicate that ACLs remain enabled.", + "Risk": "With **ACLs enabled**, access can bypass centralized policy controls, impacting confidentiality and integrity.\n- Unintended public or cross-account reads/writes\n- Object-writer ownership blocking bucket-owner governance\n- Per-object grants hinder auditing, enabling data exfiltration or tampering", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/ensure-object-ownership.html" + ], "Remediation": { "Code": { - "CLI": "aws s3api put-bucket-ownership-controls --bucket --ownership-controls Rules=[{ObjectOwnership=BucketOwnerEnforced}]", - "NativeIaC": "https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-s3-bucket-ownershipcontrols.html", - "Other": "", - "Terraform": "" + "CLI": "aws s3api put-bucket-ownership-controls --bucket --ownership-controls \"Rules=[{ObjectOwnership=BucketOwnerEnforced}]\"", + "NativeIaC": "```yaml\n# CloudFormation: Disable ACLs by enforcing bucket owner for all objects\nResources:\n OwnershipControls:\n Type: AWS::S3::BucketOwnershipControls\n Properties:\n Bucket: \n OwnershipControls:\n Rules:\n - ObjectOwnership: BucketOwnerEnforced # Critical: Disables ACLs and makes bucket owner the object owner\n```", + "Other": "1. In the AWS Console, go to S3 > Buckets and select the target bucket\n2. Open the Permissions tab\n3. In Object Ownership, click Edit\n4. Select Bucket owner enforced (ACLs disabled)\n5. Click Save changes", + "Terraform": "```hcl\n# Disable ACLs by enforcing bucket owner for all objects\nresource \"aws_s3_bucket_ownership_controls\" \"\" {\n bucket = \"\"\n rule {\n object_ownership = \"BucketOwnerEnforced\" # Critical: Disables ACLs and enforces bucket owner\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure that S3 ACLs are disabled (BucketOwnerEnforced). Use IAM policies and bucket policies to manage access.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/about-object-ownership.html" + "Text": "Disable ACLs by setting **Object Ownership** to `BucketOwnerEnforced` and manage access with **IAM** and **bucket policies** under **least privilege**. Centralize authorization, review policies regularly, and use organizational guardrails to prevent re-enabling ACLs. *Migrate ACL-based grants into policies before the change.*", + "Url": "https://hub.prowler.com/check/s3_bucket_acl_prohibited" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_bucket_cross_account_access/s3_bucket_cross_account_access.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_cross_account_access/s3_bucket_cross_account_access.metadata.json index c71b56abdf..c92912b2cd 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_cross_account_access/s3_bucket_cross_account_access.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_cross_account_access/s3_bucket_cross_account_access.metadata.json @@ -1,32 +1,42 @@ { "Provider": "aws", "CheckID": "s3_bucket_cross_account_access", - "CheckTitle": "Ensure that general-purpose bucket policies restrict access to other AWS accounts.", + "CheckTitle": "S3 bucket policy does not allow cross-account access", "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Initial Access/Unauthorized Access", "Effects/Data Exposure" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "This check verifies that S3 bucket policies are configured in a way that limits access to the intended AWS accounts only, preventing unauthorized access by external or unintended accounts.", - "Risk": "Allowing other AWS accounts to perform sensitive actions (e.g., modifying bucket policies, ACLs, or encryption settings) on your S3 buckets can lead to data exposure, unauthorized access, or misconfigurations, increasing the risk of insider threats or attacks.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html", + "Description": "**Amazon S3 bucket policies** are analyzed for statements that grant **cross-account access**.\n\nAny policy that names principals outside the owning account (other account IDs or `Principal: \"*\"`) is treated as cross-account; absence of a policy implies no cross-account grants.", + "Risk": "Cross-account grants can let external principals read, write, or administer the bucket, impacting:\n- Confidentiality: unauthorized object access/exfiltration\n- Integrity: object tampering, policy or encryption changes\n- Availability: deletions, versioning changes, or lockouts causing data loss and downtime", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-6", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-6", - "Terraform": "" + "CLI": "aws s3api delete-bucket-policy --bucket ", + "NativeIaC": "```yaml\n# CloudFormation: restrict bucket policy to this AWS account only\nResources:\n BucketPolicy:\n Type: AWS::S3::BucketPolicy\n Properties:\n Bucket: \n PolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Principal:\n AWS: !Sub arn:aws:iam::${AWS::AccountId}:root # Critical: limits access to the bucket owner's account, preventing cross-account access\n Action: s3:*\n Resource:\n - !Sub arn:aws:s3:::\n - !Sub arn:aws:s3:::/*\n```", + "Other": "1. In the AWS console, go to S3 > Buckets > select the bucket\n2. Open the Permissions tab > Bucket policy\n3. Click Delete bucket policy (or remove all statements) and Save\n4. If a policy is required, ensure all statements only use your account as Principal (arn:aws:iam:::root); remove any other accounts or \"*\"", + "Terraform": "```hcl\n# Terraform: restrict bucket policy to this AWS account only\nresource \"aws_s3_bucket_policy\" \"\" {\n bucket = \"\"\n policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Principal = { AWS = \"arn:aws:iam:::root\" } # Critical: limits access to the bucket owner's account, preventing cross-account access\n Action = \"s3:*\"\n Resource = [\n \"arn:aws:s3:::\",\n \"arn:aws:s3:::/*\"\n ]\n }]\n })\n}\n```" }, "Recommendation": { - "Text": "Review and update your S3 bucket policies to remove permissions that grant external AWS accounts access to critical actions and implement least privilege principles to ensure sensitive operations are restricted to trusted accounts only", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + "Text": "Enforce **least privilege**: limit bucket policy `Principal` to your account or approved org IDs with fixed values; avoid wildcards.\n\nUse **role-based cross-account access** with scoped permissions when needed. Add **defense-in-depth** conditions (private networks, TLS), and periodically review for unintended external access.", + "Url": "https://hub.prowler.com/check/s3_bucket_cross_account_access" } }, - "Categories": [], + "Categories": [ + "identity-access", + "trust-boundaries" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_bucket_cross_region_replication/s3_bucket_cross_region_replication.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_cross_region_replication/s3_bucket_cross_region_replication.metadata.json index a5cf1642b8..932ba8ed9c 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_cross_region_replication/s3_bucket_cross_region_replication.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_cross_region_replication/s3_bucket_cross_region_replication.metadata.json @@ -1,33 +1,38 @@ { "Provider": "aws", "CheckID": "s3_bucket_cross_region_replication", - "CheckTitle": "Check if S3 buckets use cross region replication.", + "CheckTitle": "S3 bucket has cross-region replication configured to a bucket in a different region", "CheckType": [ - "Secure access management" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Destruction" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Verifying whether S3 buckets have cross-region replication enabled, ensuring data redundancy and availability across multiple AWS regions", - "Risk": "Without cross-region replication in S3 buckets, data is at risk of being lost or inaccessible if an entire region goes down, leading to potential service disruptions and data unavailability.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html", + "Description": "**Amazon S3 buckets** use **cross-Region replication** with `versioning` and an enabled rule that targets a destination bucket in a different AWS Region.\n\nBuckets with same-Region targets, missing destinations, or disabled `versioning` don't meet this replication posture.", + "Risk": "**Single-Region storage** creates an availability gap: a Regional outage, control-plane isolation, or denial of service can make data **unreachable**.\n\nLack of replication raises RPO/RTO, delaying recovery and disrupting multi-Region workloads. Missing replicas also weaken data **integrity** during restore from corruption or deletion.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-7", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-7", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-s3-bucket-has-cross-region-replication-enabled#terraform" + "NativeIaC": "```yaml\n# CloudFormation: Enable versioning and CRR to a bucket in another region\nResources:\n ExampleBucket:\n Type: AWS::S3::Bucket\n Properties:\n VersioningConfiguration:\n Status: Enabled # critical: enables versioning (required for replication)\n ReplicationConfiguration: # critical: enables cross-Region replication\n Role: !GetAtt ReplicationRole.Arn\n Rules:\n - Status: Enabled # critical: replication rule must be enabled\n Destination:\n Bucket: arn:aws:s3::: # critical: destination bucket ARN in a different region\n\n ReplicationRole:\n Type: AWS::IAM::Role\n Properties:\n AssumeRolePolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Principal:\n Service: s3.amazonaws.com\n Action: sts:AssumeRole\n Policies:\n - PolicyName: s3-replication-minimal\n PolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Action:\n - s3:ListBucket\n - s3:GetReplicationConfiguration\n Resource: !Sub arn:aws:s3:::${ExampleBucket}\n - Effect: Allow\n Action:\n - s3:GetObjectVersionForReplication\n - s3:GetObjectVersionAcl\n - s3:GetObjectVersionTagging\n Resource: !Sub arn:aws:s3:::${ExampleBucket}/*\n - Effect: Allow\n Action:\n - s3:ReplicateObject\n - s3:ReplicateDelete\n - s3:ReplicateTags\n Resource: arn:aws:s3:::/*\n```", + "Other": "1. In the S3 console, open the source bucket\n2. Go to Properties > Bucket Versioning and click Enable\n3. Go to Management > Replication rules > Create replication rule\n4. Scope: Apply to all objects in the bucket\n5. Destination: Select a bucket in a different AWS Region\n6. Status: Ensure Enabled is selected\n7. IAM role: Choose Create new role (recommended)\n8. Save the rule", + "Terraform": "```hcl\n# Enable versioning and minimal CRR to a bucket in another region\nresource \"aws_s3_bucket\" \"source\" {\n bucket = \"\"\n\n versioning { \n enabled = true # critical: required for replication\n }\n\n replication_configuration { \n role = aws_iam_role.replication.arn # critical: role used by S3 to replicate\n\n rules {\n status = \"Enabled\" # critical: replication rule must be enabled\n destination {\n bucket = \"arn:aws:s3:::\" # critical: destination bucket ARN in a different region\n }\n }\n }\n}\n\nresource \"aws_iam_role\" \"replication\" {\n name = \"-s3-replication-role\"\n assume_role_policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Principal = { Service = \"s3.amazonaws.com\" }\n Action = \"sts:AssumeRole\"\n }]\n })\n}\n\nresource \"aws_iam_role_policy\" \"replication\" {\n name = \"-s3-replication-policy\"\n role = aws_iam_role.replication.id\n policy = jsonencode({\n Version = \"2012-10-17\",\n Statement = [\n {\n Effect = \"Allow\",\n Action = [\"s3:ListBucket\", \"s3:GetReplicationConfiguration\"],\n Resource = \"arn:aws:s3:::${aws_s3_bucket.source.bucket}\"\n },\n {\n Effect = \"Allow\",\n Action = [\n \"s3:GetObjectVersionForReplication\",\n \"s3:GetObjectVersionAcl\",\n \"s3:GetObjectVersionTagging\"\n ],\n Resource = \"arn:aws:s3:::${aws_s3_bucket.source.bucket}/*\"\n },\n {\n Effect = \"Allow\",\n Action = [\"s3:ReplicateObject\", \"s3:ReplicateDelete\", \"s3:ReplicateTags\"],\n Resource = \"arn:aws:s3:::/*\"\n }\n ]\n })\n}\n```" }, "Recommendation": { - "Text": "Ensure that S3 buckets have cross region replication.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough1.html" + "Text": "Enable **CRR** to a different Region with `versioning` and least-privilege roles.\n\n- Replicate needed prefixes and metadata\n- Consider `S3 Replication Time Control` for tighter RPO\n- Protect deletes via `delete marker` strategy and Object Lock\n- Monitor replication metrics and test DR regularly\n\nAlign with **defense in depth** and availability by design.", + "Url": "https://hub.prowler.com/check/s3_bucket_cross_region_replication" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.metadata.json index 569aa01dcc..eb0c07e8af 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_default_encryption/s3_bucket_default_encryption.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "s3_bucket_default_encryption", - "CheckTitle": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.", + "CheckTitle": "S3 bucket has default server-side encryption (SSE) enabled", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.", - "Risk": "Amazon S3 default encryption provides a way to set the default encryption behavior for an S3 bucket. This will ensure data-at-rest is encrypted.", + "Description": "**Amazon S3 buckets** have a default **server-side encryption** setting that automatically encrypts new objects using `SSE-S3` or `SSE-KMS`. This evaluates whether a bucket has a default encryption configuration defined.", + "Risk": "Without default encryption, older objects may remain unencrypted and new uploads won't be forced to use `SSE-KMS`. This reduces confidentiality and governance by limiting key audit logs, rotation, and cross-account controls, and increases exposure if data is copied, replicated, or accessed outside intended paths.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.amazonaws.cn/en_us/AmazonS3/latest/userguide/bucket-encryption.html", + "https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/", + "https://docs.aws.amazon.com/us_en/AmazonS3/latest/userguide/default-encryption-faq.html" + ], "Remediation": { "Code": { - "CLI": "aws s3api put-bucket-encryption --bucket --server-side-encryption-configuration '{'Rules': [{'ApplyServerSideEncryptionByDefault': {'SSEAlgorithm': 'AES256'}}]}'", - "NativeIaC": "https://docs.prowler.com/checks/aws/s3-policies/s3_14-data-encrypted-at-rest#cloudformation", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/s3-policies/s3_14-data-encrypted-at-rest#terraform" + "CLI": "aws s3api put-bucket-encryption --bucket --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"AES256\"}}]}'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n BucketEncryption:\n ServerSideEncryptionConfiguration:\n - ServerSideEncryptionByDefault:\n SSEAlgorithm: AES256 # Critical: enables default SSE-S3 so new objects are encrypted\n```", + "Other": "1. Open the AWS S3 console and select the bucket\n2. Go to the Properties tab\n3. In Default encryption, click Edit\n4. Enable default encryption and select SSE-S3 (AES-256)\n5. Click Save changes", + "Terraform": "```hcl\nresource \"aws_s3_bucket\" \"\" {\n bucket = \"\"\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"\" {\n bucket = aws_s3_bucket..id\n\n rule {\n apply_server_side_encryption_by_default {\n sse_algorithm = \"AES256\" # Critical: enables default SSE-S3 for the bucket\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure that S3 buckets have encryption at rest enabled.", - "Url": "https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/" + "Text": "Enable default encryption on all buckets, preferring `SSE-KMS` for sensitive data to retain key control and auditing. Enforce encryption with restrictive bucket policies, apply **least privilege** to KMS keys with rotation, and re-encrypt existing objects. Use **defense in depth** monitoring to detect drift and noncompliant uploads.", + "Url": "https://hub.prowler.com/check/s3_bucket_default_encryption" } }, "Categories": [ diff --git a/prowler/providers/aws/services/s3/s3_bucket_event_notifications_enabled/s3_bucket_event_notifications_enabled.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_event_notifications_enabled/s3_bucket_event_notifications_enabled.metadata.json index 5d67f3325b..eecbe4df3e 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_event_notifications_enabled/s3_bucket_event_notifications_enabled.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_event_notifications_enabled/s3_bucket_event_notifications_enabled.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "s3_bucket_event_notifications_enabled", - "CheckTitle": "Check if S3 buckets have event notifications enabled.", + "CheckTitle": "S3 bucket has event notifications enabled", "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "low", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Ensure whether S3 buckets have event notifications enabled.", - "Risk": "Without event notifications, important actions on S3 buckets may go unnoticed, leading to missed opportunities for timely response to critical changes, such as object creation, deletion, or updates that could impact data security and availability.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html#supported-notification-event-types", + "Description": "**Amazon S3 buckets** define a **notification configuration** that publishes bucket events (for example `s3:ObjectCreated:*`, `s3:ObjectRemoved:*`) to a destination. The evaluation identifies buckets that lack any notification setup.", + "Risk": "Missing notifications leaves object and bucket changes **unseen**, weakening **integrity** and **availability** oversight. Undetected deletions, policy drift, or replication issues can stall data pipelines (S3 to Lambda/SQS), slow incident response, and allow tampering or exfiltration to persist longer.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-11", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-11", - "Terraform": "" + "CLI": "aws s3api put-bucket-notification-configuration --bucket --notification-configuration '{\"EventBridgeConfiguration\": {}}'", + "NativeIaC": "```yaml\n# CloudFormation: Enable S3 event notifications via EventBridge\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n NotificationConfiguration:\n EventBridgeConfiguration: {} # Critical: turns on EventBridge notifications, making notifications enabled\n```", + "Other": "1. Open the S3 console and select your bucket\n2. Go to the Properties tab\n3. In Event notifications, find Amazon EventBridge and turn it On (Enable)\n4. Click Save changes", + "Terraform": "```hcl\n# Enable S3 event notifications via EventBridge\nresource \"aws_s3_bucket_notification\" \"\" {\n bucket = \"\"\n\n eventbridge {} # Critical: enables EventBridge delivery, satisfying notifications enabled\n}\n```" }, "Recommendation": { - "Text": "Enable event notifications for all S3 general-purpose buckets to monitor important events such as object creation, deletion, tagging, and lifecycle events, ensuring visibility and quick action on relevant changes.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/EventNotifications.html" + "Text": "Enable **S3 event notifications** for relevant events (e.g., `s3:ObjectCreated:*`, `s3:ObjectRemoved:*`) and route to controlled destinations (SNS, SQS, Lambda, EventBridge).\n\nUse prefix/suffix filters, avoid recursive triggers, and enforce **least privilege** on targets. Pair with object-level logging for **defense in depth**.", + "Url": "https://hub.prowler.com/check/s3_bucket_event_notifications_enabled" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_bucket_kms_encryption/s3_bucket_kms_encryption.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_kms_encryption/s3_bucket_kms_encryption.metadata.json index d8741fc837..9c593ab704 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_kms_encryption/s3_bucket_kms_encryption.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_kms_encryption/s3_bucket_kms_encryption.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "s3_bucket_kms_encryption", - "CheckTitle": "Check if S3 buckets have KMS encryption enabled.", + "CheckTitle": "S3 bucket has server-side encryption with AWS KMS", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have KMS encryption enabled.", - "Risk": "Amazon S3 KMS encryption provides a way to set the encryption behavior for an S3 bucket using a managed key. This will ensure data-at-rest is encrypted.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html", + "Description": "**Amazon S3 buckets** use server-side encryption with **AWS KMS** keys, including dual-layer `aws:kms:dsse`. The evaluation identifies buckets whose default encryption is `aws:kms` or `aws:kms:dsse` rather than SSE-S3.", + "Risk": "Without **KMS-based encryption**, data relies only on SSE-S3, reducing **confidentiality** controls. Missing key policies and grants weakens **least privilege**, cross-account scoping, and the ability to disable or rotate keys. Lack of **KMS audit trails** obscures key usage, hindering detection of misuse and **defense in depth**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/default-bucket-encryption.html", + "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/encrypted-with-kms-customer-master-keys.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html" + ], "Remediation": { "Code": { - "CLI": "aws put-bucket-encryption --bucket --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"aws:kms\",\"KMSMasterKeyID\":\"arn:aws:kms:::key/\"}}]}'", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/encrypted-with-kms-customer-master-keys.html", - "Other": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/encrypted-with-kms-customer-master-keys.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-s3-buckets-are-encrypted-with-kms-by-default#terraform" + "CLI": "aws s3api put-bucket-encryption --bucket --server-side-encryption-configuration '{\"Rules\":[{\"ApplyServerSideEncryptionByDefault\":{\"SSEAlgorithm\":\"aws:kms\"}}]}'", + "NativeIaC": "```yaml\n# CloudFormation: enable default SSE-KMS on the bucket\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n BucketEncryption:\n ServerSideEncryptionConfiguration:\n - ServerSideEncryptionByDefault:\n SSEAlgorithm: aws:kms # Critical: sets default encryption to AWS KMS (SSE-KMS)\n```", + "Other": "1. In the AWS Console, go to S3 and open the target bucket\n2. Select the Properties tab\n3. Under Default encryption, click Edit\n4. Choose Server-side encryption with AWS KMS keys (SSE-KMS)\n5. Leave AWS managed key (aws/s3) selected (or choose your CMK if required)\n6. Click Save changes", + "Terraform": "```hcl\n# Enable default SSE-KMS on an existing S3 bucket\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"\" {\n bucket = \"\"\n\n rule {\n apply_server_side_encryption_by_default {\n sse_algorithm = \"aws:kms\" # Critical: enforces SSE-KMS by default\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure that S3 buckets have encryption at rest enabled using KMS.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html" + "Text": "Enable default **SSE-KMS** (or **DSSE-KMS** for highly sensitive data). Use a customer-managed key, enforce **least privilege** and separation of duties for key usage, and require KMS encryption via bucket policy (specify `aws:kms` and a designated key). Monitor key activity in **CloudTrail** and consider **S3 Bucket Keys** to control cost.", + "Url": "https://hub.prowler.com/check/s3_bucket_kms_encryption" } }, "Categories": [ diff --git a/prowler/providers/aws/services/s3/s3_bucket_level_public_access_block/s3_bucket_level_public_access_block.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_level_public_access_block/s3_bucket_level_public_access_block.metadata.json index e5f014b637..20796001ab 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_level_public_access_block/s3_bucket_level_public_access_block.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_level_public_access_block/s3_bucket_level_public_access_block.metadata.json @@ -1,36 +1,41 @@ { "Provider": "aws", "CheckID": "s3_bucket_level_public_access_block", - "CheckTitle": "Check S3 Bucket Level Public Access Block.", + "CheckTitle": "S3 bucket has Block Public Access with IgnorePublicAcls and RestrictPublicBuckets enabled at bucket or account level", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check S3 Bucket Level Public Access Block.", - "Risk": "Public access policies may be applied to sensitive data buckets.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html", + "Description": "**Amazon S3 buckets** are evaluated for **Block Public Access** settings, ensuring `ignore_public_acls` and `restrict_public_buckets` are enabled at the bucket or account scope.\n\n*Account-wide protections, when present, are treated as effective for the bucket.*", + "Risk": "Absent **S3 Block Public Access**, public ACLs or broad policies can grant Internet or cross-account access.\n- Data disclosure (confidentiality)\n- Object overwrite or uploads (integrity)\n- Deletion or outages from misuse (availability)", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/bucket-public-access-block.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + ], "Remediation": { "Code": { - "CLI": "aws s3api put-public-access-block --region --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --bucket ", - "NativeIaC": "", - "Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/s3/s3/block-public-access", - "Terraform": "https://docs.prowler.com/checks/aws/s3-policies/bc_aws_s3_20#terraform" + "CLI": "aws s3api put-public-access-block --bucket --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true", + "NativeIaC": "```yaml\n# CloudFormation - enable required S3 Block Public Access settings on a bucket\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n PublicAccessBlockConfiguration:\n IgnorePublicAcls: true # CRITICAL: Ignore public ACLs on the bucket/objects\n RestrictPublicBuckets: true # CRITICAL: Restrict buckets with public policies to same-account/AWS services\n```", + "Other": "1. In AWS Console, open S3 and select the target bucket\n2. Go to Permissions > Block public access (bucket settings)\n3. Enable only:\n - Ignore public ACLs\n - Restrict public buckets\n4. Click Save changes\n5. (Alternatively, to apply account-wide) S3 > Account settings > Block Public Access: enable the same two options and Save", + "Terraform": "```hcl\n# Enable required S3 Block Public Access settings on a bucket\nresource \"aws_s3_bucket_public_access_block\" \"\" {\n bucket = \"\"\n ignore_public_acls = true # CRITICAL: Ignore public ACLs\n restrict_public_buckets = true # CRITICAL: Restrict public buckets\n}\n```" }, "Recommendation": { - "Text": "You can enable Public Access Block at the bucket level to prevent the exposure of your data stored in S3.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + "Text": "Enable **Block Public Access** at account and bucket levels with `block_public_acls`, `ignore_public_acls`, `block_public_policy`, and `restrict_public_buckets` set to `true`. Apply **least privilege** and **defense in depth**. *If public access is required*, narrowly scope policies to fixed principals and conditions.", + "Url": "https://hub.prowler.com/check/s3_bucket_level_public_access_block" } }, - "Categories": [], - "Tags": { - "Tag1Key": "value", - "Tag2Key": "value" - }, + "Categories": [ + "internet-exposed" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_bucket_lifecycle_enabled/s3_bucket_lifecycle_enabled.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_lifecycle_enabled/s3_bucket_lifecycle_enabled.metadata.json index f7b13296e3..855aed9511 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_lifecycle_enabled/s3_bucket_lifecycle_enabled.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_lifecycle_enabled/s3_bucket_lifecycle_enabled.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "s3_bucket_lifecycle_enabled", - "CheckTitle": "Check if S3 buckets have a Lifecycle configuration enabled", + "CheckTitle": "S3 bucket has a lifecycle configuration enabled", "CheckType": [ - "AWS Foundational Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have Lifecycle configuration enabled.", - "Risk": "The risks of not having lifecycle management enabled for S3 buckets include higher storage costs, unmanaged data retention, and potential non-compliance with data policies.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html", + "Description": "**Amazon S3 buckets** use **Lifecycle configurations** with at least one rule `Status: Enabled` to automate object `Transitions` and `Expiration` based on age, prefix, or tags", + "Risk": "Without lifecycle rules, objects persist indefinitely, driving costs and retaining sensitive data beyond policy. Unchecked log/version growth strains operations and recovery. Long-lived data increases exposure if the account is compromised and can break required deletion timelines, affecting confidentiality and availability.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-13", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lifecycle-mgmt.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-set-lifecycle-configuration-intro.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/lifecycle-configuration.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-13", - "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/lifecycle-configuration.html" + "CLI": "aws s3api put-bucket-lifecycle-configuration --bucket --lifecycle-configuration '{\"Rules\":[{\"Status\":\"Enabled\",\"Filter\":{\"Prefix\":\"\"},\"AbortIncompleteMultipartUpload\":{\"DaysAfterInitiation\":7}}]}'", + "NativeIaC": "```yaml\n# CloudFormation: enable a minimal S3 Lifecycle configuration\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n LifecycleConfiguration: # CRITICAL: Adds a Lifecycle configuration to the bucket\n Rules:\n - Status: Enabled # CRITICAL: Rule must be Enabled to pass the check\n Filter:\n Prefix: \"\" # Applies to all objects\n AbortIncompleteMultipartUpload:\n DaysAfterInitiation: 7 # Minimal action to satisfy schema\n```", + "Other": "1. In the AWS Console, go to S3 and open the target bucket\n2. Select the Management tab, then click Create lifecycle rule\n3. Enter a name and choose This rule applies to all objects in the bucket\n4. Under Lifecycle rule actions, select Clean up incomplete multipart uploads and set Days after initiation to 7\n5. Ensure Status is Enabled and click Create rule", + "Terraform": "```hcl\n# Minimal lifecycle configuration to mark the bucket as having an enabled rule\nresource \"aws_s3_bucket_lifecycle_configuration\" \"\" {\n bucket = \"\"\n\n rule {\n status = \"Enabled\" # CRITICAL: Enables lifecycle rule to pass the check\n filter {} # Applies to all objects\n\n abort_incomplete_multipart_upload {\n days_after_initiation = 7 # Minimal action to satisfy schema\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Enable lifecycle policies on your S3 buckets to automatically manage the transition and expiration of data.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/how-to-set-lifecycle-configuration-intro.html" + "Text": "Define **Lifecycle policies** by data classification: set `Expiration` to enforce retention, use `Transitions` to lower-cost classes, and enable `AbortIncompleteMultipartUpload`. For critical logs, keep versioning and, *if required*, **Object Lock**. Limit who can change lifecycle using least privilege and separation of duties.", + "Url": "https://hub.prowler.com/check/s3_bucket_lifecycle_enabled" } }, "Categories": [], diff --git a/prowler/providers/aws/services/s3/s3_bucket_no_mfa_delete/s3_bucket_no_mfa_delete.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_no_mfa_delete/s3_bucket_no_mfa_delete.metadata.json index 54d40697ca..1b08dc66ae 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_no_mfa_delete/s3_bucket_no_mfa_delete.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_no_mfa_delete/s3_bucket_no_mfa_delete.metadata.json @@ -1,32 +1,41 @@ { "Provider": "aws", "CheckID": "s3_bucket_no_mfa_delete", - "CheckTitle": "Check if S3 bucket MFA Delete is not enabled.", + "CheckTitle": "S3 bucket has MFA Delete enabled", "CheckType": [ - "Logging and Monitoring" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Destruction" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 bucket MFA Delete is not enabled.", - "Risk": "Your security credentials are compromised or unauthorized access is granted.", + "Description": "**Amazon S3 buckets** are assessed for **MFA Delete** status. MFA Delete requires a second factor to permanently delete object versions or change `Versioning` configuration. The finding highlights buckets where this protection is not enabled.", + "Risk": "Without **MFA Delete**, a compromised or over-privileged identity can irrevocably purge object history or change versioning.\n\nThis erases recovery points, degrading data **availability**, weakening **integrity**, and increasing the blast radius of account compromise or ransomware.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingMFADelete.html" + ], "Remediation": { "Code": { - "CLI": "aws s3api put-bucket-versioning --profile my-root-profile --bucket my-bucket-name --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa 'arn:aws:iam::00000000:mfa/root-account-mfa-device 123456'", + "CLI": "aws s3api put-bucket-versioning --bucket --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa \" \"", "NativeIaC": "", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/s3-policies/bc_aws_s3_24#terraform" + "Other": "1. Sign in to the AWS Management Console as the root user\n2. Open the account menu > Security credentials > Multi-factor authentication (MFA) and assign an MFA device; copy its ARN/serial\n3. From a machine configured to use the root user credentials, run:\n\n```bash\naws s3api put-bucket-versioning --bucket --versioning-configuration Status=Enabled,MFADelete=Enabled --mfa \" \"\n```", + "Terraform": "" }, "Recommendation": { - "Text": "Adding MFA delete to an S3 bucket, requires additional authentication when you change the version state of your bucket or you delete and object version adding another layer of security in the event your security credentials are compromised or unauthorized access is granted.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiFactorAuthenticationDelete.html" + "Text": "Enable **MFA Delete** on sensitive, versioned buckets so permanent deletions and `Versioning` changes require a second factor. Apply **least privilege** to restrict version purge actions, enforce **change control**, and combine with **Object Lock** or immutable backups for defense in depth.", + "Url": "https://hub.prowler.com/check/s3_bucket_no_mfa_delete" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_bucket_object_lock/s3_bucket_object_lock.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_object_lock/s3_bucket_object_lock.metadata.json index 54a639a61c..018902cb4c 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_object_lock/s3_bucket_object_lock.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_object_lock/s3_bucket_object_lock.metadata.json @@ -1,32 +1,41 @@ { "Provider": "aws", "CheckID": "s3_bucket_object_lock", - "CheckTitle": "Check if S3 buckets have object lock enabled", + "CheckTitle": "S3 bucket has Object Lock enabled", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Destruction" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have object lock enabled", - "Risk": "Store objects using a write-once-read-many (WORM) model to help you prevent objects from being deleted or overwritten for a fixed amount of time or indefinitely. That helps to prevent ransomware attacks.", + "Description": "**Amazon S3 buckets** have **Object Lock** enabled at the bucket level, applying WORM controls to object versions", + "Risk": "Without **Object Lock**, object versions can be deleted or overwritten, undermining data **integrity** and **availability**.\n\nThreats include ransomware erasing backups, insider or mistaken deletions, and tampering that defeats recovery. Inability to enforce retention or legal holds increases exposure to data loss and compliance gaps.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html", + "https://aws.amazon.com/about-aws/whats-new/2018/11/s3-object-lock/", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/object-lock.html", + "https://docs.aws.amazon.com/de_de/cli/latest/reference/s3api/put-object-lock-configuration.html" + ], "Remediation": { "Code": { - "CLI": "aws s3 put-object-lock-configuration --bucket --object-lock-configuration '{\"ObjectLockEnabled\":\"Enabled\",\"Rule\":{\"DefaultRetention\":{\"Mode\":\"GOVERNANCE\",\"Days\":1}}}'", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/object-lock.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-s3-bucket-has-lock-configuration-enabled-by-default#terraform" + "CLI": "aws s3api put-object-lock-configuration --bucket --object-lock-configuration '{\"ObjectLockEnabled\":\"Enabled\",\"Rule\":{\"DefaultRetention\":{\"Mode\":\"GOVERNANCE\",\"Days\":1}}}'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n ObjectLockEnabled: true # CRITICAL: Enables Object Lock on the bucket at creation\n ObjectLockConfiguration:\n ObjectLockEnabled: Enabled # CRITICAL: Turns on Object Lock configuration\n Rule:\n DefaultRetention:\n Mode: GOVERNANCE # CRITICAL: Sets default retention mode\n Days: 1 # CRITICAL: Minimal retention to enable default lock\n```", + "Other": "1. Open the AWS S3 console and select the target bucket\n2. Go to the Properties tab\n3. Find Object Lock and click Edit\n4. Enable Object Lock\n5. Set Default retention: Mode = Governance, Days = 1\n6. Click Save changes\n\nNote: If the bucket was not created with Object Lock, create a new bucket with Object Lock enabled and migrate objects.", + "Terraform": "```hcl\nresource \"aws_s3_bucket_object_lock_configuration\" \"\" {\n bucket = \"\"\n object_lock_enabled = \"Enabled\" # CRITICAL: Enables Object Lock configuration on the bucket\n rule {\n default_retention {\n mode = \"GOVERNANCE\" # CRITICAL: Default retention mode\n days = 1 # CRITICAL: Minimal retention period\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure that your Amazon S3 buckets have Object Lock feature enabled in order to prevent the objects they store from being deleted.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html" + "Text": "Enable **Object Lock** for critical data and set appropriate default retention in `GOVERNANCE` or `COMPLIANCE` mode.\n\nApply **immutability** and **least privilege** by restricting permissions that bypass retention, and use legal holds when you need indefinite protection for investigations or regulatory requirements.", + "Url": "https://hub.prowler.com/check/s3_bucket_object_lock" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_bucket_object_versioning/s3_bucket_object_versioning.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_object_versioning/s3_bucket_object_versioning.metadata.json index 5b8d9e5d56..0b5b42e789 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_object_versioning/s3_bucket_object_versioning.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_object_versioning/s3_bucket_object_versioning.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "s3_bucket_object_versioning", - "CheckTitle": "Check if S3 buckets have object versioning enabled", + "CheckTitle": "S3 bucket has object versioning enabled", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Destruction" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have object versioning enabled", - "Risk": "With versioning, you can easily recover from both unintended user actions and application failures.", + "Description": "**Amazon S3 buckets** are evaluated for **object versioning** being `Enabled`, which maintains multiple versions of the same object key for historical state retention", + "Risk": "Without **versioning**, deletions and overwrites remove the only copy, undermining **availability** and **integrity**.\n- Compromised identities or buggy apps can mass-delete/corrupt data\n- No historical versions means limited rollback and irrecoverable loss", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/dev-retired/Versioning.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/s3-policies/s3_16-enable-versioning#aws-console", - "Terraform": "https://docs.prowler.com/checks/aws/s3-policies/s3_16-enable-versioning#terraform" + "CLI": "aws s3api put-bucket-versioning --bucket --versioning-configuration Status=Enabled", + "NativeIaC": "```yaml\n# CloudFormation: enable versioning on an S3 bucket\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n VersioningConfiguration:\n Status: Enabled # Critical: turns on object versioning to pass the check\n```", + "Other": "1. In the AWS Console, go to S3 > Buckets and select the target bucket\n2. Open the Properties tab\n3. Find Bucket Versioning and click Edit\n4. Select Enable and click Save changes", + "Terraform": "```hcl\n# Enable versioning on an existing S3 bucket\nresource \"aws_s3_bucket_versioning\" \"\" {\n bucket = \"\"\n versioning_configuration {\n status = \"Enabled\" # Critical: enables bucket versioning to remediate the finding\n }\n}\n```" }, "Recommendation": { - "Text": "Configure versioning using the Amazon console or API for buckets with sensitive information that is changing frequently, and backup may not be enough to capture all the changes.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" + "Text": "Enable **S3 versioning** for buckets holding important or shared data.\n- Enforce **least privilege** to limit delete/overwrite\n- Use **Object Lock** and/or **MFA Delete** for stronger protection\n- Apply **lifecycle rules** to manage noncurrent versions and costs\n- Layer with backups/replication for **defense in depth**", + "Url": "https://hub.prowler.com/check/s3_bucket_object_versioning" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/s3/s3_bucket_policy_public_write_access/s3_bucket_policy_public_write_access.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_policy_public_write_access/s3_bucket_policy_public_write_access.metadata.json index 19a823ba64..784944d2d9 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_policy_public_write_access/s3_bucket_policy_public_write_access.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_policy_public_write_access/s3_bucket_policy_public_write_access.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "s3_bucket_policy_public_write_access", - "CheckTitle": "Check if S3 buckets have policies which allow WRITE access.", + "CheckTitle": "S3 bucket policy does not allow public write access", "CheckType": [ - "IAM" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Destruction", + "TTPs/Initial Access" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have policies which allow WRITE access.", - "Risk": "Non intended users can put objects in a given bucket.", + "Description": "**Amazon S3 bucket policies** are evaluated for **public write permissions** (e.g., `s3:PutObject`, `s3:Delete*`, or `s3:*`). Account or bucket **Public Access Block** that restricts public buckets is considered when determining exposure.", + "Risk": "Public write access lets anyone upload, overwrite, or delete objects, undermining **integrity** and **availability**. Attackers can plant malware, stage phishing content, poison data, or wipe buckets, causing outages and potential legal and cost impacts from storage abuse and content hosting.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/s3-policies/s3_18-write-permissions-public#aws-console", - "Terraform": "" + "CLI": "aws s3api put-public-access-block --bucket --public-access-block-configuration RestrictPublicBuckets=true", + "NativeIaC": "```yaml\n# CloudFormation: Enable bucket-level Public Access Block to prevent public policies from granting write\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n PublicAccessBlockConfiguration:\n RestrictPublicBuckets: true # Critical: blocks public access granted by any public bucket policy\n```", + "Other": "1. Open the AWS S3 console and select the target bucket\n2. Go to the Permissions tab\n3. Under Block public access (bucket settings), click Edit\n4. Enable \"Block public and cross-account access to buckets and objects through any public bucket or access point policies\"\n5. Click Save changes", + "Terraform": "```hcl\n# Enable bucket-level Public Access Block so public bucket policies (including write) are blocked\nresource \"aws_s3_bucket_public_access_block\" \"\" {\n bucket = \"\"\n restrict_public_buckets = true # Critical: prevents public access granted via bucket policies\n}\n```" }, "Recommendation": { - "Text": "Ensure proper bucket policy is in place with the least privilege principle applied.", - "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_s3_rw-bucket.html" + "Text": "Restrict writes to trusted principals using **least privilege**; avoid `Principal: \"*\"`. Enable **Public Access Block** at account and bucket levels for defense in depth. Prefer IAM roles over broad bucket policies, require private access paths, and enable versioning to recover from unwanted changes.", + "Url": "https://hub.prowler.com/check/s3_bucket_policy_public_write_access" } }, "Categories": [ diff --git a/prowler/providers/aws/services/s3/s3_bucket_public_access/s3_bucket_public_access.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_public_access/s3_bucket_public_access.metadata.json index 17bc58f884..97d4332e44 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_public_access/s3_bucket_public_access.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_public_access/s3_bucket_public_access.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "s3_bucket_public_access", - "CheckTitle": "Ensure there are no S3 buckets open to Everyone or Any AWS user.", + "CheckTitle": "S3 bucket is not publicly accessible to Everyone or Authenticated Users", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Ensure there are no S3 buckets open to Everyone or Any AWS user.", - "Risk": "Even if you enable all possible bucket ACL options available in the Amazon S3 console the ACL alone does not allow everyone to download objects from your bucket. Depending on which option you select any user could perform some actions.", + "Description": "**Amazon S3 buckets** are evaluated for **public access** via ACLs and bucket policies. The check identifies account or bucket `PublicAccessBlock` protections (`IgnorePublicAcls`, `RestrictPublicBuckets`) and flags buckets granting group access to `AllUsers` or `AuthenticatedUsers`, or with a public bucket policy.", + "Risk": "Publicly accessible buckets jeopardize **confidentiality** through unauthenticated reads, **integrity** through write or ACL changes, and **availability** via object deletion or overwrite. Attackers can mass-exfiltrate data, host malware, or pivot after discovering secrets stored in objects.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/id_id/kitchensink/latest/testguide/access-control-block-public-access.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + ], "Remediation": { "Code": { - "CLI": "aws s3api put-public-access-block --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true --bucket ", - "NativeIaC": "", - "Other": "https://github.com/cloudmatos/matos/tree/master/remediations/aws/s3/s3/block-public-access", - "Terraform": "https://docs.prowler.com/checks/aws/networking-policies/s3-bucket-should-have-public-access-blocks-defaults-to-false-if-the-public-access-block-is-not-attached#terraform" + "CLI": "aws s3api put-public-access-block --bucket --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true", + "NativeIaC": "```yaml\n# CloudFormation: Enable minimal S3 Block Public Access on the bucket\nResources:\n ExampleBucket:\n Type: AWS::S3::Bucket\n Properties:\n PublicAccessBlockConfiguration:\n IgnorePublicAcls: true # Critical: ignores any public ACL grants (AllUsers/AuthenticatedUsers)\n RestrictPublicBuckets: true # Critical: restricts buckets with public policies to same-account/service principals\n```", + "Other": "1. In the AWS Console, go to S3 and open the bucket \n2. Select the Permissions tab\n3. Under Block public access (bucket settings), click Edit\n4. Check only:\n - Ignore public ACLs (true)\n - Restrict public buckets (true)\n5. Click Save changes and confirm", + "Terraform": "```hcl\n# Enable minimal S3 Block Public Access on the bucket\nresource \"aws_s3_bucket_public_access_block\" \"example\" {\n bucket = \"\"\n\n ignore_public_acls = true # Critical: ignores public ACLs\n restrict_public_buckets = true # Critical: restricts buckets with public policies\n}\n```" }, "Recommendation": { - "Text": "You can enable block public access settings only for access points, buckets and AWS accounts. Amazon S3 does not support block public access settings on a per-object basis. When you apply block public access settings to an account, the settings apply to all AWS Regions globally. The settings might not take effect in all Regions immediately or simultaneously, but they eventually propagate to all Regions.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + "Text": "Enforce defense in depth: enable **S3 Block Public Access** at org/account and bucket levels (`BlockPublicAcls`, `IgnorePublicAcls`, `BlockPublicPolicy`, `RestrictPublicBuckets`). Apply **least privilege** with explicit principals; avoid ACLs via Object Ownership. Use private access patterns (e.g., CloudFront OAC or presigned URLs) and monitor with analyzers.", + "Url": "https://hub.prowler.com/check/s3_bucket_public_access" } }, "Categories": [ diff --git a/prowler/providers/aws/services/s3/s3_bucket_public_list_acl/s3_bucket_public_list_acl.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_public_list_acl/s3_bucket_public_list_acl.metadata.json index 6376694d3b..53d1bd6351 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_public_list_acl/s3_bucket_public_list_acl.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_public_list_acl/s3_bucket_public_list_acl.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "s3_bucket_public_list_acl", - "CheckTitle": "Ensure there are no S3 buckets listable by Everyone or Any AWS customer.", + "CheckTitle": "S3 bucket is not publicly listable by Everyone or any authenticated AWS user", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure", + "TTPs/Initial Access/Unauthorized Access" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Ensure there are no S3 buckets listable by Everyone or Any AWS customer.", - "Risk": "Even if you enable all possible bucket ACL options available in the Amazon S3 console the ACL alone does not allow everyone to download objects from your bucket. Depending on which option you select any user could perform some actions.", + "Description": "**Amazon S3 buckets** are evaluated for **public listing via ACLs**. Grants of `READ`, `READ_ACP`, or `FULL_CONTROL` to the `AllUsers` or `AuthenticatedUsers` groups are identified. Effective **Block Public Access** at account or bucket level (notably `IgnorePublicAcls` and `RestrictPublicBuckets`) is considered in the evaluation.", + "Risk": "**Public listability** reveals object names, counts, and structure, enabling reconnaissance and targeted scraping. `READ_ACP` exposes permission details for further abuse. With `FULL_CONTROL`, attackers could alter ACLs and disrupt access, undermining **confidentiality** and risking **integrity** and **availability**.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html", + "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-read-access.html" + ], "Remediation": { "Code": { - "CLI": "aws s3api put-bucket-acl --bucket --acl private", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-read-access.html", - "Other": "", - "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-read-access.html" + "CLI": "aws s3api put-public-access-block --bucket --public-access-block-configuration IgnorePublicAcls=true,RestrictPublicBuckets=true", + "NativeIaC": "```yaml\n# CloudFormation: Block public listing via bucket-level Public Access Block\nResources:\n ExamplePublicAccessBlock:\n Type: AWS::S3::BucketPublicAccessBlock\n Properties:\n Bucket: \"\"\n PublicAccessBlockConfiguration:\n IgnorePublicAcls: true # Critical: ignore any public ACLs so they don't grant list access\n RestrictPublicBuckets: true # Critical: restrict buckets with public policies to trusted principals\n```", + "Other": "1. In the AWS Console, go to S3 and open the bucket\n2. Select the Permissions tab\n3. Click Edit under Block public access (bucket settings)\n4. Enable:\n - Ignore public ACLs (bucket and objects)\n - Restrict public buckets\n5. Click Save", + "Terraform": "```hcl\n# Block public listing by enabling bucket-level Public Access Block\nresource \"aws_s3_bucket_public_access_block\" \"\" {\n bucket = \"\"\n ignore_public_acls = true # Critical: ignore any public ACLs\n restrict_public_buckets = true # Critical: restrict buckets with public policies\n}\n```" }, "Recommendation": { - "Text": "You can enable block public access settings only for access points, buckets and AWS accounts. Amazon S3 does not support block public access settings on a per-object basis. When you apply block public access settings to an account, the settings apply to all AWS Regions globally. The settings might not take effect in all Regions immediately or simultaneously, but they eventually propagate to all Regions.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + "Text": "Enable account-level **S3 Block Public Access** (`BlockPublicAcls`, `IgnorePublicAcls`, `BlockPublicPolicy`, `RestrictPublicBuckets`).\n- Remove ACL grants to `AllUsers`/`AuthenticatedUsers`; apply **least privilege** with IAM/bucket policies.\n- Favor private patterns (VPC endpoints, CloudFront OAC, presigned URLs) and disable ACLs via Object Ownership.", + "Url": "https://hub.prowler.com/check/s3_bucket_public_list_acl" } }, "Categories": [ diff --git a/prowler/providers/aws/services/s3/s3_bucket_public_write_acl/s3_bucket_public_write_acl.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_public_write_acl/s3_bucket_public_write_acl.metadata.json index d540e2bc66..7a00a61494 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_public_write_acl/s3_bucket_public_write_acl.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_public_write_acl/s3_bucket_public_write_acl.metadata.json @@ -1,29 +1,37 @@ { "Provider": "aws", "CheckID": "s3_bucket_public_write_acl", - "CheckTitle": "Ensure there are no S3 buckets writable by Everyone or Any AWS customer.", + "CheckTitle": "S3 bucket ACL does not grant write access to Everyone or any AWS customer", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/Unauthorized Access", + "Effects/Data Destruction" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Ensure there are no S3 buckets writable by Everyone or Any AWS customer.", - "Risk": "Even if you enable all possible bucket ACL options available in the Amazon S3 console the ACL alone does not allow everyone to download objects from your bucket. Depending on which option you select any user could perform some actions.", + "Description": "**Amazon S3 buckets** are assessed for ACL grants that allow **public write** access to `AllUsers` or `AuthenticatedUsers` via `WRITE`, `WRITE_ACP`, or `FULL_CONTROL`. Effective **Block Public Access** at account or bucket level (`ignore_public_acls`, `restrict_public_buckets`) is considered.", + "Risk": "Public or cross-account writes enable object tampering, **log poisoning**, and ACL changes via `WRITE_ACP`, undermining **integrity** and causing covert **data exposure**. Attackers can plant malware, deface content, and inflate **costs**, impacting **availability** through overwrites or prefix flooding.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html", + "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-write-access.html" + ], "Remediation": { "Code": { "CLI": "aws s3api put-bucket-acl --bucket --acl private", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-write-access.html", - "Other": "", - "Terraform": "https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/S3/s3-bucket-public-write-access.html" + "NativeIaC": "```yaml\n# CloudFormation: ensure bucket is not publicly writable via ACLs\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n PublicAccessBlockConfiguration:\n IgnorePublicAcls: true # Critical: ignores any public ACLs (e.g., AllUsers/AuthenticatedUsers) so write grants don't apply\n RestrictPublicBuckets: true # Critical: restricts public buckets to the account, preventing public writes via policies\n```", + "Other": "1. In the AWS Console, go to S3 > Buckets and open \n2. Go to the Permissions tab > Access control list (ACL) > Edit\n3. Remove any grantee \"Everyone (public access)\" or \"Any AWS account\" with Write, Write ACL, or Full control\n4. Ensure only the bucket owner retains Full control\n5. Click Save changes", + "Terraform": "```hcl\n# Ensure the bucket is not publicly writable via ACLs\nresource \"aws_s3_bucket_public_access_block\" \"\" {\n bucket = \"\"\n ignore_public_acls = true # Critical: disables effect of public ACLs (e.g., AllUsers/AuthenticatedUsers)\n restrict_public_buckets = true # Critical: restricts public buckets to the account to prevent public writes\n}\n```" }, "Recommendation": { - "Text": "You can enable block public access settings only for access points, buckets and AWS accounts. Amazon S3 does not support block public access settings on a per-object basis. When you apply block public access settings to an account, the settings apply to all AWS Regions globally. The settings might not take effect in all Regions immediately or simultaneously, but they eventually propagate to all Regions.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html" + "Text": "Apply **least privilege** to S3 writes. Enable account-level **Block Public Access** and use **Object Ownership** to disable ACLs. Grant write only to fixed principals via bucket policies with tight conditions (e.g., org IDs, VPC endpoints). Add **versioning** and monitoring for defense-in-depth.", + "Url": "https://hub.prowler.com/check/s3_bucket_public_write_acl" } }, "Categories": [ diff --git a/prowler/providers/aws/services/s3/s3_bucket_secure_transport_policy/s3_bucket_secure_transport_policy.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_secure_transport_policy/s3_bucket_secure_transport_policy.metadata.json index 709c136297..020e6685e0 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_secure_transport_policy/s3_bucket_secure_transport_policy.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_secure_transport_policy/s3_bucket_secure_transport_policy.metadata.json @@ -1,29 +1,35 @@ { "Provider": "aws", "CheckID": "s3_bucket_secure_transport_policy", - "CheckTitle": "Check if S3 buckets have secure transport policy.", + "CheckTitle": "S3 bucket policy denies requests over insecure transport", "CheckType": [ - "Data Protection" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have secure transport policy.", - "Risk": "If HTTPS is not enforced on the bucket policy, communication between clients and S3 buckets can use unencrypted HTTP. As a result, sensitive information could be transmitted in clear text over the network or internet.", + "Description": "**Amazon S3 buckets** are evaluated for a bucket policy that enforces **secure transport** by denying requests when `aws:SecureTransport` is `false`.\n\nBuckets without this explicit denial, or without a policy, are treated as allowing access over insecure transport.", + "Risk": "HTTP access exposes object data and auth details to **eavesdropping** and **man-in-the-middle** attacks. Captured **pre-signed URLs** can be replayed to exfiltrate data. Traffic can be intercepted or altered, undermining **confidentiality** and **integrity** of S3 content.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/S3/secure-transport.html", + "https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/s3-policies/s3_15-secure-data-transport#aws-console", - "Terraform": "" + "CLI": "aws s3api put-bucket-policy --bucket --policy '{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Deny\",\"Principal\":\"*\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::/*\",\"Condition\":{\"Bool\":{\"aws:SecureTransport\":\"false\"}}}]}'", + "NativeIaC": "```yaml\n# CloudFormation: Deny non-SSL (HTTP) requests to the S3 bucket\nResources:\n BucketPolicy:\n Type: AWS::S3::BucketPolicy\n Properties:\n Bucket: \n PolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Deny\n Principal: \"*\"\n Action: s3:*\n Resource: arn:aws:s3:::/*\n Condition:\n Bool:\n aws:SecureTransport: \"false\" # Critical: deny requests not using SSL/TLS\n```", + "Other": "1. In the AWS Console, go to S3 and open the bucket \n2. Select the Permissions tab and click Edit in Bucket policy\n3. Paste this policy, replacing the bucket name:\n ```\n {\n \"Version\": \"2012-10-17\",\n \"Statement\": [\n {\n \"Effect\": \"Deny\",\n \"Principal\": \"*\",\n \"Action\": \"s3:*\",\n \"Resource\": \"arn:aws:s3:::/*\",\n \"Condition\": { \"Bool\": { \"aws:SecureTransport\": \"false\" } }\n }\n ]\n }\n ```\n4. Click Save changes\n", + "Terraform": "```hcl\n# Deny non-SSL (HTTP) requests to the S3 bucket\nresource \"aws_s3_bucket_policy\" \"policy\" {\n bucket = \"\"\n policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Deny\"\n Principal = \"*\"\n Action = \"s3:*\"\n Resource = \"arn:aws:s3:::/*\"\n Condition = {\n Bool = {\n \"aws:SecureTransport\" = \"false\" # Critical: deny requests not using SSL/TLS\n }\n }\n }]\n })\n}\n```" }, "Recommendation": { - "Text": "Ensure that S3 buckets have encryption in transit enabled.", - "Url": "https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-policy-for-config-rule/" + "Text": "Enforce **HTTPS-only** access with a bucket policy that denies requests when `aws:SecureTransport=false`.\n\nPrefer **private access** (VPC endpoints or CloudFront with TLS), avoid S3 website endpoints, apply **least privilege**, use short-lived HTTPS **pre-signed URLs**, and monitor logs for insecure access attempts.", + "Url": "https://hub.prowler.com/check/s3_bucket_secure_transport_policy" } }, "Categories": [ diff --git a/prowler/providers/aws/services/s3/s3_bucket_server_access_logging_enabled/s3_bucket_server_access_logging_enabled.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_server_access_logging_enabled/s3_bucket_server_access_logging_enabled.metadata.json index 67fe62f840..3b0e811b4c 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_server_access_logging_enabled/s3_bucket_server_access_logging_enabled.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_server_access_logging_enabled/s3_bucket_server_access_logging_enabled.metadata.json @@ -1,32 +1,39 @@ { "Provider": "aws", "CheckID": "s3_bucket_server_access_logging_enabled", - "CheckTitle": "Check if S3 buckets have server access logging enabled", + "CheckTitle": "S3 bucket has server access logging enabled", "CheckType": [ - "Logging and Monitoring" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Check if S3 buckets have server access logging enabled", - "Risk": "Server access logs can assist you in security and access audits, help you learn about your customer base, and understand your Amazon S3 bill.", + "Description": "**Amazon S3 buckets** are evaluated for **server access logging** configured to record access requests and deliver logs to a designated destination bucket.", + "Risk": "Without access logs, object reads, writes, and deletions may go untracked, hindering detection of unauthorized access and data exfiltration. This degrades forensic visibility, delays incident response, and weakens evidence integrity, impacting confidentiality and integrity.", "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.amazonaws.cn/en_us/config/latest/developerguide/s3-bucket-logging-enabled.html", + "https://docs.aws.amazon.com/AmazonS3/latest/dev/security-best-practices.html" + ], "Remediation": { "Code": { - "CLI": "aws s3api put-bucket-logging --bucket --bucket-logging-status ", - "NativeIaC": "", - "Other": "https://docs.prowler.com/checks/aws/s3-policies/s3_13-enable-logging", - "Terraform": "https://docs.prowler.com/checks/aws/s3-policies/s3_13-enable-logging#terraform" + "CLI": "aws s3api put-bucket-logging --bucket --bucket-logging-status '{\"LoggingEnabled\":{\"TargetBucket\":\"\",\"TargetPrefix\":\"logs/\"}}'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n LoggingConfiguration:\n DestinationBucketName: # CRITICAL: Enables server access logging by sending logs to this bucket\n```", + "Other": "1. Open the AWS Management Console and go to S3\n2. Select the bucket with the finding\n3. Go to the Properties tab\n4. In Server access logging, click Edit\n5. Toggle Enable, choose the target log bucket, and Save", + "Terraform": "```hcl\nresource \"aws_s3_bucket_logging\" \"\" {\n bucket = \"\"\n target_bucket = \"\" # CRITICAL: Enables server access logging by specifying the target bucket\n}\n```" }, "Recommendation": { - "Text": "Ensure that S3 buckets have Logging enabled. CloudTrail data events can be used in place of S3 bucket logging. If that is the case, this finding can be considered a false positive.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/security-best-practices.html" + "Text": "Enable **server access logging** and send logs to a dedicated log bucket with least privilege, retention, and monitoring. Complement with **CloudTrail data events** for object-level visibility. Apply **defense in depth** by centralizing logs and protecting them from tampering.", + "Url": "https://hub.prowler.com/check/s3_bucket_server_access_logging_enabled" } }, "Categories": [ + "logging", "forensics-ready" ], "DependsOn": [], diff --git a/prowler/providers/aws/services/s3/s3_bucket_shadow_resource_vulnerability/s3_bucket_shadow_resource_vulnerability.metadata.json b/prowler/providers/aws/services/s3/s3_bucket_shadow_resource_vulnerability/s3_bucket_shadow_resource_vulnerability.metadata.json index eddcb674c4..c57026a426 100644 --- a/prowler/providers/aws/services/s3/s3_bucket_shadow_resource_vulnerability/s3_bucket_shadow_resource_vulnerability.metadata.json +++ b/prowler/providers/aws/services/s3/s3_bucket_shadow_resource_vulnerability/s3_bucket_shadow_resource_vulnerability.metadata.json @@ -1,29 +1,36 @@ { "Provider": "aws", "CheckID": "s3_bucket_shadow_resource_vulnerability", - "CheckTitle": "Check for S3 buckets vulnerable to Shadow Resource Hijacking (Bucket Monopoly)", + "CheckTitle": "S3 bucket is not a known shadow resource owned by another account", "CheckType": [ - "Effects/Data Exposure" + "Software and Configuration Checks/AWS Security Best Practices", + "Effects/Data Exposure", + "Effects/Data Exfiltration", + "TTPs/Collection" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsS3Bucket", "ResourceGroup": "storage", - "Description": "Checks for S3 buckets with predictable names that could be hijacked by an attacker before legitimate use, leading to data leakage or other security breaches.", - "Risk": "An attacker can pre-create S3 buckets with predictable names used by various AWS services. When a legitimate user's service attempts to use that bucket, it may inadvertently write sensitive data to the attacker-controlled bucket, leading to information disclosure, denial of service, or even remote code execution.", - "RelatedUrl": "https://www.aquasec.com/blog/bucket-monopoly-breaching-aws-accounts-through-shadow-resources/", + "Description": "**Amazon S3 buckets** using **predictable service naming** (e.g., `aws-glue-assets--`, `sagemaker--`) are identified and their **ownership** checked.\n\nBuckets tied to your account that match these patterns but are owned by another account-across regions-are surfaced as shadow-resource candidates.", + "Risk": "**Preclaimed buckets** matching your account's patterns let outsiders intercept service artifacts, causing:\n- Loss of **confidentiality** (templates, data exfiltration)\n- Compromised **integrity** (script/config injection RCE, privilege escalation)\n- Reduced **availability** (creation failures or redirected writes)", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.techtarget.com/searchsecurity/news/366602412/Researchers-unveil-AWS-vulnerabilities-shadow-resource-vector", + "https://www.aquasec.com/blog/bucket-monopoly-breaching-aws-accounts-through-shadow-resources/#section-10" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "Manually verify the ownership of any flagged S3 buckets. If a bucket is not owned by your account, investigate its origin and purpose. If it is not a legitimate resource, you should avoid using services that may interact with it.", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: pre-claim the predictable S3 bucket name to ensure your account owns it\nResources:\n :\n Type: AWS::S3::Bucket\n Properties:\n BucketName: # Critical: create the exact bucket name reported by the check so it is owned by this account\n```", + "Other": "1. In the Prowler finding, copy the exact bucket name flagged (e.g., aws-glue-assets--).\n2. Open the AWS S3 console and click Create bucket.\n3. Paste the exact bucket name and select the region that matches the name.\n4. Click Create bucket.\n5. Repeat for each flagged name/region so all predictable service buckets are owned by your account.", + "Terraform": "```hcl\n# Terraform: pre-claim the predictable S3 bucket name to ensure your account owns it\nresource \"aws_s3_bucket\" \"\" {\n bucket = \"\" # Critical: create the exact bucket name reported by the check so it is owned by this account\n}\n```" }, "Recommendation": { - "Text": "Ensure that all S3 buckets associated with your AWS account are owned by your account. Be cautious of services that create buckets with predictable names. Whenever possible, pre-create these buckets in all regions to prevent hijacking.", - "Url": "https://www.aquasec.com/blog/bucket-monopoly-breaching-aws-accounts-through-shadow-resources/" + "Text": "Apply **defense in depth**:\n- **Preprovision and own** required service buckets in all current and planned regions\n- Enforce **least privilege** so services write only to approved bucket names/ARNs\n- Use **non-guessable names** where you control naming\n- Monitor for look-alike buckets and separate duties for bucket creation vs. use", + "Url": "https://hub.prowler.com/check/s3_bucket_shadow_resource_vulnerability" } }, "Categories": [ diff --git a/prowler/providers/aws/services/s3/s3_multi_region_access_point_public_access_block/s3_multi_region_access_point_public_access_block.metadata.json b/prowler/providers/aws/services/s3/s3_multi_region_access_point_public_access_block/s3_multi_region_access_point_public_access_block.metadata.json index 8a8d7e1f59..6f3d07ed9c 100644 --- a/prowler/providers/aws/services/s3/s3_multi_region_access_point_public_access_block/s3_multi_region_access_point_public_access_block.metadata.json +++ b/prowler/providers/aws/services/s3/s3_multi_region_access_point_public_access_block/s3_multi_region_access_point_public_access_block.metadata.json @@ -1,32 +1,41 @@ { "Provider": "aws", "CheckID": "s3_multi_region_access_point_public_access_block", - "CheckTitle": "Block Public Access Settings enabled on Multi Region Access Points.", + "CheckTitle": "S3 Multi-Region Access Point has all Block Public Access settings enabled", "CheckType": [ - "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure" ], "ServiceName": "s3", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:s3:region:account-id:accesspoint/access-point-name", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsS3AccessPoint", "ResourceGroup": "storage", - "Description": "Ensures that public access is blocked on S3 Access Points.", - "Risk": "Leaving S3 multi region access points open to the public in AWS can lead to data exposure, breaches, compliance violations, unauthorized access, and data integrity issues.", - "RelatedUrl": "https://aws.amazon.com/es/getting-started/hands-on/getting-started-with-amazon-s3-multi-region-access-points/", + "Description": "**Amazon S3 Multi-Region Access Points** are evaluated for **Block Public Access** being fully enabled (`block_public_acls`, `ignore_public_acls`, `block_public_policy`, `restrict_public_buckets`).\n\nFocus is on the MRAP's own settings, separate from bucket or account configurations.", + "Risk": "Without MRAP **Block Public Access**, the global endpoint can accept internet traffic, exposing linked buckets.\n\nThis undermines confidentiality (object listing/reads) and integrity (unauthorized writes or policy abuse), and can trigger costly egress and data tampering across Regions.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/multi-region-access-point-block-public-access.html", + "https://aws.amazon.com/es/getting-started/hands-on/getting-started-with-amazon-s3-multi-region-access-points/", + "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-24" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-24", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: MRAP with Block Public Access enabled (cannot be changed after creation)\nResources:\n :\n Type: AWS::S3::MultiRegionAccessPoint\n Properties:\n Name: \n PublicAccessBlockConfiguration: # Critical: enable all Block Public Access settings\n BlockPublicAcls: true # Critical: blocks ACLs granting public access\n IgnorePublicAcls: true # Critical: ignores any public ACLs\n BlockPublicPolicy: true # Critical: blocks public bucket policies\n RestrictPublicBuckets: true # Critical: restricts public bucket policies\n Regions:\n - Bucket: \n - Bucket: \n```", + "Other": "1. In the AWS Console, go to S3 > Multi-Region Access Points\n2. Select the failing Multi-Region Access Point and choose Delete (settings cannot be edited after creation)\n3. Click Create Multi-Region Access Point\n4. Enter a name and select at least two buckets in different Regions\n5. Ensure Block public access is enabled for all four settings (default): BlockPublicAcls, IgnorePublicAcls, BlockPublicPolicy, RestrictPublicBuckets\n6. Create the Multi-Region Access Point", + "Terraform": "```hcl\n# Terraform: MRAP with Block Public Access enabled (must be set at creation)\nresource \"aws_s3control_multi_region_access_point\" \"\" {\n account_id = \"\"\n\n details {\n name = \"\"\n\n public_access_block { # Critical: enable all Block Public Access settings\n block_public_acls = true # Critical\n ignore_public_acls = true # Critical\n block_public_policy = true # Critical\n restrict_public_buckets = true # Critical\n }\n\n region { bucket = \"\" }\n region { bucket = \"\" }\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure S3 multi region access points are private by default, applying strict access controls, and regularly auditing permissions to prevent unauthorized public access.", - "Url": "https://docs.aws.amazon.com/AmazonS3/latest/userguide/multi-region-access-point-block-public-access.html" + "Text": "Adopt **deny-by-default**: keep all MRAP **Block Public Access** settings enabled; avoid public ACLs or policies.\n- Enforce **least privilege**\n- Prefer private access (VPC endpoints)\n- Periodically review permissions and logs\n\n*MRAP public access settings are immutable after creation.*", + "Url": "https://hub.prowler.com/check/s3_multi_region_access_point_public_access_block" } }, - "Categories": [], + "Categories": [ + "internet-exposed" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" From 8f5c43744f6fe8c77a05b8c613dbb52039e8dbc7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:15:24 +0100 Subject: [PATCH 009/337] build(deps): bump softprops/action-gh-release from 2.4.1 to 2.5.0 (#9389) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/prepare-release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index a0073277fb..9169ca5806 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -374,7 +374,7 @@ jobs: no-changelog - name: Create draft release - uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 # v2.4.1 + uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0 with: tag_name: ${{ env.PROWLER_VERSION }} name: Prowler ${{ env.PROWLER_VERSION }} From f407a24022709a82946df73cfe4a92286dab6a1c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:16:15 +0100 Subject: [PATCH 010/337] build(deps): bump actions/upload-artifact from 4.6.2 to 6.0.0 (#9712) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ui-e2e-tests.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ui-e2e-tests.yml b/.github/workflows/ui-e2e-tests.yml index aa269af1ce..054bd69f6e 100644 --- a/.github/workflows/ui-e2e-tests.yml +++ b/.github/workflows/ui-e2e-tests.yml @@ -154,7 +154,7 @@ jobs: working-directory: ./ui run: pnpm run test:e2e - name: Upload test reports - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 if: failure() with: name: playwright-report From 7c9dd8fe895d7d480c703382c06984e43c265960 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:19:35 +0100 Subject: [PATCH 011/337] build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 (#9705) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/api-bump-version.yml | 6 +++--- .github/workflows/docs-bump-version.yml | 6 +++--- .github/workflows/prepare-release.yml | 2 +- .github/workflows/sdk-bump-version.yml | 6 +++--- .github/workflows/sdk-refresh-aws-services-regions.yml | 2 +- .github/workflows/ui-bump-version.yml | 6 +++--- 6 files changed, 14 insertions(+), 14 deletions(-) diff --git a/.github/workflows/api-bump-version.yml b/.github/workflows/api-bump-version.yml index cc485a7030..97cdd546ff 100644 --- a/.github/workflows/api-bump-version.yml +++ b/.github/workflows/api-bump-version.yml @@ -110,7 +110,7 @@ jobs: git --no-pager diff - name: Create PR for next API minor version to master - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -164,7 +164,7 @@ jobs: git --no-pager diff - name: Create PR for first API patch version to version branch - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -235,7 +235,7 @@ jobs: git --no-pager diff - name: Create PR for next API patch version to version branch - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} diff --git a/.github/workflows/docs-bump-version.yml b/.github/workflows/docs-bump-version.yml index c7bd940a82..dde21b9c1e 100644 --- a/.github/workflows/docs-bump-version.yml +++ b/.github/workflows/docs-bump-version.yml @@ -106,7 +106,7 @@ jobs: git --no-pager diff - name: Create PR for documentation update to master - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -161,7 +161,7 @@ jobs: git --no-pager diff - name: Create PR for documentation update to version branch - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -225,7 +225,7 @@ jobs: git --no-pager diff - name: Create PR for documentation update to version branch - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 9169ca5806..815ade1dec 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -344,7 +344,7 @@ jobs: - name: Create PR for API dependency update if: ${{ env.PATCH_VERSION == '0' }} - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} commit-message: 'chore(api): update prowler dependency to ${{ env.BRANCH_NAME }} for release ${{ env.PROWLER_VERSION }}' diff --git a/.github/workflows/sdk-bump-version.yml b/.github/workflows/sdk-bump-version.yml index 0383837431..9f25065689 100644 --- a/.github/workflows/sdk-bump-version.yml +++ b/.github/workflows/sdk-bump-version.yml @@ -91,7 +91,7 @@ jobs: git --no-pager diff - name: Create PR for next minor version to master - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -139,7 +139,7 @@ jobs: git --no-pager diff - name: Create PR for first patch version to version branch - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -196,7 +196,7 @@ jobs: git --no-pager diff - name: Create PR for next patch version to version branch - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} diff --git a/.github/workflows/sdk-refresh-aws-services-regions.yml b/.github/workflows/sdk-refresh-aws-services-regions.yml index 672242398c..25839f2631 100644 --- a/.github/workflows/sdk-refresh-aws-services-regions.yml +++ b/.github/workflows/sdk-refresh-aws-services-regions.yml @@ -50,7 +50,7 @@ jobs: - name: Create pull request id: create-pr - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} author: 'prowler-bot <179230569+prowler-bot@users.noreply.github.com>' diff --git a/.github/workflows/ui-bump-version.yml b/.github/workflows/ui-bump-version.yml index c25b2809a7..7c576eed55 100644 --- a/.github/workflows/ui-bump-version.yml +++ b/.github/workflows/ui-bump-version.yml @@ -90,7 +90,7 @@ jobs: git --no-pager diff - name: Create PR for next minor version to master - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -140,7 +140,7 @@ jobs: git --no-pager diff - name: Create PR for first patch version to version branch - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} @@ -199,7 +199,7 @@ jobs: git --no-pager diff - name: Create PR for next patch version to version branch - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8 + uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0 with: author: prowler-bot <179230569+prowler-bot@users.noreply.github.com> token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }} From 503b56188b840e781295e0c90f1f60259443bf94 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Thu, 8 Jan 2026 13:22:59 +0100 Subject: [PATCH 012/337] chore(aws): enhance metadata for `datasync` service (#8854) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + ...atasync_task_logging_enabled.metadata.json | 29 +++++++++++-------- 2 files changed, 18 insertions(+), 12 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 711a17b046..5fd9ca66f4 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -38,6 +38,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS VPC service metadata to new format [(#9479)](https://github.com/prowler-cloud/prowler/pull/9479) - Update AWS Transfer service metadata to new format [(#9434)](https://github.com/prowler-cloud/prowler/pull/9434) - Update AWS S3 service metadata to new format [(#9552)](https://github.com/prowler-cloud/prowler/pull/9552) +- Update AWS DataSync service metadata to new format [(#8854)](https://github.com/prowler-cloud/prowler/pull/8854) --- diff --git a/prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.metadata.json b/prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.metadata.json index aea24cee9e..7c5d7cd05a 100644 --- a/prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.metadata.json +++ b/prowler/providers/aws/services/datasync/datasync_task_logging_enabled/datasync_task_logging_enabled.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "datasync_task_logging_enabled", - "CheckTitle": "DataSync tasks should have logging enabled", + "CheckTitle": "DataSync task has CloudWatch Logs log group configured for logging", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "datasync", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:datasync:{region}:{account-id}:task/{task-id}", + "ResourceIdTemplate": "", "Severity": "high", - "ResourceType": "AwsDataSyncTask", + "ResourceType": "Other", "ResourceGroup": "storage", - "Description": "This control checks if AWS DataSync tasks have logging enabled. The control fails if the task doesn't have the CloudWatchLogGroupArn property defined.", - "Risk": "Without logging enabled, important operational data may be lost, making it difficult to troubleshoot issues, monitor performance, and ensure compliance with auditing requirements.", - "RelatedUrl": "https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#enable-logging", + "Description": "**AWS DataSync tasks** are evaluated for a configured **CloudWatch Logs** destination (`CloudWatchLogGroupArn`).\n\nTasks that specify a log group are recognized as logging-enabled; those without one are identified as not publishing execution events.", + "Risk": "**Absent DataSync task logs** create blind spots, preventing timely detection of **failed or partial transfers**, unexpected deletions, or anomalies. This undermines data **integrity** verification, obscures potential **exfiltration** indicators, and slows forensics and recovery, reducing **availability** during incidents.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://support.icompaas.com/support/solutions/articles/62000233637-ensure-datasync-tasks-should-have-logging-enabled", + "https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#enable-logging" + ], "Remediation": { "Code": { "CLI": "aws datasync update-task --task-arn --cloud-watch-log-group-arn ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#enable-logging", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: Enable CloudWatch Logs for a DataSync task\nResources:\n :\n Type: AWS::DataSync::Task\n Properties:\n SourceLocationArn: \n DestinationLocationArn: \n CloudWatchLogGroupArn: # Critical: attaches a CloudWatch Logs group to enable task logging\n```", + "Other": "1. In the AWS Console, go to DataSync > Tasks\n2. Select the task and click Edit\n3. In the Logging section, set CloudWatch Log group to an existing log group\n4. Click Save", + "Terraform": "```hcl\n# Enable CloudWatch Logs for a DataSync task\nresource \"aws_datasync_task\" \"\" {\n source_location_arn = \"\"\n destination_location_arn = \"\"\n cloudwatch_log_group_arn = \"\" # Critical: attaches a CloudWatch Logs group to enable task logging\n}\n```" }, "Recommendation": { - "Text": "Configure logging for your DataSync tasks to ensure that operational data is captured and available for debugging, monitoring, and auditing purposes.", - "Url": "https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#enable-logging" + "Text": "Configure each task to publish logs to a dedicated CloudWatch Logs group. Select an appropriate log level (e.g., `BASIC` or `TRANSFER`), enforce **least privilege** for log access, set **retention** and immutability, and integrate alerts. Centralize and monitor logs to support **defense in depth** and incident response.", + "Url": "https://hub.prowler.com/check/datasync_task_logging_enabled" } }, "Categories": [ From 73375ee289165587f258d7751b4805c2d2dc60e3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:30:41 +0100 Subject: [PATCH 013/337] build(deps): bump tj-actions/changed-files from 47.0.0 to 47.0.1 (#9711) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pepe Fagoaga --- .github/workflows/api-code-quality.yml | 2 +- .github/workflows/api-container-checks.yml | 4 ++-- .github/workflows/api-security.yml | 2 +- .github/workflows/api-tests.yml | 2 +- .github/workflows/mcp-container-checks.yml | 4 ++-- .github/workflows/pr-check-changelog.yml | 2 +- .github/workflows/pr-conflict-checker.yml | 2 +- .github/workflows/sdk-code-quality.yml | 2 +- .github/workflows/sdk-container-checks.yml | 4 ++-- .github/workflows/sdk-security.yml | 2 +- .github/workflows/sdk-tests.yml | 26 +++++++++++----------- .github/workflows/ui-container-checks.yml | 4 ++-- .github/workflows/ui-tests.yml | 2 +- 13 files changed, 29 insertions(+), 29 deletions(-) diff --git a/.github/workflows/api-code-quality.yml b/.github/workflows/api-code-quality.yml index e0a5306997..0b6131538d 100644 --- a/.github/workflows/api-code-quality.yml +++ b/.github/workflows/api-code-quality.yml @@ -37,7 +37,7 @@ jobs: - name: Check for API changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | api/** diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml index 335555975b..d63f75894d 100644 --- a/.github/workflows/api-container-checks.yml +++ b/.github/workflows/api-container-checks.yml @@ -32,7 +32,7 @@ jobs: - name: Check if Dockerfile changed id: dockerfile-changed - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: api/Dockerfile @@ -67,7 +67,7 @@ jobs: - name: Check for API changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: api/** files_ignore: | diff --git a/.github/workflows/api-security.yml b/.github/workflows/api-security.yml index 14536a5183..c6273b9a11 100644 --- a/.github/workflows/api-security.yml +++ b/.github/workflows/api-security.yml @@ -37,7 +37,7 @@ jobs: - name: Check for API changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | api/** diff --git a/.github/workflows/api-tests.yml b/.github/workflows/api-tests.yml index dcf97fa18b..44b4141dc2 100644 --- a/.github/workflows/api-tests.yml +++ b/.github/workflows/api-tests.yml @@ -77,7 +77,7 @@ jobs: - name: Check for API changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | api/** diff --git a/.github/workflows/mcp-container-checks.yml b/.github/workflows/mcp-container-checks.yml index f15e63d401..5ea0b6c465 100644 --- a/.github/workflows/mcp-container-checks.yml +++ b/.github/workflows/mcp-container-checks.yml @@ -32,7 +32,7 @@ jobs: - name: Check if Dockerfile changed id: dockerfile-changed - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: mcp_server/Dockerfile @@ -66,7 +66,7 @@ jobs: - name: Check for MCP changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: mcp_server/** files_ignore: | diff --git a/.github/workflows/pr-check-changelog.yml b/.github/workflows/pr-check-changelog.yml index 3a8985977b..4a1f8e502a 100644 --- a/.github/workflows/pr-check-changelog.yml +++ b/.github/workflows/pr-check-changelog.yml @@ -35,7 +35,7 @@ jobs: - name: Get changed files id: changed-files - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | api/** diff --git a/.github/workflows/pr-conflict-checker.yml b/.github/workflows/pr-conflict-checker.yml index 6486355b80..c812f4ef19 100644 --- a/.github/workflows/pr-conflict-checker.yml +++ b/.github/workflows/pr-conflict-checker.yml @@ -32,7 +32,7 @@ jobs: - name: Get changed files id: changed-files - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: '**' diff --git a/.github/workflows/sdk-code-quality.yml b/.github/workflows/sdk-code-quality.yml index c52d1a6a8f..49f01f7fab 100644 --- a/.github/workflows/sdk-code-quality.yml +++ b/.github/workflows/sdk-code-quality.yml @@ -35,7 +35,7 @@ jobs: - name: Check for SDK changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: ./** files_ignore: | diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml index e4f95a7836..b85f0a6ebe 100644 --- a/.github/workflows/sdk-container-checks.yml +++ b/.github/workflows/sdk-container-checks.yml @@ -31,7 +31,7 @@ jobs: - name: Check if Dockerfile changed id: dockerfile-changed - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: Dockerfile @@ -66,7 +66,7 @@ jobs: - name: Check for SDK changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: ./** files_ignore: | diff --git a/.github/workflows/sdk-security.yml b/.github/workflows/sdk-security.yml index cec5502bc9..e16cb9d160 100644 --- a/.github/workflows/sdk-security.yml +++ b/.github/workflows/sdk-security.yml @@ -28,7 +28,7 @@ jobs: - name: Check for SDK changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: ./** files_ignore: | diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml index c86885214b..d55af082a8 100644 --- a/.github/workflows/sdk-tests.yml +++ b/.github/workflows/sdk-tests.yml @@ -35,7 +35,7 @@ jobs: - name: Check for SDK changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: ./** files_ignore: | @@ -75,7 +75,7 @@ jobs: - name: Check if AWS files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-aws - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/aws/** @@ -200,7 +200,7 @@ jobs: - name: Check if Azure files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-azure - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/azure/** @@ -224,7 +224,7 @@ jobs: - name: Check if GCP files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-gcp - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/gcp/** @@ -248,7 +248,7 @@ jobs: - name: Check if Kubernetes files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-kubernetes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/kubernetes/** @@ -272,7 +272,7 @@ jobs: - name: Check if GitHub files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-github - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/github/** @@ -296,7 +296,7 @@ jobs: - name: Check if NHN files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-nhn - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/nhn/** @@ -320,7 +320,7 @@ jobs: - name: Check if M365 files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-m365 - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/m365/** @@ -344,7 +344,7 @@ jobs: - name: Check if IaC files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-iac - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/iac/** @@ -368,7 +368,7 @@ jobs: - name: Check if MongoDB Atlas files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-mongodbatlas - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/mongodbatlas/** @@ -392,7 +392,7 @@ jobs: - name: Check if OCI files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-oraclecloud - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/**/oraclecloud/** @@ -416,7 +416,7 @@ jobs: - name: Check if Lib files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-lib - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/lib/** @@ -440,7 +440,7 @@ jobs: - name: Check if Config files changed if: steps.check-changes.outputs.any_changed == 'true' id: changed-config - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ./prowler/config/** diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml index 2f19f89899..8329132450 100644 --- a/.github/workflows/ui-container-checks.yml +++ b/.github/workflows/ui-container-checks.yml @@ -32,7 +32,7 @@ jobs: - name: Check if Dockerfile changed id: dockerfile-changed - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: ui/Dockerfile @@ -67,7 +67,7 @@ jobs: - name: Check for UI changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: ui/** files_ignore: | diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml index 0d2b55fbd3..c8382f6711 100644 --- a/.github/workflows/ui-tests.yml +++ b/.github/workflows/ui-tests.yml @@ -34,7 +34,7 @@ jobs: - name: Check for UI changes id: check-changes - uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: files: | ui/** From 44d791dfe9ef4fb1e52d29ed4c47ae18aba0735a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:37:20 +0100 Subject: [PATCH 014/337] build(deps-dev): bump marshmallow from 3.26.1 to 3.26.2 (#9652) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- poetry.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/poetry.lock b/poetry.lock index 5e4ddb6b3f..42f00e39c7 100644 --- a/poetry.lock +++ b/poetry.lock @@ -3238,14 +3238,14 @@ files = [ [[package]] name = "marshmallow" -version = "3.26.1" +version = "3.26.2" description = "A lightweight library for converting complex datatypes to and from native Python datatypes." optional = false python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "marshmallow-3.26.1-py3-none-any.whl", hash = "sha256:3350409f20a70a7e4e11a27661187b77cdcaeb20abca41c1454fe33636bea09c"}, - {file = "marshmallow-3.26.1.tar.gz", hash = "sha256:e6d8affb6cb61d39d26402096dc0aee12d5a26d490a121f118d2e81dc0719dc6"}, + {file = "marshmallow-3.26.2-py3-none-any.whl", hash = "sha256:013fa8a3c4c276c24d26d84ce934dc964e2aa794345a0f8c7e5a7191482c8a73"}, + {file = "marshmallow-3.26.2.tar.gz", hash = "sha256:bbe2adb5a03e6e3571b573f42527c6fe926e17467833660bebd11593ab8dfd57"}, ] [package.dependencies] From 3332e5b891a0f773825e1fb6f6fabb13ff88e224 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:38:35 +0100 Subject: [PATCH 015/337] build(deps): bump aiohttp from 3.12.14 to 3.13.3 (#9722) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- poetry.lock | 210 ++++++++++++++++++++++++++++++---------------------- 1 file changed, 122 insertions(+), 88 deletions(-) diff --git a/poetry.lock b/poetry.lock index 42f00e39c7..18bb12f01c 100644 --- a/poetry.lock +++ b/poetry.lock @@ -38,98 +38,132 @@ files = [ [[package]] name = "aiohttp" -version = "3.12.14" +version = "3.13.3" description = "Async http client/server framework (asyncio)" optional = false python-versions = ">=3.9" groups = ["main"] files = [ - {file = "aiohttp-3.12.14-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:906d5075b5ba0dd1c66fcaaf60eb09926a9fef3ca92d912d2a0bbdbecf8b1248"}, - {file = "aiohttp-3.12.14-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:c875bf6fc2fd1a572aba0e02ef4e7a63694778c5646cdbda346ee24e630d30fb"}, - {file = "aiohttp-3.12.14-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:fbb284d15c6a45fab030740049d03c0ecd60edad9cd23b211d7e11d3be8d56fd"}, - {file = "aiohttp-3.12.14-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38e360381e02e1a05d36b223ecab7bc4a6e7b5ab15760022dc92589ee1d4238c"}, - {file = "aiohttp-3.12.14-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:aaf90137b5e5d84a53632ad95ebee5c9e3e7468f0aab92ba3f608adcb914fa95"}, - {file = "aiohttp-3.12.14-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e532a25e4a0a2685fa295a31acf65e027fbe2bea7a4b02cdfbbba8a064577663"}, - {file = "aiohttp-3.12.14-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:eab9762c4d1b08ae04a6c77474e6136da722e34fdc0e6d6eab5ee93ac29f35d1"}, - {file = "aiohttp-3.12.14-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:abe53c3812b2899889a7fca763cdfaeee725f5be68ea89905e4275476ffd7e61"}, - {file = "aiohttp-3.12.14-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:5760909b7080aa2ec1d320baee90d03b21745573780a072b66ce633eb77a8656"}, - {file = "aiohttp-3.12.14-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:02fcd3f69051467bbaa7f84d7ec3267478c7df18d68b2e28279116e29d18d4f3"}, - {file = "aiohttp-3.12.14-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:4dcd1172cd6794884c33e504d3da3c35648b8be9bfa946942d353b939d5f1288"}, - {file = "aiohttp-3.12.14-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:224d0da41355b942b43ad08101b1b41ce633a654128ee07e36d75133443adcda"}, - {file = "aiohttp-3.12.14-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:e387668724f4d734e865c1776d841ed75b300ee61059aca0b05bce67061dcacc"}, - {file = "aiohttp-3.12.14-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:dec9cde5b5a24171e0b0a4ca064b1414950904053fb77c707efd876a2da525d8"}, - {file = "aiohttp-3.12.14-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:bbad68a2af4877cc103cd94af9160e45676fc6f0c14abb88e6e092b945c2c8e3"}, - {file = "aiohttp-3.12.14-cp310-cp310-win32.whl", hash = "sha256:ee580cb7c00bd857b3039ebca03c4448e84700dc1322f860cf7a500a6f62630c"}, - {file = "aiohttp-3.12.14-cp310-cp310-win_amd64.whl", hash = "sha256:cf4f05b8cea571e2ccc3ca744e35ead24992d90a72ca2cf7ab7a2efbac6716db"}, - {file = "aiohttp-3.12.14-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:f4552ff7b18bcec18b60a90c6982049cdb9dac1dba48cf00b97934a06ce2e597"}, - {file = "aiohttp-3.12.14-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:8283f42181ff6ccbcf25acaae4e8ab2ff7e92b3ca4a4ced73b2c12d8cd971393"}, - {file = "aiohttp-3.12.14-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:040afa180ea514495aaff7ad34ec3d27826eaa5d19812730fe9e529b04bb2179"}, - {file = "aiohttp-3.12.14-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b413c12f14c1149f0ffd890f4141a7471ba4b41234fe4fd4a0ff82b1dc299dbb"}, - {file = "aiohttp-3.12.14-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:1d6f607ce2e1a93315414e3d448b831238f1874b9968e1195b06efaa5c87e245"}, - {file = "aiohttp-3.12.14-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:565e70d03e924333004ed101599902bba09ebb14843c8ea39d657f037115201b"}, - {file = "aiohttp-3.12.14-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4699979560728b168d5ab63c668a093c9570af2c7a78ea24ca5212c6cdc2b641"}, - {file = "aiohttp-3.12.14-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ad5fdf6af93ec6c99bf800eba3af9a43d8bfd66dce920ac905c817ef4a712afe"}, - {file = "aiohttp-3.12.14-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:4ac76627c0b7ee0e80e871bde0d376a057916cb008a8f3ffc889570a838f5cc7"}, - {file = "aiohttp-3.12.14-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:798204af1180885651b77bf03adc903743a86a39c7392c472891649610844635"}, - {file = "aiohttp-3.12.14-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:4f1205f97de92c37dd71cf2d5bcfb65fdaed3c255d246172cce729a8d849b4da"}, - {file = "aiohttp-3.12.14-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:76ae6f1dd041f85065d9df77c6bc9c9703da9b5c018479d20262acc3df97d419"}, - {file = "aiohttp-3.12.14-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:a194ace7bc43ce765338ca2dfb5661489317db216ea7ea700b0332878b392cab"}, - {file = "aiohttp-3.12.14-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:16260e8e03744a6fe3fcb05259eeab8e08342c4c33decf96a9dad9f1187275d0"}, - {file = "aiohttp-3.12.14-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:8c779e5ebbf0e2e15334ea404fcce54009dc069210164a244d2eac8352a44b28"}, - {file = "aiohttp-3.12.14-cp311-cp311-win32.whl", hash = "sha256:a289f50bf1bd5be227376c067927f78079a7bdeccf8daa6a9e65c38bae14324b"}, - {file = "aiohttp-3.12.14-cp311-cp311-win_amd64.whl", hash = "sha256:0b8a69acaf06b17e9c54151a6c956339cf46db4ff72b3ac28516d0f7068f4ced"}, - {file = "aiohttp-3.12.14-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:a0ecbb32fc3e69bc25efcda7d28d38e987d007096cbbeed04f14a6662d0eee22"}, - {file = "aiohttp-3.12.14-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:0400f0ca9bb3e0b02f6466421f253797f6384e9845820c8b05e976398ac1d81a"}, - {file = "aiohttp-3.12.14-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:a56809fed4c8a830b5cae18454b7464e1529dbf66f71c4772e3cfa9cbec0a1ff"}, - {file = "aiohttp-3.12.14-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:27f2e373276e4755691a963e5d11756d093e346119f0627c2d6518208483fb6d"}, - {file = "aiohttp-3.12.14-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:ca39e433630e9a16281125ef57ece6817afd1d54c9f1bf32e901f38f16035869"}, - {file = "aiohttp-3.12.14-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9c748b3f8b14c77720132b2510a7d9907a03c20ba80f469e58d5dfd90c079a1c"}, - {file = "aiohttp-3.12.14-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f0a568abe1b15ce69d4cc37e23020720423f0728e3cb1f9bcd3f53420ec3bfe7"}, - {file = "aiohttp-3.12.14-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9888e60c2c54eaf56704b17feb558c7ed6b7439bca1e07d4818ab878f2083660"}, - {file = "aiohttp-3.12.14-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3006a1dc579b9156de01e7916d38c63dc1ea0679b14627a37edf6151bc530088"}, - {file = "aiohttp-3.12.14-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:aa8ec5c15ab80e5501a26719eb48a55f3c567da45c6ea5bb78c52c036b2655c7"}, - {file = "aiohttp-3.12.14-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:39b94e50959aa07844c7fe2206b9f75d63cc3ad1c648aaa755aa257f6f2498a9"}, - {file = "aiohttp-3.12.14-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:04c11907492f416dad9885d503fbfc5dcb6768d90cad8639a771922d584609d3"}, - {file = "aiohttp-3.12.14-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:88167bd9ab69bb46cee91bd9761db6dfd45b6e76a0438c7e884c3f8160ff21eb"}, - {file = "aiohttp-3.12.14-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:791504763f25e8f9f251e4688195e8b455f8820274320204f7eafc467e609425"}, - {file = "aiohttp-3.12.14-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2785b112346e435dd3a1a67f67713a3fe692d288542f1347ad255683f066d8e0"}, - {file = "aiohttp-3.12.14-cp312-cp312-win32.whl", hash = "sha256:15f5f4792c9c999a31d8decf444e79fcfd98497bf98e94284bf390a7bb8c1729"}, - {file = "aiohttp-3.12.14-cp312-cp312-win_amd64.whl", hash = "sha256:3b66e1a182879f579b105a80d5c4bd448b91a57e8933564bf41665064796a338"}, - {file = "aiohttp-3.12.14-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:3143a7893d94dc82bc409f7308bc10d60285a3cd831a68faf1aa0836c5c3c767"}, - {file = "aiohttp-3.12.14-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:3d62ac3d506cef54b355bd34c2a7c230eb693880001dfcda0bf88b38f5d7af7e"}, - {file = "aiohttp-3.12.14-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:48e43e075c6a438937c4de48ec30fa8ad8e6dfef122a038847456bfe7b947b63"}, - {file = "aiohttp-3.12.14-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:077b4488411a9724cecc436cbc8c133e0d61e694995b8de51aaf351c7578949d"}, - {file = "aiohttp-3.12.14-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d8c35632575653f297dcbc9546305b2c1133391089ab925a6a3706dfa775ccab"}, - {file = "aiohttp-3.12.14-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:6b8ce87963f0035c6834b28f061df90cf525ff7c9b6283a8ac23acee6502afd4"}, - {file = "aiohttp-3.12.14-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f0a2cf66e32a2563bb0766eb24eae7e9a269ac0dc48db0aae90b575dc9583026"}, - {file = "aiohttp-3.12.14-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cdea089caf6d5cde975084a884c72d901e36ef9c2fd972c9f51efbbc64e96fbd"}, - {file = "aiohttp-3.12.14-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:8a7865f27db67d49e81d463da64a59365ebd6b826e0e4847aa111056dcb9dc88"}, - {file = "aiohttp-3.12.14-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:0ab5b38a6a39781d77713ad930cb5e7feea6f253de656a5f9f281a8f5931b086"}, - {file = "aiohttp-3.12.14-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:9b3b15acee5c17e8848d90a4ebc27853f37077ba6aec4d8cb4dbbea56d156933"}, - {file = "aiohttp-3.12.14-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:e4c972b0bdaac167c1e53e16a16101b17c6d0ed7eac178e653a07b9f7fad7151"}, - {file = "aiohttp-3.12.14-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:7442488b0039257a3bdbc55f7209587911f143fca11df9869578db6c26feeeb8"}, - {file = "aiohttp-3.12.14-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:f68d3067eecb64c5e9bab4a26aa11bd676f4c70eea9ef6536b0a4e490639add3"}, - {file = "aiohttp-3.12.14-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:f88d3704c8b3d598a08ad17d06006cb1ca52a1182291f04979e305c8be6c9758"}, - {file = "aiohttp-3.12.14-cp313-cp313-win32.whl", hash = "sha256:a3c99ab19c7bf375c4ae3debd91ca5d394b98b6089a03231d4c580ef3c2ae4c5"}, - {file = "aiohttp-3.12.14-cp313-cp313-win_amd64.whl", hash = "sha256:3f8aad695e12edc9d571f878c62bedc91adf30c760c8632f09663e5f564f4baa"}, - {file = "aiohttp-3.12.14-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:b8cc6b05e94d837bcd71c6531e2344e1ff0fb87abe4ad78a9261d67ef5d83eae"}, - {file = "aiohttp-3.12.14-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:d1dcb015ac6a3b8facd3677597edd5ff39d11d937456702f0bb2b762e390a21b"}, - {file = "aiohttp-3.12.14-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:3779ed96105cd70ee5e85ca4f457adbce3d9ff33ec3d0ebcdf6c5727f26b21b3"}, - {file = "aiohttp-3.12.14-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:717a0680729b4ebd7569c1dcd718c46b09b360745fd8eb12317abc74b14d14d0"}, - {file = "aiohttp-3.12.14-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b5dd3a2ef7c7e968dbbac8f5574ebeac4d2b813b247e8cec28174a2ba3627170"}, - {file = "aiohttp-3.12.14-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4710f77598c0092239bc12c1fcc278a444e16c7032d91babf5abbf7166463f7b"}, - {file = "aiohttp-3.12.14-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f3e9f75ae842a6c22a195d4a127263dbf87cbab729829e0bd7857fb1672400b2"}, - {file = "aiohttp-3.12.14-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5f9c8d55d6802086edd188e3a7d85a77787e50d56ce3eb4757a3205fa4657922"}, - {file = "aiohttp-3.12.14-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:79b29053ff3ad307880d94562cca80693c62062a098a5776ea8ef5ef4b28d140"}, - {file = "aiohttp-3.12.14-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:23e1332fff36bebd3183db0c7a547a1da9d3b4091509f6d818e098855f2f27d3"}, - {file = "aiohttp-3.12.14-cp39-cp39-musllinux_1_2_armv7l.whl", hash = "sha256:a564188ce831fd110ea76bcc97085dd6c625b427db3f1dbb14ca4baa1447dcbc"}, - {file = "aiohttp-3.12.14-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:a7a1b4302f70bb3ec40ca86de82def532c97a80db49cac6a6700af0de41af5ee"}, - {file = "aiohttp-3.12.14-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:1b07ccef62950a2519f9bfc1e5b294de5dd84329f444ca0b329605ea787a3de5"}, - {file = "aiohttp-3.12.14-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:938bd3ca6259e7e48b38d84f753d548bd863e0c222ed6ee6ace3fd6752768a84"}, - {file = "aiohttp-3.12.14-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:8bc784302b6b9f163b54c4e93d7a6f09563bd01ff2b841b29ed3ac126e5040bf"}, - {file = "aiohttp-3.12.14-cp39-cp39-win32.whl", hash = "sha256:a3416f95961dd7d5393ecff99e3f41dc990fb72eda86c11f2a60308ac6dcd7a0"}, - {file = "aiohttp-3.12.14-cp39-cp39-win_amd64.whl", hash = "sha256:196858b8820d7f60578f8b47e5669b3195c21d8ab261e39b1d705346458f445f"}, - {file = "aiohttp-3.12.14.tar.gz", hash = "sha256:6e06e120e34d93100de448fd941522e11dafa78ef1a893c179901b7d66aa29f2"}, + {file = "aiohttp-3.13.3-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:d5a372fd5afd301b3a89582817fdcdb6c34124787c70dbcc616f259013e7eef7"}, + {file = "aiohttp-3.13.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:147e422fd1223005c22b4fe080f5d93ced44460f5f9c105406b753612b587821"}, + {file = "aiohttp-3.13.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:859bd3f2156e81dd01432f5849fc73e2243d4a487c4fd26609b1299534ee1845"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:dca68018bf48c251ba17c72ed479f4dafe9dbd5a73707ad8d28a38d11f3d42af"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fee0c6bc7db1de362252affec009707a17478a00ec69f797d23ca256e36d5940"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c048058117fd649334d81b4b526e94bde3ccaddb20463a815ced6ecbb7d11160"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:215a685b6fbbfcf71dfe96e3eba7a6f58f10da1dfdf4889c7dd856abe430dca7"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:de2c184bb1fe2cbd2cefba613e9db29a5ab559323f994b6737e370d3da0ac455"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:75ca857eba4e20ce9f546cd59c7007b33906a4cd48f2ff6ccf1ccfc3b646f279"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:81e97251d9298386c2b7dbeb490d3d1badbdc69107fb8c9299dd04eb39bddc0e"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:c0e2d366af265797506f0283487223146af57815b388623f0357ef7eac9b209d"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:4e239d501f73d6db1522599e14b9b321a7e3b1de66ce33d53a765d975e9f4808"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:0db318f7a6f065d84cb1e02662c526294450b314a02bd9e2a8e67f0d8564ce40"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:bfc1cc2fe31a6026a8a88e4ecfb98d7f6b1fec150cfd708adbfd1d2f42257c29"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:af71fff7bac6bb7508956696dce8f6eec2bbb045eceb40343944b1ae62b5ef11"}, + {file = "aiohttp-3.13.3-cp310-cp310-win32.whl", hash = "sha256:37da61e244d1749798c151421602884db5270faf479cf0ef03af0ff68954c9dd"}, + {file = "aiohttp-3.13.3-cp310-cp310-win_amd64.whl", hash = "sha256:7e63f210bc1b57ef699035f2b4b6d9ce096b5914414a49b0997c839b2bd2223c"}, + {file = "aiohttp-3.13.3-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:5b6073099fb654e0a068ae678b10feff95c5cae95bbfcbfa7af669d361a8aa6b"}, + {file = "aiohttp-3.13.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1cb93e166e6c28716c8c6aeb5f99dfb6d5ccf482d29fe9bf9a794110e6d0ab64"}, + {file = "aiohttp-3.13.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:28e027cf2f6b641693a09f631759b4d9ce9165099d2b5d92af9bd4e197690eea"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3b61b7169ababd7802f9568ed96142616a9118dd2be0d1866e920e77ec8fa92a"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:80dd4c21b0f6237676449c6baaa1039abae86b91636b6c91a7f8e61c87f89540"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:65d2ccb7eabee90ce0503c17716fc77226be026dcc3e65cce859a30db715025b"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5b179331a481cb5529fca8b432d8d3c7001cb217513c94cd72d668d1248688a3"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d4c940f02f49483b18b079d1c27ab948721852b281f8b015c058100e9421dd1"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f9444f105664c4ce47a2a7171a2418bce5b7bae45fb610f4e2c36045d85911d3"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:694976222c711d1d00ba131904beb60534f93966562f64440d0c9d41b8cdb440"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:f33ed1a2bf1997a36661874b017f5c4b760f41266341af36febaf271d179f6d7"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:e636b3c5f61da31a92bf0d91da83e58fdfa96f178ba682f11d24f31944cdd28c"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:5d2d94f1f5fcbe40838ac51a6ab5704a6f9ea42e72ceda48de5e6b898521da51"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:2be0e9ccf23e8a94f6f0650ce06042cefc6ac703d0d7ab6c7a917289f2539ad4"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9af5e68ee47d6534d36791bbe9b646d2a7c7deb6fc24d7943628edfbb3581f29"}, + {file = "aiohttp-3.13.3-cp311-cp311-win32.whl", hash = "sha256:a2212ad43c0833a873d0fb3c63fa1bacedd4cf6af2fee62bf4b739ceec3ab239"}, + {file = "aiohttp-3.13.3-cp311-cp311-win_amd64.whl", hash = "sha256:642f752c3eb117b105acbd87e2c143de710987e09860d674e068c4c2c441034f"}, + {file = "aiohttp-3.13.3-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:b903a4dfee7d347e2d87697d0713be59e0b87925be030c9178c5faa58ea58d5c"}, + {file = "aiohttp-3.13.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:a45530014d7a1e09f4a55f4f43097ba0fd155089372e105e4bff4ca76cb1b168"}, + {file = "aiohttp-3.13.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:27234ef6d85c914f9efeb77ff616dbf4ad2380be0cda40b4db086ffc7ddd1b7d"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d32764c6c9aafb7fb55366a224756387cd50bfa720f32b88e0e6fa45b27dcf29"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b1a6102b4d3ebc07dad44fbf07b45bb600300f15b552ddf1851b5390202ea2e3"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c014c7ea7fb775dd015b2d3137378b7be0249a448a1612268b5a90c2d81de04d"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2b8d8ddba8f95ba17582226f80e2de99c7a7948e66490ef8d947e272a93e9463"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9ae8dd55c8e6c4257eae3a20fd2c8f41edaea5992ed67156642493b8daf3cecc"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:01ad2529d4b5035578f5081606a465f3b814c542882804e2e8cda61adf5c71bf"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:bb4f7475e359992b580559e008c598091c45b5088f28614e855e42d39c2f1033"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:c19b90316ad3b24c69cd78d5c9b4f3aa4497643685901185b65166293d36a00f"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:96d604498a7c782cb15a51c406acaea70d8c027ee6b90c569baa6e7b93073679"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:084911a532763e9d3dd95adf78a78f4096cd5f58cdc18e6fdbc1b58417a45423"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:7a4a94eb787e606d0a09404b9c38c113d3b099d508021faa615d70a0131907ce"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:87797e645d9d8e222e04160ee32aa06bc5c163e8499f24db719e7852ec23093a"}, + {file = "aiohttp-3.13.3-cp312-cp312-win32.whl", hash = "sha256:b04be762396457bef43f3597c991e192ee7da460a4953d7e647ee4b1c28e7046"}, + {file = "aiohttp-3.13.3-cp312-cp312-win_amd64.whl", hash = "sha256:e3531d63d3bdfa7e3ac5e9b27b2dd7ec9df3206a98e0b3445fa906f233264c57"}, + {file = "aiohttp-3.13.3-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:5dff64413671b0d3e7d5918ea490bdccb97a4ad29b3f311ed423200b2203e01c"}, + {file = "aiohttp-3.13.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:87b9aab6d6ed88235aa2970294f496ff1a1f9adcd724d800e9b952395a80ffd9"}, + {file = "aiohttp-3.13.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:425c126c0dc43861e22cb1c14ba4c8e45d09516d0a3ae0a3f7494b79f5f233a3"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7f9120f7093c2a32d9647abcaf21e6ad275b4fbec5b55969f978b1a97c7c86bf"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:697753042d57f4bf7122cab985bf15d0cef23c770864580f5af4f52023a56bd6"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6de499a1a44e7de70735d0b39f67c8f25eb3d91eb3103be99ca0fa882cdd987d"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:37239e9f9a7ea9ac5bf6b92b0260b01f8a22281996da609206a84df860bc1261"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f76c1e3fe7d7c8afad7ed193f89a292e1999608170dcc9751a7462a87dfd5bc0"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fc290605db2a917f6e81b0e1e0796469871f5af381ce15c604a3c5c7e51cb730"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:4021b51936308aeea0367b8f006dc999ca02bc118a0cc78c303f50a2ff6afb91"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:49a03727c1bba9a97d3e93c9f93ca03a57300f484b6e935463099841261195d3"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:3d9908a48eb7416dc1f4524e69f1d32e5d90e3981e4e37eb0aa1cd18f9cfa2a4"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:2712039939ec963c237286113c68dbad80a82a4281543f3abf766d9d73228998"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:7bfdc049127717581866fa4708791220970ce291c23e28ccf3922c700740fdc0"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8057c98e0c8472d8846b9c79f56766bcc57e3e8ac7bfd510482332366c56c591"}, + {file = "aiohttp-3.13.3-cp313-cp313-win32.whl", hash = "sha256:1449ceddcdbcf2e0446957863af03ebaaa03f94c090f945411b61269e2cb5daf"}, + {file = "aiohttp-3.13.3-cp313-cp313-win_amd64.whl", hash = "sha256:693781c45a4033d31d4187d2436f5ac701e7bbfe5df40d917736108c1cc7436e"}, + {file = "aiohttp-3.13.3-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:ea37047c6b367fd4bd632bff8077449b8fa034b69e812a18e0132a00fae6e808"}, + {file = "aiohttp-3.13.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:6fc0e2337d1a4c3e6acafda6a78a39d4c14caea625124817420abceed36e2415"}, + {file = "aiohttp-3.13.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c685f2d80bb67ca8c3837823ad76196b3694b0159d232206d1e461d3d434666f"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:48e377758516d262bde50c2584fc6c578af272559c409eecbdd2bae1601184d6"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:34749271508078b261c4abb1767d42b8d0c0cc9449c73a4df494777dc55f0687"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:82611aeec80eb144416956ec85b6ca45a64d76429c1ed46ae1b5f86c6e0c9a26"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2fff83cfc93f18f215896e3a190e8e5cb413ce01553901aca925176e7568963a"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bbe7d4cecacb439e2e2a8a1a7b935c25b812af7a5fd26503a66dadf428e79ec1"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b928f30fe49574253644b1ca44b1b8adbd903aa0da4b9054a6c20fc7f4092a25"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7b5e8fe4de30df199155baaf64f2fcd604f4c678ed20910db8e2c66dc4b11603"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:8542f41a62bcc58fc7f11cf7c90e0ec324ce44950003feb70640fc2a9092c32a"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:5e1d8c8b8f1d91cd08d8f4a3c2b067bfca6ec043d3ff36de0f3a715feeedf926"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:90455115e5da1c3c51ab619ac57f877da8fd6d73c05aacd125c5ae9819582aba"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:042e9e0bcb5fba81886c8b4fbb9a09d6b8a00245fd8d88e4d989c1f96c74164c"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:2eb752b102b12a76ca02dff751a801f028b4ffbbc478840b473597fc91a9ed43"}, + {file = "aiohttp-3.13.3-cp314-cp314-win32.whl", hash = "sha256:b556c85915d8efaed322bf1bdae9486aa0f3f764195a0fb6ee962e5c71ef5ce1"}, + {file = "aiohttp-3.13.3-cp314-cp314-win_amd64.whl", hash = "sha256:9bf9f7a65e7aa20dd764151fb3d616c81088f91f8df39c3893a536e279b4b984"}, + {file = "aiohttp-3.13.3-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:05861afbbec40650d8a07ea324367cb93e9e8cc7762e04dd4405df99fa65159c"}, + {file = "aiohttp-3.13.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:2fc82186fadc4a8316768d61f3722c230e2c1dcab4200d52d2ebdf2482e47592"}, + {file = "aiohttp-3.13.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:0add0900ff220d1d5c5ebbf99ed88b0c1bbf87aa7e4262300ed1376a6b13414f"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:568f416a4072fbfae453dcf9a99194bbb8bdeab718e08ee13dfa2ba0e4bebf29"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:add1da70de90a2569c5e15249ff76a631ccacfe198375eead4aadf3b8dc849dc"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:10b47b7ba335d2e9b1239fa571131a87e2d8ec96b333e68b2a305e7a98b0bae2"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3dd4dce1c718e38081c8f35f323209d4c1df7d4db4bab1b5c88a6b4d12b74587"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:34bac00a67a812570d4a460447e1e9e06fae622946955f939051e7cc895cfab8"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a19884d2ee70b06d9204b2727a7b9f983d0c684c650254679e716b0b77920632"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:5f8ca7f2bb6ba8348a3614c7918cc4bb73268c5ac2a207576b7afea19d3d9f64"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:b0d95340658b9d2f11d9697f59b3814a9d3bb4b7a7c20b131df4bcef464037c0"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:a1e53262fd202e4b40b70c3aff944a8155059beedc8a89bba9dc1f9ef06a1b56"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:d60ac9663f44168038586cab2157e122e46bdef09e9368b37f2d82d354c23f72"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:90751b8eed69435bac9ff4e3d2f6b3af1f57e37ecb0fbeee59c0174c9e2d41df"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:fc353029f176fd2b3ec6cfc71be166aba1936fe5d73dd1992ce289ca6647a9aa"}, + {file = "aiohttp-3.13.3-cp314-cp314t-win32.whl", hash = "sha256:2e41b18a58da1e474a057b3d35248d8320029f61d70a37629535b16a0c8f3767"}, + {file = "aiohttp-3.13.3-cp314-cp314t-win_amd64.whl", hash = "sha256:44531a36aa2264a1860089ffd4dce7baf875ee5a6079d5fb42e261c704ef7344"}, + {file = "aiohttp-3.13.3-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:31a83ea4aead760dfcb6962efb1d861db48c34379f2ff72db9ddddd4cda9ea2e"}, + {file = "aiohttp-3.13.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:988a8c5e317544fdf0d39871559e67b6341065b87fceac641108c2096d5506b7"}, + {file = "aiohttp-3.13.3-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:9b174f267b5cfb9a7dba9ee6859cecd234e9a681841eb85068059bc867fb8f02"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:947c26539750deeaee933b000fb6517cc770bbd064bad6033f1cff4803881e43"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:9ebf57d09e131f5323464bd347135a88622d1c0976e88ce15b670e7ad57e4bd6"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4ae5b5a0e1926e504c81c5b84353e7a5516d8778fbbff00429fe7b05bb25cbce"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2ba0eea45eb5cc3172dbfc497c066f19c41bac70963ea1a67d51fc92e4cf9a80"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bae5c2ed2eae26cc382020edad80d01f36cb8e746da40b292e68fec40421dc6a"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8a60e60746623925eab7d25823329941aee7242d559baa119ca2b253c88a7bd6"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:e50a2e1404f063427c9d027378472316201a2290959a295169bcf25992d04558"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_armv7l.whl", hash = "sha256:9a9dc347e5a3dc7dfdbc1f82da0ef29e388ddb2ed281bfce9dd8248a313e62b7"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:b46020d11d23fe16551466c77823df9cc2f2c1e63cc965daf67fa5eec6ca1877"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_riscv64.whl", hash = "sha256:69c56fbc1993fa17043e24a546959c0178fe2b5782405ad4559e6c13975c15e3"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:b99281b0704c103d4e11e72a76f1b543d4946fea7dd10767e7e1b5f00d4e5704"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:40c5e40ecc29ba010656c18052b877a1c28f84344825efa106705e835c28530f"}, + {file = "aiohttp-3.13.3-cp39-cp39-win32.whl", hash = "sha256:56339a36b9f1fc708260c76c87e593e2afb30d26de9ae1eb445b5e051b98a7a1"}, + {file = "aiohttp-3.13.3-cp39-cp39-win_amd64.whl", hash = "sha256:c6b8568a3bb5819a0ad087f16d40e5a3fb6099f39ea1d5625a3edc1e923fc538"}, + {file = "aiohttp-3.13.3.tar.gz", hash = "sha256:a949eee43d3782f2daae4f4a2819b2cb9b0c5d3b7f7a927067cc84dafdbb9f88"}, ] [package.dependencies] @@ -143,7 +177,7 @@ propcache = ">=0.2.0" yarl = ">=1.17.0,<2.0" [package.extras] -speedups = ["Brotli ; platform_python_implementation == \"CPython\"", "aiodns (>=3.3.0)", "brotlicffi ; platform_python_implementation != \"CPython\""] +speedups = ["Brotli (>=1.2) ; platform_python_implementation == \"CPython\"", "aiodns (>=3.3.0)", "backports.zstd ; platform_python_implementation == \"CPython\" and python_version < \"3.14\"", "brotlicffi (>=1.2) ; platform_python_implementation != \"CPython\""] [[package]] name = "aiosignal" From 6e2ba66a5a1df282714a649ecedfc3b1dce2e2e2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:44:13 +0100 Subject: [PATCH 016/337] build(deps): bump pynacl from 1.5.0 to 1.6.2 in /api (#9739) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- api/poetry.lock | 213 ++++++++++++++++++++++++++++-------------------- 1 file changed, 125 insertions(+), 88 deletions(-) diff --git a/api/poetry.lock b/api/poetry.lock index 7b2365dd9c..6599c7e0d3 100644 --- a/api/poetry.lock +++ b/api/poetry.lock @@ -1,4 +1,4 @@ -# This file is automatically @generated by Poetry 2.1.3 and should not be changed by hand. +# This file is automatically @generated by Poetry 2.2.1 and should not be changed by hand. [[package]] name = "about-time" @@ -1554,84 +1554,101 @@ files = [ [[package]] name = "cffi" -version = "1.17.1" +version = "2.0.0" description = "Foreign Function Interface for Python calling C code." optional = false -python-versions = ">=3.8" +python-versions = ">=3.9" groups = ["main", "dev"] +markers = "platform_python_implementation != \"PyPy\"" files = [ - {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"}, - {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be"}, - {file = "cffi-1.17.1-cp310-cp310-win32.whl", hash = "sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c"}, - {file = "cffi-1.17.1-cp310-cp310-win_amd64.whl", hash = "sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15"}, - {file = "cffi-1.17.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401"}, - {file = "cffi-1.17.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b"}, - {file = "cffi-1.17.1-cp311-cp311-win32.whl", hash = "sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655"}, - {file = "cffi-1.17.1-cp311-cp311-win_amd64.whl", hash = "sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0"}, - {file = "cffi-1.17.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4"}, - {file = "cffi-1.17.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93"}, - {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3"}, - {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8"}, - {file = "cffi-1.17.1-cp312-cp312-win32.whl", hash = "sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65"}, - {file = "cffi-1.17.1-cp312-cp312-win_amd64.whl", hash = "sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903"}, - {file = "cffi-1.17.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e"}, - {file = "cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd"}, - {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed"}, - {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9"}, - {file = "cffi-1.17.1-cp313-cp313-win32.whl", hash = "sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d"}, - {file = "cffi-1.17.1-cp313-cp313-win_amd64.whl", hash = "sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a"}, - {file = "cffi-1.17.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1"}, - {file = "cffi-1.17.1-cp38-cp38-win32.whl", hash = "sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8"}, - {file = "cffi-1.17.1-cp38-cp38-win_amd64.whl", hash = "sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1"}, - {file = "cffi-1.17.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16"}, - {file = "cffi-1.17.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e"}, - {file = "cffi-1.17.1-cp39-cp39-win32.whl", hash = "sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7"}, - {file = "cffi-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662"}, - {file = "cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824"}, + {file = "cffi-2.0.0-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44"}, + {file = "cffi-2.0.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453"}, + {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495"}, + {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5"}, + {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb"}, + {file = "cffi-2.0.0-cp310-cp310-win32.whl", hash = "sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a"}, + {file = "cffi-2.0.0-cp310-cp310-win_amd64.whl", hash = "sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739"}, + {file = "cffi-2.0.0-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe"}, + {file = "cffi-2.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26"}, + {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9"}, + {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414"}, + {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743"}, + {file = "cffi-2.0.0-cp311-cp311-win32.whl", hash = "sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5"}, + {file = "cffi-2.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5"}, + {file = "cffi-2.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d"}, + {file = "cffi-2.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d"}, + {file = "cffi-2.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba"}, + {file = "cffi-2.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94"}, + {file = "cffi-2.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187"}, + {file = "cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18"}, + {file = "cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5"}, + {file = "cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6"}, + {file = "cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb"}, + {file = "cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26"}, + {file = "cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c"}, + {file = "cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b"}, + {file = "cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27"}, + {file = "cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75"}, + {file = "cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91"}, + {file = "cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5"}, + {file = "cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13"}, + {file = "cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b"}, + {file = "cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c"}, + {file = "cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef"}, + {file = "cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775"}, + {file = "cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205"}, + {file = "cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1"}, + {file = "cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f"}, + {file = "cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25"}, + {file = "cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad"}, + {file = "cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9"}, + {file = "cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d"}, + {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c"}, + {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8"}, + {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc"}, + {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592"}, + {file = "cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512"}, + {file = "cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4"}, + {file = "cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e"}, + {file = "cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6"}, + {file = "cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9"}, + {file = "cffi-2.0.0-cp39-cp39-macosx_10_13_x86_64.whl", hash = "sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf"}, + {file = "cffi-2.0.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63"}, + {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2"}, + {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65"}, + {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322"}, + {file = "cffi-2.0.0-cp39-cp39-win32.whl", hash = "sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a"}, + {file = "cffi-2.0.0-cp39-cp39-win_amd64.whl", hash = "sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9"}, + {file = "cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529"}, ] -markers = {dev = "platform_python_implementation != \"PyPy\""} [package.dependencies] -pycparser = "*" +pycparser = {version = "*", markers = "implementation_name != \"PyPy\""} [[package]] name = "charset-normalizer" @@ -5678,11 +5695,11 @@ description = "C parser in Python" optional = false python-versions = ">=3.8" groups = ["main", "dev"] +markers = "platform_python_implementation != \"PyPy\" and implementation_name != \"PyPy\"" files = [ {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"}, {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"}, ] -markers = {dev = "platform_python_implementation != \"PyPy\""} [[package]] name = "pycurl" @@ -5946,30 +5963,45 @@ testutils = ["gitpython (>3)"] [[package]] name = "pynacl" -version = "1.5.0" +version = "1.6.2" description = "Python binding to the Networking and Cryptography (NaCl) library" optional = false -python-versions = ">=3.6" +python-versions = ">=3.8" groups = ["main"] files = [ - {file = "PyNaCl-1.5.0-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1"}, - {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92"}, - {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394"}, - {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d"}, - {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858"}, - {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b"}, - {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff"}, - {file = "PyNaCl-1.5.0-cp36-abi3-win32.whl", hash = "sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543"}, - {file = "PyNaCl-1.5.0-cp36-abi3-win_amd64.whl", hash = "sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93"}, - {file = "PyNaCl-1.5.0.tar.gz", hash = "sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba"}, + {file = "pynacl-1.6.2-cp314-cp314t-macosx_10_10_universal2.whl", hash = "sha256:622d7b07cc5c02c666795792931b50c91f3ce3c2649762efb1ef0d5684c81594"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d071c6a9a4c94d79eb665db4ce5cedc537faf74f2355e4d502591d850d3913c0"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fe9847ca47d287af41e82be1dd5e23023d3c31a951da134121ab02e42ac218c9"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:04316d1fc625d860b6c162fff704eb8426b1a8bcd3abacea11142cbd99a6b574"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:44081faff368d6c5553ccf55322ef2819abb40e25afaec7e740f159f74813634"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:a9f9932d8d2811ce1a8ffa79dcbdf3970e7355b5c8eb0c1a881a57e7f7d96e88"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:bc4a36b28dd72fb4845e5d8f9760610588a96d5a51f01d84d8c6ff9849968c14"}, + {file = "pynacl-1.6.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:3bffb6d0f6becacb6526f8f42adfb5efb26337056ee0831fb9a7044d1a964444"}, + {file = "pynacl-1.6.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:2fef529ef3ee487ad8113d287a593fa26f48ee3620d92ecc6f1d09ea38e0709b"}, + {file = "pynacl-1.6.2-cp314-cp314t-win32.whl", hash = "sha256:a84bf1c20339d06dc0c85d9aea9637a24f718f375d861b2668b2f9f96fa51145"}, + {file = "pynacl-1.6.2-cp314-cp314t-win_amd64.whl", hash = "sha256:320ef68a41c87547c91a8b58903c9caa641ab01e8512ce291085b5fe2fcb7590"}, + {file = "pynacl-1.6.2-cp314-cp314t-win_arm64.whl", hash = "sha256:d29bfe37e20e015a7d8b23cfc8bd6aa7909c92a1b8f41ee416bbb3e79ef182b2"}, + {file = "pynacl-1.6.2-cp38-abi3-macosx_10_10_universal2.whl", hash = "sha256:c949ea47e4206af7c8f604b8278093b674f7c79ed0d4719cc836902bf4517465"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8845c0631c0be43abdd865511c41eab235e0be69c81dc66a50911594198679b0"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:22de65bb9010a725b0dac248f353bb072969c94fa8d6b1f34b87d7953cf7bbe4"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:46065496ab748469cdd999246d17e301b2c24ae2fdf739132e580a0e94c94a87"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8a66d6fb6ae7661c58995f9c6435bda2b1e68b54b598a6a10247bfcdadac996c"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:26bfcd00dcf2cf160f122186af731ae30ab120c18e8375684ec2670dccd28130"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:c8a231e36ec2cab018c4ad4358c386e36eede0319a0c41fed24f840b1dac59f6"}, + {file = "pynacl-1.6.2-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:68be3a09455743ff9505491220b64440ced8973fe930f270c8e07ccfa25b1f9e"}, + {file = "pynacl-1.6.2-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:8b097553b380236d51ed11356c953bf8ce36a29a3e596e934ecabe76c985a577"}, + {file = "pynacl-1.6.2-cp38-abi3-win32.whl", hash = "sha256:5811c72b473b2f38f7e2a3dc4f8642e3a3e9b5e7317266e4ced1fba85cae41aa"}, + {file = "pynacl-1.6.2-cp38-abi3-win_amd64.whl", hash = "sha256:62985f233210dee6548c223301b6c25440852e13d59a8b81490203c3227c5ba0"}, + {file = "pynacl-1.6.2-cp38-abi3-win_arm64.whl", hash = "sha256:834a43af110f743a754448463e8fd61259cd4ab5bbedcf70f9dabad1d28a394c"}, + {file = "pynacl-1.6.2.tar.gz", hash = "sha256:018494d6d696ae03c7e656e5e74cdfd8ea1326962cc401bcf018f1ed8436811c"}, ] [package.dependencies] -cffi = ">=1.4.1" +cffi = {version = ">=2.0.0", markers = "platform_python_implementation != \"PyPy\" and python_version >= \"3.9\""} [package.extras] -docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"] -tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"] +docs = ["sphinx (<7)", "sphinx_rtd_theme"] +tests = ["hypothesis (>=3.27.0)", "pytest (>=7.4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"] [[package]] name = "pyopenssl" @@ -6698,6 +6730,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f66efbc1caa63c088dead1c4170d148eabc9b80d95fb75b6c92ac0aad2437d76"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:22353049ba4181685023b25b5b51a574bce33e7f51c759371a7422dcae5402a6"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:932205970b9f9991b34f55136be327501903f7c66830e9760a8ffb15b07f05cd"}, + {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:a52d48f4e7bf9005e8f0a89209bf9a73f7190ddf0489eee5eb51377385f59f2a"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-win32.whl", hash = "sha256:3eac5a91891ceb88138c113f9db04f3cebdae277f5d44eaa3651a4f573e6a5da"}, {file = "ruamel.yaml.clib-0.2.12-cp310-cp310-win_amd64.whl", hash = "sha256:ab007f2f5a87bd08ab1499bdf96f3d5c6ad4dcfa364884cb4549aa0154b13a28"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-macosx_13_0_arm64.whl", hash = "sha256:4a6679521a58256a90b0d89e03992c15144c5f3858f40d7c18886023d7943db6"}, @@ -6706,6 +6739,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:811ea1594b8a0fb466172c384267a4e5e367298af6b228931f273b111f17ef52"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:cf12567a7b565cbf65d438dec6cfbe2917d3c1bdddfce84a9930b7d35ea59642"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:7dd5adc8b930b12c8fc5b99e2d535a09889941aa0d0bd06f4749e9a9397c71d2"}, + {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1492a6051dab8d912fc2adeef0e8c72216b24d57bd896ea607cb90bb0c4981d3"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-win32.whl", hash = "sha256:bd0a08f0bab19093c54e18a14a10b4322e1eacc5217056f3c063bd2f59853ce4"}, {file = "ruamel.yaml.clib-0.2.12-cp311-cp311-win_amd64.whl", hash = "sha256:a274fb2cb086c7a3dea4322ec27f4cb5cc4b6298adb583ab0e211a4682f241eb"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:20b0f8dc160ba83b6dcc0e256846e1a02d044e13f7ea74a3d1d56ede4e48c632"}, @@ -6714,6 +6748,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:749c16fcc4a2b09f28843cda5a193e0283e47454b63ec4b81eaa2242f50e4ccd"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-musllinux_1_1_i686.whl", hash = "sha256:bf165fef1f223beae7333275156ab2022cffe255dcc51c27f066b4370da81e31"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:32621c177bbf782ca5a18ba4d7af0f1082a3f6e517ac2a18b3974d4edf349680"}, + {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b82a7c94a498853aa0b272fd5bc67f29008da798d4f93a2f9f289feb8426a58d"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-win32.whl", hash = "sha256:e8c4ebfcfd57177b572e2040777b8abc537cdef58a2120e830124946aa9b42c5"}, {file = "ruamel.yaml.clib-0.2.12-cp312-cp312-win_amd64.whl", hash = "sha256:0467c5965282c62203273b838ae77c0d29d7638c8a4e3a1c8bdd3602c10904e4"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:4c8c5d82f50bb53986a5e02d1b3092b03622c02c2eb78e29bec33fd9593bae1a"}, @@ -6722,6 +6757,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:96777d473c05ee3e5e3c3e999f5d23c6f4ec5b0c38c098b3a5229085f74236c6"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-musllinux_1_1_i686.whl", hash = "sha256:3bc2a80e6420ca8b7d3590791e2dfc709c88ab9152c00eeb511c9875ce5778bf"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:e188d2699864c11c36cdfdada94d781fd5d6b0071cd9c427bceb08ad3d7c70e1"}, + {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:4f6f3eac23941b32afccc23081e1f50612bdbe4e982012ef4f5797986828cd01"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-win32.whl", hash = "sha256:6442cb36270b3afb1b4951f060eccca1ce49f3d087ca1ca4563a6eb479cb3de6"}, {file = "ruamel.yaml.clib-0.2.12-cp313-cp313-win_amd64.whl", hash = "sha256:e5b8daf27af0b90da7bb903a876477a9e6d7270be6146906b276605997c7e9a3"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-macosx_12_0_arm64.whl", hash = "sha256:fc4b630cd3fa2cf7fce38afa91d7cfe844a9f75d7f0f36393fa98815e911d987"}, @@ -6730,6 +6766,7 @@ files = [ {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e2f1c3765db32be59d18ab3953f43ab62a761327aafc1594a2a1fbe038b8b8a7"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:d85252669dc32f98ebcd5d36768f5d4faeaeaa2d655ac0473be490ecdae3c285"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:e143ada795c341b56de9418c58d028989093ee611aa27ffb9b7f609c00d813ed"}, + {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:2c59aa6170b990d8d2719323e628aaf36f3bfbc1c26279c0eeeb24d05d2d11c7"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-win32.whl", hash = "sha256:beffaed67936fbbeffd10966a4eb53c402fafd3d6833770516bf7314bc6ffa12"}, {file = "ruamel.yaml.clib-0.2.12-cp39-cp39-win_amd64.whl", hash = "sha256:040ae85536960525ea62868b642bdb0c2cc6021c9f9d507810c0c604e66f5a7b"}, {file = "ruamel.yaml.clib-0.2.12.tar.gz", hash = "sha256:6c8fbb13ec503f99a91901ab46e0b07ae7941cd527393187039aec586fdfd36f"}, From bbdb230bb21c45f86a75ea62b3a6a5c954892ed2 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:45:14 +0100 Subject: [PATCH 017/337] build(deps): bump filelock from 3.12.4 to 3.20.1 in /api (#9594) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> From 25c90f9f63668faa6fa760e330af915110b5b9dd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:45:58 +0100 Subject: [PATCH 018/337] build(deps): bump urllib3 from 2.5.0 to 2.6.3 in /api (#9735) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- api/poetry.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/api/poetry.lock b/api/poetry.lock index 6599c7e0d3..331f5fbf58 100644 --- a/api/poetry.lock +++ b/api/poetry.lock @@ -7257,21 +7257,21 @@ files = [ [[package]] name = "urllib3" -version = "2.5.0" +version = "2.6.3" description = "HTTP library with thread-safe connection pooling, file post, and more." optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ - {file = "urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc"}, - {file = "urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760"}, + {file = "urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4"}, + {file = "urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"}, ] [package.extras] -brotli = ["brotli (>=1.0.9) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\""] +brotli = ["brotli (>=1.2.0) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=1.2.0.0) ; platform_python_implementation != \"CPython\""] h2 = ["h2 (>=4,<5)"] socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"] -zstd = ["zstandard (>=0.18.0)"] +zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [[package]] name = "uuid6" From 211639d849f07191a8f789834058def3b570ab9f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 13:52:58 +0100 Subject: [PATCH 019/337] build(deps-dev): bump marshmallow from 3.26.1 to 3.26.2 in /api (#9651) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- api/poetry.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/api/poetry.lock b/api/poetry.lock index 331f5fbf58..d6c777e025 100644 --- a/api/poetry.lock +++ b/api/poetry.lock @@ -4233,14 +4233,14 @@ files = [ [[package]] name = "marshmallow" -version = "3.26.1" +version = "3.26.2" description = "A lightweight library for converting complex datatypes to and from native Python datatypes." optional = false python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "marshmallow-3.26.1-py3-none-any.whl", hash = "sha256:3350409f20a70a7e4e11a27661187b77cdcaeb20abca41c1454fe33636bea09c"}, - {file = "marshmallow-3.26.1.tar.gz", hash = "sha256:e6d8affb6cb61d39d26402096dc0aee12d5a26d490a121f118d2e81dc0719dc6"}, + {file = "marshmallow-3.26.2-py3-none-any.whl", hash = "sha256:013fa8a3c4c276c24d26d84ce934dc964e2aa794345a0f8c7e5a7191482c8a73"}, + {file = "marshmallow-3.26.2.tar.gz", hash = "sha256:bbe2adb5a03e6e3571b573f42527c6fe926e17467833660bebd11593ab8dfd57"}, ] [package.dependencies] From fa2deef2417f0c7d5b0de554afcbbe240e3d78e1 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 14:12:54 +0100 Subject: [PATCH 020/337] build(deps): bump aiohttp from 3.12.15 to 3.13.3 in /api (#9723) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pepe Fagoaga --- api/poetry.lock | 210 ++++++++++++++++++++++++++++-------------------- 1 file changed, 122 insertions(+), 88 deletions(-) diff --git a/api/poetry.lock b/api/poetry.lock index d6c777e025..b12a734dc9 100644 --- a/api/poetry.lock +++ b/api/poetry.lock @@ -38,98 +38,132 @@ files = [ [[package]] name = "aiohttp" -version = "3.12.15" +version = "3.13.3" description = "Async http client/server framework (asyncio)" optional = false python-versions = ">=3.9" groups = ["main"] files = [ - {file = "aiohttp-3.12.15-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:b6fc902bff74d9b1879ad55f5404153e2b33a82e72a95c89cec5eb6cc9e92fbc"}, - {file = "aiohttp-3.12.15-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:098e92835b8119b54c693f2f88a1dec690e20798ca5f5fe5f0520245253ee0af"}, - {file = "aiohttp-3.12.15-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:40b3fee496a47c3b4a39a731954c06f0bd9bd3e8258c059a4beb76ac23f8e421"}, - {file = "aiohttp-3.12.15-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2ce13fcfb0bb2f259fb42106cdc63fa5515fb85b7e87177267d89a771a660b79"}, - {file = "aiohttp-3.12.15-cp310-cp310-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3beb14f053222b391bf9cf92ae82e0171067cc9c8f52453a0f1ec7c37df12a77"}, - {file = "aiohttp-3.12.15-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:4c39e87afe48aa3e814cac5f535bc6199180a53e38d3f51c5e2530f5aa4ec58c"}, - {file = "aiohttp-3.12.15-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d5f1b4ce5bc528a6ee38dbf5f39bbf11dd127048726323b72b8e85769319ffc4"}, - {file = "aiohttp-3.12.15-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1004e67962efabbaf3f03b11b4c43b834081c9e3f9b32b16a7d97d4708a9abe6"}, - {file = "aiohttp-3.12.15-cp310-cp310-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:8faa08fcc2e411f7ab91d1541d9d597d3a90e9004180edb2072238c085eac8c2"}, - {file = "aiohttp-3.12.15-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:fe086edf38b2222328cdf89af0dde2439ee173b8ad7cb659b4e4c6f385b2be3d"}, - {file = "aiohttp-3.12.15-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:79b26fe467219add81d5e47b4a4ba0f2394e8b7c7c3198ed36609f9ba161aecb"}, - {file = "aiohttp-3.12.15-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:b761bac1192ef24e16706d761aefcb581438b34b13a2f069a6d343ec8fb693a5"}, - {file = "aiohttp-3.12.15-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:e153e8adacfe2af562861b72f8bc47f8a5c08e010ac94eebbe33dc21d677cd5b"}, - {file = "aiohttp-3.12.15-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:fc49c4de44977aa8601a00edbf157e9a421f227aa7eb477d9e3df48343311065"}, - {file = "aiohttp-3.12.15-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:2776c7ec89c54a47029940177e75c8c07c29c66f73464784971d6a81904ce9d1"}, - {file = "aiohttp-3.12.15-cp310-cp310-win32.whl", hash = "sha256:2c7d81a277fa78b2203ab626ced1487420e8c11a8e373707ab72d189fcdad20a"}, - {file = "aiohttp-3.12.15-cp310-cp310-win_amd64.whl", hash = "sha256:83603f881e11f0f710f8e2327817c82e79431ec976448839f3cd05d7afe8f830"}, - {file = "aiohttp-3.12.15-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:d3ce17ce0220383a0f9ea07175eeaa6aa13ae5a41f30bc61d84df17f0e9b1117"}, - {file = "aiohttp-3.12.15-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:010cc9bbd06db80fe234d9003f67e97a10fe003bfbedb40da7d71c1008eda0fe"}, - {file = "aiohttp-3.12.15-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:3f9d7c55b41ed687b9d7165b17672340187f87a773c98236c987f08c858145a9"}, - {file = "aiohttp-3.12.15-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:bc4fbc61bb3548d3b482f9ac7ddd0f18c67e4225aaa4e8552b9f1ac7e6bda9e5"}, - {file = "aiohttp-3.12.15-cp311-cp311-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:7fbc8a7c410bb3ad5d595bb7118147dfbb6449d862cc1125cf8867cb337e8728"}, - {file = "aiohttp-3.12.15-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:74dad41b3458dbb0511e760fb355bb0b6689e0630de8a22b1b62a98777136e16"}, - {file = "aiohttp-3.12.15-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3b6f0af863cf17e6222b1735a756d664159e58855da99cfe965134a3ff63b0b0"}, - {file = "aiohttp-3.12.15-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b5b7fe4972d48a4da367043b8e023fb70a04d1490aa7d68800e465d1b97e493b"}, - {file = "aiohttp-3.12.15-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:6443cca89553b7a5485331bc9bedb2342b08d073fa10b8c7d1c60579c4a7b9bd"}, - {file = "aiohttp-3.12.15-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:6c5f40ec615e5264f44b4282ee27628cea221fcad52f27405b80abb346d9f3f8"}, - {file = "aiohttp-3.12.15-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:2abbb216a1d3a2fe86dbd2edce20cdc5e9ad0be6378455b05ec7f77361b3ab50"}, - {file = "aiohttp-3.12.15-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:db71ce547012a5420a39c1b744d485cfb823564d01d5d20805977f5ea1345676"}, - {file = "aiohttp-3.12.15-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:ced339d7c9b5030abad5854aa5413a77565e5b6e6248ff927d3e174baf3badf7"}, - {file = "aiohttp-3.12.15-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:7c7dd29c7b5bda137464dc9bfc738d7ceea46ff70309859ffde8c022e9b08ba7"}, - {file = "aiohttp-3.12.15-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:421da6fd326460517873274875c6c5a18ff225b40da2616083c5a34a7570b685"}, - {file = "aiohttp-3.12.15-cp311-cp311-win32.whl", hash = "sha256:4420cf9d179ec8dfe4be10e7d0fe47d6d606485512ea2265b0d8c5113372771b"}, - {file = "aiohttp-3.12.15-cp311-cp311-win_amd64.whl", hash = "sha256:edd533a07da85baa4b423ee8839e3e91681c7bfa19b04260a469ee94b778bf6d"}, - {file = "aiohttp-3.12.15-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:802d3868f5776e28f7bf69d349c26fc0efadb81676d0afa88ed00d98a26340b7"}, - {file = "aiohttp-3.12.15-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:f2800614cd560287be05e33a679638e586a2d7401f4ddf99e304d98878c29444"}, - {file = "aiohttp-3.12.15-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8466151554b593909d30a0a125d638b4e5f3836e5aecde85b66b80ded1cb5b0d"}, - {file = "aiohttp-3.12.15-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2e5a495cb1be69dae4b08f35a6c4579c539e9b5706f606632102c0f855bcba7c"}, - {file = "aiohttp-3.12.15-cp312-cp312-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:6404dfc8cdde35c69aaa489bb3542fb86ef215fc70277c892be8af540e5e21c0"}, - {file = "aiohttp-3.12.15-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:3ead1c00f8521a5c9070fcb88f02967b1d8a0544e6d85c253f6968b785e1a2ab"}, - {file = "aiohttp-3.12.15-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6990ef617f14450bc6b34941dba4f12d5613cbf4e33805932f853fbd1cf18bfb"}, - {file = "aiohttp-3.12.15-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fd736ed420f4db2b8148b52b46b88ed038d0354255f9a73196b7bbce3ea97545"}, - {file = "aiohttp-3.12.15-cp312-cp312-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3c5092ce14361a73086b90c6efb3948ffa5be2f5b6fbcf52e8d8c8b8848bb97c"}, - {file = "aiohttp-3.12.15-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:aaa2234bb60c4dbf82893e934d8ee8dea30446f0647e024074237a56a08c01bd"}, - {file = "aiohttp-3.12.15-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:6d86a2fbdd14192e2f234a92d3b494dd4457e683ba07e5905a0b3ee25389ac9f"}, - {file = "aiohttp-3.12.15-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:a041e7e2612041a6ddf1c6a33b883be6a421247c7afd47e885969ee4cc58bd8d"}, - {file = "aiohttp-3.12.15-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:5015082477abeafad7203757ae44299a610e89ee82a1503e3d4184e6bafdd519"}, - {file = "aiohttp-3.12.15-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:56822ff5ddfd1b745534e658faba944012346184fbfe732e0d6134b744516eea"}, - {file = "aiohttp-3.12.15-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b2acbbfff69019d9014508c4ba0401822e8bae5a5fdc3b6814285b71231b60f3"}, - {file = "aiohttp-3.12.15-cp312-cp312-win32.whl", hash = "sha256:d849b0901b50f2185874b9a232f38e26b9b3d4810095a7572eacea939132d4e1"}, - {file = "aiohttp-3.12.15-cp312-cp312-win_amd64.whl", hash = "sha256:b390ef5f62bb508a9d67cb3bba9b8356e23b3996da7062f1a57ce1a79d2b3d34"}, - {file = "aiohttp-3.12.15-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:9f922ffd05034d439dde1c77a20461cf4a1b0831e6caa26151fe7aa8aaebc315"}, - {file = "aiohttp-3.12.15-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:2ee8a8ac39ce45f3e55663891d4b1d15598c157b4d494a4613e704c8b43112cd"}, - {file = "aiohttp-3.12.15-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3eae49032c29d356b94eee45a3f39fdf4b0814b397638c2f718e96cfadf4c4e4"}, - {file = "aiohttp-3.12.15-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b97752ff12cc12f46a9b20327104448042fce5c33a624f88c18f66f9368091c7"}, - {file = "aiohttp-3.12.15-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:894261472691d6fe76ebb7fcf2e5870a2ac284c7406ddc95823c8598a1390f0d"}, - {file = "aiohttp-3.12.15-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:5fa5d9eb82ce98959fc1031c28198b431b4d9396894f385cb63f1e2f3f20ca6b"}, - {file = "aiohttp-3.12.15-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f0fa751efb11a541f57db59c1dd821bec09031e01452b2b6217319b3a1f34f3d"}, - {file = "aiohttp-3.12.15-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5346b93e62ab51ee2a9d68e8f73c7cf96ffb73568a23e683f931e52450e4148d"}, - {file = "aiohttp-3.12.15-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:049ec0360f939cd164ecbfd2873eaa432613d5e77d6b04535e3d1fbae5a9e645"}, - {file = "aiohttp-3.12.15-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:b52dcf013b57464b6d1e51b627adfd69a8053e84b7103a7cd49c030f9ca44461"}, - {file = "aiohttp-3.12.15-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:9b2af240143dd2765e0fb661fd0361a1b469cab235039ea57663cda087250ea9"}, - {file = "aiohttp-3.12.15-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ac77f709a2cde2cc71257ab2d8c74dd157c67a0558a0d2799d5d571b4c63d44d"}, - {file = "aiohttp-3.12.15-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:47f6b962246f0a774fbd3b6b7be25d59b06fdb2f164cf2513097998fc6a29693"}, - {file = "aiohttp-3.12.15-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:760fb7db442f284996e39cf9915a94492e1896baac44f06ae551974907922b64"}, - {file = "aiohttp-3.12.15-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:ad702e57dc385cae679c39d318def49aef754455f237499d5b99bea4ef582e51"}, - {file = "aiohttp-3.12.15-cp313-cp313-win32.whl", hash = "sha256:f813c3e9032331024de2eb2e32a88d86afb69291fbc37a3a3ae81cc9917fb3d0"}, - {file = "aiohttp-3.12.15-cp313-cp313-win_amd64.whl", hash = "sha256:1a649001580bdb37c6fdb1bebbd7e3bc688e8ec2b5c6f52edbb664662b17dc84"}, - {file = "aiohttp-3.12.15-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:691d203c2bdf4f4637792efbbcdcd157ae11e55eaeb5e9c360c1206fb03d4d98"}, - {file = "aiohttp-3.12.15-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:8e995e1abc4ed2a454c731385bf4082be06f875822adc4c6d9eaadf96e20d406"}, - {file = "aiohttp-3.12.15-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:bd44d5936ab3193c617bfd6c9a7d8d1085a8dc8c3f44d5f1dcf554d17d04cf7d"}, - {file = "aiohttp-3.12.15-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:46749be6e89cd78d6068cdf7da51dbcfa4321147ab8e4116ee6678d9a056a0cf"}, - {file = "aiohttp-3.12.15-cp39-cp39-manylinux_2_17_armv7l.manylinux2014_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:0c643f4d75adea39e92c0f01b3fb83d57abdec8c9279b3078b68a3a52b3933b6"}, - {file = "aiohttp-3.12.15-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:0a23918fedc05806966a2438489dcffccbdf83e921a1170773b6178d04ade142"}, - {file = "aiohttp-3.12.15-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:74bdd8c864b36c3673741023343565d95bfbd778ffe1eb4d412c135a28a8dc89"}, - {file = "aiohttp-3.12.15-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0a146708808c9b7a988a4af3821379e379e0f0e5e466ca31a73dbdd0325b0263"}, - {file = "aiohttp-3.12.15-cp39-cp39-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b7011a70b56facde58d6d26da4fec3280cc8e2a78c714c96b7a01a87930a9530"}, - {file = "aiohttp-3.12.15-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:3bdd6e17e16e1dbd3db74d7f989e8af29c4d2e025f9828e6ef45fbdee158ec75"}, - {file = "aiohttp-3.12.15-cp39-cp39-musllinux_1_2_armv7l.whl", hash = "sha256:57d16590a351dfc914670bd72530fd78344b885a00b250e992faea565b7fdc05"}, - {file = "aiohttp-3.12.15-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:bc9a0f6569ff990e0bbd75506c8d8fe7214c8f6579cca32f0546e54372a3bb54"}, - {file = "aiohttp-3.12.15-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:536ad7234747a37e50e7b6794ea868833d5220b49c92806ae2d7e8a9d6b5de02"}, - {file = "aiohttp-3.12.15-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:f0adb4177fa748072546fb650d9bd7398caaf0e15b370ed3317280b13f4083b0"}, - {file = "aiohttp-3.12.15-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:14954a2988feae3987f1eb49c706bff39947605f4b6fa4027c1d75743723eb09"}, - {file = "aiohttp-3.12.15-cp39-cp39-win32.whl", hash = "sha256:b784d6ed757f27574dca1c336f968f4e81130b27595e458e69457e6878251f5d"}, - {file = "aiohttp-3.12.15-cp39-cp39-win_amd64.whl", hash = "sha256:86ceded4e78a992f835209e236617bffae649371c4a50d5e5a3987f237db84b8"}, - {file = "aiohttp-3.12.15.tar.gz", hash = "sha256:4fc61385e9c98d72fcdf47e6dd81833f47b2f77c114c29cd64a361be57a763a2"}, + {file = "aiohttp-3.13.3-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:d5a372fd5afd301b3a89582817fdcdb6c34124787c70dbcc616f259013e7eef7"}, + {file = "aiohttp-3.13.3-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:147e422fd1223005c22b4fe080f5d93ced44460f5f9c105406b753612b587821"}, + {file = "aiohttp-3.13.3-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:859bd3f2156e81dd01432f5849fc73e2243d4a487c4fd26609b1299534ee1845"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:dca68018bf48c251ba17c72ed479f4dafe9dbd5a73707ad8d28a38d11f3d42af"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fee0c6bc7db1de362252affec009707a17478a00ec69f797d23ca256e36d5940"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c048058117fd649334d81b4b526e94bde3ccaddb20463a815ced6ecbb7d11160"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:215a685b6fbbfcf71dfe96e3eba7a6f58f10da1dfdf4889c7dd856abe430dca7"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:de2c184bb1fe2cbd2cefba613e9db29a5ab559323f994b6737e370d3da0ac455"}, + {file = "aiohttp-3.13.3-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:75ca857eba4e20ce9f546cd59c7007b33906a4cd48f2ff6ccf1ccfc3b646f279"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:81e97251d9298386c2b7dbeb490d3d1badbdc69107fb8c9299dd04eb39bddc0e"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:c0e2d366af265797506f0283487223146af57815b388623f0357ef7eac9b209d"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:4e239d501f73d6db1522599e14b9b321a7e3b1de66ce33d53a765d975e9f4808"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:0db318f7a6f065d84cb1e02662c526294450b314a02bd9e2a8e67f0d8564ce40"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:bfc1cc2fe31a6026a8a88e4ecfb98d7f6b1fec150cfd708adbfd1d2f42257c29"}, + {file = "aiohttp-3.13.3-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:af71fff7bac6bb7508956696dce8f6eec2bbb045eceb40343944b1ae62b5ef11"}, + {file = "aiohttp-3.13.3-cp310-cp310-win32.whl", hash = "sha256:37da61e244d1749798c151421602884db5270faf479cf0ef03af0ff68954c9dd"}, + {file = "aiohttp-3.13.3-cp310-cp310-win_amd64.whl", hash = "sha256:7e63f210bc1b57ef699035f2b4b6d9ce096b5914414a49b0997c839b2bd2223c"}, + {file = "aiohttp-3.13.3-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:5b6073099fb654e0a068ae678b10feff95c5cae95bbfcbfa7af669d361a8aa6b"}, + {file = "aiohttp-3.13.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1cb93e166e6c28716c8c6aeb5f99dfb6d5ccf482d29fe9bf9a794110e6d0ab64"}, + {file = "aiohttp-3.13.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:28e027cf2f6b641693a09f631759b4d9ce9165099d2b5d92af9bd4e197690eea"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3b61b7169ababd7802f9568ed96142616a9118dd2be0d1866e920e77ec8fa92a"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:80dd4c21b0f6237676449c6baaa1039abae86b91636b6c91a7f8e61c87f89540"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:65d2ccb7eabee90ce0503c17716fc77226be026dcc3e65cce859a30db715025b"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5b179331a481cb5529fca8b432d8d3c7001cb217513c94cd72d668d1248688a3"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d4c940f02f49483b18b079d1c27ab948721852b281f8b015c058100e9421dd1"}, + {file = "aiohttp-3.13.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f9444f105664c4ce47a2a7171a2418bce5b7bae45fb610f4e2c36045d85911d3"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:694976222c711d1d00ba131904beb60534f93966562f64440d0c9d41b8cdb440"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:f33ed1a2bf1997a36661874b017f5c4b760f41266341af36febaf271d179f6d7"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:e636b3c5f61da31a92bf0d91da83e58fdfa96f178ba682f11d24f31944cdd28c"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:5d2d94f1f5fcbe40838ac51a6ab5704a6f9ea42e72ceda48de5e6b898521da51"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:2be0e9ccf23e8a94f6f0650ce06042cefc6ac703d0d7ab6c7a917289f2539ad4"}, + {file = "aiohttp-3.13.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9af5e68ee47d6534d36791bbe9b646d2a7c7deb6fc24d7943628edfbb3581f29"}, + {file = "aiohttp-3.13.3-cp311-cp311-win32.whl", hash = "sha256:a2212ad43c0833a873d0fb3c63fa1bacedd4cf6af2fee62bf4b739ceec3ab239"}, + {file = "aiohttp-3.13.3-cp311-cp311-win_amd64.whl", hash = "sha256:642f752c3eb117b105acbd87e2c143de710987e09860d674e068c4c2c441034f"}, + {file = "aiohttp-3.13.3-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:b903a4dfee7d347e2d87697d0713be59e0b87925be030c9178c5faa58ea58d5c"}, + {file = "aiohttp-3.13.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:a45530014d7a1e09f4a55f4f43097ba0fd155089372e105e4bff4ca76cb1b168"}, + {file = "aiohttp-3.13.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:27234ef6d85c914f9efeb77ff616dbf4ad2380be0cda40b4db086ffc7ddd1b7d"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d32764c6c9aafb7fb55366a224756387cd50bfa720f32b88e0e6fa45b27dcf29"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b1a6102b4d3ebc07dad44fbf07b45bb600300f15b552ddf1851b5390202ea2e3"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c014c7ea7fb775dd015b2d3137378b7be0249a448a1612268b5a90c2d81de04d"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2b8d8ddba8f95ba17582226f80e2de99c7a7948e66490ef8d947e272a93e9463"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9ae8dd55c8e6c4257eae3a20fd2c8f41edaea5992ed67156642493b8daf3cecc"}, + {file = "aiohttp-3.13.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:01ad2529d4b5035578f5081606a465f3b814c542882804e2e8cda61adf5c71bf"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:bb4f7475e359992b580559e008c598091c45b5088f28614e855e42d39c2f1033"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:c19b90316ad3b24c69cd78d5c9b4f3aa4497643685901185b65166293d36a00f"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:96d604498a7c782cb15a51c406acaea70d8c027ee6b90c569baa6e7b93073679"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:084911a532763e9d3dd95adf78a78f4096cd5f58cdc18e6fdbc1b58417a45423"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:7a4a94eb787e606d0a09404b9c38c113d3b099d508021faa615d70a0131907ce"}, + {file = "aiohttp-3.13.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:87797e645d9d8e222e04160ee32aa06bc5c163e8499f24db719e7852ec23093a"}, + {file = "aiohttp-3.13.3-cp312-cp312-win32.whl", hash = "sha256:b04be762396457bef43f3597c991e192ee7da460a4953d7e647ee4b1c28e7046"}, + {file = "aiohttp-3.13.3-cp312-cp312-win_amd64.whl", hash = "sha256:e3531d63d3bdfa7e3ac5e9b27b2dd7ec9df3206a98e0b3445fa906f233264c57"}, + {file = "aiohttp-3.13.3-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:5dff64413671b0d3e7d5918ea490bdccb97a4ad29b3f311ed423200b2203e01c"}, + {file = "aiohttp-3.13.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:87b9aab6d6ed88235aa2970294f496ff1a1f9adcd724d800e9b952395a80ffd9"}, + {file = "aiohttp-3.13.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:425c126c0dc43861e22cb1c14ba4c8e45d09516d0a3ae0a3f7494b79f5f233a3"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7f9120f7093c2a32d9647abcaf21e6ad275b4fbec5b55969f978b1a97c7c86bf"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:697753042d57f4bf7122cab985bf15d0cef23c770864580f5af4f52023a56bd6"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6de499a1a44e7de70735d0b39f67c8f25eb3d91eb3103be99ca0fa882cdd987d"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:37239e9f9a7ea9ac5bf6b92b0260b01f8a22281996da609206a84df860bc1261"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f76c1e3fe7d7c8afad7ed193f89a292e1999608170dcc9751a7462a87dfd5bc0"}, + {file = "aiohttp-3.13.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fc290605db2a917f6e81b0e1e0796469871f5af381ce15c604a3c5c7e51cb730"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:4021b51936308aeea0367b8f006dc999ca02bc118a0cc78c303f50a2ff6afb91"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:49a03727c1bba9a97d3e93c9f93ca03a57300f484b6e935463099841261195d3"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:3d9908a48eb7416dc1f4524e69f1d32e5d90e3981e4e37eb0aa1cd18f9cfa2a4"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:2712039939ec963c237286113c68dbad80a82a4281543f3abf766d9d73228998"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:7bfdc049127717581866fa4708791220970ce291c23e28ccf3922c700740fdc0"}, + {file = "aiohttp-3.13.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8057c98e0c8472d8846b9c79f56766bcc57e3e8ac7bfd510482332366c56c591"}, + {file = "aiohttp-3.13.3-cp313-cp313-win32.whl", hash = "sha256:1449ceddcdbcf2e0446957863af03ebaaa03f94c090f945411b61269e2cb5daf"}, + {file = "aiohttp-3.13.3-cp313-cp313-win_amd64.whl", hash = "sha256:693781c45a4033d31d4187d2436f5ac701e7bbfe5df40d917736108c1cc7436e"}, + {file = "aiohttp-3.13.3-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:ea37047c6b367fd4bd632bff8077449b8fa034b69e812a18e0132a00fae6e808"}, + {file = "aiohttp-3.13.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:6fc0e2337d1a4c3e6acafda6a78a39d4c14caea625124817420abceed36e2415"}, + {file = "aiohttp-3.13.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c685f2d80bb67ca8c3837823ad76196b3694b0159d232206d1e461d3d434666f"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:48e377758516d262bde50c2584fc6c578af272559c409eecbdd2bae1601184d6"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:34749271508078b261c4abb1767d42b8d0c0cc9449c73a4df494777dc55f0687"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:82611aeec80eb144416956ec85b6ca45a64d76429c1ed46ae1b5f86c6e0c9a26"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2fff83cfc93f18f215896e3a190e8e5cb413ce01553901aca925176e7568963a"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bbe7d4cecacb439e2e2a8a1a7b935c25b812af7a5fd26503a66dadf428e79ec1"}, + {file = "aiohttp-3.13.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b928f30fe49574253644b1ca44b1b8adbd903aa0da4b9054a6c20fc7f4092a25"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7b5e8fe4de30df199155baaf64f2fcd604f4c678ed20910db8e2c66dc4b11603"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:8542f41a62bcc58fc7f11cf7c90e0ec324ce44950003feb70640fc2a9092c32a"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:5e1d8c8b8f1d91cd08d8f4a3c2b067bfca6ec043d3ff36de0f3a715feeedf926"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:90455115e5da1c3c51ab619ac57f877da8fd6d73c05aacd125c5ae9819582aba"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:042e9e0bcb5fba81886c8b4fbb9a09d6b8a00245fd8d88e4d989c1f96c74164c"}, + {file = "aiohttp-3.13.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:2eb752b102b12a76ca02dff751a801f028b4ffbbc478840b473597fc91a9ed43"}, + {file = "aiohttp-3.13.3-cp314-cp314-win32.whl", hash = "sha256:b556c85915d8efaed322bf1bdae9486aa0f3f764195a0fb6ee962e5c71ef5ce1"}, + {file = "aiohttp-3.13.3-cp314-cp314-win_amd64.whl", hash = "sha256:9bf9f7a65e7aa20dd764151fb3d616c81088f91f8df39c3893a536e279b4b984"}, + {file = "aiohttp-3.13.3-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:05861afbbec40650d8a07ea324367cb93e9e8cc7762e04dd4405df99fa65159c"}, + {file = "aiohttp-3.13.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:2fc82186fadc4a8316768d61f3722c230e2c1dcab4200d52d2ebdf2482e47592"}, + {file = "aiohttp-3.13.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:0add0900ff220d1d5c5ebbf99ed88b0c1bbf87aa7e4262300ed1376a6b13414f"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:568f416a4072fbfae453dcf9a99194bbb8bdeab718e08ee13dfa2ba0e4bebf29"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:add1da70de90a2569c5e15249ff76a631ccacfe198375eead4aadf3b8dc849dc"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:10b47b7ba335d2e9b1239fa571131a87e2d8ec96b333e68b2a305e7a98b0bae2"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3dd4dce1c718e38081c8f35f323209d4c1df7d4db4bab1b5c88a6b4d12b74587"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:34bac00a67a812570d4a460447e1e9e06fae622946955f939051e7cc895cfab8"}, + {file = "aiohttp-3.13.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a19884d2ee70b06d9204b2727a7b9f983d0c684c650254679e716b0b77920632"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:5f8ca7f2bb6ba8348a3614c7918cc4bb73268c5ac2a207576b7afea19d3d9f64"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:b0d95340658b9d2f11d9697f59b3814a9d3bb4b7a7c20b131df4bcef464037c0"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:a1e53262fd202e4b40b70c3aff944a8155059beedc8a89bba9dc1f9ef06a1b56"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:d60ac9663f44168038586cab2157e122e46bdef09e9368b37f2d82d354c23f72"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:90751b8eed69435bac9ff4e3d2f6b3af1f57e37ecb0fbeee59c0174c9e2d41df"}, + {file = "aiohttp-3.13.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:fc353029f176fd2b3ec6cfc71be166aba1936fe5d73dd1992ce289ca6647a9aa"}, + {file = "aiohttp-3.13.3-cp314-cp314t-win32.whl", hash = "sha256:2e41b18a58da1e474a057b3d35248d8320029f61d70a37629535b16a0c8f3767"}, + {file = "aiohttp-3.13.3-cp314-cp314t-win_amd64.whl", hash = "sha256:44531a36aa2264a1860089ffd4dce7baf875ee5a6079d5fb42e261c704ef7344"}, + {file = "aiohttp-3.13.3-cp39-cp39-macosx_10_9_universal2.whl", hash = "sha256:31a83ea4aead760dfcb6962efb1d861db48c34379f2ff72db9ddddd4cda9ea2e"}, + {file = "aiohttp-3.13.3-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:988a8c5e317544fdf0d39871559e67b6341065b87fceac641108c2096d5506b7"}, + {file = "aiohttp-3.13.3-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:9b174f267b5cfb9a7dba9ee6859cecd234e9a681841eb85068059bc867fb8f02"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:947c26539750deeaee933b000fb6517cc770bbd064bad6033f1cff4803881e43"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:9ebf57d09e131f5323464bd347135a88622d1c0976e88ce15b670e7ad57e4bd6"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4ae5b5a0e1926e504c81c5b84353e7a5516d8778fbbff00429fe7b05bb25cbce"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2ba0eea45eb5cc3172dbfc497c066f19c41bac70963ea1a67d51fc92e4cf9a80"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bae5c2ed2eae26cc382020edad80d01f36cb8e746da40b292e68fec40421dc6a"}, + {file = "aiohttp-3.13.3-cp39-cp39-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8a60e60746623925eab7d25823329941aee7242d559baa119ca2b253c88a7bd6"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:e50a2e1404f063427c9d027378472316201a2290959a295169bcf25992d04558"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_armv7l.whl", hash = "sha256:9a9dc347e5a3dc7dfdbc1f82da0ef29e388ddb2ed281bfce9dd8248a313e62b7"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_ppc64le.whl", hash = "sha256:b46020d11d23fe16551466c77823df9cc2f2c1e63cc965daf67fa5eec6ca1877"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_riscv64.whl", hash = "sha256:69c56fbc1993fa17043e24a546959c0178fe2b5782405ad4559e6c13975c15e3"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_s390x.whl", hash = "sha256:b99281b0704c103d4e11e72a76f1b543d4946fea7dd10767e7e1b5f00d4e5704"}, + {file = "aiohttp-3.13.3-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:40c5e40ecc29ba010656c18052b877a1c28f84344825efa106705e835c28530f"}, + {file = "aiohttp-3.13.3-cp39-cp39-win32.whl", hash = "sha256:56339a36b9f1fc708260c76c87e593e2afb30d26de9ae1eb445b5e051b98a7a1"}, + {file = "aiohttp-3.13.3-cp39-cp39-win_amd64.whl", hash = "sha256:c6b8568a3bb5819a0ad087f16d40e5a3fb6099f39ea1d5625a3edc1e923fc538"}, + {file = "aiohttp-3.13.3.tar.gz", hash = "sha256:a949eee43d3782f2daae4f4a2819b2cb9b0c5d3b7f7a927067cc84dafdbb9f88"}, ] [package.dependencies] @@ -142,7 +176,7 @@ propcache = ">=0.2.0" yarl = ">=1.17.0,<2.0" [package.extras] -speedups = ["Brotli ; platform_python_implementation == \"CPython\"", "aiodns (>=3.3.0)", "brotlicffi ; platform_python_implementation != \"CPython\""] +speedups = ["Brotli (>=1.2) ; platform_python_implementation == \"CPython\"", "aiodns (>=3.3.0)", "backports.zstd ; platform_python_implementation == \"CPython\" and python_version < \"3.14\"", "brotlicffi (>=1.2) ; platform_python_implementation != \"CPython\""] [[package]] name = "aiosignal" From 3d16c62f30da3e1a0e41990c07f271d951612190 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 15:04:53 +0100 Subject: [PATCH 021/337] build(deps): bump fastmcp from 2.13.1 to 2.14.0 in /mcp_server (#9696) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- mcp_server/pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mcp_server/pyproject.toml b/mcp_server/pyproject.toml index cd6e674e1b..0db6ef67f7 100644 --- a/mcp_server/pyproject.toml +++ b/mcp_server/pyproject.toml @@ -4,7 +4,7 @@ requires = ["setuptools>=61.0", "wheel"] [project] dependencies = [ - "fastmcp==2.13.1", + "fastmcp==2.14.0", "httpx>=0.28.0" ] description = "MCP server for Prowler ecosystem" From a0f9df07bd7312c0a963f98c2138ce5a59039389 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 15:40:55 +0100 Subject: [PATCH 022/337] build(deps): bump pynacl from 1.5.0 to 1.6.2 (#9726) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pepe Fagoaga --- poetry.lock | 206 ++++++++++++++++++++++++++++++---------------------- 1 file changed, 119 insertions(+), 87 deletions(-) diff --git a/poetry.lock b/poetry.lock index 18bb12f01c..f00add7a56 100644 --- a/poetry.lock +++ b/poetry.lock @@ -1579,84 +1579,101 @@ files = [ [[package]] name = "cffi" -version = "1.17.1" +version = "2.0.0" description = "Foreign Function Interface for Python calling C code." optional = false -python-versions = ">=3.8" +python-versions = ">=3.9" groups = ["main", "dev"] +markers = "platform_python_implementation != \"PyPy\"" files = [ - {file = "cffi-1.17.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:df8b1c11f177bc2313ec4b2d46baec87a5f3e71fc8b45dab2ee7cae86d9aba14"}, - {file = "cffi-1.17.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f2cdc858323644ab277e9bb925ad72ae0e67f69e804f4898c070998d50b1a67"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:edae79245293e15384b51f88b00613ba9f7198016a5948b5dddf4917d4d26382"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:45398b671ac6d70e67da8e4224a065cec6a93541bb7aebe1b198a61b58c7b702"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:ad9413ccdeda48c5afdae7e4fa2192157e991ff761e7ab8fdd8926f40b160cc3"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:5da5719280082ac6bd9aa7becb3938dc9f9cbd57fac7d2871717b1feb0902ab6"}, - {file = "cffi-1.17.1-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:2bb1a08b8008b281856e5971307cc386a8e9c5b625ac297e853d36da6efe9c17"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_aarch64.whl", hash = "sha256:045d61c734659cc045141be4bae381a41d89b741f795af1dd018bfb532fd0df8"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_i686.whl", hash = "sha256:6883e737d7d9e4899a8a695e00ec36bd4e5e4f18fabe0aca0efe0a4b44cdb13e"}, - {file = "cffi-1.17.1-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:6b8b4a92e1c65048ff98cfe1f735ef8f1ceb72e3d5f0c25fdb12087a23da22be"}, - {file = "cffi-1.17.1-cp310-cp310-win32.whl", hash = "sha256:c9c3d058ebabb74db66e431095118094d06abf53284d9c81f27300d0e0d8bc7c"}, - {file = "cffi-1.17.1-cp310-cp310-win_amd64.whl", hash = "sha256:0f048dcf80db46f0098ccac01132761580d28e28bc0f78ae0d58048063317e15"}, - {file = "cffi-1.17.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a45e3c6913c5b87b3ff120dcdc03f6131fa0065027d0ed7ee6190736a74cd401"}, - {file = "cffi-1.17.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:30c5e0cb5ae493c04c8b42916e52ca38079f1b235c2f8ae5f4527b963c401caf"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f75c7ab1f9e4aca5414ed4d8e5c0e303a34f4421f8a0d47a4d019ceff0ab6af4"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1ed2dd2972641495a3ec98445e09766f077aee98a1c896dcb4ad0d303628e41"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:46bf43160c1a35f7ec506d254e5c890f3c03648a4dbac12d624e4490a7046cd1"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a24ed04c8ffd54b0729c07cee15a81d964e6fee0e3d4d342a27b020d22959dc6"}, - {file = "cffi-1.17.1-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:610faea79c43e44c71e1ec53a554553fa22321b65fae24889706c0a84d4ad86d"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_aarch64.whl", hash = "sha256:a9b15d491f3ad5d692e11f6b71f7857e7835eb677955c00cc0aefcd0669adaf6"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_i686.whl", hash = "sha256:de2ea4b5833625383e464549fec1bc395c1bdeeb5f25c4a3a82b5a8c756ec22f"}, - {file = "cffi-1.17.1-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:fc48c783f9c87e60831201f2cce7f3b2e4846bf4d8728eabe54d60700b318a0b"}, - {file = "cffi-1.17.1-cp311-cp311-win32.whl", hash = "sha256:85a950a4ac9c359340d5963966e3e0a94a676bd6245a4b55bc43949eee26a655"}, - {file = "cffi-1.17.1-cp311-cp311-win_amd64.whl", hash = "sha256:caaf0640ef5f5517f49bc275eca1406b0ffa6aa184892812030f04c2abf589a0"}, - {file = "cffi-1.17.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:805b4371bf7197c329fcb3ead37e710d1bca9da5d583f5073b799d5c5bd1eee4"}, - {file = "cffi-1.17.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:733e99bc2df47476e3848417c5a4540522f234dfd4ef3ab7fafdf555b082ec0c"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1257bdabf294dceb59f5e70c64a3e2f462c30c7ad68092d01bbbfb1c16b1ba36"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:da95af8214998d77a98cc14e3a3bd00aa191526343078b530ceb0bd710fb48a5"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:d63afe322132c194cf832bfec0dc69a99fb9bb6bbd550f161a49e9e855cc78ff"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:f79fc4fc25f1c8698ff97788206bb3c2598949bfe0fef03d299eb1b5356ada99"}, - {file = "cffi-1.17.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b62ce867176a75d03a665bad002af8e6d54644fad99a3c70905c543130e39d93"}, - {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_aarch64.whl", hash = "sha256:386c8bf53c502fff58903061338ce4f4950cbdcb23e2902d86c0f722b786bbe3"}, - {file = "cffi-1.17.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:4ceb10419a9adf4460ea14cfd6bc43d08701f0835e979bf821052f1805850fe8"}, - {file = "cffi-1.17.1-cp312-cp312-win32.whl", hash = "sha256:a08d7e755f8ed21095a310a693525137cfe756ce62d066e53f502a83dc550f65"}, - {file = "cffi-1.17.1-cp312-cp312-win_amd64.whl", hash = "sha256:51392eae71afec0d0c8fb1a53b204dbb3bcabcb3c9b807eedf3e1e6ccf2de903"}, - {file = "cffi-1.17.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f3a2b4222ce6b60e2e8b337bb9596923045681d71e5a082783484d845390938e"}, - {file = "cffi-1.17.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:0984a4925a435b1da406122d4d7968dd861c1385afe3b45ba82b750f229811e2"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:d01b12eeeb4427d3110de311e1774046ad344f5b1a7403101878976ecd7a10f3"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:706510fe141c86a69c8ddc029c7910003a17353970cff3b904ff0686a5927683"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:de55b766c7aa2e2a3092c51e0483d700341182f08e67c63630d5b6f200bb28e5"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c59d6e989d07460165cc5ad3c61f9fd8f1b4796eacbd81cee78957842b834af4"}, - {file = "cffi-1.17.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:dd398dbc6773384a17fe0d3e7eeb8d1a21c2200473ee6806bb5e6a8e62bb73dd"}, - {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:3edc8d958eb099c634dace3c7e16560ae474aa3803a5df240542b305d14e14ed"}, - {file = "cffi-1.17.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:72e72408cad3d5419375fc87d289076ee319835bdfa2caad331e377589aebba9"}, - {file = "cffi-1.17.1-cp313-cp313-win32.whl", hash = "sha256:e03eab0a8677fa80d646b5ddece1cbeaf556c313dcfac435ba11f107ba117b5d"}, - {file = "cffi-1.17.1-cp313-cp313-win_amd64.whl", hash = "sha256:f6a16c31041f09ead72d69f583767292f750d24913dadacf5756b966aacb3f1a"}, - {file = "cffi-1.17.1-cp38-cp38-macosx_10_9_x86_64.whl", hash = "sha256:636062ea65bd0195bc012fea9321aca499c0504409f413dc88af450b57ffd03b"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7eac2ef9b63c79431bc4b25f1cd649d7f061a28808cbc6c47b534bd789ef964"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e221cf152cff04059d011ee126477f0d9588303eb57e88923578ace7baad17f9"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:31000ec67d4221a71bd3f67df918b1f88f676f1c3b535a7eb473255fdc0b83fc"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:6f17be4345073b0a7b8ea599688f692ac3ef23ce28e5df79c04de519dbc4912c"}, - {file = "cffi-1.17.1-cp38-cp38-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0e2b1fac190ae3ebfe37b979cc1ce69c81f4e4fe5746bb401dca63a9062cdaf1"}, - {file = "cffi-1.17.1-cp38-cp38-win32.whl", hash = "sha256:7596d6620d3fa590f677e9ee430df2958d2d6d6de2feeae5b20e82c00b76fbf8"}, - {file = "cffi-1.17.1-cp38-cp38-win_amd64.whl", hash = "sha256:78122be759c3f8a014ce010908ae03364d00a1f81ab5c7f4a7a5120607ea56e1"}, - {file = "cffi-1.17.1-cp39-cp39-macosx_10_9_x86_64.whl", hash = "sha256:b2ab587605f4ba0bf81dc0cb08a41bd1c0a5906bd59243d56bad7668a6fc6c16"}, - {file = "cffi-1.17.1-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:28b16024becceed8c6dfbc75629e27788d8a3f9030691a1dbf9821a128b22c36"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:1d599671f396c4723d016dbddb72fe8e0397082b0a77a4fab8028923bec050e8"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ca74b8dbe6e8e8263c0ffd60277de77dcee6c837a3d0881d8c1ead7268c9e576"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:f7f5baafcc48261359e14bcd6d9bff6d4b28d9103847c9e136694cb0501aef87"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:98e3969bcff97cae1b2def8ba499ea3d6f31ddfdb7635374834cf89a1a08ecf0"}, - {file = "cffi-1.17.1-cp39-cp39-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:cdf5ce3acdfd1661132f2a9c19cac174758dc2352bfe37d98aa7512c6b7178b3"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_aarch64.whl", hash = "sha256:9755e4345d1ec879e3849e62222a18c7174d65a6a92d5b346b1863912168b595"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_i686.whl", hash = "sha256:f1e22e8c4419538cb197e4dd60acc919d7696e5ef98ee4da4e01d3f8cfa4cc5a"}, - {file = "cffi-1.17.1-cp39-cp39-musllinux_1_1_x86_64.whl", hash = "sha256:c03e868a0b3bc35839ba98e74211ed2b05d2119be4e8a0f224fba9384f1fe02e"}, - {file = "cffi-1.17.1-cp39-cp39-win32.whl", hash = "sha256:e31ae45bc2e29f6b2abd0de1cc3b9d5205aa847cafaecb8af1476a609a2f6eb7"}, - {file = "cffi-1.17.1-cp39-cp39-win_amd64.whl", hash = "sha256:d016c76bdd850f3c626af19b0542c9677ba156e4ee4fccfdd7848803533ef662"}, - {file = "cffi-1.17.1.tar.gz", hash = "sha256:1c39c6016c32bc48dd54561950ebd6836e1670f2ae46128f67cf49e789c52824"}, + {file = "cffi-2.0.0-cp310-cp310-macosx_10_13_x86_64.whl", hash = "sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44"}, + {file = "cffi-2.0.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4"}, + {file = "cffi-2.0.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453"}, + {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495"}, + {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_i686.whl", hash = "sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5"}, + {file = "cffi-2.0.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb"}, + {file = "cffi-2.0.0-cp310-cp310-win32.whl", hash = "sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a"}, + {file = "cffi-2.0.0-cp310-cp310-win_amd64.whl", hash = "sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739"}, + {file = "cffi-2.0.0-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe"}, + {file = "cffi-2.0.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664"}, + {file = "cffi-2.0.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26"}, + {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9"}, + {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414"}, + {file = "cffi-2.0.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743"}, + {file = "cffi-2.0.0-cp311-cp311-win32.whl", hash = "sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5"}, + {file = "cffi-2.0.0-cp311-cp311-win_amd64.whl", hash = "sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5"}, + {file = "cffi-2.0.0-cp311-cp311-win_arm64.whl", hash = "sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d"}, + {file = "cffi-2.0.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d"}, + {file = "cffi-2.0.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037"}, + {file = "cffi-2.0.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba"}, + {file = "cffi-2.0.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94"}, + {file = "cffi-2.0.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187"}, + {file = "cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18"}, + {file = "cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5"}, + {file = "cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6"}, + {file = "cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb"}, + {file = "cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3"}, + {file = "cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26"}, + {file = "cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c"}, + {file = "cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b"}, + {file = "cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27"}, + {file = "cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75"}, + {file = "cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91"}, + {file = "cffi-2.0.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5"}, + {file = "cffi-2.0.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13"}, + {file = "cffi-2.0.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b"}, + {file = "cffi-2.0.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c"}, + {file = "cffi-2.0.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef"}, + {file = "cffi-2.0.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775"}, + {file = "cffi-2.0.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205"}, + {file = "cffi-2.0.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1"}, + {file = "cffi-2.0.0-cp314-cp314-win32.whl", hash = "sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f"}, + {file = "cffi-2.0.0-cp314-cp314-win_amd64.whl", hash = "sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25"}, + {file = "cffi-2.0.0-cp314-cp314-win_arm64.whl", hash = "sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad"}, + {file = "cffi-2.0.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9"}, + {file = "cffi-2.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d"}, + {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c"}, + {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8"}, + {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc"}, + {file = "cffi-2.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592"}, + {file = "cffi-2.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512"}, + {file = "cffi-2.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4"}, + {file = "cffi-2.0.0-cp314-cp314t-win32.whl", hash = "sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e"}, + {file = "cffi-2.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6"}, + {file = "cffi-2.0.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9"}, + {file = "cffi-2.0.0-cp39-cp39-macosx_10_13_x86_64.whl", hash = "sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf"}, + {file = "cffi-2.0.0-cp39-cp39-macosx_11_0_arm64.whl", hash = "sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f"}, + {file = "cffi-2.0.0-cp39-cp39-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63"}, + {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_aarch64.whl", hash = "sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2"}, + {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_i686.whl", hash = "sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65"}, + {file = "cffi-2.0.0-cp39-cp39-musllinux_1_2_x86_64.whl", hash = "sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322"}, + {file = "cffi-2.0.0-cp39-cp39-win32.whl", hash = "sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a"}, + {file = "cffi-2.0.0-cp39-cp39-win_amd64.whl", hash = "sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9"}, + {file = "cffi-2.0.0.tar.gz", hash = "sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529"}, ] -markers = {dev = "platform_python_implementation != \"PyPy\""} [package.dependencies] -pycparser = "*" +pycparser = {version = "*", markers = "implementation_name != \"PyPy\""} [[package]] name = "cfgv" @@ -4563,11 +4580,11 @@ description = "C parser in Python" optional = false python-versions = ">=3.8" groups = ["main", "dev"] +markers = "platform_python_implementation != \"PyPy\" and implementation_name != \"PyPy\"" files = [ {file = "pycparser-2.22-py3-none-any.whl", hash = "sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc"}, {file = "pycparser-2.22.tar.gz", hash = "sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6"}, ] -markers = {dev = "platform_python_implementation != \"PyPy\""} [[package]] name = "pydantic" @@ -4804,30 +4821,45 @@ testutils = ["gitpython (>3)"] [[package]] name = "pynacl" -version = "1.5.0" +version = "1.6.2" description = "Python binding to the Networking and Cryptography (NaCl) library" optional = false -python-versions = ">=3.6" +python-versions = ">=3.8" groups = ["main"] files = [ - {file = "PyNaCl-1.5.0-cp36-abi3-macosx_10_10_universal2.whl", hash = "sha256:401002a4aaa07c9414132aaed7f6836ff98f59277a234704ff66878c2ee4a0d1"}, - {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:52cb72a79269189d4e0dc537556f4740f7f0a9ec41c1322598799b0bdad4ef92"}, - {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a36d4a9dda1f19ce6e03c9a784a2921a4b726b02e1c736600ca9c22029474394"}, - {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:0c84947a22519e013607c9be43706dd42513f9e6ae5d39d3613ca1e142fba44d"}, - {file = "PyNaCl-1.5.0-cp36-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:06b8f6fa7f5de8d5d2f7573fe8c863c051225a27b61e6860fd047b1775807858"}, - {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_aarch64.whl", hash = "sha256:a422368fc821589c228f4c49438a368831cb5bbc0eab5ebe1d7fac9dded6567b"}, - {file = "PyNaCl-1.5.0-cp36-abi3-musllinux_1_1_x86_64.whl", hash = "sha256:61f642bf2378713e2c2e1de73444a3778e5f0a38be6fee0fe532fe30060282ff"}, - {file = "PyNaCl-1.5.0-cp36-abi3-win32.whl", hash = "sha256:e46dae94e34b085175f8abb3b0aaa7da40767865ac82c928eeb9e57e1ea8a543"}, - {file = "PyNaCl-1.5.0-cp36-abi3-win_amd64.whl", hash = "sha256:20f42270d27e1b6a29f54032090b972d97f0a1b0948cc52392041ef7831fee93"}, - {file = "PyNaCl-1.5.0.tar.gz", hash = "sha256:8ac7448f09ab85811607bdd21ec2464495ac8b7c66d146bf545b0f08fb9220ba"}, + {file = "pynacl-1.6.2-cp314-cp314t-macosx_10_10_universal2.whl", hash = "sha256:622d7b07cc5c02c666795792931b50c91f3ce3c2649762efb1ef0d5684c81594"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d071c6a9a4c94d79eb665db4ce5cedc537faf74f2355e4d502591d850d3913c0"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:fe9847ca47d287af41e82be1dd5e23023d3c31a951da134121ab02e42ac218c9"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:04316d1fc625d860b6c162fff704eb8426b1a8bcd3abacea11142cbd99a6b574"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:44081faff368d6c5553ccf55322ef2819abb40e25afaec7e740f159f74813634"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:a9f9932d8d2811ce1a8ffa79dcbdf3970e7355b5c8eb0c1a881a57e7f7d96e88"}, + {file = "pynacl-1.6.2-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:bc4a36b28dd72fb4845e5d8f9760610588a96d5a51f01d84d8c6ff9849968c14"}, + {file = "pynacl-1.6.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:3bffb6d0f6becacb6526f8f42adfb5efb26337056ee0831fb9a7044d1a964444"}, + {file = "pynacl-1.6.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:2fef529ef3ee487ad8113d287a593fa26f48ee3620d92ecc6f1d09ea38e0709b"}, + {file = "pynacl-1.6.2-cp314-cp314t-win32.whl", hash = "sha256:a84bf1c20339d06dc0c85d9aea9637a24f718f375d861b2668b2f9f96fa51145"}, + {file = "pynacl-1.6.2-cp314-cp314t-win_amd64.whl", hash = "sha256:320ef68a41c87547c91a8b58903c9caa641ab01e8512ce291085b5fe2fcb7590"}, + {file = "pynacl-1.6.2-cp314-cp314t-win_arm64.whl", hash = "sha256:d29bfe37e20e015a7d8b23cfc8bd6aa7909c92a1b8f41ee416bbb3e79ef182b2"}, + {file = "pynacl-1.6.2-cp38-abi3-macosx_10_10_universal2.whl", hash = "sha256:c949ea47e4206af7c8f604b8278093b674f7c79ed0d4719cc836902bf4517465"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8845c0631c0be43abdd865511c41eab235e0be69c81dc66a50911594198679b0"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:22de65bb9010a725b0dac248f353bb072969c94fa8d6b1f34b87d7953cf7bbe4"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_26_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:46065496ab748469cdd999246d17e301b2c24ae2fdf739132e580a0e94c94a87"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_26_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8a66d6fb6ae7661c58995f9c6435bda2b1e68b54b598a6a10247bfcdadac996c"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:26bfcd00dcf2cf160f122186af731ae30ab120c18e8375684ec2670dccd28130"}, + {file = "pynacl-1.6.2-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:c8a231e36ec2cab018c4ad4358c386e36eede0319a0c41fed24f840b1dac59f6"}, + {file = "pynacl-1.6.2-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:68be3a09455743ff9505491220b64440ced8973fe930f270c8e07ccfa25b1f9e"}, + {file = "pynacl-1.6.2-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:8b097553b380236d51ed11356c953bf8ce36a29a3e596e934ecabe76c985a577"}, + {file = "pynacl-1.6.2-cp38-abi3-win32.whl", hash = "sha256:5811c72b473b2f38f7e2a3dc4f8642e3a3e9b5e7317266e4ced1fba85cae41aa"}, + {file = "pynacl-1.6.2-cp38-abi3-win_amd64.whl", hash = "sha256:62985f233210dee6548c223301b6c25440852e13d59a8b81490203c3227c5ba0"}, + {file = "pynacl-1.6.2-cp38-abi3-win_arm64.whl", hash = "sha256:834a43af110f743a754448463e8fd61259cd4ab5bbedcf70f9dabad1d28a394c"}, + {file = "pynacl-1.6.2.tar.gz", hash = "sha256:018494d6d696ae03c7e656e5e74cdfd8ea1326962cc401bcf018f1ed8436811c"}, ] [package.dependencies] -cffi = ">=1.4.1" +cffi = {version = ">=2.0.0", markers = "platform_python_implementation != \"PyPy\" and python_version >= \"3.9\""} [package.extras] -docs = ["sphinx (>=1.6.5)", "sphinx-rtd-theme"] -tests = ["hypothesis (>=3.27.0)", "pytest (>=3.2.1,!=3.3.0)"] +docs = ["sphinx (<7)", "sphinx_rtd_theme"] +tests = ["hypothesis (>=3.27.0)", "pytest (>=7.4.0)", "pytest-cov (>=2.10.1)", "pytest-xdist (>=3.5.0)"] [[package]] name = "pyopenssl" From 64ab8e64b094e529e0a206ceede4cb223f179491 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 15:41:39 +0100 Subject: [PATCH 023/337] build(deps): bump urllib3 from 1.26.20 to 2.6.3 (#9734) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- poetry.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/poetry.lock b/poetry.lock index f00add7a56..208437c62f 100644 --- a/poetry.lock +++ b/poetry.lock @@ -6046,22 +6046,22 @@ socks = ["PySocks (>=1.5.6,!=1.5.7,<2.0)"] [[package]] name = "urllib3" -version = "2.5.0" +version = "2.6.3" description = "HTTP library with thread-safe connection pooling, file post, and more." optional = false python-versions = ">=3.9" groups = ["main", "dev"] markers = "python_version >= \"3.10\"" files = [ - {file = "urllib3-2.5.0-py3-none-any.whl", hash = "sha256:e6b01673c0fa6a13e374b50871808eb3bf7046c4b125b216f6bf1cc604cff0dc"}, - {file = "urllib3-2.5.0.tar.gz", hash = "sha256:3fc47733c7e419d4bc3f6b3dc2b4f890bb743906a30d56ba4a5bfa4bbff92760"}, + {file = "urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4"}, + {file = "urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed"}, ] [package.extras] -brotli = ["brotli (>=1.0.9) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=0.8.0) ; platform_python_implementation != \"CPython\""] +brotli = ["brotli (>=1.2.0) ; platform_python_implementation == \"CPython\"", "brotlicffi (>=1.2.0.0) ; platform_python_implementation != \"CPython\""] h2 = ["h2 (>=4,<5)"] socks = ["pysocks (>=1.5.6,!=1.5.7,<2.0)"] -zstd = ["zstandard (>=0.18.0)"] +zstd = ["backports-zstd (>=1.0.0) ; python_version < \"3.14\""] [[package]] name = "virtualenv" From 795220e290de11d57d96b8d5cfd0502eb9042efb Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 8 Jan 2026 15:41:48 +0100 Subject: [PATCH 024/337] build(deps): bump werkzeug from 3.1.3 to 3.1.4 (#9399) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pepe Fagoaga --- poetry.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/poetry.lock b/poetry.lock index 208437c62f..f7243ed271 100644 --- a/poetry.lock +++ b/poetry.lock @@ -6118,18 +6118,18 @@ test = ["websockets"] [[package]] name = "werkzeug" -version = "3.1.3" +version = "3.1.4" description = "The comprehensive WSGI web application library." optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ - {file = "werkzeug-3.1.3-py3-none-any.whl", hash = "sha256:54b78bf3716d19a65be4fceccc0d1d7b89e608834989dfae50ea87564639213e"}, - {file = "werkzeug-3.1.3.tar.gz", hash = "sha256:60723ce945c19328679790e3282cc758aa4a6040e4bb330f53d30fa546d44746"}, + {file = "werkzeug-3.1.4-py3-none-any.whl", hash = "sha256:2ad50fb9ed09cc3af22c54698351027ace879a0b60a3b5edf5730b2f7d876905"}, + {file = "werkzeug-3.1.4.tar.gz", hash = "sha256:cd3cd98b1b92dc3b7b3995038826c68097dcb16f9baa63abe35f20eafeb9fe5e"}, ] [package.dependencies] -MarkupSafe = ">=2.1.1" +markupsafe = ">=2.1.1" [package.extras] watchdog = ["watchdog (>=2.3)"] From 27492cbd42e019cfce2c75a9125b327dfb1e0f76 Mon Sep 17 00:00:00 2001 From: Andoni Alonso <14891798+andoniaf@users.noreply.github.com> Date: Thu, 8 Jan 2026 15:47:26 +0100 Subject: [PATCH 025/337] fix(oci): validate credentials before scanning (#9738) --- .../providers/oci/authentication.mdx | 4 +- .../providers/oci/getting-started-oci.mdx | 2 +- prowler/CHANGELOG.md | 7 + .../oraclecloud/oraclecloud_provider.py | 161 +++++++------- .../oraclecloud/oraclecloud_provider_test.py | 201 ++++++++++++++++++ 5 files changed, 292 insertions(+), 83 deletions(-) create mode 100644 tests/providers/oraclecloud/oraclecloud_provider_test.py diff --git a/docs/user-guide/providers/oci/authentication.mdx b/docs/user-guide/providers/oci/authentication.mdx index 2ae73fb3af..7f0c493e76 100644 --- a/docs/user-guide/providers/oci/authentication.mdx +++ b/docs/user-guide/providers/oci/authentication.mdx @@ -164,7 +164,7 @@ prowler oci --profile PRODUCTION Use a config file from a custom location: ```bash -prowler oci --config-file /path/to/custom/config +prowler oci --oci-config-file /path/to/custom/config ``` ### Setting Up API Keys @@ -377,7 +377,7 @@ ls -la ~/.oci/config mkdir -p ~/.oci # Specify custom location -prowler oci --config-file /path/to/config +prowler oci --oci-config-file /path/to/config ``` #### Error: "InvalidKeyOrSignature" diff --git a/docs/user-guide/providers/oci/getting-started-oci.mdx b/docs/user-guide/providers/oci/getting-started-oci.mdx index 80c008480d..8affa2f992 100644 --- a/docs/user-guide/providers/oci/getting-started-oci.mdx +++ b/docs/user-guide/providers/oci/getting-started-oci.mdx @@ -122,7 +122,7 @@ prowler oci --profile production ##### Using a Custom Config File ```bash -prowler oci --config-file /path/to/custom/config +prowler oci --oci-config-file /path/to/custom/config ``` #### Instance Principal Authentication diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 5fd9ca66f4..7fd5b6b734 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -42,6 +42,13 @@ All notable changes to the **Prowler SDK** are documented in this file. --- +## [5.16.2] (Prowler v5.16.2) (UNRELEASED) + +### Fixed +- Fix OCI authentication error handling and validation [(#9738)](https://github.com/prowler-cloud/prowler/pull/9738) + +--- + ## [5.16.1] (Prowler v5.16.1) ### Fixed diff --git a/prowler/providers/oraclecloud/oraclecloud_provider.py b/prowler/providers/oraclecloud/oraclecloud_provider.py index 08d654d580..3ff83e7c22 100644 --- a/prowler/providers/oraclecloud/oraclecloud_provider.py +++ b/prowler/providers/oraclecloud/oraclecloud_provider.py @@ -266,7 +266,6 @@ class OraclecloudProvider(Provider): # If API key credentials are provided directly, create config from them if user and fingerprint and tenancy and region: import base64 - import tempfile logger.info("Using API key credentials from direct parameters") @@ -280,21 +279,19 @@ class OraclecloudProvider(Provider): # Handle private key if key_content: - # Decode base64 key content and write to temp file + # Decode base64 key content try: key_data = base64.b64decode(key_content) - temp_key_file = tempfile.NamedTemporaryFile( - mode="wb", delete=False, suffix=".pem" - ) - temp_key_file.write(key_data) - temp_key_file.close() - config["key_file"] = temp_key_file.name + decoded_key = key_data.decode("utf-8") except Exception as decode_error: logger.error(f"Failed to decode key_content: {decode_error}") raise OCIInvalidConfigError( file=pathlib.Path(__file__).name, message="Failed to decode key_content. Ensure it is base64 encoded.", ) + + # Use OCI SDK's native key_content support + config["key_content"] = decoded_key elif key_file: config["key_file"] = os.path.expanduser(key_file) else: @@ -428,78 +425,85 @@ class OraclecloudProvider(Provider): Raises: - OCIAuthenticationError: If authentication fails. """ - try: - # Get tenancy from config - tenancy_id = session.config.get("tenancy") + # Get tenancy from config + tenancy_id = session.config.get("tenancy") - if not tenancy_id: - raise OCINoCredentialsError( - file=pathlib.Path(__file__).name, - message="Tenancy ID not found in configuration", - ) - - # Validate tenancy OCID format - if not OraclecloudProvider.validate_ocid(tenancy_id, "tenancy"): - raise OCIInvalidTenancyError( - file=pathlib.Path(__file__).name, - message=f"Invalid tenancy OCID format: {tenancy_id}", - ) - - # Get user from config (not available in instance principal) - user_id = session.config.get("user", "instance-principal") - - # Get region from config or use provided region - if not region: - region = session.config.get("region", "us-ashburn-1") - - # Validate region - if region not in OCI_REGIONS: - raise OCIInvalidRegionError( - file=pathlib.Path(__file__).name, - message=f"Invalid region: {region}", - ) - - # Get tenancy name using Identity service - tenancy_name = "unknown" - try: - # Create identity client with proper authentication handling - if session.signer: - identity_client = oci.identity.IdentityClient( - config=session.config, signer=session.signer - ) - else: - identity_client = oci.identity.IdentityClient(config=session.config) - - tenancy = identity_client.get_tenancy(tenancy_id).data - tenancy_name = tenancy.name - logger.info(f"Tenancy Name: {tenancy_name}") - except Exception as error: - logger.warning( - f"Could not retrieve tenancy name: {error}. Using 'unknown'" - ) - - logger.info(f"OCI Tenancy ID: {tenancy_id}") - logger.info(f"OCI User ID: {user_id}") - logger.info(f"OCI Region: {region}") - - return OCIIdentityInfo( - tenancy_id=tenancy_id, - tenancy_name=tenancy_name, - user_id=user_id, - region=region, - profile=session.profile, - audited_regions=set([region]) if region else set(), - audited_compartments=compartment_ids if compartment_ids else [], + if not tenancy_id: + raise OCINoCredentialsError( + file=pathlib.Path(__file__).name, + message="Tenancy ID not found in configuration", ) - except Exception as error: + # Validate tenancy OCID format + if not OraclecloudProvider.validate_ocid(tenancy_id, "tenancy"): + raise OCIInvalidTenancyError( + file=pathlib.Path(__file__).name, + message=f"Invalid tenancy OCID format: {tenancy_id}", + ) + + # Get user from config (not available in instance principal) + user_id = session.config.get("user", "instance-principal") + + # Get region from config or use provided region + if not region: + region = session.config.get("region", "us-ashburn-1") + + # Validate region + if region not in OCI_REGIONS: + raise OCIInvalidRegionError( + file=pathlib.Path(__file__).name, + message=f"Invalid region: {region}", + ) + + # Validate credentials by calling OCI Identity service + try: + if session.signer: + identity_client = oci.identity.IdentityClient( + config=session.config, signer=session.signer + ) + else: + identity_client = oci.identity.IdentityClient(config=session.config) + + tenancy = identity_client.get_tenancy(tenancy_id).data + tenancy_name = tenancy.name + logger.info(f"Tenancy Name: {tenancy_name}") + except oci.exceptions.ServiceError as error: logger.critical( - f"OCIAuthenticationError[{error.__traceback__.tb_lineno}]: {error}" + f"OCI credential validation failed (HTTP {error.status}): {error.message}" ) raise OCIAuthenticationError( - original_exception=error, file=pathlib.Path(__file__).name, + message=f"OCI credential validation failed: {error.message}. Please verify your credentials and try again.", + original_exception=error, ) + except oci.exceptions.InvalidPrivateKey as error: + logger.critical(f"Invalid OCI private key: {error}") + raise OCIAuthenticationError( + file=pathlib.Path(__file__).name, + message="Invalid OCI private key format. Ensure the key is a valid PEM-encoded private key.", + original_exception=error, + ) + except Exception as error: + logger.critical(f"OCI authentication error: {error}") + raise OCIAuthenticationError( + file=pathlib.Path(__file__).name, + message=f"Failed to authenticate with OCI: {error}", + original_exception=error, + ) + + logger.info(f"OCI Tenancy ID: {tenancy_id}") + logger.info(f"OCI User ID: {user_id}") + logger.info(f"OCI Region: {region}") + + return OCIIdentityInfo( + tenancy_id=tenancy_id, + tenancy_name=tenancy_name, + user_id=user_id, + region=region, + profile=session.profile, + audited_regions=set([region]) if region else set(), + audited_compartments=compartment_ids if compartment_ids else [], + ) @staticmethod def validate_ocid(ocid: str, resource_type: str = None) -> bool: @@ -838,7 +842,6 @@ class OraclecloudProvider(Provider): # If API key credentials are provided directly, create config from them if user and fingerprint and tenancy and region: import base64 - import tempfile logger.info("Using API key credentials from direct parameters") @@ -852,21 +855,19 @@ class OraclecloudProvider(Provider): # Handle private key if key_content: - # Decode base64 key content and write to temp file + # Decode base64 key content try: key_data = base64.b64decode(key_content) - temp_key_file = tempfile.NamedTemporaryFile( - mode="wb", delete=False, suffix=".pem" - ) - temp_key_file.write(key_data) - temp_key_file.close() - config["key_file"] = temp_key_file.name + decoded_key = key_data.decode("utf-8") except Exception as decode_error: logger.error(f"Failed to decode key_content: {decode_error}") raise OCIInvalidConfigError( file=pathlib.Path(__file__).name, message="Failed to decode key_content. Ensure it is base64 encoded.", ) + + # Use OCI SDK's native key_content support + config["key_content"] = decoded_key elif key_file: config["key_file"] = os.path.expanduser(key_file) else: diff --git a/tests/providers/oraclecloud/oraclecloud_provider_test.py b/tests/providers/oraclecloud/oraclecloud_provider_test.py new file mode 100644 index 0000000000..dd3b7b7d27 --- /dev/null +++ b/tests/providers/oraclecloud/oraclecloud_provider_test.py @@ -0,0 +1,201 @@ +from unittest.mock import MagicMock, patch + +import pytest + +from prowler.providers.oraclecloud.exceptions.exceptions import ( + OCIAuthenticationError, + OCIInvalidConfigError, +) +from prowler.providers.oraclecloud.models import OCISession +from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider + + +class TestSetIdentityAuthenticationErrors: + """Tests for authentication error handling in set_identity()""" + + @pytest.fixture + def mock_session(self): + """Create a mock OCI session.""" + session = OCISession( + config={ + "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample", + "user": "ocid1.user.oc1..aaaaaaaexample", + "region": "us-ashburn-1", + "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99", + }, + signer=None, + profile="DEFAULT", + ) + return session + + def test_authentication_error_401_raises_exception(self, mock_session): + """Test 401 error raises OCIAuthenticationError.""" + with patch("oci.identity.IdentityClient") as mock_identity_client: + mock_client_instance = MagicMock() + mock_client_instance.get_tenancy.side_effect = self._create_service_error( + 401, "Authentication failed" + ) + mock_identity_client.return_value = mock_client_instance + + with pytest.raises(OCIAuthenticationError) as exc_info: + OraclecloudProvider.set_identity(mock_session) + + assert "OCI credential validation failed" in str(exc_info.value) + + def test_authentication_error_403_raises_exception(self, mock_session): + """Test 403 error raises OCIAuthenticationError.""" + with patch("oci.identity.IdentityClient") as mock_identity_client: + mock_client_instance = MagicMock() + mock_client_instance.get_tenancy.side_effect = self._create_service_error( + 403, "Forbidden access" + ) + mock_identity_client.return_value = mock_client_instance + + with pytest.raises(OCIAuthenticationError) as exc_info: + OraclecloudProvider.set_identity(mock_session) + + assert "OCI credential validation failed" in str(exc_info.value) + + def test_authentication_error_404_raises_exception(self, mock_session): + """Test 404 error raises OCIAuthenticationError.""" + with patch("oci.identity.IdentityClient") as mock_identity_client: + mock_client_instance = MagicMock() + mock_client_instance.get_tenancy.side_effect = self._create_service_error( + 404, "Resource not found" + ) + mock_identity_client.return_value = mock_client_instance + + with pytest.raises(OCIAuthenticationError) as exc_info: + OraclecloudProvider.set_identity(mock_session) + + assert "OCI credential validation failed" in str(exc_info.value) + + def test_service_error_500_raises_exception(self, mock_session): + """Test 500 error raises OCIAuthenticationError (can't validate credentials).""" + with patch("oci.identity.IdentityClient") as mock_identity_client: + mock_client_instance = MagicMock() + mock_client_instance.get_tenancy.side_effect = self._create_service_error( + 500, "Internal server error" + ) + mock_identity_client.return_value = mock_client_instance + + with pytest.raises(OCIAuthenticationError) as exc_info: + OraclecloudProvider.set_identity(mock_session) + + assert "OCI credential validation failed" in str(exc_info.value) + + def test_invalid_private_key_raises_exception(self, mock_session): + """Test InvalidPrivateKey exception raises OCIAuthenticationError.""" + with patch("oci.identity.IdentityClient") as mock_identity_client: + import oci + + mock_client_instance = MagicMock() + mock_client_instance.get_tenancy.side_effect = ( + oci.exceptions.InvalidPrivateKey("Invalid private key") + ) + mock_identity_client.return_value = mock_client_instance + + with pytest.raises(OCIAuthenticationError) as exc_info: + OraclecloudProvider.set_identity(mock_session) + + assert "Invalid OCI private key format" in str(exc_info.value) + + def test_generic_exception_raises_authentication_error(self, mock_session): + """Test generic exception raises OCIAuthenticationError.""" + with patch("oci.identity.IdentityClient") as mock_identity_client: + mock_client_instance = MagicMock() + mock_client_instance.get_tenancy.side_effect = Exception("Unexpected error") + mock_identity_client.return_value = mock_client_instance + + with pytest.raises(OCIAuthenticationError) as exc_info: + OraclecloudProvider.set_identity(mock_session) + + assert "Failed to authenticate with OCI" in str(exc_info.value) + + def test_successful_authentication(self, mock_session): + """Test successful authentication returns identity info.""" + with patch("oci.identity.IdentityClient") as mock_identity_client: + mock_tenancy = MagicMock() + mock_tenancy.name = "test-tenancy" + mock_response = MagicMock() + mock_response.data = mock_tenancy + + mock_client_instance = MagicMock() + mock_client_instance.get_tenancy.return_value = mock_response + mock_identity_client.return_value = mock_client_instance + + identity = OraclecloudProvider.set_identity(mock_session) + + assert identity.tenancy_name == "test-tenancy" + assert identity.tenancy_id == "ocid1.tenancy.oc1..aaaaaaaexample" + assert identity.user_id == "ocid1.user.oc1..aaaaaaaexample" + assert identity.region == "us-ashburn-1" + + @staticmethod + def _create_service_error(status, message): + """Helper to create an OCI ServiceError.""" + import oci + + error = oci.exceptions.ServiceError( + status=status, + code="TestError", + headers={}, + message=message, + ) + return error + + +class TestTestConnectionKeyValidation: + """Tests for key_content validation in test_connection()""" + + def test_test_connection_invalid_base64_key_raises_error(self): + """Test invalid base64 key content raises OCIInvalidConfigError.""" + with pytest.raises(OCIInvalidConfigError) as exc_info: + OraclecloudProvider.test_connection( + oci_config_file=None, + profile=None, + key_content="not-valid-base64!!!", + user="ocid1.user.oc1..aaaaaaaexample", + fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99", + tenancy="ocid1.tenancy.oc1..aaaaaaaexample", + region="us-ashburn-1", + ) + + assert "Failed to decode key_content" in str(exc_info.value) + + def test_test_connection_valid_key_content_proceeds(self): + """Test valid base64 key content proceeds to authentication.""" + import base64 + + # The SDK will validate the actual key format during authentication + valid_key = """-----BEGIN RSA PRIVATE KEY----- +MIIEpQIBAAKCAQEA0Z3VS5JJcds3xfn/ygWyF8n0sMcD/QHWCJ7yGSEtLN2T +...key content... +-----END RSA PRIVATE KEY-----""" + encoded_key = base64.b64encode(valid_key.encode("utf-8")).decode("utf-8") + + with ( + patch("oci.config.validate_config"), + patch("oci.identity.IdentityClient") as mock_identity_client, + ): + mock_tenancy = MagicMock() + mock_tenancy.name = "test-tenancy" + mock_response = MagicMock() + mock_response.data = mock_tenancy + + mock_client_instance = MagicMock() + mock_client_instance.get_tenancy.return_value = mock_response + mock_identity_client.return_value = mock_client_instance + + connection = OraclecloudProvider.test_connection( + oci_config_file=None, + profile=None, + key_content=encoded_key, + user="ocid1.user.oc1..aaaaaaaexample", + fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99", + tenancy="ocid1.tenancy.oc1..aaaaaaaexample", + region="us-ashburn-1", + raise_on_exception=False, + ) + + assert connection.is_connected is True From f3ba70dd6b1d983fcd12bb34a9ea7afaee34b714 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Thu, 8 Jan 2026 17:03:38 +0100 Subject: [PATCH 026/337] docs: add warning about changes not complaining with roadmap (#9741) --- docs/developer-guide/introduction.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/developer-guide/introduction.mdx b/docs/developer-guide/introduction.mdx index 5377991fac..3f77c53ab5 100644 --- a/docs/developer-guide/introduction.mdx +++ b/docs/developer-guide/introduction.mdx @@ -6,6 +6,10 @@ Thanks for your interest in contributing to Prowler! Prowler can be extended in various ways. This guide provides the different ways to contribute and how to get started. + +Maintainers will assess whether a change fits the project roadmap and scope before merging. + + ## Contributing to Prowler ### Review Current Issues From 8d8b7aad15486dac7328defddb2dff946f8af682 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Jan 2026 08:22:37 +0100 Subject: [PATCH 027/337] build(deps): bump werkzeug from 3.1.4 to 3.1.5 (#9744) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- poetry.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/poetry.lock b/poetry.lock index f7243ed271..3189aa7b0f 100644 --- a/poetry.lock +++ b/poetry.lock @@ -6118,14 +6118,14 @@ test = ["websockets"] [[package]] name = "werkzeug" -version = "3.1.4" +version = "3.1.5" description = "The comprehensive WSGI web application library." optional = false python-versions = ">=3.9" groups = ["main", "dev"] files = [ - {file = "werkzeug-3.1.4-py3-none-any.whl", hash = "sha256:2ad50fb9ed09cc3af22c54698351027ace879a0b60a3b5edf5730b2f7d876905"}, - {file = "werkzeug-3.1.4.tar.gz", hash = "sha256:cd3cd98b1b92dc3b7b3995038826c68097dcb16f9baa63abe35f20eafeb9fe5e"}, + {file = "werkzeug-3.1.5-py3-none-any.whl", hash = "sha256:5111e36e91086ece91f93268bb39b4a35c1e6f1feac762c9c822ded0a4e322dc"}, + {file = "werkzeug-3.1.5.tar.gz", hash = "sha256:6a548b0e88955dd07ccb25539d7d0cc97417ee9e179677d22c7041c8f078ce67"}, ] [package.dependencies] From d04716ea952df2c9e3e3eb0bc45cddc04f9fee69 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Jan 2026 08:23:58 +0100 Subject: [PATCH 028/337] build(deps): bump werkzeug from 3.1.4 to 3.1.5 in /api (#9743) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- api/poetry.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/api/poetry.lock b/api/poetry.lock index b12a734dc9..fa0df098eb 100644 --- a/api/poetry.lock +++ b/api/poetry.lock @@ -7374,14 +7374,14 @@ test = ["websockets"] [[package]] name = "werkzeug" -version = "3.1.4" +version = "3.1.5" description = "The comprehensive WSGI web application library." optional = false python-versions = ">=3.9" groups = ["main"] files = [ - {file = "werkzeug-3.1.4-py3-none-any.whl", hash = "sha256:2ad50fb9ed09cc3af22c54698351027ace879a0b60a3b5edf5730b2f7d876905"}, - {file = "werkzeug-3.1.4.tar.gz", hash = "sha256:cd3cd98b1b92dc3b7b3995038826c68097dcb16f9baa63abe35f20eafeb9fe5e"}, + {file = "werkzeug-3.1.5-py3-none-any.whl", hash = "sha256:5111e36e91086ece91f93268bb39b4a35c1e6f1feac762c9c822ded0a4e322dc"}, + {file = "werkzeug-3.1.5.tar.gz", hash = "sha256:6a548b0e88955dd07ccb25539d7d0cc97417ee9e179677d22c7041c8f078ce67"}, ] [package.dependencies] From 68684b107a0ff9aa7373d25ef5816b4d99a369d7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Jan 2026 08:25:25 +0100 Subject: [PATCH 029/337] build(deps-dev): bump authlib from 1.6.5 to 1.6.6 in /api (#9742) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- api/poetry.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/api/poetry.lock b/api/poetry.lock index fa0df098eb..bde85eb28a 100644 --- a/api/poetry.lock +++ b/api/poetry.lock @@ -847,14 +847,14 @@ tests-mypy = ["mypy (>=1.11.1) ; platform_python_implementation == \"CPython\" a [[package]] name = "authlib" -version = "1.6.5" +version = "1.6.6" description = "The ultimate Python library in building OAuth and OpenID Connect servers and clients." optional = false python-versions = ">=3.9" groups = ["dev"] files = [ - {file = "authlib-1.6.5-py2.py3-none-any.whl", hash = "sha256:3e0e0507807f842b02175507bdee8957a1d5707fd4afb17c32fb43fee90b6e3a"}, - {file = "authlib-1.6.5.tar.gz", hash = "sha256:6aaf9c79b7cc96c900f0b284061691c5d4e61221640a948fe690b556a6d6d10b"}, + {file = "authlib-1.6.6-py2.py3-none-any.whl", hash = "sha256:7d9e9bc535c13974313a87f53e8430eb6ea3d1cf6ae4f6efcd793f2e949143fd"}, + {file = "authlib-1.6.6.tar.gz", hash = "sha256:45770e8e056d0f283451d9996fbb59b70d45722b45d854d58f32878d0a40c38e"}, ] [package.dependencies] From 7c1bcfc7817fed7cfd62b38ace5a47eac662b2f0 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Fri, 9 Jan 2026 11:32:10 +0100 Subject: [PATCH 030/337] fix: typo in subscription error (#9745) Co-authored-by: Alan Buscaglia --- .../workflow/forms/test-connection-form.tsx | 25 ++++++++----------- 1 file changed, 11 insertions(+), 14 deletions(-) diff --git a/ui/components/providers/workflow/forms/test-connection-form.tsx b/ui/components/providers/workflow/forms/test-connection-form.tsx index fecced7c6b..d7f5344b61 100644 --- a/ui/components/providers/workflow/forms/test-connection-form.tsx +++ b/ui/components/providers/workflow/forms/test-connection-form.tsx @@ -4,6 +4,7 @@ import { Checkbox } from "@heroui/checkbox"; import { zodResolver } from "@hookform/resolvers/zod"; import { Icon } from "@iconify/react"; import { Loader2 } from "lucide-react"; +import Link from "next/link"; import { useRouter } from "next/navigation"; import { useState } from "react"; import { useForm } from "react-hook-form"; @@ -18,7 +19,6 @@ import { getTask } from "@/actions/task/tasks"; import { CheckIcon, RocketIcon } from "@/components/icons"; import { Button } from "@/components/shadcn"; import { useToast } from "@/components/ui"; -import { CustomLink } from "@/components/ui/custom/custom-link"; import { Form } from "@/components/ui/form"; import { checkTaskStatus } from "@/lib/helper"; import { ProviderType } from "@/types"; @@ -144,6 +144,11 @@ export const TestConnectionForm = ({ type: "server", message: data.error, }); + toast({ + variant: "destructive", + title: "Oops! Something went wrong", + description: data.error, + }); } else { setIsRedirecting(true); router.push("/scans"); @@ -239,8 +244,8 @@ export const TestConnectionForm = ({ {apiErrorMessage && ( -
-

{`Provider ID ${apiErrorMessage?.toLowerCase()}. Please check and try again.`}

+
+

{apiErrorMessage}

)} @@ -297,17 +302,9 @@ export const TestConnectionForm = ({
{apiErrorMessage ? ( - - - Back to providers - + ) : connectionStatus?.error ? ( + + + {error &&
Error: {error.message}
} +
+ ); +} +``` + +## UIMessage Structure (v5) + +```typescript +// ❌ Old: message.content was a string +// ✅ New: message.parts is an array + +interface UIMessage { + id: string; + role: "user" | "assistant" | "system"; + parts: MessagePart[]; +} + +type MessagePart = + | { type: "text"; text: string } + | { type: "image"; image: string } + | { type: "tool-call"; toolCallId: string; toolName: string; args: unknown } + | { type: "tool-result"; toolCallId: string; result: unknown }; + +// Extract text from parts +function getMessageText(message: UIMessage): string { + return message.parts + .filter((part): part is { type: "text"; text: string } => part.type === "text") + .map((part) => part.text) + .join(""); +} + +// Render message +function Message({ message }: { message: UIMessage }) { + return ( +
+ {message.parts.map((part, index) => { + if (part.type === "text") { + return

{part.text}

; + } + if (part.type === "image") { + return ; + } + return null; + })} +
+ ); +} +``` + +## Server-Side (Route Handler) + +```typescript +// app/api/chat/route.ts +import { openai } from "@ai-sdk/openai"; +import { streamText } from "ai"; + +export async function POST(req: Request) { + const { messages } = await req.json(); + + const result = await streamText({ + model: openai("gpt-4o"), + messages, + system: "You are a helpful assistant.", + }); + + return result.toDataStreamResponse(); +} +``` + +## With LangChain + +```typescript +// app/api/chat/route.ts +import { toUIMessageStream } from "@ai-sdk/langchain"; +import { ChatOpenAI } from "@langchain/openai"; +import { HumanMessage, AIMessage } from "@langchain/core/messages"; + +export async function POST(req: Request) { + const { messages } = await req.json(); + + const model = new ChatOpenAI({ + modelName: "gpt-4o", + streaming: true, + }); + + // Convert UI messages to LangChain format + const langchainMessages = messages.map((m) => { + const text = m.parts + .filter((p) => p.type === "text") + .map((p) => p.text) + .join(""); + return m.role === "user" + ? new HumanMessage(text) + : new AIMessage(text); + }); + + const stream = await model.stream(langchainMessages); + + return toUIMessageStream(stream).toDataStreamResponse(); +} +``` + +## Streaming with Tools + +```typescript +import { openai } from "@ai-sdk/openai"; +import { streamText, tool } from "ai"; +import { z } from "zod"; + +const result = await streamText({ + model: openai("gpt-4o"), + messages, + tools: { + getWeather: tool({ + description: "Get weather for a location", + parameters: z.object({ + location: z.string().describe("City name"), + }), + execute: async ({ location }) => { + // Fetch weather data + return { temperature: 72, condition: "sunny" }; + }, + }), + }, +}); +``` + +## useCompletion (Text Generation) + +```typescript +import { useCompletion } from "@ai-sdk/react"; +import { DefaultCompletionTransport } from "ai"; + +const { completion, complete, isLoading } = useCompletion({ + transport: new DefaultCompletionTransport({ api: "/api/complete" }), +}); + +// Trigger completion +await complete("Write a haiku about"); +``` + +## Error Handling + +```typescript +const { error, messages, sendMessage } = useChat({ + transport: new DefaultChatTransport({ api: "/api/chat" }), + onError: (error) => { + console.error("Chat error:", error); + toast.error("Failed to send message"); + }, +}); + +// Display error +{error && ( +
+ {error.message} + +
+)} +``` diff --git a/skills/django-drf/SKILL.md b/skills/django-drf/SKILL.md new file mode 100644 index 0000000000..03b43fc64e --- /dev/null +++ b/skills/django-drf/SKILL.md @@ -0,0 +1,184 @@ +--- +name: django-drf +description: > + Django REST Framework patterns. + Trigger: When building REST APIs with Django - ViewSets, Serializers, Filters. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## ViewSet Pattern + +```python +from rest_framework import viewsets, status +from rest_framework.response import Response +from rest_framework.decorators import action + +class UserViewSet(viewsets.ModelViewSet): + queryset = User.objects.all() + serializer_class = UserSerializer + filterset_class = UserFilter + permission_classes = [IsAuthenticated] + + def get_serializer_class(self): + if self.action == "create": + return UserCreateSerializer + if self.action in ["update", "partial_update"]: + return UserUpdateSerializer + return UserSerializer + + @action(detail=True, methods=["post"]) + def activate(self, request, pk=None): + user = self.get_object() + user.is_active = True + user.save() + return Response({"status": "activated"}) +``` + +## Serializer Patterns + +```python +from rest_framework import serializers + +# Read Serializer +class UserSerializer(serializers.ModelSerializer): + full_name = serializers.SerializerMethodField() + + class Meta: + model = User + fields = ["id", "email", "full_name", "created_at"] + read_only_fields = ["id", "created_at"] + + def get_full_name(self, obj): + return f"{obj.first_name} {obj.last_name}" + +# Create Serializer +class UserCreateSerializer(serializers.ModelSerializer): + password = serializers.CharField(write_only=True) + + class Meta: + model = User + fields = ["email", "password", "first_name", "last_name"] + + def create(self, validated_data): + password = validated_data.pop("password") + user = User(**validated_data) + user.set_password(password) + user.save() + return user + +# Update Serializer +class UserUpdateSerializer(serializers.ModelSerializer): + class Meta: + model = User + fields = ["first_name", "last_name"] +``` + +## Filters + +```python +from django_filters import rest_framework as filters + +class UserFilter(filters.FilterSet): + email = filters.CharFilter(lookup_expr="icontains") + is_active = filters.BooleanFilter() + created_after = filters.DateTimeFilter( + field_name="created_at", + lookup_expr="gte" + ) + created_before = filters.DateTimeFilter( + field_name="created_at", + lookup_expr="lte" + ) + + class Meta: + model = User + fields = ["email", "is_active"] +``` + +## Permissions + +```python +from rest_framework.permissions import BasePermission + +class IsOwner(BasePermission): + def has_object_permission(self, request, view, obj): + return obj.owner == request.user + +class IsAdminOrReadOnly(BasePermission): + def has_permission(self, request, view): + if request.method in ["GET", "HEAD", "OPTIONS"]: + return True + return request.user.is_staff +``` + +## Pagination + +```python +from rest_framework.pagination import PageNumberPagination + +class StandardPagination(PageNumberPagination): + page_size = 20 + page_size_query_param = "page_size" + max_page_size = 100 + +# settings.py +REST_FRAMEWORK = { + "DEFAULT_PAGINATION_CLASS": "api.pagination.StandardPagination", +} +``` + +## URL Routing + +```python +from rest_framework.routers import DefaultRouter + +router = DefaultRouter() +router.register(r"users", UserViewSet, basename="user") +router.register(r"posts", PostViewSet, basename="post") + +urlpatterns = [ + path("api/v1/", include(router.urls)), +] +``` + +## Testing + +```python +import pytest +from rest_framework import status +from rest_framework.test import APIClient + +@pytest.fixture +def api_client(): + return APIClient() + +@pytest.fixture +def authenticated_client(api_client, user): + api_client.force_authenticate(user=user) + return api_client + +@pytest.mark.django_db +class TestUserViewSet: + def test_list_users(self, authenticated_client): + response = authenticated_client.get("/api/v1/users/") + assert response.status_code == status.HTTP_200_OK + + def test_create_user(self, authenticated_client): + data = {"email": "new@test.com", "password": "pass123"} + response = authenticated_client.post("/api/v1/users/", data) + assert response.status_code == status.HTTP_201_CREATED +``` + +## Commands + +```bash +python manage.py runserver +python manage.py makemigrations +python manage.py migrate +python manage.py createsuperuser +python manage.py shell +``` diff --git a/skills/nextjs-15/SKILL.md b/skills/nextjs-15/SKILL.md new file mode 100644 index 0000000000..4fa47fd619 --- /dev/null +++ b/skills/nextjs-15/SKILL.md @@ -0,0 +1,148 @@ +--- +name: nextjs-15 +description: > + Next.js 15 App Router patterns. + Trigger: When working with Next.js - routing, Server Actions, data fetching. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## App Router File Conventions + +``` +app/ +├── layout.tsx # Root layout (required) +├── page.tsx # Home page (/) +├── loading.tsx # Loading UI (Suspense) +├── error.tsx # Error boundary +├── not-found.tsx # 404 page +├── (auth)/ # Route group (no URL impact) +│ ├── login/page.tsx # /login +│ └── signup/page.tsx # /signup +├── api/ +│ └── route.ts # API handler +└── _components/ # Private folder (not routed) +``` + +## Server Components (Default) + +```typescript +// No directive needed - async by default +export default async function Page() { + const data = await db.query(); + return ; +} +``` + +## Server Actions + +```typescript +// app/actions.ts +"use server"; + +import { revalidatePath } from "next/cache"; +import { redirect } from "next/navigation"; + +export async function createUser(formData: FormData) { + const name = formData.get("name") as string; + + await db.users.create({ data: { name } }); + + revalidatePath("/users"); + redirect("/users"); +} + +// Usage +
+ + +
+``` + +## Data Fetching + +```typescript +// Parallel +async function Page() { + const [users, posts] = await Promise.all([ + getUsers(), + getPosts(), + ]); + return ; +} + +// Streaming with Suspense +}> + + +``` + +## Route Handlers (API) + +```typescript +// app/api/users/route.ts +import { NextRequest, NextResponse } from "next/server"; + +export async function GET(request: NextRequest) { + const users = await db.users.findMany(); + return NextResponse.json(users); +} + +export async function POST(request: NextRequest) { + const body = await request.json(); + const user = await db.users.create({ data: body }); + return NextResponse.json(user, { status: 201 }); +} +``` + +## Middleware + +```typescript +// middleware.ts (root level) +import { NextResponse } from "next/server"; +import type { NextRequest } from "next/server"; + +export function middleware(request: NextRequest) { + const token = request.cookies.get("token"); + + if (!token && request.nextUrl.pathname.startsWith("/dashboard")) { + return NextResponse.redirect(new URL("/login", request.url)); + } + + return NextResponse.next(); +} + +export const config = { + matcher: ["/dashboard/:path*"], +}; +``` + +## Metadata + +```typescript +// Static +export const metadata = { + title: "My App", + description: "Description", +}; + +// Dynamic +export async function generateMetadata({ params }) { + const product = await getProduct(params.id); + return { title: product.name }; +} +``` + +## server-only Package + +```typescript +import "server-only"; + +// This will error if imported in client component +export async function getSecretData() { + return db.secrets.findMany(); +} +``` diff --git a/skills/playwright/SKILL.md b/skills/playwright/SKILL.md new file mode 100644 index 0000000000..34e71aadd1 --- /dev/null +++ b/skills/playwright/SKILL.md @@ -0,0 +1,324 @@ +--- +name: playwright +description: > + Playwright E2E testing patterns. + Trigger: When writing E2E tests - Page Objects, selectors, MCP workflow. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## MCP Workflow (MANDATORY If Available) + +**⚠️ If you have Playwright MCP tools, ALWAYS use them BEFORE creating any test:** + +1. **Navigate** to target page +2. **Take snapshot** to see page structure and elements +3. **Interact** with forms/elements to verify exact user flow +4. **Take screenshots** to document expected states +5. **Verify page transitions** through complete flow (loading, success, error) +6. **Document actual selectors** from snapshots (use real refs and labels) +7. **Only after exploring** create test code with verified selectors + +**If MCP NOT available:** Proceed with test creation based on docs and code analysis. + +**Why This Matters:** +- ✅ Precise tests - exact steps needed, no assumptions +- ✅ Accurate selectors - real DOM structure, not imagined +- ✅ Real flow validation - verify journey actually works +- ✅ Avoid over-engineering - minimal tests for what exists +- ✅ Prevent flaky tests - real exploration = stable tests +- ❌ Never assume how UI "should" work + +## File Structure + +``` +tests/ +├── base-page.ts # Parent class for ALL pages +├── helpers.ts # Shared utilities +└── {page-name}/ + ├── {page-name}-page.ts # Page Object Model + ├── {page-name}.spec.ts # ALL tests here (NO separate files!) + └── {page-name}.md # Test documentation +``` + +**File Naming:** +- ✅ `sign-up.spec.ts` (all sign-up tests) +- ✅ `sign-up-page.ts` (page object) +- ✅ `sign-up.md` (documentation) +- ❌ `sign-up-critical-path.spec.ts` (WRONG - no separate files) +- ❌ `sign-up-validation.spec.ts` (WRONG) + +## Selector Priority (REQUIRED) + +```typescript +// 1. BEST - getByRole for interactive elements +this.submitButton = page.getByRole("button", { name: "Submit" }); +this.navLink = page.getByRole("link", { name: "Dashboard" }); + +// 2. BEST - getByLabel for form controls +this.emailInput = page.getByLabel("Email"); +this.passwordInput = page.getByLabel("Password"); + +// 3. SPARINGLY - getByText for static content only +this.errorMessage = page.getByText("Invalid credentials"); +this.pageTitle = page.getByText("Welcome"); + +// 4. LAST RESORT - getByTestId when above fail +this.customWidget = page.getByTestId("date-picker"); + +// ❌ AVOID fragile selectors +this.button = page.locator(".btn-primary"); // NO +this.input = page.locator("#email"); // NO +``` + +## Scope Detection (ASK IF AMBIGUOUS) + +| User Says | Action | +|-----------|--------| +| "a test", "one test", "new test", "add test" | Create ONE test() in existing spec | +| "comprehensive tests", "all tests", "test suite", "generate tests" | Create full suite | + +**Examples:** +- "Create a test for user sign-up" → ONE test only +- "Generate E2E tests for login page" → Full suite +- "Add a test to verify form validation" → ONE test to existing spec + +## Page Object Pattern + +```typescript +import { Page, Locator, expect } from "@playwright/test"; + +// BasePage - ALL pages extend this +export class BasePage { + constructor(protected page: Page) {} + + async goto(path: string): Promise { + await this.page.goto(path); + await this.page.waitForLoadState("networkidle"); + } + + // Common methods go here (see Refactoring Guidelines) + async waitForNotification(): Promise { + await this.page.waitForSelector('[role="status"]'); + } + + async verifyNotificationMessage(message: string): Promise { + const notification = this.page.locator('[role="status"]'); + await expect(notification).toContainText(message); + } +} + +// Page-specific implementation +export interface LoginData { + email: string; + password: string; +} + +export class LoginPage extends BasePage { + readonly emailInput: Locator; + readonly passwordInput: Locator; + readonly submitButton: Locator; + + constructor(page: Page) { + super(page); + this.emailInput = page.getByLabel("Email"); + this.passwordInput = page.getByLabel("Password"); + this.submitButton = page.getByRole("button", { name: "Sign in" }); + } + + async goto(): Promise { + await super.goto("/login"); + } + + async login(data: LoginData): Promise { + await this.emailInput.fill(data.email); + await this.passwordInput.fill(data.password); + await this.submitButton.click(); + } + + async verifyCriticalOutcome(): Promise { + await expect(this.page).toHaveURL("/dashboard"); + } +} +``` + +## Page Object Reuse (CRITICAL) + +**Always check existing page objects before creating new ones!** + +```typescript +// ✅ GOOD: Reuse existing page objects +import { SignInPage } from "../sign-in/sign-in-page"; +import { HomePage } from "../home/home-page"; + +test("User can sign up and login", async ({ page }) => { + const signUpPage = new SignUpPage(page); + const signInPage = new SignInPage(page); // REUSE + const homePage = new HomePage(page); // REUSE + + await signUpPage.signUp(userData); + await homePage.verifyPageLoaded(); // REUSE method + await homePage.signOut(); // REUSE method + await signInPage.login(credentials); // REUSE method +}); + +// ❌ BAD: Recreating existing functionality +export class SignUpPage extends BasePage { + async logout() { /* ... */ } // ❌ HomePage already has this + async login() { /* ... */ } // ❌ SignInPage already has this +} +``` + +**Guidelines:** +- Check `tests/` for existing page objects first +- Import and reuse existing pages +- Create page objects only when page doesn't exist +- If test requires multiple pages, ensure all page objects exist (create if needed) + +## Refactoring Guidelines + +### Move to `BasePage` when: +- ✅ Navigation helpers used by multiple pages (`waitForPageLoad()`, `getCurrentUrl()`) +- ✅ Common UI interactions (notifications, modals, theme toggles) +- ✅ Verification patterns repeated across pages (`isVisible()`, `waitForVisible()`) +- ✅ Error handling that applies to all pages +- ✅ Screenshot utilities for debugging + +### Move to `helpers.ts` when: +- ✅ Test data generation (`generateUniqueEmail()`, `generateTestUser()`) +- ✅ Setup/teardown utilities (`createTestUser()`, `cleanupTestData()`) +- ✅ Custom assertions (`expectNotificationToContain()`) +- ✅ API helpers for test setup (`seedDatabase()`, `resetState()`) +- ✅ Time utilities (`waitForCondition()`, `retryAction()`) + +**Before (BAD):** +```typescript +// Repeated in multiple page objects +export class SignUpPage extends BasePage { + async waitForNotification(): Promise { + await this.page.waitForSelector('[role="status"]'); + } +} +export class SignInPage extends BasePage { + async waitForNotification(): Promise { + await this.page.waitForSelector('[role="status"]'); // DUPLICATED! + } +} +``` + +**After (GOOD):** +```typescript +// BasePage - shared across all pages +export class BasePage { + async waitForNotification(): Promise { + await this.page.waitForSelector('[role="status"]'); + } +} + +// helpers.ts - data generation +export function generateUniqueEmail(): string { + return `test.${Date.now()}@example.com`; +} + +export function generateTestUser() { + return { + name: "Test User", + email: generateUniqueEmail(), + password: "TestPassword123!", + }; +} +``` + +## Test Pattern with Tags + +```typescript +import { test, expect } from "@playwright/test"; +import { LoginPage } from "./login-page"; + +test.describe("Login", () => { + test("User can login successfully", + { tag: ["@critical", "@e2e", "@login", "@LOGIN-E2E-001"] }, + async ({ page }) => { + const loginPage = new LoginPage(page); + + await loginPage.goto(); + await loginPage.login({ email: "user@test.com", password: "pass123" }); + + await expect(page).toHaveURL("/dashboard"); + } + ); +}); +``` + +**Tag Categories:** +- Priority: `@critical`, `@high`, `@medium`, `@low` +- Type: `@e2e` +- Feature: `@signup`, `@signin`, `@dashboard` +- Test ID: `@SIGNUP-E2E-001`, `@LOGIN-E2E-002` + +## Test Documentation Format ({page-name}.md) + +```markdown +### E2E Tests: {Feature Name} + +**Suite ID:** `{SUITE-ID}` +**Feature:** {Feature description} + +--- + +## Test Case: `{TEST-ID}` - {Test case title} + +**Priority:** `{critical|high|medium|low}` + +**Tags:** +- type → @e2e +- feature → @{feature-name} + +**Description/Objective:** {Brief description} + +**Preconditions:** +- {Prerequisites for test to run} +- {Required data or state} + +### Flow Steps: +1. {Step 1} +2. {Step 2} +3. {Step 3} + +### Expected Result: +- {Expected outcome 1} +- {Expected outcome 2} + +### Key verification points: +- {Assertion 1} +- {Assertion 2} + +### Notes: +- {Additional considerations} +``` + +**Documentation Rules:** +- ❌ NO general test running instructions +- ❌ NO file structure explanations +- ❌ NO code examples or tutorials +- ❌ NO troubleshooting sections +- ✅ Focus ONLY on specific test case +- ✅ Keep under 60 lines when possible + +## Commands + +```bash +npx playwright test # Run all +npx playwright test --grep "login" # Filter by name +npx playwright test --ui # Interactive UI +npx playwright test --debug # Debug mode +npx playwright test tests/login/ # Run specific folder +``` + +## Prowler-Specific Patterns + +For Prowler UI E2E testing with authentication setup, environment variables, and test IDs, see: +- **Documentation**: [references/prowler-e2e.md](references/prowler-e2e.md) diff --git a/skills/playwright/references/prowler-e2e.md b/skills/playwright/references/prowler-e2e.md new file mode 100644 index 0000000000..bc9efaf78e --- /dev/null +++ b/skills/playwright/references/prowler-e2e.md @@ -0,0 +1,16 @@ +# Prowler-Specific E2E Patterns + +## Local Documentation + +For Prowler-specific Playwright patterns, see: + +- `docs/developer-guide/end2end-testing.mdx` - Complete E2E testing guide + +## Contents + +The Prowler documentation covers patterns NOT in the generic playwright skill: +- Authentication setup projects (`admin.auth.setup`, `member.auth.setup`, etc.) +- Environment variables (`E2E_AWS_PROVIDER_ACCOUNT_ID`, etc.) +- Page Object location (`ui/tests/`) +- Test ID conventions (`@PROVIDER-E2E-001`, `@SCANS-E2E-001`) +- Serial test requirements for data-dependent tests diff --git a/skills/prowler-api/SKILL.md b/skills/prowler-api/SKILL.md new file mode 100644 index 0000000000..62f3c15156 --- /dev/null +++ b/skills/prowler-api/SKILL.md @@ -0,0 +1,137 @@ +--- +name: prowler-api +description: > + Prowler API patterns: RLS, RBAC, providers, Celery tasks. + Trigger: When working on api/ - models, serializers, views, filters, tasks. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## Critical Rules + +- ALWAYS use `rls_transaction(tenant_id)` when querying outside ViewSet context +- ALWAYS use `get_role()` before checking permissions (returns FIRST role only) +- NEVER access `Provider.objects` without RLS context in Celery tasks +- ALWAYS use `@set_tenant` then `@handle_provider_deletion` decorator order + +--- + +## 1. Providers (10 Supported) + +UID validation is dynamic: `getattr(self, f"validate_{self.provider}_uid")(self.uid)` + +| Provider | UID Format | Example | +|----------|-----------|---------| +| AWS | 12 digits | `123456789012` | +| Azure | UUID v4 | `a1b2c3d4-e5f6-...` | +| GCP | 6-30 chars, lowercase, letter start | `my-gcp-project` | +| M365 | Valid domain | `contoso.onmicrosoft.com` | +| Kubernetes | 2-251 chars | `arn:aws:eks:...` | +| GitHub | 1-39 chars | `my-org` | +| IaC | Git URL | `https://github.com/user/repo.git` | +| Oracle Cloud | OCID format | `ocid1.tenancy.oc1..` | +| MongoDB Atlas | 24-char hex | `507f1f77bcf86cd799439011` | +| Alibaba Cloud | 16 digits | `1234567890123456` | + +**Adding new provider**: Add to `ProviderChoices` enum + create `validate__uid()` staticmethod. + +--- + +## 2. Row-Level Security (RLS) + +```python +from api.db_utils import rls_transaction + +with rls_transaction(tenant_id): + providers = Provider.objects.filter(connected=True) + # PostgreSQL enforces tenant_id automatically +``` + +Models inherit from `RowLevelSecurityProtectedModel` with `RowLevelSecurityConstraint`. + +--- + +## 3. Managers + +```python +Provider.objects.all() # Only is_deleted=False +Provider.all_objects.all() # All including deleted +Finding.objects.all() # Only from active providers +``` + +--- + +## 4. RBAC + +```python +from api.rbac.permissions import get_role, get_providers, Permissions + +user_role = get_role(self.request.user) # Returns FIRST role only + +if user_role.unlimited_visibility: + queryset = Provider.objects.filter(tenant_id=tenant_id) +else: + queryset = get_providers(user_role) # Filtered by provider_groups +``` + +**Permissions**: `MANAGE_USERS`, `MANAGE_ACCOUNT`, `MANAGE_BILLING`, `MANAGE_PROVIDERS`, `MANAGE_INTEGRATIONS`, `MANAGE_SCANS`, `UNLIMITED_VISIBILITY` + +--- + +## 5. Celery Tasks + +```python +@shared_task(base=RLSTask, name="task-name", queue="scans") +@set_tenant +@handle_provider_deletion +def my_task(tenant_id: str, provider_id: str): + pass +``` + +**Queues**: Check `tasks/tasks.py`. Common: `scans`, `overview`, `compliance`, `integrations`. + +**Orchestration**: Use `chain()` for sequential, `group()` for parallel. + +--- + +## 6. JSON:API Format + +```python +content_type = "application/vnd.api+json" + +# Request +{"data": {"type": "providers", "attributes": {"provider": "aws", "uid": "123456789012"}}} + +# Response access +response.json()["data"]["attributes"]["alias"] +``` + +--- + +## 7. Serializers + +| Pattern | Usage | +|---------|-------| +| `ProviderSerializer` | Read (list/retrieve) | +| `ProviderCreateSerializer` | POST | +| `ProviderUpdateSerializer` | PATCH | +| `RLSSerializer` | Auto-injects tenant_id | + +--- + +## Commands + +```bash +cd api && poetry run python manage.py migrate # Run migrations +cd api && poetry run python manage.py shell # Django shell +cd api && poetry run celery -A config.celery worker -l info # Start worker +``` + +--- + +## Resources + +- **Documentation**: See [references/api-docs.md](references/api-docs.md) for local file paths and documentation diff --git a/skills/prowler-api/references/api-docs.md b/skills/prowler-api/references/api-docs.md new file mode 100644 index 0000000000..72bc7990fd --- /dev/null +++ b/skills/prowler-api/references/api-docs.md @@ -0,0 +1,21 @@ +# API Documentation + +## Local Documentation + +For API-related patterns, see: + +- `api/src/backend/api/models.py` - Models, Providers, UID validation +- `api/src/backend/api/v1/views.py` - ViewSets, RBAC patterns +- `api/src/backend/api/v1/serializers.py` - Serializers +- `api/src/backend/api/rbac/permissions.py` - RBAC functions +- `api/src/backend/tasks/tasks.py` - Celery tasks +- `api/src/backend/api/db_utils.py` - rls_transaction + +## Contents + +The documentation covers: +- Row-Level Security (RLS) implementation +- RBAC permission system +- Provider validation patterns +- Celery task orchestration +- JSON:API serialization format diff --git a/skills/prowler-compliance/SKILL.md b/skills/prowler-compliance/SKILL.md new file mode 100644 index 0000000000..8b82617d6e --- /dev/null +++ b/skills/prowler-compliance/SKILL.md @@ -0,0 +1,113 @@ +--- +name: prowler-compliance +description: > + Creates and manages Prowler compliance frameworks. + Trigger: When working with compliance frameworks (CIS, NIST, PCI-DSS, SOC2, GDPR). +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## When to Use + +Use this skill when: +- Creating a new compliance framework for any provider +- Adding requirements to existing frameworks +- Mapping checks to compliance controls + +## Compliance Framework Structure + +Frameworks are JSON files in: `prowler/compliance/{provider}/{framework}.json` + +```json +{ + "Framework": "CIS", + "Name": "CIS Amazon Web Services Foundations Benchmark v2.0.0", + "Version": "2.0", + "Provider": "AWS", + "Description": "The CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance...", + "Requirements": [ + { + "Id": "1.1", + "Name": "Requirement name", + "Description": "Detailed description of the requirement", + "Attributes": [ + { + "Section": "1. Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "Attribute description" + } + ], + "Checks": ["check_name_1", "check_name_2"] + } + ] +} +``` + +## Supported Frameworks + +**Industry standards:** +- CIS (Center for Internet Security) +- NIST 800-53, NIST CSF +- CISA + +**Regulatory compliance:** +- PCI-DSS +- HIPAA +- GDPR +- FedRAMP +- SOC2 + +**Cloud-specific:** +- AWS Well-Architected Framework (Security Pillar) +- AWS Foundational Technical Review (FTR) +- Azure Security Benchmark +- GCP Security Best Practices + +## Framework Requirement Mapping + +Each requirement maps to one or more checks: + +```json +{ + "Id": "2.1.1", + "Name": "Ensure MFA is enabled for all IAM users", + "Description": "Multi-Factor Authentication adds an extra layer of protection...", + "Checks": [ + "iam_user_mfa_enabled", + "iam_root_mfa_enabled", + "iam_user_hardware_mfa_enabled" + ] +} +``` + +## Best Practices + +1. **Requirement IDs**: Follow the original framework numbering (e.g., "1.1", "2.3.4") +2. **Check Mapping**: Map to existing checks when possible, create new checks only if needed +3. **Completeness**: Include all framework requirements, even if no check exists (document as manual) +4. **Version Control**: Include framework version in the name and file + +## Commands + +```bash +# List available frameworks for a provider +poetry run python prowler-cli.py {provider} --list-compliance + +# Run scan with specific compliance framework +poetry run python prowler-cli.py {provider} --compliance {framework} + +# Run scan with multiple frameworks +poetry run python prowler-cli.py {provider} --compliance cis_aws_benchmark_v2 pci_dss_3.2.1 + +# Output compliance report +poetry run python prowler-cli.py {provider} --compliance {framework} -M csv json html +``` + +## Resources + +- **Templates**: See [assets/](assets/) for complete CIS framework JSON template +- **Documentation**: See [references/compliance-docs.md](references/compliance-docs.md) for official Prowler Developer Guide links diff --git a/skills/prowler-compliance/assets/cis_framework.json b/skills/prowler-compliance/assets/cis_framework.json new file mode 100644 index 0000000000..817c0ca6aa --- /dev/null +++ b/skills/prowler-compliance/assets/cis_framework.json @@ -0,0 +1,76 @@ +{ + "Framework": "CIS", + "Name": "CIS Amazon Web Services Foundations Benchmark v5.0.0", + "Version": "5.0", + "Provider": "AWS", + "Description": "The CIS Amazon Web Services Foundations Benchmark provides prescriptive guidance for configuring security options for a subset of Amazon Web Services.", + "Requirements": [ + { + "Id": "1.1", + "Description": "Maintain current contact details", + "Checks": [ + "account_maintain_current_contact_details" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Manual", + "Description": "Ensure contact email and telephone details for AWS accounts are current and map to more than one individual in your organization.", + "RationaleStatement": "If an AWS account is observed to be behaving in a prohibited or suspicious manner, AWS will attempt to contact the account owner by email and phone using the contact details listed.", + "ImpactStatement": "", + "RemediationProcedure": "This activity can only be performed via the AWS Console. Navigate to Account Settings and update contact information.", + "AuditProcedure": "This activity can only be performed via the AWS Console. Navigate to Account Settings and verify contact information is current.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-update-contact.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.3", + "Description": "Ensure no 'root' user account access key exists", + "Checks": [ + "iam_no_root_access_key" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "The 'root' user account is the most privileged user in an AWS account. AWS Access Keys provide programmatic access to a given AWS account.", + "RationaleStatement": "Deleting access keys associated with the 'root' user account limits vectors by which the account can be compromised.", + "ImpactStatement": "", + "RemediationProcedure": "Navigate to IAM console, select root user, Security credentials tab, and delete any access keys.", + "AuditProcedure": "Run: aws iam get-account-summary | grep 'AccountAccessKeysPresent'", + "AdditionalInformation": "IAM User account root for us-gov cloud regions is not enabled by default.", + "References": "https://docs.aws.amazon.com/general/latest/gr/aws-access-keys-best-practices.html", + "DefaultValue": "" + } + ] + }, + { + "Id": "1.11", + "Description": "Ensure credentials unused for 45 days or more are disabled", + "Checks": [ + "iam_user_accesskey_unused", + "iam_user_console_access_unused" + ], + "Attributes": [ + { + "Section": "1 Identity and Access Management", + "Profile": "Level 1", + "AssessmentStatus": "Automated", + "Description": "AWS IAM users can access AWS resources using different types of credentials. It is recommended that all credentials unused for 45 days or more be deactivated or removed.", + "RationaleStatement": "Disabling or removing unnecessary credentials reduces the window of opportunity for compromised accounts.", + "ImpactStatement": "Users with deactivated credentials will lose access until re-enabled.", + "RemediationProcedure": "Use IAM console or CLI to deactivate unused access keys and remove unused passwords.", + "AuditProcedure": "Generate credential report and review password_last_used and access_key_last_used fields.", + "AdditionalInformation": "", + "References": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html", + "DefaultValue": "" + } + ] + } + ] +} diff --git a/skills/prowler-compliance/references/compliance-docs.md b/skills/prowler-compliance/references/compliance-docs.md new file mode 100644 index 0000000000..6d53252cfe --- /dev/null +++ b/skills/prowler-compliance/references/compliance-docs.md @@ -0,0 +1,15 @@ +# Compliance Framework Documentation + +## Local Documentation + +For detailed compliance framework patterns, see: + +- `docs/developer-guide/security-compliance-framework.mdx` - Complete guide for creating compliance frameworks (CIS, NIST, PCI-DSS, SOC2, GDPR) + +## Contents + +The documentation covers: +- Framework JSON structure +- Framework metadata (name, version, provider) +- Requirements array with IDs, descriptions, and attributes +- Check mappings for each requirement diff --git a/skills/prowler-docs/SKILL.md b/skills/prowler-docs/SKILL.md new file mode 100644 index 0000000000..d8fd8f9cb2 --- /dev/null +++ b/skills/prowler-docs/SKILL.md @@ -0,0 +1,122 @@ +--- +name: prowler-docs +description: > + Prowler documentation style guide and writing standards. + Trigger: When writing documentation for Prowler features, tutorials, or guides. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## When to Use + +Use this skill when writing Prowler documentation for: +- Feature documentation +- API/SDK references +- Tutorials and guides +- Release notes + +## Brand Voice + +### Unbiased Communication +- Avoid gendered pronouns (use "you/your" or "they/them") +- Use inclusive alternatives: businessman → businessperson, mankind → humanity +- No generalizations about gender, race, nationality, culture +- Avoid militaristic language: fight → address, kill chain → cyberattack chain + +### Technical Terminology +- Define key terms and acronyms on first use: "Identity and Access Management (IAM)" +- Prefer verbal over nominal constructions: "The report was created" not "The creation of the report" +- Use clear, accessible language; minimize jargon + +## Formatting Standards + +### Title Case Capitalization +Use Title Case for all headers: +- Good: "How to Configure Security Scanning" +- Bad: "How to configure security scanning" + +### Hyphenation +- Prenominal position: "world-leading company" +- Postnominal position: "features built in" + +### Bullet Points +Use when information can be logically divided: +```markdown +Prowler CLI includes: +* **Industry standards:** CIS, NIST 800, NIST CSF +* **Regulatory compliance:** RBI, FedRAMP, PCI-DSS +* **Privacy frameworks:** GDPR, HIPAA, FFIEC +``` + +### Interaction Verbs +- Desktop: Click, Double-click, Right-click, Drag, Scroll +- Touch: Tap, Double-tap, Press and hold, Swipe, Pinch + +## SEO Optimization + +### Sentence Structure +Place keywords at the beginning: +- Good: "To create a custom role, open a terminal..." +- Bad: "Open a terminal to create a custom role..." + +### Headers +- H1: Primary (unique, descriptive) +- H2-H6: Subheadings (logical hierarchy) +- Include keywords naturally + +## MDX Components + +### Version Badge +```mdx +import { VersionBadge } from "/snippets/version-badge.mdx" + +## New Feature Name + + + +Description of the feature... +``` + +### Warnings and Danger Calls +```mdx + +Disabling encryption may expose sensitive data to unauthorized access. + + + +Running this command will **permanently delete all data**. + +``` + +## Prowler Features (Proper Nouns) + +Reference without articles: +- Prowler App, Prowler CLI, Prowler SDK +- Prowler Cloud, Prowler Studio, Prowler Registry +- Built-in Compliance Checks +- Multi-cloud Security Scanning +- Autonomous Cloud Security Analyst (AI) + +## Documentation Structure + +``` +docs/ +├── getting-started/ +├── tutorials/ +├── providers/ +│ ├── aws/ +│ ├── azure/ +│ ├── gcp/ +│ └── ... +├── api/ +├── sdk/ +├── compliance/ +└── developer-guide/ +``` + +## Resources + +- **Documentation**: See [references/](references/) for links to local developer guide diff --git a/skills/prowler-docs/references/documentation-docs.md b/skills/prowler-docs/references/documentation-docs.md new file mode 100644 index 0000000000..727e4b0773 --- /dev/null +++ b/skills/prowler-docs/references/documentation-docs.md @@ -0,0 +1,15 @@ +# Documentation Style Guide + +## Local Documentation + +For documentation writing standards, see: + +- `docs/developer-guide/documentation.mdx` - Mintlify-based documentation and local development setup + +## Contents + +The documentation covers: +- Mintlify documentation system +- Local documentation development +- Style guide and conventions +- MDX file structure diff --git a/skills/prowler-mcp/SKILL.md b/skills/prowler-mcp/SKILL.md new file mode 100644 index 0000000000..4bf3eec7a0 --- /dev/null +++ b/skills/prowler-mcp/SKILL.md @@ -0,0 +1,78 @@ +--- +name: prowler-mcp +description: > + Creates MCP tools for Prowler MCP Server. Covers BaseTool pattern, model design, + and API client usage. Use when working on mcp_server/ directory. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## Overview + +The Prowler MCP Server uses three sub-servers with prefixed namespacing: + +| Sub-Server | Prefix | Auth | Purpose | +|------------|--------|------|---------| +| Prowler App | `prowler_app_*` | Required | Cloud management tools | +| Prowler Hub | `prowler_hub_*` | No | Security checks catalog | +| Prowler Docs | `prowler_docs_*` | No | Documentation search | + +For complete architecture, patterns, and examples, see [docs/developer-guide/mcp-server.mdx](../../../docs/developer-guide/mcp-server.mdx). + +--- + +## Critical Rules (Prowler App Only) + +### Tool Implementation + +- **ALWAYS**: Extend `BaseTool` (auto-registered via `tool_loader.py`, only public methods from the class are exposed as a tool) +- **NEVER**: Manually register BaseTool subclasses +- **NEVER**: Import tools directly in server.py + +### Models + +- **ALWAYS**: Use `MinimalSerializerMixin` for responses +- **ALWAYS**: Implement `from_api_response()` factory method +- **ALWAYS**: Use two-tier models (Simplified for lists, Detailed for single items) +- **NEVER**: Return raw API responses + +### API Client + +- **ALWAYS**: Use `self.api_client` singleton +- **ALWAYS**: Use `build_filter_params()` for query parameters +- **NEVER**: Create new httpx clients + +--- + +## Hub/Docs Tools + +Use `@mcp.tool()` decorator directly—no BaseTool or models required. + +--- + +## Quick Reference: New Prowler App Tool + +1. Create tool class in `prowler_app/tools/` extending `BaseTool` +2. Create models in `prowler_app/models/` using `MinimalSerializerMixin` +3. Tools auto-register via `tool_loader.py` + +--- + +## QA Checklist (Prowler App) + +- [ ] Tool docstrings describe LLM-relevant behavior +- [ ] Models use `MinimalSerializerMixin` +- [ ] API responses transformed to simplified models +- [ ] Error handling returns `{"error": str, "status": "failed"}` +- [ ] Parameters use `Field()` with descriptions +- [ ] No hardcoded secrets + +--- + +## Resources + +- **Full Guide**: [docs/developer-guide/mcp-server.mdx](../../../docs/developer-guide/mcp-server.mdx) +- **Templates**: See [assets/](assets/) for tool and model templates diff --git a/skills/prowler-mcp/assets/base_tool.py b/skills/prowler-mcp/assets/base_tool.py new file mode 100644 index 0000000000..7c176a22eb --- /dev/null +++ b/skills/prowler-mcp/assets/base_tool.py @@ -0,0 +1,62 @@ +# Example: BaseTool Abstract Class +# Source: mcp_server/prowler_mcp_server/prowler_app/tools/base.py + +import inspect +from abc import ABC +from typing import TYPE_CHECKING + +if TYPE_CHECKING: + from fastmcp import FastMCP + +from prowler_mcp_server.lib.logger import logger +from prowler_mcp_server.prowler_app.utils.api_client import ProwlerAPIClient + + +class BaseTool(ABC): + """ + Abstract base class for MCP tools. + + Key patterns: + 1. Auto-registers all public async methods as tools + 2. Provides shared api_client and logger via properties + 3. Subclasses just define async methods with Field() parameters + """ + + def __init__(self): + self._api_client = ProwlerAPIClient() + self._logger = logger + + @property + def api_client(self) -> ProwlerAPIClient: + """Shared API client for making authenticated requests.""" + return self._api_client + + @property + def logger(self): + """Logger for structured logging.""" + return self._logger + + def register_tools(self, mcp: "FastMCP") -> None: + """ + Auto-register all public async methods as MCP tools. + + Subclasses don't need to override this - just define async methods. + """ + registered_count = 0 + + for name, method in inspect.getmembers(self, predicate=inspect.ismethod): + # Skip private/protected methods + if name.startswith("_"): + continue + # Skip inherited methods + if name in ["register_tools", "api_client", "logger"]: + continue + # Only register async methods + if inspect.iscoroutinefunction(method): + mcp.tool(method) + registered_count += 1 + self.logger.debug(f"Auto-registered tool: {name}") + + self.logger.info( + f"Auto-registered {registered_count} tools from {self.__class__.__name__}" + ) diff --git a/skills/prowler-mcp/assets/models.py b/skills/prowler-mcp/assets/models.py new file mode 100644 index 0000000000..32669e6c84 --- /dev/null +++ b/skills/prowler-mcp/assets/models.py @@ -0,0 +1,146 @@ +# Example: MCP Models with MinimalSerializerMixin +# Source: mcp_server/prowler_mcp_server/prowler_app/models/ + +from typing import Any, Literal + +from pydantic import ( + BaseModel, + ConfigDict, + Field, + SerializerFunctionWrapHandler, + model_serializer, +) + + +class MinimalSerializerMixin(BaseModel): + """ + Mixin that excludes empty values from serialization. + + Key pattern: Reduces token usage by removing None, empty strings, empty lists/dicts. + Use this for all LLM-facing models. + """ + + @model_serializer(mode="wrap") + def _serialize(self, handler: SerializerFunctionWrapHandler) -> dict[str, Any]: + data = handler(self) + return {k: v for k, v in data.items() if not self._should_exclude(k, v)} + + def _should_exclude(self, key: str, value: Any) -> bool: + """Override in subclasses for custom exclusion logic.""" + if value is None: + return True + if value == "": + return True + if isinstance(value, list) and not value: + return True + if isinstance(value, dict) and not value: + return True + return False + + +class CheckRemediation(MinimalSerializerMixin, BaseModel): + """Remediation information - uses mixin to strip empty fields.""" + + model_config = ConfigDict(frozen=True) + + cli: str | None = Field(default=None, description="CLI command for remediation") + terraform: str | None = Field(default=None, description="Terraform code") + other: str | None = Field(default=None, description="Other remediation steps") + recommendation: str | None = Field( + default=None, description="Best practice recommendation" + ) + + +class SimplifiedFinding(MinimalSerializerMixin, BaseModel): + """ + Lightweight finding for list responses. + + Key pattern: Two-tier serialization + - SimplifiedFinding: minimal fields for lists (fast, low tokens) + - DetailedFinding: full fields for single item (complete info) + """ + + model_config = ConfigDict(frozen=True) + + id: str = Field(description="Finding UUID") + uid: str = Field(description="Unique finding identifier") + status: Literal["FAIL", "PASS", "MANUAL"] = Field(description="Finding status") + severity: str = Field(description="Severity level") + check_id: str = Field(description="Check ID that generated this finding") + resource_name: str | None = Field(default=None, description="Affected resource") + + @classmethod + def from_api_response(cls, data: dict) -> "SimplifiedFinding": + """Transform JSON:API response to model.""" + attributes = data["attributes"] + return cls( + id=data["id"], + uid=attributes["uid"], + status=attributes["status"], + severity=attributes["severity"], + check_id=attributes["check_id"], + resource_name=attributes.get("resource_name"), + ) + + +class DetailedFinding(SimplifiedFinding): + """ + Full finding details - extends SimplifiedFinding. + + Key pattern: Inheritance for two-tier serialization. + """ + + status_extended: str = Field(description="Detailed status message") + region: str | None = Field(default=None, description="Cloud region") + remediation: CheckRemediation | None = Field(default=None, description="How to fix") + + @classmethod + def from_api_response(cls, data: dict) -> "DetailedFinding": + """Transform JSON:API response to detailed model.""" + attributes = data["attributes"] + check_metadata = attributes.get("check_metadata", {}) + remediation_data = check_metadata.get("Remediation", {}) + + return cls( + id=data["id"], + uid=attributes["uid"], + status=attributes["status"], + severity=attributes["severity"], + check_id=attributes["check_id"], + resource_name=attributes.get("resource_name"), + status_extended=attributes.get("status_extended", ""), + region=attributes.get("region"), + remediation=( + CheckRemediation( + cli=remediation_data.get("Code", {}).get("CLI"), + terraform=remediation_data.get("Code", {}).get("Terraform"), + recommendation=remediation_data.get("Recommendation", {}).get( + "Text" + ), + ) + if remediation_data + else None + ), + ) + + +class FindingsListResponse(BaseModel): + """Wrapper for list responses with pagination.""" + + findings: list[SimplifiedFinding] + total: int + page: int + page_size: int + + @classmethod + def from_api_response(cls, data: dict) -> "FindingsListResponse": + findings = [ + SimplifiedFinding.from_api_response(f) for f in data.get("data", []) + ] + meta = data.get("meta", {}).get("pagination", {}) + return cls( + findings=findings, + total=meta.get("count", len(findings)), + page=meta.get("page", 1), + page_size=meta.get("page_size", len(findings)), + ) diff --git a/skills/prowler-mcp/assets/tool_implementation.py b/skills/prowler-mcp/assets/tool_implementation.py new file mode 100644 index 0000000000..87daa4b5e5 --- /dev/null +++ b/skills/prowler-mcp/assets/tool_implementation.py @@ -0,0 +1,95 @@ +# Example: Tool Implementation (FindingsTools) +# Source: mcp_server/prowler_mcp_server/prowler_app/tools/findings.py + +from typing import Any, Literal + +from prowler_mcp_server.prowler_app.models.findings import ( + DetailedFinding, + FindingsListResponse, +) +from prowler_mcp_server.prowler_app.tools.base import BaseTool +from pydantic import Field + + +class FindingsTools(BaseTool): + """ + MCP tools for security findings. + + Key patterns: + 1. Extends BaseTool (no need to override register_tools) + 2. Each async method becomes a tool automatically + 3. Use pydantic.Field() for parameter documentation + 4. Return dict from model_dump() for serialization + """ + + async def search_security_findings( + self, + severity: list[ + Literal["critical", "high", "medium", "low", "informational"] + ] = Field( + default=[], + description="Filter by severity levels. Multiple values allowed.", + ), + status: list[Literal["FAIL", "PASS", "MANUAL"]] = Field( + default=["FAIL"], + description="Filter by finding status. Default: ['FAIL'].", + ), + provider_type: list[str] = Field( + default=[], + description="Filter by cloud provider (aws, azure, gcp, etc.).", + ), + page_size: int = Field( + default=50, + description="Number of results per page.", + ), + page_number: int = Field( + default=1, + description="Page number (1-indexed).", + ), + ) -> dict[str, Any]: + """ + Search security findings with rich filtering. + + Returns simplified finding data optimized for LLM consumption. + """ + # Validate page size + self.api_client.validate_page_size(page_size) + + # Build query parameters + params = { + "page[size]": page_size, + "page[number]": page_number, + } + if severity: + params["filter[severity__in]"] = ",".join(severity) + if status: + params["filter[status__in]"] = ",".join(status) + if provider_type: + params["filter[provider_type__in]"] = ",".join(provider_type) + + # Make API request + api_response = await self.api_client.get("/findings", params=params) + + # Transform to simplified model and return + simplified_response = FindingsListResponse.from_api_response(api_response) + return simplified_response.model_dump() + + async def get_finding_details( + self, + finding_id: str = Field( + description="UUID of the finding to retrieve.", + ), + ) -> dict[str, Any]: + """ + Get comprehensive details for a specific finding. + + Returns full finding data including remediation steps. + """ + params = {"include": "resources,scan"} + api_response = await self.api_client.get( + f"/findings/{finding_id}", params=params + ) + detailed_finding = DetailedFinding.from_api_response( + api_response.get("data", {}) + ) + return detailed_finding.model_dump() diff --git a/skills/prowler-pr/SKILL.md b/skills/prowler-pr/SKILL.md new file mode 100644 index 0000000000..d5e743e18e --- /dev/null +++ b/skills/prowler-pr/SKILL.md @@ -0,0 +1,125 @@ +--- +name: prowler-pr +description: > + Creates Pull Requests for Prowler following the project template and conventions. + Trigger: When user asks to create a PR, submit changes, or open a pull request. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## PR Creation Process + +1. **Analyze changes**: `git diff main...HEAD` to understand ALL commits +2. **Determine affected components**: SDK, API, UI, MCP, Docs +3. **Fill template sections** based on changes +4. **Create PR** with `gh pr create` + +## PR Template Structure + +```markdown +### Context + +{Why this change? Link issues with `Fix #XXXX`} + +### Description + +{Summary of changes and dependencies} + +### Steps to review + +{How to test/verify the changes} + +### Checklist + +
+ +Community Checklist + +- [ ] This feature/issue is listed in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com +- [ ] Is it assigned to me, if not, request it via the issue/feature in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](goto.prowler.com/slack) + +
+ +- Are there new checks included in this PR? Yes / No + - If so, do we need to update permissions for the provider? +- [ ] Review if the code is being covered by tests. +- [ ] Review if code is being documented following https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings +- [ ] Review if backport is needed. +- [ ] Review if is needed to change the Readme.md +- [ ] Ensure new entries are added to CHANGELOG.md, if applicable. + +#### SDK/CLI +- Are there new checks included in this PR? Yes / No + - If so, do we need to update permissions for the provider? Please review this carefully. + +#### UI (if applicable) +- [ ] All issue/task requirements work as expected on the UI +- [ ] Screenshots/Video - Mobile (X < 640px) +- [ ] Screenshots/Video - Tablet (640px > X < 1024px) +- [ ] Screenshots/Video - Desktop (X > 1024px) +- [ ] Ensure new entries are added to ui/CHANGELOG.md + +#### API (if applicable) +- [ ] Verify if API specs need to be regenerated. +- [ ] Check if version updates are required. +- [ ] Ensure new entries are added to api/CHANGELOG.md + +### License + +By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license. +``` + +## Component-Specific Rules + +| Component | CHANGELOG | Extra Checks | +|-----------|-----------|--------------| +| SDK | `prowler/CHANGELOG.md` | New checks → permissions update? | +| API | `api/CHANGELOG.md` | API specs regeneration, version bump | +| UI | `ui/CHANGELOG.md` | Screenshots for Mobile/Tablet/Desktop | +| MCP | `mcp_server/CHANGELOG.md` | N/A | + +## Commands + +```bash +# Check current branch status +git status +git log main..HEAD --oneline + +# View full diff +git diff main...HEAD + +# Create PR with heredoc for body +gh pr create --title "feat: description" --body "$(cat <<'EOF' +### Context +... +EOF +)" + +# Create draft PR +gh pr create --draft --title "feat: description" +``` + +## Title Conventions + +Follow conventional commits: +- `feat:` New feature +- `fix:` Bug fix +- `docs:` Documentation +- `chore:` Maintenance +- `refactor:` Code restructure +- `test:` Tests + +## Before Creating PR + +1. ✅ All tests pass locally +2. ✅ Linting passes (`make lint` or component-specific) +3. ✅ CHANGELOG updated (if applicable) +4. ✅ Branch is up to date with main +5. ✅ Commits are clean and descriptive + +## Resources + +- **Documentation**: See [references/](references/) for links to local developer guide diff --git a/skills/prowler-pr/references/pr-docs.md b/skills/prowler-pr/references/pr-docs.md new file mode 100644 index 0000000000..3fb1a7ce83 --- /dev/null +++ b/skills/prowler-pr/references/pr-docs.md @@ -0,0 +1,15 @@ +# Pull Request Documentation + +## Local Documentation + +For PR conventions and workflow, see: + +- `docs/developer-guide/introduction.mdx` - "Sending the Pull Request" section + +## Contents + +The documentation covers: +- PR template requirements +- Commit message conventions +- Review process +- CI/CD checks diff --git a/skills/prowler-provider/SKILL.md b/skills/prowler-provider/SKILL.md new file mode 100644 index 0000000000..493c393f1e --- /dev/null +++ b/skills/prowler-provider/SKILL.md @@ -0,0 +1,143 @@ +--- +name: prowler-provider +description: > + Creates new Prowler cloud providers or adds services to existing providers. + Trigger: When adding a new cloud provider or service to Prowler SDK. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## When to Use + +Use this skill when: +- Adding a new cloud provider to Prowler +- Adding a new service to an existing provider +- Understanding the provider architecture pattern + +## Provider Architecture Pattern + +Every provider MUST follow this structure: + +``` +prowler/providers/{provider}/ +├── __init__.py +├── {provider}_provider.py # Main provider class +├── models.py # Provider-specific models +├── config.py # Provider configuration +├── exceptions/ # Provider-specific exceptions +├── lib/ +│ ├── service/ # Base service class +│ ├── arguments/ # CLI arguments parser +│ └── mutelist/ # Mutelist functionality +└── services/ + └── {service}/ + ├── {service}_service.py # Resource fetcher + ├── {service}_client.py # Python singleton instance + └── {check_name}/ # Individual checks + ├── {check_name}.py + └── {check_name}.metadata.json +``` + +## Provider Class Template + +```python +from prowler.providers.common.provider import Provider + +class {Provider}Provider(Provider): + """Provider class for {Provider} cloud platform.""" + + def __init__(self, arguments): + super().__init__(arguments) + self.session = self._setup_session(arguments) + self.regions = self._get_regions() + + def _setup_session(self, arguments): + """Provider-specific authentication.""" + # Implement credential handling + pass + + def _get_regions(self): + """Get available regions for provider.""" + # Return list of regions + pass +``` + +## Service Class Template + +```python +from prowler.providers.{provider}.lib.service.service import {Provider}Service + +class {Service}({Provider}Service): + """Service class for {service} resources.""" + + def __init__(self, provider): + super().__init__(provider) + self.{resources} = [] + self._fetch_{resources}() + + def _fetch_{resources}(self): + """Fetch {resource} data from API.""" + try: + response = self.client.list_{resources}() + for item in response: + self.{resources}.append( + {Resource}( + id=item["id"], + name=item["name"], + region=item.get("region"), + ) + ) + except Exception as e: + logger.error(f"Error fetching {resources}: {e}") +``` + +## Service Client Template + +```python +from prowler.providers.{provider}.services.{service}.{service}_service import {Service} + +{service}_client = {Service} +``` + +## Supported Providers + +Current providers: +- AWS (Amazon Web Services) +- Azure (Microsoft Azure) +- GCP (Google Cloud Platform) +- Kubernetes +- GitHub +- M365 (Microsoft 365) +- OracleCloud (Oracle Cloud Infrastructure) +- AlibabaCloud +- MongoDB Atlas +- NHN (NHN Cloud) +- LLM (Language Model providers) +- IaC (Infrastructure as Code) + +## Commands + +```bash +# Run provider +poetry run python prowler-cli.py {provider} + +# List services for provider +poetry run python prowler-cli.py {provider} --list-services + +# List checks for provider +poetry run python prowler-cli.py {provider} --list-checks + +# Run specific service +poetry run python prowler-cli.py {provider} --services {service} + +# Debug mode +poetry run python prowler-cli.py {provider} --log-level DEBUG +``` + +## Resources + +- **Templates**: See [assets/](assets/) for Provider, Service, and Client singleton templates +- **Documentation**: See [references/provider-docs.md](references/provider-docs.md) for official Prowler Developer Guide links diff --git a/skills/prowler-provider/assets/client.py b/skills/prowler-provider/assets/client.py new file mode 100644 index 0000000000..ed47f5bc40 --- /dev/null +++ b/skills/prowler-provider/assets/client.py @@ -0,0 +1,56 @@ +# Example: Singleton Client Pattern +# Source: prowler/providers/github/services/repository/repository_client.py + +""" +Singleton Client Pattern + +This pattern is CRITICAL for how Prowler checks access service data. + +How it works: +1. When this module is imported, the service is instantiated ONCE +2. The service fetches all data during __init__ (eager loading) +3. All checks import this singleton and access pre-fetched data +4. No additional API calls needed during check execution + +File: prowler/providers/github/services/repository/repository_client.py +""" + +from prowler.providers.common.provider import Provider +from prowler.providers.github.services.repository.repository_service import Repository + +# SINGLETON: Instantiated once when module is first imported +# Provider.get_global_provider() returns the provider set in __init__ +repository_client = Repository(Provider.get_global_provider()) + + +""" +Usage in checks: + +from prowler.providers.github.services.repository.repository_client import ( + repository_client, +) + +class repository_secret_scanning_enabled(Check): + def execute(self): + findings = [] + for repo in repository_client.repositories.values(): + # Access pre-fetched repository data + report = CheckReportGithub(metadata=self.metadata(), resource=repo) + if repo.secret_scanning_enabled: + report.status = "PASS" + else: + report.status = "FAIL" + findings.append(report) + return findings +""" + + +# Another example for organization service +# File: prowler/providers/github/services/organization/organization_client.py + +# from prowler.providers.common.provider import Provider +# from prowler.providers.github.services.organization.organization_service import ( +# Organization, +# ) +# +# organization_client = Organization(Provider.get_global_provider()) diff --git a/skills/prowler-provider/assets/provider.py b/skills/prowler-provider/assets/provider.py new file mode 100644 index 0000000000..27bc8ff0b9 --- /dev/null +++ b/skills/prowler-provider/assets/provider.py @@ -0,0 +1,143 @@ +# Example: Provider Class Template (GitHub Provider) +# Source: prowler/providers/github/github_provider.py + + +from prowler.config.config import ( + default_config_file_path, + get_default_mute_file_path, + load_and_validate_config_file, +) +from prowler.lib.logger import logger +from prowler.lib.mutelist.mutelist import Mutelist +from prowler.providers.common.models import Audit_Metadata, Connection +from prowler.providers.common.provider import Provider + + +class GithubProvider(Provider): + """ + GitHub Provider - Template for creating new providers. + + Required attributes (from abstract Provider): + - _type: str - Provider identifier + - _session: Session model - Authentication credentials + - _identity: Identity model - Authenticated user info + - _audit_config: dict - Check configuration + - _mutelist: Mutelist - Finding filtering + """ + + _type: str = "github" + _auth_method: str = None + _session: "GithubSession" + _identity: "GithubIdentityInfo" + _audit_config: dict + _mutelist: Mutelist + audit_metadata: Audit_Metadata + + def __init__( + self, + # Authentication credentials + personal_access_token: str = "", + # Provider configuration + config_path: str = None, + config_content: dict = None, + fixer_config: dict = {}, + mutelist_path: str = None, + mutelist_content: dict = None, + # Provider scoping + repositories: list = None, + organizations: list = None, + ): + logger.info("Instantiating GitHub Provider...") + + # Store scoping configuration + self._repositories = repositories or [] + self._organizations = organizations or [] + + # Step 1: Setup session (authentication) + self._session = self.setup_session(personal_access_token) + self._auth_method = "Personal Access Token" + + # Step 2: Setup identity (who is authenticated) + self._identity = self.setup_identity(self._session) + + # Step 3: Load audit config + if config_content: + self._audit_config = config_content + else: + if not config_path: + config_path = default_config_file_path + self._audit_config = load_and_validate_config_file(self._type, config_path) + + # Step 4: Load fixer config + self._fixer_config = fixer_config + + # Step 5: Load mutelist + if mutelist_content: + self._mutelist = GithubMutelist(mutelist_content=mutelist_content) + else: + if not mutelist_path: + mutelist_path = get_default_mute_file_path(self.type) + self._mutelist = GithubMutelist(mutelist_path=mutelist_path) + + # CRITICAL: Register as global provider + Provider.set_global_provider(self) + + # Required property implementations + @property + def type(self) -> str: + return self._type + + @property + def session(self) -> "GithubSession": + return self._session + + @property + def identity(self) -> "GithubIdentityInfo": + return self._identity + + @property + def audit_config(self) -> dict: + return self._audit_config + + @property + def mutelist(self) -> Mutelist: + return self._mutelist + + @staticmethod + def setup_session(personal_access_token: str) -> "GithubSession": + """Create authenticated session from credentials.""" + if not personal_access_token: + raise ValueError("Personal access token required") + return GithubSession(token=personal_access_token) + + @staticmethod + def setup_identity(session: "GithubSession") -> "GithubIdentityInfo": + """Get identity info for authenticated user.""" + # Make API call to get user info + # g = Github(auth=Auth.Token(session.token)) + # user = g.get_user() + return GithubIdentityInfo( + account_id="user-id", + account_name="username", + account_url="https://github.com/username", + ) + + def print_credentials(self): + """Display credentials in CLI output.""" + print(f"GitHub Account: {self.identity.account_name}") + print(f"Auth Method: {self._auth_method}") + + @staticmethod + def test_connection( + personal_access_token: str = None, + raise_on_exception: bool = True, + ) -> Connection: + """Test if credentials can connect to the provider.""" + try: + session = GithubProvider.setup_session(personal_access_token) + GithubProvider.setup_identity(session) + return Connection(is_connected=True) + except Exception as e: + if raise_on_exception: + raise + return Connection(is_connected=False, error=str(e)) diff --git a/skills/prowler-provider/assets/service.py b/skills/prowler-provider/assets/service.py new file mode 100644 index 0000000000..0ad73a9142 --- /dev/null +++ b/skills/prowler-provider/assets/service.py @@ -0,0 +1,119 @@ +# Example: Service Base Class and Implementation +# Source: prowler/providers/github/lib/service/service.py +# Source: prowler/providers/github/services/repository/repository_service.py + +from typing import Optional + +from pydantic.v1 import BaseModel + +from prowler.lib.logger import logger + +# ============================================================ +# Base Service Class +# ============================================================ + + +class GithubService: + """ + Base service class for all GitHub services. + + Key patterns: + 1. Receives provider in __init__ + 2. Creates API clients in __set_clients__ + 3. Stores audit_config and fixer_config for check access + """ + + def __init__(self, service: str, provider: "GithubProvider"): + self.provider = provider + self.clients = self.__set_clients__(provider.session) + self.audit_config = provider.audit_config + self.fixer_config = provider.fixer_config + + def __set_clients__(self, session: "GithubSession") -> list: + """Create API clients based on authentication type.""" + clients = [] + try: + # Create client(s) based on session credentials + # For token auth: single client + # For GitHub App: multiple clients (one per installation) + pass + except Exception as error: + logger.error(f"{error.__class__.__name__}: {error}") + return clients + + +# ============================================================ +# Service Implementation +# ============================================================ + + +class Repository(GithubService): + """ + Repository service - fetches and stores repository data. + + Key patterns: + 1. Inherits from GithubService + 2. Fetches all data in __init__ (eager loading) + 3. Stores data in attributes for check access + 4. Defines Pydantic models for data structures + """ + + def __init__(self, provider: "GithubProvider"): + super().__init__(__class__.__name__, provider) + # Fetch and store data during initialization + self.repositories = self._list_repositories() + + def _list_repositories(self) -> dict: + """List repositories based on provider scoping.""" + logger.info("Repository - Listing Repositories...") + repos = {} + + try: + for client in self.clients: + # Get repos from specified repositories + for repo_name in self.provider.repositories: + repo = client.get_repo(repo_name) + self._process_repository(repo, repos) + + # Get repos from specified organizations + for org_name in self.provider.organizations: + org = client.get_organization(org_name) + for repo in org.get_repos(): + self._process_repository(repo, repos) + except Exception as error: + logger.error(f"{error.__class__.__name__}: {error}") + + return repos + + def _process_repository(self, repo, repos: dict): + """Process a single repository and add to repos dict.""" + repos[repo.id] = Repo( + id=repo.id, + name=repo.name, + owner=repo.owner.login, + full_name=repo.full_name, + private=repo.private, + archived=repo.archived, + ) + + +# ============================================================ +# Pydantic Models for Service Data +# ============================================================ + + +class Repo(BaseModel): + """Model for GitHub Repository.""" + + id: int + name: str + owner: str + full_name: str + private: bool + archived: bool + secret_scanning_enabled: Optional[bool] = None + dependabot_enabled: Optional[bool] = None + + class Config: + # Make model hashable for use as dict key + frozen = True diff --git a/skills/prowler-provider/references/provider-docs.md b/skills/prowler-provider/references/provider-docs.md new file mode 100644 index 0000000000..02261aaad0 --- /dev/null +++ b/skills/prowler-provider/references/provider-docs.md @@ -0,0 +1,28 @@ +# Provider Documentation + +## Local Documentation + +For detailed provider development patterns, see: + +### Core Documentation +- `docs/developer-guide/provider.mdx` - Provider architecture and creation guide +- `docs/developer-guide/services.mdx` - Adding services to existing providers + +### Provider-Specific Details +- `docs/developer-guide/aws-details.mdx` - AWS provider implementation +- `docs/developer-guide/azure-details.mdx` - Azure provider implementation +- `docs/developer-guide/gcp-details.mdx` - GCP provider implementation +- `docs/developer-guide/kubernetes-details.mdx` - Kubernetes provider implementation +- `docs/developer-guide/github-details.mdx` - GitHub provider implementation +- `docs/developer-guide/m365-details.mdx` - Microsoft 365 provider implementation +- `docs/developer-guide/alibabacloud-details.mdx` - Alibaba Cloud provider implementation +- `docs/developer-guide/llm-details.mdx` - LLM provider implementation + +## Contents + +The documentation covers: +- Provider types (SDK, API, Tool/Wrapper) +- Provider class structure and identity +- Service creation patterns +- Client singleton implementation +- Provider-specific authentication and API patterns diff --git a/skills/prowler-sdk-check/SKILL.md b/skills/prowler-sdk-check/SKILL.md new file mode 100644 index 0000000000..f032f6b590 --- /dev/null +++ b/skills/prowler-sdk-check/SKILL.md @@ -0,0 +1,257 @@ +--- +name: prowler-sdk-check +description: > + Creates Prowler security checks following SDK architecture patterns. + Trigger: When user asks to create a new security check for any provider (AWS, Azure, GCP, K8s, GitHub, etc.) +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## Check Structure + +``` +prowler/providers/{provider}/services/{service}/{check_name}/ +├── __init__.py +├── {check_name}.py +└── {check_name}.metadata.json +``` + +--- + +## Step-by-Step Creation Process + +### 1. Prerequisites + +- **Verify check doesn't exist**: Search `prowler/providers/{provider}/services/{service}/` +- **Ensure provider and service exist** - create them first if not +- **Confirm service has required methods** - may need to add/modify service methods to get data + +### 2. Create Check Files + +```bash +mkdir -p prowler/providers/{provider}/services/{service}/{check_name} +touch prowler/providers/{provider}/services/{service}/{check_name}/__init__.py +touch prowler/providers/{provider}/services/{service}/{check_name}/{check_name}.py +touch prowler/providers/{provider}/services/{service}/{check_name}/{check_name}.metadata.json +``` + +### 3. Implement Check Logic + +```python +from prowler.lib.check.models import Check, Check_Report_{Provider} +from prowler.providers.{provider}.services.{service}.{service}_client import {service}_client + +class {check_name}(Check): + """Ensure that {resource} meets {security_requirement}.""" + def execute(self) -> list[Check_Report_{Provider}]: + """Execute the check logic. + + Returns: + A list of reports containing the result of the check. + """ + findings = [] + for resource in {service}_client.{resources}: + report = Check_Report_{Provider}(metadata=self.metadata(), resource=resource) + report.status = "PASS" if resource.is_compliant else "FAIL" + report.status_extended = f"Resource {resource.name} compliance status." + findings.append(report) + return findings +``` + +### 4. Create Metadata File + +See complete schema below and `assets/` folder for complete templates. +For detailed field documentation, see `references/metadata-docs.md`. + +### 5. Verify Check Detection + +```bash +poetry run python prowler-cli.py {provider} --list-checks | grep {check_name} +``` + +### 6. Run Check Locally + +```bash +poetry run python prowler-cli.py {provider} --log-level ERROR --verbose --check {check_name} +``` + +### 7. Create Tests + +See `prowler-test-sdk` skill for test patterns (PASS, FAIL, no resources, error handling). + +--- + +## Check Naming Convention + +``` +{service}_{resource}_{security_control} +``` + +Examples: +- `ec2_instance_public_ip_disabled` +- `s3_bucket_encryption_enabled` +- `iam_user_mfa_enabled` + +--- + +## Metadata Schema (COMPLETE) + +```json +{ + "Provider": "aws", + "CheckID": "{check_name}", + "CheckTitle": "Human-readable title", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], + "ServiceName": "{service}", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "low|medium|high|critical", + "ResourceType": "AwsEc2Instance|Other", + "ResourceGroup": "security|compute|storage|network", + "Description": "**Bold resource name**. Detailed explanation of what this check evaluates and why it matters.", + "Risk": "What happens if non-compliant. Explain attack vectors, data exposure risks, compliance impact.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/..." + ], + "Remediation": { + "Code": { + "CLI": "aws {service} {command} --option value", + "NativeIaC": "```yaml\nResources:\n Resource:\n Type: AWS::{Service}::{Resource}\n Properties:\n Key: value # This line fixes the issue\n```", + "Other": "1. Console steps\n2. Step by step", + "Terraform": "```hcl\nresource \"aws_{service}_{resource}\" \"example\" {\n key = \"value\" # This line fixes the issue\n}\n```" + }, + "Recommendation": { + "Text": "Detailed recommendation for remediation.", + "Url": "https://hub.prowler.com/check/{check_name}" + } + }, + "Categories": [ + "identity-access", + "encryption", + "logging", + "forensics-ready", + "internet-exposed", + "trust-boundaries" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} +``` + +### Required Fields + +| Field | Description | +|-------|-------------| +| `Provider` | Provider name: aws, azure, gcp, kubernetes, github, m365 | +| `CheckID` | Must match class name and folder name | +| `CheckTitle` | Human-readable title | +| `Severity` | `low`, `medium`, `high`, `critical` | +| `ServiceName` | Service being checked | +| `Description` | What the check evaluates | +| `Risk` | Security impact of non-compliance | +| `Remediation.Code.CLI` | CLI fix command | +| `Remediation.Recommendation.Text` | How to fix | + +### Severity Guidelines + +| Severity | When to Use | +|----------|-------------| +| `critical` | Direct data exposure, RCE, privilege escalation | +| `high` | Significant security risk, compliance violation | +| `medium` | Defense-in-depth, best practice | +| `low` | Informational, minor hardening | + +--- + +## Check Report Statuses + +| Status | When to Use | +|--------|-------------| +| `PASS` | Resource is compliant | +| `FAIL` | Resource is non-compliant | +| `MANUAL` | Requires human verification | + +--- + +## Common Patterns + +### AWS Check with Regional Resources + +```python +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.s3.s3_client import s3_client + +class s3_bucket_encryption_enabled(Check): + def execute(self) -> list[Check_Report_AWS]: + findings = [] + for bucket in s3_client.buckets.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource=bucket) + if bucket.encryption: + report.status = "PASS" + report.status_extended = f"S3 bucket {bucket.name} has encryption enabled." + else: + report.status = "FAIL" + report.status_extended = f"S3 bucket {bucket.name} does not have encryption enabled." + findings.append(report) + return findings +``` + +### Check with Multiple Conditions + +```python +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.ec2.ec2_client import ec2_client + +class ec2_instance_hardened(Check): + def execute(self) -> list[Check_Report_AWS]: + findings = [] + for instance in ec2_client.instances: + report = Check_Report_AWS(metadata=self.metadata(), resource=instance) + + issues = [] + if instance.public_ip: + issues.append("has public IP") + if not instance.metadata_options.http_tokens == "required": + issues.append("IMDSv2 not enforced") + + if issues: + report.status = "FAIL" + report.status_extended = f"Instance {instance.id} {', '.join(issues)}." + else: + report.status = "PASS" + report.status_extended = f"Instance {instance.id} is properly hardened." + + findings.append(report) + return findings +``` + +--- + +## Commands + +```bash +# Verify detection +poetry run python prowler-cli.py {provider} --list-checks | grep {check_name} + +# Run check +poetry run python prowler-cli.py {provider} --log-level ERROR --verbose --check {check_name} + +# Run with specific profile/credentials +poetry run python prowler-cli.py aws --profile myprofile --check {check_name} + +# Run multiple checks +poetry run python prowler-cli.py {provider} --check {check1} {check2} {check3} +``` + +## Resources + +- **Templates**: See [assets/](assets/) for complete check and metadata templates (AWS, Azure, GCP) +- **Documentation**: See [references/metadata-docs.md](references/metadata-docs.md) for official Prowler Developer Guide links diff --git a/skills/prowler-sdk-check/assets/aws_check.py b/skills/prowler-sdk-check/assets/aws_check.py new file mode 100644 index 0000000000..9dd1f5c109 --- /dev/null +++ b/skills/prowler-sdk-check/assets/aws_check.py @@ -0,0 +1,20 @@ +# Example: AWS S3 Bucket Encryption Check +# Source: prowler/providers/aws/services/s3/s3_bucket_default_encryption/ + +from prowler.lib.check.models import Check, Check_Report_AWS +from prowler.providers.aws.services.s3.s3_client import s3_client + + +class s3_bucket_default_encryption(Check): + def execute(self): + findings = [] + for bucket in s3_client.buckets.values(): + report = Check_Report_AWS(metadata=self.metadata(), resource=bucket) + if bucket.encryption: + report.status = "PASS" + report.status_extended = f"S3 Bucket {bucket.name} has Server Side Encryption with {bucket.encryption}." + else: + report.status = "FAIL" + report.status_extended = f"S3 Bucket {bucket.name} does not have Server Side Encryption enabled." + findings.append(report) + return findings diff --git a/skills/prowler-sdk-check/assets/aws_metadata.json b/skills/prowler-sdk-check/assets/aws_metadata.json new file mode 100644 index 0000000000..fbf1e657dd --- /dev/null +++ b/skills/prowler-sdk-check/assets/aws_metadata.json @@ -0,0 +1,35 @@ +{ + "Provider": "aws", + "CheckID": "s3_bucket_default_encryption", + "CheckTitle": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.", + "CheckType": [ + "Data Protection" + ], + "ServiceName": "s3", + "SubServiceName": "", + "ResourceIdTemplate": "arn:partition:s3:::bucket_name", + "Severity": "medium", + "ResourceType": "AwsS3Bucket", + "ResourceGroup": "storage", + "Description": "Check if S3 buckets have default encryption (SSE) enabled or use a bucket policy to enforce it.", + "Risk": "Amazon S3 default encryption provides a way to set the default encryption behavior for an S3 bucket. This will ensure data-at-rest is encrypted.", + "RelatedUrl": "", + "Remediation": { + "Code": { + "CLI": "aws s3api put-bucket-encryption --bucket --server-side-encryption-configuration '{\"Rules\": [{\"ApplyServerSideEncryptionByDefault\": {\"SSEAlgorithm\": \"AES256\"}}]}'", + "NativeIaC": "https://docs.prowler.com/checks/aws/s3-policies/s3_14-data-encrypted-at-rest#cloudformation", + "Other": "", + "Terraform": "https://docs.prowler.com/checks/aws/s3-policies/s3_14-data-encrypted-at-rest#terraform" + }, + "Recommendation": { + "Text": "Ensure that S3 buckets have encryption at rest enabled.", + "Url": "https://aws.amazon.com/blogs/security/how-to-prevent-uploads-of-unencrypted-objects-to-amazon-s3/" + } + }, + "Categories": [ + "encryption" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/skills/prowler-sdk-check/assets/azure_check.py b/skills/prowler-sdk-check/assets/azure_check.py new file mode 100644 index 0000000000..f7e036e7a5 --- /dev/null +++ b/skills/prowler-sdk-check/assets/azure_check.py @@ -0,0 +1,25 @@ +# Example: Azure Storage Secure Transfer Check +# Source: prowler/providers/azure/services/storage/storage_secure_transfer_required_is_enabled/ + +from prowler.lib.check.models import Check, Check_Report_Azure +from prowler.providers.azure.services.storage.storage_client import storage_client + + +class storage_secure_transfer_required_is_enabled(Check): + def execute(self) -> list[Check_Report_Azure]: + findings = [] + for subscription, storage_accounts in storage_client.storage_accounts.items(): + for storage_account in storage_accounts: + report = Check_Report_Azure( + metadata=self.metadata(), resource=storage_account + ) + report.subscription = subscription + report.status = "PASS" + report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required enabled." + if not storage_account.enable_https_traffic_only: + report.status = "FAIL" + report.status_extended = f"Storage account {storage_account.name} from subscription {subscription} has secure transfer required disabled." + + findings.append(report) + + return findings diff --git a/skills/prowler-sdk-check/assets/azure_metadata.json b/skills/prowler-sdk-check/assets/azure_metadata.json new file mode 100644 index 0000000000..e278849592 --- /dev/null +++ b/skills/prowler-sdk-check/assets/azure_metadata.json @@ -0,0 +1,33 @@ +{ + "Provider": "azure", + "CheckID": "storage_secure_transfer_required_is_enabled", + "CheckTitle": "Ensure that all data transferred between clients and your Azure Storage account is encrypted using the HTTPS protocol.", + "CheckType": [], + "ServiceName": "storage", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "AzureStorageAccount", + "ResourceGroup": "storage", + "Description": "Ensure that all data transferred between clients and your Azure Storage account is encrypted using the HTTPS protocol.", + "Risk": "Requests to the storage account sent outside of a secure connection can be eavesdropped", + "RelatedUrl": "", + "Remediation": { + "Code": { + "CLI": "az storage account update --name --https-only true", + "NativeIaC": "", + "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/azure/StorageAccounts/secure-transfer-required.html", + "Terraform": "https://docs.prowler.com/checks/azure/azure-networking-policies/ensure-that-storage-account-enables-secure-transfer" + }, + "Recommendation": { + "Text": "Enable data encryption in transit.", + "Url": "" + } + }, + "Categories": [ + "encryption" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/skills/prowler-sdk-check/assets/gcp_check.py b/skills/prowler-sdk-check/assets/gcp_check.py new file mode 100644 index 0000000000..164a2b0a3d --- /dev/null +++ b/skills/prowler-sdk-check/assets/gcp_check.py @@ -0,0 +1,29 @@ +# Example: GCP Cloud Storage Bucket Versioning Check +# Source: prowler/providers/gcp/services/cloudstorage/cloudstorage_bucket_versioning_enabled/ + +from prowler.lib.check.models import Check, Check_Report_GCP +from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import ( + cloudstorage_client, +) + + +class cloudstorage_bucket_versioning_enabled(Check): + """Ensure Cloud Storage buckets have Object Versioning enabled.""" + + def execute(self) -> list[Check_Report_GCP]: + findings = [] + for bucket in cloudstorage_client.buckets: + report = Check_Report_GCP(metadata=self.metadata(), resource=bucket) + report.status = "FAIL" + report.status_extended = ( + f"Bucket {bucket.name} does not have Object Versioning enabled." + ) + + if bucket.versioning_enabled: + report.status = "PASS" + report.status_extended = ( + f"Bucket {bucket.name} has Object Versioning enabled." + ) + + findings.append(report) + return findings diff --git a/skills/prowler-sdk-check/assets/gcp_metadata.json b/skills/prowler-sdk-check/assets/gcp_metadata.json new file mode 100644 index 0000000000..b6e28b0e17 --- /dev/null +++ b/skills/prowler-sdk-check/assets/gcp_metadata.json @@ -0,0 +1,37 @@ +{ + "Provider": "gcp", + "CheckID": "cloudstorage_bucket_versioning_enabled", + "CheckTitle": "Cloud Storage buckets have Object Versioning enabled", + "CheckType": [], + "ServiceName": "cloudstorage", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "storage.googleapis.com/Bucket", + "ResourceGroup": "storage", + "Description": "Google Cloud Storage buckets are evaluated to ensure that Object Versioning is enabled.", + "Risk": "Buckets without Object Versioning enabled cannot recover previous object versions after accidental deletion or overwrites.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudStorage/enable-versioning.html", + "https://cloud.google.com/storage/docs/object-versioning" + ], + "Remediation": { + "Code": { + "CLI": "gcloud storage buckets update gs:// --versioning", + "NativeIaC": "", + "Other": "1) Open Google Cloud Console -> Storage -> Buckets\n2) Select the bucket\n3) Click 'Edit bucket' -> 'Protection'\n4) Enable 'Object versioning'\n5) Save", + "Terraform": "resource \"google_storage_bucket\" \"example\" {\n versioning {\n enabled = true\n }\n}" + }, + "Recommendation": { + "Text": "Enable Object Versioning on Cloud Storage buckets to protect against accidental data loss.", + "Url": "https://hub.prowler.com/check/cloudstorage_bucket_versioning_enabled" + } + }, + "Categories": [ + "resilience" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/skills/prowler-sdk-check/references/metadata-docs.md b/skills/prowler-sdk-check/references/metadata-docs.md new file mode 100644 index 0000000000..63a702a9d0 --- /dev/null +++ b/skills/prowler-sdk-check/references/metadata-docs.md @@ -0,0 +1,19 @@ +# Check Documentation + +## Local Documentation + +For detailed check development patterns, see: + +- `docs/developer-guide/checks.mdx` - Complete guide for creating security checks +- `docs/developer-guide/check-metadata-guidelines.mdx` - Metadata writing standards and best practices +- `docs/developer-guide/configurable-checks.mdx` - Using audit_config for configurable checks +- `docs/developer-guide/renaming-checks.mdx` - Guidelines for renaming existing checks + +## Contents + +The documentation covers: +- Check structure and naming conventions +- Metadata schema and field descriptions +- Check implementation patterns per provider +- Configurable check parameters +- Check renaming procedures diff --git a/skills/prowler-test-api/SKILL.md b/skills/prowler-test-api/SKILL.md new file mode 100644 index 0000000000..b53eddc44b --- /dev/null +++ b/skills/prowler-test-api/SKILL.md @@ -0,0 +1,118 @@ +--- +name: prowler-test-api +description: > + Testing patterns for Prowler API: ViewSets, Celery tasks, RLS isolation, RBAC. + Trigger: When writing tests for api/ - viewsets, serializers, tasks, models. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## Critical Rules + +- ALWAYS use `response.json()["data"]` not `response.data` +- ALWAYS use `content_type = "application/vnd.api+json"` in requests +- ALWAYS test cross-tenant isolation with `other_tenant_provider` fixture +- NEVER skip RLS isolation tests when adding new endpoints + +--- + +## 1. JSON:API Format (Critical) + +```python +content_type = "application/vnd.api+json" + +payload = { + "data": { + "type": "providers", # Plural, kebab-case + "id": str(resource.id), # Required for PATCH + "attributes": {"alias": "updated"}, + } +} + +response.json()["data"]["attributes"]["alias"] +``` + +--- + +## 2. RLS Isolation Tests + +```python +def test_cross_tenant_access_denied(self, authenticated_client, other_tenant_provider): + """User cannot see resources from other tenants.""" + response = authenticated_client.get( + reverse("provider-detail", args=[other_tenant_provider.id]) + ) + assert response.status_code == status.HTTP_404_NOT_FOUND +``` + +--- + +## 3. RBAC Tests + +```python +def test_unlimited_visibility_sees_all(self, authenticated_client_admin, providers_fixture): + response = authenticated_client_admin.get(reverse("provider-list")) + assert len(response.json()["data"]) == len(providers_fixture) + +def test_limited_visibility_sees_only_assigned(self, authenticated_client_limited): + # User with unlimited_visibility=False sees only providers in their provider_groups + pass + +def test_permission_required(self, authenticated_client_readonly): + response = authenticated_client_readonly.post(reverse("provider-list"), ...) + assert response.status_code == status.HTTP_403_FORBIDDEN +``` + +--- + +## 4. Managers (objects vs all_objects) + +```python +def test_objects_excludes_deleted(self): + deleted_provider = Provider.objects.create(..., is_deleted=True) + assert deleted_provider not in Provider.objects.all() + assert deleted_provider in Provider.all_objects.all() +``` + +--- + +## 5. Celery Task Tests + +```python +@patch("tasks.tasks.perform_prowler_scan") +def test_task_success(self, mock_scan): + mock_scan.return_value = {"findings_count": 100} + result = perform_scan_task(tenant_id="...", scan_id="...", provider_id="...") + assert result["findings_count"] == 100 +``` + +--- + +## 6. Key Fixtures + +| Fixture | Description | +|---------|-------------| +| `create_test_user` | Session user (dev@prowler.com) | +| `tenants_fixture` | 3 tenants (2 with membership, 1 isolated) | +| `providers_fixture` | Providers in tenant 1 | +| `other_tenant_provider` | Provider in isolated tenant (RLS tests) | +| `authenticated_client` | Client with JWT for tenant 1 | + +--- + +## Commands + +```bash +cd api && poetry run pytest -x --tb=short +cd api && poetry run pytest -k "test_provider" +cd api && poetry run pytest -k "TestRBAC" +``` + +--- + +## Resources + +- **Documentation**: See [references/test-api-docs.md](references/test-api-docs.md) for local file paths and documentation diff --git a/skills/prowler-test-api/references/test-api-docs.md b/skills/prowler-test-api/references/test-api-docs.md new file mode 100644 index 0000000000..2aa3e0134f --- /dev/null +++ b/skills/prowler-test-api/references/test-api-docs.md @@ -0,0 +1,18 @@ +# API Test Documentation + +## Local Documentation + +For API testing patterns, see: + +- `api/src/backend/conftest.py` - All fixtures +- `api/src/backend/api/tests/` - API tests +- `api/src/backend/tasks/tests/` - Task tests + +## Contents + +The documentation covers: +- JSON:API format for requests/responses +- RLS isolation test patterns +- RBAC permission tests +- Celery task mocking +- Test fixtures and their usage diff --git a/skills/prowler-test-sdk/SKILL.md b/skills/prowler-test-sdk/SKILL.md new file mode 100644 index 0000000000..f9e08b5811 --- /dev/null +++ b/skills/prowler-test-sdk/SKILL.md @@ -0,0 +1,321 @@ +--- +name: prowler-test-sdk +description: > + Testing patterns for Prowler SDK (Python). + Trigger: When writing tests for checks, services, or providers. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +> **Generic Patterns**: For base pytest patterns (fixtures, mocking, parametrize, markers), see the `pytest` skill. +> This skill covers **Prowler-specific** conventions only. +> +> **Full Documentation**: `docs/developer-guide/unit-testing.mdx` + +## CRITICAL: Provider-Specific Testing + +| Provider | Mocking Approach | Decorator | +|----------|------------------|-----------| +| **AWS** | `moto` library | `@mock_aws` | +| **Azure, GCP, K8s, others** | `MagicMock` | None | + +**NEVER use moto for non-AWS providers. NEVER use MagicMock for AWS.** + +--- + +## AWS Check Test Pattern + +```python +from unittest import mock +from boto3 import client +from moto import mock_aws +from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider + + +class Test_{check_name}: + @mock_aws + def test_no_resources(self): + from prowler.providers.aws.services.{service}.{service}_service import {ServiceClass} + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ): + with mock.patch( + "prowler.providers.aws.services.{service}.{check_name}.{check_name}.{service}_client", + new={ServiceClass}(aws_provider), + ): + from prowler.providers.aws.services.{service}.{check_name}.{check_name} import ( + {check_name}, + ) + + check = {check_name}() + result = check.execute() + + assert len(result) == 0 + + @mock_aws + def test_{check_name}_pass(self): + # Setup AWS resources with moto + {service}_client = client("{service}", region_name=AWS_REGION_US_EAST_1) + # Create compliant resource... + + from prowler.providers.aws.services.{service}.{service}_service import {ServiceClass} + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ): + with mock.patch( + "prowler.providers.aws.services.{service}.{check_name}.{check_name}.{service}_client", + new={ServiceClass}(aws_provider), + ): + from prowler.providers.aws.services.{service}.{check_name}.{check_name} import ( + {check_name}, + ) + + check = {check_name}() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + + @mock_aws + def test_{check_name}_fail(self): + # Setup AWS resources with moto + {service}_client = client("{service}", region_name=AWS_REGION_US_EAST_1) + # Create non-compliant resource... + + from prowler.providers.aws.services.{service}.{service}_service import {ServiceClass} + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ): + with mock.patch( + "prowler.providers.aws.services.{service}.{check_name}.{check_name}.{service}_client", + new={ServiceClass}(aws_provider), + ): + from prowler.providers.aws.services.{service}.{check_name}.{check_name} import ( + {check_name}, + ) + + check = {check_name}() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" +``` + +> **Critical**: Always import the check INSIDE the mock.patch context to ensure proper client mocking. + +--- + +## Azure Check Test Pattern + +**NO moto decorator. Use MagicMock to mock the service client directly.** + +```python +from unittest import mock +from uuid import uuid4 + +from prowler.providers.azure.services.{service}.{service}_service import {ResourceModel} +from tests.providers.azure.azure_fixtures import ( + AZURE_SUBSCRIPTION_ID, + set_mocked_azure_provider, +) + + +class Test_{check_name}: + def test_no_resources(self): + {service}_client = mock.MagicMock + {service}_client.{resources} = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.{service}.{check_name}.{check_name}.{service}_client", + new={service}_client, + ), + ): + from prowler.providers.azure.services.{service}.{check_name}.{check_name} import ( + {check_name}, + ) + + check = {check_name}() + result = check.execute() + assert len(result) == 0 + + def test_{check_name}_pass(self): + resource_id = str(uuid4()) + resource_name = "Test Resource" + + {service}_client = mock.MagicMock + {service}_client.{resources} = { + AZURE_SUBSCRIPTION_ID: { + resource_id: {ResourceModel}( + id=resource_id, + name=resource_name, + location="westeurope", + # ... compliant attributes + ) + } + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.{service}.{check_name}.{check_name}.{service}_client", + new={service}_client, + ), + ): + from prowler.providers.azure.services.{service}.{check_name}.{check_name} import ( + {check_name}, + ) + + check = {check_name}() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION_ID + assert result[0].resource_name == resource_name + + def test_{check_name}_fail(self): + resource_id = str(uuid4()) + resource_name = "Test Resource" + + {service}_client = mock.MagicMock + {service}_client.{resources} = { + AZURE_SUBSCRIPTION_ID: { + resource_id: {ResourceModel}( + id=resource_id, + name=resource_name, + location="westeurope", + # ... non-compliant attributes + ) + } + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.{service}.{check_name}.{check_name}.{service}_client", + new={service}_client, + ), + ): + from prowler.providers.azure.services.{service}.{check_name}.{check_name} import ( + {check_name}, + ) + + check = {check_name}() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" +``` + +--- + +## GCP/Kubernetes/Other Providers + +Follow the same MagicMock pattern as Azure: + +```python +from tests.providers.gcp.gcp_fixtures import set_mocked_gcp_provider, GCP_PROJECT_ID +from tests.providers.kubernetes.kubernetes_fixtures import set_mocked_kubernetes_provider +``` + +**Key difference**: Each provider has its own fixtures file with `set_mocked_{provider}_provider`. + +--- + +## Provider Fixtures Reference + +| Provider | Fixtures File | Key Constants | +|----------|---------------|---------------| +| AWS | `tests/providers/aws/utils.py` | `AWS_REGION_US_EAST_1`, `AWS_ACCOUNT_NUMBER` | +| Azure | `tests/providers/azure/azure_fixtures.py` | `AZURE_SUBSCRIPTION_ID` | +| GCP | `tests/providers/gcp/gcp_fixtures.py` | `GCP_PROJECT_ID` | +| K8s | `tests/providers/kubernetes/kubernetes_fixtures.py` | - | + +--- + +## Test File Structure + +``` +tests/providers/{provider}/services/{service}/ +├── {service}_service_test.py # Service tests +└── {check_name}/ + └── {check_name}_test.py # Check tests +``` + +--- + +## Required Test Scenarios + +Every check MUST test: + +| Scenario | Expected | +|----------|----------| +| Resource compliant | `status == "PASS"` | +| Resource non-compliant | `status == "FAIL"` | +| No resources | `len(results) == 0` | + +--- + +## Assertions to Include + +```python +# Always verify these +assert result[0].status == "PASS" # or "FAIL" +assert result[0].status_extended == "Expected message..." +assert result[0].resource_id == expected_id +assert result[0].resource_name == expected_name + +# Provider-specific +assert result[0].region == "us-east-1" # AWS +assert result[0].subscription == AZURE_SUBSCRIPTION_ID # Azure +assert result[0].project_id == GCP_PROJECT_ID # GCP +``` + +--- + +## Commands + +```bash +# All SDK tests +poetry run pytest -n auto -vvv tests/ + +# Specific provider +poetry run pytest tests/providers/{provider}/ -v + +# Specific check +poetry run pytest tests/providers/{provider}/services/{service}/{check_name}/ -v + +# Stop on first failure +poetry run pytest -x tests/ +``` + +## Resources + +- **Templates**: See [assets/](assets/) for complete test templates (AWS with moto, Azure/GCP with MagicMock) +- **Documentation**: See [references/testing-docs.md](references/testing-docs.md) for official Prowler Developer Guide links diff --git a/skills/prowler-test-sdk/assets/aws_test.py b/skills/prowler-test-sdk/assets/aws_test.py new file mode 100644 index 0000000000..2137c5651f --- /dev/null +++ b/skills/prowler-test-sdk/assets/aws_test.py @@ -0,0 +1,149 @@ +# Example: AWS KMS Key Rotation Test +# Source: tests/providers/aws/services/kms/kms_cmk_rotation_enabled/ + +from unittest import mock + +import pytest +from boto3 import client +from moto import mock_aws + +from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider + + +class Test_kms_cmk_rotation_enabled: + @mock_aws + def test_kms_no_key(self): + """Test when no KMS keys exist.""" + from prowler.providers.aws.services.kms.kms_service import KMS + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), + mock.patch( + "prowler.providers.aws.services.kms.kms_cmk_rotation_enabled.kms_cmk_rotation_enabled.kms_client", + new=KMS(aws_provider), + ), + ): + from prowler.providers.aws.services.kms.kms_cmk_rotation_enabled.kms_cmk_rotation_enabled import ( + kms_cmk_rotation_enabled, + ) + + check = kms_cmk_rotation_enabled() + result = check.execute() + + assert len(result) == 0 + + @mock_aws + def test_kms_cmk_rotation_enabled(self): + """Test PASS: KMS key with rotation enabled.""" + # Create mocked AWS resources using boto3 + kms_client = client("kms", region_name=AWS_REGION_US_EAST_1) + key = kms_client.create_key()["KeyMetadata"] + kms_client.enable_key_rotation(KeyId=key["KeyId"]) + + from prowler.providers.aws.services.kms.kms_service import KMS + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), + mock.patch( + "prowler.providers.aws.services.kms.kms_cmk_rotation_enabled.kms_cmk_rotation_enabled.kms_client", + new=KMS(aws_provider), + ), + ): + from prowler.providers.aws.services.kms.kms_cmk_rotation_enabled.kms_cmk_rotation_enabled import ( + kms_cmk_rotation_enabled, + ) + + check = kms_cmk_rotation_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].resource_id == key["KeyId"] + assert result[0].resource_arn == key["Arn"] + + @mock_aws + def test_kms_cmk_rotation_disabled(self): + """Test FAIL: KMS key without rotation enabled.""" + kms_client = client("kms", region_name=AWS_REGION_US_EAST_1) + key = kms_client.create_key()["KeyMetadata"] + # Note: rotation NOT enabled + + from prowler.providers.aws.services.kms.kms_service import KMS + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), + mock.patch( + "prowler.providers.aws.services.kms.kms_cmk_rotation_enabled.kms_cmk_rotation_enabled.kms_client", + new=KMS(aws_provider), + ), + ): + from prowler.providers.aws.services.kms.kms_cmk_rotation_enabled.kms_cmk_rotation_enabled import ( + kms_cmk_rotation_enabled, + ) + + check = kms_cmk_rotation_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_id == key["KeyId"] + + @pytest.mark.parametrize( + "no_of_keys_created,expected_no_of_passes", + [ + (5, 3), + (7, 5), + (10, 8), + ], + ) + @mock_aws + def test_kms_rotation_parametrized( + self, no_of_keys_created: int, expected_no_of_passes: int + ) -> None: + """Parametrized test demonstrating multiple scenarios.""" + kms_client = client("kms", region_name=AWS_REGION_US_EAST_1) + + for i in range(no_of_keys_created): + key = kms_client.create_key()["KeyMetadata"] + if i not in [2, 4]: # Skip enabling rotation for some keys + kms_client.enable_key_rotation(KeyId=key["KeyId"]) + + from prowler.providers.aws.services.kms.kms_service import KMS + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ), + mock.patch( + "prowler.providers.aws.services.kms.kms_cmk_rotation_enabled.kms_cmk_rotation_enabled.kms_client", + new=KMS(aws_provider), + ), + ): + from prowler.providers.aws.services.kms.kms_cmk_rotation_enabled.kms_cmk_rotation_enabled import ( + kms_cmk_rotation_enabled, + ) + + check = kms_cmk_rotation_enabled() + result = check.execute() + + assert len(result) == no_of_keys_created + statuses = [r.status for r in result] + assert statuses.count("PASS") == expected_no_of_passes diff --git a/skills/prowler-test-sdk/assets/azure_test.py b/skills/prowler-test-sdk/assets/azure_test.py new file mode 100644 index 0000000000..4bf85d65e6 --- /dev/null +++ b/skills/prowler-test-sdk/assets/azure_test.py @@ -0,0 +1,137 @@ +# Example: Azure Storage Network Access Rule Test +# Source: tests/providers/azure/services/storage/storage_default_network_access_rule_is_denied/ + +from unittest import mock +from uuid import uuid4 + +from prowler.providers.azure.services.storage.storage_service import ( + Account, + NetworkRuleSet, +) +from tests.providers.azure.azure_fixtures import ( + AZURE_SUBSCRIPTION_ID, + set_mocked_azure_provider, +) + + +class Test_storage_default_network_access_rule_is_denied: + def test_storage_no_storage_accounts(self): + """Test when no storage accounts exist.""" + storage_client = mock.MagicMock + storage_client.storage_accounts = {} + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.storage.storage_default_network_access_rule_is_denied.storage_default_network_access_rule_is_denied.storage_client", + new=storage_client, + ), + ): + from prowler.providers.azure.services.storage.storage_default_network_access_rule_is_denied.storage_default_network_access_rule_is_denied import ( + storage_default_network_access_rule_is_denied, + ) + + check = storage_default_network_access_rule_is_denied() + result = check.execute() + assert len(result) == 0 + + def test_storage_network_access_rule_allowed(self): + """Test FAIL: Network access rule set to Allow.""" + storage_account_id = str(uuid4()) + storage_account_name = "Test Storage Account" + storage_client = mock.MagicMock + storage_client.storage_accounts = { + AZURE_SUBSCRIPTION_ID: [ + Account( + id=storage_account_id, + name=storage_account_name, + resouce_group_name="rg", + enable_https_traffic_only=False, + infrastructure_encryption=False, + allow_blob_public_access=False, + network_rule_set=NetworkRuleSet( + bypass="AzureServices", default_action="Allow" + ), + encryption_type="None", + minimum_tls_version="TLS1_2", + key_expiration_period_in_days=None, + location="westeurope", + private_endpoint_connections=[], + ) + ] + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.storage.storage_default_network_access_rule_is_denied.storage_default_network_access_rule_is_denied.storage_client", + new=storage_client, + ), + ): + from prowler.providers.azure.services.storage.storage_default_network_access_rule_is_denied.storage_default_network_access_rule_is_denied import ( + storage_default_network_access_rule_is_denied, + ) + + check = storage_default_network_access_rule_is_denied() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].subscription == AZURE_SUBSCRIPTION_ID + assert result[0].resource_name == storage_account_name + assert result[0].resource_id == storage_account_id + assert result[0].location == "westeurope" + + def test_storage_network_access_rule_denied(self): + """Test PASS: Network access rule set to Deny.""" + storage_account_id = str(uuid4()) + storage_account_name = "Test Storage Account" + storage_client = mock.MagicMock + storage_client.storage_accounts = { + AZURE_SUBSCRIPTION_ID: [ + Account( + id=storage_account_id, + name=storage_account_name, + resouce_group_name="rg", + enable_https_traffic_only=False, + infrastructure_encryption=False, + allow_blob_public_access=False, + network_rule_set=NetworkRuleSet( + default_action="Deny", bypass="AzureServices" + ), + encryption_type="None", + minimum_tls_version="TLS1_2", + key_expiration_period_in_days=None, + location="westeurope", + private_endpoint_connections=[], + ) + ] + } + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_azure_provider(), + ), + mock.patch( + "prowler.providers.azure.services.storage.storage_default_network_access_rule_is_denied.storage_default_network_access_rule_is_denied.storage_client", + new=storage_client, + ), + ): + from prowler.providers.azure.services.storage.storage_default_network_access_rule_is_denied.storage_default_network_access_rule_is_denied import ( + storage_default_network_access_rule_is_denied, + ) + + check = storage_default_network_access_rule_is_denied() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].subscription == AZURE_SUBSCRIPTION_ID + assert result[0].resource_name == storage_account_name diff --git a/skills/prowler-test-sdk/assets/gcp_test.py b/skills/prowler-test-sdk/assets/gcp_test.py new file mode 100644 index 0000000000..9f71a82121 --- /dev/null +++ b/skills/prowler-test-sdk/assets/gcp_test.py @@ -0,0 +1,126 @@ +# Example: GCP Cloud Storage Bucket Public Access Test +# Source: tests/providers/gcp/services/cloudstorage/cloudstorage_bucket_public_access/ + +from unittest import mock + +from tests.providers.gcp.gcp_fixtures import ( + GCP_PROJECT_ID, + GCP_US_CENTER1_LOCATION, + set_mocked_gcp_provider, +) + + +class TestCloudStorageBucketPublicAccess: + def test_bucket_public_access(self): + """Test FAIL: Bucket is publicly accessible.""" + cloudstorage_client = mock.MagicMock() + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch( + "prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_public_access.cloudstorage_bucket_public_access.cloudstorage_client", + new=cloudstorage_client, + ), + ): + from prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_public_access.cloudstorage_bucket_public_access import ( + cloudstorage_bucket_public_access, + ) + from prowler.providers.gcp.services.cloudstorage.cloudstorage_service import ( + Bucket, + ) + + cloudstorage_client.project_ids = [GCP_PROJECT_ID] + cloudstorage_client.region = GCP_US_CENTER1_LOCATION + + cloudstorage_client.buckets = [ + Bucket( + name="example-bucket", + id="example-bucket", + region=GCP_US_CENTER1_LOCATION, + uniform_bucket_level_access=True, + public=True, + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudstorage_bucket_public_access() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "FAIL" + assert result[0].resource_id == "example-bucket" + assert result[0].resource_name == "example-bucket" + assert result[0].location == GCP_US_CENTER1_LOCATION + assert result[0].project_id == GCP_PROJECT_ID + + def test_bucket_no_public_access(self): + """Test PASS: Bucket is not publicly accessible.""" + cloudstorage_client = mock.MagicMock() + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch( + "prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_public_access.cloudstorage_bucket_public_access.cloudstorage_client", + new=cloudstorage_client, + ), + ): + from prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_public_access.cloudstorage_bucket_public_access import ( + cloudstorage_bucket_public_access, + ) + from prowler.providers.gcp.services.cloudstorage.cloudstorage_service import ( + Bucket, + ) + + cloudstorage_client.project_ids = [GCP_PROJECT_ID] + cloudstorage_client.region = GCP_US_CENTER1_LOCATION + + cloudstorage_client.buckets = [ + Bucket( + name="example-bucket", + id="example-bucket", + region=GCP_US_CENTER1_LOCATION, + uniform_bucket_level_access=True, + public=False, + project_id=GCP_PROJECT_ID, + ) + ] + + check = cloudstorage_bucket_public_access() + result = check.execute() + + assert len(result) == 1 + assert result[0].status == "PASS" + assert result[0].resource_id == "example-bucket" + + def test_no_buckets(self): + """Test when no buckets exist.""" + cloudstorage_client = mock.MagicMock() + + with ( + mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + mock.patch( + "prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_public_access.cloudstorage_bucket_public_access.cloudstorage_client", + new=cloudstorage_client, + ), + ): + from prowler.providers.gcp.services.cloudstorage.cloudstorage_bucket_public_access.cloudstorage_bucket_public_access import ( + cloudstorage_bucket_public_access, + ) + + cloudstorage_client.project_ids = [GCP_PROJECT_ID] + cloudstorage_client.region = GCP_US_CENTER1_LOCATION + cloudstorage_client.buckets = [] + + check = cloudstorage_bucket_public_access() + result = check.execute() + + assert len(result) == 0 diff --git a/skills/prowler-test-sdk/references/testing-docs.md b/skills/prowler-test-sdk/references/testing-docs.md new file mode 100644 index 0000000000..75ec547372 --- /dev/null +++ b/skills/prowler-test-sdk/references/testing-docs.md @@ -0,0 +1,17 @@ +# SDK Testing Documentation + +## Local Documentation + +For detailed SDK testing patterns, see: + +- `docs/developer-guide/unit-testing.mdx` - Complete guide for writing check tests + +## Contents + +The documentation covers: +- AWS testing with moto (`@mock_aws` decorator) +- Azure testing with MagicMock +- GCP testing with MagicMock +- Provider-specific fixtures (`set_mocked_aws_provider`, etc.) +- Service dependency table for CI optimization +- Test structure and required scenarios diff --git a/skills/prowler-test-ui/SKILL.md b/skills/prowler-test-ui/SKILL.md new file mode 100644 index 0000000000..fbff0f9310 --- /dev/null +++ b/skills/prowler-test-ui/SKILL.md @@ -0,0 +1,190 @@ +--- +name: prowler-test-ui +description: > + E2E testing patterns for Prowler UI (Playwright). + Trigger: When writing E2E tests for the Next.js frontend. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +> **Generic Patterns**: For base Playwright patterns (Page Object Model, selectors, helpers), see the `playwright` skill. +> This skill covers **Prowler-specific** conventions only. + +## Prowler UI Test Structure + +``` +ui/tests/ +├── base-page.ts # Prowler-specific base page +├── helpers.ts # Prowler test utilities +└── {page-name}/ + ├── {page-name}-page.ts # Page Object Model + ├── {page-name}.spec.ts # ALL tests (single file per feature) + └── {page-name}.md # Test documentation +``` + +--- + +## MCP Workflow - CRITICAL + +**⚠️ MANDATORY: If Playwright MCP tools are available, ALWAYS use them BEFORE creating tests.** + +1. **Navigate** to target page +2. **Take snapshot** to see actual DOM structure +3. **Interact** with forms/elements to verify real flow +4. **Document actual selectors** from snapshots +5. **Only then** write test code + +**Why**: Prevents tests based on assumptions. Real exploration = stable tests. + +--- + +## Prowler Base Page + +```typescript +import { Page, Locator, expect } from "@playwright/test"; + +export class BasePage { + constructor(protected page: Page) {} + + async goto(path: string): Promise { + await this.page.goto(path); + await this.page.waitForLoadState("networkidle"); + } + + async waitForPageLoad(): Promise { + await this.page.waitForLoadState("networkidle"); + } + + // Prowler-specific: notification handling + async waitForNotification(): Promise { + const notification = this.page.locator('[role="status"]'); + await notification.waitFor({ state: "visible" }); + return notification; + } + + async verifyNotificationMessage(message: string): Promise { + const notification = await this.waitForNotification(); + await expect(notification).toContainText(message); + } +} +``` + +--- + +## Prowler-Specific Pages + +### Providers Page + +```typescript +import { BasePage } from "../base-page"; + +export class ProvidersPage extends BasePage { + readonly addButton = this.page.getByRole("button", { name: "Add Provider" }); + readonly providerTable = this.page.getByRole("table"); + + async goto(): Promise { + await super.goto("/providers"); + } + + async addProvider(type: string, alias: string): Promise { + await this.addButton.click(); + await this.page.getByLabel("Provider Type").selectOption(type); + await this.page.getByLabel("Alias").fill(alias); + await this.page.getByRole("button", { name: "Create" }).click(); + } +} +``` + +### Scans Page + +```typescript +export class ScansPage extends BasePage { + readonly newScanButton = this.page.getByRole("button", { name: "New Scan" }); + readonly scanTable = this.page.getByRole("table"); + + async goto(): Promise { + await super.goto("/scans"); + } + + async startScan(providerAlias: string): Promise { + await this.newScanButton.click(); + await this.page.getByRole("combobox", { name: "Provider" }).click(); + await this.page.getByRole("option", { name: providerAlias }).click(); + await this.page.getByRole("button", { name: "Start Scan" }).click(); + } +} +``` + +--- + +## Test Tags for Prowler + +```typescript +test("Provider CRUD operations", + { tag: ["@critical", "@e2e", "@providers", "@PROV-E2E-001"] }, + async ({ page }) => { + // ... + } +); +``` + +| Category | Tags | +|----------|------| +| Priority | `@critical`, `@high`, `@medium`, `@low` | +| Type | `@e2e`, `@smoke`, `@regression` | +| Feature | `@providers`, `@scans`, `@findings`, `@compliance`, `@signin`, `@signup` | +| Test ID | `@PROV-E2E-001`, `@SCAN-E2E-002` | + +--- + +## Prowler Test Documentation Template + +**Keep under 60 lines. Focus on flow, preconditions, expected results only.** + +```markdown +### E2E Tests: {Feature Name} + +**Suite ID:** `{SUITE-ID}` +**Feature:** {Feature description} + +--- + +## Test Case: `{TEST-ID}` - {Test case title} + +**Priority:** `{critical|high|medium|low}` +**Tags:** @e2e, @{feature-name} + +**Preconditions:** +- {Prerequisites} + +### Flow Steps: +1. {Step} +2. {Step} + +### Expected Result: +- {Outcome} + +### Key Verification Points: +- {Assertion} +``` + +--- + +## Commands + +```bash +cd ui && pnpm run test:e2e # All tests +cd ui && pnpm run test:e2e tests/providers/ # Specific folder +cd ui && pnpm run test:e2e --grep "provider" # By pattern +cd ui && pnpm run test:e2e:ui # With UI +cd ui && pnpm run test:e2e:debug # Debug mode +cd ui && pnpm run test:e2e:headed # See browser +cd ui && pnpm run test:e2e:report # Generate report +``` + +## Resources + +- **Documentation**: See [references/](references/) for links to local developer guide diff --git a/skills/prowler-test-ui/references/e2e-docs.md b/skills/prowler-test-ui/references/e2e-docs.md new file mode 100644 index 0000000000..3ea6f4db47 --- /dev/null +++ b/skills/prowler-test-ui/references/e2e-docs.md @@ -0,0 +1,17 @@ +# E2E Testing Documentation + +## Local Documentation + +For Playwright E2E testing patterns, see: + +- `docs/developer-guide/end2end-testing.mdx` - Complete E2E testing guide + +## Contents + +The documentation covers: +- Playwright setup and configuration +- Page Object Model patterns +- Authentication states (`admin.auth.setup`, etc.) +- Environment variables (`E2E_*`) +- Test tagging conventions (`@PROVIDER-E2E-001`) +- Serial test requirements diff --git a/skills/prowler-ui/SKILL.md b/skills/prowler-ui/SKILL.md new file mode 100644 index 0000000000..0c9e338e91 --- /dev/null +++ b/skills/prowler-ui/SKILL.md @@ -0,0 +1,210 @@ +--- +name: prowler-ui +description: > + Prowler UI-specific patterns. For generic patterns, see: typescript, react-19, nextjs-15, tailwind-4. + Trigger: When working on ui/ directory - components, pages, actions, hooks. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## Related Generic Skills + +- `typescript` - Const types, flat interfaces +- `react-19` - No useMemo/useCallback, compiler +- `nextjs-15` - App Router, Server Actions +- `tailwind-4` - cn() utility, styling rules +- `zod-4` - Schema validation +- `zustand-5` - State management +- `ai-sdk-5` - Chat/AI features +- `playwright` - E2E testing (see also `prowler-test-ui`) + +## Tech Stack (Versions) + +``` +Next.js 15.5.9 | React 19.2.2 | Tailwind 4.1.13 | shadcn/ui +Zod 4.1.11 | React Hook Form 7.62.0 | Zustand 5.0.8 +NextAuth 5.0.0-beta.30 | Recharts 2.15.4 +HeroUI 2.8.4 (LEGACY - do not add new components) +``` + +## CRITICAL: Component Library Rule + +- **ALWAYS**: Use `shadcn/ui` + Tailwind (`components/shadcn/`) +- **NEVER**: Add new HeroUI components (`components/ui/` is legacy only) + +## DECISION TREES + +### Component Placement + +``` +New feature UI? → shadcn/ui + Tailwind +Existing HeroUI feature? → Keep HeroUI (don't mix) +Used 1 feature? → features/{feature}/components/ +Used 2+ features? → components/shared/ +Needs state/hooks? → "use client" +Server component? → No directive needed +``` + +### Code Location + +``` +Server action → actions/{feature}/{feature}.ts +Data transform → actions/{feature}/{feature}.adapter.ts +Types (shared 2+) → types/{domain}.ts +Types (local 1) → {feature}/types.ts +Utils (shared 2+) → lib/ +Utils (local 1) → {feature}/utils/ +Hooks (shared 2+) → hooks/ +Hooks (local 1) → {feature}/hooks.ts +shadcn components → components/shadcn/ +HeroUI components → components/ui/ (LEGACY) +``` + +### Styling Decision + +``` +Tailwind class exists? → className +Dynamic value? → style prop +Conditional styles? → cn() +Static only? → className (no cn()) +Recharts/library? → CHART_COLORS constant + var() +``` + +### Scope Rule (ABSOLUTE) + +- Used 2+ places → `lib/` or `types/` or `hooks/` (components go in `components/{domain}/`) +- Used 1 place → keep local in feature directory +- **This determines ALL folder structure decisions** + +## Project Structure + +``` +ui/ +├── app/ +│ ├── (auth)/ # Auth pages (login, signup) +│ └── (prowler)/ # Main app +│ ├── compliance/ +│ ├── findings/ +│ ├── providers/ +│ ├── scans/ +│ ├── services/ +│ └── integrations/ +├── components/ +│ ├── shadcn/ # shadcn/ui (USE THIS) +│ ├── ui/ # HeroUI (LEGACY) +│ ├── {domain}/ # Domain-specific (compliance, findings, providers, etc.) +│ ├── filters/ # Filter components +│ ├── graphs/ # Chart components +│ └── icons/ # Icon components +├── actions/ # Server actions +├── types/ # Shared types +├── hooks/ # Shared hooks +├── lib/ # Utilities +├── store/ # Zustand state +├── tests/ # Playwright E2E +└── styles/ # Global CSS +``` + +## Recharts (Special Case) + +For Recharts props that don't accept className: + +```typescript +const CHART_COLORS = { + primary: "var(--color-primary)", + secondary: "var(--color-secondary)", + text: "var(--color-text)", + gridLine: "var(--color-border)", +}; + +// Only use var() for library props, NEVER in className + + +``` + +## Form + Validation Pattern + +```typescript +"use client"; +import { useForm } from "react-hook-form"; +import { zodResolver } from "@hookform/resolvers/zod"; +import { z } from "zod"; + +const schema = z.object({ + email: z.email(), // Zod 4 syntax + name: z.string().min(1), +}); + +type FormData = z.infer; + +export function MyForm() { + const { register, handleSubmit, formState: { errors } } = useForm({ + resolver: zodResolver(schema), + }); + + const onSubmit = async (data: FormData) => { + await serverAction(data); + }; + + return ( +
+ + {errors.email && {errors.email.message}} + +
+ ); +} +``` + +## Commands + +```bash +# Development +cd ui && pnpm install +cd ui && pnpm run dev + +# Code Quality +cd ui && pnpm run typecheck +cd ui && pnpm run lint:fix +cd ui && pnpm run format:write +cd ui && pnpm run healthcheck # typecheck + lint + +# Testing +cd ui && pnpm run test:e2e +cd ui && pnpm run test:e2e:ui +cd ui && pnpm run test:e2e:debug + +# Build +cd ui && pnpm run build +cd ui && pnpm start +``` + +## QA Checklist Before Commit + +- [ ] `pnpm run typecheck` passes +- [ ] `pnpm run lint:fix` passes +- [ ] `pnpm run format:write` passes +- [ ] Relevant E2E tests pass +- [ ] All UI states handled (loading, error, empty) +- [ ] No secrets in code (use `.env.local`) +- [ ] Error messages sanitized (no stack traces to users) +- [ ] Server-side validation present (don't trust client) +- [ ] Accessibility: keyboard navigation, ARIA labels +- [ ] Mobile responsive (if applicable) + +## Migrations Reference + +| From | To | Key Changes | +|------|-----|-------------| +| React 18 | 19.1 | Async components, React Compiler (no useMemo/useCallback) | +| Next.js 14 | 15.5 | Improved App Router, better streaming | +| NextUI | HeroUI 2.8.4 | Package rename only, same API | +| Zod 3 | 4 | `z.email()` not `z.string().email()`, `error` not `message` | +| AI SDK 4 | 5 | `@ai-sdk/react`, `sendMessage` not `handleSubmit`, `parts` not `content` | + +## Resources + +- **Documentation**: See [references/](references/) for links to local developer guide diff --git a/skills/prowler-ui/references/ui-docs.md b/skills/prowler-ui/references/ui-docs.md new file mode 100644 index 0000000000..81efd37ea8 --- /dev/null +++ b/skills/prowler-ui/references/ui-docs.md @@ -0,0 +1,14 @@ +# UI Documentation + +## Local Documentation + +For UI-related patterns, see: + +- `docs/developer-guide/lighthouse.mdx` - AI agent integration and Lighthouse patterns + +## Contents + +The documentation covers: +- AI agent integration in the UI +- Lighthouse performance patterns +- Component optimization diff --git a/skills/prowler/SKILL.md b/skills/prowler/SKILL.md new file mode 100644 index 0000000000..bb520fe42b --- /dev/null +++ b/skills/prowler/SKILL.md @@ -0,0 +1,63 @@ +--- +name: prowler +description: > + Main entry point for Prowler development - quick reference for all components. + Trigger: General Prowler development questions, project overview, component navigation. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## Components + +| Component | Stack | Location | +|-----------|-------|----------| +| SDK | Python 3.9+, Poetry | `prowler/` | +| API | Django 5.1, DRF, Celery | `api/` | +| UI | Next.js 15, React 19, Tailwind 4 | `ui/` | +| MCP | FastMCP 2.13.1 | `mcp_server/` | + +## Quick Commands + +```bash +# SDK +poetry install --with dev +poetry run python prowler-cli.py aws --check check_name +poetry run pytest tests/ + +# API +cd api && poetry run python src/backend/manage.py runserver +cd api && poetry run pytest + +# UI +cd ui && pnpm run dev +cd ui && pnpm run healthcheck + +# MCP +cd mcp_server && uv run prowler-mcp + +# Full Stack +docker-compose up -d +``` + +## Providers + +AWS, Azure, GCP, Kubernetes, GitHub, M365, OCI, AlibabaCloud, MongoDB Atlas, IaC + +## Commit Style + +`feat:`, `fix:`, `docs:`, `chore:`, `perf:`, `refactor:`, `test:` + +## Related Skills + +- `prowler-sdk-check` - Create security checks +- `prowler-api` - Django/DRF patterns +- `prowler-ui` - Next.js/React patterns +- `prowler-mcp` - MCP server tools +- `prowler-test` - Testing patterns + +## Resources + +- **Documentation**: See [references/](references/) for links to local developer guide diff --git a/skills/prowler/references/prowler-docs.md b/skills/prowler/references/prowler-docs.md new file mode 100644 index 0000000000..1b09c832af --- /dev/null +++ b/skills/prowler/references/prowler-docs.md @@ -0,0 +1,14 @@ +# Prowler Documentation + +## Local Documentation + +For project overview and development setup, see: + +- `docs/developer-guide/introduction.mdx` - Repository structure, setup, and development environment + +## Contents + +The documentation covers: +- Project structure overview +- Development environment setup +- Repository conventions diff --git a/skills/pytest/SKILL.md b/skills/pytest/SKILL.md new file mode 100644 index 0000000000..bb2328cc41 --- /dev/null +++ b/skills/pytest/SKILL.md @@ -0,0 +1,192 @@ +--- +name: pytest +description: > + Pytest testing patterns for Python. + Trigger: When writing Python tests - fixtures, mocking, markers. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## Basic Test Structure + +```python +import pytest + +class TestUserService: + def test_create_user_success(self): + user = create_user(name="John", email="john@test.com") + assert user.name == "John" + assert user.email == "john@test.com" + + def test_create_user_invalid_email_fails(self): + with pytest.raises(ValueError, match="Invalid email"): + create_user(name="John", email="invalid") +``` + +## Fixtures + +```python +import pytest + +@pytest.fixture +def user(): + """Create a test user.""" + return User(name="Test User", email="test@example.com") + +@pytest.fixture +def authenticated_client(client, user): + """Client with authenticated user.""" + client.force_login(user) + return client + +# Fixture with teardown +@pytest.fixture +def temp_file(): + path = Path("/tmp/test_file.txt") + path.write_text("test content") + yield path # Test runs here + path.unlink() # Cleanup after test + +# Fixture scopes +@pytest.fixture(scope="module") # Once per module +@pytest.fixture(scope="class") # Once per class +@pytest.fixture(scope="session") # Once per test session +``` + +## conftest.py + +```python +# tests/conftest.py - Shared fixtures +import pytest + +@pytest.fixture +def db_session(): + session = create_session() + yield session + session.rollback() + +@pytest.fixture +def api_client(): + return TestClient(app) +``` + +## Mocking + +```python +from unittest.mock import patch, MagicMock + +class TestPaymentService: + def test_process_payment_success(self): + with patch("services.payment.stripe_client") as mock_stripe: + mock_stripe.charge.return_value = {"id": "ch_123", "status": "succeeded"} + + result = process_payment(amount=100) + + assert result["status"] == "succeeded" + mock_stripe.charge.assert_called_once_with(amount=100) + + def test_process_payment_failure(self): + with patch("services.payment.stripe_client") as mock_stripe: + mock_stripe.charge.side_effect = PaymentError("Card declined") + + with pytest.raises(PaymentError): + process_payment(amount=100) + +# MagicMock for complex objects +def test_with_mock_object(): + mock_user = MagicMock() + mock_user.id = "user-123" + mock_user.name = "Test User" + mock_user.is_active = True + + result = get_user_info(mock_user) + assert result["name"] == "Test User" +``` + +## Parametrize + +```python +@pytest.mark.parametrize("input,expected", [ + ("hello", "HELLO"), + ("world", "WORLD"), + ("pytest", "PYTEST"), +]) +def test_uppercase(input, expected): + assert input.upper() == expected + +@pytest.mark.parametrize("email,is_valid", [ + ("user@example.com", True), + ("invalid-email", False), + ("", False), + ("user@.com", False), +]) +def test_email_validation(email, is_valid): + assert validate_email(email) == is_valid +``` + +## Markers + +```python +# pytest.ini or pyproject.toml +[tool.pytest.ini_options] +markers = [ + "slow: marks tests as slow", + "integration: marks integration tests", +] + +# Usage +@pytest.mark.slow +def test_large_data_processing(): + ... + +@pytest.mark.integration +def test_database_connection(): + ... + +@pytest.mark.skip(reason="Not implemented yet") +def test_future_feature(): + ... + +@pytest.mark.skipif(sys.platform == "win32", reason="Unix only") +def test_unix_specific(): + ... + +# Run specific markers +# pytest -m "not slow" +# pytest -m "integration" +``` + +## Async Tests + +```python +import pytest + +@pytest.mark.asyncio +async def test_async_function(): + result = await async_fetch_data() + assert result is not None +``` + +## Commands + +```bash +pytest # Run all tests +pytest -v # Verbose output +pytest -x # Stop on first failure +pytest -k "test_user" # Filter by name +pytest -m "not slow" # Filter by marker +pytest --cov=src # With coverage +pytest -n auto # Parallel (pytest-xdist) +pytest --tb=short # Short traceback +``` + +## References + +For general pytest documentation, see: +- **Official Docs**: https://docs.pytest.org/en/stable/ + +For Prowler SDK testing with provider-specific patterns (moto, MagicMock), see: +- **Documentation**: [references/prowler-testing.md](references/prowler-testing.md) diff --git a/skills/pytest/references/prowler-testing.md b/skills/pytest/references/prowler-testing.md new file mode 100644 index 0000000000..c26c8104dc --- /dev/null +++ b/skills/pytest/references/prowler-testing.md @@ -0,0 +1,16 @@ +# Prowler-Specific Testing Patterns + +## Local Documentation + +For Prowler-specific pytest patterns, see: + +- `docs/developer-guide/unit-testing.mdx` - Complete SDK testing guide + +## Contents + +The Prowler documentation covers patterns NOT in the generic pytest skill: +- `set_mocked_aws_provider()` fixture pattern +- `@mock_aws` decorator usage with moto +- `mock_make_api_call` pattern +- Service dependency table for CI optimization +- Provider-specific mocking (AWS uses moto, Azure/GCP use MagicMock) diff --git a/skills/react-19/SKILL.md b/skills/react-19/SKILL.md new file mode 100644 index 0000000000..53ab6b0aea --- /dev/null +++ b/skills/react-19/SKILL.md @@ -0,0 +1,122 @@ +--- +name: react-19 +description: > + React 19 patterns with React Compiler. + Trigger: When writing React components - no useMemo/useCallback needed. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## No Manual Memoization (REQUIRED) + +```typescript +// ✅ React Compiler handles optimization automatically +function Component({ items }) { + const filtered = items.filter(x => x.active); + const sorted = filtered.sort((a, b) => a.name.localeCompare(b.name)); + + const handleClick = (id) => { + console.log(id); + }; + + return ; +} + +// ❌ NEVER: Manual memoization +const filtered = useMemo(() => items.filter(x => x.active), [items]); +const handleClick = useCallback((id) => console.log(id), []); +``` + +## Imports (REQUIRED) + +```typescript +// ✅ ALWAYS: Named imports +import { useState, useEffect, useRef } from "react"; + +// ❌ NEVER +import React from "react"; +import * as React from "react"; +``` + +## Server Components First + +```typescript +// ✅ Server Component (default) - no directive +export default async function Page() { + const data = await fetchData(); + return ; +} + +// ✅ Client Component - only when needed +"use client"; +export function Interactive() { + const [state, setState] = useState(false); + return ; +} +``` + +## When to use "use client" + +- useState, useEffect, useRef, useContext +- Event handlers (onClick, onChange) +- Browser APIs (window, localStorage) + +## use() Hook + +```typescript +import { use } from "react"; + +// Read promises (suspends until resolved) +function Comments({ promise }) { + const comments = use(promise); + return comments.map(c =>
{c.text}
); +} + +// Conditional context (not possible with useContext!) +function Theme({ showTheme }) { + if (showTheme) { + const theme = use(ThemeContext); + return
Themed
; + } + return
Plain
; +} +``` + +## Actions & useActionState + +```typescript +"use server"; +async function submitForm(formData: FormData) { + await saveToDatabase(formData); + revalidatePath("/"); +} + +// With pending state +import { useActionState } from "react"; + +function Form() { + const [state, action, isPending] = useActionState(submitForm, null); + return ( +
+ +
+ ); +} +``` + +## ref as Prop (No forwardRef) + +```typescript +// ✅ React 19: ref is just a prop +function Input({ ref, ...props }) { + return ; +} + +// ❌ Old way (unnecessary now) +const Input = forwardRef((props, ref) => ); +``` diff --git a/skills/setup.sh b/skills/setup.sh new file mode 100755 index 0000000000..8f0fc57197 --- /dev/null +++ b/skills/setup.sh @@ -0,0 +1,119 @@ +#!/bin/bash +# Setup AI Skills for Prowler development +# Configures AI coding assistants that follow agentskills.io standard: +# - Claude Code: .claude/skills/ symlink (auto-discovery) +# - Gemini CLI: .gemini/skills/ symlink (auto-discovery) +# - Codex (OpenAI): .codex/skills/ symlink + AGENTS.md +# - GitHub Copilot: reads AGENTS.md from repo root (no symlink needed) + +set -e + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" +REPO_ROOT="$(dirname "$SCRIPT_DIR")" +SKILLS_SOURCE="$SCRIPT_DIR" + +# Target locations +CLAUDE_SKILLS_TARGET="$REPO_ROOT/.claude/skills" +CODEX_SKILLS_TARGET="$REPO_ROOT/.codex/skills" +GEMINI_SKILLS_TARGET="$REPO_ROOT/.gemini/skills" + +# Colors for output +RED='\033[0;31m' +GREEN='\033[0;32m' +YELLOW='\033[1;33m' +BLUE='\033[0;34m' +NC='\033[0m' # No Color + +echo "🤖 Prowler AI Skills Setup" +echo "==========================" +echo "" + +# Count skills (directories with SKILL.md) +SKILL_COUNT=$(find "$SKILLS_SOURCE" -maxdepth 2 -name "SKILL.md" | wc -l | tr -d ' ') + +if [ "$SKILL_COUNT" -eq 0 ]; then + echo -e "${RED}No skills found in $SKILLS_SOURCE${NC}" + exit 1 +fi + +echo -e "${BLUE}Found $SKILL_COUNT skills to configure${NC}" +echo "" + +# ============================================================================= +# CLAUDE CODE SETUP (.claude/skills symlink - auto-discovery) +# ============================================================================= +echo -e "${YELLOW}[1/3] Setting up Claude Code...${NC}" + +if [ ! -d "$REPO_ROOT/.claude" ]; then + mkdir -p "$REPO_ROOT/.claude" +fi + +if [ -L "$CLAUDE_SKILLS_TARGET" ]; then + rm "$CLAUDE_SKILLS_TARGET" +elif [ -d "$CLAUDE_SKILLS_TARGET" ]; then + mv "$CLAUDE_SKILLS_TARGET" "$REPO_ROOT/.claude/skills.backup.$(date +%s)" +fi + +ln -s "$SKILLS_SOURCE" "$CLAUDE_SKILLS_TARGET" +echo -e "${GREEN} ✓ .claude/skills -> skills/${NC}" + +# ============================================================================= +# CODEX (OPENAI) SETUP (.codex/skills symlink) +# ============================================================================= +echo -e "${YELLOW}[2/3] Setting up Codex (OpenAI)...${NC}" + +if [ ! -d "$REPO_ROOT/.codex" ]; then + mkdir -p "$REPO_ROOT/.codex" +fi + +if [ -L "$CODEX_SKILLS_TARGET" ]; then + rm "$CODEX_SKILLS_TARGET" +elif [ -d "$CODEX_SKILLS_TARGET" ]; then + mv "$CODEX_SKILLS_TARGET" "$REPO_ROOT/.codex/skills.backup.$(date +%s)" +fi + +ln -s "$SKILLS_SOURCE" "$CODEX_SKILLS_TARGET" +echo -e "${GREEN} ✓ .codex/skills -> skills/${NC}" + +# ============================================================================= +# GEMINI CLI SETUP (.gemini/skills symlink - auto-discovery) +# ============================================================================= +echo -e "${YELLOW}[3/3] Setting up Gemini CLI...${NC}" + +if [ ! -d "$REPO_ROOT/.gemini" ]; then + mkdir -p "$REPO_ROOT/.gemini" +fi + +if [ -L "$GEMINI_SKILLS_TARGET" ]; then + rm "$GEMINI_SKILLS_TARGET" +elif [ -d "$GEMINI_SKILLS_TARGET" ]; then + mv "$GEMINI_SKILLS_TARGET" "$REPO_ROOT/.gemini/skills.backup.$(date +%s)" +fi + +ln -s "$SKILLS_SOURCE" "$GEMINI_SKILLS_TARGET" +echo -e "${GREEN} ✓ .gemini/skills -> skills/${NC}" + +# ============================================================================= +# SUMMARY +# ============================================================================= +echo "" +echo -e "${GREEN}✅ Successfully configured $SKILL_COUNT AI skills!${NC}" +echo "" +echo "Configuration created:" +echo " • Claude Code: .claude/skills/ (symlink, auto-discovery)" +echo " • Codex (OpenAI): .codex/skills/ (symlink, reads AGENTS.md)" +echo " • Gemini CLI: .gemini/skills/ (symlink, auto-discovery)" +echo " • GitHub Copilot: reads AGENTS.md from repo root (no setup needed)" +echo "" +echo "Available skills:" +echo " Generic: typescript, react-19, nextjs-15, playwright, pytest," +echo " django-drf, zod-4, zustand-5, tailwind-4, ai-sdk-5" +echo "" +echo " Prowler: prowler, prowler-api, prowler-ui, prowler-mcp," +echo " prowler-sdk-check, prowler-test-ui, prowler-test-api," +echo " prowler-test-sdk, prowler-compliance, prowler-docs," +echo " prowler-provider, prowler-pr" +echo "" +echo -e "${BLUE}Note: Restart your AI coding assistant to load the skills.${NC}" +echo -e "${BLUE} Claude/Gemini auto-discover skills from SKILL.md descriptions.${NC}" +echo -e "${BLUE} Codex/Copilot use AGENTS.md instructions to reference skills.${NC}" diff --git a/skills/skill-creator/SKILL.md b/skills/skill-creator/SKILL.md new file mode 100644 index 0000000000..d84aa5101a --- /dev/null +++ b/skills/skill-creator/SKILL.md @@ -0,0 +1,169 @@ +--- +name: skill-creator +description: > + Creates new AI agent skills following the Agent Skills spec. + Trigger: When user asks to create a new skill, add agent instructions, or document patterns for AI. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## When to Create a Skill + +Create a skill when: +- A pattern is used repeatedly and AI needs guidance +- Project-specific conventions differ from generic best practices +- Complex workflows need step-by-step instructions +- Decision trees help AI choose the right approach + +**Don't create a skill when:** +- Documentation already exists (create a reference instead) +- Pattern is trivial or self-explanatory +- It's a one-off task + +--- + +## Skill Structure + +``` +skills/{skill-name}/ +├── SKILL.md # Required - main skill file +├── assets/ # Optional - templates, schemas, examples +│ ├── template.py +│ └── schema.json +└── references/ # Optional - links to local docs + └── docs.md # Points to docs/developer-guide/*.mdx +``` + +--- + +## SKILL.md Template + +```markdown +--- +name: {skill-name} +description: > + {One-line description of what this skill does}. + Trigger: {When the AI should load this skill}. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +--- + +## When to Use + +{Bullet points of when to use this skill} + +## Critical Patterns + +{The most important rules - what AI MUST know} + +## Code Examples + +{Minimal, focused examples} + +## Commands + +```bash +{Common commands} +``` + +## Resources + +- **Templates**: See [assets/](assets/) for {description} +- **Documentation**: See [references/](references/) for local docs +``` + +--- + +## Naming Conventions + +| Type | Pattern | Examples | +|------|---------|----------| +| Generic skill | `{technology}` | `pytest`, `playwright`, `typescript` | +| Prowler-specific | `prowler-{component}` | `prowler-api`, `prowler-ui`, `prowler-sdk-check` | +| Testing skill | `prowler-test-{component}` | `prowler-test-sdk`, `prowler-test-api` | +| Workflow skill | `{action}-{target}` | `skill-creator`, `jira-task` | + +--- + +## Decision: assets/ vs references/ + +``` +Need code templates? → assets/ +Need JSON schemas? → assets/ +Need example configs? → assets/ +Link to existing docs? → references/ +Link to external guides? → references/ (with local path) +``` + +**Key Rule**: `references/` should point to LOCAL files (`docs/developer-guide/*.mdx`), not web URLs. + +--- + +## Decision: Prowler-Specific vs Generic + +``` +Patterns apply to ANY project? → Generic skill (e.g., pytest, typescript) +Patterns are Prowler-specific? → prowler-{name} skill +Generic skill needs Prowler info? → Add references/ pointing to Prowler docs +``` + +--- + +## Frontmatter Fields + +| Field | Required | Description | +|-------|----------|-------------| +| `name` | Yes | Skill identifier (lowercase, hyphens) | +| `description` | Yes | What + Trigger in one block | +| `license` | Yes | Always `Apache-2.0` for Prowler | +| `metadata.author` | Yes | `prowler-cloud` | +| `metadata.version` | Yes | Semantic version as string | + +--- + +## Content Guidelines + +### DO +- Start with the most critical patterns +- Use tables for decision trees +- Keep code examples minimal and focused +- Include Commands section with copy-paste commands + +### DON'T +- Add Keywords section (agent searches frontmatter, not body) +- Duplicate content from existing docs (reference instead) +- Include lengthy explanations (link to docs) +- Add troubleshooting sections (keep focused) +- Use web URLs in references (use local paths) + +--- + +## Registering the Skill + +After creating the skill, add it to `AGENTS.md`: + +```markdown +| `{skill-name}` | {Description} | [SKILL.md](skills/{skill-name}/SKILL.md) | +``` + +--- + +## Checklist Before Creating + +- [ ] Skill doesn't already exist (check `skills/`) +- [ ] Pattern is reusable (not one-off) +- [ ] Name follows conventions +- [ ] Frontmatter is complete (description includes trigger keywords) +- [ ] Critical patterns are clear +- [ ] Code examples are minimal +- [ ] Commands section exists +- [ ] Added to AGENTS.md + +## Resources + +- **Templates**: See [assets/](assets/) for SKILL.md template diff --git a/skills/skill-creator/assets/SKILL-TEMPLATE.md b/skills/skill-creator/assets/SKILL-TEMPLATE.md new file mode 100644 index 0000000000..7639240245 --- /dev/null +++ b/skills/skill-creator/assets/SKILL-TEMPLATE.md @@ -0,0 +1,78 @@ +--- +name: {skill-name} +description: > + {Brief description of what this skill enables}. + Trigger: {When the AI should load this skill - be specific}. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +--- + +## When to Use + +Use this skill when: +- {Condition 1} +- {Condition 2} +- {Condition 3} + +--- + +## Critical Patterns + +{The MOST important rules - what AI MUST follow} + +### Pattern 1: {Name} + +```{language} +{code example} +``` + +### Pattern 2: {Name} + +```{language} +{code example} +``` + +--- + +## Decision Tree + +``` +{Question 1}? → {Action A} +{Question 2}? → {Action B} +Otherwise → {Default action} +``` + +--- + +## Code Examples + +### Example 1: {Description} + +```{language} +{minimal, focused example} +``` + +### Example 2: {Description} + +```{language} +{minimal, focused example} +``` + +--- + +## Commands + +```bash +{command 1} # {description} +{command 2} # {description} +{command 3} # {description} +``` + +--- + +## Resources + +- **Templates**: See [assets/](assets/) for {description of templates} +- **Documentation**: See [references/](references/) for local developer guide links diff --git a/skills/tailwind-4/SKILL.md b/skills/tailwind-4/SKILL.md new file mode 100644 index 0000000000..84b50261ce --- /dev/null +++ b/skills/tailwind-4/SKILL.md @@ -0,0 +1,197 @@ +--- +name: tailwind-4 +description: > + Tailwind CSS 4 patterns and best practices. + Trigger: When styling with Tailwind - cn(), theme variables, no var() in className. +license: Apache-2.0 +metadata: + author: prowler-cloud + version: "1.0" +allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task +--- + +## Styling Decision Tree + +``` +Tailwind class exists? → className="..." +Dynamic value? → style={{ width: `${x}%` }} +Conditional styles? → cn("base", condition && "variant") +Static only? → className="..." (no cn() needed) +Library can't use class?→ style prop with var() constants +``` + +## Critical Rules + +### Never Use var() in className + +```typescript +// ❌ NEVER: var() in className +
+
+ +// ✅ ALWAYS: Use Tailwind semantic classes +
+
+``` + +### Never Use Hex Colors + +```typescript +// ❌ NEVER: Hex colors in className +

+

+ +// ✅ ALWAYS: Use Tailwind color classes +

+

+``` + +## The cn() Utility + +```typescript +import { clsx } from "clsx"; +import { twMerge } from "tailwind-merge"; + +export function cn(...inputs: ClassValue[]) { + return twMerge(clsx(inputs)); +} +``` + +### When to Use cn() + +```typescript +// ✅ Conditional classes +
+ +// ✅ Merging with potential conflicts + + +
+ ); +} +``` + +## Persist Middleware + +```typescript +import { create } from "zustand"; +import { persist } from "zustand/middleware"; + +interface SettingsStore { + theme: "light" | "dark"; + language: string; + setTheme: (theme: "light" | "dark") => void; + setLanguage: (language: string) => void; +} + +const useSettingsStore = create()( + persist( + (set) => ({ + theme: "light", + language: "en", + setTheme: (theme) => set({ theme }), + setLanguage: (language) => set({ language }), + }), + { + name: "settings-storage", // localStorage key + } + ) +); +``` + +## Selectors (Zustand 5) + +```typescript +// ✅ Select specific fields to prevent unnecessary re-renders +function UserName() { + const name = useUserStore((state) => state.name); + return {name}; +} + +// ✅ For multiple fields, use useShallow +import { useShallow } from "zustand/react/shallow"; + +function UserInfo() { + const { name, email } = useUserStore( + useShallow((state) => ({ name: state.name, email: state.email })) + ); + return
{name} - {email}
; +} + +// ❌ AVOID: Selecting entire store (causes re-render on any change) +const store = useUserStore(); // Re-renders on ANY state change +``` + +## Async Actions + +```typescript +interface UserStore { + user: User | null; + loading: boolean; + error: string | null; + fetchUser: (id: string) => Promise; +} + +const useUserStore = create((set) => ({ + user: null, + loading: false, + error: null, + + fetchUser: async (id) => { + set({ loading: true, error: null }); + try { + const response = await fetch(`/api/users/${id}`); + const user = await response.json(); + set({ user, loading: false }); + } catch (error) { + set({ error: "Failed to fetch user", loading: false }); + } + }, +})); +``` + +## Slices Pattern + +```typescript +// userSlice.ts +interface UserSlice { + user: User | null; + setUser: (user: User) => void; + clearUser: () => void; +} + +const createUserSlice = (set): UserSlice => ({ + user: null, + setUser: (user) => set({ user }), + clearUser: () => set({ user: null }), +}); + +// cartSlice.ts +interface CartSlice { + items: CartItem[]; + addItem: (item: CartItem) => void; + removeItem: (id: string) => void; +} + +const createCartSlice = (set): CartSlice => ({ + items: [], + addItem: (item) => set((state) => ({ items: [...state.items, item] })), + removeItem: (id) => set((state) => ({ + items: state.items.filter(i => i.id !== id) + })), +}); + +// store.ts +type Store = UserSlice & CartSlice; + +const useStore = create()((...args) => ({ + ...createUserSlice(...args), + ...createCartSlice(...args), +})); +``` + +## Immer Middleware + +```typescript +import { create } from "zustand"; +import { immer } from "zustand/middleware/immer"; + +interface TodoStore { + todos: Todo[]; + addTodo: (text: string) => void; + toggleTodo: (id: string) => void; +} + +const useTodoStore = create()( + immer((set) => ({ + todos: [], + + addTodo: (text) => set((state) => { + // Mutate directly with Immer! + state.todos.push({ id: crypto.randomUUID(), text, done: false }); + }), + + toggleTodo: (id) => set((state) => { + const todo = state.todos.find(t => t.id === id); + if (todo) todo.done = !todo.done; + }), + })) +); +``` + +## DevTools + +```typescript +import { create } from "zustand"; +import { devtools } from "zustand/middleware"; + +const useStore = create()( + devtools( + (set) => ({ + // store definition + }), + { name: "MyStore" } // Name in Redux DevTools + ) +); +``` + +## Outside React + +```typescript +// Access store outside components +const { count, increment } = useCounterStore.getState(); +increment(); + +// Subscribe to changes +const unsubscribe = useCounterStore.subscribe( + (state) => console.log("Count changed:", state.count) +); +``` diff --git a/ui/AGENTS.md b/ui/AGENTS.md index 5eada68033..0e26f60f6f 100644 --- a/ui/AGENTS.md +++ b/ui/AGENTS.md @@ -1,5 +1,17 @@ # Prowler UI - AI Agent Ruleset +> **Skills Reference**: For detailed patterns, use these skills: +> - [`prowler-ui`](../skills/prowler-ui/SKILL.md) - Prowler-specific UI patterns +> - [`prowler-test-ui`](../skills/prowler-test-ui/SKILL.md) - Playwright E2E testing (comprehensive) +> - [`typescript`](../skills/typescript/SKILL.md) - Const types, flat interfaces +> - [`react-19`](../skills/react-19/SKILL.md) - No useMemo/useCallback, compiler +> - [`nextjs-15`](../skills/nextjs-15/SKILL.md) - App Router, Server Actions +> - [`tailwind-4`](../skills/tailwind-4/SKILL.md) - cn() utility, no var() in className +> - [`zod-4`](../skills/zod-4/SKILL.md) - New API (z.email(), z.uuid()) +> - [`zustand-5`](../skills/zustand-5/SKILL.md) - Selectors, persist middleware +> - [`ai-sdk-5`](../skills/ai-sdk-5/SKILL.md) - UIMessage, sendMessage +> - [`playwright`](../skills/playwright/SKILL.md) - Page Object Model, selectors + ## CRITICAL RULES - NON-NEGOTIABLE ### React @@ -19,48 +31,19 @@ - ALWAYS: Reuse via `extends` - NEVER: Inline nested objects -```typescript -// ✅ CORRECT -interface UserAddress { - street: string; - city: string; -} -interface User { - id: string; - address: UserAddress; -} -interface Admin extends User { - permissions: string[]; -} - -// ❌ WRONG -interface User { - address: { street: string; city: string }; -} -``` - ### Styling - Single class: `className="bg-slate-800 text-white"` -- Merge multiple classes: `className={cn(BUTTON_STYLES.base, BUTTON_STYLES.active, isLoading && "opacity-50")}` (cn() handles Tailwind conflicts with twMerge) -- Conditional classes: `className={cn("base", condition && "variant")}` -- Recharts props: `fill={CHART_COLORS.text}` (use constants with var()) -- Dynamic values: `style={{ width: "50%", opacity: 0.5 }}` -- CSS custom properties: `style={{ "--color": "var(--css-var)" }}` (for dynamic theming) -- NEVER: `var()` in className strings (use Tailwind semantic classes instead) -- NEVER: hex colors (use `text-white` not `text-[#fff]`) +- Merge multiple classes: `className={cn(BASE_STYLES, variant && "variant-class")}` +- Dynamic values: `style={{ width: "50%" }}` +- NEVER: `var()` in className, hex colors ### Scope Rule (ABSOLUTE) -- Used 2+ places → `components/shared/` or `lib/` or `types/` or `hooks/` +- Used 2+ places → `lib/` or `types/` or `hooks/` (components go in `components/{domain}/`) - Used 1 place → keep local in feature directory - This determines ALL folder structure decisions -### Memoization - -- NEVER: `useMemo`, `useCallback` -- React 19 Compiler handles automatic optimization - --- ## DECISION TREES @@ -68,8 +51,8 @@ interface User { ### Component Placement ``` -New feature UI? → shadcn/ui + Tailwind | Existing feature? → HeroUI -Used 1 feature? → features/{feature}/components | Used 2+? → components/shared +New/Existing UI? → shadcn/ui + Tailwind (NEVER HeroUI for new code) +Used 1 feature? → features/{feature}/components | Used 2+? → components/{domain}/ Needs state/hooks? → "use client" | Server component? → No directive ``` @@ -81,15 +64,7 @@ Data transform → actions/{feature}/{feature}.adapter.ts Types (shared 2+) → types/{domain}.ts | Types (local 1) → {feature}/types.ts Utils (shared 2+) → lib/ | Utils (local 1) → {feature}/utils/ Hooks (shared 2+) → hooks/ | Hooks (local 1) → {feature}/hooks.ts -shadcn components → components/shadcn/ | HeroUI → components/ui/ -``` - -### Styling Decision - -``` -Tailwind class exists? → className | Dynamic value? → style prop -Conditional styles? → cn() | Static? → className only -Recharts? → CHART_COLORS constant + var() | Other? → Tailwind classes +shadcn components → components/shadcn/ ``` --- @@ -105,14 +80,6 @@ export default async function Page() { } ``` -### Form + Validation - -```typescript -import { useForm } from "react-hook-form"; -import { zodResolver } from "@hookform/resolvers/zod"; -const form = useForm({ resolver: zodResolver(schema) }); -``` - ### Server Action ```typescript @@ -124,15 +91,22 @@ export async function updateProvider(formData: FormData) { } ``` -### Zod v4 +### Form + Validation (Zod 4) -- `z.email()` not `z.string().email()` -- `z.uuid()` not `z.string().uuid()` -- `z.url()` not `z.string().url()` -- `z.string().min(1)` not `z.string().nonempty()` -- `error` param not `message` param +```typescript +import { useForm } from "react-hook-form"; +import { zodResolver } from "@hookform/resolvers/zod"; +import { z } from "zod"; -### Zustand v5 +const schema = z.object({ + email: z.email(), // Zod 4: z.email() not z.string().email() + id: z.uuid(), // Zod 4: z.uuid() not z.string().uuid() +}); + +const form = useForm({ resolver: zodResolver(schema) }); +``` + +### Zustand 5 ```typescript const useStore = create( @@ -146,54 +120,31 @@ const useStore = create( ); ``` -### AI SDK v5 - -```typescript -import { useChat } from "@ai-sdk/react"; -const { messages, sendMessage } = useChat({ - transport: new DefaultChatTransport({ api: "/api/chat" }), -}); -const [input, setInput] = useState(""); -const handleSubmit = (e) => { - e.preventDefault(); - sendMessage({ text: input }); - setInput(""); -}; -``` - -### Testing (Playwright) +### Playwright Test ```typescript export class FeaturePage extends BasePage { readonly submitBtn = this.page.getByRole("button", { name: "Submit" }); - async goto() { - await super.goto("/path"); - } - async submit() { - await this.submitBtn.click(); - } + async goto() { await super.goto("/path"); } + async submit() { await this.submitBtn.click(); } } -test( - "action works", - { tag: ["@critical", "@feature", "@TEST-001"] }, - async ({ page }) => { - const p = new FeaturePage(page); - await p.goto(); - await p.submit(); - await expect(page).toHaveURL("/expected"); - }, -); +test("action works", { tag: ["@critical", "@feature"] }, async ({ page }) => { + const p = new FeaturePage(page); + await p.goto(); + await p.submit(); + await expect(page).toHaveURL("/expected"); +}); ``` -Selector priority: `getByRole()` → `getByLabel()` → `getByText()` → other - --- ## TECH STACK -Next.js 15.5.3 | React 19.1.1 | Tailwind 4.1.13 | shadcn/ui (new) | HeroUI 2.8.4 (legacy) -Zod 4.1.11 | React Hook Form 7.62.0 | Zustand 5.0.8 | NextAuth 5.0.0-beta.29 | Recharts 2.15.4 +Next.js 15.5.9 | React 19.2.2 | Tailwind 4.1.13 | shadcn/ui +Zod 4.1.11 | React Hook Form 7.62.0 | Zustand 5.0.8 | NextAuth 5.0.0-beta.30 | Recharts 2.15.4 + +> **Note**: HeroUI exists in `components/ui/` as legacy code. Do NOT add new components there. --- @@ -201,36 +152,30 @@ Zod 4.1.11 | React Hook Form 7.62.0 | Zustand 5.0.8 | NextAuth 5.0.0-beta.29 | R ``` ui/ -├── app/ (Next.js App Router) -│ ├── (auth)/ (Auth pages) -│ └── (prowler)/ (Main app: compliance, findings, providers, scans, services, integrations) -├── components/ -│ ├── shadcn/ (New shadcn/ui components) -│ ├── ui/ (HeroUI base) -│ └── {domain}/ (Domain components) -├── actions/ (Server actions) -├── types/ (Shared types) -├── hooks/ (Shared hooks) -├── lib/ (Utilities) -├── store/ (Zustand state) -├── tests/ (Playwright E2E) -└── styles/ (Global CSS) +├── app/(auth)/ # Auth pages +├── app/(prowler)/ # Main app: compliance, findings, providers, scans +├── components/shadcn/ # shadcn/ui components (USE THIS) +├── components/ui/ # HeroUI (LEGACY - do not add here) +├── actions/ # Server actions +├── types/ # Shared types +├── hooks/ # Shared hooks +├── lib/ # Utilities +├── store/ # Zustand state +├── tests/ # Playwright E2E +└── styles/ # Global CSS ``` --- ## COMMANDS -``` -pnpm install && pnpm run dev (Setup & start) -pnpm run typecheck (Type check) -pnpm run lint:fix (Fix linting) -pnpm run format:write (Format) -pnpm run healthcheck (typecheck + lint) -pnpm run test:e2e (E2E tests) -pnpm run test:e2e:ui (E2E with UI) -pnpm run test:e2e:debug (Debug E2E) -pnpm run build && pnpm start (Build & start) +```bash +pnpm install && pnpm run dev +pnpm run typecheck +pnpm run lint:fix +pnpm run healthcheck +pnpm run test:e2e +pnpm run test:e2e:ui ``` --- @@ -245,13 +190,3 @@ pnpm run build && pnpm start (Build & start) - [ ] No secrets in code (use `.env.local`) - [ ] Error messages sanitized - [ ] Server-side validation present - ---- - -## MIGRATIONS (As of Jan 2025) - -React 18 → 19.1.1 (async components, compiler) -Next.js 14 → 15.5.3 -NextUI → HeroUI 2.8.4 -Zod 3 → 4 (see patterns section) -AI SDK 4 → 5 (see patterns section) From d3eb30c0663d16a6f73c5f0c253ebefaf8c0871c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Adri=C3=A1n=20Pe=C3=B1a?= Date: Fri, 9 Jan 2026 15:13:48 +0100 Subject: [PATCH 033/337] chore: update API PR template (#9749) --- .github/pull_request_template.md | 5 +++++ skills/prowler-pr/SKILL.md | 7 ++++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index e3b870ff2a..28365d4acb 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -42,6 +42,11 @@ Please add a detailed description of how to review this PR. - [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/ui/CHANGELOG.md), if applicable. #### API +- [ ] All issue/task requirements work as expected on the API +- [ ] Endpoint response output (if applicable) +- [ ] EXPLAIN ANALYZE output for new/modified queries or indexes (if applicable) +- [ ] Performance test results (if applicable) +- [ ] Any other relevant evidence of the implementation (if applicable) - [ ] Verify if API specs need to be regenerated. - [ ] Check if version updates are required (e.g., specs, Poetry, etc.). - [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/api/CHANGELOG.md), if applicable. diff --git a/skills/prowler-pr/SKILL.md b/skills/prowler-pr/SKILL.md index d5e743e18e..9d1e299a78 100644 --- a/skills/prowler-pr/SKILL.md +++ b/skills/prowler-pr/SKILL.md @@ -63,6 +63,11 @@ allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task - [ ] Ensure new entries are added to ui/CHANGELOG.md #### API (if applicable) +- [ ] All issue/task requirements work as expected on the API +- [ ] Endpoint response output (if applicable) +- [ ] EXPLAIN ANALYZE output for new/modified queries or indexes (if applicable) +- [ ] Performance test results (if applicable) +- [ ] Any other relevant evidence of the implementation (if applicable) - [ ] Verify if API specs need to be regenerated. - [ ] Check if version updates are required. - [ ] Ensure new entries are added to api/CHANGELOG.md @@ -77,7 +82,7 @@ By submitting this pull request, I confirm that my contribution is made under th | Component | CHANGELOG | Extra Checks | |-----------|-----------|--------------| | SDK | `prowler/CHANGELOG.md` | New checks → permissions update? | -| API | `api/CHANGELOG.md` | API specs regeneration, version bump | +| API | `api/CHANGELOG.md` | API specs, version bump, endpoint output, EXPLAIN ANALYZE, performance | | UI | `ui/CHANGELOG.md` | Screenshots for Mobile/Tablet/Desktop | | MCP | `mcp_server/CHANGELOG.md` | N/A | From a57b6d78bfe7bcfbd38088678f06b4582c7ae374 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Mon, 12 Jan 2026 09:19:29 +0100 Subject: [PATCH 034/337] docs: add audit scope column to supported providers table (#9750) --- docs/introduction.mdx | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/docs/introduction.mdx b/docs/introduction.mdx index 44438f7278..928a527a88 100644 --- a/docs/introduction.mdx +++ b/docs/introduction.mdx @@ -23,19 +23,19 @@ The supported providers right now are: -| Provider | Support | Interface | -| -------------------------------------------------------------------------------- | ---------- | ------------ | -| [AWS](/user-guide/providers/aws/getting-started-aws) | Official | UI, API, CLI | -| [Azure](/user-guide/providers/azure/getting-started-azure) | Official | UI, API, CLI | -| [Google Cloud](/user-guide/providers/gcp/getting-started-gcp) | Official | UI, API, CLI | -| [Kubernetes](/user-guide/providers/kubernetes/getting-started-k8s) | Official | UI, API, CLI | -| [M365](/user-guide/providers/microsoft365/getting-started-m365) | Official | UI, API, CLI | -| [Github](/user-guide/providers/github/getting-started-github) | Official | UI, API, CLI | -| [Oracle Cloud](/user-guide/providers/oci/getting-started-oci) | Official | UI, API, CLI | -| [Infra as Code](/user-guide/providers/iac/getting-started-iac) | Official | UI, API, CLI | -| [MongoDB Atlas](/user-guide/providers/mongodbatlas/getting-started-mongodbatlas) | Official | UI, API, CLI | -| [LLM](/user-guide/providers/llm/getting-started-llm) | Official | CLI | -| **NHN** | Unofficial | CLI | +| Provider | Support | Audit Scope/Entities | Interface | +| -------------------------------------------------------------------------------- | ---------- | ---------------------------- | ------------ | +| [AWS](/user-guide/providers/aws/getting-started-aws) | Official | Accounts | UI, API, CLI | +| [Azure](/user-guide/providers/azure/getting-started-azure) | Official | Subscriptions | UI, API, CLI | +| [Google Cloud](/user-guide/providers/gcp/getting-started-gcp) | Official | Projects | UI, API, CLI | +| [Kubernetes](/user-guide/providers/kubernetes/getting-started-k8s) | Official | Clusters | UI, API, CLI | +| [M365](/user-guide/providers/microsoft365/getting-started-m365) | Official | Tenants | UI, API, CLI | +| [Github](/user-guide/providers/github/getting-started-github) | Official | Organizations / Repositories | UI, API, CLI | +| [Oracle Cloud](/user-guide/providers/oci/getting-started-oci) | Official | Tenancies / Compartments | UI, API, CLI | +| [Infra as Code](/user-guide/providers/iac/getting-started-iac) | Official | Repositories | UI, API, CLI | +| [MongoDB Atlas](/user-guide/providers/mongodbatlas/getting-started-mongodbatlas) | Official | Organizations | UI, API, CLI | +| [LLM](/user-guide/providers/llm/getting-started-llm) | Official | Models | CLI | +| **NHN** | Unofficial | Tenants | CLI | For more information about the checks and compliance of each provider visit [Prowler Hub](https://hub.prowler.com). From 05466cff224b332ff7706790aa0559477e1fbf4f Mon Sep 17 00:00:00 2001 From: mchennai <50082780+mchennai@users.noreply.github.com> Date: Mon, 12 Jan 2026 10:06:34 +0100 Subject: [PATCH 035/337] test: Add edge case test for s3_bucket_server_access_logging_enabled (#9725) Co-authored-by: Pepe Fagoaga --- ...cket_server_access_logging_enabled_test.py | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/tests/providers/aws/services/s3/s3_bucket_server_access_logging_enabled/s3_bucket_server_access_logging_enabled_test.py b/tests/providers/aws/services/s3/s3_bucket_server_access_logging_enabled/s3_bucket_server_access_logging_enabled_test.py index 5ab05e4959..849f2456b1 100644 --- a/tests/providers/aws/services/s3/s3_bucket_server_access_logging_enabled/s3_bucket_server_access_logging_enabled_test.py +++ b/tests/providers/aws/services/s3/s3_bucket_server_access_logging_enabled/s3_bucket_server_access_logging_enabled_test.py @@ -249,3 +249,42 @@ class Test_s3_bucket_server_access_logging_enabled: by_id[bucket_pass].resource_arn == f"arn:{aws_provider.identity.partition}:s3:::{bucket_pass}" ) + + @mock_aws + def test_bucket_logging_config_missing_loggingenabled_key(self): + s3_client_us_east_1 = client("s3", region_name=AWS_REGION_US_EAST_1) + bucket_name = "bucket_test_logging_empty" + s3_client_us_east_1.create_bucket(Bucket=bucket_name) + + # Explicitly set empty logging status (no LoggingEnabled) + s3_client_us_east_1.put_bucket_logging( + Bucket=bucket_name, + BucketLoggingStatus={}, + ) + + from prowler.providers.aws.services.s3.s3_service import S3 + + aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1]) + + with mock.patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=aws_provider, + ): + with mock.patch( + "prowler.providers.aws.services.s3.s3_bucket_server_access_logging_enabled.s3_bucket_server_access_logging_enabled.s3_client", + new=S3(aws_provider), + ): + from prowler.providers.aws.services.s3.s3_bucket_server_access_logging_enabled.s3_bucket_server_access_logging_enabled import ( + s3_bucket_server_access_logging_enabled, + ) + + check = s3_bucket_server_access_logging_enabled() + result = check.execute() + + assert len(result) == 1 + assert result[0].resource_id == bucket_name + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"S3 Bucket {bucket_name} has server access logging disabled." + ) From 6c01151d7816de021a7df95c5d327581692e082f Mon Sep 17 00:00:00 2001 From: Chandrapal Badshah Date: Mon, 12 Jan 2026 17:18:58 +0800 Subject: [PATCH 036/337] docs(lighthouse): update lighthouse architecture docs (#9576) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Chandrapal Badshah <12944530+Chan9390@users.noreply.github.com> Co-authored-by: Rubén De la Torre Vico Co-authored-by: Andoni Alonso <14891798+andoniaf@users.noreply.github.com> --- .../lighthouse-architecture.mdx | 407 ++++++++++++++++++ docs/developer-guide/lighthouse.mdx | 140 ------ docs/docs.json | 2 +- .../products/prowler-lighthouse-ai.mdx | 110 +---- docs/images/cli/lighthouse-architecture.png | Bin 181976 -> 0 bytes docs/images/lighthouse-architecture-dark.png | Bin 0 -> 273006 bytes docs/images/lighthouse-architecture-light.png | Bin 0 -> 271679 bytes .../prowler-app/lighthouse-architecture.png | Bin 181976 -> 0 bytes .../cli/img/lighthouse-architecture.png | Bin 181976 -> 0 bytes .../img/lighthouse-architecture.png | Bin 181976 -> 0 bytes .../prowler-app-lighthouse-multi-llm.mdx | 2 +- .../tutorials/prowler-app-lighthouse.mdx | 31 +- 12 files changed, 448 insertions(+), 244 deletions(-) create mode 100644 docs/developer-guide/lighthouse-architecture.mdx delete mode 100644 docs/developer-guide/lighthouse.mdx delete mode 100644 docs/images/cli/lighthouse-architecture.png create mode 100644 docs/images/lighthouse-architecture-dark.png create mode 100644 docs/images/lighthouse-architecture-light.png delete mode 100644 docs/images/prowler-app/lighthouse-architecture.png delete mode 100644 docs/user-guide/cli/img/lighthouse-architecture.png delete mode 100644 docs/user-guide/img/lighthouse-architecture.png diff --git a/docs/developer-guide/lighthouse-architecture.mdx b/docs/developer-guide/lighthouse-architecture.mdx new file mode 100644 index 0000000000..38ee50c5b8 --- /dev/null +++ b/docs/developer-guide/lighthouse-architecture.mdx @@ -0,0 +1,407 @@ +--- +title: 'Lighthouse AI Architecture' +--- + +This document describes the internal architecture of Prowler Lighthouse AI, enabling developers to understand how components interact and where to add new functionality. + + +**Looking for user documentation?** See: +- [Lighthouse AI Overview](/getting-started/products/prowler-lighthouse-ai) - Capabilities and FAQs +- [How Lighthouse AI Works](/user-guide/tutorials/prowler-app-lighthouse) - Configuration and usage +- [Multi-LLM Provider Setup](/user-guide/tutorials/prowler-app-lighthouse-multi-llm) - Provider configuration + + +## Architecture Overview + +Lighthouse AI operates as a Langchain-based agent that connects Large Language Models (LLMs) with Prowler security data through the Model Context Protocol (MCP). + +Prowler Lighthouse Architecture +Prowler Lighthouse Architecture + +### Three-Tier Architecture + +The system follows a three-tier architecture: + +1. **Frontend (Next.js)**: Chat interface, message rendering, model selection +2. **API Route**: Request handling, authentication, stream transformation +3. **Langchain Agent**: LLM orchestration, tool calling through MCP + +### Request Flow + +When a user sends a message through the Lighthouse chat interface, the system processes it through several stages: + +1. **User Submits a Message**. + The chat component (`ui/components/lighthouse/chat.tsx`) captures the user's question (e.g., "What are my critical findings in AWS?") and sends it as an HTTP POST request to the backend API route. + +2. **Authentication and Context Assembly**. + The API route (`ui/app/api/lighthouse/analyst/route.ts`) validates the user's session, extracts the JWT token (stored via `auth-context.ts`), and gathers context including the tenant's business context and current security posture data (assembled in `data.ts`). + +3. **Agent Initialization**. + The workflow orchestrator (`ui/lib/lighthouse/workflow.ts`) creates a Langchain agent configured with: + - The selected LLM, instantiated through the factory (`llm-factory.ts`) + - A system prompt containing available tools and instructions (`system-prompt.ts`) + - Two meta-tools (`describe_tool` and `execute_tool`) for accessing Prowler data + +4. **LLM Reasoning and Tool Calling**. + The agent sends the conversation to the LLM, which decides whether to respond directly or call tools to fetch data. When tools are needed, the meta-tools in `ui/lib/lighthouse/tools/meta-tool.ts` interact with the MCP client (`mcp-client.ts`) to: + - First call `describe_tool` to understand the tool's parameters + - Then call `execute_tool` to retrieve data from the MCP Server + - Continue reasoning with the returned data + +5. **Streaming Response**. + As the LLM generates its response, the stream handler (`ui/lib/lighthouse/analyst-stream.ts`) transforms Langchain events into UI-compatible messages and streams tokens back to the browser in real-time using Server-Sent Events. The stream includes both text tokens and tool execution events (displayed as "chain of thought"). + +6. **Message Rendering**. + The frontend receives the stream and renders it through `message-item.tsx` with markdown formatting. Any tool calls that occurred during reasoning are displayed via `chain-of-thought-display.tsx`. + +## Frontend Components + +Frontend components reside in `ui/components/lighthouse/` and handle the chat interface and configuration workflows. + +### Core Components + +| Component | Location | Purpose | +|-----------|----------|---------| +| `chat.tsx` | `ui/components/lighthouse/` | Main chat interface managing message history and input handling | +| `message-item.tsx` | `ui/components/lighthouse/` | Individual message rendering with markdown support | +| `select-model.tsx` | `ui/components/lighthouse/` | Model and provider selection dropdown | +| `chain-of-thought-display.tsx` | `ui/components/lighthouse/` | Displays tool calls and reasoning steps during execution | + +### Configuration Components + +| Component | Location | Purpose | +|-----------|----------|---------| +| `lighthouse-settings.tsx` | `ui/components/lighthouse/` | Settings panel for business context and preferences | +| `connect-llm-provider.tsx` | `ui/components/lighthouse/` | Provider connection workflow | +| `llm-providers-table.tsx` | `ui/components/lighthouse/` | Provider management table | +| `forms/delete-llm-provider-form.tsx` | `ui/components/lighthouse/forms/` | Provider deletion confirmation dialog | + +### Supporting Components + +| Component | Location | Purpose | +|-----------|----------|---------| +| `banner.tsx` / `banner-client.tsx` | `ui/components/lighthouse/` | Status banners and notifications | +| `workflow/` | `ui/components/lighthouse/workflow/` | Multi-step configuration workflows | +| `ai-elements/` | `ui/components/lighthouse/ai-elements/` | Custom UI primitives for chat interface (input, select, dropdown, tooltip) | + +## Library Code + +Core library code resides in `ui/lib/lighthouse/` and handles agent orchestration, MCP communication, and stream processing. + +### Workflow Orchestrator + +**Location:** `ui/lib/lighthouse/workflow.ts` + +The workflow module serves as the core orchestrator, responsible for: + +- Initializing the Langchain agent with system prompt and tools +- Loading tenant configuration (default provider, model, business context) +- Creating the LLM instance through the factory +- Generating dynamic tool listings from available MCP tools + +```typescript +// Simplified workflow initialization +export async function initLighthouseWorkflow(runtimeConfig?: RuntimeConfig) { + await initializeMCPClient(); + + const toolListing = generateToolListing(); + const systemPrompt = LIGHTHOUSE_SYSTEM_PROMPT_TEMPLATE.replace( + "{{TOOL_LISTING}}", + toolListing, + ); + + const llm = createLLM({ + provider: providerType, + model: modelId, + credentials, + // ... + }); + + return createAgent({ + model: llm, + tools: [describeTool, executeTool], + systemPrompt, + }); +} +``` + +### MCP Client Manager + +**Location:** `ui/lib/lighthouse/mcp-client.ts` + +The MCP client manages connections to the Prowler MCP Server using a singleton pattern: + +- **Connection Management**: Retry logic with configurable attempts and delays +- **Tool Discovery**: Fetches available tools from MCP server on initialization +- **Authentication Injection**: Automatically adds JWT tokens to `prowler_app_*` tool calls +- **Reconnection**: Supports forced reconnection after server restarts + +Key constants: +- `MAX_RETRY_ATTEMPTS`: 3 connection attempts +- `RETRY_DELAY_MS`: 2000ms between retries +- `RECONNECT_INTERVAL_MS`: 5 minutes before retry after failure + +```typescript +// Authentication injection for Prowler App tools +private handleBeforeToolCall = ({ name, args }) => { + // Only inject auth for prowler_app_* tools (user-specific data) + if (!name.startsWith("prowler_app_")) { + return { args }; + } + + const accessToken = getAuthContext(); + return { + args, + headers: { Authorization: `Bearer ${accessToken}` }, + }; +}; +``` + +### Meta-Tools + +**Location:** `ui/lib/lighthouse/tools/meta-tool.ts` + +Instead of registering all MCP tools directly with the agent, Lighthouse uses two meta-tools for dynamic tool discovery and execution: + +| Tool | Purpose | +|------|---------| +| `describe_tool` | Retrieves full schema and parameter details for a specific tool | +| `execute_tool` | Executes a tool with provided parameters | + +This pattern reduces the number of tools the LLM must track while maintaining access to all MCP capabilities. + +### Additional Library Modules + +| Module | Location | Purpose | +|--------|----------|---------| +| `analyst-stream.ts` | `ui/lib/lighthouse/` | Transforms Langchain stream events to UI message format | +| `llm-factory.ts` | `ui/lib/lighthouse/` | Creates LLM instances for OpenAI, Bedrock, and OpenAI-compatible providers | +| `system-prompt.ts` | `ui/lib/lighthouse/` | System prompt template with dynamic tool listing injection | +| `auth-context.ts` | `ui/lib/lighthouse/` | AsyncLocalStorage for JWT token propagation across async boundaries | +| `types.ts` | `ui/lib/lighthouse/` | TypeScript type definitions | +| `constants.ts` | `ui/lib/lighthouse/` | Configuration constants and error messages | +| `utils.ts` | `ui/lib/lighthouse/` | Message conversion and model parameter extraction | +| `validation.ts` | `ui/lib/lighthouse/` | Input validation utilities | +| `data.ts` | `ui/lib/lighthouse/` | Current data section generation for context enrichment | + +## API Route + +**Location:** `ui/app/api/lighthouse/analyst/route.ts` + +The API route handles chat requests and manages the streaming response pipeline: + +1. **Request Parsing**: Extracts messages, model, and provider from request body +2. **Authentication**: Validates session and extracts access token +3. **Context Assembly**: Gathers business context and current data +4. **Agent Initialization**: Creates Langchain agent with runtime configuration +5. **Stream Processing**: Transforms agent events to UI-compatible format +6. **Error Handling**: Captures errors with Sentry integration + +```typescript +export async function POST(req: Request) { + const { messages, model, provider } = await req.json(); + + const session = await auth(); + if (!session?.accessToken) { + return Response.json({ error: "Unauthorized" }, { status: 401 }); + } + + return await authContextStorage.run(accessToken, async () => { + const app = await initLighthouseWorkflow(runtimeConfig); + const agentStream = app.streamEvents({ messages }, { version: "v2" }); + + // Transform stream events to UI format + const stream = new ReadableStream({ + async start(controller) { + for await (const streamEvent of agentStream) { + // Handle on_chat_model_stream, on_tool_start, on_tool_end, etc. + } + }, + }); + + return createUIMessageStreamResponse({ stream }); + }); +} +``` + +## Backend Components + +Backend components handle LLM provider configuration, model management, and credential storage. + +### Database Models + +**Location:** `api/src/backend/api/models.py` + +| Model | Purpose | +|-------|---------| +| `LighthouseProviderConfiguration` | Per-tenant LLM provider credentials (encrypted with Fernet) | +| `LighthouseTenantConfiguration` | Tenant-level settings including business context and default provider/model | +| `LighthouseProviderModels` | Available models per provider configuration | + +All models implement Row-Level Security (RLS) for tenant isolation. + +#### LighthouseProviderConfiguration + +Stores provider-specific credentials for each tenant: + +- **provider_type**: `openai`, `bedrock`, or `openai_compatible` +- **credentials**: Encrypted JSON containing API keys or AWS credentials +- **base_url**: Custom endpoint for OpenAI-compatible providers +- **is_active**: Connection validation status + +#### LighthouseTenantConfiguration + +Stores tenant-wide Lighthouse settings: + +- **business_context**: Optional context for personalized responses +- **default_provider**: Default LLM provider type +- **default_models**: JSON mapping provider types to default model IDs + +#### LighthouseProviderModels + +Catalogs available models for each provider: + +- **model_id**: Provider-specific model identifier +- **model_name**: Human-readable display name +- **default_parameters**: Optional model-specific parameters + +### Background Jobs + +**Location:** `api/src/backend/tasks/jobs/lighthouse_providers.py` + +#### check_lighthouse_provider_connection + +Validates provider credentials by making a test API call: + +- OpenAI: Lists models via `client.models.list()` +- Bedrock: Lists foundation models via `bedrock_client.list_foundation_models()` +- OpenAI-compatible: Lists models via custom base URL + +Updates `is_active` status based on connection result. + +#### refresh_lighthouse_provider_models + +Synchronizes available models from provider APIs: + +- Fetches current model catalog from provider +- Filters out non-chat models (DALL-E, Whisper, TTS, embeddings) +- Upserts model records in `LighthouseProviderModels` +- Removes stale models no longer available + +**Excluded OpenAI model prefixes:** +```python +EXCLUDED_OPENAI_MODEL_PREFIXES = ( + "dall-e", "whisper", "tts-", "sora", + "text-embedding", "text-moderation", + # Legacy models + "text-davinci", "davinci", "curie", "babbage", "ada", +) +``` + +## MCP Server Integration + +Lighthouse AI communicates with the Prowler MCP Server to access security data. For detailed MCP Server architecture, see [Extending the MCP Server](/developer-guide/mcp-server). + +### Tool Namespacing + +MCP tools are organized into three namespaces based on authentication requirements: + +| Namespace | Auth Required | Description | +|-----------|---------------|-------------| +| `prowler_app_*` | Yes (JWT) | Prowler Cloud/App tools for findings, providers, scans, resources | +| `prowler_hub_*` | No | Security checks catalog, compliance frameworks | +| `prowler_docs_*` | No | Documentation search and retrieval | + +### Authentication Flow + +1. User authenticates with Prowler App, receiving a JWT token +2. Token is stored in session and propagated via `authContextStorage` +3. MCP client injects `Authorization: Bearer ` header for `prowler_app_*` calls +4. MCP Server validates token and applies RLS filtering + +### Tool Execution Pattern + +The agent uses meta-tools rather than direct tool registration: + +``` +Agent needs data → describe_tool("prowler_app_search_findings") + → Returns parameter schema → execute_tool with parameters + → MCP client adds auth header → MCP Server executes + → Results returned to agent → Agent continues reasoning +``` + +## Extension Points + +### Adding New LLM Providers + +To add a new LLM provider: + +1. **Frontend**: Update `ui/lib/lighthouse/llm-factory.ts` with provider-specific initialization +2. **Backend**: Add provider type to `LighthouseProviderConfiguration.LLMProviderChoices` +3. **Jobs**: Add credential extraction and model fetching in `lighthouse_providers.py` +4. **UI**: Add connection workflow in `ui/components/lighthouse/workflow/` + +### Modifying System Prompt + +The system prompt template lives in `ui/lib/lighthouse/system-prompt.ts`. The `{{TOOL_LISTING}}` placeholder is dynamically replaced with available MCP tools during agent initialization. + +### Adding Stream Events + +To handle new Langchain stream events, modify `ui/lib/lighthouse/analyst-stream.ts`. Current handlers include: + +- `on_chat_model_stream`: Token-by-token text streaming +- `on_chat_model_end`: Model completion with tool call detection +- `on_tool_start`: Tool execution started +- `on_tool_end`: Tool execution completed + +### Adding MCP Tools + +See [Extending the MCP Server](/developer-guide/mcp-server) for detailed instructions on adding new tools to the Prowler MCP Server. + +## Configuration + +### Environment Variables + +| Variable | Description | +|----------|-------------| +| `PROWLER_MCP_SERVER_URL` | MCP server endpoint (e.g., `https://mcp.prowler.com/mcp`) | + +### Database Configuration + +Provider credentials are stored encrypted in `LighthouseProviderConfiguration`: + +- **OpenAI**: `{"api_key": "sk-..."}` +- **Bedrock**: `{"access_key_id": "...", "secret_access_key": "...", "region": "us-east-1"}` or `{"api_key": "...", "region": "us-east-1"}` +- **OpenAI-compatible**: `{"api_key": "..."}` with `base_url` field + +### Tenant Configuration + +Business context and default settings are stored in `LighthouseTenantConfiguration`: + +```python +{ + "business_context": "Optional organization context for personalized responses", + "default_provider": "openai", + "default_models": { + "openai": "gpt-4o", + "bedrock": "anthropic.claude-3-5-sonnet-20240620-v1:0" + } +} +``` + +## Related Documentation + + + + Adding new tools to the Prowler MCP Server + + + Capabilities, FAQs, and limitations + + + Configuring multiple LLM providers + + + User-facing architecture and setup guide + + diff --git a/docs/developer-guide/lighthouse.mdx b/docs/developer-guide/lighthouse.mdx deleted file mode 100644 index 25afd51728..0000000000 --- a/docs/developer-guide/lighthouse.mdx +++ /dev/null @@ -1,140 +0,0 @@ ---- -title: 'Extending Prowler Lighthouse AI' ---- - -This guide helps developers customize and extend Prowler Lighthouse AI by adding or modifying AI agents. - -## Understanding AI Agents - -AI agents combine Large Language Models (LLMs) with specialized tools that provide environmental context. These tools can include API calls, system command execution, or any function-wrapped capability. - -### Types of AI Agents - -AI agents fall into two main categories: - -- **Autonomous Agents**: Freely chooses from available tools to complete tasks, adapting their approach based on context. They decide which tools to use and when. -- **Workflow Agents**: Follows structured paths with predefined logic. They execute specific tool sequences and can include conditional logic. - -Prowler Lighthouse AI is an autonomous agent - selecting the right tool(s) based on the users query. - - -To learn more about AI agents, read [Anthropic's blog post on building effective agents](https://www.anthropic.com/engineering/building-effective-agents). - - -### LLM Dependency - -The autonomous nature of agents depends on the underlying LLM. Autonomous agents using identical system prompts and tools but powered by different LLM providers might approach user queries differently. Agent with one LLM might solve a problem efficiently, while with another it might take a different route or fail entirely. - -After evaluating multiple LLM providers (OpenAI, Gemini, Claude, LLama) based on tool calling features and response accuracy, we recommend using the `gpt-4o` model. - -## Prowler Lighthouse AI Architecture - -Prowler Lighthouse AI uses a multi-agent architecture orchestrated by the [Langgraph-Supervisor](https://www.npmjs.com/package/@langchain/langgraph-supervisor) library. - -### Architecture Components - -Prowler Lighthouse architecture - -Prowler Lighthouse AI integrates with the NextJS application: - -- The [Langgraph-Supervisor](https://www.npmjs.com/package/@langchain/langgraph-supervisor) library integrates directly with NextJS -- The system uses the authenticated user session to interact with the Prowler API server -- Agents only access data the current user is authorized to view -- Session management operates automatically, ensuring Role-Based Access Control (RBAC) is maintained - -## Available Prowler AI Agents - -The following specialized AI agents are available in Prowler: - -### Agent Overview - -- **provider_agent**: Fetches information about cloud providers connected to Prowler -- **user_info_agent**: Retrieves information about Prowler users -- **scans_agent**: Fetches information about Prowler scans -- **compliance_agent**: Retrieves compliance overviews across scans -- **findings_agent**: Fetches information about individual findings across scans -- **overview_agent**: Retrieves overview information (providers, findings by status and severity, etc.) - -## How to Add New Capabilities - -### Updating the Supervisor Prompt - -The supervisor agent controls system behavior, tone, and capabilities. You can find the supervisor prompt at: [https://github.com/prowler-cloud/prowler/blob/master/ui/lib/lighthouse/prompts.ts](https://github.com/prowler-cloud/prowler/blob/master/ui/lib/lighthouse/prompts.ts) - -#### Supervisor Prompt Modifications - -Modifying the supervisor prompt allows you to: - -- Change personality or response style -- Add new high-level capabilities -- Modify task delegation to specialized agents -- Set up guardrails (query types to answer or decline) - - -The supervisor agent should not have its own tools. This design keeps the system modular and maintainable. - - -### How to Create New Specialized Agents - -The supervisor agent and all specialized agents are defined in the `route.ts` file. The supervisor agent uses [langgraph-supervisor](https://www.npmjs.com/package/@langchain/langgraph-supervisor), while other agents use the prebuilt [create-react-agent](https://langchain-ai.github.io/langgraphjs/how-tos/create-react-agent/). - -To add new capabilities or all Lighthouse AI to interact with other APIs, create additional specialized agents: - -1. First determine what the new agent would do. Create a detailed prompt defining the agent's purpose and capabilities. You can see an example from [here](https://github.com/prowler-cloud/prowler/blob/master/ui/lib/lighthouse/prompts.ts#L359-L385). - -Ensure that the new agent's capabilities don't collide with existing agents. For example, if there's already a *findings_agent* that talks to findings APIs don't create a new agent to do the same. - - -2. Create necessary tools for the agents to access specific data or perform actions. A tool is a specialized function that extends the capabilities of LLM by allowing it to access external data or APIs. A tool is triggered by LLM based on the description of the tool and the user's query. -For example, the description of `getScanTool` is "Fetches detailed information about a specific scan by its ID." If the description doesn't convey what the tool is capable of doing, LLM will not invoke the function. If the description of `getScanTool` was set to something random or not set at all, LLM will not answer queries like "Give me the critical issues from the scan ID xxxxxxxxxxxxxxx" - -Ensure that one tool is added to one agent only. Adding tools is optional. There can be agents with no tools at all. - - -3. Use the `createReactAgent` function to define a new agent. For example, the rolesAgent name is "roles_agent" and has access to call tools "*getRolesTool*" and "*getRoleTool*" -```js -const rolesAgent = createReactAgent({ - llm: llm, - tools: [getRolesTool, getRoleTool], - name: "roles_agent", - prompt: rolesAgentPrompt, -}); -``` - -4. Create a detailed prompt defining the agent's purpose and capabilities. - -5. Add the new agent to the available agents list: -```js -const agents = [ - userInfoAgent, - providerAgent, - overviewAgent, - scansAgent, - complianceAgent, - findingsAgent, - rolesAgent, // New agent added here -]; -// Create supervisor workflow -const workflow = createSupervisor({ - agents: agents, - llm: supervisorllm, - prompt: supervisorPrompt, - outputMode: "last_message", -}); -``` - -6. Update the supervisor's system prompt to summarize the new agent's capabilities. - -### Best Practices for Agent Development - -When developing new agents or capabilities: - -- **Clear Responsibility Boundaries**: Each agent should have a defined purpose with minimal overlap. No two agents should access the same tools or different tools accessing the same Prowler APIs. -- **Minimal Data Access**: Agents should only request the data they need, keeping requests specific to minimize context window usage, cost, and response time. -- **Thorough Prompting:** Ensure agent prompts include clear instructions about: - - The agent's purpose and limitations - - How to use its tools - - How to format responses for the supervisor - - Error handling procedures (Optional) -- **Security Considerations:** Agents should never modify data or access sensitive information like secrets or credentials. -- **Testing:** Thoroughly test new agents with various queries before deploying to production. diff --git a/docs/docs.json b/docs/docs.json index f6e5876bb7..f8c20a258a 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -284,7 +284,7 @@ "developer-guide/outputs", "developer-guide/integrations", "developer-guide/security-compliance-framework", - "developer-guide/lighthouse", + "developer-guide/lighthouse-architecture", "developer-guide/mcp-server", "developer-guide/ai-skills" ] diff --git a/docs/getting-started/products/prowler-lighthouse-ai.mdx b/docs/getting-started/products/prowler-lighthouse-ai.mdx index 629699e41a..6f197ae546 100644 --- a/docs/getting-started/products/prowler-lighthouse-ai.mdx +++ b/docs/getting-started/products/prowler-lighthouse-ai.mdx @@ -59,6 +59,14 @@ Prowler Lighthouse AI is powerful, but there are limitations: - **NextJS session dependence**: If your Prowler application session expires or logs out, Lighthouse AI will error out. Refresh and log back in to continue. - **Response quality**: The response quality depends on the selected LLM provider and model. Choose models with strong tool-calling capabilities for best results. We recommend `gpt-5` model from OpenAI. +## Extending Lighthouse AI + +Lighthouse AI retrieves data through Prowler MCP. To add new capabilities, extend the Prowler MCP Server with additional tools and Lighthouse AI discovers them automatically. + +For development details, see: +- [Lighthouse AI Architecture](/developer-guide/lighthouse-architecture) - Internal architecture and extension points +- [Extending the MCP Server](/developer-guide/mcp-server) - Adding new tools to Prowler MCP + ### Getting Help If you encounter issues with Prowler Lighthouse AI or have suggestions for improvements, please [reach out through our Slack channel](https://goto.prowler.com/slack). @@ -67,94 +75,6 @@ If you encounter issues with Prowler Lighthouse AI or have suggestions for impro The following API endpoints are accessible to Prowler Lighthouse AI. Data from the following API endpoints could be shared with LLM provider depending on the scope of user's query: -#### Accessible API Endpoints - -**User Management:** - -- List all users - `/api/v1/users` -- Retrieve the current user's information - `/api/v1/users/me` - -**Provider Management:** - -- List all providers - `/api/v1/providers` -- Retrieve data from a provider - `/api/v1/providers/{id}` - -**Scan Management:** - -- List all scans - `/api/v1/scans` -- Retrieve data from a specific scan - `/api/v1/scans/{id}` - -**Resource Management:** - -- List all resources - `/api/v1/resources` -- Retrieve data for a resource - `/api/v1/resources/{id}` - -**Findings Management:** - -- List all findings - `/api/v1/findings` -- Retrieve data from a specific finding - `/api/v1/findings/{id}` -- Retrieve metadata values from findings - `/api/v1/findings/metadata` - -**Overview Data:** - -- Get aggregated findings data - `/api/v1/overviews/findings` -- Get findings data by severity - `/api/v1/overviews/findings_severity` -- Get aggregated provider data - `/api/v1/overviews/providers` -- Get findings data by service - `/api/v1/overviews/services` - -**Compliance Management:** - -- List compliance overviews (optionally filter by scan) - `/api/v1/compliance-overviews` -- Retrieve data from a specific compliance overview - `/api/v1/compliance-overviews/{id}` - -#### Excluded API Endpoints - -Not all Prowler API endpoints are integrated with Lighthouse AI. They are intentionally excluded for the following reasons: - -- OpenAI/other LLM providers shouldn't have access to sensitive data (like fetching provider secrets and other sensitive config) -- Users queries don't need responses from those API endpoints (ex: tasks, tenant details, downloading zip file, etc.) - -**Excluded Endpoints:** - -**User Management:** - -- List specific users information - `/api/v1/users/{id}` -- List user memberships - `/api/v1/users/{user_pk}/memberships` -- Retrieve membership data from the user - `/api/v1/users/{user_pk}/memberships/{id}` - -**Tenant Management:** - -- List all tenants - `/api/v1/tenants` -- Retrieve data from a tenant - `/api/v1/tenants/{id}` -- List tenant memberships - `/api/v1/tenants/{tenant_pk}/memberships` -- List all invitations - `/api/v1/tenants/invitations` -- Retrieve data from tenant invitation - `/api/v1/tenants/invitations/{id}` - -**Security and Configuration:** - -- List all secrets - `/api/v1/providers/secrets` -- Retrieve data from a secret - `/api/v1/providers/secrets/{id}` -- List all provider groups - `/api/v1/provider-groups` -- Retrieve data from a provider group - `/api/v1/provider-groups/{id}` - -**Reports and Tasks:** - -- Download zip report - `/api/v1/scans/{v1}/report` -- List all tasks - `/api/v1/tasks` -- Retrieve data from a specific task - `/api/v1/tasks/{id}` - -**Lighthouse AI Configuration:** - -- List LLM providers - `/api/v1/lighthouse/providers` -- Retrieve LLM provider - `/api/v1/lighthouse/providers/{id}` -- List available models - `/api/v1/lighthouse/models` -- Retrieve tenant configuration - `/api/v1/lighthouse/configuration` - - -Agents only have access to hit GET endpoints. They don't have access to other HTTP methods. - - - ## FAQs **1. Which LLM providers are supported?** @@ -167,13 +87,21 @@ Lighthouse AI supports three providers: For detailed configuration instructions, see [Using Multiple LLM Providers with Lighthouse](/user-guide/tutorials/prowler-app-lighthouse-multi-llm). -**2. Why a multi-agent supervisor model?** +**2. Why some models don't appear in Lighthouse AI?** -Context windows are limited. While demo data fits inside the context window, querying real-world data often exceeds it. A multi-agent architecture is used so different agents fetch different sizes of data and respond with the minimum required data to the supervisor. This spreads the context window usage across agents. +LLM providers offer different types of models. Not every model can be integrated with Lighthouse AI (for example, text-to-speech, vision, embedding, computer use, etc.). + +Lighthouse AI requires models that support: + +- Text input +- Text output +- Tool calling + +Lighthouse AI [automatically filters](https://github.com/prowler-cloud/prowler/blob/master/api/src/backend/tasks/jobs/lighthouse_providers.py#L341-L353) out models that do not support these capabilities, so some provider models may not appear in the Lighthouse AI model list. **3. Is my security data shared with LLM providers?** -Minimal data is shared to generate useful responses. Agents can access security findings and remediation details when needed. Provider secrets are protected by design and cannot be read. The LLM provider credentials configured with Lighthouse AI are only accessible to our NextJS server and are never sent to the LLM providers. Resource metadata (names, tags, account/project IDs, etc) may be shared with the configured LLM provider based on query requirements. +Minimal data is shared to generate useful responses. Agent can access security findings and remediation details when needed. Provider secrets are protected by design and cannot be read. The LLM provider credentials configured with Lighthouse AI are only accessible to the Next.js server and are never sent to the LLM providers. Resource metadata (names, tags, account/project IDs, etc.) may be shared with the configured LLM provider based on query requirements. **4. Can the Lighthouse AI change my cloud environment?** diff --git a/docs/images/cli/lighthouse-architecture.png b/docs/images/cli/lighthouse-architecture.png deleted file mode 100644 index 63202ce7c7bdcd06067d234b91654787803b8724..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 181976 zcmeFZhdIPm6bctbUiPS}^V8pLR~%H0=E{d_9$h-Mef9Rz z`={2*N!;MR5%+xbUS-rOjU`(QwA*x-upHHGHCV!=p8h1XlFoqCldy+@bG37a?AhkFBETk zf6DUz{x-37>H7cv++n}!$bWzKuGvmm^50*iZ~wnH{J&NDuQmKX)A;}QhvaX9SSB5I zDUN`bFJJz&J^0fu7hkWu<~@UggZsav8}jej^QgGEm|fJAOGZXU%=)W_c$lJbhNkgI z#9+u;8JS`kBi)JFr%LfUg2CBU6hTeF;L{ud@s$>0=JoeW4IVUGs%dCEIkWR&Fl`xy zQc~(eT=VGxyz2J4Z7Rmbai8nzGM$GFW=HGJPW8q|D7mFImx0PNPegdfwgHxLn(N^OI_0t1mCUzjB)$Ytm2i z@maNE#fsiafizWF*&F7K$%)3*p}V=bN=`Q{rBFHyF8&=#bD~ge@8z~xd*B^Y-*0oi za_m?07;n46&&PKk^F4O#*riM@qf9NYVR^lP@*VgJu8NI{;tmQ5nl;$3vdz=e^JTN8 z$=F<pJ%A$zl&1i6w! zhS{w_p`kSShda#%S~AP}zkmPk>+7qMqLum6DW7Hi`scIL<5dRftQSwp%isAsGU6YR zcs~AKYQbLx7by-oS=skBH8oGHE((YIbdU%N3!6?ly$MSg^!PFVfdkoEnPFH?V`ExE zLW0&3?>1|7Jw3h5ERWQXYU33vS4L!8O;1njzuf*l_D!!t<#$_Wt9k2eZ8m6I4-J0_0(>dJfX@;f=HVbB=tgPJq$~d4rx})R5%^NqKQd4$5l%JfOH6kbzU_+XuMZ(K&5U1~H@{&ShCG&Y zVe1$L1O)2lW~VbRzNI@n{X0X#q36Dk#(_)k*WbK-8_%8Y>gsCAvlsIqS?jFpE@QCY0u2g zvaql?DrNT$J2P+C5cT}|^NhLXH*b#ZxFH@^t#JDEd2Hy*j0~!VMnbscmA;|xZ?&?m z!?F3yTet3cSP}DZ*I9+YZ*GH!#|GQ=FJ8R3$7m%MOnz~_><(_7>WK~*{nu*K-=9|e z7^WQ+9W8dDgfjN0O&fcZ?=+xdXZNybe$EZUAO^|A#AN<8C;dbKM~a|s9-pwV3jPxO zF7(gMn>W4qbY8R$5HsGlaG>M2*EPI>v~nq&1sFPx=F$Mo|?PPK2vpZ$vxrE9$P#+VB;GQFz$2*HyT>H>GcW< z#boc{!@Bm}9~-VNTdAt58dJ{crPG$@ScmV)-4R}T*beLk877Bw#}YBK&$6(%R-rCM;S}!hK<#74Qgdhty>W#e3@i{>`S~Xs2n@#Wix)xp_U=-Goh8Fss%qv#!dZzvJWT@UKVV z;VF|N-Bp(2NmmBHO?Au6CoY(TDy4+?<0aw5)4_sylfS|cm6H%CXNTT0x(;ME6)X;v zYhj>!G5_)a&L)^H%jV7TLqoR29b8;oFnQO}+LH}0jZWJHucmlk{PN-=Nh1mh3e0$+ z*W5_N6f$d}?j|zp^@|sS+0-9scaI(&bs#%4G2AI(+u@BEBWC~W4DZgJuEbhttJbY+ zw90Oa`}$R4d371cC6Z)-ILX7 zecqp4tU#BWLW%Ef%g?4;%N~P}CU@e5`P*A-TMFH>v#W^rtvEu#H=0q+v%?DV@(-$w z>tJhCRaGAOyv}=)%q%QjU48HvqfCpYMmQDq+&O|mQuK@UlGIXEE?$hxK21=C%L#HB z&+~{Kjmerj@Dk)Ue8tAcTa?{pGyfcOC%bAHr9&NmbL^{^ztZLyjM1y+J6U-Qylw3S1HnDbR%ZHGIywY)GIK zb`?ox%K__AC;9(zdlIgO=au5mr>CbQ0_`u9fpz%<6*%^Omdnk}6%IM0prrJ;s_UDh=(~RYWYrH23QBYt`Q_{HKW0D$*eV2&sCKk7OK@H9 zBc5#%4)6c(i(e9!4@A~$cz$%*loxDP0iofr>*zUUweL#yy+-07?8QF~S{4gx)p_gKpTw#1x4TA#!0kC5I2NM$Gcdr&c3e zreo;>b8IlqXlCBDi5OCjDZIiZAKOUL;aV{D7LufynaP}TOf^%~Y=ZHe_nI4It5vmO z>C7A)N()b}SiU>~NG_1y)qBVUTkSpgpWAQR6!+zehE4DiO3C1_?(TR5lhc8)oS=w^ z!7g81&bDa1H(qZp5>^en8F6BR6>Ucv2qcgkfJBGHn2(!@2M>jP_%%Nl6lwQq6~)_c zTa`XGXF{AjV|xN7rKzbIxC$nNM@i{*GRB#>%8ngUQaYRbN~;?1{%M%X<3emuj_l%1 z{qEjH$RAs{sWmVZHeg`{lpG4Nts|Mk@Ad#VcRNUA+O!w(&!*to9bpq&ILS>q0)KRO zcMoj9kG4z5_5SmSIF2QO4O|kgxFqb7&w!uV=5*k%Iid@96{-CAQO(II3$%gK@$_BQ)2P>T3FOWr3{4fwx3+MC!d6b zmXMIpH$mJDkB;QU8v?QK*@!XWAt*t1cJWct{r?&D;uG%ch>2kUCt(p1c0YY8D=Q0h ziSgOWFX|26BR$Bb^$4K^lG+55i|eS6HN#z{BrgBBQ8fKWGDRo%Gciugj(H&jTkU*U z(aJkxhTzbTq|_86|M1bnhxSTYntFPI*{vQ*SvO@?-hR71zwJ*(cSGm!OrlJ?FN=Vv z-Op1gdWBjX0o~UIntB}+0`GAgc76SC_v~a10e!YbOy0zX1a|Mf$Tgt;yS-Tdtn_3I z0TmIRQ@xBf`^3bk*u$eoHJa(o(Gf%p|2EOm-agN0V?X|o^BSH@t|L`#wcBb znUz(e%Mk>GjNs;GJwo7GvaFKeV{VC+b=zb-b%5;yV*t6|8>H*J@CbhN=+x&G^M|F~ zCtl2rrFp?V69KpA*RCymK1~*~U_o+H-E#WEtS~~?ZB9=OgnaD23ee>Ikhnm=SZ(x4 zqwLoCp?|jD9|Z;VCZ!d9t_%{$^qigI7rC}m>1jf!m<7ME@ZYE{cfs#k@*I=Cc}`nR zPEYqgILV=GX_-9i@vwpi_#Md{9+wys^YiRR@0>R4*tj?lB>6y)0XwB@m3=gZBT-RN zf?uR#eeDgz!;k}?gRA@f2_?2Y$4BhRTgG&5W-@S2a->sdIako^YHSniX-7tL^5@Sg za1q2TFf*M`OLS(kz!&Q73`M&MyBk$ttnu2 z=mDE&JRr_T7^Q|v%&t#?)1TARdxqO%$xRvNwD)X6O0TS`8NAl?4D3{0&qWSof%rAn zsc?h0j#IPIX3K~m&}mhS8@H|mN3FVy@gR=l${p957UJvzq@Z|}fDnjX`J;ouvPPE9 z3$9hwMH&R6R+fQ$4G7v#ra{7R$P zM2r(0`x`fpiZl;6?bXdw?Qcpu@OW!Rv*qRjI(b~<;I3AXR031d+pz6BGyva_k5!Kz zy}EAeK`=kAf!6G^Hbs+hNMh?ar1)Ud_wTRQ1zuqnxBPM_aW%GlLS!+esO7#}%g@Zr z3=k^)8R&$0%NBu*<~{Nao^RR)oCNmmJG*4b5_$#(RnWU{uKjyStO0rSy>sV5U2pxG zeFa>JKkf{;j`dYQpy+$4fn0-_`%){V*y4V+-Seq4AU;4wU4w&ON1y$Iz5y;-oNsd+ zcnEIC!p^Q0s~2CF2;IQ~T&ShktC&D4(2PxcwM;)e5i-eif7m)89%{aF#fsg~abRMq zcp>tr>cGIy?rwoyyG{nGCaLWOb&t3lap=&Y|7cCz+}x_5&gKK$fQmHyJr z`ebqMZIdLF`}c3l!hbCmf&8hhQ)B&A15WC_+f_mQpb;cG4YU+%Tmhm?R_o_{7Wu-c zYSZD74uN~QEr3K3C)f?~bBDK~H3dgf%42~xa!cjDi| z`9Rf7bzf{L$N_?3{VTIN{$+*WcCLRbb~O}xd9CG?*6D9d5ux+9fD{Ii2JlDm z=|N>M+H-J+yH~5`!z1s5eE{SGkDV&Nx9vPxRYSvuIK?e+nlow^4aNV+Trhp$XNWf{ zYHE)O3;ponjILt?)f~wnXuwU1W7{D+S;ShxZ0+prVI(vdSfa=DKbm^lHyaL-fO7j5 zakwM^m6wplX?gkDZ-s6USD4_$3ebzpzr2WqypaOLt?FU}M+poJ1h`6tFHA`o!SzgYUA?;22q5^QIphQ z<^BE#zMTVoPR;$rj%oeAyKK@aUsqmUerlpKAk(mX9jI!id4s}%Hiw52PQRU7h7ZB& z)KYa4@#-G<4iW?vR7K2v!Zv!}?KbNsge$6wN)*zm`s#NG1T>)H#LJy!gwJ6wUI7!V zW!-;-c=WYv*9gson&F0ksSXiu44zBVFZM*9Bl+yIbnqU{sO)d9rvsU>ZU_bqH0o)D z8>-)?z1Y?B@PkuWBKmdf9;>GF)Pvh`VinG8+@+)%A?-oCu>ldgEX)8P_~ZdGv^x3?g3lHj(1??Nh&WDF)#NLH(8ItSi~TCLMc! ztyiYQey#iPG%&rLogKIfVol7GC#+ENR9*C~ty6i}u0AgBtc7!pLTXLG)QOY;K_jVP z{^42ag`I`EDzJU~QLOR8CgBDH-wN|9|7mBM$0BA`_Bya%eWZGsGjS%(YktnWHtHtQ zX57StGbsC(Zj#}KsQ+<=upR}L>yLw$xdi8p^*8l5n?y7q2amnmcsAi=07s~VBaMf; zdW*{W^N!u&SCD2*zrVRjnBQRz3kp;v?1R;_9fhF-vmEEtONbOiV67wOm(jy-#=aN^5KUT?4%s1} zo}M21T{0j^Ps!C~M44dOwhh?M6?O{vCckF0V7*wAPIOXgp2E?iN1@YHR#eo&0mgo3 z)R@CX;|FXIWb+1#rb+DU?48*r>BJ`_q+IAW-bl2euEbeL8S0!~GwG>?|FpzxzUjc& zBfREvtqaH08j>~7>*hOAg9UX}p<5UN8&P7V(bmrVz3 zlZ;!jW)o{SR5vxEV(f}=kAhK}gPPN?TJ;I4!5AEnsAd2hdO@-AV4g9W8OCN1GxC0g zS`a1URsV25>v&YOVU2;G128uyMJT_|H9RuEa| zncJVqh7K;I5>V~>K;F}$mS6V6*LP5ee-pK_Im4v?Z`D5aZ0j~pbxL4JNFrG~_#K#f zCqdnvB6CtiAg(22XOx~eGC$Q+?9gl!+}oh8-*A^rghzhk&NH7rgovC?`rh&SIuTtm zUB}D^+Va&Gi99hq4v*1V{_aB}BIiGQnRp-Ex^CcW?)kxjk$YtUoHnCf39qbL#oJuE z!vkZ={I^uKx9iVOl*>R=<|kqSA_GCRMEud*vk5Yd0xf6!m1*s<@pi9b#8axCUaC>m zsF8_P*eHRs6!D-eOTmmT3aeSvxqOh(W7`wFY(mvVq)jV~^~y=&yh zLp4h+uxXcuc%_I?lkjpTpsGuF%Kaz6X>#%ztCm-_h5?6n0(2pdRzE#-e%{v?0Y*Q*vz z|H%*Je|9bcU=!1hPe|a)1wR1I36T2hLvRsNh#5ebdGpIyP~)+;j4}lCs9e6BPH;BN zM}Uv-RAORcsEk+9)M#%sloG-d2tGp?PY_7WIR>eWSahaoEjNK!NMg#<{|2Bm#UK=( zt&tkJ3-D4;qYA9uB7O$pMg7EyTR>dT$yOsw=HXQh(I*)}?@dR3RR{7L`-8*mpzKBs zV7RlKmnypZN`4!3@dgAn9;(##_AD!HU9Z_ONV37D20}}VGmON;8lvRZfJi1n1%y8L zInS|w^rPgUX;Z4MR)KRmnfvOEJ6Q|4P>sv7X-{p^b5pFSs0fwz$fH}gl@Gcic$%(& zda5dtFO&BrW8*$7Mg8yQ3~I5b2Z{LR?L~$Eem6(=*2VYdc0a3I#whh17zOf_5_ zSyfs2%D9@naDHwYnXkw?uXiUAVkYKlOv13BgsHWAjE6h@`I-o7(g)uPQms8QGdtei z)KeRsw44h?!_ReRWl|7NK;;O`1gt)%r4>pt8}uEb`ik7^g^I{KJN~W1F88icI-Ev5 z_K+)xOVR8`JD`>EA<#lvR6_=I9siT^`ua+N{riVrP1`}F9D@#vf*M)4 z6Fw7eX%_IL4ueIZvF>Kih;4ep@9A{+NxQWiQW}`7im7SB-@kwFj>BKrL{{;ylwP@( zUDYTz1m2ROo3Ex)dcHMC#EO5Vroc*3um@1&v7|AO;t#82=7s~jOuyz_1`+^dRzq%0 zEt)b{3>B4UJUn_Icv#eP#u?h>4pl@&{}|t*CFkSL)E0S6zcMJLPtnd+(#>;t&^plg zV8=;>A{aO#d-*=G`QBO!1U!*TiX}V3{w{h7)nn+0gAJ*vL=vH z5R@|$FXfp4U{vT#dg?ltZ<2ihr|y-RpA6WvPcNBJaVXBA2QNnf_7g(JBB0g-_N_Ab zt}%WY|>>HF}@2rO*DC6S3*J&I}o7}Aiy!z zP+LG5%t+@vo+&%S5ms%yH4TVFVL_^U_AE8_bg(&U0Ms|vaJ_9(&gaq!{`#io_3kS!UBL3gt`%Ko{2q4(MUfATB#1icS$_V z@$XOhy&5l$tl6~ZTmZ*m2NbZAkOE0o{o7SFRbn#Q-Hk}n%!nh2tN#4i-M|a5egeCI zXhaRm7>GDk=sKo?+`u%7mV@Zs;}HG`8z4v>SH;UwAPf3aG;K}th=5x1e&bqII>kG8 z?v$lVLJWijTh<$9Gy_e80mm;{MrR6XD{rh(8`YIKz$hR`r94E(phu4!S^{N@yS%oz zpJuswdUk3|40Ml}OQ__PRN%n)UC*44$;=F0kMX@ag|I-pP&>=AmXy38wUZhpsmF|s z7tiZLp$=57wK1rRQ*0^n$p2F?qJ(8pB2=!yyum0~H?I4co08Z3bUO=b$`Bo3++8RK zfXRUBi}V3Y1buVvT#K?Ast7f!-X1%CoCSh93P_6K5>yOMazH{fth!9t1m-R?Afo>9 z`DKZ4>Ypv(=^*xH(^XYfK@T1%^LjssLFn!wbVO4#WapVD&k=MZ8eH!48=HK!uQ{w$ z>{*Cpmw>G{8|!NzxsP}~VKjJ_APeN_yBu8DKQbtw{V`0`tn$(BvX@S+**3wdOviv! zR_Pj~WyV3mzX_THX}V}8vb%TM zqCn%cd*9VAr+iq=&gux#R6w+>vof=+0y}7}=@>E?u@P>9;nG)g6F6<;~l-nFgi4{H^|Acf#*yM0d1-2@Uyfe@jnYUMd3ru$cV$jZv9CMKyE6*DFptS=12_9IiIL7PcH zB=^00R~4v=0JAv7Ff`6+=Jm#f@l-q!>KJyud$d`gd^vN__41(Yibg5eUXrh+ zXGhO>_D&TPNOfvxrKlmLDj~^!*0w2(jeq8<07=lbH#V3gki+9&?N8*WY=aU}TRcB& zgKGJf>4{umK7WqGT2LSEs|wl2zj*P<)Yzj=@j!2y*KE?#rAtXxa~x=)&d+qqIJR14 zvsHg-v(6S0;Nj=5e3GsV+kc@D?FjWNsX@z#t`=<>L>z(Gngrwuh5N*lO8s_Xr479b`lf%ME<^P|SJg!rH9|&xsg+_yj$JR~``e^FVfcD#W`( z;Yv_WARi^5w*qkT`H6d5cO$Qiev?;J41$1#!WP7**lX98k|h8-J@DraSsvK?E>tq% zhlK7CK_saEdv}w*(S6m)NmPi&-mKZjs@O39FT0qO`^sug$jbIS*0!$o+gG&E%dq3* zy?P)!(Ti`E>)Ka~X%)I=UiO%oac@XaJ`Sai`bP+ahEQ%j&&jR~=`xsZN$CyV7o^^U zDzkv3WPasmpc()pj0H?qhf_Mz~k3-s0Ll!1P z7WM9aRO4&mQ!rP0OoD&Mj%Wo=@5{%@D7+Y5RjjWk z69BF#-JxBIp*(=1kgpBPWWiD$kh~L7Za`&?L&v2nNGsPa79jdkM)TdPLm-|4A|e?I z$Nv#Dii`*K;sL024AYJir=|vzBOwa&^6>PKn1~f|n3=eY5uqCCH9e4x#Pe8KM1<6q zu`LWQ2EoaUjEqire@FQPbzOpjP;LHn8WCbM(TD&+n*i`B zv~mPJeYywLUu+$CJ|rmt*rHGWJ2_eB+8!3i~D?$+gu6T@p|H7J10%Y>a!}>p^ zWPhU}De(ykDj}a>7^pdX{?nF^-Y@<{?z>QD%l3Ffx&OK*?v?zxuG*Qk=cn zYq)eX5zz9S2568_c9=qJeuyrebLZ}xH>IYanr+oyqzg)c(r^QE8jpOFzE>f{9f#2# zWm2a`yhjuhSsJTPpBLl1UKE)Y8YR&Kt*xztc%J~+;OncBCwqJ5)3GZ{e_d6 zVh|)?F{8hWG@(HAA?XgA3v)L45R=I82TA|po`Ess9|6=uNvH+Lf$W+B70vX`jn!o) zNxxf>pzD)0MF`PB<|bDppw=9Ok;u!>Tz;{&*;VZ=n}o2Bf!2d;B;BB{T(^~!2<~d~ z|Bn=)22PGfk<)^dW(;KK*=NZ>>kFwF6~B5kZ9wKCb$RSH!HM8ejy<2Y@7Vf)|8Wue z)jk2ekCiNAe2;v#W}KMkaJ1r4;oB*2t^=;j>G6BC58ftNX+e@ zB@tlX-ey$C`~ewaiPS?{gOW8fh(44Fy%(5kwzOGH=72@x9#ZT??Jx`wD(?OJQ;SVe zil8@`_7kCrdDJOs;P1HpepeHBwBGc6NsnfVQ3Z2CeFQQco;e4|-T=~R^)*Kss?a%z z&{!e?FE1}70|32BbVXpZ2rwaQOWcMe2Go+WESsYshnyu^4*^^rsK+TNDpH~L12W!a z6Ae0jeD?F83*>o(Hy%`3TV9@4OQHe}Nx1xt0UT;5aIuG%xAmCSqD4+#1vrK@fs%U= zm4jdnx^|RKYM&pyP8%(q*o%E66^J>c5&6Jpu6?@+#v%I1sZ%}}5ridw`}=_XfP|=Z z0QP@fwUgjB00j2dwe<8V=x`c^7)t~|Ec1cTH#HFcAhf9h;1x~$SR>C;Y=UZF-RIcT z3*|JBGn#gGDwAqlTpSJ7ilRJe%|w(Lt3AnSRuRZcL}_43$KPLs08>*HY#t$N9iE>V zL9MJ_@jzP)^g$9K!2$q;gXd-ky(~aDi3A)fZbh?5%{`$a_esS?`t#?{q`m_U-3+== z;H3ga_~xRZ{Jcf5l=lUYVA@Ge4^>!t1L<`_U9`CJrDzZ+(y+rkiQm3 z_$HY`L$19^b-1KDiJWL96(bdSv?C!lNLqz~enpS~-*<8);y=+r;VGv)yoaEF!iJ zsl@BK4TyO_hdN>CC=YlQQd<>?7*yu{mtb(jKTTlXIxrR5sLLuw#wMz|ZY+@bN9Sur zpvJDhLQF;*wQbB$@_VGXNx; zq+=6$dD%2+y~H#<(7H}KyoiEG_LtNhV47FTI%kXd-v%I~n<5H_ikf}iSF{gJOo5Px zW!N%oP-BC%dyoKT)KL$(MxA1*x<u1Bow_@)t}R zQJx60gfg1LIEfKh=XPx(;DQtn&^l@)98wP*l8Cbef2*Q8P7DCgXyw>O-deZKeCD1i z(R)zo7W0~O_h%J4wv3M992)l19fDDnA#H(7mN#zRWGi={nHXl5@hnI$bQ>&G2h5U6 z>ijLhKj&f9aAqy|({2*7m3-jMXx>4s7?>X)Q@hV+}FeU1I}T2e42Ne^1xu!DOns#svP z3Z#VE%)r}a*!aM-pHW>($Ynh8{~*v1BLkW26?7Fe|`i& z2zATE^fPCTO6(z|5SZRMoB-N~C@FmHdV~O)4gg4q27*E;M0XOq(bF&fA`DUx)&Tvi zCr-2n0DX`Sc0zPFT!@T}Bt>I5)R5ooZrl-d`~<`=(xZl$1w4h8zxi>m`FQM<*{A16 zeec~&9l6g`gFZG}7_&^9Q1B4rO&?&KtLHZ@FF@ z1hE(lWDJb22P(^XC#QdAt;rYwV0zk04(F1Cq+?D3jV^F7qfw_9S}8Q;=vyd|B>nD& zrmArEtU98ze{5=uuZ0t6GU0$oH$>V605T=816n!@C+EChMD2H5BAJ5q0jnmw)Cp6q z{o;XEUqI1^s0m{iNY^-^#M8zmUNj)AWaNNCcb^F9r2nEW{%jM*IPKRokk*SXT5wsh z%Rgktdh5E?O#+gkY++4R=jUb#r%#0Hhe~}m7MGkI_$Puv5hRRUxUDni*Uz7($QTf3 zl)<2X{PQwe-N(ay$JBD^L4N*d0ofH#PGOgV&0 zxu^isBnXRCb=i^hMVLK$m?JTYr)nlf&Xdqi3M(yNf&k5S?eikE61G5kWcm??8xUR3 z<_GBTWBCD(4nVRog;BfyxU)-Xx(!_|-Zl#@?Ixomlo(8=%zG$ygZEFU&VV*p@}$ol z(_SctK#w&CkRl?T&F)lZ~zs9r3nek0#KZQT4LxX(7fE#9hMhi3WH zJu>yGeWpx)n;!4M^wt5=GTNA?p9Y~q8G-dN5FkWHh<>DMk!jsF^{V8T&IpQ#$e{42 zSC-AfXpTh-1YAQ8>aj9#JE{n?8T89(Np@^Wm70t}%Z9IBy;|(DcD99q35^~@&O zsXuEF)-KK}?5o$z-TJiDV6vgT9hwMf`1o9(cz&#@c&?#`b9BTC3uW5Jz=msJ^QWVbe z4H{@$ZULiu6cI7+ceZMphPSGl?U}Q{feq3!g5{1FllHVKX+$XzJp+h7)XZ#z(T^4r z+jVm~I(5(tW8yzCJ-uaZtWExaI0{uEXX4h(P2vLNTm=M11koSr%hE@_dyQXA*HF@K z>}#57v2zAUL%$J#PC}y-ToxK5QQnDY0QfGQG;~}gsCk2lL8cZdy=Aogv$0B(IJ2{k zEubIurLndv?ec+Wsu=RS7z{_lsV1T!=^~p2@-Izl&r|wfJfex-M?CZ|n@Q!NPw3+v zaA)9FU6m!P1h;MS>pClxfeNY4{h`hp95OjVgi-{zdf*voqUEi;y5|s>uy1v+5A4J) z(6X$S*Ojpj;pDQ#x5wviqBTyCJ=kEQ1EpIXH5V*8k38(QiZ@&IJai**n{UbR6@vN! z&AtheZlxi%#Xie|Hv>){7`b}7s4ABmH>-|Qxk{u9sno-;0WO8!K&+c4dv;U z|BO5iw3wWT$*vj-1%ucvBviZ5IZTnhL&TEB$NxNKI3wdWzHMu_Za3r1tmR-*Taa3k zIZLbEozuU+m?`a0I=rgl!42DG-`^uH)*tyLT2(piBeW?yr?$WER;^M z?w1=Iv_X4g;gECc>Id4ZxX7jIyqB!PWvW9<4X(Bh+=}8`cx%)l!zX9)Vh8IBlw^sH*syI6qxce1QdUrI9NWHC%6UDF_Hl%UrBQlHqfMaGj6S$( zMaLR%?>DVlzLes9X6JR=gHkmDWEH}&3TQ=QSBl?=yPk+vD42|0 zHh$IOBBY`aK%vmzTn@`yCHfp6*Vc80P_K%DaaD&maqEtxrKH@fHGLZ2u&^VEWs5V1n$S@&@^KmE?%lf= zEG;b;*4yDnUVi?PBOhmxKt^)668rhDKU`*GpnH{_y^QkjPn#d$oQobTvGxudJNvP- zXBpk4IaR4Q>w0CatOnfo`4P)e+P-MK0=l}orsn2LDZg7X*MyugUfftWGS|1m(a_;I<;C+yuqP35QW3KQD9-JRyw$~3{+<=h zo5z-b+DIY`iq#10z<{I9-&u4|-`0T>Cr_@VT)-QhQ3JhyW@onx6{}Ld8AKLEGOqQj zj?{@V`^oLm&SLP5`Y`_a|GK+@aL5bmHVMnGIZP!FG`a4`8az|SUO8Ci>a3d|k(s|f zH|L2nypI%kdydA4{kIoD^uU46ss6Nx!C2y{wYwLW+gMJSd5>NJD|j=7^80Jpl&QkXPn81G|w@Ck4v|6M~Qrf5Ih7L_O{nyDTVvND(T6Jvj)JwpZdo}3M3ZnpeSWrm__oZ^21KqNxO1oTLUH3~!@XIjE9W^xEf%aAR zeGhzmJ}M)gfD!NU#1XI^8}5{tigG_V#T8uj9SBS8cEm<BkC@(y z=Ijr~B2b~ON&d-M);>QsE+i@{+FrFIR9QOWq(nI4-BEnu2k|hubPZYT>tGjCt=n@N z|1+;Sm#;WM&C1H^-E4V6lpQ|u?)=%qD~j7?+E4QkbFDj7`z7fbcIelsI#DSc-_3!v z`svG;RdUMvg@v!3b^oz(0!!kXnkx9kGHX(A=Ytp;f6>s*eI1*NC*&Hs6?blwo^Gy* z%E;IVwLxf;pbnovxPyeAh^&M7`|c6vKe^quC=R{uvU~mAmTSYE3pj%}@ol{5HWqXP zv3lV<#OFj8eQvNBtomMn`_CQl*=tJiZ-4&e5e{J}nr<8X@hi-x3H}Oh;vZ=PDe)^I$UB@c9TDj)t}Enb6{jse>bj=heN0kN#9Wqf1qanZg2M2YoVd+ zXb^*sJb1vgN55z*dcZeZ7Yv`+1GHWgEPvz9oz(?1f2+O}xQKX8R_UwFhE-g;_V)V` z;Skw$jpdZ5Xh+n@vScGIHVzIBWGQfRcO>0`JG5+QXus!lYx|E~GLx$nVmIvBw5F`A z?0HlF@cSJB9jG8(wvPQ2y(0nz?;``}5~ z-|5q9$h^KnX46PFSRo)oy#C`w2IOs@o*1095FiblGrtZLANBGoW;lpRB0hEvq~`pf zcW`p5+;kinNlZ)(x$dS?{PoutylYLDdyj9u&*%H5Xi(H*c6Qe1MD&*o6GjMx0kyTt z1*p*f9YcAj>&0kRmiQj6SF7e{YUUY=+XKqVP9P8=I!;a<-iYloNcVA<4!E%2Cp}&0 zr`@4RDfTT}((SqwZaok+q0yc_>NE}AsUI8~7pcmBluCs$yfY9&I5?xEWPnDn3A7ci zqkyFE539yflPix*wUiK>VM+HSktD570c6_+$y!7KRFXu zmv=SUti{ahgW;h%@!9TUH*Ahcalq-zu+vVzzg$ImATmFHOJ`@NuSv>!bk|>x&u}F1(E}^&+_h^7 zflX-r3^_xWuEFs7!uq#w-#VkucnQTRf17XA^T^00;o;#qsFhqUWl?{go<4k7hLc2L zSFc5Y7k`G2`3(ZJKLnVIs6jdRr({zoun586HLismzEMb(FkrwLbX*O#H#X8ysmki= zyV8D!SH*?bn%-y~kd6&Y4vl-=Ib33#QGF;Oq~Gw_>JdIs#p_M|2zyTlV?Ttfdc?19 zBN47tbYkP38()3eU`&K1=enesvD@WtJr=p1ask=|mhRn~n`_chBz={Y_3U3#?V6iQ z3Gjd(7@eKHdB=_&Jp%(cYk#e-_Xcb=&I}1^!7Qr9no2GShc}8D3$xug7MWoneVjk& z4QR93Y71t$*YDoFlV{XHQb<&N^X1DId6{l(Tph=V>^H{JDdaov9ZTL14GrDRE*|}S zn)I=`|2E`&3o?HpQ>$ib{bS-%N`ec(#zE`uy?X|r-Cr^-HUq8IHZ|Qw&PAF-iw?RU zRQXp>V14*ZgqN`jxjK)x-}%BCcIV5b#{RJv8he0TXtXGeJ;$gG(W&n?Z~40GZEwLb zor7%wCr{Sb*O&AdWnha;1I~Y%nc4O(tMPSRK%QZA*(UO3)mHDzpxr@Y8`=|BUw_RdbHMTKfQF@b>)n*Qqpq`e)j0%w-{_5s4$8(>Ch}aX z%$2?uXU4}&Z=dHS7@S1olH7Lp1U~v>WOa%LAGc}^Jvi{wu@sBez zH8p)=zvbxdw@Yrnz5HgpPE_%hO-7w#JQV)&W9#Ipm%3tw1+qKZMY;A^0BF}+gRcg@ql6xN{*B1_)j@_`~ zj%-7*fG@W;^Xg_xd>BYvAH5O6^3|(LE@f!C$SBtB7Z<+;KtIreu>H+_L{TH9kyg|1 zAQ4m7yYUcj{M}|tX{!vrxFqp|ZOn34Utf6A@GHq#QE|2*=dYts8};`Od;7^Ctvb&5COeiz+_69&4Wq$nj-$nw$8q&-6-ED(vAxsV~c}`m$3} zN@Skw>`Kn8*|ny!$B(~NZqF}|ZtDMTm-|cgsBxy&ciV%;9{1pM4d(EV(DRfZBa^>$ zcq8k2f6Ww1wNCT?rpw%qLWQ*kl2LJM~=lX>XGtSeOv9HZjEfF z?9;I-2%6L_Unkv*Xi+gLiK-I(rkGDJhUyCOb*t#E^93pFdNoYr zqeoU@@+(!EWLSpf5)!)VEalm9TN`VHe9+voXTu$?h#F22(NCbMi05I|)YpoMs>d*z zfjZ-Z;<;H<1?x=Ho7i?|UL&7_8aBC|4zc@E(iSTu?D)OGG zc*fF_q2xjJI8qL>*pE<))T`}-!LNOgkF~X1pB@Nhk-J)L95&*zVO*wmlG$Lue)R-) z2A`+XJuN#Zx!E`Bsjb|{=KXxn$QtyVS#*pZ23v0RYknboyJ$Ls5kn2b_PnXTq*=nU z3`R7z=KmE^rOFA1+@R5XN)0AZX$#;)Q+l~out;0FcSy0|;Fx+3VnKgu{yH2I^tM!t z;qztK_p*5pAjSSehwk8X>{gsn5JV#N`k?4~c`K8<>MahG`(Lk=nK+7&XMkfG1gMx> zSRixI-q2aUB-oUxc6zmi55a36DH(0fo5Fr}zpSW`2ZfR4W{RmZL*hh?J{IYXeEaR2 z9)3lx>42IvG(AflkN8tL9inw1oF5*Iut&|X#)uGd=~k{3+P~i$Wj;|wb`-SVP`Lv<06Pw>A0lEFkitigYu+>W6Aim>nAgnq zV`MN0zHVc)k|G6qM!BbY11bR{nw#J32#{LZ@&3%3hZQ$KktV+&Eyb$zCMa;!@>{sO zZ=DD8@kw*<62LTJPxkB=6bXEk9rY~Pq(OcF4^}(lvwp|Jisw3lgd>Ml!=~QbM(YR~ z0$Y-@tl;<=d(SSnX%MARGcof@bXW^pw#DhyFBo4(=zl{bSUWL?s97 zx9K3RSYK6-kG&2M@*+Oj?+#MX$g$m?mzQVz{pRL3gX7WB(Z{7%QmMeST}RA1PCXIM zoMo}SB<-V@7F<(nD*DDeQ%Q1{i8-r7^7dgeQd!xNs|x^=N#3AN=LR$Q3gu_}#yiWg z0~_uv2ewAVyTF6{!IAx}vdC;-zOYVBO})T@WJm*uL1vsa=9zDdGmfS;y}hvijAW}} zR#;C^aU+`J6KM2QYS-^al}qXkzGSabe#bQmP63z(GeO_xp(oQgbHmEXc@lZ0b@j7j z%FLS8!+LL)DsSHyP#!R;vB^(v9fLm3#ZcFzg3m4R5pkD4U#$rE8%>^2Bnv z^Q{(lTB&N!eainiOHs?~dmV%=X)^@~jQsAky$*Hj%r@&ECy|+(dvU6@hh#0kcH14o zIM^-#9b#D_wSZRx{&5E>Y~Q->c%7(hwDP1&?Ja(0`pDv9{cpvA5Z~T@2SiP#JwN!Y z*HbJd`ThC^o=JDTTO#;)t#6Ii*~b?`XNf^N`7+LUeM$JWH3STEbMsI2^~mhzpBJMlY9ND=c@eM+5K_Hi?E4Rx8M4dcjBWO05pO`P8n-Oe|f*TvP<~P&W-rr zd)^`~wyFQ3c-RA__<${*Jq~%}q9sLk9>*fj-M82fRojysV3w)XB{bk9iK?)J>MH8_ z^UKnjv@_TFm0ml-b#BZZ7t#@IQtpP9@;#y3DpO1OJWgq87wQGTNoeJpyR-i~#+$J} zRq9qw69GB!E9DN@{btL;x=G|O5F>6^&O4;eY)6QuuIl~=Xg=dc_Gv|J{$!-O4yC5D$ER;HaUYlFdYBx1^Ng9nG z`~c~woW&}`xaFsfg~fFMEi8IX_rt4l5cxbj4kL3H=%pne8*-Kc(t&0)Y&o z{iT1h1j;`+{quR*QA$Je97x~ z9RWpkqS*Q$s3!-PKQR}7ee21rG9UB3>9Nh(EJ3_Kq#`VTSn$s=Y)#|}QDBHqr&8& zJ}QyPQA}hXA~ISBFbQhPyMx|~nP7BLFL9vT9b5&n>l+1~fSPGt**)@dsUeaM))asn zC@wyJC7xua2fEn7?r-4Wz+6~ZC?fqhiVxK_WI4OK0=s8r4g(4A=rR)C0sGipmkd&< zFl-%gf~n(hJ1A{4y}XX*po0Xq!HCy8ht_T>9-Wn?mUYP7)D(x6+N}9}m%<1DfdFqv zODBWU&zYSYR^tN8uOGE+&034z^zu)i)zTXgLz z03nS%;)agC&U=QtE0+ua$kXYZZ#Ah_?GhRL@*}J6rbXR06LT>?=ehIC9?5bG`H2X- zfp$=-ybHYGy|{j8Tt$;(*9ce~^aUEduIvkSd~!<3fKyecHjvbd6Lq4j{$;dj)vVQZ zqA7iDI{0v>7N3O_Q`o*J=1Ww+qqF3Ga6cshj!1H9dAahQO_6-`2!!`f@vOfid%xn+ z{(}d7EX4&542y)^m3sUo!Rg>uPz2m|KPv;3g;69#EBrxCccfX%E0#4S4{YBWq(4td zSqs(%rQ(z5TD>%Ny|sf*`H?hQ!G>?kx4^HuXYHjrc(X~CeN871-)ESP*Ob_wp`*qG4E+hsby+KDkp4Jo% zi45&8JREMnh0dHga{)a*6FAv+&mygG6ApQ;@*MWlM__tZd;GP4iLFnQA_^FntHH(4 z7e{A;a`U>P%|RQ7optCo8pQd$zHmQm@_e_8kBe~7{Ii;F?5|P6j-|&gOEN82mHt@2 zcJ5(jv&{J+;js}MdEj^7K;3tKP~h6(%bYN%hZU-hl3~?qVm{xHldQAV+iW1({4MaM zl=Y8QP6M|sU%F&c`Z*sx07+NDX3%DQOvAkHE3qU7P1!DgX9k?x`F56X0SWv^^6cRe zV5WysK|*MMKUf&lq=%8EJw1Gs_x$T>Y5c4VmFD#6lMK)M=$$S*dKtyu`m#Rtt53>S z1HpSDWAu}WqppV~BqUzoa}X&ds7XfB_@V7dNJ^4`mEGDE^bQ;({wSWJ9(c#LK=tWXa?vB~dydO62iwB`7q2#HYnJ@B;P>jTA;iaMaq$O(i*r{e=(*i00BI^=JxJI~@L z2P%kcUp2-daEd8tGxrBt@&_hnxd$wq$+tJ|ITLM2qIh52a;lDgCaK0hfj?q zF)(=d9)FzJeWkC-s&C#`F-0xWl2d*1&~TyPoF1EwPdPy<?lf}9Hj3Om`YMh(Y} zj+|>YRq`*j{E2uA{r$fBZ_-{3?P>z;3wPQfh#@9`yyT#%Y$&(JW8K=dYZ0}b(Z+Zg zozT&_xh`cdj#{1>|M&0BciZP^(BnTsusJzET!16Ypgxe6PQ};NsXg-9-i{Cp&W~h> zNb-_)5}Bjcbo2=e2jzZEH`5*2I9)fR%s^+$%YwUh?z|_NA&dEa(1CII#u~1W0>+|a zG2rkswdWP@FKuePu>W~(E}L-%8^(m-Mf9seS1|xV_{MK1Nu+2P_siyFo$FASc{V(_ zcz2apRo6=f&SR1Hlm8-+L1v`xeGTM&Eb^03&D9J0SuaUSL<(Oxq{kAh@iu+Vs;~I0 zdZx5{18+xPERsZvW(18~%F8_3kai4x1^6%-_R z@_~fI#3nZRt)RQU1dTBz>P3H9zPk3O0PBFFOw9D0lz9V%|Mug@k7?b?nwc5sU~tFV zZbLlB@liLa$)67?T*o)oviI7|{jx!Bf|iHU-q7dM`zo4bc`s+q;jrIjoSOcQgQw-! zR;>BiF!w|J{DFda73LMt^T5eYu8<9lyND`X8QYFt2QBNzeooXMg9sncWHIHQ-rlP; z+9`;iIOqPVfuCD-eM(cD+gkN?XCtO^6Gcva?tLY-82}Kc2yWDLAJ^6022~Px^Lkv| zP9oc)|0>I5V}|*=UvoHAL=9@hNA5KkZuXPoc_3`95 zCSX0b-P+F_LWN8zB{GJPN&}gROi78%8RBU$CNh*Fb3!zbAr+zw8H-AYlJq1(gJgPC z5=CnNR^Gi2$Ns+kzSRGJ-`BO)xz6)kYehBR6t9V3$85tB9(TfwaoILnd9735zJ09& zOu|g<7Tp}me9{r^uKo~|>+bni+bo&I7tME`*|O2zISgFI(wz z_Lg!$lRBdFbI^@QBQP@v&eYVDdo9sL!?W52(pF*2_K|*pikU4^FWgdfXjoSUqYB+A z4=#D|qzcv#kd;f9dS#NX*%mxv5BiT#{|Dpcx(_FON@GL+C~X-g2a0b`QM`m19xqpY z{rdGj9+uto%XF9&9{b4KYjalFAli2wI#KG%y|)j zWF!C65fM%4h8YgM3=u)?Dn@d6znuAFO+`i<4tpTO#>dZyozg1+ z=5A4`*1h&qPEYL>a6I#)RE`2ZP#}pf#PnpQ#11eqF)6&n{bD4qb&*&9%%8i?eo}Tb zK6CW}P8B11&y;Sy-oqz>sR)Bv=4QYW!()-kXx}nE@uYmDw$|H$NegUdbXyc_Tea5O zI;wte;N!L?tsZ@fp{tU-`mkgRDvlHGsTupf|M-#SE}dZ8djahHOW*?|pHW_q!|be-F8^F-LNo_k z8i&8}t0PKA|BXiHx@=lRc^=bucU;Ub3SB~Wdku|4=hu$(-mEwbUgjya$wGaj|H{tK z=uLEO=Dqb?Ln9T9y-g0!aqmf>wX?Ikh(U~$bdPd!HH4*`kkHqWPap^Apk0t*lHd+VBf%DjaIt%E>BPPKMUj*jpIo@Tb=% z`WsV!H?A-IW}lfC6}X|`lO-!x;%gC^un7;DdSg~p&z)Q0hxvmey8}-4Bt~{tO*8W; zTB!W?bJ&wZiuE>kbtvIe5a`7wL2bl&$3vbBpf!jp^xM6uY{0ZsodILQXZF#sJ^?TJ zuF8RS#dEi45P;$xMn#D%lV9P!Xw);yf!6O`H;wGJ|7;(Xr0c5bqpYoS!T@b^5x#lB zG2ccv)QF6nPaXj^f$Y~|1E2KBF4-75)uWG#-pGKL9~EsL6~&mqAC9xOh8kJ$<{wx! zYCKZ1!Lb&b;vE`y2|IfB!iARTBm8f2Z`!D44eP_s(>}DX7a~t5?;qCOvubgujN7#C37w zCv%FrFNF9(r(txhb7|i2>R0i9W@W8dK?9QK^bYIJM)n#)F%@@9-xDV#F=jX_B7;13 zrlqAV9a8=COU|~pbTpuN#^rDCbdmnLlPmo#yI&#%RDTaQPZpMqV!+xupC}FzC6d2=+bXZtu4{6k3pvJ~DG`-%8k*i#7Acs-6UGC@a7d)P>U6^yg};NsI_e93rX}XdmlN zKN>V>K+cGH6147#u4+@Gq)o1_s^s0Pp2v{uxRrco!eVvGE00_UAc`6sTk+CJH#V^C2#CN{7yjlyUGF0+wA`=z4MVy(0lHT68xB8WX(^W&LK6Z7 z(g79}s8HnE0l@d6q-2bP!`odpMaJqaq0x-o8YoC4PgT7X_yRcyh)koJs0!Q%R}J|* z-`#JkpL4qQ3iV*2Ur+9PlP#GW4yP7@R+RUq6m9+noBX|^BHzmMS8M9+dc#_t3mJba zWTf|=tYxD(Ww++^lW>NI2Rf@BUN!Kq^+1)y+P#{cd9_MIT|J4}Bs(3L4=3mEqvWoCJPJFJcco4bv~+zfA|^!YzSN?Hn_cPSE2K?hgpE!1uI0N& zYK!-3rx=4U)i?ZBb;~K$z{F%12H3)qny)1b`>QtdzQ`07$R@=iSKF)Gn>F4h;;&@v zyq&!-Y)&aOS}^3bRRCom^*Zue+Z&Cy4Hs@|Q!r+a`ZQ4rgYdPy%4GcM13|U=$F3WP zb+avUYNHVMDKZKId-4v*DYIQCTJvMlxPQ!Z)u z`jOqlBStfC`BhbaC$8`WVN<&OQ~e%t!kt+4TDr}vu2W#Y;K7bunFMq>8aPP0eY?c1G6w^y!Q ziAjFCfw2WUK(hsRn`kD9KS_?(-q!s0c0LW31F!1SHzrmR7vyt7Ct0~c z=gyr)`YyVU4=a8T5ciz@b=4VBZTTMYmC5}g?OZ!A-zf46^JMn;Xt*n4#-fJsN}fNQ z*vfRgKAM^Tt?3#(sStFQESfk9DeeGd76i&Xnl2Mk%xhfusozXPul?Ni$iSw`LxZ>! z8Tn}LshNGku3fXax}+0K`k;z)I$M_vYL@q)5A;@jY(Z#hBen4^ z?Bzj|wgKc`iSxke_-H7x_&?DCB;1y6>gAU_HS3;bwSB}ni+X!%I>sM9G$ZWO$jd`o z2dtd7Bf+NHeic=!yC@OtFbMUB9)=CClU~&Tb9Cpo+;VMZAIOQ4&yV^`8vI#D!Woa* z;ZUzvZSTg$Da334afBm<&AD@Tj?{KN{vE03uPH%gZwgcKV2zM1zExH4vbkIz!rlw% z?btW~}o#uDg%I4VN0fGvg@^_2uo`M`LQ)&iCo!q$7%uWE?E`;KPifvr2{ZPbf&+H$H# zGb(-XB=qLf%*<`vW%6szzyBfb#S{#8TI{!T&qur2JF41n4oOurjBw$L;}F0+^YRiE zFnb@zcuJo~h0dFjY8!Zc6o0)yKQw=vz9x!$z+%}1X*H2cYx+J%L zTduvSCG7dhc*Sf@o$3FVxrDba}EZrO@y{npWwOIA;z9oHoLfu^N z4ug=`62)#a4pbCQlKpY27wXYJ(_4kM_QNTsJ3!L~L+{We>F8!SG%^PIGE_kw-?Z?~maeB4N;ZV;9$!%wb5d zCM}!?{*)zKe4MWp?kdfwci@!y_pVp0_ zk?vVDP==j|%Zs>)ql!~r`8?drTaMSv>#jxT>R-iBaO>BnDAHscel-_tD|vyAA;S%h zd1ozaGw&7hEzoPJg~~x^mF#@BVC;{Mzy0IvBf%oe;EuyJ_8l*CnP8U zN4RRG{F8iI1n)7Sb(fg<;^M3VbarH)IllC$(ss-S z@^8oL^hW}Qt%Ewn82RAGCV+%%OWz|?bQaG+BV2DurL{a;Pk6JKjv`OXog(uSjZLud ziA$DtilCM;i<`CXm3Rg=#8$Ikz<8hvA*q9_Z=m&jy#N?s^Pw=u)H7H%`lxZCMww_F z4p0x%o^<(cGjEG;FSee2q+GH#Y^%$SpBgHsb`;y#2Fx%zcJ|xRF=a7pUwN<1UnR;M?&I^fL8 zSkh+4$oc@jN#SlUx4a1pu=CyW}&&xLp#T|LJKUV&A!g2E8fCm z$5fOWU!o3`xiED$iI*>pqZVMy5&NXV9;Zp0zMs@g78Yq&Py}XBU)sVKAPCagf@Li! zXlpzUV(Rt+24y61+J#>bPdbYxv?2E|F)>usB$%S4&TDhG2%JjPtm%(A>*dRrX`ec@ zc5F6k%DaH_fTYH2alGoN-sSY6!tg;a;^vgfPgH-!xRgR{7yf+@5!e}zpcIj`y_zOm z86is$fDdGbV>2d5++)(j)7;!Xjys;_?kE|hGWN--7_wfp-%f*!sZfl(4+NBl3L`K3 z(oTeU22RIK3uL)Vfz2s0(MW-^*z0b2^R?bAqobB*I?Vc3FSC_byAwMeF2q1;ZQT~` z49vm*o;z28@JQhRqspxYf?za4;dpe1H;O54%GDuG*j@=uKyz9ODf7YD74g-{WKvogPxr>_JK ztT#X^H+MZqGVq@imefGBA9*v{x{)vt)V}r9mzDwI^qgK?tS9V%u31@Aqjo-%THJiy zl0UdC4;@m&vTNV6l6mJsn0NO_uwF;=+eL{hw7OcSPzitgJz`25e3<+ZS+xE~@^S*- zP8ar9jFs?9_n_H)e*9Qt&xDrZ+~dD9$4#H7{*Rg868~;B_Bk^qUjDo@c|L|uD0ziF z4SUL5-XKKM?>~QbZLd^c0j{U?ey4xb*Pc04Y1_x5S()8YW2H@>HYSxf*z-6}<;1>q zCMu;u;xJQ#ctRWZ!FV^{Vi@p@7cYEay^zB=!c{lDmYnYvIq^($)w&2%=L^m-L4p4^ zLR=L8{L_!BS&oT#aFCRc%`eRia@jWG@~0_ngiYoTz?1`zo*X~Z2#AEn5ZhpPdT=UO| zF_%a$ty?xmTV-fs*IDYXISO%kTbu8>K49s!R~Z;T=|X_ik8bJNZ}>iP?dz2(OrgKX z*a)#6i>bK=2|17H2gwNkw8MEp!r%RGP2q)`UyqhA$k@@^VHRRCO`2JwKR3{<+^lqZ z!-frIG>;0Nqx2TX#fql0_1fjGT$|PSs^Uv%oNBw~Xg3L0vgi0oUW1^SJ0Wbn_NLLA zesR8YyBGYdSN40`Sre6#SEL8ZMsYDw+hElNv*BUK`^gz?tE?(k?Pqw2fc#$;B&tcMk|nw;8On z`qSdr7nRD1k9uFZcC8SjLkjp`tePAz4muDXyu@8*?yM+sS9{IBa{qeIKuf9fNgnj% z8pzdl%86-2ChHHVM3(B{pcxR`N?|VJ`d-AjbhVo`ONbmIIO_I;W&5knEbS{#6F7;zrOEv^sc6D3hOc-%xD(6@qe+OVV;miI#ZA8M_M4@>qZ(3cfM1oFf!sp2 z7u~|9ABRIW*sS`~(*jte7oA}4oTng^X!Ym#n%;LR&j0i9 zQE1N9H75u9Ea}>Fj&9~stYW2}+ww;B@BY$u=j2n&9>v=dnvURY~DJfYeab`83ZL_ii0&s}Nh#h~VGn|UvMFtyG{K$_YPCtr0or6!?? z*=8b*Xe2Tk(kY*|*QZaPIzKL#7Lnrabxz=tEpaiI;8}qc+qP{J3r_q7h(SsfnO1^U zGV)|b=e)?+wpGmtx*& z@UpPX@ayfLbFTmRIW<7v*mx&Dzlnk~L3ci7QEcR)$n)n%fj1COq!}xBRpvyI4>vIs%~KE|@olmbI$8>5$$2ZjP9NKrQF~ZGGbU zlf@&JFYk@6)@oB}gKCmi3Nt2sm`2gD-RxB=fRc5&j~W>No<3)g)*CB$^~LH9`z_9* zdgX;dxp=l37oI6C98&JI^x;izS?cJourJ^DtOf=$2t$9j@x5McUV3yp*9CY9Vc5qu zrXdfX8bCj(^?#R%USiId5%ZB-e=uJf*((tuuzvj8evbP(>=vtN*qu8yyQ*#L(tDFS zc-Vo`oHE)-=N3dWaG9Hi=kz|)YsK(9Dcq&9bRNIX>Gh3@vxR_SqfRGdPVYIZh^{~? zi+OvkQu7a4PN)iOhTMqM!~J~j&K2tB65&zUlsUQc{pX#T(RS6!-T~vGu1QmMP@bNv zu65QnkwzOh>wK@1h;$;qybXc;%EM{z!<5Ye5_bZf$npZwqG?|WX&Y^ht|C`X`oUb@ ztS?5{Dm3+J0Xq)tLjkI7PIzFViOat>**9OW6v+WVOOQpnd0(rd!vW~1SOJ&dA9dO%f>j2Yb7uSGAmcxp3kHYEO4f)%XO`4-{H3zx+Fppx`n+vWjQ=UH^F}?GS zlKqssb$7+yx!zx+?G|L9FXt48PC87zvKN5A4ldM%2Jn0|7$Zy?3Ic1*d1a-zj1=e= zCIiX^s@rr~i;bmVg2OLW8Ez%*l$9BKH|a!I>KdysW+$1)coEPqG%3sE5}>w;JxYxe zr^I#?{_$iSJbiVdd36H@A8y0+32*GY&iIKf0Gx~p>BrwXx2r|tZDVy*j~qFYK$Su* z;LKI2Dj$1!LK{t<&CxUXQBMMO;T3R#Esm8(0PN*|Kv;lZK0ZfFVd3(ADv=5aVWa%S zCM6ACa)aP!>L6-pwHenxX1=%hpI6?x3?P5=6EPqEgL)qty`V-27x+MW&9W(SHNs0M z`jGYcjRZx4cK;Qty%mi~Jh%WjYJiG!KQQR=Dy8G;ZAprBoQTX~0q#W01Xg*?@umgnQWpvks3*8Kb)kX1)ET)q`-`uvHv}a9g6D zFd%&jw}w9*oUj361dR&dvk32W63$fGUnT7_nt?2QsIS)tuk~c@sBs)(PH>%NSc%6( z!vf~O0r0Anyi8Oi-rxd#P_G1;4%*bZtq;_zwN`NZH!CmAq|ZbQ5^y*8c&x3tD?HjV zhV|#8K{j@N_h&5~2}0gV!f|kD6`r|+;eQX+!qoh{&1>ZaO%>hs!^Tk!)p^T=IWRFM z@VGCwrqGwrS8%F$un>+5M&y$TQ?B64!|e%4zSlihI#^47CgKn*EE9ts z4$heu=gPInL#gPuHp4O4M(x>#wv=SB{Uk|@!$MI&6(&Lcwv-N>%3I*%u{FqauKWZTh(zhj6yurb}rdEB(&{qP5AV< z*I!SX$v{HsLJ76vHb632(8_aSaspFakOYL{l0I`oX9XO)uS9o~i$am6j^O$B7vGkm5RbLLEAM(hf}BL~;tq9E)#bR%uL4eM{IO@Fg- z%$V85zcoG2q@9|mztq3wxUrk}4O2a!yzEr$R>hso+TDDSx_b8QceO?NP&Stg=vSs?~IyV#Fz>p8h=pfBoKe?E2`ZqZ)1hwkaqvqtGMJ!%Sm) z)h6@k^x{8TNY57uWR9=>!jw9f1kcl~-kqw&tQ?acbaFaET$4<9>Lk=fEr zlw{D2Vv81xvK+a!h0D0_gEkLtuf%dyIS#C&Wg7hgy0p?VA6B^j)1~P!FJ%k+48R(747rgaVd=7EVK;6ZW!@hKnGw7PyYq*bYv*{| z(c5Cn_|vY9)lK~dnbv->9m^tAm?LA)8BFFJH-5au`5C-P&EmA5%r9det?%yLtH1V9 zQdHbGyR0DQ>9Q-_nyIuLC=K1CX`aU1IG43+bqx*M)4Fjkpk^Zs*zGxt#dB16@Z`xN zCV`$heL925mkgyFv1EyONiQ6EIryZmLRm#c5lgV&2iVN{*j9V?5{3Cp1x6O6)#60M zE(HfZfBfTu8Xg%L*`r4fvC*E*TE@q5pS?Ub$8h7XLF_cK3^op6*wSvMZZltL_8@ny z8q7q}qU)1Llh&~COrw&v8y+Q8RBuR+4mmJ`1DIxBVrFK>dz{{@Eubi^rmKdA2A7?u zzjXO>nk!&SN-HY5>FXb0wE}xWgBMLY85YJn8OGu0slwx)Hu`()|9b%nnss^ATAuwB z2r=;2<;$0!K6_>X_GX@GkjeT345m3ZqqqC*H`hBw7mplcRajc$qi$Mzd1fCd+01|c zeP3e*+Z>5|CwxMbu=VFc`gH;7dkrn@7p)b!lFJiztR+}YAhY>8*kgfT)dis z+GxJ)KGn|^Hrx)<4N&sW8IZxeqEz;=95G(q3k@kYDqP!ZT6*Yb4byJT zHn`uQ38i@Hezt)!cnYfvW84N8-#SdsW{)0JkiopiKj?wvqM^KXNmBuC;pA_eRhpL8M|=U zxN)MYoO`%dlK`%aDca%JZ4#BbKTIqK=+l833OT{*stxaL7mj>^*M-d(jr zhjFV`4Z;-%%iGj2scqu2E6-lPo;Ye$BZjqkkTr4AJgjnGvgCu+p{t)FR(SGcC!Pwlii71H_IDbZp7Y)42?`OFLj+cQPyM zPNvI4PS8{vn_`cB)vSfFWm`;n1tS-4-M$^%{8sU-ca11EpaLu0S1>Bk^5~!)jFQ6A z(Q)_oh*kF)zexO7 zH{TS*1aGFt<(sVjQc_|ydGgb}n>>G3&RhR)$c9&ph!l!xdn?U7qfctFedEz0fP!+n z{SCYDi1eBrdor4t2Ds7K3b0^M$DV!qEW|dI)+C9bM^H{Mx^3)!^Z@e*0A}w0onl?< zJKO>bX)a7kPChXss_ff0ZH_rsm{gN#TAM;b^0dv(LqC05hVv;IFN#g^XLI|pU#d)b zX>gj8!tq@-;5^-Dfy`sp6^)xTX-&u>)eAIwmHqq~e*E}mTn%n>N}3LPpB`!j{D8|c z@32|XBGn~PM zvW$$o{Ot(pbf9$Fay*yZgR~kK^VPp9eU5da%)ftRz=8*lACEjeb->bRI*yteJROT_ zebvo`w#ppl(8hLfqcS3!$n9VO4zJB{{Wl%wt0RZ4TW3fJPfOk(;sAg|v7Qmt=(ts= z85hmC)Bf-?XY|?7KrRg4-50%Pwt=J8rj`H+02<*DD8D~6G@a;8?{z|EX6xOf-O{#> zwfaCEzA!D0S-b$4Er_w z1$Rah7o(p$;=#cRSuY{cVR75A@cF~&+B}HeBt<+{#p_+5@;0VXWJvmN`8Jx}# zQYj{Z5R>4yC{Y-Iq@t|6+2VxrkJxQ)@u?er`BP&xaNKr~r813`+7Da2xH}7+)`X~4 zl$Gt@P>+XJP=B0)Hvf+-$h3DD(<Tt+EP3$oA-~|&s94o@w4F?w zI@My?vQO(BuH`tLn{)dpyDRv}7kV-w!jS=S9!voxQW%#s$ouk^$F-Y&1+(hX5e$0z zz#Q7|M#|YHK8bh9-N>>O+5zN#$DCB=cT*=hySXKjH~RI9F5kY*^q4k?8bFY;>`Hy- zl+J4$G)ihu zgj|HyEp#?~x@1t=_IJd%E+!^HM0LLHjy-!0&2}n?Jd?GIfutucUp~k(HfQG7QCc+$ z>f6fgPH9;9JMS4$-OS8Fm@3WMs~YjT~TAP-Vg7o-IlF`D(d^K%RPIV55r=raN~1syYb1r$;E z5}-x{b9)6KIG6eBp2i!?H$*Hsk+Ed#xN%zj`t4;aHM{L55W1->0=`|8G}nqV?4^7! zg3wG10d2~t5zb?fp^Mb{xL24?oWd);o_Nl2t)12N(2zNr3Ty@9eeXMZ^btv72S;bn zpf=|0{?Q%j71xp3yMjqBTzJoa2?OIRAbiG*?c+~tvjsNj+YIQhlNn=WiWQ?EwZZ*> zxlFcKGRCj;=g-6X1F}K%NmtUG45r!Gq+o_iqqWay&6oC6HVkAemfp!(9BVXT@v=c3 z`K9eyyw3UurS|oYMc_;QP$?NOh{eIhNDu)9p4cw>N z+CIcEOnZ5YB%Wt^*eidM<$}*GWKCu6MvQ(}Ei|Ha5aEk#Xc*{QBk2TwFQ2 z=x{!X!-ow^SU*IC2m;LIya0vszKlLavnBg~lI7+4`Tfptoh3)*%B1?rpwCI)zZfoG zvIL8ucVWujX*>%eD%N>IFj(9Th}+2X=S=%x0_10rO(Oi zOTRQYWzZ;|UAlJ{q{C#;pymm0qbvF*UBM?9OzfUIWy)|DmjTQ*Nydynz1N1m@9yR# zOPdj5#^{s#rLjv&?OnT+SoyV!9TBV)7$4tM>q2urKSPmKR8{XWt5~dpw&DxDb4S2^ zQ4zM>d4wJ6lgOwj@X<+n{Vr(SP}XZl&Z95|YASUy*u^h`hN59FJTh{pL^cMq1F{uL z%gcv`+aKDyw-sOM=4!^y%P7VN5CVuH9d}5cE>|f??GBxcRjs5$5!6hAxDmM zN+|uZOs&|oUJRaDfbZu|Cz`t03Ob!UIYGb@D=l}AKFLWTqhPlou+Vh0VLGzO@Rvs0ZLbAnDdD=RC<4`k{$z2or31B{{n$Bi93 z_iOHTFrP}hc4NpOa3#-7rr5Wm(5BD3x+>lC{Xd?+J2_vi7h!katk{ioMJaWLPr^`U z8P%oIwrw&cl<&@+#{X9TRCg8~Y6wYMxpJvz)!>;&_qs68^E!Dh-_UIlaxY7YG~ zGVXz`K4BoMXPrj+dM3hcUz*8E;5=TDP~{L4?8-jSke(~cmFc@H!qkO%%z#iA^6mFv$wO&J*JSoI3w=nzqFAj^PIUe*RW z3Wl|}uY1SV_c<_tW)6TbU*M-jw09^_a2u};9je~4*kvszz{ciqxv3;C_Dgjj|4_um zBu=nj>)!GEChjgOK@cOY8IO_?^?iiZ+$H_ngMk`!(be@KABHfDd|ZPmE_W%n3hV&{ z9{5#m;fh0Z-p0~UoU&|j;V`SVX~RfJle@Xs-LP{wS2%meeL{u@D+xj;9(er7am4FV(*Tz+Pxwwi(+tE`yngUS!)M18Ry!ppjS7JjX6uS4<`Gyi>2)ZU_sTAf)bQ- z%!$7*bMe@YIo@`X)~3^8VcPunIk*I<`q?C#Nf2iJQ>^{hpAGh45Tg&L-iNpG=B(W4 z%^F8-0|Oa-<@RW~6lgZu0u2kAv3vtft$?w}p!unGc8_pKG~OH5 z`&9n=bpVzL=7Sq_l56t)bM{`g-PueUr+Andl3_$oI{3;F4rB2Ffts5tDt@TgSK@5= zf&Mrr1OK3)$Bh2FCk2_MrH+wNj`u)io1uJ!%B66nEPF1+ap})EzK%4d@!J)!ys~am zdUpr1A(9tVSdh`orDFL%|AdEyZN-baN8QMR)IkE|#m_f5#zNkY*5j`gYeW!Y3}5wo zM=7pLY~o`Qup#*Z`j6yhwjEcO)weQR3$SMhR$^tyiL+;Y*~d}8HoM2=G3ndJ&YIN; znodVoci`Lv1?ZMhjD&XE^7D7Mjb3pfU+Cc5BzJCE0PRB~{Mln+k>i zGT5}T^<91sYL)i`YTHUV0_aYrJV5G7e*0FF|8d+g+wgZVlZ`3pAdK~wJnh1+i$pe{ zj2%0+i-Ezv$pcl1NACU#eD@3TP%*`ZvSniG^yx_oX%Xo9>}w1 zO#TzL?urYN?G>xOny3}bm+#)3rxS7hd=XRf3t0uF-M_zb!1$tDP1xV_4o^`5^w^>J zDDOC5clRdCuGj(E1OWpKPG7pTAK*owDwXv*clUxiILu6iXY_86pc#t3aM7Xx+*=l^ zkDV~VKm9CMxA#`Ly7~2yUf@N*chZSTtE$*Hqq4>i8>Y}J;L-Y*C&N`@XGA5xejUup zO!h2DISdgZX{b$`cLg1q=DVBfnh856*%Kimeb%SQ@Q~FcC_a-TH}X_?cx!d_FZVM1 zmIuCG>Bv>j^(cQrWOUgAEuV99Z9hyX-5fm1yki~w=R_BSR825lJPsbpHoG<-TWBYB zn@V7zltFYj#cKwIpmPqR6eR^hqUC-0X`jBs4xZ2M{QIk~R(2&OqFNjX3W6Sr_H*pY zEq0fUWFgqz9&cZdNC?%Xu6(1lt~?&G=(d6 zeVaR4C?NUqjbfQP0!Em)X_Hwq?}DKF@1>^t3ladOQaFs*uB63&sbw?#CVb^KGn5Zs zAqeL-&)fbuF+3J3l?OHf#*dmD9~5B--b5+>&wu~GIfq60^h_GeAO$G6WaNa1sHg=H z1nQ>l2W2kc)Cjou4;AVQF3kj=P$2X1*&x(~t+2ySPX!wk-wPB@Sfh>$I6NFV5W@B( z(g*oce0t>d(jPzWvz76B<+4jN5%~H1_4ge+mMYvW)Fi(}S4XEIg|ypNRjms)awuM1 z-5t=|CPsSbs;ejWXp`1j^RI$K<_I*~XpBOlJ7maV6cX?ANZ z&iJ#?u(*8p>y_cmyg*XHw@5+UiU+DYaG*bg;m0C*(=ps7(54E11IoM-#|hiQiU4mQ z8D%xKf0u7zW>O{=$0v)s8W{!R3pl`6$9+0>;X)lW6xDT#WevLf??6A5$uX=8v;qx} zKOJLJ>H=x3u#(aLY#kl3a-|+kV9&aaiSy#cRvXWV3ZSf&cE1|TD4n+59p>cJ2hNEi za3H&-#COD^s&}7GG;?_ksFON8Ynd(5GPO0MlKs)5cp^>fYU@taVQbe8fkg&H!urei zlvybleY%E(gv9h5MV#&ij^Rj;q_kyVF#MA3t#t#$H%e`8+x6$~=Fu&Ew!uOZI$2`h zKQJ&*spBADupq3wZnyPbhI2AC>RLGa-Gc!y7sv9bQB6&ma=63U*02B_B4 zxE}Y0^OTf~F;a{|GpQtGKe_LY9e1BR*-f%x2lEr!B-042M4<~Bk;>U3I?ag=2c^SA zVUSE>DGP2hCEvMYm~<) z?8Y1cIRoVfdJ1Xn{$0IO6A7g2XtL{|zfch&&^obQ!A{3(uO6nSJF+ZEKoAtc$r(`_ z8flu|-0bG&ww`Id@|O{M_+rYAbzh9FS3PBnv9RPbXSSym4vQ1S0Z>riit#m^j0+lP zl(Ww>MHLUR1bHZ;c}($Kw_!tTRn@KG;o$?72GEpUC%KAi3|dO3Z{OXJEH+ld`8tCw zB(YX{tG8@I?M<8wB#lfV&G1|ln>SBPNeRzhZQ4B6l&0?loI_KhvKlsQ_+V)(txfkJ zMBvI=u&G1*x~LLEQ}02m5UpqvCK#6?!n>l{Lk?(%_I4SypM>IP6`k!5zX{$Oj%16p zk@m(a`p&Ojv5x7qu#FzC*(~1zU4(Z4Y7->^wQEQD6;L?!HgwwOE90C5_;nhxhpVK& z^x3I7=`#epr`JW(Y9&GcXrl%K^v%*m26R!Wh=s3im4Y^!XSRE3<_3PKaf6VkD z#woXMU04vP=(310RH6nF%Gs&eN&%u!V$zc*EubX9i`m(SiF^ZD)FM*RlR?RCC-Cg_ zg2~HxGNVgr+f7~n>*}358k_f;{qmIxMs2cpoCOIN1TczkOP7lR9` z)GBm=UlPbna&hz=ne$E<)8fBDV;Hao#e+3gmss3tR+$G6x%C_r?407i)!^#Y1lSa^ zH9cn{cyuGEy5#nMMx=`(7sZ3g8wQwwuL_I1qY_dHQ=aOdqkco}t<`TQio>Eu;)7QM_X>#~cz`YEf?WLR5Tk)(!U$7WV!5&2b*6 z#p@Z?UdbM5@!y@8%;>!&E~+gq9^Rx&g|fGDF)e@e(NKoq3VFy5xhGs|NYVQU4*=CV zRb0ct!2yqkI0aZ>4PI64*zwb+o|4c1a{INZbNf%Ww|@);l?sT-VJI(I0y^>5ty@9! zwkPH%px9rUDKW7&GCC;Gbb|pjPu)w@ z?^KtM523j8JzvcP!>9V2xw>4kW zpIqwuc@8;&O>wMJ@WUAvL~7*gl}h=d`|>ZRIgIoxF_s>&t^)?B0F)#1o4Z(l`toI= z=m_XUvWKBxzkZHSKR6pw4vac6xs+z2{f7^ykfMagp936QA@%Y%s#nqQXq4OmopUl{ z33e(>BjP9)8#p_uKYW_kOsl2^n1aP|oXb4u4B9ldQ@k7pkTq+@unZnMz(`6W7Ek_9 z?c)Y#B|;14&le`(!Yufmd<L>RDrCcV3PEm^%@4w@CslM>2DHQub+$;A0%f8)09;ce=NlyDiY# z^H*kQkKVlzp__s7*~nYP7}s>J_-xaW90*8i;t1Hm2m=YzIOc-S6sTpxrbh5z;R+eO ztNrk)Q&qXA;_Gqk*AoVBfLu1o?!ysH95z<8l?@1j&lLbf0Mg>!Wk0Pp>{2&6K#zqq zEcfTu_KfeE)bDBQ?ssZyeha);xZUwcr`@CZ%5nTBc&j%&c=YIAc6N5a2(^N+17Nu9 zSA2dMKabhM;$((UZpriWnLyh_=pbnJtPyQ2s+BnYkciIj9;gTrNQ;JoV$-I8k{0J@ z_$B6dL3CmA$QE9koIdD3zcG3Qd{_AmF0&~LAv-2>AK4o}VbLNK=QG($TN!rpK%O&pYk| z6&iH^VSZ7&sECMp(EI!YWtwA$0c-!cQ`KF1ik4k@ncS7{p-SbcjuinY1*c`oznu~> zoxsJ+Fu3`7q+w2$8FKS|r*KFo0yea?e3fkmz}_H_OXo1H7INsx z?z_?aVSMPh_4M?VX&J(aE?X99Qr;AJBx*v^U=f}~O@{&CWx`-~=j=j=77s?h236yW zAvMYA!cn{#*zY)Su~t&QlUd8y?%GQB*az=+Y}>36e;ZHP>y^TA#N#1Fp2|c0`=r&} zWgKjf3y)IVdDEsz$ca1haN&H4tXoLf0?f!coJ6Mqn)sJ=*Satt$@J#yG~#3> zGpqzNONwGx+VoyHc0r{2Yy@RLYC>gM;YTFR=;BfENZF0+-jkC5!;yS;^f?a>l^FT+ zZrznBc+uGdk-bH-BB;Rqtjc=ojVxr@opsE%@UBcix|^P!Zu{(!lR+kGI+yr5`$eUl z;`HU9xRvO2NdXba*(6kP&*M8KzMfG7%<#QIg&jRHx67fDNBf9gHact)=iVy)jzcQn(o<(L`Wz{{*| zNZ=ibRTV6Zwc!vNhT{S^7=C~h^&zacEGZEF7vdR>adlZAuee_<-#Y-+S4uNSEV)SZ zwTg<>KmO&m6pPDuZF|3fzxpEvw=@N*^vy3NHRxX67Q7QHt%RMNI!6p#x2Y zi%<#?zJ_GXYQ5jr8Gs_}6Qvsa69*81;JAW*p0@B!?aiYB{IMEZsGMz$Td=*Y0e%H4 z66$f0r3vd#v$9wZk%%_VQ8jAO9X`-#eSxZl{T1+5k6yjzBOnS>gh5LTZqui?Aq^@3 z_KH`Uou2xT03SGLsj85QEPh<`rkRThN(;OEk^p=6X-Fcx0^8?ZvBQ^$53H;-v6UO~ zz&|8JuZ1p<#(oNG8UqI`XpDhEyazxd7~0VYQsmYzsjcW7gbk*vSfXuW z**nFy;;LUT5FHGh+C$vv_U_#rCMVp2=-*45!m=RJ1suaZ$QLZ;p%M7hxpPVwKqe)A z`>S~!;r#*V7qR?QN!?JHW6*BT9N*;=2;RK=LfkV8K_6+|iz!bj3ctn`w#0sP7pQ|o z`njS*+XB1H%!Pw>b&JPDR~gk~Qu{r!lDCCRPoKVCl`O^DBBXACUq6^eFQjmUDq8IO zgTTP`dX=~DRK4$1Q)ph(02Cud0bYA}>d)QOZz~rZenx}PDr5QZF^ihN-SoRJ>gC9& ztol$*Pl!GpAkBrPOG*Ns=)I~0Try7eYb(CH;{gpIR__qRYZyw}{I}vsJPcmuERwqJ zCnh!+GGvHjL=<8_TuxPHXpM*_i7YLLt~_|g-@;yJ&COtFmvXk#meZOMxN~PS)Z4Ps z(&LZ^u(uM~Lp;8X6Y#($X)n!!quH-tKWU=rk-)w1{C+evvjIgRG1^NE@dgBU~n!G^ZLpJ-LT? zgb^^2WcLLIKEzN|`t4g-TwHs;iXb79BQ!W>R7n9}+Pe14%FdPvhCD!0;&0pG=eTht zrsh9<1FQT-GSfzWN{(Kl3Cggx4Y1wBk}}w?VYhFTLS~2 zchaUMap_IyOXK>KQ|_{qFQxXkXYF2gc6k0agY}dJN-zW|>(hU67s_dJSMJbZeMC6) zLL*_3{u+6RIBeW~2vC)4vUKIj#&ZG3*b8@%1Q26HT9KP!VDKYsFNIkQR&rQoGq8Po z^Gzl&iutU5zW%{{0@!sFH&oGO6qtg8M{1HgtRM#B&hJg{`cUqZf$BAA+@A<73^#|c z+jr#xRosM_Y6krC#^lbQAG4$^1ulT$(Z+cQ>+`lW!8N!i=&EXVHx_82Yse1VjA>ok z+0~EYG_g&1r*6o)t>@02OC8{$l@w1AFRH%K7-Vq;p^ZlQsi|mcdJccPk>;eu1pJYs zMrAyGn!r{e8TPdm&+uuDJIV#xl>c+ZYBgiVH#!WN3}y#A&om=)t%9_S$~X(6*oGCk zzpsp+FkwAzB-@yUO{r)lE3&;v%q{(v_tYaHz8u@M4_XPM)~C&$4YXUn?#rc=b$})q zJlx+$I5WJ6;L{ht5#+8y`n&U>2Koy3(zowKwK?8#4KbiHI#H(R5obE%J1zL{zuj2V zU=qx0%Jx>X@N2=dQ{$c~O|`$qq9#^$I~FAEfO805d#Mn!XJ-ms-B6DMKAM}3K&+(> zZlslDMGe9c#lgCJY6NSo_Ys<;p&ot7a{Ty5@qb#;wt zLXz7^934bM3>)|!#sKUN{@dEZS5u2k-^%*xGOcEuHH z6&gIyU`0pP*bWdu4u_PghoZ|4^`UEa#n=8Rk!@PsU_P{%MF$NcvQ?5b1Bb5FqgYy9 zG1=QWB19nxq8KqW_?ptc-i^D+`aPgY{s|uq0Kac}0$QqlntKv(WRaKOUD!vy6VQWO(r4x}kfJ9GJ`+(Brd{M-*eCm4M5-o9O|=XdAI z4ny22t=qSMaCcji9P%=N445?g;51#J$$4Svw$O;bWKezkZ>k2QP!vV2?*ZFJ zc4aN2Kc*pUO7V_X(3)Tv;=L$I5=T-rHtZroe>n6O1~p?xpJMNZU4;H+9*%-2S&gPeWr+)i*D8A# zK37oP^Run&?bT7=%x_!_+`oS~f)!jycZ>}1;V>Rx{ev6qDJ!sKleqdreT%>b`wWQ% z7ey#SNqGmkDZAx(VkjcMhYz>oufsmoob%V>^a`K<`Ex33b)`!KzUpMg14brTaof0- zs^^+%CDqE&{~Scx!L})Vu~bpmqq|iZ@c_|G1;!IX9$;nPad&Q)K7G#FMD+ga6pom# zk9HBV{(T2oFAriaIx*RI!db|oC&z}A*r3;PZbwW6I37_grrSgye53Q%u7 z!?lY-qje`EOyLv|=7dK>!j(QIo^8AH^J0|m4TcTz_48wr(>C0(bV>>16P*o6gl7_N zhh4x^XuskWKzIWR2>ksj&4!ZPFJB%+zIy@JK*dNaP<*^O5L7-hfq+-guWT1c`cZLJ zNk2Yhs(fgH*|gXtl7W#3ho8)_e;(?BFG>gqPGc206lsolZme0#dw?YexHjnTn5Mq+ zcEt>2Lc-quCd0MvaF7d}4fS4LT0>b0<7rD~gJv5Qm8FVgNX)jtwv+UzEomNQa5ExWdDQGY`PZ? zk)36PoD!1(?tF1ZqbG=Q0ZSetASLJQ(lbd2<8l}{=-2=JctwTB)%3!yhx@L^2b3to zd@23pL8XjZDkZM7CS+UIvPC4kT-KVlD>}t?*HidDq^Onop6o(A zh(*X_h5MVVpJFiOR`<5!#BUTpJ6<1LH|iF zYeLTKWyoSA*l$dNa(%n;r<9~c7rf#Wur5)_NUGt~@8E)pOIXB_-SBXnJBm}dI`>9h zNWa9TSYp!Fty|ZDEye9HYO>Y^ZN3OUS#A}d9cF^Nf&>rq--$ze`%~HPU%wy@#-oGL zr-tq!opxs?1!IIf+uTvxD{eZ$iN7gfdf@|Q0tQqG!3lZ9iWUTlTQOXTK!SMQT3I>o zOV4+Oh2;GS3PLeVfW}>y?V(c8kBkzm!FP1MpdBf`3!AJUeVN7Tpgt_fY~xWh^=(oC?=`PELR1p`KX?eOv+M_;8)toG zzR!9rR-$t>XskrHtd*L(S7lR#eZgY9mIbjn()Ywak8>OH!u#2>D?$qcM%bI(i-RHv zo6?@E<}ZV*MKS!^Uu#o6VmMW~SgQzX@MfHe;N~s3xZ<@y>4U!_Vvx}qKz@q$O)xqe z{d)KAJkoBa*JZwUbeMHU*j4M_Sv$}7y>LbCie8r4zm0}3A62z1YHPD)vlT|E^!Tm) zyVt(eF%$I%20nE9`Ljv<^+vW0l>&8wvdc?NhAlSoU-&imw^6a%B+tOlx?YB#$JQU| z8=J&zn@Z+WB8a*@NKa2Ga-D*`S55+bhLeoyF-k*{v@HJ=l}v;chEm^rec_49=Gv<_ zxBvxUn?>@dT~qt6`to9m-R!0=vV?*fte7N{vQR&NmGN~#*T;;LDdWtg(L#tT2KOTO zb-?pO>KsO>VK1Hn$-fwyr@N7n?ScIk)rznu7&h)y7BmMd_R!NibM~y_?Kz&g4af3R z#8q+m(0*}xz)T*vKGfp!yrxZ?e*gOV79KWm8l_YWujQ*tv7 zhMO00HY}ru_|KrV#$3*5ZE@Lwun14?{`2b-#^n#A0v-pv|6CD+5s{!xmm>~i0dn+v zr90r_nmTRT$EPP6FgkqsrSKljpaI3r2q}6I!zHmj9b^l$-z8tKH7g7q}xqOuH?=v%&h=Hk`CC8%q_Xk-11*v1cR5B<{bQo*v zWGu|HgoEfl@#x5FD_@_=3Q!K83nfIM-wZc_j_N!Rfn|sZt_9brKUw--gzumL$wahC zdVQza+3jS<7mG1uCfM^{Q@oYUF&;4rX%EBi_zg^+TvVEO7sga`U_E_U94dVtWJ|rn zek28Gc%=Aww;XmV7u5QVJ}HlxH3zak0K&Z9*zx0y^Mf?7>mpzm2f4LW2;KCnCnG*k zKVk5z1C)Y#0E$l;;j)Mv8Pcb6QQ6 zwO(GwcK$8Jyk^Sh3LucxVZGVwr~|11-}N;Ammv`8yE+UMPN>ZNHbCh7cnsuh3?bJL z^#;0sUm^@1F|zTEHUIURwZhwQl*V2k0iiq!dVIzks=sHU`th|TZ_L-dbvArVgqI0- zaU>9iivv=av?EejmFWI7AH3VxbL7CCS7L=}#r}*hcPsV-_a9%@Pp|(@Hc=B=W%s9L zs97*3FnGhem|flYf(3u3dMVe2zAZsHHL?uU_m)XNh5lA%^B8s@OcuYgC9{HIr7GN4 z8NZ$~P6d2ILle6Z>b6VvQDZoS3=$*5NKr=cLz89`k%aGCw@l1xtKGQgBgjTUbFM3E zhwz+XK9o8eAC&1de#!S>SY)a>)9m}V#}LmKCquGn@gw5JPXGvzOmI$u^4r8Tkk^lV{8r z?e1^%E(G@ zQQv_sv6R|av;@KMQ+BKc9+m7EsV$KWG$3XWL=%P}EN9d?BWQqexRA3}n$sZ#dpwSG z0lRaC0v_nX`Z-cd5kn6bL4DY5xP^UI+)Y&FqP|Mjf*>H43H`t6&u51TQ604!I)CtB zT!%Eu^@j)M95A+po(NLp=CB@iHf&lJI~9}X+JgE}{Et#nF}zBYv67$Vm@r*g8}zVZ zi*nd(|IXZ?5s{HGOfafpU%IMdLn01_e~EVcaemXBJ8505w1$W}!CMO!>WALH^I2K> z1I?fnP%+rMtCvsCC}KeVaXy;smhMS=FT;N0eR+u0jlV)&?1j<)5OKIX?skHyMk@!; zKZDav%9UhOxN-D}D-HyATogC9jR9u|Z!u+&X za(&qC@Z@RJ61fL>K$!-FvD?^q?N{}ZQg7wACo?}XjNv#|dzuubN=h@Y^&ql+U0Z;C;Yu1J0K(etrltt2us=LfbKlmcjAhkQwVtr=_gkPLWuG7oym zAl2QYBhH;W<(M84lWD1#abaAnxz@`QXwTm&3-`t{Sel+B9#O7m?H?f@Vskule`jT7 zl`-Dr8;`w=ajcoopN}MmvRm=yL>*OzRcNprjQ>0xovA&F9aI0+W_T}YY!6jFp#=q8j1Ss6ukDMCng z%I|f0zQ5m0{%oX5$z0nFqpGEla&yX|4kGlo`tS`@5vsQi!3IJbij z3y^u{sZUe6E12nxJ|7XRG7s=nL&^|Vqsf(rD~Q^&r>WS10DcYEy~Kk!7XajnO^iO6C&9QNYvnRN z2PuTEbStbDKSOFdTq&sYLYNT}%3B~eqWCx~t8h)E9HY^`=+pKA=AHB@6YyLXWC@M| zTE%dktE;}&pd~JZ5K%P^?{Nenm(Z(A-rilyzPFKXEt=>R8_r+b*}|-}`d2$*wwynr zJPayyD{SCXk$p&yTnk*>`UqTjd&mzb zO3BjCrrnA)RlPOn2`*QnPf$9PZ{wLq9oT6O{^bDB+Wn)tWVmSlIz}2)68#TP@s~nO`QOPh{GC2nc*={qeTLjL+Ua z!oZQm=@e6aR(zQwwV}6nYO_&o&C|_%?9}76u;Lbbe3{Lnu_R0jjxLT{5s$yKu;HH= zoEh#^{7e1>{GDtzQ~|JtA(V^5CT=%n-0&WA{*R?B~RJs~R$B70l!S786vs!f|4R)%`TXPIZF+Q`_eO_HGUkZmMk;W%yw=1BE5lP`rE zjxh*hRNsIXwh)}2#j;r7rpPS7D^`|X}OiMcv#Mk z(>ann&eb*k^yPHqhj?8wD9JxKtti_Lf7&=A?=tBMv;G3(bC})B9b>$UnPu60V(a8I z;m5~kb4~wKiGLQkT~)6*l=6~fC`t&D1D_a1av&NTFS{=Za5HS`+03V|lClR1;qihl zojY5e+mf72OT(gxw@=RWl6Wmsm;(k(k<_UeaB-i^j?pL)nyZ!%W{zjQMEN6o9pD~a z0d~1Ejj8G=?8#BW%H`JrDZN=ij#Lk*ztb&)fm>E3NrO1 zW7IK!`XzB#Z77C!$;sPdVycBCXE3eO5B}#LBtrincuD^~aLBUx=pX!?m^i*+rb@~+ z>DWtk{$9hKkdfb^@7^aT+u)Z(2FnL#G`c=s@3ubhAjX5j_uM-)ej3U$lB#%T&@zF- zgpUa;eE85CAKoevB~Wzd8T;s2_=b&25N~ivM#Gk4$;>i^f;z1y1y!|$>{MxpY07;E%a(Z+Xa^*Cp-ySFnA-LmKf1f7t5_TQui-8^oOf*~AIyhXV+1p8-4f2*i)-#>|_W=8OX{9YGh$$4J5o)Q2`TEk_V{3j3R*wJ-vo|a3O!+KNWQ07IhymTH~nfLL-c|RhPCbi zk$KlIh6K`|Yyp%vdf(91WGh|)4LhYA9+5PLND&gcDTl?2YOs|hLeE!6YP2qRc0yf8 ze8AbMl5-Z4svj~#S*mhedQzoWqc!XJ0EQz|%54=$=7@ts8f%>(q}`}ZX_ zlX9sPB!;prq6$q!G`J#l7=f)6zm=^9lk^-@r|K*+O%JT9&0&k3^~M%jRM%BX)=C9o zjK={sUjZBvIEVo8g3VojXkNPv8>U0qg)o#kJ5d5{RZxxBVxoWl{{1h{&Ro1;0c3rX zeRoD9BlH{c>6`!Bk-?bDY$G@EQU7mpi-bo#L~O~a^uyNUcXU`Hl>p*M!10$le@lW? z;#)^H2vJ#R2mXVKTwCT%Fx`=&gs&zJ*f7c@%Q6Ansk_-e@cGEA^3;?Rkw6FV-Ut3gZOHMoR4p{1xL#J3vLg7m#}FlfAa z^XBpm-GkgmVCS*v%9r)$*k<=|tKNZ0W5#deZ7QTZG}0VYNc~BDlXy!7$)o`0fVww6 zw$!sYr{8yYko$TPq;x7`vA`Qf2*fz_FMKaXc2biS0WMT~3cx%%1)usBs+*{V$^aAH zhj`9VThwo{x0R*7DvRm8_x+u7`nIxOz#}xKGULmkx3`BiDWxM;2U>Ie^`-33yD1mr zPo3iXhruL>^pLJD9t(}cuY(B_Il>I*`g(p{Y(_089!XQwPJtJNdh^bmtJ^& znNL++&8KS0aS8BhEjG3%Nd851QT9m2z?Hn!=AbNEI6+tCC0F@DvGcB5Zd^k!AyGnP z`n~}!h|hRx3S!I`228mMQCq>Jbe8|O9Ar7OE;piXp)#kq;x^{ph#)s3fTv>~mb}$o z$@`07SY${qcdrB2=akSfbz#WmA5;QZnaDy()VKg~*IG|;$_{FxPMtRF=Oe-?UEXayuGM(93Ny*UimG$Q>#-IhmM? zzw&Z#{fyBd1ZKJazU&y12*pB)w2Dw#qnp_=1dAgw9w-sJtGs{KuKf1y3Kb5c4p&@y z%Q6};3Q=URI^@igiR506E3r8_xp-0JqaBYKYGxk= z{igVCPD=_b#Wql?0lsv7u!vol#leN&Vbn8cP9Low#;b?wP-1>~awdXZD57=(uQj9g z6#F4+`lnQlvT%gzKmEb@*5+RBZ^}Of{4f*7VBsr}eGz^YP$Dkh*fq$#J~%5Bo}6LS zkMvZB7N+pB^>W8XN|UO`D4r`R6!ZGBBL<(TyVTUI{_H4x|4sNoeh^!rk#at0l(>3d zd^b34o+P2$-X5a|S}b8caC}S4GSa)#|?Y&#L1Z(eJ;h-g~dMwWXel5^}a>Io}HtSyhBZ%HM{j_X&%TvqO~;^+UXK;^EjqB9d?=kW zmVRHxW?cGpf#34t6NX=-YA$kC_-W{3c<9h7sZT09b?HLSdi~lp-OinZVfq%f_a|7^}04XlhTeUxXKm{J{Ezbi@C=>Shz-;N)Op zhNT2A0F0hE@s{ey>(;@Py?}5(YOH%G+Bi5A9(%EPuT|TkHme{IhOr7b*?@|z>-mWb zhL-;L)EFQ)IiqjwQ1To20_~3FWbsR(Y<14^kJ`441!h;~^g(oNWfq{9TM;FPT9Gb( zaP8Oo3W?kPupAxJGIyQZFdhd$b(g#^oH+g>qMs4D2HSWO5zpvI&NthKi{`D{}aP}InN1Pg@D*(a>FPcNysXBjpw*j-Nwisn+!pl~*IJGz--3Xn%T;?2$sV= z-~i*sDf?$Rn;CCkd(Av{1)+>iWh20wPL;ER{dUw4(sFU!gJzzE?IAzvP*}^JM`*IHW@a5&Ox=2vdAdH_tE3Q`{a7m`GXtONi6zFc zZYoM(j5;z=B17=HDhe$OzoY)Z#(I5TX+fJSL?8AGJ!#@|+U$A8f2J#iyB6UfUkedB zw5^mFeEHz&nhncl3IN8ZVYLMc8z;^D8~6-8!JjcLMuU0+|tN&LaBS z!#|BMBoV(F3*nFRg{CR z+Kpc@W$d(RkDDC*Y`r7C8)@JkJ_aAnwCI9cvQw~Qif-E-St z*ABE3wuf%}GKCY(q}i3TRL<)ioR z!9MZ+L*D!rMEg=>-$4 z=FlMbl;-ho^{~Gq0knuoGE%}-YmOd`B*h%N5E>N7D4|*k^YpAy(963<$yD{i3^Hmo zmBCo>H|{%Pbr8ro)F^V8WGzGD{q~U7(PZ%*0~qdVlT?Bm+HL)4hpn;j+!^8WE@sPlWC}ul9f7P_WgODP=WI^8=Cn?~wMT#-rAPCeLMoX*XpGY?@|Db=4pCt&o5=S~c{AxBCCe z+>fPkv7-|vFU(JN7gHx@7iu!u)rz3$v%l!KDVT{T_acf9&o|K^+mYPK@`>B+Z0xbx zicP2+rlQ0*nry!vPM0S|M*^UOwt=F6p(JriV~_KqGqZ{6zkUUq-nX+agZXY-G-H_- zlQP}H;tl@;L7MM7nD&GCEA}^Rati}gz~p$#;{}U~+7@!a9UHS4@k!-jnp`1e39?`{ z#fvsg1d*hwzO~~d{0>;EUrlY;0DF7TIY^X#HKnWqkaMwIt97Uav8F;8jS%?`~P(Y6907QN5V>TI04_EDn0vDbfXTc+++d0|~{5;N6_iRO>B zoi2V_;x~TP-#Rw_+1qDa{QGFR)P1Y>1ss|3zJiHodKz}x6?*n3+*JPxKl=<7eS78$ zh_*61#2E8{l|57JX{yvh-7hxo+VS-I@+Hff?Cl;FpPrw5UDza~g3c?-TEmy2yMjL_ z0ppVkj~R{PF)}XB3cdpmf})QdYTECum_21d<8k9XZ@<~RI_^rhF#Wbo4Bsvpw#GH@ zgzeJh`l$o8oS!|3%XPN(?P@#yUA0A(&{k-yg6gAC%UebML>0C1)33ta(r*OGpBk8!uThh%U2ZzkV6F zv@b&CGA#Xy=m*d&V-a*Fcf`LE4&Is|2rgMZ<>K$wGGX{k+uQ_T;tnY8FM!|`Sj;jc zh6+sKpYs#TQ6{*pSE}kbrd}s2dL>9YVR=}7x|7|9qIpw*wLxn-shfp~MrR%@;V8kt z7G#8Xo@oC|n@(ZS-l-{tXXBLKFBvq*@5Az|)^0eSSwH%HG$nM#=Kq|GDD9^|d~ee# z7-lf`d&%MWZbSkO5IO-#R}6IXmZ%U39F?vtWqEWY%0 zn4s#p2dA!#*;gLl{PZIYv6SF2sNHS=Un{1EeV@A44*fsBl&liH;M{zM+w=dm0Hm!MMjkl6&F}^VR{@L$59H>ChtHpsyZx8wnLL;59!7DG;z3qnNWC-K92cL?Q>V{qo zA5DC}b=tJZkxpe@_Wr`c-a8hA%$SttwkFrMce@3J{dK#dg+N#2fAd{c>8;E`QB%!_ zb=l$6i*l!83HoiI*2dJ9?o%qew|G*18ZJ?`Xi;5O`nrLJgEI|4~3kuT3?1O{Dj?+ih3<`}s zos9BQv=3m-f?07XDKd+1W+NP^G!@ANGWm+a6f8;C6N^PX;^dhJnr$NJt>`+#ziqkmcLV77Uj3{8>SA2mO!5wo4zKI>_=H_;O z=8f($PqlVrlee&5qBi4%j_BR)^^WO_Ud-k?sWH}z|w=eYZW!hF4`F+q4k0E=r0D?|Vv&Lt%cohTYlc~6@q<6-n& zQat(j^#@S&ab+IjjCbj%6n!aXW%p7{K7+pZjdJPn>29T*l+89y-d9>LJoRO|y*)8p zG!M*s3a28g1$Y{ST2@#d9aA5|{_ci3I&pTJwT7|ZxrutG)a28ph5>*Vvu7t1Mx+na z3{b5b*>qOo{oCCLPeDQD`PKUt)$E-5M^u->KE|hgjZdo|=Y3KxIT^+Ht)VG2)htw-@XBi^ zS0vy|^uFGhnh@Ks;Yd)tYR@rhO&SzHur<=LP>=rKd~>c@dSCpM_kE53c|Am{$CK)T zQ;yAb^Bwy9x@H18s_tEj9RD>06DJ;myn|d2qd!t(V&x+Dh!)y|uZarC)_O=Vr!PE_ zpG)H}QU&OkipObPi3IU5PcSq2w-xom4?sMNJKz6?`lqrP5ihq~&;@4IaSmplL?r#f ztB}ug&0a^J;uZ1RL}mx)Oj41Pi--Y>t+KYPxA)$Z6r^(NC?X<3RcOCdNfLO_iUk4{ zbJ;Ze^H4vL4aPL3U=*nr_OLSYhDiq%3AjaXd`X3d7XNEZap);;4ShN>jQg zZlq_bQpkn*3=7QMMpwdU^4j4q&u&`DA3}+*-eowYQp?kZWL&|0DsNW-`p4OQJ00H* zoE!?lI@2SSZC5Bh2IQMNm}m^?n6}6YnzOE8(+*BQ&1S6Co3X1I%Ik*Uf+~IQ=gcjm zI&#wU{%Gg2|~e-rCCc?4whqBQT~WTPT6L@r`du0dkmwgFr0(SA$d)LqY4DosYMkR|~~c&PEj? ze~Qu7C#zi)%|`iqbJ2JTJrJ%A%i;INPnRkAB@6i%SLVg5JFu- z(R=Z~V#crpUD5mjZ@QbOHy9fjJB!v|3?I^ z9{=y10V7vqBD9AHP}n7U?31}(=VvGnvrFpGA!v1cM9|cgo7D$CcIZO^^85Gi=y8ER zYwPasepULT235^1hk|Ed5%HG?%Y91+-EK5d zpVVmmt0T)@e++bp9klo3k-rfcYMXA|V!h@e=DDf(fY{{D2yv;%=r8wQ{a=SOo9`+l z6$t(LiLG?#wZ#xlOpuUQ=D4A6N6wh~x*D488ULa0`#Et%oL#hsNlDpns%34sz=u2~Ma|t=G3Zr0sTG8G z1s!>Xk%Su}ROb0lJ}wE55v`dF&?2zdz}sO7DG5)E_(j-=;mbbi90-di-;BEH-9AVt z<^Hnr@nu=eOgH42j*6oY1qm?EysGEX=ewK{s-(}q&!HJW@;Q=x19i~~W--LIzc@E@ zt4ifWq_d1^mWX_odkthKIF+d706a84eGYQ(+ey)<5g$WH%xd}o`0@ZtU@eNiihV+{r2v0$&#VTu9eQaJ&hAPN9!1O-JS1a;QC^t?TTZk&nva5dA#xR zENTYyvywWPjNFI#Qek8HhTL*znaLIY@loY>)6oI0GP)}`h79U!Z1HIQP39;;bWuv* z21a6`6>qip&UwSXJ%im_Y;3DYWsClS5_iFi3wt5LJVsuEA}}+XK0a3Fl>`qG=Xu;Z z?!{GR~J zV%OCDs%lYnR-hZ1a^rcSpoa|sSKo!lOUF^0LzXQ!kIj(Dr;^aFg8Eq{Ml*!*f3qTu zel=@b(rIkH*UhA=6hR0|HH4nvfFke217k;uhk5J>u#Gvz>GOL|KRv;7yU_lB>puMz z|8PESiB^g6FLV-hKQ8(LGr%`n@+O$GkcC}UrFnhPTaMkST-7lt`3Cnvl=On@Ni+iR z=z|rWI8SP}7#*81c=w$*v%v%9LJ{CuOlVEo&7_tW-v|75Js)15q34+9ZgK-M@h1mK zyaNH4FEQ~N6?LHU!g)aA<*%bgzoj=he|bn}vhizL(>J^3#bsA4fjhX`E1;^WAjycd z+sm;m0#0T`=_L<$9ts`y?1`5LD!6Ve30by04?T~*d_aH?lnnH>U--4YRD5}6CVIC$ z$W>yhEfJGwOs~}*#V1^M+|AdjC7mjC0+_QY)v{Rm74GtjXa!rs>lo)r<(Tk8Tu3u6%-aE7S zg+tpkm4)p51xLAmZrNf%$;nY7E543mhI=W!EqC@z@;C!JaRP59JuO$6vm&FLA20q5 z5Hg)^^uuSBlF@)W#9kSm1kxCYVFP`#6a~Z*P%AzLdfK}*V>F~CT3^PJALk)28vOmy zZ2DW|BbfkxJ8@5?_N{7R9pXnm6iN$>8`B>>%@!gRGkUfX;BkGp0JM?< zwTXqWAhz!2u@9-0iGQLgfngCf1F!xpDQx=OsvRmRQQMlvDatZ4Nn+pu^5^c3Y*{6$ zS?HcC@{*Kgpn-b(Fh(f$_E0#~xnf9;9$D+t=Wuj>ZA2f7QioV{w`94mkje;K=3EU_NfEt14Vyw;jWgD1%SzjCRaqEDKj9`ksc4w_ zS#W)V=6qpj4q;iL!O_7%?h&mlnQv_iKu6It7Wjrg2kaLW7xz5bZ7sib(fO)T@TkIl zsG014>mPI6%tpsa4H8n zF4FAG6RkIITOdwa#hd{HyKIHJMolJ;ZxwLvM?JDTTC8L%h#X|u>_!JFV|ZflLXC3v zY6dr3><9tA2_Tdg0acr3-X$ZPz1lhV@f>Oj8Pvs0e)7@ham+V}1p}hq=dZMEkKGc( zNy<;bOffOqE$WnwU2>;YGTB7}RAKy8Tmt}TG(JU!i_HZjHDg^qnLlZkjM5qgxrcf{!HIH2?C!Ye5IkLu7u^g;ju==@%aU4ML&EiYI zwNMF3jewM;&6%A+rqgGz7*fVAot8ed=O9tIh%q4bV^xbvX)MGd1<5UfqrToH7O;Y_ z`JHp8ouCSqi$f=^C~*8>ZR^;C-zUJx|2J+A*vFB1oa}c*Nl$i`u%;3UCGq}bxNTtZ z^Ox1)C(={(MfWNiNtkDl8{Psg*~3rAH&G>IPs0;kga1IubmF2q;H2ODnuM3_O9s)ARPX>IwdS z@E{{uif;kS+HC54dvX)K3n!QW-~qR?oW;ALHOw{Zq*vTv+TO)oF!YgioO%qLfGGK1 zZazT%+iia`9K(2C6ssN&9S8!zIM1mmUBeWdolb(zn{Lmr+LUof;keUk_{aeT|)HRf6p(5 z8JW7Cc7CLpIU{h4n#jmBEw?b8eC4i{%Y)rJlRIuwm{=nyz|U$973$Ab7nW~qs5$Pg zfP9Z0Dd`qhs;X3TyNW(?yM1Wjxr`RD z#c0?gYHp_PgpTOARr}Nt1B>@_(jJqI!9a&UKWZM^b8Mi=dJZqGM9}p)^?MPN*Suz>}wh^Con4Usf78e=1aaapP1Cj40=s7BKAx}7Gr3Y0&6F(|376?(q zZ|DMuo4gU}FPCeYha|AjViWUE?rB%*co*r(v);n*h?zzpjV=cnUcx(koRYWco?DGH zi<3Umji6@mwb%&z!4=O~lb;c)k`ir|*pb-Cs&z!D;obl5;S1Ty)hKQ_iZZTLGfJhz z3p@gq8$cUcS!wy;qR(CtFDO{l&%aiQ*z-e6J;x{j075k<*=R^z3{yaKkqD3j0pm_D zZ)P4cd;Hk3uVlau0HLu9c!Xn4dOt?v?rlh0R&lT4#>=X2LV{FY;BJiB22$<3(pmhW zsup8?fBv~wxMTs2R58f6VZVm!g3}u~9PNh^prFf`dI#GBPymfV9^viiT#P#N2HJa> zqFAWnk9mXBh7R=sGrnNeyoqB^2SH{{(Ci!JZYd7F^wU^#7^Qr1-M&Bd!Ud+|7gx0l zQpqdI@SMUDg}{-0S326hZ$hC%gjOC-N#u8K$Zb`*u5>SazxZSW?1bnWhCJ7sPj~nh z)Jb>YQs8YSr=c%8sVMDFPX17+CWZUK_Ttq?L2qY&2qoueJ1ZrQs(0u}CGQ3Q6CVQSP{nx`jCczq&E=qj5e*AYh>KI-(70=6IiILJ#)|tj zo3uLyTzl2}2@0E2^({giuD$Yd$#4uEl@Mfpz+q`K#jz+e+vFDF$K2K0;oY7QfP>$c zZM-bgnvU&>mjMAo+ibGz(5B6a8Ex5?U9Uw(62*D7YL;KHN|p4mycb0zH^swW?T~^W zfgEbFh`a>*T}|~ITcR?#U-7^#EMte_Rj)aB0;XxI#xEUbZJo%srBO zNq1VWRL~#x4q%y5H6{5GB`)n>iPi>{k_LA6S3dp7AGA&-am?+ldoZ2d`uzvI_w_3q zRZ=D$n`_yvRXkZc?eWtRV>mJQ+FC`7LIw}?R*l~dLM0$u)7^&Crj=DK4|fkP$nY#` zvvQGM?sZ%H4EyiT`fF@K0(RA`8RA7|4yfM?Pg%JsD(hLvow_D`Sokt80 zpWdO|TQ4_?L&U4((TUhWV~e3SqYjj2^&_LB*Wa&LAZNAfVW8QuV?*=bWX5-+Rz^ES zghMlxAy?1#{_Zwq z1puB-i$ZUBnI5xW*<5>YyY<;BF^F8c9!~afs(I6R{fLz2F}yeBfs2$1elLA{S21u* zC!gHG1w@Cpgx= zV`y2{Skw&Gvv|KB@CxJ1_u;qU4FTHciU-~{@R@%iI~C7emDRscVQum?*+>)gbkUjg z*J|A{bzK@c|utnW?r^_BJ^wy@MX-CHSZ zrP_Z5ru%oXSjZAeg>yFU(Ezq~IXWt<#I)~($yl2f8&QNj@Y|em@KG}rg~a>aOsiGH?jzg( zZZ=`xkNTftTle#bk1}3)+`4z=VBhlCH!D7VKR5A5GWn{$p1yvskh9|h#)6O`?5QUU zEwJq#Q8LQHB6rnYj|`YJ`y;-?k3Ljx6ya_c60)-^g$4c*%H9f;u#CuP4PP=REM#X7 zgY97e&3ZNWVhgLG;~c)Ku#?VN!PfF@Mn*qe4q5)LtgT9hpl|8YDKO-^qrQImCe&>P z+qV)&{QUeZTaLDPy=8d%@tIp;OXu`yfBN)kChOB4oyQYwu$FJP_x-gl>YvJIeO6oq zBDe#SlzzN>zb$#C-G!^MvB_*M{3|;Ki{5iF+?MSNs~u)x@x14P1q;rusO~~#)_Mrj z6uA6aJ^C9G+K%5IYL!^Zlw8gbgBvr$Le95y-FS3LkcIvTgY7m>PEG|Q*~DNx5@?zl zGpCW|&15xIV{6h{OP!$&ZfL4MfByVL*;#5XOkIk6da9~M#URMS*lX>kP2+>RPT9#N zRITfO=H=#)kZaLX9UUasZHV$47g1;1HAW;bM22qz4PWYwPPTR(4f* z-Fb4iRwUV`t#v0AdS1%TKCo_d7kzzKE3PtI$aYTbtnXS5GK|*b&9ZM;QpGvn*IJ3B@+S}=3Ux7|F1{MlAtmj2IW zIn}YYxp|6%j5`6?)aCjLhy%Ek&a7g+Q4Sl>y(1Qp^6>D)4#`l~vu3YQ{a^Rjqel<# zUPk&~2ADSsJm1OseRmhD4()jQeHfKd&%RMaavMSV-@^|3zN3v|@J)AKdGbrag?jz_ z_kUDe99A7164L&Qy8^zXyC?R}bvI!gG9)@$9ke5U)fWC+_0QkVlP0G3dm zmZ#_Rf|0+TxY{&4nVwGLpc^&j{-(X z9^ZP@HCnToDns14#KIp&qx`bkG|G4c2 zZmAbGg@l|RT%MY9Aseq8z|Y_blg-S`jyq>LW+!0Bw?Y#OP7Y{&Rr&m4;zwzu5W9Ep z%srbo<4}tfgER5fzt(f$VIGeT_GQZUuIyY{U@+Xm*|5vTC5QMu{@wJ~^qo-aubpxd zY>M$6tRgHtd2hH!;tTy7Z+|Z0sOWwWzV!R zE%Wm7WMi7|-@4Tvg~vi|l3vpiQ+Zgp@;t%p2_A>von*wVtiquF|lFzk-?4DXD=v^ zWOhJKHm+8@?29#n7=yx~LY9%z!7Tas^l{Jcb~Fc!{3xK4go6aV8*|8J_khJ#%mYIX zUVZ#{7og;yqzgT;nF4LEzjLlmF+P(r0Dx^7N;2b3FJ7VlNE#of%)vPl#~>2 zFR$KvGGyuPAZUw4gS$(*0RWo;{9te*JXFnf3T>ea*X8#}oko;q!scj?vUdY7k@ zY+g^Epf;6Deqv&s@{M}GJTm^vne$tc(B{$Wwafo|6EmihtNGpWgtHYtKkK#B9?YIK zhh~8xe-4plwv9V9?VIXSHazU{XcfK0hF&&lT3Y$13swf(v6ybKZQ$`+odekzc9V<& zzlE8->;pmaCIfVgV`t~&)Jw7pTfhGDKIOo{zlW?}zkX)f-I=>Nt5{}d2GkBBoteK- z_hn_^ew(CjB-@uzxuWStW{yrZm1vGNDTOEQV?fNd9fIOZPDnL{Pxu!!`?9yQ^}nxW^GMdvDfn) zEfY-&A1JMVGm@w-E*~V?50#Zs*XNL!XZLP*v;28KTGO*mm(pg#8DookTzZXx5lW%Y z4=m2`i*P!Z%Dq>wmfUV&;P2PH1Bh z*K6s5{Z7`ce4}HCn401k#gE`O;<0z@@SR(wI2wwZ_^era6p9H1Y^N-L`?Gc0q7ZOX zRWN>RaQMA5$K!Fx{0+UQ?#FVLF^c^wUfU*~ zg_{NQA`AJP5G$%9)6%*a8yoXhA*t3`=yS-|iQiLfY_n}+drzM_l{y`J{Kl7Fy!gB9 zVt%R5Ew=lDZhLVl57=P-8-fv0D6{=dMl@vI_vW-;Gf6b$5?S%goA)IZ(pEbs?bBmo zQ%25q?z|?R{5XEQ^d4MYOxZ$UW$Nhb(>h0dMKQk=T@6OoKY1vbD16j^Y_&@4F=fV~ ze=Zd-sTvqnR*F~yB!4q*$R2DW;>f_A)S85chszKla|vQucYNkWD^3jmTl3}EpMD`( z*9a8Ns+(QBFoIy3_E;CYY~1J-Po}26f`O^$a(Dj-Mj1D;f>XlFoLIF!@8 z+5JyH4llCfd4Q^L;y8~aIksR^?)-KV$RrcJKdHjz4Vk1KNhaW8#tCc&{E?guz?(?gWpgtfR zPK-{%4sU`9{kvt?3+?8CrlzI}e=G05e*1Q+QR(kBTHHbO;puXSKlu#@ znP_a$t(g0Ja~>9Pt1xtYaD2udHh56<(vHl<=~977)JV>{Hwil6cSTpDnHN~O*bC=* z!K~1TW172m?_MoD0ogCoWMv?vHGf7TJ2QdfGfSbC_F7};38!=+J;;^BC)YCFc{^Zi|LR>+wR^eu)C z#H)MpmQD9Bcs`U(7c?f~KhUyeOALR+{77*pY!kp!BBkUKJ_w~GB>Xs#7~CSo01BQP zzxXPfHzVoM2CLN9?G-w3p&Id5+|daAq?`4ua@b0C5PJ%A4+;q44l&>j8!EfQ(~2*> z|K^WcY7FkR)By=pXQpOm!+xyh5phgr&7Qp;$G>T{U3$@=m7>?o`FrPvzj50M?YniU zoZy>XT&yu*z!~Ke`;BMpD?eCWvyup>r{0xQg58Ps;N_QO7?B(c{ZA;liw^`9@cS4e zy)~-bDO^eF-Tb7nQcG+`wY9^K9_>M65s&_^^^k)v4&fw5U-Ihh+c98VJ^W33ZJyAD zDYRD9c*%B2UmPPA_L=n8>iy0!SJ>CYPJ>bij|9wJ(-%CxcTDRpcZl1Nk@2m=(w67P z&aOR*#iAS8oRtFcPfPL2W+1Hj;>DkoH6H6+{jKnY$4vBfadwV-+^LV_)Tuis-meNf9j%?WZFyN`Wv!FhPi9}h7i}^;?1{dS zV>(IkPXkT4hA(Rw%vd%HU&(hA>2d#cDS!R?GnJ!wA4v#9C{GXPQgQE)xQX+vn`Ae& z)xXElk_v@uB4bj74%fMJEqSpwR-Z;hnQRweeH;lv1j37Z$@V=w9vsQWMGGBW>RpRf z#2b@EPusB;f`Kh*B*0y9Y9x8-t+L{t&VO>+kRo+IkPvD9B%&12149cbxIg=^AIo!N zhpgPe|5ek`xg!J2{X8D*YvG>!&;vuusnGSf{7VVIDWaFA$+V93-9FBeJtN}d!!K9Y zj@Z1p6X_9g1W=p|Cm~wq6o{`qIi}Gi$`}?pxKSm_mIua|WKH3gEzRjivEh}`&=kjv z$Z?0nEp+PCsV_@Pa@a&DsNKTi^jT0^^cd=0yLJ_|9|8rM4&&+bm-_BJN4Ia1t8lHy zRmR*O^`6pzAES>7fa`Mi$mEW)UxZX+x~6V0rJs2Bi30(f<&0q{sc78#PgHB#wCUs1 z3p-q_``tr9q{x>774O_~>}g~~7c+C}&%ajF!jY+A$fCpY3%zUAhd;Zg_2#q%2REd+ zGaWR@;o3UGaV}Zyz(^>dKR(YIkI^_bcO?`KG_&46KF)Zxlt;RsDuoVA)X<25$HRO8 zwXB)8AI0bPXotS-=XbgF;^K6Luihpa&G~`~tfJVJ@*ymgc}9e>GbbGy*P7S%ZQPRZ znT@+t)LXtfYaLjYPi8Dux*R=R+T9G_9Jyb?KVW@HWW@NrapT6=YQ6{=Ui(*>j3eem z98}q+$@JLG)4hTU++Rb0h)|YLcApWN0d7MFdi(HZXp-M)p+Uq zHnJL?4Hs@l|JHSj_^#%)bg89LjO>yY6%YcvVB##!g>Ku&IH(R@_4A)yzkz+SZuIq= zegP{qXd$kZ`GC<(O0wf+yUd*%oRCoJd2!Uj1q+z(S>^E}tY|FFfxtI|HssMFQ`%5> z#?_o-3QA$_%Gcx+`f(+kTxpr*_MvuBY2Dfq`4_1qL~7l~-*au=GlTc?Q$Wk;cqC^4E9*#wrElJh9*#`D z34pyh0cF>)HABhlrSv0USobchUP%Fq+GA9gXweZXgzF5mnlwp;J9n7{D{b4hrJou> zab8$hnDeNkzP=dW0-3C0N9Y>U`8hbvkN`!BO0OhaRYSVxdokTk$lrFCiZ}obR`H_Pb5yuS-iyi(ECGXtuv+JGb!U=2WWO4IeBf!nDIe zu5}3h^=bHv-n_4$90!9X&AKE$f^3t8MO*-i7_NN7#Bxr1dz=sY?Ai=B_44D#7JvHn zX~Gc}Z`bzw~{PXp?j;KOY3+)tfgzZ1xlm`%=r; zwMT{qOVikTM5(piZ9M~5j63U_IMlz{|H*_D2UZ!ZA9qNt|83GEo5vAV2TtfRQa@_a zIlqNC^0>5_c-eWt;&Golqy7}9U(7w4MsNWNj!o;Uw>~dFzbWqqNg9h#kR5I0Jh4bq z;5DU|EfW!_pIEg3yadv17GTmkM)h6*~m8Y3=oo$k&&C3 z&d%QLb&5{R#A)aKmL`FA+nge=yY$tXo@BSX?7UQ9R=* zgG$rWn+n`>S&Rzm@it?CPtp5tZh9$hCK|Vl_OtUnA|at;pIskzjXgYI@$=UJdFjS@-bhDm<5;7>%cpuj8eCF1)|OGsVJbIWFs0v|tDjNqvt zck{rS=JmTZkK2oH)%RW55Kd#@11CAGs9L$x;Hl2w<-@T!zkT~Q+PBT15z^)b)P9?S z@`->8dLV~DrbH|(8qipxPkerW`h(m>Gnkr@fj7Lx=O|7UP;fTEFKD*^iWRc59NbG7 zXX3FeMo-}J-KkrvUCNo3ZKte}7ATbzN3B!B;!c*0%K!tv<;SNN^VrkLl@k?}bRmpq z{~{Dn1Z?VENPi>$Zp;`ZvcLKMMmM%r;Z#r91Bu&&xE3$?QRuFM-f2LsITZP}3r9{ngbI&|36wT+CIPv}z0eX=|1u!RRdIAh%b=HuDKz~&AvR##o! zK$^~y4P${XYgPW9jRNd<7mE zq-&c@pEB%6zWHZ;cKqKGO>s~Fo&(pV3o}^IMo|Dh3RG70wvMx$RlM!ON43R-u~BxP zh5q2m5cIwL{K_$0Oav}qNo7e{*|!IQvV?2J=a-6N39gILHWpJPkRRjn-2VHasj12O z*GEsD&>T!-=zxs%n%=`M*)EiNB+Gc$6APM-Xn@xuXu9B(Dw&R}1MuP4SJVGxle{lBVqQ}%%t z6hsLg4F*_zdSO0+4uw};)hN?J`!@1%~$W@%eqejnPAedH#}LS$Ocg3}A9YxG|b zg6fUAW!d~heE_K>U?Cj}t3FsfBTiV<(>bX+d*|V}{_EzqORpCPp31uaX;!kD@#;I$ zf|BHC&7UtNF_|&ppCxw$GVDou)o)kMaB>3j?cVlgG%D&Bhdr{S7#0TNh+XoFg)RQB zBygn$)cQj`jLYzN$eBY0s?_j0_H2if0~%#yX;n?A;{eDF{anda{h&w z)<_qLwKsaa22D;Pko`i^uXp#X_iQ{FryU=5klF}y2JSjV9{*XCDIk;-B|T$f@=h#` z-g1bcLS0$dNJD@r=4bqfY*}72Y)JsPtbw+%!j}PJCBJLJC_Z0L~ksFjZ&Ki;5GBbyV> zLuRQTb2uss45X7rN%iyR&q>s|U9YbC`FR#1#>PZ_@dTS+5Fh;V(yHRaLs=055X*Hw zVwc1w_%`PCPhqFkHFg~}s(8&4VK9{0Oq!R_XuWT!dD$lO1OFNcL>#2T((-bwAk3u0 z0EOm3q`G9+Bk*F}#6jJP!?71|*DF&#Mm#_4MDEM;YyMu)ZAhg&K$aiTh4+0S?C6|h zg~Y;LqpV0}>^Nl++71dgcEij^Rzj~}aOM}41^}7Tv>-H3vBTEH{rR)%c|gs=8+|ClXp{>F_PRhAnUO>km$FO!Uy zm>WR?*-O34gi8+}e#>m3P1oRtA1S=}*vE#^ z*A?<)pXljORJr|vp@7WuH6;?Sjy<8HAfOF7VS}oX9eOvmXbof4S?oiqQOwR z!i`u}LYiA!lZMp`!j2ccpZP>{$L`%XXi^ohdYw9O;~wJf$x-=bUlIq!kZM9BB3Mc` z!@bW()@zU@>$V1ZVSNH80@W77m%C41q_MOAIKZT{m12%2-M$5l!u&@k_4owVDW*jg zOPB~C9<3vCKYZAlSk|>L6YAxwf0j#MWOgi~r_4doPpyeO~1>FWe;bAlT<@ zKB$Ol$@HaVWtLuEC+|+r%}pq(s>aKFkQTsy{Tr)VQe5F-H)hPJW0Mma@s){xigSlX z5FW(#vB^r6=&*Iy8_)Li+{Cq1>o>91GVW@^!+KOTJ&X3i1p81Y3k1n6XiwFxv%3fA zEXP?TU?bWFkW;LhUSjMo*VpNs-xjh$8nA|}EAH8|CzwUfQ#gHU+5z-4eGuxH_fa0s zr%xjNkOrP!SiJ{;^q=+&$dL}3JOuPLNK}($-#rh%c7aQy+m*?^;C|N+dPOphK_Qr_ zJ*tb@y;djJo%+?;z#xpKL{&q>pwVy;kKrI5FE&$G$xj1IVye%BvA6Lf-QA9zykVEVhWm*JWWXH?`@AF21EpV>a(T^=e`sf?7+6=Dq4qokR8D6s=xfcw%B#8Q!Jed3tWy38xi5kFsyMX?ts`0dv3mv`G>(F4lhUz+Bg=MU9>v zUErTo;4bDHLx;wpokQCnZlOPm;Apb2`0IAfk%w$j;da3|^yk<;e)Q=4y$K_tx9M!N z-(5Rx^n9RW84rVPTsLCY;>9zMyIz`euwkP{fHeteoqZ`v#n=dj)!I-l@54(ut; zvv>gNRWucFSUiy7d7J(?W0N!oEiSJ3o2ZdcD9oU4fZ!c&6jRNT#+pON?K7QjGplfo z>bK%~mKk~61%O|{dhcv{yn+5-y8&y8vDozK(=`Sxy1AyVT8B^wG{ZiQR|DufUow5* zLaMhr;j9J6dV2AT+Z0{DDBOYv4nJg5#hiuLuP<{CTki{pQlXY}E>G8ST}z6s%_%ZiE&oqYku7vI$1R z(*o_%YoCD}%(LgtRX@y&CU zCKZZsv%K(Keda1N)peEa^BIm4f#+bk1hWeY4z6NE^MaScAi^!~D1EWQp~Sw53m<)7 zKOR{Qf9HQ(x~%C2M9L#iDA@?whpV;j-_C?FQ#Nkj4l|oISP- zls5wiJv8NnGsJ=NY%UiKK20@k7FZ7dlMSJ~#hz2N7}YVy4pMdmlL8NtY;$}Me+u~Y ze8|0f_fCR-(1F4esJ3eL^{RvErjS1;IyM?!=SBvQLKx9gTO%ih8_D`y(2+zynvd*f z&$Q^U;5OJLm`%k3-wj$T0zC8~{C>IE%yM)$>5s9FfHE)__3oz6xBYL~Cy9zchE#Ln z55%d<N$UIC8(MBs53J#5^_m~{e&c-z9!L~Vt1fyIUR8!|M_!mmZeiR zknd%`7_q$>Buci@K(ChyliCb_2hj!!lf$~YB)i|^Vwb~A69&>S15gmpHcF)6=5I?| zSVN+c_HY$f^~rRK>|V?=3W@_L^(cTIo_8?%8e-Z_EX>J8;&uj_%63gLq!(&4cF4-p zu~j1AA~#C*WCJti5Kh|NP~4!R90AEE;yaj8sL|Y@q=I4G!{6E^r4?%jq)xkd5qDr40ZL zseLxVkifWT(Qy@buVu^DB&T(RBcw1Ff`G&@+Rg3o=h&E-q8?2H!GilR;RVHKelei- z5%fb}t#4d(s0Io=z^gmQULx$28j7`v5`#EcZvn7Dy$y@fE^kY5zjwZ0yJj+5`7*n{ z^l|n_+c-ElP;vLceB$LrpZ<)eIWvEure;o+UR70ffcg`}Cd@bYZ&zkK_*H2s;(ok# zeuWcbEM2--d(W>g|BcXonzFh@>22Z%xPO4po=X%X`5Z7rG(Nik$ZT$(c{KTHyH~p#XK(XHPnw`3bp_z!=KG z^`IQtA2rd%MVIeEfh@~*WVD%z_wBtyP5DVq7gp^eei}3TrKzR$3uyp!`@g*yjGz8t zFjq=`pqEH$Xx@L2?m~b6K_dAgJ`+3(03OJk0#FO7;?lb}-XCBp%($3$$(VnWU(4k} zaCC!Z_rY14vR$O)!M0$^&Nt}N!r>j*7wkg5g6xiYzhwsmIb%P< z($KV2(hLj?n$$~IuWrDpzaH%|(NYLdVxI2c!J1U3h@!ZTj25h?QIn7bq&A*#Pg2w; za+0zCRw#s6CC(;gi_<)iaBsdkT~!0KvZ~A(U7{tM%F0r}<|M}q15Uyp1~Z$r?-N82 zUIX5hA3aK)Er5s4E~V4@WO*4EIlr4OCS}Fj30dS@m@~5VW!p zgpYEcJVsI9*^aZ4SB+C()9({3XDzayT|R*jDq0^&1FStPvs2~nv>Uq0lzZN>XU`8! z<_}^=Gys5r-Bj4p7w}b-Y@T%al}4?GP#abq?}A7s1ZB!sR@~TL3|K8KQGOY1gGz@E zn-GD6#Pm92wCi=EwoLkq^$%ZPVea-h0Is}cBop(Wo;48E!VUIZ>$JEwy*9(nU@r9;{Gr&XGTUBv;%PM(*OfTW7+`73Z*@}{ z^8zLy>mc*!Arjo=1EN8%0c8Go&_{hI9U%7tt=R#pGPAS6&b0Z+o_PK zv5A^O9G_uU;3p4K#iM$pOT-+EjnGk?T=7t2F1UT4IZ9AX^Qh6wt}aY|S3~@uL^Svj zJ3n9ohzi~queCB^1moEH3q0Gz1>6H0oMjE$n)hd^FFQMf7_wOV=+4>{p z9A+_j6#4Q*xb_`cF3s8M7=0ZBnjF`iz)#!yU0@RS!O^2eN>s437){2)Vgp!- zUf-I6W4*SIldZt=+c{%$OyC?#KYp|tF=Fk>%s~NvOc~|*SySUnIS;yE$$M?jk;V-5 z6_+7r!)x!6mtNl$Zi)MRiAfUM9s)2qi3+bo=$Q_i6?fBkqAsN0^TvpYL-u5PdMvF;&XFw0YK0 z@UkL;-k>w75M*_z-uAh@+esywnwt7FYo$P4OccN=AT4V_m?3o41*QEgD1G?%FD{UzrLL; z+$C*0Xl*><0Ljf(+J9p3jrN_;39hRBR%HJFXgUwLp7-|uhm4McjAV;Si4&3(GLr@w zk(He!q$MH}vQkJ{Es;8e4xxptN=QpqSq({~gpBC_yxhP4@9{Xl$9><9`hGv3_xl>J z>-BnFC1#s3y^%D7pJji;-H7fa%u}0daMpwX>|QaAfIkkuhS~ouY{VhFMWxuoc)c^z zD_I~xfso`<(hT;aX8-Qa+VcEp^r6g0QA;q3$cHZS z+H3rT39LrB{QADgx z$;o)y~9z3QI=oFf}ybUnpMP^WI?vBpX4Tr zqm1psyVJXuS5)jGY#`D>!0ZYyPF(6qe%MRX8+R3-eeJnx1)x~7W+^F6Za97U~7{C{CRv6OiU(_B%P z3rxaCXYM``P%`8vU_^cTVrBZ4wAY6f5=ROX-{4aLzM+APjvixw?j!JLZZ;?m^E z+hFJMT?+nFGhz=`Kizv`incrmLaq#xo%b=N9SDn19FUoKJM>^=1 zwD>ni7M6waCSF+FH!Pp=bt~ZY`yI5oA!1CC;3k-VwFJ z`gNPf>jX1%&Ehm{)A+M?9PHn~spt+t!2z&UGDC6+pIjzBr>2*^H*H&+Mim2xN^~9E z$%z=w(k~KPm~mPV>ZpW09bJ8?kFcB(C=f0&0c;1edyx&zzmL-_)uFV=ln_e6f5}h+ z9FlXtkWWG>?7Jd2s>Rf+>(?NCpKNPeWF5PU>Xt_4c3xf}HffTzxF3wydueN%yL$wytg&_=lm9(d*LE=~cBHKepC1=KYlEI5%n1|OcMU%uhNA`AJT z0+Fxb)A2{g=%I-64Uv~FGqxw13Zx~JChmDer@?BUdu`FnOr5a7iGpDefdB&eo@u8{ za7bRgIvf6+aBx^kuNruP{C}InBYF_o_z6rzrOL}mr>|@JQ-9#Veej-Ny?uL!e`$(# zhspILX)T1bL9iOtHivF`DVsZFdlnZ~DK3I#A&dyt|D)6l`b1oh+$J@_Qm38~6;S`o;T?PZ8r==%V82Rh7^$j1#<;!=G%GJ*1 z^Qnm)XI;y)c(nxW|7hi;>1GgQh)RRdAHylXLIp8E(k)-6#~PA=`I(JZ5%|CqD%aLLR#3 zWA`H|hbOVJvbUm&Dho+D$wDfiOxNn)|BP+0DMLNJj0C5$(?%0#tih%vhF>FeU_Ng= z+xd`jh+Ad@eyI}xHMTkaH*@OK6E?B3fQ8|5FPM;$@%$T~g^B8{ooS~BW{^(3bGO3a z5M(02QqGM4TR zW5=(yeYIg=_VVLQPW@M}X(F?4>mg~AW6`l3pLZAO8 zH+q7xAj7$v^?eRx%EEMpBa2v%BE;LtZ$F1XQ=rP4lJjre^iz2ee{K3d(k5Sh`J*$P zA$OEQ-oClk(`$f(ewSVT{$hS7Wl+?U> z5aVhv+pgLn-r1ZU{`C9X6MNs{lm^#GY-YzE5182JR$*ZX`8gjaTxt%POv}53Jkx93 z_7F4SFKka25<>!`02L`4vN{VY zyKO6a5y7#E0wn;kkkwCYVREK|fC@(`R7yQf@@?s#cH+c|Mk2NV0zZ{=Lip|IYl4}S zxNwIlPUq|TWVlbve}+~_UEgeI7k}*Y2M}>~Y~HLOUGa^nYnkoP%~IdKri0+jb^s%c zyldWjzw@V3b54PnurPkIr=Vjhg&df@M-%WLYIKu{%3w4#k;D1}0)lNWWS{%}fBIy3 zfz$FM*~xTyVSCOp2cT}7Nw%NF0bXt*#AjYk6rGxF>ZUNjHY#T+ZKy=0E=0StA3A}6 z4A*=hCUjUoqOn9K+6yq$rbB$NPH7Q1nm5tSczqC{4B6Hc6(K-|-@u`;p^31-*YG-| zX~0D#le3LAtR2PFmeV&*DCtG_IB-1dlRe{>0os;_HU61&bzS(S`Oi>I@+v8d?m{&M zdI|YYckGew`JiYLH0XMKqbsD(rpFij54@(yQlDMi(mV_(Ae5LfGhljNDz5NERBy+! zXwo(*r!1nOK4zbnqkb2cHEUF=3S-W?WIG1FfTMzAZ<6tD&|2#0jZT}bQ8&lh{6k6X zd)hMJxMo=(Mvb8iO%CK(R@7}7Kw87Ohy@lmW&5DXzO)XCdYPNM{N0R$^VjHg>((Vb zZq~GE4H6<|kYeO!==JTt>LNa{3>=WawmrSp*x2~qj7y`0bONZozWB=QS+fT68j1MA zKNQ5C@|Sp?wK8_~7DP!l&r zr{&U+W(?4%`r(1YlQ>8yXV%#~Xz4cNcghFvm2I(|NzQ<~{0ba9bmYdPWLIS#H8}xP zbnuulV`SPQkPfxZ>%lBS*k*qn>Ng)4buat49tzr91 zB~8J0&;N_J5>&mReH41{H)G1L5*oPIuognq# zI4bK+n>GR3w0OK2bO|}I^3gSY`t)(FDl($_oIuG(Ri(0}XP@#iS?mU3%GW-dT2-cs zgxGu-RW!;X3=mk4+MUB$4Lkl71U!q=U7-V!8kYeT%05~&Xs zJ7>l>Z%Y4*t6$FFSM!X%fC;D25_x@i2rxB##duZ}V?ynzsOW3f<8;A0*UtZOK_s;? z0g^4d!21q)QA*@HDFtMa9YyP6ZoOU9(`V2A8q?-L{M$)4^YT7j8q(*n<0XU;hi8oH z&>m$u>9k4ET=h+D;Mx(Q8*S6sO=^{CiP!fF$5#E)Cen-T4L(E49XoDEPECbDGv9>Z zdBf;1aff6G(Yp`ROXqzdp)EwsNEoNk7rcAS+EM6$K&$xgrp(-4DGzC@swyig;kBN` z1UWG|`2wR@*)k76KjrDMTnAbBvtZMA&0Yk)K0Xj0@9 z)5tT8$168#Ycj@}o!h&2&%E95UA9YiRjoTST#o5Q6)SX@-eIY_+V0UlW1FAY5T`L| zllSM4CF*mJDXkCRo3YV$+gPi7uaOaM4}NZZ@$t3^JGVzODd4QxgI)<;kE(zGjQO(i z%N3rUNr_tIW;UZ&1no+s&dgmw4C|iqT-Rzyf@8tEi<%Enu_an{SDM$Fu>i~d0y$3r zd17WyceM=ViKrK8;ddQSz{3V)UKYb0tJ#JWB&o&2?K^ge^EI4nbpimpI^2#H4m&pw zEeccF)P~=~g>*((Lki(#YCa+3x6njN;HgbvD*Ofr$ zvZi7k|1g+dNGIHX&PB8Oq=bZoe>Gk?47|p-a7kVYGHX?L2{XC*8^6q`*@z^e8V0S{ zLC6e&$sJL#9AEQ3l&vxv$FnOYDwuyCt76#D!o9_MVM7@v+z;k- z(PJ7Y2CvKWqj5OHsc+Jr-3R|a7hsu}Zdg^+_N`+h)eu_-e!cCk=>7Y>m*v#Phx*U9 zJUNZcvfpZdJVRGAHM(kIw~ujI_EP*SSQ(G(#zRlSx-^l0SeATz=92|RuRWsIgs@|m zh<1Fz*_8c_Y|WFM^&myEz70liBjpC~YeyfA`SSVmh!1wxT^dJSyB5ya+LaUS*L)d% zYIG=GpE9**C&gcVf7_1Sa4HeBV1rnH_?pmNM6aeG+n_PM+4-2jR~(edq`ps|XqHnP z$lNwRF2gCo4NjyO`Ca?|rYo}uF|!6NFGWSL2u1djl?F9Eq|<;oEZ(bFrU9qW85wTe z8*smQMxA$b^F{OKb;qV2TtyGVSg{_Z(i2*{xa%jePx3n%!xK$z*o8jXu$Q+%+t}?Z zOl}3V^RlN6+^rV2Kn;^zh!7KNUND1aQYRJQ_;Eur`W_{b*04ntX^5BT7*h#PqmQ%s5dI*9eHCLofopy#lXLvw)*KN?L>bklZ3Lub|DO0Du4w~^A78&Xs zMs~foo;!19VrcR5IqCOQY_DE-nA7-P*zB`55y8AB}qGke2VfUi?H-@rgLMQ11xy zi~ zNFT^Je5~PL%=jO~H<*Vk>oSOHhlj7#rIqV8((5o2TRiwY@9wXTZh0hHckQ_MmN%xZ zzLu0&X*}kvjbw5px07bierl9D5~-ctOpkXDmEej1;|R>gi2Q$~gZ|fEQuW5es|71c z#Kc?}vBb4M8VC{QLIZ-Xa2s0&mWjgoHPj3-H26%hMR6krx6I0|>pjs?fpp1ok3aJ^ zl0&`hl*@ft${dVU-M$!L^HQ4WAB=Vn4Zxza^ku{Ep@{lK`yL)%^-y_6++)83Cs8&s z-ujPSBrfghIPiiSGF~}EL}j&*S&ob<0Vm$D+xC~`n1@8(+*>OU@BH0k#9<aD5*eIpvSZFn8P0(J{2DbHMc-OR9SP8j@w44TVH_OafN3 zmVgC~I8>kdFeddUQ2ZfKW&{rh+DdCy7+CZ6k<3}6^4rrZP$EaKB158u*r(t_A? z=d6P6yC{Bf!+HFbU4N^2umGX4$rgu{-HN z#4fDE?q#6+tG*ucV8@foyVdD$Cc3nP9YkwTU0X}#>zA()U~-OC52Q4<_ne@(<-2!| ze~KI`t3*R7@qnI^2m}hZH_YIob0J}hb#Mz1qXdYe zC5YmAK)`3XhFi~@=MUqW3xA9q5a7jRClIv}OMlO{wjRgE3)~r@u*z^`&_@!tG%g%y zwz#}|IMd>f?oG=|c}&TbdsE-M@d|fSz2`EG+u7dv*R#?H)05M}>gwZ{j}3PBB)J_3 z4)(?Urca+{Wc@7r_Q49>evNv7JSX{L#NK|8et3VA=boDy7&Z7nqkVqv$x42)eFov? z7t}E^N1;Xi`R}fD-!XeSHD?G%DJjG%#;_C4+O$_u@g;GQJ~r91G3?0@U$S7V3UKr%pQ|>PUr{TzPH@ zD-x`I{QHGi!5_GD8r`{6zh^H`_Y6UCFKrO_CT&@sIO#^pi7&s!U>G!J0fL zrmf4>e~x87s|V@9v;Ija8oO}evBU|O=kA)MKcRgxgA1YD9doJm0&5huP*CzW9#LPG zmg38RZ0N?qg>*&7HT=^SxAmJ9|Mb29eAqlYpoRE$hE&mk6;K6^nnW9VHDziFeoJwO zdd3|cyS}E!>;396ntq`q5u9Z=9~JzY%Y{y2Bp{MQ$kMPSbk`m5rZAWHE!1{pERSZrhho4@b@zDcP)ONXv;iD+@fI*Ah!+uf0%Q{KmLjW_ZkrZt?Dl!f>xwXjQ zZ-sdqK3uXo63vAoHsR?5C%qV!;xc?XcoexwZp)ZGnJ^B{@3ZxUexq0Jb52raOD=5G zq*+eff>8-=wj^5Mfy+aMuQ{&2GfDT$N^=~1@gC14fTTox6?7v;}2@nyRP18-AmvcnhH0akn$F#5F~4X z`F7`pOyXzljR{}B8+yqWF=76*LRrYqSAJHdfQF0nKDazitBaS6L}ue~r5Q(N2MZn% z+-y(bUi7~H(D(l3IzQGnTkGG`fJ8?l)KD)R}c5z7Uvpg><_2I0+blt)!AH5`R z0+tV=H^ca28E_k8s#+1{z|U?qvQEXT=uDP1M#VLaRx8Ul12uEUf{%+k+4 zU1^n_K}Ntg7S@haLffVKT}W3dT~D1WJ*{?{I)i#sOgex!cOGagh%>bpahq6)-J?3h zIUdel`eYZ2rJQbAFpW;`xJ@i>8)cZ~DnBlOe=#6DGhm1fwjGo|8o-W=UsO{zF*x{3 z-@eO^ZQGogWRnxAhVd%S9aTxoF4!Y9g30<{x2G=*xUtar+4Q?vSto%x0d~)u@)qb2 zcIr97yR{>#U?Sl!kPowTi1)IYfpS%RdPF{t=$REX{T?m<6B=!c5R?%K86r&JxWR`P zu_pV#1%wh0Da^(uq6~#g&3>#IGgRO)u{m@bS*RKUs*vs5_UtL-m(Wc%0oPO~J)XPF z8bf1Yv~$@|bxEg4soB0u7Z!rv1p7uhMLkZuT06(v1Mq`MmmUMsaPQxqBY%HeA}U{y zB%9daefyNB>jb|o?*Jvv!9ly9%^C5{wq5&t&GEJ)^dG2qYotSuK$vj5hR9@>>(HEa z4Orv}r#N(kr^qB-Hj2e4;1=_7={e!23k^t^vs}TLYkwW`JK^oCK6)PUbm78R3x~h9?zegGd5H=v>w)a~m8(Rmhc+_8}ffFb0 z`L+?}B3J`oO;t_>w_b*PtRVRu^kXj!q{D|hUAcNysZ}fdxv*-IjZqZEN!o224TK6P zvl153(sh)AFxk<*3WWeNp-dHJD-$a!cN93v=p0a3JlO&0op99It(fxHpGSiZaT{6mJQ zz-Hx2Jt3WTWb}Pcu}VheGHoMH*T5K zv2^PsOQ@6+S*a&R07!FGG>d8D;1RK8C4>%$xOa+L!a<+QwPo5V>GY_3Wr-4h0_7o! zeee=DUvB#8PxpZ&NYkL-ULN0%$A(r1iT^HqP`_3kCXCuF&xZOI1~e>pzBZx95Dc2e zgeSh+&rc*hu(Bzxgz9}hlGSRy$VX*6A+bnYGPvUqqBe*_I*sRH+<7QEj6RNE#T*@Q z_%)f{6yZSW9RTqzM$s%f)=^PW>0LR9;X0YY@A?Cdhpf{SLNQz$ zW9|%Wik(M`_Zolg#Q1J8)d*jsZTIezEG+K!{j#e2s0lo9PJ&1d=A3K$Pa62_qm@ zU>?S_Xw{c4ooZwArh@__eR>f#k{Duk)J!Szg@}FSN>SfCl{%9KKMvV& z4wKSOBi0RsBQHe-PKQ2{To7_}8m&=9Ww^64p5jN02WJo*;l3~&j;EGCaxa{MWL8lX1Wadlh^ z%vK4+XaF`v*B75h0+&YW9KT#=!sPRV&(G>F9$Z4Yh58}!oqlYs#guDw(OzGrO8DoW zG-&x$D1r+!R}cX)^*M=NdPUepIJ+p&bEztI#Rp>{697?;$Pz1x0=Aj>VLeMEtfwlH zK?4t1>iYf668Jtb)PmUQd)VyeXIEbInk%F0eC%h|I# z54cjj<#0Z@<2BPubI#7y+GdtlhW|Q?T9?4PIqvm_2&!Wd_ky-qZ{WISlYVZ@+^|C< ztY>G1q!yfgSV;oL?(*Ty#iZG~@%@UqpdttciLlLiiPtB#LW5XhgZIIM#J*iScg}3m zW&|s_lkZreu)x)vw_w98@C`e|KQGPI>7|{^RS*#`1ZQ6BQB+C zn9KAhQ`1i~9gyr%R1NiWPeepSi);LgHQ<4tWDgQaXISt~7vh1Yfk8)tJEIpS+oXja z%j!F))BErlg_0naOS#KVRQz-Ruz)9J6t6;1`pzzhq#y5MMJ5B6CuZaI*y%dC|5aye zSN%0oGmK=JYya0}0|jQT5xIVOu=-jljy#Hu$}<`OQ4h8<9EWV31TLIn9rYq0^Vx z3K{_)?>j8arq@>`JWuD<-eu{89A5EYV^&}aXf$a*TNuyS^kZXs|2sq|53te!BV%~k z5~E;&$gohp0T+B|k#iFXVsg=mD%9n>OCICW%N%s~{ZE_;(VFntfP|TwZKr0=flMNt zd%7gy_p<*I#{#3^5~J=^TwK9*ENc74wz)(Wm%J^ARgH{{JU(Utl^;MdA_jjNB zN>7h1TOFzaWF;&LkvDDe>x`b>xE~*zqW$*C`4dm}U8S*;$^GhU-}^`tNYqhY!Y#%J zf9HiR?D|`23dVE*L8af%keHa5#0BUM3YWW0gL!oQq40&EanS0+Qf}r@Ij(JL>SQH=NVQ zGsUsHxlKt7TD8L0ZGjSgo--{3z#bdk4~n@kYtp@1DOq`+D-A;4)_Oc&^H@p<4gq~m z@%*pL7}W|t6@a$7*l&OckI-3@61;v?#7L7yVR7#2*Ez(cO*b0VfEGzm795^YC%P?& zZ9@E-b9v=15*_#86;*W^O{J`# z=v0SlHXz;H*;XBCD5mVY+D-P>t&A#g6jv(lFEigB4p*9UCi9_H0I;F2SM~Q}BE$k? z@(N;uy^LiT90~stunN-OcI!>1RCLQoJ>~VYJF2ME@bL3dt@l{}wwEj}NT2^tz>9s@ zPWSD^|J{Kj(23th>Y;H|=6^Uo-cJZd5Fb?PG!A6S1}B(+@(bwSeg-|(>-2YVR5-sD zG92jFu1}e*iKucDDNpk_STUYwKyJ7WSICYOaFljqpooeO5%hMq!rM`AqNeLS{~eY5 zx$angh1_pUnY6)U8@`cx#c3wzNl!=Ihg{D(cMQ06%xkYkMg1LxJL4U@c&;&=`KY0+ z`0#sRiH`$erN=Z8=4UyZuXq5k7#bW;SrzK zu1UO0j9kLQt%%4?nzyzC(+WByrtA)Aig^|%si=5m z9eMU!^jRpq=fKNXuNL;P3N=GU{DgrmkqLlj=aOoAB;FfluBC2|o__iCX)!tkXq`wi zoYUiG#ukWdMuepFv@yx`If=8doNymD`}GqOOEWX)qn{^?AMYX?4$0)y3`SUQQVD@+ z<`yN>+5Kedy~RAGm|yXHO=T>f`GRR1APnmcHgs;dzGH0U^?Ua$^|P-D zZr59(V%8qa^#)V5LND$ABi9g6Mb4EBXK@@vmb3UqDp@wBe}**T%!2{POr8eu?Oli& zRHWmND1x^Wd*GMgJq5XlgZjR2tAY7>d7+Kf=m!Kmh1q|e0jU5g{rg7&D+L7yyWm<$ z=VY?WmvkU(D@^8Yu$}H61=V=FY z_Zx+Uh0Cpr&ie=yeeuQ+T3%VN-gWhrG2BDm0b?rMCd7xrKA!nf%bLMqP<3TWD3~b* zN8AvUaC-_IMNP};1fCv`7EI0%Z%#yb7*$$dP{;Xe47C$&EM4I42xjViw6$B%y`$(C z7b8Lz=so;Gt7+5nG?#bs?i*HhwSNOy5~1Psf7iAuM3j3Fvu#vsWRueO$4e8k{+GTD|^ z)LAFy%^f|PQ`05GUN8U>8ooryk~KJh&7$X_-TVh~Ytv)koQ#xff<~v7%purw!!bgJ zi}8ksQG%+;UFUU^oz~0f`A93uFwF_J;HG>$c~7v0ZqxkSgNwoEQTDE5*|>|&7uS(O z-X~1R3QX|gMNA9D=7ux6f8&RB3to6PY$P|*7`G4c2WGSv)f{>;!7&KA$lb>>PsKSy zvJ#v%m*hm62GL~5Bn4vKuwa$5r%pvOePuuewnC06o;}p-n=^{siVhmiihej_fpite z_zH#lxAD?QrYR}S*-BlW69k?aaZdjSo8;8-)Ki9rGtcChu z_|;U-sO&9ufA??~E$Y6I5K9m=KA40YGD0qi*rkn&*>{($|IY;obsXLu&10@=MK%ZU z8>p^$BBECYD>4u>+LM}E^TLi51Yv*Fuiw3j&*wDe=^~P0@ux9Tu^JkTTK+;~f2EZH zYa%tw^G?2+KfH~1`*XVI^WA%UM*hCi$XQo4*>g>=RvA`x8_J(``%#1@2+Qqv-R{@sf7D`?(iA1I{yU4}JWY&4p6>23eGOUM&ys zT@4~*^>o``%=>)w;-B_^cVxJp!+^B57Q7}wvvbYzo*Nj=8y{N`?h;w03%HG-t~ffx zi9MfXTeip>5p!Y!+U_$i2)VLE^Ic`-AUIV#&X!DCF++_7em$6q{zSt0<*s4|m7V!B~b4lony zvFY0)yp`8KJ1`W1t8IS3-^(59SNhZX0>#O6j153cEn%+>qNk%aHOX>z7}2W^gxjTX zRYDC_ome$U`4tx@?)b$$Tp_+R&H?(I@BM2Hk=ZIKh7qwdkP47+{eww~I1iY3oEh$-_&CenExxXcbNSCGgrg)O-~*2AP0rNq?Dog-agh@$ojxUR z_}8T9={n|Ercg4B_?$D2CYLLgHm;3vY0%Z!DcYR|E);r&AXINa*_MLsaxkZT?lzq4 zhbsY6&>iLB8(MRW&ntOco@Tcx0kgZ49rBK9RTzWqJ3o+RcXhlW++oHuYuh%jM$soM(xIWYMvE zu@Ql|u;h3BcYJvxfL0-}K!A(}A%yvjFZ&bZ5we>Rgi4g*OyG=y6J0v#J1AFA$TrF_ zPU9hPfSCvU(T+jjz=0#0Gz8D^CfR47fIlC}ankz&l`<#NqOYkEiC7Ie3oQl`lFl{DL1aKIe;Vx0r26TPA<+ zERqy@DxK+zM@1@_*bC=`Ps)Ek<3VZQXZ`<$F@nHdm3sf(>c1gCs zg5wi2oVF;ts95*1!{@?ygNBY>e1wrO(Yl+eJFv)D<_1fz+X)wMAt_Fv!*Xdms=096#ibqBw+EogD2 z)6K}p=TXFLe;0#Powie5NRD8Oy>r}#Q9qSIJrf7E^DH2JLVEVPPra$HWCbe_Lrs5F_yg#9`}XvzZUo6|5spt*-Z8-AlKB`K?fi6% zqfXFKyfi0k#>{!XhYqPi6)ENi+_-gX>ysx>TDIOa!^XxHVhH-9TjU^&=H4wYSC^R1 z&tL$&Q_U)WlqEMCE)3H*w$3pK7rBKTG@Jo#N5p}25~!CUuDb%mHzqV^Yx>_0=&Gj{ z#{eIR$@=8U+1BCe!2R_M-*BHBt|^S1fh(U36o>*y8VOG%knM=->rJdm_FKg*f7v1P z2=|#P81N=}eCokB7~Q+%`qZ~P(j?re7HUug++}7TK!i8$-Sgvu|DS1ow&Ba=0c&=r zD4yxot!&47As?E##Iw|FkVp!`!>grw6Y4`Rsh3VuvAW@tRTgi!RL( z27)Z8$4&~$!)_+T;*d;JnTCte((ZGIx@#&<40)8=&`&ols^IbCx}fVBN%PBHA1+Fm z)gSy&)#2}v`X`CSW@c*4W2l9v&YSno`e?%+jViwUa0{@EoPv4FzayN#3+{%P=xQ`2R($e90pqtoDGm0!w@zq-LLAp~z_q7C|DGP}px zH&sjD*=F6lS9#@bOz1A8b$~j}9$ZO^ri4NS*v9y?^2Q&ZsXHu#E<-C-=elwku{%mD zUr(+*zBc+TkLH|IVh^|GGZ-pAH=Bn?G z9d1;V^h%)y>LFjRB~GD85?YUT@ZI;JM{7Wn)5xg{?H zl|VEo{2oT5>I|w>W3IuA1PPJS4RpdNxVJG{(4hR^n-~os8yz8O3TS~*BdEv#&vy6H zoM)W6;+A>$uIm@&qJ!!;7J+VB#b}+pw*s;$Te!P3CxP&q38m#bmtET4ne)~Zcm|vQ zjA4G~{yjPl8`X^w8ksX}H+DA*{9LE`QCHPGCLcecR}a@=A#hN)+y2j!r_G!>0c9o; zpA;DY#`cMZzex_6c<>|DgBlgnK~e=J=4AV||BL@3r3dna!QuZVcZj*68)cVSakp;F z5~CwXTV%&rLIS&eeZdWdb`ALCmHufbJXP+5?Za=`qJmFlGU$M;R0V?=^ z{1uV$!7!~%yWcxQ-|}ysw!5t(U{Rr}+cnLxDzPnZdMj^7+vlAwh1)!1#e_G8A1=XV z14=GBUX=54-lR$X-)xxz#WT;4K8wy1L?`9F+unY=PV5Nl=SegyFW-^2*rmcy!#q%< z!qqu-Mw&|c`C}`OD)ku}cJd8#TG^4z=w3*|3xO$^k2hjG4OB$|pL$O#uj+PpJp*Rm zb5|WS^JatlV&d6|+WUj)7(cz*+9nSp)m&{)?4O*xjs2Ob0S@b79}vE-Sc$MiXF7Vx zD7D!W>gtn<=l2?{JNe_pMx$n?bSPV@o9;Wp(n|F((=NgAAm0J2?t*3VwtSI(7Y4n? zOR8VHdVl=OxA@}HQO|u(%$zcA+}62G9e&pzfjsE?AlHP+Z1#xSzh%C)_JwDRZQPKp zD9Wu#U8D!v&E|CJ%2x|PE8Z68CLL<|kI@Dr!}Th66?SSQjavJpa9>nE|DX4t#Vz!{ zR&%FI+B7#_lyr4)ajRc8{FZ8Hr9oF(v z&({Bxb@%Sg#pi_u&GBod?-ZI?yWJMAMilATfL2E|)HjbUu)w8XN|>6jU;7vsJSrG> zWid#^(4W!KJ9acDnI4~gR%4zMgpT8Jx!kP#s5C&87ZDqgjTW5RbI4sMBYo>|r_rzw zWiX1{+^}KK3U0Y{eV)AL1f^#^151XInF?luozGay=64h-qEiQX7s2PJ`0w7`>e{Rg zUt$qhIv@C!AgkwT@xS?fRQ^BfA3U659jJSV&X2tx4_LVlHbMh;r(m4xaE>P9jzd-* zidG#k`LPuojHS1t9XW$9ABcdA9U2c54X?-hw~vlogh%mb%Q_bxF9^#4S2ccvsV*n) zB|5v$Jjmlir0$V&^{K(;NqyP_bW>P7Jgay2Wa@y7Q{r!|72(xb|7+@Zenk>D+^R5i z{;(O7Cb2`Wt?ugie?M^hJJ_P^QFi~CIh9|oP{&e?hF|U(;O<0@{ zxqJ721{-AG>^^viW*sZR-a==?oJ2?J8fN7ky**0&ht6+%WH&UJ7~tm-4fVC?4?2k% zeEQy=11zk}${*$Ay!zZN;pxglzpgnZ6qXf@akSyPdf`MYX%(X(ndtgSE>AtSNvFXM z-UD-lt+oTU8nXk_YMQ1Wo3c@_9W73#y!k+ zyV97Hy^9P}Wm^cKr5HaD7T+-Y7GHjtVh2&JDln1c)_?FogL+GE{E(pqr@@kQW1!COLT+y~Ml` zz3Vg{FF&XLv7fhCBSc3xgSp388WP3YFZ&eAr`g)aKlN4LuTkNJ#53W2u$Fn1S+mi) zfvCmL+AO&=ha#IbVTtR_0yV;X)kDk=9@+nZVTf=;I1IkvBC$K%ZgAwNy`bs8I63KP z+;koo!j0X{GP2Gu!bj4d!3Ebj{L%iSGXR9zjHp&1NkafW%Gw+(U}JZbJ)+U(WXG)1 z{b&)OhE_cao+}e5)xBncQTfnuk82%!?gU3OCF>W20qR`ZB)wVM<}(%6nq4Q}_!c#~ zVulSnm<{2PtVA5W`@W;O>k>VM-eGb527Sv7`g>FT5R6(u;m_Eth`$<*6;w?AkjfPn zfpYEWk+P;$efW5Dp4CSEf{V73+?uY|H2<-p+hcs>)7WNnBKK`^+aZkK#Qp<(CR4&) z-;gX*E|1#eN9K9H`)1x7k8?orog?aQ)>a+=D-n!%BYbP0ZGdo+@^ z*qSVON?-4j{&y7&Z2E0pm3iO;sMX=%UJ0jO$MFUlXEB&qy4=d#bsQO#Ck(tTyV5lW zXjY8K41OTLtoMPUl?L}NGzu(D@88kSa_BmM1-8>Emb%O^cb&=B(O`>$Gmrm05fuOi zP}j^nxv~CLs}skMgL8SjcIaYc@lF94?~Z(zK^ewTmoGB~dS#%MAA9<==-U*;i{tX; zM``NhxokM9h;le7Q+JsLM!5;UmcFv=;l(r5;ZD}KtOKJ)iT-5PEbYc>=bqSIoYnt$ z>N?9Ria5tcyh(P zXh64Ss;7Oam#p{J--uL~D z_E{cVetlfCQ5u=XPd|A489D|-L_73(t-~-QrIsyOv@zsoCk^vq!y#FEd5tg#X~je8 z@AnroUEq3<#NO5IR8%xSwhb)Z&cUQu>HYS#u8#!)m!X}Z=O+!dp(YxcVMZ2@JlC&p z*Qpa}u>OY2OSpY(K%e)u&jCJFLLnrV%}+K2Xia4GWXQZK~8C(t$`Xzti136X}I&wDPYeFsw0@Dtkd_0S`Nh#A6UOHc`!>V zi>I0geqJWqPst9e0taYRSoDfJYX$*x+J^>mFXaIpfsq|k5hFdi6 z3YgvgIij4B@kl4*N8MvP0u0Abol-QCjQAa?si}9KdBhwDoAhxmCvx#dZqo)q&2l=K ztvR%i<$~-EH41Z@8*lGlxMy-;lqn!v+T!zx1@+?s&nfCDxGGUS?p(5r2`dr9-06-} zLVixpW+E@R{;d87?R%nr+IOT&VCfr<1h8q=GsW&KeA@x&$_qRCWsRnJ@<7a2IKR9} zP?6hqdP!M*O!9}A@o29^m<5KoW&{oq$}=+;n^+<%cR*yMuBAI;cl0sOYY-KjI0IWh z-AJ&x+15NScwE)(d5tG&4Wwr{)JT~?009?lI-_ioW%szbQ>MHMRNJFrUQR4ai@%Z- zUcr;&sKX&RTJ}Z5JQ;_^E~ImVM*B#nP5j3k1t{vQu%F`@{}emF6z#|lR{YE2BpVqy zrsy&JjXy7{)S1bo?2B+9IOr<_YH^8UcW9c=R3r&1b~~_@C?!0Hg!^yzMR_N~UE|*# zpZV8JMT}L0*ZmUu8ANHG8fPEFdcne(gLBTQpnXFG+`-f$M+zW=4)Y&3a$y!Bx7z#`NQ>Z3-z?5j}x7w78I9Dml( zXlYG2cs)>K=*a@dc?UndeX>x<1bivo&hnt`6ABqDIVE*|tGz4ICYG@kpyJ*CeOBi4 zOp*+7Eadsqe9kl0z)(Q}40L}zk^@m&$*Ng2#m+Tv`N*;K<|3K`blvs4Cr_D-3f1ym zaW2PljMNBA2DkrhxZMLhWoB!0B0ox~r8K3C=aTdliW3(Y8cZ_4Vtj9qB}c!gAKxqF z!w^J@00E;*j+-_!*UU6#oqWRZNcJWC@$ivAJf62Cr~Ra-W@Z+}Cz?QVJ>4d?bJe?E zN>uc+>j0v0m&l*rzEv|NzQAJ3B&Yovst7_$sK4xJ7peA+^HUuh6kahy{PUIW_G+T0 znh6CCtUu;uAuq?zRNXwUg3)R}7OmcD;=998`bCBnLYQgE# zr|;abP5s_!BPzdK#pllrW@?%{KFrA(y=KiN>jMkdzScf@g3@GGf3jkx-mJh%ZXT-R9)S|5bn1K>0{PP?H3c-5}#Kho4t zxpLqUKIwYHrThnn(Cx8b!+g@Jm)F9;g(0VzDBM=by2+mOJE4#lig^Y>EtSk&2gBn5 z7TkG#M@i5!H;3dSP|cq^xy=aFpgTmMHtVy3OU$%c0oF?>83A}bSa5tM<_W(u1=SHO zmaV{2ty;ArP$g`5)P|W8Ga+yzIY@j1QhmJFcUO4K#-67q1|FS?G*cFWr`CV+Yq9Cc z2M@k|QcZeSz<=Eyks9-iIOy$YD`?M_BovDOxQu6CroJq=6{xW*ePR{xS7ZOKjj2?q z3@7%nj^CTcoSpytYVW6El+P=^x|jvJ+Y>6l%Fp*=iTl%)aoxFfG$nikj54O+!n88( zAM?DVrz;J>jc&u3*a@n5A~#VZvUuY9&u<&)zsMl*2^|jiprEBIG%_dA=!>%h;>f1L zA^UbIMaF={7@4+0pcG*zG-&esh??8&uY9`OkE4*d{&3*ugqd)j+4m-$mT;VO5*KiqElVGIJ99E{uO_d+>bc z_U+X-oy~Q?KX<=ndM{2WEN{Zeo4`$DC~@&eteSkmBwQmY0$`N01eXZF7)!+xgU&?( z?N{)^DA7cL1j~`Rrf!cT8s_LG1hC}bQXkXUx~06@af`WyPr6YqFmFX+LY$e}1_q{{ zNS*Dh-OZEtppM4LWh7k;4vk~)4`!b9Hb15f!cqQT_a2s5gf1!*;ruIoA=d zeY%sRku-}6jTT+jPg?o=;-56nU=c~MX_ui|pu_xIq}oKg{^y^%V5cXZt1x|RjrGlc zWT35k!z}zJVxj5NZ$r*3@@NuI>m&q9UfX}(4V&R{i?YtI!y8RVjS|yZH~odx78k>RqHop2`H`pbu4%>lv;=z7Vc1bh32KC4`wH@adr% zKo?mO|I`f9H*k8^u=h_mRy}$Q4)>m1eGfkfhCa>IbaYP7{;3#d$uVlu?CI&uFowbY^V8erTQiS_j4FoQJU*eFaJAqB%Nid@ ziR<|5M+{whQxwVTu6(`G($AtT0$_G4tTH zz^K&GJfZzvof60NH=u3;)znf~ANT0vK@C;d!>@Ty#kixj{WY@NQW4LTgDhJ8=5QWV!ECUx+Ttq&fif}Dy(gn7r4_+@(y zXLRY%q12}9VTAki?9hF;KV6B*iBMZ)@WwE5p799t9}}n+gjFXZDU2f+?#bkiSmf~~ z=fT~VFC&=tV$Nd$Dk@Kc5{vKSLys>Gl<-N`aj=AqBx*1!-4oH#reC`UM%BU;LixZB z&4~Z=Ly)5*XBi!C&aA)sG0g&imu)$at=|++wag2){DPKdRMopN_1$4Gicu`5l0`yo z{hLECwnF0Z=M!g;Q;Go?aBuDjpIZSSli&0PwHvIjq?Ie7bHTe5X7AKyv5Xo79g6z6 zS;L$Gzeves11mE}ZbLOB-ytiM`s3v%`uKEC1Mfw~6X=T!D(RA3?U@r`-8tau=XQ+i zd>`JXxRx%%#~URwKK#5)7S!t8M2ZEUl}xtTxKgW3*Wd| zmyhP>Y~9QQhwFu8k#o;;w`IxK$nT}?ncGZ~DG6j8-apOr6dM~;I0SH|1_HlawH`o2 zq8my8>&-1-q#}Qj@I;$Kkqqy~eA1*fh0T@)eqKv2HybbW)mLho5$hPjBY1##`1({# z_;Cb0y2b{l(WQ`g*_eH^uyAfrb|up_(-XN%O9G?3Pt)KFCko~_K!7TNSQrEh0j+~h zIO_gS;45x(K%(LhF{iK zW8DSgJM`0Oyk+xWOBdV>-1t)K$VB^>RUg}Isx#=Nq@iqAGqPu!p6~95ZTL8`%D67H z?$i1jpt)ja!~eaGX$uxiMg_u2x!}Hi&;2$gYRa-aL7XoS9_)BDBt#sX$$*JDF^^UW ze~R^V1V2C%uIDZ;Ar{c7cv?CdtR z@EY0EAVfABu}v^rZX6+7JPgHhL-6P=Y9K-)#J_YYSZqpCs*;5*4bs}jww;o7=OcdI zebpRq-U%H{|GAKv`Fot(2&j#H6zHewtJbD20iHfQF}mf(-FkY5jJK%$hgqxrgHWL( zQ+tn5W~aOSz5hAZ-)Xt=sA0F(B4iS#E#B8X_U;hrAzGAgV=`aYozGsS`N6P<{4nrtu+Z9c~fAP^-{Y{3Y;RDkP0!GZ7_+p zy1#Lt`xGDX>-}-d&~T+O$_ypML006cLUN+uCKJLax_I%T*{7R6qZJ~ucjQ+D&F=~E zi_|AoKSVA@0^E{#rSasgZml!MR}7~Yuvomf*mJ)E3-*}Qw)Qv8Kk;&svLZx>EwHl6!!%?GgxKQ3!@h-JMlQYK`a#K zjk4a3osY~nwMwn)%~>m(nfgNo`S8v1TACr&SS`cilJDc1(S5CL2cMapkK9v<$j%TO zGuUUO%W1wRo;#H@>=&kSV9z_g=$i)N3`5cumMsqe;rn2SWBf{&$jOsU-%J3+DTmWm zvP&ymZRE%v=#`0x5@OhrlDu%*AO!d$)Xl?nZ zh9fMvWU0AXnJaT zJE~`@2H43hwxCw*P9OTm@S@B$%x&T0k98#;DH|#Zzx1H64YOKnvnwpWSBu7f5^7El zt!7-HVPWUyx;-1MHky_;A+Z0Z)ClGR5mT?KDYszZ805gJuiv9%V(RX0EUx>>FMscR z_S>&bB-s{; zeNe!gquEld*81?c4kV`;*Sl?ENuo_?92>TVuw<8Plf^ga(4$*!nRoJEG8l zL^1@^4OZ%Hrk;6S_mfPr|B80t{_l;dfBq86BCO`U@=1e&fG}>C*S_{hfgYLow%_1e zSiGPX;oKpd5C7w?(H#ukN(q@!Yc-*|>c*!GW>-dQsLMuXV*QK~sZQ*q*J_{Q+Gh%rD zOW<9LhS21Q2j_w>XRQ1ge)yF`NU3wmbKW~OpjAxmp66!ZQOhvDq90)zk9)G%g8#3? zr7Bm&BgXWNtI5IZ!`gs9Rr@Wd-y%DVx$Qhsrv%jT_qMhfc?YK+&)fk=?d)_lWrx$2 zrY$k_YtQL~*rYgyGMJxzQ*q#>epgBc_{NhzUCk}e~hZujp#v=AO76x<7550pJVl-ubR*h7IF&3JS=iU-z`=v2TRi1qC~sU%eIZOVxyRRb8GANK#?QqM6nMb9-TC2 zH^~sOZQ1KxuMR2UT274D9O?^zs}iZ_&Yf!=lC>Sd0qi=?{0NEV+QXy|0oh#K-FQ@!5Gu&RTACq^3|A8PNtY z5)GRtwjwNZX7ib4qutP=H`VwpsJ_{90EQE5eX=i?le0xxEv~dowHeqWKW#FQCnxQL z$hzI#FKW!g$~eC*;WEGC_6Lu6Xn_C(>5R604$S#|JYp85<7LgQ38r0UL-A5;~-Yn~uvuw5i)cCkZln{QfMv1|6xmmd$!vC6U^++%NZ zP+}e~<(Bl@V&})C+I&eo-+OcFuMew55sD*yb)cE9QJ9s0QoN_-PEP6NwTsTrS_kHm zM3^?Suy9n}Ng-CzgQJ2w3C5Pn@jDfnCTp zcGiQ+&NzssM5*PDj*Sl+w&JS%|T z<>2Uev!o`pcF^r@&(cu8kBHSs%yoGGby!cU7t1)3LVExgl{HKFN$^Mz2)}YRjQZlu zVQ;--D^w*=VapXOVjo`0wF$pV?Nax%X59#wsTGGQs{xo~#{m5TcqDm;Iu#QMa8v4jo;=+>CO;E#nb-$ZkLuj~{1zxD z!7qPRt(8^~0+prJSRLgS)zku_QU&ut!ZTJ`QFcOZZq!6j4A3Cz()ocO`!=TRkJP4|{ zUW;vjJtP<xsA(?cn|2d$m0|N4C^MaQP0^Q(Th?+>Tm!AXv*EKwBlkgPw(5>go|CY<^4(=xBx1U=>+{|nzwUye zdi3bgsMHW*!OlsK-9=hHrH3sv~u2uHnQNc19&1cs1I&X!&)tBWZs4AxwRU)Z{3 z)3Y{(x=jYy6!~d)*sa^|s?~(KwWs~Qw`(8k{@_c(OzjTBLi}-dy~Q%`nEX|1jVR%O zcQDg|-`HQXjrXSm5%izVk&{1$R)6;b5e&!T=K@KCX|7AkbNwMhIH?o)jH0VYHE+A7 zV1`Uwut$Ng(QNDMi*LMpU)|_`x8?97wd0qS6rGAovemWKRb|vlx&j!M{ur7Yc|g3h zUqziy%qY2GrzbnF#CjJx>404(r_@?79}mNI>Z2E_EpOus5=3@+2~?eO>D35T|KkTe zzo9+d^i2l$fl8xW>*iGI@^m2Ek7QFF{UP}UZs&#Pzlv+WOS_B-(-O`X0*vUwrri#; zWA5Sot8xJrK7Q%xraV&0^t>*#0hX@n<+5Vi-Tm|O@=L3lOke!kiXl;qlK+GB5tJ@C zT_k_0qZ8qYN49+HP9cR2L&|d%BHP=Sson{XdopO?Vb;D|y7uzV)ytO~t%{s6xqAIo z!)^h(!Oi)wz{K5O%+v{Hmc8WstfDx#OSre`_Ff_@(7l zB;oi%Og;Itw{i=!6=pkb`DEJl#xMg>GAlbx@UXT0SHo?L!`xS%mus(6ACb1f3=9Wc zbF+#$z#>6Wr?a`+lmM4fW1!sPRo&02r>2Jm+~NXJG1D1R^o#YaXcSbMzmp!EAiFxeY(<~u*GeGhO~Uus7Y+lG>S%m5YF6yGMc4bDH?X?lKnDD7Lk4gKgNKhBd>$@S0~saFuh%h zKXO$xDe@I~Fg&lxg_(c}%uuh|cxtz3%(8Tt&+$LJCTEYISn9Dhv|YkS{|(drPPTpb z_-IDSe!K4LcORbh!Ab3Yd2QI&IWSYg0xXY@n6YfmH7a1kFe~#uaVXlUiA7y*-Z<_b zeze$8(e6VR9|u{CkCyUp#N>HX*%^SS_bxCq)7Nbe2Vrk+fk8XHzE~Uqp(6a$oe|&l z?`C~xJ?UC^ZPp0qBc}3BNzPLJXFm9`PZmv*}`MDHU-V(U0qyRo6DdQN z$0jRi`87QAc)tRZhAFdS@)2jAG&xAE&Ds)+Gh6~-CAdTcFEor$;5bF+5{v&rP^z_d z$=%SQw~MDC^1oLWSS1dT&z)j$u%^C+SbEWBC~vK+!I?t07o*j#lXPaYTuBK00#%@f z?&P07e_jLk{5MWr0+;PEEt$Q>=7-lvS~RLj;mOhW)5$Ss(CFLOJg^R`Oc?6qO`S>= z?~ET!?b2iK1idwv=bY`{cqCb3?hK}*ttMuo z2%yM*q&rL9CW8c%IaJZ=|M7Gta5=VH+rK45Xh3F?c~&w-6qysskdO#vN+=D6WU7Q@ zN(hxCQ$i>rLQ*7>hoq7usZ>%(zW;ij{eJtmzxUhw+0=bs*LkktIF5C!e*1=3sBAsp zahJU;)>F0|pK`@w<9F|*^Ccs9Q7|HfEc)@|UwUk(L$b9~LA7BM^?9b=<9zK7G{&Z4 zf4h_jAD?IH&Dw<@sK1g)obFHm(K`R?t=Z18@9fsC8_4gbVmfXX?sT!p$$-$pE5Hs_ z3^{lWL`&jb{R2r|vPK2y5%Cz)UI$+y%>xh&D2e&L@ik8^%*}ze$Yhx6^zGU!_0>O? zrqwvHFVLF56Lm;vn(M@@m!Qx@@D6)|0(8K?V`F2lo)|^eC67Ta9v`}9tH?*3+N{)2 zHZIq|N*}#>5CohfbG+pe0wcCHg;8R0nVhaQ3@^G^HzQ)vKiIT>UPGn{LZ)OXG1-cMq^eNJ#Oay%-2 zUQeCLr_4xn$c!jmf9uwFJ@ta4L6{D`HJfs(yUNz*xowJ;x8HE4#AW&;b9H5;_-tf- zQQGQX_okcrE_;1^{LejjSjHSNk6;hDGkXk;)gg2Fov7v576iofU#H&<4+Zoy$Rol= z*KHm6-pJIECSp?6t*1*v!@}wXB#&jS*KoBAK3U-=zr->0l6&^-ff93I3fy}0&n486 zvCdyPDKaVsx-uF;83)SzwUaC-^!ARo*Z(o8rVE@9lK|V`n6Q=23LX==s^#R_-fNvh zoU-6#1>3}RPgdWyY$;-Vz7U_4g0)|=nOW=BfhC=~8}%D)Hs4-lt9H?YCy#3;Xk=E( zN*oL~V4)7*-o7~2>*nX;e&OdYG^JwFpT05nkIN71)rRg%+i>jZ`bS$9*_H2D zq-3JM{A@?; z)+&=X+pZQmj>t09em36V_l5<#*0o5RnqwZ=RCOy0;NYD;UOC`8^i{ycV%Jx5t`s}9 zUmC6nYyYh7=*CA0f<5s#WidBIDE#A1sxESZf8DNGr@QCv&Mqx2yZN!=XY8MLEzh4$ z-Tu#5s= zoZNAsY66rSa1U_0Y(2wrWc-{tZ|3Z2fY#4kd*Fx>x08zu>GtNwThwgIeAeQ@-ShS% zzgD`Zx_U5-0(=oWsQ&p^U(8gM#)fTY9%NZZ>UW&edQQCXx+t@&(SwjW)!Er&YgRLq z@aOP{yJJUdwg(pcOrxm2brDM0qK&ooiuO0H{fE#?R(jTIH1YR~9DJr&Abt(vKQ|a0oTrg;T=z zR#|QZKu`X$Gi<5REJJ*!T<-pE|DQ2k2T+!*8`hBlz&|-3UBg}$@=E7F+3PztfX9gD zktB;b1fE4|#FDP#s27MGS+(;CvHjFODto7N9q-bzXZWuT-pyXaqlr*OY;%cMe!W^f z(6T_8ghz18M|z`rY`(kT#i#3NONOs+%;4lbn|-mGA)%p}&bGYliAOKq5-_(*YXjoJUv)4tZm zfE9e5dQBhL%yaQrt$SGkNuY9kUUTpLO{h5rA4~mIRJVKG2DAw;ls?XgeKC9Lq)A`C z#q#-LufHuhKQJMaVO;q{t8m}puq~^4bG`n}MJsOgn1h<+XXpy&s-GL7-WhiA0@|k| zp&p{XedgL9_pzqsgFjThd=>W(Sck2xtyjIsR;DA`+nqCK;iyBwl=TJ=>U|4TFTM40 zO;58Osg=h!=-u(%-!|)BUKz@cXFskPbVVS}A#R#ygjR%}FKBPl2g?tY?p-6>=>`ME zvz{GzOBQ%DrqUXhQBbH*7{P!|UJ<6Hw70%*R-U1SLtd!pURmMm>x;k3zDuK`Ce1bZ zS`A3};+;|BbH44reAvL!#@J_Q$nh+fQl2?G(9K(hRT>3tKa{;)U$i3nZNEhOsDWb} z-^9B}N_{Xn?gMxoB^ky7ofw{?9CvW84-7;{cI%L-db7Lq$(q)YvnS1SjkBf@7bOsC zEubBls{>sWj|Or^LIH-~VZUe0n|$0LvT%8v`Sj_sbT%gc@Z8wA!J5jR=$2$Wk;4|| zcG$IcQ9whZyPN-Du9WZDpo8}C;d9+L<1SIv!}v201{<2;In)4G5yYJY-j;DK25i7g zLU6BOmPQb!z^i znIqN{;Jq%Xz*vFU%lcw2Te%t>JD3cwCv&FtdacJrUpKI`#>pV)qt}1Lp}8Z5*w+TG zZc){+Z$0y+a0 zPRckLVRH)VIazta?5e2h3neS>u6nw3s?5)pI}|p~{n(}J|7iizsz5(}?Y6cG*==TR z{eIbjwv)ojuW7Cvwe-9Drhv6WR+atSh^vds1e5hUk8B?`XinOXKZH<}o(8wy&(xk# z{nzk|*`W^2l|4EA{FU&A>VO4Bl`qoMyUcXFas9e5RrdC0PcOUlYWao{pOPLs?d*~H zdHpSLs{NYUAtQnla^rIyd929aP1J<}39FpS(oPhnUJ0Fw2O1c}&c8P^(@gblcJ{OG z=K4)a8kfCk%Rmkj`370zZvUkv;rzciKKbiu^~9yqcg-~Y;9V7QvltiP`|`S3_#Ihu zNiG256fk$BsSIv~fTY9lvulf&P}kwc-2EXf@=G6F+H>jC$W^Lgv3YeEu{eT?1|ZKW zeC+t}&eZkbc(MTk1BKXksmw3>M^Dz>J}8R%@mYQPI}>2gQ4?X;tM}6F{>JO{+0Wqk7qx7 zWdxbnWGe0#f&sPP)$>^c7$jtq-_L%T-nfmm%C_PYu00u2Tb44c*`l?<=as!J*qSs)9BRP`Nn#Bah|R0xBczf??IWx*Ys;|R=(Kq!7?A@ zyWw%vQA`wGdO2xWqpe2pp4|>K1Vbz|>^5nX*e@U?JVbt?(g#?f@Z@~xwD6}l0;la= zv)SX;V$-Rz01yC@EhNBgb#8t+cmAWBXUdW(AkYF8Q%~8UwlNyNpzZW=Q@$QAF1b1s z8)RrED%`0>>$+$y1{nGK0qSDJ`O@jrrfDaQbAHvLwTg0=iAGVGbHDd*jmJLj37z;` z4C>Wy+U}o=CcEuF)FzIq^`~g93&#y%EJzXS|70+lxj7moT71IebP!lJ$ei5tqqQj6 zul0{|9X+qJbL9q~pf$kSXbT_&P-!eo*r`irP58$QTtRv!)2Qm%9RQVRFC~ZCGx3sx zZ%HruO@+;>)6+p8XWCtBVuVq?V{+dc-zT#z zN!Oo%BO*N!cbZ+jFKIK+kFbqq<=v$nGvSKYp&zP4L&-LxSlNv@Xzj^Iia~`#rSOMI(t{ViVB3_aD0sZJgq5(EgIEhgOY!jPrMT-39+|hEV#9?dNs;|Y9uLsiFw1qw_Mnr5*AOg zN~VW=8<&CIH?<}DE_~9{>Y{uzrQh6G-wYXrHHGL;HBle zYHMv0!c&wl$4?*UpWS2j{*_sy$zPRJm6f>vvXqJWu(pF&GJsu|vrNRN0HtRF1tu3W z6zV7*cAN%rg`2o5vNu{wKKTd;EZFR(an?wkM#y;snHD4=>j&a}s^z5noB50K_~=e8 zX3oT8r>+8U0MlgN|;z{XF3n`B|WOOyM5tEJzEQdmCT)zwZ{9{b^HPhCM z+nHJr8WYnx+A7QVz0re3QQw}AQ4_@ZNy8@&c3qjtvN5&LAf8v}oekb*_G`B*$)N_r-1o0+;Yu@`y-rs??lQFm+d z`-_>6xE<1((5^)Eoo}}5@#Eu*S$8R%Sh2NglP1O2qGMJC1Xy~e&o`KB;%#-~LuWle znf*m`Sz1N)k+>}SY?i|i{JB4()X!($0i-lyZkElWQ`DEiiRO!_a*LHNl9mLyC_}^ zFc{Nl*0N=HH&>q*`wI&T`8r7Jx+Oirp;n9)kf)@e>GZ*FXjMSc8*LROS!(1zzC&(x zSswV)H&ks>`psEu_UQ_Mdd9=`+XBvME_f{`59+Hfo;dnvQ+^CSPXKx{)P83F1=z$RXV)Tm5zABcVO z;L?rWk+=6_awdBzptpD=^M9Sg;!ZkTyeh<~8H82-0ERu{&4##q+1)YVnKBi3=FCp< z6az(PvSApra*ldhEi^S>ToPtemjOxq%(~{QPj8b^T7{DLZPIyGtdyN!@MjmkG#wB} z{U^J*(#U&v%2@B?3je|upb=u*f_e4>#+wl$ImN7E+?jF4{Xb9Or-TC?#nHr$qv%-Y zCOY5Bg8H+VHR}--j5NZC`oo{b`?}x4@2x$0O>?hCTL(_(j3Tpr!ZwPxfwlFO>Tv(W z1qOXVcUJba0ECpaoAF6wO=$#4VL`@g5L-hW*>GWHWeY_ErOiYZ0wDuGH*H_s*u|Sy z3UwmdB?eKMc4tBZ1#M*F?`6HWb=TQD5Q5`Hmpi?cjYWUJ5M#x$?3$gl>zW!GYu?)O zh*9q})XsW2zxbAHqe5pR`;(w@PxtB_W!?wZ1=y{onkFGlt0I1nd{x>RcL2}24W5h( z(bFqvO+coX!6O0+%A};6E4&3fj;zUd5w9^xE(lFK*0ck(ATJ$cnc9DYWugT@gWO=> z?$oi%0%0}j?InfEGyq*QoVD|jmvlA}b#V-9xCIzZhQRLG(2yJhc81`A3CrVg?*DiN z1%#NR3Fk_M%(-QXWv)mlvx4t${#{obwish??(#g~@? zt3l-L@C^=&`7zcccvEkJD2o1`41`j5)|bVyi3zVp zp@1=%faHjPgyHjv&|O5dDOw2nRP)^$3}SvARysv{R=vM9|b?Vn1IOunAbP#q=(Ygk4U1CqN= zybk7*kh`zZGX#%AvYeWseHVXwH2Z`LucXEMfAsa+0GHNuSRI{pW;|u8#dz+5tW!Jv zI<;U)*Y!sQ>)_sA1?xbh-&A`_<5<0EEtW)Hiuu$=tKU3Xgq!-Moe0p0tKJE@+I{+% zx@YB;iM$dyBh%Bed=fd=b%(4;Nbwl7Xiw@HT72jC_d>>eLzw4>`-M!@JlX!8!w~fK$c$CD-FseWxFX83OXq^?R&Q6~LPVIu!Z>V`_s*{&*Q5W* z@3j08eKC*6e&x!Kj1Ms_6#KGaM0P17SG!h3#vK;x+@Kqe3gNXspchibwo7?mO66O3 zXT|!GeJitgDcaZ(c)kKKG7~LRDzI)+FmNof6i`?8L|=VC{vS6?se7}gbZl7Y z$f7;j;=TTN#`0+M?qm6kIIOoLi3y+$L~tWBqo|U_i%CF)iL5E!z%b*rZu3wxvoESE zmPKFFT(07g{AV-mvvC+^@A8uT{qJ?G{nmiR zG4IbOHd0oimV&AKNs9YPBu*kvc^-J*Q8fCaJGGuo1vPQzOPxjK^3)1MrG%|ofs>hx zFo?4UAkH}hWKDc5lp{#b`rfU6*k3SMPMhEN7$hS6^sp{wn>UYyT!0wE3~}$%r3rau zPCY%u>k16A`swP;30vyaeO5S}hO!5$d0D44)v&VpjjZ);Iq@~d8+(#*DZ*sJf(;bg zQ%C+bb)R~1){VKJef6v)m2;|w*&eHm0C|##fFxRyAmSFTTuzxQ&9U%QzI{4%@+8|( z(lu08VmTiGBAaLJ*j6Ab#7I<@%U_nPg7#;u>!S>oQ1<7LLl17#)YG$@h({!*Cc76u zlISeE(PO?K;B9cfcs&fsee`CQF>AvPu0)v?5)%`MUfNECp%AUs!_TA^BnY(jPAUQh zB==?X4QYJ^-$xz#Hx`AY*{`&_bUw|VNnRE156&H$NP>9T6kz)=%w*J)&)o%qBghqv z{P_RKo8rCe@ZGLOfp``78R$T=NKN5Xj}Po%V8NLfCCa1&$QGOK!>_&HdSL7ld9oC{ z-Pw!7(#>bK|1i|zO7=zonvm;=^M%?skm4r|7X|t@HC9J~=|JJM% zm*t$ryGf_5{1UglE|R@7j6Y5zLeNcyDd|R879nse;G%x6Tt`PPc}pgmkb;PH=jzQB zZHYFn$YzIO{{>uvo2k-eF^K;4^5pvJEG8pl`x`Ucl60B4Kxjc4Jp5?t7BR*E#Y+vE zG(mKj=qAfBaPi_=qPZbRE&}_IbplX?FYkK%y;^&Ta+EJCoE9fh25)&W{PDUIRt(@) zX{+GQE=v>Wn*esmeGN6|x|Z(NEVAv>CfGO4%>*F;45$x?5SOFDLnIMUW|*PXS)u7FJP9 zaR%XLki^;Qw|R4C({K^kwL=uJ5aS*RM?Bl(6)}vkiD;Chu=8IN3)$mE+T>FLhl@02 zxi^lxPHl`}cM}#xffWm`gkl)Y0BIeF_f%Ar2C_s(BbG-`IyslxLas0k;I@0(lNTq= z(3os*2D@U!;gmJW~EsL6u|6Iq4z@c=X`;sL@4Jtt>H95Z<}DE-FJ7)kgi)Sz^f%B7@N*Ncxx~Tufp8S)?>>QNciKJ5O3z4R+ z%~;VCgcjBJ!v(eFEqNzGBe0h6LsVi1TMFtcK9^I*dLndy#TQKrvU2plYu?wikxHVBKwV*S$c1)ZJbSOwk)=5}Rx)>BPsJBFhPw^8L73F`j z_IvmUT#v$M-Wm$NFH1#aJu;V?Iulkm5c6cQjf0#hT9a#K$K61CCX?tC;388dm($9e zE*S||)3u-YPazH1c;sIO+icQq0Bc^N2+wjI6(awlA(#9rDN#>Plh$b5xcbCScng=w zA0`WKB2Z-qCXcbdS#1d($SFIhRfVeW_V*W)WpPuS&Qs<#@gucE>?kABqSk`(g33ig zduV?fvv7+S^N#D<)@MX-_*QM%SA7L6zvsSxKr-3$a)cF1MBuo?(<3ikTFRy;QA~o8 zb5WVv7$_%GmXOdp5@}_D@}{b+L^|3S@=WZ(Bb1Yj{EX8N(3T^Qgk0 zHoWQ0CuGe;e{{?t)<nsNTxPJ0HGy2p4co`n2GSYK+H75$=o%~tG_W8cD6?k%+pIKeiRe&KLW&f>psV(#Kz(<0nRA!4!gA8U` zVHGu)P$~quj7L$>kP#+r@&Cn|Vz;c+{*R z%zffNQt2 zaqH3GEV6Kn5nuBVjClSvjKVqg&6{Z5`@4D8xdcfxHaS@Os6DI@1vSz%Bz9Oy{!8%{pW7s^cY zX#aoaz-+Yw|AdPcXIshDRHqDSJp?b+p7ObO@7@yqL}%a1(A_DrD09f*!R72wmYpxA z-I|eH@+g>x0pcv-p6?%FNvXzEx~P%F(lP6Bq-NM{Mk~-eaHshXh{lPVWe8uH1AZc? zDW<*dmCWgU*Ft$LRRKN-;+OEUP|R?F_B?Van&M|}ErDE>%jOzgZVocVn7n_zi*6{Tr~6fcp9;sDX}x_S z#-RYnp)-BhfAc*+iTCHh^iztSS;In0Fp&|MR1yAK(1<7F{boES_?6)tm;HUq#|@tYMKUQ%~~ z{`&RfwAJ@5(q}A`P6ATz2}QLyyzmbg#5I095-~SCj;rfX{vNd>!XL~?52iN|yPZCL z4mMhN?AS4`8yWZjdV6%8-Of^?UE*x*+ZUaIQR^IdMD5v z7!5L3nP-zxUM@g{(kV_B8~t9(=11DZ6E~XraPv3+xOy^bLzM&N1@7*$4K?7LQZ0wc zk*LSW2d|MTwCq;)pS@qde!ZH}alJv1EE|<(D}?1{{4QdntC@!?GhoKBSF73VBM=;m zGU+p^??!gm^nJPvT|E2E^vpxdeE4+|y=aLA!#k}#GG0mn*2IhGo(#u&D(3j00`MeB z>BPL{$<*=839~w@05f@m(q@yq67C7HYwKq?j$a88LW_m6ZyPFnAVIoiwQcvd%sRiS zr42Waya(I};>i(_NG2s5a=AHEzZ-T?J2rULB0OM4G8_3i8R$KU`I6T9_R}K!DV8km zH-xJc)+_FMQZjHlXYwH}oy#+yN$AM_F2n{3y-!$-iXG5dbq{ z?);DNj$K$a%2Go*Unbg~)rXLz6V|7{QfiKBNT7Foc@Af6v_?%K&f#WoY=WDoq3bb>N9suz- zTqd_!DIrd(5ud-^xcjHC--vSbE)5HAd(bnlT)7w|SoYDub1>$lqNWy3w?k2+$0%^b zir`g;Jm_7h!1EZ;)!`yxl14pGl9x^E^VU3UQLu4y7MW4lBSh)U*`DD$5YUCkShmTr zrh1KhG%23Z-VYhF4i%;Bctli{8Cn*6^X3uubco1UI&KgjuYO@}n7$B+|1I%Blg+Q( zE2`9kLy?tCOvI+%YRPcJ!7eHEbfCf^)QV7sT()6OpVb}BfArGVpP_dc)b@L6_JS|% z_U_uXh$Yh$9VCm&)2=DQRd9v2vzazQRQ%0{X9*%d)%%`4B85WxrA)h{=_||G8wMLIl+CV zIrv!OZl(eln-{Q^&W@6D+qh6;1Q-=tB&7j3VNmii--?(hFf+9@$gJx5Sr^3%JD2&~ zTu5JVyyx%UH8uinmDW)ju)x4TL1WP4Cg%&%A)Dl6wuWi3b##xE2wj4zgaRL4a&w!+ ze*itJbFD62ytt~n+f3jIIbk%sY}1<**(Ta+#|~L4fCt?i;0?HIVTBO@Fz0CCw3dET zcpe(HR>RhIq2fY552D2CY;l;EG3fpa%*aeMxOnq1OZVpDC3U(`1ZnV}@}me|;Bds$ z=Wa#uhx~`N@Jmbp&q^U)b*JY;$S9d#CjIBTTYldz<8>@0s{L`}uGqWK?2=1|w)@+0 zLqYr3>6L%~&Q@BetWrm*%R*Ie?+~3`b9+BCI2S#0MSIJ+Mej3Mi7ga-=3>3p{4d*yfdd`#L<51{Q)`@FD-TB@j6!)OgFlZK z>rDtVXKC-pJFUl~iOA6lu7xkUcH4yT({t8&s@+XJ7Y_jg;bYt2?I4}Sym|9-a&ifBz=Fp>Qh0%ONvD!ii{9E@--CY-@jAa z^)D|g>%+jCKZlRxpVp*8y$*FcbH&v~+4oNy$gHXfBF6qIgaM zh`4$4=CjJb-I!hxuNwX_70OwH<#$R@O$~ntD>|T;;7&)@3>!L>rJyZH18KCTXHT8V ziMmsTmrgn{?@Sh#>KGaIx0llkmjW9FGbM>=PCBA93cs#Zr^JR6M&u;M{%m~r&S zX)NJlUCVUhXtb2Ku$_1r{QC?`OFVc_Tv~9~tRVGdI9cpf>rggY{H(6t7a7_A=dWK3 z+;W<9l#F1m&QKaX=lpfJwE*%)pZ#D;Mm!$nEn>uT?(A9DU7>ahf0pKyl$h!Gd%JZj z-8^{H#*LhgO^fy0oOBs7$I{yU(!7|_;z#CbWW=+3quN!oVVzS1$~2f;65*FSRmu5l zd4XY6o8~K5_KD+`ro4xym|I|q5_~MhSunOTFL@QqXeIU0sJbP97Go+G|Fo3?P{fG(E5*zazcfcc$n37=KF2$T+Nc&g)OI88Bi^Ca>!|Zc)z( z+>ddrf({48{`7YvPs^$D%S>~em!3RgJL_Tr(=Vq(+_KCjA!y$#b~w>Xj0Fkk=D^)))z zSf@hG&a-*BKm_TC27f{0P7F;OQGVoPeVztt@w4ovq3gxSX^#vae|a65ZMcE7T^Fa@ z@*h9Wz*o0H@*GFl*9VyT1-N5RQqpG!(H9d)Xr6o}{<87K~_fhKtfkg2~r|*xU5^ae8o;^+W zbR2b}--0_e6IK;ENoN`Yw|-c|OtBC1c+TyBooXXbPTe^2B)h^U3ZV_f35>R_^AAVFuMn>~ittL=z z`Z?#o-e~c}9yxxew;T1eQ`F@VqAjJ?8ZV)sxHu^*D+m*;FJ0$ltD%G9cQ&W{g38z( zlIxH#9@B!J$i>CZ4zaE0=zA=A8cU2@ygOE5&*ls#O7rgRe>6J~6f_0TgGIYj5N6E4 z3udDOaw94MQLTzoA$rrLeGg6OLTpOD5FTB>yF#MMTkxMO`YcbSjBTJk@*RY6HOyBdD+UYS4AE@$>gtT6X0vx|!Z++?eKSo(&HZfgv+B~9% zu5Q#`|I0rrJX4#@t5K#xLu!1cpw-=z8;F0t}oEELcU#PN!Bsy|Dsn@AsmtY1(VYUtnIAW<>TYl zrE|(%ytcXl$Ptu58`se*PN3d8}JSw`I{*=OQB9-dh-(xHzc<^j~m>E!P?f zF1d~(9S^}t6DPX$+Bxy??6w(-`)g&vjT|^w!!GJ7kMVGv-uw|A$LQd*v*iuYuN3mC z!g-?EuUEWDObp*^yqNpVDJU`6n*0aV;5B-PGlrP5YBt)@93=yGUaoCkeltl48XnNv z0^G6Zp(h(IVOSBuGPG%w=Sgqh9-ZE=DG(tBT9NLl>tt!j;#I4js&wFKY*;vW;NjU` zRCmOemUXm)r#EzJTQvWioCk*XAEI!-)w*X0!R$d}mJWmoiRyJwt4%0Eor z>mxfGch+&u8mS(Z?qRp5j;B$4$^zyv=Eu1oqHQnA>Q3xHzj8J&_YIri*a6Y1&?z?D zuwI`&{kw`KVjY`jgNTu~I(A4wIZcvN=EtnfcXK(kBR>qQ{AomdQo*>95r?`erjhas z0V+;oqCqgG0r<@Lx<0)pODZ+4sv#;^>*4~)G-UsTF6nHbI*J@?P^_hbv&+iKxo@`BH=iaGn1llCA%j?OI=z=}BS}ee* zIdR~?Mp3s7$TW{KZ_gSmt6e+JU4QA)r896r&xMs6YA2yRG_1gGY~Y>_)@JpKW2jd%cj2-rvQ-HUpet^?XTW2LN2rj+DjwPXC*H0 ze0X{O6;V7;y^W*8ZQi!+WT`hWrF)KKLTWSW@L>i9?`>;tT)7egMn%)F$=lljjyjHj z<@Z&;N?%qIfkaq<5(kaEYrl4Qa&m*Y%0XdGafOu08ysc)j~;D=@c=_*@F*6oh| z{)@*)ZffJ;;6UC$!y)7vJxN^`mn!#sLu~*4x#iMdI^T4yBZF3GiNCJazC~``V00Iz zo-jm;(UoZo8VDO(+ifUD8dG}SS?&4s7L=x`*;iu!B1G=ef-8*pjQ08=7cMkb3_ztM zOM=yXAATz@cei(V2?`>M-!PllX&vc>@gORBuv||%;6EK-U$c9C_ zWsjLCY^->DzPsUSgMJL4;xfEB)`UXXUXG65arNpzj*P`XOf#@IQQ`6>z;&r>Xn0b0 z8teGi1Pl=@gnz43bVvQlNuuFl5U?!eZ9cO)Del48uhz(?~YfhxIzNN zkE43Y{ruTGIiUZTegS#lfYfK16(xGA$&<&T!(mL^2Zzjij~?xOv(8&()~s2m(%ax> zY_nv^4uIl$w_PiPVQC>2#CBEi6sni|OZD3F9W)#=u)KKrjy z$8P3*$R0T4U|T^KK^;s3_3DAO^V{M(M;|(N%vatOp#zP87mtqAhtnUQgX((+*&0cy zQv2cSw}*!28CJ}mKYtGs5(1af2*4zW8cevaD}$QOInfA+A8F46p0@U(NwlJ({Q##^ z!V}x?-7Fw!8rL2CupF2TM;Dg{OzTdZ*buv0PY87d1w0>MUEJH-Yx5i7NwJIm_GWCX zUcI-ZmrdEfTBg?3xepH~jAkB}3W|c2DGzB-N`{*;;s{DCYIHeDv^3O_Ad*{1cdvT> zf*@M;b~`xm=q{R^02}O;+1Y0s_u4eb%!{dPSzQH~c9Xb|qU(pHtw#qAlrgrZr%oxr zN+(R7oPc3tqa3qU-47%w2bncc*uT4}%UYkh^t#*bDaMZ<&lZ+b95-5FS}SI6JJ9a( zZ;Ao(M4fkUdNZz*cGtth`{5$_w}}paA)XKuk@oun&U}KMg4EQFvTV#QjZR~B+Atr( zF6vj4r)O@@ua_5dbb+PyP*4&n$v%GlYRb|JQ^P%sAdg7@ja{b&zmZL-yM#pCekSj) zSNQ8Q&(BrXcX4(O!?x|{2sgd_j~~-Bcd;OE8Km0o*N3TO=$;Wd2EzgvR_%Lk#pewg zwr(e@NAc2~mClQ7aON+g;4`eOCgE!rhPHX>doEWKm~a|w=c(3D8vqCx)8Q@tG!(du zNc!WNS0beZ>W-1M)wYi+Qs2A@e6UD&6HFJ2&O5rV=F+n6;sx%_CQ`t0CUoETjXq&e z{kPLgeo5Cr(^;!m$MYKX{z(5$N#3N5{wb1F!QtUIM$WstIVj1i`19up^ZErqDONs@ zHU}vL!iCUzfrk1qi;n{DTB+&F;#nV)k2yI;fFS8SdA8f1JbU@_W$WB(iU!jOca5}p zV?Cs@I1~^t>S^xP%eQBc$2xv2ESyNc*yYe9md@Ln8r-5$PD2+a^`qiBF2q0lR_Lgz zCjSN7Fc!r!d0o@@p|g2%J!R!-6gf>`?A_N|P?oiCFTNV_*J&+E)Uxg@_-ZGeI@q%HS zvqU-5=Ie`NZo#{LC%qh)*U#g$`$)cG2y*8DpTi2Ha6A?-y{}fY1xr<~SzwjRCoK?51J`NHg&WgF!)mMkjAk zLwZGT-<67s56EiXI!6thd(nDGiF}~xogev}3XWsS`yq_)NpD1l;w#W0MD%IS*>pZg zVC+$s@GJ(=LP)98pxXPgtcg*+LLv%{SB`~KheA9(5PQChZk#BbmPt(B{`y_Wx z7`NrJ;$~jf2KWJ4^F-QobaviB-lBn$tb|7FUEUgyUsR?jcD?A!Z9$|{>=s3}Vi>5* z0PX7Kt5>)2XxUoN(m3~19D&Q%uU~TMNKWT8@1T4!((xZqs@8UJV{V7Bz5V9{Qy*9` z?vle%lq^l{o>N%pgWF;|($kN+aYJCx_yX*Y-;QI|qs;l*>N!}IbcAJX%r+md&5>3Y zA6;Aa@*CaD7#1~MxuVI$$>(=56`h|BQJuUAy5{EQKL(ik`Jic{qJVO1&gYU9lWD*} z8)~zCRM{w%zcDnRD4Q&z_h>x}NyFG9!~7{rfji z(5EVq;1U@<+C%F})e!&oZ5t9bk@g|amXiu#JOBaPM#7{0^HcX;wlhfXeIGb(fJf~{ zF(B6TQRbKP4#Ct+s5btVZ6-sJZQG69*h&a&#z*QXsPj2UT#3)`P1zvh4vsW;j|uXPVe9xHIqH+XNs ztgBoh!s70l1`1k95w09Re!L_mk^6w!h-vg4rrpM{%|Y%Cg{7L3XU>AwnaR8yVeBe*GX2zykQE`;zlPu=&6IXVhN&2j`Mi z>@4M7A%S~jV!$$!cnY==9ZDmLjsqEQ{!=+y7HtlNVFTn?xO%l8t%EF;_?#Z`a^N1* zg>G(9R+QWK3$hv>F7U-#2|UDy#>Kc_K*Fn6E$VNp!@3AAKmy;s==6N(W3m?>I7(p6 ze!wIP`QP?U=ps>ub4D}55Y)%D!$8Jmznf^MT0sMfktn6Dq4|*;lfv$kr-agAg$Lo1 z_ie)=YBg|aW7Y-K?ul^I;e?Tny@gMuf_j{kWXzpmv4(T@2Jo!3+ivUFE)`1M1Pr)j z@NubhBWB!BN@@rdxqkins#OUY8CnoHNdCuB(lL~XB~sjOmJ9oBH49H5bmNJVc%cr3 z5KHC79v3%V@oef*4MF#iUaqZp-Beggq~1FjX$WRC z#s2NJ!co*Q5AF5E)KA8t2;0i^QlV+yoS=oQB%qSZo4jTMad9-Tk+%N?M~vBVQDbK5 z{>s4#tdrqvsplsV zzKLrc|E~vRNyGl&fcF1f?t})Od304^gn2g|<;nTkw5d)&6};{17hXMo05WC zCWQ^0RG`w}s1xxl785UOtzg#t5i>({}MBh^5T_~>AD zPHa>nn+1G{ka?iiUN=+@tvdF9T7Vlv4*a;mvpzCxT{mW2e%)_vjCUN~0~GNHW|d%N zXjem^PU$gel>82bOxE$&CW2A^nEtwqP7j(BRtXKSR8Qh03rR&7qf=6$GKR7v?<@k^ zQ1>yRiK@@&g`?v))qpz(^B;Z!As0pT=3j-~SqY?cv*N-dMnq7Vs2x1-IsD0M+G2T# zGIEE^li}tj6f%$2oF{;_qMYI23mnTY$hfuIWP5u0474llc!gWJZeS<6;ALzyH!S<- z?-bV&9Z<9Iowm|;GSA6MTWx*)@18pwLRXE;o=$gz>JIyl9AXfcgS-@*n1-BGm^5Oh z1Yq93L-w6L;IW^oHXh1#97-eOMg0NZDlH~|F%iERcgSEdKpuweuCba{aP6IdxtqTk6o_&`R!Nps}z z?k2lx8^&4V2csOCrm|tf@9u|HSFK$6{Pe_TFazq`Q8SR5O}FVez1yf+I}==7S?U zd>-q(0_$BB?zil9#h0ZaP8{Q(y_$_W4&urNs)>UFV#=quM-I`Y0&dWznYA)RWKMqm z4rHDy^qK3xX3_2SZW>DFx#DU9VK zYP=~gCjIXbBtz4-cz*+Zw58=j)TIyEXW1EA`>FrNNWkx zs7}GOsbtXB4)ubkc@wr|u85B;;sB}~?SSM?nm!#qYit+-sX%Ho=Cd;+2s~|vZmTmh zeI(YF{jE(XSEvv=sjE1af1D^70r&&8R!VT}tky`dwKaX7L%#x;Gv?TqszT~DavPj3 zPqT8`!u>n)?}`RY7QPWkoeE#n1NZAdVdBUHi%dR__0?k3pg$mZ8F~l=rvr!Wo?~fQ zLa{2?6NgJ@*s#_J`DGuI%Eei8`^WHP(38?(;7?-IF92f~oE4Rb0R-I6#NBOZ2?mby zqpl8itN5g%qOt`>#-j7biA*`h(+J9jhM@)q5;#Z~A^;Lq4_d{z%aht50VU0h>2>G> zzi-Q=u+b>YnO_4b$tf=WW4WsjqZ1J`b^$Mh@Wb)t+7cIM2#nW|>qN`KGpr=)C;jvhqB?=UebrToj$ANTAtDT$anAFiHL(Dg!p317e-EN%n>L`A8}F5WIOngz;ytj z+B$p{TQnH`ojxXJ39LgZ;fHL+PLFAr+=2ox%s9L*MVLo4M>J2s5P0B{b=)qv+ThEV z)o}o-8tPy$bm$hmHp}yqsocgRIis$(#+kU~`YD?_psayUH}0Z&kByZ45LxMS!y$`d z!CfRohAbNc$RPN_miGbm-Wtet!S|R~KqDu)BWbY`a0?s_bg{SixR+$LB{h&5<+q_p zfu)eh$TI-Q)b84~9x@C#n9%@oycjM%ch_dcir@d(u5)%C3%N*tv70M}qJX!-ebu|t zr|4U9`G9|#TSgA0*n0@oiED7q$BzP-kO#y<8j@@4v>xK44{jqyRVkV9*5|4~%!O?B2u^Yz9 zZ7Z42IP$eEl5D{&;fMd0Srd4n!*a+3mUuN+Yz99b04zmgT$jrmS8#c(iNHSc*O9g) zWM#D%`8h@E6Nkoqrf#Qo0tEZUI-b$m>I~1G5(Uxh$Z<4|ln$(+lamBcB`FGUTcR%3 zCOVDh&7YrJQnHsKI7gZkX*}y_JK<07ii#QJ1Bgj~Xy^eU7Fkgt?1tT^0G z>(JT2pbb=_lsGSO`HBan*efj~gLo||AKAttie#|B9aAjsm7jdHa3HCm6Uz1u#xM?i8JYm#gQ zqN9_r_W0v0n^5>7WwzrFjaWevBI4{2od`HInlt7B?<2-#Y4x8Ocg8Th%4a~!F-k(| zal;K-G~PaMFP=L$nsk;1V?y!wfyPI6=Q_N<-4I!tb)35_KSx57WKpP=>~Vl1K=w{l zgBKBc<8j@g<)q@{kiQ=iwi3*eF~}|GN0@Kx)W5%)nVFgNd1hjSW`u4}luq)YiHWWk zoOgITBC3&@Lt+ID(zl9=1i*$gn9Fe88oQm`1!(5W)a-oxDONX3{nfonzqnhd8jou6N_^f7aT>< zfb1kj39c=(n9xO&-U4%9O``g@swyv*N3VMtI${jDjDJ-#8zB~4{62+3`anP*O@XJb zYFvKTGDA@=%d|yd$=Gxq!V^s&mtHDs*alxtbHcM{g2mFzHUQON#46|0r}}N%wzZry zheIZazT!EACzMnJzzKnR5x1QD$9Gcr%Upa^q}&KhH-L_KM8W->J~rUViv`DKyC8cr zZB@%|tpRX6?rpun7-aF=aRcW@@UotCrj!+u)_{DnhMYV7!)6fG(7QXE+QJXeXg)+v zwlTZrDC9Xgte$jeXyVwk(uhi(1!t}RoM|kNBooz(%4qB+OSbZKy zW*tQhSFP2c<>~7>)KN{oiuINDz=6$#_oT#ZrDmODcCRoI<6(y$~*&BdL zb?dx-i83$>6{StEC5KO)QFQ9uxkkj91W;Y}tvtW7WHNHu_B<_*p09Tc_s4$|q=#@V z(m&$(>+=rGZahG}e0kIF_3aGZn-gPsPC)7pDEEufEo5|<@waclW1im6A?;WGbJ=tH znX4lV_+xGM)aL{um0>8rgbI*TEiE>^Z$`|>9z9f0E=l1DEDKRr7he8M{qB^o9N??h z18_Zx$xcY9%OB#g7{Ll*+PaI%_dW#-L9OyxD_gxl&^|xOG~g{j0z2q+n68y|7ci+? zE_x=LHyB(mqxU4-VbDVO;yt9YV>Ast(M7s*$93xxm~GHt*$PzN=zalXAg+EovK5O) zLM}z?flF;<&kVvMSpWzO7ys~KzK=zU*mHAO1)HNRWL4yLWXB(f?Bl55Pxf#saU(K! z@}FP>?m{fRPwFPX+P}Hdl^$wFt zyB>k)086Wq6h&?gVjYkl5Y{-U1ma*G~XwU7lVk6?f*sAfLQU0z<^ znv!?JsHH}Szr?bFuC}>&jj@w<&6o6^|72$7!IOja;2Gf-(ZUF2Ob92HPc#nFlGzeT zj0%^=oq=U`0;n;MD2rGrw28W%1`TRKKSEVGo}%_dg^H!+iM~S|-ic~I%B9r$({AnN zjas+P+iZObG>e`N83>i=Xo!5ImOfHuOJ9YfjXV+>1L=|g6**w3QwpbV_!RjxuvV}4 z0y?0;d9^U+Qu}Tn-3hhQ&-8X_v@D=gJERi;=m1%32ETzAt_fl9^r%Z0E^J3Xs^OWO zPl2Z0y*t)$jYMy;V(aDfT(B@1k>YpO@7S>;kr{CU19Vc!Q0&>Am_pKoHd@4AkWQEP zLO346`Q>W|hlD7BdNT#ahNU*g=>uOU7FKvz;wf*|vaLIDOL23r6}Z%0Kru>LNVvv+%SdS1Wr;Bk09 z$T^1V{pLCXXwB8lO&Cu$QGI?L*-=m({|N|_czTkKnA6B5lS;BZFnDsmfKd8ofNQIZ zKZ08?AaMa2BEjkn&?Je4{{`ZVC87<8+S8^zx0tv(sXTkj9)(-I7`k+kA5szB<03NY zW1`GVEioF#yzNkr+7X}~trl+gMw^UvzpCQ%o2%Us5O3!g11=Uu^y@_^BQz$Ep+&#E zYgZ#_W7$0D8eFs~y#YimOFBFMf9842xN(mT;53ANH^&o4{#VD8j zeU4h_3Ij_N>+<6J`Ij-k9d@k4!1Z76F>g_@F?DBHzXDd1-G+JQI)MFC66 z?l;%z+pix8;&=ci0@xVT7gM?^qkS~8E^6E1_S zB3Rx(Z{7&l2hQ-2R^{YT&3NF3i?c$>QF741EM!(^<1>2v=8ZJ8w02VK3w}iV!vJG_ zX+xTaU_>tK)a6PB%sOkk&`mvh*a6URm53RQa`v{AnMLVdrHtisNy$&JyYstbxcH(A z_icNij72_ZRDR8alK(I9m`Q z!Cks^$>9NDVScl8^%N6&Qgjn-37~&wbhfaxwnpqP!#FZa=0AD)z}eX3v_Q4AjSgN4 z84SrN})Lw;~7z}hpC zL1X5AMRuc*;cjMV?!SC__5CVIFpLCRLU@MWkh~!Qopc@#zzttj^g7b+Z8x17R5erk zj_sKIclt30bM_6UJ&UgI$Gq!+)QNqm#Sr6yrF%~3A}gXTjN-@u;D%y7EAxYp^$j+! zCXMBO{mPCxZIX))r85Pw+o@cp=RTn5PM}a#ywm+cjL(q;rLwL1c-kE6RhD%h_omWN zA_5#b^vdv&vd&hki#sn~lvcdeWOne?;T}SX$ev55FX^~{HceS%dD5d(Q!k6s<~`8K zJ-}gS8<;3?I2&miQu%tGKVKB8R$Xri>a8P)0tl}fnwnd|DMEq7{od`RJf!WdDvGQ#oYV};$qn2rc=r1H5;p}1j}1KZEg zpc8JH?qEi|j)Fkog%0BsIg@>Ie`f!3F8eSRVPH%AN9rr&3qUT9<5?|muM=`d2JB95 z{?!wlq>)05Tk>|)t`-nG+v9J0q-Y+xO*ZYcR*!B&*6>SI`~yRIo_~#%72m>ijgB#2r#@6 zM1A$iY^tV4pv2Q^GzcfbTMf`lx)_@QHn@VRT{t$u1gZ%h6nz=<4~>!%={;F~FCj^ntcfq7^C-#k-^{gp9xyOY~X;bg;vHwGH}sA)fBOc>OzhjG|3T2Kwj==vm}TkY+qn z3y6E2hYkA~7NPNbfz-+p%7w>)G~rX$C*6a2#FSRjni@mJGWpP!VG`Zwc<@PiTjVBS z<`Lh13#bZIWrH*v8UXg#`O5?8u1K&L9gl$6U~`xdpZs3zpKBso>&~$@lPmBb>+sr+ z9Z$NqsIQ|#Zl;>CWtLBpDorY*a=YAHYU$_@YVV=XDEq;dVz0=^(oK>5d-b|cHC0B* zxCl6*|IDb0Um;lGfqeI|ysR+Uj;uqb0#zC{a=-9{5VQu!0DF)2h#4F39EdURH&xAN zv7lyOt7}_s-P#bOv;@qISv5eIZ6{A=TXg7@>>-TKLN+$u-1xKHFm>fcjdav*oQG^?;6UbD6(!9L&sRQkKST{6{vEteJh3kG_YI!-c&L(^CE#)U z;OK6mKtJ$hOqeiEG>fPoX78Ege2 zgq46oR4Cf$+i!un27ZP+KKkYurE;s(Z{z#kc~b5HR+z&oE+eu6Vn9dEbpz|UMb&~# zLv2uJbN{KkSRnwY6mQw^G)q|75mgZ3xx>oi7W;sNJAefCw-5I{_% zY`(s#3~bc9`eru}29!>GYHDe4^of#BM4^AX*p@8?V1~Scby`H>A(bU+$+S!Jhkv?? zM@Ca3!@Ys6x+eb-fdraK7+;7NPcT~%CCEM4GQ6jn+lUS@U4a_}+jc5`+k&3f1T>Z7 zywJ{02!>8WhO`8Ad4$vefS;Cyb`KAuI$M%P57=DeDj)6My*hv}bgb-f7yR8DhTn4T z+)xs*!1xlLd`#{eu-G@BDYu5RPP%*g5w<4Sz^I2TXYHzV))?c2k zA}R;^);bF284`&F3u2Eh?bB!K0jnLhWG-l`ZJ>B!#ptvALcYV2ITtlTXKlYY=r9~? z0-|#cFWUu}=1gCfn4R4b;D*FC*41?=+yG-w&s=u^+K<>a{qGGC4-`5nN?LW=GJIS^ z)QC)ljR}9*32Th$mZ z7Yl}f&R`fUKXP=KNHvCaTEW{O*YP;(&+tMM_a zhrKROL~IwnH{q94BN1h7Rg-x_0 z3D9UoWvMqm$GK6O=JcQ);p^+f439fRP2^~&an-U90W_tP*3G<&`JX<`3UAWCf22Wi z#wS(fk{-Oow?&pKL-utI#r|iZKce)Oj%vl9I&77sWxTB z1QQfYTjSz3wXb^!K{V$S*PF|X%X16|OgbxM74Jj*YYF;QQJu3bEv=Ph>oRa9Q_)Hk zb_v8os2A+Bcr8lT9J1O#MsH=DMLI4@S0jcnnTrQC+5A4sIeN^~|I-54Ep%I`tpj?~ z?X@d)2lo+DyvdC#HupSGx_)28rfi!5qL3v`0mVsP>!UR}DBB|ZrE#|dx>aNeFk|Kz)j);i ze-%ALpLsXG1yAqX=WkzXerB7?nDhu{MfC|bb@gir{spmWn!7INZ#zSFF^f|tF}Sir zpqKZw`SYKCHihwDF>iwji>gFaP7ynxGzNth!`L`Fi{=`n4?rfD(^D|yTo|7YY$*Y0 zDyOn3E->0decKJ`l<2>RFbj*WAWrp?lS(R$Tfrx%+-PHV+vKf_G zy_3{Lqv01tS}$}U{33ESx>9+^V9Ag+paVQzNT-fp`c9uUYbW?n9z_KkKjff+EelzI zok2$;hw$y2e-{ryvx4bRb98-UnbA0r`+1JFJ|Beo=Q(4P-XErzJ z20L56&ZsBr7;1i2yxG=0dGcgHPa(*~EfE;kbsfkgxj{f5fEn_34yA$6{{T@7SFDhH z^`qT`^2k%KmNS&1%ncyp-nSVb8anV%p5%`oKkVP%9%f;iTbkac(}_VYrNg83o@8k# zqDv3ak09PK{q>X!NcW>#N<5VB;T~7pvAyncRi_pDZ4k_eVqNUp=;*#Y)}7a{DtLNC z^twm6juJTL&dvPYtIWDS-9^QXq{Zj*+Sv_07U+f`+xgPP9p0iQ!s70ChCMq*Oylmq zty&&4JT`B0f!E#f+y5U;X9Ct^yLSCbD8qxO%qk^?Oqo&?Qi)0$NHQx?rVK?PLPA95 zMv+QFqCsU!GBuD?(nJH2R1)I*UH13B$FYz1+0Rb?|NFj%^IU74Yw_0cf)mx1?NxgN zkYONw!Ao6|_*Fv9@pi(myCv!Mr90OQ^v~Q;J=JhXyzX|i>VnvUne{&KF=*0#1OVv1 zI8T7*SbWap%LZf9pGD=A5cYw7y+sO332?%!0!<%dE8kv<+9y+tX7vAYtETEZk0o_1r>`IxK8od~=IPNi?fSM*zP z>7SD*me0@YTCL`>AD{Q6>R=IUwJ7CDr}CnD7wi3@?>{HX);XExp2X~7gV_e1Ae?eE zB;_QqTyRG%*7~dTuNe@Af}h&ZOcP^cGT?$XzASIphK8mJS4NeQBhBC1M_WZ}DTdyk z^hQDX^wwJ)&Z@rX%7=J_pg9{6im;jJ1AV~qfSx}Odhtydp95($0-G(^{RGk zkFx<=H~%La5}51M2s^}Bm_!|`No@vXz@f12ZjDF?1VSdxl9_+K2&u6*Z}TxoO@mLE5HoJ6cJW48kv zn1Vp~1wp_u_fKBcwv^0n3{Y^{3ImLp7w(Zm4t>PmPuLJHtnB+;pgR3GX$NSArn&%TUqkU##h=^C!KocChwr|074f-0XeC-+x`CD!Jth zqa4r_Sv@FY#+*3>?+#Jp>*qJQ{>HUAbLL?5bdr{Y)S*~x zPTYUfF645z@YnXxYwb2b=OOP1gYR>v2Pi81%89NbHCVUt*;wJ7nJ4u}H>19#5$V=7 zH1!c9nca+jxRc+8$XJH;Kx*FeZMoc-hv-QMx~ zWrG(FZ@Aq8QXqJ6Y-buA2V$R@s|I}E9(}0Od&{uc>X>O^XgjA}F>7kwAsk@(^eL=8 zy)o&|yge=84yZ$L4%A=sjdOY*TblEfNgwe5?%z+g@|By{{#jQ+8snL(A6L*QfM}}pmX>R3FARk9tgu=}_F4_6%ix`-Uu>vq$Pm1J4*08{jGP;b}Q z?axWP6C-gQJ`6MLnDb74mQh`v{4uNPMm_+>P>XCLWlRE&{IXp-^>btEjIHhNB@ZLX z+rECLp`ow$eI|=?gAJinUe>a8RS4^$prC|R>vvTN2L{16Edaa*$DcT2YJ z4-^6!-wPQAu2qeQmV`ah@&vmK2aEgtY0L%G&2q9eRt;10@XxO9S$Bp^6wUw&drQ1Q z{ugBtzR3WuH+B|Rg)jm}k1m9E`Od;|^7gur(|78(b)l)rT2Yau9wKasPedoa*ub`v zz!FMy(+D#TUbN*JVTEAL@McN&+VLW=ue3hX^)_c?aq1BZg}3LV4{%sIC)}EsC(~~L zNU3Gi=Ux%L6x^mQh!2%=PT6+q>4#KHGuft@8p^}_hc&NKS2fJ+qFsy0 zr%UG8$msVLa2F-Oio3fcQ9*k{HN>aA;;V^FK3rPT(gwyCK7&D~P@zM8`RdgS4qoQ& ziAFx2W`_I_#RlLLL;t3*w@mg6wHdBnT3?HT`{CAz4jF|;7G9jnB@!=|-*Jd@TBr_? zGdXZa$P+D-D63nYXUSmgWBhz(iou&ZiV6w=A!HFRT9lIX+&SUkcfR(VD^(~Ecr}&l zCl*DG@~Q6Bug$_h#yFvF*yb_60*`cc@d-8>K=K#zJHwlud!4<}+2j}i1ym!Wlvf(4ekAzAaXPK5X23}qksk@C+;3h-e##zn_$-QKAZQqT; zwfv(O(dHtrMk~1{++k3Q8>YhVAvuJbBAU4a@RSl87QZ>yX1CSt_TsKptsBO0l$w7U z_-=e{m77ksQy0!x-WnU{0l1b3?Vt+ED^j`Jf69*2!fFsnO!cAddNS90;892-TH?+g zYfm#ckD`$NDuC(+Dh47KX9RPWa>E3S`_u$@q_hEBwW2;bxN4})!y34F$;^!MrfBuX$Z5nMU^}Y*) zt?=Ln?mYe%(|Mc?M@Qi&tD(8xXW#W{lP+F+EN8XAWp&E>HN_7j)!mwwPd)RkgO~l| z&J(`8Q@T9Zthp$1+Ubb0OlLXe4MaFR%$rx@W8=BdYhVtcE6VC+9`>_@0Hdog# z8WXa-+w?OVWKOzDiGN6&sgC0~27c2XUCOR(u)qWp#}Uygf}KT@#}HRg{Kd1A>>4M} zY?pduDK1dr4Kf9|b z=gvbC!@uuQFz9}Vt1h9582X|LKLMvd-#J{fhXuC0!T?&hD>~g%*=Fz0;X%6V5pwfH zmJbWB*t)foZ{w|&O{bpbXKgK}Mw6GjU-@iR<7(MU$R#8&3|!Cx8(4Q8N*u675wS-i)m)@@ zk*&o^L~D(Y@{dFa1d`WgT>p7vn3S>=cBGP~x6XIMwgSn|slY*cR0ZHc+s}udeEPx4 z$|{Fr4QEDl8Y(d5d>pRN6=OhydkJGz^56aCbFXvCu&asQAhLvRy^8uK!rC(jZa>7lN&37^+kJCFA;Q7@k;g*u0aSV8t;f4z zKz-S>xo(=e_e9yPg$ALD&YZoYkD;)G*z zN{)AVup+G--MZ?yan{3w_6}Nijr8!B9j1j2YYrfz-4TsVok9af!A(s~W^+pRw%?Yy zt2&A+Uii3UOEWOW^8H5ll)Rch;TLwMUQ;4j*B+7V?{BBlSI`brUpYLl`17rTPZ?{+ z-=4PzbqJQxciEz1=nO5gVM=x9eh;svZ6$>b4?=cDA2Gtjg7f?qtZH_I*%2pgO9zJ| zSu5n?HYwK@_235?zf7sOy*#RCbdL1iOJOd!h-qtUV}@F;lzQRaSg+qd%)WbYm~ix8 zx6G<;Ja+o@P`eb3z*&guiV8Jkv!s^(L17~|;xw~qsM1B4!J-bf-iL9rM}AqIZ@c&d zc6`W#xbw{xY}q;Fa{kBTTHigwBR>1hS+aG@P?1|YE~j6)Fi)pyT$VwV5GiugwRam}uKd^9-sY{;hmN3fxmrU%wfu@A z4vdP(k$ViAb=A=2-O-wT;CxqP_GP@tS;zmfb~FL8cP@g{S2j-IcfprA0sb8*`) z3j<+}aBoQ{&god?8y<3GDC+u0BbftR10QcrvZnt83#(Q%^VBWjAiq^-KO=h7xQeh9fEHU(x7Jqmt4 z{0aIP!~8u*n?7nx>$$r8C)+^XdQ5YKosvc8tl(#Ai(JBsJK~W_>T@^vU0Nz1Po5IbO{xXmJ2a#uZXWQR7rl!kz+smXxFk<+C zm6U}Hg_2=|%dJi$hDvEMfQ%$Z!^Ir|%;C{;bGQB;R z=ZRAe9=;4UHb1CQePPWNyY2J!%zwc!PoCU&P9Q_~A$R^%p+LdIT5782LpYIt7QYBt zOlHsSmC@^d@=wt350u+owuS8C@dKtRdF(=3feea>M#Y2w6x^O(1rlgH@*;6zvV9xv;*^e@)5Jgkby9>SY z*68jv6JH}pFv}b?as850X}??=JW|nDAHmPV&2ojzhYu8%-OoAr_n&m*X;qPnOWtp< z^hEbh-8Oq&Yxvbhb_zkiPf>n6hiw@6b-B#Rsi}q&Bena^xjVsy4BmOup9JS!H_ECF z&vgRu3)j3tnY4>nB<#<5?D|JGjUn*{$^97I^#ng~yZAYt)elgUKVgE++vD?C?oz+B zhI{&_2TPlt(iiE7g1Q!!2fsj6C@$>?xR(%o7`BSXyl2Wq;yxf)K|WjY3s(afFK}8v zf-MJB$Bvq=G7;&`Hxb2&d>Mr;J49rh*n2kTx9Qz%JV`5fgR7fF?zdS1YvI`?W2MIS z?jkbrgcA@=4gSEwhI?vjmbuiHF23(B6nqkmu@L6a^}t23A+tM=ymJ>jlAqhRInF5l zW6O`D+20j;W9&tGHm0EyOs#@6808cK@yKA0=%7=sMpl~EDXUU< z&pds{+_AhcP$xW6rfY?VH>LC1@gc7_gnr8Y8acI1g9~p38c`AMdHnb$v!Pq)9D&%y zeaP`~5+rYKf&q89DM$713dQs? zPP?vlW2m>k@>AdNW8;}PIXRW_->Pk&b}Gjd6$AHU_4lrw@kWk@JJ3O&Xiz} zj~bLKL);(Ca`P+r^Z~Hg5offzsxFA;z_TH9s+eY&qW)!}T-bCZ8&JDL$V8&%5BB`N z;A;9Gk6PVNMgW*p)5|zPi1HM3f}kGB6>&S;h6xsAk`1GqRD)y5tTc+r|3(DD2F$`u z432jf<4JGH*+XUczxaXoqMG4n8y6%5v(DHy%SQDsTCkLmLQpkS#o-waqiW}Oy=tX7 z$)jl~v6xr_bs+9GPD?&AJY`_C%b-nK-#>RALM&DIqSqva+~fWy)GB3uYZVn#R8%?q z8@@%&E$g$LIR;n>0Nf&Tg}?Oy;`(H_%UDs@zkWpCm7mS3uglNlO?rOrNOh+%@_7v2`ev(EU3#<8;B3DaT{I-~Oj&ipMcP+A zSRYExCMJodDY5p_IRe=x#wd)fR$)zwrGseuSa2{iXx-&cIf}$bAisLp%fpFTy)=7K z?-K|6yN{je+Vx%*Zb)*X>T$5v5cz}u31o}gfh$HGYzF#6@ASs0_PEQeAi!ee4 z!689-H$R>({>O)MmB>%-W&LP{=E6OBXUP5FUj=b~r{(=o9J}O&Mg4lUCT#CmFbc*7;u(JAA$^NY$hA2-wgBgN4zrYs zP^9vQgUu9;26WSzi5pbXTc59^Hc7sj(?ywgfE-*%RmgdbFgd=BA|u=Q-Xh+cNRGln zXE7uhwo3vPZuao?_ZLxy6`wkHIt^;Y{vu0>PyRi+@OR;X%t~mCKqPWo{(fm}#fHTQ zDagqsY$B(GBC`nyUh-E?pGn^i=t#>9d1gtn`;=8wBf}RZH(jw#sUt@gCl$^LkSlf` z@HG!(lK8}MVPEQ%gKa^j)BgNiBa$57B)RBcZ4NfGhbpUgkeL`V zCSy3jDy`I?dqnIFLFJ&!d^qW1SlDi{^!P2e;>QOZtudx~C4I3Ar=r4yB2HjktmDzV zgum3YoK`WL*63gIVN_)BeHJ0A01ky4e+Hg>__w^}mk4YW!BjY$s58HKJZlE;g{yvY zWkJEG=7`8h5mCZ@_*kcL}AsKnMQ}w7V_vFZ5;CyxKfy4q#58 z$a4?QlxdpO|A_0ko~BK~=n`@I5Y~qDts-aubc71R1aCfIrhC}~d9LIEi-8A&_?LPG z+?VBK_pD&VgA-Q@(7ccCwo!0WGydfZyw#A@;PV~}TT<{Y-}6ajgFtlECWIx(r2{Y9 z2KK*q?Gw;S$-BjEUQ_84Ko7NiPE85v7Hd=d;t{MH@9W`|+?>8fy`pu6LpU5WR)H0p z&~hm{Y*Q8?;%9L0Vm7$i=dsRF>8nF(bP4|6E%GZ-#S@y8^f5XHCH9RIzhy>?S_pr9 zQM|F7sD~k6w-m`9C5ua3N~2pPkDfmL82OVz={N^Cp=Hg+JfweMnI@i zZ5M40e6#<<+E6$LrtkjYY!c8u--xN-$Z>4^{M0YWB>NY%Spt+6TnlP?u5j1%wk1O+TUiueGyB{;b(;i*lv15!)QsGLeA#2*?k+BMeHIQ` z$27lF*Q>@_(qY2An2GTv2;GFJZWrwErg9&}eV@~=A;A%Eg9#U59|9XFSlZJg0hD^( z%33kTq_>WrB*lE3yy(%Y2U%mc@F#LSWol|qvCmG)y}zO`+T{H8+>qksnLeyYeG?qmLXn8}din71Ui zr4VmHXc1g)Xu^9>4tO+5yyT2;Emxxl6w5((+r@tQ*1IHDPxZw}6f7c*hX$KN&9qZN zcU8a{5kV?~A~6y+csm(Wr~;u{JLItN&AGl^_U(GpHcNUxB#TIw6Pee1W+p@{x%54a zhv*~i5vL)OEh5^0tRzZ7UfU{E@)1}n?D(;M?w!G>o|0hKHLGRgErbz37D7{l`jsgq zIh1W!ZVECM{gvP)z-yl}Et*)quOCWXn~=#$GG@JJUbz0Ww;xz=t=sqFNpPT$V5vH3 zuy4#F+%DeUbO%Oz-jEQw(Hieu`2lsIdz%+!zU$rQld-IvP_mUkO!T*0uFq+wG3DLF z&G{*J4HWI|o~gmZ=MtNhQm;Q)dv5(2G6PY^i}?%tErlz8lh|1)FiDb6M7kw22M99A zAYS>{w%0y6vF3!et5eXc{ayPhTzga`w;OsynD!v>7!s`^9XM+p4U?EYbLzT`Yg5q4 zqqcuvt09q_Ehd(*XcnR_-V8=L#Uwjt;mFe5HRty0AUZLd`UKSw&<@Sa+2XUM3fz{ z0Id+Rci+xU79n92RCd3nW$;rSB(<)l;MbW8hKm8G1h%8FN!uG$c6_H)^@Pb5BJ7up@_+OLq_;X#) zJr~hs^zq_uBfC-9SwEF0kQOI)YMR&Kr>b@~oK7X`gAiu37|}ytTK`H2$VU&YKbw&E0^U`V<8K zNCp#;%PFaq&;6b_h@pd3%%_W2BfcHB^<^8Ai1i-EpvFY=DXlAZc5AqzKWkT$9Q4(L z@+I_3Y}P*mk32Miqkw`wm|k4BW%Spaegf@iQ-;U-%=im6{6diOz~UIC z)5`_{Y6USg$4V7{>?Mv(saS)n4A*-#_$@Zh^6##yt9xFg%mM;gbh+C>MN&mu z8wywM++&ly1EIOQ5m5}2QR~RgU6uMQB zAjrPJq~r|!m#M;G<-PgNhX1H1%>QQX>}C|+j~XY5?Cw@{Ka$DK7wTn&)&dQcf_B)F zGb$T4a#zD0ec+zxxP)rKeq)wen{Ms!L=EF|!9UU1N>F4RT zw*gJQ1&07|trKMf&^RaRtM)mY~m{t|M8oC8dz@UleA1%xh%Z2_z@$psF+|P_=hw zEeX5ozqGRUS_OSZOrgJFn6ILqh>fF9Y^I+^PA6F>--x<7X!K|*I zknSQ00YN=XlN%-V{%`lQrQfTYixARX37Yt6cKu+~J-CDD|4yyTmJ7=Qw&rFhka+z2 z6HO>DA(&sjeS4_5ZWW$AeBs3O{c5?pQRnr3Ov<@muQlR0jm2;-OCdu$0n)ex2$E=VdXHF4DU32$MfohCfRq2(+&_utXj` zBI8-#yy_j{H{ZB+bxY#{a0i*uK(z&UDLi10F2LF8F%9TSz zl^mU9MBXOQL(e+Zc5~~7_vjB4m{=3;H~*$nk8XNR-AQUH2kTl!cjNe~9fm>;`2IB# z)!ZKF_=|bpzI_?O(QSQy{4K>JWp(hee7DO@tGll?nBKm8>~o$BUKS#FTtwcnbWY*w zC}c!D*qK!JcnN|<#KEF4`reW= ztuOn%vl#O!uEW>&C~iOBTh^<3>n(_au9|ja1X+~9}YGr`+{CNz+**rsb`D8v)rd1x%8J}OPtQga9vZI zZTK=Jb(KC|x**;HP+Yz|W6Gr6q$^${T&ST%|FSkM@rxhhUKsLRX_S`2$tov2f_4R3 z7XgJC%NVKNJ6q}@+QRrk&LK#psM3`OF4)8fT`zkT9oqkxVaF5pf^>C%f6RzOMOjm` z6LJh>YaGTx)pS9%L)~<=0e!GjHP>yBhAtAt8X8D1uPMN?!b{g6W+RiX5yV+A#{=v) zVS??fU3(dV)&Su6C(fkIoYK}bkLz1awmI1#z@^!n+H0=0VwZmV;`-$&-R(9xup6;m*+z~?#4wc$aVk|#DsG)U-D8$5F3*_51 zzVL17bUFSd)4qXM-db(U|(1TvzWqdp?u8wv9Dixc_D>`*jo18 z4WB;CuWAqb06n4*KlfbW+ZIcpzGeP>O_s|4QLWtnq|-LBhH<5aTy+kLa$c= z4<=+apoL$7o#Mepnfm#;{Xn%E(0Y8~@F7#omsr63M}p#p%J^gWnzx z_7{UV@Wc10GbLlQoTVEp~dG9Kj}JX*07M1FGqg#F~s-KFw5UV^UZZ+|K{DBQy6D<#BmA_fCuLr49c zK6Na{V#1CUdyyzBOKWRGD!$t-iDT*4P%}}G-gUj*F;>%3WfbIsh=lnv{?=9gY+nU%~XRBlNT+EDHo z$^JnzMp1cFo$3xWfBft97cgb`OXkc9>^IHX*-c$lbQfSSLMBX=T0Ef^Z?an>IjKbCrK>WZo_>8$$JM+F5ose7Oh`-W74mcV} zVf(h)ZyaKQHza7FlY-qqAS#X&h(QGJ>US@ktQmohjj?oLwI|?lwzr^DxlStDRF5Kx z!sE|y^oGlwP1U;p`X(uC7sEHl&v2v(7du+gPEnfwr!0TIb9?CwT4tSE?|0RW=)4Y; z)>AT#z8n%(Tu1x~c(B=;9*zlid|L^u1;a{v>V$b`S9dOyFe+};I`P{prGjC<3h#?I zZUkVp+}wEJry@pZDBcCblKA1|LM*tuUY_=C_Uf3+a(zdJ$lh<0j?g@Mi;aDKe|A&MQ&&JhH2h?c z@jWHgsenPsA~ON+)fIpLv{4JOwMF+m%br@}#-eqpSmihUYBLPq&ggPRNWZ>)e{N6> z^G5`sOdX*AY1zdTrN6BQuU+1%6Qtg@R;b-zuu)G}Q*5gde&d81Kv#SGc)31(-0f`U zuljeQwiB6qR^#3jPJ`8;%M}-z>fpf_()YiV4aweW<8TTnG<|(oao!qHVCMPvFeJANzjZQG`}%v08XJky6nfmGYs1dODXYzx`^f@LZS}Df%g{Tp<&pE)WLR1ck9oop#^DLoKdEMNJykVpZMmet(Hk zmPACZQzUL6^yr z(8KlB$>e%vD<&KN3CNWmCwzW^b3%tjJA|keouIeJA&U#>rA4Ph3pZx-$5%)F3uFRM z&AMp$dqMabaeb|hDXM*X7i<;pp+xNXY^tuHuO!qA<%Nz!S%p~!!8zig72?sXwO9EqI|;r zWCgndmuX`#>P~(-&K?qmiWJ9~hL<6KPOuw0Y~JCrI;N~!`@PL`E~~DbCdmqdJrTuF zNzW#5n`Ls9ZV>;pwnFiA6$mF(-Ac{F9G+XqVNgjEa!*yk)dn6NI&sr~{;OBx8XeXVU zpr^r?dd7W#0z{)s%XPb$Kq#S>#7Xd=??-z3>nf_J59+6vjyw{xTxtaf_S>C*+a%s@ zuTN#xYPwaT?%&^y|MWB5-;=2x|8tg*v5PBCPEHP$?wjq1Y?h%~?y@ay`Y#-dI)v$5 zHNYzl5z1KTX5z);+6$?{iOA}gRi(X%-A6QXzbB~WILwI%k-CHhlX3Zd_<5@I6 zY|e>gnTbt#rmcw72v<1SdmAPZK|kjUePB&9g%5~D7_~6xFEBxh`XW8pL&| z9jb*;lgXFhTR9OfUv*DAn}cx(@R9cVVdc9m#V#0?p9DKYiPB2>BKS5yum2!GD46{I zCa{#6d@mXow{6^-iCh@Htl|!sbpfA=GyQVbTZ^k#=ydHK1Sw>0y5`(2~fBxJT>g zq(KEA?k89+Uc9qtgIZj{Q#jt7PtAgq@Eo(1RtlYh5%$_S{+n;9sOg*SS>pJWJ>!m5 z7iai5j^w&OCyyPw$B+u`<4W`@qO1~vXPzaKVGlQMa$5A5tGmTl)7)Y-5zV}R%9h{X zZ>P7n+p`uzN)E9J0HbQn@*dr#oOwB^MXx9+mJiZp@i&m4_#YNj>0Z z!Q?o(oE_)>ZH2-}hqsP4QxVoficXpIx;AIS2D^m|`@O2fpIFRszzr~jIfKYZa>j*< z!qoJsMo9gZ6u`1=Id#J0p9-8yc69G#I0G>_h9(BVB)b&f0=ks)KwAgo#$5&QhXwX{ zC)w_ZJGi6U<^8q~9ciT`X5bxC&*E*FvgqYzCzmmLa0v)h_~PxEzl`17 z+(PCrkv%u@-VG_c*tos#Ga2#}LmLn4!x2ddgLS9WBRi%n&XH4+f|InI*+EvBX{o+c z8P%RsW$#t=D$4EymoB>DoxdvwVf7k}C@MFbE^#iCckn4}hyRbZPA!wnymf0mhsP|L z?>(_D+W(-(wS(SQX`ns?Z~ub#e)!Wy%DFIPwSL{lkWe1yXCLYr?Aqoc7m@tivmh0=7i2o0!M>~ z$W%no0`jn>IbU)I)IH(*-L-E|_EKN%;vqiM?jdv+G862wDgfn_ILeUsmfnkEJ7?@NTmwI|5TUdscfrt0d&XIE`{gvR z2<`DbjW=kp*gR+i;|B0*oK{RA?z55-S{6!G&b=)~aR^PQwD<`QPqcL>hmV+kn(fMF z>3n{{`m_ls1HP}8pFULSN+eK#S#mum`r5)9K6J8Qs3XjFP9+pguvB7<3(iGxku=Lu zAn{UZ*=VR4juIN!KNsbK801TxF>%8lB>gK((>$5W7d|yt6DvB2k#DMoJsu_*6>kHkRKm*h`c zV!ct(d;BiCuV-<2e3yrtq)WFrEtdR-3i&v<9Oiw`D9{VE&MdODR4MX(9;`R{ak#j_dzkF`#1ZYyOEJ~JXtnt&_B6_lTbQ`W`(D+S|`{GnmmUTmvJrp$}Q--=tI0p$PW&8H+*Jlpv)hV~MoH-?`AM8d830pwikMZvqU{2Jx z6LC6XT%a23)jN>lZv1)KV7to15-%T1i42Zj=YVlkG(tWDFWJu4w!rSlh6}kvA1zz{ zIfGdr(XJtFK{rWMLFLDfPdHCR;|$M{@JBd7ypH=HAw6qWC*F^uq9T$JVPcPxL7{qF zqr`z%(k1<~j@izi|CmFHbm-GZza4-2!De%lNC++}w!4tG%Voshb`0wh7LVK7r721n zA^bUfv%`X(QKflxDr(A`>)!@Y{Q54~dC4j~I9Kw*!xKv)5uOUg1(GW|btc;)$2}Q~lwCurd|d4smho zVkLyeUWl?+BULzFvWY{EOAX>+mF>vn4lRtf4=*Ipx0Y2>*(kJhizV1&jFQ=bk^R{K|pY@87_WYG53|6>qyVLzAU2?2Ej9N_i~=(_I_hh?>&bXOa{>t;cOU%oS(cE zx4aonPD2S25$oW^v*$$Yi9bS3&$-1(iItbgh=n>(FdMh2<3UXAA1^tksS8bJJuC;m zw3)b2iG?t3&F`t+GcPEU_ZVxlMn2X>BdLr>!o5JIt`WmnOmvlj5V^i`6a(zo8RigM zFoYBu_(7EGAXI*nJc#>Zec~Qe4&|jbbm#$IOG69L3huRdQHrYBX7gR+fXG{&j-Ct~ zH&NqxO#4sMqu=g5J61@lG8x-YmU;>mwS!?Sk&P-`IWejo#odH592|}3G8*+Ez?SlN zp+69DpcG%v*p7t6t|DaR{>f2;S}f&G1woB-LIJSLlnycI6@wVRKu)AzOhdytS98wbU7nG9$ zA&k0XZA_^zXdG0hOnDdGQqb#&bFF9f`}e3(O$j%T>Dz9^J(}8@l9UOgXZJz;ZyXbK zkOt?*(Fr$Bn&+L}9{MUGg`LWk#Ih2aUnC>pf5m_Yx;XNOWCksxqZ45ueES5CfDlx&A76<>D zwm*j_yeor?y7{IC|LGUPf&j_>RKm_<*N72su3Xh8^=1AN#*5Avd^M`PkHqHu`SWMh zF8t0;8_ZmWz6VG<3w)7=g-5_vVXUda^O$PbWqbDPxZ2jifMLseMOK7lLjeZ1m^ zP3*$r{wO3W{5_M+5-#v_XrWtPL3RG;GMrA$Tmqiy$jvq~v9!c{`B? z7CG)!KR@mN{y3|ZJ@+|LchM#WSmVYllbx(7afHAl3JeQ};|0Ipk;coJ$pM0sG6$Ff zF$UPGbKe6Pf)rzeZ!>6}#aMMWouH$)14ObDceLW%R=Jgl9by~%rH2!_m$+voBVJ|#@uNFAmijVKP{0AFOM8GNBTC!w` z(#~JSrSMQI8B}CSVHfh2@?E&%E#U@NFj!AgC?&C&M->eR-PPdHqvuW>@oemhi&y?| z0y*GEArxj)OfTei@7`S>*GCb>1iPRWqW6N6OsaS&#}9}v*cy1n=tSy zD_gSR9ab1BOv~`$ZorM_5)uSvw}QS~Tn|(Ow~H=S{4)UBlbV`p{CMquCWWt$yk9dJ zuz;z(*dY?a<3|MK;U{aY>5-b2HB6tEf3B%9BKQJ@jeWA4F9wW^9nmOq1B;B&2_HA1 zWWqE2cz(Wl#HIr=F~e{qr_$xl6DR;)gc5fP3T&VCY}{-d`Emmz=F0J{L`ewQ3@I$A z_(SnQ5#lQ$kr16U9rc3db=Q}ge6sglI66-2LXJQ- z{UL{1B@0;mIorjafvg8&&1Q>=A2f%*T+q?Ip35SaF#&9!xT&fOraIM7*+L-;Rya)9 z+R|clx%5+EacwZm)^JPQxDD&qcYhS)e*EsEC8K)pee07T)*_znLP%fXNYTD`-@ZI* zE4(NLi_2{-`eUqi+H>sc{8gas8NNJMS3;%F21+%qrBgJNlunCddf=BZ3{kuG>szZP zUDUpWw?1epOiIF&PDiVR@yymQ_81ymw<~<`)#$fU*gwxeoHN?xgQVS6ao&Et(HbdxYPG0kg%x#w7mPU?pW%irHTwZ+cC!F62J za*gtbMD^j0om7*pV$zb(;n~G`pQhiaV;|FucKG`vbL!r@H<+`+0t(-K0eO+cBa(0M zh4qa{+CR|a0OE$%_ixo>$Vz>>f`` zvON?}d3((-d9ms?Y~8wUoMd;69EoxHhOcjJ0us;4&Q`~monA_7aoRKNO_B&zhR+M{ zbmQjD6BLRp0mGw%mT(G#-#+*#E6dF9@vIed!-A9yr6 z)txBO7y?p8z3&`7B4dG*PbIf5ZlJ`m_orQ}dIDtGr+WB zK>7kdz>3OmJx%20r!GJuc*%U_(jzMH7X^G#(?L>UhJ+5(KWRNkAH!Tuq?)?4p>t9b# zumJidnM`ZX{aTG1S44T=JIl?xGy=G~hfQ74G#XG|7sM@A?04^SkcPJC|25u{pj@F6jAUNNm@of3#eK-ufNRm zc0MD{jCT35Hrk(R*^5jO46AFYticQAwlAg`$0!new|o(V&U_|1;~5nATm@{D(OW*x z58m<3go2{ot3y%TWbtbY$DGt!^n`JS$27C!ej&E+f*2EJivR1+}8_XYnW8JdxkfjXw@PKh9JsBH_u!-+`lc3YLV5 zo4tMEoXLdtRh74Qft>20$OvSyb<<*OLXzCmn`&#+a>b@R~%_AtVco~wemJSkML#YbP)+I zl-|-EJNj*yg1*bncMggwueP7LTyV5|)2Rme5}P}m}|=XsI(b_M5yf~ayMsnXc?K?n||M8Xy}uZG~~hM}*~BGBYE zJQ)_pu%hLf;S=O1d^i3PZ!CL~6LrtMoMoP?BkIT1|5XY~QPp@*HB0~G?}5!hzi0s` zZvQ@<7Os*)bclwAxWzb)1`6JodZP5bMU7kyO`E=RFEgxU`ve$&Y1LFF7CUW$36@OF@*!^P6s#K>LwFf+Lk!Sy z6XBmIF{Rko6evR11_`)=TZ<3X05up+8S&Gipr|kET}oX;L}fgVA(Y|77~SBlme0oy z%-{Nk`ZLpo7iZrrHq;zOMu|<9+d3fj*}q)^nyeNXcW^>xMYnxj=68&hCfTbJcQH>9 zl@|8+_lk@Ak@UcID7-#u3gaU)S{`L&jHVml1aQJ5 zkh>cj{~f>$2M$H}Lgrw9-DUYxM(vWhWxQa+`2Fi%F7tXkE?autEOc^*$WGgzf)6`gz6}woI?xP{k4s(IBY~_rU%<$P2|Ei9-;8+haAsFH zY-+z%UA=Z)yz&y`tdFzbK*@x6%Ln7|y|+Y(;TZOt_}ci;2;sh-M^hPA5mi@HzDPN1 z4&m|Lg(ljDl|SoNk@RS;X>nM>iI5A~U0}NW5sB_E-qZZ@d*CF(Km~=T#OI;}KW3eX zp%TG7Y%&p%!~b>+n2Tog0lm$Y@mpQp+)8IZ`mxG5->GX|`SacGc?+fo>Q@=~0&f#) z>a7h$Lh$WuMhn2uqO-Qz@y?i?Lir^AD3Fl-qD6)mvkw1? zzZo~nH=POq{aH_#0nUmsXP&9tv-@_Y)=g)wnq0qr3)gw?p+{$1UZQo)x7zr}8kD}T z$@C9-&krY6Ml&|?ZqAcC+C>Egw_jxFcM3H=a}o_-#aXIk9YvSgO=uo`u3mM2n5Oki z&DAdaVGNGE6UW=NL%+s(=(lm=rikj!T|4S?J-kWXF07Qg;w7{*BO66OD_(L5yGB^1 z^Z(j0+c~C*uOWs*4P_Je@9zl8fK$QWa)7T&0lFZmudrDD?n3!0o;gXu_kjhW8aa!? zUmHY50fZ&jJy>CyV`-^VwIHB*saL2cWP}(r9X{(hHeYDX4X}IyOB=oFS#R+747;&Z zSHhLgd(WPXaRQ2Gzz@^E2JE8z2%jNId0h{sR46}1WY4v9Ho(=q**x;h#hfDLG|)6t zDbWjF*IqjM=;--jh=syOuido#%e7IbT9bQh%ADo7X@2BO*#$$X7rBYKMmf2Nj`?Wc zc=18kSBDHYbxcg!boa#zP8AR0&usz4I0kEa#$n|};Mb_-kGjN|b~gSM(e=}^;EZ># z`o5wqw^AuNVC6H!#BAI{a>@i{CA?i>sX97)pXDibbe6h>Ah?|8*1hlv<&>xc$#L{u z^Q@&-j4rwqX~X{+Z`(G}Vr)02YZ05M%v|^ zRFX8rGwqeq>zPmUYTROhszTJHe?{?5xslel<_{Cvx2RPU_95>~Zrc zCah4A&PfBIP{1flAkSD#fgk(&fxd^Dkjm-0|O$b+3QXDC4 zB2Oup9G`QpCCLlw&Z}7Ov|E1lW<=c@2gy8(0F3%O^LE89rYfF4F#rI8?<|}Hg>49> zrfBy4Sthgoj`^e~M;$5*_niDLLxgGCIaK#HGwkVKIQBCv%L+ zt3kBLp}uch#nCI3Q&W=>OU>|qTSVo>a?dBM>V{zw5CnfZ(aqbR`-HW9OVtJ$%e($*vcV8rl-eZ+Dv8fZt$18qg$;i3r1Oo$lNj%Qq6 z;rz|LJKI<~FraOqOm0@?P6*qv)HVd#^7}8IJ$nZsPwe=|B_cL8O~E@A7*r^ z<3iPDgVn1|TwfI3O#KVqp6ruz&sqLv%a(%pDnjV z?eXCSf%9K2MgOOh;?{O3Mjx^dvP$?g2_BUeCZH>N+}y~h-eGqpMJ>N(vvYoOVq(kj z9Ge+~B)yC!C$CAkFO-82m0kb&=PkM)bA}T^tf#m-U_TMzh(%(x$_6xN%(G8{8NXN& z_=4k$C;_UTC-VWEyqU4}UuZ@z|2fRJnKHlZyl_{-977oUkc9>N51fs2KBI4{`YCd- zrTLamv3n z!ehCM7<(8dr=2*&R@SIOmT=oSe|ep-eH15X7V}56`GwISUPp7OqeYh-}r@w)s-ncSedw(~I(64$uHg4GCw2Z-!vEaQ_yjHND!+`LSW^iV40P)q?b-6F1&L$*^nNp6wlF7H@3O~LUK4z6E(ORgX(MTo#(T6=u?Yl(O zrf^n^&CD*m%->3*S~UIZ7NDMoS3CUgzaOxM0*iI^`T{Bx<~7WzKR)01{rh{-Youck zv*lg*$_c{84x~Tt;H>G>`%>~SNG0~ObN38NbR Dde-Ea^*!^ zPHE`{_wED5dkQ4-f29LU1AO$f%^2$oEjHtNVm9`jsi-^&n_^GomrwC!IPmWynt|8B zg3gUKj|B&mu>C!af3K9jvffC_0=F$DEH)s#Y{o2nmjY zw0Jlo^j^Ci#-YVtUGBq>O!>Nes=(knr8ulu@MGtFXJrI> z5PI|%n{|Ph;vNV^G4Vl+ln|;Jw-z#lAh(vT`{*C}LoU6mtkmN6i2%;;yhGn0+B?uF zGz~;kTZq~~58pA{?5d|WzGip%LwD7IF5fdAS4?VNbv>U)#cMI~dQp=(#i>QPUp{+8 z)_-+{KRByw>pvyz{kwOf5zRpoBCb6!Q(|!|C#QVYo|j^6B_X`amtLvp^HY? zGwy^_!+PofQMIuGeEYrw{uvXJ&DP4#ZxEl4V7kl2CHLBjvB&g`owo|fL1X@EWFJD& z9v>gSCCB2%3i(wxlm_x`Oz^k`o5dM| zU2$&ytWe>=I%kgWN3P8WF7+FICtRT)O+TSI+G=HJ{Y&ncm&J6 zb!%D8i_jdi&5?3IbxpECHAQ@2ir)l{tvh=%S;r8{Ei@cL0{PWmCsRVyE}|Pk6K_SG zXi@$xY%qE5Q^@AWt`^OlDdD%_+S1Vbo@9DyEY)u_B8pV@o;?>1ULs7~*%5m6b4THD zx{FgEVHP;C@zOs3?QIsN0dk`!7Rk|{({u9>$dAUE*eft_4ucUP^p`|~oCnP76!Q+5 zLM}sF;_H_$DEo}AsxgwlXj)8$3{o@5n{`vfAivn=iDj(7j6&pdb+aHgxy=yzLSO!& za>aOw%emE7jS?|qxMl`_jz4+j&D@8O2GH3huMI?L^MDu1c01OH9_FdS6?7(OYcLlf z5GT)82z7)OdLN8DBWHsIZ9MOXptixg+5iZg6)z!kc~_F(>=dwg%(BsN$79{h*rbSs z(evlmOW!hO;cYmXa!$cV$zSxyHtP;g>KjcVd*qI{)#p8yT{Aii_vw3c60Cx7VH8BZ zuy8|bx)~wQyJkGEHnG8)cE;fz#-Ym@cYb=HQ}-W88h#Ll55;s_N17BmWl?)(DS~jw1DpFe*--Kn(n^uH}#&fqd8 zsp#yM+ISX*O_2z7n&fIgu^ZDxBST(8&b1^Fd@!r&)dq-5Q5pjXZNIkS*fSLbl;~7H z>6R1SYuXp0kw-=3N8@cjzvix)zWv<-L7kFY7IZp|%IuXVK=v_txmM{Prq;IEY_hO` zesaw9$d5m^dnYOgzkGT9-_K%KHeQGg8ZdBRVN$)n?#Z1<30Yrttd)%7P@UrrGWcHh z=lAMYLvwaj!+Mb*1}LALcj+R;tVnCV@~h!{*tH!Q-!1l%6&8xx{G2a%WwnyVGn8`9 zZ&_T{Po@C-brVyo*x7aieq8OIUT|-f^o9W4w)WEV!pGR^V?#vb5k7e!cZi~Zi1opv zvnIlS;45|v^;s{b0oNTkOs538QEt+t;}EbA%&8abCMoS0B?2vRi76i*?h*R4N4m~% z3u2!eUkG%=62WTIze#uQOr=`?)z(G|&op))QDlrt)WV{2bA3_nAXMgDI)%&UUm6Y* z9mzjL7I!^Wo~hWy2aAI2n) z%S3p0c2*VZLGYEiKdip)N#nEP;s9I`U*55|ppbbE*q`Y9O)>4~i(f<9it2Hf+U4wg zbj)`|>|W2Fr1a0QtzZc2BtyfLu?yg`;88i8teF*4a?JDLr4*5UWHT^k{m>ar{?G%* z7Dcxl81FOdCe=LMZrVV!O8EDJFhGlD+;I*8Y*gKBd&kpZA&H5`+R5jb*fz2F6IuLV z&)pfD`ajRSw~fc$d2-#C1kEm4 zpV{-De}udg-mE-LQc^NvmAmUGpOrF(uQgbr1g8pfwO~nr%$!jG8Zb}?L%C&2of!7G zfB*jG_^qGiY{vf3T(9uy$()0{wb`?UMIhqml8f&%3Jd+XTWe+p)0=j`5Y7(X3l}cL z$*OQkg$IV{i__0WlLA30q+`|9MwOifABAiMe}+b@A18**8A_o5wNe~$4)3D6Gs>4Z zX4(Djh7Otfa+^fzT_b1H?t%E5GZfOrN_jH1+%b)%u9|;1J2PR*m!2xIxbSsPaBu@} zSFFz=sYhcjfu0NA-vU3gOoO9qStGZ5_npU`H$2z2m8EkaGrfVHxjp%{J;b=w0*tr{u)6;c2 z>T-Vq)DPw$ggRsNeQz(k-Pbaq@YNze-$kJdr$0`- zAx2;jO-ej`;?rboFLM#iBc?&vrJ7!OUkA(ta`d`rRItD@NXc*g&FoocoAnMz7sn|z z%EvB~f%Ah3Qem_LeMrKcJ0)iVC#tN=h>17pM*Bn`w0S-X9}9c&+7(DN|Rzi{yB8PZdv@F+duBxmY+g^%dj_@M3P(b6fGn}z*>FOL>z6QyzoBm8(zG6qUTI7-4 z@3w-j530L|x?q=ft?>dbaL7(lv$9SwPJ}K}p&**Jnen~Jj0kIMAJ#5CJ;5fVR=TBl zbaCk~+3@Ap7@r4u9OkPz1s3Jad9{rg0!du;u21xxt>yLL*WjY7GA0rs-m!O-Ld#FBrj=oDWZb8xNCgp;4Orv1Yu+5M-j*}XwDMrk=|c-fn@{3{YLGiF!; zY~Q)__R*N-&YDh_JA{o^X5wXhsc%T2(J+$GTh6h~n*?tvPyDMrfX;}a#pJknf>Oyq zWQrnj`9ZD_#8iwzx=ta&3`O=sb30%&h+p`%!`V}13aJ+4iYT$+-Uul4B-eY}W>Ydb zH`N^p3JU6fVR?^=daX%*5SgyU)(^cr)xK-K&(z^`$f*D3j&HNKPYQKS{VVe<)HG#S zNVo%i+uZ||QUXVlZ?^te#!t2Ffp<=AIij>Iybf0$&Su`V+U`o$R}?P{qzqyA^nwkJ z3>`qOoSkCcUP73db9)Eqoogrh%HSyUG$&q$&%v;X-w(q%8!gy$I<&_;LY7}9sINnp zA@-w)CM$GI00F-DL>0%HerT8Y@kKXo%pA$W#tfTSS^8@4?n^1X4^atFDNb+%91!eb zk`>c`!6J<%sgvx*#6k7})5Z_*E zt9@rKlB1Yf{J$0~U3&6I;G)pWU|}&KEy|c5U(6?&-PMLi5iNZj9`NdXI#MHS>9{Xn zzm_w@Rf))rO+4Ma*L3=y7Qjy&c`oeX%B5>hekBTYvhvYqm+c{g>%!ksFba6viM_Rk z3wvBbCcu#>-ErB%^o`-U(mZ~w5dmfcRRi_!)(7YWg@%L(6(CezY8L7?Sj~>YlMc_b zvZ6k&ke@hlBeG`k1+;B@4;bKqNYwuFy#*WXyH5PR&yUN&v)c%X!e?EsXhc{NJvHb- z&6T>ssNd$>)XRmnBo?n#uA`h(Z%b&8ie8xWTUFb81<{-txMSMm&shu>oDohRs!EP+ zzkZ1^E}`LJ%tuIAg^p4TsJOqatV|O|!4O&Q2P;t`jTMvLEHFT=%_7qPnnvz#YNl?LX0)?Re-AhVZ2UvX-((iuh>gz1_J^>jy6}Ks3 zQuV9oQ54>Nl%GJgpujw1SRc}eZ1fbT4x5GH15&Dc7W<~Wh$I{;QfN%|K8 z+F0jKhkv?Rn>;e^Ts?#umNcG!&`jB`XXtWE^DM(gh2*Ib{u zi90?nI%S<(CTV{z-6OmgiY50Aw{9HW&kAH3J*iygFO7};EmlWlhG0*H)YOv{4@TJzhxl`Hk;F? zu3z6R6if?GZJU#m1%)Qvv3`(Oe9j_VX^~OBXEx*`CQf2q1u0kP?BhANQ(86I zX-C{H*CQGQ_wTk(omKQzlQLyt{}QZLAwZx8H%vQ6<4DlvVwWFqOnBr2=)~w8e+j(k zca}w!GsMt7i%%*R48gRPS5!O^6KdF&V({yylt#mhvjRCdbVz0@vSy+ijxC)}iPx%aa|Ms#v$ z#!KaOoc)`vtf$VNHLUfg_wWt$5kR&_Z%t|zpADK}5ELx)3}WHD_w$bwD4=!5XHhU6 zfet@;?p!)<`a;MqsP?RW){*D7%sBq|%+Z%g2?m zPJv_CK&|#G6mZ^KS;$3D_6QWh!@%fF4$=YzWj_F}GnU%}a3v7=_WO}tb z+0w5Uq>8)4XC$^l+e`xF9`Xo<0G5hQbl${JHeI{kbS<_IErOUpf+_Snr_#weAHnJ3 zM4`P9&Ud{q-k=J$zkcKBAf0#pt-@V|rVv(?`sJa@YyYyiLkABEn&Z5>%k9S#u7}nu z`IX%3eel6L?=9cxwiuot;?h{N5JwF@vmzArc(f**q$7*l5bKMhX!118>Ay)xvEuwI zU`t?R0#=R90fo_rTYmhwx##B&P@I4ZVmwMtt|OzI8(+!}84~&K*p^8t2HUqs=cfcu z;!dL68_;z@1(|Ic&1~ENXSlUgkL9BO)1yadc=#gioeQ4Jtt)SBIUuk8b@3a zYk5f2@vrZ>j%}G8&^I71PdnskGNZov`El7fOO=f~r&munl@41!bLPx9%eu^uGtQ(g z|*REbU4?xe2~+1aPhPHxEA8xV7?JaXHHDHr25 z?<=}m{$%^69>$lSWju*w>Brh9w3)_DoCs?PO?)UO#y(IlwK&c?P1s%1 zwZcaeEyVOC>W%%NF*lG)#0(Mf9#xVy6gKF0%Yeah$!1FsAv-4zg(fZDvtnkfgkZd$2;v5K&|~+HISk9Wkc1$ZU7nbR3}CLZf}dHC z3wZw3s!#bnQ%m`FyIrOrtPxj=mQM@GafzaqZyrkSV#Ee|fd-rP=odd*TUoX;NF*v0 znnGR=UG{KNz;p}!$kIEM6M`xSsfcL^F(nG@2&}Y6Nqb_bI!T~!*Ks-OI?eP$9WRc_ zzIkoPn;my#U0hl>cU`VzF?@08@^YRRIuEd3qrsHt8>jJnMYSS)TWLP6|HHTp`}(~9 z(-W9)|3k7DW8*?&z+)3)<292kun!eQ$?vw-_wV0tC=Xh+c(L4w5&IzyRppoSfnd+Y zvYWqhGI|ji5-l1mU7ih-uJkCs;>~27Z!lfj3*uc#_kD|6f7J3zaAEO}I}-0T z$Mf_;RpNCV` z%V}PPf1*ZhY9tV&U(*2z`MdUTBG;ii_4-Xk*=OKDKh*&584mc@*f^}c!>TspTbj!s zJ)t`})Vb=C=3b{2>nEvMUO#N5!u%SRAEJ_zxIJ{ZlLUmw<(@%FNv*bxXC3VA(Lc?9 z)#vsh|AG@xpw#BGt7Bq2;RG4_3HKe4so{$d>z*zyE(7wc=Yt?eiSma z5e44^r+^iBs$8?X02w z+g)ZnY7U?xXTLA00#1!mWTkyx|C6lX5~FJLeqM&@$pCQ_Ha@QDW>8SsCE~`7Fl-U< zOT2#F`cxN<|Hcw7Yq>YPh|Jc#dS{bIE7SJqUH|FU&1&hxRW)Nr{d^koHZ^n4I+P58 z(H6fh_gp={kTfPNL};K{cgnn2VJZqS@^R9O)F1cnYlx6Vz7w-5Q>L8c4P6f!=BPS^ zey_p7T{3&ub>H`9q;s;_Y1!h0=}a43T^X*qdI&A!V^z-9N=t2j?WZFEzw+Op&II3@ z+tbV=(!IK@{O&eT*?1WA0)mjbrkltFA)kPs_AKd6tfQBOT~Sv$B1gZfwCOYxh{-J^fmG|H(8XA1CW5Iz|mWm7Z5OcM3oT5@YxC!nSjZJfCzPVK*l8)7!T%*YycT zDFY`G@31xg*n@Sn){6Sr$lMd|SpS&Hw`owWa_R ziZegFeXH@Gf55vnjxpA7%3PPryT4`rPNv2d3qNXZymq4Ep{`}VnO(eC9zuwzEpnEz zx)30jS@gywad*#?RGNIhnucOul*us?KXqUR*i4~FrMtqNC>`vEl1GZ9T%Y0O1tDSHXFg1<5)syv|JnEY< zF)@RZ^di@=eopiwt>Ru+bV+)|m}kPrnuZirlCr7^HT8Kayx;5>I!rSul?YaSX zevX)TB{!~{&P16WqkOL}a&@kmu-c}Fwv5k*U$?y?3s?s|pe1>^3) zt6S#d)p?tPL%$|VOu^1-?HzD!TJN`9xs=GPTjs9)y18F{jh|lRvpZF_wZ}X?J#TI` zuGs@a_h;pwj`m|)BG=>&qPZJ*uDOp-Z0NCL&xaH`^|N{r!mT=U-oc*zAqzi7B_+8e z_gNt{eXKs_X-;R;5E5fCzQ&RlFre5)Ay#41|C@5*7yO+6wXHfsAzRNb&J!Nay zXV4%d8{PIj9cdRS5CR?DcDMgcR%>Tpd12$O(n;thM=L4y-^ct(z`qOSg*WT__hN-C z`fb`2#rrRIWm1)_(gA(v0^Hs|{k*-NKI+64{a4QKVr7}Ep$adT^p?I{yd_z?@+i}B z99sW6`>hMZA8S4zk(tj}02M*x<+48(XiK%k<&XJ1+<$^0YzwxO$4~aMwrka8109tD z(_4$+OJz>awzszzmLUv4V)wKdg*bgLX4)8Yt(g_9qNX-|&yQ_FqVXXoWcCo4W5>(6U^Xsq349x7oA?VW$`xn}OV@2i!E z22_3;aQN`yi>OYKGZQ*r&?Pc%Ib)M|Fa&sb1~V6>#M7%UEq!%saJ>cqbqSIl#+oP> z26$=a=ESd@4D=oOXaZw1?)6WeWKNkeEe?&mt^pliA(hhfj`Y9SNOsa@qJS85XN}!- z#ehNfW7p9pKBlwvRe}mr>42qZ)GiWC(688fJFG|T`?|V}ySu+L7Wx2@G5>lyh0d9K z3NnpL@i71=Q&tHSrC(tr`3P&x3`|dtW6uQi=vd z9QgGo-l?*DSwZvfKWm#eZuVI`Z(5Pl$is*04!_dVi9RsSE>gX5-SvdqTIw~`(Q$E+ zS7c8_+Mak_8+%3FIL=_9Npq*>P6HS8>ojnqx86S^S}$bWdy_KfM`oMe@ck3}PLs?^ zbKGt!ckWK*^y1__rS(~@L%cNmOL_9osx@n7P1t0{@O~6xhAn)+E~azeZ<`5#2|*2O z1vBce>KIN0bGhG9DXBy(2dbS-vt$L0jFiv=YbN=eCI#O8>nf6uUIKLD);&1T zq4Rc+XXV?Te%dLoppZGiXsp-bX`8ZacN}-xHGHt;x_|abK3sk8TmN%m*H|7F38{&| z!ET;{>B6n*WdVk#>h?=d-@G_V(`WI{(X*3E?DSUBS9CkAWxr0nb|+e%gTb?;Wwqt{ zWCMXBf|3#wJ=9gKV~QLeb{%UthqKtz+GWu0p(nJEOBm2g5-r#hY13cNUo;`w)ro_R zXm(v>=eh52K`ub$98u5Emb+R3P0FM|Vew+*k| z+*M^X+h$y7>N_QmS2Z3B*rGD6>gynnsh8DP(xiy+HTKqCKuIxbhg3m~?4Ulw?0q}< z&2%~YNTW_}bW=MMu)1TPW2x*_x}x?uVLm!Te|B_0Gjws>i&fW%&oW@$zA zK;k^?(}>2LnE3lp2U@!oXPz}IvK#NFS8Fh9nL?VE=zQ=4EGJqKkdvX>0y> zRnPB7QU`iz8mZ6GSQ9NdFQT`dT%TpEj24^aBgHm?%U!R=#H>ICeu0wEHy}W*YKOLZ z%rNDxrLu+6$%j+mSXM%zB{=qZHGRXJ-jDSs;4u?tku@}#{!H+!kqu+}b+ZInKg-PY zeg1JdGaqZ3x-dd}>&%U)wJBySJ$O_)M$;or(4Veymi5si#*Wp(FEw~p_y;y25t~Op znvz#kbWLoU>3*Z*$`vbu;m|7!!sBSt)E?@qzwXw?)2mjltfKw7!ouPTjI|?0r8O-Z zxz%!K*+5jn_Cdb=DkrCSrX6P1seYx(MWgH6e*Zr1+h=Y{enG(#%hbbTa}^_h@AXl{ z79%x38|N%ME6%7gBR2*zDk+t;auG*R zxZbkkaXjCcy?B;sfpgw8Pua11Jm>tR~y|w9xoU~VXSePas4j<|7=O67Wtj$NR zI9dmC!(e!?K{?9ze!T0>-&Bo|z(6QG*J=$*M>Vn1$Y^{}))f}b!geP3&3S#t{tET! z`1s;T8YpdPdw+G=^r!C|yf6pHU(iTDF7b3YcC-q{vD)-fRuYuRq7a#3LP|SYtLx>^ z(1lp3?6XU(9>e@StjQw8XoDN}&l)xAQQ}n$W1Br4=Ix)q0fcQFXXQ)T71?)RK|#T? zq51n2jBceqvzs(-+)Ml=LixNKPiwi~V+!F-OG?`N=t)u@%ueZwM;Ma4|26I0dSk4` z`rhlxXPTYEBfG0x&;X#*Pie`I`q1dSDW<3aRarH=lS0khes1CvZnqiS zi8y!XjuEYemvkVa@aWSAu3=%ij9a3w-k6s#OYGWKWD2QM`*!%vRnb@+J9qMaLXaya z04=PMzK%!)LlRx=N-nT;Q}Olu+Q*7|yJrn8`m~c3GoUZqSkFTprs%C;r*uK8gQH{P z$%^2`xv|e$Rb{34qL!|5Q~aK9TBY38eV#u%=-#X@_n0@reIA8hIpdy#3)3`y<>lvJ zyM5aLbHzSw8d94-s5Z!5!~a?zC+-^ns&J|##?q_C&iQ$So9p;Or7|^gaR1I@rM;}c zTFx{d8e@Xm79*Bgv}8#kyMs0i+57A3!BX7qZWA~ngPcCS4#n|S`NDk7^L#T)xOju6 zn{uCEl=^8oY$F^k($iZd*T*}zI*()0z>u-kv(w`jj~RWE&tH3F?1ieh$uN=s7Jq1l z&~RV}XO&Y*Yv2X97E4D5hbq3l03sy)opvua6TPI@kJH`ApKWfgALZBTBt&Fxe7iGA ziD_(ggrd{*R>1MS#xdnaa+9$ugTaL?iB-fLnF+M?Y6k#8Ly;4H$&D`W(699O((K}3 z-s>+E>8tvsPtuf6^*_&sjZZ3ZdnsvuCHGF5wWWX9p4nnyEG^6i7V=by^+^Qw$o?;#T48m0(g%dJY`2lp{iJTwu|bE{Vx8^4|#Z{fc= zXp`IgOD9=v_h!;99JZT_&tz^^tGjh_l=tBS4=$ps$;-*PjQp*Nk6g&{4rkA%ub&@` zQ+j=KEmXpZ;`cNvSBT^5fRg(86iI?|&8_E?azU4{c)( z;qnp<`Qm4#_bU9YHDi~3TN)b|m;U}MPAz)i6-=n|XdCoQsxSAxoSbaR3=18e<<8ED zVzIiZWB#gxlUj##a~BEb#*Ik~HRKe^KTwf9Zsw~;Bz!-+JTNFIit!d0T76&wFF&8- z@g%&g<3|55kvVGrFVhe%V`S;JtM$EmhGm%Ur_A}ji?%p@wC`rpCBzyjfmOhQ&!BY;;#$S

1TJv4d745xltj@yvi8OLt%7H3R6Qh*k-+y~IuUL;;+BQ=Tt`IF_( z2!NG|CFA-X@8tCEe_DWUmQ-ruxVvu6NoDDqW2$i-%4SB+feke^X!chz z3Uu*#^N86G%Wn!llD6`mdzWfyd6NA^@aJQj=vnlhLqb9@n2%T?1lTuW)TsIV4lhEi z@l`~FqIY)6T)4hfIyy%P){spF@*3uYJQ&Z&uiWTmKFG?(W+mbMrTco26n4!Im6K-Z zt>9TaOHWr>Cy@&NojyILEJeoS62(?%SXh&@0!NHOAP%!$uIc=($&F`dK5dFG&Mzs6 zB=gin#JspAeQDJ8^9TjHb!_jEj+u!z0qXG=o_~)XnqJH|J!7n>Vjr(*gb)%R4ZONI5YMu* zR$E$L!=AUFWM@ZSh!ws;kEE9@*_mVtMV!dIKqEUPjL|;;`3g~SUnwXs2;BMFvW2Zv z;T+ZWKSpKLHimQB;gWM`%`_mSs3NYfR+L@^R_E$FJnp}G3zt1uJ+F;GoL>2zH*Se* zP7B0%EV}O(^ZTxha9G7X0m_2dJse*2@zRX+*$q_SO^lH6dFycS)(!H-gOr#OUJ)_`R5Sb=gnC}^weAEr3fpN-PB$*7R> z$=sYvneV{HMFHSWmDR7tXbBZOvBcb zEiKM%Z@bJ9#o7ConK7F)bLgbUB2^>H>G5eXS;SF{}lxm20^vuZZAd2`LlzzYMkm2{Yi6V@1jplBTNmYJ*K|v`%f2_e_w69 zSz=e;sCq7}sJ0T~!&)sm<*~uOj_un~PQedrgZY2}sugE9IFvXRR`dEdpL1D`Op3{Ti&xHcK#Mn#}uV~3HIt*vj`dvEhWnAUQzuwuOBRyt$L zmO&nXYsY}{X_CQN(iM3AKeO?2H5(%331hM`rikE4C7dfSldq`9PcnYaoRmU~Sp|wa zhrjpgB(@+Skd;Z%L-&IrNTAAR8M>^Q`%vE_*BHwtVpKIuL@)3n72&Jl4kk; zDNKxvirlWh;V%bX^>uD6-m*hAkOK6S`Jic%kGge!ZKF*3-U7shNm3%#Mde?T2>_zjx1!2L^74Jy0;ef6~^8 z7muZW{JJZaX^7fNwh=50&Q1ujZ(2Ojk*WaDDk`u{w#Iz$>zGa0!B~EQsKN+sBCc)4 zbC8<#$(Ei9mwHPKZtwZ%5?cOh=1{Yt=Waj^t|jM)ssI`HHQfPegW%+%Z}vLQCTjgN-4G4h=c~ko^mAJy5;ntF!WnITW zcWj#(;o;F)9US3Yan2&vxzS4JPyI$kZY#&|@4-*{qzt<0QKRz7n!Awr?x=hN^@xs- z-Myci6-*OPcmLh-E7SYcK!!pP7{p^3F$a%T-T&&gp(Xo~q*akq3z=7l4$hl_n@C4Eba}G@6xs4V32AcnCeq$XLlzB~D4hv9-TOem+6v5DuAfo=7cj=^XjN(OGqrOUHU#-&C(pk9SO0_PCPsth6!S`z8hn~vgW#zBu zeE%5`b`7v&TXbt778|$3K55&M#8u=)bk^+S;pQabo!`K4dRs5`Q=^tpCf)lUSbr5n z&h%3hxiJ)xI3LPzw9ERwM<|Xdw=@GUY8}bn>9Xwp^8@#8@(<%w z%IP3;_6g~$KXYzb+h-?7K8uL?9ozRcB(5_t7RB_jnLtP&j0Sqr0wRC=xhMSEwPm)p zkzDTFS~qU)1TAuDe6H*P&khAx#O>#zYIX1G)XM%ub>(c z--#<8x#44np0h4u{2`eb(MQu@rfdN>HJ@{gV;|X^Ox45sI2iTscgEIH3AL0;;ES2Z z2Yt=qt0JQYY430bEPc*@l3_LW>NHC zM+hWz)A{?RjT@`LNnXW2jc$#Un6`k|q>8CqIeJyn~%4At^^(2e=$dxCdT`<_&21CrapDDeA}|NR8ARE;$2Kja;k{l8G>22Dmb*I> zF5x-oLo7@u4wH&I{%L2DzS<|nK*s_j<9mDVz-nFxI&tk>Y2f9MLG~C%y;NQE>CK%L zV(ney-apNI8L?SvY8oie2b<6>Qx|Cs^0)-1Hedze5!$D=oz_B}Od?irt(6oN{}ywc zYii1kddsC6zw+2`)AOm)S^Q|qhvwEeFf}_e#^%Xw;e9hqpyc-J$Lz_S*U$X{LL`aX zmfkf2JnFHIjF8e02z=u2CjgeVR<_2*~8BYOOgf-eR!C?|EoOMn-SbO}%xeRZo8KL8JNDf|206`7Otv^jQre z^_1NbTl@*!Qun>}97wl5)q{cwaxMR^%I#^xDg8O`u)!0~?e*;XXv)fE%UJC)&GnP@ z+FVpFH;5V5zMff?x$qv59%(p%);I2Exw_zX8VAc(SwyFNf6q_QCLJg3aS4ZkxkI!( zrjH-k{dR+ILVi)v_*})FKU`1f&3t@(I{v4(ia+t_s~p`<`um5A%t7Q53@bzFyls2! zK363l2~rG->?&fDHMHel!c$!W#@8Sb{^VHvNGU-k$!>PPmToWN;^Uiln~-#f=LCI1 zx=xOfMPMis2ummy@3Mb5=w;zpC|Kz^Zg)eH%Y3QK+gL7^JtO6(p2C`hZKt(7FR;(1 zK}@%OpTLStn#4nMeos{{9Qi45O?_S6;#c2-v=aHtxs`^Sewdh;#G&nTe^j2(B|;=I z()bc_WN6cJuRb=nIx^nyoWcdPyZEa0{ZU7Fboe@5W{SZ0K@;sYQx>|YzW;anICH07 z9W^{2R6AI`N!XrBCww#JHM!K|+t4kEk6;&@{&?Z%LT^*h1F(z_G`%j#8 zos-bT%0cCP-b9%tnpA`P4ZlpRtZLl46hVGL!QU$Ec1|Q-$O;;W z2Gz%wj*~l)wjuDaup!AuH~G%rRIGlv-toAle8i@fT)ELf97Wh4uGohRJ+}WQ=KE(U||BrGgyAad=SYwuEnfj z@u0z7J2Dj-tP+}6OVw#qo>G7QEA_(sI<>5Y`Q>aX8xM#; z+kCq;i}IR(nwoaXcO7rgVfGkluV?km&BnIb_S0VRB!M~*hsifKG2I$Cy90$+-Ae?} zwnLIO?EjHHF7EWXbC$^iK*sbo|K3CnAtcQz1A}LL7vd^_hIY!ocujub{9hOeF;Fly z&n{k+riHcJE^esOW}!y%fwf5Cmclywj+d3GB*{u$FZGDN*g#e7tbW3~&yfWV8B^05 zj6SU^+x~dW$lTmqNBS*S0s9p6Ft%8D7nyr|2XJ4R_|iK!Z6WlNL9>kJ(~Z;&eBqFGsGikbi~0|5$`P}aBbh~x_&g8%U?Sn zFP>I@M+&NYC2*&|*foQqLH@=G&kojra?vaiMI*FjHZ2gkX6;d#>M-qbSYPF1zY@}x zr)lzQO0;UwbAaHtDDp|$S1B=oVye|4rxdZ)YqK)eb(s@H@ht7&0YzVc-ibiUf?q0- zVK3b(m(~S4&o-c+8@1Ta&_3O8$eXjIDmIMDfANRhXT-<0?4BvqH8oocgkK(bohaJm z|7Nh-&ItWEZ4PY}Gg1b}9jSjc;SOg@7?TPiB`SuY@vm#!j^yv!YHcmE)3kj4Xjv($ zMw_L5-$l2SM5jAm$-TxX9BD&<>O?lXDKbKx2Vu|L&~t@ z98Ezofe1RhUefFsaN%QelS1&>jKMdK7(e@_(b6jGb=vj%)P^gS37wO|$9wOZHB>yK zM8^9g7Kt^TA|W=G{b?)Pe*NaYOKhKYhL>}sb~gSPwLY|6(C&)Cfvi?NSh|^qga|Wg zZ)^PC7z5YYp!=3@ekrrsXGuI-W@2)k2y8_iElwh5>c#9<8xh$?-A>GS|FsI#`Lhn;^g(q_r*WdgHDeQ#kECuB6M3?)C~}0om9wM7 zKl^0clS6a#6jrt~~_P!y*aD!<Mp{}5Qzp?_!CieWub)ZN*p{dS$d80Zm zF~hod>qb}P&f3n?B_uR%U5|j6pv>LnuP_B`L##+TNHU%!!qCM5sWtE-}a(Nekhcjd0xog`P# zOXmJw9M)E)#XI$RR4%@Ypt1j+{p^~76!n6Ai~AN#&xhq+yp@`&s+SlhT^F1Q4CigQ z#mJD%d(X<#+yq zOj?{vDS8IdcohO8u$$n{>AAQ$8d{8{|M96PMoT0bZrBw%Z`Ks7ZKb8v4#uO)*RNNK zYpofPSJr^5IWga zhe%-1W21xw_g^%#|NP4OlV|EwvZ*oA(#k3){$8Vkg4ta|!ECY%!t0jSVM~7yDlY_X zHJJMqLXNJ6kzWlT>l@OSsvRa$Y>YL&wK4tVuqaAU{L-Tuu_QGUg!G)f_rzyzDII+h z%-8laYi|LK!YFOI^^LASg8uv*CNS2h3kf{-Sgcl(f4n>9jDq(+o@NZ0fhHA)-jV?r z!C33h{`sNJ+3K-R50^3WEp5NsT2AyhWa&@Pl~&tnlhQi;(G)=uTNg)%D~_5P#s1D| zb-SmFCQ$|pECmw-%ho^-V}4HQeJ$=egfvTdN1EcD;;&*K2F2{5{(Dr{cD>d~K-CCR zt&M4rLNxFZzC&|L_wCQBTw!7oAb0K7t>suVB#+tLW%<0TR|v}JGDNu;e*XE=I<*(X z(y*|w5q{I9>n3d~D^9DKS5HloQ|b$&*r}j)NRn%W_Z7K7Y&o29Y>`UJS>1Ld@JHwN z?Eo5<3|s(GU)Lvx-?(wxYFC=u*iQ=A`peh$jRDXSXB$ws{Bl`A*4av(Z=v<9%Xui-;;f>Ukwu`8&3OWWGl#XW;9 z*7p8;9#(P;%Mg^eFwQnnr=Z4};&X+*%0eJg0bQhs+I;WNDOKBMN)6gJ*zQ~TrM#GM zt*ix+uN>Ec3vg);g_9C=CZyFexjxa(7j;}Jhavn39`^f-XCh|fo~D-XY4_%a`k953 z^YZiZs`#HdmRACm>ne}_c$Kg{7*IJYE;e?Yx_Ze3*Cx>`gPrr-D4D%wrJB>{JUX0z zc>vfKpQbSz6W2@{>~V<`LZj9AV|3q4T8=G&)~^aRDj%SPAtEThxpXZgB(>#uA$>ry zc1~#_c5GZ%U7E7l?;am>e6u|*J7CA*fA&dq5d3-C5T`0ZJtJ#jGh`G1bm7R}*6n8$ zEWT+mCh0G0*>>aVVZCYfCNoq9Ngg-;dG5jK*)`(_c*hsnbQ$6TRF*o^dNgwVVWp;{ zdd_M7OErU+k*TbiOEK%=lW(nU{F7`)+ga8N47wo7gh1U==Q-|Ea@fQP6P5!of;Ktv z=UXPW1<>%NW^1^UX}I2CFXaKS%GvZg%u+=~Mcb1B@=A7tJlJSX8i=T62sVTS2via~ zxL)7g9Yb9ZlH50lW}-ou>*C?PmM&U!RIu|^jK8encT?WWUVZ)A*tOoJEEgF@2dehNZr#jcTVO3j)Io*`7 zv6*dMX6CED+Wv8i*5lt7=$uhAaujNy|MFET&j&*-%HCEF>(hzr+zX~wC;-r?m~oU= za`&yRuhW}?!9b;ww6@1=WFrvmv}@dC=A(#1$YcLhZ7+59iWSqVJUpQ35m+28?rKeh zH8(HcCtaGRZ_ui?4){Q9vmQ-@fyL+aWBf|&R1t;^6V1kF8_mzU?(H){RI zJ<>8VM8}9qL^y)Us8!A>O|N~>u)`s##9-^e3*>)3DcvA|o&$P<1s3PGd+?LItlixs z4O58gtk7LZDy1|`WIu>w_QHXd6!sefPV@m{2p}S20NE^Doc-Ws+{P+_LFTmO&hfG; zd&p6NJtsfGv_J@p(|f<{Co*xf{E1Sdk;C||Xnm2(wPZf2Infny5RW;3hQrMhqU9xT zUT7D8Jt5&$iwljV{wHa05x64=N$90l3JYwvXTv4hOX>{obuz2+l%>CcoQjgtDk;z4 ztb8Hp1cv|>4>7%6 zt*C=|_zhXLjn4p%a8^hO{uVab*(3P0yfyT1T&1UW@y}};1x*IY_Swm$bxa2O0=S#T z;+Sn$KknL4^wzbphot8t*w@xht2s3X9=yFc%(`sq&~aOEjYn}rtX2HmEA4hII(ivf zsCEX$2a)}F^cMxu&VJrotIkX`qjYvexK<;WEegai5(UEJ>eyWU+`^RKjuZu);3uJF zVTHAyW=!d)J5>GUo5SXVxcLQE=e#!#(hRzO%=u{Kw3<7K%>3GF=v->U!dQ@Lc6?6) ze)@#^HAF5bdrO8NTXOvFIXrcCl*(IoZ^osiTk=|7JeiQ7UGqKWcKxDw!wugqbzc8z zr%RN|v`14ScF)XJ6u|9kYQ=!wdpl}~hbJMiO(Rv6Kf{(WGDmh-)Asi|P|dKY#~AU7g0q@KA^_IqUXk-AH# ze;n1bI&Or#-a`nlxSWXMh)sFGM92}ii}BK4qD6<||E8T< zpHrm(Ex`uEj6|ZmSx(vaA2Y7XB?Y`*!zfbJ-~UlIqDP8+#I1OmnnSCYNOVdbq>=5s^V{{H4? zj0911OzB>61yMAJE7#VC%9sAr``I4wdIx7WUuavcwS3}Jr{NFQZA~7?1Z6+19JehIt5=!10dKtrfSM|MLeq7?8|9;kOhgu=J;~0K0b;w@m z)6`jY{oEtOca7mU*FI{#*O0O&>X3v)Cr_OPb5}~P|4>mOHGUntnWa>VhRItDm>liV zH2>U$A^K7Nt}220G@z?RV?}3dpir|;z^}!wxXW?H|D7#~r(8RFWPgP=wAibVSw;U= zcC1+`hV%s$*#G=t-(*xyC2sqrfP;uh#66bz((SBa(24y`r!lUSSzdO=l~Cn1c)Dig zdHWY9pIzYg4zbUe%2^unvW<5Jc*Xj8WUitkz5MGTAq&JK_4V<&49|akuJXR}5fbhH z`}h(PJ})j!p74JjhJ?hFhd_h>^Phbo^Cdd|@BhdR`QO_`8ByI!qTT=gg^uU{9;JkY zw(9@;NhLIL{=eTus$H-D{ehDhnf>p7|KD#x$@zaD)c-wET!{aBFaG}lBwF{|zfHsc g7b_&*RsZRb*L%Xxq49Y=#Bb^>)L(F8-ns+-5BSiP-2eap diff --git a/docs/images/lighthouse-architecture-dark.png b/docs/images/lighthouse-architecture-dark.png new file mode 100644 index 0000000000000000000000000000000000000000..0ed77712c57616d02b73400755841507d70d35ad GIT binary patch literal 273006 zcmbTecU+U%)&@H2C@Q0es)7&HAX8&fGrAz?97_!rB*$%9R40vMXE# zo1ZvyPM$mX_Vm89hpwE^R1;FWBn0279sc&g4)?zoc=wju%-C_a1J!#hc76Z)fhaS^q>nKF_4D_yYK-C?GoKWEe!c7a-*0}m*o8CH zpyx>azW2~6wFkfL*!ksy8e{i0%^zR4fBy_o`}^0+P6_NhvdovJvGD87zlG4)pZ@dx zSzkVUz&zNy@0WMHk>7oGIEvHtf{&-}*Vlf#=M;12nX^9)hxPlK#HlO4TsC_$WLS8Z z!?&|$wlaNQ;@i-_KI0$wj>AWOo)YjonfK7?UoMkA^a0iYgFGB7Y>9nv>;K0rx^C~R zF{oa-=!%*^rUh=ZsIO{Yx-+)&LP2plbw=%zE!2 zaQ?69{`>W_`*!TxRB=z)t@S_+w!`Va&i~E(y?+?!mYJOcmL%;z2 z`5pi|I)8n3$ZWp(mGIZAh7bMY27lLZg0;wAl@CS_|8I$0dbZPO!$mCi=!>i0t~TTS z#|>Zmf`=uK=fb;x*ZZFvfi;%z`{mxnQ{(88s0yQVW7IsP_Ne>5L$jtk=tBQREMJxK zr`1)|S8ISZr5)kFuzw4kcjlo0u=D=!Pce*fTe_MYQ$7FgxABLR?EjPwJl~)5(thL7j#qx)Rd?|8 z^8??m`cA#;Ho|$tFee_LppQr5{1e8^+b*FmB{p1_Fei%0)Gd1duZ`%+5y22p| zz*DN;J2?D!N$j~X`JXRNk`EaWoz4!ylqwSO%J7MUFYR{zo^t5*zMrHw$-P=wHW^6%fKZav@wyXa-tk(qi#VhVX$Dvb~@_3{7g4~n1SCyTzR^De>~Gt z?2^+!YSA*LgQXDH?pQyO=T``4J^N=baH?wOPQe>o|F}VHS0DbEEU>iPhj_n_Fr;MP zhF;s~%=T3*_mZQn)<8FIRucbyAMhdIrdr$ASBC7_NtbKaX&pr=wp&)c zersx~_gD=d?ilNSv?=NAj^aYCzkH7F{M~hL(toOG*VV(dHltUC&0qa8{(rb%U;DCP zUXgF~@NPP0OqI>7sTE5^A0t)?m-1v;lb%2At|?iWv!?_n0$dG>77NFjO_ANBW@D@gT}`W9*PVOHAb5(Mf&g|OL3ul0VY zz9_Q~>D8(+8pBiX=xAgr3+$mcXZOo<{VaB1k-O}6_WE{f9C)+m7m)!Q?z^!RGPu)N zPicN9#YVxs0soQhjraDgU9y4dI57xI*ywzRi|I1{{B7juGbQzx-{S$?5W~5N=0; zxoK7elLpL%1D|0pzF?3^Pn_xR8zzSJ%x~gTT{c>D1rBW$-ENfIT<$LB>0;Q#+}+aD_4U?*pAtMTJEZNfhf_#=2Bd^MDDDozZv zrB*w)Ae&v|#1mdyd|;kk7a=29R+{V?J#hL7dn-D~J4H4yK(h246eDr~)`|#SuLy3t zbxEp_IX2?hUWFDJSzCoU66K&;h2h}>nLQe3$Vh?eVtGUA+GdenE51r~WTOJnqX!Q( zDq$y>-C9eC$CA}SYox)H3Tu5cf}Ctty8ukbjJo8TwY!Q#dOxPR2&xWopJ!vu(d*d* z*Kg+f%U%sR$d%L=0-K)~pHu!-3g6=ywZPqvC9L$QOgCy0Uz#M`-Yke2T24}0(dI*M zj+T#g*ohFeiu7z~P|D(B=3n`V0fAoBF+^bN%cSr)e?Fe8s90n6yx8I(_n_Ih`4ZfS!?GIN@1@fxgk5k_F^t(s+dcoIN z^&j>SPJ@%$b-_~u?oF2ivBTvQgsVshI=mDwAry&aXp?#aM zGGz8K&oZIhRY-V&)xs|RvcyiYf_6q&bbo8?YMGOhgcx()+p!mqkX82!5 zZM@6S$+40*LzNug*2}K6odLfFDn@6!hAoFg=2PEI>!~UKth=n>>&qStA+TF01m@nK zIa(M%ZA#ZvV)Vw&y%AW_&9PEVd0hMl*ae*T^x9lJ+~%s;ropl<&fY-61R;AU$&@hu zcYaQO=hcTJo>h4m^_{Tak3CzZUtPD6HM)OpxM@$>o|*Sqxuu_%L~(!>$*Wl+!*Xyn zBRThr%n9fNxzNE`0r5Fxe_!}+DZr&!n$!A1dzo%JDHU!$?Vohwn=pQ_k}NRPeso;N zl8R-XK5ta24p?G?^h87bQror%3E6kJ>-^8^7@z?J8!M?!(Wd)v{mVdp%^qsC?+k9t z|4x=;P>a0C8(1$wSB=*qf$oSehKfd-p*H0pn!@NU^;!>xNBhy4Kg2Zo(A0EkRHNpU zjPLAJOQ`Vf#15-Py9j9~fBH4@Bl85)fsZ-`85QN2`$J~jlA+X=;(=Qg^IJyHti<5Y zgz^OlDAtND*NNN(FD<)|IJWM9#6rz)n?P<$x&-*vS5A-Ao&|K9A-&3-ZxrNo-R?y8 zl-~%3FjI$X6`)%TGBd2ih58fwlD}?9l?$hwe>Ow9&(*Ll8~c=FkoykZJAdcg&*A{| z{!6yeb?Z*!%VZP2)BwUglabY_{JD*=rk(|+V_*O|Gb)E4M8|rKML}|pw+BqC!Ob>b z1opIDFUuReaZ~7qWCMM*hJrtJqY~`u;Lv|;Ty|us}qVZ zw0GW;7cHb9hqS{4aaWn1zJpAGs+{~8*P!R0KRImX2*OLCwuqj#hB`K#GVdIz+Rqg- zs~sk}#UVqN z{%3my7@*!~#BNeFCP+mn`LfgVV7LySPpgyD;P7I_t$F67%$XjNM!II8DkIx#o}4K% zwJLQQyO8(x$pLL1 zDl$@g*KvS<*DMoNiPo2=kL-H~lWHV=y8CuX z2RFDVEJ$o*5S_<4x0tygl^^u=t? zo(82-)5&}2TuTa)nCcM?I&DOj4MMmZBFCD|%A6l3&Kitx9kfBtz z73{STRWCC_>8?UDWY}B4axx$oqpf^QPX{+FxvVr$BFh~f@zsZ&Jap*H4`D8I9vwt39$4;Y*W2--`<=WYQ-gW=E?iKL<%7Zst`{g&{_HGoX zBq}TqfKzm;Ge$uw?IYFlV(^v0a>6*Zr#>R=^3wY&_yVV@cMfeC@v=d)qvdzjd&=*$ z_LOg=$u-SeKl^(*9#VFCgfs~?K%iGzdurhUzJs)@9NSL0c5cO0+!Z(5#4?Qa<_THY z&0|(&2_mOkjbE>9#cJo#9(q>`5M$kJ51nK^d7YJtEA_AN?;*g zh$=3qfnE^r8K%{EmuKI*D%he65X1$YDx^@_9j9O3?hYC`qMDD#WG9`iU*ym4Nv&X4 zuZ*BBU&Z?bhLU81R#Y76Y%Ag&Pzvv6&N(PVq13X@Vd6w%)fwsgRT~#i74<*PY>kR> z1Ffd>2?RWyv_yHypcr)$P0sH;C^{PXeFg~kB}$Q*JL(K209GlV{IuV+WSj?ng0ep1 zxTU=Wx&f|-!a~;t`t`z|)$qP^s zv;bBWXRj|>@8kMx0NL8MyR1j-Q9pJbUY)%)9{+ap51CQl{WdPcl1|^iDWkJvuYW9m z%AtEfY?aUU1i)hbek)@<+~g8yDPSasJz^6fYLv}+ivp<2CCQ!Ju*etf>WWcAaFWgD z!_rt!d|sqxP;j26pQme;Ugmn&%y08fN|ocy6jYGDd)&HarDdh}d6w1ec?|b~O1gWm zYv5D*RJ{VtNXxyBeG>yF7Q9gq%^a)h^ep8}x96o|(?yoX7AZ3F!Y*43IbdZlB1FAT zS5Cn<8kd)b53q*~nKGVUBghC;3y!Rfv-PAvVMg1r=C%vBoSm#)sjW+@uUoEL)(*p$ zp2419ji-XeJI!Q;3+a_gJqZ~>ua82)Ei7x=ZzX0%a6>A@>xPK(4sFem(=g(2{GyLc z!kK1YA{DB~2l9eSHdhZjH`0L~oiuFY&Rf~UzE zdF==j@Qq0mqe1r95j@lJFwQH|{&VlKUbPbs1=cGq_<|e==HNylZykKwqPH=6ynFzs zp}Kk_5448aMCK=|SAlK|jt6h8^%_d`;;zUEO;wn{K1=qe4#6%g(TOt)LL*J&sD6{6 zS2lA>uCDV$X)|G-5v3$qI1sMYuTstjo4+CQPoykk9D{4ge6l&3^%=6B6rxOTZ1TE& zgfR)ieEj#;Kb?b63}9Cdt(+F*#1kILBSzuVH5xtKLCO+z7NO>ubfFmS-YClwT@O?D5NyD13AJ-v@ESmF6Zc!a*RtN)H0T5wB};F zm8#tJiTk~gcHD`bR{C{tVolt9c*=;Jr&;JtWPfmzrDJ(?J7C3I%=EFgcm$&Z$t7sg zIpikh4l4U|pdt0e?l~j|l`Bu7zLb+YDH*urI}$(bTH9y!o>vfTkb%$(m2e99IG{;G zk@@mgR;*NmUsOZwF1sahgFliFHqDnG*susM3PaD-9(h;$WyvR8H!E`S!LytdzfOYyYnhOJnp53H``Iu$SI+TDG@X)Weu6T>9x ztr1Q{evME5QQEQN8@{;Lg7=j>-wNe;Eb{khs8!5>YXDYLEjiw@`t?|3Ha0rR{@@0$ z##yr+gdF%CA0nb8lxKfTR2pJB^&_ z!rL19cq>;poe3d-nq=#V%%EJka4vzj>Y`3~#MIG8G$izsvF^*rDZ^)UoARY~wvH@K zwW!}`q>9ro7V59N-j0!_1G&ot)inI0jFgnibon+~AUOd;QR8tA2F3UDlHQw}3|U~u zz<-#WJDU;AxTjdP=~WVfRu}*r$PIWL5eSg8W$-X?=-)FF9d@9G3rF6x=7pB&jJkWe zn-Mc7EUpdZW9)Q#?ZF)oeFvX(Oxenm>+ zq)yI$)8v+hhFZ9XL!Pp5e2Ia?aICnq**YG``!5r7&|YU{JUX2%Zuw1iTIm(jK6B1x zM+M39(_0&#QDRAh7dG-Ond1C)|M)Nm6MG^detBc?YS%JC!118Y8-UM-YPI6)Wc5}$ zty;Z(FBaUQ6q#UQ`^%Ey?k78Vtu|S&rVS-z9b3M>h?C_jr~ZE;f&DI8QHFnJa&eTSl*TGzv=S+0Ov#VM4p4HkVY!)2Yu&s&_$3 z6tR2P3En*j)gX9iDVa^+d~n)&A!x0SOHe;z3K^J7pD35eCRd4TU0uN&)`tjeD-+gR zCb;dGopJv0x>sk^PId0I{x?WAzrXD^>iKf5z3H_xq};?P0_j&QOYp1QFFGwd!w}5GB;>@v9@7T!XLl521Tbjid5j+`Mq+Pro@Ouw7;7 z=P^2SDn7b4Prk^4|29|^Cud`3wmISphH<_buoT9T1ei4M{LUOfrUQiR>NtwTCQtQT zIm@3oZBzSsNse3D{=IX_HP9xFvOYHzrJ7C(qUks`b*d)&(BAX*JQL>N?ysUYHPj`T z$oNmkb7GxlH`p~UFI;FBuXmT_r&`DoREi4Q^zGOI>@Qv{+pB2t-HBvwms?3d$jeu2 z*83j2%K?YR2aCACKR@FVc>au|!Pv$4)l&}8#lX$^@6g%{Bmr|BdQw-EL8)z1?xxjbJnh=O-XP+9o|jPG)*aJo`Z;Rqx^2t{e_L@o(Xg9bNO zAi9bBsVFOw*~O)ga3d1sd~c$G&5h^hpto;Z#fzWB{G+d&Mt^Wc7@IOzu#LBWF%2W) z&zWDGnVP{q&1xvYOQXlvpVPs&ml=v%TdMUA?(1Ph&QaRl5{T#2Q&W5wX61%kcSRJl zq34|Bvd!TeE{?MTD3Nvys)kOzpnmTH6vu*(kY;ZP--4~L&llcjEOe@WeyEon+%o{y z&&p&%;Q@3I)S!;Jl-R>c+FSy+O03V2&=7pWL6`?rv5bBz^z(q3%Qe_pkA5>=?`XHc z&rEcm+wa8d-s%-mm7DaAFf6*>G-;U`H58^b(cNT|p>(4+XUo330`CvjhQV@anAWDw zM2WuCC>R*S>;qB>lvp91q~zqv8Sf5}iix&C8&5pko7k%Acc~CWeKppSJ-Bak7eq4d z0^2DC#{0Jo{(j#4U4^cTT~-e_Lu za}Zjn=xr1S%XpKwuoG`N7Se_g`#t3t z*uaJkNWg_OzqN?y7EKbUP9;!3lOBDb#a=x96*DD*W3-;3BoSeuV^_!RFe#st-YL}F zdAsU$by0Uzh%ZNW3!|PvmB^7+RxUNq!7BDh{#+d{w^V!hW!2ui-*3C}(qOSf5lyV# zQ8yLMhC{AUOQi$JsYr?v>}^4tPfmJkq(|)St4S%W2F*5k^gs-=VD9u zllh90F;cc8{mHTxE0{E+y$R)l7??wc00@sq!!?vm&D~QK9iwoP);naS!V0f#f4}&1 z_27Y86nh&G)d(Ki{1gdi+zFs_Sm_rt<~`@)1>i5`uWT$ssD_GLcwZzZ#7{77#QThl z_F#wftxC74#i`P4zB1tql~k>2R0-00c`f4azMhn$g|Md1V9DNEjT12C)g~pwv+Nmz zKIP>)?#JCF{D(p(_O~U+e8U2Q=9+S6%7)_Rb#RVlIXMULo=`J4sv04EYM97wl;^(S z!@{Il4q%OGElpX=nz+>uz9)ecoYM9VlH%zU53Za2Ap0m82RJG!bG1>E{3y?Q=juG% z&Acr#ZoN27q}>5I9+P|Cd~b2slaBaa-NnUW8TOunkVVfBPCKnGhe`n*caCZ+34LX6 zc}r!F(`AaPsakMI~#ySLU-UPqa!#cG|>{IEgv4=#*7n6cq58S#OF?nl4DmxLstCR8bBBVD$FndCfr( zn4q^W?WhwH$D@AuRj|ZKJGT5EX22`-LGTw;Z+M^W%K2&W`srOMR@KQUT7Dn5Z<0b+ zMj!7V0 z9%$083PUA=35M`Ctak+;LjlV&=KI#E201WHg&1lr)*wrcF|%Ag)1P4=0sCC$xB`Xh zNTwL&>KU<6wppPaFjl?$2W-&HHH(lDyMDxIf6S%pa66XeQJDcc>CpM3CuCzwlqqi8`$$Fhj zD)E4iLaz1w8um`>F0{j(_qqsIN9;XM`2*N5|EV|MC$qwMAk)dsJ>U}KdOKU8hVzD>7MU7 zPPlGJi4Zdc_DN-;L}Xi2mAHk9uYzSBq5b!={hfU3vKJ9G7Vc32q?Sdp=umm~Ky$E5 z#m523_{$!C22g1KxDuVZRY9^={A| z8{3DW$q0amnW%TBj*ekl;@)uf-&XV7S^0%%P{^)Xjd87BC523U zQ0nImTla*vN79VUz$uOG9gcRH&n=XLPh<6nJrrgANg=2(*4w9vu(1ZXbt`hNMAni( z;29TYNoP(Xh*C4536@~Ac4oP7fD)`|s}4QgopzXp>b{4meyf+ZOq_6yaDRvy^KG3` z(CW*Z1wh=UN9cm~OQ^=`qq_Xw=c+H=(%4oPb?(QZ3|}lH;v@ugDh3ONi>sAWdl;a0p+*v38Wb;#f;dZ; z212x>H7%U;7n@Qm2F`A>ij4Mc8MiC1k5@DO1KWf3Gh|fCEYGeafZxN$v72@vt{Y~6 zir{Gn5I7bL5PB0Uim@zDQf6+w?U^>gvC3(^{9Et%O}sg8OWM3`V_{Tnr(fa|BU3v+ zV(GJ-24J|~*ryo|uBxzG7nbb%k9D0xi&RwOhyp-t8i#CmWIm9Kr4QDg?8wpw99xDD zeHbUA?pLh5`j;GsZC(OOQ0YRD<5U5*j0N!{9;2u9u%&leOMCL7=N2$j>pW#lc6^2E zdr$kBXI?-cm93|qmOc_a;xleJz`-7O{3!>f?U>mOvy1xpErDWWE4LOi?SxYa?u(`P zD&Obe-S4**!&2lQ*oCh6)8#q13iUG?RX%s$HO>^6$K8e#h>NeTCC4k69i_FrCqaVw_s3xJ^{3Z%a+3?lE~axE}wp()bo;>U|{y1a7a)+vNnifO$hlEzYaG1 zh~2xDt^Wt_y!N^zDnL@H0j7LuaD%>?9U=iqvlnYq9S&R4nVQeepZmZJ6mwxd17K}9 zMhyE(D%<-Dt3`nn zf!I8cwOqN&-jdawlogb4yCvql5q|!PXmO!wlu93c^4*TICWRh&eK3hm(wY0%I`Gzg zy0AS!ygE}c8l4=BCg6Q!bki}$eyTSII=Y#g0d^+uri?lTnhPL?z|E|zau1MUm04Ou zX)sGEw}AB*`i=cd0P@u?U&`KjP@g5#cEEGIl&dljubM|B!`>YJv*Y+w<8mr-;P5r^ zddbQs7u>`3#c(qnx`&ym-t76c@~i1GbI9VMxCE4qiP>v^#}t`M!q`~}plGK@&!5Th z+wxe)*PPSK7-Dn-lEm3!<8cFQUSNsQt^0lVtfwa!dEMzR(Z)c5D&C4oPsHf}C7V#T z^N9wgpw$a5PTF5qS~u^(!|$m-P?Omek{sq>_cF;!aw5Rqj*q9vINVl1(6&kKWV@^i z3T|(YLyx0b=>9JACzlb%=N36Qa>9fqY%7xiZ;E|$S`_1BgG85i!PjZhD0o0<_h7%W zmqu=_e8k_3e#T@gmYf1AI_Qw+u;H+>)N#A)R2icyV@1CXLSMk`*{18{!yVZ^LNK|3Zvs9KWg5KB4!(s(~l5=*e6O0mwkCW7=W`Kfl`Ih945Jy zg6pbs77^pgk=*J+GgqzM(KHRnlP0rK@cJ)GqxM|)%|*b1D4O0eYa%(vDD`2it$GhT zh#`zjz*dsQ)>+A(f%@^q%eCZVkN8%$ary*}le!4_Y)E;Dn@!-HIrRSNNHh=0Wu*u# zZVOESlM1?@>>@D}!K`wvvm#;RMO=}sfO17uqS@C}xfY`K`%j|?*SOQza65SfsnM{x z(NgD^tY>Cc?Qu@&R8w#Mz|>8?;@P2LJ$9pcJ`^VU5*#Nt95W3yOKo8)ku7{|7jF4Z z-SX**VoiAsgBIs@v3_{mu6fAyLhvrfDOon=LZq?i>FST~SKUbH8Gy{8lOKw6M$p-P}a?dWk+3r zI@d!~T!Ien=&C&nFs5@0c%3g4Xf0p+gmucCpz!Mia#k!&u(<|Zy?QpKn9*nsgqkmP|^rmwnT-P#0H#>WFcbbhtVm@_|V1 zv2CO+UVUT;)3q^<12|uei<*wp$b}D$kCKnA+andOuHyih$uL~e_*F^|T+*YhErj8| zdD`_n#Bb7Bv0~{S!G0q?H2PWNh#Q~JB0^RLr;QH>wmx9oIn=fJ3TOyE0Of0xOVQ6g zupN*BBY6|ISN=!UJ4F0&l4=#jYH`tS5(8E+`vi*@tOcK?MO89$9XRY{=K!?Zj9ev~ z6^B|%(q>+NNiQwDx?KnoL;LyzHbVud$tluiM<;^FQ9!~W4!I~aB;nuMqH8(zYWN{5 z#E|G5twOu4IxCWD9wyT-@IDre8FgsujC6w&uKASHXEpHUPH!7wV`X*vS(64QE*>;H zviVeW2wI)mUS)veHHEMr*o5Al>Z%%zMz$9O>v}9QmjrzCc@L)Qxfj>hhdip15QUsb zj#~0z0(ske&w-l+n}+}^C5s5;>4RGU(FK5lfK2I63k~;R-r-7VF@I`HISsa8XaRl* zsgT9K+QK<08(|aVJm~(y8Qd9@; zZWQ{dKbV>}S1AAwG^6WP#jjYU!k0F!F6d7-0p)R%8T)PowEm>TN##U+6}U8iU=Wl{#QeKwLJ%Do~|f@_mR7r$3!V>*L%)wL}$7SNML4S`K`5%i9`w%6}Y-y2s{DWg-W zbh#2*nci0mrsy*NBA@J)K7EH1z(S0lQ}oy3d>rl{JlVWX7tPnGjyepY*!K#B9=_fZ z$d?%@9k}idu$!`5)UdK=4g7~9rY9G!@dAu2ZSKtY zEFnf1VjX~=vK1D1kjampfU(goDW8hVo3WF;J(4{w>_w&yqqV?WjycVx0(lDFcea6fM#Au=^ooZ{N9?LhoU%wGv#LV*G?;*|)XP9?-?c)`(| zRj_G}-Ac7WA^^&%#*jjIbB4bxZ_tMiRCfs3_IQ zf{SeyKzV;@3y9$J6H7N$+4I#I*jg0~q2YrEDp@l{0>Y~`GS$j!1u{n`y_BekK}hk* z)LgP~zdZei*gcQVJ~_VS{0}4v>0^Q&QRJ(;9?@HvCc%8mG^ND&;*K_r9{K`i-B6JR zcfx0+SNQpu5zxfBJ^_EH5@%MV*o!YcS4fMTFsuKD1*Akga&k5y)E);aRNFy?D?_Qu zb};f0kU?Q3n~e08>FOgR6T8H8mLbWejEDn|G4gW^{&_BN22l4*ps}2H^$r zeb-RVc<9Ru?I>n02Ld&04~Kb3GC%RW%+?BvKqNt5o#~0xK>uUyl{6V8pvyZd-+w16 z7t-6Gi2CRR`)8tyIhYnnyT0_~_~Exe{Xeu%a(^$2Z&)$-bcyR5$0elbP?y&CFZxGb zNv<}Blgoq)p5X4EZR)VZ1-;w^NDH`egXP?Le0YsiC_X`9tG^F9wPKzDFe>d*>Kt#j z+m0Q5e{Rp^8n1b46Q!GnwW^{o39MJNEMS-(p?}^120@(N%3j)JG_KFB5f*1Rvc0Ep z>uhCOA3Q~uAsGX~7cCW2=?PurDhU=Rt&eLH)jE`yx`L1t19+sD#8{Xu4nGjbGpdp_ zVCyFzc=^m*Wj%~+K(PJ0eYcLPLR9|pM}^#O^w^5+w2f_=aXD|XYxfg%mlG6$I@~Be z=(MG3U`@CEf&Sil2bJdH!pHp1uh(WF%Lc+3g(v4QZ^aLQ(}Jco6}N;3x+iR&T!p8@ zM$}(2QlJk{HwNG%A#Vm4wnjPDF*=E8;NVds61a&jP$v{<{DaS-x2~E=yogf zgM6YcNMyyq=8Ttc2TDx61FSEUe~nSU@7-;ly^zHz#3SYLCkt)6F4n@Yk3_cLlFy&6 z-EE#=JKtF!$A9izS?TLbF4G$mnk4p>j|c!PaU}c8dT( z#47)B-uoY~!<4iOD~qiPK!!nuHYX_`M**(at_o9`g0O286oznRkXW4I=$9d*t_q)o zqs__+Gnp$yFIRj;VA2!jL`B}sdYc@8xFv@Sm=O99lwB#n@CgX*aFL^2}rqe@j78#TWV`|xq{F1h*1 z#+91>4r3Pa(58U=W~o( zj$^H0a3RKT?TTX6g013Kj*?M$sMjofS-*~f$pLaRvU32DHzRjYRb4MHZ*etre0(v2 z==g|lmRNgY#uj{fdE^md&B4bOTA#SW>GDVLREiTv+`F2w+5M`pU5Lma3L% zZszl5!$v9$@q!e<3GGvrvr z2Lcsyv5-QoLT0bjixBbBnAg`M;5dr<1rBDhipX+F;st$WU-<(Ne#lFY+z9&|$(Iy@ z@IfBAC~8AsFnM4iC?6!AQDf{qnt*}A?%RK6XdVHrB^KwTf#|k_M4is8E&DzxB?Dua z{3MW5iY!AkJQ$G~3~TqH7U=1x^7^`KPNIMV3;pPp3S?I!)_Gv~~lLQx}DOycH;DLXIn*qGZ0CqYpkZAi(yq=L^rQdBjrM@mF zCVud7`CJD4c5SwsSTQxSt|zp?-`sDeR2s!>d~!{js)z8IJUldot0v2wln>o9mehs~&+0vTa-4YlHl4#&$MZ3dt!dM&v=YN) ze7vPt8L^#Z#b?m1YXQZyN7O9v+9$N~J}$PDM=nbbu{sranq8TtoITs@Sz z+pW^gC>Y3)jq5}BIjrVgAVJSJ(qC{1DzqQVTmLP0v}69KeCDXhH%dOh0v10hkFa8P z4ux%MM$xe7jr)ir8GOx4^avM`WojD8O$c=|Q!7fUiArO9VosIQZ2+X4IXn3X{e{@d zqcIRnOw7<4f&*5nhXY_TtYEzKU|^*zAQ>3gXEPtm1=0k$ zoBO4vJ2ZE#nDs6$W0yKG!L@$Nn?OAm>vW!S?AfeD@Rrne!aKq6K05Bo9_rn<)zzP6j4-uikCa1gQ zHrGpGXNxj|O9*nja`%PPXHHPU7Uj;KV0<2(Acu1Nfn___NC_xb9vyE89PfYxDFR~V z4Hd{6Ag>!_>ok>iMqk*>wOCHLB}#Rv@!frG8`b*BdVYpHHy2za|4qe0t-4o-+c7SV zy_D-5wwnsXD?S_9Yy8vr+OzE#F{Qs4WO@#+2;!$`sq8g5t{tu{6|}5PF3PpOL29ct z_S-63smc>5c>jd0FNm7v7{J_!qfmN6i%0)4#lUq!DaIr`D^KWv_+8+qZ#X@g_ z&-l}ZM{#q*%fMO>M3Uw8bs`|g#3Ma|#|(UtM{k1E)u6d3MWv>_q&oPLjw2NSj?Oq@ zM%~Zsqr_*BuiW?9Sk~+S)h*bDUZe7Z)@=ziQ=f5Kx{-*g?cq!&M0~ie$O0eH3J~cN z^ie_5IAQ?)24dh|+@meGYe|u%x9y3xn99p+D_xKLq6Vl4iL8F+*c4Z%PRgA9*?}f+ z=HLn@&WG`l*GRcv1TSGF6@3r0K9hbyXf&~yZzU+)UI72po#hUoe;w5c967RZ%equ7 zMC*tf&}Q@ty%*^G)6@7A)aQ=V^XYsn*+Q-lwFRQZ6CJ-_0s<>(&*$(g*N(y6j-<63 z!B$DnwYjU3x#BR9!mZkfWQwL0o}LfUb~maI!j1(#?pfp>@ae?()CR@ok)?*BxKF-b zEXd1XB{2ZC8%J3|ivl${J(GnffKD+;E;Fz{!pN7sP+Xm&_hALm2TRl&o)zbqTO;dC zh3U0JRJ}#`DW6AK)C`Hp^G4*?Ssyin-rQv+-OHBG+|Fc8#tTLP6)C%MMI(CQegt^4T5YNlhL7%hy^fpHM%BGd} z5Quawl;d}lRrRugD$H-Vd4==v)iM{7VL^M!r${y5eY0XeX(DR@F2(PRja5*IKP)Rx z`b$o%J)9QIAmZl6;3Fm#O%s7^8uI}7>|?8HZ(U9SYSN9)Cb!-C)mS|WNLBSe@mm19 zk<~IJhKBo_t&!p#C*J|Z03dl9Sf+(Y&8;;LE+s(yfc}Cx0Du)QzR;o317lHN)~7%u zX1Ay#6F!`NfwQZ%DmN7qP+{%2C0>6Y*`5-;Z(+WsHF>H;{Qc9*gx9vd<3d5o7juW< zSZZI+u`ma)srfhZ&vrb8-hJ&$)oJfW+?y$>M4)Q5Y{15}1rO4lAlh{dqLfI?!sJP> z@OuJ+w5F;G5|{S%*W;^zwH8Nhjdx~o8lZ2M^jYWZO&xKsmmkv)TDTrGbR`bPWMI8k zfqiDwc|t$YAc|3sG_pQcD1hQxxW@zV$GZM{VEL0*VWDJE`@HVXdo4J;`q(g0RdlhP zC#MPH_Sz4((ZJ^r)|xF4wp>>^!Xh;T9Y67TVK~4mKvMfClB>(T6?r%yecSFhlY@qeh|)Qmd;dAOa)$kaP{i3C=UTFYkvIV=|%1qxoJ7_P^%pz=mS`)|pip^xSs zZ5cv*GD7tl>*Z}21rtw>m@+5D9LW$!VrbLRtD-RafDUYn7B9JI3CC4Sq9z^Eb>sVW z7fV)`Lz2$_vLXN9iI)HFf4}o`cj@g9oUrnP_d)7adu+a80Y@rDV`mIdZUvv-9WBg~ z_oO!gX?N(pHBshrY7orAxnk$kQ#~%-UwDcEIYM_@h=49j|lH`Jz2;8(lfX?9Ri@^J?Qll-zN2EP? zsW={ItCR$klgS{9d+U$jkr^2-I7d%*DNe-z%^U#z-zX@_dOBvnQJIPTAS>x%G^M$@ z-Y0(4z?1Y#J4Hy){->coO5fW%=RcbGPd(YGf^frw;`AP)fdHpAh<1g*mEl*bCH?|}lh_r@IJ|^IX6}OA7S2F-QUIr?9(Q@$2ktG8VTzZN2 zD5qzRxA+_*u`fb4P1Zr(Y?I%&cjV$AI-q9Y@JK#_mBu4I0@D7bp5rLcElcbWaa97E zv!rwM_RU0p0NF6wtn0D`ZdOeXEo(Zdx@n}KtT#Ah+bl7!%bnZ`pV}9+ zfC$y10SZwpOWn?q&L^>PhVuW~jtca>=014%Z_?y{94JtJ^|=G*@=Rf? z(4CB+`L3rkSizZ|>~}L72@CBf=&dlKX|}YOjuLFNz>D0L?X~q4%0{gjK{NvyBkXe( zc$ml%jhurE18pS(1^225e_N{NK|HX?xVDhRy~|VlEEw*L0&Gm>>Qt{@Cqx0EcQ)fD z;q61itDb%B62P95nzoJo92RdwzxfFbweKsvA+sid&c5?*b2QczAUa7qO$|p=){-@8 z8K^UL%Pqvi%aacevpPVWRejt4;!4*UMPCNm(<~Z-!vBG<<1yZ!-|fk6EJ{Ddd~!nD zCFy6I540txA3AjQUuN}Rha9Lq*V#SqaM{;Ut=%VZ8F@Wf&%h-7K75wB*j`XXom&iXUJEd8e6_hQD-kge?XgUxs0#AQNO}?{W}hvv zy9#J-(~X!0EBfrC<jB&{F)6tkF?-?N6PlpUdM%I0iWw#ZLTYKASJ_#o{;1WFY^lwv#oD`N@R zQ6s0HC;nn>zPICjmt%}mV%|*xU>HX8tm)X} zf}c5HtqIaLgvAMpX>c2h#7}Oj%BkQOxv6_m0=htB;2fJU0hgC3*$zEZxPfcrPp-?9 zM~)*Pl+t$pNwo4w@67mohtj2u;?780yj-C~A%o4lr@SXJW%15xi5jCovm$de)wJH%1qmr}5BhK#d9!0hB~3eXq{+ko8FWulnf;$; zlu86H6ev&?`r#>D&$e1I0hVSY04}+{`3EvUz{hV1RG(C2TpeFEg7k0yjzfL@@E;rO zTTk0}R!-O3ojAp6C}&><&`oQ6E)Svr2BOJTH^tQ_6&mNGY}Ya~2Jo-p?-GlV@0h+2 zd&C@FDpc@wr&+QdsngjDc3Sn&>n+CAHf-ifsYBoZm^##n2jzdsg*F4#2Q)}rJdr6+ zZF#maF9AvvKdG3=vR+GD$r4DM#0e3+t*vTIGh1a5|7}-k&zdvtL46GaKyNNSfd`K{ zQ%I|gaKv$_{&N8%Io8Dts<;_zV^ziEfM~JmsE#w8ptOUGsGF5sN&AP=BLZV$)~>&~6Zj(}VcxuvmQMTdjL= zW8fkYS5Kf}Tpa3Z%V=wD!Y#u$v$>uzvReS^Nfru2v<|f;&idw}rNsoI(Z*n>fZ8q} zJNjQ@t^4UfQGOV6xjjiqu#5r(54h$W4u|={lI=!5z!G?ENNfU)i&R@y2_suDBe<}o zdbC9Rgi4|nifJ)#lx80n&T zatHPQtaVA&A?do+7>{}D$0{+^QrvdzYz!}l!AAzp$YQK^4iyEGO+{VAEQHEfj-PuU~=RHW?ZCm5$C!RHOO%=%T(;nhlMlcN z5S?RT@;;1>SVyXXa`Zti=a+?->VVQ8z=1LB7FT_LXkD^_QG?3qc{Xzp07hxrg9Ir9 z9?-BG*^4xo=YJ_)MdZ}I|IBRu>rp--qnxwNe^XnV#BDn^lEM1638K9EC^zXPD!}|@ z<&~k`U84PRW~$Wr=JH7hO!E3)KAB6$3+ucltQ9G6hz{?;jQqiiF&&$Xx)}|AchHe` z!NUwJ2V96n8Ro)G8r0wHwL*pNVtPBEOt2Kqv8e88Us{9F+*+;W{vfC%O%*~kl@Eo1cpRL=4WJh+E6NHnn0ZBq4o{>e0n<)3>t=;1`*YrA;6_ZKyQ5}&ZLpJ4P z``E$Op`=&jtwV1B6o#|6-UnzWMm%`@V}#pV~JyX|b$$urBhneGD|HUV&+_h$UBz#It7 zejLJe^dZn9B6(*Z?#o@XXLrEuKtTXD{c}gQ^o@e}Drt$m=(3rpb>GiLs zLG9%4?|=BHFC?j7cEG+C|vYV!~1~+I8(}v8t8^&L3ZhZR^UvK_y--o#{H~KlN7fXQB(Y> zBl10A0)1a9yIWt#K}GI;l(HflW^)3@}^whBnQ{Yi{aiG0Ye(*-Bke#h}@`K(@=}y zHspb-XXtB=6`+SeH*U7-bG&DhlFJh!mQT8U z+M;rX6OO_#tcKedGXt9I{gF(-^W(=dczrW{s{+ZVd*L9Z9^8PI6bIvh57^ZsEGB4hc zS@!zYRQ=i4+; zX}(js)C;swzJhhHnQI1zPtH&K)86nmlw1JT-9~;ex2QaO)G;l4Yk`~b=%w#mBBvSd ziGNb=y6*p|lR552*frv*`k)}4-lyL;rFGXwf6w+`vYPvTZIPTBFaddHoe+~J&^?L8;f?cA>X-e3~S;(|sL9SxjBMM1BeoZ#tDJyM$ zyBynG66R~+6)uk=p#Q1&P|NX@-ZK}uQqrAL_KVxKr2F`H0W{-ef`D6?e0_ymd*Hv} zWdbJ?BF1cT3yt|@?+f9*@0Y$Vsqi{ki!Mz*wBZmnd#`1U6 zy(5aJ74M7RyzQJ%vTml&PJz5v`|{LghLiWX+Tf=&W-=?6k0+>AkF}Lmuy(#E^T{t7 zGS9zbp;xyl-C}kq@5bgULwyJ5TzrBo z*03Cxv};2-nW=$&m=r{?mBmag^(k81v$qmJ564!2OOqa2{&l}4Fx|X<)Zi&PTl(En zwJo4-A=$bJ!QZLZVfV2H20QFU)zUNlm!Mc1HTB4g!T}uJ?_$aj7<4 zWG9xq$!IJ6vG<)15!XjZd81N`4|rn-w=kn ztqU#BpZW%KGHa$r6yLMg^Bo|DeQW)sMTpAQxE+}HggDd~SzKY#Be2j`j5p5X);c=l z@rXYzgyG)na?^Orkwy(w79KZUJLP_~%XsJO&1}xaoz7NL%p5~_CP6?2lU6a-nLDHVi_l$6n&aLeEbB z@C*8falF_fRV|OZ0e|)16%8eiei94XM`ziI4FjCecG+RR@u*Ubpk4K*r~}JkD^aGY z(uNizI!*&8QZ$tu(q@4wXSO*=wK_tq!L@`;qm}a1noEa`az(nG%tjvKHFOu*8E2VN z7Uc`C>x;KZCw(>=y)nR5+-Np0yV%$Fw*0p1xR9)k<>(vVU;juANH4Z6-Ewg|nX5Lm zP$9S29<`#u+iW^xhka2!l9tqMc+f`4eBNJmvE}uzu{!*wPJ4#QuhG_3XS1c-UFxmb z(asR-x}r}7MVn5#d7cOw)jG5ymp89lxBT36;@tHk6%z&Z=$B=`dYywt`JwL$O&NiVmC_4;aV=FCeh;x{CGHOmp#tF8KY$*IJ5&ZM<{10C|e>&w@ z_dMA5qf9b-NbrR@N;x*mWDxV-H_8UDk7GrDnEPR$-Oh&I?dGriGaY};HM>qdwJ^Tx z;NT8@f!BnvguyNke1pa7o-lNpKC8{;W%F-Co7kE=%n7;0Xk4pvP;G{3&rqIAx|+ux zE!`m%?+U_=69-LJ29n8pY?&pv8ZMKn7tJGECPF$gr9N_Fbr|Mi1!a)6^S z=yKQ!Zq#T|Ni2OjzUXK3Kr?Da1O?RZy!{cAx{mynEvNLGoX_$woV)y8zmBsbFWxbe zPc^-Iz;Z-?=ImqlJq|Vu_BP@2Kz|q6h?>039bNu6`-HlOg;Nv;7GqSjzUU-*<5R)l z>gB)+HF$2?yy1X=tA=IXjL2Lh_zfy}15zA?x^L`n8k~$6HoDw1lqj&fGNd?7degt= zscKVxeEMoAVyyL8+Oo>N?!{sKSO69B9*<7^vPk?|sK#m}B^pO8@xyobrI@ZHyUE3) z?wMamS1Sw>iz};co*?cy=Up z!!kIBO$s(hKBFu~T*llNsnW6evBxGg6tJ;u%rt{`$O?W1-P7|{m$Dx3iSzZ{-@!&K zk?K}UxU8s149hkEXESVAiElwY3N z-9wt+dC}qXcR%3!<(u#Ljn!KSphq9BX#4^UIrWCs2-lk5@_G|7Y*;@Rh(M{n)ba=p z9t(a-b=u9GdlY0D;azFU=9#LNR;<=BJB7JYIAMfeuIYH-a>I2oTP;%1a(2X~8aqW> zUslq-Qa9V0-)W9(A9WG#<`z2K_bx5ZdnPj`K)A9)rSAo&$9tubfTKa-d@j$U9dr3Q zFY%V2IG@_O$euJRoC3O>Y-H7`$p12|1F_5%SLE3}V1Id3U#ZbZsrzo|FM;!4e%%qu z@Lu_4i)(id+Vw!WI}BfZ0ys7UY+v(mM&-ZQ30Cz+sm$rXKDOKeI>9hhre#`C=W$n} z*%bF7ip^EdsN3U_cL^(cTjL3a(%UXdjh0G8oC?=DpVVncbfG(Pgrm^3+n#Th6>tcS7@~? zUfhZbN{#duGtj)3WIP@FSb?>ZIi=oANx-pYWS!KlsDNH5WRQ!JajgaNG2adDOw~k|8w0s$2T>j&bgH`O)%2Dy8i$ zQL0CIn^R10Z$=R{mEZBS_2jqRnXhVdb}|dH(4G+==PkTuR8@8_FFGOh-TZQ&bC~MC zK1B`r#a7vB#T}99d&xw{?Ta6h@0N!cGrGLoK3q220bJ8O;hFYPGbz=ne)fIovCeWT z`Q@hgDWPp$@5g`{YOm;1ZO)vEKdxj`)s&)Kg%=$Rh$L7-Nb$z2HTb*a zswTCilx6g^r#ucTv6u>5Xqv06%rEVe{de|vtgJ8TXzjddO2 zdf#~`!+@)NFA}x0z%Z;N^_{8COlEsaJ|4$&W0}G8E;7K~YxqG=>&Fhc7cEZ9ygEVP zjOL@c_9gAC8&QRlTSO9=>aJ$^J~sEO*}*(JC}^Q9e#6VKTn)ua3P`NsgM<^g=~mnG zME&blSap<$?A6tld&WnN>bQc8a3^*F)HX?Tw8sV34ItCv9EBia)hcxJjQhTO<#e0`4TZi?5!xi)zT@Qsd08g{u z0Y5#(w9)KUW?W$G+<4sz?&5eI{xZR-b1c_$D{g<}nAlrOiE%}nsg?HkD;oZJvBNq_ zfi`suQ6<1Z_|EHk%}eT=B=A%7t7To6bC~yQBAaV;CT_7Jl>>-1 zM84QXj`89XsBvg@1URF|N^FQ2C8L0%PJmw=XWhr{I`~YMjf3O8ref>)wdI{Vvr29wu4qo+uy{jsdY>J2fryDko#- zTvtLPOWVkr7CBZJH!xY~hHIV|f0wt%>P@qQ)X|^|`jJcXKb$<#5heLaosEtS&JI;8 zGZVADZ)f*)%jc(TD+}b$nRpIuXDLQ4EJR!~lYF-vXD0OT;JgS_1;*VT zdT~+b{#tOm9_V{!)+8o1jCm_3^KB~;yi+tmD{6aGU#wRv)j8I;i&x~fX~~aJN}MZ~SOaJ&)=GgX$mIZtO1e*N!aL zX5#f8ecIpxkI!X$Jv9BLncMCV(l+wXe?aeQXw&o%86forL<}8$ezq!_4s{43Fpz~}=oN9-&zSSODueGGZYQVF0DlNnfY!Tfym2xpTRC#p2*84fz zdz+s`diPjeOmP05k!Oi|AO*gg5=IOX6KqSYI4dYIC7vXK}ab%(t1SMVl7} zmn)m&UuT)%D7k>1=9K2BeetvJW-<#7U;Wf-JDXr8*P5aksTnjKh#%A|$~ep(m-pQ= zccC(=Kqw{W7sF$Vsc2I!RS&%=h|lcJDSi#k8TdGJ=i-4JeGsx|wa@vETDa;2@#Kc+ zXI80==`UaE2>X`X-syN5msi56npg5b?F%gOn`N;#o`*P1B7{X}iOMDZdn|dEhOI!nGRrNt^H#RTjNj4FsVwa!TRos+f+~ zn?4?s2g#JNPV+I#ajoxU5VhW&7wQzS)GIy1*>_Wd*SQOJq4 zNj0WZd>>w@(AHxbbgFSSKhj~e2OK|YIW9gFaL8o5BMPsOERnx6U(vq7cv*hUQC0r7!B-GLEPlU@M7w~AoA1?N-|!WTD-AX`zUAwPe4ypUTt^#xF~(gD7?X_mfoCr+_v@6<^`uw zRd|3L-0bZDAwdPrkNmN|1D86l1&f&?RGUtW(Z~2P7n^QwTbu4`=5B$FWh=SkrWjaX zyr-H61L1j$|4QR`Wotrkx-gNu%K9SON>mC$7~A_WZ>l4dYzOIfy*fBC)uz+}xeRGm zTTqn+S`U+vt*|MJoMMlvW(Q~2dku>F{^)e=QVW^Our!grPTrd?(|*1~$Jp<<5BLlr zV)k({Tj?+d41RKn?Gp&v8z=TbUsG)-`LK1}!r*}lNWFZ*&fM$}xz?mT?7GnRg%Ici1>2OKw>$EILronW>Kyv&c zrgki|quY19J;zMz_3B|7bC8Zj(>OG2#4D z=wzEt_&=i&=LHH1%3h&erPLT$xTAy7yy`YMvP5bGIG4d23?qQ`V#t=2@Og3-Z&f zVHlv{iMsu?Fm@prDt5JX} z?gBXEdExTsXAtqXYZ>wQ4bOR8JI%HJMwK7}MgD~?tbq{XwC99{<-4B8Wv0c7Fck?I zK*e`uV^x997aoz0+!xhFQjUD2aEiR7hxDQM)Tl)Zci*}6ZlFxzC|ls=q|56a!4*#+ zGs$wO#aK7od;7Z5blb4;W`-^2`Eo|}DlZJq8WkTQEnd!)2haai*)WPQqhxnCS)$@O zO*u;MfNn!9kC{k6%LG}ppWjm6`2~ol6QLnR$I!=~=@Q(}%=Yp7;kk3({F7E3w;=sT zaxn}`Qndhai4;W-@5D&xl|`Q+a=*jh7UI8>+;{oOlWxG(b%vJfAl;zh*}kUR^-T3O zM6_PFyVI=?Ht`9|7@YI;FNoQus9jDO3WOCBju_I1GZ2%wD`LQ+4#OYTN%ib?+LDd*dSr#^-uSUbQ!{*RBw-Oc89)EL3%QS&90Nh?IWqTP}CP^2kJdJj5 zVV?lYKiZqNf>XREloS0uX*Vp9Au}0<$syG69!wc?1=yN!VoUH70()bo`NSUD=GBL* zBoNM2)P!aM)MK2~{Fq3OK%i$qh~l_fwZ#S$!d&2JBHuwGqYYyl7h~wQqs+e;{)b_* z5^OqAyKFABv$s6s>)u=Ep_6CiI*P)!&de#5hx-TV1Lm??(*j*CNFYt0jKjQ6DjQx7S zT;Yi_>w%bfcY$YZjEHKXp3ZR7KXN_Nw9UVFN41BA4}|9!{_P4yKYdMR-t-?ZHtBpH&Hy&CogrfK+7D|yscIhYxhz?cyQgZy znNfgt|953paE&q3TYwVp`X0O2mhbz-K$!L0`vIREu_(dfe(X>2_@5;;pvQ}Q-NAuP zo_-CVqb{mJt!b7vE?`wnC%m&?kRn8@N=j8kK$<@&!=KKs zVsAd*CoiV_2|vva4-x3Q7jeOc5MX{7`x8F13frs3kA5Z;DcoJKT$AKvJ7&;5{qidN zVsQ+gR*w2#Kwv!xL5RWjy+)rE|9Nn4^5bv*?8)u|DTq*EBE978Ns*qAYv3eqU%KzB zHSZMWi=q&0<8OMb=aL^xAN?64{?Xun_JQTZywoY^4N6U()bp)H2V6ni{$8rGWZn&y zxTJ=j=mKVMyw3)-_OcKeapl&~k82&3!F&FfqF~>^PaDj?8lAo-)~j!dh+1FjTU+x3 z{ad8jzU_PbI8Jn2#})>cr9K!4Qn(Ez5oru{*dK8{b-@>r{ zY^pdWMvhT)^YsFqL)*K6WH^m)p3ns#(gMKcn?g$zlU@k*%pmPsuV_g)g0a}-tf%1v zu0Ok$BTt$q(u`qv&A9`xB7(6v_(k+IM?}k%E`u(v#`Z>{G>!x-;e3IXOmVuDR*u7e9<5&>fu|6cv1Y~dQy$U zqx@11jeBC4m06}~jwo|_-Gt!l|HayTrWvc0uf9*dtEjt19srztTJ<=S|;vYG}&xGu1ERn)koxO_Z(wtZt0J^8tKg5yX9^(P*1*f1RC&lm??#| z(-Q6u=Vm*Pe?4%*aP~^gQsj-?+6cFcSvkg_eM~vblp>E7oZJ_RX^E?&Vc+|a1_<-8 zHO6e#A_vU)faW*=jnI3fKZF@fLDvyt1rN?r+wA=RoRX3{3{M)f6@&u^g~`x34o7qrwaewpYVOD-Rlz8bQ$JHT6-Pe z&V9k>YWJ8dhI;|5MLkr5*Gn3Vsqe}kFO=+tE*P>B!4~}$wQ4w^JN96nA?qf)sRxz{ zmAGw#FJ5H1%EH5Vf50opdHD%pi%EMnMF3f{#IV2LTtupCnz@d&1m|$nJ$w*yK_7%y zGuM;FsYGfxkd~Ccr@`>RfSXugn7g(W1nWZQd4Jt%lUxH*le#yNJ!}&~uL2=O2GD&R zDDw&7etm-!IqGUDOfMrnsTN96{p0udF(!OrL~D~c$u*g$k5I4K`xhc42w+M?dd+V8 z(wvkyok%?ZD={qOf)6`kT9uxp^#YH{P2Zn>ZQ7(O#(<2FM!HHEpzgKX;oZQqNb4?b zVy;-11Clfu!XJU0M9pW$@5^;RC2oHQXN5!Fa|nOmfv0@#vg>m2_k!0xPCGz}3aRtI zdjfkHyON+C6Tp@ot5mD_c}BlZirTtM!gp^R2~=gpEpmi`kVbQovbSz^3gw590#qC$ zje8v+S04fvVz&%9szVmI)2DRA?)u0&-Sv^@p$roL1Y7&=fCn$wzIlq7@| z`-`d^0~fRI%RxtYr$jqytXCQWs(LdyMz1rH78VJL6A#W6#)DvWc>O>P@)Z8`&^Hvy zLL}xB1BIbO$HTUngmOKA^$$GR%D0y9*qwFXI6-T43b^w?z6_7el@q4=iULQAn~v zpn#5y9aKXaVG6+%LdKM~2N*uA5c}^rnN%a`J){9qZFt4@`+f>^=VIJ{?)6anOk2Wd`WnCDOvT{9A zgP;lzLcGP$ zZcv8T!RaVkV_8l%+u&M01;XZU;y31~=}J?YEZh>b)*(R0pc zzB@=WrY$~RlU^iymSIryfC_ICj4>b#Pv{8z_+A!D*Q$6DAM*D+1Bzrv`(Vx0TkT*~ z9Tjz7TzFl2nahO%$EtMSVbS%xoT@X1^>Bqdv5VOg)5$0##xF^zCm3mO{aNbCD{ z$N^gNz{UqF{+;hgkXio(PWAcGklR*rjp*ykE+qUSRC}LV|F#e7(1VO-)V1xxCpo}8 z?Wes?tn$QOxG$$OK>bQ z$eIfYA8kC{e@t8O!8%cg;h3oaB|WhjOM#7~rU4k#r1-Z!K)&V}u3+al-UL%ZP8+l{ z3yGNA%31>s0LqoHx&L=ib@_(7f*WmEW<1i8ZNf$F(S~)C4cDBK$MSdFbv#sykGE_> zasfwh@=DCZ8`Og1h_L1SVTDxr$yO-IAk73F64(XnGVpzSbM*3z7if zT43x@kqSn8yNq?S@KvRq)Eqd16f|H7{k-@*y8l?Ybc*z&xoEI31`(va;eb-K8I@y? zXexris4m8X$fO5k!wr@lbFlf~UzGE{B1S!WLK`U0BlFXNqke-gsU`#bG#}cj4elWF z9JKf3?a!9Hsus7uw70=u1GD%8z039@KCLKT)8?nE+qg&JdQZ=ND3Wg4P8&%jAY|-W zTh1c=glB+@u$S9DC|xXI2)(lk1b{c4Ofz0+I1I3<<{Fd2+TT~d{H8)pMnK&CM?IP1 zYqru}+A!_*3JrY z!YBWb)w!&I!t@0Ooib1WZ>+;t zbO4gSQ(Q8C+G3f*tQVjybYXLlrBwv=^9+jN4!_Sh1AcyuxuD1x#C;cf3V}NXjR}Ztt4vchr7BvKPonhENC# zs0Cz$he%dtiX&Mi(bRd*?#5lPI_j!dCNS$L4 z0EMs^Rt)!6`_(E#Ausa!FIbI*Q->HGm__Dqru=v0R!M6-#Swb zEvAB%gG^8v00bm6M|#z3{_m|~$WjR2Iu2wGtkKj+@M8k`2a=gdV-OwTJMbKSgbcD( zyAa1I6IdMvWfij(O!!{L6G6)8XfVgwn*_)Y+wP)U?37M;`L&qh<~W|HaaikdwKo!X zkz(K`gUQcDX>RNPF4sod{H}3-3G&HO`Vzo@qr3U46hbURNW%uHev-uD511ycH|-LZ zX$RBDT->6dx;77hAqa%#-)BuNN)Ytd@`Fp<2d;`)QCpSul}n5@8-$_K|4Nyz5=NtD z3spzZlp!@eejRMqdu8CgWkau7(zdIG6*7XPMIwsVJ1843_8G}T$q~v5+4639ku*0W zj!z$w#B!qo0z0#F%BM_$2`;$5yg{T9cVJh@A@*fXZm{;$*;IFQRe89Jg84Q)3w(|M zhMgeEB#MRXX=3>H?I4bT4n&m&5uqjuwep)^=*r$iPOEd5B0<@j39%mCn}b^S6^!uLG3T<3zIFSb(tL^c#6NWAD01iT zjr|E8G|W~KQR)K0^!(Y>!Whkw8Z}(?}LrRY!f~3 z>>V(6LGXPePbe7-3i+Uk{HB=YW?<7SAz4X9Oy&bD>bJ$NHE5*x0$|d=*@zl$U=^Zi z-+-GZJZ}f%H=0Qh`albLCYu#N64E3oJdC61ZzmtFhpxlt0R$(Z181VZx)^Jd{)YLy zOhO8G3Ixtrv@DPCfny#(TvowNC#y+&?>}NtvOZxLL7SY2?Ev6zZl>M0VT4G3I8=WL z?cv8kE9S>)-1KuT1e^G2^ENyO2uID!nl^x;DT|j#&iu=Y;Q8M*_dmgtEHxmX`w1_m zUx5W*K#^2?+93r5HvA5PPo2 zn<)Z<9D_a2JNSTHh#>O-#`B*eYq~+nG2m1@f!P#mN01w75~W=`U#0v6wm`~1uNBx> z!;fGcD)BLtfGj$XL59!||7T4vhJow%mAcYdUm)eLv-gn&0#OayMU8&o(6yZlv2fyq zqP<_w4w&B`Xk|m*HhuFT=2^Jm_&2vx_fO-9-Y+CR;jM13UGJ@%5ey~d)TwO|C83^FK-Kcour@bZoE^A>Z zNa1;|{Q$W4o-?$L_?YeVfu%`(?C^sKiCeWW$NIuQ;rai=n3fOAt zcCHP4^~?WoD)ktkXs@^r6oKcC)>}4%riYQjA10x7h>XHV8>dDQ4l)e>XR8=%PDhto zbiuChd*mlU_Cgl(sagJU;1l>xa+Uph!~flkHaqZAo!VCS5rQPsSq$EKoAvjt@JH0? zX{e9iuxw3FK*cNr;j(H4_2rSayJ00115O#nf4$#i3f_19(#B0a^==U?-v&I|sFYM~ z)?VNOPRjT>gJ0B6mCO!U6c9`dKPM^712tjLa>=y7S|6BRCi=f+?;Cc59NpV9-c+Iq zn#tbo4!OFz*8$&1r4K9hFQD>=eN%z^qsFLHl&9E##85c0CK||t8seYuyzg(TuA?u6 z?qW>CydW*c36ie}_LIW>4WWcY6!lFwGvUDs)YBr{?zRZ9jHJ)Z(J-m8X*X+>-O8Qwz6+SB5c#W8+$cJ?)Xg9k_uk`&( zx)NMes|FOX4Krd|CiCW(O;?B|Go^2(ms_OM{nBxfPX50p5>buQF1C{2hWx(Ap74wG ze2tUpH&-l+iMh-#Hpp|~+t|h3lX71g@*;B2bU(|q>bxikl?s&{?U=jf&+OXmeL=QO z1XljnVw7@2sKka?1!@bv+#uhO0?L!qHxH%hNeN_iTI>y?8F0jZ2w9wEtB@RXnLYc+ zi_q`y=6ud+5#IIK3FDodQfMuZ=4x|UufyWPT)Ep!w}j0>i=oq?-uTSUIOO~@Kp8cd!HNwcu(NLR{(PTN&Ks3r z8ZljjX3+rHnoX+b+@}K4G9~=Ez@$Mn(opT3=X*zOAr1%nna9CRf0a&>m}hZ_i%7NK zjps+09UuC1v5Jj3#U;*H#;U-$MBvSoL4|d8#51UbqF%^gQbn}?Do>o>OjPi(pOP$-n5q7ge$r8d>B@S^y%01E>tevD7kRJ_RuBR!-(uGP2fQ~{3rb|0AMO&yHiWTK(X0>35x)L7M1W3#cUs+kIGWn@D10H@)_ zFe!0Z9|9Y_hpEoryt3hizip*YNw4kEP5LUc#^KYv)llW_5J>l`nT==FE=9RBXi(ysEQ^S#y()1cF zSEh~kVG3IL{66`8|Cd{*nrV=5^l})O%Ak){?7Yee3xR4Izh{~eaQa@B;f$xg(cy$g zzRWiWWu`>_>S&>7Ph!uXM7>-}o?J-g5b01^o@pH!IpQ>HZd4UiC-XssGPQD3MGuSe zWW55kxx+3##i^yzT>Thuzx5bVU24)Uvj3{icsxODQ2J!OoUuh`R+7aSD#*TJpm(2* z3$GVkR2^hz&xk8QE~BCilKDRbPDR=PwO3Mv`{->$>d9;~c7sK(#eG=Zfr15q7NflHSR<2n3=8guxw%H{p9ym~U zF?OD>t(g{71;H+}W%24%3cT<)t~}S?=NQX5m29(E#a=x&Nbp$NCLv-O^`xR5UVa4Y zsd7&hobmX!RbNfTt~I|5;rZk&CX=btU@1S8ty(FyE+BTks^vTFAi;boiLcdxP{@bz zhE}KVJoJW47d8@h_di@6-6*86f@avmh7%VJr5H4aM!b}j!EW5mjrJ1hb(vGghcE`n`h6AWEO@D#p&`a#q zZo77fqn5Twifn!{nI5K)3{|@s=p*`lP?LveOR~)bCR3)Yc_tgC`1vOn(g&1g=U#PK zl1JGNo2n2&Em?;RNbj?$G8w-+PxPy-?sP8Aimw?4;i=ZaC;vxIshKoKiv@HYK{ zOBWnPCXQ_jAJ9pMKbS|iqx_+|E^rThIw7gKM9M~B(rb#JdoprrWyj>zslZcsz0UVz zq)j}Y50OjxVFOB2M6s{;M$Rln-Dr7RQX<%t18ln~-8dODL{HXyqPP|ScoKGE01}$< zk(W53(jpmFShq0Jb_sT?j9WY6)?0;mP=O;E&c^JWR;S(%Sf)H22~V>)yQESq2H~S; zIdTN87RVfnTDlNAz-kC|FIzP*BtkA3nuOVuztq=;^6GKG37Nad%2JITt`#kdzS1`c zCB6kW2sJ0FM(P+GNkvLeU|{4c^-H`SX9q0z#hJ4+e9EiTvw;cx}j3-K25sSN}|nC`p=y*GmCk zw(=rnO;gbTd1sxXIQ@@cv-N>UlfCCmEg&xjqs`$i4r_A5=<3D?f@eFdok$ zT?hsCr&OOyjlKQDUKMp9PwTcpwro+AD`?F?2eG1h;VU$vaAw9AM3aEfEK|!-dT@ok z5XcmKyo($mnCKR?x2^05(rTEj0lVSZ9Q8mN#3gW!avD+_*W>kDr*i4ue^*XMY0rUe zA^L^A?X)ALdpdL@f=x4x5&RDW7h6+~zY}JU(;SZg)I&-=a75`RLC5%lZ3u&eFX~w8Qbn-sM>b$sMrDI|=nqK=lcx89unY z3zarLsPb~4KJwZlp(Z|Nn_*#Awaay7&T*9B0$UhdyfFZP zvPGi8wcHPO-yXNGd!o7drsKe|2GW{7STLW~c#u%gnF(&-I^k9YEh1e*R_benEm)+_ z5IoWd_biCnAj(Iw!{h~JL|{`&dr(zZ8zx_f&vxXB$w0|^`{pNWsgIg2`1OX8g*Ml5 z>eMh45g-rJYdk?m7|2^ZK`Won<1a4a-PNW=avhFh=BrGsop)%Y8U%cN)S>7Fh96oT zGlWh})~IZlCzd5gfpJZXAyTc`LI*qyM_=r$78oL&shS;SkOiWQKPl0(mNJO2!n%F0 z=n_hYV<;3^jd`-zLN`CWb>5~p^-*fB=J@Wh(vwj42o~5aabwBCQzr*Eol98(=Zai= zfZ74hL8}{hJr2^puw4BGjm!*2Fe>UGIJ)uLK9{~+&qQ3Z-IG1)Q+_nBkl7*x-ot}G&-Nem2Mg_MV$WC*q;=vZJ4w?P_3nL z>!@I`X052WA=_Ks?U%O>PRm^2_J}N#rVl@Scq{!~aW2X5D{pLN8818&;bA`-c^Hjk zkDK>-3jbo*M$cHsY3%KB*g8<8-Ppv8;HfWdWU@Rvt=oRcYqaf9%IJt>#-t*j>G6|K z;CFp`I=VZ(_rAi?mq{~7MeYiwfzcxchv6(p8d~syIEN`_GRtVUB247q_A`RN zVif2d|9P^g%F!N@jq>1TMr&aCY2}5$%TYDGPcQB1*_~7_Kgu&={B<*o-uO{)KT~Wi z&CJJbgqL>vV+El;gij(nRntFm&$?S=xHvq%kT|_F<0Xs{H+fN0+QqErmG`}-295xm zx9TkJHoAJ^Rck1@&;3(Z2*O9j`vX!O4B#`&vvNzmHR@jck z>V>${b4b>#&?B0rOYGk~gMYBuM^fi%Gr7GVNx}J7Q3GG( zf3U|i>sBY8Tuko)14e`BvCnKYqG#?C%gy$okL7KQAZ#P^HE-adfRyh4%{oj}i%lk*#iZl$QDbT`sEQ3eR@esGT z2asip=Vb76NNQH;$f891PBwo0x&D=Ldmq$@42(Y3I#|d!I2d+4_KJGDoKfd{+e6S$ z@`D2>pKEf>@w1vn?EK0lhB|4~tX#*; z39>rp%mH^?9Bb*hx4}5~+#K<-BE06@`urpL?Ux8_wFup0O5zvQP1|4WprbEqJjR~4 zb>^S-$*q3d*yGzLbS$hIby9HXzX%4{3vTr;xqYp2IPQkDt#Fo5NDTbC{EvA0>FSe5 z?HGW0>~gkCu6W8H#hfaMtU(($>f(q;C)X#n`VFxFi(sMjFJ6HxVOD&u%Du;b^C1LT z23T3?@1+}Az46}DK6g`t6-Hlo4DsFP6yX(WAJ0ElM@iJeeutF@ZL^k6{DS|UDcG@D z_@in^X7u|Yv6{x$99;&9&mG!Uc}tcon1F3(R%eeLh9#t` zJ~Q&T(9H@Oxpi5gbYn+_quNQ=m$K}(#@R`4!;th0$p*jjOnoBZiomtu+}DH|J0Z@2L`F|WkIomHe!O>ciW^Gx*F+-0LDo1k})bd1-mqz_nGO5F?* zymLG_UI@W5M-;$ZXr?2-uxk$%OFZUt^Zn5i!NJ61$=enGrGb56{V4t$q3O?TN7Sem z=~b3AS(1jTK!1&n?tS8c26{yJ^ABm!q~{~|V1bcgZf|dYwriSR_!MH{IaB|EO9l6r zF1;r!8%l_!GAKVgd*4Kgj(yTYQ-(7AmJerk(<4~iX#Ju|l%xK5#btYq)Up%oS&d*R ztSIs++bS_%?!~%@9#;Pl*%glbKo=fRqf2;uRCUWclG#HTu)^#Jji+3s2HUt~kHIFG z2JO#*aU-6>BDPQzgKTwaFyWkC28V>sJ%s2LOP5f1;Ptr>JgFHCz2Gs2w)gbQhp{uT zg{A&G_=7uXNv~sk8Ql3II~T%_xG|JP*Pg^OlZH9V03r`EWmlzy1~biI95-pO^OYD9 zK!T((;`~4RRA(MFacz1|0xieK!44x^CU$y9ZtV~R6qsVk%FmzklKo0}gD<>!n5>HX z;8zHZa&mIpEBoa&s}&qP0n9{CJbiGE)axxytUc)q)kmE=1k8D8*KfX_@)xTf0z@;| zhS9|Y!&&0gQ|w6&h_IgR`}>FRf)b7|&7i@ZmSR~#Z(G4Pc-!6@R!AbzC(9V~aaPv1 zD$kg!o^LO}oHC|#ayNBa!O5#&zQ!_^U5|UNsdjvcu8Oe3Rzc z9H-}#9g-xeG^DG|fAF^Dr15DUb*v%0HZb~X(X>3OLBY`p?#Kxd5PKf>Y|N=kuJnA; zCnO!iBdfCguD`q{^HEY#4}qW_nd#zMrE?2he3g+D!ULR~6D;a>DIwNR?oc@vPBVnW zn!^$u%A`$+IFh0VBSjeCo36`x=NF$q2m;Y_=!qmO-0+_qQ3K<pv9jyct4c@*7OZGvJ0h z{91XK;A~rV%mNT(d{IeU`~L?ZbLl{Z zKKPuL0`?B|F-mD7)FfzRH}IS@Xwozh`7q_-?VShA76b3de#Fo8eWRyRr&x_(&EHrH zgtQL!>|?cNg5je&p@+aFXH#6F|fC7ClR)XyuWdirdr5JuUeFxJbJVd^yCx;-13J9!EufBq9ekL*>Om!$AbX>@ey+y&hUi z{~U>aBU*zYy>O9>{(Vcf%H=LSMq&7%G?;+siqL5|nZ)ySF9lglz^K#w9EQ0lvI})y zXBezXH4U-=1DbFPLIic9gTYn?;Hy2(LX4|xD}x*uCl>b%|h#O%lN-G5hTmJ+sxOsx7M5}46Z zXPcmT_tu8P|6qKXn*4#kca4U*=;)wq69aW;QU-QHLLc$9#}%Hh>6Y;0!)lOEh5VOE z2J-K*s!-V2-I932btU0L$(hlyi~uxoqa8{WLAsIW5L$%%akyO}`d|DSS<^Yhy?Wri zcPtX-C?bxbXEZ+gSl<&0D6-sXudmA}nFBO1l4X{?OLMp)QnL}mDxO0#U~Oo8oJXAo zlf@(xW82oqvaF6xg->rOD-h@X=LSR@%Dbe&Gs>K&nkjj3$M7^lx=*0cHbz;w{`%@W zaflk-D{=1eJA`0`tf4+N=<^99;v1U-!N6{oZzqvFiBZ&n&Z@ZVfGcPi(k0MUWZjpg zG)fu`CuGoAZD?eH)3b4SXTakR9W$?AU*~+dG}6F!O3#Uvq;xX0bL5zVWT2ss&^ySV z7kVs+-S0(4WN8T^b|9DU34tPmZex8qZu{bGPw4!Lx-63;gN7_JWXvxp3v<+L`1x_qm`!*lsw& zzf3(G3>(wiB&E`8T3DwIEg%$OXbOZ`Jz zvxI#T;z#%~?zAY1D6UP76x3kqS(*kMpRaiLaHBsZ01^e8VKXx7@5woQn)RS~OX9Fg zU*Ap@8(CQa=U5_=CT|@&f!a*NL6j=Z^Dh43!ve96N7|A?g2Bk|@L>=JQ%fjdi?B^F z73!}369ON*TKE;_e9`m1TQ-x1hk3#T7eH-Q#aYa4^Qd{r$RYR9x=2J~WGpOEPU6Y8 z`%!`{2WZQG*MU_fTI)2OW4Nm@Z7a7-O}Y2D#p~xy@*oO66^!f)O~Hl_^Iz3irzIj8 zc64i5v>0s_B!tr}Sdw2wElC>(&%mCQn_F~CNUIy?)Ow!K=cC^>45C^3&ypT>D$`c z7+X~xD7gURI)xo)KEdFsKDIlEeo#MDgXR zhiv1Vq(Lsx(Tj%vI&=n3Z)|2}CJrOJ=#a+nm;tx5e)iiisnxh$H44-Miin53t8jGz zLEuY}>yuwm2XBmWVqp+Lk*1jOlAib54t-`B>#Hc0b7~QGv67EB#X7ZSq^ls0Sh#gO zO4Pfr&^%E^u&$WI6TgQ`;}WAh)OyjV2E%G@GW68k<0Fh2zWs7KDE>2}V=c}Uz;&bxU<7V~_Y(%Z|( zy1vJq*8U&%R(v0HXpOIY-+GMVh-3ECyVI|7SGbgS~RupH|w(3eU>Sbc0zTk){4E9sOd_$j*=N(w^ag`I|T?<3PL45ZIg zZ)L_ECP#|FAiLH@&izs3a2=+xy)dQkkJX0-l{|-SGw)vv*GpFZ;PCG5Su^X)>3kk_ ztR3k(Tn^RDoNuaSc7I&CA&q}o{eZD2O*=+(?uO0MF4wkP(>#>aB_^IBul_VGW|y9l zyq=={eT%<=N!)Eno4ZhDX9m39lP{Mg(Yv6Rhcp3RN9d-rbm z4yjFK>tC~F6Pc{xLcnl&>~x}|3|ag)lp{d_*-zp`{P=p$?W^o-RrF%l?!$Z|L#7Gx}=;-$6GT9dwL$*T`h>vEw5n?npbz}ue{uS{X8w< zOF+^XCip<3aw|h}(C~wh`!tJh_Ex-&XcCA(57A4&-tqLNaiZb zXfTe9O;Udc2`mTfV4r8q9;e~u!fB0H&HFf;rTJoX( z;PjU_cZkzxYUw!c^OuNN)}RmBeA5y@qibM$uy^9l96(yO9{9hg-mCV z>Ayz5+XDBJVcW{m&qiL^)b~kBJ;TjudPV&y0n@Ka05HgBC82sH=5N-%j+2tQC0MYp z^g>_vHnpW6IP}ao4N0p1AG*FeF3R+a7mxuNR8T=wB#e~~r9n#921RL*Fc`X|B!*nY zRY44-%K*tihK3nHOj;U-QY43x8ekaao)=};{oQ;2Lv;58&-=XRe9t$|c(Kx76<;?o<$B4^yeWfsrRjuE?PrNSiY}I;1MOMHJ58n}#5>5V zk%s0!_zU|Miu(OYi2-ZgaY}Bfsz2WC^rTJ}k@i@}e_icsE0f{gc;IlEUn?@QAalwR z5F8ZW2&9hw`dh(0Ob`A=Q_0`{FFf>vp8@%8|K_^;HMy|o=6MU;bjb+6Y5A=;BAc&N zRVwt|dclXC|Kizgo2I0>;7nXj#S!Dino>e~{pRZ1vrQF>?pm<~Syrmb^jHUW>#c&} zrE*#Rj<#|CwfFb9iGHbCO6DVA*}|#LRBl>)%P!T~zqY8*GTqQ-Xfes$#!B@V2x3*{ z$QU&}AW4|N%&YES-V3kWvoVTTvHJ22Hfa^lyau5c8_f~D-4gIigg!DRG#BE`jC!1x z4i2b=MKf*u#>nq3T*xr_t4_hGJT*+lS{hKF^_s?E%A}m76!)$_xL0hg3Vo^CaVBx{ zj(%-i;uB(>(OvKgOBm%=P7$e2)+|#ewkf@9P^bIFDLD6i$d02Mnj-Jd!bF#w+kSf> z*9NBbGYwv~rC8!CXTDY|STos|9Lv(l=~(8m@Vlze;}R0KSFUD!d|a!4+Yd?wy*ClN zXl#L7@O@EAJiakP{X*M}OcVDsTA72Z7HTo6tOGpVBhOiS$eVcUpT3NF5-c#v)qQF4 zcUZ{CeD9Ek%tlYp_=bv|Y!&@+{YK#Ww|?vdP;}iSt>1^7ou6kJ#PrU>f7wc9B;L)T z`Q=$+eSMsQ7pBy?x3mD)Q}@YvM<*uEQ9c`66fxpuzq$oI0aveZB+-}UzV7lBOtJGs zhqu1Ieny1}bdj|eC^p6<4G)h3sf)j{^+CJYn>?7oC2<`?dM+{-pYJ|=EiEfr9kc|b ziKfOpZmsexNQgdimh;f>k4i%@lY#elP=GwY*IR<%m8Y_-blc;M)nuFl;N~xWI{5G< zsyFis<0clHuP-koD0fZ!Q&f0WeezKu_4+9p88t*YZQ7JF)ti0t{w`6`6QYg#7yAPO zMobyQm4>5R85eYpi{f2hr7%+RwlqAecvF%^pMLX^U*3Q97JS~_lN020Rn%**$?i5; z89$p>N4cGfdOaKLQ=6(I$sUR6NmX+Mn=j9`^hN&r7&wJX8Mex&24YGLMNbMKQcl-o z2%iH9r<;5C*hVS&^^l*UMtT49EuCvftJ)zDH2gxe30@|P4s-7zZVNTtQ<`1q@ag`F z3NzRD-10ZSf6C85vlylXry_5s3cN~_P_SJe*F?59q^Bj?$zbYoD^`c3JU{YzDUt!H zCM9^Z8yn~kCGELFz4fGfsx33hcGr9ehgzo(WonXnl66x&fqKK#8EymNV_ji@OB}y) z@zS^Zlkaw3%*QvXk^C3&NlN;`9Nbyvgzmbo%XALaa+lA4M0E~6RCl^~?8jfK3$42H zj@`1n@($71Y2W_Z?m)l!FlH>UT7YLwAM&eSUN9|ka;$)dlCX%Nw6uC-Jf3v6!1Eie_?w|oO#Rc`0d@_7n+E{UvTBK z=b#^1j6PVYV)5#{%Bssr1t8|wl6J8uiM~2gCF(uWc4|hGx#RhMMoPA6Q6Ut_qSR0x zJ9~R91`t6(&?Z)8EPY5SAm$Bj>IA3LZGbwV4H+0hhqvlL;HLO;|KhXlE1pb6(@x&$ zQ7ae*)t6sY8@4L+Sc(~B&FqRHT2&cxKK`=1{Qaw23BDwb95RWw+)BW2CP<-HdA$@e zF=u3E?vzH~`FT%4Arj^sIkMA5U<7}<|9@W28j;F3zqKBXWM(F}kp>CPOxZmr85Nd# zC*v?TIvy-M5xQ7dHdR_H+fou7FI7Ciq|30H=sRVLzT-s>mEd+z_nEh$&Qx<$%bT{O zYG*?o^;~E(BsHi^?=un7O=0>Fx{YtVt~AGZQl?GUJ4p@eFwyy@VG~pA7c;AvX1R_l z*U{HH7U2SR7Ic`~OPChw6>8c74wP4A;Oz14%Cov~iO5Jn7j`HqP2^U`)9|!t>8rsg zYxhPy3(a|SX-5{NDwIE%>d=|H-$*a7oay^QJwxKAPPazY5kG3x$^x12epek;-l<0R z1KF=7CE+&zsEdI-ZE0!np+fc>4NE*jzdXJxSnl^?_Sz_@oCQR9^DBD4j}pk;1yW&t z)5axUN7r{BYLt0SYE=!rpZHN1BQyE($%Q;a3#?q5gS22Nyeaa2OD<#}buz*YxL(t7 z0km3ksNqOw?!8$nvDj|vZ2RPi&%(G>tUeunD6iR)wWi%49|}0f{(yMdRqE#hMtv{O zKC!&iuzc|0vF7d~=jlw`9y*V>(ZEww$Z|)v>B!SiTBlRlWIQVa;MdqfV}m4s8z#&9 zL-##4NDUq+(ILUR*>c#TdCNrXWB?%AMR-2Zm|~78GAZTm9@PgaZbOcjaa&cBQ@SQ1 z%SptQaWQ9kN3#(FTu}a26jxn*%$jmzdpxBer^B;E9KZ0l<3`8Yz*X)YU|-k6aSp0#CX@L!T{)`$>kTwFNT%{^}i9A+&7Xa!}Ti(0qL$70o& zv>DKM)aRQ{Xd6_lE#M{}2CTktuCQ4B#zQQRGcLLLs%%`Gb?e^mGWzO`N+bJJ7CWye zIJ54CnwcKnfXAQsJ3vogzbpF4^=5v9CIxPB3u2Fwk4q|Tg=wmGLD@^0XZ8e#+^xnU zf9K;F+y?LZHV#Q67^UnvVY6~L=lC>vht|6$I4F?hUKa;a@2R$I+4rBD27iU#VflLF zzeSFoQv%e?2V+||xPac$Hq!ojaW&sX2Y^GdX8y}Vo{L@9Bq(Z*(0r42a^Yec3np*# znCD6nmk#8s)(>ZEOf`k^vbTMB@lY)mozrjhbTPou(a|IZ-KvhFiV3fll5^aGXSomg zcU}$cO7QBl?auLW>c&!fCo?j0@+1mp0uE8Xh6ZyLOiMC}L)J;y;aXpryvzNB{tE-W=HVV#84Vy?u%S0CEQrT14%bRm%ztk-ghRfl zKI`>I>{WVM!L+}mN&aYABs2Yn&BkGA96e< z@uJ%DOTuEe{o-e#q#IkqFWS3b*K}#8hMjDnbEqvP4;}UO>D)3iO`s(1oX1%Pq#bGG zKrQwAQzugcJ;FZYKSKd`q|+#rU0rjH>eIEXGO^qiGOc0}720v~4VzfCV`bS4@a6;` zB~0Je*f2H456>h_eKI>0`uzrL#aap-O6BDZlU;9jk`R-t%oqxz%z?Rn>EIm?2xq^-s z&Q;q_@4Jf5r#!R$;Ok5T&MCEPkzh5RhUtTEsVZ*5c5Xr`r;htP;SX#Qry|J0*0XVq zMvcRi8}^xA>_0b9Uq+sF=^)g?DDY+8GO#Eso}6t`kcZ6vUT0Kax{keyN>%Oo^5*(! z3qm!AdXKksibaKgD(gW%UIh#?x!x+yr-#V&uv*mGs^~<3oUk#O-rmeyK}(M){3+%N zt^tGhk-qP+7xVum(j&Y%=hyB2%Jy!7gy888@p;yP)5T=>tsBRCH(o>9#TefamGK0| zd1I3nxDR;vF-5bFWocAR^xZ^-Nd9NC!=31PyV6zeJy#zopOgNOmnWUht>_O#S=wwLcYR*Kdv3!{ zgs$P0!94I7ZK^8k;yOle)xEe})AN8oSx2xe&MOKTw8~5thjy7deD%8@>@|GZ;~VfI zZpWzeW9z)dPCa!%pU6m)uM~Mh$z?!;SH;tzdlN^7UPDJoIFA-kP$9U{Ua$Uzq0fR% zubKA!EQ&$VY@>Zr7&E8&sd0bBCFeV*rn&f#h79vmCH9e^?cv{TKtFjf_}j-)1AJe* zZ;P#~MK(3ZOph*j==PN*fcE_B-vsqAbN$I5{{}l$6In9Z6KH}o({6LX%72;|rv_VE z)`trCN2lA_lqeLNbIZ=H!dbu27rI?vIo)s^H?V3cUF_LBF>4|^ncs3j{??3Tc4{*M zwjnNdMReNik_JJcVxisC7vGMzzQ`WlWw`$Y23j&QzUW$F?}+Z&m$_(M>~b}A{0}L0 zm}evuPgHEns9gE{M2G~G!WeV2*lV>VjgWC~U6*}B{t3R+Z#mQO+@>;TAp5I{-Vl!bhFO?il_`sRy%CoX;6=bMO6RO_Fr*t zW+9PnVA3>sdI%7TT-+MGJdfty1T&5+O&7nprmr7~vc8WDgILWmsD0Ulxds(pd*?L^ z%|-O(Jx8v+8$R9`8=T!Lg?c3{+=KtjmPPz}hqwGB(Ze~nLO$Q-%kleq=!V3AUXPBh zrj!$oA0F&USB5Lu6aaHmXURyS{Z$TyTjU(0H*ez#qRf3hM@d;@`mvM(0R7y4pStkY zB-^wEj8{Ll2$y}cq5;d=|8%UUWG+<>5B2*{K?B$m{xlEVhA1Z@L9|6uBR_Wj5;CIh ztXu_#^~<~tMqhtyDoK|WH^WWYZzL5m^@ZTwUX7ZsH(F7+U#8DdG6f~VN#5}@`B>Or zKx*6#0w(x~;#v3YL8I(VC;qu@8*lKx?0>Q%6SxrG+uk*}c93(|-F@*^gy@jv6*3N6 zFH+fSsB;lhD^WDx)(H*R5gE3O^s5vrmg}7-0yk}&nWRtP8&_s)$^i$NynKu~tUmVg zNfz+?>3IV+2sIgH=4ot_V4qX+!64g&J1enaI1A81sN_Ij?HPo zYnWx`{^g`+kL$-Sn6K^8#TNo~@| zxBF6sDE3`1BcrGu{1buZ0V{<}MaM|?Z?mg+z%RR*Cs}r!sji%NK}OGr?p`tEc(udK zs{knDE|{XMRUnL{O;5bm?t#wFSQZ*lb}3P6@#-!ISgXRt=xoABh>Qn7klamDmJGs zp%g%wcxM`KVwgOK024}oK*iR5iqiTykx1c(Nv^`SEh?CibmGpIBd8uo@E4~dbWM`4#6)u?q*2&$~-Bg4Dqu(rCqINx%S1jC7S z6)Vb5<<5;@#&eFO!ma80-Oq_wYWG5iMbd&G0uNMYKOMXv4P12fgki->r0uf{^*021 zzNp+U_cAT980ouC4&qeZ{8fSslmJ2!c&;svkdOfwez7vu)tTx=7$#I|k*WdUY^wJ* zQsD$+ndZ?!=$(M%_>P~>VwJh5G{n^+=Lf81L-nK6`&|F>7;Ao?kr7Q(WE>Fh;=1=eKct6R|(zUIN4uQ#6N~NpazWv#W{`fAFTUc z@v0~S<@4tHRi`!9KmL|3)t1k zqW(gphXr#my#5ho;ct9j@3MeyOqkf*a6KNljW~>PfAm(G1xa=g>r!4-QyV2k;r5v5 z{1O!a%nR0g;bav}U;j3%6Y68m9uq99nCqz#+tsBXwx=)6EEl^DI)Gf18v4ftwdET^ zo#vX9JPVi;@DHCM6FGir?UU>sC@rKSXJ@#^n@blKr*gdF`iQLGI64DcYn-*|t-i^KSmSo}ac~JrC?n z*4qVf!JoF74Sf@@0K&*&Hh~D z`l894x0!j9p`P6C`Ru%FuPh^qx_hmn%a`d zZ<$vd)2Z@hI<AggGt;A7IlC8`f{hoXd9~YqpHkGsm`V+MFI7CZ+;C{X^0iJ=8dI+(XhC z>-HAtS#5HaS}H}-?K9l581I9oJH&K!b)R&;IU>z0sulS4u+BhgoKv0yMd<2@_GErWkAx)-}D++ZbV(WQg)$2l?k16XRX;z1g2iNG$&dnsplH_JY&eEi2)M@nwq zwFN1~gC*Ux@l0I)CnekA6DYBv^6J!k7u9L`32qHasm43Fi!0I<9pCuVe9D%G<63I; zlVf;zB(J>IMXT7 z6zX(EKO3=Q6FY*p;brcNQPP)L6LX;fQ<|5qo2D%DN+4kMhdlTZ?7Q+_k^X|3tXN>) zz+L}m`W)x6R7_ci_+r(pmUsODfu44FK`b9V;qcWCjZ}(cU;To&ZVWcL1ux)45G%in zc_#B??ms^x!ji^k)VGB|t(`?*?OGg?{QPVc?qqRT}h5bz4E3W zh2G$U5E&(fAB!{Iy1l7FY@Wf!<;j}F%YZrN+Fn1<*#K7+`E~|B^VwaL%+k4sk@=ix zlS7&TagqDhw3zVmJAu>#g3Zk9kL5V??th$=8~h2|_9lnLxsP@7sBWp)qm9oR9O5mD z&fIJkK?(%8F2q6MDA$}p6PEy!T*~t=U!BEZ1#&mIfZE}$M-7`OB``xB_ev5?NAr`ZLl4JGn&khsk4E& zw>u^5HoCRNUaM-sN8@<^aTidRx|20SChqV$NfQhd3tGCJYc8sc>r=-|M%5#Iyp@)To-vOa~wJ1_?8F`(DILj$5gw|AT@uQo!K#zB? zh2DI;mT-H>C!qowd0%yVSx$h;cw8=~A>MX{QVn;{$vWQk&YZ8|bb}ro{i&V8Cj+rA z(sA_e?LCjJ%>@S5J#`(WUWUuFH-3Q-K`%zT->o-Dfz){&$TYc7L^@8oN^fRsI*NRY zjR~F0FK74E)?gBNgeKXR;SBv(w0)OkV#r2lqG4e1N)x9&iYz8=jGY1@Aps=33j>dt zB=glQD;Zj}X3#fQpwrJO|Fz=&<2?^4Org&P{Y@vCu(EecyP<0RKAhzkfPgeqV~1Ch zRK;quWXbm(x|MhN_vtjP2CU5`<@a)JQ3sB4j^$IDeny(c^&bt)r9KOGh#*j(s7jKh z(vh5-kBM*traphHP}Xbeipp^GbuCR9C*z!2KuY~wb;H>e*WRO@rjlr{%uH0X)z;D@e9r}=Gp%-kRCyn>6N6-QwT|ISMGgk0l&>oW)c2?)@Gxb*fO(N_ntz^$OU9-Us~otqNiuD*1x2U@1I{gwY=QtPGrOGV>sHFb*fPk?S42>T}eG#g=kbIBd zu4KOXyf!_j9Kf7J%e0|O0A!;g9D=}H@LYlpVXVUd|c<0prX|ICL89%0(D9$Wbj zS@a8P20dmIH_m$(qfZ6EUWB|)H$J-Z8VEiP_W*px`laIB!Ad?g#!?lF$SuqF();h-A;wtUsMq1#xL{q-4 zZi~WJZ{KvwtIpQGGJ@k7dvNf*25@GWo{`x`FhAHW)ha#u>q{B}0C}R47@odb4aWTty2% zXwPy6)gh)a1PY`FMpvH?)to8bzh~{dQegm{+Mg;Iu#nl5?4}x@tg(p9d9r-~-wU3a zHD)@Zg0L{5dQYCPf=VMeh74s5a_9R0yuKQ$p@p!v(d~0ZeLiB@;zr57o3Pa_N+a>t zpB&bnb#wx!fNiSpv;yO@sI1-Ly{!Ep%lh#>O2Y+eoztLvfSYYCDsbhq)g9^w{{%yQ z{pC`=MF~qH`i3a{^-gX%OP07N8ecX|xhacA{_~3-Vw2wWv*vAl3!3-F*eI%{!FUR} zZaYD@{Bimr|76`|obh1V#U!U#?SdxDMa4&US?65GWw6KzieA#_|Nh+4_Z2|*I|I~n ze%lXOf)mnfG3*E%M1O*eG3UM zteeg^PCZOg8rnb{q%uGF3(uH;-b!pVdbD-3Y+j(kfQi|q%0+YENh_b%FM$(CjcEv& zeUj9P^Is4XVps#s;3%qE>=PA?ZMjFTe~2Epw{X5}nU5hF#srTSxa&41swT8;<5OO@ zhrw7kyfvf!lp{E91|2}i*Oiw@??;y-ETne-y_ZN?Z#sM-ew2AqY&Q)aZ@xcmC5Cq? zsr_!6WhkGgH0q5yPztHeMl0ZXnCj}z)i2oY$5~ZibEXnYZqJ@9s-R_$eZAe?ZITp& zc_E}zi!B~IJ=6NkMu2ukXII2oV%c@57g(GYch3B@rm9IN*NXeesbFx zy?+Jq^^negx(U4DK_7M@_9j;z8~$G)9ejM3Q3zenyx6YbuP{T*$!W+pH#0NqmvlG{ zks+sK zj5FZUn*fwo2rWn{|3d0<)B_Ga<<=MvGkmvoM%pamoP#kZft6YIMOn?!R|t8;^)6@9 zu{-~bJ&w?BQs|KG5Yh}nrlSvoVDTKV@$t|7HcfFm;M{Hk)1XAPrXB&1&fYMZm`)5H z<#xvzPls@*GE=~&b0YWk4R6#ZavWnh>#eDhk$C6hMiu^qqRwFN{twzQ-^v>lfQY2;gmsd$z!5#1SGoV6KUus-x6&6bX>F3rB9qyAA=vbupgJ zXN9^lal}|V`Q4noS;jKFYJSBYQxkNR*G$p$1zbQEBBk8tktzff^S%#!J9;VvpM{(L z9pUP0OM1qVVtWUdehg~M^od!jI|vvv*MhBchj@)r!1qU|O{j~L*af*kdN7JTKF?B` zUg|-PpUo8@ITj_%F=&9vqD8)T946w6V(KtGHrMEJ9^Q(pUXa2nD;r06>_tNOsruAxa?iM2L}5x`aBhcp;cz+5 zgHU+?TFhji17sLF*}<$#)&0cqTc;5YXUP6lbOSBGwrbWeY6a2oLNEhuE~U(EnAL)! z(M^v3obzR7E*D&-FKWBJYLu&3r}^Il)GPU~b{{D!2%XkRl5AB(Zg32qB-qsc~d*Vg-#x zJed<~)M*9O-=?1eKs*1)#$M`WoygH8F@2!^R6vbL+R~z~PC37z3wsFua{z6jW9o4K zWtk@XMcRM@qwwyvCXi^2X)7HSh3acR9ujH(Kki#B%{pN~2bjvh?~}EOXw;(}1EFF9 z1{)6|pJiw6)l_BW#)fTwtXt6UyvoGNB%N*tY24+uT1$H zC3y4GE0$9|B@J78`Ua?=%C-7lfqo~l^iNrs_J5Vbd0XwN&x6Pwe^3U-`G}ZZNvghu zASKo#5J`nPfu96`Sco7WwtF3QBi-xHK43hzcPC=z3K1g-7==ocA;3&Wr$bmJO!9SHMXk_#)yH4I$N~tH?ql*L zWHVaB;?1?&d8t_Iy6CT2W$IwY7V~N=S_Pil&)fNw!FU;k#8ytKeUszNGD<4KP3ugN zYYj&~`z;SeC0<#v1IRgcdM)QqnTdd+#ok7+lwphBHeNidxA@f)Cc zdOT46r&&hYI@NdIzwf|f@ygC$e*!${G()?){h$`(QtYx?)BrU$cCXNY|LphA!z}$m zz4v~|g;!osnSAOw@R8rQjx9?-+5I)2Tip>)kX}h3zmL{kqkn&L5nw3+17_H>?E_2s zrxbQETNC$VX(dfMdeLj|+^S9>9T`T^Mjg?|;A!y_Dn;mk9B35_%Ey~z_Zu<~`dKu=u~j6NV+!OQi?gp%{=eH=%CeTy{pnWpZUCM-iwjKz>B&(f1(z57j57Y4S>U*+H$ zjm{uz`!F2GPfPTaRxC(iI;XbUj3S8;S}h@reR(%?itO5IARlnF zfB!LiQW{+Pucm;3D8Bkv6Hp$nGeZq8dZzunEQojTBm*e zsw%DO%`Gzc17H@n)$Rw=Z=qdVM*eIr6AJHJ%e{{XHOu+Z2aozdHLDt~{zcWr&gybU zOk9_l%qRO)KZ{MgGGNx|TymSEgT@x`G1=|mR`sFaUyV4-RDq6Db83j$xh@g=-oH$a zwW1>cTYdE_hdg-X$w0c=#Toq6h;8L0#u(A4JXVDs_ZID{=Xpa#o!8h$Ot}z$lgcoN zTO+p?$67vaQ=QildhL&-0~(Y@mc~Edgv5Zn=R{{dE5F{Gc$^!bRJ13!@hrXop+yFp zVRAEScR(?SZC@py{tx}~PB+l}pWNTZ3;zq*atTUXH^eh7Vhou@PiO>D&TZXFR0pnJR?@Cmz-=jT?l2ZDK6Wqm-h;;Cf0i`&YAcn zCqd*aOb0s4wIn37A5Qi@zE*pmD zUHkC3<9F&nc6R`=A+>U4i@vy`!6e@0>szh1^XC4upM^|a?)dZR1+AO&#Bk-!Y%dLU zurom{ZF8vuiZwK4%Hn&oe%FtDz4|R=7<@cnUrnSC0QR05Uib1-`(pZbxCq4PYM%bL zw5@;jSg7*u&u`fr3mWb%ECA+TyY>Sa^=rWhGC67n9yt)Pg%L~EdZT;v#_p4^*a7~Z zt)c)$uaMng{cEWFz*gSjgTyd{EOQBeW@KdK3!g=^%-PG+5ZBSjb=0O-w?5bFpfriH zH|(NA0EZgfTtQnj^#wv!zP)d?B6uPW#OZ^l9&}zAHAdztnVmGy)JB+Z`^qZ?wIQbL zqEAIrTNgX-?2<6Cd33I-YYta7rOXR;wm$mELH&_`3pDFzKw`+E=YvI3c^j}!$pIDN{`^~~l>uGc|N1>KH?Bp=VBT<&1jTJ)R#T2b9-u_8fBd8LM zZhuhl{(_x?Q#wHS=ZWqO&tvb=nogbQuAMU!#Er+I3>ovGsjm>_-l`g|n7MS!DGNu6 zodQKnNwL=F$Pwb&ioJy!+J(a1`lJg?gjhMxeykVi+WnR4?cCDzxc=1-+Y|>F`qw~! z%#y;@0h5k9DQb(EeR4thv$FeWgeZH?KKCX~&n~N|S8XN3vGxva8TwV@>3&TIce@B2 zg_N zdV(EhxGjhOuu-YIZMPaAi8tWG7tAj2!OdB+&abo-aTgDDneTMsdlo4KGKsEtNci$y zLn)&v-YUcnw0!Nxc*R@pL1FJg&3`Q!>jO{_Guq+IK=kg*0N&Sq2s&y(7?lFi{wl@w z1P9W?b*h-aAqDEgN(_cYU-}|S_vM|2bMq)JhJ7^iXSh&w?meGorTccGizj%u+FlHr z96B=|*AQYZg)XH75E{p(WDuJn`h^KtuC+L-){~;_)0y1Ik{%%(1lAuG0N}9D>~Sz7 zT-XY%`NuC?hWq${=H^(Jttlt^Zo+n)Q>Xbnp7ug!L>{~>MV-b(uw#RKOshAhtZim- z-~eWv%Vjznf9uCJ=XQjnV_#b<|D_*W5G;pbxR~X3ESoGOuCBY^z}A?O{w4>S)^KBz zGa|Jh6#Xtg9axWf1_Rn6vANKZv@$#NX?~K_kyEj@k`?L$V&eo5t#1%reM3U#gF4xu zwOGYRz<=^Billl>sTT5Y{u093mj{NjE@SHitC6GtqM1jV{(3|O+)NG+)z^ygt-iE> zB;>ovm9PYgwNq@#zy5dtga47zE3JXPSUFcjDeOHwf413>o2NQP{(nl#IZAd~=K-B9 zjNORKX2%~*upqt0EWB(I+NOT$Po z4-+QUHV}-Hs^5zP`B=42oxa=%7W_MOa4y_{>YIZEPG#q)h_rxEFk>xgBtUiIiq*^T zh#f)ED?te`=nMjJp0_LgrCRDyUc=$~IBVcxZ@M|f8%3T;172X2K#MoC#riH$>s zRf;}UHoY=Cem|I+nUUc)wDmLdMx@-JgpreDm-`mZkK)42U|e7nEAI336TOc6{z z36{R7-dcYcH5$}R`~f32lu{42?1ozI+)pITX=MFJKUUZw{MsM5s(hH(yS&53y)N|LSg8BZ#`sDibmVJ;q&h2gD#N#*El@x z^)A;qJiPS(Yl}atT!a=QYMZ`3H~)hOExuC_vpUOZ18v1_H@Z{AD&oqxM%Ftc!M$b` zK)Kd!E$zsQ7TJ67B@YtV$+$=DoxLYCVpAV0cb->EdQ>I*I3ub`&{?hk9CS91bWO@U zv(133u=S9`FC)^x!PDXS2&r=cmhWa}XUn0aS;Y|BFJhx+XDKUNkhL#o8t(OT@vfKa z=!5|o89cT)of~QkMUY=)WB&6l5`h#emOww#`*5jH? zoDai({ajZo@PKwN$uy1>MBpXsAf$lwu!Y)@rAa8T!-hOd_k z!e>ViNV(6PW(e(P*|;r@Ho(U}bI0%D+|68?2y%1MU8t8FZC{s0-kr5XUi7IoP&a1a zjp6)*(JU&-dw5Tacz5holDy}I+H0v{+No<&7(sQ%`m-f@j~#+CM1v_$uy<%LO!IF1 zU151$GRxt*>m>l0XL3$efWuqj<^{wO0Mnqv$coeZv?Tv-fLQwwH=l@0zXXS*hqDK$ zEv)wwRw3+R$Ic_^-Y($3bT#hC^*i_}T1w0u;ur$ZxPVw>iX7pnk4{%VT~U|-d`!-K z@c`ow;|Vokz*jXl**Uip-sxH0tfmp%l*Z9x@S2+>^^M>P@b&dV5<$*#VHCgV*`*qqYXVs-&8F&bj$gbA6D%0iH zIgZT)UVl245)r%&i3f6u1;JhaX!qS+{t?p_^v?$JX|uy!t&5}UIyiFj5fHcApn-nu zj8=4gF7mpOGzaGvTFwuFT7lTb)n zN%4Gn(UJNHfAE^bVe~p44C06@86tOkO@$n2U>?qg>eNtlwrT-h4#NyB{DK8`q3y5~ zsuLlZL9tl3LHys5HwG^ zVTZjhAs^}_YH2Y->Q%(9xVKcZI1%-Jim_u*j7UJPJTgek)&RR|5#lMVIv`}x(6KB} zav0o)Ckm|WLJ>Z2UBR&)nwMZ^<-e7@b+7Cvr{b?HE%pUO`A!(;KJ#?0<|M4XIeMJA zMxye^dKVBi4s5(Hwmc!@`DIwjKGGWPS8kC$f%Oz+x4@9fhF8b@mxBzZ_> z2C#2~bZ3L&;FgiEWC*84V}g^8THV90{`lz4cN|-aq^clmkPm&Km&*o6WC=*pyD0Nf z%*dp_@44ELTk?juisU@Usu)rA^bvLXS^MKvGXRbom1P3DF9b1#SwW3Yzf5c3;FYh# zG$uO6(&!fhR&?!5MGVVjmdJ!5P*C1LA6A<_L4>y_HI$`XW!=cAolQOl2{v;>!;w|B z64oRI=fpA7JxCN0L_42>8^8j30*BarlE>^jbB8@9z>x}~Lr<@fL0};9R^ndG4K6@6 zo$1bJPId@_6E!qEPYbFsAuH+rr(yqVox6J{Fjx$JVJlgmKczVD5(6=}C>UX`uOb$6k;+fn zD1~#Itac1YyK?GC=f<`6!yEvuve~YE9>TZL!RB~_YuB%#kl@jf(vhxl-;1ReeZSwu-KPktkO#+0$wtIs=aEYY|^2qhPN)w&9+Ck@by~CM8&(3RsDB~o6nE&yK=vIr0MIq5 zQP)P`sK}tjiR@O5S`2`2pD`r#{Pg8cyv7){X59y|!R3ZEpjm2fdpXH{3a{tT#fAffxJCF71~L6+hf3EoNB8%BJ@()czM3ymU!6oY zVk|uu%UzZ+UPkSM0nR5tUEks?b*+)UdXcb@4vbltRI;TLDnl%qI$JB{)u$k*Ld4uP zbRh(fLnAP;z7x=PNsv%8oA9;b=|LLMe~xI-q|pTDwrV!?jeh3}n${pxG{f^<3+3JI z3Mc)36I+ErA<_8@QkQx!8AAU5p^TtrwpJb++(EHUVno+$D+^nYbPy6Z0j2Rs%a(fp zp-qh<^By6I#C7RPayqnjIM6T6KV#j5s9%9UB8wx}qb z$WlKnuXNqjnjmS&X~w_TwXWq{F5bwhWJuA6{KnJlxjWD;Tz-HL$HY zoeQ9mE$~y-r{I<(1_qZPbf6HdP#J_L+wHwuziJ6GhF+K@DcNXMpBD{12gCG5+_n}X z(Ci1Y%^`6l3}_9FJk)N!-)YQs=(eGY{*CO_D|C?QwvRyP8^ZI<1F`YSN#e_aLl%sC zV26rM#0rddBNJ}`sK#PU8g~sKji~lB@>EA{X3>1X~&YAl@x+4tNo3R5~#QO_HJwguSaoX(*$dG<%2eNy135IyQ-qklydWn= zMM4i`ki;^?JGkqg27v1c*(@`WrcSdZlpzMah4vWr0HW=wRUa`H(NT))Xj94}P`cd^ z5XTR4)Jm`aC5OTY)8YnU;8#wmipG!eO1 zp^`}K%lmh?qM#Nqs?yv)cfmau(?FKW{9D0;j_%!Suc9Mo0#D z^q*@||F|kdXeb|S@_nw*_%orp%3Q9w*fkYGIOrBKL6GV4Ey5Ge25#(i5#)rA)|t9~ z^ZDpucEhpbbrV3J#bo%3ToRC*Cl9lFZ~FW*(DOwDhjfB_k(EsH^hC$nrXc;HsZ&;e7mO!gFXUMFP6 zhGe~zV;mYW_ezXwL$c^><{St_U5Gnib&na080FWKF@=}H zHBO+8qIxL62FUIt6!mH`QetWd)KW6C!iDeVr~OXy1@Qp5`MkeB0w&c+H=-9@)4HUd zNO0x71!K!7Mn)0_rP_SQ71}aj2#2a*RBGXASeOFsCD+XF$9s85>6w;!I(DmxLhLJd zD`1(z&gbOd*}0Gpii04ppa|Tplsq=ZZh{a4T=Kx_`T; z({&`}33R7CU{G2C7&E^5dLJKTDR59?*>-thho2R;;2R z;SL9gp&!=m4`=(tY;m#9B`NSp4JWvgelV4ec!W%NTr>s8aZ7Zs?^RSc*(agpg5Gh# zLMC@eN*x*qC^z^6RyDllf=eYfq$P9VC-x9E3;gl_ocga`LiHrS$UPNObrP+0ldP}* zDqvNsl8{-Q7rnj?sC`(rw$xO!YB_d$U;Ri~>l(0Bp50Edwg_c-MhqcywHZgMwwjf? zv+a5{ROU53CDt+>hZ8*XLXZyfTNk`&*FWxadw|3wi6+Pxk>I~FM$Ef|nICw|ZFuD> zxT-Q$LE~Qp%x(f^ecsk9U{TncZ}HR%Z8BPQ_X@QP0#wLqf-EFzN6}XmPH`3<1#{$W z?3`xKK6#+|)zsk<{d6i&uN5Gc$h9RJAd)L=AW1Yhp=*@v2c7W**@r!Zk%G*9 zUTy?3B4UN@Q)&jbVLTJ*ma&)@6z<`eFVm%%>3$Fj<11$@UA%MZk?hGD=+xa4U3jNjCCW#zTSGi->UN=M5f`NXjP5(VUzqlL9uH2Ss=Jrjgf>jpR*>Il?cc$b0%=lG1#&^5{(va>LYY)?W@4-eaw5K z(P1&>FJ$NaU38NK98>Z)X4sHcC}};P2fm4TE0N$Swqjgy6!)foQ0{X{4f^lxJXt5` zqV;x5i`V<92X$GF+NwEZFMNfsMPb!&&ahs$o!I9;RE8Wv&?=CWZevtS#qudSh-BXXER&7fVO_JaNHI@nmJ3S&}jkf zWnRuLo0#GAB{;NX29OrQm4*F!o2MIgb;T!70&CWp1L$4_Qf1=eoonE?D1xCn{WD7% z0DAc}EO#9uMw5`F8H{XsK*oQ@)J0!~RaiOM78Pn~@_OkIcS4M9acbC7WC4OFq)4NY zbN7z4Uqz^MFzR0@`yP3(ckP*})0m2X>Rh&)qQ|%%B12#o@K*EY@s28_^&@(Va&H`G z=_V5e%b!)~O_$VRrWN)h@mkp{fvO;y1~s$8C(7Hs#0Cv}IFYG29le01S*2lIZ-{(-F;XqCj^p^%_OCqk|z zwZv_tG%n%QqL;y2e}~Ot4lj>x<5dX)@0yYHW^?>&Df5YnVcQQB#3)8yD(u3^%SH2}>*xofbh2R}x!11<1E z?jp2^3FdFG#^{)%x^ocbJBP1em8nqF0vvWTplWjFUitfwe4#n}0t?wPzT#Q;I6Wid zX#I@<#M)RHv`K=rwB?Ss^9C1y?3HVwK8;`CJT8e}GSrVurGcEbbgBU4U<>m-1SjY6 zAE!u=vWeWP4aS@T9`jpO-e)uiOTjLsJ))L>^!9rDO=0Sz_FQ3_re`H@X-hkR~gTs6))#L3J!m($K@cV?=Ap%cy_l4JO^9cR5FLS5Uz+?G-;h z@D>8-64K}@D+(TB<=~%?$g>PA#)QC*oWF753V7;NnJ<13_Twzgb{&nq1g#ub1d>nt z1)$~P)C2qr$J<|=ewam?>wT?3M;iEtaK5;Xy4jfUIj~D8%QVoz#v&7T9zOYCCu8k%j?~{sl4w%P;;Y|{qdX7iQ@P{lS#z$-KeqyKq-*#XZ9m>p z)e$IRVv1#DAY7Nw@3>k;?S8mUN=8T~`?hION~*f2usHs{X1N>S_Nfwu z;*4N@;TVRkF!cE`!(t{JhjWjhZ@p&)=IY8$>W`F^wBHU_Q0E~-+v zL;8BTY0rG`p6>-)3NMW>hTsaIVTyL5$bchZNyU6_C7{=^N*~*Zdw+2HDdreWHg99P zw5ti5ak)^fRCCd%5|+3+7s_}3v|4E}p>~5_cw@V;T_qtL?>>AjP90MSAEHt!!eC+b z-9Rc1tu#C`(+o>?wRyLZDKA4d<3rgMs+& zB~TP6AhG?$&Zb%Xn-pRGvF#~8=i9LH${U})00*XAFqJd9d&=iX6nbj9Ez^*oO@s_W z!-H8w-Iif5_ZM1VcnhWUd!5>P)ETj*M8BLEgx(F-Bu^37 z*SrC&Z^)Vk0DnIW2!w4a6VhcXQGxir^*$IP^tP{m4oxy6Qz>p?Dz$vd4N9f+b$MUh7V@vx zG9rp0Qp_Ai_k^~2@-ew@cu*48K$ zMUczW&fN2a=?9W2K-Np(E`WnR8&+zh=UpzUfNA$t_^U{GHP5kIT($t8lYIch!~KSw zhJghykqOVtDXl@eO;Pmv=LTtn!}+vfg*6wIf-i0CvA8Cpkya}O3?9q-j4yqx~Fd6#$2tG42%o zyE=zYRAT#7x3G*$nU%J}?xvx5(w8D$W`T%K$N^raMwQZ#ciBTcTe#S~*0NcPipVc> z8t=iF&(kyU9lHI+I1mz$1)cu?hp#V>hx&WpHj~MqLIy=;in2yYv|%I?$y!v_LJBES z*)l_ERSFf7ktLEPTb69C)(k2lOGS1{ma_HSXBO1w_kI59H8Ez+`<#0}_kCTHUq!dt zP0}rRsUB(U0o1Xok`=OMy&soA!lfyQ2`|-E66Z<+D3Stq+6>|;#5T5Ek|e0j*u>OT z4u_8zmuTBG71(h#njUOXNcI}ryFBzJuVfq0b8SjeehlVC)pA97_m`{3IrPTCmXt3x{p?qslCDiql z`tA3D@y1M*e2v?ZezXI&OrfC25^4#zrPgJ_wczPGJ>`#Zaj4riwMJR+0;jEKvcLyv zufJ1NLq178H9-5FWm1|6+-QJF4zvl{oXmWsFILwa@cEA`x^*}%2%4BmK%FZIahssVvBT*yd z{4P+Qy?iAy^Tg-v6QDqm?qhEt;p2yvRBwor``{g8p(7ACA1@f$SE00_(BcOtSxq#lzvh0&8*i`GA@~B%i%>F44_os6( zjOgROF*ql+I2d&p^}(Zl54oG=(%J&tyZgtk^2v%i#X$L^@T=zL3{)l?^E-S}c>u=n zpxfFBAT2>Zot|9y^R*Xl+oc}1x%Qty<{T$v-lo(c3ypHl2*C?v_tC?+h%3#7ex1;< zR;j$slE=^7qa*Y*+}j}(XM3AJs3MCX4q@KoV8gfhcbeyrZ^xq~qqbzu$-}lW9=A;Y)q)f!M{Si9s?%Jf)w-Oj5fwe$EAD_^7W-J@Tt ztNu6&PC|VkzUsi>2ikh5#>jUz%|}y3`LEs@wOXHmChpC>12>GG{sEBJ+>5TaTVWdM zp56D0Z~GyWNQQi%L~qYD_|(+ILDUr5?LI*8JXdN5wW`f3*V;a=-IFx@F9H-Os1sje zi+KEo|1m@!px0q?egW`X*oXt19k74BAhtIVRDKYR!5<0b?LgK7sZYRYwR*<;KL2pnqt?7JKV zT|0JOUv|`g{z3(nVOQ|}TPg3t1Dl(xEu^(uE$S7FtqZd?*V0jxbi-9z4krBQik{~Z zR_Ie4VFeu(KLgoY6nrvD5F$lBAXwky5VU>Bu?|Muzg7;PgRIu<#J5REX2Y|4?|C#y zyHBWJglmrgRrBbvDnN?<2wg9B^;W(v;yKDPa3*gCo(-_X1Sn`D~0N2I|1Aqr_~%YRCl<(!BHc1GwJK2lf-V3nzyvGLNGh&<;? z-Dob{=M?$r?p_$gu6ce(F=hhQ2t2LTH++mb`FiPxB46LS-Q$HZH90C=M{~=Pu=eSGb>{SA*d4yVWE0)a79%QS6fCN z`=obJi)~z&%kc(5%@`R&#y`|m0IZx^TGx`}|E=r)yMY~iXTOCVc^n_Vrr(+?z6o6U z&+zvx&h2ndqU&hfkMr-}tJc?0vh@4j8|Q)7hAYJv%_ZwOjGnbppQiw$(`lgS&!0ZD z*Ka*^wNErU#j2=fg-1J|2n?9%MQ+)+)}giDTKgNSpZu9>{iE0PfP?MX1+Fd>lND&* zwB&hPoU*?Yn%|BZ`ct^BZ!|_LFulp;pwP}~ zRxO~Yd3?D0>%bS;EUWJkeD@YkYCkRxz+b;6_jl84C^2X%RTD+3GXJZDjOb}VCNC54 z5f+y7_VV^ZOI>F88KblUqZ2!`mdYBdHgMp+CEYs@sC6@W3r_YVf+xbz=T4c`(G2 z!SOMKXGSpQ_x(>2fD(&9Y1=)-by^e#&Fr|Yr=|vT-LHlk$hO-}`%VN*>>l|vF3abT z02m#*eF-tw(-A)b!K9gX+HXS2djEzP=o*8@XL{F$TGuT?{)TlxP>;R<=I<{LT_8f{U@&M$_cH1pz54Hy1V2Dx=JdO zaeNgh(##=Da7(#J%xs0b>;d)<6~kzv2q5&DP$_@Q=xd9i@gkFc$7?8O=yo3g0dJbe zvn}X@ypIUk{)v2h37?7+^`dgE@Iz44RpKO5Udcl8!0)TA(rX!Mqrpe)c!Zf9x46r2 zZ_C>07v1ciBnI7|U*eU#&$jk&*#xme{ronoa0CZB=L58v_A5o-kou*1bDo_6o@mXL zVroQ%j7na-O~p8^pphqLQIbBJ!Ciu#p->Lw!g?hY$JG#~KD7B1L^#uoGKPGiv>tCg z=`EZCT@|}Cvd}=O$6!SDNu9lCz}3YQPq|ERZL6Qh5gunz@&m=!XHM^+Q z4EGT8SA@_O{C0htNb!^w$oHvoOzOQoXusV9C;oOLmt0Ecw{;Di*@0jRK7~ z%x`F@uwRj)eyrJeIM4nFw27cV{@i*V!}ZR|=DD>5TRQT@L^-r;c2{bvp+>T6Ljv<| zz9Efx27d%V%&+Wi`al)20yPW5yjgb%cU4eoSRa_PPVa-y5hNpOmD$){a$#GZ=3Z16 zZ^tg1HPdXAL!7b^x#I8NvG{hqpX|G`;zTP9a^71SoN4Roruip$FPs;%^gP^RLHN;yo`+_gKbOJVNI;wrruU!yoF)~zv%eQ_&-ERnV))^qQ z;=`sqoYzdp6|?ctdC6vJX-L;_K%wUZMdj1AaBqFbRvdalU96fu9smkUHxpfZJy*$J zz)6A+Q73CKa+W!D0oL%ffiT6o?b-DQVf{ZNlU3`-b3YiQ&Upp zoR@KBo9Z;RN#VI`j|6z}@Fvke55L2J?C8#}&t0y6bBKf0|vU=JakIe>v8nhX1BH9uF z5mOG>@@5C{)$KjmziCQ~XoPi}17FW{_4MwwOV7xD{h@x#m#cc8O_Nj<{d8yPDUC2D zYAHinD7M_|wlD=Kffrqnw(r=moAHC^xVdA+%=gpLCTekhn4gcL!}>+G==!Km@ZFPl zW=Z`+`-OUs!8_hHV=``UBt+$Knab2M9xZjeviU{U{>(9goMn6T(?sb6L*Q6PAM5Zx)s_&Uw_i$MN`!?@e;gR1tl5g zr|p1>)g0Oe)-fBHzE%JLnbQ@xJ{`+GQFcw|zUZPf( zyOHZ=`Jr}bkS%9apiBrs#kvGl*vl~y3!qg%nPN?SHlAwju{!yogwEVgrmn}qjCS4K zi=7Q%2mz>tKq(i*pA!*pZ8!UvdU1D*M4M{xf)3^;gNps&qs|n|Nu2Deky$UHl#Xka zkIcs)2&eCyCgK`p;+#v3f}|YOD&&qv2v0`a9nd8(7fVvbvJZTV(X?Pb ztAiqD5t>s0MIle%?-NkZ0`rUK(!G}Pn&qE}14OoI27O)G5<(1puM)H|xH66-J&Sh~ zmW(z^+?C#ZLf%1r77PHyiTiwW{hjf+T^c5pqK25aqO9!|GcK1wQV?Zu*0prHX6(Luj?~mre z6V?>VKD+Syi89(8(i5Bm52c(BT2o!$ZWNm{*3U+vvi&VZ#1bq#?9muwvbTnR{|mn{ z&QH2x@x&|GVHOeitYpybfn+q~PL`h*w#*b_88(*Wfn!jK%$$#bEC%<6<4D%tCdfHy z4t7ZRjxgwgec&iNDB>4Jzlly-N5PU#p!$ zk{XN%P7*A*xsh>$-WO{$a-Hmz>J+N{g5C`^`+YUo1+0TTB%OBpb9v_dRIf984*;Py zF~}T)Ym&k3G;<((n?;lyR#en)GtlVhX}ZBv)Wd%$Umc!;Q=qLeoW@^~Hv7m|qz%-^ zsx;lN9yp9f_4|))-F);Zr;kpp3Nr-#`-oo&P&YD#qjaY=B7W^j5|Vuix1SG(fJzcv z&~xlpKy)xE?E-45uT2HCQSZQ;$b~G!oMUN#54Q5^dp1z(Lcq7LDw0M!eey6=!bd4uFD${#! z?fjQ#(YFAYnCnX%e#MnvoDaP41S0S0Rx8q}J_f`laFd_cWBWW6@aD<|o3?0#uT;-B zy!VyPc=#b)Tas+}Wy}9FjAo{BU`dx^ZPb-Pmme*_XwkO@V)AQ9VzuMh)P2jgrCy_t zSP+G=+hTCJ>e}fwXCCnn0A^ss`K(a6^)`M^S>MOVe!!XY^g48ph zb=xSr)&0suq=1W;zFbADjjz5;)lG+uQpnAA>|W!w?Ajvqt69l`SF?TdB%(fDanBg1 zp-VIWS2wHq6$!tMcW}_xeP|W$565G>3EgY3HGH%wpEPB5&iR_93`HPI+yg7t+A01*n{Id#g|I+FtBKsOIw7 zP87xT{JWFD%*-Bsrs>0$g}-m291Hab1&)hyFrb8pL~xlxlI!a(`klmQ>-YYO$NB{* zsi!e^i^@jXU2kmPBg>X`FW*&`eLMTFsfFs%3~xojvMV%i5Tc3a?<0f77C3Qh=_+go zq3u6YQ{tLb&8Hs_uiuePVBf;9-y;{OEub?{N!Gz6P5I{oQMqSQ zy6&+1)4x-aMC@~MJSO*x98s=~&jI1er?b3M{>wE=*~Fcb(fr0^!EnJc>@tL>Ael^R z;P3;@ld-9qifiW67s zySkjEpeiOGC+Cc0&rp!+@{cPAWnfT8US145n%v9vmw~&*1}Nq@iFzK}%Gy`qHKgwb zFFrMJQxfo9XEvSXu`o8y$n|>6v@9fb?8(WA1M2haJDhleoi@WLhj%NOt?2Y_(7>Hs!Q;ae2?$sA zKZ&79jKlW)hLCIG;?&lae{S;^am=Il(Lu9Z>FMTotsn2{Op=KHAhJuXB^mu(z$82T zFIFIBaz<@HW%|Uw7A?U8gtY?qd7mW-JeW|0L4p3YT!Q6<$v3i*HL7QZ=|+Z_hqW17 z(36~!f8ZA6Pt({EFNYOofnPVrRnxc6kRNYp74t!DoPQytF)=4sbTON%=@G8Ut>OS3 zVcEm8{zdy1>COhv{S^br$uO@jA;qS)>+4}zJKi?ln|$b$`*rX6_iJ#pOH~qNyAq$X zQdxE+H^JVmyw=34KvwqrT$G3P#vcz0GUvs*Bcty3Wfkb|Px7&6z6(Fdn%`FG7_thnF+c6dJJ7MDqArn@j>lNmNv9BWfD;ymFlUG@a3Uap)bJtv1(S~pw^ zg#jvk_FZOaLG$C+^DByTGSjVG?i2l$%~!(lFZYu$l#=~tM+O5n-MCyR)+S&L${?&x z-Tq}&x`q6PslZ2kZ|7fhA{Qg*{}I0`^)bjO)`xDSCO*ywS5*k`P`!%nJF}b4tHzH! z-g$(6Lxc=%5X`F0AvlB|Ddv%`9#5_tPaA07d(;l1f0940JUvF0-Gpn!Zc#Sr(lur) z-gsx9JRhiX{ctSfbnqd%B%a3?mg|l!vgrr`#$9im-&oD~RA+R=ulxF*D~@6iUm@VV zwuXf~4|p-2nr{Gu)>Zf3K}jpCZ@QUd%K`aasYhogw}>2= zM}Nn3$h4c|o~yFI;~?uyuYa{w=w4*q@`dUeDeMf4Y4#o=e7?(xv2wR$_orxT_!nna zD|<<6ztiBnA0jJNfT5DkMGSHbmijMx3CoGZc?^fYONdsW5x?F(|E+!FMOPTYxkz3SZ*zO% z>^&Jz2zKa*DvCSE6CD8wdk0ik^W>zOAJCc&G|8m5SQCaJV3`$|wjiu~NQk9f^wlXD z5^oof3^}^Y^E=T-eJm_MXEWn#7YgF@&p4bo+y|t*PZr}Rl()ybR9tyq+$9UY=k>*C z@$zAsW#H;dqHl}vz8ebch}hnO^EPAK7$==JXLf=S9FPv<&%?v={0R|`QR~=ZpZx?Wj-0s6mp-L66XDIoQhffgZn4U{qO!+$~|FM|* z6dg=D`#uDhL7U5-L(m}h%_HF|B?V%pHf8Y%inotiW!$>3KeuWBDnxj?Nf7K-HaX>T zo|1jf&ebhDZPTgCC^~#g)*m{5p;@2b%}Oej?KM5JZ{zB+{AdBg-%*t>64gVUJhDB& zUymJ2nX00@NTAzA%f{ESjyAk@-6siMKa)$Ob!~+#I-gln0I$BR zB+0{v@nCQ*oraN*7#jRehDs8Ov)1(a{*WM>8vE>ZDvx?b;O0uXgFbYa83Ea18vh!D z){O@BHRl(GeTJjIkLAj%9=4>8@m5VHQD1J0h-20fZVJ%c^-4xRZn@jtc-L7pdnGU7 z(%E94wEVxN7zIK^n3I{Q3c(~cE{}cZW8x{*$%#F7K%CH;Z2K$mBVhc8*lc)3U+7H% z>fsA`q)o;mpLW{bie3geEp38g)KKa!pG&+VaSXt2{>2I?E0rgU6f48(J0kd zx={P_ek4xlSm0&*%bnJjPdA%W%qg}h8*=WDo?tl!26m)T8eYiPv-F2P_VPB;8jF< z!$vwQG5m!;PBE!qdPS_GS-cj(DbZ{0 zq;K^iY+j+1U9Y20eYw-b{HGrFH+hb)0`s$8kT!AND1K#^4@e)Tzkg(m zx_hc-qdsh0w(CX93EfFj7ivP8l=Q$Aw$?YohTaB^q zp>bShaAl*#XTYZWy*S)iR}?$HqRd4w=tk|gTi-YSmcHN;$B1T77?KwslH7^r=Cd~s zI@d&Mst!h{fxl*Fchg5uom+Xb<}1aedsd$mwSVtE0y}-D3 zOQI`#BZqyK3(z4P&7L^KP1x9WfB&s3KAsNp{~N~pQc!Vi*j2<3wWrqee4dsmFVteI z3I&u-*f((*?~8vK@LuHCI z_CA-rrB_9p5_mxR)!9;pXCubb0i~6Ndj^k!Y4$P zbQg<$3+dSA%F8~qn5uyMG7{~Xe^}GK_#GM~QG7sE;VTaE??_RPZvQ&-(ObDja_)(Y z*cC|b2_`01q?;nUccl4*yfyzidLc%P#*1mTsuwz&dfMG8IkwGfb+SzNlupww_y)ce zp)))J$jBcg)h}u0N0)k>IXn~j;aD;6Y8E=gWZsZD2bPbF~`Wk-Z)91nBZaft%C`55)`V213&tfX>6 zLLqsT-{lA1Yq}%CD7+gmQ~BccUQP@3#y;wB`MsOU#;yuAt@R4)31a*WOb^uathO+A zbFSIArb*>V;~E-_xVmyflyAAAQ3kn%3sq;W1~9JMkTq1p9Q$v)$}|NAK*JHqej}EL zUEtkfS&688@??nXM~zOB=!av8JT9j`UfjYsj1Xf|eS*2)6}NsU!EBy*{RBK2n^@^y z(%^coXZ25Yj;hp85qJ~F)~_zO)7{df$92ynHzG&0dT*#Fd;l1e;TF-|d2(IC(XoyJ zDWW=g@$Zyfr!4g9rJIEu4+V_(WGtr~;zD`K-N+cm91)I<8JQprr>i;rju-rsb}U&{ zae;`LYKe@^gz;!3d08_ZGk$!Xsc1{jGY1tf=WIrVY;XXBTizWW%N8@9qI=xnW{Ou_ zzd$lf6_nu)onXVs_e{mFEEy~LEOo+Y@Z|B@shpNEEANo@$Fwo|a_CP=3OMjYR}L6Yw{;#3AH~ zki1MZbR!P;K(q49e8qy~lWRM7Vu{l((M8ha)nBQFjpUzhGBDe;b?sI1KVitFX zoG*^!3C7?*4jrq7XbO&v5mx=Pdb&#TZpDnv`(*uQq=agecF+4W)^#M_{GeNPsEFI= zZvwnwjw0`5c9TB5(jLgYT35R;FR-b0%IAmNSET^+36VSX#?eI@7p4R=&M0BVKINot z#^vOy>wO%pQ&KM0u2=3r`bjzrQuO#=2>r{xT`L;>9(Q7rt>)2tKW@1SV^A)`kl3+!`gqIu`rx{QrOI(Lu2?RY+ z?r6$;8+i-6s@eKbhkw~Zs@t94%ic6U46;j8TUeG~5_Lh=B4+#TbUCeKm(&jrex2X^ z+Ii`y=Z&T%uKg~Di?m!-&Y`E7T;$lgy=ABC^26Dl7oJ506x908>4$KMY#DGO6y*PDNhfsxiyDN7f88V%Zfb8*S=+d($F8j zoJhxqF3iqw7akHjvOhq>70)yZJNJ;(PuoP+a$JUlJyeU-qBBn0C)#q%LbOY%-GS@= zf;GzIS_|m}h5GgZ<5Go&sDSq7w(9M-7yhsn1s%LkS~)1T(Blsm{Bq)G%3$-z`%@Ft z!rT?V?;o{z=vHM!<-=(G?lFX(_6OqBv31S9UcoI*A#T3+rMgwt-D!7LZpv#hJ+;d) zy`oV_X%$>$?iJWjYu*y0@V;zx`i}EKxxtLE9$U{pZy%c1V^@zD)^o>Q+5CBdA|EPF ze^FFG&jDsZct7>N?@vY7!A)~H%oi?(>kz~bWV<%s_o)fnIe+0p67UDq?d;M%caH~I z&`PFw*MrJ!!;XL72llS3N5eWznbuX5<0Qq|cP6ek!q7?ehB}_ z-rv=`DaUvHTYc4{3LE#}(dpN46+_GiUHjHdt7tO7{Wt7PpHRmdp3->9Mj&oj;1|khjoC#ZdKnv6(7`s}Plr zurSv#g%+(tKTY#Wh>tvY$+3X)9K?L*YVD*glP_quuxOi5pX(S$acRrUiRuQPTJvr-!p^RGqe~Ic6mAJ zI|rzb-f>WUSa1A?DTdOAt;%n=r%EKQE*4XkAF&0l40516+HvE0 z35qn!_|W~X>--nmybe3)w{H2UYsPvrvM)C|n1{`D~!cu|x z!ArN<{+WP7W(744G0;oezg;bmh1o-xk~p2_T(qZT74QxHy))ht#rku;;Ls|hn2pAM z{Tln}?Msu`cE+L1i2*N%*h^0qBu|c%Bhc2R&qC)%?*u zF;+|bg4G0p{)O-UkH!P?A$bk!$$)4O&z*gTy=2sgNKfg-^~rpU+?HA+wr2S4Hd4E(P&xvgfd)hdt(mFm_^nKvEX#>{1T_l z^_iPFO*%}j>d<$HPk?%mxm7{iFjY=gfWD!$4!ShroFUX=Jm_M1)CS1J%)Luvs8k26c4;jzmQf$E%(r0z!R<-^fy^GBRJkfvT z4xq*87(WqygSs^$45xAFHrYNK^{e%UKv!R_(%j2%(jx2}Iu+2ivxvZA@aN7!KFK?5 zZx~}btgVKX(7R#JmKsLQm=ZvwHe4CMy{gTC_Ue!It4_EW4KtVo% zn>NE#GP7uA1!xENyZ7%eT)z>+>X)qjXWBqEa^2dUa~hax2vpO5ga_Ovsbr+W{`jK2u@nj4Vd0gWu&(ER{aIsZ41r-w zX0!yqV;}kYj8(B;o0m1ZJ`?8QDuiT=hsYD|gDKMctd4Tf513-hxlVY_q0u)>M?8%= zLmr%I`QQc3Ne=t&@?+GnwE|*u}$;w92-wR0mwtQuqeA<37~=Z zylmT^-fX9Di;df+9!UMX_Axk?No&VO*@jE_r^XK-QYPdO!Y2)u{p@#W&RJ42sxI&! zcSVpT&0`$GOG`8ZzSt08%LX@oEf@lK$dDLf3wC(64T3J!ZGVmoT2ea_dc1G^i8z8^ zIX{@VY8R1@UA*%07S94=c{yeWJBE)SO5R?KsWxQqsKUN_Q;gfAMOb`-jZ(9e!yt8@ z!zy8GkCV$z-MhwqfnA&MPMjBe{!UPY)rBpIk6QLlJ?cq$bLZ6_)BeUR$3cDf`j`o; z2}qsyvzwQU_K3{*6{akZ-ZR2PhU}6Gp!sWTBw{7==urKGeLGKg&hQ#}m!f=Niq>+EJUT5iNa?~efAcYl6?-Jdx&N(Y?; z9Q@lMCWSCaEgrix05ks?hj0-``RU1uQ@-YdJ0l-VOF(J9f)OX-y$n^BfvJ`^KYnGuq48S_3>rm}M3$_@VgY_|A!S1@Qn|DHaq@_Tv$_ zltA90w#l%BaPIq|@TLcHjNSHJNj(+*)_F^HxA()Nk$*gE1hW|*MUugKNGAP^Pg>62 zly6eXD0R=-c6ZDNra!GjUeaT*RvA9AnBS~(szMEV7uB&i8ZRqAMToVru&yC6r zsC9qVq@Y)Ed{i;Uk7A|4v_HCMf;@D)A@%kft(r9uGfI*u;uzeLW42bfrSW{WMKDkN zGZ-ruGWpxGaLv**x-RV1ctsd1`&@{Z@Nl%YgoOkAKEv2S?Hl zZ0*h1^Ng(4=;O_Ko4%CxU8K$(re1E#KbK3$`(iU$lFc&s&?hWU;sFm#Sp|G9R_6ZyMubU3U` zq5IUwq}Z?6qc5yR9NL3ksUGX}d0#&9tma6??-E(<_(7sZzld+)`)|EAS+S=al12;} zHkY!BbHT!enbZc2N1|}t{@FKRxS;5q`|cx?{4Up| z^ZmXL(Ws#T4pvi$_S*%&h$S{F{3NX0-EwtT;Zmt` z`Vobwlg2`HQVP4a^^{8hIGhnLmFs^P^XFhJOwV@Kp>8I+H6glSxvm&oalGRvwxmjR z&&5f5c1d)p5~5kGCef1>rn)-PDq??>0_@*5N{#WG##sJVC;kZukv}U9R#S3LwG1Y=-fVwPlXW-Kw-2sWRoW27W3pv7J}s9(aTbF!igaLg3h z6Trt@k){5$jk)P1;MQ7SZ`yvm7FF8e+{c7}6jr_8zmT#W-*w-pGtc3$`*o8m-!>qB zU}8$X|9_qJqq-M+f8M#cCEwNZtZHVOf7rWu10yf0&@SftI=e(PsO9>{KVkKsf%_I< zClI0u^`utnpPgXUG~9l78+ zodO3WLXi=mivV>AHuImf5`ONwDhQ^@P9=^51# z3wHoPR-fi`UcVH)l376-Wp_Jn0W*C z%Q2oa)nvw(1*L<*kn%UO5XQb^nMXT8Z75k5ab6E%CiWCJoOx$`&P_^Pv#XJ_EDDeg z2qk0{ayf?VCUwf!`^3F<*IC^w*F2LR>kvsoe;pC!3;0~CNgr*VbV2Gl<|AqEC5e4{ zvse4Xj(ZD!Gd9|7&AM&doN5dQEK06KI>)s+)_J2hQ$BG+O{na>!GMH?bo;C*z2gjG zt(x)onJXbg5^;F!M*@BWAb>$n31Lc3>P(mtvWwWQo})05(OkGK!`9v5edy2I7r$lP zi#|^OB2SE8f3IHY%#-j+X0s*FsR%)V8TsC8Q#)k%N|V@_l1c^p+=ee&tR+6Y`YfY0 zmgs{4I?S5f%~SgbNw4?*RGyERZeBgJd(}hoOs+bq*X#O8DI9F>Q7+_Blj?r!mE{I8 zCk7dN=b%YWXFL|;uz1Db;T9|anFQF;Mh0_{Ee0!o<=L3SR=Rlcv7>+mY=ox6vEz+7 zr@Ms@dVebz?YgI#?L9E)S|=yGn2>-wau?b$q2mLyzTQf=&LhyP?ACx=-kjnIS$)PN zfy|zRxq<5HLh5SxUM0*py$`@Zf=axcw_AaE$RL|F)E%bZ57i4BQx{5oFC%|(_jTjpjL%u+2p@o2UFepW32zReIbO)@u$9r0ks+Q_6NWP)&pwoJJ} z?D0sPWQ8K1XWTpHvHfgmd7gDczK;88g~RMf=XJJTSRf_G+G}8CMfSsP9+rZVN%7c8 zO3rQ%FT>4Evn9GNRGVrZv3I2Ju?YJwA^1)_C$A*mms0xx`MQjgaZp<)QLV9{$~edM zRhn!RKW>^g`!Px#}X zkTko?+RmB@`m1aBbu1m&%fCd${jpwORA1cV@%vzR_XWmUGL%hvHR%Xn0+oziBi-Pf z$4celdr51s)oPP&76mCKMm=0NYb-F?f-+F@UTsP#DN#37@|Y`uNG#fo$@`cZ2>Z&F z8KvNur`HwL9(Q>vc*DmP01=&LB*obJ4nC>`Jf-#7vpI8~vW@pd;EFy;Ex7w8Xt#Zg zOLFdb)?s-yYCjA-RkVq+A7UR0SuW&MT{`N~sGIqBUnq%s37g5dbEc$oUu*P;*qsOb z%WEE+ungN$P6KBO?u*~=CC!D!TSMdNMxS6r9H$<%va(t^p&kSMbC#r-kEwT`RtiRW zq^^yc*jnf2ee^alNFL?i8x!Q9m`#r=|JiAxfeEIO0q{wBgN3Z=LeG*7&gKrP$tcv= zc*rR2k3W?ZTXmL3gwkk1kx4az;21DM5|T~<~7 zlf!o1MDxq$5fTlm51un)=sBwiu_7v~Jno2Jt%xQJy5dMZn6aM9D;^cQDPxXzQfg#p z>buaEkF7c#Mw+yblccLMO^+fSSpVEAqWjy{tIl+>c*!Y_YdV#3#kgXpYBD48Mas;4 zMH%9zX&|lY!G=M6ygYPzHk4D8r^OXt{wA_x7vt?8xYt=$c(PA3%r8|J3vue(wMT8e z=xTR@JLtb*4l_3;)kEenxMj1*thWDWB^XWz+X*0KcTfl!u7_#^&&_ql+8E(E0Itk1 zfbp3II8^mWyVE_}&_54TuRY2|Emf~`Kv$CnCn)YX7qu#;x1c=YqWdggzkcMiXwhs* zvyaM@EM|scy9x~Z92tfn?iyJJUlcYXX?z^x2|Jz4_3nTLWu{(6l4HN+*Pm-u`AY5q zAKq4))G_Bc8J|th!Jt9~134A5vt1&t3(WrdfB@kB*f@lCc{{9x zvQZl^5zXsrTakaBe3ppqe^?oQ9Ms1H*dBkx?Waf2w8vzv>?p(swW(xuk04l8sw64R{yGr&m)Ugo_ zJl=AAPoZE~My){5dII(Zgyon;>#Di3LLI`giKDiU(ii_0T_50SfP3zsPdtA9^XM^| zu>*(W17*%|bR)(L8V-4%Kqs|r+df?oOyfji48b4`0v^dLY%%YI?DT7xpy_md7?KQn zs?-5p1zyR|3X~mY9Tr{kNE6t{GpRF?mk*rIm3F7Qd(#SP12!|N9we#(RuKlu4&j!> zsooA?T)#1o+CULgprcHn~7Puff)D3}y2n)BXkNR&tiukrh^)O!54pSU z!ztX@%E9Nj;iFGUXIL@$tai~WnGA)e=y1|CpnJ}qgPP38 zjL!)#7>~LO%rtqRw&@u6wfkGL8`*|cm9ZyFMuk6~ zJ9~DMa)0bf)?+gihWS6n7m@NI7k?^KKQ+>@Y9=UPYBxRv+D`4)8dP}Bdv}90h+8wN zpWR%P{Zub(W3$(L@4fN`%8&;(bSB$@B{GXKv$hSD1J2r)^%$(J`AvJi$R11( zTWVuctrx?b(RY*a4`Y)k3V7tf6x{q(2?ivwrs})vUwm}+>yMPRovFX8EVj=0`&riG z_ElM}IQHu&kJ|EZeaAH;WUr~PFS{fPJ#5>>s~)~L>rqFQ)W7}+Ju9;)qsO_sD~cek zY~Pqe+qMC`Gh&EKaprRxG+IeVyQgoy^$s#!dS@Pvx{H#fTi@_y!(i6VPT3)p&wgkR zPZrQsX*<`O__gv6W~W-;wWy`jCm&{gGZcoxChge2k3A#_<>@;TJ}C_5Qr9^k(7Nh^VZ(7GE(!B0J66Zyx_k%;@O zp)B;I!puMtBaFO5yOyccZ$yasF!L#^hV z7!q*Cfm0u0g+Hne*vR?yCyl32TW2@ALx6f@_J4R24M^gS^<@KPR#6|I7HhY0^(1 z@ShWa?=uphD$H4+0%{HsGkb($fkr;-<#T>DN2;igu>fESb!zw2I{CS8xx^2%x2zw) z#0|XVh*d2={DkO?=|MYbBmn+EH%nETzO7va#XwQwU~1_R=hI^xm9D4UoH@4e0Yk9* z@o9^&iFlN`^uqP>ty3$*<~%t%$L7V>TW5c?9FnG1%!(wsT)P>Q8KDB>y!F~nMNQn( zi&AaAt}<#S-;wN-`OpKi;+kX2m0NgXP!`*WkReMu-2T=M`WFZYQIQ#E2+I?8C8>R< zj;>{>`DQ-qQr557uq!Ds*SAP3RwI@WczYZ#m46}qrdC=ztw8qz>f(i6VEse+#7QHv z{zs)iuCS17#t58AeC!T0VF1mMf(Y;8BaS!r+Nb%zF4Ap)k4)!Uo~jKfTXH){ywRk~ zl?{*~H@vPX%@uAWq88*)=8s6zDAj6Jjn-r=ngG9oCfdvFh?IA0dyt0H4V6(z!_+P= zfSq2Q1|U-QdpC}(qVZGa9QCy*bg5C}Gl_x%^ zZQ9gTS*;Y@_?H7m+fPM71^pZ-EqLD5bs}f7S;75Y0nj%{8nRM-oD;HwCG@iaPN}gF zXiXXc2KE>t3Q!*MN#4gDdKh&3(aN;$_=pegZdcc4Csc^d1A8m^y>P)4l?S#LoF7y< zT;IPb9Zh}o{r{@qF>g6S5r&9De)#nnn>>Ooczao7;gkCQLlYwGfabaa7;O3j!b*#p zj^`&YKUKNDrF5(n5TW}0MJK82)7{xG?`PMMYXfXQK#0<9am-_-!Hc2N0t8*#f9wA5 zVn2pG9d5c*w;nu(Hjp8m4tnI;&HQJ9AOVQQ_hi6xD?G8|m)MgDDO)~>MIXZR>(6eI zd$Nritl2UwVDvre)&8Wh#T{416mrUQdf}m|5ble_8d`Q~*cY&Eo>dm+D^@8#Ln%<@7tl zogO^*ynkG^%9Qu%)cK2Xq%p?!UrF}kGN!MxQbaYFpBtm}`qgXSuu@J8@5){dd;+dHEy*_pz z<5nCqlct|QEuqWC0%3t#_)d+SE?s#Mp~+e!faVt;B-wrgyW=o6$U;4Lp^TXoNvzW` zAAv6}T(F=4tf(z;z8x$&|A(*Zelg%7>#5rz3fVCsQ2-n|tTxrHUqJQ5)kgu5Ts+5a zL|$7rPlD^Y>ALBIEklA$z@z32+`MUk82v%lQ&Mwny|=G#Q8Tb~i~^*d<^Bu1YpS!g zo+1qHl@r?`*=3`obD~ODf-ch{k+x!ivhA5v?gu+tuRB~G_)MwdWB=>m6FDVm=gJ>< zquYQx1n;N=9h58h93Ja+fBDiMSOiMn3~M_L=%*2W*S_i=H-Erp8~9!2)VJM9?~jQH zDXw=1NMaB5@{$LL%Ujdm+rJ`Ai^`9|Jum9D7)&?bv-uTbu@t^J{o$ZX79`>mpE^~K zz@y#;K|UVov??(pA0N-+AG%jrWF8o^n$kv^n{J3!7zb4{Rh1oWR)zeq4rz& z(%K6<5cmh64cM0d8!0f)8SWoQ6V?-Ns_zl*={awKSn6EyF6UN2xymJ2KPxvM5EMpr zF~W9|*bbow(TeF(6n*b6{9+vd-EQyi?|&N3^?Ex_g7EV3%^w1p&j78ILumD$qHh~h z6Az};Jg-*!0SBvUQNi=@w>3dn-_vU9LyWP>(k@+H+#FKwz%cK-viEvsx zt@AnY;r&OX)NT~10+RHcs4KnWlzk}+&P z|5x}7={6LspiZ%~_f7J$Y4>d@CfvVEYJxKx%RNMP8rN=v?EcDHT4PS;s{t8SsgrV+ z0*>F#_H%n#a6galFMpu~Z{R*{T7Ad-kj%cvOZE@wOOk)*^`>Ol?;I`!g4xNv8mWM7 z`m`U2dZV9tSJA>(;k#1hD#JFs8NUC{>JV)rC-`)$FL0Ry;|TC6HuY_7{e9g6FwjTi zzm!`^fa2lcfK^tS-Rqy%qO{+61?JS zYVkxoml2-A4n1yfA|(JBgnSt0jZH{oxfw&v5^6@8Ey51hFZDMzai!O5j|r<^t_fBm z{bV^n6cE@gMo_KWn>_#|qOA&nGmgfHPL&dhCxNG@_+ znU%n@P!0H&WqBQ6-`q&85EIiP_idp7S*!=;J7SG&Rxk}{@khY;bmahM%6frZfY79q z$X=DpE0xRdQ;67lCPiuxIR6r#zV*X#KPv|HmpN+bUIlQD2-iGs{K~B-zrRIX41ZMZ zE9t+K=>#O{sC4Gb4b#x=r6V7sQdhuh9l?5TFuPa{h;UI_nwY?1##BzZc?YU)w9$|QxyyBJaD%4=JBc#6)S zh%Wx!=Dj!mDcExZ)B4Bz`NNN}!gi2aXm^2Vmn%nknxWuCEwU3UWozI*pvWN< ziIO5op$ZBBh`*TVGso&vuV8^t%`Tw{AYIKJTB1CFg|DwKqdFU~oePe~jtB4AQikw{ ziyZoTf!Wm>LGlZ&`%|WWu2!*UN)))68-^mB(l1v*@-~0|{63&NSRa^>+7G+{HKW;2 z3#x#LPNE5zANs^Ze_x6OF#IPYiW$}!RZ1CU!4ge?aepNIxP9c~a))=L0H*)ucwYCK zeDJ0!sr#O00rq`^SL=jj@OvQNpbhu%ui2fZT+pp&NiAxu>AT_r=cLC&>PlUildXLG z(mQvP?Sj+&6h(!x;Bf zo)(R4&58YFT*I;Nf$#4Jp9&rVViEH0P!p7Eu=Krr#d>0B(3gIjAF`V~zznnL@gw~o zP%VZ2&uhXy?CJPR>U1!H%S8Lk++I$!Dd_#_F)dQSDeUyWqc-uey76G^_&$MMtEKKv zM@@G}IYEMUecO;W+6w;OW?;VIzmqTc;n>EyOTSU_F@=Z#QPf!oyd7S3R=>+loe+a) z^6k41$x}cxS*+Mor1eD&SgQMhZ!2mHP>2XWa;_}e(nZ|*y?EYEK^cd0y*7iWqlEF1}K(3~TYo3Isq_>>}k$gQ8x z^Y^8_Sd;;SsZGOeJ8JW4?0^>c4Sr00A+x9~nOzL*2!kpwdwOssqjCa6%z*Hpt0H=U zW}ryT|ggokZO(V>?(&43N z;B8f(@!|M-%QS2CI=j6mAcBjhdIsJdY<#Oa(RbL?$|pWijFEQyl{>=#UDM3l-9_?P@f__6y0VBf0Us&_c_F!J=!mC_wC!=kRGD_gvW zMMD8yck02%wbg%ER!O94y25HY9kGla&ASe$^a1552cOC*w!XbK9{ItmB+Ex7cHO2; z4v0ZIu_)?y<&i!_l#SdvsOm$HL5(R*yh_7&0Ca7Ac9F|m05|l2$95a=zft0L3u+Pr z$6O4@b+*#emT-PlR7}eB>%aK_==$<_sJH)rCd!gfmK#}0vK1|sB8&oA=bZQJyk5`O^Ywf_ zdSv-*hdUPhhKWFJC+_6y)bQ#ks{0eQ`cN_L_tOLZlqSi>_Zc6L@{_p%{Jb;ZUfQb~ zNGG~^Qr7auoV`^z2tBI{naX_T3y_sNI4yk}W7Zq>7;q0&0G0Gu{<8=QZQ_gB7X#dO2Dqg^x3Xywi1iyFcS||V z1chP*PAq@_hgH2u3mG`VJ5*3wvp$V%dUH_VXYHQKn%!*8cbX+?&4XURQwPaiM(ngFi+X%Mqs2LOMV=aM;zvt)9Sl>ZmzjHPjf z!5?AxvAVqh-uLEPfsyAeS&EbRCpENj-*>@Q(BmrnOoO9d-W-~6A`E{ODPsnKQ+B^Q zzD|s~|3OIsgBo({9jLmnMcvtoLcq0B{_m=g^u+0(;K5YyaGa@|<2kVbY@}H1L$y2# zKOW0?(Yw^^f_+grd_NY%M~Rm*rvreN@Mo~fu29kmIh!ozdjvGOS1;Q`E|Js98zai! z#^S8`#S*1c*t=vB{GV$qH&+;u)-^ffOfgLiX-U!2TIozcCTCktwND z_X8Op_8jDY-J$M5Ljg68@u@*+@f4KxI2j^CZ(=KL^vx~m-Z6DTn#k@; zLqRp=Ay@7pk7~OdU4qQiO-CQ{x)%Ttxg+aa(9eGaF4%DtR$zM?7xdZ6`mh4pkC9F1?GwPQN_>C6;aX0DjCGla-@8)dI zh4R;cuSHi>IVo59g=H{zW0|C`oD-+(3y_R&K;)if%*lRk^kW8^0#gs=W4vb$UK|)4$-c+&Tyw&3=^4<%*hBg`mP2Bi22K z{Jy^iXU?#Ti2TyzThC-A#BrhzR^kq$s~ zGkkGj$s7oQLq2PeWy}elcbHn28vg~Hac;a?#lCSDUZxe+ai`7KxBh0VJ6-{-b-kRt3Ua{cu3RLU{{22M%0YHiSQNm~5n zY?#j#IO}XU;vE)~qIvsllzr5DE#5eLWG578MlZk{HqvZXNix=wJlaA4#Fhz0W_MlM zMot%uQ9yp+&x_U+YUia(B83Q*G{QTWWAFvWOX`Ii)|=!YT-OE^ic=`Zv~vW`o#lC# zE4V_?Bs*|e!zNOdH{eR z&+UEQ1N*Q1rdET8{F)3U4&dIX`<#(c6ev|TMfB5W^_F%Xp6be-X14wrqPRR7mGTCZ z>USKKR)`0zd?(WhUiNb$fOpkjpa*~<|9?(%kS?QQAmpf@@hIOaV@d14%o`Puspwv* zQWM{4sh`>PuVE$4V+9%?S1#TGJHbgS{);~qNe{I9zvu?vsT|=e0oHC0=6IS#%anLN zOf&Ta0B7P0Myl$c7rC9^xrep{fRgd0M9;M`Y2OLu^$ukpp~0GIHxC12SKnqAE8Diy zOeZ&ib@pEsS5xWDUEiu^J%*LahzE$Cxvmz(K3u&z!yKcV9CC1zV!g@v3I~GMLy%QM zMHUFw)2+T($REWGO8exdH&fSrd#*oPE=n<3_Mf?(Tm;=SpnTI}rJ-XcVQJqf(xrH{ zq1?xu5CQ8r8f|W2RdrvFi~(?>-%xV3=OpHs_>L3VVm@o|EqF##YX0 z-a6HBj`MMtmw;P_T6y^RDQkP$6+rVc;?^w)=znWXykoSKviV1?6#b`4Irw{cCTPvv z5&y6P?%*mK^BuIdpYalqMyajYT&;oL8n~}4gbV`b2R`vl;753WT;>2v;~>bvWB3w* z@9Ir~b&~pY|Ls;BAdWhe1B2`)-lTPa-{&yrEScz{%ax~V@VygKF5@yh=)66VZHqHn0jQ$rW9}$f3{oOg>Ib` z$YUyY{X*TMLlQDpb(819tr${uS793a58Qdy$p_q43^EsAr#wGqUl=HLNj=#l$|6V) zzU=Art>B! z9IO>0xi^)4zUo47kT-C`skIsr5}t#hSRGQY!F}LDtH5> z(>0(I;ma!Icz^Z9C&~c`0bK__wN&QZ2m)Cri=F>`;!tt8|ELh;UKhV;>iA{lAZ`Kz z*n)mO3M!~s837c+>JFd$=TE5I9<-}G)SjG%PHiB)i1-P7q10k4U^886IBONM5WV@!tggRlTRr?oc&AxB?p`#I$qJ3L z4)n>&3+anHZn_^NmcZzfayoL~*Y8`-Zn*k7?6Y{RK>3xFy zkRVq{tyO*6&ya;YaE5cTlK=WxsB+pLfM2q4*2P|mf3Y`9{JnNXs*1yT93b@<=bJxu zI)AR_cE;UWcaGxkA-JT1c&-pX=mHu)ZdoJ(EWrw2(B;^oW8LC0wMH z{Y^?Dys15N#rRS8wR0XmfOvKgHq#NA#!rR3wgWO+9Q3Ex0A|60yaO6vC+UHM>rfyy z`vwoBBV_ElJ}RPoiay6hdYQl!eDFjK7|(&7;}tQ%T2*YJXleK@mbP!`^~%PQf> zu>lm7V}F1smibXPa``Ez#04Kjn&O;|Y+4|!WFEE@ zlZ{%29Bl_5ukaWJfhxMuUA}6rQ6i<#i`i}zF%Ep3_Tsc=lXTS%oB;uxKVU%*>B*SA2QMdwhkPZ6QuDR??D3)D6jMM5oN067p&ED%v>rU~2z_ zdnxD&>vO&&D2o{mWhI$!x*ShonzH{OS_n9Hlv^>mtpA@WvK(=E%}$^SUSrNnNY+LL z6i)yKoR0jD=8{$7;^KzI+YN*#BK6Z&+Ct!@m8CW%Bc9eCOLV<4@;-DP_L);x8Tgk& z9-!;XtwAL=x=ZRxbL5L0F^OSoY+z28 zvo`>@sgCuKf0CHvwcy!}x#3*cJI=dU_MucEiVlbyz`FX~i?2`_qn>f^fWo(ed!_kM zxf33^AOyw4xXy40=vrK#4I0AKZ1_s)Zh%^U@N&dF2#qGs+znFuhrnIo4J=R-)t(bY ze?Tr_P$_N27iZ!1@xw};Ea~tA;IMTP)Z6*&JvEekkI+vd+FAUH7HlSJL5Bs)To*`f zud)1+4CAF|_*lwJ20%;*P%uIwlSm(Cnm1xXY=l5!Bl>a$stWEUN-s}IX_KUs4ng@* z+8*77!PWP2)nBTHR#sOpk{#7%zX+@i?@8F34s4Mhjq?T!UVIS$u?lV>Xg|Yybr(Cl zR_r7gf^!ITIz4&0W4keCOu$t}x*XgB)OW%lNG2C7P`iI2p!@!8%}@z3L-)MDBCEkO3k7}{Ue16g1{ARkcR$$oqF3u_RGzEFaO8t-TQ zCloT+XE@P=ppDd==m0gfq3D$HVj^maz%T;}Ylq|j+2Te}OWQMrES=$$&TFFpL==R7 z=Rj`~@^hhGM%xrHTH4Uvr~nAti)CO`+gDqQQY}^1M}K?*0mwqaSYW03VsiLh$|HVf zp5V2j#@OkM zdl))JCc9jFxOK}=U_Q-lo=G;Vl{0+3e?SjV&JU<>zaY=${b2AV_Jk%7ZBtpS+r0{8 z$bJ!Y(GxIf=st54rScrWwSjs#mT=;G;?UZA=6*#GUcS9~CRwOfH(cinV&u$=&kg*3 zd6GX(gz(`Ucab+h8Hs~pzBlOWB*L0>NE^|hF*>5CBlLz(|1|rm;44;;O+L3Bdi$W*hBw!nycsN^a|j7<1vk3)~$Po8V|P5 zmBR*jK+K7s&<|$u?kVeHH?+)Y}j>WL- zUZy{J#{_sh0 zso$0on+YIa`{3-uOp( z?VcsF%V^MAg%H?otrP(^2y1>lK zg1-cGbwL1G0{_Xjiz2?aR9BTT0lu>?%H))nkg<5NyM^i4CNXH;WPoAC*@4esd{TN?KK&F+R(#6+_ym7+j4H=kOB#P zud+rH{pjj~l|j4T1y=McuST&!>-!KbCvoa2f8#m82dR4Gg3v01`rSd`Y$lk+U07xV zu^$<9>S%A_NVu|6LOoTO1ztyoIBw!4V@?IUV?Lxt{c-PX-8nl{9FS}?ff6wjb(wSL zHSkziXDA#?2W*KQ0N|M+cVPwerH1J%1dyG2RyNBJ-l{;(E2?DgmB}erYq6@l`_}0a z#e3I3yuk1KJ5zU9n38~n&h%Nprm3v;3oR6|h?UM4oCAn)7smo-4@+d@?zn6$lYQW1 zdYl&aG_$0Kw;5Rpcy%uh-(yYSm;4D50*`RzjWQF5BIMDS4u)0WAC9hC)YJc*W(Og< zA5B>GkH#=db}(!(eQm!;he7$`rW+-&3;gR5GKo*V0SjR+`CW-6`$9=Tc#_W|bqY2iD(c<+2Y*JECm@}8@4sC#}?sAQ1ayfFRr9 zkix&R1el&rtRG?2Z=-jXQ7e~PQA%5fzEdO$^JpZN%yYv1;4;I@gAD)o_adZ$B3S!^ z-ftZq!EjhHWAI%d87*a6_%0AMZTwWe@H|+Bm}9`tx(|ZpIz*?T1hSHS%t*HSSZo=c zbmTJV>;b(*wB8`KX?xJ&)pd}Tivvh53Pi>c@<0dQT9 z_0NA=aT&3rld0e699J2*fDV|Obm`5QG!Ok{1B8w^=VOKC-$ES65BJ~}K=4cU?Aa`C zNVY8^od)@D+!FkfE&56fq<7&}@oL|nKSv$h4ZQ$KFOBysUV`q&^0|9s0M&hk{d)mS zV!Lh+Ab*}KugSeY9bVzE0GEJggNs^;)X$dmWpM5@XmbDC)!BZ}&tPgZx$4vo2(`W1 zk@VN7qsiC6U{?UTMbp#xQq0TdjIOO6 zMrfmM+Yz%qv+e9S^|@r@w5g7UILTh6?PCAhRCEAsH_$S2W&#u0PSJj$FD=HbH33JlD*X;+>Oey9KKg4_pJ1;fnkw&10v_wu$)dgw;VF$>2Vit6 z@u@ri0x7rhlMiYrGtg{#2Bgt-dMzwYI<(7EXI3n#)kQE#3JnM~IGB)m z`G}U}h@F{yTIX?9WKxp*zh6 zjo{qK_f$!GA_1K>y!dzMoKNRd&$*Tl9i&k;^#U3U`_;Ax4q+r%fOkaO1)DXw6l{N4 z>Ni&9&_z?F0l?h46mY?P7KjiYR(kgEj-d$aocFti#+_9L^uo}PrQYl)NPZRMal&wy z#=`{BvqfOm@ep4+H$(I_o36D`+C`>n>r)=4PyEaWFq3x=al2wyv1$$TQ;lu6x4$#V z5Jma#Gxy;c@C~`=c2N1Y{w-PDB!;dZYl%OG+nuTV;vnlB&*py*vaS~`o|sV!2vTCY zXWWsYx3Ge(kPZS0jCw2teA}L9fS7f})!l6&T6AB5ywj2&x`-t&}!p#8@tP`{KK z9cV?!olY9R1j;?YrR&rMGr=7bfKO4cjpL@`=Ft`74`-Wwg3W>7p>o}ObN;pC;NNEfKj2@j!YR7$uCcA5 zYQi-^z=w460yE1Q%BFeBCV4deV=veo)lpkJ`{x^@<)}}Mmqh`1YCM}hP(QxoRXD3c zJzo$7%~7}5d`_S0>_&~p;N`A6!UJ=Hx=j~_s6A%gv%y+GFESH;kKOSqN`L1>?c5E9 zYG^$I0M(_$b`L z%+!d0f|tN}PMmXM=5adbbgrqL4ZRPnsm(p;7UTEUF9=Aj(JD;g+8(%~eteo>en7+sVku!_*3 zLsS}hxmh$g3lmRoQ+c*Od2k8cwSRr73m`f^I{Q+C<62x<^aF-bP1Jj8=;64CZp$jK zC(-9`b!N~#Fb&pvC)4(2Goce8*t}f|YBSeaWzPyhg%v?iqw*h6BXw!F+5W!*SrxQe zL_hT9J}hVU+hWdO3q}G^Z~J3O(FL$j*tw_>ICI}5{GVUcfr#d#FiF}uwhxyCC(kOJ zJQ?v(Hv6}&5OwMPJ(|P`33!JnB!Q0hzeTg4&qb(&pGobPvo?RLDgGx1**cG((Cf@h zSOs)`KvC0v*Tt>KmTp`8zktoJOPIO?18m^UcpF`*(pG|2DB(ZPSA-ueJ@S}LAr>p; z^T!zxdWU#0D{o9E+6TdVF%}Y2WqG4!YX5FSfMcY1z~-NwUkBF!^N>=L zVd>`7znNw%psIZDoZ?PqX&#kxl7hw688;@L$ID`R_|PD4J$WQziBa)GG{RN5M`;#_ zD*Y#tjjEtzf9;SHAYCNK9;IykMMO1?%n@Dr;0Mgyu^1i1w)b5Q!_lM$AnA3TX*0ix~$vh0R0@M5xh{hAKm>|<%07hCocMh^lX6h7^R3Zz`8!xZRLJ~D z$i<4@%d$}3NKI%oG49Z;Aug}e2l2mNioZwoK9qw8_1ut(^iH^adKfN|c;NBwuc{M? zxesof|+quswU67jgMm8myJxBNq_Nx;NvDIzdLuYm>+G) zRxH`sWN2f4>0~in0tX`e>2EPJjz66);u)lQ#+1Z#rK5K1fw}p!^c;@LcHM|Xg7Qc2 z&E7#k(sfWdeOovJv6t_!zdjh5J88MoIWqh!se#@b8e^n#r;ajEbuA_veVQ)LJ2n4# zP@vbnV|eG_Lf7y!{rL6*2cKs;8d{LoHh->W!V}w;kpme2N<9->hrcBS9DC$mq>Ofh zrQ&z$$%o`xejlCfKkd|}qgTM)?h5;sTJ`DZaA5lrk43es?PRcMZEmOk&~k&%()Dbc zP;hcx7W%7NkB}LnCZVN8WG9u=q<&uV=PvH2;gbUo98e7Wh-o{W z1U)+MWfk1-kN0pw`bG?f*Wj!d>goHQJ+Sc;i(mu8?p1$;zpc05o)jS^pqQUTliGeh@E`3BsdH#Mv2c!rk2&t&2>yGE1k*^l7l5b*$&M9ah_WV!8 z+&Zv?H{fwR5u!&O2c<46NcV}C%a}g6)Tnh|LgQfz(2pF|1$_sRNr{R1CafL8`2yUR zdtKL~p=E0nNAHP@40}P>7l&-64m_e2X}h;`w_kCGI_>e#8dS|}23!IoQQJG%&X{Lj z+7jJ)iawDP15{NXaG`&I)uN##o-9p6ffrVq$G-QR*fPw+`t!3VT;oDlPTK1MvOSn+g^ab?gQ|d z1B3k+fV{H*w>@S%av%(b7tqGH_iS1OP`Uudu>R=^m{^G^Km%w=_b@H~DLjn6o#C4W zC=*;+Ij`|lM9@QlVV4oU@8+-zO1t3YYA$VU^5*9a1-djG#dUc4r}n4@`&l3 zn>u4}Ge`_RNB398&B z61OK%@q)U8+Ky?<$Nl0sj_0^lz&46pbT+5u*k1t}EI+|k?Mz5MG*q>V$tR)J>KH$V~aI>G6(+w3Vs$PS9B<#lzxQ4+ zLV}j(Um+hHeCW-q7|+#nK}i?&><|DkA_h#k0ohV6mYLf!`Nn;0j#xWZrJrc4%R5Kw z4N9WtjM&-g0d1G))iNYf8|`wxY|L%62#n$ig5;6-gXn?aYPeqGZuQ646@5Wt`S0W4 z1qoD1dhZGq#nLElJz8imi7M&@%!Pz{B~+1s50mJ~HNW%OQcx|eb>fA4=d^MZdc$lI zpDJs!LUE@673SmHBl@c1`qc)_be7v||DyQUv!m1h-1P|co#e%;F(-ho-$D3F6_5}` zZO6Jad5^U?5} zhh>a{&L1Mu^6WOhbkLxf{5|B`AL1aU1t4HQ5C>u- z69dM%T{jf0a=WxB^;|aFK7S0wN7-0zwaOE21AwYHv`kH$qy&IdXg+^{n_)+YYrx}@ zYH8Mpd%I%u@UV@l9m%^AzNYB4Ccl#zLFZNQ-#VPZRtz9JDjT3?M+S+EG>{ zD0+F7r`*)7@kV0j6F4(02DlQe);kQkgtwU9Y?|1>>F-0Aq%h0tpmh#Yg zAQvZ;H$ShTYRvL~kOFe7Y1hq?cS2P@Gsz-{!@?l=wPs!A@eIz+Wa&o5iJ!+ivx~}L zpG#iN+7(ekyD=k}prHen86#MI>0}@1Ui^I<28%Ng)PMaIP(w-Mzl9a>G;T3>4}7|N zn49nUB9vytaG*QDC#(fJkr6K5hJN{9_w&>aR*)mpNGi@ z?QX4V#>QKHOhdO@m7b`w(mwzb=0IO@VoQgGD9nyeiNY|mI&Ya+EiT>8dw#(?)S$b!y{_0hPfPCSi@YmL-kf zOKTDvtb-CO|C@g4a?tkv8mr|{5sX5u9znd4-FjI>Bu$r~E@QC08jkxCH8f^u80bEM zO;yJ4-UQToKC5NNQ~6jo_4)X1>?qimmfnA=GJD$G|5icPz@XN3n*pOp|8p8u-EWY244`@O=n!xE7y-Lp@m z2W#qD>7Ww>-Kn}=wCj&KxXUK)Xw?Z}gVxFFYPh9& z3J*(~f$93KG&@fXyJ(B1F8<#bOjaS#K$dr?*o&|-@;X6Q8~pnLv#neQ2`}ia$_2gW zId;MilaF18_%?lg){r={j`QL`(-er6uH?p~*;+_sM-4l%ln^x9DYwkBW0XqGjfWCn z*k60Gw|9WpjEQ@{S~}3GtB^ckznbpVeCQ67CtLc9?Jr~Va65`|LTUKl3dxwQ^QtRD zyVCax6-d(-ethNBQFj*l@V$HYzB_^84YdkBX4ZfUiKU;H!Qw5)x{iTwMI4sb+Wv<| zv`GhIEY^uYMAwK|=sqUwri>XFaOUlUt|obQLV!WL=kdv(#E;&lrRQih4->A?@(J(= z^C|NP2gr43wJ#lQ&M@BP%ZodOuZ$X=w3<0n5(?m&-sNv<%9|SV&4>IF&V|XyA3KIS zJXvNzS=ZSF8wVmKU3gPfk5b?9a2iEm*LZ`8u60+P(`Le8tAzcmBQhRBN#+OBJ$9Z< zhhU2mZMl;xw3n0%%XqSC73u$B-M7zINH^QR;8pCNiFGIX#G_r4ar4&3dxj@=umCW4 zrQJvH4Yc}h)Ylb$(wAlY%(g_E5#54aY6#2MmIv}8WQ$%G)})RuE)xZW8#=Hoc1+A; zq4TZm+n~a@xlYMmkd#(&f`zbPMhK*iSoeF)Nr=E7F&{;{91ym&rH{f?glG(Dyb}iN zl5R8L*?~89KF0YtE(3Zt`52|;kG<#9iAhFSgeklh86&?!`^F#!Nm;geP%k9f5Z<6J z%qM~DUx*6B){PX7H$|=~ajhGz<}ql@VqXbAE6Gd~@W6N329s9v29~{*Ch`vrMTSk+ z&BJf?dPF5p5L2dCnihITENjOlAWY`L9i`u+1+q*pm*vFjDu;_h)HupAYuN{iRXuKg z4VmOX3*?E&=dZl+*{CeZ9&J^(?%F+YbJ9o*|7tr%Hy%UZE@=6@Qm9wA8?!O_D(`lQ zi>cHcPg0X#TZVn$s&kB!nsQt69<%Q5>77wJSgXQ1i~$UBqO=eb#&=13A<5# zd=@LeXF_pu1%1aU*sjXWay44f&aLO_x>MC`-}3WPFaIm^cd^sE`y}Lol$xh?xnZFY z`}F8LCnkthjGh3ZgVf)l2`*(^by+uecH6vL!83V}37`b%)`3IyrcXL*PF*Q> zl^W-C6zHG%86Oo=1RgIqJv{;oB!rOzHSbOc0ePK6Fw0NvlxU?Id`A1y9y~^0-)a!6 zf&cI>16qthrabcWxWWLwMMNGeI%$!5J1j#XKMrbg1XnVVc+4B*g)#Z__&7&y*k?vk zZ|0=5?L*GDuHL?#{n;o?Q4C@r-z5Di`DOqe50u1Temu7Q@Bon*dPGNxRP9%MmJK`o zw3u#-R4Nj2=3DD3ws9$wl7ozq9&l=3G>X$t#dq!#9=JBitfVa=VedA+xW^T`1o~;}#J?^m#w9cB$qadL&gdV&hH_eY(QMA8) zya06U9QEPJmYcqs$zRf3a*pMu{RQM>1ksN?{9Yhf+ndtJuyz#g#_%+jyz#k`805Z* z`@Ce%>@iaEZ0c3&?eOZ{?p*!8n72ouY+8uc(wf{e9^{ZcVi}g8ZU8OaLl}o>9CZoY z+g-|i)jj5*VVc*AySFS1pc8;UI=tC)=uT0JfbfFtsT z6UDakF+*Uorb@u_O_Rm^N{CLMaeH%2HBD!6SYU_*ok9FxzP)@F_A5H zni`hfK1Af;RkO^#riJeo{jx}_Fmp8}=%b3z^2Lqxruu=PZ%MsB!Q|TpGNziD;85B| ziO%K3zn_az8qvg$&qY-yJBlom<$m<)qjPeVaPggi1a}E<$<6a)xOppW7d}Of{%4(y z8%=NWFwB?#kp=S@2u&Ad>D9nze&MUh12%qZ^TA~QHrLlP0Wk=$3Pof+2Fe8C=a_sGB+-vvAM9BKxy!H1-gcMARru znDIf!QxF)v_HvPz2qkdXG$zE;?Tsk)X)P6)dG8`5BG;lnE`18ShVR-}0+nvXLg>~kT;2;r8VHhTyWIwlhEJ_gY|mT5e-FP1`_eV^O= z%4)^IgNAPEwgSR7$h$Cf*e}8fXb^IJS9YlzNeWUTEURctFa?#j2z-?3mg>T#SMMRX ztm}J0r)`aqbhm5L^Gd@NVZMtoi1UX2we9=HiVM+U2>B`Z~Q0J!LDsimcK_uaCzdW*9S!l@H1fO}@&XPp*FHid?sf zA(qR#_jx_pI_CrzTE5iiue~o2{?E)G`GaLNffJ|k-JLS=n4*O2ftn1kAq)RtF!|95 zK*3&-%LXc7;jHus3_%7R*&={fCN6_yUcN!PjQx`4?4!F^-$X6B<|Zc% z2DEn!6s}BHOoPGbL2H_Y3G)HyiOt8T`_NgymRZZJC!GJ3u+3*6?LIQ8?l5qk{7_F$ z661@jj&w0SDK&GffnrWNSmR$lg#r^$Q7)72)vS(Tn~TE(~M3Ru`J4Bi@x0&V?i zNVBjTC<`v?ui^?aLhd3ZpGOfq&p~7!K>{CbfEv&~8)eJVr|%>gGd zbFm_t00<;ND7D>b2dhW2NOel`F1Fv{ud62E8*4JY-sX+Ij!%OjfPSdg z5j0tKpoy&DtSwP5qdkw`4KF_o+MkNUwOn741fJrz~S+r<#efP9#DL~ z{7KHKHg>;>*fomn3pH`mnKlTDL5!rQ3G~IxicnIMIzyETSm+u>;NhTE09Tj@CCP92 zT%HgXPD({o>$jgyYG_Qc%c#!U#B7l8^)b*GQ?Vpa9vU_qak$FVavH$s?VcJ94(Z2o z-~0s|WBbr%ebg9TRgJwBFv0$=d!nGhg-#m7O)<1>IHoA^^TRMZ`HV>gEetM^J(a3>2doP=mM>#9LrYR_Csms`8-|Td zGc33#L8b|^8*BgQJR0vv_z2oIKnOMw@inn3ZL*l>isDv=F=`^HUUPPwTdc&6RNsy$ zh70ME><^ngaX+1~KG%c`ELLjHy;_Bj>}3ZYF9IhL$11C749(Y$#(76p>wc3Kt1avp zT@ng4p}%PVqOd<1uocx|dHu*>@32$({6oFxFeSd{JtivIEgNRzTCQkX4jr@{M6Zy0 z(_rHkL>5dTDCFUlpfl9aS6p~$>4K&w`5j-=*T$%DxEP(+ckU<1e6-*tOSz-*Q}Vh* zq`z@g^tFd@ReF*v>>L|mIlIkAllVsSoTH>Ri0)4rNH0@6vnrYo{ln8$x1B$>a}ky` zvfGd)CAqUP4EVT9KJ9<-r+lzLcj-(M+7HO*NYn-b4h-)Zw^wn}Nh%fDTl|~gSB#^> z+zqdu6t^E*Fl%$J{swVQUbb0Z>{zKYl{*+{)t*~zXrL*cYL}za*Iq0!X)pW|>rFQi zKPV{p&()|!RWmW3y$Riw?zf6A`+7LUw4ZJ+Yf3K+kLmQef|X=US_MTgb$+>>gYZ^OEc+^7Ze*CL2DxxA z5OO`)Ym@FRm(-kzYBAN+$Tv8|tg@tWq23~+cJ;XVphj&#$Mg-u^o(p#$oGX>m8XfL zZPW%Xi^BCg^4Es@NzY_t43QE}y)hhF`Vj9{v$=VZgCjmVEB;Zt^BHyz z_)4X(`4ptBd{v4Y6^a1uq_ae?fVxSl+X@>g1FjFp21(A^`}Kfs$jeCuru3uC0ZK@n z2*ZbV)c1V?JO1qjs^z+;N}l}YB({QtQ*X8{0vLf8EuVGtSA6#DkFQ~Rp5%yd&^7zZ zt)RUkxn)9KaFVCbBRw$c2x*Wwj5`Q5+0>^iwa@f5qxTy9#%apv5JD+%4Ps$grMlR$RqtF7IObzI=SBI#V5dKxFU~#d_kjut_UY(r}v)P<)+1;`vVn$zet%AL|E~J{Dm{^r&& zyyzPg21_BDAp&pXtbd&H1Qtg=b2$)YQgu;rV2iT?-Z+7spnYFIwQwaeU+>@vV(1gA z^>?hp)pQVb35sh%x@l$<`pn!ae4y^Fq%E!o+!!WbRG2ing9XeS9bm5KD=KtmrGTzl zyi#0f$n>)7+*K+BFPe&K@c`C6lLC^G7IYIX1A`Y~ zO9%4WwX_XF_YCM64h7sUaoj;=7)A{RXPR&}w~@QrwT3HmCG&ano`J-YT7!z>;5Q}^ ziYWr$Ego19*)d*J{1LDnuQ_@3OWk=2Hd zQhXlG7&&R_n`w9N+4DU!!$d7PyzZV}ev|}8mf-Fn%X05LJ8)N2Mts7IpIdiA{0g{) zs7q^jQE&!-BvEfB_qwJOxTlf9X?}oE+%XI2FQTkXUiSW zp>_K-kR=g`8+1#M6c9Yv2kaw!ixN7ZbJ$f(6jOQcFdi^@WqG#hP^`#wp;((YsK zYtZ!N?47`WS&Z7Zx32aFJu}zKq{#74wU-9e(gstid_dk5k*Vt ze6}@{K*&!c?;7BZGke?ut`SK(#LycK;!ES1;IC7VCa&25!W|vY1D`K6SN7;xs3&cFsZ2zPE{rYFxpox<(S zx8r)OusQiEd&se||ISJ*AQBmy*CJW-Y@h4n>`02x34wFcbL<*n!V{PEhxkm|?kkBv zZS-#jW$7zua)udg1k=M#?GpVj@)z#0Z)x(M;~@B`aVG}0FRM=+7FL#e)SRI~OKYh> zXP*?6AJ~?$q*`!-qUOo#R%&a3B~Xs?xjTQY7ZQ-Or|?Sxd*@X zdM66N1x3*UOCj?c#TcWtNvlfCpN-qzXR-y&=NSkOPct3mvqoq+Q~0x>HHf6hBoH?;#axnpfG4Rm8Zo2aju4@|b)SIs?$OkcS)P5Cb{b=c zUuGE3eLZ}BXYWwJH+jZPg~;La^MXO}Qr+U|P`D0#&)o(Xo>l*8?qk%wvj^wcKNt(n z+&*|GDZx5Uv=r{W~3{<0m+=D7s6gRiF_UmRt9Cled!R}>hd zgVpa{RK@Dd_MK0AqhQ|^xOqD=lb9FIidj)mERiV+G+sSv=238>uG(2()s7PHO3BM& z?kH|?$ahbi$^bx04+VM?8sp+gz9{L6^`P zrs@(}ZLTekDZb5WD7~xq8JwSfq1^CkiFUF^x}(zkcBnNHoT((qhZ}c24g~1oHNhFB zvom-1TltL~GT3@Wv?=_pUfafGoiU~;RlMu9$Z$1$)tb8w%vfcxPxrZ%1XdcO(jr5S zA<+cY;=mqb=h8v(JdtE8;c20E2M3*m? zM=C`@xZ|PJ^Xc|H>CX&cvxzS>OP}}icJ+Kydft5?-+VU4F+Ob>sljZzGm(+b`M6?{ zz@3mjEzJi2q+)uW?zn}4oUn_UED|YD{i%&=y}3i@hpW(iZ3)HSF+Q)Nf>$|1Wz)+m zU6SLzbNoqc(~tAoTODsfByGKdszm7fnoDtKtWSVJ9Oi-=r0usoy%m!8qwvFkuR%!E zZ};7%-|M6Mk>o?EQclqvD6C1kT2;5Ic<@qabi1jfOL|&waci+uRAX7}BwjcHi+|&z zF^@}ou=P(t*X|B>0{7nkPdcI|x)sH*Z%#hSA_@S#k3c!?`+|ELp(m+-O*BFy2C4aD#f<6u9`}Y`?~asALI~_!yXVJ z-T0D8p38|%8F{R4QA1I5?k{W~?O+G8-@_}eQ>%38uVmxxw^BWV0quYSIatp`Xn_|c zkqkmfRtCHu=Pe^6-sys;YHJfpP-MRw#O2~?mVz6{{>Rm4ALQzjVUVqqrJ3KE!Rw;f zhGDICFE%%gE8IG^H&37iG{GSG?U)S9K7-dSK|Is1r5>igaF2A;5ABuG)Ub<;mB~?d zvW)#j&+sH3_RR`+xi~1mAT3qkH8}U;Z*YUTfjWyf9{crvn1IHTxM#y_aWiC5t1C0D zbuDFi^!6nA`<50s%3N^9Vp1N9cM$~CtQCYHqbaffFa| zgGpw-^fd2DY^AiHl2%UUJ-c)>qgW>6D^rH40g=U+sc^~Jv}#AoPutiDT!wBz@lkFj z#)ZY?9ALoIR{pz*KX(*g`urk6@tHoPywI-jxU{Q?hB*Roi={sh)IaJ4EXMPHxA z7bWH7liL)z=#q=v_WA_ND#Uh&rS01t;jR~NG8v?~fU3Lp$OU1k7YKngn)EW;s~=5C zRx|WD9q{#I`bmTB23xTaFI2mXQ)qFe2YYa9)4W(w%`f*b9Hf?D5)JdnoWjdV{Or?j zKHz3RooR4@?4P7wn-=!+s(wuTlAJ*&-5aU&DwK)bAV^>DsnUP>=~kOV6;$%ap&8!& znyRELR((AmbXMVVEGKZv`ekjhN9yB$$-2IR;g7W~@natN$4^piExytr!ryR|S}dth zhZBNPa5WGLD*{=+6veZj?b<^9uL{n*ibt?m$kWM#XZ|hh5c3Tuhz&|LZ>W8YBAfM5 z6uUn#X#sUXFd32UbcxE+01S;55SY&E+tP-*4wXg6D}8$IJoKEyj(Sl%1wFP`k+}ma z`j?g8;bULK9T%)f+ke_bQ@q15-em}3=8)>97DqLlQpoR+ir(C`J&Ye&%+PVqh=v~1i+ym>F zYK1Sp1mZ9l?1-d8Z2kpSTVmVnbB3X;8Y?>NP^56pb<5Bz_%GmSDzema$_7++dckG3 zs;cJzSOX$4uyHfg74+R0mCIqOW;|jEI5x2MXQlz!dC|pg0e25}DQP_3D)sI56MS@7 zyjU%j=kH!#$nqsP1qvqv-4WGB$+&p!9W`S1l)sQjoJXcH-oCAxT+H7sRZc^t0fSnJF}Tcy$&yv}t-LDuzcajT+DA=q(qEp@GeT{e-tFOBX!*MwCRaKJ=&am14WoG8@q3 zs1i>{f{4Gm#MdhWM+F)Z_idc7x2HnHbprs5(16nc&g z%}8Ab+AlZCg?6w2u!yl~E=jdh*;-*c;JY}dJ|lnK{I+^?)2AK~JYCABAgg6DOxGbDjOkzUkpKKuMh_SCQ)66f+=iQM0;h@}0LW zSuD{8K5U-IjuYA6#smQgFJ>Ov@vo$)O9r0P{eQRW`spXZOmd*q*5$7sg_M@_Xgmcp zBM*91wW-=)BSP)pXu(>8L$ByxkosBv1-S|PgSvg)rk34Rj`f?x{$-1hZlb3n#^N}k z@>M~1H}aCMNJzO;raTIqzTUdPP@&GI+xBw*Yu>+5-@B-A zL)r++fQhs&riVzMc6h{naZjSP<9KcLm#W2i0wu-H`$^o^!h+L@3MpkABnU{O8FDa5 zwAEQC=_|Y-d{3wv*AFq4Ov9Y{v~AB!+5Dy4*ZT`??EGkHxLy z_>D{!OWAap-jfb{$|~nN3OCl}5vwVcKUsC@q$HMJ-L;F_n)-wys8gKnsR!&Kr}rXs zXM4V&@znTIfmvyg5-aq;6)}Nl#>5f1vm()6z_VCx87H16(4|925O9Hp{w;D%1}+r$r|y@q-mrm+bRx{xy-CV}2S32+y@G8?lF|$Q&K5O285~vEUEf zujTox{a!>*9qOH8P&8?D>MbsRR0Ea@q0a#jhP1=6*wX1UeG|ZpYM6xPsy8v`5F+9s|$#yJ&*pbQR6W``8Fv(K*=5n z8oCL2_o~5A?Cx3hOzl@S-naX_FEQ>e?J6T$48>_h(wEcw3D!SLJQj%AN}oRX`Qewx z@t5{6keJVK)09re_PTW^Ul0f}WK3nA;ysLiM_2PfpN+;*%1UD09CvcvA2S%Hc*^H5 zgXhEUkK^P-L?}ydL%DGZ+F*xd2G2d&yQj!ofr;448M*Lu=;wPDI!kuAh@m96j!P-n zuFT#i)1$40M{zNHTe*c1?~z7{PcnB`4#qnLSM<_K{LwEnzzi0u{p?flDv_V)a?UEd z0^P%|QTsO+;ajtl6!fhTn)C#}JUMN2zDW(Ot7oy_F?8c(MgAejyRutSW{Uy#C%t4+ z_%ecJ^N-Kco9=h}*U(I@$q{yY8Yj;kjSnK2k6Escv)f}~V@?r0rFcj8mZ7Lz56qo0 z-AuawU>pXgaQQ{p%eRJ!Qh&6J;sfTa&b>0OJq$))RwH0d_Jlglb^udFnf3(ZE?%lF zjrfI*QRal+<-bL>LIhg|H*+VnJd1HKw5h>KdtF}r4bk3(mi-S1{?ibC-z0dULA@$$ zdQS#|eBFfNjqCi}v=E8o_T%HP6qhd}_l6Q3o|%P?ad8T^75=#iY#CyAK$-4fF0-k* zQcPXwe^6&1+Vf7A23KS9i0<`RpMpGCS4#)6w=>U(7VX_Ogt0!j@iRDOoy?l3R7t5%#Lx59 z^Y}ahGXB%O;2*Un=n+rH(Ri6YyUKQ4UnM;lg>#bVpVg6erfK2({$6%Q-8F`Tk@2>% z64;sVN}Ra(f*O*)O(tp??d}QrjgzB6%#hxUdT&DXXR53D?sZRu=xft{8{7$FMW$D2>WAuog z{_L1yP`m2UVdvu7LtkDKSAM@MB=Aq-1S>e6=iwfs>q&*Xg-Ik@VT!AuxEmEqPB^a~ zy00lC6&S1@0bUl{RrN4;WZ!!u8X1Oj7o``e^JO=+w^xB^nBTEk&5I8z2a&NyWU1YeOdMQ(GIJ>HrUH>^J&2a;o@9F<tE`SlFHRZFCwe&amC}Xt8 zC0``ZKR^6LxhCLd*-NSULq`MAcaI>ql+h$2VVD6_hsCSYX5Z>fFFju{F(|@!TOwCV zk=5lb0HK<))}Ltjg;*sYN^9K>Zd<&$>TwvmAA&Vj23K`925?{FME>#X1PT%Am44H# z@QZdo0wd&+?q5vT|6pxN5ozbN#9LLSiN2zWC-@<1ZJ8mF(5pmBU6a!+^b zSihG6)4zKtA*V_0j!_w;n+2IMs)mFHVg4)7e5AIoaE4PY=)#B^8G&TK;(jm~hImAnc-XQtpxI)A|A|NZJ9S20y(CI)A&Y~A;J(>9V&x8`0YDZE2=S|>R2;_w>L+`p?Q88o1mS52t zyhS|jgL`Rt2a5MB&3z3EnB7-|Oln33!rkzQ9{%rv+>h1#o%hgg2ydfa<;4RRJUaOo z@$>zO1R=jjyk&$Y&g#qa*B{*>#6kY^ZC z!a+509a?`UyX^YovvA4*wmq*pg+)k?7v%8n$dE=D_ObS>Ktlgd1`Ml$;iMtp`xAvf zghb4?%-Do`=KA;I!;)%U`|na$pVK#1i}Y(F{mGR6uD~oiN5V%+%8&kL(J#rA@(%`3 z^sJxWDYP-~0sD<)_K5xVbM!=XL5v?N&oA9V3j&4OJ`>ISCS`s*C1=83K4j0H3yGvT z5i5oZr@6rR*ao%NDcgN;`Ul<9KTJq5YKyb`i^>9xt0SZFpQ{Jo+tjIN?LQpc`@KDH zf^Bau!`yqI>Ly^fdksm4_x3>ho!}Yflk>hW6MgZ8r0>^rd;mr6K)CW)@6M~C)w6N@ z11;M|l9Kf$NR43hbfDtN(F>WMv#5Ik$fePhR_JN7z43dkyR@nc83S7Anef+{AbX1o zAi=OQA*o29bQSl0N95a8Vu}4>B$!DQu0tY5M@!WCxz#~ed7kpv+bp$RI$A<+?P&i# zU3^6F%vckbIfad-QVRO}Wz0H8-PQ3MQbxW31?xXIXqJRUd{?HnB@4#|2Q6>0%>pm6 zut~Uj5Wy?>bv_x^b)_mFiN)vyow$~h{~FRdOM(DN`c_M%C=1|VW<=8CgGV&as?;*y z50iM`1fx1kL-dtr3PUyTKb_NeiG-@$W-OuMJ|UcdP@Rj?OK_?@k5BF4G%+fR`aJIS zFJLfcT%2=~3d0B!_S&=(@@S_bzz4?K4`+LYVJxuE5hHn;aY7g$DY#(~u2LSykCegx z+xv`!09-~urq}SgsX<_nMF&+oC>Z4qU%jpMXQQ1Vyd!ZVERW43gs1!__J(`H>x(4q zOn>aalv0gHrEbwo?FC$0Ihs}v%5Ai>P2f>o9>5{zO$e?!bW+F5XiB{}DisEbc}~Pg z!udaTBO|bf9;n1H>pfIe2_!^_cUY_LJX4mxgrt!4VB%-! z*8P5XXyGeCd-2Bd*2UX7>J&lAETSQH2`-w3>FO;F8Ar` z5ltaP2-u25H0{OdDs{0E6?Q%09c!X-80I~CJagAGvs?2a_s97r&GxhaIF8C8Li&3E zqYhOLw*IFoi&ZcBaANl*lglN0dea!`5e|{#J<$hYxG~ z)dK#e@DN=I6Pgg{SK6sc59r26&RAB4goJp$v|=Mvhcsm0KG~_%&?Uc`d2Q33br^M( z3L#m-$Q=J?(*M-ywx)2|C+ep=o4i1^X6cLtQ{dP&KVP|(E zZnpp#u(dW46!b*IQejp~zz*sPF1yHFZhbW(4eiu(eaIBmieE2Z?HvdpRFv40!qhbn zJ7ev0zm@D#nV>Pk1wY^3?0f&8HHVk0LGVk3QzHao$*UJ-5OMzEUake_8OCM=Bd5WB z>X1szH|7>wb{K{&ggLnPa!#-9TdAJj_on$oK!j zFUT?r!_(Ff&ShTZno-609sXIi1@Bvqg=)X#TuTP?=JVV8==YFiM6V3;kF-1tuz^v` z1u#ka8?ApC42$lAH)8+9sr=dpC)GGTWNiEgkFR{N@yoD!dt+YyXR*P(BO1aIUp%f< z2S>Fhmj}V*%>M0b!eRe8)x$(4wR%iWLWwU;LwHDw4Aie4)CC0@=(E9dh)0*9cQI8x zd0r(%JVi{a$5B1yTWvX-(;~Yq;bL;cj3}$Y14y*N$c~c;0J24zp=e;K^!*P(&(Fsn zdS?!ExVOt|5owlIKu#E-6==&6pHx~8_#XV-()v1&YYcL=?>}~5b2@Oy95(2Mm z_kSQ-yEZLM?d~>kc`d5ELb!bz@3L;(Ouuiv_tPj&NtBqi5+bK}y{4K&b|UOT>CU31 zzd3I(bay@t(&1?{KgQpvbn=%%u$pc-a)0IDTrj14lB{%S7$~{t-ZGh!k&)r~5`iNd z3XcZGc56%R_Eg6I;}d65c>|zw2DgL^T|IL4JEb(tFq}h%yh<;;@1(UbF<9)1MvwuQ zZBwqA?<_qOWIn%hoyv?0)zLAS2B5$5kyqLzuH%v4D(6DLai(UO(J=8{obT?J8+f`~ zaDqLb!I@so=kC<}&uQ%cA675KY)u-j^_h9zcKp|J3uTS41Edm>B_5!o{T&DCLpTLe zrMp@UUBRoFd{0RZ6N8Yg+D*?HYZ=0qyrboZme^L(qi5dE2>;w0qy#|cCyphTO>L14 z>G$hJ&MaWUN`00m`(XOD!$Q#RmZOVHdlekqKCrC%rLm{ihW(r?R=#RD0(v9q_;EDg z1zt(i;g^0i2{H>*f1)=&cH7aAmW|GQ)xq%YhI0d1DcnrPvi-L^UC>ii{Rvvohqw3b zo*hdcxpnd7o$I80qj0m!PMfrSc5G}6Rdjd%QUxd0A!KS(BA?-X9)^bKq0)f)Y^D6n z-de$ZAB^ZU z{`F(>iL;r3?EF|fE=?gtv}b5u#rjyLzafb^hc#!_!q@;{VLAvMx7tuK>f z_Q##`W(5a^lX(in$?K7dMFxJ(8l}#%7=WokNKBf35#>%Fa-YbgN5A}thLz~Gu6ruR z&ku$G8&foswnsm}Y&BhTFG_+x{^hs`&=#<_5PSnNmzTFqJd>&lnNr{1Ah+X+aD5e& zhd1ga`+KU^#9`QThQEyjsY7v>K8tO)w%)1Hz<^T4-F$>~#*q@4lnYozn7RDU?v3W8 z2AfM-Bx52EiBeG9dA_DU=5*iR!8t62oWkj0ugM=h28=}tnime6;VpJ*Y_QsYx4)-y z4;TwW)3%pK3f*jE=;5Uej7>p|CO1}sU}%^3)2as2ncMVvFQVp6t7(;9VEy$CxpCR< zpUFfdWA6Hi4)~w%u^mI611)0xm1$?MeLW`qGudr6%6$8&^1&RvZ2eb#aBtcf7`bl& z>1=d4OKoeRx*E()6EaykK{ke6#@E`2W{!BU>9mwl)h`Wogn~E+@VXKN;nsTPr8APZ zz{Kp&CYfKP4X$&$f$2r(c1_90O_^&M7Fw&>;RS3<;0ds+d&XJxUh0AWnHYg=<~j6~ z*K^NqtCVq|#+VNV{K;IYR%OLG14kGhfaco&j1HqTl6t4R>F1 z$auVVteSg}!9_Yqaa9C@**7S)w6ij_6S(Ah{dy=lfStXFo`oUB8G(R=z^XJyqbh-I zOM#dp$JXSt-6JFB1~-7?Vm54Vw#-}slXPbR^HCH=A=|4l9J;#8Tebyr`QO3~^PwHU zQgpcseO*DIh6pQe$mPC&mrMZ89ex*&OjIaD=qqOJfnw=H_}UajIPhm5|(A+dda>*n&$0bmhL%vIQ#rnEYPfz04T zn5pgl?mRe`#;;i#nacf1BQVr_78wXT?CeUx*vMn(lUYLCblTL8fcZa#1eOK@90Y;z zi{oO?f}fy%XTcc&vq$#xrw5m>bqg#R75!^3`hJq}3!U9*7(*r}X7o=PJ4Q-tJGQv! zVrpglPByt$t}nYe$tlhO=WQzEzkW$off(hnm*pKLIz#+({}}UD2ZuJ%y=I@Celonm z12n3wpaD2p*LHY+l78J8JtSwB2CQNSP&C#6_+3M`QU&qcdrs#V8;;kCofPL5gEupO z@IN>63A~tImF?AQc}UoB_g>oeGv$Ndi}$dgbI`!VXY`PkH*hS1p&uExFKlSkiHzhh zz47_DS$kDzM>Vc1A4+_pDcrwQ`Td7x%xp=oR0EW07U0NlODpFbJGcbfUc~~nRHi7^ zx#L1jWoQ*Lz}AmKc#7Z_@R~AvK2Th*STncF3}KStrFtYj=iFld%}?e#1Z0QoB<@@1 zR$mw`l_@G{VX9mYo$E1I$Ev@)5QOI}^M{G@wS5WGA1LGo$x?eh9C0OB3A8L8Lx3>T zZt3d-Kxa4_q%);Q;Yldk4T#p{tIQz}2yr-^5nuHikxT!RJRygx3am|)(wF?)ZSN;b z*)Lidkcu&KB3MaSgSLOuSIS~tBKgq*sx8@ng|A@D4iR$^w#TG{tA&_Fb1IG2G!bF| zxO0f)nx9ttz6bJNK<*`B(%+*xc=f6WT32H)@^ACD-qNxLip>43`Iq*;)MZGG~(}vpU=Q>ck^*61a55VQcDDc z#+a#8-HqMtv|Z8D>eVKwNTh3lranJ4KcBN zCOjRH4CB*LANU*~QkwU@If>ip3_F}xw?r}7P+1yw6~NLfD0gI-?0!UrIG(8tj3>eR zbii(hVye4jt}tO|ZbJW^V;JK-cl(k*os%Xj9T`Cr>hq^*9XVOggbQ58>dMtKdu%+2 zq#7;YMvO?Ot>(#Ah5t3{`55<)i!m~e3%8VGusbOW{tXw-j1d|aU++5a(J}fR*vF4| zzJ3R8wCWc-g&73Pxu{ZaaA2*=z}&GK5U$0I8q5(UKVMtLo~?i4yv9M~wKp4?YJsj` z!N|EToW!G#IigbN?dNFj*fVuJ7m^wI@E8mD5=bMS!l zT+yYWD|osPgpwe%3&W`Mnl7ohn?Iiipc6JqVHyZNqA_dLFz(%ND&v+W_n>MId2ai7 zGx!(|qX~$SC|Xo)OM0)6Z2`5e0=ou;G{xm47%v{Ma{BIeb+*V|s>ioWtUy0Wpk}cF zx_pn*Bkxu75rqY+u8eAQMm6DYAjNhTY2iN+3i=hF5vHT#WY4IOPR%`vB_xO?Q|{F$ zqWZHocevtB;l33wVG&J;I%zv1=|O-{xqVtqo=08B1&?KDv4U*v&pL7j5X7Xjk(c+F zvtR$g{Ci#75q*)gqAC_ zBW|Xd!XXfd9<~U2_npd*($(D;f~CX0uK=w(B1#mQ-}Z9LoO{?_IxpQX==)}QVt*r} zq*F2*fDSUm>1gv0p|_i-?3NH5d^PXNOR6bxT%h|gPofV9ur;*{u@qY%M9~>7Ap8Tx z<(=jvargg zOMJ+Zt_7)%7`(*R&ik%jS`jAM*xa!ft1%0DTw_k}uO}V4tjgwbzXb^75zdz*{%Qe5 z9DDw9D~i(BIRHOnUivDp{L3CaArMB%`)%2RvPhcu1$YL!0OtB1Njw-+kLn{Dv>jZ0 zZ_xJeqtA$9k+3r`nzRu|D`=!A2MO3n8XKzH_jBt;K z5%a*)*kc3_^yJe!Y&9~;3~EDU_x^!0B49}|tcPOe0eRyv{N5)UgF}4o1prEH)f|$w zKxW`;h4eC?-2v}Y#qfRpP{Sepb)Lk0jFWTy?>H6hUC2ens7)4lui)|cJcrKb8@9== zH+vo+3LDuMgZQ$3Zvc?{G==f=ZCsY`KtS`COFGaqFBQ2T^Dk~8H2QZc5e7_I+7NGM zjJo_V1uh)@Vahn-(CUrxC_ep%vKzG&{XqF){?ZeMW-xIHkpY#%tg5>brdwBD+vSKs zFK8b!PXoU7sDqu+gX>#JScVOx7wxFdOFu+dwUn6O3xG(+d--=m`&NCITO?s_d56bNU_p?@)5+<{GdSxy}eYmv-(=qhiq+ziI7Dl{Whuykq6JK zfu8(4kB7+bWS1bXy^34dy~N`66}V@JxFTA@Gmo=_?OZbly)JqIBK5?pw@&PYc8b4H zq$LJ-UKy?{;Lg*C<1yg~6}C$+SAx&mc&_LCL@lb^b1-NZ zA9i^SaK@)0r0;mX!JJ_hvdui_UyWaLBgSf{$yN%TF$tOIkd0*$)-WlcY~dce`1@v|Q}2m4wgI_wx78@GsXfVi>vk+NiSX*Vxk9M|;*e_Uz=N zM_JZLDoaQ6{Jht@k-Wy(>?eO5e!D2r(xcLL6TD8yBq1+U-apY|L3SfJNA!sHt!mM~ z!Jt#Q!J+q8FqwI8`>#dLNNIYMTw<8vjE}(dd+ayw^c)Jws$>IEN+NN4bLy3Bn0kl* ze&ypOcL6wEBeC9%Zaeq<_%2h@9#%ELHfGyYyFLvMhL*7lX}MLJLAN11=i8oIzvm5eFjXuc#Z zz7!~;-Pu7kWlBM7_k@o{lX==SbC&;%Y36G6LcoG(jCcN~#XATTB+p2n7K}@HT=NmZ zrFMo9guK?|Sskqd98S0EP~M?~62NW4R{FLP?!LshWUyaExC^0|hl_TMf+eXoRIeU< z>v0bZbIv-uG-Rxm)dw;T=?8+b>PeIa*2#>ln@2?Bp0}SWKfvUc9nuRlGkWA-aPjXqlH z)T0FZ=y${&YT?iCadymX$StJUroFCg?f*I3Iq=g*W@fgl$*;7y2bZ^?UXN+&K_b&| z+irg|{P!3osk2JyT_mqv*7{3667Ub8!f;HU;R`dSKQFG|3!j?_AiiIXz8#D%k|i+j zWpDX;4+x#cpX4A@3VknJy?sN2=Jpylck?{%C~K;Rd<|@J4#8tCo%wI-nI|Wis7GTb zxLsnhw|m(*@N6i=(9Voh2eGoUAqd*hx(I}nsN=n@$Yv$2O4tdgG{4tG#DZH0Mgs}H zB^-K1mW%Vb&+Q_%iIa_eR+F;daTG!{?y`9sAVHk2o=c>~0XCZUm|NS4kWchh2$qa! z@cc5UE>9GB+`9A(`nrvs9TAI+5a@`#JcBK2Nu#(B={~*<=w25`Pf$?71kdXU=-U`( zg8Hvt>%I%4a@B*Y7FAdrtyvrjLRx^jo@=Dlr9r5KAyi8LMB;xcV^O-QpU>-24W6QF z>AAhHhxN>z(g0C|7G?Mo7(%H#2NZZ1t98&1IluqdY7#_oasK_m$`as=AKkcw!=I|Z zPJD#b&`BcklK~%<9c4(oOF$Yyz>Jaai!Gg~xS2cVkE4R&p#~@)Iah5`dyrpC*H(J| zH3U#z7(*53NG~^H>O|?~+lA%`fp0FJ+q3$ZY6Xx?6Pr8( zf5{>Hv6SZfH+)j+0(&otl5277gIdIqOZCTwGQ<)$x_-obe0HH4Z*ZqXz^ou-fc^>H z5m`f;9Wk8&!YRH&8^Zgre8FgUt`L=~CyJpw=m9IKgxvmPf8RPMDu#2E?8_w{ywKsb z*F4`&G$l3gch=hqW($tLxI3h5v3C6DOXIM2w?wWHxr{{2j}>h!F%VEu5>QQJ^aEZ)SrYrCw(*(~>%2gwvR z$f5f(KeN-ZL50tQQg4bpBPSTo801`jSEVX4LI{XCSQhw zU?J>?RO37l#Qa%%LM~+yLP=26S1so7y7KG|6KkG0AAZ{0>(%Ax!MCQrlQmXjV6iN))i3#99EOi6e-O+p zge-`ovc<;YSS{}KZ`#B0Imo*G`N7zrj*|DGH?N$w{YvvYZFk$YZ6P|SXt2%YYN=k5 zkRORD-K7}EOQ^x1M@7Gu1;f?I9`0GE+ZZpZM_{vQ$jz)1lu5(y(NMi~_lMjul9kd$ z+xxytGYBe?jA)#7M_y#jx&CGVF-|Dq5T%$zG8X>gEyZDh_ltEUfEZ(RSV~R33Mx%8 z&?R#@TQ`5EIRjAi1%uzs&YxpsgIl3}0=K13cIJ z4YzrzM2b2DCWDw7-CJC`nS65WHg~K@_{>P)mSZvr4RxNXiyYO9hT5lLsfs&k_Wr9~ z25l8@kitg&JVEcN9R;N`TSoI#$sD3KhdY*U`cn?K`4I}tMi;F0+n-Q?j6ha_I8xy| zY){INSwh-N$SSE*rwe~qF@mVaG-p=uJmuv(gBQ}TxGJt2zu6$A**`B1D7O~9vI$buO0@jiz zl*(opM6rtuB%F5DAOZG0*U3CQW+(Z3WOv7_0zz5S{6^V8{~HWh`1KJv>asYLUyy&u zHNsE$of(i;9IJvootL(285ofY$Fij%Adt9^_#pMm$pIWJ(*TrstPwt|%+AIHJ+(#K ziNl8e87G5E!!UP~d^a7ByY+uO)uNet?kv^!W$t)3n)dr~G7?aJe&kqCOI)(O)Wp)i z+jpGvh!sO9qQ-5D**V2bd~ASCAyA^C8vgJmIm-jN6A88pZ31tbugv6@rs5|htEX2V zyCT>r+cVbtZ(tGaUe&oE>K+)?Rd<0CGg9w(s~Y=_{9dIvx?t4%<83NWKolL?dX}rx zv}9j9f2B#_ZS-c;y{0y`lTwMn`J*o`4ZQGd;l#RyY%yJKD_CV}_qv%$=5W+fIw?0+ zfYut8~(Sk ziXv@WCZUWhc>B)UCYTr@>Sx2(U*#TdS=gGd$WL+qswUyPV#gxo{ygKypw`B(SNZ+Z zIcZKir~~7W)9sGNOMW}GF!cr${#IfNb_b52ZPz&dZEZ&81^gQBP0odsq(vi#H=n5I z;Y@OmWecI#f8KZ(9(4Rj^&C3W;I4MoHQd_Vlk;~*{pz?!7m1ee$_HKV-r@*6Q=-xU z<&{B7Aco&~h6qau=G$&dpHB?jKY6Ly+%6c8KLisP;Ou8KBTkabXmWLh4{mz08ld&#q5Xlfh9``mzkfdmr zHc;?dQJ`7X=wb0A*Vr4X>FXJmc(jXXZZuz^^sHK}BO`mtg^l4{g++Bl5TSG6DI5bPE^_c9BTQ^fLtn|<`Mm<4}$oaLqCSTje$REuILn?IdMUgFt_jv zABkjAJ8~q$Iig6P%k^*35TsfG?iA7ET1$p~?G-b(f_B$~{7&8d%Kd!%uNH8DaGt7J z4cFcF!`!b*B;dLAZgNDc@U)@bm~e81^>>nG5frC*_+WFsc|AQJsB*B zYyE5xvm+5@y3C#$vEggu zjr~p=a^yH?$kq{=H`gER#TaJ^#H*u74zr#q$jG&|FT#dsDn)GnIPqVo!G)C}Akq$^Yj`d53*%>~p&W)oD|PlabtwJVGsV|>v-lRJ%InB#I6 zcY!co2o+!@0z2LJyE|Ll6o;2V2k!Q5>mUQRbA5%UdvV|>=2WBw+ODZo0Tm7Sb2U`yp7F*{Q1P^w^6 zo2k^uDe(+?b1Y!8|3Uk^ce!QbcZj5&x+;oyLeW8E*DIUyRd?`P>%xuQ)j~sPUz;*9 zYle_k9$36q+3M?m-n0fK_PA6cCMlkz?l{`j<9bDx(4VaXyT^_Qwen6R&~z%((m!Zq zE+_GUUt0Vi7bOq&*Ur*Hu8UC0uUDS?K`bpdrTu#Bgh=4co9n%%Gu%cErbq1v)68Ms zdtsFPB0RU3q}Y=S$!AW9<3W&}t7mZ*6XQT?FKdwYGAqo!An`rO?mKnVZ~J$HpJ^ur zx@QC`JDqGY)pj$xLkoen@Cj*0ErI}a%H+Z2sO^%yo0IDM#bQ(i335zqkBxFrm#g-& z#_SlF2NVxM>Z`K(Gu1Ee==rL8X8U7Hx7kEn#H^T^LjnvoSaKI*Xp?b3kFyalN_R3j zc$r=&{b=gOo0BCh2P-I9K|#E!vYC?>C^g>vlXD+oN{|Q_A+a1TUv73mhs2re(3lxa8I{GyKhqU-XqWi~2$y^@(I+)m8puttp zNgL%ez5X@GLH8}*eiwoQXWb4D{#)-*a&AGjuUUqpZR;Vfv*LeU5Sn2+l1nz?^jn(z zc*1O}g!iJwhq#4wq~`5nwpVuTzB z0a39%wH#N6`>5!4E>sMyfz2s8r?_KxMYZ4xbQDOqj(qD*Kx10fc4Ut#Z5mikMhsR9c`>x%0~Qa@&cQ51M{Z zJB`$C`YhHSngg0=9K9kZwk?!m8(&to$v&23dFw!H&?&8Ss2E3i8ubEwI%c`e!^M=Nb3GHVaD_}|!n^nk*T&prCkbAMzN5^s&g^yd@RV)+MGZkZQw|6Ol#A}sk5uNQ zcqXOzOg{Dmk%?tN;#cz(lPc|v*iZREyE`R7Fds;l4|_^vV`BgD9%MU>7ci*xzRM@G z_wBVb^+pC8|B$JNQ$zRZ=Ql~ZOi?^X`IhzrK*SS;;Hc7fBYtb7SKs`NH!V%eGu$?i z^ZB5~SAlkCBbcYqH2Ux^P2}3xpDdG-0DTTbl@h>l_9H~gF0}hS1Nty}g`xoN`_c8A z0@u_($$PWrPS~jqN=5=NsSnj2NX10!?zK2%KFKpDpqnov~84pE{N zDP?rgb)$CeITtcqM&jHeIb~2Ib{iB~VVy9x+7|sZXk+YFAU(P3hd%Shc>P7NBDQ%C z{OARqeaijDG4=*Na)2GIgXZOQwKTRPz0<)%#OIr?+=bFWkDYP0ChcC*pu{O3>}3Y= z*{CsNXKdZN04G{Z&Fnb3fDH1eAzdzgOA%Bq9P`=}Q5sZt1f#n)WxGn+8OquU4Ga5E z8=u63CTE4@PlA;zUlT0E$O1LsR#2io-|ae~%S5Rji&J7De)PiOg!56Rw_^NlnjuWB z&$A{IDzk8x=&-AvFQ4hh&Ez`+Wi@tlU7Pmg;#)Xp{or+|&qN&P(+HOi=S`zj6+fThn9PTjKH4xK8s z^xy5p12SB+WHN4L{Yr!FL{7avn{xUq5*H53ubeKsmS5|B2%`kgWAv!^LJ?khi!b+2 zCUoNkOM2^&=III3IL~cB<#K(!7>AV!WnZDX9mXjW_~ZJ9uue=i@!MDOCLxfFo+$an zyB``_5_&gWb);U9(Uc|~v31NG*E$hAIR(`&^dQz?8sUF46kv2*gLGhoVE)GOh3qwu`9Hzo8CH} z#+0GSR{gpy8VT4a3%%~@JFG4g-x0m2KsCh$FK*%Kz1(cj1NM^(UF`!c+8HK{BDLXl zeCwCg|5{MwmA)pNin83^&xqvw=uV< zT^6FSG>YqHys3!O_= z?uD+r9dJxa(x~=HXca4MAh{&CzgS;*Y9!~t0NE>-|)WS!amwdHJC5x7pC?H}h)h`=V|LG@YkjdgU# zeoaghyN2_2XLWAO$uT)+M2t;4%7Izxc7W~@$HnfMw$f!~2=1AjIKal9lYHBaJWXdx1Zuq1Y=2!@XPFl`%CFAKtLb1 z6l45iF+jlE{FijO6@jP42b)x%$xwaQnDn#$PVZu zDprZvTqBUHp#DfvUB%^_^Hh@WA5}iKQ6kpHPnfNjhyKAOt7uaQ>q*A)pfPNY3p(8690?ia+T7% z>vRO3X|NDlxsZ3N&l#91Sx6D!|CzUT?GGEr6au7qF1-D?Jkf5jvbQCUQkEMGmXNba zee?LTCt-56)1vrv|Gq86Pb3gBDqea2nXXFsczDa;@sVEYD(CNyUus>hT7-y8)>ywD zlA@}kA7|`ga_;(&BVtgN6xzL@bM%d9>zNPTpcFK=?aChrh&=wF09rtsZIWKNDdFjj z>@w_5eHpC{Yq=`ZW8!w45^^p{5-<8gCSwndJF(h=D!LTkCB_e5 z_)K?n?S6V;CDqI7(NHq3kS&?@!OqxoOO5{Qi&1Qd)a4-P^DGd`%~?ZW{nnsKR%y@z zT>Q^Ic!W!ZLoUjTzU}Gq^;`!^F&jfSngl%|B1e=Kd#^!PRcpDqqR!}&GS^qd6>}%@ z1r$2r{B!9nPeRt!I`HbvEC@Fp;$@qYPjYM~gk(qk@r#Ni9@{U@il4B6&hesyN6v8S zZ2Wj=?gSS5N?rc_Or5sqBHxXkv5%27olm>#&EMU|kWp`R1iy2vm5)-*HtV_vfTl)1 z^FIshf-dSg5pn6aP$`!~97Z2~FwEv?5F#`|Ij{@6xBJs8(CyA2%5t;gev;8{(LDXw z5&ld=Yt88>c2*iqJgCh$dm45{%<-BEGJ*pJqS?cGF*1kvax2l#Oa2{7uJ-dNfBuTP z^{g*8vysj&r9tL=F?B4e=@5w%Mc`*`R57{xDTj+DjrA)imUe8mnx7%xI%6aE-jN>5#R7|>26 zp41+hxJh%{VjBrnt2aIgyL30N%ne8;^gz`8&}HjL|5T47M2vxA-0V>pL(K#Eq3G0x zpq-yV{m`PwVjA}0Cb_8j^R%gC;iXTpzrEaQ@)OB>mLgB2K6=jOILf{W+n#18i#5jA z=2_PV(+y0r6HQr8%jqGl1M*wPj~MpRGkz03jbAf=A%r>RV$Se-`tjFkH444`7z2|- z{oEnOJLjuioad>U2$HS`wIrInnt{kFVR;CY_p4!c2MBOZM?-uG879U%)F&I%W+>{f zJz|WRlkyZMsNX8n7wLVXH6BHh)_ecdy``=Vhi%;_=O%OCS3HW4u=qOe66Ye9713l4 z_A-#LOmb-bi0Aed0{_`ZxGv0D#KeH!`p;FD-##$X`lj1&HYS#;QKV z+$+8}2^%^rf?C9TdXdK4ssoP-!LD1B zJMYlChr>_9SEffAHL@L0>Hxf(G~s*a{X$>w<+~dEPa5^=sq1<^Ke+$;eNNOWXAPk^ zkDxO#$6l=)R(MVeQ;aNdNbB+7o2SAfhUiZ}o+cgI!k?=%mJjaFeLI`09K1jrZhH1g zLB+j^4e<$Pg_@l#ORKq-gb9bQiNe-5RRW@vCuRBQ^F;QN-^CHjK()bY##DLMQ-Q4S zkVOUVU*Er2fmuHI4G%<4X<3@}nNw}AoYNxo@#6xJ1d6w8gO@LU+bY#`L3Y#HP29G^ zlhnjAf^HVf=f@-ww2s_buhkk-Xh5n$dF_az;dG1j#`$Npvh>l~$Ardv9p1LgJ}`EA z1C~^p5%l9pzQwrW4hBN&MNE83IZh`Zq{GIj#m28&%dkM}{dI?mnr?Y#WNmZoZm7z0 z^*<@8;T-nhyif#9dHtXRT(RBR_*4wxRRv` z3P=?f$YMAOUeyq@IKB8Lrqt(7fkES9?J}Z_l-2$pW709kTC_-eg>aTbBCuo?^ruq zOlrXAy7jI&;$sX%U7<=XMDvP?Ny$247kP7$bn45A8VOlq78;}E-!wku*t7N_I2tU;-eI>wp~<#rjvQWTP*{iO)vOIy zdQ)W?^D1YyKfb0W+Lkb=Zv2qtmeE&L77FRk7CkoqlQ_7rC|8 z`}^Swxsa<5E@zJ`RBeotu|R+05aey15H1ZsuY)7J1vjjSADG_A8%S5qiNWu0KOB+n zg?=_`yJ7Zo-UV!d8)FiI+Z(*YtZvPgjfcR8UPzE$3Dd{Jov+XJ(M(o|W0t24AH00H zW_9{dAbfO{fu7SDZ0eKG&?RK^M#4$%u-1f=Nza9V0JDN!=wh})U*f)9joclZ$*-R0 z5%ol!_g<08_70r`n><7QIFM1sx9DhiQ1ht<#w9JgJ3qH=I_l(PZaGx%6f=B%eIy4_ z*7ZRfp7M2Z3xr~!sjc-1p=(^K3vmnctF0XLkU6|()37rjG9P6xSqwrNHQ?LEc!rcg zy@osn7cFB39T*9_Sr5&wLp~KFuCc-Xt{lF2w9OClb>?-oStw24YE@)?m>D#@*mS+j z>7-nfD7Tg_w^Qgp}TDHEP6n+Mj9qKH`EK4`?Z)TQbB%|mDW_}-2cML*a46P7$b zL4aF!t!DS@E}R;$Vl)`N{W(eh_ZRM92^Yd!8d(bQP?=mPi4v~rrEHx{PM2rPa40I{ zwu>fSf%3>Rn;&F86;w$7hV=Mt?pbJobg88Aw6_0R)X%;09s+MAqty=1AW+cyk zG;*IJ(%&UH5I22O;>PToO+X*gf&G7H(rUMU{GrJeleBB04S3vY6g@{7Q^uQJ_-ieG z&>P_3BmF?^sBQSCIH_N}Prs8#kr>7=!e8!!9eS%V=<74JHRzjDUfZyRa#?I{B)8FT z8unN#h+sTxi5M6|J7T?Ba?u5Cu;(NFubmiKomFyy_)t0eY$?+Cp_`-hoxK4R!~a%o|hFN366kh*^W@2fdj+K^iOV&&(lX#VtT(ia-a3> zvnBSq)m%p=oV-5yZhT~56LT4C_)9J<12iUx-_?SZVGES(aIj1=Lzr-Np!5Ud;VXc9sRg>3k~v<^-7FRR+1-)u5xj}jZTYN*!9*7eEo z%hK_6>CSI#= zn}w0sS14_6)r$1ckk99_Y$2%{v@J?^Kb?eo3<)FV&&iF;G&47H-9#s_XNiXgdwb zLoYPNK3ZIjs2~}%%Zzb|5$~=^k~A>&NUS}*&|&r1qx-U7pzZc8de&x0A)(Q_qUH8C zd+D)on!{(Q>ib1zrGjhRoL$_JBC){7=$az85F5WUlsTz3$bCEcFk(HukC4-a8TH#f zzWP9^YN9?yqs;VB|C~==SzxbX6bEi)S`pjM+1_?m7E&GLUfLac@6k1)S{VEQ%2BA# zw|+MWKT2U}g=B(YPa{NDDT@>3H^XKk^|#qPdutz2v7sH`H7;ORiooRS|gi{qCIp)vi(^bb)CwP`le-JJ>|-LOef1O!E-JEdE?y9K0MP(->zK#&d6DAL_ZgLHlC_Icj- zJLimn4u9g_YpprwRTEUu`S10pHi5rC-nlQ|LI3rzw889H_CHtvVzq9Mz2QHwr!+RP z+D~}~ROE}-6!3dVy!qd_E@J%jniM+NI|M@`L-($`sr|0riKl|XR*)5W;$`Tee8Ikz z;5tf1M#AE|29S6wR+QQI<#!wGC2U@=?@M$T*n4&VGt5*z!se3wtMF`UQHxeVg?)g5 zC##;Z!x#!8DMu7P86+N|6-2U*i;r2pxbK(~x+nw5(pIGd97i zv&)GGWBuL)ixr?cmJ@_Il*}vxS{38hfZC!C^eQDiZ?AIg>Zge47-dcYhrmS0?#=~n zepuF{E89tc;jH9c9f00fRWj9aSaG`!;10|fg$9=T_|e?WRzJ`E|BNbrk+|Aoxo-e& zIogU`x|u%g4=`&^0||k3%WiWiW6cpD^{D;0_B#fbNpp|E!P7nU`vYl0M}$IdOJ+cm zZU1Lu3O5iP1zO2`J|QTMTN#ZKjp4&u4S1N4A>313Z1QCu_u_~hG4QC5y@jyG{+ds- zBu#EuBcoR2W&4a#{DaA@b>I!XQLD{3yI=K{$bC#*aSCc>VB!-jKXR03%j~_fF31Cw z(atKJ#Xq}poPX#`)=Cr$LP7<*^FqGV)VdzLbJJ=3s}=y01cbMdAcr<^2iCUHQTh1f zd$TF&Hn4uw<|JCYFnQ0#Mpu=}?&FZSFS&3}nP`0Ff_c~^X?KkBN0jXg_P+&fwxaxQ zjQVW&2J$dETB3+a)O)oL|1f*X|4W-HC*70#K6>TXxPJ)H4LTAZMFURN9^SDw@N|UdRSyEs{0oiOQm)*93oEbgFAcz9E;D49!XFIttIeb+=>@prF!@eQDd#@b0zMwHOrJZmb`;Qv`Pil$-k z0NDVDjE-^v_F`X?q$*Z2(eN4H_wuAn7j@I|>M*sv7P!o(hD26kGE#!`Y8QA*wb%PT zm}2oHtP1af*W~0gUyHWG3d6oVCFZ~;6L0~k`z)g-^^g>gc z)g4fIgDiQ~Hqrr2J)gpEo|7dhL`cTT`Ex~oyVtAQ%H_s_2ab|5E)Qok5^~5EFK8+O zk3zznn&}rqBMA>VrHNt2!0pfCzcTyCyof!lnW}p*1~soTAGY>KdH%8u&xK{dbtR3=RY?wG@{?H_`HG(wnXb) zb)?}1E-w$D%)*;`8-Af>JV&lqSnj4s9m0HU>+rsC!P5!z;`dY>=!L$LfrOr@ z=scHYw%s4^s+QOBYWRwe&U&vmoP2VHOK_REQ@nOx{vZ-@U}u*M%^n2Z<@Qe+_-dDO{O5wci^kDLHOBaxS^{?mp>8^I6hH zbLSlT6clpcmcVNLC~-}Rvn-hvSPW;K69YcH-p0&anw@QVZ3S_`gREHtM>3hGHfbiM)(TG!em0JqYb zaorICfDP{8eq;oo6|4J(WjyZ20j^1X4stnEfbr&3(GC!lZj-!lp$P{u;uZ{&R%sax3- z*7`+_nsBDMWL_*5^FyhbW?_fFk$DNbIt)s-ab{RdwTPK-IdIn_5?hWITDksR-F z+E>V@<340vkuBfa|DdZx-@sY?pBvhT_dP5){K{ux`q-!dq0G~cx;473rc8%T1X^~0I1DTuQ7 zIT{Muh$cc9v$K+7dyVUA(K~EUD=tl%Q0761S`hN*oU!2MV=*^yA~%sxW+zf4EN6?4 zvc7yBrbTqmI!-~uP+lh1*|bQy|E2}qD{mL9{p+Ymn?Tyo7e1I{og?HN6K14Z9xJ1J zy|1e8RP-D$30)8dk}-AoMtxf=#vV-7t<&RvnGkYyM`A58J>Wqp(f93a(V9C+hF>I7MiAA2WqaL;#lA}3nGKYyk=b|wu13m{4e zlW01dn_P5~G^o=8dQV#Vz(S34D7{I5QWAw_!WO7oQlI#`BOD`mu; z$~igINLcrha!w&&D?XH7naE_Lg#{bA&5j55+3`=Pk<&`NF(0}xaRQ?Yn2}P;+~7}W zNfp7l5`^vBE{S##KDRD=ox?y7K0E{yC8myvZ56Wt6~9=Kj-_C zopsW50K<;h0c>ny(`G?*%$7446ru{(;(_?rVBP>5JIb1}#&JfWjSEi%7#xno8S>J| zo1_qrZh*dS`rYHC81JaYwzu90jRXAjhf@4n+x9Mhy6rwLJa*}lbrS04sUDM?65B(gJ8?iM!v_9;XH2}ns2KB*c^KEo{9 zTt35u!YEY~Y|lYY#1fFyPfCZyu5!0a_{Cj0(1Rzv=vGFpD&-*Dq(YG}w7XEER;YynJ=-Tva2@dk&5Wh`BW(dnrg;qp<-r5XwDyCohZ+bATS5q zlh+5xt`Nq+ZQLfac?N)z!o6${s8RB4agfQB&{-SJi7obq(+GDCSdAkL1^^Nzj{c>M z=W{Op#um_S!}?;*((hMxpd=!W00lgQC$fm-;=y*uy3r7X!d-FwUdKBwN%Xv{nb$5I zsNimW0KD9tL30FGjmbTA1lZGX;2w|U0AoKGGybBD08}(qp%CakDszNXl?ZabcxEVo z10q=vLm%U_Oi9+b!Q>g)N|3i9^%|gB;PjE`jz~+{V}Rey;kO6XL>@J{w`2|_&>Sbt z0fQVOC=BWy$F)pxqdxXJmUAk7kY^fMLt}AVSR)U}fCqN~fSAS(oA`1B>yO}kkFj-6 zZ5(#+J5)dNEUo`w0hoBoPc&WpHB+0@g`ADzUj*4ttxaC1dYYr0t|fnH%$5zn&sPH~ z#B`#=xGRF>crHpmkXc~`2zJZb@0pSKQu33kuRsD3kCf`Q0ykx~Mlu_L5kZVe`jxpX zg?BFx59wiQ?th>L$UfmgAiXIy#y+qnpgpDYQu=f(Y>Sty&2pJ0sp#0}lHh?s#4bHn z>Da!?i#}kl?+OYq!H}5;L*TIq+Y|kWE((LYASAztI8c*?0B%Y!^2NZKw#lDowt}W9 z{@&n|U-Ar`fwiLPpMGr-K1l7?2A;e-wT{Ipbs#-*3f%il*gW{;b|CQjxvFTl7S6;+ zojpKR-H{W)C`$p|s#XE+-1>fKp-EZV971NtP71lra>dX8$fl6076@yY-0jYp(>yQq_DB*5)DKSDg{;m&02oi^X@QjxDaSJ{nmX* zd9yn}1t$vZt!9u*-v5-3>WL;SZn)lqi#;_e?+3sHT`m^dDB?qAsi1FA`dZ+L3;YI3 z5Fq&-j;(VP89$4596-K1$)FsIag`wL4eU41*mE(dE>;}lfZx}Zg(p^02qwoI;sfgQ zBm^yB->+4x?ZWo8OMXY^^p()P|9-paO_cHiM&N?y#X&wCsun5r@4f zcNM`h6&DKG(+(Vz%#Gks>?dBNG5vmz3Sapjiv9l&yW+6q9}moAYs5c%NKwEd!CK7} zG&>V=QhB6B^X0_^gKPNRXL>Sf03^C{Zd&C%+|Hv%=tongy72;;@vX>!BzyOEzRT|m z($a8hvSvS@c093^S4v5+eW{h}a2_H><)Rl$7i)e?HysAnQcCP7-LO2y1Bkv_r`Oan z4mD9{Uh+Vj0nEKooyH$IzhDg9>azOjKA}0+=W@XuLE^%5u1VJbXNd2+uTz!NVS>VI z6(Rv#`AlV}RtNGT7NBje1-ZbO5iiQU%@P(haIAe%$#)N*A zz0(HO*o>FNA;~s&o6JA^c!ae%<><@Fim3vfh3)QBjKa%8OU_BP9)|fe9N<1`PrKn= z_+-u^Ty9uSIN4c{RU4&C8wf@JBz^%YD43T(j7IEN=lT_8%P9w6@{gMBppSgMRV#<- z_GFdjCwP#M7YPpdHRHnE4*{~1!iA}_$aS{Q%*3;E=VMJYsvqn*#8ih3i~#Ugt5(V{ zXW#u=HfWefE@2@y9AaXG%#r}YBedeZ1iU+Z$?xoeN+hh3&q;5kkM&ESLXrI$0F-}= zZP{;V6E;MLB6H8EEkSB}BJBH0)-N{1robB>qhD{}bD*#yQPn>VeCnoF^{4%X+`Zo2 z=7p?M^(~4ayGwDE;uERV>oebyw&J}YQ{H}Xsq^hBJ3O+je^$AXKH<5kanzP!U!0I9 zTy@&S>Q-!ts=SB4%W!jRV%RMnIQJ5wn}M!s=WHcD-kr@Q!6Yj^@eLq2hc%H_w<2ZcK-G*vv7bN-=(}R^yG=+< zkShOAu=2Z>u*m8Jr=u@JUt1iizi&`a z#OlV;s^}{(_Y_0NBrCvQ%2#+pG8#)C-j?eFFv6~B!37Wm)9Dz z{me7K5kILWO=*~H;?4w%ELqBWzAMurvGgO!98;qk$<8E8ABm6hk`p z_lo@J-BL17VUy0yb+|u2;e+{BH8DoUKkG7OE7gXDGQ;)T3wjh-YfS`EpqcxhF9x}9 ziZ>u51~p3WQ>pWJP_fr6K{$jgd#=}55tr@$AwQjQfX@JZ1amMoYsMc#b)JZrAAhLK zE)|Z>fs8Ts=5%wkuyBq&p=$qm7w+HzP{f;z6$3g2-&wAv2 zUHQpAq({AR6Jd#rg0epA?IY&{S`>T7xgA(u*J}_X5VNXPO`@gLF*l6bogzHz7)%S& zQh`z&qJL#KcvUfzvOVTSpVeNpEL?M+aEpB3IBUPXY~Q?$a3C+2(<(qqx{PqQtLi30 zRK3}%$m}0 zjb^piA5_~cZq&rife)ZQS#VsdOKYs7hag*{{!$d6a53n(O?viTU&n9CKz@xS*Uh8; z4{05~IvIN0-{SCWfM&OW92uiH>Sr4Acax=m{n`+E1>gcHlv8CY(+Xwk+-XNP>F21V zBLXOZrmPLjS-Kn*RQ9>V2vnQk;oYSc#@|-Xx-6!|9bU8W=|>Q=A5>}hj>O1Q8$Hx3 z-+C7I+B^*}>OyX&A=E{`&(Y43_vV_=x#d(tcv?<*dJuodGVRp^Kav`a%<%8g(#lBa z@G40urj9RqPq*FUfregx{#zEtG!Hp|?^+EtvCo;UI<>CA>!`yw1+W}Lz9GouodR<_ zn13j}9w)xbBj656i&^_WdW2|>wi@oahaH}x?{cPR!qzz9gdg4l^KOkEx8+~)t;po7 z;^~vSpJ5>Vrmc{|CU1DyaiIyv{j z5&;>8wrj((R)Fr;)(5*r1P$3cN4q!PsiNojyE+)n>p|OXsGHMQrh=81GDnNEQe;?m zf)(OAHE#(>0Rhby^Pq{sEey7()*(mSdnpjfPoZx;&n1u8F7mHBToUdtLtKV3ck z(KVc~aWS;?Q16y@i_=2EfOTa zFf8`vz3-Z44p5qD!x9+#qYD1~`tiQNH9H|Eek_T!z47bY9cjz4}D5bv(1PL)UCGIwBd z&`;rVs-Z)K{@))nc7`Uz_9v2>a2zW zl`JW#&RJpoh?Y-m{B1#ZITM+L;{ue30)<$i#__|N^N)BZ{y(jek2kfRqA&(}_vwNW zNrYv9DVpnzV^16)E5+*HN`RmjC?)p3z{4Bhbyl3F>WQT$9|-qMGz!?De1;PGa1b&v zY+~li`~g~!KhIdRIaVPsr=Tg#?2)Nn8($_Od77#S@-Ie4`2gV=R>Qvns%*soUIK(D zMUPQdK^7UGaAbnyL)nwH1e>GAkA8Dlt$@LUEJl>RCIXYDL!i-nw0Hv%G@$YP`5ABU zUVtTG^lLC0G+VsLH|xEmlY}|%IeVRe`Pn8l-Mlete@Cgh+!jbgf z%THgOq57ut9Wa^eQ}#q{0bbzeqy@#2m%wFB5gy8!!CQ3I_Idtc2^X0xo!2}R!}ZTx zYoCIkN(d0eod-Gt!`kC}s1txvHhT9s2l1@5{tX zwi<81;nfT^xmT;~LXL~lHVyFKdIJn&YgBCwJ}Yje#gwh-pK*fo&MzAr^ z{$q*^eB)WLvZ1{eFgDbl^dQ(`bhaOy2P=@k)m}8%fpde92@l9?Tjb6qWWJyH*UJSQdKJ<*O{K__rtELWwEjks^u@ z<{3(?3uR>VJ`S(>{=C(TKrJU*VG;PTg~_%dDO>hWp1QyGUOpn}%=ZFrPrnWh$3wrvf{V1Lk=QH5@7+qRZ{NE?6|ae*8!OapGS zewRBSEzfMCAA1JgqmLeb!^3Xf@7WQ+mAJM;opY62peFQ_HYcYrMi z5jDg$)BOf6yZ#9UsB^B@E04#ZVZA9w>CArbYTO{zL7jk`Y40AoT|JE$ZD&Eb8H*M2~&G_9#?x8@}{+XiXSb$y%A zAzxb<2IFlrq)?o-O5fghWNrgrMEUcRaR#*-9UkkVFP}1&G#>t!31S)h@b> zg0s31>lVt2O}@h$UJDV3q%ZXdL!00nl(L2Ft$MdQQ|TVRf%Kk9oQxiX2GD{Wxzs5r zYXTs$9`ClTfEbdW;s#XdYA}lk|Im|XS`l(Qn@AFvZTRx|IVr??F)#5XltUR z|CT2320yCZO>Mg8k~T^3^KvBc7O6e|M=2_H>yB>KVr)Z#1Zki1KGHO zZbkEr_I6eewL|MDB!d{+ya^CpD|)z#Wt1-mq$YcNMjf6C%ukt~RjmALzT=&yf-I^H zfTsHn!azu^o9v>+h#2j|q~CBX2g zu<;!EO1|(4-FzmvBo{x~ns`8X1w2%&v(B~nfzOB=B*b}sHarsjr(XZ_w<{Aen?`E3 z_v4xBg}heJm6`@-y8?UfbgMO8QK33AcaPA8yQRraTWsFuXeP$9CW>vW-<2iO4YswE zInp1WnIImddO3gQJ9wJ@ggc8n1eORefcwvq6Z+SfmR^?gmg~kTU-e6v0_}Q?GCEFU z+daWyGmhc*ljx@CIXNe-s>>1Fm9`A~s0Xqfn)L9POQGnJWXrN2ya=L9J^PCq=G6X_ z7dXG>(3`vy}wmO-?!OU2v9cs zAQAPFH)&%!zN4h)!^Yi&?1O!f()MHd93`2h=^(9V3P^kODx!72Au2i|`*v!?MX-$<-Vr5#zJ2*lXE7_TsJ+z?w(>X`ZKPn|Vkg+kS zg}*ROfiP7{>A0lsIz?R|@$vq;AXfDKo*wA=Q(zys|9wS3dsa^yWE4IF3b$jjlB zh)IA#w@yEDih~bHK4{a5zX|kkWyu)s0_6-6?Z6F~%5@2>n6b;1=o`RqZTn89w28B0 zkimwe>GHV`6~SO2!3Qg(K#+>)vTB&P8O$_`I#ECxV(kNJIgXF zOa?JI9k2KCcO_2)tCjLyu(-&-u~M3 zLFf))t!1We?IpicN8K`6M@NOfO4HJDwToRtqzy$@Edg~43V+w zzg0CNdfUcP{JXP-2bHa`hT>ws8;5wh2#0tc{8=tiuJZbt^s77WXO2a=X!(!Vhw%P7 zOw%)l*NSsjVhQx;7a+7tx`BAn@0&@KB>7e4v*9$6*3F|=pN|W&?=FkXE@;OZ<|bSM zfp9!oI$(OdM;mPbN*lLkfZxgwq(a=eBp&mO(XiylMnD0i@cio3|JFk)s|nALKnyR- zy7>F^cTm{pVD3w!7_ZqzCnq6v#rcLd_P%5v_`(kMEF7ru{gMmp*RdfBZKi~$Gt)dM zO!n4F=|qIlBAb?az;IVTB(_CyglerEZAOR=vXpe8K6DB=VVFJGuX+5J>Y+#%r)+e0 z3ZUf(LrBc!-u!uQHM9YGm$>AI2cN&-p$|L`CG#OMW5Xxxm1g*3+n1oME}ypr+gBOz z5Q_dzNxn?0bqD42u<$(`8S?Rqa^uhNkOB4R{DC>kt{~CSww&deICJ@8YVN{aI znFL$Av)TO1R6L`PlB-J+pdZuIHWjggRuu9Io1$@hid0~>dDryU&_nW-tN>dPk8%WqHp-Z-YN>>oKd zEXvnl>dg8s?Th$_?B8zq->|#0#o>Hpm!QFvT>~uO%i8B1z_Ii9Tcp^ttE3x2huK7c{<6Ihvj{?xFyoxubPzZ}^=FZY{Z zT4OXlBA(u1_gKC@HiraslqXw;x6?jDI1is@2t?jfK;*LA75qTU>g)#)K&c+{6QCzx znRRx>LoPoavR1Kakgxl%37#O(osr<_$HT#xMJLhYp*80dYs&aLc`VcZh z1LYDv3OJd#!vP7A3z!l%1ZQ7ENWw!R&iq!pFO9E{CxmfML{zya+V%z;am9qPuTgp{1)>2Tf2K)`-q!<|0|E3AE0EFkm!LtT{l|S z0PR`rz9XJaZ{lYL^Xu>72OF~A z55urs3}F|AJK4IVl*P z{=Mvh8N@~s5vLk&_qH1=`n43V%2W(n*HfN_L2v0u5Sj+--`3ay$Tljvrrx{ghufx@ z$71oMH3L}(o3lc+d}rZ9yqA})nXIxqR-a&4GjKrGBSH{hh1x5tb~w=JLga5vKX=PO z+Uov~Gi-E%0gwL9p+&~v%+gQQcZM{A5pRL`OiFMTw|DJL5;G22^Acb^WyZBWWTIm` z-b*1*63P$U8X3=qB`|Bm3!OI72>WByKr74Swy2%vctUpP+?}On9k;XKaf~&Ns2-5TzHbJy98}*KR|iB2O(X@rp58KWz)8N` z=u>%)FHUuOEprVv3rqnnB7*~@1hpY9-Kc$z z5oHH54=xAR_}{ztGKNnA{Cfw8tSiBY{A1)~h*0>ZHdmD2Um5;{v2G~0NvdJC_GnO4 zzKX=az{5b;0~$zsS_KPBHQwx=H2P40Jl5bsYjU&S`n2E z4>(k5!P)}a%g54ruE2&I$v0B4?8U$kC$yhXDH#k>!?wY4Ji+ic2zslctT&O*n0&xx zk0d}N*EH}nH%*jg%Io`BwC zYrFG|O#7JdpXd5rEaeVqV{W*_tpIUcocSiaHvZxuQ!c=PI>fM_wEBJh@Kc{r6Pe4G z@W%^Hu{NPw2?FIZBLRo{a7cJ37L9Z&0uCz5N!l}%hefb`iKWlo;Iuw1Ih!LbA0LlG zauI7IkkA=Rf8f|}bh7~^UIPtME-;qgxzfY;*P~$-2Nah_;k)TkM}J7o=t4ZU1DeLi zu}?tpM-^egnH~mc?(Cz=8&DjC=4YVHYsOEp)y071p4U?ljr{rLuGy_PD|Gh)7#PGaJ0A~phXT+(?Q90kDOZAYV$fOh+A{Ke%}?=R=)(Skrj?} zb7ERT6i5*4agPJOZ?M59605eWmMVZ8h_i-KPVl2vSk)UZ3JID#MY{Sy zrolr9WDJTF!RLD9T-=+F-`s+yWdb)=#4}z@cRk139;{6HaYu=g-y(*$@{43G=;#!W z%^OfKmaco1V`#iK^TUe$-~%3)(b_DId&IBogokTJ;)w0b($k#hs)0XV1kDV%EdSnb zZnh4zSL5qPgNi;ABf~Mc3(wk?F1rPlzhAJa($nX9u2Xs=__en_yxw^nP=(QELqUG; z} zK^ASg@g7H%Q|a*JHQ3EUhQ-lx6N7~h5T;{3LunsiRTS{IT~JvZ7ECUTz=%DBh|7Fe ztRkMGdwekW~M@;r8;eBQw1_YHhWZv&xxYo8VO3||%xdAti?Meg+u5EV>gv1b|G zbjFBqQ?2-xgK?L+^91(iGFmjMsDv%%8{RG^o79yLL5`(57>}-PAg^QWWs^o`b4Z$;f-~l zrs{$-cMWSCPSe4jI@7_qh(D2TLp3UcppbIuETjP1S_rx(?pMukVHzV5r=;4^eA@0rj){q;a@$ z>;PavDQM^D$z&Vt7yOnZ*{O8jG~e7viv^be6OCJ;R*4UBA}U_U8R&t|7V4U@Y_xfZ^w))bP5mQMI>_5TopmHR|?S^02f-v~U`XBW37k0BZC|$LkUa zl6eUfSOy7ac3}0tymKHE8p%K5{3EPr1XAvU{)1K3WdeIK`db8C_kQke6KTA%z=eU3 zU7qQ+N+M*fayhc_G1-w62iC)*%#aRAw?Efw&@AGMGTQ<}+^jwDuTsk4%_lp|T5Jj~ z>8@ed2)mL8=1;O<-kUwdQuEhqFh$P*TO$||N0^4n8?3&1Fry`p%YOly8(mjde~vD< ziN2v$e5FjKwQyM)fj*Ec)D115Sdkn=2>~&NV4m%CqdSjIM+ON}-7+5DS7 z@N!0wJq}rBl5Yod1(nVMq}US&!k?Yg_N$_6pdRN>=4`T7lR~HWFE5%uzntg?j?pbm z&g!0MIi~QVzX4~!w6%5Cdk^K9vBSgO*IBdtU+Cs<6U{X87VX|gR|z~qb_*Qt`mIS? zNJdG!p6 zb>2-l`SB0HXrr^wO|3XJ{T;e@uw=Kr@#KZTpD)^2!h? z*X9=JHFz;f8^B($8DJV^HugiipzO8ip8-S#BI-T{mPXaR2lX$_FUOquj61*38?j%5 z18bA-BA;fHHtD$cV?=Tpk^1=QwB%e|{>(Vm2k>lZKe&Hs+f$DK01!y+p-@6$<5NtP(X7~dLSeiUNXSU%xk@N!gP9>lK-LD7%}grtuqfglL5R@{WN@ttTz~@f z3Ci7%B6e)MDQ86aCbz3QhJ}HsIC9S%=6IO{OggHa{p3RIJjr;sk;LrNkP@@5BTuG# z0w?I9m+vqq;14WJx%%#u3E59{^7I_dV?A{vZ{aVhz!j^~Arb6S5iU z+SR2nUd5|H=rgTid>mxd=e42}_41!AD4)m>xdPkpcxuNSY1vS`Xb;T9Csx7Xp4bv! z>0sCaB{RXW_h2cUeh9W*3DgP5hsiP!FWv4>dn#YC1wW;3y+U?sS7SRFSsZSf z1emy8VXROTSz*F>eE;XI%X9lah5q&yRAkh-ZL~n+H-}IH4JO^|juD)&CZObC9+a`C zf*UqbKMlAuJD;GbAhJk}16fQ4GFXwPeb?B6%})vyYtR# zln`(&@cSI`+jmToE_|&kXY&jLQOs=0b2j=pkn!*XNR=HuJMVlgcxoru6rLk0!Tj;t zb8Ce>9TX@qG?2`3U4@`E?#RMJ&%c}jFWRH;n3Ryr^T>vohk#@nOn!qjC54jVx@L?>%A09s`%qfMpDwWV6wY z706<0(6&ftjk7o&@*mf>983)j6=jYq&oAfbY6hlMy}eeD!}T(L`b*XrVDxfNQ~yT7 zfNATMjP&)nj+zGDzlU~20c~td1M>S3v0E7e6DU`7wN|FXm9UvR#`69h{9bEL>F+5Ox#EP#&1l&GVcHW8H z#KEHjbSD-ZBZ`<#5>Mdjl;+M2Wr!>0&@~LWA99HdZcZ|B3gSWbC1H3sHc+9zXN2Kf z3N$e{US}>`At?6E@==3+N6Jg${XPU>&DSaTAJxq+h9>Gi{{GEY~&dhX}PAjta^g8jCK6VdTkO7qz(A6 zOom3FhqFd}QIFrfg#kaVuE{oUV{gi#a9H+c)&2OZ$|Qfn3v24>19QX!l+$F&|nX1@5w8@HC_V0+K4(v1IL0b9^c5k1Sn?E&P*^n7X9lI=vri=8^6##8j;^!KuiY9;PH zOWXE~!`O{S8sKOG&r5VE5$%s5`izr`wu|3ZGU!po1-x#j> zP#CfmgQeq$%0us5FqZ;?bQtXL9UZ-H0-gRKIe|x4RiWK%8EOmGnK*u>KD(1|m$c-u zxeStSHB-P`yT3m?Bk|TaoR(}yN{wK0IWPw?OnkdgO zosHst;H8j6zRE|w1vZ~jhEF-}lA#~RZS!A-?8+S%-2W$)P#{OTXqddA_@D-Z(VOhp zNNs%yVI7j~B~U<A3C#;F0WLbO6$k zsSvh5KGN}_yuYB`JiM+XT^jsvvxWz%&RTH7-AUaG8j^obv@X1Vnmcxp|Md>*%WdVw zy>)RA^1<@GXyfg=>s`hS0u|O z&4Z>@q7@nz32z#luv41DTO0wtvy9V6RXiWOf$ED@7K&>Kp|(3zr1Lam5y^#dEG<$Q zODA=sf;ZLnl`R?F)k#Bp9U$wuD8jRG(i)x7Zz(kt0%lbL)_o^bWs<44-6m{ zwTl7YPN7)Ek=;1NxicDOK_@C4)^RCL>_|%oG`^ZKEuQ{BRq$cMluSo@=~ctsM+sko zw}Nbl1Fr#~b=#jHtNvS|gEXwupu#!1;@^+h6$80W7Mv~;u66!yVV-CtnERt!!d{2w#tnNVS+GO>LcXMC_Y- zd_Fp@P-y3NlAL9BQ5sNKH47CBn313O~sh}R~h#|57byjhjQIe zR{mlr!0!q=cwt^(S zhu(h{q9RR=puF$5=2e|wRHEK-?GQEP$wAg9d*)~lC107Ea2lr5VFy>js%kE!|XT!+5v_v_+t{hM&S4GzL@_z(iXOQhH`6YT4p!K0MzBLZJrSFVIFpO4xc^ zBLEC{0OeT^EprEIs8$XKfwQj%vxOC(yK(zpEr0=pSl!qea>Y$JGv%R#w?9GB&cn(z zz1wx%`|b|0$aZ~zJ4+hye(plJ6}8UklePT)b)w!i=fSc7rGMm~0Iz$*o<{&}f`Cn% zUcEZlS%=ViDddpRe$o*0EF?zGkZnR|hZJ6g-?DR8LQJb$f6;sZNw*eiUA-xi-!;Y= zPSfhh@ossM!>>J^C&Gjj2!??L0ujV+1_Y6~kxf#*w8UdzY21l#D16+?5Nv>t2)O3; zP9AfF=f5i^>pb+M)9xwvE}a|;Zof=gc-!dQR=}8i{nePpGQ*k;&$Fw%PCKOkaRX>n zX8N(O7A+(9p{ld$uT63nD-(1GUn8 z7}X>0&QJ>!RA(jF;|F#4)2*Ymu?hEysbMCCynetq1#FWjQ!uB?+Foj7tM6yiGuMsE zi-qYB)D{==`r9dJx_Qyg4>HBvJ_7niFVYNB;B@YYja17vr9q|u+IP4qq~v3Ri_6oQBU|fP;?d8M8Ms>}wZw>;X=(X)8zK5s2|= z0Av{DwB1NsJ9z#mj!p7WgHNsOdgvKFG3Mn^57i&ug=Z-aQBL4Y^#9$luy=`C?&M7I zoNa2y=)OLWY%ROXfZ=e=ag)Bzy!%Ud~ z8%*OrTtSsSU5zM}KK?_!B|`PX?8;?g%xGA0>6ITCRv*9t5O_hnc%GuywfDd zOTzT~Zw7zD4}!>OOO&RkN9L*XBWV?YNZ8@zyT}E2MC}Je7P{#sV>b^+hcR7v6VvYt z`r89~A%KEC6fa+X7)f*_H{b@v`PPr?*s!`kj>A6Q@U7k!qj_(4G787%z&Z?_DPdL$ z5P#Gw?i@)?jzzmoD;(n({TiDRT3QJN1%lyjn*Ux z1D73&_^i?c-5E{RVwA5);=GmOv+$6>tyc zRt1Q!UH$GM)$e)_hf4qYe$?;{7iHMf)F!*8-uT<2w!>*&?(k_Oz)Rb6?^%q(A9&^z zkcnOGkXC&;L`l2ZDJtT6{tw(4R{f`U08eSdsCr3z@|E=$L_qWJZwLEFxP_Mo{4Ca+ zMMEwMKeBvAm9_znp?y9~59Y-%c?mx52ba?61&RBT@U_{u{Wj zk5{F$We1mXWrd~PH&d+L2Lyb6ZuWi}hL70jab=d2zQRpR$DIvxe`M64ExhD3qETaa zC68UnQUWE`YtcfhqbG9h9*%-eQL#}*Y?I$4bHBdobwx2>{W-r+-ve#@hEF_y|)HDT)NCTk;3PnRq zL^ZLjW*n%KoT+fymG<@IZWy7+Q2{k);nBgOHD1v%--cSO>FqwcioCbERPVnin}ZsA0FPG3rArFA=KFnXP$Hh=wB6a-D0f-L zVn>ia!u{0E_XM=IhcLlWz5xE+KIOUQtQajPk8Xd5AK!;kk&3r_Ryi$u1UQ4Tgb~ZA zfu|=u?`qc`J8U@qO52OOo^_8BGX!uQfFv#PH!-Pim_9Ri{#^XKQXdTuj~5u5*Mww( zD@Q)OEr!7!Z!Q6ZkDFk;cFSF6FEs}m#eoq2^DCfb@(e~Yw>cPiZPAFHs6*KSyAvk} z-)upDU*ssOq5W|8K@};^>zY#n(=9LJR9D~%u;HUnz99NBv6*$?P~to*{1Uz+cx!49AFo$58u`f-EycyE*E z$?4~k8Q~#Ly3k2d`R8xA2CZXLf?wCLocWPP^EpT1b?HgEQ;k`lx%9jc2QxW$x!N~J zq(_eabfoqjx$GFM?1kDj2ta1f)pq|9k{72gd#}}Tgk~>Jd^oC#jq#Kzxc=x1a<4wn zyWx2Enx}vExy)1VBXrGC-R0txeg4GIKcLZug^uR?w@+`YwOZ9v8dL2E9ya1NF=Co! zxIBCr)4{Fri6qYfrDF>(`oKWtFIJ5vg1Y&+{Ei|n-{vrlpA&jz$i(=^>c_;vmK10E z2UT}H9dreL0|W@ALAW|al5Q+iotfb?D(Njd*_y)EYl8ONUyh!c+$(w5Qw5cNiyO{gA>XfEqr1v^V(no9~xP4W1yBDG+-r7R;Vw{Xif@XFUAYb^lt+ zL}K{^UszrsC)_INmT*CFa=(qCkXG!PYBi4TyZ5N2eK+TP?D4)xWv?r-hs!30v!SCIy#VIum+B`ylW zZ5;oEodZf7o$|RBpGJ`e!Pvr+_-v&c)C+7!t(1utndJBB3BlNGk3re+9o(<`Y2u|U{6Qt_ij(2GJY|0Vkq%sG>1CKYSx*rE{P3* zY{UhwoWh+z0(JbSjs7gPWgRyU`SrcUX9>W)Da&Bj8LXu!Dta%JyN5MX3lGjMB*O=% zKIjbqtbEuG+o}v%o27~!zV+8%T-qAZs>SQ)z~f_ExA^jagD-%W<`NNscU{8rF2Kt? zzVKH3K&~OclEH=SMe(2NYs+qfEfF-0CTKr4eE6ZsFedKbd3klHz3g(QdWRGEW-XNi zYPyyT>^{{(#cvBe=aA zcgfCtFYPb)cZmv->Yz#Lq#PqP3|rXpaCi1si@+beGT^G_y@hFUn&$Y;UIj|pU&0Vk zN>fYa)dM6?Rzi|N@K>LX-vLWs3QWn3{-oL-=#vJG07>t{Cq5)0dwmm2xJFvwYgAh! zDz(Jht7W}v?ry?;wQRi7I^g(NdZK_DnRp$rN)2O4Tm@&%LVd{zj34iz>HpPaq6c!E z?lIFxHzq`LSk3Rnqh?R0Ty&tW(iDmnMfK|FAO`?8$S_tMMwUdPFv4C<&04ze6Sn@< zCdfo3iltr5Wny+2?Tw&u@WER56Sis1%|p~i_d8sfb9NHAHH5D3+M>_AL+qMvXjMGCM|HUiiK=^QoDcyUr zFV)X0IU8N*I+|ToKxYV~kOl#t!&%>x2lqd&t~lR`^ktabR1#MO{weVG1d$qPpaMd% zHZ%wFjBsU`LezWxl)rN5Er$guV>}J{;>0^7Lt-0TsaUN_;qBF4X>m)(MJckN{UkSmi_NwNsDf zH9L0Kb_IaG&}n$`G92N+Acg?iV`K_+A8$l)dgEP8AwGnKlwqL0TIdxN{g zl%z{{SX3;&lbo+NH=YQN?L5cxk82J$roXG|>$`;<1c+jm4MYl0aCFfRx(n<;s%FQf zbFyEH57)+t_)e#{2Wu~c(9#3bd-khLKG^4`e`?P^XkKx=O}WdkF{ZnD0YJ;{3@yn# zS@dTZQ3jMQsDG8htuF@2pIV+ZIOKQ-WuQnw+x1y0#CV3Cv2yiyQeD!Se*!ggy9P)6aIu<@dAgf{yieqmKqw7rwH-@AfM;2UEWtfltOk#bdSc*-RQS z_*?jsO0%S$(#n=kB~vnf8R3}yR{-fb0ro4GJLoisYpWrrm zKTzK2b6fpFdr+<1GL-16m+bOV{`wFi0RLORxZ#`l!7`ru(dh-<`P*=pB~b~se6mkp zUtz2ao2k4cTmz1<0{-2+?bo`Yvz|k`Gs}F0zMW03U<4g+Pr85Uxzyfm0-SM%FZUMd z!NbFy;X~g$XU{Bvo$3pNG%wty8R$hW>RBUt2*Jn@r-!4 z{`-H45#$dgiU!L`?MBj?UJR0YTba|)4^I^bkiKGko;!Y)9BnF2K1{qRJ)3hQC~`aOR~*4A8C7cT?X0caSsmQ07+7RAD> z(K~!50=2S&PnmE0@e^;{eS~@G#nB-~nV5KYFf5H0keH|kqlWlFpvtS`Z4Mh>44Ls ziMRhU8r0{1AAH^z!iV~>J|daz&-vw|yl9OI;UH?mzUec34S3SL3pUAbPy-gvB4D3B zejeetGmM*@1kj?z_|CtWN=$;E4AA9%!W)2(gLN(LWYRy7g}NNz0)EBkb%Sq5;zO_~MBfgxS)C#Z^Dc!qc8{qRLm6H7h$7v{6lFeCs0#dzYz%&V&r zKesZ7WDbJHwr>4h7x<009AzZ{q$1FvFR#w!UbPKA`sFs_siQ2Idmy5aw__{poe(H| zh0iX7Uo%{U?w!<&o;TFJbm*xP@erK`Qxt0yzdY8SA3;N1(U&vbnCW7ftzqwnnt4rp zo*dY%5&$m*IDb9voh^Z15Ht|kvx|b|2A)`ZEH`d(n>M#B3D;pyP-rUUE-I ziE^mi!Ily_x@d>z%OR#x8K8C90lBt!++>9h0MtnshR;-TFb06NEn+O+=8qBn9Oobi z?ktteJ;)3FEzP7};{g81R>ztQU5fX28W>0NW-7pIs+EB0(`0+}xV@%x@$_9P>LqdH z+~k=cn}6!N%&1(nQS)hD3fyg?KC&+@R8Vw_Mq)FPNH{q0kzsQ8troTO!j0?~;ChWB z0w8l9p1Z^!2`n*2{}ABILEX^n?ylTQvsO~3zF2im4iX>$Xb#(0ak*Kz2TX4t7eidW z;%9iflWj}9@iTmc?r7)}lIR_OSmt62627D9PW(!xBBglkj6(L7m~3Sdrzh0k3 zJM{E`RfZW~z~(!ToXNtUTViX1D$IbF0#czDH};FR?g62SLg)x~VkJpqgy#;7&w-@$ zO_|G?Yv;`l%8L5TMKnWhc%%~7tLq{PE4heUlhOZm!lc*Z^oSS_KMfPdfjHOKx`>r& z|NJZVuQZC^k@-fvjK~Ws~yDpUt@a-0_$YG?nfoKR|zwf~EpyxDyT zmniivMtnY2-DK`<@Eh6Qim3aRJJ!yXk5EOnE$;e>JlnMZlCdJ2tag;xKJ)UoiTWbw zP7zV`=N_~OUA<3RpRnB;xi|qDXhJD62CQc7k)=Ev`jm#eB)3w?NofOAFX1|cVjYwG z3^7|NxD+83+=$SH9e(Fss82DO*kH2oJPE`dz-U{Vwv?m{z9xCI+W1goVMHt^Va3Jz zL@_c1jD6Q%@zCvT<*(RiE+dF4y>4^%lM$xb9rxe#&#_{_>6;^P}F|u zi3w$7(H7j}LAkWa?2<&Xf{Y4y<^LhX`{! zsesS5Ka0q=Q%pau(gpf9fs7P#Q`&4@S=r$Qcu}GQjhL2%ggaWugI&tJ@3|98+j}5T z!Suyk&)Ih_!)z&_Egy=O4`QbsIiNYTZ)E+(XW@r?e--=+J|5y|oB#s`9K)&C$t$gR zwFoo7kR{hpiR-R2g#6;eq|cpJf+S(C;H!8D*JoS;`V1UMmWGjUINsVuAKCT1UB63^ z19-PRgmY=RCxwg!OG-X~cuXRzX@7g^RY$;PjZhu8vX#d}r)Tu`Iwo&>CP)oCKGhzJ6v+ST_O36{cUVwoe{(RM4 zV+Utz;W^Jhiy}=AN zUn=39mtfjM1rFK4SmL1L-tkhU$$~~;``#n{<(OR|p~toVxg8Rz>9#bz)KW*v7Y1|pH2e55~R!3glG&ob&4?RtQBxRd-( z@rcNV2+4|(W6S^C7Zw&M^t#})=dO8h|KIF%s9Pmb_67ws{(DM8-LV4YO-Y$a^`ZU~ z6~D3ej;w};#-Jn;DS};|LRU=N_rsm;+w@R2oGtg5STqE%+Kb{3mLs8NWa1W*rgRph z-uuF(GEB~t1-|OBzbf0IuHP%(CxndsO(4Vv3AVQheaVziJ&i!M#hF8j$23_cX zbqlJ2z9t_z16H635{NBSdb~6i8s-*pl75R@Q_tc4XWYI0UP|O(kBOV?3;M}A$^7HC zodxtgMwVe%1Jr zQm7w34a^_cS>?O<;sbf*?8X+#Q~qIY+O+s{ z=G;}XXm}sT>sc5hsxyM$b=Ai4>XnBd?Jxp9ZmZvU%b_Ym!BZ$D%}rszNaf&B)1uPs zdATn}yVL++po!VFGqfo-ZHiLo__U%xO`CWV*(rdvmq(z2=!+})f}{VVl(Y4`Vl4C@ zppTvR1G{X}mk;L8mQGX)R-!6sDBH6u-lU$9-Ekp+6@8JRPah@K-e4RV&KeNN-=tQiO8V1bCC$hp(7b~=J#$Ul%Kdd8HjJoAS{fiur>F*wcuR%-9TGrUeyz)_lviE z8+7q|*3VpW6L=y3M6M#$D8JJ9FWk|0&gwsJiUI1u7)@~g72St<|as`L>8XlmfW zc#yZq`TAwJJ+1V?R;%U6+5+%RLm?;qpBLeI*IORZOciSPL5aOLd0;KvF1AnD=-=G{ zOI0SQB7Z)osJRr5L#h8P{E+vJi+Br!bWE`g72h1rkh9Ldh|r-Mwu3pbMWsc++;@gj ztTe2BlBD?5XjC{#`XEU@KuavXD!>=e;^xKYQ`}f_tc$kf7)c+;QHV+hWy#y+0SfVn zMXLvYB-;P{tEqr5SO6Aia$n9O+Q6&}gMY{wDh7==e(Tp6xt|fpTxiB6mH~|q?r*3o zc-6ggDi0k+OvoI_$q~bjA3JSxBw8BZK7x{5-g+}*+(n?Z_zjSvyV z79ORv>5)LhyjZ<{V{nL!XS!w5_n;qHcCF-PO_MryGLW4eGw&82o)1EPgWUoC7 zd8zabvKRlJ*L|qzcF{iPT^GU3a*_xaCO~ETj%EC?MGsu)W#iomM#29U-h$Lo)osE_ zV44R9#4&B+ygK&<-}@5>Kw60|A~XX)oPSgmL(`;~u8@kdLEcG0ACxleFqRjKRw{y4s&8rVbs~5A9Q8M*^h&H z{v?M5{wxzJ9Ad;x2z6oBZg{Y@1PZ?9)+x;a!LBsrOeJxXH#^kZb`KU$jVTPm)|+f9 zD$csg$9>*m?P=UqP#^6bkUtU1(c{d-Ph%HK=l&|n7IP98IamWr z-9ALII*WE6T94XaJtkRWH0Yr3Otw%wP3yRi86_8r0YOn% zRItfpfPPHM)?pGs7FC$s&WQ;uJzl^kSeXjnW3pV^i<7EWXV?x(xb!IT#7m{=vDCS6 zBm~(aqP7oKeE2aF1r8h)Gri{kJ&6=64@56(QgW-t408Z@VwRfek&rxWAe-dgKL^LUbW$3Tt1eO8?B`*E#Jr#q^C{XkKN z7fR!tuHlPMke>07zo|(-4-@5+_WHu?lE!Pn3{=G)$}XiXAq7>Z!uak;yK^oRstAW6 zYmi6Js7WfG37=fQEz;1Xc1Wz45;ZbyN%UD1!&~qU#tEp}b z=D7On*CAx$K8R8D>^8Z{bu_DUsx*93|*J1KuLR-K5-R-eJTC{lIg|ix-rSpTS@o8h^}AAM7VEP z7ER=DS*bZE*~@= zo}CEP*uNjNv}Zqik~OnZC12?nibA6Ig8JKdX^`Aj)rOR3;A4=AUUb=wUM*Abc{Sk$ zIC%L4B=!-pJokluVF1}qVt5E;1sutNfmJqx;2`DA$9#>Q93TwU>7-ZK%TXykkS)#$ zI`BaB>y2;(*XSW3ocbgU6UdL_ z*6{@ua~aVVcoeGNq|)jdPH%>bn1&puS#Vu+Ixr!%?g7Wu83< zlIVsHP8R6&d$hz~c$=}T!%u57(XbCq>Wlyt9=&IPAy~>ao14wQ-dh&#QtE!l`N$F~ zmhGGAXQo*39PfXZg>)D@UNi&VCl0DQbhTpvJ(}Yo)ci2EcrED95C*uh}Tc?u70RP^a0gp+nYZkS18%XvweLr^PC{x*dT_w!~Qs=BOsuqCSh`Kf3)% z+DoT9*IC%;awpcczDmZX=n+W)(sAl^fp&9+jM{?74G&IS?zyM+os%4WO{+sbjCfnD zUe*JnZ|7WPFykP?l`$x{Kd3Zx2{kk^C>o`W=OR`iftzA^P&czqD%M6oXHkX37COsA zJSBgGYQkEw;+F;IZ!8x*bTpAdIBYtj2YP60$dMJOg)EjbyLlGBHuNsJ6#MzIO{pmU zwe{fRJK?dFQfhJHQ%eFRpn&Uq;S_K)wB=2NkZ_6+SwRbxOl{q^*uF)L!tL@Us3>jh zb1z9(y&)~4+h$9U5i$KumPz0Q!5yEvFv!^Afg$@tO=4jx7x5@EWf(Q^F{V6Uc9(Si zJgD}2AI5`P6w>5fa6Fp2jXd_j1nsR-hmD|>Obj`;`CTt%L)lUq|9SCRhzj8bWGtU< z7qj+BHgu6(jg>_D&tCjY{SnsE$4?I61MREg(ExEc-zK<)D!y3sb)$S!x;UqC&Cyl5f<>1aa5n3CVH;(x))(d3>dFp^+E@nZSM zu$dorU`p}k&b&}4bmbs*kTX-z`6222Y-=!7006OHZxz)F-9O^4emnSFJ(D&l`*1R<(bWyuXp0CGjxQza!fxZNfYBc7z0eU4ieXC}O|tRfWfk=` ze~vnQ*{USKfv_)c(>m?#^M530yBy|Cnk|;#aGe(L^=NkAqgJ(O6QxVrs{*I47SKvWS`Dshzm;-Ol&iWR@h;HOB zKpFjHxy^%&dy$YPW;L7F@qJ*@@S**&HTl7;RpvAX@Js`6*X*LO_t2|f?ti#3xhLDtMh85Mj8Kf86MmMfFnp3ez2d~*rEw-K>x`I1INb3q z%xvcd9%i&GUSpImP8fivMWF;p89Bs)5A+R>)}G_?&N|QkYsb6;dOI^AznGHF%yduZ z{fL_7Lff;B%xj|~L0TPQ`FHm*2qI`X^)$vaHDZ{KK3`-D4I>qVp*o!9JX3V*cz=E+ zzEO-1XzsKYXGT}GUV5`0$5lM0FRIG4qZ(YNCABRhI=XQ#kAR=G^u&Wo!ej688 zW{XVbXn@!h1Et%In~&8H=DQhBD1iK_Gm-+_qYfGpi5sK18pURI<IgD_`>L6;H17MZBugBh+l299L!P3K)H3GvleCbv=8D*ze!Va;7Ic_DsoKcWF=nUeSz8Z1h31P#390`h2G5-$Y9l+l*Kn4M;sP7>!lemkf zU87+^@yEBG0XWztEa<+HC@DO{{?6gYH(>pU=aB|RKoF^M_R0m-hRk~Yd~T3^_* z09{>?V<5+hY1&N;6!-oZ7s=JH`2R_Yf`{vY{+jXLtNz`V8j=Yi$62m*^&C;r_(GyR zmPfBBtKAS6JZbf_KK4Oro1-Y)+d=&GRaN9X{lWL!6CC<*KnsZ{k!ef&@)k0dL+sq| z>RcYvJFiKKPvP%`B~*bYB|KPc?;WT~W!QG15 zuG)QVy5s;HCdiT+Z?##@T=uxXF=Z}N`_MvigM{+~?b@GIFEV5+tw1nOk14#pdnLqv z>fDfx58|P-3ZWS_w->_Pv`#LXcW$aiC{&l{o+BM@Qep*eP%QjGWm#c1o?XH|j(;;e z5Dw{0b%W_V5R&CI#mNHCwNIU~c5K0uPdC1cwv_Le2^S-Gm4XWx`0A(aOuA)_$E{xp z^WM(TldD(xv|l59m`^z_y-s0JC$1~;cq($s0=DPYzP6!|Xr z-(U^MLl+%tiK@8c96Z0ZLI_WM!ZBpioXIfVcfJdh={U4P$0+#NSe9e6=uQcx+>O0{ zRU)5ml-Gh3WQkD@vN8?w*K3N^U$Dw%AC&r%c+q0?AP0j3Fe0nwUn!r#R`L2Ff`p2TxjkV3`ioTbd zj*MkoL$?`qe{&@y!Ps@TiWETmmdoc)4;1vSCU{bzZKJU`C&hzlX#@_d3UZ|I2-Lh*d zLbKF+XZHY3e4RV;%s^2Ip^&6^794}%Rk4K9=`@YD?3r`BnAQ69Uv_HuGR3tYyZc6!^$v-1X9>>u5SueWL5m+2TQdkA|XP#!i`FVZsOPSB|MI zTYNb=ORXh2n{q-V*ifQRbHP?i86>Uv^Puj+`ob%kyW^4L#G7(@I(fShJ2%3=#LZ|0{tZH@H!fHnXKaSMBkMo$_|FQhMe{HoxzP0(>rMa}XI>P}qf zu;emvfe(MGPHB#++Lasd9HP(rDgcUVTQ&tiQp{?^oW%IQvSKR@H;PW0>?yyPbVh+> z3*qlXPo$@0@y#_uNu~QS%7hVASYt;@;(M>0cHPP%QN%gmw=h76OSy!2$>)fWMPa{| z%w2&nyciDUc%wWIp79WdA|%HAmQ;+LaJzweUCM>f*lHxV!9}ch)<^sE&xZ(#)2PgH zAhwS_YAe+dD?UoB?^0OP_Sv2At`*&ND2*cRo#In6Z5S@113Q%vD@z1pE?w!Q&x_6X91w*& zHw?VRDF<(ctOq=?y8K7AHadyD$ZOX`J{Q<0HbjXaX4F9cJjt$rlp0aqyk^B*eog{A z&V&G`mM`;TQWM=ecCHImKJIkwh%)Z7SCuRs+4nTci*YBsQzE&)2D5)P?))o8{2DW2IjX98ql;Mes!L z+|&qj#Fqf3^;aFI|Mc=kbZTJ>!$LnqKs}gmUOxKYgK* zxVonTip-u>&SYPcbHd-w5%fNRUv@cUEdyq9YkdyiOIK&4bqZ@bp>Fh@sU`Dq%Cam? zQ4M$?H|kPATq0e;-7&-D>b%U1q%gYx-#U+tV^LlGv6G|Nr)vIBEm=HV&xOOmc7-%$ z=8buA$q=12wH2ejDBqPD(RB>nHAU(Y|AFoToypXn4A%n9cFot}{itW-dMnm~be5b% z5W&=oB>~qRkGRKE^FB@1np+JSm>K14f>aLg!_|tasFTBy0c8#zCWYN~=a}e=X`-o& z^D>KWq@uSE!6G0N9BOH|gL+vA6R0B*W06d^X=A&5X=qw3lsc$0x!2?-lR=G~o>JTi zhs;zk+S_s8Q|r_h(+R`&Fh5Cz`1cB4P1Di$6E11qk={OKOL7HyKRZ09&(Rg61r-|h zInFrAyWF=^uldq7w_paz{NX^(U7?NLT3+dQNtU+a59meuL@!^_WVjiS#aYlh>&rFqPe#QgQY@$qXUCcLTI zMcJO~O;D%yM^un;hJTi3v=#Te&^F*WZMG{TBB!C?`^l$7iV{&3r|?86mLa>}QnqiT zlo_^8O8V&Z{+kpMO{BIeY#|m8>M}iru4XrB>Euv*Z5@OaSJF^ziW(jy#z;p}%*w?K z@kucJ3Mm;@rPJ@LlkJQMtm@X{O-kXa%=jaw9Ep=R2td)CL1;!_1E+n3GOtJ@_S#T?F&Scm+aJV0%m=9C*`EJ!vrh zuW)_oTSnykrpfDA>gEKo-9F!B-|27V_1m4x&=U;dO0S5^IT>JrCP4k+;A^RZ#`hC1 zOlshgG{{ktL*Y`$|K`Uo2~s(1I=%T5^SYY7w;>NoA=G62Xq@$k+>=X=D3HV zzel#LCb%mLxC*T@6gwHSnq&_aU4!2MW@%S~{UO{2N4UDpYbKS>>+#fYT{f33Uc+ZM zKT2^3d4pT(4$7e4&fj&;<%iv&z?RjmS}BPfFczW+gpoUih@BVE7@d6x4LDoa@Jc9D z;8k3?)RapEH{@cuUAJR+&~<80C%k+}iNgxyK+~PMg%43)%8ax8+DgR-w8^zg9WFu@ zc)WoYA=UaI>XRt>G|2_8u*vmoJ&N^1CEClZ-&3+)5+sQtzf_$@%kw2q--k0~(ia0( zkL!PIB-%)!)JxHT;8{qo$ih+TK@>5<@*o%E!(LqaMN47tT}t1``& z>6!Vnha|!lTKYl!KhDl0i6D%jwX9uM7Ejg zFVzv&N?DU!dFgjYu_Lt?C;oZzDhK`cY>o-cQ@-(Eg4W~N=e-9#4=ipGOhIn0Dq-cnhV zZ7u|JVw^YhIbEYvP{uE%@qpX=6SqfG!4!ZC4;uew3)@_D(F8JCgmGddDhnc1PqEnN_fk{#%5|fUX+6hWymb|yD7W7PUZnAGod4&?Kq{WkD`|;Ue2oB{X{!9}DV<}jDfbWKHom^e zQ4fh3)92#!ycIH8;bItb_PN_FTx6k2@`;D#!t=(0`lo$Z-U!EA`&y_p^2w~HeRIoe zm_BhOE5K#ayHU_d_{*VJvgQ}&rI>p%^;=kas#9#lT#vKn1)u9vHVv?*z4NHeq#%xh zOdChu>fQvO@s&Zr{&$|!R7iD8EBxwIs^2y5%b6L~UI(|8hN&PSX7`IJK(w zM+;U#!KvowrjPox9I^!~4DKvzkrc6IjG62&>^Hb?_LL_sg42BWeBlnk-ZcJMozoZZ zPa(du4n+o497dn5JeR;+;Q+Pi&+PP3sl_s3Pv<&r6+HGS`1ntu>Ukxs@bC;#9szW_1dtWyPlr z2a{%e-W#nx?rN%JM7sN#0q;mY72Kk$b~;_WYoXzc=3=+>G7xQv(?<547L( zXSdkfyx=e`fjx24xu%Q>@BX37jJ<|1ryS-PBl$jULK{@x$QBQr{{9Eqq786s_ zf8rW8803m=RD|jNN;<6O zZ73!IlH3zH@am7A1`Z|tsMUO^apTBlrvX=%#`E9})A`qS&TgBR=HtGb9mdTS91F}? zW{3!D6u8;R#EWCIt})~KQ8wFh9>b9!gt;Qs7ARP(Fr!fHZ6iy~UV5jRy17!|)`731 zj{=peDh0THi@okQK4X*_MK(2r`(OZwYRsR9?+xfY=s3iJ@v9qY18@5JjH`-yyA$f^YrbDQrH*}D8B!I+T>)uO|R|Ur$eXv4*sXv8AF_Vhn) z@9yq?d@ebipTp`utPcl7_>JJ=+2TbF0_Q?AXtP}lnDH_)z>x(qpP%TKyl!QyeRr^W zNsG+ElP)-IoDsl>oVJF+AR5?|mB4tGfhk(9j9uyrHH{sZLCCMXdszNR4K_T>i3GaMu@ zhLh;lJsvWfDt&w@5p3RBY-^pqwCkw)JU4o90i~q|m2UlwWg}w#kbNWf_`te$58IET z`Y%n{4{d0`6D%x!d@A`{)vH%hOKzx8Q6iGCVtQcD6O}Bp*ZdAgbIy% zwWzVdm2IIrid<{&WkIu9d*>X+uc0F%U zP+noQezYHf92I@^`0)qvh>)=dnc;#k^_Gu9EB`KUYdz2=m9jd48tjmhJLWoBE(|U- z39od?`l=2JQ@)4Aqsg0Ut({)BYVWh0A9MK0k3M%yllGad-KT$}UkbEO7+>Gv zGGEMgYbJe38Y4o9Xvbi9|Cd1YMu8nGDg3nUhx7>0Q{`i?S*f@tqo4*PEN%EcwDMQS z)N8lwEk<*!osqWOk7{fC%5zrVcF%@qXSQrDCbVf4QAO5;9W9*@<#-;2Qm-y;#UIlm zv6aw>2q@=Ot+3HO6@4`MDVyjYOl$)5oeBvSi+@eU(>qiJUEW03EMIziTX_`J8K}lz^~CH3Misi zc%_-b6-kOCae+hBgIj{fHS8+*4Sr$|6Iq@0MDbl+U74X@z0%Y3f(#9|h{UU+QOR3R z|4V#IX%jgFDmWgYUY%t;Ce62P3z*C}Zq1aJSXU`WvKleGf#u|p3S~N0AP?dx8l`=^ zcO^h@0=4(R3Ew$;-JJB&hOz>k=5DI<=g$WopYb~~=}>r;{ApsrltDWi(~4s25H^9W z89orLd~eess6$I8*)K21%=>)QxAlA6!WW+hzvrBYC;zb?EwDT`IH@9!jhI{T?^+m$ znUKcj;Mii2#mg8-AK~-o>U8+78^`av){d%6Umjj-x6$Q05RsnO)6-KY9hIK9p7F7k z#dwn@gfs+S~(n3SuK`PEdTnF5LuO_KUp8sP6& zOx{VXZETcF+We77ffqq_ZWd5fK_6;fx3s9XWtM*}H+i~XGFFwjtqLfNKz1nSe}p0s zJ07gmTK;HG@P>g$qIy%j^!27isww=|>N=G;M8C*!-LAlHyJkHN8%BMe#pIS>dNAP^s#a`$^w((dB!#k)af)9zbz3FXHq8_tN9#M!W zij|zre=%6nwHNm&jspLQ=B23Dr4EbvPbEV&uFKpNYKV{6x!`Z!rb`;+&tOu4SpRwl zq^%IgmyoK#W!2E862xy_SdKUm0ch5;$go&FJ+hD&(JZcaW%}=s@a6Vx1b(8 ze7O9QC2MFcV>Xbbcv~}I(SUrYV(yY84E|{vmF*FGj_%8@Jj3(SgY}(e`d8Get z#KwRmoK541qYGZhfcGH=6Z{i9b0UGyrizP-^{(tWCtsOWFPp4;N-{ z!`aSnHG&>xMwbr9thniC%g)*Q3o;ax|0!&xp)A`Ui8qGbLGwj=BoKpqeu5ovj6w-g zZ=86XQ@)2ZzG@yM?`#RpVh}rBWRc0NkF<&Ett~^vpH(Ic600ta`mA@EiyD@{5vqDI zurTVX-E<$C{oM1>5O{METS!byxfl9yC+Di-1KZ`~TD4_2exZ7W@GZcx84Ws@-hA}_ z#9m6WzEol&(swT)Ue~=BD;*G?*i2P|XxD?`P=>y-LG=jGiOjx*a6Py(4b0qepE8GeF6czzWVB+;@#+CYP|7 z(`5+T8qw~vZY0{9rl_cSQ%4(mQa4f4H^DQS_rR{&o9Xn5Y!XAM*yaD&hkt`;?E?w! zLyH&4IXxtf6lAw~y9Nx}Al;2iv4?OBWagZvN={DpR7+kt#Q!8)13b<^i(}Ty^e#1pQ^Zyq+Q{Yp9P-mU2Ik+8~SMeoCEjaNwIhRP8Yzw9>Q2%EVxHEP#xFBxgUOe53 zv!=`)KPm2BoLUWtZp3R(u z7ICBQRqsv_fLON;aK5nE_@>67_Vu%e;%3mD<{Y?b-TolkzOs6ufysO2XLyEsHk ztKs;tR$;6e4yovQ3GDxyh0qIR+`&_6u)Dp`DP<94-Q$U+!OcYLb&|6M$Wj$pAqOAL z&J=9k0NLa4Vp{7`A0b~HLn4w6z^;}<2X?jh#>5#T(hJJ7zJKj$yPTXpkAGD60nLQj zSt=#M3wJ`UV6zXzkg@a_3Gg4boWxX1_SY*n_M2L)x)y-^Uz~3m&i_Bb2I0tMqBJR6 zLZT$jao{9>;yyASIFPP!Y`S_$7dE8gxVeKJF@&*-^pMke^MkfJN{>wtl?)Moj+^uk z3$hvVe72K+(_Hi3u4WIrfl_IDs6R>iVVWe=EVEB$N5OdmGi5Z0-wZf#Q>BA`HnlUi zia%s)%1b5*0E({k4T^t+^L|?YS3e(q)68USHvMz6TI@oI4F8rLyuL^Io@&(#_0HCA zqlY=6aJZ*uK{+(vxzf8YFzePzV}2u!iyI>RKm?4{D~z?~2SsK<ON1E&V{XK*j5a^6!}OONn<0;(n5+B`RF22Ez8BZkBEryigW9XI!^9* zc`c5FV0m$c3*h2U)ix6?#1Jp%Z!`i6{( zvF=YZ3*Gm*NfsW3VY1*z&&A5Be?U>?y+&BUE5>{7SqzHDMHYN#E7J!`U>S&*H#!pZ zLjNxR03<8xB})hUPwcjOY%?6LSAfoqw>)1OofTO3lj$H#AZ`+pwLe6pVtE}5Hd|S) z#3IAC*7*dbjQb(7zvfST?#Iszg1~$M=-~PV(6?sOeliS>=!|vq@LX91lvi2HWPiY~bV6g&Acpkhw znp0U>Y0|w)qP6g5DA}FwkPb|Mgfu(f!|hrC4@eGZPZFP#MStQj<}}Nv)-~QLoBl43 z01uC&B7>t*b2r0;<?(RkUU2HV$edUtSBl0Pt7tepV+&2A4vituCiRE*cD%b1|P5TXK0+##}NH&^Xfvdg1^P2fHpFSNTI+{1F zagG-fGZsg~VE^aC_8RB>#NM|031|}JBbP+J ziP`#u$JI}$+lDyC{x&f&(MgH6S8={Wup7X+jeLUw+S{DGq?^h*WVcqF=^gdPPp>T! z&Mx^{vxd1vSl^_L`0=Lcb`ufSgQ5Qx+iDi7gOss!11Y_$DyZffh#s7Rwn!HB^yyRX z?x$VVPPEz;EWTv1@US35Cz)-I}}NJqcJktYllgE1LEIwFIEiPiZ4y0-%Zb7eN?Ufq=Xcw zi{b5oI0+{qoSuonuE+crR&ONyBx+J9`faUZ7Ow@h`F;l5sqU4ySUq)-e z<+6}Y{xlRC54zP|Ok6EKT+ePl*OT3JCgyG)en~|}@5EQm9eYDaqDr0N;1x}|K9|YW z`Xcobdp9B-ATBLTR-3jHis4YFK#+>r>Q~?`<;S#-%Q*9^F*_7?6|vYv5kn>zJ zT~OujHUVnyygS}(K4fNL&^JbK0qsvRA3%%}++Jz+8o<__MJ5_%ey=|HVNw1gLFFA9 z$8-iHzq&Zih>_u!fZB&q`mSdWJvD!!VzV7!m8dt&BYyk4=YUk>3|F5z1VkJ5wUp}L zY+oSqb(&JwAlK2Bo_dzj zOoi(qWE6|WJuM}4){zE2^wHwN!WgS^-|d`6%~aDeF><+OCuA*PDceMb5goPUVuY5| zUSqLG#Ihuu|BGW!J(H~S2y@JZzt6))XJ8IY;#|Q~umI|Wz~$bSr9|uhJPMVmi=pz6 zJgP8ay9}RK_2%LO2IsF~m?sYj)6>?>WSE$p%@Z@?k8oa#=;>nXQzId%=R=6EUqhFG zMKSkvSNRBVd*3{tvg@v5lP4u|#(GzcRftmKO=ex}6?Nw0Lx)ZSb!y!X1!4w?q4PU! zT4UXuW!pxnwyG}&T zj^Fk;~rH`3A|oMr(2Jk2xmVv+|E~f!gDAj?g3G#A>~26%RyAz&Z{1lXiMZ$ zrSv9%8LIVd`WDVt-M`@StEq%65x@VDt0E8tUa2y0P+BMsgODGVR{{0J>QR|9!)h)M z=e8Mau)va9FeuCV#U1>xFkiw};|)Bz#SQ0P(DwvF>%cquZ4;TB2h)o$_BsUEHI+L! zjIZ8N7xH*u5svI5cdMfggMo3Qc@MO4gBoNmR-4vDx1>Z;Nu|aa2L89cVtqSVAiF|0 zjL88IJ%WopITuxDI5Hk;y+3XKk&_1W-BHagW+233qA$~(uOABX5ZA@)(XnD&4Mews zst@&sMU>^bn$m-YbKttd7Q%>a=@xC2^1TWR*#u5a>|FinNB^L7*?8BYw~Z_q5(~^; zIgBcHMtf)Z|Gho{`Q85;&TulWVX$FVQqkf|D=o6*oO>N`o1W`jOI$=y1($s~Ow86M zs$WDQW!C`*2M5)fV6jME_tu^JMA^Wzpx+(`!3=S0*&N2YDN zW&8!7wtC%G>E_|h&iU{e%q$l~IL67-`WGIwV56oTw)gk_4+z1lQ+1qARN=)Zv>QDD1JEWwTsnujcdg&y z(kqy%U#M8oF|pe}#P4fV!&Rd-*DrC#6!yRP z)ID&>E~~UwrR?N%2t(rOlGb>{GCn+C@a2(bO>y+stg->_NMfPj#D-p2DlzSy7MGW@ zc5`#PFNnh*muD4I$)5B7wDIU1OqA@m1*JpdX5-d3eU+Is0y`TaVBBmRFEMj-C~*x! zqZhb?`QH_cubte{IvJqe+Qa|Jz0y0k zAFX|jq~{Q;{-1UL8+pjJoIB+gpGH7T{P=iT(w4WG6+!>3UvA^QfoEj^1&;wHA>^FO z*sJ7uCUo>SzS_37%kiBu!M-6ry>lMVoY-2O){WBv`RCqFiDOG@gnxcKmC7-DId$Aj3c&X}WulcoOs|}1A^Bp;8u?LZ&Yt`r_W#cVq;WrYwP>udy0oqq z|Dde4Sv~IcZN48DyNK4`Ev3|UY|(ZX{Yy(C(?V(GPqQh})oJpx%q!61Ci9|}17cMP zxD}u4%GY@IJ~C(NI15|?5xe&RpzW5 znWF58`WtScz|;P6pV6#S#Q6XE3@fVp_>h3R1JqN@`o9P;16rz-So-l} zbUp@GdcYVmmRpz-nf{_E)<0U}$@F~)s!LL(tNC{eOx}>QI$Isc8M;~DbQLZv&wBBg z)}!6Yuet0qgK}9pc=d&yvzrRTYnvPgQ=2HO%|kuP69`9xAOL5Je5-VCy3*R)S@O&G z3-ibTMwM1?SAJGmyE7bi6588KqFd;Z-p10?A8Uz6@^p2pg?YgJK(BD%y6~RVz#EDZ zb<;WkAhaXhdCB;(Q+#GSrvRV}Kd|!bc7cSGmCw2X0r_|cOld{c_O0w`z8taF z2eyL?9uOARU@F+h8(sA>FhZdp-OCR?jF*LY>1`aCh3$z2Wd}?*o`UYC8FqDD4XQwi zO}WrVM5HIU?Kpe-iT9U>c6x5Ah&yLbPY=Ae*Cp&i?dQV;y~>29TZLC3%>v>wF891* zR;&89;e$r=Q5Eu+%A#L4$LSF61&d@n1hLIdL^N(Bo2b8os`aHf4u|SHBxXti>&f{& z2N*~vgwHkjXo_2LzwGH=92G-=+tHbfx}Cd9>$Tt5<@vWmFUb-vP3No|Kw*wSB7?Dl z4Kmj zRn9*#`Ukj44TyD-hy=k5se`eb;Bn%Ep8dxvC))x8;@|}fW7UR2RB&h573Ta9HwA~8 z)Pezn(!eXzbwI7bWB-&tI>fTwY!pzbxTyc5uscgv8X5;x7{q;7cOT5qo=I(?g`AXgc{vgu+G7zxadZn^n92e#uK`A%aob z-tseZJ=fPbx;S^}3ny?0HF!L*%{?ei9mPesC`APo=?p`;B~X=*RmlnS^UfphJ#wYQ zM*(OF>!j1!=X$`Alz%o2TuOgG2OW-Km@X~O=dS9ZkxI;s(v~*#_XG8k<;*2#Sv_mK zcv;D8Y;0M!i6Nw{owSXA@`9UpaY)#I!CZW+3@w?S0$H=werfG>_XsdgSlm99x5H}d z#>zs^uC?#$W^pDkxRE;nZ8m{YkYVcNK6;n_^lxC_ba?H+*$9Vgs;kef5?yFSK!mR= z5Nd_xf?~*073o!rF=eAl#Rh!?k+YGob7-TA0RfN25|ltW+y+Di z9Hkk`6e;RcO3u7Zxc?{4KdKEL#l5x&h-JLE@C~pE(I&!?NAp8`_4M@aNEZwz1|IaWq-JtliumxCo*UzlsQ zV0PZNfK}o6#ThIX?l_jrT;|x1XxbC- zeJeTZ^2Tahy(#S6_uhx)u>r`MM?}AJeI}O|6@pX4#{WyTWR?g0v;Mr`M(HwuHEgUZ zrK9ME%pVWIl6NtokJ@$B91~!*USFj#E?$qV=H^UxC0Z`W!8+(w+5Z&hz>wx!ddVaL zru+FcBL;$5>N4RnI&z$WvK%c9idlaT5GO*O7q74n%D!1H9I^CgV&4zF$nt~8>3k>I z4X|g4i+52?*gwU*LWGAMK-V1h#?R5N7*%h1S=qF@y1K_YEQ}ig+~|?t6A7qHF=`fazg_b*#ssap^&otUyG#j^>jSj&B(SXU+Q;>aF7nK`?gadFPJzXN}K6)@6X% zHgB}NH2~;+LC>eazodgMCQ{;H&76!{*M1|I4Lir@ z79ZY2d*TO`y7oxhUJy8Jvkq5DUKe(blYWCcOV~0WsT9_ep$3_8$myvb90-_s3T#ch z6o<0jSR$50z+<-MF)HjBQo2!p1|rq{OlW&L{R8Sfv+}3b$lQXl56RU!o*QX#^Tn#9 z^h3{M12}d3BY$SR&N85{%_Vcx*#@Go@~;=lT%w|1&!9m3(YI?A($$(B+4!5php>R3 zO-Z;W+RIkA|73k&$3X0Kj((Ng6R5ox)zchmqFQ@~KHaRn|Bx)gy~J=NEU5VCxVfVV z0i3TjnY7M0r(MXOxlXj(C@HWkWtv0WD)s*gY#RW}?o&F+*%!La?p-_WF_Ce2qOtJA zzTi}{qdnMy-Xl#E=FL(khNy04KU$UtSc$#gp&FXCv7*+bj-g%vWb_-TZstqPaLdTS zAL16f;>Wxq1A8}$A|x}ak{ysk{*Ufy-MR__gYVcTCGzr~P&MaQjViIgFd)C$cD=Y- zmCLx}ru1&mp+BWB`BVo6gt*tB&QE})`>5Oe<~W{XCXp@yKt3#QqTrRE6UGpiMh24u zW#r^`-*DOh3N9T(o$X#LC$Wh0R}RxfiG>N0?F?K_l&qZGv)oUInOAojGuHBdHs1af z1a%yO0;36FO76a(m$Yo&wvY)erXXqJ++#1YBGPXgP2InLe}2LX*WTy!SAi8Ui=ghk z3LXvAz!Kf8&9R=7kTV0V8@?Das0)3!@8LHtUP()FhT++`@J79+U!Q;Qd`(~~9dwdFbc^l;H+K&OJ$lYCi~%uFf&(HzN+cZD7W z2P+aMH5)R~(Lc;CR~8^ZGq zUtIYhl2|{ZN1kBo*$Un4xT)pWPih3)a$ARxByg2Zo?y^&xZoe~n19hhqBG(KGc(J> zAV&E3pY@GD;yRM#^ysnNaOI_oi5t8Qb0g3q83jq-Y<#A5VNJOwm;C(I4t*UMKQhz?Gk`uFgzftq#n1 zyaCPpgNla=XVM+p0>xT2`IKuN)$=IH2(XcFLe3?pGgSl61PZkt4_=LpeQx5y`3)k1 z_?XZ=lpB!a0qx!^xMK&>onBu40Ya4PAR~ zwCI%@-?*V$!!@5D_^e;84C+w0$9$DD?tWFFQ-7PD#cJDPer$!zAbE(CR4wRXVv8!S zC-GYh>HARny56cGobPq7ke~#jTS_Jm5-mVck#DyyxtaYo$$p{>*<)LI%LwM5!ma_k z$shIB_jDuny#f23wjXTvWR0~eL**KvoXYQX@I$hss`TpB+6zy5Q^V{}XGV2u|uNhfnuEp?79v#s=BPAIkk2epGWkPF>%|eDX6Ut0S=Q;B1}?>dOz*jbR3*nfI%5 z`N9{5_FO%bErR0>At{Uoq5~%(P6{-*w?6kBC!bZed2wg0o-UpnbqI{RLQ8T9i7L?s zbm#1os!iA34$AyPbfRWcBHZjsFwR%~=rJYpJH?^toangW%F{UKHgx?L56bFif1$5A zPKlES0AxA+NOV6~eSki)l6n^qH$}w;BWg3~e)+ihKO2g_DL|LBQL_)pr?n&*Jre(* zxLFs_$I)rv-jcnm+jJy6Wlb}4 zs**{}bLMX<(P4BrIUiUa+Q?}%X+^#)Yixp50At?m2Nj2+N_PhTFP$o>k=y~=VKg!! zL>>qi_*D!{?1IJ}S&y~7I(rRIzq^OgdSm7lQ)3@jxHjY;yv{cRwE{f?7DFY-o~1YDJIBK6vu4Ir4r|f(c$C#% z|3BKq{O$+{m=;AdHdP5=T}L^^`Qc*v8Vy}`u?vMyHT(($Y|~`+O6I_t%@N>$wDj&u z;-?9|Rv)b!#?K3{45ggFpl|P;EofTc>%2g^YsUv7%C$f_Q)fL(^KB zHa@?bQQEk)mxI1d^cA3+S6&l9Lw&w_+rj<}V_~vbHQF?yr@PR{ImJ!!B?1KkUUEg4 zJ^k5(E!K+6v#w86QsX%NZ=DtK=8IU~vsSey)nes^g${l}6(1!?TgGM3sCb$`-;+BR z+_{TK4-$Glk-)i?B@VsSAGX;RV9$2XBf9x5B-I#L0IfH?*&NWp?--@NMWw!JMJnbK z-(nqpQ`A&SCrWSP8lbWUXxmP+1aGd9=(Dm}J44r6aidWUvP|IFRer$>`$1w< zSn6=fr7UhNS8>?t*4a0nJU5>5Ts%4aaIpeUu9(m<@Vi{PJQCK9q4Z+X_8^yQCMX0X za`ioS^}R>$?buI|WvwSi!+#*hxQl5Nf<+68uXBKTgiz`}4oq6?X&%*_*RY$k9gjLa zXM{Swf@o4#lp}-=h%!2yq#_A=ip6}pYBSIy&qveWmrqsYI%vCze%(vo0`OW@H<_o` z;rET5*+;Khe$5GzsOT$pw>gjQUYA?TVi+VNh2cL|&gzh+rlxxJZ!~eq-PrYXc^m`< z{FnV>79oQ+aU#c8-*55?CSLG&(2mryfiXF=?cNnrX6+^8NeLsLyzu0qB8S9B_gDhP zy%Bb&wqL$)I6YLMqB_DEVP9bz8ynj$Dzx%>@rQ)^Dd-Ho2~BxFL%%v{bF^H^kI2O* z$mJ(l33?;jql!y@gi2@I58BL^Vaa6^uiRUt&Wc5`A40r-Q?P@Tlz8Ba{}7?nVn6FB zowMPZQR#l=*OJ|$*~%I&&OsO}=zg#~@JsQ#arhq}enHq00!223bQjk$=ocuxj(1J= zFL4;#&jT8&u%J_!0|f6aRJgyV+2U>Kcc>GEZPE_UE}l%gJ-N0 zT1;jmgwzE)bv3sYy5NU&Pa~$Sg%Sjpt9GOpw49b!oivQl1-p)oA6iHvr5aVvzsOn| zeMqX6P;-0rv#$j%oN!Y$Ww6Cl*}Hu7;FYz>>hps0&pn2G$J1gf7t^wsSBuKWWG6~m z1D&Ug_(cAto@({I=+}59DN>N~OFILETNYc3$5jb0M-D$KE)mo1mlq^>6_us2$(J9c zRLieb-yBWw7{{-D!4GuSfm8W?m48<}OES%<)P`*XuLhBMZO^_`y*u=r zRHBeAl!)2#o-+hEZlE1>d5SZJ?f7f;qAv&otz#53ya1uPe858p70ahU{a%%|A=(8J z`w-0@aLaRB5}-f|c5vHa9jA!e5J{6*crqc@1JkWm81XR7r&*dyVg72Pi8nYQIvtXx ztkhA9)ieuTdH>#~HZVGGe({5ysx;+u#2P%bb|fo&jUPM5UzGpSDP6{OTm|pj=pW}o znhV=SD#od{jS7;A7e{!oCp9lqz?pS7u%#SLZbN=w9|(3VOznyaUwwl3_2h7Gz-+%Q ztzLYfmGb<8=Rb4GN9}h|vR57y=4Hz;)q_|UoWC}*{X@A!b?y}WZ=C{*vBCt^2Qb#f zo=syUFq(J|9Rc3nZU;{Y$+o2Ro$+Cq<&`SBTaeVSyj5*3;wGY72enY~(Q*}wZHvuzYKp2q4(-t?^Cl#z-m4?> zDoc6nHUS}>RzcFZ*;InKaNoIY9$FB^IHG7x?Bl@ji4Pi4zwZ3wPe6q%R2aMAbuV3k zKqbgY$6sa*`v*|8!BFL?{{G+}U^gGYlRqa+sO300`nT&V*FCuGj>1y>rpnm_dnLjrtm3F7;$(4v@Wo3Pe?6O#V!;^NTxsNJ~pO>A8MXtoQ?@(X<*8`jz zoxbDD_bq!5Mu8Cy89oQG0M4|7kAxV<^p z>N~13@S3c?50HfmTVBr3?hx0hUkPX|>sCdTu=W6y&vfr+vH)*47uLS;gu!MRD=;HR z&9+qhNf0D;lgXxwZ~Qvx5I*;zWYBrU(tJ}mQsRw`_p4YBAswIIUUuuUD;GV2QGp!wmq;4Tmie5&`hZR5H5d%9`!cFZMpl8liiz#}!I2Rw={teGzNaXC zIg}fxSAInK7s_6#s}Z99UWCL*bkBq$X63@vVYH7dPXACZJ93x@@p?&*J;$d`y3N6S zA$~EYs9d}P+)*#q0^z&vwd(d6rA7q&5Y6Ihg^rso>Ka>mF;mvugkRLhcbq7f51h~g zaMPqH2W#YmHx2#8t`M(t=)^_cmHC;!Yv9sy_#>c0(Ot_W40Qth@Gq zu5=0Qn)5Ym3xrGlWf3_tLxbEl?Pa(q2*w0t=`?5Z878fBK~-0`iJ(Muy(G{Yd7$I- z%VgZ3tNXuEeJlY>?=76Z{21iB)I1b8^QqhGdgsrTL=YW*^e4@F5d85ffm1~Yha1Mm zl46A}YxORUOZ#9pz*cq-?9Mqj#%x|^vffnl$`<4_j5WK^SBO;&5CU~e%?kdhRE0k{<+qWD+TaL*7 z_i2JFnH~R|T`DrG$OWI|H9OF&Yok6_ySHq$+0@wB7_R<%tNQaw0=ZItaCrA9^5&`G zhkM&5GB8PyLj3f^U*j3|hhh|9T&Qn6AN&iHY;_TbT*FD(-bdCeCZPeDM$Bf{0@pHz zqkAZ&-4$|_F$?PL_xN9mN!aPz@_NALRA~LWU4D2Ea2#!9JdFwkZE0mgOW6thPsrYg zac^h2i1{Co8m&gDuSC&3j_NS00UR8P>+GPk9423RGH|sWBbXL;J%O;AP0*G1`xbUt zY!c@y=7^`vdS|GU3)J-@{5n$Flmpw9KlSaS7=%;yVwN@D_b*?2d~&x!3Q}NHRQuV- zNixM9r!ti1(21muBfVq|@;Q)u=HjU#nB|b`ZM60z;>Shk87BVSgK+IDuxk}Fb8+@3 zmEl!Yfu0(ulibx~N0#_;1Sr002UY~nO*XJzBglD|=owAr1kN}>dV9zfgdFU<#He07 zlyaetGxmKP#4IK^>+3^y|K943H7z1;!oTZoL9!@lGo{aG8nw%{@z33W2cz|?d|0>- zb2NAv<{#9W5AaVXmoN1aW8TX@Ph>yCZ`jNs6w-kuI$*nWkI{hR>d-AjbeDk!lkd+` z7vMW-HR@|M*O^?s$i#bMY}ol1ITv#LI^VYyBrSbFN6lJ$ts0e&?3;KXv}WnIkbr*$ zMUPz{CT9=@5ei*JSjr4N{`R^S%DCY@-EDjpub&n5>){@#In9uphu4>-z^VrmOv z?P60&#=j5uxmka92mb&RIH)fusz(hG3yacjg%D@V9^WGSp4pGK5yUOHMfl(J1H1ms zPhXwf+v;5LGikY2qR`ofg``|Dp`V3)31t@gDqhpUW)as~PEUPUtXHm7sB5N>i8FfY zv;}p{$PyWZ6si@!AIV>U9P;3*X?XXwwZ5v{7VG9jr` zb&}cuRWhqGlw-St1G7(j(C*s*Hvfk(J2Lhe1`Iaq?)!(k_YaFP6dY*)1mp8>-X38P`>U-gI5xGoSKUT zS*!4?S@^#8A5f5Y#qM4UWEC>t@w0b&4D)hxpNsgOvb}@_ITJqbaGDB!rNyji<`H}{ zB9-8H-_t*ktk7lQ@l8`y{4t(@AUTMyYR|j-lMxZvd1-8<;M(^cQ9-mIh(8K# zSCGxtf>DUc48)Nlv$A6Xq9GL(0tK14V(XPKi#4l8>I`C-&Ej+7TPl)9pe0s<;hi{J zQ#pn60RygczqHl;?1k`@LHuB;p{0F|?D1fY6^EP(uW8v)o;~$L_Ep>I5oubid3@4J zv)%3rHxa5WIO%xpx)ox%4&NJ;ZTkMA>QYCSJZCw$vcYigyXggk^1~yZ`*NNvCmiH< z_&76t*jziYDXCjqID3@xCd9!X>#6@9yVA#BcCK^gIwaqz zd?#y@HciQ^DHT_u)g zs4cyfitO!gN{mq8U(TVe=4523&fH1t%o+zfNQ+Zjc-i_f$(y>jAQ-pnd!pyu+PnAJ zx(aNxJZqelTR|;5=uhr+Q7Rs5fD)j^Nh7SE{pBTDePxK3*)1~BTEZ<854P_e ze|B~%;o~gSBF?^J_os8uY{;z^h^d9^kC2dK6t2_1;foDFHhn{J?`f6)^u&Ulnv_3! zyn6J!sr`Cjw8^usyHu1E>(#gY@XD~rgYII3+Q&4_BQ*=N#wJ-_Ayy~M9y~S4!RdUU zL9y{-h(Ulz1yB})84XIDS;gRlg!)PYvHc4Uu)rBDN;CWDIaW)eN`F`uPG}h=1Xp-Z zg<#9Bdt?kej`kG4{FJ-kksaBur$(^rolDVEoP9xQX?)ULxLqpf)aYVo1{QRORi`aq zw5!l)u*Sld`hx~?Wz+fGiU^SE=3Kx~rtMU^Qn^Fc=Jd9hy(p5giAomrCC5xw(rC{J z%g>TLdo`#Lh{co%V55!hwyp}Yc5r%+KbA=JxI8}6(@Hni)6-Ot2xYX73elDq@AH%k z*U3yr_z#R;9$@*_y8;EOEp;Vo5qzs*yj2h;oNaOUGm#IuH^=vjL)#QcAw0mT?c6!N zjtM>oH4 z`*|q$XnSHGy$`p;2pG=5h^)`+JGzBwbmuN7Ay$%MKD+2k5tS=T)%R&WXwP?T_sm5| z$#dY4HH0ov0C#BOWhXuUYXnEyE)-}-z?@MV?XjJ3yBV|WFS{F+WGOz^`MVGah=Lmp-9@s_Y6AfaUlLl$swH#v{AJf~llnj1 z`&>;z5J>6nt*S-uukmV(bYiJfSm!QUKbB(J>ehO|QAzIKD4(pSD&fVw!&~WVa?zVx4dELfjXgKwlIdOpMQK?UhlABrrWO#I!d*Bbb~y|i zH}dmI9EF-l2(SyqRuq3blGumlCq@tNF6yQoo(>M5puKLJbq>;{rOB;6IACILAqgwGkfoBFbtvHYvMo zw$$UtXY|05A)ihI`k_FpieB^bL7fID>2H-;`X*P;S0E>i`HXEA?q~?#qV=Hx5k7Slcb_5s z-NStSKVHO{so%_>+P+fQU!P~M9)Y{1IH8?T&eiZ8ZHzCGYpDzfK%qjLFTcmIfq6i(2~qLn8kXmJdcQ-! zUOSYMw!Dk3FcG<~b&L{)S^KdFj65l?=i10)G?Z*kyfp~CySijSTgvv#%LVD0Pmhem zE7$6u3qHWO1c(bpA7QgW$SOw)?RXUB{Zy!92qNA&ggKbpYOaqz{b0y*yT?Qq@}TNC?%fadAI*s_5%ms<1y z8G@ET#+lIp4g=rac!&L?`#jOUqw$WN=Er{b69Tl}sCkgOnIwSZA* zivU59G4txZou>mF)vSuNh?^?clFC$HE6@J@ZC8@!qls4Cqag4si&@y8-!SIZywJz~ zJ}i}1HaO#K_GRSLUS;mJ=GL_fr^jEp-L*Q=V_u=@;H@JJsMs6FBYhtI)1Uy;fc_ z{9Z~OgurkkrHfo%w$0DqD{W7l{b$z? zF16t?bMKEl$X5NPb?DOREnEMUia*zbvhAMz)c}Ys z=e90!QXn02-u2m(Q*lV0Iu~IeA27^j+Cc2B{n>Nawxcz{aIM9=(tQ<5HSP0Fs((R2 z`_K7e1FOR27AGLn6l`LcSt~R;k6T&T zvy$2`buxM!lMjK)03mVtfw+lNIp$_7+bWk#v7a2CBS8QZMO`$Y9j}uaqhow6c{6t{ zI;ug0HH0$LJl2X+Bj%x;tj3UJ7n-bKy_`b7kC@`PQ=Bq+#SR39<>{i`xA*oL0RCja zX>?g*x&*l8>7qf|_ewNO;v;qWBzu9tx(_rrnUTl$GaX`$V=E?-E1bVt4^(j$VCW7g z*;dgawgP3-U+83d;JlI{?J>VI?|aOZi>K1w2d=f99hc{_iRgs#AkR-ih0pbSB8Yhr zKH-u2#S#2h-k85lf(PsD0RCwGm5cEuVN9e|%8h;fv3($h1 zz9Db{J$jzwCrF#_EszjY(i@1IOHp43t=?&5cKLxFn`<}UjWlZU*fzSrzvK#%fXtmwr%!aY?%kU z2$!=ct2);Qf@h9@8et`gphH{2Qo9!)0LpvFt+)pJ<52>z= ze*er1-~SqIu=}#Rx)@R1+RWtc>`nTR#x(G{taaxiD9a( zqb>^O?W)qp_9?hS;8txH`<}%2bV~;TPYKsdo@5RAXXz(_5f-1woq>S}?RtA_1)h2A=jJf>% zVY|W0)nYL4r?n-?qy2>T<$!+`m*CS3aswKxhIUnV^csK@qbwD=YmT?I6f|`2@$ac= z>j&7(V!CpLR0Z9EU!|F1mrN(#gvsdwd??Fi(%!wx#O_n%9G!84uRi0#sYLdO_NqnB zib_#p5fibi&qgar;H(azM8&rxr+}tVHo0Qqisd@_i*AZl)#nHoM$quJN5JvK#1zrg zZHryxHAm6WtPqBR;-wwa&!t-v)4`GBR5fD~VOvDj5q`N`A$Y^|V9$BY&_ z7}+S5kqZBzMp{WtHo0`RbgJ+Dm97)dOjOR&mghz%z{KMT0(F+q z2HEmOz(;0Fzx6MO;!8Q{}*N zh>q#yml-)h93oW~75J9UH%gbqj1p!bNx6beCBr{Pbbl41%?Z(A1GE16X5w7YfC*nt zP0N@eLg95m#rW91&tw&XfYVK!N~|jAgcD?ZzB4ixPyO8#SNFn z{Ch$&(-92kdJVz0go*k7%9;Kf1wU{fmQ=iFr*F{aB9P@Ts;H?Fs#278b;_0QQsZE; zF$krb0Or#ow3e1RC4;^M)jVV)2_%GzU1v-ZZCHqUYt{?Dl8ApPa!Sp1B0_9ZI=fgz zGvvnv2@rl#Tp0Y?PvwkmEOjZ1pARy`F2sf5JxHGg-!ma5qoNH|V4=*KgeUvNoqbOF z{I)Fp8Sl_{EerQM_y@J?90pklq|7TTBw_1mX)E%$8mUBzh|k`GYXMEaFDGd@+Op7{ zX66|$k~?w@nzt0!$(uSN$S|4iLib;#5w$88BBz&(c?4 zVpd)zIa%5E0C)iZ>utnCGO%!-oj7^vwH#nC+g8Rg7(rmuG9X#W`mtKfCvNUCcVO~N zOrD!SQ}J1`ej}oQV1M109eGbLJE5lWzIMlbS<#78U{@i%H01;(YtvqH@9n@Wwj&U? z@ReoD*-dg~gM9@}E1nSN{G@AmYj?(blG#fzh)=4Ze@8H*m=3fGG#4H$FxCFd##W*D zOq=V@hbxWJ9Eu4%r%K_!p1%C3PMI($vQ>$w9c`gn?_Ywj?^iyTwD&yW)Ni!KSv>=%!5Y8Bi&2zQE`E1`czjM3@$1pAe#H|&i+fC zMj2pwBlp~=sls_5dZbnmJOgRt&wE&jSTiq^yR89;&TB@VC)l2}sFhtG0zt{UXC`em zry`fE_b<|UD#Xk0g+H^NWICvp%wXa;)ev*v3+uYh4>)otrW5);z5g^oz<@k#(Sq89 z)BzFxMF%gE#quKyxWX)A#?BC%%Q60bR<-T}W$;8zEWqwo)Uy)Q^JNKuC`n(gyAS%# z6QV?E1^q;PED%euB#H)}~vjj-jKx4QmDgBYRC1 ze`;3;yg!RmcT0NqV-295g(<|Yj5!D9BDFFKz9r$DbI#I-i%i*HJWt14LG^6D%pY$6P51M z=pVf$)4r#+QK60afYPj90nrma9UdQHGX+&WXjT*UCjEYRohz{UH0=t&O0sN5L4kzt z1e9Oe(ntU`A$P6fqPfJBdQhx8>X@2_1AUVxr_^p4RA6n%M6mb$$=2bZ$F^<4s|Os|A5 zfJo0GRO5HC+o5MmDS}Ix+y(Dw6Bz29P`=*LllA&s>cBz`Dn39OWhff6kf)si9v_o+ z;La&?#gu`Q=ouMA+9Bs7A=r?dfH7&Q+x!EC0yFu_Dg%Xgzn@=Ae2f(92mC0_-?<;~ zQmM-)9<;pJ6Zq@A3cXs%{Fn`U4L27(g+42st>BAIy$2|zFSm|+trsim9x69QGbwDad7sCqs!**b7~6e=kQ<@?=F z4#t5%Et-UdY^#)QPiuBq?-U5KV>6(#NH{uLi1jR#Jhnq<1t@#APoaiZ4 zfMYwFltb7iKqGO=b`=rKE7|o$G6HG=CpAah#lGO4vO)lk%i9VH&4My%)E)+6^e+8v zP@2@PYmWt-Ln$OBx6bZiP~8 zy6cRQGu;T;vAUHw+?m4_tDQL)=Wh4{%IpP#T!d6noib_Fg_y@im091yUW&f^sb|)9 zG|nsKm8Yk)0tJ;rYVkNIE(KJBhhT!EkXy~U^8JVr34}G&1 z0yAG#%4o|2yaaq0+fQpARPSVGT-01) zw)#00w}nhcejt|q`Wq6JLN+bvqWy}X+J}naje+d(I~U)2^Upk2jk1!`WihusdOM%F zRsIl{zw-r-B=*`B3Cd&F<_G39F8hlW(Rwiyli5|nBciWq5Ouq%#2yBhLAJOjwI65# zHt+j&E-IAm0NUY6s?h3dAzg(QxJE?nc#~Y2OyEkBMaztQWdCUTeYzL54T>;n07@P~ ztk`l$01|`a=J9X5!9Iq*@NLc&Dp<4d?7WuPX{{RZ za4whMA>}^5_K1IN|Ev<%PnYt!dg4foV9gIGtaNLJpr13Emrd530C{5Ipi0XVBIk9@ zJ?*ZBz6r00I63R4sI!(;|5W}P@=OGEG_IEYKpuX1EW{zZ#P$bu^b-$q)Xf?m4LJ}| z7jUe)*R|)cSMF?+y6aP9gpGu=Pxum4M=P2@p~$QfG%Sklbc0AoPtrI*e^+PC z=J*~khzo308vqm>9#6rKI~QtwdJ|zog5L*)DhXG_{BSa3z{EPEc83?VAwA&;eURq#Hmfu2s>z$^s`bQ=CF@g0$8CC0^wCYWcWZ!M|WC zVQB5_(I$tetS}2hpZ@-#uG4~OVL|0fHvP?hr$zz+`}eK%+Ybm}VH*r=J}#6)Dn2_r z`5tK0+OKaZk7h)lSugS-i@wnS39X)bQqFYn>>AMNLxv+icQntz~Smf%fjmS8|iywWqbk ztXDyg+HAq7#f=+xDf0$}Lz~AzRIxC{|KMP5z@OTTB629p)*8wfF+lT{36OqgNn*7H~(W%i)b9u7AwOw|1z|SS=7Pt zQ#83Kw`0v>%pp@>{8}Ucskdu>ZaknRKmSSHD3X)@R0rY6b4m9g|s+C&tYr{vK@IEBT5{YR;>|^fWJhghtNkQF;JFTFf&43T zj)75gNSec-rn^mjmAnf0q}Q)bi(ZNjLj3hP_(9bo^L*sNjH04RVgP7Lz2N&BYN>-Q zFpEs6@p}$r%1)@g2UFQL#4%ZoN#rj!5=@-qnthL8eu}A*VV-`#_!T{OJ|a#>tG43G z^70g1D_($t5hZXHTVamwWKgaJFK#7we&pNL@Yi}A*Moih>#@USL6MZ>F@8`?=dy*o z`Et-(p&FRyxeiK9ed}Tl<@pMRbS&))p1L%YlcmuX7?`sE@1W6_Y4Xn-Up)&JV&Ah! zFre*{?H2358^&N0%+A2rR$7OO;VPxGKraX;$d8G6=l;)Sg0f&dAi(v`PyO9(>c;$$ zF~W^o!nM3Od+|6D?B;^{c4%}mifNmN<|c>${y*BebRvC!4FKb>M0ec>EN>>d>h~q6 zD^HVe=rSAA0=-Y$7nFdyVvCDUV$Sw5YykZ#y5g2cH=?4nZTpX?uIjQ=e>(U}h^pLa zC7!beHB^!rEzpZ5gJHG|=Lt5%eV?)MFN(acZ^KjfgQm0A5OXd-cElTnqbhz1O8P2&S{G(&IP0_496_;>rx?$epaD zs9)=yYDdH^bN_5#ykst@#{k(pDGek#9>D7=qhZZpAiFCNGmpA}$x~&eF;kVom3Kku zf1p<_=uXvXV@xL66kU&Rpl#Pv)d=zwcd1U4meFcIHX1}3e5Dd)z#LmG@8 zR!I4EWi8h`p}>4GuGykDwhTvCwZ=TXX++i+vja4^&Vmklf2*)ma#G`}(Z-Pxe?28O zhy{v1l10G9r0*r~TJKl|FLZHB%76GE)GCVr#$OU@4TEO4M0#MZyXn1+^CgSDYZt)Plv!XG++VYvZR- zU!P3X#&YCcNCuVsjEij;>h(uHY7MNG;`Snyzhv+nY~9L_@jzV=e%mKv1^nUA#C*#m z5WM{W# zWcZdq`WB%CQ1EQ*a8;HL2|B{Y%)8;*sjREeS5+UG!Q{EXKuX~(kF);;+Y)^A?}z`O z^0qnBBhbHYNat(Q!Q5ZO&dkz3-TL4XVoZhW^PX7*{_1MiMF&|Vq4^+CIQ|fa4yhL& z8xsS1>I^|S+a;YX51^*5zn2S|!{P@G$;P>H|7RW3#gi@mtepGaV2jI5dZp@w@`bjM zk&%J=+c@x)nXiM^TU!5I6C#6L!yq+bu~YnW0r2CvCqaRmVAgScXz2Sc;Ee_MLBGme zpNjkU(}62pl>l>2J5OEL+8BNVroh0OwTv53{Lo}zEzYlub0lDvhnb*3*<=&YHyJs* zaSX!$+e%r&9)c;H-;Mv6Qu>m-6SMrVvGAblt@g_R=m=6B)~u$C{24pXI4$JQ>uzDH zV3L^ajRB*GXUz;@U(SGrcizIkoIhRfQITxCLjv2Z>hUdu+L2cDgOWN-zk{CT4i(t9 z6W75JAt#iH@X}VZ*Ysl#z+ycL`k%IUR0-Pv7~kB+I70!@l^MV1;Kc@y5+?r|sz={k z$;2RND0=cKCTRSEQLeJUFZ0*3FkJL(A@|CW&NcvtHHszo*CS z<14wv#VePa_kZ|$??5Ww|9?EELq>x`Mx|_0c2edc*)v(0q3o3rnI|eMvPV{umAyBG zWQ43^?~z@0B){uEhtli)`TqVh&bjYvJg?`z9*?}>UZ5J!Nqnp_*FWQbfQ+I)0^9r- zOvH}l24w!Xw46TfeL;`(@gfVD9c=GfeegUSKqvq>7nSQwz_gkJH)I^f)w1$kZJ6yU zXw+5&$T2y_MoDJn5PS%`D8uk0`e83O@&E@3Ec9~>2zjAzd-5NVgCqkWlxbrn3F2w+pO?a<*Eyn7&Zn4JTg_6z22`>@l{$OYOHmbbMK&qBo~tRPao zu#o%n@pt5$HvnP;9SwmKYbHNq2Yqgb%3F+DCM1snsl*S4-Jsz87T*MmXd%NwOhC+d zAp(1W5p|D9iaT>-TwWT}p`LpgAl8)stXz`@c9z}c&^ZCac?83g0~}rj>(^sOMFVH}_3Qxg5S-~8PpH$2(;7qQLwgltx`nPD z!EwRdlfWu@lo`R*yXK`5S_D9Chu@IHllH9jhFw4E3IKFHx~5znjhY)>>Eq5{Z~?+I z@;L4Ue@Qg}b9ZJKsvxMu5bPW*(7)FkYg@sU>-N~8e{f?kyW2(LGxc$9JyRXfjZowQ zC0KyihORRX>6Ee0+2?_t9Kl0|1sh>B+n2E;+q9cy0m34dGp#0pR)@ z5}N$k1x`Rix}|cz=Q8wA3)Nc3KQaJ*)dBqvdB&5Ar)-5z-CaNH!?4@686T}6Z0G_Y z-`|Hjjbb{S0~iyzP)PvrRCpzZf?&%T-I%nMBXV%;k@Rr#b0qI*2#8sfkm`r)R}R^Q zmS8dr{1Mg=lF`uQy*VbXgVkyzxCTt47F|&rd|JlN<}g4Z$1`GWX%6lSDH-70dhZJ^ zbI(4@2jHvfSw|uaFoy#K7w9Rq5nx}equa1ZLHfP0O-XP95IfBt0Rb4bHh*P|sbm5~ zsi_HfTvMNb?SQUX6tfa1NbfQZLogBVhX?+BJieSLG7>urWH<<`)#ps8uu%s~sAnEA zrSe$iTHE=&cMq|j0jAWsU@#{qN3ruAR-Yhc&hh{+pmIS^n|U}^Ezire^vH^X{T9G+ zIq=l*KxX68XG2Epb}OC5nY=IWlA4V=ZK#a&!JVw)Kb@|uMi-x zK@Jg*aLl;_@-)T^d9?B>$kBiHANbY~b(SZfV8oCk0GdLc?bq2iLqPQCZdc~R4Ef3+ zCuII98KOEGD614`cm$6A!9xJ9;1uIEz(A55d9WAy7ASYklJSoYCe*`*$p^H*n9zZG3L)iu|K5M)XLEd3U^iYQvp!j|A4s=UeX6) z9P?6t`~YB108Eh(6~nk!FYUpac!FE`2IL(jzo3*y1ixt{L6in>D?qmjgF6Xslr|_@cqIp=6Adw8#K{CW`7CG3o73Toq z?*Wv?t)AieG03;Zv#lfkUcnjqlCCEGe>-?la@fF}32G-WE!5SRgR@GWJ2fOJKJMd09kdUKV zeTaTpU(2F0QngGVr&D_xYotWcU8SenU0gR60bRjwmyhcf8*+d@%+|6MEIZ%xMtO^k zm)b@LcuD_?1BSDY6GB(#q+K|4QQ*Z_i3v_QpO<{9A6DrABCx&?&zFE-GzzILNiWLD zvFMH-tt`eyW&rznM~5EZUc}Tx6tNj>`s@F`0V8l4V!#YA3bH)^gLmN%c?a{69mKv* zmFE%fZ$J>l-(vxj8Daefk4%l*dd23Zc@BiX0+!+K*tXnOZxIgXsp!L8K!Iq2GJrT5 z?dioNR|4n~0npPwZ-#=Y=b%~ikYNb?JB5jpWsV~Rmp=VI=)5!AMS}~Ya0Cp-i|{dj zs4cSl?Ao{TLF@AynCIxHz=(K;wc6Vz?v(*Mt#Ya60x7yb{w&4|NaTn8aqa(TB0YTt z5}DEj(#qk(Xd#9H0uAIFk}}iK(vtNGIk9VH0R=0pECBEgSORo&>BG|l!Xfx4vPuB8 zQV3D2?aWF@3*|+W819Y^#|s@}B5H4J7HJa(J7Ul=>UN&KgJZl}n8fdZ1`9-k%a~|T zPwbY9O|Up+!EmEtMH>b(7m^lMI%0Gqi`R33#d`uKS_=^NVQsAOZ+73O_lcv*YZKek zew5kIAJ4@ix^cSTxcv8xOvGtYANSxS1AlM|63Jk}aLNZA`Ub_jQcRT-epgzZMDUv- zr=nX8sjmq&;FI}!*t)f5FK7pvTZFaow=-jdSpJ(3CmR-JFfAUb%?BkP@Gd6EPVNjA zh(XH)#9JxRGaKt?VSfh-tO%GE>uIMyRD4K%Sy*rf@q@6J^m$4Xdn|VbFy^@%KGSE* zuyZ?U4}cl^)z^sL@-;UP6Sd47j6pJ>M{UM>lXoG_mt8THk>y}?1$rGIXQ){)*7lIS zsqb}QCR6AWfq!*$2%O^JxDY3@W?nxe(FC@d?hS2onxPf*h-Bw|!AlMT5XL_k>si45 zGcemgitc7{Ug$ncZvz1@LHLxnBHdYU!`!*5<}svR%`{Mmv7;k7$zwwG$>abr7G!fE*MeJ^(?w}tYI#9yIy9Wj zXF-!;Ej6js9bvPJcjx1fG4l;A((&YiUgSI#A{CJ) z=Ied>!6x8?b+V+Kyc5%{e{PoCtxWC7e2#y;qj34Xw0>}CeG)N!rkVX0*Ba6}p z925m`aam}?>M2pmPxjQ0k~fB`~wCD zwK0BN!K0}O==I?GqOv#WkS!Yo_?VzbQFiT5lL7V|*9yWHvAKRZRWP!<&JGF?>0%&S zSPTb2!^wjqaOC)7PF*t#aC|}pGNnrOw6$Ax&^4Xs{;?xK?he?ZQAfbE3(jgpEiEs; z1cTxs&80v51}fs8YYrHgdw9&{gQT3DS5Wfq&{@^=YYK;7IB*sIyuuem>WXq{e~@Yc zU+%YrgN5fjgObXJ(75NOc#2c0TPp7PZmm(iz$AQYf8naBtJ|H(!%9S_MS3ST0zK3$ zKrk`k6x6{AQVtW!JP!}YfO016tJnC^E+X9 z|7H=Pk`#tZoD$-Pk&-+2SADSARDL^selVdH>#UaL_I#cpfDaKO)tHDd5k>>3B@|5BMCj@qZ((<5Gq?J9k9LWB% z`Tqb`!vrqGeE?{&<`AYBs8{g)Lzb2U?*;BhuA!;fw8V`m?b)Hz0T6vT48ohkysKMf z%t@#YflWa5C3$|qZ&d;F7u;BSjU5a0P!tn^&mp%XSbk^tl%>T_4GRm4v+NYpSu;Rt4GNKqIO?#A1L(w9CVtlT0B*q`UrHsgnWI`laZ;O!s$?m%(Fw!Ik2 zdJWf+jjG{-SEyze4X^BttQ1`=*vIArF>J&Ck4q&s1E7wO%9iPIC=D1vpkz-x^lH;; zL8zr@nnu4F@nM{-;zO^%nUC;6MkwU9Y%~{CCWMbRn2L zfbRtt`h&5G*qQqv$S%SSz=pzy0|9x+@oLS+3hFG$|MOXiZ(tavr74g-8G%Zk03ho+ zXuX3P_aT*h)ynt}V3a+P#y=VYbr~WC<<4D}JW{4Q(0JIB4psv|h++zXLVTZ(R)1)e z1aP1N&cVmQI=e&V#>aBEucdqbE1O5xQBD-f&y?$6YG7+dz(G-BL~R!Za)+@-LkUnu zV$Oefv&d+!%7v63<^sS{K$%?(O!MIaVYlqhPR-L|;w#2s$&YRf8NKv(ldGw}F)Z|DX`d zK{t&-NLD5!E+)N982*k_qjFky_l9nqZ+e_>&RZtx$5uQ|Ysy=EFCE7@7Z5ds%FphU zQ)J_iP>SjgcxZJA>&Z$vitg!L4qwiXkzBir0J5qJhS12rpJAA4_NTu)VUA9HDK^#R6g9@{F@$kN~S<)s%@ zZz>ovb4Gh+y$9ST*(|o~{%iMQCnsXbXR964%`84);=e9Z6FvHYAls#HS8auS5$Fh( zxP=rxRw2@F96%~+Uh)DpNT~>z(6FWet7jmvRrIL+m*6i^RyR6cd)Ab7hR)#oKsgP1 ze8`dj+_xXo`V4OaI$koVkog!AH_~xjHu0@oI|6T5;w7V3 z(iY>8b-3OlN;D&ijV^O6w#$Bq*?iP_O>FUwiP&eWaS1`Ntvtcso&7q|{59f;X-|9t z0~Z*N>cCK<3!u(6S1y|^qrOtXO)YG*H$^>OAjVP5(g%Q9tG~%|Y)Ac8GV?Xdag5ERLOu zt+l`fz8We3g1*hT=fA{p9H8V!13nEdli0Xo()mfJ?99w$$D1JL?1FpshmbfMW83lx1Axye>AL?#2Uq9F#VJ`S8yP7lbLQoCa| zA~n%cBXzGyD>eHDigN^@iTY73O-j5_b_wKgnrs=}ep(uL_mUp0k;^htc{jtQqF7Sp z;-o|3FWrTq>w&j+SJF&_CMkQWEUDT_ZpS4I<~<0yzq@e}9a5T7zf)Q*mp|&XPvdNY z_&`uBB>bWHI-}BkR90m|pq)k|q3B8U6P;OQM6*d(@UiR^2r#qDvA&3G3#3-&}c{ z%d_gMzuLM}&;HCs%U9$qMh(~&p5jNJS>UOt-W$33yFy8@J-b9sUmFAtlYXXH*VK=^ z0}_U#mJmv?URR^3rVQZlSUcw0ADMbbTW32k)Z|j*Kvm172S+s^rmYO*rWO38k)n&EIPYMBxHF?j$ zb|@u#Rv+CJq`n-AgIbV#hCGHessg!mqT@FmCr8J22nXWcYH#{^J({bManE?FW5bO^ zs`J>OuO>R7N||n(GM{`|@xn=jgvT+kB5o6`#Am|#pGIL@U0fBpTb-IhE%f*%;1&?- zBkqKoeb}bUoRhE#vu&1L*F4Re`D}l2O!XGJKOHVr&B1++VC%LS2AUc?DXq-&`_Vxv zxuXEHhvTW$1Kxm@i~^93p+U`M`g80W;C-$fne?x&eBv-k;BClo;?y8(;O$-6zWbJ0 z*ifN>{9C2MhRez;zLcmul?kQz0FZB%IP0_3rHof(o$z)dWkPf*lO6+JhfK7B*~a;C zH+yXPn(Ky@Q(e0m4`qY)53)h7^8{PKRhq2#>i*L~h79y%Ju2(#B&85^D!6&r=@6+M z4z8`G3uoOWrQtM3Z3D?j2&O@A5mi^7>fXTj)(eY2OMN!DkdnuCQ{XhUybw0-wxjS_ zP;I?P9W;58Df@-;r+x`7@P>M4dKnR4Ck`Q*RfC$P9`MAco=iYoSczBOzR;JdSG=H`!4ixytix3nD= zs3=_S>ctinAC7I{ovf*aXJiL>5mc~veIj25qioby5&)F|$fN6rPn^4cRhdO#rj%Wx zsaFe>$dK{KSdOHrEdTNwXBxnUXM^bV0!}a@%^#`V_`E71a6vz;y#8w796ni$&81rb z{UHW3$spG451o*WOH=>5<*iD!|4rjx#+{I@j-uwawyExGQK8a^{CKrFQSD*TrDQ`) zTyXa`&B(2K-mKAGABzjNZbJ}=^8nO_UJjqoCVBTh-;lOV!1niC+A3tY*NAf!VWdR$ z8x~3vZrW$w%2m=+cdJ2(qE~)^&9#!x<&Mce@Q+7)RIq4+xD!OxgOOGq#f634GBh<+ zp9(}_Km3o?RpY;ezv=&CCSp?9i}7nwO}G;=KM?vUESZPcceHs!>$j=nEv|9CP_%wbTo%_TjY~E zJ(9YBkLpi5Y#KF-b2*?Fv*?1lD7X!qWM>_0FS0n$-#-GXk|1;REq1KRelMs7>I~(S zM`f&2qbuC`@;*6qdQ+<23@JFD>b={qIrsrL7HHa-m4RNv z=IYLpQSwi@ucYqkTzTP`CTa=tKIqL3!avNTV5k2jmqzgu)t_A43(=gA72+`kU>Lbg zdZBlmB<4zVg#Z^kC6tQ*ob={;VfU-*dAoQ0@5}U3V4KVDMj>NQBuzO`&IUuZ9jtJG z$8B)zwkUT+6TfZq+X#{e)XzbAn6BAF2Tv)$6ACChkQnZ{inba>sLK8mtIngIBS$En zEbXn!dYk50PfT)#ez!>Sk0KyrO$0rOte1(=wJddbB8&IyETW`S1YE|K&t zC?f)TH&@=how_ZsI22s+5-J0N8Xhxho3Xiazqos4Kr^+k1tHttNIPD=DEWE&i2MON zgh|>XkHhJH2tTZ}My82D^+yyHQ9Z?zJ%l#cB5B)_i?4D^H#Apjg7ql_tIVNBH%xOA zOBIx+n%}BU6519;cRQZPP(LM(j#h7VZV2?!K@l!0i=f^^%WuJ8w%1BysoSJ`Enc5- zXzNwlKe_-1rb@vH2-5tBp;iXJZxWXnkEY7uqW{vpp-hr1DJ1)f`-&?OQ`C{c8{6IJ$`c)g(IgYNO096!QVzVYfLljnc# zpd6fn0NO-MmlU*zwNg-1XxS3oWh#1Qcn5odTI`|tw#BznWxo-Wg%7PNFzS^HhBfA09Z6&; zse$>mv?cajGrb&SI#8f{+mP z5Z{SoIAHQBMme!4(5%#aZP+Mm+PBQUF+9J?FkW5R*ao%IVdpr{Zd198?VkRa|j zEL(RlLZov=LuJHziw^93(?1hS>7#QmpPs;MzYJ09gYR|OpAm4lznIiIMjUSU6UWPc>^X2>$O%`JUtl*C z19lGNlXS~M7Q;HikVkA10AcW0W&U`lTVoVGbjs|`O_R;sN)8coL@_63F17VAE*|6G zMXQ_HCv=Rht*3!8Ry|9(&L_P1OQ|R7B{p422C&(6%YFBCvhiEW*MY#ZOXi!}`W!M( z9c(+u=0RQcefhQ7Yb&7&pkD|yzg-yy4YS2VL8rhCry!*38_*~iU$M4rV6D^%q~UB% z!1+_FVy|ezQj@T`L3^Nf@<(_5OsH1aCTz1C+Q9c>fDo#@?SWbx@UJ0(B{HtF81RT} z`J^{94eH*VypklhnG9+KcNoSf_zgfyr4koT-9cgHuaqCKTtz*{bilSH^^7PofUIt! zX-RsWVZG*y8}-K=2;B~7*|<&?_7z^35#s4x%Sz2=2t5#$Pgw7f&=QzMurJSk z-Yz_X{)hXyNw#a_?jQz;=Zd+R{z4oilh?>{tuZ?GaBaZB#}-yVWi`LR#Nm1G)KsY` zdz{1}hiD05spH7}*k}v^zHuV5#t1pQHx*R%m221By{6c2FtbaYEdgO zFqosow?9W2J4wK@Twt;x>*GsxW#JdDUQOSQv)qIQpbwI?X?2QWd2H*kcG<`N+} zz+M?SOXkC|vBUWJ_MLKg8R5mdx3KM8b|B3{X4jXc1C+!G6m+-qv`djJb})*l%Gc_9 zTcuAfE{G~immYeVt;)68N44Vj{eFQnPM0$ZUe=g1K9wTtPNUK1GeeTT)Peb(b$N+< zO1}|7r1tczA+GFQ@jSkyzFfHB)p|w4DOOf982RE;I#`58_3p{mCo_w!5iXBchU50u zDvW2>R}=b&c^22IkK^DYkHLsNkHN)YKjDuM!!I^E?d5jHxi9%&%StFZ_+PU;jRFf< z;Mek9UmNlZw7{t+(dW=%4_QC>x({>h@0;jO{-!goZCAf}@6y8ODYrQe=_Q z*NCB1an(T6BUyv%aDdYAkWGZ`#89&EXKPJZ03MiM?O2L7!`unX($MIC`d#)r8wTIn zc-*GR1-}<_Y*O@Kphsr-${m(TjQPSnA5ZZu>08qF33t`Ze@cHkE=~90p4O$cX9trf z$AOn*-4^DZ%zt%`rdGEcPXVEVSr}9dJ#k5p!cJROSp(O25<3^M3vprR7Ttt()W*Ga%aGzAfpMS zY!cRwC&0H%iCY?cy+eAnA6D9*K>dWf$9jyN#V)i`0eqX?{HKa~1ATsE_C#o1H)cl@ z9};}qA2)Mcm8&#@;V;WdNF0a6c8;;O`M*0(BQw@Turd%vOKQ23rY;ZrWpep4em4`& z!&5;1yr6BlBE1mg<}@Y8KRKoDjZC4d>bwl5g36$IWqnEcEU6JxMf5t4h9gzsPt}SI%c}5o)#-q((vszdAiUx zSNPVPU`{3>W{H{=JWn6||8U_kgMg$QH9$x6VJ}%a)PR}ogIla|OJB2U6cyiAa*^8j zdNcyNVTtnu->dFzr1}tuC1%3ySCo2Bn^*IYAILFF95Qy?Y-s;}_y`Z18S2>6-Fr7= zTS>6HGe$}SRuMD1BWD{sQ8H1Q1e=EdY4rBGl7Q-jdv|7BKaUFb!^jO%cHRg`RPX|bk6iFVtufG&m&>PP+iBT&++MjGLYPvo! zQ;V%d3=e9h3hO*oTK+&h6#1HE?{Hf>2H=#Ju=D+Uwgq8&H5>0DZy{j3ik`SP;6Q~S zzJ8Oex#m5|O@j&&WJda~O{vEA?!S?1Kc_NT>W zQ8iaHbn?Q9hbUzIo*YgAnJ5i6`HwIqJ|Jj)eSPquTvR-@eOtHY=A8HA0#iC5VT|~N z?g@xt<}U_d-KB4r{S=vb7<{PFkvsVMtr69B&3@P;#E8#{2Ttw^oYUxi+?B*(R_bQ{ z{(QpaS%ufCy-i=K{>}g#)eh>vzk+R2qJT5xCU6@ifm3btT6n&vT!Y8o8(Br#5#*-% z)$L>e3B5%9)F-0{2CJVj+xkaJ%p#8AUFUU~kGcUTBuxYZ=$MChem81Td!dm+P&ij? zq@XBkZ=Dc|?hXKBnZDVS;N#x+W9^R}fVKb$toKo4f_y+wzn5V7Kr;C;IA6SwUSUX? z>n}(x>OJE*txxCm^wIjQOGm$w#s^z`x3CmYpo?F45l7-VQixb;r>5kIhD%jWUglGm z53yYL%P+S^^I!QMpDcJ_Vz8TO=6MXOn*U4*TF!1k9N*kcq5GBy)aTPj2NKJw;9UG3IO~Nk8Dl;cV)`hYpp1(4VDyOS8 z_}`=bj`Y=5vun~WSmLme%WSMtp4rfc?gk=L9_e)15#pP)k8vEopRMS94Q>{MWE1Jh z*filWgr573IFTJ}-U7Uty)?&xruAR3_Mt_R|Fg@`yiVc}EQiAFAhUdrY@8u0^`U}H zmRy*#*k5y(?1zlCmCqpmY=9LkQ@BZw5$yNl_rG(pn&Q6ZrU0vzlit-}^zU4N=k)g( zm>-d#7CX$`LwWO&(H)YX#A&QBIlTWKJjnEs>OUh+!v%WZeEcexcEej37+sRY1nz8<#NfOi)&ZZ#^2AVKkG7(Ax@)%$>BoVyhgyVL>e>7 zBLrrdb=%X;-aOb?8#Bl>X4r4x^8EcqHASQME?M}??{|N33jAmMMe?5g(9qIsVc=+3 z$DR1y$-gmY@XPC9{B)4$%?LrFN4E;CahQbXz<&k~?M!k4k~)X@gBx{%YsBe)q!)A> z;OFW>uLTe-pWUZL7w%Q4@@q5-#~mMcyS$W6g#C0H9_-YqQxS^xA_nz7W>HLbU`1HP z_1}f7<-70gXri-qu3QsyaBRuM$N_e9?}?Z7TF+-G_~y z6fBM#j5`COZdpuuZI!>#tCh1!argBV{a)fUD%b!;cdJn}Rwv&TLg`jL>F;=RYbmp! zE&qPq^L{ZRTGh;*&`)s83uuCoB%=ntmY0vJn1em1;e~79!)eAyO}Z?lMf|T}j|=cd zrq&*bfDMSzp&)&648BVGtvg+%_@gJz@qAml4LQ#ujA%g*;V61=>@XLAil7C*WLlzI zYfi(re*Pr8`tBcvcd#9E%(aAn4lwc@KA3UNB|Mk)Z^6$W0B}7WfM&tY1HRXT2Vi?0M>>^Nf+kNUT%_H2f)H4I!)z)M0|1wD6!}F zX}$yIu2wZIOI|Gi4T!=4BI^kp4zgHrV*>F%?>^WHAYOkxd1x9ja{AxLKKNQn240BP zkidb*+)9*}?hgJ!%PmBU#Q8;mN_Bed2hBJl}BlMVCdc zik0f!#qx#h0=Lcn#`4E2x>vd9-}%%6}nRdR%e6( z&mv3w*ax>OsGOktnv9rt{i_SHi;Xg4%oX3->`hmUG>f~q1`O#vU*xS@Uh*;5F59jH z{m&4g3=n{bZ>)Z%Uy9JO%9{)l8IgE-?g0SwO>tQ0&AP1fHANie&sMCVK;%5w+9ap^ ziRraP$OaQ@PSW1)79SO<(0a!$$Mvt0gJ1^!+rqbJU%$JS;JJz0uq7rBv?)1(l!>nY z8aq06qyGGos6zse(P!d{-Q^0)T2Gu_AiIxFiHbPmZ-0t69rY)Cc2dCpu7=x2&yo*) zU@n*8C-|25i3>KKO_Z7syzNOljN2hhTAkzo`OP7_c8h_aH23v_d3NFVu2RXgO1N+k zxP6e;Cu9@%y#K%I;BdF$aE3xX=Z^B;JVkH~Y&(VNhnrF@5m-Z%1g!Cbo!q4PuLStb zXO-CvB@7g>GI)gcBk4hxl`48%x1IGoaMHeJmrf840*FD2a8DrI-T5{@$3{SV8kU<=3{qIkNcM23s3bXXT7W3j1$5%YPa3 z$cd2&bR;%m!io8#PX4NKY_ORHd`g$ciw~YWb_~UY4Si!Dyhty9K5uVu|H|3#bq}tf ztY>lo8nEKx{i==Lg13SE%~qx3c;`jjE90Kbrxydwsnr-rO**IqP(W^oHmd8nsorDe zRde|iK;`&zI&wCyND%N>ZPkUDKUyR;SQCDNtAIDqmvo`$ zePrCD=F2Fwi%_t%;==)xw=Wj~u#%?1c|sZbF_*#wK5Jc5>TdldAg`a|ohE!Mc_3gj zFPGI9m)!e|@XHtTTV}Ep?=O+~@EH91wbo8b(RnUGRhF$NEUT#Z-c7}0U3($F^`t(v z?$o>;b{u5;UYt|;+N!+Cs6LY!eV;SLiT|?6Z5RUG9>u9=FJe4@m1uH0=1xEE7OL$;X8CwfKI^IeK$(#}0XA?(G%o>REt_oK#6%P&oI7bqvOX#3&M0{rPfEnAhF8kA@%r-ke z8ZUK~X&9?M9(8-H-}(bA-_5cg%0jjfWY}qO`q!4lREkl+zt)zz z6h+udC8(YTQVaAdi0rM$rgD*4$UVzoq?x4lcvSH4%W6UXT*U88&|tKl{0u<8F_oSW z*&4E2S}bTU1_`QmtC~GWqJ2FHMS~lgeTMRic*?rK&RY&Upm~QS=k{NcYgyzip7Q}5 z>-etx<2tWFOdx-0Bjd7en{&9T4F}2%I1)y)=)5z!q4}IXK+FBnuK$beAoA)Vl+@Nd@|87z|BkGp39MBmh9(VANk#A{o7Z-Vh|Z!Pe{aew>N>8e)1jf zxQp=@=I>JHy#UEz|7n3m&hs~H5{EtZ_tZXrzm-JdE1O+D&sx_(Z>fHK;d1z~(fxOb zx9<00-JZw=k|^#6e#1`|vKSSS3C{*(fqD|U4pd#}jiM<96aDJ3-@ssG60veW3g6nP z+8nr2>dvGPt6?)dXi@M|=kc(^2NjA4&4`;iA?NY1{j9r@@ z41(H#KK$&I<*-~WFBx@rsThBL{;ANj%@q0NwA1Hz@DhK* z8%^u!t+xQ6xyW&ny+DCwlXj7P*AEZo<7Y=)R*HrnkH)zqJT1&9_?TU>d`=)w4DBK7 zrk0iW=^RtA+aiN(>-y*<%WIoI`}r z&bPPDRj(e;butoX0QS?HGek{x{2YvvjdxhlYC5Ag#@E_KaUBZ%d)IkD(=51 zvORXZ0z8S$x5=tv=^+q+NNN4ZCZqf%a1w;^lefL{gcWGsXL7;hN*>_XFG(_*Ef1Dh z>tA5Ch6o+Zj{Iiu~mN#~5d<&8X9m<|h81~O(36Ut( z+Q}prrN1@&I3W(WCB=281)}1wMsx?d;wJ|qHF390;q@^Xk)q+i`RmpF6|)1+Dmm8E z{j=gdgZ6l#ED+pCH{71yUD~r(j#ElcA-J0VneOIVB*hPo>g|uhzrNRvN$!GUgPz(@ zMo-2)9x+9T&t5ZY?X&NaKfaQ*G*DzN7e3C>aL-K7Mla~%^6-^pz!B7+EXWmjj<=a1 z6QX34f0}AB{`52OBk$jOev&|Jh_^EF+zI^TS4ck*N)@MK4FtSdj;3h1!7Wm@^;eI& zUO#ZNEr&{NQ-n~J{t339s5ZaXonb!bb()g1Hc)U?O3Q@S=4i* zRyH*HTGmy_b^CiQ%Uww-hTVk)fPAb2++oO7+`gUsJ`5?$eB9RHi3b%}*>~nEQ=y8* z%<)ci#9#G1_BK8UZHBAs&M7iG?V#HPRxBDXx@683D1TZ71Uh+uCc&fNiMt3<*aeMm zlz4mlnv}Cqx-i$Z)UBa>Zb)Jsq&yk_pVpf=4UYQYb%NPZ0K^hNd;&XcD8#%6P%YAu<$vnevTVr^ygrs_J60J_S{{A_8V&wIi8)L^R z09g24GJ+>EU6)g14XS+03MH|TE&3bd)ztawHe&_x^dm>a(m_Tq=`kOsCuHqS)daC{^F7qg52+`#CglGnFj^eF-lB|7Nx4D$(YZ&f06M{DGhC1CE(F&w5r-r zgWS}`=}0|YCBSQ0Vy(9e7>+naKA2y{5#svH#v);}*sG|b{i)$+?^@j%5umY!9_}uc zBmiH?@}}y8DO&)d_qwLBJv}PvBo*a1-A4sqt`|Vw8&l3=BlY80-)ARH-kYY!ED$iq zzIrUvKp9)OX&kId=sLZzEb38H z{o>hlV0N@&1N&ujk-ATs>!0V;N9LkW&lXSNN)9a@<^n=wpMM?G_O?Z{cx2&u@5 zU#l%yF(bDIuC%aJO8YyWE2=jR=h0T^cFUO)cAaUBzUlDU6DdS$vJ>Yhq++;qc&@HR z9$SK9@@_oTC3C}=R>aX0rz+!V+Cz!sT-MH99_g6`YzJeG%wEKh4_-Q5?#}#s$zJ+1 zTfqU|-rgfX!X3vxdoS{9do-IFTq%^gnvbLs1vl-xonTWSOP8s zx6Z8JsBI%PikLaH$y?PhXkJUV+GS(@EPmkhu$CCUdI0etC#?!yh#b>?6oI^9!S2R_ zv2m>JbLsC6-O7^vc;_vMyVqV4`u#|wyk_AV{NpKHCP;AA2XX^80m;cQK;2{tEqyTe zF48J9_!qM*=7x38Ha1}a%J0H39gFIEdl5Bwaec2%k_9& zkS*F=62KT0k6bk4jF+Xjqj^%h5UdJ_lgy#t3U?RT+hh zGtOEL=bvAVp(~A~(ft^&WnIO~X=4*TC%9C#HIh=c@T<(Q+&1A^TS@cuhVBFtL2bCB zmxgQFB6?Prk4sqqqKPNz-ciU!f$ayvn<)eppf)L`IprPxc z1g?>RjgS<6cur0!w~ji3agP6$=T$PMxgqJoRDDAEb@iRk?T z4pfu6+(CsY(G1_@%%tKBAj`1K-S56=2bkecR_4pH_+)THjc-Fz|-s{5#k5moZz zMqX95NL?!aTm|0+Nn3)6aJ2*weP8!b%*?+i^rR1XG$|$uuk`g4IYMse0ihP<*FC!Jp=15q6MoE{l&|~0H3!5b{ zs3!}W-MhD~QfZm_+JhG6WFhja<6bf)a*Ff=z$6c6)|cK0U*q>XFZJ{ZRmkUW;#&^< z>KUn90oga5->OHiPCTvODG#)_a$ujB-*&dH{+Z&o_Jz;g(LZ(LV#tpIf!uiSH(M!f z39t27Mv8t^_vNVgwzGN!a4v}~jW3mqp7y^1$}&X27t%ZS^!Oh;opuf;2mh;`6It=4 zv_%X*x_;e@O)prCGiO$BsEmTc2}wGN7SN_8GAA&JZBX{iaB}s%8Ipnq8m-pu{vGGM zpYy4G<=yWsVbxK$-`@nOL(A>&d|oV)ko}K0|a>i&rdefxH9dV29OvvM_gd^ zrDV_#uDu5fS5?lv+qOLLi=QrT$~wB zHSqO|ajZ@Tg}V$TI+fK)yH2HqPH_JsrYO<=Xpakagah!%GQHUa*!-kda)}oFeFaPB zpS+@!zGzXGFD6Ma4Y2biz&Y7iRSW+vy@DG@RFia40^-81eCq0J2}shYT)w?|vAA5Z zaynk>JMc+&bb=46L3bHZr9%GV=m8HI4G$n*ua{9qMyYNY)su|%=*RZexYC8}lO4(Y zJ0szo_uQCzl--Bo#V39(bRP-8dJ0RY@q$J2)juRKgd52-CpE= zDmdnOd?JH9j+x7W#pKL+w_iURMY~7++khwjxqXXH7ojt&RWKmy#6hpzF!}UKeXny^ z-UmP#Xz^@w)7CAVF(;4IgJVAR{QLUfbMCVscrOA*jQ@`Ne0u7=602c4XZIuoI#}TO zNp_>YOrgwW>mhCt_LZ$_3a6f6^~XzI556bbYe(@}$Mash2DzBzl>5zn;+F2fBA3py zMS!qZZsqd6y9(?V^0;Ed0oW74` zCZ=&+*;d&F5iLpSB!OMpC*EF{`SqNU{y=qg~8WZr$md z&duN3pY2=(=G~8O91NF}pod8@-U9F^d&pm0-YX8q`ywZ0G3`jgY-QInysfvtgVxWs zia#kn(Pjz?4|&1rEid^-`Yi8oUexsf`Faiwbwy(qhOoy1!7O?cPxurkc&ZeKDmk;) zlI-ZX;=NrF4o#lOr>s;>+pwfu>VwKCvWTRk%e46>^V0po+0d`=DjwTTo>Np*=KsAt zdG@6@TG!=E;id2w%OHOJs{OTkGxte(s9@iVkK0m{f&^5ApYiYFy|L{v3Yed5k?Lu` zay_dmd}bbv{(aAx70q=LxbCOk=1Dq722C#FcQb!3wAn}B=yOYAaD2#qWay_G$b?vNGsoA{rWyoOmFrFjzYmGoea^m8v+sUK zb(L1B1cW*0rF7%*L+=)u$V9+t`X|NoH`{d2(-Ynp$|NsyK{{!-{v#dHs#6(9{)vnp z80rRx+q+gRvBi$MQgM0&cMwQxxc(^R$Ox8Psdn3ycpgHbQWV)J>g&v~T?*3dY-Ey6 zw^HlRS9j1XirbZKjkw5PJj*C?dTsbET;UwEg1v|#YSy{LU1btM(IlHZsGGE{G?whD zHx)LetURJV?KZmA%EDDCnB(6Q@3L&_0fBcYl6VF zwM=l^B#1wqxR$|Rjc$`-{vv0@9UXhoRru!F*pt33)3myH=kFH}fLhk_eQuX9PMwKV zi{})<`f})30rU*ZtA1X|PCl|sq2O}jtI}DJWKqAy8~{k6?N2F0anh#BCAsja#2Y`j zIx%w@c)2;R#pU^#f4j&}gERtE2S&1yXn;^EMo`CX%X~CdC=uR{pfEo}%G~-J*jl>D zSo==t;KH4+@iK~cI^FN$C4-EHMX$!4T}fXDurMo90(@`wqBnDP;?eQVY%1Ejqy!cv zeFj8~^!Gu&EZE+TbRzM`ko!9PeaDqzJ*J>hD;>Vwb3AlZ7hOfR~cS!zVRQNMhWUpzx8~$#XCb&d!bpeE}Gml%yB5C~s?`t?uhu4`* zrR^1toastc44P7x6L{S`-x@*slS^g*Y3&q=vG+*61=NTe6Zrfkly5+Lul&P46bmxNmk(~N${!aWB zqBFsHCfX5Ls{trSrDaw2fTlNM*2$SD(vy~~ao6yQh=M&?Z>YvB>cqv*ehYQ3Ta>dK zccu}$QUUZNh4u7^Y1xxmHv_47KHbfJa{pDDW_&H9IKi4dNb{X>_&)s9osA>G~5(!GUEd~+G+c<*=r^Lfq@H*3!|=NRvJ-`|Wn1Ra&XVW&jX zAwB)V)!9A@Gcuf7PkngcccOvg@Ty$5i}Ry4iV)A?5^=vx=lAG%Qd1PHb@S%-;8%Tz z=my)Ram~n*<t$?~|5tmsKyD7^fpjOq6 zhgCJ$Mbv?nLDrF=_9m55mU>6aH}tTVp=lcFN1{ zJT%}`?_s_ajrErLQ$!i*zDm+mlYAn>k%IysNXbQz zZC9%KzCm*R=Y$cyGP^7i>V*!TCd3c0X4hANN|BkKNXEn+ zhrvdf7&h8@wOy6pc=LnY91xcRIr<$mz$~G}L2@(?Q!1EejW$AoQPV+K>`Of~L!&H; zQFtY6`#Lo2s}w{2t>z|tejBntA8|rs-~3)3{j41qa-7g*oC;XTUK^>MoORN7ULll+ zy3V*2OTUcD!{VQ2t<+{QHEka!@z`__D$F}N=*OsQBRIhPN%q+yoxwv`E07-DuIa28 znZ*n~l=r^i-%yQG%)um><`dk)C~4XQc7fOdHO6^oPXwuDb!chNXuN%Wj#5 z7=A*j!7$)FTZrf#_}e_9Ac=DD|6Hr(@)vi+IpDx0@r%7oh556C_l5L7h8i4k8jT6$4v+mnoRb zg8CB$weL7>mdAX*+rdy!mwpmu?XsS8rQ!2qb@^*#X+BC9XLm=w{a$_2sWU-ZYM}9L zYY+3ap8Mo(3wqsH&xVN<7ocH;@yNIVlJ$uJk?!#3=cqy~*wd;OO5zRcpS63c=Atr=BeCm$fzRBJbV6U!wkI>-+Yw%k? zzCl|qBt$jM&)N5Iuc%M)#i;B1rSduV-)*W2hPz9!q*swrmPFG$fmKtz-n&W$?}b_v zM8Z`QhmwPO-j6~ew}>?veu&uX(kge=xt^`-enmH&s%WVCIf+TB*PIPn=Ywj6ZuElp zETWH5&K;t@P67FXIxpO6Xv}K4tDX0HJ(oQ1CPzdpo!n}MoQ;dr4me7`#;u==M`e8n@FQyW9?vglu{HH&!{v zo_R>v_zh7I%8BSdcT3p?cbgC7=s|O?t1}hTGK3fH4+p!IwY=Z)cndp)vyhM&VH31Y zFT|S`m`qr;)i%BhygvP=#RrQt*`BFI+h!`YzMi1k;XdKTkA)B`@BJJ2Z|Iv1+hPZL zdkope^Q3geYvf8i9y~TI(=twBeji=faPqO(b}t1L2|9k=`G|IFtPCW{W|YxE8Zv8f zhF-Y@%(4=a8|ID*>PwSPKOj-Nr4gnR%7UOEUv5k(i&1kT%r@pX7rcM`bSd~w>!GVn z3J1BUUs0Zah|CR?V$>0$hMaspW9{{^tWp~if-{nUR|+E3?~w3kiof#_e;N}Z2edxO z1oi9m&1Q6u3!x|~WYlx?5pux^eR1NP?gZNk*zL-4b$-)Qwm%tKK#U^ITyJeyVo9<} zffpa=i#sB*s$f>xKqf-+HQ-gQV?mV;G^&eRZ)Y<Bdjpe7}o*yzEX`>Wr+k*tbk7g5A-LXqpxp(C6-rG3mJ|5xeETWPdeLma%p}oS8M0 zH#87U^{Eja7lVZ}Fd(rzJUV1(7p+UETnv}4kqp39dqi&!yWn|K|JHW3k6cOf@m=(= zuIH4L*5RYwU_RRweiBtV4rUmGi;qU#P(<0iGoi2s__b5-q4L;n5PY{g+87VB=EmK! zvmM*6vRq)?q7&7tb~-?q(+9BYtGFud)Vm?Qvw$k0lVMUNsKQG)`Uw3Fu6B(z>n7oy z_n%XeRhPC&son+S4kEv7R~;V9E1+Man_mKLeWmmKag~)NsMhfMt(HC-%fVmNQnc+m z(S5Pp9JIdJJW3PLUg&(-vs4$XrC70?hCHpx!q3hd+8KY55*H{G@^Bsvpwl80Tvq$i zs3}4~TdYoZDwPzXshdJovo*!na_AZwRQ0WX8~2*28+R9~dv>4r>2Q}wm)znnFXx=C$;Sc-qtauuT$1ee4hLC*)(w;9D{eoSH5LZ(B zDg^8ULwy%pr`T;uRuRhgT`=9qoxM(GO>%kvty}ZWbmk5X_TZSF)vT*?sYyQ|b^Y<# znRy+~33)q%xtC+dwzwvYDF*8nWry(XCA6$Sjr_GjIg{Z?tp=C?cnm$Z`7a=03K$i- zNPw_pM$C2Za)kg!F#nNy0K56?bt#3#%!|W9x9WCPzpoA^k|e4*%zz(+x^U0@DZvGp{ofHQ9|eb&1vtvU4fk$=MP1X^8RU_7iJMZv zK;)^OhSMam-Bf=WjqG0Y1=!7(rwhGZOayUTo8DszHQAdI>pFh_(AK9ve}_(-o`c%3 zitI81h~;q$+V#a_(0y>eSr=d%I=3lUXNov(Z)#W`nj$kmC;YKh(#d2C4&#J^8;$aW zy=#*4HG*_4z9ZXNv1MDM2M5fvW2vzf=EV7;-uZj)1Pxj-E88^oO6l2l-Zg_SvXPAQ zLSfa_!u7sRZv3T)PPp+T|I4c6`^F*}APq5VIuHmOOkkmk|Jls{RnG&l?%6*R!AJl< zMl7udC4=+KktUV2B!WQVA#=Zxl0z)%sCco?XO72XSYIc|<}l!t{-H&gN~MT;AE`N= z4t02G)!|aVbD9_WMI!xW?>d$a(GQd7;AU9c2;tK+#4J|uw*WCY$V%!b8@obE^_B-9 zo2=HL3&d~JP@_*G`6e9SIq4EGeeMN?`g8b^Mdh?D)cwZSaU=s*Beh~1xSHO;5es?d zy-+RQ7|dLyG#z~t8eH{+3V0N~>&YRIn4_?a5R=n;Y9IM*8Qj-v728G9!U~kbRi2l8 zw@xG4o&&9$TE4{GXjEO;pvH(uI=w7PRinL|Nm^?=12GBm&XA9pr*A0l@$sbOK-`oqG94fpw@q{h=F=79KlU{1zC8=mffcb#~b`{7a?LM{ZzDDh14F$&yl6G&RrVV&Sf z5t}gduE4*FvE9LKSTzAOX(r`{LO)`3Mq-L`(9 z+esL~)TaWIY$xbyN2;w>CL-ySW$qn9j#X#T%az(%Q~2tVZFp*hRQuq1Y1~@Szups- z3Z)F|fh+)t*ZoWusZ{i{mF2iwRJCn}CBQufmnXx-Nlez*yD&n4jnkOmMljD;%Xep~ zMZ1sYi4LiDgHB0t{_zF4B^OpN$NOf>=qS2`MJ(G-zN(B{W@1fjMr=LEeb6zO(;Aj- z4onK2$t$hjJQ|_%HPeJ@VWm~FbzQYjcko;@Npt^>5#5(-qLG~ z_o$ui!;Ry3tWHA0T(=_+p%%GnByUNqB z+j_@?#-9qdZA7~f(2CDtu_x?gOgLs-m+B zC%&6p3d5x7k574W5;*RP+)NseJ=~rZWcf70?~NI{UA1u2X)#RvU8)oPG((Pd1`Z5u z=%zb$ZyDGhyXT>V>49S5HDMIzC7l0QzP}1G+Uu83{v5+U_0WBoL?5?)Gg^dD!_dqD z#U99L!V~b;l+!OYTBdQjx(t+y3Z z7djh%dN$Xqn{nYJ5~#p6`*qPbVa9o1mUku5icxNrBIMf^LHzrKWIl(I8^97rY5it@ zx~hY+VQ+MOMA3O9?`Y4Q0ub0`r`yLiE8Na6bX&kbS6_pS73WK{GA4Q1tt!KQLK{cTO?FJ)T#?2z_@1eJ{v5I!$*SJ zFP<`V+o^#Xzc~X0(rc(w&)#A@TL|JR$aarqM%OipdNTEGzm+O6x^E(%vbelq@{riA zPxyMA*f`V&n^=6T_i7k5dc9JisC7@zK~Qb#hOWzD)G^pI*QR-h)`6s9Tl!`mG$TnS zx}nN*h7y#Ulpg%i%$d=lGx=6vD5pu+HC5p?f85;THNp8o%QQ;OjqtAYvj$+WxsL1y z_qdAJ4DwfCQX7(`Ibm()oLa$6`eJ{8o<)Bmq&u0vmKE;|=*yJvwcO;1dxX-DK}v>p zXP(K@wu*FkMrECZ*Ve2E0bPyVJ$=!^dj^Kxw>M(8Yu1@Gf%f!;iQ+4_)pG1s_u{S& zazaASKm;KXC$qn8L{!U`#Cz7*4rKX4L(aB`8s0a*Mc}(4YG>n)`guaw9>)r})O^32 z?Y_OFbAkW71@WDm+7U7ImUCa<;de;SyGP5)6b?u$GbNKk3+UOFAfy z>PR{5Lvrh6#j8@A`7MkxyKdF&XJR6+2pJ^|&p%zkLX~eCIF}W9lW*4+N-j%u20{f7 z9Ee7h{mKe&JesyldUC=u;HoPB+5Zl2*I;#5CFxnWg)6S=gJ}yd*rs$L@J@buILx1= zR~^i@+!v8*Xq|3NFr?aAp;wb5uC1w`??h0E1zSBlADlSU3H#gztWYbee$B%n3FIWi zJl3yEODuOgsBeqW1D~^jrglutV;j;e8aN|C!J>y7v%;I}9B+kgz_T$vyWB{|&&2#! zfc~dB_CwA7EAZIIfdZfEv`PqWIUr*`gnLjAKM_3Ut2}JAb(XGoUm#HVfaU3EKzV&O2uZ zk4T?=vTt>5Rt=uSa;o|&`gD~F?Ij-MK81&!KSVbTrIN6^HiD9 zqp}Y9r^wk0^Sx%eZ&hNeaGzQo!iAptlLG4>pzR^%^GdzDu*xR~#;0W!penhBk_A3b zVRpe1;mC@vOq0S;VXtITN)=~E%!^*|{Y+EV`R6LrZiCvs*ZX-T_>bkSrk|KLWa#q0&pWpL! z#0;bao)|7ZU9+oOlP0SJ_OCchq5Ys7n%U;fgchn>ET(R$4!$vyG0BS=E^>*f)A?Cd z%ZvM=KCV$-!pQ?vS~mxIq$2aqN{)CYCQV2`o~?pC)f~vcE_37BNNoOkarw>u!K|ZM zH#cPkC$C-sq>PWm4^T$k`z}RQ7Q@u~EH!r5M$TIP^}HWVe6m?;eR}h<*94H22W;*y zU~N7F5{IJAt``wY~mQn_NS`-t-o(+6@L zW@lahft(oCb>p`$5ewI|nNqiu?+MTPQB?y>#~*gj_?@Sm!}qKkj9!z8+VImc=8zm? zOE3WJ#eKKugufXGe-;_k75%ap|2gPWU&2!lTP=3-ht42uiMA0D5CJ)7NT zPZ63el&-Nw;{!vBu=cg7&L$_y(m+3`kI)J$6`O@$jpFh2+=g#Vf#tFs;5pSmc`rPs zgC8+9=zWv;<(?T6Yndhu(>X9?#EGGs$2C(Htcu;sgbc{k%$xAB5Mo|VY@D3@NhaM> zFfEGlbJr9{!Qi^D=Oe~wo;(ldku;=|U&G=*2sJqcnUKC~H}4ut>R>P3SA2y>c`ckk z)bgsscx18rd=zFkq3AuLr0cM5$WpOKLSJ0nBbNrmpVLsF2ve9gze}U za`X;L^DQNW%x2lwI#{9@vJSeozD$FOte0R_W*@DB@If&U7lu#y^Vim4GCcIY z9(<_`B-bu9(DplBhGss}x%lU9#TZ`7+o#Ywh9<23>kS`=T+BZdQgn-7Fq2VWO>?z9 zd)O07VVHJS)Kl8C0>(slr+B@LCPqK<$<&GyYOkK9n#zkfIT)$&e1~B{QsQLY;t%k? zS~#YAPAY6S0jCY;wsOJLiQZJbAo@PYcUH3yai5H4&G1J3$n$qX*EYN-r@yz@o{6NG z#{JpmZq;xpXpNe%wvx)(iIIn*gNVGcB~d~t+QeUR{om*Gz~i~EW%si&*V8cmXhLMb z4tYjfu%p}~&w93#Pg-kpO2;J-J>>J!2gS8zK}4X~Rm)}XWyGh0?}M9N?7f(tpCAc; z?yP=*A?&NHLv7>_opdsoa6DV4=c7FoCX1Q9j2wigXRF7x8*D90XWBCih4n`oNN_$$ z6Ny-bi%U3=*8{tNtcX+hF#dXOa$T;p3LA(%+}(9f6JBajK3#gC;(Y~PDe-WrGJ?Pr zbk|gVS*HSJw;cvB_gA{&4B*WYiTAcIK!nLaU8VoMm=q7f(!=*NWEriTamR(=Az|Ekzmg+K6BfTXtgTPB8?v4i$=Cg8G^1Gw2soOrHzmjli>+U^TQw9gz*Lue zk~F18g|)TW!BouqJ5RXX=>3YZFOG+6Mj%8A3-)KQ0DagEOwPrtoIUHCy61cN5&gae z$kYYuI*FY^8;&$O*$%0mXDcHmwoG+5KoKsqNizLw8Ei$7Y7&sCRT*+wY7 zgr>&J6pB@tf=mrR=I2Z#CY;W<>>4|_#49IWGJsdAsb<+)cR|;*#zG~o;L+ju5ZS^F zL~;h*S(QAhGUym3o)zq8S&Y9%$Ak9y?TyI%jk zmtea0`?&<-4I9A)uo%c9NcA*>v9ra&3SQsMQ`?V^yYr8_{m=e7j>^`(<$jZ1CN*(d zZPjP^wg3O(BV_o!b)8d_(1>V$gf6+%5%W4tfm9NOs!=-Bg9Kl zr&|hil5rrL;3t3u6>F*JRFj{#gyB+tiI#Z0`?U1=lBrUWj6M~N5Lglo-aigv^V37; zd?|9(p-2!Ieq}^R{4^xbl3g4=*4?`COQ`HxB&7*S%RE9xbVG&)^avnZ!Z5EnZxxHv?ADA78-W_dr5+ z85zpZQJVuGxoGAj?UGi#j|tp zK1k+?3n#&!jbmqXxTBwPr5=4a=^0WK-t8lM@?DDA@4Qo9=-0B;rkf3tP4YwCnFwi1 zEyX}Kl z322}?wL#r7>$rZu_Tn5VyS)G;gnrUViK_WJ_#$u_pzTr9fdNe1A@rS)=Ox%b+u^@Q`^Q8fLRWQJjkM+? z1}u%yiTr`jJV)Q}qHRa4h5vRuWIsYV3DZqp4zKH$R=DLK5I&M65I&I`bkbL>5GsBu zVnYky2lUcH?_T>c*pBI4hgx)*Z3~C5FXho?Xpgr|hr>d39PTgOFB=<{mZ0g~ zJ2?%HdFp59k9Ts5_p!#hUs8_^xH&c7%^)%Z-yxY^GAcK`8Jfepv-;HO zNYTcqGUYMwqpHI|BsR*CRhLFu+GLf=Sj%j{16qWKl08kg_H#AbxCfk3Wa#j0 zQ#bl=4X7JzYr`{7j3$~Ek47B1*~X&8UtcAZkno&!EX~Oeqf&~wT;8(_#=NiCwEFpd z)Ynd`fMX2B!-&6Hvh^0Q&f1U>xB+dyvqXWPY9l>>2|ZbbycgNMsqz@lQOYZs@57l@ zxmGTl@3V`UsZwdABjg1o>E$skc!JV(=l@wnF1g>P?5l9{X)}h;NPCjDGrGMa`A58( zi!}&_d6r9Fk(SATBG_Z}aQ^1o9M7dB3M+#8+jJAJw`80*d3$vjedFY&96dhl6vNavx- z|8xrCFM^iL3#Ra13br^oS))8cqW12Yiz@wAG!FP~B8Siz)1>fMmyh9U>;9vN9xEb<@=--E&3Sx5Xl-OIZ_BSn>YQ8BV#}w=f?PF(& z#Jd|Gv>M6$^BRQOf?asf)%z(aD!2@C{Wq}hKR(MDsyf8!a<8EY&7r;Q=MROF?J!}! zl+=4y4}kG&bvk&cM;1b({3DJD-E&uE>YEw4(IO}Aq;qvM#^wOg)p8`t5Bait}BL1`#${ZGnm5rT%QQ14LKNZ=ko7^K>wSg&mWE+xj>&`Se{JzOxe&I z(x~Gl!AD@fJa890KA{`f&;0+Na1G&ge!&bCR8in~bc^dM_wIQW1vj4@Ph>N_I|;r0 z7pTZxgFKbrob_>z<$9Q6&e3P114mLWOozXIC>}L<%{HCN(29L*etPyffPZEKqFCd!j)jyZLNA~64 zSv7dNA0yu$wW6o}n3)~C9ba)&H^IAb*npiw9XSYM3ld~+;~6evj$<3cFT2EW<&X!_ zOFi2vd&+(Gb!kb3p6&g;cTRQGc#IyKF&Vwy2 zKlAUUeyGOR+%+iY(EY=gnfpWE@r|zF66eUR;^^9(odccz$v%PmkIGT_mu5 zRb^L+Ca1nQPz})L^!#Hcl23*KpGi2?5iNE3W3ts}8SolN;ly&is_2eo;h(IZ@92Ea z!LDTc*#!{ZFzcw>J>XxE&y$J&Fg!G3F1`Qn6)hA5Umc^NFS4kV@*&cO4Vqs@!MyAq zjwT_N5jrGskKAFcOHKUM6Zx+X_0B=ABLMStDHj~IO-Qd35M@UXT(==tczdbk*Me{#`p0npa~5pRjjyHp*#)rh7*D@t8Z2P( z*vrzdyOGdNQt-rU6 z)N3%~#ysq;I6P(}Lim)aV9+R1DO<7f2#w_@rVPAeOK6dUr7jOU0RxVz1dDfs_0}wd z+@Hel5=ssrqy4j!{JW_@vGv%Px1OTtl2MB}=kG%Vr06+eev8$Eh&PQOd`wl5_U{LV zwiz)Yq|sHs?dw=1X8!oR7kv`tw+a#GGc{wy+1J5lcIndZ-x<0^b_$;$;4cE9J33CP z=CA+!?*{;%a6mqlNR9S$XtO9!YqteB46#bUxcTecYNLep_6l8+itZo7%dfu%unPRs zlE~+qDWbbB#V8J&3A>KE0WXrcMNzD&Bb|MzzK=aoD| zy~hywT7o?MJ0*zHMx4;m7bYFo&0VNO5d8iA4v3Q7nk5Aj1M15SM*}Us+vRT2KLidO z3+)}Vi{QXbAq8W(|MRyqhR$dl6t};=aue!L6aVAsgZ&5&^U_aKY6UvLrc_R{LW~*o zBg%!Jee=Sv02$Uvz;-eMUXYw1N%qbf@>H5Gi8@U`aC&2{D|)4w%Q0c(JEBZT*UmeA zz>wu}F7%#9iX75Gzh>x7l{ekt9Uv8d}1KP&xU9}6Nz&lAV%$w zcw38L`;x)%_fi=my1e|GsRpg-P&pJZ6zzCA1{jn8+X}c>La9oqlsCgGkw0M;-_X~< zz$->QUHoR9nq|TIfge5N{4{)S-n|28eq`AO=eqgC9OR85je^Qfh|oA?^22t zE@2B0rjO+s0b&k)1^poz$T~m@8!+0foAsp%FK>0P-A2PGq(|9$Fdm8Y(!ULjQYYki zHw_(2`~%-Yrmde&Z*dZbj8{M$2f^w9yulkb0G|wnCZ_3LeEw@`U}tNf$YB2W)~obb zNN`5VnY1!bh8j0UR_7-Pb?AXRsHy}?&hgZ=Si`9=yGK)!eRiR4LRd<(yShGl>EJ2%?TIH($!g^YBHJf->hIz=V{`XBl+Pmdusa%n;IDHW`b z3socf6R3TO2#bKXC5+>DKOuD2T|ukRfSTQHI}s$NzE_<iz^-z*F+K=j zC{93;T0$SntRjN_c*o@T^rK~RSB?N0AIJzC7AvU2+=-}C&nyYp;*OmbWS*b1YAI3U z%K9AZ)v|O0?KDd$wj@#KocBwB)*b zgJGpRL2ZkCwNMHza^E!zj=-3h{Fx;y({VkHxL~RLqXif_fmUJzv^169ntUdKjh{3} z83Pd?28%GheVGU!Dj!)WUjDTe{`{km4em4B|9EIZH*i9I%>gd<0f#|m{52G?qzs4e zQ$)0@uk<9z&IjsKSAM>BXACIyBsq@YpPT@89E&FJ8>N78Rq(QYM%SwQ0jKq<0x!g% zTYVoAoR{V)M*s1IgrN~M_jOEwO~0ns z8<2}$EF8l7XGZZuvn)54>Sl4+V-&f!@S&}(QaWN6@I9V z92fAQW_9epT}@!odv^vz<&ZLp%b?3th!Q2QD(o2ilJVc?TB_9TPPLV9qRGK z4B+@)HtcbM)!$iCC{W|2=YVci3B={L0-$kf0tfP*EzNGN=jL>+T_u3~Fj`D2p%3e( z2)N|wHo8_oh%hkPF!#Cp#uoxl9mO=BexU6?11`9vhlYhZ^&64OaxhPLB_KtSna%!# zPD_Yp`~i&q$;5J)1LQUBOgS08+xpn}JmTCdD4Vikn_(ZiTuq=yU~o=8THA zwPN)L{ry+N0}jaFwCmqr&l4#j5o*8QkJgSd3{N_Vmtx^&u-CIR+B0c?MsDuTEB|cmb85;Dh(a8p~*4r*2CG zqVXL`E^c8_Xtg|$5pw$S=ISOZ1CEHOM<&UGtesmX%;{O%w4M$vBvcbImY;#3Z-SoI zFJi9}cLH(|?xDJtpp0ip`NRyOe8)K3V~WO4D9 z$2+mEP9^F4Mvxyt8$`}*fuZ$U@(BJ@!?4)+eny~&vOlSNPnDlAP#4d01yQ3&YKg#D zYaFvddaJShXtAnq1GlvExPQc%iV?8U`0srJ+CxoIW10Uh8MROfcG|kJ7UE>61K)TG zMWD5brq8|xR#rcfCGhwWW;PCVbs)|rlYF~0?$Kk)A7d|4Tz=75M|B&YF~FA5pTx5n zNzLIjD)2Yf0b?1E!Ft>Jy$=w@X5aU zs~G*WiTuWB38faG0b+M;!AK|IIlE7gkrjv5S$5z;Ez;d}uYK?)5n4XaGnqzyUfWGoF#z`GL@Dn|0d z03)Ccawy1pGXY?UqN4YuN7myR^bMDCB$I}WDYRc~4QXEvN|3M1LtTZ+Gob(++N?I6 zh{wjv=-?twAE5!<6u^2>PQIL|Gf`==ozW!#;=vL;n=n|D&FoU4GU6QLek8+Fh?8~p z5h4T95J~0Aq*Us?2PFx=eY|?C`KE!@mfhYoGl$VM0OrNLNH%%J7l`HV4_E(%>s%qD z)sgFW*~(IT6eF@COCj_hHSzBy2=UyZ!iAO;SlH!5tT_!tIEd*ef7Zn4XcG3&CY0dn zjL3>;pIe%FAyQ+HV)@Rge8#M_+uGL?R1oChH*s?dYF-lDx9*wm@WGGClZba8l)d?PL4uwo?2i--vGNoXU@X&w#h{R272BS{JrA7 zxHE8mFp6_M82_ptaQ}9k9Tloh*kuV7^2?c^C(8(WE0%)3v|~tG66T(Wsl4>oPA~HXwxECg(u`>tYMyyG>Z8q8EEC+3Mqph z%sn&;{+Z;3`>c{(VUdNdr>}uQ3PLH)y@1MQV7{>}1-yo9-c$>%L7h3JK!Vo@XKBf= zYr7Xv)lS9)V#&HLM&K8DaOeVN^bqsnCwu4ncbxs@Zj7~KW~i>B2;m!;uah~k>5Q9s z=5a%Y# zK}I&U9aSsr4C>Ba^d`%0N#78)IGVs(uhn*d&}Gi3(K?Rb$9lljDq!q%+3>`mJN`i~ z_w=yVq%%SR3iDcx4BlUEH~d%z+MTsfTmaU~PvkSY>vGVa>4e#$$qqgJ2+0OrTAS&H zoeOYWRzN(C2mLIZs4wFohMraC<3@s=c$LA?$K5i?e*al*|E#fo+n>!@HXy*%tCJ5)?juwHihx5bp9nU;u6rI0thB?^hd8k9Jdl@AHU0YSaH z&j4gAXp+Mh91k*IDTnzL6@VKre(Oy;~`Xz8`^dboPM062`*MEchNU@pU-NA zm-zsOJJiR>dC3c&an#E9(wRN>=Buvl7DR5abH$z53yA8^7O5h*pbgsy{=zKJpN+l& zq~YM#RpfUwzNP_+00}gHOoGWyT$2}(i1?Pqp zN`6SfdEF63kZmDM&R&m_&h;jA_(~^*b1c(g_7Nx&Rpi(m z;vt6Hn>{M$(77pQb#S1b^} zW7V(K!qa><4TW|=)ZV+@|1QIy=j#T#W1MSjXd#B7#&GvH8<*obSb~7v3@mO9VAO`s zEIg3pK*KhEg%bF$I{eRL{(YaxA3@FiAquE;LppnwtG@(8He|o_9k1K;rx9yFp-5Vg zy#Q>@;`Rud7hm@&;N!;*AaJu=`ep!}6dz)AI&vbIMbp!9fd~CVC33>t^=#n zi^>R@%meP~O=-Wcn>H?@LrN!|YIXo27JSPMKyAXTCva=<+bUbZI%n2oT$nXWZ*Bt~ z3J)4blg7Lv2xPTICAE>cx^_a6eQ+knioj?o(DWXC#2gF;4MM^wUKe)R&+t`#wzia) zKmKn9YL3RYkQ|L00q#)owvI|fMD)@H*45|*lMqX>XahC)V6?`|oYW4mQt#ef&_Va} z2Cckg-c|*)RipH7nJ1IR^qqjvMX+I|=_ph95iT5doPJ8DocUu|e{ipa&LSNCynWCm zOD^fn8U%ObcKBdu24avORIt{d3A8Q1;9VDqgTP&skvP4OgaNEo#6xrk_n1ICq)PTM zqS6l58+qg<=XD}U&-~(o2kYCz6t{B+f^Kf9De90UN2yOmdQExqDFWO!Q-NTbHYp2- z)IS9W6dM+i)qWk6&SfU9TN4Z24b_zIH>qTX5e=x{G+&iRMXlFf;5Yv8Y7aPsoIL3M zrdT6G_2CVp`7#$}Tv5f-5O@&^kbG|!f!D39>o|P^){B8;uvgB(#3pie0JXdVig`98 zk0;jXBtXDbi>yL$vuyC*p&9_vD>qIQPJv+^IHW4a1{xfG#&jgvso6DBM~P4ofx8}L)cfVzdVku>ag&Yce=g&X!f~vt7slFcOk^9`gXUxjzpF_rdxoGs~q0;H|lGvCz z_6tE23(_jL+Kpu-glL3)#b$!q#~LY%AE`fmhY2hCQWnfLZ5?s*st5B9-QsbH>1YAB z%lT1dV|ftgM4O=y*<~-jxlUwu^91~<7EpiOi`GC+qZIUrl-SQ({5H4i_T`X3-LN_V zBwj!Rr~O!iX$(Mk_CL!6V3sKZ4&^ow71MJ9=JhW8z{Pb1{cxzVfDmX9SQ4zZOR`_s zKSUKCN*fP=j@?+-L8tmQ&`~OYFOq+|PK&j1p6#*1#e``vxJW>iF`q{CE@+!RM&ov{ zW+lqu8%iYRpF`ynq{ZD{JhwKUtk{(IYaOd|*w0g67;asoI;&1Md63BORB^NWCUo#@ zzOuRh{e%aid9U}37WX7znwN`5hqXewD1dZ!jb=PG;<+%t4$7V9!K`oW3#mPBR~C>m zTQe_@_Qu>U1+rMPYX4c}Os-=`^cIC7$2|{{#y20f?fmO?cUG1%joxOY_O^-Ma5md^|9kZkSk< z`f3(sRaXRZ1dg%6-4cO%{`u1UXcS zP^_OmLgG-~?Ia>y_U7KTE!~s}Cl>&i<93l!D0E3Xs^#{Q1D!b4r;&-ojpl6B&%g*J zT{J3_H>8eD6In2nXiZ|MlFFYy;tV0*0$I;bMjNjsH-Hyi8L&pVogQy$OS2xCX{q+R zoe$pbco1B0*$xgr!mrUChwA*pDO<4TmLxEm^4%KrNjhKGy+99)1v|yW{u&(`+?yfk z)_lSHjGE)ULx;R9l+|Q~YqjRnklFbf+Bc^sMm4I3gzu~FSa+}TuPjFabu<=v)o!Dz zYRhY3FDeUB8;E`|6Dr&fx?p?)i%ub`h<1yNj9#6?Z{B^EzIIzJu)PjttxCwM+Owe) zN*zICR58VU-teTpPTpFOP!Svg^lMm zlArEf_8FnViiaCYj?Gu>KB6~&npTBs3Hd_+kG=RyQIWhuUi$LY#@!N;W~MnKy2Q*KV(`r4FVX&}{nGxDYQ&w|)}0PTnVvcASwzl}RYME)id zA~pl;fk%e$eB{i;f@(I+m3A`4nXQG6C?H9jK}=Yff=gIY$NtrBVWj{08S<;@zE|nT zA+5q5@w=9uHGZi4bZz)ng@D%Xt|*kDZy@4S1p1H)*4t;e41Oi=tM`>%X8}GeS%stV zAWIF9h@JN&Be?b_9dHlb`TP_2$6e-C8uK}#?SIUmd{ zxoYJ5LtYJ?|Go5G=Cta%PZrR~2~g(aF|Qe>Ds~k$#A-Z_sp)MWRbBY81bOL7JHkgE zFg2-Hvb#Kn{J`d_*fIS@joXLYE&e#qbAx+%2|hU-Pj9=%$X4qdQsqHsdWn&_AyiXd z=^Vx935X@LTsk_3)pzg8}C!8iH>p2HfL}_n>(pbz%0nY0J2xOt&KnI+THUQcj{Xujly*EYEAH)344d@u@L7lN0 z5Jzh&0aXxi$mSJ4o=YEGa%3cE^(QJEX?vA z;Uns@bLe)AdDJIsA}GZ9;>p`o)PwO++t(ZhBd1lGv9bus`^K2Z6G|1}Qtq4ZuSlmt zk?D3^m+;kn&{CEI_aS#NhMy#Krbq0~frE`$a~taPF>kWR$z<@QC~ztjw|O23-g#A~ zm{D=Wi%TuzyO<9unaujw#_cL-QVGE|M;MsT8p5(I#E5K9fXCajf6g9c(XM{od4%kQ zeDRc1QQ6w9c@R2m(NBIUS@~f_>o5tO%nENu-v~1lw?54)$*>8T+b88P4sCC$sWL6( z0dC`G@=P8uLQLb3f;WU`i|jX})Mt}2_zG%G1euN;XMY?6ck%m_C(&ie)N^(R9SntI zpsIZZ@mMq3xJde5WP8qoPD^wU94(E%&s`zab_Yoma>-8gh*?&~G00+E|Ej?bK)1b^|-&(r__)M;*EXnrXH z&zmpsc?c0j0wk693 z&XA*>K!Xsp(-7w4xCw*zbguTle+5n|yEnc+brx{bp#&fEt|nDLUWR`i`-?Uq8#7SMs+LcSi7We9y3Oik~psOBo>Jyk*jX~eu-HoxZCYn4roN`0} zek*E0jl~1soSX~<*a<9 zliXS(Bzpr6HC;TQJUC2@&In``U1cj9J@5&$6iVYS>L|Bs1f!uhn7+faA{h4#fs*+# zeVhfj&dsJm0MmO=IqcNAIIP$^MK`z%AngR18&6BVyL{v$yt5j6i^Or2e6ZT869cxj zlqQf@h%hEVgg|>RWi9~xe^zdo2T}}P`2|y}dX*M}w`Gdi*cGh8UJ@61Vo+7u0u?{U zG2)#)gkTu2IOjhC-h!z60RbBz0mY42`bg6RCx&4Irz^O6Z#R$i_w{6-C*CTdxNVanw!)0y)9~Z;rkzZ~WD(o>(MO(d;k7J`sfaoqp3$BYGA5r!b z8}UsFs9|Rxg?Vm;p!!{9Zb4%MfZp%eG}pqa&OhcBpnGz_S0v1+nRDS@?YxUn-sMxR zaW#KlG{+5=D8NRX3#Vs?R8D6mY>J zG|kI8f+%}C8$z}8`@oEeZYTLZPBq_vv>|<19WQSA{?%Pa^bk#&z)pj@qub}M3QLYJ zLz2BI-Rs3VJ1{(so)x@!vnf5_FxYg$BPGK~A>`-y;42tYD2#KH%jMv;}3 zdc9un-}m$1QRm#_y03L#_jNrk_ON?n;M<9P(Z}8MrsFv|Vd6Fp0BC{_c``a4_>q!J z%UzK>(r?rE$V}(q*3nEmu0GB)uVTK^2hgxMj+$h%T2D;WzQCcFK2>J2TQMV-@2}Zu zr$*Wyx5fK$F3zSO|6x@sbgCkf;#7GI(Nf{#b7;LPLc;;RJ);kx1>q zW%s(5wx|O&j_?9@9c;5{fA2|7sxJ}%c#XOUkK!HdKL`))SWUX1@n*fa;|aDbVXw!6 z*gBz=M#m7+v?HQ0slh4TkD=pq>sf_3mRaVJW*o#kHwR9(2IkMxIu#Cr?Rl%x_wKSl zx9NMPCPifgfViOPCXWcx*XV&1mx_|7aE7`}@`6pW8pYue*hUvVd|s?ZlAc7F(lEK+;CP z50g95e;M9V?KFCQ7wqj_n~QJF4L?_&SmfVKGcw%iKC73jL)~(Ao6sX=>K0%A_W{DY z&PkI-8%Qt7*@`M$H=i?`x9oTs%LT zT7|j0eYCUl1s{u*j@lc$h9B&kA11}Pd|FJBrMLG?s$cQ8J zdQVF~_h@3EzyD*K(SC>D74j1@LoGWRXvgo_GOvu^lO0f>$%KA^Cl(eZ# zIXng-FxMAI3PTRSP@7D8LgBRB5I-nZ|lMaX;?ZX##2d9vaK z?Moha*}@U}aB6ozV)HS*h3@%w+_(qH+;H<>3BKQw!C!6zP2RHL^!%71JMo(XfkLezd3w06L+N>MvbCp4zteu@t~tm4Ei+?0S!yKpjl-8SlV`@OBBhc@ znJocSfzoJlN9&l9n3U{J_s}_Q*OV)xiy>4@P);lUTD0@2L>+mZf*4)F5x?(%1K_1d>&mq0 zAw}H>KK|b75gD^-$BeaRG9do;EpOj%(gmZwmJ3(n?-*@6{KjSC4gbsHneI=MvKOHt z7t`hbZOi%NV}~Y0u2c9H8|*jjxRhIRCa0+D-sSISVqJw~np*+zTdNS>0Bc0weC|Jc z-r$sH&8M^VbmBj#ZcU5-jJ?>zgNX}6TG&3zs?c3ykz{j}G9fp6JsysPC{_zVp`ln1 ztDgRRJCg!N7HQ9L=zdjI?C@`h1sh}o{^!yC4OO5{Qa~!6T0G2s2hPfoi)u9FUOim( z44lbn;^jLHp2xx&53AFaGdTCqiG0MR74Z#yMAMGuQ7(R~^XTK|Q)JxrT$5E0x>{ZH zKRr7}X}$RS72O5u2im&iJ+)##se)Or%3bea{oW10>z5~X`Hailyo+GX!E>b_q%84s z-dut^j53a#;TAsz@bw4i4!=I-FwEeC!@Y%;PV8Uab*1K^RsgR^P(xJt8h~|OYJ>_; z$>9A`k)IhKe3h|^X{9@|D}0e>N3)BOhK9VSN=lLl_=GF;HG2*oB%9 z@Q`vK*m-iI{dQdo-ywRngLNhz6Q}nzKlpxoCU3b!jJIW40$MT&Jdz$F-+JkdyG8g! zwsu&AF6feR-k-{%YQMn~`{3Z20Ko3>b{o;q3wYWQ!AVr!%X<716XX2GMxh4=2K6NF zvc>++qGEdEBJrN-#+=#~^_1tdo|DldX-oXrnO(p9{Ht&${bs z7^YKI1l%GKP~%9D;6}>*CXAE8zX@5x>z~Q-;SgQ*pVQ)Xpay zC`G#5?2#uV-dM4BFAS918QK{d5_N{=-jkGk<%>!>E)SXXBB51=a_m`|%BKwCVtUS< zas2rP&ScNjNLc=pr@#dUzB);g;dyyQDoCmg_hF>Vr?b3&D$mP^+q1}3-P>4~d194k zU!TUH&WvnppWg@0Us$#*<*;H8(|gCMQrD)8iAdVU@D&HH5w?yJXznF1YCiGnaNsaJ z+a2vvKa$4i^N~xJS;#~of_d+>No+!~*U;9`T}73_#eOr5rgB<6;|L10-|@@YNlPaa z>J=5pMmcX?dB|p{K2W4-p}OqsD~zc>a%4G9?iRfY6@pJ}bm1)JkBADU!*felnM;zt z9UTJjhLZ{2opb>_zvI$Y{bo|zl?qSxTLztt*`4=j=L<((2Y`Q6aN%2?-%(JJypjlV z>HD0C@v+h1B_4S6*>O91KBn_$%*1DSxXyH`{f&Ujg3~PYQ1)swZ!ooNb+uV0P4fYO zdajalAGSYv3MY7@ri4CgH1idIUQ5H#H?K4h2z&j6f>GxVKX|KZHKFe5yJIWe#MafX zd_Ir^oe~Z85*D)Z)vE|%AYqN9B)iC0BLIZZrRL4G4)X^;A9Y7AF;`F|k1=s}Xr%I* zb}x=Y3LF&=Elxg~u%fmP5MF{Ts90{q^ zd1EYk))g*BQlD#l-hr>L*HCiy*qnl#G5g^RLCLwvZCkk-!#>AIrTRXI8RdMC^+kw2 zh`RVWOOpE;8v$%YcvwUO`0q@@uaNfAw|F+q-$8==oT>0e)Mvo(fI>xK5#EPu1Uo}B zi`2D|9IgP{WY@rW9^v_u$!BZkAL|?x$~^aj=RAywxw<#&YhMURb>Ex?9IMm;2{6 z=ABd7!YevjC3`+OmU0}nD*aYhGVstYJtNQY-cn@{hu`p5&8Oqwg(=l!$;EQ8U1ajq zg@!+g#yM|p-cP@@l4UDLvy}`wkAq%u`V=9su2;M;732aNg54Sz!x!HpTR+`uejVU0 zaS@70l*@h2BLyE=A-cH2M(Q9|b9i{GyHE#rZWZ>VsGID<&}Crn^ZCNArNa-e)6x1= zR;BQ7KNBs#L%OlY+<@iyQEl=!0NcZG-zy|cJ>GL=8SC@`np#%%l%H{IY~EHveFa){ zIr^qbjK*&DZg8_L+?5G@F%+~-=zb;lZjKUl`I`YCO?_m+yHmG#?v~d#n$9M1&Y%)v zC{l>BFDGT-Rj85GELeeLx$DaqO8s6^JGmov_4yq@aLe9M?SP(p2^xa6kK96zAQUZCprrs}Q(xBQ)_F?3u>0|M*#O$_nQyu}s>aH%L24j1= z1m=;a%tsfW3m#6Fse1qG7rfuTY}UDYx#|adZ$a0A8ISk~$9t1*{n1WuuGr`r`yah& z{G7j}JR|0-ErJ0UlPG9f%{b|w^mch#e2-Z-OPKv_j5s-@ph+ebW_0<;RIn!tpmDGj`#JNNvr{jYAn@TzkGAnnEDvjJ*AcV{9(2UOq(Yqkm@auc}2af;=W?Q_|7CRgjuSf+Ota&TQHXfZs#*&Jc`Q4uW07 znGhyAlc{$jL;(V<5uDZ97hd1tFRfm}UhMqY;cOvY(yu1%UiL!ReZgUJa?0cugbzDZ zrKdH6%Wr=DxXBn0X}I45A@l?0lMCt>5-o6zNPZyIp~jXoS%X> zbw!&o!mVjmMPIr1TVv^{LopKPxO6UH^`7>ayPL9isY1cQ9a2GB!SA^Q2J?F6)}Y+W zrJaB_&hXKPj&#Q!k!qxYbnxdMB)bV-NPGt+&$&{NJ6xt`7)%iS4fnUL#-bG<=(_UcTE1j?b?9gkJYuy( ztJ;)sE;f0%Kw9>7KwL6rXBK9vE7lWxnVvv87#f&N1hcx)UDphe;(AwQeR_BjMUL)2W_W$J#y((TeZ zZRZjkbLgSDSrHFeJ-SiEi(1eQBDocCsopHePwI^W^aEK6kH2}*;BJYF(5(Qgl0BY~ zW!uhaOQsoB22he&#?_A`s$`<6muf3_iLhyCl^1(tK1kwpR-N#yH-FO(rjeKnHTRJa zRX!onPpEu-wZ-%!J>DIU^C53+Y=rE^U||F2BqUC5H=*<~2r~eWZ2m_SC(;b0zR@C6!neHv(DV_%`oTnoQD1PhIwaHnMwAoAWq- zr(4ta=d|dn8GPBi77I9g6ZiaVl1{snrnV!#jnNOorr;}WU7i*OoKLZ0XR=#w%c)Vr zT{39|aQ?BM4ZfVc{$>Gy3{)9wT+&F)8WK= z8CkP36jMgg#A(*W+0>7f4oFZ}T1DM-hFc0Y<&#k8TSo4ES^zR5x>QxNtRm&T96Fopw zDZTcj1Gl@%(qrDkNE=uME@zQIlOt?wa#(=BJxk6u zCEZErYsQ!Km}*nIGI@%w;H`^V{FAN0sq z9Q+ljAkTp3aZ$lSjBHb_r_iylJZl|*_-HCko@_B$NSA^KvRh-NM$K$vk-c=or1 ze~*=_#LeIN(wYSf?U5+0q+5E))!BIV&hn*4fQOg)JUhm%$Jgz(>IjLO?TaCtTueQ3 z?6PepM{J-PE0T%^0W76$8QxElHA62X(zw|38waU_WHXsUJ@%3lv-}8*-o+@!jK(N8 zj<@f~kL((d`p7EM(;jiTl~NxfWj>~F0R#1cfB2yZKr^cF8J&de%yj#B`$rCXgHh&s zwo3yNElc+=YANpc>0+I4Y+g6wYUxzv>%Y>qvSgsz)CGAZ;?A@!g|kdZq+OM{xO7@` z|IYhkAje5pI>+JCeO$)CB;-M^oN>Hl;Cqwt5WeU@jZq|F0RjS#>#Xy7fyC=Aq zr#tsZI9$25M=yBysrU7lNLM^0s_Q%x=uy3F0@gZ>tVw%|!&Gee$7YsqhYfaot7Biw ziCN_w)?)Pe)xLH}K#~?^P&$3NR=M^1SP-F+AXbOHzP?^vso`=up902cvv(+`YS1RV zCwCzmAe~ou4x+p?gQwVkL$&0oiHEeb=9R{SP$9PShJN^*zR`}F&z6&rqT33<*2?U5 z&a9z%+^X+->Q2P)t$-VxuXoO|o#7{^iWWPgGtO_)YG2NS4^@C&`thCS7KX5KHTRFV z29dVE6D|nE`9;C%gWpPPBPBb)UKV_0W$CZcB&Dra;^ld;1o=`dH{wFoRe2pOQv&ul zSh~+&9xbVVA&)PCx1^bSnUh#`?a)aKOC;Ax7GYCA#l-`+#61O^wZdMuLNNatt#+!v z!6|d{m%U56kQcFide$O^Zi{;^q~$)_HTsRSeS6ge^J}xuZtW66j5cGooGC4PvvZxH zQWW)a3~6Ze?8ZG7S&t&~ZKGm72nK2*0EZa^pCwBJpB+5QEQ&Osw)%o(JSpfLn@~6z za~#6p+>bqDE~&hy1l{?{+e&Iq!*H)(eqlk4Z~!YBIeej4GJ8gp~h`$+naf@TxO_#0<$#!$!MQo;9VHc?MN zp5&N|0Kr)(SFOpm;V2Wo-4|#-b?_B;lf@&)kDxf^H$oNX^0jXE@de(S?>od+3GZemKSDENJ{`Mt7fHkd zxL`{Q9vc7K(?$gl>;4LeHP+y$#h71veSk|d#q-4(eN#t0MK3$hhL9%y z62KVau9O$tE||EUQQV63WTze4u~$q$pj8rJ?p|1Tm6VsL+_jybxi%{Gb`F8j>HOLI zNY^zF5197d6_9LuY4lz90BEc->u1~ZTGeN8sxQ6+s`jBomut);Y;M>k1gmMnC8OB; z_D>_0HZkrj4f`)K1~_TyOPI+sK`+aZWSr`AIJuG6Mv3$$=K4l2CikZE?N2VN0%K_G zaue&v**l_pa*sr5Ytm3b{p&)&v;PWj0erRNBIc(HWb1c3xFfAhXF&G0%raWJON$@+ z`1Re3mZ&@`9i;5mt1$h0-&Ai-=$TiMqhFr+P7k-#)lmE>a0;UF>s*6GBGmY(;o>Dy@t zVxU8DkFb^2(lNQKp>kEwVtXH>^v7iRyYG;0BRS9g{0?5Oe8`-zor5>u5$dn4^_KmJ zFcp!6>wizz!l=*&87jVcYBPb5+7fP-+k#ajJ{{@>Yjc%$A><489WQN&qPnIm#CyR@_q?%V4wX-q;Kqe$zM z0ET_1^farL4D<(jiG&&)O59Ctr{79>n{%Q=g0}Mevh5@|`H&auR_@;Jv)j0Ah-6ne+)k#WoW__Z74r`nwR7G^{xJJ$DSY(rU9^1G<)uHbI{_sJAOB8<{5+2-jL zwP*VCLl!z;oj(03ZW2=LbImjGi0!wVgiN9Hrom4x$6uPwXKA7m6m7;5uO2we!N_zb z&wd%OG=Fku*)o+6EM@R$nFv==f0hm(ZSxs9J+{MhEWIvB15)qu4eFy#U&tLraNrI! zI40-xZZC+n$2HQO{N$)txI_!}-HxJ6=vhanPZx-y4FszdQNHHk{BgV0_mVh|1>aM4 zJ`^&pKL}mpOY`10`cOwe9-*Si;ku9s?t^mSxBKB^jQ?NIFf4Y5>YbkoV*mn#&_ARU2;eC~(2 zw_(*+_k)EG*`6F9n6PmFe1hQ-x`;MRiAw6y8+35e68NZXP%LQO5d1{b4Elg1E?GVE z()<~9@O5+ZfD@Dw3OY0G_z=c+2fcKupgF*$tBO_I$nnLA7Sr}%wiI){X_r#ymb0e~ z3?STp)#C4)1R>!TO^;3J*-*1;vJF>ZgfiGg^!_`mhMhp630lmi2!~{)P3ge_yL> zgHCiD2=>wxUyAJsSmwE(!)l%o23a{Em*#+a^d++XNdY-hpN|mf1ov|ursF~in7Cu; zsUD%+tI~XLRa)eW;^X64!Y<5SO}kv~-VrOc>94sU=V-`llhSR>5cy)n!p>KizZOYK zu1*4pS8z;03f)lN8yLcuRV{>+-8V{NU*vX5-0X%fowDr)bbSpwNs{1%(P_&x9z{i2@Js z+pAZq12h%n*!j9%91z>dSAqtR(SV{mTTB@L+Ap$IBmq_{#OvL(Fn2XWM;+Xy-`qH{ z_1SuzvJv@_BS+r#1+RvnlPOWWNPBinG~FC1_7PBMl^W-vl8-OA-2cQbvIhm+nUE^p zMsX;O`qDU*NuT_}$qHyWkd2*yz$QFM-v=0~3XhNLkd3FAMk}IcpJ0;3NVXtEM-)F1 z(*U`?V}S()c_WibhI5C3<7x zV#t5NtHy)gs<(5HI!N;oYP3&N4?tgygtj`_mG&4UG|u9kOE(v%n&LRDo z4iW%Nkfx$vrXh-I;=-=T8H`4290ynyA60Ip=l=m;HbrN6=O0>S9VzPIiEila;qA}? zFzOdgA6;g52C7@5p*lId@?r0#MbHBGdmeZ}uG6)m-|utYP#ij500FCe2tO(8fzYwJ zxMHR90%}-R(_f4S}XuxR7pev z%MmjJvJj#wAq*R8(dNQ^>fUvd#4V5u$detpSB8`gLN_6W1m7mDi+l(ehzrL!I5Rx2 zdLX{YkNg8*DnW~vgkf+S+7K!zu#l5w?^>_JjgPX2oDtQ>Q;=hn5WQ*m-yi2RUcQ0O z6VHs8c~JzN0USuL)cwKekjCocjX*3$uPCv`W*QRH{GvqPRnY9^911Ecg*=MN6n7ej zgdj9vx^zQ5V8GPO`#sjjK~(B>(45&wM4|bmT0g6Tn?ZU$YaTy?;sR2NQ~v|axUm@+ z{uCgVaHW-^UnSB~m|M9{Bu3aV%w6Jp2ZH3XDpS)6tQ`-hl%-=dnhBWJ2iVIre4uLc zH)M93?sFT*N&~{lb$CH9R<7){9at7)M60g7DO)DT9c+Meo z^ULd5NP=vIT)Nb&H>(q^$Q7=P9rk$C8Qo!$^<(GGcF(2e@S4Ya{RvUEyJQ0A{&AcD z*5%`coMAOnEcP{XkJH^Hz~Soiul%(WR5Z4M zCCz3H-;7T2#T1^C2(dhNnXbLc_+b%ezHq}139HAexNdRJ$a(^Tt?H!nhq<<{AMzSo z3dDLXk6riRb`vVk&LDa9K zem$)U$UZ2^8`-U&8XV3kop}C@tFwv*%c}iRXGZHZ*{eCS8tz)>@IR_i^Wi4jZ#JfjuD)ydyJD7apVoVz*Y8% zcwflj#-$)`P*3%aGltt~g(zs^kkA#h{AH(}UAm~TRTH2kQyy-@4Wvl%!5K`S=>D*v zb2!zK6vZc%u+s4<_=(OOI{SwW+2}hP557cA6uSAR&lxWAyqb~HPA zQ>pkNs7x<88+#ZFk620??bVNkMgIkJomG7gI)V#N22CcCqHo&Y$S+BNkMt2eo_$eB zXg4woyjb`>K%q)b)zb5NbHTrC$BJ#<-8s9R^~stZNqAgVWS(USh43TMS9!LcdRFzi z`xW^pSLWE)ex4nQKH6P@61{Iu%C3EXeevL>@spS$9J9Keppz(ggSOcnUh$Z4Odru# z&TmIC=7-*52iUa&@^{WZUyL#dORh?)Bkj2V*RM+2{mx&~J{`!`_M`wKoGN?_s?Yu? z*>zq2w@G?YWuHd=4l^0<@fl66#U?#XTl_w{*qZsn$Y5zM2#$gOS4S`Tm zdNxZ~ZT6k}OZNipi^i$O1=Rb6v0@~wcT+FlRdynrk`wx?8UO*-T@bj5+skPJ2l9+I zPKF@uYjT67*7Y|R4ilmRtLlqrmOro$jpSG{{#n>eaBv;LcEw#o|9CgU_&RhOKl8b; zO~s;EubFz=vEO-hH@O|u=vJA$gQkAvM80nTF2=FSJ1H0mvRfALJ(9nIpw7Yt2_{SC zN2L)o(JG~p^;(3Mfl}yKcJIvohJ3G#Y72or2T+Q#hU~ji=xrAW=FNqTRnDq7E!6QC z0F_u2@_3W}l$vUuNr{kNRgn`A1yY;&5^ARJ&k>?xW8m*=tcoA2n}&5`UKybysitMms@vYYq(fHyX)>-C>K5)yDrEcV3getVAa3O z4y*BbgN(jbW*wA1Tpl;}ELV3pVc+V}0Ma1NeB@a}o@%pZ1O#os-V&l#({f(t{@Y

Q01Sr&f=obA1?$|p%6#g)*o1w;({FiLBz&JK;1R8?NA}u z(zgi!o{=w8(B5xT8(vAG5J@;@0ik`hk>{5$5w-+*ScaF^clSri@S4y|jdk#pit~UU zj;7ICZS}nzpcki#le;styPi>a$e4p~QjC7sIoT>dnUFjcGplovX%dkEb$|5YlEW7# zi=(y0o&DLzXJ?=~GMqIenDi#j?n}Zd)-Z(r9&EY_ei|{I)g93Q#AykLsXo=i!?`7X zc;BCkCeCgr_5PlCx^nfMQJjf{gE=Qx#<2BVMM4B5KGz>aPmIJvZ2H?ldn0u+O>vS$ zhbh%T^&Y))!#a=@aI4?1<01#OJPy#+q zlINjZy~kvu$43`Y`T(s&Po3Pw)q}G=dz0<>?6j+8rXBtl5o)Z8*D}V`@65lx0W=u$ z#+1x@M8##se9hD%)08DKg=ke)G&F?c-%gg@P1_qU+!YwLa3-5H>8<+e*`~0^jmh1~Q|!ep`=zR} z086rHtsN*l|*)N3Ew0;U5y58%&W%D-ns}j*ADi1LBQygY8 z<<$BT4erYq5YL%}>>XW@fC5{(W>>WBJYuk?ch7#*Z{^V_9Rw$6`e_X$7^%n^xf*yGl-|D}PCTy>dC)(!C+I#p@*dpFtWQM_ zBDQyqtlm=S)i7^Z@8s=TsMWlGhy$*3pz`NsD5sd7s2dzV&j+JoU(v>8?dFaf!;pHC zLpIw?mO_gl7M4&k4(%Wxzkz;`kI{3VIEX0$dJW?x{!c|^aStOef2$Yw`K;{2gN?O5 zIu?n3gkYLEN8Fg?ojgZH-BfDrlW<7tp6Kj*wX=`n>S*sQaJ_XpzMg$WIq=G_NJJ%hFQ3H`&AeMCV>v;0xhv zDuD+De*xT=N|(JNoVo3NT+e;MbDs%4!e$8Jo8(VhX zn>4e6b(PHKO%07WU`CU*^B8^Z$%1W@uKU&Xby!d%mhp2k51u8ID3G0bNtT07*tv2% zx73-R@s;<8*l$In*dl7P;JLbfHyM6O)%P+#2XQjdbsw|ugzsP4OvY&Axk;0aoSGHm zwTT3UCZlGxF(mm;{5PhXA4^q$BxiI`=~303Xw+3+y1H`*I*grF4Q0k=)6bj2d)CAQ zd#z1xMEJhQt&z$3^NHGLAP#+|8{h%2*%b|>@^wWo{ji7)7(^z>)WlkLB~41Z3@m;j z8Q$eWg4)u~Z^)teV08ibl}zpmVkWGIurO8rAj&7^?vG6B)pfeu8px@?avRE!ppxh- z&CbKz1L-qNQjv1mTiRmnlm;Wq?9g^aj0?+Ar|sH5{^qGWir*Pbd_B%xrlp`nt>4wb zs;}GCq419Mb#g|Vu4hKOiDx6@)yDL}TKDg_nO*R(pI&aO>8*MD-V<3q#;a_RRLF4u z3;qVGU7w;QCcozT!M=EpV;-YxkH<0Zg%IJPSWhM?S8m=-^?xw zl~Tw`B2qCpy#nhv_les6xUtUji0xi9=isz z9AOaE=HJrEU%2}l9dcsWN$ScwU)n=?1KoG-Inu~uEJ1?8QJfFNC}OW0s&C2LzHPe& zuG$P*BeinC{;tzh{^qc3lPHn5rW1-qX6j=N8v8O|y#US0+OFXaN7t2Ri}&!|o2Sg) zJlY@ooN5CjziB^ewdkfidE%?C zU(Jbcx=}Tg*(JRyv4?|vzZ+l7smKWww}$2E^%hZK-Dhf=mR!U8jk~l{tNfkoOdq}cfYqB|mN@)+(#N`& zj`Z5FIkR!A)xBRF#$SZ$J^UVC1`a-$SvA`?6>5AwU`af&_iI?c`J*HnJWC!x$#=z1 zUI?y>6a4KS$nwL&HuI5|J?K1a7xn=6nco7(RJ^6 z*}GK5EXc|i0XNjjJC#LzOzi8j*P4R-K z!`Lu!*<~_ak-_o-p622+&t89cqpWl_F#N&{{fiOL1A&5){mrAYEGun|*KBHWH!KW3 z{Z8%?bbZ~&nDAos=lr5VB#>)@&_f(ST2Xi_QY6Ca^Ys^U11)T_nd- zshN&E@_jS>qL?-6gD&f+#iN#%=ASQ0RAb#OkBZj8?`>33?jI_yFAUjck2!Y<=0|rr z^44Wv_rT@tE*TX%%Sk1`GOlg^% z4^?~R)jqc_hfjPhh#odBT)DBReKxB+f3(Z8LrI(^RLV4?xm_Y{^yi*^Cpma}Bpn`) zedZ|V%?XCxNZMYwv5XSpTot4>OEJWt&PIYVCLPu9vOa9hBI3NaFrXL2%Ek(ny7~UZ zV*8LbKeE|s`8a0Aka9UD!&uXxC8->LUNY*rv#edAlS&wIRp9@Np0&U6-=r3c#>fOt zd6>H_%*q%i)d(>L*b+kV848^$oV5pPB)e#I1VgLi^46O&9Lr&uyS+5%i^e1R195&FDAguT>SmB-iYuP z%d3IG_8+xb5c&!1!_EjBExlZ#`e=4qN5;S{FsAN$q&;`3wDXLHi>!>t!k6I#{65?B zN?le)7@SUjdWxMrE8^=&9(Biy{a+aR#xX2drJ_dM!f?2$iyX4wViXhEH~j%i{?Wc; z);fn5awaE=QZMJfd;uGKS@WXNn0Na(7txzcU@=d|^$0$B_wwqe-wvN%x=PPBUl!b> z@dSOHA#)41l+>>JqV)Eh4?miI4gnvhzU-SRO3e{hz1VT`gG-4_T+Y;RsnanvGHS61 zOc(C@lGqo=_F)PA+*q1nka4%f1m-kWY${!4$FI`mfyur?wUTQSb8ml+`8J)uR<;Dz zJh9j?_>_~wffwNf!y*dHhGu(b z=G*OAA`LFqweM?-H4d21!!Izsyof8&aogS)p%Lmn_gitZ(K6RPbK3{e@2%S6mn^Ty zj=GLb6sMBGw+1pSC5B32 zHF1Bomneb_4tVWo!sj;e`)W%wF`}Ev~T*MdH^e#eut2%e-*5s$uNN zK=WjkxBs69!hezX82tRiHEu;@S7mObCMP!v5?LdE+%WU%lFFRPlf(Wm z6gssNexBSe!Lh1fvQaGSBH4F%yunOORAX`JW8IzxWr9Ptgz8(<)@!*1nPvO>CD`HB*8V+|j|mgw9sgAd{ZM*3>-1PXUxLlW7Ne>1x_oO+|5>yuSDe9rofFZx1bKP} zx1`b#J}$LCzp$qdq9ghqGVp)SkI4WlT71Nm=qxgikj($9>~0(r@8-?W6^oUE(l$( zf2B77`Oj5P5Pb=hg&qdI%6#3Z{K%!2eeRuZvme9xTXzJO%HD{TATR}*tcbIlbR$`S z)Mb8$+@=@g9{lpzmbWq;X~xghW2MM%dt>8bgm(oIu64;5ST~O~Sfrn^TwMcJ5CvWz z5e;F6AqKJIcPh5D%Pvi&a^LzTJTBv;Y?qrL4~?of@KrYzI%JK(*A}^|H9}}^=yUt+ zC)(%~r7|!N(-CC6&W?v7mdbxkTSXsq^dH+pIQe{9S#*WzVQ8tac6NYxFVVf6aBev2 z|Drb5e=bZ5`UA5^eqH^oPD`ve*QQ$26Kj8?YcGNbPJUfZ`FB5XeG=ruKO~{M5;W;P zCS50*`t<<`AFxDT@n5uD=fp;S!!q}!w)1z|(A7NuIJ2)=ZwgyxBU5L)tiTN|x#GX_ z_Z0IKm43to+e!^|*pz&XHiF$y?+p=h z(CwinmP*5FLqX!cQBh!jlIJ~L`kiJl`ti_Ti{E&V=L10PRDIJD;=&kOp(g%fJK%Q2 zfBzrnMg>|=*2{Pod?}2RReR%CF&pP1933&!80sU&^Qvnla&>)8mb@{p@xPo3Jn5o} zVew|Al$&7WGI6rx4Y46KSyV<@$1o0w$p~*!Xa67D_yBfpd9Kd|;aaRcgSza-?}|Mv zyST5kt>|~TWKBiQIV8|?YUrFOKYCGq!x0jn5V!^4F6TU`0zK6gkyD4>JUV+OYde16 zWChHDjU-Jf>uuE=8IyLY@3ES7)JjdUL=gfRLO%)u^uq!9zf+k z#Vgx{Ugzg%P@koF`4)Ef5;(*9M?>hz{Ry0VKF90V2Bin&`(L7(S&Df;GOKqBDhtOf zR?^be!!MZ!3@M1ViY)mb>Var%U)udb-5zIlDy@4)areDgH*6GINFZ0gjWV{*&Qz4Z zwZDuHugzH|gf>}U%<6CcxOnS_yvojo*AcF@3RbwkCcuXCsDlU(J}#RCC?g_KRL6SJ z{;g?N-Hk-S?oR#8T(95kt_>H~IM+s(q!{Gc1uL1PCP#dk)jS-B4+^fSKhS%G)!5Kt z**A|GAce(?`?{823D(>$K>IN~zv`N@77w!FC0Sb6ldB)rx#`b;;7`ByL|mm8&c0lO zXN@+n$0qXq>s$SsRo00^Ah?YH_;x!^9ugq>Ir{p}Oey5=YDL69uu7Q31;>geKKgSw zhN2`&_`n^}uV96l+%VYH*2fmaY6+uA@)AgD(}!ZxUHSP_c5BDVLQPhpyGI}Ir**}j ztb&nV=Z7SQ8y*YvCiv+>Dfe4H1g#M~mj?Z?iKhENTfYPTRAn27>tAGs>_UVx%OUP}6@FE*9$L zv4O_mIArL{ejRvuwe|fm4sH-_)Swi@nT-xpBgc4AjE1Jhc}yM~mMXJ!b|99{9s=d^ zzLBRupi5=v^XI1{!-1Q|=WyS853muLvh94V@QOgRRb?7bK%LPK6R)9$186g;H~uGe zp715TR9dkoWvGGzS9ed63#T8H$)X@HIA#9#?*@F7p#;JWo~Ad}FH*pq*t6sV;lwOS zNe8pYIGxtXXp4T>e4;2_5yMBc2t;y$-g-MrT$bvX#|rx*PZ|cG#I@TTw>t&ofAS_C z>cg)3eMF0NBrBTeySnF2NWpVA(8wPTJDvIz{cwWE$38bfxdGVO$4m9!)fUkp#O4mq z88h^GvjaAwwFgDIWnTBHD$dhYjE2!~^DoP%NQTB|#019Vg&_HQ6Ota;t4 z{uz>3Orl6ApZ4>raUoXA&A>eOB)nFf%=yUIsqU122vL8ngqi^CEtK$Su9594Qn( z;Dzgoxwb6gMJak#B+zkfz;opL*W3VvB9F*=GD2!OcbdcCv0gs^J~#x%9sCXWqjf)n zv-UCHrh(|)vuu!*U`Po}B8B$woUk{G*K;Zv)2%-aC&8z4Qo)cT!dA_G7=;jS-2(J2-aCl`tUP*+*Dq}|n*xvIyfl;utMTzGZ z&9Fh!HPvX{&lZ^V0?}|+v+^yT? z^p;#74FNKQo(XdcuG*^sGVCO+Iv?@L1I_ThX;g4oe0uNBeKso%W-ILvOFJ-!+p}r^ z1l!1{zsi>#B#?;{CC(NuEBh!cQn@F9kw@`(5}Ja{VF{&(%{)d>RS!`{f7V8jJH$mR zV<+|5kvFCRidC+~1T^y>k<7%996)5MOq{%@PA#!lP0e)EvUpQ^a{;uGNa0^TKJiI)3j1Ru)oP z3p^1v>q8o{YWR4S%ADISTk?OyJ5|_xvdVwE0DocUz?YkECMU4MjX;}Xg!v6B4DdeyR9_tfFO1d4ix|7mEVNz*~gI@Lg)v&Fo6Qt-3>Do4{pa?j(b>{X% zC#=&JInT2cdqIy=;6{V_C&!=6pRM3$T(tk&t5_WtdxEUzT|Udm*Ir9mj^4VpBd@Lke;fH&h67C9raT+_#*tKElr)O_k3s#TFEFK; z+J^L)+!2E>dpB@QM6TCrIs-CwR3K(cYbha~(R5~O$3C|*_d;^v@e=n@< zVC&SCF{~SYCw8+8;y&D-9uu8UxAKqrJ;2VM8qi`u>yQNgEy2Wbg0E*;TP6y$mcIX< z)eH7j6Yee%d+r54NWOqs3ku_pE?JG0X8;0!`UiP8j~P7fCdFpas&8-*fFFrN7*#aq zOT)seJ>3?M>^Nl(an3u?Ssme7Y7%7q>)fV}i5o_Dz+1{8>I-Bjv=12>G3Oz36M3ST zKxC7(;vWhM-6cf3Whe;hdp|2Hnux)w=msR^X2GuUW-v0*vD(m+L=#PjpZQNTAR@4= zqNeGj(1#-8A)_9ZP1+}G`xBAQj~YgGs+KhJQ)pm^e;=R|h+dZ%!iROoxBD9DVKW;i zT=yQEeWZ9BU#r|*`>09so?S1-@O)WDITbEKi6C%$PZ}QP8Q6X{IvEBPyW=H8OdUk{ z)&ood96?u|8HDo+-BXUP@14~~AC(dv?PYN5Q3v+}!o@6EzZ>2}>;;4A9GZ*|A=lj` z+Im7V0TJO>ABN&iVpm9G*n3Y!Hjf5=dLg{ZU1f=0e`0qZ7?4aM2}$V+ z@`Bpq%7`Y%4x#D)-7kSWF^+MF89QuQfJuM#F_mA=>^QV@y4 z{Mmu>lhH{Ma=8!gljHxZdmQERXUPPnS&b&_IslTFDLkfICD~MyWeOC@U8y6jlSx*U zrducB!CmTW7CtTwQ!6>WEl0MAyx`SNpObM#nA*0!;0yXgSn!6!e_dJAH`{ax7-Qg`sFIa^G)2(H=IB459^|zv;CX`LjC##UNa==e^=32UWw{UiLX0LA(T= z_3ye?DgxuG!oGQ|6xUN_y4@+q+Bdq%3&**0@2yde_&<&+3@m_p0!-N5j<(aVdfiu4 zE1ukB9z(}k&mT1FYoD_uLwL8w=2KLzd8q`6K(5?zITZHDES{bdlWC_TJG^iM=&J*$ zS|pJF_F=QjS}Z`fpv^sbJyioCC9fW48Q4`UuMBZGaTy0qGu>6cFc+O=rcPEa6L0$@ zl5B@Rp0eMhQ~%^pb;~(Pi8E@S|uO22U`v5O>k@LmG;5&1PqGuN@txBC2dblPTxJhBuWT$O8Kh9JTvouF8z z$=jc2aPFiLGehFaJIH}%Y>pKh;w6YA@e({1_RNte%dn3fqg@MgdYi{?tsmenZq~nF z&AKmRzwO9VE6Dc>mYpvisoS|So#d0{LmUD_=--%P9 z_2g(n^OV|Rn=xiC=$Mg;O;(ej(1cm;g&A(BL24>UzD+hvi<97rMop<>nTGqGlT;Ea zrKSlkjSHlRCMbp|ycf%|d7tO={&#_U&bjBee1GfVmN|_BEm53HUv4_(yF|2DN&v{E zuHKEQCq1BD-RpR13@9z!_db6(@z~;=v05iS;UwU22t(AeC+G~j6`|Q3J9+!uT^iEh z3rMar-V*o;?dNrA%{x$I>BSPDb{IF&8D<`~ITCn{YT#9aaKj;h$z-AevF=sEvZe)2 zeIo0^dN;m*4`jRPYTs?LXSb0wG3`ddN9|T`HZ$=ee34FV2|objCQ+O%3LDskTqn-; z3+m!xNt5mAm_yY*Kffm#MM(sP5dH?-42cSDo1c4s!KjTPQeSH z!tl~M`exfY=-ayFQ1iEgf4FG9EpM|2y+PN1C7FO2)oU-~t&IpH&5rd&J!zy=0d02z zfQ|HwJ5#IH?0vL9ws(&(gdnAXdWI@~ciWbt_ffLzeKonNm`Pwm@%xs$E{Y85m&IpN zQJngj5?PhEZ9S}WZ09e&-S@9<4(|&}tqN#+COra_WQ+b`8HHPar$z)m0E=djt^P47 z4}Usrv}~pJDj>5Q;)d!MM)UDaM>v+%C3lpO>8XCN%;sdK)d+?o=LPmiZs3Ra`s?&= z1*`tH+HGMM)uG_36jJjeQ>4S+xEL11%yzpgy5n^9E%h>Nd`?|(f)NvzCkT0DfnYo1 zbo}3yGAyh?vws%nkt@jb zN2UWR8|T;Vo6G;yLBx4*XotPtM1eivmjpoS~W;SwA2pTHO;K5hIm)V zpXg=Vr!oxyRrl)lnmS8cI~(YJHZ^4c8TRs~6@K=`AySoI9vQ z_kZxRWSpE1qnsmv8kF5();5eJ1-Dx!1j(Clu~|D9%AT%?==z<-HIM&z*$1B)tbNtj zRsl7V8lRiJ$$cL=(11O8>O#TX74D<@_g)IF1B}@iJx$ITmF>PXs#eXNrsU;O<)y;f zNx--0gWfrg)HwqV%|HgJR?3nINZp=ny~%VhXCSBPavJH+eQ^KMKPl`44_UVMYsH)*j9m4qBBHG4`*) z))As{n+T+w_TK5*+>Sk+@ccX&g{dF?*qCzM6Gq@M{5&lg2IVJ$cwyr`UM5UT9TeM5 zrOMDzdHcLm9k(;CyC=M_lY~5tcsFXK?V~>yr+QO(%;vW{>g7dRZ zITFefh8WO5g_NzMD$p(BUN3HqT*>_P5Z3yw(iH=(zdmg1JJ>1_c!X6R?e4^Hl}luZ zp)^=RiqkFe25xO_wi>;@z+MElXvKWRaGSCd;(}m)@JuDyy@?@4SR)MG1xJv9~>4N39aDKh#PfR1nOE6UdW0Z49`%twX%w8wU&-U z(XfVaqK?q2d?1nN)7#-dl1&b++Ej?|g_+v0;hd~d0uuVrZz5=?emMD_OEi!`b|(2D zD=lh$1Y4!-r&4bZyc2zdx?1%RfSN*cx|ije(>)=bovAju^g+V8YH@B^ds(nb#PL-o zqwpE6NeIlt=Y3NV7*@1>Dyy&5sG|TF#+WmgkMgERB<>EC_vU|>IAyZBYisBFxwHPY ztT(0Obwm725CJZ_`dBo1hiC~jAD41*oWx;5Kss)sc_G|rayj*`y7^6Xb`YE_*Rjhk z?IYw0XnW=Er{{!Ob)D;%I@s)NX(zUZ#mTY^z#?#`-55{iUTFVw>W?xprOI1TY8PL% zyyb3HjS2{AOW2UD4-dYkNP+yuv`+F>EebR0V(Guv1_!}{w}NZ0P17_c(urqV>hRsE==DyRg-`Ieb3DSWc6%_y3XyF%K>H&A^2X7Ns76Dc=f>A-o9n-i@?w-@7%K)FCJv_fzvJvlVogrIE!7Ai$flc;eX85pou$Brcxk;UT6lI{w5~xu} zU37`a=y&&I=jNu&_E&x~|iWeMcU=5ms(JQ`&U&z!WL>^VDH!^+4&(K)p77We7? z!tsKMTS@4CXLmBG$5`&Q?n9mDHb&+(&%|QoKF+;|xAHkq`qWU(&i6(2(p2A=h<))( zWtmrPpwWyJsvO6e*k&q>d|n2;@&(=Ia*avSF+H)1k)}Om73m|POuI5Nr0g=r2vyIo zoc$8t<-@#%hUMXcV0nRmjxnYEe&jgbWc1TqmJEKa4i=eyi&!Mi9dj^}I_2{ulnFC_ zc34+Pp#kX_+PAsdIT4jFEKxO?GEQ>YKfxLp>j`|aASH1QdqI^>2h0@Xkf3--;}))t zBRtzzB)4->uyz#S=LWi810 z_01Sc68HvTaw2ZL?`)Tk^@qVskC8@&ooOMV*$gN8>rOw=SgZ;jID4g0CutLG#r?9O z1Hdb5oa2rdDzw-)JSdoa z4jR+qe-Y{FDPf=bQ#MtQ2!KPkvugDY3UhN*Unj-dKQ_BhJJjSf&8roVJkMruw3wfS z&}wsG8;N!v#)#=ZRr_Gh)cawOfs}9WvgkZeFxigNR$Bk6j2svadd4ee3( zI!)=8T3Io-aXg3}sGc3)Kk;Z%cxWWlPse`e^qt6w)UNjN4HT<(u9*~AAC_9q4@y-& z+wIxLwY~B|ZZG`)+1>&(s)IvijL&v%8-DXnQ{fr>6Ehs+!vj)uT&QML%fnMs1uF+H z+)R-ch#rndr1-9a3f3> z@PA4W@X4bNU)`cSHqC%IywQDaAGz6ZypXAYcjAHJsLnV@WQKZpr0=jt!JyJgU{x;j z*RJs8Kk53*Evm-rUGt&75-$y8@QQ&#m|)w)QBF*-w|LfaeQuku#iZcj?{-vFkT>0W z#=pb#CW3z&|68mgrt^6#fJ3Zq>%>TTK3z{N0wtnJ@WDq0j<5#?bZ)V32-3cXX1p{( z2eLmmhnS}(b&nj2r!|MU;{$F4BS)V6oO zkU`rcTvomsoP%0F3sSL-6$2wB-nY0AhPT8J8SvzthQ^B3P6vNL3y@BDE@#)=*G`t3A-&~~WHRG`$UDevJySe^+k$U86F z6&5?x%4}_~!q=o3_*p+>!JA$OR@-r_C``^iN6uOL&<99K)61Gcs-7cfbYEc^G4dgq zFM;%xIrq&Pi-7-9_x1J5L3NRJAQxldFaqD_N+TBdZ)2%(G!dDfC!jzCq+(q9Mj?V& z2R@94*BG0glXwSt_VNYTSa3&siWex@lk6t|BkL450^Q3Vxb%cQ8w}K+kCDRhOBRRK z^JM#+)4i_JGAYjal0W}4@WE9?sZAuCD`Q(Vi1p zILXjsWB+6@r63bXZV9Q^mrbrUN@ZmvAv&5NFlNUXE?Fk+>5O&Zojs>}qHIW#v)1 z_9jSnws$#rvW2?V{L;FpfaaMZ3X|~M-X#BduP|a5z$-yhRo)#}q}m{OQiw?io>}Gj zZ&=MUM$+LCztlj9yoU1EQ4_$c^Xr_;HP2;@K<|zI5Zy^EnvF3@Mu1THQy=_%u(hvK zPG<9hx(kHaGv9tZOs58vb(%^4i0l_~D=T;J2ROMrWQVa@P1NDBz;ui4q99ovEq_%% z`h-XeqEH1iWRD+9e_A3eZae_`6kNwYU3DZ)J=xhEZ?SxRoOa%490MKwFI_4YYXL39 z7H!?rR#6OPf4A@m3sVVAftjSe%FpG=f98GEIgk0mM!g(p!Xel3eTF`V`aPqU2hlXh}H8hu1qcLTD|=3P+%LP-n#pXl3AznFRD*$E+CKk z;)}?9`C+~+bs6w`%(ZuI{489+1$^bN|4$?P0+-Bu0d5Y3IsSX`YHwd^_W!3!=U2&) zk4;vw>JvCCGLCrS6^71SQ5R6 znDYY`#Ane$K*l-uz|yhUQ_lZb4DsFXR*T62i~-idn-J@|+x?MW<#ezn;rD@l_SFU9 zU$Z;>uqOQfrup97d17n3JNW0X@3qhcIOrR)LbaHN>Q(;ZGcP(HKELVP`Sq$58X77U l_m^B_4Gj$~wOL%MLD_jiS*l&L9Qa1V=@9Z@!GTl%^S`MPdzSzJ literal 0 HcmV?d00001 diff --git a/docs/images/lighthouse-architecture-light.png b/docs/images/lighthouse-architecture-light.png new file mode 100644 index 0000000000000000000000000000000000000000..076240ccb29bcc85c77eaee29a6db2a84db7766d GIT binary patch literal 271679 zcmb5WbwHE*+dr-thyjWsD#DJ*p+!n^n1Bc<(lvx5Au*7SZE_3*#EG<|Qj(L-Z78Lr zFktiqBu0%GjBRZD-orfS^Lc*H^ZO6Ry_7-L(_=f!fqz~XHz}Nzis=ZQw%-?e@-14@B{5{{3K=rr|C$=9H zJpHf7uBlsNx(!(}NB$4bhD!Z$>7S3?+`E;F($=2l^6UR@4nTcr#}&{ zK9;HjeB0$ic!TS6t^f7m2mkp_^r=5aF+S~v<>B4FKj+T2_PgrXE_W$+G zpRcHYfE_%Z;ICC{!u}F_Bn;tm1*}VlrP&KgMsL~j&sqP+LaO_4X;zR5R_@4NJ+Pni z_gw&nbu)150p9PM@?(?@{QFP*_83eGmRJF#Ej>J4@{GZp7oLalm`ysK*;nL>& z{jXUMeGE7F!1&ld6aVd1)7)Fre(lsxg&!fvY2`nq5z2w4=gSNW8`@p{j@~^YOp7D>xu6+ue zGmx~I;P)wR-?i6RJ>dVovWK*QqaM+oX|ikobVcpZbIRMx>@QEB*n0WQzx?8_z4$r3 z@9tAw5-_dG^|>1l)H`=H@~NsXv1g#p!*xXTcN@8;`z4bTs)Mbh`4DMz=&{O&)A3t^ z4sVw|@n8RwzYZ`oRFd@guYr8t$ILGNX^>eiXgWq3t`^_TVx%z{rGp={pYx%wx1q~ zJ+krhL-zXJ+EIV?=di4OIXbY58;jnbU$N&^rCz)LzZ_t6rD)9^=phvsxXFH%edAs&#UTN)>#vB`9{g_-|9%T=NG0 z>9k#EhA5q%4*z3YcNy$9`R+xlG`@uK!-VIV!P{_p1sgg8tUSF;oIDCt3G@~!?vxIc*8T5_NbyS6u(ZC9sCo4&J1k9Mr zA!Ir&pw-ald|a;zh$S8HovF;ar)1{F+~G7s%OCr+HP$te$a=1^aDxZTaL~?516i3P zRaQ)1dADgf21in~&6%zg&oBKcIuPnC1y{~wMwaw1RcC?;a4l`4W5B9eAKGy|^k2p| zEgdA!yAU9LsqU9G16!QJRTBH8cf<;IZP0#nckJeuo+Z~_)>9o?v@Ta&P9f*^H)Wz( zzBm1GCG%Yx?Nl4b$r(i?0p|u1cp|(%WTGcPyz0xz9z$3uoWW3tepyaXaiNokwGlBh zN24DOk-y{A60K3$ILbM{wu8w-0u3sQj$p`qrfq|E#>ROuEggW zq~k@bH<+@?%t~UjqH&gO{PGZCv2a6 z?bl`oTm`1+q8A7q7+W9iI>FES!xGlvb$KE8qHR!93arS+HZjcI(c-ElHh*IcB%CQc zS$Uk*f$P%fVCY}|o1Pr_$Gkf&iu~F`Eu~D=9Yro&!MsfNWA=A1uxyNInx_d1lz>>f zd#q2fR5}2rNmzu-6RZL{YgdI3^ZGc9(T%HLyft8X^!2BtCEYGSh zW!kSELk4=o3HmpW#ep^_08y9t-OB;q;u7Ev1=U2Ve$Oq~Tl>RC3HP&*w=f2(u&No)McnEQF_C=_ISWNI^0gA_^yS7T8;%87?4Ms38b2$lQVHT zs&;Xxw~6J;S?0`_C%3{!?o~}c*Tzk;ma+Xa?}S*MEsrzO8AiOHIx2`mhh)$S%Ib+N zRtOjLIm%;M#w0jvSeI^1^nwq0Wo0%c`_eNP z_VXt@Riog8h5k?I4g3~)gk7Rzu;t3Et~x!i{w;nn>0;U*FSXC^EtkuiCPR6-Ryy{r zDEjvC1!r|wu4A)%j`ojl6SgO8Oofj3niD7Ry^qUT5-uKN$;3Sfs!`R_d-Ivc3MQ1v zXyFXo5o#nkYZ$4G=$rWH*(j-zft`o>4{Y!W@RSvPa~%E_wTnOE?xqb}KijSp=SCnv zq?E5sp_;gzD%c-?KDrfjfA(3L)lZLm?V36Y_=^L?I{R_V+kQp6Ts4-ea3*eqkwDG} zS4);RyUUPe1+L&rT0~FYqS0d+DvXZ!6iq!9`d>!#g(2!*HtR)uqSgb z6~0q6fLQ89h~!C6vGV%MQJ$`s$m;PV9OT)11c4`4QMw zjnnF>S=*Cg7;ht*9-8>jvGQt+R<2a(y#bebpG=7JN)nlZ?$88}%m_FFwxAn^gygwC z!;erbx9(=+kPC^rqtiW<$H7zPZ6a=XMb|xu>4y zI&st;_#E>u7yd1OaFBGP9HjKh`VQs@^md1*Al@HZCG>qQCXP{(W7>ySr^yZB+&S@W zv@#85q_^VyHsV5)6Fr|;f)q=JjaG(E#~vdPxF`x>&w$4o)Mm&+MM;GL5XX_5G% zSB!Ejrwol%hF0of#4lh(+8aqDwK66hS3a^vE&00MU|VW1vNDj=MaK^pmsl{z^~x-3xvX|wz(ngv=3l3IpIk|QQzNTnIxCB336t%u+bcU@e9au zirCKCla92@Q-Nx*xf)cuMv9;FJ2msCUpL|eSygmbO&+i%cco{Jl-^3Yfdk1hCPlNBoYFhCZx-O41Rb7{R|QyB zCYij_(d~jGHX}w5wm3=F8sX@}K|QoP?aTeu4?~r02NC0bCaTJ?K##hMvshGB?)%ld zhpj}>{{3>Cc-zs@EYQ*Ow*pG6%%zi6&REs0uCYjI9$kLrOt}W9;*mAoURBnI6=H-E zX;0hp15;nb5DYl2wm(H{33CfIuc|j>JaCw#F);`d@ri6b_FTCLIex7y0R27i3-15C|jT{6D>L3qq(m_hr zWvP@`O#i04g3~(u+jn`QA8h?SWn~*8Q1y()?XvJ;?c-~Lt+bpq%u_H6NvF1uUPZ(G zC!k$r!Wach>30^xYoDf)MGc2pUmrS_LtF zIs%~L+XL1E%3X(>NHLheP9NMbk}z0;T%?kBK*Y{)fdb}59D7yq+-1nw1x_Z>BZKL! z3b+c@EX1E^zkxO4yzoNwbJmpO!+9n2{;6{qzSpMMrJ9iWh&V*kDW680;pL55YHsx% zs|hK4K^Z8qA^7nm2tup<80Hj?a4j7;D<_b0bgXVy+R{MIQ3CplespY}v!ri(Ov+8Kb^}Ja$;jsPoVb^$Xu(5&OWJu@M&z{o=Fk zOCCt@4Uyp}#pxQUSXTpCC#V4McO{8b@b}tQ9l=%Mg@;U;m$1M7f{R>ddpg!wSgNCn zKCqeOv@Fz!4sU#R$uMm{)$cu%mxi-vZiJVth>*n2+=1SoYbQRmN1PROUtP-fUz>iH z@UAb^vDmog%wZ=x4y0}U6LTTVDfDAJb2hF9-1SZx>H*kozegokRR6eLa{J}q7Da06*!QmVeZD4{!Y#=Lyi z(q>aO4`$M9^zR2IVlP}n>$^zLE;wCpv+1R~AXp<^eo}@}jHjoW>o@CV>JqiEd10Ah z6NE?m_ZgcxKPFGcqNNXWwp?8~OHf>*$?Tk+kx*f5;8t_Az1aCkRq9L)+!{^Ee9Uk1 zwglaelrRc#YMa#TMP(-%OPitc{eoLo&$%~vb#=R7B9EOJZlWUb%$O!pGW&oXdS1zW z;ho3nZYX@CfT*zzg$z!C|CKt~fLKbzj0PoWb1k`prn9GxrF3W}BHU3?1qqaWTuUcX zC`qf?he(`DLN8sAO%>&bNCLP5DvZ{I#%uIghu{&b!PYw!dQC4lH%i@pCO1f~Mles9 z=lLCRIa_$wAP8!)~*#kAl3urNd?ijzq|_;L~NV;K-^;%4X^r8sAQU&20T{ZLN+O{o|*! z)C%tO&Y2h$c3;xYWald-Ujp|;^KWp-*&E7`lmF1Xj%z#AoP8WAu^{nxcB!C0&j*A~iP{V^;~; z{k9VgM&dmU3frR&PclsIy`JQvj2@CfK->mDgSJ0i@fn6Gw9ZyiFI&te0foPa9a>87 zkAiai#`v|#wMM^kM(LOv)b#Fs|0%KZytiQ<2W03eaGWCFYLA#6m~z9b=L?Oxtw{ta z&D%=xA8vm*m>`i?+B)Ni#gk&j>b68Uu!#G(Z|srvg=>IqR|i6E%WsdAEZ1-5-3q9o zbpgpS%#BuGP{=Yk#m_(+^jEe*47&;yd5uvzfvIviJp$U8LKz$L6iA(0$S|dj*I>>q zS}n1Qw}L7<=%LFo2^BDf`bx(~O$o>etgZ&0sxxJ&VQp~BVUp&B$@!j_^ZHFxeg+Zp zvj;&xe`!5|E|ihG4#wg=x!353hYh=(lPfg1`oJE;a;j z9r5h;cI=86jKYX2Nm{eWIj3-n;z1bvh27v1^S_lA~xosEylo;TNX-Ef#(jN0oqpfZ zoQiB{l8Wg~dFN{8^(i((^DMLRY>JjUym`>mMzH|I@*0_2HAO&S)SZqkJ@TK7I6=0P z%bIyYc}Gm%K36T!;xWK8d?pf`ugvA|eBRlLu8P#d5FZltszI@mgOt{i4y9@%Xn_eR zA8*uf(W9Woc`3SUbPz6;v|dn$JDlq>^sd}jwPA(s(u7uKd~GJA&+s5+hup0%2c`VO^ly4wd@I`7d+xUOmp9$$6}&L^upIJ1+akucU~TP$jmWm0umWx z=}Rp6lmpcz!G^1G$F%d6-eoKk1d$`Ark&RFK-tja+)rAq#&>&Z=gDomees8DQMWeX zIQ9e5Xw(JZNnJWi%}BB3<4Hq)Ll19)S9J>62&YIr=e2>(fhH?i1s8Hrg- z?^3YrP2vkkO*_)kn~RlT7hW+h>p64oF|YEHt+Ej5u759%?U6LXVTMCB_b1Dr8(C(Y zlHSM_K-_2^Qe|hUegTOuyiJ@E^y#{+3-lN; z-m`MFWyHjv+hr{@T(m42DIFmv*;jH{9`V=)wBv{#YFHglcW zIYw}o2esZu(2Djz!!J!+KqWR7@>l<|9g#B@WL1dinMsJEF@~RGHJcU|ah~s!v3lVC znS=}`R)5W`)jRa)YVpK1q_oIq5^J?7wC&(wb7`0I$-{hJ!-t$2YV&>p(bHaA$G?}^ zwCjLzwc}ur9_O=>&2|@>`@M`8m?;{hnOE+^w2y)=;S)RxOcBeC6tO3z&_LBiycG4$ z!1T1>CJLs_KR3RmM@IH)5Ag@`y4RQ%?dIF20Gi+KWkHY#RL0(S4NL{KsF8 z05IjD;(WZ*K`%)4*LR0LeJo6jmcmXPbR-t>2pM#|1;c}uOmU%2kao4RhI;DD1;#E3 z@RjFv`Y~=biyV70&{pLh4e*YdMdt?pvZAp!E%sq@$UD^Pq|D54W53&NWf3_SmO;V> zp6G#>QhH$$6%N_1$Wk9sRe4$=-O1-h4~5e;a53gu8xBBQ^$X`qTd+Ac=twa(OmU*x z-1Gfa{Skcc3(ilSfAD@9-zLjnGese$t`cI$E=#Odg-!Y2i1WDd5Nh}oHYOm*4%J}| z?|DgF!rUqZz*J{tUB9pjPrPI(`1gM`IW8WKakOb@h!JqUjouHcQS@A4DXd%Mj0iPl zCpWNis#&*&^XwSL#mHPg7lae8Ba7M?F5o=qQpnBS%JD5|Y+@9G{GY$Gr00qNUa=)` zoMW#3RJpElQVpVt`g*XrOxCJ~l^rZ9?^;Y76zvTwTVD6j^VHFdGzx@;qIg~H)q9G0 zf93TeLshdfx7T z_l-OIfq}s!-CF9(jd#_{mHA+4f<%FYz|5%6f?TVJK|0xUy^NrpGV-PNP{_!vp6}(* z^m+Fc-oM0@9E$XlovlWk6XfJ|BHYZajG>CACYqEVSU>_16F3L}V@b@4mRpXqO8BR? z&mcq7sfRv&fSP;NEf04|@DL(&E0{cdUhXc1Z{FOSSh7#~)3Ue*KxVJw#ZM_x05@t- zdOahaF2(Ga;9HfB^!Iw!3Gqwwml^5+K=7{eu$c0I*%k%O;F?w3gdwq#KUsU};)CU8 zyd)*Zxpd6E;i`bJ2*NK7nH498u?aq4QAtal?Gi)|nYuq}GYV+=;ve|*RKZprBLfL% zR&#z=j&`2@Edh}3)9s6)&3Zu3uaUQy7as(f;77{L?An3PUMkp;(w z`$i`n!B&KRe-&@rJZZ__2<)H_dv<*zh7SQzj8Su&R(qQ#1Ju55=qO>gb6}o_vzH-C z(0^D2;!$07>o>cefEml!v&bi~yJ)$-SkGJMv~*qP9rNS*GGYd+Thc7OhHr+@@C3wd z;zRxv%onHZe(@`vq}*6b8HPg(Dg!(Zx1g#$peI&?dmHZU%&ydlfLhJ)kT-v5wRdPK!QwzNd~Vwap{gIB$jtM5%6 z7&_EgviRCnuepFR-QcWfen|EkjQ^RJkH^hyyt)>$6>gv$Xf!^n+l5wWUKw*^J?{I1 zb*yZM!-H7QP9M=3n?%CkTnnF9A+O80wAj*}U}wbu6`M8p{;@B%r&l!YGva|PGinIL zRhuA)bz;{iJY^w|%Ta}nD&0|M_|4vAN{WuXnr%moNFLUxsOe@LFb1)@nrkvFA;pZE z41UnqAdi(r&c;!hIw?i?QqT&7-nQKxd!mO*;597d@e-`k<(DuFUvtXMxajq^^DEbE z2FQiFN)EPsej`_0`gJD$APTIi!=miqTXmP31~SZow_(x9BuexqHxvc{hz8tBq!war zF<2mBXN&$GiTGZ#%=04P!MmZNCk5dHsk4$JJmcF0`qyTfI;_^) zLUVjw5bkM6!)`C9Jidn|zaR3TTL;|sZ-$N+5Wq}S>Q%#fpT;ulLl5SJB9-=3o)#Ho}&y*U=eyl7COp5OTt2ko2 z9VY2Bb*l7@Vm`yA{MZ($D(9<~Y0=ciwpcant-Cg?eLO=J(&KB#w9#)m7ewrekXOcL zcFK?{%ihcg8#B*d{ovv^fhW-74WNl^2Gg(jm6oo}&W+p9yp5acWtUrvKp_l}($tEG z9UqG6-Km*O$Pjf`9aO-?TLalPJ0<4nuejg4@qXW_5;r#5^fIrd8tIOzs&8q|)we*7 zxVA|Ewm312^3zaBZ#ZmG(pYfoB*WY&-eN$QegNd)`!&9)sOP!rbHGq+w}Gx{god?tA_5IUEV*FSv%X|_n| zQ-!+o3uAW9{X@({GgY5s<1e2hfoL?9ROT-e(Se~?u}#Cmiz3G-&}+32%{P11GG58U zEc9qB20@k5AG*>%`jxSX-^~X$)4PC#@&fG3Tt_;1Xg%xJ9z zU_+AOn+r{6S3Noce47YU>NLmL?~EKkek}NHFheC{O&pd&S9MVa!kO1t)hP63l@bFX z#6n1@cdn#qe4J%rVSBTOl#1~!0sQ%<4(u0e%Nq;lE6zhlGgwoNafu!vn3P8*1zKt(`(-I`LyN4y~_+VFP?Ct5_?$*C*vz_Ri9~+ zx>YE$<~O{IDtIeEj0Rc2ecMi~0Ts5K*DZG-EwiLGJ~ny2oUI@jS0yPFXQ$XnuRwkg z{3@=WVlXnLNGih`IYYfBWCQ}=IxcS%g>}Q78ZjtBe$RsTe3`|3en!(=Qz1U-r3AMc zlYuqP1jwbYU;M@E6&}o?+a(K4ZdEDvh6b7ag8>YZ=5upnI|~Oux4}@!%1S{cz8B7c z`YulTI+y@8{7k4zo1I{eL*F(rHnR>8^HtSrW6aUw=UVIx&~vUdE4`v30Khjh;}{b$ z!6Z%mzM+pH2~rUB`e*VY4(X|r-lOpOuvO~$QD%G49%@gqYBUd=UC?1x%Q~{cD9p>D z0)L8i$8XK8LEqi>!R^L#ykme76ibDy#|%w~4ig*BD%tlD_PH z!pGO@?KjrL%5O%!!q`e-Wv zQRc{w>NGq#E|$g^xaaeBlV%3!?@b2SpB@sBQ4FPeco|FNW8u_ht@~pS_x3+ux)@uL z5|Q8Jhq3M;WUYILWgN~46tZ*Kri|OR@r=@ejND0sb~o%uC@R;b`?6ewEEe~Po)x0unk28fFziUd zao@mVnMlQxM`CRW?F&_!JmCPA`#B`37aJhtscvWqWuOw2wkqiGOCh0@*w)b%?N!)~hk z2e6(VC=TwXlhA>t)@55=a_emf92bT1scewb`ZK$1S2_O>f~_r;yl*~uyVZ&ni`Lb` zjx4+*_k@EDUzL3APC_JY7R7r6grZI=qPs6ff_m^4P2mFgbT4}aHr7qNJq6Oo5uZD` z;5_H{?6nYn{%FH6Chlf22}mmpyN8!PCS}v8Npf-L-BU{1mrXbX|o_xQK{ND0Z=f(;@T&y8jdkoX?<;mGS9=M@H1m+?jOff1EMR2Qu zDUU;40BusBnJ@Ek7pL$-lH|~Ay618`R`d)C;Rxi>>*}A*1h7sBmXCMf5@Q;snb zMHqmQwoa?FqBF0eHEGE0tYvw~MoT$vE}%e%0;XDTYKM+^P}e}t%$_RLJW#x;>}=We z~?l}_)@7P>Zi)U;AFLO|csyE1}cRuGNUV6_TAb4XWuSu1D=5?X; z5Cu~Zua_^;WIDjN-JixvVDuaOsmo`%DjIonqPQUa|_ng*)w9bOR-s!(K*2rMb|&FIewUdKY#Zrckc$%El| z&t7atM~*fUW#!!_dv^?zF|iCnSuPk(UK>q< z6cAS<1ClFHHn7viYM$-<`qaJC{e^3m_IPLaKBSXGv45!3#Duby+u)gr+=nd@6^QON z@O5)T)s#0E=ZZ-na7>x%5}Fw2q^FAn)2|Q(xLy6G*T{HfN$n=qN(q_Kf`}ONL37#|R7_PRx3KH9qN;Zslm+q2f^uMcP2*byOIe zC)nif*!0beWS5UTW6av}G{HC}0S8seDuG!XiybR1nz#oQ^hMVclY?Hev!{~$Xi!hb zcwZK+j{BB^0kwN4r;%*P)D+wve$s_nJ$yTG+a+ovY-e&75Ez+ZhKAsP6TLYn%zsyB zv0c;?-gik`fY25Py@4D#!-=r_a%mx)XGCA-RmGjfuO50m-5L$80iyQhNK*~Aw4zV; zuS(*3a~x+o^TvSlm&xW4gvy_21T70^gdIG!$?e4!KhF*b!dhiToCZOJ{YU2!0u>Q5 zi)q-EEA|VOliyJYRS6&)TgqxSR%38hjo^n z<3vebGnND4dMdNekE%)P$MQH#G#Fp!%qutc>-lnDg-6Y2l$ANJHz3TQu4#7-1+jQs zOE%pvOzd0%^c4SvptT)yza-(Q5w&R@Dn`ZGO71n87oUf^8*)+HUC0qiwho?8ldMWz z+A=k{M>YUu7Mm)ewe?`No2&w^(|QSrmu!y9F>>5n_qM%mZsi&qO-N6HGUjC=Nv6XJ z0S(vqnx0C>80S@eZRrB)0!O8T0jGzV&I!;A_iZdGLb<!3a< zu{-FI-O+?60qyySPx5$`Yh8@j2`p?0LBJc;f0$3Yj{Z7UZXQQx5dN70%Ks9Eu znc^-F@nmBS#(2H{B^rx9ORK9~I>%VKg6fBBDZp>p?$KX!32&Ypu{cUVY`U>TH9 z|DKGhY7n-ZY{D2HQFwg(W1yqw(61;8J9D{Rsxclqlb#ILyNW8+-hhA zlPzhI?5Fb(=Z29wgyA`DM?AhpCclz=Z(F%@quh{vo$kpq>zbvXBK87Q6p)UmtG$ltLo!Hj84@-jfVo`#r9 z@Ra4;Y3;?d9ZN9kDZ^IHA4|xRat5#rPLL%F#^<#(FvJ$l9^FRK5tZ*Y4VkhFynHpV z?*uOk1gCYrHv)#ChP18A3n&N&bR<&F2FeS|xDvho82u{e4rLbRbRX2zvw zHsUKti`=t1G3y>V_6U)zX5#hUB{m&oA?@Xc9=X)o%B(wzz0P?9e1T0a@ac^0Yz(lf zzJ1lwqQvrU2p0gX6gAuv$O4?Q?BRg2?&?qb-`DS$b{u3u{8x*d8t)A+v#}?(y41yc zNRqf{+O*g2a<;3m=r7@p!7h^@c0w+%6^pgX-)Y^Z z0bTDrRD3t~*uEuOHs;wm2BKJ{EWpN?@2dcvDQztia>SzJFcXkfId=8DjRwk^5Hm9hVZ) zs0w^LbNS#>enCP()t!Yp*J6K{G2ghoJ?^cI@C6~Pc1r)3%h@BPR69Bf;H!u%myJ)a z&I0Ls&e7U)qL}jjSRAr!!_0rBWn@z{duNWSk6Z73N~jrsM^0+P#5DpHs_8FjkLr}lM;3#%|;_SZY9HUm@DgV!?t~Ak}0;jk-g`#rNL*m!!@P8tX}}bbILC9qm?W zR1B#=1~&2F5{!~fidA!;uF%5bHKJYrY*0AJ)~)rQMgB@O{mpBqe@rS({N2P%g28e3 z@C+jzHn4rwQrP(9`H8t@mL_fd&2n>(u#&kC+6qGm00Gh>!B>^L zj#eL!K6&&4@7Gfy=uz$!`MJV1ZsI;bn+ct72=1fc1dgwdHP?1fcS^#UgcyikLLO~W z|D|{9oFHBySJ>pJ!@wfsMiKAMiG8m5Rq{eyOisf#ZlU>cB_a~F;k79sW-D!75M64- zVt%-cAZ%WX_=MB-`B}LMYNgcP-UbC^qug4aO>WTCC91y>m=`IXMym#*diHFEWMHc@ zLf@>NZcBU|o1+K~wo;R8s8_hWstRZBzy;v_e3U%!X*iPi##P!!0haxj(s!=J!M)8C z%fJnrj9Gj{VoGT~^YGse;LYqVxu{=kf ztAI~3*B@M|c}}QVPA9()35c~ax8GNRcF&k32|@^8WkhH>LQ{8rtPE)}gMzvPQZDj~ z7R;2O08#gmcJ%5Sa-R&+SV6BN8g{UbjTNm0)GhG2c$>}6^UcU7|?EGcTpI zvoLf8qFf86sHTc|U#fmUc8h?9RqcTvOvd-EW;Z~+I|YbG(qn}dzM@!_;%s@`zEkVQ zNdg=_GMzPdsHL}ux*fVdWl61@RjpwVhR#-iha;8*?MahP@VAg<)=6q)Y6eO{Wo_Gg zCUW^&_OvP>%p90Y*)#-O&f_^{>tk$?f*5QdCJB>bZJxYd-sgUc773+U({Qd$``Vu@ zKR0%bA1Pl5=yIBZJ+Lm^!Jn_#eyT&oY(z&-yhEX2Ia>%+a^&8ZNF#q3t*4Bjmo*o7 zB~(Bve4uGx2Bcl-tc&}GEAdqT3fg@`^*33H1O_pz ziUUA)&-#bYXN%m2rR*Y^y_qSXibiw4eT6++uY7>EUW2hIO+^3f*F#!^*kPtd##e&L z^P?@SG72%Hzv$11mHlF~Kct+z{&I#dr|3BGB}4K;sSK z2D}I;RJAtQ<1hQvqFjzeH~EgV4X}m|;b(GDol{3^Sv7Z%p~JR+C;1;7Gmy0p8`X2s$Pob~NJ|UH+4}Y&n z+`L}G8oS0B%}YWKE={rJ3C8y;?qiF!mr~I5!VI38LJhk!WD0Nnm4aTBXbbGy1yk z6QfPcxi#y4vM`&Ta&x=>#HgdL^^FKVvI;M2uVDG&{Jic#a;nzBvDlLHP+~fQ;Xcw8 z#*=`yN#p0A*?7iCi-LwG2nwTTjU87rj0E$Z$J@so!)~H=ZBf2?#wUX|G|b^>yW4@j zUtsnyQB_(iaK0-&a6FP=m8%~R-LVSK;~~02N9y1xg2XJ$H#i8n@0S@of&T#_js+5w}d=d}x>?q-ude_hFoO0mQaDXII4QOY7Kx?W>A0 zCAN)O-RYcI_KZKdw4MeX0>fPEkm;xzfFR!3*fTkU>TE}uGkZjMW5*wEizva~OyYvr z5aRBzS}n6O1bYXRjDp488H&8bQ=Mvd>nw*P(`CHnXeqHz5N<|$@qsP2DeACtct;hJ z*JWd)4L4c$n+RgPgQg)o8nV?sH&Gp(aF-r|%jG>1K!Z)jm9&PrX7d^NzKZr~9@ww6f|{N&V6RXL_A$gt$B-9=!gw z&)<^Z27U*{4;bAFq-nbpts{fa1PZY&4qXM(dIh#7Y3HmR!Na9$VpMr2-u6zlT=~=B zS8O$E*NNDT)Hm?gK?#SjuqLFw#i0)QRvix<8WNYhR_x-X^1G=A_-C;t zolQ<YMwOM+Y@BS#lS`yc<^~%{?RuoVl+VB9vgek(>1rEM6*Vl< zz=~oA)rMLd0_loTf8}+R{c^8__e>mHO zSzN#!G+>pOecsbyU#Tq3Me=Pkv)LG9$FifbjTv#b zCiw>gg&VG}SD5OfS?uc7LkL@5HK6p{k=q_B@yGWaNkwgsvGUEUPRTYpKHwwn&m!fVq{~hl1X>_q1t*2+a;N#sw*nPA2al0@mWhTH?!Yc`;e*dV@}qCN545!z*y&TW7ER-X zEfD@?CjLW2L#ULctfg(Xq4sP)66d;c+i{8Am&Qiny6&%?vQzjJlM6zq(${Blx@bT% z(96tyO7~oUU;#k!xGAJ3pvm@*?cvW zVyuzfxzgkRSuf-#fLxAUfHxl=>}~1^N}|P|G8-=kBr1e%f#A*8e=w z|7c?eo;u*vBQ*h%aP#XgSj`QD1ml&lx{Z}K$gBRZ z4W-Q~Ku*TSm`qI(`ETTD8%sunw+XeDo$v15C3$&g=VV)i$D52`8ttN^B?=@|SeN)D zawGA@;RjaMgy$pWRb69&a}H|F@c_5$cxW>i_j{#9)W~k#a#+13iLJ52eugbD!m7zc z@Ug=nmi`9@u-axbl=h|t*Gla26X{}|)*%B`90LGiC7^cS+M~%awH1;_3es7U7r35m z){}yVKJ)!y$W$zU7UH9tYqTKRhw{)@3 z5g^#=%|%NX3Y*#spwJ{pzYWoSexmm}|AL=BQA`VvO?=X~q#`v-kdIiAgw zLH6r1kQK$ODX$#dH+YpWJ_UIBI4LGTU z6c5t#DUI;Oe%=_zo!=v6=)NJG5>RC`ys2H-|Hru-L9UuK(BuobZ_+LFDeLs_KJdr# z{OtAq`FYa*>A^>I0ARR1TFwwFKV|`8>nZ^pg8Icj?J*iiwbOLi!W2~B+7|$>W;YlJ zUT`OQj#>$46niV5W!NN;(n+ps8Jql3K_4ZLTqnV^*@D#oznp*N{<>=x>>N9U9FvE^ zt;Hh};p=&}$I2Yb?f|)cUSD9xL5eZZWLCV8Eej(Pn~HSi!Q69HpxtEeMjlIwm*~Up zMqtadTmky7D%@_^!zGkwOBB=s@JJawvkP=%QP!6CJrs*r@1xVCbwqMZ@;&K0YIYx4 zbB_tfH{M;$9uESwh#SN|0N+yW#V=K&MK%^I5k>?Wi&4uY9ylTOCN45WTfg{&l+Egij?pT<=?$K*Ex{8(y8I)|@X+tNs%6BOv!J2tdZjZ+GE1i(fly{-gfohYL@B4TgQK5Y2SbN z(P8@I^Agc>8{#CRfQ4mmprJ6JVHeO4Kn-0L#QO(?rqe>3i=tt@{Ta^r-i0H3sUT&N z7~8q_$_v@G0eYu+wfpV-+96*fj$2{qY%x#L+5#b+Fu%T8*TzCcB{aHNR`!9Xb=2-v zANn+&(R>1KK#>_==;sTl-%I0!EUp@;9fbAeS2$!iHt5!wgnV81LEjsUS*uuJ3gCp> zS@$-hbexGh~U{Z~SdLU^#gU){1(79ct{GAm#naA%B<%;LCMDynQ@W+uCH z=;Q&`J27rO4d(bGpxI-Oej1PRhIJS!^X_4xrK1bE!Oj3^|9X4lzMk6O`Mq79Ne{OE zXIuL}Jhr9y=U6U^F~P&qaVL3srKo=WOtUdAaJ(@C<+_m_TIGD^BqkU|$JCrsP9S38^1iR{G4Y?U@hONy`alm02-SckLnMxM~(k#nm zLUaFD+wlbB zv+Lp%%+ERyhr>%Min}ZUL`G{F1Vd^P#$p5ID9b0H4A0FfU5i9Bq>*=WW*Wu@nwrBT zOFzFP-rh#HSMC54Hi#dAN=*WQZ}LR(wq#0ldEiO(>V&}8nJfh#`OVPw!+wD9_TR3^ z`InhB@1Oyc{IX)SOo_%z&(nReb@j{aL%0?=Uv1<5?#dv@)lW0D>3#FgJ)qdgU0$u``Sm@BtWuQi@ zSI^@fJpYvvd4|^x6&wu-VlSo}2gk|pc%7;ziCo0!~{P8${&?vI`&0 zcLbZ#a2(KU`3hb>F4g4}8(?S}))=;@4Xno2*!3i-GJsytI5qf)ahEb2>oYL(NVO{n zL9?I{4K*^uSRQ`U#WOJ&si*cwQq>9+5K4BZ97TjIg=HZz?yN3x+SHtT;O>NJ zu~w@}@{D8u<53@fYRfY!5MuLM%m%lA(5F@{&( zP*G(JcohH>;PMz95~{!|lKyn+3|x|dGH>E`M%03e+fvwl49kWf2Zt)#VEM*iZtlbi zA2zP6$xh2Xmjd*(W!4gsnV62F#3ERSI5k`zgU01gz@ zzM(l=usG0VTZZV?37A5fFUSm{lA3yA&E#N+6;$`>HLQDvLORKLt-+J1h7fO)XQxtw zMEI38Q)|qQF7{0b8%RK=&VTOzay!>=r$t?w?RVf7$BeJ@f}zNRT|m6lJQjX>X=z0& zPK})}by{Uby__agw^!rLA()H)6J5Dk#!}UG0}j!v+A12gMd^k<47IEyW4?E& z=Hw>^MVWCP1_<9bwcY^RigyGo7C9i}G225hx}FD~1a!F((}+(a2u-YC)13?+De(&g zjx>30PT*kIKHWW?_`3xHhWYy?O5ZcU-|t%bd?E;Qqk{Cp(tNl+Z#LozD;_|(;8m-v z%t#-mp^|%69Zsr@s!Q8MrsiVJ|B8PCYuZcY)E!br1L&Q`#6ymrZ6WnEHge)v#$c1* z{>7VJmecPZEc}))uzmXP|M-U+`Zd0w5k8>*vU;lh&hMcbebPGd`@#XE z5#8Qsm}ko7gM$9vwd>*kwAkv=z_m=G`*VM+_{m*QgZ`&ye|`RQeHyI*5nEr%wo^YM z;UP=)K;T_R4hB`)-Z$XYNc1~3MU%KYCy?x`UcKj`DyKg}QH z&ftCf^TsFOwQo%3`l_Cpbc4Vl0`-ak*5jZ{Gh`b^Bv)3*|SMn zqx{j%gGY3aQn*(wXQ?aKziPP%U@qJ#&3CSuz4fW>(I?XbtyN_wl&+1ReC1b;eLEj) zl7b&QhzKlAxwQP%`+Xf7Hi%`p*l0Q=*=LY5Xk}uKoD2Bmtn1F(0njK$eQTWzByJ8m zD7lZh_}Yd1`Z`|9BbqefWx#-E^OH;x*HRtAjWW3Y)$@#pj>!40;q$i{LfH~-X z)tu8s#ugyO7zUNI_Ekfb?*Oj;&2niMFURkK`V8*LDQw*<=Y^|n%1c4{vONPj$lAz~ z@Wc8cLOKIguVlE5X4!?79MWrF1T9dv-L9)7;epUA1%;k3WR z$a25obH5p-x|o#Q3ZZ7srwgG{visT{p0SQ?qfY&E_x}+3dl^EpGxfRM)qJN8^Tc{i z-PuPMa` z(3)A~3@wig$91;7Mgi8Orun_LQt+Y06}Fk&CrT6rKmR_Qg#(|;X!bVg$TMqeLg{B- zhjZJmA9gs0pTQZ&brg;lPt{Vrmf=x6{iNx==Y3mTjW@o}#5PIw^~CkM_$=|nyDr;% z#hA}Tb$OOri8}GhmkztLAV(yoOvUl#2_r<@*q*YyE-tiWdxdd?;O~^`!kDgH$AWyY z&_8)?mUVeVVuGi7z)$LlQkq#3PQwJguqw_(tu$tYw*I}`qaFGEaQ}}%yi{~)SZm{4 zRC14+l6L~2HzLX-M^jzN&~lK|X>yA3{Ed*6>3LQ{ea!ScJ5tSjkJzS!+PSyryTvOb zp=nE)R`c4&CqoAtZ{%S2V@q~f`^-xtY# zn8MgT>RgO?RNCwud!{fnUoA6Ze^(>0t9FVh#!bJS6?vOx(#!^3R5Q(xSecIXyr$H8W@T#kg(Z~Q?EUmwli_8tCAxGET@O`-rFZ8PT&$$)SeMo8 zy>(`pkwxQ?6C71iVUWNmD@Y}Bo{@VpR?z=3Gyf7caAi7rEXznJWI9SeR8?ht5qDT@ zM)4iVOS>oMIaN!39p$yUx=`)SzXDS5TyKkMPVxDic-E)lzxc7xIjh0h}n%0yJkZLc1>@U z1doIG@`ur&SJ=nyL&obW2Y_Ou4(BHQ1M`k%_@=K1b{~(`(MIRHNBaC11d0`9^d1%B z^K|;6GR~yr4uzGJEk|h+qUugw7;N$haVh0#ucwd0l_`yT*Rf8iHMsuL$M=4l`tlQg zJl!gIWxCJ6esqqz-rjgREd7&JEN&CaHbiIJqo38s_z4$Ue(*^+2FwfuPFGRASi{E{)3}B1?fY(dlZut!K=Vx>V|viXt zVaZi-Y~a-P(?EQ2JeOh~bjRFLur8R8iXOWXb2q0~X$iu9Swe|nw*xki$?}A^?(C<` zk9t;tF(D#syEv3X9W1vd8Q7dJYY^cM9^{y7KC>u8=WE3jg7hNC`Svq=v) z7o2qyXXN^nQGWk>+#U zSyZ5Zfj$b;l#jyb3YPZ1t$<_X{znK&j}3{-$ek(PQG`F86Iph2}%Odbm`7 zDz_qbE5_eB*GLFN>LN!LHExa_ROVwwzPUEQvh44f==Vyvd8M83l?zeJnpW1FZ^|2( z5B7;?3LcGW*p*jrjSaQ2eTamo^w!<)^u@iu`eE^Ik;GEt%&)*(dV3BJdRqngrJUFk zAmL=*J$OV+J$z1gw^arpHp>KV;iIX8px0%qpsF4Tsp#yaj_KznD;>rjjuIt=8mKSy92q($lldF7BVaro)8h!(;f1>mo{ug_=BPAC|DW zD_xB56rRUNApqM1DbGZW2`t%8oF%@39O2Ua&J8q8Xn0#sH25L-W8fgivpq#FS@ufa z^(=(Dh81Sqybfa$Lo7l|4MvtqhAH96;XS45a?y1Xrh_MIr_@e7+sfE~2>%oJ%PWV+ zr)8Vzm(Vn`67S!H6tg6&(;S`hDQ?q?K>NgHl{c{V{MLAf+oWmk4b&l3o96wTP->itbY~tfdb!59caON&U zZ+7j6`$N%PB}Nu5-wzMImY7m%(D~jQD5VZ$%DXy$z_G!OO-?HM`(~5!@b1N#Fd%VK z{zj=E8>K7sy;$HY-w{_qD7Iu|Gx*F$m<`#r-}aJso=U@J=@|zqX1Q!C5c+TqEt5*N5oT+_3^yU?kJrhD{Q_3)JmSJWHSZUN*YmV}sTF zHFF@fnxa1a8_v)HmzEslv7N&_ph+psNV-rO9{jWWTAQX=@x3u0ZN9|tiD>=0NBvZG z3sS+!tX4r%mvXy(!lz<+p4I}JTY(MCugy=X)(2)Jy`TGIw;!`^Er7cfG0W8f^cp+z z3zv}~Q?1wZY{UfUlQWa_tYjue{$lm781H(co*O4emEkN_@34RlEX!`Hf%$6R?&Q~U zYFO^~P6|)pF-osvHA@inuKV=u(whL0W-rU%5u8S|y%K3!^uYoyIg2tko=gvYI*<9; z;dp)J%QCW6sb|RPgLI<)?`KlKTF*=}V*^i~jdOa|yW-a*op^7o?Z$O=^NR^Lln9TF z>)Gn=cY!y`PcxY2xoT4hTm@5n9Bkpj`i+jbSb13r#>ij0DO)|^ygMFUU%janA{ zXFMf_?KLwBYrEBr|I4-gt=z-#1}oa99oe$06wmnJnbdv$iFWO^SJc#VkBj(JAsHl@}?GcBL)XV$TQYrlW1&omoA~Da*?Gw9D9ZTB%TaV(g zzIr@)fhWIAv3;9kAKj-T(tIYd3Rtu0S;I=Fl7!rp(DeKGW|zsCCAUvr!!Norr=sjP zujD{v%v@NwINPreM4(woXo)VhLTKq*?cmH1_p;gzZ=DWJp13agCSAx8Im=~R(Rya~ zQ3+s_j4E;4=TAc7$A+m|Jia2$$SP=Y z*eOU!$THAxdY3w{YN$Y%?5RNI6up5df0vFkKy!cDgZRpNgY~NzvnGkD6J0J5G*k>< zDK^Kvy3+UY`5?6LAXc zN(pz|g&>NpQH2J74!}&1a>}5G?rdwrlpAi2-DO0A`CR#dZogJd5nqV;#!LF^fkkKp zjH&;tDqv<0(%lkB7W9ZzVu1J(POV|dVL^%;5h8{NG)c+zs5h)KpEXjB9xG2^$!(tY z>%9;*^+h6Km+ns0*@x+umc2mC0MCM*eU4PpPdFm+pfNl3Tz}27C0EosEnDQ8tV>BO&UzKb#(HdRHe%}HaaKMhR>cOgf- z2OH)cmIFSV+qEOP`kS-~Zj^ogDP8Ho$Qs_K&@MhQD&2I!*pwiyDh_&L3QJxdRu(IN z$t6D*wA0*fD#Y&DBV&@&3g1gR?1V|yN#Dea^Ll2F{}MCo^h!ynt~Yb)3zufGQ;3L; zNL|$2qva2MlUDV0(mxiihh+8xI=Wv|I-BIp6FS=R^7nzP(YJRIm80t7?o)oP4WkHv zE;rl#Q!6}c_Bml+tN8%%oyYDHGXac3lAwM|R*(Oi@}xvvULQN)*ONU4Ro;B>V89<_kHW7oxkLjP zPl(09Y_hY=aU}uDDY*dofU9%AYI6Voyk1@L#>-lM*{M!{NzJ_J%<^c_s4Mbeww&*s znO_a_S$_L(tf=2O8@Q6yTU_o)ZoEZKmi)0VfRU#aMwpZg)#xs4zcSZhzkp0|PU`;^ z8dqt^pLw9snN{g-Z`F{r&A=V|^E1YGmo1b&G-!0E|Fqa#ysMe&`28CR^MUd>;k(?| zjMD2_a~JmR=y`ms5`mVzs{G{%2<7&2%h|Min{vbcjAR?|Am;)avC=Hfyx6NhF73|P z9w)jf*kReVDz;#12s_ulc!WvLa94><)tm9)@KFSI6yBwFwJ+u8&fMJAxlGT(!#50Z z4&ze_um6#~A!{X5wiu<0l`@w1d&Nq<5R*?xAhS2hP0mZmDY5kWd)-$UVMx zdM>-F75hav>6J}kv%%c`Er~X&MOO=v&!=Qk#M&215P_I);SoQ+xv_YBqSElfYAt@@ znhq(q9__Bg5ReWQ&$_(OulD}4t7&#Ss zH(jh;X=`US_|rurmU*v*^=0QQ8f%fU!jQJPQvQiGUA;Qtz->fnc z)0^yvG&iJo+`7>CZ=h{Qz=OC^Ub(s@>iCYwESe?IIKsbfX9x%FAA4^)MuAMssO zyE^c6?peZN^SV!6iuNfoj#3p8;F~u=l-C91PK2F!>x>Sx_#VkEnrZKQNYXYwDt zI=*~t`AFTTOqS8AeSH^mJ#6>40wl6ZsoQ(&enVDmx)J`yE9D?I^Y^Jyqd}ppk^9N@VE1CRHSRzpN*eThNK<@pHMVP%#s0VH?C)K7=M6U#yWLp1g{iWc?(J! z!@?AO(WS*b6C7oCc^@2Iqd)Wk^A={gcJO)Z0J;>xxxmOB`n31{5Wh5EtYLC8-d7ouCjFcY?7CrF_*=OM}dI!<>J(NXz-f&p0ZmGt5E*u(R zGwpt|Hh>Un@tt;M!o5FE@=loscXsQ_im6|SnpXJZtRf1Y zOV4?bn79HX*wgZZE}I{beRl({-?UPE)sxC0I<$i88N;=y9YP9rXa;^+0)Ee&A?|w$ zF*97ISL3B|#$s}er-|a`hBnrKV7ob-z}~~wpQF9Z5t@6zX|7!t-t)BEWlZcCOk7X? z5IF*#OUEff0-@z0tTNioJjS2Uz}n%k=pP4k9Gmvs*_+60&8wxiwh`a7;Dp_FQpowi z%&>lq#1@)iQ~f9n)zDgk7E`p>pqAEAbO-Hl(WzYb)NX5Bk%VPJ%m((`u9z=(kj7% z7wVU1If<~aL3=IN+GUnqu9zQw<>_8IC&lV)@lW+|nM zcjom$Cw{QxU36g;#Q_=;X`4;6o79ILqB#5t?QkqY?%VOyM1gNrt&IJl^M(i%TqnYw zH#f;==TuMDncT3NV3^;(f-fdcF7(@l$$0|PZJkoyN1rmzkfy;%!eHcdB9o{;986JA zONdFnJ{)l_-D|&E%S}GXSFp$lO-_@ARPoO?e-e^>o6K#NfX9Rwx1*E4-&_;?Tz~YX zBmK!&$dY(^a%sqtKD=h_<)1Xe{O7(|_C7{(d$39OYx29i-Yf^IZ&++(3XmQb%iG@W zfYJ1@b1)OCB8yt>@<4)p@g4aS0 z%oSS3)lIuGdUVW$AF(w_w)|(UePQE>x#CQLmR#6WSq8^--+(l;N+>vFGle^^VU_e@ zwaN=EM^nZ>r0nRX54JYkz+Q(@-{-)3Im`U5tD+CYp^Aw~a8(M=^I4aLcfS}fij^A0 z`LyHcX4ByB9nBB^&;b19&<-i9nz!`eo{Y7(i62OtLu1>}Ia;N;`g!3rzeFpK*+i{_ zv}6kZLHvdhr?vEO)P8-z+m`WZFpcH(ecVv(xUiW@`yALq0mcDOOGQKz#RR0x!8V#Y zrJ*W??y8rEPm`P8L1e(tQtJ`PQKJiskU6izlUV2!3$(|n*q?sG$_Hih)G*<+yFNIo zc)uz`X7js23_rGqTHwEXHQ?@~egVlR^a~O8=1#(dQf3A3&%!nfl3W|Emg!;2BjPUP z1zhYKm?7=b_0G7uUv8Xm4tkl`{(y$P&|va+#0ZIemGUpV)y5{lzhaxtL%}^w`fT^00sA>KKftWi~9Pf zCW6}&o+JDE#45_DHn20unlqB3l-Y;y^LG=VOsgNBvc|8s-z+S~>opDroYmv3@rSX_SqQFN3IL2}+7Sux4zln*LJA zk%BEdcK`e~GJcC&p;Xd`e!)F*LLh9o$)2}WYy%d6&d;Y+`=6a^g}stFtO;Ycz`<}P z&IkU4MZsg0U6vjMpE;Zc9RBdn@yNQG;{O|A1@d8q24?tKpdapisvS<@tkf_h6e>kc z-{&LjojeHoiH!recQzYX;jgItPql$$2XRl=P{Ve&K%(=Y&F9Dopf`CpQQ!S@laZpb zf~;*e#CW3jYWiSr_@kQWPk@wC(8+#m8*}`KUoGoox*XsF1udX{FTr^JgfX8b;L*Wh zZf?z$#jv$B4-?EW{_ag;uc^fpA(&1)Ds(zj zzMPS0wMF0_qGo^sk&r$@(D1jepuTNMkAYhP^BF$Ysqe8TbFI*?POBz#M(U=g2~iOt zs14VpSu_Cd?&ssr&T6L~IHLcM8N@{hCbdW;qteasOV2C04jwsgI77Zu%MwdqUX9iVl%d7*lsm!)Hv9rsO?h)2xLqcO&9Cr|5@4HD z_JFl|0HEc5q@bK``n0}85Z{+PkB&K<;=`-G(9YjcZ&pLMK@a}HQ5K?TjfHuQ;gv*x zLUPlc31}@XiKt5G9gFugzN~FAt%{Nm?br+~9#?rhN1Zy3J45ZVj$e`%ASa?BTItf_ zg!;p44TSo_{hulm4bV6ZBSnWEYM3g08=7^a^R&wuX?N@%^hy6rN zW)%{Kl9ZmjBIg1&R651dht&F;vP{MW_JVp7@Y3py9jkhY&Mg`K9>tut^{%xR%{6+c z3<0v$P+fvf_zQ)C8E2ZpKZw3|dka`RBP~uZLzd-rgtH3E(w&ev5*SAWoki*p|o`0epX!Xj5LXBbN0Dr=Yk69q;5(>9!6vc&k zV~5bCq8w@O?p%gir;j;Mr~Wg8A;|zsjc_|S7D%%Iul8 z6p80GAQ!=LL@A$n43sba3&JH$3!tMEcV+t%!mi<<<}1)xk|{8SH6S=?(GB9cXI!K7 z&7-o8pcsfx{D?#e5kIWyfHf9IZ>I+mj=1Y%+ZXCjsFN#R1r%Jn$DT(r!oZH7fHb6p zwM7a}7tQ5rd!;lbGxGZjy8-?m`8HA-kYef4o#q?s2>6>|1#?n1$QYw3*zjkp0T!4D+Z{uN9 zXcS_dd8LK-NG^YtagUA*U!Iy}79uYVu8KBmK4i~nLM=~6ypBUd&7v=0R>3DhKQV7| zY|s0MH6GLW`)S;JHQ% zIiO6{V%oolYZ6;_#xtZzbZrWs3pI;>nkMML?_t;;-O^lPmrc)2Yd0LF^3ktBffrgj zVeQ%rM#2-lojfz1~NZy6lvrJkU6Lw?s#L0Ldu^Q*`8fyS{NKOrN z@19ux24xn!?mN~6u72vnyVjmWSFth4tbHSWFz`hW1m#)LFI2J@w{8qG(eW@35$H7fA~E+vqaL&kR&yd~#d>S|G0^(PXQqTUi zOcwwaBSEdW;d?r`_-CQ*+o7&WW=WQHc_OZs=vx>tqGQ^te4Y?2)r2=7)a^K&c<~t- zzcvRzy#6Bm8I6x>jp#q9MS;XWJ=8G;P&0bLQ-?7Cj^7$U;+r)C@W;bnSYzUxJg-9z zMok9YVLA#liD{QE><8=oqsiks%8616H>YP4IE_4So*+%S$5fNXZN1~E#R=&4MEdeu zEPO51F#a`ZUnM$)gIx2LLF+W{S##1oH|P$ULUQ~Fsyo4Ymajc|19~cG?XkQ&D`SP zg3tj8$bAW1=$BK*?rjN%)&0rbt5FB19rYliT*sA~DS9?t&}TfqDcuHw07DT5LtmR| zpI#{nuO)~goA`ZU>a0vVDDVwYl=9TpHF`I}A-`#Vce~Aoxj9cFNGt=2V_z>1KdrjW za(L}sv=nQMOXqhf#o|q@d?2$jOsav27cjFEH-@W!$-?b46GLMqy>Ln`Wz z;v-`c#06(DKE{NYZ^}9mRy&~!d~oy`>&^^Gfvi&dlt?E6gn9J_0GYh*O)LImRn<2(g#XbC$A5}F?xk1K#hRwo}6I-{9iQ?GH^&Q9mxZ8T?WbJB>=P74Fijf&4F{*SKlVG}a;3u}J^xysFLm0h*Mf zZLGW|t?zHiqC%7sE?R$(Qx2yEj;+v-clb+!GA>#7P;phhX1mNXsMz zB(tR`#I=P*dKq7s1cQwRh5&rFo^)#iP`Y=8lw z0}*&4dTLN`K}dG+H6Me2H$F7ap1KeB-1@%M&f^1>2-uRR@Z>@2nVo4}6BAk6<`^&m zTebT8YALJWA!0(KJAWrSmr%czlYt}o+<^icqI+=Pb1jAB072{*1KxmQvuTK-oPCjl=vF1)@=pK{z+y$ITt{jB_sjTeFdIh{8*XD z8*gN?{!5-I#2yJ2zKEcBvR>rwCn(u9QHAjS4cHZ03WfDMj1&jF6qLF*Uqh> z;Q!(yfRP?TvGVVeCDE(gA;lp{^}plqS2yY2OK9yTUdQ?y-1d&Ic0FK8d{t5ywq1wJ z(W|ihnOTO23*48koSIS(&qCr+{E&Pg7gEa9+gFVgxWOKHycBBz((_*(x$fLisc#;dXU*AyU8c_hqs%oZuG7m?V`lMDqo<@ zpaXGPSDMyUS>5p(DU$r6m3Ia}&hZI8;uaTQ%R$&MrQLvZ(5iYWgtjy<@7uO6_-=8i zsa0(vAO_hlf$qvG^3RZk_$yi63IOFCl@;sOf5tqd3Hkd?_mt~d-E{$Xb<;1f?>1gj zpTKztLLH{~3cd6fqf3gzLW&@Ts=O&|&AS22r9v0*zeyWFxt1NkiC7rY=AgW`Vfg@` zABjSkBpRSF`w>GytLx!p%UdJy>IaCsQ}^->`N>4>*?9DC*Ve98pCu%q1{{bYHVEGi zk_z9XIyAq)706nnkRP*+Ldip%0<@!4kTZxaY{QhiM|#R)H6)C+N}ZT>q&EoYn)iuL zVK|X+&R>PF}9boSi<3m+VK8G>EB`TfaajUbBo(0y)Xa*s|a;wm_J zwWTpw-WfR1nFV1vN|8mAJ7aqLUrTS?!5iC5ZMA_x)|r)JAuVw*V2>WAxcSV2ELpf9 zVftlz+|f*5LcoD>-$fYqPId6cQX_EP9mC;29E>%^QF9OWwR?A@)~3~^zz?9qg!;~e zzdFNOEok`<3k%AI=W<%ZYO@dY?<^sU44@jPHZ>Ah5fFX7FX#@v@@BQ>1kFz$0yK8S zJ%*jZ&i`A!rdToDf(^<6z@Dqhu;#6{%v;0Lf1H)S$jTcwaMJSq%)X}{w3IOgkx~Ak zn<+CoAQuiaJkw)Gx)4zHP;O}9D8IdNV?7P#E-hoiD&vvm;}6KjE&w^NygnHc51rvP z)3!MOEqz1I1|SXtdqq~dAb+m|6F#y_$mT8xIpIgC-PaT-4IQH@I0-A6CnE&M#Ln4#}&gPiM}E$&pvW7L`wqX`nXh)f+$JQo2x4U1A(&zj9=8gm5T^&|a4 z!l=+@%#!*WSX(rnr;ijJ(ok&qXB z5K)c+|7dB3S^g(QaS+r#=+S(Y>$culYcqQfl}xt98kzv}V~07gqK?Peuu4HUsnC-w zlDjrwi{ur5KY(`Wm))JZmM|cy@%7`;AYJWGc$L`0O!rK6D;*Ik{&Q&^;_I8&&ETCa7XIs51RTPYGz0gg(G5$@mwj zNybv(fFw9zx0({u7eDGTjRLvf%*=zNH!wA@<7DT82!<1Jv&d;%mkqt!ZPc-UQISoL zoO(zf2EMnL_A+?V;s6Yc8j^xirSyI+=+H4k#G)VQ0OA{LR3OWbyL<(Y;0yGe%>S_! z)Wn^*ngF`@F|O|QOA|n?0}(K0eCh*wGD1aUY=#!+nQyT`bTwsdA#W}Lfk98Q1BYR9 zPXdsL7F}4~zg#y1@s=0SkK?51hT4)!sV1RlM@_TyOn!=~~yGY;S|j$dinu-61+HVho8L@Tq$NL}$zuvmI| z72HQnI0f%o8y^Il#QKCaTf^5PMa}E>o%3?K;>W=};5hAwd%u0{ap(i6?0_6GbSqPU zAOTdtJ%&o2LGw~gY$-GwnUH_4P8_>U2ae~yI(tZigj9=Dw7$vh8P^m!!Fxe`e4D}b z%KIR{lsy8vL@G!}oMP_TVANsyHg;!3@_}F-N}|j@h4;IF?X-6(k)-*@u27rXv^QTd zhdQ+UM>PZBA-C`xO`p+NwDiT@6jLy99zo~pmh!%cnf)`1?G}vszov9J-_=Bsa{*xD zJfQx(MLIW;ak7D%$u^XP`u{Th*kkavzO6^j!J`{_a-+%k*O>5dU`p^)tcMj|d$Lg? z3rH?00gMSCr*kjVw$!R&L}W{*%u;wMvxcYq@nfc3hKb#%d|uRs0#d zyXm^;PnRrgBuPP-ryu0A1L z+wqQON!ucuWtq@WI+kxOUw79hyDHhtsq)um-+~ciC!G9vs&DU(8;h@_N*LLHJC|@Q zdrR+}+P1J;#x7~$=gG<&KWFk=ucap~%$eN^#l@bz)LS3BTf zF(%HvXk4dm>YPvROAYt-+)aWILf|&)I&C2T&liTh z2E!KSy+XYUW`?o^~VfP zDcGW(nyVd=cX=Njwb0g;1ZSqH-6&hYHiGz#CP+-OB<5mZ5K!tY0de)AIv$%|EJ-;Y zlHcbt^TG_Y*1#1&OAD=In@d&0f(=-<^Lzsc+=J$o~W{EF;W9EUj!w)`%S8TDyCrxpVtB0OG4~Yn<6`U#;A>jQNud5IUm5Q2nr}_^t z1uh6k)q(J%8RSXdEb{+U)=^J`tYJtR%4*$HUDpY~F%KCxP$}CB$1Knc3p+(=$=RM7 z{_0fl(WW}1*^%!IXcWNxV8BQQO3j2+z*86AXXN^YOPGf*3~QtfT)*BSr@Pd^gFS4h zp?p#kh<*;Lu@5%I6J1&V=Gx@;EQK!T*V~Mu5PsA5zxlK3i$3UeESH$O)-cTZq5cQ= zGnP?18QpfHx_#(Z^dWWQS4;6bya%ddD{ov`jt&mq)gpcvmo0~vK^O9>jjgTB`FELXyg7amJj zFV;=!2YWoJ2G^P6gG8sw1$5>IdGnvOr`8VkOnG|zQnqvFouC7r$17yI;2g1p=--W2 zE!=4MABpM+?gYh)qN%R49N{eT;k{zrA4ZLN1-ikxQSO0>Xr+3IL3zh2&!>e}%JE1u zrE))(vF+#~B~R|64>LXDH}>o(QtDfHl)Mx?@vH(N7o?cQ8z{|H?Zhu8s`G1mW8|$A zKf$o{<_g%!*=dHJ>g%+_NRfeC!^<|MsUZsuUP++~yobBsnwpyeonbLc^SC+Lf^jXMdU9_ZoZ}%=5`~`1kx=jv8H@cM#@N&wUi;P$|yT5HM9G9Zxr0d0=1@ zwo-}*i`KZ1{~I(K*>S}l19cNLsK z5r<6;u;68%6^6=9neD{8g0?=ms0j8JMaacD#ZZe+TI^L^83?N`NIg}YaXxs^btN%J zCSUFl)J>}HbS}|%0EzzE^_!naE+bJT_#Eep92dAMrIWQOEUq--1e?4IR!XN${c6#U z3CM@X+@Kv^P#4^!9yqvniXf;XNUI(=@eHTMW_wyk5rjSL0oB3S%CrabQ-17tD?`f{ z50Hgok5L#%8=r;&Mvq$T^~pfL!B;F|x(z1mMOt!zkL58!&X~9*qxP=jbSxf9G8nrV zSDNLw61O&p5nKj)z@-$?2siWcqGDmkHjP7uZ1n0y%C-=Id`WN!ra|cu`o(9nu|f>m zJ8jiA(?NK}EDy=c8b@GbUVzscSDrY^#4HkCwA-nNE*T&| zrM^GGXJ4wJyrazaVR9V<*nHT(hE7HVl&tv}1>#F`5i;BO>+xfDMBh|$3AXH38@Ou!zTi7n zKUnv{-(H}F8>XR+Nuo9VdA(<_b@>+~*P|{_^c#|8M$VDY#BS~SZwPFm#vk&iarntq zB{@Zq2-4&?j52ZT=#V2pw-YuJcszot*M>1diCeocv^Wc7R^W8C1hoqD+G~|8H(0^+ zQv*g$NqZl;0wTC=Tl}6Z{|@*eeikn0G0V zjSS?^97`)DArL(Y{LW<2DT268rJ)9k!>{exC3;W?h++H}uOu5mX1v6Tvg6~_L=f4~ z2V^ACJg-jWezUup7rSsNbpl6UxDVuoPK!Z81j09LoevcV;c9+g!7G1$oPqxxexqrZ zY>)(VNJOp4O~ax0f${km%a_M3-@Sp+(Eh%n!WLSImSCyjoIAxvt6Ottm(`iJF=jRD zH$mIDGYoI+{N9+f@HYFChtq;b@%!)Z?hYp47ZeA7HZ2h1D|<)gr3clisA-tsq(A6d zdgmFB;R9ToG^o&xTP1Je*js`UCTMrZGJc=IL3pP?L>^j{8B>7phWk)Q8@e=gQOD;lU6v&Z1ihWf}PKY;MfN%iM7|q zM7eMb%zU4#m?V1mQB*KGKJceqphk-f3;@f<92Hm6E1yCOel_Tag*fJ;Zcez;GG{(g zK6N^;^5*1e;l0FH@13HiW&9>9(Ywel`M9&ro{*_Yh3;W#!QZk!=I;}pJt$Tr^va%D z>oL_Wurf}X+1T{Xs*Ic-Lix!ysWu^m#nP{{9SW|;wKwb6Ahk`tv5|3-Axr%=cojGj zgn}(CFRt4h-ge=Yd$PtU2B z=|o%nek8okcCYgqmvY=<^aB}RAn;jPUvKI78r3qkQ){3pA?!G>!k3Dn`t_A(S^DxJ z05m+3rZC9qix$wDK~z!~ z5Ui4lRSg42+vAhx%CuXM=oot29Qbv-^SLXv&!;FtD`0(z@PLEecKfM6T43#SsB8~NQ z28Ap%C?FCvMZFXtG6(dhEr#kw`m_A4O>WFu5h$3J$(>qwhV=T&N=qB@^yH*tBbO4cerJ!i<9?B0e;?_0%BUoc!a@8M6at z#Y_-KUcd~qy2Yc9HgUb#>708^c45p(hoLz9ItG^nXiR~es8gsW3UU!qd>oURDK>t1 z_Sn@n+@-TSEVjUoQ8$8j;5UItbI&Qnj2B72{B(H?5J(*^-$Uc6-hYqPUKKzFp(B>X zMCt6Z#8nr$fnRmh1N@(X-Jr&xZTwhRc+`NRxVI*T zeeywtds@?{8_#L!N)hvOR>Lb9e_O3iu3mqV2^)#JUpsQl6iO>7VR{z2~8( zVd2MgzWHoWP@t}YDS$3Z4Wa|HWDjU>9o6=Cvh1_ zT_U`#xfDj{of}_a*8tM;V9Z8w%tDjThuOr_;(g-Y<8ROCV3wM7Ymjs10vbS{P_EKo z0v57^lD{mO-xfbN`LU_hL|;P$qGd9yP!rQglVZkOP#JC9-NLmUMpr8e&qId9xDn}e z&z8E#}dJ(C{Ck>C?m*{6R#ZRA@OB!Mh@o$d&ze2}fRPPtEBdR)Jv> zVk$CC?-7eJ;0@S^AnK~cV<^DWJ5Ms`T)M8etvEG=3f90%x0x1Kd2QPIC26Hh8S(HR zMMhwmrybSekBGq@FqR^Mn6YXbF$=gYY^$>%ERfv*v;0}{?%DB>DgBem`S&k=Ce1Gh z=i^lRvi*_8^)ojm0D=tKVT?J)VXPwhj0s12?QAplvI8a-rFMLx-8N#GM||n@J`A_< zgNoPK<$^P}d_k$-r1YUn6sCwIt$fR{_e|(tv`?DjM(ncNCz0%ItIzPsq3vI)zC2xT zsknC!(I`DWk12k_G3WDWqNu3&Qj7%b8^`CbZL{W9)A zU;5YS@}APt<>lhuz5Y!6`J^yYQDlrUw*X4?GDj@XO+a_=GZ^+BmzDMkDlRUzV29YK z6#nC=Yug7o`Xv6>B)-J#hrL{AHcHo*O?w_6e_zlTg(B3Nl}&GtFCdvvh*wWNs(H1K zd&lcz5W=-?Q{5-68hqQg_nrf-nK5@(ZTshVBEq!U3~KI0dVU9bYP#cvcQL@I642X^ z?#r`k0OEpY;3Kp^FEuDeehzgQKz?BcCHe~|`GoXPQ)~8~t_@_RiO=F_WB68ixvi8c ztG9EJ74?m%zu5%ueSVO$HC7~)8UA?-^}xa37RR=el+JNluixi0I49^!M~|T3tuQyz zV8jtu|9s=HxI=_@aO)5EbAyUMIMd;643@rQTz1@!kusHe>j4ZHJ*EX9`;=o zqd?o!)8o4dyZk)-7K{WG?N*vWmGR!>D2B;^O|}{Ud9g3rP83?x#E7m!4N-zP5#3{R z6c_)!^qSe91=;Rj{guvrVnqAWES5d)d7Jlz5G^$rm5q_?xhrX zCar2J>1=&857r~^rRVm74lb0kmz&I9$iIGS8Z{Z*!CgJq7DFZ4Gf4I3_uta}dqJAVTN>%+r^Y@7(VJCoLS*p^oNhfZYd*!Y#%%W-VpG(_U;veGQ$J3Kg<+k<5z>)6GGt~3aTl(#+2w`p~`w9YO zKbyUrXDI9Bo0EOxXm*(e8VvqmtEAFji2^CHr&<>8W2BN>W#r`U;4)Sz2h>T5nJ)eA z#=-DtI>BRnxKSk;$9=1G#auvV#C3V$`wpCImv6z%r*U4gr(VdmF%NpDngq=^!651S z&-re`40+u)_ZmRP6by*|4y%Z^F1fe^rp?ZI)W_}Q-9#>VF4EgiPoox^+kGxSbvmC< z+o!1)nkyQ1GMOl6d}!F&I~9_;N8A64TsZX|AnccS+Su7`O^DcWL{*UJ5(Axk58h@c zmgTlnP0NbrsTn3MEe%(1GP3EC7io}7?4LDCvSnneQy&AO=WZpDypa~SPew(5gU3yL zo+!qT&G|Tgaj^5n_|cMdC<^`y_Oi1rBd%{)Mf@l~3NA)-6aPrpW&2WgA=M~R@nt-Q z)T|Jq`30*Wu+ujW>{KO1JeYm7oNTM~UuPGh>>6yQR{p$y)1mZr+0rV6|F{#YhPdEl4D8?6!|!;kt;%M5WR&_oR!pI^WGVy*|v;>=AKvQ+J&jbWvLnVrqVr8?>Jnw9fU6M+xdz(O}*a6h|M+LVUnU=0ag zTNBLErpce@^X?=ip4hXhO@`Sq@~g`MjMKxCk@f7`p>xoG&~IS&WbW*sO@U3?_51%M zdD{1ssjZ2Qrhz^hx1)5__2o5X-oqSZhz*pfo7Vi$Q!n7Eqmxz4a-BPVJP;#8%LDV4 z+bb!F5RD~SCEzR?m*V+$-z9wo?Ga#w$N7?Bzx4JcbL7BY=d7Rz3>aq}3Q$=s>d1Tw zH^988s(x{7o}tQVtU^1F9@s`AO~)|sbLZmlZ-IU@e{qU-X_X~FkGb7XABcZYTJ??j zbWk8VgY!88cL2LHO=WEsYMLMp%$C)!88Gynrv7IyG;hQm88hSV^?aOpp7ymR-6|CK zc&M#!66r}Isy_O2=+h(I1*{OJF{ZSf06&i*t85s=5=UD zY)O1dogS#Ao$g9o)}toiBU9_&gde8?9`)PXmN6SfOMrzi{0ltvWBNP>kB>Q=*!A=R z(IJLIo>f7E0b~!zG;e3vpWPE7l^3*Cl4`?p`657yLwNeR)L0|Ev-O6bAcY2*y8Q;^ z&>gKg(ix8;{ED}sa8=>#^lhhGO*k1~FKD_*LPZ68z+wZKAx-~-_bQn&Uuj|_fgw9) zfosdu<`lM~bU4vZ*)t~5bDSl&wpF>t6g6?;?Xf%()C(@bA9>f-K%%TWgXBIEl(t%! zWLHn4Yw6j(uHh?=5s(*3B<(#jYU?{xurR7Y9<1aK3TlJ+fc?jN@zST2#${)wWyBP? z&($C|i3_tMrN&6wdkxnZ51JTYccB5(c5(uClkMCg>F_`Ysl2ovgV1d?xV4Vs)lVZF zG0ML)O%Oe1HOK)GyRp8bZPD!akCS!wIyeTQun?l{<4c1raXYjPIvOclcmfbh&l02H z{?w`P+u7Tm$xddF_lw@gYH?Urn8_Ept!kx%bIYf7l0&klu%GE%O{E5=Ju+&RTK}r? ziH~Qs$fREb@SY>JHJLo%NBBuvT%>|?T_||q6dYwl^henC)r3ml4r&EK8Z>Jk(EJ^r z^|D@sTRTb6*K#`#rdD5lBS_mTKBhc(?*!8ty2#jDlN^!?07Lk1tysck?b3-&C+7k@ zCW<9+Fj1P?*hgizlQDJ5QJ&7o5ZxC zrGaCXfuc&MWF#n_?eZK%PSmm@3YC#dUD$9Hv$3H=%WmUkSsn4KL!~jore@)v4 ztU;vbGldj`++x#3D6i*si>Ce1DKY{vA7Q+{KhS#dhg+YVcw{-~M{r2HYxHUKH@H05 z)@S9X{>n_VN(p+?mL9oYd#iH}MGv-d9eUia>YZ4kt9FZFE0de~&{l&xpIjNpBLZsK z>RBvRoJ|&!cN-8qb>;*u^}?Gmm;ErhsN<-OGzHLQFrYggvBq0mr|mCk;zYC{E6&^= zSj8r$j%KnHyFDv6w*(ue*hFtJU=@D!`_Nt9;@ev}I%3p*rV~aUn%~iX3ZFI*V&99l z%Xv}v;#h6JOY_l%F6m|^>`v8liKBa2$Q~q_{h@e{dLgqk@2@!ZRB~1W9i}qpo zuH*Y|UB)X@($mX2l*4}%;Gv_nLJ?=7skKGv(8*{?uu{))= zV|i}O>Zz%JSwxu3AkSEP#zRW^SZ;BPJS|%HnyHHtPM#a;{Bem3CQcB1qe;NUF-a39K zt#p-_@DGmQzS?kdFOC7H~tnTdVLL*v})e16~0zz(>~s+%zki~ zq;Z+543OAIu&xoVi3g+X_XAGiMy6g{m)^!QumSaXGK4DApFy@}pwbWUMK3SkYYdEc zdy!kMcm}N|J91#`W7-v^lz{cs13@+jDOzHFYTJFsoPY zPmguHXCEcnkB@7aaryeL=ipPL$2(I{!_>+dH7(6>jO7KnnED98lJ;Pt&31t#AqTz4 zC4q1Q#zW9IzrVBEV3l9cahKuQLjM(fn4*!n?sxY>zM=zp%K)_iR9 z{sU2ZE8( z)s39-_U|(GEXxqH&54@6KN=W9FE|Y%N8Lw1U}LoW z_vbJE{dZK4K(!CG(}rw0pLXTaq1jF&c;O#K7}}&o?Hj9# z8t_SQdij={)LtA*woVDPub>nc_^&SaB=}C)T!5Y7M1LBkxy87Gx&3E($i5QT_TvZ@ zd*Ck+my;3v&+hf3KEeOsvUsa`-`4N7)x5GmY;~v129!VJW#oN`tkE;Y4CKgv3s)Z3 zt6q-6;+IF&j!p_^#NB`fm)=oP^c=G=LBvpquf}lIj@9d{RLbogCeAtCmfIHR2~HSa zT@!B$)0kjWvx&YkkNSg87e#kGoh}lsn=w+5W9D-UpPL{O)>eiT2=#)A_CxWW2{W#R zUZpWjt}UmnJo{Ykj-+#Al-~f;K*>xA%U6}`InaJbg|aD6)`MbXXNhnNkyip|emn{r zU>4Sr_nvSITZ`4qyq>_t)HlR(PU1%)x`<`i{`;;YMN3nV!>GeVlqj0!_*`WZjPBO( zaCHQd1imeh1ISX3NmahI29Zx49r`7X#PPh>TMNLm)0E&dDqJz&YllrvR;rM=grU5w z+aqcI?tuzlOkPcwX#gc>{8Ls0PNi1dd3hv*CVDDOM_2!?*1hH@W8V0c=?{dgj09Ua z*P?ircRM9-zUQE|C$8O;qZCFsnJt%T7@8hL|16yXRj9@-NCQmThz_ouYnt0|L+>A8 zD)_st-yXomajqx|&Od6W-(BRb48P2H=nuRMKjIWWiXpxDB9{!~jZiX!@qYDK6s~IC z!1~M5i##mDlvqjMN5|678|7%@1sDvp?wYm9y9&|4RE(U^O(uExsftOApPr2#!QhGk zdM$`~&wE*lA8JB$^^|F;bF$M)^-`0Qp9Slti-9^5X^P*4tfbwjIJz*BWQ6)fvA8~* zytnW+Y=38rd&JDQl&K9*ad#w%Dg-5@IIHmoiO{Z@r>NiA(iiLoA^X zyS(NPD9CwF-=vM1uG^Z|g*B-R0s?CK7Nrl@tWa25*jb^}z~49i)XL;*kI7nQ0=&pP zJ=&{PfGUx)+uktwD6~O)37U5=JaNO>o`$(oEt0MMb0(fd_kxpY-=Qr1X>~G1izCnD z79-XTr+v@n9k(+-ml0Xk{EYBB6@=;eQA19O)D-?tu(O1sV6$Uab{-G0N3l9DOxW4m z&vF+Gaz$dz1y!HjRKBz2<@T$mj(yUt?a$V3oh>Ff+DVc93J?TzDO*odVTX}(kj+~v zd3D0GxLr-I=RB{&O$7IBe}hx>EBf$6ezAW;tURXNhRY3GtYFc=={r$2beN|qr^*ispRH6%1V!Bri?$oe$`-Mhw`H**h$(+PFtKkzD*^??g*3qvWWn$ zHmqTZV|qUYfx-W5+dp2lK>E-V;N>hSwzM0LvS0=fu=Y5`Th@8yrcS|JT>)fkq9lGuDwS4+AJG+VPdw zNZQl!qArsHoA&e`h4rPYf(-txNlI!*D}yV!cH=tgI!x+(B2Xy{1Sf@z%Sv-5 zlYzoKBv19EBr_UI>)xiLT8u&Dmq?%U#vC z_PCKT3o*LEWcY*QxrnYO<@*CSjCUG3xjz%i!$7epd8n|~E$sR2^L=r=vm?W%Jr(bE z*-7iva!u$N*c{A|CxpC9wY$}Hvg@YZ<1B^Anhi)Rdmrg)!Fd*!~cp$wG?5B z8@n9z3r%VlFqkVd1leu}!$fcHrmu8`<~xcOU_&+1W$T};`=mx<__=U8V` z*5-{f@ODkBVLrXS%kOVp&ZwBv&Aeczvy9lruQ?zpTu0VEFR@Q0cs@m1`t`INnN0A?~-cwjx{3_v|2%!HEt`WvAtg4U=+6Rm0UpW+L z>`Ck>w5@mnczqnmgjqh?^#l$T~H|MQFQ?Fm$-b{f}fsOdWdFt(s*mvpeJ9asn<_?v;FP4jjKXPS3dw-y!3d$`+@gUHHxW8qG{)CG`2Ha*7T-!5q zx?^OHeLv%R?rYKGpCx>d0vnXg;kC9jMBuxt%T0x8i_hiFHc87yo(e#=svz+}=N1++ z5lyr+rIM;t9a3bqTPt}F^A(w5#-V!3=&4sziV4rRx;JN;1)y)U^UL?C$qaA`UR(jp zoR<i7VipAI1~K|4(Sj(y6^%Bp91k$B2G|Mc>3%6y|lOE;IE(RG8j{tr*j=Rxgk z>@;$1imRPUR@J@4wKus2V^ zUnN<NnOipxT}9N#i(w4=#gH*F?Qxpvf42Of zS7>RVNH{Y0A+$aw#U_`(9}4oX>iXVPG3S%7p=kdyE?_lBI1i7ZF(E_i!3f9a78%)#9w}Uc9_hA{%My@|H_A=L7SG(GbQ3V!8Wf zzA-G1f`6rOE6Ff}i&`~+!!L_)F6O$}4q%+*2C5goY<4(q6JznD{u}W@^T;3(8@yE1 zuy%T(&)k6M`Z4uVFf^@~D`A zx~j11mLO(BAH&0S1kTBUD$w@!rpRw_O8;t#6?~qXJ{2pvV%E0=22*)uogNEE{BBr6 zDgr#EeFau6uVjUi=8$lM`WS%IHd*&k&g_TT>PIU|`~l|_K)Yx%j5=BU?eUdfc(sNI z>%d>cl(YcsB9xE~TQAS+8M{Z7G}Ob*BlMKB1OJoN6eCe5CQCSG{_bp;1P@Q{F{(V4%yW#MZ|Xe|bw#oS9_#5(CAuHkbu6=-E0@qsSj@a_Gh2Fu5& zFEB;dsr1CMGz*q~S$(im;&AsnU%z5MW#tfnts+BG+nI*4%_Y0dLhOy7RIa_+EWQQX zii;4*!$alSDmyGN6uW^_8^_>B`S2uo=AS9=1WF{Ovl>c!jHC|<=Eqwx$A75Ka1U#k z`Tfk6@1zN9rAIryS80CVE~UAE@maRyraq8gUvWhc@W`D$Y;kXco3fp+RlheWfrBP` z5Mf>}$3L6VEmLGcP2~8!+wvdICprkC<9XW)fr_-=vd+ezrq0XzC)a4yyRw~^za}?C ziv-uM7^s@o)-8FEAN9MIP=RJOa4uR5l_GWTh{V77>&i74<@=Q5u)*V8skfjQ$qe*| z1Y=JeL8l1`^;MX<%FTV!s?x!)9RG0mt7rfW@c3KKb1TUF^Q}I@0Setzk?UrI5O>roM?&#?1k|RG$Ww0blF9QsSC0RXj-Cg9B3qADs35Ti+ z>^hq83GhX$YAq{UT$@8_#JoZD{1`H@WC(kkv<611ht`&yhp@Xfra{ z0i`vy$5BJHW&O*J>dB(EhHvYObqWZ_ztG{kS&HZu!FTKZ-egIuL`*R}(0anBrwh5c zIKD)`>3=0-I4ikX$MwRW>bB_}U2`ZQT0(<+8OkTu$vHmve*eSn)?{U|;kc332$tfk zoSd0)G1GaNvt7qoWxhhYurw}rW8wSQ+q6For>fPse0F7hn4J zM2W6-@`zH?X_uT~5?ekbZP$5tj9gtk^6qW*D#fXJ&Z@(mU&H=(KkbHl`?*sC-g~}0hh72cyc$f5_+P)TCH?h7fX?jZqso8wmqjH3o__3UAbN8pr!sC^ z)-uqbR8%C*SfgF3jO?dp!-Y#nU=o1szfBx6d*Iko!@^k8MhLV zxbj9154f(eYQ*dhcNJH?Lgo@X&HS+mx%<`5Pyh)qS&!ki zM8Z^b8h))+6)ExIcN@{grL zel>BTap+sbRgZ)aIcjBr13<3g&v$rb3F+yFp!2+X{$$1U0Ylw)X^o?#29Utco;1fs zKvmPJN}MJvF&8N4xm)m1qiT0t)WZE4l2K`)8e)iP5}q9=W`VqEn~3 zn%-!v??L$d8EPEDbplA6NHq_Wc{fWvvnqFyypqPX6f%Pt4~qohaZ!w2sSoPu&;LJ$ zgP+Xy559$qYY`@6<)K7L2ZPKbPwvSUl$W1lpMM>|s&;SJYj&}fGGmXPx27*MQ_Z~4 zMsYr)S#%ANO{&i<<$P%V{)eYN(iwi6jCf0G_4?ZLCkiXoZRdG=fS^>CV#s_8HzZ5- zkj;abSIsOhDV4;dX%jvk-NX8@(WIRNAUX zespGX@NPzePxgMI+aix~2C&@HZYymU_$ht;M;-g5Y1DvqJ9vtT@c?p**VkyVEiWIRZrKsHz>hY70~8ej3^u43O*}Sb%aP^t?6aU zbiZZXTS+K}F;2Z8Yn-W|7Gan_S$~EZRI;jWi<*L74F+0g`QCo`*SI_GBiR=;sW8qq zH8rKD3eZ3T>)csR8XDvM5b0Psbv{S2KW>$~jiMI8-;bRO30%fARcqm@U)mXLPsG|DG>5Mp#MZ`oK;5ie46fFNJgc6scB zSV>$_VPPguOm68HR@%tbfL&!RhFM(dRReYW0eyyUs6wCl@sXT%k%f#z|MGLja!#*t z)oZ<+X0E^~NHdNBr(EsnDWrHw=`gF;)JYKyCHZo-+6k^}0iQH3^h{Jx9n00?Ujr%k?fB=@VJlrZ~5cmpap~JPqF3(c}iKbQRlf=~m7_1(z>xJjiuiZo#{3c5f+d zne(qYe{uR*I)1N6_VpiHR0M^t;ynMM;(V;WdR(rzUM1mFSv>bRNR^;BY2IxvJ&j_` z*F$m}hE@+eQPk5F=JkI$^KafCpQ;&n>HqMQgt@G9snl3~*HwmJOx^(J;(&O-PFbSt z*o*Di_j8^@03|t>l}%*NQL{h`?{R z0etO7UTNA^>3#+)^!bc_ZypKD2hd1;ZS$>Q_^~55L!&f5l*;>)3#ii{>BGLr$&tW* z8Gb^f=;#?+RMUvmIIdOq*RMcOxj8e~rva~NUH>IOY4Vt7c(HUHg{O%wEBh6OngSt%%Zf`EOsUiNmwgKmodMpRVGWXRTR10L>AFj^m7=CH^w&;y+pMbgk5ca{9^b{lF*r7H=E-uTO zhUZ_nPOD!3&=H5(6V%TZiC_&Y@g5;Y;&^hbQV4CE|6Ebb>1o;R zh7)e}wO$%xt@E?urO=Clr?G)KqP$qy&pT7p+-;QP4as=`zil z)OK$Ty3>7!{Q5(kIeOw&1D`%!9+Z@gJ8YN1f3gf+d(Ri$>$pvN@lmOT9T(vwoO zuAc7j&K(>Nj0fx0aYk9hgn5f)I5zBwzGaO1_9}M2FaHXvQ0+Fd?}>9g=vQS5(`o7q zR^AEfTc)_kD^zWuZPioOlIQP4otFll`reOOxh#r}thf3Q398UrZo`|rXKq%lQ8Jxg zjdtM@N674dD0|-+wZRUlvng_4jlA^BZq&paW7y*bCN|^6dpB^*-b|VYYPA3BX>te| zm|br>-Kz92dRQKfYC64aI7uxQj^_S8`(BI=M7@B?)V4jlcLVd*LLl5*U}V$&sQ&=C zY?du#KwRU%R2M)c$X6bsb>RFhSXDZs5eiFCeJMhj3%sxkF1kt>QkfoGKG^vbH{o`C6kUNBQPA z6XYn}R>GkYE7`=!ls1&7JKv?s`$4?A(w7IJ8*8}CfRE7;nuN(~>Ad^hL3_Mcy+DN1FGl6}jw&XGBio!-lW)Djo_FlF!(WQIOH zQ3PY~4OiXE+5G)}fnUGvz(l9`Af9A(14f_UzA*X?zW6*);epV<5@wA9T>bVx=J)WM zjM%(fhB+8)+YyH7@zrxd7iGInb{Uz2hW22IQ=;^_(hE)A8)5tRHn1OM<1t zPS0O6gyLns(=Km2)@&VsC$X$YNr|Q*nm)>d&QMtF4@p0k)o1dtgi9#gBxv5?v%;vf zj4_ZP&7ZtyQBr+@cT<%*xdm81fSSkKLw6c{4gioN{-K2Btc*J1BjXgTY1;&<>`f}$-+zt3 zF-qdK_4J1N{?2eREC;qkh02x-GkANG7wOLE6>|6q^LJaEPA&z07h{FzRA1pE4(25V z=-uR<7s+|?*g-EHZ`9&Sbk62gcXxf^Xw*@y4@8eb3~djYFWlepQ>Rz~VtWflz1-NB zU`k)~?hSuFex;gIBmz+S{C@oa-`Tw{yNj4wuW|>a%vD% zsGkvkwFZ-xIJ9}k@_N#aIWaSR!S`XGHV?0!9Tlu++RWW=N=8SxAZR-LFyr}O)a5VC zjo4$jxcf!rMEn?~=?N=vadYOSMXBH2%4ci97tmMg(kwEE3^#nvHH^)+*>5)%JiXDE zHmXHFuYP4lENcHM0^icOt!-`d+fpvbWg&6Y8s9X{#1f-b*Mwe<)=+;^%qVXxtG>6P z)He#C@Z==lxh$vkHr)}JUXE3DwM#7u37CQi7x)eEQhP$cnl}v!Rb|Cri3pLpI)@7= zdTCx~IXDe?)pELFm^Zgj?8FcK7xUlx??`MY@RsHVJLU5=Vnh^HCY9SuT)BM9Z=G%_ z2$k@v0w)R4UKJv$j7+=14$HT354{vO9H_D35HhI=h;W%&ZQJmRdZSMwihZcrKOBOve%q`&;L-~Kh5l$)c9&ZI}8JjVXbKilR>zSMznCHYm_LJ7290^)B0Ua+~aOX{z} z!oui3WZ&5)t#S|Dp!MccGb%Hrq?fN)MgMl>Tm%T*%NLW7Lpq=4mEcQb9~^2)q~;jF zeL)-sAoZw&&oOBe-S!={>o2qHe>pR+e9PQ<;=c~}EtB*QmEtFvsVKH-cC_O|WPa00 z9=}8^-`pjxi!G&9j9t&7P{q`;p*`)Y2gR#qA6J2`L(-x51Z_xReT1ooebJEWYnK6x-TLmu$CI3mJispGv=ujhjC6D zVv_4@Z8d{2BjD3#HRIMV@OFEQ7L8Up-YOk0$0!(AcDX4cXGDEwqI_3fZv&yiS152YK zTI*Cc@TB?PMA)dT4AOdNMA%pLIbL zTliQjk)mY&ks1!X-66vWl~rUC5U-p(lO89UBH)82+I9FkF$8=%=I%aV_)?t_W@HAc zv`3%Ig`u)i;Jkfu9J11$Oh=`#M!~CHHwE4(-}}Xb&+L{P=&tJ|5HFOrHT*cN{!RaB zCbvW!X7m79%=Uip0x@xS*6fbCp&s~~(WjrfWYCi*+_7?=xdYq1a9pps{BTM7=zh^f zlln#WAXXN@b8_j56Vg}7I8y~J^))b4CXD=lDj%2c71A!t{2?EkwH+a^8w6os+;Y`z z?1~l#Y+s2YVB+2Kl46emupXB)XbA;lSeJg2eChMm{0~RQ?063k_m0YNybw>{4Q`x{ zM7-E5B5ue-UW%oZ(gUE`ffYhGv0d@{-@A7B3C4GSbS+SYId9^AJ9m3<41$NN6_<41 zh^+TXo1bCgIrJa3g(EhQ*9#}mw?{9Z;6<{_o0iPnRm_Y<>g4 zh<5|GKc1s?bPk3I3z#uPCfMZ{lY}|?*i;gL=>og7iN0Q!p88@S;|7(WUN$y15?;a^ z>!sk_uXx{}o@neX-(LF9gYUAkDf|DgWaUW~4rl7uq@Tv7P2ct_^8T7IgA6#-!>c?K z+J~B^xxce?sgN`L(}l0NiwQnl)1tQDw?kiUU3k*uQtg5Pqp2v_?%ayUR?(#iNW(r( z4B4)&)(>U}r-g3@`juA`Z>Y6{8YA6;Q7B=?#(hoe+Mt?EUbnyt8L%B zvCqmdZ8bY5Hy_-|0RgRF>Xf(2yx|N)7+~3xvK}CDdQ4Be2J&;n5<`GlgQz#p?Y4U8 zYJxqW^I6@eCvkS(&{Js5Bl6XLQ3=6=RN*`M-~+v@R#|!jc)k0sWT#D~>!ctso4ywV z0@RUz{?~DKh}UfTtv)sEONyHKaBH91_t=tRB!l}OHCaHtFc3vCG%!%fAt6Ic;dIp~ zG`b)NS?TpxJr0f|$lY1pVYZg$)=h+RNfY(+Ev+UN+Iz{3$2$h$vL(Dvc zH_rzb5YzzTgdb(T$BKU@Hxd_5_M1`7%)Rh%PcPTyTT?ndtUokpudV-{lye7n^d_N5*U2Gs&;|3#>vTqb&Kv~mFEC$KJ2;zYKhf4%E!qNZL|(h^d!2o ztE-CubCQL-yF2L+U-LT5B5Zs)TpbT(2BXz6+P8zps^(;M6|Vl@mz?1gOI4qps4pgZ z7;5!6q)@iXjVGxJ)$fP0d?VJO_!yBVPss4mx&m}oJ4Z)J>QBv?H8TJPx2h(4@K!g6 zvMh7|4fDm~e3m*KV)G6aFjWEPxN5c?X=#cV0k?6maQ!?z29)q$W+K18`|*|f03u1f z4GaJJ`{e~1L$P+@vg;0<-_=P>TdG?tV~|<@Ef9(2TCe!uUHK-cz;f~wfMP5J0+N?A zS&)D?X}L~ zmfaw*Ka{ZgZ9-5?T4v(e_WO2b!%Bxl3#^1-ba7UKPy}6Ge=k;J^1UHVb0Vp?xAD`b zPBw95+A^X^qQZ;*U*7!tq@`gY<-$YBv|QtgXDDh^w$I}&xgty?NJ6wq7k>20Jf42f z>}a)ayWXS=p6GdCv5(^W`PFT1BQgK4p;GhcH1U^j{_4aUN-c0$uVvX9#gVA>|ceLUHkit*ooS z95i2^)R2-Yr4$-lMClaPr-DKu8zJsF2$i$MHAL~{P)EZ8kkn84z;BArg`-=D_jCCS z@0CfMgdr#o5=(EaqTyA6B{6}t$I~BWejOA1@SCWj-0v>E$i!)_K+jm2SIQ7#wtpFm zOZZMJ3Y`g5&e1Ttesb%*V|xP?ccM8ry+|^{UgP!DtiE)`g*WoKf^mVZstdWW?a|uh zrLQSE&RmLPYwwQ*vcYnB|CdF*kN>Z^px+1r3SMwQ>& zVRET%@G_(jT<|WhPKP--Y+~9_d2$Ruk6!HKRI|WUkb8|=y$gfO76R|?@p->CUsBxz zb!H6P{B4djj6fB{FRrHUV_EmS5lPC0Y-BTtoLT2L`n(;|iL^EJd4G|Q5nBPc03 zF;T3z`<4GXjZEuBZ~kzk;stK>HM_!WRKRouIJ$roi65y-6wxzsIX4DeDLsG%!*H}e zbCx{05GJDKXHTZfX=>ku`@msW4Diaw_Eit!35U^0p}lEy`OE8&Oq-_@%=zraNYp1- zN3E={#dRq4KEIptd$5-lm(H$QF3*lM`>Dw<-5ioBg#m{Ei6mQKy^;$$sG}^~5BZU! z>ke!_Iv=_DMAt$~qk8QETf9_#^yJSg&yuo0NLXXhRzRpU(~1e-`a+ z!F262?)XF;7t-$qwlZSvsg%3b9X==Df3L{uSkwbiHoAL*&wufAb3+oGueC`|W%_ke zYV5&6(L7p-n!0*=P8-RaP!J0!kPLK+0I@Rwj8Q8JQBCh#oW2Gap?SoKLu!AJwVTSFMGYmOnfOPo!UB012Crg<{HlHuWr8$ zNZ^d4!EiDlrnOyhW<46ZtH3Os;?Sr&__=GPw{!#7;8@U8528sa4&Kd z-iX0Qwu&ZDph78fA1{g2VZx#}Oe7v(2;s#fwabRc`F_Eh{TFwpZIooWF`UMZJNdfi z>>t?S9}Q$d$FceIdcd1&GRjiJ1A}k%ZQ#n&YUtm)aLRt0kgnNqYx3Ymq8+c5h==`d zB**^gF`^qcF90ZK(|xPEb)$FASCIJ5$5wuP7_edvgqT+*R#&nb+9o~wd;RsDm|&t) z)ts&tgKOTD2f@KA;*e^-SzZM}E$5vTAw$x@1_M2;07i4J{q2Z(6QRlXFL;X<`Bapw zEPj3Hd%u}&1A_ZIY@%pLD))JAe933PPYz(xD>Q~8u2!?WxTr19{NXO1bsO!mMh+SXL?W3_o-lKAPu(65dGt^yna;9|5|tk z(jgPd?LQo>^&GGOPghLko%POx5DAS{)O=R}#+s!&vYr!0h{W4*AgOB*8ma;K{cYxS zLsbdV5zB5`aX~Ay9Um+#U>Fzvi?07ZYx<%8p20EJ;{T9;YaM&VsNj86OIihf*9P$$ zbk6%Yxr0UT?1WzU;znNk{&6`l`y)J&%QT6(suNLvbMgo2>MtI#N&QfK3&5~i`nGZY zXSr*>w^n}rGvcT8o*C=`Z$n(iXNy84VF;#JOT<}R^jr0HNq?wmGSql!-*KQdi$PeC zD7>)lK?WPmnYkX36Xbq8m==Yv4MYa$zZ+UY0wS&+v&j&R@n}_ImTBoQlJa*e3=n{#mP)Dd#1uS4MTF$M@udxaOuLUjih1yr_rUCDZ{S@CN*>|B z@oHEb-wgubFd?IV8A|>st&IPn*fyQ86-){A-RTvJ);p^gxUO#%Kj84?+nm@1gSG&u zY%d|m_hxA@8cAg%<2-`R+Yc>HLUFOkz60c6#Z*$j`dWG{+i|wbkvkPg)iwEQ5@3NL z0R0oyBxiG*X7)8HzM>jZrLT}}J5S;GsTk76zC%Kn#$pf@k;JpXOeVX*3O zGRWC{Jm3rS>|+V%^Ut;|ez`Ax+}mQBZCZm6CKz@$=_u@4diQE;609VOG#2P;vB||) z@Cyk(&{1UUL>wnJIu2+%GE~yeEUk=dE!)QJ!R4Rs3NwqY2g!S=2Yg#Q?H}tcA(_kV z(JziEtj@NpB~1g$z79RRA|hbAUNGKCO9rxT<5mhZeG^Q1=(k%Cuk1!*lt{%EZZ%PA zgN9;;Dbfn82u?%nzU|R{^3y%G?g3bN=-cZgx37W0^8qulvC&`|wp zZ?Hj)@G^t%TM)Fp^3UJ+*B9@qg8X^}LQ6w3FQQh9oInuwWH&e5fbv=EsyPvJ;}NQ3 zo3rV+1Aq7xL0zFgwZ8;vIDVIS+w(|;PiOCADa6HGX+CStfh5H35yLT3WIX`U^>Q29 zU*CTr?1U4C%9ae_OFMQ|1ZQ!k{o_eC>#1*4~x$#rx4z361wILJ)v2o zlJ&Ue<;MP7VF#Y*lf&Tj1`jYiOI1!Ow$EYu0vQxs1@0+TCXQRzor0PDnX1+=30Z-ZXw?3_X_p+CX zvk|N4j&>a*zw%M-pxwZ7;QE(qLzoFjv0?JF>sW`JS2s(mxZCY@&1PSax1`WZV;cj* z{40Xw8@nqEJBmDa)3zxlmBX=CL4}u= z60vb#f&86J&Zk5G{2n!o%+b2J;*!x-<(6^2C(1t;J{gQP45@-w2=-)8w7Z@BaD2xP zj`2@s;`hP?AcFi+tcM!}TS*k`%a?6Umc^s{wFE*GgHWuR)w3V3#HVoD&hNSLJo*Hsa6)wJQvVo@l+onk-#2px6lgiZ8D{J1g0#+ zeN8FeEZN%fRc0s-F?tjtUP}rba3|IK^@&G@R)meco)C1li zksYmexsPe`*Syo_?_dLc&|MXm2Iy4fPnJ&69SD9?GTkvI^-nz zpu2tb@>@Ee&?9W$!PY2jyTLExw(UO)pBJ_JzXf^*)VWQiNY(H3v}w8L zqiQ;9p`K=0m3jB?rCs4$-~vau#Pb|P33JdxzJFd|xZvN_T=?QVBYKDMdm+7~s^EV) zjUw&VfS@Y#C}4-rPC1Kp#)VDbX^!oeXB#Rmi8hvdQzZ=r@Fk(K2-t9BO>+G(F%L{a z36iotx5N0`IF+ohLb-@+djU+;ar(g6JmgxoQrcTuSVdo$L6%Bl4g(}J0T^0rQBeoN z@3-SymF|mxwP55$^g5tLF_9?hI^dm8fSUMx;ataI{LhCWS>~%W822c_n~&rHInfBI zPE9;x)RYQr!Jqi>PfHebkO!!dQ&FUa(L-8Q3p$!Ii7}&9c_ez0(O-@icmaMfuduX~^>_o9eX7|$G`DcKyq+R{e#dDZSw#VX zN$^l3{4%OYfzzrvZb|vN#sqzf0MD9&NX_ZK24pFa2db`$#yKpHY$*VsZjG2+3$73l z4;Q!u_6OM-g*g1t{4Rm?^uCnC_DE zc){n|cr2Nh!!PunkRL=e=ONEQ^MMcZLrMcg&f3G|m#qcgn|wty>fNt_-ubX`>+a#` z<*h18dl&uo^~awodp{psMXm0(h1qy_#An%bk zkq2OJs!HIi!x}-trlf}-C4EF5fcv@rVR25Yq zip`&pY_(mG>T?b;JnWV8mFq13DfJvgD`C!Y`1jxwXH-Lo9NlQEleq%#6>W4EFE3^w z6A3-ofDtwqsfOv^qTNKo1b{*h6tT*kuW9Vv?Y+u(x{;s+LK3Y)a=aLn3%AS)MATBQ z)0t61(kf0~<;Py>JxZaQ0mw$qpc=;b7YHSrX0wJG~C8tZw;m zQVHETwwn8RdMQqiikaKv1^Z5#OL{YRp9=da(jT}YkQm@8Xm|cWF?>u|-_tWu@&K)1 zC-u?aCFpn4_`WJBpH-;)`$B&0{a9U`z<#MxYe2mEgi)`et|#y@Q7FWO(0rumO9jEK zx6npEBY&vepUs+kXSo!ei1{&bBgLb~2bx>@_EaM%HdXcgkr}7}| z7~{xi1X31D=(>&4Bv;rJLaW#`+8+&o^a!6XY3cxz0t3mrS*9L22 zH$8#0L|n)kL@FrIr1SQNNxy<1*@mI>8wciAKC13pwhTo24@+fB&o(k8LOZLM>s zuIf--=Hzs#o^pR#Q!)Iz*M~2E+#ml-&^WpG=N9ThvA2Ie6*`wO`<-%7^h3@5%FzFM zxo)#Upl(7gwah;dXM{l`JDWQ8B_-`o%bXIbF=0GU>KNsEk*X7&(yMh>F$=v0#c1%< z+ZXx;<1oCs^&)~$v*c)URUi$rV!dE#W+x|uvnm!@>w+&gQwr)tyi~YlNWRWTg`m-I zm_w#3JQu2SnIF1*KuX&35JrB6TN*iv!Za{ff06-Iw zRTvXh3nsn*04V@j3K6ykG9zV`%Mtf;Gf=BVy%ohG)d2at`N$?I(ln4B79=tdG3)q} z*?ICaXJp26@}J?An{8EA&FN((czpna`7EgF>XCsa?et|v7n4BJos-uSCNJQY_1kEs zx&;qsg4=&>?u2F4V~s4oH~yS!g--yOGL`b7XT~lTFu48-B>tF`1sG9HbF15rHi+!m zr>qRiXgC8?b>xfK)W~cnH1i%!Pxu!#30|w`O``7kz#SybR4Lk>Qw^piC0^5y_r_Vv z*So6M267g-Vg1b&r(=}ooD^1~+xd#83B=Q|M%g0VU!juA#8PcdTn3z!>4l< zXQX6KAsRJIJ3R;*LR1xO_1bbV&{G4L37CSq^m~k5+fSWjhDi~@4EH3H%Y3Lgsg+hcdJ0*N{$!Rf-iC)$wcRHESgqlMgNbC*v(u+^oI6rav8T{K z2LKACn|k2uKPU=1E%DD^tz_FDpTS_$E4d)RpwJ*J?EYYTkS5T|7i%wE))?9;>y~M; z`9yJaB+0>e9YxU| zSRh4s7sh8-Hkh%L2#Bt;!0PJIp}+lfr^I#Ep{Hdz-P4c+Q!sewj-!dRUB0YfE;!a? zEG0bLDfQ&hiU@qrHaCE zA$FaEwbQja5zoe$&&Ed}i(wIp;bI0u!S^LbKM4np%;TUC>h*;4s7<4zmF|I@nyTpQ z5Ynz0_y`r6k5yBEO$VFzWH6+eDJ(q+!3_BBrr7EUl-|H#FjZK9+4FS@Yi)O*n=L)s ze_?qvSgF;3Z4C}$u4syTPr!)!{=-#BY50ORGMBw_mG@CE2`JARg+Fji~# zTiEf5)BZqHy4*8BBZf=$n&OXNo)_#qX&YHECtnF6WH9@$Ba!LgekqdI*T%I{0829} zcPq5ReSvsl<2hQ>tg!A!Z)1u9*vF*LYWuf-8eOxBbGc(PFbAQcE>Qo*p*$7gEPTnk z`t8Prt=AwC?(&Y3)qIo7Eq7@*zzBrsx~)slQ^w2$>4tY*o)+=d%A&E$cR>f#r;fz? z6-QCrUEeb@?>2ju(jLytbc3V+PB9P1$UYa;Ql(x8&8Uj(9?|e`tk8z@Klali#}>tf zEc4Q`nP?+he*btC8@6~?Tx-(&udP@~hnS)d{3+Se`yTAhW|YwGk4I68LU-i`BmSM| z9y0E-M?~Q2%dnkd*KkiD-rP2vhb%@G&g>;9nVY9*8QEcr?C*;eJ5Ot{8=Uh4`ce}6 z50%J2-a=de!MMDqQFrJ)=Z!||s8w(Ymk?4=q@w35^lfD(-f3XwH*QvCge?&-3YJ%Z zQHqaRlY-c|2kl-?EjZPwW1~nAIBG`h6!fM?In`r}z)|Z$h2Yqnq05$TFEdL4>;xlVKOr&VUB6W3s2UfhfiKjKGmIu?Pfu_1!Afkez<7qXd4 z*3FR;1E%MsoO1K_88W@}%%8^9e7?Mp~zEJ}CvCZzu{mT(*vh}$T zvJuP!?49UYJQU{|#^=_mRE(JYdtV@9p1G)gaxAm#tu;u+%DP48)bLWDYi!<2peChj({j0}}Js zK1Z)(!-0XME+2L+eJW@}@pir0<3xlD=eQWc;7YG}LRHA#45`6CjJjp$?qApU7tA`y z*_u7eTG+zPfeT#n3x3F%hr?GY>(ppoxpE&p)^UEW_lTN3$3N%#;Sbn^MddPBpiL?S z)j51%=L_+<6T)uE4S+$c9hN)vpeBk;8OgonBVc)SEqLh|lJg2z+-o}zJ2*aY{*7G{ z%JYXdaepq(#l0BOip!S~Gs=M9X6RySnIj@|o>OAL8P>>5LWEkYL=4iMz0-|wHltFThL5yE94twuWW)7S06$M?fxs)qx1;~!e-k|)_a`ZOp$T@pCq>cw z2e$Lz%xIZ`81#uOvf28m-dsm4kG>`vaw@&8t$^>S>O>$2`LYQRm!q#%)T#y~E@Qax z8Keu>f@BBacl_MJJTo2jRiqLL=jOr)SkVf5Z#L>^x0Y=5y4&6sNb7fjUicEp-x1uK zD|J`dNdm`!ZEQT2Hi6Ke@8hn-^oMTB*7|svW-wwRrTqdVv24~f#6|5E^1dc$0|i;@ zO39$d0R<`oN#xOYt>a?fc};aW6n)LYKNr9{;6%j%DDXLGUt9kBg$jXBBBVmmY zMgKZx3Fd(LsGKqmBky%&r=M&ek`tBeb5?FYxd<>5LxBZj5~gJkCBfgizzU1hZVcvW zF7R&|W={~82!9)ctcL*A?}(j)!^u?>6C(;iCFc0s+1;O{WH`L2Daox$h@kWT&~@Db zG5`O+J9pG2?GWjZG(=LNRA)7%U6ckwR78cQyFw%+LQB_>lm;!*G?Pji+5_!P<5be` z`MOc@`TjnC^hr0~ukn07U(eTbJRXZyd^k8e<=vd+7=RgPP_HP>zcCv#A&uh=J>Fe< z9I=#vHz{Grgf;iM?ceABnqh_{62T9Q@o7_F#}`Z2s#-Wbsy}aJtk&~-*^?Bi=itWi zv3`}yo}=u>-!+BSAFxB{XghXJ4o6NqK$T#WyNLr-anXHSFuJGAms%%2Otd=g%cYnK z4IjF7dqSbZU3{=~1bnOX`kbr*FtX?nD@DyPr(6xjZ3=Qb4jB6#*|z1pGbs}=8EYc} zjWQD&AU)v9fl3XAt{aXv`?nT@M`17?b~5`zcf(7)%}1WM8`7-JIxnn0>g@DBrr%IU z=7`ti7_8ct(&fm-PT1Lvs%x-=VPRqYV2)VAHRDf77?Z~!l#~xgglqlOMK z@AEG;&g&`G?sV&=iHcJfv}`RghZf@?pFw_=mGkLwD}8<}!4sN~GY$AnNsl(`t0r8} zItdqJp+23$k!IDZcOC&hPsGS@06SdxdgK8Z6+AT>+BVW#^T~*C3^?r=qI%$N~93JDRoX8T9e z!kZBK1XUe>UlD79s(wwZSIqw_O!?qJ`0w$Y4 z;01_#nP&!nb6u1~$cKR5eVRJam3m6{7vx0}9K?gOr{PRcbY6c1EUOBDCe@6AN0No| z@#%Vk`M=(7*mL*-6n^P`a;|o}eE?!y_iIYoo4+$lc<4?8`a!RU`whXFNfn8|oz`w1 z8zK6_KIKe(<<%GK!k~SMA!W9nkJy13x-`E*+D^?P)l1e+Eg_;zX9saTCBD^VRK=!% z%~2^FrNdgDnm<*oN%%@=&4XK6gh{{Gg7xcB^-~wt z3)obaihySTBV zDOUicY;xfp{aroS2U)r;-%)}(;*^fl`>v+504Orjzi46%?-k~AF7iPNa%Hmo0Uoj{ zsNj`(=sG%G1;ee9WtUnHviWucW**(cnECN9WVJfw-o+k--llJ5wW1<%i^LOFETCr)DthFSVh8P?$EQLPCakOhkiU07 z9GZUEXDwa1;L|U-9xq7jgEEPdDiv7dy{%ISMiix&HjOq1oD_K8_v~YM*p{5p(9Tzv zb~U-{7G-THZ|-%OR4I>^!u2E^5?DCfkPrF|z}>jUnr|k@%4W|S_>JVqDeE!E?=W0V zt-hIt&qam%N_@tf(M@#hv9~~*@I}tdO7Dznh!7sYf~ORM_kDB|y7r=9rX(h&p}=p= zC%82^Kx`x;W&OT=a2g{l&a`O&n2Iy`665pE_x<^gz6-cBVLGoZ+S^bIm9hnGJ7x-C z1G6ojOgK8>&n78dfIX;3ebMGqYFjArEs`fHV>Gyrt?_8*)N;RZ0Ic9yI87R0eRV{H zL*V8KJ}8PE3`1C@?L*!(0zweT_#oEg5VZ{8LD&HxgkJvu&hQDyX}my1n`hD0p-g$u z0c@*v$C4v1jnJs|WF3RdY4-G>m7&nT_JF|dI*dlDh$Y1RZd0;p{1H2XSm@#8whHVH^h}!d9$+X~^sXA@!94eUr z#HX)G#UVBRH1kW=g)~V0Y`*>jD(y1hh0myY=Ow^igco!}q048}1E=3U@j71Zfwza4 zzcQxATtwCWyHsP;XzW|*Yp*d$152QOItjv>k&jA;6&-PxW0aP4~3TbaV zKKbi2*TM^c%D<=6%0+Yg^u2^>aKS(B-SQRJX|WV#Rg|F#bI13JEKJvY%Au3XKbOvj zP{^71!5nEj`q~6)0ukOv{;f;rGol@&VD_$-dnR%Mmw9iKcHSGFlX%Gv|$wR=EAp@3)0(+69Cb0@(PAUC9;UgzG76$>;!Jx-5fA8l$0S9(m}#j84p~+NdPcb_526nhK@5Al;+Zyg$hc zif$F~KNq_=3CbhX3f=7;%~4&KFQcr^{-;)jKM+Pk&dcFq`-jtTyta5leo^gn;wNpV{Gn=7&R1(I@mlK!hG<>=2$ATIS-K*qDiQregbTG!5 z6M?>7%wvH9wKwI>%C%pXK5-cwCEg^3;sh3^822rp5FT(Rn{HS;n&g=Gxb}3L$BO!u zJdenx8a2h;<`I?@niPT~yD}`GP+0?BgabjYMrs-r) z$g|?$vr85YT$+R(3iBBGgbImQIHj1}PCpcs`6N`J=7?0fX#IcleWSlD~S6cbJ>QK=gg2Q$e9~S0#YSh4*ESNc8nU8BM=$o->^tE3yEPu32tmDs`H z4yGHsQ2Y`=4V@Y8CB%GpMaU7BjnczwBR2cWKNESgo@zs1`iaubwW=_AxBm&?!`m6SeVW-oIF2?T^s;Fd zw@F7l`m3Xcs^+%mMh}r zq&o{)mO|ikf`qOFFn>ym6{52oqSbHZXZKzvmXfc! zf^ZFjP1XwwnVg!2P`);29ofZibi8)43Ux^Y=8-1v}Ol2*Jypo>T z6_6~jx4%VJaM=P3kuFa|q!>e}UR!YGzo#Y;^QH!YeG~;=OFMS+CRO7Qjoqm!5QEuv zgJsP6Io3I(V4!A=e%exd@JopBm4Vw(4Z^unDTPD8QnBXK3@hAU9b$Bmhaa)l)OSah zEDWp}5p)oJ5BqdYki}vlVMR^;wZ3bm7|+5L-&~b);EkL z1is~h8NOvCKW`*S){K{C?0HQ=0l!$zzna1#67moIjX?$GN8CgVvFkYgrv&=?Y7JD*+ZY63`6hj3(A);Rk&E3 zXH=Eyu(op-l&^#Vcw0=$2JcKdk}dT+b~&Whui<}<-G9r&(XuB}?W6gzy-tRY<8~By zL9Bf-^E<$QxrlXPWqatetHU7z+5Qt&2sRTgBQ}#z|K!(Uc0Hv5?DDTCYvC|LSh9X`+aea4wEpYSg47WTs0ktPP zx6e6%D2oVAtnWb!Ya(8LK#jO*6~1*dtt%2i5`&iS!oQQQ%>#DQ_zyI|`#9(MbZT5l zX9s2DOmP9I3m%J`Z(6w91}GhwOm$cJ%8SPeG4^jKZ7iQ2!46y#Y&$>anw9W3CmWS* zGQ@WvsWGFs!cHv*M6K3nC9Zv|dVeJgjm1An)bupE~nSx@ar#Y4qU!9tDSd9 zWNJPiwF3Gzz#44CK2}of8MJ#GO1yp51WsfRuk%dG`yQ>QH}00r4jO)=MB}!w1dH*4 z<|CF-T`v9EPcuHA10zl^*B}k?d_p|;JfnGPxoJm^GIXMiPvWF?6_y8(ZQi;Te|}8Q zfN29fSy+%yKez!(2;_=!B+-?Wbdilwn#}qupwt^|-wdvk$C`=zmvuG+Ru&r_t%*Jy zC5Zw8P2}QtS;jj3UcIeM>vkIf+_cC81ob&_T6jQJCR^HEI4z1T0h!VH$pzs+ zJ~)gy*2QN?S(%;_%!&n&KH$1w0V+07PvvP%uM1g;%~(yPjWyT(Y_4O1KLMdRhph)t zJP(|GLhIS$Z}3JMOhnFukr~P>#sqn8vgQ6Y)fHGm{Iv>X+ZybcdBCTpNqK0wSV~JW>l3aEft(jbSy~b-xKsmg=3J$TEw-d za7^pK^=sTpJMRSn=bgk$wza#6BB+g|`#yUb7$ObQ;9x{RCxuqFV&OB!y1$VKe3Sq9 z?UpIwo`j*t0LJ-zsm9!~qrKAKk13n8x&^C%LmfE@*Tzg~(*~keeDcOkH36TYe-w|~ zvIZ+6aK&Bsx_f`W4Q)BBj0v&ex`K%l?-Dw{3n>~O{U`aIN5?MfiXiShU=>~?3TFvp zYO^z?&{;++q)@@oGPqpzZaldF=<8P|RoYt72hJggyp`(*L7-8^I?FVGFur>@63P=2Uqk!UCbwWM#`}y7QG68%X;;Zd~m!+B^| zDd_~+ly%sg2S+JU!oXjN^Box9ulEao2@O4jM#I^KGZSjPiEYYpkgGyZn=pxhX6Vm)nB`SZg1E4 zoXlQsNZ?<@bT%|8@!U8;hn9*8L)%ZwSu$~)$EjI**Pe^5QS1Tc%+3!vCj*4hd#Ty@iZSn~>$oDd2BKXR>WT`LTP0t7e3IvG%^t4_@tz8ERoy!gbZ$uAgS{X zh@le3eI{YgTztlG#_;sc08lMmt?{v&(YvJ(wRoa-MAnWP>iC+hvith3-)%|2(40rcc1HUg6W<$N z`=^k@j#qG9>_Pi7?c&=k8B(JFfX#2=3JCZpN$Cr|KaRIrGidV+&+Xn2$T)zgU+^R6 zG9Bh0x2j#$5MF8A0xbiQFPu*x!itxpZ%-cPeqLiHU_Xl5m0J`2ujMMy`&Iux{H-*w zM+DupC>@%;(P)xucNBg5nh8f)}c6dm8*L>U;(SWn-%jk`^&3J}%<~NOv5w z>#Xe4G9G~goM26w7H9wCpfNQW^<>jmTZY<-8Iw{HIYg9RFJhOc!9arhn=0QdcM`SQ zs@JqGt5yTz;NPckwxYSXvxpGSf=sL1(Di^0QJBxtv6VKJA;9z5iD z4N057yDvzlmAyEb_aigu(l%$tFbf3Bdk<&QJ{Hy((UxSg@8Uo_!md8?DI0E_&|uxM zY;i^Zo|Mdr@msJZ`h{|Z5yz+4WNUIDR^qep4%4y`iB#GmO2VFvHN6gTyg;y^8B0DH zXYg~8s)cM+7T35xyOSZ>H;R;Ce8yXugb_Khqx;ryKi3Pu&10%GWgT`dXb8ipLUE3R z3hWX#>!mc+3(ue@FA;0YU6lQU^ua=db=CNdH5e56Edx0)k~w~4@M3G@GcOC%RFQT> z1O#hO>Swo|vq+Nq^L9z5y!&~7Fbx{F=^ZyrQ6knY72?-!=w@7BEXyU<^{ zF-&)BGH2%;mx3CKcX8Hr@+7Pm>r##1v6S)~huFuvd5cDAvGFyZMoPj%?r6i43_n!N z+{*R6F=hV^p>qi6%LbT6FI=SZ(eFax(Z>>b@4=*1CETNFuc7vu+$<5N8?jmiuXBHf^{|yva_P;p_ zMwpTUwHO@bn-~YnoK;U>OXX%0T*&Y6h#F$+`D^iVxA(>Ur3%IIhmU=eU}${BN^~!A zT?M}Qe%e!DY^+#IrBx7exXboPPj(O#7ee|ChTA4&vjO{or)Vro@!SX;buMYpIgcQH ze4g9QGSCO^!_3w|2uPqV{=q8<5<`w&UW37XxDX`H%l1skZ>M$VG?#$oELn)dJ!9VmOh%3g`7d_o zT4hhxtqRnEp&U@^n^Ut)-Gy~wRWMa=C_m8B(n$4igm7)jpY5A=(A8!ahs3WnCkirz z#U631#B6I+^0En)eqQcqrfczz36#|c0f-v=Lz&(U9xA10mqP|A(39ezHa&69&-Z zwtx-$mcxk&o>{$yS^ymsyfJhy2O?!yOMxN2a6g|?`>EGzrPiW8^Br^AC6oufe`@jC zgwqA>5}`|FSMuQzrBHh{xZ4t^u%=Y?YxElqNc zMa1&$-~uVLzn@digRI&b+?K!i3&ku*(%R~!B+);+t7}eJdaM}tq?#w5Em0Q1mY{s? z5J5sVGZ)|kYu#_Igu0Xr8EOlMyIzD$fquTx$jjZ2GauepK|>%J;zxw<_76IQ-nN?O zoGX-|t049+5W&UXc1~I%`IqwQJ7NPEaO>~{v=RiKa>#)QaIXk*9Q|PP(p;){=jX8l zwjsT~)#g7BC9~hzM;?IY3Lj)r3Thp8miIoy+NbrSWAlU=Y4EY2U3?3_0b!ykI<{q# zwt-_jLsOuGwlRM}x5B!H+Qu4^V_HU(sv+@nFoVpPUt4hjIEm^y@8_5lWJKpcOcQ}o zE6nb@j)805d;qbewqXf2S0{-2g&S}mb`O8tt@_y`Kc(953G~G&jC)%nc0PJ2AIi$y zy{@@Ww+aFq=nn=S;7ZKYgQC$q^Za9XMwHjO$b!d$WYqW;S;$JiqQ&>>>|NhXD$4hxql81{p1cT_AW_k4o?O@Eb@62L$7)bJ zkVJjbVA3#0PR$?@uh>JoWtb|;L>;{Y9n7QdToo9LJ(B8X8e5}6V)h%#e z^_1y;aiLxUfakpQn{V0bw>9efV}_bidvHRgO;?uiu%!4ejLoV5vg(qm1s4lBI{8T} zw#D83I8k6M8s2f3%6+i?fu2P@eV+lGs*F>h+~e{X*1yqal_O{0gAO!Ub<$u;180ue z;oK}!!=c=u=3~;`wBRwOSAE5Tl(NxX?@4S8F*q$^=it>*+Nw3}X&Esqpata+*Yg_k z$mknwLLM@-34Gy8lo%uA#k%sk0-OfP0oz!~w``3F-M?*ZMoke*Z$tak&59S-M(w^OO(%v8m|wv08m+ zBs3~1s6Jz}{gkC{iitLKUObqB5IB!VfmgV1OiGWC4Xf{hb>^U8I2|3B{#_#ciB^3KWu+cidym`P&FSdImK_>A=c&~wJW#CDKGzxDXOZnYWxN)#o`H&L=OB?bl^2>#iv zRkK^PujjRm<=Tg{-KB2{T?$29auufSV-r=q7T4zsW@x;Ih@XTn`A>f|t)UsXQ|{ z0bz~VH^x4mo>^}{k^(_ioF)8p-9$fTA|r4cz&kBi5Y5dl7!DSEc?vloSYRZ^*lsZU ztTrLQ#rJ9q_GFWd);WtJx5mT%b?Vn2mn)S%t!)z)Op`ggaNtMwNiChX+ZITu#Mq1E8qTrJ1o1e@B0bVgrvLd)n^*k82T zaHp|mQG0N@^<$scZB^{Hg2Yx;X)a|rLyfT`|H>DM4^jhkG{f3fWxuTrVgWBg-xcix zQ$;Zs&?j3~<&17WWUS))kXOI_X3%6*(r@L7gO0`pNy%xOCFA8<+EkKb#^W~%ns?5> zAe1IkS{-8sD;P@Jn6E*YY7(r@i^3GvcdjQ-W_?>nwaw5_!>$45=lwxt{>?d z)F5p5GE55D+pjzK`R49(VL{E2$8_o=^(s6jJ%ire())QM0?|b4@1=NpYaFq^{b{f; zUUB^QgVHbJ4TFO_dYbY^g};_1g?EH=QVxONx4{%4d=k5{0d%I*nO%hmX`(3VGYIpP za^zU&Tz3FVi(7(Nef5D!{X`=1W$V=u%p=uZ3%?kxze(;J-JYykRqa=hy+XTvt1=T1 z5~|p(Vj64Kg1gupssh&L5nCyr6t#siE|#11X>B*{gsRrGx`cdtWlGldKT`&Kir+uX zRpjt8m+ia5kxttt<8oo6n%Th9=E&+BZJbk6UmaU+4ZnEbHtZprpd0nBc}&tnNlpZ( zBnBqIuXYPN$fHCs8=bXa)+DeSUxTzr?qPbHpV&~dAtN>Mv$xV3-ys5d=Rp%+8;KDRh% zWbo#ppvh2!64U8FlDnmj?rB&0GDWj`nAIM7YGbG5Tjw_o$2K0mrj&UnP!hB*vuN9SH60#{N(eWk%KRi zZ-tFu@|G>6ddd=a_WM3o?}lPzm^eupJJ5T{N@pZAx@NIsaHChhOW{eF3DFzlzKeJi zlD?es49Q?5?}Nn4tEvRH z+TyEr4_t|Qw*Ine*QzWsc99QeX?9#;EL-s*qts7lf(3D*9kKSBJx7waho-o$be699 zWVWWvsBdu9jY#_!&7`8s?fkh&7^(C9NfSQ+FhMBcvi2-1L)3z}^V;qc8|hr~ zloNb5>*nk$-CbdvV5GeiK(DW@dTg}QQQ)G6ljW65{_C*r$;PWB+2u<=aGgD({Mk0J z!``x}QR+vUX|nUtalxIgd$5JQ@tu~b>*I_*(=i4}M{rwaS}6jJ;4&M&t&b63B1&Qd z_+ed0#J!YDr_ZX-%`3kVCusn-8YAU;85m0NP;7}PApaUH$qFmawEO?kjkB1>HJ_6# zU%me{#0n>1=%HUo1M5Te=yBYMoEm80xW(hJ0gt?%Ksk)*G0i&s5hdnx^aI(hGe26u z{=8F*b<96rY~%CyP?9)CmSp)dDBYF}I@mk@DalgA7jNx_^l4G0Zupjs&mI87H^}}) z&QztHuQm{0vm#3J9I}fU`;&v^vds3lwl^=z`FUBL!JBy)+V0lV60BL5V=#;UPLXR% zG2QLpkyw`-BrXnwM-sO;LOApXq-2tyP4whHMB{&-FsUTxn}70n+E^|$)6w=}vCyvZ}J1|${SUW=U!}Tb+2rO8szZdi1VS7~vRMO~= zVi%$-wL}bQXXikiae~o12xkf&Xi+-6@zC1>}FA>?9j7w3a2B87rA;Bd(L`b>*VJF+o;x&IdpO zkuAzc2n>MZ!v6e}-j%7j1Jj?v2B2v$E(_?*61PwuaqrvWF+<`?{iB$@Gm*%dC)2BH zjibQYnVdIR@>iBy%!2%RPMnBLQlh7_)<#$NuRf;_$#jJ^1#?iin9pS_CZO^#6q7YM zP*E$)(Z5p7B0Mvz80*u&ze)AY4v1K8K2HfV@9ijA!inf7OW4zZJ425lbOstXvZs!pzFBj1&$}FB;m4N=az_jD`!A)7=h#v=wO04L`vH7p!^a#HkA6rn?zTV`Qwn9Ea*=u#VNF8-M#zKlVzv=jZya4ip9eYN(6Z!uWLlGUncHs^nnIX1UI zps(>%{8sx9W(2G1j{fBmd#O9v9<^q|o0f?Wj)chDDk6Tac*3KgYYpP@ehfYdhrVfraxAbRTU3%qf3z9+^) zB8xzx3IVl9%i+dF2xnvOiHNOHVhaKEyMbh3CPFm*sX3zHgF)4lXiB^4E|LINig?9; zC=j=5+LCAMiexsd&o*frpU>o8iUX1OXaSX~{;bt^9S@$5WZLGv#ni~ z;%%c8t@I&12biYY%`P-!+DM7Zr;#6DcOS`4g#VgVD&Lo+*fR|~RT4XIxN{=2Qh7_| z=E$l&Js8^eFGt#9W6uhWBBHwa?6O6V`x270Y57D)YM*8hx(Y2`y9pM^zac~HPiPIKLmae zI(Mmbt~p1Fr=JB%`baO*>Z!Mf$IF$q&ASb$JWTvIkhtmNPv8^-M??4Q^$;7B z`1UAe<&lwSX&R6dW@pKen=3LloS8Mn!cA5wu_c6ZX89B2HHHE*XCWsUs9oSC?x7ts z=S9eIFZ)LjixNo3jy=ja4!#3B?aL+GRW^dee|-zMA}|I_c?;+6hO@2KGmA&zV+S0* z_q!fGc(9_WS zuDy$gg{m6}js!-DRe8?(V#wPpc5;7SK7Q{4kERuv%QoG|yi5@S!=nWtWG=poMia)x z9Yafrfj(?>sn6h$aMJHo+x#mpGec5D!^Y-MYKZ4|<4qktmU{-vpKM9grwb&}7pr7l zANtV7JcG&Sm2>17cwZq z0CEuATo|&tGIT8?G`o}3snOsSQ}(H;scF0mmxR=@LV${{mvmb@^8@Ls!#-G%%N&nq z{z#%O#S#Mb$xwMKXuR*EqTug%8^Xi9Jk=O^X!HFpUiwlCvsin;Q`)*|?BP`CQPCq0 z)GJhV<*I*rM?2W#YNfDR1Y>1y+)ayv@3k6!)R}(qu=&<_o}BsPn=HHY+_qkQ9R zd+LX4>^z+4b3l-%a<4 z9+KT9bh_6yt249CwftuhVTX`Zsy>Bwx-4v^NubE8)*ELw^b-)Wot&>X?>Q)B_o|nTE~VRIK0sSUFjJcL=}YYC$j>Z zeSsJ2V{LY=!S9jKH%K8IFn$nJ9LQsLiQIfaYfbK>O6`e~*pQJI4kp@Z)^!OUKdcAr zVs(%A#kkiSeVojx?@SbooQ%!vRw~k;e8*LglHslLB+mJGQm+A{aDlRly=$9YuU}bW z_Kj4T)u39gvpNIZ(h=aL#wozK&e>P$}ihvqeW3 z3S9J(ykbjQ#55T0;ST$IH7=2*+oWWiz>+8%4-2P@ zO3?)dK7DJp)5mpXwSKxBfzM^$pzGd%%KZ4@6XBzh48uTrfOFA%yr9g%@rzs4T|K0+ zbUzV{!fR~w$pNbH$@aoMvn!1uWS`$SFY*CD6D84)85FsdbIOVvu0-pzd;Y( zyX(Rc=lwXI>xJJT@Gqv)YXCqxBy!ja$1b(Jb)jG9h({38)3O(4+iBX8n;-t^*$*e4 zA-{fWuHlJg)I&HqB6U)`!EJBhn3CR6>Q#AqRF`gMNZ7g8aFDL;l;o%Uo*Ay!Bf7%$ zPKf^?drUdSe7^neKq}{jhzKttuK-Q5IP} zO%&X#k|k=TT^aTPYHVtco7b#xYEj*SsAorc_2XcoLgl4@UVxR)1{;xC3 zl^`*cS7vfJ>8@P?SmEFtivf}F_J|{Jk0;2GIvF#F*Cno#c$IYN7P}>f6+>|1bxEt6 z{P0a?%F|ym*J$4}B3q$zsE)U*uPP72$ozN_BUVP=2hi%bto1<3Um&O{-`bpX z2O{1iB0pB1arLUi3OA`HPzX1!n3u^hSL})qJ7+eyI@M*bKP#jOfY~cw4)T#iE<2`_ zg2%Y1X{CDUUt(r;>5n+Go-{m1zU|P}UgpiQN)Xlc7Co;Wdcql6E|7L(M&B*UY zzECS+2-PO08>4k|6e#3P#xZ>ldGYe*=93QFY3{#tKMaWigR&+0&r1D$lvE_YDXHu( zf7kKuTURhAx+4j2#*uQe)$}9(4KLhA*zahO3ca)sdWmmYwdb-YW665>%Y7XPIVq!zE0Osz#W7Hw40Vk(}UcvrlCDJvF0ePWI^MHec&fEPj?fWj?DwFt?XJ1k=eha^cE^hMM3+|Vd?d?75;{DyKLVM@m z#FsGGt^Cv%j4y+uo;=w%u*{qlWpd-E=5ldJXhug7_OZGESK;d$8m=4Kt`wTU3D~O1 zAI}Wg=pB07lQV=a0(PO~70sDbCPEQ4=6nt<=?~IYvbKz_$#i)MVPpFA1*=H~xeI)? zSZ|?fV)yrP#&jJ$ol;Iu4^refaH39W_zibItUhTicwRJXT|0fbf&}$by=rr9t*xz} zE&F)fQU1T3jWf3{b5!SUKUK%9699D+q9jb&8ox@|CGhvrt-Y2<$U)Te$`cpax_()i z|K=>dah9WM0zkNcJO9ahl?PcPCwgE@x$hJ`z{oJ%4e(9-`}<347d9}SK;)&sF4(JN z`?WVr}PG1E$RUz;_{7`oKJNA^om?J=yL@!SApB+vHdhg25H9l?9mLpRP(L zZ%Q(wLHu~1?X>Wiuq&V9=m)`G{$&&%V#tUCy30f0=+H4JUi$mlGzdx$DA^P=&L<_pwY3+ECWpb9 zuPRWV6%nRnQh#Ab$~Od_FUU<86y8)Qf&4k`UMk_bsa|-_rHs#3 zi9?!gR&yD@Y3?FcVrW-K0<~vfk%PR&Rhyj-ZiR9s^l3BVAM|sGv=v$;)PNz?zEdGP z*A)ZWMW1`11x9$*e_$?$6=dOW=66cW#9@hnsU!^zjaLeW%!*AePJIA3qko0G7NDg( zSdbo;&R+|z0Qy_IAe9Mx&v*#>+BeXIt*U79g;2rjCzv&v5_zPbDt&{4dU+Mtnk}*y zYDX58o`Gx^EbG*$2RT6*L!4r2B%v2BfXlI1eJH0 zfZvzxTFSC?jD?4l6Qa_XJHyjIm&<`D; z-)L!Sa+Ijfk@}an7`hU+VAGwt`B-+y)6!XRp=>39YLU>SdyKv(a#983TVj;s zx=N!jfRT5nKoF4s?4nh*c_XK|*=ASQe-%k>_Fp^_@nF#LO;25*S)+&FM&>^{!HC3C zIsg;h8{&Ciu8)n5?jQcg%M=#0@tX6=AU+UFNv$4a9D^29)#tnfR{~ecpFe-9vI^(J z?}o&TOY?^Pj1t5AdE<8z*VTF#-;s>V&CR`=An|uiPMZn&?Ce@XOqx8od~jPRT6lRg za?+fe5Oa@L;N1O=hHPBicSyWtOSN0I=kK#dd=y(eM7xs&rE2qDzHG=2*z?!Wpa29P zKT{tgak=2RL5!CON7D8}j<9EDJqw&wd^AFU=%wGQ=z{4=aJe4QYT?|N{fEu7<<^9xRUQvS6#6sfC;-bc`$60NWa962gCh0F>21@pIc}k> ztbDKRe4P9xEQBA1bK0dn>ir7%lfz?=I0z;qK`nrpOJJp z*?&VlD{H-kmUz=YH!@g7rl$(O5TNa?(MxB>60;;B%#k-?4GPBsPFioa7nU~s zt5}{sl9>}p48bD!+*dHkNR6uyn7N;w*?`Gixv}DEN-H!~)dNv_C)7)bW1*tjAWh zra+ti8A0sY2j`=gE?FWA5P5fROA!KZEyJt`_*j}89fjmp9I42j+7}mXCie`;2@9?% zV1))|jXoKCp*ZU^o!W z6#C$k>g5}D69rK`OTEWr$gAf5!{ODO_tBzguR{(~zZWB;h2jjc>kGh?G7Jz)4;T-o zH~G1|Kk(5~{`0O4!l^jiVy z5-eV*JbtWs0N%MiUoL~)d=Ea`p4C}aA=3>(a%?sGro2v zSjy63cBDXxdLYUj`_tCU7yt^HRBLyIa;PLz(*~h@A=Ek7-VJ%bqPzS16%g!dcUPAz zLa=fJ0QaOLA9fLUkauqtO2yZt0Lt{%0bX5JDb;hNz>r5dofx$oc}pZWT-S{MFlQLl zauu=Gyz-a#%4TgKQ9r)`A#APB9WhJ;xZ>TWKl{=?g$@E3?@@#%t~UNbFQ8+!naxUU zh#>V~2K%~wsnqCSlg+fe*~=+)A2uQ);>)6ptgK}|{an-ZuVz!B_C_7mjQG(;HHvVa#K)7{&<$;{F<_{Gm+=~5^RD*-;EI4T=gI`@u8Y{JY;K&I9vZ==?^Q)FB7v=0R%}4++da^yc)|7djEPY8j67Q z5FGp6AlsFJ4+;SE^Vr1XWGP%jN&)!U4r$)-2R-i!js!EOT=mn{^TZ#8pYaE}4Cip7 zC;od2e4vA}V1+CK%Kq%TT6^Hw_R5+A&e!VzT(1;R_Glx*kxr$BJw6y3lF8%t_MAfW zI30q4V%00esu8?3Uw zBlY#7O@&13!838ZcDq_HEw+-~+~S#LFysk|?$1|7BF9UPmE6l4S>s%xwKimb+R>1& zU%#p=ezh>e{POkn&CA(V3gTQ))9CtT|NG66KNm6rq`TO`Uy^+$zr<7R8JPojf(OhL zXqY?u)5|>)Gtr7Sf>gS;&6V(5kQ1W`b)iVOu7eV!2)qk^3@k$qKGSp_z~JqkSLSqB zw=M<(YBVShsaKK_*0C*`QmIfw>YdHYAi6MW8~ZA527uJO|YF_%OEk+K6A zr;_)n&&Q6k{{{+J1)#Xg9$qW}FzeEtQ8$)uI=Vz8O@QZ=;h&Twnf%qS5bmyO1h;4F zyu9%;Mk;mP@6tX$&RNe~%o-*KmjA(5Ko`G|=FO;L$I)KBk z`i;nE4`7TvZ8n6X+!6o~?Ex^vc2ds)i9Ww)pv{rs6*>SG1LVwaF2J;RG z+Cs2K-iI${t%9R<$H|@Yvv@hgd@Qn+Ue_ZxpL(zfQAmdY4P1F6kVbbDt-k5m~FCM-l34ACSi#1$NYBTA^ln*gwF|{?>ou zXV4EodK?c;_>{lFcPZ{J`w+bWHqaX4b-jh=7Tj>m{cAEp=CHI%H*0-gA z1AXZskx`vGEQUJ+p8c#WpWqp~;gnK+*V@}HHy{>xoa>gKe#6^=pi9+xME9rKep}Y^ z>+;Dsp`t9z{7yC15rzJV~& z6~SdpV-p(zZMpOUpiILJ27&$Tb?UbcAOYPpH8s_-K z`Rh7G90aGe(~G;p8yC8=K#^rdDC7bJ|NoKW#`!^u=XM>=k(1#DL}%Ia;~p)O4_*M{ z#NuGhjtlroX}bv>>xrNjtv;Lq*vyy{u;hmK0GBhO8Kqx9fS34v>0af2TO}o> z@a~=5Dpd=)xh-n06&n})F)_1j516=s)Cr-f{vON9S3n4(9P<_Ys-1z%3#bcn&e%R( zA^WSL<&UDA=&^5r2ds!FCx#c}5z4HQOo8PEFH+1)V2b~86dd_8*eSKq$9hYr@IGj% zZiRVvKfD*dKr;Q)3iqy+Ew2}+thzIjsC*5-pH~!N8!u9*YrSEn*mu7-Eeepa5D;Du;O0H zgw;skBV;33I{*h&(LJ`LxrM@zn!fwkjms3BV&>}#I+!MaI*KhM4gvc_;)xh}sb7QM zH089<>dVH9r8F(KzsoC8Ix2r?3ao*{{Q2__r6k>|KD^k?=R+4dwX(Q9mAB96v5uNY(@~=<3KfdaYaK1P_jVOt zM)Z`pY5z+WH)#sLNbkVQ>#!_Aam4aeHbF48_Ba&hHT&VHDFH^(4xF&)xyIACR?2R{G$?CU z01LHqcV5`a4S2b?NrS)|=8CQ5R_Y=i=6qt7tC&AMnLk|_y{{XN=*JSYt9qW%tMpuZ zQrLe3xxkZsLM7!z-GI`6T(&_eg>4WnFohg#HNIS5cIe2p(DG<9At(CU|BtS>j*Dvh z-p65Nr1XkND2kw@rCUji(a8)NkAms*H%)HD(oHzQR_@UX1t(T-Po8Zof18benkzMJeAI2 z9H3gW45tANmDGRWFe^sP_#bJA9>8b!5wqX8AK?r+yxF%r!_02UuXh!QW!Q?c)Rc$F zXVw9=nreNH9+0=DblqA2x%&966t8Qo0n1UT4@%@;0a|7?H$e3rzr9p9{=#d_yQ68< z*w|QAeIsCZARqxcxEYSUkL0xmY!~Yh#B2{>kVGwL0|S6Gc<2x#Qxk)BR^SgWAosHZ z3=KYQP{+_o`+3&H_h-ttKbZd98hF;VAl9m!g9>2m&ADF6Nt~^MDGaHY zmnqOH)FUn0s@Og*Wq5;K8RbXOef(*qJlCKstDF6wh64F`2q6lRcBXA1CEuAwY5|50g%K`b8IH6zgY$% zv<1!2Gv54!oFpW3&*44xkBa!mcTmLAVY^Fn3DA<3dVOmGy3=eoQ;ntTknMQ+>P5IQ}Y2I03M*2X~n<) znx{V>tVw{dsS2>AUr=)Se|^XnztSl;&P#RWWd4$I7GuvEpbOhHi9olN11X?qz*i_M z2CSI_CjIH&J8EJItRB%tG6FAMAwLi@=7PrnVZ7~ezDtohdghOx+i@53(=pysBp|2! z?_dsUtE!q`kyaO6L8}Zxor>HzJSdsgz1{GsYB%+tMjk+QTX4N!{lC0L0IBC1+jM7z zGSeioUD9*BrN(~p!D*Y@kd_7Vy(r5D(CtNfCnkVc*W`sI?U8}mc_>&b8QJaxgyqh% z8x@_BS4Y+;ZsZj}LhQCT{8W5&ji7$4)c>6m}LioVE3%t!!POA;?`2=3j^t!<{ z`puoxfPe}MRDO^MZkcEnPe$g}SdinC)xZgc)M`;#nBnY(Y zKgnO+VR>wl{y8YLU%x1l=QA)zIaCHZ>{~#T$^imC)D$iHjoegLc9#OioA11-2poT? zTCXvxt!Krkg?s*Kc!*Eo(?IqbsG3XztC&q?DYy9gbBNdE{ZQMpNABuQl;JII(=f;Z zZ2)9&?^*b+uSlx*^eGXiAyJpuj{s~?@$xDcUILnwuJY+%zbwK+hai(uRZ=@}Ea3aw zT5m7;V}E}E0o9`8wCR+d14oa)u&vzCPzEJuX{Xb+B?zuWAe?s-2qhVP`}pFb#S?F^ zN&K{H!MoIY%Y#(U()E==VMbV#Qi7wOJj;8kjZ+_wiylJzQCrrQNv$iuhbeKJm&VVr z{9jfl#0uPg=JMon?Z!3BuO4)N(}`anu$ zm&(3R0l-D?%D14xJ%EO04U_&vGJgn7wB?x4} zy}+kWco`NJ)7ba=hc^9$oT)teN6X49vxwT*99ejugA|_=h&`r(lMkd(YO8~VDw`y53Bb&a`9T>J(2o^O`~e_> zg^+bNQ6NpZt2L6?50qq{`JG||`q7M=`Yr0GYZmki&Cp)r{q93ck3k4jm&WR&HZP)H z#2!%uX$V6;c($+VRsgzQnr(+jUH>_-T%hM8T{hD_oX!)tk^L!BoB~R;G03M<>n9vd z=WhPbfX7E>%zhstdqgQ%TE$>ZfGU&ntG&+q2ye8S-=`C`;y?#sVH#Y<#*}svgzP0_ zOk65}h~bztQ8{4tI-9G>Xh2}PW7Q^2;K1w%lu;GIPv^amU%CS107AL}vXGfiSnUk> z(K7;If!Zm#t*-Dkuw`dk^Q@+!xS3IR0xzGrVI|)-D-8Pru%lY~`6vksAOyYEkq8t{ zJ0zAmu7L2I`*P$iNS~cn2gpV)`SjVYl~}iTTi%T9ROCsvtOb@hk?qIVpbk@puT0&h zhp2q1u1(2)uRk{bKCYL0w~Wlx`h!g%M@^%hGgwx$UHcx8$6@32>_Wx*{|13UZE=04 z@>h|%wo88RCl0mFDwkolCoXcOk7D#m%R)^JdU)asEdoG)(>23?vY*`iBXrrzOAiVp zAe1Dh_%2pWCjDG!?=OG~90n*LVKE>$^o;?yyYwnOzYI8=s%GVZ6*c^W@;=AHijkl? z0A5ZUoG z@U+A&NI0y&_)Gx+%oMA8(_kD1-F1L1dhyzns-pv(cL#$ zI9DbkCa>dzqriW9MoH+~el-Sqy$>`EsSxUMkn^DXsSB+rE}bjfoKDg$z0T3EYkBz6 zlc1n>FbLib+?VM^mP%MHC=MQSICX3)S}T{A?OlI)RebY(gIL(n(8WhoeA)sr>m%uNp|APTE1o6zOr| zj2OujD6~|ArGEvA#}pfJfmpB!Yo5CD zPG;GuCTyczw%zexYVz&h5lkswnpyDlg zVI?#Zt-?%rt8Ly0a3P{k(Ol@=hgZoDl0wo_|98FFd7xC^QlaZtrIgG4`@D!{kUksOh;9N@WY`F(>a-Nxs@s_oR{5LE@G$_QY5vkoHelkpaO?Yw+|LS; z`CUks)p!c{kB1)tRM8G(zpoVg0mYb837$NE$?e?B+NCk@TCw*&diaVQz{;&bvvX0d z`e`VOG1Z5cJ8*iNPNyXRTd@-S!+5JMa2%4_;V5U@omH3yt8QF*udDYF^$93#!rSI9 z{{-2`FbG0}g%gj855Do+s2Uf82)Q9}rJXCz=o4q?D_ot>Jt%k?K15sljHz9q>PvC( z4*;mwYiy?iY$#Fs`MU2py*id`O7T?#K^X|(d2{Gk{sUg?tYpt+Y%Zl?^(hD-@QR%~ zLpyspFZ#0(!JR@$7=zeumQWP~E%MA+FZDAe$lnNqPDPw1#qe#k)&<1>7+g}l2}0F3 zPn?vnFU55kTkvd6MCVpc&$%O?T0aUTqrUAkv z%0i9=;&7s=TfJE!us*TGY8QBCNZ^9kpgE;lM|X1>a1nEDkvUMV*WBC93=aZAgqzdN zJgG*Ba|xRFwo2`KUXa~4oTz~{lVURn;OH=*IXMn+%@=k{ax5G3bP%M5fRyP4U zNEV>G_U3F%+S zd`@&acGwSsOMnqy{B-U1kKH-7fcY=MP}q9gm8p)`%rw1UI3;h#YoTml-Krx|td)91 z_Z6%F%5+x%y4J4<<;igxuT`$lvK22!-tIL)`i5r9P zb%~=)VO{UIWb6v{&ZHCdPCo<{{HdrQ#59HNFQP3{o&`5cN7 zht&+I<3u#F`_0bXpYbJy-;jUKuE803mC7NtJev$6h?p9vvws3DJ^LR3+DZubo8+j) zEP{A!078saF}tU1UYIjHU^_B&G|>^@#~n>8K!?-jURRUfy+^)+>Tl{yMl;^H!%w98 z%;#7Gi8(LW4&(Plp^aKTgb{j!<)R7t{g@Rb9Sp&f;*lPM=0Ty#zC0;D^B2;cJUl%U zi!2(YIBFewHy}IbSoEIh6=AT-_E=ccT##%%JBv+{O+1J?oG2@FZzl3ulxeCXa9|?%pvl9nQeA{_> z4Z)At6A}RlRy*Yxx!a)b7gpud+A??b(9(yQ_dERXF^_J4;nK3QQ!pbsEPP2utcen)yh?#Bd2wVsFBy4XMGWaz<$K030A43?{|BX-1`H# zeToiU70g+7y(l~Zl8Cjv;S48L4yWaQuE@0mlNAE%btrhyMFUlkHO!VEG*EPTCoP}w z6I4aD(l$A$RF>!t2%U+wB({&sfxM)GVEnDZB?1TN4%7kiB>A ze#;nI23SV_4Ver~Bulc~pv07KlzbCzTKJI6y9whZkb_*LX`=DXt{2S1_{pe$O&Z_% z;EgZ`Z5Fk=UHv-V3Tq$=sm!xk*WO(Qv`pJe8yz1~RJUusW(p&l9gCZ}85g>KNY7x_kkD+5swNZ0%C)? zh;YP9irM|fN9Ygo6nu5s?YG|Af(AJ7<8g}FLog}|APdjdq~tEXiQ2ADs6BkiCo=p$ zIH@bgy-tthII#mPKxQKz6ioSw)}2e*#i!q$P!m0L=+HFKPP=6BA><$94d6?}H9dil zn}n0o4_uB|+V(9p*9oZNPr?yJX?DtM*96@Fkevk5x?$TJ8xSx(YYq!7Tndw|vlO!t z{W)M7Fq$j|+RLXw0YVgn2Wz)X1W!P-CsaCxgP?mYU{2Qy60R3+Gxc%<1wpxJGe3B%BuQ9`Q-s|OWq|Y zIDl{!fb&Uq@Xq^WUp;1b#`jCnG*q00YRYp%|>pb{P*X8GLfpQA_%BUXwFu~LCHa5Oh{;eXI+QZ1F#wgVzM(1bOdLdQN^``v|;)HAdn zAYVb7soxir(PA%>FZ#LYRp(If`V-9xD9D`*b@hkN{4wP0^)jug=wwm5$d%jx2)UTc zJkJW?AV%+&2f$6V{oLvNdHL#u9PlOWYW~Y7RzUta;vH|sscry|%YYh4AZ(#|cq440KM(iu>t@7r@Ii|qz^V#!!xN(fJZsK zr`iI-=Wemz)Gktp(idx9^tmn!1<Vi zwhWstK-5nDYBl7Lv5AA;hK@y#H^+bOn)ZNxpfI@~4~RZcO-3Yb8`8ZqKFf2bzKJDN zCjW~RG2a3Ln|PiYFKC!DKKcpCIX0g4ZG&VC<;fdqth)~#4r23vEj&1CxCCMJAuyb) zfiC$PhzcH70G->AvvjY)1AHMRcB%U8C7@%!i0mFF(#7+s>VmN#?to3D>R$9xDNd zTyRLtm(JWZA-olV%HAuR4*(|Ip6oSdH?om9<^sHOk~fgJO%AdsP5t~M1`Q>{FMyYp zKQ=HMj|mb4h5x)tR=tZ!FpczcHYM*%0iiPRF}$EHqwsSDsa2Bq14QITxI&IU;3)8l}^F!e}Zl49ykh2h%*nB5qYJ7C)7;= zo#c+DkH9^MvuMH~Hf1LDK|SJPFK#dNLp|2@R^ z9i>62g)NkY3*1aAmX8f(mF{oa0OjQmw@k{YLnm=I{y)zCw{j0lUKcB=r zBMT-%{e-HQ|C~kvQ+F)&2IwL10JAg-w-scUpT7%y)3bbst{S!^7FaGnBnO&w+Ca{k ztnnJa!O|sQ^Ce#YOY)s9r*G(b&hc7+C$&M+tn#5OF*+qQca}i$_-f-K)XhUP*3J8a zWy%=6MiVawVCZD9SNtnP>?`HJ4m9QXJY_%i$gww#-FHm*;~;bCc_cY2f6q9LA?ea@ zT}KQ!n6J&hY$~*x+-ra&_@K|@F|}xxXS`Qa57OlQlS`*35Rn={{kpTWHZAkdU8DXG z1#YBe_pI+1a|Q-~fHx&T0)|j!e0nlUO`Iijm)7)qph#MEOTW6AJ`;1^5Q?sXa_myanSQ73k&)m5M@#kg+Cwh1QjS2)193pMf%t7^cqJ z#(mp;B!_ViUa+PvWQA~sgZn3aXIp^ahb<-zU&kMe%>7;pES*^roSuqyNI;z#YkUf1 zVZwF4x;nu;-)e-`;Qgwano&AOm+yNc?VzKO5hMP8KZORgj@De*k$v^>_nYs3XU6`N zo?zRk(aKnz!=U}@X)DMRPR_*!E>(RHNM_T2LjjI`#6@(WnXgz04yPvkYnmAhBDx>_ z&#i#Pn*=2>wXxD77XAOfVLC#?S$p@-6VowS3~d`7aTg~{uC8B?vQ9enIZLvcSPxY; zBW~`E1XLHS-_vH=zMgcjUg!~8!vFoWYb5c&(RdS{?1S0DgO@`DB*1*xqvHY2{yvCm z?j>yLI@5Eg9o{Y{Iow@J`| z8w@$1yW9Tre?k+4M^Pv9Q%1@9UfXb44)G$E(Oh6V~j6ESk7jX`1W*#N1wp@&-UpJRThP(r>2a1?m_ z*;uVj{+|(^tS%kcVvl+zP(o`;B-`tzt4e^)9dka_*;S z>1>P0l1$Ho0o#Vi3lMf+<`5wrK>KhWRYs^I9Ta_PeW4yDo`}0!62JVEwgY6m`W5s zp;8ygCVempYcN2MfAI>TS6GABU-x!aiO68A* zL120lsZ;6CjRu4D!Nk%7uN>082u4-}8Pq3so2C06UNWywdCp%1a%#G!R|sc=%%J3kusR?0XJ*?YUzAvW^<3`l z1%e+r{#PldR}f-98pWFLGfmJvr87JJ$5wAYkx|?kz4A z4KGS0ekM7b#qOhFm>pz&&>twkbMS2IE2(g&gy zvJSqF)(`#!lH2Rby~K0jyX+D&Z5KQy;XOz7qVJG~M&pd% zT68~?CQ9{xH^TlzwmLm%TDV=DKKFZq4rPoo+II!nLKsX(wx)SKMuV8#+TeJA1x%VJ zz!qv203F93CkEXu?S1FrcBsyf+ z_d^#Z0JHpmt()k1F!aLVlmDMFyY>@iw@EuFhw28r+gIYURSUzC<9m0ld$u>t_a@!1 z?al05SC(RGlyMGnM!~^9fVSi1q1wmZPL~&c^f+?^2Yip$qy;XE=3m()T}2EDwnHhBh9_e9pOXkqB61O5T88h& zWw8G`P6wOaQW-VPuC4-%g8j8W@V#5g>?fZxzfg0$-v8`-Ur)<5YYmE7sKtfO5c7Nm z7buf1-g|3QW33pRH~WJ^N?+}Hhf-xkBLND~o|*ZQ*fG%Ev}6a#8R-g1U!XMY6i6pz zA4)&|gP9IG(3?z{HE?fQJCrAzL2`%cni`Al960 zeH7rWVb?%sYb=UMm1w4&&H&R^+4>0d`dEw)<*B(b;`8@&q_NSR-un{s=2-&kLHo_O z1bTF_b162THS5ndE$DhO8K~SV0k;K0RjPypfOCev$j}Xa6|LH{ADtiUUtk+|s0nu| z3@*?ywdvnZ%7r84LkUK$p3tP{8uj0aNTf5?=r)KT8&%=MUZ5$V*xT{Iy#skGvHv-W zw@d+Z$T5{fC+m<@>(wDK?qsr^LezGpZ#J3lh5~ENUst4!yo~ertQ_zg-yN{tgSSf$ z=KrrzGy%bBbT($2GjNM&&%h5I6-frdMG=8PlhJd(*?9H|WA+T)!R_#tf?TTSi`ggg zje0U)o>_nY^s5_o^y>QrnxWKR2MkWHSS&14@kVeC8XB4u9$6vn7AtxT&W@JTW3lgP ztA>+`y|l)#8RVYSDL`}FwteH!`PEd}{YQ<^htK{GBj+altt%6mEOnvz|6Sc&CQ@RDM$Wix%MOJj$;o3#}p(Icsow*mH{ExT$1>+=014 z8&MH%{r48pH$l}?_}awJ^Rxts-!?XqW5K!xN1FWuE2Bfh`$pvTE^xkPIw~tHk0l-9 z!|M$#;wfqnB_YC}0?fOnhvjX~ofG`S5wHuA|LGUN#xVe7DoBTskM@5&P%SFD5Z$ZS zNRT!eEQc!Nen%+Fzb47IERu31R{l8*t?;?Mfu=#wHYs0z49#(H9-v4=fM$<}<=2jc z5}wSDeeMisC34VR2JKf{JYtZy63l*mP%*FPX?Nxy-ZLuz>QJQclm|>#p`VNnkLRyG z_XM{iPKsTOdW%H=v2YdlQTlUk5CQn)9DjAAL2up-JuVqT(C&&JqTnUXBdf#Eg%kAf zk5w1)m8l=h9#BitWO#)2J#8~T>eabq-dd6(=iF;+dZOxs>T0{loj5Z7bLvXutjE&B z-h$jK)BR=7!NZ3vow^>m)E~PX6b1n0WA9>y2#6G3kcpAp8>b+q>&)lg97OcxDc%DX ztZ#6~nSpG?=6A8v=^6}rqRPO%eAv;0o`h`}8R^BYLSU0;lbvwcpc4OP|M%W# zHsTTtkJ`4hH!-^1yJy#LJ7k}4v%|x6pza^Y1z*x5q{8! z{j&ze!w>8q`DQ)~6=2CW6A^=tUqQWJcn@*)!p zNu&u3#u$LE85%wfOikn~hvQvT;bqZT0$_hY*R91&m~E-ow7W9F{jp#6-t8rs@j+me2Qm4P z+H?D1)Ry%3Qb}aFq=kpFdq!OZnvD2$zkIJ$D#NUr<&mUwvSEvXd9#JqTr$JE9GL67LCC!CzqAwFQ4;XZJU;zKAJ(3*W zb7WO(SE)AC$2!+o_`$PFAnrd(_2AGKMkwRIcBrh#UJxeLadWh1b#1LrlhrEfIOZ1- zAsIT5x|A_r&Yi@8#D1Kdk978Ub5I~SH(uHs(@R8czvIoJB2Oag>>t)@A{nqk>PcZW zXr01oxbORlfiTspcs_4ln=YU)@PIc8eTzI<&BJ7kX?}M0YsafgtR7?GZle)O>DdhE zNNV0U2ebz~G5Onq3(mdwh33BxcFUK1LcGZEzfTKVHEdIZ7}>hGh`?*=ID0{uLr^}151~f+02F-zZd)`HLDej=Bx$=`8P^9 z|EhDL@yPO+PbsUDn)d+$`BWIQVk0v%_T4bsL=&B9o@p?OFZ6s49Zk{mq|!ywVsPTO zH+MJ|Y(}eT7+l`ORWDKx?U}v(YayMMZ*UUb&7=l9n6y0S4w#ikGRXX-Es(!K+Ep~pfMHF~zzjxFu4c>VE&?55_c__nZlxz90`w+Pj-fEIj1JxB5 z{91P|$`sKkI$Sg$m}yZc-451uQVI28-vs`?3Mkb!e+b*5A+WRO&B(LIpteU=Q=a^O z-8*`93{s2iA1pmQhWG0`yg+EG}t9q&Ns8Il0*8UWvb|GU#8KSM=~g_nQ1+M6k z;Ns4BM7@IUJqC8FwQJ2vQ?YTqG^$`!F_~NKuw5NbAd&H~bj3=d0;){$IXL`(`mBJ|%CcQVs<35eu@+q6=MFsCAuOTbG|9&XBi2 zR@#b=u&FWQXlUwT(zn@%&p+j@kuF7vV@&Kii-#z(I4@v6;}-8Yddz7Kl2a* zJTv%weee2}YOgBuh4ol-NHwD=7qys_7G|N*SeL*4k0%hpy9ASx)w*5zBrkS#RQW~5 zlH#XVm)E>oXTg2u_Ag~mHP70-VqysdXi1uEl6kAWr1*nye)FFDVHW1Z%1w>NzCwRq zIbG>s(r$+zCwv=FfzQ#8k~UWM)i*Mf6sDsNJ`#0L_zbn97h<7^C34|j<*!u#2KDS= zc{%mj!yj~1(Y`cKbTv=y7Jd@Uni})=GN||GTk7yNbt3Yr4O7u-c6qLGgbWd}!2sUM zzKJRZVV4bgvaUx*zhqbcu?-`8!~V7_W!IbWDr;Ap@dCHK52os^a*Rs>cwxYgvACy4 z>&|w<^9!wE5FoN_dV(rYiC#rMl$aA)QrS{HFW}w!ScS+^V4x}eDZ{a;>lukX_}Mx2 zh4_;mMn|R3^2>dBa5e_FHnQ?)Nc)Jn4{5vbV?L)xhQ&!aS1LB@dKusng_Se|o<)>) zE=R2XXz@{6zjM=xN`UFsJkqoiOha0LuvRAjEGXL=FZRFmcJXDt{naItOwtZw-o*dC z_A4=wJWfz~=4{rGn1?wIujjvaL*jmYaZ5Qi&%<%k*<{eipa6k%((S=#h|hAj)>IV7 zoC5_S*YgMwz@-_B>Zq5p;kO&YM|NQQI_mIi-7R^ZLTV0GioJQi+60p`Cbl`}Gyeih zQI1-aYw*EXq%2xA#6|%N`|&uTEILxQrxM@2LF=R4y>WCb!*wh=*@Qq(;mV7MI?jti zbx<#QUz<6ad_7teyYftvyi$=FoL6)rg}Y<#H?_uV8}Zq8tiok&Dq`A+B@NDOD?f6P zu|XLdy8ThIv^Q1tH`LOQ`Xd2~tG7LRS0r&$-(x4w84a)Db+>QMoXO-Yziv!T%TOo< zTcmw`XYSX)t$HxZS=Ie|n(nZVGa*I7_J)K=eK9L5E4N-yph{_N%TRxpt6;FwP(k3~ z^p;#_uC?nD+DaN85U2tH)UFi8+!(j~S~Bf!cfD=*u|97RM{oY+K5njIeEQa1{_!tY zAWE-~2b5mX>WB@N$_*-F<)UdrEaZH!j0BG$*|(J`-5Zo(Wo!&u4Th!gAS%Stn^i&P zW96R?ekD+RpGn~?ziJG{JFyh*BRyheN$xv$Ok#&_83O!6h8#H-oYLKsJ}nP-@6hP> zC@-jpVZlbN1q(*pSOP`1YtN+)tRMOX&Frh|rh$*eOs_7|46Ph)wqqT=OgYfi9wMPe z4Hk33midd9^J^wKKo*Pi93@^rJ`ppGt?f~x zC}zhjtr)z2-p)jsZl(x^bc8ntp$lKA*ZW%O+ z*Ual>MX!tJK2J-Z5lZD>MdSo zm-i)`7sKSDaY0g4p-1&pX|0zrcE)&7)wlJvw+4<+4)D0Avzex~RJ8W0mFX%<=+2i6 zrDa$-OYRW~+aJd`8o;C^=8UFPTJAg>deu>dU-9gfYBzZ${>16d%-nt{Tc4irO)_7m zQsEz|{>NAaki%ziV2C_O>(M2cs3|daHNi7V_Onvuv};stYBo;=QR1_<6SvC!S_P%y zm#4N%o;&rfn5ft%%MXnCEuaP-oRoU+s47r%IFUtr}v9jm)Dja{kIJbglPW(?_aDqH7s?^OU1Y ztH&5dnD)RT75ZBbMAlL$Kjmk+g+_MBjAg7mk6a${`Q&+f#)xa!TiThmosYTygTeMl z{(3P~1P5OEbGg@;G}f1XH2uL!Jjl-bsb(v$4QMGP7GyG3>U4R;MAo_y@{(3h0lP2J zr&(T}U*#`i(r2w%KDW52DkEkQAYOcQ$v47|!j+$p@uVuX%(=7Ztqj}j4kp9f_z+)? zA6BJjqi5?Z`#eiYztjcjmNS6&jtMiA^6#r+WfhKbKcej#o|UN6eP6eARBOr8kyznj zJ*ACQk!t=sCj%K}sg!G+t1vT`aYtl~8Nb2h{gL_Bd`(xAug=o8f#!=&5D4b7rhgh5 zTraM2zIWO_ZrER?${8>9X>#sGrdwQx`TdqVhtZb-g43v>ggFA#M)sE-%S1TVzE!U; z!Gy=pevp?Csw^rJ4ENL0j6fF~)j^3mI}W57*^?6N_^T)x0-8u+>c1 zRGo25{wZoq+`{tV+&l*HQ}p-{h^`sa2a{r!XU%d~>z)@cMpCp0VTk-2Qp!E|ueh^j zI`DBB>&|I=E8XwUA~iZ9yy5Nz1Tjox2iv0ejg1;5gR=?>1Myq_*9MZHn*~SM7LN*3 zlTw{~piRVk2=rdmY?e{AH`r7v>sQ#^p|K6%iE&?4k(xs$cy`;c6E8SDyu4=9&a0aA zIofVg#*k>k1Jox2TKilERF-HZiBg8mro~$?I?Sa~wS^U_DRO}$G#$-;$~Al9UffM9;k=ctay=JZnBL4q8>mL+mvmIU0L zu$>NNg7XG9QVo$_7~OV$ZNu=Xy`!gfg0OjGT!Vk^OuAcWZMu$snTJPB&Psx2S@F5n zW+)M-XC{c@!_>;O@-0$)kM!nE$JplpzF2kw=&9E+Og89o!zWUb*GPCIV>5`3$rkQd z*760Q9URlgrc*SM!yXX^Ioy)2;pA_l)HgkbbOjClmmxvIKkSF7!-TnK#+f-T{KCJhA zd~$JKO>eYvn#xcf*u-AYp?)xB0EG`j_Lx$B%=QH@sqeWK24mr^^|BYkAyI+_OsDOO zC4p6a!Im|xl=b6I5G)C{-cq*5k1ns?N>42sk*-bU=5?gcpw!3qEGtqxXKcgItAV?} z^{Y^(P$^W94Ft~e8=zREl{TwaU@vhrn)PKWVWSJ%I);!}N2sats& zr-ivxh=+}EMYy{hqmEXiGi&-=QXDl$Gh0Q&HSBeEOpsVIZ({h^ z_~C=rJ$7+OMg^=xx3}U#-7V<63(7|C`X0c17bF%gOs20q@`ArvV$iXwxW z%RJ9qBxNvE8RsTyKJ-`Q42iqfux=RXVufOD6fh27C`>IrV2Q`xKA+(EOBvo#sZUjaOA2{y>OU7;HnD~G?z3yvH38K0CVq+%GPNO0 z?X$FqviB;kIXrW;@8$2v3?D5>-;L0URAI@vS(Vrh7$6UWCHm0o6GD5I=X2YD&z0~y zHf5I|ECl-}T6^Fv{G#(3SmWDb{u53L8jAbuobTphtF>cGmZ=u#r9ut&yP-2o(Zc6b4Rf*4vbK5%K}fqKdSl3YfD z>2j%g<25AceYA6@C}-?V^X-On4JG&!@m!-B6f4qFQi1wy9E3vD*svW}O=C&Q>L&ME z!j+Sv#G2^-nR*?Uw`^v7yqT!6+xW2I0#?VVCVpr-98&?)kSo=yqO^Cu{gDMWb^PgR zvJBtAsIz6)5RJ^N4h?wh(l_^z z?jpW?h#VSnv6d=`8NuW_$ALj-!?h%>Uaxv6-n$0}PnPY0=O8u-QhmS}!B!!)nx<@& zGv}(6o?v^h+ntxEPxP^Bl;^oo)q_-fwZIK!DSnRP{q(`U_(56ZTCa9d8J#fI8ZdmBvJFuq6VxtK0B+B~`@6 zH4XIP`-|vEhohh_fudO5z0n(<;!LJK=<#@-eGkWt-~mDS{EoFlNrARUyFE$liNTb8 z?(F=7w9n75CdQ`x1d~S2Vb^8S{-bM(0%{m63nnuXhE;33Q60em0Rs{&>=R>oq_#fD zm_b@VP}X{5FwS92X!f@FlHXvdvvPGSVAZKEQ9kIs_y^tqqjKNHXx(M03`3;AU57nc zz0wvRH-za|Ec|^`ft?bzWuybhfsVbBoTX9OLxM5fTVj_5O?CMRJ$f#0lvp^EoX5OSQ&AY+yJER z<}h>90`FGfA3Ne4@xr@n*U{xdul50JOf{@BMZK8%T?Ka$RslRz_6g>vati7$e*8-3 z2?FSBA~{l`-s?#F&tHpBRi=lG>@Co7WRlOxQ0I{cZ6HY4FOypDPc-Yh)g4D;$HS@xV6ZlJr=L0l<4xNlw~5wY zKdVIn*UkX|Y#oPZwYEJ+Z?r_9Mc@WltbWC%$>7GqA#@jYg>FWps&=&gweyR$ZS zNV_!Z2nF3!K}=_60i`4V*NV~{XuE)_)(vvwpeION0cN|<&FZ)y6mxO%U>uwbos4XT zwdUI_Nab#{GVQFC;f#zShexs#WHlh^(Z`XTqxY&5nF(Wmfp$bdXP z)5D|iwseJmb;m{Vho!rQ#&u&hH*ejSi}DuIeYD%#COi9LLdCqNz7wganwmNHYP~9~ zM1!@TdAsu4Q@+o}O!+tfYF5QVsS&V#Ae)%oIv;X%AQd{B;1`kf*`C5$tupGGPWC!7 zj+E$pnpqb1@5zC~I=d%ZX1e<(NFBLQBek8>modpNe)@-*w?F}Yjr!5(A-81XR2!52 zv}DrBkAZFZH+v>ymonXJ^Nk*!p$IuQQTt{IhWtK?Qh|3=_W1O*m&aB$w@yrpZOvn& zpliY;z(UW~wcu+zsPBV7c`U;%IC9y&XpVc6>vdgDt|H9mnAUJ~?I2F)gR!$O+w7C~ z#vKQMJJ4>KrIhg++8!DoUrKgr25olf$l(PR=`M**5P?q`A~pmyHm;dBX8CPMm0+{X zsY0k`OC-S{6~QKQiRlWvGRa^>%OhqGhBh7@y)L5ASp@b%oP1cOFzh0DaHUPR6;bwJ zE2G<}cn^PIa>uP?7LuBv6%kw2R3iQfKP4 z06Ijo5sYsQ5HBROOcw%x^Ohd_yveN%1h}0?Nmo4*7%&=GdV-hYR@jBtNZF{X$M@!e zTR1UG10F)9Yx*1Q5V#KAjtRN3gYS$O_A~89Z6te)E-D2`0(^uw6qGoPtHq2y`vG8! zb7O}p(f#4qX&gc9Oxtx)iX?In;Y)6e;+s2@DSSWLbv#GFgB^{xP1UOMBpj8;n&ROK z84I(sw=iW|q*sHFx(Om8UwrMHL3iwU{uTJgPN16fI!AxlN*aWvwJ2bl@M#vBSa2I2 z&%+VtVO+VKUq(7@if_2UDoH(mW*|CMAMYDxdXg+hI{IK$2E!OxK9*OXUp<39LPG#W z4ckgoEiE3zxMA`+b4Tw!Okld@_h|b*F|1(r>zkblMsG_|Aq?ANhBxs#5jB5tJ9l5@ znw#t&optyeNh*tS3KM3F1Ut4A+2Y>Lui!I}UqJqop5Yc3*Vk;>CZkKv?shx7$UOXLDaH^XO^S!B}VNqo>i=C(XjX!SskfyBb+hu9ybTc5BJ zbDv%HkYi3h+qr%VZd^!i2bt^hS6;0oEYPMH5YzmSupvqf2m88tCuOtZLKtqJ&(8d;-gQ#z&PZE|5=W$P6laOKJaUAQH=|dEJ>$7a9 z-7S0GBMB&k@XUex@2$y@srHoK&h-69Ay1Y^V_5L*#au>YbVb$pT0*b)O~szA2Hgv) zRjXWo1MR+yNWl{`uhHREM4KO8~ zaL2~Oqd&PTj?P2ff-O9V@L*odgDkVUz;D9!Q*Cj#K{9&gi;MBjd=NXA%0Raz{Q5is zGkN$bpIT0=&pwep!iYTCV)ZdVzht%=^n7S|TSe|o;!>+kLo8PD{zn#H_m)sir`pRO|v$UtV zfVSpP%T~9-Or8Cdo=GaI;DY6uGEWZE(j0%6(cD()PElZ=_k*c>@P;3kRLh9WUPu5^ zzKI8EtnS|-hUJ%VY3lVN?y09d1iCh|;XD{$DoY(iYNy%fRb*hT8qKswstdUR3E7JX zLHTd%7WXmjgpGmx3hd`_)Pg}0@yqg;03XOCl`64!4woU-&aBnArfeHz;D7bFw!OEr z)!`fEn2=@cx8&=4?1E*}8Py|R$7Re}8e9|H3x_#5Fv9m39^h7@{VyNQ)1HwF_3UJR zYkqBQrd8bDX@PkmEBlg0Yi=J~nNTZT(^Il`lApGHi5T>FT0k3PFeoY>3hG8+*5r&G z4)(R`gYwA);m?o4*fciyDv$A{(<0^B`C<4@n?bRwIz!6RH0KaJz}KUVXdfBB9qP!d zSmX@_{fSQ~0vjI{S}0sUZEm%9`iceB-H49&%eTTRrl0A(w1af1g=XYK;+3ic5u!U*tJFdw-{S z=X9BA)JIquu<1SUL3R)W5-8Ax4o_c?$B4fC#}S4ep#t+7QW8!oc`qxOY4QxmbLMMB zNf`{#oC*jC*g9=a3#=YVz6ntPe;v@VwwV46C>YSKCmY(IK9DYO<-;t6##FZth~Xn8 zaCANHY20WA*rGxbm;*_cpQU6CO`B}{swRMbUBAAC;O7lvdvv!*lQbX0{uv15-h_|w zt6$-}b^h~c>x~u5lYMl^=2yhv>`Q&I+Qaf?Yow&Vmk&^wgB}@Ffnu~{&F5C-BpP6m z>9{f5P1)NFqm+-aw;>=O^bu5Q-n+e(!W-WR^1Wz76gc=OWA-mT;`1znCMPOLfp8f7 z=1ATiqasEhhIeop-q35eSJTHwt@(2UN#?&CZfw6)EC~gQmF~DJnjU~6S6A37M79mg z^lyKYRAr6cYuI8BhHYKdo{=;hUd^Oq#)&7)d(&L{hmXtcqe4s$z76lff-M;mCtW|O zQ5b~?gjLEGX=gcHBbg`^0+gJ1H5!kw+I;sH%La3q?TmyO(bqST;t#z^{Y0luU?ia_ zr-2fs`okYPib$G3h$6US-O=SL^w?W|+Czy&8caR&&6YVf`bV5w=hvb5!i^djkPX;4#-;3T{%2!@|x?YdHSB2oYX_isByV42hQj% zU3wKP45sjG*vju}%KgyVrklTQ?N4F+>{<_*4s9z!=|)`al;eWvkH>S%MPQEC2|m$+5XXZ(qJw)V1KX&)L7Z1${MX%reI%uJo| zcqy#A8T;{R?Or+`ahyEy_&GYy8hVf96B?|+z+_Iqq{L_aFXktWP(E%36beLmL&ql8 z<&@xFD#v~i-OJbQ;auoye42749#}(H5Go&^ipC7=t!b~2nRK`-*0{<-qaV!1KK3mx zDG_lcZWUVd49XVg><_}Qi;*YOdZ-?8MqFhudUsfxsS^mq$_CHy{fx;n;*X0sXuqVg zyp0$T#53JACJwepL`obeP;smkf_DE5VY)SBUKq~^WoF&6K^W{l*nP{O%l36%zq+&e zQ7a()1Z_*iM+(3MM#Z2F^|5CgriI;~l)0ny_r}vk(-E(;*{}MO!S zz-WbeqxjO_J4AJp^x{a-Jy9*^|7@B2N@xXwA(C3ti((UXcb z4(Bo~rCf`Xf8Jt-BKaIBYaLCkTxCq$Nz5=nZHQC#D*>S%3#w?z#!FP^^2L_FgHR2m zV>;9%Y(`gt7{b&cd2qP5BT;^I+M9#K`j%8QP3RVk;~`RR%ct#s;f6u|8b@|UCOZAj z3D(x0Lpv{)7={wKF>v`oiWeI$4pHYtT>~j6!iU73O@HMQnm>AEorv(l|4tBayLOjn znwziAHAXkh63d1uaRPde!WNkDwq54XpWwV&9;^%! z&puRbyYNPR?kwx^Uz=mbSw%d^7OSm8#)`ajH5X1LlJf-0F@_~$s3KS4GtNv>!5D>P zS%B(o%S&4yZ=LMUy5i-qHGeVlC{d=@L*cD<549HYu@frvioLe5o28cVCo&Eed-Ukh zjGz5{hwDRQOz18byMvWnRc(CByYHA(ADghF&?<)psT#6R5#0pU*cIlE&d%`ksc&k> zDal2#k8ekykD&E8HEB4(n6E!As6U2b?SoEDWLfTD>)`>Fz zbtT)dh#9z|T-2u~^pBb`JsYsRs_#mFnqe+dVrzK=TPZifa-WXJm3~XP^s}IM8$%c- zW(=%VA>PcJcNjKHG26LnpJUbEnqa^7S<}0xWAJKrSWNHeP_Sl+EmJEBck_n5czX*C z3QR>ToN&l;mb3~BL0PR5L}KX;P;ZL4izJN?sjbBBWBt(<%i(_G=*`&51hLA8V#3{_ z!4UjROQyl2IWdrqDH_dK=_42ziiUR=ywzP$FvcJR($&S{VusPLZfm#tixQzUp4Kd1)?07)7zbs)#2%AvKb$xB( zlsI&lqL^Em9XrMJo&b1jn1dp-G1tPn2avUZFJ zigLMUIr8;(DQ$@V(x~4MfA0hA6Yp>ktov8dp2qB@n!}pxFAi^5&Au@3vRys2Tzl`o1&qZELw!a|WckBS;TX7{dG-FRoY6PRQkleYA zOy3L+Ld^ruf*YDz6%j-GAC^Aa4sLq!0k79>6MIgmBMkpX15V&|4Fuvt!LLUb<4WWH7Df<@) z%_kK=^^3cpb2~obRH&pAZiPqIPdWNc?Z5?>_+pXHd&v4ZVKQpH;7>y)uMupxxfml8 zx!!pUgu8QBz)1ERQ)U{+Af=U}NP^Y`voDwB?k(SWSUj-{owJe`P_=ZAxG9WP z-FrWpts@*YW_Z}IHPjjZj+PK3ZxFMg;eC$o#tikXi@CvyFf9y0_lCGq@VIjixME&8 z4}4WJbbPwEsIpq7$N#-eaAc3tKQR+*uiv-Qd|4ki#S&ZVJW+UFEX6AWM)b$3OtDm1xm>{JG*bB&N?$FQQY0EK7(}+OQq^lPR z?deia&fUA24bb8;9@inB55M`71YNFvIRQ&p2DImD`$-%ga9X-j@Ct@?2hYVRCu5bV`YnQ$Ls}o-cS@S#= z7wQ(hzgsQ(riw|>Q=sITyfMY(&mSDy5af*>zFQBm!`Vh(a`gV?w54pk;rjyWhP(72J~D7H+J3%cX>-%m}d7#6Rb14XmDIcK2@D$D|N z_>^>EnEnnDg@wss(gxx6b3Qx{gOf3)M@b*QJ3^|UHH5XJr@?J6A3j zVDI+3ot7`9Ivy^8L6o3B*m>K;4S4|Vka*8S+yAI&6xzYHtBV8okwf5$V5Gs289 zmFwu?s*o?J4PGxXm8N1RB!8HUK_X++^%-cf`O`iWd;edNlvBCBuO3s|%457JRb1_$3OCbgzKyU_)(>$_* zy#|YQC9%IWyk4RftStd``vq!lhOefOa(kY{N~VqObfv3Z#~;gMLq4FGH)>074@fh4 z5c!CHgft3-b)pW=be=fg+@n+ko=!}WD1kK({ab^&#GecIN(LdWx;d=!my6!bbL=`F z+s*oFBfe=;bE~-%nCJV4^a^l2WpO$v;aM;gUnY`g-@jh@JX1#{-fR95jDQZ2szyRT zOGk;vqIa?>=!`wnYCRSdY++HnVU^&z-XC80RxXzBY8$YxkgC%MI#2xg)xrHgZw^t= z;YNn_g37&Od;gs*5QEc5R87>dG_t5&H?6S1QvV5sK@d~K?YNA*9V);rQgi0sJsn7? z*?HPy0G)U+MFEpX?U@UT>lobi-cA%+WZiF%Rc!KW@YP(bIVrZp$VqoSlF4x5YZ|ows z!`{t|pQxNum4Pv$uL(7% zM0=D{f~sp#DTV29)%`EXA)-cw3a>|(ZvJ?NUt4c7)1x*GG67k+y6$I?jmexLt(9_a6!B9 zjOeeT+wluWg-BKUO=;y3w~|8aK{GvKb588TR_&vdxe(Ww)I4qMsf#EH>HVtbsEM9) zai1+O^@+@jWLPLYvmp4!-ZJHmoO|eTt^hqEBZS(q2jPo00_CqOr_Ne?R>1xk85=iOtbP@Yz`NUub8-mb&%0=uX|I}pj2R!f zG33ru6aCM)**80;H9!b!T%%jG8i1}feW2#Y^-g|hL)c673Ndumyn|$O)7Pf;O zv*;xWrna@E2A7q5nG`os1|l}!`POW{A$;x4))f+&sr;)+&WRcAk2YRi^z#qR&nrHh zbPIc4Qw=oh9YF}idrIdLFgrWu1BrBON{B#<4kA+sv}QME1lTj=YRIjtK`!dM+AW+r zqChhKRgwXr=8=?oyQkZcBrxdUP8K+Htv@}V&iOudy9%C^4}Q#$ACc1oGGz$ zQ8+(P4rco(4awP(kD&tkup6E^VkFqle{L~&2`%Cc9L-mXiC`HUMtfw%y{h;^rjt0? zW+cTXp--jw~$0Nd;uIunbc$(u(vgEXo8z<{K zqh#~e+>&{ZT@)c>SnfRFKSAXES;cI);hs<)Y7C~1`+RRUX(Ge#cT`oforWJM*siQp z$~|t-9(@_1ruF&F<3=i8{z;Go;RRy0kbY30Yz3}0W6SD2hgIO&?bcD~S4YFa1S;e- zMkmmyI3!>V5eDhiuX^9WKRLdq9sP}faVUkK|k;&e~2pIrlDeNzOdi@KsuM5?7LRs$T#w2BIxP2<_^8b zPe7^U#`~f|_lFE55Gx)l0{{Df*c3Ne#;V4Q>d|i0&TNJIPEKjzLBFY7uKR0 zpqSL{tVK+Tal;xyhiC*L#ub4_AYyjN+J5%wOp+1s$!2TZph9H05Ya2pURLM16GZp~ ze7@_QUJV2MQJ2m~h|FZleR%AdON>7cJk#E2uxZVEJ5=0CjfaHc!O4NhIv z17%3s;c8E{BbRWDSw~`21PY*Q5nxfA+Yn(TD(%WDFO~!x zk(nIO2#k_{2<-2_*Ge-vo<{G(VnEX?_k99)W6c+z13EdIU#+{4+|7E2l+}+C=SXve?V9C>`9(_j#H=&NB@B>n?6h0~GKAc|)vLuX@ZS!VHJZNrk_R?fzOB}G*4JPcW3oz%f;wzQDu$FD}1uzCvT4ky(MbS5W62^ zSbl27K_0RL0w-x0`#^~LmVr=rQ=oL%VQ_2eLmTTD5UVQiAxx&(Gt0|4oyHrMQ-~~( zUHtW_XoFUueV;N4tzf%$0My)k1fsh+h+Ks53q7AeP#qZ91%WqSM960LEBvp()yzQn z+r6jnu3tn8U(<3cybZE5XKaCG{I%Zh4~m}T_e-F@!u6E0p6`8yeVV{kpsSV})#|4G zgWm7wA`Oi5rM5PuL!J|{Ijp{`$KmCqikN!@XS!T^zddvj>Rr%T_;4jz zX2A&2&~~tCe0LBgXP=0p17(DhQ|)U;R8Ua4 z8ZDlb*gP^I$;UxP(*`_ z1*E&iCM$tb+X&&@SHI_!*6C<<`>U7q0c*()!p4v2&Gmz-XdBQ-8}W_0*rwDRAe^bH zH$ESLD1r%y?6t0ejNRqxT^n1VYo`g$p*w91eF_=})u1V%T1@pJnZ*~8c|LUH2p#Gh zo0f}Hi{(oWkyvzW8W63-?Or>W8TSP>g&~*it^__@0eAsXONSAsM~Awj`if6;M7Ct3 zxoQ!?J)?mFlg9D`GLI%lXH%6(;J5bWreURWGSN|CIDY`71kl_R{m;_tuy)NfzT32lSmPT~EZQ-?Bn7>4anBEfsUZF zEhweL0zvjSs-HUI1Be>;bzmKrMN}I>|07O+2~l>%S?K}UWdR=Hr+1UO5 zaBSXKk@YfeiXp1fQ6sJk^)jX>TK_I?1sQw7%D* zd45&W+LVAbdE>Msn%86RHR!OE_cR?Cna_=i^y=MK40^9Xp!_7tOwVb0cot#GuU&oG z$H49}!tr5`%W37|bP|5$sN3G0UimYZY`AWS)@1P;DlAhXNbR!It|8aPa~=)zrN`!o zUJ~`?VFrh<>1__t5%TvFc8664eJM~{u0Y}P;M}8|xskHI?qGH0Z__T^IAZb+UiF-o zF?&txQo&KdYh7`Z&&g$JflCyND zlkaJ@h@^S^Mug(2>_MP&+I`+PauU%jmSL*Bw5-Qe#`(FZ>QHeB5qHX$-4om#^KJv- z&>yY6tL-#a72`q}ggTB8OFz!@Vj4mWz2i##zEbR;oO)p9KdbhTS#M_v5w~b|`R?O2 z104uTOO=?rMfRZiWZrN8^PT7j8Sncl#}U3gV8q|f}H0XT3ALK=QT4}k0)}aIh z707@39niTP=)w)|sjFT0t1QmE^b#2zN8%KGJobX`Vu#Q_{N$l7ed!XBxiHJv$lDjn z@l}Mf?@R&9Lfl|t48|92R((7kCF@&2kAEHT$+MxSTPgA@+z9dO-65UjPpz3{L-VRv~0*81A6h=s8HV zYy|x3(DNw)PUALEh&nZ$eRYQOyzy%*7Ngr2#DpYf9j>2~NqmpdNM4_FBtFyMnW{R~M}6$f zUa5;=Zrp~}S~@nT)#SHPgE?0z-$kya{4%0KNt5ObpK#jwycedPGSl^kz|$D>YkH@M zw9bHWO(iOqm$*u%y81`ZrB=k~A^L}E_nZvrdO?+YF;-naPlj>BC?4c>zi#8c?PXm= zNXeDxO9WqRg7ltt{=xoEEMnox2bv28u0H-D#SJ#$!cCWlo{uD$M$8J_25&AdHm}D2 zuvcKKIRHoYCo?;76EZ0W<|SZEKli$)0o2^Hqk>Y2W_Y*VteMvlQES#{9W{Xbr#2@- zH!_{Uv>__XyuCVIad!9GuT7jzcsJmLNc6(ib-e-DO=f2egb%Jh?WomcNOF&NS-GVr zSG0dgU)OVy&AATe0_Boh*Z!HRY?bkjj<9<&${kJ*YhMKFdsOaUt$iU~MNwEEn^ZlP z1F>c7p;!s1{(RN*>2Nj!-PpsRd(b>T7}4o%g_y$_T&Bp<`@e$^7$`YHeMkzgUol98ad$K-?G;-El?;Xf4JhY;8v6+m{={pTB1JKr*K}UDtey-w zb)pvJ*QCil+(bO0)0pQemo4C8=Wj)D$5l@PmzvMLWk{43XR<*Tj9!v=)#iZ|K;<*1Z-z*lL&QH9-_Xx7LfREl4YbAY@2MTtFmnn@LNow8c}rny7?_ z`B2-4ngI{-{u#k}MWw=lC!j19gGf=F->gjBPOY(7x-Ga+@Y1p9!8Qba{M4N~Of6wW2HQ zOwf0Hn0a|V$6@V|5>3U9ji}e((Wm$?Th?MsG`oa-c~;;<{7Kdh{*w4#r>9^9RSE0l z6hZ7rlBV2Th)8U=*Fq_s>A<4CB>Fp3jQ~3JGNQ|_f<=Q!esDLPwSC^nI)MmAC}FrM z<7)!?c>BqIbuga-@6xB4^DcjE);4kW9LEki9g&4c6l4YwnU~F- z7g9Z-*+tvGPaw3*wQC&y$N*zehMMm(sOF0BsuK}EKY;Iuf7*O4(Ic~F>QAkC@)^Ir ztrwM}E2-7HR9+3jJ^hGEpK<>5ozvzT{l+Q5yAK=v{2&}6^}Qs9CH4P(CEB1Eq-7(b zlFu&4ilH_ZT>gA_AR@#({PL8=is88VsqWUz4j=4NS$s7{(=|8=Tlm#4s7D1v=%R3x^vxjJ)!;21=NC+{@BmhL2<|Dd5=RCxQ5W9{AGJTvo7Ea z@^7OvT#zR`Z*c9S;wfzh`;6tMFxDvz@_l$y6?GZ}N@G9QsS0Nsrg^nE#A%fd|o zS9NVcccScGsr2DeL#@EpM7PJ#zW4+>XDcjQZy18sbqE`?PdrV%9N>Wt5bHu`F#6Yw zxt%zx=lZ69bZqXfo_bWWr@1p5C(-ADFbK>;OI--V+FYy<&OXrkgLurEae4imN zI!O2g&`lBxe3L{4=8VqO!fe;f3?C3GDP?8nsG<0F&!OM2>&3}>*Zbx??d@O}d<&BH zn^0Tm>1wD~_!i`zSXjy3K@dbRIp^19_)x#$T1ro@yYKFAQZFHDzwfcSP7%kvva z*NFi7;3K+@6b>9faiw9zXF-obYWpW~qdK0ko-q^7Z((8K&fYV-!Dl%u{}6XxMHc1g ztAh^<5oZ$IU9MjM1f~#j*;WwX>F2Xhmps}S9aNibC?yZOQh$JWJ<0x4Cu&CP_GI}~ zag$%Fd|AEUKjbbbhme~N{=E4v?&zVz5{a)9>?Jn8Ob6vu7F^#}nWTV=;`xR|aTTtW zjWm71Sxt}LlhPu)f6gGcb zTk4nl$zf)RPR4`Olm!5Jx1_dcE)j>XASeFlOY95|2wWXpEcgZLb@_M#HCvX`sakJJe+O@l&aXf4br;)>69JdC5jf^`_r`maF%QG z6P}C%abfP2surz}p5~?pW=lazbb7rmNq=?%mr#f@ayhd2k!MP|Cqxpxw5~5exu8=k^0&o z0}RG zXRh%xnEFDs@z!_C6>vRpTx`6?DPe2|NE=+1?U#lmlmOy*%F!LZ7y)ywOd8gat^ZGp{|m zt;YO{*5AMi0IMR%VJ2iL_3HOPU=ln>d7z8uEMi`aX>A~nWhd@%_)-)6)^WZMDMsdU z=TU&|Y7TLSQgKY3UjR0RPDcm28Wi3K;I>#YV6I=&YnJgC!r!QN7;EIM+k?=Soa|0Q z5Gu|Cq(Z;_e!aCDF!=#xU3)GTiecSIHOYD9^Mzo}GjHsBG#{({@%6>KTtfdq6FqOA zSX$V7dlwYBdT>PR?tr?U-FS3Kc!JyZyJ09VkyAUnPSA{6zf}9B_VmaL^IZT?W|D8o zGiEdxi*gWhQU0K^$2Qa6HK6xMWMMQ6b>w8Z(k)}vh0IM*#F_{Hf5qL_W`X5{k32(7 znQHnU={+E>UPNsqnWncsxk@@TmeWI)P;~Qyr}Q2PBUBThrPK3VGFTrr%2MBXG}LA&9xLjHh#;H&QaM5-IsMEeY1msFL2b zkAxDEU^s>NmXugcehmtbS;AHB!{bSa1Ly>qcG9Bm1yzZOZAPfyqw@VE>cXHO$P$^; zt)|U!CdeG?50n3DKGd~uptj}1hCyMmvoWYM*85ULvJNhki*I1|l}}_tfEPEek?ah18{K86Np<4XaU8aP#wWb9m)u_VXcJtL z=U1ie!4O3|NgJ_*McT*3 zpXjZFx$+apJx#IRg$gcSqv17u#W26`FS=VR;UzY@_0{n-1BYIp@MV&P8I#AU*H>G) zEvmMr@JugXp!M!p0~Owo{8UY-bdmf<^jPcK{X8KF5+(AB+_@`%{Zq$CLcp>Rl*(QU zuYJGku-2^(Bsm9AU0_lE^M{%LgwXE>5^=eOKw0}gn+tlzNxm(Si*!*1ZPfLC`1!$n z0~zK{knC!SZ$jybzrG=m2tZyO80yKz&>Fg;S1+v9s6E82s^{h5?n2qL z{)f5gfF*DGYLK(Xj_=ixwacJV_PyxEy^ZH8LP3O{A&m5%J0SvZ`UO*7{f$@NVfFD2 zwN@?UHqqApl914^^}!`Qd~GBc_dH2F^F5hJQ9QACiH?SW2y4CGRdnl$ZSPn zgI%|c%tO*97QpEz@^W{8v8C&X3d$xAoC(^M}q0*lV0P_)~VCwKHN z2TWW`@0cn5d_J~894EHw;CHBd0l@e>zScbLJE%R-mimcc!EHo!-eCw<^4OCOH&yRQsfbD7I+q;CemDhA8p@dVh?e>oon zCHT-u>{Y~L4pn()6C$db;XO_~V|B0PC_uk9Vi+0^iXf%9ke7qwZHpxsqG9?j?ZKlu znVEf%>V01IcI>SJ^RLyjb{*o4g7`5@(+PSsesb=a%!y^viJ9odi z02<)KHgm`-1NkD{0mbv)K4Z_j$?!1Am;5SEA=8*A{dV{bTFn46KLeJ({VMGQ$To<#8rIoMjdE;*0pBY@~)^?{pYV!Yg$v&Gkf&6o(cmg@;kX+UgFcm*{ax`^F&j^(`h(TFSyX$BXx8 zl?^{VMjJAn{hdO$*Bk<#JJu|#^hZY7fN@SWELd{z3G@O}0PTByIMD$r^7qc4$l=7fFLFjTTT`mRm41 zR*Lw2@6CPd>TP4}&@W~ev@OUmqcD1jdSB8^m6h(7oEhdi#-Lzd2V!f8@37xTcZk9P zZq(49Y!3Hx*hLD@e%5>9r_Pa@1V1`~t#!~j6O!nfM!ml(i(?V?cxQWKiB8b)5HPwy zr1+@yNqSq0r=tO|0E|9bNcq;r$OUNk&a8sFz?Zw9mXKxzZOhU$d^(Y#zAz1GBHh@Z z&>?gCPvxsbTgLnTPc~mf4n_ca(YY74 ze#ko)Ut3NgvF_UT{_{$9VGQnFBcd5%6miMYixZiaL1O;Iip9uLPn^Yq&dX5!IN8SB z8Pew}iN_B2d$<^%u8aLgMd?7XSVDdF#^_e7%g++g=&kWhqLQYu5d2w#4FG=38xqIE z`I%joaHnqs{^?>xu@!&98k%GLPMTGHe47%_Vjf)Axm@`J+;ofrM(qoTovsthND1zP zAS>+7P zykq3=P)9>qc9(=Ju`ddVFso!H_$e^AA0@c<^w~XupmY#2hdpMTgVb9u&9f`l^Pr`a zi|Dd~fG1=|%tZYb)QiyZwBDg?s5^M*%1O7HZ=eN0CPI-om64Ad&Mg z?p(&7X?1=g#}HZezh7E6Jg#WQbhyS?S0u#SQ9kty+Y9ilKSXUL zqo1Rr?J2yKm&C)Cvl;3h{`*H#iFeWTue{U_RC zO7-QcA?Jc9)seF#n}B!+X*FG6`N`>ieZcOTc^_B#O3S4MXgMkZ&F+41U`7pOhQIJB zxs7B~ued`%QYo?*#W=>@!Z@SzzQWv^e8=8Eg?*tp{Pfxq{z;9#AAIog%G}sSl@@9jRk<0^6<(%E4cTzYIl*t5fRnzElt?(dfn)H?HvIQX|bn|SyPAYz`JWLQa+ zFNKY~{@ODC?ZCfP74XHdm9AJ)V{>VLL;RLOYe^8>l4flJ?xaFN~s3dUfJkw zQOKay(?$0_%Y@R#H9vc_yZPG>V;<>48IQQdFows$r2pnc0h2etwj)71Kh0`y)VqH2 zRe6n>xop|f!TY0ex_b|bxPt%*zZ?+CTK(Q!6<{>X-ACwxG*(Ld5rta2Iiza22+|&@ zWAnKxvNi7{0jkEvH$aD$1SWM8>6N^ zOGFiqM1maWDEG~LM%59JFFOKy;N|1Xshu40A z@kG2~q-NuJ*=WU7`)&AGFk`ypu5<>=^_DF(8TWx_BlF!71t>YGa=8v~9g6&et*^QF zW{TDn5=4fh-G6++aNijm#oc=X=pC-*S-3C+YSJgOtUoZ5)U`lW_wBjI4MgimhhX#? zT)UtjE)1*sKiE#V;vYaQLa+bD?mExiv5{Wu(GWf6O}OqRi`O;CpWOB`8sb)dAL4ab z(%}=;gFYtT$Sy)5gdSEFgB1I(&$PwKC=wzWV-d}CmCZ=|bW!Jj?n~kt z76jQ68|*g8nyprG3G#J+L>RUPeW3s|_kHL)oN)4AdYqPThSJci@>r%9YHUBQE30_@ zm&hG@z9HjHgahhApQ% zK{m!!rekP=TMLQ6wULh`;KD!OUWwNy!QvV)=E*tYU-rfRe z)GsfB^tTVz+p2YN(}JnejIi~_;5xt<3w|_~IfItvZEs~?Kgh1ye((BQ+TJvi=z-&0 z#;0J#J&~Px16JWu*sTR05_wkAjf8{U^f3f9)3T1T?WjU5*n=v7Pi2OBps$!l#H9p@ zTMTz9p}&yEs~1K$p5@}yWD>a1SQLaKz+?_bQ6J;BO>Nm+mKl@GbFS?lZ!^1t6|1#n zG?QjW8t$gcF8~NWTJ3(&A5X0_4gTHk3=9*jy-O>p+drEfAFr%D)E(#iE~1y=2U0wW zgYrP&iw*}-P)NpzqOzKadP5qxHeXqr`Wp< z`t9~Lp1h5+I*zU>tna%;Of~s<6S&hen%xfmO8Cc!=n?j#h^n|$UbpeH?6XEyKm2zf zb+aD}TIjd><3%Xy=Aw~aLKqPvH))W$vzutTgvmkgf^w`#Xp^ zB!{-53>9@e!GU)~0T;Zk76Sr$^CoSz*)_+nB0J{%8Dlc~?qHC^t@k6fEloxb_BSk4 ztdMLW=ce`c;OKr4J{T@y*7oF1np#(%%>HX0go4vs03xeoWK*B=`i*{H9((dZ=3?%- zsGW#x7Z!)e0-}uc;FKGoe8oD^@-aN0_0QmKrjq?>xs*+sObgxS&3gdE(9CmL3Wb}W zE|~}soQJKg*XCaZIP^k`7E}RA+(sqo_KMc#dfOF@QVmGZu{dL@uWIm~z{pZCK7;x9 zYfwsEfTwIIM?bD$P#evNWPK^F5NIrYe6u}ZSU~Hi zbhFQ`EX6%AkxKt-A}6CT@WdHBpZbtbsF8$1A;e@t{0CRew5QkUY0M=8%Aw5jS4&1Q zXs#GPNummOAItHoe&sFlN?@r}rX>D$MA9{)j7X1_i1RgTvm*x9wv{U|wUzKhc2=46 z(tp*BLzjLURUya}))vF~RwwTFW_+%&flKhh7a}tkp@H!|Ey6MxV`u13EJhlSiUv$C z2~LJdo*s8BXhuTCaK-$D_BAW$N8*FnnV)rB#$yX=Mtm)@QcvQ;#;$pF7R-Wsez%3{ zvvlBDOi_(5FeeqW9tw6GHfI&<6Ci(pm}M(-X6r7MUw++)F_bDwi_~IUDW@Ssix~(w zTs*;v_3O^s>s|B+Qii?eZ8YLE&Edl&_0{Oac8J4{gcQkHtBT(;$&r9{3yg0FS0(bt z^jH5$dl23M00)bJ!&&Di5rfvh0f=XQ|G-w9F|ii`aMt&~?k7NgXXI?N_~Q=2S-pf4 zvAR>QAJMK-K|jn8i}UyQ&N4$8&}z`|wK=O-{Y-Klcy)`L7#17B#ty%S3mdggZfK`B z62H>@&mL>t@wmlKo_QiOz$=>h+1YK#a*x{&pw)l|WlT8;xg+s{;gy%tt=BsAFj#0w zn!b=@CSWX`c_UdNs&8HXY@(s~$64wt*3ojq2edTRYthY{3-YU7{sq_SN<$!CO~gY_ zWU?RPg^I!}DE3uttI+Bo@2^Dn%GL<%H->ZxFc+J|n+WL#;gFqG? ztMFLcM*P!lbS_W~nX)?j@)O*6d54KOD{C5X2UQO#ZJ3G2c-+eP};ue~S$ zVQ6E8obqz7dsu%f8qk6Jz7BBDmCnVUa2A)u5Y*cjc%g<_P0LgdeThTYwodig|2S7M7`Y)|r#P$8AaygwCZK*SMDAVg{WmfW z8^qB=<%*=ggr~`-&-kr=P(|f<@8F|(IVoiXy@^~spHlof!EgslOQPoa^xdAhFlU1E zRU6g{rb_v$naJ~BU09ahV!jReh9V7SBT->QA`&#N(JQ_i6Slva)zo0HlWWjK%-)5C zYKLNNcOlXQTvY3QYH)eH{?KoiFI5c!x`a7sQ9K;fqGQ)7O>$op8mNffTEuB~0dF)1 zJo}l?TS(Tlv;i?mv7>YS6K;{;#>WTHQZwDQxZ4a8Xr6N%>Xe|K=$vu`q-p@dY|U4$ zfRC}^eqb3>uijSeRL3BU4)ygmd8REA)2LfL_qI}mv+wRHTLMbV$~zeWSL-9 z4YQ(w^zk%-7)}s}{*plIknBI6Q}PIzp0zAsm8RW;&EW~If%KLTzh?7IsA!3~7SsET z834Aq9q!RW$k=$fi7iNx9J#SKS;FiemqMDr=?`@*+02wVCak~7C_H|^1H(X|`t@_N ziN|AM43fm14flyXL()~=yp;WVhGi^)Gp+11>bl>jGhd5^I9_x`DorezVupM z-#qlQyVYR6uknc+)+IV~L{D!-Q+hrsFl53A$>EXchvp80RC`+d8KjJ2s+3j`ML@|_ zgN!9>Kb=jxyUL`!3b7*gL}$f5#DCOUYn}A&wb&GW$bjWdeHW++a<;5`)9u!D$Slev zUL0BTAJTLA?VEHx9v}Nnf{9mC!79`y6i7WA_o0}QNa$Cz@0H$r1rnW&eewe)cDJF& zO)QLrE=YTb1t5wA@$s78t7 z%*Gx`qL%&`&+9>*5x)^#z|C3OF0w<)YnT?H#)j(*s6kL&$2UFFK8j^1$#+2`igC|$ z6Rw5Z^5E?(m~=c6vAGT^)W1e{RWr8%UkL%Ol5z$E2a=J|DD&oWAeuvxtKrqQ-_;g4{EmmoH+yP z`CNzHQqz?)562mKrVOrhDR5S!#XMGhSKqzBwpn>x_4r<{Sff)@IeI*k>${xxw_j5+ zNeL#uaiR0aSOhccvq{%mO_mMXjjDS4P!qQ=GOA4jK0e$3N>xu%4cBy`~t)#xg1 z=>2=O=LVTP21D3adZwV6J~QJMx|eD5xq~g%Tmp2S*Ne=3%s;)bJi52&$Rzg*ng;Zh zMwBu2b_RNtQ;1#>;9M`KLXy^AZEK|YbA2`8UmSb9^dUfvVVK+#vxrnB|CpNCzb;O+9 zNMwLoi&^|_Voah8KMZd!{)FmhZNXn&4(_>hLPKCe`rCIL7E)v2nTvCs-?S@iC1jhX zSZ2KAps#sIN^;jkl}YL)dAc=GvzXW|c;L~O4N%$t=wLjLM}Zb4S>lVb?&T~-mtbAf zd#_8Me)cQpi1ZI>n-Mv*Rb>-b7co?kWRKQ-`NVt0UbWGL@|FGA0MW?PLy@wv{&~i@DK#BQSyxVM~BldXdv^{ zfpVCs7Cxm=$5|k7-;|V-&aPN#As_Jh4afpZ%Q>MZ)^$ry??KtmSkjNiPq1LCc9dSc ztdG8<{fd!o1L8K#muo`#wyxpxNo=^dVmhYa=ShLJQBS7!`N2PAT`xsB&8xLPTtmbp zL)jFNt?|c~;-k?BH*Un!GwNei-+AW@U#i2(N&q^XO&I;+nV2A<{*CxSd3VCG#-H7L z0NycW%iS%vk@e7>gfOTy4sK54bowS%sqambG!Lw3g4 zo}5}r?|va=cuy5nZdh`HM{W|GpD4$hYg9x5IM(;>KUlCsPc%K&G#|Oc^;^OzrCpGG z?@r+}$E4dkitmL!fwTCYfU$A*bnm6N->82$pV>Hp<;T{R{m1D-;yU~#k2gk8j%DSV zS~*;W1t@CkalcnNcbH)~U_GgBGo_4*GAN}!Xc*tWr@|T6}sUOx78THSy zrO+Dsw=7I@z1l6^+xhBP)y3sG7Z%2U-?+_jFl_3~XGvt@%;fX4y6WG-R(%jdzDB#x zB>5BXLmlwSxTCP~mScn&vA>$rQ5zJbBQt$8{brekk>?;W3?JOv0&A*krT9chPH6-n z3Zl<}^UzP_Ctf3{q>WUYls)=@8l} zATeI-zwhANPk*;6mhpOh8DRJ-8U2y$YQ#cLpq%*i-XFHL9-i=q)JZ0CbnNu5wi>LvpVn{DJ3vtX<5e@p4M0|o>*3eb zRsL2cTjs9s(QZPJ!mkksH*ci+o72u|+Z`KLP*345023+6qJvO|{ljumjAS|k2 zsoP2aHAC5#fJxeaKjKECPVlyeW)rQY>emA6c_!{x1?^^zb_1`+*nv_C>2E<5D2Jlqc%P7UK(CtMPxuB5I;sGNwgG0IF~M#4U~%W4M`e?131D0l4d+Pc zwkBIKF^#lq~1I>vnA0seHZHD2d>+P z%w8uub0kAZ{rDn&G$quJ=kpDKZ^rQx><5BPx?Bm+ix@8eFrso|^6((iqo8U&T#7Os zvS8ucw?&D|jlW-@jXcMn*mtbO@_0B(vojZokKgfL)q-gC8IW*Xw)(hfi}v9 zoZe7VTCWy0oIh9QH8bsO`GHh;ltU08L!eqsugZ>*k7zZc%RB)6daM38cz@U_`yUtQ zhaTs%B1xG0jk&42jZ5P1el|)={As%BmP#`pZ7tHytJLiy>r#gEVK>BL@NDXfHH62I z-i<=;d~A&Oe=FuGKV-NA?oBrc7a(#37D%V&exD9JcYt3pY(x1WlHa@+cYVQp{)%Z4 zJWAZbRSYUK{haNTCcacYPe+F1(xR@x!Cm;$vD_`u!6=;6BnsIgTIh5AzrRt!l z0aF$D1VKCH$`bC3c@c%xibpL(_U!@kyN@>xTGTG^9j6V(K(P<_)H8sN+=M94k9Lq) z+)U#IriWK!g7GT7C12 zL+)!@G;O2ByAvTr6!~==yQBNGogbRUdM2HX-=I7VMZ8&W|7@$$Ilxt_0QR4G4?TF6 z;O#L{h<^Ay&&C8~0soXpc(sv&w^6k98C~CC zXM5r5g>N_?*ZH|@#GIf`zWbX4)c1TLLcjYDV>MU2IjefpWJOL5Wcg;x14Fw=$TRW^sHpXq6PaXuW#H zEu~*Kyug=Nm5rgcvy418Ymz$#dgzUBhC{(qiC{)8K|yI7=RSrS6e45+DtEVjJ%`J&1!ACzT7MH!+Y!2`i3AB zg};LE9W6UcpEKCM!oscm?z9r|hOMGhC>j8=sCb{Q0xFc~ij~?muQ=7I zIT&YfHcI?Sg7=}~f~deHx~1^?UiY4;+CqEc-Z^Fic-{)toj^w#h=wpHME6PO3Gf1t z)|8up3HBOPX24SB?&P|*pOBM{pUtGJ%BbFqe zw3C!0G^-#5zj9U_Ex9s+>o1iRe!&l9FkH1sySaPNM#5d<| zfDF-Wb+4D0@GX-7c_rRMuB{I1RfGGvgLNA9;L18D+A-6}RmqtCrJQBUVG{zr$*-pp z6OfZIKfa^~N*A~-xQGuX8k^x|zMryxB^J-tZ&zSvtpPoqjxJ3Jp?g2I=P2zDtg{zhtcF-_`ppw?bN!WGT|wU~*Dok#d z$%U#eV1C4|Js60~mh|TM^yfRKgvhDlUP|$c3rap)t$77(h|bxij2<>F9mEKF%m=(i z#)FABjsPf^`pCsP?Vgdde!4?5PN?n&1gBvm+P>Ko>ckpl+cx&H;c^3rrEJL`qHYwO z{4Vr0^G==vI1*3agL>9k^FxUnzN)HCL1_4H6V;0a2+;_;vO$?pN@8n|JcRe+~CQtU|m`l!GJuTMZ;H&`SVhcbCE&(Y|P+$ z@0PCLj;@_{*QhSW74F9uk0sbxWorNS-Qd(LzV%PJ2er&D$i`OB4-x8)^ly{VwrK%x z2UrG2wmtpW``p`nWF(?s&YIQJ`#NK1Y}Rc-kKbkJHou}hI3#^^jfcHHp zD1tA4ptAUFvVX%>jG`FBd%H7GZtyT3Iv{Ta4!}2R0^q-DeW&pN=Bma2r6cO?HmFT|KRWO? zCL%n6g4%1bjT-|A=tp2^SN&6cY3t8}s}eEcuHK2H0kYVI7t9TQTRmV5-n5AOuKrhcrgW6;Kp_u$&jH*x7R@oQ@jzC}+?`D*a*NN= z@FWFeWeNO6lCi-M8BKJhBW$_-S)|e+zLS&$3Sy8o5Ibq1xiSP4QQ+!F-`wbvTzRx!3Y*;{8(G)@|I1Zj}<8)#~LO;vWDz+(#WADm|$%UJV*4IH*9Rdb<; z$P0VwYH3=2nA0>q4r=8BEzhI(ej^)iWm^CycFlB&Jr)#nrB6Qv%^oddc?iY~RakCp z&G=nke)U?}u8VK<`OQ?zwg3bwO%t&{ZfT?e>FM){^h0!w{(9fW0XeI%)mTvOz4Y=H zx;~}C`<{8{Ja?!f0>|l%*c*QcQk%#?Yi^^!t+;mF2&OLTXsPa~WsxXOOVvKRi`&%J zd^}cnjZdBWY>C!iGTkYZt2-HpvlC;tLLVt4Kikwu1AmVTOeUJrior`M=a{U4uRw3> zA&Pr`eM*I)0sNsAMm|fHHZk3Mz#mQUp&TR;01kPVJ2;e6hD@l~U$TTf_YT+}Df{A4 ze#T38FdqthJ+cLw_5_v`=;^&m-xTkLi6s)u{-~qQC9(b0PZ{tsN%Re#m35w^hXsKc zlS_il(KZN!;G7&bB;C97UOm8d55Q;zOx+Ow#Y8Wqy{h7OrUr2;c;cv!!9UR9RNTl- z7p!Z*I-MH|1i&>vY50OntA|4sDneLB=CGod26f8+(E=P3xgcIU{3vAl4w(H(QACe| z5}GQW{K>tILnuEebU=Wjv0re7(z!vAc*x-zT%L!^)_s1KiXU!Cv{^&6#fn|f4ri>}eM!{|{QZ2k@&(56@7Rrc?>cyh=Z{uG zh2X$X9Izz@+0YE&(-52>_x$x#b{rtB)^%@o1oOa1mTThh&r7FH)$G_Ze=(t^Rt$$c zFRnQChnDGI|K;ifJc(32z*|Lw5F`U~8ol3%|4s+P4>y~mY|`peQ3QGXfxWQ>DLi#* z@40_v{ER0;$-d=}c%XTEJ5XD(+Lyopk9&zAppNj(HYdu$+T-fy=;KkA(UgMsb=13k z)|wM3iY#7X6`nj;^pWW~RPYZ%pb8Dkwv3aqVZ?Z1N!{~p#0&QAHlVTPZ0_$bhbg~G zZYPZnFE{4H3HnM9fDw?teKX`1=w@a8oxf0rI+}eC-L(?FwLNsmQC@L_ntH28Kl+KT z=z`k}K20i}WT+{dCeAQUKA1O#$(d@`AC(v0Z(jQYL^}<_pIJ{u2vpljJLn_EG&J?h z>iPD##y=h~ra1&EeRxzZcV3-w3_0sVg3sQ4hlJWsiycY>x80@DeMI4EpXzw-4NNCy z8`7;tdCSmcjs}EY>3`elM{2Zv4Dr{;2JccjXCEODlfvh7_G-Z=pqS4f_G1)029$PZ z(7b?rvl@hZ+%npp-Wa?Fi3=p-Tm67XU-v|;EmQ8FD;p?itkJ}Q*ETorDTviG;h%b? z_6j8#HsBwFR(XCm5W@Y#va|3Il$xfN5)#K@J?YqX`;Y_97K~yJjji{c@;w-x705XZ z{lVksl82B$l@+HJvb1iE$*6g6xNZVI>5J$+)OJNqe5y?x9yVp+U(>@g=$({}Z&}>v zBmeD@fL2`3sc;pPVpV2qwUuYJ9#hJ@d1Vj~ zaI`>kE#R4K96Jv{qcYHd4k?jTk1uuk$3a;m?1c3e*sghdpCZpXsnAKhwb7Jq$l~$ocPV)4A zl2S@ z>z#cZ>`6bXz5(((8eSMsrlX6mW^LFG6l6~>LDFXl=wP;=t4NE+A45hTXrNIGtWkJ) zAK_cJHGgtL#fE^Mu*IL#VIWV7bstnTQQ>9NYDni_M2yOc`DSLYAi=THfhN-sW(~acF&Kp-V^UN3dN+>h_lXwx-WB++%y+;{Nx1yIr?#M#)2%=w@j*~e!qgD@@p=dQ6b%9?CA zw*h()-3-2L-8U@=vkV}(->}=Rdr@U8=~B{(LDc@X^>%tERqV;O0EFtrig3EPUSKS=d7}5PVQHaLhu)Sx#{OWH9V{q zFN01$OK2E(3n75w7}c}(9~&Mv@ji;||6EKL{N$$oZQyaXt9)ab=$eDMErq_f7>X9B z#d?xpjUVTiGY@I(|Ju9hV88HyX767-=PlV_eYOscz2pg2)6>x+!z~0%QE#EW-FI3= zcVRT7K^w@e(MqLj8=;;8p*fLW7Yfx2&bjfM>CQQ*oUS(uDCfHPTJ@RvDtm#xoHH_K zOa908G_)w9T7|<>b;=dKm3u3id9T8W0_5SeQhVJ7S6p4qXP6Sl@Y_=80U4mWYdr!t zs^lPHAV1_?qt!T~h514}_!pu0GDBdv>G8>Rr`L6a?KS(-JXRg72 z9on|L&@L+<4UJhBQj9+=0bY|m+p3&F=_LF2rnSr^Fz2}Q`rWf&Z)J!q>W5ZYkIwJ%| zDg53i^dEya`5--53S&p|^=;m^WO$h7FmCWXL6P)x?A|R)7HCQs6_rMI5otysBHLt` zW3VK?e+o1jb9l}j1YeJU%Ddv7$(xnu+YK{hg+m$g>*BsaoP0W+gEi5&VhykZ=a`hU z8+>)2i`vP~eN3g^JccJZZx+wFfRo|+39%)EM%Bh%e`1_H#-k7dN+`z!(-0o0fZokv zuBU8tlvu_h34x^tDUo-0H7x<)V%ONh%gfUfa`+}V`qH6#J>;n44V|b43nB8VNbve? zaq5R!k%GSz`2g_58r8|ZpYV_En02?T%!pAUSB?!V)jqxzO|<9k_|tpN|NI8V0esAP z)A6?R_tFPxN?diNdu(+ebxTJ@MI}w60+f&MLH}-WzslTHjj9*q#tUZjI@%}>t8eGx zRG;b+M!?}a+d#N!Tk$=)HwfZ>E#BXzmt3;I+2=)-#&IarJ6Vwtf3MxDsQ_pl1*R3U zcwA1E&45XS$6*hfSy=wBfRgvpHU=rKKlkK`> zi5Q%B{lJ{CYgw`?PnSOU4gNB7VqeTk$|G=XL>@AhsfmDjv~O(g`O~+<2lCF(vS!?Z zlbnWlco{5UI^$_hCKu0JD`Q`;kp#%#0~@k!*@I|Dk^VLLwKs+0uq4hCmd?VmLq>m9 zL5xm#Y3SmMH9ZE5jt1F9+6vdF49BcTJE-y%)4n;;#bdKV`RVPDnc3j#rTqUNB?h2t8sjy+X#u9}JF zaqmVn(_denw%vZzK-n+_?A5-p1xJ3Mm1%=r639{-efwUKQfzWkHmn>W(%FiE`S{&< zPREuSpZ6~e-0uP^!iVu$cj0qaI$hT4`t`Yu7BQ&3>Mh-C=-T$=uATwGpHelTV&nzy z9&Q|3+ZdVHzKsu__y6-6rp35RplTe`7wgs5*Of9WTBi=LA3N^V(2po0$`d zI$t4Q1Iw{OY(G4u?WBB%4&z6;Eo*Q7X$4;pid8kf6rh*|72eEwQ(K*l2Q$~(EaZJq%Vpzd}+I*8Eaq#P$gChT!!J` zqTNo$3`(E7H>=rufO2Esfk9gpV@p=TW2whjK$vwTIfwx>%Jh}AZ?PC)Yu2c@- zslD;`m+9C>6NqP=M>FFy*;h)yDlHDgW7HmEj)K3!4QNuh&9t^Q>-*D4I*j=i_=-as zvWqxA@eHeM=0V zY-MhnbhWbdGvoLjQJ?Que}+FJh;|Znox+OGkAQr|fy_NEdsmD8X~c7AZw5?8Du98F z4AUccX?TbL%AzIDh&KMr!G1INJr}@98x*8Jw{ep9C*lr-mjZcYoNv;W2Q^H%dW>o;7yQD{V(+98{@3zGy&l7->mT_|XsG0)bZA zrEnP-#wjzi4ONz)Q@v-8?%8Zp5T;-+8_-S+t7yocVT7OwZ<^vo@J531_t`k1FY(?6 zNFhvKS2QgMYS%PZdrd!?`v!8v3_iE2Qki`#3*#bGAn?Xo5zl-l@_g){H=O85 zeYWkhB;o$efbpG{qiW_+n6>OJiu9e)?qU3Z^9S7NML}C+W|-_Vs5Ye^U-j)Y1nCFx zF)Z&_|H(}yH1j*Iol!dJ_FPLt+nl%D5&`grEx=&;U1#V_F9GLZ@ip%=*XB4!w=P?L^#c*oc=hkki*@-yFFSnKj1iEl>qVUc_(YU2e7YD1YW`? zA%>*sz%tQ7tj7a?sF|qe7owwEqVWCcH3;(Ko#->Y0At^$@iA1XWpiK_%pPtd-T2^h znz1FT(|Tyu^(nU>(d$%^-oK+Z;*2(VSjVs?KZHNqxX;mWfgc50*l5p6Na}4ioYY8`vC1xV5?cB zXGkv`k|F5phn#&7`A$UW8ag7W)nI5B!e0CA2q*_uJ-=fR{Cyx)fuDg*eFBg$w~SIj zBx>kK1j!L#^~l#>fFw_YO%N4O25KmFYit`1@N%p#Hg7$9+CnkV9OyGbSoLzQN%c20 zhhvt7VZf3m4eNtW@og^xOq*yInaJ2%u|$zcS^-e$s!A6CJQm2sdZjalZg`25^cy6{|N)Ss`vDarlAs5{Tvq8gvaF!Hr^`%M^m$ z01?Iea+AJc*-wd6De<|W+aanSQ##;*C=jwf6hC$a(Tc9X`Y%P){@}?c!?N|-l_}s% z$H$qGeb)!UDWAS%D62MC15s=ebiKCFJ8yTKrSEU@IrCswG@mze#mejBj{gdfnkoQk zjKm+V%Y?=~1%P6b3bCw}4Z?q{F!ctsW!;D7PR_Qd;BL0s{Pp*>EpS@fLJQ~DRO&9W z|9L3^1FV!GD2c|s(Up$DF4-G?tZfNgb(Oi~B+hz7PNl0a`hxeWjSf0_vyPq*nBD*W z7Hyj;=hikSU5gOm+}-CEi^)LYHe!-ou6#F;Euh{P;QU1=E`)!@`nlQ~Mfd{qkLU6A z2)Me)=P5k(y^;2Q(QA~daok7&Nc=^9Jo#!vpV{ByshClkeF$!HK|)G5qGGn@lrHFw zDbAI&jo%B7pX0dRUcOUJpzhXEt(he}gVz#;ya3*q3H+~qV2ZW@RK&O_YT=YG!Q`U8 zbyR@qYV(w*|ENqIf8$jC;~0Kp&ERqU@sCy9a`^c0?Ru`rolB?!24mY}yj&M+8T;_v zenz12E)RU6qaWae{dzY-@McA7-h=2u`$fw>%4f7GrW5oC|Mw~vgE2Gs&kE<3=#Hz6 z>dlH|5BhdRGL}}#J&?}qgyDa6{U-Hg>QHlCCMhLM*Dsdmd);4GGw2#71y|DI67CJH z`hZAp>0Nj-1VUGU

s`PmT2%KvS;l=k1m!s**MI0pN55Qh;D%8t6fhI0M?%u?-uc z!M`B|5B_SOd>E>E1`M}zbph(7%f8iP4g`6XY{+;<2QOY7aA@!;3o-|SG&J!gRqDkhpKFjX5in1suLqlcKr9O)E0|~?0 zGNKyjp?KoAc=iDR*A$wNDqla~?;yA`2wBfH_gEutU?TBCZ&N*DX*|6ISk=Nw%DU9K z2m%+S10on6p3mL!BfD{$%6DNyC$GNTKAP4rW*qUpGi%lLek1*5$2*3}@>6SIK>z0o zgl@qgoFe}-KlbZ>k@S;{z^pDjzA+F5CD(qgX1n%qqtDCM_RF`l2R!+w(b0MDOmzEp zMBbUBejf1f?~_>}AF5FHc}3b-u7jybl=EBA!UoX(NDUQAtL$ONXDkf}6L-0V+W-2@ zjbwSt!=R7KfIVlU%x2&YyGAG?(NzT=V)2LFih1eF0sR0TOqEvcYer9M`z}1SG@9U? zrMxo+|3}81?}s4VV=o9Vgd<=3gaDd3(5Nq32sh&O?A?Gbw`l5E-H#Z>#dmeg(GKeK$=t(`ch|yQ=)RHP z#K{ISV$=`J&_=So#jgl|GRZ@aZOW5OmNnz6kmHT9S@u!KwjHu*BKN|^wwMQrn!Eq@ z{(lvKQ$|&{fb$DC?T5qxi2&_%IJ4$Gx9dg%&L zXySVw-B?+0AC2a9-N)&Bpq4Aud<0~jm}(4^Vo8n10MGnc^1Wr}kMR83xvD{~W=2)V z^H7yLbQ{rP{P}MH4JrD(34-EoxaCAw^$5_!MHV9vb`KSo&n65{4%VSS69aF8t3~z< z_9+mSaaK01`fMokemWjD=q1d{0t_4d(K}&2BEb{G!M%f3Gl{GvT}pxVAU*ZzqvO{L z^Jf-4NpqgK_GK*tBz)q;7~dQk6P?>hD=dcmog;c_pal6T_l2miq2v>@7Fqft9O?p1 zzaZ@2fd34+@lb-*5}zdX#53%2$u=6XqLy~s=qjDssv_K@Ea-z-3Ck9C#D4J$(A@s_ zB>DrS5npI|YBh*Ozx-P1LZvylEiL$G+e6tcTbP!6pRt6*H+wSN@lqwN$Nad{ON!N8 zZ&rNhdrki+@Nxag6PTIbk9WT7=eefMSr$=Y;?RHd!)1iOW`dLX%3B3kO%U3s0!bWn z=A5a_IhVFH?Y$HB=6SY$aQ9LjS3iy}@f=r%$@}Cb`eyD@AzE}~Cv^Ez_MWJ9WtMe} z=JxL=7JkoN!o}%2m)Do@@VPHizvImmgJ|^}k1n6`QV`I13#=|-PVaVMo~;fXF!$qe{?-cMRn zXu|*58bf^H3bNkg?5M#r@TEB>?*``H=J6wafTjqf;xR_9PAt|*`2OBe)DEfZneUa+X8d~wZ72!YIR3H`M`YCuXeE%4&@!W9-Ow5v(AZoMn9~0 zS@Q>Ve9qPYFMEt$u$|xb!>wjZK(x6WWx(;0z8WeG4bb~u4Za)ZzVMF>BlSQLHOX)K8(0ad{7I-*zS5D?nRA$P zr(cb!aI?L*67to#a+*72&2XuysvoFPrfff>UZ()XPA*^^jM{Y6DM?G7j@`Yf`H%Tm z>=K8ACb*Le%eB2G(s|e9NyQE;V6cl zYM$4~m(hUHEEo|&d#YeRSiX=5x@~EqOHY)x3&Zl4$8CB*T&$1pr9X2u0>asfg0sfZz zU8jOG_+wAhUUCmLzkM2%b1I|5zXj46cq=m~@9b_g=x!VG0+{KNue6D*x~6PF)F2DYlNLbx3nro_%T8^Dj~8EZ#YX2xJIC&q65@IJCxHW3G3(oXlwx*^ z->7&_%Q3z6YAlzn;2(lBb05cH%A~5l70a(&c;$*vRKY}IP1I0EDm1@ShA zy`%?Gmp}dpH3(GO1grL-?tYBFem6=k89x=%`=?m^PoXmqo)cMW9jAeQXH+Pa5~_tv z^j7jq`?!epvc}9ouy~KIsExIy>*tpTaUz+UR0vT6vPQ`E+mkWe|Ln<+Zj0~z-;Y6- zPWbx6D#1|O2?1~|;ups9!n`3Y zGjqyClBmapb~$$co4=|I5m3sq3U=RF(0P0T5zZ3Ab=tEGFeuzB9m@J0uauEvDBzqV zMUD!Xm*_S&al?;+#Z*fd@4al=qA=M(y~>{zOo~*M~Yh-U7Wxj{yIPZ9!^P{E;ue9u?{-L6HdXSJAs& zNY;XU1u8FwRObs2R1uBZ?UyFiBeokcbXFqy&aYV3?okXJ85*p~eDwG!QckJ;)jcxcrZoawXI9c)jY#+c=d@$mTluayMtoEPIziKXao1H2da`A%%Cu#Sn+CCO0b z@i}$$Z)N;>sSM!M57+WZt2`i|+c^+xwz2M3KUGyHUWJ|P&oe#I0ch+8;y=nfU?1H1 z43uxkb|$e7kjj=C#P?VXJ3mu>3$qcZ|-^x0dGH!2qbl=A!4x`-{;CV-oYw8J|g+0!} zVuhJCc%zERU?6OZ#5wNIMZQdqXlkQT{L+{Yi&y@i`#c4(EEE3l=l{>?Eo%7y-1j4M^fs$!-d2 za}f~_Z`w|Qy8J^K`v#?*2@v7^v5Hj`)Z|=9!Ktz>jQEC5Lty-Hj6gzu!D98 zwPlwW+?fFO^Xkw((Q9w0o3VuEyq6$%^(amz!&Dk^dqwGKHt7zK6j%rXmp_c7J1u=^ z94j{I{lO;*hR+X(3poDAN*l0+RP79WVCB;yz|B{eaSCk|8btm9FV|fLaC94PUrhPL zKWaFx>)+8=i`rpX!CoO)85>-ov2Z?8AuZ!yiP<07B}s!%kqYUpsJ@oYG`X=*(t zv%M%k;;X-QxYMj>;{hfTIUu=dJ-HSNd$a{)q>8DemTylIXBday6qeo26{a^c4*WAYRw7${DvIX6M z7Ji6Jch21>&;r&P6kFP-meWR4rJZ^P`Az4#s{Wf*%u8TMiD;l%Ft_bK=jFRfxv9DQ zuTuSQMVZNkVepl;`WeU<#5a7_osqOe6o0rzHL)}mCS6u`KJjeeS&VA!3q~ESq*pAw z=;2t=Kud1vHTMo2A{~&ObW4M0{ef~Fph)f&I7=Y_Lf-iS7&qMZ_%)8mD2)@4DK5ec z{fq~rOk)vIn{d0=B+dZZ`GdS;%^|-2h(g$~RqE4>eZB5mrtHxL+!O9`)Uew4@=X!Z z$rtK#eh@fWb?JJ3_!B3&(SlogOXV{(zA&w&CWn=C+wPT_%*DhWh?SH2@Yy zi;`xtF6d`yiTA>C;tRmv_q?M$37`9c)sTVg?XM=ucwIF-loJy7+U>q*Iv?%D_UrB$ z42-YOVAl5<4}1Q;8(D{{+#I&UGCrKxJXAZC1|d)*GD+92!*&p6NcwQ+-KXu>)y9e$ z{3S`U(Ug7tfCpJSF@Kz#3T|~^?Asj2S=;ag=J>B{@5-4*DpmD^hp36!=~iPB4!+{z znVR~b-50jhxA^cG1T@Yc<_LJ?@kR?Mb>vc7$D z;6tls1Q{tP8hYL$0+_eB+nN>_NEfe}CukXmNom97Ytf-7v-K#{<=G*(fxmG0>bdx2 z7nnO6LSwx%33F{=ojPTGz5haf#|Mh!4IZDWNznJSGI=)gpm~gG_Ds^Ar@U$|%a@?v zR3NUniW6>cQj1hl6;|f9M+q#%Wf#*Rlvc)yjh?;7!z!k!)veBcUvSM62Le55y<8{{SBsol{C z5TKkiU=jekAUA;lwUn-rI^~N@)wQhX+0z3Y{XU{D%TOZ|bX?5xk)KjR2u>|HlV-v< zbZnBWuw5s!S2o_%XL|N~5n&}lWomZ+O&$Qh=wL^0i!UHQ+3h-N2)lm5lXN2GFGR0; zA3a$A+g<-9At^XoP;D1dYTRA(=KH64JAUd(zK_!VAB};Y;k+9p61psi1T~B#IA_eJ z6Cp0j6Y?(TRdE73;}{Y9*Y?zW67vucZwun6TLJn(FatV!yr>g7AiR9?Qdn2Mr*~YNXgDCt`0@M#AQ0 zjzZGi$5uo46ka_3o8AcW7CFo6W2l8Ez#_RlIm89T!Ae#SgAp6bmrd1BOd+7DG{Nu;EYY@ZoH;Vc`OSwhQV`{z=(T+8 zfYN5I_FY>XU-P)VE(?q!X|a%kpwl#*1r<4NoMbut9oCW#`Y=_bItV?39eG;biTm)Q zZ}l29`cbyWjKn1E`+3ih)FytmuSI^YsVJXsipRkx66d+($01UF(Bi3}tD=4TX@Z{X zIM}%{Sf#&n@aUwu5ya+r>6KnR2#UH>>Rsw9nWAa_lla>AkAeYL^kbqw-g%9FneBpX zAWqXHaD2*t4tLgBSIb-Sg%CngU<BLw)&HI}FsQ0~E$T4kBONu8 zR0Chiw*4sYLc$?rg5i%fL5eZ+6_fJ{EpY?4{d{9+sxbt{W zL(pT{u^|l4S5YJ6K^**-94(K5ki%@FL>@NPE7hjW$ADf|F;VsbyOmU=vV<5323Ew$ z6*5WrFgQ$?oB?;6D_NF zpA!jW_is$(?XzwT=O3tmTFM7@=pyHnYgdv=TpfXHoN-=jTWq)iF}AuVdNPYy`3M&W z1=)}*poV&AF6+l@N~bqjOIJWCW0d>f471E6e~EvuKUz}IIAlb$WXkZQidhcDbdEtr zJgqnGVC0Ldlp^Sy`vVMOLOFPv+r6g=0uG@>R;|V)5g$*w@9R6fsQx6*mMA_Ri%)j< z2*%c{!J~1@$X3M1qldGdOs5(QDyHO!2mysY7{ECr>Dk8~N*Q&Mz3)FMB} zS0Y)Fsd^+&GmjT=QAE8kx(XX8BxBSDN`* zaGU}OOL9px0lwElTT0Udeg*uoa@cG-%^oIBSA9y|!Yd;X0Eu8yxh4*Q!6$xU+VagY*8TE&O{*Arrfo z|BQVUix2&t#r;Naq7`B+w-N8`g}Q|wG)w4XCpd+lvlN$aUvOEmwB3Os@Mxtnd5v^G zpxyu1n5$_C{&cg21 zmt;tp;@q(@_B|-{J!FAc|BKn+jKfHyme9N3Y4m_I{s=TrwEwtBB|2F%u5%Z2#9Wul?+ce+%-%10-g+#5`EPO`Mt161o{qw^qc@V@p<+)f} zH)EwEI`Fo+879#U|3$AG(G~|7dWz;%%bONlkt!N{=xEEZQ+wiZ9T!)^P3YMj41~jWtY!}WwOsP>s3+*xN!3$zZY5g??pkQ>z z4Sn+JTIdXT)a)$NWm|+YYRx1@RES6$BlbXYq#=CZoT!5%%X{b?>ernl0Tr~FGXKnh|Iu;c?>C~v#--$GG05RNBAutf zO&{nK=y0}A>#mI*Na-mS|JFa^GwkUV=SEQG9*E65CN5C9we^w2?AGj6;G90U-9(w? zG@f7EhCC8OiEbx#<|6k?I(RRXGeNn&tT!QZl`R-!Mm8sEn5Kq*?+Zwu=YrDwe0sFfps^Gm9FUw#C!KZ3w2GJ`QKGx+zD*<-2>y_ zjyqgPCII^U0>+k1P-_mP%!g+Eo;f_XNBUldDZ-KlX}OG=VUoClaY6PXXArLtSV7#nZ?TYgD6LVa->Y#{Bi!^|-JS%owBZ0pQ~UuSjvq%jl?*+bBH+p0Xv`)m<+ zq%ZKgsZbm{ zdsl3D;*XAL8>htgM2g{Uzj@FArvni^aX)=4AU$j>Kg!Ogv13$OeRWi0Te%r|c@eyO zAN!=)7E%e~h%YSHUYh_YeHWb7AIJQs{kbrnkztE2iy$d3X;%YFZlxoXy!IUoR@Txd z;f2vfg1|NZHFB9iRq6j4iMRY1kt{X@x;-!aex;A#&r;6o-3WSY!-DT*movb!-I-M} z6!T9QY>JA%*Uiy;SZ=%z-)!@uUK&ek@tT?S63LH-Ka$*3)vCv#ed`NlCQyVmCxaIO zvU!IU_&?jc+3kBkMwDfb(L!5300Xsd>;vx)BTp77y(d-AlVhC_zvTgKQ4gRo-!wXO zfGi$i#*kw>ShSxSI19n3JZS<2=}oFmKRMk&p+xxSg7@LFClSuqovQsK&=!!c9KO&3;h5a?3eQ2YR(i2)m{Abtv-iPY`qO| zA9jjexyY{^^Poagu&h2Ve+kw(EzILsV2q6>5Vj|ljPv*p)Mp@xLpcN`7JPMPVmPW& z?avPW_{P#-11T*HF6mC51w|ST&c?pkIK=PcTy;TSCEs$x)N(N58pOk`PW~mWH5ugv znr+>}-Eobw*(x7}dvd!D(NLVk5m;d|0Xeba)y-{%PJXic8i5zN3kM#8t)O=6k@Jn~ zWc4MRoAy}2<9fh6*T3z_z@KsqlJpRhAb6f(bA$2)3FScjH5839upG$Y5kGe7F&9F5 zvwmPX0)hcgj4@Ld^MV!xOxkXpgMZ659-_x&Q~bwfp)_MjB4GqQQYBrNsZs}fbOF2= z-gopB*MO;uf|H8r>S1QcH?Y5@_A;7bsBF4@cgeO7w@*pS2Q2+%PSoASyEl7N^2u0z zKxXY{%R}}5JlvVxI2`rAs!F<50x4=^c332e$WYqhCRdo^$Ioy6XxogOBs@1stv57o z082Ikz!97d%scRmEVSF=?#VDB3bj&F(b4}#F@S`r9_@i0xY=LIA&LX6)glfdY81Kx zkE;z+l#vpenN+aJbD%4l6i~a_4#nTbqk8mffRE;Li}`IY5Ytc!O8na|^&;6FR5I3| zIS}34<;Tv(K`|Kir@*?LwA>(f7~yvY6dwFLP4#a5IpAJ+8g4D`EWGm7{n5Ss=Sg~m z73KVqVQFrwC*iRPpYsMdB`{KQ;s$ES&p{D2a*92i^mj;-N?vR1!eh5h=P3iQJZVWNAf|S8xm3 z=L(|yE7#eVr~y*?wJjQ0l323xsO`428Aa|0%%YiKO6c+vRTV$37>DfwtNJ8ZudJHT zPV&Om$Wr_oY>G97KX;CtcN&6%FCG&rt|S3=POwqtX7t0jBY0`82ar8(p?kPB&un5^ zo#uZjj7oRt0h?fmt=1uD=Oze3sK~h7uy6%K7qSQ(MV+`dUVA|>=BV2>!{VprC+fH5 z7z5(eEhTPNm`Pok({mW2Ynwr-6wB zztPd+X-I!%Nwt3nTD^n=m^LBO25M+Ja%rKb`v2_W5MQK-QCBEGR-fGZ_#0cW0YTu; z*}kF2%lHH(&5@LXTrTzZ6toW&<3>o%p7(o#pz$|iW-xbU4JW^_ZO-9brP8`73+8nX z{_N*8!|*gzlhB`$__Hu&FR_?sb0^{Sl-!GHKQRD&VlJTyzAX;Tbs69H!ea@c;G6v>2gQloUy z5oF0kLHj}Uz&4uD9cUZ4h4(UnxGl+CjNmevBtB_?DcA=rqQ)oDwYXbed2R(Af!+h4 znkw^XD^z=@zXGNt-sXXtJuoM`UlJmcOu;A?_vp|VY+lF~5QzH$9zhwMA%ZKJu_|38 ztlLPHnF?bS!0WZA6FXBv3J=TUi!BczL(M=+UoM=#J|3a8vm;|76!#}d)l-BaJlC~s z5}GiEiV1HTtF?d>Raq!nHp-!_5~Mn|k)*u6^B(aUyc)>bH@c>sL&MIX)kJ^cEll6E zwsNDMK=c)I1eF%td0}u`<%K{4{*~(jvtuDxt6TvF(_j%tK+t}QGYi4f01MDCeV4=Z z(HUfY*6OIp1P!n&x|qMU0_eNmboO{3TEOtsw*Y6TjQ|tt)|->er&#>$0eCdtUk^de z&d=9a0Zj?@pWi$VeWkvPaSnG9q{<7*7?UpsEISK-)* zt7(|k5_LQ|hZ-+Zy;o14+PH$0#1~+$7SUXam0vmS8I}zN$AB~<`3Irm=(qQO<}VC9 zCmyZ?nR;!WL|33KYg0{d2Juzo@*Y|S^ieNF?ER)Jz|{t;4B3srln?ZtbA8n8E$V7} zQGE^g5~gUd5o!;bQ7H@)t5D_tfU^GDWSW@NX6~$0^=uw{Fnk+ag7AZbVWevhtm@6ylsqa$#1 z0A(KtweC4Y$3G!8J2c^1a?7wU$I_1CbC%=rjuy$zW4n4(RBv7C77 z5+`THeCy?khU8huq4Noh40fP!vHj{GhaTijZ&Psy6YG0 zit!4C?%<-mAX3Hs&oNAg-Lo}NNn!40Yze20VirVmNi=VD7zAhH|sY7X_ZmZ=_h2TiqhW6vyz9Xw&2?`Y-pxub#?;NN~hII$fdi z(CTLD%0~P5w5@{OWTop=S$85?|NbNZMWl);ok@aG|J)0<%~>8#-t_{oS4}PhnZ(v# zATM{%MZYT4HdZ$^OCjSvK+7WO-b7)MmN`&D>5b;0D4wz?MBvUbIyU8BIr$?y8!diw z?j5A==`A({b&{#f>;=F`!s;g)mocN8fXg9uV!zO5(*}yj^#aOL6xS0KZAFLD@!&9n z`SG3|VD2N2z-8Skc7Lm58A1S&q-RE`HB_bSo`EKIy%jhbv1{Xa$wVKfbgWGyGV+81S_@zHo||7_>rNk^0Cm_NU1zr`C>sKNV2%myADUjp{hjah$4 zlz9?cD29_Gp5xh>#_hZX?T0QVdB$v)SEV9)S;lk*tdlRFjsYUlA@&W`UylJ) zrf;z8$IyM}dq8o*d?l2sElc;tg&MY92+HMiP$A>a75qQKz62WT?+cu1Xk^J!*3x7T zg=}S=Y}v_9wjw*(mqarqm2BCwj-&=zvSmv{g%(WK>`L}ELP-7JX9o5Co&W#*&vE7q zWDTzzN|PlgO(3PN#~mT$VodbXY1?Ib{jz>IUkDpANq*sI!J?U(R`$ zSu70nv{+M^P<*dj;2CIo5D2MADCDxIew%O2+-!$YUU|fjRZ9Qt6*R*E*hf+lqbos{ z%*+PVE#`0=tx+M$v#v?0on$cKQ+Aq%<-u(NgHOaUY#2Ij>;fqaV9$##k>`jhdtxfX zfM6I6fq(IZe=M=PWY(xWopxC2@~9}sU~ynkW!&bpo`8I#_dnxQULqh(FhQ-CBmAUi z8R+iFAkP=+P&fk0fkD~s!BU_EiH*mc%nwpUv0U+n{cM~Ep3Pj?NAIGE6DF63_Vb=C zyZm9hQi1a}%0q}Ca|0B-_CYl@PJaT%Jh{)r%%?$7pwzkTCGXI-2cWen0W>{QWScc` zp5`zQ1#Md+C1qbM0FBVMs| zV4+MU7$-OXf?`}6s-!#AOQ%@=g3!iDC&h?&1xasBoeJQW4Rqxh=Frk!Z$+Lweq|oq z%L~_+ZFUC@<4S}-vYXepH`sLMh@>CklQ$0SMp2EMCAkGJ*p z@2bGF8{le~1_fS?KWp49E;+qCZ!R;!sz(noO z9MGM7H4b(U&gY3-Fh zuYMrTxE|6)SuE6U)9C+!6gKuG748#oFi&!oG;;>ST~A3rp>Z(4B7DiosfGd?&Y7?f zKlK5T4yn~8@4d z7z6aD1JWA9!$B^eyTdHT^B3sPJFn*Gol_ACMj1Z`ty((umEP8{vM+y0&qJTSH)EyX z8iMEoT{y=pK>%&5;(Tb8CGa0UeP4U1N@WoG^JXJxA{|AGU`*G>JRUWI$v7H(5>VQU z4p746CBGS)K*Zr>3S$HHCl#)sXuNzs2HXzj$cl)(7z_;YKB&T2+_5e4)*MI%lz{6O zFGic6gAB*zcO*vr!C-61@uZ!j{PA0fyQ;(sCy@Jh9tDO+?Z zQw?QEQAG!w{3tv!XH!mR=WwTG_gdflIkNdFC*AY1vNzX%f~m$MoKfxOLM-O?49YD> zPW}N=(5LdtE!^Rw8z7YF>XguK?&I_6NSky@wi`A1FDP9zS^>2w=MW*p#_(-HbBj9W z6tBEL1PzLE>2|Y31ej(2jSl=1EJ$Q@Qp9X&27i9^Bbx%pEUDT(k&XusH1ASk-p~Vu zHp&FfhT!rWSSw!LyL`ViB_F>DB2A~_XA*dtM{$l`n_paiWGAAEwL{>zxd>!1#K4`f znNM!V*!jaJ0+goN2}WRONHsV9x-srTwyR)*?j-=tkPh;P_PhtzOb90eX{!iw*1>=b zxueEbJJK`n)K@&Bb-D!2L30P=V4YM~-OVSVUKQXDbpo6Ur1-gPs|d7u_7DM?DH$|HZqN3d-s~-HIVIfS%mlp8CRcktoRL z_Ix+F+8>Jth0`9OZ?t8}I5gj74zr(A{Z009d#LOt>>Ww-h~7sfHMpy{xR`is{|(rK zDf9Zu1xR}K{ij1CZ_jTB!oL^b)XY_|IaHplw!d_}w~>LM_JTA7XO9l_naHmY^-U@w zZ1{_-p#DRMnMps``%t~>{ez)nwMFcu^k%@jn+KgupFq;)wK+KV|r379@owJvIDK*j1 z@iJg^!9?&wkt5PYyhXBqHU6HuobrXuWFfvqp{8ESUv)PM-h)a7n*p^j%ZN_u?>`K$ z2Mw~I+d_7rHF^$|=e&?*3U1Wa0)0v=djR(*Mw8fdw}=~!RPXh(IQn-U3+5CzJ^RXW z?ZpEFcO<+6mTuZ7XOPc$a8req4;tD`)o@$>n^%S~wE_PTI&gjBY~F>|JupdcaN?k5 zp_dH@T02~0Ut&y-Oesqtj_L!>y?O!w@ z!HrNf@}=UiG68?MQqPrTy5s91Ydx4?!4N2dSg2m8`rZHXstZx~{UsTQYF;96=_d57 zr|s2+@{M|m)^VNw+d!s-up zjx?4ZCLiPy*-x6;N<@dwajfP)L_Cj(WR-Y^YXy@h1P&BPf+Sr9qtQaxt8EhZp&qv?k5>vUQwstQ{ko6Uv6#i%L!>lJV zuXg64{oN7qyb`$Rujz>-Dr9-NB>p|W1b(!qJfH5_%Y>!R=BBmB!CZw=>^Z7=jckg{ znl%(80ifrgtf_ET)u7!u;}au0`j3K#i_iQ$JSYZYt9{3_c)*|ubG&u!@o}ii#CIPC zoSR#qG&r%mu2-k1X3yl%fyWuCq9=Wg*%FCeZTGeZ-dLPN`R$4QZ%O!{h0SJeYBa(< zfi^MW(ki2zP{V%bQGk83xh9c4XNABH8?qF#(9v48fgy9Jz`U)!hc4@p(e`JHS><_+ z0&=)7lf;*9lb}xyPU;*C99@x~yC>CG7c=YuX3&CbiDIr=@mocqOY#nO%7w`P1Pv5z z>(>I+A;^#Y?l=CiU;a-2o~DWAK_>-kpDquruc02iBhfFde9K@v7RR%T84Mr2lloz2 zrgvd>n#TDWI0N59|6FF?;KiTu0AUUR7v#-XxlQPAKH|5-Rwlvq=8YT2&xI&Pfoa@@ z@Tv*X&_8|jV>Uja>>IL4=)e5B%V`kZ5jNmm$~((W1;W5ImBqlzlD?jxb+hC*6QWHB zu^Pq#5eCOOBs+$a-JShU))*^~2n(BM+qxYVI>xCn;IFMz3AG(hvr@{P$q-Uez0}H& zWxuF_x8eSzmTtmH+fB4Y{*_`G+Ncm{&^cz4X=$=lvrxJFm49N&evlY!e|oI=m(m%|HCBEdn^Y67Xu(WdJcVdA$sbr%mqmxqD`Z8+4d}e z{wT6kU9Adpc9z$^hyEGm5X6HXEmEw$hqO7{5VUMNsF29PU*kLuG>3p5+LdAK>9>pz zuYUiMAQlBgqg{4X3T6%XCtFfhC&5669f^kFW778nK&&1gz0vwyAvZrk4)jF|xfQMJ zbT03lah}=U2P5Hu3U(cF+&?iI_e}#&A#g-Lk94@Uhym`Z*&Kv(_gbe@-6Yck8!(O+ z>CUY+)$guNZIlmCGmQA@bNWi=yCB#4eiBQ>y29kEJ*80%!dG9$-*+`y+SE{adx%ce z!7^V8?q_FTj5=~QP5^kT7#YUVA>kjt-`-U0^*UN$Z~<)HT^k*&6f9v=_;&>T9(q6l z;C0wcHsUc;id>NQwa1rhZi0gO+OMJo@q08SMjoaBdIG*MpL+ZA%kq8HMS6YiofE{q zrb0gEU`#oWd(p)z(!|I<`9M1QV4u%gmg1pjppqOz1ONPyu|}#oTDjLQoGVcUP(>>h znD*g5oZBN|Q?a+_e?_FP0=U)D3zuk5oPFIH+oUmCf85L%w<{@8nN$f(`AR>z+viOO zRIpYE+^)t2Q(baFKz*jwz%&5Pv$Y`04KBaDu`8l}cCW;ES7Ik1@#1Xp zNpFtvJk2!(4S7))8T9Q)Sm{q88!L;#YGxyfF2VLx3&tEO`szZq*_{d zTQTD}S>wPRMT$K;GC|hEqg#wH&C%GW3UH$cXuH0We5zn8;Md82 z^;D`=fd5Oxp_}@n9v767_Fa>K+6bES;O{!R4W_*X9C2JV*p&%*Zhemqs)mCi_v;{N zK)d!XaftC+#4rRkb@({LXyN0&RGPxDq>c!1N6vF7T(i5@^ln6>3N{$AbiK(}FQ(g& z!AXqV7|49WcleLhlxW2_Ggx30W4-(xj5LW>9eDI%CiS$%qAIM~75!@3 zJf!ugCNn_u6!5~{KQL0L!R0Nwv6Gkx0AnLbt*^EiUG)fz9Wn2=j78NYqU*>;v>L=E8^I7a7*c6t({~_lWw- zTMsGG))tZjB^HQc(rF*;cU@v;^@g0&{vomVP4WuIPgik#dS66ebrpUlanI9=)q{1@ zxM_`F8jXDCc(q$_7oX(G=s_-eE_%jMTB@z^WkGFt9Q<0`aQY_HCWM=kR;2vY^1&k} zOOp)^;mL$x)-<~xzZ36pKbC@0Qa{(pivBe9=ChMXM&>qplYx((U2Cg-&{Ov|5TCw+ z7(z(4;Z}a=u7OyFn9^!#<;r-;DKSu+_sKuT>-Ef+qFVg+Xu7L@{{C{|D+z&Kt#MY) zdsLXJj!nlWGKZuEiW=?8H(xsPRUoZ_F{oy{GpC6-2)eU0JOOuRUS50Ah8KH66E1TX z&CDk|Wt%TV5;LUN>f`ir#&LuY54sq3lKo8pm0XTPnfpCJ`-$1%B}&BLK>-&YYB^QR zffg!qNo686fCE6kG=gj@fSsRuUYq<|r;R8AM_-v$WN z;iXSq|9Z4GFG~N)4i-V2N1|zA^j2E7YZOD(u`?eDF2w#ZZ2j3hT(Md(mmTt7r?=IQ z)R=u9Cg0H_u-8l!YRHVf1_@dj*zrqb7Tg#zftI@{M_>?Ml34HPYrgmrvJe3na^yE? z~1xqAU9Ub|4N;Vyq_|BLH4Lc#dasM(!%?F zFBFR;GA1RgLhfoOT>h(zGP}Xp8E9(7-p>a2s9soyl7x%harp-4Hzp;_+0HFkY*k`!-xr|M?{tR#W*2c4wEcI!WXzw zyI!G~-_LU*o$_EdH~C{Hz|;~jXpR?PZf-PoKVP9^JingqeFI{ze3B5mi)sT__nH!Q z^jTMby0jd=dw{`8)ETa^3;@l@Zd2_7VFW^Ab#4p6^cnl_--W#VYc`*G}sgX2|zl+yN-Z0*Ld+O9PvH-XmOqYp_gS>Z@DI1$1{&g5*U(k!k24mdJnZ;-X|Q1X<5(E^h%<_>y5tt(KZU+Y_2h0Eg_j z*ix|HK4txqPuwa_7}r9fiujlWzI$mjmfb+ck~-*bfSH$v_zH7><7G}}K$(#}VQQg_ z9`c{*(2Y1`KIZ+uWF3rUTc>3Dq7QhlmkCi6WnY#xR59dcdBJsO?f zPqJWQ9bs+`tv*{_QsA(fn3kIRT7)jm*pv}NXhiDf!qOII_{q)oae#1F{FC=2rS7B% zbMb0s!1by;P^22a`H1e{9Yd-!6cN_s(v9GV48E@P$Ph8i5Bmm43nxo1rFdt!xvEIa z*c2BD&Y_wY?-%36(Xv|fRww!HE@9F0;a3bex*OeqlQyJ_lwj#Oynf$9acPDW4MQm- z!ZHhJ^VDxoK=*Cat_P;@cz7q~lOh1vCz-o9NAbyF+%LC42q3Zijc)G0^=Q@$D9B%Di>(evi?z*L7%21%!n)VA2#-njY-3 z0KZ&g_zCJH(gY&DOY#B#P?-uxdOl{28=syq;1X4A#XdBj1Rdia5Pe9q%*iK7KYC0) zm9I*Z1z(gVZR!b@PKMYns=o|6g@mOBPh)T875PeH%GbrHhNQoh>t}NjykTyo4L@nW zvz*xugzQ1+=&@;3C12!zJhR{DD(!P&1pL*3$u=_T;nB-a)?Jd-daJuHksv<}{R(Jn4h*LI+RrF#Rm$gtQXH8(vz1N+x%Pz9zjgaI6 zmwq&AD#+qg%vZ>eO+!u91JUkyY-Mda!-6PXH@NUCpOW_-kUziD?NagNA$0LyyFbLw z`5f+G7^#E=2uT=*Kv|`kuX9vxo%xaDH4!*y6+;w<5UGJtR%|oUPrCx!^n{?ontDWu zIb}oeE92jf?i>RX8M_iuEQi-r?{B?djsBk2AX$8tH7kNBOn?{wvyN;sA1Lf^B7~+u ze;d+4i%B)*;dJmzt{3nHjzGGf`+BMb|1?IvCgzZc z;B={B8JLvi+Qpntx~gP2`z0PQ1+xbBAVoi%u=HiVi+6)T5@qa(wWKUo$4c1cr_Q82 z4LP@>OQ7P2@~DqMV#u@&cfdYPiJ6pylwqMHzt^YhvMc;o6IY)8k_27sI?^@`CG z9V~R$ajz&Nm-(UFRBP7nXLB*?eFh6Gi2ipQ_5C9+a*pdzQ|izjjJrTY#8`BW>h_S+{>Ri0{sB2-uG_W?@%Fjqe3AB*M^5_OuQ8O0r@21U9|O5Iv9=l~otlNhR8ksN+m`K4|8 z$H23Po)WtVEKxmO&m!Kg;Du1Y89h3irOq*e;tH?6EIM&Bbk= z@xcJpv@G})Y@?HE>2f+}!JcggT8sbOcWD_6_kkC9Jn6!xPRcy-NX$cmV?08y&jbL3 zP;ndOB>ef5yQwT#6ZGgqJ;=HhAjYiz%M;>2Fi*utEPFOH(`z2;SSfAwhY*_=h4zM| zEGm?0DP8$<=A<<)5ll^{p%BuB9;nHP!iu`5x5{y>XT(tm?1o7O*Vv8g7iQ;&4CNK?s(n)N!pdfN3ze%C6M&q1l8OK_tSlARk% z#*~wdpgJ0c6VQg>TPe(5KRw*s5f%%|5N9w5Uup8pY0E9=Lsh>!oAx;e9XbW8=EF8Y zUMcDrdFEBQ$;~>|B>2sUSOG|1!eEhQ%8R{+8n!B=UMMMnwV=OtA|6LQ@65bMJOApy zRaq!9+IU{#-(=IBzHsP3G4C^@hjP83jqJg$OyS(Q^kvD1KPdSW<%T_QDK_Q>YJWMj~rY9@dCDh1_}}_ zR@x{ZA*<_4-K#}>^w%cGLLyb;izsv2?xXfI3Gn;s^)l#og^)3xh7yKdVhkX+5b6BE zoy$&G7=w*gJlu5-nsu|lKWN$^Xum+4o z_mKe-_)_9|;fe9{^BGHv};RaLM zLE16$5(BI;K`?O=I~=6NU;vH(k%U(ji}svKG##7UOU}fa!oHv37`U3#)T6)vxa?!Z z1N^oy9qsm&@B8CTsBU$XpV>t%2=em9RtCO*qd%SA-Mnns{5X-G9rrZXcz0J4>1aWE zkZ#7qos<2{hYn*(;q?M(kK~z_hFPvj1IU9p^(rjjrHrHf?aOtO*2spfXGV#@e#LSl za7^wR=v8>woLH5X-_6Nm?F|Obr2J7gpo(jtCrZ=HCq`@wXKDvS3XIMY%NrphRgH0! z?JX+@Q~sSO2lk71S_GaQ!VDq?lU?lj-_U}|UlkmdgLw}kc7zyESShILd)NqS8hZib z{Y*L-;RAaCJ5lj-z|LiK`cdWT`HKABL^K$<{w4W5Bt`UUCCVfG!-rc_uIdb=Td5v? z4+1W+$}r)(rJ@n~`qdL+*0G}@XEh^;&M_1Z&ZQD{Q2n|8R;{m#cxJHNpZB?jbr5HD zX`+L5rmO};lD(wXMWZT0PVYoE0lV0_X6msHhF(n3y6hG;-~3JlHV!HP6tr;*+2g15 zPm*;Xtv+xF6A70wZob&GAoLJ;R^)s>7N2M{=Tr2DX!^yn&+KL}feRIZX76l*cT5s0esW|vBuy?bZZ*1iX^)u(4y@)}G9oZmC ze!E8#+x7EVYUzGru#c`RZ)?PE>;-@gMiFq*Fp#234;a0AJ{)w<=#hGBRmhH z=*4Ewpo91EG5gzxQpG3##vO&WfrMo!qgQXhL&2y(^GbzfH)W*2MVDNNNI<#osC;dl zmsEvMOs5$K5EI1Dw<7UAcb@ypHQ!P+5^0xc>i&5A_SeIFFmoWF6om3*9*^CwG7_Va z(Rw?{r%MY>AdQ_1CU%CHG6RK7j@6Uy@|Q#fn#11PBV(xEo**h3NKgX}braRb!NyKK zQTNUz6CBt+s<2^-ApUrI_kGy~P7Ez<o*NrzbQ1Nz?ekZyho6AMhei39-_UV zg`T7gcSOJxQ+`$}ooUjsX=|-fHl(=uUQ!)8Gbl!p( zR zask6M!m~T6YEbn9?IpLxeYuquH6kyr36spm40uQ8L!d_81Y-@Dw6u|u6=M1SY*Qu$ zJy1~>Niih#4kTI$7O;;m!-v}gMeK$vDhdtf0i>;5_&R;bMwHi9m5t}fT^0|91C3Fa zelc)#ybW@BeuBT4Z=qoBxm0Dqysm?r*4b~XGWQ0IKZKxyRy2?bl|}MBwJb|+_^S2; zna8~{U9L5yFkeE_EV#U%3X_{r-eUauC?u^Y$q^~){Y@Q=a}Hc@vTrd+2;1V}tG`jR zPWY*C@k2;gp(tph=0BM1FyQH)_{B_Wpgh00qU*zk$jToJZniG(>+Fdyl3a6=q`JKi z=8q3g58p5FYhLZVlR|#PPWpT9dk5jx6!u%SMiyX7B`@&!Y^Vxl9-j;#UqPJ+P{t{X z8>x&TaP}m9$IOWH_kNnhx8erKV)SA3f5}1xTMti_V}5pZ%s3TLg%zS?>DV=}w4j?#SM*_5Vfil%f1$54AZs8GLHgZ)L!a9K61BwrhK&(Z02><+c zMo}cF>2!5x1gBwu#mi9H&JHkjhr}JwD^iv`>iKn(!ey-htAdt-VP9DGx;XQdz!>fJ zTwp6=boubtF9-)7t2yuMJ<=@=VHZtim+c|`Lw1pp97)rNVjT>+TGpSuALeok0pcR- zC!6{QUrP+PwR>IAf>yu|AeQ7JvQ$6+tc}8K%BDdM$7c|CYNf-KX~EY0C@qT4oSGtp z71heU3%kRN2C1j(7a8?)fPtxk)rBwf*}h#l$~42-zDl|ey$5?fcdV3SBh1E+SI~47 zZh4qd_k?$40)8}fw!HkeiD_G{xzq2&b@i876`NDIP$;k6bbvJsV}>5L#(b&&)Sr|` z@;5LZ$MNEK9AjM(vq`@TvW}{wtQg7fklDG@jJY@UJ^vKahT(ZiGA~=*gBML%^p#Z5f8mKGdcYyow`OP~1r$S302h+&G5Lv~S`o!Y`j)^KVRBEYi z^ekiAPxG5u5``{VGp)xku_nRgL%p@RpjzbE;5d6iDJRl{a=c^Vc{3+pq1L#-32V4a zI9i6scFA}*769pZ3|afzSTvkTimg;yg6dX~HZD#-O?i4pCz7_VpGjudxSW@u1ozg$ zo}lFr^EBh}RScaK3wPGcJzKyd@#p=vGRGqye=G*=ijVs4Oct$X6u3qH!XG|Pd*`8u82H2wF_UBCJzsG*Eo3UmJc zO%-G!M8Z#+j5$7$VYbLs-7jID3Y2`sxu{A>8P;UdhCB6jMNe3mnEi)O6%KJ#s08gJ3sc)V9_xn zco5`cTBykv&Y9ELrD$r`jas%9sm5Y0`*OclFZOiWUovw|txFdl>Wa3AF)!QzMWNyE z1^uGB7)?L;%}*BQ9?h;x9BeLqT)4`5XW8^x)W($rmltW39oG`9AwiIO9wpg*A00fB z9K4U|)@907nO-Ac+&~`DZ$y{XXy&P=EMbRpPcKReG-Rh=QhH>`{!3(`3&tRfD#3pG)ss*pHs9B_a>P*P#brqJ?EZ8hoP-nA)FA&V7t{uSs>)i*G#5PP z^-tr`J^lr@j~+3qvtun|gyCSMLRRkO+=r@U=gz??9XB-paQPPB#&$#=B4!P&)Uji= zAIsWVDxY>b2{yK+eW{M7su1dm(XVL=5Bc=@t8op<5`kVN?vlYuvmZUYNOha!O(XGJ z=1{3qS^3t14R0riq)9g2zpt1!ek|u+(#lr4h&mTkY@^v9M9!;iuM@~#&k-w6^Gqcl1wzSxa5Jm!>35H5Q?{DspU&S{ zFj9QjCx4^iJLWC~**^d^Kw))TkaKUpsh6v?-qrAkz8}qC^k%P^a$beZ{ia-VVCL<9 ztN9f%BNOr09bx#XtKtKnIQ{Yx|0*_mKEnHIy0AHh%JWm9V73TX!vAfVtvgT6f%YJ{gXD>%T>L*=1wCl5W^qamDiZu6ri$|fPHniA#)=uMlKutuMWO5` z<)kGGdGKY_=YnY#^e+Z-hQqm(oL88`*WQ#%X{2yRY3nw2)9ex`xM(UM*^_TN#!wpY zL1}52c=Lyl30GQ7`B?DeWpbsXNVf|RblUI)^}ocwM@A~35i{-%SoEllEx0cpu_--X z!5`7+LJQJyg>a6PtlL=qRNBKS^}utHWzRRwg7qKtj8>0kla43n8^pf6JCgs3*Pdh`|7`GDa z0h*h2@RI-*?agrEmfJa7G|Kj-l8PJ}6(-;vf8j_v8~wRJJd=F03I+Te1I5ILSMkHs zMOH(#!He}qrrXQ*^F{xTM1o`wFXag)1yZ`G~3<^YqiaCeGqOgD%^L4 zVEbV5d4KQd8Heh+w2{Q$&x2m}>wK4yzJW>4lDoQG_uj6De_FD)ibpO|Q$Oo*6yHL8 z)lAdj2{WM^M=lnY>5@RE zp)x!EU+CfeBBEOey|(&ysucoXLN9cP&+*?|-|((p_<+sujTb34Tvjzu6!R9%^W%5- z2+)qBej&6i78(38h5y7o*VNM*X}7lCT$R2ed*AuR)yb=}7!CN7kYSygKOUi`o6U5; zf6v(&DvE-A%tWk@KS*iuMK2G)} zxV-cuod`A$)};EM^MNCth2b-YBE6UG*0X8?mNWPV4I8(^^mPVKQr+7)4W@Aoo7#Oy z*3kH^rO{~5$ZuGhE>de)T4(i6Ea$y{vqSLaNRj=s_ym{89&q-eg?OG~$y-})>zl?e zfXo4$D_c|U=-tg`>U^yyr({Y@ovg>tT@xr7naoixI1Y%=!J!2 z#tyxSK0s&elHCsdVQy1_>u_uDR{d^`#Ch7hh_7*={&s(YXL#~{_Jw!X%kCnnFx&7? z!dFclK0TF!zHB=Q8+fU^{$kx`V3u=h%jj5uLjG*Dws%O;#p=*28#Vp@f3(w2_+4nK zFS0&Lr1O-g=t?RHE9`=Nhuoi`oN3Oc^R@<<;g4(0bO+}%;lHvE2r0uho+X_&3Yw32 zyyeR9OOJE{&+5=*|AiMdKtZ=48zBCMXY`odSbFQK`N@yGUleR+emLmMg!Xy-ar^%4 z>zs=0h5;_?dX@;*P==uj39+0lFWft0hQDu8Y*t8YiH**?tD^db@@tyfjzdHkK|#tG zuP9IKE4+l!rQ2i}E2<+eH{TRRFE%!8q+3LFI#%T0-60V)zKBAC$OS??p5C{cTyP{@ zqFzwM+1~h7C-i~W(PmI+g^&`|7&7d}+ozzhz7hZSgn4H3D9gyi%#V~eTL~YJq{oRw z#(nD*vC{Uo%qVkwtaG?!G0NM)IscqtmbBF|(@c?S%GF|3^Tkq)uX=gnxU_}}4@E!H zQg|--kLPX}5cuh$JN~EV0=SI}cHw}GZ7=S2_~>nO`1uaQ(mTbY&4{O#j?eVsaOd9P zUI~3<*+9FinYdonjp6SfCL~SfO(>q2>3Q4KCoCji59-nj{phW!$ace+Q`}*E`E=pA zwpwrFzIzSjJ!@INH>x?xGSWNwj+CXPJeBwF?_IZ)rPLa_;^-ONf9#0i^|H*6ndo^J ztMr-6?H}*?twM5!xNz<*xZh%w+RK<3WK1j-eM&q^;nfqPv}E6ZAV!L^kVi58Dc$do+Egl$)mk5lwQ8YJIrQmQ05I zMnfEY(}is?b8Y_^8=~_o8a3jCb@B1Cv$ON*gAorMi304t!kN6TvclY>Kn@#&FQ0u; zBQH&!YcyNPv2n@t$IX%PU`pm&4wT{nX9IQK! zx4i(%8D<)%Y)=)#aRG7kkzyupq19W_$AR|m4pY?d^*h{1{F+%lI&3RGoS zn=~RabzDK5@5x}vQ{ElTfm(;p3?GcDx%50pMok5c;()7#IK=yogqI0X{#7nz^aRQs zSRj_NVv6+~sSrP94P($JQpGeZC$1^;d!(aqh#Tb&ZP1$~;hUP8N^3kEUp?YN**3%c z$_6LHu?a_|XHb714M%)bMy34&_(v;L|N5A%*Zhpq>n~lYcGc#XS-ZR5gCoIg!xHpPFB3P8T*{n zM)wcM^iC0IuN~S1e@?jvF#k~0B@8@?w5mHZPHR}bPGeO4U8&N}4yGbdOe24Q)Lf+h z(-1OAS9tNbs4V$ONn_hC;dPzstuFc5UXb$H+XKo5&%L_=d_I8Rrd!-`5Ughwj#dC% zP>sj2UCaW9@Uc#0k1kS$MQ66#H#avs!b3bq&gN#>XMNk+ewtoi{(LG0uSDT1#Um;> z9qPm{^zVLvpzDVJMW5|ua;kME!@dU)EUA39a`1j6K$cXxs@Tr1YY($Z8vekgF$D~a zJZ@f8ymIwyVAI+0xH6H2#AkZfo^1oHWZ+9L=5Gxq^%h1&MO`_l^XI=SVkKd)U8_LC z9Mu>S-yZ#(sC@;gScNc0sUtOcI3z#JM$395chG>%hG|&3PZ6%Yj&mBZTe^jMNuKqSo!2ts5@QHE`RPKQ8Wr2vTHdh!x$ItoOwpv00zvEvP*=|IB0$R$?KtVZU>GU zWbEVanlrt6BL8lYft!bVk7bI!*$s#0_BUgTlT|e&XR-(bJDr z0t&89_I-6S<0wf2U=Fi<{`?siW!trt)1P4sxY(8)P?y%E_yDf=IR#B#kQFOQApE5O zLMS-{k=-$L;P4kmHCRp)7o4g=F^v^#4Yr&)-@2CSeqaYVq&*9pK;)!RXEUe%L+Tzn zNvnKi~dhPR{%STu3er4y(_ts59#;RESC%y$IzhF*rFS;O^JCH;+)wCnTBo$Ws=YtdTJC82;Gg3c ztw1r(#bgCsss1*1KlsWF<&ly?JkER}#D4%16EhTDe}(jaXk`K^8q+s78-8{rY^z3h znL^L%rOYmLm`mhkg9n2p+*<>8D5mc~lUnJww%SexX}=TJ?4)VgRTr2d>Xh;N*>?23u@@u> zW9EzjJlg*~3pACeSQP|FAV^^9taE9ig~SJAu7z+6wnMb{guX-wT2I1q)c$p|W8fY` z3mvzOh5l>{5P45pyr2J*0F_Vu_45bi*jH9q4h~T zJ`8>pM(vO;YP|;F4bKSo)qqIS7$e_(V0LdUxQR824303Om;i?7{2R#UATERVg>{=V z`uH+R8I%GpFNs38LjNEH0=doeUh(gTHuj<-eZtcuCU-)6BkE1W6Rs#+BLdCqnmPLl$CEu2D1N-A8a$flrndTCRK z6I##=Q|F&cLnoRwr1r9hcERx>^uc~!B>N7ayURh8IQImo4v)-$3p-{5EsJ`onxFAD&~XWT)DG?jnE)LW(MQf2$c6)S^YepwtLfk{8AQ6+ zLfF^;%Z?f;sDS#QFZb9zkj?`s*pQK5*zSSP*vW=o~RIJt&;mo{mV%c`<(-c zptcX+N^oIys4k8$<40kQVISI@(%CyrT@B;UVpm`s92^ytev82_0hXTQpImhlNOB>x z?`CihZ~+SVVtbz_G-*9VXQ1b<(z@-_-{6!$`Cq~MmA3}^tL@JCzvA`X;fco_f2?^nwZ!dko(|52k`3>kp_5q*_#{?+T=0)+Y zOhE0Upt<)y>);UOqF?G6vyFFm7Xer~^sOHD3q(Npbht$AOZ>a}0P`hI2)pt9C1N>DLnP_Viiy4>gp;VU0(`#NQn?o3G1~kT@5=N z37$;}7ygf+#b1W=42m?Fi>$(2fO%v#`t40{{{u3N{{bQy`sO&?+u)ss3 zh1ub;A9PE%0G@?T#rD2PXb@etsCxcf%>H4-t9ou1d2BQ8h zf{{Yp{bx-~HKf|FYOuLo|C1NI-_)^G_)92XB>VAQlLRFWY^UmDk{8{?)!Yt2=p?9N z;@xR9wY3;_ zJQuig55(F>xnz+1Y*7)6{ECZNZQ)^HtBm&dTe#XWf7XUel#$vDp}`>o$BvUj47 zuJPYLKU%*7xoNW9os>gHVu?}e_+%dyc79F#GEePv3h9Z zZ0cX^lf&*a5U6(v0GRsr{#!v&AwZWplxOwkbwF+m-=Pu?a#$ft%d@*DZebiu-Xt{0 zKth9f^nBDtBkdAF&zjV*4`7rP-msvd0=}V1pTR1Qc#~7=`*sB9&ZqkhIPD!hmH`HQ z`QrOCQ<95C1t!EW(NTJOF5t*8;P{*$vy=^<-?ffY`9x>r-vf+xhP%iCF{*^mj;H!2 z63p{G)N`>;m+yOMNgK&Rg@7V%$LSGTY*!%G2$sZ#Z54fuAj(d5ep`?k=8lC&B{ZPp zun$g~k@O^hu|yl=RVKwh?fcNKQyT1<*~!<_1MBf)TI|e@Kp{Qc>?k?+F3kvQ1Bum$ z^HU)%oDb`vn$tzaH7)!)0)mtfD8hQ!Yh$C!YL6VDUzBXCV(KVO6x+uqrW3x%7w*DH z!VpkB+_sNN$VH`r80(9Txd;-)EQlK+2#V&(@RDF~&E%0el_*CgzZ zgafgMIZGu`*;ivn#bkNT&?OkH^v~7v~E7gPsh1&8XH?FL|dues8 z%~!rhwT^SzZe6~Q>a5;Y%UXld^lv{BEXVq-^TlOe$XkDhltlu{`e1>^`u1!) z&aSK73blWSpm$jTwMC(#PCUOS%s>W8KHRs9ybsK0Um#|8V*#uSuTrrOz%_u+TFV-7 zjQh1_3>aUK{BDyA$lm9nr$ZT+e2(gwzcr(5PEVoi-TDBIY5Q%H;sOwJW6e%zpdTwy z9*=atZrdK(s1vX9sQv)E49*rWN1@wR=HD0~a3iS%1?2*Z>AlxIVsx87L0 z{+RSc&H5=VOeVGy*y?Qkv!nGscX|q;1(<<{cwut&2D7{CExa~`gc=(40lro)%=zV? z0~BQ*3mSMUxotO*3AMv(2o3*`M;_X4$?Qajvg**YY^DgrCUwR{!P& z5Wf-D3;tEQcFb>OM3*M%u<~Xr&3bctZKRnK+lXu=7zC6*gO}=oAIPExW zTwGX7K~YWqWBY2GukrKo33IaU)9Z#SXQbXKjt%NOtbFCQ#oyrg;7Xj&r7UskTjC$M zvXVR3Bo_i)E)4juu$Ok)u^hg*`EYGDkbkRvcKw-$@VyfYK_6F6h9pz{`5-AKjU8t{ z`{lUSkbBo^u)Di^-dMl$q(Y$;lZ)RJ7s}SV3_GI188>0UJ zmk|bAdd+V$MWSd_Ej<4nn})BJd4)i{QQYH3uQA&Q9 z049kVSW_ER%tY%PY~d(|$MG?ZTKb#FgoYZvQ~Z}aElWeb#@Ua&5$`P$yB7}jqC=m; z_r3m}#(L1m0|UqE%1RT{!f0rZlyL8(E&qqFH;;#UegDUgNkuBfNu*E>Dng{On^J0` zwAj}vTZyrSY%?ZpPDPCnvPCL{BKuY;*(E!JFqGX`24iNv_iGk)&inKGoj=Y)%)DOr za^2VRysqnck0jvJ2<>dQS|VGW>*W9O-b)njP;1ZUJJqme)q@((qujLlja)bmWhDGu z+@?dHuK0QA5++VQJTzmM*9Y%52|p_kdo1xY?ATsp;vfuFP^YZW{?YyK!aKv}YM6u* z7|{slghTLDjROGXG(j`=`{!TJX0*KVvhcp}O&C9V4QFi;J7?Y}yl)L~5RmHJ$N%&y zq1DZ`LEiEdI`y2kWMXN!d6&8+StTsRpO@mP6%w;*YA#5ie(etqlv3SmpPjkC7PSNQ z9POnMvKzG^Fq@{>#w)9bEC&`zPon*!(}2B~Y+>YZjQJazFMeMxw7X_bFoE@_VHE&` z#2k6Xy%OyBET<5Yv;_05&nR0MnScK}VJt@8=@uj!3WY(MEdLT39aHV#U+_M&G;Ew0 zlMY!3KEF%NyR&~(KhiPYt(@`XyQ884QyVeGZCpPw=ILYOn5R!4S609u+64ql4npyj z{<^V)U_;OsD`5CgUj3Ns<>O>gkNbDFQ{8zfB8+}h@QG|;JniMU zmHtV;==(^Fu9&k*R?d>F@~X>X`Yb3OI(w(Na$e<;b2t3MIc*^6l^pu)(?*JaEm-Y^ z(`8KniAh#7S#>!T#PLp-b^TBtx?)jQilIffD&XB=dV4Gv3g#jAcH35kx=6kU#n!_+ zitCQo6^;3yy*uXr_upUv^yMG5H;y_Mm$VJfW0%`@vLz{3AE^Rn{PbavnW5w0D+pI% z?OGdOoyHHX%h3Rt0h2E>AiBNPWqWB73I=$%L(0a5$CVF0%-bInS8+q@wWIdD4)p=B z9`t?m+O->f#bBr+@m5SGrS??i&ZwW|d3i^i3LxhKi5A7L+(`q9 zP4-4n&TMG)DnmJbG6fb2=(k4iLCkgY&%zHm5gKry9{$_5;6;E=NjUUVHs(7gkpawU z^x8xA*>CI{ZauyA$mt_a;3WLVruf}VH@Zm@Pppi&7Lb|j!oKc`4X+>t_7Nud}iu6Xr5Y1wPw*(pZRciv5%~=X=2Qi z$G09lvA^{Myt$k(k-n$aQoFFOVV>!ps&Dz~mFxFr3USegIN>TfQ!qH%V~7~-2XW*1 z*cM24Rs0Q3CkU(ici#_qBR<}~>StG+<`dRfJ)6)E<4E8NZ*JQ8PM<4~t@gh2z<2Mp zpMGi&w{MXgczAlt&YkI`6C1|O>>Qc+7hVJ;QP8Qs?1|{8vh{jj5CvLG@0jO4@xVFS z#)$UiqDJ%9L006?eA$)EpvQl%I9eHUhQ9bJ)}(F_-p>38NT?L0Jb*jMdi?Z4(FLZ3 zeAmq}Q{*5yVm(HED>v$A;}h2?oQ9yiz-+7i6aP7|x$i0OmMf2u)+W%BZ?bL~3%tMY zHYbw;POLTZ;GdJ$q|FtJe6#O0WT_GNbj^5Bgd zMSn)haWIfw=4{4b~!?8$xiCtfL|xyafdhN&S%L3eLXJ2E%Z9!OH>)vnpX1 zd~B`C6Go|_*wT}*IKeFnAfg!ZG!mFvADb|8jgHp-jk-fGO5B5v;JiL@9%OASaR00Y zVE}$&?f6k9aR2E1!|RsMExr2UGE4-uMg_Qhnlo)#W5mCKdA0i?I$XRi=p+Ik-Zct2 zKWk(?J3t)gSg59K^I(zG-MB(e#xb)|avlHSyfN5b1d5d?o52dm^PoZjC} z0Iz3l!8T}0?mN~pHTJAvlOo=m*U%BEfBnAxgREFzge^123g)}STeo+{qlbDItnkv> zWZ*+f390zihj{#4v=^Lmt!n+dV1-puA{s&XvJPac|L{l} z3g$8hL)6<|naQ0z`rl3~|I$L3KP*1v^iS%@ zFPXEyUUS1P&dQy>q>zLZICNp1k2peaq8}SB*Dg67JK=pnlgiX}cp|Utpjw~!48TBe z-vCaeC!i2ZBlJi0xOhcUH%bF<)cMj@0roy~jt~bk`wJhkR`C;UW;Rnc>RF(B_2363 zhlC()kPCu$@MB+lf*PEVHF+HLDNz$vADW_88|a{=e|6#2L$)EkaKHa+J5LVCbJSkVYDn``m#-o|UsAh1XDCmMz&db4Xnz)ABI zdUZG<+V$eP^eV~5O_PXf53esPPB$5FmyWxvgV+&`oG*&KRU7v{cm9>Ti&3A2v!?kb zXrgr&C9*yNXLQK3x1fFUL*PMBJuSQ{gRCD`!+5^!rsqD=inohB-Mp$szwot44%Q#o zYFq66C9KYveMVlx1~X?sjDBWUo;z6kL?w{hnG{?EHxiH&x0wDDbawUo&~|TIC%$@* z05~`79H-S5(^DSxb4t)LW$_ATAO z`E4hz=9k5&AxBbqWNi{LQeEy!?PnDSoCHoPf3qbV8UHT9r2{EAe1zcB_V@X~kG*AP zVIgYyo|!?_6H=(95e$MRc{2bi_kX`pT?l$(=*fZAf(`r&9>Z`lK|e|{{llq>*oYMG zJ&DjLD#+Ylh)+y>1pCOkX%MEiF`KpD@oz02q(cjEM>n7kpvzU@MY&=*gXe5I5Vq{A;FYo7x)0c=1u}|7 z@CRn~9yVu&ZI0b2f+Nu)ux0T7*RY&2dZ@omc3D|ji|I(`5>QA_fJU6~dVHLkK`~x| zR`wsBA-{7JUxQ}aKhKb#fGz$vD$P<(~{CUTkKoc2xGB{#oCZ|fhoYS54)Az75%xe4B zhv!?{#{$mk{VIC62u&8GYWMthI9Q%RmwfgE9?2eg9jgS+I;`8!QtzjNIns^NQ32>z zN^uvI&Ii<1()c!>j5lxIO9|njr`5x}5-4>ZeZxv}MNetYn#}L zJihQI;d&sV>TK6tnwo^$yETV4fFzaf2H}<~_#)AH-6FIKEpQK#vD6?dYA5r4S~QUyYweH)e)*m&17`yirjQ&BXq0=%SDS^;8vZB<{fB2kZ`eSM?&*0%5;@VR+9@U-ODK*3E__#B-zbgK=T!CNH?mGW_xf4IY z?yLsP;Me$nDl`PfWvrfnIt%fhe6PHey61)y9cuW@4fj~t;f$ML>YtTBnVgYu(IGan zq$D8hGtoHyRcSQ!eLc?uq#*Z7v9n;qF{P?Uu^D4p6jYJx@RH(z)j1Du5EfZo0WKJE z3sfCiR#}}O+hBXz;r!^j7yEcKQi6^$^*P=g54TA%L|~kq4b!E}wZS<&PVHppkgwdS zD7c0t`rmSR(6#RiPY0yo4#En3)0Si6%g;u>vv=IaUTElj88?GCLxz5lv} zwYhF_%3FaR(t};*B#*#T`M_x{uJGIkrY^KUQ65Z6e=jIhqSMXJk^^ypF;zvC_j3_v zL_2*fo2~O?SPO;p1UAqzs1y<6O)YJVdIvI|oQfu<7(u#_ zvy~N2P(j9wJK{(9KGYqy{j=b_L!?Se}PL0bZr6hH&a0<9VG(&5U;BBCJ(0v^WO zGIjcH7|84(jrzgOKk}`1OYp|}1HZIfjHtQn70M{9@J6)S3k|h~T>vH~1BCmHdJ+lZ zlEg+m69^Cay=4k%mybiAVD4q&Zh#tPZI%onf0rV*OIpE2iXppPkNdk61gERxab^8s#I%Cs2eFyObQ8x3Cgy#=HFMU0!^=|oS2>LP@ z4Fv>ZA>CJNLx0zaSib9t>;T09NGi9(*7L+o?dv!1+((#nOiJIx-UgQTl*snyI>=tN z+O5D5+UZluR0)v2@c#fqJxKr~vT8m71|_tUFbS6Ly&AH(LWE-~0yn5C}IW>Qo^FKtNpK z*~OLo+fI(#LjTu20X1CQYLW^XFU(#Zo6^q~m{j*nTg#44uUkpv{2h8a=9OMimY?KR z?HA?=DfgYMh((nT)V4uU(UtfL9DM}0dDH2Sv@IvEndJG)KcZ}Xv&k9_t!Osr!=>p4 zVtd}@{1dT#3wwK6LI?iL3HK@{L3A+H&bgVo<%H zDs)CrLSZky&YJ#@Ny+n`DJ(_Cz_;dNO?5cEfcW5w#dm$>A7w?oG03%wZ;=E!>E2GJ zcha;2AArrUUPJD5B{YVngr&JL&o-6rEx!zx&VCZLXopJ|b7a7Y#fd#7?N5?FScf1uRi;44;sm!AFq=6K`AtuR+&r)u{I^HIQ#^FG(y} zc%Nl8aOFDjIKDApSV`woQS}*&VlL)I90+tsAZDA`Xl}@DF6TBEBS>nRsWlgSF+F@x zVKm29U}}VzzrcG~r(z##O;!~bM?|{;YTMWQRgAM{ZM+ZkinQJOD>`nB3CIzgA1f{( zMMtEwDp!S{T^nbDz|4H(anGo!lyi;7_dc~$?54er= ze`{x4eJY>FMjDSg97^7n&lrD?UF zx7%3u&ZQzE!mxA6_6no?*y&)>wyYZ`3cHDu#=Y~IKASM_dbZ%p8PsyuucsolAMgkM z)FIi+`08oIPHK*xCw<_@x)rvUP8wl+io54Aa@Cup z3JZsFzn>i=+7U*Uu368ISo1WW3Q9P_g?g>5^EF&t%iGtT8CzELRO~ zo~f;iKYTx@CFID$^*yJLvh-pqFWmidR|*wwo?>W=`gr2>``%@z4RCj@5VCy0558K_ zzQr%(D%?sH3EWF2*%~uvGZ-6C- zcaMK7t4~;}bF88EG3ex?_R>uF`Ekeq$>Zr~eTpvn*4c`Er>1X2W#h(e#Vz8&&4*D@ zB}0;uyo*cM{sOo2?khy?F5kPKHZ-R(EU#+m_F*mQwL#$M>14^s4}W3&zQ=CPG{+LWR!1(Tk(nc`Y&8qCf8S!FbAap$ZS6E8_LmdNS+?U;U0 zx+6G!jX&m{2Pg|d(--jkzgt;*;66BtVg{?%2`<-)$r;qiuI3)y!g?rO~?k!Heh0ZV-hDlW=NaWZAM zox=)>;xdJ;zdt@G&bTqVPWjVTk}oBmQu5N$qgs;mI4r=faB$a@DF)mdA5{z_k+e1J z#_{U0Hc?Ow@qN_E1xq@48YCE)T*)vv?;dJz@rN^5hq z(hQP&xY%WyRkl3pK_05U7S%P&cnQ=CIi|fN^%=M+j%1u)WK=k!Ib{~VG9(?#xc!iR zHN|+wc0YNrbjH>1duEq9xRlnvad5pxKUZlvd3sixF-rn>d&-s5y34IL?@}`a@-Y%I zqRm(;C6Gq6D21AzG$zvqCB;DjVYM{+12HT%`UZ#tJ|ur*Hu*vAeV*t{NsxC~?s&*_ zmt*##;s1Lex`cj!HR@gm7h^9VGKxDDq%kjeosJ495*T}kIlOFp%;6ob)}r@<^}@TT z2)I2ohb7a<*q$M&QtlzRCphaA@#3t9v)dMjq_sO^iL}a)HwcvWOo)MO*p14)e$_*` z>GimCp<TC6*`Au-QvX`3NslNG zuo?M27f+EYdN=JY6!~%0z~9{WqhS0wG2lE#Qi)So(t7aR+D^v=t4Z(t;t1%lfaNLf zqfM5IZu1C6y?el`jC+*A~?z~k)f{9u#R6yKLgG&2miezw0(sd1c` zXm)@h`K#=LJu69)0a}sRvE}NjO>FP*x|OVS)ti{RZq?F)N~mftuN)z%nIkz?{9g?7 z`})0W)Avt5>|1n14fJ97VU}L?|!@_ zpOV2{wMsyF?&7}zyhL>^@2%^hWPvjRbqm*$EM_EEzCtF`Ddpuuy1-rNUrPcvCN4)- zzFpaNx6VyF@5613rKMxSVx{yQwQ%UzL`T34y`@a?&?G7hVM}$Uni2`y^NSy+`#oTl zbRrYaB3Uh=9M=Z8S;z66Qay-6$81-fzo+IBynlOD&!L_R>lZ~mKqya~-Z_23X6{63 zbjkYlv7IHZKvVG>zjs&yQmb7HDLoHBr9}>7EQXN)PmWT^1Y|}1CsONW8&kgR-+|g0 zT}X?Y3K;qO_@MbkxYct8xsEft(7NsxWbRacW1^9npkOU6g=Eiu2X^ z^z!BOT1dA%AJ3h*Yn(PRDpO9D$=A(F z-3A+U*lTTJaqYx|o6tn@OFTpCzBttuW)3OYzVBrRxF7)jA76Wp+dR&#?|u_A7-xQU z7jK=~FYAHNp=UoeZ(i=o0*AWn<(UE+A~4?n{xbOOYNg)rqfrsJ#?9 zlmczRm9anu$Ewh7ywf#?FvDn=S~L!>xlYy_px>VNM!PA&Vf z$#q}ff=i$AWWb1e6y(^%R#mP{fshB$E^XFP?BnYDRY&YX{CtLEM1BeBAgOdJ(AD+G zA`~0QQx_&;Q$l*Ra1mbyN*lbX$TBRxdV( z{`hSlIDTWwvE?<>1y!1vlqeAo45+^DRv4&q)S8V>I%q?dv{B40i;Y;(8d44Hw2z9= z7>QrVeHpR6^ydlEd=@TnsT*iI;^9(X=Z4lPTJIF_oo>`zjK2V>K9BH9=wuV<2%l%@ zq~)ISnTM_#AI{ejPfUI1b4KvF_paCPOWO+_$V3?!2 z_qISOYKQ%xs2DoWO}<>>TxyKJ|6;n9wIIGOSMk?m!;aj>XCo;7R4 z7c0n%Rod8r6l&dBM*n*4f*!~N1y_C>FMSYS`Oy1dp5~n%CUQ;SN4TjqaRJ&S61eSr zzsMLG=I>QL>PL72-E>UmE1%{g{rr~PT2FfD8eq%xF|B9*F>&r}%Q|&=EK=xwQ}sFmfK5)l_g#5 zp5+&OK3Eg4>7PkdTVfRc_`z#%<5=ORU6bdUjpx4#lS=5*{0ukOy4HzetHy`B<*_sO z{ZR|J<(D{c*gkoOEYP&l5x460RBMbVHNL1TNf^0~`Rl9aB(R>C#wBSSS(>TNd#CDv zD7!{MUmWFk9H@fg1UU+jm>QtUDP&J=iYLno^I1>dBtwUt^b&lyHgM82p?B(XyoqX6 zxALwevKZNHz-f`T|vemHMNR#sF|$};@IP8GMr zs8a_IxhmEg^`>j@^(DB68`6MdS5orpjOzhZ=GhB@4)+Z9%x^QXJg>F#gFkGevQnlr zmr72SiO({$sqa8AZ$@j5D$CWNb~g4}W?7v2=u3!F3SNrsTNzHWqR-nfysiM#Z&5yP zQEEqrzov|hisjHCKV16sMqHJ8?>D_U1G1-;MX(p-WV$-cekh`oYi;Oc^2hCE*@)tm z`!*{BWN?*ndHL&w8F9vp_+5tqTz7YGo@y`j5(}(Pcz`wHA`L{Llqh*xv;3P0+vb|O zEeWD>)?`AIv;S8}14LB;-=}*rKYSNqA8yQ|&u>&`b~}Hn)|EQ0Dc?r_8cp#35W4v> ztRr?1flY=V(#9@nihjTD`W@2#Q75&?k4Z`VfmcEtvpg!pG@@opYHUQmPK_6s=1ifL z5XGJK>r4)2r66gEp1ZR8F8JXlY+Ld&TLC^kb?z(Gpwr^QodZyj#Wx&6)I)=3ZvHhrFjG4)qdj`$= z0%J;^G#B7^z4Mvs_2~5-iGZ(nY$IPyzCkJO)BLs@Qotxhe_})QrWI-IfOO4wprj7Q zf*mP;k4X3N(s9_@xUs)=nMS2h2A1B*Q{N?>DLmRQ&mha+9Zi$T@+XeftPz_IN~)xc zYPHVSY0<$E$TYX=U2eC-k#;IyG#Ab-gSKq18LD?I!9l;! z9bPVv%1f}*U2^J1-D^CvAF`cku}9ixpA|zV*_ztbj%hnn^r)|M#p~|*^5E86)X}NR z6k11CCoC9&XnlA%YnRu&(rb&ix|`$O&#Hn3(B4i+W?iGaJ*~C9XFQ(MY{IVhAKH*o7i2n*+vr8K3*a7sOJWXC#(pc+l*T> z{;626HH}Y7lH&D=sa$ql`Qj>@4-8FB;FNzKIdQ$_tDZqI%D!l;QcFf31v^EtF2DZi z(?iVl@!p@azh9O#M)V)z^h>p=qvJmzUGCezM%;8cr%bv~%bj0r zvDyIZ;pR0;vRS-sv#+(2rW8)^?xQdC%F+tm2O8<)ji)iUgq>FwX9k1Q^{g5;(t_7~ zwJ{L3Ot`)T#mXX4b(Jsdxt{16WNYXCU&`& zg9Wfq$#G*)9EVxE%K%M>`LRC#aI2}f()U1t13Q$?t?7J^wAw={&3V>W*8+f=8 zp3W{VHR8(bBA3Bs#V_pw-A3w)61Z330sy!`i1iq1(PzSRm z$qz=IfDNq{);h!xU67OH{V^k!QA>vNHX}-Zoyi$p+lorMQS zF?Nf0To>=uFGCKJJfeK59?_noP;;a^(rQ3`Lf9kcQ!GH9x;~YS_?NvL@=`1pgrKF` zPXIDt#*aht`!qo4)Z>v;y_=d}@B zn?Q04Z4Yr^c-k%$Tx+OVcdh^Tc6&?rU-=`bHa-V-ctiYQ9jRD&5Ft-pH#sst(P7bf1O5{q;UTztJbjzya~h zPRoBLQZ7CnwEoF#gSu<2?0o0$oPG$H$BO7rpA9Ux^R9;rQ`%>rioyuo@g!{ZgRxe# z>GYg;6iVQrXkUTkFKy~@D*pRf^*7}fQ-?x^%jfjUTP#8?2s7nFdSxm3y^Qld;W`@B z?({HJNvPg?tq`DjNBuAu;f!=CFMf<@{tBd^=LScoqUg2?!Zw8Va2|T7Pf0R(-i$>V z$-*z}%;NbovW@k-zK6ZrW>pGk&~E4V)J;d& zEJXwt&qapo<46%EkyFc=Q=@PA>0h5t`n4BF0&vhvvV47T_q&y`a{8EWhit3JBqTmJ zJYzv$UyCOHy1f=QHsY4=d#-YQfHuej-*YAAg619+rB!Y0_xA7{Mpb~iUG~`oxx(XM zf8eJVb|VuDVY)LxE;jP`mvi$OM`L1^dw}p_J_2laZ&M|$@c=D5% zPoR*k)NTke`I3SBlTYk^7F8yV&jN5%jXzeBDyDY*)q|KzbjXLPH8Qa>q7S>$Qz1+* zwrYO6;-^5IY8c8Aw7eV>=m6jgPN~>szyHE`=LM5DuNq_%DwjsJ!ZW0QF(7-;lsQud z0wwEs5NSneuYA&$%?cpN_-Cq~wC^tmh^@D+YngC|*Y5kRBW}tw0feLDojEUifZY}A z@?y|wBnUfr9m79yed2U{d7Hv3FCA5HS%00Kx;kfSvPx?eRZPylaN7GYCQsLY>f!8!6qy z@z%wPjgLV4B=56v%SsrlYHX8$!XKrcn?R{&Uz4D%DS&fRgP@u`kTO*Vh|9YZQ4frj z+kj!hiR|zbsK${@urHV%K$N8i%6HJ$2Nud8qnEV`BkVdu7qe7~tb(H)zEHI-4=v&dWux|%3?)Q_5t{SJI zrdm5G>%09v%UGZHSo0B0JY3s4M21eFnExV#JVo@}J5T&|Lf-HE`?P#IuuTPa!*dDC zuM-Yv&njtORBwaSOKD&%IoXK}iNE>|bLC4kfKC}qWvS~oo6kaJs#r&DF79N}116=+t5;8Tdfi8|hIlsCD8Qv39Bm zw~`f-ygY!8`c$eX`MO7-!0+zzG6*8Ia*O0uVYi6$8a-%7-hp>2WCG6*Yia}fs4JRz#Md7`Nb|2TWY?X$?Tp{ z&hkB@>OF4i`dz(uCY0QcqqUckR&Fq;eF=B#38G59v`L>RY0Y0KQY1h_90GB>N5&yf zpa#O*n=8$7(;HvLHMk{|uWJfZ4O4aWeU@S;MFqm_t5Xa>;QU?YS@G1-hdXrC+cQe0 zZ_D>wP@f#W3#CIW7EIn2!3GJt#t3^&5Eu4JBl|%UV&uKVu}r>}K&`qnHh@dO>g87L ze>u-^368b^br7M}vy(|5;4@nGuRNk;5M891&8$c$eLuPdREZj*n^UNOcdRbg=3)KG z{=FddKlcgs<*Wd`4}hzY026uw9G`Mo+=3&{7|M62lq`M*urk2U%(38idGMn&ET!0n znf02yQKi0618PBQlEvm<0S&M50^p4D`*4eQai#=r?UtkVBuKfO4)q^V?=$Q4_~b+g zo$^eeK7n#L2*a}lPejTuTIK41OU@l_hGP<|*9a+yc~RKK`%ADC4#6+n-W;W{WX>)$&Y-|P88 zuAw=Ik;Y4DEuYK&zPoJxjceS`rm(NrS2SJ|;PJaanQ5qO%t8Y!dM-$nV4h~_p4<0mpdoGICwdg#WwW1y+$KlR9J&w|Qt zj<~koeMV^pL2coTOb8`iEMW%nqL^n4GUI>HQvA%V0M)5=nsm|nqPwHxs3i|+`!?DY zR@F-`3MmVCqo7hp7lH>t=0evN*I3(A19RvAR1DpQF@}pM?jgyMKsv&t5X#RgUR;8p z*eE78ba(TvQAuL}4lvwNgaC&}jOn}DmKQwAY-pn<6v9OKb;d>Q`HQ6@P3ybGEwSyz zy+#1_!(O=}HUD9vl_ah4gO`<#s{gC?_|SOl@c}4oZ5VJ^3f5i>t|!G3#~ny>-wouo zr`KqoD+4y9G+<^sZe}>ooiF-FSqx7cO}^;obC0{~JxSYLFB=GWjb0=q(nAaap2Huj zhtQ%`wGfJS7N?gp8;TNQMX&&c%tz=k!V^}8$NbG7SHIPBxU3@>@aVf>XxSu$cO3|89Wb+*FgmUjYoZ-WUG`D7;h3B z;VZT|(}28Pa2+MT#}Z#6^-$C*b8s-PTQ{h}X~UvV=Wtwp=7W9h5haXQUt&|J9L|MR z>1aB_HN$rGCIkz?%+I z%o%ZwPJaPG@XtRy&!G1)#_9hkgpVLBI(v-4SV>@bUa>F+V$(j4S$FE= ziVO&w4L3!U`cpQ)k^Z29Shvw=63r|pnm7+2BwSzYH|?A`>5yfR-ubLKp zLJjquQbsA&!`Ph~2rN&6OeF1duPxzixE*7!HhC|EZ~khX$ANf%MVEzl$9DIm+O+!X zH+vJP{xW;9hK>bUQUk+_bFp;lnaY`KWy9B&(_dgxmmycv-bgTa48!xaerqh3LBVvg z_Hwetg8s1pjB)iQfha3)vuc|=H=q=3gZfknIj(Ohjs$GXLZmGr5kStGE_#9S>NX4Z zHb)E-$}=AIg=ANjMZAby%Y_{aXNA5GAg)yg;e_=#}5RIje`8`9mEN;&BrB4r(#? zuQqr8N#~?4=w{f>4WCzLJaBNBG7D9#{t%5)uO5k>SOJ-ZxpTA8k2RHw9i?bVo7yw& z@~H5&(uL~P3rzhCaHsW_#r9(i5efvex^_M?n@^8`@S++>kvh#s&cj6=%OOBsGUpfW zr;d16k2LSk!fN=8i}57-2h$Tfk7_F$vzjU@)N=X(r7daEjY{`d`myf9&Yo@-I8`Mo zC2IDmSu<{O1e-ZDd>ig0?b=25@|2(g#)RPKE;;0uJRWivHt+yXlkD?*2qWQ zec*VtjqD8|MkeH_-Q*JN_t;)T;+y<Y)U zCLZ}BDFyARX(m#O+A2u|b(HX4*IjY{7sV6{Y)s#;0BBTNQxu%ov2q1B%)2uJY4z@N z=8o&rmfU4y#bwvhyu;n%Z!JNoG0B`N>2C-nOgV@-_CsOMcNqv}s!6w=PxFA1=Tl4Z zQ=QHXt0_N|rI3Whkox%#w;|U^vRVZ-KG`nasgi?z88+9QH3jktzz3AaXi3G_9Vs_+ zr+o|-U+E_hqGuV6j3sT!DybQboFRZtGCZJ+MMrF)22}&p_sGlpR_oO?GFBRGaC2V# zs69nMY2LY9gsHXDhQ<;JG85uGJxgB@W$vivIgnp1HA56U0tbsuj*0?c$(0;6-rnHU z&POU_l{7<2BQ{z@Q|WnCUW`J53a)=WR-$-Q#Isoluh8)VBU?`+w1<)a zuh?zZ)($DzOiZt3Bepem*AYah+1IJ70<>9^EoU|7Te>u7ch=U!gGFc64*{l$K&WP8 zg6}l5XtIe1Z)r=mey8@dq%o^a8AA;EBX(xGwyO+&`uik)V2|yCx>cCgIc8r|<)P@; z*&&YhMTaCi)s@g;Y6o&!wTE`|?{5TB%fu0_kI`xYF3`JidIa3+S6HPv`ArYmsNd;@ znhBo34($~eu_Riaedpm|&bTSRc(cCf!|l1p$Cm(PZ2h9|q*#Kf(yULYKU5T>_z4@i zz7{&Ogp?TwH)PsVP)|gxX8-iB^Kl`5Am1#B z;7%c8byQE%NJUjl;Hoew31jhIu6juX{MkP(*3Y(noZ;nO2K>iKn(|F3OE*C*a07)J zFEs$-Hf1KsRo>O%s7>v3YCYEODYjl+Uw?^@FW4(wZba(w3Ko7|6BmM>?lJ8Cx>WD^ z10=Jc3WrHe{&Z@~8wOO0S^ZFUJ-?W2p?fkWp+z!u#hRJQT+*!fd_6gQbG#b>Txft8 z^UooCos%k}9pgJczPiO^ra2?VW9+mR6Uw>Ss_H^m1n5l1VS9YKVdo?UEtmKzxBFCF+su{Rji)lVfEVlfgH7 z8x6=K%yjew;igi9qvn`d=`99Cqd`$ou~_M^Ahg5}Ev(o4c{I57;z8*U`gZJ(?Yd%u z_r6s|dS&Om z#7qtHPD2%0s^z|N0Tb=miIzZ8$%q4CrEFL=Y9Z&@0(2DwB_4;HH^H@1YX$QQ>s_QU z+KAjC9}UEv6phjIVKIxQ>Y4G#d8zo;`xW<~AQ4ak__~^d+B~z#S*_Q<1`%cETuf?} zRaXZ%!W?#*HK6@xy~1xYvN~&KUG;v{;rPI@LGxS}1T5N23)O@utUgl%Rg3^IP9p_z zjfN3?lx|z2zZ|U8=(q&I7pU^qK%e6H=s_l^l0t(YGibJUkiu205j#gXOoOrkn!%{h zS}jD;w}*bbm6I(>{j?_=I=@p96}?tq*QtqN0Yrze(>BeG<({94m%Kw752 zqd|4#2~#_P${QX45cf=o;}2_(=j&}^eOnX%P(XeSPIFU z6lNslQ}jJf>NH@ez9B$w)THzXyRhh6NpMgZ9XF4&&^+ka=W@E2n29t{mM14;l6H671+-RLwPeMY-_ zo>@!$sJ9o%zty7UBSP(DenY;k}f zdSD>7Qx7-nh)uP#Aaun#Uv}m$+5_5V+9J;R>~tiIhdYCg3aITzV9KZGDTJ#ux#N3& z8i5l-2|<-isf11Q)}29qTHR9C53C~tGToqYvdI3yVbUKN$h$N=bqH1iYpqf9xzBCR&W9rVIC4e57UHRsPRHZRR?^MR+&B6tphi z2cB%#9yibnPXeS3qY+ASnt(sS;;b{@;8*4SA(Yl8wvaGmng?6Xu{+W@%0^8t8xYpy z^Xvp9g9p8eUz_@Y%;35y(|^Aa379P&cof2-k1j&JGA34Dtsd*2`+zo~J#KTOf;u$7 zW8B$Pv<-Gf;Hz?)T6~>b`P;YW-{f)nXo7-v|7-RC!k>V;asZ4En2Ry%qYyGag^*`n z7yl$WTrs@)A6n;tl?R|S#kUHo6#D5Lx%|g?yk(jS2bKKYPLII0E8s&n7&6Y}74@DM zx`Z&4Xn$D*igzF`*gKoMv)Ko$b&CR2P|KMzXxq4lbjXFcbtENgb2j^fFfSOj0H_S* zKp}DNeb3=@pqT^^ztXLkMJTJ^v|S6G2(XYuAyXS0c~nW(0r;=7-#0{L7r}J@lv}`{ zcR&GjwvQ&rG>oJ6r*E+9SpySd$_H~dSjT?Vla)Q1h>4^!m+tMYZ$H@$hZ0R(T>oCY zib{yBFrmOvU7+Jd(5L^e=N0XKBr-Whm{h6_6qqVbV%8KxZ$$d6J^tq?@lp`+6uI+I zo{@lp@xRsycmPbEX!JLj^mbwrJ#s&gIcvfVn_W7DNl;kK5_M7TlGdxA%>LHVTYKwI zHH3$nKXrB*^W>gD?p$3&)(@=W?lmxfwJph8?m{%0AR_}#oetHErBGb9OdG%4n7msU=X^bB^L z)s>rntU8fLC35wjfMN&Sk$?lO8WzG7z|Wu;w*fp@mPsJ>TWX-SV>&w(qZ^=NBY3aL z-c$cY;E6(8G&wp3NI4In8^Uf4Zd(t2XZ{;2=DeA`yr&_ptMrKmwC3hrlM*0n%K6yj-`iVwQSd))w8S^wKZID9Qp_ut)aGLqADZ@XB{7GOUk6Bl zTq{rt+{~FH6N#|roaSrJ{Jf!#+^IyZ|;(9Tdpum398dz)Pry}mpn-zE-BOTWQqLcibw|pf;sKQTr z08Sh^FCvhwcoMJa>1^@usxTya16MKAEuM!tTKXBQGMgN2@A`+en>3Ce{Yb0Zr_78T znF3iF#H=1=Nfcn7g7{1}D*J-oX`L}+9;ns2IS_NWyQ9ODl&z-V{cq(7ww~ix?>!gS zs-;AHS?6&W=u?D$v#dc_9%tp#B_F}>w(fAZ&oyRgIX-U7Fbg+<+eknfvxMkkQw9tW zs)8LiO7~B_^Svu*nuer1>7Dl45>4t=&Q7}=m=eTnmuDYPX!%(R1l-sFrHZ1zXj5-d zFH$ydY8ppDijuuSaRRUOZvOncLN3^g)d$fL5@h!&?v?5tK-NRJ(bw?xc&itrGHeMc zRKT)le5T?CXFoXd&$KG|R*1^$15ib=iR$F21|sn@THULRYtR>1 zL_$E7ybdZ?QF{G^Nlt@~;PwdAdmX9@Y3DL?SI~rRv`qoSk|k(_yMRDGR=ExO`S4KG z86yul2*Y<>pngi0&bzfYwZS%qBdM78w9PHqca4Pc+Dz^vWLETMon7oIU$wP$K~XdABqei71SE!iv=nA-#t z@j+Xwb1@tf;5Zf$(Ai&CJjKJ^Hl&h1u4dg*;-ruJ~8;*zQJUkLEiK)0r z@Uv?poAkMoIg7)V!-v~JJ$mfL>x%2yE%9KN1G#tu19_SCcuiXP;gg0@&V4KA5&pMM zW@&vJ=i0&Sh}r^0U_ySqXh6dndjqwg)uv2`LK4F-L}%;sv*7u-FKp zA>)tm-eY!maUN|2RnD|3_0<=gV22#CC}cC>iSlB0hQ)0K>=!@vGX%MvwnL-+S%AcF zM_uomk;YH6!~!qJbB}rT4(Ew{P}#qN)2^+rHn2%7CjNe<=kzMpJwNW-eHPo~VLfzU zV5!-f(V;8cXF%=A$t>0Lpe>=?S#?d53|^9NXa~4IY*fKR=LTq`{9QQ#IIUFvpd!cH zgE)*dSLk!_2X?YjO(J^_><+81*a80N)}1FGh6#0#esgs{jYAUaUAzz<>N8Ise3KD` z_c;c{cEra0JW3UGC{Dc<#Pbo5C(teLrvaZvgyx&yO6W>-kQ;M;VC$t{YJKE_mVy9c zV7WM#w*r7ZMF*m109O#SNW${uPj6*zKZu7xTa;|sMNNUHkAob9_CAW9-2Oe>n&+^d z1R_|k$hA%N&}t3@kJ)gKIW^;>=*9yZn}xyZo|6GVUnvQcHz4xo+Zt6IJp+aKfF^H@ zLPV?nf=KeCQTxYogkK$j_Wn4R71Kp~0`ubC6#YZXz9w~??ZPFNUsOCeyaN zVfPO@@dbl)hHg2NWE)lQSJwr+7-ZGjTMz&;%m!L)FH2EY`WtM6EcA=@G`xG z@3|-S3plume;S8u6|U8`6`qz2AUY_^+s=Yi(MMrLpd3&Y%7aLvHnnb*Jan!((C9Nu zN}pOww6~l;NmA2riuD5rCif_EBX{byukYVZDmh`$deM2B;2IOQg1c_iZ)dV*I|9&F z{d~eUIZb~9|MiTj;1?#Fkjvj&1n~`g4`Plg@ZKa$sx#*PVt%(6aByBX^yq&zHYHcY zBm&`iusz%B1h=l$UjCgb*?YDMuM%xkkk>BA;&^m{_x_H1j(Ms9xq>MmSGa3X)&w2m z#A~nt$?O~WIx&?4Nk^M$1C4i?wO@(5V5q!C@S?-fAADMl%tI=sX)V{GPyu0zh*2|b zpEC1T?Ad_7{noic0Mf!f?pkK6V9b{677@HV3WpNXzwqgmh@W~e97ONnd4R+&GrABP z+7;OH5R<&XCYv3WYs%hC7EuPk$R*N_*nbNpbEWhp&`gCS(c}RZ?4b6Ck8Jl@N-(=U zU@hc{Ki&mT0@c{jZ+wQ%9%1Wg$@UscrKZ8O5wgav0M+N&&O zvMkaWg~a!H^nLG{&r9@&4QeG1d;Wr*xc+Ad4vm9NfFRKXgXW_Wa*QJ-fSdWq8^~vp?!f=Y*LTNL{f7M`il{g$AtMe-R(9rzB70`9B1FjEwpz(d4=l4&qqt`i~&podD8t?16uXh-Mg5Xk7SpCO=U)hJ=8-O#)c^QAQ zqZ+N1rYI@_+GI&KR!UIFwg=7rH@xiX!)*sQ_GXib9J_Dz_H2bUtFm`FpJoV{E9Q80a+u|RPFWd#3oX*!YM|0zJRBSCqEJcSL*`5G` ztrn)-#qejL@DDmFOarLHwTpBn23`JAU)w#&h2V2hv;K=P*13U#NhGyz_zbUb3-HV|>!9 z?l97Dw;V!sykjgNp|Q;)p=)fpfB>ffa|G>iq()_$K}O_#ymG0hu5NBZl)i`a2&4Vs zO4dc-l;`$Qg)Q1)n7km`iNDt$><|=;0D@2Wup@fcKmKTx`F5ZgBj{?b`t%e0gzVD? zupcU6UI}6KzVPuhBQ$)eKW!QZI(v0Ecs5J(Q9AxMy3+Id$?u29MB4K?Pgv!~mV3zC zzHvYD7QW(?*97gzzBb>OqqhKh6i|TN0azEVyaSVJ=pTbit4NYB4IFRSG8s`WM4*Hj zD(C?tWqEgEJRSE%j^tzgaCie41pF2qLC`f#z2{+5vJaCXi(AC9TK+cg#6!)K&a8^^ z*RxFXvuE45_cnA-1veL8MWsY6%ZeK(B;^{!lw>u1uWjk9@}d0Pk%*#{E*yz`U$Gg4pWSN zAI@7M$k+_aQVe^OA(YHAXmBB((w4$-UbzzR%=VA!An!TFe-USI_5>`y_BPZ@=HZYx zfkBxQL4=N>ti!j{G3c4?bYp8qhXk$RCqPHa_b;#vBUK<_z(g^G1sGUNdeT;Bs8tX91r?`SJIE(Wdjz|OqjOO>lmI~z|A2Iwi?woaqMz1EvXHzJN}R7F84hM{VXgYw9CVfKn~-ISzDj?YFlvJx)H`BjNnM zM2!JyNjSA;GQz`;NkQ3BO8x>*H?8#A`d4{_){^I=&3MsN68r$&b&KKRzgWn0#!Tb) zCiVv+!l=W*Sf15Kz!_4FZu)KQg{`MX?q3@E6>Z!7?tScRj3FTPt=qZ?94MZgok88| zKGo85xoPd$=cvQYHKc3V&@7B%)sR_4?rK}Kq-$&j3?{|{2gs&6m)@y?D_#k}u%&W` z7s8|e+kG3Hxfuw06e(n+8g{g7Cc9ZZO;X6j^P&#)5Ib7eLD~@9&+v&&nZ8)99mB`n zhN4PE*Mg<=bk#K9-GU)6D$VRw_V}O@&o<`gcQQFs2cg|BZB}Y-y4)~3STJ|A*XdpI zUVOy0=-tRdq$qi$3hHsn)n?uAj9`QNyjkjpHcg9-R_OSk9V)2KM^GO%NiNSMehA&` z*je=_IUW`?K7$)LQeQMxr6!i?q{E)gYA%Gu&EDhd;AgZDY}U?FWehZDLd)64Gd=PI z&OR`?s7UMDD1T@BWBQTzin<&!#6Z0bbAcTGI+NcP^_3vpy`uYfr0%PHbLmV`Gsz?U;8uh%x@p3C0D9}qj zRJ4V4{-zPbXwNo1;52-fD=z!rNgWO;IW-6%9xf9fG`L&)%J&29u~z=83p2)IXk7tW z!V76i#84OJe=GQ35`=;@ESEHLz&{2VW;zqU(*9C$F-Z8M1? z5No&rM~t;c(u`lE`7cyp5#*@)80yQ<5mVRP?4bR%8W7kekT3J`@~Uw&fBLi4PrSVt z{t{0Kuvat|hG2$S3a+!-GRizMP&O|XL4`_OEDX!3`;Q9{2Yjgb;}F z#D?lGQ~BHfK1>6F%L1USOw6>1-=;;Nw$ATgf)DAWipT!z+*2reee>`J^q@L^?4dtz zJDdRI4Aiw9Z8^#yZ25?8{>Uu=KN7>WJC4<&{lU}9^UV&UnD43v_Q8VX720I&?H*WG;d45l6Bq^!SoDQr3qZc`tJVqz$u$Hep2HPw&Yr}1zB1*&lw%`2!pCfrHXKKZ}c&DwcT2@DO? zGy|e7jg0v41F*z8KCwr&!j>K7(vP+a@Lccwt1p&72ZKSARCL5raM3BGF@AQ-RVb$d zG!0a5T;X!$c>P&1dmInUz9BVF6EXHPZSMn{*7kmz6EaWM;UJ~zt-S6Z7Zapoh*<-` z=PsXHfAx%wB+l8tu`C2Vz@^=jLMJ(|0??Pkp&zgq9_Hl?gNy&cVxUO{ctNdffn!bh zH$R*))fdpB22&Y9^b2tArPRK$KLm#C6buwL#V-B~!?imK7BQ<1tpbY{aG`^xD>@+3 z-h`#-qQ7!Mm{}eNG5IRUHp|*>!$vB;Za^P9wFC9vLe*kgC}G4E3T*#926Mg;Rwy;$ zu3H8fB`di&#Q!Fe&}&*`Ntd1f8~{_$A^I3^JNyaK`80-19I8-hD>Sz_hp+LEXn|)O z^%`dp2O65QXZ?3Oy3U8#1-}Dy;^-_O5u28e4gllasB+pKyC)5!3}%Bv)hgTJ;r#J z6`lE)R>K&9!(q=bfaqH9{otRTposrgCK)`(kgXmnQhrWxCJsaF_P`6K3;JA5=9;7} z8bXx+sC^6&lXwRxDs4N?zsM`R>K^0$v&|r72QFfyW77AxdmjxJTG`^+urXaLd}$C? zGgGW!c~R5u=96)RrqRG7eW;K!MzZ|#o57JK4aWuU#YqQBNmOvc`gVE=-wMj#xwn!j`+_zt>4?pgl2 z{I_T#KNHOT#XX9=Kzx+Q;Egl70eJv(zQ;twO4k^cckKxtv8WsK%<&Y3Is0 z*ulN4wk|Vfk##zFz?tHK##J-3G-K~lX~?y#qrSs1dq0;+YZ4qLjU#sF7D%aXUyT0i-6Q8x9{_JHd_ida#+i-T* zwTHIU;aCwn9-8}C1HI}n{S<)|*|0X-r|8?nHLs_FAaE0Z!0O`OBdCnW|9q3Vy0l*F zYDHvY)o4nt{>7Wr?$DX3GsFLtN3z$bBY09Km+4x0$-AjNo7!xNXIZ?`lOytAtsTT5 zn)^R7>oFu^OAJD9>DqayAvn9sq3jz%cXWVgxLHTD!y0)FCWrBC&aN_89QY3j3GmsP zpsE+{$P|8>2sY0B;9F4P&rk`XCixwX}PaJ3I`#Mx9U-@zZ!p& z0rhqlEiWzp!a_svg6X(5K*61q|3fybrd>A&NLYgF7)!U$lp|I#EM6S{`DLUy@ z#g?ia45ei%NfUauDoVcDriHt4=y3Pilxb0KtE}XIjygxa9|TO8x*y#!bVt7xCNS=L z*Z{51mqC8eTy`9Yz?6X`8bZ9Y9Z^Ww>_xPZuXET_<@Z8zD|^p&-gLCG*H-<4F7_6e z59ck48f&Xdi_YW<%{V9OXr%JY9Z=gZS!<=~E{m>zHuso5#sZu*jXdSt0;78u?L402+~&| zt=VlSt9O>2Kj?k>ScY6AsnWb)PPusvp~(&~R+U$~XYC8J73O<#_fRk5>E+zwqI<79 zik7UmY%hz>qETU0OieYF^L#5b@N-KNonQ}TuZL`QIyGu4_T z2a)emjn1#W%VSF37pkMukaTRoJCbHLY!(zZ#DwoIS>IhR(91xAkWr0a4{-7 zO}2Y1b0yY^iM5>Z`@3K6j;qm&9oen&4F$f2JE;CtVK%xA&CMH&vu$M?#=;v#rQu_R zN{zBRXkp9Rd!BLH4O^!=BoDU3ZHEr_;*Dg>gQoXvb02M&CP@VqoI?r#9cIsbCYuX$ zRp&3|aD?GOHhS<{2s`#7T`QSK&0JRafUd628iQGl>_~2k8%aF7*;k-zC{e5i6 zH!F;h`#dF&g5`<^EoGNn8eXQd;y90Pc-GpUX+h6LEKRi9v#uoUX%9OnXI1ab@i0LR znb%vg=|i80nt!z{V*20lPlG$4CcrXH!qg7mk~L~&1?r0wiz6l0w%F_dW*{QKkYLYy zuH;aYM$#&}v&VU^kn;spIXZMN@W1UHiM)+Iq!f23Qx9_!Z8ZgWlCp}n46O4X_9$?u zjsgaZw|aKz^*YGPaH*OAl+cunBh<;zbaWAVDi3rC1kUE$ep*@TtzQA)!ALEzJI+y0~zkWByR;y zbF>ESN{Wh2P79CuFtU7RdXUeOW=Ktj7EtTai`adC|Djixy+in$$3ey?{pIg2^%S(7 zcG#2uLpNYJ>&f_`QUqY`T7kwMzJ7)#_Ztb|(nx3D38S4QtQiqLGZDou-B=v)`>z{$ z)CX1o*=DvfX1-|DL!uFn2ve1CZ;oQ$3UjKh`kG_eF~o3+;e8p?qZ_ldi-);qjSEOA z*z?SSDfc_M!M!evpkxRKXN|aN@s1v!MDd6xyRca$lp6vYX@ry-RhSisUc4VZ$x$** z*yaWX6b*_iSMSJM4J0t@?Q8Pl;Ixx)z>c&jbhIF~dVJE5H*mJYtW>)kYlbOp)8%+@ zwmIztOW}i!)iY1-VZLeb5V!@cJQh7@Uo+Zr5s)KK)Ut@HW5Fxx#X&BCx7#!2iL&C~ z!|*SGx@et_hIXff&5m+5hc{ANhPa^OE}@3gRvEg+nt%xr+Rt+^|L?;A@jj=x(MUSy zr)u_%1*3(mp{oBmf=waC)r9nw72dxsisl&qcOC2Mdn@(2aYQvKzn zK^2gRwm4Eo8H57*bAd8m8G@-Y_65yk3CRzF%)uavbq@<5O}*>l7rjA&WUf0ZFUYN_ zmuRtV}@h1Z(PdoOUuTK5R@ks-OX?%~o?Y;(=K=Mg`1S#f8w%3!vL)Wa+}cTI2elLJYiwqi zH**~J{yEwMQ-8!i7Y~MDvHW0o`PxWE8qfF5-jp{=D%gL$H?Qd&V*4P3w$GUI|DyC$ z&trQ!nK$FerjVJ|#fHFJ)l6oxPsVSOT?4O#f&|(GR*C9_(dFXgJpsDQ42e*tMi&~{ z@>ryVu3+T^-4{x*D`N)tkI6J3g#EWq+9pfuw|R}rTu~faFOKWTw+Ta7F21nF7Ztq)!!rR9L42s=lf=+S`i}xZGuR>0|CI zDU==)L{^G*5HLBz9J2Yfob9Ybm}is>d3NEj9FWx!p_QZ~FfWoWQRR5AkoRC1NR1-5 z01_Nf)8@b%0&ffyuu*-`mcBQnCHmzG*G>tKrS)M+#Us2-DY4$kaE=H}P8i{e*DzAG zP;KYhQQ0)Z3Q7QQ2SGOO0buJh6a<~v$1|scPJ=5bbADup5D(Ctw0}7)n9ZVK;9#B? zA+Vl=88w{z8WuP?F~*jW&w%^!@Qb8`@LQ&pi<4!P1B}Z}prd^@FjHgOOM2JU7!fBJ z5Q*ncg0fNB#N{3S<*`)bz5*W#Q2Si-HLY>{c+p2lh_C%6o?zYQDiC3l$_tmnXu%DU z3X3e&((VGreWga@nF6ID%!$APTnke>{0r`PWLIm%x)kB(fl>j;emv^sVbS12{JHQt zX2L0VyA}hY?b3{@7t~;_S)sKS7)$yM4MfY<>HR(!m=B<4779NMRzK@eSE@BI;P5%REV`*C2DEaSwZv5#VVf_R1gkdIE9; zK+-ZxKJ8B-?BF%pzidM{AqGgc+kHQO&JJh@8L~?NhGSoEU`SwhAGf8b1D(DlN``aE zZ%X<+Iy}JrfIDeATjo5)W0n>6lPFfu{Dci@T{}4{Q@W_*53YiM>i52T#Obc=!V8Qg z_k0^KIkE#VWYb6M&$a@G>5m%X)*FXtGOt1R2B4zV$wqTPpiV?MMOYp2ZE&#<=;pF_ zF^d~!s1Bu{mQjd)w&x7DlVus zc&mC971lk)#T5zbpD_d`ifN#Q0BFlHbOCU*T(CQ?b%z8^=0fMqV=1W1M;I4(eBbac z?p^<25ed#wDir5)4YDyb1jc@?U6$$Cy1I0p7;w*k!b}~5VL3CHkHhl9U7Rdhz)s-3 z*`?hv+MIK5DQ8|ae@Qryjvm0ish{svJKKZNJepjdZ~|rKCb{=JKz2!g*l6Zm+v^B+ zhZzBvz`vvUL`|IE#o4CsKrVB1q{*5b6s%7|UC5YjSnAO2Y^eQWJYZ61)&BNxsznhC8@BRSw$h<5y-UdR_TziGZ-%U(ES%vf|CxgT#OKcJj0IDLa0^i=gH z>jeLz2&RPZwAh<}5?za@dsx;7D&H?Wlwv-{0T)i3WNgs>#T~^ z9(}ro>H>9{B}K{B{Bf8!qj(5r3(XCqp}prhV(@EAkxyohW=++@DR#$~o0md9$M z1@4E~ArQW}k<5y6=d~6L?Bu-wXeKdIC4iEj9Vqj>7@w9~0zDQYS+3M+8MoXQwp2`} zY*k?#c06$>;;(fEUjp>6NxzFMOkV@C$a44ypG8&Sr4FDN%wn6*;1^S>0=tmtk5l>j zXQ{uzNYG6wv1|6HE!;(w$g%`*bcuiHRS=qJ20#zam&IO5h{~vaQ==~U&EuxA%WoYB z_7*{p>y|L++igJXPuvMz^T6ylLdpiPoS@s%dn?FU@`Pvo76)IvJ&+_PS~7yba9x;b zcR;PKfR#*uJ?I1PSH1WeToxhdsgC+$^777l9u4L(AbW7Y*jvIS;4TDPPUE9=e)dl} zxyC!M6&13K9CjQ&e2rrmAMl-XRR&9kHD_ztOYyW)WO-mVqb`%M$bL6@RK|(sYabUI z8~91tH$d|xgBh+tDbA?qirSO)pr|LcF0+rjNQMr(*ZdYU z@a@ui3TQv~p`@PmEHvP)g8{*FPS-LE18ddWP54Y<-c*KpUP(_23{HK{H8^qStJk`g zH-#%1cR$IEs}J%D919+t$9r5*di(RJxoQnMz_E|Z#H3_c(ACj#qhlpLuDjLK*s&wO z1AP{kS>M_M9 z8Z3t|Or*lyVzW3^MZ|sQNdhul!;~Q6{~8Y`u8ZBWnRw;7(*o*lkH09-#RT%SS*aY%06)QTjna}zjy+(sP=NS&8^iJ zU-ieY*6 zQBmrCMEFGsSi*K3*dttaKSGF39S-0063(T{-oA`@A@|pT@h+OgUGd~k(M5h;G(gC( za5d=uIZ#K(k0~VQ!iGkoxdlsl25;&I7TORVoc8wiNO%(HfpdDjX6D^`FS;UH^v`dB zY#W*HmQ{;3a1RJHW}iHo4blk*Hh8Xll9*EXp&Rk};Jkqn9o$WeNeRr>6pMSsU{1#W zIMolc^Cf38!W1Sjs``Z!RUs+<}#G(-mx zi4AfkiQ*#?H}LOrznH7p_(I6_^sgU*3D4=h&9McF;pjon31nY$XFS1^77VDH+Dx4e ze3d#U^6-QEzMJ z=ziI?BDI{#6QiFNmLqQ5KR!paSV)R1A$Gxv^xfA@D0-eBK1MYTYb@)YDBitTMCMc1 z9I;?#wa#-lSL5G-VjUPk+g+Bo7)^ANARqqcLB9q4y@J;TvBV18A2#~B`vGTv|37$_ z7M<7C{4f*mn&X3S3dflzT&_IB?OYtyua|_Dc-pKrghc zcrRlUm=TZg4L>sZaC8vg6PR|4^Sx|cTMY3*B$K4`iH3zU%9$0Z)Vqk|Tt0qj`c-5P z-sXik*0^Jh5Tc30LiB%}9V&6mBI4R&7SXOvwu_SCk??#VLgDbGhx2Pf|*JZd^Y(gwkN3qp5i<83VXuj_xXdfkn3}S((4Bw6)d*drr z&>QS4iU+tF*uZ4)VtdlGZ(0rDFTTfqimni{kfr#u9JKH{lHY%+hSg2YcRy~TdeJ|Z z5p~bz(vHuO*ajffs)p5xh^dbE^{>OJ$b}n?4+f3YVgSpf)AxuRK7wOUI zfs|3xNhFQu?pMq5>5G+n8$(M&R<-R7Ng8*ONerr?mA1hp9-dVs{`&+Y`tb9qkGHuC zPW!D|?6rFr+2J}T(&GcGANy?6+HgJ;b=vyjR4*a+3<0p{g3D#eRMzz*CEt7~2g4Oa zVst`b&{J4(`$>xsoR$KJOpS{xnbCShX#i@oeL*?ELP2g%edlDp1`}E$`y>orCM<3a#QiEHb-5{ zw*xNUO4lz`*gENewQb8vl|EEF>If>OT^b&JUb{nfe>QJ|&7h zz&i~F%#E*F9Gq9XUy(WK*aN8Xwvw9*4-`cAdX&UD&jJV<^zW34(Ih0qY$+yOUuM&QRjv2_wYO@8pG9dUE+!5xc~Iq{c7R!-H#|Q2&Z(L zu&%F;9qgmj^xf^dRfN^FEqDaM6+*d&+puq_E}bkh;CiF{@VA(l-_r^Qk2* z%vrdb49_`!Xx{TZ`*4W~aqbZ@;z`2EJ3G)W{IlLIB#9=#DEi>HrN1rbxBxz0LN<4& z4S?f(Axi?-;7$WvxY)hBTD(bUIOkO9t2zRvHwKG&wKY`EQ=xr%`l8@G?R}q)(&yd3 z7hktI=9$3fTV*lxuuodz^jg_U4f^|Ju;^KruAiW%Bd2?APSt9Q!|u<f9xsA6c5$xD<&1_?`ELvz2<8e+evE%8 z$7|`I0v*sK*_I?#6FQg^PS4Adrgwh^W}ut2vFNu#JzAec0o+R$a02BLGYX6CuUVeUB0l7^1tZp{J)6%dpC@_0t zCf2GXkaw`DWXuDd_#JG2=^kj)8!7dIEu&Xv3gYfsDdIz_&}Y1kNiPzqxZw zEokEPIH$PpbbJ|y{X);vb@O*2kB(i=&XYJa9$WVxWC4xSd-mp3NZsO|%VG}McRA2= z%apT+Yd=M-&adl{f)vrTgW9npscfff)WwPN`^DrUCYfb)L?6y-Ej*Q&jP8k#+V05S= zA?^=jeL@rDP2jK+{Q5r7eLl=MlSVnbg*h(RaYUMQxon@oBOZ`7_@BM1)NPN_H92+p ziB}G2K$=SPlR?NCm=yn#6fsUnzcDJO+kWkd*h^DeDrlrmUCeOZTn=4tWcXG8oV9eA zlQX;)_0d8wgg~>#6D>>7k!ebmp?A5hFa^gh6Jm@iZ<0Pw}o=pnq zcFL^G500K>m!@o!|3Ud|JSBbvnT7!}NhacoDF|e;%gb-BJR-V7sq)sCKxk{++u1f2 zj0dpm1O)A8hkcbCt8usRXDz{B{;)Y{&Q1xM+b@Bqlz?vG8e0dPlMR7{M6cJ4h^L!v z4}iXq+f)+#p6~5`u($aQ#xIs=41faO&eXFtjSU-Ak6xzTEC7)KtiMupCLo?uq`f>9 zMJD_|rIi)}8IA%?NEIg1BE|HU*Tpl%KAgS!3_*fZ*v=ap=R6a0$84HxQPPb-fp^4C zWyrdb%3`A45C84jjSKBR@iw0eF<)HD{=%GHGHCXJlys`x0aUwjl2e}7dU~5)+=r+D zsOSccUsrEuO0-6+W#Vq_D_mfT1H-w;*ja3@PRaXNW1z6p}#O0KA#cZkJl;o~V9H^pp$ zX&zaG0!ycGw&-X1IDu`=ayv;6HFxl|543=LsmSIaFEE3DbN!gFZ@Qh)YCri%wXV4iUiSL-1|E~jgSQ9N>;>e# zw2Gy;$`^(eJgl@vo*GQt!~w3-Uq|)u<6j5~(1SQQ!mbn-Y1+AV#+DsN<72 zg`eBR#+rTDr)g5Wm|MvfRS1ZU2O+OfN|vqqm$Eis#FN9RBp#E#E=K)8IqY%)(vJI^YBHKoKl7xGl(m}EM z%JIuFc2+&5R{BFWt*jQHOK?Hq7lGDz=Na;F>$}Q=t5-tq;AEU$F2wicxfhEy`LE-I z8SLLD5orbkhIIdDBMsm4jW#Rb!iCN(EwOiz`&H2X04vFE6%V96zj<kw_c5I#%%gZvd8zr$-2<^{@6 zFF*T|(0|{aP2i(?81kKc>y^4*!BWZ47e?9Wak9`{C7g;pxz}26qDS+Fz^YbkGz3zb z#9EZZNZt1Ayme}znJMA1CwgdXcRqS~D8XarQRQmOb?*)d^40{qE~%1UHEqos!F$ee z4_T7c^YlV5{Pff%xf~-$Th{SCR+8>lUJUbn3ukzsRV{RM_6u4J+&1@+NQuShcdvQT9%>=1D^n&(_r^w~(SC@r6k z)Rt9v;a|xHbm!e}l}m2kTE$E~XOY)bQu_g;Tqyq)_Zs-cl8bgdCcQu)tbp6*L7OBx z?sekvY@Fj+qOm>K6>4FZqAvj_aA|2lY;*^Sg%n_@`yZYn6k-0sN$2o!U~jI%1AD2z zR*$hyY{Ody+M`S)9PM|$dH|Q*w(!B^PJw4uPRZ$K@|DXK=I_1$(Y6`_9^GT$_lLT{ zYGGTzZ}gBWs;3zFv07?*Wm?`rRB#%d!v9EuXv8epiv~wY!{QN-xLxyJ*D;$jQjGzQ}U58x2~C z07K4eH`iH}36bW7tgQT8V>Z4je)1%62r@_9H%A-*2|@q;7gWZQRQ3^mpTXl*Rj$AK z*$%=my(jW1ItRV`*{ccgw2r!`{z=3*XCMgNJMKv&A@VdV(ft2scMv`Vmz~Cuep%uD zc0K7ze$&$z(`#*p6l*;Qs&-dfL!0xeHwHuP3hDv5_M=7`&nk<8&lf{8F`irHIWB$A zJ^OBZmMaY?eNQUm*&x{L0q8f+<9EsJr$VlBoP=e?Jfq;=uWq?fwNDIgAh5g7&0o@+ zoPJxl#<2^K=dlAb9Rf_5o&)IAS>LDZX;t;pr}@$(FkHSl;SMt(`k|Tc+T_d>BUp3* zv5V{Xg2pz!)z0-|V6Xdua!SkOp@O1)-VUpsU-P{8KjK1uMUFWtw*=^g!M87{%|HW~ zx6MPf_3{sF(MzSJ&O{U-{JtFG$R-y5#_{#44(2h#eOpe`j!?`6*Q4<#*b!4n0qRGNDBQA-k={FVX% zG7+rbO5$_JMK8#Hv?ZtVm(r-c7+kTUY}z_p#48*#34Hegpq|=!`whJ7)+z!-){R7} z8>f~$!IbhcHbXXAmW#(Ci?ie;-P9hvc{e^PxkwS`xxXEr8Fmio1ETMmD++@CJ_veZ zgTViv4nuMiG?7-3RjTTtFfwFDnUG9Ss8_?L|oq`n59<;{M@lI(>ilI&qeRphlkm+q1e8 zS%cdWco2u&D_!M~G98>05FL+3YFn1qRWABaTAIR2-2fzkhbB${ydbZi8N)!Y*8>nG zmjIk2u@+D@$L{EuWu!a?jws=mxO+bm$|^?=#t!xpVgu?0?HA5pa=zO?dC_zqc$v)v zi^K09{DdM!WXJ*V47u_AcJu)PA@gY*@e!_j3JMN$-nTH9Y)$ybei?~(T_z8>_cBod zRW8(@SI|J=Fcm6!(w4P|akJ`TrX)E)2atC7orJi9@(A>uC5vHdBh{JI@Cn#M(bXn; z-Us!*26^NrPGlZYtwYsSR_5p4p_x(rE5O8^3+OMRdFAB<+{`mIdF${So|gMMzl7Pm zzxt6fope=Nk}Brw9Zkw{m0qISwH|yOneG7;EibugYyYa1Ct5rA`cmA-dWh+SL+e-i zwk`nju-6zOHR$>q&8@ghI}_`MoD1wXSH?s+F81tsZzL~!O{Af{K&gB$@2Jz{cr)Ih zXmeIo-$b7rSFS6pv{uYjsW;r@XDeG}8=OU5fM`&h8l1=b@23nIa_Jp^0F%=8MFjmg z{C;Zg8k=rK^gcVnCpI^aR zVhWu$YcD?+Q|GkisQYy=mwNIo>mPtXut-}L6l#zn){_@?nbe z%W;bH$h$Q1LfG2c{z!J}QifM3Fkg?zqZu4oE!mjdxK$;Be|L)IR*2vbAmeSAD) zJg4(!MARBs-q*J;z^+L-!N2<7=Fzq&zDK(n$>&;n?lUYTp#2yNU=YzT&nZ67qhH4f z0%zKTrP8sIcD}J;xL25$XwzeNr5GU+AA9XW+fxKD84My7#q??bjA#{3t4S9o;=Y6X zk;XYXB1BSe-1ZD9-AdJ35Fnu5-vE@$&F~+gPS@X>H4iL^KR8=@tLY;jen_cosh*Bb z(nY_VhgFI8fnBx4)1U%x2(kJ6JrcqgTS}RvZCd()1q%IA5F3xLOdK5TGx~nm?fASpk zCQ1%p0J>TNLhzM3gcbqrPw^Vd|2UuWJ4l?sh3C=?x+^Lw{VZ^oJZY^*tGI}3S8Wz# z84VJcv2Z9Sl}L;2rx(tAmzb{Oxzu#ZOjd&OqHEb7ycq7Z=+9n*-(}$(YATs@y>VmmR!o*=hi&+Bt23(tU(h*_-)ae|%Tck^$)2(vu_y&l+es-D)-CcB zr!q2jzg)r`O?N3Lc6z1HlOKU?ifrw3jwnF(v8`;BKRp|?<*Fna$4%u|Vo%jH_c6y7 z1TZl|S(VNnRWMYjpbrt7QGYhm>GKsEJrbiU?(9EWqSPIiydVBZw9|&cLOaFjsmVnkq6@L%c|-17TfOo8Snv2B-s<97?BggNMe7zW`( zK-+1*<>{sJVH%Rjo$IB+Hj9)8W=|1sOcRAk!}}iq2a1Ov5CjYRI_j{bDHtmW0bh{t zh6W+t9ahZ`34@zUL#U}ox=DMr;JB4^Nngi%=n{JM&V$IW$&%MKZ9?j9)3N%6GV}+V z&$$w*Qu(RcJ(el^)g`kgl(P&de@cK1;EilQ*at#R-xTb+4QQX_#G?4~UOu?M6jHIX zkTqGsd7zVSN{ZeRu`2%e8I0eC(lqA0Y8!8_Qd@f*N8f)QDt}Q(uHU7vlpzaLdu%RO7EVhIsK-mmfc1g z=G27FtXe_GlTR1hw?tfHR09e7_w+&hVk0vj#m@;x_*aI4I0Gg3x=OD?mPdi$9W}rS z!sjGr*TG_PlMCFYNR1A`A6;QvzPxS!(N0Are7>28vmbx0XCH)`1mWe$Re{pG5v@Py zU;*w$G)@&?PP>)ne z>q}C|NW^kJ?NcF*aPYo8%2^+xloqf(!udH(J}y(7tqPp^@-j+tKFc>!Rc!Q+_-fTA zv>E|QMiUb>I_cu+6H_x@6a4}mw3B^$c9v$$ZLR%o-vfWvi<4>S7Tb3X*;bb}Z-j(PIa%pGjwBzkk_$i8f;y zfZ`8oe5IUW6VEK%KDdW9NhMj2#U?$YTOAYtQ^Xs|$XWTx)l9#z0_ZRj<%az=q>M_y zN;O_kXUWURxRz&?prD7xZn#`Ndp3Y|__6b#U4k<0B;HsjeKtEu<+BHn0CsJMmC1Y* zPRJQ-O5O#8OgX0TyTi616Le=a;u42}*ZgZJPcDb57~J{Dqd%3rcxO%7m9L3Duc~TC z;*urR!~jF$%GUSXpjQCZ50pTR)`s66U?U_be@K+ZRNj;?hZb21hPU+9D7Yfr`Pd5E zI4ukBR)tun)L7+}O`O&?efylwV)$8&V|dk|c^>U2rKJv^b2OGa@u ztDs$kze+cF%E{G!pM+QG0XFp>IN7kf23sM+1mUvwdmB$qw}|`68!6>&XMMLO7WtDK zA9QQj_ulh%r7MjOfREUvkHdG11@C+aKP|9O*g}O0tOasn*(Ej^ zbC;0-pPL^Wck_$~c0R@%2YBmE-1PrbIX=UMhq1#eqVOv&E5+{+qWcQolw>NTE8x`J zm7Iui-xz3QtNI~U3Glw}0C(ioC4`-6mPx8|kq&`>bx`SMpLngT9uKDrYjpOrf4NS| z~=CA{A9zMhK8F3)vuSR5C@=Z_WNls;B-ec}H^?L0*i zuE^SkQi@+5bDBJJ$D1R0`rd=;NbxBJg{%AklxjC&FHqU43BkX+=F1I`(S907dAqpv z`EDi-te>CxSlhQSryEJZFuqc5ZugpsHwOf8>{cv(ix0=I7F0Z2ccBXp;`9l3+&aVC zU#BYB;NTocXtXu<$?_h-^uxNjneCqt|5L~5F3zHEy<0vuwb z#d`Xz%R=DBlUqsC4?)_dh3mXUbI`7?!@xtNx;1%7Cc;&VYVQdEy>>KtZKj%ht+V3a zO{z)5h7&+OK2`XYwz~O3SBih^g-aI~s6V#r0HU7}Ber;>-NZE)fQZa4+!LHwLCM4f z=PH%PFO%zt_XGXN+0wcHHO_kiB)fx}J3m!_iGBT=PJygbub-@ck)jW+AAMC(0e`4EX<2OkB;14YP@o# zhD)FS2>?I_An+5mnhRD!YDCeCrMo{V0g`Fy6TiOxUz%Zr2fC)F=J##ZAi*88;S+j(f5+k%Zs7~x@| zAqPM|^58k&v0!bXvU3Ll8aPAw_}PW2Q2m6l#>=(=atR{BZ8L|(!uDc`UpFBD(P2t< z-c@ZZ1=J=)NzG-gEP;mzE2rfUtW%-XTuXtk#h-gMtP~(ql3mhskEDSg7n_9liNZYl zKCHF!Rna-rre}1T`%5D2Peq;)Khto(Sk_dfR6hE=u9^;IKELYlPlbr%&_CCakg30b zEQPaLvO~;zF;&r7!)-RF$UV&U-=!s8yE|S5@Yku93!zSeK`||1Up|8fPHdZ?W29zIVLWx8)9={N*?|ah&P|olly*;p)2} z%S2RML1U0 zQB~cs-BuKYO42D}+B%oL=^nv=2Gu6uHWu`w3R7dl?f@n6VK3>oK`t`j-77^`DuMy{ zxW6p}MF>Z#a@O7_n*9*eI*H`v`!#%>Rnj@+u)J!xM25GE;d815NuefVt~ zbif+js8%n4nvR?|_J$Dk4yaZ{J=b^C`$1M2WzGJMIp3q#$+1^Rd~xY5^)5vC zzR7FhPu`v5dKx`INxFaLc#AzLnsn=|P5GOqx!TLTgo~P6{HDzmf_pzE8EVaLj+8l) zCTgWS&ATZd#xLDi9#b7`$*Fi6T1Zor8oUFW>e!@nRjF!RXo{3h0~!9BO!821&@X)^ z>*V9xao=R`Cow5+{j0Yul<;u+v#oxefX9??nQeF;t8hC7P&{3SIB}F(W$2uN!IC0b zTh4j+=2fk^*|4_bo}{8X+;3y~Nxz33#VXYiS-yv(DBNZ35ZNlf!Gp=@fXZU&3F7_; z)8Q>i@ya^J%FM>-3kPwl0&ECV!(j%O>*+La zN~}Mz|LkO&^sq>tcZzz>i>vc{)!1cd<6ejROmZHZroLIO_o75}ZT^g514iYW!0JY7 zX?uu^v$(aFsg#KrCxaShCCTiB14GId(9d_B@%u&hH`}Z4U**V|x|YOfgu6H8#a0~$~-YiOIVgB%E_-RmG@9z z;Kn{nDp%MVotQrPI(uIG+7`kxuG-DD$=jmAY~Fi=7qUI(xX-XO?=W^ zL=e{2yT(viya+!hKyyX7FzJ2`(N7f_C}z%QQ!=5e`|f@K#@!s#aLh=Unvtc8hXepK zmD9O{*Jf+a@APULuDx6BLa0-yBAJ)hag@#7RqiUTwZ0h{hWU6^6-j+pOJT1vd7P5f)HEEik>m-(} zPVk5E(8AX?iRW`!Z4eg2wABoZ<78<6j0QhkLY*Hp*%60gY4(Q2-(|lBOOO{F( zl?RW@tskuDKtj_zyQN3icGv`>hB5_joJ z%QT)RI^?sSvmh(JO+`IIdr*zB%auvyYRoNgx*0!S#)Uq&5fr8jgTT)t#x3F^#Qwqk`!eR)nR{zl-eG zO8k1s)ak|e{w}V-&Vm}{Yc zlp%5ybVkbQ88gJKjQ6?ja=2Tsnq9C-s^1DdFbQJj0ys2z)GxPvdlYlwCcQoSfdB|K zl<(0WQkg)&6Qf$+>E5u7I)0vO13hbb`Q<=wtNZCM`;4P@>~N#P%P+Wi_J9z%2jE_1 z5Vc?*jq@Cx3sj}bIHM%nJW1w>esha}qj?E0sZWgn{JGlDRnpROuSsnWN(W28BYFJe z5e6c9crJ-X{$Tx1W>-SVx#_Nz31?N${HO51gPzkYc&GA|P!X?#6b#!O>w-npCP>Tru< ztA?0spcpf$wB0Kw%R}VO^^$FHXin$TiH+}^Si#Aev`n9Q5pnumM9z*D*;s7ie$W_7 z7xoqEcR-`GO@y%a_90)!ETz~AdFVnm5UpZU#E%b0&Yxp1kNLO_cr~&b$m~jy^ot|WvwzNx^|f%<+Dy7!Y2+iQJ<&w)!#&63iY}}C_51nf zZP0J~S7Kg2(Bgk{{7>P8oKu=l4vhSlejQG*g~uLs(OY!F=I>X-BKhq-%R{iD2bFt zh+k8!u!C$ZG3j3l8FU-lTnxze){1{$B&U6iuBa}jdnEX zj81#n{8hhm51ueOwM2R-`<__n#;UGBc_ibf-*GisyG!4fGOSo8QJ*n(wf!5+lGR@9 z%hk*CA<(XzGqC+SQdR`4pPT1tl?j)PxZX32x4QXJy}~es^;F{Q>)S->=$A3C*;{Qx zwsy2j2pj{-Oal}TWMrN%o@4_T@h=Vnydk1DmiAs(d{f=B4q9}C+nEQ;GyL`^RsqVD zQr)oP%6>%6x!9kdv^iSD1>O0#po_c0&!37QJ@u3Egqbf(eBY&*g2aKxIQ_zr6s$oeVsjr0`E z+J1~8dqToARbsd;L&alO#Tc@quswVEUXB1FOsOlYXoga&DYd)-^Oz(=TOT7WI31~h zFL@IyIPw51T=ipuxO-dG#b%#XgY7&>eVV@LVv2GnN`nhk`wgzjKdb^IF^=nu_Ru;3 zHpOwsimwbn3}S~=X0Ew?1yJkUcBZeh%&)jp8f|(Bd!?uQz;MCY{F%E^BDV|L9cOKU zv3NE*IdS3O6dVvk(S~lDv8K^{OjQSdCPhV z&{bdhZ(%y^H-hgBh2>-|?3j|ksAP4~ugrzWO{=ttu?j4_CMeNNAdn^K&$g3-URe3o zrNDPtTKI{@D@2+zwZ!PL!mjAe34R~h^Hz`!U(z(R0VTCLisltej(2F~`8eetkG|4r zPtE*2?Bjh$l24t=iaLl6W!67;SO6t1f1tC6;%2^{ET*@choq9$80-hf1HDpb=rQ|G zsV;iixftveih{NXJD;a)Wxp%m!w|L!ypHKnUd{W05y>}awdr|@;`TP%-Q%Rhtf@uw z+Etxyt_3mII9EFAPPeenBbWCRExTjNvD_cNd*c(mM3=4}yV4`G#`so4hy)RNEf+k7 znsH4EKQ|Qy`+9!-d|gYIkvmf7(MtV6qo)mF{4)I|4abHQLh~0lU)LVLc+-9LKKpF| zcZ3y|xyCD=UW~qB!CJ&}g5KW{9U*lSgx-01Ek4}l$o}R;F6+wLNrDQ_>l&Niq{n%m zvKLN*jivt4V`bp78?$jgI=ai&j}69KA2_*h$&rM!`T>WfWHPLq!v=mrCk?h_LQrK8Dk1=O<+FXqY zqnlt(dSvYUB8p&!SE$cTbM_N96RZKAAH0Q17Dpu~toIX&*G`H~JYn#1iGWg$m5L~; zGT0KkL#3t@NH>7gncvFW$_$OVEVJo@d5X8rX*uJ ztcv`$+{E(aefBUOuV(w>Jz^wwB#&pP8+LC?i{_MnfbZ>B%`ZNys2bUE_vzB15eweN z3IL9kEF&?w&88m7$=mEB-B}ewzWfAdJjE8gwq-mT&iuzd_Y9`1X8F5HK;DN?5j=ls z#?lyC9Z|QCGnZe!5}zvJ%=X;k>^m<}iFW?n5>q7Oe!VirJ}UF%qp+f_sD4#yMIyL; zVw$>(4Yj?zpn>Q?-wP|2Gj=2*MPFH7Y%WVFKe%NK9XtV>yy;5@viDNGsCz8blrUG= zI3C)G$pCt%O4=JV3?oN*Plpl?eToPz4gDhU3Q_j9Px))qVEk_bD_{AVh5yQBX=xSE znYDa-Nu&9yI@Xk73MhAMewR7n<3->sKb<$AHsP$@!}uYz&c%m7 z9AU7Ped#K*?t>^@UNW5Y_xXI(vv~K0tcVk{Jbwa#r17*g<;_d^Ixn1so#bEK!)hZM z9Qu4?Mc>L6FxU7+>+Fodp-p4h5zcP2I(Sk3M?%5fsH}&e(lpP$`9qavVfRes+)WvO zYwG9u&m9I?PaG`U#9*ARRm~>4D7n~T+bf|!)-NpH#>d{YJ;`>ubGHr5O(#!_HD9bE zm_o%`?x(r<0C!ZNoXYjO8h^d0YWI^#BU@^#S`T%9?maei|CK8K>e6g`xnj%(H!TZu|5v+hcjB$Ci00gK?no9#yg(;kk!u%!z7zk< zdmZEkqOFv4WowL24g~eMa zCOdOcb%>Nbf>w@Z*Yq{5O&}^?DS^Lp%3j0ZM2!A}rfTv`@5$AB#c*H63pF31E-0^i zz8(EFU|$#xo(~#?U8m({uhH-`K5~ZuZhUdo?EZX_Bh##Jhn?hlxY~G&%`5`WaC*C5 zzI^#mqA=q?%raXm*DOnZap|dEnZq;!rQ#BdL~Gxj@)y+?L4f|071WkjnZlmuaT%VT z3P>N`d-7ZB{ZjhYXVaJFt4!E4?Qw*^(k&TVdCA4I-jl7N z{9;MswnFPU=7pGQ5ejZg_hhFhF+(wlQ)!vP^+bas&H;`~!=E1=?1;B6m6tA|Rh>s& znB~1eKbWsT@@hA9-ND&7Y&{jwC;iuBedngr4P}A{10DvSOVR z=SF3<`3)`2!=xG+N~}4`>ZZ@hN5~tiB{;rE())jkSn%6~bJgzV9F5qx+uKJiZairbek*?ZoNJd0i7PZV$*l?9m{od8ijs+E8%bVW{Q)*2|ncwjXHT zqRI)3YFl{b!>G-aRFRxZl~sNlv+69l-#8y1d}Gt%YMWA-quKEK1WRDGl4)-S@84|_ zQoHsL;$`6dCuf{&Mesefcuf6;BM}?p%v#Gt7fMv_36*w+&|3O!{U?^0E0YW1+G7OH z8%xx>9&HugN5fhv$X99R0}>dwqUBPD>CoKKN0x=x2N+b*Q|pXI5#Ap|K)yh`tb04? zGIW*(Xu$5kGj%ZkiFG0YL*ASeeFoeOy;~bN8`J<4y91Y)3+;za1}L83JZw!(#4%hz zu*dw|EEf zXA!WY!sLhF0btBtW;WNI8PY_&3)(GoVz=4xYZr7cx18CFj}W$P&W zs}o;M3;a5|T?+VmH4>XwEI3DVM~?XMRSY$AB&u7sdU-ig)czVZ@u2pq=pl>&;?cMq?uXXQcXW}-(Y}MNvUSBdO?dlKf z`#d~+k9Rc`x~_$ZkD=ZN($q38X-ExM%bs7}C1AfWb%!#jY(v(_lq%F4voU9w|!lP>Z$YU%fzvo@Uf*~;VyKHyZS0^;r5B)Xa3@f5!oRVUz<7K*dtq7vq1pel#FRtLKZUSqqX|& z(<~JezcDVw+%g4b`avI5Cu-EWHnz)qtH*I< z)CG6*!O(k6eT3F!uKB(+GUPCfk?j`A;@p*^;F1)>YMVqduN1Cx4$88yaITcr&Bot* z>mOBS6PA*-PK!!!;Z}DMca7P$J;{fqE6D6|Zl=Bqc;aQ@5qaOB)pFdKU7y?XQ|`ca z9jY1S&L2*l$rDZ(QW?b+%J%N5xl}#a_-bu9U01I$;Zzm0S|=`Zx|F$J#86`GzG~KP zT-)QBm$qCV%Ex3&<^dy!3y~V<{T^kMQMWSa0v^VkQ%kZ43#yU0URye2XE^C%+fSp} zUo?>2{{AqPP4NcWYJL_R_WqZ;OVP{yn}HOOp&c|MHq5s}i!;E^mA(ycJ9iUEMC`bj^Vb78-pa`zo-rCbcTvoPaf%Gw(SF_}eW@?{`S}qXg6%gnUuKuEse9WlMC`f7mU2523GU3 zABG=kC|<`nq1c;<%Y`CZG&1YBF>8bI%%tl8!n~JnWWWRx@L*gQb~$*WW+=3mX65RW5hak_4JrPDIotPXbqs70>s$yQvm8MVoduc*4q>n z*?3y)Fd>*q4E+dY_n;0r+`x=#Toee$^WfjIG_$$U-v|1zGlaNi9{$cv3Wn!gpK^Pg zvhvCenu)Q1P3Tx${AmTw(#0P$-@hjuF-2SVeMr?WT5{<85O< z>7!^51npF&8DB#`qwftol|$;EUue@QA|XDX=6bX9xE{Ni4f}0xsBU;3#$B^?Snvbf z=df>(b91owXUxI5c`?*_vtE_dJjQ-U2zwc%wr(0Sgy3?!pBAv*&ldCKrc0Ha(IN6d zy#)~+dMhXV{$Z0Ztl||ULTe>2wvB|P<%J4jUe+ac7#gSNF}R;guNN5(vCyABN&H;U z@wm{yB9RJj@&&CiP8`4%O=gl37``gb6>vZdLVL&Dy{)q$%d27yb&*WWVE%eT={{k5 z{#N80MfL6RT0cFoG0czZA0|VbXH9Yv+wN4(a<}qVOpBA-W7C{KCu>2L<%5CzqZ-{? z$B~lqrOGXt-n-TRUisi`d3^~qh$=+h#xB&q;w~2LSe4HH+Gr;f#a_5L#YJ>n$@B6) zkW$Q&r|-1DkX_N->la+_ML<-)pax1>&1esTaa0G=fHR33+1kEq609r_Q%GjQ3ltJ+ z_K+~xXKW39lAT)a6J6>|)HbbK3GF2l*Ei_Grn`r1iq1gXh`j%EE>3 z(J=8sZX-Sltr&Ts6UX!M+-;PBCFu)V&r)v~eyjRipcj!zUpF1xFSPs;dA8-2V`|V9 zUZ+Dbp59VFSV_Y^FQL_A@Cw^j5X_QSzf;&xX8}-NgTpP(Z=XG7HE^D1gtPzKy~18C zMIZk}R7Pe9faLAlSgfYZNoNJ0M3Hon!ZB-`B=dq8aVc5c*tLvw%*KBD@QHv+|0GM2y$ynm4jw^qO3rN7QtuKmO${P(41;^Ez;Fjx0|L@oP^Jg<6>Qq4#1gFI|(GD~^g;1Fcejkl?eB>VoHp5Iw zBK;}l0xfTPtf5u3i`n*|Npf-~L!+4yG+RXFLM<+@^88>g#h2G9ETcb|56Px5B1iln zIvH1`ekVit?c#1_wNPN_sBm!{0;knuW^HrQ7u?2mgc0IdPsO3wHJCJfPc(O~ z(*l|i7Cw!(jFXMfhDGd zX`~#nd}^mHZS!lX|0KQ$&?O7MTz`KwT}5|WhldcQZ$= z?6HD;bPD?9id-+LjiWvbrKW@5*t{oP+}pqQG5(c`q-F@ewZDJ!=-rloGj9Ij!T#&_ zB9O~I*obs_j5ShJi$<#081WWjF#o_(_^}USMbFe3ZP-fQF?`NXb%#z|S z*%RRk?`kb?e2}+l{7W&PbrXDsmK(!8ovpEK{~is$>nBLj`x68ND*-7i>4br3`Umxr zs6|Q?L$-+5mP~1Y4*So4*Tal=2ZCgN5ESrTsAuW5$t+l}8ay(&W^jq{pXE$;L%QBE z+mEdggrUFTgTI&hk2aMBQ6@Z-=nT+A{x%c>Z;h_8(1eG|jbsG{%Zsno@)CWoefZF> zrB*2T&kw)EjTe2~^9-!GHA^{{iCNqwQ>^{;iou7=`pPd=MgIM6Vps?!F%+EjdS()N zpygj$`p*v%`z=ols)j(4&!K|Hi6n|JXX(oG3(4yq(W>1gKy$D$u{@BL)P`i0iKC3I zj`h-jbx->TvHtsAt}|6HpE!Ys4LK>XQc;z8{kep=i-A9G#o6!)%JkQ7@*D&$-|FD= zo0Dy?kg&m1=OKYDyY6WK;nGT+CcW!R@#IM&?*E;w2I)+pvbVlRwyduHj0A&|SX(W! zN96^b|2!kVI*TUPj?r5%=sNY*ye-G)MfT$FJ*AIdXX)Xw-o(p)o#js28NQp?6w~sT z$rX0`)T@8}-vY?zI!kg8Hck5)W*U$WD*2oD&pRuJA7S*~zzPXo@)MgOdM)tPwv*AcN&)D*ONv*d_lYiJ6d5uiAI1? zK!GjBLr&s_gnjtnAB^kggY|qt@KQ&7+tlZM0FJS|-|dFD%S^DYg2qRZ+JBM5V*L)2ZQ|z;r73cQR!A!Y-qq5Q@X|I2970`I`D>W@k9AAm( zpOyN*r%E%^i2%Q5vg0L><;12k{QtJg)8-JMeMvXkQ+^mYrN7eNzT;G`E%#y3l~q#x zcOi=GscLYYje3ex{QMmYJ_o)5ZD{el`ss}%+He0U{9W)kpaFlm;P2rrX+<{DVtH3M zH=^Wko{aVwharIYDm^$$f$_9VsMGky=@d zW>(NysbTRUzCe4>IkZ^*tlHAaRNI@@XBQ-sN${U#IfH-=phv4a2nb!`@=l2(Sh`0T zZzJwi&u$GM*_NR1N~gAMe#YX9EW zF!!(f|8sO3agr57JEtr<+}D*5i^N<(&O@wev@U&Z3qNbPI6gkLoEZJo@pHi`zuz!c za+azx=%g>67!(BppJ{v-oPI61w5O*4L99~tZ zZRmIWn^O0V@eSXC2J1EWV;UXCTpbrjE6NbyGw9J79YF$Pxb;HnC76Eg3|REJ1NbC= z!E9>XkQ#YDmamFGf7~hR&lWBwcoJVe!caO3BM%8^mx(Rw&u1q8J<@5_ z%<%zL^e4e=j5rQKWC3N9rEQI6R^|5h`P&B%le|V~?nDzwJN zijsJ@-dvXUz)i;qP%Hh)`xNk~2GS&wPa$0j*s4bu>sNqw3?UhN`lSr?Pp>5ru-R83 zdf&LjVzuK@pjJsvSm^PA+Xyl!c3AIt{?{keYcWNP1ld=~4pX5j8nV7d@XB^SFtHm7}H@vq8`#q+@RziyB}|0x&f zA+>>;PVY5z-tEwcCVB+z`{g1bryL{`MtS0?I@1PZ=zIpD0A;o_L=FtF<-9UR9NkFV z*X6}Ew-(N#0%!yJRp11G4>U<{X;$Ekd-EV#_m24`f>(Tx3D9%O>}E-!S{-hw6)F0Y zkJGlW&;17b!|A-*91nAuMneGPr30RTFI=&S8jP7W%?O3uAVVqVd4S~6BZNd)S64h3 zc_lcao90x-aA)ajSFs^KCle*~uTG2rO zvhNPvdlv-ic~$AM?d4ih^2K5JLk9@SATYr7&LUZM5R_2>VS)m0lx0s98~mtGCX?cm ze^dn*kQ`Z}3Io5K80|ZPf(>(<0B%XKwyEushABF7Pp4{o1Xn|McH&1fd%g}>*Q~PBqu)YYPR?9J z9=O+!#S1yTy}saoFv@!=aq-Fsjz2li6hyKyo{fNGRlh z12%l9)NX!N5icJ)46$V1u~Xvx<^Q>&L1G@4|GwCNE%%^=m=_OG$Y59W6>8OF1KCKq zT|kLQGPvGUNNs?Z?@?&5O9>LS1_1I~$krS{AZsKSLccKl8=ChsAoh><*2mo41$UNf zvB{5*zlGcl_7mJ$44*6)da?sfktkj$G5N6iTFv0w$6#tpL@LJ#(B_p})d$Xk)S_a4 zZ`&y9<$17Ej=XG7xj~ME^UzBIdovt%i3r&gL2_a)H3eSlu~CF6$yK?sRCs9^>w0VA9`fTdzVkwn}O z^=1Xp8r4l2h-^-g! zALfdDXD!V7sh$qEzPq(%`)+jt2_RpA^5UZ{-GAQR;7MuyxBC127#5z0-Ka?wxWTKT z>?hV#(J1-C&gq4EZx>XGA+85ZGJt3G)BZ7{pY%PIcCfugE)BsuIdn? zH;VQU{?_s6alO-#T4sv#T?dTyY2A#(W_y4NWmjwJ;E7Q>3B-sjg6(zSH9zhLU`2;~>%rol@iTi8 zj5u*zn(dZ7o>Y5@RS7A(@0WHZ^!l(#e&7?SXTyAodDp2?_)l}7tJDjU#T01fMM05@f7y-o3{cC@ zK|WfA9$a>YtjPhU_k!MLBIdQF zb}K)%>!{Vu==GLCc6OH0J~uPqLUbm`lh{`3QXp&OlGmdYpHl&8?-E0~^*3(r2{69c zhkA1N>lc4&w;69Da@4W(>oacekrc}h-E})6FQcs6cU4lhecr!v0d}8^#5qn6{aET5 zL6*THf$uQpNf5-_5e8(kmdf5YT)dmK`CGu;Ovjy?(EKYo+S8Yz+UpOU4I)d(A$({&ML%DY>e8q&`Et%N

uoWonvB0q{bq z^+*suI|1`mm{BxSBUBzF$BWk}aeC0i^k(LB|>f{$~YZGUr9_tXn zN0H0x^i&#{9rH9Ks&gvVo`=l2s98>)`9VdLQ`ULW1W*{i@nwJ-?=_M-2FFZ!@}n=+ zJGhyZ$&W)ITpf3O7PAMZP)rQ-uaqYMF%0MJo_t@kLEvwrDzi z^?}J39?`ZI6GaT0JLb6%tdOT)Cn!#v^Q!iokzCowP6^Hn*$$vU`y9)2yLF@Pbib<;J~%#KIUtQ#@98pgc$SPCzJTKmf?zz`TwcHf3822tlW5iFvUhR z-fmK^1QX@Q7r(0mX~G>i?$_Z8Mfb%C*juDQLsVk`MI>bF24Zam4zF1#` z2FI2z<}qc2`C?TyD~{|tOWZeH)2R9RB_pN9UTi^9qV5fPmt#OM6JbwMXw%@~pO8!P zSWkD$C+2wV@d+qLH;1zBpbN$BaNLqpA(Htp-jOl%NYSRt?CX@L0e;8Mo?>G72)5U; zFuQc}(!8$nv6cR>qg;_?*879eo(}0w9ijvlPsA29Kp4wqBaiyLcqD-~xIe8&^)&T= zR|5YtV5!3ZA9^Cx?lT5$JaFI$ziuWiQ`pz;)_JM8qZg&^wUL<+^D*7RB zH9`wia%YP1QHayZiq(wkdqJGITBye;S4yKn(gy{~dukFXb!({4>?{TnjI zK`OP#2ksPoHZ5( zLpMyp7$aw4jFAY18dvy@n-1iEad~%snG2kK+=|ZyRM_jL6Jo{`MT1Bf*lOF{Ow`#V zX!Wqglfe$qj2@|3et#6Z|2UL5W;+L-1S4S0&CjwpWAtgEHvu^#UOj4c1kM=(IVq(cPPx1 zWYb%|dM%uI4Oqb_V#__tV=VO=$9A#_#Gy(qf$Hl;MoGLJy`vb2EO`q>A$x1^x!z2I zJ_v=)_!*A;*4Y1jYqm}j=-nCxU%dlarBA132$DybRs~;+FTBlJLUn+xKxV|ZE4?YPk8Aor z8GgwkM6Frv<`);)$ZqNU+md)TpieNXSSz7km1^SeZ}nFl)p`z|FW0U4O!4QieTDcN zDk#X&@@P9?^JU`J7yH{06O>$HQfP;Bgz^=C6L)B)!U~eW=wyuItAdy}YhIoUT=7UI zA#Ljon~JrsP@cBrY}b;CPEAKeKw0e=sUe(I)}yZYSw#?Qf@(&hd6`n43SCFMoL8Xt zJ7OPD@g%S<(|d1qJukJZvLjnZRDRlgeIMYnSzp$vdCiIU#21RIwRDUQA=$6W23Xr; zx9K%9Rf3vwaU6FLq(6C(fQ_y|)+A|3H;ViE*fz==WNFywKF6Ovx(LcexRE+3DEevA zb6pr+^D_${5Dl8%a|B0G{CcwU+fV|W&sIMTl4D;8B5eW}Vt@OhK@0XW5at|QaZ7m* zK@}O)_C41;2llEDl0NML{nf1Uu0_?`4~NeVzzJyycF5xSib zp(&}`gQJ1+-pgZwIUF*r=b&G_$bLe^b|NKS4- z1q+R+V}!Uq%~8hEDzMr&v zISx{7A_59jQR8-2-5^RA{6eSRL)|_EdNT{CC~Rq4!$a$Ea>ltxaEY6P?)n=;jH-Hr4_6uV;oMd!cV6Y-)* zchB{T;w>)E)L@08OwqwT1+f>l!t>HHC0nC0w2uZ}8-3{ZLAu6>jeAtmdxI|u2EeCD zMcCMX!!q|vwlGYj=^I9UCrE-DVXV}C@lLHDDWAX3Wk2HzXxkz_(8$shF{&f?aNuRu z8y7lXCgy1t7%LvavVsFW<`(H(U|c4|2qU?V@@PXdgS=QnRjzOz3B~@5ikXaf>oe@p z(J?D&u1aTYyMAEA=^w1^L(KYTSh@&p=@+(qpkkaQY0Hj}(b8|ovo?G#VE-V(Dj3lh zWmM$0Jx;?dQpnRCq z`lhJCSA*7kLl(|Ed9fq8IosJ_zZm^~HFx_6RZwH{$K2G1={QG)3d0Wla4(Wjitkjc zkEx0hN6#X`QSsLw=#QDop2J8jqc2vp?*aIEq@k-`U;wZhq_#nnK?7j%=&zn*Zu^n0 zBN{20e2Oq~U6iJfTVtj}1^?1t_|u>3=UOwIUB6x@=nOJqp6S)HF zCq2lTP#Qgq*gql~<>`r?%px0^vJ#f*@dg0JC09^vABC%5sfMvgIzd~;Nh~VVDz9Yb zK~D6!7!Q@iuaL@M1=;z95{uni(}(OJfRohQDE(nZuI7H;E#<(V+YGppRSI^pz=b-W zL#K4A3mp8t?3VnFQ(GYE$rCTbV|4MObYs19qUN6&(5Z21HbDdfpF`jFwoo0iwy)}+Z5&ng+FOY{%>uT)6cGKx_PJ-ol{xbyz|IdjS7|iwdNpuR*l{Ij=53U%yKGs9e`TbJ`GW=UbV3KB+;A8Y<6O|$ z&sWzz=cJyMICze)J!r8sf~Pn>vv}1WEe13TFv>+2qoX$89{-Pn@7KZjAMxSHai~D> zC}a&R%|!rOFfYHFRgw341!Epcb!Ui~&#$M~*mzd%U{gD9@A z(6V2m_n?i}A@)dJmXxYKK6pYN=xxvbxr!^<{~|we3V8 zX%adYU{?EfnZ+}^4chifIsR7>c0K3NOCsPvHO_g2j9%CTYrL|7!Bwh3;vZ{kX|#r| zyGRIm)xNqQ_QO=RA%^csl+&|#^h*fGQlieq=)Bc#8SzhJ=v-};1 zzkWu-_sG+&i{g>zyQdfIlOi+?H_yn*^0h*cmo;x;@zW^N(~AyS8!?G#UuIY@gq2k# zZEO^z6TZ9taW;2vB$@f3w|Rd~rS}?u{$vqbH8Iy3GmA370|0DuL>HF`)JLAOY9Oim}=8qCJj{!Gfx_!$^7QkHcLYqhw25|!SkJ39n$o{=Dz|_!Zd=bhJ?g^<@IDLBW*SK2Kf^4Rv)Qb4D(KWY?>;W0$QkN>DSYbO zyKv7j@jUDM+8~d+j%OEN_M1zgW>_~iLu9x89UA{M(qr;9p7A}?KT-pKIBGCgrLdK+2 zyyz48T!lUAZ`KMNg#dU_c2O&;fr1gsG(;UkYmk^V5?nC$8LqDpj_%7>Z&iB;9Tag| zjMi}*F2*paeya>K3pc7kV)*Cx^WAqX(Yd?R$Y>D=#)@dtTSquh=c69$-bVEWvlQ#d zbb@#iwpzQC)OB??C)OI1DrHvl5r!Yzm0%tnu@m-hLEv@)S(p}1B5zv!25R?1)4W?w zNF(dFvhf;hVD`p0Pd=#-$)Rwp1wAc}Nh5I49N+COGSKD|%mwj`9pd~Z{ATf@W&@cu zwQxnX^7aZc{evlg%{eY=fA9Wc8+3vtY2FLGS$jw*@5Zqbuh=K`kEBW!o z+lM}-bd;_UTzaEf@xZI0&qX)suH~yYzD>p2hv|*ZmqynV2RnQD*@UL=9t9}#Je&8cTt2T*ffPN4eJ0Fwxkp7FX_;X{b9V9@%{W&46Q={QX%{E1*wDvE& z2=?6p{FC(D=3VHBtU;`S!O18juvvL@n<9jGmA(?jTEq(3l}@|48+}HiqGfDlgTfTk zPKU8bC29uRv*JAwilad&CAtQrE_>)1HC*#+-0p;>)}{SS?xmu3Jn4J1d*UWvEZi z$`Sf-`NNTKb+?Vykho!{lvr=NpEXm{)UiE?6TIlOO1e1D5*AeFSjpU}uz@>!W@ij? zgfqyAP`9LcZ;-E^b^)D!VFo{ZaC<3_>^>?yB8_P*KZ$~$xN$A_1)fxi=bZU@nTP;A z&O3RD-bA07tWv6ERnrxYu#X}o4S{*`9{dY=p)?r&M)O zIU`0hQJ8;ym^3a%2y1DBi?Nrw;iBw*?)hV5ms?R_8f!M;ILG`QZi}REPcI^^@TTN+ z7cYKiC4Wrk8M3ofmIX{2!eF3b4BJC{_it-H<8|)kVQnN7pKare*>LB>el!(A%{+%f z(dZHmL49OazdO;U9&~aJp?FAyt=bhX*JhN1PqUF z_Sz_(Xb08u)&3s7bse~_ZA~#`RA1^wWEa0($P;lok#z(FV2k4%JhFtEQ3oFXkIe_= z+9*3qVnubpKgfcZ10nK>odV~<>w7`fK*5%X>n((m3?MlQ&}cnOn}S=>A7C;T8lrB2 zEqbEqbh3#$T2%jenBe391xB3r8Y+ICccL%`fc#|r0cBGeHrA`uolq&52m znzoBh3g3k}+5pVUux0y@z||3PLLqT)q>^o9A4u@|<99LmaY%IEmCq&-a>9(44E;6G zabd}7P6ULSkE@?rkTl1#qLOpek?CoAww9q;A|&Yrx%C1lrv8cY=I0SYTrCIR4XGIP zPW$VQzGJ*^2pJvtVc8^*zh~hHP-cnl2aSjHRJlY>Ph$qIsx)#uu1A8irmPHJO!qN; z5dWE*6-1jyiB+7a?7n{Lu)qH{;#yg=2u4O;I3V_(GCQ{yPp0e2qVEZqo+ItU+Mc_g{#ex3Aa3cdK?48YF+~+*=1e1 zc?YiDo7>RCYtgF55MF&nNprLFL2OLJ3c^l0@;So{Q=9`jtT;aUnmOGbuT1B5gH>uV ziLHHm>ccp3)xgzb-Zzb^%71L*&N}V@$Hw3OP*Sy^gZ$vIvpi;FcecONVDMA-c8$A5 zbVC(jJtG$4`Z7G?X-{L`kK!U9RDDrpupUuXR`w(-dHP_doi0~H!rArCJj7#Om>4~O z=A*0nvr$FxsOMF2FP%4p-BvAGnUudW1A`7k<1Y~`_=1X~^y+mb&GS?^0z@tQi_pfSA>?{$)TEYlU& zAMJen4rM{2lT3cYW4g%)2u!jxYkYRH=#A?z=IDnHm%we5KB0X$(TDt;< zaI{Rc!DN^1vDY_7J1@ufUUk@5w>I5(?(b$Fet-$XlTQ+HZFS#z%yr3e$Y-Ts$x)%i zup>4-PtShWMNc?gGU>eYgh%3|l#Nu9>n3R&j}KN9t$imHu8`R1T96d?6%g?K@LV!B zGnE95(2vp#;t)FH%NwR(pBUR0zZJb8G#hV@(6U%1rDFZuyxZ+^L9X5YYQsV> zme{t2*I#>T-r(>_Mb1LaSn8|IF1aL9$Yd**h3rgvQ}oYI2M)Wp9SSuQ9IqIxkF6$R zXB1B_X6zOdB<*cfmgknOJ;E#^z+C!LKANUC;>7UYBhod9e8mJZVEiBMZlOr306r;k zM(J&jZe3@2^S-JoT*nY{Z9_XV2nu;cdMb5jwp_)F3Esm=57xBSwXbJF>kgwl%zC{L+&XIwH3ndfc{oFKv>a5?Is=tP- zc!=TS5p{9Fy(^b3br77sfm5t+IwXjnmB+K^(Q>5#ba4F=A%uu3+$S-dx^}rqZvt*B zaxLOu)B$8_$IroS^92U_D^XitfyO;NF^(ezmDi{or+fay(H(&Kn&n2g z=|X0WcHjYA_OGce2u2NAazV&i0rUOt^ajSdn2&2|TYGVus>Z|nU_jR>xRuqDP%!3j zLaLoh~Zoj9pNv{cgKzR8#d#T7-)FC6tNOE0<^_9<+xJdO!PzU9r4yV0doP zR&)H}vH!qW04MylEwVtXTDSx0_MhTgAxr&^vhpU)jwUAPa^Gvfzx&Y+;Rj@liKp3N zBoQwYS7db+dX0`;Sr0lGPQZeK zq|IRr6HkH=i-O6FipHk3KvT{Oy^ldKPG(Jf%sTNYZ;f60wv9!AL7@D(n$0;Dt}@r{ z^~+8qQN>E5YEif&{wru>Dj04j|7bcU;N#lImNFP=pRJQ+{2#vL2IiuCHQ89ta zYgVk9Fwz0x6{k7Z7vdm@&RVZFQ?;sDUwQ+?1IW~Xc{Uc$->YoYay2`jd;5)A_SMZ< z&b9;Mw%tEaw(N-%ARr4)dvRsV$K1J!qy* zK)lv*{x2TfaSPXQlKwj*Duu`Q34JiUyJ)X+HlNt(;pbIVvm6w~ahx_iE}9|=lr zr=s3fYc8$5QuzgmXCet~7Jzt$iLkBlyVqkk0k6C<+)b>Rmnkq;DTBc$fH%);+gZe= z^_M7JfmuxX{~%Ff2T^~dCzG!dqJEO1VzsDHJ~^Ub*8?!u(I@GoyrMTFsV}Am2^Qc} z-|##_^CWGg4w=Y>#IDDiLTpzeGJehhnu&O>=nzc~p7D)w;vj{u8En0e$dJ4G_Uw3| z?jy`o+=p-ABV&`-&vO9WF?Cah3WX=XOs*oc2EC~H2IAJr`G1VPcOcd8`#;X_&jz#4+u%TGBJqx@vnD6&ry6l=mCHQ)5dA%d%<7Rw z=q7a0BI{<~cZaI_D)_J7!hyJtq3e?n5H^sC`sP!!^k|y%aG3b{^HwI@*T+E%h@&~h z!0tzO zD$XLRHY~t_1gXM(czw6{n#R?0rHP48o(yGB9udg~#+Qi4Ef$F>U}}2ZP{2X4$^&CL zrwXsLuy`9ppY3;Gkbl#n+5E=cf7Q0rPwjT<`(Z5q>wi*g7kM}yfxIE(k99==vTBrt zaqNoCnc&8L(LcYF-X+!7wlB4E)pw_UW~vBr2Z4YC%0W-RGOYV4>2%D0_wkNbDtAms z9!_5eAaIf_sby}_SP*{79hv{__RmJ$Fs&hn_26ubcLQJ>!|a>&N@|9WUV%)C@uJqD zXYElD`KdEm**6+fcm{cJs7Fdvb%?aRAVIP4b#zk9~vI&mt0WkUdNz41?P!ypZn!qIcUgNbItJ;DDlWwq*dMBCA>v1b4G0S9_vN%)TFwWJsL} z`1TSiBSI?kbd*}Q*QgBnWO*{X0eij|WTjYx)))_y>{n7ju7VhcS3TJPb8_pw(vDQ^ z(>`ANdcJC{(}%As>)|nXp7w zt#&N~ASy;4mVd+hJ^`3qL2J*XL3>w&=>ykzrmw&H^~zl3y{efN3*#O0iCf^or0luV zu5)_`0&`<|XTw(LVNDU51=$_vJ)f$COVY$}JkAe=TKfQ$F8WgdGT6Y?UtXYczy*jK zGZ3l)61OnGyQCYy;8}_`eX+^SpHCfS?EXE*Fj|SN0zXVxO7&NSx{RW(xOfAXmlQ_l z-0WD@-m+}Z1@|@}Qw^nB0h@1}?Nqy$`_=M(^W9io1Ky}?fD z25hgF+vODymy`;92?__LqXTV0^9XLosr(NvR3=U+&iCyS&(iPB{h*me%`Ne`HhuNV z>IUG3a*gQtOt!6%lq%2h@N9a@iSga*?%9%{earnzNl;}7q#63t zoIh)5wM1{Mt|Rb6#;dz!@^t;%Gsgl--G`c$=0YcV8 zn}soM`N@mueoj@r$?gkv7hUHm8tIeO|3El;l-lH-)pLa`DW_O0t*(j6b%^Yd1uc+% zUrNvzIf%{32h9>*mG#71E`q4N)R)?$Acq7Qzi1vN!|gZ#5@{6LrH{`f#vZKekjPl5 zY+|(?UPLJ?AC`KtQKoHgy8(=Os9EQESFeI_0OM?-(aHMZ2#A+e7#T%Y@dSnD*G=Wh zo%|ClT915$X~K-<)(K)y`75eocW34qy6VjRpS`KgnJm7lo_&(@37qY!>-%JLJ|u(@jkUMZ zQub<%AykL-(mR4)Olt1|J`~%$&B~KwS3q{tKDTGfLl3TrUk`mStmFaO`XI3Zq2V!X zlwLZ&mvc3~n!CFN!H)tbrLk!dyY|xjx<3e-CCH7}E;7bb=|Ac(x2=n>Ra=^UU@VRT zX@3_&&ffwqMb~i<0}&8DTm|}r3TSm?+!tj$2!Lu-2Qu6ambI~n^u~I{k`F5jx+S;TB&*DkF}qIKs*vO5i#y}a3p(Et;Nt-SKq~};G9@8FI)$XO~R|L`Z>t#c~;$=Rtt;P&~re}^GB=_e1#PcH9$`M#ZM9(=KY}D z|5zcwdf&rh=1kcb@aHv~hBDXlXvS5)@@~Va71fDcy?P=vA(OuVYYc?O09UfyPa?xkP|kmVR`ua<1IrJU-& zs4mFFf&<9}_cLM>K+?0@TM8D#w{!??`nozM7J$)|1?`o6mci9>s&0uKSS{MRDROqKX#RbT2pPTHaSG zE-`{Vr2F~PqhWGIfM-Kfa-%3m&Z`T1H>Yn__3YQ2OFUP24|2MEu76j^iJSryx*>Wt zLgY!~qU<|iZ68`MGZT>bs`>p-w3aOIT*a)bF>nQbSd#*1wpA^Sw=zeE53z7-rDY<< zR4I#(S=zRIx~7B6jORNAJ*N<8nSZBx?n7{aAJ^EOembQE6$A9R1YOyR(ZkplY#zk=f7U>hm z>b*tdzTbTXibI%}eIqX@r?2q2j-|U90$UN;&;|@ zUUpWMrjF~?0g6XPUGE@N=psCEWzDLZPHa2{Z1N)|Wn=2w_3CNqG)1@mQs6S_eikF@ zo4Z>+p?EWS-GO?;%8q9I4)sad^jcc0K|abVQLwRTbM-P5QE;ZCs^gffUMyGB-xYycpkfdU)Z zg5@|-rBKsGTTs2Bk$18%3uIyavxoJ!cu>au3H7gzTsA#k(P?>%H)E$TV{~K4t3781 z5;@c2^|X%1gE&F&FjDt)HH6XQX1`+ZX8*?P$l_!q!F~i0Qm;t|00_2guQdAii!UH4 zrH<=uX-R5=E2JkiSG$g5156&w@TQA zTCqJ_E<5WQAbQYg)|vBp&*8F4ePBiIDlV*R!yR8Wq7sQ*U&B$^&OOM|OgeBY&hzCk z(HC$o{+_;V$A#cWt4SHkX zOu-^Kk>CN)#3@nUd}oX>*Ha5>!Ry$>t(|HIX=e#Xe7e@cyEA>*^OY!5pgwk{bG0C8 z?Cir!M+X@YCO0kLCfoB;&C-f?LP?W@d!QCJ_j$QQ{>)?8r;`%L+?K(S< zciWl9clfT!cOM!$@n&E#z6NCtH^7PXXnZ}#l^mC50X#HXQ|e|%LWMX_L`$n3&uM%o zp_k^>`r~?fj_Tn6z>5jDn4V{sK+T#Oe}jTTsZgCRt>cNH11Xm&A2PAg32FjpZCB3A zbNP8dsPSIK)w!XZJ@h$HKDF1UC_Pn57`^ZaQ(VF^rAKFlxOB5w35r-2jX1y)^{b_H zOaHR~OvEy%q^^u7qSA%N7F0U8?WQPwbKpdJLEWHj;S#`PPPnrIvdVL<9n-Vl)`1wt z%cJH11W(th{eV;(h~cSxijD&HH${kKfuL&XLM;6&8%MG0ukN4|5Kn$otw+t5&33Vt znP@)0Bw*rm55!euFWP^;am^x->~EZRUfL(<+7g%1U0dW z3Asym`)s*1HI)yUqV;@1Z!3>COji>gN?HiGfSdrzp1TEuQ2snr zE&4#LPLtIHOJxvLpe>(b8hP%3$n>#6U@lqMeebq?R5>mTTI>0MWLMZsO>lpgss;y! z`ik~VI>m*u&NXP}n9-MBTV@Vxq+g zN>`tY5nu^q6m`&DGgGn!AWx~XPEdg^=zy_*AR0W*=G9rEqR(TFsXNder~7FNqJyUn zO1~zQdqBF{<@;o7e=4}lITxf1c9 zgEn4`uc!Hg8F$8|f$%G47`Uo#L$ylAyWc@a=hrZ5pE%uO~K6=Q=r|BZ=xatK6Is4H;kyjRWMF3xUR3aMm@Z;`lUmoKqbOD;q zXvW$#fPMpUgLx1XlN9f{IQDG8NNX)2Gd4Ms$8-&p3rbFZ21w`Z(M1MLdulwA5}zn@ zad}Q$sRK!@95PTBRZe5=P+*Gk&xZaZnh|Ok^w9M8dJhBt_jmn?**J;8%GkbZv-<*O zzsBKGF3vEEXS;L@e)Izdo<{H+nv#$&CeO_U$!Iy z$YS9_lOhXjY2Tos_!m0(@C)tRTweS!9ctqs%~rgz@6$C4(3?QxxT{xKtkeaXn&G>y z@x~rG33D9N5^in*HD4R20J5({=m3P7&rk@`?mIZ2M2Gl#l_&yJ7*<#d!0z|fWmUX! zN`KnZbgNtiak{)OiAfA9-ZmY5ko^OWb-GUeV-ORx^UOD z$s?Q#x}W%n$nVd!nLKfQNcjb38DyAGgQV5_be)$@9B1KVk01w}E#^e858LFF&2+K* z`_r~z28jBgPCJ~AEY4%;*%cX}R)R95K9FKT5#8(@s>mm0u;dfR?BT@_i~TZHD4D_p zQqW%ki^{PdL~u2qaCiyD-kSkFqY6-F_=(dh(lVgngWIi7P*pncsvRKTz)b^R*YkXu z?m4>yhIS&+*cFhNJphFzMTbv;-0NN1xOxA2&@9L8&y=mR){(vGuw5%hn-)1KHeOsp zUgz(-0s4WO+VMT58+_1WmGNX(R+pE`z-)&2=gT#b$Q6*cpE8*X(u*oU`qOCVS@sAf zujSo#DvF!H|9{FHYF zuZ6PoTXr$1!k+246S%?3-rb)>kF)#}@e^R}?8=McI$kx#O5#ulA6b*hTL0fkqlg#u z5tUY+GaxBH9TdVLgL#~OJd#pA=mwz7*Fj3fx%u;mGR4@6{%l`KO8uB^HWpK7oI~*$u7|3EPg-VfcgRCcVsO0VPeKg2|U>UD5 zY4Bg_$E-_6#h0J$#pLVn>OfB_IbqN|sLbtr3lt(6r37j@t!}}{AR2YNCA6^(L_eZp z*($N^NQd7N_YC=dvxt%t9kmsuKnOA<0MTau@f`C9&0oO$C}9zE;)>gKIwPG%4hZ!n z!2c=-e^2*IMRAiO)#(0!xR5;xZzDh>4($YR`#OEc9A{>X}_q8%(i|D5NbdkZ|exCH}F{k*+?F&Y8W5`ED47RQjb5mt z3fhu5D-v||5Gb+mItbdOmvcbV(7^V|%>}*ydLuXqU}v9Cgu_de(_T|x^>@AX{(A-} z2*rcgtcKaz_Rjb=8SKb8H1mM%0H~+9Km`LmLD8UWNL>c-9~AgOSlK8-|PB2pNJLRw`N zks5f!!e%;CM*MHy3L`-?+1I|aEs%{8eD!@NyG}A10xQia!*|{S8|Q^V9ZoVPGvf^2 z-AtsBae>o@KHo0S?M#MWy_G25KgfLK->V?#8lV7u1dzGTWrXTFp*bhvP}0cA@ySY; zQHbt6S3~x&&?E0xN#71SyNmu0aHJmAFBiHU#uycdxQ{pQ&pYzxmtEx4guy-^XHQ=P zkWa->o}JQnT-oUDAqBxG{izTM5)FvBqD_^D?ky)&BHRZWW4YMw?i{3q#4LeR@vMQQ zA}4!+STthEBLQncmOXj(+grp0gwjSnZ*0)ndY0@KpY3{212bwuS7f#@$pjY zG{3*NEA0E@<8RE^0n|#uVK{3f`k}Isxa~Hy3B=t0)l3{*E|P0acm;H9;TM?(Y@O$A z@Zbe%48XF-OXH4X@I+Y)MoI!03XxC9kZ_pAwxr*pHGzMgoh0|&uN$xUl<*Y;nv9cG zj?;J@7MXYqy_1_ZWiv@E8qZ_+zh*Mr0th7>u|7*vED$V6KE3HRIxA_|pW}8_m)bT< zv(qG@xYLJ)S9xI3Q}m_;FtW{22}4<+$oT(n`34aJ5d?75Fzh^uHy{alj|Xw`UlNhX zaXUsoOY`UGj1MT<%tz3I(!?_`4U%#u(7T9k;Oc#WO$!6D47Vb|$$>7FV09WL(HDSU z#S%@?=`D(GU%MTN|HwTM+G=`q%SHUfWH*NWCZGrsi3gw;ttE%U&e;9#Y7GQa{x>w7 z1u}4B_`X0M?+1wv=FQy#)GA+0mQt|-4uHy`#vbY84-xTWzv-JTH448@DhBE|OR{00 zjGpeR=N#j~z2K>rgXR4NJ^%?Yl6MT~h%8WMg2$@_0(C+DlJIWQ{aT>V!{hB|4?xgV zoY8RT_ZkeQ&d?)yYhP}P>r0KzJs*N|YbG-4p9i;y1M1%gX6iT(CxG_>PJIIkDTI{o zxe&*;L6M1(G68~uTEpMbfWkXd9sd<8F>+SPJ>-px|F}MfIw=9tUydZhR9?B$-hm%o zCxI+;lLSas2up}koAweBvMH^eM%afq6N#|IgU5v-l0%HoB4dAOwi8IW{~m7riUKHH ze&z_9dOC?)6~Xm^91ZA)Rq)kW-KCEwQ|y}e4_M+>OJx6J*c~&lFYqS=Eq1i$EsUT( z9XV&(_3T1qIvve9r-(qrApJcbq0;bz{!cB9$0E)Kf|jvqP1L`EUDT$+zbdcV6h zDe1rw{YT-$`Zz$+1H0%`4%8*=#)e^zqN*NI*|%U0s08lSx{t!(*YQmR%_!;!lqPH) z%jYxRC)+MB>-k8-3POW$+lhd%DIDIOB-bUmlK{7kv&=JI*qb(W#`q}6K|uC#cjR6z ztfN^`v>Ls_{!|cdwG02tf0Ws0aEy^ULB?COi5-1Smf{}Mj2Y-Hc;Nnw z`_xCTkuGI`4k#3^IvKCz5A}x)Akx@GlD%p$kmElh z!qc>Ql4=b17-+6|Ye2w)vSDPwxks84Bk`P;CJ(pTjeJK3K`25I2<8|q+l($a78sA< z`b!DDS-!v%5(MhUx5X8E1Q#ri;%}W+HW>|~MA*G-(d35+hEfL^T-e1nF#0|Hp;UB+ zYBXyqIT>Lb3Yr+bpN9%d;!o~3VtSs*Tec5m&<`n0MR4qx2}}xF=_&se*zKSOF#lPn zIr3s9PO}4$b?AUQ*@q4lz43ajWqx=C{PX!4vTr8tRbqVj;l#O-YSWpAqHj(Y);zh5 z13vB?KiGS^zqioIi7?q@md$g9_(zj0U8i<`Cpnx?GjJUott_W7h|9_*OI!jx+^3FE z&ZV864p}1bm@?1Mp+ZUOeQ~{NX<(vm5vX#2?wLGH%*IjeJ@xj4zykcqu>DWyOIKme zPkj8pgsBk)CnXo07!K9vC@q8D?33)prSnwon_s-Yc=nj)u7{t2WWqDC;{fllw!O9N$SVdAY= z_UUWnc;q~rP%>8}fMcDbsC34ZOUSxs0kn%4C3aOe6J_Sh#Cr#l5tlm8k=-bg)^$R? zbT8rD!J3eqA%n}oIPo$Il(9L%b-3pC09?PWLrBi_2%!UcmF^;V#6djzEIZ8ks7$Oj z_)UolyB67rr&sPy<;O7*v{>0-vJJM+BFVO1G2Wo`L{xE< zUQ8`uQ1HrlA4ALKo@Li!?;02|%Ip;uAmy@&5Jd7vR-f?|nE>k#j4%CqIjxDq62uf< zaPEA(kp}GeJ8u0`MeFW1Z0QXKtA~`%U#CTEY#+L|^Bsx~{EDGnpZKxIaaA@0I#n?~ zd9pP~oIN8W-`Gh1UT?`SEMVMy5DD%a$S04hEIXQVwXKzd;|9!)D0u%`#jEF=9)Kz! zrarWC>>{uc^46_zJmxu zTso-?*`WW8~hzGol6 zTh%N0ZjKAv^L^XmcZPFTU7b^j(K*p(SZES1PNefq=U^LWOrZjQCp0CV?aX=DuwHbA zks3tafx%Wbc-9mzgI!%K4N80H>A!cU57ploT?Jg0Nq^ou zTwVB?j*Vg$LDY!Lg402j#XGohKdSMEV;^~s>U%O#3v&`TL?S1)^0fh#&L<&`6<&8f z{;I4wTXAz^z#-Iu%@Cq{-c#Q7weInLxD5&s^)t2oZl9tjK?d0b1ulJB*PvZfj5UdO zs{q~;Fx-_pf6cpl$?q)i}V0{&Zm z-1GVD<+G<1V)tYKx1kyJ&$Xk`_I--{jj@qLwn7)eSJ&J+JtqqV@7;j%0tHaU-IPe# zYl_%^$m|e@qZn2;g~g##ygzT;>q7{$0+o1$ws$)<^^fAYnG}aT^zQ;vpi6S;TAX zA#Q(JTU@gnVP!e{JFsTS380boy*n3QYp5)qNlUkUj`cfCHl5D&{oNJ}B>Fu@o5wHv z)$=844Nw>fbt<5?Zrl6PFHsz?EFk`8DP_bAt&iJ`4Xs0={DGg46A@b0DcF2l4xN8#zY=0 z=x)AojKqllRdzEBvf+P2>O$HD>LM-T-5}w75F+C*ivQyecs{c|DG_2sn;66~N3#_X z#*coFQl%k@4VvSm8X9u&JbCg7M1rfxe;>Jj9=}RpjJ?>1)|Daq=ts}Gi2)8AKvs&= z8ygqXXFDn1T$XB$tHhOYKiFCb8SKh2bQ%f66F)XGM4_GK^(x3X9aMHBBRf^O=|3XQ|jv1vN}rZ(3wjN1N%U0yD-jhRa!4G9)jSDFoxyr zA;`e3cbi?u6+SVuVQtxU_;kSO48YHP3?1Rgcj0H|-AqP!Mddc{aoTH|#?YWws^>Ww zn;`V#N2)^rX|EzfzUKUxET;QHp>5mYgelgE9nRPJe>)aHG1V`89?-2ow*& z!Em0QDm1iSY(GsX9BAMjV@mWCG<(=iQux>w~oAE~oT zynI2o7kEe*fqTT7evm(W`{{zgw&e2mABnNAv-mUmnZu^KXl_lV8FHP#VOK!Qlv94Q zZ!{6#4H}o6E#3x!wRRjeKfMr>2uJtK`(TAw_gL3s9Ns33>HuW z_KXDpve~euh#xzPRke5vzzX5dfDG=EMxMr5H!ex|&p($2o$0qMN{HgXe<93IxWPFL zXY`1^08-W{(Plrz4|HMR1{YmpPb}jLrC&6+xhS(tSid(rJMu;SC(dBa#KL-Ju8JO! zoW1z}yYHv<)0Oh|l>!E83jo>%c6%E3X6e(4f6R3QJroDr2*gf|S@9Xs_*Vf)iEuJ} zD2s#{ppW1|zo?h)PbbJ(6K_TR(T_H5e6vaekO6a@zF(a)Mw~o!ii^IJIQ41RO5KUF z09|>%nV$CVl#5p%1?UXlX&$!q4W&y;0uoDmuQ;N8wBzl;? zOfK{$SE}IU5K-vw3P>}Y<>#KUeLhx^?BL(}z^p3KWFJtsRm{INVAHG8eBqc-7+8ul z-!Q3vG);k8c+*P&NXVywfO4-k`-||)9Udeao)Iwe(BR=%4aEd*_p6pq(lc%ldIGR; zv5Q2URidw&c;=R#IdMuG6L5Dz2hvd4Ljx5Qf6GK&J~~<&vRBm!a!}}qz}%8y%G zQjw%%4?4O+Uh;5HTSpKX`P4a!p?~UvC|8Sv#MEYA1#GO)9FaJ8arK0%#W?I@V4sHJB|1d<_Z;C&byR4CTk{Ynli3{FkQu2YCOnlSp(+Q20CLq@t>;D^^= z(nE^;L<$^V+z)}f>`kd18F&%wak3}T>HMDa@YJ@1D>2q;O{sblFT9FIiKj>{9S_Kj;QJh0Pk0s0v2Nq zcad*#zwr}0x+cB6_O#k#M9lX6qHRFHEPlCYP9(?zTi_N%$uF-}FAKb@38?v9FOG6w zu4~184U?q%NhkcRe%Bj5{OSqYi#b3CBsR%kPV&r+en=Wja-4>;q&&>I>2A#H7#!`( z8X$E6}G}4X2{@^^9QoVtJQh#T#3VLx+UcTm-_()BBnnCVLJwoYRIG!_3=X zuK72&E!R&kKYrZTwE8}){Y#Z!PgKDoP6GR4R&?-tO;&xAGe*3>sVhcR>G9#1IIQ{7 z#}KfZOB7kFUz5L72amY&_EZ}6CrmNZr~|GzKh`mUkBC|a}DDuIBtM33JSi4 zE3m~)hAg#LER~npRvWAMRPQStbX4?c(o!$*(zIQ{zL_*Y5jJV;m&XAZ(Hbe!AjK0h z>W#8BF(~k}{;=rW<}U24UVd{mzfRJjXC={91-Ic*e#mHYd9drn-N_3%woVL|4Wmuh zH{{yKR18WB#xYZhOA>fyE~{g!#Zcl@m-oQ92TaUfJSsTf!?uFVMpWQuAJ9{SA5)Xx}x%$qGUG=xrYMpKO4^Pe2Gi#7F zPjE6BbH2hvx^C+COhs(?KRi1>wEk^jW;z>NTc>+D?jj^TE}I6xK0-w|OS|$A~gulY_G9=%Vp=)ni1AhhVvhVT#vWeQ=zs2ChBqWq^kaTl-+a^q9ZqqGYq|n7xH03 zN5{QAN8DJ8pLE^9&7SeHT1a_yh~zFqL`e$t#tW}AFl<18f7En;_$*4m5ZVyZAF08v zW_xsC^tyw=(XUyHv(3Fa+!4YPLiaQs?Vy&^eM$NL%k zw!P0`X6fQGmsaRxPn7M%7k=-agVO_-v<-|F5|>8%t1(ljJOtLjtVPO5qxMdhN9wH- z4jZyR4JwGuCi9GI+N38COfx=Fg*k-;ef^~;b{kNV#(FV?C!QZ(f7H&16kF#AEOK`2fNk7eN*kkdPeo}30AT`0rtorwI zMHCy4^&aYn@}powf(C*IN zA3;re4{z?4OL~!ggoaMKH1He5UZe|Op|}iscS2uJ)=jhhJ{RRa9ooVbhvQaiH^xZy z)(o#ySAVX+7=0?<3oXFQw-3elk;d*)+Lt>x`#7OVChGIZ9ZwQ?gG~^3cL+3aU)ErJ z(BVV#JfuIEIOV6=uY7&{Y#^Esu2E(3=6Xb)4les>95iuAAm5IuOpDQjtyif;YU)K+ z)1sN+ZCs{@|1ZKC8G*4Lu)!dL{!MYy2e8LR0oeIP^9kH6+toin!c)O?p)V$&d(0x? z$G6!lttilmKvSeGqwu$N*6^A{Fs9QW>^YF+TRTKsA#0fnJy8D3MYtbh7*8)nZxz6< zRb}X!W~s-w2Afqp;+b!GEHhe={)ijSsY)0_`T^hq%j=SxZ2yy?D0OS>%@5B^(ypYp zGz!u^*gE5EhPg_4ZA*SpK>t1%L5D;dfCDXDeEa+X{&(;97w!9xL*3%Dg7aw1Qr(lF z{L6rva!f^MH`l|+093bwnTXA~5Z2_scAN$f7ylP$7To|^ZKdz;VXe*4k}sk4wpRU_ z);GUG^e$d~1c4WbAIhsU}{*og9dvoItMs!5#=+q(()12Ck9~Bd=8_#ME;KcQNWaaTx{r zi0Q3?!ONjFG&7RRBQyBIcg>;~2G+&B`^*237GItraE8-jzZCM%%5V?F>o5W%WpfRt zS71>jZ@Xz_Yh`c1%E;@Pa8y8mou^Q$7TOXJ9+|)UEsFRX0$&g=joxvmjky~wGZ?HO z5aRnB>s8j4nku>c&dhD9CwO5o7)HKz)W`?4!(Z+D&P5ALgTMWC=b;TkR~s`1hV|^lW*hFv3uo5U+?qFCcb6qu^Z~f zqs`r<_LiZDzJN_h7zC3fm4VP~#Dgc94!?Q61K?GzH{;2KIEFwSCkmJvQ5fS-4mo+? zkN4n+iRL0L*VeZ-KR|m&Mghqb-^I9jCkSUf0zXS~(*gO#cFUbwxE0J%)IZHm?SY{Df=PbnL?=w9*^!;A|56b6o`&uOX9u_>lR$a%0BYPxM*V}Nw@Kgt@MY}$nRGOo zf@c7gbNV$jI_ZBhGYX3%r)dWieZ8W5xxZ%1>s#-jb;_e;iB*e1@%lk9`F}@DLYl2TJL;=iEy%|7Zz%s?}R@ua7Qt z$KZ9(f@P14)rH0nI4|p7NKRa3Pis7bEDXubBN5#Yvm_meko%9Rw~pZXffJ(N>TO-t z!0pKmzH}IT*M>pwoP4`(_sZvc`+V++@1a&N4t*yO|5BgcDD5t1rNkJg{ zP$TTs4k-%8|G#!(DgiqOG}A2BP~s%ITA%67*YWb!aBq6OZwnxxLo^G2TEG`iE41fG;-Vex6T>+30N=tk}0HQ#SM-W?R3WR8GrLpACtZM4vS?LC0x ze;{+lQ^;g?eq}s`SAT>T6XS-PeyLe6m{a-mpT9T_{SKaShUA=}A^*+1I)!N7jm!z4 z3cp4st;Pm=zJJn>~U()L?#ho3G z3z7zg-51h6=ir#CeNTAc^BvrEHbcwZUn2j1T>``Wxk+7ycqtN^Fi?QkR%5{2z>{Gn z+iU#A6>={UKENvrLdOD);DCnAM=`Up?yG}^l$y!W0`P1WBm)IVIx?_m zCr6nc0Yo&}OV7Kkt$h^U@SN%Xf1JyrynQ=xL}rO!z$@_d?W1)nk1$oMsZ)Os+|)D^!3+Cz^I+> zyg7P93gW?^bVc|7b+ki_Op;i8hErI3*L_m65`@c4{MwKxOnGZRCpbD5-~U+38mR2& zX??;l!%#F>bKeSEtO4DpB*uup6|f?5WPwkaqhdW`mwKRu&kXagWdRz2w^3^uK>Xjo>g9d=zFW=le!dzG{6o2cI8!&ID z)ZPUpon)HaysFFaha^u5f(6+h7VxcD!{P#PMh;b2cCJ~gFs%*1ns!`7a1FM#9H$db z*zccbJ_)gT1gx&&%uh`f+i3#9q538$>4eoL8PS1(n%e}GJm%CdQoY`tF`{|+l zf=DxDml~dL*9L*A`u$I9v&-S#LQeg^n9p~k%JALY`&RaAT&*RoVuKj?p@Sy}WGyr#_rYoEcp08fd~}#(hq*6(o;|usT|6dv#&dRgOOJw>QBUc1j2Uo1c7ks8{s~EvX%i zd<^pd!76tc&toSPU+vMab!&eVlEg`-lW0?u zf;@{u$6-84P8h7FD)*qtu=F7kUo!GD^>5Dka?2N=2^&W;>>f_F?+Xptzv(kIdK~ET zA7kDUgob287pP+E1$jj`Eh@reVgPG5XdN>U--|4#`P0f{d+PZ7G0;C1IZ&#ZnwrpgnmqmAYqfbkm%%VoThE&_d0k60&1R<}Xai^53^P1uta`EhEA1rKe&2cG+h3r9 z$lPWK;`M*PCpUfvXR*}W-Y_;&Joxpnzia0Y%8kE;QW*6YyljWRqaIe6hD`7v`I8NE zg|Yrrzk&%@$LRuj&`yC$4g;~ieJD@hre&MB=xex4gUx4LC>n(%+T&X&kFl4U>Ti$l zAPn7?w7?i>-=?2n)!MZI7>`eH&To0VhumPtcTRz1qOo|gw)u4a8k|?fnlv+e%+p{s z`5xcG)G3bT7H{3q%@12@*#dl^GG*+h5Rt!;t<(o&cSwPPtL)L!Vjt`Gzs33X`<2Qq zFZTYCZm!EC(${ltzete*yzSI_WDB7_b@ezUhIyR-6cK{4d3|`xyIf;=N3ys4tL_ zsou{H9$mTCNwtNUH@O9$-}F3&Y&Uc-%;VqIo!<4k)k^WIOSqgH-`CblusikzE;pQf z%crIdPnFj%ftWT2Hf`zEyD>8|S(lvo*eT$^%^g6T}+UG%tZ&v2G7!2M-`%`6mH_$h4Qs<3O z4nFKEbY;G>lWqUxT(0|`H*Jh>yOz;g0J4y3hK znw5!Fcl}f2aWsy`&ICb0LUKrU5+7}dtjWqlAc-Ocxgaom(ImC}IStmU<1tmLpH7Om zF8*OdR>PJ^1k=z2+y%pnP3yaBGEZrIin$fu%^iVyygHR9Som@I=YKy(5DTW!BIUvX z9O|HwV5L;MXMCa^%0gG-n?m$78{1dkAn#ve+O=t1s+*odqo6=ml5I)nBW5Jr2h&=g z#n&mt|B`^&GQDlroarC6Y?kjARZ)#Ghna-C7yZRudDjrPH+PP9L&`pd7T5E<=K^^4wN00+$n1V!t9%~bnuwU6X!!`K~7n>(b~8}ZYeGL`j62b z4bWWgw9buaFmxpC;M8qRvWOMABo-L!mUkR^ z9XW8-2K!e2nS}2lm-d$N_&AQ*KPcostn_khOM2bX9`p366 z{`ga1>@bJJuV_|jU&OPf7skO$dLn72pKmKoFPA=I4`F*ild9&eL|u+^-DeY!0)*=C z-NR#ViOOvvu+-C4(K)*v$uo(=?d)&Z3=(Tfw@Ue zD5D^W-(+KNP>RzUb>T5vJ|h?@PJdhhj=Vd z`i#z^)BgJcqDSDmGT#&qpV{YBGFUmNqO^6-zQhC)R8`~yYKthp83{iSpKP$K!s_ERb{p9u;!vmP#IXhq6tN zH9_x-hP!Qf><-c&bZwUeuzYJWLYpe2UQS@y-%lR2WYcOiH}`9v$EP9Pps|PMA4t8Rs($oafdB*E!TQ8RQ zH8c=Z0kkCC0f!KojTS@XBv) zJ}_&IjAv4mMX`UUJE4k|{4VeaS0fx6C8U1ZtV%w7w+}U6puvu{R9u_C-lI|1F5f@U z{6ds+gdhg9_tWiE&VYZU2$9;KDbWsqaPubBrq{oz_e`X_=MGl1&|n|kTp;7wXWyB) zcx@-spl`q*ss$owkOMKT|I{!Cte3Ug#(g^4K=Wg^ohz6whz!X& zoK6Rhd_+AQY-HfjAt5zcG7#(Eo$YR43esX$;PXO;;yrgqStCcv1hO;RV|3Mcd!F$A zSXzv2#~GtEyBEGiFPJ*Gu1g1urk?6;U;eS$;w4;}vbMTBeCva}Zg2Z9m-S(}g#Kj3 zHWa{pTY|pna`e4@8{1g>fGZD9CLmc+X5XmfnD*M3Ho%X=1hv1IE6ZtCaIIaSkk?+q ztyoxJ+MS!=)IeFByhlbgvD-+a#Q&e=mYqRaYCB`ZI-C_b;MnpaejvmeQ)Iic=fx=H zV24LPkkKma8ztvVB&y>wz!u^rwM^a@Pr9zDC5bwiU>aFYIhZswo}WBq-npVZiwkCX zp-`Qn$%+NJipLUk$XXbiqA0T@pZ(_N zXBnzbYRQVBV%|fkVL80cYQvYl`<{HPJu$)S^LwK4JpZ?7>8DgP;|T|?=f^4eyw;6y z%f3^GTfM&cF*X%yJ}fggf7F{Q{X=DD=J7#m^QKeXJkB*LEDaT-3)PM7S08=~JMuuJ zpTTl9a(w3(Bt<&I9!cEv`Tmftx;A^Ex<6Cjurz$Z@=yCIu7VH=l%j94qPar$%8E1~ zx8GP(!lI#Kzm`$gJ+mOS10ykQx?xFWD_Q#L4lZEt6@S%MRhNx9ulSx( zDvrs8T@i6uYnk*uLEP{1fZ(~mQ^)dD5Zo&8KCDcbn_`X3FBg-{>gFgPA$?D`X5Em1 zG~4`=^MQy=m}|j)bKbbdwin;HaFwnad1Xs0#jTkOkA3_c=JVxIhjYuazUCDE3jNi! z7Q7<#!Lnt2x{jVd|AqgQi*MW%<|t3M`uESN+IF3N4(9Pc7=9G5HUBoeq|m};ukqE` z?|Z4mhR6FxHQPeAS^?DcoIiQvzHPogJY(9bsIK?}Sebk` zg_i583cZyX?VY|Q8;SG!N#VXO!M~*x)+Bph@zB1u*X%)A@S#quRt|2gEjKuFuQtfH zD70ELoVI(COM}Jiy>!wEb1iH=-rsupn@y#h@QkfjM6${Eu)Q6<-!QQ(r_4FOc6z+? zjrtK2XVkf#@3vmsWcBXPbbY3aDpL#3uegdvzK>Duow~=v*A7nmE>(IFBPo!Dh7{ag zwo&(~auuT}R*!Li5%)~-$7p-~rCBZu)LPtH^pE7^5)(77cp2PSmJxR!l-qN1cB~Of zz3OLp+wRlHE7}n7NA%PbaCVl0j*ZUt%OF*0R(tY`nN0 zC=uiL!!r9FvEiTQrwXj~wI+XF`@qLA)9!XcOetV|-)I!or)g2ku~Oz|LZ~j8Os@E{ zsZwVD`F^=SjxK6>)q>TWZNqSbQ{vGy^p4i*_W5(s%t^i%`=jEF=xtqK`A6uV@`pE~ z`sj0+{O8Tu;)liDr`Fbc6@fI+N-IAzubSLw)Jgx8$$QBx`jXj6>rw`*Y3Ug4ibvM@ z5f7M~AIfxrCSowUgIsg&mxVSXpy-3hbc}tI!y&P@1O*nymf5!6%4K=a_qWdY(eni8 zo_{Z5|FivJsF-+nf_=*|1@jgE*-s1H)k}7)M)H;o;5pE&(I{!RjiaI}js!Jw09hSM z1pHxA!RvnHd~z*wGaKt~mH?L^)ruxP;8kIO+ zO%1L5eTz%^>Qwb)cZ{};VPd;cNWogS$2uoUVmU_oTIk0cik^cPQBljBy7tTOUWDwuo;PSqnUm-|^56 z+S`x0mbleD>A?K?-Jdt@8>hWd{O*9lg@X?MUndv6Joc6%59;PXr$T6acOz;+ z)>8CkhqU^9OFh?uYF^{vci1l#^dgBOYK?p%T=^~bGq%L@YJ{gWTDhpb=MpR) ztr5oouBewQvDZ*P$yHz(8mVXAba*2AVCd&A8LY&ZMw4nCmtb|qhYwGC9Tic-5|y!U zGh29zM@K(S#UIqH%PbU8tIM=EI@%uQ!5`WFQHk5_yn=fFoo~wSgDwhBX}iY1!_JK9 zjSmMmv6kjrD3~|(&wlb86o|dlG;!$1mzB={ud=I;XL{e`y0<5%bLmWV=vMc1_;JZ- zg*d0CQcfCnq7HdTMy(N!ITkY0t#sB|9=4c=Ilq*V!fi1_8n+gWGQ~lZ6=Q{3Z60FA z{mv43b?<%MzxMFmzTeO9^Yr`d{ds?0gTEHCsdhs#gC*6%lLh;_0}FF}YC|!F>@lkf z0l_IauG*Of*+GpUQ7J8i`DenYu|yerZT@W*nozN$4InMVaWL!Q!`r^DOVW{?HsH{F zla+SzR)F_-K60fCjT4|VjA50s#{_}LSe#Berm9yF({^MPT*^jMAFZVHR|z)f=!L zD@4NjMZzD@cj2$4TPcaEiC)hlBrK7DUC!YcWyUZ!+g|<(eS(O*U%}{`cx7|`f+D{& z&yE6eX#jAPgXp_bUDzMys$zxt6YuJ`am)Mg>yZu7N10_qUS+*1m+~p;%ic4`T$5wp z+7wB&>8MGAP&r1vC#$NbMu)d-k|2hZI=Q98E@Fk>CWG#i$*oxsWqr=dYxle9v8{a( znXzaQ>5w-%IO9@tyfI97%=nUPbqHrQh9tWHMF$c)AL|zwR^;}o=w&cgo(Z&M+>8`L zN@GWy+VGYrH*XN$)ReR+jCZ#=Sm?u>ho|+)UrxLt@3aVV0orrgkb%W%z7ynqMiC+v z?5Q$E2Atpu##a#^QK%_CmEBlhrsr?;v9buy@(Zf>BnPbVrkof3X57~_z`2}NrPt#r&UsDUTuQDl6L`_F ziGN&tS36YnO7wmHdxa8!SST8HTmr*S#g?*WBEzDn!h|t;a4Jwbj08=7&_I&Jq@*c} zfr~KrQU=o{vE%;P971$c);T^Q8g6y26;mF@ zIUtqXgv_e+bIk@3^2DOGbi7;`9Nhf!-k|rl%%e4RQOl+br0VoT43cM!XOi^-`r{l_ z5w1ER_D@G-nG%J}E#rjTfVB1O*xO(4dNZB%D}CQGBgSuDGle0>UDp@D>=TRVlL5og zJi%7Ih0H;5;|9*-j)6K0yx2KrP3M$nwP5dq098VnNo~`JX(u8$WXxGueLaktnOP3u zQh(iN2Co?aj$a8fWDlciZz-Fb%3qh4*OJ~=fwX@3jCb3Q=%lVJsshEF0OwaH&d0Wn zC||5dB8k=03!svL8Zc86)}x~Qf-BF6_WrI&DudiSBI5*-J6P!>goRbJ@QDUUoePhF z+cxHl^q=i_*z3kO%P-w}Ca;OQdZb$0A(G@mqh&2=#(2q{3mbPB7Y;T+@A6Aq=#zR0 zZw5Og3{Q+VE>dTc{}G%~lJjxT#|T45^-89`(6BC!fN{+}{bkYd5R3)kwU5`cM2n+S zZevERj}|2TvWM0ZncMli4}lt45=G-(u5NPs7FLb#trCd_p4t}R-|)#w5ZjQo#S@+g z@ARNk4``UbwXV>9HyUGXo+ykCf}yd(keyP3{9v2kv5c75Q6*d}ZJ1on=(4mM9bfE) zP^>_cqYnkC5HQzQw~bU48kR@Nde2cDc6tCQM|!zKqcFSrv`m`niIF=MP8dMpIO{xi zm#iR34CvxDM{ZOjQ&U}wpr-_23@ie0YYRxKIxII{3 zSDGLcXF<;XF76gZ?xf?(h|ep;&`L=Y1q~d7)mx;3^fY})VX(Q6gNEczz65vQP8B1# zAhv@ewXiJOV2!-MfluO~zR5~cSxFeq`3e52ETHNv&FEKS=ezBx82pi9gGL*ESgUa zoYUA<*NyIgOhpOue+QV>t4}Rr_{Us8L=Xo4f)00(zsy`{b;K9vyrzt&Y$|s*wn?ow z9iy#1an+9+OUHN_(~tyV$$qrUI;tHHa_sNlX6hKahbG9(s+)|XS`*v5La8a~8Kvd9 zkfWDuyWtk2TKZNHl=0uGlL{o2f0 ziF{~+0_U{pySGB1M9H0O2l<<`>U2(7i%E}(qugLMey|J#I26(-@{ot|By_NckdG-A z3H_^~pQiJ9Q^*vi`Uo37};kx=?UP@)IUc^hRM6sm}}O9f-Olv}Cw z(6G@@-%qCZ4)Vl^>-#&CI*0i!w$tSQ8tbK3=MYjfAkEw{AP5j~EOY+8SiQn>-5v-Y z<^l!tIlSsfnv;!g>;oeaTVkH)x~LbJUu`t|Zz|F3{IQ7zPSRJ8`FNUYIJq_B3j^n{ z4yKhlj}D{WVU9=}RslxKy(K>cO$&Y4`%gD#aX8?oK$clTg61{YVAe{f$Uyp0>#7g! z&;GA|)c$|Ow=f67pVf_jp+RX*4J`i=n*aT$SIo+^v=%&d+O=c<^k~9NXG{aaOoMH+_SKNKJ_M6fG^Ssj2fV!7}h0z7lit^m_1)meX$6UBx>O|Ks27tar!& literal 0 HcmV?d00001 diff --git a/docs/images/prowler-app/lighthouse-architecture.png b/docs/images/prowler-app/lighthouse-architecture.png deleted file mode 100644 index 63202ce7c7bdcd06067d234b91654787803b8724..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 181976 zcmeFZhdIPm6bctbUiPS}^V8pLR~%H0=E{d_9$h-Mef9Rz z`={2*N!;MR5%+xbUS-rOjU`(QwA*x-upHHGHCV!=p8h1XlFoqCldy+@bG37a?AhkFBETk zf6DUz{x-37>H7cv++n}!$bWzKuGvmm^50*iZ~wnH{J&NDuQmKX)A;}QhvaX9SSB5I zDUN`bFJJz&J^0fu7hkWu<~@UggZsav8}jej^QgGEm|fJAOGZXU%=)W_c$lJbhNkgI z#9+u;8JS`kBi)JFr%LfUg2CBU6hTeF;L{ud@s$>0=JoeW4IVUGs%dCEIkWR&Fl`xy zQc~(eT=VGxyz2J4Z7Rmbai8nzGM$GFW=HGJPW8q|D7mFImx0PNPegdfwgHxLn(N^OI_0t1mCUzjB)$Ytm2i z@maNE#fsiafizWF*&F7K$%)3*p}V=bN=`Q{rBFHyF8&=#bD~ge@8z~xd*B^Y-*0oi za_m?07;n46&&PKk^F4O#*riM@qf9NYVR^lP@*VgJu8NI{;tmQ5nl;$3vdz=e^JTN8 z$=F<pJ%A$zl&1i6w! zhS{w_p`kSShda#%S~AP}zkmPk>+7qMqLum6DW7Hi`scIL<5dRftQSwp%isAsGU6YR zcs~AKYQbLx7by-oS=skBH8oGHE((YIbdU%N3!6?ly$MSg^!PFVfdkoEnPFH?V`ExE zLW0&3?>1|7Jw3h5ERWQXYU33vS4L!8O;1njzuf*l_D!!t<#$_Wt9k2eZ8m6I4-J0_0(>dJfX@;f=HVbB=tgPJq$~d4rx})R5%^NqKQd4$5l%JfOH6kbzU_+XuMZ(K&5U1~H@{&ShCG&Y zVe1$L1O)2lW~VbRzNI@n{X0X#q36Dk#(_)k*WbK-8_%8Y>gsCAvlsIqS?jFpE@QCY0u2g zvaql?DrNT$J2P+C5cT}|^NhLXH*b#ZxFH@^t#JDEd2Hy*j0~!VMnbscmA;|xZ?&?m z!?F3yTet3cSP}DZ*I9+YZ*GH!#|GQ=FJ8R3$7m%MOnz~_><(_7>WK~*{nu*K-=9|e z7^WQ+9W8dDgfjN0O&fcZ?=+xdXZNybe$EZUAO^|A#AN<8C;dbKM~a|s9-pwV3jPxO zF7(gMn>W4qbY8R$5HsGlaG>M2*EPI>v~nq&1sFPx=F$Mo|?PPK2vpZ$vxrE9$P#+VB;GQFz$2*HyT>H>GcW< z#boc{!@Bm}9~-VNTdAt58dJ{crPG$@ScmV)-4R}T*beLk877Bw#}YBK&$6(%R-rCM;S}!hK<#74Qgdhty>W#e3@i{>`S~Xs2n@#Wix)xp_U=-Goh8Fss%qv#!dZzvJWT@UKVV z;VF|N-Bp(2NmmBHO?Au6CoY(TDy4+?<0aw5)4_sylfS|cm6H%CXNTT0x(;ME6)X;v zYhj>!G5_)a&L)^H%jV7TLqoR29b8;oFnQO}+LH}0jZWJHucmlk{PN-=Nh1mh3e0$+ z*W5_N6f$d}?j|zp^@|sS+0-9scaI(&bs#%4G2AI(+u@BEBWC~W4DZgJuEbhttJbY+ zw90Oa`}$R4d371cC6Z)-ILX7 zecqp4tU#BWLW%Ef%g?4;%N~P}CU@e5`P*A-TMFH>v#W^rtvEu#H=0q+v%?DV@(-$w z>tJhCRaGAOyv}=)%q%QjU48HvqfCpYMmQDq+&O|mQuK@UlGIXEE?$hxK21=C%L#HB z&+~{Kjmerj@Dk)Ue8tAcTa?{pGyfcOC%bAHr9&NmbL^{^ztZLyjM1y+J6U-Qylw3S1HnDbR%ZHGIywY)GIK zb`?ox%K__AC;9(zdlIgO=au5mr>CbQ0_`u9fpz%<6*%^Omdnk}6%IM0prrJ;s_UDh=(~RYWYrH23QBYt`Q_{HKW0D$*eV2&sCKk7OK@H9 zBc5#%4)6c(i(e9!4@A~$cz$%*loxDP0iofr>*zUUweL#yy+-07?8QF~S{4gx)p_gKpTw#1x4TA#!0kC5I2NM$Gcdr&c3e zreo;>b8IlqXlCBDi5OCjDZIiZAKOUL;aV{D7LufynaP}TOf^%~Y=ZHe_nI4It5vmO z>C7A)N()b}SiU>~NG_1y)qBVUTkSpgpWAQR6!+zehE4DiO3C1_?(TR5lhc8)oS=w^ z!7g81&bDa1H(qZp5>^en8F6BR6>Ucv2qcgkfJBGHn2(!@2M>jP_%%Nl6lwQq6~)_c zTa`XGXF{AjV|xN7rKzbIxC$nNM@i{*GRB#>%8ngUQaYRbN~;?1{%M%X<3emuj_l%1 z{qEjH$RAs{sWmVZHeg`{lpG4Nts|Mk@Ad#VcRNUA+O!w(&!*to9bpq&ILS>q0)KRO zcMoj9kG4z5_5SmSIF2QO4O|kgxFqb7&w!uV=5*k%Iid@96{-CAQO(II3$%gK@$_BQ)2P>T3FOWr3{4fwx3+MC!d6b zmXMIpH$mJDkB;QU8v?QK*@!XWAt*t1cJWct{r?&D;uG%ch>2kUCt(p1c0YY8D=Q0h ziSgOWFX|26BR$Bb^$4K^lG+55i|eS6HN#z{BrgBBQ8fKWGDRo%Gciugj(H&jTkU*U z(aJkxhTzbTq|_86|M1bnhxSTYntFPI*{vQ*SvO@?-hR71zwJ*(cSGm!OrlJ?FN=Vv z-Op1gdWBjX0o~UIntB}+0`GAgc76SC_v~a10e!YbOy0zX1a|Mf$Tgt;yS-Tdtn_3I z0TmIRQ@xBf`^3bk*u$eoHJa(o(Gf%p|2EOm-agN0V?X|o^BSH@t|L`#wcBb znUz(e%Mk>GjNs;GJwo7GvaFKeV{VC+b=zb-b%5;yV*t6|8>H*J@CbhN=+x&G^M|F~ zCtl2rrFp?V69KpA*RCymK1~*~U_o+H-E#WEtS~~?ZB9=OgnaD23ee>Ikhnm=SZ(x4 zqwLoCp?|jD9|Z;VCZ!d9t_%{$^qigI7rC}m>1jf!m<7ME@ZYE{cfs#k@*I=Cc}`nR zPEYqgILV=GX_-9i@vwpi_#Md{9+wys^YiRR@0>R4*tj?lB>6y)0XwB@m3=gZBT-RN zf?uR#eeDgz!;k}?gRA@f2_?2Y$4BhRTgG&5W-@S2a->sdIako^YHSniX-7tL^5@Sg za1q2TFf*M`OLS(kz!&Q73`M&MyBk$ttnu2 z=mDE&JRr_T7^Q|v%&t#?)1TARdxqO%$xRvNwD)X6O0TS`8NAl?4D3{0&qWSof%rAn zsc?h0j#IPIX3K~m&}mhS8@H|mN3FVy@gR=l${p957UJvzq@Z|}fDnjX`J;ouvPPE9 z3$9hwMH&R6R+fQ$4G7v#ra{7R$P zM2r(0`x`fpiZl;6?bXdw?Qcpu@OW!Rv*qRjI(b~<;I3AXR031d+pz6BGyva_k5!Kz zy}EAeK`=kAf!6G^Hbs+hNMh?ar1)Ud_wTRQ1zuqnxBPM_aW%GlLS!+esO7#}%g@Zr z3=k^)8R&$0%NBu*<~{Nao^RR)oCNmmJG*4b5_$#(RnWU{uKjyStO0rSy>sV5U2pxG zeFa>JKkf{;j`dYQpy+$4fn0-_`%){V*y4V+-Seq4AU;4wU4w&ON1y$Iz5y;-oNsd+ zcnEIC!p^Q0s~2CF2;IQ~T&ShktC&D4(2PxcwM;)e5i-eif7m)89%{aF#fsg~abRMq zcp>tr>cGIy?rwoyyG{nGCaLWOb&t3lap=&Y|7cCz+}x_5&gKK$fQmHyJr z`ebqMZIdLF`}c3l!hbCmf&8hhQ)B&A15WC_+f_mQpb;cG4YU+%Tmhm?R_o_{7Wu-c zYSZD74uN~QEr3K3C)f?~bBDK~H3dgf%42~xa!cjDi| z`9Rf7bzf{L$N_?3{VTIN{$+*WcCLRbb~O}xd9CG?*6D9d5ux+9fD{Ii2JlDm z=|N>M+H-J+yH~5`!z1s5eE{SGkDV&Nx9vPxRYSvuIK?e+nlow^4aNV+Trhp$XNWf{ zYHE)O3;ponjILt?)f~wnXuwU1W7{D+S;ShxZ0+prVI(vdSfa=DKbm^lHyaL-fO7j5 zakwM^m6wplX?gkDZ-s6USD4_$3ebzpzr2WqypaOLt?FU}M+poJ1h`6tFHA`o!SzgYUA?;22q5^QIphQ z<^BE#zMTVoPR;$rj%oeAyKK@aUsqmUerlpKAk(mX9jI!id4s}%Hiw52PQRU7h7ZB& z)KYa4@#-G<4iW?vR7K2v!Zv!}?KbNsge$6wN)*zm`s#NG1T>)H#LJy!gwJ6wUI7!V zW!-;-c=WYv*9gson&F0ksSXiu44zBVFZM*9Bl+yIbnqU{sO)d9rvsU>ZU_bqH0o)D z8>-)?z1Y?B@PkuWBKmdf9;>GF)Pvh`VinG8+@+)%A?-oCu>ldgEX)8P_~ZdGv^x3?g3lHj(1??Nh&WDF)#NLH(8ItSi~TCLMc! ztyiYQey#iPG%&rLogKIfVol7GC#+ENR9*C~ty6i}u0AgBtc7!pLTXLG)QOY;K_jVP z{^42ag`I`EDzJU~QLOR8CgBDH-wN|9|7mBM$0BA`_Bya%eWZGsGjS%(YktnWHtHtQ zX57StGbsC(Zj#}KsQ+<=upR}L>yLw$xdi8p^*8l5n?y7q2amnmcsAi=07s~VBaMf; zdW*{W^N!u&SCD2*zrVRjnBQRz3kp;v?1R;_9fhF-vmEEtONbOiV67wOm(jy-#=aN^5KUT?4%s1} zo}M21T{0j^Ps!C~M44dOwhh?M6?O{vCckF0V7*wAPIOXgp2E?iN1@YHR#eo&0mgo3 z)R@CX;|FXIWb+1#rb+DU?48*r>BJ`_q+IAW-bl2euEbeL8S0!~GwG>?|FpzxzUjc& zBfREvtqaH08j>~7>*hOAg9UX}p<5UN8&P7V(bmrVz3 zlZ;!jW)o{SR5vxEV(f}=kAhK}gPPN?TJ;I4!5AEnsAd2hdO@-AV4g9W8OCN1GxC0g zS`a1URsV25>v&YOVU2;G128uyMJT_|H9RuEa| zncJVqh7K;I5>V~>K;F}$mS6V6*LP5ee-pK_Im4v?Z`D5aZ0j~pbxL4JNFrG~_#K#f zCqdnvB6CtiAg(22XOx~eGC$Q+?9gl!+}oh8-*A^rghzhk&NH7rgovC?`rh&SIuTtm zUB}D^+Va&Gi99hq4v*1V{_aB}BIiGQnRp-Ex^CcW?)kxjk$YtUoHnCf39qbL#oJuE z!vkZ={I^uKx9iVOl*>R=<|kqSA_GCRMEud*vk5Yd0xf6!m1*s<@pi9b#8axCUaC>m zsF8_P*eHRs6!D-eOTmmT3aeSvxqOh(W7`wFY(mvVq)jV~^~y=&yh zLp4h+uxXcuc%_I?lkjpTpsGuF%Kaz6X>#%ztCm-_h5?6n0(2pdRzE#-e%{v?0Y*Q*vz z|H%*Je|9bcU=!1hPe|a)1wR1I36T2hLvRsNh#5ebdGpIyP~)+;j4}lCs9e6BPH;BN zM}Uv-RAORcsEk+9)M#%sloG-d2tGp?PY_7WIR>eWSahaoEjNK!NMg#<{|2Bm#UK=( zt&tkJ3-D4;qYA9uB7O$pMg7EyTR>dT$yOsw=HXQh(I*)}?@dR3RR{7L`-8*mpzKBs zV7RlKmnypZN`4!3@dgAn9;(##_AD!HU9Z_ONV37D20}}VGmON;8lvRZfJi1n1%y8L zInS|w^rPgUX;Z4MR)KRmnfvOEJ6Q|4P>sv7X-{p^b5pFSs0fwz$fH}gl@Gcic$%(& zda5dtFO&BrW8*$7Mg8yQ3~I5b2Z{LR?L~$Eem6(=*2VYdc0a3I#whh17zOf_5_ zSyfs2%D9@naDHwYnXkw?uXiUAVkYKlOv13BgsHWAjE6h@`I-o7(g)uPQms8QGdtei z)KeRsw44h?!_ReRWl|7NK;;O`1gt)%r4>pt8}uEb`ik7^g^I{KJN~W1F88icI-Ev5 z_K+)xOVR8`JD`>EA<#lvR6_=I9siT^`ua+N{riVrP1`}F9D@#vf*M)4 z6Fw7eX%_IL4ueIZvF>Kih;4ep@9A{+NxQWiQW}`7im7SB-@kwFj>BKrL{{;ylwP@( zUDYTz1m2ROo3Ex)dcHMC#EO5Vroc*3um@1&v7|AO;t#82=7s~jOuyz_1`+^dRzq%0 zEt)b{3>B4UJUn_Icv#eP#u?h>4pl@&{}|t*CFkSL)E0S6zcMJLPtnd+(#>;t&^plg zV8=;>A{aO#d-*=G`QBO!1U!*TiX}V3{w{h7)nn+0gAJ*vL=vH z5R@|$FXfp4U{vT#dg?ltZ<2ihr|y-RpA6WvPcNBJaVXBA2QNnf_7g(JBB0g-_N_Ab zt}%WY|>>HF}@2rO*DC6S3*J&I}o7}Aiy!z zP+LG5%t+@vo+&%S5ms%yH4TVFVL_^U_AE8_bg(&U0Ms|vaJ_9(&gaq!{`#io_3kS!UBL3gt`%Ko{2q4(MUfATB#1icS$_V z@$XOhy&5l$tl6~ZTmZ*m2NbZAkOE0o{o7SFRbn#Q-Hk}n%!nh2tN#4i-M|a5egeCI zXhaRm7>GDk=sKo?+`u%7mV@Zs;}HG`8z4v>SH;UwAPf3aG;K}th=5x1e&bqII>kG8 z?v$lVLJWijTh<$9Gy_e80mm;{MrR6XD{rh(8`YIKz$hR`r94E(phu4!S^{N@yS%oz zpJuswdUk3|40Ml}OQ__PRN%n)UC*44$;=F0kMX@ag|I-pP&>=AmXy38wUZhpsmF|s z7tiZLp$=57wK1rRQ*0^n$p2F?qJ(8pB2=!yyum0~H?I4co08Z3bUO=b$`Bo3++8RK zfXRUBi}V3Y1buVvT#K?Ast7f!-X1%CoCSh93P_6K5>yOMazH{fth!9t1m-R?Afo>9 z`DKZ4>Ypv(=^*xH(^XYfK@T1%^LjssLFn!wbVO4#WapVD&k=MZ8eH!48=HK!uQ{w$ z>{*Cpmw>G{8|!NzxsP}~VKjJ_APeN_yBu8DKQbtw{V`0`tn$(BvX@S+**3wdOviv! zR_Pj~WyV3mzX_THX}V}8vb%TM zqCn%cd*9VAr+iq=&gux#R6w+>vof=+0y}7}=@>E?u@P>9;nG)g6F6<;~l-nFgi4{H^|Acf#*yM0d1-2@Uyfe@jnYUMd3ru$cV$jZv9CMKyE6*DFptS=12_9IiIL7PcH zB=^00R~4v=0JAv7Ff`6+=Jm#f@l-q!>KJyud$d`gd^vN__41(Yibg5eUXrh+ zXGhO>_D&TPNOfvxrKlmLDj~^!*0w2(jeq8<07=lbH#V3gki+9&?N8*WY=aU}TRcB& zgKGJf>4{umK7WqGT2LSEs|wl2zj*P<)Yzj=@j!2y*KE?#rAtXxa~x=)&d+qqIJR14 zvsHg-v(6S0;Nj=5e3GsV+kc@D?FjWNsX@z#t`=<>L>z(Gngrwuh5N*lO8s_Xr479b`lf%ME<^P|SJg!rH9|&xsg+_yj$JR~``e^FVfcD#W`( z;Yv_WARi^5w*qkT`H6d5cO$Qiev?;J41$1#!WP7**lX98k|h8-J@DraSsvK?E>tq% zhlK7CK_saEdv}w*(S6m)NmPi&-mKZjs@O39FT0qO`^sug$jbIS*0!$o+gG&E%dq3* zy?P)!(Ti`E>)Ka~X%)I=UiO%oac@XaJ`Sai`bP+ahEQ%j&&jR~=`xsZN$CyV7o^^U zDzkv3WPasmpc()pj0H?qhf_Mz~k3-s0Ll!1P z7WM9aRO4&mQ!rP0OoD&Mj%Wo=@5{%@D7+Y5RjjWk z69BF#-JxBIp*(=1kgpBPWWiD$kh~L7Za`&?L&v2nNGsPa79jdkM)TdPLm-|4A|e?I z$Nv#Dii`*K;sL024AYJir=|vzBOwa&^6>PKn1~f|n3=eY5uqCCH9e4x#Pe8KM1<6q zu`LWQ2EoaUjEqire@FQPbzOpjP;LHn8WCbM(TD&+n*i`B zv~mPJeYywLUu+$CJ|rmt*rHGWJ2_eB+8!3i~D?$+gu6T@p|H7J10%Y>a!}>p^ zWPhU}De(ykDj}a>7^pdX{?nF^-Y@<{?z>QD%l3Ffx&OK*?v?zxuG*Qk=cn zYq)eX5zz9S2568_c9=qJeuyrebLZ}xH>IYanr+oyqzg)c(r^QE8jpOFzE>f{9f#2# zWm2a`yhjuhSsJTPpBLl1UKE)Y8YR&Kt*xztc%J~+;OncBCwqJ5)3GZ{e_d6 zVh|)?F{8hWG@(HAA?XgA3v)L45R=I82TA|po`Ess9|6=uNvH+Lf$W+B70vX`jn!o) zNxxf>pzD)0MF`PB<|bDppw=9Ok;u!>Tz;{&*;VZ=n}o2Bf!2d;B;BB{T(^~!2<~d~ z|Bn=)22PGfk<)^dW(;KK*=NZ>>kFwF6~B5kZ9wKCb$RSH!HM8ejy<2Y@7Vf)|8Wue z)jk2ekCiNAe2;v#W}KMkaJ1r4;oB*2t^=;j>G6BC58ftNX+e@ zB@tlX-ey$C`~ewaiPS?{gOW8fh(44Fy%(5kwzOGH=72@x9#ZT??Jx`wD(?OJQ;SVe zil8@`_7kCrdDJOs;P1HpepeHBwBGc6NsnfVQ3Z2CeFQQco;e4|-T=~R^)*Kss?a%z z&{!e?FE1}70|32BbVXpZ2rwaQOWcMe2Go+WESsYshnyu^4*^^rsK+TNDpH~L12W!a z6Ae0jeD?F83*>o(Hy%`3TV9@4OQHe}Nx1xt0UT;5aIuG%xAmCSqD4+#1vrK@fs%U= zm4jdnx^|RKYM&pyP8%(q*o%E66^J>c5&6Jpu6?@+#v%I1sZ%}}5ridw`}=_XfP|=Z z0QP@fwUgjB00j2dwe<8V=x`c^7)t~|Ec1cTH#HFcAhf9h;1x~$SR>C;Y=UZF-RIcT z3*|JBGn#gGDwAqlTpSJ7ilRJe%|w(Lt3AnSRuRZcL}_43$KPLs08>*HY#t$N9iE>V zL9MJ_@jzP)^g$9K!2$q;gXd-ky(~aDi3A)fZbh?5%{`$a_esS?`t#?{q`m_U-3+== z;H3ga_~xRZ{Jcf5l=lUYVA@Ge4^>!t1L<`_U9`CJrDzZ+(y+rkiQm3 z_$HY`L$19^b-1KDiJWL96(bdSv?C!lNLqz~enpS~-*<8);y=+r;VGv)yoaEF!iJ zsl@BK4TyO_hdN>CC=YlQQd<>?7*yu{mtb(jKTTlXIxrR5sLLuw#wMz|ZY+@bN9Sur zpvJDhLQF;*wQbB$@_VGXNx; zq+=6$dD%2+y~H#<(7H}KyoiEG_LtNhV47FTI%kXd-v%I~n<5H_ikf}iSF{gJOo5Px zW!N%oP-BC%dyoKT)KL$(MxA1*x<u1Bow_@)t}R zQJx60gfg1LIEfKh=XPx(;DQtn&^l@)98wP*l8Cbef2*Q8P7DCgXyw>O-deZKeCD1i z(R)zo7W0~O_h%J4wv3M992)l19fDDnA#H(7mN#zRWGi={nHXl5@hnI$bQ>&G2h5U6 z>ijLhKj&f9aAqy|({2*7m3-jMXx>4s7?>X)Q@hV+}FeU1I}T2e42Ne^1xu!DOns#svP z3Z#VE%)r}a*!aM-pHW>($Ynh8{~*v1BLkW26?7Fe|`i& z2zATE^fPCTO6(z|5SZRMoB-N~C@FmHdV~O)4gg4q27*E;M0XOq(bF&fA`DUx)&Tvi zCr-2n0DX`Sc0zPFT!@T}Bt>I5)R5ooZrl-d`~<`=(xZl$1w4h8zxi>m`FQM<*{A16 zeec~&9l6g`gFZG}7_&^9Q1B4rO&?&KtLHZ@FF@ z1hE(lWDJb22P(^XC#QdAt;rYwV0zk04(F1Cq+?D3jV^F7qfw_9S}8Q;=vyd|B>nD& zrmArEtU98ze{5=uuZ0t6GU0$oH$>V605T=816n!@C+EChMD2H5BAJ5q0jnmw)Cp6q z{o;XEUqI1^s0m{iNY^-^#M8zmUNj)AWaNNCcb^F9r2nEW{%jM*IPKRokk*SXT5wsh z%Rgktdh5E?O#+gkY++4R=jUb#r%#0Hhe~}m7MGkI_$Puv5hRRUxUDni*Uz7($QTf3 zl)<2X{PQwe-N(ay$JBD^L4N*d0ofH#PGOgV&0 zxu^isBnXRCb=i^hMVLK$m?JTYr)nlf&Xdqi3M(yNf&k5S?eikE61G5kWcm??8xUR3 z<_GBTWBCD(4nVRog;BfyxU)-Xx(!_|-Zl#@?Ixomlo(8=%zG$ygZEFU&VV*p@}$ol z(_SctK#w&CkRl?T&F)lZ~zs9r3nek0#KZQT4LxX(7fE#9hMhi3WH zJu>yGeWpx)n;!4M^wt5=GTNA?p9Y~q8G-dN5FkWHh<>DMk!jsF^{V8T&IpQ#$e{42 zSC-AfXpTh-1YAQ8>aj9#JE{n?8T89(Np@^Wm70t}%Z9IBy;|(DcD99q35^~@&O zsXuEF)-KK}?5o$z-TJiDV6vgT9hwMf`1o9(cz&#@c&?#`b9BTC3uW5Jz=msJ^QWVbe z4H{@$ZULiu6cI7+ceZMphPSGl?U}Q{feq3!g5{1FllHVKX+$XzJp+h7)XZ#z(T^4r z+jVm~I(5(tW8yzCJ-uaZtWExaI0{uEXX4h(P2vLNTm=M11koSr%hE@_dyQXA*HF@K z>}#57v2zAUL%$J#PC}y-ToxK5QQnDY0QfGQG;~}gsCk2lL8cZdy=Aogv$0B(IJ2{k zEubIurLndv?ec+Wsu=RS7z{_lsV1T!=^~p2@-Izl&r|wfJfex-M?CZ|n@Q!NPw3+v zaA)9FU6m!P1h;MS>pClxfeNY4{h`hp95OjVgi-{zdf*voqUEi;y5|s>uy1v+5A4J) z(6X$S*Ojpj;pDQ#x5wviqBTyCJ=kEQ1EpIXH5V*8k38(QiZ@&IJai**n{UbR6@vN! z&AtheZlxi%#Xie|Hv>){7`b}7s4ABmH>-|Qxk{u9sno-;0WO8!K&+c4dv;U z|BO5iw3wWT$*vj-1%ucvBviZ5IZTnhL&TEB$NxNKI3wdWzHMu_Za3r1tmR-*Taa3k zIZLbEozuU+m?`a0I=rgl!42DG-`^uH)*tyLT2(piBeW?yr?$WER;^M z?w1=Iv_X4g;gECc>Id4ZxX7jIyqB!PWvW9<4X(Bh+=}8`cx%)l!zX9)Vh8IBlw^sH*syI6qxce1QdUrI9NWHC%6UDF_Hl%UrBQlHqfMaGj6S$( zMaLR%?>DVlzLes9X6JR=gHkmDWEH}&3TQ=QSBl?=yPk+vD42|0 zHh$IOBBY`aK%vmzTn@`yCHfp6*Vc80P_K%DaaD&maqEtxrKH@fHGLZ2u&^VEWs5V1n$S@&@^KmE?%lf= zEG;b;*4yDnUVi?PBOhmxKt^)668rhDKU`*GpnH{_y^QkjPn#d$oQobTvGxudJNvP- zXBpk4IaR4Q>w0CatOnfo`4P)e+P-MK0=l}orsn2LDZg7X*MyugUfftWGS|1m(a_;I<;C+yuqP35QW3KQD9-JRyw$~3{+<=h zo5z-b+DIY`iq#10z<{I9-&u4|-`0T>Cr_@VT)-QhQ3JhyW@onx6{}Ld8AKLEGOqQj zj?{@V`^oLm&SLP5`Y`_a|GK+@aL5bmHVMnGIZP!FG`a4`8az|SUO8Ci>a3d|k(s|f zH|L2nypI%kdydA4{kIoD^uU46ss6Nx!C2y{wYwLW+gMJSd5>NJD|j=7^80Jpl&QkXPn81G|w@Ck4v|6M~Qrf5Ih7L_O{nyDTVvND(T6Jvj)JwpZdo}3M3ZnpeSWrm__oZ^21KqNxO1oTLUH3~!@XIjE9W^xEf%aAR zeGhzmJ}M)gfD!NU#1XI^8}5{tigG_V#T8uj9SBS8cEm<BkC@(y z=Ijr~B2b~ON&d-M);>QsE+i@{+FrFIR9QOWq(nI4-BEnu2k|hubPZYT>tGjCt=n@N z|1+;Sm#;WM&C1H^-E4V6lpQ|u?)=%qD~j7?+E4QkbFDj7`z7fbcIelsI#DSc-_3!v z`svG;RdUMvg@v!3b^oz(0!!kXnkx9kGHX(A=Ytp;f6>s*eI1*NC*&Hs6?blwo^Gy* z%E;IVwLxf;pbnovxPyeAh^&M7`|c6vKe^quC=R{uvU~mAmTSYE3pj%}@ol{5HWqXP zv3lV<#OFj8eQvNBtomMn`_CQl*=tJiZ-4&e5e{J}nr<8X@hi-x3H}Oh;vZ=PDe)^I$UB@c9TDj)t}Enb6{jse>bj=heN0kN#9Wqf1qanZg2M2YoVd+ zXb^*sJb1vgN55z*dcZeZ7Yv`+1GHWgEPvz9oz(?1f2+O}xQKX8R_UwFhE-g;_V)V` z;Skw$jpdZ5Xh+n@vScGIHVzIBWGQfRcO>0`JG5+QXus!lYx|E~GLx$nVmIvBw5F`A z?0HlF@cSJB9jG8(wvPQ2y(0nz?;``}5~ z-|5q9$h^KnX46PFSRo)oy#C`w2IOs@o*1095FiblGrtZLANBGoW;lpRB0hEvq~`pf zcW`p5+;kinNlZ)(x$dS?{PoutylYLDdyj9u&*%H5Xi(H*c6Qe1MD&*o6GjMx0kyTt z1*p*f9YcAj>&0kRmiQj6SF7e{YUUY=+XKqVP9P8=I!;a<-iYloNcVA<4!E%2Cp}&0 zr`@4RDfTT}((SqwZaok+q0yc_>NE}AsUI8~7pcmBluCs$yfY9&I5?xEWPnDn3A7ci zqkyFE539yflPix*wUiK>VM+HSktD570c6_+$y!7KRFXu zmv=SUti{ahgW;h%@!9TUH*Ahcalq-zu+vVzzg$ImATmFHOJ`@NuSv>!bk|>x&u}F1(E}^&+_h^7 zflX-r3^_xWuEFs7!uq#w-#VkucnQTRf17XA^T^00;o;#qsFhqUWl?{go<4k7hLc2L zSFc5Y7k`G2`3(ZJKLnVIs6jdRr({zoun586HLismzEMb(FkrwLbX*O#H#X8ysmki= zyV8D!SH*?bn%-y~kd6&Y4vl-=Ib33#QGF;Oq~Gw_>JdIs#p_M|2zyTlV?Ttfdc?19 zBN47tbYkP38()3eU`&K1=enesvD@WtJr=p1ask=|mhRn~n`_chBz={Y_3U3#?V6iQ z3Gjd(7@eKHdB=_&Jp%(cYk#e-_Xcb=&I}1^!7Qr9no2GShc}8D3$xug7MWoneVjk& z4QR93Y71t$*YDoFlV{XHQb<&N^X1DId6{l(Tph=V>^H{JDdaov9ZTL14GrDRE*|}S zn)I=`|2E`&3o?HpQ>$ib{bS-%N`ec(#zE`uy?X|r-Cr^-HUq8IHZ|Qw&PAF-iw?RU zRQXp>V14*ZgqN`jxjK)x-}%BCcIV5b#{RJv8he0TXtXGeJ;$gG(W&n?Z~40GZEwLb zor7%wCr{Sb*O&AdWnha;1I~Y%nc4O(tMPSRK%QZA*(UO3)mHDzpxr@Y8`=|BUw_RdbHMTKfQF@b>)n*Qqpq`e)j0%w-{_5s4$8(>Ch}aX z%$2?uXU4}&Z=dHS7@S1olH7Lp1U~v>WOa%LAGc}^Jvi{wu@sBez zH8p)=zvbxdw@Yrnz5HgpPE_%hO-7w#JQV)&W9#Ipm%3tw1+qKZMY;A^0BF}+gRcg@ql6xN{*B1_)j@_`~ zj%-7*fG@W;^Xg_xd>BYvAH5O6^3|(LE@f!C$SBtB7Z<+;KtIreu>H+_L{TH9kyg|1 zAQ4m7yYUcj{M}|tX{!vrxFqp|ZOn34Utf6A@GHq#QE|2*=dYts8};`Od;7^Ctvb&5COeiz+_69&4Wq$nj-$nw$8q&-6-ED(vAxsV~c}`m$3} zN@Skw>`Kn8*|ny!$B(~NZqF}|ZtDMTm-|cgsBxy&ciV%;9{1pM4d(EV(DRfZBa^>$ zcq8k2f6Ww1wNCT?rpw%qLWQ*kl2LJM~=lX>XGtSeOv9HZjEfF z?9;I-2%6L_Unkv*Xi+gLiK-I(rkGDJhUyCOb*t#E^93pFdNoYr zqeoU@@+(!EWLSpf5)!)VEalm9TN`VHe9+voXTu$?h#F22(NCbMi05I|)YpoMs>d*z zfjZ-Z;<;H<1?x=Ho7i?|UL&7_8aBC|4zc@E(iSTu?D)OGG zc*fF_q2xjJI8qL>*pE<))T`}-!LNOgkF~X1pB@Nhk-J)L95&*zVO*wmlG$Lue)R-) z2A`+XJuN#Zx!E`Bsjb|{=KXxn$QtyVS#*pZ23v0RYknboyJ$Ls5kn2b_PnXTq*=nU z3`R7z=KmE^rOFA1+@R5XN)0AZX$#;)Q+l~out;0FcSy0|;Fx+3VnKgu{yH2I^tM!t z;qztK_p*5pAjSSehwk8X>{gsn5JV#N`k?4~c`K8<>MahG`(Lk=nK+7&XMkfG1gMx> zSRixI-q2aUB-oUxc6zmi55a36DH(0fo5Fr}zpSW`2ZfR4W{RmZL*hh?J{IYXeEaR2 z9)3lx>42IvG(AflkN8tL9inw1oF5*Iut&|X#)uGd=~k{3+P~i$Wj;|wb`-SVP`Lv<06Pw>A0lEFkitigYu+>W6Aim>nAgnq zV`MN0zHVc)k|G6qM!BbY11bR{nw#J32#{LZ@&3%3hZQ$KktV+&Eyb$zCMa;!@>{sO zZ=DD8@kw*<62LTJPxkB=6bXEk9rY~Pq(OcF4^}(lvwp|Jisw3lgd>Ml!=~QbM(YR~ z0$Y-@tl;<=d(SSnX%MARGcof@bXW^pw#DhyFBo4(=zl{bSUWL?s97 zx9K3RSYK6-kG&2M@*+Oj?+#MX$g$m?mzQVz{pRL3gX7WB(Z{7%QmMeST}RA1PCXIM zoMo}SB<-V@7F<(nD*DDeQ%Q1{i8-r7^7dgeQd!xNs|x^=N#3AN=LR$Q3gu_}#yiWg z0~_uv2ewAVyTF6{!IAx}vdC;-zOYVBO})T@WJm*uL1vsa=9zDdGmfS;y}hvijAW}} zR#;C^aU+`J6KM2QYS-^al}qXkzGSabe#bQmP63z(GeO_xp(oQgbHmEXc@lZ0b@j7j z%FLS8!+LL)DsSHyP#!R;vB^(v9fLm3#ZcFzg3m4R5pkD4U#$rE8%>^2Bnv z^Q{(lTB&N!eainiOHs?~dmV%=X)^@~jQsAky$*Hj%r@&ECy|+(dvU6@hh#0kcH14o zIM^-#9b#D_wSZRx{&5E>Y~Q->c%7(hwDP1&?Ja(0`pDv9{cpvA5Z~T@2SiP#JwN!Y z*HbJd`ThC^o=JDTTO#;)t#6Ii*~b?`XNf^N`7+LUeM$JWH3STEbMsI2^~mhzpBJMlY9ND=c@eM+5K_Hi?E4Rx8M4dcjBWO05pO`P8n-Oe|f*TvP<~P&W-rr zd)^`~wyFQ3c-RA__<${*Jq~%}q9sLk9>*fj-M82fRojysV3w)XB{bk9iK?)J>MH8_ z^UKnjv@_TFm0ml-b#BZZ7t#@IQtpP9@;#y3DpO1OJWgq87wQGTNoeJpyR-i~#+$J} zRq9qw69GB!E9DN@{btL;x=G|O5F>6^&O4;eY)6QuuIl~=Xg=dc_Gv|J{$!-O4yC5D$ER;HaUYlFdYBx1^Ng9nG z`~c~woW&}`xaFsfg~fFMEi8IX_rt4l5cxbj4kL3H=%pne8*-Kc(t&0)Y&o z{iT1h1j;`+{quR*QA$Je97x~ z9RWpkqS*Q$s3!-PKQR}7ee21rG9UB3>9Nh(EJ3_Kq#`VTSn$s=Y)#|}QDBHqr&8& zJ}QyPQA}hXA~ISBFbQhPyMx|~nP7BLFL9vT9b5&n>l+1~fSPGt**)@dsUeaM))asn zC@wyJC7xua2fEn7?r-4Wz+6~ZC?fqhiVxK_WI4OK0=s8r4g(4A=rR)C0sGipmkd&< zFl-%gf~n(hJ1A{4y}XX*po0Xq!HCy8ht_T>9-Wn?mUYP7)D(x6+N}9}m%<1DfdFqv zODBWU&zYSYR^tN8uOGE+&034z^zu)i)zTXgLz z03nS%;)agC&U=QtE0+ua$kXYZZ#Ah_?GhRL@*}J6rbXR06LT>?=ehIC9?5bG`H2X- zfp$=-ybHYGy|{j8Tt$;(*9ce~^aUEduIvkSd~!<3fKyecHjvbd6Lq4j{$;dj)vVQZ zqA7iDI{0v>7N3O_Q`o*J=1Ww+qqF3Ga6cshj!1H9dAahQO_6-`2!!`f@vOfid%xn+ z{(}d7EX4&542y)^m3sUo!Rg>uPz2m|KPv;3g;69#EBrxCccfX%E0#4S4{YBWq(4td zSqs(%rQ(z5TD>%Ny|sf*`H?hQ!G>?kx4^HuXYHjrc(X~CeN871-)ESP*Ob_wp`*qG4E+hsby+KDkp4Jo% zi45&8JREMnh0dHga{)a*6FAv+&mygG6ApQ;@*MWlM__tZd;GP4iLFnQA_^FntHH(4 z7e{A;a`U>P%|RQ7optCo8pQd$zHmQm@_e_8kBe~7{Ii;F?5|P6j-|&gOEN82mHt@2 zcJ5(jv&{J+;js}MdEj^7K;3tKP~h6(%bYN%hZU-hl3~?qVm{xHldQAV+iW1({4MaM zl=Y8QP6M|sU%F&c`Z*sx07+NDX3%DQOvAkHE3qU7P1!DgX9k?x`F56X0SWv^^6cRe zV5WysK|*MMKUf&lq=%8EJw1Gs_x$T>Y5c4VmFD#6lMK)M=$$S*dKtyu`m#Rtt53>S z1HpSDWAu}WqppV~BqUzoa}X&ds7XfB_@V7dNJ^4`mEGDE^bQ;({wSWJ9(c#LK=tWXa?vB~dydO62iwB`7q2#HYnJ@B;P>jTA;iaMaq$O(i*r{e=(*i00BI^=JxJI~@L z2P%kcUp2-daEd8tGxrBt@&_hnxd$wq$+tJ|ITLM2qIh52a;lDgCaK0hfj?q zF)(=d9)FzJeWkC-s&C#`F-0xWl2d*1&~TyPoF1EwPdPy<?lf}9Hj3Om`YMh(Y} zj+|>YRq`*j{E2uA{r$fBZ_-{3?P>z;3wPQfh#@9`yyT#%Y$&(JW8K=dYZ0}b(Z+Zg zozT&_xh`cdj#{1>|M&0BciZP^(BnTsusJzET!16Ypgxe6PQ};NsXg-9-i{Cp&W~h> zNb-_)5}Bjcbo2=e2jzZEH`5*2I9)fR%s^+$%YwUh?z|_NA&dEa(1CII#u~1W0>+|a zG2rkswdWP@FKuePu>W~(E}L-%8^(m-Mf9seS1|xV_{MK1Nu+2P_siyFo$FASc{V(_ zcz2apRo6=f&SR1Hlm8-+L1v`xeGTM&Eb^03&D9J0SuaUSL<(Oxq{kAh@iu+Vs;~I0 zdZx5{18+xPERsZvW(18~%F8_3kai4x1^6%-_R z@_~fI#3nZRt)RQU1dTBz>P3H9zPk3O0PBFFOw9D0lz9V%|Mug@k7?b?nwc5sU~tFV zZbLlB@liLa$)67?T*o)oviI7|{jx!Bf|iHU-q7dM`zo4bc`s+q;jrIjoSOcQgQw-! zR;>BiF!w|J{DFda73LMt^T5eYu8<9lyND`X8QYFt2QBNzeooXMg9sncWHIHQ-rlP; z+9`;iIOqPVfuCD-eM(cD+gkN?XCtO^6Gcva?tLY-82}Kc2yWDLAJ^6022~Px^Lkv| zP9oc)|0>I5V}|*=UvoHAL=9@hNA5KkZuXPoc_3`95 zCSX0b-P+F_LWN8zB{GJPN&}gROi78%8RBU$CNh*Fb3!zbAr+zw8H-AYlJq1(gJgPC z5=CnNR^Gi2$Ns+kzSRGJ-`BO)xz6)kYehBR6t9V3$85tB9(TfwaoILnd9735zJ09& zOu|g<7Tp}me9{r^uKo~|>+bni+bo&I7tME`*|O2zISgFI(wz z_Lg!$lRBdFbI^@QBQP@v&eYVDdo9sL!?W52(pF*2_K|*pikU4^FWgdfXjoSUqYB+A z4=#D|qzcv#kd;f9dS#NX*%mxv5BiT#{|Dpcx(_FON@GL+C~X-g2a0b`QM`m19xqpY z{rdGj9+uto%XF9&9{b4KYjalFAli2wI#KG%y|)j zWF!C65fM%4h8YgM3=u)?Dn@d6znuAFO+`i<4tpTO#>dZyozg1+ z=5A4`*1h&qPEYL>a6I#)RE`2ZP#}pf#PnpQ#11eqF)6&n{bD4qb&*&9%%8i?eo}Tb zK6CW}P8B11&y;Sy-oqz>sR)Bv=4QYW!()-kXx}nE@uYmDw$|H$NegUdbXyc_Tea5O zI;wte;N!L?tsZ@fp{tU-`mkgRDvlHGsTupf|M-#SE}dZ8djahHOW*?|pHW_q!|be-F8^F-LNo_k z8i&8}t0PKA|BXiHx@=lRc^=bucU;Ub3SB~Wdku|4=hu$(-mEwbUgjya$wGaj|H{tK z=uLEO=Dqb?Ln9T9y-g0!aqmf>wX?Ikh(U~$bdPd!HH4*`kkHqWPap^Apk0t*lHd+VBf%DjaIt%E>BPPKMUj*jpIo@Tb=% z`WsV!H?A-IW}lfC6}X|`lO-!x;%gC^un7;DdSg~p&z)Q0hxvmey8}-4Bt~{tO*8W; zTB!W?bJ&wZiuE>kbtvIe5a`7wL2bl&$3vbBpf!jp^xM6uY{0ZsodILQXZF#sJ^?TJ zuF8RS#dEi45P;$xMn#D%lV9P!Xw);yf!6O`H;wGJ|7;(Xr0c5bqpYoS!T@b^5x#lB zG2ccv)QF6nPaXj^f$Y~|1E2KBF4-75)uWG#-pGKL9~EsL6~&mqAC9xOh8kJ$<{wx! zYCKZ1!Lb&b;vE`y2|IfB!iARTBm8f2Z`!D44eP_s(>}DX7a~t5?;qCOvubgujN7#C37w zCv%FrFNF9(r(txhb7|i2>R0i9W@W8dK?9QK^bYIJM)n#)F%@@9-xDV#F=jX_B7;13 zrlqAV9a8=COU|~pbTpuN#^rDCbdmnLlPmo#yI&#%RDTaQPZpMqV!+xupC}FzC6d2=+bXZtu4{6k3pvJ~DG`-%8k*i#7Acs-6UGC@a7d)P>U6^yg};NsI_e93rX}XdmlN zKN>V>K+cGH6147#u4+@Gq)o1_s^s0Pp2v{uxRrco!eVvGE00_UAc`6sTk+CJH#V^C2#CN{7yjlyUGF0+wA`=z4MVy(0lHT68xB8WX(^W&LK6Z7 z(g79}s8HnE0l@d6q-2bP!`odpMaJqaq0x-o8YoC4PgT7X_yRcyh)koJs0!Q%R}J|* z-`#JkpL4qQ3iV*2Ur+9PlP#GW4yP7@R+RUq6m9+noBX|^BHzmMS8M9+dc#_t3mJba zWTf|=tYxD(Ww++^lW>NI2Rf@BUN!Kq^+1)y+P#{cd9_MIT|J4}Bs(3L4=3mEqvWoCJPJFJcco4bv~+zfA|^!YzSN?Hn_cPSE2K?hgpE!1uI0N& zYK!-3rx=4U)i?ZBb;~K$z{F%12H3)qny)1b`>QtdzQ`07$R@=iSKF)Gn>F4h;;&@v zyq&!-Y)&aOS}^3bRRCom^*Zue+Z&Cy4Hs@|Q!r+a`ZQ4rgYdPy%4GcM13|U=$F3WP zb+avUYNHVMDKZKId-4v*DYIQCTJvMlxPQ!Z)u z`jOqlBStfC`BhbaC$8`WVN<&OQ~e%t!kt+4TDr}vu2W#Y;K7bunFMq>8aPP0eY?c1G6w^y!Q ziAjFCfw2WUK(hsRn`kD9KS_?(-q!s0c0LW31F!1SHzrmR7vyt7Ct0~c z=gyr)`YyVU4=a8T5ciz@b=4VBZTTMYmC5}g?OZ!A-zf46^JMn;Xt*n4#-fJsN}fNQ z*vfRgKAM^Tt?3#(sStFQESfk9DeeGd76i&Xnl2Mk%xhfusozXPul?Ni$iSw`LxZ>! z8Tn}LshNGku3fXax}+0K`k;z)I$M_vYL@q)5A;@jY(Z#hBen4^ z?Bzj|wgKc`iSxke_-H7x_&?DCB;1y6>gAU_HS3;bwSB}ni+X!%I>sM9G$ZWO$jd`o z2dtd7Bf+NHeic=!yC@OtFbMUB9)=CClU~&Tb9Cpo+;VMZAIOQ4&yV^`8vI#D!Woa* z;ZUzvZSTg$Da334afBm<&AD@Tj?{KN{vE03uPH%gZwgcKV2zM1zExH4vbkIz!rlw% z?btW~}o#uDg%I4VN0fGvg@^_2uo`M`LQ)&iCo!q$7%uWE?E`;KPifvr2{ZPbf&+H$H# zGb(-XB=qLf%*<`vW%6szzyBfb#S{#8TI{!T&qur2JF41n4oOurjBw$L;}F0+^YRiE zFnb@zcuJo~h0dFjY8!Zc6o0)yKQw=vz9x!$z+%}1X*H2cYx+J%L zTduvSCG7dhc*Sf@o$3FVxrDba}EZrO@y{npWwOIA;z9oHoLfu^N z4ug=`62)#a4pbCQlKpY27wXYJ(_4kM_QNTsJ3!L~L+{We>F8!SG%^PIGE_kw-?Z?~maeB4N;ZV;9$!%wb5d zCM}!?{*)zKe4MWp?kdfwci@!y_pVp0_ zk?vVDP==j|%Zs>)ql!~r`8?drTaMSv>#jxT>R-iBaO>BnDAHscel-_tD|vyAA;S%h zd1ozaGw&7hEzoPJg~~x^mF#@BVC;{Mzy0IvBf%oe;EuyJ_8l*CnP8U zN4RRG{F8iI1n)7Sb(fg<;^M3VbarH)IllC$(ss-S z@^8oL^hW}Qt%Ewn82RAGCV+%%OWz|?bQaG+BV2DurL{a;Pk6JKjv`OXog(uSjZLud ziA$DtilCM;i<`CXm3Rg=#8$Ikz<8hvA*q9_Z=m&jy#N?s^Pw=u)H7H%`lxZCMww_F z4p0x%o^<(cGjEG;FSee2q+GH#Y^%$SpBgHsb`;y#2Fx%zcJ|xRF=a7pUwN<1UnR;M?&I^fL8 zSkh+4$oc@jN#SlUx4a1pu=CyW}&&xLp#T|LJKUV&A!g2E8fCm z$5fOWU!o3`xiED$iI*>pqZVMy5&NXV9;Zp0zMs@g78Yq&Py}XBU)sVKAPCagf@Li! zXlpzUV(Rt+24y61+J#>bPdbYxv?2E|F)>usB$%S4&TDhG2%JjPtm%(A>*dRrX`ec@ zc5F6k%DaH_fTYH2alGoN-sSY6!tg;a;^vgfPgH-!xRgR{7yf+@5!e}zpcIj`y_zOm z86is$fDdGbV>2d5++)(j)7;!Xjys;_?kE|hGWN--7_wfp-%f*!sZfl(4+NBl3L`K3 z(oTeU22RIK3uL)Vfz2s0(MW-^*z0b2^R?bAqobB*I?Vc3FSC_byAwMeF2q1;ZQT~` z49vm*o;z28@JQhRqspxYf?za4;dpe1H;O54%GDuG*j@=uKyz9ODf7YD74g-{WKvogPxr>_JK ztT#X^H+MZqGVq@imefGBA9*v{x{)vt)V}r9mzDwI^qgK?tS9V%u31@Aqjo-%THJiy zl0UdC4;@m&vTNV6l6mJsn0NO_uwF;=+eL{hw7OcSPzitgJz`25e3<+ZS+xE~@^S*- zP8ar9jFs?9_n_H)e*9Qt&xDrZ+~dD9$4#H7{*Rg868~;B_Bk^qUjDo@c|L|uD0ziF z4SUL5-XKKM?>~QbZLd^c0j{U?ey4xb*Pc04Y1_x5S()8YW2H@>HYSxf*z-6}<;1>q zCMu;u;xJQ#ctRWZ!FV^{Vi@p@7cYEay^zB=!c{lDmYnYvIq^($)w&2%=L^m-L4p4^ zLR=L8{L_!BS&oT#aFCRc%`eRia@jWG@~0_ngiYoTz?1`zo*X~Z2#AEn5ZhpPdT=UO| zF_%a$ty?xmTV-fs*IDYXISO%kTbu8>K49s!R~Z;T=|X_ik8bJNZ}>iP?dz2(OrgKX z*a)#6i>bK=2|17H2gwNkw8MEp!r%RGP2q)`UyqhA$k@@^VHRRCO`2JwKR3{<+^lqZ z!-frIG>;0Nqx2TX#fql0_1fjGT$|PSs^Uv%oNBw~Xg3L0vgi0oUW1^SJ0Wbn_NLLA zesR8YyBGYdSN40`Sre6#SEL8ZMsYDw+hElNv*BUK`^gz?tE?(k?Pqw2fc#$;B&tcMk|nw;8On z`qSdr7nRD1k9uFZcC8SjLkjp`tePAz4muDXyu@8*?yM+sS9{IBa{qeIKuf9fNgnj% z8pzdl%86-2ChHHVM3(B{pcxR`N?|VJ`d-AjbhVo`ONbmIIO_I;W&5knEbS{#6F7;zrOEv^sc6D3hOc-%xD(6@qe+OVV;miI#ZA8M_M4@>qZ(3cfM1oFf!sp2 z7u~|9ABRIW*sS`~(*jte7oA}4oTng^X!Ym#n%;LR&j0i9 zQE1N9H75u9Ea}>Fj&9~stYW2}+ww;B@BY$u=j2n&9>v=dnvURY~DJfYeab`83ZL_ii0&s}Nh#h~VGn|UvMFtyG{K$_YPCtr0or6!?? z*=8b*Xe2Tk(kY*|*QZaPIzKL#7Lnrabxz=tEpaiI;8}qc+qP{J3r_q7h(SsfnO1^U zGV)|b=e)?+wpGmtx*& z@UpPX@ayfLbFTmRIW<7v*mx&Dzlnk~L3ci7QEcR)$n)n%fj1COq!}xBRpvyI4>vIs%~KE|@olmbI$8>5$$2ZjP9NKrQF~ZGGbU zlf@&JFYk@6)@oB}gKCmi3Nt2sm`2gD-RxB=fRc5&j~W>No<3)g)*CB$^~LH9`z_9* zdgX;dxp=l37oI6C98&JI^x;izS?cJourJ^DtOf=$2t$9j@x5McUV3yp*9CY9Vc5qu zrXdfX8bCj(^?#R%USiId5%ZB-e=uJf*((tuuzvj8evbP(>=vtN*qu8yyQ*#L(tDFS zc-Vo`oHE)-=N3dWaG9Hi=kz|)YsK(9Dcq&9bRNIX>Gh3@vxR_SqfRGdPVYIZh^{~? zi+OvkQu7a4PN)iOhTMqM!~J~j&K2tB65&zUlsUQc{pX#T(RS6!-T~vGu1QmMP@bNv zu65QnkwzOh>wK@1h;$;qybXc;%EM{z!<5Ye5_bZf$npZwqG?|WX&Y^ht|C`X`oUb@ ztS?5{Dm3+J0Xq)tLjkI7PIzFViOat>**9OW6v+WVOOQpnd0(rd!vW~1SOJ&dA9dO%f>j2Yb7uSGAmcxp3kHYEO4f)%XO`4-{H3zx+Fppx`n+vWjQ=UH^F}?GS zlKqssb$7+yx!zx+?G|L9FXt48PC87zvKN5A4ldM%2Jn0|7$Zy?3Ic1*d1a-zj1=e= zCIiX^s@rr~i;bmVg2OLW8Ez%*l$9BKH|a!I>KdysW+$1)coEPqG%3sE5}>w;JxYxe zr^I#?{_$iSJbiVdd36H@A8y0+32*GY&iIKf0Gx~p>BrwXx2r|tZDVy*j~qFYK$Su* z;LKI2Dj$1!LK{t<&CxUXQBMMO;T3R#Esm8(0PN*|Kv;lZK0ZfFVd3(ADv=5aVWa%S zCM6ACa)aP!>L6-pwHenxX1=%hpI6?x3?P5=6EPqEgL)qty`V-27x+MW&9W(SHNs0M z`jGYcjRZx4cK;Qty%mi~Jh%WjYJiG!KQQR=Dy8G;ZAprBoQTX~0q#W01Xg*?@umgnQWpvks3*8Kb)kX1)ET)q`-`uvHv}a9g6D zFd%&jw}w9*oUj361dR&dvk32W63$fGUnT7_nt?2QsIS)tuk~c@sBs)(PH>%NSc%6( z!vf~O0r0Anyi8Oi-rxd#P_G1;4%*bZtq;_zwN`NZH!CmAq|ZbQ5^y*8c&x3tD?HjV zhV|#8K{j@N_h&5~2}0gV!f|kD6`r|+;eQX+!qoh{&1>ZaO%>hs!^Tk!)p^T=IWRFM z@VGCwrqGwrS8%F$un>+5M&y$TQ?B64!|e%4zSlihI#^47CgKn*EE9ts z4$heu=gPInL#gPuHp4O4M(x>#wv=SB{Uk|@!$MI&6(&Lcwv-N>%3I*%u{FqauKWZTh(zhj6yurb}rdEB(&{qP5AV< z*I!SX$v{HsLJ76vHb632(8_aSaspFakOYL{l0I`oX9XO)uS9o~i$am6j^O$B7vGkm5RbLLEAM(hf}BL~;tq9E)#bR%uL4eM{IO@Fg- z%$V85zcoG2q@9|mztq3wxUrk}4O2a!yzEr$R>hso+TDDSx_b8QceO?NP&Stg=vSs?~IyV#Fz>p8h=pfBoKe?E2`ZqZ)1hwkaqvqtGMJ!%Sm) z)h6@k^x{8TNY57uWR9=>!jw9f1kcl~-kqw&tQ?acbaFaET$4<9>Lk=fEr zlw{D2Vv81xvK+a!h0D0_gEkLtuf%dyIS#C&Wg7hgy0p?VA6B^j)1~P!FJ%k+48R(747rgaVd=7EVK;6ZW!@hKnGw7PyYq*bYv*{| z(c5Cn_|vY9)lK~dnbv->9m^tAm?LA)8BFFJH-5au`5C-P&EmA5%r9det?%yLtH1V9 zQdHbGyR0DQ>9Q-_nyIuLC=K1CX`aU1IG43+bqx*M)4Fjkpk^Zs*zGxt#dB16@Z`xN zCV`$heL925mkgyFv1EyONiQ6EIryZmLRm#c5lgV&2iVN{*j9V?5{3Cp1x6O6)#60M zE(HfZfBfTu8Xg%L*`r4fvC*E*TE@q5pS?Ub$8h7XLF_cK3^op6*wSvMZZltL_8@ny z8q7q}qU)1Llh&~COrw&v8y+Q8RBuR+4mmJ`1DIxBVrFK>dz{{@Eubi^rmKdA2A7?u zzjXO>nk!&SN-HY5>FXb0wE}xWgBMLY85YJn8OGu0slwx)Hu`()|9b%nnss^ATAuwB z2r=;2<;$0!K6_>X_GX@GkjeT345m3ZqqqC*H`hBw7mplcRajc$qi$Mzd1fCd+01|c zeP3e*+Z>5|CwxMbu=VFc`gH;7dkrn@7p)b!lFJiztR+}YAhY>8*kgfT)dis z+GxJ)KGn|^Hrx)<4N&sW8IZxeqEz;=95G(q3k@kYDqP!ZT6*Yb4byJT zHn`uQ38i@Hezt)!cnYfvW84N8-#SdsW{)0JkiopiKj?wvqM^KXNmBuC;pA_eRhpL8M|=U zxN)MYoO`%dlK`%aDca%JZ4#BbKTIqK=+l833OT{*stxaL7mj>^*M-d(jr zhjFV`4Z;-%%iGj2scqu2E6-lPo;Ye$BZjqkkTr4AJgjnGvgCu+p{t)FR(SGcC!Pwlii71H_IDbZp7Y)42?`OFLj+cQPyM zPNvI4PS8{vn_`cB)vSfFWm`;n1tS-4-M$^%{8sU-ca11EpaLu0S1>Bk^5~!)jFQ6A z(Q)_oh*kF)zexO7 zH{TS*1aGFt<(sVjQc_|ydGgb}n>>G3&RhR)$c9&ph!l!xdn?U7qfctFedEz0fP!+n z{SCYDi1eBrdor4t2Ds7K3b0^M$DV!qEW|dI)+C9bM^H{Mx^3)!^Z@e*0A}w0onl?< zJKO>bX)a7kPChXss_ff0ZH_rsm{gN#TAM;b^0dv(LqC05hVv;IFN#g^XLI|pU#d)b zX>gj8!tq@-;5^-Dfy`sp6^)xTX-&u>)eAIwmHqq~e*E}mTn%n>N}3LPpB`!j{D8|c z@32|XBGn~PM zvW$$o{Ot(pbf9$Fay*yZgR~kK^VPp9eU5da%)ftRz=8*lACEjeb->bRI*yteJROT_ zebvo`w#ppl(8hLfqcS3!$n9VO4zJB{{Wl%wt0RZ4TW3fJPfOk(;sAg|v7Qmt=(ts= z85hmC)Bf-?XY|?7KrRg4-50%Pwt=J8rj`H+02<*DD8D~6G@a;8?{z|EX6xOf-O{#> zwfaCEzA!D0S-b$4Er_w z1$Rah7o(p$;=#cRSuY{cVR75A@cF~&+B}HeBt<+{#p_+5@;0VXWJvmN`8Jx}# zQYj{Z5R>4yC{Y-Iq@t|6+2VxrkJxQ)@u?er`BP&xaNKr~r813`+7Da2xH}7+)`X~4 zl$Gt@P>+XJP=B0)Hvf+-$h3DD(<Tt+EP3$oA-~|&s94o@w4F?w zI@My?vQO(BuH`tLn{)dpyDRv}7kV-w!jS=S9!voxQW%#s$ouk^$F-Y&1+(hX5e$0z zz#Q7|M#|YHK8bh9-N>>O+5zN#$DCB=cT*=hySXKjH~RI9F5kY*^q4k?8bFY;>`Hy- zl+J4$G)ihu zgj|HyEp#?~x@1t=_IJd%E+!^HM0LLHjy-!0&2}n?Jd?GIfutucUp~k(HfQG7QCc+$ z>f6fgPH9;9JMS4$-OS8Fm@3WMs~YjT~TAP-Vg7o-IlF`D(d^K%RPIV55r=raN~1syYb1r$;E z5}-x{b9)6KIG6eBp2i!?H$*Hsk+Ed#xN%zj`t4;aHM{L55W1->0=`|8G}nqV?4^7! zg3wG10d2~t5zb?fp^Mb{xL24?oWd);o_Nl2t)12N(2zNr3Ty@9eeXMZ^btv72S;bn zpf=|0{?Q%j71xp3yMjqBTzJoa2?OIRAbiG*?c+~tvjsNj+YIQhlNn=WiWQ?EwZZ*> zxlFcKGRCj;=g-6X1F}K%NmtUG45r!Gq+o_iqqWay&6oC6HVkAemfp!(9BVXT@v=c3 z`K9eyyw3UurS|oYMc_;QP$?NOh{eIhNDu)9p4cw>N z+CIcEOnZ5YB%Wt^*eidM<$}*GWKCu6MvQ(}Ei|Ha5aEk#Xc*{QBk2TwFQ2 z=x{!X!-ow^SU*IC2m;LIya0vszKlLavnBg~lI7+4`Tfptoh3)*%B1?rpwCI)zZfoG zvIL8ucVWujX*>%eD%N>IFj(9Th}+2X=S=%x0_10rO(Oi zOTRQYWzZ;|UAlJ{q{C#;pymm0qbvF*UBM?9OzfUIWy)|DmjTQ*Nydynz1N1m@9yR# zOPdj5#^{s#rLjv&?OnT+SoyV!9TBV)7$4tM>q2urKSPmKR8{XWt5~dpw&DxDb4S2^ zQ4zM>d4wJ6lgOwj@X<+n{Vr(SP}XZl&Z95|YASUy*u^h`hN59FJTh{pL^cMq1F{uL z%gcv`+aKDyw-sOM=4!^y%P7VN5CVuH9d}5cE>|f??GBxcRjs5$5!6hAxDmM zN+|uZOs&|oUJRaDfbZu|Cz`t03Ob!UIYGb@D=l}AKFLWTqhPlou+Vh0VLGzO@Rvs0ZLbAnDdD=RC<4`k{$z2or31B{{n$Bi93 z_iOHTFrP}hc4NpOa3#-7rr5Wm(5BD3x+>lC{Xd?+J2_vi7h!katk{ioMJaWLPr^`U z8P%oIwrw&cl<&@+#{X9TRCg8~Y6wYMxpJvz)!>;&_qs68^E!Dh-_UIlaxY7YG~ zGVXz`K4BoMXPrj+dM3hcUz*8E;5=TDP~{L4?8-jSke(~cmFc@H!qkO%%z#iA^6mFv$wO&J*JSoI3w=nzqFAj^PIUe*RW z3Wl|}uY1SV_c<_tW)6TbU*M-jw09^_a2u};9je~4*kvszz{ciqxv3;C_Dgjj|4_um zBu=nj>)!GEChjgOK@cOY8IO_?^?iiZ+$H_ngMk`!(be@KABHfDd|ZPmE_W%n3hV&{ z9{5#m;fh0Z-p0~UoU&|j;V`SVX~RfJle@Xs-LP{wS2%meeL{u@D+xj;9(er7am4FV(*Tz+Pxwwi(+tE`yngUS!)M18Ry!ppjS7JjX6uS4<`Gyi>2)ZU_sTAf)bQ- z%!$7*bMe@YIo@`X)~3^8VcPunIk*I<`q?C#Nf2iJQ>^{hpAGh45Tg&L-iNpG=B(W4 z%^F8-0|Oa-<@RW~6lgZu0u2kAv3vtft$?w}p!unGc8_pKG~OH5 z`&9n=bpVzL=7Sq_l56t)bM{`g-PueUr+Andl3_$oI{3;F4rB2Ffts5tDt@TgSK@5= zf&Mrr1OK3)$Bh2FCk2_MrH+wNj`u)io1uJ!%B66nEPF1+ap})EzK%4d@!J)!ys~am zdUpr1A(9tVSdh`orDFL%|AdEyZN-baN8QMR)IkE|#m_f5#zNkY*5j`gYeW!Y3}5wo zM=7pLY~o`Qup#*Z`j6yhwjEcO)weQR3$SMhR$^tyiL+;Y*~d}8HoM2=G3ndJ&YIN; znodVoci`Lv1?ZMhjD&XE^7D7Mjb3pfU+Cc5BzJCE0PRB~{Mln+k>i zGT5}T^<91sYL)i`YTHUV0_aYrJV5G7e*0FF|8d+g+wgZVlZ`3pAdK~wJnh1+i$pe{ zj2%0+i-Ezv$pcl1NACU#eD@3TP%*`ZvSniG^yx_oX%Xo9>}w1 zO#TzL?urYN?G>xOny3}bm+#)3rxS7hd=XRf3t0uF-M_zb!1$tDP1xV_4o^`5^w^>J zDDOC5clRdCuGj(E1OWpKPG7pTAK*owDwXv*clUxiILu6iXY_86pc#t3aM7Xx+*=l^ zkDV~VKm9CMxA#`Ly7~2yUf@N*chZSTtE$*Hqq4>i8>Y}J;L-Y*C&N`@XGA5xejUup zO!h2DISdgZX{b$`cLg1q=DVBfnh856*%Kimeb%SQ@Q~FcC_a-TH}X_?cx!d_FZVM1 zmIuCG>Bv>j^(cQrWOUgAEuV99Z9hyX-5fm1yki~w=R_BSR825lJPsbpHoG<-TWBYB zn@V7zltFYj#cKwIpmPqR6eR^hqUC-0X`jBs4xZ2M{QIk~R(2&OqFNjX3W6Sr_H*pY zEq0fUWFgqz9&cZdNC?%Xu6(1lt~?&G=(d6 zeVaR4C?NUqjbfQP0!Em)X_Hwq?}DKF@1>^t3ladOQaFs*uB63&sbw?#CVb^KGn5Zs zAqeL-&)fbuF+3J3l?OHf#*dmD9~5B--b5+>&wu~GIfq60^h_GeAO$G6WaNa1sHg=H z1nQ>l2W2kc)Cjou4;AVQF3kj=P$2X1*&x(~t+2ySPX!wk-wPB@Sfh>$I6NFV5W@B( z(g*oce0t>d(jPzWvz76B<+4jN5%~H1_4ge+mMYvW)Fi(}S4XEIg|ypNRjms)awuM1 z-5t=|CPsSbs;ejWXp`1j^RI$K<_I*~XpBOlJ7maV6cX?ANZ z&iJ#?u(*8p>y_cmyg*XHw@5+UiU+DYaG*bg;m0C*(=ps7(54E11IoM-#|hiQiU4mQ z8D%xKf0u7zW>O{=$0v)s8W{!R3pl`6$9+0>;X)lW6xDT#WevLf??6A5$uX=8v;qx} zKOJLJ>H=x3u#(aLY#kl3a-|+kV9&aaiSy#cRvXWV3ZSf&cE1|TD4n+59p>cJ2hNEi za3H&-#COD^s&}7GG;?_ksFON8Ynd(5GPO0MlKs)5cp^>fYU@taVQbe8fkg&H!urei zlvybleY%E(gv9h5MV#&ij^Rj;q_kyVF#MA3t#t#$H%e`8+x6$~=Fu&Ew!uOZI$2`h zKQJ&*spBADupq3wZnyPbhI2AC>RLGa-Gc!y7sv9bQB6&ma=63U*02B_B4 zxE}Y0^OTf~F;a{|GpQtGKe_LY9e1BR*-f%x2lEr!B-042M4<~Bk;>U3I?ag=2c^SA zVUSE>DGP2hCEvMYm~<) z?8Y1cIRoVfdJ1Xn{$0IO6A7g2XtL{|zfch&&^obQ!A{3(uO6nSJF+ZEKoAtc$r(`_ z8flu|-0bG&ww`Id@|O{M_+rYAbzh9FS3PBnv9RPbXSSym4vQ1S0Z>riit#m^j0+lP zl(Ww>MHLUR1bHZ;c}($Kw_!tTRn@KG;o$?72GEpUC%KAi3|dO3Z{OXJEH+ld`8tCw zB(YX{tG8@I?M<8wB#lfV&G1|ln>SBPNeRzhZQ4B6l&0?loI_KhvKlsQ_+V)(txfkJ zMBvI=u&G1*x~LLEQ}02m5UpqvCK#6?!n>l{Lk?(%_I4SypM>IP6`k!5zX{$Oj%16p zk@m(a`p&Ojv5x7qu#FzC*(~1zU4(Z4Y7->^wQEQD6;L?!HgwwOE90C5_;nhxhpVK& z^x3I7=`#epr`JW(Y9&GcXrl%K^v%*m26R!Wh=s3im4Y^!XSRE3<_3PKaf6VkD z#woXMU04vP=(310RH6nF%Gs&eN&%u!V$zc*EubX9i`m(SiF^ZD)FM*RlR?RCC-Cg_ zg2~HxGNVgr+f7~n>*}358k_f;{qmIxMs2cpoCOIN1TczkOP7lR9` z)GBm=UlPbna&hz=ne$E<)8fBDV;Hao#e+3gmss3tR+$G6x%C_r?407i)!^#Y1lSa^ zH9cn{cyuGEy5#nMMx=`(7sZ3g8wQwwuL_I1qY_dHQ=aOdqkco}t<`TQio>Eu;)7QM_X>#~cz`YEf?WLR5Tk)(!U$7WV!5&2b*6 z#p@Z?UdbM5@!y@8%;>!&E~+gq9^Rx&g|fGDF)e@e(NKoq3VFy5xhGs|NYVQU4*=CV zRb0ct!2yqkI0aZ>4PI64*zwb+o|4c1a{INZbNf%Ww|@);l?sT-VJI(I0y^>5ty@9! zwkPH%px9rUDKW7&GCC;Gbb|pjPu)w@ z?^KtM523j8JzvcP!>9V2xw>4kW zpIqwuc@8;&O>wMJ@WUAvL~7*gl}h=d`|>ZRIgIoxF_s>&t^)?B0F)#1o4Z(l`toI= z=m_XUvWKBxzkZHSKR6pw4vac6xs+z2{f7^ykfMagp936QA@%Y%s#nqQXq4OmopUl{ z33e(>BjP9)8#p_uKYW_kOsl2^n1aP|oXb4u4B9ldQ@k7pkTq+@unZnMz(`6W7Ek_9 z?c)Y#B|;14&le`(!Yufmd<L>RDrCcV3PEm^%@4w@CslM>2DHQub+$;A0%f8)09;ce=NlyDiY# z^H*kQkKVlzp__s7*~nYP7}s>J_-xaW90*8i;t1Hm2m=YzIOc-S6sTpxrbh5z;R+eO ztNrk)Q&qXA;_Gqk*AoVBfLu1o?!ysH95z<8l?@1j&lLbf0Mg>!Wk0Pp>{2&6K#zqq zEcfTu_KfeE)bDBQ?ssZyeha);xZUwcr`@CZ%5nTBc&j%&c=YIAc6N5a2(^N+17Nu9 zSA2dMKabhM;$((UZpriWnLyh_=pbnJtPyQ2s+BnYkciIj9;gTrNQ;JoV$-I8k{0J@ z_$B6dL3CmA$QE9koIdD3zcG3Qd{_AmF0&~LAv-2>AK4o}VbLNK=QG($TN!rpK%O&pYk| z6&iH^VSZ7&sECMp(EI!YWtwA$0c-!cQ`KF1ik4k@ncS7{p-SbcjuinY1*c`oznu~> zoxsJ+Fu3`7q+w2$8FKS|r*KFo0yea?e3fkmz}_H_OXo1H7INsx z?z_?aVSMPh_4M?VX&J(aE?X99Qr;AJBx*v^U=f}~O@{&CWx`-~=j=j=77s?h236yW zAvMYA!cn{#*zY)Su~t&QlUd8y?%GQB*az=+Y}>36e;ZHP>y^TA#N#1Fp2|c0`=r&} zWgKjf3y)IVdDEsz$ca1haN&H4tXoLf0?f!coJ6Mqn)sJ=*Satt$@J#yG~#3> zGpqzNONwGx+VoyHc0r{2Yy@RLYC>gM;YTFR=;BfENZF0+-jkC5!;yS;^f?a>l^FT+ zZrznBc+uGdk-bH-BB;Rqtjc=ojVxr@opsE%@UBcix|^P!Zu{(!lR+kGI+yr5`$eUl z;`HU9xRvO2NdXba*(6kP&*M8KzMfG7%<#QIg&jRHx67fDNBf9gHact)=iVy)jzcQn(o<(L`Wz{{*| zNZ=ibRTV6Zwc!vNhT{S^7=C~h^&zacEGZEF7vdR>adlZAuee_<-#Y-+S4uNSEV)SZ zwTg<>KmO&m6pPDuZF|3fzxpEvw=@N*^vy3NHRxX67Q7QHt%RMNI!6p#x2Y zi%<#?zJ_GXYQ5jr8Gs_}6Qvsa69*81;JAW*p0@B!?aiYB{IMEZsGMz$Td=*Y0e%H4 z66$f0r3vd#v$9wZk%%_VQ8jAO9X`-#eSxZl{T1+5k6yjzBOnS>gh5LTZqui?Aq^@3 z_KH`Uou2xT03SGLsj85QEPh<`rkRThN(;OEk^p=6X-Fcx0^8?ZvBQ^$53H;-v6UO~ zz&|8JuZ1p<#(oNG8UqI`XpDhEyazxd7~0VYQsmYzsjcW7gbk*vSfXuW z**nFy;;LUT5FHGh+C$vv_U_#rCMVp2=-*45!m=RJ1suaZ$QLZ;p%M7hxpPVwKqe)A z`>S~!;r#*V7qR?QN!?JHW6*BT9N*;=2;RK=LfkV8K_6+|iz!bj3ctn`w#0sP7pQ|o z`njS*+XB1H%!Pw>b&JPDR~gk~Qu{r!lDCCRPoKVCl`O^DBBXACUq6^eFQjmUDq8IO zgTTP`dX=~DRK4$1Q)ph(02Cud0bYA}>d)QOZz~rZenx}PDr5QZF^ihN-SoRJ>gC9& ztol$*Pl!GpAkBrPOG*Ns=)I~0Try7eYb(CH;{gpIR__qRYZyw}{I}vsJPcmuERwqJ zCnh!+GGvHjL=<8_TuxPHXpM*_i7YLLt~_|g-@;yJ&COtFmvXk#meZOMxN~PS)Z4Ps z(&LZ^u(uM~Lp;8X6Y#($X)n!!quH-tKWU=rk-)w1{C+evvjIgRG1^NE@dgBU~n!G^ZLpJ-LT? zgb^^2WcLLIKEzN|`t4g-TwHs;iXb79BQ!W>R7n9}+Pe14%FdPvhCD!0;&0pG=eTht zrsh9<1FQT-GSfzWN{(Kl3Cggx4Y1wBk}}w?VYhFTLS~2 zchaUMap_IyOXK>KQ|_{qFQxXkXYF2gc6k0agY}dJN-zW|>(hU67s_dJSMJbZeMC6) zLL*_3{u+6RIBeW~2vC)4vUKIj#&ZG3*b8@%1Q26HT9KP!VDKYsFNIkQR&rQoGq8Po z^Gzl&iutU5zW%{{0@!sFH&oGO6qtg8M{1HgtRM#B&hJg{`cUqZf$BAA+@A<73^#|c z+jr#xRosM_Y6krC#^lbQAG4$^1ulT$(Z+cQ>+`lW!8N!i=&EXVHx_82Yse1VjA>ok z+0~EYG_g&1r*6o)t>@02OC8{$l@w1AFRH%K7-Vq;p^ZlQsi|mcdJccPk>;eu1pJYs zMrAyGn!r{e8TPdm&+uuDJIV#xl>c+ZYBgiVH#!WN3}y#A&om=)t%9_S$~X(6*oGCk zzpsp+FkwAzB-@yUO{r)lE3&;v%q{(v_tYaHz8u@M4_XPM)~C&$4YXUn?#rc=b$})q zJlx+$I5WJ6;L{ht5#+8y`n&U>2Koy3(zowKwK?8#4KbiHI#H(R5obE%J1zL{zuj2V zU=qx0%Jx>X@N2=dQ{$c~O|`$qq9#^$I~FAEfO805d#Mn!XJ-ms-B6DMKAM}3K&+(> zZlslDMGe9c#lgCJY6NSo_Ys<;p&ot7a{Ty5@qb#;wt zLXz7^934bM3>)|!#sKUN{@dEZS5u2k-^%*xGOcEuHH z6&gIyU`0pP*bWdu4u_PghoZ|4^`UEa#n=8Rk!@PsU_P{%MF$NcvQ?5b1Bb5FqgYy9 zG1=QWB19nxq8KqW_?ptc-i^D+`aPgY{s|uq0Kac}0$QqlntKv(WRaKOUD!vy6VQWO(r4x}kfJ9GJ`+(Brd{M-*eCm4M5-o9O|=XdAI z4ny22t=qSMaCcji9P%=N445?g;51#J$$4Svw$O;bWKezkZ>k2QP!vV2?*ZFJ zc4aN2Kc*pUO7V_X(3)Tv;=L$I5=T-rHtZroe>n6O1~p?xpJMNZU4;H+9*%-2S&gPeWr+)i*D8A# zK37oP^Run&?bT7=%x_!_+`oS~f)!jycZ>}1;V>Rx{ev6qDJ!sKleqdreT%>b`wWQ% z7ey#SNqGmkDZAx(VkjcMhYz>oufsmoob%V>^a`K<`Ex33b)`!KzUpMg14brTaof0- zs^^+%CDqE&{~Scx!L})Vu~bpmqq|iZ@c_|G1;!IX9$;nPad&Q)K7G#FMD+ga6pom# zk9HBV{(T2oFAriaIx*RI!db|oC&z}A*r3;PZbwW6I37_grrSgye53Q%u7 z!?lY-qje`EOyLv|=7dK>!j(QIo^8AH^J0|m4TcTz_48wr(>C0(bV>>16P*o6gl7_N zhh4x^XuskWKzIWR2>ksj&4!ZPFJB%+zIy@JK*dNaP<*^O5L7-hfq+-guWT1c`cZLJ zNk2Yhs(fgH*|gXtl7W#3ho8)_e;(?BFG>gqPGc206lsolZme0#dw?YexHjnTn5Mq+ zcEt>2Lc-quCd0MvaF7d}4fS4LT0>b0<7rD~gJv5Qm8FVgNX)jtwv+UzEomNQa5ExWdDQGY`PZ? zk)36PoD!1(?tF1ZqbG=Q0ZSetASLJQ(lbd2<8l}{=-2=JctwTB)%3!yhx@L^2b3to zd@23pL8XjZDkZM7CS+UIvPC4kT-KVlD>}t?*HidDq^Onop6o(A zh(*X_h5MVVpJFiOR`<5!#BUTpJ6<1LH|iF zYeLTKWyoSA*l$dNa(%n;r<9~c7rf#Wur5)_NUGt~@8E)pOIXB_-SBXnJBm}dI`>9h zNWa9TSYp!Fty|ZDEye9HYO>Y^ZN3OUS#A}d9cF^Nf&>rq--$ze`%~HPU%wy@#-oGL zr-tq!opxs?1!IIf+uTvxD{eZ$iN7gfdf@|Q0tQqG!3lZ9iWUTlTQOXTK!SMQT3I>o zOV4+Oh2;GS3PLeVfW}>y?V(c8kBkzm!FP1MpdBf`3!AJUeVN7Tpgt_fY~xWh^=(oC?=`PELR1p`KX?eOv+M_;8)toG zzR!9rR-$t>XskrHtd*L(S7lR#eZgY9mIbjn()Ywak8>OH!u#2>D?$qcM%bI(i-RHv zo6?@E<}ZV*MKS!^Uu#o6VmMW~SgQzX@MfHe;N~s3xZ<@y>4U!_Vvx}qKz@q$O)xqe z{d)KAJkoBa*JZwUbeMHU*j4M_Sv$}7y>LbCie8r4zm0}3A62z1YHPD)vlT|E^!Tm) zyVt(eF%$I%20nE9`Ljv<^+vW0l>&8wvdc?NhAlSoU-&imw^6a%B+tOlx?YB#$JQU| z8=J&zn@Z+WB8a*@NKa2Ga-D*`S55+bhLeoyF-k*{v@HJ=l}v;chEm^rec_49=Gv<_ zxBvxUn?>@dT~qt6`to9m-R!0=vV?*fte7N{vQR&NmGN~#*T;;LDdWtg(L#tT2KOTO zb-?pO>KsO>VK1Hn$-fwyr@N7n?ScIk)rznu7&h)y7BmMd_R!NibM~y_?Kz&g4af3R z#8q+m(0*}xz)T*vKGfp!yrxZ?e*gOV79KWm8l_YWujQ*tv7 zhMO00HY}ru_|KrV#$3*5ZE@Lwun14?{`2b-#^n#A0v-pv|6CD+5s{!xmm>~i0dn+v zr90r_nmTRT$EPP6FgkqsrSKljpaI3r2q}6I!zHmj9b^l$-z8tKH7g7q}xqOuH?=v%&h=Hk`CC8%q_Xk-11*v1cR5B<{bQo*v zWGu|HgoEfl@#x5FD_@_=3Q!K83nfIM-wZc_j_N!Rfn|sZt_9brKUw--gzumL$wahC zdVQza+3jS<7mG1uCfM^{Q@oYUF&;4rX%EBi_zg^+TvVEO7sga`U_E_U94dVtWJ|rn zek28Gc%=Aww;XmV7u5QVJ}HlxH3zak0K&Z9*zx0y^Mf?7>mpzm2f4LW2;KCnCnG*k zKVk5z1C)Y#0E$l;;j)Mv8Pcb6QQ6 zwO(GwcK$8Jyk^Sh3LucxVZGVwr~|11-}N;Ammv`8yE+UMPN>ZNHbCh7cnsuh3?bJL z^#;0sUm^@1F|zTEHUIURwZhwQl*V2k0iiq!dVIzks=sHU`th|TZ_L-dbvArVgqI0- zaU>9iivv=av?EejmFWI7AH3VxbL7CCS7L=}#r}*hcPsV-_a9%@Pp|(@Hc=B=W%s9L zs97*3FnGhem|flYf(3u3dMVe2zAZsHHL?uU_m)XNh5lA%^B8s@OcuYgC9{HIr7GN4 z8NZ$~P6d2ILle6Z>b6VvQDZoS3=$*5NKr=cLz89`k%aGCw@l1xtKGQgBgjTUbFM3E zhwz+XK9o8eAC&1de#!S>SY)a>)9m}V#}LmKCquGn@gw5JPXGvzOmI$u^4r8Tkk^lV{8r z?e1^%E(G@ zQQv_sv6R|av;@KMQ+BKc9+m7EsV$KWG$3XWL=%P}EN9d?BWQqexRA3}n$sZ#dpwSG z0lRaC0v_nX`Z-cd5kn6bL4DY5xP^UI+)Y&FqP|Mjf*>H43H`t6&u51TQ604!I)CtB zT!%Eu^@j)M95A+po(NLp=CB@iHf&lJI~9}X+JgE}{Et#nF}zBYv67$Vm@r*g8}zVZ zi*nd(|IXZ?5s{HGOfafpU%IMdLn01_e~EVcaemXBJ8505w1$W}!CMO!>WALH^I2K> z1I?fnP%+rMtCvsCC}KeVaXy;smhMS=FT;N0eR+u0jlV)&?1j<)5OKIX?skHyMk@!; zKZDav%9UhOxN-D}D-HyATogC9jR9u|Z!u+&X za(&qC@Z@RJ61fL>K$!-FvD?^q?N{}ZQg7wACo?}XjNv#|dzuubN=h@Y^&ql+U0Z;C;Yu1J0K(etrltt2us=LfbKlmcjAhkQwVtr=_gkPLWuG7oym zAl2QYBhH;W<(M84lWD1#abaAnxz@`QXwTm&3-`t{Sel+B9#O7m?H?f@Vskule`jT7 zl`-Dr8;`w=ajcoopN}MmvRm=yL>*OzRcNprjQ>0xovA&F9aI0+W_T}YY!6jFp#=q8j1Ss6ukDMCng z%I|f0zQ5m0{%oX5$z0nFqpGEla&yX|4kGlo`tS`@5vsQi!3IJbij z3y^u{sZUe6E12nxJ|7XRG7s=nL&^|Vqsf(rD~Q^&r>WS10DcYEy~Kk!7XajnO^iO6C&9QNYvnRN z2PuTEbStbDKSOFdTq&sYLYNT}%3B~eqWCx~t8h)E9HY^`=+pKA=AHB@6YyLXWC@M| zTE%dktE;}&pd~JZ5K%P^?{Nenm(Z(A-rilyzPFKXEt=>R8_r+b*}|-}`d2$*wwynr zJPayyD{SCXk$p&yTnk*>`UqTjd&mzb zO3BjCrrnA)RlPOn2`*QnPf$9PZ{wLq9oT6O{^bDB+Wn)tWVmSlIz}2)68#TP@s~nO`QOPh{GC2nc*={qeTLjL+Ua z!oZQm=@e6aR(zQwwV}6nYO_&o&C|_%?9}76u;Lbbe3{Lnu_R0jjxLT{5s$yKu;HH= zoEh#^{7e1>{GDtzQ~|JtA(V^5CT=%n-0&WA{*R?B~RJs~R$B70l!S786vs!f|4R)%`TXPIZF+Q`_eO_HGUkZmMk;W%yw=1BE5lP`rE zjxh*hRNsIXwh)}2#j;r7rpPS7D^`|X}OiMcv#Mk z(>ann&eb*k^yPHqhj?8wD9JxKtti_Lf7&=A?=tBMv;G3(bC})B9b>$UnPu60V(a8I z;m5~kb4~wKiGLQkT~)6*l=6~fC`t&D1D_a1av&NTFS{=Za5HS`+03V|lClR1;qihl zojY5e+mf72OT(gxw@=RWl6Wmsm;(k(k<_UeaB-i^j?pL)nyZ!%W{zjQMEN6o9pD~a z0d~1Ejj8G=?8#BW%H`JrDZN=ij#Lk*ztb&)fm>E3NrO1 zW7IK!`XzB#Z77C!$;sPdVycBCXE3eO5B}#LBtrincuD^~aLBUx=pX!?m^i*+rb@~+ z>DWtk{$9hKkdfb^@7^aT+u)Z(2FnL#G`c=s@3ubhAjX5j_uM-)ej3U$lB#%T&@zF- zgpUa;eE85CAKoevB~Wzd8T;s2_=b&25N~ivM#Gk4$;>i^f;z1y1y!|$>{MxpY07;E%a(Z+Xa^*Cp-ySFnA-LmKf1f7t5_TQui-8^oOf*~AIyhXV+1p8-4f2*i)-#>|_W=8OX{9YGh$$4J5o)Q2`TEk_V{3j3R*wJ-vo|a3O!+KNWQ07IhymTH~nfLL-c|RhPCbi zk$KlIh6K`|Yyp%vdf(91WGh|)4LhYA9+5PLND&gcDTl?2YOs|hLeE!6YP2qRc0yf8 ze8AbMl5-Z4svj~#S*mhedQzoWqc!XJ0EQz|%54=$=7@ts8f%>(q}`}ZX_ zlX9sPB!;prq6$q!G`J#l7=f)6zm=^9lk^-@r|K*+O%JT9&0&k3^~M%jRM%BX)=C9o zjK={sUjZBvIEVo8g3VojXkNPv8>U0qg)o#kJ5d5{RZxxBVxoWl{{1h{&Ro1;0c3rX zeRoD9BlH{c>6`!Bk-?bDY$G@EQU7mpi-bo#L~O~a^uyNUcXU`Hl>p*M!10$le@lW? z;#)^H2vJ#R2mXVKTwCT%Fx`=&gs&zJ*f7c@%Q6Ansk_-e@cGEA^3;?Rkw6FV-Ut3gZOHMoR4p{1xL#J3vLg7m#}FlfAa z^XBpm-GkgmVCS*v%9r)$*k<=|tKNZ0W5#deZ7QTZG}0VYNc~BDlXy!7$)o`0fVww6 zw$!sYr{8yYko$TPq;x7`vA`Qf2*fz_FMKaXc2biS0WMT~3cx%%1)usBs+*{V$^aAH zhj`9VThwo{x0R*7DvRm8_x+u7`nIxOz#}xKGULmkx3`BiDWxM;2U>Ie^`-33yD1mr zPo3iXhruL>^pLJD9t(}cuY(B_Il>I*`g(p{Y(_089!XQwPJtJNdh^bmtJ^& znNL++&8KS0aS8BhEjG3%Nd851QT9m2z?Hn!=AbNEI6+tCC0F@DvGcB5Zd^k!AyGnP z`n~}!h|hRx3S!I`228mMQCq>Jbe8|O9Ar7OE;piXp)#kq;x^{ph#)s3fTv>~mb}$o z$@`07SY${qcdrB2=akSfbz#WmA5;QZnaDy()VKg~*IG|;$_{FxPMtRF=Oe-?UEXayuGM(93Ny*UimG$Q>#-IhmM? zzw&Z#{fyBd1ZKJazU&y12*pB)w2Dw#qnp_=1dAgw9w-sJtGs{KuKf1y3Kb5c4p&@y z%Q6};3Q=URI^@igiR506E3r8_xp-0JqaBYKYGxk= z{igVCPD=_b#Wql?0lsv7u!vol#leN&Vbn8cP9Low#;b?wP-1>~awdXZD57=(uQj9g z6#F4+`lnQlvT%gzKmEb@*5+RBZ^}Of{4f*7VBsr}eGz^YP$Dkh*fq$#J~%5Bo}6LS zkMvZB7N+pB^>W8XN|UO`D4r`R6!ZGBBL<(TyVTUI{_H4x|4sNoeh^!rk#at0l(>3d zd^b34o+P2$-X5a|S}b8caC}S4GSa)#|?Y&#L1Z(eJ;h-g~dMwWXel5^}a>Io}HtSyhBZ%HM{j_X&%TvqO~;^+UXK;^EjqB9d?=kW zmVRHxW?cGpf#34t6NX=-YA$kC_-W{3c<9h7sZT09b?HLSdi~lp-OinZVfq%f_a|7^}04XlhTeUxXKm{J{Ezbi@C=>Shz-;N)Op zhNT2A0F0hE@s{ey>(;@Py?}5(YOH%G+Bi5A9(%EPuT|TkHme{IhOr7b*?@|z>-mWb zhL-;L)EFQ)IiqjwQ1To20_~3FWbsR(Y<14^kJ`441!h;~^g(oNWfq{9TM;FPT9Gb( zaP8Oo3W?kPupAxJGIyQZFdhd$b(g#^oH+g>qMs4D2HSWO5zpvI&NthKi{`D{}aP}InN1Pg@D*(a>FPcNysXBjpw*j-Nwisn+!pl~*IJGz--3Xn%T;?2$sV= z-~i*sDf?$Rn;CCkd(Av{1)+>iWh20wPL;ER{dUw4(sFU!gJzzE?IAzvP*}^JM`*IHW@a5&Ox=2vdAdH_tE3Q`{a7m`GXtONi6zFc zZYoM(j5;z=B17=HDhe$OzoY)Z#(I5TX+fJSL?8AGJ!#@|+U$A8f2J#iyB6UfUkedB zw5^mFeEHz&nhncl3IN8ZVYLMc8z;^D8~6-8!JjcLMuU0+|tN&LaBS z!#|BMBoV(F3*nFRg{CR z+Kpc@W$d(RkDDC*Y`r7C8)@JkJ_aAnwCI9cvQw~Qif-E-St z*ABE3wuf%}GKCY(q}i3TRL<)ioR z!9MZ+L*D!rMEg=>-$4 z=FlMbl;-ho^{~Gq0knuoGE%}-YmOd`B*h%N5E>N7D4|*k^YpAy(963<$yD{i3^Hmo zmBCo>H|{%Pbr8ro)F^V8WGzGD{q~U7(PZ%*0~qdVlT?Bm+HL)4hpn;j+!^8WE@sPlWC}ul9f7P_WgODP=WI^8=Cn?~wMT#-rAPCeLMoX*XpGY?@|Db=4pCt&o5=S~c{AxBCCe z+>fPkv7-|vFU(JN7gHx@7iu!u)rz3$v%l!KDVT{T_acf9&o|K^+mYPK@`>B+Z0xbx zicP2+rlQ0*nry!vPM0S|M*^UOwt=F6p(JriV~_KqGqZ{6zkUUq-nX+agZXY-G-H_- zlQP}H;tl@;L7MM7nD&GCEA}^Rati}gz~p$#;{}U~+7@!a9UHS4@k!-jnp`1e39?`{ z#fvsg1d*hwzO~~d{0>;EUrlY;0DF7TIY^X#HKnWqkaMwIt97Uav8F;8jS%?`~P(Y6907QN5V>TI04_EDn0vDbfXTc+++d0|~{5;N6_iRO>B zoi2V_;x~TP-#Rw_+1qDa{QGFR)P1Y>1ss|3zJiHodKz}x6?*n3+*JPxKl=<7eS78$ zh_*61#2E8{l|57JX{yvh-7hxo+VS-I@+Hff?Cl;FpPrw5UDza~g3c?-TEmy2yMjL_ z0ppVkj~R{PF)}XB3cdpmf})QdYTECum_21d<8k9XZ@<~RI_^rhF#Wbo4Bsvpw#GH@ zgzeJh`l$o8oS!|3%XPN(?P@#yUA0A(&{k-yg6gAC%UebML>0C1)33ta(r*OGpBk8!uThh%U2ZzkV6F zv@b&CGA#Xy=m*d&V-a*Fcf`LE4&Is|2rgMZ<>K$wGGX{k+uQ_T;tnY8FM!|`Sj;jc zh6+sKpYs#TQ6{*pSE}kbrd}s2dL>9YVR=}7x|7|9qIpw*wLxn-shfp~MrR%@;V8kt z7G#8Xo@oC|n@(ZS-l-{tXXBLKFBvq*@5Az|)^0eSSwH%HG$nM#=Kq|GDD9^|d~ee# z7-lf`d&%MWZbSkO5IO-#R}6IXmZ%U39F?vtWqEWY%0 zn4s#p2dA!#*;gLl{PZIYv6SF2sNHS=Un{1EeV@A44*fsBl&liH;M{zM+w=dm0Hm!MMjkl6&F}^VR{@L$59H>ChtHpsyZx8wnLL;59!7DG;z3qnNWC-K92cL?Q>V{qo zA5DC}b=tJZkxpe@_Wr`c-a8hA%$SttwkFrMce@3J{dK#dg+N#2fAd{c>8;E`QB%!_ zb=l$6i*l!83HoiI*2dJ9?o%qew|G*18ZJ?`Xi;5O`nrLJgEI|4~3kuT3?1O{Dj?+ih3<`}s zos9BQv=3m-f?07XDKd+1W+NP^G!@ANGWm+a6f8;C6N^PX;^dhJnr$NJt>`+#ziqkmcLV77Uj3{8>SA2mO!5wo4zKI>_=H_;O z=8f($PqlVrlee&5qBi4%j_BR)^^WO_Ud-k?sWH}z|w=eYZW!hF4`F+q4k0E=r0D?|Vv&Lt%cohTYlc~6@q<6-n& zQat(j^#@S&ab+IjjCbj%6n!aXW%p7{K7+pZjdJPn>29T*l+89y-d9>LJoRO|y*)8p zG!M*s3a28g1$Y{ST2@#d9aA5|{_ci3I&pTJwT7|ZxrutG)a28ph5>*Vvu7t1Mx+na z3{b5b*>qOo{oCCLPeDQD`PKUt)$E-5M^u->KE|hgjZdo|=Y3KxIT^+Ht)VG2)htw-@XBi^ zS0vy|^uFGhnh@Ks;Yd)tYR@rhO&SzHur<=LP>=rKd~>c@dSCpM_kE53c|Am{$CK)T zQ;yAb^Bwy9x@H18s_tEj9RD>06DJ;myn|d2qd!t(V&x+Dh!)y|uZarC)_O=Vr!PE_ zpG)H}QU&OkipObPi3IU5PcSq2w-xom4?sMNJKz6?`lqrP5ihq~&;@4IaSmplL?r#f ztB}ug&0a^J;uZ1RL}mx)Oj41Pi--Y>t+KYPxA)$Z6r^(NC?X<3RcOCdNfLO_iUk4{ zbJ;Ze^H4vL4aPL3U=*nr_OLSYhDiq%3AjaXd`X3d7XNEZap);;4ShN>jQg zZlq_bQpkn*3=7QMMpwdU^4j4q&u&`DA3}+*-eowYQp?kZWL&|0DsNW-`p4OQJ00H* zoE!?lI@2SSZC5Bh2IQMNm}m^?n6}6YnzOE8(+*BQ&1S6Co3X1I%Ik*Uf+~IQ=gcjm zI&#wU{%Gg2|~e-rCCc?4whqBQT~WTPT6L@r`du0dkmwgFr0(SA$d)LqY4DosYMkR|~~c&PEj? ze~Qu7C#zi)%|`iqbJ2JTJrJ%A%i;INPnRkAB@6i%SLVg5JFu- z(R=Z~V#crpUD5mjZ@QbOHy9fjJB!v|3?I^ z9{=y10V7vqBD9AHP}n7U?31}(=VvGnvrFpGA!v1cM9|cgo7D$CcIZO^^85Gi=y8ER zYwPasepULT235^1hk|Ed5%HG?%Y91+-EK5d zpVVmmt0T)@e++bp9klo3k-rfcYMXA|V!h@e=DDf(fY{{D2yv;%=r8wQ{a=SOo9`+l z6$t(LiLG?#wZ#xlOpuUQ=D4A6N6wh~x*D488ULa0`#Et%oL#hsNlDpns%34sz=u2~Ma|t=G3Zr0sTG8G z1s!>Xk%Su}ROb0lJ}wE55v`dF&?2zdz}sO7DG5)E_(j-=;mbbi90-di-;BEH-9AVt z<^Hnr@nu=eOgH42j*6oY1qm?EysGEX=ewK{s-(}q&!HJW@;Q=x19i~~W--LIzc@E@ zt4ifWq_d1^mWX_odkthKIF+d706a84eGYQ(+ey)<5g$WH%xd}o`0@ZtU@eNiihV+{r2v0$&#VTu9eQaJ&hAPN9!1O-JS1a;QC^t?TTZk&nva5dA#xR zENTYyvywWPjNFI#Qek8HhTL*znaLIY@loY>)6oI0GP)}`h79U!Z1HIQP39;;bWuv* z21a6`6>qip&UwSXJ%im_Y;3DYWsClS5_iFi3wt5LJVsuEA}}+XK0a3Fl>`qG=Xu;Z z?!{GR~J zV%OCDs%lYnR-hZ1a^rcSpoa|sSKo!lOUF^0LzXQ!kIj(Dr;^aFg8Eq{Ml*!*f3qTu zel=@b(rIkH*UhA=6hR0|HH4nvfFke217k;uhk5J>u#Gvz>GOL|KRv;7yU_lB>puMz z|8PESiB^g6FLV-hKQ8(LGr%`n@+O$GkcC}UrFnhPTaMkST-7lt`3Cnvl=On@Ni+iR z=z|rWI8SP}7#*81c=w$*v%v%9LJ{CuOlVEo&7_tW-v|75Js)15q34+9ZgK-M@h1mK zyaNH4FEQ~N6?LHU!g)aA<*%bgzoj=he|bn}vhizL(>J^3#bsA4fjhX`E1;^WAjycd z+sm;m0#0T`=_L<$9ts`y?1`5LD!6Ve30by04?T~*d_aH?lnnH>U--4YRD5}6CVIC$ z$W>yhEfJGwOs~}*#V1^M+|AdjC7mjC0+_QY)v{Rm74GtjXa!rs>lo)r<(Tk8Tu3u6%-aE7S zg+tpkm4)p51xLAmZrNf%$;nY7E543mhI=W!EqC@z@;C!JaRP59JuO$6vm&FLA20q5 z5Hg)^^uuSBlF@)W#9kSm1kxCYVFP`#6a~Z*P%AzLdfK}*V>F~CT3^PJALk)28vOmy zZ2DW|BbfkxJ8@5?_N{7R9pXnm6iN$>8`B>>%@!gRGkUfX;BkGp0JM?< zwTXqWAhz!2u@9-0iGQLgfngCf1F!xpDQx=OsvRmRQQMlvDatZ4Nn+pu^5^c3Y*{6$ zS?HcC@{*Kgpn-b(Fh(f$_E0#~xnf9;9$D+t=Wuj>ZA2f7QioV{w`94mkje;K=3EU_NfEt14Vyw;jWgD1%SzjCRaqEDKj9`ksc4w_ zS#W)V=6qpj4q;iL!O_7%?h&mlnQv_iKu6It7Wjrg2kaLW7xz5bZ7sib(fO)T@TkIl zsG014>mPI6%tpsa4H8n zF4FAG6RkIITOdwa#hd{HyKIHJMolJ;ZxwLvM?JDTTC8L%h#X|u>_!JFV|ZflLXC3v zY6dr3><9tA2_Tdg0acr3-X$ZPz1lhV@f>Oj8Pvs0e)7@ham+V}1p}hq=dZMEkKGc( zNy<;bOffOqE$WnwU2>;YGTB7}RAKy8Tmt}TG(JU!i_HZjHDg^qnLlZkjM5qgxrcf{!HIH2?C!Ye5IkLu7u^g;ju==@%aU4ML&EiYI zwNMF3jewM;&6%A+rqgGz7*fVAot8ed=O9tIh%q4bV^xbvX)MGd1<5UfqrToH7O;Y_ z`JHp8ouCSqi$f=^C~*8>ZR^;C-zUJx|2J+A*vFB1oa}c*Nl$i`u%;3UCGq}bxNTtZ z^Ox1)C(={(MfWNiNtkDl8{Psg*~3rAH&G>IPs0;kga1IubmF2q;H2ODnuM3_O9s)ARPX>IwdS z@E{{uif;kS+HC54dvX)K3n!QW-~qR?oW;ALHOw{Zq*vTv+TO)oF!YgioO%qLfGGK1 zZazT%+iia`9K(2C6ssN&9S8!zIM1mmUBeWdolb(zn{Lmr+LUof;keUk_{aeT|)HRf6p(5 z8JW7Cc7CLpIU{h4n#jmBEw?b8eC4i{%Y)rJlRIuwm{=nyz|U$973$Ab7nW~qs5$Pg zfP9Z0Dd`qhs;X3TyNW(?yM1Wjxr`RD z#c0?gYHp_PgpTOARr}Nt1B>@_(jJqI!9a&UKWZM^b8Mi=dJZqGM9}p)^?MPN*Suz>}wh^Con4Usf78e=1aaapP1Cj40=s7BKAx}7Gr3Y0&6F(|376?(q zZ|DMuo4gU}FPCeYha|AjViWUE?rB%*co*r(v);n*h?zzpjV=cnUcx(koRYWco?DGH zi<3Umji6@mwb%&z!4=O~lb;c)k`ir|*pb-Cs&z!D;obl5;S1Ty)hKQ_iZZTLGfJhz z3p@gq8$cUcS!wy;qR(CtFDO{l&%aiQ*z-e6J;x{j075k<*=R^z3{yaKkqD3j0pm_D zZ)P4cd;Hk3uVlau0HLu9c!Xn4dOt?v?rlh0R&lT4#>=X2LV{FY;BJiB22$<3(pmhW zsup8?fBv~wxMTs2R58f6VZVm!g3}u~9PNh^prFf`dI#GBPymfV9^viiT#P#N2HJa> zqFAWnk9mXBh7R=sGrnNeyoqB^2SH{{(Ci!JZYd7F^wU^#7^Qr1-M&Bd!Ud+|7gx0l zQpqdI@SMUDg}{-0S326hZ$hC%gjOC-N#u8K$Zb`*u5>SazxZSW?1bnWhCJ7sPj~nh z)Jb>YQs8YSr=c%8sVMDFPX17+CWZUK_Ttq?L2qY&2qoueJ1ZrQs(0u}CGQ3Q6CVQSP{nx`jCczq&E=qj5e*AYh>KI-(70=6IiILJ#)|tj zo3uLyTzl2}2@0E2^({giuD$Yd$#4uEl@Mfpz+q`K#jz+e+vFDF$K2K0;oY7QfP>$c zZM-bgnvU&>mjMAo+ibGz(5B6a8Ex5?U9Uw(62*D7YL;KHN|p4mycb0zH^swW?T~^W zfgEbFh`a>*T}|~ITcR?#U-7^#EMte_Rj)aB0;XxI#xEUbZJo%srBO zNq1VWRL~#x4q%y5H6{5GB`)n>iPi>{k_LA6S3dp7AGA&-am?+ldoZ2d`uzvI_w_3q zRZ=D$n`_yvRXkZc?eWtRV>mJQ+FC`7LIw}?R*l~dLM0$u)7^&Crj=DK4|fkP$nY#` zvvQGM?sZ%H4EyiT`fF@K0(RA`8RA7|4yfM?Pg%JsD(hLvow_D`Sokt80 zpWdO|TQ4_?L&U4((TUhWV~e3SqYjj2^&_LB*Wa&LAZNAfVW8QuV?*=bWX5-+Rz^ES zghMlxAy?1#{_Zwq z1puB-i$ZUBnI5xW*<5>YyY<;BF^F8c9!~afs(I6R{fLz2F}yeBfs2$1elLA{S21u* zC!gHG1w@Cpgx= zV`y2{Skw&Gvv|KB@CxJ1_u;qU4FTHciU-~{@R@%iI~C7emDRscVQum?*+>)gbkUjg z*J|A{bzK@c|utnW?r^_BJ^wy@MX-CHSZ zrP_Z5ru%oXSjZAeg>yFU(Ezq~IXWt<#I)~($yl2f8&QNj@Y|em@KG}rg~a>aOsiGH?jzg( zZZ=`xkNTftTle#bk1}3)+`4z=VBhlCH!D7VKR5A5GWn{$p1yvskh9|h#)6O`?5QUU zEwJq#Q8LQHB6rnYj|`YJ`y;-?k3Ljx6ya_c60)-^g$4c*%H9f;u#CuP4PP=REM#X7 zgY97e&3ZNWVhgLG;~c)Ku#?VN!PfF@Mn*qe4q5)LtgT9hpl|8YDKO-^qrQImCe&>P z+qV)&{QUeZTaLDPy=8d%@tIp;OXu`yfBN)kChOB4oyQYwu$FJP_x-gl>YvJIeO6oq zBDe#SlzzN>zb$#C-G!^MvB_*M{3|;Ki{5iF+?MSNs~u)x@x14P1q;rusO~~#)_Mrj z6uA6aJ^C9G+K%5IYL!^Zlw8gbgBvr$Le95y-FS3LkcIvTgY7m>PEG|Q*~DNx5@?zl zGpCW|&15xIV{6h{OP!$&ZfL4MfByVL*;#5XOkIk6da9~M#URMS*lX>kP2+>RPT9#N zRITfO=H=#)kZaLX9UUasZHV$47g1;1HAW;bM22qz4PWYwPPTR(4f* z-Fb4iRwUV`t#v0AdS1%TKCo_d7kzzKE3PtI$aYTbtnXS5GK|*b&9ZM;QpGvn*IJ3B@+S}=3Ux7|F1{MlAtmj2IW zIn}YYxp|6%j5`6?)aCjLhy%Ek&a7g+Q4Sl>y(1Qp^6>D)4#`l~vu3YQ{a^Rjqel<# zUPk&~2ADSsJm1OseRmhD4()jQeHfKd&%RMaavMSV-@^|3zN3v|@J)AKdGbrag?jz_ z_kUDe99A7164L&Qy8^zXyC?R}bvI!gG9)@$9ke5U)fWC+_0QkVlP0G3dm zmZ#_Rf|0+TxY{&4nVwGLpc^&j{-(X z9^ZP@HCnToDns14#KIp&qx`bkG|G4c2 zZmAbGg@l|RT%MY9Aseq8z|Y_blg-S`jyq>LW+!0Bw?Y#OP7Y{&Rr&m4;zwzu5W9Ep z%srbo<4}tfgER5fzt(f$VIGeT_GQZUuIyY{U@+Xm*|5vTC5QMu{@wJ~^qo-aubpxd zY>M$6tRgHtd2hH!;tTy7Z+|Z0sOWwWzV!R zE%Wm7WMi7|-@4Tvg~vi|l3vpiQ+Zgp@;t%p2_A>von*wVtiquF|lFzk-?4DXD=v^ zWOhJKHm+8@?29#n7=yx~LY9%z!7Tas^l{Jcb~Fc!{3xK4go6aV8*|8J_khJ#%mYIX zUVZ#{7og;yqzgT;nF4LEzjLlmF+P(r0Dx^7N;2b3FJ7VlNE#of%)vPl#~>2 zFR$KvGGyuPAZUw4gS$(*0RWo;{9te*JXFnf3T>ea*X8#}oko;q!scj?vUdY7k@ zY+g^Epf;6Deqv&s@{M}GJTm^vne$tc(B{$Wwafo|6EmihtNGpWgtHYtKkK#B9?YIK zhh~8xe-4plwv9V9?VIXSHazU{XcfK0hF&&lT3Y$13swf(v6ybKZQ$`+odekzc9V<& zzlE8->;pmaCIfVgV`t~&)Jw7pTfhGDKIOo{zlW?}zkX)f-I=>Nt5{}d2GkBBoteK- z_hn_^ew(CjB-@uzxuWStW{yrZm1vGNDTOEQV?fNd9fIOZPDnL{Pxu!!`?9yQ^}nxW^GMdvDfn) zEfY-&A1JMVGm@w-E*~V?50#Zs*XNL!XZLP*v;28KTGO*mm(pg#8DookTzZXx5lW%Y z4=m2`i*P!Z%Dq>wmfUV&;P2PH1Bh z*K6s5{Z7`ce4}HCn401k#gE`O;<0z@@SR(wI2wwZ_^era6p9H1Y^N-L`?Gc0q7ZOX zRWN>RaQMA5$K!Fx{0+UQ?#FVLF^c^wUfU*~ zg_{NQA`AJP5G$%9)6%*a8yoXhA*t3`=yS-|iQiLfY_n}+drzM_l{y`J{Kl7Fy!gB9 zVt%R5Ew=lDZhLVl57=P-8-fv0D6{=dMl@vI_vW-;Gf6b$5?S%goA)IZ(pEbs?bBmo zQ%25q?z|?R{5XEQ^d4MYOxZ$UW$Nhb(>h0dMKQk=T@6OoKY1vbD16j^Y_&@4F=fV~ ze=Zd-sTvqnR*F~yB!4q*$R2DW;>f_A)S85chszKla|vQucYNkWD^3jmTl3}EpMD`( z*9a8Ns+(QBFoIy3_E;CYY~1J-Po}26f`O^$a(Dj-Mj1D;f>XlFoLIF!@8 z+5JyH4llCfd4Q^L;y8~aIksR^?)-KV$RrcJKdHjz4Vk1KNhaW8#tCc&{E?guz?(?gWpgtfR zPK-{%4sU`9{kvt?3+?8CrlzI}e=G05e*1Q+QR(kBTHHbO;puXSKlu#@ znP_a$t(g0Ja~>9Pt1xtYaD2udHh56<(vHl<=~977)JV>{Hwil6cSTpDnHN~O*bC=* z!K~1TW172m?_MoD0ogCoWMv?vHGf7TJ2QdfGfSbC_F7};38!=+J;;^BC)YCFc{^Zi|LR>+wR^eu)C z#H)MpmQD9Bcs`U(7c?f~KhUyeOALR+{77*pY!kp!BBkUKJ_w~GB>Xs#7~CSo01BQP zzxXPfHzVoM2CLN9?G-w3p&Id5+|daAq?`4ua@b0C5PJ%A4+;q44l&>j8!EfQ(~2*> z|K^WcY7FkR)By=pXQpOm!+xyh5phgr&7Qp;$G>T{U3$@=m7>?o`FrPvzj50M?YniU zoZy>XT&yu*z!~Ke`;BMpD?eCWvyup>r{0xQg58Ps;N_QO7?B(c{ZA;liw^`9@cS4e zy)~-bDO^eF-Tb7nQcG+`wY9^K9_>M65s&_^^^k)v4&fw5U-Ihh+c98VJ^W33ZJyAD zDYRD9c*%B2UmPPA_L=n8>iy0!SJ>CYPJ>bij|9wJ(-%CxcTDRpcZl1Nk@2m=(w67P z&aOR*#iAS8oRtFcPfPL2W+1Hj;>DkoH6H6+{jKnY$4vBfadwV-+^LV_)Tuis-meNf9j%?WZFyN`Wv!FhPi9}h7i}^;?1{dS zV>(IkPXkT4hA(Rw%vd%HU&(hA>2d#cDS!R?GnJ!wA4v#9C{GXPQgQE)xQX+vn`Ae& z)xXElk_v@uB4bj74%fMJEqSpwR-Z;hnQRweeH;lv1j37Z$@V=w9vsQWMGGBW>RpRf z#2b@EPusB;f`Kh*B*0y9Y9x8-t+L{t&VO>+kRo+IkPvD9B%&12149cbxIg=^AIo!N zhpgPe|5ek`xg!J2{X8D*YvG>!&;vuusnGSf{7VVIDWaFA$+V93-9FBeJtN}d!!K9Y zj@Z1p6X_9g1W=p|Cm~wq6o{`qIi}Gi$`}?pxKSm_mIua|WKH3gEzRjivEh}`&=kjv z$Z?0nEp+PCsV_@Pa@a&DsNKTi^jT0^^cd=0yLJ_|9|8rM4&&+bm-_BJN4Ia1t8lHy zRmR*O^`6pzAES>7fa`Mi$mEW)UxZX+x~6V0rJs2Bi30(f<&0q{sc78#PgHB#wCUs1 z3p-q_``tr9q{x>774O_~>}g~~7c+C}&%ajF!jY+A$fCpY3%zUAhd;Zg_2#q%2REd+ zGaWR@;o3UGaV}Zyz(^>dKR(YIkI^_bcO?`KG_&46KF)Zxlt;RsDuoVA)X<25$HRO8 zwXB)8AI0bPXotS-=XbgF;^K6Luihpa&G~`~tfJVJ@*ymgc}9e>GbbGy*P7S%ZQPRZ znT@+t)LXtfYaLjYPi8Dux*R=R+T9G_9Jyb?KVW@HWW@NrapT6=YQ6{=Ui(*>j3eem z98}q+$@JLG)4hTU++Rb0h)|YLcApWN0d7MFdi(HZXp-M)p+Uq zHnJL?4Hs@l|JHSj_^#%)bg89LjO>yY6%YcvVB##!g>Ku&IH(R@_4A)yzkz+SZuIq= zegP{qXd$kZ`GC<(O0wf+yUd*%oRCoJd2!Uj1q+z(S>^E}tY|FFfxtI|HssMFQ`%5> z#?_o-3QA$_%Gcx+`f(+kTxpr*_MvuBY2Dfq`4_1qL~7l~-*au=GlTc?Q$Wk;cqC^4E9*#wrElJh9*#`D z34pyh0cF>)HABhlrSv0USobchUP%Fq+GA9gXweZXgzF5mnlwp;J9n7{D{b4hrJou> zab8$hnDeNkzP=dW0-3C0N9Y>U`8hbvkN`!BO0OhaRYSVxdokTk$lrFCiZ}obR`H_Pb5yuS-iyi(ECGXtuv+JGb!U=2WWO4IeBf!nDIe zu5}3h^=bHv-n_4$90!9X&AKE$f^3t8MO*-i7_NN7#Bxr1dz=sY?Ai=B_44D#7JvHn zX~Gc}Z`bzw~{PXp?j;KOY3+)tfgzZ1xlm`%=r; zwMT{qOVikTM5(piZ9M~5j63U_IMlz{|H*_D2UZ!ZA9qNt|83GEo5vAV2TtfRQa@_a zIlqNC^0>5_c-eWt;&Golqy7}9U(7w4MsNWNj!o;Uw>~dFzbWqqNg9h#kR5I0Jh4bq z;5DU|EfW!_pIEg3yadv17GTmkM)h6*~m8Y3=oo$k&&C3 z&d%QLb&5{R#A)aKmL`FA+nge=yY$tXo@BSX?7UQ9R=* zgG$rWn+n`>S&Rzm@it?CPtp5tZh9$hCK|Vl_OtUnA|at;pIskzjXgYI@$=UJdFjS@-bhDm<5;7>%cpuj8eCF1)|OGsVJbIWFs0v|tDjNqvt zck{rS=JmTZkK2oH)%RW55Kd#@11CAGs9L$x;Hl2w<-@T!zkT~Q+PBT15z^)b)P9?S z@`->8dLV~DrbH|(8qipxPkerW`h(m>Gnkr@fj7Lx=O|7UP;fTEFKD*^iWRc59NbG7 zXX3FeMo-}J-KkrvUCNo3ZKte}7ATbzN3B!B;!c*0%K!tv<;SNN^VrkLl@k?}bRmpq z{~{Dn1Z?VENPi>$Zp;`ZvcLKMMmM%r;Z#r91Bu&&xE3$?QRuFM-f2LsITZP}3r9{ngbI&|36wT+CIPv}z0eX=|1u!RRdIAh%b=HuDKz~&AvR##o! zK$^~y4P${XYgPW9jRNd<7mE zq-&c@pEB%6zWHZ;cKqKGO>s~Fo&(pV3o}^IMo|Dh3RG70wvMx$RlM!ON43R-u~BxP zh5q2m5cIwL{K_$0Oav}qNo7e{*|!IQvV?2J=a-6N39gILHWpJPkRRjn-2VHasj12O z*GEsD&>T!-=zxs%n%=`M*)EiNB+Gc$6APM-Xn@xuXu9B(Dw&R}1MuP4SJVGxle{lBVqQ}%%t z6hsLg4F*_zdSO0+4uw};)hN?J`!@1%~$W@%eqejnPAedH#}LS$Ocg3}A9YxG|b zg6fUAW!d~heE_K>U?Cj}t3FsfBTiV<(>bX+d*|V}{_EzqORpCPp31uaX;!kD@#;I$ zf|BHC&7UtNF_|&ppCxw$GVDou)o)kMaB>3j?cVlgG%D&Bhdr{S7#0TNh+XoFg)RQB zBygn$)cQj`jLYzN$eBY0s?_j0_H2if0~%#yX;n?A;{eDF{anda{h&w z)<_qLwKsaa22D;Pko`i^uXp#X_iQ{FryU=5klF}y2JSjV9{*XCDIk;-B|T$f@=h#` z-g1bcLS0$dNJD@r=4bqfY*}72Y)JsPtbw+%!j}PJCBJLJC_Z0L~ksFjZ&Ki;5GBbyV> zLuRQTb2uss45X7rN%iyR&q>s|U9YbC`FR#1#>PZ_@dTS+5Fh;V(yHRaLs=055X*Hw zVwc1w_%`PCPhqFkHFg~}s(8&4VK9{0Oq!R_XuWT!dD$lO1OFNcL>#2T((-bwAk3u0 z0EOm3q`G9+Bk*F}#6jJP!?71|*DF&#Mm#_4MDEM;YyMu)ZAhg&K$aiTh4+0S?C6|h zg~Y;LqpV0}>^Nl++71dgcEij^Rzj~}aOM}41^}7Tv>-H3vBTEH{rR)%c|gs=8+|ClXp{>F_PRhAnUO>km$FO!Uy zm>WR?*-O34gi8+}e#>m3P1oRtA1S=}*vE#^ z*A?<)pXljORJr|vp@7WuH6;?Sjy<8HAfOF7VS}oX9eOvmXbof4S?oiqQOwR z!i`u}LYiA!lZMp`!j2ccpZP>{$L`%XXi^ohdYw9O;~wJf$x-=bUlIq!kZM9BB3Mc` z!@bW()@zU@>$V1ZVSNH80@W77m%C41q_MOAIKZT{m12%2-M$5l!u&@k_4owVDW*jg zOPB~C9<3vCKYZAlSk|>L6YAxwf0j#MWOgi~r_4doPpyeO~1>FWe;bAlT<@ zKB$Ol$@HaVWtLuEC+|+r%}pq(s>aKFkQTsy{Tr)VQe5F-H)hPJW0Mma@s){xigSlX z5FW(#vB^r6=&*Iy8_)Li+{Cq1>o>91GVW@^!+KOTJ&X3i1p81Y3k1n6XiwFxv%3fA zEXP?TU?bWFkW;LhUSjMo*VpNs-xjh$8nA|}EAH8|CzwUfQ#gHU+5z-4eGuxH_fa0s zr%xjNkOrP!SiJ{;^q=+&$dL}3JOuPLNK}($-#rh%c7aQy+m*?^;C|N+dPOphK_Qr_ zJ*tb@y;djJo%+?;z#xpKL{&q>pwVy;kKrI5FE&$G$xj1IVye%BvA6Lf-QA9zykVEVhWm*JWWXH?`@AF21EpV>a(T^=e`sf?7+6=Dq4qokR8D6s=xfcw%B#8Q!Jed3tWy38xi5kFsyMX?ts`0dv3mv`G>(F4lhUz+Bg=MU9>v zUErTo;4bDHLx;wpokQCnZlOPm;Apb2`0IAfk%w$j;da3|^yk<;e)Q=4y$K_tx9M!N z-(5Rx^n9RW84rVPTsLCY;>9zMyIz`euwkP{fHeteoqZ`v#n=dj)!I-l@54(ut; zvv>gNRWucFSUiy7d7J(?W0N!oEiSJ3o2ZdcD9oU4fZ!c&6jRNT#+pON?K7QjGplfo z>bK%~mKk~61%O|{dhcv{yn+5-y8&y8vDozK(=`Sxy1AyVT8B^wG{ZiQR|DufUow5* zLaMhr;j9J6dV2AT+Z0{DDBOYv4nJg5#hiuLuP<{CTki{pQlXY}E>G8ST}z6s%_%ZiE&oqYku7vI$1R z(*o_%YoCD}%(LgtRX@y&CU zCKZZsv%K(Keda1N)peEa^BIm4f#+bk1hWeY4z6NE^MaScAi^!~D1EWQp~Sw53m<)7 zKOR{Qf9HQ(x~%C2M9L#iDA@?whpV;j-_C?FQ#Nkj4l|oISP- zls5wiJv8NnGsJ=NY%UiKK20@k7FZ7dlMSJ~#hz2N7}YVy4pMdmlL8NtY;$}Me+u~Y ze8|0f_fCR-(1F4esJ3eL^{RvErjS1;IyM?!=SBvQLKx9gTO%ih8_D`y(2+zynvd*f z&$Q^U;5OJLm`%k3-wj$T0zC8~{C>IE%yM)$>5s9FfHE)__3oz6xBYL~Cy9zchE#Ln z55%d<N$UIC8(MBs53J#5^_m~{e&c-z9!L~Vt1fyIUR8!|M_!mmZeiR zknd%`7_q$>Buci@K(ChyliCb_2hj!!lf$~YB)i|^Vwb~A69&>S15gmpHcF)6=5I?| zSVN+c_HY$f^~rRK>|V?=3W@_L^(cTIo_8?%8e-Z_EX>J8;&uj_%63gLq!(&4cF4-p zu~j1AA~#C*WCJti5Kh|NP~4!R90AEE;yaj8sL|Y@q=I4G!{6E^r4?%jq)xkd5qDr40ZL zseLxVkifWT(Qy@buVu^DB&T(RBcw1Ff`G&@+Rg3o=h&E-q8?2H!GilR;RVHKelei- z5%fb}t#4d(s0Io=z^gmQULx$28j7`v5`#EcZvn7Dy$y@fE^kY5zjwZ0yJj+5`7*n{ z^l|n_+c-ElP;vLceB$LrpZ<)eIWvEure;o+UR70ffcg`}Cd@bYZ&zkK_*H2s;(ok# zeuWcbEM2--d(W>g|BcXonzFh@>22Z%xPO4po=X%X`5Z7rG(Nik$ZT$(c{KTHyH~p#XK(XHPnw`3bp_z!=KG z^`IQtA2rd%MVIeEfh@~*WVD%z_wBtyP5DVq7gp^eei}3TrKzR$3uyp!`@g*yjGz8t zFjq=`pqEH$Xx@L2?m~b6K_dAgJ`+3(03OJk0#FO7;?lb}-XCBp%($3$$(VnWU(4k} zaCC!Z_rY14vR$O)!M0$^&Nt}N!r>j*7wkg5g6xiYzhwsmIb%P< z($KV2(hLj?n$$~IuWrDpzaH%|(NYLdVxI2c!J1U3h@!ZTj25h?QIn7bq&A*#Pg2w; za+0zCRw#s6CC(;gi_<)iaBsdkT~!0KvZ~A(U7{tM%F0r}<|M}q15Uyp1~Z$r?-N82 zUIX5hA3aK)Er5s4E~V4@WO*4EIlr4OCS}Fj30dS@m@~5VW!p zgpYEcJVsI9*^aZ4SB+C()9({3XDzayT|R*jDq0^&1FStPvs2~nv>Uq0lzZN>XU`8! z<_}^=Gys5r-Bj4p7w}b-Y@T%al}4?GP#abq?}A7s1ZB!sR@~TL3|K8KQGOY1gGz@E zn-GD6#Pm92wCi=EwoLkq^$%ZPVea-h0Is}cBop(Wo;48E!VUIZ>$JEwy*9(nU@r9;{Gr&XGTUBv;%PM(*OfTW7+`73Z*@}{ z^8zLy>mc*!Arjo=1EN8%0c8Go&_{hI9U%7tt=R#pGPAS6&b0Z+o_PK zv5A^O9G_uU;3p4K#iM$pOT-+EjnGk?T=7t2F1UT4IZ9AX^Qh6wt}aY|S3~@uL^Svj zJ3n9ohzi~queCB^1moEH3q0Gz1>6H0oMjE$n)hd^FFQMf7_wOV=+4>{p z9A+_j6#4Q*xb_`cF3s8M7=0ZBnjF`iz)#!yU0@RS!O^2eN>s437){2)Vgp!- zUf-I6W4*SIldZt=+c{%$OyC?#KYp|tF=Fk>%s~NvOc~|*SySUnIS;yE$$M?jk;V-5 z6_+7r!)x!6mtNl$Zi)MRiAfUM9s)2qi3+bo=$Q_i6?fBkqAsN0^TvpYL-u5PdMvF;&XFw0YK0 z@UkL;-k>w75M*_z-uAh@+esywnwt7FYo$P4OccN=AT4V_m?3o41*QEgD1G?%FD{UzrLL; z+$C*0Xl*><0Ljf(+J9p3jrN_;39hRBR%HJFXgUwLp7-|uhm4McjAV;Si4&3(GLr@w zk(He!q$MH}vQkJ{Es;8e4xxptN=QpqSq({~gpBC_yxhP4@9{Xl$9><9`hGv3_xl>J z>-BnFC1#s3y^%D7pJji;-H7fa%u}0daMpwX>|QaAfIkkuhS~ouY{VhFMWxuoc)c^z zD_I~xfso`<(hT;aX8-Qa+VcEp^r6g0QA;q3$cHZS z+H3rT39LrB{QADgx z$;o)y~9z3QI=oFf}ybUnpMP^WI?vBpX4Tr zqm1psyVJXuS5)jGY#`D>!0ZYyPF(6qe%MRX8+R3-eeJnx1)x~7W+^F6Za97U~7{C{CRv6OiU(_B%P z3rxaCXYM``P%`8vU_^cTVrBZ4wAY6f5=ROX-{4aLzM+APjvixw?j!JLZZ;?m^E z+hFJMT?+nFGhz=`Kizv`incrmLaq#xo%b=N9SDn19FUoKJM>^=1 zwD>ni7M6waCSF+FH!Pp=bt~ZY`yI5oA!1CC;3k-VwFJ z`gNPf>jX1%&Ehm{)A+M?9PHn~spt+t!2z&UGDC6+pIjzBr>2*^H*H&+Mim2xN^~9E z$%z=w(k~KPm~mPV>ZpW09bJ8?kFcB(C=f0&0c;1edyx&zzmL-_)uFV=ln_e6f5}h+ z9FlXtkWWG>?7Jd2s>Rf+>(?NCpKNPeWF5PU>Xt_4c3xf}HffTzxF3wydueN%yL$wytg&_=lm9(d*LE=~cBHKepC1=KYlEI5%n1|OcMU%uhNA`AJT z0+Fxb)A2{g=%I-64Uv~FGqxw13Zx~JChmDer@?BUdu`FnOr5a7iGpDefdB&eo@u8{ za7bRgIvf6+aBx^kuNruP{C}InBYF_o_z6rzrOL}mr>|@JQ-9#Veej-Ny?uL!e`$(# zhspILX)T1bL9iOtHivF`DVsZFdlnZ~DK3I#A&dyt|D)6l`b1oh+$J@_Qm38~6;S`o;T?PZ8r==%V82Rh7^$j1#<;!=G%GJ*1 z^Qnm)XI;y)c(nxW|7hi;>1GgQh)RRdAHylXLIp8E(k)-6#~PA=`I(JZ5%|CqD%aLLR#3 zWA`H|hbOVJvbUm&Dho+D$wDfiOxNn)|BP+0DMLNJj0C5$(?%0#tih%vhF>FeU_Ng= z+xd`jh+Ad@eyI}xHMTkaH*@OK6E?B3fQ8|5FPM;$@%$T~g^B8{ooS~BW{^(3bGO3a z5M(02QqGM4TR zW5=(yeYIg=_VVLQPW@M}X(F?4>mg~AW6`l3pLZAO8 zH+q7xAj7$v^?eRx%EEMpBa2v%BE;LtZ$F1XQ=rP4lJjre^iz2ee{K3d(k5Sh`J*$P zA$OEQ-oClk(`$f(ewSVT{$hS7Wl+?U> z5aVhv+pgLn-r1ZU{`C9X6MNs{lm^#GY-YzE5182JR$*ZX`8gjaTxt%POv}53Jkx93 z_7F4SFKka25<>!`02L`4vN{VY zyKO6a5y7#E0wn;kkkwCYVREK|fC@(`R7yQf@@?s#cH+c|Mk2NV0zZ{=Lip|IYl4}S zxNwIlPUq|TWVlbve}+~_UEgeI7k}*Y2M}>~Y~HLOUGa^nYnkoP%~IdKri0+jb^s%c zyldWjzw@V3b54PnurPkIr=Vjhg&df@M-%WLYIKu{%3w4#k;D1}0)lNWWS{%}fBIy3 zfz$FM*~xTyVSCOp2cT}7Nw%NF0bXt*#AjYk6rGxF>ZUNjHY#T+ZKy=0E=0StA3A}6 z4A*=hCUjUoqOn9K+6yq$rbB$NPH7Q1nm5tSczqC{4B6Hc6(K-|-@u`;p^31-*YG-| zX~0D#le3LAtR2PFmeV&*DCtG_IB-1dlRe{>0os;_HU61&bzS(S`Oi>I@+v8d?m{&M zdI|YYckGew`JiYLH0XMKqbsD(rpFij54@(yQlDMi(mV_(Ae5LfGhljNDz5NERBy+! zXwo(*r!1nOK4zbnqkb2cHEUF=3S-W?WIG1FfTMzAZ<6tD&|2#0jZT}bQ8&lh{6k6X zd)hMJxMo=(Mvb8iO%CK(R@7}7Kw87Ohy@lmW&5DXzO)XCdYPNM{N0R$^VjHg>((Vb zZq~GE4H6<|kYeO!==JTt>LNa{3>=WawmrSp*x2~qj7y`0bONZozWB=QS+fT68j1MA zKNQ5C@|Sp?wK8_~7DP!l&r zr{&U+W(?4%`r(1YlQ>8yXV%#~Xz4cNcghFvm2I(|NzQ<~{0ba9bmYdPWLIS#H8}xP zbnuulV`SPQkPfxZ>%lBS*k*qn>Ng)4buat49tzr91 zB~8J0&;N_J5>&mReH41{H)G1L5*oPIuognq# zI4bK+n>GR3w0OK2bO|}I^3gSY`t)(FDl($_oIuG(Ri(0}XP@#iS?mU3%GW-dT2-cs zgxGu-RW!;X3=mk4+MUB$4Lkl71U!q=U7-V!8kYeT%05~&Xs zJ7>l>Z%Y4*t6$FFSM!X%fC;D25_x@i2rxB##duZ}V?ynzsOW3f<8;A0*UtZOK_s;? z0g^4d!21q)QA*@HDFtMa9YyP6ZoOU9(`V2A8q?-L{M$)4^YT7j8q(*n<0XU;hi8oH z&>m$u>9k4ET=h+D;Mx(Q8*S6sO=^{CiP!fF$5#E)Cen-T4L(E49XoDEPECbDGv9>Z zdBf;1aff6G(Yp`ROXqzdp)EwsNEoNk7rcAS+EM6$K&$xgrp(-4DGzC@swyig;kBN` z1UWG|`2wR@*)k76KjrDMTnAbBvtZMA&0Yk)K0Xj0@9 z)5tT8$168#Ycj@}o!h&2&%E95UA9YiRjoTST#o5Q6)SX@-eIY_+V0UlW1FAY5T`L| zllSM4CF*mJDXkCRo3YV$+gPi7uaOaM4}NZZ@$t3^JGVzODd4QxgI)<;kE(zGjQO(i z%N3rUNr_tIW;UZ&1no+s&dgmw4C|iqT-Rzyf@8tEi<%Enu_an{SDM$Fu>i~d0y$3r zd17WyceM=ViKrK8;ddQSz{3V)UKYb0tJ#JWB&o&2?K^ge^EI4nbpimpI^2#H4m&pw zEeccF)P~=~g>*((Lki(#YCa+3x6njN;HgbvD*Ofr$ zvZi7k|1g+dNGIHX&PB8Oq=bZoe>Gk?47|p-a7kVYGHX?L2{XC*8^6q`*@z^e8V0S{ zLC6e&$sJL#9AEQ3l&vxv$FnOYDwuyCt76#D!o9_MVM7@v+z;k- z(PJ7Y2CvKWqj5OHsc+Jr-3R|a7hsu}Zdg^+_N`+h)eu_-e!cCk=>7Y>m*v#Phx*U9 zJUNZcvfpZdJVRGAHM(kIw~ujI_EP*SSQ(G(#zRlSx-^l0SeATz=92|RuRWsIgs@|m zh<1Fz*_8c_Y|WFM^&myEz70liBjpC~YeyfA`SSVmh!1wxT^dJSyB5ya+LaUS*L)d% zYIG=GpE9**C&gcVf7_1Sa4HeBV1rnH_?pmNM6aeG+n_PM+4-2jR~(edq`ps|XqHnP z$lNwRF2gCo4NjyO`Ca?|rYo}uF|!6NFGWSL2u1djl?F9Eq|<;oEZ(bFrU9qW85wTe z8*smQMxA$b^F{OKb;qV2TtyGVSg{_Z(i2*{xa%jePx3n%!xK$z*o8jXu$Q+%+t}?Z zOl}3V^RlN6+^rV2Kn;^zh!7KNUND1aQYRJQ_;Eur`W_{b*04ntX^5BT7*h#PqmQ%s5dI*9eHCLofopy#lXLvw)*KN?L>bklZ3Lub|DO0Du4w~^A78&Xs zMs~foo;!19VrcR5IqCOQY_DE-nA7-P*zB`55y8AB}qGke2VfUi?H-@rgLMQ11xy zi~ zNFT^Je5~PL%=jO~H<*Vk>oSOHhlj7#rIqV8((5o2TRiwY@9wXTZh0hHckQ_MmN%xZ zzLu0&X*}kvjbw5px07bierl9D5~-ctOpkXDmEej1;|R>gi2Q$~gZ|fEQuW5es|71c z#Kc?}vBb4M8VC{QLIZ-Xa2s0&mWjgoHPj3-H26%hMR6krx6I0|>pjs?fpp1ok3aJ^ zl0&`hl*@ft${dVU-M$!L^HQ4WAB=Vn4Zxza^ku{Ep@{lK`yL)%^-y_6++)83Cs8&s z-ujPSBrfghIPiiSGF~}EL}j&*S&ob<0Vm$D+xC~`n1@8(+*>OU@BH0k#9<aD5*eIpvSZFn8P0(J{2DbHMc-OR9SP8j@w44TVH_OafN3 zmVgC~I8>kdFeddUQ2ZfKW&{rh+DdCy7+CZ6k<3}6^4rrZP$EaKB158u*r(t_A? z=d6P6yC{Bf!+HFbU4N^2umGX4$rgu{-HN z#4fDE?q#6+tG*ucV8@foyVdD$Cc3nP9YkwTU0X}#>zA()U~-OC52Q4<_ne@(<-2!| ze~KI`t3*R7@qnI^2m}hZH_YIob0J}hb#Mz1qXdYe zC5YmAK)`3XhFi~@=MUqW3xA9q5a7jRClIv}OMlO{wjRgE3)~r@u*z^`&_@!tG%g%y zwz#}|IMd>f?oG=|c}&TbdsE-M@d|fSz2`EG+u7dv*R#?H)05M}>gwZ{j}3PBB)J_3 z4)(?Urca+{Wc@7r_Q49>evNv7JSX{L#NK|8et3VA=boDy7&Z7nqkVqv$x42)eFov? z7t}E^N1;Xi`R}fD-!XeSHD?G%DJjG%#;_C4+O$_u@g;GQJ~r91G3?0@U$S7V3UKr%pQ|>PUr{TzPH@ zD-x`I{QHGi!5_GD8r`{6zh^H`_Y6UCFKrO_CT&@sIO#^pi7&s!U>G!J0fL zrmf4>e~x87s|V@9v;Ija8oO}evBU|O=kA)MKcRgxgA1YD9doJm0&5huP*CzW9#LPG zmg38RZ0N?qg>*&7HT=^SxAmJ9|Mb29eAqlYpoRE$hE&mk6;K6^nnW9VHDziFeoJwO zdd3|cyS}E!>;396ntq`q5u9Z=9~JzY%Y{y2Bp{MQ$kMPSbk`m5rZAWHE!1{pERSZrhho4@b@zDcP)ONXv;iD+@fI*Ah!+uf0%Q{KmLjW_ZkrZt?Dl!f>xwXjQ zZ-sdqK3uXo63vAoHsR?5C%qV!;xc?XcoexwZp)ZGnJ^B{@3ZxUexq0Jb52raOD=5G zq*+eff>8-=wj^5Mfy+aMuQ{&2GfDT$N^=~1@gC14fTTox6?7v;}2@nyRP18-AmvcnhH0akn$F#5F~4X z`F7`pOyXzljR{}B8+yqWF=76*LRrYqSAJHdfQF0nKDazitBaS6L}ue~r5Q(N2MZn% z+-y(bUi7~H(D(l3IzQGnTkGG`fJ8?l)KD)R}c5z7Uvpg><_2I0+blt)!AH5`R z0+tV=H^ca28E_k8s#+1{z|U?qvQEXT=uDP1M#VLaRx8Ul12uEUf{%+k+4 zU1^n_K}Ntg7S@haLffVKT}W3dT~D1WJ*{?{I)i#sOgex!cOGagh%>bpahq6)-J?3h zIUdel`eYZ2rJQbAFpW;`xJ@i>8)cZ~DnBlOe=#6DGhm1fwjGo|8o-W=UsO{zF*x{3 z-@eO^ZQGogWRnxAhVd%S9aTxoF4!Y9g30<{x2G=*xUtar+4Q?vSto%x0d~)u@)qb2 zcIr97yR{>#U?Sl!kPowTi1)IYfpS%RdPF{t=$REX{T?m<6B=!c5R?%K86r&JxWR`P zu_pV#1%wh0Da^(uq6~#g&3>#IGgRO)u{m@bS*RKUs*vs5_UtL-m(Wc%0oPO~J)XPF z8bf1Yv~$@|bxEg4soB0u7Z!rv1p7uhMLkZuT06(v1Mq`MmmUMsaPQxqBY%HeA}U{y zB%9daefyNB>jb|o?*Jvv!9ly9%^C5{wq5&t&GEJ)^dG2qYotSuK$vj5hR9@>>(HEa z4Orv}r#N(kr^qB-Hj2e4;1=_7={e!23k^t^vs}TLYkwW`JK^oCK6)PUbm78R3x~h9?zegGd5H=v>w)a~m8(Rmhc+_8}ffFb0 z`L+?}B3J`oO;t_>w_b*PtRVRu^kXj!q{D|hUAcNysZ}fdxv*-IjZqZEN!o224TK6P zvl153(sh)AFxk<*3WWeNp-dHJD-$a!cN93v=p0a3JlO&0op99It(fxHpGSiZaT{6mJQ zz-Hx2Jt3WTWb}Pcu}VheGHoMH*T5K zv2^PsOQ@6+S*a&R07!FGG>d8D;1RK8C4>%$xOa+L!a<+QwPo5V>GY_3Wr-4h0_7o! zeee=DUvB#8PxpZ&NYkL-ULN0%$A(r1iT^HqP`_3kCXCuF&xZOI1~e>pzBZx95Dc2e zgeSh+&rc*hu(Bzxgz9}hlGSRy$VX*6A+bnYGPvUqqBe*_I*sRH+<7QEj6RNE#T*@Q z_%)f{6yZSW9RTqzM$s%f)=^PW>0LR9;X0YY@A?Cdhpf{SLNQz$ zW9|%Wik(M`_Zolg#Q1J8)d*jsZTIezEG+K!{j#e2s0lo9PJ&1d=A3K$Pa62_qm@ zU>?S_Xw{c4ooZwArh@__eR>f#k{Duk)J!Szg@}FSN>SfCl{%9KKMvV& z4wKSOBi0RsBQHe-PKQ2{To7_}8m&=9Ww^64p5jN02WJo*;l3~&j;EGCaxa{MWL8lX1Wadlh^ z%vK4+XaF`v*B75h0+&YW9KT#=!sPRV&(G>F9$Z4Yh58}!oqlYs#guDw(OzGrO8DoW zG-&x$D1r+!R}cX)^*M=NdPUepIJ+p&bEztI#Rp>{697?;$Pz1x0=Aj>VLeMEtfwlH zK?4t1>iYf668Jtb)PmUQd)VyeXIEbInk%F0eC%h|I# z54cjj<#0Z@<2BPubI#7y+GdtlhW|Q?T9?4PIqvm_2&!Wd_ky-qZ{WISlYVZ@+^|C< ztY>G1q!yfgSV;oL?(*Ty#iZG~@%@UqpdttciLlLiiPtB#LW5XhgZIIM#J*iScg}3m zW&|s_lkZreu)x)vw_w98@C`e|KQGPI>7|{^RS*#`1ZQ6BQB+C zn9KAhQ`1i~9gyr%R1NiWPeepSi);LgHQ<4tWDgQaXISt~7vh1Yfk8)tJEIpS+oXja z%j!F))BErlg_0naOS#KVRQz-Ruz)9J6t6;1`pzzhq#y5MMJ5B6CuZaI*y%dC|5aye zSN%0oGmK=JYya0}0|jQT5xIVOu=-jljy#Hu$}<`OQ4h8<9EWV31TLIn9rYq0^Vx z3K{_)?>j8arq@>`JWuD<-eu{89A5EYV^&}aXf$a*TNuyS^kZXs|2sq|53te!BV%~k z5~E;&$gohp0T+B|k#iFXVsg=mD%9n>OCICW%N%s~{ZE_;(VFntfP|TwZKr0=flMNt zd%7gy_p<*I#{#3^5~J=^TwK9*ENc74wz)(Wm%J^ARgH{{JU(Utl^;MdA_jjNB zN>7h1TOFzaWF;&LkvDDe>x`b>xE~*zqW$*C`4dm}U8S*;$^GhU-}^`tNYqhY!Y#%J zf9HiR?D|`23dVE*L8af%keHa5#0BUM3YWW0gL!oQq40&EanS0+Qf}r@Ij(JL>SQH=NVQ zGsUsHxlKt7TD8L0ZGjSgo--{3z#bdk4~n@kYtp@1DOq`+D-A;4)_Oc&^H@p<4gq~m z@%*pL7}W|t6@a$7*l&OckI-3@61;v?#7L7yVR7#2*Ez(cO*b0VfEGzm795^YC%P?& zZ9@E-b9v=15*_#86;*W^O{J`# z=v0SlHXz;H*;XBCD5mVY+D-P>t&A#g6jv(lFEigB4p*9UCi9_H0I;F2SM~Q}BE$k? z@(N;uy^LiT90~stunN-OcI!>1RCLQoJ>~VYJF2ME@bL3dt@l{}wwEj}NT2^tz>9s@ zPWSD^|J{Kj(23th>Y;H|=6^Uo-cJZd5Fb?PG!A6S1}B(+@(bwSeg-|(>-2YVR5-sD zG92jFu1}e*iKucDDNpk_STUYwKyJ7WSICYOaFljqpooeO5%hMq!rM`AqNeLS{~eY5 zx$angh1_pUnY6)U8@`cx#c3wzNl!=Ihg{D(cMQ06%xkYkMg1LxJL4U@c&;&=`KY0+ z`0#sRiH`$erN=Z8=4UyZuXq5k7#bW;SrzK zu1UO0j9kLQt%%4?nzyzC(+WByrtA)Aig^|%si=5m z9eMU!^jRpq=fKNXuNL;P3N=GU{DgrmkqLlj=aOoAB;FfluBC2|o__iCX)!tkXq`wi zoYUiG#ukWdMuepFv@yx`If=8doNymD`}GqOOEWX)qn{^?AMYX?4$0)y3`SUQQVD@+ z<`yN>+5Kedy~RAGm|yXHO=T>f`GRR1APnmcHgs;dzGH0U^?Ua$^|P-D zZr59(V%8qa^#)V5LND$ABi9g6Mb4EBXK@@vmb3UqDp@wBe}**T%!2{POr8eu?Oli& zRHWmND1x^Wd*GMgJq5XlgZjR2tAY7>d7+Kf=m!Kmh1q|e0jU5g{rg7&D+L7yyWm<$ z=VY?WmvkU(D@^8Yu$}H61=V=FY z_Zx+Uh0Cpr&ie=yeeuQ+T3%VN-gWhrG2BDm0b?rMCd7xrKA!nf%bLMqP<3TWD3~b* zN8AvUaC-_IMNP};1fCv`7EI0%Z%#yb7*$$dP{;Xe47C$&EM4I42xjViw6$B%y`$(C z7b8Lz=so;Gt7+5nG?#bs?i*HhwSNOy5~1Psf7iAuM3j3Fvu#vsWRueO$4e8k{+GTD|^ z)LAFy%^f|PQ`05GUN8U>8ooryk~KJh&7$X_-TVh~Ytv)koQ#xff<~v7%purw!!bgJ zi}8ksQG%+;UFUU^oz~0f`A93uFwF_J;HG>$c~7v0ZqxkSgNwoEQTDE5*|>|&7uS(O z-X~1R3QX|gMNA9D=7ux6f8&RB3to6PY$P|*7`G4c2WGSv)f{>;!7&KA$lb>>PsKSy zvJ#v%m*hm62GL~5Bn4vKuwa$5r%pvOePuuewnC06o;}p-n=^{siVhmiihej_fpite z_zH#lxAD?QrYR}S*-BlW69k?aaZdjSo8;8-)Ki9rGtcChu z_|;U-sO&9ufA??~E$Y6I5K9m=KA40YGD0qi*rkn&*>{($|IY;obsXLu&10@=MK%ZU z8>p^$BBECYD>4u>+LM}E^TLi51Yv*Fuiw3j&*wDe=^~P0@ux9Tu^JkTTK+;~f2EZH zYa%tw^G?2+KfH~1`*XVI^WA%UM*hCi$XQo4*>g>=RvA`x8_J(``%#1@2+Qqv-R{@sf7D`?(iA1I{yU4}JWY&4p6>23eGOUM&ys zT@4~*^>o``%=>)w;-B_^cVxJp!+^B57Q7}wvvbYzo*Nj=8y{N`?h;w03%HG-t~ffx zi9MfXTeip>5p!Y!+U_$i2)VLE^Ic`-AUIV#&X!DCF++_7em$6q{zSt0<*s4|m7V!B~b4lony zvFY0)yp`8KJ1`W1t8IS3-^(59SNhZX0>#O6j153cEn%+>qNk%aHOX>z7}2W^gxjTX zRYDC_ome$U`4tx@?)b$$Tp_+R&H?(I@BM2Hk=ZIKh7qwdkP47+{eww~I1iY3oEh$-_&CenExxXcbNSCGgrg)O-~*2AP0rNq?Dog-agh@$ojxUR z_}8T9={n|Ercg4B_?$D2CYLLgHm;3vY0%Z!DcYR|E);r&AXINa*_MLsaxkZT?lzq4 zhbsY6&>iLB8(MRW&ntOco@Tcx0kgZ49rBK9RTzWqJ3o+RcXhlW++oHuYuh%jM$soM(xIWYMvE zu@Ql|u;h3BcYJvxfL0-}K!A(}A%yvjFZ&bZ5we>Rgi4g*OyG=y6J0v#J1AFA$TrF_ zPU9hPfSCvU(T+jjz=0#0Gz8D^CfR47fIlC}ankz&l`<#NqOYkEiC7Ie3oQl`lFl{DL1aKIe;Vx0r26TPA<+ zERqy@DxK+zM@1@_*bC=`Ps)Ek<3VZQXZ`<$F@nHdm3sf(>c1gCs zg5wi2oVF;ts95*1!{@?ygNBY>e1wrO(Yl+eJFv)D<_1fz+X)wMAt_Fv!*Xdms=096#ibqBw+EogD2 z)6K}p=TXFLe;0#Powie5NRD8Oy>r}#Q9qSIJrf7E^DH2JLVEVPPra$HWCbe_Lrs5F_yg#9`}XvzZUo6|5spt*-Z8-AlKB`K?fi6% zqfXFKyfi0k#>{!XhYqPi6)ENi+_-gX>ysx>TDIOa!^XxHVhH-9TjU^&=H4wYSC^R1 z&tL$&Q_U)WlqEMCE)3H*w$3pK7rBKTG@Jo#N5p}25~!CUuDb%mHzqV^Yx>_0=&Gj{ z#{eIR$@=8U+1BCe!2R_M-*BHBt|^S1fh(U36o>*y8VOG%knM=->rJdm_FKg*f7v1P z2=|#P81N=}eCokB7~Q+%`qZ~P(j?re7HUug++}7TK!i8$-Sgvu|DS1ow&Ba=0c&=r zD4yxot!&47As?E##Iw|FkVp!`!>grw6Y4`Rsh3VuvAW@tRTgi!RL( z27)Z8$4&~$!)_+T;*d;JnTCte((ZGIx@#&<40)8=&`&ols^IbCx}fVBN%PBHA1+Fm z)gSy&)#2}v`X`CSW@c*4W2l9v&YSno`e?%+jViwUa0{@EoPv4FzayN#3+{%P=xQ`2R($e90pqtoDGm0!w@zq-LLAp~z_q7C|DGP}px zH&sjD*=F6lS9#@bOz1A8b$~j}9$ZO^ri4NS*v9y?^2Q&ZsXHu#E<-C-=elwku{%mD zUr(+*zBc+TkLH|IVh^|GGZ-pAH=Bn?G z9d1;V^h%)y>LFjRB~GD85?YUT@ZI;JM{7Wn)5xg{?H zl|VEo{2oT5>I|w>W3IuA1PPJS4RpdNxVJG{(4hR^n-~os8yz8O3TS~*BdEv#&vy6H zoM)W6;+A>$uIm@&qJ!!;7J+VB#b}+pw*s;$Te!P3CxP&q38m#bmtET4ne)~Zcm|vQ zjA4G~{yjPl8`X^w8ksX}H+DA*{9LE`QCHPGCLcecR}a@=A#hN)+y2j!r_G!>0c9o; zpA;DY#`cMZzex_6c<>|DgBlgnK~e=J=4AV||BL@3r3dna!QuZVcZj*68)cVSakp;F z5~CwXTV%&rLIS&eeZdWdb`ALCmHufbJXP+5?Za=`qJmFlGU$M;R0V?=^ z{1uV$!7!~%yWcxQ-|}ysw!5t(U{Rr}+cnLxDzPnZdMj^7+vlAwh1)!1#e_G8A1=XV z14=GBUX=54-lR$X-)xxz#WT;4K8wy1L?`9F+unY=PV5Nl=SegyFW-^2*rmcy!#q%< z!qqu-Mw&|c`C}`OD)ku}cJd8#TG^4z=w3*|3xO$^k2hjG4OB$|pL$O#uj+PpJp*Rm zb5|WS^JatlV&d6|+WUj)7(cz*+9nSp)m&{)?4O*xjs2Ob0S@b79}vE-Sc$MiXF7Vx zD7D!W>gtn<=l2?{JNe_pMx$n?bSPV@o9;Wp(n|F((=NgAAm0J2?t*3VwtSI(7Y4n? zOR8VHdVl=OxA@}HQO|u(%$zcA+}62G9e&pzfjsE?AlHP+Z1#xSzh%C)_JwDRZQPKp zD9Wu#U8D!v&E|CJ%2x|PE8Z68CLL<|kI@Dr!}Th66?SSQjavJpa9>nE|DX4t#Vz!{ zR&%FI+B7#_lyr4)ajRc8{FZ8Hr9oF(v z&({Bxb@%Sg#pi_u&GBod?-ZI?yWJMAMilATfL2E|)HjbUu)w8XN|>6jU;7vsJSrG> zWid#^(4W!KJ9acDnI4~gR%4zMgpT8Jx!kP#s5C&87ZDqgjTW5RbI4sMBYo>|r_rzw zWiX1{+^}KK3U0Y{eV)AL1f^#^151XInF?luozGay=64h-qEiQX7s2PJ`0w7`>e{Rg zUt$qhIv@C!AgkwT@xS?fRQ^BfA3U659jJSV&X2tx4_LVlHbMh;r(m4xaE>P9jzd-* zidG#k`LPuojHS1t9XW$9ABcdA9U2c54X?-hw~vlogh%mb%Q_bxF9^#4S2ccvsV*n) zB|5v$Jjmlir0$V&^{K(;NqyP_bW>P7Jgay2Wa@y7Q{r!|72(xb|7+@Zenk>D+^R5i z{;(O7Cb2`Wt?ugie?M^hJJ_P^QFi~CIh9|oP{&e?hF|U(;O<0@{ zxqJ721{-AG>^^viW*sZR-a==?oJ2?J8fN7ky**0&ht6+%WH&UJ7~tm-4fVC?4?2k% zeEQy=11zk}${*$Ay!zZN;pxglzpgnZ6qXf@akSyPdf`MYX%(X(ndtgSE>AtSNvFXM z-UD-lt+oTU8nXk_YMQ1Wo3c@_9W73#y!k+ zyV97Hy^9P}Wm^cKr5HaD7T+-Y7GHjtVh2&JDln1c)_?FogL+GE{E(pqr@@kQW1!COLT+y~Ml` zz3Vg{FF&XLv7fhCBSc3xgSp388WP3YFZ&eAr`g)aKlN4LuTkNJ#53W2u$Fn1S+mi) zfvCmL+AO&=ha#IbVTtR_0yV;X)kDk=9@+nZVTf=;I1IkvBC$K%ZgAwNy`bs8I63KP z+;koo!j0X{GP2Gu!bj4d!3Ebj{L%iSGXR9zjHp&1NkafW%Gw+(U}JZbJ)+U(WXG)1 z{b&)OhE_cao+}e5)xBncQTfnuk82%!?gU3OCF>W20qR`ZB)wVM<}(%6nq4Q}_!c#~ zVulSnm<{2PtVA5W`@W;O>k>VM-eGb527Sv7`g>FT5R6(u;m_Eth`$<*6;w?AkjfPn zfpYEWk+P;$efW5Dp4CSEf{V73+?uY|H2<-p+hcs>)7WNnBKK`^+aZkK#Qp<(CR4&) z-;gX*E|1#eN9K9H`)1x7k8?orog?aQ)>a+=D-n!%BYbP0ZGdo+@^ z*qSVON?-4j{&y7&Z2E0pm3iO;sMX=%UJ0jO$MFUlXEB&qy4=d#bsQO#Ck(tTyV5lW zXjY8K41OTLtoMPUl?L}NGzu(D@88kSa_BmM1-8>Emb%O^cb&=B(O`>$Gmrm05fuOi zP}j^nxv~CLs}skMgL8SjcIaYc@lF94?~Z(zK^ewTmoGB~dS#%MAA9<==-U*;i{tX; zM``NhxokM9h;le7Q+JsLM!5;UmcFv=;l(r5;ZD}KtOKJ)iT-5PEbYc>=bqSIoYnt$ z>N?9Ria5tcyh(P zXh64Ss;7Oam#p{J--uL~D z_E{cVetlfCQ5u=XPd|A489D|-L_73(t-~-QrIsyOv@zsoCk^vq!y#FEd5tg#X~je8 z@AnroUEq3<#NO5IR8%xSwhb)Z&cUQu>HYS#u8#!)m!X}Z=O+!dp(YxcVMZ2@JlC&p z*Qpa}u>OY2OSpY(K%e)u&jCJFLLnrV%}+K2Xia4GWXQZK~8C(t$`Xzti136X}I&wDPYeFsw0@Dtkd_0S`Nh#A6UOHc`!>V zi>I0geqJWqPst9e0taYRSoDfJYX$*x+J^>mFXaIpfsq|k5hFdi6 z3YgvgIij4B@kl4*N8MvP0u0Abol-QCjQAa?si}9KdBhwDoAhxmCvx#dZqo)q&2l=K ztvR%i<$~-EH41Z@8*lGlxMy-;lqn!v+T!zx1@+?s&nfCDxGGUS?p(5r2`dr9-06-} zLVixpW+E@R{;d87?R%nr+IOT&VCfr<1h8q=GsW&KeA@x&$_qRCWsRnJ@<7a2IKR9} zP?6hqdP!M*O!9}A@o29^m<5KoW&{oq$}=+;n^+<%cR*yMuBAI;cl0sOYY-KjI0IWh z-AJ&x+15NScwE)(d5tG&4Wwr{)JT~?009?lI-_ioW%szbQ>MHMRNJFrUQR4ai@%Z- zUcr;&sKX&RTJ}Z5JQ;_^E~ImVM*B#nP5j3k1t{vQu%F`@{}emF6z#|lR{YE2BpVqy zrsy&JjXy7{)S1bo?2B+9IOr<_YH^8UcW9c=R3r&1b~~_@C?!0Hg!^yzMR_N~UE|*# zpZV8JMT}L0*ZmUu8ANHG8fPEFdcne(gLBTQpnXFG+`-f$M+zW=4)Y&3a$y!Bx7z#`NQ>Z3-z?5j}x7w78I9Dml( zXlYG2cs)>K=*a@dc?UndeX>x<1bivo&hnt`6ABqDIVE*|tGz4ICYG@kpyJ*CeOBi4 zOp*+7Eadsqe9kl0z)(Q}40L}zk^@m&$*Ng2#m+Tv`N*;K<|3K`blvs4Cr_D-3f1ym zaW2PljMNBA2DkrhxZMLhWoB!0B0ox~r8K3C=aTdliW3(Y8cZ_4Vtj9qB}c!gAKxqF z!w^J@00E;*j+-_!*UU6#oqWRZNcJWC@$ivAJf62Cr~Ra-W@Z+}Cz?QVJ>4d?bJe?E zN>uc+>j0v0m&l*rzEv|NzQAJ3B&Yovst7_$sK4xJ7peA+^HUuh6kahy{PUIW_G+T0 znh6CCtUu;uAuq?zRNXwUg3)R}7OmcD;=998`bCBnLYQgE# zr|;abP5s_!BPzdK#pllrW@?%{KFrA(y=KiN>jMkdzScf@g3@GGf3jkx-mJh%ZXT-R9)S|5bn1K>0{PP?H3c-5}#Kho4t zxpLqUKIwYHrThnn(Cx8b!+g@Jm)F9;g(0VzDBM=by2+mOJE4#lig^Y>EtSk&2gBn5 z7TkG#M@i5!H;3dSP|cq^xy=aFpgTmMHtVy3OU$%c0oF?>83A}bSa5tM<_W(u1=SHO zmaV{2ty;ArP$g`5)P|W8Ga+yzIY@j1QhmJFcUO4K#-67q1|FS?G*cFWr`CV+Yq9Cc z2M@k|QcZeSz<=Eyks9-iIOy$YD`?M_BovDOxQu6CroJq=6{xW*ePR{xS7ZOKjj2?q z3@7%nj^CTcoSpytYVW6El+P=^x|jvJ+Y>6l%Fp*=iTl%)aoxFfG$nikj54O+!n88( zAM?DVrz;J>jc&u3*a@n5A~#VZvUuY9&u<&)zsMl*2^|jiprEBIG%_dA=!>%h;>f1L zA^UbIMaF={7@4+0pcG*zG-&esh??8&uY9`OkE4*d{&3*ugqd)j+4m-$mT;VO5*KiqElVGIJ99E{uO_d+>bc z_U+X-oy~Q?KX<=ndM{2WEN{Zeo4`$DC~@&eteSkmBwQmY0$`N01eXZF7)!+xgU&?( z?N{)^DA7cL1j~`Rrf!cT8s_LG1hC}bQXkXUx~06@af`WyPr6YqFmFX+LY$e}1_q{{ zNS*Dh-OZEtppM4LWh7k;4vk~)4`!b9Hb15f!cqQT_a2s5gf1!*;ruIoA=d zeY%sRku-}6jTT+jPg?o=;-56nU=c~MX_ui|pu_xIq}oKg{^y^%V5cXZt1x|RjrGlc zWT35k!z}zJVxj5NZ$r*3@@NuI>m&q9UfX}(4V&R{i?YtI!y8RVjS|yZH~odx78k>RqHop2`H`pbu4%>lv;=z7Vc1bh32KC4`wH@adr% zKo?mO|I`f9H*k8^u=h_mRy}$Q4)>m1eGfkfhCa>IbaYP7{;3#d$uVlu?CI&uFowbY^V8erTQiS_j4FoQJU*eFaJAqB%Nid@ ziR<|5M+{whQxwVTu6(`G($AtT0$_G4tTH zz^K&GJfZzvof60NH=u3;)znf~ANT0vK@C;d!>@Ty#kixj{WY@NQW4LTgDhJ8=5QWV!ECUx+Ttq&fif}Dy(gn7r4_+@(y zXLRY%q12}9VTAki?9hF;KV6B*iBMZ)@WwE5p799t9}}n+gjFXZDU2f+?#bkiSmf~~ z=fT~VFC&=tV$Nd$Dk@Kc5{vKSLys>Gl<-N`aj=AqBx*1!-4oH#reC`UM%BU;LixZB z&4~Z=Ly)5*XBi!C&aA)sG0g&imu)$at=|++wag2){DPKdRMopN_1$4Gicu`5l0`yo z{hLECwnF0Z=M!g;Q;Go?aBuDjpIZSSli&0PwHvIjq?Ie7bHTe5X7AKyv5Xo79g6z6 zS;L$Gzeves11mE}ZbLOB-ytiM`s3v%`uKEC1Mfw~6X=T!D(RA3?U@r`-8tau=XQ+i zd>`JXxRx%%#~URwKK#5)7S!t8M2ZEUl}xtTxKgW3*Wd| zmyhP>Y~9QQhwFu8k#o;;w`IxK$nT}?ncGZ~DG6j8-apOr6dM~;I0SH|1_HlawH`o2 zq8my8>&-1-q#}Qj@I;$Kkqqy~eA1*fh0T@)eqKv2HybbW)mLho5$hPjBY1##`1({# z_;Cb0y2b{l(WQ`g*_eH^uyAfrb|up_(-XN%O9G?3Pt)KFCko~_K!7TNSQrEh0j+~h zIO_gS;45x(K%(LhF{iK zW8DSgJM`0Oyk+xWOBdV>-1t)K$VB^>RUg}Isx#=Nq@iqAGqPu!p6~95ZTL8`%D67H z?$i1jpt)ja!~eaGX$uxiMg_u2x!}Hi&;2$gYRa-aL7XoS9_)BDBt#sX$$*JDF^^UW ze~R^V1V2C%uIDZ;Ar{c7cv?CdtR z@EY0EAVfABu}v^rZX6+7JPgHhL-6P=Y9K-)#J_YYSZqpCs*;5*4bs}jww;o7=OcdI zebpRq-U%H{|GAKv`Fot(2&j#H6zHewtJbD20iHfQF}mf(-FkY5jJK%$hgqxrgHWL( zQ+tn5W~aOSz5hAZ-)Xt=sA0F(B4iS#E#B8X_U;hrAzGAgV=`aYozGsS`N6P<{4nrtu+Z9c~fAP^-{Y{3Y;RDkP0!GZ7_+p zy1#Lt`xGDX>-}-d&~T+O$_ypML006cLUN+uCKJLax_I%T*{7R6qZJ~ucjQ+D&F=~E zi_|AoKSVA@0^E{#rSasgZml!MR}7~Yuvomf*mJ)E3-*}Qw)Qv8Kk;&svLZx>EwHl6!!%?GgxKQ3!@h-JMlQYK`a#K zjk4a3osY~nwMwn)%~>m(nfgNo`S8v1TACr&SS`cilJDc1(S5CL2cMapkK9v<$j%TO zGuUUO%W1wRo;#H@>=&kSV9z_g=$i)N3`5cumMsqe;rn2SWBf{&$jOsU-%J3+DTmWm zvP&ymZRE%v=#`0x5@OhrlDu%*AO!d$)Xl?nZ zh9fMvWU0AXnJaT zJE~`@2H43hwxCw*P9OTm@S@B$%x&T0k98#;DH|#Zzx1H64YOKnvnwpWSBu7f5^7El zt!7-HVPWUyx;-1MHky_;A+Z0Z)ClGR5mT?KDYszZ805gJuiv9%V(RX0EUx>>FMscR z_S>&bB-s{; zeNe!gquEld*81?c4kV`;*Sl?ENuo_?92>TVuw<8Plf^ga(4$*!nRoJEG8l zL^1@^4OZ%Hrk;6S_mfPr|B80t{_l;dfBq86BCO`U@=1e&fG}>C*S_{hfgYLow%_1e zSiGPX;oKpd5C7w?(H#ukN(q@!Yc-*|>c*!GW>-dQsLMuXV*QK~sZQ*q*J_{Q+Gh%rD zOW<9LhS21Q2j_w>XRQ1ge)yF`NU3wmbKW~OpjAxmp66!ZQOhvDq90)zk9)G%g8#3? zr7Bm&BgXWNtI5IZ!`gs9Rr@Wd-y%DVx$Qhsrv%jT_qMhfc?YK+&)fk=?d)_lWrx$2 zrY$k_YtQL~*rYgyGMJxzQ*q#>epgBc_{NhzUCk}e~hZujp#v=AO76x<7550pJVl-ubR*h7IF&3JS=iU-z`=v2TRi1qC~sU%eIZOVxyRRb8GANK#?QqM6nMb9-TC2 zH^~sOZQ1KxuMR2UT274D9O?^zs}iZ_&Yf!=lC>Sd0qi=?{0NEV+QXy|0oh#K-FQ@!5Gu&RTACq^3|A8PNtY z5)GRtwjwNZX7ib4qutP=H`VwpsJ_{90EQE5eX=i?le0xxEv~dowHeqWKW#FQCnxQL z$hzI#FKW!g$~eC*;WEGC_6Lu6Xn_C(>5R604$S#|JYp85<7LgQ38r0UL-A5;~-Yn~uvuw5i)cCkZln{QfMv1|6xmmd$!vC6U^++%NZ zP+}e~<(Bl@V&})C+I&eo-+OcFuMew55sD*yb)cE9QJ9s0QoN_-PEP6NwTsTrS_kHm zM3^?Suy9n}Ng-CzgQJ2w3C5Pn@jDfnCTp zcGiQ+&NzssM5*PDj*Sl+w&JS%|T z<>2Uev!o`pcF^r@&(cu8kBHSs%yoGGby!cU7t1)3LVExgl{HKFN$^Mz2)}YRjQZlu zVQ;--D^w*=VapXOVjo`0wF$pV?Nax%X59#wsTGGQs{xo~#{m5TcqDm;Iu#QMa8v4jo;=+>CO;E#nb-$ZkLuj~{1zxD z!7qPRt(8^~0+prJSRLgS)zku_QU&ut!ZTJ`QFcOZZq!6j4A3Cz()ocO`!=TRkJP4|{ zUW;vjJtP<xsA(?cn|2d$m0|N4C^MaQP0^Q(Th?+>Tm!AXv*EKwBlkgPw(5>go|CY<^4(=xBx1U=>+{|nzwUye zdi3bgsMHW*!OlsK-9=hHrH3sv~u2uHnQNc19&1cs1I&X!&)tBWZs4AxwRU)Z{3 z)3Y{(x=jYy6!~d)*sa^|s?~(KwWs~Qw`(8k{@_c(OzjTBLi}-dy~Q%`nEX|1jVR%O zcQDg|-`HQXjrXSm5%izVk&{1$R)6;b5e&!T=K@KCX|7AkbNwMhIH?o)jH0VYHE+A7 zV1`Uwut$Ng(QNDMi*LMpU)|_`x8?97wd0qS6rGAovemWKRb|vlx&j!M{ur7Yc|g3h zUqziy%qY2GrzbnF#CjJx>404(r_@?79}mNI>Z2E_EpOus5=3@+2~?eO>D35T|KkTe zzo9+d^i2l$fl8xW>*iGI@^m2Ek7QFF{UP}UZs&#Pzlv+WOS_B-(-O`X0*vUwrri#; zWA5Sot8xJrK7Q%xraV&0^t>*#0hX@n<+5Vi-Tm|O@=L3lOke!kiXl;qlK+GB5tJ@C zT_k_0qZ8qYN49+HP9cR2L&|d%BHP=Sson{XdopO?Vb;D|y7uzV)ytO~t%{s6xqAIo z!)^h(!Oi)wz{K5O%+v{Hmc8WstfDx#OSre`_Ff_@(7l zB;oi%Og;Itw{i=!6=pkb`DEJl#xMg>GAlbx@UXT0SHo?L!`xS%mus(6ACb1f3=9Wc zbF+#$z#>6Wr?a`+lmM4fW1!sPRo&02r>2Jm+~NXJG1D1R^o#YaXcSbMzmp!EAiFxeY(<~u*GeGhO~Uus7Y+lG>S%m5YF6yGMc4bDH?X?lKnDD7Lk4gKgNKhBd>$@S0~saFuh%h zKXO$xDe@I~Fg&lxg_(c}%uuh|cxtz3%(8Tt&+$LJCTEYISn9Dhv|YkS{|(drPPTpb z_-IDSe!K4LcORbh!Ab3Yd2QI&IWSYg0xXY@n6YfmH7a1kFe~#uaVXlUiA7y*-Z<_b zeze$8(e6VR9|u{CkCyUp#N>HX*%^SS_bxCq)7Nbe2Vrk+fk8XHzE~Uqp(6a$oe|&l z?`C~xJ?UC^ZPp0qBc}3BNzPLJXFm9`PZmv*}`MDHU-V(U0qyRo6DdQN z$0jRi`87QAc)tRZhAFdS@)2jAG&xAE&Ds)+Gh6~-CAdTcFEor$;5bF+5{v&rP^z_d z$=%SQw~MDC^1oLWSS1dT&z)j$u%^C+SbEWBC~vK+!I?t07o*j#lXPaYTuBK00#%@f z?&P07e_jLk{5MWr0+;PEEt$Q>=7-lvS~RLj;mOhW)5$Ss(CFLOJg^R`Oc?6qO`S>= z?~ET!?b2iK1idwv=bY`{cqCb3?hK}*ttMuo z2%yM*q&rL9CW8c%IaJZ=|M7Gta5=VH+rK45Xh3F?c~&w-6qysskdO#vN+=D6WU7Q@ zN(hxCQ$i>rLQ*7>hoq7usZ>%(zW;ij{eJtmzxUhw+0=bs*LkktIF5C!e*1=3sBAsp zahJU;)>F0|pK`@w<9F|*^Ccs9Q7|HfEc)@|UwUk(L$b9~LA7BM^?9b=<9zK7G{&Z4 zf4h_jAD?IH&Dw<@sK1g)obFHm(K`R?t=Z18@9fsC8_4gbVmfXX?sT!p$$-$pE5Hs_ z3^{lWL`&jb{R2r|vPK2y5%Cz)UI$+y%>xh&D2e&L@ik8^%*}ze$Yhx6^zGU!_0>O? zrqwvHFVLF56Lm;vn(M@@m!Qx@@D6)|0(8K?V`F2lo)|^eC67Ta9v`}9tH?*3+N{)2 zHZIq|N*}#>5CohfbG+pe0wcCHg;8R0nVhaQ3@^G^HzQ)vKiIT>UPGn{LZ)OXG1-cMq^eNJ#Oay%-2 zUQeCLr_4xn$c!jmf9uwFJ@ta4L6{D`HJfs(yUNz*xowJ;x8HE4#AW&;b9H5;_-tf- zQQGQX_okcrE_;1^{LejjSjHSNk6;hDGkXk;)gg2Fov7v576iofU#H&<4+Zoy$Rol= z*KHm6-pJIECSp?6t*1*v!@}wXB#&jS*KoBAK3U-=zr->0l6&^-ff93I3fy}0&n486 zvCdyPDKaVsx-uF;83)SzwUaC-^!ARo*Z(o8rVE@9lK|V`n6Q=23LX==s^#R_-fNvh zoU-6#1>3}RPgdWyY$;-Vz7U_4g0)|=nOW=BfhC=~8}%D)Hs4-lt9H?YCy#3;Xk=E( zN*oL~V4)7*-o7~2>*nX;e&OdYG^JwFpT05nkIN71)rRg%+i>jZ`bS$9*_H2D zq-3JM{A@?; z)+&=X+pZQmj>t09em36V_l5<#*0o5RnqwZ=RCOy0;NYD;UOC`8^i{ycV%Jx5t`s}9 zUmC6nYyYh7=*CA0f<5s#WidBIDE#A1sxESZf8DNGr@QCv&Mqx2yZN!=XY8MLEzh4$ z-Tu#5s= zoZNAsY66rSa1U_0Y(2wrWc-{tZ|3Z2fY#4kd*Fx>x08zu>GtNwThwgIeAeQ@-ShS% zzgD`Zx_U5-0(=oWsQ&p^U(8gM#)fTY9%NZZ>UW&edQQCXx+t@&(SwjW)!Er&YgRLq z@aOP{yJJUdwg(pcOrxm2brDM0qK&ooiuO0H{fE#?R(jTIH1YR~9DJr&Abt(vKQ|a0oTrg;T=z zR#|QZKu`X$Gi<5REJJ*!T<-pE|DQ2k2T+!*8`hBlz&|-3UBg}$@=E7F+3PztfX9gD zktB;b1fE4|#FDP#s27MGS+(;CvHjFODto7N9q-bzXZWuT-pyXaqlr*OY;%cMe!W^f z(6T_8ghz18M|z`rY`(kT#i#3NONOs+%;4lbn|-mGA)%p}&bGYliAOKq5-_(*YXjoJUv)4tZm zfE9e5dQBhL%yaQrt$SGkNuY9kUUTpLO{h5rA4~mIRJVKG2DAw;ls?XgeKC9Lq)A`C z#q#-LufHuhKQJMaVO;q{t8m}puq~^4bG`n}MJsOgn1h<+XXpy&s-GL7-WhiA0@|k| zp&p{XedgL9_pzqsgFjThd=>W(Sck2xtyjIsR;DA`+nqCK;iyBwl=TJ=>U|4TFTM40 zO;58Osg=h!=-u(%-!|)BUKz@cXFskPbVVS}A#R#ygjR%}FKBPl2g?tY?p-6>=>`ME zvz{GzOBQ%DrqUXhQBbH*7{P!|UJ<6Hw70%*R-U1SLtd!pURmMm>x;k3zDuK`Ce1bZ zS`A3};+;|BbH44reAvL!#@J_Q$nh+fQl2?G(9K(hRT>3tKa{;)U$i3nZNEhOsDWb} z-^9B}N_{Xn?gMxoB^ky7ofw{?9CvW84-7;{cI%L-db7Lq$(q)YvnS1SjkBf@7bOsC zEubBls{>sWj|Or^LIH-~VZUe0n|$0LvT%8v`Sj_sbT%gc@Z8wA!J5jR=$2$Wk;4|| zcG$IcQ9whZyPN-Du9WZDpo8}C;d9+L<1SIv!}v201{<2;In)4G5yYJY-j;DK25i7g zLU6BOmPQb!z^i znIqN{;Jq%Xz*vFU%lcw2Te%t>JD3cwCv&FtdacJrUpKI`#>pV)qt}1Lp}8Z5*w+TG zZc){+Z$0y+a0 zPRckLVRH)VIazta?5e2h3neS>u6nw3s?5)pI}|p~{n(}J|7iizsz5(}?Y6cG*==TR z{eIbjwv)ojuW7Cvwe-9Drhv6WR+atSh^vds1e5hUk8B?`XinOXKZH<}o(8wy&(xk# z{nzk|*`W^2l|4EA{FU&A>VO4Bl`qoMyUcXFas9e5RrdC0PcOUlYWao{pOPLs?d*~H zdHpSLs{NYUAtQnla^rIyd929aP1J<}39FpS(oPhnUJ0Fw2O1c}&c8P^(@gblcJ{OG z=K4)a8kfCk%Rmkj`370zZvUkv;rzciKKbiu^~9yqcg-~Y;9V7QvltiP`|`S3_#Ihu zNiG256fk$BsSIv~fTY9lvulf&P}kwc-2EXf@=G6F+H>jC$W^Lgv3YeEu{eT?1|ZKW zeC+t}&eZkbc(MTk1BKXksmw3>M^Dz>J}8R%@mYQPI}>2gQ4?X;tM}6F{>JO{+0Wqk7qx7 zWdxbnWGe0#f&sPP)$>^c7$jtq-_L%T-nfmm%C_PYu00u2Tb44c*`l?<=as!J*qSs)9BRP`Nn#Bah|R0xBczf??IWx*Ys;|R=(Kq!7?A@ zyWw%vQA`wGdO2xWqpe2pp4|>K1Vbz|>^5nX*e@U?JVbt?(g#?f@Z@~xwD6}l0;la= zv)SX;V$-Rz01yC@EhNBgb#8t+cmAWBXUdW(AkYF8Q%~8UwlNyNpzZW=Q@$QAF1b1s z8)RrED%`0>>$+$y1{nGK0qSDJ`O@jrrfDaQbAHvLwTg0=iAGVGbHDd*jmJLj37z;` z4C>Wy+U}o=CcEuF)FzIq^`~g93&#y%EJzXS|70+lxj7moT71IebP!lJ$ei5tqqQj6 zul0{|9X+qJbL9q~pf$kSXbT_&P-!eo*r`irP58$QTtRv!)2Qm%9RQVRFC~ZCGx3sx zZ%HruO@+;>)6+p8XWCtBVuVq?V{+dc-zT#z zN!Oo%BO*N!cbZ+jFKIK+kFbqq<=v$nGvSKYp&zP4L&-LxSlNv@Xzj^Iia~`#rSOMI(t{ViVB3_aD0sZJgq5(EgIEhgOY!jPrMT-39+|hEV#9?dNs;|Y9uLsiFw1qw_Mnr5*AOg zN~VW=8<&CIH?<}DE_~9{>Y{uzrQh6G-wYXrHHGL;HBle zYHMv0!c&wl$4?*UpWS2j{*_sy$zPRJm6f>vvXqJWu(pF&GJsu|vrNRN0HtRF1tu3W z6zV7*cAN%rg`2o5vNu{wKKTd;EZFR(an?wkM#y;snHD4=>j&a}s^z5noB50K_~=e8 zX3oT8r>+8U0MlgN|;z{XF3n`B|WOOyM5tEJzEQdmCT)zwZ{9{b^HPhCM z+nHJr8WYnx+A7QVz0re3QQw}AQ4_@ZNy8@&c3qjtvN5&LAf8v}oekb*_G`B*$)N_r-1o0+;Yu@`y-rs??lQFm+d z`-_>6xE<1((5^)Eoo}}5@#Eu*S$8R%Sh2NglP1O2qGMJC1Xy~e&o`KB;%#-~LuWle znf*m`Sz1N)k+>}SY?i|i{JB4()X!($0i-lyZkElWQ`DEiiRO!_a*LHNl9mLyC_}^ zFc{Nl*0N=HH&>q*`wI&T`8r7Jx+Oirp;n9)kf)@e>GZ*FXjMSc8*LROS!(1zzC&(x zSswV)H&ks>`psEu_UQ_Mdd9=`+XBvME_f{`59+Hfo;dnvQ+^CSPXKx{)P83F1=z$RXV)Tm5zABcVO z;L?rWk+=6_awdBzptpD=^M9Sg;!ZkTyeh<~8H82-0ERu{&4##q+1)YVnKBi3=FCp< z6az(PvSApra*ldhEi^S>ToPtemjOxq%(~{QPj8b^T7{DLZPIyGtdyN!@MjmkG#wB} z{U^J*(#U&v%2@B?3je|upb=u*f_e4>#+wl$ImN7E+?jF4{Xb9Or-TC?#nHr$qv%-Y zCOY5Bg8H+VHR}--j5NZC`oo{b`?}x4@2x$0O>?hCTL(_(j3Tpr!ZwPxfwlFO>Tv(W z1qOXVcUJba0ECpaoAF6wO=$#4VL`@g5L-hW*>GWHWeY_ErOiYZ0wDuGH*H_s*u|Sy z3UwmdB?eKMc4tBZ1#M*F?`6HWb=TQD5Q5`Hmpi?cjYWUJ5M#x$?3$gl>zW!GYu?)O zh*9q})XsW2zxbAHqe5pR`;(w@PxtB_W!?wZ1=y{onkFGlt0I1nd{x>RcL2}24W5h( z(bFqvO+coX!6O0+%A};6E4&3fj;zUd5w9^xE(lFK*0ck(ATJ$cnc9DYWugT@gWO=> z?$oi%0%0}j?InfEGyq*QoVD|jmvlA}b#V-9xCIzZhQRLG(2yJhc81`A3CrVg?*DiN z1%#NR3Fk_M%(-QXWv)mlvx4t${#{obwish??(#g~@? zt3l-L@C^=&`7zcccvEkJD2o1`41`j5)|bVyi3zVp zp@1=%faHjPgyHjv&|O5dDOw2nRP)^$3}SvARysv{R=vM9|b?Vn1IOunAbP#q=(Ygk4U1CqN= zybk7*kh`zZGX#%AvYeWseHVXwH2Z`LucXEMfAsa+0GHNuSRI{pW;|u8#dz+5tW!Jv zI<;U)*Y!sQ>)_sA1?xbh-&A`_<5<0EEtW)Hiuu$=tKU3Xgq!-Moe0p0tKJE@+I{+% zx@YB;iM$dyBh%Bed=fd=b%(4;Nbwl7Xiw@HT72jC_d>>eLzw4>`-M!@JlX!8!w~fK$c$CD-FseWxFX83OXq^?R&Q6~LPVIu!Z>V`_s*{&*Q5W* z@3j08eKC*6e&x!Kj1Ms_6#KGaM0P17SG!h3#vK;x+@Kqe3gNXspchibwo7?mO66O3 zXT|!GeJitgDcaZ(c)kKKG7~LRDzI)+FmNof6i`?8L|=VC{vS6?se7}gbZl7Y z$f7;j;=TTN#`0+M?qm6kIIOoLi3y+$L~tWBqo|U_i%CF)iL5E!z%b*rZu3wxvoESE zmPKFFT(07g{AV-mvvC+^@A8uT{qJ?G{nmiR zG4IbOHd0oimV&AKNs9YPBu*kvc^-J*Q8fCaJGGuo1vPQzOPxjK^3)1MrG%|ofs>hx zFo?4UAkH}hWKDc5lp{#b`rfU6*k3SMPMhEN7$hS6^sp{wn>UYyT!0wE3~}$%r3rau zPCY%u>k16A`swP;30vyaeO5S}hO!5$d0D44)v&VpjjZ);Iq@~d8+(#*DZ*sJf(;bg zQ%C+bb)R~1){VKJef6v)m2;|w*&eHm0C|##fFxRyAmSFTTuzxQ&9U%QzI{4%@+8|( z(lu08VmTiGBAaLJ*j6Ab#7I<@%U_nPg7#;u>!S>oQ1<7LLl17#)YG$@h({!*Cc76u zlISeE(PO?K;B9cfcs&fsee`CQF>AvPu0)v?5)%`MUfNECp%AUs!_TA^BnY(jPAUQh zB==?X4QYJ^-$xz#Hx`AY*{`&_bUw|VNnRE156&H$NP>9T6kz)=%w*J)&)o%qBghqv z{P_RKo8rCe@ZGLOfp``78R$T=NKN5Xj}Po%V8NLfCCa1&$QGOK!>_&HdSL7ld9oC{ z-Pw!7(#>bK|1i|zO7=zonvm;=^M%?skm4r|7X|t@HC9J~=|JJM% zm*t$ryGf_5{1UglE|R@7j6Y5zLeNcyDd|R879nse;G%x6Tt`PPc}pgmkb;PH=jzQB zZHYFn$YzIO{{>uvo2k-eF^K;4^5pvJEG8pl`x`Ucl60B4Kxjc4Jp5?t7BR*E#Y+vE zG(mKj=qAfBaPi_=qPZbRE&}_IbplX?FYkK%y;^&Ta+EJCoE9fh25)&W{PDUIRt(@) zX{+GQE=v>Wn*esmeGN6|x|Z(NEVAv>CfGO4%>*F;45$x?5SOFDLnIMUW|*PXS)u7FJP9 zaR%XLki^;Qw|R4C({K^kwL=uJ5aS*RM?Bl(6)}vkiD;Chu=8IN3)$mE+T>FLhl@02 zxi^lxPHl`}cM}#xffWm`gkl)Y0BIeF_f%Ar2C_s(BbG-`IyslxLas0k;I@0(lNTq= z(3os*2D@U!;gmJW~EsL6u|6Iq4z@c=X`;sL@4Jtt>H95Z<}DE-FJ7)kgi)Sz^f%B7@N*Ncxx~Tufp8S)?>>QNciKJ5O3z4R+ z%~;VCgcjBJ!v(eFEqNzGBe0h6LsVi1TMFtcK9^I*dLndy#TQKrvU2plYu?wikxHVBKwV*S$c1)ZJbSOwk)=5}Rx)>BPsJBFhPw^8L73F`j z_IvmUT#v$M-Wm$NFH1#aJu;V?Iulkm5c6cQjf0#hT9a#K$K61CCX?tC;388dm($9e zE*S||)3u-YPazH1c;sIO+icQq0Bc^N2+wjI6(awlA(#9rDN#>Plh$b5xcbCScng=w zA0`WKB2Z-qCXcbdS#1d($SFIhRfVeW_V*W)WpPuS&Qs<#@gucE>?kABqSk`(g33ig zduV?fvv7+S^N#D<)@MX-_*QM%SA7L6zvsSxKr-3$a)cF1MBuo?(<3ikTFRy;QA~o8 zb5WVv7$_%GmXOdp5@}_D@}{b+L^|3S@=WZ(Bb1Yj{EX8N(3T^Qgk0 zHoWQ0CuGe;e{{?t)<nsNTxPJ0HGy2p4co`n2GSYK+H75$=o%~tG_W8cD6?k%+pIKeiRe&KLW&f>psV(#Kz(<0nRA!4!gA8U` zVHGu)P$~quj7L$>kP#+r@&Cn|Vz;c+{*R z%zffNQt2 zaqH3GEV6Kn5nuBVjClSvjKVqg&6{Z5`@4D8xdcfxHaS@Os6DI@1vSz%Bz9Oy{!8%{pW7s^cY zX#aoaz-+Yw|AdPcXIshDRHqDSJp?b+p7ObO@7@yqL}%a1(A_DrD09f*!R72wmYpxA z-I|eH@+g>x0pcv-p6?%FNvXzEx~P%F(lP6Bq-NM{Mk~-eaHshXh{lPVWe8uH1AZc? zDW<*dmCWgU*Ft$LRRKN-;+OEUP|R?F_B?Van&M|}ErDE>%jOzgZVocVn7n_zi*6{Tr~6fcp9;sDX}x_S z#-RYnp)-BhfAc*+iTCHh^iztSS;In0Fp&|MR1yAK(1<7F{boES_?6)tm;HUq#|@tYMKUQ%~~ z{`&RfwAJ@5(q}A`P6ATz2}QLyyzmbg#5I095-~SCj;rfX{vNd>!XL~?52iN|yPZCL z4mMhN?AS4`8yWZjdV6%8-Of^?UE*x*+ZUaIQR^IdMD5v z7!5L3nP-zxUM@g{(kV_B8~t9(=11DZ6E~XraPv3+xOy^bLzM&N1@7*$4K?7LQZ0wc zk*LSW2d|MTwCq;)pS@qde!ZH}alJv1EE|<(D}?1{{4QdntC@!?GhoKBSF73VBM=;m zGU+p^??!gm^nJPvT|E2E^vpxdeE4+|y=aLA!#k}#GG0mn*2IhGo(#u&D(3j00`MeB z>BPL{$<*=839~w@05f@m(q@yq67C7HYwKq?j$a88LW_m6ZyPFnAVIoiwQcvd%sRiS zr42Waya(I};>i(_NG2s5a=AHEzZ-T?J2rULB0OM4G8_3i8R$KU`I6T9_R}K!DV8km zH-xJc)+_FMQZjHlXYwH}oy#+yN$AM_F2n{3y-!$-iXG5dbq{ z?);DNj$K$a%2Go*Unbg~)rXLz6V|7{QfiKBNT7Foc@Af6v_?%K&f#WoY=WDoq3bb>N9suz- zTqd_!DIrd(5ud-^xcjHC--vSbE)5HAd(bnlT)7w|SoYDub1>$lqNWy3w?k2+$0%^b zir`g;Jm_7h!1EZ;)!`yxl14pGl9x^E^VU3UQLu4y7MW4lBSh)U*`DD$5YUCkShmTr zrh1KhG%23Z-VYhF4i%;Bctli{8Cn*6^X3uubco1UI&KgjuYO@}n7$B+|1I%Blg+Q( zE2`9kLy?tCOvI+%YRPcJ!7eHEbfCf^)QV7sT()6OpVb}BfArGVpP_dc)b@L6_JS|% z_U_uXh$Yh$9VCm&)2=DQRd9v2vzazQRQ%0{X9*%d)%%`4B85WxrA)h{=_||G8wMLIl+CV zIrv!OZl(eln-{Q^&W@6D+qh6;1Q-=tB&7j3VNmii--?(hFf+9@$gJx5Sr^3%JD2&~ zTu5JVyyx%UH8uinmDW)ju)x4TL1WP4Cg%&%A)Dl6wuWi3b##xE2wj4zgaRL4a&w!+ ze*itJbFD62ytt~n+f3jIIbk%sY}1<**(Ta+#|~L4fCt?i;0?HIVTBO@Fz0CCw3dET zcpe(HR>RhIq2fY552D2CY;l;EG3fpa%*aeMxOnq1OZVpDC3U(`1ZnV}@}me|;Bds$ z=Wa#uhx~`N@Jmbp&q^U)b*JY;$S9d#CjIBTTYldz<8>@0s{L`}uGqWK?2=1|w)@+0 zLqYr3>6L%~&Q@BetWrm*%R*Ie?+~3`b9+BCI2S#0MSIJ+Mej3Mi7ga-=3>3p{4d*yfdd`#L<51{Q)`@FD-TB@j6!)OgFlZK z>rDtVXKC-pJFUl~iOA6lu7xkUcH4yT({t8&s@+XJ7Y_jg;bYt2?I4}Sym|9-a&ifBz=Fp>Qh0%ONvD!ii{9E@--CY-@jAa z^)D|g>%+jCKZlRxpVp*8y$*FcbH&v~+4oNy$gHXfBF6qIgaM zh`4$4=CjJb-I!hxuNwX_70OwH<#$R@O$~ntD>|T;;7&)@3>!L>rJyZH18KCTXHT8V ziMmsTmrgn{?@Sh#>KGaIx0llkmjW9FGbM>=PCBA93cs#Zr^JR6M&u;M{%m~r&S zX)NJlUCVUhXtb2Ku$_1r{QC?`OFVc_Tv~9~tRVGdI9cpf>rggY{H(6t7a7_A=dWK3 z+;W<9l#F1m&QKaX=lpfJwE*%)pZ#D;Mm!$nEn>uT?(A9DU7>ahf0pKyl$h!Gd%JZj z-8^{H#*LhgO^fy0oOBs7$I{yU(!7|_;z#CbWW=+3quN!oVVzS1$~2f;65*FSRmu5l zd4XY6o8~K5_KD+`ro4xym|I|q5_~MhSunOTFL@QqXeIU0sJbP97Go+G|Fo3?P{fG(E5*zazcfcc$n37=KF2$T+Nc&g)OI88Bi^Ca>!|Zc)z( z+>ddrf({48{`7YvPs^$D%S>~em!3RgJL_Tr(=Vq(+_KCjA!y$#b~w>Xj0Fkk=D^)))z zSf@hG&a-*BKm_TC27f{0P7F;OQGVoPeVztt@w4ovq3gxSX^#vae|a65ZMcE7T^Fa@ z@*h9Wz*o0H@*GFl*9VyT1-N5RQqpG!(H9d)Xr6o}{<87K~_fhKtfkg2~r|*xU5^ae8o;^+W zbR2b}--0_e6IK;ENoN`Yw|-c|OtBC1c+TyBooXXbPTe^2B)h^U3ZV_f35>R_^AAVFuMn>~ittL=z z`Z?#o-e~c}9yxxew;T1eQ`F@VqAjJ?8ZV)sxHu^*D+m*;FJ0$ltD%G9cQ&W{g38z( zlIxH#9@B!J$i>CZ4zaE0=zA=A8cU2@ygOE5&*ls#O7rgRe>6J~6f_0TgGIYj5N6E4 z3udDOaw94MQLTzoA$rrLeGg6OLTpOD5FTB>yF#MMTkxMO`YcbSjBTJk@*RY6HOyBdD+UYS4AE@$>gtT6X0vx|!Z++?eKSo(&HZfgv+B~9% zu5Q#`|I0rrJX4#@t5K#xLu!1cpw-=z8;F0t}oEELcU#PN!Bsy|Dsn@AsmtY1(VYUtnIAW<>TYl zrE|(%ytcXl$Ptu58`se*PN3d8}JSw`I{*=OQB9-dh-(xHzc<^j~m>E!P?f zF1d~(9S^}t6DPX$+Bxy??6w(-`)g&vjT|^w!!GJ7kMVGv-uw|A$LQd*v*iuYuN3mC z!g-?EuUEWDObp*^yqNpVDJU`6n*0aV;5B-PGlrP5YBt)@93=yGUaoCkeltl48XnNv z0^G6Zp(h(IVOSBuGPG%w=Sgqh9-ZE=DG(tBT9NLl>tt!j;#I4js&wFKY*;vW;NjU` zRCmOemUXm)r#EzJTQvWioCk*XAEI!-)w*X0!R$d}mJWmoiRyJwt4%0Eor z>mxfGch+&u8mS(Z?qRp5j;B$4$^zyv=Eu1oqHQnA>Q3xHzj8J&_YIri*a6Y1&?z?D zuwI`&{kw`KVjY`jgNTu~I(A4wIZcvN=EtnfcXK(kBR>qQ{AomdQo*>95r?`erjhas z0V+;oqCqgG0r<@Lx<0)pODZ+4sv#;^>*4~)G-UsTF6nHbI*J@?P^_hbv&+iKxo@`BH=iaGn1llCA%j?OI=z=}BS}ee* zIdR~?Mp3s7$TW{KZ_gSmt6e+JU4QA)r896r&xMs6YA2yRG_1gGY~Y>_)@JpKW2jd%cj2-rvQ-HUpet^?XTW2LN2rj+DjwPXC*H0 ze0X{O6;V7;y^W*8ZQi!+WT`hWrF)KKLTWSW@L>i9?`>;tT)7egMn%)F$=lljjyjHj z<@Z&;N?%qIfkaq<5(kaEYrl4Qa&m*Y%0XdGafOu08ysc)j~;D=@c=_*@F*6oh| z{)@*)ZffJ;;6UC$!y)7vJxN^`mn!#sLu~*4x#iMdI^T4yBZF3GiNCJazC~``V00Iz zo-jm;(UoZo8VDO(+ifUD8dG}SS?&4s7L=x`*;iu!B1G=ef-8*pjQ08=7cMkb3_ztM zOM=yXAATz@cei(V2?`>M-!PllX&vc>@gORBuv||%;6EK-U$c9C_ zWsjLCY^->DzPsUSgMJL4;xfEB)`UXXUXG65arNpzj*P`XOf#@IQQ`6>z;&r>Xn0b0 z8teGi1Pl=@gnz43bVvQlNuuFl5U?!eZ9cO)Del48uhz(?~YfhxIzNN zkE43Y{ruTGIiUZTegS#lfYfK16(xGA$&<&T!(mL^2Zzjij~?xOv(8&()~s2m(%ax> zY_nv^4uIl$w_PiPVQC>2#CBEi6sni|OZD3F9W)#=u)KKrjy z$8P3*$R0T4U|T^KK^;s3_3DAO^V{M(M;|(N%vatOp#zP87mtqAhtnUQgX((+*&0cy zQv2cSw}*!28CJ}mKYtGs5(1af2*4zW8cevaD}$QOInfA+A8F46p0@U(NwlJ({Q##^ z!V}x?-7Fw!8rL2CupF2TM;Dg{OzTdZ*buv0PY87d1w0>MUEJH-Yx5i7NwJIm_GWCX zUcI-ZmrdEfTBg?3xepH~jAkB}3W|c2DGzB-N`{*;;s{DCYIHeDv^3O_Ad*{1cdvT> zf*@M;b~`xm=q{R^02}O;+1Y0s_u4eb%!{dPSzQH~c9Xb|qU(pHtw#qAlrgrZr%oxr zN+(R7oPc3tqa3qU-47%w2bncc*uT4}%UYkh^t#*bDaMZ<&lZ+b95-5FS}SI6JJ9a( zZ;Ao(M4fkUdNZz*cGtth`{5$_w}}paA)XKuk@oun&U}KMg4EQFvTV#QjZR~B+Atr( zF6vj4r)O@@ua_5dbb+PyP*4&n$v%GlYRb|JQ^P%sAdg7@ja{b&zmZL-yM#pCekSj) zSNQ8Q&(BrXcX4(O!?x|{2sgd_j~~-Bcd;OE8Km0o*N3TO=$;Wd2EzgvR_%Lk#pewg zwr(e@NAc2~mClQ7aON+g;4`eOCgE!rhPHX>doEWKm~a|w=c(3D8vqCx)8Q@tG!(du zNc!WNS0beZ>W-1M)wYi+Qs2A@e6UD&6HFJ2&O5rV=F+n6;sx%_CQ`t0CUoETjXq&e z{kPLgeo5Cr(^;!m$MYKX{z(5$N#3N5{wb1F!QtUIM$WstIVj1i`19up^ZErqDONs@ zHU}vL!iCUzfrk1qi;n{DTB+&F;#nV)k2yI;fFS8SdA8f1JbU@_W$WB(iU!jOca5}p zV?Cs@I1~^t>S^xP%eQBc$2xv2ESyNc*yYe9md@Ln8r-5$PD2+a^`qiBF2q0lR_Lgz zCjSN7Fc!r!d0o@@p|g2%J!R!-6gf>`?A_N|P?oiCFTNV_*J&+E)Uxg@_-ZGeI@q%HS zvqU-5=Ie`NZo#{LC%qh)*U#g$`$)cG2y*8DpTi2Ha6A?-y{}fY1xr<~SzwjRCoK?51J`NHg&WgF!)mMkjAk zLwZGT-<67s56EiXI!6thd(nDGiF}~xogev}3XWsS`yq_)NpD1l;w#W0MD%IS*>pZg zVC+$s@GJ(=LP)98pxXPgtcg*+LLv%{SB`~KheA9(5PQChZk#BbmPt(B{`y_Wx z7`NrJ;$~jf2KWJ4^F-QobaviB-lBn$tb|7FUEUgyUsR?jcD?A!Z9$|{>=s3}Vi>5* z0PX7Kt5>)2XxUoN(m3~19D&Q%uU~TMNKWT8@1T4!((xZqs@8UJV{V7Bz5V9{Qy*9` z?vle%lq^l{o>N%pgWF;|($kN+aYJCx_yX*Y-;QI|qs;l*>N!}IbcAJX%r+md&5>3Y zA6;Aa@*CaD7#1~MxuVI$$>(=56`h|BQJuUAy5{EQKL(ik`Jic{qJVO1&gYU9lWD*} z8)~zCRM{w%zcDnRD4Q&z_h>x}NyFG9!~7{rfji z(5EVq;1U@<+C%F})e!&oZ5t9bk@g|amXiu#JOBaPM#7{0^HcX;wlhfXeIGb(fJf~{ zF(B6TQRbKP4#Ct+s5btVZ6-sJZQG69*h&a&#z*QXsPj2UT#3)`P1zvh4vsW;j|uXPVe9xHIqH+XNs ztgBoh!s70l1`1k95w09Re!L_mk^6w!h-vg4rrpM{%|Y%Cg{7L3XU>AwnaR8yVeBe*GX2zykQE`;zlPu=&6IXVhN&2j`Mi z>@4M7A%S~jV!$$!cnY==9ZDmLjsqEQ{!=+y7HtlNVFTn?xO%l8t%EF;_?#Z`a^N1* zg>G(9R+QWK3$hv>F7U-#2|UDy#>Kc_K*Fn6E$VNp!@3AAKmy;s==6N(W3m?>I7(p6 ze!wIP`QP?U=ps>ub4D}55Y)%D!$8Jmznf^MT0sMfktn6Dq4|*;lfv$kr-agAg$Lo1 z_ie)=YBg|aW7Y-K?ul^I;e?Tny@gMuf_j{kWXzpmv4(T@2Jo!3+ivUFE)`1M1Pr)j z@NubhBWB!BN@@rdxqkins#OUY8CnoHNdCuB(lL~XB~sjOmJ9oBH49H5bmNJVc%cr3 z5KHC79v3%V@oef*4MF#iUaqZp-Beggq~1FjX$WRC z#s2NJ!co*Q5AF5E)KA8t2;0i^QlV+yoS=oQB%qSZo4jTMad9-Tk+%N?M~vBVQDbK5 z{>s4#tdrqvsplsV zzKLrc|E~vRNyGl&fcF1f?t})Od304^gn2g|<;nTkw5d)&6};{17hXMo05WC zCWQ^0RG`w}s1xxl785UOtzg#t5i>({}MBh^5T_~>AD zPHa>nn+1G{ka?iiUN=+@tvdF9T7Vlv4*a;mvpzCxT{mW2e%)_vjCUN~0~GNHW|d%N zXjem^PU$gel>82bOxE$&CW2A^nEtwqP7j(BRtXKSR8Qh03rR&7qf=6$GKR7v?<@k^ zQ1>yRiK@@&g`?v))qpz(^B;Z!As0pT=3j-~SqY?cv*N-dMnq7Vs2x1-IsD0M+G2T# zGIEE^li}tj6f%$2oF{;_qMYI23mnTY$hfuIWP5u0474llc!gWJZeS<6;ALzyH!S<- z?-bV&9Z<9Iowm|;GSA6MTWx*)@18pwLRXE;o=$gz>JIyl9AXfcgS-@*n1-BGm^5Oh z1Yq93L-w6L;IW^oHXh1#97-eOMg0NZDlH~|F%iERcgSEdKpuweuCba{aP6IdxtqTk6o_&`R!Nps}z z?k2lx8^&4V2csOCrm|tf@9u|HSFK$6{Pe_TFazq`Q8SR5O}FVez1yf+I}==7S?U zd>-q(0_$BB?zil9#h0ZaP8{Q(y_$_W4&urNs)>UFV#=quM-I`Y0&dWznYA)RWKMqm z4rHDy^qK3xX3_2SZW>DFx#DU9VK zYP=~gCjIXbBtz4-cz*+Zw58=j)TIyEXW1EA`>FrNNWkx zs7}GOsbtXB4)ubkc@wr|u85B;;sB}~?SSM?nm!#qYit+-sX%Ho=Cd;+2s~|vZmTmh zeI(YF{jE(XSEvv=sjE1af1D^70r&&8R!VT}tky`dwKaX7L%#x;Gv?TqszT~DavPj3 zPqT8`!u>n)?}`RY7QPWkoeE#n1NZAdVdBUHi%dR__0?k3pg$mZ8F~l=rvr!Wo?~fQ zLa{2?6NgJ@*s#_J`DGuI%Eei8`^WHP(38?(;7?-IF92f~oE4Rb0R-I6#NBOZ2?mby zqpl8itN5g%qOt`>#-j7biA*`h(+J9jhM@)q5;#Z~A^;Lq4_d{z%aht50VU0h>2>G> zzi-Q=u+b>YnO_4b$tf=WW4WsjqZ1J`b^$Mh@Wb)t+7cIM2#nW|>qN`KGpr=)C;jvhqB?=UebrToj$ANTAtDT$anAFiHL(Dg!p317e-EN%n>L`A8}F5WIOngz;ytj z+B$p{TQnH`ojxXJ39LgZ;fHL+PLFAr+=2ox%s9L*MVLo4M>J2s5P0B{b=)qv+ThEV z)o}o-8tPy$bm$hmHp}yqsocgRIis$(#+kU~`YD?_psayUH}0Z&kByZ45LxMS!y$`d z!CfRohAbNc$RPN_miGbm-Wtet!S|R~KqDu)BWbY`a0?s_bg{SixR+$LB{h&5<+q_p zfu)eh$TI-Q)b84~9x@C#n9%@oycjM%ch_dcir@d(u5)%C3%N*tv70M}qJX!-ebu|t zr|4U9`G9|#TSgA0*n0@oiED7q$BzP-kO#y<8j@@4v>xK44{jqyRVkV9*5|4~%!O?B2u^Yz9 zZ7Z42IP$eEl5D{&;fMd0Srd4n!*a+3mUuN+Yz99b04zmgT$jrmS8#c(iNHSc*O9g) zWM#D%`8h@E6Nkoqrf#Qo0tEZUI-b$m>I~1G5(Uxh$Z<4|ln$(+lamBcB`FGUTcR%3 zCOVDh&7YrJQnHsKI7gZkX*}y_JK<07ii#QJ1Bgj~Xy^eU7Fkgt?1tT^0G z>(JT2pbb=_lsGSO`HBan*efj~gLo||AKAttie#|B9aAjsm7jdHa3HCm6Uz1u#xM?i8JYm#gQ zqN9_r_W0v0n^5>7WwzrFjaWevBI4{2od`HInlt7B?<2-#Y4x8Ocg8Th%4a~!F-k(| zal;K-G~PaMFP=L$nsk;1V?y!wfyPI6=Q_N<-4I!tb)35_KSx57WKpP=>~Vl1K=w{l zgBKBc<8j@g<)q@{kiQ=iwi3*eF~}|GN0@Kx)W5%)nVFgNd1hjSW`u4}luq)YiHWWk zoOgITBC3&@Lt+ID(zl9=1i*$gn9Fe88oQm`1!(5W)a-oxDONX3{nfonzqnhd8jou6N_^f7aT>< zfb1kj39c=(n9xO&-U4%9O``g@swyv*N3VMtI${jDjDJ-#8zB~4{62+3`anP*O@XJb zYFvKTGDA@=%d|yd$=Gxq!V^s&mtHDs*alxtbHcM{g2mFzHUQON#46|0r}}N%wzZry zheIZazT!EACzMnJzzKnR5x1QD$9Gcr%Upa^q}&KhH-L_KM8W->J~rUViv`DKyC8cr zZB@%|tpRX6?rpun7-aF=aRcW@@UotCrj!+u)_{DnhMYV7!)6fG(7QXE+QJXeXg)+v zwlTZrDC9Xgte$jeXyVwk(uhi(1!t}RoM|kNBooz(%4qB+OSbZKy zW*tQhSFP2c<>~7>)KN{oiuINDz=6$#_oT#ZrDmODcCRoI<6(y$~*&BdL zb?dx-i83$>6{StEC5KO)QFQ9uxkkj91W;Y}tvtW7WHNHu_B<_*p09Tc_s4$|q=#@V z(m&$(>+=rGZahG}e0kIF_3aGZn-gPsPC)7pDEEufEo5|<@waclW1im6A?;WGbJ=tH znX4lV_+xGM)aL{um0>8rgbI*TEiE>^Z$`|>9z9f0E=l1DEDKRr7he8M{qB^o9N??h z18_Zx$xcY9%OB#g7{Ll*+PaI%_dW#-L9OyxD_gxl&^|xOG~g{j0z2q+n68y|7ci+? zE_x=LHyB(mqxU4-VbDVO;yt9YV>Ast(M7s*$93xxm~GHt*$PzN=zalXAg+EovK5O) zLM}z?flF;<&kVvMSpWzO7ys~KzK=zU*mHAO1)HNRWL4yLWXB(f?Bl55Pxf#saU(K! z@}FP>?m{fRPwFPX+P}Hdl^$wFt zyB>k)086Wq6h&?gVjYkl5Y{-U1ma*G~XwU7lVk6?f*sAfLQU0z<^ znv!?JsHH}Szr?bFuC}>&jj@w<&6o6^|72$7!IOja;2Gf-(ZUF2Ob92HPc#nFlGzeT zj0%^=oq=U`0;n;MD2rGrw28W%1`TRKKSEVGo}%_dg^H!+iM~S|-ic~I%B9r$({AnN zjas+P+iZObG>e`N83>i=Xo!5ImOfHuOJ9YfjXV+>1L=|g6**w3QwpbV_!RjxuvV}4 z0y?0;d9^U+Qu}Tn-3hhQ&-8X_v@D=gJERi;=m1%32ETzAt_fl9^r%Z0E^J3Xs^OWO zPl2Z0y*t)$jYMy;V(aDfT(B@1k>YpO@7S>;kr{CU19Vc!Q0&>Am_pKoHd@4AkWQEP zLO346`Q>W|hlD7BdNT#ahNU*g=>uOU7FKvz;wf*|vaLIDOL23r6}Z%0Kru>LNVvv+%SdS1Wr;Bk09 z$T^1V{pLCXXwB8lO&Cu$QGI?L*-=m({|N|_czTkKnA6B5lS;BZFnDsmfKd8ofNQIZ zKZ08?AaMa2BEjkn&?Je4{{`ZVC87<8+S8^zx0tv(sXTkj9)(-I7`k+kA5szB<03NY zW1`GVEioF#yzNkr+7X}~trl+gMw^UvzpCQ%o2%Us5O3!g11=Uu^y@_^BQz$Ep+&#E zYgZ#_W7$0D8eFs~y#YimOFBFMf9842xN(mT;53ANH^&o4{#VD8j zeU4h_3Ij_N>+<6J`Ij-k9d@k4!1Z76F>g_@F?DBHzXDd1-G+JQI)MFC66 z?l;%z+pix8;&=ci0@xVT7gM?^qkS~8E^6E1_S zB3Rx(Z{7&l2hQ-2R^{YT&3NF3i?c$>QF741EM!(^<1>2v=8ZJ8w02VK3w}iV!vJG_ zX+xTaU_>tK)a6PB%sOkk&`mvh*a6URm53RQa`v{AnMLVdrHtisNy$&JyYstbxcH(A z_icNij72_ZRDR8alK(I9m`Q z!Cks^$>9NDVScl8^%N6&Qgjn-37~&wbhfaxwnpqP!#FZa=0AD)z}eX3v_Q4AjSgN4 z84SrN})Lw;~7z}hpC zL1X5AMRuc*;cjMV?!SC__5CVIFpLCRLU@MWkh~!Qopc@#zzttj^g7b+Z8x17R5erk zj_sKIclt30bM_6UJ&UgI$Gq!+)QNqm#Sr6yrF%~3A}gXTjN-@u;D%y7EAxYp^$j+! zCXMBO{mPCxZIX))r85Pw+o@cp=RTn5PM}a#ywm+cjL(q;rLwL1c-kE6RhD%h_omWN zA_5#b^vdv&vd&hki#sn~lvcdeWOne?;T}SX$ev55FX^~{HceS%dD5d(Q!k6s<~`8K zJ-}gS8<;3?I2&miQu%tGKVKB8R$Xri>a8P)0tl}fnwnd|DMEq7{od`RJf!WdDvGQ#oYV};$qn2rc=r1H5;p}1j}1KZEg zpc8JH?qEi|j)Fkog%0BsIg@>Ie`f!3F8eSRVPH%AN9rr&3qUT9<5?|muM=`d2JB95 z{?!wlq>)05Tk>|)t`-nG+v9J0q-Y+xO*ZYcR*!B&*6>SI`~yRIo_~#%72m>ijgB#2r#@6 zM1A$iY^tV4pv2Q^GzcfbTMf`lx)_@QHn@VRT{t$u1gZ%h6nz=<4~>!%={;F~FCj^ntcfq7^C-#k-^{gp9xyOY~X;bg;vHwGH}sA)fBOc>OzhjG|3T2Kwj==vm}TkY+qn z3y6E2hYkA~7NPNbfz-+p%7w>)G~rX$C*6a2#FSRjni@mJGWpP!VG`Zwc<@PiTjVBS z<`Lh13#bZIWrH*v8UXg#`O5?8u1K&L9gl$6U~`xdpZs3zpKBso>&~$@lPmBb>+sr+ z9Z$NqsIQ|#Zl;>CWtLBpDorY*a=YAHYU$_@YVV=XDEq;dVz0=^(oK>5d-b|cHC0B* zxCl6*|IDb0Um;lGfqeI|ysR+Uj;uqb0#zC{a=-9{5VQu!0DF)2h#4F39EdURH&xAN zv7lyOt7}_s-P#bOv;@qISv5eIZ6{A=TXg7@>>-TKLN+$u-1xKHFm>fcjdav*oQG^?;6UbD6(!9L&sRQkKST{6{vEteJh3kG_YI!-c&L(^CE#)U z;OK6mKtJ$hOqeiEG>fPoX78Ege2 zgq46oR4Cf$+i!un27ZP+KKkYurE;s(Z{z#kc~b5HR+z&oE+eu6Vn9dEbpz|UMb&~# zLv2uJbN{KkSRnwY6mQw^G)q|75mgZ3xx>oi7W;sNJAefCw-5I{_% zY`(s#3~bc9`eru}29!>GYHDe4^of#BM4^AX*p@8?V1~Scby`H>A(bU+$+S!Jhkv?? zM@Ca3!@Ys6x+eb-fdraK7+;7NPcT~%CCEM4GQ6jn+lUS@U4a_}+jc5`+k&3f1T>Z7 zywJ{02!>8WhO`8Ad4$vefS;Cyb`KAuI$M%P57=DeDj)6My*hv}bgb-f7yR8DhTn4T z+)xs*!1xlLd`#{eu-G@BDYu5RPP%*g5w<4Sz^I2TXYHzV))?c2k zA}R;^);bF284`&F3u2Eh?bB!K0jnLhWG-l`ZJ>B!#ptvALcYV2ITtlTXKlYY=r9~? z0-|#cFWUu}=1gCfn4R4b;D*FC*41?=+yG-w&s=u^+K<>a{qGGC4-`5nN?LW=GJIS^ z)QC)ljR}9*32Th$mZ z7Yl}f&R`fUKXP=KNHvCaTEW{O*YP;(&+tMM_a zhrKROL~IwnH{q94BN1h7Rg-x_0 z3D9UoWvMqm$GK6O=JcQ);p^+f439fRP2^~&an-U90W_tP*3G<&`JX<`3UAWCf22Wi z#wS(fk{-Oow?&pKL-utI#r|iZKce)Oj%vl9I&77sWxTB z1QQfYTjSz3wXb^!K{V$S*PF|X%X16|OgbxM74Jj*YYF;QQJu3bEv=Ph>oRa9Q_)Hk zb_v8os2A+Bcr8lT9J1O#MsH=DMLI4@S0jcnnTrQC+5A4sIeN^~|I-54Ep%I`tpj?~ z?X@d)2lo+DyvdC#HupSGx_)28rfi!5qL3v`0mVsP>!UR}DBB|ZrE#|dx>aNeFk|Kz)j);i ze-%ALpLsXG1yAqX=WkzXerB7?nDhu{MfC|bb@gir{spmWn!7INZ#zSFF^f|tF}Sir zpqKZw`SYKCHihwDF>iwji>gFaP7ynxGzNth!`L`Fi{=`n4?rfD(^D|yTo|7YY$*Y0 zDyOn3E->0decKJ`l<2>RFbj*WAWrp?lS(R$Tfrx%+-PHV+vKf_G zy_3{Lqv01tS}$}U{33ESx>9+^V9Ag+paVQzNT-fp`c9uUYbW?n9z_KkKjff+EelzI zok2$;hw$y2e-{ryvx4bRb98-UnbA0r`+1JFJ|Beo=Q(4P-XErzJ z20L56&ZsBr7;1i2yxG=0dGcgHPa(*~EfE;kbsfkgxj{f5fEn_34yA$6{{T@7SFDhH z^`qT`^2k%KmNS&1%ncyp-nSVb8anV%p5%`oKkVP%9%f;iTbkac(}_VYrNg83o@8k# zqDv3ak09PK{q>X!NcW>#N<5VB;T~7pvAyncRi_pDZ4k_eVqNUp=;*#Y)}7a{DtLNC z^twm6juJTL&dvPYtIWDS-9^QXq{Zj*+Sv_07U+f`+xgPP9p0iQ!s70ChCMq*Oylmq zty&&4JT`B0f!E#f+y5U;X9Ct^yLSCbD8qxO%qk^?Oqo&?Qi)0$NHQx?rVK?PLPA95 zMv+QFqCsU!GBuD?(nJH2R1)I*UH13B$FYz1+0Rb?|NFj%^IU74Yw_0cf)mx1?NxgN zkYONw!Ao6|_*Fv9@pi(myCv!Mr90OQ^v~Q;J=JhXyzX|i>VnvUne{&KF=*0#1OVv1 zI8T7*SbWap%LZf9pGD=A5cYw7y+sO332?%!0!<%dE8kv<+9y+tX7vAYtETEZk0o_1r>`IxK8od~=IPNi?fSM*zP z>7SD*me0@YTCL`>AD{Q6>R=IUwJ7CDr}CnD7wi3@?>{HX);XExp2X~7gV_e1Ae?eE zB;_QqTyRG%*7~dTuNe@Af}h&ZOcP^cGT?$XzASIphK8mJS4NeQBhBC1M_WZ}DTdyk z^hQDX^wwJ)&Z@rX%7=J_pg9{6im;jJ1AV~qfSx}Odhtydp95($0-G(^{RGk zkFx<=H~%La5}51M2s^}Bm_!|`No@vXz@f12ZjDF?1VSdxl9_+K2&u6*Z}TxoO@mLE5HoJ6cJW48kv zn1Vp~1wp_u_fKBcwv^0n3{Y^{3ImLp7w(Zm4t>PmPuLJHtnB+;pgR3GX$NSArn&%TUqkU##h=^C!KocChwr|074f-0XeC-+x`CD!Jth zqa4r_Sv@FY#+*3>?+#Jp>*qJQ{>HUAbLL?5bdr{Y)S*~x zPTYUfF645z@YnXxYwb2b=OOP1gYR>v2Pi81%89NbHCVUt*;wJ7nJ4u}H>19#5$V=7 zH1!c9nca+jxRc+8$XJH;Kx*FeZMoc-hv-QMx~ zWrG(FZ@Aq8QXqJ6Y-buA2V$R@s|I}E9(}0Od&{uc>X>O^XgjA}F>7kwAsk@(^eL=8 zy)o&|yge=84yZ$L4%A=sjdOY*TblEfNgwe5?%z+g@|By{{#jQ+8snL(A6L*QfM}}pmX>R3FARk9tgu=}_F4_6%ix`-Uu>vq$Pm1J4*08{jGP;b}Q z?axWP6C-gQJ`6MLnDb74mQh`v{4uNPMm_+>P>XCLWlRE&{IXp-^>btEjIHhNB@ZLX z+rECLp`ow$eI|=?gAJinUe>a8RS4^$prC|R>vvTN2L{16Edaa*$DcT2YJ z4-^6!-wPQAu2qeQmV`ah@&vmK2aEgtY0L%G&2q9eRt;10@XxO9S$Bp^6wUw&drQ1Q z{ugBtzR3WuH+B|Rg)jm}k1m9E`Od;|^7gur(|78(b)l)rT2Yau9wKasPedoa*ub`v zz!FMy(+D#TUbN*JVTEAL@McN&+VLW=ue3hX^)_c?aq1BZg}3LV4{%sIC)}EsC(~~L zNU3Gi=Ux%L6x^mQh!2%=PT6+q>4#KHGuft@8p^}_hc&NKS2fJ+qFsy0 zr%UG8$msVLa2F-Oio3fcQ9*k{HN>aA;;V^FK3rPT(gwyCK7&D~P@zM8`RdgS4qoQ& ziAFx2W`_I_#RlLLL;t3*w@mg6wHdBnT3?HT`{CAz4jF|;7G9jnB@!=|-*Jd@TBr_? zGdXZa$P+D-D63nYXUSmgWBhz(iou&ZiV6w=A!HFRT9lIX+&SUkcfR(VD^(~Ecr}&l zCl*DG@~Q6Bug$_h#yFvF*yb_60*`cc@d-8>K=K#zJHwlud!4<}+2j}i1ym!Wlvf(4ekAzAaXPK5X23}qksk@C+;3h-e##zn_$-QKAZQqT; zwfv(O(dHtrMk~1{++k3Q8>YhVAvuJbBAU4a@RSl87QZ>yX1CSt_TsKptsBO0l$w7U z_-=e{m77ksQy0!x-WnU{0l1b3?Vt+ED^j`Jf69*2!fFsnO!cAddNS90;892-TH?+g zYfm#ckD`$NDuC(+Dh47KX9RPWa>E3S`_u$@q_hEBwW2;bxN4})!y34F$;^!MrfBuX$Z5nMU^}Y*) zt?=Ln?mYe%(|Mc?M@Qi&tD(8xXW#W{lP+F+EN8XAWp&E>HN_7j)!mwwPd)RkgO~l| z&J(`8Q@T9Zthp$1+Ubb0OlLXe4MaFR%$rx@W8=BdYhVtcE6VC+9`>_@0Hdog# z8WXa-+w?OVWKOzDiGN6&sgC0~27c2XUCOR(u)qWp#}Uygf}KT@#}HRg{Kd1A>>4M} zY?pduDK1dr4Kf9|b z=gvbC!@uuQFz9}Vt1h9582X|LKLMvd-#J{fhXuC0!T?&hD>~g%*=Fz0;X%6V5pwfH zmJbWB*t)foZ{w|&O{bpbXKgK}Mw6GjU-@iR<7(MU$R#8&3|!Cx8(4Q8N*u675wS-i)m)@@ zk*&o^L~D(Y@{dFa1d`WgT>p7vn3S>=cBGP~x6XIMwgSn|slY*cR0ZHc+s}udeEPx4 z$|{Fr4QEDl8Y(d5d>pRN6=OhydkJGz^56aCbFXvCu&asQAhLvRy^8uK!rC(jZa>7lN&37^+kJCFA;Q7@k;g*u0aSV8t;f4z zKz-S>xo(=e_e9yPg$ALD&YZoYkD;)G*z zN{)AVup+G--MZ?yan{3w_6}Nijr8!B9j1j2YYrfz-4TsVok9af!A(s~W^+pRw%?Yy zt2&A+Uii3UOEWOW^8H5ll)Rch;TLwMUQ;4j*B+7V?{BBlSI`brUpYLl`17rTPZ?{+ z-=4PzbqJQxciEz1=nO5gVM=x9eh;svZ6$>b4?=cDA2Gtjg7f?qtZH_I*%2pgO9zJ| zSu5n?HYwK@_235?zf7sOy*#RCbdL1iOJOd!h-qtUV}@F;lzQRaSg+qd%)WbYm~ix8 zx6G<;Ja+o@P`eb3z*&guiV8Jkv!s^(L17~|;xw~qsM1B4!J-bf-iL9rM}AqIZ@c&d zc6`W#xbw{xY}q;Fa{kBTTHigwBR>1hS+aG@P?1|YE~j6)Fi)pyT$VwV5GiugwRam}uKd^9-sY{;hmN3fxmrU%wfu@A z4vdP(k$ViAb=A=2-O-wT;CxqP_GP@tS;zmfb~FL8cP@g{S2j-IcfprA0sb8*`) z3j<+}aBoQ{&god?8y<3GDC+u0BbftR10QcrvZnt83#(Q%^VBWjAiq^-KO=h7xQeh9fEHU(x7Jqmt4 z{0aIP!~8u*n?7nx>$$r8C)+^XdQ5YKosvc8tl(#Ai(JBsJK~W_>T@^vU0Nz1Po5IbO{xXmJ2a#uZXWQR7rl!kz+smXxFk<+C zm6U}Hg_2=|%dJi$hDvEMfQ%$Z!^Ir|%;C{;bGQB;R z=ZRAe9=;4UHb1CQePPWNyY2J!%zwc!PoCU&P9Q_~A$R^%p+LdIT5782LpYIt7QYBt zOlHsSmC@^d@=wt350u+owuS8C@dKtRdF(=3feea>M#Y2w6x^O(1rlgH@*;6zvV9xv;*^e@)5Jgkby9>SY z*68jv6JH}pFv}b?as850X}??=JW|nDAHmPV&2ojzhYu8%-OoAr_n&m*X;qPnOWtp< z^hEbh-8Oq&Yxvbhb_zkiPf>n6hiw@6b-B#Rsi}q&Bena^xjVsy4BmOup9JS!H_ECF z&vgRu3)j3tnY4>nB<#<5?D|JGjUn*{$^97I^#ng~yZAYt)elgUKVgE++vD?C?oz+B zhI{&_2TPlt(iiE7g1Q!!2fsj6C@$>?xR(%o7`BSXyl2Wq;yxf)K|WjY3s(afFK}8v zf-MJB$Bvq=G7;&`Hxb2&d>Mr;J49rh*n2kTx9Qz%JV`5fgR7fF?zdS1YvI`?W2MIS z?jkbrgcA@=4gSEwhI?vjmbuiHF23(B6nqkmu@L6a^}t23A+tM=ymJ>jlAqhRInF5l zW6O`D+20j;W9&tGHm0EyOs#@6808cK@yKA0=%7=sMpl~EDXUU< z&pds{+_AhcP$xW6rfY?VH>LC1@gc7_gnr8Y8acI1g9~p38c`AMdHnb$v!Pq)9D&%y zeaP`~5+rYKf&q89DM$713dQs? zPP?vlW2m>k@>AdNW8;}PIXRW_->Pk&b}Gjd6$AHU_4lrw@kWk@JJ3O&Xiz} zj~bLKL);(Ca`P+r^Z~Hg5offzsxFA;z_TH9s+eY&qW)!}T-bCZ8&JDL$V8&%5BB`N z;A;9Gk6PVNMgW*p)5|zPi1HM3f}kGB6>&S;h6xsAk`1GqRD)y5tTc+r|3(DD2F$`u z432jf<4JGH*+XUczxaXoqMG4n8y6%5v(DHy%SQDsTCkLmLQpkS#o-waqiW}Oy=tX7 z$)jl~v6xr_bs+9GPD?&AJY`_C%b-nK-#>RALM&DIqSqva+~fWy)GB3uYZVn#R8%?q z8@@%&E$g$LIR;n>0Nf&Tg}?Oy;`(H_%UDs@zkWpCm7mS3uglNlO?rOrNOh+%@_7v2`ev(EU3#<8;B3DaT{I-~Oj&ipMcP+A zSRYExCMJodDY5p_IRe=x#wd)fR$)zwrGseuSa2{iXx-&cIf}$bAisLp%fpFTy)=7K z?-K|6yN{je+Vx%*Zb)*X>T$5v5cz}u31o}gfh$HGYzF#6@ASs0_PEQeAi!ee4 z!689-H$R>({>O)MmB>%-W&LP{=E6OBXUP5FUj=b~r{(=o9J}O&Mg4lUCT#CmFbc*7;u(JAA$^NY$hA2-wgBgN4zrYs zP^9vQgUu9;26WSzi5pbXTc59^Hc7sj(?ywgfE-*%RmgdbFgd=BA|u=Q-Xh+cNRGln zXE7uhwo3vPZuao?_ZLxy6`wkHIt^;Y{vu0>PyRi+@OR;X%t~mCKqPWo{(fm}#fHTQ zDagqsY$B(GBC`nyUh-E?pGn^i=t#>9d1gtn`;=8wBf}RZH(jw#sUt@gCl$^LkSlf` z@HG!(lK8}MVPEQ%gKa^j)BgNiBa$57B)RBcZ4NfGhbpUgkeL`V zCSy3jDy`I?dqnIFLFJ&!d^qW1SlDi{^!P2e;>QOZtudx~C4I3Ar=r4yB2HjktmDzV zgum3YoK`WL*63gIVN_)BeHJ0A01ky4e+Hg>__w^}mk4YW!BjY$s58HKJZlE;g{yvY zWkJEG=7`8h5mCZ@_*kcL}AsKnMQ}w7V_vFZ5;CyxKfy4q#58 z$a4?QlxdpO|A_0ko~BK~=n`@I5Y~qDts-aubc71R1aCfIrhC}~d9LIEi-8A&_?LPG z+?VBK_pD&VgA-Q@(7ccCwo!0WGydfZyw#A@;PV~}TT<{Y-}6ajgFtlECWIx(r2{Y9 z2KK*q?Gw;S$-BjEUQ_84Ko7NiPE85v7Hd=d;t{MH@9W`|+?>8fy`pu6LpU5WR)H0p z&~hm{Y*Q8?;%9L0Vm7$i=dsRF>8nF(bP4|6E%GZ-#S@y8^f5XHCH9RIzhy>?S_pr9 zQM|F7sD~k6w-m`9C5ua3N~2pPkDfmL82OVz={N^Cp=Hg+JfweMnI@i zZ5M40e6#<<+E6$LrtkjYY!c8u--xN-$Z>4^{M0YWB>NY%Spt+6TnlP?u5j1%wk1O+TUiueGyB{;b(;i*lv15!)QsGLeA#2*?k+BMeHIQ` z$27lF*Q>@_(qY2An2GTv2;GFJZWrwErg9&}eV@~=A;A%Eg9#U59|9XFSlZJg0hD^( z%33kTq_>WrB*lE3yy(%Y2U%mc@F#LSWol|qvCmG)y}zO`+T{H8+>qksnLeyYeG?qmLXn8}din71Ui zr4VmHXc1g)Xu^9>4tO+5yyT2;Emxxl6w5((+r@tQ*1IHDPxZw}6f7c*hX$KN&9qZN zcU8a{5kV?~A~6y+csm(Wr~;u{JLItN&AGl^_U(GpHcNUxB#TIw6Pee1W+p@{x%54a zhv*~i5vL)OEh5^0tRzZ7UfU{E@)1}n?D(;M?w!G>o|0hKHLGRgErbz37D7{l`jsgq zIh1W!ZVECM{gvP)z-yl}Et*)quOCWXn~=#$GG@JJUbz0Ww;xz=t=sqFNpPT$V5vH3 zuy4#F+%DeUbO%Oz-jEQw(Hieu`2lsIdz%+!zU$rQld-IvP_mUkO!T*0uFq+wG3DLF z&G{*J4HWI|o~gmZ=MtNhQm;Q)dv5(2G6PY^i}?%tErlz8lh|1)FiDb6M7kw22M99A zAYS>{w%0y6vF3!et5eXc{ayPhTzga`w;OsynD!v>7!s`^9XM+p4U?EYbLzT`Yg5q4 zqqcuvt09q_Ehd(*XcnR_-V8=L#Uwjt;mFe5HRty0AUZLd`UKSw&<@Sa+2XUM3fz{ z0Id+Rci+xU79n92RCd3nW$;rSB(<)l;MbW8hKm8G1h%8FN!uG$c6_H)^@Pb5BJ7up@_+OLq_;X#) zJr~hs^zq_uBfC-9SwEF0kQOI)YMR&Kr>b@~oK7X`gAiu37|}ytTK`H2$VU&YKbw&E0^U`V<8K zNCp#;%PFaq&;6b_h@pd3%%_W2BfcHB^<^8Ai1i-EpvFY=DXlAZc5AqzKWkT$9Q4(L z@+I_3Y}P*mk32Miqkw`wm|k4BW%Spaegf@iQ-;U-%=im6{6diOz~UIC z)5`_{Y6USg$4V7{>?Mv(saS)n4A*-#_$@Zh^6##yt9xFg%mM;gbh+C>MN&mu z8wywM++&ly1EIOQ5m5}2QR~RgU6uMQB zAjrPJq~r|!m#M;G<-PgNhX1H1%>QQX>}C|+j~XY5?Cw@{Ka$DK7wTn&)&dQcf_B)F zGb$T4a#zD0ec+zxxP)rKeq)wen{Ms!L=EF|!9UU1N>F4RT zw*gJQ1&07|trKMf&^RaRtM)mY~m{t|M8oC8dz@UleA1%xh%Z2_z@$psF+|P_=hw zEeX5ozqGRUS_OSZOrgJFn6ILqh>fF9Y^I+^PA6F>--x<7X!K|*I zknSQ00YN=XlN%-V{%`lQrQfTYixARX37Yt6cKu+~J-CDD|4yyTmJ7=Qw&rFhka+z2 z6HO>DA(&sjeS4_5ZWW$AeBs3O{c5?pQRnr3Ov<@muQlR0jm2;-OCdu$0n)ex2$E=VdXHF4DU32$MfohCfRq2(+&_utXj` zBI8-#yy_j{H{ZB+bxY#{a0i*uK(z&UDLi10F2LF8F%9TSz zl^mU9MBXOQL(e+Zc5~~7_vjB4m{=3;H~*$nk8XNR-AQUH2kTl!cjNe~9fm>;`2IB# z)!ZKF_=|bpzI_?O(QSQy{4K>JWp(hee7DO@tGll?nBKm8>~o$BUKS#FTtwcnbWY*w zC}c!D*qK!JcnN|<#KEF4`reW= ztuOn%vl#O!uEW>&C~iOBTh^<3>n(_au9|ja1X+~9}YGr`+{CNz+**rsb`D8v)rd1x%8J}OPtQga9vZI zZTK=Jb(KC|x**;HP+Yz|W6Gr6q$^${T&ST%|FSkM@rxhhUKsLRX_S`2$tov2f_4R3 z7XgJC%NVKNJ6q}@+QRrk&LK#psM3`OF4)8fT`zkT9oqkxVaF5pf^>C%f6RzOMOjm` z6LJh>YaGTx)pS9%L)~<=0e!GjHP>yBhAtAt8X8D1uPMN?!b{g6W+RiX5yV+A#{=v) zVS??fU3(dV)&Su6C(fkIoYK}bkLz1awmI1#z@^!n+H0=0VwZmV;`-$&-R(9xup6;m*+z~?#4wc$aVk|#DsG)U-D8$5F3*_51 zzVL17bUFSd)4qXM-db(U|(1TvzWqdp?u8wv9Dixc_D>`*jo18 z4WB;CuWAqb06n4*KlfbW+ZIcpzGeP>O_s|4QLWtnq|-LBhH<5aTy+kLa$c= z4<=+apoL$7o#Mepnfm#;{Xn%E(0Y8~@F7#omsr63M}p#p%J^gWnzx z_7{UV@Wc10GbLlQoTVEp~dG9Kj}JX*07M1FGqg#F~s-KFw5UV^UZZ+|K{DBQy6D<#BmA_fCuLr49c zK6Na{V#1CUdyyzBOKWRGD!$t-iDT*4P%}}G-gUj*F;>%3WfbIsh=lnv{?=9gY+nU%~XRBlNT+EDHo z$^JnzMp1cFo$3xWfBft97cgb`OXkc9>^IHX*-c$lbQfSSLMBX=T0Ef^Z?an>IjKbCrK>WZo_>8$$JM+F5ose7Oh`-W74mcV} zVf(h)ZyaKQHza7FlY-qqAS#X&h(QGJ>US@ktQmohjj?oLwI|?lwzr^DxlStDRF5Kx z!sE|y^oGlwP1U;p`X(uC7sEHl&v2v(7du+gPEnfwr!0TIb9?CwT4tSE?|0RW=)4Y; z)>AT#z8n%(Tu1x~c(B=;9*zlid|L^u1;a{v>V$b`S9dOyFe+};I`P{prGjC<3h#?I zZUkVp+}wEJry@pZDBcCblKA1|LM*tuUY_=C_Uf3+a(zdJ$lh<0j?g@Mi;aDKe|A&MQ&&JhH2h?c z@jWHgsenPsA~ON+)fIpLv{4JOwMF+m%br@}#-eqpSmihUYBLPq&ggPRNWZ>)e{N6> z^G5`sOdX*AY1zdTrN6BQuU+1%6Qtg@R;b-zuu)G}Q*5gde&d81Kv#SGc)31(-0f`U zuljeQwiB6qR^#3jPJ`8;%M}-z>fpf_()YiV4aweW<8TTnG<|(oao!qHVCMPvFeJANzjZQG`}%v08XJky6nfmGYs1dODXYzx`^f@LZS}Df%g{Tp<&pE)WLR1ck9oop#^DLoKdEMNJykVpZMmet(Hk zmPACZQzUL6^yr z(8KlB$>e%vD<&KN3CNWmCwzW^b3%tjJA|keouIeJA&U#>rA4Ph3pZx-$5%)F3uFRM z&AMp$dqMabaeb|hDXM*X7i<;pp+xNXY^tuHuO!qA<%Nz!S%p~!!8zig72?sXwO9EqI|;r zWCgndmuX`#>P~(-&K?qmiWJ9~hL<6KPOuw0Y~JCrI;N~!`@PL`E~~DbCdmqdJrTuF zNzW#5n`Ls9ZV>;pwnFiA6$mF(-Ac{F9G+XqVNgjEa!*yk)dn6NI&sr~{;OBx8XeXVU zpr^r?dd7W#0z{)s%XPb$Kq#S>#7Xd=??-z3>nf_J59+6vjyw{xTxtaf_S>C*+a%s@ zuTN#xYPwaT?%&^y|MWB5-;=2x|8tg*v5PBCPEHP$?wjq1Y?h%~?y@ay`Y#-dI)v$5 zHNYzl5z1KTX5z);+6$?{iOA}gRi(X%-A6QXzbB~WILwI%k-CHhlX3Zd_<5@I6 zY|e>gnTbt#rmcw72v<1SdmAPZK|kjUePB&9g%5~D7_~6xFEBxh`XW8pL&| z9jb*;lgXFhTR9OfUv*DAn}cx(@R9cVVdc9m#V#0?p9DKYiPB2>BKS5yum2!GD46{I zCa{#6d@mXow{6^-iCh@Htl|!sbpfA=GyQVbTZ^k#=ydHK1Sw>0y5`(2~fBxJT>g zq(KEA?k89+Uc9qtgIZj{Q#jt7PtAgq@Eo(1RtlYh5%$_S{+n;9sOg*SS>pJWJ>!m5 z7iai5j^w&OCyyPw$B+u`<4W`@qO1~vXPzaKVGlQMa$5A5tGmTl)7)Y-5zV}R%9h{X zZ>P7n+p`uzN)E9J0HbQn@*dr#oOwB^MXx9+mJiZp@i&m4_#YNj>0Z z!Q?o(oE_)>ZH2-}hqsP4QxVoficXpIx;AIS2D^m|`@O2fpIFRszzr~jIfKYZa>j*< z!qoJsMo9gZ6u`1=Id#J0p9-8yc69G#I0G>_h9(BVB)b&f0=ks)KwAgo#$5&QhXwX{ zC)w_ZJGi6U<^8q~9ciT`X5bxC&*E*FvgqYzCzmmLa0v)h_~PxEzl`17 z+(PCrkv%u@-VG_c*tos#Ga2#}LmLn4!x2ddgLS9WBRi%n&XH4+f|InI*+EvBX{o+c z8P%RsW$#t=D$4EymoB>DoxdvwVf7k}C@MFbE^#iCckn4}hyRbZPA!wnymf0mhsP|L z?>(_D+W(-(wS(SQX`ns?Z~ub#e)!Wy%DFIPwSL{lkWe1yXCLYr?Aqoc7m@tivmh0=7i2o0!M>~ z$W%no0`jn>IbU)I)IH(*-L-E|_EKN%;vqiM?jdv+G862wDgfn_ILeUsmfnkEJ7?@NTmwI|5TUdscfrt0d&XIE`{gvR z2<`DbjW=kp*gR+i;|B0*oK{RA?z55-S{6!G&b=)~aR^PQwD<`QPqcL>hmV+kn(fMF z>3n{{`m_ls1HP}8pFULSN+eK#S#mum`r5)9K6J8Qs3XjFP9+pguvB7<3(iGxku=Lu zAn{UZ*=VR4juIN!KNsbK801TxF>%8lB>gK((>$5W7d|yt6DvB2k#DMoJsu_*6>kHkRKm*h`c zV!ct(d;BiCuV-<2e3yrtq)WFrEtdR-3i&v<9Oiw`D9{VE&MdODR4MX(9;`R{ak#j_dzkF`#1ZYyOEJ~JXtnt&_B6_lTbQ`W`(D+S|`{GnmmUTmvJrp$}Q--=tI0p$PW&8H+*Jlpv)hV~MoH-?`AM8d830pwikMZvqU{2Jx z6LC6XT%a23)jN>lZv1)KV7to15-%T1i42Zj=YVlkG(tWDFWJu4w!rSlh6}kvA1zz{ zIfGdr(XJtFK{rWMLFLDfPdHCR;|$M{@JBd7ypH=HAw6qWC*F^uq9T$JVPcPxL7{qF zqr`z%(k1<~j@izi|CmFHbm-GZza4-2!De%lNC++}w!4tG%Voshb`0wh7LVK7r721n zA^bUfv%`X(QKflxDr(A`>)!@Y{Q54~dC4j~I9Kw*!xKv)5uOUg1(GW|btc;)$2}Q~lwCurd|d4smho zVkLyeUWl?+BULzFvWY{EOAX>+mF>vn4lRtf4=*Ipx0Y2>*(kJhizV1&jFQ=bk^R{K|pY@87_WYG53|6>qyVLzAU2?2Ej9N_i~=(_I_hh?>&bXOa{>t;cOU%oS(cE zx4aonPD2S25$oW^v*$$Yi9bS3&$-1(iItbgh=n>(FdMh2<3UXAA1^tksS8bJJuC;m zw3)b2iG?t3&F`t+GcPEU_ZVxlMn2X>BdLr>!o5JIt`WmnOmvlj5V^i`6a(zo8RigM zFoYBu_(7EGAXI*nJc#>Zec~Qe4&|jbbm#$IOG69L3huRdQHrYBX7gR+fXG{&j-Ct~ zH&NqxO#4sMqu=g5J61@lG8x-YmU;>mwS!?Sk&P-`IWejo#odH592|}3G8*+Ez?SlN zp+69DpcG%v*p7t6t|DaR{>f2;S}f&G1woB-LIJSLlnycI6@wVRKu)AzOhdytS98wbU7nG9$ zA&k0XZA_^zXdG0hOnDdGQqb#&bFF9f`}e3(O$j%T>Dz9^J(}8@l9UOgXZJz;ZyXbK zkOt?*(Fr$Bn&+L}9{MUGg`LWk#Ih2aUnC>pf5m_Yx;XNOWCksxqZ45ueES5CfDlx&A76<>D zwm*j_yeor?y7{IC|LGUPf&j_>RKm_<*N72su3Xh8^=1AN#*5Avd^M`PkHqHu`SWMh zF8t0;8_ZmWz6VG<3w)7=g-5_vVXUda^O$PbWqbDPxZ2jifMLseMOK7lLjeZ1m^ zP3*$r{wO3W{5_M+5-#v_XrWtPL3RG;GMrA$Tmqiy$jvq~v9!c{`B? z7CG)!KR@mN{y3|ZJ@+|LchM#WSmVYllbx(7afHAl3JeQ};|0Ipk;coJ$pM0sG6$Ff zF$UPGbKe6Pf)rzeZ!>6}#aMMWouH$)14ObDceLW%R=Jgl9by~%rH2!_m$+voBVJ|#@uNFAmijVKP{0AFOM8GNBTC!w` z(#~JSrSMQI8B}CSVHfh2@?E&%E#U@NFj!AgC?&C&M->eR-PPdHqvuW>@oemhi&y?| z0y*GEArxj)OfTei@7`S>*GCb>1iPRWqW6N6OsaS&#}9}v*cy1n=tSy zD_gSR9ab1BOv~`$ZorM_5)uSvw}QS~Tn|(Ow~H=S{4)UBlbV`p{CMquCWWt$yk9dJ zuz;z(*dY?a<3|MK;U{aY>5-b2HB6tEf3B%9BKQJ@jeWA4F9wW^9nmOq1B;B&2_HA1 zWWqE2cz(Wl#HIr=F~e{qr_$xl6DR;)gc5fP3T&VCY}{-d`Emmz=F0J{L`ewQ3@I$A z_(SnQ5#lQ$kr16U9rc3db=Q}ge6sglI66-2LXJQ- z{UL{1B@0;mIorjafvg8&&1Q>=A2f%*T+q?Ip35SaF#&9!xT&fOraIM7*+L-;Rya)9 z+R|clx%5+EacwZm)^JPQxDD&qcYhS)e*EsEC8K)pee07T)*_znLP%fXNYTD`-@ZI* zE4(NLi_2{-`eUqi+H>sc{8gas8NNJMS3;%F21+%qrBgJNlunCddf=BZ3{kuG>szZP zUDUpWw?1epOiIF&PDiVR@yymQ_81ymw<~<`)#$fU*gwxeoHN?xgQVS6ao&Et(HbdxYPG0kg%x#w7mPU?pW%irHTwZ+cC!F62J za*gtbMD^j0om7*pV$zb(;n~G`pQhiaV;|FucKG`vbL!r@H<+`+0t(-K0eO+cBa(0M zh4qa{+CR|a0OE$%_ixo>$Vz>>f`` zvON?}d3((-d9ms?Y~8wUoMd;69EoxHhOcjJ0us;4&Q`~monA_7aoRKNO_B&zhR+M{ zbmQjD6BLRp0mGw%mT(G#-#+*#E6dF9@vIed!-A9yr6 z)txBO7y?p8z3&`7B4dG*PbIf5ZlJ`m_orQ}dIDtGr+WB zK>7kdz>3OmJx%20r!GJuc*%U_(jzMH7X^G#(?L>UhJ+5(KWRNkAH!Tuq?)?4p>t9b# zumJidnM`ZX{aTG1S44T=JIl?xGy=G~hfQ74G#XG|7sM@A?04^SkcPJC|25u{pj@F6jAUNNm@of3#eK-ufNRm zc0MD{jCT35Hrk(R*^5jO46AFYticQAwlAg`$0!new|o(V&U_|1;~5nATm@{D(OW*x z58m<3go2{ot3y%TWbtbY$DGt!^n`JS$27C!ej&E+f*2EJivR1+}8_XYnW8JdxkfjXw@PKh9JsBH_u!-+`lc3YLV5 zo4tMEoXLdtRh74Qft>20$OvSyb<<*OLXzCmn`&#+a>b@R~%_AtVco~wemJSkML#YbP)+I zl-|-EJNj*yg1*bncMggwueP7LTyV5|)2Rme5}P}m}|=XsI(b_M5yf~ayMsnXc?K?n||M8Xy}uZG~~hM}*~BGBYE zJQ)_pu%hLf;S=O1d^i3PZ!CL~6LrtMoMoP?BkIT1|5XY~QPp@*HB0~G?}5!hzi0s` zZvQ@<7Os*)bclwAxWzb)1`6JodZP5bMU7kyO`E=RFEgxU`ve$&Y1LFF7CUW$36@OF@*!^P6s#K>LwFf+Lk!Sy z6XBmIF{Rko6evR11_`)=TZ<3X05up+8S&Gipr|kET}oX;L}fgVA(Y|77~SBlme0oy z%-{Nk`ZLpo7iZrrHq;zOMu|<9+d3fj*}q)^nyeNXcW^>xMYnxj=68&hCfTbJcQH>9 zl@|8+_lk@Ak@UcID7-#u3gaU)S{`L&jHVml1aQJ5 zkh>cj{~f>$2M$H}Lgrw9-DUYxM(vWhWxQa+`2Fi%F7tXkE?autEOc^*$WGgzf)6`gz6}woI?xP{k4s(IBY~_rU%<$P2|Ei9-;8+haAsFH zY-+z%UA=Z)yz&y`tdFzbK*@x6%Ln7|y|+Y(;TZOt_}ci;2;sh-M^hPA5mi@HzDPN1 z4&m|Lg(ljDl|SoNk@RS;X>nM>iI5A~U0}NW5sB_E-qZZ@d*CF(Km~=T#OI;}KW3eX zp%TG7Y%&p%!~b>+n2Tog0lm$Y@mpQp+)8IZ`mxG5->GX|`SacGc?+fo>Q@=~0&f#) z>a7h$Lh$WuMhn2uqO-Qz@y?i?Lir^AD3Fl-qD6)mvkw1? zzZo~nH=POq{aH_#0nUmsXP&9tv-@_Y)=g)wnq0qr3)gw?p+{$1UZQo)x7zr}8kD}T z$@C9-&krY6Ml&|?ZqAcC+C>Egw_jxFcM3H=a}o_-#aXIk9YvSgO=uo`u3mM2n5Oki z&DAdaVGNGE6UW=NL%+s(=(lm=rikj!T|4S?J-kWXF07Qg;w7{*BO66OD_(L5yGB^1 z^Z(j0+c~C*uOWs*4P_Je@9zl8fK$QWa)7T&0lFZmudrDD?n3!0o;gXu_kjhW8aa!? zUmHY50fZ&jJy>CyV`-^VwIHB*saL2cWP}(r9X{(hHeYDX4X}IyOB=oFS#R+747;&Z zSHhLgd(WPXaRQ2Gzz@^E2JE8z2%jNId0h{sR46}1WY4v9Ho(=q**x;h#hfDLG|)6t zDbWjF*IqjM=;--jh=syOuido#%e7IbT9bQh%ADo7X@2BO*#$$X7rBYKMmf2Nj`?Wc zc=18kSBDHYbxcg!boa#zP8AR0&usz4I0kEa#$n|};Mb_-kGjN|b~gSM(e=}^;EZ># z`o5wqw^AuNVC6H!#BAI{a>@i{CA?i>sX97)pXDibbe6h>Ah?|8*1hlv<&>xc$#L{u z^Q@&-j4rwqX~X{+Z`(G}Vr)02YZ05M%v|^ zRFX8rGwqeq>zPmUYTROhszTJHe?{?5xslel<_{Cvx2RPU_95>~Zrc zCah4A&PfBIP{1flAkSD#fgk(&fxd^Dkjm-0|O$b+3QXDC4 zB2Oup9G`QpCCLlw&Z}7Ov|E1lW<=c@2gy8(0F3%O^LE89rYfF4F#rI8?<|}Hg>49> zrfBy4Sthgoj`^e~M;$5*_niDLLxgGCIaK#HGwkVKIQBCv%L+ zt3kBLp}uch#nCI3Q&W=>OU>|qTSVo>a?dBM>V{zw5CnfZ(aqbR`-HW9OVtJ$%e($*vcV8rl-eZ+Dv8fZt$18qg$;i3r1Oo$lNj%Qq6 z;rz|LJKI<~FraOqOm0@?P6*qv)HVd#^7}8IJ$nZsPwe=|B_cL8O~E@A7*r^ z<3iPDgVn1|TwfI3O#KVqp6ruz&sqLv%a(%pDnjV z?eXCSf%9K2MgOOh;?{O3Mjx^dvP$?g2_BUeCZH>N+}y~h-eGqpMJ>N(vvYoOVq(kj z9Ge+~B)yC!C$CAkFO-82m0kb&=PkM)bA}T^tf#m-U_TMzh(%(x$_6xN%(G8{8NXN& z_=4k$C;_UTC-VWEyqU4}UuZ@z|2fRJnKHlZyl_{-977oUkc9>N51fs2KBI4{`YCd- zrTLamv3n z!ehCM7<(8dr=2*&R@SIOmT=oSe|ep-eH15X7V}56`GwISUPp7OqeYh-}r@w)s-ncSedw(~I(64$uHg4GCw2Z-!vEaQ_yjHND!+`LSW^iV40P)q?b-6F1&L$*^nNp6wlF7H@3O~LUK4z6E(ORgX(MTo#(T6=u?Yl(O zrf^n^&CD*m%->3*S~UIZ7NDMoS3CUgzaOxM0*iI^`T{Bx<~7WzKR)01{rh{-Youck zv*lg*$_c{84x~Tt;H>G>`%>~SNG0~ObN38NbR Dde-Ea^*!^ zPHE`{_wED5dkQ4-f29LU1AO$f%^2$oEjHtNVm9`jsi-^&n_^GomrwC!IPmWynt|8B zg3gUKj|B&mu>C!af3K9jvffC_0=F$DEH)s#Y{o2nmjY zw0Jlo^j^Ci#-YVtUGBq>O!>Nes=(knr8ulu@MGtFXJrI> z5PI|%n{|Ph;vNV^G4Vl+ln|;Jw-z#lAh(vT`{*C}LoU6mtkmN6i2%;;yhGn0+B?uF zGz~;kTZq~~58pA{?5d|WzGip%LwD7IF5fdAS4?VNbv>U)#cMI~dQp=(#i>QPUp{+8 z)_-+{KRByw>pvyz{kwOf5zRpoBCb6!Q(|!|C#QVYo|j^6B_X`amtLvp^HY? zGwy^_!+PofQMIuGeEYrw{uvXJ&DP4#ZxEl4V7kl2CHLBjvB&g`owo|fL1X@EWFJD& z9v>gSCCB2%3i(wxlm_x`Oz^k`o5dM| zU2$&ytWe>=I%kgWN3P8WF7+FICtRT)O+TSI+G=HJ{Y&ncm&J6 zb!%D8i_jdi&5?3IbxpECHAQ@2ir)l{tvh=%S;r8{Ei@cL0{PWmCsRVyE}|Pk6K_SG zXi@$xY%qE5Q^@AWt`^OlDdD%_+S1Vbo@9DyEY)u_B8pV@o;?>1ULs7~*%5m6b4THD zx{FgEVHP;C@zOs3?QIsN0dk`!7Rk|{({u9>$dAUE*eft_4ucUP^p`|~oCnP76!Q+5 zLM}sF;_H_$DEo}AsxgwlXj)8$3{o@5n{`vfAivn=iDj(7j6&pdb+aHgxy=yzLSO!& za>aOw%emE7jS?|qxMl`_jz4+j&D@8O2GH3huMI?L^MDu1c01OH9_FdS6?7(OYcLlf z5GT)82z7)OdLN8DBWHsIZ9MOXptixg+5iZg6)z!kc~_F(>=dwg%(BsN$79{h*rbSs z(evlmOW!hO;cYmXa!$cV$zSxyHtP;g>KjcVd*qI{)#p8yT{Aii_vw3c60Cx7VH8BZ zuy8|bx)~wQyJkGEHnG8)cE;fz#-Ym@cYb=HQ}-W88h#Ll55;s_N17BmWl?)(DS~jw1DpFe*--Kn(n^uH}#&fqd8 zsp#yM+ISX*O_2z7n&fIgu^ZDxBST(8&b1^Fd@!r&)dq-5Q5pjXZNIkS*fSLbl;~7H z>6R1SYuXp0kw-=3N8@cjzvix)zWv<-L7kFY7IZp|%IuXVK=v_txmM{Prq;IEY_hO` zesaw9$d5m^dnYOgzkGT9-_K%KHeQGg8ZdBRVN$)n?#Z1<30Yrttd)%7P@UrrGWcHh z=lAMYLvwaj!+Mb*1}LALcj+R;tVnCV@~h!{*tH!Q-!1l%6&8xx{G2a%WwnyVGn8`9 zZ&_T{Po@C-brVyo*x7aieq8OIUT|-f^o9W4w)WEV!pGR^V?#vb5k7e!cZi~Zi1opv zvnIlS;45|v^;s{b0oNTkOs538QEt+t;}EbA%&8abCMoS0B?2vRi76i*?h*R4N4m~% z3u2!eUkG%=62WTIze#uQOr=`?)z(G|&op))QDlrt)WV{2bA3_nAXMgDI)%&UUm6Y* z9mzjL7I!^Wo~hWy2aAI2n) z%S3p0c2*VZLGYEiKdip)N#nEP;s9I`U*55|ppbbE*q`Y9O)>4~i(f<9it2Hf+U4wg zbj)`|>|W2Fr1a0QtzZc2BtyfLu?yg`;88i8teF*4a?JDLr4*5UWHT^k{m>ar{?G%* z7Dcxl81FOdCe=LMZrVV!O8EDJFhGlD+;I*8Y*gKBd&kpZA&H5`+R5jb*fz2F6IuLV z&)pfD`ajRSw~fc$d2-#C1kEm4 zpV{-De}udg-mE-LQc^NvmAmUGpOrF(uQgbr1g8pfwO~nr%$!jG8Zb}?L%C&2of!7G zfB*jG_^qGiY{vf3T(9uy$()0{wb`?UMIhqml8f&%3Jd+XTWe+p)0=j`5Y7(X3l}cL z$*OQkg$IV{i__0WlLA30q+`|9MwOifABAiMe}+b@A18**8A_o5wNe~$4)3D6Gs>4Z zX4(Djh7Otfa+^fzT_b1H?t%E5GZfOrN_jH1+%b)%u9|;1J2PR*m!2xIxbSsPaBu@} zSFFz=sYhcjfu0NA-vU3gOoO9qStGZ5_npU`H$2z2m8EkaGrfVHxjp%{J;b=w0*tr{u)6;c2 z>T-Vq)DPw$ggRsNeQz(k-Pbaq@YNze-$kJdr$0`- zAx2;jO-ej`;?rboFLM#iBc?&vrJ7!OUkA(ta`d`rRItD@NXc*g&FoocoAnMz7sn|z z%EvB~f%Ah3Qem_LeMrKcJ0)iVC#tN=h>17pM*Bn`w0S-X9}9c&+7(DN|Rzi{yB8PZdv@F+duBxmY+g^%dj_@M3P(b6fGn}z*>FOL>z6QyzoBm8(zG6qUTI7-4 z@3w-j530L|x?q=ft?>dbaL7(lv$9SwPJ}K}p&**Jnen~Jj0kIMAJ#5CJ;5fVR=TBl zbaCk~+3@Ap7@r4u9OkPz1s3Jad9{rg0!du;u21xxt>yLL*WjY7GA0rs-m!O-Ld#FBrj=oDWZb8xNCgp;4Orv1Yu+5M-j*}XwDMrk=|c-fn@{3{YLGiF!; zY~Q)__R*N-&YDh_JA{o^X5wXhsc%T2(J+$GTh6h~n*?tvPyDMrfX;}a#pJknf>Oyq zWQrnj`9ZD_#8iwzx=ta&3`O=sb30%&h+p`%!`V}13aJ+4iYT$+-Uul4B-eY}W>Ydb zH`N^p3JU6fVR?^=daX%*5SgyU)(^cr)xK-K&(z^`$f*D3j&HNKPYQKS{VVe<)HG#S zNVo%i+uZ||QUXVlZ?^te#!t2Ffp<=AIij>Iybf0$&Su`V+U`o$R}?P{qzqyA^nwkJ z3>`qOoSkCcUP73db9)Eqoogrh%HSyUG$&q$&%v;X-w(q%8!gy$I<&_;LY7}9sINnp zA@-w)CM$GI00F-DL>0%HerT8Y@kKXo%pA$W#tfTSS^8@4?n^1X4^atFDNb+%91!eb zk`>c`!6J<%sgvx*#6k7})5Z_*E zt9@rKlB1Yf{J$0~U3&6I;G)pWU|}&KEy|c5U(6?&-PMLi5iNZj9`NdXI#MHS>9{Xn zzm_w@Rf))rO+4Ma*L3=y7Qjy&c`oeX%B5>hekBTYvhvYqm+c{g>%!ksFba6viM_Rk z3wvBbCcu#>-ErB%^o`-U(mZ~w5dmfcRRi_!)(7YWg@%L(6(CezY8L7?Sj~>YlMc_b zvZ6k&ke@hlBeG`k1+;B@4;bKqNYwuFy#*WXyH5PR&yUN&v)c%X!e?EsXhc{NJvHb- z&6T>ssNd$>)XRmnBo?n#uA`h(Z%b&8ie8xWTUFb81<{-txMSMm&shu>oDohRs!EP+ zzkZ1^E}`LJ%tuIAg^p4TsJOqatV|O|!4O&Q2P;t`jTMvLEHFT=%_7qPnnvz#YNl?LX0)?Re-AhVZ2UvX-((iuh>gz1_J^>jy6}Ks3 zQuV9oQ54>Nl%GJgpujw1SRc}eZ1fbT4x5GH15&Dc7W<~Wh$I{;QfN%|K8 z+F0jKhkv?Rn>;e^Ts?#umNcG!&`jB`XXtWE^DM(gh2*Ib{u zi90?nI%S<(CTV{z-6OmgiY50Aw{9HW&kAH3J*iygFO7};EmlWlhG0*H)YOv{4@TJzhxl`Hk;F? zu3z6R6if?GZJU#m1%)Qvv3`(Oe9j_VX^~OBXEx*`CQf2q1u0kP?BhANQ(86I zX-C{H*CQGQ_wTk(omKQzlQLyt{}QZLAwZx8H%vQ6<4DlvVwWFqOnBr2=)~w8e+j(k zca}w!GsMt7i%%*R48gRPS5!O^6KdF&V({yylt#mhvjRCdbVz0@vSy+ijxC)}iPx%aa|Ms#v$ z#!KaOoc)`vtf$VNHLUfg_wWt$5kR&_Z%t|zpADK}5ELx)3}WHD_w$bwD4=!5XHhU6 zfet@;?p!)<`a;MqsP?RW){*D7%sBq|%+Z%g2?m zPJv_CK&|#G6mZ^KS;$3D_6QWh!@%fF4$=YzWj_F}GnU%}a3v7=_WO}tb z+0w5Uq>8)4XC$^l+e`xF9`Xo<0G5hQbl${JHeI{kbS<_IErOUpf+_Snr_#weAHnJ3 zM4`P9&Ud{q-k=J$zkcKBAf0#pt-@V|rVv(?`sJa@YyYyiLkABEn&Z5>%k9S#u7}nu z`IX%3eel6L?=9cxwiuot;?h{N5JwF@vmzArc(f**q$7*l5bKMhX!118>Ay)xvEuwI zU`t?R0#=R90fo_rTYmhwx##B&P@I4ZVmwMtt|OzI8(+!}84~&K*p^8t2HUqs=cfcu z;!dL68_;z@1(|Ic&1~ENXSlUgkL9BO)1yadc=#gioeQ4Jtt)SBIUuk8b@3a zYk5f2@vrZ>j%}G8&^I71PdnskGNZov`El7fOO=f~r&munl@41!bLPx9%eu^uGtQ(g z|*REbU4?xe2~+1aPhPHxEA8xV7?JaXHHDHr25 z?<=}m{$%^69>$lSWju*w>Brh9w3)_DoCs?PO?)UO#y(IlwK&c?P1s%1 zwZcaeEyVOC>W%%NF*lG)#0(Mf9#xVy6gKF0%Yeah$!1FsAv-4zg(fZDvtnkfgkZd$2;v5K&|~+HISk9Wkc1$ZU7nbR3}CLZf}dHC z3wZw3s!#bnQ%m`FyIrOrtPxj=mQM@GafzaqZyrkSV#Ee|fd-rP=odd*TUoX;NF*v0 znnGR=UG{KNz;p}!$kIEM6M`xSsfcL^F(nG@2&}Y6Nqb_bI!T~!*Ks-OI?eP$9WRc_ zzIkoPn;my#U0hl>cU`VzF?@08@^YRRIuEd3qrsHt8>jJnMYSS)TWLP6|HHTp`}(~9 z(-W9)|3k7DW8*?&z+)3)<292kun!eQ$?vw-_wV0tC=Xh+c(L4w5&IzyRppoSfnd+Y zvYWqhGI|ji5-l1mU7ih-uJkCs;>~27Z!lfj3*uc#_kD|6f7J3zaAEO}I}-0T z$Mf_;RpNCV` z%V}PPf1*ZhY9tV&U(*2z`MdUTBG;ii_4-Xk*=OKDKh*&584mc@*f^}c!>TspTbj!s zJ)t`})Vb=C=3b{2>nEvMUO#N5!u%SRAEJ_zxIJ{ZlLUmw<(@%FNv*bxXC3VA(Lc?9 z)#vsh|AG@xpw#BGt7Bq2;RG4_3HKe4so{$d>z*zyE(7wc=Yt?eiSma z5e44^r+^iBs$8?X02w z+g)ZnY7U?xXTLA00#1!mWTkyx|C6lX5~FJLeqM&@$pCQ_Ha@QDW>8SsCE~`7Fl-U< zOT2#F`cxN<|Hcw7Yq>YPh|Jc#dS{bIE7SJqUH|FU&1&hxRW)Nr{d^koHZ^n4I+P58 z(H6fh_gp={kTfPNL};K{cgnn2VJZqS@^R9O)F1cnYlx6Vz7w-5Q>L8c4P6f!=BPS^ zey_p7T{3&ub>H`9q;s;_Y1!h0=}a43T^X*qdI&A!V^z-9N=t2j?WZFEzw+Op&II3@ z+tbV=(!IK@{O&eT*?1WA0)mjbrkltFA)kPs_AKd6tfQBOT~Sv$B1gZfwCOYxh{-J^fmG|H(8XA1CW5Iz|mWm7Z5OcM3oT5@YxC!nSjZJfCzPVK*l8)7!T%*YycT zDFY`G@31xg*n@Sn){6Sr$lMd|SpS&Hw`owWa_R ziZegFeXH@Gf55vnjxpA7%3PPryT4`rPNv2d3qNXZymq4Ep{`}VnO(eC9zuwzEpnEz zx)30jS@gywad*#?RGNIhnucOul*us?KXqUR*i4~FrMtqNC>`vEl1GZ9T%Y0O1tDSHXFg1<5)syv|JnEY< zF)@RZ^di@=eopiwt>Ru+bV+)|m}kPrnuZirlCr7^HT8Kayx;5>I!rSul?YaSX zevX)TB{!~{&P16WqkOL}a&@kmu-c}Fwv5k*U$?y?3s?s|pe1>^3) zt6S#d)p?tPL%$|VOu^1-?HzD!TJN`9xs=GPTjs9)y18F{jh|lRvpZF_wZ}X?J#TI` zuGs@a_h;pwj`m|)BG=>&qPZJ*uDOp-Z0NCL&xaH`^|N{r!mT=U-oc*zAqzi7B_+8e z_gNt{eXKs_X-;R;5E5fCzQ&RlFre5)Ay#41|C@5*7yO+6wXHfsAzRNb&J!Nay zXV4%d8{PIj9cdRS5CR?DcDMgcR%>Tpd12$O(n;thM=L4y-^ct(z`qOSg*WT__hN-C z`fb`2#rrRIWm1)_(gA(v0^Hs|{k*-NKI+64{a4QKVr7}Ep$adT^p?I{yd_z?@+i}B z99sW6`>hMZA8S4zk(tj}02M*x<+48(XiK%k<&XJ1+<$^0YzwxO$4~aMwrka8109tD z(_4$+OJz>awzszzmLUv4V)wKdg*bgLX4)8Yt(g_9qNX-|&yQ_FqVXXoWcCo4W5>(6U^Xsq349x7oA?VW$`xn}OV@2i!E z22_3;aQN`yi>OYKGZQ*r&?Pc%Ib)M|Fa&sb1~V6>#M7%UEq!%saJ>cqbqSIl#+oP> z26$=a=ESd@4D=oOXaZw1?)6WeWKNkeEe?&mt^pliA(hhfj`Y9SNOsa@qJS85XN}!- z#ehNfW7p9pKBlwvRe}mr>42qZ)GiWC(688fJFG|T`?|V}ySu+L7Wx2@G5>lyh0d9K z3NnpL@i71=Q&tHSrC(tr`3P&x3`|dtW6uQi=vd z9QgGo-l?*DSwZvfKWm#eZuVI`Z(5Pl$is*04!_dVi9RsSE>gX5-SvdqTIw~`(Q$E+ zS7c8_+Mak_8+%3FIL=_9Npq*>P6HS8>ojnqx86S^S}$bWdy_KfM`oMe@ck3}PLs?^ zbKGt!ckWK*^y1__rS(~@L%cNmOL_9osx@n7P1t0{@O~6xhAn)+E~azeZ<`5#2|*2O z1vBce>KIN0bGhG9DXBy(2dbS-vt$L0jFiv=YbN=eCI#O8>nf6uUIKLD);&1T zq4Rc+XXV?Te%dLoppZGiXsp-bX`8ZacN}-xHGHt;x_|abK3sk8TmN%m*H|7F38{&| z!ET;{>B6n*WdVk#>h?=d-@G_V(`WI{(X*3E?DSUBS9CkAWxr0nb|+e%gTb?;Wwqt{ zWCMXBf|3#wJ=9gKV~QLeb{%UthqKtz+GWu0p(nJEOBm2g5-r#hY13cNUo;`w)ro_R zXm(v>=eh52K`ub$98u5Emb+R3P0FM|Vew+*k| z+*M^X+h$y7>N_QmS2Z3B*rGD6>gynnsh8DP(xiy+HTKqCKuIxbhg3m~?4Ulw?0q}< z&2%~YNTW_}bW=MMu)1TPW2x*_x}x?uVLm!Te|B_0Gjws>i&fW%&oW@$zA zK;k^?(}>2LnE3lp2U@!oXPz}IvK#NFS8Fh9nL?VE=zQ=4EGJqKkdvX>0y> zRnPB7QU`iz8mZ6GSQ9NdFQT`dT%TpEj24^aBgHm?%U!R=#H>ICeu0wEHy}W*YKOLZ z%rNDxrLu+6$%j+mSXM%zB{=qZHGRXJ-jDSs;4u?tku@}#{!H+!kqu+}b+ZInKg-PY zeg1JdGaqZ3x-dd}>&%U)wJBySJ$O_)M$;or(4Veymi5si#*Wp(FEw~p_y;y25t~Op znvz#kbWLoU>3*Z*$`vbu;m|7!!sBSt)E?@qzwXw?)2mjltfKw7!ouPTjI|?0r8O-Z zxz%!K*+5jn_Cdb=DkrCSrX6P1seYx(MWgH6e*Zr1+h=Y{enG(#%hbbTa}^_h@AXl{ z79%x38|N%ME6%7gBR2*zDk+t;auG*R zxZbkkaXjCcy?B;sfpgw8Pua11Jm>tR~y|w9xoU~VXSePas4j<|7=O67Wtj$NR zI9dmC!(e!?K{?9ze!T0>-&Bo|z(6QG*J=$*M>Vn1$Y^{}))f}b!geP3&3S#t{tET! z`1s;T8YpdPdw+G=^r!C|yf6pHU(iTDF7b3YcC-q{vD)-fRuYuRq7a#3LP|SYtLx>^ z(1lp3?6XU(9>e@StjQw8XoDN}&l)xAQQ}n$W1Br4=Ix)q0fcQFXXQ)T71?)RK|#T? zq51n2jBceqvzs(-+)Ml=LixNKPiwi~V+!F-OG?`N=t)u@%ueZwM;Ma4|26I0dSk4` z`rhlxXPTYEBfG0x&;X#*Pie`I`q1dSDW<3aRarH=lS0khes1CvZnqiS zi8y!XjuEYemvkVa@aWSAu3=%ij9a3w-k6s#OYGWKWD2QM`*!%vRnb@+J9qMaLXaya z04=PMzK%!)LlRx=N-nT;Q}Olu+Q*7|yJrn8`m~c3GoUZqSkFTprs%C;r*uK8gQH{P z$%^2`xv|e$Rb{34qL!|5Q~aK9TBY38eV#u%=-#X@_n0@reIA8hIpdy#3)3`y<>lvJ zyM5aLbHzSw8d94-s5Z!5!~a?zC+-^ns&J|##?q_C&iQ$So9p;Or7|^gaR1I@rM;}c zTFx{d8e@Xm79*Bgv}8#kyMs0i+57A3!BX7qZWA~ngPcCS4#n|S`NDk7^L#T)xOju6 zn{uCEl=^8oY$F^k($iZd*T*}zI*()0z>u-kv(w`jj~RWE&tH3F?1ieh$uN=s7Jq1l z&~RV}XO&Y*Yv2X97E4D5hbq3l03sy)opvua6TPI@kJH`ApKWfgALZBTBt&Fxe7iGA ziD_(ggrd{*R>1MS#xdnaa+9$ugTaL?iB-fLnF+M?Y6k#8Ly;4H$&D`W(699O((K}3 z-s>+E>8tvsPtuf6^*_&sjZZ3ZdnsvuCHGF5wWWX9p4nnyEG^6i7V=by^+^Qw$o?;#T48m0(g%dJY`2lp{iJTwu|bE{Vx8^4|#Z{fc= zXp`IgOD9=v_h!;99JZT_&tz^^tGjh_l=tBS4=$ps$;-*PjQp*Nk6g&{4rkA%ub&@` zQ+j=KEmXpZ;`cNvSBT^5fRg(86iI?|&8_E?azU4{c)( z;qnp<`Qm4#_bU9YHDi~3TN)b|m;U}MPAz)i6-=n|XdCoQsxSAxoSbaR3=18e<<8ED zVzIiZWB#gxlUj##a~BEb#*Ik~HRKe^KTwf9Zsw~;Bz!-+JTNFIit!d0T76&wFF&8- z@g%&g<3|55kvVGrFVhe%V`S;JtM$EmhGm%Ur_A}ji?%p@wC`rpCBzyjfmOhQ&!BY;;#$S

1TJv4d745xltj@yvi8OLt%7H3R6Qh*k-+y~IuUL;;+BQ=Tt`IF_( z2!NG|CFA-X@8tCEe_DWUmQ-ruxVvu6NoDDqW2$i-%4SB+feke^X!chz z3Uu*#^N86G%Wn!llD6`mdzWfyd6NA^@aJQj=vnlhLqb9@n2%T?1lTuW)TsIV4lhEi z@l`~FqIY)6T)4hfIyy%P){spF@*3uYJQ&Z&uiWTmKFG?(W+mbMrTco26n4!Im6K-Z zt>9TaOHWr>Cy@&NojyILEJeoS62(?%SXh&@0!NHOAP%!$uIc=($&F`dK5dFG&Mzs6 zB=gin#JspAeQDJ8^9TjHb!_jEj+u!z0qXG=o_~)XnqJH|J!7n>Vjr(*gb)%R4ZONI5YMu* zR$E$L!=AUFWM@ZSh!ws;kEE9@*_mVtMV!dIKqEUPjL|;;`3g~SUnwXs2;BMFvW2Zv z;T+ZWKSpKLHimQB;gWM`%`_mSs3NYfR+L@^R_E$FJnp}G3zt1uJ+F;GoL>2zH*Se* zP7B0%EV}O(^ZTxha9G7X0m_2dJse*2@zRX+*$q_SO^lH6dFycS)(!H-gOr#OUJ)_`R5Sb=gnC}^weAEr3fpN-PB$*7R> z$=sYvneV{HMFHSWmDR7tXbBZOvBcb zEiKM%Z@bJ9#o7ConK7F)bLgbUB2^>H>G5eXS;SF{}lxm20^vuZZAd2`LlzzYMkm2{Yi6V@1jplBTNmYJ*K|v`%f2_e_w69 zSz=e;sCq7}sJ0T~!&)sm<*~uOj_un~PQedrgZY2}sugE9IFvXRR`dEdpL1D`Op3{Ti&xHcK#Mn#}uV~3HIt*vj`dvEhWnAUQzuwuOBRyt$L zmO&nXYsY}{X_CQN(iM3AKeO?2H5(%331hM`rikE4C7dfSldq`9PcnYaoRmU~Sp|wa zhrjpgB(@+Skd;Z%L-&IrNTAAR8M>^Q`%vE_*BHwtVpKIuL@)3n72&Jl4kk; zDNKxvirlWh;V%bX^>uD6-m*hAkOK6S`Jic%kGge!ZKF*3-U7shNm3%#Mde?T2>_zjx1!2L^74Jy0;ef6~^8 z7muZW{JJZaX^7fNwh=50&Q1ujZ(2Ojk*WaDDk`u{w#Iz$>zGa0!B~EQsKN+sBCc)4 zbC8<#$(Ei9mwHPKZtwZ%5?cOh=1{Yt=Waj^t|jM)ssI`HHQfPegW%+%Z}vLQCTjgN-4G4h=c~ko^mAJy5;ntF!WnITW zcWj#(;o;F)9US3Yan2&vxzS4JPyI$kZY#&|@4-*{qzt<0QKRz7n!Awr?x=hN^@xs- z-Myci6-*OPcmLh-E7SYcK!!pP7{p^3F$a%T-T&&gp(Xo~q*akq3z=7l4$hl_n@C4Eba}G@6xs4V32AcnCeq$XLlzB~D4hv9-TOem+6v5DuAfo=7cj=^XjN(OGqrOUHU#-&C(pk9SO0_PCPsth6!S`z8hn~vgW#zBu zeE%5`b`7v&TXbt778|$3K55&M#8u=)bk^+S;pQabo!`K4dRs5`Q=^tpCf)lUSbr5n z&h%3hxiJ)xI3LPzw9ERwM<|Xdw=@GUY8}bn>9Xwp^8@#8@(<%w z%IP3;_6g~$KXYzb+h-?7K8uL?9ozRcB(5_t7RB_jnLtP&j0Sqr0wRC=xhMSEwPm)p zkzDTFS~qU)1TAuDe6H*P&khAx#O>#zYIX1G)XM%ub>(c z--#<8x#44np0h4u{2`eb(MQu@rfdN>HJ@{gV;|X^Ox45sI2iTscgEIH3AL0;;ES2Z z2Yt=qt0JQYY430bEPc*@l3_LW>NHC zM+hWz)A{?RjT@`LNnXW2jc$#Un6`k|q>8CqIeJyn~%4At^^(2e=$dxCdT`<_&21CrapDDeA}|NR8ARE;$2Kja;k{l8G>22Dmb*I> zF5x-oLo7@u4wH&I{%L2DzS<|nK*s_j<9mDVz-nFxI&tk>Y2f9MLG~C%y;NQE>CK%L zV(ney-apNI8L?SvY8oie2b<6>Qx|Cs^0)-1Hedze5!$D=oz_B}Od?irt(6oN{}ywc zYii1kddsC6zw+2`)AOm)S^Q|qhvwEeFf}_e#^%Xw;e9hqpyc-J$Lz_S*U$X{LL`aX zmfkf2JnFHIjF8e02z=u2CjgeVR<_2*~8BYOOgf-eR!C?|EoOMn-SbO}%xeRZo8KL8JNDf|206`7Otv^jQre z^_1NbTl@*!Qun>}97wl5)q{cwaxMR^%I#^xDg8O`u)!0~?e*;XXv)fE%UJC)&GnP@ z+FVpFH;5V5zMff?x$qv59%(p%);I2Exw_zX8VAc(SwyFNf6q_QCLJg3aS4ZkxkI!( zrjH-k{dR+ILVi)v_*})FKU`1f&3t@(I{v4(ia+t_s~p`<`um5A%t7Q53@bzFyls2! zK363l2~rG->?&fDHMHel!c$!W#@8Sb{^VHvNGU-k$!>PPmToWN;^Uiln~-#f=LCI1 zx=xOfMPMis2ummy@3Mb5=w;zpC|Kz^Zg)eH%Y3QK+gL7^JtO6(p2C`hZKt(7FR;(1 zK}@%OpTLStn#4nMeos{{9Qi45O?_S6;#c2-v=aHtxs`^Sewdh;#G&nTe^j2(B|;=I z()bc_WN6cJuRb=nIx^nyoWcdPyZEa0{ZU7Fboe@5W{SZ0K@;sYQx>|YzW;anICH07 z9W^{2R6AI`N!XrBCww#JHM!K|+t4kEk6;&@{&?Z%LT^*h1F(z_G`%j#8 zos-bT%0cCP-b9%tnpA`P4ZlpRtZLl46hVGL!QU$Ec1|Q-$O;;W z2Gz%wj*~l)wjuDaup!AuH~G%rRIGlv-toAle8i@fT)ELf97Wh4uGohRJ+}WQ=KE(U||BrGgyAad=SYwuEnfj z@u0z7J2Dj-tP+}6OVw#qo>G7QEA_(sI<>5Y`Q>aX8xM#; z+kCq;i}IR(nwoaXcO7rgVfGkluV?km&BnIb_S0VRB!M~*hsifKG2I$Cy90$+-Ae?} zwnLIO?EjHHF7EWXbC$^iK*sbo|K3CnAtcQz1A}LL7vd^_hIY!ocujub{9hOeF;Fly z&n{k+riHcJE^esOW}!y%fwf5Cmclywj+d3GB*{u$FZGDN*g#e7tbW3~&yfWV8B^05 zj6SU^+x~dW$lTmqNBS*S0s9p6Ft%8D7nyr|2XJ4R_|iK!Z6WlNL9>kJ(~Z;&eBqFGsGikbi~0|5$`P}aBbh~x_&g8%U?Sn zFP>I@M+&NYC2*&|*foQqLH@=G&kojra?vaiMI*FjHZ2gkX6;d#>M-qbSYPF1zY@}x zr)lzQO0;UwbAaHtDDp|$S1B=oVye|4rxdZ)YqK)eb(s@H@ht7&0YzVc-ibiUf?q0- zVK3b(m(~S4&o-c+8@1Ta&_3O8$eXjIDmIMDfANRhXT-<0?4BvqH8oocgkK(bohaJm z|7Nh-&ItWEZ4PY}Gg1b}9jSjc;SOg@7?TPiB`SuY@vm#!j^yv!YHcmE)3kj4Xjv($ zMw_L5-$l2SM5jAm$-TxX9BD&<>O?lXDKbKx2Vu|L&~t@ z98Ezofe1RhUefFsaN%QelS1&>jKMdK7(e@_(b6jGb=vj%)P^gS37wO|$9wOZHB>yK zM8^9g7Kt^TA|W=G{b?)Pe*NaYOKhKYhL>}sb~gSPwLY|6(C&)Cfvi?NSh|^qga|Wg zZ)^PC7z5YYp!=3@ekrrsXGuI-W@2)k2y8_iElwh5>c#9<8xh$?-A>GS|FsI#`Lhn;^g(q_r*WdgHDeQ#kECuB6M3?)C~}0om9wM7 zKl^0clS6a#6jrt~~_P!y*aD!<Mp{}5Qzp?_!CieWub)ZN*p{dS$d80Zm zF~hod>qb}P&f3n?B_uR%U5|j6pv>LnuP_B`L##+TNHU%!!qCM5sWtE-}a(Nekhcjd0xog`P# zOXmJw9M)E)#XI$RR4%@Ypt1j+{p^~76!n6Ai~AN#&xhq+yp@`&s+SlhT^F1Q4CigQ z#mJD%d(X<#+yq zOj?{vDS8IdcohO8u$$n{>AAQ$8d{8{|M96PMoT0bZrBw%Z`Ks7ZKb8v4#uO)*RNNK zYpofPSJr^5IWga zhe%-1W21xw_g^%#|NP4OlV|EwvZ*oA(#k3){$8Vkg4ta|!ECY%!t0jSVM~7yDlY_X zHJJMqLXNJ6kzWlT>l@OSsvRa$Y>YL&wK4tVuqaAU{L-Tuu_QGUg!G)f_rzyzDII+h z%-8laYi|LK!YFOI^^LASg8uv*CNS2h3kf{-Sgcl(f4n>9jDq(+o@NZ0fhHA)-jV?r z!C33h{`sNJ+3K-R50^3WEp5NsT2AyhWa&@Pl~&tnlhQi;(G)=uTNg)%D~_5P#s1D| zb-SmFCQ$|pECmw-%ho^-V}4HQeJ$=egfvTdN1EcD;;&*K2F2{5{(Dr{cD>d~K-CCR zt&M4rLNxFZzC&|L_wCQBTw!7oAb0K7t>suVB#+tLW%<0TR|v}JGDNu;e*XE=I<*(X z(y*|w5q{I9>n3d~D^9DKS5HloQ|b$&*r}j)NRn%W_Z7K7Y&o29Y>`UJS>1Ld@JHwN z?Eo5<3|s(GU)Lvx-?(wxYFC=u*iQ=A`peh$jRDXSXB$ws{Bl`A*4av(Z=v<9%Xui-;;f>Ukwu`8&3OWWGl#XW;9 z*7p8;9#(P;%Mg^eFwQnnr=Z4};&X+*%0eJg0bQhs+I;WNDOKBMN)6gJ*zQ~TrM#GM zt*ix+uN>Ec3vg);g_9C=CZyFexjxa(7j;}Jhavn39`^f-XCh|fo~D-XY4_%a`k953 z^YZiZs`#HdmRACm>ne}_c$Kg{7*IJYE;e?Yx_Ze3*Cx>`gPrr-D4D%wrJB>{JUX0z zc>vfKpQbSz6W2@{>~V<`LZj9AV|3q4T8=G&)~^aRDj%SPAtEThxpXZgB(>#uA$>ry zc1~#_c5GZ%U7E7l?;am>e6u|*J7CA*fA&dq5d3-C5T`0ZJtJ#jGh`G1bm7R}*6n8$ zEWT+mCh0G0*>>aVVZCYfCNoq9Ngg-;dG5jK*)`(_c*hsnbQ$6TRF*o^dNgwVVWp;{ zdd_M7OErU+k*TbiOEK%=lW(nU{F7`)+ga8N47wo7gh1U==Q-|Ea@fQP6P5!of;Ktv z=UXPW1<>%NW^1^UX}I2CFXaKS%GvZg%u+=~Mcb1B@=A7tJlJSX8i=T62sVTS2via~ zxL)7g9Yb9ZlH50lW}-ou>*C?PmM&U!RIu|^jK8encT?WWUVZ)A*tOoJEEgF@2dehNZr#jcTVO3j)Io*`7 zv6*dMX6CED+Wv8i*5lt7=$uhAaujNy|MFET&j&*-%HCEF>(hzr+zX~wC;-r?m~oU= za`&yRuhW}?!9b;ww6@1=WFrvmv}@dC=A(#1$YcLhZ7+59iWSqVJUpQ35m+28?rKeh zH8(HcCtaGRZ_ui?4){Q9vmQ-@fyL+aWBf|&R1t;^6V1kF8_mzU?(H){RI zJ<>8VM8}9qL^y)Us8!A>O|N~>u)`s##9-^e3*>)3DcvA|o&$P<1s3PGd+?LItlixs z4O58gtk7LZDy1|`WIu>w_QHXd6!sefPV@m{2p}S20NE^Doc-Ws+{P+_LFTmO&hfG; zd&p6NJtsfGv_J@p(|f<{Co*xf{E1Sdk;C||Xnm2(wPZf2Infny5RW;3hQrMhqU9xT zUT7D8Jt5&$iwljV{wHa05x64=N$90l3JYwvXTv4hOX>{obuz2+l%>CcoQjgtDk;z4 ztb8Hp1cv|>4>7%6 zt*C=|_zhXLjn4p%a8^hO{uVab*(3P0yfyT1T&1UW@y}};1x*IY_Swm$bxa2O0=S#T z;+Sn$KknL4^wzbphot8t*w@xht2s3X9=yFc%(`sq&~aOEjYn}rtX2HmEA4hII(ivf zsCEX$2a)}F^cMxu&VJrotIkX`qjYvexK<;WEegai5(UEJ>eyWU+`^RKjuZu);3uJF zVTHAyW=!d)J5>GUo5SXVxcLQE=e#!#(hRzO%=u{Kw3<7K%>3GF=v->U!dQ@Lc6?6) ze)@#^HAF5bdrO8NTXOvFIXrcCl*(IoZ^osiTk=|7JeiQ7UGqKWcKxDw!wugqbzc8z zr%RN|v`14ScF)XJ6u|9kYQ=!wdpl}~hbJMiO(Rv6Kf{(WGDmh-)Asi|P|dKY#~AU7g0q@KA^_IqUXk-AH# ze;n1bI&Or#-a`nlxSWXMh)sFGM92}ii}BK4qD6<||E8T< zpHrm(Ex`uEj6|ZmSx(vaA2Y7XB?Y`*!zfbJ-~UlIqDP8+#I1OmnnSCYNOVdbq>=5s^V{{H4? zj0911OzB>61yMAJE7#VC%9sAr``I4wdIx7WUuavcwS3}Jr{NFQZA~7?1Z6+19JehIt5=!10dKtrfSM|MLeq7?8|9;kOhgu=J;~0K0b;w@m z)6`jY{oEtOca7mU*FI{#*O0O&>X3v)Cr_OPb5}~P|4>mOHGUntnWa>VhRItDm>liV zH2>U$A^K7Nt}220G@z?RV?}3dpir|;z^}!wxXW?H|D7#~r(8RFWPgP=wAibVSw;U= zcC1+`hV%s$*#G=t-(*xyC2sqrfP;uh#66bz((SBa(24y`r!lUSSzdO=l~Cn1c)Dig zdHWY9pIzYg4zbUe%2^unvW<5Jc*Xj8WUitkz5MGTAq&JK_4V<&49|akuJXR}5fbhH z`}h(PJ})j!p74JjhJ?hFhd_h>^Phbo^Cdd|@BhdR`QO_`8ByI!qTT=gg^uU{9;JkY zw(9@;NhLIL{=eTus$H-D{ehDhnf>p7|KD#x$@zaD)c-wET!{aBFaG}lBwF{|zfHsc g7b_&*RsZRb*L%Xxq49Y=#Bb^>)L(F8-ns+-5BSiP-2eap diff --git a/docs/user-guide/cli/img/lighthouse-architecture.png b/docs/user-guide/cli/img/lighthouse-architecture.png deleted file mode 100644 index 63202ce7c7bdcd06067d234b91654787803b8724..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 181976 zcmeFZhdIPm6bctbUiPS}^V8pLR~%H0=E{d_9$h-Mef9Rz z`={2*N!;MR5%+xbUS-rOjU`(QwA*x-upHHGHCV!=p8h1XlFoqCldy+@bG37a?AhkFBETk zf6DUz{x-37>H7cv++n}!$bWzKuGvmm^50*iZ~wnH{J&NDuQmKX)A;}QhvaX9SSB5I zDUN`bFJJz&J^0fu7hkWu<~@UggZsav8}jej^QgGEm|fJAOGZXU%=)W_c$lJbhNkgI z#9+u;8JS`kBi)JFr%LfUg2CBU6hTeF;L{ud@s$>0=JoeW4IVUGs%dCEIkWR&Fl`xy zQc~(eT=VGxyz2J4Z7Rmbai8nzGM$GFW=HGJPW8q|D7mFImx0PNPegdfwgHxLn(N^OI_0t1mCUzjB)$Ytm2i z@maNE#fsiafizWF*&F7K$%)3*p}V=bN=`Q{rBFHyF8&=#bD~ge@8z~xd*B^Y-*0oi za_m?07;n46&&PKk^F4O#*riM@qf9NYVR^lP@*VgJu8NI{;tmQ5nl;$3vdz=e^JTN8 z$=F<pJ%A$zl&1i6w! zhS{w_p`kSShda#%S~AP}zkmPk>+7qMqLum6DW7Hi`scIL<5dRftQSwp%isAsGU6YR zcs~AKYQbLx7by-oS=skBH8oGHE((YIbdU%N3!6?ly$MSg^!PFVfdkoEnPFH?V`ExE zLW0&3?>1|7Jw3h5ERWQXYU33vS4L!8O;1njzuf*l_D!!t<#$_Wt9k2eZ8m6I4-J0_0(>dJfX@;f=HVbB=tgPJq$~d4rx})R5%^NqKQd4$5l%JfOH6kbzU_+XuMZ(K&5U1~H@{&ShCG&Y zVe1$L1O)2lW~VbRzNI@n{X0X#q36Dk#(_)k*WbK-8_%8Y>gsCAvlsIqS?jFpE@QCY0u2g zvaql?DrNT$J2P+C5cT}|^NhLXH*b#ZxFH@^t#JDEd2Hy*j0~!VMnbscmA;|xZ?&?m z!?F3yTet3cSP}DZ*I9+YZ*GH!#|GQ=FJ8R3$7m%MOnz~_><(_7>WK~*{nu*K-=9|e z7^WQ+9W8dDgfjN0O&fcZ?=+xdXZNybe$EZUAO^|A#AN<8C;dbKM~a|s9-pwV3jPxO zF7(gMn>W4qbY8R$5HsGlaG>M2*EPI>v~nq&1sFPx=F$Mo|?PPK2vpZ$vxrE9$P#+VB;GQFz$2*HyT>H>GcW< z#boc{!@Bm}9~-VNTdAt58dJ{crPG$@ScmV)-4R}T*beLk877Bw#}YBK&$6(%R-rCM;S}!hK<#74Qgdhty>W#e3@i{>`S~Xs2n@#Wix)xp_U=-Goh8Fss%qv#!dZzvJWT@UKVV z;VF|N-Bp(2NmmBHO?Au6CoY(TDy4+?<0aw5)4_sylfS|cm6H%CXNTT0x(;ME6)X;v zYhj>!G5_)a&L)^H%jV7TLqoR29b8;oFnQO}+LH}0jZWJHucmlk{PN-=Nh1mh3e0$+ z*W5_N6f$d}?j|zp^@|sS+0-9scaI(&bs#%4G2AI(+u@BEBWC~W4DZgJuEbhttJbY+ zw90Oa`}$R4d371cC6Z)-ILX7 zecqp4tU#BWLW%Ef%g?4;%N~P}CU@e5`P*A-TMFH>v#W^rtvEu#H=0q+v%?DV@(-$w z>tJhCRaGAOyv}=)%q%QjU48HvqfCpYMmQDq+&O|mQuK@UlGIXEE?$hxK21=C%L#HB z&+~{Kjmerj@Dk)Ue8tAcTa?{pGyfcOC%bAHr9&NmbL^{^ztZLyjM1y+J6U-Qylw3S1HnDbR%ZHGIywY)GIK zb`?ox%K__AC;9(zdlIgO=au5mr>CbQ0_`u9fpz%<6*%^Omdnk}6%IM0prrJ;s_UDh=(~RYWYrH23QBYt`Q_{HKW0D$*eV2&sCKk7OK@H9 zBc5#%4)6c(i(e9!4@A~$cz$%*loxDP0iofr>*zUUweL#yy+-07?8QF~S{4gx)p_gKpTw#1x4TA#!0kC5I2NM$Gcdr&c3e zreo;>b8IlqXlCBDi5OCjDZIiZAKOUL;aV{D7LufynaP}TOf^%~Y=ZHe_nI4It5vmO z>C7A)N()b}SiU>~NG_1y)qBVUTkSpgpWAQR6!+zehE4DiO3C1_?(TR5lhc8)oS=w^ z!7g81&bDa1H(qZp5>^en8F6BR6>Ucv2qcgkfJBGHn2(!@2M>jP_%%Nl6lwQq6~)_c zTa`XGXF{AjV|xN7rKzbIxC$nNM@i{*GRB#>%8ngUQaYRbN~;?1{%M%X<3emuj_l%1 z{qEjH$RAs{sWmVZHeg`{lpG4Nts|Mk@Ad#VcRNUA+O!w(&!*to9bpq&ILS>q0)KRO zcMoj9kG4z5_5SmSIF2QO4O|kgxFqb7&w!uV=5*k%Iid@96{-CAQO(II3$%gK@$_BQ)2P>T3FOWr3{4fwx3+MC!d6b zmXMIpH$mJDkB;QU8v?QK*@!XWAt*t1cJWct{r?&D;uG%ch>2kUCt(p1c0YY8D=Q0h ziSgOWFX|26BR$Bb^$4K^lG+55i|eS6HN#z{BrgBBQ8fKWGDRo%Gciugj(H&jTkU*U z(aJkxhTzbTq|_86|M1bnhxSTYntFPI*{vQ*SvO@?-hR71zwJ*(cSGm!OrlJ?FN=Vv z-Op1gdWBjX0o~UIntB}+0`GAgc76SC_v~a10e!YbOy0zX1a|Mf$Tgt;yS-Tdtn_3I z0TmIRQ@xBf`^3bk*u$eoHJa(o(Gf%p|2EOm-agN0V?X|o^BSH@t|L`#wcBb znUz(e%Mk>GjNs;GJwo7GvaFKeV{VC+b=zb-b%5;yV*t6|8>H*J@CbhN=+x&G^M|F~ zCtl2rrFp?V69KpA*RCymK1~*~U_o+H-E#WEtS~~?ZB9=OgnaD23ee>Ikhnm=SZ(x4 zqwLoCp?|jD9|Z;VCZ!d9t_%{$^qigI7rC}m>1jf!m<7ME@ZYE{cfs#k@*I=Cc}`nR zPEYqgILV=GX_-9i@vwpi_#Md{9+wys^YiRR@0>R4*tj?lB>6y)0XwB@m3=gZBT-RN zf?uR#eeDgz!;k}?gRA@f2_?2Y$4BhRTgG&5W-@S2a->sdIako^YHSniX-7tL^5@Sg za1q2TFf*M`OLS(kz!&Q73`M&MyBk$ttnu2 z=mDE&JRr_T7^Q|v%&t#?)1TARdxqO%$xRvNwD)X6O0TS`8NAl?4D3{0&qWSof%rAn zsc?h0j#IPIX3K~m&}mhS8@H|mN3FVy@gR=l${p957UJvzq@Z|}fDnjX`J;ouvPPE9 z3$9hwMH&R6R+fQ$4G7v#ra{7R$P zM2r(0`x`fpiZl;6?bXdw?Qcpu@OW!Rv*qRjI(b~<;I3AXR031d+pz6BGyva_k5!Kz zy}EAeK`=kAf!6G^Hbs+hNMh?ar1)Ud_wTRQ1zuqnxBPM_aW%GlLS!+esO7#}%g@Zr z3=k^)8R&$0%NBu*<~{Nao^RR)oCNmmJG*4b5_$#(RnWU{uKjyStO0rSy>sV5U2pxG zeFa>JKkf{;j`dYQpy+$4fn0-_`%){V*y4V+-Seq4AU;4wU4w&ON1y$Iz5y;-oNsd+ zcnEIC!p^Q0s~2CF2;IQ~T&ShktC&D4(2PxcwM;)e5i-eif7m)89%{aF#fsg~abRMq zcp>tr>cGIy?rwoyyG{nGCaLWOb&t3lap=&Y|7cCz+}x_5&gKK$fQmHyJr z`ebqMZIdLF`}c3l!hbCmf&8hhQ)B&A15WC_+f_mQpb;cG4YU+%Tmhm?R_o_{7Wu-c zYSZD74uN~QEr3K3C)f?~bBDK~H3dgf%42~xa!cjDi| z`9Rf7bzf{L$N_?3{VTIN{$+*WcCLRbb~O}xd9CG?*6D9d5ux+9fD{Ii2JlDm z=|N>M+H-J+yH~5`!z1s5eE{SGkDV&Nx9vPxRYSvuIK?e+nlow^4aNV+Trhp$XNWf{ zYHE)O3;ponjILt?)f~wnXuwU1W7{D+S;ShxZ0+prVI(vdSfa=DKbm^lHyaL-fO7j5 zakwM^m6wplX?gkDZ-s6USD4_$3ebzpzr2WqypaOLt?FU}M+poJ1h`6tFHA`o!SzgYUA?;22q5^QIphQ z<^BE#zMTVoPR;$rj%oeAyKK@aUsqmUerlpKAk(mX9jI!id4s}%Hiw52PQRU7h7ZB& z)KYa4@#-G<4iW?vR7K2v!Zv!}?KbNsge$6wN)*zm`s#NG1T>)H#LJy!gwJ6wUI7!V zW!-;-c=WYv*9gson&F0ksSXiu44zBVFZM*9Bl+yIbnqU{sO)d9rvsU>ZU_bqH0o)D z8>-)?z1Y?B@PkuWBKmdf9;>GF)Pvh`VinG8+@+)%A?-oCu>ldgEX)8P_~ZdGv^x3?g3lHj(1??Nh&WDF)#NLH(8ItSi~TCLMc! ztyiYQey#iPG%&rLogKIfVol7GC#+ENR9*C~ty6i}u0AgBtc7!pLTXLG)QOY;K_jVP z{^42ag`I`EDzJU~QLOR8CgBDH-wN|9|7mBM$0BA`_Bya%eWZGsGjS%(YktnWHtHtQ zX57StGbsC(Zj#}KsQ+<=upR}L>yLw$xdi8p^*8l5n?y7q2amnmcsAi=07s~VBaMf; zdW*{W^N!u&SCD2*zrVRjnBQRz3kp;v?1R;_9fhF-vmEEtONbOiV67wOm(jy-#=aN^5KUT?4%s1} zo}M21T{0j^Ps!C~M44dOwhh?M6?O{vCckF0V7*wAPIOXgp2E?iN1@YHR#eo&0mgo3 z)R@CX;|FXIWb+1#rb+DU?48*r>BJ`_q+IAW-bl2euEbeL8S0!~GwG>?|FpzxzUjc& zBfREvtqaH08j>~7>*hOAg9UX}p<5UN8&P7V(bmrVz3 zlZ;!jW)o{SR5vxEV(f}=kAhK}gPPN?TJ;I4!5AEnsAd2hdO@-AV4g9W8OCN1GxC0g zS`a1URsV25>v&YOVU2;G128uyMJT_|H9RuEa| zncJVqh7K;I5>V~>K;F}$mS6V6*LP5ee-pK_Im4v?Z`D5aZ0j~pbxL4JNFrG~_#K#f zCqdnvB6CtiAg(22XOx~eGC$Q+?9gl!+}oh8-*A^rghzhk&NH7rgovC?`rh&SIuTtm zUB}D^+Va&Gi99hq4v*1V{_aB}BIiGQnRp-Ex^CcW?)kxjk$YtUoHnCf39qbL#oJuE z!vkZ={I^uKx9iVOl*>R=<|kqSA_GCRMEud*vk5Yd0xf6!m1*s<@pi9b#8axCUaC>m zsF8_P*eHRs6!D-eOTmmT3aeSvxqOh(W7`wFY(mvVq)jV~^~y=&yh zLp4h+uxXcuc%_I?lkjpTpsGuF%Kaz6X>#%ztCm-_h5?6n0(2pdRzE#-e%{v?0Y*Q*vz z|H%*Je|9bcU=!1hPe|a)1wR1I36T2hLvRsNh#5ebdGpIyP~)+;j4}lCs9e6BPH;BN zM}Uv-RAORcsEk+9)M#%sloG-d2tGp?PY_7WIR>eWSahaoEjNK!NMg#<{|2Bm#UK=( zt&tkJ3-D4;qYA9uB7O$pMg7EyTR>dT$yOsw=HXQh(I*)}?@dR3RR{7L`-8*mpzKBs zV7RlKmnypZN`4!3@dgAn9;(##_AD!HU9Z_ONV37D20}}VGmON;8lvRZfJi1n1%y8L zInS|w^rPgUX;Z4MR)KRmnfvOEJ6Q|4P>sv7X-{p^b5pFSs0fwz$fH}gl@Gcic$%(& zda5dtFO&BrW8*$7Mg8yQ3~I5b2Z{LR?L~$Eem6(=*2VYdc0a3I#whh17zOf_5_ zSyfs2%D9@naDHwYnXkw?uXiUAVkYKlOv13BgsHWAjE6h@`I-o7(g)uPQms8QGdtei z)KeRsw44h?!_ReRWl|7NK;;O`1gt)%r4>pt8}uEb`ik7^g^I{KJN~W1F88icI-Ev5 z_K+)xOVR8`JD`>EA<#lvR6_=I9siT^`ua+N{riVrP1`}F9D@#vf*M)4 z6Fw7eX%_IL4ueIZvF>Kih;4ep@9A{+NxQWiQW}`7im7SB-@kwFj>BKrL{{;ylwP@( zUDYTz1m2ROo3Ex)dcHMC#EO5Vroc*3um@1&v7|AO;t#82=7s~jOuyz_1`+^dRzq%0 zEt)b{3>B4UJUn_Icv#eP#u?h>4pl@&{}|t*CFkSL)E0S6zcMJLPtnd+(#>;t&^plg zV8=;>A{aO#d-*=G`QBO!1U!*TiX}V3{w{h7)nn+0gAJ*vL=vH z5R@|$FXfp4U{vT#dg?ltZ<2ihr|y-RpA6WvPcNBJaVXBA2QNnf_7g(JBB0g-_N_Ab zt}%WY|>>HF}@2rO*DC6S3*J&I}o7}Aiy!z zP+LG5%t+@vo+&%S5ms%yH4TVFVL_^U_AE8_bg(&U0Ms|vaJ_9(&gaq!{`#io_3kS!UBL3gt`%Ko{2q4(MUfATB#1icS$_V z@$XOhy&5l$tl6~ZTmZ*m2NbZAkOE0o{o7SFRbn#Q-Hk}n%!nh2tN#4i-M|a5egeCI zXhaRm7>GDk=sKo?+`u%7mV@Zs;}HG`8z4v>SH;UwAPf3aG;K}th=5x1e&bqII>kG8 z?v$lVLJWijTh<$9Gy_e80mm;{MrR6XD{rh(8`YIKz$hR`r94E(phu4!S^{N@yS%oz zpJuswdUk3|40Ml}OQ__PRN%n)UC*44$;=F0kMX@ag|I-pP&>=AmXy38wUZhpsmF|s z7tiZLp$=57wK1rRQ*0^n$p2F?qJ(8pB2=!yyum0~H?I4co08Z3bUO=b$`Bo3++8RK zfXRUBi}V3Y1buVvT#K?Ast7f!-X1%CoCSh93P_6K5>yOMazH{fth!9t1m-R?Afo>9 z`DKZ4>Ypv(=^*xH(^XYfK@T1%^LjssLFn!wbVO4#WapVD&k=MZ8eH!48=HK!uQ{w$ z>{*Cpmw>G{8|!NzxsP}~VKjJ_APeN_yBu8DKQbtw{V`0`tn$(BvX@S+**3wdOviv! zR_Pj~WyV3mzX_THX}V}8vb%TM zqCn%cd*9VAr+iq=&gux#R6w+>vof=+0y}7}=@>E?u@P>9;nG)g6F6<;~l-nFgi4{H^|Acf#*yM0d1-2@Uyfe@jnYUMd3ru$cV$jZv9CMKyE6*DFptS=12_9IiIL7PcH zB=^00R~4v=0JAv7Ff`6+=Jm#f@l-q!>KJyud$d`gd^vN__41(Yibg5eUXrh+ zXGhO>_D&TPNOfvxrKlmLDj~^!*0w2(jeq8<07=lbH#V3gki+9&?N8*WY=aU}TRcB& zgKGJf>4{umK7WqGT2LSEs|wl2zj*P<)Yzj=@j!2y*KE?#rAtXxa~x=)&d+qqIJR14 zvsHg-v(6S0;Nj=5e3GsV+kc@D?FjWNsX@z#t`=<>L>z(Gngrwuh5N*lO8s_Xr479b`lf%ME<^P|SJg!rH9|&xsg+_yj$JR~``e^FVfcD#W`( z;Yv_WARi^5w*qkT`H6d5cO$Qiev?;J41$1#!WP7**lX98k|h8-J@DraSsvK?E>tq% zhlK7CK_saEdv}w*(S6m)NmPi&-mKZjs@O39FT0qO`^sug$jbIS*0!$o+gG&E%dq3* zy?P)!(Ti`E>)Ka~X%)I=UiO%oac@XaJ`Sai`bP+ahEQ%j&&jR~=`xsZN$CyV7o^^U zDzkv3WPasmpc()pj0H?qhf_Mz~k3-s0Ll!1P z7WM9aRO4&mQ!rP0OoD&Mj%Wo=@5{%@D7+Y5RjjWk z69BF#-JxBIp*(=1kgpBPWWiD$kh~L7Za`&?L&v2nNGsPa79jdkM)TdPLm-|4A|e?I z$Nv#Dii`*K;sL024AYJir=|vzBOwa&^6>PKn1~f|n3=eY5uqCCH9e4x#Pe8KM1<6q zu`LWQ2EoaUjEqire@FQPbzOpjP;LHn8WCbM(TD&+n*i`B zv~mPJeYywLUu+$CJ|rmt*rHGWJ2_eB+8!3i~D?$+gu6T@p|H7J10%Y>a!}>p^ zWPhU}De(ykDj}a>7^pdX{?nF^-Y@<{?z>QD%l3Ffx&OK*?v?zxuG*Qk=cn zYq)eX5zz9S2568_c9=qJeuyrebLZ}xH>IYanr+oyqzg)c(r^QE8jpOFzE>f{9f#2# zWm2a`yhjuhSsJTPpBLl1UKE)Y8YR&Kt*xztc%J~+;OncBCwqJ5)3GZ{e_d6 zVh|)?F{8hWG@(HAA?XgA3v)L45R=I82TA|po`Ess9|6=uNvH+Lf$W+B70vX`jn!o) zNxxf>pzD)0MF`PB<|bDppw=9Ok;u!>Tz;{&*;VZ=n}o2Bf!2d;B;BB{T(^~!2<~d~ z|Bn=)22PGfk<)^dW(;KK*=NZ>>kFwF6~B5kZ9wKCb$RSH!HM8ejy<2Y@7Vf)|8Wue z)jk2ekCiNAe2;v#W}KMkaJ1r4;oB*2t^=;j>G6BC58ftNX+e@ zB@tlX-ey$C`~ewaiPS?{gOW8fh(44Fy%(5kwzOGH=72@x9#ZT??Jx`wD(?OJQ;SVe zil8@`_7kCrdDJOs;P1HpepeHBwBGc6NsnfVQ3Z2CeFQQco;e4|-T=~R^)*Kss?a%z z&{!e?FE1}70|32BbVXpZ2rwaQOWcMe2Go+WESsYshnyu^4*^^rsK+TNDpH~L12W!a z6Ae0jeD?F83*>o(Hy%`3TV9@4OQHe}Nx1xt0UT;5aIuG%xAmCSqD4+#1vrK@fs%U= zm4jdnx^|RKYM&pyP8%(q*o%E66^J>c5&6Jpu6?@+#v%I1sZ%}}5ridw`}=_XfP|=Z z0QP@fwUgjB00j2dwe<8V=x`c^7)t~|Ec1cTH#HFcAhf9h;1x~$SR>C;Y=UZF-RIcT z3*|JBGn#gGDwAqlTpSJ7ilRJe%|w(Lt3AnSRuRZcL}_43$KPLs08>*HY#t$N9iE>V zL9MJ_@jzP)^g$9K!2$q;gXd-ky(~aDi3A)fZbh?5%{`$a_esS?`t#?{q`m_U-3+== z;H3ga_~xRZ{Jcf5l=lUYVA@Ge4^>!t1L<`_U9`CJrDzZ+(y+rkiQm3 z_$HY`L$19^b-1KDiJWL96(bdSv?C!lNLqz~enpS~-*<8);y=+r;VGv)yoaEF!iJ zsl@BK4TyO_hdN>CC=YlQQd<>?7*yu{mtb(jKTTlXIxrR5sLLuw#wMz|ZY+@bN9Sur zpvJDhLQF;*wQbB$@_VGXNx; zq+=6$dD%2+y~H#<(7H}KyoiEG_LtNhV47FTI%kXd-v%I~n<5H_ikf}iSF{gJOo5Px zW!N%oP-BC%dyoKT)KL$(MxA1*x<u1Bow_@)t}R zQJx60gfg1LIEfKh=XPx(;DQtn&^l@)98wP*l8Cbef2*Q8P7DCgXyw>O-deZKeCD1i z(R)zo7W0~O_h%J4wv3M992)l19fDDnA#H(7mN#zRWGi={nHXl5@hnI$bQ>&G2h5U6 z>ijLhKj&f9aAqy|({2*7m3-jMXx>4s7?>X)Q@hV+}FeU1I}T2e42Ne^1xu!DOns#svP z3Z#VE%)r}a*!aM-pHW>($Ynh8{~*v1BLkW26?7Fe|`i& z2zATE^fPCTO6(z|5SZRMoB-N~C@FmHdV~O)4gg4q27*E;M0XOq(bF&fA`DUx)&Tvi zCr-2n0DX`Sc0zPFT!@T}Bt>I5)R5ooZrl-d`~<`=(xZl$1w4h8zxi>m`FQM<*{A16 zeec~&9l6g`gFZG}7_&^9Q1B4rO&?&KtLHZ@FF@ z1hE(lWDJb22P(^XC#QdAt;rYwV0zk04(F1Cq+?D3jV^F7qfw_9S}8Q;=vyd|B>nD& zrmArEtU98ze{5=uuZ0t6GU0$oH$>V605T=816n!@C+EChMD2H5BAJ5q0jnmw)Cp6q z{o;XEUqI1^s0m{iNY^-^#M8zmUNj)AWaNNCcb^F9r2nEW{%jM*IPKRokk*SXT5wsh z%Rgktdh5E?O#+gkY++4R=jUb#r%#0Hhe~}m7MGkI_$Puv5hRRUxUDni*Uz7($QTf3 zl)<2X{PQwe-N(ay$JBD^L4N*d0ofH#PGOgV&0 zxu^isBnXRCb=i^hMVLK$m?JTYr)nlf&Xdqi3M(yNf&k5S?eikE61G5kWcm??8xUR3 z<_GBTWBCD(4nVRog;BfyxU)-Xx(!_|-Zl#@?Ixomlo(8=%zG$ygZEFU&VV*p@}$ol z(_SctK#w&CkRl?T&F)lZ~zs9r3nek0#KZQT4LxX(7fE#9hMhi3WH zJu>yGeWpx)n;!4M^wt5=GTNA?p9Y~q8G-dN5FkWHh<>DMk!jsF^{V8T&IpQ#$e{42 zSC-AfXpTh-1YAQ8>aj9#JE{n?8T89(Np@^Wm70t}%Z9IBy;|(DcD99q35^~@&O zsXuEF)-KK}?5o$z-TJiDV6vgT9hwMf`1o9(cz&#@c&?#`b9BTC3uW5Jz=msJ^QWVbe z4H{@$ZULiu6cI7+ceZMphPSGl?U}Q{feq3!g5{1FllHVKX+$XzJp+h7)XZ#z(T^4r z+jVm~I(5(tW8yzCJ-uaZtWExaI0{uEXX4h(P2vLNTm=M11koSr%hE@_dyQXA*HF@K z>}#57v2zAUL%$J#PC}y-ToxK5QQnDY0QfGQG;~}gsCk2lL8cZdy=Aogv$0B(IJ2{k zEubIurLndv?ec+Wsu=RS7z{_lsV1T!=^~p2@-Izl&r|wfJfex-M?CZ|n@Q!NPw3+v zaA)9FU6m!P1h;MS>pClxfeNY4{h`hp95OjVgi-{zdf*voqUEi;y5|s>uy1v+5A4J) z(6X$S*Ojpj;pDQ#x5wviqBTyCJ=kEQ1EpIXH5V*8k38(QiZ@&IJai**n{UbR6@vN! z&AtheZlxi%#Xie|Hv>){7`b}7s4ABmH>-|Qxk{u9sno-;0WO8!K&+c4dv;U z|BO5iw3wWT$*vj-1%ucvBviZ5IZTnhL&TEB$NxNKI3wdWzHMu_Za3r1tmR-*Taa3k zIZLbEozuU+m?`a0I=rgl!42DG-`^uH)*tyLT2(piBeW?yr?$WER;^M z?w1=Iv_X4g;gECc>Id4ZxX7jIyqB!PWvW9<4X(Bh+=}8`cx%)l!zX9)Vh8IBlw^sH*syI6qxce1QdUrI9NWHC%6UDF_Hl%UrBQlHqfMaGj6S$( zMaLR%?>DVlzLes9X6JR=gHkmDWEH}&3TQ=QSBl?=yPk+vD42|0 zHh$IOBBY`aK%vmzTn@`yCHfp6*Vc80P_K%DaaD&maqEtxrKH@fHGLZ2u&^VEWs5V1n$S@&@^KmE?%lf= zEG;b;*4yDnUVi?PBOhmxKt^)668rhDKU`*GpnH{_y^QkjPn#d$oQobTvGxudJNvP- zXBpk4IaR4Q>w0CatOnfo`4P)e+P-MK0=l}orsn2LDZg7X*MyugUfftWGS|1m(a_;I<;C+yuqP35QW3KQD9-JRyw$~3{+<=h zo5z-b+DIY`iq#10z<{I9-&u4|-`0T>Cr_@VT)-QhQ3JhyW@onx6{}Ld8AKLEGOqQj zj?{@V`^oLm&SLP5`Y`_a|GK+@aL5bmHVMnGIZP!FG`a4`8az|SUO8Ci>a3d|k(s|f zH|L2nypI%kdydA4{kIoD^uU46ss6Nx!C2y{wYwLW+gMJSd5>NJD|j=7^80Jpl&QkXPn81G|w@Ck4v|6M~Qrf5Ih7L_O{nyDTVvND(T6Jvj)JwpZdo}3M3ZnpeSWrm__oZ^21KqNxO1oTLUH3~!@XIjE9W^xEf%aAR zeGhzmJ}M)gfD!NU#1XI^8}5{tigG_V#T8uj9SBS8cEm<BkC@(y z=Ijr~B2b~ON&d-M);>QsE+i@{+FrFIR9QOWq(nI4-BEnu2k|hubPZYT>tGjCt=n@N z|1+;Sm#;WM&C1H^-E4V6lpQ|u?)=%qD~j7?+E4QkbFDj7`z7fbcIelsI#DSc-_3!v z`svG;RdUMvg@v!3b^oz(0!!kXnkx9kGHX(A=Ytp;f6>s*eI1*NC*&Hs6?blwo^Gy* z%E;IVwLxf;pbnovxPyeAh^&M7`|c6vKe^quC=R{uvU~mAmTSYE3pj%}@ol{5HWqXP zv3lV<#OFj8eQvNBtomMn`_CQl*=tJiZ-4&e5e{J}nr<8X@hi-x3H}Oh;vZ=PDe)^I$UB@c9TDj)t}Enb6{jse>bj=heN0kN#9Wqf1qanZg2M2YoVd+ zXb^*sJb1vgN55z*dcZeZ7Yv`+1GHWgEPvz9oz(?1f2+O}xQKX8R_UwFhE-g;_V)V` z;Skw$jpdZ5Xh+n@vScGIHVzIBWGQfRcO>0`JG5+QXus!lYx|E~GLx$nVmIvBw5F`A z?0HlF@cSJB9jG8(wvPQ2y(0nz?;``}5~ z-|5q9$h^KnX46PFSRo)oy#C`w2IOs@o*1095FiblGrtZLANBGoW;lpRB0hEvq~`pf zcW`p5+;kinNlZ)(x$dS?{PoutylYLDdyj9u&*%H5Xi(H*c6Qe1MD&*o6GjMx0kyTt z1*p*f9YcAj>&0kRmiQj6SF7e{YUUY=+XKqVP9P8=I!;a<-iYloNcVA<4!E%2Cp}&0 zr`@4RDfTT}((SqwZaok+q0yc_>NE}AsUI8~7pcmBluCs$yfY9&I5?xEWPnDn3A7ci zqkyFE539yflPix*wUiK>VM+HSktD570c6_+$y!7KRFXu zmv=SUti{ahgW;h%@!9TUH*Ahcalq-zu+vVzzg$ImATmFHOJ`@NuSv>!bk|>x&u}F1(E}^&+_h^7 zflX-r3^_xWuEFs7!uq#w-#VkucnQTRf17XA^T^00;o;#qsFhqUWl?{go<4k7hLc2L zSFc5Y7k`G2`3(ZJKLnVIs6jdRr({zoun586HLismzEMb(FkrwLbX*O#H#X8ysmki= zyV8D!SH*?bn%-y~kd6&Y4vl-=Ib33#QGF;Oq~Gw_>JdIs#p_M|2zyTlV?Ttfdc?19 zBN47tbYkP38()3eU`&K1=enesvD@WtJr=p1ask=|mhRn~n`_chBz={Y_3U3#?V6iQ z3Gjd(7@eKHdB=_&Jp%(cYk#e-_Xcb=&I}1^!7Qr9no2GShc}8D3$xug7MWoneVjk& z4QR93Y71t$*YDoFlV{XHQb<&N^X1DId6{l(Tph=V>^H{JDdaov9ZTL14GrDRE*|}S zn)I=`|2E`&3o?HpQ>$ib{bS-%N`ec(#zE`uy?X|r-Cr^-HUq8IHZ|Qw&PAF-iw?RU zRQXp>V14*ZgqN`jxjK)x-}%BCcIV5b#{RJv8he0TXtXGeJ;$gG(W&n?Z~40GZEwLb zor7%wCr{Sb*O&AdWnha;1I~Y%nc4O(tMPSRK%QZA*(UO3)mHDzpxr@Y8`=|BUw_RdbHMTKfQF@b>)n*Qqpq`e)j0%w-{_5s4$8(>Ch}aX z%$2?uXU4}&Z=dHS7@S1olH7Lp1U~v>WOa%LAGc}^Jvi{wu@sBez zH8p)=zvbxdw@Yrnz5HgpPE_%hO-7w#JQV)&W9#Ipm%3tw1+qKZMY;A^0BF}+gRcg@ql6xN{*B1_)j@_`~ zj%-7*fG@W;^Xg_xd>BYvAH5O6^3|(LE@f!C$SBtB7Z<+;KtIreu>H+_L{TH9kyg|1 zAQ4m7yYUcj{M}|tX{!vrxFqp|ZOn34Utf6A@GHq#QE|2*=dYts8};`Od;7^Ctvb&5COeiz+_69&4Wq$nj-$nw$8q&-6-ED(vAxsV~c}`m$3} zN@Skw>`Kn8*|ny!$B(~NZqF}|ZtDMTm-|cgsBxy&ciV%;9{1pM4d(EV(DRfZBa^>$ zcq8k2f6Ww1wNCT?rpw%qLWQ*kl2LJM~=lX>XGtSeOv9HZjEfF z?9;I-2%6L_Unkv*Xi+gLiK-I(rkGDJhUyCOb*t#E^93pFdNoYr zqeoU@@+(!EWLSpf5)!)VEalm9TN`VHe9+voXTu$?h#F22(NCbMi05I|)YpoMs>d*z zfjZ-Z;<;H<1?x=Ho7i?|UL&7_8aBC|4zc@E(iSTu?D)OGG zc*fF_q2xjJI8qL>*pE<))T`}-!LNOgkF~X1pB@Nhk-J)L95&*zVO*wmlG$Lue)R-) z2A`+XJuN#Zx!E`Bsjb|{=KXxn$QtyVS#*pZ23v0RYknboyJ$Ls5kn2b_PnXTq*=nU z3`R7z=KmE^rOFA1+@R5XN)0AZX$#;)Q+l~out;0FcSy0|;Fx+3VnKgu{yH2I^tM!t z;qztK_p*5pAjSSehwk8X>{gsn5JV#N`k?4~c`K8<>MahG`(Lk=nK+7&XMkfG1gMx> zSRixI-q2aUB-oUxc6zmi55a36DH(0fo5Fr}zpSW`2ZfR4W{RmZL*hh?J{IYXeEaR2 z9)3lx>42IvG(AflkN8tL9inw1oF5*Iut&|X#)uGd=~k{3+P~i$Wj;|wb`-SVP`Lv<06Pw>A0lEFkitigYu+>W6Aim>nAgnq zV`MN0zHVc)k|G6qM!BbY11bR{nw#J32#{LZ@&3%3hZQ$KktV+&Eyb$zCMa;!@>{sO zZ=DD8@kw*<62LTJPxkB=6bXEk9rY~Pq(OcF4^}(lvwp|Jisw3lgd>Ml!=~QbM(YR~ z0$Y-@tl;<=d(SSnX%MARGcof@bXW^pw#DhyFBo4(=zl{bSUWL?s97 zx9K3RSYK6-kG&2M@*+Oj?+#MX$g$m?mzQVz{pRL3gX7WB(Z{7%QmMeST}RA1PCXIM zoMo}SB<-V@7F<(nD*DDeQ%Q1{i8-r7^7dgeQd!xNs|x^=N#3AN=LR$Q3gu_}#yiWg z0~_uv2ewAVyTF6{!IAx}vdC;-zOYVBO})T@WJm*uL1vsa=9zDdGmfS;y}hvijAW}} zR#;C^aU+`J6KM2QYS-^al}qXkzGSabe#bQmP63z(GeO_xp(oQgbHmEXc@lZ0b@j7j z%FLS8!+LL)DsSHyP#!R;vB^(v9fLm3#ZcFzg3m4R5pkD4U#$rE8%>^2Bnv z^Q{(lTB&N!eainiOHs?~dmV%=X)^@~jQsAky$*Hj%r@&ECy|+(dvU6@hh#0kcH14o zIM^-#9b#D_wSZRx{&5E>Y~Q->c%7(hwDP1&?Ja(0`pDv9{cpvA5Z~T@2SiP#JwN!Y z*HbJd`ThC^o=JDTTO#;)t#6Ii*~b?`XNf^N`7+LUeM$JWH3STEbMsI2^~mhzpBJMlY9ND=c@eM+5K_Hi?E4Rx8M4dcjBWO05pO`P8n-Oe|f*TvP<~P&W-rr zd)^`~wyFQ3c-RA__<${*Jq~%}q9sLk9>*fj-M82fRojysV3w)XB{bk9iK?)J>MH8_ z^UKnjv@_TFm0ml-b#BZZ7t#@IQtpP9@;#y3DpO1OJWgq87wQGTNoeJpyR-i~#+$J} zRq9qw69GB!E9DN@{btL;x=G|O5F>6^&O4;eY)6QuuIl~=Xg=dc_Gv|J{$!-O4yC5D$ER;HaUYlFdYBx1^Ng9nG z`~c~woW&}`xaFsfg~fFMEi8IX_rt4l5cxbj4kL3H=%pne8*-Kc(t&0)Y&o z{iT1h1j;`+{quR*QA$Je97x~ z9RWpkqS*Q$s3!-PKQR}7ee21rG9UB3>9Nh(EJ3_Kq#`VTSn$s=Y)#|}QDBHqr&8& zJ}QyPQA}hXA~ISBFbQhPyMx|~nP7BLFL9vT9b5&n>l+1~fSPGt**)@dsUeaM))asn zC@wyJC7xua2fEn7?r-4Wz+6~ZC?fqhiVxK_WI4OK0=s8r4g(4A=rR)C0sGipmkd&< zFl-%gf~n(hJ1A{4y}XX*po0Xq!HCy8ht_T>9-Wn?mUYP7)D(x6+N}9}m%<1DfdFqv zODBWU&zYSYR^tN8uOGE+&034z^zu)i)zTXgLz z03nS%;)agC&U=QtE0+ua$kXYZZ#Ah_?GhRL@*}J6rbXR06LT>?=ehIC9?5bG`H2X- zfp$=-ybHYGy|{j8Tt$;(*9ce~^aUEduIvkSd~!<3fKyecHjvbd6Lq4j{$;dj)vVQZ zqA7iDI{0v>7N3O_Q`o*J=1Ww+qqF3Ga6cshj!1H9dAahQO_6-`2!!`f@vOfid%xn+ z{(}d7EX4&542y)^m3sUo!Rg>uPz2m|KPv;3g;69#EBrxCccfX%E0#4S4{YBWq(4td zSqs(%rQ(z5TD>%Ny|sf*`H?hQ!G>?kx4^HuXYHjrc(X~CeN871-)ESP*Ob_wp`*qG4E+hsby+KDkp4Jo% zi45&8JREMnh0dHga{)a*6FAv+&mygG6ApQ;@*MWlM__tZd;GP4iLFnQA_^FntHH(4 z7e{A;a`U>P%|RQ7optCo8pQd$zHmQm@_e_8kBe~7{Ii;F?5|P6j-|&gOEN82mHt@2 zcJ5(jv&{J+;js}MdEj^7K;3tKP~h6(%bYN%hZU-hl3~?qVm{xHldQAV+iW1({4MaM zl=Y8QP6M|sU%F&c`Z*sx07+NDX3%DQOvAkHE3qU7P1!DgX9k?x`F56X0SWv^^6cRe zV5WysK|*MMKUf&lq=%8EJw1Gs_x$T>Y5c4VmFD#6lMK)M=$$S*dKtyu`m#Rtt53>S z1HpSDWAu}WqppV~BqUzoa}X&ds7XfB_@V7dNJ^4`mEGDE^bQ;({wSWJ9(c#LK=tWXa?vB~dydO62iwB`7q2#HYnJ@B;P>jTA;iaMaq$O(i*r{e=(*i00BI^=JxJI~@L z2P%kcUp2-daEd8tGxrBt@&_hnxd$wq$+tJ|ITLM2qIh52a;lDgCaK0hfj?q zF)(=d9)FzJeWkC-s&C#`F-0xWl2d*1&~TyPoF1EwPdPy<?lf}9Hj3Om`YMh(Y} zj+|>YRq`*j{E2uA{r$fBZ_-{3?P>z;3wPQfh#@9`yyT#%Y$&(JW8K=dYZ0}b(Z+Zg zozT&_xh`cdj#{1>|M&0BciZP^(BnTsusJzET!16Ypgxe6PQ};NsXg-9-i{Cp&W~h> zNb-_)5}Bjcbo2=e2jzZEH`5*2I9)fR%s^+$%YwUh?z|_NA&dEa(1CII#u~1W0>+|a zG2rkswdWP@FKuePu>W~(E}L-%8^(m-Mf9seS1|xV_{MK1Nu+2P_siyFo$FASc{V(_ zcz2apRo6=f&SR1Hlm8-+L1v`xeGTM&Eb^03&D9J0SuaUSL<(Oxq{kAh@iu+Vs;~I0 zdZx5{18+xPERsZvW(18~%F8_3kai4x1^6%-_R z@_~fI#3nZRt)RQU1dTBz>P3H9zPk3O0PBFFOw9D0lz9V%|Mug@k7?b?nwc5sU~tFV zZbLlB@liLa$)67?T*o)oviI7|{jx!Bf|iHU-q7dM`zo4bc`s+q;jrIjoSOcQgQw-! zR;>BiF!w|J{DFda73LMt^T5eYu8<9lyND`X8QYFt2QBNzeooXMg9sncWHIHQ-rlP; z+9`;iIOqPVfuCD-eM(cD+gkN?XCtO^6Gcva?tLY-82}Kc2yWDLAJ^6022~Px^Lkv| zP9oc)|0>I5V}|*=UvoHAL=9@hNA5KkZuXPoc_3`95 zCSX0b-P+F_LWN8zB{GJPN&}gROi78%8RBU$CNh*Fb3!zbAr+zw8H-AYlJq1(gJgPC z5=CnNR^Gi2$Ns+kzSRGJ-`BO)xz6)kYehBR6t9V3$85tB9(TfwaoILnd9735zJ09& zOu|g<7Tp}me9{r^uKo~|>+bni+bo&I7tME`*|O2zISgFI(wz z_Lg!$lRBdFbI^@QBQP@v&eYVDdo9sL!?W52(pF*2_K|*pikU4^FWgdfXjoSUqYB+A z4=#D|qzcv#kd;f9dS#NX*%mxv5BiT#{|Dpcx(_FON@GL+C~X-g2a0b`QM`m19xqpY z{rdGj9+uto%XF9&9{b4KYjalFAli2wI#KG%y|)j zWF!C65fM%4h8YgM3=u)?Dn@d6znuAFO+`i<4tpTO#>dZyozg1+ z=5A4`*1h&qPEYL>a6I#)RE`2ZP#}pf#PnpQ#11eqF)6&n{bD4qb&*&9%%8i?eo}Tb zK6CW}P8B11&y;Sy-oqz>sR)Bv=4QYW!()-kXx}nE@uYmDw$|H$NegUdbXyc_Tea5O zI;wte;N!L?tsZ@fp{tU-`mkgRDvlHGsTupf|M-#SE}dZ8djahHOW*?|pHW_q!|be-F8^F-LNo_k z8i&8}t0PKA|BXiHx@=lRc^=bucU;Ub3SB~Wdku|4=hu$(-mEwbUgjya$wGaj|H{tK z=uLEO=Dqb?Ln9T9y-g0!aqmf>wX?Ikh(U~$bdPd!HH4*`kkHqWPap^Apk0t*lHd+VBf%DjaIt%E>BPPKMUj*jpIo@Tb=% z`WsV!H?A-IW}lfC6}X|`lO-!x;%gC^un7;DdSg~p&z)Q0hxvmey8}-4Bt~{tO*8W; zTB!W?bJ&wZiuE>kbtvIe5a`7wL2bl&$3vbBpf!jp^xM6uY{0ZsodILQXZF#sJ^?TJ zuF8RS#dEi45P;$xMn#D%lV9P!Xw);yf!6O`H;wGJ|7;(Xr0c5bqpYoS!T@b^5x#lB zG2ccv)QF6nPaXj^f$Y~|1E2KBF4-75)uWG#-pGKL9~EsL6~&mqAC9xOh8kJ$<{wx! zYCKZ1!Lb&b;vE`y2|IfB!iARTBm8f2Z`!D44eP_s(>}DX7a~t5?;qCOvubgujN7#C37w zCv%FrFNF9(r(txhb7|i2>R0i9W@W8dK?9QK^bYIJM)n#)F%@@9-xDV#F=jX_B7;13 zrlqAV9a8=COU|~pbTpuN#^rDCbdmnLlPmo#yI&#%RDTaQPZpMqV!+xupC}FzC6d2=+bXZtu4{6k3pvJ~DG`-%8k*i#7Acs-6UGC@a7d)P>U6^yg};NsI_e93rX}XdmlN zKN>V>K+cGH6147#u4+@Gq)o1_s^s0Pp2v{uxRrco!eVvGE00_UAc`6sTk+CJH#V^C2#CN{7yjlyUGF0+wA`=z4MVy(0lHT68xB8WX(^W&LK6Z7 z(g79}s8HnE0l@d6q-2bP!`odpMaJqaq0x-o8YoC4PgT7X_yRcyh)koJs0!Q%R}J|* z-`#JkpL4qQ3iV*2Ur+9PlP#GW4yP7@R+RUq6m9+noBX|^BHzmMS8M9+dc#_t3mJba zWTf|=tYxD(Ww++^lW>NI2Rf@BUN!Kq^+1)y+P#{cd9_MIT|J4}Bs(3L4=3mEqvWoCJPJFJcco4bv~+zfA|^!YzSN?Hn_cPSE2K?hgpE!1uI0N& zYK!-3rx=4U)i?ZBb;~K$z{F%12H3)qny)1b`>QtdzQ`07$R@=iSKF)Gn>F4h;;&@v zyq&!-Y)&aOS}^3bRRCom^*Zue+Z&Cy4Hs@|Q!r+a`ZQ4rgYdPy%4GcM13|U=$F3WP zb+avUYNHVMDKZKId-4v*DYIQCTJvMlxPQ!Z)u z`jOqlBStfC`BhbaC$8`WVN<&OQ~e%t!kt+4TDr}vu2W#Y;K7bunFMq>8aPP0eY?c1G6w^y!Q ziAjFCfw2WUK(hsRn`kD9KS_?(-q!s0c0LW31F!1SHzrmR7vyt7Ct0~c z=gyr)`YyVU4=a8T5ciz@b=4VBZTTMYmC5}g?OZ!A-zf46^JMn;Xt*n4#-fJsN}fNQ z*vfRgKAM^Tt?3#(sStFQESfk9DeeGd76i&Xnl2Mk%xhfusozXPul?Ni$iSw`LxZ>! z8Tn}LshNGku3fXax}+0K`k;z)I$M_vYL@q)5A;@jY(Z#hBen4^ z?Bzj|wgKc`iSxke_-H7x_&?DCB;1y6>gAU_HS3;bwSB}ni+X!%I>sM9G$ZWO$jd`o z2dtd7Bf+NHeic=!yC@OtFbMUB9)=CClU~&Tb9Cpo+;VMZAIOQ4&yV^`8vI#D!Woa* z;ZUzvZSTg$Da334afBm<&AD@Tj?{KN{vE03uPH%gZwgcKV2zM1zExH4vbkIz!rlw% z?btW~}o#uDg%I4VN0fGvg@^_2uo`M`LQ)&iCo!q$7%uWE?E`;KPifvr2{ZPbf&+H$H# zGb(-XB=qLf%*<`vW%6szzyBfb#S{#8TI{!T&qur2JF41n4oOurjBw$L;}F0+^YRiE zFnb@zcuJo~h0dFjY8!Zc6o0)yKQw=vz9x!$z+%}1X*H2cYx+J%L zTduvSCG7dhc*Sf@o$3FVxrDba}EZrO@y{npWwOIA;z9oHoLfu^N z4ug=`62)#a4pbCQlKpY27wXYJ(_4kM_QNTsJ3!L~L+{We>F8!SG%^PIGE_kw-?Z?~maeB4N;ZV;9$!%wb5d zCM}!?{*)zKe4MWp?kdfwci@!y_pVp0_ zk?vVDP==j|%Zs>)ql!~r`8?drTaMSv>#jxT>R-iBaO>BnDAHscel-_tD|vyAA;S%h zd1ozaGw&7hEzoPJg~~x^mF#@BVC;{Mzy0IvBf%oe;EuyJ_8l*CnP8U zN4RRG{F8iI1n)7Sb(fg<;^M3VbarH)IllC$(ss-S z@^8oL^hW}Qt%Ewn82RAGCV+%%OWz|?bQaG+BV2DurL{a;Pk6JKjv`OXog(uSjZLud ziA$DtilCM;i<`CXm3Rg=#8$Ikz<8hvA*q9_Z=m&jy#N?s^Pw=u)H7H%`lxZCMww_F z4p0x%o^<(cGjEG;FSee2q+GH#Y^%$SpBgHsb`;y#2Fx%zcJ|xRF=a7pUwN<1UnR;M?&I^fL8 zSkh+4$oc@jN#SlUx4a1pu=CyW}&&xLp#T|LJKUV&A!g2E8fCm z$5fOWU!o3`xiED$iI*>pqZVMy5&NXV9;Zp0zMs@g78Yq&Py}XBU)sVKAPCagf@Li! zXlpzUV(Rt+24y61+J#>bPdbYxv?2E|F)>usB$%S4&TDhG2%JjPtm%(A>*dRrX`ec@ zc5F6k%DaH_fTYH2alGoN-sSY6!tg;a;^vgfPgH-!xRgR{7yf+@5!e}zpcIj`y_zOm z86is$fDdGbV>2d5++)(j)7;!Xjys;_?kE|hGWN--7_wfp-%f*!sZfl(4+NBl3L`K3 z(oTeU22RIK3uL)Vfz2s0(MW-^*z0b2^R?bAqobB*I?Vc3FSC_byAwMeF2q1;ZQT~` z49vm*o;z28@JQhRqspxYf?za4;dpe1H;O54%GDuG*j@=uKyz9ODf7YD74g-{WKvogPxr>_JK ztT#X^H+MZqGVq@imefGBA9*v{x{)vt)V}r9mzDwI^qgK?tS9V%u31@Aqjo-%THJiy zl0UdC4;@m&vTNV6l6mJsn0NO_uwF;=+eL{hw7OcSPzitgJz`25e3<+ZS+xE~@^S*- zP8ar9jFs?9_n_H)e*9Qt&xDrZ+~dD9$4#H7{*Rg868~;B_Bk^qUjDo@c|L|uD0ziF z4SUL5-XKKM?>~QbZLd^c0j{U?ey4xb*Pc04Y1_x5S()8YW2H@>HYSxf*z-6}<;1>q zCMu;u;xJQ#ctRWZ!FV^{Vi@p@7cYEay^zB=!c{lDmYnYvIq^($)w&2%=L^m-L4p4^ zLR=L8{L_!BS&oT#aFCRc%`eRia@jWG@~0_ngiYoTz?1`zo*X~Z2#AEn5ZhpPdT=UO| zF_%a$ty?xmTV-fs*IDYXISO%kTbu8>K49s!R~Z;T=|X_ik8bJNZ}>iP?dz2(OrgKX z*a)#6i>bK=2|17H2gwNkw8MEp!r%RGP2q)`UyqhA$k@@^VHRRCO`2JwKR3{<+^lqZ z!-frIG>;0Nqx2TX#fql0_1fjGT$|PSs^Uv%oNBw~Xg3L0vgi0oUW1^SJ0Wbn_NLLA zesR8YyBGYdSN40`Sre6#SEL8ZMsYDw+hElNv*BUK`^gz?tE?(k?Pqw2fc#$;B&tcMk|nw;8On z`qSdr7nRD1k9uFZcC8SjLkjp`tePAz4muDXyu@8*?yM+sS9{IBa{qeIKuf9fNgnj% z8pzdl%86-2ChHHVM3(B{pcxR`N?|VJ`d-AjbhVo`ONbmIIO_I;W&5knEbS{#6F7;zrOEv^sc6D3hOc-%xD(6@qe+OVV;miI#ZA8M_M4@>qZ(3cfM1oFf!sp2 z7u~|9ABRIW*sS`~(*jte7oA}4oTng^X!Ym#n%;LR&j0i9 zQE1N9H75u9Ea}>Fj&9~stYW2}+ww;B@BY$u=j2n&9>v=dnvURY~DJfYeab`83ZL_ii0&s}Nh#h~VGn|UvMFtyG{K$_YPCtr0or6!?? z*=8b*Xe2Tk(kY*|*QZaPIzKL#7Lnrabxz=tEpaiI;8}qc+qP{J3r_q7h(SsfnO1^U zGV)|b=e)?+wpGmtx*& z@UpPX@ayfLbFTmRIW<7v*mx&Dzlnk~L3ci7QEcR)$n)n%fj1COq!}xBRpvyI4>vIs%~KE|@olmbI$8>5$$2ZjP9NKrQF~ZGGbU zlf@&JFYk@6)@oB}gKCmi3Nt2sm`2gD-RxB=fRc5&j~W>No<3)g)*CB$^~LH9`z_9* zdgX;dxp=l37oI6C98&JI^x;izS?cJourJ^DtOf=$2t$9j@x5McUV3yp*9CY9Vc5qu zrXdfX8bCj(^?#R%USiId5%ZB-e=uJf*((tuuzvj8evbP(>=vtN*qu8yyQ*#L(tDFS zc-Vo`oHE)-=N3dWaG9Hi=kz|)YsK(9Dcq&9bRNIX>Gh3@vxR_SqfRGdPVYIZh^{~? zi+OvkQu7a4PN)iOhTMqM!~J~j&K2tB65&zUlsUQc{pX#T(RS6!-T~vGu1QmMP@bNv zu65QnkwzOh>wK@1h;$;qybXc;%EM{z!<5Ye5_bZf$npZwqG?|WX&Y^ht|C`X`oUb@ ztS?5{Dm3+J0Xq)tLjkI7PIzFViOat>**9OW6v+WVOOQpnd0(rd!vW~1SOJ&dA9dO%f>j2Yb7uSGAmcxp3kHYEO4f)%XO`4-{H3zx+Fppx`n+vWjQ=UH^F}?GS zlKqssb$7+yx!zx+?G|L9FXt48PC87zvKN5A4ldM%2Jn0|7$Zy?3Ic1*d1a-zj1=e= zCIiX^s@rr~i;bmVg2OLW8Ez%*l$9BKH|a!I>KdysW+$1)coEPqG%3sE5}>w;JxYxe zr^I#?{_$iSJbiVdd36H@A8y0+32*GY&iIKf0Gx~p>BrwXx2r|tZDVy*j~qFYK$Su* z;LKI2Dj$1!LK{t<&CxUXQBMMO;T3R#Esm8(0PN*|Kv;lZK0ZfFVd3(ADv=5aVWa%S zCM6ACa)aP!>L6-pwHenxX1=%hpI6?x3?P5=6EPqEgL)qty`V-27x+MW&9W(SHNs0M z`jGYcjRZx4cK;Qty%mi~Jh%WjYJiG!KQQR=Dy8G;ZAprBoQTX~0q#W01Xg*?@umgnQWpvks3*8Kb)kX1)ET)q`-`uvHv}a9g6D zFd%&jw}w9*oUj361dR&dvk32W63$fGUnT7_nt?2QsIS)tuk~c@sBs)(PH>%NSc%6( z!vf~O0r0Anyi8Oi-rxd#P_G1;4%*bZtq;_zwN`NZH!CmAq|ZbQ5^y*8c&x3tD?HjV zhV|#8K{j@N_h&5~2}0gV!f|kD6`r|+;eQX+!qoh{&1>ZaO%>hs!^Tk!)p^T=IWRFM z@VGCwrqGwrS8%F$un>+5M&y$TQ?B64!|e%4zSlihI#^47CgKn*EE9ts z4$heu=gPInL#gPuHp4O4M(x>#wv=SB{Uk|@!$MI&6(&Lcwv-N>%3I*%u{FqauKWZTh(zhj6yurb}rdEB(&{qP5AV< z*I!SX$v{HsLJ76vHb632(8_aSaspFakOYL{l0I`oX9XO)uS9o~i$am6j^O$B7vGkm5RbLLEAM(hf}BL~;tq9E)#bR%uL4eM{IO@Fg- z%$V85zcoG2q@9|mztq3wxUrk}4O2a!yzEr$R>hso+TDDSx_b8QceO?NP&Stg=vSs?~IyV#Fz>p8h=pfBoKe?E2`ZqZ)1hwkaqvqtGMJ!%Sm) z)h6@k^x{8TNY57uWR9=>!jw9f1kcl~-kqw&tQ?acbaFaET$4<9>Lk=fEr zlw{D2Vv81xvK+a!h0D0_gEkLtuf%dyIS#C&Wg7hgy0p?VA6B^j)1~P!FJ%k+48R(747rgaVd=7EVK;6ZW!@hKnGw7PyYq*bYv*{| z(c5Cn_|vY9)lK~dnbv->9m^tAm?LA)8BFFJH-5au`5C-P&EmA5%r9det?%yLtH1V9 zQdHbGyR0DQ>9Q-_nyIuLC=K1CX`aU1IG43+bqx*M)4Fjkpk^Zs*zGxt#dB16@Z`xN zCV`$heL925mkgyFv1EyONiQ6EIryZmLRm#c5lgV&2iVN{*j9V?5{3Cp1x6O6)#60M zE(HfZfBfTu8Xg%L*`r4fvC*E*TE@q5pS?Ub$8h7XLF_cK3^op6*wSvMZZltL_8@ny z8q7q}qU)1Llh&~COrw&v8y+Q8RBuR+4mmJ`1DIxBVrFK>dz{{@Eubi^rmKdA2A7?u zzjXO>nk!&SN-HY5>FXb0wE}xWgBMLY85YJn8OGu0slwx)Hu`()|9b%nnss^ATAuwB z2r=;2<;$0!K6_>X_GX@GkjeT345m3ZqqqC*H`hBw7mplcRajc$qi$Mzd1fCd+01|c zeP3e*+Z>5|CwxMbu=VFc`gH;7dkrn@7p)b!lFJiztR+}YAhY>8*kgfT)dis z+GxJ)KGn|^Hrx)<4N&sW8IZxeqEz;=95G(q3k@kYDqP!ZT6*Yb4byJT zHn`uQ38i@Hezt)!cnYfvW84N8-#SdsW{)0JkiopiKj?wvqM^KXNmBuC;pA_eRhpL8M|=U zxN)MYoO`%dlK`%aDca%JZ4#BbKTIqK=+l833OT{*stxaL7mj>^*M-d(jr zhjFV`4Z;-%%iGj2scqu2E6-lPo;Ye$BZjqkkTr4AJgjnGvgCu+p{t)FR(SGcC!Pwlii71H_IDbZp7Y)42?`OFLj+cQPyM zPNvI4PS8{vn_`cB)vSfFWm`;n1tS-4-M$^%{8sU-ca11EpaLu0S1>Bk^5~!)jFQ6A z(Q)_oh*kF)zexO7 zH{TS*1aGFt<(sVjQc_|ydGgb}n>>G3&RhR)$c9&ph!l!xdn?U7qfctFedEz0fP!+n z{SCYDi1eBrdor4t2Ds7K3b0^M$DV!qEW|dI)+C9bM^H{Mx^3)!^Z@e*0A}w0onl?< zJKO>bX)a7kPChXss_ff0ZH_rsm{gN#TAM;b^0dv(LqC05hVv;IFN#g^XLI|pU#d)b zX>gj8!tq@-;5^-Dfy`sp6^)xTX-&u>)eAIwmHqq~e*E}mTn%n>N}3LPpB`!j{D8|c z@32|XBGn~PM zvW$$o{Ot(pbf9$Fay*yZgR~kK^VPp9eU5da%)ftRz=8*lACEjeb->bRI*yteJROT_ zebvo`w#ppl(8hLfqcS3!$n9VO4zJB{{Wl%wt0RZ4TW3fJPfOk(;sAg|v7Qmt=(ts= z85hmC)Bf-?XY|?7KrRg4-50%Pwt=J8rj`H+02<*DD8D~6G@a;8?{z|EX6xOf-O{#> zwfaCEzA!D0S-b$4Er_w z1$Rah7o(p$;=#cRSuY{cVR75A@cF~&+B}HeBt<+{#p_+5@;0VXWJvmN`8Jx}# zQYj{Z5R>4yC{Y-Iq@t|6+2VxrkJxQ)@u?er`BP&xaNKr~r813`+7Da2xH}7+)`X~4 zl$Gt@P>+XJP=B0)Hvf+-$h3DD(<Tt+EP3$oA-~|&s94o@w4F?w zI@My?vQO(BuH`tLn{)dpyDRv}7kV-w!jS=S9!voxQW%#s$ouk^$F-Y&1+(hX5e$0z zz#Q7|M#|YHK8bh9-N>>O+5zN#$DCB=cT*=hySXKjH~RI9F5kY*^q4k?8bFY;>`Hy- zl+J4$G)ihu zgj|HyEp#?~x@1t=_IJd%E+!^HM0LLHjy-!0&2}n?Jd?GIfutucUp~k(HfQG7QCc+$ z>f6fgPH9;9JMS4$-OS8Fm@3WMs~YjT~TAP-Vg7o-IlF`D(d^K%RPIV55r=raN~1syYb1r$;E z5}-x{b9)6KIG6eBp2i!?H$*Hsk+Ed#xN%zj`t4;aHM{L55W1->0=`|8G}nqV?4^7! zg3wG10d2~t5zb?fp^Mb{xL24?oWd);o_Nl2t)12N(2zNr3Ty@9eeXMZ^btv72S;bn zpf=|0{?Q%j71xp3yMjqBTzJoa2?OIRAbiG*?c+~tvjsNj+YIQhlNn=WiWQ?EwZZ*> zxlFcKGRCj;=g-6X1F}K%NmtUG45r!Gq+o_iqqWay&6oC6HVkAemfp!(9BVXT@v=c3 z`K9eyyw3UurS|oYMc_;QP$?NOh{eIhNDu)9p4cw>N z+CIcEOnZ5YB%Wt^*eidM<$}*GWKCu6MvQ(}Ei|Ha5aEk#Xc*{QBk2TwFQ2 z=x{!X!-ow^SU*IC2m;LIya0vszKlLavnBg~lI7+4`Tfptoh3)*%B1?rpwCI)zZfoG zvIL8ucVWujX*>%eD%N>IFj(9Th}+2X=S=%x0_10rO(Oi zOTRQYWzZ;|UAlJ{q{C#;pymm0qbvF*UBM?9OzfUIWy)|DmjTQ*Nydynz1N1m@9yR# zOPdj5#^{s#rLjv&?OnT+SoyV!9TBV)7$4tM>q2urKSPmKR8{XWt5~dpw&DxDb4S2^ zQ4zM>d4wJ6lgOwj@X<+n{Vr(SP}XZl&Z95|YASUy*u^h`hN59FJTh{pL^cMq1F{uL z%gcv`+aKDyw-sOM=4!^y%P7VN5CVuH9d}5cE>|f??GBxcRjs5$5!6hAxDmM zN+|uZOs&|oUJRaDfbZu|Cz`t03Ob!UIYGb@D=l}AKFLWTqhPlou+Vh0VLGzO@Rvs0ZLbAnDdD=RC<4`k{$z2or31B{{n$Bi93 z_iOHTFrP}hc4NpOa3#-7rr5Wm(5BD3x+>lC{Xd?+J2_vi7h!katk{ioMJaWLPr^`U z8P%oIwrw&cl<&@+#{X9TRCg8~Y6wYMxpJvz)!>;&_qs68^E!Dh-_UIlaxY7YG~ zGVXz`K4BoMXPrj+dM3hcUz*8E;5=TDP~{L4?8-jSke(~cmFc@H!qkO%%z#iA^6mFv$wO&J*JSoI3w=nzqFAj^PIUe*RW z3Wl|}uY1SV_c<_tW)6TbU*M-jw09^_a2u};9je~4*kvszz{ciqxv3;C_Dgjj|4_um zBu=nj>)!GEChjgOK@cOY8IO_?^?iiZ+$H_ngMk`!(be@KABHfDd|ZPmE_W%n3hV&{ z9{5#m;fh0Z-p0~UoU&|j;V`SVX~RfJle@Xs-LP{wS2%meeL{u@D+xj;9(er7am4FV(*Tz+Pxwwi(+tE`yngUS!)M18Ry!ppjS7JjX6uS4<`Gyi>2)ZU_sTAf)bQ- z%!$7*bMe@YIo@`X)~3^8VcPunIk*I<`q?C#Nf2iJQ>^{hpAGh45Tg&L-iNpG=B(W4 z%^F8-0|Oa-<@RW~6lgZu0u2kAv3vtft$?w}p!unGc8_pKG~OH5 z`&9n=bpVzL=7Sq_l56t)bM{`g-PueUr+Andl3_$oI{3;F4rB2Ffts5tDt@TgSK@5= zf&Mrr1OK3)$Bh2FCk2_MrH+wNj`u)io1uJ!%B66nEPF1+ap})EzK%4d@!J)!ys~am zdUpr1A(9tVSdh`orDFL%|AdEyZN-baN8QMR)IkE|#m_f5#zNkY*5j`gYeW!Y3}5wo zM=7pLY~o`Qup#*Z`j6yhwjEcO)weQR3$SMhR$^tyiL+;Y*~d}8HoM2=G3ndJ&YIN; znodVoci`Lv1?ZMhjD&XE^7D7Mjb3pfU+Cc5BzJCE0PRB~{Mln+k>i zGT5}T^<91sYL)i`YTHUV0_aYrJV5G7e*0FF|8d+g+wgZVlZ`3pAdK~wJnh1+i$pe{ zj2%0+i-Ezv$pcl1NACU#eD@3TP%*`ZvSniG^yx_oX%Xo9>}w1 zO#TzL?urYN?G>xOny3}bm+#)3rxS7hd=XRf3t0uF-M_zb!1$tDP1xV_4o^`5^w^>J zDDOC5clRdCuGj(E1OWpKPG7pTAK*owDwXv*clUxiILu6iXY_86pc#t3aM7Xx+*=l^ zkDV~VKm9CMxA#`Ly7~2yUf@N*chZSTtE$*Hqq4>i8>Y}J;L-Y*C&N`@XGA5xejUup zO!h2DISdgZX{b$`cLg1q=DVBfnh856*%Kimeb%SQ@Q~FcC_a-TH}X_?cx!d_FZVM1 zmIuCG>Bv>j^(cQrWOUgAEuV99Z9hyX-5fm1yki~w=R_BSR825lJPsbpHoG<-TWBYB zn@V7zltFYj#cKwIpmPqR6eR^hqUC-0X`jBs4xZ2M{QIk~R(2&OqFNjX3W6Sr_H*pY zEq0fUWFgqz9&cZdNC?%Xu6(1lt~?&G=(d6 zeVaR4C?NUqjbfQP0!Em)X_Hwq?}DKF@1>^t3ladOQaFs*uB63&sbw?#CVb^KGn5Zs zAqeL-&)fbuF+3J3l?OHf#*dmD9~5B--b5+>&wu~GIfq60^h_GeAO$G6WaNa1sHg=H z1nQ>l2W2kc)Cjou4;AVQF3kj=P$2X1*&x(~t+2ySPX!wk-wPB@Sfh>$I6NFV5W@B( z(g*oce0t>d(jPzWvz76B<+4jN5%~H1_4ge+mMYvW)Fi(}S4XEIg|ypNRjms)awuM1 z-5t=|CPsSbs;ejWXp`1j^RI$K<_I*~XpBOlJ7maV6cX?ANZ z&iJ#?u(*8p>y_cmyg*XHw@5+UiU+DYaG*bg;m0C*(=ps7(54E11IoM-#|hiQiU4mQ z8D%xKf0u7zW>O{=$0v)s8W{!R3pl`6$9+0>;X)lW6xDT#WevLf??6A5$uX=8v;qx} zKOJLJ>H=x3u#(aLY#kl3a-|+kV9&aaiSy#cRvXWV3ZSf&cE1|TD4n+59p>cJ2hNEi za3H&-#COD^s&}7GG;?_ksFON8Ynd(5GPO0MlKs)5cp^>fYU@taVQbe8fkg&H!urei zlvybleY%E(gv9h5MV#&ij^Rj;q_kyVF#MA3t#t#$H%e`8+x6$~=Fu&Ew!uOZI$2`h zKQJ&*spBADupq3wZnyPbhI2AC>RLGa-Gc!y7sv9bQB6&ma=63U*02B_B4 zxE}Y0^OTf~F;a{|GpQtGKe_LY9e1BR*-f%x2lEr!B-042M4<~Bk;>U3I?ag=2c^SA zVUSE>DGP2hCEvMYm~<) z?8Y1cIRoVfdJ1Xn{$0IO6A7g2XtL{|zfch&&^obQ!A{3(uO6nSJF+ZEKoAtc$r(`_ z8flu|-0bG&ww`Id@|O{M_+rYAbzh9FS3PBnv9RPbXSSym4vQ1S0Z>riit#m^j0+lP zl(Ww>MHLUR1bHZ;c}($Kw_!tTRn@KG;o$?72GEpUC%KAi3|dO3Z{OXJEH+ld`8tCw zB(YX{tG8@I?M<8wB#lfV&G1|ln>SBPNeRzhZQ4B6l&0?loI_KhvKlsQ_+V)(txfkJ zMBvI=u&G1*x~LLEQ}02m5UpqvCK#6?!n>l{Lk?(%_I4SypM>IP6`k!5zX{$Oj%16p zk@m(a`p&Ojv5x7qu#FzC*(~1zU4(Z4Y7->^wQEQD6;L?!HgwwOE90C5_;nhxhpVK& z^x3I7=`#epr`JW(Y9&GcXrl%K^v%*m26R!Wh=s3im4Y^!XSRE3<_3PKaf6VkD z#woXMU04vP=(310RH6nF%Gs&eN&%u!V$zc*EubX9i`m(SiF^ZD)FM*RlR?RCC-Cg_ zg2~HxGNVgr+f7~n>*}358k_f;{qmIxMs2cpoCOIN1TczkOP7lR9` z)GBm=UlPbna&hz=ne$E<)8fBDV;Hao#e+3gmss3tR+$G6x%C_r?407i)!^#Y1lSa^ zH9cn{cyuGEy5#nMMx=`(7sZ3g8wQwwuL_I1qY_dHQ=aOdqkco}t<`TQio>Eu;)7QM_X>#~cz`YEf?WLR5Tk)(!U$7WV!5&2b*6 z#p@Z?UdbM5@!y@8%;>!&E~+gq9^Rx&g|fGDF)e@e(NKoq3VFy5xhGs|NYVQU4*=CV zRb0ct!2yqkI0aZ>4PI64*zwb+o|4c1a{INZbNf%Ww|@);l?sT-VJI(I0y^>5ty@9! zwkPH%px9rUDKW7&GCC;Gbb|pjPu)w@ z?^KtM523j8JzvcP!>9V2xw>4kW zpIqwuc@8;&O>wMJ@WUAvL~7*gl}h=d`|>ZRIgIoxF_s>&t^)?B0F)#1o4Z(l`toI= z=m_XUvWKBxzkZHSKR6pw4vac6xs+z2{f7^ykfMagp936QA@%Y%s#nqQXq4OmopUl{ z33e(>BjP9)8#p_uKYW_kOsl2^n1aP|oXb4u4B9ldQ@k7pkTq+@unZnMz(`6W7Ek_9 z?c)Y#B|;14&le`(!Yufmd<L>RDrCcV3PEm^%@4w@CslM>2DHQub+$;A0%f8)09;ce=NlyDiY# z^H*kQkKVlzp__s7*~nYP7}s>J_-xaW90*8i;t1Hm2m=YzIOc-S6sTpxrbh5z;R+eO ztNrk)Q&qXA;_Gqk*AoVBfLu1o?!ysH95z<8l?@1j&lLbf0Mg>!Wk0Pp>{2&6K#zqq zEcfTu_KfeE)bDBQ?ssZyeha);xZUwcr`@CZ%5nTBc&j%&c=YIAc6N5a2(^N+17Nu9 zSA2dMKabhM;$((UZpriWnLyh_=pbnJtPyQ2s+BnYkciIj9;gTrNQ;JoV$-I8k{0J@ z_$B6dL3CmA$QE9koIdD3zcG3Qd{_AmF0&~LAv-2>AK4o}VbLNK=QG($TN!rpK%O&pYk| z6&iH^VSZ7&sECMp(EI!YWtwA$0c-!cQ`KF1ik4k@ncS7{p-SbcjuinY1*c`oznu~> zoxsJ+Fu3`7q+w2$8FKS|r*KFo0yea?e3fkmz}_H_OXo1H7INsx z?z_?aVSMPh_4M?VX&J(aE?X99Qr;AJBx*v^U=f}~O@{&CWx`-~=j=j=77s?h236yW zAvMYA!cn{#*zY)Su~t&QlUd8y?%GQB*az=+Y}>36e;ZHP>y^TA#N#1Fp2|c0`=r&} zWgKjf3y)IVdDEsz$ca1haN&H4tXoLf0?f!coJ6Mqn)sJ=*Satt$@J#yG~#3> zGpqzNONwGx+VoyHc0r{2Yy@RLYC>gM;YTFR=;BfENZF0+-jkC5!;yS;^f?a>l^FT+ zZrznBc+uGdk-bH-BB;Rqtjc=ojVxr@opsE%@UBcix|^P!Zu{(!lR+kGI+yr5`$eUl z;`HU9xRvO2NdXba*(6kP&*M8KzMfG7%<#QIg&jRHx67fDNBf9gHact)=iVy)jzcQn(o<(L`Wz{{*| zNZ=ibRTV6Zwc!vNhT{S^7=C~h^&zacEGZEF7vdR>adlZAuee_<-#Y-+S4uNSEV)SZ zwTg<>KmO&m6pPDuZF|3fzxpEvw=@N*^vy3NHRxX67Q7QHt%RMNI!6p#x2Y zi%<#?zJ_GXYQ5jr8Gs_}6Qvsa69*81;JAW*p0@B!?aiYB{IMEZsGMz$Td=*Y0e%H4 z66$f0r3vd#v$9wZk%%_VQ8jAO9X`-#eSxZl{T1+5k6yjzBOnS>gh5LTZqui?Aq^@3 z_KH`Uou2xT03SGLsj85QEPh<`rkRThN(;OEk^p=6X-Fcx0^8?ZvBQ^$53H;-v6UO~ zz&|8JuZ1p<#(oNG8UqI`XpDhEyazxd7~0VYQsmYzsjcW7gbk*vSfXuW z**nFy;;LUT5FHGh+C$vv_U_#rCMVp2=-*45!m=RJ1suaZ$QLZ;p%M7hxpPVwKqe)A z`>S~!;r#*V7qR?QN!?JHW6*BT9N*;=2;RK=LfkV8K_6+|iz!bj3ctn`w#0sP7pQ|o z`njS*+XB1H%!Pw>b&JPDR~gk~Qu{r!lDCCRPoKVCl`O^DBBXACUq6^eFQjmUDq8IO zgTTP`dX=~DRK4$1Q)ph(02Cud0bYA}>d)QOZz~rZenx}PDr5QZF^ihN-SoRJ>gC9& ztol$*Pl!GpAkBrPOG*Ns=)I~0Try7eYb(CH;{gpIR__qRYZyw}{I}vsJPcmuERwqJ zCnh!+GGvHjL=<8_TuxPHXpM*_i7YLLt~_|g-@;yJ&COtFmvXk#meZOMxN~PS)Z4Ps z(&LZ^u(uM~Lp;8X6Y#($X)n!!quH-tKWU=rk-)w1{C+evvjIgRG1^NE@dgBU~n!G^ZLpJ-LT? zgb^^2WcLLIKEzN|`t4g-TwHs;iXb79BQ!W>R7n9}+Pe14%FdPvhCD!0;&0pG=eTht zrsh9<1FQT-GSfzWN{(Kl3Cggx4Y1wBk}}w?VYhFTLS~2 zchaUMap_IyOXK>KQ|_{qFQxXkXYF2gc6k0agY}dJN-zW|>(hU67s_dJSMJbZeMC6) zLL*_3{u+6RIBeW~2vC)4vUKIj#&ZG3*b8@%1Q26HT9KP!VDKYsFNIkQR&rQoGq8Po z^Gzl&iutU5zW%{{0@!sFH&oGO6qtg8M{1HgtRM#B&hJg{`cUqZf$BAA+@A<73^#|c z+jr#xRosM_Y6krC#^lbQAG4$^1ulT$(Z+cQ>+`lW!8N!i=&EXVHx_82Yse1VjA>ok z+0~EYG_g&1r*6o)t>@02OC8{$l@w1AFRH%K7-Vq;p^ZlQsi|mcdJccPk>;eu1pJYs zMrAyGn!r{e8TPdm&+uuDJIV#xl>c+ZYBgiVH#!WN3}y#A&om=)t%9_S$~X(6*oGCk zzpsp+FkwAzB-@yUO{r)lE3&;v%q{(v_tYaHz8u@M4_XPM)~C&$4YXUn?#rc=b$})q zJlx+$I5WJ6;L{ht5#+8y`n&U>2Koy3(zowKwK?8#4KbiHI#H(R5obE%J1zL{zuj2V zU=qx0%Jx>X@N2=dQ{$c~O|`$qq9#^$I~FAEfO805d#Mn!XJ-ms-B6DMKAM}3K&+(> zZlslDMGe9c#lgCJY6NSo_Ys<;p&ot7a{Ty5@qb#;wt zLXz7^934bM3>)|!#sKUN{@dEZS5u2k-^%*xGOcEuHH z6&gIyU`0pP*bWdu4u_PghoZ|4^`UEa#n=8Rk!@PsU_P{%MF$NcvQ?5b1Bb5FqgYy9 zG1=QWB19nxq8KqW_?ptc-i^D+`aPgY{s|uq0Kac}0$QqlntKv(WRaKOUD!vy6VQWO(r4x}kfJ9GJ`+(Brd{M-*eCm4M5-o9O|=XdAI z4ny22t=qSMaCcji9P%=N445?g;51#J$$4Svw$O;bWKezkZ>k2QP!vV2?*ZFJ zc4aN2Kc*pUO7V_X(3)Tv;=L$I5=T-rHtZroe>n6O1~p?xpJMNZU4;H+9*%-2S&gPeWr+)i*D8A# zK37oP^Run&?bT7=%x_!_+`oS~f)!jycZ>}1;V>Rx{ev6qDJ!sKleqdreT%>b`wWQ% z7ey#SNqGmkDZAx(VkjcMhYz>oufsmoob%V>^a`K<`Ex33b)`!KzUpMg14brTaof0- zs^^+%CDqE&{~Scx!L})Vu~bpmqq|iZ@c_|G1;!IX9$;nPad&Q)K7G#FMD+ga6pom# zk9HBV{(T2oFAriaIx*RI!db|oC&z}A*r3;PZbwW6I37_grrSgye53Q%u7 z!?lY-qje`EOyLv|=7dK>!j(QIo^8AH^J0|m4TcTz_48wr(>C0(bV>>16P*o6gl7_N zhh4x^XuskWKzIWR2>ksj&4!ZPFJB%+zIy@JK*dNaP<*^O5L7-hfq+-guWT1c`cZLJ zNk2Yhs(fgH*|gXtl7W#3ho8)_e;(?BFG>gqPGc206lsolZme0#dw?YexHjnTn5Mq+ zcEt>2Lc-quCd0MvaF7d}4fS4LT0>b0<7rD~gJv5Qm8FVgNX)jtwv+UzEomNQa5ExWdDQGY`PZ? zk)36PoD!1(?tF1ZqbG=Q0ZSetASLJQ(lbd2<8l}{=-2=JctwTB)%3!yhx@L^2b3to zd@23pL8XjZDkZM7CS+UIvPC4kT-KVlD>}t?*HidDq^Onop6o(A zh(*X_h5MVVpJFiOR`<5!#BUTpJ6<1LH|iF zYeLTKWyoSA*l$dNa(%n;r<9~c7rf#Wur5)_NUGt~@8E)pOIXB_-SBXnJBm}dI`>9h zNWa9TSYp!Fty|ZDEye9HYO>Y^ZN3OUS#A}d9cF^Nf&>rq--$ze`%~HPU%wy@#-oGL zr-tq!opxs?1!IIf+uTvxD{eZ$iN7gfdf@|Q0tQqG!3lZ9iWUTlTQOXTK!SMQT3I>o zOV4+Oh2;GS3PLeVfW}>y?V(c8kBkzm!FP1MpdBf`3!AJUeVN7Tpgt_fY~xWh^=(oC?=`PELR1p`KX?eOv+M_;8)toG zzR!9rR-$t>XskrHtd*L(S7lR#eZgY9mIbjn()Ywak8>OH!u#2>D?$qcM%bI(i-RHv zo6?@E<}ZV*MKS!^Uu#o6VmMW~SgQzX@MfHe;N~s3xZ<@y>4U!_Vvx}qKz@q$O)xqe z{d)KAJkoBa*JZwUbeMHU*j4M_Sv$}7y>LbCie8r4zm0}3A62z1YHPD)vlT|E^!Tm) zyVt(eF%$I%20nE9`Ljv<^+vW0l>&8wvdc?NhAlSoU-&imw^6a%B+tOlx?YB#$JQU| z8=J&zn@Z+WB8a*@NKa2Ga-D*`S55+bhLeoyF-k*{v@HJ=l}v;chEm^rec_49=Gv<_ zxBvxUn?>@dT~qt6`to9m-R!0=vV?*fte7N{vQR&NmGN~#*T;;LDdWtg(L#tT2KOTO zb-?pO>KsO>VK1Hn$-fwyr@N7n?ScIk)rznu7&h)y7BmMd_R!NibM~y_?Kz&g4af3R z#8q+m(0*}xz)T*vKGfp!yrxZ?e*gOV79KWm8l_YWujQ*tv7 zhMO00HY}ru_|KrV#$3*5ZE@Lwun14?{`2b-#^n#A0v-pv|6CD+5s{!xmm>~i0dn+v zr90r_nmTRT$EPP6FgkqsrSKljpaI3r2q}6I!zHmj9b^l$-z8tKH7g7q}xqOuH?=v%&h=Hk`CC8%q_Xk-11*v1cR5B<{bQo*v zWGu|HgoEfl@#x5FD_@_=3Q!K83nfIM-wZc_j_N!Rfn|sZt_9brKUw--gzumL$wahC zdVQza+3jS<7mG1uCfM^{Q@oYUF&;4rX%EBi_zg^+TvVEO7sga`U_E_U94dVtWJ|rn zek28Gc%=Aww;XmV7u5QVJ}HlxH3zak0K&Z9*zx0y^Mf?7>mpzm2f4LW2;KCnCnG*k zKVk5z1C)Y#0E$l;;j)Mv8Pcb6QQ6 zwO(GwcK$8Jyk^Sh3LucxVZGVwr~|11-}N;Ammv`8yE+UMPN>ZNHbCh7cnsuh3?bJL z^#;0sUm^@1F|zTEHUIURwZhwQl*V2k0iiq!dVIzks=sHU`th|TZ_L-dbvArVgqI0- zaU>9iivv=av?EejmFWI7AH3VxbL7CCS7L=}#r}*hcPsV-_a9%@Pp|(@Hc=B=W%s9L zs97*3FnGhem|flYf(3u3dMVe2zAZsHHL?uU_m)XNh5lA%^B8s@OcuYgC9{HIr7GN4 z8NZ$~P6d2ILle6Z>b6VvQDZoS3=$*5NKr=cLz89`k%aGCw@l1xtKGQgBgjTUbFM3E zhwz+XK9o8eAC&1de#!S>SY)a>)9m}V#}LmKCquGn@gw5JPXGvzOmI$u^4r8Tkk^lV{8r z?e1^%E(G@ zQQv_sv6R|av;@KMQ+BKc9+m7EsV$KWG$3XWL=%P}EN9d?BWQqexRA3}n$sZ#dpwSG z0lRaC0v_nX`Z-cd5kn6bL4DY5xP^UI+)Y&FqP|Mjf*>H43H`t6&u51TQ604!I)CtB zT!%Eu^@j)M95A+po(NLp=CB@iHf&lJI~9}X+JgE}{Et#nF}zBYv67$Vm@r*g8}zVZ zi*nd(|IXZ?5s{HGOfafpU%IMdLn01_e~EVcaemXBJ8505w1$W}!CMO!>WALH^I2K> z1I?fnP%+rMtCvsCC}KeVaXy;smhMS=FT;N0eR+u0jlV)&?1j<)5OKIX?skHyMk@!; zKZDav%9UhOxN-D}D-HyATogC9jR9u|Z!u+&X za(&qC@Z@RJ61fL>K$!-FvD?^q?N{}ZQg7wACo?}XjNv#|dzuubN=h@Y^&ql+U0Z;C;Yu1J0K(etrltt2us=LfbKlmcjAhkQwVtr=_gkPLWuG7oym zAl2QYBhH;W<(M84lWD1#abaAnxz@`QXwTm&3-`t{Sel+B9#O7m?H?f@Vskule`jT7 zl`-Dr8;`w=ajcoopN}MmvRm=yL>*OzRcNprjQ>0xovA&F9aI0+W_T}YY!6jFp#=q8j1Ss6ukDMCng z%I|f0zQ5m0{%oX5$z0nFqpGEla&yX|4kGlo`tS`@5vsQi!3IJbij z3y^u{sZUe6E12nxJ|7XRG7s=nL&^|Vqsf(rD~Q^&r>WS10DcYEy~Kk!7XajnO^iO6C&9QNYvnRN z2PuTEbStbDKSOFdTq&sYLYNT}%3B~eqWCx~t8h)E9HY^`=+pKA=AHB@6YyLXWC@M| zTE%dktE;}&pd~JZ5K%P^?{Nenm(Z(A-rilyzPFKXEt=>R8_r+b*}|-}`d2$*wwynr zJPayyD{SCXk$p&yTnk*>`UqTjd&mzb zO3BjCrrnA)RlPOn2`*QnPf$9PZ{wLq9oT6O{^bDB+Wn)tWVmSlIz}2)68#TP@s~nO`QOPh{GC2nc*={qeTLjL+Ua z!oZQm=@e6aR(zQwwV}6nYO_&o&C|_%?9}76u;Lbbe3{Lnu_R0jjxLT{5s$yKu;HH= zoEh#^{7e1>{GDtzQ~|JtA(V^5CT=%n-0&WA{*R?B~RJs~R$B70l!S786vs!f|4R)%`TXPIZF+Q`_eO_HGUkZmMk;W%yw=1BE5lP`rE zjxh*hRNsIXwh)}2#j;r7rpPS7D^`|X}OiMcv#Mk z(>ann&eb*k^yPHqhj?8wD9JxKtti_Lf7&=A?=tBMv;G3(bC})B9b>$UnPu60V(a8I z;m5~kb4~wKiGLQkT~)6*l=6~fC`t&D1D_a1av&NTFS{=Za5HS`+03V|lClR1;qihl zojY5e+mf72OT(gxw@=RWl6Wmsm;(k(k<_UeaB-i^j?pL)nyZ!%W{zjQMEN6o9pD~a z0d~1Ejj8G=?8#BW%H`JrDZN=ij#Lk*ztb&)fm>E3NrO1 zW7IK!`XzB#Z77C!$;sPdVycBCXE3eO5B}#LBtrincuD^~aLBUx=pX!?m^i*+rb@~+ z>DWtk{$9hKkdfb^@7^aT+u)Z(2FnL#G`c=s@3ubhAjX5j_uM-)ej3U$lB#%T&@zF- zgpUa;eE85CAKoevB~Wzd8T;s2_=b&25N~ivM#Gk4$;>i^f;z1y1y!|$>{MxpY07;E%a(Z+Xa^*Cp-ySFnA-LmKf1f7t5_TQui-8^oOf*~AIyhXV+1p8-4f2*i)-#>|_W=8OX{9YGh$$4J5o)Q2`TEk_V{3j3R*wJ-vo|a3O!+KNWQ07IhymTH~nfLL-c|RhPCbi zk$KlIh6K`|Yyp%vdf(91WGh|)4LhYA9+5PLND&gcDTl?2YOs|hLeE!6YP2qRc0yf8 ze8AbMl5-Z4svj~#S*mhedQzoWqc!XJ0EQz|%54=$=7@ts8f%>(q}`}ZX_ zlX9sPB!;prq6$q!G`J#l7=f)6zm=^9lk^-@r|K*+O%JT9&0&k3^~M%jRM%BX)=C9o zjK={sUjZBvIEVo8g3VojXkNPv8>U0qg)o#kJ5d5{RZxxBVxoWl{{1h{&Ro1;0c3rX zeRoD9BlH{c>6`!Bk-?bDY$G@EQU7mpi-bo#L~O~a^uyNUcXU`Hl>p*M!10$le@lW? z;#)^H2vJ#R2mXVKTwCT%Fx`=&gs&zJ*f7c@%Q6Ansk_-e@cGEA^3;?Rkw6FV-Ut3gZOHMoR4p{1xL#J3vLg7m#}FlfAa z^XBpm-GkgmVCS*v%9r)$*k<=|tKNZ0W5#deZ7QTZG}0VYNc~BDlXy!7$)o`0fVww6 zw$!sYr{8yYko$TPq;x7`vA`Qf2*fz_FMKaXc2biS0WMT~3cx%%1)usBs+*{V$^aAH zhj`9VThwo{x0R*7DvRm8_x+u7`nIxOz#}xKGULmkx3`BiDWxM;2U>Ie^`-33yD1mr zPo3iXhruL>^pLJD9t(}cuY(B_Il>I*`g(p{Y(_089!XQwPJtJNdh^bmtJ^& znNL++&8KS0aS8BhEjG3%Nd851QT9m2z?Hn!=AbNEI6+tCC0F@DvGcB5Zd^k!AyGnP z`n~}!h|hRx3S!I`228mMQCq>Jbe8|O9Ar7OE;piXp)#kq;x^{ph#)s3fTv>~mb}$o z$@`07SY${qcdrB2=akSfbz#WmA5;QZnaDy()VKg~*IG|;$_{FxPMtRF=Oe-?UEXayuGM(93Ny*UimG$Q>#-IhmM? zzw&Z#{fyBd1ZKJazU&y12*pB)w2Dw#qnp_=1dAgw9w-sJtGs{KuKf1y3Kb5c4p&@y z%Q6};3Q=URI^@igiR506E3r8_xp-0JqaBYKYGxk= z{igVCPD=_b#Wql?0lsv7u!vol#leN&Vbn8cP9Low#;b?wP-1>~awdXZD57=(uQj9g z6#F4+`lnQlvT%gzKmEb@*5+RBZ^}Of{4f*7VBsr}eGz^YP$Dkh*fq$#J~%5Bo}6LS zkMvZB7N+pB^>W8XN|UO`D4r`R6!ZGBBL<(TyVTUI{_H4x|4sNoeh^!rk#at0l(>3d zd^b34o+P2$-X5a|S}b8caC}S4GSa)#|?Y&#L1Z(eJ;h-g~dMwWXel5^}a>Io}HtSyhBZ%HM{j_X&%TvqO~;^+UXK;^EjqB9d?=kW zmVRHxW?cGpf#34t6NX=-YA$kC_-W{3c<9h7sZT09b?HLSdi~lp-OinZVfq%f_a|7^}04XlhTeUxXKm{J{Ezbi@C=>Shz-;N)Op zhNT2A0F0hE@s{ey>(;@Py?}5(YOH%G+Bi5A9(%EPuT|TkHme{IhOr7b*?@|z>-mWb zhL-;L)EFQ)IiqjwQ1To20_~3FWbsR(Y<14^kJ`441!h;~^g(oNWfq{9TM;FPT9Gb( zaP8Oo3W?kPupAxJGIyQZFdhd$b(g#^oH+g>qMs4D2HSWO5zpvI&NthKi{`D{}aP}InN1Pg@D*(a>FPcNysXBjpw*j-Nwisn+!pl~*IJGz--3Xn%T;?2$sV= z-~i*sDf?$Rn;CCkd(Av{1)+>iWh20wPL;ER{dUw4(sFU!gJzzE?IAzvP*}^JM`*IHW@a5&Ox=2vdAdH_tE3Q`{a7m`GXtONi6zFc zZYoM(j5;z=B17=HDhe$OzoY)Z#(I5TX+fJSL?8AGJ!#@|+U$A8f2J#iyB6UfUkedB zw5^mFeEHz&nhncl3IN8ZVYLMc8z;^D8~6-8!JjcLMuU0+|tN&LaBS z!#|BMBoV(F3*nFRg{CR z+Kpc@W$d(RkDDC*Y`r7C8)@JkJ_aAnwCI9cvQw~Qif-E-St z*ABE3wuf%}GKCY(q}i3TRL<)ioR z!9MZ+L*D!rMEg=>-$4 z=FlMbl;-ho^{~Gq0knuoGE%}-YmOd`B*h%N5E>N7D4|*k^YpAy(963<$yD{i3^Hmo zmBCo>H|{%Pbr8ro)F^V8WGzGD{q~U7(PZ%*0~qdVlT?Bm+HL)4hpn;j+!^8WE@sPlWC}ul9f7P_WgODP=WI^8=Cn?~wMT#-rAPCeLMoX*XpGY?@|Db=4pCt&o5=S~c{AxBCCe z+>fPkv7-|vFU(JN7gHx@7iu!u)rz3$v%l!KDVT{T_acf9&o|K^+mYPK@`>B+Z0xbx zicP2+rlQ0*nry!vPM0S|M*^UOwt=F6p(JriV~_KqGqZ{6zkUUq-nX+agZXY-G-H_- zlQP}H;tl@;L7MM7nD&GCEA}^Rati}gz~p$#;{}U~+7@!a9UHS4@k!-jnp`1e39?`{ z#fvsg1d*hwzO~~d{0>;EUrlY;0DF7TIY^X#HKnWqkaMwIt97Uav8F;8jS%?`~P(Y6907QN5V>TI04_EDn0vDbfXTc+++d0|~{5;N6_iRO>B zoi2V_;x~TP-#Rw_+1qDa{QGFR)P1Y>1ss|3zJiHodKz}x6?*n3+*JPxKl=<7eS78$ zh_*61#2E8{l|57JX{yvh-7hxo+VS-I@+Hff?Cl;FpPrw5UDza~g3c?-TEmy2yMjL_ z0ppVkj~R{PF)}XB3cdpmf})QdYTECum_21d<8k9XZ@<~RI_^rhF#Wbo4Bsvpw#GH@ zgzeJh`l$o8oS!|3%XPN(?P@#yUA0A(&{k-yg6gAC%UebML>0C1)33ta(r*OGpBk8!uThh%U2ZzkV6F zv@b&CGA#Xy=m*d&V-a*Fcf`LE4&Is|2rgMZ<>K$wGGX{k+uQ_T;tnY8FM!|`Sj;jc zh6+sKpYs#TQ6{*pSE}kbrd}s2dL>9YVR=}7x|7|9qIpw*wLxn-shfp~MrR%@;V8kt z7G#8Xo@oC|n@(ZS-l-{tXXBLKFBvq*@5Az|)^0eSSwH%HG$nM#=Kq|GDD9^|d~ee# z7-lf`d&%MWZbSkO5IO-#R}6IXmZ%U39F?vtWqEWY%0 zn4s#p2dA!#*;gLl{PZIYv6SF2sNHS=Un{1EeV@A44*fsBl&liH;M{zM+w=dm0Hm!MMjkl6&F}^VR{@L$59H>ChtHpsyZx8wnLL;59!7DG;z3qnNWC-K92cL?Q>V{qo zA5DC}b=tJZkxpe@_Wr`c-a8hA%$SttwkFrMce@3J{dK#dg+N#2fAd{c>8;E`QB%!_ zb=l$6i*l!83HoiI*2dJ9?o%qew|G*18ZJ?`Xi;5O`nrLJgEI|4~3kuT3?1O{Dj?+ih3<`}s zos9BQv=3m-f?07XDKd+1W+NP^G!@ANGWm+a6f8;C6N^PX;^dhJnr$NJt>`+#ziqkmcLV77Uj3{8>SA2mO!5wo4zKI>_=H_;O z=8f($PqlVrlee&5qBi4%j_BR)^^WO_Ud-k?sWH}z|w=eYZW!hF4`F+q4k0E=r0D?|Vv&Lt%cohTYlc~6@q<6-n& zQat(j^#@S&ab+IjjCbj%6n!aXW%p7{K7+pZjdJPn>29T*l+89y-d9>LJoRO|y*)8p zG!M*s3a28g1$Y{ST2@#d9aA5|{_ci3I&pTJwT7|ZxrutG)a28ph5>*Vvu7t1Mx+na z3{b5b*>qOo{oCCLPeDQD`PKUt)$E-5M^u->KE|hgjZdo|=Y3KxIT^+Ht)VG2)htw-@XBi^ zS0vy|^uFGhnh@Ks;Yd)tYR@rhO&SzHur<=LP>=rKd~>c@dSCpM_kE53c|Am{$CK)T zQ;yAb^Bwy9x@H18s_tEj9RD>06DJ;myn|d2qd!t(V&x+Dh!)y|uZarC)_O=Vr!PE_ zpG)H}QU&OkipObPi3IU5PcSq2w-xom4?sMNJKz6?`lqrP5ihq~&;@4IaSmplL?r#f ztB}ug&0a^J;uZ1RL}mx)Oj41Pi--Y>t+KYPxA)$Z6r^(NC?X<3RcOCdNfLO_iUk4{ zbJ;Ze^H4vL4aPL3U=*nr_OLSYhDiq%3AjaXd`X3d7XNEZap);;4ShN>jQg zZlq_bQpkn*3=7QMMpwdU^4j4q&u&`DA3}+*-eowYQp?kZWL&|0DsNW-`p4OQJ00H* zoE!?lI@2SSZC5Bh2IQMNm}m^?n6}6YnzOE8(+*BQ&1S6Co3X1I%Ik*Uf+~IQ=gcjm zI&#wU{%Gg2|~e-rCCc?4whqBQT~WTPT6L@r`du0dkmwgFr0(SA$d)LqY4DosYMkR|~~c&PEj? ze~Qu7C#zi)%|`iqbJ2JTJrJ%A%i;INPnRkAB@6i%SLVg5JFu- z(R=Z~V#crpUD5mjZ@QbOHy9fjJB!v|3?I^ z9{=y10V7vqBD9AHP}n7U?31}(=VvGnvrFpGA!v1cM9|cgo7D$CcIZO^^85Gi=y8ER zYwPasepULT235^1hk|Ed5%HG?%Y91+-EK5d zpVVmmt0T)@e++bp9klo3k-rfcYMXA|V!h@e=DDf(fY{{D2yv;%=r8wQ{a=SOo9`+l z6$t(LiLG?#wZ#xlOpuUQ=D4A6N6wh~x*D488ULa0`#Et%oL#hsNlDpns%34sz=u2~Ma|t=G3Zr0sTG8G z1s!>Xk%Su}ROb0lJ}wE55v`dF&?2zdz}sO7DG5)E_(j-=;mbbi90-di-;BEH-9AVt z<^Hnr@nu=eOgH42j*6oY1qm?EysGEX=ewK{s-(}q&!HJW@;Q=x19i~~W--LIzc@E@ zt4ifWq_d1^mWX_odkthKIF+d706a84eGYQ(+ey)<5g$WH%xd}o`0@ZtU@eNiihV+{r2v0$&#VTu9eQaJ&hAPN9!1O-JS1a;QC^t?TTZk&nva5dA#xR zENTYyvywWPjNFI#Qek8HhTL*znaLIY@loY>)6oI0GP)}`h79U!Z1HIQP39;;bWuv* z21a6`6>qip&UwSXJ%im_Y;3DYWsClS5_iFi3wt5LJVsuEA}}+XK0a3Fl>`qG=Xu;Z z?!{GR~J zV%OCDs%lYnR-hZ1a^rcSpoa|sSKo!lOUF^0LzXQ!kIj(Dr;^aFg8Eq{Ml*!*f3qTu zel=@b(rIkH*UhA=6hR0|HH4nvfFke217k;uhk5J>u#Gvz>GOL|KRv;7yU_lB>puMz z|8PESiB^g6FLV-hKQ8(LGr%`n@+O$GkcC}UrFnhPTaMkST-7lt`3Cnvl=On@Ni+iR z=z|rWI8SP}7#*81c=w$*v%v%9LJ{CuOlVEo&7_tW-v|75Js)15q34+9ZgK-M@h1mK zyaNH4FEQ~N6?LHU!g)aA<*%bgzoj=he|bn}vhizL(>J^3#bsA4fjhX`E1;^WAjycd z+sm;m0#0T`=_L<$9ts`y?1`5LD!6Ve30by04?T~*d_aH?lnnH>U--4YRD5}6CVIC$ z$W>yhEfJGwOs~}*#V1^M+|AdjC7mjC0+_QY)v{Rm74GtjXa!rs>lo)r<(Tk8Tu3u6%-aE7S zg+tpkm4)p51xLAmZrNf%$;nY7E543mhI=W!EqC@z@;C!JaRP59JuO$6vm&FLA20q5 z5Hg)^^uuSBlF@)W#9kSm1kxCYVFP`#6a~Z*P%AzLdfK}*V>F~CT3^PJALk)28vOmy zZ2DW|BbfkxJ8@5?_N{7R9pXnm6iN$>8`B>>%@!gRGkUfX;BkGp0JM?< zwTXqWAhz!2u@9-0iGQLgfngCf1F!xpDQx=OsvRmRQQMlvDatZ4Nn+pu^5^c3Y*{6$ zS?HcC@{*Kgpn-b(Fh(f$_E0#~xnf9;9$D+t=Wuj>ZA2f7QioV{w`94mkje;K=3EU_NfEt14Vyw;jWgD1%SzjCRaqEDKj9`ksc4w_ zS#W)V=6qpj4q;iL!O_7%?h&mlnQv_iKu6It7Wjrg2kaLW7xz5bZ7sib(fO)T@TkIl zsG014>mPI6%tpsa4H8n zF4FAG6RkIITOdwa#hd{HyKIHJMolJ;ZxwLvM?JDTTC8L%h#X|u>_!JFV|ZflLXC3v zY6dr3><9tA2_Tdg0acr3-X$ZPz1lhV@f>Oj8Pvs0e)7@ham+V}1p}hq=dZMEkKGc( zNy<;bOffOqE$WnwU2>;YGTB7}RAKy8Tmt}TG(JU!i_HZjHDg^qnLlZkjM5qgxrcf{!HIH2?C!Ye5IkLu7u^g;ju==@%aU4ML&EiYI zwNMF3jewM;&6%A+rqgGz7*fVAot8ed=O9tIh%q4bV^xbvX)MGd1<5UfqrToH7O;Y_ z`JHp8ouCSqi$f=^C~*8>ZR^;C-zUJx|2J+A*vFB1oa}c*Nl$i`u%;3UCGq}bxNTtZ z^Ox1)C(={(MfWNiNtkDl8{Psg*~3rAH&G>IPs0;kga1IubmF2q;H2ODnuM3_O9s)ARPX>IwdS z@E{{uif;kS+HC54dvX)K3n!QW-~qR?oW;ALHOw{Zq*vTv+TO)oF!YgioO%qLfGGK1 zZazT%+iia`9K(2C6ssN&9S8!zIM1mmUBeWdolb(zn{Lmr+LUof;keUk_{aeT|)HRf6p(5 z8JW7Cc7CLpIU{h4n#jmBEw?b8eC4i{%Y)rJlRIuwm{=nyz|U$973$Ab7nW~qs5$Pg zfP9Z0Dd`qhs;X3TyNW(?yM1Wjxr`RD z#c0?gYHp_PgpTOARr}Nt1B>@_(jJqI!9a&UKWZM^b8Mi=dJZqGM9}p)^?MPN*Suz>}wh^Con4Usf78e=1aaapP1Cj40=s7BKAx}7Gr3Y0&6F(|376?(q zZ|DMuo4gU}FPCeYha|AjViWUE?rB%*co*r(v);n*h?zzpjV=cnUcx(koRYWco?DGH zi<3Umji6@mwb%&z!4=O~lb;c)k`ir|*pb-Cs&z!D;obl5;S1Ty)hKQ_iZZTLGfJhz z3p@gq8$cUcS!wy;qR(CtFDO{l&%aiQ*z-e6J;x{j075k<*=R^z3{yaKkqD3j0pm_D zZ)P4cd;Hk3uVlau0HLu9c!Xn4dOt?v?rlh0R&lT4#>=X2LV{FY;BJiB22$<3(pmhW zsup8?fBv~wxMTs2R58f6VZVm!g3}u~9PNh^prFf`dI#GBPymfV9^viiT#P#N2HJa> zqFAWnk9mXBh7R=sGrnNeyoqB^2SH{{(Ci!JZYd7F^wU^#7^Qr1-M&Bd!Ud+|7gx0l zQpqdI@SMUDg}{-0S326hZ$hC%gjOC-N#u8K$Zb`*u5>SazxZSW?1bnWhCJ7sPj~nh z)Jb>YQs8YSr=c%8sVMDFPX17+CWZUK_Ttq?L2qY&2qoueJ1ZrQs(0u}CGQ3Q6CVQSP{nx`jCczq&E=qj5e*AYh>KI-(70=6IiILJ#)|tj zo3uLyTzl2}2@0E2^({giuD$Yd$#4uEl@Mfpz+q`K#jz+e+vFDF$K2K0;oY7QfP>$c zZM-bgnvU&>mjMAo+ibGz(5B6a8Ex5?U9Uw(62*D7YL;KHN|p4mycb0zH^swW?T~^W zfgEbFh`a>*T}|~ITcR?#U-7^#EMte_Rj)aB0;XxI#xEUbZJo%srBO zNq1VWRL~#x4q%y5H6{5GB`)n>iPi>{k_LA6S3dp7AGA&-am?+ldoZ2d`uzvI_w_3q zRZ=D$n`_yvRXkZc?eWtRV>mJQ+FC`7LIw}?R*l~dLM0$u)7^&Crj=DK4|fkP$nY#` zvvQGM?sZ%H4EyiT`fF@K0(RA`8RA7|4yfM?Pg%JsD(hLvow_D`Sokt80 zpWdO|TQ4_?L&U4((TUhWV~e3SqYjj2^&_LB*Wa&LAZNAfVW8QuV?*=bWX5-+Rz^ES zghMlxAy?1#{_Zwq z1puB-i$ZUBnI5xW*<5>YyY<;BF^F8c9!~afs(I6R{fLz2F}yeBfs2$1elLA{S21u* zC!gHG1w@Cpgx= zV`y2{Skw&Gvv|KB@CxJ1_u;qU4FTHciU-~{@R@%iI~C7emDRscVQum?*+>)gbkUjg z*J|A{bzK@c|utnW?r^_BJ^wy@MX-CHSZ zrP_Z5ru%oXSjZAeg>yFU(Ezq~IXWt<#I)~($yl2f8&QNj@Y|em@KG}rg~a>aOsiGH?jzg( zZZ=`xkNTftTle#bk1}3)+`4z=VBhlCH!D7VKR5A5GWn{$p1yvskh9|h#)6O`?5QUU zEwJq#Q8LQHB6rnYj|`YJ`y;-?k3Ljx6ya_c60)-^g$4c*%H9f;u#CuP4PP=REM#X7 zgY97e&3ZNWVhgLG;~c)Ku#?VN!PfF@Mn*qe4q5)LtgT9hpl|8YDKO-^qrQImCe&>P z+qV)&{QUeZTaLDPy=8d%@tIp;OXu`yfBN)kChOB4oyQYwu$FJP_x-gl>YvJIeO6oq zBDe#SlzzN>zb$#C-G!^MvB_*M{3|;Ki{5iF+?MSNs~u)x@x14P1q;rusO~~#)_Mrj z6uA6aJ^C9G+K%5IYL!^Zlw8gbgBvr$Le95y-FS3LkcIvTgY7m>PEG|Q*~DNx5@?zl zGpCW|&15xIV{6h{OP!$&ZfL4MfByVL*;#5XOkIk6da9~M#URMS*lX>kP2+>RPT9#N zRITfO=H=#)kZaLX9UUasZHV$47g1;1HAW;bM22qz4PWYwPPTR(4f* z-Fb4iRwUV`t#v0AdS1%TKCo_d7kzzKE3PtI$aYTbtnXS5GK|*b&9ZM;QpGvn*IJ3B@+S}=3Ux7|F1{MlAtmj2IW zIn}YYxp|6%j5`6?)aCjLhy%Ek&a7g+Q4Sl>y(1Qp^6>D)4#`l~vu3YQ{a^Rjqel<# zUPk&~2ADSsJm1OseRmhD4()jQeHfKd&%RMaavMSV-@^|3zN3v|@J)AKdGbrag?jz_ z_kUDe99A7164L&Qy8^zXyC?R}bvI!gG9)@$9ke5U)fWC+_0QkVlP0G3dm zmZ#_Rf|0+TxY{&4nVwGLpc^&j{-(X z9^ZP@HCnToDns14#KIp&qx`bkG|G4c2 zZmAbGg@l|RT%MY9Aseq8z|Y_blg-S`jyq>LW+!0Bw?Y#OP7Y{&Rr&m4;zwzu5W9Ep z%srbo<4}tfgER5fzt(f$VIGeT_GQZUuIyY{U@+Xm*|5vTC5QMu{@wJ~^qo-aubpxd zY>M$6tRgHtd2hH!;tTy7Z+|Z0sOWwWzV!R zE%Wm7WMi7|-@4Tvg~vi|l3vpiQ+Zgp@;t%p2_A>von*wVtiquF|lFzk-?4DXD=v^ zWOhJKHm+8@?29#n7=yx~LY9%z!7Tas^l{Jcb~Fc!{3xK4go6aV8*|8J_khJ#%mYIX zUVZ#{7og;yqzgT;nF4LEzjLlmF+P(r0Dx^7N;2b3FJ7VlNE#of%)vPl#~>2 zFR$KvGGyuPAZUw4gS$(*0RWo;{9te*JXFnf3T>ea*X8#}oko;q!scj?vUdY7k@ zY+g^Epf;6Deqv&s@{M}GJTm^vne$tc(B{$Wwafo|6EmihtNGpWgtHYtKkK#B9?YIK zhh~8xe-4plwv9V9?VIXSHazU{XcfK0hF&&lT3Y$13swf(v6ybKZQ$`+odekzc9V<& zzlE8->;pmaCIfVgV`t~&)Jw7pTfhGDKIOo{zlW?}zkX)f-I=>Nt5{}d2GkBBoteK- z_hn_^ew(CjB-@uzxuWStW{yrZm1vGNDTOEQV?fNd9fIOZPDnL{Pxu!!`?9yQ^}nxW^GMdvDfn) zEfY-&A1JMVGm@w-E*~V?50#Zs*XNL!XZLP*v;28KTGO*mm(pg#8DookTzZXx5lW%Y z4=m2`i*P!Z%Dq>wmfUV&;P2PH1Bh z*K6s5{Z7`ce4}HCn401k#gE`O;<0z@@SR(wI2wwZ_^era6p9H1Y^N-L`?Gc0q7ZOX zRWN>RaQMA5$K!Fx{0+UQ?#FVLF^c^wUfU*~ zg_{NQA`AJP5G$%9)6%*a8yoXhA*t3`=yS-|iQiLfY_n}+drzM_l{y`J{Kl7Fy!gB9 zVt%R5Ew=lDZhLVl57=P-8-fv0D6{=dMl@vI_vW-;Gf6b$5?S%goA)IZ(pEbs?bBmo zQ%25q?z|?R{5XEQ^d4MYOxZ$UW$Nhb(>h0dMKQk=T@6OoKY1vbD16j^Y_&@4F=fV~ ze=Zd-sTvqnR*F~yB!4q*$R2DW;>f_A)S85chszKla|vQucYNkWD^3jmTl3}EpMD`( z*9a8Ns+(QBFoIy3_E;CYY~1J-Po}26f`O^$a(Dj-Mj1D;f>XlFoLIF!@8 z+5JyH4llCfd4Q^L;y8~aIksR^?)-KV$RrcJKdHjz4Vk1KNhaW8#tCc&{E?guz?(?gWpgtfR zPK-{%4sU`9{kvt?3+?8CrlzI}e=G05e*1Q+QR(kBTHHbO;puXSKlu#@ znP_a$t(g0Ja~>9Pt1xtYaD2udHh56<(vHl<=~977)JV>{Hwil6cSTpDnHN~O*bC=* z!K~1TW172m?_MoD0ogCoWMv?vHGf7TJ2QdfGfSbC_F7};38!=+J;;^BC)YCFc{^Zi|LR>+wR^eu)C z#H)MpmQD9Bcs`U(7c?f~KhUyeOALR+{77*pY!kp!BBkUKJ_w~GB>Xs#7~CSo01BQP zzxXPfHzVoM2CLN9?G-w3p&Id5+|daAq?`4ua@b0C5PJ%A4+;q44l&>j8!EfQ(~2*> z|K^WcY7FkR)By=pXQpOm!+xyh5phgr&7Qp;$G>T{U3$@=m7>?o`FrPvzj50M?YniU zoZy>XT&yu*z!~Ke`;BMpD?eCWvyup>r{0xQg58Ps;N_QO7?B(c{ZA;liw^`9@cS4e zy)~-bDO^eF-Tb7nQcG+`wY9^K9_>M65s&_^^^k)v4&fw5U-Ihh+c98VJ^W33ZJyAD zDYRD9c*%B2UmPPA_L=n8>iy0!SJ>CYPJ>bij|9wJ(-%CxcTDRpcZl1Nk@2m=(w67P z&aOR*#iAS8oRtFcPfPL2W+1Hj;>DkoH6H6+{jKnY$4vBfadwV-+^LV_)Tuis-meNf9j%?WZFyN`Wv!FhPi9}h7i}^;?1{dS zV>(IkPXkT4hA(Rw%vd%HU&(hA>2d#cDS!R?GnJ!wA4v#9C{GXPQgQE)xQX+vn`Ae& z)xXElk_v@uB4bj74%fMJEqSpwR-Z;hnQRweeH;lv1j37Z$@V=w9vsQWMGGBW>RpRf z#2b@EPusB;f`Kh*B*0y9Y9x8-t+L{t&VO>+kRo+IkPvD9B%&12149cbxIg=^AIo!N zhpgPe|5ek`xg!J2{X8D*YvG>!&;vuusnGSf{7VVIDWaFA$+V93-9FBeJtN}d!!K9Y zj@Z1p6X_9g1W=p|Cm~wq6o{`qIi}Gi$`}?pxKSm_mIua|WKH3gEzRjivEh}`&=kjv z$Z?0nEp+PCsV_@Pa@a&DsNKTi^jT0^^cd=0yLJ_|9|8rM4&&+bm-_BJN4Ia1t8lHy zRmR*O^`6pzAES>7fa`Mi$mEW)UxZX+x~6V0rJs2Bi30(f<&0q{sc78#PgHB#wCUs1 z3p-q_``tr9q{x>774O_~>}g~~7c+C}&%ajF!jY+A$fCpY3%zUAhd;Zg_2#q%2REd+ zGaWR@;o3UGaV}Zyz(^>dKR(YIkI^_bcO?`KG_&46KF)Zxlt;RsDuoVA)X<25$HRO8 zwXB)8AI0bPXotS-=XbgF;^K6Luihpa&G~`~tfJVJ@*ymgc}9e>GbbGy*P7S%ZQPRZ znT@+t)LXtfYaLjYPi8Dux*R=R+T9G_9Jyb?KVW@HWW@NrapT6=YQ6{=Ui(*>j3eem z98}q+$@JLG)4hTU++Rb0h)|YLcApWN0d7MFdi(HZXp-M)p+Uq zHnJL?4Hs@l|JHSj_^#%)bg89LjO>yY6%YcvVB##!g>Ku&IH(R@_4A)yzkz+SZuIq= zegP{qXd$kZ`GC<(O0wf+yUd*%oRCoJd2!Uj1q+z(S>^E}tY|FFfxtI|HssMFQ`%5> z#?_o-3QA$_%Gcx+`f(+kTxpr*_MvuBY2Dfq`4_1qL~7l~-*au=GlTc?Q$Wk;cqC^4E9*#wrElJh9*#`D z34pyh0cF>)HABhlrSv0USobchUP%Fq+GA9gXweZXgzF5mnlwp;J9n7{D{b4hrJou> zab8$hnDeNkzP=dW0-3C0N9Y>U`8hbvkN`!BO0OhaRYSVxdokTk$lrFCiZ}obR`H_Pb5yuS-iyi(ECGXtuv+JGb!U=2WWO4IeBf!nDIe zu5}3h^=bHv-n_4$90!9X&AKE$f^3t8MO*-i7_NN7#Bxr1dz=sY?Ai=B_44D#7JvHn zX~Gc}Z`bzw~{PXp?j;KOY3+)tfgzZ1xlm`%=r; zwMT{qOVikTM5(piZ9M~5j63U_IMlz{|H*_D2UZ!ZA9qNt|83GEo5vAV2TtfRQa@_a zIlqNC^0>5_c-eWt;&Golqy7}9U(7w4MsNWNj!o;Uw>~dFzbWqqNg9h#kR5I0Jh4bq z;5DU|EfW!_pIEg3yadv17GTmkM)h6*~m8Y3=oo$k&&C3 z&d%QLb&5{R#A)aKmL`FA+nge=yY$tXo@BSX?7UQ9R=* zgG$rWn+n`>S&Rzm@it?CPtp5tZh9$hCK|Vl_OtUnA|at;pIskzjXgYI@$=UJdFjS@-bhDm<5;7>%cpuj8eCF1)|OGsVJbIWFs0v|tDjNqvt zck{rS=JmTZkK2oH)%RW55Kd#@11CAGs9L$x;Hl2w<-@T!zkT~Q+PBT15z^)b)P9?S z@`->8dLV~DrbH|(8qipxPkerW`h(m>Gnkr@fj7Lx=O|7UP;fTEFKD*^iWRc59NbG7 zXX3FeMo-}J-KkrvUCNo3ZKte}7ATbzN3B!B;!c*0%K!tv<;SNN^VrkLl@k?}bRmpq z{~{Dn1Z?VENPi>$Zp;`ZvcLKMMmM%r;Z#r91Bu&&xE3$?QRuFM-f2LsITZP}3r9{ngbI&|36wT+CIPv}z0eX=|1u!RRdIAh%b=HuDKz~&AvR##o! zK$^~y4P${XYgPW9jRNd<7mE zq-&c@pEB%6zWHZ;cKqKGO>s~Fo&(pV3o}^IMo|Dh3RG70wvMx$RlM!ON43R-u~BxP zh5q2m5cIwL{K_$0Oav}qNo7e{*|!IQvV?2J=a-6N39gILHWpJPkRRjn-2VHasj12O z*GEsD&>T!-=zxs%n%=`M*)EiNB+Gc$6APM-Xn@xuXu9B(Dw&R}1MuP4SJVGxle{lBVqQ}%%t z6hsLg4F*_zdSO0+4uw};)hN?J`!@1%~$W@%eqejnPAedH#}LS$Ocg3}A9YxG|b zg6fUAW!d~heE_K>U?Cj}t3FsfBTiV<(>bX+d*|V}{_EzqORpCPp31uaX;!kD@#;I$ zf|BHC&7UtNF_|&ppCxw$GVDou)o)kMaB>3j?cVlgG%D&Bhdr{S7#0TNh+XoFg)RQB zBygn$)cQj`jLYzN$eBY0s?_j0_H2if0~%#yX;n?A;{eDF{anda{h&w z)<_qLwKsaa22D;Pko`i^uXp#X_iQ{FryU=5klF}y2JSjV9{*XCDIk;-B|T$f@=h#` z-g1bcLS0$dNJD@r=4bqfY*}72Y)JsPtbw+%!j}PJCBJLJC_Z0L~ksFjZ&Ki;5GBbyV> zLuRQTb2uss45X7rN%iyR&q>s|U9YbC`FR#1#>PZ_@dTS+5Fh;V(yHRaLs=055X*Hw zVwc1w_%`PCPhqFkHFg~}s(8&4VK9{0Oq!R_XuWT!dD$lO1OFNcL>#2T((-bwAk3u0 z0EOm3q`G9+Bk*F}#6jJP!?71|*DF&#Mm#_4MDEM;YyMu)ZAhg&K$aiTh4+0S?C6|h zg~Y;LqpV0}>^Nl++71dgcEij^Rzj~}aOM}41^}7Tv>-H3vBTEH{rR)%c|gs=8+|ClXp{>F_PRhAnUO>km$FO!Uy zm>WR?*-O34gi8+}e#>m3P1oRtA1S=}*vE#^ z*A?<)pXljORJr|vp@7WuH6;?Sjy<8HAfOF7VS}oX9eOvmXbof4S?oiqQOwR z!i`u}LYiA!lZMp`!j2ccpZP>{$L`%XXi^ohdYw9O;~wJf$x-=bUlIq!kZM9BB3Mc` z!@bW()@zU@>$V1ZVSNH80@W77m%C41q_MOAIKZT{m12%2-M$5l!u&@k_4owVDW*jg zOPB~C9<3vCKYZAlSk|>L6YAxwf0j#MWOgi~r_4doPpyeO~1>FWe;bAlT<@ zKB$Ol$@HaVWtLuEC+|+r%}pq(s>aKFkQTsy{Tr)VQe5F-H)hPJW0Mma@s){xigSlX z5FW(#vB^r6=&*Iy8_)Li+{Cq1>o>91GVW@^!+KOTJ&X3i1p81Y3k1n6XiwFxv%3fA zEXP?TU?bWFkW;LhUSjMo*VpNs-xjh$8nA|}EAH8|CzwUfQ#gHU+5z-4eGuxH_fa0s zr%xjNkOrP!SiJ{;^q=+&$dL}3JOuPLNK}($-#rh%c7aQy+m*?^;C|N+dPOphK_Qr_ zJ*tb@y;djJo%+?;z#xpKL{&q>pwVy;kKrI5FE&$G$xj1IVye%BvA6Lf-QA9zykVEVhWm*JWWXH?`@AF21EpV>a(T^=e`sf?7+6=Dq4qokR8D6s=xfcw%B#8Q!Jed3tWy38xi5kFsyMX?ts`0dv3mv`G>(F4lhUz+Bg=MU9>v zUErTo;4bDHLx;wpokQCnZlOPm;Apb2`0IAfk%w$j;da3|^yk<;e)Q=4y$K_tx9M!N z-(5Rx^n9RW84rVPTsLCY;>9zMyIz`euwkP{fHeteoqZ`v#n=dj)!I-l@54(ut; zvv>gNRWucFSUiy7d7J(?W0N!oEiSJ3o2ZdcD9oU4fZ!c&6jRNT#+pON?K7QjGplfo z>bK%~mKk~61%O|{dhcv{yn+5-y8&y8vDozK(=`Sxy1AyVT8B^wG{ZiQR|DufUow5* zLaMhr;j9J6dV2AT+Z0{DDBOYv4nJg5#hiuLuP<{CTki{pQlXY}E>G8ST}z6s%_%ZiE&oqYku7vI$1R z(*o_%YoCD}%(LgtRX@y&CU zCKZZsv%K(Keda1N)peEa^BIm4f#+bk1hWeY4z6NE^MaScAi^!~D1EWQp~Sw53m<)7 zKOR{Qf9HQ(x~%C2M9L#iDA@?whpV;j-_C?FQ#Nkj4l|oISP- zls5wiJv8NnGsJ=NY%UiKK20@k7FZ7dlMSJ~#hz2N7}YVy4pMdmlL8NtY;$}Me+u~Y ze8|0f_fCR-(1F4esJ3eL^{RvErjS1;IyM?!=SBvQLKx9gTO%ih8_D`y(2+zynvd*f z&$Q^U;5OJLm`%k3-wj$T0zC8~{C>IE%yM)$>5s9FfHE)__3oz6xBYL~Cy9zchE#Ln z55%d<N$UIC8(MBs53J#5^_m~{e&c-z9!L~Vt1fyIUR8!|M_!mmZeiR zknd%`7_q$>Buci@K(ChyliCb_2hj!!lf$~YB)i|^Vwb~A69&>S15gmpHcF)6=5I?| zSVN+c_HY$f^~rRK>|V?=3W@_L^(cTIo_8?%8e-Z_EX>J8;&uj_%63gLq!(&4cF4-p zu~j1AA~#C*WCJti5Kh|NP~4!R90AEE;yaj8sL|Y@q=I4G!{6E^r4?%jq)xkd5qDr40ZL zseLxVkifWT(Qy@buVu^DB&T(RBcw1Ff`G&@+Rg3o=h&E-q8?2H!GilR;RVHKelei- z5%fb}t#4d(s0Io=z^gmQULx$28j7`v5`#EcZvn7Dy$y@fE^kY5zjwZ0yJj+5`7*n{ z^l|n_+c-ElP;vLceB$LrpZ<)eIWvEure;o+UR70ffcg`}Cd@bYZ&zkK_*H2s;(ok# zeuWcbEM2--d(W>g|BcXonzFh@>22Z%xPO4po=X%X`5Z7rG(Nik$ZT$(c{KTHyH~p#XK(XHPnw`3bp_z!=KG z^`IQtA2rd%MVIeEfh@~*WVD%z_wBtyP5DVq7gp^eei}3TrKzR$3uyp!`@g*yjGz8t zFjq=`pqEH$Xx@L2?m~b6K_dAgJ`+3(03OJk0#FO7;?lb}-XCBp%($3$$(VnWU(4k} zaCC!Z_rY14vR$O)!M0$^&Nt}N!r>j*7wkg5g6xiYzhwsmIb%P< z($KV2(hLj?n$$~IuWrDpzaH%|(NYLdVxI2c!J1U3h@!ZTj25h?QIn7bq&A*#Pg2w; za+0zCRw#s6CC(;gi_<)iaBsdkT~!0KvZ~A(U7{tM%F0r}<|M}q15Uyp1~Z$r?-N82 zUIX5hA3aK)Er5s4E~V4@WO*4EIlr4OCS}Fj30dS@m@~5VW!p zgpYEcJVsI9*^aZ4SB+C()9({3XDzayT|R*jDq0^&1FStPvs2~nv>Uq0lzZN>XU`8! z<_}^=Gys5r-Bj4p7w}b-Y@T%al}4?GP#abq?}A7s1ZB!sR@~TL3|K8KQGOY1gGz@E zn-GD6#Pm92wCi=EwoLkq^$%ZPVea-h0Is}cBop(Wo;48E!VUIZ>$JEwy*9(nU@r9;{Gr&XGTUBv;%PM(*OfTW7+`73Z*@}{ z^8zLy>mc*!Arjo=1EN8%0c8Go&_{hI9U%7tt=R#pGPAS6&b0Z+o_PK zv5A^O9G_uU;3p4K#iM$pOT-+EjnGk?T=7t2F1UT4IZ9AX^Qh6wt}aY|S3~@uL^Svj zJ3n9ohzi~queCB^1moEH3q0Gz1>6H0oMjE$n)hd^FFQMf7_wOV=+4>{p z9A+_j6#4Q*xb_`cF3s8M7=0ZBnjF`iz)#!yU0@RS!O^2eN>s437){2)Vgp!- zUf-I6W4*SIldZt=+c{%$OyC?#KYp|tF=Fk>%s~NvOc~|*SySUnIS;yE$$M?jk;V-5 z6_+7r!)x!6mtNl$Zi)MRiAfUM9s)2qi3+bo=$Q_i6?fBkqAsN0^TvpYL-u5PdMvF;&XFw0YK0 z@UkL;-k>w75M*_z-uAh@+esywnwt7FYo$P4OccN=AT4V_m?3o41*QEgD1G?%FD{UzrLL; z+$C*0Xl*><0Ljf(+J9p3jrN_;39hRBR%HJFXgUwLp7-|uhm4McjAV;Si4&3(GLr@w zk(He!q$MH}vQkJ{Es;8e4xxptN=QpqSq({~gpBC_yxhP4@9{Xl$9><9`hGv3_xl>J z>-BnFC1#s3y^%D7pJji;-H7fa%u}0daMpwX>|QaAfIkkuhS~ouY{VhFMWxuoc)c^z zD_I~xfso`<(hT;aX8-Qa+VcEp^r6g0QA;q3$cHZS z+H3rT39LrB{QADgx z$;o)y~9z3QI=oFf}ybUnpMP^WI?vBpX4Tr zqm1psyVJXuS5)jGY#`D>!0ZYyPF(6qe%MRX8+R3-eeJnx1)x~7W+^F6Za97U~7{C{CRv6OiU(_B%P z3rxaCXYM``P%`8vU_^cTVrBZ4wAY6f5=ROX-{4aLzM+APjvixw?j!JLZZ;?m^E z+hFJMT?+nFGhz=`Kizv`incrmLaq#xo%b=N9SDn19FUoKJM>^=1 zwD>ni7M6waCSF+FH!Pp=bt~ZY`yI5oA!1CC;3k-VwFJ z`gNPf>jX1%&Ehm{)A+M?9PHn~spt+t!2z&UGDC6+pIjzBr>2*^H*H&+Mim2xN^~9E z$%z=w(k~KPm~mPV>ZpW09bJ8?kFcB(C=f0&0c;1edyx&zzmL-_)uFV=ln_e6f5}h+ z9FlXtkWWG>?7Jd2s>Rf+>(?NCpKNPeWF5PU>Xt_4c3xf}HffTzxF3wydueN%yL$wytg&_=lm9(d*LE=~cBHKepC1=KYlEI5%n1|OcMU%uhNA`AJT z0+Fxb)A2{g=%I-64Uv~FGqxw13Zx~JChmDer@?BUdu`FnOr5a7iGpDefdB&eo@u8{ za7bRgIvf6+aBx^kuNruP{C}InBYF_o_z6rzrOL}mr>|@JQ-9#Veej-Ny?uL!e`$(# zhspILX)T1bL9iOtHivF`DVsZFdlnZ~DK3I#A&dyt|D)6l`b1oh+$J@_Qm38~6;S`o;T?PZ8r==%V82Rh7^$j1#<;!=G%GJ*1 z^Qnm)XI;y)c(nxW|7hi;>1GgQh)RRdAHylXLIp8E(k)-6#~PA=`I(JZ5%|CqD%aLLR#3 zWA`H|hbOVJvbUm&Dho+D$wDfiOxNn)|BP+0DMLNJj0C5$(?%0#tih%vhF>FeU_Ng= z+xd`jh+Ad@eyI}xHMTkaH*@OK6E?B3fQ8|5FPM;$@%$T~g^B8{ooS~BW{^(3bGO3a z5M(02QqGM4TR zW5=(yeYIg=_VVLQPW@M}X(F?4>mg~AW6`l3pLZAO8 zH+q7xAj7$v^?eRx%EEMpBa2v%BE;LtZ$F1XQ=rP4lJjre^iz2ee{K3d(k5Sh`J*$P zA$OEQ-oClk(`$f(ewSVT{$hS7Wl+?U> z5aVhv+pgLn-r1ZU{`C9X6MNs{lm^#GY-YzE5182JR$*ZX`8gjaTxt%POv}53Jkx93 z_7F4SFKka25<>!`02L`4vN{VY zyKO6a5y7#E0wn;kkkwCYVREK|fC@(`R7yQf@@?s#cH+c|Mk2NV0zZ{=Lip|IYl4}S zxNwIlPUq|TWVlbve}+~_UEgeI7k}*Y2M}>~Y~HLOUGa^nYnkoP%~IdKri0+jb^s%c zyldWjzw@V3b54PnurPkIr=Vjhg&df@M-%WLYIKu{%3w4#k;D1}0)lNWWS{%}fBIy3 zfz$FM*~xTyVSCOp2cT}7Nw%NF0bXt*#AjYk6rGxF>ZUNjHY#T+ZKy=0E=0StA3A}6 z4A*=hCUjUoqOn9K+6yq$rbB$NPH7Q1nm5tSczqC{4B6Hc6(K-|-@u`;p^31-*YG-| zX~0D#le3LAtR2PFmeV&*DCtG_IB-1dlRe{>0os;_HU61&bzS(S`Oi>I@+v8d?m{&M zdI|YYckGew`JiYLH0XMKqbsD(rpFij54@(yQlDMi(mV_(Ae5LfGhljNDz5NERBy+! zXwo(*r!1nOK4zbnqkb2cHEUF=3S-W?WIG1FfTMzAZ<6tD&|2#0jZT}bQ8&lh{6k6X zd)hMJxMo=(Mvb8iO%CK(R@7}7Kw87Ohy@lmW&5DXzO)XCdYPNM{N0R$^VjHg>((Vb zZq~GE4H6<|kYeO!==JTt>LNa{3>=WawmrSp*x2~qj7y`0bONZozWB=QS+fT68j1MA zKNQ5C@|Sp?wK8_~7DP!l&r zr{&U+W(?4%`r(1YlQ>8yXV%#~Xz4cNcghFvm2I(|NzQ<~{0ba9bmYdPWLIS#H8}xP zbnuulV`SPQkPfxZ>%lBS*k*qn>Ng)4buat49tzr91 zB~8J0&;N_J5>&mReH41{H)G1L5*oPIuognq# zI4bK+n>GR3w0OK2bO|}I^3gSY`t)(FDl($_oIuG(Ri(0}XP@#iS?mU3%GW-dT2-cs zgxGu-RW!;X3=mk4+MUB$4Lkl71U!q=U7-V!8kYeT%05~&Xs zJ7>l>Z%Y4*t6$FFSM!X%fC;D25_x@i2rxB##duZ}V?ynzsOW3f<8;A0*UtZOK_s;? z0g^4d!21q)QA*@HDFtMa9YyP6ZoOU9(`V2A8q?-L{M$)4^YT7j8q(*n<0XU;hi8oH z&>m$u>9k4ET=h+D;Mx(Q8*S6sO=^{CiP!fF$5#E)Cen-T4L(E49XoDEPECbDGv9>Z zdBf;1aff6G(Yp`ROXqzdp)EwsNEoNk7rcAS+EM6$K&$xgrp(-4DGzC@swyig;kBN` z1UWG|`2wR@*)k76KjrDMTnAbBvtZMA&0Yk)K0Xj0@9 z)5tT8$168#Ycj@}o!h&2&%E95UA9YiRjoTST#o5Q6)SX@-eIY_+V0UlW1FAY5T`L| zllSM4CF*mJDXkCRo3YV$+gPi7uaOaM4}NZZ@$t3^JGVzODd4QxgI)<;kE(zGjQO(i z%N3rUNr_tIW;UZ&1no+s&dgmw4C|iqT-Rzyf@8tEi<%Enu_an{SDM$Fu>i~d0y$3r zd17WyceM=ViKrK8;ddQSz{3V)UKYb0tJ#JWB&o&2?K^ge^EI4nbpimpI^2#H4m&pw zEeccF)P~=~g>*((Lki(#YCa+3x6njN;HgbvD*Ofr$ zvZi7k|1g+dNGIHX&PB8Oq=bZoe>Gk?47|p-a7kVYGHX?L2{XC*8^6q`*@z^e8V0S{ zLC6e&$sJL#9AEQ3l&vxv$FnOYDwuyCt76#D!o9_MVM7@v+z;k- z(PJ7Y2CvKWqj5OHsc+Jr-3R|a7hsu}Zdg^+_N`+h)eu_-e!cCk=>7Y>m*v#Phx*U9 zJUNZcvfpZdJVRGAHM(kIw~ujI_EP*SSQ(G(#zRlSx-^l0SeATz=92|RuRWsIgs@|m zh<1Fz*_8c_Y|WFM^&myEz70liBjpC~YeyfA`SSVmh!1wxT^dJSyB5ya+LaUS*L)d% zYIG=GpE9**C&gcVf7_1Sa4HeBV1rnH_?pmNM6aeG+n_PM+4-2jR~(edq`ps|XqHnP z$lNwRF2gCo4NjyO`Ca?|rYo}uF|!6NFGWSL2u1djl?F9Eq|<;oEZ(bFrU9qW85wTe z8*smQMxA$b^F{OKb;qV2TtyGVSg{_Z(i2*{xa%jePx3n%!xK$z*o8jXu$Q+%+t}?Z zOl}3V^RlN6+^rV2Kn;^zh!7KNUND1aQYRJQ_;Eur`W_{b*04ntX^5BT7*h#PqmQ%s5dI*9eHCLofopy#lXLvw)*KN?L>bklZ3Lub|DO0Du4w~^A78&Xs zMs~foo;!19VrcR5IqCOQY_DE-nA7-P*zB`55y8AB}qGke2VfUi?H-@rgLMQ11xy zi~ zNFT^Je5~PL%=jO~H<*Vk>oSOHhlj7#rIqV8((5o2TRiwY@9wXTZh0hHckQ_MmN%xZ zzLu0&X*}kvjbw5px07bierl9D5~-ctOpkXDmEej1;|R>gi2Q$~gZ|fEQuW5es|71c z#Kc?}vBb4M8VC{QLIZ-Xa2s0&mWjgoHPj3-H26%hMR6krx6I0|>pjs?fpp1ok3aJ^ zl0&`hl*@ft${dVU-M$!L^HQ4WAB=Vn4Zxza^ku{Ep@{lK`yL)%^-y_6++)83Cs8&s z-ujPSBrfghIPiiSGF~}EL}j&*S&ob<0Vm$D+xC~`n1@8(+*>OU@BH0k#9<aD5*eIpvSZFn8P0(J{2DbHMc-OR9SP8j@w44TVH_OafN3 zmVgC~I8>kdFeddUQ2ZfKW&{rh+DdCy7+CZ6k<3}6^4rrZP$EaKB158u*r(t_A? z=d6P6yC{Bf!+HFbU4N^2umGX4$rgu{-HN z#4fDE?q#6+tG*ucV8@foyVdD$Cc3nP9YkwTU0X}#>zA()U~-OC52Q4<_ne@(<-2!| ze~KI`t3*R7@qnI^2m}hZH_YIob0J}hb#Mz1qXdYe zC5YmAK)`3XhFi~@=MUqW3xA9q5a7jRClIv}OMlO{wjRgE3)~r@u*z^`&_@!tG%g%y zwz#}|IMd>f?oG=|c}&TbdsE-M@d|fSz2`EG+u7dv*R#?H)05M}>gwZ{j}3PBB)J_3 z4)(?Urca+{Wc@7r_Q49>evNv7JSX{L#NK|8et3VA=boDy7&Z7nqkVqv$x42)eFov? z7t}E^N1;Xi`R}fD-!XeSHD?G%DJjG%#;_C4+O$_u@g;GQJ~r91G3?0@U$S7V3UKr%pQ|>PUr{TzPH@ zD-x`I{QHGi!5_GD8r`{6zh^H`_Y6UCFKrO_CT&@sIO#^pi7&s!U>G!J0fL zrmf4>e~x87s|V@9v;Ija8oO}evBU|O=kA)MKcRgxgA1YD9doJm0&5huP*CzW9#LPG zmg38RZ0N?qg>*&7HT=^SxAmJ9|Mb29eAqlYpoRE$hE&mk6;K6^nnW9VHDziFeoJwO zdd3|cyS}E!>;396ntq`q5u9Z=9~JzY%Y{y2Bp{MQ$kMPSbk`m5rZAWHE!1{pERSZrhho4@b@zDcP)ONXv;iD+@fI*Ah!+uf0%Q{KmLjW_ZkrZt?Dl!f>xwXjQ zZ-sdqK3uXo63vAoHsR?5C%qV!;xc?XcoexwZp)ZGnJ^B{@3ZxUexq0Jb52raOD=5G zq*+eff>8-=wj^5Mfy+aMuQ{&2GfDT$N^=~1@gC14fTTox6?7v;}2@nyRP18-AmvcnhH0akn$F#5F~4X z`F7`pOyXzljR{}B8+yqWF=76*LRrYqSAJHdfQF0nKDazitBaS6L}ue~r5Q(N2MZn% z+-y(bUi7~H(D(l3IzQGnTkGG`fJ8?l)KD)R}c5z7Uvpg><_2I0+blt)!AH5`R z0+tV=H^ca28E_k8s#+1{z|U?qvQEXT=uDP1M#VLaRx8Ul12uEUf{%+k+4 zU1^n_K}Ntg7S@haLffVKT}W3dT~D1WJ*{?{I)i#sOgex!cOGagh%>bpahq6)-J?3h zIUdel`eYZ2rJQbAFpW;`xJ@i>8)cZ~DnBlOe=#6DGhm1fwjGo|8o-W=UsO{zF*x{3 z-@eO^ZQGogWRnxAhVd%S9aTxoF4!Y9g30<{x2G=*xUtar+4Q?vSto%x0d~)u@)qb2 zcIr97yR{>#U?Sl!kPowTi1)IYfpS%RdPF{t=$REX{T?m<6B=!c5R?%K86r&JxWR`P zu_pV#1%wh0Da^(uq6~#g&3>#IGgRO)u{m@bS*RKUs*vs5_UtL-m(Wc%0oPO~J)XPF z8bf1Yv~$@|bxEg4soB0u7Z!rv1p7uhMLkZuT06(v1Mq`MmmUMsaPQxqBY%HeA}U{y zB%9daefyNB>jb|o?*Jvv!9ly9%^C5{wq5&t&GEJ)^dG2qYotSuK$vj5hR9@>>(HEa z4Orv}r#N(kr^qB-Hj2e4;1=_7={e!23k^t^vs}TLYkwW`JK^oCK6)PUbm78R3x~h9?zegGd5H=v>w)a~m8(Rmhc+_8}ffFb0 z`L+?}B3J`oO;t_>w_b*PtRVRu^kXj!q{D|hUAcNysZ}fdxv*-IjZqZEN!o224TK6P zvl153(sh)AFxk<*3WWeNp-dHJD-$a!cN93v=p0a3JlO&0op99It(fxHpGSiZaT{6mJQ zz-Hx2Jt3WTWb}Pcu}VheGHoMH*T5K zv2^PsOQ@6+S*a&R07!FGG>d8D;1RK8C4>%$xOa+L!a<+QwPo5V>GY_3Wr-4h0_7o! zeee=DUvB#8PxpZ&NYkL-ULN0%$A(r1iT^HqP`_3kCXCuF&xZOI1~e>pzBZx95Dc2e zgeSh+&rc*hu(Bzxgz9}hlGSRy$VX*6A+bnYGPvUqqBe*_I*sRH+<7QEj6RNE#T*@Q z_%)f{6yZSW9RTqzM$s%f)=^PW>0LR9;X0YY@A?Cdhpf{SLNQz$ zW9|%Wik(M`_Zolg#Q1J8)d*jsZTIezEG+K!{j#e2s0lo9PJ&1d=A3K$Pa62_qm@ zU>?S_Xw{c4ooZwArh@__eR>f#k{Duk)J!Szg@}FSN>SfCl{%9KKMvV& z4wKSOBi0RsBQHe-PKQ2{To7_}8m&=9Ww^64p5jN02WJo*;l3~&j;EGCaxa{MWL8lX1Wadlh^ z%vK4+XaF`v*B75h0+&YW9KT#=!sPRV&(G>F9$Z4Yh58}!oqlYs#guDw(OzGrO8DoW zG-&x$D1r+!R}cX)^*M=NdPUepIJ+p&bEztI#Rp>{697?;$Pz1x0=Aj>VLeMEtfwlH zK?4t1>iYf668Jtb)PmUQd)VyeXIEbInk%F0eC%h|I# z54cjj<#0Z@<2BPubI#7y+GdtlhW|Q?T9?4PIqvm_2&!Wd_ky-qZ{WISlYVZ@+^|C< ztY>G1q!yfgSV;oL?(*Ty#iZG~@%@UqpdttciLlLiiPtB#LW5XhgZIIM#J*iScg}3m zW&|s_lkZreu)x)vw_w98@C`e|KQGPI>7|{^RS*#`1ZQ6BQB+C zn9KAhQ`1i~9gyr%R1NiWPeepSi);LgHQ<4tWDgQaXISt~7vh1Yfk8)tJEIpS+oXja z%j!F))BErlg_0naOS#KVRQz-Ruz)9J6t6;1`pzzhq#y5MMJ5B6CuZaI*y%dC|5aye zSN%0oGmK=JYya0}0|jQT5xIVOu=-jljy#Hu$}<`OQ4h8<9EWV31TLIn9rYq0^Vx z3K{_)?>j8arq@>`JWuD<-eu{89A5EYV^&}aXf$a*TNuyS^kZXs|2sq|53te!BV%~k z5~E;&$gohp0T+B|k#iFXVsg=mD%9n>OCICW%N%s~{ZE_;(VFntfP|TwZKr0=flMNt zd%7gy_p<*I#{#3^5~J=^TwK9*ENc74wz)(Wm%J^ARgH{{JU(Utl^;MdA_jjNB zN>7h1TOFzaWF;&LkvDDe>x`b>xE~*zqW$*C`4dm}U8S*;$^GhU-}^`tNYqhY!Y#%J zf9HiR?D|`23dVE*L8af%keHa5#0BUM3YWW0gL!oQq40&EanS0+Qf}r@Ij(JL>SQH=NVQ zGsUsHxlKt7TD8L0ZGjSgo--{3z#bdk4~n@kYtp@1DOq`+D-A;4)_Oc&^H@p<4gq~m z@%*pL7}W|t6@a$7*l&OckI-3@61;v?#7L7yVR7#2*Ez(cO*b0VfEGzm795^YC%P?& zZ9@E-b9v=15*_#86;*W^O{J`# z=v0SlHXz;H*;XBCD5mVY+D-P>t&A#g6jv(lFEigB4p*9UCi9_H0I;F2SM~Q}BE$k? z@(N;uy^LiT90~stunN-OcI!>1RCLQoJ>~VYJF2ME@bL3dt@l{}wwEj}NT2^tz>9s@ zPWSD^|J{Kj(23th>Y;H|=6^Uo-cJZd5Fb?PG!A6S1}B(+@(bwSeg-|(>-2YVR5-sD zG92jFu1}e*iKucDDNpk_STUYwKyJ7WSICYOaFljqpooeO5%hMq!rM`AqNeLS{~eY5 zx$angh1_pUnY6)U8@`cx#c3wzNl!=Ihg{D(cMQ06%xkYkMg1LxJL4U@c&;&=`KY0+ z`0#sRiH`$erN=Z8=4UyZuXq5k7#bW;SrzK zu1UO0j9kLQt%%4?nzyzC(+WByrtA)Aig^|%si=5m z9eMU!^jRpq=fKNXuNL;P3N=GU{DgrmkqLlj=aOoAB;FfluBC2|o__iCX)!tkXq`wi zoYUiG#ukWdMuepFv@yx`If=8doNymD`}GqOOEWX)qn{^?AMYX?4$0)y3`SUQQVD@+ z<`yN>+5Kedy~RAGm|yXHO=T>f`GRR1APnmcHgs;dzGH0U^?Ua$^|P-D zZr59(V%8qa^#)V5LND$ABi9g6Mb4EBXK@@vmb3UqDp@wBe}**T%!2{POr8eu?Oli& zRHWmND1x^Wd*GMgJq5XlgZjR2tAY7>d7+Kf=m!Kmh1q|e0jU5g{rg7&D+L7yyWm<$ z=VY?WmvkU(D@^8Yu$}H61=V=FY z_Zx+Uh0Cpr&ie=yeeuQ+T3%VN-gWhrG2BDm0b?rMCd7xrKA!nf%bLMqP<3TWD3~b* zN8AvUaC-_IMNP};1fCv`7EI0%Z%#yb7*$$dP{;Xe47C$&EM4I42xjViw6$B%y`$(C z7b8Lz=so;Gt7+5nG?#bs?i*HhwSNOy5~1Psf7iAuM3j3Fvu#vsWRueO$4e8k{+GTD|^ z)LAFy%^f|PQ`05GUN8U>8ooryk~KJh&7$X_-TVh~Ytv)koQ#xff<~v7%purw!!bgJ zi}8ksQG%+;UFUU^oz~0f`A93uFwF_J;HG>$c~7v0ZqxkSgNwoEQTDE5*|>|&7uS(O z-X~1R3QX|gMNA9D=7ux6f8&RB3to6PY$P|*7`G4c2WGSv)f{>;!7&KA$lb>>PsKSy zvJ#v%m*hm62GL~5Bn4vKuwa$5r%pvOePuuewnC06o;}p-n=^{siVhmiihej_fpite z_zH#lxAD?QrYR}S*-BlW69k?aaZdjSo8;8-)Ki9rGtcChu z_|;U-sO&9ufA??~E$Y6I5K9m=KA40YGD0qi*rkn&*>{($|IY;obsXLu&10@=MK%ZU z8>p^$BBECYD>4u>+LM}E^TLi51Yv*Fuiw3j&*wDe=^~P0@ux9Tu^JkTTK+;~f2EZH zYa%tw^G?2+KfH~1`*XVI^WA%UM*hCi$XQo4*>g>=RvA`x8_J(``%#1@2+Qqv-R{@sf7D`?(iA1I{yU4}JWY&4p6>23eGOUM&ys zT@4~*^>o``%=>)w;-B_^cVxJp!+^B57Q7}wvvbYzo*Nj=8y{N`?h;w03%HG-t~ffx zi9MfXTeip>5p!Y!+U_$i2)VLE^Ic`-AUIV#&X!DCF++_7em$6q{zSt0<*s4|m7V!B~b4lony zvFY0)yp`8KJ1`W1t8IS3-^(59SNhZX0>#O6j153cEn%+>qNk%aHOX>z7}2W^gxjTX zRYDC_ome$U`4tx@?)b$$Tp_+R&H?(I@BM2Hk=ZIKh7qwdkP47+{eww~I1iY3oEh$-_&CenExxXcbNSCGgrg)O-~*2AP0rNq?Dog-agh@$ojxUR z_}8T9={n|Ercg4B_?$D2CYLLgHm;3vY0%Z!DcYR|E);r&AXINa*_MLsaxkZT?lzq4 zhbsY6&>iLB8(MRW&ntOco@Tcx0kgZ49rBK9RTzWqJ3o+RcXhlW++oHuYuh%jM$soM(xIWYMvE zu@Ql|u;h3BcYJvxfL0-}K!A(}A%yvjFZ&bZ5we>Rgi4g*OyG=y6J0v#J1AFA$TrF_ zPU9hPfSCvU(T+jjz=0#0Gz8D^CfR47fIlC}ankz&l`<#NqOYkEiC7Ie3oQl`lFl{DL1aKIe;Vx0r26TPA<+ zERqy@DxK+zM@1@_*bC=`Ps)Ek<3VZQXZ`<$F@nHdm3sf(>c1gCs zg5wi2oVF;ts95*1!{@?ygNBY>e1wrO(Yl+eJFv)D<_1fz+X)wMAt_Fv!*Xdms=096#ibqBw+EogD2 z)6K}p=TXFLe;0#Powie5NRD8Oy>r}#Q9qSIJrf7E^DH2JLVEVPPra$HWCbe_Lrs5F_yg#9`}XvzZUo6|5spt*-Z8-AlKB`K?fi6% zqfXFKyfi0k#>{!XhYqPi6)ENi+_-gX>ysx>TDIOa!^XxHVhH-9TjU^&=H4wYSC^R1 z&tL$&Q_U)WlqEMCE)3H*w$3pK7rBKTG@Jo#N5p}25~!CUuDb%mHzqV^Yx>_0=&Gj{ z#{eIR$@=8U+1BCe!2R_M-*BHBt|^S1fh(U36o>*y8VOG%knM=->rJdm_FKg*f7v1P z2=|#P81N=}eCokB7~Q+%`qZ~P(j?re7HUug++}7TK!i8$-Sgvu|DS1ow&Ba=0c&=r zD4yxot!&47As?E##Iw|FkVp!`!>grw6Y4`Rsh3VuvAW@tRTgi!RL( z27)Z8$4&~$!)_+T;*d;JnTCte((ZGIx@#&<40)8=&`&ols^IbCx}fVBN%PBHA1+Fm z)gSy&)#2}v`X`CSW@c*4W2l9v&YSno`e?%+jViwUa0{@EoPv4FzayN#3+{%P=xQ`2R($e90pqtoDGm0!w@zq-LLAp~z_q7C|DGP}px zH&sjD*=F6lS9#@bOz1A8b$~j}9$ZO^ri4NS*v9y?^2Q&ZsXHu#E<-C-=elwku{%mD zUr(+*zBc+TkLH|IVh^|GGZ-pAH=Bn?G z9d1;V^h%)y>LFjRB~GD85?YUT@ZI;JM{7Wn)5xg{?H zl|VEo{2oT5>I|w>W3IuA1PPJS4RpdNxVJG{(4hR^n-~os8yz8O3TS~*BdEv#&vy6H zoM)W6;+A>$uIm@&qJ!!;7J+VB#b}+pw*s;$Te!P3CxP&q38m#bmtET4ne)~Zcm|vQ zjA4G~{yjPl8`X^w8ksX}H+DA*{9LE`QCHPGCLcecR}a@=A#hN)+y2j!r_G!>0c9o; zpA;DY#`cMZzex_6c<>|DgBlgnK~e=J=4AV||BL@3r3dna!QuZVcZj*68)cVSakp;F z5~CwXTV%&rLIS&eeZdWdb`ALCmHufbJXP+5?Za=`qJmFlGU$M;R0V?=^ z{1uV$!7!~%yWcxQ-|}ysw!5t(U{Rr}+cnLxDzPnZdMj^7+vlAwh1)!1#e_G8A1=XV z14=GBUX=54-lR$X-)xxz#WT;4K8wy1L?`9F+unY=PV5Nl=SegyFW-^2*rmcy!#q%< z!qqu-Mw&|c`C}`OD)ku}cJd8#TG^4z=w3*|3xO$^k2hjG4OB$|pL$O#uj+PpJp*Rm zb5|WS^JatlV&d6|+WUj)7(cz*+9nSp)m&{)?4O*xjs2Ob0S@b79}vE-Sc$MiXF7Vx zD7D!W>gtn<=l2?{JNe_pMx$n?bSPV@o9;Wp(n|F((=NgAAm0J2?t*3VwtSI(7Y4n? zOR8VHdVl=OxA@}HQO|u(%$zcA+}62G9e&pzfjsE?AlHP+Z1#xSzh%C)_JwDRZQPKp zD9Wu#U8D!v&E|CJ%2x|PE8Z68CLL<|kI@Dr!}Th66?SSQjavJpa9>nE|DX4t#Vz!{ zR&%FI+B7#_lyr4)ajRc8{FZ8Hr9oF(v z&({Bxb@%Sg#pi_u&GBod?-ZI?yWJMAMilATfL2E|)HjbUu)w8XN|>6jU;7vsJSrG> zWid#^(4W!KJ9acDnI4~gR%4zMgpT8Jx!kP#s5C&87ZDqgjTW5RbI4sMBYo>|r_rzw zWiX1{+^}KK3U0Y{eV)AL1f^#^151XInF?luozGay=64h-qEiQX7s2PJ`0w7`>e{Rg zUt$qhIv@C!AgkwT@xS?fRQ^BfA3U659jJSV&X2tx4_LVlHbMh;r(m4xaE>P9jzd-* zidG#k`LPuojHS1t9XW$9ABcdA9U2c54X?-hw~vlogh%mb%Q_bxF9^#4S2ccvsV*n) zB|5v$Jjmlir0$V&^{K(;NqyP_bW>P7Jgay2Wa@y7Q{r!|72(xb|7+@Zenk>D+^R5i z{;(O7Cb2`Wt?ugie?M^hJJ_P^QFi~CIh9|oP{&e?hF|U(;O<0@{ zxqJ721{-AG>^^viW*sZR-a==?oJ2?J8fN7ky**0&ht6+%WH&UJ7~tm-4fVC?4?2k% zeEQy=11zk}${*$Ay!zZN;pxglzpgnZ6qXf@akSyPdf`MYX%(X(ndtgSE>AtSNvFXM z-UD-lt+oTU8nXk_YMQ1Wo3c@_9W73#y!k+ zyV97Hy^9P}Wm^cKr5HaD7T+-Y7GHjtVh2&JDln1c)_?FogL+GE{E(pqr@@kQW1!COLT+y~Ml` zz3Vg{FF&XLv7fhCBSc3xgSp388WP3YFZ&eAr`g)aKlN4LuTkNJ#53W2u$Fn1S+mi) zfvCmL+AO&=ha#IbVTtR_0yV;X)kDk=9@+nZVTf=;I1IkvBC$K%ZgAwNy`bs8I63KP z+;koo!j0X{GP2Gu!bj4d!3Ebj{L%iSGXR9zjHp&1NkafW%Gw+(U}JZbJ)+U(WXG)1 z{b&)OhE_cao+}e5)xBncQTfnuk82%!?gU3OCF>W20qR`ZB)wVM<}(%6nq4Q}_!c#~ zVulSnm<{2PtVA5W`@W;O>k>VM-eGb527Sv7`g>FT5R6(u;m_Eth`$<*6;w?AkjfPn zfpYEWk+P;$efW5Dp4CSEf{V73+?uY|H2<-p+hcs>)7WNnBKK`^+aZkK#Qp<(CR4&) z-;gX*E|1#eN9K9H`)1x7k8?orog?aQ)>a+=D-n!%BYbP0ZGdo+@^ z*qSVON?-4j{&y7&Z2E0pm3iO;sMX=%UJ0jO$MFUlXEB&qy4=d#bsQO#Ck(tTyV5lW zXjY8K41OTLtoMPUl?L}NGzu(D@88kSa_BmM1-8>Emb%O^cb&=B(O`>$Gmrm05fuOi zP}j^nxv~CLs}skMgL8SjcIaYc@lF94?~Z(zK^ewTmoGB~dS#%MAA9<==-U*;i{tX; zM``NhxokM9h;le7Q+JsLM!5;UmcFv=;l(r5;ZD}KtOKJ)iT-5PEbYc>=bqSIoYnt$ z>N?9Ria5tcyh(P zXh64Ss;7Oam#p{J--uL~D z_E{cVetlfCQ5u=XPd|A489D|-L_73(t-~-QrIsyOv@zsoCk^vq!y#FEd5tg#X~je8 z@AnroUEq3<#NO5IR8%xSwhb)Z&cUQu>HYS#u8#!)m!X}Z=O+!dp(YxcVMZ2@JlC&p z*Qpa}u>OY2OSpY(K%e)u&jCJFLLnrV%}+K2Xia4GWXQZK~8C(t$`Xzti136X}I&wDPYeFsw0@Dtkd_0S`Nh#A6UOHc`!>V zi>I0geqJWqPst9e0taYRSoDfJYX$*x+J^>mFXaIpfsq|k5hFdi6 z3YgvgIij4B@kl4*N8MvP0u0Abol-QCjQAa?si}9KdBhwDoAhxmCvx#dZqo)q&2l=K ztvR%i<$~-EH41Z@8*lGlxMy-;lqn!v+T!zx1@+?s&nfCDxGGUS?p(5r2`dr9-06-} zLVixpW+E@R{;d87?R%nr+IOT&VCfr<1h8q=GsW&KeA@x&$_qRCWsRnJ@<7a2IKR9} zP?6hqdP!M*O!9}A@o29^m<5KoW&{oq$}=+;n^+<%cR*yMuBAI;cl0sOYY-KjI0IWh z-AJ&x+15NScwE)(d5tG&4Wwr{)JT~?009?lI-_ioW%szbQ>MHMRNJFrUQR4ai@%Z- zUcr;&sKX&RTJ}Z5JQ;_^E~ImVM*B#nP5j3k1t{vQu%F`@{}emF6z#|lR{YE2BpVqy zrsy&JjXy7{)S1bo?2B+9IOr<_YH^8UcW9c=R3r&1b~~_@C?!0Hg!^yzMR_N~UE|*# zpZV8JMT}L0*ZmUu8ANHG8fPEFdcne(gLBTQpnXFG+`-f$M+zW=4)Y&3a$y!Bx7z#`NQ>Z3-z?5j}x7w78I9Dml( zXlYG2cs)>K=*a@dc?UndeX>x<1bivo&hnt`6ABqDIVE*|tGz4ICYG@kpyJ*CeOBi4 zOp*+7Eadsqe9kl0z)(Q}40L}zk^@m&$*Ng2#m+Tv`N*;K<|3K`blvs4Cr_D-3f1ym zaW2PljMNBA2DkrhxZMLhWoB!0B0ox~r8K3C=aTdliW3(Y8cZ_4Vtj9qB}c!gAKxqF z!w^J@00E;*j+-_!*UU6#oqWRZNcJWC@$ivAJf62Cr~Ra-W@Z+}Cz?QVJ>4d?bJe?E zN>uc+>j0v0m&l*rzEv|NzQAJ3B&Yovst7_$sK4xJ7peA+^HUuh6kahy{PUIW_G+T0 znh6CCtUu;uAuq?zRNXwUg3)R}7OmcD;=998`bCBnLYQgE# zr|;abP5s_!BPzdK#pllrW@?%{KFrA(y=KiN>jMkdzScf@g3@GGf3jkx-mJh%ZXT-R9)S|5bn1K>0{PP?H3c-5}#Kho4t zxpLqUKIwYHrThnn(Cx8b!+g@Jm)F9;g(0VzDBM=by2+mOJE4#lig^Y>EtSk&2gBn5 z7TkG#M@i5!H;3dSP|cq^xy=aFpgTmMHtVy3OU$%c0oF?>83A}bSa5tM<_W(u1=SHO zmaV{2ty;ArP$g`5)P|W8Ga+yzIY@j1QhmJFcUO4K#-67q1|FS?G*cFWr`CV+Yq9Cc z2M@k|QcZeSz<=Eyks9-iIOy$YD`?M_BovDOxQu6CroJq=6{xW*ePR{xS7ZOKjj2?q z3@7%nj^CTcoSpytYVW6El+P=^x|jvJ+Y>6l%Fp*=iTl%)aoxFfG$nikj54O+!n88( zAM?DVrz;J>jc&u3*a@n5A~#VZvUuY9&u<&)zsMl*2^|jiprEBIG%_dA=!>%h;>f1L zA^UbIMaF={7@4+0pcG*zG-&esh??8&uY9`OkE4*d{&3*ugqd)j+4m-$mT;VO5*KiqElVGIJ99E{uO_d+>bc z_U+X-oy~Q?KX<=ndM{2WEN{Zeo4`$DC~@&eteSkmBwQmY0$`N01eXZF7)!+xgU&?( z?N{)^DA7cL1j~`Rrf!cT8s_LG1hC}bQXkXUx~06@af`WyPr6YqFmFX+LY$e}1_q{{ zNS*Dh-OZEtppM4LWh7k;4vk~)4`!b9Hb15f!cqQT_a2s5gf1!*;ruIoA=d zeY%sRku-}6jTT+jPg?o=;-56nU=c~MX_ui|pu_xIq}oKg{^y^%V5cXZt1x|RjrGlc zWT35k!z}zJVxj5NZ$r*3@@NuI>m&q9UfX}(4V&R{i?YtI!y8RVjS|yZH~odx78k>RqHop2`H`pbu4%>lv;=z7Vc1bh32KC4`wH@adr% zKo?mO|I`f9H*k8^u=h_mRy}$Q4)>m1eGfkfhCa>IbaYP7{;3#d$uVlu?CI&uFowbY^V8erTQiS_j4FoQJU*eFaJAqB%Nid@ ziR<|5M+{whQxwVTu6(`G($AtT0$_G4tTH zz^K&GJfZzvof60NH=u3;)znf~ANT0vK@C;d!>@Ty#kixj{WY@NQW4LTgDhJ8=5QWV!ECUx+Ttq&fif}Dy(gn7r4_+@(y zXLRY%q12}9VTAki?9hF;KV6B*iBMZ)@WwE5p799t9}}n+gjFXZDU2f+?#bkiSmf~~ z=fT~VFC&=tV$Nd$Dk@Kc5{vKSLys>Gl<-N`aj=AqBx*1!-4oH#reC`UM%BU;LixZB z&4~Z=Ly)5*XBi!C&aA)sG0g&imu)$at=|++wag2){DPKdRMopN_1$4Gicu`5l0`yo z{hLECwnF0Z=M!g;Q;Go?aBuDjpIZSSli&0PwHvIjq?Ie7bHTe5X7AKyv5Xo79g6z6 zS;L$Gzeves11mE}ZbLOB-ytiM`s3v%`uKEC1Mfw~6X=T!D(RA3?U@r`-8tau=XQ+i zd>`JXxRx%%#~URwKK#5)7S!t8M2ZEUl}xtTxKgW3*Wd| zmyhP>Y~9QQhwFu8k#o;;w`IxK$nT}?ncGZ~DG6j8-apOr6dM~;I0SH|1_HlawH`o2 zq8my8>&-1-q#}Qj@I;$Kkqqy~eA1*fh0T@)eqKv2HybbW)mLho5$hPjBY1##`1({# z_;Cb0y2b{l(WQ`g*_eH^uyAfrb|up_(-XN%O9G?3Pt)KFCko~_K!7TNSQrEh0j+~h zIO_gS;45x(K%(LhF{iK zW8DSgJM`0Oyk+xWOBdV>-1t)K$VB^>RUg}Isx#=Nq@iqAGqPu!p6~95ZTL8`%D67H z?$i1jpt)ja!~eaGX$uxiMg_u2x!}Hi&;2$gYRa-aL7XoS9_)BDBt#sX$$*JDF^^UW ze~R^V1V2C%uIDZ;Ar{c7cv?CdtR z@EY0EAVfABu}v^rZX6+7JPgHhL-6P=Y9K-)#J_YYSZqpCs*;5*4bs}jww;o7=OcdI zebpRq-U%H{|GAKv`Fot(2&j#H6zHewtJbD20iHfQF}mf(-FkY5jJK%$hgqxrgHWL( zQ+tn5W~aOSz5hAZ-)Xt=sA0F(B4iS#E#B8X_U;hrAzGAgV=`aYozGsS`N6P<{4nrtu+Z9c~fAP^-{Y{3Y;RDkP0!GZ7_+p zy1#Lt`xGDX>-}-d&~T+O$_ypML006cLUN+uCKJLax_I%T*{7R6qZJ~ucjQ+D&F=~E zi_|AoKSVA@0^E{#rSasgZml!MR}7~Yuvomf*mJ)E3-*}Qw)Qv8Kk;&svLZx>EwHl6!!%?GgxKQ3!@h-JMlQYK`a#K zjk4a3osY~nwMwn)%~>m(nfgNo`S8v1TACr&SS`cilJDc1(S5CL2cMapkK9v<$j%TO zGuUUO%W1wRo;#H@>=&kSV9z_g=$i)N3`5cumMsqe;rn2SWBf{&$jOsU-%J3+DTmWm zvP&ymZRE%v=#`0x5@OhrlDu%*AO!d$)Xl?nZ zh9fMvWU0AXnJaT zJE~`@2H43hwxCw*P9OTm@S@B$%x&T0k98#;DH|#Zzx1H64YOKnvnwpWSBu7f5^7El zt!7-HVPWUyx;-1MHky_;A+Z0Z)ClGR5mT?KDYszZ805gJuiv9%V(RX0EUx>>FMscR z_S>&bB-s{; zeNe!gquEld*81?c4kV`;*Sl?ENuo_?92>TVuw<8Plf^ga(4$*!nRoJEG8l zL^1@^4OZ%Hrk;6S_mfPr|B80t{_l;dfBq86BCO`U@=1e&fG}>C*S_{hfgYLow%_1e zSiGPX;oKpd5C7w?(H#ukN(q@!Yc-*|>c*!GW>-dQsLMuXV*QK~sZQ*q*J_{Q+Gh%rD zOW<9LhS21Q2j_w>XRQ1ge)yF`NU3wmbKW~OpjAxmp66!ZQOhvDq90)zk9)G%g8#3? zr7Bm&BgXWNtI5IZ!`gs9Rr@Wd-y%DVx$Qhsrv%jT_qMhfc?YK+&)fk=?d)_lWrx$2 zrY$k_YtQL~*rYgyGMJxzQ*q#>epgBc_{NhzUCk}e~hZujp#v=AO76x<7550pJVl-ubR*h7IF&3JS=iU-z`=v2TRi1qC~sU%eIZOVxyRRb8GANK#?QqM6nMb9-TC2 zH^~sOZQ1KxuMR2UT274D9O?^zs}iZ_&Yf!=lC>Sd0qi=?{0NEV+QXy|0oh#K-FQ@!5Gu&RTACq^3|A8PNtY z5)GRtwjwNZX7ib4qutP=H`VwpsJ_{90EQE5eX=i?le0xxEv~dowHeqWKW#FQCnxQL z$hzI#FKW!g$~eC*;WEGC_6Lu6Xn_C(>5R604$S#|JYp85<7LgQ38r0UL-A5;~-Yn~uvuw5i)cCkZln{QfMv1|6xmmd$!vC6U^++%NZ zP+}e~<(Bl@V&})C+I&eo-+OcFuMew55sD*yb)cE9QJ9s0QoN_-PEP6NwTsTrS_kHm zM3^?Suy9n}Ng-CzgQJ2w3C5Pn@jDfnCTp zcGiQ+&NzssM5*PDj*Sl+w&JS%|T z<>2Uev!o`pcF^r@&(cu8kBHSs%yoGGby!cU7t1)3LVExgl{HKFN$^Mz2)}YRjQZlu zVQ;--D^w*=VapXOVjo`0wF$pV?Nax%X59#wsTGGQs{xo~#{m5TcqDm;Iu#QMa8v4jo;=+>CO;E#nb-$ZkLuj~{1zxD z!7qPRt(8^~0+prJSRLgS)zku_QU&ut!ZTJ`QFcOZZq!6j4A3Cz()ocO`!=TRkJP4|{ zUW;vjJtP<xsA(?cn|2d$m0|N4C^MaQP0^Q(Th?+>Tm!AXv*EKwBlkgPw(5>go|CY<^4(=xBx1U=>+{|nzwUye zdi3bgsMHW*!OlsK-9=hHrH3sv~u2uHnQNc19&1cs1I&X!&)tBWZs4AxwRU)Z{3 z)3Y{(x=jYy6!~d)*sa^|s?~(KwWs~Qw`(8k{@_c(OzjTBLi}-dy~Q%`nEX|1jVR%O zcQDg|-`HQXjrXSm5%izVk&{1$R)6;b5e&!T=K@KCX|7AkbNwMhIH?o)jH0VYHE+A7 zV1`Uwut$Ng(QNDMi*LMpU)|_`x8?97wd0qS6rGAovemWKRb|vlx&j!M{ur7Yc|g3h zUqziy%qY2GrzbnF#CjJx>404(r_@?79}mNI>Z2E_EpOus5=3@+2~?eO>D35T|KkTe zzo9+d^i2l$fl8xW>*iGI@^m2Ek7QFF{UP}UZs&#Pzlv+WOS_B-(-O`X0*vUwrri#; zWA5Sot8xJrK7Q%xraV&0^t>*#0hX@n<+5Vi-Tm|O@=L3lOke!kiXl;qlK+GB5tJ@C zT_k_0qZ8qYN49+HP9cR2L&|d%BHP=Sson{XdopO?Vb;D|y7uzV)ytO~t%{s6xqAIo z!)^h(!Oi)wz{K5O%+v{Hmc8WstfDx#OSre`_Ff_@(7l zB;oi%Og;Itw{i=!6=pkb`DEJl#xMg>GAlbx@UXT0SHo?L!`xS%mus(6ACb1f3=9Wc zbF+#$z#>6Wr?a`+lmM4fW1!sPRo&02r>2Jm+~NXJG1D1R^o#YaXcSbMzmp!EAiFxeY(<~u*GeGhO~Uus7Y+lG>S%m5YF6yGMc4bDH?X?lKnDD7Lk4gKgNKhBd>$@S0~saFuh%h zKXO$xDe@I~Fg&lxg_(c}%uuh|cxtz3%(8Tt&+$LJCTEYISn9Dhv|YkS{|(drPPTpb z_-IDSe!K4LcORbh!Ab3Yd2QI&IWSYg0xXY@n6YfmH7a1kFe~#uaVXlUiA7y*-Z<_b zeze$8(e6VR9|u{CkCyUp#N>HX*%^SS_bxCq)7Nbe2Vrk+fk8XHzE~Uqp(6a$oe|&l z?`C~xJ?UC^ZPp0qBc}3BNzPLJXFm9`PZmv*}`MDHU-V(U0qyRo6DdQN z$0jRi`87QAc)tRZhAFdS@)2jAG&xAE&Ds)+Gh6~-CAdTcFEor$;5bF+5{v&rP^z_d z$=%SQw~MDC^1oLWSS1dT&z)j$u%^C+SbEWBC~vK+!I?t07o*j#lXPaYTuBK00#%@f z?&P07e_jLk{5MWr0+;PEEt$Q>=7-lvS~RLj;mOhW)5$Ss(CFLOJg^R`Oc?6qO`S>= z?~ET!?b2iK1idwv=bY`{cqCb3?hK}*ttMuo z2%yM*q&rL9CW8c%IaJZ=|M7Gta5=VH+rK45Xh3F?c~&w-6qysskdO#vN+=D6WU7Q@ zN(hxCQ$i>rLQ*7>hoq7usZ>%(zW;ij{eJtmzxUhw+0=bs*LkktIF5C!e*1=3sBAsp zahJU;)>F0|pK`@w<9F|*^Ccs9Q7|HfEc)@|UwUk(L$b9~LA7BM^?9b=<9zK7G{&Z4 zf4h_jAD?IH&Dw<@sK1g)obFHm(K`R?t=Z18@9fsC8_4gbVmfXX?sT!p$$-$pE5Hs_ z3^{lWL`&jb{R2r|vPK2y5%Cz)UI$+y%>xh&D2e&L@ik8^%*}ze$Yhx6^zGU!_0>O? zrqwvHFVLF56Lm;vn(M@@m!Qx@@D6)|0(8K?V`F2lo)|^eC67Ta9v`}9tH?*3+N{)2 zHZIq|N*}#>5CohfbG+pe0wcCHg;8R0nVhaQ3@^G^HzQ)vKiIT>UPGn{LZ)OXG1-cMq^eNJ#Oay%-2 zUQeCLr_4xn$c!jmf9uwFJ@ta4L6{D`HJfs(yUNz*xowJ;x8HE4#AW&;b9H5;_-tf- zQQGQX_okcrE_;1^{LejjSjHSNk6;hDGkXk;)gg2Fov7v576iofU#H&<4+Zoy$Rol= z*KHm6-pJIECSp?6t*1*v!@}wXB#&jS*KoBAK3U-=zr->0l6&^-ff93I3fy}0&n486 zvCdyPDKaVsx-uF;83)SzwUaC-^!ARo*Z(o8rVE@9lK|V`n6Q=23LX==s^#R_-fNvh zoU-6#1>3}RPgdWyY$;-Vz7U_4g0)|=nOW=BfhC=~8}%D)Hs4-lt9H?YCy#3;Xk=E( zN*oL~V4)7*-o7~2>*nX;e&OdYG^JwFpT05nkIN71)rRg%+i>jZ`bS$9*_H2D zq-3JM{A@?; z)+&=X+pZQmj>t09em36V_l5<#*0o5RnqwZ=RCOy0;NYD;UOC`8^i{ycV%Jx5t`s}9 zUmC6nYyYh7=*CA0f<5s#WidBIDE#A1sxESZf8DNGr@QCv&Mqx2yZN!=XY8MLEzh4$ z-Tu#5s= zoZNAsY66rSa1U_0Y(2wrWc-{tZ|3Z2fY#4kd*Fx>x08zu>GtNwThwgIeAeQ@-ShS% zzgD`Zx_U5-0(=oWsQ&p^U(8gM#)fTY9%NZZ>UW&edQQCXx+t@&(SwjW)!Er&YgRLq z@aOP{yJJUdwg(pcOrxm2brDM0qK&ooiuO0H{fE#?R(jTIH1YR~9DJr&Abt(vKQ|a0oTrg;T=z zR#|QZKu`X$Gi<5REJJ*!T<-pE|DQ2k2T+!*8`hBlz&|-3UBg}$@=E7F+3PztfX9gD zktB;b1fE4|#FDP#s27MGS+(;CvHjFODto7N9q-bzXZWuT-pyXaqlr*OY;%cMe!W^f z(6T_8ghz18M|z`rY`(kT#i#3NONOs+%;4lbn|-mGA)%p}&bGYliAOKq5-_(*YXjoJUv)4tZm zfE9e5dQBhL%yaQrt$SGkNuY9kUUTpLO{h5rA4~mIRJVKG2DAw;ls?XgeKC9Lq)A`C z#q#-LufHuhKQJMaVO;q{t8m}puq~^4bG`n}MJsOgn1h<+XXpy&s-GL7-WhiA0@|k| zp&p{XedgL9_pzqsgFjThd=>W(Sck2xtyjIsR;DA`+nqCK;iyBwl=TJ=>U|4TFTM40 zO;58Osg=h!=-u(%-!|)BUKz@cXFskPbVVS}A#R#ygjR%}FKBPl2g?tY?p-6>=>`ME zvz{GzOBQ%DrqUXhQBbH*7{P!|UJ<6Hw70%*R-U1SLtd!pURmMm>x;k3zDuK`Ce1bZ zS`A3};+;|BbH44reAvL!#@J_Q$nh+fQl2?G(9K(hRT>3tKa{;)U$i3nZNEhOsDWb} z-^9B}N_{Xn?gMxoB^ky7ofw{?9CvW84-7;{cI%L-db7Lq$(q)YvnS1SjkBf@7bOsC zEubBls{>sWj|Or^LIH-~VZUe0n|$0LvT%8v`Sj_sbT%gc@Z8wA!J5jR=$2$Wk;4|| zcG$IcQ9whZyPN-Du9WZDpo8}C;d9+L<1SIv!}v201{<2;In)4G5yYJY-j;DK25i7g zLU6BOmPQb!z^i znIqN{;Jq%Xz*vFU%lcw2Te%t>JD3cwCv&FtdacJrUpKI`#>pV)qt}1Lp}8Z5*w+TG zZc){+Z$0y+a0 zPRckLVRH)VIazta?5e2h3neS>u6nw3s?5)pI}|p~{n(}J|7iizsz5(}?Y6cG*==TR z{eIbjwv)ojuW7Cvwe-9Drhv6WR+atSh^vds1e5hUk8B?`XinOXKZH<}o(8wy&(xk# z{nzk|*`W^2l|4EA{FU&A>VO4Bl`qoMyUcXFas9e5RrdC0PcOUlYWao{pOPLs?d*~H zdHpSLs{NYUAtQnla^rIyd929aP1J<}39FpS(oPhnUJ0Fw2O1c}&c8P^(@gblcJ{OG z=K4)a8kfCk%Rmkj`370zZvUkv;rzciKKbiu^~9yqcg-~Y;9V7QvltiP`|`S3_#Ihu zNiG256fk$BsSIv~fTY9lvulf&P}kwc-2EXf@=G6F+H>jC$W^Lgv3YeEu{eT?1|ZKW zeC+t}&eZkbc(MTk1BKXksmw3>M^Dz>J}8R%@mYQPI}>2gQ4?X;tM}6F{>JO{+0Wqk7qx7 zWdxbnWGe0#f&sPP)$>^c7$jtq-_L%T-nfmm%C_PYu00u2Tb44c*`l?<=as!J*qSs)9BRP`Nn#Bah|R0xBczf??IWx*Ys;|R=(Kq!7?A@ zyWw%vQA`wGdO2xWqpe2pp4|>K1Vbz|>^5nX*e@U?JVbt?(g#?f@Z@~xwD6}l0;la= zv)SX;V$-Rz01yC@EhNBgb#8t+cmAWBXUdW(AkYF8Q%~8UwlNyNpzZW=Q@$QAF1b1s z8)RrED%`0>>$+$y1{nGK0qSDJ`O@jrrfDaQbAHvLwTg0=iAGVGbHDd*jmJLj37z;` z4C>Wy+U}o=CcEuF)FzIq^`~g93&#y%EJzXS|70+lxj7moT71IebP!lJ$ei5tqqQj6 zul0{|9X+qJbL9q~pf$kSXbT_&P-!eo*r`irP58$QTtRv!)2Qm%9RQVRFC~ZCGx3sx zZ%HruO@+;>)6+p8XWCtBVuVq?V{+dc-zT#z zN!Oo%BO*N!cbZ+jFKIK+kFbqq<=v$nGvSKYp&zP4L&-LxSlNv@Xzj^Iia~`#rSOMI(t{ViVB3_aD0sZJgq5(EgIEhgOY!jPrMT-39+|hEV#9?dNs;|Y9uLsiFw1qw_Mnr5*AOg zN~VW=8<&CIH?<}DE_~9{>Y{uzrQh6G-wYXrHHGL;HBle zYHMv0!c&wl$4?*UpWS2j{*_sy$zPRJm6f>vvXqJWu(pF&GJsu|vrNRN0HtRF1tu3W z6zV7*cAN%rg`2o5vNu{wKKTd;EZFR(an?wkM#y;snHD4=>j&a}s^z5noB50K_~=e8 zX3oT8r>+8U0MlgN|;z{XF3n`B|WOOyM5tEJzEQdmCT)zwZ{9{b^HPhCM z+nHJr8WYnx+A7QVz0re3QQw}AQ4_@ZNy8@&c3qjtvN5&LAf8v}oekb*_G`B*$)N_r-1o0+;Yu@`y-rs??lQFm+d z`-_>6xE<1((5^)Eoo}}5@#Eu*S$8R%Sh2NglP1O2qGMJC1Xy~e&o`KB;%#-~LuWle znf*m`Sz1N)k+>}SY?i|i{JB4()X!($0i-lyZkElWQ`DEiiRO!_a*LHNl9mLyC_}^ zFc{Nl*0N=HH&>q*`wI&T`8r7Jx+Oirp;n9)kf)@e>GZ*FXjMSc8*LROS!(1zzC&(x zSswV)H&ks>`psEu_UQ_Mdd9=`+XBvME_f{`59+Hfo;dnvQ+^CSPXKx{)P83F1=z$RXV)Tm5zABcVO z;L?rWk+=6_awdBzptpD=^M9Sg;!ZkTyeh<~8H82-0ERu{&4##q+1)YVnKBi3=FCp< z6az(PvSApra*ldhEi^S>ToPtemjOxq%(~{QPj8b^T7{DLZPIyGtdyN!@MjmkG#wB} z{U^J*(#U&v%2@B?3je|upb=u*f_e4>#+wl$ImN7E+?jF4{Xb9Or-TC?#nHr$qv%-Y zCOY5Bg8H+VHR}--j5NZC`oo{b`?}x4@2x$0O>?hCTL(_(j3Tpr!ZwPxfwlFO>Tv(W z1qOXVcUJba0ECpaoAF6wO=$#4VL`@g5L-hW*>GWHWeY_ErOiYZ0wDuGH*H_s*u|Sy z3UwmdB?eKMc4tBZ1#M*F?`6HWb=TQD5Q5`Hmpi?cjYWUJ5M#x$?3$gl>zW!GYu?)O zh*9q})XsW2zxbAHqe5pR`;(w@PxtB_W!?wZ1=y{onkFGlt0I1nd{x>RcL2}24W5h( z(bFqvO+coX!6O0+%A};6E4&3fj;zUd5w9^xE(lFK*0ck(ATJ$cnc9DYWugT@gWO=> z?$oi%0%0}j?InfEGyq*QoVD|jmvlA}b#V-9xCIzZhQRLG(2yJhc81`A3CrVg?*DiN z1%#NR3Fk_M%(-QXWv)mlvx4t${#{obwish??(#g~@? zt3l-L@C^=&`7zcccvEkJD2o1`41`j5)|bVyi3zVp zp@1=%faHjPgyHjv&|O5dDOw2nRP)^$3}SvARysv{R=vM9|b?Vn1IOunAbP#q=(Ygk4U1CqN= zybk7*kh`zZGX#%AvYeWseHVXwH2Z`LucXEMfAsa+0GHNuSRI{pW;|u8#dz+5tW!Jv zI<;U)*Y!sQ>)_sA1?xbh-&A`_<5<0EEtW)Hiuu$=tKU3Xgq!-Moe0p0tKJE@+I{+% zx@YB;iM$dyBh%Bed=fd=b%(4;Nbwl7Xiw@HT72jC_d>>eLzw4>`-M!@JlX!8!w~fK$c$CD-FseWxFX83OXq^?R&Q6~LPVIu!Z>V`_s*{&*Q5W* z@3j08eKC*6e&x!Kj1Ms_6#KGaM0P17SG!h3#vK;x+@Kqe3gNXspchibwo7?mO66O3 zXT|!GeJitgDcaZ(c)kKKG7~LRDzI)+FmNof6i`?8L|=VC{vS6?se7}gbZl7Y z$f7;j;=TTN#`0+M?qm6kIIOoLi3y+$L~tWBqo|U_i%CF)iL5E!z%b*rZu3wxvoESE zmPKFFT(07g{AV-mvvC+^@A8uT{qJ?G{nmiR zG4IbOHd0oimV&AKNs9YPBu*kvc^-J*Q8fCaJGGuo1vPQzOPxjK^3)1MrG%|ofs>hx zFo?4UAkH}hWKDc5lp{#b`rfU6*k3SMPMhEN7$hS6^sp{wn>UYyT!0wE3~}$%r3rau zPCY%u>k16A`swP;30vyaeO5S}hO!5$d0D44)v&VpjjZ);Iq@~d8+(#*DZ*sJf(;bg zQ%C+bb)R~1){VKJef6v)m2;|w*&eHm0C|##fFxRyAmSFTTuzxQ&9U%QzI{4%@+8|( z(lu08VmTiGBAaLJ*j6Ab#7I<@%U_nPg7#;u>!S>oQ1<7LLl17#)YG$@h({!*Cc76u zlISeE(PO?K;B9cfcs&fsee`CQF>AvPu0)v?5)%`MUfNECp%AUs!_TA^BnY(jPAUQh zB==?X4QYJ^-$xz#Hx`AY*{`&_bUw|VNnRE156&H$NP>9T6kz)=%w*J)&)o%qBghqv z{P_RKo8rCe@ZGLOfp``78R$T=NKN5Xj}Po%V8NLfCCa1&$QGOK!>_&HdSL7ld9oC{ z-Pw!7(#>bK|1i|zO7=zonvm;=^M%?skm4r|7X|t@HC9J~=|JJM% zm*t$ryGf_5{1UglE|R@7j6Y5zLeNcyDd|R879nse;G%x6Tt`PPc}pgmkb;PH=jzQB zZHYFn$YzIO{{>uvo2k-eF^K;4^5pvJEG8pl`x`Ucl60B4Kxjc4Jp5?t7BR*E#Y+vE zG(mKj=qAfBaPi_=qPZbRE&}_IbplX?FYkK%y;^&Ta+EJCoE9fh25)&W{PDUIRt(@) zX{+GQE=v>Wn*esmeGN6|x|Z(NEVAv>CfGO4%>*F;45$x?5SOFDLnIMUW|*PXS)u7FJP9 zaR%XLki^;Qw|R4C({K^kwL=uJ5aS*RM?Bl(6)}vkiD;Chu=8IN3)$mE+T>FLhl@02 zxi^lxPHl`}cM}#xffWm`gkl)Y0BIeF_f%Ar2C_s(BbG-`IyslxLas0k;I@0(lNTq= z(3os*2D@U!;gmJW~EsL6u|6Iq4z@c=X`;sL@4Jtt>H95Z<}DE-FJ7)kgi)Sz^f%B7@N*Ncxx~Tufp8S)?>>QNciKJ5O3z4R+ z%~;VCgcjBJ!v(eFEqNzGBe0h6LsVi1TMFtcK9^I*dLndy#TQKrvU2plYu?wikxHVBKwV*S$c1)ZJbSOwk)=5}Rx)>BPsJBFhPw^8L73F`j z_IvmUT#v$M-Wm$NFH1#aJu;V?Iulkm5c6cQjf0#hT9a#K$K61CCX?tC;388dm($9e zE*S||)3u-YPazH1c;sIO+icQq0Bc^N2+wjI6(awlA(#9rDN#>Plh$b5xcbCScng=w zA0`WKB2Z-qCXcbdS#1d($SFIhRfVeW_V*W)WpPuS&Qs<#@gucE>?kABqSk`(g33ig zduV?fvv7+S^N#D<)@MX-_*QM%SA7L6zvsSxKr-3$a)cF1MBuo?(<3ikTFRy;QA~o8 zb5WVv7$_%GmXOdp5@}_D@}{b+L^|3S@=WZ(Bb1Yj{EX8N(3T^Qgk0 zHoWQ0CuGe;e{{?t)<nsNTxPJ0HGy2p4co`n2GSYK+H75$=o%~tG_W8cD6?k%+pIKeiRe&KLW&f>psV(#Kz(<0nRA!4!gA8U` zVHGu)P$~quj7L$>kP#+r@&Cn|Vz;c+{*R z%zffNQt2 zaqH3GEV6Kn5nuBVjClSvjKVqg&6{Z5`@4D8xdcfxHaS@Os6DI@1vSz%Bz9Oy{!8%{pW7s^cY zX#aoaz-+Yw|AdPcXIshDRHqDSJp?b+p7ObO@7@yqL}%a1(A_DrD09f*!R72wmYpxA z-I|eH@+g>x0pcv-p6?%FNvXzEx~P%F(lP6Bq-NM{Mk~-eaHshXh{lPVWe8uH1AZc? zDW<*dmCWgU*Ft$LRRKN-;+OEUP|R?F_B?Van&M|}ErDE>%jOzgZVocVn7n_zi*6{Tr~6fcp9;sDX}x_S z#-RYnp)-BhfAc*+iTCHh^iztSS;In0Fp&|MR1yAK(1<7F{boES_?6)tm;HUq#|@tYMKUQ%~~ z{`&RfwAJ@5(q}A`P6ATz2}QLyyzmbg#5I095-~SCj;rfX{vNd>!XL~?52iN|yPZCL z4mMhN?AS4`8yWZjdV6%8-Of^?UE*x*+ZUaIQR^IdMD5v z7!5L3nP-zxUM@g{(kV_B8~t9(=11DZ6E~XraPv3+xOy^bLzM&N1@7*$4K?7LQZ0wc zk*LSW2d|MTwCq;)pS@qde!ZH}alJv1EE|<(D}?1{{4QdntC@!?GhoKBSF73VBM=;m zGU+p^??!gm^nJPvT|E2E^vpxdeE4+|y=aLA!#k}#GG0mn*2IhGo(#u&D(3j00`MeB z>BPL{$<*=839~w@05f@m(q@yq67C7HYwKq?j$a88LW_m6ZyPFnAVIoiwQcvd%sRiS zr42Waya(I};>i(_NG2s5a=AHEzZ-T?J2rULB0OM4G8_3i8R$KU`I6T9_R}K!DV8km zH-xJc)+_FMQZjHlXYwH}oy#+yN$AM_F2n{3y-!$-iXG5dbq{ z?);DNj$K$a%2Go*Unbg~)rXLz6V|7{QfiKBNT7Foc@Af6v_?%K&f#WoY=WDoq3bb>N9suz- zTqd_!DIrd(5ud-^xcjHC--vSbE)5HAd(bnlT)7w|SoYDub1>$lqNWy3w?k2+$0%^b zir`g;Jm_7h!1EZ;)!`yxl14pGl9x^E^VU3UQLu4y7MW4lBSh)U*`DD$5YUCkShmTr zrh1KhG%23Z-VYhF4i%;Bctli{8Cn*6^X3uubco1UI&KgjuYO@}n7$B+|1I%Blg+Q( zE2`9kLy?tCOvI+%YRPcJ!7eHEbfCf^)QV7sT()6OpVb}BfArGVpP_dc)b@L6_JS|% z_U_uXh$Yh$9VCm&)2=DQRd9v2vzazQRQ%0{X9*%d)%%`4B85WxrA)h{=_||G8wMLIl+CV zIrv!OZl(eln-{Q^&W@6D+qh6;1Q-=tB&7j3VNmii--?(hFf+9@$gJx5Sr^3%JD2&~ zTu5JVyyx%UH8uinmDW)ju)x4TL1WP4Cg%&%A)Dl6wuWi3b##xE2wj4zgaRL4a&w!+ ze*itJbFD62ytt~n+f3jIIbk%sY}1<**(Ta+#|~L4fCt?i;0?HIVTBO@Fz0CCw3dET zcpe(HR>RhIq2fY552D2CY;l;EG3fpa%*aeMxOnq1OZVpDC3U(`1ZnV}@}me|;Bds$ z=Wa#uhx~`N@Jmbp&q^U)b*JY;$S9d#CjIBTTYldz<8>@0s{L`}uGqWK?2=1|w)@+0 zLqYr3>6L%~&Q@BetWrm*%R*Ie?+~3`b9+BCI2S#0MSIJ+Mej3Mi7ga-=3>3p{4d*yfdd`#L<51{Q)`@FD-TB@j6!)OgFlZK z>rDtVXKC-pJFUl~iOA6lu7xkUcH4yT({t8&s@+XJ7Y_jg;bYt2?I4}Sym|9-a&ifBz=Fp>Qh0%ONvD!ii{9E@--CY-@jAa z^)D|g>%+jCKZlRxpVp*8y$*FcbH&v~+4oNy$gHXfBF6qIgaM zh`4$4=CjJb-I!hxuNwX_70OwH<#$R@O$~ntD>|T;;7&)@3>!L>rJyZH18KCTXHT8V ziMmsTmrgn{?@Sh#>KGaIx0llkmjW9FGbM>=PCBA93cs#Zr^JR6M&u;M{%m~r&S zX)NJlUCVUhXtb2Ku$_1r{QC?`OFVc_Tv~9~tRVGdI9cpf>rggY{H(6t7a7_A=dWK3 z+;W<9l#F1m&QKaX=lpfJwE*%)pZ#D;Mm!$nEn>uT?(A9DU7>ahf0pKyl$h!Gd%JZj z-8^{H#*LhgO^fy0oOBs7$I{yU(!7|_;z#CbWW=+3quN!oVVzS1$~2f;65*FSRmu5l zd4XY6o8~K5_KD+`ro4xym|I|q5_~MhSunOTFL@QqXeIU0sJbP97Go+G|Fo3?P{fG(E5*zazcfcc$n37=KF2$T+Nc&g)OI88Bi^Ca>!|Zc)z( z+>ddrf({48{`7YvPs^$D%S>~em!3RgJL_Tr(=Vq(+_KCjA!y$#b~w>Xj0Fkk=D^)))z zSf@hG&a-*BKm_TC27f{0P7F;OQGVoPeVztt@w4ovq3gxSX^#vae|a65ZMcE7T^Fa@ z@*h9Wz*o0H@*GFl*9VyT1-N5RQqpG!(H9d)Xr6o}{<87K~_fhKtfkg2~r|*xU5^ae8o;^+W zbR2b}--0_e6IK;ENoN`Yw|-c|OtBC1c+TyBooXXbPTe^2B)h^U3ZV_f35>R_^AAVFuMn>~ittL=z z`Z?#o-e~c}9yxxew;T1eQ`F@VqAjJ?8ZV)sxHu^*D+m*;FJ0$ltD%G9cQ&W{g38z( zlIxH#9@B!J$i>CZ4zaE0=zA=A8cU2@ygOE5&*ls#O7rgRe>6J~6f_0TgGIYj5N6E4 z3udDOaw94MQLTzoA$rrLeGg6OLTpOD5FTB>yF#MMTkxMO`YcbSjBTJk@*RY6HOyBdD+UYS4AE@$>gtT6X0vx|!Z++?eKSo(&HZfgv+B~9% zu5Q#`|I0rrJX4#@t5K#xLu!1cpw-=z8;F0t}oEELcU#PN!Bsy|Dsn@AsmtY1(VYUtnIAW<>TYl zrE|(%ytcXl$Ptu58`se*PN3d8}JSw`I{*=OQB9-dh-(xHzc<^j~m>E!P?f zF1d~(9S^}t6DPX$+Bxy??6w(-`)g&vjT|^w!!GJ7kMVGv-uw|A$LQd*v*iuYuN3mC z!g-?EuUEWDObp*^yqNpVDJU`6n*0aV;5B-PGlrP5YBt)@93=yGUaoCkeltl48XnNv z0^G6Zp(h(IVOSBuGPG%w=Sgqh9-ZE=DG(tBT9NLl>tt!j;#I4js&wFKY*;vW;NjU` zRCmOemUXm)r#EzJTQvWioCk*XAEI!-)w*X0!R$d}mJWmoiRyJwt4%0Eor z>mxfGch+&u8mS(Z?qRp5j;B$4$^zyv=Eu1oqHQnA>Q3xHzj8J&_YIri*a6Y1&?z?D zuwI`&{kw`KVjY`jgNTu~I(A4wIZcvN=EtnfcXK(kBR>qQ{AomdQo*>95r?`erjhas z0V+;oqCqgG0r<@Lx<0)pODZ+4sv#;^>*4~)G-UsTF6nHbI*J@?P^_hbv&+iKxo@`BH=iaGn1llCA%j?OI=z=}BS}ee* zIdR~?Mp3s7$TW{KZ_gSmt6e+JU4QA)r896r&xMs6YA2yRG_1gGY~Y>_)@JpKW2jd%cj2-rvQ-HUpet^?XTW2LN2rj+DjwPXC*H0 ze0X{O6;V7;y^W*8ZQi!+WT`hWrF)KKLTWSW@L>i9?`>;tT)7egMn%)F$=lljjyjHj z<@Z&;N?%qIfkaq<5(kaEYrl4Qa&m*Y%0XdGafOu08ysc)j~;D=@c=_*@F*6oh| z{)@*)ZffJ;;6UC$!y)7vJxN^`mn!#sLu~*4x#iMdI^T4yBZF3GiNCJazC~``V00Iz zo-jm;(UoZo8VDO(+ifUD8dG}SS?&4s7L=x`*;iu!B1G=ef-8*pjQ08=7cMkb3_ztM zOM=yXAATz@cei(V2?`>M-!PllX&vc>@gORBuv||%;6EK-U$c9C_ zWsjLCY^->DzPsUSgMJL4;xfEB)`UXXUXG65arNpzj*P`XOf#@IQQ`6>z;&r>Xn0b0 z8teGi1Pl=@gnz43bVvQlNuuFl5U?!eZ9cO)Del48uhz(?~YfhxIzNN zkE43Y{ruTGIiUZTegS#lfYfK16(xGA$&<&T!(mL^2Zzjij~?xOv(8&()~s2m(%ax> zY_nv^4uIl$w_PiPVQC>2#CBEi6sni|OZD3F9W)#=u)KKrjy z$8P3*$R0T4U|T^KK^;s3_3DAO^V{M(M;|(N%vatOp#zP87mtqAhtnUQgX((+*&0cy zQv2cSw}*!28CJ}mKYtGs5(1af2*4zW8cevaD}$QOInfA+A8F46p0@U(NwlJ({Q##^ z!V}x?-7Fw!8rL2CupF2TM;Dg{OzTdZ*buv0PY87d1w0>MUEJH-Yx5i7NwJIm_GWCX zUcI-ZmrdEfTBg?3xepH~jAkB}3W|c2DGzB-N`{*;;s{DCYIHeDv^3O_Ad*{1cdvT> zf*@M;b~`xm=q{R^02}O;+1Y0s_u4eb%!{dPSzQH~c9Xb|qU(pHtw#qAlrgrZr%oxr zN+(R7oPc3tqa3qU-47%w2bncc*uT4}%UYkh^t#*bDaMZ<&lZ+b95-5FS}SI6JJ9a( zZ;Ao(M4fkUdNZz*cGtth`{5$_w}}paA)XKuk@oun&U}KMg4EQFvTV#QjZR~B+Atr( zF6vj4r)O@@ua_5dbb+PyP*4&n$v%GlYRb|JQ^P%sAdg7@ja{b&zmZL-yM#pCekSj) zSNQ8Q&(BrXcX4(O!?x|{2sgd_j~~-Bcd;OE8Km0o*N3TO=$;Wd2EzgvR_%Lk#pewg zwr(e@NAc2~mClQ7aON+g;4`eOCgE!rhPHX>doEWKm~a|w=c(3D8vqCx)8Q@tG!(du zNc!WNS0beZ>W-1M)wYi+Qs2A@e6UD&6HFJ2&O5rV=F+n6;sx%_CQ`t0CUoETjXq&e z{kPLgeo5Cr(^;!m$MYKX{z(5$N#3N5{wb1F!QtUIM$WstIVj1i`19up^ZErqDONs@ zHU}vL!iCUzfrk1qi;n{DTB+&F;#nV)k2yI;fFS8SdA8f1JbU@_W$WB(iU!jOca5}p zV?Cs@I1~^t>S^xP%eQBc$2xv2ESyNc*yYe9md@Ln8r-5$PD2+a^`qiBF2q0lR_Lgz zCjSN7Fc!r!d0o@@p|g2%J!R!-6gf>`?A_N|P?oiCFTNV_*J&+E)Uxg@_-ZGeI@q%HS zvqU-5=Ie`NZo#{LC%qh)*U#g$`$)cG2y*8DpTi2Ha6A?-y{}fY1xr<~SzwjRCoK?51J`NHg&WgF!)mMkjAk zLwZGT-<67s56EiXI!6thd(nDGiF}~xogev}3XWsS`yq_)NpD1l;w#W0MD%IS*>pZg zVC+$s@GJ(=LP)98pxXPgtcg*+LLv%{SB`~KheA9(5PQChZk#BbmPt(B{`y_Wx z7`NrJ;$~jf2KWJ4^F-QobaviB-lBn$tb|7FUEUgyUsR?jcD?A!Z9$|{>=s3}Vi>5* z0PX7Kt5>)2XxUoN(m3~19D&Q%uU~TMNKWT8@1T4!((xZqs@8UJV{V7Bz5V9{Qy*9` z?vle%lq^l{o>N%pgWF;|($kN+aYJCx_yX*Y-;QI|qs;l*>N!}IbcAJX%r+md&5>3Y zA6;Aa@*CaD7#1~MxuVI$$>(=56`h|BQJuUAy5{EQKL(ik`Jic{qJVO1&gYU9lWD*} z8)~zCRM{w%zcDnRD4Q&z_h>x}NyFG9!~7{rfji z(5EVq;1U@<+C%F})e!&oZ5t9bk@g|amXiu#JOBaPM#7{0^HcX;wlhfXeIGb(fJf~{ zF(B6TQRbKP4#Ct+s5btVZ6-sJZQG69*h&a&#z*QXsPj2UT#3)`P1zvh4vsW;j|uXPVe9xHIqH+XNs ztgBoh!s70l1`1k95w09Re!L_mk^6w!h-vg4rrpM{%|Y%Cg{7L3XU>AwnaR8yVeBe*GX2zykQE`;zlPu=&6IXVhN&2j`Mi z>@4M7A%S~jV!$$!cnY==9ZDmLjsqEQ{!=+y7HtlNVFTn?xO%l8t%EF;_?#Z`a^N1* zg>G(9R+QWK3$hv>F7U-#2|UDy#>Kc_K*Fn6E$VNp!@3AAKmy;s==6N(W3m?>I7(p6 ze!wIP`QP?U=ps>ub4D}55Y)%D!$8Jmznf^MT0sMfktn6Dq4|*;lfv$kr-agAg$Lo1 z_ie)=YBg|aW7Y-K?ul^I;e?Tny@gMuf_j{kWXzpmv4(T@2Jo!3+ivUFE)`1M1Pr)j z@NubhBWB!BN@@rdxqkins#OUY8CnoHNdCuB(lL~XB~sjOmJ9oBH49H5bmNJVc%cr3 z5KHC79v3%V@oef*4MF#iUaqZp-Beggq~1FjX$WRC z#s2NJ!co*Q5AF5E)KA8t2;0i^QlV+yoS=oQB%qSZo4jTMad9-Tk+%N?M~vBVQDbK5 z{>s4#tdrqvsplsV zzKLrc|E~vRNyGl&fcF1f?t})Od304^gn2g|<;nTkw5d)&6};{17hXMo05WC zCWQ^0RG`w}s1xxl785UOtzg#t5i>({}MBh^5T_~>AD zPHa>nn+1G{ka?iiUN=+@tvdF9T7Vlv4*a;mvpzCxT{mW2e%)_vjCUN~0~GNHW|d%N zXjem^PU$gel>82bOxE$&CW2A^nEtwqP7j(BRtXKSR8Qh03rR&7qf=6$GKR7v?<@k^ zQ1>yRiK@@&g`?v))qpz(^B;Z!As0pT=3j-~SqY?cv*N-dMnq7Vs2x1-IsD0M+G2T# zGIEE^li}tj6f%$2oF{;_qMYI23mnTY$hfuIWP5u0474llc!gWJZeS<6;ALzyH!S<- z?-bV&9Z<9Iowm|;GSA6MTWx*)@18pwLRXE;o=$gz>JIyl9AXfcgS-@*n1-BGm^5Oh z1Yq93L-w6L;IW^oHXh1#97-eOMg0NZDlH~|F%iERcgSEdKpuweuCba{aP6IdxtqTk6o_&`R!Nps}z z?k2lx8^&4V2csOCrm|tf@9u|HSFK$6{Pe_TFazq`Q8SR5O}FVez1yf+I}==7S?U zd>-q(0_$BB?zil9#h0ZaP8{Q(y_$_W4&urNs)>UFV#=quM-I`Y0&dWznYA)RWKMqm z4rHDy^qK3xX3_2SZW>DFx#DU9VK zYP=~gCjIXbBtz4-cz*+Zw58=j)TIyEXW1EA`>FrNNWkx zs7}GOsbtXB4)ubkc@wr|u85B;;sB}~?SSM?nm!#qYit+-sX%Ho=Cd;+2s~|vZmTmh zeI(YF{jE(XSEvv=sjE1af1D^70r&&8R!VT}tky`dwKaX7L%#x;Gv?TqszT~DavPj3 zPqT8`!u>n)?}`RY7QPWkoeE#n1NZAdVdBUHi%dR__0?k3pg$mZ8F~l=rvr!Wo?~fQ zLa{2?6NgJ@*s#_J`DGuI%Eei8`^WHP(38?(;7?-IF92f~oE4Rb0R-I6#NBOZ2?mby zqpl8itN5g%qOt`>#-j7biA*`h(+J9jhM@)q5;#Z~A^;Lq4_d{z%aht50VU0h>2>G> zzi-Q=u+b>YnO_4b$tf=WW4WsjqZ1J`b^$Mh@Wb)t+7cIM2#nW|>qN`KGpr=)C;jvhqB?=UebrToj$ANTAtDT$anAFiHL(Dg!p317e-EN%n>L`A8}F5WIOngz;ytj z+B$p{TQnH`ojxXJ39LgZ;fHL+PLFAr+=2ox%s9L*MVLo4M>J2s5P0B{b=)qv+ThEV z)o}o-8tPy$bm$hmHp}yqsocgRIis$(#+kU~`YD?_psayUH}0Z&kByZ45LxMS!y$`d z!CfRohAbNc$RPN_miGbm-Wtet!S|R~KqDu)BWbY`a0?s_bg{SixR+$LB{h&5<+q_p zfu)eh$TI-Q)b84~9x@C#n9%@oycjM%ch_dcir@d(u5)%C3%N*tv70M}qJX!-ebu|t zr|4U9`G9|#TSgA0*n0@oiED7q$BzP-kO#y<8j@@4v>xK44{jqyRVkV9*5|4~%!O?B2u^Yz9 zZ7Z42IP$eEl5D{&;fMd0Srd4n!*a+3mUuN+Yz99b04zmgT$jrmS8#c(iNHSc*O9g) zWM#D%`8h@E6Nkoqrf#Qo0tEZUI-b$m>I~1G5(Uxh$Z<4|ln$(+lamBcB`FGUTcR%3 zCOVDh&7YrJQnHsKI7gZkX*}y_JK<07ii#QJ1Bgj~Xy^eU7Fkgt?1tT^0G z>(JT2pbb=_lsGSO`HBan*efj~gLo||AKAttie#|B9aAjsm7jdHa3HCm6Uz1u#xM?i8JYm#gQ zqN9_r_W0v0n^5>7WwzrFjaWevBI4{2od`HInlt7B?<2-#Y4x8Ocg8Th%4a~!F-k(| zal;K-G~PaMFP=L$nsk;1V?y!wfyPI6=Q_N<-4I!tb)35_KSx57WKpP=>~Vl1K=w{l zgBKBc<8j@g<)q@{kiQ=iwi3*eF~}|GN0@Kx)W5%)nVFgNd1hjSW`u4}luq)YiHWWk zoOgITBC3&@Lt+ID(zl9=1i*$gn9Fe88oQm`1!(5W)a-oxDONX3{nfonzqnhd8jou6N_^f7aT>< zfb1kj39c=(n9xO&-U4%9O``g@swyv*N3VMtI${jDjDJ-#8zB~4{62+3`anP*O@XJb zYFvKTGDA@=%d|yd$=Gxq!V^s&mtHDs*alxtbHcM{g2mFzHUQON#46|0r}}N%wzZry zheIZazT!EACzMnJzzKnR5x1QD$9Gcr%Upa^q}&KhH-L_KM8W->J~rUViv`DKyC8cr zZB@%|tpRX6?rpun7-aF=aRcW@@UotCrj!+u)_{DnhMYV7!)6fG(7QXE+QJXeXg)+v zwlTZrDC9Xgte$jeXyVwk(uhi(1!t}RoM|kNBooz(%4qB+OSbZKy zW*tQhSFP2c<>~7>)KN{oiuINDz=6$#_oT#ZrDmODcCRoI<6(y$~*&BdL zb?dx-i83$>6{StEC5KO)QFQ9uxkkj91W;Y}tvtW7WHNHu_B<_*p09Tc_s4$|q=#@V z(m&$(>+=rGZahG}e0kIF_3aGZn-gPsPC)7pDEEufEo5|<@waclW1im6A?;WGbJ=tH znX4lV_+xGM)aL{um0>8rgbI*TEiE>^Z$`|>9z9f0E=l1DEDKRr7he8M{qB^o9N??h z18_Zx$xcY9%OB#g7{Ll*+PaI%_dW#-L9OyxD_gxl&^|xOG~g{j0z2q+n68y|7ci+? zE_x=LHyB(mqxU4-VbDVO;yt9YV>Ast(M7s*$93xxm~GHt*$PzN=zalXAg+EovK5O) zLM}z?flF;<&kVvMSpWzO7ys~KzK=zU*mHAO1)HNRWL4yLWXB(f?Bl55Pxf#saU(K! z@}FP>?m{fRPwFPX+P}Hdl^$wFt zyB>k)086Wq6h&?gVjYkl5Y{-U1ma*G~XwU7lVk6?f*sAfLQU0z<^ znv!?JsHH}Szr?bFuC}>&jj@w<&6o6^|72$7!IOja;2Gf-(ZUF2Ob92HPc#nFlGzeT zj0%^=oq=U`0;n;MD2rGrw28W%1`TRKKSEVGo}%_dg^H!+iM~S|-ic~I%B9r$({AnN zjas+P+iZObG>e`N83>i=Xo!5ImOfHuOJ9YfjXV+>1L=|g6**w3QwpbV_!RjxuvV}4 z0y?0;d9^U+Qu}Tn-3hhQ&-8X_v@D=gJERi;=m1%32ETzAt_fl9^r%Z0E^J3Xs^OWO zPl2Z0y*t)$jYMy;V(aDfT(B@1k>YpO@7S>;kr{CU19Vc!Q0&>Am_pKoHd@4AkWQEP zLO346`Q>W|hlD7BdNT#ahNU*g=>uOU7FKvz;wf*|vaLIDOL23r6}Z%0Kru>LNVvv+%SdS1Wr;Bk09 z$T^1V{pLCXXwB8lO&Cu$QGI?L*-=m({|N|_czTkKnA6B5lS;BZFnDsmfKd8ofNQIZ zKZ08?AaMa2BEjkn&?Je4{{`ZVC87<8+S8^zx0tv(sXTkj9)(-I7`k+kA5szB<03NY zW1`GVEioF#yzNkr+7X}~trl+gMw^UvzpCQ%o2%Us5O3!g11=Uu^y@_^BQz$Ep+&#E zYgZ#_W7$0D8eFs~y#YimOFBFMf9842xN(mT;53ANH^&o4{#VD8j zeU4h_3Ij_N>+<6J`Ij-k9d@k4!1Z76F>g_@F?DBHzXDd1-G+JQI)MFC66 z?l;%z+pix8;&=ci0@xVT7gM?^qkS~8E^6E1_S zB3Rx(Z{7&l2hQ-2R^{YT&3NF3i?c$>QF741EM!(^<1>2v=8ZJ8w02VK3w}iV!vJG_ zX+xTaU_>tK)a6PB%sOkk&`mvh*a6URm53RQa`v{AnMLVdrHtisNy$&JyYstbxcH(A z_icNij72_ZRDR8alK(I9m`Q z!Cks^$>9NDVScl8^%N6&Qgjn-37~&wbhfaxwnpqP!#FZa=0AD)z}eX3v_Q4AjSgN4 z84SrN})Lw;~7z}hpC zL1X5AMRuc*;cjMV?!SC__5CVIFpLCRLU@MWkh~!Qopc@#zzttj^g7b+Z8x17R5erk zj_sKIclt30bM_6UJ&UgI$Gq!+)QNqm#Sr6yrF%~3A}gXTjN-@u;D%y7EAxYp^$j+! zCXMBO{mPCxZIX))r85Pw+o@cp=RTn5PM}a#ywm+cjL(q;rLwL1c-kE6RhD%h_omWN zA_5#b^vdv&vd&hki#sn~lvcdeWOne?;T}SX$ev55FX^~{HceS%dD5d(Q!k6s<~`8K zJ-}gS8<;3?I2&miQu%tGKVKB8R$Xri>a8P)0tl}fnwnd|DMEq7{od`RJf!WdDvGQ#oYV};$qn2rc=r1H5;p}1j}1KZEg zpc8JH?qEi|j)Fkog%0BsIg@>Ie`f!3F8eSRVPH%AN9rr&3qUT9<5?|muM=`d2JB95 z{?!wlq>)05Tk>|)t`-nG+v9J0q-Y+xO*ZYcR*!B&*6>SI`~yRIo_~#%72m>ijgB#2r#@6 zM1A$iY^tV4pv2Q^GzcfbTMf`lx)_@QHn@VRT{t$u1gZ%h6nz=<4~>!%={;F~FCj^ntcfq7^C-#k-^{gp9xyOY~X;bg;vHwGH}sA)fBOc>OzhjG|3T2Kwj==vm}TkY+qn z3y6E2hYkA~7NPNbfz-+p%7w>)G~rX$C*6a2#FSRjni@mJGWpP!VG`Zwc<@PiTjVBS z<`Lh13#bZIWrH*v8UXg#`O5?8u1K&L9gl$6U~`xdpZs3zpKBso>&~$@lPmBb>+sr+ z9Z$NqsIQ|#Zl;>CWtLBpDorY*a=YAHYU$_@YVV=XDEq;dVz0=^(oK>5d-b|cHC0B* zxCl6*|IDb0Um;lGfqeI|ysR+Uj;uqb0#zC{a=-9{5VQu!0DF)2h#4F39EdURH&xAN zv7lyOt7}_s-P#bOv;@qISv5eIZ6{A=TXg7@>>-TKLN+$u-1xKHFm>fcjdav*oQG^?;6UbD6(!9L&sRQkKST{6{vEteJh3kG_YI!-c&L(^CE#)U z;OK6mKtJ$hOqeiEG>fPoX78Ege2 zgq46oR4Cf$+i!un27ZP+KKkYurE;s(Z{z#kc~b5HR+z&oE+eu6Vn9dEbpz|UMb&~# zLv2uJbN{KkSRnwY6mQw^G)q|75mgZ3xx>oi7W;sNJAefCw-5I{_% zY`(s#3~bc9`eru}29!>GYHDe4^of#BM4^AX*p@8?V1~Scby`H>A(bU+$+S!Jhkv?? zM@Ca3!@Ys6x+eb-fdraK7+;7NPcT~%CCEM4GQ6jn+lUS@U4a_}+jc5`+k&3f1T>Z7 zywJ{02!>8WhO`8Ad4$vefS;Cyb`KAuI$M%P57=DeDj)6My*hv}bgb-f7yR8DhTn4T z+)xs*!1xlLd`#{eu-G@BDYu5RPP%*g5w<4Sz^I2TXYHzV))?c2k zA}R;^);bF284`&F3u2Eh?bB!K0jnLhWG-l`ZJ>B!#ptvALcYV2ITtlTXKlYY=r9~? z0-|#cFWUu}=1gCfn4R4b;D*FC*41?=+yG-w&s=u^+K<>a{qGGC4-`5nN?LW=GJIS^ z)QC)ljR}9*32Th$mZ z7Yl}f&R`fUKXP=KNHvCaTEW{O*YP;(&+tMM_a zhrKROL~IwnH{q94BN1h7Rg-x_0 z3D9UoWvMqm$GK6O=JcQ);p^+f439fRP2^~&an-U90W_tP*3G<&`JX<`3UAWCf22Wi z#wS(fk{-Oow?&pKL-utI#r|iZKce)Oj%vl9I&77sWxTB z1QQfYTjSz3wXb^!K{V$S*PF|X%X16|OgbxM74Jj*YYF;QQJu3bEv=Ph>oRa9Q_)Hk zb_v8os2A+Bcr8lT9J1O#MsH=DMLI4@S0jcnnTrQC+5A4sIeN^~|I-54Ep%I`tpj?~ z?X@d)2lo+DyvdC#HupSGx_)28rfi!5qL3v`0mVsP>!UR}DBB|ZrE#|dx>aNeFk|Kz)j);i ze-%ALpLsXG1yAqX=WkzXerB7?nDhu{MfC|bb@gir{spmWn!7INZ#zSFF^f|tF}Sir zpqKZw`SYKCHihwDF>iwji>gFaP7ynxGzNth!`L`Fi{=`n4?rfD(^D|yTo|7YY$*Y0 zDyOn3E->0decKJ`l<2>RFbj*WAWrp?lS(R$Tfrx%+-PHV+vKf_G zy_3{Lqv01tS}$}U{33ESx>9+^V9Ag+paVQzNT-fp`c9uUYbW?n9z_KkKjff+EelzI zok2$;hw$y2e-{ryvx4bRb98-UnbA0r`+1JFJ|Beo=Q(4P-XErzJ z20L56&ZsBr7;1i2yxG=0dGcgHPa(*~EfE;kbsfkgxj{f5fEn_34yA$6{{T@7SFDhH z^`qT`^2k%KmNS&1%ncyp-nSVb8anV%p5%`oKkVP%9%f;iTbkac(}_VYrNg83o@8k# zqDv3ak09PK{q>X!NcW>#N<5VB;T~7pvAyncRi_pDZ4k_eVqNUp=;*#Y)}7a{DtLNC z^twm6juJTL&dvPYtIWDS-9^QXq{Zj*+Sv_07U+f`+xgPP9p0iQ!s70ChCMq*Oylmq zty&&4JT`B0f!E#f+y5U;X9Ct^yLSCbD8qxO%qk^?Oqo&?Qi)0$NHQx?rVK?PLPA95 zMv+QFqCsU!GBuD?(nJH2R1)I*UH13B$FYz1+0Rb?|NFj%^IU74Yw_0cf)mx1?NxgN zkYONw!Ao6|_*Fv9@pi(myCv!Mr90OQ^v~Q;J=JhXyzX|i>VnvUne{&KF=*0#1OVv1 zI8T7*SbWap%LZf9pGD=A5cYw7y+sO332?%!0!<%dE8kv<+9y+tX7vAYtETEZk0o_1r>`IxK8od~=IPNi?fSM*zP z>7SD*me0@YTCL`>AD{Q6>R=IUwJ7CDr}CnD7wi3@?>{HX);XExp2X~7gV_e1Ae?eE zB;_QqTyRG%*7~dTuNe@Af}h&ZOcP^cGT?$XzASIphK8mJS4NeQBhBC1M_WZ}DTdyk z^hQDX^wwJ)&Z@rX%7=J_pg9{6im;jJ1AV~qfSx}Odhtydp95($0-G(^{RGk zkFx<=H~%La5}51M2s^}Bm_!|`No@vXz@f12ZjDF?1VSdxl9_+K2&u6*Z}TxoO@mLE5HoJ6cJW48kv zn1Vp~1wp_u_fKBcwv^0n3{Y^{3ImLp7w(Zm4t>PmPuLJHtnB+;pgR3GX$NSArn&%TUqkU##h=^C!KocChwr|074f-0XeC-+x`CD!Jth zqa4r_Sv@FY#+*3>?+#Jp>*qJQ{>HUAbLL?5bdr{Y)S*~x zPTYUfF645z@YnXxYwb2b=OOP1gYR>v2Pi81%89NbHCVUt*;wJ7nJ4u}H>19#5$V=7 zH1!c9nca+jxRc+8$XJH;Kx*FeZMoc-hv-QMx~ zWrG(FZ@Aq8QXqJ6Y-buA2V$R@s|I}E9(}0Od&{uc>X>O^XgjA}F>7kwAsk@(^eL=8 zy)o&|yge=84yZ$L4%A=sjdOY*TblEfNgwe5?%z+g@|By{{#jQ+8snL(A6L*QfM}}pmX>R3FARk9tgu=}_F4_6%ix`-Uu>vq$Pm1J4*08{jGP;b}Q z?axWP6C-gQJ`6MLnDb74mQh`v{4uNPMm_+>P>XCLWlRE&{IXp-^>btEjIHhNB@ZLX z+rECLp`ow$eI|=?gAJinUe>a8RS4^$prC|R>vvTN2L{16Edaa*$DcT2YJ z4-^6!-wPQAu2qeQmV`ah@&vmK2aEgtY0L%G&2q9eRt;10@XxO9S$Bp^6wUw&drQ1Q z{ugBtzR3WuH+B|Rg)jm}k1m9E`Od;|^7gur(|78(b)l)rT2Yau9wKasPedoa*ub`v zz!FMy(+D#TUbN*JVTEAL@McN&+VLW=ue3hX^)_c?aq1BZg}3LV4{%sIC)}EsC(~~L zNU3Gi=Ux%L6x^mQh!2%=PT6+q>4#KHGuft@8p^}_hc&NKS2fJ+qFsy0 zr%UG8$msVLa2F-Oio3fcQ9*k{HN>aA;;V^FK3rPT(gwyCK7&D~P@zM8`RdgS4qoQ& ziAFx2W`_I_#RlLLL;t3*w@mg6wHdBnT3?HT`{CAz4jF|;7G9jnB@!=|-*Jd@TBr_? zGdXZa$P+D-D63nYXUSmgWBhz(iou&ZiV6w=A!HFRT9lIX+&SUkcfR(VD^(~Ecr}&l zCl*DG@~Q6Bug$_h#yFvF*yb_60*`cc@d-8>K=K#zJHwlud!4<}+2j}i1ym!Wlvf(4ekAzAaXPK5X23}qksk@C+;3h-e##zn_$-QKAZQqT; zwfv(O(dHtrMk~1{++k3Q8>YhVAvuJbBAU4a@RSl87QZ>yX1CSt_TsKptsBO0l$w7U z_-=e{m77ksQy0!x-WnU{0l1b3?Vt+ED^j`Jf69*2!fFsnO!cAddNS90;892-TH?+g zYfm#ckD`$NDuC(+Dh47KX9RPWa>E3S`_u$@q_hEBwW2;bxN4})!y34F$;^!MrfBuX$Z5nMU^}Y*) zt?=Ln?mYe%(|Mc?M@Qi&tD(8xXW#W{lP+F+EN8XAWp&E>HN_7j)!mwwPd)RkgO~l| z&J(`8Q@T9Zthp$1+Ubb0OlLXe4MaFR%$rx@W8=BdYhVtcE6VC+9`>_@0Hdog# z8WXa-+w?OVWKOzDiGN6&sgC0~27c2XUCOR(u)qWp#}Uygf}KT@#}HRg{Kd1A>>4M} zY?pduDK1dr4Kf9|b z=gvbC!@uuQFz9}Vt1h9582X|LKLMvd-#J{fhXuC0!T?&hD>~g%*=Fz0;X%6V5pwfH zmJbWB*t)foZ{w|&O{bpbXKgK}Mw6GjU-@iR<7(MU$R#8&3|!Cx8(4Q8N*u675wS-i)m)@@ zk*&o^L~D(Y@{dFa1d`WgT>p7vn3S>=cBGP~x6XIMwgSn|slY*cR0ZHc+s}udeEPx4 z$|{Fr4QEDl8Y(d5d>pRN6=OhydkJGz^56aCbFXvCu&asQAhLvRy^8uK!rC(jZa>7lN&37^+kJCFA;Q7@k;g*u0aSV8t;f4z zKz-S>xo(=e_e9yPg$ALD&YZoYkD;)G*z zN{)AVup+G--MZ?yan{3w_6}Nijr8!B9j1j2YYrfz-4TsVok9af!A(s~W^+pRw%?Yy zt2&A+Uii3UOEWOW^8H5ll)Rch;TLwMUQ;4j*B+7V?{BBlSI`brUpYLl`17rTPZ?{+ z-=4PzbqJQxciEz1=nO5gVM=x9eh;svZ6$>b4?=cDA2Gtjg7f?qtZH_I*%2pgO9zJ| zSu5n?HYwK@_235?zf7sOy*#RCbdL1iOJOd!h-qtUV}@F;lzQRaSg+qd%)WbYm~ix8 zx6G<;Ja+o@P`eb3z*&guiV8Jkv!s^(L17~|;xw~qsM1B4!J-bf-iL9rM}AqIZ@c&d zc6`W#xbw{xY}q;Fa{kBTTHigwBR>1hS+aG@P?1|YE~j6)Fi)pyT$VwV5GiugwRam}uKd^9-sY{;hmN3fxmrU%wfu@A z4vdP(k$ViAb=A=2-O-wT;CxqP_GP@tS;zmfb~FL8cP@g{S2j-IcfprA0sb8*`) z3j<+}aBoQ{&god?8y<3GDC+u0BbftR10QcrvZnt83#(Q%^VBWjAiq^-KO=h7xQeh9fEHU(x7Jqmt4 z{0aIP!~8u*n?7nx>$$r8C)+^XdQ5YKosvc8tl(#Ai(JBsJK~W_>T@^vU0Nz1Po5IbO{xXmJ2a#uZXWQR7rl!kz+smXxFk<+C zm6U}Hg_2=|%dJi$hDvEMfQ%$Z!^Ir|%;C{;bGQB;R z=ZRAe9=;4UHb1CQePPWNyY2J!%zwc!PoCU&P9Q_~A$R^%p+LdIT5782LpYIt7QYBt zOlHsSmC@^d@=wt350u+owuS8C@dKtRdF(=3feea>M#Y2w6x^O(1rlgH@*;6zvV9xv;*^e@)5Jgkby9>SY z*68jv6JH}pFv}b?as850X}??=JW|nDAHmPV&2ojzhYu8%-OoAr_n&m*X;qPnOWtp< z^hEbh-8Oq&Yxvbhb_zkiPf>n6hiw@6b-B#Rsi}q&Bena^xjVsy4BmOup9JS!H_ECF z&vgRu3)j3tnY4>nB<#<5?D|JGjUn*{$^97I^#ng~yZAYt)elgUKVgE++vD?C?oz+B zhI{&_2TPlt(iiE7g1Q!!2fsj6C@$>?xR(%o7`BSXyl2Wq;yxf)K|WjY3s(afFK}8v zf-MJB$Bvq=G7;&`Hxb2&d>Mr;J49rh*n2kTx9Qz%JV`5fgR7fF?zdS1YvI`?W2MIS z?jkbrgcA@=4gSEwhI?vjmbuiHF23(B6nqkmu@L6a^}t23A+tM=ymJ>jlAqhRInF5l zW6O`D+20j;W9&tGHm0EyOs#@6808cK@yKA0=%7=sMpl~EDXUU< z&pds{+_AhcP$xW6rfY?VH>LC1@gc7_gnr8Y8acI1g9~p38c`AMdHnb$v!Pq)9D&%y zeaP`~5+rYKf&q89DM$713dQs? zPP?vlW2m>k@>AdNW8;}PIXRW_->Pk&b}Gjd6$AHU_4lrw@kWk@JJ3O&Xiz} zj~bLKL);(Ca`P+r^Z~Hg5offzsxFA;z_TH9s+eY&qW)!}T-bCZ8&JDL$V8&%5BB`N z;A;9Gk6PVNMgW*p)5|zPi1HM3f}kGB6>&S;h6xsAk`1GqRD)y5tTc+r|3(DD2F$`u z432jf<4JGH*+XUczxaXoqMG4n8y6%5v(DHy%SQDsTCkLmLQpkS#o-waqiW}Oy=tX7 z$)jl~v6xr_bs+9GPD?&AJY`_C%b-nK-#>RALM&DIqSqva+~fWy)GB3uYZVn#R8%?q z8@@%&E$g$LIR;n>0Nf&Tg}?Oy;`(H_%UDs@zkWpCm7mS3uglNlO?rOrNOh+%@_7v2`ev(EU3#<8;B3DaT{I-~Oj&ipMcP+A zSRYExCMJodDY5p_IRe=x#wd)fR$)zwrGseuSa2{iXx-&cIf}$bAisLp%fpFTy)=7K z?-K|6yN{je+Vx%*Zb)*X>T$5v5cz}u31o}gfh$HGYzF#6@ASs0_PEQeAi!ee4 z!689-H$R>({>O)MmB>%-W&LP{=E6OBXUP5FUj=b~r{(=o9J}O&Mg4lUCT#CmFbc*7;u(JAA$^NY$hA2-wgBgN4zrYs zP^9vQgUu9;26WSzi5pbXTc59^Hc7sj(?ywgfE-*%RmgdbFgd=BA|u=Q-Xh+cNRGln zXE7uhwo3vPZuao?_ZLxy6`wkHIt^;Y{vu0>PyRi+@OR;X%t~mCKqPWo{(fm}#fHTQ zDagqsY$B(GBC`nyUh-E?pGn^i=t#>9d1gtn`;=8wBf}RZH(jw#sUt@gCl$^LkSlf` z@HG!(lK8}MVPEQ%gKa^j)BgNiBa$57B)RBcZ4NfGhbpUgkeL`V zCSy3jDy`I?dqnIFLFJ&!d^qW1SlDi{^!P2e;>QOZtudx~C4I3Ar=r4yB2HjktmDzV zgum3YoK`WL*63gIVN_)BeHJ0A01ky4e+Hg>__w^}mk4YW!BjY$s58HKJZlE;g{yvY zWkJEG=7`8h5mCZ@_*kcL}AsKnMQ}w7V_vFZ5;CyxKfy4q#58 z$a4?QlxdpO|A_0ko~BK~=n`@I5Y~qDts-aubc71R1aCfIrhC}~d9LIEi-8A&_?LPG z+?VBK_pD&VgA-Q@(7ccCwo!0WGydfZyw#A@;PV~}TT<{Y-}6ajgFtlECWIx(r2{Y9 z2KK*q?Gw;S$-BjEUQ_84Ko7NiPE85v7Hd=d;t{MH@9W`|+?>8fy`pu6LpU5WR)H0p z&~hm{Y*Q8?;%9L0Vm7$i=dsRF>8nF(bP4|6E%GZ-#S@y8^f5XHCH9RIzhy>?S_pr9 zQM|F7sD~k6w-m`9C5ua3N~2pPkDfmL82OVz={N^Cp=Hg+JfweMnI@i zZ5M40e6#<<+E6$LrtkjYY!c8u--xN-$Z>4^{M0YWB>NY%Spt+6TnlP?u5j1%wk1O+TUiueGyB{;b(;i*lv15!)QsGLeA#2*?k+BMeHIQ` z$27lF*Q>@_(qY2An2GTv2;GFJZWrwErg9&}eV@~=A;A%Eg9#U59|9XFSlZJg0hD^( z%33kTq_>WrB*lE3yy(%Y2U%mc@F#LSWol|qvCmG)y}zO`+T{H8+>qksnLeyYeG?qmLXn8}din71Ui zr4VmHXc1g)Xu^9>4tO+5yyT2;Emxxl6w5((+r@tQ*1IHDPxZw}6f7c*hX$KN&9qZN zcU8a{5kV?~A~6y+csm(Wr~;u{JLItN&AGl^_U(GpHcNUxB#TIw6Pee1W+p@{x%54a zhv*~i5vL)OEh5^0tRzZ7UfU{E@)1}n?D(;M?w!G>o|0hKHLGRgErbz37D7{l`jsgq zIh1W!ZVECM{gvP)z-yl}Et*)quOCWXn~=#$GG@JJUbz0Ww;xz=t=sqFNpPT$V5vH3 zuy4#F+%DeUbO%Oz-jEQw(Hieu`2lsIdz%+!zU$rQld-IvP_mUkO!T*0uFq+wG3DLF z&G{*J4HWI|o~gmZ=MtNhQm;Q)dv5(2G6PY^i}?%tErlz8lh|1)FiDb6M7kw22M99A zAYS>{w%0y6vF3!et5eXc{ayPhTzga`w;OsynD!v>7!s`^9XM+p4U?EYbLzT`Yg5q4 zqqcuvt09q_Ehd(*XcnR_-V8=L#Uwjt;mFe5HRty0AUZLd`UKSw&<@Sa+2XUM3fz{ z0Id+Rci+xU79n92RCd3nW$;rSB(<)l;MbW8hKm8G1h%8FN!uG$c6_H)^@Pb5BJ7up@_+OLq_;X#) zJr~hs^zq_uBfC-9SwEF0kQOI)YMR&Kr>b@~oK7X`gAiu37|}ytTK`H2$VU&YKbw&E0^U`V<8K zNCp#;%PFaq&;6b_h@pd3%%_W2BfcHB^<^8Ai1i-EpvFY=DXlAZc5AqzKWkT$9Q4(L z@+I_3Y}P*mk32Miqkw`wm|k4BW%Spaegf@iQ-;U-%=im6{6diOz~UIC z)5`_{Y6USg$4V7{>?Mv(saS)n4A*-#_$@Zh^6##yt9xFg%mM;gbh+C>MN&mu z8wywM++&ly1EIOQ5m5}2QR~RgU6uMQB zAjrPJq~r|!m#M;G<-PgNhX1H1%>QQX>}C|+j~XY5?Cw@{Ka$DK7wTn&)&dQcf_B)F zGb$T4a#zD0ec+zxxP)rKeq)wen{Ms!L=EF|!9UU1N>F4RT zw*gJQ1&07|trKMf&^RaRtM)mY~m{t|M8oC8dz@UleA1%xh%Z2_z@$psF+|P_=hw zEeX5ozqGRUS_OSZOrgJFn6ILqh>fF9Y^I+^PA6F>--x<7X!K|*I zknSQ00YN=XlN%-V{%`lQrQfTYixARX37Yt6cKu+~J-CDD|4yyTmJ7=Qw&rFhka+z2 z6HO>DA(&sjeS4_5ZWW$AeBs3O{c5?pQRnr3Ov<@muQlR0jm2;-OCdu$0n)ex2$E=VdXHF4DU32$MfohCfRq2(+&_utXj` zBI8-#yy_j{H{ZB+bxY#{a0i*uK(z&UDLi10F2LF8F%9TSz zl^mU9MBXOQL(e+Zc5~~7_vjB4m{=3;H~*$nk8XNR-AQUH2kTl!cjNe~9fm>;`2IB# z)!ZKF_=|bpzI_?O(QSQy{4K>JWp(hee7DO@tGll?nBKm8>~o$BUKS#FTtwcnbWY*w zC}c!D*qK!JcnN|<#KEF4`reW= ztuOn%vl#O!uEW>&C~iOBTh^<3>n(_au9|ja1X+~9}YGr`+{CNz+**rsb`D8v)rd1x%8J}OPtQga9vZI zZTK=Jb(KC|x**;HP+Yz|W6Gr6q$^${T&ST%|FSkM@rxhhUKsLRX_S`2$tov2f_4R3 z7XgJC%NVKNJ6q}@+QRrk&LK#psM3`OF4)8fT`zkT9oqkxVaF5pf^>C%f6RzOMOjm` z6LJh>YaGTx)pS9%L)~<=0e!GjHP>yBhAtAt8X8D1uPMN?!b{g6W+RiX5yV+A#{=v) zVS??fU3(dV)&Su6C(fkIoYK}bkLz1awmI1#z@^!n+H0=0VwZmV;`-$&-R(9xup6;m*+z~?#4wc$aVk|#DsG)U-D8$5F3*_51 zzVL17bUFSd)4qXM-db(U|(1TvzWqdp?u8wv9Dixc_D>`*jo18 z4WB;CuWAqb06n4*KlfbW+ZIcpzGeP>O_s|4QLWtnq|-LBhH<5aTy+kLa$c= z4<=+apoL$7o#Mepnfm#;{Xn%E(0Y8~@F7#omsr63M}p#p%J^gWnzx z_7{UV@Wc10GbLlQoTVEp~dG9Kj}JX*07M1FGqg#F~s-KFw5UV^UZZ+|K{DBQy6D<#BmA_fCuLr49c zK6Na{V#1CUdyyzBOKWRGD!$t-iDT*4P%}}G-gUj*F;>%3WfbIsh=lnv{?=9gY+nU%~XRBlNT+EDHo z$^JnzMp1cFo$3xWfBft97cgb`OXkc9>^IHX*-c$lbQfSSLMBX=T0Ef^Z?an>IjKbCrK>WZo_>8$$JM+F5ose7Oh`-W74mcV} zVf(h)ZyaKQHza7FlY-qqAS#X&h(QGJ>US@ktQmohjj?oLwI|?lwzr^DxlStDRF5Kx z!sE|y^oGlwP1U;p`X(uC7sEHl&v2v(7du+gPEnfwr!0TIb9?CwT4tSE?|0RW=)4Y; z)>AT#z8n%(Tu1x~c(B=;9*zlid|L^u1;a{v>V$b`S9dOyFe+};I`P{prGjC<3h#?I zZUkVp+}wEJry@pZDBcCblKA1|LM*tuUY_=C_Uf3+a(zdJ$lh<0j?g@Mi;aDKe|A&MQ&&JhH2h?c z@jWHgsenPsA~ON+)fIpLv{4JOwMF+m%br@}#-eqpSmihUYBLPq&ggPRNWZ>)e{N6> z^G5`sOdX*AY1zdTrN6BQuU+1%6Qtg@R;b-zuu)G}Q*5gde&d81Kv#SGc)31(-0f`U zuljeQwiB6qR^#3jPJ`8;%M}-z>fpf_()YiV4aweW<8TTnG<|(oao!qHVCMPvFeJANzjZQG`}%v08XJky6nfmGYs1dODXYzx`^f@LZS}Df%g{Tp<&pE)WLR1ck9oop#^DLoKdEMNJykVpZMmet(Hk zmPACZQzUL6^yr z(8KlB$>e%vD<&KN3CNWmCwzW^b3%tjJA|keouIeJA&U#>rA4Ph3pZx-$5%)F3uFRM z&AMp$dqMabaeb|hDXM*X7i<;pp+xNXY^tuHuO!qA<%Nz!S%p~!!8zig72?sXwO9EqI|;r zWCgndmuX`#>P~(-&K?qmiWJ9~hL<6KPOuw0Y~JCrI;N~!`@PL`E~~DbCdmqdJrTuF zNzW#5n`Ls9ZV>;pwnFiA6$mF(-Ac{F9G+XqVNgjEa!*yk)dn6NI&sr~{;OBx8XeXVU zpr^r?dd7W#0z{)s%XPb$Kq#S>#7Xd=??-z3>nf_J59+6vjyw{xTxtaf_S>C*+a%s@ zuTN#xYPwaT?%&^y|MWB5-;=2x|8tg*v5PBCPEHP$?wjq1Y?h%~?y@ay`Y#-dI)v$5 zHNYzl5z1KTX5z);+6$?{iOA}gRi(X%-A6QXzbB~WILwI%k-CHhlX3Zd_<5@I6 zY|e>gnTbt#rmcw72v<1SdmAPZK|kjUePB&9g%5~D7_~6xFEBxh`XW8pL&| z9jb*;lgXFhTR9OfUv*DAn}cx(@R9cVVdc9m#V#0?p9DKYiPB2>BKS5yum2!GD46{I zCa{#6d@mXow{6^-iCh@Htl|!sbpfA=GyQVbTZ^k#=ydHK1Sw>0y5`(2~fBxJT>g zq(KEA?k89+Uc9qtgIZj{Q#jt7PtAgq@Eo(1RtlYh5%$_S{+n;9sOg*SS>pJWJ>!m5 z7iai5j^w&OCyyPw$B+u`<4W`@qO1~vXPzaKVGlQMa$5A5tGmTl)7)Y-5zV}R%9h{X zZ>P7n+p`uzN)E9J0HbQn@*dr#oOwB^MXx9+mJiZp@i&m4_#YNj>0Z z!Q?o(oE_)>ZH2-}hqsP4QxVoficXpIx;AIS2D^m|`@O2fpIFRszzr~jIfKYZa>j*< z!qoJsMo9gZ6u`1=Id#J0p9-8yc69G#I0G>_h9(BVB)b&f0=ks)KwAgo#$5&QhXwX{ zC)w_ZJGi6U<^8q~9ciT`X5bxC&*E*FvgqYzCzmmLa0v)h_~PxEzl`17 z+(PCrkv%u@-VG_c*tos#Ga2#}LmLn4!x2ddgLS9WBRi%n&XH4+f|InI*+EvBX{o+c z8P%RsW$#t=D$4EymoB>DoxdvwVf7k}C@MFbE^#iCckn4}hyRbZPA!wnymf0mhsP|L z?>(_D+W(-(wS(SQX`ns?Z~ub#e)!Wy%DFIPwSL{lkWe1yXCLYr?Aqoc7m@tivmh0=7i2o0!M>~ z$W%no0`jn>IbU)I)IH(*-L-E|_EKN%;vqiM?jdv+G862wDgfn_ILeUsmfnkEJ7?@NTmwI|5TUdscfrt0d&XIE`{gvR z2<`DbjW=kp*gR+i;|B0*oK{RA?z55-S{6!G&b=)~aR^PQwD<`QPqcL>hmV+kn(fMF z>3n{{`m_ls1HP}8pFULSN+eK#S#mum`r5)9K6J8Qs3XjFP9+pguvB7<3(iGxku=Lu zAn{UZ*=VR4juIN!KNsbK801TxF>%8lB>gK((>$5W7d|yt6DvB2k#DMoJsu_*6>kHkRKm*h`c zV!ct(d;BiCuV-<2e3yrtq)WFrEtdR-3i&v<9Oiw`D9{VE&MdODR4MX(9;`R{ak#j_dzkF`#1ZYyOEJ~JXtnt&_B6_lTbQ`W`(D+S|`{GnmmUTmvJrp$}Q--=tI0p$PW&8H+*Jlpv)hV~MoH-?`AM8d830pwikMZvqU{2Jx z6LC6XT%a23)jN>lZv1)KV7to15-%T1i42Zj=YVlkG(tWDFWJu4w!rSlh6}kvA1zz{ zIfGdr(XJtFK{rWMLFLDfPdHCR;|$M{@JBd7ypH=HAw6qWC*F^uq9T$JVPcPxL7{qF zqr`z%(k1<~j@izi|CmFHbm-GZza4-2!De%lNC++}w!4tG%Voshb`0wh7LVK7r721n zA^bUfv%`X(QKflxDr(A`>)!@Y{Q54~dC4j~I9Kw*!xKv)5uOUg1(GW|btc;)$2}Q~lwCurd|d4smho zVkLyeUWl?+BULzFvWY{EOAX>+mF>vn4lRtf4=*Ipx0Y2>*(kJhizV1&jFQ=bk^R{K|pY@87_WYG53|6>qyVLzAU2?2Ej9N_i~=(_I_hh?>&bXOa{>t;cOU%oS(cE zx4aonPD2S25$oW^v*$$Yi9bS3&$-1(iItbgh=n>(FdMh2<3UXAA1^tksS8bJJuC;m zw3)b2iG?t3&F`t+GcPEU_ZVxlMn2X>BdLr>!o5JIt`WmnOmvlj5V^i`6a(zo8RigM zFoYBu_(7EGAXI*nJc#>Zec~Qe4&|jbbm#$IOG69L3huRdQHrYBX7gR+fXG{&j-Ct~ zH&NqxO#4sMqu=g5J61@lG8x-YmU;>mwS!?Sk&P-`IWejo#odH592|}3G8*+Ez?SlN zp+69DpcG%v*p7t6t|DaR{>f2;S}f&G1woB-LIJSLlnycI6@wVRKu)AzOhdytS98wbU7nG9$ zA&k0XZA_^zXdG0hOnDdGQqb#&bFF9f`}e3(O$j%T>Dz9^J(}8@l9UOgXZJz;ZyXbK zkOt?*(Fr$Bn&+L}9{MUGg`LWk#Ih2aUnC>pf5m_Yx;XNOWCksxqZ45ueES5CfDlx&A76<>D zwm*j_yeor?y7{IC|LGUPf&j_>RKm_<*N72su3Xh8^=1AN#*5Avd^M`PkHqHu`SWMh zF8t0;8_ZmWz6VG<3w)7=g-5_vVXUda^O$PbWqbDPxZ2jifMLseMOK7lLjeZ1m^ zP3*$r{wO3W{5_M+5-#v_XrWtPL3RG;GMrA$Tmqiy$jvq~v9!c{`B? z7CG)!KR@mN{y3|ZJ@+|LchM#WSmVYllbx(7afHAl3JeQ};|0Ipk;coJ$pM0sG6$Ff zF$UPGbKe6Pf)rzeZ!>6}#aMMWouH$)14ObDceLW%R=Jgl9by~%rH2!_m$+voBVJ|#@uNFAmijVKP{0AFOM8GNBTC!w` z(#~JSrSMQI8B}CSVHfh2@?E&%E#U@NFj!AgC?&C&M->eR-PPdHqvuW>@oemhi&y?| z0y*GEArxj)OfTei@7`S>*GCb>1iPRWqW6N6OsaS&#}9}v*cy1n=tSy zD_gSR9ab1BOv~`$ZorM_5)uSvw}QS~Tn|(Ow~H=S{4)UBlbV`p{CMquCWWt$yk9dJ zuz;z(*dY?a<3|MK;U{aY>5-b2HB6tEf3B%9BKQJ@jeWA4F9wW^9nmOq1B;B&2_HA1 zWWqE2cz(Wl#HIr=F~e{qr_$xl6DR;)gc5fP3T&VCY}{-d`Emmz=F0J{L`ewQ3@I$A z_(SnQ5#lQ$kr16U9rc3db=Q}ge6sglI66-2LXJQ- z{UL{1B@0;mIorjafvg8&&1Q>=A2f%*T+q?Ip35SaF#&9!xT&fOraIM7*+L-;Rya)9 z+R|clx%5+EacwZm)^JPQxDD&qcYhS)e*EsEC8K)pee07T)*_znLP%fXNYTD`-@ZI* zE4(NLi_2{-`eUqi+H>sc{8gas8NNJMS3;%F21+%qrBgJNlunCddf=BZ3{kuG>szZP zUDUpWw?1epOiIF&PDiVR@yymQ_81ymw<~<`)#$fU*gwxeoHN?xgQVS6ao&Et(HbdxYPG0kg%x#w7mPU?pW%irHTwZ+cC!F62J za*gtbMD^j0om7*pV$zb(;n~G`pQhiaV;|FucKG`vbL!r@H<+`+0t(-K0eO+cBa(0M zh4qa{+CR|a0OE$%_ixo>$Vz>>f`` zvON?}d3((-d9ms?Y~8wUoMd;69EoxHhOcjJ0us;4&Q`~monA_7aoRKNO_B&zhR+M{ zbmQjD6BLRp0mGw%mT(G#-#+*#E6dF9@vIed!-A9yr6 z)txBO7y?p8z3&`7B4dG*PbIf5ZlJ`m_orQ}dIDtGr+WB zK>7kdz>3OmJx%20r!GJuc*%U_(jzMH7X^G#(?L>UhJ+5(KWRNkAH!Tuq?)?4p>t9b# zumJidnM`ZX{aTG1S44T=JIl?xGy=G~hfQ74G#XG|7sM@A?04^SkcPJC|25u{pj@F6jAUNNm@of3#eK-ufNRm zc0MD{jCT35Hrk(R*^5jO46AFYticQAwlAg`$0!new|o(V&U_|1;~5nATm@{D(OW*x z58m<3go2{ot3y%TWbtbY$DGt!^n`JS$27C!ej&E+f*2EJivR1+}8_XYnW8JdxkfjXw@PKh9JsBH_u!-+`lc3YLV5 zo4tMEoXLdtRh74Qft>20$OvSyb<<*OLXzCmn`&#+a>b@R~%_AtVco~wemJSkML#YbP)+I zl-|-EJNj*yg1*bncMggwueP7LTyV5|)2Rme5}P}m}|=XsI(b_M5yf~ayMsnXc?K?n||M8Xy}uZG~~hM}*~BGBYE zJQ)_pu%hLf;S=O1d^i3PZ!CL~6LrtMoMoP?BkIT1|5XY~QPp@*HB0~G?}5!hzi0s` zZvQ@<7Os*)bclwAxWzb)1`6JodZP5bMU7kyO`E=RFEgxU`ve$&Y1LFF7CUW$36@OF@*!^P6s#K>LwFf+Lk!Sy z6XBmIF{Rko6evR11_`)=TZ<3X05up+8S&Gipr|kET}oX;L}fgVA(Y|77~SBlme0oy z%-{Nk`ZLpo7iZrrHq;zOMu|<9+d3fj*}q)^nyeNXcW^>xMYnxj=68&hCfTbJcQH>9 zl@|8+_lk@Ak@UcID7-#u3gaU)S{`L&jHVml1aQJ5 zkh>cj{~f>$2M$H}Lgrw9-DUYxM(vWhWxQa+`2Fi%F7tXkE?autEOc^*$WGgzf)6`gz6}woI?xP{k4s(IBY~_rU%<$P2|Ei9-;8+haAsFH zY-+z%UA=Z)yz&y`tdFzbK*@x6%Ln7|y|+Y(;TZOt_}ci;2;sh-M^hPA5mi@HzDPN1 z4&m|Lg(ljDl|SoNk@RS;X>nM>iI5A~U0}NW5sB_E-qZZ@d*CF(Km~=T#OI;}KW3eX zp%TG7Y%&p%!~b>+n2Tog0lm$Y@mpQp+)8IZ`mxG5->GX|`SacGc?+fo>Q@=~0&f#) z>a7h$Lh$WuMhn2uqO-Qz@y?i?Lir^AD3Fl-qD6)mvkw1? zzZo~nH=POq{aH_#0nUmsXP&9tv-@_Y)=g)wnq0qr3)gw?p+{$1UZQo)x7zr}8kD}T z$@C9-&krY6Ml&|?ZqAcC+C>Egw_jxFcM3H=a}o_-#aXIk9YvSgO=uo`u3mM2n5Oki z&DAdaVGNGE6UW=NL%+s(=(lm=rikj!T|4S?J-kWXF07Qg;w7{*BO66OD_(L5yGB^1 z^Z(j0+c~C*uOWs*4P_Je@9zl8fK$QWa)7T&0lFZmudrDD?n3!0o;gXu_kjhW8aa!? zUmHY50fZ&jJy>CyV`-^VwIHB*saL2cWP}(r9X{(hHeYDX4X}IyOB=oFS#R+747;&Z zSHhLgd(WPXaRQ2Gzz@^E2JE8z2%jNId0h{sR46}1WY4v9Ho(=q**x;h#hfDLG|)6t zDbWjF*IqjM=;--jh=syOuido#%e7IbT9bQh%ADo7X@2BO*#$$X7rBYKMmf2Nj`?Wc zc=18kSBDHYbxcg!boa#zP8AR0&usz4I0kEa#$n|};Mb_-kGjN|b~gSM(e=}^;EZ># z`o5wqw^AuNVC6H!#BAI{a>@i{CA?i>sX97)pXDibbe6h>Ah?|8*1hlv<&>xc$#L{u z^Q@&-j4rwqX~X{+Z`(G}Vr)02YZ05M%v|^ zRFX8rGwqeq>zPmUYTROhszTJHe?{?5xslel<_{Cvx2RPU_95>~Zrc zCah4A&PfBIP{1flAkSD#fgk(&fxd^Dkjm-0|O$b+3QXDC4 zB2Oup9G`QpCCLlw&Z}7Ov|E1lW<=c@2gy8(0F3%O^LE89rYfF4F#rI8?<|}Hg>49> zrfBy4Sthgoj`^e~M;$5*_niDLLxgGCIaK#HGwkVKIQBCv%L+ zt3kBLp}uch#nCI3Q&W=>OU>|qTSVo>a?dBM>V{zw5CnfZ(aqbR`-HW9OVtJ$%e($*vcV8rl-eZ+Dv8fZt$18qg$;i3r1Oo$lNj%Qq6 z;rz|LJKI<~FraOqOm0@?P6*qv)HVd#^7}8IJ$nZsPwe=|B_cL8O~E@A7*r^ z<3iPDgVn1|TwfI3O#KVqp6ruz&sqLv%a(%pDnjV z?eXCSf%9K2MgOOh;?{O3Mjx^dvP$?g2_BUeCZH>N+}y~h-eGqpMJ>N(vvYoOVq(kj z9Ge+~B)yC!C$CAkFO-82m0kb&=PkM)bA}T^tf#m-U_TMzh(%(x$_6xN%(G8{8NXN& z_=4k$C;_UTC-VWEyqU4}UuZ@z|2fRJnKHlZyl_{-977oUkc9>N51fs2KBI4{`YCd- zrTLamv3n z!ehCM7<(8dr=2*&R@SIOmT=oSe|ep-eH15X7V}56`GwISUPp7OqeYh-}r@w)s-ncSedw(~I(64$uHg4GCw2Z-!vEaQ_yjHND!+`LSW^iV40P)q?b-6F1&L$*^nNp6wlF7H@3O~LUK4z6E(ORgX(MTo#(T6=u?Yl(O zrf^n^&CD*m%->3*S~UIZ7NDMoS3CUgzaOxM0*iI^`T{Bx<~7WzKR)01{rh{-Youck zv*lg*$_c{84x~Tt;H>G>`%>~SNG0~ObN38NbR Dde-Ea^*!^ zPHE`{_wED5dkQ4-f29LU1AO$f%^2$oEjHtNVm9`jsi-^&n_^GomrwC!IPmWynt|8B zg3gUKj|B&mu>C!af3K9jvffC_0=F$DEH)s#Y{o2nmjY zw0Jlo^j^Ci#-YVtUGBq>O!>Nes=(knr8ulu@MGtFXJrI> z5PI|%n{|Ph;vNV^G4Vl+ln|;Jw-z#lAh(vT`{*C}LoU6mtkmN6i2%;;yhGn0+B?uF zGz~;kTZq~~58pA{?5d|WzGip%LwD7IF5fdAS4?VNbv>U)#cMI~dQp=(#i>QPUp{+8 z)_-+{KRByw>pvyz{kwOf5zRpoBCb6!Q(|!|C#QVYo|j^6B_X`amtLvp^HY? zGwy^_!+PofQMIuGeEYrw{uvXJ&DP4#ZxEl4V7kl2CHLBjvB&g`owo|fL1X@EWFJD& z9v>gSCCB2%3i(wxlm_x`Oz^k`o5dM| zU2$&ytWe>=I%kgWN3P8WF7+FICtRT)O+TSI+G=HJ{Y&ncm&J6 zb!%D8i_jdi&5?3IbxpECHAQ@2ir)l{tvh=%S;r8{Ei@cL0{PWmCsRVyE}|Pk6K_SG zXi@$xY%qE5Q^@AWt`^OlDdD%_+S1Vbo@9DyEY)u_B8pV@o;?>1ULs7~*%5m6b4THD zx{FgEVHP;C@zOs3?QIsN0dk`!7Rk|{({u9>$dAUE*eft_4ucUP^p`|~oCnP76!Q+5 zLM}sF;_H_$DEo}AsxgwlXj)8$3{o@5n{`vfAivn=iDj(7j6&pdb+aHgxy=yzLSO!& za>aOw%emE7jS?|qxMl`_jz4+j&D@8O2GH3huMI?L^MDu1c01OH9_FdS6?7(OYcLlf z5GT)82z7)OdLN8DBWHsIZ9MOXptixg+5iZg6)z!kc~_F(>=dwg%(BsN$79{h*rbSs z(evlmOW!hO;cYmXa!$cV$zSxyHtP;g>KjcVd*qI{)#p8yT{Aii_vw3c60Cx7VH8BZ zuy8|bx)~wQyJkGEHnG8)cE;fz#-Ym@cYb=HQ}-W88h#Ll55;s_N17BmWl?)(DS~jw1DpFe*--Kn(n^uH}#&fqd8 zsp#yM+ISX*O_2z7n&fIgu^ZDxBST(8&b1^Fd@!r&)dq-5Q5pjXZNIkS*fSLbl;~7H z>6R1SYuXp0kw-=3N8@cjzvix)zWv<-L7kFY7IZp|%IuXVK=v_txmM{Prq;IEY_hO` zesaw9$d5m^dnYOgzkGT9-_K%KHeQGg8ZdBRVN$)n?#Z1<30Yrttd)%7P@UrrGWcHh z=lAMYLvwaj!+Mb*1}LALcj+R;tVnCV@~h!{*tH!Q-!1l%6&8xx{G2a%WwnyVGn8`9 zZ&_T{Po@C-brVyo*x7aieq8OIUT|-f^o9W4w)WEV!pGR^V?#vb5k7e!cZi~Zi1opv zvnIlS;45|v^;s{b0oNTkOs538QEt+t;}EbA%&8abCMoS0B?2vRi76i*?h*R4N4m~% z3u2!eUkG%=62WTIze#uQOr=`?)z(G|&op))QDlrt)WV{2bA3_nAXMgDI)%&UUm6Y* z9mzjL7I!^Wo~hWy2aAI2n) z%S3p0c2*VZLGYEiKdip)N#nEP;s9I`U*55|ppbbE*q`Y9O)>4~i(f<9it2Hf+U4wg zbj)`|>|W2Fr1a0QtzZc2BtyfLu?yg`;88i8teF*4a?JDLr4*5UWHT^k{m>ar{?G%* z7Dcxl81FOdCe=LMZrVV!O8EDJFhGlD+;I*8Y*gKBd&kpZA&H5`+R5jb*fz2F6IuLV z&)pfD`ajRSw~fc$d2-#C1kEm4 zpV{-De}udg-mE-LQc^NvmAmUGpOrF(uQgbr1g8pfwO~nr%$!jG8Zb}?L%C&2of!7G zfB*jG_^qGiY{vf3T(9uy$()0{wb`?UMIhqml8f&%3Jd+XTWe+p)0=j`5Y7(X3l}cL z$*OQkg$IV{i__0WlLA30q+`|9MwOifABAiMe}+b@A18**8A_o5wNe~$4)3D6Gs>4Z zX4(Djh7Otfa+^fzT_b1H?t%E5GZfOrN_jH1+%b)%u9|;1J2PR*m!2xIxbSsPaBu@} zSFFz=sYhcjfu0NA-vU3gOoO9qStGZ5_npU`H$2z2m8EkaGrfVHxjp%{J;b=w0*tr{u)6;c2 z>T-Vq)DPw$ggRsNeQz(k-Pbaq@YNze-$kJdr$0`- zAx2;jO-ej`;?rboFLM#iBc?&vrJ7!OUkA(ta`d`rRItD@NXc*g&FoocoAnMz7sn|z z%EvB~f%Ah3Qem_LeMrKcJ0)iVC#tN=h>17pM*Bn`w0S-X9}9c&+7(DN|Rzi{yB8PZdv@F+duBxmY+g^%dj_@M3P(b6fGn}z*>FOL>z6QyzoBm8(zG6qUTI7-4 z@3w-j530L|x?q=ft?>dbaL7(lv$9SwPJ}K}p&**Jnen~Jj0kIMAJ#5CJ;5fVR=TBl zbaCk~+3@Ap7@r4u9OkPz1s3Jad9{rg0!du;u21xxt>yLL*WjY7GA0rs-m!O-Ld#FBrj=oDWZb8xNCgp;4Orv1Yu+5M-j*}XwDMrk=|c-fn@{3{YLGiF!; zY~Q)__R*N-&YDh_JA{o^X5wXhsc%T2(J+$GTh6h~n*?tvPyDMrfX;}a#pJknf>Oyq zWQrnj`9ZD_#8iwzx=ta&3`O=sb30%&h+p`%!`V}13aJ+4iYT$+-Uul4B-eY}W>Ydb zH`N^p3JU6fVR?^=daX%*5SgyU)(^cr)xK-K&(z^`$f*D3j&HNKPYQKS{VVe<)HG#S zNVo%i+uZ||QUXVlZ?^te#!t2Ffp<=AIij>Iybf0$&Su`V+U`o$R}?P{qzqyA^nwkJ z3>`qOoSkCcUP73db9)Eqoogrh%HSyUG$&q$&%v;X-w(q%8!gy$I<&_;LY7}9sINnp zA@-w)CM$GI00F-DL>0%HerT8Y@kKXo%pA$W#tfTSS^8@4?n^1X4^atFDNb+%91!eb zk`>c`!6J<%sgvx*#6k7})5Z_*E zt9@rKlB1Yf{J$0~U3&6I;G)pWU|}&KEy|c5U(6?&-PMLi5iNZj9`NdXI#MHS>9{Xn zzm_w@Rf))rO+4Ma*L3=y7Qjy&c`oeX%B5>hekBTYvhvYqm+c{g>%!ksFba6viM_Rk z3wvBbCcu#>-ErB%^o`-U(mZ~w5dmfcRRi_!)(7YWg@%L(6(CezY8L7?Sj~>YlMc_b zvZ6k&ke@hlBeG`k1+;B@4;bKqNYwuFy#*WXyH5PR&yUN&v)c%X!e?EsXhc{NJvHb- z&6T>ssNd$>)XRmnBo?n#uA`h(Z%b&8ie8xWTUFb81<{-txMSMm&shu>oDohRs!EP+ zzkZ1^E}`LJ%tuIAg^p4TsJOqatV|O|!4O&Q2P;t`jTMvLEHFT=%_7qPnnvz#YNl?LX0)?Re-AhVZ2UvX-((iuh>gz1_J^>jy6}Ks3 zQuV9oQ54>Nl%GJgpujw1SRc}eZ1fbT4x5GH15&Dc7W<~Wh$I{;QfN%|K8 z+F0jKhkv?Rn>;e^Ts?#umNcG!&`jB`XXtWE^DM(gh2*Ib{u zi90?nI%S<(CTV{z-6OmgiY50Aw{9HW&kAH3J*iygFO7};EmlWlhG0*H)YOv{4@TJzhxl`Hk;F? zu3z6R6if?GZJU#m1%)Qvv3`(Oe9j_VX^~OBXEx*`CQf2q1u0kP?BhANQ(86I zX-C{H*CQGQ_wTk(omKQzlQLyt{}QZLAwZx8H%vQ6<4DlvVwWFqOnBr2=)~w8e+j(k zca}w!GsMt7i%%*R48gRPS5!O^6KdF&V({yylt#mhvjRCdbVz0@vSy+ijxC)}iPx%aa|Ms#v$ z#!KaOoc)`vtf$VNHLUfg_wWt$5kR&_Z%t|zpADK}5ELx)3}WHD_w$bwD4=!5XHhU6 zfet@;?p!)<`a;MqsP?RW){*D7%sBq|%+Z%g2?m zPJv_CK&|#G6mZ^KS;$3D_6QWh!@%fF4$=YzWj_F}GnU%}a3v7=_WO}tb z+0w5Uq>8)4XC$^l+e`xF9`Xo<0G5hQbl${JHeI{kbS<_IErOUpf+_Snr_#weAHnJ3 zM4`P9&Ud{q-k=J$zkcKBAf0#pt-@V|rVv(?`sJa@YyYyiLkABEn&Z5>%k9S#u7}nu z`IX%3eel6L?=9cxwiuot;?h{N5JwF@vmzArc(f**q$7*l5bKMhX!118>Ay)xvEuwI zU`t?R0#=R90fo_rTYmhwx##B&P@I4ZVmwMtt|OzI8(+!}84~&K*p^8t2HUqs=cfcu z;!dL68_;z@1(|Ic&1~ENXSlUgkL9BO)1yadc=#gioeQ4Jtt)SBIUuk8b@3a zYk5f2@vrZ>j%}G8&^I71PdnskGNZov`El7fOO=f~r&munl@41!bLPx9%eu^uGtQ(g z|*REbU4?xe2~+1aPhPHxEA8xV7?JaXHHDHr25 z?<=}m{$%^69>$lSWju*w>Brh9w3)_DoCs?PO?)UO#y(IlwK&c?P1s%1 zwZcaeEyVOC>W%%NF*lG)#0(Mf9#xVy6gKF0%Yeah$!1FsAv-4zg(fZDvtnkfgkZd$2;v5K&|~+HISk9Wkc1$ZU7nbR3}CLZf}dHC z3wZw3s!#bnQ%m`FyIrOrtPxj=mQM@GafzaqZyrkSV#Ee|fd-rP=odd*TUoX;NF*v0 znnGR=UG{KNz;p}!$kIEM6M`xSsfcL^F(nG@2&}Y6Nqb_bI!T~!*Ks-OI?eP$9WRc_ zzIkoPn;my#U0hl>cU`VzF?@08@^YRRIuEd3qrsHt8>jJnMYSS)TWLP6|HHTp`}(~9 z(-W9)|3k7DW8*?&z+)3)<292kun!eQ$?vw-_wV0tC=Xh+c(L4w5&IzyRppoSfnd+Y zvYWqhGI|ji5-l1mU7ih-uJkCs;>~27Z!lfj3*uc#_kD|6f7J3zaAEO}I}-0T z$Mf_;RpNCV` z%V}PPf1*ZhY9tV&U(*2z`MdUTBG;ii_4-Xk*=OKDKh*&584mc@*f^}c!>TspTbj!s zJ)t`})Vb=C=3b{2>nEvMUO#N5!u%SRAEJ_zxIJ{ZlLUmw<(@%FNv*bxXC3VA(Lc?9 z)#vsh|AG@xpw#BGt7Bq2;RG4_3HKe4so{$d>z*zyE(7wc=Yt?eiSma z5e44^r+^iBs$8?X02w z+g)ZnY7U?xXTLA00#1!mWTkyx|C6lX5~FJLeqM&@$pCQ_Ha@QDW>8SsCE~`7Fl-U< zOT2#F`cxN<|Hcw7Yq>YPh|Jc#dS{bIE7SJqUH|FU&1&hxRW)Nr{d^koHZ^n4I+P58 z(H6fh_gp={kTfPNL};K{cgnn2VJZqS@^R9O)F1cnYlx6Vz7w-5Q>L8c4P6f!=BPS^ zey_p7T{3&ub>H`9q;s;_Y1!h0=}a43T^X*qdI&A!V^z-9N=t2j?WZFEzw+Op&II3@ z+tbV=(!IK@{O&eT*?1WA0)mjbrkltFA)kPs_AKd6tfQBOT~Sv$B1gZfwCOYxh{-J^fmG|H(8XA1CW5Iz|mWm7Z5OcM3oT5@YxC!nSjZJfCzPVK*l8)7!T%*YycT zDFY`G@31xg*n@Sn){6Sr$lMd|SpS&Hw`owWa_R ziZegFeXH@Gf55vnjxpA7%3PPryT4`rPNv2d3qNXZymq4Ep{`}VnO(eC9zuwzEpnEz zx)30jS@gywad*#?RGNIhnucOul*us?KXqUR*i4~FrMtqNC>`vEl1GZ9T%Y0O1tDSHXFg1<5)syv|JnEY< zF)@RZ^di@=eopiwt>Ru+bV+)|m}kPrnuZirlCr7^HT8Kayx;5>I!rSul?YaSX zevX)TB{!~{&P16WqkOL}a&@kmu-c}Fwv5k*U$?y?3s?s|pe1>^3) zt6S#d)p?tPL%$|VOu^1-?HzD!TJN`9xs=GPTjs9)y18F{jh|lRvpZF_wZ}X?J#TI` zuGs@a_h;pwj`m|)BG=>&qPZJ*uDOp-Z0NCL&xaH`^|N{r!mT=U-oc*zAqzi7B_+8e z_gNt{eXKs_X-;R;5E5fCzQ&RlFre5)Ay#41|C@5*7yO+6wXHfsAzRNb&J!Nay zXV4%d8{PIj9cdRS5CR?DcDMgcR%>Tpd12$O(n;thM=L4y-^ct(z`qOSg*WT__hN-C z`fb`2#rrRIWm1)_(gA(v0^Hs|{k*-NKI+64{a4QKVr7}Ep$adT^p?I{yd_z?@+i}B z99sW6`>hMZA8S4zk(tj}02M*x<+48(XiK%k<&XJ1+<$^0YzwxO$4~aMwrka8109tD z(_4$+OJz>awzszzmLUv4V)wKdg*bgLX4)8Yt(g_9qNX-|&yQ_FqVXXoWcCo4W5>(6U^Xsq349x7oA?VW$`xn}OV@2i!E z22_3;aQN`yi>OYKGZQ*r&?Pc%Ib)M|Fa&sb1~V6>#M7%UEq!%saJ>cqbqSIl#+oP> z26$=a=ESd@4D=oOXaZw1?)6WeWKNkeEe?&mt^pliA(hhfj`Y9SNOsa@qJS85XN}!- z#ehNfW7p9pKBlwvRe}mr>42qZ)GiWC(688fJFG|T`?|V}ySu+L7Wx2@G5>lyh0d9K z3NnpL@i71=Q&tHSrC(tr`3P&x3`|dtW6uQi=vd z9QgGo-l?*DSwZvfKWm#eZuVI`Z(5Pl$is*04!_dVi9RsSE>gX5-SvdqTIw~`(Q$E+ zS7c8_+Mak_8+%3FIL=_9Npq*>P6HS8>ojnqx86S^S}$bWdy_KfM`oMe@ck3}PLs?^ zbKGt!ckWK*^y1__rS(~@L%cNmOL_9osx@n7P1t0{@O~6xhAn)+E~azeZ<`5#2|*2O z1vBce>KIN0bGhG9DXBy(2dbS-vt$L0jFiv=YbN=eCI#O8>nf6uUIKLD);&1T zq4Rc+XXV?Te%dLoppZGiXsp-bX`8ZacN}-xHGHt;x_|abK3sk8TmN%m*H|7F38{&| z!ET;{>B6n*WdVk#>h?=d-@G_V(`WI{(X*3E?DSUBS9CkAWxr0nb|+e%gTb?;Wwqt{ zWCMXBf|3#wJ=9gKV~QLeb{%UthqKtz+GWu0p(nJEOBm2g5-r#hY13cNUo;`w)ro_R zXm(v>=eh52K`ub$98u5Emb+R3P0FM|Vew+*k| z+*M^X+h$y7>N_QmS2Z3B*rGD6>gynnsh8DP(xiy+HTKqCKuIxbhg3m~?4Ulw?0q}< z&2%~YNTW_}bW=MMu)1TPW2x*_x}x?uVLm!Te|B_0Gjws>i&fW%&oW@$zA zK;k^?(}>2LnE3lp2U@!oXPz}IvK#NFS8Fh9nL?VE=zQ=4EGJqKkdvX>0y> zRnPB7QU`iz8mZ6GSQ9NdFQT`dT%TpEj24^aBgHm?%U!R=#H>ICeu0wEHy}W*YKOLZ z%rNDxrLu+6$%j+mSXM%zB{=qZHGRXJ-jDSs;4u?tku@}#{!H+!kqu+}b+ZInKg-PY zeg1JdGaqZ3x-dd}>&%U)wJBySJ$O_)M$;or(4Veymi5si#*Wp(FEw~p_y;y25t~Op znvz#kbWLoU>3*Z*$`vbu;m|7!!sBSt)E?@qzwXw?)2mjltfKw7!ouPTjI|?0r8O-Z zxz%!K*+5jn_Cdb=DkrCSrX6P1seYx(MWgH6e*Zr1+h=Y{enG(#%hbbTa}^_h@AXl{ z79%x38|N%ME6%7gBR2*zDk+t;auG*R zxZbkkaXjCcy?B;sfpgw8Pua11Jm>tR~y|w9xoU~VXSePas4j<|7=O67Wtj$NR zI9dmC!(e!?K{?9ze!T0>-&Bo|z(6QG*J=$*M>Vn1$Y^{}))f}b!geP3&3S#t{tET! z`1s;T8YpdPdw+G=^r!C|yf6pHU(iTDF7b3YcC-q{vD)-fRuYuRq7a#3LP|SYtLx>^ z(1lp3?6XU(9>e@StjQw8XoDN}&l)xAQQ}n$W1Br4=Ix)q0fcQFXXQ)T71?)RK|#T? zq51n2jBceqvzs(-+)Ml=LixNKPiwi~V+!F-OG?`N=t)u@%ueZwM;Ma4|26I0dSk4` z`rhlxXPTYEBfG0x&;X#*Pie`I`q1dSDW<3aRarH=lS0khes1CvZnqiS zi8y!XjuEYemvkVa@aWSAu3=%ij9a3w-k6s#OYGWKWD2QM`*!%vRnb@+J9qMaLXaya z04=PMzK%!)LlRx=N-nT;Q}Olu+Q*7|yJrn8`m~c3GoUZqSkFTprs%C;r*uK8gQH{P z$%^2`xv|e$Rb{34qL!|5Q~aK9TBY38eV#u%=-#X@_n0@reIA8hIpdy#3)3`y<>lvJ zyM5aLbHzSw8d94-s5Z!5!~a?zC+-^ns&J|##?q_C&iQ$So9p;Or7|^gaR1I@rM;}c zTFx{d8e@Xm79*Bgv}8#kyMs0i+57A3!BX7qZWA~ngPcCS4#n|S`NDk7^L#T)xOju6 zn{uCEl=^8oY$F^k($iZd*T*}zI*()0z>u-kv(w`jj~RWE&tH3F?1ieh$uN=s7Jq1l z&~RV}XO&Y*Yv2X97E4D5hbq3l03sy)opvua6TPI@kJH`ApKWfgALZBTBt&Fxe7iGA ziD_(ggrd{*R>1MS#xdnaa+9$ugTaL?iB-fLnF+M?Y6k#8Ly;4H$&D`W(699O((K}3 z-s>+E>8tvsPtuf6^*_&sjZZ3ZdnsvuCHGF5wWWX9p4nnyEG^6i7V=by^+^Qw$o?;#T48m0(g%dJY`2lp{iJTwu|bE{Vx8^4|#Z{fc= zXp`IgOD9=v_h!;99JZT_&tz^^tGjh_l=tBS4=$ps$;-*PjQp*Nk6g&{4rkA%ub&@` zQ+j=KEmXpZ;`cNvSBT^5fRg(86iI?|&8_E?azU4{c)( z;qnp<`Qm4#_bU9YHDi~3TN)b|m;U}MPAz)i6-=n|XdCoQsxSAxoSbaR3=18e<<8ED zVzIiZWB#gxlUj##a~BEb#*Ik~HRKe^KTwf9Zsw~;Bz!-+JTNFIit!d0T76&wFF&8- z@g%&g<3|55kvVGrFVhe%V`S;JtM$EmhGm%Ur_A}ji?%p@wC`rpCBzyjfmOhQ&!BY;;#$S

1TJv4d745xltj@yvi8OLt%7H3R6Qh*k-+y~IuUL;;+BQ=Tt`IF_( z2!NG|CFA-X@8tCEe_DWUmQ-ruxVvu6NoDDqW2$i-%4SB+feke^X!chz z3Uu*#^N86G%Wn!llD6`mdzWfyd6NA^@aJQj=vnlhLqb9@n2%T?1lTuW)TsIV4lhEi z@l`~FqIY)6T)4hfIyy%P){spF@*3uYJQ&Z&uiWTmKFG?(W+mbMrTco26n4!Im6K-Z zt>9TaOHWr>Cy@&NojyILEJeoS62(?%SXh&@0!NHOAP%!$uIc=($&F`dK5dFG&Mzs6 zB=gin#JspAeQDJ8^9TjHb!_jEj+u!z0qXG=o_~)XnqJH|J!7n>Vjr(*gb)%R4ZONI5YMu* zR$E$L!=AUFWM@ZSh!ws;kEE9@*_mVtMV!dIKqEUPjL|;;`3g~SUnwXs2;BMFvW2Zv z;T+ZWKSpKLHimQB;gWM`%`_mSs3NYfR+L@^R_E$FJnp}G3zt1uJ+F;GoL>2zH*Se* zP7B0%EV}O(^ZTxha9G7X0m_2dJse*2@zRX+*$q_SO^lH6dFycS)(!H-gOr#OUJ)_`R5Sb=gnC}^weAEr3fpN-PB$*7R> z$=sYvneV{HMFHSWmDR7tXbBZOvBcb zEiKM%Z@bJ9#o7ConK7F)bLgbUB2^>H>G5eXS;SF{}lxm20^vuZZAd2`LlzzYMkm2{Yi6V@1jplBTNmYJ*K|v`%f2_e_w69 zSz=e;sCq7}sJ0T~!&)sm<*~uOj_un~PQedrgZY2}sugE9IFvXRR`dEdpL1D`Op3{Ti&xHcK#Mn#}uV~3HIt*vj`dvEhWnAUQzuwuOBRyt$L zmO&nXYsY}{X_CQN(iM3AKeO?2H5(%331hM`rikE4C7dfSldq`9PcnYaoRmU~Sp|wa zhrjpgB(@+Skd;Z%L-&IrNTAAR8M>^Q`%vE_*BHwtVpKIuL@)3n72&Jl4kk; zDNKxvirlWh;V%bX^>uD6-m*hAkOK6S`Jic%kGge!ZKF*3-U7shNm3%#Mde?T2>_zjx1!2L^74Jy0;ef6~^8 z7muZW{JJZaX^7fNwh=50&Q1ujZ(2Ojk*WaDDk`u{w#Iz$>zGa0!B~EQsKN+sBCc)4 zbC8<#$(Ei9mwHPKZtwZ%5?cOh=1{Yt=Waj^t|jM)ssI`HHQfPegW%+%Z}vLQCTjgN-4G4h=c~ko^mAJy5;ntF!WnITW zcWj#(;o;F)9US3Yan2&vxzS4JPyI$kZY#&|@4-*{qzt<0QKRz7n!Awr?x=hN^@xs- z-Myci6-*OPcmLh-E7SYcK!!pP7{p^3F$a%T-T&&gp(Xo~q*akq3z=7l4$hl_n@C4Eba}G@6xs4V32AcnCeq$XLlzB~D4hv9-TOem+6v5DuAfo=7cj=^XjN(OGqrOUHU#-&C(pk9SO0_PCPsth6!S`z8hn~vgW#zBu zeE%5`b`7v&TXbt778|$3K55&M#8u=)bk^+S;pQabo!`K4dRs5`Q=^tpCf)lUSbr5n z&h%3hxiJ)xI3LPzw9ERwM<|Xdw=@GUY8}bn>9Xwp^8@#8@(<%w z%IP3;_6g~$KXYzb+h-?7K8uL?9ozRcB(5_t7RB_jnLtP&j0Sqr0wRC=xhMSEwPm)p zkzDTFS~qU)1TAuDe6H*P&khAx#O>#zYIX1G)XM%ub>(c z--#<8x#44np0h4u{2`eb(MQu@rfdN>HJ@{gV;|X^Ox45sI2iTscgEIH3AL0;;ES2Z z2Yt=qt0JQYY430bEPc*@l3_LW>NHC zM+hWz)A{?RjT@`LNnXW2jc$#Un6`k|q>8CqIeJyn~%4At^^(2e=$dxCdT`<_&21CrapDDeA}|NR8ARE;$2Kja;k{l8G>22Dmb*I> zF5x-oLo7@u4wH&I{%L2DzS<|nK*s_j<9mDVz-nFxI&tk>Y2f9MLG~C%y;NQE>CK%L zV(ney-apNI8L?SvY8oie2b<6>Qx|Cs^0)-1Hedze5!$D=oz_B}Od?irt(6oN{}ywc zYii1kddsC6zw+2`)AOm)S^Q|qhvwEeFf}_e#^%Xw;e9hqpyc-J$Lz_S*U$X{LL`aX zmfkf2JnFHIjF8e02z=u2CjgeVR<_2*~8BYOOgf-eR!C?|EoOMn-SbO}%xeRZo8KL8JNDf|206`7Otv^jQre z^_1NbTl@*!Qun>}97wl5)q{cwaxMR^%I#^xDg8O`u)!0~?e*;XXv)fE%UJC)&GnP@ z+FVpFH;5V5zMff?x$qv59%(p%);I2Exw_zX8VAc(SwyFNf6q_QCLJg3aS4ZkxkI!( zrjH-k{dR+ILVi)v_*})FKU`1f&3t@(I{v4(ia+t_s~p`<`um5A%t7Q53@bzFyls2! zK363l2~rG->?&fDHMHel!c$!W#@8Sb{^VHvNGU-k$!>PPmToWN;^Uiln~-#f=LCI1 zx=xOfMPMis2ummy@3Mb5=w;zpC|Kz^Zg)eH%Y3QK+gL7^JtO6(p2C`hZKt(7FR;(1 zK}@%OpTLStn#4nMeos{{9Qi45O?_S6;#c2-v=aHtxs`^Sewdh;#G&nTe^j2(B|;=I z()bc_WN6cJuRb=nIx^nyoWcdPyZEa0{ZU7Fboe@5W{SZ0K@;sYQx>|YzW;anICH07 z9W^{2R6AI`N!XrBCww#JHM!K|+t4kEk6;&@{&?Z%LT^*h1F(z_G`%j#8 zos-bT%0cCP-b9%tnpA`P4ZlpRtZLl46hVGL!QU$Ec1|Q-$O;;W z2Gz%wj*~l)wjuDaup!AuH~G%rRIGlv-toAle8i@fT)ELf97Wh4uGohRJ+}WQ=KE(U||BrGgyAad=SYwuEnfj z@u0z7J2Dj-tP+}6OVw#qo>G7QEA_(sI<>5Y`Q>aX8xM#; z+kCq;i}IR(nwoaXcO7rgVfGkluV?km&BnIb_S0VRB!M~*hsifKG2I$Cy90$+-Ae?} zwnLIO?EjHHF7EWXbC$^iK*sbo|K3CnAtcQz1A}LL7vd^_hIY!ocujub{9hOeF;Fly z&n{k+riHcJE^esOW}!y%fwf5Cmclywj+d3GB*{u$FZGDN*g#e7tbW3~&yfWV8B^05 zj6SU^+x~dW$lTmqNBS*S0s9p6Ft%8D7nyr|2XJ4R_|iK!Z6WlNL9>kJ(~Z;&eBqFGsGikbi~0|5$`P}aBbh~x_&g8%U?Sn zFP>I@M+&NYC2*&|*foQqLH@=G&kojra?vaiMI*FjHZ2gkX6;d#>M-qbSYPF1zY@}x zr)lzQO0;UwbAaHtDDp|$S1B=oVye|4rxdZ)YqK)eb(s@H@ht7&0YzVc-ibiUf?q0- zVK3b(m(~S4&o-c+8@1Ta&_3O8$eXjIDmIMDfANRhXT-<0?4BvqH8oocgkK(bohaJm z|7Nh-&ItWEZ4PY}Gg1b}9jSjc;SOg@7?TPiB`SuY@vm#!j^yv!YHcmE)3kj4Xjv($ zMw_L5-$l2SM5jAm$-TxX9BD&<>O?lXDKbKx2Vu|L&~t@ z98Ezofe1RhUefFsaN%QelS1&>jKMdK7(e@_(b6jGb=vj%)P^gS37wO|$9wOZHB>yK zM8^9g7Kt^TA|W=G{b?)Pe*NaYOKhKYhL>}sb~gSPwLY|6(C&)Cfvi?NSh|^qga|Wg zZ)^PC7z5YYp!=3@ekrrsXGuI-W@2)k2y8_iElwh5>c#9<8xh$?-A>GS|FsI#`Lhn;^g(q_r*WdgHDeQ#kECuB6M3?)C~}0om9wM7 zKl^0clS6a#6jrt~~_P!y*aD!<Mp{}5Qzp?_!CieWub)ZN*p{dS$d80Zm zF~hod>qb}P&f3n?B_uR%U5|j6pv>LnuP_B`L##+TNHU%!!qCM5sWtE-}a(Nekhcjd0xog`P# zOXmJw9M)E)#XI$RR4%@Ypt1j+{p^~76!n6Ai~AN#&xhq+yp@`&s+SlhT^F1Q4CigQ z#mJD%d(X<#+yq zOj?{vDS8IdcohO8u$$n{>AAQ$8d{8{|M96PMoT0bZrBw%Z`Ks7ZKb8v4#uO)*RNNK zYpofPSJr^5IWga zhe%-1W21xw_g^%#|NP4OlV|EwvZ*oA(#k3){$8Vkg4ta|!ECY%!t0jSVM~7yDlY_X zHJJMqLXNJ6kzWlT>l@OSsvRa$Y>YL&wK4tVuqaAU{L-Tuu_QGUg!G)f_rzyzDII+h z%-8laYi|LK!YFOI^^LASg8uv*CNS2h3kf{-Sgcl(f4n>9jDq(+o@NZ0fhHA)-jV?r z!C33h{`sNJ+3K-R50^3WEp5NsT2AyhWa&@Pl~&tnlhQi;(G)=uTNg)%D~_5P#s1D| zb-SmFCQ$|pECmw-%ho^-V}4HQeJ$=egfvTdN1EcD;;&*K2F2{5{(Dr{cD>d~K-CCR zt&M4rLNxFZzC&|L_wCQBTw!7oAb0K7t>suVB#+tLW%<0TR|v}JGDNu;e*XE=I<*(X z(y*|w5q{I9>n3d~D^9DKS5HloQ|b$&*r}j)NRn%W_Z7K7Y&o29Y>`UJS>1Ld@JHwN z?Eo5<3|s(GU)Lvx-?(wxYFC=u*iQ=A`peh$jRDXSXB$ws{Bl`A*4av(Z=v<9%Xui-;;f>Ukwu`8&3OWWGl#XW;9 z*7p8;9#(P;%Mg^eFwQnnr=Z4};&X+*%0eJg0bQhs+I;WNDOKBMN)6gJ*zQ~TrM#GM zt*ix+uN>Ec3vg);g_9C=CZyFexjxa(7j;}Jhavn39`^f-XCh|fo~D-XY4_%a`k953 z^YZiZs`#HdmRACm>ne}_c$Kg{7*IJYE;e?Yx_Ze3*Cx>`gPrr-D4D%wrJB>{JUX0z zc>vfKpQbSz6W2@{>~V<`LZj9AV|3q4T8=G&)~^aRDj%SPAtEThxpXZgB(>#uA$>ry zc1~#_c5GZ%U7E7l?;am>e6u|*J7CA*fA&dq5d3-C5T`0ZJtJ#jGh`G1bm7R}*6n8$ zEWT+mCh0G0*>>aVVZCYfCNoq9Ngg-;dG5jK*)`(_c*hsnbQ$6TRF*o^dNgwVVWp;{ zdd_M7OErU+k*TbiOEK%=lW(nU{F7`)+ga8N47wo7gh1U==Q-|Ea@fQP6P5!of;Ktv z=UXPW1<>%NW^1^UX}I2CFXaKS%GvZg%u+=~Mcb1B@=A7tJlJSX8i=T62sVTS2via~ zxL)7g9Yb9ZlH50lW}-ou>*C?PmM&U!RIu|^jK8encT?WWUVZ)A*tOoJEEgF@2dehNZr#jcTVO3j)Io*`7 zv6*dMX6CED+Wv8i*5lt7=$uhAaujNy|MFET&j&*-%HCEF>(hzr+zX~wC;-r?m~oU= za`&yRuhW}?!9b;ww6@1=WFrvmv}@dC=A(#1$YcLhZ7+59iWSqVJUpQ35m+28?rKeh zH8(HcCtaGRZ_ui?4){Q9vmQ-@fyL+aWBf|&R1t;^6V1kF8_mzU?(H){RI zJ<>8VM8}9qL^y)Us8!A>O|N~>u)`s##9-^e3*>)3DcvA|o&$P<1s3PGd+?LItlixs z4O58gtk7LZDy1|`WIu>w_QHXd6!sefPV@m{2p}S20NE^Doc-Ws+{P+_LFTmO&hfG; zd&p6NJtsfGv_J@p(|f<{Co*xf{E1Sdk;C||Xnm2(wPZf2Infny5RW;3hQrMhqU9xT zUT7D8Jt5&$iwljV{wHa05x64=N$90l3JYwvXTv4hOX>{obuz2+l%>CcoQjgtDk;z4 ztb8Hp1cv|>4>7%6 zt*C=|_zhXLjn4p%a8^hO{uVab*(3P0yfyT1T&1UW@y}};1x*IY_Swm$bxa2O0=S#T z;+Sn$KknL4^wzbphot8t*w@xht2s3X9=yFc%(`sq&~aOEjYn}rtX2HmEA4hII(ivf zsCEX$2a)}F^cMxu&VJrotIkX`qjYvexK<;WEegai5(UEJ>eyWU+`^RKjuZu);3uJF zVTHAyW=!d)J5>GUo5SXVxcLQE=e#!#(hRzO%=u{Kw3<7K%>3GF=v->U!dQ@Lc6?6) ze)@#^HAF5bdrO8NTXOvFIXrcCl*(IoZ^osiTk=|7JeiQ7UGqKWcKxDw!wugqbzc8z zr%RN|v`14ScF)XJ6u|9kYQ=!wdpl}~hbJMiO(Rv6Kf{(WGDmh-)Asi|P|dKY#~AU7g0q@KA^_IqUXk-AH# ze;n1bI&Or#-a`nlxSWXMh)sFGM92}ii}BK4qD6<||E8T< zpHrm(Ex`uEj6|ZmSx(vaA2Y7XB?Y`*!zfbJ-~UlIqDP8+#I1OmnnSCYNOVdbq>=5s^V{{H4? zj0911OzB>61yMAJE7#VC%9sAr``I4wdIx7WUuavcwS3}Jr{NFQZA~7?1Z6+19JehIt5=!10dKtrfSM|MLeq7?8|9;kOhgu=J;~0K0b;w@m z)6`jY{oEtOca7mU*FI{#*O0O&>X3v)Cr_OPb5}~P|4>mOHGUntnWa>VhRItDm>liV zH2>U$A^K7Nt}220G@z?RV?}3dpir|;z^}!wxXW?H|D7#~r(8RFWPgP=wAibVSw;U= zcC1+`hV%s$*#G=t-(*xyC2sqrfP;uh#66bz((SBa(24y`r!lUSSzdO=l~Cn1c)Dig zdHWY9pIzYg4zbUe%2^unvW<5Jc*Xj8WUitkz5MGTAq&JK_4V<&49|akuJXR}5fbhH z`}h(PJ})j!p74JjhJ?hFhd_h>^Phbo^Cdd|@BhdR`QO_`8ByI!qTT=gg^uU{9;JkY zw(9@;NhLIL{=eTus$H-D{ehDhnf>p7|KD#x$@zaD)c-wET!{aBFaG}lBwF{|zfHsc g7b_&*RsZRb*L%Xxq49Y=#Bb^>)L(F8-ns+-5BSiP-2eap diff --git a/docs/user-guide/img/lighthouse-architecture.png b/docs/user-guide/img/lighthouse-architecture.png deleted file mode 100644 index 63202ce7c7bdcd06067d234b91654787803b8724..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 181976 zcmeFZhdIPm6bctbUiPS}^V8pLR~%H0=E{d_9$h-Mef9Rz z`={2*N!;MR5%+xbUS-rOjU`(QwA*x-upHHGHCV!=p8h1XlFoqCldy+@bG37a?AhkFBETk zf6DUz{x-37>H7cv++n}!$bWzKuGvmm^50*iZ~wnH{J&NDuQmKX)A;}QhvaX9SSB5I zDUN`bFJJz&J^0fu7hkWu<~@UggZsav8}jej^QgGEm|fJAOGZXU%=)W_c$lJbhNkgI z#9+u;8JS`kBi)JFr%LfUg2CBU6hTeF;L{ud@s$>0=JoeW4IVUGs%dCEIkWR&Fl`xy zQc~(eT=VGxyz2J4Z7Rmbai8nzGM$GFW=HGJPW8q|D7mFImx0PNPegdfwgHxLn(N^OI_0t1mCUzjB)$Ytm2i z@maNE#fsiafizWF*&F7K$%)3*p}V=bN=`Q{rBFHyF8&=#bD~ge@8z~xd*B^Y-*0oi za_m?07;n46&&PKk^F4O#*riM@qf9NYVR^lP@*VgJu8NI{;tmQ5nl;$3vdz=e^JTN8 z$=F<pJ%A$zl&1i6w! zhS{w_p`kSShda#%S~AP}zkmPk>+7qMqLum6DW7Hi`scIL<5dRftQSwp%isAsGU6YR zcs~AKYQbLx7by-oS=skBH8oGHE((YIbdU%N3!6?ly$MSg^!PFVfdkoEnPFH?V`ExE zLW0&3?>1|7Jw3h5ERWQXYU33vS4L!8O;1njzuf*l_D!!t<#$_Wt9k2eZ8m6I4-J0_0(>dJfX@;f=HVbB=tgPJq$~d4rx})R5%^NqKQd4$5l%JfOH6kbzU_+XuMZ(K&5U1~H@{&ShCG&Y zVe1$L1O)2lW~VbRzNI@n{X0X#q36Dk#(_)k*WbK-8_%8Y>gsCAvlsIqS?jFpE@QCY0u2g zvaql?DrNT$J2P+C5cT}|^NhLXH*b#ZxFH@^t#JDEd2Hy*j0~!VMnbscmA;|xZ?&?m z!?F3yTet3cSP}DZ*I9+YZ*GH!#|GQ=FJ8R3$7m%MOnz~_><(_7>WK~*{nu*K-=9|e z7^WQ+9W8dDgfjN0O&fcZ?=+xdXZNybe$EZUAO^|A#AN<8C;dbKM~a|s9-pwV3jPxO zF7(gMn>W4qbY8R$5HsGlaG>M2*EPI>v~nq&1sFPx=F$Mo|?PPK2vpZ$vxrE9$P#+VB;GQFz$2*HyT>H>GcW< z#boc{!@Bm}9~-VNTdAt58dJ{crPG$@ScmV)-4R}T*beLk877Bw#}YBK&$6(%R-rCM;S}!hK<#74Qgdhty>W#e3@i{>`S~Xs2n@#Wix)xp_U=-Goh8Fss%qv#!dZzvJWT@UKVV z;VF|N-Bp(2NmmBHO?Au6CoY(TDy4+?<0aw5)4_sylfS|cm6H%CXNTT0x(;ME6)X;v zYhj>!G5_)a&L)^H%jV7TLqoR29b8;oFnQO}+LH}0jZWJHucmlk{PN-=Nh1mh3e0$+ z*W5_N6f$d}?j|zp^@|sS+0-9scaI(&bs#%4G2AI(+u@BEBWC~W4DZgJuEbhttJbY+ zw90Oa`}$R4d371cC6Z)-ILX7 zecqp4tU#BWLW%Ef%g?4;%N~P}CU@e5`P*A-TMFH>v#W^rtvEu#H=0q+v%?DV@(-$w z>tJhCRaGAOyv}=)%q%QjU48HvqfCpYMmQDq+&O|mQuK@UlGIXEE?$hxK21=C%L#HB z&+~{Kjmerj@Dk)Ue8tAcTa?{pGyfcOC%bAHr9&NmbL^{^ztZLyjM1y+J6U-Qylw3S1HnDbR%ZHGIywY)GIK zb`?ox%K__AC;9(zdlIgO=au5mr>CbQ0_`u9fpz%<6*%^Omdnk}6%IM0prrJ;s_UDh=(~RYWYrH23QBYt`Q_{HKW0D$*eV2&sCKk7OK@H9 zBc5#%4)6c(i(e9!4@A~$cz$%*loxDP0iofr>*zUUweL#yy+-07?8QF~S{4gx)p_gKpTw#1x4TA#!0kC5I2NM$Gcdr&c3e zreo;>b8IlqXlCBDi5OCjDZIiZAKOUL;aV{D7LufynaP}TOf^%~Y=ZHe_nI4It5vmO z>C7A)N()b}SiU>~NG_1y)qBVUTkSpgpWAQR6!+zehE4DiO3C1_?(TR5lhc8)oS=w^ z!7g81&bDa1H(qZp5>^en8F6BR6>Ucv2qcgkfJBGHn2(!@2M>jP_%%Nl6lwQq6~)_c zTa`XGXF{AjV|xN7rKzbIxC$nNM@i{*GRB#>%8ngUQaYRbN~;?1{%M%X<3emuj_l%1 z{qEjH$RAs{sWmVZHeg`{lpG4Nts|Mk@Ad#VcRNUA+O!w(&!*to9bpq&ILS>q0)KRO zcMoj9kG4z5_5SmSIF2QO4O|kgxFqb7&w!uV=5*k%Iid@96{-CAQO(II3$%gK@$_BQ)2P>T3FOWr3{4fwx3+MC!d6b zmXMIpH$mJDkB;QU8v?QK*@!XWAt*t1cJWct{r?&D;uG%ch>2kUCt(p1c0YY8D=Q0h ziSgOWFX|26BR$Bb^$4K^lG+55i|eS6HN#z{BrgBBQ8fKWGDRo%Gciugj(H&jTkU*U z(aJkxhTzbTq|_86|M1bnhxSTYntFPI*{vQ*SvO@?-hR71zwJ*(cSGm!OrlJ?FN=Vv z-Op1gdWBjX0o~UIntB}+0`GAgc76SC_v~a10e!YbOy0zX1a|Mf$Tgt;yS-Tdtn_3I z0TmIRQ@xBf`^3bk*u$eoHJa(o(Gf%p|2EOm-agN0V?X|o^BSH@t|L`#wcBb znUz(e%Mk>GjNs;GJwo7GvaFKeV{VC+b=zb-b%5;yV*t6|8>H*J@CbhN=+x&G^M|F~ zCtl2rrFp?V69KpA*RCymK1~*~U_o+H-E#WEtS~~?ZB9=OgnaD23ee>Ikhnm=SZ(x4 zqwLoCp?|jD9|Z;VCZ!d9t_%{$^qigI7rC}m>1jf!m<7ME@ZYE{cfs#k@*I=Cc}`nR zPEYqgILV=GX_-9i@vwpi_#Md{9+wys^YiRR@0>R4*tj?lB>6y)0XwB@m3=gZBT-RN zf?uR#eeDgz!;k}?gRA@f2_?2Y$4BhRTgG&5W-@S2a->sdIako^YHSniX-7tL^5@Sg za1q2TFf*M`OLS(kz!&Q73`M&MyBk$ttnu2 z=mDE&JRr_T7^Q|v%&t#?)1TARdxqO%$xRvNwD)X6O0TS`8NAl?4D3{0&qWSof%rAn zsc?h0j#IPIX3K~m&}mhS8@H|mN3FVy@gR=l${p957UJvzq@Z|}fDnjX`J;ouvPPE9 z3$9hwMH&R6R+fQ$4G7v#ra{7R$P zM2r(0`x`fpiZl;6?bXdw?Qcpu@OW!Rv*qRjI(b~<;I3AXR031d+pz6BGyva_k5!Kz zy}EAeK`=kAf!6G^Hbs+hNMh?ar1)Ud_wTRQ1zuqnxBPM_aW%GlLS!+esO7#}%g@Zr z3=k^)8R&$0%NBu*<~{Nao^RR)oCNmmJG*4b5_$#(RnWU{uKjyStO0rSy>sV5U2pxG zeFa>JKkf{;j`dYQpy+$4fn0-_`%){V*y4V+-Seq4AU;4wU4w&ON1y$Iz5y;-oNsd+ zcnEIC!p^Q0s~2CF2;IQ~T&ShktC&D4(2PxcwM;)e5i-eif7m)89%{aF#fsg~abRMq zcp>tr>cGIy?rwoyyG{nGCaLWOb&t3lap=&Y|7cCz+}x_5&gKK$fQmHyJr z`ebqMZIdLF`}c3l!hbCmf&8hhQ)B&A15WC_+f_mQpb;cG4YU+%Tmhm?R_o_{7Wu-c zYSZD74uN~QEr3K3C)f?~bBDK~H3dgf%42~xa!cjDi| z`9Rf7bzf{L$N_?3{VTIN{$+*WcCLRbb~O}xd9CG?*6D9d5ux+9fD{Ii2JlDm z=|N>M+H-J+yH~5`!z1s5eE{SGkDV&Nx9vPxRYSvuIK?e+nlow^4aNV+Trhp$XNWf{ zYHE)O3;ponjILt?)f~wnXuwU1W7{D+S;ShxZ0+prVI(vdSfa=DKbm^lHyaL-fO7j5 zakwM^m6wplX?gkDZ-s6USD4_$3ebzpzr2WqypaOLt?FU}M+poJ1h`6tFHA`o!SzgYUA?;22q5^QIphQ z<^BE#zMTVoPR;$rj%oeAyKK@aUsqmUerlpKAk(mX9jI!id4s}%Hiw52PQRU7h7ZB& z)KYa4@#-G<4iW?vR7K2v!Zv!}?KbNsge$6wN)*zm`s#NG1T>)H#LJy!gwJ6wUI7!V zW!-;-c=WYv*9gson&F0ksSXiu44zBVFZM*9Bl+yIbnqU{sO)d9rvsU>ZU_bqH0o)D z8>-)?z1Y?B@PkuWBKmdf9;>GF)Pvh`VinG8+@+)%A?-oCu>ldgEX)8P_~ZdGv^x3?g3lHj(1??Nh&WDF)#NLH(8ItSi~TCLMc! ztyiYQey#iPG%&rLogKIfVol7GC#+ENR9*C~ty6i}u0AgBtc7!pLTXLG)QOY;K_jVP z{^42ag`I`EDzJU~QLOR8CgBDH-wN|9|7mBM$0BA`_Bya%eWZGsGjS%(YktnWHtHtQ zX57StGbsC(Zj#}KsQ+<=upR}L>yLw$xdi8p^*8l5n?y7q2amnmcsAi=07s~VBaMf; zdW*{W^N!u&SCD2*zrVRjnBQRz3kp;v?1R;_9fhF-vmEEtONbOiV67wOm(jy-#=aN^5KUT?4%s1} zo}M21T{0j^Ps!C~M44dOwhh?M6?O{vCckF0V7*wAPIOXgp2E?iN1@YHR#eo&0mgo3 z)R@CX;|FXIWb+1#rb+DU?48*r>BJ`_q+IAW-bl2euEbeL8S0!~GwG>?|FpzxzUjc& zBfREvtqaH08j>~7>*hOAg9UX}p<5UN8&P7V(bmrVz3 zlZ;!jW)o{SR5vxEV(f}=kAhK}gPPN?TJ;I4!5AEnsAd2hdO@-AV4g9W8OCN1GxC0g zS`a1URsV25>v&YOVU2;G128uyMJT_|H9RuEa| zncJVqh7K;I5>V~>K;F}$mS6V6*LP5ee-pK_Im4v?Z`D5aZ0j~pbxL4JNFrG~_#K#f zCqdnvB6CtiAg(22XOx~eGC$Q+?9gl!+}oh8-*A^rghzhk&NH7rgovC?`rh&SIuTtm zUB}D^+Va&Gi99hq4v*1V{_aB}BIiGQnRp-Ex^CcW?)kxjk$YtUoHnCf39qbL#oJuE z!vkZ={I^uKx9iVOl*>R=<|kqSA_GCRMEud*vk5Yd0xf6!m1*s<@pi9b#8axCUaC>m zsF8_P*eHRs6!D-eOTmmT3aeSvxqOh(W7`wFY(mvVq)jV~^~y=&yh zLp4h+uxXcuc%_I?lkjpTpsGuF%Kaz6X>#%ztCm-_h5?6n0(2pdRzE#-e%{v?0Y*Q*vz z|H%*Je|9bcU=!1hPe|a)1wR1I36T2hLvRsNh#5ebdGpIyP~)+;j4}lCs9e6BPH;BN zM}Uv-RAORcsEk+9)M#%sloG-d2tGp?PY_7WIR>eWSahaoEjNK!NMg#<{|2Bm#UK=( zt&tkJ3-D4;qYA9uB7O$pMg7EyTR>dT$yOsw=HXQh(I*)}?@dR3RR{7L`-8*mpzKBs zV7RlKmnypZN`4!3@dgAn9;(##_AD!HU9Z_ONV37D20}}VGmON;8lvRZfJi1n1%y8L zInS|w^rPgUX;Z4MR)KRmnfvOEJ6Q|4P>sv7X-{p^b5pFSs0fwz$fH}gl@Gcic$%(& zda5dtFO&BrW8*$7Mg8yQ3~I5b2Z{LR?L~$Eem6(=*2VYdc0a3I#whh17zOf_5_ zSyfs2%D9@naDHwYnXkw?uXiUAVkYKlOv13BgsHWAjE6h@`I-o7(g)uPQms8QGdtei z)KeRsw44h?!_ReRWl|7NK;;O`1gt)%r4>pt8}uEb`ik7^g^I{KJN~W1F88icI-Ev5 z_K+)xOVR8`JD`>EA<#lvR6_=I9siT^`ua+N{riVrP1`}F9D@#vf*M)4 z6Fw7eX%_IL4ueIZvF>Kih;4ep@9A{+NxQWiQW}`7im7SB-@kwFj>BKrL{{;ylwP@( zUDYTz1m2ROo3Ex)dcHMC#EO5Vroc*3um@1&v7|AO;t#82=7s~jOuyz_1`+^dRzq%0 zEt)b{3>B4UJUn_Icv#eP#u?h>4pl@&{}|t*CFkSL)E0S6zcMJLPtnd+(#>;t&^plg zV8=;>A{aO#d-*=G`QBO!1U!*TiX}V3{w{h7)nn+0gAJ*vL=vH z5R@|$FXfp4U{vT#dg?ltZ<2ihr|y-RpA6WvPcNBJaVXBA2QNnf_7g(JBB0g-_N_Ab zt}%WY|>>HF}@2rO*DC6S3*J&I}o7}Aiy!z zP+LG5%t+@vo+&%S5ms%yH4TVFVL_^U_AE8_bg(&U0Ms|vaJ_9(&gaq!{`#io_3kS!UBL3gt`%Ko{2q4(MUfATB#1icS$_V z@$XOhy&5l$tl6~ZTmZ*m2NbZAkOE0o{o7SFRbn#Q-Hk}n%!nh2tN#4i-M|a5egeCI zXhaRm7>GDk=sKo?+`u%7mV@Zs;}HG`8z4v>SH;UwAPf3aG;K}th=5x1e&bqII>kG8 z?v$lVLJWijTh<$9Gy_e80mm;{MrR6XD{rh(8`YIKz$hR`r94E(phu4!S^{N@yS%oz zpJuswdUk3|40Ml}OQ__PRN%n)UC*44$;=F0kMX@ag|I-pP&>=AmXy38wUZhpsmF|s z7tiZLp$=57wK1rRQ*0^n$p2F?qJ(8pB2=!yyum0~H?I4co08Z3bUO=b$`Bo3++8RK zfXRUBi}V3Y1buVvT#K?Ast7f!-X1%CoCSh93P_6K5>yOMazH{fth!9t1m-R?Afo>9 z`DKZ4>Ypv(=^*xH(^XYfK@T1%^LjssLFn!wbVO4#WapVD&k=MZ8eH!48=HK!uQ{w$ z>{*Cpmw>G{8|!NzxsP}~VKjJ_APeN_yBu8DKQbtw{V`0`tn$(BvX@S+**3wdOviv! zR_Pj~WyV3mzX_THX}V}8vb%TM zqCn%cd*9VAr+iq=&gux#R6w+>vof=+0y}7}=@>E?u@P>9;nG)g6F6<;~l-nFgi4{H^|Acf#*yM0d1-2@Uyfe@jnYUMd3ru$cV$jZv9CMKyE6*DFptS=12_9IiIL7PcH zB=^00R~4v=0JAv7Ff`6+=Jm#f@l-q!>KJyud$d`gd^vN__41(Yibg5eUXrh+ zXGhO>_D&TPNOfvxrKlmLDj~^!*0w2(jeq8<07=lbH#V3gki+9&?N8*WY=aU}TRcB& zgKGJf>4{umK7WqGT2LSEs|wl2zj*P<)Yzj=@j!2y*KE?#rAtXxa~x=)&d+qqIJR14 zvsHg-v(6S0;Nj=5e3GsV+kc@D?FjWNsX@z#t`=<>L>z(Gngrwuh5N*lO8s_Xr479b`lf%ME<^P|SJg!rH9|&xsg+_yj$JR~``e^FVfcD#W`( z;Yv_WARi^5w*qkT`H6d5cO$Qiev?;J41$1#!WP7**lX98k|h8-J@DraSsvK?E>tq% zhlK7CK_saEdv}w*(S6m)NmPi&-mKZjs@O39FT0qO`^sug$jbIS*0!$o+gG&E%dq3* zy?P)!(Ti`E>)Ka~X%)I=UiO%oac@XaJ`Sai`bP+ahEQ%j&&jR~=`xsZN$CyV7o^^U zDzkv3WPasmpc()pj0H?qhf_Mz~k3-s0Ll!1P z7WM9aRO4&mQ!rP0OoD&Mj%Wo=@5{%@D7+Y5RjjWk z69BF#-JxBIp*(=1kgpBPWWiD$kh~L7Za`&?L&v2nNGsPa79jdkM)TdPLm-|4A|e?I z$Nv#Dii`*K;sL024AYJir=|vzBOwa&^6>PKn1~f|n3=eY5uqCCH9e4x#Pe8KM1<6q zu`LWQ2EoaUjEqire@FQPbzOpjP;LHn8WCbM(TD&+n*i`B zv~mPJeYywLUu+$CJ|rmt*rHGWJ2_eB+8!3i~D?$+gu6T@p|H7J10%Y>a!}>p^ zWPhU}De(ykDj}a>7^pdX{?nF^-Y@<{?z>QD%l3Ffx&OK*?v?zxuG*Qk=cn zYq)eX5zz9S2568_c9=qJeuyrebLZ}xH>IYanr+oyqzg)c(r^QE8jpOFzE>f{9f#2# zWm2a`yhjuhSsJTPpBLl1UKE)Y8YR&Kt*xztc%J~+;OncBCwqJ5)3GZ{e_d6 zVh|)?F{8hWG@(HAA?XgA3v)L45R=I82TA|po`Ess9|6=uNvH+Lf$W+B70vX`jn!o) zNxxf>pzD)0MF`PB<|bDppw=9Ok;u!>Tz;{&*;VZ=n}o2Bf!2d;B;BB{T(^~!2<~d~ z|Bn=)22PGfk<)^dW(;KK*=NZ>>kFwF6~B5kZ9wKCb$RSH!HM8ejy<2Y@7Vf)|8Wue z)jk2ekCiNAe2;v#W}KMkaJ1r4;oB*2t^=;j>G6BC58ftNX+e@ zB@tlX-ey$C`~ewaiPS?{gOW8fh(44Fy%(5kwzOGH=72@x9#ZT??Jx`wD(?OJQ;SVe zil8@`_7kCrdDJOs;P1HpepeHBwBGc6NsnfVQ3Z2CeFQQco;e4|-T=~R^)*Kss?a%z z&{!e?FE1}70|32BbVXpZ2rwaQOWcMe2Go+WESsYshnyu^4*^^rsK+TNDpH~L12W!a z6Ae0jeD?F83*>o(Hy%`3TV9@4OQHe}Nx1xt0UT;5aIuG%xAmCSqD4+#1vrK@fs%U= zm4jdnx^|RKYM&pyP8%(q*o%E66^J>c5&6Jpu6?@+#v%I1sZ%}}5ridw`}=_XfP|=Z z0QP@fwUgjB00j2dwe<8V=x`c^7)t~|Ec1cTH#HFcAhf9h;1x~$SR>C;Y=UZF-RIcT z3*|JBGn#gGDwAqlTpSJ7ilRJe%|w(Lt3AnSRuRZcL}_43$KPLs08>*HY#t$N9iE>V zL9MJ_@jzP)^g$9K!2$q;gXd-ky(~aDi3A)fZbh?5%{`$a_esS?`t#?{q`m_U-3+== z;H3ga_~xRZ{Jcf5l=lUYVA@Ge4^>!t1L<`_U9`CJrDzZ+(y+rkiQm3 z_$HY`L$19^b-1KDiJWL96(bdSv?C!lNLqz~enpS~-*<8);y=+r;VGv)yoaEF!iJ zsl@BK4TyO_hdN>CC=YlQQd<>?7*yu{mtb(jKTTlXIxrR5sLLuw#wMz|ZY+@bN9Sur zpvJDhLQF;*wQbB$@_VGXNx; zq+=6$dD%2+y~H#<(7H}KyoiEG_LtNhV47FTI%kXd-v%I~n<5H_ikf}iSF{gJOo5Px zW!N%oP-BC%dyoKT)KL$(MxA1*x<u1Bow_@)t}R zQJx60gfg1LIEfKh=XPx(;DQtn&^l@)98wP*l8Cbef2*Q8P7DCgXyw>O-deZKeCD1i z(R)zo7W0~O_h%J4wv3M992)l19fDDnA#H(7mN#zRWGi={nHXl5@hnI$bQ>&G2h5U6 z>ijLhKj&f9aAqy|({2*7m3-jMXx>4s7?>X)Q@hV+}FeU1I}T2e42Ne^1xu!DOns#svP z3Z#VE%)r}a*!aM-pHW>($Ynh8{~*v1BLkW26?7Fe|`i& z2zATE^fPCTO6(z|5SZRMoB-N~C@FmHdV~O)4gg4q27*E;M0XOq(bF&fA`DUx)&Tvi zCr-2n0DX`Sc0zPFT!@T}Bt>I5)R5ooZrl-d`~<`=(xZl$1w4h8zxi>m`FQM<*{A16 zeec~&9l6g`gFZG}7_&^9Q1B4rO&?&KtLHZ@FF@ z1hE(lWDJb22P(^XC#QdAt;rYwV0zk04(F1Cq+?D3jV^F7qfw_9S}8Q;=vyd|B>nD& zrmArEtU98ze{5=uuZ0t6GU0$oH$>V605T=816n!@C+EChMD2H5BAJ5q0jnmw)Cp6q z{o;XEUqI1^s0m{iNY^-^#M8zmUNj)AWaNNCcb^F9r2nEW{%jM*IPKRokk*SXT5wsh z%Rgktdh5E?O#+gkY++4R=jUb#r%#0Hhe~}m7MGkI_$Puv5hRRUxUDni*Uz7($QTf3 zl)<2X{PQwe-N(ay$JBD^L4N*d0ofH#PGOgV&0 zxu^isBnXRCb=i^hMVLK$m?JTYr)nlf&Xdqi3M(yNf&k5S?eikE61G5kWcm??8xUR3 z<_GBTWBCD(4nVRog;BfyxU)-Xx(!_|-Zl#@?Ixomlo(8=%zG$ygZEFU&VV*p@}$ol z(_SctK#w&CkRl?T&F)lZ~zs9r3nek0#KZQT4LxX(7fE#9hMhi3WH zJu>yGeWpx)n;!4M^wt5=GTNA?p9Y~q8G-dN5FkWHh<>DMk!jsF^{V8T&IpQ#$e{42 zSC-AfXpTh-1YAQ8>aj9#JE{n?8T89(Np@^Wm70t}%Z9IBy;|(DcD99q35^~@&O zsXuEF)-KK}?5o$z-TJiDV6vgT9hwMf`1o9(cz&#@c&?#`b9BTC3uW5Jz=msJ^QWVbe z4H{@$ZULiu6cI7+ceZMphPSGl?U}Q{feq3!g5{1FllHVKX+$XzJp+h7)XZ#z(T^4r z+jVm~I(5(tW8yzCJ-uaZtWExaI0{uEXX4h(P2vLNTm=M11koSr%hE@_dyQXA*HF@K z>}#57v2zAUL%$J#PC}y-ToxK5QQnDY0QfGQG;~}gsCk2lL8cZdy=Aogv$0B(IJ2{k zEubIurLndv?ec+Wsu=RS7z{_lsV1T!=^~p2@-Izl&r|wfJfex-M?CZ|n@Q!NPw3+v zaA)9FU6m!P1h;MS>pClxfeNY4{h`hp95OjVgi-{zdf*voqUEi;y5|s>uy1v+5A4J) z(6X$S*Ojpj;pDQ#x5wviqBTyCJ=kEQ1EpIXH5V*8k38(QiZ@&IJai**n{UbR6@vN! z&AtheZlxi%#Xie|Hv>){7`b}7s4ABmH>-|Qxk{u9sno-;0WO8!K&+c4dv;U z|BO5iw3wWT$*vj-1%ucvBviZ5IZTnhL&TEB$NxNKI3wdWzHMu_Za3r1tmR-*Taa3k zIZLbEozuU+m?`a0I=rgl!42DG-`^uH)*tyLT2(piBeW?yr?$WER;^M z?w1=Iv_X4g;gECc>Id4ZxX7jIyqB!PWvW9<4X(Bh+=}8`cx%)l!zX9)Vh8IBlw^sH*syI6qxce1QdUrI9NWHC%6UDF_Hl%UrBQlHqfMaGj6S$( zMaLR%?>DVlzLes9X6JR=gHkmDWEH}&3TQ=QSBl?=yPk+vD42|0 zHh$IOBBY`aK%vmzTn@`yCHfp6*Vc80P_K%DaaD&maqEtxrKH@fHGLZ2u&^VEWs5V1n$S@&@^KmE?%lf= zEG;b;*4yDnUVi?PBOhmxKt^)668rhDKU`*GpnH{_y^QkjPn#d$oQobTvGxudJNvP- zXBpk4IaR4Q>w0CatOnfo`4P)e+P-MK0=l}orsn2LDZg7X*MyugUfftWGS|1m(a_;I<;C+yuqP35QW3KQD9-JRyw$~3{+<=h zo5z-b+DIY`iq#10z<{I9-&u4|-`0T>Cr_@VT)-QhQ3JhyW@onx6{}Ld8AKLEGOqQj zj?{@V`^oLm&SLP5`Y`_a|GK+@aL5bmHVMnGIZP!FG`a4`8az|SUO8Ci>a3d|k(s|f zH|L2nypI%kdydA4{kIoD^uU46ss6Nx!C2y{wYwLW+gMJSd5>NJD|j=7^80Jpl&QkXPn81G|w@Ck4v|6M~Qrf5Ih7L_O{nyDTVvND(T6Jvj)JwpZdo}3M3ZnpeSWrm__oZ^21KqNxO1oTLUH3~!@XIjE9W^xEf%aAR zeGhzmJ}M)gfD!NU#1XI^8}5{tigG_V#T8uj9SBS8cEm<BkC@(y z=Ijr~B2b~ON&d-M);>QsE+i@{+FrFIR9QOWq(nI4-BEnu2k|hubPZYT>tGjCt=n@N z|1+;Sm#;WM&C1H^-E4V6lpQ|u?)=%qD~j7?+E4QkbFDj7`z7fbcIelsI#DSc-_3!v z`svG;RdUMvg@v!3b^oz(0!!kXnkx9kGHX(A=Ytp;f6>s*eI1*NC*&Hs6?blwo^Gy* z%E;IVwLxf;pbnovxPyeAh^&M7`|c6vKe^quC=R{uvU~mAmTSYE3pj%}@ol{5HWqXP zv3lV<#OFj8eQvNBtomMn`_CQl*=tJiZ-4&e5e{J}nr<8X@hi-x3H}Oh;vZ=PDe)^I$UB@c9TDj)t}Enb6{jse>bj=heN0kN#9Wqf1qanZg2M2YoVd+ zXb^*sJb1vgN55z*dcZeZ7Yv`+1GHWgEPvz9oz(?1f2+O}xQKX8R_UwFhE-g;_V)V` z;Skw$jpdZ5Xh+n@vScGIHVzIBWGQfRcO>0`JG5+QXus!lYx|E~GLx$nVmIvBw5F`A z?0HlF@cSJB9jG8(wvPQ2y(0nz?;``}5~ z-|5q9$h^KnX46PFSRo)oy#C`w2IOs@o*1095FiblGrtZLANBGoW;lpRB0hEvq~`pf zcW`p5+;kinNlZ)(x$dS?{PoutylYLDdyj9u&*%H5Xi(H*c6Qe1MD&*o6GjMx0kyTt z1*p*f9YcAj>&0kRmiQj6SF7e{YUUY=+XKqVP9P8=I!;a<-iYloNcVA<4!E%2Cp}&0 zr`@4RDfTT}((SqwZaok+q0yc_>NE}AsUI8~7pcmBluCs$yfY9&I5?xEWPnDn3A7ci zqkyFE539yflPix*wUiK>VM+HSktD570c6_+$y!7KRFXu zmv=SUti{ahgW;h%@!9TUH*Ahcalq-zu+vVzzg$ImATmFHOJ`@NuSv>!bk|>x&u}F1(E}^&+_h^7 zflX-r3^_xWuEFs7!uq#w-#VkucnQTRf17XA^T^00;o;#qsFhqUWl?{go<4k7hLc2L zSFc5Y7k`G2`3(ZJKLnVIs6jdRr({zoun586HLismzEMb(FkrwLbX*O#H#X8ysmki= zyV8D!SH*?bn%-y~kd6&Y4vl-=Ib33#QGF;Oq~Gw_>JdIs#p_M|2zyTlV?Ttfdc?19 zBN47tbYkP38()3eU`&K1=enesvD@WtJr=p1ask=|mhRn~n`_chBz={Y_3U3#?V6iQ z3Gjd(7@eKHdB=_&Jp%(cYk#e-_Xcb=&I}1^!7Qr9no2GShc}8D3$xug7MWoneVjk& z4QR93Y71t$*YDoFlV{XHQb<&N^X1DId6{l(Tph=V>^H{JDdaov9ZTL14GrDRE*|}S zn)I=`|2E`&3o?HpQ>$ib{bS-%N`ec(#zE`uy?X|r-Cr^-HUq8IHZ|Qw&PAF-iw?RU zRQXp>V14*ZgqN`jxjK)x-}%BCcIV5b#{RJv8he0TXtXGeJ;$gG(W&n?Z~40GZEwLb zor7%wCr{Sb*O&AdWnha;1I~Y%nc4O(tMPSRK%QZA*(UO3)mHDzpxr@Y8`=|BUw_RdbHMTKfQF@b>)n*Qqpq`e)j0%w-{_5s4$8(>Ch}aX z%$2?uXU4}&Z=dHS7@S1olH7Lp1U~v>WOa%LAGc}^Jvi{wu@sBez zH8p)=zvbxdw@Yrnz5HgpPE_%hO-7w#JQV)&W9#Ipm%3tw1+qKZMY;A^0BF}+gRcg@ql6xN{*B1_)j@_`~ zj%-7*fG@W;^Xg_xd>BYvAH5O6^3|(LE@f!C$SBtB7Z<+;KtIreu>H+_L{TH9kyg|1 zAQ4m7yYUcj{M}|tX{!vrxFqp|ZOn34Utf6A@GHq#QE|2*=dYts8};`Od;7^Ctvb&5COeiz+_69&4Wq$nj-$nw$8q&-6-ED(vAxsV~c}`m$3} zN@Skw>`Kn8*|ny!$B(~NZqF}|ZtDMTm-|cgsBxy&ciV%;9{1pM4d(EV(DRfZBa^>$ zcq8k2f6Ww1wNCT?rpw%qLWQ*kl2LJM~=lX>XGtSeOv9HZjEfF z?9;I-2%6L_Unkv*Xi+gLiK-I(rkGDJhUyCOb*t#E^93pFdNoYr zqeoU@@+(!EWLSpf5)!)VEalm9TN`VHe9+voXTu$?h#F22(NCbMi05I|)YpoMs>d*z zfjZ-Z;<;H<1?x=Ho7i?|UL&7_8aBC|4zc@E(iSTu?D)OGG zc*fF_q2xjJI8qL>*pE<))T`}-!LNOgkF~X1pB@Nhk-J)L95&*zVO*wmlG$Lue)R-) z2A`+XJuN#Zx!E`Bsjb|{=KXxn$QtyVS#*pZ23v0RYknboyJ$Ls5kn2b_PnXTq*=nU z3`R7z=KmE^rOFA1+@R5XN)0AZX$#;)Q+l~out;0FcSy0|;Fx+3VnKgu{yH2I^tM!t z;qztK_p*5pAjSSehwk8X>{gsn5JV#N`k?4~c`K8<>MahG`(Lk=nK+7&XMkfG1gMx> zSRixI-q2aUB-oUxc6zmi55a36DH(0fo5Fr}zpSW`2ZfR4W{RmZL*hh?J{IYXeEaR2 z9)3lx>42IvG(AflkN8tL9inw1oF5*Iut&|X#)uGd=~k{3+P~i$Wj;|wb`-SVP`Lv<06Pw>A0lEFkitigYu+>W6Aim>nAgnq zV`MN0zHVc)k|G6qM!BbY11bR{nw#J32#{LZ@&3%3hZQ$KktV+&Eyb$zCMa;!@>{sO zZ=DD8@kw*<62LTJPxkB=6bXEk9rY~Pq(OcF4^}(lvwp|Jisw3lgd>Ml!=~QbM(YR~ z0$Y-@tl;<=d(SSnX%MARGcof@bXW^pw#DhyFBo4(=zl{bSUWL?s97 zx9K3RSYK6-kG&2M@*+Oj?+#MX$g$m?mzQVz{pRL3gX7WB(Z{7%QmMeST}RA1PCXIM zoMo}SB<-V@7F<(nD*DDeQ%Q1{i8-r7^7dgeQd!xNs|x^=N#3AN=LR$Q3gu_}#yiWg z0~_uv2ewAVyTF6{!IAx}vdC;-zOYVBO})T@WJm*uL1vsa=9zDdGmfS;y}hvijAW}} zR#;C^aU+`J6KM2QYS-^al}qXkzGSabe#bQmP63z(GeO_xp(oQgbHmEXc@lZ0b@j7j z%FLS8!+LL)DsSHyP#!R;vB^(v9fLm3#ZcFzg3m4R5pkD4U#$rE8%>^2Bnv z^Q{(lTB&N!eainiOHs?~dmV%=X)^@~jQsAky$*Hj%r@&ECy|+(dvU6@hh#0kcH14o zIM^-#9b#D_wSZRx{&5E>Y~Q->c%7(hwDP1&?Ja(0`pDv9{cpvA5Z~T@2SiP#JwN!Y z*HbJd`ThC^o=JDTTO#;)t#6Ii*~b?`XNf^N`7+LUeM$JWH3STEbMsI2^~mhzpBJMlY9ND=c@eM+5K_Hi?E4Rx8M4dcjBWO05pO`P8n-Oe|f*TvP<~P&W-rr zd)^`~wyFQ3c-RA__<${*Jq~%}q9sLk9>*fj-M82fRojysV3w)XB{bk9iK?)J>MH8_ z^UKnjv@_TFm0ml-b#BZZ7t#@IQtpP9@;#y3DpO1OJWgq87wQGTNoeJpyR-i~#+$J} zRq9qw69GB!E9DN@{btL;x=G|O5F>6^&O4;eY)6QuuIl~=Xg=dc_Gv|J{$!-O4yC5D$ER;HaUYlFdYBx1^Ng9nG z`~c~woW&}`xaFsfg~fFMEi8IX_rt4l5cxbj4kL3H=%pne8*-Kc(t&0)Y&o z{iT1h1j;`+{quR*QA$Je97x~ z9RWpkqS*Q$s3!-PKQR}7ee21rG9UB3>9Nh(EJ3_Kq#`VTSn$s=Y)#|}QDBHqr&8& zJ}QyPQA}hXA~ISBFbQhPyMx|~nP7BLFL9vT9b5&n>l+1~fSPGt**)@dsUeaM))asn zC@wyJC7xua2fEn7?r-4Wz+6~ZC?fqhiVxK_WI4OK0=s8r4g(4A=rR)C0sGipmkd&< zFl-%gf~n(hJ1A{4y}XX*po0Xq!HCy8ht_T>9-Wn?mUYP7)D(x6+N}9}m%<1DfdFqv zODBWU&zYSYR^tN8uOGE+&034z^zu)i)zTXgLz z03nS%;)agC&U=QtE0+ua$kXYZZ#Ah_?GhRL@*}J6rbXR06LT>?=ehIC9?5bG`H2X- zfp$=-ybHYGy|{j8Tt$;(*9ce~^aUEduIvkSd~!<3fKyecHjvbd6Lq4j{$;dj)vVQZ zqA7iDI{0v>7N3O_Q`o*J=1Ww+qqF3Ga6cshj!1H9dAahQO_6-`2!!`f@vOfid%xn+ z{(}d7EX4&542y)^m3sUo!Rg>uPz2m|KPv;3g;69#EBrxCccfX%E0#4S4{YBWq(4td zSqs(%rQ(z5TD>%Ny|sf*`H?hQ!G>?kx4^HuXYHjrc(X~CeN871-)ESP*Ob_wp`*qG4E+hsby+KDkp4Jo% zi45&8JREMnh0dHga{)a*6FAv+&mygG6ApQ;@*MWlM__tZd;GP4iLFnQA_^FntHH(4 z7e{A;a`U>P%|RQ7optCo8pQd$zHmQm@_e_8kBe~7{Ii;F?5|P6j-|&gOEN82mHt@2 zcJ5(jv&{J+;js}MdEj^7K;3tKP~h6(%bYN%hZU-hl3~?qVm{xHldQAV+iW1({4MaM zl=Y8QP6M|sU%F&c`Z*sx07+NDX3%DQOvAkHE3qU7P1!DgX9k?x`F56X0SWv^^6cRe zV5WysK|*MMKUf&lq=%8EJw1Gs_x$T>Y5c4VmFD#6lMK)M=$$S*dKtyu`m#Rtt53>S z1HpSDWAu}WqppV~BqUzoa}X&ds7XfB_@V7dNJ^4`mEGDE^bQ;({wSWJ9(c#LK=tWXa?vB~dydO62iwB`7q2#HYnJ@B;P>jTA;iaMaq$O(i*r{e=(*i00BI^=JxJI~@L z2P%kcUp2-daEd8tGxrBt@&_hnxd$wq$+tJ|ITLM2qIh52a;lDgCaK0hfj?q zF)(=d9)FzJeWkC-s&C#`F-0xWl2d*1&~TyPoF1EwPdPy<?lf}9Hj3Om`YMh(Y} zj+|>YRq`*j{E2uA{r$fBZ_-{3?P>z;3wPQfh#@9`yyT#%Y$&(JW8K=dYZ0}b(Z+Zg zozT&_xh`cdj#{1>|M&0BciZP^(BnTsusJzET!16Ypgxe6PQ};NsXg-9-i{Cp&W~h> zNb-_)5}Bjcbo2=e2jzZEH`5*2I9)fR%s^+$%YwUh?z|_NA&dEa(1CII#u~1W0>+|a zG2rkswdWP@FKuePu>W~(E}L-%8^(m-Mf9seS1|xV_{MK1Nu+2P_siyFo$FASc{V(_ zcz2apRo6=f&SR1Hlm8-+L1v`xeGTM&Eb^03&D9J0SuaUSL<(Oxq{kAh@iu+Vs;~I0 zdZx5{18+xPERsZvW(18~%F8_3kai4x1^6%-_R z@_~fI#3nZRt)RQU1dTBz>P3H9zPk3O0PBFFOw9D0lz9V%|Mug@k7?b?nwc5sU~tFV zZbLlB@liLa$)67?T*o)oviI7|{jx!Bf|iHU-q7dM`zo4bc`s+q;jrIjoSOcQgQw-! zR;>BiF!w|J{DFda73LMt^T5eYu8<9lyND`X8QYFt2QBNzeooXMg9sncWHIHQ-rlP; z+9`;iIOqPVfuCD-eM(cD+gkN?XCtO^6Gcva?tLY-82}Kc2yWDLAJ^6022~Px^Lkv| zP9oc)|0>I5V}|*=UvoHAL=9@hNA5KkZuXPoc_3`95 zCSX0b-P+F_LWN8zB{GJPN&}gROi78%8RBU$CNh*Fb3!zbAr+zw8H-AYlJq1(gJgPC z5=CnNR^Gi2$Ns+kzSRGJ-`BO)xz6)kYehBR6t9V3$85tB9(TfwaoILnd9735zJ09& zOu|g<7Tp}me9{r^uKo~|>+bni+bo&I7tME`*|O2zISgFI(wz z_Lg!$lRBdFbI^@QBQP@v&eYVDdo9sL!?W52(pF*2_K|*pikU4^FWgdfXjoSUqYB+A z4=#D|qzcv#kd;f9dS#NX*%mxv5BiT#{|Dpcx(_FON@GL+C~X-g2a0b`QM`m19xqpY z{rdGj9+uto%XF9&9{b4KYjalFAli2wI#KG%y|)j zWF!C65fM%4h8YgM3=u)?Dn@d6znuAFO+`i<4tpTO#>dZyozg1+ z=5A4`*1h&qPEYL>a6I#)RE`2ZP#}pf#PnpQ#11eqF)6&n{bD4qb&*&9%%8i?eo}Tb zK6CW}P8B11&y;Sy-oqz>sR)Bv=4QYW!()-kXx}nE@uYmDw$|H$NegUdbXyc_Tea5O zI;wte;N!L?tsZ@fp{tU-`mkgRDvlHGsTupf|M-#SE}dZ8djahHOW*?|pHW_q!|be-F8^F-LNo_k z8i&8}t0PKA|BXiHx@=lRc^=bucU;Ub3SB~Wdku|4=hu$(-mEwbUgjya$wGaj|H{tK z=uLEO=Dqb?Ln9T9y-g0!aqmf>wX?Ikh(U~$bdPd!HH4*`kkHqWPap^Apk0t*lHd+VBf%DjaIt%E>BPPKMUj*jpIo@Tb=% z`WsV!H?A-IW}lfC6}X|`lO-!x;%gC^un7;DdSg~p&z)Q0hxvmey8}-4Bt~{tO*8W; zTB!W?bJ&wZiuE>kbtvIe5a`7wL2bl&$3vbBpf!jp^xM6uY{0ZsodILQXZF#sJ^?TJ zuF8RS#dEi45P;$xMn#D%lV9P!Xw);yf!6O`H;wGJ|7;(Xr0c5bqpYoS!T@b^5x#lB zG2ccv)QF6nPaXj^f$Y~|1E2KBF4-75)uWG#-pGKL9~EsL6~&mqAC9xOh8kJ$<{wx! zYCKZ1!Lb&b;vE`y2|IfB!iARTBm8f2Z`!D44eP_s(>}DX7a~t5?;qCOvubgujN7#C37w zCv%FrFNF9(r(txhb7|i2>R0i9W@W8dK?9QK^bYIJM)n#)F%@@9-xDV#F=jX_B7;13 zrlqAV9a8=COU|~pbTpuN#^rDCbdmnLlPmo#yI&#%RDTaQPZpMqV!+xupC}FzC6d2=+bXZtu4{6k3pvJ~DG`-%8k*i#7Acs-6UGC@a7d)P>U6^yg};NsI_e93rX}XdmlN zKN>V>K+cGH6147#u4+@Gq)o1_s^s0Pp2v{uxRrco!eVvGE00_UAc`6sTk+CJH#V^C2#CN{7yjlyUGF0+wA`=z4MVy(0lHT68xB8WX(^W&LK6Z7 z(g79}s8HnE0l@d6q-2bP!`odpMaJqaq0x-o8YoC4PgT7X_yRcyh)koJs0!Q%R}J|* z-`#JkpL4qQ3iV*2Ur+9PlP#GW4yP7@R+RUq6m9+noBX|^BHzmMS8M9+dc#_t3mJba zWTf|=tYxD(Ww++^lW>NI2Rf@BUN!Kq^+1)y+P#{cd9_MIT|J4}Bs(3L4=3mEqvWoCJPJFJcco4bv~+zfA|^!YzSN?Hn_cPSE2K?hgpE!1uI0N& zYK!-3rx=4U)i?ZBb;~K$z{F%12H3)qny)1b`>QtdzQ`07$R@=iSKF)Gn>F4h;;&@v zyq&!-Y)&aOS}^3bRRCom^*Zue+Z&Cy4Hs@|Q!r+a`ZQ4rgYdPy%4GcM13|U=$F3WP zb+avUYNHVMDKZKId-4v*DYIQCTJvMlxPQ!Z)u z`jOqlBStfC`BhbaC$8`WVN<&OQ~e%t!kt+4TDr}vu2W#Y;K7bunFMq>8aPP0eY?c1G6w^y!Q ziAjFCfw2WUK(hsRn`kD9KS_?(-q!s0c0LW31F!1SHzrmR7vyt7Ct0~c z=gyr)`YyVU4=a8T5ciz@b=4VBZTTMYmC5}g?OZ!A-zf46^JMn;Xt*n4#-fJsN}fNQ z*vfRgKAM^Tt?3#(sStFQESfk9DeeGd76i&Xnl2Mk%xhfusozXPul?Ni$iSw`LxZ>! z8Tn}LshNGku3fXax}+0K`k;z)I$M_vYL@q)5A;@jY(Z#hBen4^ z?Bzj|wgKc`iSxke_-H7x_&?DCB;1y6>gAU_HS3;bwSB}ni+X!%I>sM9G$ZWO$jd`o z2dtd7Bf+NHeic=!yC@OtFbMUB9)=CClU~&Tb9Cpo+;VMZAIOQ4&yV^`8vI#D!Woa* z;ZUzvZSTg$Da334afBm<&AD@Tj?{KN{vE03uPH%gZwgcKV2zM1zExH4vbkIz!rlw% z?btW~}o#uDg%I4VN0fGvg@^_2uo`M`LQ)&iCo!q$7%uWE?E`;KPifvr2{ZPbf&+H$H# zGb(-XB=qLf%*<`vW%6szzyBfb#S{#8TI{!T&qur2JF41n4oOurjBw$L;}F0+^YRiE zFnb@zcuJo~h0dFjY8!Zc6o0)yKQw=vz9x!$z+%}1X*H2cYx+J%L zTduvSCG7dhc*Sf@o$3FVxrDba}EZrO@y{npWwOIA;z9oHoLfu^N z4ug=`62)#a4pbCQlKpY27wXYJ(_4kM_QNTsJ3!L~L+{We>F8!SG%^PIGE_kw-?Z?~maeB4N;ZV;9$!%wb5d zCM}!?{*)zKe4MWp?kdfwci@!y_pVp0_ zk?vVDP==j|%Zs>)ql!~r`8?drTaMSv>#jxT>R-iBaO>BnDAHscel-_tD|vyAA;S%h zd1ozaGw&7hEzoPJg~~x^mF#@BVC;{Mzy0IvBf%oe;EuyJ_8l*CnP8U zN4RRG{F8iI1n)7Sb(fg<;^M3VbarH)IllC$(ss-S z@^8oL^hW}Qt%Ewn82RAGCV+%%OWz|?bQaG+BV2DurL{a;Pk6JKjv`OXog(uSjZLud ziA$DtilCM;i<`CXm3Rg=#8$Ikz<8hvA*q9_Z=m&jy#N?s^Pw=u)H7H%`lxZCMww_F z4p0x%o^<(cGjEG;FSee2q+GH#Y^%$SpBgHsb`;y#2Fx%zcJ|xRF=a7pUwN<1UnR;M?&I^fL8 zSkh+4$oc@jN#SlUx4a1pu=CyW}&&xLp#T|LJKUV&A!g2E8fCm z$5fOWU!o3`xiED$iI*>pqZVMy5&NXV9;Zp0zMs@g78Yq&Py}XBU)sVKAPCagf@Li! zXlpzUV(Rt+24y61+J#>bPdbYxv?2E|F)>usB$%S4&TDhG2%JjPtm%(A>*dRrX`ec@ zc5F6k%DaH_fTYH2alGoN-sSY6!tg;a;^vgfPgH-!xRgR{7yf+@5!e}zpcIj`y_zOm z86is$fDdGbV>2d5++)(j)7;!Xjys;_?kE|hGWN--7_wfp-%f*!sZfl(4+NBl3L`K3 z(oTeU22RIK3uL)Vfz2s0(MW-^*z0b2^R?bAqobB*I?Vc3FSC_byAwMeF2q1;ZQT~` z49vm*o;z28@JQhRqspxYf?za4;dpe1H;O54%GDuG*j@=uKyz9ODf7YD74g-{WKvogPxr>_JK ztT#X^H+MZqGVq@imefGBA9*v{x{)vt)V}r9mzDwI^qgK?tS9V%u31@Aqjo-%THJiy zl0UdC4;@m&vTNV6l6mJsn0NO_uwF;=+eL{hw7OcSPzitgJz`25e3<+ZS+xE~@^S*- zP8ar9jFs?9_n_H)e*9Qt&xDrZ+~dD9$4#H7{*Rg868~;B_Bk^qUjDo@c|L|uD0ziF z4SUL5-XKKM?>~QbZLd^c0j{U?ey4xb*Pc04Y1_x5S()8YW2H@>HYSxf*z-6}<;1>q zCMu;u;xJQ#ctRWZ!FV^{Vi@p@7cYEay^zB=!c{lDmYnYvIq^($)w&2%=L^m-L4p4^ zLR=L8{L_!BS&oT#aFCRc%`eRia@jWG@~0_ngiYoTz?1`zo*X~Z2#AEn5ZhpPdT=UO| zF_%a$ty?xmTV-fs*IDYXISO%kTbu8>K49s!R~Z;T=|X_ik8bJNZ}>iP?dz2(OrgKX z*a)#6i>bK=2|17H2gwNkw8MEp!r%RGP2q)`UyqhA$k@@^VHRRCO`2JwKR3{<+^lqZ z!-frIG>;0Nqx2TX#fql0_1fjGT$|PSs^Uv%oNBw~Xg3L0vgi0oUW1^SJ0Wbn_NLLA zesR8YyBGYdSN40`Sre6#SEL8ZMsYDw+hElNv*BUK`^gz?tE?(k?Pqw2fc#$;B&tcMk|nw;8On z`qSdr7nRD1k9uFZcC8SjLkjp`tePAz4muDXyu@8*?yM+sS9{IBa{qeIKuf9fNgnj% z8pzdl%86-2ChHHVM3(B{pcxR`N?|VJ`d-AjbhVo`ONbmIIO_I;W&5knEbS{#6F7;zrOEv^sc6D3hOc-%xD(6@qe+OVV;miI#ZA8M_M4@>qZ(3cfM1oFf!sp2 z7u~|9ABRIW*sS`~(*jte7oA}4oTng^X!Ym#n%;LR&j0i9 zQE1N9H75u9Ea}>Fj&9~stYW2}+ww;B@BY$u=j2n&9>v=dnvURY~DJfYeab`83ZL_ii0&s}Nh#h~VGn|UvMFtyG{K$_YPCtr0or6!?? z*=8b*Xe2Tk(kY*|*QZaPIzKL#7Lnrabxz=tEpaiI;8}qc+qP{J3r_q7h(SsfnO1^U zGV)|b=e)?+wpGmtx*& z@UpPX@ayfLbFTmRIW<7v*mx&Dzlnk~L3ci7QEcR)$n)n%fj1COq!}xBRpvyI4>vIs%~KE|@olmbI$8>5$$2ZjP9NKrQF~ZGGbU zlf@&JFYk@6)@oB}gKCmi3Nt2sm`2gD-RxB=fRc5&j~W>No<3)g)*CB$^~LH9`z_9* zdgX;dxp=l37oI6C98&JI^x;izS?cJourJ^DtOf=$2t$9j@x5McUV3yp*9CY9Vc5qu zrXdfX8bCj(^?#R%USiId5%ZB-e=uJf*((tuuzvj8evbP(>=vtN*qu8yyQ*#L(tDFS zc-Vo`oHE)-=N3dWaG9Hi=kz|)YsK(9Dcq&9bRNIX>Gh3@vxR_SqfRGdPVYIZh^{~? zi+OvkQu7a4PN)iOhTMqM!~J~j&K2tB65&zUlsUQc{pX#T(RS6!-T~vGu1QmMP@bNv zu65QnkwzOh>wK@1h;$;qybXc;%EM{z!<5Ye5_bZf$npZwqG?|WX&Y^ht|C`X`oUb@ ztS?5{Dm3+J0Xq)tLjkI7PIzFViOat>**9OW6v+WVOOQpnd0(rd!vW~1SOJ&dA9dO%f>j2Yb7uSGAmcxp3kHYEO4f)%XO`4-{H3zx+Fppx`n+vWjQ=UH^F}?GS zlKqssb$7+yx!zx+?G|L9FXt48PC87zvKN5A4ldM%2Jn0|7$Zy?3Ic1*d1a-zj1=e= zCIiX^s@rr~i;bmVg2OLW8Ez%*l$9BKH|a!I>KdysW+$1)coEPqG%3sE5}>w;JxYxe zr^I#?{_$iSJbiVdd36H@A8y0+32*GY&iIKf0Gx~p>BrwXx2r|tZDVy*j~qFYK$Su* z;LKI2Dj$1!LK{t<&CxUXQBMMO;T3R#Esm8(0PN*|Kv;lZK0ZfFVd3(ADv=5aVWa%S zCM6ACa)aP!>L6-pwHenxX1=%hpI6?x3?P5=6EPqEgL)qty`V-27x+MW&9W(SHNs0M z`jGYcjRZx4cK;Qty%mi~Jh%WjYJiG!KQQR=Dy8G;ZAprBoQTX~0q#W01Xg*?@umgnQWpvks3*8Kb)kX1)ET)q`-`uvHv}a9g6D zFd%&jw}w9*oUj361dR&dvk32W63$fGUnT7_nt?2QsIS)tuk~c@sBs)(PH>%NSc%6( z!vf~O0r0Anyi8Oi-rxd#P_G1;4%*bZtq;_zwN`NZH!CmAq|ZbQ5^y*8c&x3tD?HjV zhV|#8K{j@N_h&5~2}0gV!f|kD6`r|+;eQX+!qoh{&1>ZaO%>hs!^Tk!)p^T=IWRFM z@VGCwrqGwrS8%F$un>+5M&y$TQ?B64!|e%4zSlihI#^47CgKn*EE9ts z4$heu=gPInL#gPuHp4O4M(x>#wv=SB{Uk|@!$MI&6(&Lcwv-N>%3I*%u{FqauKWZTh(zhj6yurb}rdEB(&{qP5AV< z*I!SX$v{HsLJ76vHb632(8_aSaspFakOYL{l0I`oX9XO)uS9o~i$am6j^O$B7vGkm5RbLLEAM(hf}BL~;tq9E)#bR%uL4eM{IO@Fg- z%$V85zcoG2q@9|mztq3wxUrk}4O2a!yzEr$R>hso+TDDSx_b8QceO?NP&Stg=vSs?~IyV#Fz>p8h=pfBoKe?E2`ZqZ)1hwkaqvqtGMJ!%Sm) z)h6@k^x{8TNY57uWR9=>!jw9f1kcl~-kqw&tQ?acbaFaET$4<9>Lk=fEr zlw{D2Vv81xvK+a!h0D0_gEkLtuf%dyIS#C&Wg7hgy0p?VA6B^j)1~P!FJ%k+48R(747rgaVd=7EVK;6ZW!@hKnGw7PyYq*bYv*{| z(c5Cn_|vY9)lK~dnbv->9m^tAm?LA)8BFFJH-5au`5C-P&EmA5%r9det?%yLtH1V9 zQdHbGyR0DQ>9Q-_nyIuLC=K1CX`aU1IG43+bqx*M)4Fjkpk^Zs*zGxt#dB16@Z`xN zCV`$heL925mkgyFv1EyONiQ6EIryZmLRm#c5lgV&2iVN{*j9V?5{3Cp1x6O6)#60M zE(HfZfBfTu8Xg%L*`r4fvC*E*TE@q5pS?Ub$8h7XLF_cK3^op6*wSvMZZltL_8@ny z8q7q}qU)1Llh&~COrw&v8y+Q8RBuR+4mmJ`1DIxBVrFK>dz{{@Eubi^rmKdA2A7?u zzjXO>nk!&SN-HY5>FXb0wE}xWgBMLY85YJn8OGu0slwx)Hu`()|9b%nnss^ATAuwB z2r=;2<;$0!K6_>X_GX@GkjeT345m3ZqqqC*H`hBw7mplcRajc$qi$Mzd1fCd+01|c zeP3e*+Z>5|CwxMbu=VFc`gH;7dkrn@7p)b!lFJiztR+}YAhY>8*kgfT)dis z+GxJ)KGn|^Hrx)<4N&sW8IZxeqEz;=95G(q3k@kYDqP!ZT6*Yb4byJT zHn`uQ38i@Hezt)!cnYfvW84N8-#SdsW{)0JkiopiKj?wvqM^KXNmBuC;pA_eRhpL8M|=U zxN)MYoO`%dlK`%aDca%JZ4#BbKTIqK=+l833OT{*stxaL7mj>^*M-d(jr zhjFV`4Z;-%%iGj2scqu2E6-lPo;Ye$BZjqkkTr4AJgjnGvgCu+p{t)FR(SGcC!Pwlii71H_IDbZp7Y)42?`OFLj+cQPyM zPNvI4PS8{vn_`cB)vSfFWm`;n1tS-4-M$^%{8sU-ca11EpaLu0S1>Bk^5~!)jFQ6A z(Q)_oh*kF)zexO7 zH{TS*1aGFt<(sVjQc_|ydGgb}n>>G3&RhR)$c9&ph!l!xdn?U7qfctFedEz0fP!+n z{SCYDi1eBrdor4t2Ds7K3b0^M$DV!qEW|dI)+C9bM^H{Mx^3)!^Z@e*0A}w0onl?< zJKO>bX)a7kPChXss_ff0ZH_rsm{gN#TAM;b^0dv(LqC05hVv;IFN#g^XLI|pU#d)b zX>gj8!tq@-;5^-Dfy`sp6^)xTX-&u>)eAIwmHqq~e*E}mTn%n>N}3LPpB`!j{D8|c z@32|XBGn~PM zvW$$o{Ot(pbf9$Fay*yZgR~kK^VPp9eU5da%)ftRz=8*lACEjeb->bRI*yteJROT_ zebvo`w#ppl(8hLfqcS3!$n9VO4zJB{{Wl%wt0RZ4TW3fJPfOk(;sAg|v7Qmt=(ts= z85hmC)Bf-?XY|?7KrRg4-50%Pwt=J8rj`H+02<*DD8D~6G@a;8?{z|EX6xOf-O{#> zwfaCEzA!D0S-b$4Er_w z1$Rah7o(p$;=#cRSuY{cVR75A@cF~&+B}HeBt<+{#p_+5@;0VXWJvmN`8Jx}# zQYj{Z5R>4yC{Y-Iq@t|6+2VxrkJxQ)@u?er`BP&xaNKr~r813`+7Da2xH}7+)`X~4 zl$Gt@P>+XJP=B0)Hvf+-$h3DD(<Tt+EP3$oA-~|&s94o@w4F?w zI@My?vQO(BuH`tLn{)dpyDRv}7kV-w!jS=S9!voxQW%#s$ouk^$F-Y&1+(hX5e$0z zz#Q7|M#|YHK8bh9-N>>O+5zN#$DCB=cT*=hySXKjH~RI9F5kY*^q4k?8bFY;>`Hy- zl+J4$G)ihu zgj|HyEp#?~x@1t=_IJd%E+!^HM0LLHjy-!0&2}n?Jd?GIfutucUp~k(HfQG7QCc+$ z>f6fgPH9;9JMS4$-OS8Fm@3WMs~YjT~TAP-Vg7o-IlF`D(d^K%RPIV55r=raN~1syYb1r$;E z5}-x{b9)6KIG6eBp2i!?H$*Hsk+Ed#xN%zj`t4;aHM{L55W1->0=`|8G}nqV?4^7! zg3wG10d2~t5zb?fp^Mb{xL24?oWd);o_Nl2t)12N(2zNr3Ty@9eeXMZ^btv72S;bn zpf=|0{?Q%j71xp3yMjqBTzJoa2?OIRAbiG*?c+~tvjsNj+YIQhlNn=WiWQ?EwZZ*> zxlFcKGRCj;=g-6X1F}K%NmtUG45r!Gq+o_iqqWay&6oC6HVkAemfp!(9BVXT@v=c3 z`K9eyyw3UurS|oYMc_;QP$?NOh{eIhNDu)9p4cw>N z+CIcEOnZ5YB%Wt^*eidM<$}*GWKCu6MvQ(}Ei|Ha5aEk#Xc*{QBk2TwFQ2 z=x{!X!-ow^SU*IC2m;LIya0vszKlLavnBg~lI7+4`Tfptoh3)*%B1?rpwCI)zZfoG zvIL8ucVWujX*>%eD%N>IFj(9Th}+2X=S=%x0_10rO(Oi zOTRQYWzZ;|UAlJ{q{C#;pymm0qbvF*UBM?9OzfUIWy)|DmjTQ*Nydynz1N1m@9yR# zOPdj5#^{s#rLjv&?OnT+SoyV!9TBV)7$4tM>q2urKSPmKR8{XWt5~dpw&DxDb4S2^ zQ4zM>d4wJ6lgOwj@X<+n{Vr(SP}XZl&Z95|YASUy*u^h`hN59FJTh{pL^cMq1F{uL z%gcv`+aKDyw-sOM=4!^y%P7VN5CVuH9d}5cE>|f??GBxcRjs5$5!6hAxDmM zN+|uZOs&|oUJRaDfbZu|Cz`t03Ob!UIYGb@D=l}AKFLWTqhPlou+Vh0VLGzO@Rvs0ZLbAnDdD=RC<4`k{$z2or31B{{n$Bi93 z_iOHTFrP}hc4NpOa3#-7rr5Wm(5BD3x+>lC{Xd?+J2_vi7h!katk{ioMJaWLPr^`U z8P%oIwrw&cl<&@+#{X9TRCg8~Y6wYMxpJvz)!>;&_qs68^E!Dh-_UIlaxY7YG~ zGVXz`K4BoMXPrj+dM3hcUz*8E;5=TDP~{L4?8-jSke(~cmFc@H!qkO%%z#iA^6mFv$wO&J*JSoI3w=nzqFAj^PIUe*RW z3Wl|}uY1SV_c<_tW)6TbU*M-jw09^_a2u};9je~4*kvszz{ciqxv3;C_Dgjj|4_um zBu=nj>)!GEChjgOK@cOY8IO_?^?iiZ+$H_ngMk`!(be@KABHfDd|ZPmE_W%n3hV&{ z9{5#m;fh0Z-p0~UoU&|j;V`SVX~RfJle@Xs-LP{wS2%meeL{u@D+xj;9(er7am4FV(*Tz+Pxwwi(+tE`yngUS!)M18Ry!ppjS7JjX6uS4<`Gyi>2)ZU_sTAf)bQ- z%!$7*bMe@YIo@`X)~3^8VcPunIk*I<`q?C#Nf2iJQ>^{hpAGh45Tg&L-iNpG=B(W4 z%^F8-0|Oa-<@RW~6lgZu0u2kAv3vtft$?w}p!unGc8_pKG~OH5 z`&9n=bpVzL=7Sq_l56t)bM{`g-PueUr+Andl3_$oI{3;F4rB2Ffts5tDt@TgSK@5= zf&Mrr1OK3)$Bh2FCk2_MrH+wNj`u)io1uJ!%B66nEPF1+ap})EzK%4d@!J)!ys~am zdUpr1A(9tVSdh`orDFL%|AdEyZN-baN8QMR)IkE|#m_f5#zNkY*5j`gYeW!Y3}5wo zM=7pLY~o`Qup#*Z`j6yhwjEcO)weQR3$SMhR$^tyiL+;Y*~d}8HoM2=G3ndJ&YIN; znodVoci`Lv1?ZMhjD&XE^7D7Mjb3pfU+Cc5BzJCE0PRB~{Mln+k>i zGT5}T^<91sYL)i`YTHUV0_aYrJV5G7e*0FF|8d+g+wgZVlZ`3pAdK~wJnh1+i$pe{ zj2%0+i-Ezv$pcl1NACU#eD@3TP%*`ZvSniG^yx_oX%Xo9>}w1 zO#TzL?urYN?G>xOny3}bm+#)3rxS7hd=XRf3t0uF-M_zb!1$tDP1xV_4o^`5^w^>J zDDOC5clRdCuGj(E1OWpKPG7pTAK*owDwXv*clUxiILu6iXY_86pc#t3aM7Xx+*=l^ zkDV~VKm9CMxA#`Ly7~2yUf@N*chZSTtE$*Hqq4>i8>Y}J;L-Y*C&N`@XGA5xejUup zO!h2DISdgZX{b$`cLg1q=DVBfnh856*%Kimeb%SQ@Q~FcC_a-TH}X_?cx!d_FZVM1 zmIuCG>Bv>j^(cQrWOUgAEuV99Z9hyX-5fm1yki~w=R_BSR825lJPsbpHoG<-TWBYB zn@V7zltFYj#cKwIpmPqR6eR^hqUC-0X`jBs4xZ2M{QIk~R(2&OqFNjX3W6Sr_H*pY zEq0fUWFgqz9&cZdNC?%Xu6(1lt~?&G=(d6 zeVaR4C?NUqjbfQP0!Em)X_Hwq?}DKF@1>^t3ladOQaFs*uB63&sbw?#CVb^KGn5Zs zAqeL-&)fbuF+3J3l?OHf#*dmD9~5B--b5+>&wu~GIfq60^h_GeAO$G6WaNa1sHg=H z1nQ>l2W2kc)Cjou4;AVQF3kj=P$2X1*&x(~t+2ySPX!wk-wPB@Sfh>$I6NFV5W@B( z(g*oce0t>d(jPzWvz76B<+4jN5%~H1_4ge+mMYvW)Fi(}S4XEIg|ypNRjms)awuM1 z-5t=|CPsSbs;ejWXp`1j^RI$K<_I*~XpBOlJ7maV6cX?ANZ z&iJ#?u(*8p>y_cmyg*XHw@5+UiU+DYaG*bg;m0C*(=ps7(54E11IoM-#|hiQiU4mQ z8D%xKf0u7zW>O{=$0v)s8W{!R3pl`6$9+0>;X)lW6xDT#WevLf??6A5$uX=8v;qx} zKOJLJ>H=x3u#(aLY#kl3a-|+kV9&aaiSy#cRvXWV3ZSf&cE1|TD4n+59p>cJ2hNEi za3H&-#COD^s&}7GG;?_ksFON8Ynd(5GPO0MlKs)5cp^>fYU@taVQbe8fkg&H!urei zlvybleY%E(gv9h5MV#&ij^Rj;q_kyVF#MA3t#t#$H%e`8+x6$~=Fu&Ew!uOZI$2`h zKQJ&*spBADupq3wZnyPbhI2AC>RLGa-Gc!y7sv9bQB6&ma=63U*02B_B4 zxE}Y0^OTf~F;a{|GpQtGKe_LY9e1BR*-f%x2lEr!B-042M4<~Bk;>U3I?ag=2c^SA zVUSE>DGP2hCEvMYm~<) z?8Y1cIRoVfdJ1Xn{$0IO6A7g2XtL{|zfch&&^obQ!A{3(uO6nSJF+ZEKoAtc$r(`_ z8flu|-0bG&ww`Id@|O{M_+rYAbzh9FS3PBnv9RPbXSSym4vQ1S0Z>riit#m^j0+lP zl(Ww>MHLUR1bHZ;c}($Kw_!tTRn@KG;o$?72GEpUC%KAi3|dO3Z{OXJEH+ld`8tCw zB(YX{tG8@I?M<8wB#lfV&G1|ln>SBPNeRzhZQ4B6l&0?loI_KhvKlsQ_+V)(txfkJ zMBvI=u&G1*x~LLEQ}02m5UpqvCK#6?!n>l{Lk?(%_I4SypM>IP6`k!5zX{$Oj%16p zk@m(a`p&Ojv5x7qu#FzC*(~1zU4(Z4Y7->^wQEQD6;L?!HgwwOE90C5_;nhxhpVK& z^x3I7=`#epr`JW(Y9&GcXrl%K^v%*m26R!Wh=s3im4Y^!XSRE3<_3PKaf6VkD z#woXMU04vP=(310RH6nF%Gs&eN&%u!V$zc*EubX9i`m(SiF^ZD)FM*RlR?RCC-Cg_ zg2~HxGNVgr+f7~n>*}358k_f;{qmIxMs2cpoCOIN1TczkOP7lR9` z)GBm=UlPbna&hz=ne$E<)8fBDV;Hao#e+3gmss3tR+$G6x%C_r?407i)!^#Y1lSa^ zH9cn{cyuGEy5#nMMx=`(7sZ3g8wQwwuL_I1qY_dHQ=aOdqkco}t<`TQio>Eu;)7QM_X>#~cz`YEf?WLR5Tk)(!U$7WV!5&2b*6 z#p@Z?UdbM5@!y@8%;>!&E~+gq9^Rx&g|fGDF)e@e(NKoq3VFy5xhGs|NYVQU4*=CV zRb0ct!2yqkI0aZ>4PI64*zwb+o|4c1a{INZbNf%Ww|@);l?sT-VJI(I0y^>5ty@9! zwkPH%px9rUDKW7&GCC;Gbb|pjPu)w@ z?^KtM523j8JzvcP!>9V2xw>4kW zpIqwuc@8;&O>wMJ@WUAvL~7*gl}h=d`|>ZRIgIoxF_s>&t^)?B0F)#1o4Z(l`toI= z=m_XUvWKBxzkZHSKR6pw4vac6xs+z2{f7^ykfMagp936QA@%Y%s#nqQXq4OmopUl{ z33e(>BjP9)8#p_uKYW_kOsl2^n1aP|oXb4u4B9ldQ@k7pkTq+@unZnMz(`6W7Ek_9 z?c)Y#B|;14&le`(!Yufmd<L>RDrCcV3PEm^%@4w@CslM>2DHQub+$;A0%f8)09;ce=NlyDiY# z^H*kQkKVlzp__s7*~nYP7}s>J_-xaW90*8i;t1Hm2m=YzIOc-S6sTpxrbh5z;R+eO ztNrk)Q&qXA;_Gqk*AoVBfLu1o?!ysH95z<8l?@1j&lLbf0Mg>!Wk0Pp>{2&6K#zqq zEcfTu_KfeE)bDBQ?ssZyeha);xZUwcr`@CZ%5nTBc&j%&c=YIAc6N5a2(^N+17Nu9 zSA2dMKabhM;$((UZpriWnLyh_=pbnJtPyQ2s+BnYkciIj9;gTrNQ;JoV$-I8k{0J@ z_$B6dL3CmA$QE9koIdD3zcG3Qd{_AmF0&~LAv-2>AK4o}VbLNK=QG($TN!rpK%O&pYk| z6&iH^VSZ7&sECMp(EI!YWtwA$0c-!cQ`KF1ik4k@ncS7{p-SbcjuinY1*c`oznu~> zoxsJ+Fu3`7q+w2$8FKS|r*KFo0yea?e3fkmz}_H_OXo1H7INsx z?z_?aVSMPh_4M?VX&J(aE?X99Qr;AJBx*v^U=f}~O@{&CWx`-~=j=j=77s?h236yW zAvMYA!cn{#*zY)Su~t&QlUd8y?%GQB*az=+Y}>36e;ZHP>y^TA#N#1Fp2|c0`=r&} zWgKjf3y)IVdDEsz$ca1haN&H4tXoLf0?f!coJ6Mqn)sJ=*Satt$@J#yG~#3> zGpqzNONwGx+VoyHc0r{2Yy@RLYC>gM;YTFR=;BfENZF0+-jkC5!;yS;^f?a>l^FT+ zZrznBc+uGdk-bH-BB;Rqtjc=ojVxr@opsE%@UBcix|^P!Zu{(!lR+kGI+yr5`$eUl z;`HU9xRvO2NdXba*(6kP&*M8KzMfG7%<#QIg&jRHx67fDNBf9gHact)=iVy)jzcQn(o<(L`Wz{{*| zNZ=ibRTV6Zwc!vNhT{S^7=C~h^&zacEGZEF7vdR>adlZAuee_<-#Y-+S4uNSEV)SZ zwTg<>KmO&m6pPDuZF|3fzxpEvw=@N*^vy3NHRxX67Q7QHt%RMNI!6p#x2Y zi%<#?zJ_GXYQ5jr8Gs_}6Qvsa69*81;JAW*p0@B!?aiYB{IMEZsGMz$Td=*Y0e%H4 z66$f0r3vd#v$9wZk%%_VQ8jAO9X`-#eSxZl{T1+5k6yjzBOnS>gh5LTZqui?Aq^@3 z_KH`Uou2xT03SGLsj85QEPh<`rkRThN(;OEk^p=6X-Fcx0^8?ZvBQ^$53H;-v6UO~ zz&|8JuZ1p<#(oNG8UqI`XpDhEyazxd7~0VYQsmYzsjcW7gbk*vSfXuW z**nFy;;LUT5FHGh+C$vv_U_#rCMVp2=-*45!m=RJ1suaZ$QLZ;p%M7hxpPVwKqe)A z`>S~!;r#*V7qR?QN!?JHW6*BT9N*;=2;RK=LfkV8K_6+|iz!bj3ctn`w#0sP7pQ|o z`njS*+XB1H%!Pw>b&JPDR~gk~Qu{r!lDCCRPoKVCl`O^DBBXACUq6^eFQjmUDq8IO zgTTP`dX=~DRK4$1Q)ph(02Cud0bYA}>d)QOZz~rZenx}PDr5QZF^ihN-SoRJ>gC9& ztol$*Pl!GpAkBrPOG*Ns=)I~0Try7eYb(CH;{gpIR__qRYZyw}{I}vsJPcmuERwqJ zCnh!+GGvHjL=<8_TuxPHXpM*_i7YLLt~_|g-@;yJ&COtFmvXk#meZOMxN~PS)Z4Ps z(&LZ^u(uM~Lp;8X6Y#($X)n!!quH-tKWU=rk-)w1{C+evvjIgRG1^NE@dgBU~n!G^ZLpJ-LT? zgb^^2WcLLIKEzN|`t4g-TwHs;iXb79BQ!W>R7n9}+Pe14%FdPvhCD!0;&0pG=eTht zrsh9<1FQT-GSfzWN{(Kl3Cggx4Y1wBk}}w?VYhFTLS~2 zchaUMap_IyOXK>KQ|_{qFQxXkXYF2gc6k0agY}dJN-zW|>(hU67s_dJSMJbZeMC6) zLL*_3{u+6RIBeW~2vC)4vUKIj#&ZG3*b8@%1Q26HT9KP!VDKYsFNIkQR&rQoGq8Po z^Gzl&iutU5zW%{{0@!sFH&oGO6qtg8M{1HgtRM#B&hJg{`cUqZf$BAA+@A<73^#|c z+jr#xRosM_Y6krC#^lbQAG4$^1ulT$(Z+cQ>+`lW!8N!i=&EXVHx_82Yse1VjA>ok z+0~EYG_g&1r*6o)t>@02OC8{$l@w1AFRH%K7-Vq;p^ZlQsi|mcdJccPk>;eu1pJYs zMrAyGn!r{e8TPdm&+uuDJIV#xl>c+ZYBgiVH#!WN3}y#A&om=)t%9_S$~X(6*oGCk zzpsp+FkwAzB-@yUO{r)lE3&;v%q{(v_tYaHz8u@M4_XPM)~C&$4YXUn?#rc=b$})q zJlx+$I5WJ6;L{ht5#+8y`n&U>2Koy3(zowKwK?8#4KbiHI#H(R5obE%J1zL{zuj2V zU=qx0%Jx>X@N2=dQ{$c~O|`$qq9#^$I~FAEfO805d#Mn!XJ-ms-B6DMKAM}3K&+(> zZlslDMGe9c#lgCJY6NSo_Ys<;p&ot7a{Ty5@qb#;wt zLXz7^934bM3>)|!#sKUN{@dEZS5u2k-^%*xGOcEuHH z6&gIyU`0pP*bWdu4u_PghoZ|4^`UEa#n=8Rk!@PsU_P{%MF$NcvQ?5b1Bb5FqgYy9 zG1=QWB19nxq8KqW_?ptc-i^D+`aPgY{s|uq0Kac}0$QqlntKv(WRaKOUD!vy6VQWO(r4x}kfJ9GJ`+(Brd{M-*eCm4M5-o9O|=XdAI z4ny22t=qSMaCcji9P%=N445?g;51#J$$4Svw$O;bWKezkZ>k2QP!vV2?*ZFJ zc4aN2Kc*pUO7V_X(3)Tv;=L$I5=T-rHtZroe>n6O1~p?xpJMNZU4;H+9*%-2S&gPeWr+)i*D8A# zK37oP^Run&?bT7=%x_!_+`oS~f)!jycZ>}1;V>Rx{ev6qDJ!sKleqdreT%>b`wWQ% z7ey#SNqGmkDZAx(VkjcMhYz>oufsmoob%V>^a`K<`Ex33b)`!KzUpMg14brTaof0- zs^^+%CDqE&{~Scx!L})Vu~bpmqq|iZ@c_|G1;!IX9$;nPad&Q)K7G#FMD+ga6pom# zk9HBV{(T2oFAriaIx*RI!db|oC&z}A*r3;PZbwW6I37_grrSgye53Q%u7 z!?lY-qje`EOyLv|=7dK>!j(QIo^8AH^J0|m4TcTz_48wr(>C0(bV>>16P*o6gl7_N zhh4x^XuskWKzIWR2>ksj&4!ZPFJB%+zIy@JK*dNaP<*^O5L7-hfq+-guWT1c`cZLJ zNk2Yhs(fgH*|gXtl7W#3ho8)_e;(?BFG>gqPGc206lsolZme0#dw?YexHjnTn5Mq+ zcEt>2Lc-quCd0MvaF7d}4fS4LT0>b0<7rD~gJv5Qm8FVgNX)jtwv+UzEomNQa5ExWdDQGY`PZ? zk)36PoD!1(?tF1ZqbG=Q0ZSetASLJQ(lbd2<8l}{=-2=JctwTB)%3!yhx@L^2b3to zd@23pL8XjZDkZM7CS+UIvPC4kT-KVlD>}t?*HidDq^Onop6o(A zh(*X_h5MVVpJFiOR`<5!#BUTpJ6<1LH|iF zYeLTKWyoSA*l$dNa(%n;r<9~c7rf#Wur5)_NUGt~@8E)pOIXB_-SBXnJBm}dI`>9h zNWa9TSYp!Fty|ZDEye9HYO>Y^ZN3OUS#A}d9cF^Nf&>rq--$ze`%~HPU%wy@#-oGL zr-tq!opxs?1!IIf+uTvxD{eZ$iN7gfdf@|Q0tQqG!3lZ9iWUTlTQOXTK!SMQT3I>o zOV4+Oh2;GS3PLeVfW}>y?V(c8kBkzm!FP1MpdBf`3!AJUeVN7Tpgt_fY~xWh^=(oC?=`PELR1p`KX?eOv+M_;8)toG zzR!9rR-$t>XskrHtd*L(S7lR#eZgY9mIbjn()Ywak8>OH!u#2>D?$qcM%bI(i-RHv zo6?@E<}ZV*MKS!^Uu#o6VmMW~SgQzX@MfHe;N~s3xZ<@y>4U!_Vvx}qKz@q$O)xqe z{d)KAJkoBa*JZwUbeMHU*j4M_Sv$}7y>LbCie8r4zm0}3A62z1YHPD)vlT|E^!Tm) zyVt(eF%$I%20nE9`Ljv<^+vW0l>&8wvdc?NhAlSoU-&imw^6a%B+tOlx?YB#$JQU| z8=J&zn@Z+WB8a*@NKa2Ga-D*`S55+bhLeoyF-k*{v@HJ=l}v;chEm^rec_49=Gv<_ zxBvxUn?>@dT~qt6`to9m-R!0=vV?*fte7N{vQR&NmGN~#*T;;LDdWtg(L#tT2KOTO zb-?pO>KsO>VK1Hn$-fwyr@N7n?ScIk)rznu7&h)y7BmMd_R!NibM~y_?Kz&g4af3R z#8q+m(0*}xz)T*vKGfp!yrxZ?e*gOV79KWm8l_YWujQ*tv7 zhMO00HY}ru_|KrV#$3*5ZE@Lwun14?{`2b-#^n#A0v-pv|6CD+5s{!xmm>~i0dn+v zr90r_nmTRT$EPP6FgkqsrSKljpaI3r2q}6I!zHmj9b^l$-z8tKH7g7q}xqOuH?=v%&h=Hk`CC8%q_Xk-11*v1cR5B<{bQo*v zWGu|HgoEfl@#x5FD_@_=3Q!K83nfIM-wZc_j_N!Rfn|sZt_9brKUw--gzumL$wahC zdVQza+3jS<7mG1uCfM^{Q@oYUF&;4rX%EBi_zg^+TvVEO7sga`U_E_U94dVtWJ|rn zek28Gc%=Aww;XmV7u5QVJ}HlxH3zak0K&Z9*zx0y^Mf?7>mpzm2f4LW2;KCnCnG*k zKVk5z1C)Y#0E$l;;j)Mv8Pcb6QQ6 zwO(GwcK$8Jyk^Sh3LucxVZGVwr~|11-}N;Ammv`8yE+UMPN>ZNHbCh7cnsuh3?bJL z^#;0sUm^@1F|zTEHUIURwZhwQl*V2k0iiq!dVIzks=sHU`th|TZ_L-dbvArVgqI0- zaU>9iivv=av?EejmFWI7AH3VxbL7CCS7L=}#r}*hcPsV-_a9%@Pp|(@Hc=B=W%s9L zs97*3FnGhem|flYf(3u3dMVe2zAZsHHL?uU_m)XNh5lA%^B8s@OcuYgC9{HIr7GN4 z8NZ$~P6d2ILle6Z>b6VvQDZoS3=$*5NKr=cLz89`k%aGCw@l1xtKGQgBgjTUbFM3E zhwz+XK9o8eAC&1de#!S>SY)a>)9m}V#}LmKCquGn@gw5JPXGvzOmI$u^4r8Tkk^lV{8r z?e1^%E(G@ zQQv_sv6R|av;@KMQ+BKc9+m7EsV$KWG$3XWL=%P}EN9d?BWQqexRA3}n$sZ#dpwSG z0lRaC0v_nX`Z-cd5kn6bL4DY5xP^UI+)Y&FqP|Mjf*>H43H`t6&u51TQ604!I)CtB zT!%Eu^@j)M95A+po(NLp=CB@iHf&lJI~9}X+JgE}{Et#nF}zBYv67$Vm@r*g8}zVZ zi*nd(|IXZ?5s{HGOfafpU%IMdLn01_e~EVcaemXBJ8505w1$W}!CMO!>WALH^I2K> z1I?fnP%+rMtCvsCC}KeVaXy;smhMS=FT;N0eR+u0jlV)&?1j<)5OKIX?skHyMk@!; zKZDav%9UhOxN-D}D-HyATogC9jR9u|Z!u+&X za(&qC@Z@RJ61fL>K$!-FvD?^q?N{}ZQg7wACo?}XjNv#|dzuubN=h@Y^&ql+U0Z;C;Yu1J0K(etrltt2us=LfbKlmcjAhkQwVtr=_gkPLWuG7oym zAl2QYBhH;W<(M84lWD1#abaAnxz@`QXwTm&3-`t{Sel+B9#O7m?H?f@Vskule`jT7 zl`-Dr8;`w=ajcoopN}MmvRm=yL>*OzRcNprjQ>0xovA&F9aI0+W_T}YY!6jFp#=q8j1Ss6ukDMCng z%I|f0zQ5m0{%oX5$z0nFqpGEla&yX|4kGlo`tS`@5vsQi!3IJbij z3y^u{sZUe6E12nxJ|7XRG7s=nL&^|Vqsf(rD~Q^&r>WS10DcYEy~Kk!7XajnO^iO6C&9QNYvnRN z2PuTEbStbDKSOFdTq&sYLYNT}%3B~eqWCx~t8h)E9HY^`=+pKA=AHB@6YyLXWC@M| zTE%dktE;}&pd~JZ5K%P^?{Nenm(Z(A-rilyzPFKXEt=>R8_r+b*}|-}`d2$*wwynr zJPayyD{SCXk$p&yTnk*>`UqTjd&mzb zO3BjCrrnA)RlPOn2`*QnPf$9PZ{wLq9oT6O{^bDB+Wn)tWVmSlIz}2)68#TP@s~nO`QOPh{GC2nc*={qeTLjL+Ua z!oZQm=@e6aR(zQwwV}6nYO_&o&C|_%?9}76u;Lbbe3{Lnu_R0jjxLT{5s$yKu;HH= zoEh#^{7e1>{GDtzQ~|JtA(V^5CT=%n-0&WA{*R?B~RJs~R$B70l!S786vs!f|4R)%`TXPIZF+Q`_eO_HGUkZmMk;W%yw=1BE5lP`rE zjxh*hRNsIXwh)}2#j;r7rpPS7D^`|X}OiMcv#Mk z(>ann&eb*k^yPHqhj?8wD9JxKtti_Lf7&=A?=tBMv;G3(bC})B9b>$UnPu60V(a8I z;m5~kb4~wKiGLQkT~)6*l=6~fC`t&D1D_a1av&NTFS{=Za5HS`+03V|lClR1;qihl zojY5e+mf72OT(gxw@=RWl6Wmsm;(k(k<_UeaB-i^j?pL)nyZ!%W{zjQMEN6o9pD~a z0d~1Ejj8G=?8#BW%H`JrDZN=ij#Lk*ztb&)fm>E3NrO1 zW7IK!`XzB#Z77C!$;sPdVycBCXE3eO5B}#LBtrincuD^~aLBUx=pX!?m^i*+rb@~+ z>DWtk{$9hKkdfb^@7^aT+u)Z(2FnL#G`c=s@3ubhAjX5j_uM-)ej3U$lB#%T&@zF- zgpUa;eE85CAKoevB~Wzd8T;s2_=b&25N~ivM#Gk4$;>i^f;z1y1y!|$>{MxpY07;E%a(Z+Xa^*Cp-ySFnA-LmKf1f7t5_TQui-8^oOf*~AIyhXV+1p8-4f2*i)-#>|_W=8OX{9YGh$$4J5o)Q2`TEk_V{3j3R*wJ-vo|a3O!+KNWQ07IhymTH~nfLL-c|RhPCbi zk$KlIh6K`|Yyp%vdf(91WGh|)4LhYA9+5PLND&gcDTl?2YOs|hLeE!6YP2qRc0yf8 ze8AbMl5-Z4svj~#S*mhedQzoWqc!XJ0EQz|%54=$=7@ts8f%>(q}`}ZX_ zlX9sPB!;prq6$q!G`J#l7=f)6zm=^9lk^-@r|K*+O%JT9&0&k3^~M%jRM%BX)=C9o zjK={sUjZBvIEVo8g3VojXkNPv8>U0qg)o#kJ5d5{RZxxBVxoWl{{1h{&Ro1;0c3rX zeRoD9BlH{c>6`!Bk-?bDY$G@EQU7mpi-bo#L~O~a^uyNUcXU`Hl>p*M!10$le@lW? z;#)^H2vJ#R2mXVKTwCT%Fx`=&gs&zJ*f7c@%Q6Ansk_-e@cGEA^3;?Rkw6FV-Ut3gZOHMoR4p{1xL#J3vLg7m#}FlfAa z^XBpm-GkgmVCS*v%9r)$*k<=|tKNZ0W5#deZ7QTZG}0VYNc~BDlXy!7$)o`0fVww6 zw$!sYr{8yYko$TPq;x7`vA`Qf2*fz_FMKaXc2biS0WMT~3cx%%1)usBs+*{V$^aAH zhj`9VThwo{x0R*7DvRm8_x+u7`nIxOz#}xKGULmkx3`BiDWxM;2U>Ie^`-33yD1mr zPo3iXhruL>^pLJD9t(}cuY(B_Il>I*`g(p{Y(_089!XQwPJtJNdh^bmtJ^& znNL++&8KS0aS8BhEjG3%Nd851QT9m2z?Hn!=AbNEI6+tCC0F@DvGcB5Zd^k!AyGnP z`n~}!h|hRx3S!I`228mMQCq>Jbe8|O9Ar7OE;piXp)#kq;x^{ph#)s3fTv>~mb}$o z$@`07SY${qcdrB2=akSfbz#WmA5;QZnaDy()VKg~*IG|;$_{FxPMtRF=Oe-?UEXayuGM(93Ny*UimG$Q>#-IhmM? zzw&Z#{fyBd1ZKJazU&y12*pB)w2Dw#qnp_=1dAgw9w-sJtGs{KuKf1y3Kb5c4p&@y z%Q6};3Q=URI^@igiR506E3r8_xp-0JqaBYKYGxk= z{igVCPD=_b#Wql?0lsv7u!vol#leN&Vbn8cP9Low#;b?wP-1>~awdXZD57=(uQj9g z6#F4+`lnQlvT%gzKmEb@*5+RBZ^}Of{4f*7VBsr}eGz^YP$Dkh*fq$#J~%5Bo}6LS zkMvZB7N+pB^>W8XN|UO`D4r`R6!ZGBBL<(TyVTUI{_H4x|4sNoeh^!rk#at0l(>3d zd^b34o+P2$-X5a|S}b8caC}S4GSa)#|?Y&#L1Z(eJ;h-g~dMwWXel5^}a>Io}HtSyhBZ%HM{j_X&%TvqO~;^+UXK;^EjqB9d?=kW zmVRHxW?cGpf#34t6NX=-YA$kC_-W{3c<9h7sZT09b?HLSdi~lp-OinZVfq%f_a|7^}04XlhTeUxXKm{J{Ezbi@C=>Shz-;N)Op zhNT2A0F0hE@s{ey>(;@Py?}5(YOH%G+Bi5A9(%EPuT|TkHme{IhOr7b*?@|z>-mWb zhL-;L)EFQ)IiqjwQ1To20_~3FWbsR(Y<14^kJ`441!h;~^g(oNWfq{9TM;FPT9Gb( zaP8Oo3W?kPupAxJGIyQZFdhd$b(g#^oH+g>qMs4D2HSWO5zpvI&NthKi{`D{}aP}InN1Pg@D*(a>FPcNysXBjpw*j-Nwisn+!pl~*IJGz--3Xn%T;?2$sV= z-~i*sDf?$Rn;CCkd(Av{1)+>iWh20wPL;ER{dUw4(sFU!gJzzE?IAzvP*}^JM`*IHW@a5&Ox=2vdAdH_tE3Q`{a7m`GXtONi6zFc zZYoM(j5;z=B17=HDhe$OzoY)Z#(I5TX+fJSL?8AGJ!#@|+U$A8f2J#iyB6UfUkedB zw5^mFeEHz&nhncl3IN8ZVYLMc8z;^D8~6-8!JjcLMuU0+|tN&LaBS z!#|BMBoV(F3*nFRg{CR z+Kpc@W$d(RkDDC*Y`r7C8)@JkJ_aAnwCI9cvQw~Qif-E-St z*ABE3wuf%}GKCY(q}i3TRL<)ioR z!9MZ+L*D!rMEg=>-$4 z=FlMbl;-ho^{~Gq0knuoGE%}-YmOd`B*h%N5E>N7D4|*k^YpAy(963<$yD{i3^Hmo zmBCo>H|{%Pbr8ro)F^V8WGzGD{q~U7(PZ%*0~qdVlT?Bm+HL)4hpn;j+!^8WE@sPlWC}ul9f7P_WgODP=WI^8=Cn?~wMT#-rAPCeLMoX*XpGY?@|Db=4pCt&o5=S~c{AxBCCe z+>fPkv7-|vFU(JN7gHx@7iu!u)rz3$v%l!KDVT{T_acf9&o|K^+mYPK@`>B+Z0xbx zicP2+rlQ0*nry!vPM0S|M*^UOwt=F6p(JriV~_KqGqZ{6zkUUq-nX+agZXY-G-H_- zlQP}H;tl@;L7MM7nD&GCEA}^Rati}gz~p$#;{}U~+7@!a9UHS4@k!-jnp`1e39?`{ z#fvsg1d*hwzO~~d{0>;EUrlY;0DF7TIY^X#HKnWqkaMwIt97Uav8F;8jS%?`~P(Y6907QN5V>TI04_EDn0vDbfXTc+++d0|~{5;N6_iRO>B zoi2V_;x~TP-#Rw_+1qDa{QGFR)P1Y>1ss|3zJiHodKz}x6?*n3+*JPxKl=<7eS78$ zh_*61#2E8{l|57JX{yvh-7hxo+VS-I@+Hff?Cl;FpPrw5UDza~g3c?-TEmy2yMjL_ z0ppVkj~R{PF)}XB3cdpmf})QdYTECum_21d<8k9XZ@<~RI_^rhF#Wbo4Bsvpw#GH@ zgzeJh`l$o8oS!|3%XPN(?P@#yUA0A(&{k-yg6gAC%UebML>0C1)33ta(r*OGpBk8!uThh%U2ZzkV6F zv@b&CGA#Xy=m*d&V-a*Fcf`LE4&Is|2rgMZ<>K$wGGX{k+uQ_T;tnY8FM!|`Sj;jc zh6+sKpYs#TQ6{*pSE}kbrd}s2dL>9YVR=}7x|7|9qIpw*wLxn-shfp~MrR%@;V8kt z7G#8Xo@oC|n@(ZS-l-{tXXBLKFBvq*@5Az|)^0eSSwH%HG$nM#=Kq|GDD9^|d~ee# z7-lf`d&%MWZbSkO5IO-#R}6IXmZ%U39F?vtWqEWY%0 zn4s#p2dA!#*;gLl{PZIYv6SF2sNHS=Un{1EeV@A44*fsBl&liH;M{zM+w=dm0Hm!MMjkl6&F}^VR{@L$59H>ChtHpsyZx8wnLL;59!7DG;z3qnNWC-K92cL?Q>V{qo zA5DC}b=tJZkxpe@_Wr`c-a8hA%$SttwkFrMce@3J{dK#dg+N#2fAd{c>8;E`QB%!_ zb=l$6i*l!83HoiI*2dJ9?o%qew|G*18ZJ?`Xi;5O`nrLJgEI|4~3kuT3?1O{Dj?+ih3<`}s zos9BQv=3m-f?07XDKd+1W+NP^G!@ANGWm+a6f8;C6N^PX;^dhJnr$NJt>`+#ziqkmcLV77Uj3{8>SA2mO!5wo4zKI>_=H_;O z=8f($PqlVrlee&5qBi4%j_BR)^^WO_Ud-k?sWH}z|w=eYZW!hF4`F+q4k0E=r0D?|Vv&Lt%cohTYlc~6@q<6-n& zQat(j^#@S&ab+IjjCbj%6n!aXW%p7{K7+pZjdJPn>29T*l+89y-d9>LJoRO|y*)8p zG!M*s3a28g1$Y{ST2@#d9aA5|{_ci3I&pTJwT7|ZxrutG)a28ph5>*Vvu7t1Mx+na z3{b5b*>qOo{oCCLPeDQD`PKUt)$E-5M^u->KE|hgjZdo|=Y3KxIT^+Ht)VG2)htw-@XBi^ zS0vy|^uFGhnh@Ks;Yd)tYR@rhO&SzHur<=LP>=rKd~>c@dSCpM_kE53c|Am{$CK)T zQ;yAb^Bwy9x@H18s_tEj9RD>06DJ;myn|d2qd!t(V&x+Dh!)y|uZarC)_O=Vr!PE_ zpG)H}QU&OkipObPi3IU5PcSq2w-xom4?sMNJKz6?`lqrP5ihq~&;@4IaSmplL?r#f ztB}ug&0a^J;uZ1RL}mx)Oj41Pi--Y>t+KYPxA)$Z6r^(NC?X<3RcOCdNfLO_iUk4{ zbJ;Ze^H4vL4aPL3U=*nr_OLSYhDiq%3AjaXd`X3d7XNEZap);;4ShN>jQg zZlq_bQpkn*3=7QMMpwdU^4j4q&u&`DA3}+*-eowYQp?kZWL&|0DsNW-`p4OQJ00H* zoE!?lI@2SSZC5Bh2IQMNm}m^?n6}6YnzOE8(+*BQ&1S6Co3X1I%Ik*Uf+~IQ=gcjm zI&#wU{%Gg2|~e-rCCc?4whqBQT~WTPT6L@r`du0dkmwgFr0(SA$d)LqY4DosYMkR|~~c&PEj? ze~Qu7C#zi)%|`iqbJ2JTJrJ%A%i;INPnRkAB@6i%SLVg5JFu- z(R=Z~V#crpUD5mjZ@QbOHy9fjJB!v|3?I^ z9{=y10V7vqBD9AHP}n7U?31}(=VvGnvrFpGA!v1cM9|cgo7D$CcIZO^^85Gi=y8ER zYwPasepULT235^1hk|Ed5%HG?%Y91+-EK5d zpVVmmt0T)@e++bp9klo3k-rfcYMXA|V!h@e=DDf(fY{{D2yv;%=r8wQ{a=SOo9`+l z6$t(LiLG?#wZ#xlOpuUQ=D4A6N6wh~x*D488ULa0`#Et%oL#hsNlDpns%34sz=u2~Ma|t=G3Zr0sTG8G z1s!>Xk%Su}ROb0lJ}wE55v`dF&?2zdz}sO7DG5)E_(j-=;mbbi90-di-;BEH-9AVt z<^Hnr@nu=eOgH42j*6oY1qm?EysGEX=ewK{s-(}q&!HJW@;Q=x19i~~W--LIzc@E@ zt4ifWq_d1^mWX_odkthKIF+d706a84eGYQ(+ey)<5g$WH%xd}o`0@ZtU@eNiihV+{r2v0$&#VTu9eQaJ&hAPN9!1O-JS1a;QC^t?TTZk&nva5dA#xR zENTYyvywWPjNFI#Qek8HhTL*znaLIY@loY>)6oI0GP)}`h79U!Z1HIQP39;;bWuv* z21a6`6>qip&UwSXJ%im_Y;3DYWsClS5_iFi3wt5LJVsuEA}}+XK0a3Fl>`qG=Xu;Z z?!{GR~J zV%OCDs%lYnR-hZ1a^rcSpoa|sSKo!lOUF^0LzXQ!kIj(Dr;^aFg8Eq{Ml*!*f3qTu zel=@b(rIkH*UhA=6hR0|HH4nvfFke217k;uhk5J>u#Gvz>GOL|KRv;7yU_lB>puMz z|8PESiB^g6FLV-hKQ8(LGr%`n@+O$GkcC}UrFnhPTaMkST-7lt`3Cnvl=On@Ni+iR z=z|rWI8SP}7#*81c=w$*v%v%9LJ{CuOlVEo&7_tW-v|75Js)15q34+9ZgK-M@h1mK zyaNH4FEQ~N6?LHU!g)aA<*%bgzoj=he|bn}vhizL(>J^3#bsA4fjhX`E1;^WAjycd z+sm;m0#0T`=_L<$9ts`y?1`5LD!6Ve30by04?T~*d_aH?lnnH>U--4YRD5}6CVIC$ z$W>yhEfJGwOs~}*#V1^M+|AdjC7mjC0+_QY)v{Rm74GtjXa!rs>lo)r<(Tk8Tu3u6%-aE7S zg+tpkm4)p51xLAmZrNf%$;nY7E543mhI=W!EqC@z@;C!JaRP59JuO$6vm&FLA20q5 z5Hg)^^uuSBlF@)W#9kSm1kxCYVFP`#6a~Z*P%AzLdfK}*V>F~CT3^PJALk)28vOmy zZ2DW|BbfkxJ8@5?_N{7R9pXnm6iN$>8`B>>%@!gRGkUfX;BkGp0JM?< zwTXqWAhz!2u@9-0iGQLgfngCf1F!xpDQx=OsvRmRQQMlvDatZ4Nn+pu^5^c3Y*{6$ zS?HcC@{*Kgpn-b(Fh(f$_E0#~xnf9;9$D+t=Wuj>ZA2f7QioV{w`94mkje;K=3EU_NfEt14Vyw;jWgD1%SzjCRaqEDKj9`ksc4w_ zS#W)V=6qpj4q;iL!O_7%?h&mlnQv_iKu6It7Wjrg2kaLW7xz5bZ7sib(fO)T@TkIl zsG014>mPI6%tpsa4H8n zF4FAG6RkIITOdwa#hd{HyKIHJMolJ;ZxwLvM?JDTTC8L%h#X|u>_!JFV|ZflLXC3v zY6dr3><9tA2_Tdg0acr3-X$ZPz1lhV@f>Oj8Pvs0e)7@ham+V}1p}hq=dZMEkKGc( zNy<;bOffOqE$WnwU2>;YGTB7}RAKy8Tmt}TG(JU!i_HZjHDg^qnLlZkjM5qgxrcf{!HIH2?C!Ye5IkLu7u^g;ju==@%aU4ML&EiYI zwNMF3jewM;&6%A+rqgGz7*fVAot8ed=O9tIh%q4bV^xbvX)MGd1<5UfqrToH7O;Y_ z`JHp8ouCSqi$f=^C~*8>ZR^;C-zUJx|2J+A*vFB1oa}c*Nl$i`u%;3UCGq}bxNTtZ z^Ox1)C(={(MfWNiNtkDl8{Psg*~3rAH&G>IPs0;kga1IubmF2q;H2ODnuM3_O9s)ARPX>IwdS z@E{{uif;kS+HC54dvX)K3n!QW-~qR?oW;ALHOw{Zq*vTv+TO)oF!YgioO%qLfGGK1 zZazT%+iia`9K(2C6ssN&9S8!zIM1mmUBeWdolb(zn{Lmr+LUof;keUk_{aeT|)HRf6p(5 z8JW7Cc7CLpIU{h4n#jmBEw?b8eC4i{%Y)rJlRIuwm{=nyz|U$973$Ab7nW~qs5$Pg zfP9Z0Dd`qhs;X3TyNW(?yM1Wjxr`RD z#c0?gYHp_PgpTOARr}Nt1B>@_(jJqI!9a&UKWZM^b8Mi=dJZqGM9}p)^?MPN*Suz>}wh^Con4Usf78e=1aaapP1Cj40=s7BKAx}7Gr3Y0&6F(|376?(q zZ|DMuo4gU}FPCeYha|AjViWUE?rB%*co*r(v);n*h?zzpjV=cnUcx(koRYWco?DGH zi<3Umji6@mwb%&z!4=O~lb;c)k`ir|*pb-Cs&z!D;obl5;S1Ty)hKQ_iZZTLGfJhz z3p@gq8$cUcS!wy;qR(CtFDO{l&%aiQ*z-e6J;x{j075k<*=R^z3{yaKkqD3j0pm_D zZ)P4cd;Hk3uVlau0HLu9c!Xn4dOt?v?rlh0R&lT4#>=X2LV{FY;BJiB22$<3(pmhW zsup8?fBv~wxMTs2R58f6VZVm!g3}u~9PNh^prFf`dI#GBPymfV9^viiT#P#N2HJa> zqFAWnk9mXBh7R=sGrnNeyoqB^2SH{{(Ci!JZYd7F^wU^#7^Qr1-M&Bd!Ud+|7gx0l zQpqdI@SMUDg}{-0S326hZ$hC%gjOC-N#u8K$Zb`*u5>SazxZSW?1bnWhCJ7sPj~nh z)Jb>YQs8YSr=c%8sVMDFPX17+CWZUK_Ttq?L2qY&2qoueJ1ZrQs(0u}CGQ3Q6CVQSP{nx`jCczq&E=qj5e*AYh>KI-(70=6IiILJ#)|tj zo3uLyTzl2}2@0E2^({giuD$Yd$#4uEl@Mfpz+q`K#jz+e+vFDF$K2K0;oY7QfP>$c zZM-bgnvU&>mjMAo+ibGz(5B6a8Ex5?U9Uw(62*D7YL;KHN|p4mycb0zH^swW?T~^W zfgEbFh`a>*T}|~ITcR?#U-7^#EMte_Rj)aB0;XxI#xEUbZJo%srBO zNq1VWRL~#x4q%y5H6{5GB`)n>iPi>{k_LA6S3dp7AGA&-am?+ldoZ2d`uzvI_w_3q zRZ=D$n`_yvRXkZc?eWtRV>mJQ+FC`7LIw}?R*l~dLM0$u)7^&Crj=DK4|fkP$nY#` zvvQGM?sZ%H4EyiT`fF@K0(RA`8RA7|4yfM?Pg%JsD(hLvow_D`Sokt80 zpWdO|TQ4_?L&U4((TUhWV~e3SqYjj2^&_LB*Wa&LAZNAfVW8QuV?*=bWX5-+Rz^ES zghMlxAy?1#{_Zwq z1puB-i$ZUBnI5xW*<5>YyY<;BF^F8c9!~afs(I6R{fLz2F}yeBfs2$1elLA{S21u* zC!gHG1w@Cpgx= zV`y2{Skw&Gvv|KB@CxJ1_u;qU4FTHciU-~{@R@%iI~C7emDRscVQum?*+>)gbkUjg z*J|A{bzK@c|utnW?r^_BJ^wy@MX-CHSZ zrP_Z5ru%oXSjZAeg>yFU(Ezq~IXWt<#I)~($yl2f8&QNj@Y|em@KG}rg~a>aOsiGH?jzg( zZZ=`xkNTftTle#bk1}3)+`4z=VBhlCH!D7VKR5A5GWn{$p1yvskh9|h#)6O`?5QUU zEwJq#Q8LQHB6rnYj|`YJ`y;-?k3Ljx6ya_c60)-^g$4c*%H9f;u#CuP4PP=REM#X7 zgY97e&3ZNWVhgLG;~c)Ku#?VN!PfF@Mn*qe4q5)LtgT9hpl|8YDKO-^qrQImCe&>P z+qV)&{QUeZTaLDPy=8d%@tIp;OXu`yfBN)kChOB4oyQYwu$FJP_x-gl>YvJIeO6oq zBDe#SlzzN>zb$#C-G!^MvB_*M{3|;Ki{5iF+?MSNs~u)x@x14P1q;rusO~~#)_Mrj z6uA6aJ^C9G+K%5IYL!^Zlw8gbgBvr$Le95y-FS3LkcIvTgY7m>PEG|Q*~DNx5@?zl zGpCW|&15xIV{6h{OP!$&ZfL4MfByVL*;#5XOkIk6da9~M#URMS*lX>kP2+>RPT9#N zRITfO=H=#)kZaLX9UUasZHV$47g1;1HAW;bM22qz4PWYwPPTR(4f* z-Fb4iRwUV`t#v0AdS1%TKCo_d7kzzKE3PtI$aYTbtnXS5GK|*b&9ZM;QpGvn*IJ3B@+S}=3Ux7|F1{MlAtmj2IW zIn}YYxp|6%j5`6?)aCjLhy%Ek&a7g+Q4Sl>y(1Qp^6>D)4#`l~vu3YQ{a^Rjqel<# zUPk&~2ADSsJm1OseRmhD4()jQeHfKd&%RMaavMSV-@^|3zN3v|@J)AKdGbrag?jz_ z_kUDe99A7164L&Qy8^zXyC?R}bvI!gG9)@$9ke5U)fWC+_0QkVlP0G3dm zmZ#_Rf|0+TxY{&4nVwGLpc^&j{-(X z9^ZP@HCnToDns14#KIp&qx`bkG|G4c2 zZmAbGg@l|RT%MY9Aseq8z|Y_blg-S`jyq>LW+!0Bw?Y#OP7Y{&Rr&m4;zwzu5W9Ep z%srbo<4}tfgER5fzt(f$VIGeT_GQZUuIyY{U@+Xm*|5vTC5QMu{@wJ~^qo-aubpxd zY>M$6tRgHtd2hH!;tTy7Z+|Z0sOWwWzV!R zE%Wm7WMi7|-@4Tvg~vi|l3vpiQ+Zgp@;t%p2_A>von*wVtiquF|lFzk-?4DXD=v^ zWOhJKHm+8@?29#n7=yx~LY9%z!7Tas^l{Jcb~Fc!{3xK4go6aV8*|8J_khJ#%mYIX zUVZ#{7og;yqzgT;nF4LEzjLlmF+P(r0Dx^7N;2b3FJ7VlNE#of%)vPl#~>2 zFR$KvGGyuPAZUw4gS$(*0RWo;{9te*JXFnf3T>ea*X8#}oko;q!scj?vUdY7k@ zY+g^Epf;6Deqv&s@{M}GJTm^vne$tc(B{$Wwafo|6EmihtNGpWgtHYtKkK#B9?YIK zhh~8xe-4plwv9V9?VIXSHazU{XcfK0hF&&lT3Y$13swf(v6ybKZQ$`+odekzc9V<& zzlE8->;pmaCIfVgV`t~&)Jw7pTfhGDKIOo{zlW?}zkX)f-I=>Nt5{}d2GkBBoteK- z_hn_^ew(CjB-@uzxuWStW{yrZm1vGNDTOEQV?fNd9fIOZPDnL{Pxu!!`?9yQ^}nxW^GMdvDfn) zEfY-&A1JMVGm@w-E*~V?50#Zs*XNL!XZLP*v;28KTGO*mm(pg#8DookTzZXx5lW%Y z4=m2`i*P!Z%Dq>wmfUV&;P2PH1Bh z*K6s5{Z7`ce4}HCn401k#gE`O;<0z@@SR(wI2wwZ_^era6p9H1Y^N-L`?Gc0q7ZOX zRWN>RaQMA5$K!Fx{0+UQ?#FVLF^c^wUfU*~ zg_{NQA`AJP5G$%9)6%*a8yoXhA*t3`=yS-|iQiLfY_n}+drzM_l{y`J{Kl7Fy!gB9 zVt%R5Ew=lDZhLVl57=P-8-fv0D6{=dMl@vI_vW-;Gf6b$5?S%goA)IZ(pEbs?bBmo zQ%25q?z|?R{5XEQ^d4MYOxZ$UW$Nhb(>h0dMKQk=T@6OoKY1vbD16j^Y_&@4F=fV~ ze=Zd-sTvqnR*F~yB!4q*$R2DW;>f_A)S85chszKla|vQucYNkWD^3jmTl3}EpMD`( z*9a8Ns+(QBFoIy3_E;CYY~1J-Po}26f`O^$a(Dj-Mj1D;f>XlFoLIF!@8 z+5JyH4llCfd4Q^L;y8~aIksR^?)-KV$RrcJKdHjz4Vk1KNhaW8#tCc&{E?guz?(?gWpgtfR zPK-{%4sU`9{kvt?3+?8CrlzI}e=G05e*1Q+QR(kBTHHbO;puXSKlu#@ znP_a$t(g0Ja~>9Pt1xtYaD2udHh56<(vHl<=~977)JV>{Hwil6cSTpDnHN~O*bC=* z!K~1TW172m?_MoD0ogCoWMv?vHGf7TJ2QdfGfSbC_F7};38!=+J;;^BC)YCFc{^Zi|LR>+wR^eu)C z#H)MpmQD9Bcs`U(7c?f~KhUyeOALR+{77*pY!kp!BBkUKJ_w~GB>Xs#7~CSo01BQP zzxXPfHzVoM2CLN9?G-w3p&Id5+|daAq?`4ua@b0C5PJ%A4+;q44l&>j8!EfQ(~2*> z|K^WcY7FkR)By=pXQpOm!+xyh5phgr&7Qp;$G>T{U3$@=m7>?o`FrPvzj50M?YniU zoZy>XT&yu*z!~Ke`;BMpD?eCWvyup>r{0xQg58Ps;N_QO7?B(c{ZA;liw^`9@cS4e zy)~-bDO^eF-Tb7nQcG+`wY9^K9_>M65s&_^^^k)v4&fw5U-Ihh+c98VJ^W33ZJyAD zDYRD9c*%B2UmPPA_L=n8>iy0!SJ>CYPJ>bij|9wJ(-%CxcTDRpcZl1Nk@2m=(w67P z&aOR*#iAS8oRtFcPfPL2W+1Hj;>DkoH6H6+{jKnY$4vBfadwV-+^LV_)Tuis-meNf9j%?WZFyN`Wv!FhPi9}h7i}^;?1{dS zV>(IkPXkT4hA(Rw%vd%HU&(hA>2d#cDS!R?GnJ!wA4v#9C{GXPQgQE)xQX+vn`Ae& z)xXElk_v@uB4bj74%fMJEqSpwR-Z;hnQRweeH;lv1j37Z$@V=w9vsQWMGGBW>RpRf z#2b@EPusB;f`Kh*B*0y9Y9x8-t+L{t&VO>+kRo+IkPvD9B%&12149cbxIg=^AIo!N zhpgPe|5ek`xg!J2{X8D*YvG>!&;vuusnGSf{7VVIDWaFA$+V93-9FBeJtN}d!!K9Y zj@Z1p6X_9g1W=p|Cm~wq6o{`qIi}Gi$`}?pxKSm_mIua|WKH3gEzRjivEh}`&=kjv z$Z?0nEp+PCsV_@Pa@a&DsNKTi^jT0^^cd=0yLJ_|9|8rM4&&+bm-_BJN4Ia1t8lHy zRmR*O^`6pzAES>7fa`Mi$mEW)UxZX+x~6V0rJs2Bi30(f<&0q{sc78#PgHB#wCUs1 z3p-q_``tr9q{x>774O_~>}g~~7c+C}&%ajF!jY+A$fCpY3%zUAhd;Zg_2#q%2REd+ zGaWR@;o3UGaV}Zyz(^>dKR(YIkI^_bcO?`KG_&46KF)Zxlt;RsDuoVA)X<25$HRO8 zwXB)8AI0bPXotS-=XbgF;^K6Luihpa&G~`~tfJVJ@*ymgc}9e>GbbGy*P7S%ZQPRZ znT@+t)LXtfYaLjYPi8Dux*R=R+T9G_9Jyb?KVW@HWW@NrapT6=YQ6{=Ui(*>j3eem z98}q+$@JLG)4hTU++Rb0h)|YLcApWN0d7MFdi(HZXp-M)p+Uq zHnJL?4Hs@l|JHSj_^#%)bg89LjO>yY6%YcvVB##!g>Ku&IH(R@_4A)yzkz+SZuIq= zegP{qXd$kZ`GC<(O0wf+yUd*%oRCoJd2!Uj1q+z(S>^E}tY|FFfxtI|HssMFQ`%5> z#?_o-3QA$_%Gcx+`f(+kTxpr*_MvuBY2Dfq`4_1qL~7l~-*au=GlTc?Q$Wk;cqC^4E9*#wrElJh9*#`D z34pyh0cF>)HABhlrSv0USobchUP%Fq+GA9gXweZXgzF5mnlwp;J9n7{D{b4hrJou> zab8$hnDeNkzP=dW0-3C0N9Y>U`8hbvkN`!BO0OhaRYSVxdokTk$lrFCiZ}obR`H_Pb5yuS-iyi(ECGXtuv+JGb!U=2WWO4IeBf!nDIe zu5}3h^=bHv-n_4$90!9X&AKE$f^3t8MO*-i7_NN7#Bxr1dz=sY?Ai=B_44D#7JvHn zX~Gc}Z`bzw~{PXp?j;KOY3+)tfgzZ1xlm`%=r; zwMT{qOVikTM5(piZ9M~5j63U_IMlz{|H*_D2UZ!ZA9qNt|83GEo5vAV2TtfRQa@_a zIlqNC^0>5_c-eWt;&Golqy7}9U(7w4MsNWNj!o;Uw>~dFzbWqqNg9h#kR5I0Jh4bq z;5DU|EfW!_pIEg3yadv17GTmkM)h6*~m8Y3=oo$k&&C3 z&d%QLb&5{R#A)aKmL`FA+nge=yY$tXo@BSX?7UQ9R=* zgG$rWn+n`>S&Rzm@it?CPtp5tZh9$hCK|Vl_OtUnA|at;pIskzjXgYI@$=UJdFjS@-bhDm<5;7>%cpuj8eCF1)|OGsVJbIWFs0v|tDjNqvt zck{rS=JmTZkK2oH)%RW55Kd#@11CAGs9L$x;Hl2w<-@T!zkT~Q+PBT15z^)b)P9?S z@`->8dLV~DrbH|(8qipxPkerW`h(m>Gnkr@fj7Lx=O|7UP;fTEFKD*^iWRc59NbG7 zXX3FeMo-}J-KkrvUCNo3ZKte}7ATbzN3B!B;!c*0%K!tv<;SNN^VrkLl@k?}bRmpq z{~{Dn1Z?VENPi>$Zp;`ZvcLKMMmM%r;Z#r91Bu&&xE3$?QRuFM-f2LsITZP}3r9{ngbI&|36wT+CIPv}z0eX=|1u!RRdIAh%b=HuDKz~&AvR##o! zK$^~y4P${XYgPW9jRNd<7mE zq-&c@pEB%6zWHZ;cKqKGO>s~Fo&(pV3o}^IMo|Dh3RG70wvMx$RlM!ON43R-u~BxP zh5q2m5cIwL{K_$0Oav}qNo7e{*|!IQvV?2J=a-6N39gILHWpJPkRRjn-2VHasj12O z*GEsD&>T!-=zxs%n%=`M*)EiNB+Gc$6APM-Xn@xuXu9B(Dw&R}1MuP4SJVGxle{lBVqQ}%%t z6hsLg4F*_zdSO0+4uw};)hN?J`!@1%~$W@%eqejnPAedH#}LS$Ocg3}A9YxG|b zg6fUAW!d~heE_K>U?Cj}t3FsfBTiV<(>bX+d*|V}{_EzqORpCPp31uaX;!kD@#;I$ zf|BHC&7UtNF_|&ppCxw$GVDou)o)kMaB>3j?cVlgG%D&Bhdr{S7#0TNh+XoFg)RQB zBygn$)cQj`jLYzN$eBY0s?_j0_H2if0~%#yX;n?A;{eDF{anda{h&w z)<_qLwKsaa22D;Pko`i^uXp#X_iQ{FryU=5klF}y2JSjV9{*XCDIk;-B|T$f@=h#` z-g1bcLS0$dNJD@r=4bqfY*}72Y)JsPtbw+%!j}PJCBJLJC_Z0L~ksFjZ&Ki;5GBbyV> zLuRQTb2uss45X7rN%iyR&q>s|U9YbC`FR#1#>PZ_@dTS+5Fh;V(yHRaLs=055X*Hw zVwc1w_%`PCPhqFkHFg~}s(8&4VK9{0Oq!R_XuWT!dD$lO1OFNcL>#2T((-bwAk3u0 z0EOm3q`G9+Bk*F}#6jJP!?71|*DF&#Mm#_4MDEM;YyMu)ZAhg&K$aiTh4+0S?C6|h zg~Y;LqpV0}>^Nl++71dgcEij^Rzj~}aOM}41^}7Tv>-H3vBTEH{rR)%c|gs=8+|ClXp{>F_PRhAnUO>km$FO!Uy zm>WR?*-O34gi8+}e#>m3P1oRtA1S=}*vE#^ z*A?<)pXljORJr|vp@7WuH6;?Sjy<8HAfOF7VS}oX9eOvmXbof4S?oiqQOwR z!i`u}LYiA!lZMp`!j2ccpZP>{$L`%XXi^ohdYw9O;~wJf$x-=bUlIq!kZM9BB3Mc` z!@bW()@zU@>$V1ZVSNH80@W77m%C41q_MOAIKZT{m12%2-M$5l!u&@k_4owVDW*jg zOPB~C9<3vCKYZAlSk|>L6YAxwf0j#MWOgi~r_4doPpyeO~1>FWe;bAlT<@ zKB$Ol$@HaVWtLuEC+|+r%}pq(s>aKFkQTsy{Tr)VQe5F-H)hPJW0Mma@s){xigSlX z5FW(#vB^r6=&*Iy8_)Li+{Cq1>o>91GVW@^!+KOTJ&X3i1p81Y3k1n6XiwFxv%3fA zEXP?TU?bWFkW;LhUSjMo*VpNs-xjh$8nA|}EAH8|CzwUfQ#gHU+5z-4eGuxH_fa0s zr%xjNkOrP!SiJ{;^q=+&$dL}3JOuPLNK}($-#rh%c7aQy+m*?^;C|N+dPOphK_Qr_ zJ*tb@y;djJo%+?;z#xpKL{&q>pwVy;kKrI5FE&$G$xj1IVye%BvA6Lf-QA9zykVEVhWm*JWWXH?`@AF21EpV>a(T^=e`sf?7+6=Dq4qokR8D6s=xfcw%B#8Q!Jed3tWy38xi5kFsyMX?ts`0dv3mv`G>(F4lhUz+Bg=MU9>v zUErTo;4bDHLx;wpokQCnZlOPm;Apb2`0IAfk%w$j;da3|^yk<;e)Q=4y$K_tx9M!N z-(5Rx^n9RW84rVPTsLCY;>9zMyIz`euwkP{fHeteoqZ`v#n=dj)!I-l@54(ut; zvv>gNRWucFSUiy7d7J(?W0N!oEiSJ3o2ZdcD9oU4fZ!c&6jRNT#+pON?K7QjGplfo z>bK%~mKk~61%O|{dhcv{yn+5-y8&y8vDozK(=`Sxy1AyVT8B^wG{ZiQR|DufUow5* zLaMhr;j9J6dV2AT+Z0{DDBOYv4nJg5#hiuLuP<{CTki{pQlXY}E>G8ST}z6s%_%ZiE&oqYku7vI$1R z(*o_%YoCD}%(LgtRX@y&CU zCKZZsv%K(Keda1N)peEa^BIm4f#+bk1hWeY4z6NE^MaScAi^!~D1EWQp~Sw53m<)7 zKOR{Qf9HQ(x~%C2M9L#iDA@?whpV;j-_C?FQ#Nkj4l|oISP- zls5wiJv8NnGsJ=NY%UiKK20@k7FZ7dlMSJ~#hz2N7}YVy4pMdmlL8NtY;$}Me+u~Y ze8|0f_fCR-(1F4esJ3eL^{RvErjS1;IyM?!=SBvQLKx9gTO%ih8_D`y(2+zynvd*f z&$Q^U;5OJLm`%k3-wj$T0zC8~{C>IE%yM)$>5s9FfHE)__3oz6xBYL~Cy9zchE#Ln z55%d<N$UIC8(MBs53J#5^_m~{e&c-z9!L~Vt1fyIUR8!|M_!mmZeiR zknd%`7_q$>Buci@K(ChyliCb_2hj!!lf$~YB)i|^Vwb~A69&>S15gmpHcF)6=5I?| zSVN+c_HY$f^~rRK>|V?=3W@_L^(cTIo_8?%8e-Z_EX>J8;&uj_%63gLq!(&4cF4-p zu~j1AA~#C*WCJti5Kh|NP~4!R90AEE;yaj8sL|Y@q=I4G!{6E^r4?%jq)xkd5qDr40ZL zseLxVkifWT(Qy@buVu^DB&T(RBcw1Ff`G&@+Rg3o=h&E-q8?2H!GilR;RVHKelei- z5%fb}t#4d(s0Io=z^gmQULx$28j7`v5`#EcZvn7Dy$y@fE^kY5zjwZ0yJj+5`7*n{ z^l|n_+c-ElP;vLceB$LrpZ<)eIWvEure;o+UR70ffcg`}Cd@bYZ&zkK_*H2s;(ok# zeuWcbEM2--d(W>g|BcXonzFh@>22Z%xPO4po=X%X`5Z7rG(Nik$ZT$(c{KTHyH~p#XK(XHPnw`3bp_z!=KG z^`IQtA2rd%MVIeEfh@~*WVD%z_wBtyP5DVq7gp^eei}3TrKzR$3uyp!`@g*yjGz8t zFjq=`pqEH$Xx@L2?m~b6K_dAgJ`+3(03OJk0#FO7;?lb}-XCBp%($3$$(VnWU(4k} zaCC!Z_rY14vR$O)!M0$^&Nt}N!r>j*7wkg5g6xiYzhwsmIb%P< z($KV2(hLj?n$$~IuWrDpzaH%|(NYLdVxI2c!J1U3h@!ZTj25h?QIn7bq&A*#Pg2w; za+0zCRw#s6CC(;gi_<)iaBsdkT~!0KvZ~A(U7{tM%F0r}<|M}q15Uyp1~Z$r?-N82 zUIX5hA3aK)Er5s4E~V4@WO*4EIlr4OCS}Fj30dS@m@~5VW!p zgpYEcJVsI9*^aZ4SB+C()9({3XDzayT|R*jDq0^&1FStPvs2~nv>Uq0lzZN>XU`8! z<_}^=Gys5r-Bj4p7w}b-Y@T%al}4?GP#abq?}A7s1ZB!sR@~TL3|K8KQGOY1gGz@E zn-GD6#Pm92wCi=EwoLkq^$%ZPVea-h0Is}cBop(Wo;48E!VUIZ>$JEwy*9(nU@r9;{Gr&XGTUBv;%PM(*OfTW7+`73Z*@}{ z^8zLy>mc*!Arjo=1EN8%0c8Go&_{hI9U%7tt=R#pGPAS6&b0Z+o_PK zv5A^O9G_uU;3p4K#iM$pOT-+EjnGk?T=7t2F1UT4IZ9AX^Qh6wt}aY|S3~@uL^Svj zJ3n9ohzi~queCB^1moEH3q0Gz1>6H0oMjE$n)hd^FFQMf7_wOV=+4>{p z9A+_j6#4Q*xb_`cF3s8M7=0ZBnjF`iz)#!yU0@RS!O^2eN>s437){2)Vgp!- zUf-I6W4*SIldZt=+c{%$OyC?#KYp|tF=Fk>%s~NvOc~|*SySUnIS;yE$$M?jk;V-5 z6_+7r!)x!6mtNl$Zi)MRiAfUM9s)2qi3+bo=$Q_i6?fBkqAsN0^TvpYL-u5PdMvF;&XFw0YK0 z@UkL;-k>w75M*_z-uAh@+esywnwt7FYo$P4OccN=AT4V_m?3o41*QEgD1G?%FD{UzrLL; z+$C*0Xl*><0Ljf(+J9p3jrN_;39hRBR%HJFXgUwLp7-|uhm4McjAV;Si4&3(GLr@w zk(He!q$MH}vQkJ{Es;8e4xxptN=QpqSq({~gpBC_yxhP4@9{Xl$9><9`hGv3_xl>J z>-BnFC1#s3y^%D7pJji;-H7fa%u}0daMpwX>|QaAfIkkuhS~ouY{VhFMWxuoc)c^z zD_I~xfso`<(hT;aX8-Qa+VcEp^r6g0QA;q3$cHZS z+H3rT39LrB{QADgx z$;o)y~9z3QI=oFf}ybUnpMP^WI?vBpX4Tr zqm1psyVJXuS5)jGY#`D>!0ZYyPF(6qe%MRX8+R3-eeJnx1)x~7W+^F6Za97U~7{C{CRv6OiU(_B%P z3rxaCXYM``P%`8vU_^cTVrBZ4wAY6f5=ROX-{4aLzM+APjvixw?j!JLZZ;?m^E z+hFJMT?+nFGhz=`Kizv`incrmLaq#xo%b=N9SDn19FUoKJM>^=1 zwD>ni7M6waCSF+FH!Pp=bt~ZY`yI5oA!1CC;3k-VwFJ z`gNPf>jX1%&Ehm{)A+M?9PHn~spt+t!2z&UGDC6+pIjzBr>2*^H*H&+Mim2xN^~9E z$%z=w(k~KPm~mPV>ZpW09bJ8?kFcB(C=f0&0c;1edyx&zzmL-_)uFV=ln_e6f5}h+ z9FlXtkWWG>?7Jd2s>Rf+>(?NCpKNPeWF5PU>Xt_4c3xf}HffTzxF3wydueN%yL$wytg&_=lm9(d*LE=~cBHKepC1=KYlEI5%n1|OcMU%uhNA`AJT z0+Fxb)A2{g=%I-64Uv~FGqxw13Zx~JChmDer@?BUdu`FnOr5a7iGpDefdB&eo@u8{ za7bRgIvf6+aBx^kuNruP{C}InBYF_o_z6rzrOL}mr>|@JQ-9#Veej-Ny?uL!e`$(# zhspILX)T1bL9iOtHivF`DVsZFdlnZ~DK3I#A&dyt|D)6l`b1oh+$J@_Qm38~6;S`o;T?PZ8r==%V82Rh7^$j1#<;!=G%GJ*1 z^Qnm)XI;y)c(nxW|7hi;>1GgQh)RRdAHylXLIp8E(k)-6#~PA=`I(JZ5%|CqD%aLLR#3 zWA`H|hbOVJvbUm&Dho+D$wDfiOxNn)|BP+0DMLNJj0C5$(?%0#tih%vhF>FeU_Ng= z+xd`jh+Ad@eyI}xHMTkaH*@OK6E?B3fQ8|5FPM;$@%$T~g^B8{ooS~BW{^(3bGO3a z5M(02QqGM4TR zW5=(yeYIg=_VVLQPW@M}X(F?4>mg~AW6`l3pLZAO8 zH+q7xAj7$v^?eRx%EEMpBa2v%BE;LtZ$F1XQ=rP4lJjre^iz2ee{K3d(k5Sh`J*$P zA$OEQ-oClk(`$f(ewSVT{$hS7Wl+?U> z5aVhv+pgLn-r1ZU{`C9X6MNs{lm^#GY-YzE5182JR$*ZX`8gjaTxt%POv}53Jkx93 z_7F4SFKka25<>!`02L`4vN{VY zyKO6a5y7#E0wn;kkkwCYVREK|fC@(`R7yQf@@?s#cH+c|Mk2NV0zZ{=Lip|IYl4}S zxNwIlPUq|TWVlbve}+~_UEgeI7k}*Y2M}>~Y~HLOUGa^nYnkoP%~IdKri0+jb^s%c zyldWjzw@V3b54PnurPkIr=Vjhg&df@M-%WLYIKu{%3w4#k;D1}0)lNWWS{%}fBIy3 zfz$FM*~xTyVSCOp2cT}7Nw%NF0bXt*#AjYk6rGxF>ZUNjHY#T+ZKy=0E=0StA3A}6 z4A*=hCUjUoqOn9K+6yq$rbB$NPH7Q1nm5tSczqC{4B6Hc6(K-|-@u`;p^31-*YG-| zX~0D#le3LAtR2PFmeV&*DCtG_IB-1dlRe{>0os;_HU61&bzS(S`Oi>I@+v8d?m{&M zdI|YYckGew`JiYLH0XMKqbsD(rpFij54@(yQlDMi(mV_(Ae5LfGhljNDz5NERBy+! zXwo(*r!1nOK4zbnqkb2cHEUF=3S-W?WIG1FfTMzAZ<6tD&|2#0jZT}bQ8&lh{6k6X zd)hMJxMo=(Mvb8iO%CK(R@7}7Kw87Ohy@lmW&5DXzO)XCdYPNM{N0R$^VjHg>((Vb zZq~GE4H6<|kYeO!==JTt>LNa{3>=WawmrSp*x2~qj7y`0bONZozWB=QS+fT68j1MA zKNQ5C@|Sp?wK8_~7DP!l&r zr{&U+W(?4%`r(1YlQ>8yXV%#~Xz4cNcghFvm2I(|NzQ<~{0ba9bmYdPWLIS#H8}xP zbnuulV`SPQkPfxZ>%lBS*k*qn>Ng)4buat49tzr91 zB~8J0&;N_J5>&mReH41{H)G1L5*oPIuognq# zI4bK+n>GR3w0OK2bO|}I^3gSY`t)(FDl($_oIuG(Ri(0}XP@#iS?mU3%GW-dT2-cs zgxGu-RW!;X3=mk4+MUB$4Lkl71U!q=U7-V!8kYeT%05~&Xs zJ7>l>Z%Y4*t6$FFSM!X%fC;D25_x@i2rxB##duZ}V?ynzsOW3f<8;A0*UtZOK_s;? z0g^4d!21q)QA*@HDFtMa9YyP6ZoOU9(`V2A8q?-L{M$)4^YT7j8q(*n<0XU;hi8oH z&>m$u>9k4ET=h+D;Mx(Q8*S6sO=^{CiP!fF$5#E)Cen-T4L(E49XoDEPECbDGv9>Z zdBf;1aff6G(Yp`ROXqzdp)EwsNEoNk7rcAS+EM6$K&$xgrp(-4DGzC@swyig;kBN` z1UWG|`2wR@*)k76KjrDMTnAbBvtZMA&0Yk)K0Xj0@9 z)5tT8$168#Ycj@}o!h&2&%E95UA9YiRjoTST#o5Q6)SX@-eIY_+V0UlW1FAY5T`L| zllSM4CF*mJDXkCRo3YV$+gPi7uaOaM4}NZZ@$t3^JGVzODd4QxgI)<;kE(zGjQO(i z%N3rUNr_tIW;UZ&1no+s&dgmw4C|iqT-Rzyf@8tEi<%Enu_an{SDM$Fu>i~d0y$3r zd17WyceM=ViKrK8;ddQSz{3V)UKYb0tJ#JWB&o&2?K^ge^EI4nbpimpI^2#H4m&pw zEeccF)P~=~g>*((Lki(#YCa+3x6njN;HgbvD*Ofr$ zvZi7k|1g+dNGIHX&PB8Oq=bZoe>Gk?47|p-a7kVYGHX?L2{XC*8^6q`*@z^e8V0S{ zLC6e&$sJL#9AEQ3l&vxv$FnOYDwuyCt76#D!o9_MVM7@v+z;k- z(PJ7Y2CvKWqj5OHsc+Jr-3R|a7hsu}Zdg^+_N`+h)eu_-e!cCk=>7Y>m*v#Phx*U9 zJUNZcvfpZdJVRGAHM(kIw~ujI_EP*SSQ(G(#zRlSx-^l0SeATz=92|RuRWsIgs@|m zh<1Fz*_8c_Y|WFM^&myEz70liBjpC~YeyfA`SSVmh!1wxT^dJSyB5ya+LaUS*L)d% zYIG=GpE9**C&gcVf7_1Sa4HeBV1rnH_?pmNM6aeG+n_PM+4-2jR~(edq`ps|XqHnP z$lNwRF2gCo4NjyO`Ca?|rYo}uF|!6NFGWSL2u1djl?F9Eq|<;oEZ(bFrU9qW85wTe z8*smQMxA$b^F{OKb;qV2TtyGVSg{_Z(i2*{xa%jePx3n%!xK$z*o8jXu$Q+%+t}?Z zOl}3V^RlN6+^rV2Kn;^zh!7KNUND1aQYRJQ_;Eur`W_{b*04ntX^5BT7*h#PqmQ%s5dI*9eHCLofopy#lXLvw)*KN?L>bklZ3Lub|DO0Du4w~^A78&Xs zMs~foo;!19VrcR5IqCOQY_DE-nA7-P*zB`55y8AB}qGke2VfUi?H-@rgLMQ11xy zi~ zNFT^Je5~PL%=jO~H<*Vk>oSOHhlj7#rIqV8((5o2TRiwY@9wXTZh0hHckQ_MmN%xZ zzLu0&X*}kvjbw5px07bierl9D5~-ctOpkXDmEej1;|R>gi2Q$~gZ|fEQuW5es|71c z#Kc?}vBb4M8VC{QLIZ-Xa2s0&mWjgoHPj3-H26%hMR6krx6I0|>pjs?fpp1ok3aJ^ zl0&`hl*@ft${dVU-M$!L^HQ4WAB=Vn4Zxza^ku{Ep@{lK`yL)%^-y_6++)83Cs8&s z-ujPSBrfghIPiiSGF~}EL}j&*S&ob<0Vm$D+xC~`n1@8(+*>OU@BH0k#9<aD5*eIpvSZFn8P0(J{2DbHMc-OR9SP8j@w44TVH_OafN3 zmVgC~I8>kdFeddUQ2ZfKW&{rh+DdCy7+CZ6k<3}6^4rrZP$EaKB158u*r(t_A? z=d6P6yC{Bf!+HFbU4N^2umGX4$rgu{-HN z#4fDE?q#6+tG*ucV8@foyVdD$Cc3nP9YkwTU0X}#>zA()U~-OC52Q4<_ne@(<-2!| ze~KI`t3*R7@qnI^2m}hZH_YIob0J}hb#Mz1qXdYe zC5YmAK)`3XhFi~@=MUqW3xA9q5a7jRClIv}OMlO{wjRgE3)~r@u*z^`&_@!tG%g%y zwz#}|IMd>f?oG=|c}&TbdsE-M@d|fSz2`EG+u7dv*R#?H)05M}>gwZ{j}3PBB)J_3 z4)(?Urca+{Wc@7r_Q49>evNv7JSX{L#NK|8et3VA=boDy7&Z7nqkVqv$x42)eFov? z7t}E^N1;Xi`R}fD-!XeSHD?G%DJjG%#;_C4+O$_u@g;GQJ~r91G3?0@U$S7V3UKr%pQ|>PUr{TzPH@ zD-x`I{QHGi!5_GD8r`{6zh^H`_Y6UCFKrO_CT&@sIO#^pi7&s!U>G!J0fL zrmf4>e~x87s|V@9v;Ija8oO}evBU|O=kA)MKcRgxgA1YD9doJm0&5huP*CzW9#LPG zmg38RZ0N?qg>*&7HT=^SxAmJ9|Mb29eAqlYpoRE$hE&mk6;K6^nnW9VHDziFeoJwO zdd3|cyS}E!>;396ntq`q5u9Z=9~JzY%Y{y2Bp{MQ$kMPSbk`m5rZAWHE!1{pERSZrhho4@b@zDcP)ONXv;iD+@fI*Ah!+uf0%Q{KmLjW_ZkrZt?Dl!f>xwXjQ zZ-sdqK3uXo63vAoHsR?5C%qV!;xc?XcoexwZp)ZGnJ^B{@3ZxUexq0Jb52raOD=5G zq*+eff>8-=wj^5Mfy+aMuQ{&2GfDT$N^=~1@gC14fTTox6?7v;}2@nyRP18-AmvcnhH0akn$F#5F~4X z`F7`pOyXzljR{}B8+yqWF=76*LRrYqSAJHdfQF0nKDazitBaS6L}ue~r5Q(N2MZn% z+-y(bUi7~H(D(l3IzQGnTkGG`fJ8?l)KD)R}c5z7Uvpg><_2I0+blt)!AH5`R z0+tV=H^ca28E_k8s#+1{z|U?qvQEXT=uDP1M#VLaRx8Ul12uEUf{%+k+4 zU1^n_K}Ntg7S@haLffVKT}W3dT~D1WJ*{?{I)i#sOgex!cOGagh%>bpahq6)-J?3h zIUdel`eYZ2rJQbAFpW;`xJ@i>8)cZ~DnBlOe=#6DGhm1fwjGo|8o-W=UsO{zF*x{3 z-@eO^ZQGogWRnxAhVd%S9aTxoF4!Y9g30<{x2G=*xUtar+4Q?vSto%x0d~)u@)qb2 zcIr97yR{>#U?Sl!kPowTi1)IYfpS%RdPF{t=$REX{T?m<6B=!c5R?%K86r&JxWR`P zu_pV#1%wh0Da^(uq6~#g&3>#IGgRO)u{m@bS*RKUs*vs5_UtL-m(Wc%0oPO~J)XPF z8bf1Yv~$@|bxEg4soB0u7Z!rv1p7uhMLkZuT06(v1Mq`MmmUMsaPQxqBY%HeA}U{y zB%9daefyNB>jb|o?*Jvv!9ly9%^C5{wq5&t&GEJ)^dG2qYotSuK$vj5hR9@>>(HEa z4Orv}r#N(kr^qB-Hj2e4;1=_7={e!23k^t^vs}TLYkwW`JK^oCK6)PUbm78R3x~h9?zegGd5H=v>w)a~m8(Rmhc+_8}ffFb0 z`L+?}B3J`oO;t_>w_b*PtRVRu^kXj!q{D|hUAcNysZ}fdxv*-IjZqZEN!o224TK6P zvl153(sh)AFxk<*3WWeNp-dHJD-$a!cN93v=p0a3JlO&0op99It(fxHpGSiZaT{6mJQ zz-Hx2Jt3WTWb}Pcu}VheGHoMH*T5K zv2^PsOQ@6+S*a&R07!FGG>d8D;1RK8C4>%$xOa+L!a<+QwPo5V>GY_3Wr-4h0_7o! zeee=DUvB#8PxpZ&NYkL-ULN0%$A(r1iT^HqP`_3kCXCuF&xZOI1~e>pzBZx95Dc2e zgeSh+&rc*hu(Bzxgz9}hlGSRy$VX*6A+bnYGPvUqqBe*_I*sRH+<7QEj6RNE#T*@Q z_%)f{6yZSW9RTqzM$s%f)=^PW>0LR9;X0YY@A?Cdhpf{SLNQz$ zW9|%Wik(M`_Zolg#Q1J8)d*jsZTIezEG+K!{j#e2s0lo9PJ&1d=A3K$Pa62_qm@ zU>?S_Xw{c4ooZwArh@__eR>f#k{Duk)J!Szg@}FSN>SfCl{%9KKMvV& z4wKSOBi0RsBQHe-PKQ2{To7_}8m&=9Ww^64p5jN02WJo*;l3~&j;EGCaxa{MWL8lX1Wadlh^ z%vK4+XaF`v*B75h0+&YW9KT#=!sPRV&(G>F9$Z4Yh58}!oqlYs#guDw(OzGrO8DoW zG-&x$D1r+!R}cX)^*M=NdPUepIJ+p&bEztI#Rp>{697?;$Pz1x0=Aj>VLeMEtfwlH zK?4t1>iYf668Jtb)PmUQd)VyeXIEbInk%F0eC%h|I# z54cjj<#0Z@<2BPubI#7y+GdtlhW|Q?T9?4PIqvm_2&!Wd_ky-qZ{WISlYVZ@+^|C< ztY>G1q!yfgSV;oL?(*Ty#iZG~@%@UqpdttciLlLiiPtB#LW5XhgZIIM#J*iScg}3m zW&|s_lkZreu)x)vw_w98@C`e|KQGPI>7|{^RS*#`1ZQ6BQB+C zn9KAhQ`1i~9gyr%R1NiWPeepSi);LgHQ<4tWDgQaXISt~7vh1Yfk8)tJEIpS+oXja z%j!F))BErlg_0naOS#KVRQz-Ruz)9J6t6;1`pzzhq#y5MMJ5B6CuZaI*y%dC|5aye zSN%0oGmK=JYya0}0|jQT5xIVOu=-jljy#Hu$}<`OQ4h8<9EWV31TLIn9rYq0^Vx z3K{_)?>j8arq@>`JWuD<-eu{89A5EYV^&}aXf$a*TNuyS^kZXs|2sq|53te!BV%~k z5~E;&$gohp0T+B|k#iFXVsg=mD%9n>OCICW%N%s~{ZE_;(VFntfP|TwZKr0=flMNt zd%7gy_p<*I#{#3^5~J=^TwK9*ENc74wz)(Wm%J^ARgH{{JU(Utl^;MdA_jjNB zN>7h1TOFzaWF;&LkvDDe>x`b>xE~*zqW$*C`4dm}U8S*;$^GhU-}^`tNYqhY!Y#%J zf9HiR?D|`23dVE*L8af%keHa5#0BUM3YWW0gL!oQq40&EanS0+Qf}r@Ij(JL>SQH=NVQ zGsUsHxlKt7TD8L0ZGjSgo--{3z#bdk4~n@kYtp@1DOq`+D-A;4)_Oc&^H@p<4gq~m z@%*pL7}W|t6@a$7*l&OckI-3@61;v?#7L7yVR7#2*Ez(cO*b0VfEGzm795^YC%P?& zZ9@E-b9v=15*_#86;*W^O{J`# z=v0SlHXz;H*;XBCD5mVY+D-P>t&A#g6jv(lFEigB4p*9UCi9_H0I;F2SM~Q}BE$k? z@(N;uy^LiT90~stunN-OcI!>1RCLQoJ>~VYJF2ME@bL3dt@l{}wwEj}NT2^tz>9s@ zPWSD^|J{Kj(23th>Y;H|=6^Uo-cJZd5Fb?PG!A6S1}B(+@(bwSeg-|(>-2YVR5-sD zG92jFu1}e*iKucDDNpk_STUYwKyJ7WSICYOaFljqpooeO5%hMq!rM`AqNeLS{~eY5 zx$angh1_pUnY6)U8@`cx#c3wzNl!=Ihg{D(cMQ06%xkYkMg1LxJL4U@c&;&=`KY0+ z`0#sRiH`$erN=Z8=4UyZuXq5k7#bW;SrzK zu1UO0j9kLQt%%4?nzyzC(+WByrtA)Aig^|%si=5m z9eMU!^jRpq=fKNXuNL;P3N=GU{DgrmkqLlj=aOoAB;FfluBC2|o__iCX)!tkXq`wi zoYUiG#ukWdMuepFv@yx`If=8doNymD`}GqOOEWX)qn{^?AMYX?4$0)y3`SUQQVD@+ z<`yN>+5Kedy~RAGm|yXHO=T>f`GRR1APnmcHgs;dzGH0U^?Ua$^|P-D zZr59(V%8qa^#)V5LND$ABi9g6Mb4EBXK@@vmb3UqDp@wBe}**T%!2{POr8eu?Oli& zRHWmND1x^Wd*GMgJq5XlgZjR2tAY7>d7+Kf=m!Kmh1q|e0jU5g{rg7&D+L7yyWm<$ z=VY?WmvkU(D@^8Yu$}H61=V=FY z_Zx+Uh0Cpr&ie=yeeuQ+T3%VN-gWhrG2BDm0b?rMCd7xrKA!nf%bLMqP<3TWD3~b* zN8AvUaC-_IMNP};1fCv`7EI0%Z%#yb7*$$dP{;Xe47C$&EM4I42xjViw6$B%y`$(C z7b8Lz=so;Gt7+5nG?#bs?i*HhwSNOy5~1Psf7iAuM3j3Fvu#vsWRueO$4e8k{+GTD|^ z)LAFy%^f|PQ`05GUN8U>8ooryk~KJh&7$X_-TVh~Ytv)koQ#xff<~v7%purw!!bgJ zi}8ksQG%+;UFUU^oz~0f`A93uFwF_J;HG>$c~7v0ZqxkSgNwoEQTDE5*|>|&7uS(O z-X~1R3QX|gMNA9D=7ux6f8&RB3to6PY$P|*7`G4c2WGSv)f{>;!7&KA$lb>>PsKSy zvJ#v%m*hm62GL~5Bn4vKuwa$5r%pvOePuuewnC06o;}p-n=^{siVhmiihej_fpite z_zH#lxAD?QrYR}S*-BlW69k?aaZdjSo8;8-)Ki9rGtcChu z_|;U-sO&9ufA??~E$Y6I5K9m=KA40YGD0qi*rkn&*>{($|IY;obsXLu&10@=MK%ZU z8>p^$BBECYD>4u>+LM}E^TLi51Yv*Fuiw3j&*wDe=^~P0@ux9Tu^JkTTK+;~f2EZH zYa%tw^G?2+KfH~1`*XVI^WA%UM*hCi$XQo4*>g>=RvA`x8_J(``%#1@2+Qqv-R{@sf7D`?(iA1I{yU4}JWY&4p6>23eGOUM&ys zT@4~*^>o``%=>)w;-B_^cVxJp!+^B57Q7}wvvbYzo*Nj=8y{N`?h;w03%HG-t~ffx zi9MfXTeip>5p!Y!+U_$i2)VLE^Ic`-AUIV#&X!DCF++_7em$6q{zSt0<*s4|m7V!B~b4lony zvFY0)yp`8KJ1`W1t8IS3-^(59SNhZX0>#O6j153cEn%+>qNk%aHOX>z7}2W^gxjTX zRYDC_ome$U`4tx@?)b$$Tp_+R&H?(I@BM2Hk=ZIKh7qwdkP47+{eww~I1iY3oEh$-_&CenExxXcbNSCGgrg)O-~*2AP0rNq?Dog-agh@$ojxUR z_}8T9={n|Ercg4B_?$D2CYLLgHm;3vY0%Z!DcYR|E);r&AXINa*_MLsaxkZT?lzq4 zhbsY6&>iLB8(MRW&ntOco@Tcx0kgZ49rBK9RTzWqJ3o+RcXhlW++oHuYuh%jM$soM(xIWYMvE zu@Ql|u;h3BcYJvxfL0-}K!A(}A%yvjFZ&bZ5we>Rgi4g*OyG=y6J0v#J1AFA$TrF_ zPU9hPfSCvU(T+jjz=0#0Gz8D^CfR47fIlC}ankz&l`<#NqOYkEiC7Ie3oQl`lFl{DL1aKIe;Vx0r26TPA<+ zERqy@DxK+zM@1@_*bC=`Ps)Ek<3VZQXZ`<$F@nHdm3sf(>c1gCs zg5wi2oVF;ts95*1!{@?ygNBY>e1wrO(Yl+eJFv)D<_1fz+X)wMAt_Fv!*Xdms=096#ibqBw+EogD2 z)6K}p=TXFLe;0#Powie5NRD8Oy>r}#Q9qSIJrf7E^DH2JLVEVPPra$HWCbe_Lrs5F_yg#9`}XvzZUo6|5spt*-Z8-AlKB`K?fi6% zqfXFKyfi0k#>{!XhYqPi6)ENi+_-gX>ysx>TDIOa!^XxHVhH-9TjU^&=H4wYSC^R1 z&tL$&Q_U)WlqEMCE)3H*w$3pK7rBKTG@Jo#N5p}25~!CUuDb%mHzqV^Yx>_0=&Gj{ z#{eIR$@=8U+1BCe!2R_M-*BHBt|^S1fh(U36o>*y8VOG%knM=->rJdm_FKg*f7v1P z2=|#P81N=}eCokB7~Q+%`qZ~P(j?re7HUug++}7TK!i8$-Sgvu|DS1ow&Ba=0c&=r zD4yxot!&47As?E##Iw|FkVp!`!>grw6Y4`Rsh3VuvAW@tRTgi!RL( z27)Z8$4&~$!)_+T;*d;JnTCte((ZGIx@#&<40)8=&`&ols^IbCx}fVBN%PBHA1+Fm z)gSy&)#2}v`X`CSW@c*4W2l9v&YSno`e?%+jViwUa0{@EoPv4FzayN#3+{%P=xQ`2R($e90pqtoDGm0!w@zq-LLAp~z_q7C|DGP}px zH&sjD*=F6lS9#@bOz1A8b$~j}9$ZO^ri4NS*v9y?^2Q&ZsXHu#E<-C-=elwku{%mD zUr(+*zBc+TkLH|IVh^|GGZ-pAH=Bn?G z9d1;V^h%)y>LFjRB~GD85?YUT@ZI;JM{7Wn)5xg{?H zl|VEo{2oT5>I|w>W3IuA1PPJS4RpdNxVJG{(4hR^n-~os8yz8O3TS~*BdEv#&vy6H zoM)W6;+A>$uIm@&qJ!!;7J+VB#b}+pw*s;$Te!P3CxP&q38m#bmtET4ne)~Zcm|vQ zjA4G~{yjPl8`X^w8ksX}H+DA*{9LE`QCHPGCLcecR}a@=A#hN)+y2j!r_G!>0c9o; zpA;DY#`cMZzex_6c<>|DgBlgnK~e=J=4AV||BL@3r3dna!QuZVcZj*68)cVSakp;F z5~CwXTV%&rLIS&eeZdWdb`ALCmHufbJXP+5?Za=`qJmFlGU$M;R0V?=^ z{1uV$!7!~%yWcxQ-|}ysw!5t(U{Rr}+cnLxDzPnZdMj^7+vlAwh1)!1#e_G8A1=XV z14=GBUX=54-lR$X-)xxz#WT;4K8wy1L?`9F+unY=PV5Nl=SegyFW-^2*rmcy!#q%< z!qqu-Mw&|c`C}`OD)ku}cJd8#TG^4z=w3*|3xO$^k2hjG4OB$|pL$O#uj+PpJp*Rm zb5|WS^JatlV&d6|+WUj)7(cz*+9nSp)m&{)?4O*xjs2Ob0S@b79}vE-Sc$MiXF7Vx zD7D!W>gtn<=l2?{JNe_pMx$n?bSPV@o9;Wp(n|F((=NgAAm0J2?t*3VwtSI(7Y4n? zOR8VHdVl=OxA@}HQO|u(%$zcA+}62G9e&pzfjsE?AlHP+Z1#xSzh%C)_JwDRZQPKp zD9Wu#U8D!v&E|CJ%2x|PE8Z68CLL<|kI@Dr!}Th66?SSQjavJpa9>nE|DX4t#Vz!{ zR&%FI+B7#_lyr4)ajRc8{FZ8Hr9oF(v z&({Bxb@%Sg#pi_u&GBod?-ZI?yWJMAMilATfL2E|)HjbUu)w8XN|>6jU;7vsJSrG> zWid#^(4W!KJ9acDnI4~gR%4zMgpT8Jx!kP#s5C&87ZDqgjTW5RbI4sMBYo>|r_rzw zWiX1{+^}KK3U0Y{eV)AL1f^#^151XInF?luozGay=64h-qEiQX7s2PJ`0w7`>e{Rg zUt$qhIv@C!AgkwT@xS?fRQ^BfA3U659jJSV&X2tx4_LVlHbMh;r(m4xaE>P9jzd-* zidG#k`LPuojHS1t9XW$9ABcdA9U2c54X?-hw~vlogh%mb%Q_bxF9^#4S2ccvsV*n) zB|5v$Jjmlir0$V&^{K(;NqyP_bW>P7Jgay2Wa@y7Q{r!|72(xb|7+@Zenk>D+^R5i z{;(O7Cb2`Wt?ugie?M^hJJ_P^QFi~CIh9|oP{&e?hF|U(;O<0@{ zxqJ721{-AG>^^viW*sZR-a==?oJ2?J8fN7ky**0&ht6+%WH&UJ7~tm-4fVC?4?2k% zeEQy=11zk}${*$Ay!zZN;pxglzpgnZ6qXf@akSyPdf`MYX%(X(ndtgSE>AtSNvFXM z-UD-lt+oTU8nXk_YMQ1Wo3c@_9W73#y!k+ zyV97Hy^9P}Wm^cKr5HaD7T+-Y7GHjtVh2&JDln1c)_?FogL+GE{E(pqr@@kQW1!COLT+y~Ml` zz3Vg{FF&XLv7fhCBSc3xgSp388WP3YFZ&eAr`g)aKlN4LuTkNJ#53W2u$Fn1S+mi) zfvCmL+AO&=ha#IbVTtR_0yV;X)kDk=9@+nZVTf=;I1IkvBC$K%ZgAwNy`bs8I63KP z+;koo!j0X{GP2Gu!bj4d!3Ebj{L%iSGXR9zjHp&1NkafW%Gw+(U}JZbJ)+U(WXG)1 z{b&)OhE_cao+}e5)xBncQTfnuk82%!?gU3OCF>W20qR`ZB)wVM<}(%6nq4Q}_!c#~ zVulSnm<{2PtVA5W`@W;O>k>VM-eGb527Sv7`g>FT5R6(u;m_Eth`$<*6;w?AkjfPn zfpYEWk+P;$efW5Dp4CSEf{V73+?uY|H2<-p+hcs>)7WNnBKK`^+aZkK#Qp<(CR4&) z-;gX*E|1#eN9K9H`)1x7k8?orog?aQ)>a+=D-n!%BYbP0ZGdo+@^ z*qSVON?-4j{&y7&Z2E0pm3iO;sMX=%UJ0jO$MFUlXEB&qy4=d#bsQO#Ck(tTyV5lW zXjY8K41OTLtoMPUl?L}NGzu(D@88kSa_BmM1-8>Emb%O^cb&=B(O`>$Gmrm05fuOi zP}j^nxv~CLs}skMgL8SjcIaYc@lF94?~Z(zK^ewTmoGB~dS#%MAA9<==-U*;i{tX; zM``NhxokM9h;le7Q+JsLM!5;UmcFv=;l(r5;ZD}KtOKJ)iT-5PEbYc>=bqSIoYnt$ z>N?9Ria5tcyh(P zXh64Ss;7Oam#p{J--uL~D z_E{cVetlfCQ5u=XPd|A489D|-L_73(t-~-QrIsyOv@zsoCk^vq!y#FEd5tg#X~je8 z@AnroUEq3<#NO5IR8%xSwhb)Z&cUQu>HYS#u8#!)m!X}Z=O+!dp(YxcVMZ2@JlC&p z*Qpa}u>OY2OSpY(K%e)u&jCJFLLnrV%}+K2Xia4GWXQZK~8C(t$`Xzti136X}I&wDPYeFsw0@Dtkd_0S`Nh#A6UOHc`!>V zi>I0geqJWqPst9e0taYRSoDfJYX$*x+J^>mFXaIpfsq|k5hFdi6 z3YgvgIij4B@kl4*N8MvP0u0Abol-QCjQAa?si}9KdBhwDoAhxmCvx#dZqo)q&2l=K ztvR%i<$~-EH41Z@8*lGlxMy-;lqn!v+T!zx1@+?s&nfCDxGGUS?p(5r2`dr9-06-} zLVixpW+E@R{;d87?R%nr+IOT&VCfr<1h8q=GsW&KeA@x&$_qRCWsRnJ@<7a2IKR9} zP?6hqdP!M*O!9}A@o29^m<5KoW&{oq$}=+;n^+<%cR*yMuBAI;cl0sOYY-KjI0IWh z-AJ&x+15NScwE)(d5tG&4Wwr{)JT~?009?lI-_ioW%szbQ>MHMRNJFrUQR4ai@%Z- zUcr;&sKX&RTJ}Z5JQ;_^E~ImVM*B#nP5j3k1t{vQu%F`@{}emF6z#|lR{YE2BpVqy zrsy&JjXy7{)S1bo?2B+9IOr<_YH^8UcW9c=R3r&1b~~_@C?!0Hg!^yzMR_N~UE|*# zpZV8JMT}L0*ZmUu8ANHG8fPEFdcne(gLBTQpnXFG+`-f$M+zW=4)Y&3a$y!Bx7z#`NQ>Z3-z?5j}x7w78I9Dml( zXlYG2cs)>K=*a@dc?UndeX>x<1bivo&hnt`6ABqDIVE*|tGz4ICYG@kpyJ*CeOBi4 zOp*+7Eadsqe9kl0z)(Q}40L}zk^@m&$*Ng2#m+Tv`N*;K<|3K`blvs4Cr_D-3f1ym zaW2PljMNBA2DkrhxZMLhWoB!0B0ox~r8K3C=aTdliW3(Y8cZ_4Vtj9qB}c!gAKxqF z!w^J@00E;*j+-_!*UU6#oqWRZNcJWC@$ivAJf62Cr~Ra-W@Z+}Cz?QVJ>4d?bJe?E zN>uc+>j0v0m&l*rzEv|NzQAJ3B&Yovst7_$sK4xJ7peA+^HUuh6kahy{PUIW_G+T0 znh6CCtUu;uAuq?zRNXwUg3)R}7OmcD;=998`bCBnLYQgE# zr|;abP5s_!BPzdK#pllrW@?%{KFrA(y=KiN>jMkdzScf@g3@GGf3jkx-mJh%ZXT-R9)S|5bn1K>0{PP?H3c-5}#Kho4t zxpLqUKIwYHrThnn(Cx8b!+g@Jm)F9;g(0VzDBM=by2+mOJE4#lig^Y>EtSk&2gBn5 z7TkG#M@i5!H;3dSP|cq^xy=aFpgTmMHtVy3OU$%c0oF?>83A}bSa5tM<_W(u1=SHO zmaV{2ty;ArP$g`5)P|W8Ga+yzIY@j1QhmJFcUO4K#-67q1|FS?G*cFWr`CV+Yq9Cc z2M@k|QcZeSz<=Eyks9-iIOy$YD`?M_BovDOxQu6CroJq=6{xW*ePR{xS7ZOKjj2?q z3@7%nj^CTcoSpytYVW6El+P=^x|jvJ+Y>6l%Fp*=iTl%)aoxFfG$nikj54O+!n88( zAM?DVrz;J>jc&u3*a@n5A~#VZvUuY9&u<&)zsMl*2^|jiprEBIG%_dA=!>%h;>f1L zA^UbIMaF={7@4+0pcG*zG-&esh??8&uY9`OkE4*d{&3*ugqd)j+4m-$mT;VO5*KiqElVGIJ99E{uO_d+>bc z_U+X-oy~Q?KX<=ndM{2WEN{Zeo4`$DC~@&eteSkmBwQmY0$`N01eXZF7)!+xgU&?( z?N{)^DA7cL1j~`Rrf!cT8s_LG1hC}bQXkXUx~06@af`WyPr6YqFmFX+LY$e}1_q{{ zNS*Dh-OZEtppM4LWh7k;4vk~)4`!b9Hb15f!cqQT_a2s5gf1!*;ruIoA=d zeY%sRku-}6jTT+jPg?o=;-56nU=c~MX_ui|pu_xIq}oKg{^y^%V5cXZt1x|RjrGlc zWT35k!z}zJVxj5NZ$r*3@@NuI>m&q9UfX}(4V&R{i?YtI!y8RVjS|yZH~odx78k>RqHop2`H`pbu4%>lv;=z7Vc1bh32KC4`wH@adr% zKo?mO|I`f9H*k8^u=h_mRy}$Q4)>m1eGfkfhCa>IbaYP7{;3#d$uVlu?CI&uFowbY^V8erTQiS_j4FoQJU*eFaJAqB%Nid@ ziR<|5M+{whQxwVTu6(`G($AtT0$_G4tTH zz^K&GJfZzvof60NH=u3;)znf~ANT0vK@C;d!>@Ty#kixj{WY@NQW4LTgDhJ8=5QWV!ECUx+Ttq&fif}Dy(gn7r4_+@(y zXLRY%q12}9VTAki?9hF;KV6B*iBMZ)@WwE5p799t9}}n+gjFXZDU2f+?#bkiSmf~~ z=fT~VFC&=tV$Nd$Dk@Kc5{vKSLys>Gl<-N`aj=AqBx*1!-4oH#reC`UM%BU;LixZB z&4~Z=Ly)5*XBi!C&aA)sG0g&imu)$at=|++wag2){DPKdRMopN_1$4Gicu`5l0`yo z{hLECwnF0Z=M!g;Q;Go?aBuDjpIZSSli&0PwHvIjq?Ie7bHTe5X7AKyv5Xo79g6z6 zS;L$Gzeves11mE}ZbLOB-ytiM`s3v%`uKEC1Mfw~6X=T!D(RA3?U@r`-8tau=XQ+i zd>`JXxRx%%#~URwKK#5)7S!t8M2ZEUl}xtTxKgW3*Wd| zmyhP>Y~9QQhwFu8k#o;;w`IxK$nT}?ncGZ~DG6j8-apOr6dM~;I0SH|1_HlawH`o2 zq8my8>&-1-q#}Qj@I;$Kkqqy~eA1*fh0T@)eqKv2HybbW)mLho5$hPjBY1##`1({# z_;Cb0y2b{l(WQ`g*_eH^uyAfrb|up_(-XN%O9G?3Pt)KFCko~_K!7TNSQrEh0j+~h zIO_gS;45x(K%(LhF{iK zW8DSgJM`0Oyk+xWOBdV>-1t)K$VB^>RUg}Isx#=Nq@iqAGqPu!p6~95ZTL8`%D67H z?$i1jpt)ja!~eaGX$uxiMg_u2x!}Hi&;2$gYRa-aL7XoS9_)BDBt#sX$$*JDF^^UW ze~R^V1V2C%uIDZ;Ar{c7cv?CdtR z@EY0EAVfABu}v^rZX6+7JPgHhL-6P=Y9K-)#J_YYSZqpCs*;5*4bs}jww;o7=OcdI zebpRq-U%H{|GAKv`Fot(2&j#H6zHewtJbD20iHfQF}mf(-FkY5jJK%$hgqxrgHWL( zQ+tn5W~aOSz5hAZ-)Xt=sA0F(B4iS#E#B8X_U;hrAzGAgV=`aYozGsS`N6P<{4nrtu+Z9c~fAP^-{Y{3Y;RDkP0!GZ7_+p zy1#Lt`xGDX>-}-d&~T+O$_ypML006cLUN+uCKJLax_I%T*{7R6qZJ~ucjQ+D&F=~E zi_|AoKSVA@0^E{#rSasgZml!MR}7~Yuvomf*mJ)E3-*}Qw)Qv8Kk;&svLZx>EwHl6!!%?GgxKQ3!@h-JMlQYK`a#K zjk4a3osY~nwMwn)%~>m(nfgNo`S8v1TACr&SS`cilJDc1(S5CL2cMapkK9v<$j%TO zGuUUO%W1wRo;#H@>=&kSV9z_g=$i)N3`5cumMsqe;rn2SWBf{&$jOsU-%J3+DTmWm zvP&ymZRE%v=#`0x5@OhrlDu%*AO!d$)Xl?nZ zh9fMvWU0AXnJaT zJE~`@2H43hwxCw*P9OTm@S@B$%x&T0k98#;DH|#Zzx1H64YOKnvnwpWSBu7f5^7El zt!7-HVPWUyx;-1MHky_;A+Z0Z)ClGR5mT?KDYszZ805gJuiv9%V(RX0EUx>>FMscR z_S>&bB-s{; zeNe!gquEld*81?c4kV`;*Sl?ENuo_?92>TVuw<8Plf^ga(4$*!nRoJEG8l zL^1@^4OZ%Hrk;6S_mfPr|B80t{_l;dfBq86BCO`U@=1e&fG}>C*S_{hfgYLow%_1e zSiGPX;oKpd5C7w?(H#ukN(q@!Yc-*|>c*!GW>-dQsLMuXV*QK~sZQ*q*J_{Q+Gh%rD zOW<9LhS21Q2j_w>XRQ1ge)yF`NU3wmbKW~OpjAxmp66!ZQOhvDq90)zk9)G%g8#3? zr7Bm&BgXWNtI5IZ!`gs9Rr@Wd-y%DVx$Qhsrv%jT_qMhfc?YK+&)fk=?d)_lWrx$2 zrY$k_YtQL~*rYgyGMJxzQ*q#>epgBc_{NhzUCk}e~hZujp#v=AO76x<7550pJVl-ubR*h7IF&3JS=iU-z`=v2TRi1qC~sU%eIZOVxyRRb8GANK#?QqM6nMb9-TC2 zH^~sOZQ1KxuMR2UT274D9O?^zs}iZ_&Yf!=lC>Sd0qi=?{0NEV+QXy|0oh#K-FQ@!5Gu&RTACq^3|A8PNtY z5)GRtwjwNZX7ib4qutP=H`VwpsJ_{90EQE5eX=i?le0xxEv~dowHeqWKW#FQCnxQL z$hzI#FKW!g$~eC*;WEGC_6Lu6Xn_C(>5R604$S#|JYp85<7LgQ38r0UL-A5;~-Yn~uvuw5i)cCkZln{QfMv1|6xmmd$!vC6U^++%NZ zP+}e~<(Bl@V&})C+I&eo-+OcFuMew55sD*yb)cE9QJ9s0QoN_-PEP6NwTsTrS_kHm zM3^?Suy9n}Ng-CzgQJ2w3C5Pn@jDfnCTp zcGiQ+&NzssM5*PDj*Sl+w&JS%|T z<>2Uev!o`pcF^r@&(cu8kBHSs%yoGGby!cU7t1)3LVExgl{HKFN$^Mz2)}YRjQZlu zVQ;--D^w*=VapXOVjo`0wF$pV?Nax%X59#wsTGGQs{xo~#{m5TcqDm;Iu#QMa8v4jo;=+>CO;E#nb-$ZkLuj~{1zxD z!7qPRt(8^~0+prJSRLgS)zku_QU&ut!ZTJ`QFcOZZq!6j4A3Cz()ocO`!=TRkJP4|{ zUW;vjJtP<xsA(?cn|2d$m0|N4C^MaQP0^Q(Th?+>Tm!AXv*EKwBlkgPw(5>go|CY<^4(=xBx1U=>+{|nzwUye zdi3bgsMHW*!OlsK-9=hHrH3sv~u2uHnQNc19&1cs1I&X!&)tBWZs4AxwRU)Z{3 z)3Y{(x=jYy6!~d)*sa^|s?~(KwWs~Qw`(8k{@_c(OzjTBLi}-dy~Q%`nEX|1jVR%O zcQDg|-`HQXjrXSm5%izVk&{1$R)6;b5e&!T=K@KCX|7AkbNwMhIH?o)jH0VYHE+A7 zV1`Uwut$Ng(QNDMi*LMpU)|_`x8?97wd0qS6rGAovemWKRb|vlx&j!M{ur7Yc|g3h zUqziy%qY2GrzbnF#CjJx>404(r_@?79}mNI>Z2E_EpOus5=3@+2~?eO>D35T|KkTe zzo9+d^i2l$fl8xW>*iGI@^m2Ek7QFF{UP}UZs&#Pzlv+WOS_B-(-O`X0*vUwrri#; zWA5Sot8xJrK7Q%xraV&0^t>*#0hX@n<+5Vi-Tm|O@=L3lOke!kiXl;qlK+GB5tJ@C zT_k_0qZ8qYN49+HP9cR2L&|d%BHP=Sson{XdopO?Vb;D|y7uzV)ytO~t%{s6xqAIo z!)^h(!Oi)wz{K5O%+v{Hmc8WstfDx#OSre`_Ff_@(7l zB;oi%Og;Itw{i=!6=pkb`DEJl#xMg>GAlbx@UXT0SHo?L!`xS%mus(6ACb1f3=9Wc zbF+#$z#>6Wr?a`+lmM4fW1!sPRo&02r>2Jm+~NXJG1D1R^o#YaXcSbMzmp!EAiFxeY(<~u*GeGhO~Uus7Y+lG>S%m5YF6yGMc4bDH?X?lKnDD7Lk4gKgNKhBd>$@S0~saFuh%h zKXO$xDe@I~Fg&lxg_(c}%uuh|cxtz3%(8Tt&+$LJCTEYISn9Dhv|YkS{|(drPPTpb z_-IDSe!K4LcORbh!Ab3Yd2QI&IWSYg0xXY@n6YfmH7a1kFe~#uaVXlUiA7y*-Z<_b zeze$8(e6VR9|u{CkCyUp#N>HX*%^SS_bxCq)7Nbe2Vrk+fk8XHzE~Uqp(6a$oe|&l z?`C~xJ?UC^ZPp0qBc}3BNzPLJXFm9`PZmv*}`MDHU-V(U0qyRo6DdQN z$0jRi`87QAc)tRZhAFdS@)2jAG&xAE&Ds)+Gh6~-CAdTcFEor$;5bF+5{v&rP^z_d z$=%SQw~MDC^1oLWSS1dT&z)j$u%^C+SbEWBC~vK+!I?t07o*j#lXPaYTuBK00#%@f z?&P07e_jLk{5MWr0+;PEEt$Q>=7-lvS~RLj;mOhW)5$Ss(CFLOJg^R`Oc?6qO`S>= z?~ET!?b2iK1idwv=bY`{cqCb3?hK}*ttMuo z2%yM*q&rL9CW8c%IaJZ=|M7Gta5=VH+rK45Xh3F?c~&w-6qysskdO#vN+=D6WU7Q@ zN(hxCQ$i>rLQ*7>hoq7usZ>%(zW;ij{eJtmzxUhw+0=bs*LkktIF5C!e*1=3sBAsp zahJU;)>F0|pK`@w<9F|*^Ccs9Q7|HfEc)@|UwUk(L$b9~LA7BM^?9b=<9zK7G{&Z4 zf4h_jAD?IH&Dw<@sK1g)obFHm(K`R?t=Z18@9fsC8_4gbVmfXX?sT!p$$-$pE5Hs_ z3^{lWL`&jb{R2r|vPK2y5%Cz)UI$+y%>xh&D2e&L@ik8^%*}ze$Yhx6^zGU!_0>O? zrqwvHFVLF56Lm;vn(M@@m!Qx@@D6)|0(8K?V`F2lo)|^eC67Ta9v`}9tH?*3+N{)2 zHZIq|N*}#>5CohfbG+pe0wcCHg;8R0nVhaQ3@^G^HzQ)vKiIT>UPGn{LZ)OXG1-cMq^eNJ#Oay%-2 zUQeCLr_4xn$c!jmf9uwFJ@ta4L6{D`HJfs(yUNz*xowJ;x8HE4#AW&;b9H5;_-tf- zQQGQX_okcrE_;1^{LejjSjHSNk6;hDGkXk;)gg2Fov7v576iofU#H&<4+Zoy$Rol= z*KHm6-pJIECSp?6t*1*v!@}wXB#&jS*KoBAK3U-=zr->0l6&^-ff93I3fy}0&n486 zvCdyPDKaVsx-uF;83)SzwUaC-^!ARo*Z(o8rVE@9lK|V`n6Q=23LX==s^#R_-fNvh zoU-6#1>3}RPgdWyY$;-Vz7U_4g0)|=nOW=BfhC=~8}%D)Hs4-lt9H?YCy#3;Xk=E( zN*oL~V4)7*-o7~2>*nX;e&OdYG^JwFpT05nkIN71)rRg%+i>jZ`bS$9*_H2D zq-3JM{A@?; z)+&=X+pZQmj>t09em36V_l5<#*0o5RnqwZ=RCOy0;NYD;UOC`8^i{ycV%Jx5t`s}9 zUmC6nYyYh7=*CA0f<5s#WidBIDE#A1sxESZf8DNGr@QCv&Mqx2yZN!=XY8MLEzh4$ z-Tu#5s= zoZNAsY66rSa1U_0Y(2wrWc-{tZ|3Z2fY#4kd*Fx>x08zu>GtNwThwgIeAeQ@-ShS% zzgD`Zx_U5-0(=oWsQ&p^U(8gM#)fTY9%NZZ>UW&edQQCXx+t@&(SwjW)!Er&YgRLq z@aOP{yJJUdwg(pcOrxm2brDM0qK&ooiuO0H{fE#?R(jTIH1YR~9DJr&Abt(vKQ|a0oTrg;T=z zR#|QZKu`X$Gi<5REJJ*!T<-pE|DQ2k2T+!*8`hBlz&|-3UBg}$@=E7F+3PztfX9gD zktB;b1fE4|#FDP#s27MGS+(;CvHjFODto7N9q-bzXZWuT-pyXaqlr*OY;%cMe!W^f z(6T_8ghz18M|z`rY`(kT#i#3NONOs+%;4lbn|-mGA)%p}&bGYliAOKq5-_(*YXjoJUv)4tZm zfE9e5dQBhL%yaQrt$SGkNuY9kUUTpLO{h5rA4~mIRJVKG2DAw;ls?XgeKC9Lq)A`C z#q#-LufHuhKQJMaVO;q{t8m}puq~^4bG`n}MJsOgn1h<+XXpy&s-GL7-WhiA0@|k| zp&p{XedgL9_pzqsgFjThd=>W(Sck2xtyjIsR;DA`+nqCK;iyBwl=TJ=>U|4TFTM40 zO;58Osg=h!=-u(%-!|)BUKz@cXFskPbVVS}A#R#ygjR%}FKBPl2g?tY?p-6>=>`ME zvz{GzOBQ%DrqUXhQBbH*7{P!|UJ<6Hw70%*R-U1SLtd!pURmMm>x;k3zDuK`Ce1bZ zS`A3};+;|BbH44reAvL!#@J_Q$nh+fQl2?G(9K(hRT>3tKa{;)U$i3nZNEhOsDWb} z-^9B}N_{Xn?gMxoB^ky7ofw{?9CvW84-7;{cI%L-db7Lq$(q)YvnS1SjkBf@7bOsC zEubBls{>sWj|Or^LIH-~VZUe0n|$0LvT%8v`Sj_sbT%gc@Z8wA!J5jR=$2$Wk;4|| zcG$IcQ9whZyPN-Du9WZDpo8}C;d9+L<1SIv!}v201{<2;In)4G5yYJY-j;DK25i7g zLU6BOmPQb!z^i znIqN{;Jq%Xz*vFU%lcw2Te%t>JD3cwCv&FtdacJrUpKI`#>pV)qt}1Lp}8Z5*w+TG zZc){+Z$0y+a0 zPRckLVRH)VIazta?5e2h3neS>u6nw3s?5)pI}|p~{n(}J|7iizsz5(}?Y6cG*==TR z{eIbjwv)ojuW7Cvwe-9Drhv6WR+atSh^vds1e5hUk8B?`XinOXKZH<}o(8wy&(xk# z{nzk|*`W^2l|4EA{FU&A>VO4Bl`qoMyUcXFas9e5RrdC0PcOUlYWao{pOPLs?d*~H zdHpSLs{NYUAtQnla^rIyd929aP1J<}39FpS(oPhnUJ0Fw2O1c}&c8P^(@gblcJ{OG z=K4)a8kfCk%Rmkj`370zZvUkv;rzciKKbiu^~9yqcg-~Y;9V7QvltiP`|`S3_#Ihu zNiG256fk$BsSIv~fTY9lvulf&P}kwc-2EXf@=G6F+H>jC$W^Lgv3YeEu{eT?1|ZKW zeC+t}&eZkbc(MTk1BKXksmw3>M^Dz>J}8R%@mYQPI}>2gQ4?X;tM}6F{>JO{+0Wqk7qx7 zWdxbnWGe0#f&sPP)$>^c7$jtq-_L%T-nfmm%C_PYu00u2Tb44c*`l?<=as!J*qSs)9BRP`Nn#Bah|R0xBczf??IWx*Ys;|R=(Kq!7?A@ zyWw%vQA`wGdO2xWqpe2pp4|>K1Vbz|>^5nX*e@U?JVbt?(g#?f@Z@~xwD6}l0;la= zv)SX;V$-Rz01yC@EhNBgb#8t+cmAWBXUdW(AkYF8Q%~8UwlNyNpzZW=Q@$QAF1b1s z8)RrED%`0>>$+$y1{nGK0qSDJ`O@jrrfDaQbAHvLwTg0=iAGVGbHDd*jmJLj37z;` z4C>Wy+U}o=CcEuF)FzIq^`~g93&#y%EJzXS|70+lxj7moT71IebP!lJ$ei5tqqQj6 zul0{|9X+qJbL9q~pf$kSXbT_&P-!eo*r`irP58$QTtRv!)2Qm%9RQVRFC~ZCGx3sx zZ%HruO@+;>)6+p8XWCtBVuVq?V{+dc-zT#z zN!Oo%BO*N!cbZ+jFKIK+kFbqq<=v$nGvSKYp&zP4L&-LxSlNv@Xzj^Iia~`#rSOMI(t{ViVB3_aD0sZJgq5(EgIEhgOY!jPrMT-39+|hEV#9?dNs;|Y9uLsiFw1qw_Mnr5*AOg zN~VW=8<&CIH?<}DE_~9{>Y{uzrQh6G-wYXrHHGL;HBle zYHMv0!c&wl$4?*UpWS2j{*_sy$zPRJm6f>vvXqJWu(pF&GJsu|vrNRN0HtRF1tu3W z6zV7*cAN%rg`2o5vNu{wKKTd;EZFR(an?wkM#y;snHD4=>j&a}s^z5noB50K_~=e8 zX3oT8r>+8U0MlgN|;z{XF3n`B|WOOyM5tEJzEQdmCT)zwZ{9{b^HPhCM z+nHJr8WYnx+A7QVz0re3QQw}AQ4_@ZNy8@&c3qjtvN5&LAf8v}oekb*_G`B*$)N_r-1o0+;Yu@`y-rs??lQFm+d z`-_>6xE<1((5^)Eoo}}5@#Eu*S$8R%Sh2NglP1O2qGMJC1Xy~e&o`KB;%#-~LuWle znf*m`Sz1N)k+>}SY?i|i{JB4()X!($0i-lyZkElWQ`DEiiRO!_a*LHNl9mLyC_}^ zFc{Nl*0N=HH&>q*`wI&T`8r7Jx+Oirp;n9)kf)@e>GZ*FXjMSc8*LROS!(1zzC&(x zSswV)H&ks>`psEu_UQ_Mdd9=`+XBvME_f{`59+Hfo;dnvQ+^CSPXKx{)P83F1=z$RXV)Tm5zABcVO z;L?rWk+=6_awdBzptpD=^M9Sg;!ZkTyeh<~8H82-0ERu{&4##q+1)YVnKBi3=FCp< z6az(PvSApra*ldhEi^S>ToPtemjOxq%(~{QPj8b^T7{DLZPIyGtdyN!@MjmkG#wB} z{U^J*(#U&v%2@B?3je|upb=u*f_e4>#+wl$ImN7E+?jF4{Xb9Or-TC?#nHr$qv%-Y zCOY5Bg8H+VHR}--j5NZC`oo{b`?}x4@2x$0O>?hCTL(_(j3Tpr!ZwPxfwlFO>Tv(W z1qOXVcUJba0ECpaoAF6wO=$#4VL`@g5L-hW*>GWHWeY_ErOiYZ0wDuGH*H_s*u|Sy z3UwmdB?eKMc4tBZ1#M*F?`6HWb=TQD5Q5`Hmpi?cjYWUJ5M#x$?3$gl>zW!GYu?)O zh*9q})XsW2zxbAHqe5pR`;(w@PxtB_W!?wZ1=y{onkFGlt0I1nd{x>RcL2}24W5h( z(bFqvO+coX!6O0+%A};6E4&3fj;zUd5w9^xE(lFK*0ck(ATJ$cnc9DYWugT@gWO=> z?$oi%0%0}j?InfEGyq*QoVD|jmvlA}b#V-9xCIzZhQRLG(2yJhc81`A3CrVg?*DiN z1%#NR3Fk_M%(-QXWv)mlvx4t${#{obwish??(#g~@? zt3l-L@C^=&`7zcccvEkJD2o1`41`j5)|bVyi3zVp zp@1=%faHjPgyHjv&|O5dDOw2nRP)^$3}SvARysv{R=vM9|b?Vn1IOunAbP#q=(Ygk4U1CqN= zybk7*kh`zZGX#%AvYeWseHVXwH2Z`LucXEMfAsa+0GHNuSRI{pW;|u8#dz+5tW!Jv zI<;U)*Y!sQ>)_sA1?xbh-&A`_<5<0EEtW)Hiuu$=tKU3Xgq!-Moe0p0tKJE@+I{+% zx@YB;iM$dyBh%Bed=fd=b%(4;Nbwl7Xiw@HT72jC_d>>eLzw4>`-M!@JlX!8!w~fK$c$CD-FseWxFX83OXq^?R&Q6~LPVIu!Z>V`_s*{&*Q5W* z@3j08eKC*6e&x!Kj1Ms_6#KGaM0P17SG!h3#vK;x+@Kqe3gNXspchibwo7?mO66O3 zXT|!GeJitgDcaZ(c)kKKG7~LRDzI)+FmNof6i`?8L|=VC{vS6?se7}gbZl7Y z$f7;j;=TTN#`0+M?qm6kIIOoLi3y+$L~tWBqo|U_i%CF)iL5E!z%b*rZu3wxvoESE zmPKFFT(07g{AV-mvvC+^@A8uT{qJ?G{nmiR zG4IbOHd0oimV&AKNs9YPBu*kvc^-J*Q8fCaJGGuo1vPQzOPxjK^3)1MrG%|ofs>hx zFo?4UAkH}hWKDc5lp{#b`rfU6*k3SMPMhEN7$hS6^sp{wn>UYyT!0wE3~}$%r3rau zPCY%u>k16A`swP;30vyaeO5S}hO!5$d0D44)v&VpjjZ);Iq@~d8+(#*DZ*sJf(;bg zQ%C+bb)R~1){VKJef6v)m2;|w*&eHm0C|##fFxRyAmSFTTuzxQ&9U%QzI{4%@+8|( z(lu08VmTiGBAaLJ*j6Ab#7I<@%U_nPg7#;u>!S>oQ1<7LLl17#)YG$@h({!*Cc76u zlISeE(PO?K;B9cfcs&fsee`CQF>AvPu0)v?5)%`MUfNECp%AUs!_TA^BnY(jPAUQh zB==?X4QYJ^-$xz#Hx`AY*{`&_bUw|VNnRE156&H$NP>9T6kz)=%w*J)&)o%qBghqv z{P_RKo8rCe@ZGLOfp``78R$T=NKN5Xj}Po%V8NLfCCa1&$QGOK!>_&HdSL7ld9oC{ z-Pw!7(#>bK|1i|zO7=zonvm;=^M%?skm4r|7X|t@HC9J~=|JJM% zm*t$ryGf_5{1UglE|R@7j6Y5zLeNcyDd|R879nse;G%x6Tt`PPc}pgmkb;PH=jzQB zZHYFn$YzIO{{>uvo2k-eF^K;4^5pvJEG8pl`x`Ucl60B4Kxjc4Jp5?t7BR*E#Y+vE zG(mKj=qAfBaPi_=qPZbRE&}_IbplX?FYkK%y;^&Ta+EJCoE9fh25)&W{PDUIRt(@) zX{+GQE=v>Wn*esmeGN6|x|Z(NEVAv>CfGO4%>*F;45$x?5SOFDLnIMUW|*PXS)u7FJP9 zaR%XLki^;Qw|R4C({K^kwL=uJ5aS*RM?Bl(6)}vkiD;Chu=8IN3)$mE+T>FLhl@02 zxi^lxPHl`}cM}#xffWm`gkl)Y0BIeF_f%Ar2C_s(BbG-`IyslxLas0k;I@0(lNTq= z(3os*2D@U!;gmJW~EsL6u|6Iq4z@c=X`;sL@4Jtt>H95Z<}DE-FJ7)kgi)Sz^f%B7@N*Ncxx~Tufp8S)?>>QNciKJ5O3z4R+ z%~;VCgcjBJ!v(eFEqNzGBe0h6LsVi1TMFtcK9^I*dLndy#TQKrvU2plYu?wikxHVBKwV*S$c1)ZJbSOwk)=5}Rx)>BPsJBFhPw^8L73F`j z_IvmUT#v$M-Wm$NFH1#aJu;V?Iulkm5c6cQjf0#hT9a#K$K61CCX?tC;388dm($9e zE*S||)3u-YPazH1c;sIO+icQq0Bc^N2+wjI6(awlA(#9rDN#>Plh$b5xcbCScng=w zA0`WKB2Z-qCXcbdS#1d($SFIhRfVeW_V*W)WpPuS&Qs<#@gucE>?kABqSk`(g33ig zduV?fvv7+S^N#D<)@MX-_*QM%SA7L6zvsSxKr-3$a)cF1MBuo?(<3ikTFRy;QA~o8 zb5WVv7$_%GmXOdp5@}_D@}{b+L^|3S@=WZ(Bb1Yj{EX8N(3T^Qgk0 zHoWQ0CuGe;e{{?t)<nsNTxPJ0HGy2p4co`n2GSYK+H75$=o%~tG_W8cD6?k%+pIKeiRe&KLW&f>psV(#Kz(<0nRA!4!gA8U` zVHGu)P$~quj7L$>kP#+r@&Cn|Vz;c+{*R z%zffNQt2 zaqH3GEV6Kn5nuBVjClSvjKVqg&6{Z5`@4D8xdcfxHaS@Os6DI@1vSz%Bz9Oy{!8%{pW7s^cY zX#aoaz-+Yw|AdPcXIshDRHqDSJp?b+p7ObO@7@yqL}%a1(A_DrD09f*!R72wmYpxA z-I|eH@+g>x0pcv-p6?%FNvXzEx~P%F(lP6Bq-NM{Mk~-eaHshXh{lPVWe8uH1AZc? zDW<*dmCWgU*Ft$LRRKN-;+OEUP|R?F_B?Van&M|}ErDE>%jOzgZVocVn7n_zi*6{Tr~6fcp9;sDX}x_S z#-RYnp)-BhfAc*+iTCHh^iztSS;In0Fp&|MR1yAK(1<7F{boES_?6)tm;HUq#|@tYMKUQ%~~ z{`&RfwAJ@5(q}A`P6ATz2}QLyyzmbg#5I095-~SCj;rfX{vNd>!XL~?52iN|yPZCL z4mMhN?AS4`8yWZjdV6%8-Of^?UE*x*+ZUaIQR^IdMD5v z7!5L3nP-zxUM@g{(kV_B8~t9(=11DZ6E~XraPv3+xOy^bLzM&N1@7*$4K?7LQZ0wc zk*LSW2d|MTwCq;)pS@qde!ZH}alJv1EE|<(D}?1{{4QdntC@!?GhoKBSF73VBM=;m zGU+p^??!gm^nJPvT|E2E^vpxdeE4+|y=aLA!#k}#GG0mn*2IhGo(#u&D(3j00`MeB z>BPL{$<*=839~w@05f@m(q@yq67C7HYwKq?j$a88LW_m6ZyPFnAVIoiwQcvd%sRiS zr42Waya(I};>i(_NG2s5a=AHEzZ-T?J2rULB0OM4G8_3i8R$KU`I6T9_R}K!DV8km zH-xJc)+_FMQZjHlXYwH}oy#+yN$AM_F2n{3y-!$-iXG5dbq{ z?);DNj$K$a%2Go*Unbg~)rXLz6V|7{QfiKBNT7Foc@Af6v_?%K&f#WoY=WDoq3bb>N9suz- zTqd_!DIrd(5ud-^xcjHC--vSbE)5HAd(bnlT)7w|SoYDub1>$lqNWy3w?k2+$0%^b zir`g;Jm_7h!1EZ;)!`yxl14pGl9x^E^VU3UQLu4y7MW4lBSh)U*`DD$5YUCkShmTr zrh1KhG%23Z-VYhF4i%;Bctli{8Cn*6^X3uubco1UI&KgjuYO@}n7$B+|1I%Blg+Q( zE2`9kLy?tCOvI+%YRPcJ!7eHEbfCf^)QV7sT()6OpVb}BfArGVpP_dc)b@L6_JS|% z_U_uXh$Yh$9VCm&)2=DQRd9v2vzazQRQ%0{X9*%d)%%`4B85WxrA)h{=_||G8wMLIl+CV zIrv!OZl(eln-{Q^&W@6D+qh6;1Q-=tB&7j3VNmii--?(hFf+9@$gJx5Sr^3%JD2&~ zTu5JVyyx%UH8uinmDW)ju)x4TL1WP4Cg%&%A)Dl6wuWi3b##xE2wj4zgaRL4a&w!+ ze*itJbFD62ytt~n+f3jIIbk%sY}1<**(Ta+#|~L4fCt?i;0?HIVTBO@Fz0CCw3dET zcpe(HR>RhIq2fY552D2CY;l;EG3fpa%*aeMxOnq1OZVpDC3U(`1ZnV}@}me|;Bds$ z=Wa#uhx~`N@Jmbp&q^U)b*JY;$S9d#CjIBTTYldz<8>@0s{L`}uGqWK?2=1|w)@+0 zLqYr3>6L%~&Q@BetWrm*%R*Ie?+~3`b9+BCI2S#0MSIJ+Mej3Mi7ga-=3>3p{4d*yfdd`#L<51{Q)`@FD-TB@j6!)OgFlZK z>rDtVXKC-pJFUl~iOA6lu7xkUcH4yT({t8&s@+XJ7Y_jg;bYt2?I4}Sym|9-a&ifBz=Fp>Qh0%ONvD!ii{9E@--CY-@jAa z^)D|g>%+jCKZlRxpVp*8y$*FcbH&v~+4oNy$gHXfBF6qIgaM zh`4$4=CjJb-I!hxuNwX_70OwH<#$R@O$~ntD>|T;;7&)@3>!L>rJyZH18KCTXHT8V ziMmsTmrgn{?@Sh#>KGaIx0llkmjW9FGbM>=PCBA93cs#Zr^JR6M&u;M{%m~r&S zX)NJlUCVUhXtb2Ku$_1r{QC?`OFVc_Tv~9~tRVGdI9cpf>rggY{H(6t7a7_A=dWK3 z+;W<9l#F1m&QKaX=lpfJwE*%)pZ#D;Mm!$nEn>uT?(A9DU7>ahf0pKyl$h!Gd%JZj z-8^{H#*LhgO^fy0oOBs7$I{yU(!7|_;z#CbWW=+3quN!oVVzS1$~2f;65*FSRmu5l zd4XY6o8~K5_KD+`ro4xym|I|q5_~MhSunOTFL@QqXeIU0sJbP97Go+G|Fo3?P{fG(E5*zazcfcc$n37=KF2$T+Nc&g)OI88Bi^Ca>!|Zc)z( z+>ddrf({48{`7YvPs^$D%S>~em!3RgJL_Tr(=Vq(+_KCjA!y$#b~w>Xj0Fkk=D^)))z zSf@hG&a-*BKm_TC27f{0P7F;OQGVoPeVztt@w4ovq3gxSX^#vae|a65ZMcE7T^Fa@ z@*h9Wz*o0H@*GFl*9VyT1-N5RQqpG!(H9d)Xr6o}{<87K~_fhKtfkg2~r|*xU5^ae8o;^+W zbR2b}--0_e6IK;ENoN`Yw|-c|OtBC1c+TyBooXXbPTe^2B)h^U3ZV_f35>R_^AAVFuMn>~ittL=z z`Z?#o-e~c}9yxxew;T1eQ`F@VqAjJ?8ZV)sxHu^*D+m*;FJ0$ltD%G9cQ&W{g38z( zlIxH#9@B!J$i>CZ4zaE0=zA=A8cU2@ygOE5&*ls#O7rgRe>6J~6f_0TgGIYj5N6E4 z3udDOaw94MQLTzoA$rrLeGg6OLTpOD5FTB>yF#MMTkxMO`YcbSjBTJk@*RY6HOyBdD+UYS4AE@$>gtT6X0vx|!Z++?eKSo(&HZfgv+B~9% zu5Q#`|I0rrJX4#@t5K#xLu!1cpw-=z8;F0t}oEELcU#PN!Bsy|Dsn@AsmtY1(VYUtnIAW<>TYl zrE|(%ytcXl$Ptu58`se*PN3d8}JSw`I{*=OQB9-dh-(xHzc<^j~m>E!P?f zF1d~(9S^}t6DPX$+Bxy??6w(-`)g&vjT|^w!!GJ7kMVGv-uw|A$LQd*v*iuYuN3mC z!g-?EuUEWDObp*^yqNpVDJU`6n*0aV;5B-PGlrP5YBt)@93=yGUaoCkeltl48XnNv z0^G6Zp(h(IVOSBuGPG%w=Sgqh9-ZE=DG(tBT9NLl>tt!j;#I4js&wFKY*;vW;NjU` zRCmOemUXm)r#EzJTQvWioCk*XAEI!-)w*X0!R$d}mJWmoiRyJwt4%0Eor z>mxfGch+&u8mS(Z?qRp5j;B$4$^zyv=Eu1oqHQnA>Q3xHzj8J&_YIri*a6Y1&?z?D zuwI`&{kw`KVjY`jgNTu~I(A4wIZcvN=EtnfcXK(kBR>qQ{AomdQo*>95r?`erjhas z0V+;oqCqgG0r<@Lx<0)pODZ+4sv#;^>*4~)G-UsTF6nHbI*J@?P^_hbv&+iKxo@`BH=iaGn1llCA%j?OI=z=}BS}ee* zIdR~?Mp3s7$TW{KZ_gSmt6e+JU4QA)r896r&xMs6YA2yRG_1gGY~Y>_)@JpKW2jd%cj2-rvQ-HUpet^?XTW2LN2rj+DjwPXC*H0 ze0X{O6;V7;y^W*8ZQi!+WT`hWrF)KKLTWSW@L>i9?`>;tT)7egMn%)F$=lljjyjHj z<@Z&;N?%qIfkaq<5(kaEYrl4Qa&m*Y%0XdGafOu08ysc)j~;D=@c=_*@F*6oh| z{)@*)ZffJ;;6UC$!y)7vJxN^`mn!#sLu~*4x#iMdI^T4yBZF3GiNCJazC~``V00Iz zo-jm;(UoZo8VDO(+ifUD8dG}SS?&4s7L=x`*;iu!B1G=ef-8*pjQ08=7cMkb3_ztM zOM=yXAATz@cei(V2?`>M-!PllX&vc>@gORBuv||%;6EK-U$c9C_ zWsjLCY^->DzPsUSgMJL4;xfEB)`UXXUXG65arNpzj*P`XOf#@IQQ`6>z;&r>Xn0b0 z8teGi1Pl=@gnz43bVvQlNuuFl5U?!eZ9cO)Del48uhz(?~YfhxIzNN zkE43Y{ruTGIiUZTegS#lfYfK16(xGA$&<&T!(mL^2Zzjij~?xOv(8&()~s2m(%ax> zY_nv^4uIl$w_PiPVQC>2#CBEi6sni|OZD3F9W)#=u)KKrjy z$8P3*$R0T4U|T^KK^;s3_3DAO^V{M(M;|(N%vatOp#zP87mtqAhtnUQgX((+*&0cy zQv2cSw}*!28CJ}mKYtGs5(1af2*4zW8cevaD}$QOInfA+A8F46p0@U(NwlJ({Q##^ z!V}x?-7Fw!8rL2CupF2TM;Dg{OzTdZ*buv0PY87d1w0>MUEJH-Yx5i7NwJIm_GWCX zUcI-ZmrdEfTBg?3xepH~jAkB}3W|c2DGzB-N`{*;;s{DCYIHeDv^3O_Ad*{1cdvT> zf*@M;b~`xm=q{R^02}O;+1Y0s_u4eb%!{dPSzQH~c9Xb|qU(pHtw#qAlrgrZr%oxr zN+(R7oPc3tqa3qU-47%w2bncc*uT4}%UYkh^t#*bDaMZ<&lZ+b95-5FS}SI6JJ9a( zZ;Ao(M4fkUdNZz*cGtth`{5$_w}}paA)XKuk@oun&U}KMg4EQFvTV#QjZR~B+Atr( zF6vj4r)O@@ua_5dbb+PyP*4&n$v%GlYRb|JQ^P%sAdg7@ja{b&zmZL-yM#pCekSj) zSNQ8Q&(BrXcX4(O!?x|{2sgd_j~~-Bcd;OE8Km0o*N3TO=$;Wd2EzgvR_%Lk#pewg zwr(e@NAc2~mClQ7aON+g;4`eOCgE!rhPHX>doEWKm~a|w=c(3D8vqCx)8Q@tG!(du zNc!WNS0beZ>W-1M)wYi+Qs2A@e6UD&6HFJ2&O5rV=F+n6;sx%_CQ`t0CUoETjXq&e z{kPLgeo5Cr(^;!m$MYKX{z(5$N#3N5{wb1F!QtUIM$WstIVj1i`19up^ZErqDONs@ zHU}vL!iCUzfrk1qi;n{DTB+&F;#nV)k2yI;fFS8SdA8f1JbU@_W$WB(iU!jOca5}p zV?Cs@I1~^t>S^xP%eQBc$2xv2ESyNc*yYe9md@Ln8r-5$PD2+a^`qiBF2q0lR_Lgz zCjSN7Fc!r!d0o@@p|g2%J!R!-6gf>`?A_N|P?oiCFTNV_*J&+E)Uxg@_-ZGeI@q%HS zvqU-5=Ie`NZo#{LC%qh)*U#g$`$)cG2y*8DpTi2Ha6A?-y{}fY1xr<~SzwjRCoK?51J`NHg&WgF!)mMkjAk zLwZGT-<67s56EiXI!6thd(nDGiF}~xogev}3XWsS`yq_)NpD1l;w#W0MD%IS*>pZg zVC+$s@GJ(=LP)98pxXPgtcg*+LLv%{SB`~KheA9(5PQChZk#BbmPt(B{`y_Wx z7`NrJ;$~jf2KWJ4^F-QobaviB-lBn$tb|7FUEUgyUsR?jcD?A!Z9$|{>=s3}Vi>5* z0PX7Kt5>)2XxUoN(m3~19D&Q%uU~TMNKWT8@1T4!((xZqs@8UJV{V7Bz5V9{Qy*9` z?vle%lq^l{o>N%pgWF;|($kN+aYJCx_yX*Y-;QI|qs;l*>N!}IbcAJX%r+md&5>3Y zA6;Aa@*CaD7#1~MxuVI$$>(=56`h|BQJuUAy5{EQKL(ik`Jic{qJVO1&gYU9lWD*} z8)~zCRM{w%zcDnRD4Q&z_h>x}NyFG9!~7{rfji z(5EVq;1U@<+C%F})e!&oZ5t9bk@g|amXiu#JOBaPM#7{0^HcX;wlhfXeIGb(fJf~{ zF(B6TQRbKP4#Ct+s5btVZ6-sJZQG69*h&a&#z*QXsPj2UT#3)`P1zvh4vsW;j|uXPVe9xHIqH+XNs ztgBoh!s70l1`1k95w09Re!L_mk^6w!h-vg4rrpM{%|Y%Cg{7L3XU>AwnaR8yVeBe*GX2zykQE`;zlPu=&6IXVhN&2j`Mi z>@4M7A%S~jV!$$!cnY==9ZDmLjsqEQ{!=+y7HtlNVFTn?xO%l8t%EF;_?#Z`a^N1* zg>G(9R+QWK3$hv>F7U-#2|UDy#>Kc_K*Fn6E$VNp!@3AAKmy;s==6N(W3m?>I7(p6 ze!wIP`QP?U=ps>ub4D}55Y)%D!$8Jmznf^MT0sMfktn6Dq4|*;lfv$kr-agAg$Lo1 z_ie)=YBg|aW7Y-K?ul^I;e?Tny@gMuf_j{kWXzpmv4(T@2Jo!3+ivUFE)`1M1Pr)j z@NubhBWB!BN@@rdxqkins#OUY8CnoHNdCuB(lL~XB~sjOmJ9oBH49H5bmNJVc%cr3 z5KHC79v3%V@oef*4MF#iUaqZp-Beggq~1FjX$WRC z#s2NJ!co*Q5AF5E)KA8t2;0i^QlV+yoS=oQB%qSZo4jTMad9-Tk+%N?M~vBVQDbK5 z{>s4#tdrqvsplsV zzKLrc|E~vRNyGl&fcF1f?t})Od304^gn2g|<;nTkw5d)&6};{17hXMo05WC zCWQ^0RG`w}s1xxl785UOtzg#t5i>({}MBh^5T_~>AD zPHa>nn+1G{ka?iiUN=+@tvdF9T7Vlv4*a;mvpzCxT{mW2e%)_vjCUN~0~GNHW|d%N zXjem^PU$gel>82bOxE$&CW2A^nEtwqP7j(BRtXKSR8Qh03rR&7qf=6$GKR7v?<@k^ zQ1>yRiK@@&g`?v))qpz(^B;Z!As0pT=3j-~SqY?cv*N-dMnq7Vs2x1-IsD0M+G2T# zGIEE^li}tj6f%$2oF{;_qMYI23mnTY$hfuIWP5u0474llc!gWJZeS<6;ALzyH!S<- z?-bV&9Z<9Iowm|;GSA6MTWx*)@18pwLRXE;o=$gz>JIyl9AXfcgS-@*n1-BGm^5Oh z1Yq93L-w6L;IW^oHXh1#97-eOMg0NZDlH~|F%iERcgSEdKpuweuCba{aP6IdxtqTk6o_&`R!Nps}z z?k2lx8^&4V2csOCrm|tf@9u|HSFK$6{Pe_TFazq`Q8SR5O}FVez1yf+I}==7S?U zd>-q(0_$BB?zil9#h0ZaP8{Q(y_$_W4&urNs)>UFV#=quM-I`Y0&dWznYA)RWKMqm z4rHDy^qK3xX3_2SZW>DFx#DU9VK zYP=~gCjIXbBtz4-cz*+Zw58=j)TIyEXW1EA`>FrNNWkx zs7}GOsbtXB4)ubkc@wr|u85B;;sB}~?SSM?nm!#qYit+-sX%Ho=Cd;+2s~|vZmTmh zeI(YF{jE(XSEvv=sjE1af1D^70r&&8R!VT}tky`dwKaX7L%#x;Gv?TqszT~DavPj3 zPqT8`!u>n)?}`RY7QPWkoeE#n1NZAdVdBUHi%dR__0?k3pg$mZ8F~l=rvr!Wo?~fQ zLa{2?6NgJ@*s#_J`DGuI%Eei8`^WHP(38?(;7?-IF92f~oE4Rb0R-I6#NBOZ2?mby zqpl8itN5g%qOt`>#-j7biA*`h(+J9jhM@)q5;#Z~A^;Lq4_d{z%aht50VU0h>2>G> zzi-Q=u+b>YnO_4b$tf=WW4WsjqZ1J`b^$Mh@Wb)t+7cIM2#nW|>qN`KGpr=)C;jvhqB?=UebrToj$ANTAtDT$anAFiHL(Dg!p317e-EN%n>L`A8}F5WIOngz;ytj z+B$p{TQnH`ojxXJ39LgZ;fHL+PLFAr+=2ox%s9L*MVLo4M>J2s5P0B{b=)qv+ThEV z)o}o-8tPy$bm$hmHp}yqsocgRIis$(#+kU~`YD?_psayUH}0Z&kByZ45LxMS!y$`d z!CfRohAbNc$RPN_miGbm-Wtet!S|R~KqDu)BWbY`a0?s_bg{SixR+$LB{h&5<+q_p zfu)eh$TI-Q)b84~9x@C#n9%@oycjM%ch_dcir@d(u5)%C3%N*tv70M}qJX!-ebu|t zr|4U9`G9|#TSgA0*n0@oiED7q$BzP-kO#y<8j@@4v>xK44{jqyRVkV9*5|4~%!O?B2u^Yz9 zZ7Z42IP$eEl5D{&;fMd0Srd4n!*a+3mUuN+Yz99b04zmgT$jrmS8#c(iNHSc*O9g) zWM#D%`8h@E6Nkoqrf#Qo0tEZUI-b$m>I~1G5(Uxh$Z<4|ln$(+lamBcB`FGUTcR%3 zCOVDh&7YrJQnHsKI7gZkX*}y_JK<07ii#QJ1Bgj~Xy^eU7Fkgt?1tT^0G z>(JT2pbb=_lsGSO`HBan*efj~gLo||AKAttie#|B9aAjsm7jdHa3HCm6Uz1u#xM?i8JYm#gQ zqN9_r_W0v0n^5>7WwzrFjaWevBI4{2od`HInlt7B?<2-#Y4x8Ocg8Th%4a~!F-k(| zal;K-G~PaMFP=L$nsk;1V?y!wfyPI6=Q_N<-4I!tb)35_KSx57WKpP=>~Vl1K=w{l zgBKBc<8j@g<)q@{kiQ=iwi3*eF~}|GN0@Kx)W5%)nVFgNd1hjSW`u4}luq)YiHWWk zoOgITBC3&@Lt+ID(zl9=1i*$gn9Fe88oQm`1!(5W)a-oxDONX3{nfonzqnhd8jou6N_^f7aT>< zfb1kj39c=(n9xO&-U4%9O``g@swyv*N3VMtI${jDjDJ-#8zB~4{62+3`anP*O@XJb zYFvKTGDA@=%d|yd$=Gxq!V^s&mtHDs*alxtbHcM{g2mFzHUQON#46|0r}}N%wzZry zheIZazT!EACzMnJzzKnR5x1QD$9Gcr%Upa^q}&KhH-L_KM8W->J~rUViv`DKyC8cr zZB@%|tpRX6?rpun7-aF=aRcW@@UotCrj!+u)_{DnhMYV7!)6fG(7QXE+QJXeXg)+v zwlTZrDC9Xgte$jeXyVwk(uhi(1!t}RoM|kNBooz(%4qB+OSbZKy zW*tQhSFP2c<>~7>)KN{oiuINDz=6$#_oT#ZrDmODcCRoI<6(y$~*&BdL zb?dx-i83$>6{StEC5KO)QFQ9uxkkj91W;Y}tvtW7WHNHu_B<_*p09Tc_s4$|q=#@V z(m&$(>+=rGZahG}e0kIF_3aGZn-gPsPC)7pDEEufEo5|<@waclW1im6A?;WGbJ=tH znX4lV_+xGM)aL{um0>8rgbI*TEiE>^Z$`|>9z9f0E=l1DEDKRr7he8M{qB^o9N??h z18_Zx$xcY9%OB#g7{Ll*+PaI%_dW#-L9OyxD_gxl&^|xOG~g{j0z2q+n68y|7ci+? zE_x=LHyB(mqxU4-VbDVO;yt9YV>Ast(M7s*$93xxm~GHt*$PzN=zalXAg+EovK5O) zLM}z?flF;<&kVvMSpWzO7ys~KzK=zU*mHAO1)HNRWL4yLWXB(f?Bl55Pxf#saU(K! z@}FP>?m{fRPwFPX+P}Hdl^$wFt zyB>k)086Wq6h&?gVjYkl5Y{-U1ma*G~XwU7lVk6?f*sAfLQU0z<^ znv!?JsHH}Szr?bFuC}>&jj@w<&6o6^|72$7!IOja;2Gf-(ZUF2Ob92HPc#nFlGzeT zj0%^=oq=U`0;n;MD2rGrw28W%1`TRKKSEVGo}%_dg^H!+iM~S|-ic~I%B9r$({AnN zjas+P+iZObG>e`N83>i=Xo!5ImOfHuOJ9YfjXV+>1L=|g6**w3QwpbV_!RjxuvV}4 z0y?0;d9^U+Qu}Tn-3hhQ&-8X_v@D=gJERi;=m1%32ETzAt_fl9^r%Z0E^J3Xs^OWO zPl2Z0y*t)$jYMy;V(aDfT(B@1k>YpO@7S>;kr{CU19Vc!Q0&>Am_pKoHd@4AkWQEP zLO346`Q>W|hlD7BdNT#ahNU*g=>uOU7FKvz;wf*|vaLIDOL23r6}Z%0Kru>LNVvv+%SdS1Wr;Bk09 z$T^1V{pLCXXwB8lO&Cu$QGI?L*-=m({|N|_czTkKnA6B5lS;BZFnDsmfKd8ofNQIZ zKZ08?AaMa2BEjkn&?Je4{{`ZVC87<8+S8^zx0tv(sXTkj9)(-I7`k+kA5szB<03NY zW1`GVEioF#yzNkr+7X}~trl+gMw^UvzpCQ%o2%Us5O3!g11=Uu^y@_^BQz$Ep+&#E zYgZ#_W7$0D8eFs~y#YimOFBFMf9842xN(mT;53ANH^&o4{#VD8j zeU4h_3Ij_N>+<6J`Ij-k9d@k4!1Z76F>g_@F?DBHzXDd1-G+JQI)MFC66 z?l;%z+pix8;&=ci0@xVT7gM?^qkS~8E^6E1_S zB3Rx(Z{7&l2hQ-2R^{YT&3NF3i?c$>QF741EM!(^<1>2v=8ZJ8w02VK3w}iV!vJG_ zX+xTaU_>tK)a6PB%sOkk&`mvh*a6URm53RQa`v{AnMLVdrHtisNy$&JyYstbxcH(A z_icNij72_ZRDR8alK(I9m`Q z!Cks^$>9NDVScl8^%N6&Qgjn-37~&wbhfaxwnpqP!#FZa=0AD)z}eX3v_Q4AjSgN4 z84SrN})Lw;~7z}hpC zL1X5AMRuc*;cjMV?!SC__5CVIFpLCRLU@MWkh~!Qopc@#zzttj^g7b+Z8x17R5erk zj_sKIclt30bM_6UJ&UgI$Gq!+)QNqm#Sr6yrF%~3A}gXTjN-@u;D%y7EAxYp^$j+! zCXMBO{mPCxZIX))r85Pw+o@cp=RTn5PM}a#ywm+cjL(q;rLwL1c-kE6RhD%h_omWN zA_5#b^vdv&vd&hki#sn~lvcdeWOne?;T}SX$ev55FX^~{HceS%dD5d(Q!k6s<~`8K zJ-}gS8<;3?I2&miQu%tGKVKB8R$Xri>a8P)0tl}fnwnd|DMEq7{od`RJf!WdDvGQ#oYV};$qn2rc=r1H5;p}1j}1KZEg zpc8JH?qEi|j)Fkog%0BsIg@>Ie`f!3F8eSRVPH%AN9rr&3qUT9<5?|muM=`d2JB95 z{?!wlq>)05Tk>|)t`-nG+v9J0q-Y+xO*ZYcR*!B&*6>SI`~yRIo_~#%72m>ijgB#2r#@6 zM1A$iY^tV4pv2Q^GzcfbTMf`lx)_@QHn@VRT{t$u1gZ%h6nz=<4~>!%={;F~FCj^ntcfq7^C-#k-^{gp9xyOY~X;bg;vHwGH}sA)fBOc>OzhjG|3T2Kwj==vm}TkY+qn z3y6E2hYkA~7NPNbfz-+p%7w>)G~rX$C*6a2#FSRjni@mJGWpP!VG`Zwc<@PiTjVBS z<`Lh13#bZIWrH*v8UXg#`O5?8u1K&L9gl$6U~`xdpZs3zpKBso>&~$@lPmBb>+sr+ z9Z$NqsIQ|#Zl;>CWtLBpDorY*a=YAHYU$_@YVV=XDEq;dVz0=^(oK>5d-b|cHC0B* zxCl6*|IDb0Um;lGfqeI|ysR+Uj;uqb0#zC{a=-9{5VQu!0DF)2h#4F39EdURH&xAN zv7lyOt7}_s-P#bOv;@qISv5eIZ6{A=TXg7@>>-TKLN+$u-1xKHFm>fcjdav*oQG^?;6UbD6(!9L&sRQkKST{6{vEteJh3kG_YI!-c&L(^CE#)U z;OK6mKtJ$hOqeiEG>fPoX78Ege2 zgq46oR4Cf$+i!un27ZP+KKkYurE;s(Z{z#kc~b5HR+z&oE+eu6Vn9dEbpz|UMb&~# zLv2uJbN{KkSRnwY6mQw^G)q|75mgZ3xx>oi7W;sNJAefCw-5I{_% zY`(s#3~bc9`eru}29!>GYHDe4^of#BM4^AX*p@8?V1~Scby`H>A(bU+$+S!Jhkv?? zM@Ca3!@Ys6x+eb-fdraK7+;7NPcT~%CCEM4GQ6jn+lUS@U4a_}+jc5`+k&3f1T>Z7 zywJ{02!>8WhO`8Ad4$vefS;Cyb`KAuI$M%P57=DeDj)6My*hv}bgb-f7yR8DhTn4T z+)xs*!1xlLd`#{eu-G@BDYu5RPP%*g5w<4Sz^I2TXYHzV))?c2k zA}R;^);bF284`&F3u2Eh?bB!K0jnLhWG-l`ZJ>B!#ptvALcYV2ITtlTXKlYY=r9~? z0-|#cFWUu}=1gCfn4R4b;D*FC*41?=+yG-w&s=u^+K<>a{qGGC4-`5nN?LW=GJIS^ z)QC)ljR}9*32Th$mZ z7Yl}f&R`fUKXP=KNHvCaTEW{O*YP;(&+tMM_a zhrKROL~IwnH{q94BN1h7Rg-x_0 z3D9UoWvMqm$GK6O=JcQ);p^+f439fRP2^~&an-U90W_tP*3G<&`JX<`3UAWCf22Wi z#wS(fk{-Oow?&pKL-utI#r|iZKce)Oj%vl9I&77sWxTB z1QQfYTjSz3wXb^!K{V$S*PF|X%X16|OgbxM74Jj*YYF;QQJu3bEv=Ph>oRa9Q_)Hk zb_v8os2A+Bcr8lT9J1O#MsH=DMLI4@S0jcnnTrQC+5A4sIeN^~|I-54Ep%I`tpj?~ z?X@d)2lo+DyvdC#HupSGx_)28rfi!5qL3v`0mVsP>!UR}DBB|ZrE#|dx>aNeFk|Kz)j);i ze-%ALpLsXG1yAqX=WkzXerB7?nDhu{MfC|bb@gir{spmWn!7INZ#zSFF^f|tF}Sir zpqKZw`SYKCHihwDF>iwji>gFaP7ynxGzNth!`L`Fi{=`n4?rfD(^D|yTo|7YY$*Y0 zDyOn3E->0decKJ`l<2>RFbj*WAWrp?lS(R$Tfrx%+-PHV+vKf_G zy_3{Lqv01tS}$}U{33ESx>9+^V9Ag+paVQzNT-fp`c9uUYbW?n9z_KkKjff+EelzI zok2$;hw$y2e-{ryvx4bRb98-UnbA0r`+1JFJ|Beo=Q(4P-XErzJ z20L56&ZsBr7;1i2yxG=0dGcgHPa(*~EfE;kbsfkgxj{f5fEn_34yA$6{{T@7SFDhH z^`qT`^2k%KmNS&1%ncyp-nSVb8anV%p5%`oKkVP%9%f;iTbkac(}_VYrNg83o@8k# zqDv3ak09PK{q>X!NcW>#N<5VB;T~7pvAyncRi_pDZ4k_eVqNUp=;*#Y)}7a{DtLNC z^twm6juJTL&dvPYtIWDS-9^QXq{Zj*+Sv_07U+f`+xgPP9p0iQ!s70ChCMq*Oylmq zty&&4JT`B0f!E#f+y5U;X9Ct^yLSCbD8qxO%qk^?Oqo&?Qi)0$NHQx?rVK?PLPA95 zMv+QFqCsU!GBuD?(nJH2R1)I*UH13B$FYz1+0Rb?|NFj%^IU74Yw_0cf)mx1?NxgN zkYONw!Ao6|_*Fv9@pi(myCv!Mr90OQ^v~Q;J=JhXyzX|i>VnvUne{&KF=*0#1OVv1 zI8T7*SbWap%LZf9pGD=A5cYw7y+sO332?%!0!<%dE8kv<+9y+tX7vAYtETEZk0o_1r>`IxK8od~=IPNi?fSM*zP z>7SD*me0@YTCL`>AD{Q6>R=IUwJ7CDr}CnD7wi3@?>{HX);XExp2X~7gV_e1Ae?eE zB;_QqTyRG%*7~dTuNe@Af}h&ZOcP^cGT?$XzASIphK8mJS4NeQBhBC1M_WZ}DTdyk z^hQDX^wwJ)&Z@rX%7=J_pg9{6im;jJ1AV~qfSx}Odhtydp95($0-G(^{RGk zkFx<=H~%La5}51M2s^}Bm_!|`No@vXz@f12ZjDF?1VSdxl9_+K2&u6*Z}TxoO@mLE5HoJ6cJW48kv zn1Vp~1wp_u_fKBcwv^0n3{Y^{3ImLp7w(Zm4t>PmPuLJHtnB+;pgR3GX$NSArn&%TUqkU##h=^C!KocChwr|074f-0XeC-+x`CD!Jth zqa4r_Sv@FY#+*3>?+#Jp>*qJQ{>HUAbLL?5bdr{Y)S*~x zPTYUfF645z@YnXxYwb2b=OOP1gYR>v2Pi81%89NbHCVUt*;wJ7nJ4u}H>19#5$V=7 zH1!c9nca+jxRc+8$XJH;Kx*FeZMoc-hv-QMx~ zWrG(FZ@Aq8QXqJ6Y-buA2V$R@s|I}E9(}0Od&{uc>X>O^XgjA}F>7kwAsk@(^eL=8 zy)o&|yge=84yZ$L4%A=sjdOY*TblEfNgwe5?%z+g@|By{{#jQ+8snL(A6L*QfM}}pmX>R3FARk9tgu=}_F4_6%ix`-Uu>vq$Pm1J4*08{jGP;b}Q z?axWP6C-gQJ`6MLnDb74mQh`v{4uNPMm_+>P>XCLWlRE&{IXp-^>btEjIHhNB@ZLX z+rECLp`ow$eI|=?gAJinUe>a8RS4^$prC|R>vvTN2L{16Edaa*$DcT2YJ z4-^6!-wPQAu2qeQmV`ah@&vmK2aEgtY0L%G&2q9eRt;10@XxO9S$Bp^6wUw&drQ1Q z{ugBtzR3WuH+B|Rg)jm}k1m9E`Od;|^7gur(|78(b)l)rT2Yau9wKasPedoa*ub`v zz!FMy(+D#TUbN*JVTEAL@McN&+VLW=ue3hX^)_c?aq1BZg}3LV4{%sIC)}EsC(~~L zNU3Gi=Ux%L6x^mQh!2%=PT6+q>4#KHGuft@8p^}_hc&NKS2fJ+qFsy0 zr%UG8$msVLa2F-Oio3fcQ9*k{HN>aA;;V^FK3rPT(gwyCK7&D~P@zM8`RdgS4qoQ& ziAFx2W`_I_#RlLLL;t3*w@mg6wHdBnT3?HT`{CAz4jF|;7G9jnB@!=|-*Jd@TBr_? zGdXZa$P+D-D63nYXUSmgWBhz(iou&ZiV6w=A!HFRT9lIX+&SUkcfR(VD^(~Ecr}&l zCl*DG@~Q6Bug$_h#yFvF*yb_60*`cc@d-8>K=K#zJHwlud!4<}+2j}i1ym!Wlvf(4ekAzAaXPK5X23}qksk@C+;3h-e##zn_$-QKAZQqT; zwfv(O(dHtrMk~1{++k3Q8>YhVAvuJbBAU4a@RSl87QZ>yX1CSt_TsKptsBO0l$w7U z_-=e{m77ksQy0!x-WnU{0l1b3?Vt+ED^j`Jf69*2!fFsnO!cAddNS90;892-TH?+g zYfm#ckD`$NDuC(+Dh47KX9RPWa>E3S`_u$@q_hEBwW2;bxN4})!y34F$;^!MrfBuX$Z5nMU^}Y*) zt?=Ln?mYe%(|Mc?M@Qi&tD(8xXW#W{lP+F+EN8XAWp&E>HN_7j)!mwwPd)RkgO~l| z&J(`8Q@T9Zthp$1+Ubb0OlLXe4MaFR%$rx@W8=BdYhVtcE6VC+9`>_@0Hdog# z8WXa-+w?OVWKOzDiGN6&sgC0~27c2XUCOR(u)qWp#}Uygf}KT@#}HRg{Kd1A>>4M} zY?pduDK1dr4Kf9|b z=gvbC!@uuQFz9}Vt1h9582X|LKLMvd-#J{fhXuC0!T?&hD>~g%*=Fz0;X%6V5pwfH zmJbWB*t)foZ{w|&O{bpbXKgK}Mw6GjU-@iR<7(MU$R#8&3|!Cx8(4Q8N*u675wS-i)m)@@ zk*&o^L~D(Y@{dFa1d`WgT>p7vn3S>=cBGP~x6XIMwgSn|slY*cR0ZHc+s}udeEPx4 z$|{Fr4QEDl8Y(d5d>pRN6=OhydkJGz^56aCbFXvCu&asQAhLvRy^8uK!rC(jZa>7lN&37^+kJCFA;Q7@k;g*u0aSV8t;f4z zKz-S>xo(=e_e9yPg$ALD&YZoYkD;)G*z zN{)AVup+G--MZ?yan{3w_6}Nijr8!B9j1j2YYrfz-4TsVok9af!A(s~W^+pRw%?Yy zt2&A+Uii3UOEWOW^8H5ll)Rch;TLwMUQ;4j*B+7V?{BBlSI`brUpYLl`17rTPZ?{+ z-=4PzbqJQxciEz1=nO5gVM=x9eh;svZ6$>b4?=cDA2Gtjg7f?qtZH_I*%2pgO9zJ| zSu5n?HYwK@_235?zf7sOy*#RCbdL1iOJOd!h-qtUV}@F;lzQRaSg+qd%)WbYm~ix8 zx6G<;Ja+o@P`eb3z*&guiV8Jkv!s^(L17~|;xw~qsM1B4!J-bf-iL9rM}AqIZ@c&d zc6`W#xbw{xY}q;Fa{kBTTHigwBR>1hS+aG@P?1|YE~j6)Fi)pyT$VwV5GiugwRam}uKd^9-sY{;hmN3fxmrU%wfu@A z4vdP(k$ViAb=A=2-O-wT;CxqP_GP@tS;zmfb~FL8cP@g{S2j-IcfprA0sb8*`) z3j<+}aBoQ{&god?8y<3GDC+u0BbftR10QcrvZnt83#(Q%^VBWjAiq^-KO=h7xQeh9fEHU(x7Jqmt4 z{0aIP!~8u*n?7nx>$$r8C)+^XdQ5YKosvc8tl(#Ai(JBsJK~W_>T@^vU0Nz1Po5IbO{xXmJ2a#uZXWQR7rl!kz+smXxFk<+C zm6U}Hg_2=|%dJi$hDvEMfQ%$Z!^Ir|%;C{;bGQB;R z=ZRAe9=;4UHb1CQePPWNyY2J!%zwc!PoCU&P9Q_~A$R^%p+LdIT5782LpYIt7QYBt zOlHsSmC@^d@=wt350u+owuS8C@dKtRdF(=3feea>M#Y2w6x^O(1rlgH@*;6zvV9xv;*^e@)5Jgkby9>SY z*68jv6JH}pFv}b?as850X}??=JW|nDAHmPV&2ojzhYu8%-OoAr_n&m*X;qPnOWtp< z^hEbh-8Oq&Yxvbhb_zkiPf>n6hiw@6b-B#Rsi}q&Bena^xjVsy4BmOup9JS!H_ECF z&vgRu3)j3tnY4>nB<#<5?D|JGjUn*{$^97I^#ng~yZAYt)elgUKVgE++vD?C?oz+B zhI{&_2TPlt(iiE7g1Q!!2fsj6C@$>?xR(%o7`BSXyl2Wq;yxf)K|WjY3s(afFK}8v zf-MJB$Bvq=G7;&`Hxb2&d>Mr;J49rh*n2kTx9Qz%JV`5fgR7fF?zdS1YvI`?W2MIS z?jkbrgcA@=4gSEwhI?vjmbuiHF23(B6nqkmu@L6a^}t23A+tM=ymJ>jlAqhRInF5l zW6O`D+20j;W9&tGHm0EyOs#@6808cK@yKA0=%7=sMpl~EDXUU< z&pds{+_AhcP$xW6rfY?VH>LC1@gc7_gnr8Y8acI1g9~p38c`AMdHnb$v!Pq)9D&%y zeaP`~5+rYKf&q89DM$713dQs? zPP?vlW2m>k@>AdNW8;}PIXRW_->Pk&b}Gjd6$AHU_4lrw@kWk@JJ3O&Xiz} zj~bLKL);(Ca`P+r^Z~Hg5offzsxFA;z_TH9s+eY&qW)!}T-bCZ8&JDL$V8&%5BB`N z;A;9Gk6PVNMgW*p)5|zPi1HM3f}kGB6>&S;h6xsAk`1GqRD)y5tTc+r|3(DD2F$`u z432jf<4JGH*+XUczxaXoqMG4n8y6%5v(DHy%SQDsTCkLmLQpkS#o-waqiW}Oy=tX7 z$)jl~v6xr_bs+9GPD?&AJY`_C%b-nK-#>RALM&DIqSqva+~fWy)GB3uYZVn#R8%?q z8@@%&E$g$LIR;n>0Nf&Tg}?Oy;`(H_%UDs@zkWpCm7mS3uglNlO?rOrNOh+%@_7v2`ev(EU3#<8;B3DaT{I-~Oj&ipMcP+A zSRYExCMJodDY5p_IRe=x#wd)fR$)zwrGseuSa2{iXx-&cIf}$bAisLp%fpFTy)=7K z?-K|6yN{je+Vx%*Zb)*X>T$5v5cz}u31o}gfh$HGYzF#6@ASs0_PEQeAi!ee4 z!689-H$R>({>O)MmB>%-W&LP{=E6OBXUP5FUj=b~r{(=o9J}O&Mg4lUCT#CmFbc*7;u(JAA$^NY$hA2-wgBgN4zrYs zP^9vQgUu9;26WSzi5pbXTc59^Hc7sj(?ywgfE-*%RmgdbFgd=BA|u=Q-Xh+cNRGln zXE7uhwo3vPZuao?_ZLxy6`wkHIt^;Y{vu0>PyRi+@OR;X%t~mCKqPWo{(fm}#fHTQ zDagqsY$B(GBC`nyUh-E?pGn^i=t#>9d1gtn`;=8wBf}RZH(jw#sUt@gCl$^LkSlf` z@HG!(lK8}MVPEQ%gKa^j)BgNiBa$57B)RBcZ4NfGhbpUgkeL`V zCSy3jDy`I?dqnIFLFJ&!d^qW1SlDi{^!P2e;>QOZtudx~C4I3Ar=r4yB2HjktmDzV zgum3YoK`WL*63gIVN_)BeHJ0A01ky4e+Hg>__w^}mk4YW!BjY$s58HKJZlE;g{yvY zWkJEG=7`8h5mCZ@_*kcL}AsKnMQ}w7V_vFZ5;CyxKfy4q#58 z$a4?QlxdpO|A_0ko~BK~=n`@I5Y~qDts-aubc71R1aCfIrhC}~d9LIEi-8A&_?LPG z+?VBK_pD&VgA-Q@(7ccCwo!0WGydfZyw#A@;PV~}TT<{Y-}6ajgFtlECWIx(r2{Y9 z2KK*q?Gw;S$-BjEUQ_84Ko7NiPE85v7Hd=d;t{MH@9W`|+?>8fy`pu6LpU5WR)H0p z&~hm{Y*Q8?;%9L0Vm7$i=dsRF>8nF(bP4|6E%GZ-#S@y8^f5XHCH9RIzhy>?S_pr9 zQM|F7sD~k6w-m`9C5ua3N~2pPkDfmL82OVz={N^Cp=Hg+JfweMnI@i zZ5M40e6#<<+E6$LrtkjYY!c8u--xN-$Z>4^{M0YWB>NY%Spt+6TnlP?u5j1%wk1O+TUiueGyB{;b(;i*lv15!)QsGLeA#2*?k+BMeHIQ` z$27lF*Q>@_(qY2An2GTv2;GFJZWrwErg9&}eV@~=A;A%Eg9#U59|9XFSlZJg0hD^( z%33kTq_>WrB*lE3yy(%Y2U%mc@F#LSWol|qvCmG)y}zO`+T{H8+>qksnLeyYeG?qmLXn8}din71Ui zr4VmHXc1g)Xu^9>4tO+5yyT2;Emxxl6w5((+r@tQ*1IHDPxZw}6f7c*hX$KN&9qZN zcU8a{5kV?~A~6y+csm(Wr~;u{JLItN&AGl^_U(GpHcNUxB#TIw6Pee1W+p@{x%54a zhv*~i5vL)OEh5^0tRzZ7UfU{E@)1}n?D(;M?w!G>o|0hKHLGRgErbz37D7{l`jsgq zIh1W!ZVECM{gvP)z-yl}Et*)quOCWXn~=#$GG@JJUbz0Ww;xz=t=sqFNpPT$V5vH3 zuy4#F+%DeUbO%Oz-jEQw(Hieu`2lsIdz%+!zU$rQld-IvP_mUkO!T*0uFq+wG3DLF z&G{*J4HWI|o~gmZ=MtNhQm;Q)dv5(2G6PY^i}?%tErlz8lh|1)FiDb6M7kw22M99A zAYS>{w%0y6vF3!et5eXc{ayPhTzga`w;OsynD!v>7!s`^9XM+p4U?EYbLzT`Yg5q4 zqqcuvt09q_Ehd(*XcnR_-V8=L#Uwjt;mFe5HRty0AUZLd`UKSw&<@Sa+2XUM3fz{ z0Id+Rci+xU79n92RCd3nW$;rSB(<)l;MbW8hKm8G1h%8FN!uG$c6_H)^@Pb5BJ7up@_+OLq_;X#) zJr~hs^zq_uBfC-9SwEF0kQOI)YMR&Kr>b@~oK7X`gAiu37|}ytTK`H2$VU&YKbw&E0^U`V<8K zNCp#;%PFaq&;6b_h@pd3%%_W2BfcHB^<^8Ai1i-EpvFY=DXlAZc5AqzKWkT$9Q4(L z@+I_3Y}P*mk32Miqkw`wm|k4BW%Spaegf@iQ-;U-%=im6{6diOz~UIC z)5`_{Y6USg$4V7{>?Mv(saS)n4A*-#_$@Zh^6##yt9xFg%mM;gbh+C>MN&mu z8wywM++&ly1EIOQ5m5}2QR~RgU6uMQB zAjrPJq~r|!m#M;G<-PgNhX1H1%>QQX>}C|+j~XY5?Cw@{Ka$DK7wTn&)&dQcf_B)F zGb$T4a#zD0ec+zxxP)rKeq)wen{Ms!L=EF|!9UU1N>F4RT zw*gJQ1&07|trKMf&^RaRtM)mY~m{t|M8oC8dz@UleA1%xh%Z2_z@$psF+|P_=hw zEeX5ozqGRUS_OSZOrgJFn6ILqh>fF9Y^I+^PA6F>--x<7X!K|*I zknSQ00YN=XlN%-V{%`lQrQfTYixARX37Yt6cKu+~J-CDD|4yyTmJ7=Qw&rFhka+z2 z6HO>DA(&sjeS4_5ZWW$AeBs3O{c5?pQRnr3Ov<@muQlR0jm2;-OCdu$0n)ex2$E=VdXHF4DU32$MfohCfRq2(+&_utXj` zBI8-#yy_j{H{ZB+bxY#{a0i*uK(z&UDLi10F2LF8F%9TSz zl^mU9MBXOQL(e+Zc5~~7_vjB4m{=3;H~*$nk8XNR-AQUH2kTl!cjNe~9fm>;`2IB# z)!ZKF_=|bpzI_?O(QSQy{4K>JWp(hee7DO@tGll?nBKm8>~o$BUKS#FTtwcnbWY*w zC}c!D*qK!JcnN|<#KEF4`reW= ztuOn%vl#O!uEW>&C~iOBTh^<3>n(_au9|ja1X+~9}YGr`+{CNz+**rsb`D8v)rd1x%8J}OPtQga9vZI zZTK=Jb(KC|x**;HP+Yz|W6Gr6q$^${T&ST%|FSkM@rxhhUKsLRX_S`2$tov2f_4R3 z7XgJC%NVKNJ6q}@+QRrk&LK#psM3`OF4)8fT`zkT9oqkxVaF5pf^>C%f6RzOMOjm` z6LJh>YaGTx)pS9%L)~<=0e!GjHP>yBhAtAt8X8D1uPMN?!b{g6W+RiX5yV+A#{=v) zVS??fU3(dV)&Su6C(fkIoYK}bkLz1awmI1#z@^!n+H0=0VwZmV;`-$&-R(9xup6;m*+z~?#4wc$aVk|#DsG)U-D8$5F3*_51 zzVL17bUFSd)4qXM-db(U|(1TvzWqdp?u8wv9Dixc_D>`*jo18 z4WB;CuWAqb06n4*KlfbW+ZIcpzGeP>O_s|4QLWtnq|-LBhH<5aTy+kLa$c= z4<=+apoL$7o#Mepnfm#;{Xn%E(0Y8~@F7#omsr63M}p#p%J^gWnzx z_7{UV@Wc10GbLlQoTVEp~dG9Kj}JX*07M1FGqg#F~s-KFw5UV^UZZ+|K{DBQy6D<#BmA_fCuLr49c zK6Na{V#1CUdyyzBOKWRGD!$t-iDT*4P%}}G-gUj*F;>%3WfbIsh=lnv{?=9gY+nU%~XRBlNT+EDHo z$^JnzMp1cFo$3xWfBft97cgb`OXkc9>^IHX*-c$lbQfSSLMBX=T0Ef^Z?an>IjKbCrK>WZo_>8$$JM+F5ose7Oh`-W74mcV} zVf(h)ZyaKQHza7FlY-qqAS#X&h(QGJ>US@ktQmohjj?oLwI|?lwzr^DxlStDRF5Kx z!sE|y^oGlwP1U;p`X(uC7sEHl&v2v(7du+gPEnfwr!0TIb9?CwT4tSE?|0RW=)4Y; z)>AT#z8n%(Tu1x~c(B=;9*zlid|L^u1;a{v>V$b`S9dOyFe+};I`P{prGjC<3h#?I zZUkVp+}wEJry@pZDBcCblKA1|LM*tuUY_=C_Uf3+a(zdJ$lh<0j?g@Mi;aDKe|A&MQ&&JhH2h?c z@jWHgsenPsA~ON+)fIpLv{4JOwMF+m%br@}#-eqpSmihUYBLPq&ggPRNWZ>)e{N6> z^G5`sOdX*AY1zdTrN6BQuU+1%6Qtg@R;b-zuu)G}Q*5gde&d81Kv#SGc)31(-0f`U zuljeQwiB6qR^#3jPJ`8;%M}-z>fpf_()YiV4aweW<8TTnG<|(oao!qHVCMPvFeJANzjZQG`}%v08XJky6nfmGYs1dODXYzx`^f@LZS}Df%g{Tp<&pE)WLR1ck9oop#^DLoKdEMNJykVpZMmet(Hk zmPACZQzUL6^yr z(8KlB$>e%vD<&KN3CNWmCwzW^b3%tjJA|keouIeJA&U#>rA4Ph3pZx-$5%)F3uFRM z&AMp$dqMabaeb|hDXM*X7i<;pp+xNXY^tuHuO!qA<%Nz!S%p~!!8zig72?sXwO9EqI|;r zWCgndmuX`#>P~(-&K?qmiWJ9~hL<6KPOuw0Y~JCrI;N~!`@PL`E~~DbCdmqdJrTuF zNzW#5n`Ls9ZV>;pwnFiA6$mF(-Ac{F9G+XqVNgjEa!*yk)dn6NI&sr~{;OBx8XeXVU zpr^r?dd7W#0z{)s%XPb$Kq#S>#7Xd=??-z3>nf_J59+6vjyw{xTxtaf_S>C*+a%s@ zuTN#xYPwaT?%&^y|MWB5-;=2x|8tg*v5PBCPEHP$?wjq1Y?h%~?y@ay`Y#-dI)v$5 zHNYzl5z1KTX5z);+6$?{iOA}gRi(X%-A6QXzbB~WILwI%k-CHhlX3Zd_<5@I6 zY|e>gnTbt#rmcw72v<1SdmAPZK|kjUePB&9g%5~D7_~6xFEBxh`XW8pL&| z9jb*;lgXFhTR9OfUv*DAn}cx(@R9cVVdc9m#V#0?p9DKYiPB2>BKS5yum2!GD46{I zCa{#6d@mXow{6^-iCh@Htl|!sbpfA=GyQVbTZ^k#=ydHK1Sw>0y5`(2~fBxJT>g zq(KEA?k89+Uc9qtgIZj{Q#jt7PtAgq@Eo(1RtlYh5%$_S{+n;9sOg*SS>pJWJ>!m5 z7iai5j^w&OCyyPw$B+u`<4W`@qO1~vXPzaKVGlQMa$5A5tGmTl)7)Y-5zV}R%9h{X zZ>P7n+p`uzN)E9J0HbQn@*dr#oOwB^MXx9+mJiZp@i&m4_#YNj>0Z z!Q?o(oE_)>ZH2-}hqsP4QxVoficXpIx;AIS2D^m|`@O2fpIFRszzr~jIfKYZa>j*< z!qoJsMo9gZ6u`1=Id#J0p9-8yc69G#I0G>_h9(BVB)b&f0=ks)KwAgo#$5&QhXwX{ zC)w_ZJGi6U<^8q~9ciT`X5bxC&*E*FvgqYzCzmmLa0v)h_~PxEzl`17 z+(PCrkv%u@-VG_c*tos#Ga2#}LmLn4!x2ddgLS9WBRi%n&XH4+f|InI*+EvBX{o+c z8P%RsW$#t=D$4EymoB>DoxdvwVf7k}C@MFbE^#iCckn4}hyRbZPA!wnymf0mhsP|L z?>(_D+W(-(wS(SQX`ns?Z~ub#e)!Wy%DFIPwSL{lkWe1yXCLYr?Aqoc7m@tivmh0=7i2o0!M>~ z$W%no0`jn>IbU)I)IH(*-L-E|_EKN%;vqiM?jdv+G862wDgfn_ILeUsmfnkEJ7?@NTmwI|5TUdscfrt0d&XIE`{gvR z2<`DbjW=kp*gR+i;|B0*oK{RA?z55-S{6!G&b=)~aR^PQwD<`QPqcL>hmV+kn(fMF z>3n{{`m_ls1HP}8pFULSN+eK#S#mum`r5)9K6J8Qs3XjFP9+pguvB7<3(iGxku=Lu zAn{UZ*=VR4juIN!KNsbK801TxF>%8lB>gK((>$5W7d|yt6DvB2k#DMoJsu_*6>kHkRKm*h`c zV!ct(d;BiCuV-<2e3yrtq)WFrEtdR-3i&v<9Oiw`D9{VE&MdODR4MX(9;`R{ak#j_dzkF`#1ZYyOEJ~JXtnt&_B6_lTbQ`W`(D+S|`{GnmmUTmvJrp$}Q--=tI0p$PW&8H+*Jlpv)hV~MoH-?`AM8d830pwikMZvqU{2Jx z6LC6XT%a23)jN>lZv1)KV7to15-%T1i42Zj=YVlkG(tWDFWJu4w!rSlh6}kvA1zz{ zIfGdr(XJtFK{rWMLFLDfPdHCR;|$M{@JBd7ypH=HAw6qWC*F^uq9T$JVPcPxL7{qF zqr`z%(k1<~j@izi|CmFHbm-GZza4-2!De%lNC++}w!4tG%Voshb`0wh7LVK7r721n zA^bUfv%`X(QKflxDr(A`>)!@Y{Q54~dC4j~I9Kw*!xKv)5uOUg1(GW|btc;)$2}Q~lwCurd|d4smho zVkLyeUWl?+BULzFvWY{EOAX>+mF>vn4lRtf4=*Ipx0Y2>*(kJhizV1&jFQ=bk^R{K|pY@87_WYG53|6>qyVLzAU2?2Ej9N_i~=(_I_hh?>&bXOa{>t;cOU%oS(cE zx4aonPD2S25$oW^v*$$Yi9bS3&$-1(iItbgh=n>(FdMh2<3UXAA1^tksS8bJJuC;m zw3)b2iG?t3&F`t+GcPEU_ZVxlMn2X>BdLr>!o5JIt`WmnOmvlj5V^i`6a(zo8RigM zFoYBu_(7EGAXI*nJc#>Zec~Qe4&|jbbm#$IOG69L3huRdQHrYBX7gR+fXG{&j-Ct~ zH&NqxO#4sMqu=g5J61@lG8x-YmU;>mwS!?Sk&P-`IWejo#odH592|}3G8*+Ez?SlN zp+69DpcG%v*p7t6t|DaR{>f2;S}f&G1woB-LIJSLlnycI6@wVRKu)AzOhdytS98wbU7nG9$ zA&k0XZA_^zXdG0hOnDdGQqb#&bFF9f`}e3(O$j%T>Dz9^J(}8@l9UOgXZJz;ZyXbK zkOt?*(Fr$Bn&+L}9{MUGg`LWk#Ih2aUnC>pf5m_Yx;XNOWCksxqZ45ueES5CfDlx&A76<>D zwm*j_yeor?y7{IC|LGUPf&j_>RKm_<*N72su3Xh8^=1AN#*5Avd^M`PkHqHu`SWMh zF8t0;8_ZmWz6VG<3w)7=g-5_vVXUda^O$PbWqbDPxZ2jifMLseMOK7lLjeZ1m^ zP3*$r{wO3W{5_M+5-#v_XrWtPL3RG;GMrA$Tmqiy$jvq~v9!c{`B? z7CG)!KR@mN{y3|ZJ@+|LchM#WSmVYllbx(7afHAl3JeQ};|0Ipk;coJ$pM0sG6$Ff zF$UPGbKe6Pf)rzeZ!>6}#aMMWouH$)14ObDceLW%R=Jgl9by~%rH2!_m$+voBVJ|#@uNFAmijVKP{0AFOM8GNBTC!w` z(#~JSrSMQI8B}CSVHfh2@?E&%E#U@NFj!AgC?&C&M->eR-PPdHqvuW>@oemhi&y?| z0y*GEArxj)OfTei@7`S>*GCb>1iPRWqW6N6OsaS&#}9}v*cy1n=tSy zD_gSR9ab1BOv~`$ZorM_5)uSvw}QS~Tn|(Ow~H=S{4)UBlbV`p{CMquCWWt$yk9dJ zuz;z(*dY?a<3|MK;U{aY>5-b2HB6tEf3B%9BKQJ@jeWA4F9wW^9nmOq1B;B&2_HA1 zWWqE2cz(Wl#HIr=F~e{qr_$xl6DR;)gc5fP3T&VCY}{-d`Emmz=F0J{L`ewQ3@I$A z_(SnQ5#lQ$kr16U9rc3db=Q}ge6sglI66-2LXJQ- z{UL{1B@0;mIorjafvg8&&1Q>=A2f%*T+q?Ip35SaF#&9!xT&fOraIM7*+L-;Rya)9 z+R|clx%5+EacwZm)^JPQxDD&qcYhS)e*EsEC8K)pee07T)*_znLP%fXNYTD`-@ZI* zE4(NLi_2{-`eUqi+H>sc{8gas8NNJMS3;%F21+%qrBgJNlunCddf=BZ3{kuG>szZP zUDUpWw?1epOiIF&PDiVR@yymQ_81ymw<~<`)#$fU*gwxeoHN?xgQVS6ao&Et(HbdxYPG0kg%x#w7mPU?pW%irHTwZ+cC!F62J za*gtbMD^j0om7*pV$zb(;n~G`pQhiaV;|FucKG`vbL!r@H<+`+0t(-K0eO+cBa(0M zh4qa{+CR|a0OE$%_ixo>$Vz>>f`` zvON?}d3((-d9ms?Y~8wUoMd;69EoxHhOcjJ0us;4&Q`~monA_7aoRKNO_B&zhR+M{ zbmQjD6BLRp0mGw%mT(G#-#+*#E6dF9@vIed!-A9yr6 z)txBO7y?p8z3&`7B4dG*PbIf5ZlJ`m_orQ}dIDtGr+WB zK>7kdz>3OmJx%20r!GJuc*%U_(jzMH7X^G#(?L>UhJ+5(KWRNkAH!Tuq?)?4p>t9b# zumJidnM`ZX{aTG1S44T=JIl?xGy=G~hfQ74G#XG|7sM@A?04^SkcPJC|25u{pj@F6jAUNNm@of3#eK-ufNRm zc0MD{jCT35Hrk(R*^5jO46AFYticQAwlAg`$0!new|o(V&U_|1;~5nATm@{D(OW*x z58m<3go2{ot3y%TWbtbY$DGt!^n`JS$27C!ej&E+f*2EJivR1+}8_XYnW8JdxkfjXw@PKh9JsBH_u!-+`lc3YLV5 zo4tMEoXLdtRh74Qft>20$OvSyb<<*OLXzCmn`&#+a>b@R~%_AtVco~wemJSkML#YbP)+I zl-|-EJNj*yg1*bncMggwueP7LTyV5|)2Rme5}P}m}|=XsI(b_M5yf~ayMsnXc?K?n||M8Xy}uZG~~hM}*~BGBYE zJQ)_pu%hLf;S=O1d^i3PZ!CL~6LrtMoMoP?BkIT1|5XY~QPp@*HB0~G?}5!hzi0s` zZvQ@<7Os*)bclwAxWzb)1`6JodZP5bMU7kyO`E=RFEgxU`ve$&Y1LFF7CUW$36@OF@*!^P6s#K>LwFf+Lk!Sy z6XBmIF{Rko6evR11_`)=TZ<3X05up+8S&Gipr|kET}oX;L}fgVA(Y|77~SBlme0oy z%-{Nk`ZLpo7iZrrHq;zOMu|<9+d3fj*}q)^nyeNXcW^>xMYnxj=68&hCfTbJcQH>9 zl@|8+_lk@Ak@UcID7-#u3gaU)S{`L&jHVml1aQJ5 zkh>cj{~f>$2M$H}Lgrw9-DUYxM(vWhWxQa+`2Fi%F7tXkE?autEOc^*$WGgzf)6`gz6}woI?xP{k4s(IBY~_rU%<$P2|Ei9-;8+haAsFH zY-+z%UA=Z)yz&y`tdFzbK*@x6%Ln7|y|+Y(;TZOt_}ci;2;sh-M^hPA5mi@HzDPN1 z4&m|Lg(ljDl|SoNk@RS;X>nM>iI5A~U0}NW5sB_E-qZZ@d*CF(Km~=T#OI;}KW3eX zp%TG7Y%&p%!~b>+n2Tog0lm$Y@mpQp+)8IZ`mxG5->GX|`SacGc?+fo>Q@=~0&f#) z>a7h$Lh$WuMhn2uqO-Qz@y?i?Lir^AD3Fl-qD6)mvkw1? zzZo~nH=POq{aH_#0nUmsXP&9tv-@_Y)=g)wnq0qr3)gw?p+{$1UZQo)x7zr}8kD}T z$@C9-&krY6Ml&|?ZqAcC+C>Egw_jxFcM3H=a}o_-#aXIk9YvSgO=uo`u3mM2n5Oki z&DAdaVGNGE6UW=NL%+s(=(lm=rikj!T|4S?J-kWXF07Qg;w7{*BO66OD_(L5yGB^1 z^Z(j0+c~C*uOWs*4P_Je@9zl8fK$QWa)7T&0lFZmudrDD?n3!0o;gXu_kjhW8aa!? zUmHY50fZ&jJy>CyV`-^VwIHB*saL2cWP}(r9X{(hHeYDX4X}IyOB=oFS#R+747;&Z zSHhLgd(WPXaRQ2Gzz@^E2JE8z2%jNId0h{sR46}1WY4v9Ho(=q**x;h#hfDLG|)6t zDbWjF*IqjM=;--jh=syOuido#%e7IbT9bQh%ADo7X@2BO*#$$X7rBYKMmf2Nj`?Wc zc=18kSBDHYbxcg!boa#zP8AR0&usz4I0kEa#$n|};Mb_-kGjN|b~gSM(e=}^;EZ># z`o5wqw^AuNVC6H!#BAI{a>@i{CA?i>sX97)pXDibbe6h>Ah?|8*1hlv<&>xc$#L{u z^Q@&-j4rwqX~X{+Z`(G}Vr)02YZ05M%v|^ zRFX8rGwqeq>zPmUYTROhszTJHe?{?5xslel<_{Cvx2RPU_95>~Zrc zCah4A&PfBIP{1flAkSD#fgk(&fxd^Dkjm-0|O$b+3QXDC4 zB2Oup9G`QpCCLlw&Z}7Ov|E1lW<=c@2gy8(0F3%O^LE89rYfF4F#rI8?<|}Hg>49> zrfBy4Sthgoj`^e~M;$5*_niDLLxgGCIaK#HGwkVKIQBCv%L+ zt3kBLp}uch#nCI3Q&W=>OU>|qTSVo>a?dBM>V{zw5CnfZ(aqbR`-HW9OVtJ$%e($*vcV8rl-eZ+Dv8fZt$18qg$;i3r1Oo$lNj%Qq6 z;rz|LJKI<~FraOqOm0@?P6*qv)HVd#^7}8IJ$nZsPwe=|B_cL8O~E@A7*r^ z<3iPDgVn1|TwfI3O#KVqp6ruz&sqLv%a(%pDnjV z?eXCSf%9K2MgOOh;?{O3Mjx^dvP$?g2_BUeCZH>N+}y~h-eGqpMJ>N(vvYoOVq(kj z9Ge+~B)yC!C$CAkFO-82m0kb&=PkM)bA}T^tf#m-U_TMzh(%(x$_6xN%(G8{8NXN& z_=4k$C;_UTC-VWEyqU4}UuZ@z|2fRJnKHlZyl_{-977oUkc9>N51fs2KBI4{`YCd- zrTLamv3n z!ehCM7<(8dr=2*&R@SIOmT=oSe|ep-eH15X7V}56`GwISUPp7OqeYh-}r@w)s-ncSedw(~I(64$uHg4GCw2Z-!vEaQ_yjHND!+`LSW^iV40P)q?b-6F1&L$*^nNp6wlF7H@3O~LUK4z6E(ORgX(MTo#(T6=u?Yl(O zrf^n^&CD*m%->3*S~UIZ7NDMoS3CUgzaOxM0*iI^`T{Bx<~7WzKR)01{rh{-Youck zv*lg*$_c{84x~Tt;H>G>`%>~SNG0~ObN38NbR Dde-Ea^*!^ zPHE`{_wED5dkQ4-f29LU1AO$f%^2$oEjHtNVm9`jsi-^&n_^GomrwC!IPmWynt|8B zg3gUKj|B&mu>C!af3K9jvffC_0=F$DEH)s#Y{o2nmjY zw0Jlo^j^Ci#-YVtUGBq>O!>Nes=(knr8ulu@MGtFXJrI> z5PI|%n{|Ph;vNV^G4Vl+ln|;Jw-z#lAh(vT`{*C}LoU6mtkmN6i2%;;yhGn0+B?uF zGz~;kTZq~~58pA{?5d|WzGip%LwD7IF5fdAS4?VNbv>U)#cMI~dQp=(#i>QPUp{+8 z)_-+{KRByw>pvyz{kwOf5zRpoBCb6!Q(|!|C#QVYo|j^6B_X`amtLvp^HY? zGwy^_!+PofQMIuGeEYrw{uvXJ&DP4#ZxEl4V7kl2CHLBjvB&g`owo|fL1X@EWFJD& z9v>gSCCB2%3i(wxlm_x`Oz^k`o5dM| zU2$&ytWe>=I%kgWN3P8WF7+FICtRT)O+TSI+G=HJ{Y&ncm&J6 zb!%D8i_jdi&5?3IbxpECHAQ@2ir)l{tvh=%S;r8{Ei@cL0{PWmCsRVyE}|Pk6K_SG zXi@$xY%qE5Q^@AWt`^OlDdD%_+S1Vbo@9DyEY)u_B8pV@o;?>1ULs7~*%5m6b4THD zx{FgEVHP;C@zOs3?QIsN0dk`!7Rk|{({u9>$dAUE*eft_4ucUP^p`|~oCnP76!Q+5 zLM}sF;_H_$DEo}AsxgwlXj)8$3{o@5n{`vfAivn=iDj(7j6&pdb+aHgxy=yzLSO!& za>aOw%emE7jS?|qxMl`_jz4+j&D@8O2GH3huMI?L^MDu1c01OH9_FdS6?7(OYcLlf z5GT)82z7)OdLN8DBWHsIZ9MOXptixg+5iZg6)z!kc~_F(>=dwg%(BsN$79{h*rbSs z(evlmOW!hO;cYmXa!$cV$zSxyHtP;g>KjcVd*qI{)#p8yT{Aii_vw3c60Cx7VH8BZ zuy8|bx)~wQyJkGEHnG8)cE;fz#-Ym@cYb=HQ}-W88h#Ll55;s_N17BmWl?)(DS~jw1DpFe*--Kn(n^uH}#&fqd8 zsp#yM+ISX*O_2z7n&fIgu^ZDxBST(8&b1^Fd@!r&)dq-5Q5pjXZNIkS*fSLbl;~7H z>6R1SYuXp0kw-=3N8@cjzvix)zWv<-L7kFY7IZp|%IuXVK=v_txmM{Prq;IEY_hO` zesaw9$d5m^dnYOgzkGT9-_K%KHeQGg8ZdBRVN$)n?#Z1<30Yrttd)%7P@UrrGWcHh z=lAMYLvwaj!+Mb*1}LALcj+R;tVnCV@~h!{*tH!Q-!1l%6&8xx{G2a%WwnyVGn8`9 zZ&_T{Po@C-brVyo*x7aieq8OIUT|-f^o9W4w)WEV!pGR^V?#vb5k7e!cZi~Zi1opv zvnIlS;45|v^;s{b0oNTkOs538QEt+t;}EbA%&8abCMoS0B?2vRi76i*?h*R4N4m~% z3u2!eUkG%=62WTIze#uQOr=`?)z(G|&op))QDlrt)WV{2bA3_nAXMgDI)%&UUm6Y* z9mzjL7I!^Wo~hWy2aAI2n) z%S3p0c2*VZLGYEiKdip)N#nEP;s9I`U*55|ppbbE*q`Y9O)>4~i(f<9it2Hf+U4wg zbj)`|>|W2Fr1a0QtzZc2BtyfLu?yg`;88i8teF*4a?JDLr4*5UWHT^k{m>ar{?G%* z7Dcxl81FOdCe=LMZrVV!O8EDJFhGlD+;I*8Y*gKBd&kpZA&H5`+R5jb*fz2F6IuLV z&)pfD`ajRSw~fc$d2-#C1kEm4 zpV{-De}udg-mE-LQc^NvmAmUGpOrF(uQgbr1g8pfwO~nr%$!jG8Zb}?L%C&2of!7G zfB*jG_^qGiY{vf3T(9uy$()0{wb`?UMIhqml8f&%3Jd+XTWe+p)0=j`5Y7(X3l}cL z$*OQkg$IV{i__0WlLA30q+`|9MwOifABAiMe}+b@A18**8A_o5wNe~$4)3D6Gs>4Z zX4(Djh7Otfa+^fzT_b1H?t%E5GZfOrN_jH1+%b)%u9|;1J2PR*m!2xIxbSsPaBu@} zSFFz=sYhcjfu0NA-vU3gOoO9qStGZ5_npU`H$2z2m8EkaGrfVHxjp%{J;b=w0*tr{u)6;c2 z>T-Vq)DPw$ggRsNeQz(k-Pbaq@YNze-$kJdr$0`- zAx2;jO-ej`;?rboFLM#iBc?&vrJ7!OUkA(ta`d`rRItD@NXc*g&FoocoAnMz7sn|z z%EvB~f%Ah3Qem_LeMrKcJ0)iVC#tN=h>17pM*Bn`w0S-X9}9c&+7(DN|Rzi{yB8PZdv@F+duBxmY+g^%dj_@M3P(b6fGn}z*>FOL>z6QyzoBm8(zG6qUTI7-4 z@3w-j530L|x?q=ft?>dbaL7(lv$9SwPJ}K}p&**Jnen~Jj0kIMAJ#5CJ;5fVR=TBl zbaCk~+3@Ap7@r4u9OkPz1s3Jad9{rg0!du;u21xxt>yLL*WjY7GA0rs-m!O-Ld#FBrj=oDWZb8xNCgp;4Orv1Yu+5M-j*}XwDMrk=|c-fn@{3{YLGiF!; zY~Q)__R*N-&YDh_JA{o^X5wXhsc%T2(J+$GTh6h~n*?tvPyDMrfX;}a#pJknf>Oyq zWQrnj`9ZD_#8iwzx=ta&3`O=sb30%&h+p`%!`V}13aJ+4iYT$+-Uul4B-eY}W>Ydb zH`N^p3JU6fVR?^=daX%*5SgyU)(^cr)xK-K&(z^`$f*D3j&HNKPYQKS{VVe<)HG#S zNVo%i+uZ||QUXVlZ?^te#!t2Ffp<=AIij>Iybf0$&Su`V+U`o$R}?P{qzqyA^nwkJ z3>`qOoSkCcUP73db9)Eqoogrh%HSyUG$&q$&%v;X-w(q%8!gy$I<&_;LY7}9sINnp zA@-w)CM$GI00F-DL>0%HerT8Y@kKXo%pA$W#tfTSS^8@4?n^1X4^atFDNb+%91!eb zk`>c`!6J<%sgvx*#6k7})5Z_*E zt9@rKlB1Yf{J$0~U3&6I;G)pWU|}&KEy|c5U(6?&-PMLi5iNZj9`NdXI#MHS>9{Xn zzm_w@Rf))rO+4Ma*L3=y7Qjy&c`oeX%B5>hekBTYvhvYqm+c{g>%!ksFba6viM_Rk z3wvBbCcu#>-ErB%^o`-U(mZ~w5dmfcRRi_!)(7YWg@%L(6(CezY8L7?Sj~>YlMc_b zvZ6k&ke@hlBeG`k1+;B@4;bKqNYwuFy#*WXyH5PR&yUN&v)c%X!e?EsXhc{NJvHb- z&6T>ssNd$>)XRmnBo?n#uA`h(Z%b&8ie8xWTUFb81<{-txMSMm&shu>oDohRs!EP+ zzkZ1^E}`LJ%tuIAg^p4TsJOqatV|O|!4O&Q2P;t`jTMvLEHFT=%_7qPnnvz#YNl?LX0)?Re-AhVZ2UvX-((iuh>gz1_J^>jy6}Ks3 zQuV9oQ54>Nl%GJgpujw1SRc}eZ1fbT4x5GH15&Dc7W<~Wh$I{;QfN%|K8 z+F0jKhkv?Rn>;e^Ts?#umNcG!&`jB`XXtWE^DM(gh2*Ib{u zi90?nI%S<(CTV{z-6OmgiY50Aw{9HW&kAH3J*iygFO7};EmlWlhG0*H)YOv{4@TJzhxl`Hk;F? zu3z6R6if?GZJU#m1%)Qvv3`(Oe9j_VX^~OBXEx*`CQf2q1u0kP?BhANQ(86I zX-C{H*CQGQ_wTk(omKQzlQLyt{}QZLAwZx8H%vQ6<4DlvVwWFqOnBr2=)~w8e+j(k zca}w!GsMt7i%%*R48gRPS5!O^6KdF&V({yylt#mhvjRCdbVz0@vSy+ijxC)}iPx%aa|Ms#v$ z#!KaOoc)`vtf$VNHLUfg_wWt$5kR&_Z%t|zpADK}5ELx)3}WHD_w$bwD4=!5XHhU6 zfet@;?p!)<`a;MqsP?RW){*D7%sBq|%+Z%g2?m zPJv_CK&|#G6mZ^KS;$3D_6QWh!@%fF4$=YzWj_F}GnU%}a3v7=_WO}tb z+0w5Uq>8)4XC$^l+e`xF9`Xo<0G5hQbl${JHeI{kbS<_IErOUpf+_Snr_#weAHnJ3 zM4`P9&Ud{q-k=J$zkcKBAf0#pt-@V|rVv(?`sJa@YyYyiLkABEn&Z5>%k9S#u7}nu z`IX%3eel6L?=9cxwiuot;?h{N5JwF@vmzArc(f**q$7*l5bKMhX!118>Ay)xvEuwI zU`t?R0#=R90fo_rTYmhwx##B&P@I4ZVmwMtt|OzI8(+!}84~&K*p^8t2HUqs=cfcu z;!dL68_;z@1(|Ic&1~ENXSlUgkL9BO)1yadc=#gioeQ4Jtt)SBIUuk8b@3a zYk5f2@vrZ>j%}G8&^I71PdnskGNZov`El7fOO=f~r&munl@41!bLPx9%eu^uGtQ(g z|*REbU4?xe2~+1aPhPHxEA8xV7?JaXHHDHr25 z?<=}m{$%^69>$lSWju*w>Brh9w3)_DoCs?PO?)UO#y(IlwK&c?P1s%1 zwZcaeEyVOC>W%%NF*lG)#0(Mf9#xVy6gKF0%Yeah$!1FsAv-4zg(fZDvtnkfgkZd$2;v5K&|~+HISk9Wkc1$ZU7nbR3}CLZf}dHC z3wZw3s!#bnQ%m`FyIrOrtPxj=mQM@GafzaqZyrkSV#Ee|fd-rP=odd*TUoX;NF*v0 znnGR=UG{KNz;p}!$kIEM6M`xSsfcL^F(nG@2&}Y6Nqb_bI!T~!*Ks-OI?eP$9WRc_ zzIkoPn;my#U0hl>cU`VzF?@08@^YRRIuEd3qrsHt8>jJnMYSS)TWLP6|HHTp`}(~9 z(-W9)|3k7DW8*?&z+)3)<292kun!eQ$?vw-_wV0tC=Xh+c(L4w5&IzyRppoSfnd+Y zvYWqhGI|ji5-l1mU7ih-uJkCs;>~27Z!lfj3*uc#_kD|6f7J3zaAEO}I}-0T z$Mf_;RpNCV` z%V}PPf1*ZhY9tV&U(*2z`MdUTBG;ii_4-Xk*=OKDKh*&584mc@*f^}c!>TspTbj!s zJ)t`})Vb=C=3b{2>nEvMUO#N5!u%SRAEJ_zxIJ{ZlLUmw<(@%FNv*bxXC3VA(Lc?9 z)#vsh|AG@xpw#BGt7Bq2;RG4_3HKe4so{$d>z*zyE(7wc=Yt?eiSma z5e44^r+^iBs$8?X02w z+g)ZnY7U?xXTLA00#1!mWTkyx|C6lX5~FJLeqM&@$pCQ_Ha@QDW>8SsCE~`7Fl-U< zOT2#F`cxN<|Hcw7Yq>YPh|Jc#dS{bIE7SJqUH|FU&1&hxRW)Nr{d^koHZ^n4I+P58 z(H6fh_gp={kTfPNL};K{cgnn2VJZqS@^R9O)F1cnYlx6Vz7w-5Q>L8c4P6f!=BPS^ zey_p7T{3&ub>H`9q;s;_Y1!h0=}a43T^X*qdI&A!V^z-9N=t2j?WZFEzw+Op&II3@ z+tbV=(!IK@{O&eT*?1WA0)mjbrkltFA)kPs_AKd6tfQBOT~Sv$B1gZfwCOYxh{-J^fmG|H(8XA1CW5Iz|mWm7Z5OcM3oT5@YxC!nSjZJfCzPVK*l8)7!T%*YycT zDFY`G@31xg*n@Sn){6Sr$lMd|SpS&Hw`owWa_R ziZegFeXH@Gf55vnjxpA7%3PPryT4`rPNv2d3qNXZymq4Ep{`}VnO(eC9zuwzEpnEz zx)30jS@gywad*#?RGNIhnucOul*us?KXqUR*i4~FrMtqNC>`vEl1GZ9T%Y0O1tDSHXFg1<5)syv|JnEY< zF)@RZ^di@=eopiwt>Ru+bV+)|m}kPrnuZirlCr7^HT8Kayx;5>I!rSul?YaSX zevX)TB{!~{&P16WqkOL}a&@kmu-c}Fwv5k*U$?y?3s?s|pe1>^3) zt6S#d)p?tPL%$|VOu^1-?HzD!TJN`9xs=GPTjs9)y18F{jh|lRvpZF_wZ}X?J#TI` zuGs@a_h;pwj`m|)BG=>&qPZJ*uDOp-Z0NCL&xaH`^|N{r!mT=U-oc*zAqzi7B_+8e z_gNt{eXKs_X-;R;5E5fCzQ&RlFre5)Ay#41|C@5*7yO+6wXHfsAzRNb&J!Nay zXV4%d8{PIj9cdRS5CR?DcDMgcR%>Tpd12$O(n;thM=L4y-^ct(z`qOSg*WT__hN-C z`fb`2#rrRIWm1)_(gA(v0^Hs|{k*-NKI+64{a4QKVr7}Ep$adT^p?I{yd_z?@+i}B z99sW6`>hMZA8S4zk(tj}02M*x<+48(XiK%k<&XJ1+<$^0YzwxO$4~aMwrka8109tD z(_4$+OJz>awzszzmLUv4V)wKdg*bgLX4)8Yt(g_9qNX-|&yQ_FqVXXoWcCo4W5>(6U^Xsq349x7oA?VW$`xn}OV@2i!E z22_3;aQN`yi>OYKGZQ*r&?Pc%Ib)M|Fa&sb1~V6>#M7%UEq!%saJ>cqbqSIl#+oP> z26$=a=ESd@4D=oOXaZw1?)6WeWKNkeEe?&mt^pliA(hhfj`Y9SNOsa@qJS85XN}!- z#ehNfW7p9pKBlwvRe}mr>42qZ)GiWC(688fJFG|T`?|V}ySu+L7Wx2@G5>lyh0d9K z3NnpL@i71=Q&tHSrC(tr`3P&x3`|dtW6uQi=vd z9QgGo-l?*DSwZvfKWm#eZuVI`Z(5Pl$is*04!_dVi9RsSE>gX5-SvdqTIw~`(Q$E+ zS7c8_+Mak_8+%3FIL=_9Npq*>P6HS8>ojnqx86S^S}$bWdy_KfM`oMe@ck3}PLs?^ zbKGt!ckWK*^y1__rS(~@L%cNmOL_9osx@n7P1t0{@O~6xhAn)+E~azeZ<`5#2|*2O z1vBce>KIN0bGhG9DXBy(2dbS-vt$L0jFiv=YbN=eCI#O8>nf6uUIKLD);&1T zq4Rc+XXV?Te%dLoppZGiXsp-bX`8ZacN}-xHGHt;x_|abK3sk8TmN%m*H|7F38{&| z!ET;{>B6n*WdVk#>h?=d-@G_V(`WI{(X*3E?DSUBS9CkAWxr0nb|+e%gTb?;Wwqt{ zWCMXBf|3#wJ=9gKV~QLeb{%UthqKtz+GWu0p(nJEOBm2g5-r#hY13cNUo;`w)ro_R zXm(v>=eh52K`ub$98u5Emb+R3P0FM|Vew+*k| z+*M^X+h$y7>N_QmS2Z3B*rGD6>gynnsh8DP(xiy+HTKqCKuIxbhg3m~?4Ulw?0q}< z&2%~YNTW_}bW=MMu)1TPW2x*_x}x?uVLm!Te|B_0Gjws>i&fW%&oW@$zA zK;k^?(}>2LnE3lp2U@!oXPz}IvK#NFS8Fh9nL?VE=zQ=4EGJqKkdvX>0y> zRnPB7QU`iz8mZ6GSQ9NdFQT`dT%TpEj24^aBgHm?%U!R=#H>ICeu0wEHy}W*YKOLZ z%rNDxrLu+6$%j+mSXM%zB{=qZHGRXJ-jDSs;4u?tku@}#{!H+!kqu+}b+ZInKg-PY zeg1JdGaqZ3x-dd}>&%U)wJBySJ$O_)M$;or(4Veymi5si#*Wp(FEw~p_y;y25t~Op znvz#kbWLoU>3*Z*$`vbu;m|7!!sBSt)E?@qzwXw?)2mjltfKw7!ouPTjI|?0r8O-Z zxz%!K*+5jn_Cdb=DkrCSrX6P1seYx(MWgH6e*Zr1+h=Y{enG(#%hbbTa}^_h@AXl{ z79%x38|N%ME6%7gBR2*zDk+t;auG*R zxZbkkaXjCcy?B;sfpgw8Pua11Jm>tR~y|w9xoU~VXSePas4j<|7=O67Wtj$NR zI9dmC!(e!?K{?9ze!T0>-&Bo|z(6QG*J=$*M>Vn1$Y^{}))f}b!geP3&3S#t{tET! z`1s;T8YpdPdw+G=^r!C|yf6pHU(iTDF7b3YcC-q{vD)-fRuYuRq7a#3LP|SYtLx>^ z(1lp3?6XU(9>e@StjQw8XoDN}&l)xAQQ}n$W1Br4=Ix)q0fcQFXXQ)T71?)RK|#T? zq51n2jBceqvzs(-+)Ml=LixNKPiwi~V+!F-OG?`N=t)u@%ueZwM;Ma4|26I0dSk4` z`rhlxXPTYEBfG0x&;X#*Pie`I`q1dSDW<3aRarH=lS0khes1CvZnqiS zi8y!XjuEYemvkVa@aWSAu3=%ij9a3w-k6s#OYGWKWD2QM`*!%vRnb@+J9qMaLXaya z04=PMzK%!)LlRx=N-nT;Q}Olu+Q*7|yJrn8`m~c3GoUZqSkFTprs%C;r*uK8gQH{P z$%^2`xv|e$Rb{34qL!|5Q~aK9TBY38eV#u%=-#X@_n0@reIA8hIpdy#3)3`y<>lvJ zyM5aLbHzSw8d94-s5Z!5!~a?zC+-^ns&J|##?q_C&iQ$So9p;Or7|^gaR1I@rM;}c zTFx{d8e@Xm79*Bgv}8#kyMs0i+57A3!BX7qZWA~ngPcCS4#n|S`NDk7^L#T)xOju6 zn{uCEl=^8oY$F^k($iZd*T*}zI*()0z>u-kv(w`jj~RWE&tH3F?1ieh$uN=s7Jq1l z&~RV}XO&Y*Yv2X97E4D5hbq3l03sy)opvua6TPI@kJH`ApKWfgALZBTBt&Fxe7iGA ziD_(ggrd{*R>1MS#xdnaa+9$ugTaL?iB-fLnF+M?Y6k#8Ly;4H$&D`W(699O((K}3 z-s>+E>8tvsPtuf6^*_&sjZZ3ZdnsvuCHGF5wWWX9p4nnyEG^6i7V=by^+^Qw$o?;#T48m0(g%dJY`2lp{iJTwu|bE{Vx8^4|#Z{fc= zXp`IgOD9=v_h!;99JZT_&tz^^tGjh_l=tBS4=$ps$;-*PjQp*Nk6g&{4rkA%ub&@` zQ+j=KEmXpZ;`cNvSBT^5fRg(86iI?|&8_E?azU4{c)( z;qnp<`Qm4#_bU9YHDi~3TN)b|m;U}MPAz)i6-=n|XdCoQsxSAxoSbaR3=18e<<8ED zVzIiZWB#gxlUj##a~BEb#*Ik~HRKe^KTwf9Zsw~;Bz!-+JTNFIit!d0T76&wFF&8- z@g%&g<3|55kvVGrFVhe%V`S;JtM$EmhGm%Ur_A}ji?%p@wC`rpCBzyjfmOhQ&!BY;;#$S

1TJv4d745xltj@yvi8OLt%7H3R6Qh*k-+y~IuUL;;+BQ=Tt`IF_( z2!NG|CFA-X@8tCEe_DWUmQ-ruxVvu6NoDDqW2$i-%4SB+feke^X!chz z3Uu*#^N86G%Wn!llD6`mdzWfyd6NA^@aJQj=vnlhLqb9@n2%T?1lTuW)TsIV4lhEi z@l`~FqIY)6T)4hfIyy%P){spF@*3uYJQ&Z&uiWTmKFG?(W+mbMrTco26n4!Im6K-Z zt>9TaOHWr>Cy@&NojyILEJeoS62(?%SXh&@0!NHOAP%!$uIc=($&F`dK5dFG&Mzs6 zB=gin#JspAeQDJ8^9TjHb!_jEj+u!z0qXG=o_~)XnqJH|J!7n>Vjr(*gb)%R4ZONI5YMu* zR$E$L!=AUFWM@ZSh!ws;kEE9@*_mVtMV!dIKqEUPjL|;;`3g~SUnwXs2;BMFvW2Zv z;T+ZWKSpKLHimQB;gWM`%`_mSs3NYfR+L@^R_E$FJnp}G3zt1uJ+F;GoL>2zH*Se* zP7B0%EV}O(^ZTxha9G7X0m_2dJse*2@zRX+*$q_SO^lH6dFycS)(!H-gOr#OUJ)_`R5Sb=gnC}^weAEr3fpN-PB$*7R> z$=sYvneV{HMFHSWmDR7tXbBZOvBcb zEiKM%Z@bJ9#o7ConK7F)bLgbUB2^>H>G5eXS;SF{}lxm20^vuZZAd2`LlzzYMkm2{Yi6V@1jplBTNmYJ*K|v`%f2_e_w69 zSz=e;sCq7}sJ0T~!&)sm<*~uOj_un~PQedrgZY2}sugE9IFvXRR`dEdpL1D`Op3{Ti&xHcK#Mn#}uV~3HIt*vj`dvEhWnAUQzuwuOBRyt$L zmO&nXYsY}{X_CQN(iM3AKeO?2H5(%331hM`rikE4C7dfSldq`9PcnYaoRmU~Sp|wa zhrjpgB(@+Skd;Z%L-&IrNTAAR8M>^Q`%vE_*BHwtVpKIuL@)3n72&Jl4kk; zDNKxvirlWh;V%bX^>uD6-m*hAkOK6S`Jic%kGge!ZKF*3-U7shNm3%#Mde?T2>_zjx1!2L^74Jy0;ef6~^8 z7muZW{JJZaX^7fNwh=50&Q1ujZ(2Ojk*WaDDk`u{w#Iz$>zGa0!B~EQsKN+sBCc)4 zbC8<#$(Ei9mwHPKZtwZ%5?cOh=1{Yt=Waj^t|jM)ssI`HHQfPegW%+%Z}vLQCTjgN-4G4h=c~ko^mAJy5;ntF!WnITW zcWj#(;o;F)9US3Yan2&vxzS4JPyI$kZY#&|@4-*{qzt<0QKRz7n!Awr?x=hN^@xs- z-Myci6-*OPcmLh-E7SYcK!!pP7{p^3F$a%T-T&&gp(Xo~q*akq3z=7l4$hl_n@C4Eba}G@6xs4V32AcnCeq$XLlzB~D4hv9-TOem+6v5DuAfo=7cj=^XjN(OGqrOUHU#-&C(pk9SO0_PCPsth6!S`z8hn~vgW#zBu zeE%5`b`7v&TXbt778|$3K55&M#8u=)bk^+S;pQabo!`K4dRs5`Q=^tpCf)lUSbr5n z&h%3hxiJ)xI3LPzw9ERwM<|Xdw=@GUY8}bn>9Xwp^8@#8@(<%w z%IP3;_6g~$KXYzb+h-?7K8uL?9ozRcB(5_t7RB_jnLtP&j0Sqr0wRC=xhMSEwPm)p zkzDTFS~qU)1TAuDe6H*P&khAx#O>#zYIX1G)XM%ub>(c z--#<8x#44np0h4u{2`eb(MQu@rfdN>HJ@{gV;|X^Ox45sI2iTscgEIH3AL0;;ES2Z z2Yt=qt0JQYY430bEPc*@l3_LW>NHC zM+hWz)A{?RjT@`LNnXW2jc$#Un6`k|q>8CqIeJyn~%4At^^(2e=$dxCdT`<_&21CrapDDeA}|NR8ARE;$2Kja;k{l8G>22Dmb*I> zF5x-oLo7@u4wH&I{%L2DzS<|nK*s_j<9mDVz-nFxI&tk>Y2f9MLG~C%y;NQE>CK%L zV(ney-apNI8L?SvY8oie2b<6>Qx|Cs^0)-1Hedze5!$D=oz_B}Od?irt(6oN{}ywc zYii1kddsC6zw+2`)AOm)S^Q|qhvwEeFf}_e#^%Xw;e9hqpyc-J$Lz_S*U$X{LL`aX zmfkf2JnFHIjF8e02z=u2CjgeVR<_2*~8BYOOgf-eR!C?|EoOMn-SbO}%xeRZo8KL8JNDf|206`7Otv^jQre z^_1NbTl@*!Qun>}97wl5)q{cwaxMR^%I#^xDg8O`u)!0~?e*;XXv)fE%UJC)&GnP@ z+FVpFH;5V5zMff?x$qv59%(p%);I2Exw_zX8VAc(SwyFNf6q_QCLJg3aS4ZkxkI!( zrjH-k{dR+ILVi)v_*})FKU`1f&3t@(I{v4(ia+t_s~p`<`um5A%t7Q53@bzFyls2! zK363l2~rG->?&fDHMHel!c$!W#@8Sb{^VHvNGU-k$!>PPmToWN;^Uiln~-#f=LCI1 zx=xOfMPMis2ummy@3Mb5=w;zpC|Kz^Zg)eH%Y3QK+gL7^JtO6(p2C`hZKt(7FR;(1 zK}@%OpTLStn#4nMeos{{9Qi45O?_S6;#c2-v=aHtxs`^Sewdh;#G&nTe^j2(B|;=I z()bc_WN6cJuRb=nIx^nyoWcdPyZEa0{ZU7Fboe@5W{SZ0K@;sYQx>|YzW;anICH07 z9W^{2R6AI`N!XrBCww#JHM!K|+t4kEk6;&@{&?Z%LT^*h1F(z_G`%j#8 zos-bT%0cCP-b9%tnpA`P4ZlpRtZLl46hVGL!QU$Ec1|Q-$O;;W z2Gz%wj*~l)wjuDaup!AuH~G%rRIGlv-toAle8i@fT)ELf97Wh4uGohRJ+}WQ=KE(U||BrGgyAad=SYwuEnfj z@u0z7J2Dj-tP+}6OVw#qo>G7QEA_(sI<>5Y`Q>aX8xM#; z+kCq;i}IR(nwoaXcO7rgVfGkluV?km&BnIb_S0VRB!M~*hsifKG2I$Cy90$+-Ae?} zwnLIO?EjHHF7EWXbC$^iK*sbo|K3CnAtcQz1A}LL7vd^_hIY!ocujub{9hOeF;Fly z&n{k+riHcJE^esOW}!y%fwf5Cmclywj+d3GB*{u$FZGDN*g#e7tbW3~&yfWV8B^05 zj6SU^+x~dW$lTmqNBS*S0s9p6Ft%8D7nyr|2XJ4R_|iK!Z6WlNL9>kJ(~Z;&eBqFGsGikbi~0|5$`P}aBbh~x_&g8%U?Sn zFP>I@M+&NYC2*&|*foQqLH@=G&kojra?vaiMI*FjHZ2gkX6;d#>M-qbSYPF1zY@}x zr)lzQO0;UwbAaHtDDp|$S1B=oVye|4rxdZ)YqK)eb(s@H@ht7&0YzVc-ibiUf?q0- zVK3b(m(~S4&o-c+8@1Ta&_3O8$eXjIDmIMDfANRhXT-<0?4BvqH8oocgkK(bohaJm z|7Nh-&ItWEZ4PY}Gg1b}9jSjc;SOg@7?TPiB`SuY@vm#!j^yv!YHcmE)3kj4Xjv($ zMw_L5-$l2SM5jAm$-TxX9BD&<>O?lXDKbKx2Vu|L&~t@ z98Ezofe1RhUefFsaN%QelS1&>jKMdK7(e@_(b6jGb=vj%)P^gS37wO|$9wOZHB>yK zM8^9g7Kt^TA|W=G{b?)Pe*NaYOKhKYhL>}sb~gSPwLY|6(C&)Cfvi?NSh|^qga|Wg zZ)^PC7z5YYp!=3@ekrrsXGuI-W@2)k2y8_iElwh5>c#9<8xh$?-A>GS|FsI#`Lhn;^g(q_r*WdgHDeQ#kECuB6M3?)C~}0om9wM7 zKl^0clS6a#6jrt~~_P!y*aD!<Mp{}5Qzp?_!CieWub)ZN*p{dS$d80Zm zF~hod>qb}P&f3n?B_uR%U5|j6pv>LnuP_B`L##+TNHU%!!qCM5sWtE-}a(Nekhcjd0xog`P# zOXmJw9M)E)#XI$RR4%@Ypt1j+{p^~76!n6Ai~AN#&xhq+yp@`&s+SlhT^F1Q4CigQ z#mJD%d(X<#+yq zOj?{vDS8IdcohO8u$$n{>AAQ$8d{8{|M96PMoT0bZrBw%Z`Ks7ZKb8v4#uO)*RNNK zYpofPSJr^5IWga zhe%-1W21xw_g^%#|NP4OlV|EwvZ*oA(#k3){$8Vkg4ta|!ECY%!t0jSVM~7yDlY_X zHJJMqLXNJ6kzWlT>l@OSsvRa$Y>YL&wK4tVuqaAU{L-Tuu_QGUg!G)f_rzyzDII+h z%-8laYi|LK!YFOI^^LASg8uv*CNS2h3kf{-Sgcl(f4n>9jDq(+o@NZ0fhHA)-jV?r z!C33h{`sNJ+3K-R50^3WEp5NsT2AyhWa&@Pl~&tnlhQi;(G)=uTNg)%D~_5P#s1D| zb-SmFCQ$|pECmw-%ho^-V}4HQeJ$=egfvTdN1EcD;;&*K2F2{5{(Dr{cD>d~K-CCR zt&M4rLNxFZzC&|L_wCQBTw!7oAb0K7t>suVB#+tLW%<0TR|v}JGDNu;e*XE=I<*(X z(y*|w5q{I9>n3d~D^9DKS5HloQ|b$&*r}j)NRn%W_Z7K7Y&o29Y>`UJS>1Ld@JHwN z?Eo5<3|s(GU)Lvx-?(wxYFC=u*iQ=A`peh$jRDXSXB$ws{Bl`A*4av(Z=v<9%Xui-;;f>Ukwu`8&3OWWGl#XW;9 z*7p8;9#(P;%Mg^eFwQnnr=Z4};&X+*%0eJg0bQhs+I;WNDOKBMN)6gJ*zQ~TrM#GM zt*ix+uN>Ec3vg);g_9C=CZyFexjxa(7j;}Jhavn39`^f-XCh|fo~D-XY4_%a`k953 z^YZiZs`#HdmRACm>ne}_c$Kg{7*IJYE;e?Yx_Ze3*Cx>`gPrr-D4D%wrJB>{JUX0z zc>vfKpQbSz6W2@{>~V<`LZj9AV|3q4T8=G&)~^aRDj%SPAtEThxpXZgB(>#uA$>ry zc1~#_c5GZ%U7E7l?;am>e6u|*J7CA*fA&dq5d3-C5T`0ZJtJ#jGh`G1bm7R}*6n8$ zEWT+mCh0G0*>>aVVZCYfCNoq9Ngg-;dG5jK*)`(_c*hsnbQ$6TRF*o^dNgwVVWp;{ zdd_M7OErU+k*TbiOEK%=lW(nU{F7`)+ga8N47wo7gh1U==Q-|Ea@fQP6P5!of;Ktv z=UXPW1<>%NW^1^UX}I2CFXaKS%GvZg%u+=~Mcb1B@=A7tJlJSX8i=T62sVTS2via~ zxL)7g9Yb9ZlH50lW}-ou>*C?PmM&U!RIu|^jK8encT?WWUVZ)A*tOoJEEgF@2dehNZr#jcTVO3j)Io*`7 zv6*dMX6CED+Wv8i*5lt7=$uhAaujNy|MFET&j&*-%HCEF>(hzr+zX~wC;-r?m~oU= za`&yRuhW}?!9b;ww6@1=WFrvmv}@dC=A(#1$YcLhZ7+59iWSqVJUpQ35m+28?rKeh zH8(HcCtaGRZ_ui?4){Q9vmQ-@fyL+aWBf|&R1t;^6V1kF8_mzU?(H){RI zJ<>8VM8}9qL^y)Us8!A>O|N~>u)`s##9-^e3*>)3DcvA|o&$P<1s3PGd+?LItlixs z4O58gtk7LZDy1|`WIu>w_QHXd6!sefPV@m{2p}S20NE^Doc-Ws+{P+_LFTmO&hfG; zd&p6NJtsfGv_J@p(|f<{Co*xf{E1Sdk;C||Xnm2(wPZf2Infny5RW;3hQrMhqU9xT zUT7D8Jt5&$iwljV{wHa05x64=N$90l3JYwvXTv4hOX>{obuz2+l%>CcoQjgtDk;z4 ztb8Hp1cv|>4>7%6 zt*C=|_zhXLjn4p%a8^hO{uVab*(3P0yfyT1T&1UW@y}};1x*IY_Swm$bxa2O0=S#T z;+Sn$KknL4^wzbphot8t*w@xht2s3X9=yFc%(`sq&~aOEjYn}rtX2HmEA4hII(ivf zsCEX$2a)}F^cMxu&VJrotIkX`qjYvexK<;WEegai5(UEJ>eyWU+`^RKjuZu);3uJF zVTHAyW=!d)J5>GUo5SXVxcLQE=e#!#(hRzO%=u{Kw3<7K%>3GF=v->U!dQ@Lc6?6) ze)@#^HAF5bdrO8NTXOvFIXrcCl*(IoZ^osiTk=|7JeiQ7UGqKWcKxDw!wugqbzc8z zr%RN|v`14ScF)XJ6u|9kYQ=!wdpl}~hbJMiO(Rv6Kf{(WGDmh-)Asi|P|dKY#~AU7g0q@KA^_IqUXk-AH# ze;n1bI&Or#-a`nlxSWXMh)sFGM92}ii}BK4qD6<||E8T< zpHrm(Ex`uEj6|ZmSx(vaA2Y7XB?Y`*!zfbJ-~UlIqDP8+#I1OmnnSCYNOVdbq>=5s^V{{H4? zj0911OzB>61yMAJE7#VC%9sAr``I4wdIx7WUuavcwS3}Jr{NFQZA~7?1Z6+19JehIt5=!10dKtrfSM|MLeq7?8|9;kOhgu=J;~0K0b;w@m z)6`jY{oEtOca7mU*FI{#*O0O&>X3v)Cr_OPb5}~P|4>mOHGUntnWa>VhRItDm>liV zH2>U$A^K7Nt}220G@z?RV?}3dpir|;z^}!wxXW?H|D7#~r(8RFWPgP=wAibVSw;U= zcC1+`hV%s$*#G=t-(*xyC2sqrfP;uh#66bz((SBa(24y`r!lUSSzdO=l~Cn1c)Dig zdHWY9pIzYg4zbUe%2^unvW<5Jc*Xj8WUitkz5MGTAq&JK_4V<&49|akuJXR}5fbhH z`}h(PJ})j!p74JjhJ?hFhd_h>^Phbo^Cdd|@BhdR`QO_`8ByI!qTT=gg^uU{9;JkY zw(9@;NhLIL{=eTus$H-D{ehDhnf>p7|KD#x$@zaD)c-wET!{aBFaG}lBwF{|zfHsc g7b_&*RsZRb*L%Xxq49Y=#Bb^>)L(F8-ns+-5BSiP-2eap diff --git a/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx b/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx index dbee857fa7..0a0179ee79 100644 --- a/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx +++ b/docs/user-guide/tutorials/prowler-app-lighthouse-multi-llm.mdx @@ -22,7 +22,7 @@ For Lighthouse AI to work properly, models **must** support all of the following - **Text input**: Ability to receive text prompts. - **Text output**: Ability to generate text responses. -- **Tool calling**: Ability to invoke tools and functions. +- **Tool calling**: Ability to invoke tools and functions to retrieve data from Prowler. If any of these capabilities are missing, the model will not be compatible with Lighthouse AI. diff --git a/docs/user-guide/tutorials/prowler-app-lighthouse.mdx b/docs/user-guide/tutorials/prowler-app-lighthouse.mdx index 4dfb3fef8f..cf4886d2ee 100644 --- a/docs/user-guide/tutorials/prowler-app-lighthouse.mdx +++ b/docs/user-guide/tutorials/prowler-app-lighthouse.mdx @@ -8,24 +8,33 @@ import { VersionBadge } from "/snippets/version-badge.mdx" Prowler Lighthouse AI integrates Large Language Models (LLMs) with Prowler security findings data. -Here's what's happening behind the scenes: +Behind the scenes, Lighthouse AI works as follows: + +- Lighthouse AI runs as a [Langchain agent](https://docs.langchain.com/oss/javascript/langchain/agents) in NextJS +- The agent connects to the configured LLM provider to understand the prompt and decide what data is needed +- The agent accesses Prowler data through [Prowler MCP](https://docs.prowler.com/getting-started/products/prowler-mcp), which exposes tools from multiple sources, including: + - Prowler Hub + - Prowler Docs + - Prowler App +- Instead of calling every tool directly, the agent uses two meta-tools: + - `describe_tool` to retrieve a tool schema and parameter requirements. + - `execute_tool` to run the selected tool with the required input. +- Based on the user's query and the data necessary to answer it, Lighthouse agent will invoke necessary Prowler MCP tools using `discover_tool` and `execute_tool` -- The system uses a multi-agent architecture built with [LanggraphJS](https://github.com/langchain-ai/langgraphjs) for LLM logic and [Vercel AI SDK UI](https://sdk.vercel.ai/docs/ai-sdk-ui/overview) for frontend chatbot. -- It uses a ["supervisor" architecture](https://langchain-ai.lang.chat/langgraphjs/tutorials/multi_agent/agent_supervisor/) that interacts with different agents for specialized tasks. For example, `findings_agent` can analyze detected security findings, while `overview_agent` provides a summary of connected cloud accounts. -- The system connects to the configured LLM provider to understand user's query, fetches the right data, and responds to the query. Lighthouse AI supports multiple LLM providers including OpenAI, Amazon Bedrock, and OpenAI-compatible services. For configuration details, see [Using Multiple LLM Providers with Lighthouse](/user-guide/tutorials/prowler-app-lighthouse-multi-llm). -- The supervisor agent is the main contact point. It is what users interact with directly from the chat interface. It coordinates with other agents to answer users' questions comprehensively. -Lighthouse AI Architecture +Prowler Lighthouse Architecture +Prowler Lighthouse Architecture + -All agents can only read relevant security data. They cannot modify your data or access sensitive information like configured secrets or tenant details. +Lighthouse AI can only read relevant security data. It cannot modify data or access sensitive information such as configured secrets or tenant details. -## Set up +## Set Up Getting started with Prowler Lighthouse AI is easy: @@ -43,11 +52,11 @@ For detailed configuration instructions for each provider, see [Using Multiple L ### Adding Business Context -The optional business context field lets you provide additional information to help Lighthouse AI understand your environment and priorities, including: +The optional business context field lets teams provide additional information to help Lighthouse AI understand environment priorities, including: -- Your organization's cloud security goals +- Organization cloud security goals - Information about account owners or responsible teams -- Compliance requirements for your organization +- Compliance requirements - Current security initiatives or focus areas Better context leads to more relevant responses and prioritization that aligns with your needs. From 5f2cb614adf31038160447ed1dd6074fc0daaa11 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADctor=20Fern=C3=A1ndez=20Poyatos?= Date: Mon, 12 Jan 2026 11:40:36 +0100 Subject: [PATCH 037/337] feat(overviews): Compliance watchlist endpoint (#9596) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Adrián Jesús Peña Rodríguez --- api/CHANGELOG.md | 1 + api/src/backend/api/filters.py | 89 ++++++--- .../0066_provider_compliance_score.py | 94 ++++++++++ .../0067_tenant_compliance_summary.py | 61 +++++++ api/src/backend/api/models.py | 89 +++++++++ api/src/backend/api/specs/v1.yaml | 80 +++++++++ api/src/backend/api/tests/test_models.py | 170 +++++++++++++++++- api/src/backend/api/tests/test_views.py | 91 ++++++++++ api/src/backend/api/v1/serializers.py | 14 ++ api/src/backend/api/v1/views.py | 111 +++++++++++- api/src/backend/conftest.py | 104 +++++++++++ api/src/backend/tasks/jobs/backfill.py | 128 ++++++++++++- api/src/backend/tasks/jobs/queries.py | 134 ++++++++++++++ api/src/backend/tasks/jobs/scan.py | 141 +++++++++++++++ api/src/backend/tasks/tasks.py | 38 +++- api/src/backend/tasks/tests/test_backfill.py | 62 +++++++ api/src/backend/tasks/tests/test_scan.py | 121 +++++++++++++ api/src/backend/tasks/tests/test_tasks.py | 15 +- 18 files changed, 1505 insertions(+), 38 deletions(-) create mode 100644 api/src/backend/api/migrations/0066_provider_compliance_score.py create mode 100644 api/src/backend/api/migrations/0067_tenant_compliance_summary.py create mode 100644 api/src/backend/tasks/jobs/queries.py diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index fe0d702a77..78e4bac36a 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -5,6 +5,7 @@ All notable changes to the **Prowler API** are documented in this file. ## [1.18.0] (Prowler UNRELEASED) ### Added +- `/api/v1/overviews/compliance-watchlist` to retrieve the compliance watchlist [(#9596)](https://github.com/prowler-cloud/prowler/pull/9596) - Support AlibabaCloud provider [(#9485)](https://github.com/prowler-cloud/prowler/pull/9485) --- diff --git a/api/src/backend/api/filters.py b/api/src/backend/api/filters.py index f626732477..95c591104b 100644 --- a/api/src/backend/api/filters.py +++ b/api/src/backend/api/filters.py @@ -37,6 +37,7 @@ from api.models import ( PermissionChoices, Processor, Provider, + ProviderComplianceScore, ProviderGroup, ProviderSecret, Resource, @@ -92,6 +93,54 @@ class ChoiceInFilter(BaseInFilter, ChoiceFilter): pass +class BaseProviderFilter(FilterSet): + """ + Abstract base filter for models with direct FK to Provider. + + Provides standard provider_id and provider_type filters. + Subclasses must define Meta.model. + """ + + provider_id = UUIDFilter(field_name="provider__id", lookup_expr="exact") + provider_id__in = UUIDInFilter(field_name="provider__id", lookup_expr="in") + provider_type = ChoiceFilter( + field_name="provider__provider", choices=Provider.ProviderChoices.choices + ) + provider_type__in = ChoiceInFilter( + field_name="provider__provider", + choices=Provider.ProviderChoices.choices, + lookup_expr="in", + ) + + class Meta: + abstract = True + fields = {} + + +class BaseScanProviderFilter(FilterSet): + """ + Abstract base filter for models with FK to Scan (and Scan has FK to Provider). + + Provides standard provider_id and provider_type filters via scan relationship. + Subclasses must define Meta.model. + """ + + provider_id = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") + provider_id__in = UUIDInFilter(field_name="scan__provider__id", lookup_expr="in") + provider_type = ChoiceFilter( + field_name="scan__provider__provider", choices=Provider.ProviderChoices.choices + ) + provider_type__in = ChoiceInFilter( + field_name="scan__provider__provider", + choices=Provider.ProviderChoices.choices, + lookup_expr="in", + ) + + class Meta: + abstract = True + fields = {} + + class CommonFindingFilters(FilterSet): # We filter providers from the scan in findings provider = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") @@ -1086,39 +1135,25 @@ class ThreatScoreSnapshotFilter(FilterSet): } -class AttackSurfaceOverviewFilter(FilterSet): +class AttackSurfaceOverviewFilter(BaseScanProviderFilter): """Filter for attack surface overview aggregations by provider.""" - provider_id = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") - provider_id__in = UUIDInFilter(field_name="scan__provider__id", lookup_expr="in") - provider_type = ChoiceFilter( - field_name="scan__provider__provider", choices=Provider.ProviderChoices.choices - ) - provider_type__in = ChoiceInFilter( - field_name="scan__provider__provider", - choices=Provider.ProviderChoices.choices, - lookup_expr="in", - ) - - class Meta: + class Meta(BaseScanProviderFilter.Meta): model = AttackSurfaceOverview - fields = {} -class CategoryOverviewFilter(FilterSet): - provider_id = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") - provider_id__in = UUIDInFilter(field_name="scan__provider__id", lookup_expr="in") - provider_type = ChoiceFilter( - field_name="scan__provider__provider", choices=Provider.ProviderChoices.choices - ) - provider_type__in = ChoiceInFilter( - field_name="scan__provider__provider", - choices=Provider.ProviderChoices.choices, - lookup_expr="in", - ) +class CategoryOverviewFilter(BaseScanProviderFilter): + """Filter for category overview aggregations by provider.""" + category = CharFilter(field_name="category", lookup_expr="exact") category__in = CharInFilter(field_name="category", lookup_expr="in") - class Meta: + class Meta(BaseScanProviderFilter.Meta): model = ScanCategorySummary - fields = {} + + +class ComplianceWatchlistFilter(BaseProviderFilter): + """Filter for compliance watchlist overview by provider.""" + + class Meta(BaseProviderFilter.Meta): + model = ProviderComplianceScore diff --git a/api/src/backend/api/migrations/0066_provider_compliance_score.py b/api/src/backend/api/migrations/0066_provider_compliance_score.py new file mode 100644 index 0000000000..f9a6483e4f --- /dev/null +++ b/api/src/backend/api/migrations/0066_provider_compliance_score.py @@ -0,0 +1,94 @@ +import uuid + +import django.db.models.deletion +from django.db import migrations, models + +import api.db_utils +import api.rls + + +class Migration(migrations.Migration): + dependencies = [ + ("api", "0065_alibabacloud_provider"), + ] + + operations = [ + migrations.CreateModel( + name="ProviderComplianceScore", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ("compliance_id", models.TextField()), + ("requirement_id", models.TextField()), + ( + "requirement_status", + api.db_utils.StatusEnumField( + choices=[ + ("FAIL", "Fail"), + ("PASS", "Pass"), + ("MANUAL", "Manual"), + ] + ), + ), + ("scan_completed_at", models.DateTimeField()), + ( + "provider", + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + related_name="compliance_scores", + related_query_name="compliance_score", + to="api.provider", + ), + ), + ( + "scan", + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + related_name="compliance_scores", + related_query_name="compliance_score", + to="api.scan", + ), + ), + ( + "tenant", + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + to="api.tenant", + ), + ), + ], + options={ + "db_table": "provider_compliance_scores", + "abstract": False, + }, + ), + migrations.AddConstraint( + model_name="providercompliancescore", + constraint=models.UniqueConstraint( + fields=("tenant_id", "provider_id", "compliance_id", "requirement_id"), + name="unique_provider_compliance_req", + ), + ), + migrations.AddConstraint( + model_name="providercompliancescore", + constraint=api.rls.RowLevelSecurityConstraint( + "tenant_id", + name="rls_on_providercompliancescore", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + ), + migrations.AddIndex( + model_name="providercompliancescore", + index=models.Index( + fields=["tenant_id", "provider_id", "compliance_id"], + name="pcs_tenant_prov_comp_idx", + ), + ), + ] diff --git a/api/src/backend/api/migrations/0067_tenant_compliance_summary.py b/api/src/backend/api/migrations/0067_tenant_compliance_summary.py new file mode 100644 index 0000000000..bd753ca575 --- /dev/null +++ b/api/src/backend/api/migrations/0067_tenant_compliance_summary.py @@ -0,0 +1,61 @@ +import uuid + +import django.db.models.deletion +from django.db import migrations, models + +import api.rls + + +class Migration(migrations.Migration): + dependencies = [ + ("api", "0066_provider_compliance_score"), + ] + + operations = [ + migrations.CreateModel( + name="TenantComplianceSummary", + fields=[ + ( + "id", + models.UUIDField( + default=uuid.uuid4, + editable=False, + primary_key=True, + serialize=False, + ), + ), + ("compliance_id", models.TextField()), + ("requirements_passed", models.IntegerField(default=0)), + ("requirements_failed", models.IntegerField(default=0)), + ("requirements_manual", models.IntegerField(default=0)), + ("total_requirements", models.IntegerField(default=0)), + ("updated_at", models.DateTimeField(auto_now=True)), + ( + "tenant", + models.ForeignKey( + on_delete=django.db.models.deletion.CASCADE, + to="api.tenant", + ), + ), + ], + options={ + "db_table": "tenant_compliance_summaries", + "abstract": False, + }, + ), + migrations.AddConstraint( + model_name="tenantcompliancesummary", + constraint=models.UniqueConstraint( + fields=("tenant_id", "compliance_id"), + name="unique_tenant_compliance_summary", + ), + ), + migrations.AddConstraint( + model_name="tenantcompliancesummary", + constraint=api.rls.RowLevelSecurityConstraint( + "tenant_id", + name="rls_on_tenantcompliancesummary", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + ), + ] diff --git a/api/src/backend/api/models.py b/api/src/backend/api/models.py index 464207e111..aa568bd17c 100644 --- a/api/src/backend/api/models.py +++ b/api/src/backend/api/models.py @@ -2605,3 +2605,92 @@ class AttackSurfaceOverview(RowLevelSecurityProtectedModel): class JSONAPIMeta: resource_name = "attack-surface-overviews" + + +class ProviderComplianceScore(RowLevelSecurityProtectedModel): + """ + Compliance requirement status from latest completed scan per provider. + + Used for efficient compliance watchlist queries with FAIL-dominant aggregation + across multiple providers. Updated via atomic upsert after each scan completion. + """ + + id = models.UUIDField(primary_key=True, default=uuid4, editable=False) + + scan = models.ForeignKey( + Scan, + on_delete=models.CASCADE, + related_name="compliance_scores", + related_query_name="compliance_score", + ) + + provider = models.ForeignKey( + Provider, + on_delete=models.CASCADE, + related_name="compliance_scores", + related_query_name="compliance_score", + ) + + compliance_id = models.TextField() + requirement_id = models.TextField() + requirement_status = StatusEnumField(choices=StatusChoices) + + scan_completed_at = models.DateTimeField() + + class Meta(RowLevelSecurityProtectedModel.Meta): + db_table = "provider_compliance_scores" + + constraints = [ + models.UniqueConstraint( + fields=("tenant_id", "provider_id", "compliance_id", "requirement_id"), + name="unique_provider_compliance_req", + ), + RowLevelSecurityConstraint( + field="tenant_id", + name="rls_on_%(class)s", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + ] + + indexes = [ + models.Index( + fields=["tenant_id", "provider_id", "compliance_id"], + name="pcs_tenant_prov_comp_idx", + ), + ] + + +class TenantComplianceSummary(RowLevelSecurityProtectedModel): + """ + Pre-aggregated compliance counts per tenant with FAIL-dominant logic applied. + + One row per (tenant, compliance_id). Used for fast watchlist queries when + no provider filter is applied. Recalculated after each scan by aggregating + across all providers with FAIL-dominant logic at requirement level. + """ + + id = models.UUIDField(primary_key=True, default=uuid4, editable=False) + + compliance_id = models.TextField() + + requirements_passed = models.IntegerField(default=0) + requirements_failed = models.IntegerField(default=0) + requirements_manual = models.IntegerField(default=0) + total_requirements = models.IntegerField(default=0) + + updated_at = models.DateTimeField(auto_now=True) + + class Meta(RowLevelSecurityProtectedModel.Meta): + db_table = "tenant_compliance_summaries" + + constraints = [ + models.UniqueConstraint( + fields=("tenant_id", "compliance_id"), + name="unique_tenant_compliance_summary", + ), + RowLevelSecurityConstraint( + field="tenant_id", + name="rls_on_%(class)s", + statements=["SELECT", "INSERT", "UPDATE", "DELETE"], + ), + ] diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml index 2c2bd8f027..27a9393c6d 100644 --- a/api/src/backend/api/specs/v1.yaml +++ b/api/src/backend/api/specs/v1.yaml @@ -4883,6 +4883,42 @@ paths: schema: $ref: '#/components/schemas/PaginatedCategoryOverviewList' description: '' + /api/v1/overviews/compliance-watchlist: + get: + operationId: overviews_compliance_watchlist_retrieve + description: |- + Get compliance watchlist overview with FAIL-dominant aggregation. + + Without filters: uses pre-aggregated TenantComplianceSummary (~70 rows). + With provider filters: queries ProviderComplianceScore with FAIL-dominant logic. + parameters: + - in: query + name: fields[compliance-watchlist-overviews] + schema: + type: array + items: + type: string + enum: + - id + - compliance_id + - requirements_passed + - requirements_failed + - requirements_manual + - total_requirements + description: endpoint return only specific fields in the response on a per-type + basis by including a fields[TYPE] query parameter. + explode: false + tags: + - Overview + security: + - JWT or API Key: [] + responses: + '200': + content: + application/vnd.api+json: + schema: + $ref: '#/components/schemas/ComplianceWatchlistOverviewResponse' + description: '' /api/v1/overviews/findings: get: operationId: overviews_findings_retrieve @@ -11417,6 +11453,50 @@ components: type: string required: - regions + ComplianceWatchlistOverview: + type: object + required: + - type + - id + additionalProperties: false + properties: + type: + type: string + description: The [type](https://jsonapi.org/format/#document-resource-object-identification) + member is used to describe resource objects that share common attributes + and relationships. + enum: + - compliance-watchlist-overviews + id: {} + attributes: + type: object + properties: + id: + type: string + compliance_id: + type: string + requirements_passed: + type: integer + requirements_failed: + type: integer + requirements_manual: + type: integer + total_requirements: + type: integer + required: + - id + - compliance_id + - requirements_passed + - requirements_failed + - requirements_manual + - total_requirements + ComplianceWatchlistOverviewResponse: + type: object + properties: + data: + $ref: '#/components/schemas/ComplianceWatchlistOverview' + required: + - data Finding: type: object required: diff --git a/api/src/backend/api/tests/test_models.py b/api/src/backend/api/tests/test_models.py index 79d405d4a7..13878794b1 100644 --- a/api/src/backend/api/tests/test_models.py +++ b/api/src/backend/api/tests/test_models.py @@ -1,9 +1,21 @@ +from datetime import datetime, timezone + import pytest from allauth.socialaccount.models import SocialApp from django.core.exceptions import ValidationError +from django.db import IntegrityError from api.db_router import MainRouter -from api.models import Resource, ResourceTag, SAMLConfiguration, SAMLDomainIndex +from api.models import ( + ProviderComplianceScore, + Resource, + ResourceTag, + SAMLConfiguration, + SAMLDomainIndex, + StateChoices, + StatusChoices, + TenantComplianceSummary, +) @pytest.mark.django_db @@ -324,3 +336,159 @@ class TestSAMLConfigurationModel: errors = exc_info.value.message_dict assert "metadata_xml" in errors assert "There is a problem with your metadata." in errors["metadata_xml"][0] + + +@pytest.mark.django_db +class TestProviderComplianceScoreModel: + def test_create_provider_compliance_score(self, providers_fixture, scans_fixture): + provider = providers_fixture[0] + scan = scans_fixture[0] + scan.completed_at = datetime.now(timezone.utc) + scan.save() + + score = ProviderComplianceScore.objects.create( + tenant_id=provider.tenant_id, + provider=provider, + scan=scan, + compliance_id="aws_cis_2.0", + requirement_id="req_1", + requirement_status=StatusChoices.PASS, + scan_completed_at=scan.completed_at, + ) + + assert score.compliance_id == "aws_cis_2.0" + assert score.requirement_id == "req_1" + assert score.requirement_status == StatusChoices.PASS + + def test_unique_constraint_per_provider_compliance_requirement( + self, providers_fixture, scans_fixture + ): + provider = providers_fixture[0] + scan = scans_fixture[0] + scan.completed_at = datetime.now(timezone.utc) + scan.save() + + ProviderComplianceScore.objects.create( + tenant_id=provider.tenant_id, + provider=provider, + scan=scan, + compliance_id="aws_cis_2.0", + requirement_id="req_1", + requirement_status=StatusChoices.PASS, + scan_completed_at=scan.completed_at, + ) + + with pytest.raises(IntegrityError): + ProviderComplianceScore.objects.create( + tenant_id=provider.tenant_id, + provider=provider, + scan=scan, + compliance_id="aws_cis_2.0", + requirement_id="req_1", + requirement_status=StatusChoices.FAIL, + scan_completed_at=scan.completed_at, + ) + + def test_different_providers_same_requirement_allowed( + self, providers_fixture, scans_fixture + ): + provider1, provider2, *_ = providers_fixture + scan1 = scans_fixture[0] + scan1.completed_at = datetime.now(timezone.utc) + scan1.save() + + scan2 = scans_fixture[2] + scan2.state = StateChoices.COMPLETED + scan2.completed_at = datetime.now(timezone.utc) + scan2.save() + + score1 = ProviderComplianceScore.objects.create( + tenant_id=provider1.tenant_id, + provider=provider1, + scan=scan1, + compliance_id="aws_cis_2.0", + requirement_id="req_1", + requirement_status=StatusChoices.PASS, + scan_completed_at=scan1.completed_at, + ) + + score2 = ProviderComplianceScore.objects.create( + tenant_id=provider2.tenant_id, + provider=provider2, + scan=scan2, + compliance_id="aws_cis_2.0", + requirement_id="req_1", + requirement_status=StatusChoices.FAIL, + scan_completed_at=scan2.completed_at, + ) + + assert score1.id != score2.id + assert score1.requirement_status != score2.requirement_status + + +@pytest.mark.django_db +class TestTenantComplianceSummaryModel: + def test_create_tenant_compliance_summary(self, tenants_fixture): + tenant = tenants_fixture[0] + + summary = TenantComplianceSummary.objects.create( + tenant_id=tenant.id, + compliance_id="aws_cis_2.0", + requirements_passed=5, + requirements_failed=2, + requirements_manual=1, + total_requirements=8, + ) + + assert summary.compliance_id == "aws_cis_2.0" + assert summary.requirements_passed == 5 + assert summary.requirements_failed == 2 + assert summary.requirements_manual == 1 + assert summary.total_requirements == 8 + assert summary.updated_at is not None + + def test_unique_constraint_per_tenant_compliance(self, tenants_fixture): + tenant = tenants_fixture[0] + + TenantComplianceSummary.objects.create( + tenant_id=tenant.id, + compliance_id="aws_cis_2.0", + requirements_passed=5, + requirements_failed=2, + requirements_manual=1, + total_requirements=8, + ) + + with pytest.raises(IntegrityError): + TenantComplianceSummary.objects.create( + tenant_id=tenant.id, + compliance_id="aws_cis_2.0", + requirements_passed=3, + requirements_failed=4, + requirements_manual=1, + total_requirements=8, + ) + + def test_different_tenants_same_compliance_allowed(self, tenants_fixture): + tenant1, tenant2, *_ = tenants_fixture + + summary1 = TenantComplianceSummary.objects.create( + tenant_id=tenant1.id, + compliance_id="aws_cis_2.0", + requirements_passed=5, + requirements_failed=2, + requirements_manual=1, + total_requirements=8, + ) + + summary2 = TenantComplianceSummary.objects.create( + tenant_id=tenant2.id, + compliance_id="aws_cis_2.0", + requirements_passed=3, + requirements_failed=4, + requirements_manual=1, + total_requirements=8, + ) + + assert summary1.id != summary2.id + assert summary1.requirements_passed != summary2.requirements_passed diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py index 6babb92fc8..ab1dfc5901 100644 --- a/api/src/backend/api/tests/test_views.py +++ b/api/src/backend/api/tests/test_views.py @@ -7956,6 +7956,97 @@ class TestOverviewViewSet: assert data[0]["attributes"]["failed_findings"] == 13 assert data[0]["attributes"]["new_failed_findings"] == 5 + def test_compliance_watchlist_no_filters_uses_tenant_summary( + self, authenticated_client, tenant_compliance_summary_fixture + ): + response = authenticated_client.get(reverse("overview-compliance-watchlist")) + assert response.status_code == status.HTTP_200_OK + data = response.json()["data"] + + assert len(data) == 2 + + by_id = {item["id"]: item["attributes"] for item in data} + assert "aws_cis_2.0" in by_id + assert by_id["aws_cis_2.0"]["requirements_passed"] == 1 + assert by_id["aws_cis_2.0"]["requirements_failed"] == 2 + assert by_id["aws_cis_2.0"]["requirements_manual"] == 1 + assert by_id["aws_cis_2.0"]["total_requirements"] == 4 + + assert "gdpr_aws" in by_id + assert by_id["gdpr_aws"]["requirements_passed"] == 5 + assert by_id["gdpr_aws"]["requirements_failed"] == 0 + assert by_id["gdpr_aws"]["total_requirements"] == 7 + + def test_compliance_watchlist_with_provider_filter_uses_provider_scores( + self, + authenticated_client, + provider_compliance_scores_fixture, + providers_fixture, + ): + provider1 = providers_fixture[0] + url = f"{reverse('overview-compliance-watchlist')}?filter[provider_id]={provider1.id}" + response = authenticated_client.get(url) + assert response.status_code == status.HTTP_200_OK + data = response.json()["data"] + + assert len(data) == 2 + by_id = {item["id"]: item["attributes"] for item in data} + + assert by_id["aws_cis_2.0"]["requirements_passed"] == 1 + assert by_id["aws_cis_2.0"]["requirements_failed"] == 1 + assert by_id["aws_cis_2.0"]["requirements_manual"] == 1 + assert by_id["aws_cis_2.0"]["total_requirements"] == 3 + + def test_compliance_watchlist_fail_dominant_logic( + self, authenticated_client, provider_compliance_scores_fixture + ): + response = authenticated_client.get( + f"{reverse('overview-compliance-watchlist')}?filter[provider_type]=aws" + ) + assert response.status_code == status.HTTP_200_OK + data = response.json()["data"] + + by_id = {item["id"]: item["attributes"] for item in data} + aws_cis = by_id["aws_cis_2.0"] + + assert aws_cis["requirements_failed"] == 2 + assert aws_cis["requirements_passed"] == 0 + assert aws_cis["requirements_manual"] == 1 + assert aws_cis["total_requirements"] == 3 + + def test_compliance_watchlist_provider_id_in_filter( + self, + authenticated_client, + provider_compliance_scores_fixture, + providers_fixture, + ): + provider1, provider2, *_ = providers_fixture + url = ( + f"{reverse('overview-compliance-watchlist')}" + f"?filter[provider_id__in]={provider1.id},{provider2.id}" + ) + response = authenticated_client.get(url) + assert response.status_code == status.HTTP_200_OK + data = response.json()["data"] + assert len(data) >= 1 + + def test_compliance_watchlist_empty_result(self, authenticated_client): + response = authenticated_client.get(reverse("overview-compliance-watchlist")) + assert response.status_code == status.HTTP_200_OK + data = response.json()["data"] + assert data == [] + + @pytest.mark.parametrize( + "invalid_provider_type", + ["invalid", "not_a_provider", "AWS", "awss"], + ) + def test_compliance_watchlist_invalid_provider_type_filter( + self, authenticated_client, invalid_provider_type + ): + url = f"{reverse('overview-compliance-watchlist')}?filter[provider_type]={invalid_provider_type}" + response = authenticated_client.get(url) + assert response.status_code == status.HTTP_400_BAD_REQUEST + @pytest.mark.django_db class TestScheduleViewSet: diff --git a/api/src/backend/api/v1/serializers.py b/api/src/backend/api/v1/serializers.py index 25ca73d5ff..00c8c37dfb 100644 --- a/api/src/backend/api/v1/serializers.py +++ b/api/src/backend/api/v1/serializers.py @@ -2303,6 +2303,20 @@ class CategoryOverviewSerializer(BaseSerializerV1): resource_name = "category-overviews" +class ComplianceWatchlistOverviewSerializer(BaseSerializerV1): + """Serializer for compliance watchlist overview with FAIL-dominant aggregation.""" + + id = serializers.CharField(source="compliance_id") + compliance_id = serializers.CharField() + requirements_passed = serializers.IntegerField() + requirements_failed = serializers.IntegerField() + requirements_manual = serializers.IntegerField() + total_requirements = serializers.IntegerField() + + class JSONAPIMeta: + resource_name = "compliance-watchlist-overviews" + + class OverviewRegionSerializer(serializers.Serializer): id = serializers.SerializerMethodField() provider_type = serializers.CharField() diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py index 54a33e28fa..ffdfc1005e 100644 --- a/api/src/backend/api/v1/views.py +++ b/api/src/backend/api/v1/views.py @@ -101,6 +101,7 @@ from api.filters import ( AttackSurfaceOverviewFilter, CategoryOverviewFilter, ComplianceOverviewFilter, + ComplianceWatchlistFilter, CustomDjangoFilterBackend, DailySeveritySummaryFilter, FindingFilter, @@ -144,6 +145,7 @@ from api.models import ( MuteRule, Processor, Provider, + ProviderComplianceScore, ProviderGroup, ProviderGroupMembership, ProviderSecret, @@ -163,6 +165,7 @@ from api.models import ( StateChoices, Task, TenantAPIKey, + TenantComplianceSummary, ThreatScoreSnapshot, User, UserRoleRelationship, @@ -185,6 +188,7 @@ from api.v1.serializers import ( ComplianceOverviewDetailThreatscoreSerializer, ComplianceOverviewMetadataSerializer, ComplianceOverviewSerializer, + ComplianceWatchlistOverviewSerializer, FindingDynamicFilterSerializer, FindingMetadataSerializer, FindingSerializer, @@ -4142,6 +4146,8 @@ class OverviewViewSet(BaseRLSViewSet): return AttackSurfaceOverviewSerializer elif self.action == "categories": return CategoryOverviewSerializer + elif self.action == "compliance_watchlist": + return ComplianceWatchlistOverviewSerializer return super().get_serializer_class() def get_filterset_class(self): @@ -4157,6 +4163,8 @@ class OverviewViewSet(BaseRLSViewSet): return CategoryOverviewFilter elif self.action == "attack_surface": return AttackSurfaceOverviewFilter + elif self.action == "compliance_watchlist": + return ComplianceWatchlistFilter return None def filter_queryset(self, queryset): @@ -4240,6 +4248,8 @@ class OverviewViewSet(BaseRLSViewSet): self.request.query_params, exclude_keys=set(exclude_keys or []) ) filterset = filterset_class(normalized_params, queryset=queryset) + if not filterset.is_valid(): + raise ValidationError(filterset.errors) return filterset.qs def _latest_scan_ids_for_allowed_providers(self, tenant_id, provider_filters=None): @@ -4256,9 +4266,10 @@ class OverviewViewSet(BaseRLSViewSet): ) def _extract_provider_filters_from_params(self): - """Extract provider filters from query params to apply on Scan queryset.""" + """Extract and validate provider filters from query params.""" params = self.request.query_params filters = {} + valid_provider_types = {c[0] for c in Provider.ProviderChoices.choices} provider_id = params.get("filter[provider_id]") if provider_id: @@ -4270,11 +4281,21 @@ class OverviewViewSet(BaseRLSViewSet): provider_type = params.get("filter[provider_type]") if provider_type: + if provider_type not in valid_provider_types: + raise ValidationError( + {"provider_type": f"Invalid choice: {provider_type}"} + ) filters["provider__provider"] = provider_type provider_type_in = params.get("filter[provider_type__in]") if provider_type_in: - filters["provider__provider__in"] = provider_type_in.split(",") + types = provider_type_in.split(",") + invalid = [t for t in types if t not in valid_provider_types] + if invalid: + raise ValidationError( + {"provider_type__in": f"Invalid choices: {', '.join(invalid)}"} + ) + filters["provider__provider__in"] = types return filters @@ -4984,6 +5005,92 @@ class OverviewViewSet(BaseRLSViewSet): status=status.HTTP_200_OK, ) + @action( + detail=False, + methods=["get"], + url_name="compliance-watchlist", + url_path="compliance-watchlist", + ) + def compliance_watchlist(self, request): + """ + Get compliance watchlist overview with FAIL-dominant aggregation. + + Without filters: uses pre-aggregated TenantComplianceSummary (~70 rows). + With provider filters: queries ProviderComplianceScore with FAIL-dominant logic. + """ + tenant_id = request.tenant_id + rbac_filter = self._get_provider_filter() + query_params = request.query_params + + has_provider_filter = any( + key.startswith("filter[provider") for key in query_params.keys() + ) + has_rbac_restriction = bool(rbac_filter) + + if not has_provider_filter and not has_rbac_restriction: + response_data = list( + TenantComplianceSummary.objects.filter(tenant_id=tenant_id) + .values( + "compliance_id", + "requirements_passed", + "requirements_failed", + "requirements_manual", + "total_requirements", + ) + .order_by("compliance_id") + ) + else: + base_queryset = ProviderComplianceScore.objects.filter( + tenant_id=tenant_id, **rbac_filter + ) + + filtered_queryset = self._apply_filterset( + base_queryset, ComplianceWatchlistFilter + ) + + aggregation = ( + filtered_queryset.values("compliance_id", "requirement_id") + .annotate( + has_fail=Sum( + Case(When(requirement_status="FAIL", then=1), default=0) + ), + has_manual=Sum( + Case(When(requirement_status="MANUAL", then=1), default=0) + ), + ) + .values("compliance_id", "requirement_id", "has_fail", "has_manual") + ) + + compliance_data = defaultdict( + lambda: { + "requirements_passed": 0, + "requirements_failed": 0, + "requirements_manual": 0, + "total_requirements": 0, + } + ) + + for row in aggregation: + cid = row["compliance_id"] + compliance_data[cid]["total_requirements"] += 1 + + if row["has_fail"] and row["has_fail"] > 0: + compliance_data[cid]["requirements_failed"] += 1 + elif row["has_manual"] and row["has_manual"] > 0: + compliance_data[cid]["requirements_manual"] += 1 + else: + compliance_data[cid]["requirements_passed"] += 1 + + response_data = [ + {"compliance_id": cid, **data} + for cid, data in sorted(compliance_data.items()) + ] + + return Response( + self.get_serializer(response_data, many=True).data, + status=status.HTTP_200_OK, + ) + @extend_schema(tags=["Schedule"]) @extend_schema_view( diff --git a/api/src/backend/conftest.py b/api/src/backend/conftest.py index 28432c59f2..8eefab551f 100644 --- a/api/src/backend/conftest.py +++ b/api/src/backend/conftest.py @@ -30,6 +30,7 @@ from api.models import ( MuteRule, Processor, Provider, + ProviderComplianceScore, ProviderGroup, ProviderSecret, Resource, @@ -45,6 +46,7 @@ from api.models import ( StatusChoices, Task, TenantAPIKey, + TenantComplianceSummary, User, UserRoleRelationship, ) @@ -1631,6 +1633,108 @@ def get_authorization_header(access_token: str) -> dict: return {"Authorization": f"Bearer {access_token}"} +@pytest.fixture +def provider_compliance_scores_fixture( + tenants_fixture, providers_fixture, scans_fixture +): + """Create ProviderComplianceScore entries for compliance watchlist tests.""" + tenant = tenants_fixture[0] + provider1, provider2, *_ = providers_fixture + scan1, _, scan3 = scans_fixture + + scan1.completed_at = datetime.now(timezone.utc) - timedelta(hours=1) + scan1.save() + scan3.state = StateChoices.COMPLETED + scan3.completed_at = datetime.now(timezone.utc) + scan3.save() + + scores = [ + ProviderComplianceScore.objects.create( + tenant_id=tenant.id, + provider=provider1, + scan=scan1, + compliance_id="aws_cis_2.0", + requirement_id="req_1", + requirement_status=StatusChoices.PASS, + scan_completed_at=scan1.completed_at, + ), + ProviderComplianceScore.objects.create( + tenant_id=tenant.id, + provider=provider1, + scan=scan1, + compliance_id="aws_cis_2.0", + requirement_id="req_2", + requirement_status=StatusChoices.FAIL, + scan_completed_at=scan1.completed_at, + ), + ProviderComplianceScore.objects.create( + tenant_id=tenant.id, + provider=provider1, + scan=scan1, + compliance_id="aws_cis_2.0", + requirement_id="req_3", + requirement_status=StatusChoices.MANUAL, + scan_completed_at=scan1.completed_at, + ), + ProviderComplianceScore.objects.create( + tenant_id=tenant.id, + provider=provider2, + scan=scan3, + compliance_id="aws_cis_2.0", + requirement_id="req_1", + requirement_status=StatusChoices.FAIL, + scan_completed_at=scan3.completed_at, + ), + ProviderComplianceScore.objects.create( + tenant_id=tenant.id, + provider=provider2, + scan=scan3, + compliance_id="aws_cis_2.0", + requirement_id="req_2", + requirement_status=StatusChoices.PASS, + scan_completed_at=scan3.completed_at, + ), + ProviderComplianceScore.objects.create( + tenant_id=tenant.id, + provider=provider1, + scan=scan1, + compliance_id="gdpr_aws", + requirement_id="gdpr_req_1", + requirement_status=StatusChoices.PASS, + scan_completed_at=scan1.completed_at, + ), + ] + + return scores + + +@pytest.fixture +def tenant_compliance_summary_fixture(tenants_fixture): + """Create TenantComplianceSummary entries for compliance watchlist tests.""" + tenant = tenants_fixture[0] + + summaries = [ + TenantComplianceSummary.objects.create( + tenant_id=tenant.id, + compliance_id="aws_cis_2.0", + requirements_passed=1, + requirements_failed=2, + requirements_manual=1, + total_requirements=4, + ), + TenantComplianceSummary.objects.create( + tenant_id=tenant.id, + compliance_id="gdpr_aws", + requirements_passed=5, + requirements_failed=0, + requirements_manual=2, + total_requirements=7, + ), + ] + + return summaries + + def pytest_collection_modifyitems(items): """Ensure test_rbac.py is executed first.""" items.sort(key=lambda item: 0 if "test_rbac.py" in item.nodeid else 1) diff --git a/api/src/backend/tasks/jobs/backfill.py b/api/src/backend/tasks/jobs/backfill.py index 8571958448..851efe4e4a 100644 --- a/api/src/backend/tasks/jobs/backfill.py +++ b/api/src/backend/tasks/jobs/backfill.py @@ -1,17 +1,28 @@ from collections import defaultdict from datetime import timedelta +from celery.utils.log import get_task_logger from django.db.models import Sum from django.utils import timezone +from tasks.jobs.queries import ( + COMPLIANCE_UPSERT_PROVIDER_SCORE_SQL, + COMPLIANCE_UPSERT_TENANT_SUMMARY_ALL_SQL, +) from tasks.jobs.scan import aggregate_category_counts -from api.db_router import READ_REPLICA_ALIAS -from api.db_utils import rls_transaction +from api.db_router import READ_REPLICA_ALIAS, MainRouter +from api.db_utils import ( + POSTGRES_TENANT_VAR, + SET_CONFIG_QUERY, + psycopg_connection, + rls_transaction, +) from api.models import ( ComplianceOverviewSummary, ComplianceRequirementOverview, DailySeveritySummary, Finding, + ProviderComplianceScore, Resource, ResourceFindingMapping, ResourceScanSummary, @@ -21,6 +32,8 @@ from api.models import ( StateChoices, ) +logger = get_task_logger(__name__) + def backfill_resource_scan_summaries(tenant_id: str, scan_id: str): with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS): @@ -341,3 +354,114 @@ def backfill_scan_category_summaries(tenant_id: str, scan_id: str): ) return {"status": "backfilled", "categories_count": len(category_counts)} + + +def backfill_provider_compliance_scores(tenant_id: str) -> dict: + """ + Backfill ProviderComplianceScore from latest completed scan per provider. + + For each provider with completed scans, finds the most recent scan and + upserts compliance requirement statuses with FAIL-dominant aggregation. + + Args: + tenant_id: Target tenant UUID + + Returns: + dict: Statistics about the backfill operation + """ + with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS): + completed_scans = Scan.all_objects.filter( + tenant_id=tenant_id, + state=StateChoices.COMPLETED, + completed_at__isnull=False, + ) + if not completed_scans.exists(): + return {"status": "no completed scans"} + + existing_providers = set( + ProviderComplianceScore.objects.filter(tenant_id=tenant_id) + .values_list("provider_id", flat=True) + .distinct() + ) + + if existing_providers: + completed_scans = completed_scans.exclude( + provider_id__in=existing_providers + ) + + scan_info = list( + completed_scans.order_by("provider_id", "-completed_at") + .distinct("provider_id") + .values("id", "provider_id", "completed_at") + ) + + if not scan_info: + return {"status": "no scans to process"} + + total_upserted = 0 + providers_processed = 0 + providers_skipped = 0 + + for scan in scan_info: + provider_id = scan["provider_id"] + + scan_id = scan["id"] + + try: + with psycopg_connection(MainRouter.default_db) as connection: + connection.autocommit = False + try: + with connection.cursor() as cursor: + cursor.execute( + SET_CONFIG_QUERY, [POSTGRES_TENANT_VAR, tenant_id] + ) + cursor.execute( + COMPLIANCE_UPSERT_PROVIDER_SCORE_SQL, + [tenant_id, str(scan_id)], + ) + upserted = cursor.rowcount + connection.commit() + total_upserted += upserted + providers_processed += 1 + except Exception: + connection.rollback() + raise + except Exception as e: + providers_skipped += 1 + logger.exception( + "Error backfilling provider %s for tenant %s: %s", + provider_id, + tenant_id, + e, + ) + + # Recalculate tenant summary after all providers are backfilled + if providers_processed > 0: + with psycopg_connection(MainRouter.default_db) as connection: + connection.autocommit = False + try: + with connection.cursor() as cursor: + cursor.execute(SET_CONFIG_QUERY, [POSTGRES_TENANT_VAR, tenant_id]) + # Advisory lock to prevent race conditions + cursor.execute( + "SELECT pg_advisory_xact_lock(hashtext(%s))", [tenant_id] + ) + cursor.execute( + COMPLIANCE_UPSERT_TENANT_SUMMARY_ALL_SQL, + [tenant_id, tenant_id], + ) + tenant_summary_count = cursor.rowcount + connection.commit() + except Exception: + connection.rollback() + raise + else: + tenant_summary_count = 0 + + return { + "status": "backfilled", + "providers_processed": providers_processed, + "providers_skipped": providers_skipped, + "total_upserted": total_upserted, + "tenant_summary_count": tenant_summary_count, + } diff --git a/api/src/backend/tasks/jobs/queries.py b/api/src/backend/tasks/jobs/queries.py new file mode 100644 index 0000000000..9fbe4901b2 --- /dev/null +++ b/api/src/backend/tasks/jobs/queries.py @@ -0,0 +1,134 @@ +""" +Shared SQL queries for tasks. + +This module centralizes raw SQL queries used across multiple task modules +to ensure consistency and maintainability. +""" + +# ============================================================================= +# COMPLIANCE SCORE QUERIES +# ============================================================================= + +# Upsert provider compliance scores from a scan's compliance requirements. +# Uses FAIL-dominant aggregation: FAIL > MANUAL > PASS +# Parameters: [tenant_id, scan_id] +COMPLIANCE_UPSERT_PROVIDER_SCORE_SQL = """ + INSERT INTO provider_compliance_scores + (id, tenant_id, provider_id, scan_id, compliance_id, requirement_id, + requirement_status, scan_completed_at) + SELECT + gen_random_uuid(), + agg.tenant_id, + agg.provider_id, + agg.scan_id, + agg.compliance_id, + agg.requirement_id, + agg.requirement_status, + agg.completed_at + FROM ( + SELECT DISTINCT ON (cro.compliance_id, cro.requirement_id) + cro.tenant_id, + s.provider_id, + cro.scan_id, + cro.compliance_id, + cro.requirement_id, + (CASE + WHEN bool_or(cro.requirement_status = 'FAIL') + OVER (PARTITION BY cro.compliance_id, cro.requirement_id) THEN 'FAIL' + WHEN bool_or(cro.requirement_status = 'MANUAL') + OVER (PARTITION BY cro.compliance_id, cro.requirement_id) THEN 'MANUAL' + ELSE 'PASS' + END)::status as requirement_status, + s.completed_at + FROM compliance_requirements_overviews cro + JOIN scans s ON s.id = cro.scan_id + WHERE cro.tenant_id = %s AND cro.scan_id = %s + ORDER BY cro.compliance_id, cro.requirement_id + ) agg + ON CONFLICT (tenant_id, provider_id, compliance_id, requirement_id) + DO UPDATE SET + requirement_status = EXCLUDED.requirement_status, + scan_id = EXCLUDED.scan_id, + scan_completed_at = EXCLUDED.scan_completed_at + WHERE EXCLUDED.scan_completed_at > provider_compliance_scores.scan_completed_at +""" + +# Upsert tenant compliance summary for specific compliance IDs. +# Aggregates across all providers with FAIL-dominant logic at requirement level. +# Parameters: [tenant_id, tenant_id, compliance_ids_array] +COMPLIANCE_UPSERT_TENANT_SUMMARY_SQL = """ + INSERT INTO tenant_compliance_summaries + (id, tenant_id, compliance_id, + requirements_passed, requirements_failed, requirements_manual, + total_requirements, updated_at) + SELECT + gen_random_uuid(), + %s as tenant_id, + compliance_id, + COUNT(*) FILTER (WHERE req_status = 'PASS') as requirements_passed, + COUNT(*) FILTER (WHERE req_status = 'FAIL') as requirements_failed, + COUNT(*) FILTER (WHERE req_status = 'MANUAL') as requirements_manual, + COUNT(*) as total_requirements, + NOW() as updated_at + FROM ( + SELECT + compliance_id, + requirement_id, + CASE + WHEN bool_or(requirement_status = 'FAIL') THEN 'FAIL' + WHEN bool_or(requirement_status = 'MANUAL') THEN 'MANUAL' + ELSE 'PASS' + END as req_status + FROM provider_compliance_scores + WHERE tenant_id = %s AND compliance_id = ANY(%s) + GROUP BY compliance_id, requirement_id + ) req_agg + GROUP BY compliance_id + ON CONFLICT (tenant_id, compliance_id) + DO UPDATE SET + requirements_passed = EXCLUDED.requirements_passed, + requirements_failed = EXCLUDED.requirements_failed, + requirements_manual = EXCLUDED.requirements_manual, + total_requirements = EXCLUDED.total_requirements, + updated_at = NOW() +""" + +# Upsert tenant compliance summary for ALL compliance IDs in tenant. +# Used by backfill when recalculating entire tenant summary. +# Parameters: [tenant_id, tenant_id] +COMPLIANCE_UPSERT_TENANT_SUMMARY_ALL_SQL = """ + INSERT INTO tenant_compliance_summaries + (id, tenant_id, compliance_id, + requirements_passed, requirements_failed, requirements_manual, + total_requirements, updated_at) + SELECT + gen_random_uuid(), + %s as tenant_id, + compliance_id, + COUNT(*) FILTER (WHERE req_status = 'PASS') as requirements_passed, + COUNT(*) FILTER (WHERE req_status = 'FAIL') as requirements_failed, + COUNT(*) FILTER (WHERE req_status = 'MANUAL') as requirements_manual, + COUNT(*) as total_requirements, + NOW() as updated_at + FROM ( + SELECT + compliance_id, + requirement_id, + CASE + WHEN bool_or(requirement_status = 'FAIL') THEN 'FAIL' + WHEN bool_or(requirement_status = 'MANUAL') THEN 'MANUAL' + ELSE 'PASS' + END as req_status + FROM provider_compliance_scores + WHERE tenant_id = %s + GROUP BY compliance_id, requirement_id + ) req_agg + GROUP BY compliance_id + ON CONFLICT (tenant_id, compliance_id) + DO UPDATE SET + requirements_passed = EXCLUDED.requirements_passed, + requirements_failed = EXCLUDED.requirements_failed, + requirements_manual = EXCLUDED.requirements_manual, + total_requirements = EXCLUDED.total_requirements, + updated_at = NOW() +""" diff --git a/api/src/backend/tasks/jobs/scan.py b/api/src/backend/tasks/jobs/scan.py index 3b93dc3b84..9e40e2df03 100644 --- a/api/src/backend/tasks/jobs/scan.py +++ b/api/src/backend/tasks/jobs/scan.py @@ -14,6 +14,10 @@ from config.env import env from config.settings.celery import CELERY_DEADLOCK_ATTEMPTS from django.db import IntegrityError, OperationalError from django.db.models import Case, Count, IntegerField, Prefetch, Q, Sum, When +from tasks.jobs.queries import ( + COMPLIANCE_UPSERT_PROVIDER_SCORE_SQL, + COMPLIANCE_UPSERT_TENANT_SUMMARY_SQL, +) from tasks.utils import CustomEncoder from api.compliance import PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE @@ -1489,3 +1493,140 @@ def aggregate_daily_severity(tenant_id: str, scan_id: str): "date": str(scan_date), "severity_data": severity_data, } + + +def update_provider_compliance_scores(tenant_id: str, scan_id: str): + """ + Update ProviderComplianceScore with requirement statuses from a completed scan. + + Uses atomic SQL upsert with ON CONFLICT for concurrency safety. Only updates + if the new scan is more recent than existing data. Also cleans up stale + requirements that no longer exist in the new scan. + + Reads from primary DB (not replica) to avoid replication lag issues since + this runs immediately after create_compliance_requirements_task. + + Args: + tenant_id: Tenant that owns the scan. + scan_id: Scan UUID whose compliance data should be materialized. + + Returns: + dict: Statistics about the upsert operation. + """ + with rls_transaction(tenant_id): + scan = ( + Scan.all_objects.filter( + tenant_id=tenant_id, + id=scan_id, + state=StateChoices.COMPLETED, + ) + .select_related("provider") + .first() + ) + + if not scan: + logger.warning( + f"Scan {scan_id} not found or not completed for compliance score update" + ) + return {"status": "skipped", "reason": "scan not completed"} + + if not scan.completed_at: + logger.warning(f"Scan {scan_id} has no completed_at timestamp") + return {"status": "skipped", "reason": "no completed_at"} + + provider_id = str(scan.provider_id) + scan_completed_at = scan.completed_at + + delete_stale_sql = """ + DELETE FROM provider_compliance_scores pcs + WHERE pcs.tenant_id = %s + AND pcs.provider_id = %s + AND pcs.scan_completed_at < %s + AND NOT EXISTS ( + SELECT 1 FROM compliance_requirements_overviews cro + WHERE cro.tenant_id = pcs.tenant_id + AND cro.scan_id = %s + AND cro.compliance_id = pcs.compliance_id + AND cro.requirement_id = pcs.requirement_id + ) + RETURNING compliance_id + """ + + compliance_ids_sql = """ + SELECT DISTINCT compliance_id + FROM compliance_requirements_overviews + WHERE tenant_id = %s AND scan_id = %s + """ + + try: + with psycopg_connection(MainRouter.default_db) as connection: + connection.autocommit = False + try: + with connection.cursor() as cursor: + cursor.execute(SET_CONFIG_QUERY, [POSTGRES_TENANT_VAR, tenant_id]) + + # Update requirement-level scores per provider + cursor.execute( + COMPLIANCE_UPSERT_PROVIDER_SCORE_SQL, [tenant_id, scan_id] + ) + upserted_count = cursor.rowcount + + cursor.execute(compliance_ids_sql, [tenant_id, scan_id]) + scan_rows = cursor.fetchall() + if not isinstance(scan_rows, (list, tuple)): + scan_rows = [] + scan_compliance_ids = {row[0] for row in scan_rows} + + cursor.execute( + delete_stale_sql, + [tenant_id, provider_id, scan_completed_at, scan_id], + ) + deleted_rows = cursor.fetchall() + if not isinstance(deleted_rows, (list, tuple)): + deleted_rows = [] + deleted_ids = {row[0] for row in deleted_rows} + stale_deleted = len(deleted_ids) + + impacted_compliance_ids = sorted(scan_compliance_ids | deleted_ids) + + if impacted_compliance_ids: + # Advisory lock on tenant to prevent race conditions when + # multiple scans complete simultaneously for the same tenant + cursor.execute( + "SELECT pg_advisory_xact_lock(hashtext(%s))", [tenant_id] + ) + + # Recalculate tenant-level summary (FAIL-dominant across all providers) + cursor.execute( + COMPLIANCE_UPSERT_TENANT_SUMMARY_SQL, + [tenant_id, tenant_id, impacted_compliance_ids], + ) + tenant_summary_count = cursor.rowcount + else: + tenant_summary_count = 0 + + connection.commit() + except Exception: + connection.rollback() + raise + + logger.info( + f"Provider compliance scores updated for scan {scan_id}: " + f"{upserted_count} upserted, {stale_deleted} stale deleted, " + f"{tenant_summary_count} tenant summaries upserted" + ) + + return { + "status": "completed", + "scan_id": str(scan_id), + "provider_id": provider_id, + "upserted": upserted_count, + "stale_deleted": stale_deleted, + "tenant_summary_count": tenant_summary_count, + } + + except Exception as e: + logger.error( + f"Error updating provider compliance scores for scan {scan_id}: {e}" + ) + raise diff --git a/api/src/backend/tasks/tasks.py b/api/src/backend/tasks/tasks.py index b4994fa41d..542f01ef65 100644 --- a/api/src/backend/tasks/tasks.py +++ b/api/src/backend/tasks/tasks.py @@ -11,6 +11,7 @@ from django_celery_beat.models import PeriodicTask from tasks.jobs.backfill import ( backfill_compliance_summaries, backfill_daily_severity_summaries, + backfill_provider_compliance_scores, backfill_resource_scan_summaries, backfill_scan_category_summaries, ) @@ -44,6 +45,7 @@ from tasks.jobs.scan import ( aggregate_findings, create_compliance_requirements, perform_prowler_scan, + update_provider_compliance_scores, ) from tasks.utils import batched, get_next_execution_datetime @@ -122,9 +124,10 @@ def _perform_scan_complete_tasks(tenant_id: str, scan_id: str, provider_id: str) scan_id (str): The ID of the scan that was performed. provider_id (str): The primary key of the Provider instance that was scanned. """ - create_compliance_requirements_task.apply_async( - kwargs={"tenant_id": tenant_id, "scan_id": scan_id} - ) + chain( + create_compliance_requirements_task.si(tenant_id=tenant_id, scan_id=scan_id), + update_provider_compliance_scores_task.si(tenant_id=tenant_id, scan_id=scan_id), + ).apply_async() aggregate_attack_surface_task.apply_async( kwargs={"tenant_id": tenant_id, "scan_id": scan_id} ) @@ -610,6 +613,20 @@ def backfill_scan_category_summaries_task(tenant_id: str, scan_id: str): return backfill_scan_category_summaries(tenant_id=tenant_id, scan_id=scan_id) +@shared_task(name="backfill-provider-compliance-scores", queue="backfill") +def backfill_provider_compliance_scores_task(tenant_id: str): + """ + Backfill ProviderComplianceScore from latest completed scan per provider. + + Used to populate the compliance watchlist materialized table for tenants + that had scans before the feature was deployed. + + Args: + tenant_id: Target tenant UUID. + """ + return backfill_provider_compliance_scores(tenant_id=tenant_id) + + @shared_task(base=RLSTask, name="scan-compliance-overviews", queue="compliance") @handle_provider_deletion def create_compliance_requirements_task(tenant_id: str, scan_id: str): @@ -643,6 +660,21 @@ def aggregate_attack_surface_task(tenant_id: str, scan_id: str): return aggregate_attack_surface(tenant_id=tenant_id, scan_id=scan_id) +@shared_task(name="scan-provider-compliance-scores", queue="compliance") +def update_provider_compliance_scores_task(tenant_id: str, scan_id: str): + """ + Update provider compliance scores from a completed scan. + + This task materializes compliance requirement statuses into ProviderComplianceScore + for efficient watchlist queries. Uses atomic upsert with concurrency protection. + + Args: + tenant_id (str): The tenant ID for which to update scores. + scan_id (str): The ID of the scan whose data should be materialized. + """ + return update_provider_compliance_scores(tenant_id=tenant_id, scan_id=scan_id) + + @shared_task(name="scan-daily-severity", queue="overview") @handle_provider_deletion def aggregate_daily_severity_task(tenant_id: str, scan_id: str): diff --git a/api/src/backend/tasks/tests/test_backfill.py b/api/src/backend/tasks/tests/test_backfill.py index b7a953e2e2..4c9780d101 100644 --- a/api/src/backend/tasks/tests/test_backfill.py +++ b/api/src/backend/tasks/tests/test_backfill.py @@ -1,8 +1,11 @@ +from datetime import datetime, timezone +from unittest.mock import MagicMock, patch from uuid import uuid4 import pytest from tasks.jobs.backfill import ( backfill_compliance_summaries, + backfill_provider_compliance_scores, backfill_resource_scan_summaries, backfill_scan_category_summaries, ) @@ -260,3 +263,62 @@ class TestBackfillScanCategorySummaries: assert summary.total_findings == 1 assert summary.failed_findings == 1 assert summary.new_failed_findings == 1 + + +@pytest.mark.django_db +class TestBackfillProviderComplianceScores: + def test_no_completed_scans(self, tenants_fixture): + tenant = tenants_fixture[2] + result = backfill_provider_compliance_scores(str(tenant.id)) + assert result == {"status": "no completed scans"} + + def test_no_scans_to_process(self, tenants_fixture, scans_fixture): + tenant = tenants_fixture[0] + scan = scans_fixture[0] + scan.completed_at = None + scan.save() + + result = backfill_provider_compliance_scores(str(tenant.id)) + assert result == {"status": "no completed scans"} + + @patch("tasks.jobs.backfill.psycopg_connection") + def test_successful_backfill_executes_sql_queries( + self, + mock_psycopg_connection, + tenants_fixture, + scans_fixture, + settings, + ): + """Test successful backfill executes SQL queries and returns correct stats.""" + settings.DATABASES.setdefault("admin", settings.DATABASES["default"]) + tenant = tenants_fixture[0] + scan = scans_fixture[0] + + # Set completed_at to make the scan eligible for backfill + scan.completed_at = datetime.now(timezone.utc) + scan.save() + + connection = MagicMock() + cursor = MagicMock() + cursor_context = MagicMock() + cursor_context.__enter__.return_value = cursor + cursor_context.__exit__.return_value = False + connection.cursor.return_value = cursor_context + connection.__enter__.return_value = connection + connection.__exit__.return_value = False + connection.autocommit = True + + context_manager = MagicMock() + context_manager.__enter__.return_value = connection + context_manager.__exit__.return_value = False + mock_psycopg_connection.return_value = context_manager + + cursor.rowcount = 5 + + result = backfill_provider_compliance_scores(str(tenant.id)) + + assert result["status"] == "backfilled" + assert result["providers_processed"] == 1 + assert result["providers_skipped"] == 0 + assert result["total_upserted"] == 5 + assert result["tenant_summary_count"] == 5 diff --git a/api/src/backend/tasks/tests/test_scan.py b/api/src/backend/tasks/tests/test_scan.py index ec29dce14f..8902b17b54 100644 --- a/api/src/backend/tasks/tests/test_scan.py +++ b/api/src/backend/tasks/tests/test_scan.py @@ -24,6 +24,7 @@ from tasks.jobs.scan import ( aggregate_findings, create_compliance_requirements, perform_prowler_scan, + update_provider_compliance_scores, ) from tasks.utils import CustomEncoder @@ -4022,3 +4023,123 @@ class TestAggregateCategoryCounts: assert len(cache) == 3 for cat in ["security", "compliance", "data-protection"]: assert cache[(cat, "low")] == {"total": 1, "failed": 1, "new_failed": 1} + + +@pytest.mark.django_db +class TestUpdateProviderComplianceScores: + @patch("tasks.jobs.scan.psycopg_connection") + def test_update_provider_compliance_scores_basic( + self, + mock_psycopg_connection, + tenants_fixture, + scans_fixture, + settings, + ): + settings.DATABASES.setdefault("admin", settings.DATABASES["default"]) + tenant = tenants_fixture[0] + scan = scans_fixture[0] + tenant_id = str(tenant.id) + scan_id = str(scan.id) + + scan.state = StateChoices.COMPLETED + scan.completed_at = datetime.now(timezone.utc) + scan.save() + + connection = MagicMock() + cursor = MagicMock() + cursor_context = MagicMock() + cursor_context.__enter__.return_value = cursor + cursor_context.__exit__.return_value = False + connection.cursor.return_value = cursor_context + connection.__enter__.return_value = connection + connection.__exit__.return_value = False + connection.autocommit = True + + context_manager = MagicMock() + context_manager.__enter__.return_value = connection + context_manager.__exit__.return_value = False + mock_psycopg_connection.return_value = context_manager + + cursor.rowcount = 2 + + result = update_provider_compliance_scores(tenant_id, scan_id) + + assert result["status"] == "completed" + assert result["upserted"] == 2 + assert cursor.execute.call_count >= 3 + connection.commit.assert_called_once() + + def test_update_provider_compliance_scores_skips_incomplete_scan( + self, tenants_fixture, scans_fixture + ): + tenant = tenants_fixture[0] + scan = scans_fixture[1] + tenant_id = str(tenant.id) + scan_id = str(scan.id) + + result = update_provider_compliance_scores(tenant_id, scan_id) + + assert result["status"] == "skipped" + assert result["reason"] == "scan not completed" + + def test_update_provider_compliance_scores_skips_no_completed_at( + self, tenants_fixture, scans_fixture + ): + tenant = tenants_fixture[0] + scan = scans_fixture[0] + tenant_id = str(tenant.id) + scan_id = str(scan.id) + + scan.state = StateChoices.COMPLETED + scan.completed_at = None + scan.save() + + result = update_provider_compliance_scores(tenant_id, scan_id) + + assert result["status"] == "skipped" + assert result["reason"] == "no completed_at" + + @patch("tasks.jobs.scan.psycopg_connection") + def test_update_provider_compliance_scores_executes_sql_queries( + self, + mock_psycopg_connection, + tenants_fixture, + providers_fixture, + scans_fixture, + settings, + ): + settings.DATABASES.setdefault("admin", settings.DATABASES["default"]) + tenant = tenants_fixture[0] + scan = scans_fixture[0] + tenant_id = str(tenant.id) + scan_id = str(scan.id) + + scan.state = StateChoices.COMPLETED + scan.completed_at = datetime.now(timezone.utc) + scan.save() + + connection = MagicMock() + cursor = MagicMock() + cursor_context = MagicMock() + cursor_context.__enter__.return_value = cursor + cursor_context.__exit__.return_value = False + connection.cursor.return_value = cursor_context + connection.__enter__.return_value = connection + connection.__exit__.return_value = False + + context_manager = MagicMock() + context_manager.__enter__.return_value = connection + context_manager.__exit__.return_value = False + mock_psycopg_connection.return_value = context_manager + + cursor.rowcount = 1 + cursor.fetchall.side_effect = [[("aws_cis_2.0",)], []] + + result = update_provider_compliance_scores(tenant_id, scan_id) + + assert result["status"] == "completed" + + calls = [str(c) for c in cursor.execute.call_args_list] + assert any("provider_compliance_scores" in c for c in calls) + assert any("tenant_compliance_summaries" in c for c in calls) + assert any("pg_advisory_xact_lock" in c for c in calls) diff --git a/api/src/backend/tasks/tests/test_tasks.py b/api/src/backend/tasks/tests/test_tasks.py index ceb7f608db..376315d90d 100644 --- a/api/src/backend/tasks/tests/test_tasks.py +++ b/api/src/backend/tasks/tests/test_tasks.py @@ -730,7 +730,9 @@ class TestGenerateOutputs: class TestScanCompleteTasks: @patch("tasks.tasks.aggregate_attack_surface_task.apply_async") - @patch("tasks.tasks.create_compliance_requirements_task.apply_async") + @patch("tasks.tasks.chain") + @patch("tasks.tasks.create_compliance_requirements_task.si") + @patch("tasks.tasks.update_provider_compliance_scores_task.si") @patch("tasks.tasks.perform_scan_summary_task.si") @patch("tasks.tasks.generate_outputs_task.si") @patch("tasks.tasks.generate_compliance_reports_task.si") @@ -741,15 +743,22 @@ class TestScanCompleteTasks: mock_compliance_reports_task, mock_outputs_task, mock_scan_summary_task, + mock_update_compliance_scores_task, mock_compliance_requirements_task, + mock_chain, mock_attack_surface_task, ): """Test that scan complete tasks are properly orchestrated with optimized reports.""" _perform_scan_complete_tasks("tenant-id", "scan-id", "provider-id") - # Verify compliance requirements task is called + # Verify compliance requirements task is called via chain mock_compliance_requirements_task.assert_called_once_with( - kwargs={"tenant_id": "tenant-id", "scan_id": "scan-id"}, + tenant_id="tenant-id", scan_id="scan-id" + ) + + # Verify update provider compliance scores task is called via chain + mock_update_compliance_scores_task.assert_called_once_with( + tenant_id="tenant-id", scan_id="scan-id" ) # Verify attack surface task is called From 9ee77c2b9727ff94cdffea0e7a78104b5e23ed03 Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Mon, 12 Jan 2026 12:02:22 +0100 Subject: [PATCH 038/337] chore(security): Remove safety check ignores as they are fixed (#9752) --- .github/workflows/api-security.yml | 4 +--- .github/workflows/sdk-security.yml | 6 ++++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/api-security.yml b/.github/workflows/api-security.yml index c6273b9a11..d764f82236 100644 --- a/.github/workflows/api-security.yml +++ b/.github/workflows/api-security.yml @@ -60,9 +60,7 @@ jobs: - name: Safety if: steps.check-changes.outputs.any_changed == 'true' - # 76352, 76353, 77323 come from SDK, but they cannot upgrade it yet. It does not affect API - # TODO: Botocore needs urllib3 1.X so we need to ignore these vulnerabilities 77744,77745. Remove this once we upgrade to urllib3 2.X - run: poetry run safety check --ignore 70612,66963,74429,76352,76353,77323,77744,77745 + run: poetry run safety check - name: Vulture if: steps.check-changes.outputs.any_changed == 'true' diff --git a/.github/workflows/sdk-security.yml b/.github/workflows/sdk-security.yml index e16cb9d160..8a102d34ac 100644 --- a/.github/workflows/sdk-security.yml +++ b/.github/workflows/sdk-security.yml @@ -30,7 +30,9 @@ jobs: id: check-changes uses: tj-actions/changed-files@e0021407031f5be11a464abee9a0776171c79891 # v47.0.1 with: - files: ./** + files: + ./** + .github/workflows/sdk-security.yml files_ignore: | .github/** prowler/CHANGELOG.md @@ -70,7 +72,7 @@ jobs: - name: Security scan with Safety if: steps.check-changes.outputs.any_changed == 'true' - run: poetry run safety check --ignore 70612 -r pyproject.toml + run: poetry run safety check -r pyproject.toml - name: Dead code detection with Vulture if: steps.check-changes.outputs.any_changed == 'true' From 62a8540169d00ff247961b89b02cd18249ad1cd7 Mon Sep 17 00:00:00 2001 From: lydiavilchez <114735608+lydiavilchez@users.noreply.github.com> Date: Mon, 12 Jan 2026 12:22:15 +0100 Subject: [PATCH 039/337] feat(gcp): add check to detect Compute Engine configuration changes (#9698) Co-authored-by: Daniel Barranquero Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com> --- .../cli/tutorials/configuration_file.mdx | 4 + prowler/CHANGELOG.md | 1 + .../__init__.py | 0 ...onfiguration_changes_enabled.metadata.json | 38 ++ ...r_compute_configuration_changes_enabled.py | 50 +++ tests/providers/gcp/gcp_fixtures.py | 33 ++ ...pute_configuration_changes_enabled_test.py | 348 ++++++++++++++++++ 7 files changed, 474 insertions(+) create mode 100644 prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/__init__.py create mode 100644 prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.metadata.json create mode 100644 prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.py create mode 100644 tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled_test.py diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx index fe8cbf4f39..73f9ff3999 100644 --- a/docs/user-guide/cli/tutorials/configuration_file.mdx +++ b/docs/user-guide/cli/tutorials/configuration_file.mdx @@ -97,6 +97,7 @@ The following list includes all the GCP checks with configurable variables that | Check Name | Value | Type | |---------------------------------------------------------------|--------------------------------------------------|-----------------| +| `compute_configuration_changes` | `compute_audit_log_lookback_days` | Integer | | `compute_instance_group_multiple_zones` | `mig_min_zones` | Integer | ## Kubernetes @@ -553,6 +554,9 @@ gcp: # GCP Compute Configuration # gcp.compute_public_address_shodan shodan_api_key: null + # gcp.compute_configuration_changes + # Number of days to look back for Compute Engine configuration changes in audit logs + compute_audit_log_lookback_days: 1 # gcp.compute_instance_group_multiple_zones # Minimum number of zones a MIG should span for high availability mig_min_zones: 2 diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index b202455fa0..9337af7fcf 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -13,6 +13,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - `compute_instance_disk_auto_delete_disabled` check for GCP provider [(#9604)](https://github.com/prowler-cloud/prowler/pull/9604) - Bedrock service pagination [(#9606)](https://github.com/prowler-cloud/prowler/pull/9606) - `ResourceGroup` field to all check metadata for resource classification [(#9656)](https://github.com/prowler-cloud/prowler/pull/9656) +- `compute_configuration_changes` check for GCP provider to detect Compute Engine configuration changes in Cloud Audit Logs [(#9698)](https://github.com/prowler-cloud/prowler/pull/9698) - `compute_instance_group_load_balancer_attached` check for GCP provider [(#9695)](https://github.com/prowler-cloud/prowler/pull/9695) - `compute_instance_single_network_interface` check for GCP provider [(#9702)](https://github.com/prowler-cloud/prowler/pull/9702) - `compute_image_not_publicly_shared` check for GCP provider [(#9718)](https://github.com/prowler-cloud/prowler/pull/9718) diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/__init__.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/__init__.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.metadata.json b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.metadata.json new file mode 100644 index 0000000000..9cdbbc51e8 --- /dev/null +++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.metadata.json @@ -0,0 +1,38 @@ +{ + "Provider": "gcp", + "CheckID": "logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled", + "CheckTitle": "Compute Engine configuration changes are monitored with log metric filters and alerts", + "CheckType": [], + "ServiceName": "logging", + "SubServiceName": "", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "MetricFilter", + "ResourceGroup": "monitoring", + "Description": "Log metric filters and alerts for **Compute Engine configuration changes** provide visibility into modifications to instances, disks, networks, firewalls, and routes. These monitoring controls enable security teams to detect unauthorized changes and investigate suspicious infrastructure modifications.", + "Risk": "Without monitoring for Compute Engine configuration changes, **unauthorized modifications** to compute resources may go undetected. Attackers can establish **persistence** through instance modifications, escalate privileges via IAM policy changes, disable security controls, or pivot to other resources. This compromises **confidentiality**, **integrity**, and **availability** of workloads and may enable **data exfiltration** or **lateral movement**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/ComputeEngine/gcp-compute-engine-configuration-changes.html", + "https://cloud.google.com/logging/docs/audit", + "https://cloud.google.com/monitoring/alerts" + ], + "Remediation": { + "Code": { + "CLI": "gcloud logging metrics create compute_config_changes --description=\"Compute Engine configuration changes\" --log-filter='protoPayload.serviceName=\"compute.googleapis.com\"' && gcloud alpha monitoring policies create --notification-channels=CHANNEL_ID --display-name=\"Compute Engine Configuration Changes Alert\" --condition-threshold-value=1 --condition-threshold-duration=0s --condition-filter='metric.type=\"logging.googleapis.com/user/compute_config_changes\"'", + "NativeIaC": "", + "Other": "1. Open the Google Cloud Console\n2. Navigate to Logging > Logs-based Metrics\n3. Click 'Create Metric'\n4. Set Metric Type to 'Counter'\n5. Enter filter: protoPayload.serviceName=\"compute.googleapis.com\"\n6. Click 'Create Metric'\n7. Navigate to Monitoring > Alerting\n8. Click 'Create Policy'\n9. Click 'Add Condition'\n10. Select your log metric in the metric dropdown\n11. Set threshold and conditions\n12. Add notification channels\n13. Click 'Save'", + "Terraform": "```hcl\nresource \"google_logging_metric\" \"compute_config_changes\" {\n name = \"compute_config_changes\"\n filter = \"protoPayload.serviceName=\\\"compute.googleapis.com\\\"\"\n metric_descriptor {\n metric_kind = \"DELTA\"\n value_type = \"INT64\"\n }\n}\n\nresource \"google_monitoring_alert_policy\" \"compute_config_alert\" {\n display_name = \"Compute Engine Configuration Changes\"\n conditions {\n display_name = \"Compute config changes detected\"\n condition_threshold {\n filter = \"metric.type=\\\"logging.googleapis.com/user/compute_config_changes\\\"\"\n duration = \"0s\"\n comparison = \"COMPARISON_GT\"\n threshold_value = 0\n }\n }\n notification_channels = [var.notification_channel_id]\n}\n```" + }, + "Recommendation": { + "Text": "Configure log-based metric filters to detect Compute Engine configuration changes and create alert policies that trigger notifications when these metrics increment. Apply the **principle of least privilege** to limit who can modify compute resources, and establish **change management processes** to review and approve infrastructure modifications.", + "Url": "https://hub.prowler.com/check/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled" + } + }, + "Categories": [ + "logging" + ], + "DependsOn": [], + "RelatedTo": [], + "Notes": "" +} diff --git a/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.py b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.py new file mode 100644 index 0000000000..7902f9ed72 --- /dev/null +++ b/prowler/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.py @@ -0,0 +1,50 @@ +from prowler.lib.check.models import Check, Check_Report_GCP +from prowler.providers.gcp.services.logging.logging_client import logging_client +from prowler.providers.gcp.services.monitoring.monitoring_client import ( + monitoring_client, +) + + +class logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled( + Check +): + def execute(self) -> Check_Report_GCP: + findings = [] + projects_with_metric = set() + for metric in logging_client.metrics: + if 'protoPayload.serviceName="compute.googleapis.com"' in metric.filter: + report = Check_Report_GCP( + metadata=self.metadata(), + resource=metric, + location=logging_client.region, + resource_name=metric.name if metric.name else "Log Metric Filter", + ) + projects_with_metric.add(metric.project_id) + report.status = "FAIL" + report.status_extended = f"Log metric filter {metric.name} found but no alerts associated in project {metric.project_id}." + for alert_policy in monitoring_client.alert_policies: + for filter in alert_policy.filters: + if metric.name in filter: + report.status = "PASS" + report.status_extended = f"Log metric filter {metric.name} found with alert policy {alert_policy.display_name} associated in project {metric.project_id}." + break + findings.append(report) + + for project in logging_client.project_ids: + if project not in projects_with_metric: + report = Check_Report_GCP( + metadata=self.metadata(), + resource=logging_client.projects[project], + project_id=project, + location=logging_client.region, + resource_name=( + logging_client.projects[project].name + if logging_client.projects[project].name + else "GCP Project" + ), + ) + report.status = "FAIL" + report.status_extended = f"There are no log metric filters or alerts associated for Compute Engine configuration changes in project {project}." + findings.append(report) + + return findings diff --git a/tests/providers/gcp/gcp_fixtures.py b/tests/providers/gcp/gcp_fixtures.py index 56b6163993..2f968f5555 100644 --- a/tests/providers/gcp/gcp_fixtures.py +++ b/tests/providers/gcp/gcp_fixtures.py @@ -32,6 +32,11 @@ def set_mocked_gcp_provider( provider.identity = GCPIdentityInfo( profile=profile, ) + provider.audit_config = { + "mig_min_zones": 2, + "max_unused_account_days": 30, + } + provider.fixer_config = {} return provider @@ -1103,6 +1108,34 @@ def mock_api_sink_calls(client: MagicMock): } client.sinks().list_next.return_value = None + client.entries().list().execute.return_value = { + "entries": [ + { + "insertId": "audit-log-entry-1", + "timestamp": "2024-01-15T10:30:00Z", + "receiveTimestamp": "2024-01-15T10:30:01Z", + "resource": { + "type": "gce_instance", + "labels": { + "instance_id": "test-instance-1", + "project_id": GCP_PROJECT_ID, + }, + }, + "protoPayload": { + "serviceName": "compute.googleapis.com", + "methodName": "v1.compute.instances.insert", + "resourceName": "projects/test-project/zones/us-central1-a/instances/test-instance-1", + "authenticationInfo": { + "principalEmail": "user@example.com", + }, + "requestMetadata": { + "callerIp": "192.168.1.1", + }, + }, + }, + ] + } + def mock_api_services_calls(client: MagicMock): client.services().list().execute.return_value = { diff --git a/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled_test.py b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled_test.py new file mode 100644 index 0000000000..563b4e49ac --- /dev/null +++ b/tests/providers/gcp/services/logging/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled/logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled_test.py @@ -0,0 +1,348 @@ +from unittest.mock import MagicMock, patch + +from prowler.providers.gcp.models import GCPProject +from tests.providers.gcp.gcp_fixtures import ( + GCP_EU1_LOCATION, + GCP_PROJECT_ID, + set_mocked_gcp_provider, +) + + +class Test_logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled: + def test_no_projects(self): + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled import ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled, + ) + + logging_client.metrics = [] + logging_client.project_ids = [] + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled() + ) + result = check.execute() + assert len(result) == 0 + + def test_no_log_metric_filters_no_alerts_one_project(self): + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled import ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled, + ) + + logging_client.metrics = [] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + logging_client.projects = { + GCP_PROJECT_ID: GCPProject( + id=GCP_PROJECT_ID, + number="123456789012", + name="test", + labels={}, + lifecycle_state="ACTIVE", + ) + } + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"There are no log metric filters or alerts associated for Compute Engine configuration changes in project {GCP_PROJECT_ID}." + ) + assert result[0].resource_id == GCP_PROJECT_ID + assert result[0].resource_name == "test" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + + def test_no_log_metric_filters_no_alerts_one_project_empty_name(self): + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled import ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled, + ) + + logging_client.metrics = [] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + logging_client.projects = { + GCP_PROJECT_ID: GCPProject( + id=GCP_PROJECT_ID, + number="123456789012", + name="", + labels={}, + lifecycle_state="ACTIVE", + ) + } + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"There are no log metric filters or alerts associated for Compute Engine configuration changes in project {GCP_PROJECT_ID}." + ) + assert result[0].resource_id == GCP_PROJECT_ID + assert result[0].resource_name == "GCP Project" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + + def test_log_metric_filters_no_alerts(self): + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled import ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled, + ) + from prowler.providers.gcp.services.logging.logging_service import Metric + + logging_client.metrics = [ + Metric( + name="compute_config_changes", + type="logging.googleapis.com/user/compute_config_changes", + filter='protoPayload.serviceName="compute.googleapis.com"', + project_id=GCP_PROJECT_ID, + ) + ] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + + monitoring_client.alert_policies = [] + + check = ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "FAIL" + assert ( + result[0].status_extended + == f"Log metric filter compute_config_changes found but no alerts associated in project {GCP_PROJECT_ID}." + ) + assert result[0].resource_id == "compute_config_changes" + assert result[0].resource_name == "compute_config_changes" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + + def test_log_metric_filters_with_alerts(self): + logging_client = MagicMock() + monitoring_client = MagicMock() + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider(), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled import ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled, + ) + from prowler.providers.gcp.services.logging.logging_service import Metric + from prowler.providers.gcp.services.monitoring.monitoring_service import ( + AlertPolicy, + ) + + logging_client.metrics = [ + Metric( + name="compute_config_changes", + type="logging.googleapis.com/user/compute_config_changes", + filter='protoPayload.serviceName="compute.googleapis.com"', + project_id=GCP_PROJECT_ID, + ) + ] + logging_client.project_ids = [GCP_PROJECT_ID] + logging_client.region = GCP_EU1_LOCATION + + monitoring_client.alert_policies = [ + AlertPolicy( + name=f"projects/{GCP_PROJECT_ID}/alertPolicies/12345", + display_name="Compute Config Alert", + enabled=True, + filters=[ + 'metric.type = "logging.googleapis.com/user/compute_config_changes"', + ], + project_id=GCP_PROJECT_ID, + ) + ] + + check = ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled() + ) + result = check.execute() + assert len(result) == 1 + assert result[0].status == "PASS" + assert ( + result[0].status_extended + == f"Log metric filter compute_config_changes found with alert policy Compute Config Alert associated in project {GCP_PROJECT_ID}." + ) + assert result[0].resource_id == "compute_config_changes" + assert result[0].resource_name == "compute_config_changes" + assert result[0].project_id == GCP_PROJECT_ID + assert result[0].location == GCP_EU1_LOCATION + + def test_multiple_projects_mixed_results(self): + logging_client = MagicMock() + monitoring_client = MagicMock() + + project_id_1 = "project-with-monitoring" + project_id_2 = "project-without-monitoring" + + with ( + patch( + "prowler.providers.common.provider.Provider.get_global_provider", + return_value=set_mocked_gcp_provider( + project_ids=[project_id_1, project_id_2] + ), + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_client", + new=logging_client, + ), + patch( + "prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.monitoring_client", + new=monitoring_client, + ), + ): + from prowler.providers.gcp.services.logging.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled.logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled import ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled, + ) + from prowler.providers.gcp.services.logging.logging_service import Metric + from prowler.providers.gcp.services.monitoring.monitoring_service import ( + AlertPolicy, + ) + + logging_client.metrics = [ + Metric( + name="compute_config_changes", + type="logging.googleapis.com/user/compute_config_changes", + filter='protoPayload.serviceName="compute.googleapis.com"', + project_id=project_id_1, + ) + ] + logging_client.project_ids = [project_id_1, project_id_2] + logging_client.region = GCP_EU1_LOCATION + logging_client.projects = { + project_id_1: GCPProject( + id=project_id_1, + number="111111111111", + name="test-project-1", + labels={}, + lifecycle_state="ACTIVE", + ), + project_id_2: GCPProject( + id=project_id_2, + number="222222222222", + name="test-project-2", + labels={}, + lifecycle_state="ACTIVE", + ), + } + + monitoring_client.alert_policies = [ + AlertPolicy( + name=f"projects/{project_id_1}/alertPolicies/12345", + display_name="Compute Config Alert", + enabled=True, + filters=[ + 'metric.type = "logging.googleapis.com/user/compute_config_changes"', + ], + project_id=project_id_1, + ) + ] + + check = ( + logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled() + ) + result = check.execute() + assert len(result) == 2 + + # Project 1 should PASS (has metric + alert) + pass_result = [r for r in result if r.status == "PASS"][0] + assert pass_result.project_id == project_id_1 + assert "compute_config_changes" in pass_result.status_extended + assert "Compute Config Alert" in pass_result.status_extended + + # Project 2 should FAIL (no metric) + fail_result = [r for r in result if r.status == "FAIL"][0] + assert fail_result.project_id == project_id_2 + assert "no log metric filters" in fail_result.status_extended From 87c07471745c85780e80980e2552761350c0e929 Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Mon, 12 Jan 2026 13:00:39 +0100 Subject: [PATCH 040/337] feat(aws): Update regions for AWS services (#9771) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com> --- .../providers/aws/aws_regions_by_service.json | 93 ++++--------------- 1 file changed, 18 insertions(+), 75 deletions(-) diff --git a/prowler/providers/aws/aws_regions_by_service.json b/prowler/providers/aws/aws_regions_by_service.json index 5dd41193ca..91ea6c6be3 100644 --- a/prowler/providers/aws/aws_regions_by_service.json +++ b/prowler/providers/aws/aws_regions_by_service.json @@ -1023,6 +1023,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -3714,6 +3715,7 @@ "ap-south-2", "ap-southeast-1", "ap-southeast-2", + "ap-southeast-3", "ap-southeast-5", "ap-southeast-7", "ca-central-1", @@ -4418,23 +4420,6 @@ ] } }, - "elastictranscoder": { - "regions": { - "aws": [ - "ap-northeast-1", - "ap-south-1", - "ap-southeast-1", - "ap-southeast-2", - "eu-west-1", - "us-east-1", - "us-west-1", - "us-west-2" - ], - "aws-cn": [], - "aws-eusc": [], - "aws-us-gov": [] - } - }, "elb": { "regions": { "aws": [ @@ -4847,24 +4832,6 @@ ] } }, - "evidently": { - "regions": { - "aws": [ - "ap-northeast-1", - "ap-southeast-1", - "ap-southeast-2", - "eu-central-1", - "eu-north-1", - "eu-west-1", - "us-east-1", - "us-east-2", - "us-west-2" - ], - "aws-cn": [], - "aws-eusc": [], - "aws-us-gov": [] - } - }, "evs": { "regions": { "aws": [ @@ -5582,6 +5549,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -6563,6 +6531,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -6613,6 +6582,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -6639,7 +6609,10 @@ "cn-northwest-1" ], "aws-eusc": [], - "aws-us-gov": [] + "aws-us-gov": [ + "us-gov-east-1", + "us-gov-west-1" + ] } }, "kendra": { @@ -6883,6 +6856,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -7340,24 +7314,6 @@ "aws-us-gov": [] } }, - "lookoutmetrics": { - "regions": { - "aws": [ - "ap-northeast-1", - "ap-southeast-1", - "ap-southeast-2", - "eu-central-1", - "eu-north-1", - "eu-west-1", - "us-east-1", - "us-east-2", - "us-west-2" - ], - "aws-cn": [], - "aws-eusc": [], - "aws-us-gov": [] - } - }, "lumberyard": { "regions": { "aws": [ @@ -8618,7 +8574,10 @@ "odb": { "regions": { "aws": [ + "ap-northeast-1", + "eu-central-1", "us-east-1", + "us-east-2", "us-west-2" ], "aws-cn": [], @@ -9422,26 +9381,6 @@ "aws-us-gov": [] } }, - "qldb": { - "regions": { - "aws": [ - "ap-northeast-1", - "ap-northeast-2", - "ap-southeast-1", - "ap-southeast-2", - "ca-central-1", - "eu-central-1", - "eu-west-1", - "eu-west-2", - "us-east-1", - "us-east-2", - "us-west-2" - ], - "aws-cn": [], - "aws-eusc": [], - "aws-us-gov": [] - } - }, "quicksight": { "regions": { "aws": [ @@ -9781,6 +9720,7 @@ "ap-southeast-2", "ap-southeast-3", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "eu-central-1", @@ -12533,6 +12473,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -12980,6 +12921,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -13073,6 +13015,7 @@ "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", + "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", @@ -13360,4 +13303,4 @@ } } } -} +} \ No newline at end of file From 429c5918193568c3fb5e5842bfa544cf1703dcf2 Mon Sep 17 00:00:00 2001 From: Lee Trout Date: Mon, 12 Jan 2026 07:47:37 -0500 Subject: [PATCH 041/337] chore(aws): fixup AWS EC2 SG lib (#9216) Co-authored-by: MrCloudSec Co-authored-by: Sergio Garcia Co-authored-by: HugoPBrito --- prowler/CHANGELOG.md | 1 + .../dms_instance_no_public_access.py | 2 +- ...allow_ingress_from_internet_to_any_port.py | 2 +- .../aws/services/ec2/lib/security_groups.py | 93 +++++++++---------- .../services/ec2/lib/security_groups_test.py | 8 +- 5 files changed, 52 insertions(+), 54 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 9337af7fcf..32d1c36f69 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -48,6 +48,7 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Fixed - Fix OCI authentication error handling and validation [(#9738)](https://github.com/prowler-cloud/prowler/pull/9738) +- Fixup AWS EC2 SG library [(#9216)](https://github.com/prowler-cloud/prowler/pull/9216) --- diff --git a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py index 833d5d1fb5..2b491529c9 100644 --- a/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py +++ b/prowler/providers/aws/services/dms/dms_instance_no_public_access/dms_instance_no_public_access.py @@ -25,8 +25,8 @@ class dms_instance_no_public_access(Check): if check_security_group( ingress_rule, "-1", - ports=None, any_address=True, + all_ports=True, ): report.status = "FAIL" report.status_extended = f"DMS Replication Instance {instance.id} is set as publicly accessible and security group {security_group.name} ({security_group.id}) is open to the Internet." diff --git a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py index c4d3978199..f4ed7c20c4 100644 --- a/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py +++ b/prowler/providers/aws/services/ec2/ec2_securitygroup_allow_ingress_from_internet_to_any_port/ec2_securitygroup_allow_ingress_from_internet_to_any_port.py @@ -31,7 +31,7 @@ class ec2_securitygroup_allow_ingress_from_internet_to_any_port(Check): report.status_extended = f"Security group {security_group.name} ({security_group.id}) does not have any port open to the Internet." for ingress_rule in security_group.ingress_rules: if check_security_group( - ingress_rule, "-1", ports=None, any_address=True + ingress_rule, "-1", any_address=True, all_ports=True ): self.check_enis( report=report, diff --git a/prowler/providers/aws/services/ec2/lib/security_groups.py b/prowler/providers/aws/services/ec2/lib/security_groups.py index a5f240adb5..dabbe4f86d 100644 --- a/prowler/providers/aws/services/ec2/lib/security_groups.py +++ b/prowler/providers/aws/services/ec2/lib/security_groups.py @@ -3,10 +3,14 @@ from typing import Any def check_security_group( - ingress_rule: Any, protocol: str, ports: list = [], any_address: bool = False + ingress_rule: Any, + protocol: str, + ports: list | None = None, + any_address: bool = False, + all_ports: bool = False, ) -> bool: """ - Check if the security group ingress rule has public access to the check_ports using the protocol + Check if the security group ingress rule has public access to the check_ports using the protocol. @param ingress_rule: AWS Security Group IpPermissions Ingress Rule { @@ -29,13 +33,17 @@ def check_security_group( @param protocol: Protocol to check. If -1, all protocols will be checked. - - @param ports: List of ports to check. If empty, any port will be checked. If None, any port will be checked. (Default: []) + @param ports: List of ports to check. If not provided all ports will be checked unless all_ports is False. (Default: None) @param any_address: If True, only 0.0.0.0/0 or "::/0" will be public and do not search for public addresses. (Default: False) + @param all_ports: If True, empty ports list will be treated as all ports. (Default: False) + @return: True if the security group has public access to the check_ports using the protocol """ + if ports is None: + ports = [] + # Check for all traffic ingress rules regardless of the protocol if ingress_rule["IpProtocol"] == "-1": for ip_ingress_rule in ingress_rule["IpRanges"]: @@ -54,54 +62,42 @@ def check_security_group( # Check for specific ports in ingress rules if "FromPort" in ingress_rule: - # If there is a port range + + # If the ports are not the same create a covering range. + # Note range is exclusive of the end value so we add 1 to the ToPort. if ingress_rule["FromPort"] != ingress_rule["ToPort"]: - # Calculate port range, adding 1 - diff = (ingress_rule["ToPort"] - ingress_rule["FromPort"]) + 1 - ingress_port_range = [] - for x in range(diff): - ingress_port_range.append(int(ingress_rule["FromPort"]) + x) - # If FromPort and ToPort are the same + ingress_port_range = set( + range(ingress_rule["FromPort"], ingress_rule["ToPort"] + 1) + ) else: - ingress_port_range = [] - ingress_port_range.append(int(ingress_rule["FromPort"])) + ingress_port_range = {int(ingress_rule["FromPort"])} - # Test Security Group - # IPv4 - for ip_ingress_rule in ingress_rule["IpRanges"]: - if _is_cidr_public(ip_ingress_rule["CidrIp"], any_address): - # If there are input ports to check - if ports: - for port in ports: - if ( - port in ingress_port_range - and ingress_rule["IpProtocol"] == protocol - ): - return True - # If empty input ports check if all ports are open - if len(set(ingress_port_range)) == 65536: - return True - # If None input ports check if any port is open - if ports is None: - return True + # Combine IPv4 and IPv6 ranges to facilitate a single check loop. + all_ingress_rules = [] + all_ingress_rules.extend(ingress_rule["IpRanges"]) + all_ingress_rules.extend(ingress_rule["Ipv6Ranges"]) - # IPv6 - for ip_ingress_rule in ingress_rule["Ipv6Ranges"]: - if _is_cidr_public(ip_ingress_rule["CidrIpv6"], any_address): - # If there are input ports to check - if ports: - for port in ports: - if ( - port in ingress_port_range - and ingress_rule["IpProtocol"] == protocol - ): - return True - # If empty input ports check if all ports are open - if len(set(ingress_port_range)) == 65536: - return True - # If None input ports check if any port is open - if ports is None: - return True + for ip_ingress_rule in all_ingress_rules: + # We only check public CIDRs + if _is_cidr_public( + ip_ingress_rule.get("CidrIp", ip_ingress_rule.get("CidrIpv6")), + any_address, + ): + for port in ports: + if port in ingress_port_range and ( + ingress_rule["IpProtocol"] == protocol or protocol == "-1" + ): + # Direct match for a port in the specified port range + return True + + # We did not find a specific port for the given protocol for + # a public cidr so let's see if all the ports are open + all_ports_open = len(ingress_port_range) == 65536 + + # Use the all_ports flag to determine if empty ports should be treated as all ports. + empty_ports_same_as_all_ports_open = all_ports and not ports + + return all_ports_open or empty_ports_same_as_all_ports_open return False @@ -120,3 +116,4 @@ def _is_cidr_public(cidr: str, any_address: bool = False) -> bool: return True if not any_address: return ipaddress.ip_network(cidr).is_global + return False diff --git a/tests/providers/aws/services/ec2/lib/security_groups_test.py b/tests/providers/aws/services/ec2/lib/security_groups_test.py index 9296a29c20..653bf420bd 100644 --- a/tests/providers/aws/services/ec2/lib/security_groups_test.py +++ b/tests/providers/aws/services/ec2/lib/security_groups_test.py @@ -48,7 +48,7 @@ class Test_is_cidr_public: with pytest.raises(ValueError) as ex: _is_cidr_public(cidr) - assert ex.type == ValueError + assert ex.type is ValueError assert ex.match(f"{cidr} has host bits set") def test__is_cidr_public_Public_IPv6_all_IPs_any_address_false(self): @@ -77,7 +77,7 @@ class Test_is_cidr_public: class Test_check_security_group: - def generate_ip_ranges_list(self, input_ip_ranges: [str], v4=True): + def generate_ip_ranges_list(self, input_ip_ranges: list[str], v4=True): cidr_ranges = "CidrIp" if v4 else "CidrIpv6" return [{cidr_ranges: ip, "Description": ""} for ip in input_ip_ranges] @@ -86,8 +86,8 @@ class Test_check_security_group: from_port: int, to_port: int, ip_protocol: str, - input_ipv4_ranges: [str], - input_ipv6_ranges: [str], + input_ipv4_ranges: list[str], + input_ipv6_ranges: list[str], ): """ ingress_rule_generator returns the following AWS Security Group IpPermissions Ingress Rule based on the input arguments From e5b86da6e50219130b2cfec62e361257ec6a16aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Mon, 12 Jan 2026 13:52:29 +0100 Subject: [PATCH 042/337] chore(aws): enhance metadata for `rds` service (#9551) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + ...ds_cluster_backtrack_enabled.metadata.json | 38 ++++++++++------ ...uster_copy_tags_to_snapshots.metadata.json | 30 ++++++++----- ..._critical_event_subscription.metadata.json | 39 +++++++++------- .../rds_cluster_default_admin.metadata.json | 34 +++++++++----- ..._cluster_deletion_protection.metadata.json | 38 ++++++++++------ ...r_iam_authentication_enabled.metadata.json | 38 ++++++++++------ ..._integration_cloudwatch_logs.metadata.json | 32 ++++++++----- ...inor_version_upgrade_enabled.metadata.json | 37 +++++++++------ .../rds_cluster_multi_az.metadata.json | 34 ++++++++------ ...rds_cluster_non_default_port.metadata.json | 29 +++++++----- ...ter_protected_by_backup_plan.metadata.json | 37 ++++++++------- ...ds_cluster_storage_encrypted.metadata.json | 38 ++++++++++------ .../rds_instance_backup_enabled.metadata.json | 36 +++++++++------ ...tance_certificate_expiration.metadata.json | 32 ++++++++----- ...tance_copy_tags_to_snapshots.metadata.json | 31 ++++++++----- ..._critical_event_subscription.metadata.json | 36 +++++++++------ .../rds_instance_default_admin.metadata.json | 33 +++++++++----- ...instance_deletion_protection.metadata.json | 34 +++++++++----- ...ce_deprecated_engine_version.metadata.json | 36 +++++++++------ ..._enhanced_monitoring_enabled.metadata.json | 35 +++++++++------ ...ubscription_parameter_groups.metadata.json | 39 +++++++++------- ...subscription_security_groups.metadata.json | 35 +++++++++------ ...e_iam_authentication_enabled.metadata.json | 37 +++++++++------ .../rds_instance_inside_vpc.metadata.json | 34 ++++++++------ ..._integration_cloudwatch_logs.metadata.json | 32 ++++++++----- ...inor_version_upgrade_enabled.metadata.json | 34 ++++++++------ .../rds_instance_multi_az.metadata.json | 32 +++++++------ ...ds_instance_no_public_access.metadata.json | 32 ++++++++----- ...ds_instance_non_default_port.metadata.json | 30 ++++++++----- ...nce_protected_by_backup_plan.metadata.json | 36 +++++++++------ ...s_instance_storage_encrypted.metadata.json | 45 +++++++++++++------ ...instance_transport_encrypted.metadata.json | 29 +++++++----- .../rds_snapshots_encrypted.metadata.json | 35 +++++++++------ .../rds_snapshots_public_access.metadata.json | 28 ++++++++---- 35 files changed, 738 insertions(+), 438 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 32d1c36f69..9752f86cec 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -41,6 +41,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS Transfer service metadata to new format [(#9434)](https://github.com/prowler-cloud/prowler/pull/9434) - Update AWS S3 service metadata to new format [(#9552)](https://github.com/prowler-cloud/prowler/pull/9552) - Update AWS DataSync service metadata to new format [(#8854)](https://github.com/prowler-cloud/prowler/pull/8854) +- Update AWS RDS service metadata to new format [(#9551)](https://github.com/prowler-cloud/prowler/pull/9551) --- diff --git a/prowler/providers/aws/services/rds/rds_cluster_backtrack_enabled/rds_cluster_backtrack_enabled.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_backtrack_enabled/rds_cluster_backtrack_enabled.metadata.json index edcc73f639..438b51de95 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_backtrack_enabled/rds_cluster_backtrack_enabled.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_backtrack_enabled/rds_cluster_backtrack_enabled.metadata.json @@ -1,30 +1,40 @@ { "Provider": "aws", "CheckID": "rds_cluster_backtrack_enabled", - "CheckTitle": "Check if RDS Aurora MySQL Clusters have backtrack enabled.", - "CheckType": [], + "CheckTitle": "RDS Aurora MySQL cluster has Backtrack enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "low", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Ensure that the Backtrack feature is enabled for your Amazon Aurora (with MySQL compatibility) database clusters in order to backtrack your clusters to a specific time, without using backups. Backtrack is an Amazon RDS feature that allows you to specify the amount of time that an Aurora MySQL database cluster needs to retain change records, in order to have a fast way to recover from user errors, such as dropping the wrong table or deleting the wrong row by moving your MySQL database to a prior point in time without the need to restore from a recent backup.", - "Risk": "Once the Backtrack feature is enabled, Amazon RDS can quickly 'rewind' your Aurora MySQL database cluster to a point in time that you specify. In contrast to the backup and restore method, with Backtrack you can easily undo a destructive action, such as a DELETE query without a WHERE clause, with minimal downtime, you can rewind your Aurora cluster in just few minutes, and you can repeatedly backtrack a database cluster back and forth in time to help determine when a particular data change occurred.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-14", + "Description": "**Aurora MySQL DB clusters** have **Backtrack** configured with a non-zero `BacktrackWindow`, retaining change records to allow rewinding to a consistent earlier time. *Applies to `aurora-mysql` engines only.*", + "Risk": "Without **Backtrack**, destructive queries or admin mistakes can't be quickly undone, forcing snapshot/point-in-time restores. This increases recovery time, disrupts availability, and risks data **integrity** from partial restores or rollbacks.\n\nAdversaries who alter data can cause longer impact windows before containment.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/config/latest/developerguide/aurora-mysql-backtracking-enabled.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-14", + "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Managing.Backtrack.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html#" + ], "Remediation": { "Code": { - "CLI": "aws rds restore-db-cluster-to-point-in-time --region --source-db-cluster-identifier --db-cluster-identifier --restore-type copy-on-write --use-latest-restorable-time --backtrack-window 86400", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/backtrack.html#" + "CLI": "aws rds restore-db-cluster-to-point-in-time --source-db-cluster-identifier --db-cluster-identifier --use-latest-restorable-time --backtrack-window 3600", + "NativeIaC": "```yaml\n# CloudFormation: Create Aurora MySQL cluster with Backtrack enabled\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n Engine: aurora-mysql\n MasterUsername: \"\"\n MasterUserPassword: \"\"\n BacktrackWindow: 3600 # CRITICAL: Enables Backtrack (seconds) so the check passes\n```", + "Other": "1. In the AWS Console, go to RDS > Databases and select the Aurora MySQL cluster\n2. Click Actions > Restore to point in time\n3. Choose Use latest restorable time\n4. Set Backtrack window (seconds) to a value > 0 (e.g., 3600)\n5. Enter a new DB cluster identifier and click Restore DB cluster\n6. Cut over applications to the new cluster", + "Terraform": "```hcl\n# Terraform: Aurora MySQL cluster with Backtrack enabled\nresource \"aws_rds_cluster\" \"\" {\n engine = \"aurora-mysql\"\n master_username = \"\"\n master_password = \"\"\n backtrack_window = 3600 # CRITICAL: Enables Backtrack (seconds) so the check passes\n}\n```" }, "Recommendation": { - "Text": "Backups help you to recover more quickly from a security incident. They also strengthens the resilience of your systems. Aurora backtracking reduces the time to recover a database to a point in time. It does not require a database restore to do so. You cannot enable backtracking on an existing cluster. Instead, you can create a clone that has backtracking enabled.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-14" + "Text": "Enable **Backtrack** on Aurora MySQL clusters and set `BacktrackWindow` to meet RTO while balancing cost and workload. Use it with automated backups for **defense in depth** and resilience.\n\n*For clusters without Backtrack*, provision a clone or new cluster with it enabled; monitor usage and adjust the window as change rates evolve.", + "Url": "https://hub.prowler.com/check/rds_cluster_backtrack_enabled" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_cluster_copy_tags_to_snapshots/rds_cluster_copy_tags_to_snapshots.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_copy_tags_to_snapshots/rds_cluster_copy_tags_to_snapshots.metadata.json index ad43624e4d..63838f4938 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_copy_tags_to_snapshots/rds_cluster_copy_tags_to_snapshots.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_copy_tags_to_snapshots/rds_cluster_copy_tags_to_snapshots.metadata.json @@ -1,27 +1,33 @@ { "Provider": "aws", "CheckID": "rds_cluster_copy_tags_to_snapshots", - "CheckTitle": "Check if RDS DB clusters have copy tags to snapshots enabled", - "CheckType": [], + "CheckTitle": "RDS DB cluster has copy tags to snapshots enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Check if RDS DB clusters have copy tags to snapshots enabled, Aurora instances do not support this feature at instance level so those who are clustered will be scan by this check.", - "Risk": "If RDS clusters are not configured to copy tags to snapshots, it could lead to compliance issues as the snapshots will not inherit necessary metadata such as environment, owner, or purpose tags. This could result in inefficient tracking and management of RDS resources and their snapshots.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.CopyTags", + "Description": "**RDS DB clusters** are evaluated for the `CopyTagsToSnapshot` setting that propagates cluster tags to their DB snapshots.\n\n*Aurora tagging is configured at the cluster level; instance-level copying isn't supported.*", + "Risk": "**Missing tag propagation** leaves snapshots without consistent metadata, weakening **ABAC**, ownership tracking, and retention controls. This can allow overly broad access to backups, hinder incident scoping, and inflate costs-impacting **confidentiality** and operational governance.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-16", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.CopyTags" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-cluster --db-cluster-identifier --copy-tags-to-snapshot", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-16", - "Terraform": "" + "CLI": "aws rds modify-db-cluster --db-cluster-identifier --copy-tags-to-snapshot", + "NativeIaC": "```yaml\n# CloudFormation: enable copying tags to snapshots on an RDS DB cluster\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n CopyTagsToSnapshot: true # CRITICAL: ensures cluster tags are copied to snapshots\n```", + "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select the DB cluster and choose Modify\n3. Check Copy tags to snapshots\n4. Click Continue, then Apply changes", + "Terraform": "```hcl\n# Terraform: enable copying tags to snapshots on an RDS DB cluster\nresource \"aws_rds_cluster\" \"\" {\n copy_tags_to_snapshot = true # CRITICAL: ensures cluster tags are copied to snapshots\n}\n```" }, "Recommendation": { - "Text": "Ensure that the `CopyTagsToSnapshot` setting is enabled for all RDS clusters to propagate cluster tags to their snapshots for improved tracking and compliance.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.CopyTags" + "Text": "Enable `CopyTagsToSnapshot` on all applicable **RDS/Aurora clusters**.\n- Standardize required tags (owner, environment, data class)\n- Use **least privilege** and **ABAC** based on tags\n- Automate tagging and periodic audits so snapshots inherit metadata and lifecycle policies", + "Url": "https://hub.prowler.com/check/rds_cluster_copy_tags_to_snapshots" } }, "Categories": [], diff --git a/prowler/providers/aws/services/rds/rds_cluster_critical_event_subscription/rds_cluster_critical_event_subscription.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_critical_event_subscription/rds_cluster_critical_event_subscription.metadata.json index d41b20eab0..f0b819df1a 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_critical_event_subscription/rds_cluster_critical_event_subscription.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_critical_event_subscription/rds_cluster_critical_event_subscription.metadata.json @@ -1,32 +1,39 @@ { "Provider": "aws", "CheckID": "rds_cluster_critical_event_subscription", - "CheckTitle": "Check if RDS Cluster critical events are subscribed.", + "CheckTitle": "RDS cluster event subscription is enabled for maintenance and failure categories", "CheckType": [ - "Software and Configuration Checks, AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices" ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:account", - "Severity": "low", - "ResourceType": "AwsAccount", - "ResourceGroup": "governance", - "Description": "Ensure that Amazon RDS event notification subscriptions are enabled for database cluster events, particularly maintenance and failure.", - "Risk": "Without event subscriptions for critical events, such as maintenance and failures, you may not be aware of issues affecting your RDS clusters, leading to downtime or security vulnerabilities.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html", + "ResourceIdTemplate": "", + "Severity": "medium", + "ResourceType": "AwsRdsEventSubscription", + "ResourceGroup": "database", + "Description": "**RDS event subscriptions** for the `db-cluster` source type are enabled and cover critical cluster event categories: **`maintenance`** and **`failure`** (or all cluster events).", + "Risk": "Without notifications for **cluster maintenance** and **failure**, teams may miss engine updates, failovers, or node crashes, impacting **availability** and increasing MTTR. Prolonged degraded states can cause replication lag and potential **data integrity** issues, hindering timely containment.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Subscribing.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-19" + ], "Remediation": { "Code": { - "CLI": "aws rds create-event-subscription --source-type db-cluster --event-categories 'failure' 'maintenance' --sns-topic-arn ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-19", - "Terraform": "" + "CLI": "aws rds create-event-subscription --subscription-name --sns-topic-arn --source-type db-cluster --event-categories maintenance failure --enabled", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::RDS::EventSubscription\n Properties:\n SnsTopicArn: # Critical: SNS topic to receive notifications\n SourceType: db-cluster # Critical: Scope to DB clusters\n EventCategories: # Critical: Subscribe to required categories only\n - maintenance\n - failure\n Enabled: true # Critical: Must be enabled to pass\n```", + "Other": "1. In the AWS Console, go to RDS > Event subscriptions > Create event subscription\n2. Name: enter \n3. Send notifications to: Choose existing Amazon SNS ARN and select \n4. Source type: select Clusters\n5. Event categories: select only Maintenance and Failure (unselect others)\n6. Ensure Enabled is on\n7. Click Create", + "Terraform": "```hcl\nresource \"aws_db_event_subscription\" \"\" {\n name = \"\"\n sns_topic = \"\" # Critical: SNS topic ARN\n source_type = \"db-cluster\" # Critical: Scope to clusters\n event_categories = [\"maintenance\", \"failure\"] # Critical: Required categories\n enabled = true # Critical: Must be enabled\n}\n```" }, "Recommendation": { - "Text": "To subscribe to RDS cluster event notifications, see Subscribing to Amazon RDS event notification in the Amazon RDS User Guide.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Subscribing.html" + "Text": "Enable **event subscriptions** for RDS clusters that include `maintenance` and `failure`, delivered via **SNS** to monitored channels.\n- Enforce **least privilege** on topics\n- Separate topics per environment\n- Integrate with on-call/IR playbooks and test alerts\n- Add multiple recipients and escalation for **defense in depth**", + "Url": "https://hub.prowler.com/check/rds_cluster_critical_event_subscription" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_cluster_default_admin/rds_cluster_default_admin.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_default_admin/rds_cluster_default_admin.metadata.json index c01afd054a..b3a7075636 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_default_admin/rds_cluster_default_admin.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_default_admin/rds_cluster_default_admin.metadata.json @@ -1,30 +1,40 @@ { "Provider": "aws", "CheckID": "rds_cluster_default_admin", - "CheckTitle": "Ensure that your Amazon RDS clusters are not using the default master username.", - "CheckType": [], + "CheckTitle": "RDS cluster master username is not admin or postgres", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "TTPs/Initial Access", + "TTPs/Credential Access" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Ensure that your Amazon RDS clusters are not using the default master username.", - "Risk": "Since admin is the Amazon's example for the RDS database master username and postgres is the default PostgreSQL master username. Many AWS customers will use this username for their RDS database instances in production. Malicious users can use this information to their advantage and frequently try to use default master username during brute-force attacks.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-24", + "Description": "RDS DB clusters are evaluated for use of a **custom administrator username**, flagging clusters that use defaults such as `admin` or `postgres`.", + "Risk": "Using a well-known admin username simplifies **credential stuffing** and **brute-force** attempts. Attackers can focus on password guessing, increasing chances of compromise. A successful login enables data theft (**confidentiality**), unauthorized changes (**integrity**), and destructive operations or outages (**availability**).", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-24" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#" + "NativeIaC": "```yaml\n# Create an RDS DB cluster with a custom admin username\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n Engine: aurora-mysql\n MasterUsername: # CRITICAL: use a non-default username (not \"admin\" or \"postgres\")\n MasterUserPassword: \n```", + "Other": "1. In the AWS console, go to RDS > Databases > Create database\n2. Choose Amazon Aurora and the same engine family as your current cluster\n3. Under Settings, set Master username to a custom value that is not \"admin\" or \"postgres\" (CRITICAL)\n4. Create the new cluster, migrate your workload to it, update application connections, then delete the old cluster", + "Terraform": "```hcl\n# Create an RDS DB cluster with a custom admin username\nresource \"aws_rds_cluster\" \"\" {\n cluster_identifier = \"\"\n engine = \"aurora-mysql\"\n master_username = \"\" # CRITICAL: non-default username (not admin/postgres)\n master_password = \"\"\n}\n```" }, "Recommendation": { - "Text": "To change the master username configured for your Amazon RDS database clusters you must re-create them and migrate the existing data.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-24" + "Text": "Create databases with a **unique, non-default admin username** that doesn't reveal environment or org. Apply **least privilege** by using separate, non-admin accounts for applications. Prefer **IAM database authentication** and manage secrets centrally with rotation. Restrict admin access and monitor login attempts.", + "Url": "https://hub.prowler.com/check/rds_cluster_default_admin" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_cluster_deletion_protection/rds_cluster_deletion_protection.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_deletion_protection/rds_cluster_deletion_protection.metadata.json index c5516f84a5..b82b1cdd75 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_deletion_protection/rds_cluster_deletion_protection.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_deletion_protection/rds_cluster_deletion_protection.metadata.json @@ -1,30 +1,40 @@ { "Provider": "aws", "CheckID": "rds_cluster_deletion_protection", - "CheckTitle": "Check if RDS clusters have deletion protection enabled.", - "CheckType": [], + "CheckTitle": "RDS cluster has deletion protection enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", - "Severity": "low", + "ResourceIdTemplate": "", + "Severity": "medium", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Check if RDS clusters have deletion protection enabled.", - "Risk": "You can only delete clusters that do not have deletion protection enabled.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html", + "Description": "**RDS DB clusters** have **deletion protection** enabled (`deletion_protection=true`).", + "Risk": "Without **deletion protection**, a cluster can be removed by error or misuse, causing sudden **availability** loss and potential **data loss** if backups are outdated. Compromised identities or faulty automation can trigger destructive deletes, degrading **recoverability** and data **integrity**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-cluster --db-cluster-identifier --deletion-protection --apply-immediately", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-7", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled#terraform" + "CLI": "aws rds modify-db-cluster --db-cluster-identifier --deletion-protection", + "NativeIaC": "```yaml\n# CloudFormation: Enable deletion protection on an RDS DB Cluster\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n Engine: aurora-mysql\n DeletionProtection: true # Critical: prevents cluster deletion and passes the check\n```", + "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select the DB cluster (type: DB cluster)\n3. Click Modify\n4. Enable Deletion protection\n5. Choose Apply immediately and click Modify cluster", + "Terraform": "```hcl\n# Enable deletion protection on an existing RDS DB Cluster\nresource \"aws_rds_cluster\" \"\" {\n deletion_protection = true # Critical: prevents cluster deletion and passes the check\n}\n```" }, "Recommendation": { - "Text": "Enable deletion protection using the AWS Management Console for production DB clusters.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html" + "Text": "Enable **deletion protection** (`deletion_protection=true`) on production and other critical clusters. Enforce via IaC and organizational guardrails; apply **least privilege** to delete/modify actions; require **change control** and approvals. Maintain reliable **backups** to restore when protection must be lifted.", + "Url": "https://hub.prowler.com/check/rds_cluster_deletion_protection" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_cluster_iam_authentication_enabled/rds_cluster_iam_authentication_enabled.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_iam_authentication_enabled/rds_cluster_iam_authentication_enabled.metadata.json index 163e831e38..090d62173a 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_iam_authentication_enabled/rds_cluster_iam_authentication_enabled.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_iam_authentication_enabled/rds_cluster_iam_authentication_enabled.metadata.json @@ -1,30 +1,42 @@ { "Provider": "aws", "CheckID": "rds_cluster_iam_authentication_enabled", - "CheckTitle": "Check if RDS clusters have IAM authentication enabled.", - "CheckType": [], + "CheckTitle": "RDS cluster has IAM authentication enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Credential Access" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Check if RDS clusters have IAM authentication enabled.", - "Risk": "Ensure that the IAM Database Authentication feature is enabled for your RDS database clusters in order to use the Identity and Access Management (IAM) service to manage database access to your MySQL and PostgreSQL database clusters. With this feature enabled, you don't have to use a password when you connect to your MySQL/PostgreSQL database, instead you can use an authentication token. An authentication token is a unique string of characters with a lifetime of 15 minutes that Amazon RDS generates on your request. IAM Database Authentication removes the need of storing user credentials within the database configuration, because authentication is managed externally using Amazon IAM.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html", + "Description": "**RDS DB clusters** on supported engines (MySQL/MariaDB/PostgreSQL/Aurora) have **IAM database authentication** enabled for database logins, indicating token-based access managed by IAM instead of static passwords.", + "Risk": "Without **IAM DB authentication**, databases depend on long-lived passwords. Stolen or reused creds can enable unauthorized connections, data exfiltration, and tampering, harming **confidentiality** and **integrity**. Lacking short-lived tokens and centralized revocation expands blast radius and weakens **access control**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#", + "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.Enabling.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-12" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-instance --region --db-instance-identifier --enable-iam-database-authentication --apply-immediately", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-12", - "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#" + "CLI": "aws rds modify-db-cluster --db-cluster-identifier --enable-iam-database-authentication --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: Enable IAM authentication on an existing RDS/Aurora DB Cluster\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n EnableIAMDatabaseAuthentication: true # Critical: turns on IAM DB auth for the cluster\n```", + "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select the DB Cluster (not the instances)\n3. Click Modify\n4. In Database authentication, enable IAM database authentication\n5. Choose Apply immediately and click Modify cluster", + "Terraform": "```hcl\n# Enable IAM authentication on an existing RDS/Aurora cluster\nresource \"aws_rds_cluster\" \"\" {\n cluster_identifier = \"\"\n iam_database_authentication_enabled = true # Critical: enables IAM DB auth so the check passes\n}\n```" }, "Recommendation": { - "Text": "Enable IAM authentication for supported RDS clusters.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html" + "Text": "Enable **IAM database authentication** on supported clusters and enforce **least privilege**. Grant only necessary `rds-db:connect` permissions to specific principals, prefer role-based access for workloads to obtain short-lived tokens, require **TLS**, and deprecate static DB passwords. Pair with auditing and segmentation for **defense in depth**.", + "Url": "https://hub.prowler.com/check/rds_cluster_iam_authentication_enabled" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_cluster_integration_cloudwatch_logs/rds_cluster_integration_cloudwatch_logs.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_integration_cloudwatch_logs/rds_cluster_integration_cloudwatch_logs.metadata.json index 803989cb30..c6acca9336 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_integration_cloudwatch_logs/rds_cluster_integration_cloudwatch_logs.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_integration_cloudwatch_logs/rds_cluster_integration_cloudwatch_logs.metadata.json @@ -1,27 +1,35 @@ { "Provider": "aws", "CheckID": "rds_cluster_integration_cloudwatch_logs", - "CheckTitle": "Check if RDS cluster is integrated with CloudWatch Logs.", - "CheckType": [], + "CheckTitle": "RDS cluster has CloudWatch Logs export enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Check if RDS cluster is integrated with CloudWatch Logs. The types valid are Aurora MySQL, Aurora PostgreSQL, MySQL, PostgreSQL.", - "Risk": "If logs are not enabled, monitoring of service use and threat analysis is not possible.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html", + "Description": "**RDS clusters** running Aurora MySQL, Aurora PostgreSQL, MySQL, or PostgreSQL are assessed for **CloudWatch Logs publishing**, confirming that database logs are exported to a CloudWatch Logs group.", + "Risk": "Without publishing to CloudWatch, database events lack centralized visibility and retention.\nBrute-force, SQL injection, or privilege misuse may go undetected, hindering forensics and response, risking data confidentiality and integrity and delaying recovery.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing_cloudwatchlogs.html", + "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-34" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-cluster --db-cluster-identifier --cloudwatch-logs-export-configuration {'EnableLogTypes':['audit',error','general','slowquery']} --apply-immediately", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-34", - "Terraform": "" + "CLI": "aws rds modify-db-cluster --db-cluster-identifier --cloudwatch-logs-export-configuration '{\"EnableLogTypes\":[\"\"]}' --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: Enable CloudWatch Logs export for an RDS/Aurora DB cluster\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n Engine: \n MasterUsername: \n MasterUserPassword: \n EnableCloudwatchLogsExports:\n - # CRITICAL: Enables at least one supported log type (e.g., 'error' for MySQL or 'postgresql' for PostgreSQL) to pass the check\n```", + "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select your DB cluster and choose Modify\n3. Under Log exports, check at least one supported log type for your engine (e.g., error/general/slowquery/audit for MySQL, postgresql for PostgreSQL)\n4. Choose Continue, then Apply immediately, and click Modify cluster", + "Terraform": "```hcl\n# Terraform: Enable CloudWatch Logs export for an RDS/Aurora DB cluster\nresource \"aws_rds_cluster\" \"\" {\n engine = \"\"\n master_username = \"\"\n master_password = \"\"\n\n enabled_cloudwatch_logs_exports = [\n \"\" # CRITICAL: Enables at least one supported log type (e.g., \"error\" for MySQL or \"postgresql\" for PostgreSQL) to pass the check\n ]\n}\n```" }, "Recommendation": { - "Text": "Use CloudWatch Logs to perform real-time analysis of the log data. Create alarms and view metrics.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing_cloudwatchlogs.html" + "Text": "Publish RDS/Aurora logs to **CloudWatch Logs** and centralize analysis.\nSelect appropriate types (e.g., `error`, `general`, `slowquery`, `audit`), define retention, and create alarms. Limit log access with **least privilege** and integrate with SIEM for defense-in-depth monitoring.", + "Url": "https://hub.prowler.com/check/rds_cluster_integration_cloudwatch_logs" } }, "Categories": [ diff --git a/prowler/providers/aws/services/rds/rds_cluster_minor_version_upgrade_enabled/rds_cluster_minor_version_upgrade_enabled.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_minor_version_upgrade_enabled/rds_cluster_minor_version_upgrade_enabled.metadata.json index 08882bf0b9..87df083f42 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_minor_version_upgrade_enabled/rds_cluster_minor_version_upgrade_enabled.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_minor_version_upgrade_enabled/rds_cluster_minor_version_upgrade_enabled.metadata.json @@ -1,30 +1,41 @@ { "Provider": "aws", "CheckID": "rds_cluster_minor_version_upgrade_enabled", - "CheckTitle": "Ensure RDS clusters have minor version upgrade enabled.", - "CheckType": [], + "CheckTitle": "RDS cluster has automatic minor version upgrades enabled", + "CheckType": [ + "Software and Configuration Checks/Patch Management", + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Ensure RDS clusters have minor version upgrade enabled.", - "Risk": "Auto Minor Version Upgrade is a feature that you can enable to have your database automatically upgraded when a new minor database engine version is available. Minor version upgrades often patch security vulnerabilities and fix bugs and therefore should be applied.", - "RelatedUrl": "https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-to-major-and-minor-versions-of-postgresql/", + "Description": "**RDS Multi-AZ DB clusters** are configured for **automatic minor engine upgrades** via `auto_minor_version_upgrade`.\n\nThe evaluation checks these clusters to see if this setting is enabled so preferred minor releases are applied during the maintenance window.", + "Risk": "Without automatic minor upgrades, clusters can miss **security patches**, enabling exploitation of known flaws (confidentiality). Unfixed defects may corrupt data (**integrity**) or trigger crashes and failovers (**availability**). Emergency patching raises downtime and operational risk.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/modify-multi-az-db-cluster.html", + "https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/RDS/Types/CreateDBClusterMessage.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-35" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-cluster --db-cluster-identifier --auto-minor-version-upgrade --apply-immediately", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically#cloudformation", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-35", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically#terraform" + "CLI": "aws rds modify-db-cluster --db-cluster-identifier --auto-minor-version-upgrade", + "NativeIaC": "```yaml\n# CloudFormation snippet to enable automatic minor version upgrades on an RDS DB cluster\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n AutoMinorVersionUpgrade: true # Critical: enables automatic minor engine version upgrades to pass the check\n```", + "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select your Multi-AZ DB cluster\n3. Click Modify\n4. Set Auto minor version upgrade to Enabled\n5. Click Continue, then Modify cluster", + "Terraform": "```hcl\n# Terraform snippet to enable automatic minor version upgrades on an RDS DB cluster\nresource \"aws_rds_cluster\" \"\" {\n cluster_identifier = \"\"\n auto_minor_version_upgrade = true # Critical: enables automatic minor engine version upgrades to pass the check\n}\n```" }, "Recommendation": { - "Text": "Enable auto minor version upgrade for all databases and environments.", - "Url": "https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-to-major-and-minor-versions-of-postgresql/" + "Text": "Enable `auto_minor_version_upgrade` on **RDS Multi-AZ clusters** and align updates with approved maintenance windows. Validate changes in non-production, and document any exceptions with a strict manual patch cadence. This strengthens **defense in depth** and improves **availability**.", + "Url": "https://hub.prowler.com/check/rds_cluster_minor_version_upgrade_enabled" } }, - "Categories": [], + "Categories": [ + "vulnerabilities" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_cluster_multi_az/rds_cluster_multi_az.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_multi_az/rds_cluster_multi_az.metadata.json index 4a2c41c0de..78a4e0c0cd 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_multi_az/rds_cluster_multi_az.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_multi_az/rds_cluster_multi_az.metadata.json @@ -1,31 +1,39 @@ { "Provider": "aws", "CheckID": "rds_cluster_multi_az", - "CheckTitle": "Check if RDS clusters have multi-AZ enabled.", - "CheckType": [], + "CheckTitle": "RDS cluster has Multi-AZ enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Check if RDS clusters have multi-AZ enabled.", - "Risk": "In case of failure, with a single-AZ deployment configuration, should an availability zone specific database failure occur, Amazon RDS can not automatically fail over to the standby availability zone.", - "RelatedUrl": "https://aws.amazon.com/rds/features/multi-az/", + "Description": "**RDS DB clusters** are assessed for deployment across **multiple Availability Zones** (*Multi-AZ*), verifying that redundant instances exist to support **automatic failover** instead of a single-AZ configuration.", + "Risk": "A **single-AZ cluster** is a single point of failure. AZ outages, instance/storage faults, or maintenance can cause extended **downtime**, failed transactions, and worse **RTO/RPO**. Without cross-AZ replicas, recovery may require restores, increasing outage duration and risking service disruption and data consistency impacts.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-15", + "https://docs.amazonaws.cn/en_us/AmazonRDS/latest/UserGuide/Concepts.MultiAZ.html", + "https://aws.amazon.com/rds/features/multi-az/" + ], "Remediation": { "Code": { - "CLI": "aws rds create-db-cluster --db-cluster-identifier --multi-az true", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_73#cloudformation", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-15", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_73#terraform" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: create an RDS Multi-AZ DB cluster (non-Aurora)\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n Engine: mysql # CRITICAL: using mysql/postgres with the properties below creates a Multi-AZ DB cluster\n DBClusterInstanceClass: db.r6g.large # CRITICAL: required to make it a Multi-AZ DB cluster (creates 1 writer + 2 readers across AZs)\n AllocatedStorage: 100 # CRITICAL: required for Multi-AZ DB clusters\n Iops: 1000 # CRITICAL: required for Multi-AZ DB clusters\n StorageType: io1 # CRITICAL: required for Multi-AZ DB clusters\n MasterUsername: \n MasterUserPassword: \n```", + "Other": "1. In the AWS console, go to RDS > Databases > Create database\n2. Engine: select MySQL or PostgreSQL\n3. Under Availability and durability, select Multi-AZ DB cluster\n4. Enter DB cluster identifier and master credentials\n5. Choose a DB instance class and create the database\n6. Migrate data to this new Multi-AZ DB cluster and switch your applications to its endpoint", + "Terraform": "```hcl\n# Terraform: create an RDS Multi-AZ DB cluster (non-Aurora)\nresource \"aws_rds_cluster\" \"\" {\n cluster_identifier = \"\"\n engine = \"mysql\" # CRITICAL: mysql/postgres with the lines below creates a Multi-AZ DB cluster\n db_cluster_instance_class = \"db.r6g.large\" # CRITICAL: makes this a Multi-AZ DB cluster (1 writer + 2 readers across AZs)\n storage_type = \"io1\" # CRITICAL: required for Multi-AZ DB clusters\n allocated_storage = 100 # CRITICAL: required for Multi-AZ DB clusters\n iops = 1000 # CRITICAL: required for Multi-AZ DB clusters\n master_username = \"\"\n master_password = \"\"\n}\n```" }, "Recommendation": { - "Text": "Enable multi-AZ deployment for production databases.", - "Url": "https://aws.amazon.com/rds/features/multi-az/" + "Text": "Enable **Multi-AZ** for production DB clusters to ensure cross-AZ redundancy and **automatic failover**. Choose a model that meets your SLA (one standby or two readable standbys; Aurora spans 3 AZs). Place subnets in distinct AZs, implement connection retries, and regularly test failover to validate **RTO/RPO** and readiness.", + "Url": "https://hub.prowler.com/check/rds_cluster_multi_az" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/rds/rds_cluster_non_default_port/rds_cluster_non_default_port.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_non_default_port/rds_cluster_non_default_port.metadata.json index 2eea7fd1c9..824cde1e6f 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_non_default_port/rds_cluster_non_default_port.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_non_default_port/rds_cluster_non_default_port.metadata.json @@ -1,29 +1,34 @@ { "Provider": "aws", "CheckID": "rds_cluster_non_default_port", - "CheckTitle": "Check if RDS clusters are using non-default ports.", + "CheckTitle": "RDS cluster uses a non-default port for its database engine", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Discovery" ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:cluster:db-cluster", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Checks if an cluster uses a port other than the default port of the database engine. The control fails if the RDS cluster uses the default port.", - "Risk": "Using a default database port exposes the cluster to potential security vulnerabilities, as attackers are more likely to target known, commonly-used ports. This may result in unauthorized access to the database or increased susceptibility to automated attacks.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html", + "Description": "**RDS DB clusters** are assessed for use of a **non-default database port**.\n\nEvaluation focuses on whether the cluster listens on the engine's well-known default port (e.g., `3306`, `5432`, `1433`, `1521`, `50000`) or on a custom port.", + "Risk": "Using a **default DB port** eases discovery via mass scans and banner-grabbing, enabling:\n- Engine-specific exploit attempts\n- Brute-force/credential-stuffing of logins\n- Targeted DDoS on the service\n\nImpacts: **confidentiality** (unauthorized reads), **integrity** (data changes), **availability** (service disruption).", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-23" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-cluster --db-cluster-identifier --port ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-23", - "Terraform": "" + "CLI": "aws rds modify-db-cluster --db-cluster-identifier --port --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: Set a non-default port on an RDS/Aurora DB cluster\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n Engine: \n MasterUsername: \n MasterUserPassword: \n Port: # Critical: change to a non-default engine port to pass the check\n```", + "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select your DB cluster (not an individual instance)\n3. Click Modify\n4. Set Database port to a non-default value for the engine\n5. Check Apply immediately\n6. Click Continue, then Modify cluster", + "Terraform": "```hcl\n# Terraform: Set a non-default port on an RDS/Aurora DB cluster\nresource \"aws_rds_cluster\" \"\" {\n engine = \"\"\n master_username = \"\"\n master_password = \"\"\n port = # Critical: use a non-default engine port to pass the check\n}\n```" }, "Recommendation": { - "Text": "Modify the RDS cluster to use a non-default port, and ensure that the security group permits access to the new port.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html" + "Text": "Use a **non-default port** and enforce **least-privilege** network access:\n- Allow only approved sources\n- Keep databases in private subnets\n- Require TLS and strong, centralized auth\n- Monitor failed connections\n\nUpdate application connection strings to the new `port` as part of defense-in-depth.", + "Url": "https://hub.prowler.com/check/rds_cluster_non_default_port" } }, "Categories": [], diff --git a/prowler/providers/aws/services/rds/rds_cluster_protected_by_backup_plan/rds_cluster_protected_by_backup_plan.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_protected_by_backup_plan/rds_cluster_protected_by_backup_plan.metadata.json index 39b4a84294..46429ed196 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_protected_by_backup_plan/rds_cluster_protected_by_backup_plan.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_protected_by_backup_plan/rds_cluster_protected_by_backup_plan.metadata.json @@ -1,32 +1,39 @@ { "Provider": "aws", "CheckID": "rds_cluster_protected_by_backup_plan", - "CheckTitle": "Check if RDS clusters are protected by a backup plan.", + "CheckTitle": "RDS cluster is protected by an AWS Backup plan", "CheckType": [ - "Software and Configuration Checks, AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", - "Severity": "medium", - "ResourceType": "AwsRdsDbInstance", + "ResourceIdTemplate": "", + "Severity": "high", + "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Check if RDS clusters are protected by a backup plan.", - "Risk": "Without a backup plan, RDS clusters are vulnerable to data loss, accidental deletion, or corruption. This could lead to significant operational disruptions or loss of critical data.", - "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html", + "Description": "**RDS DB clusters** are covered by an **AWS Backup backup plan** when resource assignments include the cluster, either explicitly, by tags, or via an appropriate resource scope.", + "Risk": "Lack of centralized backups enables irreversible **data loss** and **corruption**, reducing **availability** and **integrity**. Accidental deletion, ransomware, or bad changes may become unrecoverable. Weak retention or no immutability undermines rollback and can breach recovery objectives.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-26" + ], "Remediation": { "Code": { - "CLI": "aws backup create-backup-plan --backup-plan , aws backup tag-resource --resource-arn --tags Key=backup,Value=true", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-26", - "Terraform": "" + "CLI": "aws backup create-backup-selection --backup-plan-id --backup-selection '{\"SelectionName\":\"rds-clusters\",\"IamRoleArn\":\"arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole\",\"Resources\":[\"arn:aws:rds:*:*:cluster:*\"]}'", + "NativeIaC": "```yaml\n# CloudFormation: assign RDS clusters to an AWS Backup plan\nResources:\n :\n Type: AWS::Backup::BackupSelection\n Properties:\n BackupPlanId: \"\"\n BackupSelection:\n SelectionName: \"rds-clusters\"\n IamRoleArn: \"arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole\"\n Resources:\n - \"arn:aws:rds:*:*:cluster:*\" # Critical: includes all RDS clusters in the plan to mark them protected\n```", + "Other": "1. In the AWS Backup console, go to Settings > Service opt-in and enable RDS if it is not enabled.\n2. Go to Backup plans and select an existing plan (create a minimal plan if none exists).\n3. Click Assign resources.\n4. Set a name and choose IAM role: AWSBackupDefaultServiceRole.\n5. Under Resources, choose By resource ID and select the target RDS DB cluster (or use the ARN), then click Assign resources.\n6. The cluster now appears as protected by the backup plan.", + "Terraform": "```hcl\n# Assign RDS clusters to an existing AWS Backup plan\nresource \"aws_backup_selection\" \"\" {\n name = \"rds-clusters\"\n plan_id = \"\"\n iam_role_arn = \"arn:aws:iam:::role/service-role/AWSBackupDefaultServiceRole\"\n\n resources = [\n \"arn:aws:rds:*:*:cluster:*\" # Critical: includes all RDS clusters in the plan to pass the check\n ]\n}\n```" }, "Recommendation": { - "Text": "Create a backup plan for the RDS cluster to protect it from data loss, accidental deletion, or corruption.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html" + "Text": "Include RDS clusters in an **AWS Backup backup plan**. Apply **defense in depth**: define schedules and retention, enable immutable vault controls and cross-Region copies, use tags for consistent coverage, enforce **least privilege** for backup roles, and regularly test restores to validate RPO/RTO.", + "Url": "https://hub.prowler.com/check/rds_cluster_protected_by_backup_plan" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_cluster_storage_encrypted/rds_cluster_storage_encrypted.metadata.json b/prowler/providers/aws/services/rds/rds_cluster_storage_encrypted/rds_cluster_storage_encrypted.metadata.json index 9575463b3c..67267e6a47 100644 --- a/prowler/providers/aws/services/rds/rds_cluster_storage_encrypted/rds_cluster_storage_encrypted.metadata.json +++ b/prowler/providers/aws/services/rds/rds_cluster_storage_encrypted/rds_cluster_storage_encrypted.metadata.json @@ -1,30 +1,40 @@ { "Provider": "aws", "CheckID": "rds_cluster_storage_encrypted", - "CheckTitle": "Check if RDS clusters storage is encrypted.", - "CheckType": [], + "CheckTitle": "RDS cluster storage is encrypted", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-cluster", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsRdsDbCluster", "ResourceGroup": "database", - "Description": "Check if RDS clusters storage is encrypted.", - "Risk": "If not enabled sensitive information at rest is not protected.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html", + "Description": "**RDS DB clusters** are assessed for **encryption at rest** via AWS KMS. It determines whether cluster storage-and related artifacts like automated backups and snapshots-are encrypted with a KMS key.", + "Risk": "Unencrypted clusters expose data on disk, logs, and snapshots to unauthorized reading if storage or backups are obtained. This compromises **confidentiality**, enables offline exfiltration from leaked snapshots, and can widen blast radius during incidents and migrations.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-27", + "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.html#Overview.Encryption.Enabling", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html" + ], "Remediation": { "Code": { - "CLI": "aws rds create-db-cluster --db-cluster-identifier --db-cluster-class --engine --storage-encrypted true", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-27", - "Terraform": "" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: Create an encrypted RDS/Aurora DB cluster\nResources:\n :\n Type: AWS::RDS::DBCluster\n Properties:\n Engine: \n MasterUsername: \n MasterUserPassword: \n StorageEncrypted: true # Critical: enables encryption at rest for the cluster\n```", + "Other": "1. In the AWS Console, go to RDS > Databases > Create database\n2. Select your engine (Aurora or Multi-AZ DB cluster)\n3. In the configuration, enable Storage encryption (Enable encryption)\n4. Leave the KMS key as default (aws/rds or aws/aurora) unless you require a custom key\n5. Create the cluster, migrate traffic, then delete the unencrypted cluster", + "Terraform": "```hcl\n# Terraform: Create an encrypted RDS/Aurora DB cluster\nresource \"aws_rds_cluster\" \"\" {\n engine = \"\"\n master_username = \"\"\n master_password = \"\"\n storage_encrypted = true # Critical: enables encryption at rest for the cluster\n}\n```" }, "Recommendation": { - "Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Overview.Encryption.html#Overview.Encryption.Enabling" + "Text": "Create clusters with `StorageEncrypted=true` using **AWS KMS**, preferably **customer-managed keys**. Apply **least privilege** to key usage, enable rotation and monitoring, and separate key administration from DB operations. Ensure snapshots and cross-account copies remain encrypted for **defense in depth**.", + "Url": "https://hub.prowler.com/check/rds_cluster_storage_encrypted" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_backup_enabled/rds_instance_backup_enabled.metadata.json b/prowler/providers/aws/services/rds/rds_instance_backup_enabled/rds_instance_backup_enabled.metadata.json index 50da9652bb..5c10c56b9c 100644 --- a/prowler/providers/aws/services/rds/rds_instance_backup_enabled/rds_instance_backup_enabled.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_backup_enabled/rds_instance_backup_enabled.metadata.json @@ -1,30 +1,40 @@ { "Provider": "aws", "CheckID": "rds_instance_backup_enabled", - "CheckTitle": "Check if RDS instances have backup enabled.", - "CheckType": [], + "CheckTitle": "RDS instance has backup retention period greater than 0 days", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances have backup enabled.", - "Risk": "If backup is not enabled, data is vulnerable. Human error or bad actors could erase or modify data.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html", + "Description": "**RDS DB instances** are evaluated for **automated backups** by confirming the backup retention period is greater than `0` days, indicating point-in-time recovery is configured.", + "Risk": "Without automated backups, you lose **point-in-time recovery**, impacting **availability** and **integrity**.\n\nAccidental deletes, destructive queries, or compromised accounts can cause unrecoverable data loss and prolonged outages, preventing reliable rollback during incidents.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-automated-backups-enabled.html" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-instance --db-instance-identifier --backup-retention-period 7 --apply-immediately", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-automated-backups-enabled.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-rds-instances-have-backup-policy#terraform" + "CLI": "aws rds modify-db-instance --db-instance-identifier --backup-retention-period 1 --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: enable automated backups on an RDS instance\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBInstanceClass: db.t3.micro\n Engine: mysql\n AllocatedStorage: 20\n MasterUsername: admin\n MasterUserPassword: \n BackupRetentionPeriod: 1 # CRITICAL: Enables automated backups (>0 days)\n```", + "Other": "1. Open the AWS Management Console and go to RDS > Databases\n2. Select the target DB instance and click Modify\n3. In Backup section, set Backup retention period to 1 day (or more)\n4. Check Apply immediately\n5. Click Continue (if shown) and then Modify DB instance", + "Terraform": "```hcl\n# Terraform: enable automated backups on an RDS instance\nresource \"aws_db_instance\" \"\" {\n allocated_storage = 20\n engine = \"mysql\"\n instance_class = \"db.t3.micro\"\n username = \"admin\"\n password = \"\"\n backup_retention_period = 1 # CRITICAL: Enables automated backups (>0 days)\n}\n```" }, "Recommendation": { - "Text": "Enable automated backup for production data. Define a retention period and periodically test backup restoration. A Disaster Recovery process should be in place to govern Data Protection approach.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_WorkingWithAutomatedBackups.html" + "Text": "Enable **automated backups** with retention > `0` aligned to RPO/RTO. Regularly test restores to validate **PITR**.\n\nApply **least privilege** to backup access, encrypt snapshots, and replicate critical backups to separate locations for **defense in depth** and resilient recovery.", + "Url": "https://hub.prowler.com/check/rds_instance_backup_enabled" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.metadata.json b/prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.metadata.json index 490008f1b7..b50ad339dd 100644 --- a/prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_certificate_expiration/rds_instance_certificate_expiration.metadata.json @@ -1,27 +1,35 @@ { "Provider": "aws", "CheckID": "rds_instance_certificate_expiration", - "CheckTitle": "Ensure that the SSL/TLS certificates configured for your Amazon RDS are not expired.", - "CheckType": [], + "CheckTitle": "RDS instance SSL/TLS certificate has more than 3 months of validity remaining", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Patch Management", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "To maintain Amazon RDS database security and avoid interruption of the applications that are using RDS and/or Aurora databases, rotate the required SSL/TLS certificates and update the deprecated Certificate Authority (CA) certificates at the Amazon RDS instance level.", - "Risk": "Interruption of application if the certificate expires.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html", + "Description": "**RDS DB instances** are evaluated for **server certificate validity** windows, including default and **customer-managed certificates**. Certificates **expired** or **approaching expiration** (e.g., `<1 month`, `<3 months`, `3-6 months`, `>6 months`) are identified using the certificate `valid_till` date.", + "Risk": "Without timely rotation:\n- TLS failures block DB connections, impacting **availability**\n- Bypassed or weak validation enables **MITM**, risking **confidentiality** and **integrity**\n- Emergency changes increase **operational risk** and error rates", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rotate-rds-certificates.html" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-instance --region us-east-1 --db-instance-identifier cc-project5-mysql-database --ca-certificate-identifier \"rds-ca-2019\" --apply-immediately", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rotate-rds-certificates.html", - "Terraform": "" + "CLI": "aws rds modify-db-instance --db-instance-identifier --ca-certificate-identifier rds-ca-rsa2048-g1 --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: update RDS instance CA to a current certificate\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n CACertificateIdentifier: rds-ca-rsa2048-g1 # CRITICAL: rotates to a valid CA to restore >3 months certificate validity\n```", + "Other": "1. In the AWS Console, go to RDS > Databases and select the DB instance\n2. Click Modify\n3. In Connectivity (or Certificate authority), select rds-ca-rsa2048-g1\n4. Check Apply immediately\n5. Click Continue (if shown) and then Modify DB instance", + "Terraform": "```hcl\n# Set a current CA on the RDS instance\nresource \"aws_db_instance\" \"\" {\n identifier = \"\"\n ca_cert_identifier = \"rds-ca-rsa2048-g1\" # CRITICAL: rotates to a valid CA to ensure certificate validity >3 months\n}\n```" }, "Recommendation": { - "Text": "To maintain Amazon RDS database security and avoid interruption of the applications that are using RDS and/or Aurora databases, rotate the required SSL/TLS certificates and update the deprecated Certificate Authority (CA) certificates at the Amazon RDS instance level.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL-certificate-rotation.html" + "Text": "Establish a **certificate lifecycle** for RDS:\n- Rotate server/CA certs well before expiry; avoid pinned or outdated CAs\n- Keep client trust stores current and enforce TLS with validation\n- Monitor expiry and automate alerts/rotation\n- For custom certs, apply **least privilege**, **separation of duties**, and periodic key rotation; test changes", + "Url": "https://hub.prowler.com/check/rds_instance_certificate_expiration" } }, "Categories": [ diff --git a/prowler/providers/aws/services/rds/rds_instance_copy_tags_to_snapshots/rds_instance_copy_tags_to_snapshots.metadata.json b/prowler/providers/aws/services/rds/rds_instance_copy_tags_to_snapshots/rds_instance_copy_tags_to_snapshots.metadata.json index 5711cbdff2..4258b0d101 100644 --- a/prowler/providers/aws/services/rds/rds_instance_copy_tags_to_snapshots/rds_instance_copy_tags_to_snapshots.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_copy_tags_to_snapshots/rds_instance_copy_tags_to_snapshots.metadata.json @@ -1,27 +1,34 @@ { "Provider": "aws", "CheckID": "rds_instance_copy_tags_to_snapshots", - "CheckTitle": "Check if RDS DB instances have copy tags to snapshots enabled", - "CheckType": [], + "CheckTitle": "RDS DB instance has copy tags to snapshots enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS DB instances have copy tags to snapshots enabled, Aurora instances can not have this feature enabled at this level, they will have it at cluster level", - "Risk": "If RDS instances are not configured to copy tags to snapshots, it could lead to compliance issues as the snapshots will not inherit necessary metadata such as environment, owner, or purpose tags. This could result in inefficient tracking and management of RDS resources and their snapshots.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Tagging.html#USER_Tagging.CopyTags", + "Description": "**RDS DB instances** are assessed for propagating instance tags to their **DB snapshots** using `CopyTagsToSnapshot`.\n\n*Aurora engines manage this at the cluster level and aren't evaluated per instance.*", + "Risk": "Snapshots without inherited tags lose ownership, environment, and sensitivity context, degrading visibility and governance. Missing metadata weakens **ABAC**, cost allocation, and lifecycle policies, enabling unintended backup access, orphaned snapshots, and retention drift that impact confidentiality and availability.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-aws-enable-tags-snapshot-rds-instance.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-17", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/copy-tags-to-snapshot.html" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-instance --db-instance-identifier --copy-tags-to-snapshot", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-17", - "Terraform": "" + "CLI": "aws rds modify-db-instance --db-instance-identifier --copy-tags-to-snapshot --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: enable copying tags to snapshots on an RDS DB instance\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n CopyTagsToSnapshot: true # Critical: ensures DB instance tags are copied to snapshots\n```", + "Other": "1. In the AWS Console, go to RDS > Databases and select the non-Aurora DB instance\n2. Click Modify\n3. Under Additional configuration, enable Copy tags to snapshots\n4. Check Apply immediately and click Modify DB instance", + "Terraform": "```hcl\n# Terraform: enable copying tags to snapshots on an RDS DB instance\nresource \"aws_db_instance\" \"\" {\n copy_tags_to_snapshot = true # Critical: ensures DB instance tags are copied to snapshots\n}\n```" }, "Recommendation": { - "Text": "Ensure that the `CopyTagsToSnapshot` setting is enabled for all RDS instances to propagate instance tags to their snapshots for improved tracking and compliance.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html" + "Text": "Enable `CopyTagsToSnapshot` on non-Aurora RDS instances so snapshots inherit required metadata. Establish a consistent **tag taxonomy** and automate enforcement to support **least privilege** via ABAC, cost tracking, and retention controls. For Aurora, configure tag copy at the cluster level.", + "Url": "https://hub.prowler.com/check/rds_instance_copy_tags_to_snapshots" } }, "Categories": [], diff --git a/prowler/providers/aws/services/rds/rds_instance_critical_event_subscription/rds_instance_critical_event_subscription.metadata.json b/prowler/providers/aws/services/rds/rds_instance_critical_event_subscription/rds_instance_critical_event_subscription.metadata.json index e26e7b984a..97f17a6a96 100644 --- a/prowler/providers/aws/services/rds/rds_instance_critical_event_subscription/rds_instance_critical_event_subscription.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_critical_event_subscription/rds_instance_critical_event_subscription.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "rds_instance_critical_event_subscription", - "CheckTitle": "Check if RDS Instances events are subscribed.", + "CheckTitle": "RDS instance event subscription is enabled for maintenance, configuration change, and failure categories", "CheckType": [ - "Software and Configuration Checks, AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices" ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", - "Severity": "low", + "ResourceIdTemplate": "", + "Severity": "medium", "ResourceType": "AwsRdsEventSubscription", "ResourceGroup": "database", - "Description": "Ensure that Amazon RDS event notification subscriptions are enabled for database database events, particularly maintenance, configuration change and failure.", - "Risk": "Without event subscriptions for critical events, such as maintenance, configuration changes and failures, you may not be aware of issues affecting your RDS instances, leading to downtime or security vulnerabilities.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html", + "Description": "**RDS event subscriptions** for DB instances are assessed for coverage of the critical categories `maintenance`, `configuration change`, and `failure`.\n\nThe evaluation looks for enabled `db-instance` subscriptions and confirms these categories are included or that all events are selected.", + "Risk": "Without these notifications, critical DB events go unseen, undermining **availability** and **integrity**. Missed outages, unexpected restarts, or silent parameter changes can delay response, prolong downtime, corrupt data flows, and leave misconfigurations unaddressed.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Subscribing.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-instance-level-events.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-20" + ], "Remediation": { "Code": { - "CLI": "aws rds create-event-subscription --source-type db-instance --event-categories 'failure' 'maintenance' 'configuration change' --sns-topic-arn ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-20", - "Terraform": "" + "CLI": "aws rds create-event-subscription --subscription-name --sns-topic-arn --source-type db-instance --event-categories \"maintenance\" \"configuration change\" \"failure\"", + "NativeIaC": "```yaml\n# CloudFormation: RDS DB instance event subscription\nResources:\n :\n Type: AWS::RDS::EventSubscription\n Properties:\n SnsTopicArn: # critical: SNS topic to receive notifications\n SourceType: db-instance # critical: subscribe to DB instance events\n EventCategories: # critical: required categories for PASS\n - maintenance\n - configuration change\n - failure\n```", + "Other": "1. Open the AWS Console and go to RDS\n2. In the left menu, select Event subscriptions > Create event subscription\n3. Send notifications to: select an existing SNS topic ()\n4. Source type: choose Instances\n5. Event categories: select Maintenance, Configuration change, and Failure\n6. Create the subscription", + "Terraform": "```hcl\n# Terraform: RDS DB instance event subscription\nresource \"aws_db_event_subscription\" \"\" {\n name = \"\"\n sns_topic = \"\"\n source_type = \"db-instance\" # critical: DB instance events\n event_categories = [\"maintenance\", \"configuration change\", \"failure\"] # critical: required categories\n}\n```" }, "Recommendation": { - "Text": "To subscribe to RDS instance event notifications, see Subscribing to Amazon RDS event notification in the Amazon RDS User Guide.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Subscribing.html" + "Text": "Establish and sustain **RDS event subscriptions** for `db-instance` that include `maintenance`, `configuration change`, and `failure`.\n- Deliver to monitored channels (ticketing/chat/paging)\n- Enforce **least privilege** on topics\n- Test alert delivery and runbooks\n- Periodically review coverage across Regions", + "Url": "https://hub.prowler.com/check/rds_instance_critical_event_subscription" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_default_admin/rds_instance_default_admin.metadata.json b/prowler/providers/aws/services/rds/rds_instance_default_admin/rds_instance_default_admin.metadata.json index 2f4ae743c4..ce8b7b036b 100644 --- a/prowler/providers/aws/services/rds/rds_instance_default_admin/rds_instance_default_admin.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_default_admin/rds_instance_default_admin.metadata.json @@ -1,30 +1,39 @@ { "Provider": "aws", "CheckID": "rds_instance_default_admin", - "CheckTitle": "Ensure that your Amazon RDS instances are not using the default master username.", - "CheckType": [], + "CheckTitle": "RDS instance does not use the default master username (admin or postgres)", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "TTPs/Credential Access" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Ensure that your Amazon RDS instances are not using the default master username.", - "Risk": "Since admin is the Amazon's example for the RDS database master username and postgres is the default PostgreSQL master username. Many AWS customers will use this username for their RDS database instances in production. Malicious users can use this information to their advantage and frequently try to use default master username during brute-force attacks.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-25", + "Description": "**RDS DB instances** are evaluated for use of a **custom administrator username**. The finding identifies instances or clusters where the admin user matches common defaults like `admin` or `postgres` (checked at the instance or cluster level).", + "Risk": "Using a predictable admin name enables **password spraying**, **credential stuffing**, and username **enumeration**. A successful login can expose data (**confidentiality**), allow tampering (**integrity**), and disrupt service (**availability**). Defaults also attract automated scans targeting known usernames.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-25", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-master-username.html#" + "NativeIaC": "```yaml\n# CloudFormation: Create an RDS instance with a non-default master username\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n Engine: mysql\n DBInstanceClass: db.t3.micro\n AllocatedStorage: 20\n MasterUsername: # Critical: use a custom admin username (not \"admin\" or \"postgres\")\n MasterUserPassword: \n```", + "Other": "1. In the AWS Console, go to RDS > Databases and click Create database\n2. Choose your engine and select Standard create\n3. In Settings, set Master username to a value that is not \"admin\" or \"postgres\"\n4. Complete creation and note the new endpoint\n5. Migrate data from the old instance to the new one (e.g., dump/restore or replication)\n6. Update applications to use the new endpoint, then delete the old instance\n7. If the instance is part of an Aurora cluster, create a new cluster with a non-default master username and migrate to it", + "Terraform": "```hcl\n# Terraform: Create an RDS instance with a non-default master username\nresource \"aws_db_instance\" \"\" {\n engine = \"mysql\"\n instance_class = \"db.t3.micro\"\n allocated_storage = 20\n username = \"\" # Critical: custom admin username (not \"admin\" or \"postgres\")\n password = \"\"\n}\n```" }, "Recommendation": { - "Text": "To change the master username configured for your Amazon RDS database instances you must re-create them and migrate the existing data.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-25" + "Text": "Adopt a **unique, non-default admin username** for each database and avoid enabling default accounts.\n- Enforce **least privilege** with separate admin and app users\n- Use strong, rotated secrets in a manager and prefer **IAM DB authentication**\n- Restrict network exposure and audit authentication activity", + "Url": "https://hub.prowler.com/check/rds_instance_default_admin" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_deletion_protection/rds_instance_deletion_protection.metadata.json b/prowler/providers/aws/services/rds/rds_instance_deletion_protection/rds_instance_deletion_protection.metadata.json index a1643359b6..7c406bef48 100644 --- a/prowler/providers/aws/services/rds/rds_instance_deletion_protection/rds_instance_deletion_protection.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_deletion_protection/rds_instance_deletion_protection.metadata.json @@ -1,30 +1,40 @@ { "Provider": "aws", "CheckID": "rds_instance_deletion_protection", - "CheckTitle": "Check if RDS instances have deletion protection enabled.", - "CheckType": [], + "CheckTitle": "RDS instance has deletion protection enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances have deletion protection enabled.", - "Risk": "You can only delete instances that do not have deletion protection enabled.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html", + "Description": "**RDS DB instances** are assessed for **deletion protection**. If an instance belongs to an Aurora cluster, the setting is evaluated at the cluster level; otherwise, it is evaluated on the instance itself.", + "Risk": "Without **deletion protection**, a user or pipeline can delete a database in one action, causing immediate loss of availability and possible data loss if backups are stale or missing. This heightens exposure to insider misuse, compromised credentials, or faulty automation, increasing recovery time and cost.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/instance-deletion-protection.html", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html" + ], "Remediation": { "Code": { "CLI": "aws rds modify-db-instance --db-instance-identifier --deletion-protection --apply-immediately", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/instance-deletion-protection.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-that-rds-clusters-and-instances-have-deletion-protection-enabled#terraform" + "NativeIaC": "```yaml\n# CloudFormation: enable deletion protection\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DeletionProtection: true # Critical: enables deletion protection for standalone instances\n\n :\n Type: AWS::RDS::DBCluster\n Properties:\n DeletionProtection: true # Critical: enables deletion protection at cluster level (required for Aurora members)\n```", + "Other": "1. In the AWS console, go to RDS > Databases\n2. For a standalone DB instance: select the instance > Modify > enable Deletion protection > Continue > Apply immediately > Modify DB instance\n3. For an Aurora/clustered instance: switch to the cluster (Writer) > Modify > enable Deletion protection > Continue > Apply immediately > Modify cluster", + "Terraform": "```hcl\n# Enable deletion protection on a standalone RDS instance\nresource \"aws_db_instance\" \"\" {\n deletion_protection = true # Critical: prevents instance deletion\n}\n\n# Enable deletion protection on an RDS/Aurora cluster\nresource \"aws_rds_cluster\" \"\" {\n deletion_protection = true # Critical: prevents cluster deletion (required for instances in this cluster)\n}\n```" }, "Recommendation": { - "Text": "Enable deletion protection using the AWS Management Console for production DB instances.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_DeleteInstance.html" + "Text": "Enable `deletion protection` on production RDS instances and Aurora clusters. Enforce **least privilege** for delete/modify actions and require change control to disable protection. Use **defense in depth** with reliable backups and tested restores to limit impact if a deletion occurs.", + "Url": "https://hub.prowler.com/check/rds_instance_deletion_protection" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version.metadata.json b/prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version.metadata.json index 378b8e0cac..0346756c88 100644 --- a/prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_deprecated_engine_version/rds_instance_deprecated_engine_version.metadata.json @@ -1,30 +1,38 @@ { "Provider": "aws", "CheckID": "rds_instance_deprecated_engine_version", - "CheckTitle": "Check if RDS instance is using a supported engine version", - "CheckType": [], + "CheckTitle": "RDS instance uses a supported engine version", + "CheckType": [ + "Software and Configuration Checks/Patch Management", + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS is using a supported engine version for MariaDB, MySQL and PostgreSQL", - "Risk": "If not enabled RDS instances may be vulnerable to security issues", - "RelatedUrl": "https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html", + "Description": "**RDS DB instances** use a **supported, non-deprecated engine version** for MariaDB, MySQL, or PostgreSQL. The instance's `engine` and `engine_version` are evaluated against versions currently supported in the region.", + "Risk": "Deprecated engine versions lack security fixes and support, enabling exploitation of known flaws impacting **confidentiality** and **integrity**. **Availability** can suffer from forced maintenance or failed upgrades.\n- Unpatched CVEs\n- TLS/client incompatibilities\n- Replication or backup/restore issues", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html" + ], "Remediation": { "Code": { - "CLI": "aws rds describe-db-engine-versions --engine '", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "CLI": "aws rds modify-db-instance --db-instance-identifier --engine-version --allow-major-version-upgrade --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: upgrade RDS engine version for an existing instance\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBInstanceIdentifier: \n Engine: \n DBInstanceClass: db.t3.micro\n EngineVersion: # CRITICAL: move to a supported engine version\n AllowMajorVersionUpgrade: true # CRITICAL: required if upgrading major version\n ApplyImmediately: true # CRITICAL: apply change now to pass the check\n```", + "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select the DB instance\n3. Click Modify\n4. Under DB engine version, select a supported version\n5. If moving to a new major version, check Allow major version upgrade\n6. Check Apply immediately\n7. Click Continue, then Modify DB instance", + "Terraform": "```hcl\n# Upgrade RDS engine version\nresource \"aws_db_instance\" \"\" {\n identifier = \"\"\n engine = \"\"\n instance_class = \"db.t3.micro\"\n allocated_storage = 20\n\n engine_version = \"\" # CRITICAL: use a supported version\n allow_major_version_upgrade = true # CRITICAL: needed for major upgrades\n apply_immediately = true # CRITICAL: apply now to pass the check\n}\n```" }, "Recommendation": { - "Text": "Ensure all the RDS instances are using a supported engine version", - "Url": "https://docs.aws.amazon.com/cli/latest/reference/rds/describe-db-engine-versions.html" + "Text": "Standardize on **supported engine versions** and keep them current.\n- Plan and test upgrades; back up and define rollback\n- Enable `AutoMinorVersionUpgrade` where acceptable\n- Monitor deprecation notices and upgrade before EoS\n- Enforce **least privilege** to limit blast radius during incidents", + "Url": "https://hub.prowler.com/check/rds_instance_deprecated_engine_version" } }, - "Categories": [], + "Categories": [ + "vulnerabilities" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_enhanced_monitoring_enabled/rds_instance_enhanced_monitoring_enabled.metadata.json b/prowler/providers/aws/services/rds/rds_instance_enhanced_monitoring_enabled/rds_instance_enhanced_monitoring_enabled.metadata.json index f465173ae1..24dabf0f6a 100644 --- a/prowler/providers/aws/services/rds/rds_instance_enhanced_monitoring_enabled/rds_instance_enhanced_monitoring_enabled.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_enhanced_monitoring_enabled/rds_instance_enhanced_monitoring_enabled.metadata.json @@ -1,30 +1,39 @@ { "Provider": "aws", "CheckID": "rds_instance_enhanced_monitoring_enabled", - "CheckTitle": "Check if RDS instances has enhanced monitoring enabled.", - "CheckType": [], + "CheckTitle": "RDS instance has enhanced monitoring enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances has enhanced monitoring enabled.", - "Risk": "A smaller monitoring interval results in more frequent reporting of OS metrics.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.html", + "Description": "**RDS DB instances** are evaluated for **Enhanced Monitoring** being enabled, which publishes real-time **OS-level metrics** (CPU, memory, disk, network) to CloudWatch Logs for each instance.", + "Risk": "Without **Enhanced Monitoring**, you lack **real-time OS telemetry**, delaying detection of resource saturation and abnormal activity.\n\nThis raises MTTR and risks **availability** impacts (timeouts, failovers), reduces **integrity** assurance during incidents, and weakens forensic visibility.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.html", + "https://support.icompaas.com/support/solutions/articles/62000233699-ensu-rds-instances-has-enhanced-monitoring-enabled" + ], "Remediation": { "Code": { - "CLI": "aws rds create-db-instance --db-instance-identifier --db-instance-class --engine --storage-encrypted true", - "NativeIaC": "", - "Other": "", - "Terraform": "https://docs.prowler.com/checks/aws/logging-policies/ensure-that-enhanced-monitoring-is-enabled-for-amazon-rds-instances#terraform" + "CLI": "aws rds modify-db-instance --db-instance-identifier --monitoring-interval 60 --monitoring-role-arn ", + "NativeIaC": "```yaml\n# CloudFormation: enable Enhanced Monitoring on an existing RDS instance\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBInstanceIdentifier: \n MonitoringRoleArn: # CRITICAL: IAM role RDS uses to publish OS metrics to CloudWatch Logs\n MonitoringInterval: 60 # CRITICAL: >0 enables Enhanced Monitoring (seconds)\n```", + "Other": "1. In the AWS Console, go to RDS > Databases and select the DB instance\n2. Click Modify\n3. In Monitoring, check Enable Enhanced Monitoring and set Granularity to any non-zero value (e.g., 60 seconds)\n4. Set Monitoring role to Default (creates rds-monitoring-role) or select an existing role\n5. Click Continue, then Modify DB instance to apply", + "Terraform": "```hcl\n# Enable Enhanced Monitoring on an existing RDS instance\nresource \"aws_db_instance\" \"\" {\n # ...existing required configuration...\n monitoring_role_arn = \"\" # CRITICAL: Role for publishing OS metrics\n monitoring_interval = 60 # CRITICAL: >0 enables Enhanced Monitoring (seconds)\n}\n```" }, "Recommendation": { - "Text": "To use Enhanced Monitoring, you must create an IAM role, and then enable Enhanced Monitoring.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Monitoring.OS.html" + "Text": "Enable **Enhanced Monitoring** on RDS, using a `>0s` collection interval aligned to workload and cost. Assign a **least-privilege** role for log delivery, and apply **defense in depth** by centralizing logs, setting **alerts** on key OS metrics, and defining **retention** to support incident response and trend analysis.", + "Url": "https://hub.prowler.com/check/rds_instance_enhanced_monitoring_enabled" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_event_subscription_parameter_groups/rds_instance_event_subscription_parameter_groups.metadata.json b/prowler/providers/aws/services/rds/rds_instance_event_subscription_parameter_groups/rds_instance_event_subscription_parameter_groups.metadata.json index b68cd7366d..73a20fe710 100644 --- a/prowler/providers/aws/services/rds/rds_instance_event_subscription_parameter_groups/rds_instance_event_subscription_parameter_groups.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_event_subscription_parameter_groups/rds_instance_event_subscription_parameter_groups.metadata.json @@ -1,30 +1,39 @@ { "Provider": "aws", "CheckID": "rds_instance_event_subscription_parameter_groups", - "CheckTitle": "Check if RDS Parameter Group events are subscribed.", - "CheckType": [], + "CheckTitle": "RDS DB parameter group event subscription is enabled and subscribes to configuration change events or all categories", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:account", + "ResourceIdTemplate": "", "Severity": "low", - "ResourceType": "AwsAccount", - "ResourceGroup": "governance", - "Description": "Ensure that Amazon RDS event notification subscriptions are enabled for database parameter groups events.", - "Risk": "Amazon RDS event subscriptions for database parameter groups are designed to provide incident notification of events that may affect the security, availability, and reliability of the RDS database instances associated with these parameter groups.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html", + "ResourceType": "AwsRdsEventSubscription", + "ResourceGroup": "database", + "Description": "**RDS event subscriptions** for **DB parameter groups** notify on `configuration change` events (or all categories) when the subscription is enabled", + "Risk": "Missing alerts on parameter changes erodes visibility. Attackers or mistakes can lower TLS requirements, disable auditing, or relax auth, enabling data exposure (**confidentiality**), unauthorized writes (**integrity**), or outages from unsafe settings (**availability**).", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-21" + ], "Remediation": { "Code": { - "CLI": "aws rds create-event-subscription --source-type db-instance --event-categories 'configuration change' --sns-topic-arn ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-21", - "Terraform": "" + "CLI": "aws rds create-event-subscription --subscription-name --sns-topic-arn --source-type db-parameter-group --event-categories \"configuration change\" --enabled", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::RDS::EventSubscription\n Properties:\n SnsTopicArn: \n SourceType: db-parameter-group # Critical: targets DB parameter group events\n EventCategories:\n - configuration change # Critical: subscribes to configuration change events\n Enabled: true # Critical: subscription must be enabled\n```", + "Other": "1. In the AWS Console, go to Amazon RDS > Event subscriptions\n2. Click Create event subscription\n3. Send notifications to: select an existing SNS topic\n4. Source type: Parameter groups\n5. Event categories: select Configuration change (or choose All event categories)\n6. Ensure Enabled is On\n7. Click Create", + "Terraform": "```hcl\nresource \"aws_db_event_subscription\" \"\" {\n name = \"\"\n sns_topic = \"\"\n source_type = \"db-parameter-group\" # Critical: target DB parameter groups\n event_categories = [\"configuration change\"] # Critical: include configuration change events\n}\n```" }, "Recommendation": { - "Text": "To subscribe to RDS instance event notifications, see Subscribing to Amazon RDS event notification in the Amazon RDS User Guide.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_Events.Subscribing.html" + "Text": "Create and maintain an **SNS-backed event subscription** for **DB parameter groups** that includes `configuration change` (or all) and keep it enabled.\n\n- Apply **least privilege** to SNS topics\n- Route to on-call/SIEM and test alerts\n- Enforce change control and monitoring across all Regions", + "Url": "https://hub.prowler.com/check/rds_instance_event_subscription_parameter_groups" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups.metadata.json b/prowler/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups.metadata.json index 9e59493988..1019190f08 100644 --- a/prowler/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_event_subscription_security_groups/rds_instance_event_subscription_security_groups.metadata.json @@ -1,30 +1,39 @@ { "Provider": "aws", "CheckID": "rds_instance_event_subscription_security_groups", - "CheckTitle": "Check if RDS Security Group events are subscribed.", - "CheckType": [], + "CheckTitle": "RDS event subscription for DB security groups is enabled for configuration change and failure events", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:es", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsEventSubscription", "ResourceGroup": "database", - "Description": "Ensure that Amazon RDS event notification subscriptions are enabled for database security groups events.", - "Risk": "Amazon RDS event subscriptions for database security groups are designed to provide incident notification of events that may affect the security, availability, and reliability of the RDS database instances associated with these security groups.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-22", + "Description": "**RDS event subscriptions** are evaluated for **database security group** events. The check expects an enabled subscription with source type `db-security-group` that includes the `configuration change` and `failure` event categories.", + "Risk": "Missing alerts on **security group changes** or **failures** reduces visibility and slows response. Undetected rule changes can expose databases, while unnoticed failures prolong outages, impacting **confidentiality** and **availability** through unauthorized access or service disruption.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-db-security-groups-events.html#", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-22" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-db-security-groups-events.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-db-security-groups-events.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-db-security-groups-events.html#" + "CLI": "aws rds create-event-subscription --subscription-name --sns-topic-arn --source-type db-security-group --event-categories \"configuration change\" \"failure\"", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::RDS::EventSubscription\n Properties:\n SnsTopicArn: \n SourceType: db-security-group # Critical: subscribe to DB security group events\n EventCategories: # Critical: required categories\n - configuration change\n - failure\n```", + "Other": "1. Open the AWS Console > RDS > Event subscriptions\n2. Click Create event subscription\n3. Set Name to and select an existing SNS topic\n4. Set Source type to Security group\n5. Under Event categories, select Configuration change and Failure\n6. Leave Targets as All security groups (no specific IDs)\n7. Ensure Enabled is On and click Create", + "Terraform": "```hcl\nresource \"aws_db_event_subscription\" \"\" {\n name = \"\"\n sns_topic = \"\"\n source_type = \"db-security-group\" # Critical: DB security group events\n event_categories = [\"configuration change\", \"failure\"] # Critical: required categories\n}\n```" }, "Recommendation": { - "Text": "To subscribe to RDS instance event notifications, see Subscribing to Amazon RDS event notification in the Amazon RDS User Guide.", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-22" + "Text": "Create or update an **RDS event subscription** for source type `db-security-group` including `configuration change` and `failure`. Route alerts to monitored channels, restrict topic access (**least privilege**), integrate with **incident response**, and enforce change control and **separation of duties** for security group updates.", + "Url": "https://hub.prowler.com/check/rds_instance_event_subscription_security_groups" } }, - "Categories": [], + "Categories": [ + "logging" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_iam_authentication_enabled/rds_instance_iam_authentication_enabled.metadata.json b/prowler/providers/aws/services/rds/rds_instance_iam_authentication_enabled/rds_instance_iam_authentication_enabled.metadata.json index f7c6f6af53..be4c4fa856 100644 --- a/prowler/providers/aws/services/rds/rds_instance_iam_authentication_enabled/rds_instance_iam_authentication_enabled.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_iam_authentication_enabled/rds_instance_iam_authentication_enabled.metadata.json @@ -1,30 +1,41 @@ { "Provider": "aws", "CheckID": "rds_instance_iam_authentication_enabled", - "CheckTitle": "Check if RDS instances have IAM authentication enabled.", - "CheckType": [], + "CheckTitle": "RDS instance has IAM database authentication enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "TTPs/Credential Access" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances have IAM authentication enabled.", - "Risk": "Ensure that the IAM Database Authentication feature is enabled for your RDS database instances in order to use the Identity and Access Management (IAM) service to manage database access to your MySQL and PostgreSQL database instances. With this feature enabled, you don't have to use a password when you connect to your MySQL/PostgreSQL database, instead you can use an authentication token. An authentication token is a unique string of characters with a lifetime of 15 minutes that Amazon RDS generates on your request. IAM Database Authentication removes the need of storing user credentials within the database configuration, because authentication is managed externally using Amazon IAM.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html", + "Description": "**RDS DB instances** using MySQL, MariaDB, or PostgreSQL engines (including Aurora variants) have **IAM database authentication** enabled at the instance level or, when part of a cluster, evaluated for cluster-level enablement.", + "Risk": "Absent **IAM-based, short-lived tokens**, databases rely on **static passwords** in code and configs, increasing theft and reuse.\n\nCompromised DB creds enable unauthorized queries, leading to **data exfiltration** and tampering, and weaken **centralized access control** and rotation.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-10", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-instance --region --db-instance-identifier --enable-iam-database-authentication --apply-immediately", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-10", - "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/iam-database-authentication.html#" + "CLI": "aws rds modify-db-instance --db-instance-identifier --enable-iam-database-authentication --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: enable IAM DB authentication on an RDS instance\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBInstanceIdentifier: \n EnableIAMDatabaseAuthentication: true # Critical: enables IAM DB auth to pass the check\n```", + "Other": "1. In the AWS console, go to RDS > Databases\n2. Select the DB instance and choose Modify\n3. Under Database authentication, select \"Password and IAM database authentication\"\n4. Choose Apply immediately and click Modify DB instance\n5. If the instance is part of an Aurora DB cluster: select the DB cluster instead, choose Modify, enable IAM database authentication, Apply immediately, then Modify", + "Terraform": "```hcl\n# Enable IAM DB authentication on an RDS instance\nresource \"aws_db_instance\" \"\" {\n iam_database_authentication_enabled = true # Critical: enables IAM DB auth to pass the check\n}\n```" }, "Recommendation": { - "Text": "Enable IAM authentication for supported RDS instances.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.IAMDBAuth.Enabling.html" + "Text": "Enable **IAM database authentication** for supported engines and apply **least privilege** with scoped IAM policies. Prefer **short-lived tokens** over static DB passwords, enforce TLS, and phase out embedded credentials.\n\nMonitor authentication activity with audit logs for **defense in depth**.", + "Url": "https://hub.prowler.com/check/rds_instance_iam_authentication_enabled" } }, - "Categories": [], + "Categories": [ + "identity-access" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_inside_vpc/rds_instance_inside_vpc.metadata.json b/prowler/providers/aws/services/rds/rds_instance_inside_vpc/rds_instance_inside_vpc.metadata.json index 12aaa01559..c9f5fd2c96 100644 --- a/prowler/providers/aws/services/rds/rds_instance_inside_vpc/rds_instance_inside_vpc.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_inside_vpc/rds_instance_inside_vpc.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "rds_instance_inside_vpc", - "CheckTitle": "Check if RDS instances are deployed within a VPC.", + "CheckTitle": "RDS instance is deployed in a VPC", "CheckType": [ - "Software and Configuration Checks, AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances are deployed within a VPC.", - "Risk": "If your RDS instances are not deployed within a VPC, they are not isolated from the public internet and are exposed to potential security threats. Deploying RDS instances within a VPC allows you to control inbound and outbound traffic to and from the instances, and provides an additional layer of security to your database instances.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Subnets", + "Description": "**RDS DB instances** are assessed for **VPC placement** by the presence of a `vpc_id` indicating deployment within a VPC.\n\nInstances without this association are treated as outside VPC networking.", + "Risk": "Without VPC isolation, databases may expose internet-reachable endpoints and lack granular network controls. This degrades **confidentiality** and **availability** via scanning/brute force and data exfiltration, and threatens **integrity** through unauthorized connections and lateral movement.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-18", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.WorkingWithRDSInstanceinaVPC.html#USER_VPC.Subnets" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-instance --db-instance-identifier --vpc-security-group-ids ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-18", - "Terraform": "" + "CLI": "aws rds modify-db-instance --db-instance-identifier --db-subnet-group-name --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: move RDS instance into a VPC by assigning a DB subnet group\nResources:\n :\n Type: AWS::RDS::DBSubnetGroup\n Properties:\n DBSubnetGroupDescription: \"subnets for rds\"\n SubnetIds:\n - # CRITICAL: Subnets in the target VPC\n - # CRITICAL: At least two AZs recommended\n\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBSubnetGroupName: !Ref # CRITICAL: Ensures the DB instance is deployed in a VPC\n```", + "Other": "1. In the AWS Console, go to RDS > Subnet groups and create/select a DB subnet group in the target VPC (with subnets in at least two AZs)\n2. Go to RDS > Databases, select the DB instance, click Modify\n3. Under Connectivity, set DB subnet group to the VPC subnet group from step 1 (select a VPC security group if prompted)\n4. Check Apply immediately and choose Continue > Modify DB instance", + "Terraform": "```hcl\n# Terraform: ensure RDS instance is in a VPC via DB subnet group\nresource \"aws_db_subnet_group\" \"\" {\n name = \"\"\n subnet_ids = [\n \"\", # CRITICAL: Subnets in the target VPC\n \"\"\n ]\n}\n\nresource \"aws_db_instance\" \"\" {\n identifier = \"\"\n db_subnet_group_name = aws_db_subnet_group..name # CRITICAL: Places instance in a VPC\n}\n```" }, "Recommendation": { - "Text": "Ensure that your RDS instances are deployed within a VPC to provide an additional layer of security to your database instances.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html" + "Text": "Deploy all RDS instances in a **VPC**, preferably in **private subnets**. Enforce **least privilege** with security groups, network ACLs, and restrictive routing. Use private connectivity (peering, VPN, Direct Connect), avoid public exposure, and apply **defense in depth** through segmentation and monitoring.", + "Url": "https://hub.prowler.com/check/rds_instance_inside_vpc" } }, - "Categories": [], + "Categories": [ + "trust-boundaries" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_integration_cloudwatch_logs/rds_instance_integration_cloudwatch_logs.metadata.json b/prowler/providers/aws/services/rds/rds_instance_integration_cloudwatch_logs/rds_instance_integration_cloudwatch_logs.metadata.json index ee5f8b282b..4d4834143d 100644 --- a/prowler/providers/aws/services/rds/rds_instance_integration_cloudwatch_logs/rds_instance_integration_cloudwatch_logs.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_integration_cloudwatch_logs/rds_instance_integration_cloudwatch_logs.metadata.json @@ -1,27 +1,35 @@ { "Provider": "aws", "CheckID": "rds_instance_integration_cloudwatch_logs", - "CheckTitle": "Check if RDS instances is integrated with CloudWatch Logs.", - "CheckType": [], + "CheckTitle": "RDS instance exports logs to CloudWatch Logs", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances is integrated with CloudWatch Logs.", - "Risk": "If logs are not enabled, monitoring of service use and threat analysis is not possible.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing_cloudwatchlogs.html", + "Description": "**RDS DB instances** are configured to **publish database logs** to **CloudWatch Logs** (e.g., `error`, `general`, `slowquery`, `audit`).\n\nThe evaluation identifies instances that have log exports enabled to a CloudWatch log group.", + "Risk": "Without centralized RDS logs, database activity lacks visibility, hindering detection and response. Credential misuse, SQL injection, data exfiltration, and privilege abuse may go unnoticed, risking **confidentiality** and **integrity**. Unseen errors and slow queries can lead to outages, impacting **availability**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/log-exports.html", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing_cloudwatchlogs.html", + "https://repost.aws/knowledge-center/rds-aurora-mysql-logs-cloudwatch" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-instance --db-instance-identifier --cloudwatch-logs-export-configuration {'EnableLogTypes':['audit',error','general','slowquery']} --apply-immediately", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/log-exports.html", - "Terraform": "https://docs.prowler.com/checks/aws/iam-policies/ensure-that-respective-logs-of-amazon-relational-database-service-amazon-rds-are-enabled#terraform" + "CLI": "aws rds modify-db-instance --db-instance-identifier --cloudwatch-logs-export-configuration '{\"EnableLogTypes\":[\"\"]}'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBInstanceIdentifier: \n # Critical: enabling at least one log type exports it to CloudWatch Logs and makes the check PASS\n EnableCloudwatchLogsExports:\n - \n```", + "Other": "1. Open AWS Console > RDS > Databases\n2. Select your DB instance and choose Modify\n3. In Log exports, select at least one supported log type (e.g., error/general/slowquery/audit/postgresql/alert)\n4. Choose Continue, then Modify DB instance", + "Terraform": "```hcl\nresource \"aws_db_instance\" \"\" {\n identifier = \"\"\n # Critical: export at least one supported log type to CloudWatch Logs to pass the check\n enabled_cloudwatch_logs_exports = [\"\"]\n}\n```" }, "Recommendation": { - "Text": "Use CloudWatch Logs to perform real-time analysis of the log data. Create alarms and view metrics.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/publishing_cloudwatchlogs.html" + "Text": "Enable export of relevant RDS logs to **CloudWatch Logs** (`error`, `general`, `slowquery`, `audit`) and standardize across engines. Enforce **least privilege** on log access, set retention, and define metrics/alarms for critical patterns. Integrate with a SIEM. Apply **separation of duties** and **defense in depth** to protect log integrity and monitoring.", + "Url": "https://hub.prowler.com/check/rds_instance_integration_cloudwatch_logs" } }, "Categories": [ diff --git a/prowler/providers/aws/services/rds/rds_instance_minor_version_upgrade_enabled/rds_instance_minor_version_upgrade_enabled.metadata.json b/prowler/providers/aws/services/rds/rds_instance_minor_version_upgrade_enabled/rds_instance_minor_version_upgrade_enabled.metadata.json index 8951a849aa..8a11bbeb38 100644 --- a/prowler/providers/aws/services/rds/rds_instance_minor_version_upgrade_enabled/rds_instance_minor_version_upgrade_enabled.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_minor_version_upgrade_enabled/rds_instance_minor_version_upgrade_enabled.metadata.json @@ -1,30 +1,38 @@ { "Provider": "aws", "CheckID": "rds_instance_minor_version_upgrade_enabled", - "CheckTitle": "Ensure RDS instances have minor version upgrade enabled.", - "CheckType": [], + "CheckTitle": "RDS instance has minor version upgrade enabled", + "CheckType": [ + "Software and Configuration Checks/Patch Management" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", - "Severity": "low", + "ResourceIdTemplate": "", + "Severity": "medium", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Ensure RDS instances have minor version upgrade enabled.", - "Risk": "Auto Minor Version Upgrade is a feature that you can enable to have your database automatically upgraded when a new minor database engine version is available. Minor version upgrades often patch security vulnerabilities and fix bugs and therefore should be applied.", - "RelatedUrl": "https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-to-major-and-minor-versions-of-postgresql/", + "Description": "**RDS DB instances** are evaluated for the `auto_minor_version_upgrade` setting that enables **automatic minor engine updates** during maintenance windows.", + "Risk": "Without automatic minor upgrades, databases miss **security patches**, leaving known vulnerabilities exploitable and risking **unauthorized data access**. Unapplied fixes can cause **data corruption** and outages, harming **integrity** and **availability**.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-to-major-and-minor-versions-of-postgresql/", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-auto-minor-version-upgrade.html" + ], "Remediation": { "Code": { "CLI": "aws rds modify-db-instance --db-instance-identifier --auto-minor-version-upgrade --apply-immediately", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically#cloudformation", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-auto-minor-version-upgrade.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/ensure-aws-db-instance-gets-all-minor-upgrades-automatically#terraform" + "NativeIaC": "```yaml\n# CloudFormation: Enable auto minor version upgrades on an RDS instance\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBInstanceIdentifier: \n DBInstanceClass: db.t3.micro\n Engine: mysql\n MasterUsername: \n MasterUserPassword: \n AllocatedStorage: '20'\n AutoMinorVersionUpgrade: true # Critical: ensures RDS applies minor engine updates automatically\n```", + "Other": "1. In the AWS Console, go to RDS > Databases\n2. Select the DB instance and click Modify\n3. Find \"Auto minor version upgrade\" and set it to Enable\n4. Click Continue, check Apply immediately, then click Modify DB instance", + "Terraform": "```hcl\n# Enable auto minor version upgrades on an RDS instance\nresource \"aws_db_instance\" \"\" {\n allocated_storage = 20\n engine = \"mysql\"\n instance_class = \"db.t3.micro\"\n username = \"\"\n password = \"\"\n auto_minor_version_upgrade = true # Critical: turns on automatic minor engine upgrades\n}\n```" }, "Recommendation": { - "Text": "Enable auto minor version upgrade for all databases and environments.", - "Url": "https://aws.amazon.com/blogs/database/best-practices-for-upgrading-amazon-rds-to-major-and-minor-versions-of-postgresql/" + "Text": "Enable `auto_minor_version_upgrade` on RDS instances so minor releases are applied promptly. Use maintenance windows and stage testing to limit impact. Follow **defense in depth** and **least privilege**; keep reliable backups and Multi-AZ to preserve continuity if upgrades require rollback.", + "Url": "https://hub.prowler.com/check/rds_instance_minor_version_upgrade_enabled" } }, - "Categories": [], + "Categories": [ + "vulnerabilities" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_multi_az/rds_instance_multi_az.metadata.json b/prowler/providers/aws/services/rds/rds_instance_multi_az/rds_instance_multi_az.metadata.json index 0fc8188164..b2430589a7 100644 --- a/prowler/providers/aws/services/rds/rds_instance_multi_az/rds_instance_multi_az.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_multi_az/rds_instance_multi_az.metadata.json @@ -1,31 +1,37 @@ { "Provider": "aws", "CheckID": "rds_instance_multi_az", - "CheckTitle": "Check if RDS instances have multi-AZ enabled.", - "CheckType": [], + "CheckTitle": "RDS instance has Multi-AZ enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances have multi-AZ enabled.", - "Risk": "In case of failure, with a single-AZ deployment configuration, should an availability zone specific database failure occur, Amazon RDS can not automatically fail over to the standby availability zone.", - "RelatedUrl": "https://aws.amazon.com/rds/features/multi-az/", + "Description": "**RDS DB instances** are evaluated for **Multi-AZ** configuration, either enabled on the instance or inherited from the associated DB cluster.", + "Risk": "Without **Multi-AZ**, an Availability Zone or instance failure can cause extended downtime and rely on restores, risking loss of recent writes. This degrades **availability** and may affect **integrity**, interrupting applications and breaching SLAs.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-multi-az.html", + "https://aws.amazon.com/rds/features/multi-az/" + ], "Remediation": { "Code": { - "CLI": "aws rds create-db-instance --db-instance-identifier --multi-az true", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_73#cloudformation", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-multi-az.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_73#terraform" + "CLI": "aws rds modify-db-instance --db-instance-identifier --multi-az --apply-immediately", + "NativeIaC": "```yaml\n# CloudFormation: enable Multi-AZ on an existing RDS DB instance\nResources:\n RDSInstance:\n Type: AWS::RDS::DBInstance\n Properties:\n MultiAZ: true # Critical: enables Multi-AZ to pass the check\n```", + "Other": "1. Open the AWS Management Console and go to RDS > Databases\n2. Select the affected DB instance and click Modify\n3. Under Availability & durability, set Multi-AZ deployment to Enabled (create a standby)\n4. Check Apply immediately\n5. Click Continue, then Modify DB instance\n6. Wait until status is Available and Multi-AZ shows Yes", + "Terraform": "```hcl\n# Enable Multi-AZ on an RDS DB instance\nresource \"aws_db_instance\" \"example\" {\n multi_az = true # Critical: enables Multi-AZ to pass the check\n}\n```" }, "Recommendation": { - "Text": "Enable multi-AZ deployment for production databases.", - "Url": "https://aws.amazon.com/rds/features/multi-az/" + "Text": "Apply fault-tolerance and redundancy principles: enable **Multi-AZ** for production RDS workloads. Choose one standby or two readable standbys based on RTO/RPO and performance needs. Regularly test failover, monitor configuration drift, and allow exceptions only with documented, risk-based approval.", + "Url": "https://hub.prowler.com/check/rds_instance_multi_az" } }, "Categories": [ - "redundancy" + "resilience" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.metadata.json b/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.metadata.json index 390504cca9..6f64cf9d90 100644 --- a/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_no_public_access/rds_instance_no_public_access.metadata.json @@ -1,27 +1,37 @@ { "Provider": "aws", "CheckID": "rds_instance_no_public_access", - "CheckTitle": "Ensure there are no Public Accessible RDS instances.", - "CheckType": [], + "CheckTitle": "RDS instance is not publicly exposed to the Internet", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Ensure there are no Public Accessible RDS instances.", - "Risk": "Publicly accessible databases could expose sensitive data to bad actors.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/rds-instance-public-access-check.html", + "Description": "**RDS DB instances** are assessed for **internet exposure** using the `PubliclyAccessible` setting, security group ingress to the DB port from any address, and whether subnets are **public**. Instances that combine an internet-facing endpoint, open ingress, and public subnets are identified.", + "Risk": "An internet-reachable database invites:\n- Brute-force and vulnerability probing, risking **availability** and **integrity**\n- Unauthorized queries and dumps leading to **confidentiality** loss\n\nCompromise can enable **lateral movement** and persistence within the VPC.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/config/latest/developerguide/rds-instance-public-access-check.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-publicly-accessible.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html" + ], "Remediation": { "Code": { "CLI": "aws rds modify-db-instance --db-instance-identifier --no-publicly-accessible --apply-immediately", - "NativeIaC": "https://docs.prowler.com/checks/aws/public-policies/public_2#cloudformation", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-publicly-accessible.html", - "Terraform": "https://docs.prowler.com/checks/aws/public-policies/public_2#terraform" + "NativeIaC": "```yaml\n# CloudFormation: make the RDS instance private\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBInstanceIdentifier: \n PubliclyAccessible: false # CRITICAL: disables public access so the instance is not Internet-facing\n```", + "Other": "1. In the AWS console, go to RDS > Databases and select your DB instance\n2. Click Modify\n3. In Connectivity (Connectivity & security), set Public access to No (Not publicly accessible)\n4. Choose Continue, select Apply immediately (or during the next window), then click Modify DB instance", + "Terraform": "```hcl\n# Ensure the RDS instance is not publicly accessible\nresource \"aws_db_instance\" \"\" {\n publicly_accessible = false # CRITICAL: disables public access (no public endpoint)\n}\n```" }, "Recommendation": { - "Text": "Using an AWS Config rule check for RDS public instances periodically and check there is a business reason for it.", - "Url": "https://docs.aws.amazon.com/config/latest/developerguide/rds-instance-public-access-check.html" + "Text": "Keep databases private by applying **least privilege** at the network layer:\n- Set `PubliclyAccessible` to `false`\n- Place instances in private subnets\n- Deny `0.0.0.0/0` and `::/0` on the DB port\n- Expose access via private endpoints, VPN, or an application tier/DB proxy\n\nAdopt **defense in depth** with monitoring and strong auth.", + "Url": "https://hub.prowler.com/check/rds_instance_no_public_access" } }, "Categories": [ diff --git a/prowler/providers/aws/services/rds/rds_instance_non_default_port/rds_instance_non_default_port.metadata.json b/prowler/providers/aws/services/rds/rds_instance_non_default_port/rds_instance_non_default_port.metadata.json index 98a80abaa7..73d731a471 100644 --- a/prowler/providers/aws/services/rds/rds_instance_non_default_port/rds_instance_non_default_port.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_non_default_port/rds_instance_non_default_port.metadata.json @@ -1,29 +1,35 @@ { "Provider": "aws", "CheckID": "rds_instance_non_default_port", - "CheckTitle": "Check if RDS instances are using non-default ports.", + "CheckTitle": "RDS instance uses a non-default port for its engine", "CheckType": [ - "Software and Configuration Checks/AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices/Network Reachability", + "TTPs/Discovery" ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "low", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Checks if an instance uses a port other than the default port of the database engine. The control fails if the RDS instance uses the default port.", - "Risk": "Using a default database port exposes the instance to potential security vulnerabilities, as attackers are more likely to target known, commonly-used ports. This may result in unauthorized access to the database or increased susceptibility to automated attacks.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html", + "Description": "**RDS DB instances** are evaluated for use of a port that differs from the engine's default. Matching an engine with its default port-`3306` (MySQL/MariaDB/Aurora MySQL), `5432` (PostgreSQL/Aurora), `1521` (Oracle), `1433` (SQL Server), `50000` (Db2)-indicates the instance uses the default listener.", + "Risk": "Using a **default DB port** increases exposure to broad scans and eases **service fingerprinting**. With weak network controls, attackers can run **credential brute force**, target known **engine exploits**, or trigger **DoS** on the predictable port, threatening confidentiality and availability.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-default-port.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-23", + "https://docs.aws.amazon.com/cli/latest/reference/rds/modify-db-instance.html" + ], "Remediation": { "Code": { - "CLI": "aws rds modify-db-instance --db-instance-identifier --port ", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-23", - "Terraform": "" + "CLI": "aws rds modify-db-instance --db-instance-identifier --db-port ", + "NativeIaC": "```yaml\n# CloudFormation: set a non-default port on an RDS instance\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n Port: # Critical: use a non-default DB engine port to pass the check\n```", + "Other": "1. In the AWS Console, go to Amazon RDS > Databases\n2. Select the DB instance and click Modify\n3. Set \"Database port\" to a non-default value for the engine (e.g., not 3306, 5432, 1521, 1433, or 50000)\n4. Click Continue, then Modify DB instance", + "Terraform": "```hcl\n# Terraform: set a non-default port on an RDS instance\nresource \"aws_db_instance\" \"\" {\n port = # Critical: use a non-default DB engine port to pass the check\n}\n```" }, "Recommendation": { - "Text": "Modify the RDS instance to use a non-default port, and ensure that the security group permits access to the new port.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.DBInstance.Modifying.html" + "Text": "Use a **non-default DB port** and enforce **defense in depth**:\n- Apply **least-privilege** network rules\n- Keep databases in **private subnets**; avoid public exposure\n- Require strong authentication and audit logging\n\n*Update client connection strings and security rules when the port changes.*", + "Url": "https://hub.prowler.com/check/rds_instance_non_default_port" } }, "Categories": [], diff --git a/prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.metadata.json b/prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.metadata.json index 3b6a01e899..79b4a2ede2 100644 --- a/prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_protected_by_backup_plan/rds_instance_protected_by_backup_plan.metadata.json @@ -1,32 +1,40 @@ { "Provider": "aws", "CheckID": "rds_instance_protected_by_backup_plan", - "CheckTitle": "Check if RDS instances are protected by a backup plan.", + "CheckTitle": "RDS instance is protected by an AWS Backup plan", "CheckType": [ - "Software and Configuration Checks, AWS Security Best Practices" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Destruction" ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances are protected by a backup plan.", - "Risk": "Without a backup plan, RDS instances are vulnerable to data loss, accidental deletion, or corruption. This could lead to significant operational disruptions or loss of critical data.", - "RelatedUrl": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html", + "Description": "**RDS DB instances** (non-Aurora) are included in an **AWS Backup plan**, indicating scheduled backups and retention are applied to the resource.\n\n*Aurora engines are evaluated separately.*", + "Risk": "Without an **AWS Backup plan**, databases lack assured recovery, degrading **availability** and **integrity**. Likely outcomes: accidental deletion, corruption, or malicious wipes with no recent restore point. Expect missed `RPO/RTO`, extended outages, and data inconsistency after incidents.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-26" + ], "Remediation": { "Code": { - "CLI": "aws backup create-backup-plan --backup-plan , aws backup tag-resource --resource-arn --tags Key=backup,Value=true", - "NativeIaC": "", - "Other": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-26", - "Terraform": "" + "CLI": "aws backup create-backup-selection --backup-plan-id --backup-selection '{\"SelectionName\":\"\",\"IamRoleArn\":\"\",\"Resources\":[\"\"]}'", + "NativeIaC": "```yaml\n# CloudFormation: assign an RDS instance to an AWS Backup plan\nResources:\n :\n Type: AWS::Backup::BackupSelection\n Properties:\n BackupPlanId: # CRITICAL: targets the backup plan to protect the instance\n BackupSelection:\n SelectionName: \n IamRoleArn: # CRITICAL: role AWS Backup uses to back up the resource\n Resources:\n - # CRITICAL: assigns the RDS instance to the plan\n```", + "Other": "1. In the AWS Console, open AWS Backup\n2. Go to Settings > Service opt-in and enable Amazon RDS (if not already)\n3. Go to Backup plans and select an existing plan (or Create backup plan with defaults)\n4. Click Assign resources\n5. Enter a name, select an IAM role, and add the RDS instance (by ARN or resource picker)\n6. Click Assign resources to save", + "Terraform": "```hcl\n# Assign an RDS instance to an AWS Backup plan\nresource \"aws_backup_selection\" \"\" {\n name = \"\"\n plan_id = \"\" # CRITICAL: attaches to the backup plan\n iam_role_arn = \"\" # CRITICAL: role AWS Backup uses\n resources = [\"\"] # CRITICAL: RDS instance protected by the plan\n}\n```" }, "Recommendation": { - "Text": "Create a backup plan for the RDS instance to protect it from data loss, accidental deletion, or corruption.", - "Url": "https://docs.aws.amazon.com/aws-backup/latest/devguide/assigning-resources.html" + "Text": "Assign all non-Aurora RDS to an **AWS Backup plan** aligned to business `RPO/RTO`. Use **tags** for automatic coverage, define retention and lifecycle, and store backups in **immutable** vaults where possible. Regularly perform restore tests. Enforce **least privilege** and **separation of duties** for backup administration.", + "Url": "https://hub.prowler.com/check/rds_instance_protected_by_backup_plan" } }, - "Categories": [], + "Categories": [ + "resilience" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_storage_encrypted/rds_instance_storage_encrypted.metadata.json b/prowler/providers/aws/services/rds/rds_instance_storage_encrypted/rds_instance_storage_encrypted.metadata.json index 43d031fe1b..2125e64d1c 100644 --- a/prowler/providers/aws/services/rds/rds_instance_storage_encrypted/rds_instance_storage_encrypted.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_storage_encrypted/rds_instance_storage_encrypted.metadata.json @@ -1,30 +1,47 @@ { "Provider": "aws", "CheckID": "rds_instance_storage_encrypted", - "CheckTitle": "Check if RDS instances storage is encrypted.", - "CheckType": [], + "CheckTitle": "RDS DB instance storage is encrypted at rest", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST 800-53 Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/NIST CSF Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS", + "Software and Configuration Checks/Industry and Regulatory Standards/ISO 27001 Controls", + "Software and Configuration Checks/Industry and Regulatory Standards/HIPAA Controls (USA)", + "Software and Configuration Checks/Industry and Regulatory Standards/GDPR Controls (Europe)", + "Effects/Data Exposure" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "Check if RDS instances storage is encrypted.", - "Risk": "If not enabled sensitive information at rest is not protected.", - "RelatedUrl": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html", + "Description": "**RDS DB instances** are assessed for **KMS-based encryption at rest** (`StorageEncrypted=true`), covering instance storage and derived artifacts such as snapshots, automated backups, and read replicas.", + "Risk": "Without **encryption at rest**, database files, snapshots, and automated backups remain in plaintext. An attacker with access to copied snapshots, compromised backups, or underlying storage can read sensitive data, causing loss of **confidentiality** and enabling large-scale exfiltration.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-encryption-enabled.html", + "https://aws.amazon.com/blogs/storage/protecting-amazon-rds-db-instances-encrypted-using-kms-aws-managed-key-with-cross-account-and-cross-region-backups/", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html" + ], "Remediation": { "Code": { - "CLI": "aws rds create-db-instance --db-instance-identifier --db-instance-class --engine --storage-encrypted true", - "NativeIaC": "https://docs.prowler.com/checks/aws/general-policies/general_4#cloudformation", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/rds-encryption-enabled.html", - "Terraform": "https://docs.prowler.com/checks/aws/general-policies/general_4#terraform" + "CLI": "", + "NativeIaC": "```yaml\n# CloudFormation: create an encrypted RDS DB instance\nResources:\n :\n Type: AWS::RDS::DBInstance\n Properties:\n DBInstanceClass: \"\"\n Engine: \"\"\n AllocatedStorage: 20\n MasterUsername: \"\"\n MasterUserPassword: \"\"\n StorageEncrypted: true # CRITICAL: enables encryption at rest so the instance passes the check\n```", + "Other": "1. In the AWS Console, go to RDS > Databases, select the unencrypted DB instance, then choose Actions > Take snapshot.\n2. After the snapshot is available, go to Snapshots, select it, choose Actions > Copy snapshot, enable encryption, and select a KMS key (or aws/rds).\n3. When the encrypted copy is ready, select it and choose Actions > Restore snapshot to create a new (encrypted) DB instance.\n4. Update your application/endpoint to use the new encrypted DB instance.\n5. Decommission the old unencrypted instance after cutover.", + "Terraform": "```hcl\n# Terraform: create an encrypted RDS DB instance\nresource \"aws_db_instance\" \"\" {\n engine = \"\"\n instance_class = \"\"\n username = \"\"\n password = \"\"\n allocated_storage = 20\n\n storage_encrypted = true # CRITICAL: enables encryption at rest to pass the check\n}\n```" }, "Recommendation": { - "Text": "Enable Encryption. Use a CMK where possible. It will provide additional management and privacy benefits.", - "Url": "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Overview.Encryption.html" + "Text": "Enable **encryption at rest** for all RDS instances. Prefer **customer-managed KMS keys** to control rotation and fine-grained access, applying **least privilege** and **defense in depth**. Restrict key usage, monitor key activity, and manage key lifecycle. Migrate unencrypted instances via encrypted snapshot copy and restore.", + "Url": "https://hub.prowler.com/check/rds_instance_storage_encrypted" } }, - "Categories": [], + "Categories": [ + "encryption" + ], "DependsOn": [], "RelatedTo": [], "Notes": "" diff --git a/prowler/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted.metadata.json b/prowler/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted.metadata.json index 2180bc1b1c..38320956a2 100644 --- a/prowler/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted.metadata.json +++ b/prowler/providers/aws/services/rds/rds_instance_transport_encrypted/rds_instance_transport_encrypted.metadata.json @@ -1,27 +1,34 @@ { "Provider": "aws", "CheckID": "rds_instance_transport_encrypted", - "CheckTitle": "Check if RDS instances enforce SSL/TLS encryption for client connections (Microsoft SQL Server, PostgreSQL, MySQL, MariaDB, Aurora PostgreSQL, and Aurora MySQL).", - "CheckType": [], + "CheckTitle": "RDS instance or cluster enforces SSL/TLS encryption for client connections", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Network Security" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:db-instance", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "AwsRdsDbInstance", "ResourceGroup": "database", - "Description": "For SQL Server, PostgreSQL, and Aurora PostgreSQL databases, if the `rds.force_ssl` parameter value is set to 0, SSL/TLS connections are not enforced. For MySQL, Aurora MySQL, and MariaDB databases, if the `require_secure_transport` parameter value is set to OFF, SSL/TLS connections are not enforced. Enforcing SSL/TLS ensures that all client connections to RDS instances are encrypted, protecting sensitive information in transit.", - "Risk": "If not enabled, sensitive information in transit is not protected.", - "RelatedUrl": "https://aws.amazon.com/premiumsupport/knowledge-center/rds-connect-ssl-connection/", + "Description": "**RDS DB instances** and **DB clusters** enforce **SSL/TLS** for client connections via parameter groups. The check looks for `rds.force_ssl=1` (PostgreSQL, SQL Server) or `require_secure_transport` enabled (MySQL-family) and identifies databases where encryption enforcement isn't active.", + "Risk": "Without enforced **TLS**, clients can connect or downgrade to plaintext, exposing credentials and queries to interception. Adversaries can perform **MITM**, steal secrets, and tamper traffic, undermining **confidentiality** and **integrity** and enabling reuse of captured database credentials.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://aws.amazon.com/premiumsupport/knowledge-center/rds-connect-ssl-connection/", + "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.SSL.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/transport-encryption.html" + ], "Remediation": { "Code": { "CLI": "aws rds modify-db-parameter-group --region --db-parameter-group-name --parameters ParameterName='rds.force_ssl',ParameterValue='1',ApplyMethod='pending-reboot'", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/transport-encryption.html", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: set required parameter to enforce SSL/TLS\nResources:\n ExampleDBParameterGroupPostgres:\n Type: AWS::RDS::DBParameterGroup\n Properties:\n Family: \n Description: Enforce SSL/TLS\n Parameters:\n rds.force_ssl: \"1\" # Critical: requires SSL/TLS for PostgreSQL/SQL Server instances\n\n ExampleDBParameterGroupMySQL:\n Type: AWS::RDS::DBParameterGroup\n Properties:\n Family: \n Description: Enforce SSL/TLS\n Parameters:\n require_secure_transport: \"1\" # Critical: requires SSL/TLS for MySQL/MariaDB instances\n\n ExampleDBClusterParameterGroupAuroraPostgres:\n Type: AWS::RDS::DBClusterParameterGroup\n Properties:\n Family: \n Description: Enforce SSL/TLS\n Parameters:\n rds.force_ssl: \"1\" # Critical: requires SSL/TLS for Aurora PostgreSQL clusters\n\n ExampleDBClusterParameterGroupAuroraMySQL:\n Type: AWS::RDS::DBClusterParameterGroup\n Properties:\n Family: \n Description: Enforce SSL/TLS\n Parameters:\n require_secure_transport: ON # Critical: requires SSL/TLS for Aurora MySQL clusters\n```", + "Other": "1. In the AWS Console, go to RDS > Parameter groups\n2. For DB instances:\n - Edit the DB parameter group attached to the instance (or create one and attach it)\n - Set rds.force_ssl = 1 for PostgreSQL/SQL Server, or require_secure_transport = 1 for MySQL/MariaDB\n - Save. If the parameter is static, reboot the instance\n3. For Aurora clusters:\n - Edit the DB cluster parameter group attached to the cluster (or create one and attach it)\n - Set rds.force_ssl = 1 for Aurora PostgreSQL, or require_secure_transport = ON for Aurora MySQL\n - Save. Reboot instances if changes are pending-reboot\n4. Verify the parameter group is associated to the target instance/cluster and status shows the new value applied", + "Terraform": "```hcl\n# DB instances\nresource \"aws_db_parameter_group\" \"example_pg\" {\n name = \"\"\n family = \"\"\n\n parameter {\n name = \"rds.force_ssl\"\n value = \"1\" # Critical: requires SSL/TLS for PostgreSQL/SQL Server instances\n }\n}\n\nresource \"aws_db_parameter_group\" \"example_mysql\" {\n name = \"\"\n family = \"\"\n\n parameter {\n name = \"require_secure_transport\"\n value = \"1\" # Critical: requires SSL/TLS for MySQL/MariaDB instances\n }\n}\n\n# Aurora clusters\nresource \"aws_rds_cluster_parameter_group\" \"example_aurora_pg\" {\n name = \"\"\n family = \"\"\n\n parameter {\n name = \"rds.force_ssl\"\n value = \"1\" # Critical: requires SSL/TLS for Aurora PostgreSQL clusters\n }\n}\n\nresource \"aws_rds_cluster_parameter_group\" \"example_aurora_mysql\" {\n name = \"\"\n family = \"\"\n\n parameter {\n name = \"require_secure_transport\"\n value = \"ON\" # Critical: requires SSL/TLS for Aurora MySQL clusters\n }\n}\n```" }, "Recommendation": { - "Text": "Ensure that instances provisioned with Amazon RDS enforce SSL/TLS for client connections to meet security and compliance requirements.", - "Url": "https://aws.amazon.com/premiumsupport/knowledge-center/rds-connect-ssl-connection/" + "Text": "Enforce transport encryption at the database layer:\n- Enable `rds.force_ssl=1` or `require_secure_transport` in parameter groups\n- Configure clients to require certificate validation and prevent fallback\n- Use current TLS versions and trusted CAs\n- Prefer private network access as **defense in depth**", + "Url": "https://hub.prowler.com/check/rds_instance_transport_encrypted" } }, "Categories": [ diff --git a/prowler/providers/aws/services/rds/rds_snapshots_encrypted/rds_snapshots_encrypted.metadata.json b/prowler/providers/aws/services/rds/rds_snapshots_encrypted/rds_snapshots_encrypted.metadata.json index 9693c841b0..5123981aff 100644 --- a/prowler/providers/aws/services/rds/rds_snapshots_encrypted/rds_snapshots_encrypted.metadata.json +++ b/prowler/providers/aws/services/rds/rds_snapshots_encrypted/rds_snapshots_encrypted.metadata.json @@ -1,27 +1,36 @@ { "Provider": "aws", "CheckID": "rds_snapshots_encrypted", - "CheckTitle": "Check if RDS Snapshots and Cluster Snapshots are encrypted.", - "CheckType": [], + "CheckTitle": "RDS DB instance snapshot or DB cluster snapshot is encrypted", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:snapshot", - "Severity": "medium", + "ResourceIdTemplate": "", + "Severity": "high", "ResourceType": "AwsRdsDbSnapshot", "ResourceGroup": "database", - "Description": "Check if RDS Snapshots and Cluster Snapshots are encrypted.", - "Risk": "Ensure that your manual Amazon RDS database snapshots are encrypted in order to achieve compliance for data-at-rest encryption within your organization.", - "RelatedUrl": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-4", + "Description": "**RDS DB snapshots** and **DB cluster snapshots** are evaluated for **encryption at rest**, identifying snapshots created with a KMS key versus unencrypted ones.", + "Risk": "Unencrypted snapshots enable direct access to full database data if backups are leaked, cross-account shared, or stolen. Adversaries can harvest data offline, bypassing network controls, leading to **loss of confidentiality**. Restores from such snapshots propagate the exposure to new instances.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/snapshot-encrypted.html#", + "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-4" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/snapshot-encrypted.html#", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/snapshot-encrypted.html#", - "Terraform": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/snapshot-encrypted.html#" + "CLI": "aws rds copy-db-snapshot --source-db-snapshot-identifier --target-db-snapshot-identifier -encrypted --kms-key-id ", + "NativeIaC": "", + "Other": "1. In the AWS Console, go to RDS > Snapshots\n2. Select the unencrypted snapshot (for clusters, use the DB cluster snapshots tab)\n3. Click Actions > Copy snapshot\n4. Check Enable encryption and choose a KMS key\n5. Click Copy snapshot and wait for completion\n6. After verifying the new encrypted snapshot, delete the original unencrypted snapshot (Actions > Delete snapshot)", + "Terraform": "```hcl\nresource \"aws_db_snapshot_copy\" \"\" {\n source_db_snapshot_identifier = \"\"\n target_db_snapshot_identifier = \"-encrypted\"\n kms_key_id = \"\" # Critical: encrypts the copied snapshot using the specified KMS key\n}\n```" }, "Recommendation": { - "Text": "When working with production databases that hold sensitive and critical data, it is strongly recommended to implement encryption at rest and protect your data from attackers or unauthorized personnel. ", - "Url": "https://docs.aws.amazon.com/securityhub/latest/userguide/rds-controls.html#rds-4" + "Text": "Encrypt all RDS snapshots at rest using **KMS**, preferably **customer-managed keys**. Apply **least privilege** to key usage, enforce encryption via templates and automation, and prevent sharing of unencrypted backups. Use **key rotation**, separation of duties, and ensure copies and cross-account shares remain encrypted.", + "Url": "https://hub.prowler.com/check/rds_snapshots_encrypted" } }, "Categories": [ diff --git a/prowler/providers/aws/services/rds/rds_snapshots_public_access/rds_snapshots_public_access.metadata.json b/prowler/providers/aws/services/rds/rds_snapshots_public_access/rds_snapshots_public_access.metadata.json index be565e27cb..19c0fbc838 100644 --- a/prowler/providers/aws/services/rds/rds_snapshots_public_access/rds_snapshots_public_access.metadata.json +++ b/prowler/providers/aws/services/rds/rds_snapshots_public_access/rds_snapshots_public_access.metadata.json @@ -1,27 +1,37 @@ { "Provider": "aws", "CheckID": "rds_snapshots_public_access", - "CheckTitle": "Check if RDS Snapshots and Cluster Snapshots are public.", - "CheckType": [], + "CheckTitle": "RDS snapshot is not publicly shared", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Effects/Data Exposure", + "TTPs/Collection" + ], "ServiceName": "rds", "SubServiceName": "", - "ResourceIdTemplate": "arn:aws:rds:region:account-id:snapshot", + "ResourceIdTemplate": "", "Severity": "critical", "ResourceType": "AwsRdsDbSnapshot", "ResourceGroup": "database", - "Description": "Check if RDS Snapshots and Cluster Snapshots are public.", - "Risk": "Publicly accessible services could expose sensitive data to bad actors. t is recommended that your RDS snapshots should not be public in order to prevent potential leak or misuse of sensitive data or any other kind of security threat. If your RDS snapshot is public, then the data which is backed up in that snapshot is accessible to all other AWS accounts.", - "RelatedUrl": "https://docs.aws.amazon.com/config/latest/developerguide/rds-snapshots-public-prohibited.html", + "Description": "**RDS DB snapshots** and **DB cluster snapshots** with **public visibility** (shared with `all` AWS accounts) are detected.\n\nSnapshots limited to specific accounts or kept private are identified as restricted.", + "Risk": "Public RDS snapshots expose full database copies to all AWS accounts, risking:\n- Loss of confidentiality via data exfiltration (PII, secrets)\n- Offline cracking of hashes and schema reconnaissance\n- Credential harvesting from dumps enabling lateral movement\nThis directly compromises confidentiality and fuels targeted attacks.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/public-snapshots.html", + "https://docs.aws.amazon.com/config/latest/developerguide/rds-snapshots-public-prohibited.html", + "https://support.icompaas.com/support/solutions/articles/62000127056-ensure-rds-snapshots-and-cluster-snapshots-are-not-public" + ], "Remediation": { "Code": { "CLI": "aws rds modify-db-snapshot-attribute --db-snapshot-identifier --attribute-name restore --values-to-remove all", "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/RDS/public-snapshots.html", + "Other": "1. Open the Amazon RDS console and go to Snapshots\n2. Select the public snapshot (DB snapshot or DB cluster snapshot)\n3. Click Actions > Share snapshot\n4. Set visibility to Private (remove \"All\" from permissions) and click Save", "Terraform": "" }, "Recommendation": { - "Text": "Use AWS Config to identify any snapshot that is public.", - "Url": "https://docs.aws.amazon.com/config/latest/developerguide/rds-snapshots-public-prohibited.html" + "Text": "Keep **RDS snapshots** and **cluster snapshots** private. Share only with explicit AWS account IDs using **least privilege** and time-bound access.\n\nEnforce guardrails to block `public` visibility, require approvals for sharing, and audit snapshot permissions. Use encryption with strict key policies to control who can restore data.", + "Url": "https://hub.prowler.com/check/rds_snapshots_public_access" } }, "Categories": [ From 0472eb74d22b3eeef6706ca5a1099d064436ca13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Mon, 12 Jan 2026 14:26:37 +0100 Subject: [PATCH 043/337] chore(aws): enhance metadata for `bedrock` service (#8827) Co-authored-by: Daniel Barranquero --- prowler/CHANGELOG.md | 1 + ...rock_agent_guardrail_enabled.metadata.json | 33 ++++++++++------- ...no_administrative_privileges.metadata.json | 35 +++++++++++-------- ...key_no_long_term_credentials.metadata.json | 33 ++++++++++------- ...prompt_attack_filter_enabled.metadata.json | 34 +++++++++++------- ...e_information_filter_enabled.metadata.json | 30 ++++++++++------ ...l_invocation_logging_enabled.metadata.json | 28 +++++++++------ ...tion_logs_encryption_enabled.metadata.json | 35 ++++++++++++------- 8 files changed, 146 insertions(+), 83 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index 9752f86cec..00aa650aa9 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -42,6 +42,7 @@ All notable changes to the **Prowler SDK** are documented in this file. - Update AWS S3 service metadata to new format [(#9552)](https://github.com/prowler-cloud/prowler/pull/9552) - Update AWS DataSync service metadata to new format [(#8854)](https://github.com/prowler-cloud/prowler/pull/8854) - Update AWS RDS service metadata to new format [(#9551)](https://github.com/prowler-cloud/prowler/pull/9551) +- Update AWS Bedrock service metadata to new format [(#8827)](https://github.com/prowler-cloud/prowler/pull/8827) --- diff --git a/prowler/providers/aws/services/bedrock/bedrock_agent_guardrail_enabled/bedrock_agent_guardrail_enabled.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_agent_guardrail_enabled/bedrock_agent_guardrail_enabled.metadata.json index 89c7b1fd76..c61ec9e5dc 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_agent_guardrail_enabled/bedrock_agent_guardrail_enabled.metadata.json +++ b/prowler/providers/aws/services/bedrock/bedrock_agent_guardrail_enabled/bedrock_agent_guardrail_enabled.metadata.json @@ -1,27 +1,36 @@ { "Provider": "aws", "CheckID": "bedrock_agent_guardrail_enabled", - "CheckTitle": "Ensure that Guardrails are enabled for Amazon Bedrock agent sessions.", - "CheckType": [], + "CheckTitle": "Amazon Bedrock agent uses a guardrail to protect agent sessions", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "Effects/Data Exposure" + ], "ServiceName": "bedrock", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:bedrock:region:account-id:agent/resource-id", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Other", "ResourceGroup": "ai_ml", - "Description": "This check ensures that Guardrails are enabled to protect Amazon Bedrock agent sessions. Guardrails help mitigate security risks by filtering and blocking harmful or sensitive content during interactions with AI models.", - "Risk": "Without guardrails enabled, Amazon Bedrock agent sessions are vulnerable to harmful prompts or inputs that could expose sensitive information or generate inappropriate content. This could lead to privacy violations, data leaks, or other security risks.", - "RelatedUrl": "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html", + "Description": "**Bedrock agents** should have an associated **guardrail** for their sessions. The evaluation identifies agents without a guardrail linked for input/output screening during interactions.", + "Risk": "Without **guardrails**, agent exchanges may expose **PII** or internal data (confidentiality), accept **prompt injections** that manipulate tool calls or outputs (integrity), and produce unsafe or out-of-scope responses that erode trust and cause policy violations.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html", + "https://docs.aws.amazon.com/bedrock/latest/userguide/agents-guardrail.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Bedrock/protect-agent-sessions-with-guardrails.html", + "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" + ], "Remediation": { "Code": { - "CLI": "", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Bedrock/protect-agent-sessions-with-guardrails.html", - "Terraform": "" + "CLI": "aws bedrock-agent update-agent --agent-id --agent-name --agent-resource-role-arn --foundation-model --guardrail-configuration guardrailIdentifier=,guardrailVersion=DRAFT", + "NativeIaC": "```yaml\n# CloudFormation: Associate a guardrail with a Bedrock Agent\nResources:\n ExampleAgent:\n Type: AWS::Bedrock::Agent\n Properties:\n AgentName: \n AgentResourceRoleArn: \n FoundationModel: \n Instruction: \"\"\n GuardrailConfiguration: # CRITICAL: associates a guardrail to protect sessions\n GuardrailIdentifier: # CRITICAL: guardrail ID used by the agent\n GuardrailVersion: DRAFT # CRITICAL: version applied\n```", + "Other": "1. Open the Amazon Bedrock console and go to Agents\n2. Select the agent and click Edit\n3. In Guardrail details, select an existing guardrail and its version (e.g., DRAFT)\n4. Click Save (deploy changes if prompted)\n5. Verify the agent now shows the selected guardrail", + "Terraform": "```hcl\n# Terraform (AWS Cloud Control): Associate a guardrail with a Bedrock Agent\nresource \"awscc_bedrock_agent\" \"example\" {\n agent_name = \"\"\n agent_resource_role_arn = \"\"\n foundation_model = \"\"\n instruction = \"\"\n\n # CRITICAL: associates a guardrail to protect agent sessions\n guardrail_configuration {\n guardrail_identifier = \"\" # CRITICAL: guardrail ID\n guardrail_version = \"DRAFT\" # CRITICAL: version applied\n }\n}\n```" }, "Recommendation": { - "Text": "Enable Guardrails for Amazon Bedrock agent sessions to protect against harmful inputs and outputs during interactions.", - "Url": "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-create.html" + "Text": "Associate a **guardrail** with every agent and tailor policies to your use case:\n- Enable content/word filters, denied topics, and sensitive-data masking\n- Use contextual grounding for RAG where relevant\n- Test and iterate across versions\nApply **least privilege** to agent tools and use **defense in depth** with monitoring and review.", + "Url": "https://hub.prowler.com/check/bedrock_agent_guardrail_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_administrative_privileges/bedrock_api_key_no_administrative_privileges.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_administrative_privileges/bedrock_api_key_no_administrative_privileges.metadata.json index 160654a5aa..9b306024b6 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_administrative_privileges/bedrock_api_key_no_administrative_privileges.metadata.json +++ b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_administrative_privileges/bedrock_api_key_no_administrative_privileges.metadata.json @@ -1,35 +1,42 @@ { "Provider": "aws", "CheckID": "bedrock_api_key_no_administrative_privileges", - "CheckTitle": "Ensure Amazon Bedrock API keys do not have administrative privileges or privilege escalation", + "CheckTitle": "Amazon Bedrock API key does not have administrative privileges, privilege escalation paths, or full Bedrock service access", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Privilege Escalation" ], "ServiceName": "bedrock", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:iam:region:account-id:user/{user-name}/credential/{api-key-id}", + "ResourceIdTemplate": "", "Severity": "high", - "ResourceType": "AwsIamServiceSpecificCredential", + "ResourceType": "AwsIamAccessKey", "ResourceGroup": "IAM", - "Description": "Ensure that Amazon Bedrock API keys do not have administrative privileges or privilege escalation capabilities. API keys with administrative privileges can perform any action on any resource in your AWS environment, while privilege escalation allows users to grant themselves additional permissions, both posing significant security risks.", - "Risk": "Amazon Bedrock API keys with administrative privileges can perform any action on any resource in your AWS environment. Privilege escalation capabilities allow users to grant themselves additional permissions beyond their intended scope. Both violations of the principle of least privilege can lead to security vulnerabilities, data leaks, data loss, or unexpected charges if the API key is compromised or misused.", - "RelatedUrl": "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html", + "Description": "**Bedrock API keys** linked to IAM users are evaluated for excessive permissions, including policies that grant full access (`*` or `bedrock:*`) or enable **privilege escalation**. The finding highlights keys whose attached or inline policies provide broad or escalating capabilities.", + "Risk": "Over-privileged Bedrock API keys weaken confidentiality, integrity, and availability. If compromised, an attacker could:\n- Escalate IAM rights and persist access\n- Invoke models at scale to exfiltrate data or incur high costs\n- Modify Bedrock settings, disrupting operations", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege", + "https://docs.aws.amazon.com/IAM/latest/UserGuide/getting-started-reduce-permissions.html", + "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html" + ], "Remediation": { "Code": { "CLI": "aws iam delete-service-specific-credential --user-name --service-specific-credential-id ", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\n# CloudFormation: attach least-privilege policy to the IAM user owning the Bedrock API key\nResources:\n :\n Type: AWS::IAM::Policy\n Properties:\n PolicyName: least-priv-bedrock\n Users:\n - \n PolicyDocument:\n Version: '2012-10-17'\n Statement:\n - Effect: Allow\n Action:\n - bedrock:InvokeModel # CRITICAL: allow only needed Bedrock action to avoid admin or bedrock:* permissions\n Resource: \"*\" # Limits access scope to only InvokeModel on any resource\n```", + "Other": "1. Open the AWS Console and go to IAM > Users\n2. Select the user that owns the Bedrock service-specific credential (Security credentials > Service-specific credentials shows bedrock.amazonaws.com)\n3. In the Permissions tab, detach any policy granting AdministratorAccess or bedrock:* (e.g., AmazonBedrockFullAccess)\n4. In the same tab, delete any inline policy that provides admin/privilege-escalation permissions or bedrock:* access\n5. If Bedrock access is needed, add a minimal policy allowing only bedrock:InvokeModel\n6. Save changes", + "Terraform": "```hcl\n# Attach a minimal inline policy to the IAM user owning the Bedrock API key\nresource \"aws_iam_user_policy\" \"\" {\n name = \"least-priv-bedrock\"\n user = \"\"\n\n # CRITICAL: allow only the specific action required; avoids admin or bedrock:* full access\n policy = jsonencode({\n Version = \"2012-10-17\"\n Statement = [{\n Effect = \"Allow\"\n Action = [\"bedrock:InvokeModel\"]\n Resource = \"*\"\n }]\n })\n}\n```" }, "Recommendation": { - "Text": "Apply the principle of least privilege to Amazon Bedrock API keys. Instead of granting administrative privileges or privilege escalation capabilities, assign only the permissions necessary for specific tasks. Create custom IAM policies with minimal permissions based on the principle of least privilege. Regularly review and audit API key permissions to ensure they cannot be used for privilege escalation.", - "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege" + "Text": "Enforce **least privilege** on Bedrock keys:\n- Avoid wildcards like `*` and `bedrock:*`; allow only required actions\n- Prevent identity changes by disallowing `iam:*`\n- Prefer short-term credentials with rotation and MFA\n- Use permissions boundaries and SCPs as guardrails\n- Review usage and tighten policies via access analysis", + "Url": "https://hub.prowler.com/check/bedrock_api_key_no_administrative_privileges" } }, "Categories": [ "gen-ai", - "trust-boundaries" + "identity-access" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json index 60d7d77ea9..f9b8ee0df9 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json +++ b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json @@ -1,35 +1,42 @@ { "Provider": "aws", "CheckID": "bedrock_api_key_no_long_term_credentials", - "CheckTitle": "Ensure Amazon Bedrock API keys are not long-term credentials", + "CheckTitle": "Amazon Bedrock API key is expired", "CheckType": [ - "Software and Configuration Checks", - "Industry and Regulatory Standards" + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "TTPs/Initial Access/Valid Accounts" ], "ServiceName": "bedrock", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:iam:region:account-id:user/{user-name}/credential/{api-key-id}", + "ResourceIdTemplate": "", "Severity": "high", - "ResourceType": "AwsIamServiceSpecificCredential", + "ResourceType": "AwsIamUser", "ResourceGroup": "IAM", - "Description": "Ensure that Amazon Bedrock API keys have expiration dates set to prevent long-term credential exposure. Long-term credentials pose a significant security risk as they remain valid indefinitely and can be used for unauthorized access if compromised.", - "Risk": "Amazon Bedrock API keys without expiration dates are long-term credentials that remain valid indefinitely. This increases the risk of unauthorized access if the credentials are compromised, as they cannot be automatically invalidated. Long-term credentials violate the principle of credential rotation and can lead to security vulnerabilities, data breaches, or unauthorized usage of Bedrock services.", - "RelatedUrl": "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html", + "Description": "**Bedrock API keys** are evaluated for **lifetime** and **expiration**.\n\nThe finding identifies keys that are long-lived, set to expire far in the future, or configured to `never expire`, and distinguishes them from keys that have already expired.", + "Risk": "Long-lived or non-expiring keys enable persistent access if compromised.\n- Confidentiality: unauthorized inference and exposure of prompts/outputs\n- Availability/Cost: uncontrolled usage and spend spikes\n- Integrity: actions can continue without timely revocation or rotation", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/ja_jp/bedrock/latest/userguide/getting-started-api-keys.html", + "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials", + "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html" + ], "Remediation": { "Code": { "CLI": "aws iam delete-service-specific-credential --user-name --service-specific-credential-id ", "NativeIaC": "", - "Other": "", + "Other": "1. Sign in to the AWS Management Console and open IAM\n2. Go to Users > select > Security credentials\n3. In \"API keys for Amazon Bedrock\", find the non-expired key and click Delete\n4. Confirm deletion to remove the key (removes the long-term credential so the check passes)", "Terraform": "" }, "Recommendation": { - "Text": "Delete the long-term API keys for Amazon Bedrock. Instead, use temporary credentials, IAM roles, or create new API keys with appropriate expiration dates. Implement a credential rotation policy to ensure all API keys have reasonable expiration periods. Consider using AWS STS for temporary credentials when possible.", - "Url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials" + "Text": "Prefer **short-term credentials** and **IAM roles**; avoid `never expire`.\n\nEnforce **least privilege**, strict **rotation**, and automatic **expiration** for any long-term key. Store secrets securely, monitor with audit logs, and revoke unused or stale keys quickly.", + "Url": "https://hub.prowler.com/check/bedrock_api_key_no_long_term_credentials" } }, "Categories": [ - "gen-ai", - "trust-boundaries" + "secrets", + "gen-ai" ], "DependsOn": [], "RelatedTo": [], diff --git a/prowler/providers/aws/services/bedrock/bedrock_guardrail_prompt_attack_filter_enabled/bedrock_guardrail_prompt_attack_filter_enabled.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_guardrail_prompt_attack_filter_enabled/bedrock_guardrail_prompt_attack_filter_enabled.metadata.json index fa8dbb81f2..e2017df2f8 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_guardrail_prompt_attack_filter_enabled/bedrock_guardrail_prompt_attack_filter_enabled.metadata.json +++ b/prowler/providers/aws/services/bedrock/bedrock_guardrail_prompt_attack_filter_enabled/bedrock_guardrail_prompt_attack_filter_enabled.metadata.json @@ -1,27 +1,37 @@ { "Provider": "aws", "CheckID": "bedrock_guardrail_prompt_attack_filter_enabled", - "CheckTitle": "Configure Prompt Attack Filter with the highest strength for Amazon Bedrock Guardrails.", - "CheckType": [], + "CheckTitle": "Amazon Bedrock guardrail has prompt attack filter strength set to HIGH", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "TTPs/Defense Evasion", + "Effects/Data Exposure" + ], "ServiceName": "bedrock", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:bedrock:region:account-id:guardrails/resource-id", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Other", "ResourceGroup": "ai_ml", - "Description": "Ensure that prompt attack filter strength is set to HIGH for Amazon Bedrock guardrails to mitigate prompt injection and bypass techniques.", - "Risk": "If prompt attack filter strength is not set to HIGH, Bedrock models may be more vulnerable to prompt injection attacks or jailbreak attempts, which could allow harmful or sensitive content to bypass filters and reach end users.", - "RelatedUrl": "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html", + "Description": "**Bedrock guardrails** have the **Prompt attack** filter set to `HIGH` strength to detect and block injection and jailbreak patterns. Guardrails missing this setting or using lower strengths are identified.", + "Risk": "Without **HIGH** prompt-attack filtering, models are exposed to **prompt injection/jailbreaks**:\n- Confidentiality: coerced disclosure of sensitive data\n- Integrity: policy evasion and manipulated outputs\n- Operations: unintended tool execution and workflow tampering", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://trendmicro.com/cloudoneconformity/knowledge-base/aws/Bedrock/prompt-attack-strength.html", + "https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html", + "https://support.icompaas.com/support/solutions/articles/62000233535-ensure-prompt-attack-filter-is-configured-at-highest-strength-for-amazon-bedrock-guardrails", + "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" + ], "Remediation": { "Code": { - "CLI": "aws bedrock put-guardrails-configuration --guardrails-config 'promptAttackStrength=HIGH'", - "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Bedrock/prompt-attack-strength.html", - "Terraform": "" + "CLI": "aws bedrock update-guardrail --guardrail-identifier --content-policy-config 'filtersConfig=[{type=PROMPT_ATTACK,inputStrength=HIGH}]'", + "NativeIaC": "```yaml\nResources:\n :\n Type: AWS::Bedrock::Guardrail\n Properties:\n Name: \n BlockedInputMessaging: \"Blocked\"\n BlockedOutputsMessaging: \"Blocked\"\n ContentPolicyConfig:\n FiltersConfig:\n - Type: PROMPT_ATTACK # Critical: enables the Prompt Attack filter\n InputStrength: HIGH # Critical: sets filter strength to HIGH to pass the check\n```", + "Other": "1. Open the AWS Console and go to Amazon Bedrock\n2. Select Guardrails, then choose your guardrail\n3. In Content filters, find Prompt attacks\n4. Set Strength to High\n5. Click Save", + "Terraform": "```hcl\nresource \"aws_bedrock_guardrail\" \"\" {\n name = \"\"\n blocked_input_messaging = \"Blocked\"\n blocked_outputs_messaging = \"Blocked\"\n\n content_policy_config {\n filters_config {\n type = \"PROMPT_ATTACK\" # Critical: enables the Prompt Attack filter\n input_strength = \"HIGH\" # Critical: sets filter strength to HIGH to pass the check\n }\n }\n}\n```" }, "Recommendation": { - "Text": "Set the prompt attack filter strength to HIGH for Amazon Bedrock guardrails to prevent prompt injection attacks and ensure robust protection against content manipulation.", - "Url": "https://docs.aws.amazon.com/bedrock/latest/userguide/prompt-injection.html" + "Text": "Set the **Prompt attack** filter to `HIGH` and apply **defense in depth**:\n- Tag user/external inputs as untrusted for evaluation\n- Combine with denied topics and sensitive-info filters\n- Enforce **least privilege** and approvals for risky actions\n- Monitor guardrail hits and tune to reduce false negatives", + "Url": "https://hub.prowler.com/check/bedrock_guardrail_prompt_attack_filter_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/bedrock/bedrock_guardrail_sensitive_information_filter_enabled/bedrock_guardrail_sensitive_information_filter_enabled.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_guardrail_sensitive_information_filter_enabled/bedrock_guardrail_sensitive_information_filter_enabled.metadata.json index daacdc8bd9..83876b04a6 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_guardrail_sensitive_information_filter_enabled/bedrock_guardrail_sensitive_information_filter_enabled.metadata.json +++ b/prowler/providers/aws/services/bedrock/bedrock_guardrail_sensitive_information_filter_enabled/bedrock_guardrail_sensitive_information_filter_enabled.metadata.json @@ -1,27 +1,37 @@ { "Provider": "aws", "CheckID": "bedrock_guardrail_sensitive_information_filter_enabled", - "CheckTitle": "Configure Sensitive Information Filters for Amazon Bedrock Guardrails.", - "CheckType": [], + "CheckTitle": "Amazon Bedrock guardrail blocks or masks sensitive information", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis", + "Effects/Data Exposure", + "Sensitive Data Identifications/PII" + ], "ServiceName": "bedrock", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:bedrock:region:account-id:guardrails/resource-id", + "ResourceIdTemplate": "", "Severity": "high", "ResourceType": "Other", "ResourceGroup": "ai_ml", - "Description": "Ensure that sensitive information filters are enabled for Amazon Bedrock guardrails to prevent the leakage of sensitive data such as personally identifiable information (PII), financial data, or confidential corporate information.", - "Risk": "If sensitive information filters are not enabled, Bedrock models may inadvertently generate or expose confidential or sensitive information in responses, leading to data breaches, regulatory violations, or reputational damage.", - "RelatedUrl": "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html", + "Description": "**Bedrock guardrails** use **sensitive information filters** to `block` or `mask` detected PII and custom pattern matches in prompts and responses.\n\nThe evaluation looks for guardrails with this filtering configured.", + "Risk": "Absent filtering, prompts or outputs can reveal **PII**, credentials, or financial records, compromising **confidentiality**.\n- Exposed tokens enable unauthorized access and data tampering (integrity)\n- Disclosed customer details facilitate fraud and identity theft, with potential lateral movement", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Bedrock/guardrails-with-pii-mask-block.html", + "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html" + ], "Remediation": { "Code": { - "CLI": "aws bedrock put-guardrails-configuration --guardrails-config 'sensitiveInformationFilter=true'", + "CLI": "aws bedrock update-guardrail --guardrail-identifier --sensitive-information-policy-config '{\"piiEntitiesConfig\":[{\"type\":\"EMAIL\",\"action\":\"ANONYMIZE\"}]}'", "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Bedrock/guardrails-with-pii-mask-block.html", + "Other": "1. Sign in to the AWS Console and open Amazon Bedrock\n2. Go to Guardrails and select \n3. Click Edit (or Open draft) and open Sensitive information filters\n4. Add PII type EMAIL and set action to Mask (or Block)\n5. Click Save", "Terraform": "" }, "Recommendation": { - "Text": "Enable sensitive information filters for Amazon Bedrock guardrails to prevent the exposure of sensitive or confidential information.", - "Url": "https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-sensitive-filters.html" + "Text": "Enable and tune **sensitive information filters** for inputs and outputs.\n- Use `BLOCK` for high-risk disclosures; `ANONYMIZE` when context is needed\n- Add custom regex for org-specific IDs\n- Apply least privilege and data minimization\n- Test regularly and monitor outcomes as part of defense-in-depth", + "Url": "https://hub.prowler.com/check/bedrock_guardrail_sensitive_information_filter_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.metadata.json index e301803e02..104df26fcf 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.metadata.json +++ b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logging_enabled/bedrock_model_invocation_logging_enabled.metadata.json @@ -1,27 +1,35 @@ { "Provider": "aws", "CheckID": "bedrock_model_invocation_logging_enabled", - "CheckTitle": "Ensure that model invocation logging is enabled for Amazon Bedrock.", - "CheckType": [], + "CheckTitle": "Amazon Bedrock model invocation logging is enabled", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices" + ], "ServiceName": "bedrock", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:bedrock:region:account-id:model/resource-id", + "ResourceIdTemplate": "", "Severity": "medium", "ResourceType": "Other", "ResourceGroup": "ai_ml", - "Description": "Ensure that model invocation logging is enabled for Amazon Bedrock service in order to collect metadata, requests, and responses for all model invocations in your AWS cloud account.", - "Risk": "In Amazon Bedrock, model invocation logging enables you to collect the invocation request and response data, along with metadata, for all 'Converse', 'ConverseStream', 'InvokeModel', and 'InvokeModelWithResponseStream' API calls in your AWS account. Each log entry includes important details such as the timestamp, request ID, model ID, and token usage. Invocation logs can be utilized for troubleshooting, performance enhancements, abuse detection, and security auditing. By default, model invocation logging is disabled.", - "RelatedUrl": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html", + "Description": "**Bedrock** model invocation logging captures request, response, and metadata for `Converse`, `ConverseStream`, `InvokeModel`, and `InvokeModelWithResponseStream` calls per Region, delivering records to **CloudWatch Logs** and/or **S3** when configured.", + "Risk": "Without **invocation logs**, you lose **auditability** and **forensic visibility** into model activity.\n\nCredential misuse or **prompt injection/jailbreak** attempts may go unnoticed, enabling data exfiltration and unauthorized spend. Missing traceability weakens **integrity** controls and slows incident response.", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html#model-invocation-logging-console", + "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Bedrock/enable-model-invocation-logging.html", + "https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html" + ], "Remediation": { "Code": { - "CLI": "aws bedrock put-model-invocation-logging-configuration --logging-config 's3Config={bucketName='tm-bedrock-logging-data',keyPrefix='invocation-logs'},textDataDeliveryEnabled=true,imageDataDeliveryEnabled=true,embeddingDataDeliveryEnabled=true'", + "CLI": "aws bedrock put-model-invocation-logging-configuration --logging-config '{\"s3Config\":{\"bucketName\":\"\"},\"textDataDeliveryEnabled\":true}'", "NativeIaC": "", - "Other": "https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/Bedrock/enable-model-invocation-logging.html", + "Other": "1. Open the Amazon Bedrock console in the target Region\n2. Go to Settings > Model invocation logging\n3. Toggle Logging to On\n4. Select Amazon S3 as the destination and choose bucket\n5. Under Data types, select Text\n6. Click Save", "Terraform": "" }, "Recommendation": { - "Text": "Enable model invocation logging for Amazon Bedrock service in order to collect metadata, requests, and responses for all model invocations in your AWS cloud account.", - "Url": "https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html#model-invocation-logging-console" + "Text": "Enable **model invocation logging** and route events to **CloudWatch Logs** and/or **S3**.\n\nEnforce **least privilege** on log access, use encryption, and set retention/lifecycle policies. Monitor for anomalies and alerts to support **defense in depth** and **separation of duties**.", + "Url": "https://hub.prowler.com/check/bedrock_model_invocation_logging_enabled" } }, "Categories": [ diff --git a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.metadata.json index 986f7310e1..703fde2d7f 100644 --- a/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.metadata.json +++ b/prowler/providers/aws/services/bedrock/bedrock_model_invocation_logs_encryption_enabled/bedrock_model_invocation_logs_encryption_enabled.metadata.json @@ -1,27 +1,38 @@ { "Provider": "aws", "CheckID": "bedrock_model_invocation_logs_encryption_enabled", - "CheckTitle": "Ensure that Amazon Bedrock model invocation logs are encrypted with KMS.", - "CheckType": [], + "CheckTitle": "Amazon Bedrock model invocation logs are encrypted in the S3 bucket and KMS-encrypted in the CloudWatch log group", + "CheckType": [ + "Software and Configuration Checks/AWS Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices", + "Software and Configuration Checks/Industry and Regulatory Standards/CIS AWS Foundations Benchmark", + "Effects/Data Exposure" + ], "ServiceName": "bedrock", "SubServiceName": "", - "ResourceIdTemplate": "arn:partition:bedrock:region:account-id:model/resource-id", + "ResourceIdTemplate": "", "Severity": "high", - "ResourceType": "Other", + "ResourceType": "AwsS3Bucket", "ResourceGroup": "ai_ml", - "Description": "Ensure that Amazon Bedrock model invocation logs are encrypted using AWS KMS to protect sensitive data in the request and response logs for all model invocations.", - "Risk": "If Amazon Bedrock model invocation logs are not encrypted, sensitive data such as prompts, responses, and token usage could be exposed to unauthorized parties. This may lead to data breaches, security vulnerabilities, or unintended use of sensitive information.", - "RelatedUrl": "https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html", + "Description": "**Bedrock model invocation logs** are stored in encrypted destinations: **S3 buckets** with bucket encryption and **CloudWatch Logs** groups protected by an AWS KMS key.\n\nThis evaluates whether configured log targets enforce encryption at rest for request/response content and associated metadata.", + "Risk": "Without encryption at rest, prompts, outputs, images, and token/usage metadata in logs can be read if S3 or CloudWatch storage or replicas are accessed by unauthorized principals.\n\nImpacts:\n- Loss of data **confidentiality**\n- Secret or PII exposure enabling **account abuse**\n- Operational intel for **lateral movement**", + "RelatedUrl": "", + "AdditionalURLs": [ + "https://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html", + "https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html", + "https://support.icompaas.com/support/solutions/articles/62000233532-ensure-that-amazon-bedrock-model-invocation-logs-are-encrypted-with-kms", + "https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/configure-bedrock-invocation-logging-cloudformation.html" + ], "Remediation": { "Code": { "CLI": "", - "NativeIaC": "", - "Other": "", - "Terraform": "" + "NativeIaC": "```yaml\nResources:\n EncryptedLogsBucket:\n Type: AWS::S3::Bucket\n Properties:\n BucketName: \n BucketEncryption: # critical: enables default encryption for the bucket (SSE-S3)\n ServerSideEncryptionConfiguration:\n - ServerSideEncryptionByDefault:\n SSEAlgorithm: AES256\n\n EncryptedLogGroup:\n Type: AWS::Logs::LogGroup\n Properties:\n LogGroupName: \n KmsKeyId: # critical: encrypts the CloudWatch log group with a KMS key\n```", + "Other": "1. In the Bedrock console, go to Settings and note the S3 bucket and CloudWatch log group used for Model invocation logging.\n2. S3 bucket: AWS Console > S3 > Buckets > > Properties > Default encryption > Enable > Choose SSE-S3 (AES-256) > Save.\n3. CloudWatch Logs: AWS Console > CloudWatch > Logs > Log groups > select > Actions > Edit > KMS encryption > select > Save.", + "Terraform": "```hcl\nresource \"aws_s3_bucket\" \"example\" {\n bucket = \"\"\n}\n\nresource \"aws_s3_bucket_server_side_encryption_configuration\" \"example\" {\n bucket = aws_s3_bucket.example.id\n rule {\n apply_server_side_encryption_by_default {\n sse_algorithm = \"AES256\" # critical: enables default encryption for the S3 bucket\n }\n }\n}\n\nresource \"aws_cloudwatch_log_group\" \"example\" {\n name = \"\"\n kms_key_id = \"\" # critical: encrypts the log group with a KMS key\n}\n```" }, "Recommendation": { - "Text": "Ensure that model invocation logs for Amazon Bedrock are encrypted using AWS KMS to prevent unauthorized access to sensitive log data.", - "Url": "hhttps://docs.aws.amazon.com/bedrock/latest/userguide/data-protection.html" + "Text": "Ensure all invocation logs are encrypted end to end:\n- Enable S3 default encryption, preferably `SSE-KMS`, and restrict key usage\n- Assign a KMS key to CloudWatch log groups\n- Enforce **least privilege** on keys and logs, rotate keys, and monitor access for **defense in depth**", + "Url": "https://hub.prowler.com/check/bedrock_model_invocation_logs_encryption_enabled" } }, "Categories": [ From d38be934a33d11b89678445ed34925ebfccdbf26 Mon Sep 17 00:00:00 2001 From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com> Date: Mon, 12 Jan 2026 15:44:25 +0100 Subject: [PATCH 044/337] feat(ui): add new findings table (#9699) --- api/CHANGELOG.md | 1 + api/src/backend/api/filters.py | 4 + api/src/backend/api/specs/v1.yaml | 381 ++++++++++++++---- api/src/backend/api/tests/test_views.py | 53 +++ ui/CHANGELOG.md | 1 + .../_components/accounts-selector.tsx | 9 +- .../_components/attack-surface-card-item.tsx | 4 - .../findings-view/findings-view.ssr.tsx | 4 +- .../risk-plot/risk-plot-client.tsx | 6 +- .../_components/risk-severity-chart.tsx | 3 - .../finding-severity-over-time.tsx | 2 +- .../status-chart/_components/status-chart.tsx | 3 - .../_components/service-watchlist.tsx | 4 - ui/app/(prowler)/findings/page.tsx | 1 + .../filters/clear-filters-button.tsx | 19 +- ui/components/filters/custom-date-picker.tsx | 153 +++---- ui/components/filters/data-filters.ts | 7 - ui/components/filters/filter-controls.tsx | 13 +- ui/components/findings/findings-filters.tsx | 144 ++++--- .../findings/table/column-findings.tsx | 284 +++++-------- .../findings/table/data-table-row-actions.tsx | 19 +- .../findings/table/delta-indicator.tsx | 3 +- .../findings/table/finding-detail.tsx | 277 ++++++++----- .../table/findings-table-with-selection.tsx | 1 + .../table/impacted-resources-cell.tsx | 84 ++++ ui/components/findings/table/index.ts | 4 + .../findings/table/notification-indicator.tsx | 100 +++++ .../findings/table/provider-icon-cell.tsx | 52 +++ .../table/skeleton-table-findings.tsx | 176 ++++++-- ui/components/graphs/sankey-chart.tsx | 10 +- ui/components/graphs/threat-map.tsx | 2 - ui/components/shadcn/calendar.tsx | 75 ++++ ui/components/shadcn/checkbox/checkbox.tsx | 13 +- ui/components/shadcn/drawer.tsx | 133 ++++++ ui/components/shadcn/index.ts | 2 + ui/components/shadcn/info-field/index.ts | 1 + .../shadcn/info-field/info-field.tsx | 83 ++++ ui/components/shadcn/select/select.tsx | 7 +- ui/components/ui/entities/date-with-time.tsx | 43 +- ui/components/ui/expandable-section.tsx | 33 ++ .../ui/table/data-table-column-header.tsx | 6 +- .../ui/table/data-table-filter-custom.tsx | 17 +- .../ui/table/data-table-pagination.tsx | 187 +++++---- ui/components/ui/table/data-table-search.tsx | 147 +++++++ ui/components/ui/table/data-table.tsx | 125 +++--- ui/components/ui/table/index.ts | 1 + ui/components/ui/table/severity-badge.tsx | 79 ++-- .../ui/table/status-finding-badge.tsx | 67 +-- ui/components/ui/table/table.tsx | 80 ++-- ui/dependency-log.json | 16 + ui/lib/external-urls.ts | 6 + ui/lib/provider-helpers.ts | 40 -- ui/package.json | 2 + ui/pnpm-lock.yaml | 44 ++ ui/styles/globals.css | 3 + 55 files changed, 2121 insertions(+), 913 deletions(-) create mode 100644 ui/components/findings/table/impacted-resources-cell.tsx create mode 100644 ui/components/findings/table/notification-indicator.tsx create mode 100644 ui/components/findings/table/provider-icon-cell.tsx create mode 100644 ui/components/shadcn/calendar.tsx create mode 100644 ui/components/shadcn/drawer.tsx create mode 100644 ui/components/shadcn/info-field/index.ts create mode 100644 ui/components/shadcn/info-field/info-field.tsx create mode 100644 ui/components/ui/expandable-section.tsx create mode 100644 ui/components/ui/table/data-table-search.tsx diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md index 78e4bac36a..48a7753832 100644 --- a/api/CHANGELOG.md +++ b/api/CHANGELOG.md @@ -7,6 +7,7 @@ All notable changes to the **Prowler API** are documented in this file. ### Added - `/api/v1/overviews/compliance-watchlist` to retrieve the compliance watchlist [(#9596)](https://github.com/prowler-cloud/prowler/pull/9596) - Support AlibabaCloud provider [(#9485)](https://github.com/prowler-cloud/prowler/pull/9485) +- `provider_id` and `provider_id__in` filter aliases for findings endpoints to enable consistent frontend parameter naming [(#9701)](https://github.com/prowler-cloud/prowler/pull/9701) --- diff --git a/api/src/backend/api/filters.py b/api/src/backend/api/filters.py index 95c591104b..fdb2282e12 100644 --- a/api/src/backend/api/filters.py +++ b/api/src/backend/api/filters.py @@ -143,8 +143,12 @@ class BaseScanProviderFilter(FilterSet): class CommonFindingFilters(FilterSet): # We filter providers from the scan in findings + # Both 'provider' and 'provider_id' parameters are supported for API consistency + # Frontend uses 'provider_id' uniformly across all endpoints provider = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") provider__in = UUIDInFilter(field_name="scan__provider__id", lookup_expr="in") + provider_id = UUIDFilter(field_name="scan__provider__id", lookup_expr="exact") + provider_id__in = UUIDInFilter(field_name="scan__provider__id", lookup_expr="in") provider_type = ChoiceFilter( choices=Provider.ProviderChoices.choices, field_name="scan__provider__provider" ) diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml index 27a9393c6d..2e238a5ad4 100644 --- a/api/src/backend/api/specs/v1.yaml +++ b/api/src/backend/api/specs/v1.yaml @@ -879,12 +879,28 @@ paths: description: Multiple values may be separated by commas. explode: false style: form + - in: query + name: filter[provider_id] + schema: + type: string + format: uuid + - in: query + name: filter[provider_id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form - in: query name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -894,7 +910,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -912,8 +927,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -923,7 +939,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -1436,12 +1451,28 @@ paths: description: Multiple values may be separated by commas. explode: false style: form + - in: query + name: filter[provider_id] + schema: + type: string + format: uuid + - in: query + name: filter[provider_id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form - in: query name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -1451,7 +1482,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -1469,8 +1499,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -1480,7 +1511,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -1901,12 +1931,28 @@ paths: description: Multiple values may be separated by commas. explode: false style: form + - in: query + name: filter[provider_id] + schema: + type: string + format: uuid + - in: query + name: filter[provider_id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form - in: query name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -1916,7 +1962,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -1934,8 +1979,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -1945,7 +1991,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -2364,12 +2409,28 @@ paths: description: Multiple values may be separated by commas. explode: false style: form + - in: query + name: filter[provider_id] + schema: + type: string + format: uuid + - in: query + name: filter[provider_id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form - in: query name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -2379,7 +2440,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -2397,8 +2457,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -2408,7 +2469,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -2815,12 +2875,28 @@ paths: description: Multiple values may be separated by commas. explode: false style: form + - in: query + name: filter[provider_id] + schema: + type: string + format: uuid + - in: query + name: filter[provider_id__in] + schema: + type: array + items: + type: string + format: uuid + description: Multiple values may be separated by commas. + explode: false + style: form - in: query name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -2830,7 +2906,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -2848,8 +2923,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -2859,7 +2935,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -4627,8 +4702,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -4648,14 +4724,16 @@ paths: * `mongodbatlas` - MongoDB Atlas * `iac` - IaC * `oraclecloud` - Oracle Cloud Infrastructure + * `alibabacloud` - Alibaba Cloud - in: query name: filter[provider_type__in] schema: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -4677,6 +4755,7 @@ paths: * `mongodbatlas` - MongoDB Atlas * `iac` - IaC * `oraclecloud` - Oracle Cloud Infrastructure + * `alibabacloud` - Alibaba Cloud explode: false style: form - name: filter[search] @@ -4782,8 +4861,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -4803,14 +4883,16 @@ paths: * `mongodbatlas` - MongoDB Atlas * `iac` - IaC * `oraclecloud` - Oracle Cloud Infrastructure + * `alibabacloud` - Alibaba Cloud - in: query name: filter[provider_type__in] schema: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -4832,6 +4914,7 @@ paths: * `mongodbatlas` - MongoDB Atlas * `iac` - IaC * `oraclecloud` - Oracle Cloud Infrastructure + * `alibabacloud` - Alibaba Cloud explode: false style: form - name: filter[search] @@ -4992,8 +5075,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -5003,7 +5087,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -5021,8 +5104,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -5032,7 +5116,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -5185,8 +5268,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -5196,7 +5280,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -5214,8 +5297,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -5225,7 +5309,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -5374,6 +5457,7 @@ paths: schema: type: string enum: + - alibabacloud - aws - azure - gcp @@ -5383,7 +5467,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -5402,6 +5485,7 @@ paths: items: type: string enum: + - alibabacloud - aws - azure - gcp @@ -5411,7 +5495,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -5600,8 +5683,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -5611,7 +5695,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -5629,8 +5712,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -5640,7 +5724,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -5776,8 +5859,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -5787,7 +5871,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -5805,8 +5888,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -5816,7 +5900,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -6599,8 +6682,9 @@ paths: name: filter[provider] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -6610,7 +6694,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -6628,8 +6711,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -6639,7 +6723,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -6659,8 +6742,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -6670,7 +6754,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -6688,8 +6771,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -6699,7 +6783,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -7313,8 +7396,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -7324,7 +7408,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -7342,8 +7425,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -7353,7 +7437,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -7700,8 +7783,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -7711,7 +7795,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -7729,8 +7812,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -7740,7 +7824,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -7982,8 +8065,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -7993,7 +8077,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -8011,8 +8094,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -8022,7 +8106,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -8270,8 +8353,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -8281,7 +8365,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -8299,8 +8382,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -8310,7 +8394,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -9121,8 +9204,9 @@ paths: name: filter[provider_type] schema: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -9132,7 +9216,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- * `aws` - AWS * `azure` - Azure @@ -9150,8 +9233,9 @@ paths: type: array items: type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f enum: + - alibabacloud - aws - azure - gcp @@ -9161,7 +9245,6 @@ paths: - m365 - mongodbatlas - oraclecloud - - alibabacloud description: |- Multiple values may be separated by commas. @@ -15717,6 +15800,44 @@ components: required: - atlas_public_key - atlas_private_key + - type: object + title: Alibaba Cloud Static Credentials + properties: + access_key_id: + type: string + description: The Alibaba Cloud access key ID for authentication. + access_key_secret: + type: string + description: The Alibaba Cloud access key secret for authentication. + security_token: + type: string + description: The STS security token for temporary credentials + (optional). + required: + - access_key_id + - access_key_secret + - type: object + title: Alibaba Cloud RAM Role Assumption + properties: + role_arn: + type: string + description: The ARN of the RAM role to assume (e.g., acs:ram::1234567890123456:role/ProwlerRole). + access_key_id: + type: string + description: The Alibaba Cloud access key ID of the RAM user + that will assume the role. + access_key_secret: + type: string + description: The Alibaba Cloud access key secret of the RAM + user that will assume the role. + role_session_name: + type: string + description: An identifier for the role session (optional, + defaults to 'ProwlerSession'). + required: + - role_arn + - access_key_id + - access_key_secret writeOnly: true required: - secret @@ -16727,7 +16848,7 @@ components: * `iac` - IaC * `oraclecloud` - Oracle Cloud Infrastructure * `alibabacloud` - Alibaba Cloud - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f uid: type: string title: Unique identifier for the provider, set by the provider @@ -16844,7 +16965,7 @@ components: - oraclecloud - alibabacloud type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f description: |- Type of provider to create. @@ -16906,7 +17027,7 @@ components: - oraclecloud - alibabacloud type: string - x-spec-enum-id: eca8c51e6bd28935 + x-spec-enum-id: 684bf4173d2b754f description: |- Type of provider to create. @@ -17682,6 +17803,44 @@ components: required: - atlas_public_key - atlas_private_key + - type: object + title: Alibaba Cloud Static Credentials + properties: + access_key_id: + type: string + description: The Alibaba Cloud access key ID for authentication. + access_key_secret: + type: string + description: The Alibaba Cloud access key secret for authentication. + security_token: + type: string + description: The STS security token for temporary credentials + (optional). + required: + - access_key_id + - access_key_secret + - type: object + title: Alibaba Cloud RAM Role Assumption + properties: + role_arn: + type: string + description: The ARN of the RAM role to assume (e.g., acs:ram::1234567890123456:role/ProwlerRole). + access_key_id: + type: string + description: The Alibaba Cloud access key ID of the RAM user that + will assume the role. + access_key_secret: + type: string + description: The Alibaba Cloud access key secret of the RAM user + that will assume the role. + role_session_name: + type: string + description: An identifier for the role session (optional, defaults + to 'ProwlerSession'). + required: + - role_arn + - access_key_id + - access_key_secret writeOnly: true required: - secret_type @@ -18007,6 +18166,44 @@ components: required: - atlas_public_key - atlas_private_key + - type: object + title: Alibaba Cloud Static Credentials + properties: + access_key_id: + type: string + description: The Alibaba Cloud access key ID for authentication. + access_key_secret: + type: string + description: The Alibaba Cloud access key secret for authentication. + security_token: + type: string + description: The STS security token for temporary credentials + (optional). + required: + - access_key_id + - access_key_secret + - type: object + title: Alibaba Cloud RAM Role Assumption + properties: + role_arn: + type: string + description: The ARN of the RAM role to assume (e.g., acs:ram::1234567890123456:role/ProwlerRole). + access_key_id: + type: string + description: The Alibaba Cloud access key ID of the RAM user + that will assume the role. + access_key_secret: + type: string + description: The Alibaba Cloud access key secret of the RAM + user that will assume the role. + role_session_name: + type: string + description: An identifier for the role session (optional, + defaults to 'ProwlerSession'). + required: + - role_arn + - access_key_id + - access_key_secret writeOnly: true required: - secret_type @@ -18346,6 +18543,44 @@ components: required: - atlas_public_key - atlas_private_key + - type: object + title: Alibaba Cloud Static Credentials + properties: + access_key_id: + type: string + description: The Alibaba Cloud access key ID for authentication. + access_key_secret: + type: string + description: The Alibaba Cloud access key secret for authentication. + security_token: + type: string + description: The STS security token for temporary credentials + (optional). + required: + - access_key_id + - access_key_secret + - type: object + title: Alibaba Cloud RAM Role Assumption + properties: + role_arn: + type: string + description: The ARN of the RAM role to assume (e.g., acs:ram::1234567890123456:role/ProwlerRole). + access_key_id: + type: string + description: The Alibaba Cloud access key ID of the RAM user that + will assume the role. + access_key_secret: + type: string + description: The Alibaba Cloud access key secret of the RAM user + that will assume the role. + role_session_name: + type: string + description: An identifier for the role session (optional, defaults + to 'ProwlerSession'). + required: + - role_arn + - access_key_id + - access_key_secret writeOnly: true required: - secret diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py index ab1dfc5901..f2a0c299f2 100644 --- a/api/src/backend/api/tests/test_views.py +++ b/api/src/backend/api/tests/test_views.py @@ -4110,6 +4110,37 @@ class TestFindingViewSet: assert response.status_code == status.HTTP_200_OK assert len(response.json()["data"]) == 2 + def test_finding_filter_by_provider_id_alias( + self, authenticated_client, findings_fixture + ): + """Test that provider_id filter alias works identically to provider filter.""" + response = authenticated_client.get( + reverse("finding-list"), + { + "filter[provider_id]": findings_fixture[0].scan.provider.id, + "filter[inserted_at]": TODAY, + }, + ) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()["data"]) == 2 + + def test_finding_filter_by_provider_id_in_alias( + self, authenticated_client, findings_fixture + ): + """Test that provider_id__in filter alias works identically to provider__in filter.""" + response = authenticated_client.get( + reverse("finding-list"), + { + "filter[provider_id__in]": [ + findings_fixture[0].scan.provider.id, + findings_fixture[1].scan.provider.id, + ], + "filter[inserted_at]": TODAY, + }, + ) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()["data"]) == 2 + @pytest.mark.parametrize( "filter_name", ( @@ -4331,6 +4362,28 @@ class TestFindingViewSet: == latest_scan_finding.status ) + def test_findings_latest_filter_by_provider_id_alias( + self, authenticated_client, latest_scan_finding + ): + """Test that provider_id filter alias works on latest findings endpoint.""" + response = authenticated_client.get( + reverse("finding-latest"), + {"filter[provider_id]": latest_scan_finding.scan.provider.id}, + ) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()["data"]) == 1 + + def test_findings_latest_filter_by_provider_id_in_alias( + self, authenticated_client, latest_scan_finding + ): + """Test that provider_id__in filter alias works on latest findings endpoint.""" + response = authenticated_client.get( + reverse("finding-latest"), + {"filter[provider_id__in]": str(latest_scan_finding.scan.provider.id)}, + ) + assert response.status_code == status.HTTP_200_OK + assert len(response.json()["data"]) == 1 + def test_findings_metadata_latest(self, authenticated_client, latest_scan_finding): response = authenticated_client.get( reverse("finding-metadata_latest"), diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md index 29ba43583b..4aa46e86cb 100644 --- a/ui/CHANGELOG.md +++ b/ui/CHANGELOG.md @@ -7,6 +7,7 @@ All notable changes to the **Prowler UI** are documented in this file. ### 🚀 Added - Add search bar when adding a provider [(#9634)](https://github.com/prowler-cloud/prowler/pull/9634) +- New findings table UI with new design system components, improved filtering UX, and enhanced table interactions [(#9699)](https://github.com/prowler-cloud/prowler/pull/9699) - Add gradient background to Risk Plot for visual risk context [(#9664)](https://github.com/prowler-cloud/prowler/pull/9664) ### 🔄 Changed diff --git a/ui/app/(prowler)/_overview/_components/accounts-selector.tsx b/ui/app/(prowler)/_overview/_components/accounts-selector.tsx index 80a22b1379..dce5f049dc 100644 --- a/ui/app/(prowler)/_overview/_components/accounts-selector.tsx +++ b/ui/app/(prowler)/_overview/_components/accounts-selector.tsx @@ -45,7 +45,8 @@ export function AccountsSelector({ providers }: AccountsSelectorProps) { const router = useRouter(); const searchParams = useSearchParams(); - const current = searchParams.get("filter[provider_id__in]") || ""; + const filterKey = "filter[provider_id__in]"; + const current = searchParams.get(filterKey) || ""; const selectedTypes = searchParams.get("filter[provider_type__in]") || ""; const selectedTypesList = selectedTypes ? selectedTypes.split(",").filter(Boolean) @@ -61,10 +62,10 @@ export function AccountsSelector({ providers }: AccountsSelectorProps) { const handleMultiValueChange = (ids: string[]) => { const params = new URLSearchParams(searchParams.toString()); + params.delete(filterKey); + if (ids.length > 0) { - params.set("filter[provider_id__in]", ids.join(",")); - } else { - params.delete("filter[provider_id__in]"); + params.set(filterKey, ids.join(",")); } // Auto-deselect provider types that no longer have any selected accounts diff --git a/ui/app/(prowler)/_overview/attack-surface/_components/attack-surface-card-item.tsx b/ui/app/(prowler)/_overview/attack-surface/_components/attack-surface-card-item.tsx index 9a26763c3e..46f2b0dd8e 100644 --- a/ui/app/(prowler)/_overview/attack-surface/_components/attack-surface-card-item.tsx +++ b/ui/app/(prowler)/_overview/attack-surface/_components/attack-surface-card-item.tsx @@ -2,7 +2,6 @@ import Link from "next/link"; import { AttackSurfaceItem } from "@/actions/overview"; import { Card, CardContent } from "@/components/shadcn"; -import { mapProviderFiltersForFindings } from "@/lib"; interface AttackSurfaceCardItemProps { item: AttackSurfaceItem; @@ -29,9 +28,6 @@ export function AttackSurfaceCardItem({ } }); - // Map provider filters for findings page compatibility - mapProviderFiltersForFindings(params); - return `/findings?${params.toString()}`; }; diff --git a/ui/app/(prowler)/_overview/graphs-tabs/findings-view/findings-view.ssr.tsx b/ui/app/(prowler)/_overview/graphs-tabs/findings-view/findings-view.ssr.tsx index 7dcbac50e9..c71e74c623 100644 --- a/ui/app/(prowler)/_overview/graphs-tabs/findings-view/findings-view.ssr.tsx +++ b/ui/app/(prowler)/_overview/graphs-tabs/findings-view/findings-view.ssr.tsx @@ -8,7 +8,6 @@ import { LinkToFindings } from "@/components/overview"; import { ColumnNewFindingsToDate } from "@/components/overview/new-findings-table/table/column-new-findings-to-date"; import { DataTable } from "@/components/ui/table"; import { createDict } from "@/lib/helper"; -import { mapProviderFiltersForFindingsObject } from "@/lib/provider-helpers"; import { FindingProps, SearchParamsProps } from "@/types"; import { pickFilterParams } from "../../_lib/filter-params"; @@ -27,8 +26,7 @@ export async function FindingsViewSSR({ searchParams }: FindingsViewSSRProps) { }; const filters = pickFilterParams(searchParams); - const mappedFilters = mapProviderFiltersForFindingsObject(filters); - const combinedFilters = { ...defaultFilters, ...mappedFilters }; + const combinedFilters = { ...defaultFilters, ...filters }; const findingsData = await getLatestFindings({ query: undefined, diff --git a/ui/app/(prowler)/_overview/graphs-tabs/risk-plot/risk-plot-client.tsx b/ui/app/(prowler)/_overview/graphs-tabs/risk-plot/risk-plot-client.tsx index dc312762ea..84405fe0f1 100644 --- a/ui/app/(prowler)/_overview/graphs-tabs/risk-plot/risk-plot-client.tsx +++ b/ui/app/(prowler)/_overview/graphs-tabs/risk-plot/risk-plot-client.tsx @@ -8,7 +8,6 @@ import { HorizontalBarChart } from "@/components/graphs/horizontal-bar-chart"; import { ScatterPlot } from "@/components/graphs/scatter-plot"; import { AlertPill } from "@/components/graphs/shared/alert-pill"; import type { BarDataPoint } from "@/components/graphs/types"; -import { mapProviderFiltersForFindings } from "@/lib/provider-helpers"; import { SEVERITY_FILTER_MAP } from "@/types/severities"; // Score color thresholds (0-100 scale, higher = better) @@ -42,9 +41,6 @@ export function RiskPlotClient({ data }: RiskPlotClientProps) { // Build the URL with current filters const params = new URLSearchParams(searchParams.toString()); - // Transform provider filters (provider_id__in -> provider__in) - mapProviderFiltersForFindings(params); - // Add severity filter const severity = SEVERITY_FILTER_MAP[dataPoint.name]; if (severity) { @@ -52,7 +48,7 @@ export function RiskPlotClient({ data }: RiskPlotClientProps) { } // Add provider filter for the selected point - params.set("filter[provider__in]", selectedPoint.providerId); + params.set("filter[provider_id__in]", selectedPoint.providerId); // Add exclude muted findings filter params.set("filter[muted]", "false"); diff --git a/ui/app/(prowler)/_overview/risk-severity/_components/risk-severity-chart.tsx b/ui/app/(prowler)/_overview/risk-severity/_components/risk-severity-chart.tsx index e718168698..9a8b11cd8f 100644 --- a/ui/app/(prowler)/_overview/risk-severity/_components/risk-severity-chart.tsx +++ b/ui/app/(prowler)/_overview/risk-severity/_components/risk-severity-chart.tsx @@ -5,7 +5,6 @@ import { useRouter, useSearchParams } from "next/navigation"; import { HorizontalBarChart } from "@/components/graphs/horizontal-bar-chart"; import { BarDataPoint } from "@/components/graphs/types"; import { Card, CardContent, CardHeader, CardTitle } from "@/components/shadcn"; -import { mapProviderFiltersForFindings } from "@/lib/provider-helpers"; import { calculatePercentage } from "@/lib/utils"; import { SEVERITY_FILTER_MAP } from "@/types/severities"; @@ -31,8 +30,6 @@ export const RiskSeverityChart = ({ // Build the URL with current filters plus severity and muted const params = new URLSearchParams(searchParams.toString()); - mapProviderFiltersForFindings(params); - const severity = SEVERITY_FILTER_MAP[dataPoint.name]; if (severity) { params.set("filter[severity__in]", severity); diff --git a/ui/app/(prowler)/_overview/severity-over-time/_components/finding-severity-over-time.tsx b/ui/app/(prowler)/_overview/severity-over-time/_components/finding-severity-over-time.tsx index 3990f52b31..619e8631fd 100644 --- a/ui/app/(prowler)/_overview/severity-over-time/_components/finding-severity-over-time.tsx +++ b/ui/app/(prowler)/_overview/severity-over-time/_components/finding-severity-over-time.tsx @@ -66,7 +66,7 @@ export const FindingSeverityOverTime = ({ params.set("filter[provider_type__in]", providerType); } if (providerId) { - params.set("filter[provider__in]", providerId); + params.set("filter[provider_id__in]", providerId); } router.push(`/findings?${params.toString()}`); diff --git a/ui/app/(prowler)/_overview/status-chart/_components/status-chart.tsx b/ui/app/(prowler)/_overview/status-chart/_components/status-chart.tsx index 4615410d80..8f6540ecb4 100644 --- a/ui/app/(prowler)/_overview/status-chart/_components/status-chart.tsx +++ b/ui/app/(prowler)/_overview/status-chart/_components/status-chart.tsx @@ -13,7 +13,6 @@ import { CardVariant, ResourceStatsCard, } from "@/components/shadcn"; -import { mapProviderFiltersForFindings } from "@/lib/provider-helpers"; import { calculatePercentage } from "@/lib/utils"; interface FindingsData { total: number; @@ -39,8 +38,6 @@ export const StatusChart = ({ // Build the URL with current filters plus status and muted const params = new URLSearchParams(searchParams.toString()); - mapProviderFiltersForFindings(params); - // Add status filter based on which segment was clicked if (dataPoint.name === "Fail Findings") { params.set("filter[status__in]", "FAIL"); diff --git a/ui/app/(prowler)/_overview/watchlist/_components/service-watchlist.tsx b/ui/app/(prowler)/_overview/watchlist/_components/service-watchlist.tsx index 71fc7e2146..b39adfbd2b 100644 --- a/ui/app/(prowler)/_overview/watchlist/_components/service-watchlist.tsx +++ b/ui/app/(prowler)/_overview/watchlist/_components/service-watchlist.tsx @@ -4,7 +4,6 @@ import { useRouter, useSearchParams } from "next/navigation"; import { useState } from "react"; import { ServiceOverview } from "@/actions/overview"; -import { mapProviderFiltersForFindings } from "@/lib/provider-helpers"; import { SortToggleButton } from "./sort-toggle-button"; import { WatchlistCard, WatchlistItem } from "./watchlist-card"; @@ -29,9 +28,6 @@ export const ServiceWatchlist = ({ items }: { items: ServiceOverview[] }) => { const handleItemClick = (item: WatchlistItem) => { const params = new URLSearchParams(searchParams.toString()); - - mapProviderFiltersForFindings(params); - params.set("filter[service__in]", item.key); params.set("filter[status__in]", "FAIL"); router.push(`/findings?${params.toString()}`); diff --git a/ui/app/(prowler)/findings/page.tsx b/ui/app/(prowler)/findings/page.tsx index 7fbb2e47c1..0818356f31 100644 --- a/ui/app/(prowler)/findings/page.tsx +++ b/ui/app/(prowler)/findings/page.tsx @@ -85,6 +85,7 @@ export default async function Findings({ return ( { + const searchParams = useSearchParams(); const { clearAllFilters, hasFilters } = useUrlFilters(); + // Count active filters (excluding search) + const filterCount = Array.from(searchParams.keys()).filter( + (key) => key.startsWith("filter[") && key !== "filter[search]", + ).length; + if (!hasFilters()) { return null; } + const displayText = showCount ? `Clear Filters (${filterCount})` : text; + return ( - ); }; diff --git a/ui/components/filters/custom-date-picker.tsx b/ui/components/filters/custom-date-picker.tsx index ff3a961d12..c2fcc8a432 100644 --- a/ui/components/filters/custom-date-picker.tsx +++ b/ui/components/filters/custom-date-picker.tsx @@ -1,120 +1,93 @@ "use client"; -import { Button, ButtonGroup } from "@heroui/button"; -import { DatePicker } from "@heroui/date-picker"; -import { - getLocalTimeZone, - parseDate, - startOfMonth, - startOfWeek, - today, -} from "@internationalized/date"; -import { useLocale } from "@react-aria/i18n"; -import type { DateValue } from "@react-types/datepicker"; +import { format } from "date-fns"; +import { CalendarIcon, ChevronDown } from "lucide-react"; import { useSearchParams } from "next/navigation"; -import { useEffect, useRef, useState } from "react"; +import { useEffect, useState } from "react"; +import { Calendar } from "@/components/shadcn/calendar"; +import { + Popover, + PopoverContent, + PopoverTrigger, +} from "@/components/shadcn/popover"; import { useUrlFilters } from "@/hooks/use-url-filters"; +import { cn } from "@/lib/utils"; export const CustomDatePicker = () => { const searchParams = useSearchParams(); const { updateFilter } = useUrlFilters(); + const [open, setOpen] = useState(false); - const [value, setValue] = useState(() => { + const [date, setDate] = useState(() => { const dateParam = searchParams.get("filter[inserted_at]"); - if (!dateParam) return null; + if (!dateParam) return undefined; try { - return parseDate(dateParam); + return new Date(dateParam); } catch { - return null; + return undefined; } }); - const { locale } = useLocale(); - - const now = today(getLocalTimeZone()); - const nextWeek = startOfWeek(now.add({ weeks: 1 }), locale); - const nextMonth = startOfMonth(now.add({ months: 1 })); - - const applyDateFilter = (date: DateValue | null) => { - if (date) { - updateFilter("inserted_at", date.toString()); + const applyDateFilter = (selectedDate: Date | undefined) => { + if (selectedDate) { + // Format as YYYY-MM-DD for the API + updateFilter("inserted_at", format(selectedDate, "yyyy-MM-dd")); } else { updateFilter("inserted_at", null); } }; - const initialRender = useRef(true); - + // Sync local state with URL params (e.g., when Clear Filters is clicked) useEffect(() => { - if (initialRender.current) { - initialRender.current = false; - return; - } - const params = new URLSearchParams(searchParams.toString()); - if (params.size === 0) { - setValue(null); + const dateParam = searchParams.get("filter[inserted_at]"); + if (!dateParam) { + setDate(undefined); + } else { + try { + setDate(new Date(dateParam)); + } catch { + setDate(undefined); + } } }, [searchParams]); - const handleDateChange = (newValue: DateValue | null) => { - setValue(newValue); - applyDateFilter(newValue); + const handleDateSelect = (newDate: Date | undefined) => { + setDate(newDate); + applyDateFilter(newDate); + setOpen(false); }; return ( -

- *]:!rounded-lg", - selectorButton: "text-bg-button-secondary shrink-0", - input: - "text-bg-button-secondary placeholder:text-bg-button-secondary text-sm", - innerWrapper: "[&]:!rounded-lg", - inputWrapper: - "!border-border-input-primary !bg-bg-input-primary dark:!bg-input/30 dark:hover:!bg-input/50 hover:!bg-bg-neutral-secondary !border [&]:!rounded-lg !shadow-xs !transition-[color,box-shadow] focus-within:!border-border-input-primary-press focus-within:!ring-1 focus-within:!ring-border-input-primary-press focus-within:!ring-offset-1 !h-10 !px-4 !py-3 !outline-none", - segment: "text-bg-button-secondary", - }} - popoverProps={{ - classNames: { - content: - "border-border-input-primary bg-bg-input-primary border rounded-lg", - }, - }} - CalendarTopContent={ - - - - - - } - calendarProps={{ - focusedValue: value || undefined, - onFocusChange: setValue, - nextButtonProps: { - variant: "bordered", - }, - prevButtonProps: { - variant: "bordered", - }, - }} - value={value} - onChange={handleDateChange} - /> -
+ + + + + + + + ); }; diff --git a/ui/components/filters/data-filters.ts b/ui/components/filters/data-filters.ts index 5464b09559..0baf89a3df 100644 --- a/ui/components/filters/data-filters.ts +++ b/ui/components/filters/data-filters.ts @@ -75,13 +75,6 @@ export const filterFindings = [ values: ["PASS", "FAIL", "MANUAL"], index: 1, }, - { - key: FilterType.PROVIDER_TYPE, - labelCheckboxGroup: "Cloud Provider", - values: [...PROVIDER_TYPES], - valueLabelMapping: PROVIDER_TYPE_MAPPING, - index: 5, - }, { key: FilterType.DELTA, labelCheckboxGroup: "Delta", diff --git a/ui/components/filters/filter-controls.tsx b/ui/components/filters/filter-controls.tsx index fa149fbcec..5099f05a2a 100644 --- a/ui/components/filters/filter-controls.tsx +++ b/ui/components/filters/filter-controls.tsx @@ -1,7 +1,6 @@ "use client"; import { Spacer } from "@heroui/spacer"; -import React from "react"; import { FilterOption } from "@/types"; @@ -23,7 +22,7 @@ export interface FilterControlsProps { customFilters?: FilterOption[]; } -export const FilterControls: React.FC = ({ +export const FilterControls = ({ search = false, providers = false, date = false, @@ -31,7 +30,7 @@ export const FilterControls: React.FC = ({ accounts = false, mutedFindings = false, customFilters, -}) => { +}: FilterControlsProps) => { return (
@@ -44,8 +43,12 @@ export const FilterControls: React.FC = ({ {mutedFindings && }
- - {customFilters && } + {customFilters && customFilters.length > 0 && ( + <> + + + + )}
); }; diff --git a/ui/components/findings/findings-filters.tsx b/ui/components/findings/findings-filters.tsx index 8bf51da877..571a976086 100644 --- a/ui/components/findings/findings-filters.tsx +++ b/ui/components/findings/findings-filters.tsx @@ -1,12 +1,25 @@ "use client"; +import { ChevronDown } from "lucide-react"; +import { useState } from "react"; + +import { AccountsSelector } from "@/app/(prowler)/_overview/_components/accounts-selector"; +import { ProviderTypeSelector } from "@/app/(prowler)/_overview/_components/provider-type-selector"; +import { ClearFiltersButton } from "@/components/filters/clear-filters-button"; +import { CustomCheckboxMutedFindings } from "@/components/filters/custom-checkbox-muted-findings"; +import { CustomDatePicker } from "@/components/filters/custom-date-picker"; import { filterFindings } from "@/components/filters/data-filters"; -import { FilterControls } from "@/components/filters/filter-controls"; +import { Button } from "@/components/shadcn"; +import { ExpandableSection } from "@/components/ui/expandable-section"; +import { DataTableFilterCustom } from "@/components/ui/table"; import { useRelatedFilters } from "@/hooks"; import { getCategoryLabel } from "@/lib/categories"; import { FilterEntity, FilterType, ScanEntity, ScanProps } from "@/types"; +import { ProviderProps } from "@/types/providers"; interface FindingsFiltersProps { + /** Provider data for ProviderTypeSelector and AccountsSelector */ + providers: ProviderProps[]; providerIds: string[]; providerDetails: { [id: string]: FilterEntity }[]; completedScans: ScanProps[]; @@ -19,6 +32,7 @@ interface FindingsFiltersProps { } export const FindingsFilters = ({ + providers, providerIds, providerDetails, completedScanIds, @@ -28,7 +42,9 @@ export const FindingsFilters = ({ uniqueResourceTypes, uniqueCategories, }: FindingsFiltersProps) => { - const { availableProviderIds, availableScans } = useRelatedFilters({ + const [isExpanded, setIsExpanded] = useState(false); + + const { availableScans } = useRelatedFilters({ providerIds, providerDetails, completedScanIds, @@ -36,55 +52,81 @@ export const FindingsFilters = ({ enableScanRelation: true, }); + // Custom filters for the expandable section (removed Provider - now using AccountsSelector) + const customFilters = [ + ...filterFindings, + { + key: FilterType.REGION, + labelCheckboxGroup: "Regions", + values: uniqueRegions, + index: 3, + }, + { + key: FilterType.SERVICE, + labelCheckboxGroup: "Services", + values: uniqueServices, + index: 4, + }, + { + key: FilterType.RESOURCE_TYPE, + labelCheckboxGroup: "Resource Type", + values: uniqueResourceTypes, + index: 8, + }, + { + key: FilterType.CATEGORY, + labelCheckboxGroup: "Category", + values: uniqueCategories, + labelFormatter: getCategoryLabel, + index: 5, + }, + { + key: FilterType.SCAN, + labelCheckboxGroup: "Scan ID", + values: availableScans, + valueLabelMapping: scanDetails, + index: 7, + }, + ]; + + const hasCustomFilters = customFilters.length > 0; + return ( - <> - - +
+ {/* First row: Provider selectors + Muted checkbox + More Filters button + Clear Filters */} +
+
+ +
+
+ +
+ + {hasCustomFilters && ( + + )} + +
+ + {/* Expandable filters section */} + {hasCustomFilters && ( + + } + hideClearButton + /> + + )} +
); }; diff --git a/ui/components/findings/table/column-findings.tsx b/ui/components/findings/table/column-findings.tsx index f2cbbbd074..dca9087745 100644 --- a/ui/components/findings/table/column-findings.tsx +++ b/ui/components/findings/table/column-findings.tsx @@ -2,25 +2,14 @@ import { ColumnDef, RowSelectionState } from "@tanstack/react-table"; import { Database } from "lucide-react"; -import Link from "next/link"; import { useSearchParams } from "next/navigation"; -import { DataTableRowDetails } from "@/components/findings/table"; -import { DataTableRowActions } from "@/components/findings/table/data-table-row-actions"; -import { InfoIcon, MutedIcon } from "@/components/icons"; import { - Checkbox, - Tooltip, - TooltipContent, - TooltipProvider, - TooltipTrigger, -} from "@/components/shadcn"; -import { - DateWithTime, - EntityInfo, - SnippetChip, -} from "@/components/ui/entities"; -import { TriggerSheet } from "@/components/ui/sheet"; + DataTableRowActions, + FindingDetail, +} from "@/components/findings/table"; +import { Checkbox } from "@/components/shadcn"; +import { DateWithTime, SnippetChip } from "@/components/ui/entities"; import { DataTableColumnHeader, SeverityBadge, @@ -28,7 +17,10 @@ import { } from "@/components/ui/table"; import { FindingProps, ProviderType } from "@/types"; -import { DeltaIndicator } from "./delta-indicator"; +// TODO: PROWLER-379 - Enable ImpactedResourcesCell when backend supports grouped findings +// import { ImpactedResourcesCell } from "./impacted-resources-cell"; +import { DeltaValues, NotificationIndicator } from "./notification-indicator"; +import { ProviderIconCell } from "./provider-icon-cell"; const getFindingsData = (row: { original: FindingProps }) => { return row.original; @@ -58,10 +50,12 @@ const getProviderData = ( ); }; -const FindingDetailsCell = ({ row }: { row: any }) => { +// Component for finding title that opens the detail drawer +const FindingTitleCell = ({ row }: { row: { original: FindingProps } }) => { const searchParams = useSearchParams(); const findingId = searchParams.get("id"); const isOpen = findingId === row.original.id; + const { checktitle } = row.original.attributes.check_metadata; const handleOpenChange = (open: boolean) => { const params = new URLSearchParams(searchParams); @@ -76,22 +70,18 @@ const FindingDetailsCell = ({ row }: { row: any }) => { }; return ( -
- - } - title="Finding Details" - description="View the finding details" - defaultOpen={isOpen} - onOpenChange={handleOpenChange} - > - - -
+ +

+ {checktitle} +

+
+ } + /> ); }; @@ -106,11 +96,35 @@ export function getColumnFindings( selectedCount > 0 && selectedCount === selectableRowCount; const isSomeSelected = selectedCount > 0 && selectedCount < selectableRowCount; + return [ + // Notification column - shows new/changed/muted indicators + { + id: "notification", + header: () => null, + cell: ({ row }) => { + const finding = row.original; + const isMuted = finding.attributes.muted; + const mutedReason = finding.attributes.muted_reason; + const delta = finding.attributes.delta as + | (typeof DeltaValues)[keyof typeof DeltaValues] + | undefined; + + return ( + + ); + }, + enableSorting: false, + enableHiding: false, + }, + // Select column { id: "select", header: ({ table }) => { - // Use state calculated from rowSelection to force re-render const headerChecked = isAllSelected ? true : isSomeSelected @@ -118,14 +132,13 @@ export function getColumnFindings( : false; return ( -
+
table.toggleAllPageRowsSelected(checked === true) } aria-label="Select all" - // Disable when no rows are selectable (all muted) disabled={selectableRowCount === 0} />
@@ -134,46 +147,13 @@ export function getColumnFindings( cell: ({ row }) => { const finding = row.original; const isMuted = finding.attributes.muted; - const mutedReason = finding.attributes.muted_reason; - - // Show muted icon with tooltip for muted findings - if (isMuted) { - const ruleName = mutedReason || "Unknown rule"; - - return ( -
- - - -
- -
- - - - - Mute rule: - - {ruleName} - - - - -
- ); - } - - // Use rowSelection directly instead of row.getIsSelected() - // This ensures re-render when selection state changes const isSelected = !!rowSelection[row.id]; return ( -
+
row.toggleSelected(checked === true) } @@ -185,41 +165,33 @@ export function getColumnFindings( enableSorting: false, enableHiding: false, }, + // Status column { - id: "moreInfo", + accessorKey: "status", header: ({ column }) => ( - + ), - cell: ({ row }) => , - enableSorting: false, + cell: ({ row }) => { + const { + attributes: { status }, + } = getFindingsData(row); + + return ; + }, }, + // Finding column - clickable to open detail sheet { accessorKey: "check", header: ({ column }) => ( ), - cell: ({ row }) => { - const { checktitle } = getFindingsMetadata(row); - const { delta } = row.original.attributes; - - return ( -
-
- {delta === "new" || delta === "changed" ? ( - - ) : null} -

- {checktitle} -

-
-
- ); - }, + cell: ({ row }) => , }, + // Resource name column { accessorKey: "resourceName", header: ({ column }) => ( @@ -238,12 +210,13 @@ export function getColumnFindings( }, enableSorting: false, }, + // Severity column { accessorKey: "severity", header: ({ column }) => ( ), @@ -254,74 +227,20 @@ export function getColumnFindings( return ; }, }, + // Provider column { - accessorKey: "status", + accessorKey: "provider", header: ({ column }) => ( - + ), cell: ({ row }) => { - const { - attributes: { status }, - } = getFindingsData(row); + const provider = getProviderData(row, "provider"); - return ; - }, - }, - { - accessorKey: "updated_at", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const { - attributes: { updated_at }, - } = getFindingsData(row); - return ( -
- -
- ); - }, - }, - // { - // accessorKey: "scanName", - // header: "Scan Name", - // cell: ({ row }) => { - // const name = getScanData(row, "name"); - - // return ( - //

- // {typeof name === "string" || typeof name === "number" - // ? name - // : "Invalid data"} - //

- // ); - // }, - // }, - { - accessorKey: "region", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const region = getResourceData(row, "region"); - - return ( -
- {typeof region === "string" ? region : "Invalid region"} -
- ); + return ; }, enableSorting: false, }, + // Service column { accessorKey: "service", header: ({ column }) => ( @@ -329,40 +248,47 @@ export function getColumnFindings( ), cell: ({ row }) => { const { servicename } = getFindingsMetadata(row); - return

{servicename}

; - }, - enableSorting: false, - }, - { - accessorKey: "cloudProvider", - header: ({ column }) => ( - - ), - cell: ({ row }) => { - const provider = getProviderData(row, "provider"); - const alias = getProviderData(row, "alias"); - const uid = getProviderData(row, "uid"); - return ( - <> - - +

+ {servicename} +

); }, enableSorting: false, }, + // TODO: PROWLER-379 - Enable Impacted Resources column when backend supports grouped findings + // { + // accessorKey: "impactedResources", + // header: ({ column }) => ( + // + // ), + // cell: () => { + // return ; + // }, + // enableSorting: false, + // }, + // Time column { - id: "actions", + accessorKey: "updated_at", header: ({ column }) => ( - + ), cell: ({ row }) => { - return ; + const { + attributes: { updated_at }, + } = getFindingsData(row); + return ; }, + }, + // Actions column - dropdown with Mute/Jira options + { + id: "actions", + header: () =>
, + cell: ({ row }) => , enableSorting: false, }, ]; diff --git a/ui/components/findings/table/data-table-row-actions.tsx b/ui/components/findings/table/data-table-row-actions.tsx index 585a4098d0..e465930413 100644 --- a/ui/components/findings/table/data-table-row-actions.tsx +++ b/ui/components/findings/table/data-table-row-actions.tsx @@ -16,7 +16,6 @@ import { MuteFindingsModal } from "@/components/findings/mute-findings-modal"; import { SendToJiraModal } from "@/components/findings/send-to-jira-modal"; import { VerticalDotsIcon } from "@/components/icons"; import { JiraIcon } from "@/components/icons/services/IconServices"; -import { Button } from "@/components/shadcn"; import type { FindingProps } from "@/types/components"; import { FindingsSelectionContext } from "./findings-selection-context"; @@ -92,22 +91,16 @@ export function DataTableRowActions({ row }: DataTableRowActionsProps) { onComplete={handleMuteComplete} /> -
+
- - + + { asChild > diff --git a/ui/components/findings/table/finding-detail.tsx b/ui/components/findings/table/finding-detail.tsx index 28a72fbe8c..62a2b17c37 100644 --- a/ui/components/findings/table/finding-detail.tsx +++ b/ui/components/findings/table/finding-detail.tsx @@ -1,22 +1,37 @@ "use client"; import { Snippet } from "@heroui/snippet"; -import { Tooltip } from "@heroui/tooltip"; -import { ExternalLink, Link } from "lucide-react"; +import { ExternalLink, Link, X } from "lucide-react"; +import { usePathname, useSearchParams } from "next/navigation"; +import type { ReactNode } from "react"; import ReactMarkdown from "react-markdown"; import { - Card, - CardAction, - CardContent, - CardHeader, - CardTitle, + Drawer, + DrawerClose, + DrawerContent, + DrawerDescription, + DrawerHeader, + DrawerTitle, + DrawerTrigger, + InfoField, + Tabs, + TabsContent, + TabsList, + TabsTrigger, + Tooltip, + TooltipContent, + TooltipTrigger, } from "@/components/shadcn"; import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet"; import { CustomLink } from "@/components/ui/custom/custom-link"; -import { EntityInfo, InfoField } from "@/components/ui/entities"; +import { EntityInfo } from "@/components/ui/entities"; import { DateWithTime } from "@/components/ui/entities/date-with-time"; import { SeverityBadge } from "@/components/ui/table/severity-badge"; +import { + FindingStatus, + StatusFindingBadge, +} from "@/components/ui/table/status-finding-badge"; import { buildGitFileUrl, extractLineRangeFromUid } from "@/lib/iac-utils"; import { FindingProps, ProviderType } from "@/types"; @@ -50,20 +65,35 @@ const formatDuration = (seconds: number) => { return parts.join(" "); }; +interface FindingDetailProps { + findingDetails: FindingProps; + trigger?: ReactNode; + open?: boolean; + defaultOpen?: boolean; + onOpenChange?: (open: boolean) => void; +} + export const FindingDetail = ({ findingDetails, -}: { - findingDetails: FindingProps; -}) => { + trigger, + open, + defaultOpen = false, + onOpenChange, +}: FindingDetailProps) => { const finding = findingDetails; const attributes = finding.attributes; const resource = finding.relationships.resource.attributes; const scan = finding.relationships.scan.attributes; const providerDetails = finding.relationships.provider.attributes; - const currentUrl = new URL(window.location.href); - const params = new URLSearchParams(currentUrl.search); - params.set("id", findingDetails.id); - const url = `${window.location.origin}${currentUrl.pathname}?${params.toString()}`; + const pathname = usePathname(); + const searchParams = useSearchParams(); + + const copyFindingUrl = () => { + const params = new URLSearchParams(searchParams.toString()); + params.set("id", findingDetails.id); + const url = `${window.location.origin}${pathname}?${params.toString()}`; + navigator.clipboard.writeText(url); + }; // Build Git URL for IaC findings const gitUrl = @@ -76,49 +106,65 @@ export const FindingDetail = ({ ) : null; - return ( -
+ const content = ( +
{/* Header */} -
-
-

- {renderValue(attributes.check_metadata.checktitle)} - - - -

-
-
+
+ {/* Row 1: Status badges */} +
+ + + {attributes.delta && ( +
+ + + {attributes.delta} + +
+ )}
+ + {/* Row 2: Title with copy link */} +

+ {renderValue(attributes.check_metadata.checktitle)} + + + + + Copy finding link to clipboard + +

+ + {/* Row 3: First Seen */} +
+ +
- {/* Check Metadata */} - - - Finding Details -
- {renderValue(attributes.status)} -
- - + {/* Tabs */} + + + General + Resources + Scans + + +

+ Here is an overview of this finding: +

+ + {/* General Tab */} +
{resource.region} - - +
+ +
+ + - {attributes.delta && ( - -
- - {attributes.delta} -
- - )} - - + + + + +
- - - - - - - - - - - - {attributes.status === "FAIL" && ( @@ -189,7 +217,7 @@ export const FindingDetail = ({ {attributes.check_metadata.remediation && (
-

+

Remediation Details

@@ -267,30 +295,32 @@ export const FindingDetail = ({ {attributes.check_metadata.categories?.join(", ") || "none"} - - + - {/* Resource Details */} - - - Resource Details + {/* Resources Tab */} + {providerDetails.provider === "iac" && gitUrl && ( - - - - - +
+ + + + + View in Repository + + + + Go to Resource in the Repository + - +
)} - - +
{renderValue(resource.name)} @@ -316,9 +346,13 @@ export const FindingDetail = ({
+ + + + {resource.tags && Object.entries(resource.tags).length > 0 && (
-

+

Tags

@@ -339,15 +373,10 @@ export const FindingDetail = ({
- - + - {/* Add new Scan Details section */} - - - Scan Details - - + {/* Scans Tab */} +
{scan.name || "N/A"} @@ -383,8 +412,36 @@ export const FindingDetail = ({ )}
- - + +
); + + // If no trigger, render content directly (inline mode) + if (!trigger) { + return content; + } + + // With trigger, wrap in Drawer + return ( + + {trigger} + + + Finding Details + View the finding details + + + + Close + + {content} + + + ); }; diff --git a/ui/components/findings/table/findings-table-with-selection.tsx b/ui/components/findings/table/findings-table-with-selection.tsx index 0f3f5a9225..c3720758c9 100644 --- a/ui/components/findings/table/findings-table-with-selection.tsx +++ b/ui/components/findings/table/findings-table-with-selection.tsx @@ -97,6 +97,7 @@ export function FindingsTableWithSelection({ rowSelection={rowSelection} onRowSelectionChange={setRowSelection} getRowCanSelect={getRowCanSelect} + showSearch /> {selectedFindingIds.length > 0 && ( diff --git a/ui/components/findings/table/impacted-resources-cell.tsx b/ui/components/findings/table/impacted-resources-cell.tsx new file mode 100644 index 0000000000..8ad9ccd530 --- /dev/null +++ b/ui/components/findings/table/impacted-resources-cell.tsx @@ -0,0 +1,84 @@ +import { Check, Flag } from "lucide-react"; + +import { cn } from "@/lib/utils"; + +export const TriageStatusValues = { + IN_PROGRESS: "in_progress", + RESOLVED: "resolved", + NONE: "none", +} as const; + +export type TriageStatus = + (typeof TriageStatusValues)[keyof typeof TriageStatusValues]; + +interface TriageBadgeProps { + status: TriageStatus; + count: number; +} + +const TriageBadge = ({ status, count }: TriageBadgeProps) => { + if (status === TriageStatusValues.NONE) { + return null; + } + + const isInProgress = status === TriageStatusValues.IN_PROGRESS; + + return ( + + {isInProgress ? ( + + ) : ( + + )} + {count} + + {isInProgress ? "In-progress" : "Resolved"} + + + ); +}; + +interface ImpactedResourcesCellProps { + impacted: number; + total: number; + inProgress?: number; + resolved?: number; +} + +export const ImpactedResourcesCell = ({ + impacted, + total, + inProgress = 0, + resolved = 0, +}: ImpactedResourcesCellProps) => { + return ( +
+ + {impacted} + of + {total} + + + {inProgress > 0 && ( + + )} + + {resolved > 0 && ( + + )} +
+ ); +}; diff --git a/ui/components/findings/table/index.ts b/ui/components/findings/table/index.ts index de8098d501..e0c203e9e1 100644 --- a/ui/components/findings/table/index.ts +++ b/ui/components/findings/table/index.ts @@ -4,4 +4,8 @@ export * from "./data-table-row-details"; export * from "./finding-detail"; export * from "./findings-selection-context"; export * from "./findings-table-with-selection"; +// TODO: PROWLER-379 - Re-export when backend supports grouped findings +// export * from "./impacted-resources-cell"; +export * from "./notification-indicator"; +export * from "./provider-icon-cell"; export * from "./skeleton-table-findings"; diff --git a/ui/components/findings/table/notification-indicator.tsx b/ui/components/findings/table/notification-indicator.tsx new file mode 100644 index 0000000000..4e040a784d --- /dev/null +++ b/ui/components/findings/table/notification-indicator.tsx @@ -0,0 +1,100 @@ +import Link from "next/link"; + +import { MutedIcon } from "@/components/icons"; +import { Button } from "@/components/shadcn"; +import { + Tooltip, + TooltipContent, + TooltipTrigger, +} from "@/components/shadcn/tooltip"; +import { DOCS_URLS } from "@/lib/external-urls"; +import { cn } from "@/lib/utils"; + +export const DeltaValues = { + NEW: "new", + CHANGED: "changed", + NONE: "none", +} as const; + +export type DeltaType = (typeof DeltaValues)[keyof typeof DeltaValues]; + +interface NotificationIndicatorProps { + delta?: DeltaType; + isMuted?: boolean; + mutedReason?: string; +} + +export const NotificationIndicator = ({ + delta, + isMuted = false, + mutedReason, +}: NotificationIndicatorProps) => { + // Muted takes precedence over delta + if (isMuted) { + const ruleName = mutedReason || "Unknown rule"; + + return ( + + +
+ +
+ + + + Mute rule: + {ruleName} + + + + ); + } + + // Show dot with tooltip for new or changed findings + if (delta === DeltaValues.NEW || delta === DeltaValues.CHANGED) { + return ( + + +
+ + +
+ + {delta === DeltaValues.NEW + ? "New finding." + : "Status changed since the previous scan."} + + +
+ + + ); + } + + // No indicator - return minimal width placeholder + return
; +}; diff --git a/ui/components/findings/table/provider-icon-cell.tsx b/ui/components/findings/table/provider-icon-cell.tsx new file mode 100644 index 0000000000..c99d833cbc --- /dev/null +++ b/ui/components/findings/table/provider-icon-cell.tsx @@ -0,0 +1,52 @@ +import { + AlibabaCloudProviderBadge, + AWSProviderBadge, + AzureProviderBadge, + GCPProviderBadge, + GitHubProviderBadge, + IacProviderBadge, + KS8ProviderBadge, + M365ProviderBadge, + MongoDBAtlasProviderBadge, + OracleCloudProviderBadge, +} from "@/components/icons/providers-badge"; +import { ProviderType } from "@/types"; + +const PROVIDER_ICONS = { + aws: AWSProviderBadge, + azure: AzureProviderBadge, + gcp: GCPProviderBadge, + kubernetes: KS8ProviderBadge, + m365: M365ProviderBadge, + github: GitHubProviderBadge, + iac: IacProviderBadge, + oraclecloud: OracleCloudProviderBadge, + mongodbatlas: MongoDBAtlasProviderBadge, + alibabacloud: AlibabaCloudProviderBadge, +} as const; + +interface ProviderIconCellProps { + provider: ProviderType; + size?: number; +} + +export const ProviderIconCell = ({ + provider, + size = 26, +}: ProviderIconCellProps) => { + const IconComponent = PROVIDER_ICONS[provider]; + + if (!IconComponent) { + return ( +
+ ? +
+ ); + } + + return ( +
+ +
+ ); +}; diff --git a/ui/components/findings/table/skeleton-table-findings.tsx b/ui/components/findings/table/skeleton-table-findings.tsx index 4436f22f60..d7eccad760 100644 --- a/ui/components/findings/table/skeleton-table-findings.tsx +++ b/ui/components/findings/table/skeleton-table-findings.tsx @@ -1,39 +1,147 @@ -import React from "react"; - -import { Card } from "@/components/shadcn/card/card"; import { Skeleton } from "@/components/shadcn/skeleton/skeleton"; -export const SkeletonTableFindings = () => { - const columns = 7; - const rows = 4; - +const SkeletonTableRow = () => { return ( - - {/* Table headers */} -
- {Array.from({ length: columns }).map((_, index) => ( - - ))} -
- - {/* Table body */} -
- {Array.from({ length: rows }).map((_, rowIndex) => ( -
- {Array.from({ length: columns }).map((_, colIndex) => ( - - ))} -
- ))} -
- + + {/* Notification dot */} + +
+ +
+ + {/* Checkbox */} + +
+ + {/* Status */} + + + + {/* Finding - multiline text */} + +
+ + +
+ + {/* Resource name chip */} + +
+ + + +
+ + {/* Severity */} + +
+ + +
+ + {/* Provider icon */} + + + + {/* Service */} + + + + {/* Time */} + +
+ + +
+ + {/* Actions */} + + + + + ); +}; + +export const SkeletonTableFindings = () => { + const rows = 10; + + return ( +
+ {/* Toolbar: Search + Total entries */} +
+ {/* Search icon button */} + + {/* Total entries */} + +
+ + {/* Table */} + + + + {/* Notification - empty header */} + + {/* Status */} + + {/* Finding */} + + {/* Resource name */} + + {/* Severity */} + + {/* Provider */} + + {/* Service */} + + {/* Time */} + + {/* Actions - empty header */} + + + + {Array.from({ length: rows }).map((_, i) => ( + + ))} + +
+ {/* Checkbox */} + +
+
+ + + + + + + + + + + + + + +
+ + {/* Pagination */} +
+ {/* Rows per page */} +
+ + +
+ {/* Page info + navigation */} +
+ +
+ + + + +
+
+
+
); }; diff --git a/ui/components/graphs/sankey-chart.tsx b/ui/components/graphs/sankey-chart.tsx index a562f6a823..fe7708e7a1 100644 --- a/ui/components/graphs/sankey-chart.tsx +++ b/ui/components/graphs/sankey-chart.tsx @@ -7,7 +7,6 @@ import { Rectangle, ResponsiveContainer, Sankey, Tooltip } from "recharts"; import { PROVIDER_ICONS } from "@/components/icons/providers-badge"; import { initializeChartColors } from "@/lib/charts/colors"; -import { mapProviderFiltersForFindings } from "@/lib/provider-helpers"; import { PROVIDER_DISPLAY_NAMES } from "@/types/providers"; import { SEVERITY_FILTER_MAP } from "@/types/severities"; @@ -463,9 +462,6 @@ export function SankeyChart({ const severityFilter = SEVERITY_FILTER_MAP[nodeName]; if (severityFilter) { const params = new URLSearchParams(searchParams.toString()); - - mapProviderFiltersForFindings(params); - params.set("filter[severity__in]", severityFilter); params.set("filter[status__in]", "FAIL"); params.set("filter[muted]", "false"); @@ -480,12 +476,10 @@ export function SankeyChart({ if (severityFilter) { const params = new URLSearchParams(searchParams.toString()); - mapProviderFiltersForFindings(params); - // Always set provider_type filter based on the clicked link's source (provider) // This ensures clicking "AWS → High" filters by AWS even when no global filter is set - const hasProviderIdFilter = searchParams.has("filter[provider_id__in]"); - if (providerType && !hasProviderIdFilter) { + const hasProviderFilter = searchParams.has("filter[provider_id__in]"); + if (providerType && !hasProviderFilter) { params.set("filter[provider_type__in]", providerType); } diff --git a/ui/components/graphs/threat-map.tsx b/ui/components/graphs/threat-map.tsx index f103ef35c2..498a2bf5c3 100644 --- a/ui/components/graphs/threat-map.tsx +++ b/ui/components/graphs/threat-map.tsx @@ -12,7 +12,6 @@ import { useRouter, useSearchParams } from "next/navigation"; import { useEffect, useRef, useState } from "react"; import { Card } from "@/components/shadcn/card/card"; -import { mapProviderFiltersForFindings } from "@/lib/provider-helpers"; import { HorizontalBarChart } from "./horizontal-bar-chart"; import { @@ -399,7 +398,6 @@ export function ThreatMap({ providerType?: string, ) => { const params = new URLSearchParams(searchParams.toString()); - mapProviderFiltersForFindings(params); if (providerType) params.set("filter[provider_type__in]", providerType); params.set("filter[region__in]", regionCode); params.set("filter[status__in]", status); diff --git a/ui/components/shadcn/calendar.tsx b/ui/components/shadcn/calendar.tsx new file mode 100644 index 0000000000..07634a8d4a --- /dev/null +++ b/ui/components/shadcn/calendar.tsx @@ -0,0 +1,75 @@ +"use client"; + +import { ChevronLeft, ChevronRight } from "lucide-react"; +import { DayPicker } from "react-day-picker"; + +import { buttonVariants } from "@/components/shadcn/button/button"; +import { cn } from "@/lib/utils"; + +export type CalendarProps = React.ComponentProps; + +function Calendar({ + className, + classNames, + showOutsideDays = true, + ...props +}: CalendarProps) { + return ( + .day-range-end)]:rounded-r-full [&:has(>.day-range-start)]:rounded-l-full first:[&:has([aria-selected])]:rounded-l-full last:[&:has([aria-selected])]:rounded-r-full" + : "[&:has([aria-selected])]:rounded-full", + ), + day_button: cn( + buttonVariants({ variant: "ghost" }), + "size-8 p-0 font-normal rounded-full aria-selected:opacity-100", + ), + range_start: "day-range-start rounded-l-full", + range_end: "day-range-end rounded-r-full", + selected: + "rounded-full bg-button-primary text-zinc-950 hover:bg-button-primary hover:text-zinc-950 focus:bg-button-primary focus:text-zinc-950", + today: "bg-bg-neutral-tertiary text-text-neutral-primary rounded-full", + outside: + "day-outside text-muted-foreground aria-selected:bg-accent/50 aria-selected:text-muted-foreground", + disabled: "text-muted-foreground opacity-50", + range_middle: + "aria-selected:bg-accent aria-selected:text-accent-foreground", + hidden: "invisible", + ...classNames, + }} + components={{ + Chevron: ({ orientation }) => { + const Icon = orientation === "left" ? ChevronLeft : ChevronRight; + return ; + }, + }} + {...props} + /> + ); +} +Calendar.displayName = "Calendar"; + +export { Calendar }; diff --git a/ui/components/shadcn/checkbox/checkbox.tsx b/ui/components/shadcn/checkbox/checkbox.tsx index 93977e2026..43da49eb3e 100644 --- a/ui/components/shadcn/checkbox/checkbox.tsx +++ b/ui/components/shadcn/checkbox/checkbox.tsx @@ -13,7 +13,16 @@ function Checkbox({ - + ); diff --git a/ui/components/shadcn/drawer.tsx b/ui/components/shadcn/drawer.tsx new file mode 100644 index 0000000000..239ff1592f --- /dev/null +++ b/ui/components/shadcn/drawer.tsx @@ -0,0 +1,133 @@ +"use client"; + +import type { ComponentProps } from "react"; +import { Drawer as DrawerPrimitive } from "vaul"; + +import { cn } from "@/lib/utils"; + +function Drawer({ ...props }: ComponentProps) { + return ; +} + +function DrawerTrigger({ + ...props +}: ComponentProps) { + return ; +} + +function DrawerPortal({ + ...props +}: ComponentProps) { + return ; +} + +function DrawerClose({ + ...props +}: ComponentProps) { + return ; +} + +function DrawerOverlay({ + className, + ...props +}: ComponentProps) { + return ( + + ); +} + +function DrawerContent({ + className, + children, + ...props +}: ComponentProps) { + return ( + + + +
+ {children} + + + ); +} + +function DrawerHeader({ className, ...props }: ComponentProps<"div">) { + return ( +
+ ); +} + +function DrawerFooter({ className, ...props }: ComponentProps<"div">) { + return ( +
+ ); +} + +function DrawerTitle({ + className, + ...props +}: ComponentProps) { + return ( + + ); +} + +function DrawerDescription({ + className, + ...props +}: ComponentProps) { + return ( + + ); +} + +export { + Drawer, + DrawerClose, + DrawerContent, + DrawerDescription, + DrawerFooter, + DrawerHeader, + DrawerOverlay, + DrawerPortal, + DrawerTitle, + DrawerTrigger, +}; diff --git a/ui/components/shadcn/index.ts b/ui/components/shadcn/index.ts index 88ff8d80ac..fdafd282b9 100644 --- a/ui/components/shadcn/index.ts +++ b/ui/components/shadcn/index.ts @@ -7,7 +7,9 @@ export * from "./card/resource-stats-card/resource-stats-card-content"; export * from "./card/resource-stats-card/resource-stats-card-header"; export * from "./checkbox/checkbox"; export * from "./combobox"; +export * from "./drawer"; export * from "./dropdown/dropdown"; +export * from "./info-field"; export * from "./input/input"; export * from "./search-input/search-input"; export * from "./select/multiselect"; diff --git a/ui/components/shadcn/info-field/index.ts b/ui/components/shadcn/info-field/index.ts new file mode 100644 index 0000000000..83097f6852 --- /dev/null +++ b/ui/components/shadcn/info-field/index.ts @@ -0,0 +1 @@ +export * from "./info-field"; diff --git a/ui/components/shadcn/info-field/info-field.tsx b/ui/components/shadcn/info-field/info-field.tsx new file mode 100644 index 0000000000..2f45957e99 --- /dev/null +++ b/ui/components/shadcn/info-field/info-field.tsx @@ -0,0 +1,83 @@ +"use client"; + +import { InfoIcon } from "lucide-react"; +import type { ReactNode } from "react"; + +import { cn } from "@/lib/utils"; + +import { Tooltip, TooltipContent, TooltipTrigger } from "../tooltip"; + +const INFO_FIELD_VARIANTS = { + default: "default", + simple: "simple", + transparent: "transparent", +} as const; + +type InfoFieldVariant = + (typeof INFO_FIELD_VARIANTS)[keyof typeof INFO_FIELD_VARIANTS]; + +interface InfoFieldProps { + label: string; + children: ReactNode; + variant?: InfoFieldVariant; + className?: string; + tooltipContent?: string; + inline?: boolean; +} + +export function InfoField({ + label, + children, + variant = "default", + tooltipContent, + className, + inline = false, +}: InfoFieldProps) { + const labelContent = ( + + {label} + {inline && ":"} + {tooltipContent && ( + + + + + + + {tooltipContent} + + )} + + ); + + if (inline) { + return ( +
+ + {labelContent} + +
{children}
+
+ ); + } + + return ( +
+ + {labelContent} + + + {variant === "simple" ? ( +
+ {children} +
+ ) : variant === "transparent" ? ( +
{children}
+ ) : ( +
+ {children} +
+ )} +
+ ); +} diff --git a/ui/components/shadcn/select/select.tsx b/ui/components/shadcn/select/select.tsx index 8c2b12d283..06b41e90fa 100644 --- a/ui/components/shadcn/select/select.tsx +++ b/ui/components/shadcn/select/select.tsx @@ -46,10 +46,12 @@ function SelectValue({ function SelectTrigger({ className, size = "default", + iconSize = "default", children, ...props }: ComponentProps & { size?: "sm" | "default"; + iconSize?: "sm" | "default"; }) { return (