From b6328e637a90581daa99faa7536f0b192c3593c0 Mon Sep 17 00:00:00 2001 From: Flynn Date: Mon, 2 Dec 2024 15:56:02 -0500 Subject: [PATCH 01/20] This was not written in May of 2024. :) (#1888) Signed-off-by: Flynn --- linkerd.io/content/blog/2019/0524-smi/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linkerd.io/content/blog/2019/0524-smi/index.md b/linkerd.io/content/blog/2019/0524-smi/index.md index 15b9b19218..25c687416e 100644 --- a/linkerd.io/content/blog/2019/0524-smi/index.md +++ b/linkerd.io/content/blog/2019/0524-smi/index.md @@ -1,5 +1,5 @@ --- -date: 2024-05-24T00:00:00Z +date: 2019-05-24T00:00:00Z title: Linkerd and SMI keywords: [community, linkerd] params: From 4b307815c27b32f9dd6ede54f849a62f2b31df02 Mon Sep 17 00:00:00 2001 From: Flynn Date: Mon, 2 Dec 2024 23:12:47 -0500 Subject: [PATCH 02/20] Chris Campbell's Tilt, Linkerd, and NGINX blog, part 1 (#1889) * Chris Campbell's Tilt, Linkerd, and NGINX blog, part 1 Signed-off-by: Flynn * Review feedback + featured post Signed-off-by: Flynn --------- Signed-off-by: Flynn --- linkerd.io/assets/authors/chris-campbell.png | Bin 0 -> 30170 bytes .../1202-tilt-linkerd-nginx-part-1/cover.png | Bin 0 -> 267256 bytes .../1202-tilt-linkerd-nginx-part-1/index.md | 278 ++++++++++++++++++ .../1202-tilt-linkerd-nginx-part-1/social.png | Bin 0 -> 831008 bytes .../thumbnail.png | Bin 0 -> 72437 bytes linkerd.io/content/blog/_index.md | 2 +- linkerd.io/data/authors.yaml | 4 + 7 files changed, 283 insertions(+), 1 deletion(-) create mode 100644 linkerd.io/assets/authors/chris-campbell.png create mode 100644 linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/cover.png create mode 100644 linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/index.md create mode 100644 linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/social.png create mode 100644 linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/thumbnail.png diff --git a/linkerd.io/assets/authors/chris-campbell.png b/linkerd.io/assets/authors/chris-campbell.png new file mode 100644 index 0000000000000000000000000000000000000000..30382c13e18a31b17571dea36ec027dc0d4c896a GIT binary patch literal 30170 zcmV(>K-j;DP)hJ{m1qlz!$I5lg?B1P!Kg)PzBpE(WgCJBVSAWOPln)X|bCV#a z1i^%*oVa3AV;#lHz_?-}t3og<2vIri#qqf$NiuhAT)Bse5MltG{+^$ja1Ip4OnB)q zK_=X}4yHtzPQ2r3qaW|oe_4@jL!bKdZkh;pmhwFrUG~tQ$_9F;tYAb$r!V|rVuv*TV@aWX! z>4S-X&ubC!@11^-FaS27<@?dh=T*T7LQuVra-wZAoD0to&j>-dmdpL*@qL~rFEt4T zWsH?wtEYJWnoP5?jRRK=r30@dO1&0{O;Cb%ifk3faaI{iPDU$Tq%S_$KMNx1flktl7h*Fl4W`Ew<-5X=TO(Z^TQn3y>qcpSRyZZ`jil$ls6eB z(9DDQ-%o3R>hIN+suz#FM&bo2d6YUVugI^Y+3yEo3TKEb0wAZZXOmkB)a>e;H9t|5 z>wT2!lY^CdljVw4t{Q{`JcY`3Q@oW@Psn&UmPWk^>&BHc=EYQvPR3IRM<(@p4U-(H z%8mVm*=<2JXH%)w>VATqnp)?DSiHdUJx*Ng)xDduS*F2C6Q$1`#ysYAqryA}vrrw& z8I7YtWFNRh3JpL(&<|BGsJn8VywnEJB+sU$w87z~!cER=kYZJ<4b5BRc>Pg#vb=fq`Yqy!ebPbXKLa*peEKt2Y|{J`-J~G%-0eP2@FzbGD*&B7=sA zN{kUEdS-0=vnO8A!UWr52|%#a4)b$W0#efsc3uCDGn3$Q|6VayF#x1$1q^2~d8dV; zdZR%l&8l-hS&{otvob%y!8EA}aaGjsPJM6QB$VfhyjjTg{zp*jJ3Gg6_wEz9dGoFu zAB_Qk>r~iS4VYX^-f%F)@tACAiQ|*8v|4qq)e`CU2N;t?C$C-uZh*-cPjVSRlk_?8 zH;?80+rQLjZ$e9~uP)2#`m$WU1kG`76GGCUvC#X=rkTeuE-1)i)mP12Rh!KJT@?~n z@q%>nVn2~_X*Pm3sS1gjEBu{#j1dGZkIh(8Q>jVEdD6rSL%4ynCNkWpT_{qOZuU3w z59$h`h=OYu&3g#ZEC3XbO*o;kt?#^$;Gj{YQ2%!RaE)0rlI0V*dH12b@v9rMw>{8F zo;m}ISw2t|OsQXATa#`!P*aiC5=`cT3I$j76f1>p;qp>P4i1mxq&w1Q)TfN?kxqI8 zX}6kkbkdhGR{hPpCs?JorQNK_GgmLlr(V1upM3E-40sK~)Wo?n1#1+(D$ouKu8M7{ zi$sOM*(ho|QJPHvtXsJs90p*(rCC)ch& zkmKG&4vr@>7>)G2#6KOV@y(4jXoM3vfq5Wq;Hu9#=r9%2;ZzQLJsDy36Z4FwU8sMN zg$0-a95)#BWikcEfB-exO*w}47~#4xFi5SD;P+hm!%VK_5YiFr3Rv?aKXJo4xN z(y-F16IWGd)f*|7w3jlK%(T!CIwsf^l zurl9xGB>NFcFm_3-3!(J-i z`N7+=dvGi-zx2Fp5_H15uxAS69MA9rRc%?d|1);KvPf+q!x_GXi|MH&PzPm49_}mM!v9>H58!Py?ra}|AiD+)|gx{;&LiO|N zLahpp{f>!EQ}aloK$Q7KDJ2LG!l&m~b)1`9oV(ynNFiatmW7K~L0#}mtFJyVckLIWh3jm3i}efjQB-qEr7+V8%snu?gD z)o$C^a&oegS+&)Cws$e>j?bDEj*;>Y3W7!5VKot+T`VTPDp(%3I5C!zV3hZg7Ir+I zmC#ZsTCINf-%)sutz~51vkd#KbKiIFsR3v*htT30^|ynCY9Uc zS4j-*?eEF;Yxm@5uiXMbbTWj7Ajv8jR#=Xe4pl#Z3E0|L)rUOk_M!eqF!uvYa0?ow zj_-A43Amzzzneh*eYlrAf128J9iQ}|F$Ow;sruj$?vz?&r0m=hgn<*4j2*5ukv&W@ zwFIAMnA414@&QcO+6|qU2|=49xrM)=bsoWt{PgwrWp!;4Tm^t>Y72kL$mIQxOvs@T|IxC z1y+1aLrOn~4>A)^a5Cp&8r>Tdh-pOnC{x)#K9s-y=FjBroqYhqR9BkAN?&MU6=OmP z1o?%As`sJLc^-m1s->}Pt*)qzr*Lenu4CoG8^EgHf!kQC;eB`zhXA5fW5kM6@CivA zc`!wm&Z)<--Oc3*gk`yv%6cc|f${|J#Te@r1O^IHTnF@hw_!*{48Q1HFawzlSv^6>Nwv6(bW2EAFllqjlLipVHcGcATE3@`?FQ;OdM+AXDBEJ);q z&b!kdeTHjCvX4po_kZ(4dHt;&JZ!8J%ZJXCmZdc3Dl&@;Z4FjCOy+nz*444Lwj{@0 zxRF@teQ1rNZcmxWE^It+bFtG=;q8s+f#8@S1*|RW%Was0sh+zBPhGN_gD}|4bP^uyQc`RWbL{wk`J0>Z#N%3aYtE&iy;TF$6c+;I05>gx_g?Z46<%SswhAXJ` zIY|z3sy9;so>f68xdTrYdC(NVqM3#+R!lChzW%QK>g~s{&5^oql;1P~$f>uKa9OAs zaN@G#@na1*Me0!yH!Oe?VBBG$y&|JzEb#(XGmdQnY(CyS(Cc&cYXlHNb$|N^?rGB) zM1-;-TS`QAFwtu(AfiqN(!#0qUTf@FQKJ3cG z2uZvzFja{P`#1mYRcNfPd=~C!3m#7c7>E&3@)>buTxs?UH$Y0$**6dy*Ew(bRaDcULRfQi%W9#uINPaq_y%>$e&2Vr2h6a+iS2UaSeW zRcHH3yUiN@ZuPWPI(Xkf4CCo8|f6(e(rr$ zPY%fZYo7QBYRaQODI%BpRvx5As;1*CUfz)NRQ~omKa*Scj0Cio7sUB*%z#XpO+u+ov`SsLp#Kj|M&hM@_J*9giZ^cD zk^7GhRjtERE0|hr&>T>0X3_?0N7at?0x(%eL~^Qh^C~`H#%f*xu>;vbY=E%?QFm^N zm3-76$@#?vVbE-!UIHdNRj*_sO$ZAGi=k$&NKQ)X?LsrL!B6O?(1eMNO~WV5HgS$M zxSEWFI>b)a!9$2&l@#XveowUk&BqD2iDQ_iy+N)SQWHD~fhn=xcp9q^-+MTeZ~x#| z@~{8pmihh6gi5M>k6%D}sn#{Y)|G*+Ohfc_%dvE`nw+toTqCHnTBn>d^B7Z0--^9= z=T5C!sa!s?z-RG!^=F`#XA&nX=L+`KfJwzq#>DT#?MvgD<`822f+kL72{wF;nLW4O zfiIrJr%yo^P1SbuwTTt91`Kg=wGH(t|e;S@4B|kgvejPp6u-d=7$hJgKSO zcS{W&@Cj^q57I}CF(gI6TtfQ&6a*CpXdArO!Q^+qWyCJQN(XNNe6j}jAc_b^W91-f ziKX22Kuhk_V_jgJ08ac6f_Z&+C=a0t`n(^Qibb4na|sJ4OEmN9og2IIy&u0WU;Ukz zL5?lVm{Nk%!VMQWwZf^Zn2;kC&>p+EU^}Zqqu&Ycet-f@=9%hZh$Y3hXEL9=$k&u9XqfaB`1rerLnVgRmQCF=%#lK>#|}O})h{m7 zp+@L5<=kQe+Ck*}`jUb`C24SN{ixJ!WEwhqtsha>s+ynV@&fQCIc!Q zRP+WSmDCm*-_YPztgh+`$e~ufrv5*9jYeX2c`!EWTB&h;M!2sdgu?NijF<%GVT70p z?@N*&Mmbj^(Amu0s3Jr`o0Kp)720~k4=jtiL(O7MhA?~53DeTMe7CySUD3?|{a$$2_4OSBqR>Ocb+EA-t zAL|2VBEhUA6eKYh3ua*o)jxD2=`6q#!QZ*F;*?sRLLmAuH7!k6Avk16yA5HCaLf_} zi$GOV=2)D<)t4}I?UZy%B8v{@kr~fUyJK|pkjbc#Tl zU;tp7!z4B}-qD83OwOZ^XBgn$;!+2~Rx9!-U0B`GEdStU##;S8o#5QpX-L(i_=RiM zy7UIa%Q#+VUy3S}rXJ?OUnxaVApj;g{w7^`&vOz^VNfAlGrAzyK_it_YdqT7Qx&XL zK^nm`Mr|}1tLkmQtGEmycxrP=R-g%5P@!CvRHYQoMx%{Y)KvbX4t1f~%@6>BQ>y-z z|o|Rse|t^=|ziXU@X9D z21c-p@c7VI;qV@LEsn$(q}U>^^UTHqTvr6sfH_Bfi!v^@6Fv7Bp2yC1R}PO)WO;d6 z$1C=U##Zd&W+z`}UCHpSF6KC}i?I|HY&uWIVwQpvuwh(=uxH7lif<|*=1}I`Rq;bP z%QC}eRfS+)JA_<+O85j$f3G`MS1^YEtu7@7_Xv?j<}r>DO1=t^cy+CV*ug5m;sPes z+|EX=tppQe4P$5#Qo?*O86}2Ljp1Ez((35|EMEe<-O$xP1|Pv}=(UvUmYKWZJtLdohV6k{ z7_p9Fs#=LahSz7RI&ZB7b^P4ciafQoDXS~X((cfFPz5(+VYvg>jA|HeU)-=b1Jr7# zhCmc1e3EkFC?stwf{Ba>s;4bndmu{yi%Dc&QW#i$4wp*c?^RRArp3ZwQWG=~FQEzG z-KMb#Ax+3SRx~j|rUTy5W9d%Tp1CRy9z9kZlgA{t#g@Y`uP8 z6LO!vdcIg>PO>6^rT^vwR?%q>&jg^Ptew^O6>k4L=1|hf`8o$HC`}5Up-esr03(F8 zT_Fr1$P_e22xC{1FoF=A(hiX&xgH<))K)6rKb@+%*h7Ga$1@Y@qfc$h*4CCRuPn*> z+Okr-RQH`$6G5kj`QuD)$LZ89WO*EuMEG3UM5)?Foho}|^#gd$k;XA<-ldLwshwXv z0Sbw6{NZtxi=dCL*GM#JCG|p1V9EGNovCrqK0{sMkrnP}bQLZt_>qejwp8fp{yqa? zzjOEq!Vzn9bX7f&iL$^)WJ8m>pRl|#c_BSOPVqdaw1W#-*ugo73zScD8dq>dI7b>4 z>QB513Z-m;U<$VBG=pXOAfF+jK1^a~m@{YYDgolXhdUb7;ee7*Vom^a4_5%Y6Zk9a3qba@P(d? zMN4Cygiybj`!qhDOErdq32@H7~VQa?0LtnsM~-@gCHs1*_=FQ4pBn%n5wuQ!mJs^XuxC zHS4J+gfL*m$e^m`$^cC8y*SuZ&1}wTSBZ zS$vqD<@UDhOunH0u9d@O-uQHSQD z`xyC!QP^K-7@A0z*kp?rRMVKbccsmhFx#5M0)-AH;q=VqVCj9ILxQWCtY0Vm75U$YcJoD9+{{TYjO_0k(KD#c$8RIJ7pw+(1qgHCM&5KCvg_+(Pzj; z@CND(99XQv)T*9qO8cu4VkLZ2bzhCnX4I0VNi(5=@Uz^KWT9gKE~oO*OG|PC+HtJr zDAw4*L~|o#rgow_)@O}z_5JyU=gwHPRc%s?M{$xkF6;;`gSs>_OCLL)Slv%4nm|<5 zQ@Hs2tNNY>R3b+ECUOD817WfK|>>sU^?N_lG#&W zO7|2*7+pupY@X`1`H!W3S^!LOjST*iVRezIFD);i_QUgZ>R?pY7i4XL!sk~wD?sqs z?*1X43S(!&Y&bACclV45{xCt9n~6dYs^1H*xN36(@-%KDvI$^?a~>6pmGfYz`n~Y} zY(D>K|2NO`GA9!MA0ax#AWQ>;&MGLPaB}<%4KuTdY3vq_OC*@}sZZMqj~1NUSgV#A znjm5xFrI^h%hk%T_}B|W9xBD`84`6(Q;n+DDR|UE&QjS(I*~XcR*5|+rPt00^d>qv zW&$iri~kq}r9cKPLyf?sR~wGJ(6%}j81IeMWjO~R$?PpPJ4zU(GGJ{-UQVE4JzoDb zE(>#^SD2fFvv6CnoFc0nFR(=wNR(eFPo(l3&rYl{SaQmROp0Cwvjx1fAkzkwzVzY2 ziE1D1e4<2;!4MKf#DB*e5U+KTP$?8!MYZ$Asa$1R@hq8E8VA-ie8yGp7~AJPB^7~= z?Oy4PXbgtOCXr7qcN$DmRuVs_eqw2&RP|3Yt=AM~Oeq9od~fQ7+>fQV<)$@^5_cX) zXW{!D^WZG)MW`p}PXl|M)i>zyk z_$sK}S3#Q>5fFOFNMcd&$SS<`d)5HN<(6HYS7>dg#ld*~8WV66of6(d@1(1mhHk6g zTVj;5wIJZL_=-8`$AG<-ZY_D%>o%e zX9=sB+3{Ez&fLf$Z--eeO}EwgC@Nh~$B9t#DAs#bH9fV-Ag7TL`{ZM9ZfX+B=T&oJ z;xlLrz8`t|-8m`7&6!kUK@5Gk-g)=W`3P}51KP_46-pOev1mWcG*n$n8~a&dss7X) zNc%XD5BZ1KnK{95;f7t2AL)Ewpz6iL_sjl6VdXePDvuQ?GK@&nPUl zdOK9J`&96(AYKgIih)IH31$X+*GUC~KU0h6vq4uLClZ*_Pzu=af=IxpiLn$gau~!Y z^jesz=3P!TN4`Oq;gr}iqnO*sM3%^0*HjB&F~~K;Tuw}*XqAU^1%s&6cx0qm6dNv^ zOh=&A6J7O3h~!R2nO1g1QuQRl@1_x|T6li(&6oNI;i=AX^=DcI6=#9J@&&V(kPN@#qdUD*o4D0G37%KYR~ zZMPU+XJH7D({mAoMulNs-B%B)T(UT+t&56)cuAEgn#tfTq}RS8C7o(<0CN0IsDBor zm8v4j(0zKoK~MxJH^I@klSGYh9s)lGbo5OpsHC* zevC3@91&d|=fzm^`D177X_8t4Qt>gND4JdUHXpIfdlzR-c=@|jw971Kk=hED%B;y5 z7d+d}s2k*^UVZ4utd7mQW>ko#d9mt)_-rDeo z#3sZXzczRcgF;au48bgf1sbZ*3}56kSgk4?QL#|NBAzYa4acU{H|AZEc_9dz!37bk zz=_`U>+WGfkOfDqIW^-Q$r72XZ)GyU$O>4hH$+HAU%Nlo2I z>sA!`1{sNJFnfM`x&VfifsDP7#n#=%Q81ks8W(xDbE?HZ%;sjg9fgg_tb;*MH5g%C zQ1M~xY(9+R@S`thnSgmMah5iyW=p4`NORsVHS~F!uy9oc;(t1ST$EI5CnyZ`+cVFe zg^Lq3G4F8iNRLmZ-j?}V3l8FNl6gwkX}*G;D-Kdu5J#HlN8#YqXEvDxd9fFod_2(x z8MV5)7D^>2QBy%)>{(6c^Cu`c1Z!as)fBJ;nr3Y$X76>?H}rmLHLHV&Si;AAO5ZhQ z>Io+$wsewx1lZ#&Y9*Q<#S59G*7tFr3}0&%S0aj`a(_(f!uS_6A!U|QG3z?y^T2&x z5JaSs7g1{b0PNE!3K_D|87HXBxPMg}cZPYlLGm{eMa4=j%I(CMv)K0&7$U+*jv)&P z7Zo0YrlCn%7)yQ$z>XP3JchPB%DrIamTja0q19F)%v{Q%as=75zzf6|NgSH|8rPtD z*{_ULv5J|L%x8Nsr@*TMbwP=3=%#8oBeUEKCA<_{#GXvDakEx?VbyvU+2g24L2Yh$ zVKOzWLm(XInvT!!F_n+8jF9&cp3KcOH}Ui2$J*FQb2~$axu6N07s~nhteTaw3fmcB zqbU1yUG1#d5UZdl$c!kwUv>~H2q`IrEquRwGLQk(H+w9wa5kXXK=LdgP;_CjE$5e) zwW3K}D8n<}o?LN~TcC*Um@<^1eX+ADCsioC7i|(c)goC=3_Xi9&1E$1+jm?b$3np| z0o=sQ67ys7p=ymO`3Gt`{3Ie_jVq<^lm$nWuTvV1EZ6ZkCG(Rv|6aMVR$? z_9Rv5DeR1rFnLkmFV4-~fE4ioy;vyFHAY$by%GNPRp40^6DE_a9rFz@EVdBZUC~6= zEGr|YnmXiJGaR$0%TBt%RFckWHhG*6K!?SHBPfK@>AkMY73R z3Z0o9D-6yiR(+^I>r_hsKhMlvz@IXObHgtxZ87n5+#|Pr~~CYlgUvjB#8F zFqt>OGQ!CBTcVJK+ym0zQQ;;B-bKntZWN#CRRqtY#2T|6M_QGP>gy~)(9=~4VdjP8 z)XRgdQbpP8@sn++i*~l= zX<80YB0kwRv(=JKrZ#aZK$%uo(QL4A$9dj?=AleH#cCUcxPPuVMjL=&kl7iAM3ia+ z0^KCCl(x78)-)NZ?j_-aMjke63u9;JVyXXF+wEnV0%vTiFL%>9Fb{z#fK`&oaGj6( zDj>BrsLX6JX?f8Ir8;NTIhuVho=H^jVW$1(s1HXPig>TYQg$K2>{L zO0Kr5Ws6>{va1^la$#**)}R&C8H|0%+=C{~9)ckB`dwoR!5EHN8!^p&dHvMV#Bq&m zY^s`Cr^gO%u}@T?FpY<*;aGPu9;;-kiBe)mYZk}aH7-{|EYpdPd=Ccof@sR=4yVTN z$C^ar19f2>a#tk56hGCq4H3`Klq}WvYU~lACHyt>nAF{k3R_?9b78Z1yaD3uD(MXG8mzI|C{yha@bo-c%#N!q* zv6t3XWNmdt+ReHN0M+Ew)40yU!DCgShuLc4#o(^CdCe|cPL6kGC$pw(ImXnP_PH;V(qh@fBjmXSRk0hw~I1ZDkCkcaX zaNYl$f7w)ods~Or_ok#V@6eFJ1kr={6H` zW;ebG_|$7$&7f>-i!mwKY%b~5Q4$UiDp&nO7*sNa59twc4-ATC79%-vrdxT z;n=DVi&@L}G9dh95^EblhRzkJv7H}F`6tuDdl}+dL$HIq&rnRG?RxQfpPl9*7i=1$ z4Oe34%Mq<1Ir}g$L8h+VX05qs7ZFP4YVh;S`}J`%lEno*fo+*&Q!9(h9TnVItfJe- zx8!l6I4Ux+!+be8oe~!&y%dZ{&V+YdFhRA<_ZU2jg`5|N>WMz={nA_UrT-+FVsrCM zjT$470IXd(w=OFS9krtz5b{wyXc5}c+$VjqQ8&5!I#fC{kXRf;yg+TR)M=^ErI?`M zfLbEgUQP^pF{8SpjXPsabFb%?hspCcSuD$HXE2y!n1U&DEwGY%u;Zig#N0=^g}HGf z19*dd{5xU8FBQ;SHBYTh~2h?{DEYQ{_> zzi$?WWo2bu7m4j%QTFPz2&$jfpsfqcaC(wwwRq|6l|oV;Q}7Jx!+Vz`pYvHi>{Y$c zJov17DbNdu$wv2pKX9(c|fh)uAPzzbv2kPPeNQPot_uW4nX+Nlw@kASW#eQS1B@j8wFioqi z1lQ=OYR_Pk(>hE8dqn5P4y1}pEKo$@WB*77sMy{|BdM&J)T%EC7F|N_frHOkG0tu- zoIuuqGTGI-`Fp-I4&`=;WeizyZDsfjN-=Ya)m`i_HO&&`B|7c8bl9>eii>SIr+fU?Zh>5E& zVg&*#fXI40gf{{6v3m&4p#~6_k0A)TY&4o$(Y-f{<>1M_Jh!>7U@-16*o0LH!K^i! z2JRRU9osH;YzJ^Mm>A$?r5CjW9_nNS78RI-#XnT+b!d;M&-%}awjXK(do)9)H?#bG zsw|gXg zXqE}^M;|=I)r}=>_4Dkx1vxr7kdx!SEH5s|@sNETn_9#|kD&>ZwMeYu%j8~Mn!rsu4oB+gZL;KXB#z$Ev7Kno%AdVC;l z+|R~RQ#-tHDREL*T)Pl=q!~Ar-$>aG5Sris8jZlS0Yu6^*EWH+dJC{vOw4RHQwWZQ zR}!>{kG+_%Slgi>NJZ$t3rVVEN|^nC6(sVNNppfA;=8(>_8#VmDa#3{RPT6!qi=n5 z@3w57e^#Ew3Vnb7NE>P`b`}&AGVH4a4v7~&I`9IE6B7_a$9pGGtFgTD(kEnXM~^;_|t3a*!YDK2^tVN81h`G8lzp zrn?}xaNk$9mUL^x0dU5Z^+gDgJrkK!mJ!z2(H>^7QOjg?u`c(Ix;il%o6CA!9M5Ti zVjg0(#cqz|o5@V~?4;86Q5ml0cXdNooh#?Hf}J|0Z<&RSJ}ZhL>|f;a)9F-Il~f!b z&C{Kyi7IP0flvB9IeK_gp1-s%PX>LB2(B+JY4V5)jPmsp-Ib2*ftkg;h*i4+tik)D zJ*UOK(q05WjAUb>Dcv=!#G`>c2iNkqF0bhp0aFCArYj5DuW<{5eQD!7%tBpzNiHrl zG>?L4{@lifEP&g{edCfEK3l|OZo$ocvVW+1l}w|l_H-avy}GrAbG76KOcU>)*oRNH z3f^KBVDMRBp9i}q@~d0Bva!;V^>!p3ctPjtqMnp)UNY>1OK3tsGNraRR~99CaH!ta z%`Im1|SDPi#wepT4QNZ(?rX$*a(FHjo>te7COJR zA*Z9Aq{ z>9d^X7NX{5N8E`ZCZo+vW1=+psJ&6Ajj}3Sba@^ z$DL)gV;OFt-DY&Mrou2BT8^RipUzo*P2?Uc`d?@@<=nXq!$omi^s5xjU6^Vb|K*Dp zrPrOn=1<|J#0vCMXsR~8{}SxmCzd1mjm=BCKbDAZVhS~!f@9cZ+TAkK>8&ReaR&v7 z0>030Xi1-?`{ACOAmX5*7oZ(CfG=v!u9Z7?ia;t^NB>S_DRoMgQEOK7ONyhVzy_fO zv8yn|1%RxQoE0s9N(icjG1W<)F&nP3!)n1V1mW_C8Xzu#P2R+6YwT^yDpWKZT`>5P zU?8;FW}ayfNrOkZMI#&a4&1i7wgu*PA)i?$=S(FRi4LR6(BHaG!pf^$0 zk^<9amK7#+0TMXCy>LgX>6C@S4GmA*g0LbQR*|!Ib9Jqw{03VZQ&Tu!jN5?w+pbeH zK%;fL(%D#t7WLI;l?7OB-eEx9=QEfuuVyqf5qGYn3@rBK-AD-)Wu>{%x`|w7!C){K z0ku|F|GXf~m=7tXw7>}SX>)#`$ebk0%8D$kbhLSwXltE@1zfyD9svk0V|9toedL6? z$cK;dm1InlGEo<3ZKh=eT-Y+!)_r_QQ;AC$n8sJ94-cA!u+HLrXaCWb4FRx0Co#tI$S)IjltuD`ERR=e* zI6RO&(L8k!NhDz>-Pw6es}nloHO#$#*0usOrb6UY%&bi9t{wr~3E;GH^@6%+T!u}* zJ&a=N}t;SBzh4T+Dig`|nd ztERB4oF2<04-W9TRVDbjqeGj07?da>C7Nj7z~|D*K0}J`HpwoHnP9~> z*lQ9%atWSIALeM-8^|hzu0I422A((>O|+MzwhT@Z6^vCxU)!w|+Mq7$>#NFTgawlO zXr~nh)pTnE(%Hl^HE!Ep=c3Hyqla=w=)>byM~36HCk$7c!Pbp?8!dh23>_gFYRO$uBLi zoRMZiJGht2b$AR*Esa%-Kzf~rIqGV-JGahw&_YcJ3Ry%(D4VU8CE_NLnu945TSyYo zI}+Pof%wGoAHa=VIw$qTmWWh6hcnEwug&m2f}eb=!YbXx$bWX4B^HTh=9jOs^`Dqq zDN(ug&4)GMsG5^f+QL3oP6JGV(2z=Wtni1i(nj>T5khV%Ig%^T3cJZuo$KAiR>4&B zeVBA(l$w>S>vtGhcFxx^_-^c6;S`#X3z0DbInwsStm|A{g+C9>z>aP9ScxXSYB3I? zOA!M^laZyy`zEJMy4Ah0*q{^>*J9g0#yZvzw;1*1GA4bj39_+jE@qC^)5Pa4TFW4g zLmDT=Rnh2r@PEb5aYchH{oIu|RGO5MJPS8E#CO`PGhnn4E~0J9SyQ!bt1wX& z8atEv7yy%=L5<&mE6KKgTD7Ibm?)WIX=hfvtL=6WPw1T>$_S=%_h3&JHkRT3uUXBTSy%lnw$;5%DTgzwSCg+*88lst?DWVI?RWuxx9a^-4TdR3Pl6q9QgQb@B ztI8#w6Y?Em^1Q%n+UGhmLas^&6g|O1>i{>KW{?(ML==_op;zfuJUW~1HY=?`E7(O` z0bcSvycYzjtmxt5t6_lGS__KmJ%46p_5Pe%=5D)z!HbBju?9=rD1y$mCs4N1_j6$C zoAMkO;3?F17edhO4>iZ3(eB9l#-?^+VRwgI2^zn*gpyd9UMD};v1>+Fm>X-cPNEx} zHx_HMvbG_2Z`{SlBRPi{0w;I`ceY+5*z{Z5I7@}&MAB2y#C+1|>S2hk?umAMvFvE= zI0qp(k66aq#)8)x0hEV@={2oLF|nZrqA>KaVWRmQl6fsr5{*)s6W^>OG^viIRO_B_ zu$!&il0BsF&EWD61vgdOW}k<4*UCQm|n-Tt0n|*-Zmbz(D*bpruFCT+8JzKmRQFfVy^INvLZ5_DfL+D-SIt z-f)kBN0oK$X>C}5`*B~nd|s}-dqWOS5>3xbn+Sx(c0NZ!tCcDtL z8U{9#+9w-Ld={3e+HBIZT+8XitI1fq+1fUUR^W2bA4z&R&@rKznYKX|bvi1!c`Uxg z--0IYvT?a`BVsv}EG(w`YC^&t?=&KVfZ3)-ZUZkf%kS8CB01fN!^lS~`wO2{=VU&K z*@VT-EMgUgViLXIHh5xqbj#n1f-!eABUNQRs)>Cdg3=6$$iC`b#2l3gl}meUX$pg zn~pEGQWWQAD1ccG;tbs8@)ex z^Fn~ca}rw68QK2RQ{5J}jAQ6tQJ4@$Cp7>S=VBd%Gj;h`Cpp1DbJaPnJZJ%Kjy^&p zaWELFonAsnyaO6~adAa5xTBAr?85I)70{)%x(XuK;&0 zoSEjMw$egh+|yIfJqMuL*1yfw_8y)$4_1>A8(dd~8(JBtzO{ul2mVhJRi(Sn_rngj zMmovqT8L9BznI6!Png}5C9g;&j&2ie-A%&H$&9P1l1fdY$uFteZ{`jTr{VgRZA^NY z+xhC2e7VuQTzR^o2sb5Rk7=f{gAvpO5&%Y)z)`m?E`k4t%3eksfTi;z?skK7c7Y+b zA3xAkH73VwfCW{&2QxA0bE9=&448wyZb6u7F9){wsU=-|J{{;xYcdHa8FC*|c!pEW zeCnlrgutCO>0sT5vqt5PZIBx^P1~ahezaKcrfg!h3{=@#M1z6uLI}D{ zlEKwh7Z*V&A@MCwUbPfXc^o2E9T3b=IuMI%+iKgNwQ|?j4{itj!1I9Qq-Ty1{ zZHpiTG)=6>pa4+wIWvb`{WY2vPbY`n1anWQNo7%LYoW-uCXzDQ$dZkx21eufjLEN* zIOb&~cJ=*qzQIEf2$L*N6Ni%(q3Ckosu1~_;UVS#Wfjf(n5uXmNs+g;k7wY(nQ83jlg8JXt-dAAD zDWF-K=BY&5pNU;*5q<&~)D6q1(WrqEQbnNgr@Vh6M&N3I~R!C41fn%5th?E*8E`&P> z7axq9nU^i`O^}j`pRWCrQo|2Z-NralHBL@}iLzYHyR4uBAX`CLT$o?L3@H*z*+fBF zI<3RSJXZ6O`4|azupu3t9UaQJH-)f_L{+dicSJe z>gIR{`&o5kyse`eWw{w9#2xjOT1}e`1(S5?VlApQqGmL)9b%M&^K9WnO$Ao(aZmQ( zQZ6xpmEmpYiu>op*Wm)PAqXd;0S|!05-YGW-S$wlMNkWIiYYu3jU_~p?wrfMQmrWU z8;4p$Fc#=K?Pi-G*gDj)AV_`O-PUrw0n^u*E+m_5o&JuN=k_gVeG&h{&EWukp#D?iJ1b8c4plq;z9- zEiz(Rw>-n#m)f7eL_F9(g2w=$xCsBAUIF)(l1TTDWc{R5_YuJ*L^9*l0%55}F>@uT zxPMfB(o-rqJTr+Twhq!BP5gg8(S~47DdM^@hgnUE>||&nZZI++yNG*Ubk_2RA@|q= zYsD7?i@8zM8c0*~VBKfwzKXK2uIN`Ke!odY4{=;r*Rx2za=<;~n;1tFQs1I5N3N>f zr9_; zSW#^eY`e^Bqs@G*lR*ukn}BeCCx1VzqiE@7APt|8Vmh)vIuXo1R(4CTNg7(~1@N6# zy`$Mm34WiZwmuey7Gl;kc>+wJ{+8Na>*Y9^#JY1W?}LO8Q`SuLSdYjC1bT7|){`Cu zyc%ieveaSHj>TWdjRZ}lW*`!4q?IPVIY*>Ly9{-!6-bPI)D$iqN?%^bF^(+Ks)Fm= zE7KcE)3gwd%!Tc&?RtTv(sP)Mc}?Rg3)y~Z(wVEUQToNm6~U8Iasn0zgvD&4OH>3_ z%FnByQpG2pE$)q+O~{mKU<0f`vU9lN6ezNn3(iBCb?bLmVWd&n1Ip+ zrOjyQR9p8=HD8gQ4mUwjF9jNaeVtF})l8>WPC$stwm%w}GWE|g!`Syc@VuG3nbK5+XkF;6U7N9A}7_Tiv^3ijPn6!yJJ|4;;>*4_( zSs}Ij%%+UGL(sjcEUd1|&duABos6{CV+8Vw3Ai*B+Ny`zua;_SK2qCILvo1o4Mw)l z1+mVQUJ@pv2ljFSCgSRPLsppLmbA6gyyao|-Rkm017dZ!yiv1etJB+ZPWs~Jx_7tQ;xTKedxuY%XOQm-|N81KYMg))Ok#+6R_VX z)WE9?UP4&Kl$ous!yT+`tjkg~)$I*+-w2q6qk{v9Pr9;rVN;`^?8}fI_7#8BR}fY{ zJeG%#4rKSJC-)C>xxQoPzktboY9W<#3%Kq|qAqSnJH^=c0^0FK;~}x`%b7>sU8L8< zj&;x^3yVuO-csTvaUr?bT>Lng)u4gH*hUuBv8Zd+RVWu)@aASQUNp1V3SpR+k{P#U z&h{4x713;G*YLhbbV@x{zds-03^z%_natson-u zPu#tR1HZ(=oQq4KkR$0IbaewVQrE-oNcvzMvAm@Z4bg)+*nH+$#4s9?vB3s3%?P~3 z`lZX#J>J$RCy=WgA9ukdVv<|*Ho!~Z-zxO~E1NJ?5P-D~Jeo!#YfBN>$)@g6Sx;;a zEQXvJ8_5zT^3)U;X}cdhFMCsQ#~IPSlkq99jQ}y!L`JT{@kCzT`@O8Az}vX88f+dQ z+7!&r#Vj>#ud;5UB2m>o4AqGY>1<_Sq$*)DbD^paTs0F_0SUk~GT9dg+uw)Z-vo(M zuXrA*2Tf-0Oglsgi)wmG7SUDfAa1a*w4k*WT!l?ca-&_7e1t&)SX_bY5Rgb5xy=RHK54`L9{{vUeU_g{3Ga z&ilR9m2RI0Fmf7Ggq_^ZBCx97i!d`8t89SakYlsXd}?7@&2aJQs);rA*6gEtO*sh? zOv~&Nx4dk;Jk-CadWKeEodh`zsQVPL17eP5vneB}{fHFsB-eaICY-E8UB`F!r3DPp z!FirrKQGNoivWYRw{{mX4ziDcwOAUn15YyE%=k`6qd~WPRCOH40gNM~a19eZQR7 zie^xCp^_&v6REqnR9u&N^*_^?<3lvTS&}%Dr4vvu(KV}(*VZsd+g2S!bUyBDaf%kR z)e2mQ5F}M)aIr>1DVglEfS}?$3w1V^%>$2oDiCm+RC!u!vfSai+wW> zpGbUx8eUx6(k+Sx118Y`JTk|UUP2?%#vW43m1$gDgl5@Vm%ZIRv4E0+M}F68G$IAW zT33O+Q-p0v_1V&09cat!mYSv3`%DJUgPtxu=doX`Y-)tjE!&UI~WVm`GdT4N0*8_H(w zWW!Bh%b~u{T~r~6eC1Z|tR8{%G*`WCa5m+iSk0;CF1VpNj_d+UpO6W(df%8l7UFP& zltH&EJp{za{4onDZbhoGsHx)IvX|)UuB@(TZ3eTJ$SvqTm|8UKY-2X(d@h6KYB)~_ zox6I))6i!WH5U$nt1Oyw?`_?x!Gp%Q(wAZ0bE}rn&4b43cPbl}`GYG&k_DztOPO2J-{TR|(kUlxm-KLCr<9 zUEsdwf39Jqbn_sX) z9880*(A)zumb78jE9k^(?+?0Itxk8tRa>qClUln$jVC&#k!h0H6qMT}G1$eJ1+fEb zDKgzZDmBnX<`loTK!nk|(cN#d+-GA=G_FC7Fww5FnH&QkGaqZ=@&$n0wpjgqQ43!H z_b3W6pECYaU0~Dcv@!>$HMesiP9$@H{p`8mchdO-BH#L@S};?Uo~m7v@Bon%VbHTM z#3=!DAxR^W`MoHdT}T{Qq{WL{GJNnvNfxDoF)8hqbwT5Cwb*u=V`nx-7P;iL>q_EX zG?r1wSdn-STmmziNF_5(j!(wacP(0RWsL#z8T2dK9yn4Wu+9o@tg_)?pl+<~WMlY% z$+Fr|1YS)O+`&L|Cyk$A<`a`@`)p;*G`gu%p=5Q{^Uq#2I++x8*n6RfMpToF0{{%R zf7UDeF#Hx4*;)Hh&1wi=5N$MdG=nbHm2qVk^uk6}a_XuR9|U3^l*}X6DzdeRr%(8h zIrAgI!$2etE?v6N)T9vF-CDir)7_&&^)i8#X=l0tNMvE-2DAiuDfTryC6N`UXD^C&j#x>`k<^Zsd7GS9L<^T&lvvC8k+v_S6pzc-Ry_jNVE^EFdXN)JwbnB<#g0I&%XFEZTyuv>!hFi)ydD&%CLW!wybJ~ zFlW`Ycvp=$i=6T#g3z2=bY6%`Ga;U9(3!Pn;woWhAkgZHKTAuT@@chr*6z~;LA;4L zZ3C+&i!Z8rr@OcjjP*6`J!}OyM*M(%o|-js{kbNk(!JD@cbtR5!n8Q;JkMr1G!^vK z2{03Ag=S_fuXb{0lk!@Tys9AISAP?)Xp2I|Lh9yuuntt4Z)7GA+>Y=FcwqamtJ@Qj z(VY55BD_K!*ypK_J#Skv$C0mX_4TbjY30LO0gIHiDPg?kv78=P;S|K3&QPzu442WK zIFjIWqISGXs}@-<;p8US%U40zYK z1B^7mg*6QXhkXQ~xN_UAmL}CMktHM}nL6N$mUK0xP9qz5_NhLruTD_4&vrmfOqgva zV8SpM543w+;-il=5!5tHHDjQOxt1dpgsGhLdUAk3S9h5E_6}KrMTo=b`B+_%FVYR; zkXx=|$a$=~Z}XE~6_T^q-_XQFqSLt}^8#j`oAY4Rm{Ln&_4iPK3{N_^GZ@713Q{^h zsq<>A1esE>ne$RVk2Q*GD%nWno@jE&^76W$h^g9kc6g`ncLJo}Wt}C{)S;r2xS<<^ zY4s92sWlSqsi=Een{--sGK7jnwDne^*;BSjm?icSWY)B6OsY^%HA5}2mVP<+oS-QH zNCaKIb8sm8htLYgBRLw7^5%2L@Jy^~jBcpLUouNpv2uTlFT_bj5MxYW>Py-aSnri)a^^w<|JdaXC9(if|PWYI{M(um(;jM7At39 zLSb7JaxXoCNb#pU0oV|L$`H^XiSd%EOf|DBq>MY>E}1uy0Za6!iYlfqELw z`_sp;*E%e^0uej{$YbsSvydZC=5XT@?T*4;P`Twaa#?8AR%CWu;}|};qm!7%-V1U{ zYxkiEPI_Y%yc1}noujT+U3IywQLV0;KwVVat8U$l>vE$LZiJ=^S=F)MxIHpAd0tai zCsB)*H9OX;YjG8?ten<)%~CyIVOr({BLw}}gNvprwML!dY0$!tl+xX?)f`rBRrSoX zU-J?yAr~(kTY2AvFtqt8GpCD(aYl-0XB84Uu=4{gQZ+APabXG6Zdb3_Y&B&7+PDkc zz<`x7nS~pd)e}|q-1~vs9$7KC)6LGgVd-SV(*Cj1#LPY-HsR+yzZJry${!G1GCTUH zH`I;Cj-UxxvVRCNi5OuAK{Yl3ZL%DYO*(v1OBz|0Q@d_v?#``;^33y3X|6(O)E>tr z*>rjWEAC|_d8ibG*~K%1)1uS43;Mgq6!T_W&4jC*Gb$v?Pn5oA4LjUSxpxU-_^Ng@ zFE|60I9rjC&&<`57?+peNn{2Pm4jg^_cRkdtim)sN}8*ko`%PB(Cmshl1u%&i26x^{Y zDphi+rp>!Z|2At4ZNYbNav&WD&Pp3HoBYB2EHGI4s=+}A!V?P2hEz*vt7w~PNDj<`gt1uu?jCaYRhs7dLV4L?udeNVCrb^Og3HUc zjZkE@iEIwa-jIAX#zWcJ8(C)*zZW+9fE^;9aBy@4tx%VCEz^>@G52`jb53j((W*Qta4(5V`>C$PzZA{n3xt}U`jCtUIez0ZcpHJ+XB+o zoGeY@$Ni1**@F|%(s=J=T$gKicI6Y#tV*?CW7*y>jH%x>PpaBF4N7@4fmpH&cpDg(Qd)pakxHM3SvNIwoufcJ+y)Ln z9Af`?&uRrAkjKMsf>eN+m_Hf!gSBKE_@J!2c5&%e@*5?dZIUl28LEQguc|TLwFAQW18t343OSD&x@P zBiIFF!*bikFlx%9gMID45HYkYQGiueIqkD}QrrjKOf58x8JEZ~8BOH@0x0A?)mf8) z?{KT4G5b6Copv)1sp(n%?!}twZ7oi0x2y8m; zAfOwoOJZ#a6M66PvE18ra^d1-+1=fjZZnaa58Cpvr&kQD%V}5LFj;lcLB2z8rvTmRlE-m^v)6#1(4;%XH%=ykH}{$Z=$FwI9@Y25BRDYA@Z>fsrtAcj}#gw zlIpbsJE?II4dTEX2QGN;))UaZnB=;7Geqd>`oXRznRS|nF4lfd+&Hz}Z0nV~;2oHT z#`b~@_I4hRz4k$5Gu3=GvEB=l(g7yH#D3LEKbfE;IHxAGGJNg@*A$ylbh=;0GKi*y zW?jSN8L-O5^;O+vhR^xncr1^yrYv-7s!jU9EiPS@w{9KE<;_KyFW*hJG8R%MT!#b0NeXwxuUAd=uAo_e%jMM~9~?TxLD+xv zz1$TWpH;O`d7u<3mlq~qz)g_L1b=$mY?C? z)|QrJb8S_&Hr8$D*dWxAs5%dJPXkZPpNwnT7@QlJg&>le8JF1J5e#iJGs+V5Fe*#<9G$3v(lFx&7dwEH5t0=H_{=v3#^Ulz({rvHbKM zXuyeiY`*P^lnSBbdO|c=TMflQC_<+;o4=4O6a*kdio^JZ^Hzl;{8R1yum1Fvug_|Q za#dHLVPztvEY|Qxx-%p(@`JDEtO$yI7F;HqmvA*h%{d0DE7$M#G>_rpxh=W*=Iipw zk6zV;l2`&+lPGhh+DKf{1Bomkw*aF1$#?^Wkf1a8)hhC_39<97jrmX%XkrK^%1pJ! zA@dnjxzfv)rf$sX5&&WwkmC=%K# zR0Zn{TH3i{A;&?23PEtE!>3U+%X$^nJTn)PneP@Wz48k2cy*2R#;ohQc5%xrcY-SU zWZY0+emDeZ!-~B#OywVb{c(1BilE3_uSH2$4)kd7<`l%XG zo*-oKno0}xfI+%K1JIf5=(+PqRQ=s-9e-yua{D-vU%a;inip;z0zuC_{{sB;SgyT$ zO*ViH)>anvc)E71RZLiDpC&rM1w-m=(3nI%b%4S&V%yZ)U#jP7|~?uDuwm+u0b!N=cuPXqry+ z{@G-sQH!)`N8nnB6|7r~fi+`1ElX*_cEq)o;umH`k=dMr=Xi8Hm2Y1=lzwwvo`3dP z`SFi`CNIDIX$Zk%sdYNKZx#878Z;L@6&Bzef#$w^<%$fzcK*YUeht%;$k5f~;%Y4C zmuuEjssg%$XBR-egixF}BWCuqQyQSE6{>&p1Ih)H8cGvf-x6e_ftQ%|7LsQKPak?v~00K31k(3Zt^ zODCK^mpUz7v7GQl0K*ovz!J9?Vp0n?GEZzJvJ{Y1GlhVGG$z_otL&WQ^0SA1c`#{6 zyVI6Oj~>f~^II?z_v8y-{7w1U&weJaKs(&HaYHU%cuKvCqy0T~gO^v=6cAI(Tz%#_ zxqkbRymxa)?ms#~U=7|%r>-Rcl3QJ-3W8Vh;!1v~x|oAIIv-H10?qKV5QYL6MrY?b zRwd0)VO(6ebTbVJI&r7Wjh(}1T}$p;@7Lw__E`SSH{O=RQB4ML1@GK_AZzf?7Z(7s z@Hcm&Wm~^%*WQsAKK7z+h5XYu-qbxOK<8k9+PX<7(@z-4$~C>+HbOPiV=ax7#A-$p zt#?SRB_0LI`J4scYKN=bJdC;rz6NOHC^Sg5eXeCl>?b^Y$G~`Z+m5Tw`PLS zdHL%f1{~+BqJpNF@eHb-NQJDbY8N}kdCwsQb)3n6{LVY_qqp|t=ACT?c?VeW_wU_- zN_|PmtnJ+$dFJUWva_=-tE=ns@bN>Kf~H(~_M>v^{uAk*9J5Xtt2WZalfZm2IHq|6 ziO*Z`_Mh%vfx;sTT#=|U=2WyTkLE@?Gj%MO>Git4<-chcZ6Snv$hE^-q8ZrCdfw}1 z^45;XwG)xGtu39DCr@_d>eVZ9{ry|=Tfg-s`Q_`slHdF4*W}fozbaq-{oj{&-@7hP zf8-;we|V^oQwF%$knD?J`hwiLc}x33EFet(cza(HZP&Lh%Sl#~UtN172ZtlwCzBc} zvbumGSQzHdCfN4oD3Xue>7Z3XCFI)pEHvmA2_50XIn-voBz{Z_oap@ z$t$NSdIFN@JHNOi|Nr-I$xq(BC)<1b@+W`#hYB3I9RN$z*u;~yiYqHiIvFPzl#5{Q zSf)>)bsoR(3^Ca0syu?%@!rjQa_`9##S6UmIyeK3SvY1HB?>Y#{~V!kmAMA2!b<8+ z%l5fZSfi18*UeNWS3EUSoEXv7Znrf+#!PBvGqIHrb0&6rQ@QV!5@ppFB8}0Uq`XuY5+{gSS9I zSzTS0TfhpR{oH3@_aDNAya-|Mfb*C@(APB?=lJ+Q)jj!*mtOjeY@S<(IoXu2e)ad| zo8R~^a7FLP*S_|Tt-X`2DLe6N~b}2lv5UKqzXP@~zh%%eQ{M4Q?j4ZuMe5 zp6#2N6vSWfQ%n3%x~D1w_#e!~XDeo++UxQ3YaUa~GLG?#Aca~hkzBw)-M#lf7Qh^~7vZvDHNWt&kIOf|`3?E$(U{N)R?0yif(k)!Sx?P@WxFLxLvvLRxP1}#mza)iNH`eUCt+k; zB06iP$s$^<$ey}_S>^Gx@dS@l%hWO%um-$G`CtO`w0T+Hc>8_5-Wu%v0kj>9ZdiD` zwzdJSu#ZVTC+E*ylviK-IXt6J%isLXf0D2K&hN@EUVT-51HkeC8sMFG-jh3b?kHi_ zg+^pn_2tV?0d)Qx@r)h$%2$2|lMs}MQ6Q=vw@}o&@yhp-j0v=2J#)K zvg;4JaHSUUU_S-I-j=O%=jACp&`Y2B43PF+ZQ9M>@87*GtyUX@nPTGiGE( zKat=4%J0e#fA~EJ$P2QFLHPS`eM|o6kN-zqvH$g3-;m4Cz91`?o|Z@VaW44&Z0ec# zUGJD#P5)mLZZMHUc6Q6G8!g>TEwItL4yT#anrnKHbenFbN;T z>vC9Zhy5K%l=1m5U%DtaKez=<@eDYJ0|?cs-$`dGU;gdimhGJ<;4coe``v|$ zTk_!kJ^Z{VX>(bA`uYudyx)`M+02^`Q<^T2(xnC7ss)RDU|T^}JQ0V-5c^}fA(kc zz3+clE?l~d6~2tI*@q|bCQQqQg5;+mT+~#b`OM35_s(sc<7t@8BaFpuP}w~>#_!7@ z-!5NzO5S_#ZDml|)9Rgf-@!Sr0K`5eum0)|u+)h%qij{3hUQ-(?lc!7&_!Q(1a1}- z7AUjgG0an%fufF!lDt?Bx{3Voy`KE^`k{RL`#+P{e+{?r9wcm>`z9bJGZsW5T zAxtfKCNyREw2Bin2}2j3_DGfPbWwhFU*zBY^*?9==+!G%F%XA}-fv*?=$ro@CiMtt z`SYLqyxhHeNA2VnVK*N?dIaF~d-}lF-g{p@`q3Bg-Cf;|unkY+9?Z#w^XHVOceZ%Z4}{xT-#bxc?nEBWRJH`Fcr0v;@A7^>@=SmEq;cA%>!llR}huE23;XIIS$ z-O5J2t=Ua&xSa2RkonCoeMwvM+`9PzOwB78kYl;`;0}(ztofC#)`cxhRM$83Nadp+`=q?~i&xd# z`TalmWBKt9zK{FACm;X#$6+GYbngrDDcp=zch`MzUl+k6cq24Zzx?Gd;Y}>)9B|PP zXWhAVN3K47RnBjnm%ZI5^31c(%MJvC@tXa;Ls?(jgeE>w^6Ju+r{rXm!ySJlcfo9K z?~h=%JL-PxzAbbUJYp(L0r#2mn)aepa>bcyuaAW$yBeqMqNq^3B3{=DuU(^>AQ z*TFp?xcL|vx~;8Ca7#ZW|Mvg=w|eeZUiqT@{onsB2K`w6*+2htIe`8B*5Ce}d>jI? z37`Lc5L9o%6=Q@ki38yjX^<%^TJmL@Rn4+E0xOz@9o=pX#!Ka=|p zZd;R6tj6xi9-imCYO@D03x~ix7tUV*xXtC#g%Gi}_rt^PXAwyJPNDCz|~{!nL|sIS=}&>@+rIzq29lg4BBD3!hU=^F0tk zSFb(=p}hpp=ofgNXP~yv$**Awu3mW>RQd)q-fgVZXLOwC8L*Xra}zL&Uy+~w_ zAn}0#(fC+{3Eg1xa=O{AKyckAIBFCh!A*C=+de@zb9| z*bj8W)jKzD%9W2ir`cS5eFSXg-rf_O>v?z)b&bV*=JTJ2sXUaA0ke?~=d~_^D(`{c zc>)tVf+^%@?9TgS`%sd9_K!aG^^o8Z>LxEU*tms`_kTnW__(y*tKl;%R@%Jvsm6xFQ9;m>){Wk3B>Y}c+ z4M_CL>XHf{6I}`LZc_!qM&G=7T|W8APpDtbjxCQL-z^3$LE0C?hc`NEgJjDdYxe(=+u$i_1-$lJH?VP!$p);sb6 z)a31HOMY-`SN@;xye!;+O~WBJe{G6GOXBv-w~C^Irq&d|p=8 z*B}5pat8~6Syi6`n0);Bk$mFC=M}e5NbW<+5<`(?eGW02Pkib#zzX-^dVgAX)am#7 zh+|xZ`FaOhcmbMaEY|@%8L@r$owso>drG?9gn3865xs002ovPDHLkV1i98k?H^d literal 0 HcmV?d00001 diff --git a/linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/cover.png b/linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/cover.png new file mode 100644 index 0000000000000000000000000000000000000000..4006369a2292f05510130dcaf93db379d9c864a9 GIT binary patch literal 267256 zcmV)5K*_&}P)WWa#o5B_2p@L%wMlp)BlEm(p~%YeSggl!Vt93+t< zDcL5?sn}gzuilhHL}VCi+WXvi`KpWEq?4?EnK9gZ?m7GHz4qF}S^dNR{dbPri_3Ap z+l_G?<7|C4#^V@|k4OA7R;$(E8^^;~jrDlM->cO)9*+Y*XKTL7_l`$=_L1LNuh(P! zcpR(s7_0T!I6fW+{ty3;_r~ft&c>S8z)!A+ORR7;d<5^WjssW4C)fV&dZl~wfAOZr zG;lwT*PrK=^2x`s_Inv0?uq9;JRZhoi!nZG+^aRmiqG*1D~ws=T#YmRyBhp$<8SfBMQ;Ia5w4Z23pXW|&nJSNPk2E>nYzA=Zm z@0xS{$opXpkK=g2h#tq`cpQhv$MJZ01S^skN{K{I-g9Y(i zo+sTx6v(`NOsIFTM&H_C_3!(Un*)zO3ibU)mpdO`qeg z8%HiS=AGJz&xvblF15dKZ_HcEL6#M-KaR29)b(K#vWHi=u0+-Y&Gzz2t;X1_*JJgF z3BhX`6X)jfU_F zG)Zr2#_%cWFsYK`IFoXf-pONPj_aO-`hI=3=6HGkGhJ^>yXgDj^J~n<8UN*ds092P z-iN;Q9>V^R%tz~<%+oYoT2GBpGP?XM|K=97K7RUAwU>XIUtrIoS8&gbpYdbYgxnph zZ=#EBZmspThP3;oG(UU*$-VSE<`BQ@zawn`Megx1?(Xi#ZoeB}y?#61-`xY!@Xhm! z?YO);A6J)`B3ew&Q0%|73jr`SbDcupftq-T3^o zPkF!HZa*G&yRmzG9B05#+fB&>_uy)b^X+z=ZMU2gEs>v18mOj7_Di!7yM#;ZvEOMc zV5{(+gbLq$Jiulh#-8?WMQlKP0G(%>e|d3140p9Xx0KuBo zK#)f(yCxe{28ycok#ncVq@ka5cuPa{2R@6RAR1XKUzBs9eU2XtGnf=uhI(HjEr#X+EB!=}+Xpa5BN6Q)Y;iN}phx3hS_~1F{?c>;3PwCqJEHJ~P_qGv-O}$4H zmFI8Zc_G8T-C}Baf9rieYvhH)%OsUuFs3lpz!)Cu zC|*2#2Z~nH4FdzP@+iY2G-08z#Z~_lq-+9-aU4rQ3El|kSeasRmSct-*^!7Mn%1(UIS9fIgw>1`QXEEqIP*|IGl~bJ zu>y?-(tJZvTj&GYqG%xF0i{sj_#5+Op>JSkIUsI|YZ+)@U_U9vs8MY)t=p+GU+iYi z67DM%sr?@ZFx$Bhvi2GjHs?klZMC+873*(g8;4?cd`rMv`MULrM_b>qwkhXpmcw!a{Y)_sG432;_IPx+ zv4sp(#%{;PfJMZMj2m^79ZN4>fq)q|=l25eUJ;rj>&o?74o7q_^{ut-nV(;pz2`L) zOLR4LsGZxW?|`fxkK}`^%@?iF1N>n(sMlogfYCOa_1J)_iv5Y>3g?x~nsxVjJ+^1~ zq{%DWHLfK$lx-wrZIW;4l(?S;4y7v%B%_l|YEWB*@AKGC_0ZqO-_W6fX@46I2(=Q3 z!f$Y9q%Q@SBJE5~9QOOM-yg>9!~J-7ds|G&Znqno&Dr?m<%@BD|1iFK zb36X;Kl!uq?2}K&pa0;?aej6-e(e{2W_;)K7vt*keB9nXjIUq49-n^ta=du{Z0vRq z&g8IKkI3ouA2s<$>ODE%elF`v+OySq z><@BI$~pFP?&yfX0THo)XNGe`2k88KTx~bw>f)lXMv&J$g0kl|lSVa>nT9!~UWfoE zOhHGK&Y-YLiLSppJINyUdQWA4L1zc3OSBvOM?>qn1@&bM%GI!ai2m^&E4@iY-qfd5 znlOzpZxdP}5WnsI$n%x06)596#9{0AM9|?GYiyZg5|hRQ&|`ky<@3*T(<>QmNDWBh z2$=pL9qebNLt-aZ*tqXUq+`sQ=jPZ$l6(H-gxF@=enI~7IXK28DE1UE0>}u6-qru~ z{XaO~KkUisM5r+k2(P?sD0(TwqZ!Ke5wJrKMa4kx+>GAwacmPsuu}Bbxd>3enN$pn z5f@7+m9q^Ul|DXe@Ab?Znu^p?%_%d;<7epxiOb*DE-AT8x0N@)2p^45ljb;%B2X*UE-`UI3rBTLeA| zSfC7e2frOCfcwK^18xKF0u=y9g{7?Aye0v0eF4CDOY*I1E1{>0kVuZy^ zakJ=my7WR3NI{d6`abKz(V#V|U~>nzLtIMm8_qyoJf!j z8t2oIF6jp;GqJ$hTO5slpN&Qgod^`^HOg&>0+Snz3dUe~asv{}Ku#Bi6pOW{S1Y|` z87{M#bs1~wOv;kS$j=`@4|Mc%CN~nTtI!z?17wee#X8euj2y^j=HwrC=rx)wb0Dni z_xT70zLaxEHO#DAH03xtau(MK*C}=~Km&H56^q=yV(zq(+E;DjNFB_9P?PX7vCdC5if%!K9T5Gf?u}uVcV2iO8}| zSg*!rvm(SDZj@q9eLc{cv?2Vafv|NbA3PoLk6U-+3%#*1e+oO-yHh^m}z*5ldD zvvIaL8yiQ;m$+o1r9`|?KSd`C;E6IF<6(c`Ghug0{-v+*nw%6pCv*X#HISk02F}NJ zJiEFcn=?c;aecAiu}c{RZ(AVPL{T}@#b+$Imqc!98f_aRx2HOD;egog3Y|M*N#Jb; z-V$6<+fo%B!8j#Uqc6&C&5@6f2vD4Q?&``===t|7P43R$aHq6yEII6Wu$;}OE*ApT zrQVEW4iwu-c ztv$)o9{0>-@~vP0y+1zQ-Ya~#JM768kOev-Wk)PA?gvFng+hlT6KDf&ft8|0nuVhb z7M?&VF;hZH1Z6Y?0zmjd1cE~2C;%^Ok4vo8qf-T+mLwc@%3{Kp zm|5a;nGMSrTYm?nI2CN=B!JlIFiY8>R{jh>na!pdBgi*@}UXF zKQeS;+X5Em)E8|!&4HK*u|Va3RAeBj9GIB6T&=h$=2rX!ZU6=WH}iJ!IAn0l)Y+m>`;(J zVtz+664uB{al=yNIUT7eu-mLQ(7Iy1AS&MLK4B zEGoFxtt_f#W{=@5Ysx}mjpfYB*9%+7!eL|si|=U zGM4}n_RMH-0L(chP9d3qb(qRH>fHA;t67A8oQnWyJ^#$sC0&Z?M3gzrl{CKAMvz;{ zX3`OQvLb-IN{CDd(6*C9dtjBr2#WX53aPLJ`;qei`{-W0k@dsc%eex{gdxJIq|RTD zvE8hl8IWs9mx64A0}=-b_AW#lW!vdlz1O^tvlotVQbb}YJx4lMX;|9uu?6#1FJL!C z2Iqb9H~C!zj0gv*;>DfnQgJjt_C9Ts*IqVCBKI9-=e*{eGOS z&c?;X*?9Tv`8eO6>&i@zj6)HMAd4Tihq>WeU*y3m_b)7kfx>D{*2TjqM@jo3+h_@F z+cC01a-L_LNk)n|X0LT}c%6>W>cbAzw6(l-l$z$$x(ZwvAXNUMZD7_}_cJR@S#|z6 z#YoQ{1okau{IY`Et_;NHW~WD2|`dQxFsGi`N$tB2&?J1nK~2ev0t%B0hY zZEvRoW2KDJXgcL7fZ5Txq|8NeR!EvEg2>9UV_CQCXTCW{Q`&`>$u5O9AFnxU>~fZs z4=-meKyJEe;Gwtug3OlO~6VAXo`km&MSqM>00_bDYqo#Ofq=unSjd_ zrxr%epmYZ!D^ui*slu%*BCADMO#tR6`L)3fp08p`A6&|?=E+;6RwU^@?SSaxnBGMM z#A{X2ua7uA_%0nYM|zclY<*$}9$5jvIgf`uQ=?de$t;X9ZtrfHqWqUX_;UQeU%VQx z-ro@eop0ov;=Rvb+>F2XtG~dg2CnnNAALRUVQwEE#}_|(Jnm_|9i9 z#&&Z?z>i4C<>k2@saDQ$xH0CP$-+3sA)I2dQU?YM1_y*XYqBHE!(XpVHcGcM0<_za zI5P8e=8?oz7 zsbBPU8CP! zXCbzY`{01IeP;-SfDG9!V4DbV2P01Rd(YP->$WM`@6?6={r~ZMM}SjUVF)n(!yDV} zh78Li3zP;O5=_KykHG;LIvl+Miz9==o35aMk?RQK=$Z$6^vVsJ1u51_V51mx7a=A} z!i{1~6@wPGhhZV6DQQtsP$agb3(s*U7XO(r=V#4c#ZZ?z4QMhD$R;l!7f+swQ7ISr z5ewGffpEn*N=%%K+XECm7mT_rA}C??E)0(-liW=F-nXPRLq7)=L1q&gM5{qh*z|mnci)GVa=?K{{0!PiP z$NB_+&JhsWRBvq6DQP@C+e;<}Ql@A^1Afkp=zE2%%X3${nt+>GYh_tgc(fdxf{}B~ z(Rywg!i@jRtTJ`RX(v`1O7)TApFuQ4LZM|pXMmiIFRl|NJjz@8&TPmDOC?8AGNDLI z#(}7!L3cu>Vf6X&fF3`iBNs{ykqou*XaEr~z(r>o<(#giIp#`KeMWpN>j%q50pbaC za81jNjCppxkmo6KEW4Gw*LEs28(t;rarVM+c=Keu zN=KS7S*3ny9yw2K#p{C=c}hW()6($a165;kaN9Xn4z`{$jJ0G~_kix>KK7pO{Um2u zCJh&d?lG$zaxcy>hD;qOnF?r#;a07T3S5?(56CD$p@T^=y63sLaHUaA`ryba-1AHcxkkOc{)GajB_|3 zu8ripaNQLFiT)W;~j18Ky?(}@b3Nwp6$>HDN zSEcw!(4~c+5ZE7cJvksI2`W;*#07J0L}VZYoGLY+{+S&RYpnWUpa=fFd;e~nq4CUE z5z}Bd+}+)cS8v~pzxb;kjj!H6jJw^Q4#dTJHGcMIJ|ACv`Q`ZK?|x_e(l30M^ZEY$ z?YQ6V$E(-x$De)i<@oabJ)O^A`Pt9LXV0(sUF5*S`S|XqpN{PXA`dF6FA~(y8tF0j z2RIdvY|evctZWBq%5enNs%XcfuoxmkXKNA>`~7aLHybw9!F#}8hr?b4!f=ky&c@Bf z<+wV(a6QT?luLsUwzt>-9$m{|1c7YVNjjE=k{dAv+ziDk%oMgr z*VUckM5tp{QI0k;x~;ls88DksXN?IvEg>J*p8wqSg-%XPfSnyjKnTj$%J~&$ZNpY_ zK6%|TLSFEdQ^qhNPZnWAjHE9>hl&o94B-63PA;s=(N7pq8g(-I5}(6y&qC@HqURnd zYLj6VC@BWRkqdzsjZ3A+0rPe;y;0QR>?D+K5TNg8>$QT;U9$$+OnNGT9u(@u0a324=ZuVE3cZvsNpp>P<;K-kt8QCyHs-?INx4TS^({`(7M36kc)#laV*4ok=bMMx}Cz*X-%76K`A@sDJbD4u|fxv%aQK7ov((U`Yj_Qq4G3F#_khk##8 z3hT)}o^zRJM>0iyPMD~0JAD=}r5spo9?pp!FX%?5(MmB?pAvN$wEJ#-C)eTE0%P;_Jx4noQIb>9AgEGx@tkD*ouc`u#sT7R z+5lF1)|50Sy@bK6*}*SqK9+#7QU?NdGLi#p>0l(o3pY6+{C+Y>9fi3#+l)&v=IgFc zA;Zfl!0Xa)94qTLT$ny7bb&=_+1LcFjWk?H6)X-xm!s@>GDL^ygxKIOnn#_IJqs)H zZT?92K&3eSqz(w=Q~BtM+7ow}zzo4y>Dqd5+YPOslAu3yLPE$S0`lP#NxuNsyn6N3 zc=qhYc=PtH_s43yyS*E?clYCqAH5xK@9xLXfBwn1zBnhLhxvT@^4WNCb3HCEwp;^r z%X--F$KAtj{NRVL#~=UYm*ds#Zv4u3o{#_JSATIF54&-Ww5R7c581KR*QuLH+#`w{Xm(TR4p8^p_Yq}fCEP~TAmMw5P&ZSEIp*}`qY{AvQz z*iWt~zQaf`e{2yfPqQAK-d$q3LWAnM+7881#^N-{RwV+QDC?2{Ylo?0NPM;;5+^cX zBIRp_jBjQ|{;PSy+h6C~v-5vJ3@wnSF3<-sS zjRvCJw6%4ji|_K#_VUFgQUqCJCa=R%EUPS0zeYC@F(PC}?X`0ARtwOc zZ*4er$SRM0Vh>q(8;8qISpL@1w$k*rkn3V_6ec$NPYPLi&a;yhL08v?CXth8?#qqU zqmxCr|Kf>Hpq3=F94xjobhut^iCdC&o#bZ?Ki^)r_KS-Kea79KCTAh zQtGBt_^`6u#Udme8ZaF&>9Q{akkrVj%Zrdc@sT%L*a|YvY!@vsl^+&uJMDrw1+tW{eyv$9y9q?r)}8T>%SFt7Qfn?}X~V5av42BSjMd5Ms;RD(&UX%EUt z>;m09wT)kVWmbR$2MV=Lw2y=G_1U}IX{ z+Bex({9bQ_GWU2tk>PwMOPMHUJ6mZVZTV8y5dI)#NxMs?Le4$kF~CcWiUf&H0hc5# zEEN@LV;4{@W|TwET-kB1PJL!M!%rsas>nh1s_TuMej{h1({-sg!<4#xF6M@9PhHS* zO4{H_$Ryj&XnUlEsUqN-57(VmTX9VqyE%I8G$(RisvUE>70Nwl3*JitJk$XknF+wX zn*4q1dyFX^vRL;(0Wz@@LIK^iSa;_roE`dX2s)qChjLW3#%bm2h&e7hfg1rt?dPWe zdi5>C{F** z=bw(t?K$-$u+jb9j%#rLa6i8K`tA73AAUXl{SRM{+q>QP&wuR~$IpNIjA>8LZm!1X zFJCh1&=|-B?vxY~cA8lzl05Ie*74ECI&arN001BWNklv6F~G5VE{I*8M*d!#LQG5B$0`CeQN6E&7eMG|8_l@1>JAnZYD zm9303X`DknIuV|ECN(}15i0IgvP)e@xYErW;`juoFr7T}VVfxapqsGB=9LEjz*=Bj z`A)nQ>SEYNT(ctgoyw#VF%g}*ZR|=&IImOE0sXnuZRoj-MLfLPuf!sJhyp-uwYup^ z@A2ghmvatBOu68gYYv~>~I`cR~HQFVe{ePANCUL@Laq_r5`EOu1QoMeXJnT zyTHx|bkXpYf9viXR)`57sRlks++ln#TFia})D_div|XK>=CFSvAOf};S8ZzxM~B@r zp+4VZ1}OU8Q7SxLtuf=I+U@IL~o zsYYkwR2lx1fOg7)=3|+Eul(m|GOaG|NF`D_P0klTWoL+r%MP1Bk#nXTL`(jo?X8_Y zD`uY|!Fm`*iL_+ebZTX&jw%Xg%D8tvDb>qK_mGOVOi{3!yIk8!P+u=ec0Oj-tGj6j z@QIyp+LWhC#tKeLq38yHULt)@V53=a$zP{CW*l}h`Gute5@jTvI;CVS3fx=q3RKD{ z@w-{anq$qWA}!4j6}YN%NVHoU{8<4TLX`s&;Nj?Kv4oYgteknJ?kSpOyIRZ*T9MNz zIr>v1g!z^{d*o!+fdR*slrB@pxSW2(@5PIX9TV_K%ea1+gLz2C=xTVg(diVbQ`0}f-X_KElzZtuS2c|21@x_-+f}P4?a4DUSf3)?z|NroRs_)4y-C3BNLZ_-KJ!ahLAuTe zuyjc<%uImjAv?NVnHb?#7V;Fso1+>M0WqO6r6w!+AZM+FBn`RJ*o~IC{Gzs>${RbJ0O@#)%LkD26bP`89)Yvbn#uJ>?``CdBy%k5meW) ziYUT(r&hidl-GM4C;t6!|K<0OH&<6jD^ z%EwdQFi(TB0SW-3ACwL(6v$?8;w>`jPxc4QySuMA&zB2<@B6$C8eP{dFu&G77VML< z2LiwnX^^qh*#!bXXPb@KP8K$5(G$|AF>{23Q*Ys@0#pOJY__BeWrEe<%V9(ckd0+< zl$qxo{*qdh0Fi(<&J#Lbu(cyjy6U1sF>;+2W!Ib9LT!K7ZY?X|$vPjVIV2K+t{HJ= z;DDlSUl@%w^G2D%;T?`S6Qj5ctwx}XoXUA9*3)SLNe|OTk)letJw`Y#4xBpgBs#Cx=4;Gq=Q-!1CAkFnA zC(NT1c-$GwA?|4)#e0jIUw|pG3#!veqX1rOs@Dk6m%PpjN}c5>3t2-uFbfW}42iS^ zXCd=xpp|G#=8@pP0HleBiyVTZoHTJT8lPJ6!dW$;mDEfyysH&!KrYX> zEL_I<5ph72W+E_@qVuql0^9VwD$1(sOFkJ7u+yB8}X$MnrEB(a()gKED zuz*&lf5b@$CkQt_XRUnW7r)_60#lPk0zq)rA9-jlZFHrmdF&aqfh?UkzZTXtPEx0X zWFP2X?7OdCeLY^keK%e_e?HDhuHKLL_YdRM>vud5_RoLt)%e4|dNs~hhw=_~+fHNCnh28FM?DxlUdw0im-Fy;gD2FwO0 zgkT-y<59n({qAFGe( zpi^J^4hw!hkxr-gDC&{aCfVAg>Xn>05ld1Wlo2N!4!zEb;yq1H5WA!Zm;(%=Xh)j* z2Hnwo{DU5;fq0%vY0%PJUE31mBHNQXvf861uQ>?15lv)PdazhUUPmPe?O4q?sDGCw zqyuR#wj6=z)50J+V~aIH80QnInK?*OWS(?Kh>c)45+}62a#o0grI!61SpTVL+;@L#$V6AAK%>0G+|OLUuUmy4u0e z%QD_6I>&dH4F?30@u|xFol~u>D#-9n4F@uQfp>fMlff+=YH*{Fv}<5;c0+*0!rOP7 zQ=wExMtlY-WlUpD4!OWypHERhX>vjoLe`I7meLcWJa^~PXDTI$_jl8PDHT!9Q;b83 z0>g^xPKo%H0(7K6-)xqu-q(oor^ad2l4s7FsR^2uVOUx{qsL$pAb+cnyT2ty#_2p! zkV!9)MAUd1Kt&$}^mdo7q{!6$>Q)UZxBukc0ONS#zKHFqAN0TAc_oQnv2Bjv%$%*bTW93L;jl<93#^5G#Ds(7= zOWBN5tQqP@m_SK72To~Q{&JBPR(&N~0v}0DRoFvDFhzTz2Eyqk(rYkaaK0v6n%ktV zF0wQ`^5H*YNVSI5;@6Jh(muoiSrP)$QLb~NEpbgD4zWBAg4&DoE!*(I2?0SzcxKY4 z(s50CaV8Qao1A~mnF+Scmx+RiOT(t#wKK^Pawm4VHd->V3s>I} zRHTj3z4WQtA!3pdQI3iCE3!`H+@OY6V`Xvs*@jLCa6b^H)K6X2yN+!G}p0)Zoglz} zW;nIo<$R|mk2XSq1?hERd$yx?eGZqT&C`Mek>1ysi1CX^OJrR~JL?`sSeQnRN!Byp2M(d%DLXQ5C`Jr}>`2BP(@q_lhmi)M8Ci6XyrvUnb z89h;mB_LK_b`}=b@iKLEuwhXY*8Fcf2AMURvrNC8Njh{o=%B*VAGC=y2+uwgThpm~ zJ^T~rqvW^88lzc`la1EwOt#|eR8un79CNp5%~g3wfE%qokdhOpEt6GuMNY`HK$>(gbJU{( zNm;+5FG__Mm{a82I)a3i>lFMLu)jUt?;N4IX84>}n0zLwxxGwb;Pe{t5?`*-ho2q9bF?sn|>d3kwN zpy_x1=ugJuem8C|aeZ|)Zf>p}VO+5={LTBj z@#@W67K7uwjbHx7?~YHNzfkLC*DT#XJdC@CdjdG5!6T(h@;pVc8IA9zFlZP<*4-_i z!~Y8pshcBfc73iJ&jcY6d7uLVjB|m`UW|ln^~_w_Z+1XJ)HGqzPH&~yTMxEA&Vj39 z6XhIBKPyGNiIU(UEg^uRNeHKb8kJO*O2)x?I8##*$WKzb^hk;POV$&GF5J~7wq22= zR@W=bz0rSJAf}j(NO6-WQ@z#X*SUsHX-rK#O$1MrYWt?%SpAB(Afw z!|Vf7!O{;i@io~^EY69ZE_rN&RP(7!1v$qdmWb&b&E*>+SAg?0mX&cP1=sX{|5UEW-qHEB1+q~R?p zn3Oh3P+CtmYNZjgHJ}?brRS7$-iczB;&$kbotCPlm;qPe8I3J@pK`Y3BvjfX{=4E<9hGX94AM)Ma$YLvkJ* zQ45&y{?~g3IM!oI1rs2kW8%k7SU&rwowi<;$TC4c=ey4uA;=&KljE9*yQREOCik<3 z&9f`mNA(m-*F*#Ms6ekCT>wzdAO8c`A46$Z8=VER<#}3);3aKAbFaCAbJB#1>|*MK zqVw&eH9*Q-d5oM}E|7F;T4I8UN4GHAj5TT|T=?$KehgLx$V(>(FqEre{UHbB!@c;i zYd-b591sz5Y8QK$8l*^Pp=%V7u)g6-~D9VTwagOb~Uc9u2>(7 z)G0(SVv~VU?(cWw>o>1?UdQ#-&3JxuF`hqrrggH8xV^s{xAza!=_m}xVTEa<+`9tv zqvClu{RENTKXbH1@*;v!WQ1f6*G5Vfo;&BzP&UtyA}9w$dLv!iq%TV@KeDK@q1JU& z1(6cxi4hCg@vxndJryQW9jfnT%(Mgpoq3?_4*wlV_qEblHQhc%%DMAnk+8vGOQ*G6 za3PD}s*lNWQ!2D9wT@+BrebSF8?twrY$idF6xrBW69&=w)JxWx8CF{8*4Sp?^u&M# z{GF=pJY5p4>`ax*H&*)i-nIRz?43N5YjnJ5T%*DTqN8~qcMz5S3wCcyy87>a^Iwzn zK`x?N`l+K$fncXfeR_2{ZZ5auZnqoncR0)kVLdTFDk6(nGh-CbaB@Ow0m+beQ6|B7 zRg8meR&*l~7Ag6#y#`uIr*f_!RqzDHRM_oa+GXHkc#(&xE?x2qHD>WAr98Ax6IEJ@e880QAI*g_2O5W!>kJdIW{M`E&p0U)A2`!R zg0hmz+t>YA$6+=_Yn>k1DY)+SgR%?gC=l)48b&crO7LCs9oyN;$q$-*u@7=g!i1)n zZ0=;lV&F*=3GkX7o>&Emo1ufOFz-XKnzo||S}(Jn zWoHL&p$w`QXV)=BUb()h-I%mcl%PzRBV+-WlL8Ase^MWY;X2W7HMWF+osPqtTCZz# zP}Wp+Hy^g3Zuy*|eJAgvq(gRkhztRn7BcE1h0jU8s`YmXFA3GkZ)XB(2lQX$kzRnp=c` z4TRD?8rb>>^a6qAVB~|W9h&!bxDW9Gc9M7$`mN_NkmMI}XqtiSRLh5pGFRLA#mjDE z4HyX{V-&;J> zna<5Z!7p3VyBlQ7oND%n7u{|`UD{buP&AMK;9W{|p|Fk{m z_k~eF%I(MFc=zshynXwQbs5jDuVg*^wRGQuo=Cgk8Wh(HXK6u3;jrv@S~}`F@HcP; zQeF;wIRdcyNY8?9!FwTDQG@vA-Mevnhl2OjxHvx>FJ3$wTiBIaU+qEcV;m+J=*NSG ziJ6>^o#Rn$`$YT}CChrpdwk~+jbYB1Cdjke*pwq3@)DVI3cMwZwVqY~__WL@>J}#< zUGut8gVOI^bKn#^0c6#vVxJI?6^OMXO}p+jJ|SqAw$)_G6j70>GVV!cg|S*EcuxA{ zBM}ez;UCt3*gr3ukhZ*NZlJoqiEy8YFk#Lwj zAm7DVA0~&@@zfEaIH!zWBehWLTI-y-@VYOsgtKCmwbV_hA{nvAae%4MS&XCfuL5&% zUjOND|G^PORd){$EJlup-nrE1S3bto*?L@^t=LlT{SG0<9oyDwaYQ;rEwcC-#aUrY z%>HWflv|wa-UwZs3|OTZ4^>l=82QD&0=4NFLbdK5(kMjFHM60m)RS`M7Q6u(W&x^G zmWu`RRQfIoZ9bXrhsSIms97W73ORb<2E$2)})2hZ${ts75IJ(MvCe^%?(Q8-cE+7 znhKiz6VP`b|J1GUObtcTs7K0~=>`z;%Dbzh`~;7a*Goa7rE1C)lp#~?5xyb7Ge75Y zo&vrpw+x%R7@LKQVbI&4u_bva1lKwk9?{UCLykiNavU4<X-Uk7gn6Shzt^u}_^>Ll8Sa?AW`WYD9cD-z%`X?4>5R$TICyQ!bM|jJ5`# zL8=i!GSZ6S5UmE&!W5mK^}0ZLFjHzh!jl#uX&a+6zQX7>fSdQ>xA`4=?%?O8+&&&y ztAM%)H5u@M##_u(I~v^EaP(*sf3heHo)<*wo7Zp0XD?q8kWVxEZHE8BXRsGB?^u`D z@7}W31b-ln?E2=4H7CiFhfutK_m1a|;J>%8-;Dp@7k_@deDU1iQ~Sg!x6;#;;;Xq@ z5(MrBx7mpHb(4;eaZJ6Y&##uwh=8yqu!X2v&dxe2(Q*^7BE^wYYXkwi2Cn$9;%a}VipOIt;jKL8i9J)Zm1g%NRO3ukeaP66Sv)XTF| zGlT!91Y)80mPTj}UMUT1n%8vkY@M$~knbQImE9>DEu7I#K;Nv2`%M@r1170qt^1)V zAu~(j56Su7_axnY+=8*IB2^+DMEh%jYyI{tCM!=e^U$Lqy3=Tb};$_kRBf z1@OQ#K4dH@{!>UTto?R1#x;tqj>qwESdXjA4a1PHk?Z)d(?UBYeOQfwZ7rt2hQJ3s zMG+H#*sfN7o?S~h0#dpaF|cP6MvBJ0+A!+CD@Gv9bDDH_hZ7evQs%lF0=>-?N7-29 z87d_#+kknA=tR}i&BdAi&PEbgw83Q_yV4=j+n#eZ<^G0oraiZ(9s%Tga6YPUy#z*~ z8$B~~aw#N9{gA-O^X;5Vb$~LP4@QJVN&Ns~hh6xbwOOB0fD;w*t?F-e)iES`;x(%?xa3Eq7 zhbNtoqObxft7gWNRFN`zcruz`Z)c^OXN=*=J)-Qx1Sdi=I~Xy1r%GJ&LSfXBo-iyW zr<|X;Bhb@8Xa2r1S|NF14p8;Y}ABQ3ia2Vn|KCc_Y*MvwwRXtUT36q{^w-t6m%q0GE8(=#oum_Bg(*Z#Q zL?jKJBX)GOZhSWe%NWS`*I@ z5&VL4#B)g|$DSal9B@gyM8IGpPMGWF_D1=gPG za6LR1=MH1G(x=WoK924AmQKkw?W)@y`^Eu~^e~u0RDfM2V^HR(!;gE6kG!vl(IXEh z{ENT(0nZ0{_UvZd++2<8t7`&rVyq)hQNL#@7*oRTAI9@%H{<2=>v4I0X+lw;8PB{& zCoDVsP@PJj7DnToJ%aCD(b*BnDMc$%BIj_(fZ{czZYkoR`LFf1Y?#jIXrVt7w=+7Q z7}W|XL}y3?V39cSm}|_*oOYGFGisDhVziGTr{H8M+dvV{=&<0Zq`!uxtxw8ZTYkx5|_G2QWbJzdBiY-iF z&XM|SMom-LU6trd^E?eEAS!YIS)B6X=@q+3tb`r{07eTeg8DA-y56h$1<#lM)s7I% z&P#kb)y!D1bB0H7Yub{DG80fsu_(rUmKMHF1*1_@9Zk(?*wdUD-~}g3I)y#~xS5(n zAZQlV=n#w_J=78wBmbn-<$xY51v!ywo0s$=t&uYzqYVv{<7jCP?LtD|HbO zxn)F)ia7NG$(6SjXdoxwQfXM)UVh{XgXS7x!KF{TZJg3l%wo7XgC<9Yoi1j2{kzkO zbevM#1ROt9Y8az($Q>1o^W%`Iz;J_A+lp?5fqY*Mb)tw}7f{O3Ipy3&MzD5e7=_G9 z&$+hhsk?(2=aIM29F(U+(2~!!5z5+Tzn(gWGq$WWxk+=EBDEfsW9Vp`jfc#Pn5%_@ zV^xtTlAOKR6Eir{Wcuy|x9U)-N(F6D8^29rjR0)wTB<#>zFaeXkUO#*5Ro#0C3-e} zz~*E+A3)#dC&(+fUdHt{Nxuz&)I^LUw*D>-4#WxQB8n8LR&?G`de@afMv-=c0}Icg z*I`%9bh0mZX_iE4yrz>=qAilPm#NWP?up({nyaLPMg9}*h=EON2rU3@sf$JrN?k>o z5pyd(ZWLxZjWa-G1D&o0eLdfBy2>xPEp+ zqAT)BCK(QyW1)x=i9i6Tbb&f~(G}Z2qoZlCNAz!{(YbjG)5W|F#9RfueSSn-6Fb(W z6He?{IUnpU>6A`yL}9ukvySigJ31g451k<6J09cUbojE9Bn9<(Ia*E=ok+4-9|x0a zr0?`B zWmmBSh&S7rsptr8w*YOe3)8ES@{SrSJ)tm()6#3*MW*upZo*N{rfsN*X{G%!3eCMJ zLS7^7@&erlsbz2?eS`zMunKdkaf@~KKmS+%_ISHHj(4{YS}fXpw;41TOS(yB3qxg2 z?0U@&l)mOXZVz(+MP*Nu`GJm9aFAhyd`L-@ir6oKI)%rjh!8@yOc!{cjZqnmf`sj$ zz(|F44vV6q$IdaPvr}PgpLyc0C$qu{sHW+g4%6#=vE%^<4cpMg;VNND@lxtZbe9xb z#i8*`^upTf!Lu`G(uR1BmN2!+fRwq}J{XchM+DCH6Lr|67^P4p0c8>3I7&ttGkt+8Lfh~?QCRXI1LUY>h`h?C-E9!b0?j|y+vM8S!cuW7JQ&Vd% zihd$2?kJ%-3=Fe^s6N|TH?SKzOi@ZLjLU2^w2ialwUAMY1yX#vaQ=>?lAWk?Uz{E^ z)i%_{LK4)y1YQa@Km;~p0enp+gL_4qYz>4d(vWTQHNIZ_x$v_;qQXyQRm z)kJViAS6ykt&meqV7`CLpY=`{xA`A#w%Wpt|UOcKH!Iz=wk?WDAErJ|}(IeJeHLQWc1#;FWe*^#MP zfl{wjr%-8x;-=XhMIy|kqi#5%2L_nReW+!rHSE+|-i#33p&xDWW zz(WBXr#0$Be2Mmux?X3A6dA+1J+}*uV;TqK0uG332aGF}Vo7oWy4*EUUjN8a93X<- zz19(h(Anc+c|{Vacva7iqWCP6{c~@PxzJQEv4Me^Z>%{$FxKy4yK#e;Z|8zwjAUGs z`<~5cnUPL$ZJrt05Fbn%b_ycu9#s1#`+j|SH7-%0{x@(Oq>pvQ$XyNRr~btNFR578 zk*q63i{|xaJnSCE{oUQTy1pJb-{bE7VW1HG?*4vUT%gAGVq9Hajx9i*pEEXE5hA5A zMa9xde?%uQ%+2GtI6og3+jBaK1npGfA{!|qPTfX*Qh;sLpET8UFrb}zISMiuC3m(Z z99yEd{Cv*Wkv!4PJ|4&I{=k#tY2xTyq5cVul3OjCLzBF@@xdaMDEd^36wW|i)ID(j&&f^gb)or+OVknSaYtus@mbg8Ou<_tLk zW_v#`Q1nWf!+D&s1v)oOSsPkUIv|c#DazP&u~uPq@N;E91^$H^VLGv}PcoV^3(=vf zU6!omthG3uvUk!+5@5;O>L35s?;ZEY^?2AJ?3wAamzA)$&0Gw=3h$IxhV-3y)CxuS z$=5X2F<=I(>?YzP+&R{Sx{U+mq$tddFQ-MY2A6a$GnB5am>I+fs1$g&c+^3KHdNC& z9vlw_?%YItNKQ?Abz#-oBiCeRBUFl6qAUe6yHgT3fOm4lncqv!a;0l60lyrII-HoB z7blw12;=KMaEgUzFm!f68vHrJ;Rpzg3D3faLbq{n=ZvKGNJwDZ&}qv+&0cQjC_2?6 zClMEm5N|l?O>#V=1ftObqOevH$h@NiyNZ+WCX_?fz*}-`(3ivM3iNgw3Tr)1(ywF? zyZvxE3oeXS1jAjY*xo4J=H$eLnQwo?GBa(!+D=lN8ZE(BpRk^BaM_r{pIK=4O$KL* zKp4RbWa?UA(hIQq5_Kq$HbpC@DHlHqflhT;7cWMuSq)!KPRqTXYTDz0!`{o>B~!~q z{W&>OZv0TsSL#{&c8-$FbLrh@Wt9dPwwO7r%b@G2E?f#rS9znI*M{@Bml(p-a-H~Z z71hg{N)q{G(Q|f`OJ|g;VCLF#(9e$74f>MYYq8Nj!TP#Dx1v2BS0X2tJ-a=X(j`C3 z4G=5`a`Iyqv@RKcJ7r31)t)mv;D;n@UP;#=CE}!glPk~0y9f&!#mue2(aHQN1=p*d zwIt~x;bv4}a^XZQO{berOd<8Y?SYV#CD-+25~MgewvPA*DN|O*v?nFMQ*DXQXQDoi zb64jeDLNx($qtHHU8F;SvA)>2%`Cp_6QCu3?S*NsZ3i;z27gHDQTmrwLpILQ3#Z^Z zb|44c`jTKYHe+g1A-!*gl_p@?d8{LGROed&|B8G}g|`8^HQLB*+Oj%j5i*zJ^vDhL zIJ!z9)rg&|&fpCF&FetY+3P7_SvJSo<>`N{2Wt+}0$B5l+7{Nhfb83&@LNy&{`Qvb ze?NKol5>o|;d~%Mfb~F1*wxj=xP}vgcKe=xtUu25fU}7PG7!Xcw89#~k%1hbo$%G= zr87M=a%H(WE#1t2$OXv5+?|c~&}1BCJ?E{2sF;j&93$BvlLRK#xTJo5j2-nh7+>%s zn>B2S&xICj*! zM$rp(Por~C#B&=GHIgEWSB@%cI2;)Vd6fwHOu`jmna;A76*(X{S1{QJa=PR*nBc)@ z|A*iFSH}Ym*qKVjW8F7fh{56|d|Peu*YjA@ORuI@#WglrOC$0whQHB2o=Q9|W8 ziFMMZ*8OLI?)_jOF~JD=R8&u)2ca$<4g=Y0kUbzK3ZM0K3HV*Ni`hN^wB8DadXBHyz6AMm&D?u;xpw^wbolkf`MBKbv~;c*pDBB*_j0?58ocC4 z`b8-w-bo%K>_SdpClI#5e#k`_dhHc3Bq9SH74f~;!AH01!2cwPX>o2x5=^w{^04CC+Qi?y zF`b9wYjIyVYDO!Y8j1;vP-l35i|{mKZ_=d3F{R7a=Ux9AOjmLOa*)wH)wqd7nWM&{ z2zvWTr%1~*77Pa&oul{U!07tzp6CvFMB4<<3)jZ@RGs;zTCh-2j-X28NTCadt>BKZv<%^fU1_f+te#rU&eLWG zgo@p5Z7Iotn_@O2XbA)2l`t}iD!2n__lhrc-~!4L+9|7B7Rp_yraWOdMVy>wk&<67 zr^I>0Ww^vxCA=?8X>-X{ZuSmOij*UUz^9*hqk6U&RTYIRg`iJh5Ac=nPf~QEJ|*aG z_vk#%L;AZD@Fmo5r!NcckXXWsWR_|J$|!k{@{T+?)7kR;9KpTAd0_%84PkaAQbgX4 zVCoE(&t>4bFyzjCu8kdK>uu;_UjYDh^GdqK}yWFjCFI4*;i z?pp>ZX<;Ya>ekb6rrOvQISd>Mp}YxV|_dN9+}UhpCXY-VmejglsW{bM5^5=y|>KDhT@fVEb~wI_n@BEoRW#gxKYl=C}x9( zkXTICr*ojQv@l+P|I739afMd1F2ql*Nup@cYXulXMDYY~)EM}jBX_t#?Fv>EXIe0~ zo)IIFi+Fri5`>w4eB@ZJ&d*6;%|8Mzny&yAfN97C04+|^o>Tjt+A)v>0P=vw$VT>Z z+H7;JOdb^x=yjAaDZT0lV{ab!DKsp8MM`7B z5lp$jY2-&nAn25qq-`oW$l8NviLJFeI+CLs>S)Z{=0v4yn7tu-RwmMomCY3aAZu{5622bxuHcZgYx$ zWsVd9kda7{U|AS53>~5(+raS{0A{1n0qGOl(^tO)DF&G|sLU{~QJr>7H$>2A#44&R z1=l~>r0AWEkUmc)EcPrB5T;EqRatY)zVPg^Y-S#X*^Yov>4#~G?l61RovPLXIVtvB zq)-ImHfXI)z-O1xCMR4ofcZ}+4?i9Ee+osliDsvW+cbqA9%nXK40f10-Jf)d>prBk zy2FR`{)uSD*OAeNX?Q`Yys6;K zaxrH>sAJg_9h;?tZSTTzn;EH_1O`megwzmKO^J36>o1}JEq*iOC*`KO&F|%;RGq}q z>SIpeFve(?vyr7gS!ls1M-&sDCR1Y_^i&bLuN9!$hH5#Mtm$cLR%EtY3%2}aO_`}# ztv~G`$0Vk;c;wc5U7IG3lj=US2eeq-?W^~>oFb>{c`tW6LwY1~wqRr@gS?Q9*lKR# z+|}#Py|(O>rLQQtP&;-yVxtmd5@^&p04@8K1?4!ky&5yjwnk0}otDSJE}8h*o(s_Gw2F`a!090X zOiC4>D0PW;MALfJOmpys&b){&dmI})&t}U#vAf?h3Ui5htCZ1i9LnG7n>f^O79qRb zWu+e<_v3-lk3Gq%hx-RQ6BpO#>~MuGw0qbyVzJvj@Ej5R2LOnZ$pN)=9vg6v05cq! z`-eT9TsW6JjF|)=>@sRe?#IJDPE<#l5sLIL*eMLxL#+i5bo9ZTwQAAr*1ePo*RA9; zQei}Cw#AkYZ^f*apimCwgu^8RjPc;$>bu?EjHn1$d=G0#N6U>bxF>k1k7YGZsX=($ z4rXjjHDv8{I8Br?2f)8?;@c)mq^}#lOg1OaA$-~Ab*bdd#1S7|gd6q|b>NBJl6p*g z`F3XTF-0Li+%vQTDIA}&2x$MNv*0@REs`Hs)BTNYl0s!tQtu=huCdb@_PQs%oVqz! zKp$J+F4;@9t5B_)x*pOgoAJiFF^>U)qdhoVPdF^C_hYh%cYghM{_waTYqo-eGSgxp zUu$OOG;v`IlP8yRKA>n68g~SQ^60+9aA2GW3uQRxnbT!4Td2l> zgtRU(KASoT!LdQg6?$Q-J5~rgvQ%mx?g&XD4JmfTeU5DFn4<1PDZ<_gbEyR{Wzk+Q z3!7}jlC?~ca4m@h)rbDMI9B=P`UzXdtCB5|m}ik@;7+H{`Ja``xRG)|UvwGRu;aZ+ zu&Q;)9-I$`)Xfr1xtZA_)uxrgxL3ETPR`J{hGDo!q+kX zXDrB7=#~ylH9HVkhCE>ZeJsVRqYte&BKNFen<4}AXR9-}zb2jK7Rh!fkjg+QibgMk z9!K0!hoVR32uK))DV@*v%G|VV>vSGP_&Vaq#wPQR4|}SXuH2*8hfV>Zv9la<9mM2E z56RIi)z()I6X8_ZdHv{IT48WTl3oBE?!A#cTFf1RlEAUZ66t-JY^31gG;=#3VA+)4 zs?R3{!0EI&-=gbDbPYbOQ!xt$g#4O_05s}A%G2a7P}j{4h-fhDYPZ(q3R4!lD^ zy#<|=++7Ayfvby4MF%+lf-ZI9i#t@3ys{md+Pu`7=iWQlk-T-95Wp>*mh%vDPk<`i z562X9#j3G}o&|P@duJlv1bU=v@cF|*;1P1bb5#&=u?^bc^zzkuTyD2htoURf{2l!X zx#!slCR(!3sE6P>``iOKhBzVp{_dVkAi8!z0FYX>**F4ndrv!z&mx5i&xgnbx@56X z`)tD+p{vUa$_~3sL9WnGnTPtN@xd6k_q%a-cgydw&H)EpZc&iFtgkw)yccFYO&e0bYF(IfcCgm(AMVEkQ^(xI1=$yf~l_?B(n1hCmRnj6aJV;IHL z>r9>>L*wo-jsrgk9>qR|C4)j%^wb@NtdIoQ#hRsHJ&s9oQ8g7RROBPmxp8L&7uac$ zbZTUx80zaS;L8JOrUU(8l=LVL6&B;9g-+xG*Q{ERDYUQDt`r(d8ECHMc+tQFjMr)E zmL$8CG9L15W7W7JDw^`N<`nDhc8>0VCC1=vJo@0PL_NG3m14vQ2pte@+|++a7*c4h z1_Yc3&ucj&VI=*G8DTbaipvvS;Nd=IQsjIzdlIlVvlepJroQ~yxF$=*c4(d%(q;%! z3;_Fz8;}v8;;#avirUEdhRyC2AnBQyS>@?Rre>v~&ovO|9jzGkxhNHNkb`n1lcS8O zGV)r$9NgyhO#Wt=gv!$|+FMb#5{ne_WnK+XiosC96~oT~`V(ti5wS!g62)+VuJ*X1 zR(#@|v*Q{gDt~tw5|B+dCOc4ECOJ5U;U+Z1@{|Je1P9Vj2+!$r-uE^HT3G?+tdSTQ z=&KJSWy@U@haiqmB>U;TmRBQlF*-|UMh_sFNim?c77wVC!_Mzc#f)JUa;@2*<#(QP zJP{NEJE<@50itenLM2Y!l8B-cjbuelXE78ieY&o4#icwCSM#RUOBY^rlX-qM0 z8mCerwJ?4{1Ci+Qii*UT;-jl0566=s(jIqBs_!McQE3>-7l&*)-IaR7Q4l&IE;g_7 z^&CbU-R+jHHSe}7k=HatVU(T?POOY7|9z>e60v2`H=D7@b}&T-=kugSgQ=5=`Kpln z0*(UP@G7NAH84&!nsih4WKu>GDUSmJfCo06DZ^;Ry4{TH%X40zPTmwH)7VsGDxYsj z6g;&f!1zO5ym|MQ`ts)bS|@2wGJ5(wKC78k)|Of@L?D3?O$Q)5ZBD0Vdw8A!LUc|0 zh7_XM2hNfeHJzsaA0r^NBZMB5Mh9$qG3qmin9(U98nk4 z7@fmm+*W#_ihx~EZ0ywgQ=3@2HnwZFKT~a+-=8H&OB1eMX@ZnbIGsLhlB6LD?l)^X zNU0fyLmr)*l+(ElyA^-glXec2T@g~Z2%O3B4Ys4*p0S2yxOBW_ih9tvq9P!LOGE&b zIrBBs#WD^;_C#R`r-8FPI^<=VbtIHvJyVedKcrG=bEcc3=w-#qanKDq>YQW*A*#^F<;}oVeF&*G&qSY8uhi}WqQfKAtKbi>Ped+@E79nBrxqtGT zzkhtcQ<2cwW-G-}bqWSJvibu22<_sg3{g+WX)2_{$5r$=yK`3F$zO~?^Gr&BQn09* zr=bqu3DBI3nCw@F+Tp<91avTiGDh8z3qy^N@_-`_O_L_CxD|4F$`kmbv5~!1mtseJ zvH?@%$uc>&?5AhfReRVzCrGSRR&T$g7lAu|AC z5Y1~FCr7tXiU0s007*naRFe*g^LEsDr`bLV5skft-54_GKk(yhG1)nRoKe?o(THQs zER-|D5#vW-?{pANh5NcgStUheniqP}+`abh(*`h3lPA1Vwaf_5N)-mRopcFbfMhl- zA0cbz;<;9M-e69^XvZaOE8FSjeWxhR>_}&QDx%^2B0yp1_K&hM0>lS~?eREv&4s~wPbU^S3Ao%Fz*xG>jvxzFJw`gf^VmO}ET;Q*0Jd7VmQ$I9ozK3R zb=MT3(baWtt62U{JL2x1i0<& z$$z}_ff0dld3ZdG+xK_le0xq13pBLHmqww&BW{Xw`^K*eZC!^ym&UAJ$pv5etmh#f3bg1lOv}_bBZ)B z9DFF?tXh!kt1Cvs(os%@;BxRH!vy5OD<%P`1!t~k%J@xvM`dVCSpp#!H7{~NaSj9` zbRY-SY8lRta2AT}@hrgwNn@w}_Znp^<})fvmbT8(pGJ;0G_EPK1B`VG?u!F5I|-(b zO_13;aD5lS^ohJIaGG^pT`$fENmEC+y&f(0J-J$kzC$}g$pn&KGA%qEcs&`X30r2c z%bMO~yJ)s1Rc(zUe6XKLmf#@~uf|&hzL5>@eTQ|ErBIf%Fde>cBG}HBY(dDmF;>6+ z{Xah5?jLw4&cWSN;;koeTi(`GV1vORWeJXmRGRYl=9&!N%)ljiv3d;~NBuxJ!7+-l zlT}zICqiD8z88n2*jl+QHa063HYqd}=R{z?gfJ}&kBlsw+aVO107w5;Ow9Q^LT}0TH-IE-usG+9lmRva4~YR=G09a$1iX>BHqI8|OF4k7VUi`3J51xeNrCYHpP_E2?^_M2L#_|tKF$=nQ^m!S zD(#EUf;qt$7A=bPRB`?=oTQG30Z-`Gd$X8~I3S^g>p>KCDmG{8dX?)LSe-KdJk>R0 zvu2De6qDjTA@(%+cN!akfLX@U5hu+3?9A&HlcQmfDK*pwE6z%?9imPhOJ^ zMWVi_)~34O$S|nU&iLQf@=_)s^@$FKX3fDO-t!EJ9i5N+2i1Y#{?}Wi>>%|< zQ56=vdp{7wvj{h2Thag*CUEfw8(Z+K5fxLPq3aaWh$CB$=AT@m9T0b5%;)hejuz0q z(x#>W`jy#KR(#M!*}vL)SK=OBCvun+}t3rqsPs zj?`wmq20yayT9L$AO7g;@#^h67HNO>;%2YX&)Ak1&cx*foYjqp z!YU$m(K}^Ab-YMfySTVu^aJ%DNwAP>fb=ai6tH5kW0d_S9o>6*-t%I^oxT;N#D>9GvBI$SCSr)HO9Jz^z-P^r*knWWyx5U~#9B5%Wy(JnG~k z4qD$&v~Oh=%-ALNrITE3FN)+zedjVd9Gy9nfto9kzB19q7c$N!oV|~{>Dem1w02TF zJ1ZqoP|nN5{p-F~6oh$NC)u6+J7I^qi@ryPId;q$D)M)6T!Vt6t`Dakq8?|{IjT)NUDQVw`xv|#qf+^NmK~vgR1;qwHb^dcLan*dK2)$ z#Hg!@OlgEu^C%0)jwjWHND7r*F6@-Zu$N!$XATrFJI-gGx&|-;V$o|0R4SDz7_2u} z4zP^2Px^KG80S6DJ+al|27P@qP*e~;2Sh^Q|GYjzOLn|0(0YQXi7<(od<$2Lo)48o zltdTLX}=BNC&1$Qv8j>Q3x(F2oG56dy&hJ1>rAR5z<~YD_@610g=Gxh=H30lnSUkqf`MKNhB4z4g zT-X880nt7v&JHBY%dMoL8|Z-S_GZ0NLx2MD)wns|jGODradioxs`EO^c_T1YU5LQ{ zH#;B!-N=r3c-S-2jf3u3!$K!yvT09jAQquJ?M#wm(3Cw}4M#+*%ykI(TWR1TAlcaF zTP2Kr(@y?L-*cxi%e>Y?ARD%S4}fi!`mlRs0XminovyInd=8%ZqSUFo9lB$wyXaS6 zzZtLJy{9eyC$H`vAv7=RClLJnWC-9#I~yrJYBTkw~pW z8WtQ{ImOh+PedG+<5wGIVHWMR84u0yCA&RXhVK=r(NUI2#q8P&TUr;y=GUBuP(A#EB*qgW~74n8%u$zSv4WMjfWyW1Q*j zI3TH;Wm6QZ`rPNV#!^X@!hqHFFZ7dub3+5Ou6@n9h4X5x{^#%g+ap4AIIWTqkSRRU zKpRE_5d-uZ?BYQ=%9d=iflPx+`iy~iipb|Q46rF;^0U_V5N(j!0Wj-qrb`h7o&H?m zDJuXTgvj=eF|3M&ECobP1|lVjzGz_*X(3w?15i#_d}6n`Z8EyNbZ#&g{h7aZn!Fv7 zbV~}7OnMi+i4S0pWz8Z`EJ})lr*twD=vhgNUDpPmnGBK$(+QXi10&a5iHl~Edow30 z)wrv@>soW4dm_bQ2Zjnkrh@D#)6;d8Rx+6Y1N%gdoR?hS#0p=EBvFc_pyXtCL#oQD z1mk9RfD~Flc%O*M@rG4TdK%O7+8LFx&$U(jTz?0{1!U(fA9Tp4b0nqwF&9^|QG@48 zMVJ9c9a819CL9_k&_!JBEXz?z`W6jf3L_QpXlEb?Yr1G!&S=-fBp%MbN2AZJyn?%TY*O+o@-hp*6+WhRA@_Zj}G>wkhH#z*_ZZ zB#V+1?PnnQT><0UOZ? zJX6&O_KEFsIHjjytM73(!~x(J=R@Eeh|N`%VhYy&00(3>-o3x&d1iPY--k1C zcY90c5i)_UWnaI3$F5>HR1tL^mlvwrzlV6w_9YYp3}|{1QV%p zkX2wX)Xpe9I#xVHq`O`^8pt{eWTUWtwyLK}r)0~^|Bc(ykwQ7lvPFpaFam=50i=52 zly(61oaa`19qois|A7b>YJ5&)$M!c^mJVthK(~<&*bXT^V>#(uA%`AuLA>AO*pTnShAp1i2M}EhH3g= zfA^1RquwG!%znLQ^?guYyd9<*In+-j8KqK%d>S;{6I#%8vTHz=Sy?Njw7ZOFEMS-j zfd*TVgkqi&S%|vwSD;|aSqP9$v?3`<79xXWbRtF$HMd(ZVB8B-F~R#%^YOQgE%nJSg|lCu{4MQrtB= z8zN1_iigF|#9^$$%1K9Yqs_@6Yh!wRc0QyGF^5uY>b)eS!pHR4CoER3R4X~0Yyglb z(i8=m;wUAp1Rd<8lbr0TEaH+#7Q6ZzsTJdakg+1I-L5`>kLSfK?g zV(K#=PC2C*Ir5MWMeRNhUg4G96Dkfn(`NvR@#hp}3tX)00=)u5w%-<)UU z6v-NUri6vqk=ss8h?M4)%tv%$0Dpi`_HWdTyXUNYK?Kh)y({A@hGJf{Of63|X5^ak3qA}SJxRp#~t`AvWZXLvk39>>?O-;N)>dd>4H z;5@y2cFq4#kC3#TC4B6^P;bYSr9|KtJ6(1;X>%BjYH6Mx*T?Shclo+fmt(#39H|0> z?xO>O!v>jl1cwkL!HWOl^zU{M)GZATBO_P$Xuo@4Yy9WWugCN23oZ-ZXN%#>OQudS zMG5sB_#J6=AZ?>}-Mj%JiL`1sI_$L12prPyRJ`8~h-9hKbF6~}Q`7ulYSdGr;axsE zA5$6)Ge+191jY9%a2NPiw1Q1Fau8xjM!W)NihC`!auRiRK{MxP_3kv%kdWOx21Bg2 z>2p}Q&Gr<%){Biqni&cyDfJZ0v?Px>k2BHa`z#jSm`!K4Dj-w_%W6L$fjxHHCxJ#&0tygG@u%FIPv$iu9(VXG4N+(pKoo+^; zvzjIw8hlmcV8}5OpHrlS;`%Rs=ieU@w%xDRZz_zwx z1*q`djU>6ZH5_>fSK%ylE(#oe#|8w0V{hZ_K$GK9Bd@gKV zs?$>-qDWE>)X{y=>4f>cK6Fei9m5Vsn3j~D{ zqy@Acv)1x==!nh~N&$np*?>j7i5e=V9Ac$umGH{BXkmwp%X!jk0yWA;%(z)(?=v=( zsUmrqJ4I26o3fZ0cR3TfI_D~R*=BqI3bQ6^Pdj)0vcmIt!x|Vh*8yu`RMh^t3*3Wl zSkpmS6~is2+se=rFUMgz?8y12h!m7E^KTtRS=M^YhAqxyq!Cf9p0{cKjb!oM8l!HK zxi5un2ATJ+E(M7UbS_S!Go@$~-7s*~!A3SA=q+xeAj`6p4Ye&@HW<*y<|xO9@TK1u z>r7c^bT^=W>9CNcO~g3|QO1$9PLK$ctM1Nlmf0!QEKXG9F8`M4tbXd+rvyi}9|X=_ zHYlK<`?{sF3Le3fnc;HUmW*rW#S!GXuAI{R$)`wEnFTnG#1%MqXg=o@bXST3M9TVC z#4(3l#kPo{m!l?NZ|&|BS63nx@PJE}8YVe9(#|SsO{CAQL=nXY+neSYHk{EP7z4hS z)1TR0#~sbGkJzHuQN}*cMr+H~yD`|-K`0J>cX!7c%hlm=Y`14R{Eu}aoAKi6a=g5{ z80YBvWJg)UGOL(FKOYhGIF5U!`GD|3k@kALzr7oG_jk0DNYSAKa&gXQ&^XUuLo1k-%oXrm%8Qe$Z+1|6s zQ}>p`y%ikq6i^arAGy|tJN57G6_Fg?=K*!DcNMYj$OC~t91s9+L_?I40{MV5!BtF( z6tYb2ADC-@dwb6|y_mOWH&^53C(j8nP@FCjNgcrOJ{*!~S7@s&ry@=~L7@-5R15q) zZKkq2d_ZH!VLN~++lXE(tz?}@XP#%iO?o9d-GY(55>Smoa*{xYgU+NO^KRW6Xp`2` z(cOu*u<3;4Sfri0BqfsF(Xr^_)C&=EcRiMg!Ina~RXn>b4ux$*MX@K?FOI{Gfz1&~ zV*4l-(~2a_7@@Kc7GzWiz>a=Pw?DN{Vi&CCr#a&eCgB=8-q8#tWhnKd_n=a_Euw9Q z#aG5m76Bz&YAh6jvK)_&f;73OoGTnIs6%7Y3D#t)wsUtRvw(?+az;$Bp>g5rfBCIH zJfZ+upTPwr|9g|Mz!{f<2hcxq*2Lfv3~LIxbK`!71mre zIyoiVwE!zPt;&gB{uDAUus&aNCIy~?G+Do;GjOs~y&sw|up?RixPX5S(>o>Wa_z_& z_25Yj3>FkAG4gi2zSTEg5i(;1IjMHe&_R#q5MjqnPOi4Q<|YnQ>0LkGlGw5Xrq&hK zy8;5yV)7Hk+@owbKZ*QwRHN&0WLs5yr~+vjTQTFhvUF3Lmk3N}uGxKxJV)2nh1g0I zQpAAe7@r4`gc;d(XG85D?Ny{N0UcAnGCf79y#!X4J9ZRu24K3y9M%*FkuivSNdAkN! zU6W0}X0fu`nx0x1M8B~w;XL5l>_&!G#*;3CUIctbf%_L+$J}oAI4b zUbySxRJ8xZ=D~dKOBY$EdQS)nSf3fFz;-N1$)`5t-{NcKcuvkyMK~5-nbTUGtw8-p z(654XI3OzQUJcX{BRYn3B;!LnDd>U*V5&n1kzxfoK+^!st4K*Tn8Bfs)Q0Q=w&sDA zSX;_5yNEh9s5&fSKVb|eC#z0X8bJWkDakUNGBwe;g>S+lY0n9GtI>m^SnX`;utYe$ z+qxFo57QZQ4PWpZKB!ixAnFJ^T(4PNJ3hT7!A~j_Ut4l}cS~$*UJQ=;% z*%MP2Chrib)?^>xz+vmqV1y@phX&?Rn5`od&B@d%wf2Ktd%r#H(l~#?QIj3ev5fO82a5U9|1Y5EAW8WJ)%shyCa ztnr#jkHMwUjTHnVm&2$$@!SAl*7)2uPQ0(wR#LX`mJZc47>>b;ah!nrtk1~o*;rws zQUep++~d@@Y!~@C7&W!V?6Kuhut{pj71{sL`G^yw`+2D-$(CKWK~90Oay?O(BUVr2 zh*zrXJ7dX!Q~&|<1E9uwi8vV)t`N0R%`N1oqm9zY7ElqjqE@_2dQ>h9Mz+k6C+SAm zy5ME>KozTR`9E5%3yn#T=&~GR1#ci=ggbii`-TCs#77*Px|0 z>Kr}L+|^!Qu>MMwYTc4Cvt6AX1Bs@&3p*ovj$q7YHpm`uKT6f$`Ra@jMy@pKj4y_R zH34BsrW7pBcNwv6gEl+)3n`wQgS@V>daY}XWuW-F50%ujYmR4fv%Y)MBKS1iT+?VJ z6v(4^Y=E#V7D0iXSVk{lj7&tng-k&*%okS00Dc-oXYJ(~(_@wV8xy8{j-MzVg>>sWFUiyfF4-PfUl2!tS@h!mR;H=I4|5jlK{45JYF{oOrN zY(U%~H3hm0v&ZurcoOuAsZ!6+FUIHSfb{HYY;8MaTeE&jy+VFJx+Cp?Vi}c@4#$1q z>|h-bQMtZUT?rWTq=Df*=quEX+&(<;dFgzd;d7`R(TUWUi~opb~LHG}?en()3`{^Ki$yHJx+nRMpG+4SVlX_kwMF7u#F6s?LAdd+oJ;Ypvf} z%XJP}51NkC=JpPX&~s|{k+qdr8xEqE!Moz_UIm$Hx0wOqAL=^V7)qIQTiRDRL7xer z%@~pYU;dHL<7}#)kg|Ws@$k*SgKyg9Q{=ffd2FPa;~?8D=U4;OSh9Y^)K;96%tXog zK$b)GOmIMw0v`t`V0U-Gl=-BKvty?m5Z9B+$S~&Ono0**Yjm1xFMZS4Pkg8753Pb7 zMA;?;HQUUyFe2&NQK(*M1uO@oG;Wbj0(DZ9BeLkWtvdR2C#1}r^)tJ+{iG|RFUyQ>3O%#9X@Sun}F99cHMQG*2;Ys;)1P6-%-UTg%2YKL!}kQq31I?T1N+m(IY@vbH&}_5}6=!G>gI(Ft@|R zXn~Em2l7?m=px}lDZ_j4zBG*UD0a)I10OU0jYVPFGM|^q%npeP>ogq8hp7~^Nur9U z+5iRu4W42^=Pa^QM09!z$zqs6cZJ>C;%r?}BmT5ttR-#9^ z;^~d7lxL8^u#DQs=C5Mbk8|YOcmPQ~pNqNe99Y@&b@-0tF1sU^odOw$CL-Lf3D@5l zHiA()8&%V@uv_iGRcucn&(-s#osxI74ACt`p`hTM%_&Y*>ffY0wENaL8o&zcHAPDHs; zgCPgl4OKGwo9~j&M$)cwLUk62C-Bd`&+J3~EbrM{m;><7V)V78UYuN8#r%#G>8#g) zBV@1;fq`y26LzX}peb$kjt9_Tj@LX2nR8HJ)(d3K$3mA}`;2a8rer&7J+qKx{{U2- ztSwkt>c?WgU$PJB*ktkWXf#qC!vWgD9$Q_Fm8HRxrb(gKlDu$3Lu0@yW`yoS2aWXo zRldCPs-NxCunRiH#3uah0@7zbTr&v7yUaFJZ`?={)7)qsF{dLlVATaf1}Pg8Bt1&? zs%^%HkB}&W4OR$RNq>i37wtFyHa&~VoHh`dUt=BFiAI$dcd@7lp=I}1v6(lBM$ZKY zAR4v=itmvD+UG#ZoJg;lHW%jGI58Z>IU}@THMoJ(qX3Paw{jM-6qUyA_2Lro?B-gb z{-7{y>OMM4I@U9BW2y~Z z&@g6ZeamMw2B1Jv?FI0rY$8koH=zl6(f&Xpe(l5e;71g!Hj1p*@DyF?b1Pvl1(dkE zUSWVKsRlIcay%3PWf38-3yb)u&2^b!N0%XMmaDSMS-xyZi4#Lx>tEmUXg>GmZ z{5?KBC$nE=kEKYxZhX#4+e!sMAg-AiazFs26L=|#Rt}WzNo6f?oLw3A#Z51Gr)CJ+ z14yM<*Mz32ImKA4W z9I0_ZbWOP$0octs92w%z^X@DytLLli3!E8e#EjmgUKMz#=R!Yk3`zmpc6xi;a0fx;d;h%h>(m|!D#KI${&Vr$q zEQ9I`J+A1V2HQGNVs8ow zKzrJSc@Cdb7GZNVipyI&0R8DKgVvN85jA(oE>fK=81Br)kzqfMW{0WFL?q=VyJG>Y z5_rO)8INOYl+MF`^fQ9q?E!RVx23EzIY`fBZa@0{1vnGwfFRQ&8c$whoJG*%DcZm$ zfXpFv38ohpdn|lL{UDvIqUEb2>CRyX47cDhx6~wUypDB=yw(YB=*(qhGa7 z$1J!qn7`V+@_SQI5-Z!H)zMderg5SQOTbo+8o2=2a7~OdpUVE`+5rF~+hLi!dcnN| zbf(AnSRurzfSPIGHPkPCpmWE-OnV@uPl}nXI??(|zD$!7_4>?1wvtwuazkq26lb@e zgDJC^ypwze*1b?K@j(jSV}xad!W>2IOE=>v%XyfgW?2PE ze<`eC^HsOmbl-~i#RMr-1nOXY!hzEA&AOdUHLrDewG$4|Qe7I0@WZpxTbVVmwr;XZHTGQ8Rm4Gzl;Xi8^eK-(l4OB z1*dv&W-06>kpIn267qZzrRAcO;Z@2~Fx5{l$%$NJ1V{5zk-`BfloH)f^Gb4koPsx( z*|aO((`eR*i?2l*bIt>?!M6&m0L6eAYf_5OtJEWkplB@nz)QL5*=V|I^os|P6fCbP zK&7v5{akRE9FP(LFu-#$x>KGN0M*p35qdo^c0jZ>#jR_j#RlUwvVN%eyhU0*?=TRi z-w|1h0K)DK4IkC{avuu58Wo^B)tB$h4Ck>*(ferr4Sf#+Slmm1l8-6i;xuuS%662U z6IumJ%lb3+Qi|2o_70zMWJYrDj$W;?=G%~RMf#N-D~GN?9g*v-Yg${{U*K#JWrG}f zlHt!mmN*Zh4Cxf9sGZ=_x8gEbpeUj)1UK~#Q6(#@;*lzv@7f0ZhSDNFQjM2R^uF9vugb|(&a0Z^m&Q&`6qd% zs&4QZvD|RYDGe;*)P6QfKb`UnM&z^D>BH|y@0GoA#=;01BGV4nY*NFxzB$yQ;_05u zqEdgE3X9`m8LO^n`2<(Tju>~rZ^9&?fIV*O-{Z&Y?o^{qb*jpzqG&j03N>{)gUkph zqiyA{*2We_>T#W8J#lq3^jXM-vnecs&)SMC_(olb);_Zu3FfoIRX#(uOU*W_YHXH@0>#XJj{PLk_0V?asw;um}ewX;_YABCDYmu({gK{^XkU`dPF* zFWMHLBWXnFeAQEdJhJS}4F6Re1q44D09Q|2JsZw`v?uh+-)p~9HKf&S{V8R3_5{_R zl4543+4k(S-K~Pf;&`_L+vr0FCE)BD??|?Fk{UVx%=ctnV%0Si=}MS1p2^?vecURQ z0Moe5D_WwQGdHCksu*SVe2|@x*M&1WrQ@1%lyZ?csjEy|4nCxfOWGN&0_=tPN7cez71m@w4O2r7mr2SK@m39 zEzB4XbW=#GlZR5N^OU1^+9X7SN*67jJ=aq>%FAiETn~3waa{;ZsHB9SBdE_c&S5_7 zd$jM$^r>Bl#`wzl&y8_L1x&8?N@egCRZ_7o%l8vVOkrk?vdnGc(_HivAxrAs7^ufE@gU7q`R8X>cC=80Z{yH^M5d1t( zQA<}c+lBH=%1?=wH`>qFv+?nI8K<*I-cE!-Xz>MHw5;^0qC-VtsDq2cx=>I`*=L`A zIuGWRvY~`>aHKOf^ec)-jSdyC?+k!zb{fDx1CC{kBw;#)dCU)GsKBrTnbX2p>UJ2r zP>NWzM=Cd}X6!>Fw|GWJBXx#bx$}Ow@Dh%Qi)S6pDc3OYoy~sv>=lJwycScg>YN$d z{9@=DIcSX!_mA?DQDktQmH8-{OO%K?;NiGMjoOwhMgcT_4g(yx6{IyZl)M7iGXtyd z7d74>MKo2g^Q3ofDe72TcS+NW7hNGaC9o5i!lG~=GuQ+eBx6}J8g9`pIRO2%Y3FGJ z?O@o9KGj;I!xijv<7naRX4ZkNC6Qqk{~np;%nT$oX?Ggi;|ZLLRD22avl~!$AjAN^ z{GCZoD$oC>DCUL(k}QMWy*RSG6i+#GGWrXwRU8ibagdQ^bm^MMe2}EKa5fC-8RO|L zTDRuAtSt><84k!kp5yZNI4*DIjEONEko;LXDd)i8`UEwT}FeMzbwDa=pa{b;XKDU|iQv%!Y? zeLEkP$E!umuY5*XPRXQ0=ri#Qoh_V%=6z;D9*usy`aS$zQ9*tryp`_ z1@)}U=sZ*hvF=&6V3Db+x2;#Ah&;BgQ*vz_6d_|M!s z?zro~#svX$No|IL2FiPQYA*jGvzmadD)`5yhF#;~nRX~%DgL}7g7#Tfw zdTV@mDmZ)o$OtG>%Sw9Hh`=i*JVG5wIv~mn0GyX}APspM2u}>RP&=IoZlw+-`H%Vg zs`qe)1iDC$NkcKt1tt*BK74Itj>aB_L?D=v^x3v(c-Q0_7uO>lmMWyV#vS&)ETFoy zG){*p`K6_`9k+`=SIvT>_4xx+u*@shIXbM!i??c1VSp|t2VfmWE2}ekAgK_sn*>a` zrBYNSxoQfKVteF|)~t(*cbSzVw-u^QQ7d;H@w^H@X94gi4p7@%$sYhtQ`|;QB@cw1 z&6Hhc8)RH{*c{J6=0(@3-j-65jnhqjF&$27K;Ju~kqZ0^a5er;Igl=JHKeqnV^O_z zi?UaaV#qL2acRgkp6V^D?Gq@H<~G+YRVoncpzG!&Z!kF zXxK_?uP!?vLkZRP}aDY+8yf^1QC^!L1 zmClSZV68*URV;{wd#)+FdZe0>mNU)knL{b*6O{v$H|V|Exv0D|+U;@;n4#1R7lkTo z=Fiy=2U1$Dv!2+|9f8qwKu9~4{n4}5B6JtrYGxGd3biG z)gnNrG3uHcq5|X`WH^n@QPyK*hJd;$uaRIsbs+|@$=Ih8vbi%M4GS|7rg3a_EuMbE zHF4_5FtU#oij3#y(Uvu{DyVS*-Bfh0oT`mkAK6JODOUYBy1ayXk-XPrH=kz`7cP%t zdv_=1V=tEbJvt!0@fF1o%t(J^0{5arEf1QV)9R;-xr!`n0IX zcEtH<26rgK&fH!JBWE7ss?RYSK&n^x>pD}`52}iramsu?O-HZunp9`H&taw3J(P4? z5!1~Zu5p3T4fDb0OidY(@qG^9W%;qz?4zMl$V5TE7QV8?y&MAsw77(GrXM>&AY0S@N z5g^5ZARvF9t`QG?7FWyA=D*czo1IHEB+t|Ubznf}vUEaJoI}stl3&xM9-swmFWFis z_E*L8iuy4+ET=?0)$@D6m(9d&M^qhHbSf+(CN0RMG&l-68{PHOqNp56ANsIJyf#Xv z91x%2ih+u(Gn+75>|Bk@Z1x2;Nh(s#@g?4;e}3adkw< zV7296`WjH^a;lgGs|w5oj0T3%m0IQonYrAMuNIXj)1|ev{RDW6!4Fq<$g1(=gg)-9&KBd zAxc*bQj`K~8+c#4P`uc^wwY&!gb`a!$X_T8gA<^}6x& z8_vY_CstyBc!aWx7$}(h`Fw_j7*Eo%;Ahf^r5@ZF?V=_l+n%lrlVY`iX8|2-cQ4kr zC$Tw7Ct^Q_i`^Ka)i3KnsM_bE*XzRB@Hs`+BOQ=VCw8`WVlqw&S10=Y%)l^Mx6oUN zEKg@}v8`>gbYK1N-0gIb0QMD>n)%IiZkh-_f7Zm60nTPKEty5S@6-3k$y2A`B&FW^ zi~H`6;ZjZ#@4_Bjyl_5leCkb{upJQ>E?kI{Cr_}Avbt)bIKDZ*pZ!hRpYr*xmaU-= zPA0-%_m9E2QAnOCOqJiuPG~AN7j{J8vePa3BL{{_wP8`R87Ht)C~D_QGYQ_LM4-P@ zL(U;vH^RJcQJ-7b(KYs2FVTaVl9)NHhBK$3#x0?0y-DGHv( zc6nvMbZ<^`l_ypVjzj9$cNPc|q_x1E--FPpPJzWWF8`84(Rh#q)3b-U{MeBUwVriW z!(grhP^BU-tx4WD7Zj$UDNc7(Sq-&RPr+wLX2Y#@b+0n&OMtN`czQ&HkSNAiM=oTQ z=zvrzK}!jtLWAKfYNR?KwVs8)g$$3ox9EVG>c%ybab{H}xtjcC>BSEaWez{svKsbuR3%oZ|v+r8BC|oK-Sq10!O}= z0ZvPkGFar(3*75jn3AlS8!CMb)RRs&m@;%icL%IdMg;8m5S>&UT%N=>RR*6P3mr#i zruf{X1SE)~2kz%;u{CF=a2F8OR4|JMgi>Nhs5&F{K3ssRyvhSBRoX`N$SZclov@J( zhUydS>@;;t#YvJO#z*W=Qd^hxpz~HbY>4bBeg~EVdvjZll$Rb?B)ot1Yy%xvPzN&Ejef5a*B(C_H=bIJzB23tm9$AY za4!E$_6}lal+K79b2`;o@V-5o;2e>ApTLtt=Q2ohd6XTlc2EYLH71$;Ko_s1RB7hb zVm{Xb+X6FC2=W@JJL8=(Xkxv74@L0ZP8UDV`4gPS-Pr0Uc|e!}sR0Ck?8$+3%52&x z)4(rXx)67K@Q(QSCqEi@e)3as_kH)r*|QgM-m*<_r`L($a4C)*JsLOPcuPF@xnB?` zkDrLI{Iai%<>8QOGV7rlnR}A2@|XVFlY6JX^fE<{wMx?3S{8)^{JV=*VS}jd01oq%!2;+-&9g!m)F~$4=US%S&6*F?EM-;&jSzCud3JZp z`|rgeoO%&1zVf$z4_YC=nMrsNVoqeGm2fk!4asl#v2_th<&m8#cTy?)hQD;WnXPsuClN7awW2`A%11y3CO zazMNcxoy^<-m^L%+_wtwE7iDlw9LG)ucCmja#*bcLfk~Uv1zu&7Kjopa<=4>%pg35 zat;ipGJpzu4co3dBw$Zx-)PUv+vxkEU>SrqFM@~SoqD}KE{yhlN=w6g%(M<}PH@BS zQSM&E>TDE;2Y5BnBou$4mZcVB6H^KZK(Uiz<0w1+)~l5|1u2ONPAUBb z=qiG02dF)$K3v7r#9kH0CIg6KfK1ANWoqSySR^; zjubt>G#KnGlk;>aOrw&MfTQ5lJ$czaa9oor8qyI;RdNL!yXQ$3gj1b?GcZ1&JmePI zYKoGTWaq#?PXHrPmsa()$@k=0Gc@(YS+`&1d0~N>G8jIic%KF&ipIqV8;uw9g1q{b zQJd=YS;iP~s=fA^4YTgy4pI);b01MKH4nf!xQgsqC-Y;jDPrmv1;y^rX9FhvVY#Fu zP~WG>YYWO7!$I+>dh&{_MxkI_>mG7fa}fHIM8FW}#^PXEypt{KFJ1JEKL)pH$rkGo6$1 zC_ehp55>nn@v->npLtW9ySN#vM_1ySYfi;Nrxy=A@@U+A<4tkz-Jgo5J^g91u|1B_ zXe*X_y?E$>2V--6Bfj>lzAC=^yS_V4p1LMZoj4K8M^+D=?$7ozl^#4BRGa+_?KT4t z6w}$WTyewU@6TR`I#FRx9ee}$Z0Ec+8prl{9Gg3%xU{t$ySZn*ZmbRlab#(T%#a(? zq>V!Jf!zbNaYoionYBFU=_tU_%sLF&+w`Z?HfDAYfw8@GwD)6cGQsa;5G0-Cq`GG9 zM>^IgSC=D)S@#yQSwqeSVP*ok1$U#wYcjh{6~($;w!fx5vR)~8ugQ==w>y-Ag5T;a z%-}_3e2nKB&7?@Bbdj&uWP5Gz3?&(q^v=1E+`+ioY{PPG8aws9s7fuQJ{0I_(MhgD zB|Wz?;U|!OB7iAb8`{=-6Lu{u)(u~fja7+#kT21Bxz;tCg3OqLEwJ&(h|%$IpcL1a z7oT?84hUnRd8Zt@N~&3Abj|4CNC_q?Xkrdx?)DF68(uA@cycu4T*SOMTkFH0Y)S=} zSYh?ZW}&;w`viWqp#}^FywxdTYrj_6G08-F68&5LP2gm~bT)$+(;j&nCau6qM!7jH zHqs&mmebJD^dMi zQUV;2FF2nqTv^McR<7#yP@EeX75e4o!x)g(LVG-?fHb~DYhg;pR}BCFAOJ~3K~#Q^ zXNLo)48SW0r$bA6oTW(sM;RKybgl*JAZirHO4@ytiW(|S0=QlT`dCbYZ$t=cofY@K zHI)4KY#cp{Z7Ut7rQYx~)mF?cNVhXWB~*bgmq$VddXdh5)uzgnsIX1%4r!2+RU%8J zrEyKXln9y@<;n~M-;uIA3p%O;UY(pG6Vf$pRO@PRroBcvg%0q|eBkifdtK@?fqv!4 zA%L;8v5O1kB;rj#8?C{G0)&*Qse39Np?xTNMeFabhmck4RP8gKz+0!RBxFjqpcJ?t z(iBumwXVd07=BLecH3Gc>1gOzMxqK;5_X_ufO(^8u}s;uO!KX=EPimo8@Dt^@TRn? z&H{4I@JN|Y$0IWm=@^h#&Fk{~B?T+9AqzbB;LPvF{&X6P-T64WJiz%+=OigvSx`P$ z?84^c_oh?Uvm~g@r%bw6W>Ut}%mnPgak;RujRAx!i`}^K)Nx$Xzz&q>1edanIc>ey z?TJ=V$tD@yW^pKObUtSWERv?RG+2y5QkqbRKWksECflFsdu$*goY4GIUh%VCH@83O zMvp!IaQwnA{zAO(cYiOocDCZFH{To&Jp4r5fBysVl&74D$DcSCn>)L4bagF8+Z%D@ z=#l6ThVkG755}3($K(3zuSJbWg7QljFUIxPJ|$lN`hOZPc(0n5u;3{EyT>1$!@G~Z^I$jp6tejjg7dxGloOm z?=H~U?DkNPl$p4+4e6*{+#JQF?JaddW56JtkIY!C4TtK;mg~W2I894phy^$->zg}q zVRIXlzQw@+&i80M!F`Udt;AD~AC05SiwFRu6P7_|3`ka8ShY)(Hx5vCsDY={>;kWs z0}mzO)yj`_wBlD{t>~HEjHh&UthTFIH0dy8^qVZU-`i9uLVtf=_PY&0wOJ6nx-P7Q ze`_zP|Lb6AzL#{nsH(&b4)yqj4ZLWV^8b)|cQC54k1V6GpQVZA=wy~_lX%6Iae616 zf6lNIWN|H@&#hz@bsN%iuIGUxlOqqr7UD-zbIO^N+e4^P8BjHl7>67XMM~9lT`$9S zxW&sfa1%Id>o2%4#S#(zIt_>pREFw`W+p5nVlLd`LU~dofTzLq2~DqUm|2XB@<3VO zc}W7CY+acK!A8>&RRE-n{)n5z<3K}Nx?jmLq36cu%-4gnql62&jLa07!9h>H#ynt8 zg)89wdrG^&Deh^NB#HuCxYfv?>1%ndlD^bouwFB0z|Wnjk{iPNdbpJi!$D>OQj#@8 zqj559P<;$q=LIcW-PX2lw|>>eUJ-0+TKzHTw!v<{-vCf`exW0R6IY@nM$qIH*U!5a zg!`fz3=PU*kXw9G+`7tX{)mkbxG`Q!1NG94s=NWeD2*4WwG{DicCHQ6b1fvtF_D8KT{z>X)=yNi@Z&e38wCS=A)f;V9<*7?-l%dTW$)DFVUg>Z& z7Oeq~bgr-bbJ&5Pnyd97FfI)UZ{MY41FZw9m2haFo{#3{Jacx4Jaw6CVb`%W1~$m0 zmMizufs^8NI$}l|AK!vhN9$5UMr1Z2h*b|!EpuXc6WUNz)92JQs7C3@+2pc0(=Zdf z;}NvtR6Uz#AMs-@3{N3rM9xdeqE^*!NWZc!k85bX;14i9Ab4DKd44ZHOiBW69?x$A zzyy9N^J5KT0|g6(=(YB&#NYCLb&fNlOq$vOx?7=6V1GZ3EcN5e@ik0DA5Evw!x&bl z<|;Y35TJ8w5?kn`6*1nO#^uoj^soN>T-W>O)zi5bAbvGb+x8>5 z*5mOw-ubR~#O?38Jsy7akvMhc`Z#;;0&MW3Pn^fT967QID%#(8_N}qAJ&K1Oel(sq zcfPdk&nWzGsTU7C@L&uU`?0pV78lN+i!;}qidVe+JL2oV?i=FTGuMGtaV5qhtozq;ObU;q#bo=GS=r1gwxICT4tf$FN zX$##hW_z4l-;T4FHZfl&X$F(d7)^{E2KrF)(|2H7z}F}#n@GaM!rrbFK%OH#W=O3?{u*EY#)x9{LV zu~o{Wl_KAA3i6$3cl5u;J~P-TvoDBO>;sf*#hIV!bQw!p@9^C!5TpIA z&QM;~84P0B8vJzNf-%RYA&i2h+7;pwP5*U(lCFlG4Q4g?OtjJLCa7*;sLK{xysG7# zgnmzrwJI$_z{u=J{z;HtIej{EI#4AY?yQ3>0=UPH8W2N5*itEaC|YUXYvB=b^f z?YXH_jp4L_dX$F>jSJY+NvM=Dt|!u}^3&$%;68BkhKL&_&CB zfOeB<_+01K8IZAPK#-&K00y=_1-S4FKVNHVTwsZ_Q9yrkPE#3?@611K%8;Od9hwMU z&;?8KU=W#?gTgJ&FrUGN*%d^pwX6cb#T+!i1jHA1)>`Y`AR~?CW`uN;< zE)h37%XlC+HCeG$wqlaDrN>=QY{&ia&$v zp*G;0uAVbB_G4|(jcbms00?HQ(`@#F`iq4QW+7#^V{0^ti<{$E-`>GqC*^W9&6ywB z=KLT|3>V`mr&i!OLCUUqk zW6}X#Yk4@}*G*^2MsYvMFRK$`d9l6Vj+TmCoZ+3Fop{Sz{@-}>fBM-tar&BAJ9Z-O z_>(`4XWVj2eDmM@)_D7`y(d2UiI2zeqsQZc`|gSF``%X}L-Yq9xFhcS^g{sMmoBfz z3t#*qfbe_oxi>DHI|sd)@6%n#>G7lZ{Lgz%{Pa)!hge-%A)at1Q;u%?az*OeY@M(K zGp42jORnUF7M*1IkOHtX?2~&qI8vAn3UqM*;9hKOZN@-m9^A3uLN9z4GR%mo@=7LL!6Dm5H*SS}UU@pqS zLhOvj@#v+USl=4O>hcg>*d~*4%F2OOfbC#vU?)`#5|j{~@&bPsKct+US> z5Et&?>Fgbl*5n(wHUn1>eQRz$(`{K_VF6)O24oi`DCF@K5Gw%V z42I)_hnyMORC!baH6NU+=Z2CplF4<{;>JX?So zIHfS>!M0}!m85zYgGKP&N{pF8(MH*9?5uqJO!z(5&Db!D5?4S;J%P*wc}-G@xERct z9Yy~5I|hpMT%8)T)1gycx`!~j-2kt~lQov`&)o%r3Zg<4ws31wSpJ~!MMhi<4~XM< zRNRiY0+2e~j_qfwGvxz^Dj0DQrEW?zl#yIHl2Y`Apa2C$=wmul{w^hsyjmA#SM`$7 zb}o1RAt)(C#X{LSK!XGy?kfL2nTM4Ymc0(%Nbsbfi3Hfm{%=`whHF;OJ|QZTU#QKeugVM{?MVxcgyytbTxQRxW`Z@Ow-_6v!=_KlYZJ7PPUg0VtAZPRdn$&Sg@nw#pWGJz2&)sURJGL z+MI=sXT|8+2oQ+wQ4DyM9kzAOOubyUT+e-W-$UVc7VCn3CC9=U4)NwQLRd59qLHeb z8-gj>B`JCGuwDBx$SLScebkI3AY0BU=Go4-(*eyZ=~tUO<2ZMDCob^6YEN<^dp>u*Yx433Ih3$J$F5kZf3m1J!TxxJu>AVwR_sqX zTn@by-GPGIMqFn)s{_<}eG8IL~7u%bekI5wd%YS)G{HOo?v(aBU zf;08$2Of>@_`BZ{Fa7GTh+nz=UGdgmc~?CC$P*|wPpa7SUT_;|V;}p(J@Lf3jr0m* zx;u*Je97|xtnRw=uDE#qV%&P`vtlO!{1cDGEzi6eIN&Q@^cC^_uYN7+UTXHQ&9d4O zDKMSZZ$@X<_ht~vh5C|bWlYLDwzkgL#!YTy|MD8i+Nc>3%3sz3ZNdTBh|G*33o<>3 zo!!0I!CabAY-~+XAig(ufMJ%sg$|t8^IK!cZFUChcY1h-h53UxGF*%^M^<8WsSApE zHdf%Y^`r=9(ffW}+SrK)FYUzUcsEuDZ0)=|-Hm=HVs+4sH+9e(J!z!2vJPW+$q> zx%7P5*F67_$Yifo=C~0E)?M)B*a6ExMEo%eUIWSr?5mfTGKs=DfnHLiYRV1G;1F3; zt6tIH6=y48-x~;r%u!@;pf_sV%S#J@I*mTfhgZ9M}C@f zD(WBBq|Ii~+Pn|XQ>_&!)hAYL<#~-pD-W9QX1a{#`{0qtdveC9JWWZcRKw=14DNdv zL`V*5DqK=NLn(C_iTg@{r0#K>UG9)|5z|X{>hTrCPjx`%>o$R_Sv4&wX$%qp;Anb-GQf+t-R!Z@z($!x1hT>W?>!J{%c|j8uRpu7pu*nv+xPWTeEv1=Fflf>P zh}QEtfN&25zX=A@{*ij+c}#oR6_1}i8^>0b;*rPBMz6CMw>{^!Sl`)=`|f)vp7r!+ z#$a(FdV|Gy_~D1+6Mz26IC}DQTyyR9>~cAO5bKvO$C1_5xZ}Uy5tlEl!t*>t+(D34?p~9yyhRjCjQ>bUoI+E)&G!P<5wMq;tIQAjcj-^`T9K!e|G2! zHmyny=PM zp7ly|a9)$Lg*gn_j=9r`m0>^DhW$7>?8lL%9*j#@~E1`db@gkmtO^^@cL>JZBI&xuK;%e9{~5tiasTq(jL zlNS5j1{SV{r=i`9eT3Fwu^PqzV?vdAm;#RHvaKY@sb;U8(Py1* zx>d>f95Oi2MKvG7U@rfi8CSCwX6i~!wGyr%K5k}cG!$E&@7WczoyFt7{f@g1SiC3x zyXYeGDQOAh@euQnepDmF&39ko>kM3!>q^{kj%s!@r+coPgBvzY8kz{^aA z;UXorIG6>5%V>*t%i?_Z6RWiVMXUu}Wfw|oYB~nRQ}osOw`9QQCn7&s&QjbfY~NbRL75TQPmU7pkC=s$gc;u z+L5eJ;OJO!j-X!}9qe-is$!+Sl_zT`O*0uX(Vn!V}vYEnrY9korGIC%*p)Ga?p29P!83~*-Pcs+qS?|<3mj(ij z_>`%|cmv#5=Pu7Iy8dJ*D$+hP`s~4w`FF0<-d?uOrE{8*=|W>@sn`uIj}xosP>8y@I#Ku+@9ZQF+S;gvNCvH5w7H5tu1Ee96 zt(ud3*QM-|G|cW+eRgSrq0Nznb1|MyV!X`=`Di?%F5M%0U^raFkhvUe$l8Z1_xDQZ z_GG`KzzvZ>eEiQp7T^E6*TnHtC*%BMkH@RN^Sk0dzxC(i!nuoa{P=1-{{=6I-r`!^ z{_F3JZ+huh$LBrssRZ0x<5*hi#^v>k(djR-_3_puE?&40&w9p9@#dfTxp?rAb8)cH zkM;HSc*)niIEI5>eBc9r61UuPLu_2S9B=qHZ-_5=&KHzHs4PzA`L0K{D)u79Gq_5j z2iOUJ&5%s4C*nAnmCD)&1qiRUQgoDy+JJpa8QaY^xjBDkOlKmU)A2Nm(f4C>cM^N~ z@7>+l7>!~h8yD#n@88GV>!^W6S30kM2?#tO=fFy)App} zd*9>dx&1gX?8lk4l~_V%iIKz6cpSU?Q)Ekq z{d9T;u`dcAJn$M2##iiT{P2#RGEd#<__6v7;U!|bqB~Vhnbr~o1sp5*bWCd zxO=wK%<3Id%)<4oU2%Z0y$Mxfi$xjabKsVE5_8OyO(1SAZe_I{k|ARZoG{I`D^GPO zGyR!Q*dZI<*n0GMP{&odmN%Z zVEz~`zyXKMT)1HyQ+T9gh!g{dhY?%694Jy0DpLaNwV`{LO{l0@Ts=)w7e&c>#9*0T zCQTxv=*VI49;N<7^EjI5nSlpqaj2+W>z8AZu!T)Gu{L|*G-8Q77f+XqOWq>i(X=sB zn;6Bcky!Ad-T%0G7e~1XyeV=XE=Y~5;_8MXK_}baFj-JX!24p)@leW{##|W(6w@gs ziL3~_usA|c93Oyt^)hdcY)j{%0ujel-Kab)umIcQ;MU^ZT8m+LM%gkza?k2o=sfE% zF_S~t@OeT(uGXhq$ER7*MzYS5Rw8abHPon&d%;@u<=;-Jt%;H>J+ z;8I`;PQN0eye)@N;Y=xADj$o-*j#Zr*&IAcYi!>-*WW}W{zyi*ao|b6(yUVM`O-bNHvq?3{3R_O9Yw*!BuU}Q2l01`JP&@53keosHFg@_9H zVExR0)_zzI%$Q(j!IgDtahCNvYFK6rw{!&bHTlB1JA1PBrItggBYEslQI(J=y|26J z73l~xSv~1`lf@y^0wi*oavmc6w9)18p z%2$2&E8^^<55>>?+*{)%FMeKp{LeoU-~0`KE57W@zB)c}=ci(Cx{W%8haR{;KKk*y zVqvvGdo?XgPujD&| z$&jC#p99s4QE9G8IzZiptdVN!y%2n$7BSZ2x)BqR3Bv!mwk$81StSO#YmkMXpT#&1 zn0me#^@*7*W(f$Rxix)>YSC_bOj6NFN^kJj)F8tFvWB^$Fym}yMSO>uKyC@^O847g zab{o7Y>KHdjBym54!L3YrY5bcCb^{un~7jjUDe>mRLvZ$W=~}8^h?#5n|sF{cORr< zfi;z00o_Uzs8qZdEF<9CQCF2z9i+X~PFIdRqWBL0iQvppJol&eNO(w zyFqs@kP9CjZOorB1@GS5rfyOBXN0a*5^S={f^|pL;cfblYCupx%^bW$l2JAnj+S39 zlqjb6ZOkBF8k}bU4}y+TSDs9o$_TvWBCt+JSRjlN6oeGeg%U6~x=>`;a~X%Vp;)xt zMx1D??<;^^&YUSwjP`H~>U$L-QpOE?gu*WYP)AV3BlgjH3*)KZ$X7gIn<&nN9HXj`FCx> zn^!>ArV2$lNN%#gcc}Z!&nQ}9BUhpjCB0E=iY%kf1Q@)d*tPBv*MZlyGwzupWgQx@ zYMJKGntByS{4Mhh)bx3TVO4s(WStOLZMtkU?`+4)GC_q$P*=XEHEe6J@>?Z~A!-fo zo9E5hHLqn8@hMpdO$oQ7>u60nBl6qjP}(V}TgkIqd`=cTDqvE8yPQ28@6z3eYofTm zP;f@{ZB+34<=p$8bl3<$W}|ZWWFzxd{Bk}GIRpRzAOJ~3K~#&BxfGmNZI`gRZmGd` zGI}-_Try?!BnL%j${yI+ms(?n%QUE>(<&&f&N%}dS7a_+_-J2AinE2atmUYSPsdl8 zs6y|ghAvJ!zAroCjnmRncax$BAW{UP1_S6^Ra0rZh4Tt$FR4i>_soFciI5FpaeB7U zO~;BfEzvrqvmD$r-sHNI4wH`9pcips0B}H$zd0kv!&vHO%|&27)o6b%9y-4n=Pr*x zb-A>e^BksV!jZKe385Cda~MQ-Vr?-_A6*8h%kD$FyBs=~FsQ#UAH&673VWKqF@21C}2uvNX;ry zADY_BK%kvSI3SsM%l+9W)h{QaV;)EDGyXn^t?@X{U*3#!Tida*yBj-M3zXT1$wBOF zPtXfKrJ>)QixaEESX=4?f8?HTPm=C8#&s4JvV||3ER6RLVr%yxCRsxwOt`l{MWK0q z{@8LB_Rk~xk`6dp^DZsMN^dR}JK0J)9UxKy)9EvqxGfKHt^=ipb-22IxYP`@1pk<$S|&+weB(L~!^z@6VL zZD$iOtJ??_F&&KT=|S_LnIYzxYwn(bkt6qr3?`=!K_pIrcEo^L5*i<71yuS5g=zl0 z;F5Yu=kI`WC1EOQwFW>}P@WdCww){-IvG^l&rxmJDHhuE4ee0jdiu|f7Zob&APi>t zOpZ&^(jqD>P$Ilbz^L%D=VDNC(NMI1ic_JQlhP{&+aTDZYjI~RJj!Nhr|~qR2o=F` zW&r@L9tZ**3MbxCP8`}++C^yIlLX^DfNovqZDXcDHzsC zi(y~F&*$gIlwDZ|0(v$85JdFp>@5H68Nz8YA()Nvl{hW z(qX6#+nqZswV(apd9~?eH~#+jd{^|A`mwXK6_f3)_?nlzByPLyi{dHQpNZf9o!^K* z{*yc6sW;vd$FI3Ie*HJ!7vu46+k}{uQFWaYjak*0L3;N9Q=99(8TXdcd(o+h;l@`D~e`01XiT$uU7q$TTi( z?Zkzx?YOWtj`i_0MmaPS!z(8-9<#_iYl2Q4$)*Ke$U@dV-&>v z6;)%E+bYA}m6{>9hL;Lcu=Q%eqbeEgi9qI5_{c#AV+`t57Y@(j17{it1FVxRE7h6# z%THX*##R+nZI+Ex38*x-5_%BUg?g012L*wI4M_@-1JdX?N8^$C1|8b#KKsOTw}0rK zgH%ayKxPVjbD|{+`!WMkqF^2}c{0~0Tu8!DsN&_y7`9-3GHwv3i69DsjoFxwgv z6d8);r_?e{pXgEfwXC4$cz8`MW5%{9T5CLIJeQ+$vZ&5xP=IUuS2%BSSU{00pA&d! z*F{CM?1f!p0Hhdk4*@+~A0S{TY%G*4z$w6mchdf)9QYk!ycFJacPYD^S^0H4Ed&02Nz0MRvC2A80Q~#pdCp zZ)X{m!mwkdnu-b?4W#)Jm{S zFUT}R^8cBk;?3;=)Tn;);`5c!1FvXZ%KJfPM_ost38+-!QbaSLp9SZoU7r!Z>NsYi z)g@9>SZpQ2*q#Yz&8RrrHoa9AT3R1p(JxVHdvug+19%5FwkXkTp9CpdoElxrBFJkn zxZzZM-m^4BaMVo>u%E}vMDR|-SoMaZ?9QC>3_+GzXeY-LPc1t}gM{mpKKu+G**VbB zAdS@ZDb4}sznkEIof@`bJmgp*L&xq)J{sO*oV!LhR-y(2?7)?|UKm;o*ceLxT3aSjcLxN{N#; z6+nI=+m@!C-9ua5qk~Rdcj5>NgL9uRZcpO=vzu{wYm5kgp2qdfZGg#i{^5Wu=Dd!a zem)mRmwRzdWOf#ol5}CX*N}Ek@R@<~)b9igw(*nsAZO=Plr z7&>K5r-JD04Oh3vA%@1^6qGoGSB!qT7{$CmqXq~Alcg_OmkD}6XTNfAun zH3ugyb$gJ%ezxw#Og8D(xj8&T7TM?NA*FntS-DQuNXN#|) z=aDsmvzY*uZRnvVXfAGN$M&|=^U01M&c2r-b2-p82%|9t3T74C&^RFU9B1)kld>t$ zpoK<0OPB)!h_3=lr`hsGnHkB2!{0Jy1pMqLjYZAL&29sUDX=n-NMWf6yJ=DD7vOdH zSw{bP@Kd;{*tiMi1lj-*{*Z^rAXIwEqL67*v+$1D3EmBdM!aT>h!;SxY9YOh4u~oB zRuTpurXBdR&a$|FK7U`Z$2QBGjVzJ+Miq};?fwM(Q$Wf!5Xqda$zj%n9bN!Ns>N29 z2(CLaNa--j(gQLz!eN0gMj1<}9?vx+D4=6{PYHQehf?5>*Aal0y>79B2jI+bG*!f% zxAl7Z08<|L{;7BgAS&=k5y_|z+CryCo958 zOlu&x7U+JXNGo@{O^+JLQxe!+%CI;y;M}zK@bf-YJ_e?Yf;FCpI(N0SGaTl2U5aza z6Jq@7Za4)9+bOhDAsMAoRR&M8TCzQj<6y9dH6%ji-$jlUhL<93sYLa?CHr>JEf40y z7Tl){TCTB*+v(`>tXVR6-3FXurp_!yuhP@%93rdlqPMI6QP#FzS@&%I(q>lbsw4I? zDqd3?NYbnHoZ1HmHL#m*zp3n72?XdtQA^h}C7^bzQFh4ZjAN&tgA(caGhWkK<3*>X zxGcCbh~TLWuUuBfrSzMu?b9$pIe3sM34ZA-ugA2b zV115e2-54MohquiPZt6-J;^1hT-GpdD8c{-yAm}sN0Pp#qS)E>Cr6nP;C(qD>du!O z{G8Q*p=*vz^G%S=uA*6}a$YeG3nVwcGj|Y+^K)^{@zq!x^wIg~iS?~`{Nh%OvalVF z&K{fr>O}?zvm+6TbMy0^gShVGY8)B%;~=Bo(_Prp9NL#4FIzTe9l=fl%iY~rUK+&e z@=9!OZbmmb`wB!1mIl%9a~{Yv=aFpgaOdVDR))h^9WEh?jb`9Q2Cjr;pXob_qsAvc z`LX!PH~xDJw0q^Zzby85Cvp7r&GBa+{p0xcUw?1B=Xc*9>l<6~lOuXhkPc=2k>(wFt5Gy1RUVc3Ote)!%4Bm`A3 zo6ZIeO7@LTS`%w5;7P(7Cr2FlxlH@fE4lMI&OA#1S)ntph+sCpgr0dU8>zKITIIlD1P} zlmi9y$pqd?0k)krIZ=gvrS&zo5QU-uYxR{bX-#=WZ6_0j=<2y&Z)f7mXA)%Y`<`4RQPmoj7&Ky3S{=ah+wEN8!1l|kmW{Z zOKtAAK{y>Paa>)4(X6TEo6n@o9>e1TPzL{WZux79!fVaB7U|fMqstxh%UAwrS+lla zPS^8qBV^E!af>|pd8BCbF0Lu5rd@{G)9zsiL^mzSP!L*Yh(QRyFQ44&M_QmHtwEM{ z?A?_OxpS2b--NpHEkRQ`@BPyU^1+^EOfKa?>-4ZCr4 z*c2SGtYXbsgo?14XIx1(C|W*~1cvSaiLNJ9H+7)R?gM{rD}>v*9kP!jwfKH12T=3r2&>XdHU&$Wc>t+rjxdn zbgj9AnC$GLvsS(zCeCLzrI%6kWl_2`vqe~8X5*TFFc`*T!3Grz@$O&y<#^xw-W@M| z!I#8vaS&(EKOVpEwztOzKk=y;b_ek}x7`+N$BxGfU+~58>}NeI-uBDC96RH2Jod;V zv3C4){J{79!+6hcyeEG1x855cyyHW$y1Ews=pX+>$l#xS`(>d{zPTa9Nt z?Z(*NT8{_re<0Q`oR9TO>oHs!#+g$mA2O*MlYlKqfQ$o>IqLsCAH zp7+G%t+?}{C*tADJ25(#i?i!HXhrNsDsX&zoj9>NKsT(+p5^;)@9v|{D6<*)Ea||a z`x_jj#D2^~KnPVEj7&LNI%lKk15m71a!6r+9!2N*_4TKZpsn`S_9QmPQ)(gDo_$cZ zPOq)T>hb{ew0yR_|N3Ye+oK&6-RGIlqV}A1v$oiS+-1fP0okHIxsI7N%0>>oZWkF7 z1gH_jqvKQpL$Wiaf>>v$*y42XYI~Kk$=2EYxQFfLtNUOQq|~5|Q3mH<`4G@N=(nU> z+dMMWYC~TVZlgJ*{>7&odNM3md+*s_sQ9FDL}mh?vJYyohkH1fi+E#gLa)1LT_o*e zJr8xz@r)fPGTT%qg?1Gj(U6F?3cSxJ+okRLAc+^ZA~B! z9~38;ZVqb?1dx^D=K7ZJ;u-0B{`h2e#IK@R*uTRe>=xSvC7XnG`5iR)h|SqdIlZ zyyu*8!rCB;f*cS%c>6tmOH!zFL2y+wW5(@8hZUnzXMM+z z?{Fc}w{dZ2i5GK~@$O9T>CiyxPj=C$m$I^$BX7 z^t=ZN_Ry|YU5+p*J*h4ksiq@`Oo=*Xv38EKS~7F8v-Y3zeHS~uIJUAFgF!Dc0=%)c zqv_U^X8=uQU^C(k^|-JAK7RfW!vp6dj;-|K^s(hw>Mq27&L`QM#_}L3Fas2}Cs3R! zi;~w#pq7qW0@4gBjz(i*fCY9m+se*c8M#I@dOk8ck~h!#khS43_73v191lHsf1EmYG`{g` zzXt37&fof-`01beiP+g3#p+-=-gW!i*DUa?!)C@_d`DrU;4$*jeq@b z|3m!lZ~uNA^cUlczw*m5jBszf8J91uBO{U-phq8hAg1GS%HJ)$IO05G zCHyCcg&D5PJG*iJx%IgJ?B#gi!d5(TIkRZ{Wv)#+$C)w9{k!hOQXE;%7R?K>HQtNu ztR30SzxQHuw2PL$=xhi2JtKI>1 z>nhkrxY&U$<9Z;Zl5nnFLoJ_*=^lCr+Kgg}ZDt!CkGH@5gIR>W0NRc_jeue$plst- zqE!Ozc|CV<(Jj%qsMYWpFz|2kM_J^^1u?Y?0;0oO(x7^HWMZV~%*LPg-H0mh@c`NjGpI{i>s*#yy^YTfCoJ*<(a}s%uY~~5d?!? z2&bF`Zu&)D;xbPn_G83CyvqhuLPof3#NkgK4irb>ON>`!u6tHQun zj%2AM#3f;lO1t$g4Wj`r_o@_5NqNwz(Y`u@&^TUxMgk2&UjkXyNN|toRMQBtr6+#o zNVK9E{&`Vn2tVj0Jk7Z@e`vBHaz3CK+5cDXRh_LSkX`Eun#>J=xHL|#KL?N+Wb^d6 z?gdJGMguV_&6*!NAk|r(bq)whEHC`q*&aso`3r5d$InsLx|HD)q*A`BR&aPIm8>&B zs9Dh;M~nOkMzz~I4W2h=x$>y9Bg}kgu8Y>XM9$hY3mi-Zk$6PxpO-a+o|n^}mrvl$ zKcvbYp7hRuQvD3w3ehc1*UjLQ=6hf@3l-A^m;w=y5%0s*iZk8JLPlQ>HzRgj4brgq zHHxd1vBYV0q%rkmMxpU)N#oN{LbVppg4v{t?CmSlVPJ-iSaq;#txc0$HQBGcb#@R+ zdK0oA8{0A2n~Gw~XJK6c&o=FeTENWBVY+k%SeE+paeQ@vYb6ky-`~d!kQ_$nU|_%B zgRJfDPNLiCqHS$D7`w`{q{G2=&jEEg;BJC;x68w&7%cW#yVC2#;!+?ch5bb7<~S7pBpcH@eAY8haZf0-~OIhJ#jp~^hGa>QzzEqo_p?$v**so zr3>rvgFo<3<2zpdZLzpCWCpjg_lmr?U)TXD0Pm{5Rlk|t#+;!}P|qQ{yRwb64RA8$ zfTWD(9(TLhem2KJGBjz$Lw#5vE%aqN!#mSyT-=$&Bj>l{6AwKR_dLN_GJA75sB(%z z{*<9!w-YDV7URsZBe6Qn>{k|l@5N{@Vtr#07cP&`0y;Al>AYs}IgdnU{qTs1`SxlS zyx&`Z({c0ZwYWK{fJ<3_#PhznGmZ0?)2Zf}O#G0of|GidSR}zW+VXb0kn_A>%4KFn z5`Se)N4EUUHo}>ONryRcPSXDKcTgLWEvDy_-j!XqI5r|bn~sTR;G|4)Mu)Ui=_s1B zMHqOZ=~3~uElS(55z3?1xEhRCx0NWgXk29_ie+juA5EuGYC_o$ogErbIXVjFk!nTj z(^|X6uoW4B3X^>=I$pLG&Wu{7Q`PZ4EnC8N%lEQfrvFs4dKFi2e?9hqnUlueIXjr& zat%ldIY6e0q;kVh7Xi&ILsg2CS$C2BnAy%!99rj(0FW4ugOj3T z939Meha*H&)J`o^)-_w;cuIi*oPQxNv#BehIaJiNv7Aj@kk{a(&3Zj3AVCY&yIPvajCx~m^g zg>2_f{#lufiuAt^T>;5FfdtHm#}u$!ps1X-{C7q*amZ#|^Tvx3C~g6F&BUbQI+Xr& zG|Q(<28$g_D!S%Z1Z4I`@H_&{7>;I2oTLARyU$NE3Sw}3b<0TFnH+38z~w$#t0D`v z%aHM7aq1ZU5Unz6D!4{;+@+v@oSF9k03ZNKL_t(UDXU8 zGRXHVQ$?g*t4mQFhGxs0amd@b=)O8VI<4wdl>f2=G7B0iSARBoWD~;cE?$W zGXXD|BVjy!`Nsl@Z@B9u>d7HNaU(sSH+OSh_-}c z%du*tW;)0CNlMnDf(6?v-a}>_b}yor8N1ZaI%hD)m_bGQ1RFE3J4|LI(1|D#^ySwH zCe;iB(bEKKbU^ZRoF!sSn-9+rMWHCB^N=7<&&;-~T!)NSqozbkF=;xv?`TJg07-!F zjx0zg=Ph*N$WkBee7jkAjBZ2epv=Kp$Sg~O&y1EQxJ6R{4Wi9?AX#UU>LzhP+Lf)H zQC!~K!ZRmVKfzvqu^TJPOR8z0EV^S+UNcWV=$sIR8hLdzb+ow|Z~l*OieGyB+ha7| zjc@<9zl$M(U-)^S6DN+JjJN#KTjE#WaeG|6yctiq_Dq~Ubt=wYxDrclck3AX>J@ROL>XVDisOq&ZEJzqYX!-TxljQM!taRK2)quC&fTaz+DgK&1?sNRRG;Y)fCCIw_`}XkZP0E zO8h^+3Tj}GzSG)+}dPXf2M=<7JBT_TN+ z+Oo`s?`>~RAw4mO+t^vPjG_}*p4@0b%TV+mcPih(j+WQTX~Cp`f(BBEE6qgLsD z)c<}0fiFknM6o0FNx!46Zw?x{ZqGm=Kbj7Rr;tO1+QtD`E1P2-mUmYhRAfKE*H5QJ z844{$76v;432<3>(0nQDEOQl-HsbH+npb~CKoiva1%StlR2yI=WoRy=ydBOE8Ke`E zgWk}oXdW$i^S=a_=|C*@b7n>kisOTFcy65^k`$$61trxcTiGTcOeX~G&iD2(Pb8mp zd8r>OD?@Z*%3}3&JhCPwuixu(5_S!5X)afu!M%g{#b5l7@xwp%V{zkCZ;sb}|EuHf zPklW8=mYPM=RWrfGY-t@C?j^F>iKgM9a>0}b$ z`HF9k=RNO>;s<~5^|7@zf-`i}EjPy7-|Kk7gD=UL|;M4a35P#0+KRfRE)St(ta~I;(ul~V!*~`8yI=##~C<0wD z zJM}TL7?WvS*crv04_$~)JajQGje`@^lU_BNU_UeWU>ltCXHKjw#qlF6c!u?@%z$j8 zW`hA#>I=__!@HnqkZ87ZDQgFDV!0R3y!J%gbb2k0EHf*Y6zIH8Qn1!H#-LVZH?EvB zlRwYw;pWa5|K&vXeD-d?6Q@>}QKPcl&w7q*1DtJzC#)G(Fa{cZeh%`OEr!$4PG=>D zdk(YfR%Sr5)=FJnsTny`wnBsIGB9gTTY_4y>_Vo1V(BpIi~{rS%tj_X&e)}#ZP)U0 z@7+Pr*FG#Z1#n7jkxA=}1c364!@@XW#UgF@8vm>~HG0kxa4wW&gJDHeWq)g{Vg_}Y zpzyQ!Dl}4U0JDfZZp^G+ag-sW9I^_V0tWQONlO$dtpGF@ChMq*KB<1_A*p z944o|4xF=dQq8sLOEui!!%rFjg-xic@Qa;_BDJU*3&dN?utOH2TPeX9!qPG6=8iZ9 zLUhz*um$31!0HT=`~?756|%sPiU*Hu;ZQ55i_3`kh@>=s!nVtUey=DLoE%>>#ALIImD4iy0P@IO4)%mFmN-{7OZZazN( zPy)U!ou>_0z_}rRs3_;cek!eDtExe#hkT9UutmZK_jo?E*fE8`fYb zQfv&oB-*a~sJf#%5~Wh5Bobz}pQ@u~bj(jzKt@q>#f22zEY6|?3ePEJ&Ak$^l90KE ziw+~5KyH`#u#RYy$i3<{1eQyrsyHB3Wt&E4I9#x%WWwuZI%EEvlsD642o9}#d}TWf zKILsjl=Q16_1+koTxGYftSN6&vzS3L81W!C0}?qPSOaE`x$2b$Sg1g*%fr4gvfe(= z6`8COyr}gu#iwfn3WAA>3l-3XH4*S|oQ^aw>W8*yvaB0^-&8dPLvWn5qFRc!y9>lg zJ?3lU0(S4Rh>%iAc|{1TL}Lg*EF!czjpJ_z4w)K)Ja&txo`yb9YtaPkIdR#JqkU`8 ze-$_)wj@<1Gagwa3kM{@%9KM030&&LbYvKs0fh>UAkde<34?p5`)Es=tBY9-Xmwxd z5U|baqLCf9^8Q&^o`JpWHUv6Mew|LoT*Tr6yB#fN#-qzNya~*f5~TIIh(P!HeNj{> zbqVhBziiFAJ3WZW?gSZ#4P+N+JCmxFUA3|WYDS%ptPVM}Zaj%a(6i=aX=yR~y&QCx z=53GoA{~<4r`_Fn?{B^*{?Ye+Z#?^RpB+E-h98gn@BeiC{4f4|eB>j4hH2)v+;n4{ zzjPtq{|6t8^XJxMc`%Hh`?)v8Ti^DU_^tQ7KQ3R`1l!?ne#1A!H+|FB$7^2u+E~A| zi8WbSU5-Ee!{3gt{pOd&V~?Ce%ijK=A7B2WFOBW(&G?<)`fss%>}d2?R^nODx+N|? z@kHEv&!^*WfBVbg`fFC>jz9XN*dFc08{hcmxaF3oVcvwi$cDyv1$3PG2Fn*~(Q_#( z&&=6=cCF%myEe!;g`!2Owu8ZR{)H)|vz;Z)-!GU*PCn*n?dKerX>3e(7a>#zpuqf82J8Y=t+kR{|vt94Szw7?0qu?`4}` zLsKP~SMYGf(^z!}wch!md-1Hv5nb%}HHC6N=H;#XKsYVT0H7nbrVVKp2LLM#j}2k| zHjM*;IE)bZ$Lx;d0>db!iDUP5&+sj|324Ikin5a@p}w(b1{^ZU?EaX{7ZP7K%J~@ZVKvI?7XO0 z*Fs0Hv-Tjb9kga#7Oq5_K9K}bKr$PngV+?R))1$Ln;AGZQfedL3NH45UPz&!fI5O` zp=V4qZ7dZ{t@8~m*G-|+Aw6FKAQhi`{aY!J)8dY;OfN+>iaSLE)S`1$C{F>>9HB}ji4{)w2vrV%O z#w?JoN;bb=3en|s=3hSBi1a}IYg9!|0o9^a4upaVrc_p$RHj3^uSQF%OqzL1U#0D# zFEA(S|$VqqMc`{wcksxH7=u(RIpfJ-RC$`?Pf?PWFG&EMX zco;oT2}#u0L>=U*{i)Zr&Zx96Vsq1^xTmB}@pnyIr2OlgsK$uP;Hx*r2g<3^xa_wdDaodIHj=9EpA~j|g?vU1aN7(mt~ufp!an z0|iaeSxVpqjGPqVG$DFU$fVRRuJvZWi@+W2xWAFvPrmK3{g3 z+T7fUvlrH(4>q?)F`CN$DN~$)Y}oH3ij6LqImB=}1#rz8mUN^#S+|hwn)mi%b$J-Q ze!km5+<)&~@poSKEpg_$8{&WY_HT_BeBl?w<;~6bzy9S9$A>@sk=Wav#;?BZzs6ht z>(9r9i`((rzx{`?G#JKD{JS5IcmKw_<88P9T8u|~XvO=&=YLVW?scz?SG?ktapC+r zC!#Md#vlK|Z^gH~@*l+GkDiOkc!bQ)H@x)g;`-}O#T$R}XX5lNH^sTLXXEv+dv(0| zr++3Md;DU&>6c z2AAg{Wv(|r7nv{`_U7Wu>L8wa=0u!a=|d*Rn6$nd8~O#)&TrP2s!k@AL>JVn1yC6WiwiMKha?@) zl>3ErMiy$v$+ioqa3AWADioNJZM&L5i0fl>(D}+Vc+z$K_nOpvq0I9F<1u`ceBVg9dK+!1%n}Nq<}_BZ>tERjVYWcx7ci>dX^pE)PO+qJ7(6djRZOcQ;LL4 zY*B&XRfe0{Ah*wK_sBrT|8BDbY+2dlZ}86=Sz#pAfYnpqYqqE!57R1K*vy}pL}S_j zijfO^pin0SBozT6PbxqIs&+QVjH}(;xuvw|b2jLVWScfusa(!Vur8^x-QnrafI|aL z%|D=Ut0k!-s#+f(x%~_}Qx-)Si5d9CSpa^A3hS-Z zDqx+7;v^OB|0C`_z$7cHt>N9>)m5FtM3^DW5C(=QIVT0h00uxn0n@#Tg4cjKE20>= zVorb;MG*uQML@|&&S8)|FvH}~xvHzGtNy#z+WS4HNACCde9!%#Z|?OOrn|y9?|H*o zd#}AVcfp7X=cC6Vn@QV=HU^K_lKwkcjc5#y(PZD7BM7k>vNwotx_%3(K-$+l=VhJ^ z=5(X5E)7y7Sf06w(y7og9(1% zg#;-_QFEj`hF`_NlCSx}!@bs@K@>mo8Dy5C8Xi5|a81#(3c`>{L~={q=U^r&#j~LV zGDoB%$DB6?j?b3dZ#pRn;?A|iy~U|jl9Bm*R#`iN6irnez!AiGF)IKR2?+WSflT-s zBq;Q=DgXz-I<)q1zrt~bd0Qtrkd~kIA1NCy0>Ue!gCvYz5S49ZQ#jOk;3&X34DtgB z3V}cEP$eA&5s41fthY!`#omvFk?WZDgV%U|c9zxm;!;@b(L~vVopXTeV@>)~+9-&L7`D zqrZm*#N*==*4NujFg;_SkHy6+moK-Yjy&8pn?J`s_`wg^?=Jtfo$!V?*$Xc`XV+Z! zH@oH5yR2B~uq!VAo&D+RU)#Ek!}ip&HP+VJZXbN#d+qPH-DX!_^%q;aX1&$M$8DFL z7u(N&_Cq`I#FOl~r7I}y=;-ga8~${eedT*UwP&7r-j+S{j8)3xw)3uw?QJKYV4wW# zIW{)~(1F&{7_))?KASshhAsKW5_`v~|88%2%c)-f zL&TEJ@c>f{N@eGbf3ztA6x!JQ5%Uh&Hjob#nwRS}TR#SgR+(}@HoAoEZR?cvmRfCASBGsrtKVkybnrV+ zbAlQWbXAAL78+~T>cE)=zNWvsgI2%G*N@uD4WleRpE=NNgPld|F0@F3RV;Yt_bkIx zt7q2GxM$42u2P$IfLs?^t*b-w!`@QKx{F21xFlQEo}Ib;`8m^C;QGKkVhpCyU~@;1 z9;_Gi7NLBz(L&jnEJqYvE#SQ@cz0Qw@7@X&yHqy?ti4%m3LIsLmkbbT=j7Ryz@G4$ zBw>Mz9K)qEG#bA;9m#zM_ge=b+DTmoo%<}29lsvmyi*`2+_)SY#TgqoGk*@JvpN7z zlp^HDpyi5to?wX`4tz|0fNM4_@*bw6gBQV)o(D`q!_HEHVxViwxBK~i~DAhC@;Vkp~>J`Cb7@~&R~!4-uzxh zbp6=#bf=OUF4qDe@+hO49y*!QixN7X7R3zK8z3bCE#(E5U`_gSN0_Hnq#K_&ag=hk|E;^xF2<9X}5C{;O=c{|M1UF1Um=xBfk@8 zgw~*w{FtgCG4%|Prf8NCRcCewV5u>y??rwnMSlzz8j-2FMEwzeg)psY)}A&d|6gUawDxXgsN5Ld4hzhucwD3qN6AmAzUS8UrspD*=Tzci2jW#?yVRzl}pk4Z#U)j~y{myQ<_3u`17H!8x+uOgr{WM#)Y=!;u zvMa2wy~7@Q;6dAQ`vvyXpM2lm^WHP<(IwAVYoXny3axg*_y5y=cg?l-__HtA#CVz5 z2GQ`3y!%u;;gt7SsjtuKqhof?7d~aT-hPMOde?(CS(~(j_ubjA%#L#qf)b>u?qXabisA1 z1&stNT;08$9sD2G14zM0xx%%AxrII)STpF5K7yK#@iN`5plCszPIr5Y^>-DluT-?z z{hjOyf;GZ3zooz|$A-}fH9JJp!a|$%cNJ~!U?0z$7uOAu)O40gHfv_L&F<;466A#K zZOmeYY#KysvI560oqHt5lpjisgCcZXZ>fNKs8;JO6|EP=>>x6&?a7pbk1Ih%HNHSB``i?sFi_Tb+KsOot>%h9cPIg?sTZPwL+HYPOUk75Gn=k0C{y#0CV3{)m&Qv zzaRlTzr1b{`$AyZkWZ!NwVqK;n9uJ?+pq7Rx%+g0=maM=^;~d=`+sD}G92SMm0T7n z0eMBqL)UZPk&NKFP)Lsq-WF@<^jFgWOg~67jH8 z{YS`C)HH^#j0geUop`+QZ~#3WC|YbPEJOpv z&>S&2sR6)u@G!_+M#Ps=INB!%A`t#SJVU_fgnPJaf;uG%0+4rRad5%U4*8autz18B zKe+U7cKbt5*oRJijlJrCUAdqVP;$o$jc}w@UB;7BfC?Z4$rCY)v5pLe{_W6l8v7Ly z3HlRXD4z^(4v7SWYb_D`be-C5t0D%I1 zFPrW~?<-VrqahruMZMq?cLQ>ONGcqanBk}kRG}6FU>o}yC5*U*x~zz6(Bb=j4Pb%{ zQuG;N(QK<(e`nG9x=YqhjXMAgNDe*^Js7GsJX)p<2DL?_C2nS+}5sgL^pLWE}7F)MrBkf)RW+8)l=Ba5sjs>ey;hshhE?h{tJZ7T z9?P{}U_H?gio0u5R;kq~r>iu~#;0l|5^eRS!R&deR^`5h`33nL=5?ipnhRZTsinz` z8s<63$5MqdbysJaKIwq@VBY+@Ti;b4mBmj6ohre;WGR2>P zjKg^g?p5eFvSF-jAn~YInm41@Hk;XN9R;jesb$bh1f+fnZeHFkUX464hLRt`dKZD} z*0w2YZ*5wswUyn|vDSLv28a5m91>zc!FdP@$w8)YK1|kXZop8b-Jaik|7Dm=%q8?S*3OzmnUc4|*KtwFUr6j8jV4-_74a}Y3 zDq@bBkIX-qpXtSis9T5|VWD|Q9sF>OLqCxZj~L*38IAIu6ltUNtPVfZ>r}*y-5rGB zN72EMZsnsN*@5mP%TH{4#>8aJZn*m~``|Y(W=dV-)?%+Za92C~y~o@9IWr~cN~7o5 z6+dWGl+xvE;(!Tl>V5wH0APFx=So)i$UY+8U@d>`8iODp9&HT5xp+c$> zwLu&HCluA280lB9@=BMSqmO)iihaR^E_ zm`#Y3ZWN5`{t2vz2QxyUb8-6kaD&aw@gPEBmCZ}y`zYC` zme0cCdJzE8jpZeVxhR)sT=mQ&IH&#on#i}Y4N3m>wSBG_Xwo{6N%t3oW8G3v@0OR-sngBxTWj2bM5WFAi1lj=K zw%@9W>U`|rQiZoTtvd;4i`wPv+!+brD9o_%qx zU3v9itXiqsRJ~$LpIc@tR;?w-ZYvb6T&}1dp$))y%6ew@TSsTfw%THz)vM!n_Gdn6 zpZe0bY-o7QHrsrTZNK##8yp<4AN=GZv;Xda@##-~+`jy!ui19H?q&waoyZ;ZRncYT87tZsj`up0e@Ds`d!fGXTs_p@yfR z#)8Q3(OjXyu|?BB%uf(o{BE>dw{Z|+4;JWbYg(zztfv#r|In1M-5PifwT9KJA}eE+ zx(!cMnayJ_k2Z8mSKkj5yYqWcgVJU;zpvZ2+I$AdH3$I+7zjUz0oG>?ldOT}i0TD` zbqw-^YzbBfGIUsHT<>iy)?ES#>16E^zL!|cF^W`jSO*{<#_Y^Q6{M}^Qc7VYWI#}h z5*EocT}J=|-;FiLfJxSr6VD4cR}Qn8q*kYNWY7Kl@N+i;A9)>A1n#&Wl8}l_BwK&S zs8WY`rX-mFxnI5}ualM(weoBb4C2p6n*qT{ zQ_+=x1BruM5q5wI>hn^EbQNkldP*OnN1IN`bPZ87n+OUsGcFs8;!e+fGBcA;b$X+X2OX7qL2Nv}G< z-gEpb=%)_ZTO9d8_;_YAnwjM;0@TOBn^{WoH-5+pd_;;q3iM-KNLo^nsk=ToC{n7- zvmetSiN-V^$>)8?!S4F{ARr<6h~6?00aex@B8-`1O+)~K5K{)_h0!UE=nFS{x}kgb z%{d5&lSf{QlN-N!0iNIj5ou>MJOG#jsUSLeDM#q#eSzs-oHFoprS;C9QE22fR}rLO zoYWr#Nrq=sk~N@5uT@OwZWu0246Ys;^N5CNSMe-_R(~qC<|7K-t1w@(6^w>|Bz+!b z;(NV5CQ>yl9(Ig9O+uA>9w`GBQ4)_t=K};03FnTH4pg^K&S|=m=F|bTpA(Ky6;UC9 ziVRmA$RYpN1a<=A{c_xvn4lCO(si_Wd?A{UJOct%KoEWqk7}*P zs4{>P*QD>c(BXRmMz8{PCx)62G)jXsq{TYXx1iKc0s=Au6H1U1j3A0$0V@;>V;h91d599jr`fQe^6DvnqJZ6cAb<=EQY{Fi6{yF=|Ss$?d_TSr{e)1oNMu?C+ z;d8d#dV%e}=RS7sx6fx*<{fW6(T+Rz1iSXHf3Umnd(dVK&b0gPf5=v?TW{l&6%OY7 zd0W`Ld7Im_&n_cD>*?zuIYRV%V4&ZYtz2ho*RG?>*ZBCbEnc+HN`;11E9hm?YC|Js z+pw{0d+)x3?YGY!_T?{so#f^7U;K>y^oJMN@|COYpu-QanS(vHe$86@!FPXb3m0z7 zGeSbOoFahxM}vjj7_mZoL17r*0I=s{F3=!@fiKtZgCMqnc%q>mf&?L_%n=YT{H5bs z)U$ygdmWy7EC_H`>as~@X4v<}P>0YWx`D=jbsMWr*=R-J8UYQRS#Ch#5^2;m(bq$Eseg^^rc@l0Bu2?OFR-3BUNfrirVQ2&yV5?2k&Bm&At5(#1q*^z+U7>ag z&#JrF%KDG-%A}1=LQ>VF@}{G$Y1_>ju+3-pdFBKCL26cQG`TjWK+0<%O%0L`tS@FV z3vJd_Dp(t`@~sU86(CQxCW#4%a9>H?)&(6MT(hPMq@~rG^(jNM_K8WzA8RCG7;$DT z+hpJXQo*K?tp7j&K-nIwIgvL%Um6XP50Dm09FaZoAU~Tg`u>CYgltd>-i1j}awk*> zM^M9M`~rtLq?`SY%}S%zmYIyKRyv(${$=_rLN?h>kPp$)EQj%(Q0+JlbcuR?&yW!h z_G+A^xj>oM`AJ!VU{8x>1SI)QV<6Pfh*1?bC=4(fJG{V7M0Mh@4&aK15VmF!>>~@s zPUsr?0QbS1@&}p@g)9aub&{f*IvnFMsW?7vC`D2|?UgCLbs)+~OTZ)@lCDw9V}!Wh zV8=mRRCD2xG>kCuZLqhCV=n^YG68_zkX_}SZ~R(RXzK;J&Wt17hX9$Z zj$L2wH%d6^lR1)HaSSn|75C~(g1{sdF!@{kbAy1ycM7~l6h7mJDZYx|GXgFE8O<7@`qwXSVJlzDHA^{w~%pdVJRr`Fl|OS=@Pn?`xG{A zPm!n3^T>pQJ}&DNWp}G&kG==M4uS+3Q!;Mw)tri@bL3MbMROP%oxoQ_rz5@MKXA#9 zKyF6MgUsoW^vwXe;oO{d4wLI2;wjKrdue>)u+-)!JneEcjt>sy&@{$27R zIo*q1%TLddj3ANtSro!YjZcd4Gm@nbir?uY6q#j&J9S1^txJ|u%{L0nBJvTz&!X<$ zNj%psFMcPI9snhL+ns6n5M=XDKMyw?jz=za9-qb6gr3%a7+EdNC1ir-lq4x&Mwb+z z38EY>TCta9&nzpa3C(Z>Gjc_?J~33&7wbs#KJDeaf01m}$V5a~4>a6+Vk(LBg!WnY z$*=MG?bTbJMTt5n+%LW(3?r0}1IXg|MJCB_O1&2J*(@04T=zBUMWitcIIf;C1RyEG zfrl9i$#3y~N{-;j129!b=V(M|<&HzRLNMxUj@cJwUDT~v_O&1&07U>yARwHR+>Bv? zs_xj5m&oa=MvZ@+Ko{hL|3giP!Fj07276KbjY8cz16}|+JgLZ?>Tg zqt;sLvVl3XZO0wAx89!aWNSUp*GGx)NV#mwR<5*;mZo)fc38Ptu)e;2n;0EsEetw& z*Q&4-9xYS%M8U*0WFr_6ro;vypWJy++V0Mg2-}t=OJq z@PJwrN#r>_K;BG`XEC@5F$)0K-@dq(HloiKamZgWQ)b?o{eE(Jro{9 ztXU+-xAQ>0>D0|*GB@;~?YjpV(}}Ao=tq=iNw8Vv=3UCn`&p663^S{Ko>md-bbO3GKk`BLYBM=zMk6!|e-W*Y~9TyqpV-1@!K0P1@&fzfS|BiVWk}JKs z<*n936zpdM6*8+m}LKstfXgzJb04KRoGxHi|XOi0VW_5 z0pI|zVYCvrO>n75Fru-jeSqC5vk{c9Na7T#0AWA@4n&I~)c`p_O$NvaBBub!<*GoX z_9e-Gi>(Eo9h5`kJ8Swr$iLt|1ZfST&ix$)>qFr%?MFMTzqgy;#VBZF$|kDN@>h7K z;7kWNgrgDO8&5eOP0jD+cmZW)E}wuTQ+*#CMCA6@cwf|2;d$d3ob`#1*kg~}Z=d_j zr|q1tebcIARr~nIKVT=k`6SzYkKOFUXPspiTzHWk{p#1+J@?#i*WY-96}x(D*PVB< zLR-5n*k+*}al~QPUM$yr`Qt%T}$nWluk0rLHd9ZtgO2tM-hHUM+byg^K*+jKzvuDk)RV$Ve5RMFw*b6T_Pl5>v(ti8zWpn#_>=&0@ zZl|B|K6~=nr>)p-w)ZZ(*e5>rMVoA(30@XZnXFZ2`h98D7%P5uoTRJm5O zYE|`coX_kL0)haSC)D-Sm~pB#+iU`0oWvJ%wZ@DF);DUA@CT&6udAJ|R(&8KZODFA zDZ2u(pg{xGK*}1RNnpuMAMkmoH9?VjqdsMG2D@#$xdYbUUE*3O`|o5d(X?_!^(>g* zSUa(Ipb;i*cTp#W{mFYUfvkgDi0s473hMyb46SRbYe+_99#g}(pk4-R48+^BBUn?R z+!-rZX;F-E?ddELvmqc(H#s+mLDmLih72lPxL6~C?)K<6LfttriX<1V(g=)@-ygz}D`eC8 zaGrzYU<}$R5`Hjix#I38b(`)#O@iTRY781S$~eFgIV3r8Fdp4u6Gd>KM21JHa%iy? zap7WcM9J@o>_cp1@wZ1)uu;Yq$7q^I^8-Yyq$6WhK@9ZSaN)@g*NCd?FwUY3DQc4} zT7|8|XR?|P>GGm@UfTsW0CbEU8lSMQUwD=M>DC8qcx=M9m^;%x`|oeGSM0l!_4jn8 z>`N4sF$$M+Ls+(YgZ<*FTkJ=dUC#%#$BtXu7f(OlcHM4EPF!{0%)n*FB(tnUXaplg zrq0TWK1l-Qh59}fG!e3FQn2Q<5xRUM6mBU_%9MW=HO+&D0D_vg_&+F>1ruV+&LYX0 z!UTjl=Ipdno2DLqU{CiqC)#j8;-9w3{7HZ`cKiUv(I89%<54Gp7Aa@_`x1>;G%|sp z6tWF6r)VdSaDTg8H=TTO3?rMAXtc{Jl+sLDm}o)gjgkbwgRF(&QABGphb;~fcaW&D z5P*@5YCc_>A=b!b<+G2|GkN;vB-=`t?vWFkTd3#_uhFeLm~Lo^9eL=~;#RoaCq=o$h-{*g@m@%0bQT4MU3N&oWO! zQWh}H%-B(LL_B13K?b6J&Vig}hbDJM)%EY7`*Ev$E^cfABLGF4b7^hA#!QMAgv&FW zSb3C<7Ll3kMeE2`?+uuIVZn^C)n=^lF+hNhR_STb6vd12O)Rrw@W(&92 zjQv9Xe9d32Z`N#k{>evd)#|mj-S#`!Ss(tez3}2n`_Ne*vGT+yc0OCQ!_M~QFMP&^ zhsW%FXTIN_U%t$?TePF?z2CvMal=M7SS*i^S*g@%{R0E`)KgDbvo^_^gB`cu#(sX` zZ|wLJPOv3UJYltJ*DebcJ-YKnEj8EIsEoKbR2t+sa5AE3w?f!lUr5T93y zCWlO2XBy@(|CbtdWe*?%MclL8#SsKSbs6X-f~=NXw5I+tS&)<&z&L-H;ge^x&L_x( znl@UVw4sSIGZP}z4ao_SVMARB$+YS`>Q*phzyPLU4LuHkZH>M8L0cFQ}SZ9IW zGHP@Q2R9Y6W39-R8nP(N=fU1i5|DCvQefZfL_iki&giuTbNcCAhI;|Qr`sGA1WjgU zkcGkUw&5J|J+-~4j_K$t0umr&rB?4lrdlavUfPN>BVs{%G;8JOs9znjh#-2%`e3|4 zIy%}*A~tj!Ytlt*!&rsS0R*HIO*pY;9j|F$fKddpFIb-=PEK7=llzR{%@qT2?#Ceb;1&SQgq$A#g)JZwu!9WF@ zS;&@Tx(us8p@L?XL4F7YLh>AEoS%)3Nwc%htmX1MpHK#bsb1Op#e!ht71oBJFiCcW z?8o7U2qrbPpsbrv(VMby`Ws`!B@rnY&j19Gz~{ww6@!e==Awkdh7*urejZSu!$G8c zlO1mqw?wqhn`N>1+BZWICMQo}oym*`B3i764xOBwC$!mmGeAEd<2vzRpIyGjF8Je3 zcFA9Evkk-Jw*6L{+36=7X(t@HpUoOT>M#TObW?K6wp8fuB*&{y?dca*+t2@S3&{wI z_l`brH#_~fSJ)wY>}aK;tmE=qR76w6P+b@3k-;DsA|&~4>^ZQQi(HD?<{I1icjcc; z9=H-*w)vRlb$*_%XJf2sE=V2?N)cK;d8R0H8*q?Arm2a&;&6;cd@k?t*5q1XS<|3t z-sutT_H-3D@|@&Hjy(cw*kmGeLgI;q<`J7P35Y{hxGQ8TaedkSMAj}2AI3td$Bu$# zw>u?ih^(NKipYdSI@LEAYJR7*$!CyP*TA?&t5?6W1g}rQH~JV9;eH6G4lvi+9zG8&;1ik%E*_z2tU7>`r3I3Oq3*9>3O8+ zc&tt69=+D9-g%{`xzmL%^BCG4$j%w$nkADNalW#3gR8)XZTCciM3AZ+?@&? z(;CRH=a)i%k=Y64n_K+>@YyQjn_vY6Q+ z7%)D|gvVa2LntB!P1YJnQa1g%v+wncLS&S4GkXe|#fC@Ze18k6sMdI_Wfgv>dZ}jC zv@x@)%;q_tMXvUP0W3aikrSG+uqINrq5uw10!Sey`44m}`C#dd-rk`_v45Glqrg$zsAlQ(sE$#uq^QF8~^hR8Yg%wo=^DgVB}1-Ylq zXAgjR>>FQiJM6H)7HqMZUGnS8Y_B~Jv=fg%+RpsYXY8HtdZ%4{>2GcMi>vI2Ll3nt ze&N%$aKU^#_iJBg-N))x%jslv?z!KvyY9KqZv5L-cK?G9SX-fFz`>Yg?3xI zY^im0cGAshpm&BHe)xg*%u~C*vmS4 zdTqwwfHiAno6*;9S6=o9>+9;btru=(gEMAYd3=-&49`FR=T>w17VZ(5E)at8iLy<& z!Az+G;1|TPXvJd5hr-WQxAjLLfu;v9LE@&3r*B9&;}C^s4FzOT4b)SB?)v#jNwZ|u zz-r?EGD4_Ssy11l)Y;DHyVx^G2kJmZCqQ7{Fpe#lNgYg;qse%d2cKbdX zM1p@~96ZpR?Xh~NYJB8s73L(8>qb422a4ki4nYx*5ACnQHInlRo4NT-B2ALI$&Jfj z>#7UYZbx=LJ0w{H!XO*T4PDM9yTTo^=%&>Q1%O{2IMCZgdpR&*J=m;(m6l^|a>q(Q z#=nnX1c0A*g!yjd;R@ps7H2Hf7W&Q`fI0@AheawR^aF&0=dt!&8aqxv==WIo5<$Jt ze)AB*#_xxBq)8pzaRNxg#E8I>XI`{lTy?8mdfn}YV)F&_X4^Yof0&(i%%SWkuUc}? z%=m-n;ODYWjGVhae7+w80QtJ1F+2C7KiZ#fdC)eDjM>32+riE{fIVv#w3#NB|cZ1g+|(;P15#f?_*m+=QAOD;WuSc75_kfPcAD$ z5S=p%NFd&?j+dUBdtBfz1q37xlBK<(KjzmxvXn-mN=R& zy9q!aeKBJ115uMUHL^R?>%RW!KAae^@Xj}gj9dlK)-$Be*`;e3XEt~9NFtq0_`KLT zBV~Y6(7_J?&PQIFnqEethX?;A1SAi}JbsnUJ)Iuuz)3~*p{v(vD^mk(Dj={q8(R$z zV|Gbas2VxVI35Cis&7g*^J`orRWp%f)`5QmG5xq9$`k?w>u-v_a`jYc>|=eneQ5r> z@`Qx@tv_eJCdf72f}+V}ez)@=iLbkGN5flbQJUn9IZMdcEnS*`=a0RKiJ=tu(EfrI zqK1R5*2c_)ipCLuAW;pgUH>jOd6yk8$%yj3vE}j%XqA*%WCKzwSm>(9fZTbMp<**} zWEM&Vo4(p1azj?H1Z)zy6KwvB!b-x>p}; zpZm&r_Q;dZ+v4pP**i`<*>1Y+CfjWOmUhZ|t(|xN_iXu!750sz;qX?!4_DEA$WAD_-*&n=@;sS+i=Du`z2j>ozeyW-C^#uzmO5$Cf|$tnInm z?)JIQonw{8q!;vRE&_Z)t^)!Bu#ZgB`g0nac0A4x6^bvCVy+jRW1f^rfN zWZclp12ViuT{?eX>j3qo0;2hTM$)Nj(l(5Ya^3*f;o6i%RN$q;Od9HRas(H)%U&!# zS;ro(o@DHqcR`0RU`sK|GKJsZ^_+ zhj7|rhOf10-6eG<$DBm-Lr9~*Dgf9adjvR#1QIi!GB;q*_IBFv>hoHZ!SOm6)ODZ^ ziu0c}OOQIL@SBjX#P-#`I({&NAm1Xee1Yl#6)sFlDwPtkK*`FglVunBx|gBsVS> zbIAaYTuMW<>cxt6_jnJRJjI|#s>y$s^tzdWqaTg}$5{MNJ-^Dn{Ie_V?nj^Izc-)R zZ=e15H`zfiTSSXP6e|XEMGXiJCXSg$qP%u(+L*vn4&#VO8>3?iEHDGIcH@Zs*HyRJ z1%J4ii(&qpLHpu+j@v{vZE(5dtBS0HObW>o8 zX~0gzk#_V5FMB^E5)$!VuPF$SrH^-M6XvdDFIvob8BDez=;uyQvP6V~KxOUni!$JH z{4CdJD)6JfhY%utH~&RKnTA1W)^MYX;;aNwiQA=y1r= z;`h%GI49I*FA#-NRQwyyHz=exl}z)&NoUHeR6ox4R?IIy^wozs^dU`bJr5#;}1zrFqK?VShRI4RI5#%31G(=R}+oks} zxGWWC13{>|_)@BY-@_Ug@(g4(P@^#jJ$*-s^&f0@=)@kG7ZMQ4U+UIdEZRVCpBk-| zg6M?AQ$Z-H7?jo5)cGITa@tCRlx86t4QO^sPuq1Pw3q*(4ULT2JKyBJ3wGdvN7`g_+_O=gw@IUOrUtDCR&Z5nk*-sa&%dYsX-FWl$e4h1c z&9>fREBok2KW?A@;^*zoyYIKDN`vG1t6%-ndi#3V4Si&IoX>2xy>_&7&-t3&b=Q6N z)vtV=j$3^*2W*dh_OQ2~@>VoUCvaM1Z2)YFZ=IAfC^bFNZqg} z^cD+jt~d(@5M5{zDk6q@Fl24eo`69RuSp|s43mc>4bFl!DH9UCw>ReZj@?MJzA#(Np`RbU(3lR)hCD*<+`WGqR&<3JAqPAA}q|B z+*Gc=`!T!n#(V7UN1w53y>5H&w2i&_sQvA*y>_zMGx}IW=$FBJTD@V|zIpMV?4c*0 zr!4F9?|zfb9_Z6y<%Oy^JpcaSQ}%<){%RxRWqb20_p=jUc_1fxhFhSYowTJZ*4UqJ zd&quy_1|s%&?rCib%*X@r@Zzco7vYbg5w=>g#$dI?Gcysd6BK+JaAhCK6i~r0(6Ps zh2HO_w@HC*hY)%|0^oV+N~(cyKoIt+?xik?Rs1gJq!ZbUoGV1IY;XZC7$SB*Onsh2 zq&@&^6#X({m~Y01F$%XGmjFd%8&|_-iI{nGhf?#ocrc0*`xtXKbqSnDaWjp+M{JY+ zK5N9MSsi3dl_acfNk#vzzvgoZi&mFxrDv7Z&mamD&t1 z$33zE(~!g_bBjP8=~h}nx&$dhkg|8=g?O{P$Qs3XM3h^*lV898BM*;~(?>Q}1X!~O zkq@Sb80BjjF^@)GL1a{jEOB2V83{^zD!Ysl`T)0*- zV@i#K)_6z@rF-yh*&cS_vxq}5U-RXAk!*T3uAWSuHnqY!G{4j6Aah;2_t)_4#WO>m zWef6?bDYDoB?P89QBc(L{t)C+w4(;v0R9(lmNdG0y( zWqTYL8z@3Sc@T6JQ=Hs8G8 zKKvgavest7&Uo+pZK6`Ky$^VqZMo$fd++HVv>%@TL%aIgYpvARYujwUJqy#vhKKF0 zJMOi^jy}@nZ#KuOlasb$#f!`^&EIS@`_{M4x2~RU5qaNUaju{a2$r_PW8>Vz%4Kv; zX_ACc3Rjf-5u)=VAtE1Y{K(bL6|*TJ6!??F93twdkr=B~Y@$}>zk~dPV9jG5%+WFENrQwR7?WzUIg%ncs&$A*S4P?+q%`~U5FHR|7!qN*R z)ZB&E>u96neFO`6eL_ykvU|O3&QP=Evb&$)rNkpb6@R`!8sMQ=XlLpQOuC(eAzN71 zgYZmM!Jfm|Y~!ciRhztglLe|+j2;ptulI;dioAm*?@+oa(qx)U+I+Qz99~MI#pf`%XB@&VJwV)FyH}X=$-aWzt@G#@Fn=$CvW( znc3fCzdGj(JA9v={P8GM^r8xem$4kQT*;2p~^3V5+Zz1|=`GX;)gF$QTxy4R&8xF%Z3 zhEClhxj`V348$`no5bRi3@ZU32l2cYXGfG*kOax(fE|@1L&ay8Nqr(|p_Fr&0r;T0 z6f)!%8d0rPf{+Bz;?T>(v9x)FTI*B0qq$ToOiCCQpL##KvgI-rZ9-!#;m>#Fey8G)FQH<$D^u90>E zo5o3NMT9B}b@aNlkNSS(^6GRj#pfZ?s3JxW)+E_sHXV}iEjK?B+3`%B=Ci-Y_w>B9 zCrcdqI`?&~x-?l^N;;Pj)wJY-5_%Cj_S3Lv_6eAzdE7o+vyAan7G6>5h?GWzI}6N& zMQPMKW(F1_EH2@q{k*JwGjO1c3ceRXCkE>HT~HH*91GfQWG!URNtsJ$I~%m2upGby zeQUH7WPYOF1`5z2G7YIpmlF``+H;o8+FG4}_~|m8u>K2N;{WO;dX~`Zf9-3Zx2~>| z9em*acEk05vA^7Km!0_5Q|d>+S8Z^2E4Z zarqx@XlTq1*#7{#>^GO#CqDf_`}^HXtY>h*8dEhp`AsL-UVFUE&OGab*4fifkhx*~ z8awGtC)km%ILbcwk&oL8%U-a3_u9p*F=_8T{Vcol?|--RzWaUKZs#4Xf3TlUTHpH0 zxwdTiYCGuFueAO5+|4SLaa*}^wLSdcgZ6RuEB|~li7&Sr?bh6&-rgO3T!rPoK8`b1ltUr zc;p(Oyc2VY;9Yhq7<1HQgv1e~6m<&tegJlKBnJt>Yfw;)3>>U^@!1H>HLQ&U1c7FJ zZdZGo^>>yC(m@7DEGHYbVk0sE8*QpOMMtOZ&Z718b#c#uvlW|BqG=?od(phG0<9rr zQ8H$j+0$j4&FHiKZWt|uf(FeFsjHM^9|Wif8|r|v4e1r?KG3YQXfr_`y5vfwKr~3c_FIh6SfysGhsSMbv~1;?*+{u=)kcer zS1Pt~ylmt3I-fQ65EQVZR|@{dM*uT|D9-9G+5EwN8|W@tR|%4=q7C$vND@_(f^q;6 z5Cwj)C$x*Kx&evQLf&hS_p7>#>3_1!KQ167=IJcuzM#ELLBhPFr6UoRsf7tm&; z&t+GbOiUH|=8m)$$prg3xD!E~KbVj{&e$Pa5K!3uVpy-^YSP5(Fq4?AH8r%_lMz&!wVwh{9x z1he=NL348xJ?3j#Kv^+;=!Edz%pE8D3<7fpWC5uFCRtVdre;QA)#^h!EG-`J`~xQK561-E^12OsVI3Sq14!W%*Mx4SxYBOvBJHKDLTys z70oERzu7ZNQE(W>3~_xy>UdB^VRO_Ccy@*(Pq6J{;cQ^TyXXr;y99NVYRMEcbYqL6E3r>N+1?CwaNdAL}n15OBRk z^T>!s^AOgIQ-CjKU(BU!KT@{B&lT$5CAVY56ae3|Cy2C$P9GAB2p+NFqbs!I%n7?w zfE5+8iUcSt2>_|aWK;>DDBUf25hZ4X7(xOsjVaYxG7x7? zf|u^@E;d*rv7su#vzuH;S)U(|_54c`tbf|Z|K%U#&x2OG_S)autXciG)gZMgvgYNGeGjn14mrfW@YS;k_K^s%b=TSrH{ND@9)5(i7n(M+zt=!8y1P29 zwJ~Mi`_2!oueZm0Tq#S5C^@6=VNei7>E(*{^j2d7NGKa{CIh&!j|6*8$k3OR#uL;r zYC01#(+{lAiCRtew~%+&K*%8?tn(_ovAa_2Ci*H@h#6SZ8x1-*JsVxm!WFeU0 zfQB#}0~~#YJCKNrnzTf8uZ=~=u6d*_Z$J&5T&mO7@fp%D5hbzBudgQw?FihjgFUX?#uyu?+HiRs}9)B zw%u}WW|fz+ECNr;=CsNlZ)(c^bnE^0)eHV$PdvYpV}VKXvA4a>K62XYSX33`GhVLP z8_zn=Zh!bGFU)GOBlq9c&VJtsw%wL1h+dR`r1*9zLz2P<8q(MkK}O1U7v(@(F#7(u)C%eFb?0 zUocPvBuiySrhxFxc}$FPT#McpEG8c<&w7&NBN}*I`P6BAHUce_Z*o3bLwu1NU|{}-Cj4r=Spyd`Uh>?u^trN6FJt;qNrT=9vPdoZ|BH< zWOq1TzTN;@V*YcxCm7d$mmSw(iyAb}v->U;i0EEq>-b(q<)pKBWiR(v1=%zg+2Opi zsK5eb3A8T_3W-eo6bnuPIN(r)dO}2<sQ+I%U9bDJ1w^QWZ7O=y3`(dXo-F7tPfjTXThF$J?2>Z&JTWQOINJ2 zm8(}T$DVw$b#!;x#L%$4>(o=M-l*B{ulkEsTib1~z4x${OPAWZ zb!*uhq^GNBZ+P7s?C7Ijll1b~JD^MeA;2z7`4gkS2xivU*bvz-5JS|50!ZRqhg(wA z53x4H7jp!iVhv*M1aW8cy}Am)Q4fkv-~hxh#ld-n=MI9Q?NCpbnGn=dOx6;Z$MeU0 zLDm4hVd$y_``voOMkiGyPIBJb#@EC-2n$&_HDM0oXOMUyi-KB+u}R4BTbMyWBSO@1 z;Qm;6j!x+4#WGQ`>ZDr24?u!6qn8Z`;TGCigbQh%eOQQjf<#c-sMU(KfX@}?QbG^o z5BExRN9S0f`?*Kwb$03;VKT*WtumwfEt)oBuLCLQ=`7k{U#AVA2CF^XU^7&LJsE}g zW0gr;KUTGMBa`;R`cYdmJYhql6&qsq1J4Jxy~d`OS%v_g2TaspZAgDdk;V7Dr8e7g zW}j^{x8M3ZL_Ffaq!9(}zai6VlfuY@CJ_n+_-9WO5)=iNpxL}{du_T=*`Nf3~&fQ{}^`|rx)K^{U$YL<)kGAp5I7Sf&QZ2tY<{?+b%{5jiZ{v0}2 zAp)|~!uj^@H@)0CN;;4t(gDKq;+hS7&*((i#wV(F(|t>rbvf~s``g=IcZlt?(>AV8 z)^QTY=QQw2W;|)Nx4YAhf5krb#>4lv!}ne+8{a@fInafu zJoS~ErXB(}Me(T5ngF&0nyJ!LvW9q`lCpR&m0X4@o=pVj8F`K3U#F4zNOPKEj1URb zsrEwWqZU#2-|6RmeBvN>D+B=;cEI*php;i-HRW(K-;d9-i^Y3dy~YHC9yW zjGlv~ksWcV9$|O-PC-EZJF+KkBkF{Mc|w?$gV%bcN0%}v3M0f= z;FIJ1Nv;=jB`2dv^T4;GAa&U$m(|H&{V*y6PzYONCpAIt1O#xG4vy1@2uNkwi|Nl- z2foYU9CL~I29fdymSP{7oGpE(0}&O^d)-LbOOiQ=4(QlxG)De{ z_>ZU|VXuy;KZz8)gLki4NUcb75-MF&mdz3u@vxACn6Nw6eh}c-XJL+%MZ}f`v>s@I z35sfrTv6&|oj}727~>q$LFd^$j-R~x(=A7Kl2g%psrYYsj(E*aX4&q6uAEaN?l-a* zs_{@y4b@t>r6)Un#zy%2w$Oj95 zOLEDf*$W#9x=a!J^g_WpIwI>W$%y8VKv?vF(f;iF=f7Bl{(s9v;;f7C;2n3|V%J@N zwLSCv^LG4kC&6~buD$tsyXVfEZS9)%_R)`h%$|MvaRTYfueiqEe%h&4Y1Hld8~$o& z?6-L5oot8gcC?d^JK28s`%7)fvoBbGUmvA8b7#%5qh9`UyY{+k?8UX~t-HIIzz0&8 zHyrbN`_nbo**~6r*2c!hDcM@M5l0+iU;XyCt-Zb5 z4mx08d+@INc)bT7exU8T<3fAv;fL+NF8r+(NiG#>FIOOmf`zQIXyM*AF;Ql12wNG@ zgaF?nnG!m+LxvU6`4ndJIj-yn`n{mf7(lXQRm~={66gT}`&pQ=&~AYTZD(71s%sM= z!n|%137M>u93e|BY=mmykR>TYvIVJ7lzgGim$ew)?9a1m0GZfhAPGZr!F9tE z%nE?~AUo1U8)Dhsj#O$kGARib#scp}t;NF4XWJID2dvNvK#l@;$f4LpNAnuaR?I|$ zSje@GO*=7$ic&MHgX^pDTD-mtb+G8C!C*MX+wm6FT;4+@AEEay=2&k4`N-b%QCcr~ z97q+6j8No`T?_qD(2Q}#hO#}kddQX!joUEpaU8WEHLIXUk9Ug4Mn+W-m#Lp^Ab*86 zen+X$V%_a6ws20rZG(O%?Pd*-#V{qIg)nNt+O5B*lSG5(K5>@r3;O|jh#-4|djPi0 zWK`O*)ZY!3=raBhq0F0;xXTsfXx!Av1imiq|G5xlwFxn7Se(Ov8A129q0~ zhxUbx9C<;XfJi1cz+?lf3((5piXI(NphY4fNWdt**Lg5{;8C(jG6(ok)&OrpDp8v> zA3qA|;YKhzZcCnBZvXkKzu0|`Kg;h&A^9_z$0jQ$=nI+7eeT+|;V*kuNIhepQi zzJEMtpFICkTef<=&6_>QdXJM{xj)@Z*bfC`hll_Q$>3+Db6RBuCUMl_zHXUndLS# zI$?u--S(lk9Br>Xcy~&)a6L&T!^x4Q%|d#@3FikQ0ZOj3ufTcsCt{$1MLEftatT0} zOS=(kE1H^rpYlmBA?NWLA-q@;nphYqzUh-a3&!eeoj~(tE+v6u1^|d}2r0EhaGc!_ zRzZNuEaN2S5_SM!(Wuio+>7f(@f-w%630!ltFT~o*p_Q1=Mf)obji&%K07xa(OFfW zompIm^d=7!B66OhoXLtaEfN*_DdO}wn*v<2Ag@Jgvu*?Mr@H#+9t{^=T#+Ta^t{ZDWQiK+_BZXTJ zfF9;@gYpFghuFn>s(~6-Mw;Qo11BMZi?$Z)C_o>MVq8T-sl{fWE@{T2VWQ8Xj4ZR> zCco4A>Q9-ge;$ed{hzej%{N_R-}(N3+M!1tWlJ7=(oQ+?MEm-8&$p#dKW^QnF8lZ= zK4s^e{aHKUfIV&LiuLyT*S*nRT)m3fqZu=2SbcKRN^K>3+gsme-}}+`?3Q~Tv9@N- zmM>pw^;*>yZoL(s&&H84Te@N`!EU`ek(~5;`}?i0ug^A{x4G@P%kK87BM!3*e|x!& zRm!$%N^%$`2G^{#tu?)vkWOF_b6^}Is@relE>s&Qs>}kR@n1)$8tTEd3NzKuUo1ifCNu_)|^mJTSq&C1}i;MeH%tu`Uq6 z20+f-6=gw;wTNru_R~Nu3TkuIToX=M$Xv2k2jj=)6_6IG>wMMaWY4V`vn4OAB>_RU z16|rj%IMKjXMhv;$vO^2W!#9x-StRzinQPDEwf;gUC>33Rw*>zZTi8|GH%fU9g~~Wc18|ei08D zomU%8PHyV&yr~ku2wZa>HiaNT z0s(>3)aVQUUz>v4McFR=!_D^l8}GFj*KTA1`NvLstsT0@jy88@zZ&1<$P_+n{m7V| zf5|oW@Y65Y=l=aows@O)96OAYdMao$t4>z!`IT$!H`m;07hQD=7s`$c=Gp1Tzrv2( zZx_j`qDH~xH<29>)xS&EN1nECUviDDS~o=Ev*Uuz?c}2mv||q4gOeIs zJ~b-a1%Ho2IP0@i#B2moc3SiMSBvP1O&k@pr-c+ii z=@I}{mlq@>f(7}1YYXu|aVvgTLHhW44sKZF7thKGq250o5XGjJ{ak%y0=OkRUI&ph z2%z;}RyUI-V31A!LCkCcRVN;Zu=&4r|DHN_7%u#s^>*PnX9ZoMm(35)H#sTK#*1_==7&EGU2i<~6eLU!D(oORo*o#AXCw~d1jGqi zmQm2N(!KcSdz6iH)Vs<@bSp*I1Nb9lA6$)#Ah^ z-wc<}l$jIBqEd!~CMoD1E^-c^l6u`+#<9kX*Xi(eJgg51MBDHxw) z0V|@vrGj;J!V!hQZzJVuuK6nfu6`3$puK0_Wvybfo=LvFZ!X~_u##@?Y7(5>eVZ3 z-MV4hI5EarhW1*`-to?N+vm?Y+xiB3c`qM&-x>D8ie*-6FWCz(uCf)YR@sL2>ukfi zjkadpC}nH7x1NDMN@nKHnPCHcy#&jswM3AjTB+IC*cbzDlamwH)7@bkHg2?fwQ1v% z6`L_IgHdz@U+2!5Y43mczuP1r+=8i0t<}l`tG8=HAQnzzpSB!x{1Rlmfqr2MF1t%WuMWc*&HC+MxEa~aPFq(^>?>LQJ~ z4srsgHG)?Mpj5>;A)mFw-P7l&-!Se;$q5kwxZp{}r= z*`aQIQxZv{`o-#;atl zMZH%|N<}*Q5Ts~tp$#|slqgG@H4|6e8hWi{4G6VEQMm829!cj6 zLsB4Fo&jOwMu#OjFWf{2PlWYEnS7ilYbHXnmJ4ovw22#nzAmi$h!wyJ;osa;qy-ZW zH-|ArK0->bYbe-kkv3mMZeBOS@OEoZfyRZ?T~c9NeCB*3ou-QBY@k& z>j>Yi00VUIk$%x=5?3A^e3CCm!ofZBc0)^^bDi|ok#cd>2e&EWySiQ(uW z3W51g+21qOS+3OVk!P3NwYNWHSKV?y8wBpQ{Z<6>uRCNzzGyV(^f!(c4Hy5a7} z?EK$cWA{D&9BW0OdwlybhuNvGJ;=7&d^R_M0*m`y`hkUCt=rSfSKFo6-bvT1H5*54 z(N>$;8xG&wjyYrxn>Tkbb@=r1R)=;@%p4?P6GKCydzL(B*WK~3-FWX3l9AbieRjm& zi#Zmr+u~#j#O;QUle1|(dXDxTs(@5b58Qy43k7D`=rRy z@c8tDR6ss}V5C?xW*+J6VC%u?75#Q6wS*|+0zG5FOpm^b$!Y(tR7@L%t${@2ex!16 zk9fULokNvb(B@k-&eSfQdTf0HOrA1t+fo4FiXm*q9@_Aewu_YyEmsG&dr@oD*F=C(8-xH zi5{f!{ggmJd0DR~id)}=LHYcM0z;DQO{|-hdC9QvrtlZ{q#g*_AMFt$eN#-^M?_dB zMUXnJhFrlpb;&-j+*UJ4Qxvqu{=w)R*QUT49}V|@?=#diE1*u#Gw3+{aV|0<+6oB< z^!~C3)q8dRfq-;(6s)TQBtX*PQo$&nAa7}DwY4KbR|ItY z1w=Gktrr%&Xl4geQq%s%{)_uH$EKH8ppVVV8z%FFB(ha6&a=gzQotC!oXSzFk=h1=WDF8YOS zw%J_UZkq+R?Yyn*ktd$8`yXCn!^1RI=9_$ zo6Xy1ft~r@ciZ>B|6^-wZ)Y9I#trLj;k>!_=}&xtq(u@zjWFe%u!My?3XT6-A(>HU z=$L1cs7x{Fhil0fNYmyyf@M>1rfRT>AEZWjAEZX*I*3zM&GD$k2iB6cE>GT%1t*sy*3eI5avtL>ZK1&&ws4wKwcZ^3x2Q&XL13(XrcH$9X zMI8y%ntF*qb|tAJNXGOApUOBlIFH%!99f1+jYJFkJJu7jDkwAHsl*x@}*OUP`|#=DJDD+D<@+KUXbgLGq`!21U~+pQmtYsFUUcJm7W|M=5_48*johbsv} zx<+iIJ|R>jFd*u!2s~p>(K6ZugnXZYRmsd)g29AAree~u=e@K-_L*enGO*&&^Rt^C zW_%Ss;#inS`@s*I9VMwBQ};-)eS8TvKRh%>@76Mb-Zp-pw|>gjZ5*{N=FYTzciGn7 zcI=_-p@A#{Q{;|rC|P!75t$3zBPP`F*aR(ae{}iZ?9NA?=Ado6#a#RFDX*~uci-On zx;nY21RnH}SeVE_JiC0go%hSX*j2Yaz<=k9Xfb|UZ$8UD`)_Zwm+!N)%^c`r)Pw}g z(^+^uo(0Ixudlh?esk>|lzPEu8+9Vby?kF=IDeLPl{&ac#V&Ob(p6_@9b=76Zo}}n z-SO~~_LD1aw0}JJq798r*v~)vZ+7gVdpZfoBD{%qXU2fd8SL}gju zc`762ya8QtxXO@VBEu5V9{)YZ*-MqV_Ns`)$tz#eaZ`z)$QKT1>{W=g;wOwovnbRv zRoO|9@d*D}Wb?#zGHq-kK8bqdi`)ZnOR5xqbO=XQOV=CEPnklIF=agRSsDd-lp&H` z?52Mrh@fYpkB(wRkyQUS267{46huM4)ul%5UbeSPCti{XvW|$d79E6}5)h6+bhS?s z14&#XV@MF_vxrg%kQHVP6>XN~aS(bLue2fX##n1zk!sXmxMUR#;E>5+2X}%YorwSo z00+o;V7);@uIMG!_7t17tsAM>y0I!r4CGd51~)}=C^;1hNjuw7RN86-T}2!0>L3Au z16F6Ljer-~7LX$LMex8JJ4(aim74dMUYSY4|1$!T&W;xQ$5W5nch3Ko9ewmGZD?e~ zesjn=xaC6+3&ZSSWEVu3fu| z!N!S7*(&8pn>lj^$9>MM8CIScwb9`rd*aC_t=Zacecj#m{IXT{_ES%>3x0Bet=q8C z-g)}F?DpI5v{^lE_WkpJPT5>Yc)7PE1BHkH&P|Ah+4c|gt5#o)1eWzqJpLHLefn)21aI!)X`jqCP1fTQkX)@9pN8j9w%yg zeZ8i;W<6Jn8h`e8byz1-k$ijto9MrSLUYu#JilhWJ+pG7jn-Od!;3s7yr~I2p&p|U;x1az1CcEr!cM-JW0iJyH z0rsvp9Kj;<4(NS-%a1G#J_ki@AU&V`!DV*s9S_@v;jw=@%=16M1KVM%&Fq{rPq4%H zT+D+88-*kaj5SL`+HBg$*aVv!e&vEc(1sVO<{h`*+|E4lRd&?=yKr*zaPlYxHx3{3 zOlvRP26FZ1+a9n}KlelX?#E7JHiqdkud{ini^k+!^4to0`xky<&#hQ%J^wA?`pOw6 z*a=7O>rM!|-szGQO~!l_GEZuv_CqqOtT;E+`&bCjn4Wdsuk80X-OI~5_OQL|n;(1& zzdw)YJf@qzKa2V|DVsavYZuuq_dmg+L6DEHzW*dUa=+aiu)6L&Kz9OIp2dlYO}U3l zpIC%gweMVVja_`zEllkm^s+_vy-&V_az6ZFq={E4GB3~^U{VYH$z?0;{a?M1nW_HX zF8k=)kF{4H{4#F9d^NO^sfkbkxeR%RGzHdwU-`)u_P0A8;(@ZyF5B5TA2^vdkO2Xs zsiDA^_ZM-ZHCC?JIX}A0o?N~Nz2sYSayB+(A{p|He?a#d=!pHKZUEJr+ix$|iNA64OOsp-)RVYhz zS)B+88iFbVLTSOYItcx2_1ca0o<-}o6rB#SYXZJe$fec-exmx|2=oMg1d zc-z$F8VZFr9q{Z7?c;#?g>x2iv5>^_`RXLjP1oFW`v18AT~j6Yr&hcE#%t{Q>#ws# zi?+8vUwe&pb@kYBuY0|%Sn+~=^b?=6Pk-uDws`R(yX=Z9>>p1*ZS%L@+D1mlZOg3| z*cO}5xAE~YHd)+!&RjeA;DhXnKVE5#$#Gk|dYNq;9lX zFD$jO;St+wzkO}LeGah7WZnMp^pkeoU$3))!9m-7*IjMfZML_1ZIV?=l}g3du3JY^ zf@ivZ<#N04kteLXtA`z)A^$q#{qM6MfA7W(*Gao}2~BRIcRcCbG+% zVOecp*4sgkhQJe1{F*Wilwl#@%8-AnO`$e}PE~aqtD@ujB3WB%j&w(WXdtTHd z;CCR&k|v>BI`%oDB$ub79z}C7oI9uL*lQ&-{QsDH5AZ6htP6Oh=cXqlbP()d$KJ8G zv5V-~u!}kt1iKE-*cGw&uGkPe>R7;v=qSYsDxgRwA-&!t_jj$m&wFnGznO2o`Jexf zj}I-m_r33X&OUqXz1G^)9C2O+X?>v><)kbxMuzoDW(>O#?9egMHODSznb}(OSs1)l zCA9uO3%0aM4pnnaEq6m2-Uot^;0DjN&2EQ^ybctym}uu@Yp*d!v}D;nkM&c0XlP2@ z;65byu-PQm?bRH)^fa`!wW+hr#7rl+vt0o~U)FVoW|MF0RG07*naRE6_SmR8ka zNp&5n8{=ps_+a;=Js}HYzPGwgp#ZNK7z!1}=rL_^7eKf~Rqah|yGBhe82Cg{ozkupZ3@ajP-2 zKeRTMRlhCV1?Z8qModHZJx-S<$SXGx2{QvcDSwY=t z^9^v~pLW6UeRmY%4?@NWu=zdbJ^1FQg?Qz|8F=E2Pn5W_o5C)}@O`((78~}r36-g5 z&}yzvy#ExtA2wz@?izD~1}p}5v1A?1t~*pqSsA}z+|zjIk>@BC?amK8RO8{3>dba^qB#6ymizMq|*xK0aMFd3E|6E`|+tY0-zglo04mAI+G9 z5m((O>t;KD(s1MX$Ktqyc2;XLs-83H)wJVuRh-26bw28-aZlsTk7q<4+62qb-F$&M zU6wH0LkQJfyU#v|&;c|Li@PSgiN{}^ssn~!O#1Kt>zUYLiw&LE?nz|I44p88fr0<- z36nA5^^bHQ{Xw%BN(Ee8P*UzL8yn`4Q^D;2a|d`@$T>u!Gv^M76PpI(CEWl>>1Hr;q#?6}Qf z4B2!;7wU!1*6Jn<)&~m0z|j5DwMW&`kVGbV{wex)2l>g}Yk(!R59}U9I3X&)*rB6! zO#tEtPq=4M2uaok?2va9XzSR%ONWw!80~$ziP_)V;bs2o!KEpwZAz(-G3koHhks6g zhY(-FrqFdb0Ab=tdP@{5J>L1dYX#_eYhIT>??C%>0LqKhImNxhZbWvLs3n@7OiBq| zYT~R?8}JI0nE;^WY$YzcRVaCu%1MaA;C9-cQv2cSP5fx5HcMkd#zChN%Cg*SR21iF zR)TDJv#smFmJrWo3E!RKtU{qGrQQ>EvW z{(@hSp4N%(WyLsk#7Mk1^)1|f_ro~mxRdblCm*A7)hcAi@-b-eU~E2kV`OCIVAhNo zC@sp?{Elt6-T}MpJQNQ-@enGP%)^{HKd3_8r{B7`^2%$leA#lGcfq+@^644bsHv^S zm{AuaKff3se)=h%pY);z1NQ6J7l$5lIEsr3&`?u_Z@>Q@9cfvpsHiYI;L`4yCB;EF?FCvd4z_Tx zU~8*7+p^g)`9&m9j{r(X2kKkn8Z^jnVnQv)G}TwqWTUGh7d0O3Hqo4gHm0VWkmm|X)t}C)OZ0MmIRk&V)ojB3IR3Kxwj~#YWkm3SH6p>rE z*nko#Qlgltvd+C_m46kjN!wAKAWfYT0g(0%??PG^fcsF6mKtDa0)9=F&j^Ky;Mirf zHELwq+RRmp<|D1t0=34`*yb}^I@6J+nLDqb8%_z4Z#me;{erS3sm2?HQxF60gW1pCjlod&%*+i0A1cMW!WBFJ>9Z;OgE{EDj zKm0~VuY^(p3O2D*1^}Ur<;M&8aM3^{xAv4vf&UB-el5g!T$5aLva-?G)B@5f%=_BF zi{r$|0n0ds)}}M3Eweq7tB1(8fP2vNk)?~uuPcY%F zPqb-mlP4?G|8D4(V^(IS=73x};$ZB(!zP+`ZdH?Tv^rgao0`LkT3YdsY2V<<$sgmN z-_1v3OB*&{zc0=mzAv`hWL>P^w|f_1y)$KWNdbV|eep>+=})`(`y{VcVI=AhLC#!9 zU3@3r`{KLkn+QC{cADS-DL(-N>{$$(CJeLKR*_R6MtP7I)m~BK%2eVeX&w zK1Pq95WOdpgsV$ilDL1ba=d!S#V9Gtx48-A?1lof-qojIl?C4lj0wq~6z{%G1Hh?~^e?7&aO0 zNOv)_!=9-;yB>uxQm~9#CrVyBE2yk02QvfHj47Fk3Mh2%aSfL>VoXfTfoTGFM%Uq2 z5c86bVeVF)$jzXjGy~m>@=;z~fYSUJa>%;i_e*n<>{4@>VVL_7D9ZXy*BS-d;J>k5 z{_EdjYnNXcxbyCtQC+)A>vZ2ehhpsIV{qRCPhsAIukpa+6Y<@T3(%uaUu-;R5H=k& z7(4HW0pEnL!SvlB!mtB=l zJU8(rvv5t%#PX$;IPsXH(cIXGufLyzujkA~EH8$ph9;bL)>&w7Y{0KS&&B7{r=z4> z1@<{$e^iwB(28rUsYF?M85S*BhHroP3G?PJ#6f%SiGc%q zi%CDCYZgBT0f;mR4nSz{Yu4=M5J;Dp)4;41=$%I zYRI_3{~5!0uY(@do_P@F+Zy1PLam>F#@Yz<;jYx*(6tU{6N8e9%>Fs-6tm_)5UYog z8+HzOKP@yK9-jJbg1~|m26i7*b$2c`e~?0S3Se|F`GLv{WhH|bsR28rYH3)ZanHDL zXdPBx*QCVFDoaFgUX}N%fH{kVAu(1-llCLagiyjj?k1%Go3hg*Tf~%VkFM7phls{{ z?sg10m1Q{2-gxSb5Anq7AEAoQ1L^5mx5a+x)C4 zsP{uKP_1~kIj@7xT1*<8jx;Ct-vG zkZ}EL6DhJIL;&*sKa&8YTS)=Fe)f9wDldtWdpS-qEOF!c-)d2Mf}&Qle-5L^m}>(U zv4n6@{f^d^9n#;V0ubJxt4}{1mz{EG^qQ-~y^!t`5c4_hapv`F?Mg98KmD*harGHT z2s9@ZyPkMCXEGe-bXVa$Vq(TkIN_~NF?!t7T@wF;ci$R!U2>9WjS5n}>2=pbHQTGM ztS}ut=61}QO8{b@qJPhFymIHovQM^rGkAA<7eoo5eJ|JCBQL#=2PeKGI#~4l0Ia`G zFFbnPIVdYCu!J>~q9eVMSKTExjN_u49>ermbN_1qgnMe^b^Cw-BsV)p2bQfof;mk) zwLeR56~~Kjeu}%E`tJY`#S&4ovT^3|2Vvjch6GNd@-rP6UYWGEvaJ}#xuwfj;i{V- zMs-d7zmr@1Ti>HSos*6I_t*}H9k7cI&=gD>t-E9uH7Rfn8!J!>L-oqE6UMhTmy$qr zvg(>W?$jZbP73fftzwYYW3aOg@9CARl;MS;{3G`iPx!+JU!8Ip{%p3j$<`+S-Ueoc z-I~aZEPB{d==$e>YvKMMzRA{S z2JX3c90snp4pvrHVc>uPIQhgA@y46);^I+fV@Yirib_lH=RY5h1q&9SzNQL?9k?&D zb4u~`oUbuw)(2R+WU=mBNl7_&*kLy;TD%BvzV((899F#3Iy*7y{Bw{Ui($;=*Pybx zMg!m4n%Z&g)uYj;R|TGY_9eXa{>O+F#DF&7s6P+KrkiboZ@!w1mnTj_MphaQI_w~9 zw#5($|L4s8PS3j_7DLY-J@D1n-{Yrw3$V}7p*Z`LGcaJCeo4*bYWI1~Tjm8x76UwX zha`}Df%8ck8e6nZI5ULnUKCMw?*%&Awa4jbE319ZzmR2a2hw$xrlZ|mpkyJQmM$td zW4gL_E^xP)V*rN-0@tjn>I8A3I+;enY@}`e6uaTAZS3CJx))%`GTjrwkGcRpB#~#e z(U5#53in*QTmFVdzR8}X8Ie#tBMaGl%d|8VZ<$B2@E~V5<)a3=3t~CQcUlpzkpO}2 zNv*Bz%6l4Qh1-thwT)O-+o*fSpQ9O3N2d)Dq+WyV78an`CD9&DbfQ;T0s2)GqFX_Z zQLucb4m&?fs_OC6l2ur=ssYXIrrm04H4wjveFYM%gaSsEL+pu3v<&2M#}PH zD5B$-TMLVB?B^b5$4O`(8GHmyUl5{OSId^RXWo(a!?d@-1}cCX3oqUw@mQk_gU^u; zWv=N7$E`x{J@3p+P`(y;sIrE0w5D2%#4tAHkgYtcv?#=jjz!^mmo9~)x$b3!I&k?R zBo1?D8{+_5#fSg%rf5ixQ*IcH2|#F}D1NRw8{T408CqtjDsbq$qU6p>K?J$(f#-Idl4y$r|fzZ13_ygt_H+g<+aYM*;`IRq0EF?FE2 zt_jb-^O-1G-~9BOfJ|^d_&>zzwf-pIlU%;OJ<71hHiI$p$UOz5rzzA@S6+cIpem z7ArKbPWb}2Jobv_y@bS%&u+-zbun)A$>>&`r^<^>{Pv2vmnp=}muVMyuyI^?)1zGg z2$S~2Zj@V-Gx)CT1sjKM-u~!Itf;K%LLuY5C@jpwHKR_z2Bg|Cwt2_H zfN}tJF4PCs3P4Ir3Nh?YLnUMll(=Y_xa%1O>np2j@#XBf0xuD-+rN?Phn?WD?)X#5ZD>JQ4`gkZ;ieto%2opwk$rF1a1+sqBK=mNRoVC1 z8up5q(<>t|OIN%^&V9M|(R z1gZNWjO#_H08AnlnqDV3iv@aGq~KG+#Y!X3Kx#2~aGT?`-RrhCQd^8tC0&X)8|?Ls z?qMLrD#9k{G!PhE!=#B6HnMBBSq&yCXYR+Oj=$z*rYj-pRaS(Gk^*TCHR0U#m~!Zn zPSQI6M!QbVm9S9dn#_~}+M0{^zkOh4FXZj>?)= z%=={_4mfasoIc_-%$hwDbH4u?jkT2+G-xB7a>{vl?C}Tj^n^zhznCa<9i4vanOL@T zDW-q=1>XN~n%uALH%`)<4A&?AmOWnBYmR@NXhmWN?S{0TQ+_cx3@<7~Y7 z_IqHmv)+0eVUr<)G3>B|G5OWE@bb&AY4z;1+s@c?-@VZN_xpY0E#pvH)*YK|u@!oD z?}nmS7Ji)fBR=`!TikimICXLu-vS*r$`c%Lr;^}8mrvafF>}H>Yu!e6pXsv1^~G5b zTIPL>G)GY1y(dpI+MqU&~>*X9<^mOHWQ zVO4a?#mu}z!folNtX?BcT3Wgie1biGnby=2XeQ}Q?xid3r2fPN?beAj`*}0Ju&#Xo z%cdXU>)4tnDB`me#nEtr>G#rD0MA5eVIJ~xI6K8O2P}CvcebOxu}xFfYnocIthx~^ zYg4O7Q)T)wuNR8%xyD)(t=!cFU`|r^8Cz9l$3B#WCq$=J2mNi z$*Kk{uWgb|Zbw>%Kpl;aq_1%ye<-d5JN}Tkt0>~8LSc;vn9HEVnw3EpV#k@$v;(C{ zF@~Veh5Z~}V)V;kNWuJ^E@Uj2u~<%o@F6}aTi33%(%S$OUCi_ouk1+oY)tvRBK3M&qL@Z#^bwqfr4CHU-{pG3J? zxU^E#nV<*we=~%K*JiNeM9jUn+Z2cIu?=?JY9o{s6{rIh4p=1tj#AY=jkn{y>EB|+ z*az_B-_F7TJ8jX$oBHi(voY+FyYax4r{d^+w$t;pbbjq${}O<3@rw6oq$^vZHi)Tf zKn|~;Omy_Uig@;K3Sev}$K$wf;(NGgZ2;ud!&d7!xyN)!nmVo8IB)R^3_asItXNh1 zhmUGtpYC|#ZzHk!hW*{<(?F3DAg8e?$T+~Z0|9vUtxqxP)~D9&fLz87NVX**8eEtv z;BtPXgx3ThLp&jV+^{nbD^Y4VIranspa0$iFc;W##MJcE1F|ii`*xhZqN@m zU33C^R+LGk$NOmA6|WrYbD5o}CAR5WWJFTG> zGyq;{bw{O8u{DiBk{fG3=i)Ruh{Q2b0OXA>&*<{AkH&#Rw{`Aguv_*O%D%BDo4g+@ zSJh&|t5Yy_+H5qpwnp?k#+2Q*-3+77I1<@8S(;nJZZ3g~ih=q7;kAL~D_7z2o4R&D z`u48CHDgYd&^^)yMYAzN@HP%|Q&S5T{I(PyfBrRQe>V?J%~st^?&VDEz1!9}@}S*N zSYWSb$#OD@4?$dd9tQwQos%yU&A13qB?41n1G|PweSmPlgcBf2*`4;K4vN`4hvS+_ zF-5vedJF{E3(HALYbO9Dw_6M#*Xfj+B&@1$GFi8oE__vT*nRz^7>j6?28xmwr2-8r z{C)T=(cm^!f!&2rwyQW{6^@QWXvV5OG@zYcNIV_6x<&&fbZelGfzm!PbW zR9w3g?0itGAmc+h3=#CvS~eNIqZl5hb97hd{O6~eLqdH1`Bc0+ zj^X2V&BT6VTSU96x?P8(R$75j*d+Gp0@d z7@z)gHh%c-drG7g=O#Y?JgO^~;-Ayr!sD-hfo|m$Xm4)9sV9!W(A|gPoKfeaxf5t< zYQy4XE3nHpTVUJ`H{jM=@4%!f zyo+7R2x5@fUeGr7qD5=GO|iVDwh@hu%{sFcyGX@KumEQ?s8%v-nV7n>nswm_SUT0| zNYBVZevDSo>@;(jpT#0h=O*=wNiGN1<sD{k>GAs|` z>xrDBt{aQe6k;2_ka-{RiA)x}BN^mjD&D#oi>cfQE)0N#q1Cbv*04tFc*?zsPOLCt zJlO#JY)lc@1xo8kps}Mvv?^*dme(|5>8g6vG#N#b7bPGjhbrq5g_^xtfSVqT6sMf* zOcWQ!)H$H@oY^?r=!J&nIBJ^Ou&S{YjV_DRtQ4>1MBQUvH$j^sq<>b+)ofgE2;%9CeUT0@=wR$* z(m4{eEuw_jeNqwU{n0Shl$OMavG$+SLw_7$S7ZA5^Gc~@o&e*csq<;^rT-AU@ zl@yTW>Vq%|VrPVwc)VQ<#-bq5Cpt6Jgi7s1QF zttk)U$zo4r)yrMJ?Vm3fP?$Jwl!p0P3)?t~qi=g!9fHYsU5bj*LVZrP#?*CTm7!h3 zXXY(hjvF3%72o~5NE(P#y1{=Qn*Z~k6fZC%L!FzEN9~1SdvA-<;sWGmnd?F77X!-& zUw)5a7vG78t~?co?6$R6@r{f8%G9qg;%^V&vA>>)LwDaQnvniS!ixWig4MIUBofGk zN_}WY+BJC+5{^k#NJ5BC(gRYbM)P%85xHj~DOhWEKuEz#{j&XP8%YO0?FSPH10bhg zi{<|V0O7jde$(~w+>Pg3NtSMPSr}ap0Xs+#;i_ ztgQob`Psv9;LvRhAc#kneBz!;+UoLqL?AW(u~#r<`fODWLrO-==tpn8(7QR-Z3ub? zORnuq;x8*It8vART>(hH-re!Hi%&s5*M^_0$ynfE)xlh_ccrf7`?jYr!dAZXC!Vb3g4kibwd(SGRUJUXfvNj;qjwKzQCM(ouFl*~jtgxT8 z1KYt;m^$v@P@Rj_I*2+q{W)rVhvG?ef9yl1evjfymrhXNs@eLrsxaqqxVw)}6JsoD zYbTeSE;0o?|wigU4-iXe8YWlrh(|be^`$CpU<#V zn%&Bk3$f_8Uy)x>h)b`y3bidQ7&hz}Ec$IB2KMcP9k<;Yzx+B6ue|aizW-*n<~#iT znz2~AWFE3|@^Sgtak4TVIG{gnyzDSSs{jBX07*naRQ5XA=6?3^tN38XZ>Z?eT`oqO zY%~Zb9(z1aKj$oD=NIew{P5#^B%12+^7GH(y{RAI&G+BO{P_#fyKi@`v{C2&1v7r1 zbbjCc_hZ|gcSJ#H5&HD(gN+BSgG)wV0p#Rh$d21%$mW|MD-lO^LjyM1s6QtE<0G7X z>Nz;@paYXq2h_Q;EZ3aWEo-?&#)ttbW^GisF z%E?aGTH+oc6GikdX{IbLSaHJku-s8QfL6K$3xU|L92;OXGy9dVM?hpwSpI*aQ~4pa zAFS-l^xCQ9%4vP31O?QjdJz<`_{xqv--8-s?#1fnR@64NV)4paEUv8Au>0~r;1G?FC^%*ad-d2kwp(~#D;Cr(Z%mJj>D)O-&INff1%D>< z1PBGWoY0!B!)4nI`(o+x8dNs6pjA^mJ4GAf1&|jP4$bVWbmS4(uzE`*t<#Wr#i(2Y z2fVQaH{`du3zQu!KD5O7&P*RfA?F7R1DHaB>#kM|%zK=64XSGD@!ZX$u-W?kJc+Vv z95a3brp=y<*KWTUJ<3Zgn3K!b8OM?p)wp-!yO=iXM@=RFe~V)EKZo#t{jYrZWyJ;9 zdhkFTxyLp*?tqN(Zv>7oDIz5E9#P zps2d(8HZJyJMqk$YidAf6MPo|NN$dE*sXeOYd%!ktx`&w&aly40SHCtq+n5#)P;V+ zpx@qs`HNOy#Fh7`qZ6*3`=EdC3fz0e=~#z)Cr{KZ&5QmJbwe!Sv+Lm#pnha+0Oa}c zW6-@@aTnlit=uFMuqts9L@IgqY*1Q{l$Lx5S=M>++I^a7Sth9i@>-YmaK+ifvA+Wl zpEwu&yS;D9z(^&dowClo_{K-EV9~NJuXW{Lj>V2c2CKYhB5r#I66X1(@N+C%K@G?w zT{Iwl1wc*)V_~3vCBtvfOz<`R0CJrI3oDD3t;CIYO+aPJ^WuedD=os9vyValK0TwS z6z-j(UIfwuSTd1y>beY62PP%bfNmrG4C9zeX^K{#y*H?LCMacc!w&0R^2U4M9gqcx>GC!GaJT9&y5 zC%YZCoGmHm?*r{i_r%vEk3v?jR0Z?{G~83(BHkx<7FZpYJ*a3-rcZ0@G%L@xb`Eo6 zrPU7c&|yjrY;#(ygW^!E=;~NzRY7)%0xFbY0r~OiX()`*iZ>=&2q&zU7ZxcoqU#Zb zrn%(c`>-)~^qAnu%!Bt*trF`>MWb=W67cvN-ZCW#N?lXYeQ~F)|1Ag!-KMZ!+S*zq z`2PEiHwp-xGjb$)_2_{wKl=wV66rW&;(KU=UaR|d$t^?9)I{LAYO@#L>oSv z^)p_2^IZ%YyfIEY=@c|IwBp|TZbf>2F^Y?eM6ua)&?Xpm_z}3}j&YiGMZhxe*Cl9g zZp6LgZo%B2e!~4vK8^bNCUnLdQJ7zV%P$&*$`w_(=b;C%-p1=1oxD8*#~m{a#~phz z60t&*_3nlB2lT-@Jxj4@@nQ@bya{@AE5H}iXJP#KyU?$H|A^Y!Vnc!tlF#YQq!xCdBhVJAiw zx}3Yjg0eedaf%1`9JN9@xtx^k!f$m%9HgeP=xo!u>0ZjhGLv9-E!4SJqH2@SE$&-E znP(bpXbB3qwg~#zIUq$$)GH>-+Tu2YLzC9M6Cxdlcl`L8{9MZCyi!gePD)upPL}3s z@tVkr;eF%#kXBaJ(1OaECM;T6gUb3AOyQG6j+JV@y@7~r=|O_;Am(!fnMd^ggWaQ8x`Pb)y5CV)?c^6T=k%G^765KRgI802fFarC_q!l zo|_}Dek~w(2?+^65FGJiFi9nfrwET%KxYMSI@#eAolfSFEKwsXcNAs$Lkp+aA?MwQ zUzV)Ivo~FUtu`7E4I*Pexa9T;_+-``ymH%U^y*%!+s2Lb>|38;>;n@8wo-Dee~kwI zKmHCbl>R-t;m4Q8Ip@%J*atJ_VAv&h;fb+l;DDXCw059|thM98m#5&0dnaPj&F5pc ztu{h-4mY5yoVp?qZH(HwKL#K@yHNuY9*#{tO?_4ZMZq>%-{xN3Ny3Cp;Y{byOIw3{ z0dipPr3ihk0OYU;fd@`v^qyXd;#*0Cz8U}_rR|!tj>0t$OzPrb#dS)HU((zRD_LL+ zjt*Lb-eKW;J@e)#YZsw=2gKI6RW8DG=&9dm}bap_V zzikZ4=@1qrElDf5WTF@2q%Yq^k&>9gqWdX9px@ z^Lr*|&)j*X?rNpPv$GSoKl(BzPyM3HDn9zaU2)uzd&|4t28X3osJ(>GHN0E^Gc21J7p&tjAVuyCD;4rx=yj(fbzYx3uZY_=i(a_W&v8VyWX3U0$E zZ4sNNl70T@*Deb^g|_58Un{iQmGXcO&8aT*B;P&e2yJ~aanxNKqj>DDIlX9<)rd`L{u9;gwBOW;vDY_3W9oCXYnKF47Lmq_m)VI#qE-cFb(Lolfk>brrh*_93_^mF zdf#35CU-vX6dAQR3<)&=&x$ZR9L0G#=uw=HlKd>6P)$*8CrV;jD9z`55>97lEtEoE z(*zjEB4`S{eyj4DQJS#_RLt{P1kpM**{~Hm0xi;kVyIk(B4OB2sU4lvP3BL^ZP=|a z(b8Cp$DVi$FTF7t8*H!<#$J9E-gx~*R4@A;l~r{puIP{Xzy6ADr3IKfXD+5spN%IT zdj^?lHK<%V56f#>@a4BZqI*RT{CU{XsIPCq)Q_itW#Q~h&f`kQdIQ$S?z;`eJrCW3 zoLEfrw`eB8j?p=%o`z-1SKzKk9}~q%1~b{2IO?DSQBmFvx7@yy5i)K=gtFC*y z3e1Wr&Xm#Qb(t|3k|*G3C0J@}mmWl5$z9_34PkbXxo)LNzhrxytI2XX0dh$JXuq3{ zqTC$h3WXoj12l>LaY zTwDOe@(~p(2;vm8nB)_nB*a$Y-xbHQB}6A3tE3{ytqhu0`CYU3WNt*4nJ7A%9RK2(V7sp+MzCAgB$khM$PkayKo_ziPw_T4e z8P#fkU`4Yd|)Seu4nx`o~_w?a%%L@7!}Kw%oX%THlsi zcxx~}Okk{=E?oTPy zo5x>#2T#8;rAy~#ubsBUIVT^2oXl(;j(m+kIkHZTwQZKIT!pLG=zvt5vG8A$?J|DO|L#DO-xZd;E|Ng6ZVOv?F(oeHuCwq6`JSmx~SqMDxSa zk_|WZ2rreAh}!_v)iO9e8xwYi3HEkQIStHXhjkqSNb$m1$_)(Q!~T zV%5oDY~s#RKD0I@KuiRAV6*ZY2&7iw_75ayAcv?a_uIpOjUaKHWJ!kuPus9cDvDw` zD9p`5_u?3ebIDFV=Ecdv&GIB+-GfcpSRGW}!%DUGavJ9X& z;~=mOd~g^qm(*xgS>?DW*|Q}P4ql=}&cSkWA0*d62>N^s{Mp*7WjOYv6Hr)MgpsG6 zg_43I%>U&F%=lsoKAHAU?7QE=C@jp!I(^E~(bkIlAASy(UwH$NsKdjL-iLz1QmnVZ z#^_d7j_tSE4z+cSnEmZ6#TQopX^GprXFqJQ#nyP`^_P&Dl_Bfd=4N(Yny~-g`=PF} z2`^5bELwG2TbqU(?!EKQ*lLSSaoe5av8-wp+TsZ`t*XO?7o3UbUi}AZYHLxsVmXc* zel%Wx`6aY;rs3d24?#sf%?a8umqUTCyBTFA#h#cY&&@#bRG~v|P#t<-<~{8kV%OS+ zz zbOCx^5xXW$Eu^p02Dr`Vwb8-J=S7H)PnS7riLI*>ia9nQ+LB_UUS-R0M~dD^ z#XC^b*rFV>uCW!X>YC9+Ee!Q{ZM5Vi&EArAUOSmM21o4u?D#UUE*oMuG%}+L%VMkx z=molHdbkBCQT5%JLdBgxFXDB2=O-C4{k5C|8GhbH7*0=3>OI7~aMU6FWH6vI_MJY3 z<^r=J#2nN_>V1J0M;<(P!ZLVYkdg z^4^gNXN5i-V>6*(SC>Ok+XAD>XScZOMc1tYTcGRmGd=#%_X#@Sh{or0I?PgxsEXX= zP81ZxR5fU7Y&68228mj@nPff7z?nnw6J(c0kidBq6!>tV1@ACYv$zNh1ayQJi-ME} zrlcD!rcd`mp*SvJTC7C^UOsrX`#6Xv(V;fEkiKtD6F8c>wMrT3=e*_$r_1<1y?ZpVGky@&BnzwuuIAiNG%)EPilx9H`)W(6Zu z!2_Q-CFlQN|CR%K>OOohnncOZ`S!H0@#ib<#l)Nbf<3kw6wUf*YHr0PcRi0MCx3!z zkN;H~84ZE-#LOsh_J{&4OBAd>03bcfODzfY1XGATqEZ>7R!W}TjqoFHun%hPXuf{XqLfaGM`4NM7OR*Ce= zt!poajqWN!HwxAm3GV`csjR8T$yeWpIrA5Had{#=>aNRA#U|_Z_f}~j!&ovBzM}Qz ztEFKxnv}(~q2j$F=q7#CPz_Yaet4AUkh~ zb5A}@#SQ_Gz-v~=&1jvBRm*;#7xUL!)*?b5eTs&whK_{biZ8T?`V*dQGS_we4J(;# zxc-i(HQ+FGC&=aAXOHbL{Lnq3@6&7P9)&uyCE`plLJ+r~_xs@h#5&F{cnq2Zr!{q{ zSbGdq&)7xo;W=dKkPsA$6R!p#NiP^S>L`2DlJB`U?CXv9MUkItf*X!=B8#eHa02I?A5c60LY7zo<~(p4f68yP*GNfg1mfeGH6pdN zZj(S^VFA|d)fap3wFhp#<95_GHKVn;8OxSc;;5qz$Bda@;l<}(Kw&`v&OYl*RIgfv zX8e`Hp7$%7J2R9#lRi|dO1`_kxm|c`oPui+pxl+pcbl6TSZA(Hdz6)N>Ot8BA&p&e zm)()fbcvK{4WG+S2wl|N`Kq`e2ZebYTF1RjO-Wn@BIaad3J`3sYHUJ7OI)Bvm3Io* z(=$|YS0bzRZPcr}rZ}o{S=mx!Ggf)~>+WFRkFGG?ppyMrlnN`4+vuL^Q< zoX&3%m-z`32cIHwh4?Vk8o|9H*KsF;^$b<@d?NUaIHOL zal(J=g>Qq|VfPvvAsJDV-HcQ^xp#uS7-|Mi!DiQYkaroZL+Jp*SqUL@C|6S9(f~*} zW6ed(o{^mJI6R!9{dCf@(ovE}OWtf0GlnRRWT|LD`2@cwxZd(U&?zj=t`R}3(>OU_ zh!j7K<gQq~ZHUgJhq?-kC)C2VUXINn5R?SIr^7(Mcoum&kAElCex8w~$mYlQeAD)D#U;hxd zUOWQ(?7XFMdELR_fr;{1oVB>4>VXM4EeWw20#^Y=cOfY7pIDjyR{$g=4Llsl+qPuN zMbL>f%>8vK_FM}9SvmDVZS40x{|0AW|1g$UC0()@ct;M~2bZ3Fuz0mf{6Z_k0SN;o zDSH>)x@HID&Pz{3UT!QoE!i~^p&G4RMDt|YarEfhFmp8<-q-HDMEV{EI$F$LaP#As z@xubMUi5%PBZ3<)JYMudCb9++f}>J$rb9>$0|*JQBsD2rI{=B{83K@QrF#BK@=|pd zYR`H#$g9aoaKUIpkABPgEL{#svjwZru_RE^9FVuCtwF(}1|$HGh(qrH#7o}}V(m4p zo709{9(WN`r_b)PosKzVD25-hyA@XanvAO)F3?)b%U9Im>eT^AFLS}7^G#F*_MdYm zkwZDxF{E@N?0~hz`JIox#B(pb*X21<3v&IHXR07!Yb0|S2s#g&@@zdSOU8||VV@>63vCuqIFLiHEu~}cv>L-?_I)`S znL6XRTH_kj)(Lt}4(wipeicQ?<%D!*BGOQC78IS|$X?*zlWIdc2B})s5!YOn(8={! z%+(?b)+}l|sRe6MrJiT5rcHB3Ns48@22jeyDHtypPo3|}^F3&J7~9#MXliK0vBw>W z?YG?)2kx~CmM{7lOP8*|movV?fb|CAhdDptu)~f)d1)yoOn3}sWd&$%Xuu_x-Gtiu zD$JYr6S8yikQ>X>d-m$t3pu$3`2PE^fwT@}XXOfPurn}Z$hP?ClPUOh>2f3pq}t*r zDlEVjn-4+H-hJ`vo3E={&h?X)){afqUk|(QvLo($_z^6ts?mh*<&`V3{(wPfX{yH) z4?lv2rh1%s((%}I)6MYcGZV4F`s-k;LF?j|`3umIo`r+(ZCso2-CtwrH)5ZJeud!IJ)(ZgyCw~{`WXayPv?Nzzy$NDt#YFczb;lq2TG*riEF9+OKq z+8|X+bW3-JE6B>w>$4Lg%8(|$(*&X&HBF?i#XXLtY4~6x=YX`dp|&ZG77h%ITZLX; zO@4NzQn8YtImFHs&7FX@0cksP*r~S;K`4|403Xg$?FU_>QywKocNT*7oIMwrtvU-L z7X(tCCY0{J;BJ?;#HpE)qa|0koTchPLbL5;fsC&u|2nFc5*`#CTAeNafXT7}K zEZtM?RhmgLE@|35=b8AK73gm)o=ba@Jb1elaTEjnAPC(Vk9zhwbPu@FtvhC7RDryI&@#vFDrewQ{m^v=M9T%<-w9FeV`hr*%pgE_WdcUNVF}EjZicN>WawfESmn z6FFIYt#tX7v$DfLR^QlYZM+P#4wK-AgJ&fEvo1)FvV6p{a!|((NJCRJ{gpy1B|?7G z6Hw@|(0;Va27!nDZ5keZWh%x$`5MNYayX7Xa2H*JB|Zr}Gx-zTIbkxMyzX3VzWzEw zm!yF_@!ChY?%|jIqYjAqH`}4Zjdtb{d*Q@C?W)0Yb&V~!{nMf<3I4hmX{V`$=i2DLQMk7XWyQNzufdBrrduSw%DMb z36Rp$QC-)7gD)J9@8&PUZ(tw}%P|2RFw9lh)P&u|b64`>bOVXh30ZfMo)rV66>+OnJaM zP_1#?^5h%1i zNvyZSX?5uW)&Sx|GHkyZ&)e3e?IEKEq;@hx0_`0YU${&*Y$@8rfyyjjzycbF}5eoh+7i)>(8Sy2v3^2s`| z`A?+nWMoman}eda8 z%|9@!SN^<)rN!vXWgRk7cNnLB{NZbybKdE=bKD(BwANzAKR-m(%1ZR^)dyQ|Hc&(E zy7%80bLY*+dmns=qVjSSWanV`Q72;AvPD?7oJJDXY01jWM*n{ORG zWzf;o*o4yZ9un?8|J1W+ZfnC{d+&k0cH0?aue$+x#oe&eR)g{VPd{Umjn=~!gEzl@I+KC1Y8Vq~HsBoeY zNm$Lb=iN8WgHa&U^HgV$lfy-Uu`VNU?in@UgXh$MwfGUyz%jA$rOwr6;wnXKN>PpQthB-}7FQ!bXZ>eREvD zZ*1bdY%}L3w>%EBE{rPa>)06r{G))6_HTzddg(7y&l-y#qO~cOa1SIM^a8Ngx{93h z?A){S#=0NU!ug;^m4>|5#2ct5XC6FGgY?!1&sGQdmM0~tqRiWAT9J`$l)0Sr4wS@l z(XB8~!@${4i1EIw%h@UO3U*lOfX2pxI=bwjl9j~4mNYD&kUb|Cd8Cl*1KAx4Li!}V z%q*9qGd56UQ{uXv7d|A{HKC>v@ows)AAFY}`ceIv?J-(Hrlm_D#Rp!LAJcS2R`240 z(??Nx0jsl|HPL~Nc)LER)b1MWmL*4p&NPal+QFfO8c5jKit5@%J(BX00`cJ+Da7jN zFdc|j!n>8kw6NKF{*L$DCaevxf z1J#K9?0zNi*2gn(&HXRn;jw37+fCNj&$By0O3mNzpZLE5AbRi24Ecwz->(P0{9(R= zI5!}jj7A-Q5KcH~S5>T7F(w5h9`C@#cRr`NBIKott`*C{G5hR*=ii;K`6)qs`Nyy$ ze-frW_E&7&zgL7{t7;pt{YhhW?|*rHyaz4o zcz7ek0Z2H}6R2xw(ICRr0m$rUuSZX6K#ZA_Qi(TU7&eVz5-$_E;K`D;Wcw~uYgMgJ zPe*G!jt3`A!NseK&`&!|0K~p5sHn>6)3!A;$v4N(3zuWBkzEH7vJ18Rz57l4i!@Z% zH{#4|AI96$W_7U{?OjodSI3XW2K{<^n=xr;%FXxmAK38T%|V3pEe~9I#@W@xXWTzc zwBcP#2ZSzItN>kl`vgq>XhyUiSsi8YzU|@>*kjvGBFFxar>Pj8GIzidSWB?XW;&Uu z34k~_6acyTF?=@r$B2q1LH;#optPt+ohb`E#>dtBxLZf4YADo3nX=6jqNO)ugSBGq z`A6+-r*QG_;_Ypk19JBob3lgUprPAXMLbG=&8Z}rl-v4Yf?wO%gv)My96!!q99b}O zS#V~~!#9sYUS5vr&?KVvs$1&oCK6b_vKm+4vbqSJ8jw>>0}@tU2)-$_wm^Xjz%$vn zH}7>G;D5P%yk>)hubk{GoO9Zd*lh565^dUwHc;S4U>7=_=jH|=L-K6M!4hkaah9Bz zWu!E8srS%5Y>nk_hkHt0J~9sw*EgDkYkMkC5nO)ig#~k+&^t!H_jcg2(q?Xjf$m`1 zhtRn+fNX11E5wZvw8mU`>bu-%6rzN=?jm$|QV+ra!rc8TSonr&B9rB?M;LcyWTN+R zx|vrxZ9tf`I{h?DFr^7_?b;&WvIjJDtU_O6|5Tf44%@*xmLS@K{TfNc1_l;l;( zhFh7cqrr{@IINKO(hOfnq2b+C@x=T_)miUWSb(zpTvbZRMo<^dhyL2YRV&zu@6FDij!!cL4_oZ{m3^ZIyS7)Nz4MX||{7PKfY4-Y+bH@^Dkr#SNP z!!e*wFTD2hMD*^_6D4Kc@buFU;iy0DiUSTi2|v#J72p2w1G4jqP*GNn9k$;cRaJ}8 zP~U*%D_3I0iWT_fmtRrW+>FYa8Z2F2iSK{<1?#Wd7r8lPZKP?AMk!|&b*7=XxDfdT zF*GzZYpoD`v@|!XdsR{p6Lqb)umG#7YgM%`EGm{0AZbO#-O91ihU?+We}0Cl%1V?J zm*D6lhGER;OOVLS#0kd_$LBLRYJ2Wo4Xf7~6B2i^iEH z4Xtt+W0#Egiz}PdDk1`QYdD*P9SIFXjJKJAJsWr31C~EvRoIZ9k62c$=pJNgAi^c{8}_ zlt9`$^NvY^!37IZsaj0~7fu6nvxcaP>M4y^#fu9HX@_&wh4H>>d%A*n1jC^OJ%Aj~YEMuqj4+98P8nNdV#(pX?%$*89QS zWr^B`7OYrRgEYFsh`VE51acKKGZNqd$+i#&29hJl-B41Pj{&{Pu)MZKRfzmpO#jYm z7rA{si*vE6Ee)M*&FEcGg1X<^s?ER8-)LxT)dDCasA(s~rbUQR!a4d;XJ;WdD;@E8 zt1gs-x>#wUXp3L@xw&$(Fg$9W*jfYb?4g5Eo|{kVfQ=OHaXWnh;JP(~j3Z_zIVd?@FmjKKix)PJ_;d48p@#o{plz7-rJ@|K+K8 zdCHd&S8($U`r-WJ_6IFm85q8szZide=p{_~;(G<`zZ|o#C|Lt~S4fwz>#2WNTR7!h z{U0xb*RaWYeKBLgwT|%VTi>o3CU?K^F1~*5di1I&v5HD(0&^F#D{wuA3>t`6ZyObf zvW#Mr6m*9~ii=Mgkc;oclz)C7T?;3n&wBPcfv-TFh+2;+$pI_fAvrS2f%=!NzVNFZJ1ZqImG6&@D%T5M0IZAfC4IgwAsvvqI)7%=z zu#37kl6Cc8507Udf?+ip;j$q@g27wJ!6tFM>h{rcYMEyR}ifE0S1D>tD z&?!lFEW&}OYjxU~-5cZhC#g$Ok1hK9&|9}oqGT0^l~QrnD1T32uwWA#~XMOGmUAWGXT5V8E8NB37+fFN`Y_tJ(Dnwfw-E8PyiW+oxD zUL^nt1s9{yk%mN0KF?^^ps*mvIS*MGC@aWCVQv^i=0krIkQ-9yKGHp>AQsd62~4;t z06QB@DBI($N<70oBQ1`}XH8Rsj7u7unnf!nU5lLJ) zCF<+zwbmB?wixSev;ksy#pqUEit^$Dbz4})Ei5jQxV*eug>_+kzD`C)CR$rt(9+s0 zfYj8~AW+_;yc~;{E=6r!y*|ULnp$M0XKK+>s9jcCf)$mkL>W8xoU`%xqfg-1~?6)OjXNy|qo$P`(cbDzfOvA}_VG+1c61 z&dJ5%RW+D0X9<3*ZW1S7iJl9jt;6E>u>7Ym%sJ8*S{GVI3S^vQ(2_S>U9!>`Cw)`r z5flB2=Ps#Jtcu6fkznV_s5te_ZK!IXs5`EFPFf$%-jlI`4I5;qp{AiN>fnjert{W@ zby7n@gCYVZrf031zHMi`0VFF-GM8mVKFdF&XkytJa#-zAoQLdOUaJw4;h$_ zXNuxV7B&Y&(zdvJaX!k6sol;H;8gr3Q;F100@9o;X@C@0*~N8JAa+#pvZ)ox5kQfX zrNCpFitI*jH!Jl(>Tm^^#dDn%u6J{>f9NpjGrI9cxW#EduB=PcHFx6c9~U4kD_1v( z`U?gGCY+pf&Xz7Of|XYWNVYqf%=hkIgq5}QU+xfpnJ7!`ovbvqh8M4DL~d3#vJ&k= z;ED7M4R~p4rkArv>Fwq#R4<$ef}NJx&EOp zu10^9Xhm%|-&orWUKf|1df>`c+*P zzW=u`+=zWiL3Sd_N^yrLK?ZWKqyJJzZJx$?Bbarr5Sgc^n?Reop( z;jAb5^A;_`K4;&!1^`((<$l@zilrzzK|7{?`5jKY>ON2-6TS$F&pT#6Tz1M~8V07s z&;OACVbr)aC!ybc*$5rP>i&2lB(UVw4t?$fJ0NYK2z}<9nP;6vMat_W=m6uTPI|c=W~# z)!j=C`gRK00l@F$y(a**w0!CJEea`i>0s3RPvW83)>bTI+cB@2Vo!ij)z~s>~DXHo-GB##~!gahVHzT0hpj)vejdtI%N=8NUC-B>@h~2kK~yd z=FX%h;(p{tpk2q0@uWSWw&cLUjNe8RpnDvMVuV%oZCbCb!_Z-{N|{r9JmE2VttCIA zJ$YY7)JzAZ;r`g(poM6XP8PtT4NJ5teK@3bAEHMdIy9c7`MOsHS=3e&^7H(W*2bw; z2C$NJCvx98SAiV{0wz*UX#LsPVly1f6W?f4Vajua03CV+npXhI5kT~W$nIB|L1VyN zKNFeP`DaP6qD`krCIs#RsY!ZEB6}8n>sHv|_$DtZe-o5^>E7S-fnS&V%BjVpLYGLVjKW zHs5SB#9LZ0<+Cra&#v2J#*Eq6cF5)!viUYR@Swxd4jKX2IU)e(vmGSj_49>msJ6Zy z%a&K6y1v=yas+v8?1%u(9i3R#l)$%(t5Dw-=BU}3p;X7uwJ7g!U~A`*QwXK$p{rH4 zT#tGcul?EY;kGR_=LHx>!}$By8(!Qrz9p z!WkUY(pce_RD9CL$m$3HB-sN@)3kK%5x4P*LO)kG-=FVen$rYwGt*F(myO<~g~-mc z!PNvf9Jokb2V)4=G1nryN^xYMf!EyBs{Pp}U9tr!D-u}eH`Hf5v_vu1VonN$)t{AZ z%~0x3&K6Y1(}HC32n!V#?%+V%a;K>fmW-WY1sK_9N1Xzj>0v;{iXWjdYQ)lwU?06|YH_P1)qg`s>n+XBqh81pYsyX8WXZ#h# zaz)V+1=ZOqEXbJqnNzX7PaitUUCt%lBX=T;v~Zz!9za|=(mwj`mqcbxE|#yVL%cHs z4b83MxluLGi|WoQz^YngrzbG5Uw7T9Z{{x40nx2EAJvV`HgLuVqOe`qqpTR2S?Q>( zZ9uwP3zihdWb<3wY~$@II;FD(TZElLwiK;rptLZC+{|=29S{(d7UZI$xJZGTo0lBQ zHfmC|`J6KscyVqWNEAlT~zAFs(QY9=Ovba02)4bz{qQ{qN-L8W8a;!5R zpg}DZ`u_Qn+q=w$SUusVUShB9H^nt)9wkoqxi>$7B`d3K+Iw~;_TGLo{C(sw^e8J* zV0in}*|_rF7nA^V-4T5ftUPq}Y5E>sAG=UTjkz5&=KP{oFoVpHK?CsA-_8;Z>6pvz z(NuPJ1lIP&AacZ>+v2Iek5r(bpn9*fZqU#0wWvk8ee`kG%}M~z{$n~W822=8z2MI{ z;h>!(sz<~M2q${5PSgEw#xPQ_R_}m3b3HT(Ji)I)K(G$0o0QY)b$5in7I8VrD}*#TKOl^PIhDF&J!1%hKAn1uUZ zd^aU2OG8Ov9$vj|G`85Nzb8lbStd;WM17k|YM2_*1qi*X0K$N^u z*tZr_0)p{j`|X4)PCFbqIaysOH->4fvTR+K_b@)%R@NwF+wOQ-uE3C%EUS$z7H=gPzgkx_%||O}Dv>DzwS(QwKFa zhO5r|GdA03U}R|+s7Mj;aFL?!S7)bOu-2ep^{RjXNI}en_+H;msgi|cQhw^Jo&;fd zl6I_v{PqW)$JgKf98E?~1t1}b44uJ{)GNt|s`_3*^!sPP-MSq~V}T^4$xDu1KzcOr z&}Wz=HICshw!_cvNzx8d*Qe^A>#g)}Ng=pI&F*NZ)K6Livsaf3juIO4ykUJcXv0E5 zGKk7~cS*Sj09qVwCgu(#f)f^>wrTG|#W)2(d7`i9>^~RY&k_JLUWtk?-kIZU1)f2r z`7xb8)IJh;RMj^r(IJhF*Au!_Mj`bJ@Rb@UUQwMjS#a%2iFCAKVAZud4k|+dK_G(~ zh_I#{B#IhE$3UlNF!|!gG7-8_n&p6#!|qC;N0N3$0K)0dOiprT1sm=QpAF9liBsF! zBw{Vf&zGSFDOdW;9kh~V!VOJ^XJIPPxOoAbmBaVt^+BnyHBVzO`6-==G@AkUYj%c`)VrVh(i)uOhg11oCl z1(MP-)3B;BjwKCkXd=-hxZ3&LBww-CLG(fs_kqZW+8dT!5`6F(u=-8Q-~m00QBf3A zF`2pz*?PM*aG)Jg%R|~!V{6<*@Jy0vnX7^UjSNimPAV=Zj<0HHksBQMKD!PCC3Itx zbuc?YoS^OnCKjj-fH(^x3ejoE$Vx|=iUF4FQ_X0gISZLN8OW5#o%ErU`c)bkF>y4v zQHw(DF10mrbv>jx_5Z9G7iNv{<--EE1{P%PxvNz+|^uC48f8M5#=` zDg+pEWHqW%)B*Kw0e?W0D+eG}Tn@C=WXCJgsRTm`?}Vn#@=@VVGmCi7jDBTe^i1St zrJ*QB``sMfOODCl^J6|ittI0#O$SJ^V&j14t3VE&wG=b5P?(!5kfNC-{$5r939&X9 zml&uCxkgm*i~xui4I}DqvNNoX?TgdqCi3#LwV}wLqc(t>q^vLpeR`LpvA!Ac);I=j z&<`c~nbHA#GjEv^;lkfJ>TH1pQI*<7Y!%beP#k^+PTP#sJ@5@}=!qdW1|%k$nxVje zQ;>&(99C-5#6=`uk_)jqFO!#1RJ z&(nKV)->StkH5nBr{6?UL$XiHe_vI1Tkk1+Z#8Z zf2;t=JukeAEAF0%hUONdvgPGs{u|@fVd4_H^{L6Y@$onCE@yx+sa6tUv}7e0DMu>* zo|S*T_pr54ux3AVJ$jUL4v3}xNl|%{Qqi?q8N|>5D%cZrobMDc+u*FO-1p-9YiK|S zKrS6|aMZdq8#n_Zf!<`|*@RQD*3^KkobsRrmy{%ufvL8k86*CBA3pkOPDJJ58t&V@ z43loTP&%JZPr9CclK^Dxb3j;;3%Loom8ruLbx`p@inrs43vb1Yln%)1&o^ou`R5}D zIpv5wa1N23BZdGg_3Kgo{-lC866Jc7sgCRR85)vPdx#bCboz&Z|vR=eiV{&zcM0R`(g7@aZDdhCaFa0T1g za8jfox{xSDH!vDXWnysce;2%3Qk>dh^2y_V`vg7|>wU_%cev%o%IsDl+|Gcw@kB6W#iq`WXsdNh8{n!0*D2R<)Wple#%5Kp9`I6q&-x8~+% zt-~;<3$fGoyU70kmjyp#(c(oYE-AxK+ii-+gy7KL6?~WMpPzVE?|@X{X&# zSWtBCKcfHuAOJ~3K~#kLx@yI`=H@1R|Kl&xDD))QNzXuIQ#}^UpC`e6kK!_9=EpE# z;Ce{!h-0&jH^G4i9D;V<4*_1%RXU}Avxyx>Z=p(6`i=Gu)YLU%WpzE~ELwq|R@7s8 zV_dlo&)7N+DWs;zTL{JuVRC7%MU=ac9>YpBx%+jbbkY5cW&lW24n?MiTs_;{kdp;; zE67Hl(n4u*3u5eWS&NOaUm5_qS82XYr`*=etc}Zv0>gHvd4t#i{7oS=m~5 zgk0Ru)KBs~Rj5-(kbuF=uxUHpk)X4a4Oxh?MU33FMoZ;28V%Gdm)hqlNP3181n!}jtHw%# z^eCgX$_XnI>VA|J80cg%C0oGLVgRq5@s0n>SSrIzKqP3-^7$*AJ}-j~8(3*WBCXQF z`=&0aMLo|KsjD&PLanXHge93trWT7stW5iCL3Lv3%9Wy=u!Sgq&|xC+cv~Y{+S5^x z)`4|;mSE+|O0*#d9T}VfLeM}rEGGI)P>t7a8enVjaYIK3CdDd#2!w74gCsv7oofhC zx|bFSfLLW0Sh1=K`PrH1#>wafF@3|(6{de73gWtaU@fVyn_5pMI0I*)a9+-IRMH+_G(h|qE$Bt1K;*Y+z-E@7t zaMSr%0IEP$zp`Q#rhoktj@o;BP3!!1NhKb6G745#7c7d<>BT}bX6QNExw zATLhAm^+?{J~lrOyC0X1_>)&L0!73Un$+18{9N-FEyq4*uLXcieK46UcuQ3-7ww(+ z=I4bt?4ogM^#}V}c9{;`WlP+5`DxnF3>444_30Xu(EqgC*0}SMljJNGg6;o9+Is*< zRb^Ylt2*aIH$jqMLNN!-qRyBw=NZR5t06XJ0O>s3zi~W zB=)v$MEG3RA6i@6qBNe@e8!1~VAIj-Mb0asz_B#bX-?7} zq+F7eM7z_A#OCQ*5Dj}YS16?se*Q-t7GGpcX4B{Y_`~sMrk+kD77qz~-!6g=)AMH^ zILk~}7}IqYxWl37986{+ils(XYMpARUfQ9rPKe)UxeJj;ui_)P00pPO^Z|#Km>bw{ z9ZFf`$~h=yPpw1LQ+TaJ*CW|sZ;3-*1~8zaNK^(=idA|(J9D(-TGTuM zQlZ%)px)B0HhI>PaUcZL=RgSX&dShv$otfiU@l-chWA4h>Z}a(D=PstYxON{O7uz! z^3j&G`4j{i8Iw4VfH#M8C}<7($gLOQ(0%trNpZ1gSZ}@c7WO{yXc^bcoc%2pE?R;g zewu^o+Inog^)?u_!G@@;sKn?kwnkS+0&l)LP2BVLwgiR_8H%HiIvP*?^Ley)G~@G6 z-j<0C=WGocI24cE|ETPBCr+G*Prv#`i6px?g?agSY|0c=R#jozi~qunx7?0`f;`mJ zHQ>)j{TYAUV-Gae)!@-b9tJalp+g2^lP$JHEHe-FwRI>d%EiC|mC|keIAc08^O@jh zW7AO^V7*}@amYbOB9l3bCyAl(2##!oC3ruX+_$yG(b&|66%BEGyI?t1v?kHo8AEMH zr|E3C##L}zjNyGP%;r1?({q#*=AgW&K=*_L`D&V4P~Xt1y+gyBex=2tF^vWLu$2OZ=8Z7h2k=$FL%t zYn_T*c0bxWjDp4Fn{+9HYovB@&2bPT*Rw2UJ;7!nA;7@TDVr#7d{`x`i~+VSl%Oj~ z&tzf27cx6;UbmfdsZJ)7Y1>n#>ofaf%TcBMbI>isvrtHIU)XtVNi%=S!5?2tDlI~%AhDM52v9I@^$4OL;gnC+$RSPZM0G;qMnXO=z}-)}Mndp( zWIR3TAG7KDc=qP=@bkjuxc$l3@W?f%N>opjiHFOA6{~UHtxsb9(rO_atQ5qFa zJr86hl+*b3WZy}`KuiW9NHkO4wD{bW|eOeYaEo z_PYfLlih#bcsBOkX-gegt?>jdyLT!+{O)J*n6Ewk2pqKAmL|eWbl~{w9@bnEYDW5% z7kiV~3-7>jbaAftHB?lsO#|}7KW~%<#MYKS6Boz^+edB1usJ1o@|LVu%;E5sQ?jF$ z3S?c~5}{wdMgc+r`h@WZMd*M%A8&uUFjUAiAR5|Q3y=>UGVZ0Kg&}|Gebtvg`WENh z`k01chPA-1z@_64P{Ej!lZB~oeThrg7(}Q71udCq&aYm-P&P=?V5jpmTVVHBaS z(E;K6j2Kdd=Wah=medzadIBGR`%~1J<0GPt^W`TWiX-;kUc=t>E|Jrbd6|d%Zui?z zpMWZJZ(CB-E4xW{K+;9%q%S>r`-P}1w<-5V z%?Sx#L71cO}g*@1w@vvSdE+RdJ-KD ze(;*6DhBCJ$pSH5@TH#6!D#% z#zki%@zxE`3hTsx$?sb{SAf*Atnd3#rzD6V3=VzSvob4!zs!UA3cXSrmE zB8o1k6W9LH+U-U+69)=gMbomM;94e1O9Y=qT>AVECYr$%S@)}lnucKiZJ&v#eJDbF z5r?)z)RE9{8yA;PFC`ael@tcWoO8mB%409F(U+nd%|v0}#N1W;`5_W0^Vu`y)Y z87pvmke?ZoZ6`bA`i$*K)W_SE+_7s#5xVHnLSz^)}rOKm0fwH{NlF5dQ&HgRtMe`|8?OE?NmA{co&4aws<6d@EE|4M0^{0diu!sB3POk969kYDIVTHwxf#f%2$@bu z*%{`FMdJYRJ#DA4uxRh*&_olK+awKYb|H(~);6xQ4CP{61lEmY0mH(zQ#qpI2n(8I zk8~~S0r_x6y_M#IWSWh86xgj-q{1Pb#a;wQiM+yK7-(xhAM%TkKPZ{kma%;&ds#Jn zEJ6rU3HmJuJ-ydzlvCHWa8Jt+!aTa|HAOqM3l@FKm}1j8SZ6S0sl8NDd0KGeyOc83$vDXjmpj()CKa#`qsJu6|$K3S9-P zu0MkgU@JJIw_7wNR=^#4P3Q4>i`oQ78ET(frER>ukN-Uzm*4da4*A0vTye@_ z60{dEzg?UUBofand#S)dYB^;Ce+<%o}hotE$Z^D7>H z@k88r&QTaTpi));%wHDcjGLxlMNOk*O8)x45sEPs#D|szj zj~ao8uR0mS231&PoRNWFmsVr9Q+~e#!q)3+_gsoGo2`dTrxWm?ZftE+cZTBG;MHH> z634jnZdY)6@BRtK`E^Q=?Jldh4dwN=8e*CQvbGKgU9i*v3Ea!*khKkOXoL@v6kZkz zN270q0>HvV5T2SSw6nV#55Mp}Caht@OA$IJp=42xb=yVKP8qewiw{0$4kvr3;Qy)SnbLI86HXR2S8&8*$BTQ+`9iy7uA|QCJj; zp7k?BZRBoTlk;WHN=PTY;JC zW<^WF6ZYT`<&++Iv3r*%jrwNEz3m+mPqRRDG zX;a-pX%}rNo?cA$efX;tb*W@0>XLXNZyh3|aoRIix6|sE2e4cJTz(UQzKb|F)UKo&*o!Kjja?{fJ z*m^`R8fqI*QC5n3@3{**j@<{ZzW<&yqPy(6I}YA=Uo4nE7t^Qz8^eYTRi|U)4L8GE z@4ta~;|lyRbCx0nse5C09gB}X`x=!M75MDy>FAAhqrR>I{mLtG!igtiX-y4g&zO#H zKAo=n!|w1l+iZ@5k2nO&SJ&Z-4?n@T-_Ar?|8jJ;b>i?N52q4aCL9#BfA;0)=xIyh zfWr^PPCM;@#@cGU`}S)nDk;XcV|D^!c|b=qR@c^I(X!H`{o|d?+Ny@P;SKyh#P8F|(^c(5`G+sf-IuUT|JjgLiw0TdgV?c){ zV|Obl<(^@Ot362vFKTzYBs|xQnSy-epo1ZcsJOZyo$f+vG_1CyCGw%uF2xD~ zVo#QJJp>Q}1PyH{| zRfu$Zp&W8rqu~JF4Ni&Tf;v&|d@*);eAZmFu~X-s?Ph)!ix3t&jWVYFs-)fA_ySA9 zx}SV+)2~>1lRC>&r*5Fh+8(70f_ZLPL7uFZ*^%TN5Eh)g!Yp^gB2YkUWa%-oVkpec zk^r3rFK30Q1ET%TZQ|%~q+7EGV!42q+|GhhRwq_QYWQlJJ&4Ed9>o6j`K(@E#E4;4 z=;)5&=Y^|ue3X?IqN%A#XwT3=6^Qk8p^-Lc^mwLEb#D(w4lF}aNeSwk+r<6kX6Hhs z8$tnHdgN6elVFVjlHCTn8gNF3q%-_rSy?vlhJq&_5zm0hSt8x+TL!eIn?+4dG%Z*Q z&N;X8b#|&y7=Fdz%i?Fz@){g}<-Hia{xIBm`H3hg$khXgoL#i&(*2o%o2R^l$6xvA zcb%}tj9w4V-eLvFPYaggjwfHo+h5JpYqEg2;mjj(+F^U>FlHNa%8MW3Z&O~0kaTuS zj^BS*oPW$X3>jDXd_pPW`fEC3ZXc_d6h!WySb( z$~Br-5e_fSIu>G<;wJO&7FX9{my`dB-L~2Y&;0Go$koSaSC)tbDn>xdxC_jNcTEab zv21urp9>-@t__<)%8EM(&q89BLec|W#flw6ANji`Br|%J3Xp$&piWTu;-;_y#9Xk1 zXavoJi&DdsXs(lmvf=%00kZPl`}=4{LZYQXL(VOy?&X*(?!#BJ=Jm<&NNIcFjtlYS z%(=f)fN&0obtPPS=HaKWzJ^r4H46~xhn}5u0X7-Aj?>rdo~^8F#N~JY6YqaDE9546 zO|HXh&NvcB?6tiDNoWVl+#wu{RSXVp>cXXy9_yn4VWAZY5EE{@o*=Cp zuns`rwc6T=&~vwl4G2%Tfhq6$RB&do{L;ImVD%NDUw-D1*njMH-gvR{)a+?lwDjP) z*FMFR=ilkm1>vlY>n}VGn{UFQgKjD0$y`AB4FNW)1CxMsYSOCJjktQvN$CIWPF#2K z$tWnyOY4}WWr;cseR4<8N$5~0%$Oz_x)-_@T0fRWTLSAvCOESbn;aA?`^bP?)3lAkPj8UEhsJNE>zIk);0OygJqMsAEg9E50=LyR zj=KwwRe(tvY;y*JFf(nZ+5~rVoJsGl2Vg+Ruc&j@rLcxfDCnIk=7qi`SGK6-L?*z6 z@z%Kd(nH3~?MA&VLAxR8G0I!ubW29&U=ywQIc>U)b1U?khRTYY@6)-Zw{v$!xtfuq zPei=eZ1|=3bj#8FSO)gmYycL`{RzFjNlbg`U-)*;A|$&qaK>q;V9#Cmz&Brijn6-S z4+ARm(9v3tj`kj$chPN_`O~+!^|tHL(U!28J{g%9G-L$I2CRd+)ywef&%ffApXMX4 zpindRuD<$83>dsFo_^|ay!Y0}N`TtqaqO_eRyg_86R_E4Tj7{vj>m%eD-g@<#a3gs zM8$wgj2t-<`MG&``spXp)YO7xyc7EzZ~#V+-U#KT#dz(NSFyUb4jXQ^F}B%k3lOf$ z$%$d{vSs+@+nG3E+`+i=!b_1u^1X)y>%QBpnof4_dV7)Nl<~$meywT5=W~~#HcpL# z+3P0Qh34E0wn{j+L5W}%s;J*6Ez)Fbb}o1}h50m=^ckx}I$Hf+wo!*T+s(H!;{t7k zHDJ&86W2V)8PJ)F`^gT_7&u}>Vs3UqI+JLj!&PSw+S|KC5#t)7aY03KK8g!D!=u|~ zg>WWZXAe5$R%OFF2~@Xq8fYLGkaqb&f+lZ+lo<(Tj}$&V>$yopmV-bboj2P&f-9xCR;(%ITwC99b;( zE^&yVQ2}MzG=;}B%kt1UwL&CxKrGtYeztD0{Z5KG5XvK(OfWCvFB|1GCYn`#E-80e zC}E-D8a&2f`zKQ)FSvJE+;hbepeGnX>u%15Vb0ECMnwp7Ij6@v>|rNDU<7zEq9csp zk>VFMEk4^MEk_F=P3+xSzxKApJF))o!CFKMm#;!zUcSUAD{C8t22l?p8^T0~^a*s7 z;Ki)lzZCtds<6CzHQMQ(B~u++2(;fNuUm^k0-H?n7L{OfbEw; zfBb3RofRzj@Zb1shGv1JPsL6@i^q&61?ybQ_+^pA%KSN^V$^$_dgvZF<8^O>k=Y*BH-hke}{N8s4~c19sxyIK;s=&q;n&X=>K-C$d+vb-1{ zJaC1U%S7EO+Z~To7@5=Y? zH-tn9tz{!YBpTKU1I^bz&cmsHeN?o$@WpF5YVRFnq5QW;URp~BWW0o%p`MFqE1@#- z7Am_ehh20>9}zl>n>YVH0sYE~y+E>H$@{f*RV_}t;bA?~RBYpL!d%>T(XrTT$1PG+ zHx+`R;IpJCh>=yChCzHW$dmrEwNbDpU5Ltxl5jqG>0x_NfjLTKZM{U%)rDx@bB&Uv z^nDbbIe(7@$cyiMh5MggTLH3dl=xav?OKi=4v=iYm6IOBoL`sqxgVo99F8l`{*&m1 z>0gSK4344=*!>9?Ed(9CSXteGtJmy+q!l2czzX`d)Q1jTgV0R~NVrXU|M-jV@y{3N zu9iALiVE{_*?GreaQ}XWocpFTn^!xG)g=r)_lR5UoeJNtf!Z2D=`wazyz_1-_9du>}L4q&)5;cxNUEwz1D|1 zXh@#{lZMnYc~=Ks1qeZkfODE4JzRVEx30sJ61|BhHr71!_~dKXXo+@BhDMUYYrJ!c zebs?+fJ;-)c`Xr*!_iDzR*qoWbq6hwsK**&Xw3&vZ6gx?<<6 zIv{Bs)ih_pKyi&wQ>VVk$KQpd!3cv13yUkhqP?%(1KwlaBBJ0NGMtsgF24zb4coOd zRzDxKDH;$QL!tBqIgu8Vt30>85!($bMt3rSC#Fut{3T1IE4}c%^RRs3e2g8t7w&)P zK~z=bVdauvkchWpn{9T&@h*EJB=NSy4qD3*uNiUe?JR9%$$vF z#_oi1fA}K`b70itDh`m>q>~+X}P)C5B3)9_H>H$qppqNi42j zjfG8}n7w2*5}cF4SVSNxJImN5S)Azt%~Pu?%EvmT1t=@b(P#lex9ngusi%HW^DdO^ zngb_`15xFic|zS3pQQ~Fw7DEygA|6xXOeZXv=8Wh6>nz&!Y&7MKRat9x@(%XH`kStZ0}T>eX^bH zLCF+L_m{Ao^YyYam0OdZ#n~^EI}o5Cy)uhnR!_HePN)INw|RV=ip~Mr z{9Wd(#!w0!DWipvnr0Bi8qQ!6^c($m&2DXAy~MtpSKUiW6ax(%oaAC4N=7Goy6xi8 zmBhdS70AiU!>@~0$Pt8ZSuAl&mfCPuFgQg*Uc;FRx*W1YS_A_*AFQV0GU4H*aP+FH zL2F%AT10Eem!`+NtL_b@F%?eekf>(%1Byrv4>z`pc^^XcXO1wo`7XTWG5qJ(rF{|+ zLk_wnzCZkrJK*Y5k5He94`=qgW%$!&ccIzcs@C{LPy;gcrgJgF8SJuZ>A|y>hBqC}@Kum3G z=@54oj+w`}GX+sUcEd6=kZ4cJ68DO=6d;$6KiJV!r;9~81)2~TWq`@W?-d}+-koe+ zw6r9e>qrPlXes)P3hISU|LdcD+|k(WT6b_2<}F^SWHx*qICdNS{c;;bXlvJ#o3y0J zK?4at*DOGW530mllP92}wAlIkUMav1hPtL^oN)C6_;KFSC;&3yV#nhCiKk$PEjF@R zG7W|0=TUJdF0Kh3Ljl4d%K~I=8jz=MyATy+w80KR*ASl&gqg?$*N#3Nv_K8a&Xe&Ad z?QmdmKuy-ww>*NTv>}&#W*dwgiVMy-Qu;H)$OTG_jS@ zal!*Lt6AMU{eEo8aF~9{Wa~=vs*;> z9H*5ESxr&SjG^b0AJIn98N=U^p)S22;G2NFDNZ(w1U-sPfyt@ z*^p+X9WyDiLMRUG=fgS+#I-<240Bk5Eqy>rT^~t*e~QUziL6ddpi#Ngkr(CZMI0TS zn7n3azK9P;Bi)L>>ocv$d)I#C{0|N=liq~lW?R4H_-D2^VfRr3@br^Y@XO-GC@rhP z*{7e4=bwKXZS|{g(kW+P*@|lX`jS!2Xqpblet84J?M_(W} zzZjcrI0`R6|2*D%XDXI1S%fLm-a^%&q3G@E#HjT)z)jcRgiEhD3qLPffgX+(XzM^$ zcN-4cXCIt@{uQ|Hrt9(H*WaSKZZ*~&v5rL1J8nA$l^AjiE$B&hA<+}VueB{$+z^-crlPn2>u{odR+hkCc5iquNrNfO&Jc=C zOIYeUl$)`$(wS7jNU)9ccItfydTGuM=f$vdr$K$)Xit!}5;ONGFG^TEv2Y;sg^pG> z$HOLLvmoIIJY-|E)vc zrmV~D%j1mcj9e4q;VM!VrfKXP9gUnO1vrGg8g+5QCbaFP*A9Cy03RVLhUTy5k)|t2 z%@7HDHU-qUfZhUV)b$AT(MX^Y;-h{nrtX_DQv!i2oIVcVP$QGZZM8j{>R1PR^zb8^ zqoNTZlpuJK;1o=M_#YdBM=9}AG&94hVUe$pfB zS>Di9^(|^kay76};pLZ>6e&ms?E&>3JxLBMv<)Weg?yHcYpl?%$)myfC>)ly`9cCl z>VwfXJlTjkE-{>O!-FbdCSQ4q1g5<4HTBKd^OWmUly;_hNdv=xczs<1;^}%0sTsK0FhJq{?|X^p%*^H^x40Prp3Uqhw(JSsKpK=;pGbvbWnFBKG*_*)v#EKjjZ+V6tIGc7DJK`DaF`Xi$ z)}CuQ6sovZG#!*C2Aw8CU!wq_2>tT$2lZ)Vnz-7&gxEUWh%Q)rpZ(i8AdBC+&$*Yj zxdV!vO4CwpRCc7Uo;(fH-uXHzw5+bM&y-H7IAFJ}ao>a!#UBqgyy4)t;bFo32GUF& zdf{(7Aa75;9Q{g5f^(s{e0V_Q!SKtXl{o9hDOj+4b);2d7m;+mJ1;o_yN}s4N*XnY z$?uCHxK79Mp-a3^ypD_4aKU0h^TebJBtj4O#8VjSE{RC#0&b^$gehu9%L<2%BO{&w zi`yTFX%gi3MjDVcJ0PI|F-+Oox*^n}NwsysB6diaTEaIpYt)*d4cs z3Jd`gelO%o=4(;Km{WgNuB!V@0Wx?{6|TL61xTKm3F!9>84nI*QGu0)!V#QUUR{fa zo_rb0R@C%aCxr$1IPcUWu-=HlCh7|*sE|H43vdK3I9dftogIxBj%?p;$0R;`l0HWkES)l%dt~WkdOgav8@zMLT6POmqG*d?RR1eiU z#L|BlB}RO3K1-hQ6t(m0&ZFBFHKAR)_cWg&B0r$42=l&v17Cji88UP7CEEV{+8Zxp#qz~ysI8Ur;8j=Ohynd8uzLAiIZ{6Q%qw!=Tz}o6xaImu zDnLH_>_aST=s;mfIXJF+ovMMj{L-s%{f$?mF-}@Ir($=atFs*&jaU!YTzMUyocb7E zdi#B}G&iBUyF-QS?mO**V-7z8=bU>HdTDl(mx0EHR-7_^Jl3hG#Dy1KjM4!EF=+TO zIg5=PJOJN)_Z_MRtb@@TZ-nyVJj|Xw8z+uG3ww^;!)bKX8!@r(MLeFss+xMNZfL}! z)r~03%|%{*9+uWMqqWEMnMGMZWuAeyo!r$~Su*)C$UhuibJG;=@X>>v^UQ(RnoxK8;dH#{s%6}+iH=4RZ z7Qy11YmkmgOzAipfk`ZjRXJd>J4rgd8)UG%ESu^mW~aK6b_RGiPYj*luxOFqR(&`n ztP8BTB1%TkkXpylI*q1l63`--LoedPVW48)3iprz+no0lY81}!V4!PTEKtY&PyTwO zV<`@VUw5=YQ8}%62qB#}g}9u(zdA(sV9ZnnP1=gbBH z^K%U?b-j`D@o+YKe(eoayLWy*hI<+Ehwyi?ujVf9CC9IS|0>abdNOP%-VzoW)Lmp{ zqpPz+f+$WgWy`LsCsRRz6NY&^Xemio20A?O05HdlY>Csuc|KB%9DIaSv+ zs|%uuj^v|q#}-FF>Z= zdM?InJObm+y$wIkUn&aL?%QmFbB^8zJ8Zsz+LB+){27Z@)MDGwBeB`~L-l!{d*>@W z{KALoRPgJVaXaJQOHaU^Prr#9AAL!4Kv;l~4zT;FYuA7<(R%Ifi?Pe*8%5jci8nsO z#QUe=@#{{-UfXY$miUBa?3`skbOX;?&3$PJwX3#jN-N9f22e_tyFYha~`&_iOT z!_Cj`z!48!57T^DOE;j;5kl*QL-5*WOZwp#*It0o1uM1xJz?`n$014OLZ=JXe&R|ixoCJ@~Ug0un7d#Jo|yI)>gt=KiLCdK*KuK+#}q9I~PAsa}TB^MbFvqxj)xwAWI0uMs7{lLA{$DZaCvj6N{ZOB}nb zH8{-<7=#&s;x0!8h`p)}AM~Mk8p>v`q4LvXv8JO(Cl(7ID>^*S(C_fz=F{dq;Xl-4 zB#78`kwfpCZfjw9m(8xllKnKkGz&EiY_u8c_E(|8@SoLt=~QtYgMWHI@MYs1I8)YU z^zM)S4nL2mTRz@6bh5gVJU2Z#3EXpEbHN#lfLu(T*%p4o+vxeI<)7k*o4Uxpc&|ij z2`FsDq37!uKu4WMezws+%nCde*Q|i!y|L$_vPDI3w}8oBO`W$tGbzr_$uc)B7JKZx z=4N4?@-noxHj7?8psG?oH=w)(waez=rD>1g$DilowwrH9WqAdjfBqSCH7r1FO*OXO z`9Rt2SFc!%SZ^0T{PSlxnK{(1+t-g+Z^{{FvER$h#s7OloN-~WsOm6f>l#=G&w z=kMafPd`OXV*~nCR-vr41hMWI&O7TOJo?yVEML9a<~gtf(Hh6FK|^rCIp^cecV5G^ z*Isv;QwCb&aSW{NhttNNj46*jh1WiKTQf=;8d`D0fd^psop;0|k3Wfp)wO7AYr}@? zjl_EE4#u?SreX7~w#LRAtuHf@=DHdzSy_jNCO?keOxJvn#?;m>(;Zsa(!x33*@K$K zCbT3H=#AMRxS~vGZdiA+(+cQZ4u`Y2Ce4!<-%XuB3n^1w6oYpQ?4?+pAZLEI&2Zpj zWyq(47RAMM*lcXGA%n4uEVOs^pxK8_bAonfcb7UO97d_3hU$D!^JH^j_}r<}PNHEMv zL6(6A8Nf+6De7p;;p8qU5+<#Ama(ccH~l zKaawlNT;TSXB`zEQ5ft+?1R~hdRgUg!7Qt;M^0{mZkYL<)7mW`NjV#s$Z^=vfym0} z#=J$jbz0m!M2V^w=H(&LPGNZxMfrs)^#)d!YsxvNlQt#zbGbq%*qtE# zsvtiX$t0(r_lUch#daY%X;k9-rlMGmXan1d+#s?%6RPGdVxJHyqNAgO3a1k0nk{7d z7wJK-eDH5fdh8Y4e#r^gY0C|@1~_=_qDhbAm5-;Zy}0Jrwxid>(>I=j?|%9fC zi{RPY&c_a$tdG6Vyb-g1U4~t^8YQ7RQE;|14>B&?gU1 zR3e)~F2fSBNyPjzfta^PRgv4zq$l_Mxu&(*@Rk-~`ZG630}^2gQIg?)K z5BzAmg@(TH#;M}(g@W~WKQF@36Ydp#E{J{CTpzUIy>G$^Djq`;X-Ijh&8+a~HoR+g zKvaM{aD}u(_B^?MQ;tzl2cWkH^A@kdQJ38#N12dpG5AnB^y=N0puDU^#W|CUK!^?SP*R;Db3P&Z z!k1#V^hM4ASwjPI<(YKB+RlT$2_+3>%FuymohuTXdr{xiiZdqO2WpkVz2KhTY}C5A z?t)`QcjSXK_gJ6u?MZ4FM99xpUE6>wZ|qCK8a%KHS6?z-@lfm3bqB#XLEobWj~B6Y#i~A*yZkvKQtOW#g0oLKOf-`)^eS3MLJnP~=QAoyfSBntEGx#iB6Ju# z`WA$J(fUv#8P=SaHwI^>xXZrZ)va=IbqX-B11&0m-K{0P(_?YPUOW7rrSuf)+I$*< zMv;%drT(5AS^}$elXjhQXbRSsKG%mDLcR;Tf82)&p|(uwZ75j)I@1q6Lp#$tL+qpo z9X0U7y5c?^SwNO2EAH4ATyYc&(+ZHN=m?^2O(S=NF)Ld_Y=$olWFsQ%g|qgctUS#v zN;H=)ihHd?uiyE{f&!G5_eW=E3==N97BgplgKuZdKyxCYfrz|E zg?U9dg#^YQr8&tmwfQOM5h z#x|qZ$IwB8@bfS8aL1$vkX@87O(46`G|R9^)g2Dkfw4GuOLK0q@fJRGgb<-470%lb*wc&NOl8>JhEJInHVK zX1F1zEt&$kzNz)Uvx%D9nd8}-lrWu|kghJVLzsMWtO2i|!!B(vSU#v(KN)-<|2+W$ zcGd)ox}aYR085A|;oqrFtcMbHwk@?7(+dFM@Q65h)ihvajqqOhe#} z8M|PAPrDz1hH6EMXpK(8QcQ^UI_=D@3m-Z+1PA%o0T2>6Ms_hcnt_D{J7?4j z@%(4O$@Mr$^J21*N1bw3Ox+Ly>ZCFgRAPsXfCh6SQN^SO3+06k`(=(H)^O^0h%$2T zD_Q5{%ehN?IWQ>Mn}Md5xE^9#JR#rec)S}$`J};EWn7S#g~5Z$QBz-!nx;+^<F7&0RokbDLR-`T;1*L0_<8(K0A23F6Indqi$t zZd@*4iok2@8u8~#@5b)iZGs!l`I8TE%ESlX{D^aIdQ{@^HNRMZJoUG;@%_&WaKbfa z<@)?>7ht=MM`G`@ZpQ3imtxQDM&pIsE-+DAMh2EuH)_K9ldpZInG3uy>IXh~^lCl8 zeb2g8g7LrXw=@2J`3bn=DRw|!RucQ+gI5Xx`@`usp>8dM2=~}_6TEcCMWS(W1GU84 zvD1myV#|$&=wEuJND~Veot8r4Q7d;sKM^ z+lZEl%>fy&LNmgtg-9DRs}Jnm3>M*suB`*|z~w3&Et&LP?AK)-E<;gjh<;f$Le z)t*Zw_`tx*GCX+osS?U_4f1ttD4RJ$g`eet(UDBzl3UmTnHweVbd!4UhBHx7LM@63 z-@?4VTcfsVvTBwNsVF&(64r2h*s~-0_ToEVWAf9l_1SJ$o_Q4Z;}FkC z)8f{&ESiOMS(54A7nuIzJls6_S+vC4qNJ3`#?c3j#nA`tu1=~@B1hs3B@ZHGyC!ip+4&?3_%kdJ|jv`b_J}h^FHm5ORst>F_lXv@SeWO^EL3eR$c3jbVqf>H3U5 zWR5pIqK&Y~a$Exk@dGGrw&n>>Bju^HI2Nne0*HmPjTwsExo{`gtAVp>>VSUd+r_ z_>bKr8BQ!N~X1{bNE(QM!`WE_2Yz$V3L&3|&c0`sU{e zlsO{oMY$YYmLq;RlN1gM7F$6=*dDA}vJ^MpeH}I!xiL1~WPLQ(uE4H4?SdCyeg*NS zRj6LROd{-i?s*7PAHN^TrbXCh>rJt=wiClP*%j-LTo2E`I1TZ5Gy0X4sjwrcKK{h> zFlX*;%$Yj}ZShv*=M^BopirRDVFw?EFTeZ%wG9-Bw;A}@okUql84fz&Ff3Rw2QR+) zmgpuKnYqZ$%|)^;j#G|55px$U#{ExBQL&b2OKP^+F-IPXPe1zNV}j2w zQCle5*Ys{0A6TNt=fN%n3kObe*K%V4&>Is{O)Kcu_AWG&Ue?`%qMTgm4Ot{`zwr5S zRDoDl-7My9zi^G|wH>+Fdg$pvOR`(WLJ|yn*M;wI^EhlsG&{BeswglQJuySzv6AvE z>l(`DTHR>dk0G|nNi8yMi(pO9J;I-j9%W~?(;@{_I_=hXMmP)IOHbboF-`v+Iv44^ z&2WB(NENZ9QUt63z-ot!h2uNjnHr%392GKNYoutit_5>?QWPUO!$(v|pI@SDF{iv> zC83-}?8a35^3)|d3(cP|)ftuLc`)&?EH|1=uHwUsj>u}6ogvqQNZXNI1!n+k!WNWE3t6JYK+@u3*=_!V8)yUxNqvac=4m@x~@4d z-J$RAbN0>nW$_9e!vbW&_&yY@_aD4U!Q~I9{p~je2m`?xNBjYIUUXd4<@nEnW!UeW zTcsx%f8eh8>mx5?^0fE#F~%Rb8*VxGC=GW@HSw(-87gumi!Le>is(rP2Pqx3#w2vU zrmFF%{qdXIwU%$#Qsvb4>rX!%d3iYsZbAngx(LCGIvP^2))b*r*v}49;8W}Ro%SGP zFfA~V_O|aixBSKhYhfrrf{k99NH=ANYH0@x2RUo?_R9IUOqomo03ZNKL_t*Kr0X8U zC*S@Y(S6cCq$pSu#;YhdbS2PS!Vo2oj)3^j|K|e4QRuWcP?_fZQ_UUd>BY+*O~++- z{j*QO%=aEKq(3H4JQeE=8|V%rJ~`GqUY7sTGO-I6-TIgY5eAX01;O;L&Hv=th7`&Y zw~a>*#qASLvcx?tFh$jjCv!xKU*a5)r(f^$ChUOhzx%d^frX+{G&W0oRY3Tm!u2|!x580}?5RRXR41p4ag*tqWWaCTF|KKKIU-#7fNj+cE6`hLV#cxOs zga}784NLHYDS{A4pUGh{&hA6R4;Ky5?QYdwh-p|ZU5GNXy_>|sQK+)9**m&BjAg+o z)S8jii%WCPVF6w(^2l?E{+zz{ikS?D;s3SL^pxZ zQcjr%1kGkph8YTM9gad#o}mtix^n6|X6hUsR#B{}-0{v1AKX|H4Vmc6Rg7K$J zK>z-gc;$^((B9dB0Rso>*<{7Cu-|@%WAW03_;L1k081K08~cGum}(%gb~-+u$uP0eP;Lajws4))*o02K&#Km35!1QUB&_#Uv= zAJI_Xh?^$eg@)?YIO)7IvCr6DamJY!qIA$u3>i8QgQ`l=mS{s>R~)CEelfP*etXT# zYHEs0FkVkRN{7*=dVA@2Wgc;bIaw&p%TW>lh(LG0M{QDJUM}(rXk23RYAE35$OAc8 z(o(pq7tI{@*WIlSU}JliER%^;6VcAjVfT##JA2W|ZmeV;wEs1&hlWK4QMepKX>;GD zP7CSmS(yd~(tJR4cY;UijCLWDG*Qy+;|bBpf^LZg4GS0Qp16O4L4?iw2s642955Q6 zb1Qs+W;#_U;2L51r}m<)WeX7wHAD%n1C6fBGHpr9R(kCxR^VHtAO-$hU<(DDX|A*qQ=)92@aM%mQu-%rjF6N(q?s zhi;AymNfuSQH$UY<7Y38H7Iv5Ku6|H0%N#_*yW0$UvYtk7gkV+o|}cd%wCDn3Dz@5 zC(VzR&N&2x_#Pgwje->nckI(Ej(F^{oW;H$*f{z$@BO&2w|~E438qM0=c%#CPt(>na_EpS z&S*QL5(M#7aB%1ao_hTgOq%j?BuHPUssbjs-GMsrh^(D@ z!$bJw+n;{3hN%G|z3RK47vL`w|E^^-?Y8rh<`+NUted7_KxG*o zzwR`Q9ywGCh||(fyzU{qcK0RPyiAbiELwX3^5H`hb)fHY+HW-=ESMg@{tO&AcI)U| zdi=FdarOPrIOU%p&xza z-|@jWv)8__|1ZBwg#Yz>F2Uv-4v#1;+R!0M;(AMVsQ|h1@6ScA&Z29=i3efA_yhHs ziQtEc!=Z3;qX}gQDga5rs!wS^IKXe=>-QMK={g2&h|rEzW}l+`FgS=ahAyOt=Ivfu4Kl~3nPsHDOhhmaJg)FJ?2{A zO>>k;@nvmSvnYD?;~BX8o@a%=g)h1fU3C0`IQfV_IPJta^BMrjZu>2H3V&+7KePsSD-kFf5KCqMRY6T2KvB8KTt`A5RPqyTJUWdC+Sz%}isU}SO+A)eus@fO8;#g=u+%@bVz1cOqLLx8W6cJIgeTN zStczu^CGA@jrwSZnJtZATWiU-_8_T?bnGFj?6k3{81wzhi_+Q>XFL>f*6Fo%XFDjZ zmt%iOGl<~l)0!2q%nm}P4srLQ)NSEsmBxZLw4@)a17HGBTTd~anYc)JX_@PA7eokEKEaULeVot z<0KV+OH3RDoT?c~) z48(r>ABk8-H{So~BUDsWppYGowz$s9-FDjtHT5g;pV{A|Ft0!bM6x@H#-D#o6>?}>i>s&M_JTf{nG zL0DT`hh4YlfY)q1{p>XSICD0}{&7znb4I&6=$Uz3`o7zy@oIq=WlrDn^v;vj*vyd{2Y6;MLNyAU=gV2ez zb1cPFFiN6-MR}XWpLBXu=%N_jnR3n({NZuWiX4xLQP;)ZE5Ib$*B;Z9<9NI>dteji zTNlRmNyI?#|0Wn>ppZq65Hh3KqHV$sy~j2$8YGnW;$B;+Pb9bRSoktJd@441$KI3o z&`nYN@!3zhAF_b98yIO$92^c^5i=>U4wlXJFl&CUJ??c1(EFDZp{yVm#ngOI>yzmM z^h|TbrSln!(_mR{_s?_jw4=fb5bu5kcq-CnTY(gN|Hp;BBZu}!EHej7R@7>y2kmxS zT9byt^(0YMS&E#jn5^VDBZO9zOIJ0ZJ<*B0TvC~G(b3+njZ=`DflL`|YY$7O7hIJo6?VeE!|v3?$rk6B|VM?avEv{8f{+2&dh8F1BF-a_%IF zl=mFN4#)*~=gXO*Y4OrnER5Y|V@x{#&$8a74|i#CA)49}*!QfP)h&?*WWspUfCLKG zLlc#>>~ZSf)R{^D8nx~^_~5~bdOZjDu-DnQfJxLRk6fdc$IQ4H>T5axaOo%qyU>M%K z@A9ZX2&iZXc!oUMYw`bSHyzM+qcQc0u5|hh52LXq9^DBR9k1Ly0UM7TzGY(@o9%!0m7RT#cOx+@(fg2#EUC1w)IHaq zTvuZMZHaDr;S$jg*_HW?_&n{9OyTU&`-H?>CK7I?%@}M+x_Qa#OYu3(cuG+etnhG` zsi0eOYFPNJ8V2aP591i8G%bDZiOvJ#j0fFPlq9HgmO3r%4q0&&fQWEtho6$p!;pli z3&hW8Q-$fNpM`>Ko8e&Kqq_h(?Tgp}9@k4>N2qU1ON-U_}*?WPAR> zM8%T6l%VxDPuUyN>W(;Vi??0#P5Rc7T0cP>$@ot|k#rjh&p9igydW2eByCx{k(ZmR z#Jr)kO;W74@8{&8qpcZ#z4lyewe=1dIb<*ri57e}{Y#8ocQ|(5 zc^5o9`EHaJ)xoVTZwtU&QlEJ=Wc6DATKu$!-fvW(BbRjqYvLg zZBw&A8+LwKSnj;z&e&+fQMlv2JJB4EYifH#Qwv58AC7(%6?pZHH?g{wE_N9>?Zo5o z>Pv6nz0bbFkw+h?>zw}GcUW(51x`HSY;3y4mZAp+{V1PLXR-&it*w~1tk#N(M2Apo zcAr>;*sKPwp9~b`)7~~$;4O=grnYueHzrWsl2EsT20s)U%K@;f%d`=_F=Qzh%R*6p zo}PjK1>&SCwp-C?-J)L2*kUqDO-WahYrudwc4?THa?*N99tYH!vm6;RJuIX;dr;Tf ziB;$pmb70yt_Qj(3l%vEIxSXU z5DO80PopeiD9O!4|I#99yGuw9%%*7F|6Z{#rhMOAv9hh}<<5U8Hj>k?`ov_tjEUj)pj8hS_GqGZ2lLBEyNv=4GD_NN2+Z%YU*S!X~cnj7oTucQ#`RF>e!1uM|mOQ(r;uz@$Is$6YO(zU9JIS3^i$S%N& z8V-2tMR`e~IA--t<`6*}z_#{;*~(?bP+pj;Rv?AkChW1pK!cII$0P2!+b!DJYa5H- zBe(ms8y?hTY$3B3ACEo9Y>LL_IF6loA4-by@xtvFs~f{ZaQ6HqIQGhWHB%$~i;fi( zKvQ6T&Ml8?K~B5nJZ!V^x~T$WyV3a9Z5QfV?|b%bJo)-(sBdo7Vq&rIr@eR7z(Tr$ zHMAzM_nD+%t;8|=?j!;8T~EJ-8>hUid-UwB=i%)yX5rD7KI}6bk*~#R>3==zNV}K4 zz4~n19)C5?|MR};5VW;-;<9_D;;A=26Yc8gy>`&g(-6S!k1gLoe{x*G7rnXB=;q2^ zw-@Hk^V)5QrKjP*oFQdAy5#=RCqO5JV+4_!n ztby^S=_70jna8Y99(R%Aib^Cp@$yIi#@)}nsjdT2fwPX@2gi)tMFLK*U9^9=UU`k& z@ByU>7{^ZwmgCBMpTqp6)hH_}#Kcn%!M;0hk%p89?q`ak7P={cLL{`5!o|)c9(?`- zJn`yhN+x#MdShIE@}cM-h6(xsq5Hy5uVH*_x%bLV>mM(CfG@xQk6Yty`1{kZ%pV_St z%>l|@&klbO?s(S*J~OtLRf0 zt;mpPPq2l~yAD0Q`0%TV1e=bYSxAhqM!(-t1?xpeAQh$CP1<`Jt2q38ii&5+dde0u z+9TmQ{QNW;fF+MieATuWHOn8TWtIjI33YU2F*tgO4q|kVAP~3DpZ=MQ=8?(~f)kdJ z1FWME=5?f69@b&|T)8%j#j zPbPe?YD$+2*{QO+Z`FWNAqafaIY;4AuF}ow#)q$l;7n#FUM+aJ3o7F`f zJa}ESG&ibP=<4oNTxMKcRb7q2>kLL^zy4@ysz+06TqZaDDk_nPCop2zaBREvR`}%e zPw>Ofzv!7V+V-!i!mzh#(N)NlhK=COrDA6AewRa@eekw`)cSf404|6I9bO=`YEny)9{D zIT}#7x+#H$HBDF@r`Vp|2AVstd&t6t9gj>~Lm53jcrIJQaSe2Kn32z#Ym~GbO;cw= znU$eph%8W1A?dKk0wgmgJyTIGX*wRGMfI_{CN1sVsB2B4rYV8i=D6AKQtuRI7de32 zP4g6;!wh1kL9~$XMj~n5fG|7A5?QD3grD`pCp0&;{{qqx0I0NXhu$ImzzP9pjjn>h zE2*!Df+eufz8@&5){U{ar`LC#h;@VQ@UZzWX{H}usMzmF3F93OJNZKgB-px#D^b2- z5zT+l1Ew@-=`lGBakT=(el693w!LmAin^1U6Jq(YNfyjRfWmS8k*YB z-evyNe2IpZ4m35jV)O>6VC26pU)_M*{Cs`5c$|D#yYJcAx#;LfXhYBrjEprV zHJlgHO<^1pI$G~im?-~h{-Qanh(GNIPi7|DML;)Er+6E#x^F5z`+g4IntTO@45*Z7 zivsa~y!0Vnx#u#hH*|pcZYMfKpZf6Mzoi^8&~g*dj+ocP0%Y4wMquA_QWUHgZokkL zYb=JEh9+D&c^W>N{vR~8m_U|uLB4zDulgMOoOP=TkUystAU92US-($*5e8AxWYWKg zZvXS9v#{SzTbP^4f5rZfy!Oasx`t)Z3XfRKg`1a#HW#h@>>n_&NA+73txaDnnwrLrcZDzBg@Yb@q+)yY;B#lW{MQM@Nt2Um`IAG$Uz$$(>X%MNFa|oo3 zt!?Ut@Q{#EfVy{S;yrEJ)YDHdKZd2{1kx0+>&nl`3P}Jw**#}l}ZXzD0ocI%8-&E0Z9c{3$%9d1zSPx#dy3; z>yFpXXBF%P6}0?wgyfNb4pXUvt9v-Wh%UAz+VzZr(;f>zgPOeXa529=fp^{{-ej`n zE;gy*hdw(&$Xd{#Sn;MMq9io~d3hXP7HB?Jyc;%_nsF2kH%s;HOKwEru=VenC2Fvk zPHnf~f6w=f+|T@YwBs&yct#7SPu?CZYVGv{g(CHgLpn=aM^}IQbw&;>K}QpGU?HFP zwP8uRA?#szolViU{bZi_%DZj-rga}=`AHtT9HLSd+jg(KXbQz#TC$Pe5aPX2rzvu@ z31@n6-Lga?tZ}VI-?Qc&Vw5p1Qzqv6cd!$VK7)03Sa^^t&7@9$rA6p_#z8X9;$U}y z&TpjTG_N@!$$BvbGue**#rdKsk($Ly zk+U-9%=#7&JaQjSIPyTWw9Oam!7UFk{BI zqD}R$>W|9ua*SMmV|})zi+|N;&dSO~{{e$gQ(FsUk0TC03X>mr2nUbb6Q`bd z7P1QpL1Ujlzco6dJ-d$14z#x?(b(37C94~;s-XoPJwR%jk_pEo6^jW%{&FMu;TFgj+bq*AU zqAKk*6$#UG1Up3>bg+ShcBlo54%ec}BHc_qcpfsgv8d=@R*Z_Gd{h+X$&Q!#Hs`@G z_hjDA7{`BDoKzO&8^zoQMjH5KYI=KHJ7Y~Ek?OKXRM~JJ-}_- zWrcYdP*IFzvR!UhIT@MaC&oLwH33v&x3(lYljdbyQdopUdmFN{U=B}RNmXK`PEnXe z6hp}kD|01YNgZZ-c)mbFQlTI~&SFZX#?f0a{Tm160jfB5q9qF|gW6?+nT$sQ+f+g*B=rY z6LgtF2p5}mhC%_y$-$QXSvo8vIdo5aV;V;{<>@U?aZzTv9T4`8lxOk^vc9JRg1+Wj z(0y>~O6qDXxiZ|r?vKs92+t&@`z8PPh)Yk+L26cr9c&zWW%pS3OS%h7sm+qpoG>g= zaxryS7v#PBP(uD~aPF`dGlb3?Oi>G&NU;tw7g5??_O^U9V9uy_DoS(>DMqa&U>1YI zlx*>Wb>BVNl?xH8Dl0_f0OQ%K6|Ny|PdQ|1t?PZr%MS&nt@|L{r(2-aY*w{0vD4ZN z*Pm8MhQv71qsYRN*JG>NJn;Sg>or3M#qPN~PxsXz`E{p+>qfniYf>7R!2i|&Sgrf8 z_fx#;@T~P%ouU~iJ=OtmRN5bWRCIE0@HMF)VM0T+RWv0Ep-m4G&7qJ}i{W#2cm?Ve zyM@M0W&$4QR$-@8*llxR>^?`&&5bM!TQtg2pY=})B$J|;IlkDF^q8ar-n2zw&=xPw zJ~Imtb~-Y2{zN!{W+a%lB{wruJbnq&U7X3Y$+~m)e*Elw4GD?~h9#16uCsYqbeZZ# zr(A@*`xPAPgs%ECau}JnUEV{PoH%Vk17QsE_N3LTk4tXBxCK?)AOcp~~ zp%75s!{xPg=pof77DG{1Hj4A}W#wB$cR!)fM(HAjiAEwUzD-`xjrl*%#KVu=hvSbt z6y4qJnEvg*k!-EUAI9#EqO$%#R|A$-*JH)1(Lka#001BWNklST8zqyDr`7%1a7=8< zCwu1k)XH+;ZFjc{My@SVqew}nrnVqE3xg|4(Z8ZlJbzvbso%|Qq)!pp<6X0k2&r2+ znq$ND921?M%ZcC(<1DF$eD0dV)77hMtBtp#x*=|JB)UoAvZ0pLf+%)*mL8^ehqJ>N z+)l#`@j3|Ac}_@|d3Rsty*fUhFGh@H{~IO8{^paKd9v)KoAqG}VpuK838U z{RDR-5G#Bvnde>)_T7p=Vcv#2i&^I-Fh>F`XBNG3yVCt&jPyh!P{%#~z%9Vdts>+d z9&ys_eAC?rm1#LuD>cy2Zk8yc%86K5DlqH$vak$vXns7-1Su;t;W;~S)cgDFO7pYPuP|4}2co0-S*7C3-M2yk(%oZC0V~m5+v30x8wRmAXZ+ebXh5Z^ z{p`GaaRS>~+eDXYY-vYjc@9d7^RZ}I4Qd6+>zfTZ$N>6R(t?$(#W+e! z@=;b=gyk#hkt1zLhd7d~oU&t_c1|ZPB1^RQZPy$T+UPYjwrJ5BN1v_xEad!`zfM$z z)qF{Dp$6-e7UrNVFAGf_Nl~YS{Df*EV9$Q*IDi{lcA> zD3PykiR1W*_vv?ExZ@I`K|EyVE?SO5FS=bb27d3053sDb5c}@51>XDmM@>)<1<2c9 z&cw9$zLvEv?M%7+;%)7s6WufQZQ18?G3;~JEh=0#7&=g*>=)ku=6B~zSaJZ|dfqWO zK;-JX*bVxiCvAvd~bmL^7a$NKCF z+5y5!X^)~_fCk2;s3z%Mf>505`9-B?s+q36?`RPNz6~C<^<_zzKUQM#u7QLdpUrl(S9m=*=y;F1oN=^zymls|k;Sb1taF1~T zd3y2TXR}rPXOe;Wmct`z979jpTC2iT{MThU1{xEc}*a6azLMEdbF;QkX z)VDF-u8y)gxZ0~Q1Y5Ilx~;JF5MgzxSEPOhSXfFchTUC=!t+o(hU<-z6Io|kGG&xf za=_W8>P2Zz3x6%Eb0e$MqOEyzJ}UaszeK4S(o2t7j0N!#IdaOkHBfb1+R zUGNibzvEh5c;^B_ULrdcsvrth=`yBK|~BFpaLo)AOZ@KLj#?=x~jTz)lF6R&02f!b51ey zW_<6PdF6-QU3Kf;bN=)HJFLC-+R@9ah^0O=sC5oCD!?C&dosV3;w!0wT~J-!|LTv7 zuQ%Tk$Ig2}GpdWBIAy=a0LZL}1^6Knk%-qNR$1pUp_*Hzg1=+2gPqB_tdy|nwldjx zBy5vaN=$7}Zxaf*9+!F1NDL&C=C!0mds8z&Y#*_Qt-#qIxq3@#nP{}ODye0kQ8R&u z)@Jm!wPIeO8QuTZhuhL<_E0|2KR6ph+23QxuT#B)altu%6u`LYZ|iGI7j()n5|vrE zX$xlS@@S>DbE%A-7k6Q3s)}`6hh-eui$MfrXtFGoD@{hFL8UTAt^vyycB3*gjqSr_ zw6-?NV36I+lcz_`_0}f3hJ&PHu^U$p2k){0^ocOO7X$R=A2V;(Ar%^4=PnF`22T&ic5a>`#BE&x&JT}Hw{W&a?n~_ckXF=Ff`OW zG6d%mRRbvZz%4*X{yxUjbqcYOadSlnmT56V)0 z@>|#7hd17Vzh84U7WH-tDLMCw8}ZdEZ^F&r{uuUOvqI~u8iNKnMzEGPP5M?(k`S8{ z5Le=;tC#c?VEZAL%}@+sl@+5y*}sMUB+aFPTKZ^-3`(LTLP@9(;R)$gZEgp(RSB?z zF4;TR3fETmz7Nw5x2|2g^l1FDMmTDBL^Urs)doaZ6+%YD&wd0Eaeo0N1`pjzvnlJ^ z8CoVJ=9HWmhDKy%ZlLD3Lf7xXkF7x@A$Aek6I2uut;fP~1?%2~ZRnaAFAv`wxwX4j zgT7=LT`?+x7;kW9wZSM@h6XEO<3OuG&vv+a^V-2*{j&n{{C33Y>e)XBph!q*K?8%HTce@qHo6 zjwqfu3q7kJF70)`L%r72Iwh? zi-g?cVM``c;R>sGd9udeC!i$Cl~rFw=^!WEt5MM~8T8CJQ<3-?P+*%O`o^D|goJ~( z=f`m024SkP+*Ppbni6B?ReER!fzT88!y=5YcB~GC(W4i3a6lW?zk%=zz%+f)VS{#Xa*10?Qnt(e>kOQpY z3S=fBTbz~d`FQ?pe2>JMqA_eT<~e2G$NbKAjF!qEZH!W}l-j5N)cmaGCby6D|EAuS zBVd@%D~=$$p}tncb(f!uzI+X9_C62;TQ}ny-~1l_<@k5vh$9cdC(ryeUh>kz(b2U8 zFMq{x7#`Y&XP$ZzTec11p8FrheGfk*wWm^PQj^KMdb+XG&MQ$ZRWYw`9-iIOkHw1? zW0DmOR*ouclBa||u%N3$K7OoJ!S=0NwTBtov=-VhzpoPux_dFWV^IB>oEO9-fNRmy z-7eYLVsQ-fJ9CO_xWF7k@YMP(*s!@@>Qy_hT#lBef*2V0-2VWcf8fE`f9;-lX7ffI z{`|vm)JtFHw8)TZHbqIsLQIaTvrI4z;Hp$+F*Z?@fC$y7whWD8D^;dSRa9o{P@Lgj zv5H`EwuY%H6$>c}U?LVKEI<&}IsU9dX@&>+{dH*0)v$DaC+2szp{KQ3XLx+Nfm?g*RZuL~*N2=-I> z$~~GR^cFdoy-Xtse+||9=3qV+qYzxF&3Xl7&I@8Ftl7%AC`(8JkmH_+0gDj>gvHIC z--sj3_lDfAEMG=CT-Th?ElHU)Dr^>zCuSNmn=ApzN$HPtK+gS>9jiB)aZ)oEb$2S6 z<)rjx_LO;#TqGb7IE9T=1&pF0s1m8iaH=#L-HZ~z8=e@S)^zn|O&*?6LtINk9lBa`GI9fwf-A|X zg}f)%R=plk@z4XYAjty8kae5IO}F2V)4%pZoN(L`_~_e@6Ag;;z(>6EGg!OpGF)`# ziOL8WAZ+U2fum3UJccuhI_VbwkN?IYa94lv6zsXnGBurj;47EmPR>}EVH181AAZ}h zIN{jCb?w*u=FdtVXbAt&uh+lyU|jUccZui8hrNAx6i1%;1su4?N?i1bx1*^kCpqOK zPd-~c3XlKf95u!oHN!OE!)YrPjDNecq@z!Vgj@8VRx|BD+B9jO{i0PigKYuhT(utl zC@5HVq+MF>Imj(3GeXpYN{~i`-mL4CA`jRtrm%p(g76x0iLSQ&a!9qxm3v88K~I9n zIQ7F1XM!~PXNR3pUx|`0BQ+>Ubb5m^BRtymWJ!sG8tkotq_jwXdP7?hUe?0?rq=se*_ zYE4Bg0&m;RHX%LzU90+}X{9B&7F6r?nMt=nFEg8vRx`{I+Gp8OAa~!A7FDCY1KOUK zRc4Z;EdUBfOLb39!$@XfcrXyxpPV;;j%fmDpou+y;sbu~nW|fGmc7;$DZQvt`tl^o z)PYPnkI11V(zajK+oH;j`5Atn_e(`1N>|d^YyS%1G}@Y)KkGTKij&-DB(T9iu3RN% zW|O8xjnU7Ukl2vGu$j^1YRRKdRoAlHC_+P34aDO2tXgbkOtaVF2jfZcw^Ax9)&9s- zkQx&c5A_9*GoDl6Ov~5VR*;~8s=Kpf8rb>cGiIXBbJEq`gx}q8HGY206*%$4_X3k! z6b!Fevkz+d4qS814>5oFE?BvASM<(XgdhIoI^2BQAJp^1o(}TQy%~ zdU8~Kb({MKQJQH$Z_j+Z`nXr(SHHa#pZd^gSiFKjA1nH%L@2P86mdRJi7KRl7@sHY z1cwJtmWtRoG>+|KMM?K60jaPm>MCGOM57_`0`^0i(qSsYP2b5U&F8?%6qAbf<_0XD z*Nu6dtwzCO^h;UypoFTRRxt^Vdq9PS39@w&1|mu$+;o5J6rGJ2&JiTsj>ephsaDkkK`ig&Iu(m zd~pgEBp{~yjrfd6+*5y$X_EE|znvDI6rbhc^O{l|&Zz2%ZB?N-&TZ1QX32&-KeM^? zB@Xi#vZDLV#4Q7Sb3juAhZp9sw6_~edppq4#6hJFdbn7J0ZA#qBj1pKoR+|{;$nEH zC!3G<_t!?pD_FOoA2Z-ElDyCaQi>=8x?^GjEe(z0NH)~ZV#UHfRYIQFG=P!OF|;(b zs41O&4r)q4O(oK?u_-k&6$+eCI)N6FM`tRkm@Hp9AFXw>7#f`t2feGi8>RBBDbBDQ zn9qqzsNqvA_0CjP{$a_d&}738sewIJEUGEkWCWcip$W+|;%jPfk#p3d_drf^wuUX+ zci`Al&XMl+wdbCOWea*$2LI9}KNJ1w#&3O0ia8A0sU-FOFI|f3Z@bS=$$$L^4IZ1s z_up+LHf$Tz5JYn(c7XW4Yj#?sYk&0V%|cQ`ZuLKVcRD%J!|wROr?KnOh1xi5Y`f~$ zcjCieyBgP?a|&Mcyxp{JSO5AheB>Kf4J(8 z!EP8l9Y`VCDUULKKMs$@RQ_ELmeYIm#;c@h%wB7fqt3PW;6?$NqprqYF{)Nvw;>sB z)Lbn_=h)HZNKP!M^7tZn=Zxk&KAdtJN! z%I7sCthtFp&)ENCjqk--N~xAGUMvg!(@;V0U!gFEs5IU{ZRd!6M@9{`1S!skC0deK z^~y&eq&DlssvzOav(DJ=Iny(gLGQwj*cpsP5416o1$&hxINl!<;D8D)c4p)>vmiwP z4v7q-t!ea&8I{R;`GSRL@{!?yb=8>leh%wRGP;9Zi5-;0UPS4`lZg0!?61^0r<*Gq z0Py}ID7QdFX;E4Yawx%Q3XZ0_Y&8GPz%Ax`XfF%(r>vzV-RddP+>?4uLN_kGOCej7 zphU%HW|=%MgE}??bIbx|TG`{szccs@e!gaic%Tv$qM(r3#9^mhhy-oDY0-3=RtC*} zra+zdZ25EN`&m`e?U^^Ev#Qf1$|Qd`r(}s{s)Iv?snA3lQ7K!nnj`(p0vD=d(%<)Q zd>lj1-jBBSPPEL9;TJ!<4#&UaeORz~1#bS`uhH4J7=OIuKFrqF;g5Iy4O<6BvCGcO z@q$AS#Ij|}v2}P1 zn7?=#iqq3*%r(nTvl=o!Ifk*(F*G){C}`p|cFrCf8y-TwZU&pTZPhgJdA;+|(bcE< zUmrR7-8kUDgJq*N!)0bxVircrOcmMGob7g$)l$;%I7e+@qKJ{HvM5+o9AltguNi5L zXk;I3eFH|ODyo#QXLo9vpr!j4m#3!9XJdL#p%Hx@E$Hj%K%vQoJm;9GHZ&-?DOG^c zVpY`;&U&LwC0)LyDX#|fj^-wtdY!AoH075kOBhh)#O9I+@T;@Ig=DO#x8FgdNIrt{ zYW_H=sAh8n6uF{W79^&*$|Ct;mr{5mKu32YNpD_aHf+DUuaDTlssRqXx&*qVNLHN> z&?P_>*<3qLNfpH2%TYglu2pr6;Tn`~iwETURS|JtFYGF-CTI=fvacd+Si`n`Z1lnU zG4r;2Fm~C-2+QiQo^2wj^bF89kl{>~+qFD3Vety^A zYPo#7^rfkALH^+6kF#yl$*q(u2{lDQp`U(d0~`NK|}cBRZF9`QmOhnmx6C8@jtYuz1mY4DvvYPN`{3 z=s1-{8X8colH$O5BRmw1S{Tawa&wGJ;U+T3bV4K_2)V;FtYNGZ>B4Awo}I<1U%5x2q#* z(hAVm&_4^3RWgh0+7B7GvMB<2^yWcE3x2ja2xY^*5FV_@kU%@134$4o2QJDn9 zpH4EkEP~ijP_fdeAy|n_siWe&QVJ$erjkf46FDhmvFz`i5E10tnmd*il$|iDe65w& ztTESvyCi9ipwFE^kWIvYH-L9eViH+PRB+OLVu&>ZGR^?W8fKNmW#B!aB^vC(Y$Vs= zPh`mJS@GcDJSHB-izRwQyTdsT3yVLB9HWm`EUIk40h2reS`OBbWeoiCdu|1u>F3yN%KqNv7 z<~-=QvU4M%^1*?Sd^QRa!Z{}%FL=n-%&GVA*&lXB)1W!*gH=&|Hi|oaL;9n&C91F9 ze4a_(j3SlEW|RB1-%Wa4G6|EdPU_5qiWUM2vMt`HqRON9Y#IH^?}^n8?`=^k;}uQ@ z`Rqktg@An+@ulQM&FrK-*>fgmo~SX;7*&J_oN*s9xZ~t;Hm8%4#n))4n*x&*M2RFV zvEZ~Tz%Ac70XY6hMsboyH+e8|4e|7aJYf86M$)v&u1s#bJnPau0XHX%F^sxGx zXj&9<(NH}mClZ(eIvXqK%THtT*7X?Kz8UA9`z^fxv@@{x-h1Ne>#oJ^f4L9cJ@fI% z6YJ13ZxIeZ^l;4U>&0}jh!qRxqtMlbEnBzY+F$%q68}r*b)&t|hBy548}O4~UXS{Q z8I&f5vGM80Ff}!Wrq&J|^UBxY!2J%ydEdSW#mQm(^}ai;@?2}c-uoSb{SP<@<;h7@ zXDYbplJ8pO9Q9bZXenOu;uo7D8`ogAgmq6piH?pgw6t}pzjc>gS7W9;iFHpuqjNof zUN5TeKt@|iEOQgo^RM^=+jz)8bmLc6@LOUieglFk@i+tS51LTtb)G{#7w zza(2gXTSka4UpyK|MIU-)n=+Tk(nEfh$m@H3wv9z?&$#>{Jd4zHaLZco?NdU+og+o z(bL{$)64Vq=x*=E_{2E+db*T#m!~Ju*jO)KE6aQ=DVNJdbak{!L1RI0H&!n0!nPd~ zcy?pIN`4*fZIZlY<%M^mA$KNXBjd;0-~nV)47JP`^t7phzzMRH)n)cgr<1-KOn${fEy})A#p2eG*z)T9oO18tZGNBcOX*H0O&?kL3@%U*w{5C zc+U3)j~%8ZqltC%8yGfjzb+OAX~E%sKD6f0nGImbXoV+Xl%S==*!$EIN? zUe9TTY02N-KSl0?Y7>=@xk3Sv5QPJClr83Oc)}D;I;{xU{tViZR@AS*_#CQ?zw5t16}b&h;KHwn>el{5zun5B=#KD8=_ z)M=89lkNL)$z7iit@#UazfN<>O7dFLVgU#%AX3coY9QCcH1{cYn)8I8XUz78RT@ol zn151?Wx8C!H20aPkoNq8Lv8EmXUrR;A~_7e&FqG)L4Y;cfzx5x)a33#TwSA0GnTN2 z_tsHzSJn9>fnz|-L9f;iLW(Ibu$~o&))otHD6d{u!}R7yaOmEvFgDtc9sL_{&tD(L zZu=gN8*aWC&u-j+ky1s#z+s2J5Q~?s!0_O9tX#SjhaC1I^tBgo>+gSq3%+|1j(FiA zqHeQ6e7}7Uz#e-ZgbOdd7%LWa;}5s|3Ok0j>lVhxi+IUVufTgwIu(Dp{{ftP?&q+5 z(1wYQk4>Rk0lt6f50I~~;?c*S#HT-hHd+eJI{&3o760;vH(=Kl%Qb)Ff(tId$k;I2 z3I*)3=U&)j?Y`(A907+mZ{60fibb_j#?mDVRegDK-8ww-#8YU=7x0D8egS*$yH65; zaDOrQs#a!{j94;AriNK=j4P}O?}e|#&N zoiSw7s}E7B@E%hSaNYbQ0EIw$zkz??D_pNc@;icdPjEuT%3+uU6p?i9fAr;)%czXl z1GJDP1*0wCOxiwp*$E}pY%_ry>nROy^qh?p5DcyZryw)tD#|GYbA3iwFa)eoy z%y=>+pUMP+w91@BoaS{Eu&AdUjde9Cu#uv#88Cc~8b)c!G0!pk-sl7KIrbAZpr@@F z3pxsz-`R>n-qg}^bw=%zT)R7Wqn(?LSEW=yi#=--zOV{m-Iag1zsAX$EHmcoXRvtj zBJ3C$M`NyvhacO9MGLzyJDXFp*2L5}3N0-tv=uNqHYqC5!g)QItxRL(;(6%lXu%Ut zZ@}iE2~;$Xqd^l=DSxNg9hDODn8BKz=A(ajN+rbB)@GDToTZUNQ*)#K+&(ajrlw}k zhG&H6OJBUP5#1dv=qxm2wpvE9I-?RK53NyE%z#EV7}HbL_~J7|%m`aR$&&KB&b$zh zJ+m2?eCA{vy!UElg^#S;gx8<`b-e0D2jC0ue}fPmo&!>;j(qp$G?*}gUd>`*K+ zccNiNnJ-J&%qT{}pbAK2^IE!~!vvq$f>ZBZwX>N)It~3u(hm;MOZeWzCWT_}Y|8gFET#y`qPbZCFDgwD|mCNklbDF?>nc~o~ zv>IG%AA9Z^-L{t2SWg2IiIN%CxZf;~+F~zHdWe}&5JDes=v5&2QAr4N-3*ZhQC{Fk zkd)|yVKAfF2&`^-LZN1UkNx6Vv4Uuh&w@)!M!Xv0icbj=l`U;s^q-k=Zh=ssVRL98 z4uwS@PgE&QPT2Ui36I|`v8YNxQ{tL7gsPWMRo7?LD}ZA4BPsj)XUX<^;2LWZ&zgue zjbEyQvkq#?jmnJW0AAgcvY`jiK4T`TgMl8~ zJ~c6k_{vs7qzvW3kG->J&Iv`p&a1`oX%np7rzIQg=TPIgdOz%YnGZ9k>w$qu&3kpz z<)%$*KN{7c22aiaiGY&#&-<3FDmnE$bDE_9sSMG-F#u(wvZ;6(Z6`rlMW;yzw?!ag zdm=@EdCR6on4-Rsl#u=tXEL^zRhsQiwM(30B0oxdq(- z{1wOIG28t?vJUq@NMj}>n>Kg(le{K^UjLC_lr5ErdbQ5u^WhD=aiK% z+7kA?Fxe={))bq5REY=FCX{T`d zuHnx-NASI9rzZ;_(2kpgY&y%xDpD4KL>yt%!$?FdF-Zh05^APZLsVsFj}lvYoM zlsXuZ%)xQme#qc54iLzb($iCPC1IbMca#0{`*DEKWZrEptasL`GHD#)z^CkRN>_Dv znXC;*TSWCBFqnvcVz6j(9(_&Ra+(N|CnphcCBTG0LH1oYptqw1i+kJ9-O{Mn6X+m) zm`lmzgSLl$KUx?>%WKS`(3nSeYqMm!=XbQCwZVGDG^CL1fNUjNW`ne3DlzJf`~UgHjkNp9CHTz+r=z#C%^I=(jVklWZ(WP4Zn_hff9_-)`Mlk<@1ET{ zsOIxS_F9EY&U}{=KpD62#Ev+q`Va@o5eSL{gd-P%rr_Du*Eo`v5JV|WtZz4(rhjii zP&jdB(lRuj>;%s;_{`bjh#l-yJ3K5{XkKex1(PIxj`L^3sam39PbA8)RyFbC>1t$_ zU%69tnxFNlTkHeYx|8sn}Tf*>P&Jq*42|e?OoGN4`A9Z-6v#w44ukU`^tMSkKgDV z7J<&goYGKOt?0Y)pdjf#NfTc^D{qg?x%&j70X}Jy849Y+#Fh%9V=H|HIw{LIO zwTZ?iN>?s7D=VYEG$$N-B2G$f1R<7~@u}G?galD^s)bc~QxL^dee)6Gorkf=f(n7u zTA)t)G5b4|fD%ZH1T2Ll=Ljf7Bc}jB#V3}$#PC0=Uo|l}%=Cb89}~4^0>Y|?&ZHc5 zP1B_rfLfAky-LJdxadZ&u>TksSe3}YsOYt#jgXB} zZ%9KTNzUPV+}k{#nkA5LklGZHO@1UnuvYdeXvRnty)AWk>CW}Yw|3y-?_GjFKlm7) z+B|@2sf?3OI#H@sFFO1P)G8I6ci!i*WcgyOTC=-`{B^eW;@V$ckF`6`!|lJn8AF3Z z5{c=Xw-{%C;hXsLJ%7cs&pwRv&p%(HIaHEr$TeZl-FCy9-toh?!lk5PhBX6c!8B`~)o`=2l%0;#!ODdK5Clh+G zFZ+|WAQ=vu_+GjVyRRgnO8g}ki@rruA#IAg$0&+#V(b9p)(k@;I~#~#o8%-CSz_CB zKAOWXonjL8=%$P=$62)I(cajIiBbvUlar$8%}@nS8?{cw1NL~dwB*sw>Sl8z+M9Cd zZf!y@hZVNu(ME=V>{^JL*p5)2sjDUhXsYh|`#02vheuJ5yfsUqhLtOq z1G8nU-?$asU9DKTY%z*sgD4c*@#r)C7@4eSVrnj5!vSj+W8LNf3=L19yR%zzY;?@s zot$)@*Tiyi1}7$_m3i&9asehMCNVli4t0b6)1aH`3|gqX)ohA0TL(uKRB@IC6BphT zU0iF<0w`{MPV^R%NCT}3hs`~(y&cG_p{Tauh^(2@qOs)WrTp((&p02?Y#zXsUwl6f z*kflMzmd@?9Q%PUOF`nYe?3_PF($k_v665c6Ls3 z9Ufo51;>5pYdC1nU2xHv?^MZ*%)ZZk@8|f|wKwCtXS@@~y=Z@(3uUyLQ{f!Y1V=OE zHNLdY#*;8)Ga9R+GouDf7E4M1O5~_%ZVs7$S90#ah~=V8z#NFXiFHq&QmRH{YEv0k z8cK6nN9kk%0R?n=tiE_45>DR+4_bgAKjg`moh%ENwN5I@d$^N9^Z0P{b##UfNQjQ$ zbjCSE&%}*69n`C(E;Nv}&7lMq^1yQ|t&z~AK7&A(=6aouPfT`Bk}wNq?DalF z#VbN4(dz^I>M3byf+^14NcNVhXRM?-03f;!saX~FgaohO`?VCDI1m&zJmwL(2!@?U zr)VkIvf#w3J5JB=XPT|_MxbW_4`VCRu}K*-$`BLm2!4Zys)WvG8wj;#;L0AV#ymRn zz-#wz!4EF~G46ljDQwu*k3|cY;n-u2#hTT-U}@hXhQQ$M-J17SC?ngpQsL0h(ld zo`24#ux)S{zxw4L@c6o?QP`zDK>{NbJ4efq3TWr*P$uuEpTC9he%Kz@BS& z!(IpMr77X_7cat}ZuuRac>GCJ%2jmt_2OOceutPI^Siom%WrSP{ZBlB-S^%LD_1PT zo~w4j)Z`ep^bcUgvK69zJ@C-OIPBmf@WJ<=iiRexA$xonAXYtLbF0NlAeFIr>|Or6 zTC2)7kfO%~WU@k(x}rpj$*T4cM;}y(R9nC7`1CBsrpw4THmcdYF<+;N^o2%iK<17h z&7L#Jc;*;0RjYNH>A_rRf@)w?7A>17g6N?PKyyHe)Ij!pcwC^~LD@PVvZ{TUPQbR_ z4mPOM_gk-lzznw;O2(*=u1Z@tFArS30%G+>i}RA$J^;C}>2A24jc70PIXH7N} zg0$ab3b(&cSkRE^79A-|8*|20lm#s}Fx#5&FcR*S+3x7W3PwTdrHoP?Af*Ai7MF>l z<;sm#d5m5WuSBL{iFw@sh<%l~W+@mGSLeM5ZrEv?l}NNUp{+TG?zTqFcHt-p9&`=_ z50z9)$k-FqC{_SRa}buccX%-K=^xgs2(+v;U_{E3a&G(h#LI_$UGuGqL`E4sQmP$?BLFkbdXwknz% zo3L@)cC@z@(A8G3Ag-Ri9Q7-CY)pgYP`%zgeJ*y8Q6() z84KjdwFgvJ{rXS%*9))1q5G`H6<>ItP%0)D7ysmUnnr%g8()S~-~4h5NNP1~-M#~_ z{pi>6__JI79oqOmk&ti$eBezl!$;nBjA&@Q5bB1%^3-#&b#NHhfAvG^3E{!ouw@X3 zz4No0GxCe`PD6L6HSEVEWCID)KrMT{fgU8(Ca$<6)nNr#`FZt+zlwq3vE)~i1N;x% zd=^0buU{SkMtnjNAN{*uji5Ju<(#6$fB2j-42>lH`H!z@&b$8Cm;Ibq*j=Pa-v9Y7 zJQDtQpO7YH*(&FAUzP^q=})rj9f?8`gC=R#b1yhsPWJ@PF;#ozbDl?fdFhWM`Ago~ zzhRuB%m+UA-}e4WxeDd9NJjuEQW8uSg#3;;<^q85T@31Qd|6z`)unUQ9|P(d*!dDrzp{Z0M^GbyUD))Yxds&2;c5 z6%WfxERomlP_*Xzk=ak=u&j=7$gn3%79fSBcc8e2Tw5QFJ*OCKsreHP4VtXnz5Q>v z_J&_#+t3)E_q+q~&#!(BI+~kt+wX3`+O>P5uWu=?`^C@DUI6+xK7kGEpTU6#9fnuG z{sVaA;lJQ-58Q>TuKtl?1STKNO)dD?$3Kh}E0$wu>y!BVBU|vBKirP?o=(L9+cs^% zl^0!z&fXrJ|Lt$#p(od&Qft7_;IR5npTFNKeDIXBaPw_9_@srGGoxyE}3C5ih{ZY!UnJxf)$t55U^B zdtlkZKHU44yRcyK60|h7V5jAaaQmNb$HaIQ?>YH{IQ#`KKzYU_d84;U;FF&XCE`v; zEVH8IA}bZq#Ah&GtZFXEIFkd;Tces4<&kHs&#I}V(e^@(Q_J(B?>lD z!io<^9u!N!I2+z8WzC+Mo~~e$y+@i=V(1H#2qr=y+Z}d~TPau!+#L#-sr;qcVg?LZ z`ryAs<8vP`W>h&-6;VXvP^p%zzmK3eve^ z4m1Y)#Qj0yA;ZSWUm4J7Zq3+0vb+xBh;1O|LA?fwa`Jg|jy=Uxv#QrjnCWS@7MQ$v z6m?kHAS;NV0((f>NX2T->1_A3w5TG|>6B&miI`fVJ?Bv76e}PRvM7Y(=H%9CNwGDzHldlwmKq6X(A?aN zk>OEvceU$~j!c%Ye# zGBs=&7{;4Fc0M-s58;x}o{S?8+EWT9qvKO}|CfG%zdiOWuKmgfvG=aa%@EJd;MaHl z9Uu7eWtw{aKlw!m_}UjAgfE}^W+{^y{jd&~{_OYo-1mNlkDl;Kob=B}inC5W?`JRi zDK7if?YQa-@5AByu951Bt~pBWQSSUdTyz>PxMR|!Z|v}#Fmk>)!MRRls#D4Ly+zRfAZSSfwXbB+n&3vOkAacmDtzbt7F$> z)H$7uP*(GgOqVeBw9#)Q-K-CFj)5)6oUi2CeWp%|vZwXHNCxydK}qty08!^Ws4&`* z&!kYVnSGQoVV#1JP`*+L(V*Xn@qgt28rPurd)w-NfH~$T)|IEkEz{;I=!dajDG&T)|OVx>*>VTzWH5DO_XuSkuSy`Yxl&w?lwI9@B`S`KY+EXcgN!SJ*tQd zY#+e#<*V_*(>{)|i3tI-)fx7znonilhwKW6HFMm6&XNg^aH=`grG}>}7$ME7G>eHc zMSVDMF|VPI#?h}A#hQI;9A994M?7mjKgJIRD=Mt2F_9tDg?o(C)kjM+m@ZZ^$vz}k z>*9p-lJ}fN-;tr~c5bXfp3c-tunqUYs_H5^_KLoIhYguls2qv2i?u}Z#Jy;gz@UeQ zk4$^3ERL~6La&MhSa0G27g|H3E1B!IJ)XcI{yUaDnAME9O6MwA0g3bRN{38QYTzva z2}Ldcj3gOy^BVn_`~VkZsjHb1o^lnZREl{W?o%LxRhHF5=EJm|&uiy3xo&S{kNISY zu!}`JhB26Efv$XZ7OhP=bQD^oaMx5{Lsxq@mV=;jA^jG?2WpsaJMIBnY08t7y^aR$sCEjcA4J4Ppw%Uh<_+u5QdW_+rokzu)9 z9wXxuR{r+iHAm!{_^xGd2GasrlZ0dgmIqAQdp02Gmb)Lq2hO<+2kf~EzW=W$OY5AE z@V-Z$#tCO#h-SQeK>z?C07*naRMjgM;Rl~N2_5aNGQuo}UVYOYnw1I;WBI~fZ9GypI5GXW51orWcV3FCzxY1P>uwj%^6?G*c=1VJ!1H!ri7P(;UJZ;& z4qlR>`$2R^s^VV~45kh>TEQ$}OoOM`{Ax^&gX^U_J8~APQjMcywd9h<(X$ zB~p4BiVuyA)2A{^nmBcFJKbT=NqBT!cKs1QCrOjb*Yf+CHIRaqF#^MdB#o;c@}cGw zjOIe)!}pU^qR(5ffY}ge3oPxvWT=wf4ySMF_x##2IfhU?&9<q#`Raf zmZR%xqNKoq+bkvDt|G#ceIz4xF3s774U8?E2H>%SZ67CFJfnVP&oBvZ_4l9*8Sv*T zNJ^PUtJ#Dkl-i8*ZBL&Ll&=xe8UEWdblZ37u)WwZ3DqZiok4tv!xcR4Y%)KmS^l|| zkI0B^k4IvZt&SLwWqV3P1N}Zs(JR=T!O>1rBwe?IT1GL;1}ffI${r)iX(v53w)aiJ z*%Mo*xLJ>osV7yaj3xPKAD*g4R!c4dIgO@V13aCG==^pjgh7i5kU}&NUk-jYdk3Nl zWy!C5jv7&R3+_XvIZ$4kzhz%Mi+m3SMx2FGH;ZR(yAA`JAH&L(tMP&NoPzn?J^0a& zuE4~^0Gb=hn4Xxz>yQ5cZoBPP{Qd8Dp_vGCOS1ww+MMC(Dn={p2{L6uJ~9S) z+?(=bq^UQtNw`6RK9>B)OsJF=YD@+;wi8G;dG(3u3dTyaHdC!Uqj*fy&6$A6#+mw7 z?EA183Gk6f%M*x>ZZHF@j9MHv&neK_R4#w*doz*=ffEKb_>PLiz-81kcHV4>Q(FD? z);gI<%AMsA*AkX1Xv}6W?LEu}g#}FoDYDgHix*OP?g)u!yJY1&X(AOf?!b~Qqe|&d zDv|Mjq%-^b*)^mdOyG%MTl`G=m#!!k0Eb<7Bx}5OO38R%N&*lCk+-H2kEz<o|%jmXylt?JR{ESjA58GR+GV)^=-hJ$lxIcNV6 zyrYCO&kL&?61lSD(LHMLvv#@rpCvGkT7XrgLtl~5gWG+B3GY7eZCR> z+qa{yr(46khQ}t=a83m+mC>k=&cQg9isbJY%n&WIae({IcHou^KB1<5ZeUJEee0PQ;kNr8#hoAd@21Qg38$VhO7stI6E~x4Q^N|(t!%C)Cfnj!M$6zDCb&$?^411Fc~%v zVLgdrbxNkj;{cl-l5*g^*ys&z-i+)yl!Zb8OE@f&kz`FGGp94yeW#7Qjv@NXQe!16 z#(fp)7+O<9Tw~1wt?@X~ff+}RMaKw)Ak9P=;>$phj~f9|rl~xlNTL<2=oo@)#+<)L zq)UAS>c1iH*N{?G*csS*gSiDlY5zySsb;fc2w{pO*&5sak$kE?)aXA_p|TZ95|Grq zThJB>SG+9VFVHaa2Wgqw0(?)D+-L`V$9^Y8f-F!=YE1fwNDx$#)?2v|5XuBOe)3zH zgz$^~9RwMyd`ziSGos>8JA!FDJ*sGSUrP4EQ|qAl8Hpe{R>qsF`HWa)v4(sLFf>5Z z6T>K-N7XGZU&$g#3O<$Hj#N0iR7>9~S{_mQJ;!^+e4nhWtx*!3#uZs(CfS$xg`8@v zqeBi!|CB)i3bMnmMo&R(g2WD_jwx)XZ6n`jNwS*;C3bagV{DVpp;u+AsZp_siN|&p zvrV&^^XuC01M~U>piIaG`bZJ{rXZMU%*$s@I?&w_oKI`8#mtcOAr^k=gwR3 zg2P^dg-iFqA8-Ey%H>Ji|KNkT@2?MGY-9pwfBrMr_kaWN%%gXqx3d}BhNp4EZTFy~ zvj=;xUXAyh{9%0kt7l=|`e#w!kVivf6AJC^VB5jVUi1>|v+u$9()s71Tq&6V3Z-Nx zCRJ@X`RxP}8*$0iS7Tsk5W~YGs&Ymz&nHiPKmPK!zvIG7FGa4gQN5`Qrq--pi(_7P zB))R?mr$?6FT;PP}FCv3N@l@wv-Hnl^6_A<-pV&x;f6E ztpyF#+V#P5e2wfqe=}EagJ;!OMqrs!<)<-TrX8^$ak|L9wi*45%1Dx3_r5UxPMj^1 z<#(UxXEdtm7He4C5k4qb3;`P2AlUQ}E4cQF8%_>3ZDzqpOVG_dkR|SNFI0bx~ z$6=PIeO+OnctsV!y6f(Frp8$sJ1<*=b2Pr{IzXH_NX>g>=1)<9wE?GrVqt0}{0&`ISA>QXOR(5po-bZ8cn)6CqhK~7rN z7DXF+mB^TK16nOTO3gfwHvQF<9sc_Gvv|#^=VI}^F5L93k6~d?mp1CebV&)wum1Q~ zeC4#`@tT($B1ZZ0_bxfRFcdn?$~dpbfq{zhM=SgL^dC>VA0S$lL53)ViN*tr1U zCQE5wkzA=F>KmKae}$a~2p{l_Euwjkakw9ZxbGo_&V(u_fGv zMD}@ZuxrnW@6WIzk{t!b9vDZWmL$GP5WPt*Q(;RI39mK=1thsKZFl4NM{?+9)r_mp z<4CAi-Zx_fKzqK8v<*HDI8?zDplU7HkQ+0J++jPVDrivl;0)zW?M3F?hWC$Zq$e)1 zPqN5jAe~80Hq@whC(qSrD_6&`h5vvsyMGLYN zOqe*0qaSJQQy-BzhkR@%^X&R}szipujM+v*ki*V~-Sb_erB0w_SEg|#buEMq#^Y>~ zFqn1^4gh)}6jV39E1#Ju@>xQ{bj=!}qsmh!p_p}l`Z>0*|2s}T>7y7M+=k!XawA^% zy4PcBVgf@0Pveib-HO)M1!!z)L|GBo0{m%Pw&wY>JtWSMHG_4E1aTYq7 zYZ#p@q14chw$6E2xnv36cKnIB=EvW|hRvJpxz*L9k<$IMHSD|RUO3=@!|{WwFURQE z7^X`ln^%H5OczUd^K0IK#fy4y(PfuocyttFVp8PL+1a64Bgee-NP(L_`spt)IX#6! z!6u>S^KE$RTi=AA|L96=+O!Ex@d z(`an!z!9%F9!>4t7#N>Wyuj;FHN({;Iq{q}j`Z`ce4TZdrB8H{{h!+}%-7!@1%rw+>QRQjF>Bim2k6?efo!HqK(gX$iD)2;z$mZ{wONh9XvpRD%y|#(ElpV3*M+V^GkFfOh1GIN z6%LB3@LKsjwpMUxWp`^U3ZyU#xM4pwg*9B=&p|cymm*fuBI|%ZKjOJ)(@dlDN5aH>EeZ`mMbVU)M4d< zc9dqT*tnyF{-F^pT{vIa&gT9BbhLM3wp!63l-{m3433T~8!|;HRyT4OA1|SE)$5OXKE8O$8`@V+-3g)`puY7Ix@^LldQ zHXQrGb7h!r`OYVmKt-S@X=0UpER3*#FRCJOpaU&V2^a!ed{VY}#7-RwYj@Tu4 zoAK^*(Lp;xQPRvNAo06dmp? ziexENsyryR53qnP@!b|ENzKW5`$-J!*@}?CphZMR=fN+NY^{d}4B5aa&{+#m9Zh${ zKxZD(ti*Tq2iBvJ(4P*1>&6O8Yo>P*E%ba zc*vP}HIBS%1sWbW267&;r))SsBbpsR{P}`?j?LkFz&V!e7a) zS{j+0$%w|KV8x0UgAebtR*+-PB^o6qf$M7(Pgq+!Q7lW*(b$_jU+S?^WiBY0NydZ7%&7L7o{!6`$2m;);D2s|Q~MNsAx5vr+9UY}w$b`MXil;Av{z(3 z`H!`sPd5AL>mBq?->>lu)Q=%UVrP*yI(kBQZaocEgF36sr2SdY8B)$()l%FNc&nX9 z17Fe%JxRuVn57*BZ%}nrLfQ%1A0`&jyTZVh)qe|(G88M9^5)OulXyQSe{btoKRJNO zM{mZaZG-sIXU@T=&ipVA+<#9joWBI^?H#!5u3PcMV-I7~mK`|xr1zk{jufyOmM-d3 zMc|jW-i@ocL{s&N+n#3M!c0yB28z+CDrO<_!|MNRA+t7@$Vg)1R8YU(u)o9IyrSjcWu_#tZ zdyW&>+5BIR5)*;)42GvG7%$Cg`Z=o;Q7L7Al7td+IRTWM$I#Z=ERKE~sWTjU>0x!1 z)tY(;$mL*3KBb}2DfEv{W2`uX`Z`vA>yf8g7C)yvgVAXY9ptRF3QDE2s^y~K`Fn;9 zc8ef=Y_GW9hNeKYwOov3?HGyw;` zpY<>JIn$-Y`OaD}JMET>XR9Kf{203C2~5~PL-Q?>QK;|0lG|M`^BC~uw#h$3pTh-{ zPjV12W0%c;atLTh0$a1b5`C{Chkde&e+rrgkSE{jz9;}+)+2&;&T13aMhOV}j5I_v zD!n$(gA2msfR&7e-7V-Tw1`^O!q->IE*#?P%st$gQ}v^>sSyQIwA2TZ(|b@rQz1iS-y8pVE}^MGJcI)U*AVoSH^wcRR+%r`2RaZRyVT zR?L=**fBbV$(cGeOL1sTjsZfcghFE@n)5(cPbVhIHEiE8hMu-oQG}?#u%xdW^SYRP zFsrIz{q`{ok5B1+=&+PA&2VC@4LIp+FJOj)dx*|f%bLVkU@a)mV2f%UtbmkFIYN$t zJXCL7mZE7isIzoz0f>++FRyd)r6|E+KeILT@7RH(Pdr=K`;Cvk9mgH%~9CVN~k+{QER*Ue%e&B0l-;Yw?qt|E#3tpAOr{lMFvpl*Du{ zgb;hhfri#GFR`%JIfm|kO*YROaH9fh;s%bsYL0~67>!cOdW?OQ@}JGYx}i|uV}>H$ zE4w_|z+9*cGiV}>x@41M)wx!g*_B@++>)J$0K&uPBtW*uB%|pS4F*WYQq34g1~eho zSDH|;bgsMs)jwZ|rYocok;_(oq6#HCh#p#M@N6|Bk@aGN?-@&O zopK__Vb`P(J?Q~RD(U!9?P6?nMf9eFIvZlV4 z=k(*KbnQJMk$_oc&7Yg9N%k<4>F~)uH&-9(e=LQk!KhJgj5DZRlId{DBq~~S<04vM z?E!P@woT62Jge4Gfk&uA*-lT=p-5`&A#f&BJnuNS9!|vPc~Fo9C`sbzk1?BUJf|1v zA2GXGki>2&rH!bH;X%Ke&e z47Fs#T9u2HxKu{ia0>m~fusN~bdrLe>Ehc4q&TXYp`V$(@FrTXVh06_&x|udD8cKg zsJ+&-Q|);=0K&co>#ehANA!KmSiOF2(uZJO{fjpO1xo?Ra+cHoW-gw_wd~YjNYRe~z)S5%l!* zh;GDB>Fe#qQAfQF_x$BH3=C|;$k-^5YZQy3ud{$cp@2gUJsLOMbUh}DlL~~G+)k>A zyNZ2xTZ`xIcMyL3(;qAE9-9~!wVA6_oSw#tWlM3$!H3|xmww-8y;z?pDN}o|-5(=^ z{rJtTw_@G8XR&rpJ1m0S%@ zS5Z_@Mk)DO@$aLDjt#*K3Yq*&6)Tva1n&$`R-#=mN#Fo97%OQ$4TTcaFkDk(dQ)S) zC^JN)Nh{@?7TO%nQX_}IG0zI`3^omnU|_U}Y2FqC(q`lQvl7fBPn3FWvWSUd#j0>K zX1`dO5ug=u1pSI){R~yw3(Ts_I-r*+QuxsfFd{vv=8qgcal3AI-{Og&pxK-a>%B0* z!{RsLCT?08WSjD*{jOCg(=(ew4QYJBpWFPn)CMLd#*-NH@o~-R`3}dDm_zSDNyuiZ z>d;>~Q0M;Cu^#hp3QetopF)k+BgXqM*Wt4L&h&}iW_jI&HR0}Bw#pO<4cIW-%zYyY zR=z(qKKdLhovtQnyOS{FKh0?yAjZLbWFafc6 zg}p^A5}1EsjLvhwM8x{wa;W>!?GM(vy4o;Nwiy>)YEG%clUqi#DLdPm(cVl+LM}=L z3;VjIg0+3DsAf%O&fJ(&r5Q|4POAjCXu*6e>nmXW<{{Ce7S8Wg1%wrbd_5FOvTm#aguSjO};Wr3{^ zp^ipV&9Ra7T5~&tHT9hE8Bm+un+o|%Bs&)T?ph5u{po(3@}(chs9gT}_e$bcWvp5a ze|z{D{I7q#NNB@1KXwB4+;y4JT{sQ7I)g`^-h|IwbRGWs=rc+j{*fJW(3-VdSP#o-U}n-l)7eUg(YaS8pvrS zTy0!On4J2g=W1ouD23C}2J#UzJY>L$c6()sMoGc7K7-HLg6)t)l!I{;C9X6v*a`nU z0;cRTrbgZnndl42hW{3HrXi>E<~@;AcrCuJB_*1k>Z|3coYzCr2EW*ONf(eizN~vt zA`*#HS|9MF%cgeI2s7!Xp=1IQ2)`vj?sX#G)*-Wy++G*;DMt!}>Zah%&WKTtY)zsP zWr;_&aWRrYE14$_F?w;Lf5y>nooOXE)^8;wIzw?3jm_p;WfBlaC0+3?lAttAQ$&#_ zq@t<@RUrCz>HE=vhpcC`w`X^m_b_?V8hiA)g$*r#(CB;v zWC4ul+TFk=lE)Z`r}H(VvYHKxB1lgI9Y32%AY;j(r4J0Y0(h~o!-5D`n)9AHQD~gL zBotMm1%^P{N_lnK!5&p5v(b{H%rzOh9N` zmoML0ePTcU>2;b0&+6cs-FC;p`|gX=KXy8rTIb=|SHBWN!=qBBTC`?gG%ep(Hia<_ zSr{d7@SiE3HPTPbRP|>oga6tL#yLxk!wHEXYv`*5$+H4RDmsf2bM^`&|CF?Iu0cOz z0FL0 z%>V!(07*naRGcJ(t`N)Ql>5`DUY7^RuozqmHDzk zX~m*$)Ylp@H92a{+n7a9M-w_bTCky?2BnDB<^qbviV2+)ZLd|Z->T*6)p%^ffEve} zn;S7aHX%)CUL5&``|dIyJBEwmI8K&ID)-s|K}yi&btt)~I}0sJHj1TbR7zz{S!GqE zu_dRnXmPrXa@nSX62Yu%aAhBFhSgCOQjmG#(Ffq1Kvg)T7GwvB3C$P&@%B$& zs2-djfBA!0(A$-Mh#z|DI4kUS#KPvL*oM`bB@?03tXaXD8mhULeuNSg7^{BpyP>L- zy))6CGL5)4Vb?;)to*E8bTT7t$enBUCF= zLoCA=bgD#eD3SvkPGmuZU#kZx)*NdHkE$M?Fi3d7B~U}|F%YEKhLH?fuLl)&SVT9K z3>lS70`lCTPQkV-Y7wn5Gv}dw;$+f>$)GSrf)t8tHoZO4Fv~EaGG;-iB`GFTnudkO zys^MPL45QmGaUY)b$KOJVV$do*>5`DoN(NIo&l*SOnklikt(Uh{l@5AE8V!Wfg-J!Ml( z!~;q>ya-^u3g#!n|8QzgcxLx`$!pvhT4G=cM%29wmGkrCYn(nqqc2#cE0i7rxwPjT z$wrc>`17?H7PfYLP3%qc|6ZL@;$vTNURB}sXX8J}q7upbB_*_^YNwqTZ%bvHvUa)cR*}!*6Z? z#{mGUKvlnVwYP~1x&MBLV#$(axaZzKX)SC5_pD-r_KsE@cF4=|;NS1Y`pp|Ozku^E z3aza^p*@d74}B?a{r!!qim;-cMBe(w<8kxNH{-qUI~Civ4+vnSvgSdD z9fEhf<1KjkOOD2+KfDqfHg8hJrC20OBM0R2*lGE4+<4PXqLS|z8Nz1j$W4!uR?h0s;7bl5tVdUCBYFzn6wEnl&4ysppKlqS#HPVrq)Vo41}R&6?bjkDS;5lj5dTt!gx zPid7V);B7*0xX^N!`M()tng-5r4l9%tdN+pER+xQwY8wVg^6k^hs>WdEh4>&1q;Rb zxq38<5tY-wxqq3w+KeLe5AwrG{H!8W_q{(nTHCm7hc@8C-VUi#ZQj<8p6(9pG_Ozc zT2ti`MyE>H+P_0+-h$pXy~)&cS(|pM3`|W;V5cSXQOE&nmMy@x9pjjuffOd_aJo9$ zlwos1Di^k=ki*nu8B^67MyIBgOf)t&sX0r$#=4ryxtu^=DVH?Buu?ATfG{glnQ*$~ zl6E$Dg;XO$-kb*Dj*-`@L^f%nBJYuO3sV--wr4MgJhGv$qvMm3-=!+nKfm-~oOSZ+ zlpOH=nKj;d|Ks@B*RK*)>+7eVfJ63Kt;!6Qym-G;r82e+4CC}~T!jZ7e->jC)1nl~ zIq|^fbDFaLmSYabTaS5x)HK-h!u#SwC9n1SKfetZUVAh4S+hb-=WL4SA>#iw_V2*4 zA2>%nCl`F;op|YiYmMHMfeIrivy9ylRTt^bBIP=W8NRYgb_NzCh(!|q`XOV&Habz% z>$rEqS!p$$uNaI`3pO~hp3-YJ`^6fWf}WFt2|R4997(p2TtYVc`#qT>X0SCQo<3)i z7{$QoNVc|AO=HE*lF{r}Qa+7jO#Khc(urhodM|@O$1OdmFhlD>r`M6`B*=?p?-C7J zp4?hW)#dr@BZ#sJMmBLF0?1)dY=q<L-{b*W4*TzE|}5QsS|uF;4%c12Db$ zocq;g6Q4WRPabJ*UrMIJXB7@}!q(VqlrG+z5*$zZ zlH`&BiYjWRe3qh>HXq5chjefGGq->}8<$6-70xk|;xyridzambtiZZ;O#LefkkSOx zV(SQm?K}rR*|tzdmeT!WINmrDai-@cAZdj)t+1p)kj+MzV-Dv2BT!I7J~BUxL@BB@ zkqr1ttaOqz%-X=V=-Kic2>M=9b@2*R2tD{D`7E_*uHlL*XtbwBwL12mt>YZoP=5mp z95YE&P_jhTw4{gri~wV~%H~shB+1&k#C<3ln%pRRLhKBZE+((ZAh{ujhVmqap1c>O z%@5%P2knEM7B9!`f4&3#{Ts1l(Mr7e%_rb1U-=xazWS#)=9m}aQ)hk^V`Ia(;_u2a(^z`)Mo_p>BclBpo0>vvV>90ThPUAU2kyu5Z$1GVH*PU|QUeY; z;zfAJ+g^*;9{Wms_p&Q6I6A6{@KoOH>FB`In+LGd$`#nSVI3yMMzLdf4Ee?a4m@Cg zJpSS#7PN(Gb7iykiW5<7JFY z6y;9@9222sFPzV);Y=Ft4FWQ>fs~gI@FI>;0 zbEItOpIw)oRO>~xe|fK@(<5bL{dpS8!Py4>+eTNns(IF2$(Fm~q4~{B4=jOPV+$Kl znK55!(|!uv@oE+PD;e;_zB{q`U;I`Z{Zw2r|t81wU4bufJqBq%RS84 zOFbZp!;KXbQvYHvQ8+;@4-Q^ld*3s)v584E)aMO7p+;}1gw-n-pb-tyw^sAiWKqph z3)q<6*M;^%lZM)i3=g5Ly$4g%)2Pjq(A!bK!tOR~8W_dAzHST-j);RfzpoQ*n(sl* zBQ>at7#W@r_mWa~yz#a|K{PCKuneSf>+Yw-K)@X*tn@Rm=WFXgVYPW)#nOi^({lhS8q@Zgi{ z@vhH&M{>OHf8)#W)?;620VR2{&Ml{+&LdB4!nv3K3V(U%DP_C8o$WaFEw8{)2k(u( zZZ@ltUTVE7{5jX)qhGxWx8D6AUVPA6eEGEFv81;v$sno9b^IsJ$32fcjnBXLUvT^@ z4o6F4-jH$+24WL>%xP>8;q^Q0fT2kLm_{>FUZEC{T zKJpeNuJ&0xq&`_RgSxRw_5EMoh9Cd-E}U@e5qRT29g+-540N0q$#r{j!&ZFgt5>SB z^znBdXGv?&YSfHZ##gVnQIf-^mXUr@73@U^?1AH6us;^e>lDw?o^eo0SUOC@{H+7S z_{i6;!m1Suar)a|sfv`@lJpdZ6IVY@sf?fBb|0?!-(+0{m|a!UtZ}zYX5ua+Bq0Py zAi*s-EN%-dK>`a|oCJ5*;LhUi?oI*(2~pxM->U9&-wXfj@T9yW*GLKxD9%BFR}tuXS%&!S!Fe@x&LKMJ$^FA zY&B5pK9N~r{1NKt=LkUn(#PNbvH%}^`Lir4MeV1iVCaC}IP!p9(4%{yIqC%x#C`L% zj>)KYb%HGBXW#vf*}pDwu!OIXiXJ6JIQ)QJ(Wh65?Sn`rW64D*e50XXQO}0Uz7m*5 zi+3imvozWK|4pT1Zf8*gzfZ)q;xdSa!)qooe2LF9$OM8hgB9r}{<6JpZgp`c!|Z&w z%zZ76#QT*Z*DpVuqwF`z?Gp-!1h66$KH>zth)rZTtT!k0x5Sf%;0)s%e2ch|_}RiY zv_?FRhe^3mkg+kSm5^MaA?!6~l;djDpkHq97fJ45$6PS;X z^Vstf8{>;HFhs#dmBAwHFZ;alDbAJ@+M3a95B2`Z0NfIDAB+~_D3?t~SBHL9Hk)!I zvNfEZ)Pcse3sG3V0{czg2k*T7E?V2$(9vFxT_){?ohR*q+itxMAAUItBS#Iwy|+Dp zii%BGuy{W5^7C}Qa%kX~G2=AXW6{ES>aXN|V*x@bR8CGdcAB^kmM!@mf6V(6*;zS~ zU2$JAzvyUd!j2R7#UFEjK|^B$YHMr7Ze(ZYpsb=?=iL#99fLpT&Btk{ory(@mdMJN zyJy4><8i^+$Kj|$4#x+deSvRg|D=0Ml|lEye5^08L3U0y+NH>7LPb>-YU-M?>(0Ai z;oLcR_2oA)X438$F=Q~7FPwwz_Lz*!A(POYmMcI=g&Z9|V_lM1QJNvegR^4ha^;{5 z*N)pHYqv?t87~e48>L6?QY{r=Zn`6oD?J&78B8EkC8J4BPL~9WjqPw+JogH!|wO%BX<0;-NllI(z0xb=`v|dsx5E3`P$BzI~x$H37Qwe8ONXjj) z`~FWTKiY9 z&NKuABmcMwfRB|QiUXmiE9^T5>B5m|vCFPC%z#&n3wzWR93gh{y|x&Rs(use#boXo z<-pD=+2>E_k>NGR*!M`#&OuidJocUjR3=40ad9pur)MBd(mHQ-P{C|v8t*NCp80lq zib?q>>r+F3f-tK?msm+R>l9EtL3dGxQ6#p!-9nQu^y%zB@$Z|TP;zq5 zMW^7HC7Fh_78q&`-m82;OtXx-y^G`eg=N!ME=BH35MkyJscrUv9 zc_s4yK4vm5Ir$*uW@p9GFPA0+`H?a30aZ+(KP5>?jvSP@u_CEhK)^f)Nkm3@xD$bX z_0ykl<_(XF694FdOXb{Ui9w`~P-ScdV3H(w2Ti*j3s$Vh#BGM*mD|r#)0?69-WTBa z^gnkzhgUwGrQwSoJTM)_1-UxN74Eud$=HO`uYDAMELn}+wj1F{9=*+5QC3-p`oml?S2IpO6i4qn(WYr@<0qrKx(@%k>R~Kdy%D?bFj9pT zzZR@mry_y=?Kho!EOyy$r23i^!h@W`15<5%Gfukve#~FC7GsAGz+3lTEUMFzzr=cp z-tS#F=F*v%yLdIW9YJ}Z6~vsuvub@g8e7^hVbl;6!4t*|F;q@+op>Jz3+H#fnu9x@ zep?9Lc3Tg|)yRAsu)ONt7x2g871(yfAZHM071@sJ z+6Jsxw^@nZzfU*-M^Bz;F~axr;uY(0=G715{8J9b!F!E2w$V|~05$RbZD3Lt)@`c7 z%@4kezgDcrz`i{&diVg%M_RsmBj*3LO84scL-)X8lXp~Xv>GbjoXG-Y-jY>#{Kb#N z9FH8!?BtrV4J+>)=pgON%9V9|Lf2 z&Osyff{eu(R8L?H)9~L5&n8iJ?}bJvx_mQR!YtH1^pII#6g%$8p!G+Y@_^IEvs=ng zSotUN3cI7Zr3F8H|1I{Mv@LeqbzkJ>cgO4>KgDnJ7s;UJnk#O`iWN&xQCViJaAvml z^RQuCp{TGBixuvmeH9HxBDp zF2vX!cSaeyBcuN)+2ylj??_5Qvzl@3J~By5;VGygZ6-O^S?U0R`P;R8~CM=Fu$n5I^zresJKqaG8g2v~rG`A-^h$Q}T*x((7g6(8Pw9jq<_O>Z{n$UzQ#ZH+yQrAc#@LWfK+L5MpqRQLR+wgbQoPOP7sHmyOd-q); z)P_My^>|kd%hr_PtQ()uJ)QmB^(tn=HBd4@4J6NC4&2%2%$qQ{Un$mYuG0J5bIB<- z2s0#Xo-}l{cZiYt_svg%}+$FnjY`1H{$G%JT|fc;S{a9;WN zN8C5#U)W{ats>bJgUkA|DonfiX|0==ZvT%MF(p=>*oEtQ>+_#+>yz(dr)`Gen>h>d z+|B1;!sx-KLG@q|bm0s>M_qC+)@`cP{mIMCa@3TvwN5<$!S{ILt*>;y@1JohCXOAd z!`;q2Ths4-^EdY2aY!C~m=x4$mJ&5ymI1M8_9&Jn{YCM_jJ2R$W< z=iK->9=`fa6>Fqsx$gPeWR9+W@Kt>E^L*Sr{Z#C4;PMHbrJb4+N?x#0=P7aza=91QALYU?5v!{X)ZamG~-;k;80#^L+! z7%^1VqhfC$nj1+dtE$08H$8!x+D1%0@c`^LVN~Rh#o$f1z&js*ONGbk`vAWpo}y0$b`6UH`|gR2L6JY=QeAHuj@;Y=hH)H6~5%_)15BTP@cX7ahM`G{Ehv4kLs!osHiA6yM7M(b8w-dp&nzmoq+oK8r*yDgLvgN zf-FWO({*avS;yh3%dWwuO`GuEryrxPu@PArl$NBRp{X6I=^O*lrd)@zs?Fu)=-015 ziV6zx)104CUfqJ;y?UanwFZNR4o7SLP}Jo0lQ4(P`b}yscbo6fpU8XMWd<0b@KB=b z&rijv+$T-t5t7-+9nC66mzu}-WGKirKu)O-os8J`CnNw}YF z%+k5Qngqtf=8-6$OQ`Uz$H9uWP)LXDKICdqe&`HM==;*=_Zdn2ZJ7`S20tJVt~S|H z>g%_}nHT{zp?^H;iHk?1&_igK$?Gy%R%EsBQhBjnKC!$wKUaH*U@RrylGd@esG|!l zEv-@i4qr$TEB0hlj*SknxWvS@XR-V#nx=vjMVfD6c-gJSWz<7r#Mfn2&*58p4M$D zQw3AntpJVm&hBhSR%WIK3~nkfSFjq~uMhGvGf-Yxjiy#gsmzvdP`}>jY;6K(FhU#&pP=D@?phBCwVz}ek_wn$npGA&Y z9OU@QZRcT7pYEcZx$#&vQkHe?BX8if&t_wv9minir6;2(&w6oq4Sat!oCm7ivbiYe z2JNmD;_*gKV}#rXI^iI)9+54SNEU25JMrtHm6|(p+j+;Ms-_-yzwpfhEt3EMAOJ~3 zK~#~ffp-`^*wdkaX}IVhDG5K#Uxwpm+>bMk*b`5``z=m5a1t&&`55LkJih#vD9{W5>KSeZ;t)Q-h8KjxGx9~LtAd9_J`RY z{5RJ(XXPwgvk^Ov9cGEF2PMf%Gzha9$6kD&T-l~iITWW|^Qi2WZ=QCX)`l7srMWb; zl85P0m(En8{?UWeQB;rt1AF6<%crPF2?PHqIXvac2laDL z-*6TR3vx~B<_8PIAp2$(Enkb%uXz-Q?y)^Cp?r;wbwXRZ@Wbza;q2=l$J00d8xyt} zY5~cU7p_$@hx?v!19to$8+gaXC(EDS5GZf<3yg~IFD?-_lg_y7dG%I3e9csJFR=B` zghNX`7Q+*7exZNvzVu(%ahu`hV$&7F!sY95`V|l2!cz~yVf#!Ff+W;7pln`z(F6a@ zPkz7?uYQUPru+kYP22{_gnpFt8>q%UH9qSLZ+Hw%O|7{7@+s)uqkHt(d4C>y_C0+6 z^8);5%3&BcYG^_~l5I+YAuMD*`|ellIdLqCifFqXH$Jcf$Cjb>ffzbx%&Q$zj`jPY zYl&>c3Oi~kpd%c3;of?trpIXmw)Gz-5AuoEo ze`|maEJ2{5y~GR>0C)0r3sln!hXN!VeCqQEhkal+LKgbBMoe9&Pj9w@XiM2<*zAd{ z_}>c?$xgg528khHTg& z6KW#(bfZdY!*+%3$ZS}R36mz{lXw4%4?g$+2Of4Jwx2K&ufOp;vJ1MSv|Aw#I^Y;A zU9lLA4Rukz7L-?2puM#Pn>TJkeM>u%QnJy74m8$QX)FQH*7Axf3>`WQ zk34ukI+C(6YMX6PT9|><%uMv3a3KC_%S9@C7h|1hkEKZ7OgTAkx1rqD@Z8>J^U$H}SpYu|+kRj}@>2 z-uAfW9BJ>n^xpSCTB^y-BoPWq8ejX?J!kI|&zso%ZoMo52NH54^-cJv4Sla>d|`JZ ze3k%es>j24>PTuU=~Dn#yaUp36f-X1J7}Jg%eO+iuN75YDl`gnGtsN4K>2P>W0OWS z$mf)M)Lm1#_6Z#D{!zWcB7-?~TdW;vbhFZc!X%LZIaz5)Pd1Bs8ZOxl(P9+Hs3_-j z74v*atX$1ttR4GtjY&yPV&ApVHFhT7^Hw9uL>GXou6G>hv%|B`N6 zu$6UGEF*7p@8!9T%mBh|@4gpIRJ<1P7+pnDLG<}Z=fhu8(&OSCiRm_H=1vV{N zdPsLb;o4==V2HU*@U-IC8})o&XhHEuT*J!!5_FCh18kA7@M&x7!V_e5mz|1FX3xW%MJw?dox8{s_~zxtxZuv`Fn7rs+&leb{Oig` zG#BNe8K=4^I{CmzN2|C`#HyncxBvHjJoEmyDtZR@DK#lx zLPKq66bnoo?-!A777S%owRrQMi;$Z|t#X1bUuc+i#NTg*o{MQElknT36*%*{$8i2X z55Q6T?uc8TdKYhh@e4kE^m6nqEf!tMpR~!?EI>MO^d(k+eE8s{=;n#K6|1(Mx!z{X zd>LP|=(_hp4C+%FF(53Y&$#w+OgVf{oOSd*KFHGbzCMwjg(&4%XW#e~Hk4Q4?U|Pv z)1u_M3*Y~?SjEY6x11vGpA6UwQ+7fQ}>d<_nbFO|^*YU`W=crjc-UsCcf(n8zeDl+M-1FqyIQNu8vByr^ z*s;--gzEZwoH^ruY(1<$&OhyN$t@#820bZrN@EccP`*SNQ#j=Ph>vVrZAj#n?lK|i zjnFb7Z~SzIYBK29H0)sc8Ud5GXFSogWY&{d&skN>MCf^9BI`+s9j`7v2+4LxI_v@3 zAs!IXEoEI>GPZwD`9nby2TKC-8k()+9FQj@F0Zxs^y_hS-hLuv?|*-<#6Kr2Jpbz; zJ5gd2t%faM!x#_yyQqlpxgjbdUH&1~#DkF~7{U0#?xQia;hx1mbM)E6?G4PGBgOX4 z_8CHtvh1uwt>wc_9e;{g5xQV;Ag{?a;$|4U2FYpEW9EZTm6zE$#=U!1i)yCt6w>v1avBG*qm`#_}30U9nOQnKZ?y zZ>mRQTRZAon#FMQp=W1h3gF;ZVL^csZ^kaNBHUAz)ish;*`V1Z)KykWoxz?|fs378 zC@3gIj1Q5+O4G7XSdfP-4({t{mE397+Km{x)hPV({kK?GQHk7w?ie%2Pvb~AcrSIcNhUI%9>=->CPw-VhX-QhViWeHT_~Z87{BvMB z1N#!z@c*CP5oV_7^>m&Qxet@mMd}ENH&&R1v`JFMcql*OM0hg*Va_On70UBOJXy38 z2or@0JF`qu>V_}8|7>s<*lTQ~VISdItuG=lkAb`id)w}bv;2C-(WchD4l-c=b$CsF zGCIJ9t{YyXDMM|&Fz+hK&qgtabjMo7u;peg!s6M!C$k`z?`349TK?y;kf4AX)akC~ES?Pz zw}LL|^TnHE8!D=_0oQLV*Fx#hqX=~kEvTtzKxy}Eq=OqUAGHleMUEQU8%tJ~A%$}Z zVjU>$(L=g?QmAyS%FoZorm_lTrlue*jepmS($Zof6|Id;XlZFi&+dhq!pS0sC=6vU z)URnyNM@QGg6JA!XuZ*BJltck4h_{&bFph@MW1@(YM`%`9J&Ttl$E<4#4Bg64}0*T z`A!ZtDq8FiunN`aCNz4O8oke8F~HiugtTD&$&ur9dsS*+ezA%FAf|2h=^*nJ08o%}p&HdWxV`(74< zu*ddWYdX8hU5xhQ0@W04uQ;Ox8&HerP__oc;Nc#0hl&xw9nALu4@osAyQ7O8=7s>X z@Hqam`!V&%y>Zb=2T8|HInwa@Y1y%%GB zSv98J_Fuew>ooO_5RGPFDX(e3uBTp$sYmZ4hJ=YbpY7ZCUZh?Nlc98?zP=TwUH_Pp z`Zw;rK#fn_w_I^dtAee@@sRS!rpJbV>oNt1Bu%K6+@n3J|$rM2CSTi?4q^8&^H>DsKJH zarnpHJNka=!tGDLk7wWe2G87hHpUF^9|cnt^e#u?Jz?;E^wrOC_wyfM*0VQArp36+ zXZGE%i^TlAc-u7WGKTJa+X|u_qzn=5|)H9oC~K&mHaU zxaf{&BrSX7nlsQXpYl)B!_twDh3jQAU&hvh`{2IIPDO4`w)H{8fIpY6#!1s>;^HZX zNP?BZqBQ^vF8|{jE?Thx7u@s&4%%xxPCsV9EjDaO*exZ9VeR?~oOi>cIB<^%IO)i} zketi}DFt&EFUQq)JtukAj^jp}9@|eL79CMDsUwY6{1X-QVV2$`85j?~pC;OSYqN@$ zDBF!6N@gNqp`bHn=&Cuggogfre)~ZwOeQoZTXFAVC<`Z{D0UXcUeDrTc>AaTaRfJ# zdikA;OR?gKOt=@?v-AVfK}&|gdXcuE`E|%AN~Xf$?mlUej>A51BnQ)n48{{7k+&xo zB~%eY>$bsBuUuk*6)&2?VhAx-uNK%H$3P9h@n&6pHcvDX`bcO&Ew;)N7NWG#muG6Z^3LC071E2 zd|mra)1H!iN`o%LWU!F-*glhAfT~AnGiCBdS7q@wK zFj8@5i?cFZm%U;t*PJ(ri_vj8JwI@~x6F$Zk8R3_+~kCbwPFhkIyTXFaj2fnkfXGp zd1+E=653j=AZ%^#6003|6tsJ6mt*%Nm{COHQ7`Q69@_JfLc}W<^&Zc0mHy*{Ok+Jqz=YlbMEAO|m!VT1v-@b8}Eq zSfHGY`B6c21%*OXln05WmOfnVZ&uwI@VV; zBG%EVYDG=qDKSk@Oizj-Kfgd4`=-V^j2PTc)Xj?3>yVk5jlR7~uyFZWB^o)|8EQ^v z)kC_cd$&TQ#gb84l#Q0IWNfTpps;}_rNxElXlq4BN2|QD`2;DwBBD)!BDJ0^tu5yG z*6={SCW|RLdvU=s=#k0LLU9%%G&gI(IRaVR&?IN1+?)&)WMwO%;)Ynd zb`y@Bey_fFG_8QoJW}^bzv#OEuqZT$$Sd+-TWX07*R~BfvZixy{|s7W9a8@JeAipW zo3KfY_*1cQ%Tw>Dhv5DDF2&&9C1{VCYt<1K+%4JE1t%S3y#Pkg>AHD8{(Z~S`0>vr znDxvJdZrUjyj;mR3obrSUhgZP{fMg{d>yl&zg`sJr88f`oCVAA?#xS2%-#seRcZg* zjMG^3ELn{)!}>=B%%;j(uvwc6eA2eV)!5y;w9pPnNAGw;=;n6eozF`$_sx^nASaV7 zR+9P}&c5kM+;ZOWIBbs{;=$fgDY6Ei&iWHKKJm5~1Ts*A`u4!S6UShW?MI@dC||NW zZbCy84FzdwZO4;ueT669{L*O2v{Z~9(ieO0GzOE#4ntu<4stWIG?iEDENDvq*XaD$ z>Ww)3{5vuAsJ$`mg#BemK#ONK;j@3_-I*7QY2%j#Nqg_3FTNKW%B%6|!a2|$V{;~ikUGWfJxb<8WAc4(c@Z!FC@0;In`F$_rim8X=gadYV>edou zqOxKK68e+)-1%J3zwH^ViJ|>_O6JDv+FVg9J8ViHcjSJ&@I;%5;|MKd#oQ&Ual$3{ z;gTtb;K<242`x3o${L4lrcDg9{#cA_XTF5+LSvv3&WIOh8 z;z?>)Z*e_$y!e*J+4qjE>~I`&otkJN(W=`n#|}L?S$V<}A&1To*jkDYK@5j^kZD=T z6_|twRq?7R-kT960g0JZ(6{UF{y!UH$wY!xaKbrZRhem^Bb3@vY|CXr^SULCPSBf! znBFc*S0YR_^z&F65Q?gRzQz%2&tc-9O)`{(hTa5p)}COnB@R0Hc#jd!2}zSF{16jv z1)63sgnm0pFkFff3LvdH#<#9k?7dYn(rQ;?=%Ata^@mS!*|oP|##Ogq+ik~S)yhSv zZ)(Sw(c{ps|1d0H`lph_L4!uh(zdOw4K+0tnDg^DsIIQUiq&iI`yYRZMX7JBLuPgs za&t0KR$i`nmyw-|l(cMg#5fh)TqxNyI(+C5$;C^%cQ+H46rj1W4q54BB!SHp6`JG0 zb=j?mplcmcQqu)E3B2g&KwWLMu6yO`HQ2a$vnGpEE;*=QUvG}@LVbNRkdzLjq-&6J zS@{N(^d5+Qy-LwoxdBB3hG9eZ9n^OrATtbE)jc%8hA1?Z96SfL3xb!6=LlR-win|P z$-suvk*rgiAXhYmq*?pgl3rQfdqEbSzlu|>XU~QbD9HdE1T{nacWljZT`1{x$rpQf ztpJH9N(r#q`nKslKHH zbW0^@o}ZP0Ufl|G&+2$iHnT;*+^F~unY{EgYkeTN&w_*n4JB1#HYKk#){}k9p>IXj z+wA|)*bD<(2y!ZB=wq?Z49M1q0*mWGtrH5aqz69uIhK@~hQho|WM^mUVR7CD{)Y&+ zbQopBM^c!Zh0=n2Ar(BF9LIaygs4!DT8aJhh}A7e1#1*+5E z1Gi9mMOE`O=jK$vl%<$a%$)eB;2N<5p$PF`l`hQ>H*fe1#R%^&JN%ixt{nITqUt8)&wq9^k1lbS0uCT|i~tRr#k{u3qNiJ-@TMtIY!+yxvdG`+Z0-=Xpj$Vrml3oE9>VQ+__7P*TH zL*ihEv;`Ixiw91-9fNw8;Kf^~xw`^CZwF5KpT3^6PF}t9e9bfwvf_s`nT-R^xm8H~ z2lr3cL3_hvZ%9)1#$6YnclRPS8cx0O30b{9ef?R;Nl(Mfmp;McZ+?k)?!5?un8>M# zvkNs1)`UK9=~_&lG)4=a2N(;rvdUT|-o3gP;Mn~q;kf-KMyROmkr-I0P&RhZuH$gk znMc}yDL}t_P zG5g?vUB;PaG6W`1_SThEVezU>`2N>L_<7z^tXy9vrfKWJeR0K^M_}~Oe(DpFXSp9t zcRl+)Ui#=qynfgD7(urwPY%ekoq65kc=W2%vEQU^BBv`uVd4eImycbk`>vwF;c>0X zB;e--%W>l64@hQp@hJy;-~&#%@*y?TfBx8&DnOzT>DLi-!E|-`a`pl_e7$w=MN0m; zhIxR0@$-EA^YRCA!AS?I2S*Mmon6>aUV|V0_zQCuuE5B_eeldp|CXsln7^XJ#v3u? z42A7&I&)3C*||v`t+IDZuBsm zKjko_r6&vB{OZTKxc{klao5#nVqo7=PuR))bmEFT{)=TRH$;U^kd96{Zh!2z$N0GR z{%;ARZi)E{n?p+Y^5V&Q-VACpDXIOOth60@6p<+!-%(W8MhkIvbWtJHe>WiX>J5>f zy~%(b@N*&~-UuC7*f0Rh5LmK%iL8Sq6;YG6=``%`Joeg0j?cA-7zZy7tdq_Qs{|YF zP_TpoBqU8b8;s70bm`Jzv+uyt-BrfeAKUvTRr6^CE=7yWJPfIpMW(YU zy7GiVk$)x#z=mZjnw${|W&?b0Pn4s3;!lvkXiicq#^%;zSV=lcd-TPxKYoO|#wLs! zwRD%PWwc zo+;L${~)@_rO8dMsGtDd3XAkJgw5F>$T>@mjm;=5%+s(yN>IwmDo~i4hmQ7Eq^6}| z$+G1bHf$(XuU{|3xo^*2sHm<{KWbraF523gv>FNc5qai(pg$KaMr~s&`t{_*_6{^R zHfqpeL1Cc`dFpDKkd%^&4V%i)nU*W|yeKOP1GgTH&Oy6ibE_Gxun|3$#G!x&vdFYX z4tQOPLCghcSIYRO_@!aIK?!2Bg+iZ(`ai`=*&4BR6Hea1C~9=NGb#ZZ4BgMcjyVjY z3^G|OFfFIB9pKAX_bXWa5;ZgSBMgkSpN(8NU4A7A_}_al=tO zpb@CzKug?BFDAsE0~hl$(`=|C%|2S%)aS!5{v9PnrdlF^#@vPSYM+_peOoFzBH$&& zg@F6|JG#?fG>9-Xzbm!|CfgWDyKl~tgfS7`BNG8lvQB5=={acx*!X8xFNd)WNpwx4 zQI6-l1RBU*grcl~g&5j9xYnFvcjXXsYvwvMcM2z^sb?rHGzAfRO4uVpmo8g3p}+!?ZhPaq zSf5@!(9zM3w$>J;rlzB!s#X`vK9G#GbYx{^prxq^d0Cn0)3ZBrGE&gDkdrmj(cBTk zhRx-Yl(ct3sBB@kLR8e&qqe?5MM}StLVZZ{+U^pSS&);99>r|DWb5&m9q7M2&whKEllcc)4GkCPjlA7c28?-zO?m1 z#K6#ofPq;BZhO!+8!Ndr8!B<@Q*YzTpXZAKntIe^%>wDhre9U?M#Bky*8_5PCAdr_ zG?6jrFyJp;y&iWw^B&&&_BRY4&{O>$w0o6&%8Q18+=b#m@8wpAx9hqQy0sQJ;!ykpuF=`@>l#kG}B*p1$@heJ0*8`oQxUKKtIcxb>-baM#5r zkHSCp9FMBHM(j4_TAX*{{y62( z-GvBo=EaQrUdGJnCu5%-w~0`}n)*hZe%<4!tZfsYar^)PAOJ~3K~%s8_g#vN%yf4J zvZSJ-x=wRKUib1i zWmOzjD-XHAfPC@Dl_)CAv9+w`R3GA$1ibt89GrjWbGYu`N8_Y}cJ|Mkgv(~WBC~_{ zADE7<2J{O2vB@uV&{#skgYmidzsIHbzKGe+UN32xWEq{E>Mc3;(wW*9QS-T&jV`fP zhwQ!`{`HSNbxi@q3W=@N=q9_=BxnEPvzvOu6Ds;?<4m&v$G3HWH8!>4)+gV=3m^X= zgM@$VwY{ZvG2o9SR)EYn{U11T-<_-h(=8$;BXMN$_eHBP&0Yd(yTz*Hhv6bv|(0@n0CcgGa!+mjkUt;7f#h~+l+!G+BeDDIy&x==5=&ODL2*GL$~KpwqrF8SW@?7@o(>u`2y54@!T9aB#iorL z1WZ;{l%b-s5*b+;=-p=^a`TEb9bGJFTZ@JsFJ8JBWo4Df&dI`{0RxnCG}PCkGnS0? z<<*jVl@#V;*x-JstErS^oCV5;jT=z5xk3Qi@Zlq{uDk~8)@?*q3NT>UF!Y^pAm%q^ zx*(Fz*rY0qp#nlYrV<>ofp50XnDi;`c81w3&cLZ~G5I(XX#+}4)@NUFr_X@M+sq=1 z{}I(gk4SY)+o+}$TNiKK4W!LYpXLwc8w;{WFJH-ax>DADXN7`y3JbQTILl~=1-P{ zQGkU{pIlWD;&j6@ESHDbSZ%dlpFWNk}cStG0=Rm1dQErZk zfEM;W>3;HF0GXO#o`USmRH>DiCsC>?7L}!xvGu_<8927g1*Qe`!Q(ZO}2bWB4 zY%CvnRD$#D*Of9sa>N*t?s$7vEG;F5%$x$D4Bd+gg!I?9wWwk#Eh>`KfEzU}r3>Rm z4#vQe0;KbWQ6W-(7Dl(chbBb|cY`4UgQ`IX$V`jmFV4bzUp_9F)?`Ld&s zs0IfxnoC9K6$l464;eZ-v9b7$XW!Fj+-Jwpaycr<&5^rRMBjUau+Qbqfjro}a^}y4 z0gRN+F<1n;F3bhsCo(pV&Ro<>+QtZI7wH#LwZ^%UAusnKK>CmJ@J<2Y|xsRKTpm6!ROzO9kw2ftIs?f?|kzcu72n> z{P4_mDolC!bI{`nGakSZdymJ}Q;*a_CgQ-)GUb{_QB~W34ED#Pl_jY}L+Uc5Gh#{{0KbaU>9q+dNNX)$CWa)=P5*iU2 zKFm!4-?h}-Z0jqkF?s4uIAWg(xazE<)Zi8AZ+zVu1?y}Vt!3Lg@a>#MIQzyYaR22~ zu>UUGYTr@r_Wb+b$^QAYBlghj56!r7^oH;I!MDFlHb(p2@uLQNz$en)p&k%6Yk&IC zWhlz$ki!(Dq&ddy?v8xzmp_>;tKQK=dq;)OyI=o?b8mYFH=c8h`eV5EEh+VafEPhY zR9gq8-SLcUf#HD1>`muj;x@yTh5kHmInKT1DQq>MxBi~} zGk#XseRAZBQh|{CM)#hR)!RF8+O>~rM#md>o{!>!99t8P%yRv%Tw8_%&$~k|VJvQm z7;)bQ2IR8S|A8YW?_{i*)5$ENt$`BQTvm(IF25iBdY9ndtIjYqFDlSI4RnhA_l3)G z`pB4RM)Mt6Ansq!m|7$fH8K+@MrBe zjW~{L&~-$*eP_IQiL(gCV8xU8cu}xrfna|hoU-CAsZy@HC00B(S+Zf$2s`Zl{-vMw zz6vodZct!=l54x8##fg{1@x0{tO*W1QDGDnGM?VM+&5x56POS=&seS(0a;2I;yHz1 zvE9^=sKqqv!i)RA3Fj1Pg9%NzeO6vrg5a#-wcgL{UW%N$PBd1D*J+5nU1q zy2kms(7&l(@ih@KQJ$2@HOoP<&>YNtMAgGKeey9Xc{%zF8IAA0`Up=y^BT_m&!ysX6l2}G%~-Z-1KxW3Ra911qR)UnXl!dlOKT_U>Y9{r=H?Y(zx^g7H@66@*Q~|r zHLIo07&deWmabZb_E{2ph}Fq{_(6FF=p(J&>2rru9@bH&aI5j<)t@-LEbp z%h?&S;_cO=6a@u&XlklQO>Ld*dnwsUPfJI0Ljx*m8!_>~W6(T&FMUSIbN|;Dsbo1d zRnn{mCW|pU7np>L+3*3hj9+rX<9N%&I17UNkdN=s;25#AW2}-$%+?)8`+zKUKbs(7xNs3q^j#n`DgVHOD zb9Vm>GqCd~SRBU-ka&-p${6qK2>Vy0pfesO9Pu6=FM4!qEU`)eEbPxw+2t`f${XC! zhv%f_arW#uFU$ZElh1L^3wyA`NCNI%<}zF_bf(H>O9PEu+B@_bycZd1Nytu16B9zK zUG`ox#}F9q!)y(RusdTeq-HEar4;i!78GoN=f6!o6Lcbh2Zp~RjfrfCbe?MFvH z7Oe|h9|C>ihtko6bAP#)jSb< zb}>}dG~kf)?v#z&#}8d<#R4sf8=EoZ8gs$==;6z?0k|ueP=>9%c4LKp_mJJU$JJAh zkWP_-{H-s3!e#frVp`Fx3=7B!1&Gb5;9<~(FCM!RJ&UQGOwvKcIWN16+X~}G4m76B zlQN;BOvpPrG2z53F=6x&%$)Hrxuwz4_Tg7P#c>BrLcgBfBbT`}4b`Hgumg)%Y`{U& zZo`e!j>8EDOj0pUR^`}B?vqIYr=;^|BVgCpHH(zW+Ilfax1M*riY0y#(K_nldsTpZ z%mO4Y8+<<&AmM96c`Xi}b~{SC8l#->N~7|Goa-$j(Z2$xN_} zv_Mo|U5`D^xB)wi8iL2KJRO?hJ>iQ1t2UHj|7o{l zj~%wgZRek$wZvHT$C5S9fEYz+dkKFoT7}!DpNg%9_7&sDB!aQyntPtdUn|z(+VfAsFiPkA#z(fc z=n}AV<9#n{80&*KovY_(P1tccg5KAgv@Mw1VQGnmyG$hlOMZfcY~CM3vq*tsN0 z2VAfrw<3`HM7Yk|?-twQs0wk<4ee}>+@A8ZAcZQ4whQrwi2SGyo zu^h@`tR>R%7|lYD-wQ}&_}Tc$9=Gn*J#hO)_3!75r*;0(5~_!U^C`Tx6)DcoxMWO!a)(AQ1@)VO)lQs5YWLI~h{Amf z0~>uED^c+G2}Kg0xlCkyE=gcJQIt&}Z#S9U8=9J%WGlMs#2rymT8brqEyMEVOHjUf9fl1ZCaw9aPq>|G+~$M0wThP?bD^zT1N4e+yn_yz;}_C#)8 zAqso+#G?6g(biC{_)}HajOFVqk-fuV7(ITH`e6ym7G0Un z0&U5%q%Wd7D94I;Neh~i+*!(P44r*NBMBl`HTL!RJfPt3kpMdIr5L02`#!icSiDAd zx{+nS6-pL2?fq1%CiIqBzG1~p0Q)0JVgO0Ch(lE#Vu9^Bei9Z7EGW39h|;qSfb#e9 z+9ou%w!13EES5DmFO6p^8Kfl5H=#7#oFQFSBo&THq{u>ZHb$Ep0dP0P0a`2S`R9;x zDP>eh4auKLM8j^j_!kk1kwnf|=g@*0M5YPnNt_h&{w>bK@&YA+4U*ebvZ)R-G*gS< zad656D7@l*kkJgEKV?vEctWSvEEXVSMp{}mw~skEdqZ-wGt6q2bch$8yzjg=#sr>^ zTx0f`47j4)ocESavn--HN`d*6x$oIEs)*LYh^g44VGR{iG=gYuYZp7id@1RLUsl9K zm2`Hgsf$Gj=Ydo=Hlw4Z3As6iD9TMkMsg>*PPj{25# z!-_TQv9YcRIR$yBsc%59;u4^_NgutjsSyKu_rUOerKsh!b4rTn8O~y)z7fqW+#Jbj zp6CwaGn8HhDo?sYhURyh9Bt4u}Y_Il8F{AAa{6Ui|QT*}9U=*>~bt{9~{2 z7{~sQj0_D$k;hcql1guzFCTm-=H}_sPMc(C{$#K?=PpU8D^}EkUE@wqpMTC`WH{dtSsRKhDMM=WdYaIyYWJQ!A!i{iqIt4<5W!R<4T0 zot79fd4KZFuQjmonzN3;ar^JAq@Fg?XWsCHdM{qN<2>YM+1v^XG9ip6X5;!>0NHumR?&PKCf(=W`ZQ+GTZX5uI}^KZJJM)bzb<*Ivo>%azYy?w zU6g#Bc;&-#jC=d;^U>W>U)e8p#YhF+MzgN zpPdw-NoTT1=RY>0#2VB{pv$4ei)_>t5*DFc-ZB zjm4~Q-;-(0+VU2>{n1y*%*{l4UJlyZ+U2^FlAeW^Na3>^N~Eva<6P?dQ~i)=-1)-Fjfh-FHVr3umZMM%96ouLj^4aj- z#vsw$!eWK)3*}_q*sazBzvlwYIg^8IP^wKbPft&kl#r|u2Ojgk^DWjLnIwfvxt<7R53bHaWbZ~#PwYMNA zBNYW18K~hx=xj#@9SAbBQPlL(2_bjk(`!{ z&DHg?L8A>PZw!MXJ%d%jlKDtU@~PvNDDuWrXRX0|TC@qxTB5~FKqO6?C)>e}*G$}9 zQXs0x5Jlb;{=t+M@k5iFF)J%mNheVdIZtUng@e*6JU(dmjzWKFAB z(qf#Re!@Y!p=Y-|&;s`HH$GQV&S~P?Z9NzloqPy}^e#nu28*qbJFv<%yF(TrYD{)I zHWUurB$hfkCFcdY$wurS%Cn@ol%t6u9I}a{6M`(OoHcP-L!`PFdXbD@7cR#U7vGI@ zkKGUFop68>exaYirQBbyzM%;h-}3@K{QeJo@%WV((7RMqsgJ#6rW~T4yyh%xqS6VS ztjV1JzWGV@Pp|;{{P8Q$r=&P)-fZn?SC7GskH3w#?zsS?hV<1naPhMMS+-^q{&V~R zp3Ga(xMp)XzW@C%S^cty=JBgf*T6>J)Q`UZU9&GvKVmOTJASewut8hyibpY8opOR& zv~sUNA1rU zryhor582IZn>|P~A^GyBc~Jqv>F-MT9l@`tX~03}-YUnix9+|O-3#cn6;ee@oF%QY z$x9K^#2%0nu6hJ4&dxbzA4x9)rB7+yx4->`WotKMX#XB~?8?(IpjWY@I5GVG*D4%+ z(Y@Gb;uwq@F*stPg6(Cm(jrV4GhDHzsl5%KefK*ac@6+Zd)H&j;F zVbbeWsHa z8g?tFY3F;JF-nkJSq{e`s`iw^by-moT4>`AM@;06$91&Hf1mv>0?$;9M(L#kYy{r| z;~#$yJKw_OcMkLog^k%bC#m<1#kV;yi7jMLf#z+ciNRLl>#V9Vb7olLVm75*i4E-h zep;*@2kkHrMP;+mbI5l1Zq9ss`PElgvV18zQh@yYY~*KUW5mdD$ji;gvNdZ^+1#oI z_3cKD!p_@`mJ4D{MGc<%??dR>uOITW(@ryaer-RXN$Oy%z)-Iqu zmV}DtHZ=OYo{n}Vz6N%*@%t+N!|*pJF9oY}H`#g#sf*2Eu(V%$&U=1Bkt<-)*I@u- z&7{Hh4V#ID{Uoe0SNepFqR(c1wh~~Q-GO3`8DCh@Ycri}Pg+K=)uW%YY4^%aoUI9{ zzxH>88rXkRx|5%tijo3aB`2eywF|Y)?PzIc4-y#?+YgKbWY7t~5optNhRBNB-pfKP zft7I2ET&i=NfO#)1h)NBg#ZL#!-twh6XES!2I@H6(?zh{--P!ik!cELNuqg$XK1=+ z-WQ_~A~sq1yw{G_kZ-Ys&x?4NnGSHy6RpgBCI{WXQj;|#Tn+gd>B!2U`lC}!8;e3p z*6Es+otBJjwmhUIAvqOj?Idetz`uqC%KX3qdGE<=YU@B%LzA3Miwp8Fu%r;(a&r_P z`IA!Ngy`VXWwK3F7Etb1+uVlDHI1mQZPM6^q+8$qDK@Y;3)_z9kG75&=C3Hj>dkf1 zgLP*Tm7bxg$=&j@Fm7013@RtkeAadsjzPqfNJB*GdA2eo-;0otnVDNQSVFtT2&7klb?Y$7%j`Eb|2zer;Hi(X2 z`rR&S-_i^{_oOQPIiPtA8Z16u|8zEhO2Pg+Z;Nw|pN#%JOXTQ7 zB#Oyf7*fN-$cEO%DRq6{lSNDDEO=PSVirOG03ZNKL_t(Q2nZtwtoh~+w7bv^a|2Td z&}DFl&J*>ZNI3^>GoY)JP%g?g4nMOMROoHM`X|OqhxFlj{Ykjcum&3FWxduh+05KEUAen za!j;7n>8QP?|l(ZUpG~KPu%!CoGYs8@yHvW;gyePOX_6Flm$OB73UncKZ^2l6o@=_ zDWI)bw+S;}_!wXRvcR2cEO%xBN~HdzgLg4@C>dBu2IkWHaroZjaoK5yx!ldxT4c5C zi7tzPldpV8fB)3=XK9uW*XubqJ%ulSny>W~Xi*jkbfhBF#(#QrFA%!qX-SkcX(5Dn99=0b&kDvrK zO;KK{E0X~>39EbCX9O$e1S`};du+RsNVeq@!|f=rXBZ?BuDS7p$`5&_3_Q5l{Oofb z^t+)!I>rKoNMeUO#TdIG*Bv3J5uP3uEm3Q=d;KdkIFcXaSHjcPS7b$1TvBGpOEk;F z9~2Qs%b6(6v!W*v0}2I-JqOc73%gV>i};D?u?M+Wggl1tBsgNRmn=B5h1XD=@S=g| zl8)L0RwhiYj=!g`Pd_(8Y7+Vg!^g8!&hAINOtCc-;&ph=cCVa~cUgo@Ko6{o%TWDn z((mcEhVsgHu{)w!niwoxjVNWE=`7K{6C+)Y*2len5IpKQ;KI?R~wEP zKNv;TbFpN73to8r71TC0psuk2sTo-qv&}e+7(N13)itPTjv+lW3+q-c#<~?tF|coc zOx|lR?6&J(c=gSfKoBY;)`->17h?I!m9k9jR#b}H?|2Fye)=vNo9pq`tIuQQ@+Ig> zO2dW?m1u5h$H505j3*v_9L+8Dc>aYKarM7nncwBVBc_^=}Kz&0q zrks4bq~I#PQ(`#ih=Z}$zI!7tCm-|YEx^-HJ%zgJTIC=+@4Gwt4jzWSy?diy_X0fi z*h8pquE(yEc0>Q6!^FnsXJw(C0}&e=FrZ&g%>Cn6fi`9Bg&4i>u}IFz*Kj#DxHqvM zu!Fss%!$}2Yr5glj;O1dqV#O`v-!Y(xmMcr2?B7?dK3T{NG&ZnMp|~$Vx+T zUWP1Vo7=i1pE9fVAX&8-!Ru{m??5w?Td5mD47K~fE0z_ke$zn@FA5S3PojB5UR;Et zO?zHb=YuN7% zE$G{`7+EQ79?O?KU0F>dlG9Q#pmzz9y4pQ)PZbhdQQLr$f_z8#e6m5TIsKLs5cj3yTh0*i4A|xG9g2Mv}=$hXqm|qAUW^ zeYOY_4(p*Xi4)&P{VyHHeDJkc@W@x2ls2a?2YoW-T6~}iTtOS@7&Wi2z7gNfnJ&UWJXUDA4oo>|P}gVFprHs>Jn?;aKgbA0nT}WcL6;X0P}?iEz~w>_<|ufa zA(|W7)YK4W5ScbEkzYeG{PlK>VV;m}vv$LH1=1MNxKFvdnH zvq^2!#CSF!sXs+>54+d=oK^LWLjJjUZm8nJ zZ4#;LY;KdRC)XXNc-ho?(l9`ldMW8h&q&d%5f-|E?Fe+fp(>6yd-W};pJZ)xZR*0Z zHJi1Lxkq}H6ryjBVx!?hw(IOnpdA^2DA`jXkdOlgM2G9AqOL*Df(f|Rsuy#PM|mUDx1;D%nxWHf^FSpFev8_}*sM$e>9V6mxp1tZC4YrhxJW`6cgdp$1CY z=TIRfTATmxlD&9YWu0OW-ToNo_*tF#_C*$~Z9{{!-A^5OoJ?C=kBX`~6(@YJBFe|a zYPt=k>ujyjFEkUFWo|fF1KJi6_5irpnIByG9OV-NN4CNa=qO(Kd)nI=+^G2g0bxsU zI^p|pUC~;&rOk$@DG3d;Q@lAb9L~Y8EHJoo6ZAe2yP1ZKxw^;>U)LR5f@LnV(Y8^K zffwD5jF_X7YqLWug9892AG3oxOj?enl1J=@p@`9E4up?`Jk*EFWh;t=an>cULWcA? z>+F&;X|z4rvA`2YGL8MSO%RwBC57%Xr4{E%P?$U58GTf2=xId^Ok9&~%#tlZiJ-i& zGjui-sG(qSOI6)3Tb+!r`aRje)5XmsC}Q(c7zYi8<=Mf#L*!V-B{Cl|9)v#{S;`Uw z>S)GM6NcfF=kCC-i&vqky%p)1xu|Vu!I4KDgH4+@W5}Q(7&m$>a&mI;>TAzp-u!v! z-n|%24RshjatwB!xGO&U`cw4mUW`Qxe!(xl%(gwBl#F$2D)9MdzaZ9CkG1PoV#*m) zv0+0QYHAv#y5QF?JMV})ZoLkxSFggK^A_X5N1jAxUM?ystEIkZ|DSy7x@)H+H!lM% zZ7oPn$;7QU-Gi#i8oQUt$=H3r-LcDVJE0&uLmK+WpLiC3{I*a@|9}yLvEM-lVXI+- z(AC<4TW`7@6;)LjK58fqI{0AZjcZU=UXR9}+hNE~ z`yxHL3waqf2dk#l(0ATrEAmYe#~B;K{Je-%;>zVC*EEkZUdSg}bVqDQqTO%E0Cf0z zvK)$E&2X^wAEBAfq-ftM##=GOcU6OOaBzw;k1&(S`XYl$A}mIe2FBT3OW57!+c!vX zS+rrsNl0S@dU~?lS1FY5knzV74y(mieC6XbErRXDrcnlRVdZN46LyYG8@&HGd(0I2!sX zcGZdmy^(TP@7Zw3oxNLpc9faX*uV;qbQL3p&s^peWQu~!jZ%NDCz-RD zgBWiUSvnTRnx{fmL}oBNSqb(gqck@S{Yr|Et}}+9eX=a1)q~v8rS;#`+J*AECe*fc zAeNFQJN<^H78OKEPk*x@#zeoasTEmSStz1jJS7Q>SC^xEeg--_NcY6VUgV^7fcRix zL4lB{{M;NgH?^uzpwkN-q3J}R>E|7t3OH>3;sw)QkJHfy^y{O|RaQ|e2?ZOdm?~Ij zeyS2t76z=sIK?ppQZ+Scwg)R)vw~C86r0GYk#uH2&5cff5yjyb6G;9&6CM6{pqZ2q zv#GAFU7IdFBTb1L{~Urh3mm=<9||i;2Dq@vxv2Pe+!j(hCfP)6B{oEme7(r>mYbU! zjg_p+pOj~a?lxv5LLQxgvETQ_-Qlu_@I43kOgdpjPv|*USWp3CN2&RvS>sqh9`w>| zg!T(Hdfi1^A!$&R;mx9QHwqN1OGTn0KfFi)9fPxkRsMDqh6XolkP69}0hNXV=382m*x20vbf_hNkIIU0q%I)~#D%W`%vuZOwb_Pwu9|x##@n|94n>?X@!jQ4ptR zq0w=4t*S$QT@|Qw?-^Ssg@|ZGs*@QF%Ai|%{$-#~Bnb(tC$(l$1S3#REq7JRf(cBJ z{aiwL?2IyrX!&ofBerZcB#}oYENumEs}jX2pU44pDh=77(rC9pY|AFFL*r$`q(8tb?O0X+l}pY*H3wdKVbzbMo5PXEQ^9Z|m{PS<&QL*;RJxKz z)LJ1(WSmMaEp$u;e?p$xDpIqf46~~px;gE0osqK1FcVMxY*K5oROv9->nZ@iiLt8$pt?AEdZR{KL*YKil~%Z#F9+1x>@rl@jah%w>Q;<+ex zR6*BcpiH}{syM?DzbEz1c00T_;$_iQ@VxiEkbl|xR zsHKPjD_m%LMUcwCv?>;Yz;bQ*Rn3gx`SS??PS)4H9Bt1%5O>^kU33o&#PJhTvFq&f zNN3u%aV*9L`(pFPZLw?Tp7`PIH^#UBXX8aL z+!r7Hr)y*XBl}}zIpXNy6Y&dgdV75MPd^;b9eN@jef**L^yj`B|L@H|ivFR&=;*4& z+{|oj93GA%P&wZDsqR+k3G6ROmkSpu0&~H`;Mbop*G!20JyA+3GEacdqXGbb(_9wJ$2Kz`d(~J+2 zLD;W{cuD_b{KFY-00~#4zO+n~U0{Y)D)YS9rZNfeEV*KhXt1mf$QZx07pfp-98*}L zLWDuzOS`4SNA5zliATm@b&6pKf6z7c*cCR7ga4NAHT{aBC!Ok?cc=LywsEHAXY~Uy zIA+Fio}Sr665d#g&UQ%ds%nn}gcVToapfb>x2o#BKquJ!dJ}#?l^m&LC5?79hPvBh z+lF<~(+)LN$nruC7|Egh17h06rPY|6UyQlNO0@C%Qs@E`sPYfj-?g@T$C>fW^W$_j zX!IFbHx&0h@=WaAxrrNPa`HrsjjW5Q@uM*^G{D&)6Eib$!P#dRmtNVV$k zLC=Irh-@Y|m1AzP8KtW9nhNrMSvBeu~1c*U0R9RxkXkwaPRm%Bty_C#*}R)BtCc; zScX6b0Sz2XM+dmtqKIkZi<^&4Q&dnWmnX+1$vV6^s52<~qvOfuXL7r7jZ!h9KpUJA zu({93BR*S6M~l)08r9q+it7{MPB)1raU$#bI;Ds`T!zV+D@v{9%5<7E0-n~&p<+%z zcv$d^=0YU>Oa4)qh*WO$?2N+;EqWOSCS$%21y24sloku_y3J%Fg&w9P?srS+v0#h) zKpUOJ`;|j25l@<41TU@-i3(!QwhgmPiMgGHb9e2i2wc)2We`xR0m(#VB4XsI#oRa* zQ$@$mt~C%6DN2OawFomv6-Hfh^yN-Y=t7#0Tj9T&&ilI^tUQ#(J z`+NLeisY$C;P4SnS~Ez?bt|~-r&9p92MQEe$+Z-S((#muDEa`h2cQfu9mLB*yYbZt zli#z39|1*F^+VMVBZ>^~mGC8En|W2z@ydB@Efpd6SdePsNwo~#joN3UuaICTL&>4e zCUTa_RbO*nTG}bDNd}FX_lX^Oqm%tD4A7#&r`bde7S0= zuPX^rvW99g{s$G56>@cfh(Rut$SfS5*A+le(h>Mv8Tl4xIQ!<@L*ckb>OD$gwe#)7 z$saGDU5%GT;iT+S@-%7Zpbp9mAQpS0>`P%_?#-8pkOuo@RHpAUZplhR`CXkX+iCS4 z3Q`eZsgRCARSWa0ur2(WZCok^C5r85S5WET!*I-L32_S@tJo`KrqjHiOsJGwy%ueiTAaP_9M0%iUa7~(x}F#u7>O@@@f*>O zpsTMlCMPCiU2lK<`fq$7W@cvM#Kd?!@X$k$l8o7@={PYy8SDCb;_9nj9`p5u7+$|A zZvMgT@$7-;VsW7v6XO$c$rTsHuH9!4aqsJc#BMXb{)KPG%+ySbY#5DKz3xg}E}Dz; zvD|2|hxVIa{ciLR_r~Qfe_34kq8G){=MKdUH+(QwBt_ZiXZEJSp0Vnu>t`QV0R|ZnHLJ9!x~VYH(yr~8D8qc*8+Ri6 zM|5KX_(XA~QX=R>cmdw;nc!osFah1aRPJwAb92_=0G7{@Y*Rio}Vsa|Fd%Cs3+S;SH2NN6>B*W0r0HP#} ztgKos`KNGN$S7GJI(<--5|p*5)@st}c94>e8XI@8uZ!d6Cl{7tdbZ9v2IRU{+Nc)L z)7`;J5RxhM8ZZe#l4SZ8_DD*^DqzvZQqWkI))G0#_fc`l@G7%)a_cx1(wVY1v1H%S zL?lgi9b~p_F_;pHmt}Ni@f@; z!pM;8TZ9NwJE7&Xbcz$c)F@9nf#y~SNtHyL)+-H^2I*wWr6~=Zqa(>c2FK(YD^SgK zTrK3pMN7yv5e35vN>VL!QmSN8xhaAkLCB8z3wYh>t?5lA0!_B4txt(=E77Ih=RH{J zQz>%ROKj)Ua+N4kCPGR;N@_+SZ*2Hm&CO+?lr$}Tf+Y7+=RE(dGongM2A*{FzjpTdJ^)G|P)2cv3c#^i1=#kc>bdECS>HJjEPl}N$RN~d=XPg!R zw#14h7@@1_MW9?Qjep#;K!cpnD?qRtN{}H@VA^{pO+^qzJ0|K^_HdA{>1r%}74FCHQ?a`fPCvEWl}WW66qo%U zqJZd3NWrT(^SK}R*}Ci8o8@8g+7c=E8oQ!{^ID|*9&WbgxhdlE>oYN=SUn%Mz@A9~ zrUL^RlqRqjq0X~-DjxX$7h<%p5>Fi(kJr8K>bUHZD`M9fJK|IS^bhgeb5F#+J-edX zUW?bi;q7tVx37zlfzJ5RZ8yYEo_ZoqPA|j<-~YjQ>s#Itk3I23{NR@B{CQeMmJKyq_ z=<4o{RP<`qVwXy7hM#)_r4&$cHOt*`WtVK`T50I zYp%r$FW6166_WZFoPR-_JaH=i`+vJO)(sEEww+s}t)o4T9XT2s*N?>Z?OWsNrw+w^ zcm6oWwvNSRFMA2)%`dz7qBwl?Sln>y?Q!7+7sOyKDDX4f-xUXr&d2VTzA>s}+hd`= z7&GvGI8_4G-o;wRdSf+)hDKt! zF&}d?(*YT-*IaTgX9U!jBc@JGGKe2PwHWiwWsY}0V{9;{rZDwxx~Z+8=ul`{u_&$=ruV0n)vDF z7+YACgCqsW#vG$HXx>6n0td|jf@{bSD^vtnSgx=FgU`%Fg7hl%Ft`Mnsj-6EvPqE5 znwdBldC-Bi0zi>`C%Uc8EuO6c>YQVO!|jT;9RD&(SXJ}>^?*51Gf~S_O#7U3@$50iL+875XK^oZ_ z=80H{!l2R~otTXfm2c8WB>^jS{nKJO63{)D(0OZbMd4_RZ)dNBRC^TQ8KEIsYb#@B z8l7x0s#^S2cv{D&#wQ&F(K@vlSw-wcpwSAD2+j0*8!^rQ&hoQRXE(xSlc5ubG@7jm z3XP?MOc_!KxjAjxy8K)d2Xy3xQh6xTg>uETq^nXsX&KVVwAYQTLbhyhoow-$`T6;b zLS*!sPN!rknAT_J{qm<;)Ij8{^!u5B@Dp2~(Z%Wvk~7}r84^4w2i^qjN=YVcJu4D^ zpN$n%J8>qo7)f^$Na5fN2pf8(9Jj$J}#2N|79F zgCgor$WJUA6VO>;Z&^(dt&;C5hePJCx4hG&pa^JE(7@rDElu9+ zXY+X{>D9^IX~Bj+xK#UTNkCewU#VJTib^qfE|Y;4Fd|QKStWInLZrow>5_gdCQPRp zO^dEG=S1Uw&9(t8m;YsTMEcuR$jpjXo$~CZT~gT#0UdbyPu%gH7-}AgL&uKCrI)`h zUi-?I$Hw)WnkH^P8@zJ>Nfd^u6 zU^ssEvX?|hXB+q3*w_gB`kp*^ByPX!zSzC*tQcKC6x%j!j@MjyRXq04Ju%d?CYkr| z-Nq^DxL@qCH(vRgxaJ-2h>u+RH}Ru;?ulymU@U>D(cK-(jXEh(uY2|D;{(6`q4?~V zz7T)&M7)n4OuRO5gU)o8vv#ToW@h^YI`5@Xum&%UG-*?&r|u15Z5{XYM#N zuDJZt`1rLSk7{R6Y}>mtR#ulOEQ4lz%sZ&BRpSNw_QsKC4@BQ!UkrCwW3_86hW1<< z%L8LEx40CI)pjP1Ez{`$03ZNKL_t(oY&a*rqF|X-kb>%|grD(9QN2@iZ1|}FV-SpcbBARkq*>JEDRu~0F=={ zn*ysr2?&x6B*~bQ*V)w;{XI1fZA9~U0@K(-hBYqhc# z8`p1%zTT>kk<}(24E-Jxr{-eghK(^a(8+lW_&Ph@=N4mTW|kEYBmmf`(ChAK#{iQG zAFkeLklLl7Tm}uiKG2~MM4^A9*+jR98p}Cl95Sbn_hM5_VN$sPHAPp*C3Uost#u%{ zuToipvoum;tU%0=DK66p10-*w1a49>;Fa1q{hcK6DlxcXBZ z#p_fX3UGS}vs}$HQGkV&=0S5+MkUUqzQ}PSaAziq((wwaNlNIL zhnFSCG7uN1IFU?GhRyzzJiM)0hm9KzY7vPzFlQ5=dSSTM_&1YO82}mC5`pKtZm+PX zNazPi7Jd>PXf1EfT20hNpG}O$$a5)^T26q)`lV#3s%hGz&R~k_fP(Xq->V2q&m?12 zqCOd*;jFnwy{tHZvxzEPOJbrWQrVT;50i`eZnQ78hyD39?r5q2ie4gQ+?7r&@$(EI zlj^41EIdbI*JVven5#~WgZCnC6iS;YSot9Ofx`G3d1t=@RO(2z64(G4Oi3?lqH|Vx z(7(XJoSxH>NOG>f0%Lp%00O*5%>;sR&xSwf#)Do8gh&aZ9hV(kxhX`Ghix%h?!fON-#B$g%{a@Q68cFVIr=pcVVs*$Ne={Ie+i7w`M6GEfDiwIZ7DFOgjyzoNR5!BJ5+IV}jI z{H`@e)h(zqz}y3BjedTCSO&SsJvX=BeEgz@ee&se^wzJ(;@o7M|Kcm+9lvl*{Qdv+ z=dt~)eX(u#o_OphKaRD=$$0G12jk>)BmV9qpJK58wXc09ZoK73apyhzW8&0FR!c5_ z<JLFOB#A(t7}PK#ITP z=38%yKmODI8UusF(b3rz%gtu2tu1q^``ds1^)Wg!694rt|0WvCi_zcL#ralq3(dId zwO7TJFMoM__{0A#PSoqMY2#=t)iG;fId+|SMm+GqBe8YIt{7fF92cB}HFzlcyW6AD zwI#N^=#_Dz33h|9V!$I{M+i@m9i$Ce#nZrM3)#==n1X6lo=ZB9JcWYq>_;rX8ds^6 zJX=l90tmTyl)eP zQh!O2nG_&bngmE&GZ1e{5|F?l8f*oG(x2i!R7X)F!qbu1CY$O7WPv@B%5GT=;#0Kr zw{d-we92>@&s5y0XSUaJUD%9+vLH#{AYTe~SDh(Ex2bMg(!+V*UT?fljAf{`R}|BB zC<%eQZdYe}w38+)+AM4d`#GSnhRO2mX_gPefItHEnK-eUB;g6tY|Yf6FTrP_fxV|D z6)pC919WH)G$mk0;D&Ym(bomIGdQy*K`8i5DBp4pNu$Z$58OA~BffXnqicu8r#V$| zXm~V^9626mZXSz$JI127w=249ZSl;}sd)bQI0peCyIDUpz_QEplQZBou=LVi!^Bi9 ziiYw*{c7DnKb5i$9XU?53&}OFMNeNhlL=;Ba2{BgT9;5deUZo-f;IGLz(`S{1EpS6 z5h{@8?cgFYAVALvX#>ft5xt2GY9?{MUW?r>YP5EnY(HX z3PN%CV2B}OmVqIvIy|gS2Dp(@VX3X6Nu3Dv+}Pc00&yz&o0)|cMua|4NCxhKO+8Gc zYD_RlHFFlt0N=eC3@{;q#xfVao-(@%F!dTF^NDrhp<{!(0}}UekVcXe4?0j&1ndME zo>LA^b6HxICKNE14a1U+OPE|nK>w+Oms42P?3~|sz@4RE(?nVWJ?@u;H60XCtN@PH zkSdcW_Xc2i7HJ*IuUx`C9pNYvQwMvAAQ4G*Lwaj=2HDvFka0M9 zxJGsr)##>-P9rGcI|RB;$Cf=ac951swfeeWS-vZ+S84neD2c}CXSZW3z^|;lCGuv; zMSPzk5jYRl%*TCcuDR}4l9rk-Oe0@Zr|<*9fAihozhS~~5b<7tU z>Kh|Hg+V&by@CMUzV=@>scUA28=o^cWCcX191{=^5@YjkHbb`5JmeV5WHobACB#ZJ zXtUUpro=XzqStWLSg|qf$_T%PTV*d5-igI5IPF$yGpKsNaR9{8)cBGHhG&O^W3QMK z{B+6+Xj1|-`#SXg@iRzz3G`+RpF>o=Q7P8pJ`W-63K&>1Z0Vt6FqPFa4QZkrWCAyt zpb7L*;?3ljGz8f*N}Ic}KW%*pj%3oO?IicA8*lAh6V)z%R<=N~m%)%US_SnnMF~o4 zrv0j5Eh#BH{|=k7dX(uzdC8IjR|bj2chwNuLVe|~FDk8;Cxtt(5~4sPfo2p{S<$=& zHl({UL*99UEjFf8kKGoh4&2M(et+^)uYNxE>^m>cJO9Gy=~#*T@47Ya zfAGQBxOrFn_J@8y9{I^VoZ->c)fFpko$;?X+!oItJ|6FV-!*aRC6~k__ump52hr5J z8jl`48WWB7= zyE(q_)z6Wd)z+>F?oiU}tX1RU^Dd5Ge%E{Bz6b7)|MHiAMoHlQey}>Gsd!gkn2lGw zFMYl?2D5pXQ^!WvX@*DZ@B7pansE|h?{P|CF=9@@!Yc~;<76) zjf*aPQ9SU_!_n5+8%+#i-ncH#Jab1JKJt7Foc*)WwrLOPDNH&DydYiyxZyp6bI9&t zoqG%^%-~y9*TfX17AiZIpw>@SWm~*tQDw$CYRQ2yjE?b-Oc;H;{^@=Ve_q-gOlOxp zNdKvQnBXhud`f5yURsKmv|lG63H&6GW&&z)C<+L`SycK5_E&LciG4;(g+WPM0$F8G zT`47F@ZhHsxAY5~mu9gC3Qc5(8e_Sf`_&WbA)Nlm2$V~65J)wbwt$J~!jDqgXI&g4PM;P;)~y-GWga_+?b>|N2Wet*uresXGxbJa;!G>U!JT;=;X~qp!Oorso%<($O8q zPfWznU>`@f&&|$ix?-)18P)v!0uN4icTdbO)MIX8K1S9J#6VAP96UO~Y0qP$qcJr- z#V+^`Ol5>lT6=IhIA{(SoWg~N?BnuEbV4rFbSm{uKoVEwIyBPYI=HSJm;&3yMnhSD zdmE*9+2q1vl5B+MwhIu z24Q81QB?{Ri&e@m2O4EyVM0@ZX6gft(z3x;5CVUf!IKjfI#jHs22HYxVOpH}ND>uM zGuaQFIwKy&2FjX&+ z-&6~;LrDx%Hp_}6Hnv4C4HVj-+3);Lmd11@zC(q5ne4GN>%Ih>Eh@C7rfw!0Y!LRu z-P7(jgPpP>k!YF#0R3>0pcy&K%W}0`c~PUQ&#!~`g4*#@35b3ldq=^pR6P_t!H80B z*OdtEQLTSzh?$lNRrJkd6)*3N&6Wt>Q2~inf+<~?CJUQYYo`&NDz!fg zP>y{=<)7RWiI~c!Wb!2Rtcm^^YQsy0wUy3*J1iR0ndHmyC;jTQM(>vD4Zx11eI$*d z44HM$cpthy4VdLl;nBr8Qq>MBeoP@*f;2tKK>~h*!X_NbqY3m>Y%eMkEkkV0m(#s_ zgbFHf^Efkg9W0|}%f%Z?Tk4k%1M?wl`N?K(*Gx*BHRS8SZktvGQEjHHypKXpR zmi9ZY&hlCXZarp3| zxaaO4#YN}sj&z;V} z;B(PI8Pi&vIyDt%@7ovG{K7BBV~;%%|KlI8jU$JSMy0DKF1lb}y!B15j~j2fBffvr z9Z_A2*mc&{sC9S7)}4D}^QEtirQWeZ3`L540t3>=VoTD_F;P&D0xc62s9Xu74>i!4 z%$~%HoZMqibK9G?MH}aHRVEACsR@iJ$uP{4{<6hJ=Tlca|%1kM9>L6hdlcXWs+amwUipqb;uC6L)<@B~!W8+{?Y#r&3k^b)J0HxbvK}b*=5PDh`OF=CZN@!_g)|yfI)OUWg zwr}6wI6OWc1E_GsYHS`^7lYkM4ytkVK#7)XWSiLWBK1e5o0DWR-P^cJ@O$H&@NbS*4t40Hp)GKYA_0d>Ta>8Jehen3E2&i-DSvnoe z#sHdFRTC;@-JU@eBNiDxdG;CT)pyA*PJN(dN0 zw5X;CSuH6{l9?=3vG_f1CM)h(4TkT@&E9%wRU9~b1c?aDNNV_cQG{e5;VJ`8`O~E0 z2;;*&CnCbN%@VO2z~!U`lSmI=l^iB>4#rsObrYu&mlE}7p~g@-9c0#s)2$n=!?z$6 zsVT~mwBs{)4N2`Q3}n__k${x%lb1J1zNApe2n+Gk_kj*e@g^Izo$%Qt70F2&VlP|q zTt)mR>KW0~7HM4}6-u^%jH?2pJxuP6nAaOv$0o zpd~X%8eaxp#*MsoLc3CULFcdtq>7%G5+%>3`Jy(E``NS(d@dV&6S{2)j)f385KqT! zr%((Nb+W9+>EtEL;V5y;;h`-w8(z1S`evFW5_0T6@@_E|xWYz9$~{8tVXYEVOAXRN z6k2M1*cSrHTFM$qeo^)))wg_3-0YqMWF5lIjy<9B}t{d)yyVNKIYyj&pCh?Relsez=orem9`Rt?cgIY z4~l!+s$WbPyvMRR+n}p=r1lH*91nNZo-Q(Ow}@+J zYy_eMUG4GMEnkYk%6#nIcR>sf48`|vyCs?nCu6v8C@#F{CGqi3eKIy|S|4}ac~=}i zay;H}^;Pk{_rE(n|M}0vrqSNG?4ol?slN5@hho>R7sTsd|CadVKYu*hfuKbtW@e^2 zDgafvO&hnxd*AcHc<{d4;>Me=7i|jn(TDyF%{r>AR^zR|_?~!h|ATS=gZIYV{5;PL zW)J|VgJ8|3(T(x0x4%0MA3YkM|MF+!)cjnGt{aYtQ|(b)1UiVtY5!A&NypJ z43Ca6so!+bE2D46xvVZC(aw1vj0w_C(4UHhAZohzO-o`9|C`jqq*Z5JL6FZN2Q@K@ zriyasWWX@@!;v7KnafiwZiW z&QJmm45ACVsgeY-S7fVs+#T2CUgx>?8OlJf1jRDhQkDFm0Hot7J zESm%T!uRD@%6TV@G5vFr&_BHguBckNszs`{VmN$w0q7-*?WV%WtI&5U{%!)%om|7a{F40_IJe@ zql2+=s5kmM+oKKrVnP)eyQ9v)J|@TZIhh^<%qal%_|fULo}SKVR;qFPkM1Lf>$3Cq zMy+ivW*W^nc5<51yaRnbM8Tk5wYJ)%)E74Q)XZG0R-h3cacukqDQuXF`zq?|D&Naa!Pb>l@$~q)(E6Y7jOVa zgszY!6-udLerViAqk1)Xa8fxWIoS*x+^lRqGy)G~m!L9Xf->%pl>;|xveBBQYDry^ z`{pJwQeY6c@aIK=Al)e&FumEOVxW_qDkH6mE9t%!JS$0Qr65S*MgzkV*-&q}yk%A& z6u=}3Vd@Q&AOyCUSz^Ar9kDp&YL-Y0&vw9$TGvOym^6n>0`*DeLVEIfD_Y2YoN5OE z63xJH0!hc{0fmK6B@_&UMOeCJ+@#mcNt*&$HCxksx!hUckA{Ce;$_BMaw`B}vWL%0?9#QtAq_HJE(1^LuMowKO`^u&1G{%J* zh?8zTr|D)HsG->o<=tX`ijwxfB_KK~G-TqVqB^JwC}wdmF>%#N=!#|(u!P)#w6iK= z0D~1B_tzx&;N7C6%97YhKtL1Fz^vrN19hKUUS?yq5`33B@^=h-iAwFe)ovtOsNgXxax8=OU0O ztd2SD+OM)Ks$2)fM?ia@FkEt6|KyD4Yrk}Do{N!s}Mqo zd5ei$%0y~OGZ-Oy;0jYqLYIM%wxR+^u2J@ga4$H?pd`7HIpu3gE(qo@*vsZw+2W#_ zTTnfnOtsdwc#~x!u5_%-mzWS)-7tR*K^SbHf0gf2wpmi{qL`UK?~TNJsYLYGD)HnG zzaH~Po``*W&x@s{MvQFQ8h77*L%jM`SH+Dt-xkyJ^8~vv@9WSrhvKq}eulr_D8ka5sk%p z{(Z$|m&cZ|4e^hk{6x$(no*zApwvq*JU^<@5g+-7PsQdlx5o!R@V@xo_r4z|Po9ka zvo44izT)R&sl8JaIrNwL+!b?V|3_d&z)(rSDk?R6&U_#PTzQ^xUxMkKhm>)X;wL39s(Pju$)C~vWj-YO zmiuw|9>K%_Geb65ueVgp!k4p2J=aPV%c<-68di=lp0HagkNIX_n?SF)ql zMMu!t*%c>FPV+j$>!4VnGBV|DUB$q^5%|kktFn=eF+}s*G$;#_!FV~6s1-+*$pv4w z)Nf!=(c~^CuB|~O7cRI1NjrWjR5@T)c^~|E1iom7hr`me$u#5)%}8Scch1hiMuPzi zq|itMS$4(>ePnG~Dsvf`D@YN}youtWy1`Pb=|e{6a_gqcLthL~Ks*zIXO+!BWs^!4 z;5v?$$;jL^8PPR}r79pUxc?=W9m|9JRjiokiz8{rwNU)fw@O7BqB3}&KCVO-u|CD5 zYtz|M#Ug|BMAq$C<)hi5N3;VK6sQ}?R@hu+yqSqd0f)$FmY=P+&%g(jG_F^PWFQ&9 z{uKW{dC?_}C+$_PL-B03CThcV<-$|!b4{|6AmgMUv*1^!R=WEJ^U)STrH&z3BH8B&T9to++Ip2QWG@ zMYTkgVJXa`aTDvpO0|b$0p#gI5&|hmHcqxP;Dt59eNl0!xf+X>YR?K8&yt@}%2Nuo z;ll_A|86+k+|yW*Kx8sOfF^xtQ#1JGq&%EpSk3M_~<7; z!E@EsS&NNhBT-*ih;7?;#4BI%hPeJ;zZNG>9E*XWp{Q`yfPC&iUte5x^*iFp$M?qr z`yZekn46o8dVMa|kB-GG2A@sM#IL;n1M%#kXXDO$lz?>AIynpw@dw0adb@k$s@J}r zGe*Akoo~e9@uO4}T3A@17!1^UhWdKg_c}f~70(_&Ne=z&>^wnM_}L52yC61?t&i(( zydlOaCywP zb;p`}E59#!001BWNklIPB0(0F5^a7{GC2~~q}#6w~$ zgOf?ctL*P!)x^%+K>}V@Ht3+iiWDd75~pJq9cG0U88p`;0Ecv#aLsfYmQwSJN%YaZ zPdsU8>`ksWHV#lqoCdax7(t_g77=1)xiau;Y_QKH1!%7typxtBS_ip`PEKGXv4N5O zGUzqE3nq;-Rjr zElUZ>`r`#K&t3?rK(H^^2yZ%jQPLa=IVzw@%0}{n5@9-tD+(%cE9t;n1|qBVab(dl zV}!YDs;jv#gFyuisU%;qUI?goFTMn>%w)Py?a4$Zo4SQKIY%oUPNB$=iA-t8nZ)8` zdDKhs6NOW8z{{q`Y{)fT%h--8ECs0TlD^Jmk@$LwZHXb-B0J$t`X$ej5v}x}NHlO3 zmX@Kckx3&!hYlyZM&g;Im_kt8(EmqYkQ2Y`5#iIAKB(C=P!oYPEmZYdP;kwIWROkZ zA%|?P2~p3gXbLQ3zZioGQzSqm;$C*JNGv>){#92=O*cq;1A7K)6%&$nB{#Vz6Qz@b zGg4U4mE>Tg+~Rvrpoc@LlA5623!#)^aFD*lY7>AVNpbTJH?KAn?j6@4aKtjd8rgq3 z=+-Z$TzQ@ceN_%TDUm{TiYlj_Tuws9dXQ@6Ll^W zXs8(a>bx(Y+EWGVL2|dOlef1=-_r4T_~x(2d3(-`Gk5HaKmLqkf9>Z{)who3tT`yc*s)EkRYU&L&$MK+sTo6qgE2il#dmSl>)sgs1H%J6?mF4K}?25xjk8nHp z_4P()dnL}@vpb?vjqARDqvWWUSE%IEXf$H)u3fQh)24X-_>p+{@yB`EjvYG|8%9QB z&sn?T+G{@%&ySys-~JE38S4ku#V0=dxj5&=SH$qymqpj6-LZ-$f2bAV+>o7-;tVMd z>$yUvo@+G&~}GYN|72W^D18Gye^JSE$% z9s^Yw2-0{!rKpt=Xel6=;shtpa3;8Dw$q$ZR|EZft+5VlV5(1waiM|LswNAFL6Dr7 zWSI+;GQq}C%DHW}tL7Cd=+A0o9&s}hDaKipNX2|45y);e>9aG@)uyK&ZML!1C8|+{zP9bJBjb46?GtaGXsR}nK zyod{|#woL!K%dgX8V3v3qJjjeZIwd|p?C%A)o_0;hWk2Vpw<>WomIt|>F*&3v7$r+ zxkYB5q<^sj0?GX4s60D9v4+WoP!yP%Ux-F?Ef$*9I6hsEb9ZlGbJ?+@6VZzSCmkAO z(p{@Dm~4WURB30E30}nH^mHsNF2;_{V@yyGd?5ijJ~71!h(MSz{BM2<4Psr<+ucJH ztGBy@y2O)H^DMDeJK9NcSZtzPu3;*a>{^4K@e*GkWkb;*3G@Y8#2p>6P+wvKk`)fE zXC?~@L`i$$q*wPPI4H*c$x?on(a`CSWP}abOcq+om`NdVG$e#chXRX@=U}$$VKH>3 zNqNa040y_w)u^&d9Bb2*6HPS=&Nl&HugSvz9y&J?Gu@V6kPOy*kW{5q(2L`N^%1{Q z%3h8Zihc(rJ}EjYr5v6Sa;vQ}V~3asl;~5aObM>UG7#A=xcUsc3zS^WyW~D%!o9PM zLXNiVyU1#VlQq*{X z>9)&ig1EG*$nac|4q^^^4psDL74sNcoIp{BF`B9dbyK07)!`ACG*M7)nN%REV?e2* z9a7S&780c}<%;5irq311YIu4NeNw2W|1ZQ^@ziO5yp~z%kS2Nr#%5%-MJCJX69YB{ zoit*ek)r)2)Kt#JVgW|4GEZXviT4ik0Y`wkQ65we+XEd z-Y-QoER%R{S=bK`EH#p=N>O<&1^Rx+uEZ=hH4lW%msvG5>cu1#>w^jvourd;2DR!F z;TtHHqg1lz1ynOcRv1sG^;vVy4|o4}a0iIqT?@sF3OS^0EmIm9TJWr>2v*Ww%s`+eQRT;)vz)zs zTqWBi>}^rb1VAwW;o2ZjM$#e8C^%-wQ-V_5i+(~<_Aqd3HD;ZFK#CInWtp^DHQ%Fw z6MvMHXn!QIq+lae=tOx@Fwf1Xck3p6{5vbD6t0kJLR65jCGEGR>U^3~T467e`_d}g zobsve*KswZgb>oYmuD!?lR{1N-5GqSf|})E znmVHy{q^T#aA`c|7MA0>@87`n#PsqHyzgBxHryM({|A2@H{EnEKlgWk=ikO}ec)~J zjc@-;G%Fp^+0`3;Jw2o~Z5&%47hQN++;Qu7V|r#X`uYZAa(ae+s7OA#Yn^e`)z`$s z`|pioN1u(w#RdB4jt=yQtj7HOEaQ|bU-kN!n4E|Q9=w}p8~br~b|D7(dTC1*7G~pR zFS|0v#czxCyqU0C4z89zC}NACucV{Ii~a_Ng>U|={t`q|I%?00u{GvGt4F*vj? zcAv2$re{yZ{SQCPAPr(X@aJc2-5$5zaz{M+#DRGA>t7X@z3|-l=P!OG&VSK`G10L; zwqEj@SS2lRC02{7b~#H)G)}!aCIz(JqS=&W-AiJOT>ok9w`--5Tn?;M?E9qvOWzy1*k-%L7 zm@cC$Ta)!+jKdIt+g6r@-pIx}2R70^77BG`?_jEDks2jqD~^}XD(syq$!f4qDzkpB zIM7PKOyy67$c!IZnP?GAVO)g!qYPm0GHtl4v3yp?WvH6;cC}OWais|`PVurv zDKI5++-dv7p{eqpv;a9nO8o=&tFnhkXc6yIJSo;VU~r&E)sOXkow0tfEBZSt(buI3 z>7474h^|`-KvxEU&v%3V*;O>AWB4J86H8Hf;NY>f@$qA^cjs0rL`+W2MgPD+tW|0; z+yjnn#NvFN9rJCNe7dqiEnpabR3ql=OEF(xjK2PUYWyNNhFVr{Ck#_t%rCCQ$?3Uh z$Bd6yBi9lOvvK_ZgLKfj;OH?ZWwEhJXCdC+YAn?JOc>E090deWlbM zX+jPzh~{Ix+2}2FUvn^$%$_P(SzVB~Q=^gx(b>_Fa#B$OveqUF6Tz64GOu*H9UNza zuX_dXgZZuvrWYk)W$hLb0B<3Gm)Evdk6}nIho4_F6^!y1w6Rj2vOt!K(BHPj6t6Vw zDh`2Cl6-$R(h^zML}{U_qADhGk%2sn7Q_G+)%4@L;-!duQD9c4XN~;Vg)`bzR4sANNB)RF&ozmoRrSUNwCkr62QXRLBSMi zBSADIAlZ{8QHZ>o41l%n3d0K#HP{f^9rZ)eN$6JPR98{?XmUC%swqT-Y2;n;%Ano0 zh2jowF3n+blqBYXDn%wldrP{JfCEyCh)QWsLVYB;_h=fF!^-{y-5-+^1_-)_?3nuq zumgw_GFdOY9@f_;9k5^lmqHGP&>?6p3k(Ok|KNR58o#K;=l0%K$!U zcgZ;~f)YDMCu(`W>~*0mEOA~AUd&l1OhAyBz)@O(iy{KmHtN&^ox_^)T(5$nuo4UC z2SJl2gEpx}!GEmaYgV6O!zQVF?z?EITc*rr5!{%{N``Cd`x8Aj`Io^?_LQkArV6=| zc%C5x2nsgkzp{$XaKee761SA`EhVH+2TioaTWOkRa1?Y}b@`Z9V$qXicID@~a9+@_ zvVuYy3}m0tkHrcRsJQL1v3()7w@t=#ho6nlfARBia&{(OdhU*R*Dw7RLCep6?vwGu zyB~{3A2}HBfB$>p_kZ`d;sv=o zcUNb3yyBH_iv9cViBpruC>2a8UjlXwDsw_a=km*66SH%3asT~ykj=2Tv=a3?R6M(A zOCXzj(M4Cp?%n6aZMS_to;-MfAm^&ZZ*b3W&zD_vVQkxWR{Y&3J{}88OH})T%I89J zIlB7#;_S0_MPsoZ4?O&Ev{fM3fLNyy>(&j&DSo(5?2-0Wu`CqpWMb+W83x%3$kPT@eNcR5uLv#m1qYSl8Xbo{xd<_UP@X zL|1o}tPHh^SWw3PAbU}yc!~LSpufVGuEu=59+d+VGi#@2=3}V4gIq@_PyuPLb=CNx zFuyp!D7oU`qqz)@0D}RsX{TqFVt#QcMn(o$&aBrPF*MLeJ{X>6VPz%eF_@={xgF{g z!A2YG(?muY|4J+@EV3~j3B~+;Bbuwrl-Y%$fFsb*BxFvQn(i4QypI}D4g4&O1x0Kq z8>z-QRZAo{NNNNZw!-^oGc5hCN@iIBNu-p+#4w#4177&N6_uTh+Nuds^1wRuN_f)f zD5wqs>cMT}!@#hK3DpH?m2j+SZ|9FIihxx6p&P_^$?*#DuBS=V5~R)o4%F-^nh3P@2NHwq=dD;r;R zZBoaI=58fwir=NklYwp;uY7qr+A8}p1;}i%2rQlOGV$>Io|PQ@E`T zlMVnBELH>^FhdOu=ZC?a2T|s;(cXyhNc&Wj-i@{yKRjI}kH3Qe6{;SlK$@-t8{u@I zK-y@;X|Gy@X9{PTMw*m({>j_nz*R_ycdE*jR5LXOOWBRmm#zpZ7&J1o2r~?=$bsVb6JzG|ca9!?mgOid0_IvOo_)K=w{p$>#p48%B@Em|h1hPI!UmWW3>p>(b$Qt48e}1Z zLIP+QX0L}q2GRv+-+|Og`HS@1BDpOS>oRE+TFsdUP9pSHg#werl{0Tz=_bY89GqiU z8eLJ*o^Y)ZfJpYvp^8KvcNr`)IVvhDw!Z~pt3WPkAws>Ax@k%V`Yl^GJOB z;~$Ari>vY7Z`~Zf{O(_l|Mzy*dsYJQxGL z-LbOa+*sOl9{oBFJFZEdJOvVRAg}fUXX4mUaP2c0^*)ks@jMa7t_6zD3cZb~d#l(> zWeSt3r8z@Q2hj1TY^1-HK`QqYre?$5cuIQ;=@kAWZBrRCmwlu@8I@I`;`l7|%jG^7 zP~=EB|7~bj&#ocS0s^)FdB0{Vv?d^$b>%+R4ESA9rC({Ou+xTR#lt-{1${BAe)f^_ zcP7v0?;+%MrPHBOd1Q(N$JW8`R|%m`m*5Ei<{FVeJ3t9+J&`av4^_@&4nqm6x`u>U zN~&=wJd{bEuVV$*k}~VTweGo=Dc9Zy)xE2&8hss=*tUKkwv6`009q$tS1HTe#+iS# zukJ~d?76%Fs^6qX+jQXemew#Zcr~UM>QNb=Sy%&I0EtCkcPEnz4C`51X)>_IZ`SLJ zF*tyR@fBwESo)rB3A3oNG3H&L8y8QRGy~eVLwO*HNmkbQ0+mI1m}k)eEj6t`gLrK zTv%L=shLG>_zVUVSu>gI>Z%c4fkDK9?LwbPM;nnhCMxM@oJo>j>1qbv!xH9(WK?2Q zg0v3v!0}OZ1Pl^dj2Jk()Nw|&NYoQGS4v7bn{N}Dpu=~AHn+BoUAc`+O@YCKoMj?) zcD!6aCSxe#C!etlPME+s+4$*zDbZ<9U}@ovn=(}>1<64tOq~ZdZH#(egosNPRL2-O zj6fARTG3f>zY45#)=5T%r1Cguqsov2Y0iJQgf1SNhYkrUdz2Jp62P!(mKcAc0pk5| zW{Q=!@*X%$&Vd{&A9V0a=JL77`)8HRW;Ts4KfqzXlbmcQm2EcM;cLn4XUJG4k8&W1 zI4P-S!!euZ{9HEn2wt&|3%NrF0ou!{HLqDX`A5n-WiXRT8UN;*x+lQBS+>Ik4NKcm zGO-4=bdFPHic5&Wf#tJNsfsAR@Vj4&hxb9oiKcF;sw0deUGwu7`C zI>~fK4jw`E_R&}I^ zr6W-Wk-CKce+m&~vvtYvDO8%2XgF{t`k!l{i{pFj?XWr*g5fN?E5Fu7vtor|hVaSt z#!@V@;-K(4=lI~gh!&yUNR>G|blBpYa-0Go{Jw3a5O@JcvLkA8<{G$n0;Edxihxdw zzp)pQ5Hyz8VjcsskZIUYu(yTc9YE@W(}Izdzz?Oum)0f|k)oib1nsn53!}5NGpS1o*)8-wHyAlYAm8d6V1>l2|Df!w=JMv@+EY!BOFSZ@b^PBgYu>-G@Yy;Ck z6({7`l#P!*EVJy#aYx>dpZ+AX&4wrjmnSF>AqIg6Jht9s@RlNtR4Uh^d){n3`K) zQi8c3NKmK*gX+T45-SM3JzZQhHU<&(R+Ogn^YLRXo2ofQ30Pkog=2Pug3ay1N@n}xdm2LHmx6w zrPZaFoomF*oSNc=e7OX+igIl&`un;A)h5u&u+BrhJsj*fzu4fqApn8gubQqrU%-4l zuJbaU3B5F)nd0GVcw{yTTGJ%h_^nqqS0hG}kOdVEpK3M4TzZPPforis$FOy?}r z;R#;L8EfE=54w?lqC*8Gt2~I@E2L4B6s!!wiN?_opif8dLR#kvyooFpa+MBNTM@xj zekcM!84z9{!61i}>DkNvAldtEuZ%s{bMR;AQNj(h;R{8def^5}%v>TN(Td zr8MG|wHYgoDJhh!F?%v>BwR=HImzGkOe6Fb<#gn%*72D@>r!=$sJi_;Ki){1s=<|L z0`UTUmebWOi@dr@dsoadDJpA1v6+stg5fH%oBL_2tPI4#gT<^0+ZXeUG*nW_82Ux< zS>Q5DQ~*h6B^r=E1?WXEK#k_CuG)UHQ4*8^tTklcZSR!78q_EP1nrvy1_*w&gj(EU z=7_8D+?CHv@f_fna=m4eqswTH2<7MvZYge6da3@R)@1i|YM<<;W3jYjElP8;2qo~4 z)MHYAiB@TSQ)MWdoTbLMLR*Rirmuc1KL1z07hAS%kN3Ur*W+*h{;y-8t0R8@_x>o> znhWuRTW^TzMkTKO$4|%a{`=pFx4z|#?BkeQsK<^o_po^#>Xyfk9F84lofD5ed^dym zJ$uiM&Tgq@KJnxuaq8rWxcJ2{kLM0O6~~SpW_-eswxX%fsP-cP*|FnnRyrQqe=n7} z)KdVUXo-n0VvE84;kfkD%j4iPPsKg=BH__Kot>ZaysWm^ym3Rk@#o$YxBu|wxckQs z#_^Mrd>`mz?PzO{;dR5YXZN1C_o0VlVeV9{E-x{jLA6@~dKI_#9SBa4!r>@fJKJR=^JSfJ~7^001BW zNkl!>%*y%DX$6OCgEcy66A zZ-3kp?B`h|&XSK}d_Xxu_JsMHx!wh!rTbOfWEKGudMj0-5+rK3?7u40?h$F}>JZ57 z__BD%rmfq*Yi%`XJN=!_OaWSRzgV%f=ne6#BY?>88K`os@9pHY^U;CMs6iPOy{QIX z@q0ZzHTFKC7aP?Ofwd`vTmoWjDS#*m{?}ZK%7J4i*LwSU_zU&9nHU=Aw?S@?MTFri zO-nrou#vMeyRVSC^2|p_!@Y?pavm$o}68XdJ}UXu;{9oKp9I- zf)O)w3!Ev^(OHeTIUL}X=<4p~U_oSTKpWunnPiw2p#)y&Sq7K+-ZLiObmK8{w>Opl8S8%cn4(2#7M|bEID4kX+uM|?RmWE9y z!{nOH4Oul(kV;gBmj#V-MOyD^=o87xq$ia?tcry_0(2aG463YJ0Ko46XIH&pSzW>T zX%8sv;Z0M4tKdp%H59(&5NV@k5?@42jiy20_R=6L^53{jbNqQzW3N&-y zY8_cIV1u^S0QQq~BTqGNb#{5q)%W1!oe6CQ#AQ_{(ZAx%YIkW@WAZqsJBxw@MHCEb zOig%PPl6bF%f*}$_rGZViia(_a>%44X+-!OSIhGAl+U~G%+(%;;e7ubp2b84!5;hv z?oqsHtOfbgDOpR2X9Xju;G-&^l|EJ>_^8Fn;d8KW#vWcf*MXW190w6P&|m<^-}kz@ zqLhJt*0C6n@ux)6NZ(LYG>y(?B_-)AWm27$(((+YnK&)*Je_A#Ag_5nR7BYOWNKV1 zbus5z$Ldm?HLx1r`1=n>wWlxM_U5<6fBEzO6i1#p5MTWKS7O~@4|_JAIQV@0kH7n; z_|Jdzf5uzi{B!Z>PacZZN_$-V;>)A6)=Rs2;HmwwW!tWJZ2w(x=2`nL~sNj8l{qg+KlX3qePsTYf*c~sq=)Ab|)*E8O zIhRJ~?ki%l+2I*wK(>|4aer9kBYQeD_eg&Vet&`u$)NJ!+I+_hT`jIr%mQJ>%MA4d zMpA06wW^RtwCM9oa3XUY0CGT$zZqG!QMnSICxS#tJcO0AGI`M8T-gT#2`O6R!;)tv zZ5*DXX!OoR$rTep6Z*vT(JEr7$3jWJ0ClEBG>2usNA}ejchsIwi_0LUVHh)VWs(nQT z$Qb+0?0ea3X!@;DwoG^w+vuhd1NYY2Vz{$CHVpN~`oW&4QJHp`v~L2cYfu|(k6u*o zJK9}bP?c0PZY5ptSpcG_BF8hj7M1D6r8S^+<0q%0USEif>xZMeQ+)y`m7wYYdEBY# z+34%(CX$b)6eJ#1R3gmsR{w)|+U*E1&7VYb83uGA0YNZ7TW>^Ep)R#dt!~Kk!gww< z8qw3+%cNtmu@YT9po1a7k(?I-ab$5o{~@n8Jk-w$4f;t>HitTv;&vy;wvCaydidCJ%@kk{iDYbH)bQ%@Qt&%) zsF>9NU1UfEE;K;D5fwti*5rin^CLsOF}JY5COGtA;5uE^h%QjK8q56px^;a_Lg1KD zO+i9~&qt!wTxmMbE&B+N5R&%?sa?!E;d}y38Rzge&<#><4csFSw^I{y(uCCTD#Ev_ z5*%NWC|mMPjmC2Ns5dBjIhGN8xlGww_RGUZ8k?mWWf0bgPU#vtu!ZDp8X+c0N}5y- zZWEo)VgmREKC_@FnK6x|j_9NZ9Ih^}YLdORyweEy%ok=hEP^oHJjCJ^K+PJBbz-4NF{ zSnt~*m8+&M8HtwUy@{8t>WHayt#dPM%(M?QAdmOM-X}QlOklKssF37f6?+cnsrcjm zhEzCG^{SlD!TkrmGbxZw^#pkGulBR-lls8$$4%X--cm?JYHwj(VGpuDjN7dUma~7z zsHNXW(!6xGwJzBglI&qoy6ljPzhoJ>G+;gr(y7H_b+X9qyELLJO zSWZOl^!-QB$3ZoI5)=qZFv8hDP0%R4&RMyCnSc~FNdO2z6VGbO=0*k#i4q&sU{Yc` zQdYsFlBIRke#S`#R~mg*9r!Ow%cAN5s+9&~vBG7#U{-0dRRL1fk$^ZMvnn{BwLoy) zm&6^A(U6Z~o|gg^aBz{wMgk4K(^3@3D0A8gJZU)>DnT3eVi8-AGNKyhWTRNobRv`) zdA_5cM!iK-$sQt|pUkJ2^kLX$tCY2cLS$IT&&tDTC__be(15ZC58#Zl^O1Upe$DVr93BnrVn*P52 zXlw6`zx~)};${ElC2`q{&W>Y;o{ss|&e(9_l`+}1iBjwM9Qte+8w);g6c}FzdU4!e zN(5b%5Be@TJ==N*;Pi1c&Xs6e)z1}Gy8_n9U^D?reOLmCEk-i6wbJ|8M<~fiQ%9CT z4i!#Jut;b;mEFJro-Y#+Ru;Wq`KVc)HkjcKQB?yRKf9t55%~^ntMOz2Z7~FqK)Pvnj-R-WCRGUPaK)KFr>Z96)O8(| zSU=E1upI>nQT&i00K|#tXbTP}6thY35d2Q5c!>%wMp`sgX+~?s@@iBj7iZVnqazlV zP%=SJ1P+XNjU3=qt5LZM*$Q4RCZwZ+fVHCzJQ5K$|0QK;ne+pwD-o$?Vy6#Ab0}y7 z^Gi$8UvHvk0Ui7+F*QBIg9^j|YFZmNtYaa3YOX;93VieF>DgFaZpOAPn__IZGmcNz z@ek)fDfsK?Z)DfWyYaY2;@diCJd1K~!nzHRdu$JS3y&j#k8jExKi z2x9}awP-|J9631~le2T&2x@*7rxYk9?s>6+#0TgJG?39e-xhVuorhCfURE=|(dzE* zT8s?zw0s}D;^kOFkIkw|QczXLt#)iorw9^@zl#ZBop zR6MujaN7BDO1&kUt)Rr9zO5={Jf4r^yK zAw&>>m?|&^dMIS38EtE>TDgM4S`bhV99DQ6^0Z|mmADB_r!a&?4T_-0=vRi@LUO#G zc3Sy80Wc0`97RPCHdmHCNhXS573bqPI@ zbld~%8$LttA1KZW?NlOLNH&4$Fpxx#74K7yN>w}s+&QZPi92VxWMvSE6srS5KQnQ) zyDTVdJP)Rc%8^)_*D}z&B4rhwJ~)A|c7Wc6>aX@CD$=R|czS%k@I>jH5DCG8glr}s zSxPq#**~AjOCkU40Gm`cSB?|lQ+}erM-{VjqHn$y&i62VLy2tJSWi%p3oDvyQWh0n zrM$MNnwi*fZ&^hP*jOj@88K1YdmcS_7~WNHF2^EgDJj?>Er!XOn(4U?ltE90ovcWd zP5Rvb>^I8vB1JZIzq#M_ZdK(KwNP`C5{$`MDWxUK0Mo%|0Y9WdT+(s0=MrJfHDYjB ze7^pXGUPN1NU|N=mw}}0nQJdfXxM;kNpk`urLtRXbtOhtPQ@i>4aaA`{H3_`;!ESh zfASyV@{3*=zw&|Ki%MlB?!4_^E9^M!$tMxc?=xK`8?A~`?RAAdHP~=&R`aEQN z7h?VT(RlL7M`Gf{amRu54yhN79g%@4QN$NM>ay{kz7aDbej7v@omY3t5Z+izk zT72)uo8zei2V-`AJ~}#Uv|0T<-ErYLXUFjq6R{t&K-$`3adA;VW33uJJ%e%mE%(I5 zm;X!*buC9@ZYoZkn2g;o{kb^Qxji~?_6xADO#W1*l&HlT>7TNB+7Iqo#5-ZHl@;=c zq8puO-N=c8slQ1HPWm*uTy!2iT(+P_xgOxN3b;Z!O-b()KvXgUO6hx^A_l**g$m@A z06-?YTKEkH?JYfgT!-wvps(?@k`duG&^~Q3<}EZQ@MM=kw=&Z~Nx8DJ5^T}FSHGD2 zg?y3wXtEi%s#U2aPC2SGJt$a=ahiMzZ)onSV`8bQg;0*4LSlU_s{6A;V-L6u-? zevv^nP&qV$C9;CXu8C9A9N#|BQ{~}4F*y^}4jl4ooSIpP)n+qZw08?pvL~M#kEulj z@OYUkG2GW3XKfyiXHLw=!rVe^-L!$~S7?B&HGv*Xh-Q&*EYw+;?STZKwt_!^qgvH0XEW9Z;2O1cPkI~cIwaI?`E6`=|S z&|zXR9A8^3peY|thw`B^6rGs>`w`j;yP4ki)EfX;>{p!vB4 z@zF`E!f?ha*M{XXqBuZa#e0R_fTLdv&Ew!44>T5{ssjp^yE!HAs;1X0$7dx1n+u64 zekUsdS^B4;qEj>N$0ss_Wb7BUf|S93N`foNQ2>yJNI8yvCxcO}Q%Sq?>F0rR!;>5F zGmurVoHI6Tq%GZ>F&NQh2TfSVY<@+smK7#`ZU#o~O98Ul-hsrdLjf=lb0Ew_psfl) z<7I@&AIL^9Buo%LSP{1}o4{3R(fv>)!GnXc{9a@V{zq1*3**;4Ll04VKnj4vd(JP?WY?^ea zrsqm@RtX7g8{Q3U2vy^_hqdSQE`i1Xp)q=dWQ9t3eh=W*8?8_0!);=*f$UK!n*b|O zZ#497i9jl-C#vIxCq2q*($b#9cZjovXJiEuGIk?J9i!Xpx{v~&jFV>!_t z*P#t97CHx?DOu3(mw^;hbq{ePYU#uz1D{p^B7-K~lddB?zAU6v8`u0F5J)_H{Ez+Y~8vszH;4nmL zyaf3I`a@B2S7V@mkmq>f zE8^(z`9zaB^p#aMO^jy3XBrC=NhBGH6%_{*{TM4$w4&$Ft;oIs92hnI%FUFOaDjsM zsRn`2*e$@zy4$87bH63pp9Z^C&es*^Y`x1K5u9TM+X*@pp}#6!N&EA2=+X+XMdj73 z4bJY&_#uHxL3E~eXCFu@kqe`~+Ll3miM`3j%a_7V6D$)Sq>%7u0G{|k5w~FBRY4GY z!QhgC_X1>PhhPpXb%iBen)@rYKJJ_2JInj_6m<4nwG3{hGs6ujo=yc#xm+20s-!uI z5fJ1=%d=kiW|@GLww^x4K8$N%>N)Q$WzR7fyRAZ1+kwvZ7#r%1q26war9kzK^wr{h zDUPJwU9lWKVj?D@`X9g^6chluLy53*Xnbl7W%<#;UcPL615_!@l7Q}gZ>_`4p4to? z0Ogl}P0>}8^q~x>2Eky<0Wl)C+XIgf1fv9l{tgTw!B3%@u(Y%qr>16vMxj!&1Qbw< zzj4DTt1mFzsEUw>yRsG|{mP^!W)`Bo))hSn+GB;u#m2#&cxHS$HjS){p{{DIE;mqn zk0q4amk`7^Y$g%QFTJvExDsU zK*h%Q0pcNMAf{(2&#YuA5lHj-@O=jr1=8J)iMQG-N!?1v$ODW(+?5ji6xYB(zx%u` zJL>2=C4krzo2a04_>;z!$r}O>N+Tz2CYwVU(m>{^?!r^FD zRa+7fku09(7s#e7K#&@VDk*Xjn3W=fOCbTH4@A;kDd8Lghjx*h*nN!&!{kiu%r{Es)^O)5^c-9*P1+K z;-uzn?FLaheNWgYbXFzVjFm1wI7{t7rAfzvBA%XE(%Pcl@Qh@5lXEg!Xet`)spfRN zd#Jmy0%euBR6@gNHX2R#H*k-qTAtUA@}E$;^ZXzJ7`(O&GF1kxKEq_fs!vE*ign0H zGo73BF0G+>w;HON<#JUWQ-(K%G=#+Ici4mH#z5FT(SovH!@+M6y|^-F(nCfRat>!K z2YX@rVEwxR_H=aEMz)iF1xd*1x&O)5n+I8XU)N!`yWhU_>wS8977PXhU;qrZfk=SZ zxQUcViV`i+vPC6|l-Mf8mQ*EG<&U^3P%}gJ^7@ocPbB$neLkc?;med1C@^41<5jaLD#o>9&QtXD@zY~TA4NNK zg)#Isn$s273jF!c6AxCAV)laj2ii=Zb%U#_*<4kYF!W<@gzpb||Dn>*?wL1x{`seE zZnkQ#zx=e_clRB3^8QcS>XoZjD^J;1zy7y&_}H!X;KRRQ-OjpQy?oY|SB}~A?7rmU zpjo3r{_g4LY+7wOX{hi&xAdSPyVWr(YrnJn>Ga z6G)@q4d^TJ9g3ozpYP)Z+~3GmAua&*9YgZm2>C99Z(sn=zU~xE6v_^ipVLc{BuCa) z_9o6&>?2iF(%uXv51v3X5et77K{cOAP3GZO!}>4^jk#3>K%*%cbe4!M^*MpwaO~hTb_tMZ?$y^eZX$ zbYfJZx+Nvf)Mu)fGVCv6c>#c4C1L!M)IMd$3D&uQkI!PE6%P!AeYT>=fjv+n%SXK+ zwPMa{r9AsRa35?a=ggd8(&tJb8vw-whKdV71#<=Jy8Xe(+TA`Y&Y-(aT-s`kI>Vlo zvKex_fVRU}^*UYaPncD5;0{j_S;xXqU!U2H3_P8-FHX34mTcJ+PEHDg7^piTIKZqA zP!=cdLc0RSTfzOxW6Plg;FE zuDCu*x~?4MO~u&2(&g6lZBR1c)aGZVZFjfMXJH5x8=XmkszvP2@J&F~l!*x|7SR_n zB!vnqhJZmRt1B_M5fPOoRU^Ukv$EnmXvn}~A5kip!va&bzGkx#|#R*cR%Nt{9H$cgvwYc;>Wk+R3gd7YM+os zl>~jhe|&z4<^gyG&36{gQw-h<6}jkd!6HeG(5H913JL59) zBfv@Hs8giJ0v&-KPKERRhI3NFbl+^=*JO$u=Iv(NHg}uW7+^MtKfiOWskRoCXQzuq za2P?95ZWC^c4?Jl|KgWsoDy&TEIC!M@dFx!(4o_{`nfKndiBaGBxh4DL z!w*^^leLTI-m=-5f<61=*X+@c{k&zf72DmpXzOcNY;OL5&CKp|UcK3%-?HIw($+4& zX{GY4%`Bk$pypTjI3yOsew&qzjg58EuwQ-cb$k8wQ?_<(oxMj}yPI~?u_KHbNGl%> zY<+#xYPFheHam9Z(ltAH;DGhIZChDhw8rj^<%^L0A6l(aAy^oF9RL6z07*naRBHpW z`54d)^-T18zWd%e#xmQxh%H7oGh5?puh-j@<et)89sA*fPFVjGD2EG4-9J_5wzTo6@n z;tU7c`Q2fKP~>aMpuP%Yf4R5rEhrK~cpm-I2O0 zSHkjYa-d|1>36?O0zZ=-@0%r>4_o9_W>2hTO@oQy71HpiZfbS^NaWFT;O91(l@y24 zQ)j^=A3w}q`1qyVd6yGmn62^sbxv`r)ZR5l?VvY9!sj7jI;cW(GEzM3BLn|O$j|9 zm78Li-KlaA#H2pu?ORVQty z*|x3vuFX!@Sj~X+Y^hizcM^ZUvE8(Kvuo&=fD#qD>NlV?!Qi}L6PYYOg9KuGd&dg- zoUQCzq<(n4(PHz<(rm@%tEkvaPy!FqezUb{YI4IMA;|BICT)GEMICSSxpcZ6afL@C zD;IJ$T`k-CR^1!=)BsKT5*n_N5O5A%pVQts$E2sGRQ$oSL$Y{lr;$v2hlC&l4>q)$ zl}ZItmU@_m#Z3i;9#kg8zvtk?sR=5Bao!11V)7JIN<;)Kqy&WnPLvlEY~=GgR@l{3A5=PmT%EZk~QA$!w(A$ArJrJX$ z+1`b#5JY=+6wgLP#h*ih0g*>}1F8q_e2;`xNObX@k3iHwp99TO0Y_plWA4eA6l2nh z19St|Bpu#^YHzfTwcvJvbG)wETUQU&HtjYK^6Bxs+Q`a_)UhH!PecmF0=!7f6bMSi z2#QdkQE1w>PXu=f-U!->)_bo>>|-PwagHKEXM?s^_A(SrfJ%~jyCBa>%2!mUI2R~X zYeu%)>S*X5?PPLzRQ-zP=$Hc%bBdf6qY7H|ktrBP&k~XcodJa#F#dsNLtT#wa!KH< zdm;VN6ASD+00|O+5O}~q$M>&z{(-kAkfQ<*R~1W>cuxYxgWJ%x_oOO$Y6no*2zl=leM6-Xz!4&%fQMj%41FHM1Dz? z6(k(C^Y*2@?HjCGqrPL8S1;N8!Q1Wpo2TrvpZSb6>l-#RQ?@tWxoCHve3&x)&Bm%- zTfJ!emTzRDK~n%^wcln!u!kw=y%Fb!oj-rh-aY%Sz5MdacIwpYwsc^hz5CW%_M!Xl zwQM14Te}Uab=E4=R;rY^vJgq3Z_Z5G%onhdAgtsbwndUc)PYO~!^GkdPcz7o(MU_}PjHwVxZpwbeei6$-I8AmzZX6z zy|%tmpeFBwNW{n{_nf}($pw>MSH=SPnfR=TN}{oxYjJ%)ik?beLrRjL57~B4U;GF# zW*aLx>-W535kO(Eij!2^ufh9sL5Kj(*u&|tpM%Otg)s5eUUd$?z$5SHQ>dQKpjXZ1 z0Mlwv_ZVqol|H;K1nt%fJ@z%_D6t+iu-btQV9+3dPP8MGb2$$4gt%4ogdj<2V|2sCdV7>-w|aEQ zhx!muaI>u)9M%j=EEvXD{#)~Lqb4T~Nk3IL@ZAVVkbnS{U_-kPc*6#wzCJdE zQ>w5zRk2c&DrsFF=%^P%%01Z5oMssb2@VqJh`7E^b{f3F`JovX20o?lL@?kxoSsrc zV4g@}>9JhlfFe*xjjGlpxZ2@R0-696eD;=E)?LRy_@qK=gm0KgX#H z3GnAnjAulJPi5#xG(4&1md5v`^g%o`r=AnVk<>MS2D}@p@u3-+bB2^)$UdY=CEg$g z?jeDZ+LkYb?`;+++#Pa{`Ya1L1xfIFf&kShNQHVoj(SmqFo}NUTy3a3p(?BrnJQ-C z#GOYTj*t{E&caZz%g^Z-k|1QfuOi-eP`U7_Kvq)>k_Q6Kl%EdeIyu^Kueyox?^fXNd}?L@s#ue{$}A%TK^3oKewVM9TsiL3PBvJ-c&% z$qJiqF)+D&<+5!R4p`&8SMBfrz0X;@Rk!KsvYoxSX1CmSl6{?>)>Yfw*s#TYH`v5f zfsL(~FP*b@-+kAfdFDww^Zq$jE((PrlMAHGnDfEl6Lu37!6_t|eajWfRwz}hvD;)t zd26R`bF(uFjvOe%xh~~1w%hDmr;SGQ0q2~+p0WRtYLWxmUWmZ}e85?QF9$0DwxC?d z(&u9iTBTg%3=#mI2--mh2k6M8jN%k%I?UOHi&t!EZo!(}KA#C|zPvDN)6*5Z`y-#R z)!92F6AWH_4BHd;QFI#iQ>gbUs&A5!9h(UfbOAqHavuQ;rAbC43bdgKQAmjgE0O-S z%n>M`52@X>Z%OA(K|O>ol3q^lVc}Vat#y7R&kX+0hXp1HkH&H&wkJu3{FW)oLG$G2 zCTK|Rhoj=Jm?3&9^jSTJ&(R1FWUOCH)jrv&r0U3iU5|yr{>ZfZEDrf(+zuQ5!^ZhP zL)t&U_*A+##c3m6h}ROJ0w|+gRV>KZC4q=I=oPyJJ(QJ#WOgBjga4JXQ&!B0WuQvjq_z4(+iCY%_)pgf+N4SzQJlixm2WFEFK0(dZ}2Y+C#VBWAI!lz?iYrN(#-0Mg-+BRi}AyF25Yz3#rqy?oaRGVl7aL-;9!86ZImu+*mWsOEt zi31T|@c1&Uj`Vw&*s9@YtW0^3!Tt=dB;fB^o$@AhRIg$H7lVKV8P*V)2(rl;Bppfz z1O^(8i$)zhcp8Hwh7n!G6)XZF1IjLNHl41?#KNTpV>U^|LZSvqsSD2%P0f%Y6eO$= z4*$&{!l%14pmH{8&`scQu$S?f2>v3|j{sf0@F{}B394grLb!Gg(JGjM`Wd9?oc|rt zn`FP}IxL-{Lgk4A`c7c1ajob#P?+N?So|eeH+@F^8G(T8sgWzG6r@HraVFlok_P$X z99C5X)Lid@O2mggKr%GZ6N5MwK*sxYh?MWm^T5cl|bRY7$BAxJAEIYEJ1QQF& zKf6))Bm(DF4SrIr2|)tRILWAr8jc<7Ld4&xLkeJBPL#@dzSmhDi-cQfcsRTW-09f; zd@BJSqb-hAJCdLxNdWvz1q;%PDv=7iOHT0m_0Fnmn8xL&V~2s?XexO)>OOl0gXzu(#l34vXQV+QN}g(Rn?G42k*siDyk02y3jT` z;ye}zMFm;wl75EI5T8q`sp)$Qv^3Tw_FnXmNWj3GTgMYq{>=H`zQ^!8oN2+&rOmJM zDWE+Gm6uPa7`XS_TLj)tzxAH|^;f@UyUH?L9RwpJ@yxi)Q=SFc#DHqC$vpkb%o zvC4FfF#`wpdi8l@eUo(UX0v01euqp3>}kXls7w?~W$O<5RxK2)+3nfP^o;DvlxCbD zp+NisI^qDms0gya&=Bpx8oPCy$V^$Q(d1`3tp=605MSUu6iP+IV1l{1dE4u??dVN6 z+P;KB&t{Ag_(Ztp}PC5^4!tLXplg9;Lr`7wmm(Xkzwl zktFTfx}NNM#a{_X_#{6EJiiWpj5kO7cZ7&^fGXU3-XDnfiuPtcp{ubaY>=qT$J`xH z-lIY~?$5$jL}DK2POI&H)>Ys1@anBd8orZti=GOvg3#B->iGd=;v(QKU2FG&SVz1= zXLor1<6w(yL6S7Ztdk@S6sYTwM?x86KdXvPV_;@#fy0_azX~c&l&}v~Fsh;nc*V0L zc12GJk_k%g0{9|BMxYpbxQCdVgx(OhC1@uA_1D!gBdh?p51To0=JK`C)%6W4l`D2= z|31rO3NO*~A&o#Wm$z%1+e|1HXKM`h88~tSAo1whbX2{5&o%eeWDPmWa=AjDCyW^aVHmeYvqf4LlA+NELyRDMyT>F0$OsW` zzLKVJR2S4QaVT4kvnwNeC3PszuNzCT(@2X)V;Jux34#g_-{+jaBrwk)jZJZQ(HQX6?eMvCgRX7(NbuLID-Hc z8mA0VcU&~C;O|MMSDrl_Zj>fPS%9-fKM+)G#Aj4ripzoq8Xg`v5J_g#HZZfl<=J>jx~)W?bz{8Jx7=1K$m< zKd#AS&y5)q5Klt99bSlHs3l>qdtjp~heJE^)1q^6j)7C^Jc&w)Pl2YoLHFb&N}^#l zq!Q(UECW%mNIDQ5V6XzqF{O<$TtjL+sx*aw1nFEJ&4k(1K$}SE!o2xs7ODiRTimMWx20Rh06070hLG^3EQ3GK_upfbYpy+PnlV_qc z@X8AB73eLh3{1cztN~yEYH~OWc&$>_(%>>suNu8BK?#Zr4Al$51cZU7Boakyf~^r^ zs6-%bW|wnzni<6g!U4JScZp&>kE&rzYF&ak970qLU@IV65yM9rSR@IC&q(3D487sq z6I{|0LPl0Aoa|ZO6|mgw{Cy@{&OqRHjf!i83MtT|WFdk# zhf=%`ieQ4%s|3n;z~cd?OrFyo6PxHXm1s^)571Z@E{0PI6{nzzCzzy34*T{~H_q7P z+G*RrZ^fQ@?uWLs_<()zP|1!TTC(l+YgVpQY%*8noU5mv{-Hhgt*_f|W0yUhGqY98 z7a+)yWxx)VDF}sBXBVu~>sXJC=>_ZWVW4l_cIr)QG&}6G$Q1w@7Oh&HwpzJNpNp7= zK-OfI*8+`d-{LIQF^i>wRjW07`IT1~BOExe!ioeK4y|_Ewzr$M-DvPW@WLN_;C>qo zG(O{Gw=%Ql%UQn?c>kU;sBd>|?YT$C0emD?{lMcA>Y|YR5P+cnBB1AeVbN&Ka}CySQqCQux{PctnytQJEe~*1Q4U zkqM_j3y@0UD(?@W(jrw(0mggNdJ;N#vf|$#zA;!}5nu4lM|FdJfU>#NPIZ=!rZGUO z*FiJLwsW6`dYLLkj4{2RGQdvmp?BAJMwhRwSuvNf!z)WHsi1)wFAg-O?Rvu|vU#dH zOr!LeOh42Mg1jwy3$PJG%>YP9W>O8$>=U56)`V>~+P25W^Ne+yZPJ9K0)wG^pl?mt zcB5zYR);0=?M9!&1QGWk`+@?+)vX5ky0|u|Sy%v69deVCl*fee!YhM%1(FH`2tdO* zk794nmKSQaG&@bhwB2ZvriAhFtyY`O#l>vK8ofSCsu)y=UJX#Zu)akaxx7`2c_tV@ zPIK9uZEo+XQiJL4!=7cbk}1wj8V9#Py&Kh>Mn`HVpkv`BBLTxILI$!@&a-O6>IcwS zCJmUhK4GO?-dc!rx?M^JL+%wlG|d(?{S^ckz!8T&00Sx=xO@gmFR1SLut1lz6oTr5 zfW|5c*eKYzQ7U6F!#)s2maLxmL~}Vf*TfDF7Xj#)qr)}u*I0jCH%gpI&k&_BrDlQs zzyK3UUZlQ+jI+~tnDlxAL)1~qLh(m54;Mi2Fd)JKRTEUl!JYsz&p_0JDh75mQbX$_ zFe3*#!)Nw_kQNOn0o7}Q@`5!&g$P`7C47Np5@T{|l-3bZpHm&9f!Wo)h{|}dC8v|} zR(aoHR2}uj=TqvBP)!%g5+WQDxz6-ePmdbdBz&rV1STMEgrh-N&Ol$JSs|jl1UfAh zpA^GRup$SzGzZ3$(`W!p5+q483bDa=gcP+SzGKEY-if}+m6?Ek2a?91Q8X+)Puimt z|4l3|lFdYVQhOO|s77yL)2KvNORzVhcJLa$Pmt*BQmVD*6TMMkMFqtXW0y5m@T%+L z_cgRGO*n`rx%0+ZC)Lgod?8U$74v3bI&c3S|2gZ(a2Bjgt1KGh!L{0csb z=mkk`m_Y3M$@nlZDU2zYX3*ofqqxIkDoYcpjPj}>=jZ}&tf=C=V|sN`SMfADDi;iF zpeB|E*s2J)+b0_#ssxPk~&WH-{LGL$%glv zB}pJ{ZOChSvg%1LlO`8akXlbl(^GKeVW0P>0ptmL8X_qSKs*~e}_Z2PK{R^Q&V#~ypa{`QIQS*N{g`D)H;wW<}0 zIVKaJUxDHQ`o>PZW0TpuZEV%qQ`tk1Jeg$=X}MalY`$oV^YeD>*p0SZ-?i!5j9pp1 zW}Rk(LNs##OG^bS6)U#6)3hg_de-(WFWDy^JZU-W@%w)C+>h;+#sp^t^|4uk{fW7OnMTjOAq!srAI8z`2{*ub7*bU>Apw!0* zR^oFI)S1-v!b!T-m5@)=@YAYoyhCLv&Vq0c9P1U7(*X4Yxa8A^7))BTQQAn5#QU>? zP9ET^S2Pu)yC>$?hiHeCO=XF64cH~=r8sa){+z(OtO0;m!lq%2TH64bW8a7x?+GES z`^D|nh!YDrPCd)A3T0VGdv;~BZo93v9bR6v3^$qPfuJ!3G!<$&6AeOhAGpXF{$793 zV=sv2e_)mcUI>yEBm-HFa9`U&a)2Ojf)u0d1j?jcYxhSQ!Ut8UeBO$ss$E)LBkImW z+!)wyvt`Ts7P(mKo0~-cQJn!TYcS~8+)RZtG`8yR7$qVs!&Ax!cB6a}tcGc!SLW+7i?NaNs~iDi-q!(?*cyow7oCiU}De$AjvH z-~h^6plvjeFmzQ(QF1Fv1db)vVR5c(gZ_y9B2=*AOV?}>BtZxwfUy=aa?+WbxGf-c z_#On#aoF&(q1b_hE|H7i~b_7HL-yh%P0|WUv)*8K< z;6dI5%IP?42*{l488aY=a{KjZ4E&lw3kx5>A|?&IE2D9$y?PsxN%YQNVzLtD-%!u+ zz8ExWGl+Dly^u|$4{%-dB-n{^FcF@#F&2A{Iv_A4E|Vy=yhH2Mt>z}<0;VZ%vJ zh9@9NMiYsK_rTCJl2_u=u|%$wNHT$-I#M9{Y5xKHZjxCCfnIxUCmNdr0rH9)O2w6; z_PCOU_-<7@08D@;3fly`61@cq2IT}}4{`=jpq9~E?SVGlvy^096u}c!fznRp@%bH5 z(PG-|6))_Pn7xEOJYGd(qje-T?2A$|L4-3LR5(YEEHo2DK!H&IC>(hel-^9fDQIQd zVj2*u>$+yYSGJTSxpVX+B1i(NmZFM<;P(0{&8j9jRUtu7_5O4=LSaT=O$boyqv;G0 zCG46%1$r=Skpd2v4EEqekFGwo0q(^=q5bZ~Mh}XZ$KkpFgJJ@C>{n7uJU~jaJY73_ zsFXzeqWhUj->*ykdhnzzk-z{R281<`eT%(@$8wUZs&R=nG3Zm?U<$jzeUSDIC~(pK zU@uc5g{*5Q73!qQoPyc7Z`k9Qyw3IRckF>< z&j!7Yo!_k6%F?towys&ZShQTeWVuqs_C`}S?01=zz#g7I|DN^x9h+M^Y@6*#8#Z=0 zZ>%#}umRW=REIKK+upImhY#39Yr}foCYc#)YiqW?)wDx5-fkQ9t{pwJpK;S;kA0gx zp6%UD%Z%D~;`SS@T&$7;_|D~)Z59sN{(*YXX#fBq07*naRJ$Ls+CB|m^r+4QXb0m% z(1ZE913oV6&mILIU>N(Gf$Uf!qQEwN$E@_yH|abozJtF?H#6ph=v1jPt7JN=ghBTa zMM?BAEfc>wqR=6V_^X^}<|I5C0B+ zDAo{z3hVV2oi=!~7?v~~0TC+Di9lHZ2Lg!&ha5WcihW5X0@#00O7=8760NNH{1p3H zFxeG>E+}4jhxm7V2KxmKwfKEenRKkE$`sn~F+rStF1V_~2vl!CRYFpOUK1IIv22{f z*o3-8FfG)6itm8P3l&zB=pg6|s)e}6DWa_e2m|I+O_NNdk`=sHHrGyNd`5~;U{yO@ z?T4pAMnU}qGAcm48F=~scpnI;T;E&_k5p1mG&M)YBa4su5n(JCRElSx7#Dmm`IM5T z4lcE5G%`R6ipp5j_%VpdfRtbNQeDQA3^#tDZ{+M?qGEhN%Rv zmM|(M-XGvIMf{gj(@ATCrGLaAk{b#TfU|Er8SwX!He1U711`Nmc#QDX^Z<$iKMQ1sj(gF-En}gTVN%Kyah7q5eHTchSTfNteexvGNKsgnaW2 z;`xU?d+7LnYo3424j;PF)~}qkuRr-?d-j>{Teg56$Cm94`gZWpiZwd0h#9LlhXewl zl9?@(tvWMf`AXTQOC_t8r|qL3xYP2O#9S%c<;z#>^5sj`Yh1Oh?JZkeTC#4ZZ3_!a zoaq4{a^d17tGBzhvj4E%ckjKVWnZ{@%^IDaz543w_Rjf>wtxRV`^Y`F+UkX~wy?Nl zm1@m4*4FLPrE|8qah1M%x>~i_xn(|bS=hi#6nOU&o5C5Fa9XiHDClu~PlkxKspd%7! z->R%$MxT$r7i=H|kO3Z~b}uUQs&*m)h#6J11u-LnfZ`qijzDq0o64gKu6-5;Bq$Kt zyLhuf0gJgx+U#kyH_mX(8gmk%)3e=&^Ou~iHKr;_a4DY6s|-;^9XDyhEhABKdon_E zv|@NL7Tlm{P2DF3Wh*_Ou$?IzLq{Qv3j(L29q}Y4HLQNlquv-atLu`%czJFXJdSb? z?RFx-90x_*Ht`Ak*ON*}!a~z`iy?qN8i^q@q~s;?Tg6QNu`pjOOgZ@L)=mkR_KWPc znv+PCr>#7{f~Xad%sd|kEV-RqWdV`G8mrM6zq+x*MzocM8uf)I*$g(c&3fB1 zxh&~SqsbiQ?LdDTqK~B2G0RTa+QydMaA1iFQBcp?ZMAIQe2uG!#&PsVpow&DuEu^7 z3?Rfzll4ZI4errU3PlSTJD~DtdIMi>9n;sTu9UNSqsfMA1a{!44*PvpT=3kWQt@SS z(z01OpT*c7+t_KcIks9X@PAYJDVr{rIp_+qdoU76SB2wa%5>KXR z;5K6)o68D-Iy=X#p{;WR-jS)Gl(bSDE(49%)%8_(ejSBv4B*U?; zK`Ej$#IJZ0wy0jIS&cm>ClH92ZW25{*ey*;BMJtwu?O&h5M} zmQ!oBDr3oqXVEn5EQC+SAUP$lu-B^K`6-K@8W)qm?&6f%1pP{-nu&rtEi8iNNS2c- zjBg#a;ssa%uCegnn<+12tQAI9wcGm^=00Uy?L}bR%$HH~>X~!P4Mrw8kbuVai~S- z>QDQrm+K17hgXO>_cBoNwW{$v}l#VhW*Qb`3Lsi z*|%+GVaYb@Xf*Fzxm>eCscO5J#kIOcY5hW>Wc&9m+s}ObBX;Y}H`>9K{gyAv&jJvr z<}pAMaYNhw>`(ur?e47GWIk{EmJeDfk2xZ1Ha9zKT{f9lEMF|zmDNjj`QjxzdczI& z=p&EV=Jt*)Ebb?z>$^XE%DU~kU4HMhE$=@--|^O)Z`gA$Ja3n;U9)^9V+RiGvwS{d z%~sF$E$y=tx1X@XHyp87UVYJ)_Z_mGe%4kmU$jRaddR->ci*RU|1F0WtynDC&d!#- zdFmBgU%O^2%lquWp~H6Uwma=xk3Vj=-+r6zY}RdY-+qn;IIw@ez4rPkQoZUso16=R z9+k~T&n|7Z?C{->+VKZ|)&^4&%JEoFeGmXSTqR06MN$UA`GoyZh^aFtfDJ&xI3>xA z7r`(8{bUgD7^O)@)2+5w1K2B__Jzn1rBups(FXbmS@eWdq)J2lG_3%HEe?`WkgEmE zxeAxt^(0#M>PA#oc;^mO=o|>JWw4tFz~~}D*Vf;q!T)%26-r~Nzo!>Y&owImY2;2o zAbinJAUsUY5HIsSB9(VQL2#g#np4}B*vhaMo-rhq)awApP|l3s7l^32Sn&=5*wdil z5a5;l4_`H20S)D^^nM8rdz?X#*^|)_GK#gL-}YtYKb_%1U*LOcqCFaoFrxxL#57pQ zrM|8_pQ>IFQ}X zPnT@e@A1V^`WDm0bC_e%r?z*cRJ55&Q2`s?(NxBoeV|`MR%@Rj0@kYC6%~qRpML58vh(`IMUE0{S?M6qzjhQXX zRIFG8HELj;e&2H0g0(swzEDuSa1C6ai5%3fhT@C^0Y#$5Lrur%gZiAR6v0|3MB!ca zDU&P}ETa1Ed||v$y$Mwv(nEY|bo900Uho}AdhkCaN$9(w1Tq@%Ia4G{Lr3MYgbJ0) z;lWAC`AO1HO~6tp!5<`KQc_T&OC&!6wm=~KSp;bitY9O!CNiX&P%UQ@ zN+WoVkls|)QyhF%q2%}?0b>(>(z6kWZNN1Cbz|rY4Za)eKw`MIBj9$Pmb&3(5-WI4 z4eq{J%1?ZjNCdl1ok@)K7zIXoNSfT>_eEL{VsG`hx%`=-9|LSAq>72EPq{K4v1(Vp6?IxSo=NG@)RC zMt)VC*|922R075t(bM?C1GF)eHV#_!*0^DC>Z1oNJbFF=*7sc`Z9&ISJf-R=38Vh2 zF>I52kdpT@8p;E;Hc~?pwHDM%aQMYT_h%=^UPFcB405mX%ax|kev)eCNOG`C9sOod zhq+Qy8Jo>dTKnQD`|)?bLO+%(WbN|WhD{dAHXLQG*+MU5&-N`Z+owPFQM=*5B5nSS zHyp90g(dEFAg6eiC;#p-d+C+e?Kl6?e?#B&gD0P`Q>R|C`K4t$dEWyZYIy3^m+jid zy1jSy9Q#m<#j@RW^KrZR*5g*l_uES^zif+(^H#~4ojv=Wz54QV)@amu7AmDYed+!KN9?{2eb{!kx2-%~ zv#);h2|IT5CQepgT%5D%a)AlfZlhuEzxxjT{Q7Rg4&V79J96JAZIG>stssR~y$e>y zH4ljXogx56@R+@6*X?h-(@B0tuFCy_3&bSnHtcW&)KP8pL^KWz?T7Enq^iNd+ouY7 z4iNS@Obl5PV}J?c7w_>%@(Qm41Ne;Z2-F^*=cI23JMr9#@8X%<{wFfF-jgzJJN(d- zb}FPGVJb+*R&{kM5%MfWq9rO(;$s}>VX{S`0}tMv{uTpYlSIqk+4ytnwo@fd_H8mo ziBBbHqWXUvAWS;>5*l2Z#Bnu3RLECGlsx%oz5`!#O|zE>O8^@2)%t8y$UGFHSxD8s z$Ut&HiXgKCA7U=(o(LH8ITgba^kF}&gH?@we+0A{^q}2#hmLW1epUi!qdoRjz+s}n zn_AeJjOb3ttPliX0-`&}*kE+Pq%i?4pHvexZpoccDVwF*M+=BzyTd+-JWKW&>!1fB z2Q{f2t0r&?q$do~c#gp+I7p!HWEm)-VeQ)Hj^#^5HnKOHJ-fEC&E|DbuYfc_zj$SF z+VYbV*65F{)i`I2V!1I zi7%-EP33N%^HlH>sRZTxTQ&^>3FY*9Ped|EGA5arm5K#c65xQ*6c0y(cZdxl^&fHR zAtNY6-J6$vXc#sQl8tP3(%NmPf(a=@vQfxqS>?gK(b=;nLWAv?`8wJ!1w*gE5Y2?L zm1d>jIZ=7y{1{Ji@Vl6`pg_$JwZ}+M%aS7$o`Po!o_YKZ=x=m{G~6%7P0HNCG0_ET6VXcsgMj;1I{2v-$GFI0#kiA#fW zp|GAjg|qTlFjX1SjEV^Q<0)7X2*an4i0{K=9XF2tg9NQ|hnDoQcq6_4Vp3@d#5TfG zPcE1ojW@$Za2CU`9Qoq@WfJXGJWoJKP4vXM-AxtzV3%MMKzWqJt2f+v5(GK~*ESeR z-oFq*Z$h(4G9zE5$OXp&YzjAcUloh{r96?ty>KyKn zXe3Ii)H!ldC1;{6#$YrpdrDcgA&Cu z6$K}fWG#ZRsPaW+)~h(GFpar&chpJt<7d5y!M&k@q0x$1Q9aa<)&g1|%iTVb0cfJ60-H?8F^+*~1Tg$cEjzy?yE>+v_%L4f6jpvv%yJ+w2pc z__USFW!u`?vdq-Te*d5SbNgTZ=l{{xu3fTcpZS5!%+A?E4?Sv6eg8Z5x8MGToxgOI zLnO{+@a3HQT>5Z{PU#ckTZBAFvDWzhlMRr0s5RTd6W{4}bKNJR*(m zgteMYJAdw+-F?>`R?Sb?&en!O;}HPf={Mi8!Box;-}ND@-Efa}CvrTq6jC5t0P}nx z>OLYB8hZo42>dhp(=Y^8Jrk)!KES@tK=dQgot-x7u|OJ(JMA`-^XP?35PA>y$CBCb zCo&=Oq0y}E8FA#_No>uq|N63nKI4@`eTyUXFbOzcK{Fg8|4NrHWJPKV|^uzGx$mcbb=Bd zzCnIW)mvfT0xr_J2kup|8gqk4!rV{MmTa`zqei{KL4Ac{kx2e%IG`LYUM@B>yhyXt zwo;*}9t1cDpVKfHqNf086Ph<=m=Ktfy6(nwbGOc6Kb*vkDW@Gs_fA>6H?;MwEnA+e z*?gs#NXddOB?SXaQp_>nYIQs0A)@c1)0KWdhWDZI3~F6d*{tpE)~P;$Dh7;ot%hET z0V^ys1@RbB_C+;jbz|3d>J66ZG0ogE7z8+Ef|0}2)MA$7=5b)bDed+Zw1ZEKCOXUp zKvhBXB5`iBxvc14ObjNin9p0M*=7)fDeP#hW3|Go42F^SQ;>??vvvo;j5xJKr6y!t z5Q`%*!gFH?l0dBq>vj9QE)v3aR|A#s;tRz>f@0!15J)3A=g_Cr%|npd%3XAjv61+L#J3`F6ut z0!ZNAcD}JUoa2l^I^Y_2eTdliq_`1V{rU^y&{am zKlLm;eO}d6FBHxpZ7ivgj>3_aMB_{dlU(;e zxkM==g+m?K4qiBt$}=7*<`^Z>t7-`a%emMJ06ZQK=k4!Xbi9aPw1ZWJ^W4UhW?>TE zjOuF`dq)&U?JwA5AnH*8X?8m5Q>0`n`u{wfrc+hItO|(l4-dE#pdsED?XMDOIsZ6q z{?BMMjX=b!)7;0t-;*972YhJDI8`{yzBmGptlq|OQzf}U3k?u}!}H)f`jU)?FhVpR zMZ(XsS zX2Yfm)3&}@w|sftKKBd1WS{-i&$6fU@o#*^UVHf&J9xukd-UOt+D$j#Nxa>D_8@rCb`PW`cu{c?-}gAbgv zwQFluDweF>+O(noAxWe@?YDDJ8x%?MzhgmEbzvgZ`;Psw)MLmd;Qdl zcGFEq?A)a*wz=J~pZV#Zw%`5j-?OPq&VJ?Be%1CS^Y+f0uiE|h9=FRE&a=YMUFIwsPdS z-F)*cR<71qvr4mTkYz_vsA+ZZ82Y}*u`tRws_^Yl2LNbyjj&&6bZ2Pq)%vLB$}f*MZ0o-X+Ql%!@wy}N z4()=#E|RkD_?!%<6o+!6>|9iF(w>kcSdJuj%=ZQ*Sb)4&*F8~*K1x-9-H!Pg3q7Zf zYLNQ25Fn6o7Bw}>HVM$_@5AR!%br9I$Q52eh4lo>c*9tiVhm*G300M={;8Rv86>PWOwCQTidZUqT z?`&HoJH>z>Ge&^iLsqX;D$9Y4%(j~?YY+Eqes;!+lVqa<~AMy@r_ifgTeKH#FO_vd#bl#`=72s=TlSzh`CWh{GwMIeu?~ z6_NsHa7R#X{KY3lC{Y-whim4{ZZt3Y6AM2djwpgO^=!vI+WUSKrn z%g7ZKLdvQDo&28V3puVY2bg)#uKogXgz+;{xV$=mijL@6a*P~Kh=j)bFJ$C&eI_2L zdHH>2^WHOrY|2p&pf%jQj_N4~3b|5kXi>5}k%5vID-bc2)ae#p1;GXfA|1&O&?4$} z@Sf#Bk#y<4wU3oQ=%6zJadxx}kDsZ~wsqqy;~i6|m2GjB3M7;{G!sEjNCkSp9cogH z%Z2NPylWU<`t~@WJ~JVXHH-rrqluED**=g485SN>2cW|s$x@0=#z#rAlC*pt!F$qw zB3M_Bi044Rr!sdc?W&#tRiN-ae111h3}xqBty~yt1)E{eHRNlY8l>iBAMO{GbXFL=AIG3X2L-G?saIGH zIC6L_XM3#8o|8G;>D}P#}jfDsf38l1LaM4R%~C zxi<$Z0?G5_*u9`%#&=cB#_&EW=D^-(_8krv$iu-t);n zJ~#|CYWSGJpyx2AJ{Uq7v=OjB93rd$i)RcyTEn5`@_E}if6Cr{<{Nh9!rRv94sEJ5 zZ|7Hc?YIBw@7O0l{IJcHDr6PBb^0ay?%#dWZoA_SyXUU^?8)yvZSS2uPkPiRKlyR1 zmh+sWfl5O*Q?mZBXU{zIeO5}oKS}@qAOJ~3K~yR}_<;xPy|>@6?>zBUo4fIZZEkMZ z+}w(-UU!jU&>oGfh>c>{d zLxiS8rOMk*+(X~g+nch}Z@z5{a}}$Vb8L8Twg*<<*|NvK{kR>wmhA`M`xe*p-h1!0Og3kk*@KpyJ81ctWt+&A>Brcc z3A-`yn8E4F+t>_gVmmxC@bCc$HbTM- z9AlWhCL1q>DwT7PpJlrZUkGS7NdN-$FayIlusoHiGNf98vP23{CS&XMrWJFb;UM6i zvR=Ez`5Ty% zXD@GXNKvkkL7p^2Ua$P-WHQGw90MCAa9P_2xr4Q7t)(J6xVg@XZOg#@a% zw`W`1b#7SDzOZ(b4bEgJO$=jFD}ql7&fb9Xzx}TGwAp-y0}$~Ju(4o-*keLzWvTH% zW*GM~rJbtD;GDD$CoM{r)6}JG!VM_o3x8iI<%syeSwbmGO^JKrpJU({ImGVJgJ;TS z9kYp{SuUUBLBx7c1!{7NRWc+gQQjAaQaQ3@bz|0nmx`Tx&EYzZe#4Mz4g!?Wr12so z#1)^$=m>D=C|e_Qqn@`1Fi6-$*HXU)XL*eEXTU*4<7OPEs3gT&f_FP<8CGPXnH~+) zlnq920l4}c3Z!)m6Z%sOXRjr(vIl z2fUK?Op^>6)uaqQmI%0Bx#(mHghd&1?1#KMB@s08NI)D43zQ`FRx<13<#su^w89i+ zcYIEgiAo0jOZ0EaAUUoa#U5ZNWWeLwBJftp9M4Lhgl zt{&KXl7T(O;e*4GwFj6lp&mGaM-gaiCux3$J3aq9l!aj_Nm&Y7VN|A&@JvjR-l>YJ zj-h}A?Omxmdm=Vo&gVh%0a{#KC606`d`_+PICh77!~Fx*rLvPx_D&pJBz%#V`GtmFJgi`QQ!q=9!Cj;-&-k zAO7QivPP$GOG}IP!IO6zgc@_%Nm8)auddncx7}^O^ozgD>ftlbJ!?-r|AJL3Gj`_P zQ+DFS348ICQ+C&#ciMNKc--DQe@WH;PREYibj+??x@dRZal-Dp=RSMy?7MdS=#rhg zaLE>z4q2^IvD(~%y?_3ab=plkxPQt1^6QV;&wt`k`=kH+PqkI(mb( z>Ra~Gi_cqi?w}pN?Ko*`tCz0WkweS&=INJgcYD*y)fv0}_7gTabJ#Mo2W+ZbvwWch z&m}NzN}?o@0Af$5&j)ll#5hu|>qq6n`z>KO`u!1mYM};3nsm_QhkMo=jwmq>YU%ZJ zeq7NFJJ=EJ05^C{RLT&z<@Pk}cc?R_K1sp-brn#*2WhT&^}xX+39#tgle*(R2XSGX ztpEv<_V%bm1SplDA-->2%AEe5A}0~-N2U~=7GaMPM%hm!Cy6OdDzr(p7IxqJrW4?8 z%;(F7dm@t1p9PpXfgr6gB;+OM$_D$xt3R}yh{c%r$hQfQlteMlxmS+y@9LR!OY2`o z5Ct^Dp|4^fbJ1_>GP|sTdB07tX(SErGTt8ZvJpK7$0-8jeZ-m&$RwRz1&)c0MstKF zWM;}VET5Z0ZDioHyOoOS4y}e26boxvH@cGuD!%67~1{P{nD?!7SHS_^X+0Ay3 z#yFG7s}}`j$$p=S2Ml}>4JV_Kt?hPfb-TeN3CR#P(SeyFwZQ9*md#ZQq;G9(H|*S6 z-DYR2tafZS+dS|nnWI9Yz*=e`)nb`cvv#+`=5+)VphAHHfOj!nD%f1D#6Wnb(Xo0H zhy>OPR3snFI61*211LUF6(l)`ornDa6|110g$8g|mGXF|DIzmK`tWj9xlkVnWQtKD z@Ai8(pqiJf(>Qu9ngRktgNPlzO!U;Me)$YavBe2 zuu6j1Q05dYpt1Px_#D-{oQ4&{-=sj~JZrDmL}^b$Y!oz6t2_dL2(*)+8)jPw1P&tt z6IAusFpXf;_j*+Fr0xUd9L)xSG8Weg6+Tj^C{3HLUl{heJK+(C@(~%(Oik; z@E|K`G>i3~!0L*E#!I;LG4neptW9K8iSXda<2)H+XpcMpJdAr9F8Mus;uCO(01mGZ zI4VO|;|@VT5}kvF%$wX}_#&N`SHOtQxv`26JRD6(C2B4~1i+3`F?jL8MKq}D`%%#B zXj9N#JRxS{$^ISn8!6~_p0oEjgu_#yYi%u6Tvb zpy$>#lFE@g6Yjq8m(R)r*jBIB zg~VqBu?|AI8w^T;3l)$?;TJ$ZAA^ikP(TT^lIKWP2udW;i&yF5@BK>!S}<*cP$Ff} z@qU5w1B`-SfQnfp%kqt`B*g^{s)qOQTqiXu%NPzdNtT?(7xcL#bqdEH!4vrUpaoZo z9CittjH_XwEGpidVFC(HHba{WMgd-OP-(QD+K9Ay{*IuWi1|{W{UZ73^!M0^EUXE4 zte`YxzN0^j=rv{lAn?GsV!ug>xGH&pik;3JTiIRqH7d$X>N~sk#<%~SZEbGYd#f$` zd!PR=?9(6rs2$$7pTm3cI|z8c`OPm{tKGD_Puyu={7?Vhp8N4jwqrAP&pmfoef_-M zb#%oB{jB}QKl$%%dH;S6?0fxB2?!sZLJr*+2aJ=j`I@x>X7j zcIN$a_R)`i!ZtRynCJlHZ0@XCV`tN@ZEf34$8NEGH{E5khwre7d{uMP2=Kv&j#xQE zGL_gl7Xj#VfG?{4V6g~*#g4`A({AjIT#{PDixHFc2P5k`jZgMW)iZ~wbV8#7$TZdM zCzB4zuSNnwd+X>ne;R!Ufr7Z75oJ?py963!_dPvHf^+S2eV;77SHb<-@cohB%e{Eg zodWSbiz0%3eXH!2)EVPj{Xvt;arCsrS!S(xjIJv$Kh{tmmeqY%04pvfs-#`nh}6P( zu@r8J`$&9N(3KM~1WXYmq0w)c(kNjQ0pvz9NPjZcpCvEmgf0Hu!AWK-PB%pl$es^< z49185mMW?6ZINgSun>r-A+teyj}?UNHwfyKsFLTL}GT6+i*7{I_`4~aAam4YKca9ZzlSoLUjdb~c6 zfA&70cVcS7*6VHC*xIE^1WMLGdT<>~p>B1WRw)-)A%HOljR+0zK#V)xf%PfLYE~;3 z>C7?T1HU_6%vmm@iJ!aeft|ayX^kG_<52OLvQjZ`)%>0{o0u}*vHkNiyvF7AEz6ZF zHd`&)xl8M;=->~77pE>DkjK5iR$yv8XjPEcQ@;m-rb!zP`Uc5klye)c4(FY8dO$HI zFyz$_2&xxGiWia(a)F7gE3*v>6cRZMPsHZK`mh&b4-_x-;((%s>H?&4CRlAkwM7l% zQqI7dd2TB0W)Jkk;S>D@7q^gSe+JOssIH`FW+3_sNQL~0Zwf?D&DJuE=-vR zt_!3YU)e`e>B(9cM^=6OovZvB4KE>PgA?H9$pZw^dy<(ZLMfPBQIgLGCwj6M29F?w zqa*?(G~a_w#{LuxbQyFDU5LbtL9=H7I=dn1o1#1kG>)Lc`QNcNLb7Er_t0d`J`hzp zVkl!cCIs@B`buQhXNJUZKCOh`b2uMQZ}psGzY}YzAE!aKqbZ_KX|FjiB~522Cg36m zzIQO5Ff5b$J%Sz;0c5&o(%z$}Vz{zdLfK-rCLX*u=E8x)2B_gPdL&{v(^&6 zi5S8s%F{hL@DvJKstkA%GS=s#bEG}Yz3lx5N?0S1bsWweV$gY%3khvi;ORy_xi;zf5|p? zHtdlP-eX_;#@B6cDr*}XJNAJG9m3<}ezw?g$>firGyZ=Lv z*r}JFv3z#V?tkD>TUa_`m#sf7hkn{yKN`$zRUjVi(j^4*S#gXcs9CgR@5E zJ~X0Br4&Fa>{l1Vj8OprO%Vf+on{yBUm%Bjon-I0&vyGU_T$t?coiaOq4b?zk#pHJJ=-Jo)f`IDeArPWqi+5{+x-%V)E2|zTqzmwP^p2!oaBncCB zR=}3$UvW?_82FJqSHYw#m?oAY)_!)=9agr?PKBx!`EH?$7t2k*e zh;7V_=z@kdWtr?GdrB}04+axz5-4e6Mgz=cW@Oexk3+p_v$YzhZQ~#n@&%$;9DXd@! zK9ssdm7+2j=wQX1s2q+7GTCtY4CVAtdFuBqk9j4Pigmj^8V?#J3Iu=xB_x+hQtn)F zuary1P#AEKIW;}#Kaj%Bh(d)j9;b=}C(#z#MCPmv_Q#`sw$+O zDg?BYBykMr~L*XKtr6oMifaee_4QxW-jR7VPD7B zNXe>fwGzaj(rNwh_ni344dH2xi$f@+*ED(2f_0a%2cl6s#3i`T{aQT7KBQ3lL?wP6 zyYa?!KjVBGftWHg@&)mvG6fdoMuoija9igw3;Fl8iVD5wrQAOp(x?lQI+{Z@N%zAU zR6Wh3A}9iiq*w7(5q0{BzhgOgy_KMPj0Y0`zyGe~)yZ)4;Y`H{X6U?3} zW~FXM$_(}tX10(%i(xM{VhZ5qmdLg9xrlCX-hpy5|fABBj`y~?f_WYz@GWa|8C8e*>C*Xe`VkL z+F#k{KKF}OE>!KtW4GAUWZoWo>?@>I4cgoG)xZ9tm1Y+$lPlU>rDT8o*mv!p{I|bn zzxdhD*s#52&p-35-T&xktyHPnAN_}aYxDDqwz62YuYL2IHn+55`}eQdxwG%vV~_u> zJ$V0p_O);Qo!xi;!#0_nu#4x<+6V8w%hp#f+mQoD?RS6gcP!%yU|=;gnqB+iSN?+R zf)`$S(?0(H^{4#7zxqRO+#lJAyYFRxXS2R#M~)t|jrC1?{mr*{_PedR{r>O#rv2Sh zFIqk~X|vPQRw4Q{|N0N@=38&Jl^YJ&x$~Fo*5h~CPks1PR+?LOu6%~dk=Wlz ztP2Ir?Fs|K9wSy~2iENNxG#`gV9y`{4EiaO3)n3r+*Gh+1%!R=Oj=0KLPf+?`-EXc zpqn;~C+ETUXoABz<(Y_i?B6&j9zUw$A^)g};;D*VupA-*rv0ahawx#7xC-oDz=S|t zR9M|)kJWI-AiD&_B2el5Ame=;DWxm?sEjK;d&mX*bCCL$R13nKxuh@I7-^MC_wR{S z%%Z}xIU+#2>J)Q+Hkg~fc1lFNiouGeOJ#c!#8-1FGjm{Ff2f9Q$|AOG zx>97*40wt4R)+yG=m*=oyEOaxVu=Cv!rZL&`jX(yOkhrjH0C+ob}(R7qMQdM4A<@1 zwMN?p-3}81aAOD1zh(pd$fom{dY-ek&o`T!nIW=pb$i#=ws+~=mXSPUGq$y}OUl+v zrDAQAwtF3J!mTET2KH@sx(AztO4EzVEdOc_;(5hsvCp$ke~3__^xQB*?K z=@9*xt(AG`8*M0qffo!Vt}LI8^du;XVP?o&mAuxS?K%?{2KX*hi^LCZnF9r(s)c?C z{LJ~^5tty*!8;?m$+B9=re$pfe_vi5*;=1A_(g#n8ow=G2=yO zrjl4BWiUJ9#5;E;Y zlHhE+x|Q$;Pk(~5!#qW@n@l)xebT+yIqFT*k=VGFzh5swUHl6bs6|NYXtbj$Lbf8b zN~bn^fh9q&8UBTIangvd04r(g_6Bt#^AUI^YG;YAl9S}p=CcUWs2lIeSyW(T+Yn%B zk0rBJg4gT~uz_qVp_StQ9aiAdvY>3tb zd&b6J^j>)ak}64!HylQ}T>gr{1**tC(VPi}Pw)=6r>6h0=TQ-hKcV#QSnwUMCMuUo ze4{cc>Oj25G@uSK2<*i9e08o4~ zadk8)k_dD#f7cA(J2oh0+Llqr~FzA5rfuxIq(kHSx-zUx|0#{U5)L*2k zJOgX^UtFg%AXt~o|Dklb_O1XM52D=X(C$N_4YqRi1=E%(@iA9~on^k;u;Prve(tt_qB@Bi-a*@GWEX_FHJ z8%Y&CJzo zdV1QftX{R(UwzSTzTtp<@}r-$k9_=Nl;1_bK7dHbRMx)z-EZ4WZN^@F<6V2|hu^o) zeEQS&(krhq4rw-<)@n6va<6CA+Kg>&H`uT7&Y3gzbD#ROZLeLnzxu`#cE|B!_CNg( z|IGgI5B?9^+w0pD`pBT7*~c21ojZ5g=H{v#@b~>6{Lq$HR_y)v&)FCL;pc6A2bC2F z(^M@pIkK5j$^P=s{@gN!ynW>3kJ`reu2rkE_Ta}pZ7WA^Q4io`hH+IcpRqiZA2lx} zWY;;DX{0^f>h`SO=`oo=B0|z5!2ucRQXoZigOS3gDyxe5xqI z{p&M7ux}GEHj+Q zxk!{)2UGP;Ug_o_!ZBqo{|i;VoL1|-IWc^YV4rK+Ol&q9qdesQNE4D10?J0!9XeXM zRZ(}+PWghDi21iHw>g(|Dr0R7vpZvYFN35GWfK$J8hdT=B-#P*mkpPP=i3=pPP`jKV*L^g*-jdwXI!d zc$lk!S&9feSC(c;HQU^-(|Fk2ed61A{caR1Sm^kZ4fxe2IV`Nm|)X4n@qbs3IX8W zQQ}8gA9O7|A9_x>Aw3+`AemGd2G1fPg0zBx;gEFFG)^f`+QHg{D#GLgD0qKBG$krD zq-6Qf9wKl^u7bPi62Us8NJdhq*g4i8+p|t45kiV&_x_+ zPBRu!WgN+oA_oE#RezWi()gu8t=j>wE~JV|VE|JKm-pcCw96prZ6;Pc=`9h$BeX=o ze^4+IsG7jn8IS+~AOJ~3K~$ILOo-?Waavobc8m`>a_mn+9>%V4XZuSyAn&KMTq zjwIN~HKiOAr8HISg8CI{Mhr)UO$tLF0hDNJ0aJT0>%m@>%Yh0bp_jvQINRl0 zu@ChwQNbN@2q&d4-9{=|b#AgZ4AO^1RoMe;^?XD^qUxMfF};%IwlAoASS}`|$vTFL z*91X~pv>WJiC&I1J<6fP?2d49j%sqa9V#G_Hdf^-8nXS_{U6*r>`4gKE1&pF08H0c z&rk#@_*!>r?vUA(?=yjt%3$(7(x5xu8|Y)9NXNv(70$SJ&Q3^emh*~r8PeKN0cH{2 zD^se@s3))mz>U-d$!XCSf^ly@0tS&CHyVb9N-|nZ=$Il$+JybZK7_sEKJ)QFFa|* z!h}8fb<6(MAO5jzZLQmrPkzgeA3bb;{>4AFy=>O*yYE4ppRU+H{}=zly4|7G zDph;nr#@i6`h_ppjW^y%wBIJn_MPv2)9$_J1NOb|eBEAp2`B9(=$KFVEWHLpRykvuF4Wmo8r>8v&02Dmb>>`fl64 z_k*XIoE$xR#GZNf1uK*>&!cO@Uf1faHs^<&J$KHgt5y5yM<20MufJxk!Gyi`;tRHl zYRi3h*<0_tWoOQwv*UN%&LrW34?JXN-o0pN&b)1l3rnO?SEi@!;_8O|*8khqmj~T> zSLdDk-SxZo+ZV}_ELlRf4DyO0;6OqEJKz8zF1X21lF&5JkcFlsVM?a?qwP%Bq)eN3 zrpz>%Ow%MolQv{C1{~vJ;{{`EW6PT?Th^{`|L(ru+dj{8&ih``ia55U`@Q#lfA8;i zmghX@IY0AJ`;))C&obEphZ2IChe5@Stqoh-+O#|Fco&B(x7&TY{att34Y$6XpUq|q ztklk8Q~|~vBx+Lu(x_64GuR#stk&+@ZmY`~VyyVlE*WXm?1#lakZ(?Cq@c+oCcwT& zbwt!s#0^X|-Cbxn?}Q9|BoYo2i1y>Bf&0rr2*2NGOvfIKSylleB$ZWuSL$;BHpD*E zDU&M;fJupQ1l_@|a2uZ_EFokgYPS5G?vwvNNs{E-WQ&9BtlJ5Yi+>YAwyz68kc8qL zM>s%2zgA>L6H>aP;X>0Vv;g_zc?06C=`>N-Ogdu>?=*bIn8#2tW z6$1O@j~MN^4e~U@Lx&KxP`s}@l&z9HxF?#C^SKtJKqlu~_`uUN))-r6quw0Pl}bJl z(NiA6CNNr4)*dKx!~wu2*E*`Z9>{R0hG?#VrX4D1%~+muM8vUGi5a~h;3Q^jx7y%K zn=VgVcVyORw&@Jf7lIv+$^+;|Km_pp^D`9#$iCagV8Nmla~UdQEzZx9CRMLDtUtXFU>MNC!mJgGMe;E*B^4#hb_WTA+5Ak2iOoi} zK?&YNdsk)fTMc91`)Fj1M#sieS*ujaY$ik{V75|Xpo%6h^bFt^g?eD(datj(j6#mV24{g#$;zzR>`-M3O^j0O z84@v}BNFJRcl8))0FH)f%Z>AwU|rlSKs#fuR1Jy$TFubr3RHm7Kwe zF8K9Wf_6SNjEiVtVTjZp0#up^Fb6cIJsNmQB;=&0d9cFc;b>wQFSRjbM4yT|XIvu% z;-Z2i_>FKDqLoU-N#*19MWwdGGYO(bRhC(#p>Ak;Ki3Q8l0RjFNDk+;Nv-G@rzy?8~8>5eDqQls)J z2&Kl=N5Q6a&?&LMP##B6>&cwvc4$@&+tRSNl6RuL8_88rZd4748iooJV>hn3D>?%DnZ0yaW=H%tH+XM zbAr5@t23pQ#k*tUwl^`xJHWpY7zya`3Qwq+1%1zh4h2^V?j%*JtFr>adsG4hDlX_( zXgaTO5G+6-&}E@ar~rr^Fjz;@)HE|F);y3#u@kgPxJR%G5NI~w=Ug5-UOD?)VogDl zLIos;1VjfZBz-k&Yiw;G;A6Zi2VLAYkK3SZ>s?`yTjPn_WF*KmC&*v(Nv=FWae&n&mT7cIUg_ zV>cf=V!PWr_Ti8IJ)50{5@pGrefDv?_UIe!fd{@~kA3%P>kX&upZxl-+yD5BFWa%h z2krEk3wGx8DJy1rHa9x@e_zr12EJ^!5j=$&`iLytaT%PY$S#=yX6w;J?scm3%5><@qc zi+1#l$LOQ}_>aD1M-J|{mF0QM6-rD5F*j+ZRAQy&_IJFK^1|yI+xCWQkJ=-Te#_qb z-uKy&m5SZ>&=dC3$ye=dZ+p8{ceiY5u55=7?B$+2@%#x}URkwLdDd>a<*j!7rng$I zI77g6VIH(@DgQ+h8ORmi3w`d8ikhf^)Y?$If^7Jhs#u&C(-mbDNeSs!=pzM<4+^KG zVj=MWO-qz|iOtAXIuk0f?oqfWGEYC8_K(Ro#TIrlKmR~`M!~9VSaj?8=})Ono&rdo zUr#LPCx9_eh9h~P9ZY?6lE--CHEpJ=O3J^f@)?W(TA)cVB2a#QSkCGH0W16=^+;*p zenpJr=8dzKqTh|6rl)m@ze^LFxEFyBP8-IvT|xPpNEE!9PaiNL@fS0HMCK0LB!4GS z4~au*7L+P8F|Q?DP4tLHN~9zR0FbDfWN0MxiC8PqP6JHFKvH}=;xHzoI^;w_IsN4?R;m}rdIsG)ztY|rAnZEWmXKQpEjFI1fnG?oe| zErY6r??PZ+u**BUwzbo+seFO^5Y6F`=YqKsh%xvbhTSAB+bF05^Ftw6&i#pXtEg2VQvUs(V3v^j`f^|3f2e> zjhH0@XCsYxR*#&E4~a)yl~TGm%tSXv2I*k%0M#U}01pWbHV=}W;QQj7pk%1S;qq@@ zp@Jy@Jqw8+0(B0>a#b(IcV60a1QUA)$$|VK9JtTsU{wv(3Lvqnz=?w8ymHT`*<0XB z3k(`a9T^$a+>)ktVdYFta6KjUKCq9v_u?zEdc;9XIuxRKcq5o6+*vfvJ6%Hox9o5j zJWh7!u%DFv5WxuUEBO9Eo|yVL0xqD#=@8y^g$qlsTyr)k8BAJ;?+v#EOd-`bs}OSx z|sPct#{sk*tMth{TX?%|T~; z7ARn(;d~_a0(o-F1RBUN|{Em^%})nUrY=qtobseIn13jmSO_amPb2rT{!37o2D(Yxc%=Z~#Ds)P>m zp=_#00@CeUz0)PCjX#fH`01$Hz#qdTa2Av!<=WQ*V-P@M??4TWJtL9c`w%&RGMFC{ z=uu2tr!BPcPbqGcVhhzjCj= z_pZAw)9cwk{b#>vx88P}WpeZOo1gm)JGeY!>lZKD-m8yVHa|lkaA*6hbvq+_;>kzt z$>(3Rg{6J=D?k5pHW+lQ)!4RSCTopG%PyQdWBd1AWmjK)HNl+fPSYCoHCw&vY8&)g z_QX@)wdYTru}rpT>le=0ZMWTSFTM0Vd*PL{cI$0#C5;OG7>BPuXiq)=vb9?+J9J>b z{rSE3*)ROu&)C^lPuhFmcbC%gs*?iXatS(q7o3WX4nX$@+ zwQW20#$#40RqRLK_W`^1*l}A}T(zaSSur3GII58b`tP$zq^?sj;6V5a$A)1)3Y?l==96KHq2S;eb96(5v5>sF)K!wCY z#jwvvKs-5Ng`D;w4aRA1+#V1;_i6;rN>tiu?~-bqj*M)I`q=`UkxvuFRaNy=c`?pO zd|JNW*V3=%mep;j>_qs;)CPOM%OpVP7ms*CAXeC7LXV!zL~Thwa0SaDklLhbjP+Jc zLMB;&hX7a!YQWM-fI<+Jsw?^#$>pn;BV_;OMco=lZ%QO$ezute1#iNy70IHgSGqzZ zXY^H(?(nY!z~UXSC)okM*e#jeW@`+zJrH3aJKavt>g|rrRHhl!f%gtW1zA@(Rd86< z=nJC;G&)P#6_Si12I-(73aHc=1Nju}LB14{gKVVAPg%2zLom?9^2)Sign&Yi%xaCE zwL1-4U0kyMAWOMA+~N@Y{%qFfrqoB$?R2eD&TIIa2S8Yl^+w;e>upvOkkEiGm9v4> zn@#JDA&IJLOts$P5W@;5zz=Pl&04))BZ2}?i$EGv;b&(`Rx04|53D`RTf?RLW{NqR zE@i1i0&3PQsv!Li*9nv{3}bAzAs<|%k!f{AMPraT9N2UzXLGX^CPEBySmEe$nmMXJ zP&GkN54u??H?~d-GeNwmh%XXJh$e{>_d~G5mn|v>GuknFLD0h^DL?jyxD&$Rgd^+? zdQ56Chk(fhX-_EGdXmWiDAag7v4JsSKgfV<1w;=BaWwQ}LsDrAeJtM30w*8CdDx#q zNmZwLFWXNEkF84#^wfnM4U=9|=CoSvH!#Kobo*4fm;2%0ZRS6*4_jn+a3iy1ULnKA`3=e%=B#xNJO`v{IWkP{ag!8zU;AE#b z&t(6E?i>Fgc#*ta{IoaDx?w^giw}kGZpAQ2n zUaQuV0jA^0u2Cw}I#DS~oQ``eskHgMD5Y_V5i>f?9`PSi4}#vCP#>Hv>?6thlEUP4 zREjVF{f0W77n$N-Mdy?19F4a;EPr9*tk9_xNso1v7=d$bJ;Bfl>6hj;rOH%k-$x{d zEtP<1jLhBgz&JlOmO%kX%Zq@mhO+eBVK6{63Wm? zv?6kXqt8j-$!eyH4FnxHs%=3r;B&hhj-Vu}N?3RHX*rdV&Hvt817AdyAfGKmFoXSZ zZ)ZD(iQ z);BI#t+qwsn4{Oe$=?3vH(R|{wdK`SYg9L_SX^L5X)x4a-)y#My;j}IGet5q^4V$I z+`McjUwy?I9V1ODZzFsBJCE9_OFMS$kt3Y_g=YS*eDwkQnZNrXJGaxa|Mlm8Wp{tz zE>g5koqW-L^6n2=uhX^HFJ81~UwF~h&YiJ?SMMczV{LuQ%Grz^J9eGD@#s;j_xg7F z^jRC{r|p4DZ)Un`) z*#FTVS-p)OAT*?_mksd*5|mIiiXI?Qm!bzl{)dUGYg$WRLa9%Ow#l|t!V3~)sKgjCzKZyCy$>3l#3Zm zN=3p;D^6kE$j_}Txw4eBN+mm_q{bH^xpmlKk2oB(5cuVZm)|(0cO4)K(g6W&pL@dC z!6lak1WSY?bAEew44JsdjDP?_6B zop#r<7$}&9Hn#4sfu4)b$OafB*vDX=fmNpSwtsbjfx!9oU2C?Qwz9Nj!|{~u)avXX znJ*WKj#OK9Yqd4i9QTTHBtZX#GKPbxVIC*|s76Q-kZ9m7;yN>P6B=2NX@`rVFhQ3pOHQ}_6Cwak+)G{BS#w7z<$Br0A&j6;EtHX;4(lZ z)vPQos17Lpj2qZbB+dcUg_2;^=|%!_WC?IxCSns@$t0>IvM5SaLUZEhWRcLHgJ-2K zKcfK!s0gpj-5GzzgbTs@%5~~ViLNy3$M6LZm7$%0o$!N(q@_Cb|@qpL^ zQw4Jh$^8F>*tm3W7@fE$tY0XNi6$eNXGy)L0TIqL#3HU}>UL!w7`>?IIGZ*}5aK;0 zDNB-osBRKfJ~@lARHlsY9-#$TP26*N@t-I!vw_j=0%@#A_pguqy5|l!H2(V{a%am{x{!pla2cw_H0~S zU$f^=p0bx-e%U_oo_E>dYp%BMJpC+tP~LFOHJlAnZMN*f`lcPc<~n=&ndj{XZ-1LT z{_r>KEw{bdhNHec_|Ri^>eMSXQ=Yb+%`J`^IC#x9tQ;LZe8|q8K5Mmh$L_rAL-r3p z`3ttXI4k-m_5mkW>pZLR*eh~u_(gw{`j_hH18Fol_lAw;BTR00wgyzMuxGk`tF;DH z`P5)l^@fnm64gEWkLYoTFj>JlZG_)T#M%>uG9?5=(z(fXok<%PbZ(ysf@_AQr(bc# zLR>>MRZ(OS%m!6D)S9AaA*s}PGqnJnlwKZjYgm1`<`8X|r1ggX7V;zup)YjZ=6e>8BbBU1ISOG)T<2X z3TzIgN=eRYoxW}ER5>?eb#Z~s>ZlbX$iM)fcC#(M{%B-Nv$K@cD-`o=HiNO;f7ObO zhdl=7?f%HNcAGXB=E%oHfDVMh25mHkflr8-gu&wox|p zQez@niYF%88mPSw)na31oGdpaKDwpH?`bDmQr`#2VL+88mZ;AjunTO%~ zioXxL9qu5V@q%3nr&P4p=<+4mt=9Lnhq zF{wg0`b}r<2`}e=B#DIp2H0j+xCxAf;*o;vum`NZ#9jE>i4Uw@F2po?J)GLZKv&6* zdKk1|I6ItA;18oG(-~n;l&=+m6-X3E|AzlN8Yq=_jacc6&Ka&T)WVpo%SK01&A{Km z6S}WxkaVUY4_3pFgDI`;MIrizx?5!+2X>2z5hKwWTQc!{&{V4%U(YHnpLYc%k=8@Qy;zCPMtn&>sz~& zCz{Ec_?U#4)sGM$a~OYPL8($9r6; zfI5XL&d4w^7L8fkwT|syo#TD)HaoTr8C@g{*{sdXU`lz#YE8^68QOFa++8`v&D{oh z!w2>)S+(AbEv&>u13f2@ zLIa|QQw*n%Bm>3^>&hOBe3tW9lz>QaN=`@(MyxC#aHb4%&~+m45-Px8(6#0nN^)I+g}G3e%3jE+LgDND1{SpLIeC5(aD~oJ;jkcnGOV1UH@zZ#c<7 zJ$S6y^MXwr6WpDmR-l`nz$JhNlko|zsIN7@NA*%K$V6#7HN?TimCsP!MKPbyGQKM>kqX5~ zt3^`gNFr>}ktSxg$k=$3D$YMk`078<{dymQb8wZEL~nw4NeuG2Hffn%0jg84oKMPC z^wM)`!2NU41n((~l$U&ex(Qcc7#!l%*e9P$gcZ`@TzpyF7{C=!aU@5rXNc5N&y+Uv zV@tWJmD66-h^N^MqDm@2pt=jqoxmIJHLR7>ZR8-sIcYzu`liho=T3tHJwOa!NQ>^y z$Ac28ED`0_jFvzyh47~eR`{Ms+;y&f&uA+rd2KiwZIPf|DKJtZqAECMT=4hw9VxXC zJ4D6Bw7HrUd(Nv+A|@Llz4)L?(nataGr{0v9)ctUKLh(FTCkRiRoFNuDp6?fan@B@ zJ=6ZwdefnM&li912?*?~Dnpw66#G5EH(zqzAZb<<{uo=iP_W80e36FnirN=vOY|sZ zFAn7SSqrLH@Xql)pe;ka2=g95b4D-;1+1?1 z{=`#Oo>{cFyzPfINqGox5#o;!P{G=(V%X_6>|g%&zqRi?^<7(CoVP>!R_w)>&)C&R zj@k9sU2mWI#NW5!2z`uwzH^ArtgNhBqfxVFvti4tS6Q#yArJ^Z3>HDZ+qCeuasldsvz${se+_(zIw${5U_)wSCuz5F2B9j-T4;*0yZKQyQrBaJ zZ^8%2uR8Fk%sF92#L!fpe^x7E7_LVT-Us4d+o3WC$9P<$QaVuqNq`3jmH1$aCsfsR z#li^C-RUUc7ZwrfV2V{VyX6Yo@3Y6FI}6~x?#6{bXxBVO;IoHVR2XaliUIsZl?vZR z>hc)W`GBx>WhE~7F99Z8bI$<+XwlULOTpgJpSy{L4X;cW6EP$yU#W*L49EddJt0S~Gy|F!%G)?-M8*X{u^Akp^6bp4%}-#;E#sFc}utx4sn#l?A>EmxTI^amX#5zSVQb53R|P{-;> zmbW*yt)03p%uQRn-KA;-78UETZ|{n=J1s|UvusL*v%quClnSoDf;OCHl5M^{UR27hkX`Rt%g==zvAAZ(ndU)`}04s)P zDqM1jz)53;gBO#*qxo1AgHX(1(ButOh(s8?xiRE^#&PvIDM%*CL3Ol1Ml$W400l94 zr=(>d@dJgzQ5Si8M=f1GHbrc-J~E=5bL=!Q$z&_Jka<9gM_We$6(x#r^a@H;^9~A& z&~BY$ntmTP%Db9K_`=cf%sO?16s05qNmWoHZbh;cNd#$AJ`76tFR5Au{0e;Z{UNU? z^dyo>MZy!od1Py@Dwd`oitCcT9`#dt3>x)4cb4JYytzA+thiQG9qJ`hzay!PXk6g1 z?p+D6oDeC7Q9*I_CMACgPN{$3LI_e6(O^@5I5*}x9}3c3`gVc}APHQpa+16z?_WVa z>=2V%=Mys-pof#RD&Lzsh^T-_Qa7@M;6}u{r)wraQ~N2ZGrYbJYy_nPzamkJCjE3T zt7nR7oJ&DMIf}tDX;dkFioVb(d0bb2m*gLN5JC|SoIwXqU}KWXQzVWa??Zt}ih7al z#q*`}O|S}j77Z8UzgZ~_aR^m<5v(y(aS)HE&y@#fiUpf47Ab>ErNEd!;z_(jDzJY< zH&u_G))2N27p8RjU_fdxs{Kellt^Z*hosUm7s)AWC@?LWKP#?B2J1w?qae`}U)`bO0bTyxCs{=kpfiKid6cBg5% z+?35OTxHk1;RfCW)}q&izbi8_s8t)bxVXf%eD3+Dty;ZgyE|2T{IN&v)Y%O?a@}!T zURtn^eCWsR;DLPt?<`}NFJ7?Oxp`K{IkwRZ`$&n1NPuU57@c0 zXYAaCOZFnJd-#a0EX`YHJh0=}9koOIui|@bH0q>GLyC60TC-=KJ0W&MwrGz(eS(zg z55D^y_Cr5#D<{2gY;D>4c9ja2^K)~yytqhJ%tC3}DwP@A*xayQyTP+|eruPiT$p$d zdfwry_wmH;-Luzf^}3xp^%|=uSQ7-JU;N@1?Uq~KoB(}s)+6v&(kz=9{sXjiBpy30 z(9-)h1W4J34UljU`aiat9lNyCw6$83dy0+dPM^o$Bc@~W8wNF+sok%IWV39OOTT&q zs(8R@hOE5Ez6lg_P{R8`MD12`J88S)OsCZsull>80T4+~7g28n_b$`R87c$*4vwB3~3cyQ1yqnyFE-5h2tN2upbf9A*sqxT0`T5Cn=C__E znetM}v&k+8t0Mfrf5*ggyT|k0;QJwhv%t;#+U%cXP=f?Ro-yo}ddHmZ2fyPD_(4-u zRbJl@(@}8HF=86b<~z7FYqd_-wwpaB?s|{ftDHlG->+3`<4UpM3o3r6%1@fu+v^99 zOuTzISgIsBYKGFUM>U>_<7Eyx=%kp<(P>kooQ`CQh8ji&eH%PLXnN-qRs?Jcrl39r z!#YA)*b#e#4j8y}8B<4BmZ{K%#x3v|Q4Ihhfkng=(#`E1I&x5}5CB7d4m~KBck0yA zMqkC+)-D_DuUek7DNwk21Iw0*wq0#lwb~?46g?VH7Q+0Je7?YjawJQgc9*}$Gxa+i z+qb%4%}&emg_4l5ky)$V=JgNkT{7!;?9!zT@s2rB*_Dc*05(@*lRCys?V@oW!x`H! zbV3b)=FQEbf22=?hUy20SV2OK0|^T@T`tmafMbh|!N4AwKYCd@9o{Eodn0H=U=Q>t z1`@&{An7A*!G}$<1^7c|)-NDTy#s#_Do|JVxxWiC*s*xP~1 z1(=NL0l;u9>@*}$M1NiWR`iKbSP3R6IlC0Q%kXPGNFX3{RA4`qZ2?Ub)k3D-I6 zOjKd?TogM2vKjcv`QzAua)zWV4y2#}*BDh-oB@Rp4M;`})hT?AlAse)qIJ(c@Xzl< z=T=6J&mGgQ1t_`|*59i_@O=ZAqI{bKLlOuOvNO?`>|FZ9;Cm9mN{m}xUy7u;Q7E;m z4tb`bWe(%&M#@Xn-g>WKHmMGzU^xe3hEt02xDQJrp6ppO5;8q!D(5O{mWvh8>I*fN zvWX|U6CO*6fKQS3&qk#uY_9^upb(@vjT7?%m-hKD`Yt?IZy>2%Nj8fXkW>pikdu>j zj(rrjDuXIXLefYb3dcZi4ir<=SxM!J z8tCi|or?rtjOP)uCKNGga+#n<`kEyuqX!=z0=JupLslZH7D|D7M zWEOV8eVY&CbgWJ7VoFXuQR7~4&N1yAY?fy-RA_?QUeGRO0X?Y75Ts$xqVG@5If(PE zW^XECd7zJeC{?^rJrV5z_Kfot*o&7oo@(_}b%cK{7YnSCYi^K$fV7!b!V!cZ6MFB9tISzQIe%`RQpt~xG(;3u#I~Buo2_|?kOVejVh)M;c0~@Ykw(%a~ z%;PRauhT(Of}(R6+0D#U&)$4!!Jc~jAp&u*?fb62-hSub{f@PE&)7{jAGg1`?|%Ei zciv%N_`-i?e3W?3FYQU3(~0Cl7)$J6oyh>E0-y;jg$ink z?T-KU6A~sS5~xt40%L}%2@^?+R}GS015XwLoQbbd!l2}u|MrAh_FF(`_&;}psSR)d zkbB%2JnGr-#SVqcFxv5NCTi}V=&Hi=IQ7{9iO7|bJcxg;DzJQmze5KKBW9C7NQzGh zP!~#;jHy9bK>g8n^cG1k?XpJ&|$Q?`hf`U8* zlfD?_`MU~Dcnl$HBO61(sgM^n$R|f*h3l=B<%?OHh9q9K#?N3Qqj?(@iApKY$_efO zs!vFQH~;6*@)=RmTPu~X;P zt=DUFTKRA^WiypBD0iwr>5GZ3%J@cR;`0#;-D*~lcVskA~W%XTxPjEZ{S2*R0NfD2B#cy`@DTuWIxj0;ke(Kj5`8fmOeA#=7nEXRsie{+Uc<0^kD0zMoPek` zEUCMNWEVil@y1X^O;|{J4Z@^K@WGq*(>4|bSMCrJB-qyq?-gIqzK%%toCmJ}TYX0{ zJTc}c5VdkgO|+er$@n}RqRtfe0(rhLvmgXxd{~Dj_7kR5HA>5_?C1fL1VQR+H~T&R@w$R8J7d;2RPAs4ps1w4BOD zSWOBq>~$c`(g7AfYigR-mWHhf`UDklJnRut>NH0rAwD~Z`_rpRQqXhSm7gtKj&v`t z#DemwGa_mxgL{APtVobHr}q>+aWS-zGey`F8G(y8!~>0=5{m$dh$O#dxT1##yMp}| zL2)(o#0{(o8c+vxA~|nN@`f+Px(W}`fIaWnHg>n|p>IBDFTDCH z!OE*vS6Hd{U1&F5ci8ssyUM1^bL=g__4~aZ_wL2bEqm(u7wnm*pSL%^^{qBF7}}>k z@o{Ul>UQSrIeX~Q$85J+wdKVH?h#Z?(f4!w`eW8;wiqi=UcOMa?>+y5UA}zLZan@b z+gMw(tM~4qzbh4|?ab*j)@-%8FVCJkZ+HFJUH0*heL`oz?K{D;L^9cx$)Y#IE2WK2 z*Q)J~M1?R~p*OPja6s`NP|>$Q(drDW#r-6I1I7j79|}^?eoMMGv90dEqWYKy{}Yu6 zH`BDH05sXpF+mLuqwUIhu%|(lPOBNJMmWx+^X-03G%)!Jx~|0Udu5hMa>@fBs1p@k z`hKq$MK<8oW%ZjlsOTV>=PtTqJ{Q&rZ3xjXtA|y=Lp^3;qx|tjT=9F4RoM+x7crZL8I_i#5%l(Qsh(C6^0oTgdcAgE6WP7)pbH5VCW@ z|Ax{Af^Q)CsAxc`h$U{!tZPZhH_&!Xlpm8sL~+8FE2 zUJvwegrnDign`35M@0jP9*`;gTqq<((2aKtG>FPv7$(EPYDio_9a9;Ud3JEwU3(#V zLl}g6fUVw$5tAD7yj}X2y+y9Nf_;L1Bvs86=<+!oK~}<$v8;2pkwoEnkdzUvAZim+ zO?9stqNt!-L&j7gQsq!oDm*)zMDZ>#WHTu(E9j&Y9*l%5NKGDCtRInT56UADp#x{d zAp+r)X2a%eH}Vmj0%^wq*WWo30iHbJ5y!fqR^=K^VHQlMhE!KQ z(lm2Own{;e!xFuUsNN9t*=Z^;ogEy9pTo(dg7iX<0JztkzbohF$(lQ}aL{sZuFT@9 zaR`P{iSf8w6eDkX$NOf}IcyXIMf^K0Ybn?D2F8R2p!X|4z?Gf6zkwAG7MgPj-HwTf zCwllEsgvm);~cRvrMs58pQEm#L8+p^y*njJ5~|Yb*%B=Zz795@XN7|dy%);+K=3#- zB?zMAlet&`LYOQ%jS)T&@0-KmKuaD#ov2G-4syWixeP%O1t)kl0CT9qme4g7yl`K7 z(hr-cVXYCAc%{bIMgABS{|eO+L3@UeVj|2ca!^!Y#{yh}O;X~sf7XVd;E#V?ZitjGXTO2FjaxnGdb*c?frMW+wz5J z*=DQ-sBhh_ji$18etpAEpI_q~vHEt+KJoF7*sr#%(?TnG(XQ~b4;tB zpRL%D{rlJtg)@k19V%vEZ@lpGNxSyi>v$Fs=RmZeGF!Hb7cN=7+Tvb1ckYb+;O)2D zKlr&%>zSxVsez{m+9g{ryMTP2Hs6)fcAHJxs>_jRNl%(!iQ!*NFfC#*HD1y0btR}I5LmgKe=2z{JqM#DO6o=wC_3zPc5Ib`S$8~T%>j~e z^%*0sfiTBxsX#y`)9nw(Xaome5K2x9GbPJFe$uk+d&sd#PzW{XM`)y*;oJ-iv>8~j zARTK2>9|iS>kP+i`bJ^{1uf1mAmS^{@!=4kow6DZwGVEB!Q9;4Wl3_bTwy~w3~0ed zwr6gJMq;zpq@i7@l&vuu+4@e^Ru&g*wp6m+TEn*5UF(lBwr{Cob5O4un{8KHw$tca z5j3qr-e$`R-p+5LrCY7yU1s?wf-=HNNW#CP7~E) z?57^~HsraZ&d%3GBdmCl$+sai+i=4(Rg8 zjtoW;L+M<9*Q_r2o*CenF4^Cg6*_>w$AZvp>D>t5%v>v`>8EXW0W%hSJpj{q~OA-(}mIYxeNh{>09cLNiAI01`h*L_t)Y ze%?;La?&g}Z~yWOzt16m42;;1iV76$2O82Vw!6D#k39OQy?E+1d+FpUJ9uC}=be?x z6~5Var)@VKJ#25f{(7oILQylS*0fZatX;T#!TMb!C1bnejyo-%9oyE{rhVfZ53olW|UK4C|CQo9i0E+q0z8L1{$H}t>foJO9@cAFk zBa50r()1o=iwTfYSg8*i4jOadRTC*sRE1QjR#HNBzA*+!W4}qdSc#J-PcFY4RgDDT z3>)CKE2(+}2uA}N6ivlmv=KfJia?Irl88&V-vf2{zUq$rQ>=z6&mo+m%7_G3G-wsF z&r<4QkDP-{=(AoZ6)cDNq}d+;6sB%80_N#rma?y$3E)|)=uwb^Qs4?S2aXPd^*|wF zxzWe4A}ELPMREXdu(B{Oip_99BaGk=jyE@zC#nkr3?nv|OQJbEP6>;)=zB zwHtNvc+qqRU27P{*PR~{r=J?7twrjTAXt8m921+D3 zAl+l@XQo(r=(gJ$WMnz2auwMNm}U7CbTD+sV1OY)Ayiow=PR}Y-Xw+?=CW)q#HIs) z1-ZpqvqzMbJbTQYfYfbvipk1!4vpqD(V?b{JsntkRW_zrjj1;TC?uY=7J$NETyH-;Xnv77w}&eNYn5F$Fn_j67P&!jiFQjkFXEYSx+XX1xg zAiJX_=y7r79-K?fKk;BN8~`ru6)2(hUj3jdlfGB6st5AH2UU?)y(k_6usXylL7;2V zgzl5$75nhMgWs=fq``WmA8B8L-xEF81ZJeAPO4~89%i!3GvLJk&`M6`f(Wf4@foTIER!m&21KcMJ(*Hwp66L?Sh~o-|Dmc*WNjTFfAi`@m@{NI-nDI#Fhy z%&mb<9@t_Zr1sp)**-DWD}S_~6Z-*Qz{X|H=ZPdKsA1r7qiKFX6diU`)3epj5bgtK zoPhwVj*_Y+&C355CHI74;f^dx`XaL#T>Svy^@t|YbT+xmkz0vj^IBHWF zs5*A->1Q6X$DVw~zWJ>u?4FO@WA}XcZVvwyD(mN-wn%#cHql01t6uz`{q@%#u;2ZI z|7qP(&OZ8)pRheEOIDt)SfyC9_x$iX`5k}$rQfq>o_gF)pFMA9FYMS??)`=>?_IP) zX@;FT3`hwI0MN@>wYp{xKl+Hhdgg*X@yrW$?Ajw#;Dl-w&H-k6m5W)s{mr-7;=&w( zNc52s!G{tgsNwC7wc8DAcZc@Yx4xYUR@*yU_KgQ0w05hR48%qAdAEyU$z|KE)~(&^ zadt^QSFp`m%}&00h6&&N+${G$=6#?FbN1|c4n&?VVVy>{v@~y@`qZylp^ORfp7=6( zz~0czDXd!nKG<9JR>v-EZV|L?u>u012=i~Itl1x0wcTU9gRl)r2@(;!Z`cdjY}qHi zA#S}u*+X?Ns>E>$(w-E(TU}EryMu#~^m}7Ct9PEv_8tum-b0&FK2MnMRuD1Km7HC zElaATUQJ`QIM#47iSlAg^21r0eGDgE& z7-`T+P{sts1yn0+6d)aNQs6_f@4z!01bhg-U?4eJ+j;iTp+*@TJqvu%2!1K?I^YCr za%_iV4ioIMzd&VsNZK;69FD0H(P%bVjX|kbjH(6y^Sz5HrXlUEp+jd~zDuaE@{a`@v(wOZLdR@?yVwzeG zZhtOo<>{i;njK2>q2g1>gSM5icDrM9Gi6e(P#pqNg{ln_D$Ir8H1jc3oy=C3=4_!d z&1vwBc8^lLoE@P_fpSW0HjF?91O56mLMux%R>)?oRzrnHhY5cdiZaU!6*lqVe(Uun z%Xg6b1)7FwxuTeec0~#Soz74VLC)m|B1z|s_l4&!Zd^cyPhMsKsdZ2gAo>thKSI%my&?+2iDV(*BLz#I zlavh)q-D(1?9L$1DLNrPOnMP3G9wyu^bWz0pf^cP#{w0^`;St080S>p4+k07lxLV^cwD%Jm_ZQeIy{B_&8l( zGOQDQ5X|qqqC%(cGCc{hKXRwZH zW=!tZ{*z!tTIL6`jx#FS7J`0IDb%ps8~JqOM19HkJOUTrQ!)2Om5xYYeSz_F{#`=J zL|2Gs)XFPa<=OD+SgZ-rTJ)rOa)#=;W&x>h29zn-x9ACD4+5_5sxl0Tl7V{Ztduc> zF$K-qf9dq|=&#Z`X_MgD(C^4TMjbRJ(K^d+$Nc_zOc z7xdRYk_Qi5Cy>EPzCbldspEO|)`J=jk@HE`P@shURZ}n~S$jQq0a z?$>RU#|7G_R0`Aj0G$L-g#ezFX?|XFJqT>zo#aLNg?$G)-Wr*`c433h7S%}fRjhsQ zVVj-Wvit76*M8vb@3Pz8_8vQa)7u=t7+ANnV^2T#to_lSecA4K_nr2^JMXgTQrQ!Z zsC2~%@iR8++0Mmh?8|?1pMCL9{=!C?f_?adAFx|)ywO^%wl!|o!t$) z?`vPR_4PH{=K?@fRzoW4UEyc}u`93{0e)WE*tWHeZChPgW_q-L&!W|9HQU{-lb*J* zwQ0S6#{fY7*606)&CD+_?!q~f>ZOwU7?8@j7^WeEJB_wo-mcnCv&{qqU|eRLwcg0A z(I0StC8oHe>LJCe7#{6?2wwSPz?Q?fE62s z!j223bW&v-S2S|_5lNUps$j_Wr!%3_GfeuF(*@&a`T0cT!vVH%BZ`;PAm4jkG$+R? zP5zv+MM`ca2N=eT4X;J{-Gyy*{4s<=m{j@DWzwp=O5tZWaT@*~w3YtMp@u~|ma_uz z?qhf>Bb}ro9rKqI<;c%_ADa7Yg$E9(FgCydUim0h?;~YNS26{f)W;aWgkp~vHQ>E! zNot%S6KKAS>WA5GyN?89I414KvoWB;lt0A-Bbb6iWYeb05yGerK`(NhV+J*{#{$)dg3?6|Sh#8NOg?sf*&Xm|OdFz9ga@;r@qgDP24%BrwRgyx$blZA3A zXHeNd9}6f{l<>`|Bq)xq)|X0CKEMy&8Pyp`|AKBb^inAjw?H%Tvn%sZ+W>tFP4SRC zMp;%B5jYH10HD4_x|>h3cW0zhBhV2gl|Ts9Z=qv^?-6pSstFs{-Jy2+JtitbPrY=? z@?Ox4q$;JODykLu=rW!_-QWx*xha~1I9RwxqVL`$Dt;mEMOGq8c~Xy%k{U~Yd=~Lz zsg6Tq9R|vI;HU--d@vvz`eo>F#F(v*U^Fp+EuC(Rmbzt z^}%@YqY6T4jN=~$JZg+*V&DjMifD&Xn4sB_e&ziIfx@FS>l!tJ5JaDvh^M`uK}IAo zOg8qWyiiZ?=;SKUw8j3ZD`WOx?z9qgn6lL&yQqt4x5PYu&-T`G7HybZf`^KY1$RK8OHtisR znu^6a=MXX=>-<>-0Wr@6%S)+X2SB24#kY@oHt67Vez{}yQj(b!`qRnj-BFctgwMeM z_9SqSX*8sJpN>l-V=ffUh*Pns92bnc$p%PnZtb_Em&m~Y+?#qy)I)`{gz9-HW+A{V zK~%%(q_icIbV#2SlT>7r8iy}ILN!d26ID=uY@dQLAkC|QmXMvZXV63 zqk&a{_?M@hM&aiZa{3&QSM*n(;iUC?Z)`hF^`*pl*q5u@fBrYWWyg;lWsk)N@BVvs z=*V#<$LG(yYUj?pXrp0=N>*>U_D1{hyFNsPDe>rIr@6htZe!p0p>wcfvXYNcxvKgiy1w&@Yl_FU%Z<5YNrpEasE3IUEU@ zCaz=V2z&x69IJb;vC8a%H5$A2;5Q$%mtJ|*&YeGR%gak%<88?{?%{WzN-$9JwadM11E!S zDJnZ+2eZ~-$oF)4r)Jyr7QqVyxY&yXUHhQgg!bbw>*;DBvMh2D*zw||RH?G4?jP=?Nm=gQpZAs(ak z&`(F7sQhuD{oXqfmBI8%NtK6Z$K#KvR4HV_5})(E&2v9-q?B0bCW1PK|K{`2rUxq`^+ri7 z;NQ=Y3O+zuXI=nT_-6KhFpN?kT~zu5V8gQoV8?d@dRAt{!bEE{w*Ldi7ZF7u+b&Q5 O0000', 'foo.localhost'), + ], + + # Tilt resources this app depends on + resource_deps=['linkerd-control-plane', 'ingress-nginx'] +) +``` + +This Tiltfile does several important things: + +* Builds our Docker container automatically when code changes +* Manages Kubernetes manifests for our application +* Sets up port forwarding for local access +* Configures dependencies on infrastructure components +* Provides convenient links in the Tilt UI + +### Container Setup + +Our application uses a straightforward Dockerfile that builds a Go +application: + +```dockerfile +FROM golang:1.22-alpine + +COPY . /app +WORKDIR /app + +RUN go build -o foo main.go + +CMD ["./foo"] +``` + +## Infrastructure Setup + +The infrastructure components form the backbone of our local development +environment. Let's look at how we set these up to mirror production +capabilities while remaining developer-friendly. + +### Nginx Ingress Controller + +The Nginx Ingress Controller is a crucial component that manages external +access to our services. Here's how we set it up using Helm: + +```python +load('ext://helm_resource', 'helm_resource', 'helm_repo') + +# Create the ingress-nginx namespace if it doesn't exist +local('kubectl get ns ingress-nginx || kubectl create ns ingress-nginx') + +# Add the ingress-nginx chart repository +helm_repo( + 'ingress-nginx', + '', + resource_name='ingress-nginx-chart', + labels=['ingress'] +) + +# Install the ingress-nginx chart +helm_resource( + 'ingress-nginx', + 'ingress-nginx/ingress-nginx', + namespace='ingress-nginx', + resource_deps=['ingress-nginx-chart', 'linkerd-control-plane'], + release_name='ingress-nginx', + port_forwards='5050:80', + labels=['ingress'], + flags=[ + '--version', '4.7.1', + '--set', 'controller.allowSnippetAnnotations=true', + '--set', 'controller.ingressClassResource.name=nginx', + '--set', "controller.podAnnotations.'linkerd\\\\.io/inject'=enabled" + ] +) +``` + +Note the important configuration choices: + +* The controller is automatically injected into the Linkerd service mesh with + the inject annotation. +* Port 5050 is exposed enabling nginx to be accessed at `localhost:5050`. + +## Finishing touches + +### Local K8s + +To run our setup, we need a local Kubernetes cluster. While Tilt supports +remote clusters, we'll focus on local development for this guide. + +I’m using [OrbStack] on MacOS for my local setup because I appreciate its +speed and simplicity. Other options include [Docker Desktop] or [Rancher +Desktop], which work for MacOS and Windows. These come with native +Kubernetes clusters you can utilize. + +For Linux users, you won’t need a full Docker platform, so you might consider +using [Ctlptl] or [K3d] to run Kubernetes in Docker. Be aware that Tilt +requires a local registry to push images which can be a stumbling point for +new users. See the Tilt docs at + for more details. + +Whichever option you choose, make sure you are able to access the cluster with +kubectl and perform basic operations before proceeding. + +[OrbStack]: https://orbstack.dev/ +[Docker Desktop]: https://www.docker.com/products/docker-desktop/ +[Rancher Desktop]: https://rancherdesktop.io/ +[Ctlptl]: https://github.com/tilt-dev/ctlptl +[K3d]: https://k3d.io/stable/ + +### Configuring Local Hostnames + +To fully utilize our ingress setup, we'll configure local hostnames using +[`hostctl`](https://guumaster.github.io/hostctl/). This allows us to access +our services using domain names like `foo.localhost` instead of IP addresses. + +See the `.etchosts` at the root of the repo. This is where we define our mapping + +```text +127.0.0.1 linkerd.localhost +127.0.0.1 foo.localhost +``` + +Then we can add and remove these records using the `hostctl` CLI. + +```bash +sudo hostctl add tilt-linkerd-demo < .etchosts +``` + +Now when our app is deployed, we can reach it at `http://foo.localhost:5050`. + +## Ready to launch + +Now that we have all of that in place all we need to do is run Tilt. + +```bash +tilt up +``` + +Tilt provides a powerful browser-based UI at where you can: + +* Monitor the status of all your services +* View build and container logs in real-time +* Enable/disable specific services as needed +* Access direct links to your applications + +Look for the information in the command output of `tilt up`. + +## Next Steps + +This setup provides a powerful foundation for local development that closely +mirrors your production environment. With everything running locally, you can: + +* Test service mesh configurations in real-time +* Experiment with traffic routing and load balancing; +* Debug issues using actual infrastructure components; and +* Develop with confidence knowing your local environment closely matches production. + +In the next section, we'll explore how to leverage these tools to better +understand and work with Linkerd, including advanced features like traffic +splitting and retry policies. diff --git a/linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/social.png b/linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/social.png new file mode 100644 index 0000000000000000000000000000000000000000..2f2115be662a0c3e00c2ac1cbbda3d449e62a7ab GIT binary patch literal 831008 zcmV)hK%>8jP)yl*2aV8dd&#LO~xd0@%T+(C`{t^5OLcbPx11$iOOT7X?@(os6tsYb|*)EMF2+XCs zD(_h`zq`lfoH$w4gTX8tR+y^HI1wHm9_}9Barc=0@UQ>#^K*Jm@^7ZU`Cs5uYm-vF zRrS#uK77WZo>Q9D$9dL|>6e)&Ehn4*rat-Kto}@`o8g(t6VQrVW)Dz{XJcRZ-uK>JqRBzQMLD>2SLgi*Pij*SR3Y)Rl!A3B_d=D0 zUCTcvL-nz4=7X7zjAYZH1x3OGuXk%|tls0q?N1t>txfaUTAL;(mHyakA(w76w_^rr znW51hSVQ;K*h<@)8V@|ht>=~2u>pqGN0vXBBL1*3MNvb4`LjPyfBVb-mADZ4nWfo` z=K_sqvvj>)RkzRKJM4sKfP0-c&2vinec|+&d_2Q<@H3Me z{+UFJzk@YHnf%D-2HNv5HcpboeBRoyldP>->C8KK)$H zDv!zGxbWnBuRkHWgSI%4FRPK#_4$fxC;N>Ul+yJ|ynyY3UvnE6^K!YS%jJ?Tmov6Q zeqNu`<@q_C&X;sNpVQ%ZOsCU1U9MNuSI`cRKEgxZiu3s_Etbo)S}oIZwM>h}A}tp4 zw3x$>=)321Je|{Se@KsyPw99(rPKMG=8Hv|&6nwLJg4L7LSq4K*GoE|&gpPEr7K9@ zY?kis?$dU?OzC<~%Xv!M^(t*v%d}oD(*4~Qf3|n)wAri@(1a@q^EsZ=e!oXPEar>! zaDSif@9yw#R3*%->-CbJuPI$&FI+FkSEPq!jrPI}8sIbY*#gIz&F5)0XZA}QK9l0w zz&fCgXL$x0Wt|WEXg-^#Irag4LAyEbFIi`iGLd()v$P%{31EK7#+Xb}7sE1&vaJ5C z=zyp@MQfveaQ49W4Bv(Cajy0w`xF0*@&kCpfV>uz2hP?puTP~OQ1M>WQy{7Z&guDfLUZPCT3qM#e3*`xn z32QooAFppjm-0?`{1iP$?OC93z5`xvn44%18bkkiJL}{D`>j52kA|^F+74+u)Z@%| z5^T|}Gu&T9@GQ;#m%skc&fxK?&8>{;$v9TgU)#s&$ezJrhKrLBj<*>aZidi|qaAd3g=ld8Bf!XEQOMMV

;23eQ6u8$6recRfe`6#rnD>`6cDuv|cFT|ih-B<_p`OBaF zdHU5ae_~)W_5%+ah$FPgJmFgcsMyiv9*HJ$bkwegY9S4?{iB7QfL;ap1#!p z79FMu6fl~9e*r8nJ>%Mr)`o#SR1;a)0_Xz(oH76lJ^{WVAa%K<^W~yoAOI}@1^{?< zJe|_va6~XmfCd7u!toL%1rPTCSS=U$17HjQJFDd)E#dFkJYAn>2!`$U`}Fv!6h)&O2HfVJJEyZde0 zZq{kNUgG&5_0V%dAa3`x3jo&L-4=le0g8wxe8^VdO6E?oCIAiSbOLb&z%nFE!Cf{g z2ui>@pfX|rh`$3qEfBn-=Ly6DJ3s(2nX>pIE80r|ZpiDNXKyES+gj64Jph*I1L1*p zJpi~7keL8*ad;TKa-Zowb>J1Xo|}2ibUOe@hQ_eR%z!Oe5Wo@*z+yWpd|(4WfHuDp zVh|4d%}y%->H^gO#v*{VTo9;xIVV^mSSti)Rp~^hKy0?yKUhyOLJB0qm|_Ama7uk2 zMOHHbM|lW%{QRy~l|7#?^U=AP@w_xS>rH+eUBF6%wC zOLB?lSU!V9~ZkSt6 z%J^u7Og0~}H~FKMcSyw4$*ixL4etr*nMY;NV#`>RQLD#+=~q@y4hV70hx^F=1N!@y z5P|iJpXi%?>Di7T8lt2JL0~1mg@=PnAz6GtVdq&$ zZlZPjHbh|2T1Vd<{(21nOMqjNABvp$SkYzz9Om}AeBtNTLJoc+?;+ZS_MZYLVzD^d zMfM0r24NHyM4iyy0RRUgjv(skcs!>4@t7`Wh)05e5YSO{pci0_o}oiOMGjE}5o|ip zX`A&rZPqIU1Ar<5uny^Iw@W9EwgMpQ06(X5dQS6nfB%3W7|^yq9Ma=%kC9ua>osk+ zcj<1kOsn}UtrxSjUMZ8XgTN-7yT~3#>Zrct4hSfE)_`}^`w-Cs z5oip!cmPWPhX_2dZe^MTe1fsjhIDu)xw5JOSTzsZ19;(k2Vl|uqkpn95kr;eNsh81 zFoQISXcVK%{34QLi@>7&E)kg)fdv4kfLzE0jl43eWcJHN0)^-&it2=aAg>5wEf%z9 z*9-EOA_~h0EYTA*Q37;n+X=8KZfmJa1W2PtnOPZtb*q6<`9Lx(qN}Gr|EyZkrXI{9 zzA6I%ZxP@Wfp8I6vaSd+b^};b&L2MPf};Rk zIR^JB09ejEIUi2WRyWNs+P6Sl%lJ+^2KUT2N=3=rn`YKOaJj?-&wj(SG$|RP!*lSp z=q*>JjH((K>$S+J^1}-;8Mxo|KiQLYeb=I{rd6`J;GeA>I7K;+bI4Rojh`K~jt}vT zwZIvKMR9W)5Eq$cvx)c|I+J19dx>Py9I_sU!o+nSbn1gfgo=(hMm!5lwV5tJO@3>8 z)_NHmwz(g2wU7-{_B$|Uu?>Ca^m{A7XGqB5$zT5LM+9KWp;x1%B&0=pAOW^^^cEf+ zU-4nxV9;8@FmWQ8Yzl~Q#{l=nUf()9U`HY{RJZcsb#Mb~pF}r3lIsnjK_(!_DbLfW zP5qeV8b;rYdohzx+X~DJ>B}OpA~Qc081aoM!H+Z$MN&`-RZxTar>ybsK85g`0I)>O ze9Ux7K9XztucQ%`x-jk*AAu#`Ae1EgGNgN1O0PyjTqrG200LZhP8B>|E|}g2kxOTc zz`9a|5FUa_N68@_Q|+LiOlDvYZZ-g5K}6IV!7u0wz$%Esf@l{w%L177_(V}zm&H@Jy~;&k)peFdVBIdGc4n7IDt9E+Y3O&k z-k0>=EYeE(FLp{mRXzu+m=^w)YHxD$7_>4%TuL#fJ##7|rfCA}2*46PTlXZlArdG{ ziKK{5h$dWMYAd7*q6vR~4&W7~5N38)EVKu(D$azYlA35lJF0(8a6)SCk?@PwQc4ss zH@vZJ95oEUa*bO6mPJt2fC(sJUMCqc;kZYwp*ebfZUz$X?(NrMHz7THmjKd>tBX z5@Y)s4-WSY)6%5)cR@$%$R0nxZ6Ee6O<@SXRs5+dHalXOvwj4*PnSlWVFQb_qMgcbx;2fmJilnaA2FKdb{+Tac~T;R zkoSzI<}&$RjllAKAV_nD z$SZh)_B5ssYQ3jKkyuaz>wHEaM`~;lFBo{4&C>Zo-$P`QMN$w)C<1GZfYD;H#6BP; z5db9$#+j$D-+xG7fBimv@#R;TR`~GtZQ9=7rS)c;07!!r!ry%HRr=zquhU|+N^iF7 z^!?A?rFZw+v_SxiqOc(P>TbJD^96yc1kM2;W|$7S-|e}k*9jxM0JwrWSU?*^Vl6O& z33vj470er+qn~p+ovqFo)b#?8;|@Tx%_hw_tx^MLQ12U9f&d8C1p~0lBGn{y9RG_E zZgT{&(0;H`neLBX32Q+D6D1A(1uuNnMmS(bydZf=66}Pu<7g@m7>X?76xdnAdR3Z+ zNitglu{_v9=VSK6)$~wGApuvk#=e%8MAHd~C0;yl5tea^1QPJp_AjlCq`+c|DXjGj zBIP*x3cxJ@aw{(!b|MR}X&e)rLLxel8GV4)rvbl<4X zRfr085m>=ChX^d$1T7|o&m$}FW#Eug-SYA}&o}L6J?`V!vYDgx8pfqJ5(MYOL)T`Z z-}~c{D~LEwYxJ=F7!%!p+0V@($5&yz#rS+WTMQ2M4bm}6ZcQ$K7xXoc>mf(II-Sn_ zE6=t@%0Kr2>unr);hxsVhewxh35YN_VvsGjO(^)XREDF^^R;M*c?H}AF8%VSKT5y)`Cn*3c6xgoeLERn02w;; zP;`R_ssb%8s!B)?Tp>@N_l*a^XyFaO;;1h^A{8;{O@A*kEO&e@nS*#Myws;c1eaeX z9*}(?4M3|Y+W1hE7AE(&BJOzv zmWT{dU)NbEkIf?PrO;tvY^lxCl;JM5)73~K;0Vkb@;HV8EZU!ZKo=k8nX1%5YM!JH zS|pVLUU;bIxZjX9j5iB!WWN5UE79trA8yL9uq~`#C*6 zJ*B6o9i|pSgw|rUL|_YwbRV&p{3U(;;VFIC?b33!P7j+^`s~d;0$2}Qi0)b;00qU| zSF06AF_Gp0Q0{ypzzib2C{m14#DFdUy|8B1YQ@nuGX$fcy!Q?w!*)9a*q(L=1WeKl zYI?zZ=4rW{V+7X*p2cV#N=F14#Uk)nyd8QX{f>pf1;FCkTLhHw4@6(NbVM;z5~Zth zn@N)N-+KAcC3q57>(WdMEvMuAGJzX1do}0i`;eM(WQn}HXpCSFh;Yu1i(dxNzfeJ zLKymSz6Ty6TY8b5EqylsJAbg|a}J*Jq6zG7T3zIP@VvLN@0*g-CweV^+sVQhd#V7d zm%xJmOqz4rdw4i>G+=vf8?c!D*wcON8fq0B@xkFfCN1Rj^!@8?H_qL@@mj4q54st- z)ia8nG|Cg#2$7Kr8!V@;liHWDq^0;e)j@S-c^_8lvA-g%Y64xKJ-fSSXNervX6HW} zG7R}R72}3YdT4fIPT5Ks2{%6)WIc9zbDx!EnATV2NF5YoK7d1{bSaz;E249Uw3{<1 zGK^csf?bm~a>)hyM2?v<;52U0Q#8q`Ph$J*A^S56wGZSqWSiNJ0M>u_QTo*{2*5%> z#e1OYBn#a=Hu zypp%yB-NfK{+qj$zTi_jc=#^_Pi(JnjLZCTuuSz*M2Tt1nrPJlEO?55 zM*^?#uoJkJm$!c@A;g=Q7foEdcB(WPiPd`h<#LZNjk{vK2t4J^ntMy*JFCj@Qy zWC<9?6e6?_KYLlhK%Rd?%Edf2SfoBM5g z_i&%K8%hIQ!kC&Bc}LR}zGsM;E;2b5 zUTed3y1e-TV(hVsps^i@4zspvc;D_EqR)F?F&)trtTS_rWO}Nv)eXzlMO0*Sq@`z$ z)9A{X8>J|kk6O>I=ZCg#lu57n%BNni7PUtkQHQwc3K@q(E;iu-yI zd!e+N{tTE4`>q8?26S_Udp(LVS1z@EIBis0>OP*d_kBx|<$I+j*PgMHmuZqD_Rg{$ zZqucn8tXg0HYI(-6o+s9AJq*uGW*8Y^zn_H>k(Py){SFKk^rm2GWJ+OjXNpi-&Lb? zv{7Z@5J6r&gE9SjvaKe*>___DAh| zi3SQDw5Id0d`{FSQ|TaC;S?d>L>9>%i@3`n$*Z>@Q+bp`0l@L~_AJP<8+_!;?RAFw zXD&bjZ4KUyr2^9%B6)}D&J_TQqN1pN6)qdUfdfzn3PHX6_9WMmL5tu+= z5dc*)DCoXkrgv{2(*1Uu?zRv?MZl0icChw9BY;=O0{~!00>HLg1SSA%0ssr@Z9xPU zq&ULor_(9z4yW|bzxg8l`Zr&suRlDd1~{ z!Xk`$FS2sS|0s|mM1l<2MFGH{2#C=P#4d^*QTcYZ$kGNW(ybQB^{lCj2EIoCi{#e> zSV%TULsNY+NE?I{!WpIz5`e{#bfRc9+R5dZ2p>8CtfACo(`ml!gse2%H8+O%9l-o5 zSf)tLBRafo=Nd*%#uqjQjJ& zewg}5)ZzA*7`Zq=hA1;#ue8w>KM{Q_qCs zRHw>HoA7)wftIlYd)`}Zr;hC2)|89K+PuN{FmnH@kTfQn4YK?Jq|K|ob@JTnd!nuD z>a^5*71iTYbW|NFQS^&961UR(x)SNkAwg6lPsYTc>NQ5BWvfRnh-#uB49LLqwGeLWqAcQm*9`>Y6mQM79ZzwHKy)x|MYt za{dO>0c)(%!@!tKdoSH-h1o0tfc1Aj|A}6mEpMiMkN$8Mq95dt!qEzHST1U2a+HPC zPa)3A0Ybncb9hPDYdnntMJ5MAUA_{0gyox=YF3almH6g2js(yv;6?UWSfqP3J}!bz zQwaH59rbUgNC$P|Wmeu)hjYZg)xhe~z6xNdxJQJ80(V}TxHRUe5fu`V1ml@T8w0Rd z!kq}=uLCKBrq=9`sOd%iaNWhhTN`l{luNfE>?!UAN}2Vstg>JEx_YeT1QARW3517Q zXitT*Oxx)#a?G4yTd1ft-YlpoK=3%-#wQ>If-P9TiRwJ%k(^Td1_6u<09Qa8)tW*8 z3+ilPq}2)21>XaJwL7Lg)SbGV)5CU??(a5fvs@w<4*MN~TJPRGU?kSV{WdLTaKj%& zm=Sn1!y6N?2wuTw0OkQ;^>BYjQBjKp7IH`Mioqp_vU+-YN?*KxO8@vTzd;b|aJr@$ zJiA$^?P`@a>m?S92YR50Jb+UOL_zcy*RR42Xjc`4Lr3SFvXS+OCzU{^6QIg`l?<;YCg3}q_2m?^24pduo8iV(R>VGwIVw` zfJG*ZdK8(r8fRqhcS7w@jT4y8t09U=Eh? zmv-q#&0d>qQChS0n6ELCHx_~AhiD#Ede1PyDVeUYb(pq)8y77MVKW&ecZwf0eHxSA zYU?hPae8RWC)j)@Gjcc0Wx_*)wD(MG!dNeAnhR>_tW)=|O|x7*nG?_B)DD6T62=eC z6$XjiWPR!x;uYpw8=_lW8~eFusRy?Ju-$=u`X;tkkER$b%1X@;_od1W&Ef`m9MF-C zWgZ}4NX|!A@3pr`lgivu+21v@J$9ZCdr#llsUS_dnaw(mNs6b}wH`BEh^JIu3V7yvAGqOriQ`zLZLHDn|j${fy) z2rN0!KpmO}fMw};;?4sRJc+YHBC;yAy)>GP zQ!91Ft4^M2K1mnU(cIhS?;3!WA2461$s zDT0UNIXywWs^dBBj@R^Ie@wf_59#g0eR}ui9)T#3~v0JQO&B&8s`S-ga94^xRmB|r1NyTq%XeuD*gI5U#5Tg z?N{lGuOHKLO=*UB%i$WLZ{}EU3w{99g8t+tMwmAMP51*5JhNEr98G1@?@b?z-|W>kMo#ICjtuhY zB_hu5p?#x>G>O`ge#n{;I4CKuVP|pFA{KeiGqBj02pxItwj8X6bzCeU1r%zS2@na< zeoI_qS}zBx)50=2(O}7%v#Ssyn1X-cN)O1I;ENef^;PYZ)sv!r>08kQ{xfm=@EqwP zX-Q?s%O9T0Kt7ZOXU`S~_2( z&73g&bdPw7Re4>2W9q3>C(4r?nCq*u=kJ7n001BWNkl!qTH z#;J?(0#fBse-`T@@kK+r0TA4&1fJd4zZpvEpr#ITm(W_~6YpOK=hGIHv)dQ-hZwJh zRw*LrV|=tVYZ5u~VE*#)LnbLMWj?+9nDl zw3oUt^cK>Wkl{KUd}!5J5Kjjj!2H$NuE1^t_4q)li(rmw#4z*Ps5DPs5yzVhJyf_u zu&6b>#vG!^*b9_#lFvY^55m-(LiJs1l`ATyB+TCcx9e12Z zBEIe%-BH)oxshm**WqP6PRq(#&fuI)G`^TsB72JsU)z|6qX`l9obGm%J0Ircl&yYgMX=zJJL6n;aC54b;h$NsFSI&vZkf+@S zutcjz&wwLtLU>Fj-Fj%KXcsgNhHw#OkTDWhO9TuHQ-zdTCKG6HD=tY*c<<Dukb;02b6agIZ<)HtNl!E;5Sjq6e`e z-SKo(ueaHbz%pJEyW==zmPsieWyCtm69ZVJ8MBmowJ}~EOh3?e9=E6FGuTOs#3R$W zwFs;ziZz$Q!>i%?!58c3t|J-_*=9oFLym0Ymk~X_7|s4$2dA65tUT0#%e>Z5HpiQK zeAyCAdO9l9_Sv;{%pZna@@;FaeSf9FXB|F0L$P=6IoTab#MRD=K-1WPzmq00T(P<3 z%$MDCZkUD$wj|TsVJ{oO9pwPy;b0v*hKadvtn&bWNdJA@J=70iWpuoVEPrI2DnKt9 zxXSI|D@`KDQkjY^)hYKqTd&^LYe@!sZkfaA+$UB?p6|KT@ORvm?F`GydhJy!`Wt1W z5~u35@k{);v5qBxRoO{xC8NDcKLB9;?SK3WPScB^Om0UafMtVddI9T=z!GT22XyJ( zYb09!+8UGdOW)*$-gD+~D`W-yAN}awfK(lq3K0Ehi%`)>m7>(A@mN4A(b7Vn`qP8^ zkF8B>eZIq~f>`&ZCDWSfMr;1M|6IZ1rmmSjqDES|M`eEaUtUW;XS^-Xr4@;^wg4glGzGXhEoqG7Za!AGK5zWnOz^ySwd(hloXUDGq% zKnV4#o@ZE#3W~2I(4%Qv&*^eLBTxW964avt5DWXgUen{_BYywcr=MWd78ZGD;7T|O zz#7aCY8t_Rp-B8!Uw=sd`r9vXOh`EdU<>L~0T8y`ZjlE7yc`dElsf=fFmh_Sz&Xm? zfF>yT4YjuJ@3&O^8$dJ%?n&wt{g-NF0WH237Rnvhn-W0FM_|>XFvs`1-UgRDOztH} zVMdT~qNQb@@NQ)NPUgaNdjO7jUrX((%UM!LX%8b%Ep@-R0KcY}ahLQTmtKoEN@fMr zaTC*LaEm3Rr4k+9R?y!eGLXS6m?KIyyddHzIuLazTZXmH7{J1U{174L_JP_~Pq0)%H$B zdAtfqeoy9Oj48cWpIlq-HJ7K836*C0(MT6x$Y@n)qA!z@`7;_wwQ|i#(AOYNP>%*2oj-xTTwER7oH50G32#$xIZy3h5<2 z%}P>1ut(-#WSr*(hmeG~`KoQGVO)h-?U=+(x&f@$bO2wxIYv9crGzxB8id7f!zns1 z=hy4ZQ*7**HW{6WYv2JaNoTIZQ;64juh;_X^XN1~uKa%RSLfh;mb5B`+H#0Psg zxYI3v)ECvs!WvirV$CJ382~J}weUhUsJM7Mbv4)92*3R5tMujj$Fx5{F?W#b8U9?J z6V}Fpx>&fLP)MEuFd4%~JYj^>e3th69iVpUd!K!lK6!Va?xA+onj)fL&tUDX%LRcw z=m$WK-TsiidjFVy`{mc^d?oN=3kBO(P_%uMW{X8SN`%k69{;Qq!>cf z)|-cW1g|7wi*6dE)HtjELlIj`xE)c8xieg;wE;<@1;A1%@F-*RoXL7ry=mN1t92x3!E~{Hy7J&Kc z_+0>4HQQ%q&YenVrpA@r@Owfup447Y>4TADEpT7tMQwD4+Or5mkwJgED*{;mXV1yZ zITSH{&xf$#f@Xr;0=F{HqGKxLdu3)~aH-`>Z;FQ}J90$m_nf=tW0I3O3+e&0VARM8 zXr^n>Vo+mh!!NN%_|Z4ZS7-ziD;!Sfy0C#bi#8b45#ZcNY8su=pm3ssU!**G<}gC@)w?Z|-K4mdjF z<27tfM&6*P1=TPjl>Bv%oLEnh&-!`!3u~wW8ZzIb)lyhm<+=qwpg#P?e*ggM#}Yf` zA{V^gblQ^-ej0VfhdaMkL>B`R#S+Q442VgN1U~Z&d4_lxpew{{8rw%>c@9{e3^_I{ zpoMstEAlE?6F4Mo5{nI_s4Ex`ZVaTKBNk+b&(Fsr*1Y=u=bxod-#*|Cg?F1J)vAI%u2d5Y zfD8Bsa|Jp+Jnhqmr(H_(B}Uo+fCUBKVH~K>_0@Zd5(EAK4-gOoK<#>^2r(%74WGm9 zhMP4;U%j~p01JwM69@wQ3Lq8>t3+VIe-WIMsHO^lCDDN8D-{MA8ymobpCBCwfD6E* zAf}V?!tSdjQs9!MPH%fnEH@c%cBLw-O!p%7}i$luib+mMf0H!dnQJ5x~?}O{|Rs40Hwi$&8b? zqqrlDqF`o`5-Fs!6H;1EOD`4P63+z0B0H-8f_f55K_6N)o7BN`%Cu=qEse3Q`O0td z$XSh=1skY_iZqQwxON;8@Sb=HL##_ZF<>ubGzyWzqvPku%>uNd;Q(r_w6NVJlWA5b(Oc%fsVs8(PkH-K z`^BLq8sb2ve=VwmdzUmqJp`Fd0NwZ#(vQkH$tTi|;|?+ai@8v9qVX#$#D#pc<|Al^ ztmiGhEeXbtd4f&f-q9uXucB1Rk$X$BYf1B9K?$$=PYu! zUFQ2MHq9g0SeH0I#OoEIs_(VMRMCig5Z9k|g{%bqSK7H6HfpM@UKr__QrE!7p%g*_ zjWnH*i?K^xEdXgCRS@;o9Dr__k44WQHO~MJK?K&>(!?P8hQEWFQ%}2ndVJbZy{YpB zYhdk;5Q%k8CjhRb&L8_L5UI3YF0u9%9MO-5L)skvh!J1_P^CmS0^AYDok zSc3o-pWm$qwFD|309;WK{a8Or(-rmgOR*!uiwPl;%!EG)SoOnD1Ivv`5rI_D9e^y1 z2y>QNa0uO_;bk`A6AJdQ{XyHwyrZ;Pit^GFLb2oWET$3C4V{!u=o}cSgC&uL3yzY5 z+GY;G!bmZ;@pN1fpM&j^Z4EJw{9kjxO=l2+Irh>#n!z6CZp6nB+&TgcKJ?m$A4IK1 z7-n9nzh!&NI$y)Cr_ zo5{=>sZzw!Q5tyNp7LnS*=#;H_%=zy#4G&MH^aToMsGVmR&=FrW9N{NPFuX*gAgg+ zNv&;argyRplj*1M?Z^qJ#yBrxBm0=N-c;_#(_3FEb2doRxh$1nj}{?ANb|6e)vTbP zOP|SSY%5yIa{Nv=Vdnv7DsOLT?`SGQD0>8;Z%pAaj#gcio|WnwYp9i9fqFYxvFM6T z;>0ae5yt2~k4}x5I;TIX%rqGsBBR&n4|4nk;vB~>smZ4n)nA4H)$~xV$0`$^qKR7v z#4_qQ_S*AYZ7m{T?&CYHwSUecut`(o>o7%7_}86uv~B7mpd#aO7kGXm|KqPsRujJ%2p!~<9;wmMDv#RFL3 z&^NUFoMMUc$@`%$FSQg*i(ph>fq5+Y~bPGW$DcuN2lJ}deHBAz(HYX{)fZl4YS96|AR zh=e+x()-690#cAZIGa=IpXj=WySsF^*&skQdj{a?kRJEc4`{IEEMdX+`}IlztTzu( zfPIC<)+x0NZX2Z3MgWmOb|6v=ZXg8Uj6i^SI-jZC*YDq__fI>d4bmF1P(4TG0FVYZ z6Jm`m08gH;2(UdoK<%v!0d2@uxDt=je(A*q@eqJ31m&REI~J5T{e>FXMa@!LFu>9R z9@M-cmcVT9lYXXkqT=QRfFo$-B4618Ao#5|liQHY@U43mLPUF!QwL1~si$X6wRIqM z24sQhF+eJ63GqK9swnPz0>Q-o5P(InJ%X?(w{oB$&xPdB>Tcmph7tkBQNKDhy-jk) zfb9(HUJ-x=>n+i8!WTKe@EXgyyS*hE&g%*KUA+ROKk$-mthQ8TXhr`0UXGH%7oy1g zwc|`{xiO5SQl4mU(`};lC|19QabB`EzJ<|BzY%~na`vx@zAfB9mcqx>&|x8?Admgk zJiqszc&biX@j|^$hWF~nfCSO(wKdkyO7U*Z-}`Dg2%(Cz+HbAL^5Ac+@`dkZ?9`Pb z=Xm&Erx3bk^bRCnY?lIVQVtcZ@Ib@ETBWH32J>Q#WCCaqZkc z-J?uzC`NmnXC@=nRlRvC9S>>~H!}YkqH4s;s<2^fl=AzrC$d2%HqS|nkDIgNcVl~X zD*)D*2oG$5s7K0Cn^ToHk?@E%s@oCOMHSLpYmwt2Ln;|+U_lXgB!%T7JfEj9>4AlJ zgrree2Z0fuMt=x35X%8XthfE!an%Q|))qx)xmg8*C6$mz)@J@dBDa_k|7i?57{OE0 zUC`UP95^7(ZnL7nR1kAn$V9DCfcrD91P2axx&`L^F z4$e%86aY&Oo@NQeQgZR>Ibky3A-JWZ5g4_ zykZ6>TzV6T5gzWj5W5`q5x`nf6qeMo!blgmIaL0Kn;wduQ!1iF!@!M*5d8#otswg9 z>FI#r5#Bs_zNX#joSyc3Yy;y%R26_cSi9@_iUrXj%Ia>r#{U8hhx0i-?hk2yI;H2+ zG2N|K>FwP%efG(_^zQ9F-d?y~5xo*%a)t;mC+Fnp>nL?lH`4K?vQ=ve+vmLB8>Q|qJ-73+PC{$=wiJs|+@{2hsI)d=0-`8(f1 zN%jDiaGLk7i=dM9c8LH&TNKO@gL-0uKrSU}3xO2Y3<6+rl?92avVNuLyVxs|S&aUY z8x4_6D=05D&M55_Qb7U0TBH@+xG7P3F7;99)^(B^jgEFXF_rql?aJ&hFZQ_v+dZQM zl=qGh>nU1PdeJ0?Lih%S>m7Kl+JpTUHo|6$1q$Vwfd2dX(cR`n>}`4dbyfT*t?ISq)H*t_6Ws}Q%|G?co+m6!IZtM4@nf7%(xU3p>ErV4 zcz-tWv9|e$W9_F%O3Oj5^wBY_SL=0TH|uv$pxl5RW4jGEg#m+p6|3vmrb%O#Z8bvKKYH2j8$JF-Kh>LF%+gosaF^2Za>nx6X6aCw$d*Ivla8vckxV3I4 z4&^ytQ+WermIr4K{c3;N@{X@|Wi7gS%?&f1?f3E!fK{h$nBxBVxJlgdP_}_;Qyh-^ z_1dQaV0k__%><3ylAYR8Ri}%2c05!V*ql{{*yDMfh0f&031*V9HPSRws#zXMRk>sufaAt zIn!@k!Ejdg{JNl6c-b?+Q;bTI2&^2yk{1r3JJ?8xMwXW)2B44u6j?!fxv|&_i@wV1 z5V(jd?n6N=_?tl`nJNPD42X&j&>I8+5R~vt2AL430hV!kBFZsG-k}V$CPBS}5r$mQ z9UmgSLeu9W?o!ZwMm5d=cwBJ=9j1YD8li!Uw7%X3i)j-ujk8I!@&@KG5N+Px6IErv ziqm`ISQJ~^BCt${+G5FEX*A}J@HAJTAiKgp2Vms@SQJ7Sq3)QGZ{j2rw$~5;(|>85 zBWdU?{4baI%r_g;gahB-;$cr8Zg8@N1#|t6o$kEnHUwUU#U7&HIcU{bi=1Dc!1}2& z_UHt@V0~+{H81-m>o&&J>FZlOF_FC58w2gL##VnlN6&JOO=(;}8$I~dt(>C#Q_V5F z7HlYyG5Y!Y)=Tc zC%8U&eX9`x>Ppqhb!mm>rVSIl({z8RLElupltut2kW}Mo>3`F}g{aID0a#GP-O(jy z7}a5<<*?R?5>EqH0j!FDk&{VjDGXR}x6n1c%{D^qIX5Zq=jfW(Q>f~x9 zVZ9gm-I;-~pZ(2d9>5YhBsGPB${><8{8WnON~i@JlPF!~ifGjE!k44)L zXH5Tl+8?my6+}2e-x!&M1=LxdSx>+?Aomd61mADB8>9(V0gAI(ydI=+sTneE|y3~ntLhoxcMi5J<7q$s)L+-I=p#6&vq=}=Vq$ZZsqmmR| ze&It=M06V^Lk=KsLL;f;-7xh`tkqjs) zJnB@jwCe$|qHoB0yLwQh4+Y4=xdZ^q^RW_p6}}!&)9tT@l>1E`PJXDiD5IT-(>4Z7 z$$}3~GqakR`YCB?h*+^0)fEo{=xvW5CkjxjpIn$Lj>9M;^9C(m1nP>7UD;Rdk$Z;l z%GWtQv|FNiXpTL^wo(ra(>ut=mT-9jxJ|8TPG`}k(hoBt?ww(6Py?{WSfspW$0#Ul z*}eQGV{KV)Uk2kosYmOe4!Y%K!^TTtV-RfGyTvK zI)2fn^{`Bi$2C&VeiX^KdOxUo93V65hZVz=PZ*d%RKwpGU3EUD;}MFRQ~jsaYK-~padfYuBumv@*pzt}= zxq>vj1xLw9!E+cB>u^Cd4A+p7!smDsAbti>TlD*KN&kiKpgqh9fC{4hlAw@0(50XU zL@5ElcA>)V0AN8X;S;11?x5b*5y3XN9T72>*(|MQ&*`(b_v!OD_vte%8o$LlT#3^q zi6OK{G4cv&qayH-I=Ef~&;|h3nr^&v(MGEC)EBl==h!7K)o|ROWSu}47>UHGgb3L1 zKe7+3TPwn3>EQHsMD=tvhFWg60Teuef#<0)O#}3IounPalB=0G1e9 zif9)36%dOGv}1r^sPjY`l#0nyn~jk$EGJgSB1YnZ>D?gk{h&N3xvdA@^Vb>rmp&J(3dpm!bQ;ldkJMcvOa>w{P(#{~L(%HDA{ZkUed+W6yrUXv`Fkt3{-v{zO~ zo+=F(sTqKNrr+4IHnBcJ8j@167cNBF?^7Atccgo@J)Ndn)GxX>s&k5HyeV7tMuvB& z4x1sH;o@B7J9#O91$_l67)2u80}Zoco3+l-!R=IdC_GzU*7Dhr8%_Cvnz#uchqrh3 zZDwK%wJYoi;|@e%@d8lu_I@NzMtugKPz|gfbK0A6K3`Mvv+25Yk#*9{u9!K6P*F<5 zh#b&XwIaLf#|wbPgLJ9R08GXwBnl)3IPn{A2SDIyq!YjbTB$%W^D_fRgDR2QTFSR9 zU*dlN0L$EXJ8t>gzOV+??@{*cW!Bj$)@jMaRWB8rWB^)QRI|FxIii+0ARA_ zc!-`oBhYYvf0rKa?-jg4@Ih)9Az-wmh%iiLJY&Ij0I2}TqBjo2X-YSHPP_d9zXzag zf4roxcl-2Vcf^P>Om#%SV~zmU!*-QEx!)0H(@^N@`0FPNXhom^~1$mR`z32tWq>G5KYF3k52?iml29^L=`C()Lz#qOT}KP$J|iVk+sGmqlL=yRyry$eaLbT@wGI_WSVlG_t9jco^d z@0ofp`$yYN7;Ny6H!x7wbJ^hy$O_MmDYD8u@S}>1jPj&xAidcl5mwG)S6orDP6|5n-44*Krv~aLklp{QTcUaV~j9T zu5;#45Nh3F9@@IcILSU`NkPpA0^_{m{>%uB%(R7YF$i)CS#bdb@LQHO5mq{k=Zj>YX+#9ePpz#yP2JQYv0f@; zJTEmp7J2rv2rStVTw~NW8G{l4K3y2R+Na%)0IbE5)7<7%GYX=W2yB1@KS!l-%_;${ zAcassA#4v3PSwm`^^e(65Ounrap?Yf|NwM2@(6l@h`ZB zi^U9Y{(JNAfPex-I8m{6(l`i!EfxfhT;Rq*h^&I>F(}$D02Zwkrr2E*M_>tn1%={| z=>tSz?Vw=%IUUZ|bcX$Qz2Gf`0J?qt$s3Hq`uyFSw1Ob4E2ma!>LA=`H%9;qqpl!b z5(?D=h_$5K7Gs2ym(N(xy|7;jp4c<8SM(E%+T%Uu_6>@zrqI=p0NNLpZstZ;viLdO zXJ*G_e2p67{Tc!=7)T|ciE35R9*ld)a5hN+q}ptx2VDe~(+47dF>1*QxC5vP;HsDk z1F#4{1q$R+3`n6?;5);V)Yg(F3xkxdWhUOX-&0eF=6}T?+y@WA;uU$Q5~n%*RW9;muy&}^=Oh8jUFW=h+a(GZUqv9G#xa`cpb*~>&S1koj{ ztb1v*@F5+gIb8h0M>q6H*Xy?F|g%uM|caN2e6<&{1HCsL8G3>80c{_qX!5ife*4-4HKFg z%?)d835Z6g0pb$tR{_e%Rdh0}b)>S-GaieJNf9y9wO^^2_K?4oMW>vb!+yaeLOg%? zNGx;AsVPpR?^UaFqCM%zIn5BBwA1=U`;}Yb{aKY4(DF)xgY{UliA}#RMcnhXK{y2G zn)@O(0L#4wlZyoKHawOiuXFtY--Ee@UM7X=BTFROL};Z)ay{ycx-%f#C#h9w5joBI zBb<2&fEA@)_-wocPzq{WJw86Ar>9-o?+>Il07T+wD*PM3BLJA7E*7ThEfPehAV`G8 z-3hQlO#n5uAOh-q#UkkdUOgR7p>R8N2=#>?;3mQQ4gMEuSphfzKLSt^cn0Z>XOwdQ zf9~#~u=`zFF_-|6U_hUw$^pL+oPq-F5IuI}v__B@R@kuS5&;B--Vx*iunNI8xFPX~ z1>GT~aDTesXXn!q0Sy46-aXu>?|u3v{n7V6O>Z_U1lA-{2%~veC&Mj{cbhGOSWq)- z%`^*eF<{Op%`J<>^6i734JmULt>b-g(f`ONmquq`mG!QlDQH#KpJem&wF{@tyM66_ z2HqoTM>v{Nfhtt{qWvWbk#&K)%}|TEiAyXUo4hVXzWzo#YfkRiJE#^14=5a^CI{)~?p+C?#MwagQORVuX=OEyj%b*C9kaEJ2fXne zStIrJbX;7E)-Ia3B#jkn$xGw&FmY#$GUr>3HvZBw9JLwb3)R+by^%?^b?MtBrR+wE zC+wMmKSY(zVJHHt3R3mWz|%YFiJH*W*0>>rgDS8`9HdPHFrZ<_X5>0CmDBa);NEh> zdKnC<7a3{vCx4iU^w|Ce0P9yj{|oAY8%qrh_>+F}$Pc(~+;NE?l()drkvvP=)B#v- zFj;m?f54))EVu0F+bv6+s)EIaDe^`76(>~=Hn~;^ED_K^m(SiB6Bp~6)<@9byf8(> z9CyaDl!-DX{TKS|c&qIrZumK+=Jy7`vUSD-X3#I?p7DGl86VqsgS+P&|8jZ+7VZ)| zpNX97UUL?W1dUqz)Tv4&mItp$EIl8~3l3B+oqH@18@Do10IWPxouvO|HL!GFvPdC# zfNBMzo1n<~IUSD2^!T((yWIgJl|=q1ii#qk;NN-!^_w>MU#eYxO{XK(kAn0(s4>OZ z2!U9bTKG(W(BX(c(CG~Q)0`lh>FsunMbY2gZPNYyHox)1Krm#t!EZ_s(MhL~+;lEE%c>Zuo zAK-5QoBSmP>$H%z<)ho!A+XXYnI)C}@M8u>xlfA7 z%e0q>kT;~cEzRbX16W?Z@|QAo086|YHU8$ShzQ~*%G{|c_Zu{ljiE@;MSN@Y_t02z zw)`fxU0WHzhwu&YFSvhY!yYo_sX*>PzfAzkJrl+aC*O?5u@g;Q=wl~SCfOm2m9tMK z>h(^BA|mp$x$mJW2Rx@HAID^}#gp0rAa7egB(#Og+LuqpzKib%$QjywftJ>KdAaV0 zRtajY)U*0YOPYJRHttY#$mpvysd0EwFoBwmL#^3M?e{g zAc8a?U)xNzj9fP_K&jV9HY<)S>=i5ChZao)Nr)0_TuA zcsLLc1)sw|1c0#6`5E~O;L-N(4r^CIKL}p!_i49>;_p-hoo>H_vE~V&9>9BcCjhWc zX$MhQP%8@3>}IpHT`#eo)b}AB@6BC$`|yx98>qdtqG%=ouoystV($+R4^*!R_6F!V zDFV)^+6Y{6ad0f!jfZnzY~1u6)=c7BSrCN{Y|K)G`|p05~%1x4Ml7S{QS-vf_; zpKtHh=?}m638oQ#^7c)_89!eUn1fnLpwB@!Lz<)9rU)Pw0B}?naa?A`TaccNvMdpd z@o8Oq2VjZ(mYbh+kN(47+tifakU15tr+ojiOp;0{U~aIz?mQvAOSB(=lw@lRiy<(F z9tr?f0PpBZU=KpeOBUn}gQQr@o$FvhTByjN=bPAco4G|S%l<1~G%%2<{-@UX%e)Sb zwk9h}GOZw?vlleusKbZ>o}+dvB}I2u&hokL)YMJ)f;ZEby#SWXb@s!*`M+pnx3Iyn z&g3r_q|z~y<>=csuVV2Ahbq6M$w&2Xf0-9bMy*9*<%?XIgn@45N4c$)qUNs7Xtv#8 zA|<<_^43!}kxrhSWPG@(FrC%({I!B74MvLW@nlBXluxE#A_rwnm$R3SSCQOGCt)L2 z7IJ9Z_HLX`ZDZdIbflx_WK`C)D%JkEyg@E^{(Iklg9R$?4f<>J4D3AD%c#IkXZ_?S z3T932q542=Y5~CFr?Rc@PNj`*t>fB~4{6+?HJKJc(6d*16l`5z6i=f3+L-ixO>n2l zQ@wSgk7-?x%24PoSIf1iq)}~F&0im-LmEutMbT@FSdqSDoq7PQ!ZfyOPV(3SU@5?& z4km*N;bl@5{p3>T$lOY5i%FJ`0wl-W$)6*Z04yo$F7-{K^CR_vlx^bMgcL&mVw1)S zVi8hQ;G0tZZw9b93@fY`4lXHT*@9PWl-D1HL$2HWl{ZnhbhjHuASX9Xc8K(p0{|F6 z%ol(suP}w1x{x#?4`1P4(20`tSp;7hfn~+maEFk~i=yc+IjB%K1;E06;F#~BR!Q~w zeE_hO4GdyI+8;y|(G7eAKoNKamom^{9f9%L45PI0MnJsnZ;1dC)TM%S!~JfTo}g9~ zgFe^i83I?=*&Ndc4|oIN1^)|x(D{7A=r8CO>R)~S<}Ur<^LOd{?;g^p@7`gNbGT6u zBg7bB65R*D&vv`f)MJXwq900AhOw!bHx>M*R7gtcgSilhPtjQf^g~;y0R{lbeh&ba z-AD*&kpNr~ct!LB5C=a{@P08%>EV8pK6wMQze$_rEUlqN*OsExNbi#TU@fc_M6hx6 zn4@QG1LazaA(_fC*quKrs!o6dz4?##i#0WkAF!(qcT4t#m=^C=(*7wssf{6@X$>o3 zjxR03#z~^DBo)+j3O(daI09HKD+17}n*(bEHkAK|V3xda;fO3qQzZb4egwe6_2snL zS}LaKFqFlpNZdtRY&i*)Cr;HOu$%!W@JbAu`3)4?Q!ajtfTD5K$j4s_aa5_mG1)i3 zA?!tpbXLP$Oy7#+lApo=mKTo9sTdHv&gueVd#msJLBC;|Q&F9g+qdF))nvekt@M(G zVdo)leG|=Fl}=tRE7C$XekncqZBM?QhRLANOLEnagUJAvr>3q(r|~7Y#0^A$Oj~Aj zXmh7Br-@Xykt;LG%E@O!uhW~>={tGA1TH3y_f; z=Fw7LBjf7VgcAh(8=Ge&`hXE{TRV(tGO(7Gxzx>&sr@#C8k1ayT16X)y zv4|&CkFEf1VW-Ix#(zu^+X+i8Q;Ko`OAbo*zFGUB2$k5k@29%-&KW74X(H0^XW2nb z0E5@FA`j1|dHJuu5$;K7?8=7x%0Hw-u**I4VX8TytMc(zhMJ z^3gfM-~I8B4siP(fLAA|F?Hc+rIeO%W8Qj&DSMDM1rb;n;ey~6fk6Oj0e}UOTL56~ zb`-q?0M_MsmQK&l2wFkv;1Q#^65Zwp#m=u6tQqz8ZkxXU?mqqT_diX4_{l^1^pkfA z4q$O_Ss%7>%WIZKqja_8vaZS}^$uHTe`Io4&7&&H9U49qkT}Y4k zPDY0cg${3=M_=Ljs?nTOBEheW&Bc>atJRhPST)Ll5zZr$CQMlG5nz(VYdXAR9(eyK zO}d>EFQe5XuAjecv^X95Y%pUlI3uC`bpC9fHxXa?;ga<R$=yz$8dr7vdy?j4l1eBr7NKc7t`> zCK#hvZmIxQu7Pwf(L_*lNJJX0xyjBelk|;rR{&T%-?(h!02TsQ4!|PtQw~-Gw-0({ z;Qi!A84gjgG1=9kEnh2zkZ~AX1HLOQ);gNJI+9LI4+1Cy0MCBEPy53mLFydVuYz0t z5`kBn%?8s2p?(wS7AT@_^@E5i?B{%;w7dNgi=IOY;^jI^hsz~B9*ziJJwasG1&X;R zyvZ*CxRkC~3kp*2{^;{}=}-RPv-J7HCf(m{HJVg2i?ql#06uWDAKU;(|IP@!ag8hr zaiMxh0Jia(VzGGuus9M6bS`{_HybjTL1(`i&gX=6x(Lt%p3ovtl-B8q!G z`r_*k>BEN)X}8~}^>&N55`J>ON$(&c>z)8C8k5ioOd*6CVq61@ZcrouE1r1T4p>#E z*5rX3Ms4i+&A}_y`RM2Helmn5+?4 z@>0qzus-9wdyy4k3#|j~DHnm|g+!M)OD*I!g>YvAW{68&RgOA&N-94;`ariz)-+dE${64S{RKO#$;{-@LpOan@JMvp^=ryn2l zk$m4Jh20A};TT&TB}~!HJ>L#v1o@E5&UN89PbcFo&w7ZMmW+)N-2UEr3_-n>0N$Z7 z8cfJO9?`XRdGBFUL0Th1BHE~lOp9(q@vv!dx9v(NAUrp?$J}_LfAo+tLORH2k6ec0 zm7S4T`FgbdCx61Otx#nWEf=b1G6Ot$;p5V?IRFDf>1$%e#jX(O32WGcK`uo+SbOW5 zZ&xE7y;t-mX^Cd&U*1beYnA#Q(}E9{ih%kPyKeT~kK-M{lJtD==+^*%^$$?Qoj=yM ztDG`o+Si_=xA`O&me%Je;*|ZGW2!ZN{0WzRPcEJ1YQ69wUf7OKy&WdxWnB%x655cf zl{bI{5E;vjOXZtmzXRa+5G5{_6B!rRN$8SVAHrMz61pmvzC3Bew7w+PZ=!)2ZJwtO z3duO{3`hY!3rYQlGLHjoyW4dh1qd{8ItWp(Ow_P)Hrq{|*NPW(2H(gFAp%ciTI> z=@0idr`utzC`=`!8d-1%g&&CEIzZ|j)VDgFF#-!BuiigB(Jg*Z03A{YFV6~K&7QAm zyI!RqeE+lb@4x?P`qMxBUV3-8L~tj!OQI*K&L05`q%vlFyWojZ25Ir|cPTs%v;zo7 zK$4^q0%*jy(lLNVw;0YT9TB6&;0O2u^QE=H2(8O=`Tzjdhh6&DFTPA)eEmMXe|${K z^%`qny}REcfc55XlkPSfOdDJ+=Xl#9L|#GqBLY}UnClADF-5RMt;c;G{U=G2MO`XF zSvw1he)e8}0Bl|4l?poP6p1*K|7w(@e+j}mThn%nfLFWVBdRGYwC+i>2tm_n1fWIP zMjgoXK09Aq>z=WFCHeGd7w=)MGe|%e(NBP^L=(Xtz}jUTg(Z<$bQ2)~p>hM~7=Wc9 zgG63?9UBClX5}N}TIyKwgz)m!Wdt&V)L&3JiI&f_jW54I!elm{^cTvc8h!R(#OHGL zCrikIy)X}Q$!(I*^AG>#zq%F96q*0C;a4}^_Ceb?^rctW4G-c4hB7e78F=L_Nuo%r z8;R-C?@H$6inE?V*m7!RsEQ-40(D#1LFvPLhnL1JSHwl%<(Bwn{`Wdejdhogd%KxT zXU6+toPmLJl3Pt{bI@m-yUESuqfI_YfeT(OqV6MGBRw>Oy3>{K4`^1MaYNUHaSNdy zV|ZR%)$Q?{Sz4KArcJf$V)E)CWG@LSKvPgoEm0VnMCSx^@Cp?}sXdBqRj9(e(sbWO zY#$6;`(k8X0Ss&^_CDgOtvtmedpA2wn&gbxgSK7B^|n_n^&RLUW2Vl!G#OKS$l6luc6s7iyk<@&pyOnuz~Fva^owy+;Zft*4)m2}JVa`66Zj=-YNNe(EgietZc zAoE!Syz(pUfe3$rfa3^v(A-5Z4yql0lLJF{;SH}P{mB7P)qVU0I~4FJvPRa5K&+@A zIqd^gqgfKa1FVoNeM;hD^}D1;1=g@1D)?*%yUg$iXw_qWnXTUz5DUQpxfPCS!x{5w z7TF_dYRqq3?kshrXP153+SC9nS;BY_B5!68z~XQbe2&2lKVOOhi2HJwAFS8&%OF`( z(Hd~{l~l4R*2KqvnAWjKUrU#iC_JS}{f+2wmLksktm40#TWY{E@aJ@a+E-Ap{DAeZ z6u>$|THhQCv}3XM?M4f!Q&bM!!Utd%rE9^BsxywjI;8WNZuFZkmKdG&xZkJ8r+s?A z+ouovQ~Cf!(INQia!SwFbGqNG)1Um{57M9f;By49-fkc@i+G}dhD$ew$f*cs&C}(4 zq5|^(JmFda2xT>`Afk%E2+|(_VxfK(JH>}@k_-WF_;x}Cu_z)7XgWX7(udt4efj<= z{qw*62F);-k^lf807*naQ~|8V{V~l}tMqVphc&(6cEa^yo;J$`{(iSzrTgtR-2 zu~5EK2)?eS)BuaUyB^GWp|NxrDrGW z!4X&)!-B`af8>2Qz1X({dT3S=8gFd&OSFXJvkOrNep_!@ZgQz?#1@S&lY1Lf(V&gz zg~p-z)izwsz>R6Hyv~&ybN0-U4GlUxD|r~(-8CgJq&Uj&>TDl4VvmW#$oFH9X9i|; z?L&W~09H$B=JTyk*(AK&vrPcYfhM{aGILQzwv;ObBmVVIe}pN7zCE(~%*ivuSDMI+1m5Df+g*>=7uKJx$ zkdNoiPxEe=9mDuZ=_`*m62J@^Hyk9=?N8qy>fTfW|4#27frV%Ir*L3#11kfEH04xVAID4mS zqcTiS3qU6k4Q92>M$_8Mdc%LcGV0OP)Rzaz)#dW4R$gv#Ehhl5Fmmd6KFr&0&YO08O#9yKDb>Gx<6lM z>2Y^R?;oGiuYdbx`r`d#`fxa=>zvX9m$MoFBrN6*02Y8+4|kjNaKB9t4|i$1S*7h} zlK{YiqV5pIgD(suJy>p{71Q8lgx5jpIKkSWysKW6MQ2%MFbshfO;;zs&swtl@ZLZb zDbY^~VqGcRPVAKGVwQDY7u<#-j|x8em=cy(ZbM|7pqfdd2tOYUMnl@=3|{AB;eG|B z0Kfv7h_*<8V@fr2dyY4cfTILjakL)G9pHlzz~Yot0kF{4>q0mm+iHy&@5nYIC$cS0 zi5WiCK6k%7zgdr3D7c*Mb|B0N3Hnuw?^mh7t_6zqt_=~i5q5ng4op$o_FIIVkJ zz$^^7!MA+2^+k+_%~l(atTKlJXuv*O7qFI1CZoQ8jV6gpt#NB8=WB=hZr$=eKv~Y< z8Vyb7xRSE@VkS)KAQIckh-}LckJSRDMAtf}sM%NULAH1{N{pXBNpZO(EZtRk8IsqY ziDm@WJY%&8nE-laUbjK5K(~=aw>gEafQnK7&p5@+gDQ0Az|0h=`lx2SA|GD<;b`ttxhOMmB|O0PY%lEb4ddAfdGt1RzP!vk%~ zuX;KhUVNKFiyy`pnx zfE6@C1K1;9#(0LmsZ$u~p#EZA5Nxh#hi*jfNaw`{!M{B%X30DvT~Pv2w1SdiP?raJ zw)QO@Ze$kRLIJG!gdSAzP-i!J$<8kNA4weySX~W(8_{ha<7?mq)@)HV!qF!#oeY-N zB7OJ(_niT-*xU#Y@GMJGX_7o#1FHsL*;?6N!BiiPsL=ks?B%B3#8ZE>XhCNdd~{qV zfaPUL09{QV6a_F*;CwWjJc?8DHie^E;BXHB58OI1l_NPcY!!-Cf#jw`s9lAwc%!ho|)GFF&MTfB8OrIGoe@ zum_kay}jS2|M^e;IQ{z{d@udrvrp1`1~&mh3Lp4B`4;WbnMce_L z`+B!e=LGeUmgx#9hvzdE_g>CZ+AbGqyIQ8rdWitmySMl0&BI-K^KhRwYly~LbJ2PV zp~|DLe8h}EosuF6DUAr!Fd*Y|T&0eaM4us0hxN7yF!H)Tx833^Qq&#q7LHWP?V4>H z-nX1qs`3meoEWLZL$h!yxSM(P9>9XNln5-etscP2b*7JG)#x+>s^pyqy%>;sSsW3~ zCRii8Bae~0D1sZt(`n#kII*PCadYJ4jan=7Niggoa)3YDCA+sFw@-= zRcEa^_gHx1)on9*JP%-rQK5}#zM#%2N1tj18VBpkWDZw_T2lwNfmbGeah>v28(Jsh zL&kfdx8rOOr#AV4@pY_qIXEds=kpEz5l9=4>ajycGrH~dH&RvF^uqx@yoi(`Y)1`I z=MgFMF@z?^f?v+&-I z6*@XUd3Q`j`|x!}1{OG5vbd@}6Bwt704y=(jz6_Wng1Ubz-rOl0I;S6kvi4X)(s|P zH;CIP!?n+9=i?(%i;;F+U&mFK?M(-u7%goh#`-uz(K+72|Mky)l>XrtKMB0SQT!p? z*LKR+)V*!>x4~h6EKk0mbirC@QBX@Yrqb)@btVgrT_lx-=?phj_J66N}J_8y?b+? z{`BAdApPKbpQO*b_?2kKKnq#4xwf;j^KMJIRGQxM(7sfhrlL4?`m@|<>u0~f77q!0T;djGUfdx-dg zak2RO89|N}@DjidOksRZ_uCBuSnu9Gq<3%MVgwd}g-eWllhj55u?p~tWgCm7U}B=Wg5a*DU2M2H2c z*3?a2L8l_+R|COF2EA?d{+-xF9h*Talm*ohR(nfsEfnAnttW$4l4dM*uq4tI)`kEq z045g*I#LRuq#4EwHG)5buCS#oR=0Ur>wT>F#!)X8jyw(4 z0RR*=owXSo0_hxU#C^JE1HS5XBCG!8 z5KSiUDneeIY82#)R1NF%>l78w)Jfg8kE1b(eW>L6A;5CVYp_W)pNm_0>yku%RRX86|AYCK7rif&UM=@g=o>Jh!b z{%HVKJyK8sp^9AM5;yJBa0J%Sjy2jzi2R#haeBQwU`{g~9PA%E_PmpGJNe3w8eu5YxiYS5TBt5`02?&%xJ)AidNxx$B))~Mi zJcZIB9zQ#uF;x?9+=E*TXY+KtCIqkk-~ay4>5KQfbl5#&k@HXAJ)|Fe|9g0QAN;+B z49{7@I$HpcY0-9!o|9WQY4-pvc=H?=SQmW)v`Lhzk3bP%3uOqRf&hqEE)cxBzq?Co zyd7}OKoHk@Vo(ei3wskIpRU(*fXFqxS@Du~$5Z<7w5MYAyB(!2UalC~wPKJ1!k8|n zBc>Aqfc5FSH|dji?-alS;0!=InlJsBh&tedj~!Y}UqBIwC_=D}0Pp#XBIsltrHH+k zZL_%~+oJbnM@b5vrL|#P93S^B>W%i8?gB3EZ@V}IobYYE61}7n&Om9+>`)A@NwG!a zku!{|<(?PaAT_ZlqEGA%$&G-1C=dKkBK2m^99adoRq}UogC&4i@H>KzTI8K;vzaEM z-#Fq4sF$=w^%cB16Q@Ma0pkFcfdh4iEb7owk3^Tr^T+g;t&Qne)lr_-qI-9yVnTxb z6+H#AY5-P6*-bc;;^ts)YJ}QHPUVZure1o^S{V& zj|i3u$p|}hnF}442Xy#)$_muvvr17up<dhvvHEQlYgqq(;Y)Al1-vWk4VQF8){J<=hwU4m84I#<4-o6JFtOlWX0-v>S$;Ro;b0t5UlAW?$h5;T@VCJ?B=W%ViASRU+SMl}H}mnNiAqX&BAo=eD(0^V8u90r$# zIX=>jHZ_AK?g&EriAF@T&3+HWUl=&xEh-(qYybSbM}2Yz#l0S&-{biRY4Xu)ZtqD; z1b#3jj{bW*91$>*u6!z$Y)Oo+x>CI*m@^j1X1zt}X-oQ>qjuns4|Se^Cx=T)|Lvdu zHT^&T?Vr-uyJI>ZcIgi4LUBaW+xxrpaJNmH6#xSZOlt%Xi|RHJc!d!#kkSZIJ`C!r zX2Vo70@$c}mRy3stHexE5DtJk0KexmszU|QV(_zCaWICYO-gZZTwPRMR3IK|fDr(A zI9<~IcuJ2?kXHCaJV3ePv^l9Ib-kv$%@U)|Aa(NL;Q_~6Ems_U5FsmdqM zTb2q>x=^wq8Lf;tBss+jg!Qf{7xe}*BE}Z4AsQ7y&yGniLk@E>tdCbwTKJJ)(2>O~ z&Gc8HryY5JH5Z@PmHqTh6Z}r7$9d%{Z1Qp2*4WQNhanusr@Rkx35L< zWTUHGkDJ}|-_#%O*(0GBe!#}aWwZuhMJcYSg1`FdpQXS1#gCn=b9$G*ok^pr=+J~t zJ33GKTTe%myLpS6+UV%6<`G}`DBobn*PxS5wA8cao^&M@YI7vk@j;&H9+&U>x=AWh z31CtC;Bz|J*7Ob;SY0#&v2wt+P{BPyGd{7=7Jj8;(6QcEGEG$6VePh{I4Nc}=70Lq2jrD!&XO=(jDu-G=U7?UaG)zNfL_NU}y zt})}R`lzgsBoHW(@AD$HQTO$Dw<1UWKq}JnJQF~KfDqu}i6f^pno0GIY_wTAollq^ zN9QAsGG+cOq>j{_YE@BT@foJ)0pAYiYx>83`Az!&{_&sE)8UNKNUP;Mts#YPwMZMh zsc(}u0O+h%2wnk*gji2-`N9eWdP!OyfMEo##gyC? zL`tnz1Y!Zbyw~VvI@@!IqPYktSTl&Uq7=$Y+U@u0!_$tQpU)|c4pR=Pm^jb~pxxVt zyL7)@<1LR^gNxHOWxWYg^+2md6$*Hjrw>Y`5lIGvwVXl-z#{NTYGIL?a9S!q%lNfN z8zq~7UOH%0AA>&@c}1fm$cG>spQah`41CW3EQFt~%TTSXwA^7L^HUVmM*#q4!$Z3HHcFrk<5Wy?>oub>|2R^4~BJJ3> zMnwt;WQpRYc(kE}!3_XdG6w5Mk1}c`obgD;5W9nXc5Ch{#m3zuv~v&cIf*QbU?*BT z#ZOwE8$4_N%nKs0;vp<|AcmEs5EtF5U@~OZg~$_0~d3se-io;x#q z*fY1HHkaY4YPbDVsBiCr6NJe-vIGF+7)t=MEE1zSxp+;2M zxE7D9ymd^>fiB$~6-GDu44XfDY;3uDH%Yz|>d(c|hS=L2mmiAHMvZ~b`k{CaQJ?Td zYt}s!c{wkIx$L>Ig$^9fR(vv2I}T%axHLjQmhXRM(4T zv`6L#YYq19g4b%-GO-QS;+WiGCz_VYjP&pGN9I=PyV!!Ri>NDWJ909yUCa-?)`loP zYk_#>!}`ex>A{Q0LE6HMx;3bn*g`Gv2Y>mqKTCiA^B*fu#MdZNf&8JwCy=4f=X&?` zvKkSD^awpeW;@=DM*cgtngn1KZic818AJ45%cdF^niALqurR8Et~d9m6tp6&Lgiqm z>e{JRE`J6?ha;0)^7vE?hf`BD3r=Dx!sMD?D@h)FLgGOHLbmMi2(T zA1wSnUszPyY(^<}r*r!H!(;m5>knyvgt}Wt&iRs5J=*8+{A#tP`dX(G)||ou>Hq{$ z<{#2@5XfKFNBUptIS6r)U3BaO7gyp6)$hQbnX7tolxtsoUB9Nud(Z3 zc76GjxZV{5SaM4t@RZYT3CvQfOg2D`6~C}@7jk4MlA%Rnuv~;xWJjrCLW-t1p!nZB zqE7q*$6l#%*K}Oji*$BhQ#gG$v=9!!s(7YaUcvb=(^3ejQ(C+N-?zB+IR`4s7YJjqD5hRS01UCVMQDqd_MlmW zj_7(fz!+187%(JLJ@dmFM6~-`Q>YFxb;}0M>AaCeH)&Y;-XwCc)jiB~?-A znYNGxA8UHFGSza5_DOa618ntQc|ggh9)>nTkK02{Tf=q*0Ia`L0L#_L33SmPcnexB znP>pO^1g`Z2Rca5U&PkDHjl(zaCDM1^bT>*drYj<;>zYvL&P>Y+oN>Ix20ry0E^z6 zOGY8o2yr!z91UD|+ZEQ!j%9g0C(_*ZZ4EU=WtV? zL|eh{GXPvxD@u`rTM|#_w8s>^GZsmQ&#?XRh=AGsW|cm9bC({r>jc$`ASwm`DY*l7 zu>wGBl{Nr!0XPMG^y!Ar*E9zJYXQaFA^J-|If&LWfKQaIMCJ%+BDVkv{}62BxpMdz z7RU#>p}*~Vnclp)Pj{Pj+H9$CJn&2+0)1&51KbUag>m7QMyy>1Yj&lyP62ZzGS1i1 z!dguVlJPOBB1ZX9Dc9nntHu5(5Fct+aVLkG+fNvz3P|Et>5s7Gf7 zWgQi~l1MDG+NhJURvLkTAorw87!-tPLPH#@ zvBbeEh;wIdksWsqya~V(qZ{23GsY!@>dusYS`(xim#6q-Rgb)qZWVZ(4LW5!(flI( zxqt*lF%I5upyH%d|M9yPAz1RBCYFndnF^KV!hmr3-fj;bnfl#kDLXunEF6t4eq z|J~UC0Qp1o4o~McTIi{fXB%JpXDwwUf>jYmzj8PA zDFd3dhep?TVgnyVQ`n7g--S=ukU?q^vXJdf;Sobz`Mz$&Dp3Sh}WN&ZV|ZP73~6aECq)IiFKvTVD|s}dZ6<&i)v z0%@c;ITUo48~o(pPtjUb_X$3Ox=jT3tmtBeXNq(}AO>%GBtQ`Q1%O2&hU8W}0e=99 zf@0{q-9GIP2mBrRKVMRTq%=!UyM21x9n;s3J1mlZIGm6U0Bj)T4}hyr-`uA+_v-|( z83IvQQ)+?pgqm540D5BwL>5|Mt6hEm^&0=o224i8FHlOXSs$_I1B znpo#E&E;@lJx5Vc0*YYTFngCN%|e}l


SOQ*QJu;|I z=D`+}a{}jZ32MN4Q0<#tIC$Reyp^mvR$ zM7zeImDT^^G0jQl2tonW1hf*63!yBrLUxG+r@)a6i)UrPmGF?F$OM2h01E-qf@gO7 zAx0>Llt_+{a`ujM8Yy0bSE=el%L|&JAdO*5uj1`rdAWC0_B88Ns*T6Nlf_)+r3*dg zy+9$6fIvvE?kM;W%h+? zCe};t>(P;FzSyV=P*1EGpO%rt3olX|eNFFR)?J?=f(AYP@tL%icuCZ&Iw2KA_qjvUVKvz}Q-U&tTkahk}nrXyf zcwn*3<4R_%#Y9?6{f>34-;a&pfspP_I~t0sR5r~NY?Z*^DzFV1n@I;zgBz~ae_QKK zk%6-3Hh0WdY&}Jj$k)x&lRw!5xZ;5#r34XJzj7&rJQ|P5>i~#AcfZ1p9{PUzCOJB~ zylCq7>7JFEE_r0-5P-$=r8$!PsD$WqrB*Qif;2 z3I_qzKQeQgd*poWh)A3j z8BqQBYJv{<0jP43Sd>l_K_I_|a=4e<-lTSq)JP&dLFzNC@Lkb@iYp2LIm?MB! za9bY$Spo=2RGUu;6R<_1;s8v6=qPa#0EB_4D*~?$c&i`s5+mg(0%pHIq}}0&xBTt) z$Fx5jDZLTtSYt}w8>lI@S*Ha8R!~!mQt|}!0i6L+T@>jAb*!Ed{J}!(cw=Hhpa*Z6 zTUZfq+P-XiSouKzAV0W6u?7|ZVI-3X)Sb`ifHWUCrEgBDl}q>mfR7^dR!fKslc+TU zmxe61XbuI+`1VKvu7n1Xaf*e(6)2Dy^JEs9k39}IM zT-FtpoElx`9L9w1fqeyb7T)Kok31I{gD(oaLC<-(TQ0a%eF_mfCfBmnmTY6%Brh%wRFJRkeBan)U@)Ha%+hyI@ht( z$??$%H{Fuy!~U)^hTd4PjE#XFD7K^Pqk5Hb=*N_(X!)!`?(X#h56)=wNEd1qw`^El zzxvxTv_V0bSus;q6c0~5H(#uiy=mH`_M0IL6i@U^lTUQE5fuBB+c8dpx&N9IbkX~*5(XrpJzu{pVd1mqdhC+zlS zEkX2lt$!uLk~iLd)5_&{S7P~dXkQdTbD(8hU>m>jD_eRS zsp0ReWtNcIfl!Um_(K;$2>E&1Y%vs&r~!oG*02EsYZAbcxxy?O3Ny1r*^=u<%)vYW zD`#LSD?{zd7}IhQeLIPFOb0cL3Sc2vR>YVx@QMrfW+Fg{ zzy(gOO^Mz$bP=I-!gN|=aE!n>3PGeiT6=rDJa4f+F&META!L@&n{5m+sg{z2;}N4u z<~xO2GKj>0p8)VXJG)#yCvQ(FZJs)nHr6HI70HSEE9@fyvAA6tUM^#t=PklgBp~7; z%K$eJav0$O%^IcEDJ#=JEN(O9D-+<2S2S;QVdhLI74ISLz_GqBJHX^`lL z%uO3@3)QD~OYXc@8^MBwb?5c031IbXIHG?tkVr(={3=+`P<5`U<*$gdtbfWmE;d{4 zfR@uOJeYZ@p+fyVt3gb)%6j7v%_n3!g=~~xpfDV|Ee#`6L}sE|2jG@wnNZ?YABbor{dz4F|gG4 z#g*q0;E{*YfPsZ!qnhkQ{8+#m%);t0A@E=%eU|!({y%q-x(gxdxH&eVB4GFrda}zD` z1<+@Z)J8xr>m#~eo4-XUF#7F2OPB7?1xsC`RV*tdHrypvD zc@lvzu_Q#1`oSO-LItT`3Sd!ap)tC!4(U%ZEg~TtP>^jT8F9P!X-qU{8P(1DM!=oh z4Z59?6V!7aFlCq#;20RW<)}n^l3Ay)&;aN#087Epnl{Gq6Goh@BK9*f?(C2%u2EQ4 zgt26L78zLj2-sD)vIOE!aqRhzqt%ZR_I3%nFPgb4fDIYs?^#sIxN)_=Z<>E3mvwt;cw;-jy%+?ukyvz?r$NM zm7eTWD2sEK_o3pqI+x3X9hk){o79(f(bKhtSy3;hVLziIox5$*bvEZmCZ)NG+LA(X zLQ$QVww_FmQr#x#x;gT8PuS69<&9=WiT6oOtXMv7r48+CO=j16D%Zwh@r`Z3-==FW zjC&Bkq&`;*@6*}ndc-x2-`2Hh%7iUqVC$_L>1p+a3c!;+SJR@fo^r$INViuj3jizF zfU+B7b5G>zZ-`#DC;LD|nO=HX@x;{LsXeQ8mCMY3@upYg02VI>&N47(I8k_uT)!=$ z2yn=8TWGK`A&*aXVp=eY(B87Ia@ai72bPxqA6F<697;a>i{|ZMso4h0pUCHRLz~rM zM=$AZgeAm(llzO1C4+B5=%pS2n>OHD^JgoB5c0B+3mPjJNyx^GK(v0I2L(gmOauk4 zg7Jt_4BBM)=+d5o7Q>= zVa`V2am3+S0F-(9h5R@tBiTHxa*;B9L#hB)xP6Rt81oRJaKs{_5I%&-Q6g|+U2Sb{ zGV6($J1b;>sepX>92o*w-b>5< zrgH%7D+9-mD4&?G<;L73hM(pVlVw(~ZfLHzQCp2`EbDUyoCm3)>l(6GxAI|aG4`Xb z#FdLej47&2zZ!rwW>aDasMra&7w`+jzDT>uJ9SZZ&cITZ@c_Uo{C~HyT1?c9Af1{6 zS#xd%9UatH84N7)QAHWzdvb_Zq%LU8Ye8 z!xvj_Nv*7fT$t)hk;W4A#8;+#7g$ql>M3yPPN}k*60K#dp5x<>|lqhA&WR zy#+;Rc`}Cd|IENrhc$v&R;$r=)Zq;w7kRvgx0TDSh&_gZ4CGs^k^cI$_s2Eo@dbt4 zN}83_j`v)?QWrHvHWIGM$eTl(BOXx$ufjov2$XLfV^%~s{pO8^wsY}O_02UmEfbBl zT?LyjmAZ*CoKP4CQU>~y1C}+t)3jx>S&qPnP)lq`9mK-X^CBADW0_9snS33>sN=8n z6987w9Dyv1aY0Wx1CH1=-3%-X1ClU8mM?(hz=-g$A&6UGLq*I%ll4pw9Jg|At5w9b* z6%3GQWrs{TA6ra2j76>w{%x+AQIkUH$lVhxya3R`qLMsPa_b^ZFTN2_=N`96qe2Y4 zPe%+O5gW=j_G-WVAXDf0lGp$aKUA4no-{dW$hrWXl)vU{fh5DHTN@>WkXT*}U@?1) zm|aI{e@{XzDc=@>Ryr)!-m#oLrV@K(|q(sXF)8yG&h+&&Tfa_F`bfaVV&Nsax{kgAyz2;28Jdw={z!Y4UjXv`=@0RnV z&ZO}ZPuT#05yEn!-(v`27zAzsa$=cerCpJMQL-64e4w#Rl*1lxNV4xLeQD;Qk{Zjz z+eBoLkR>?6fh7YpM`hsQgMPasWF_GyJ)>FIV0O|&^6+V!C)=I;ov77fFu(#4P)1Qa zEj&}zutD;%2D26kb%g*J&ihr zJQzSQALCDELU6ut(HH2A)vRk)jd_UCCG2A9NE1BY(h$Ov8?Y#MVCSO0%1$~uOaQR9 zZ*Fs5r!%Kdr_)gen~lC4k=7)7Z-5ic>=BU=bq*VBmLjs(>!9k zyPU&pb8{nYo!U&NPjB&UjcW{GNn&@jwhU7=IU#v?=>sd^3Fa*FTOrg_z_&1OO^$x! z9AxG5DI9P#*}a;ZF4{zWw!C?iM#Ks?#X2Xpr#x(gmgEOPx-tZYAVMu=CP1O0PeYn!tf~d}Dz#Yzps}`&g)AI?|>Ow9pwjqza>u>e%fhwgn7nbQ&Tb`)ZKIS_Nc5=Q@O?tA;ceAnXa$T~b z)bhYVtP6ciAbE!u9gv!_4bm~R7A>iZdE9Z61vm2###e<}aZ@{vSvoPj#Pm6%Q;mw< zJo(VWsWBH7!zQOK^3ihU_~dbnZE1~)p39?MZ_i+6%XXu4euh{+FsEDN$~yh6IT-`P zKQJ!Sg%wZC>4!_K{g$*f8_3yhDzv_7vTJi}x<8e?7nK%zIYnQp73d#p!;#r7eW0~~ zYn*?d?J(DBU}Le!4Z_Q(h10u&qH=xy7zM}0q6r?LSuFwg&dz*gYIio+Jbh)%;&-iS zm2$ZL*54WRDa2e#JF7U_>Abbk(h&oT0Ib|;#zCU8F|=87urGN@B7h~h%=0SR8;44v|F#XIKsfDq|lV;aDX^Y+nrJD<~bF>*^ zKq4#KSye1160b6_s28*)vs(~EE?33X9{A`YWq z#?aT?A7i-q_SiJBV1?Lj>sYJ9t$ulEZvdp2yh$|N$)Saa`E;C>rHQ2VmORNzBo z6g1;cSR)X=E4STAUOL4eJU>uiM7q_;^WQl$QgqyM+j;8eu6@X@mU^pv?E8!070)wH@y0M;MQPn`RtN61?Tm7w2=k+!?H#~>fc zhHq%pIV-F{&3UL{dn>EUoOGT*thLoOXR>0^3R8nM)?6UT;YBu)@{tky3IPAU<|gCs zC~^GGE;F#`T>=`nwodVXatorYIg)r>KVdgOO$K0Q6Y96Cp3G&1{2@17PKax_JHXL#HHL(p&5Mly$R>NU=~g{e_~y zTKVO>^h~8ZIDsx`*N9pXxxP$wOrD-_d#aWnC6B+GI{^b_tDGu#gMzK~sMY1d8HO!h zy!TU5>y!QXvKq<|tG8Hly|ZyO(0_Y)>Qswkk27_hdT~^PCLD|ERnub?PS1+Ssv6rk zwEDYHcYFM&6FQyfsjBvj_bcyVE>Savi&oS1UL2QR8)L0*4p5J7Nb^9+&Kf&5KEwS^ z-cQ}cRXyqGaSiHdFCJrhm;qQ_60ba@6}0qX(PHhrxQKKCSjU-pjRm&Ri73DJT2~{m zn^_%{JZSwuzIY{fX3O`gHjDpQTVcH!@B9j3U;%#$djffvZ|)LDR`NB;O;8SC0i%lT zD{mgExqiOI_r8c75vO_hDch#2Ul)KSrFr@GYlIpqc|bfD7Y>Z19CLPYs*jKky^`LD z4cZOPG@^-`b+;mzgC+(RP{Kny00@p~Q&mfCV}lcWQ=h0YZkTYIZ|k2v=FYs21WuiC z>~G_tw#rSGY}3&?E=8WTWgiqY0=G z^TCnK0bp?m90ORmg;1r54MKq_d%Z@uG2mL*mOdJJs_YXM+6ffrT3O^~(~T%6IzJ%B zk0dy!3A?top4L|>8M-o1PM{sn*CJpCWP4y-C^LHu?(OZR8#ivGon1<*e!$<6E>TDy z>7m>(D7XL7Px_DZQLU}3UV85(hn51a48rSo4CqUkAhF;8U?FD{!uWQ!x6}5{4v!VB zFT}js+S=lfPpXr{-Udl>G8BlF6|tl@^1 zyx-UM3^y7qnZvz8n}OB#5VO9;)BW6uD=1?6R#xoTE@;dzE_bokBCP%uvsU(}y$4Z4 z&^C>&E!VI+i@OKo8^pYAWmlrhGlj0S-0J~bpeBwn9ck?hFiV>qoYV6~mM_2ZIDgxX z<#efWm$N83Hrr=oo~cwLkX5yt~ZO$-RH-9rM&qhKWkc$yXK~e`fdyv)g?>n&MdyVFDi0W z5SdvsNWLwS6`nY2-5@VDLY8EI@OeU8O6by@)jfE56xiJ1~*1+PKC;eOoAXmMU`^b^{<*?1Q}GdB94`W8OxE zJRtK)Y?76O^%#>NhU}}eQTi)2u&D&8&}Rg74DFCJuBzohW(>Fv57z33$^NAD6JsoP zw$8ws@No-|__Q0_0 z_?Oyv@ZTnzxN_1puN;%oq*5oR@v&l}6uL^eB7DX_qIwo0e z+o^V!1};gD(XQB;=~0`fXNx>N(uQ!tT-#$FAHW*f9tIKD*52We`cv4@M92RflmqMS zZ$J!#=h@JSMsJhf%>awuV6>{&zRUeZ@-Yy_{~+JO;Wc%3MhP~OnoJ1=fuN)?w$l3p zuwoBR09e$N=$Lami&JfDAK!-=q^V0aHQJ8%( zDYFqEbnHE{C)}t;^Lm8<0l=luM(H)_AYU#}tUCZL%kZ5O6Z>RAAtbJRR{IN3kN_-Z z^sKC;HM+GiOI#gqe9Hlc4hLhhmCv^ah`S?zsIsw+5;N2Yyt;XFn}6RshZ{yu!FtSC2e6RbTkImU8%ySu*-Cj^=JcVm zvoxGnd2CosJr`gEtdJKl*C$y+^NSaRiRDJx=cuo4aVb@kG01D^w!>|DO@DEK;^D`h zFAt|knZ*lE403Nt%Z9`t0d*<>R>l`o;7%(UT9$Ai5++aU&=m(RE&IeRZ5#jqSOw5u zvaU)uK9*B!_tGQp{#!vRI&5tBTRVc<-)q*aCTt7?77YDabLMSPi4qO(wLSS0v|sf~ zdL&S_?+dhSY-?1uZrHBrmPQvlK3#R=s}5PCQ|>!-_IkRlc|nURKx=cT_0Mg_eA$PN9I{Py0i8WU$9%h;Wjx(v|o^ z1z?hF^f1mkrm~^YYsNJ+$#SoRwW2m_pKF#+el8!vX>3c9%L^*WKL?A1Xki{Us4@?r zpQ*JfB{tjgZUw}0!h``>%YLJ*)riHR7oV)eB1h6t2RS7i~o%2NQ zq?=@~h<%k?+hIPi=Z;mj=-So)9$zpJLZ)c^2}GhWLSkPrfW-h4<)9K~-s%d4Tav9$ zV)q%yB0y=4!B5=cNIELF3DSQ6p+pyfVG!Yk6SdPb`*Pg@F|`COU6RD^2b7CT!aa$> z#lRzlEpnYJd~+n%P5H|-zn%kFxGh)gj;$MEZDw{O+wUCQz?6+^j3mDoKu#e)m_iPS z#$^evkJ!8EWf)wTUSOgC76Z-U_R!eQ!GUsM250M-w#ULCOPAB^&rmlwOj!TJe3#|e z?Yev8!3imRf~se3YoNB4f5<_Otsvp6Y@P0Rn5qg7Prv}(dAIw=Dt9=;lpdLsvqaqeaBOp*N5^?U6F(gjVBoaCD$5TO!?^ zjWoC1Q0mI2Ue0ts=3D>coTUzH8|+QI1NA;wmuh{R(v6vmj#klMI z)2znu_{=w_8$JdAj#OrHD{ANmu%>%5cw%BK^QHh?sEZ&gyE1_Y!1~Uwe}jdCS)LEh z;40(o0M<%c)i6SYMSw+>&20-UDNjMs0AJg4t6uK^H3v}Wn%H;M<-ov-Q!(qa9fG>< zV@%=rBHxqEZ`eWwyFAIPC;g28PjqHw-{OgZae8a|qML3ZFCg!b$O9XUXf|q_>gX)P zN&vtbSo*S40j|oJKZW{an}UJ~X5VpVLw~h$^bKGFZRsR$nlgo+hX592>iQKr6Asd& zd*%RQBWS)$C)5i3s{VSg{!ZSZjbNN{3n$cJ3Sk$T~zfsvhuWo`9tF^)*ha&Hxr)e<=e%;FaVY+vE3e zTOfnvs=oqq9a^X&$EoW03HYV=cq%~7OswT)W?*ely#!#buQRZf16bjvJ8rwL57J%v zo-f#-Is&jFPezun=ml;Djq?*a54I5)#>UF!dU61Z-eDpHV&#{g+ALoaM3=BuOBm}IfQ75(2CH&=LpHP?L!&h3ZJS}S z;F_JwbtMyk^Mg;;K-Px2K7^%I#@n&`qOEl8OU|cr|L)1O`qXZ>L9WYnOxi^|0-2%S z!pdK3a_??&ZBS=x$3nFYUW(4oahtHPn$3H$-AuD+L$Dqlw{Z)>(N^GiJLs_*fCVS5 zcR*V0_o1k_L+bDO^glUWT3?Oza_T)TPkm5>y4|6uUV~RU4r&IA*V}etypR5^|7+OR zo)w@brLnrD7JkBxWu`|gqmxw^5|mm>B(^2Yr9l&i&*hI)Bz7D%YU=$l3vCR?{8C5W zm|xf+e5O6(h13_St0-N|m@aA@z-qfKQZfNpfA;O4@1bYe$*(x9$j`(%P*&s=cSQjh z3j-{s{?K{!n+@y3jX9Rjg<%LmxCO5OurM_Tvm)levdU3Typ4#y%;!2lB?ABypvnL& zwF|bS1rRItmCHc>t1KaLp5)xupPbz`C<~hl)ECD<_EJr#i2TGDQdEu!K$q%45z>EA zhjeoa(9Xdt4Ytt!5`d5;4<1=VpKS&fccTU*)mA`NvX<|V|2=13p}0H;mgw97OdRn6 zk&g#qhS&@XE5sRb&Zf*)N&Lo%_Q9-KS=AffWS&wE3@MIt1aSFGw znM^SULliu-eCQGi4a?128$$@6{eGORRQgNfd9RO)-fL(bO17ajx&q8L^w-=_X zYIA*E!82li2{R0JlRh8|Ahn%CwfUnK8L9f1ffbo(`jkEnc?e4jY%Tm1j2sV_ z!y1sYB@HjrMD8+~5JJcobpSBdJd)WOS_~zJRANuz%&?Y65>IPeZFE{8@-gymQ~*JF2DW0bhNgdRxj?RJO9a}>C|stP0KgsmWr`Y*T%Hg9D1?KVJ}`D zc&bw^tbN~-&#?x6q9L7QGFHmMMJ)Vcvo%9W1xwfxV?h1mTGKOvrY?a7ks0frLiCxV z3X^I~LZN3JwbVL4CI2zQGxct(N#2fFI_yKMPqSu#HLc#pX>%HkfOR7;t6j!;OZ%lZ z{-mi&uVDHs&Ic}guT@C-cPzfKD1T;Rc;X5_Tm!>8vS^n&Cd)tu!f=RzB|rpjCk)PVI1H|Z zaPWxf33aKZz5yvGmovfSogBcDzv(-bafqdHp926bYlbjnr1$7MlG$qi*%4N-Mt_D{ zrBzxk)qy$z>LAvR{|>=ZUNPM$()Y;EgQyxzInlv-fP%MJ0hsC}i(293@Vm-H7=*9D z>1XeJ2%^cx0SUAe0OU=mhRkSqMa;Y6K&S#+qn_!!Rd%**2`>zoDUHHJcX0k5&*jF} z_%aWg>KbwpK>@*_=OvEV8;SfA;ij(f*$Ndjeotp1wF2G)EN1 zm%{oe#E=23Bf6DvEv>DuF&oN4;h15SBm{7Ok6BoxEyV1D%!OS=xA-BvlYlY;vX0U| z=f~2d?uUndXrx0!EJ3Y<>&}HD(ybQgeir;g81f z1<0f>Hv>J&dQ&o*ag)GaZ5=3v{1ZQ$)wi;J9TXoIN zO3Pa=U8a*Yl6mRU2LD^$SR45E&QI36Gpp&^7oJbgeC1tf=f$Vf(&16s_{jCN^Y9h} zS*JgEIh}j|6Y124ua1m@--Lrx#_l1*M6wrJ4X$q<3L%7QXD+;1watO=?A8hFre+nP zLNtp!=2&%hp?ECTP?nI_R_HvefLUpMyFl8f=iHFcB`CXjfbEVoHgfs=@ug`o35~tg zvIC`#j!o8C3NdI*Z8rEr!|1&b_Ss{r>q`w#M~%o;;17U7YkZN4;r& zKs60IF|R3M`&ZihT5Ez^F;-92WDH-J-PA=U)5J;MB1QJSllRUgSFY<}=A3{)nnmar z<1?z=0RATXI)C;ZU;c6du*8UFD{us`IGlqSSj)`5V)ljtHw3=On=-S^F%727r;Pj& z;ZXoc+5na|$@F0!fR&GV$ZMfXhHpBsHNYXW0%y2=P}dk+YYHYNm`Aa`VZwKpQU(k$ zOGHlgB`+5GEZ~uyG>5-OZN$H)Euynds3_cWCpr?wCCl-Z>r1wZ0sP~n$g&BQqQFw{ z#Q)5U0MOFph4szQlX{9r95(}MH&ug+TgIfunw({9ay#xLSZ>I4{4J-|aKs{ODqE+r zwM1AX#=zo<7}$0k0!0iv*`#O9Qx*l-3F+uCtx$*^fdceXbM)A)kzp%)QgT0DIm6sl z)N@G+u5wVu4T%MzY$sr%kJs$y(c7f62gJBinHkG8001OQ0+tAn0)WN00a8MBP2vuw z7U|;to`fJC9v-kF(lcPG2s_IO5TuU;zEbGo9)%wAdzy0!;DLhrwB}FpaSZdJ0@=aoYgMHGJ_KV8pXVsa& zDhAn_^^5G(k_{E~-$N(!!x8fd;#`@*(kkD#cIp9D#>C1@Zw_E_h-cPUKLUuW06@Pb z2C#y&W7NOVNne_zk>$I?dez^aLbqxSEFImpxV4&=w-3_R2d|_%|HY@$%F}yN zOhvB2MeFaL`)kF&%2DYU$gI|(gt{4N!I>ZL$lNwnN;`of`h-2dqP`J`8<<*4GVd@v z5Il|e+Q?KMb<#&bsy_K(3)cJe@HuH;^~_+T&|X_MfBd}CyiH}OaW|-eF;e4vM z-0fAYe{rcE=S^v$EyA|Vo?oUp7>fW{ErZ!=#xaI^?A6jq%BrtTu3}CdqgidkS1Gin zL8havMr6C|sqyXW$@o*MTYW`MH7Elvh7Z>{1e1kgMWr@o?UY~M@y3^@Kl8TF&%i7G zLc@r#2_Z+DHxB{8ig~c)v=`2_TEK|YhNRzGytFKY74Y7=$WM~lk4z~lYkOp1wV1U5 zcoKjq_?7dH!=iD-w z$Ve~R>}TaY=-XIdg@Hxj6~g$aX#n~R7*UXw04V~X=q=L?BqGNlz~P}LVW(RR1*qa@ z^*?}9a#$e1E3>aOWRc33+X*EBJdKvzc#GQ)iTUfd5K6fOG9X8rMrN~d!rJ3Wwr#G; zWaV5~+zzm?+>|jeB;c>K69+QcI%Eeh0Jk(Ok<0avOuLa*SwaXS^m*pDhsO28JXTp) z3^5bgFij@pb4uZ_QN{R9C}@4ey$=4q*Q^{Hz#3bx z+ZLO?Y0jyswh!dCxMuZ?X1Uq5$b`w4hXaYwyH<-QiyRr-eB7m^Z(soH^D1Uaa%RLE z@>&2^sZ24X!8BI~GjlMp8Y_51&jP?|+Ygjjv6lsaRYLYMiS<2Vsc=3W4X4rA0))Ep zW`F^#uwfVhuH&h)hoyxC-2o6%H<_D*brURzJcLj>Bu&Fx&IriL(anud*P5ot=D#41 zWu`zJd*6_Gt=RLplMkh#d?Jx;h5~)VhUD!MHd*E_S$uXb_9jM@w=T%x5{pvN<)M|b zS+P*tjFo_whn9DsrC@6miP=q-G630apyil)$WqMbBlA^2Gy$-1Aw%3~qQ5fCNOCS9 zBj>nVrTjvY^jrX}E{n6+KrHl@ZzSQCQlAkLhjp55iQS(0M+3mh=T&_nV1R~nkXcxw z&n&CJaP=GRM27&J@GX}XUL|@Vxvg*mp(Jvr53%`(F}1d~uJc_$R|c;bxDv({{iNUN zJz;S1taLDy0aeKx#fK*fUKyLoZqJ0r5OP(;g9fll;a7wkW5p2b5rF>PLI?-@4eB>m zr@+n%?~`7lpA3+z(dGHXz?|Oj2)3i%`Y7wOS{>AD^~c16-U0@&0FdEkJeyZOcX?e4 zz@sicinz5WVs5|kJ#n<7-1KD$CxssRnkCiv%Iz#|g#W?T*4W0?*pPvPkcSFF8+2#` z3w3xXCGGM&YR0-NjCVXF;(5WkN;$ANgs{_4c0Ja&os7fQdPCQf;Rr`P9yP?S?DANn z1Lo{^O7yjb9M7`Z%g~<*V5A7VLJDdPo*;-xR^FRd84{(V8H7| zr_wWDaaX$brFW#mjpelQu^Z{k&t6JrfBMO^w2QNkyzOO|@>X>Xq|LMbr{}JUCtUJE z#g%SOPa$JK!+iaBsd?QsP-^I+$(suSSmlNwDog{YdcFZ8^CaB^U`>@cHt$Q__Z{89 zk6ENtPJ7QG};k!QX>$6B=NYm+BQrM-sDaRN(@5c zf98xHg!I9GtF2Guf70fH*Z>p)N5wE`$N5PRLg)bDtJT@GO2$PWGhG}0$5=)n(INn0jZt9;|XU1p#+t;p|e4gz}C?3L@lHw zVPLHY5E>2v{7g(%43^^w+4wP20zHVp6}PmQbHn!d2G>DFXB}O2BRSQ zrqXY)IC}J?clCSLx;|17bi%uxIW3|C3|@)$9V&AT>JMGz@0FoMb`b~Ha`T_qBY=aF z`%0KsauXrlSSV~=x-pP$Ei}6i&}v_vqyL!gL=3J&y@e1qB!nRYz>=RHipPMK-s&fz zcslxOgLPR@Kseu{FifVmEW*}V_@J@R1m4U2j<}+E?nAemeuE(abC#Um7`DnRQ+66c z2xHiF9Ae7RD>dc-Ru=LN+Zq{Iu%$r-c>L`2!i<7jT`|R|t)gi;&AJ4zs7+uym8D>f zwAEYJJnEcWKGEUyG;}`$%!>Bs?E%0a(w{}&A*^lLL85_jHp&vR3|;jcSfx|)?3snJ zZDaM|Eev)YTwPW~f>GYQlrjO4YSP6Bzi#Vrqb86}@ckyv)&9`CQy)B<= zOZoj6_Mb1dx(sU5%FPT~EPu}(x7;}O_M}h#nIS#aLe^7XX=XEN4n%(vR;;I0jc2U- zDV^~5d!KCgd#cZk8hR^UKpb53v%tKpHLbr}<41wn=SA zWrKIP4CzUw%%_g?tQspEd8j z<7;ipyP9qX02#Fcf%2m7+QGq5B4C7S%6xp&83hFGk^sNV!T~I)g#oNR2eAmSA)tg3 zzOOTYwQlyvz^Xk;_AY=G03K#y>Fs~zXxTc%V3iy&FpFswA+LEtbSEvz`XJc8&3@z5 z3P^`=Tn{J5JORkk9&z<3%z%B)~W}(-ipu(jw1|dK%TQiN}jF%%;AO$RHj))ZBhG*7fb$j+0IsxgZ>n))%Ri);?W8*r?%3KFStED^Obj}gLA8C z`Nl!o{DbT1?7x39ZTk|S#mf0iFnFU4Xjzx(Ru8L~5@M8mtIs_>teuM2 zxD2`V?i(jv_z_YvLkvBSVll2h8$_~*W8SYtJuMy4p9L!FeZ`)Ossv9aYj%)OZ{c&g z-C;i`v8z5+UZ_>mU7mh|t!7oW+N7e0z7nVRWK*_@M)vJ*d|CQ4Z+%^$_vg$%xouE3 z4iaXRGq5aoM?3|Nl8(-~ZiOic35BpAe85%}y)xWcO!AF5)giwUm!D1I!3H~qBslPp z+b(0_s55E~HiL9(pDM~%jt_@t#8ZFmKQ;rxd;vZfX;VQ^RH(8D;(Nv`3zbUJ{3T_L zA@>QuLS@dCG8$;VTIn*+lCJGpsAm97YLmzgt}`9i&=zbubq;`y2722gN-zrFCly}%}vPf6hcnpmVvK-2XllQ7Q+Z5 z&?K8}XO~FMBl%ClUj+Q5c`Z4GkRY2j*D~k5JXX&RufB6=PW&;4C){W0wxcKBnqh(c zfEYA2F9R^*SW_c_WuB=qHswuWU`cC^D3?#Lq?pGD?W3QpCt3!87FGiV!#L49C1WR0 zYJZ=fCt!v`2Z?<}EUYDpJY;)y#L3*j*g`I>gTn&{R+-u2AiT^G=?&}TvfP@G#C#Gf>MCv&&lJb6OzX7&4CaU2w7^3y~CnE`|du zppQ^U4cpB_`*093WY5Jm6f2-uds}P49@cgP#j&MF;U9!w8f)0KOP)a3v{|fT!IEbL zz!FWufswBXIfIStzp%RH16eYw6(M=SaAN$bdT(~yb5hv>fimZ$>p{!oB`H>@+Tjcr zR2ixq5E^MLM_m)SUKL8Y2hO8cv~xPx9so&74^I#&$u18H2^Oc zvg;}HSYu@`*K5i)f;F(}mIGM*5-1t^=-L3l8Y!~Bwj6A#jlp@$q~SW+0BpzxB~!Ci7T6HThA4W~ zzVQ%JnSc<&qVbJ_o#qb!hhiPlUo#sYnMnA&M=JmTAOJ~3K~(y^v_m$Q`6n>1z_#<< zqYjPSS}9}iL`v6^TQ_-g087W)LhABOO}Vy30IOtP_24)Iut#;nH&`6^mid;EHKnQ= z#O=CjHz$UN@GjHAQ*VRvvQfE`@SVXi)OAE5gp>;lVTE)vre|Mc(13t34Id=^G_X~3wjn2$ z*h5`bjy(L@Ws|cOxeaRD9Bc|X{UV#m=8UqY)b@fIB?lD*U{P4Q^hZE30Le$j9s>xs zva+hT6TAT47QExfKAlc|_?i68@#6H^i8`sdt4ry| z8*WdR-t|yAxNS8Ztu3du&uphVf9z9f^S7_1<(mh^5mtn(B8w#o!-cT0iz7!+bJ@c| zMzgjOb2Vqi^R;&LY4(gtGNrARUK^=c{yr$w=C=!Q+wF1Yo zXdL7HO2To2491sJu}<6KBiKWngURZEm<_baf@I@uu3f3!BcyO0t+x zKKoWf0&1%k0I&*;$!-~ptA(-EmK>;|5b79CXSvb>0}Dyq1+jn~64ni~s`w^B0-A)) z2N25+3KYO15DPj;<AtY7oq=QJYE?dtmL{|VTzP*vx7h)I5ApqNHgb?Dw1P&#{ z>=KLP?t_QzN#8U-W7q}on_?f-Gx{c!R)A5`{qUW2D)%I0Z7TDf>BIb} z9&l+{2#4j}z$5Se+ksad3+`~zW*Ne^`*W!=j9!qT1nflIFqiw z;XDIL2WKTz@YHW!O{ahH>9qChSA=mj_`ppb6XNtUXwBi~a=P&a=lRCMo1aUeg-dDU zqc_r-pTC&4e(h>nePSnSgt-Vk&WmgtCq9*p*Yvh}vecOY5Yb zpO7emk$Kjutac$TF7bhhxuKhqlatC^9m#8sr{44BnxC1UT%S5h%DR0#8KAb>Dl@NS zd3xSEBYhn!XwvwNY%TPw+3l>@(qS1>jqVuRhC@-#vJ4?DoERI2u1Gl*@gKdeZZ{W&5JE}fE;&3RfW_=8)3e+r@}J{P zQSm$ptfK(-iIXjb$)96+6IRO{b{{^3G~h1)B*3_Pr>kWTrS!pOlWMFxJ z-Ern{Kb%r?18fVK=^5H4p*>LsI044yR$ddJN`WE`)r(+5T?5>2sD1Ae_WUl`P$A^f zWEpNB6p+t#)!LyzC&JMz@xK=0JzacWwyli!)qKD1-d>1n$5srmh2qRmSp&!CP1I|8^Um=lxz$D8tWUQm$; zeJ5xX z6hf$>_{iTCZdqje$>S75_W&L_)7IIMKKm_{A9?GH2JGd@N*bUR1F^jvKk6|9ZQcND zR><`g*`#78qoaBx46DHY1IQ)-mL6mwnR~3od>0Q%g#O3kY^Ia|m9C3ez;j@&?o2y? z<-Ux|N;DxdapmS+2|ZN+3(G~h3e4SV&0h%T*3dK{SwXoYH*|XEw==I-Dx+Lf6e_s; zf>VirEYhJfzi^2|1=l{kla{v+!fSb(_8!5!7W@21ngawXmVz6<*9Jo|2HH%n}>eY0Mi z*SPHIX!csgWNt^k!gSZ%QxE1;EL7`mZg8R!qn((*!^Y)LbT_`x$+0DQkuq!Vl>Mq1 zGTgAzs+8_MwAOy_n8vYx!I4o}%$YQ($_!a;bzryVS!X%BO=g2vxFhbfa5P(G+ z2|h_yM>I0AM5z9*G$n4}b(r8_XHNBSCdSaH>X>H}TY6Ok0Pq+>`ar^Qr#mupoU#+Q zlY)ux* z<#WXK%5zY;zNqh08hHynl_z7^i%p!^f$SQ25F?75SE{@v`-0h11P&-5m4zW@l?B_N z`U3genAxWNP(x288x4;U&2P?!rAgcsB$b?N8iu5{1suQQj?rh|Z%Lr#m9!-m^_|{k z;KcM+Z6m-b{b@=4nH5Djubk+R-L$5*&dj^obP78qAV~lq0na2Pb;WKn1UoBlxv-w_ zp*&c`SlZbo0Bc`#5_U}w6DTy1^IZ|!O2b}RXIB-#VvtSjqJcnan-D6P0ZITNiriNK zwS7(>WosQJ^@0~9Rk_8Mut){4IE+xjCIvVq1{U&og#`4l~LbaY>>^TSnhmeA$!>%74}el3hpha#af?8KpY)Ex7R#-`g{fgDigaf zUs8fN9fmL1+7f&k1O034s)9YNN!1*!Ftu~%7ghSLkUD=f_a;DHwf4&7(=dKvV6pYC zgCf;AJKV_ljSr^7jb&zQ-TBWx#ks3$9|}#Rx}JW={d{*eC4T4Uf9hgd;)OMS zLf@8`()J@;>GIp}OFJ*#N(Z;ErR8h;>FftCab2qy_awZq{46YcLwq@8~g~CV`uH7Q@%$hrlgLavN%p(@~w8gHE}+->+0&sNjx-BM(yj-SE79= z$D{gU)PgbD_vlAnL6>+!mB>yYnlwy$I;k14!oFd)A}8Bw4=9bl@&a-|N2^Q>s)s*O4ooWSD`X;V1H$wy|7Fdt`H+$D;tQqAQm%u%M^HkioD-P&aG;;1^BkkIkU!C$*aZ1MZIY ziP|g4+`}z|oc~Vr`Lh7lF_m$~>optST6G7{s%pEghunHGKUQGkF)JysutY6F*s6tB z!RlyEtdKWN^h3T!Seo5BxK9b*X`koD$aL6jvV`^R5`aaacdG0hHi(-t+17e!AwmiT z%+k=hKpdskAY@R$b^#phr`{GAnOH2okW0$fK;#+J2}6A~phWM%)VWLjU=T~oM>2e} zJ$CS;Hz{(v6~GdJ%8kr`(W*)85x!`l;u>0*oms(ttGzMxE7zWIQNvJ0oedgoW@L68|1GrvdYKz@TTe+I znorU~wKJKaPG3)o5W*Qo9_F&AK^NuJ_La6JiNv2zW&E<=eDn0+vl4Lw?1?=o&J@}45IaYjx!d0HS|4I zYe(N$vtf-Eh5tRbU%~5%o=DdC(4Ne%Y}GZcJC%duLR546(4K#bwXkpG%BQkkN47vq zmQ&T_1&IKlQqOc_-;sYBL@17o(dMdw!8NL;gp@5!k@lCN6M6FZy5rp*(UXD6@R1V^PU^5G-F$ksxFWo^6V4v7F3B{s&5f4YWw8sss% z;TlC_6d6jgnNvoX>F|=VuCUPq6U##4bWTcGp|Gy_%KPQ#0Kn3&L+1Q5{7wGp^DHL8 zj#4YFne2-c3@g7xh)kG=qJzrTFp$dg?)YXkXFXsO#hc*jFb-K`aTfaxXSl6WHk$-s zIaN_+klZq=EEn1=BTN+lmbE}aSDyo?W_khqPxOhnAE*J8uqh=Xoj)r^7usw$pCTX} zKt7%T8!rM_3QV)BqTzP7oCRakN_qkzY*1tc7W%2OrueW>x9mum*CNU6I?$lhtEwruTeqyIeg z{GBy+a0q#KJypqIS=Tjds=hFJ9Vh;Pqf64s(G2eXlgVTN9dFknN=}$h8 zwm;_#CrGEptXu)U#$5r3|Iq>hFjgYW=G8sjvnU{izlz@7z*x-I~H{r4D32c<9!&B_m{XX;q{3 z*o_UWTUVjoCT{p(r9D%k>QU=Pi{#aI1yfa9u^kV#A*^0|=#_x6;0`%`mtVlqst+6G zV+>M<5=_gqx^iXyKwgcNm=&%4u9|;*H!?WoR};(WTZw`7me(l|(*UqETun9+O9KWL zJKFq_JV-Go7XCK2;gw!RSRvjXmFJ#_+Fdfup!@7Z$B-8|*BtKVA#XT|mko{UTD)=3 zm`@0cRR35)4MZLQY49_<4JwQy*Q0%nVS7eiu9vCnSp& zfMtxb%&WzU=Y9Y`XSWgxtBpsw$kXKE9FnLw0$R+HAh45jy|{G(1ky3_j`@ggSRwa< zlor_p^$k%D8GzMg+nHJ@;Q{~_>osow1WV6YG9IESvrIo4s{`OLZgwriRFhk~U!`mb z3Kffh#!+I1oG|4OLZ~ASHpgIX=~yI=IeLE-UU$pqbGz&}OIj6Vbaf43UYS*8uu7t3 zF#nk~qxMi3egfPBXhL2n1MSJyf#s>di-Zuagu^Ab5mvS_okWiv$U^dTv2V!3h0sUz z6QSw=u*CMtN)Xvn1LiS=X!A(=E=9C(l070ORMyAIi^9V6t&~RcfTa<-?eV<5P)^Zk9{Vc`MFC)o~^zSI@(xH*T3NQbnQ#-NV_jQ#bJ>v z&+Ml&KmT;v`jyLR|oCGr^*|zj-wwv{TzGd*{wUPE&S4R2iS3Yn!VrL ze9x3eV|vakrO~wpFGwA%$SCQS&0rmAVN$~$O!aB%duwCIgLOcuG8a2K?f_PJzi5Mn zEMsF4?+Ji_0SEwVv>^%|Ko*kw3fIdcCzilQ2B6uPpnuK+u>R0(S^8X5Tdp;P z`ow=*9a=xYMQ)RBCr1G+ixMmq6zeU3AN=&^;M$rGfH4X=Wx!+-Ru94~Y2yV3+Z2QI z*wfJTNj9v~VT`1m@JIdPT`9ulhV|P8FAPR2G;9G`h%fCpWs$Uz|;Wix_V4iQLHy`hQ}j zAgI+CAEli%FaZAf$ObepIincFb}+v(u#hBI6Oy>w3QE|ff-uZX0+W(~7RfV3fD3X` z(NDL>nkgCij0mn~TMATh}lC`PU^jEOLPl))QVSR_}h9Rg0_ zcLB_(O)PJ_1vmg$+G$v7843B6t~6NDkc-)sk&PYn(|k3Q9YRyf%3@obl^j~cOs9BA z;OkFJW{HD_(#6U4B)a}vpUsDnhWfjDdyFx|eN})vQ;sow@{IgGUC|~VE&s_V`JJQAX z2y2SKD+)iP{8bwtxslF(;9@%cOP4t}R{hiVtSRC9-b0(|#%s@|tAG4X$&+>CfI}0v ze&cF7^MOlg^=V2Ne^Q?Xy!>NTU6}+`kZL$Jb7x^3gqhdGwhZD_Yhq~*vd^n_^y%?& z8TP()%+NU>%%p{h?0YJ+c+al3JiE2oa15$_j@psw#|gKgVc6%?;+hiP8bkw@uENYI zQf*LwD_c+Ymk`=J^3us~Kan}1nAe%88{T>5HHEk*bfu}^K2~_7Ze_>30?~@-ELwFV zh00gq(uh%6hmJHItC@PHj|+hHxe`JsBi{YyKMx6@u38Qi|+`Ci2NjNyc6o+L94;E^P`c9|9VMoF4$`v^{()B-jx%0jz8j6T&?a zPRL#z+NS8051li5BxFXI93Cd4%mQT)7+b9x5WJWUx88ELh04v?WGu`q7a0I9lodC; zFfTR+#*9;7Dcry)Y>0eL7^{@`N%{`PQwKZ4VsTrVZuspGB-jX6N1bH6Nv4gyZFT{w z3bTXS!<$b43OY_0BW$E8fqRzE?Xv*Z$tq-}G}$^ks1%`w-2WCkW?<}~ELVkKUKA8e7>ANdU+r>t=e&rlCcB3oPZURq0FC43^S&BN@?Y*t7G6~D>t zwEG_UW0q(uzw1WVckM7lfD|7JQ`UP|kqypity z$B(Ah+fb)jrXhm*SeEOaD@r{Qh7Xrn$e)VcP|KpFRwF}!)_NXXEIxw#}$9sBq zGp1gcJO0PqNKf>BHl{4rt+9l+zNYsoQN)+=wTgTU4_d_4dtj;9ubUCPw3 zFH)WCsmILK!~=^|+WF2vEpLSYM$`;n4aOC&S3@=I&-L~qj(+-tdSY;@#rMmo_T=c> zBi;6eyqpsK?HSdIte5~`l`n-&b=&rr_K^zL3YyJzWyB*xD_gU>19zz2O_OaDa_OdN zE6X-kU7MnnwMILQV@i?v`?r4SOVhW!<+XY{oC8lRy+Fx#1{T8A;7IG0*m`-pG)dVY zg;|&KLNKAkl2|))N&Ad~Q=OZRnD;C=zk0Im;R-U*oq;8xDtyhk0tCF7Bg9JO$r};f z@N;iMJ7tq6U=bK-0QMX_8vssA2^WwKBNpkt|5It#) z&A7rQLqlzItxso65q?LWWO*JO^6g;;rVxmOE8+=6p{JSUC*TTLVx6nT?8k<{fQ$*c zDjT-|2o(E`JXBD@LuJE>ic3j@4WHeFru;X1PUc1au6L^hupA7;9MK#uQ4*RDhyX(# z4KM=jmNJBV$%YL%iD=VK|H5GBverLab$O4kF#(_1?Yvnslbj}9P|auDKSs3tpKmc-Wb>e!-+Z1dEgXqCtx>R z$N`XD7+Ee?0OC3nY|sRVlDXpf>U51!`2i$jMy1*g3nN4bI?rA0rvb?VQW?t^dFqt0 z#o>k}>$nK!bbF_BS{fi@T49@(fL2r^UkBZuW=+83Wsl>ckzMW@oz?qS;a#LaY?zW9*!aHDj_D38Sl{F%=`dw| z5}w__a*!h^Vrny{S7Y;3-owUk*tSkv5?>sQQQx4|o@%~XGg+Yx7P2>6*jXW+Z+8G# zQ^PZ;$(@dRBYa$Pt2kAW3$FIB@w!A)tiFP&R8xWKj4q&T{7Rq|@fYRxrhFyHwbdN(Y{Bt&_-QROJN-pH zT4w~Xc=JXZG(ABD6AQ+PnJP$}E*`oWeF?Qx5XKVP3k$*J&;YQCPz$#j(q}u^kJBfJ zL%IUM5a5aa9#kFj?Xwt~lO}9FX-Ke{kTxQWP$U#LawHnr?Cz(%y*2H_K-nS30I8MPQtj=9up{_pbv+{ zu83}~aviG*gei-Q!7#e5P|b6=iO*SEntM;%%CbQscYtb4wG~nGdls6fw+^b|GEh!| zH$jdNHXcSxfnv#nwQqCHLV~gGg}haq8jue~NX8;(lDAZWgA#-f>R2$a1*0EwflUBd zV#pBczdT@InYFLDKpB8#I_eiuMCTs9V+51@P)X!%Yr9C_^O|AJ371_!uS=G8Hc503 z3H{<<)!q)ROL6E001_;69+Nl=b1;+U4(T@Cn7Q=GyZ=ruuIJQFE?W7>qGUxbrQH{t zN>{(?E@m(h$V5O9v7!j{IsNlbr}a->Ppenxh7en6XIb|BJJ-_Xue+D?TrrDjIdOR3 zZSQ}Q*-;esH})a$=8$I_|ac&7O{9BT?Iu+apZ1ss< z4oST2eNS+mi%9ioWjP((wwiWdbc%tvo3A^^P9EjTTK~*;I{hE7q%%MJbm-GbZhmv; zX1JhKcEqLEqZ6~`r1;&YKuKd4g05UiSN$3*qn*VCK(T+%JM zmvz?K*s7~Ai{;RVqH_&fP!7?0AEOALRAZr4m9aQZouk&HQE&?nu*Vw@jH<>|C(7@K zdQ-7tn-cUV$(AjO!ZkEv0{uy--07jY03nqoSUz~SdH77mP1i@P_P}F zwG+=vVW^YtP~uhoU3#Q?CVZ1}^RV+09u)v>HI zumr%e(`1u)U|_}iki6CatV02?_rn5G(32m<}B+;J^(Bv*v087 zZ?H7+_#oeuwnOp@=}9}70eT8fH~&d47|935ey=_Z5Kti>4*^t}NH4@w9#|)>kDpMH zIG8Aje$lSn&CYE=+|ag^l_ZN9W+(6=KS-1|{o8LUl>8;K;oVPryAi`{KnTEo!ky{9y=D>{!?i|m(kk(P=qK-wpK!Bf#(6!%A=|HV$DE&XP@Z#-*q#OD-Vdx34 z!?~vzR9Uf`YRx9m?V@yRC5IA9o;$^LSoi!ELIO+$ETcIDJ?FmTFhSX{1PI6tnG({6 zB=OV+Va5trPT-I+uz1dCNS&@*V92hnihY*6Zn8!&1{H1w)LHAfrwm+*K)#2e%bbsw zcR=jC~cz0EkX8f%bnCtatjKFmBSU0|4@IH z{WO-jUZ5f2@9uEe~p6H>2WURh&iwgbvQGrrn26rKjJ1 zf7*R`i$m@R)LFj1pU(cw)9LI_Kg9{!-Ny~>Yg1j!Q#ssRP6y}K(v>&g!#S=FPpvS> zv-$hi()oY&SX%$|%?g1hmjShN_kqoH@tYq?+b=yWhG_pNo&A|h>GuEYv9x++e{j>G zERp$#63$=xFYiyg51r!h#O0ks?%%neq(1I3lWMRi_l);aO8a-NbDpg0UwnHyIJ=e( zPc5hA>jxZSc-#N`Bs0FK-ve*3tNhxoF}_&#G!FLEyKq!{8luM0j8ErIgo}-BiqNLT@*1DZ>lHHqWWLUTtk`>SH>gbiXxihFdt_#9Eaz8eWEKm%?goFeXQ@X7x&o*4xh7pkb5Z&W5XDU%9oX znj6_@GD^$bs;>6;fj+l94zHxvrZF|{>wU#$H(#uc<@ETvwF(8#Z=5xhU#-0F4rcLn zaWWWtY}908S$YY~ z0AnTvAP2cZ%2=js&5#X)g(k)@61xdbHW~<9VdepayXj_apV$w$IWKN%l*I-_3BYDIyKCl2}Y;@xod^z6?aLE>0;<7}3703)wm!7s43IleAsZp^>nKWzq zKnY-#umx{^lO$v2&0tE*GGG8}Zfxd`5ih)2dq4zLN^?6$4Owg4NgbaCC`lw$)HtV#6Gxz z5T=NR7g3y)+7I5a*$r*@bJQ0p!xC!qT-X$A`0wmRm- zgXQ*(GQd&SFWuSz;9>v^HwSuHn5`Dd77}Ks*dY81pbGL)A*__V|#)9rJx!BA_mX&us}i)iKVqC;mYBV zLvl&^0RnE+WPnZoLr637b74-~Oi{*@gbv31RtSq!uu+W)*vFDo-sgHAsvDSYoU2Yg zxIHk2DVhtV$=f~0Vg#_%o{Evt+?6qmzdpxgeUL>BGaKMdv|st#V@y#8NV9hoD5Cx` z;Z1E?tyOL#0U@exfDwq}o#siZj1lr%mNwGzZRtFr=W-U90>hjJjw;_Y-!{PNV@c{htiGL-In(6SmV*8@V8UHb1iND_O-P6d)M+? z|4L8RHiq>E9h_TDH(q}`CqSn>S5)8nr*5XLU%Q%4|MF$Nv5<2{jeV99hwEK^(_IV< zQ5ofD?XhhJvd;eW#k6vDe^NS>yK3jfTO1lmxxFYnl7OYHUw?+f7`Hxjm4T;)K1+## zvF(?gPTQ|MlWxBHY}$QjlYz1I&+Mdg|L&=D_CH)~7u}o;<;JBBXABFDJGYjsYr5Fd zYwN-dV(w=JwOu$uVkiA}G;&euBFu?OoFhCUY^$^|wkGwj9_QW`Kuv2ZeF?=n1ECZw-kYn5`PQT@`f1zj?`m5{@s)PH-J{u| zg50Lb0$cVcwow$n$AWfMnF+eLBeN&Qpzl2_myrc2BT|;nRmD64VA1=v)6;tWOX)3N z@)8aqWPg|+5+~2|ZU{3An-T%8meZ=95c9YwD~X+Pb`o(SUDOKD7(W%jifc?ZBU;XH zn3gzs74}tr`s~ytaXjfi1F#O|bew@K-Hb_+VdN?Cwi^RW0W3ZZClH2!Jk9e&KeIek z025TE047jsKJ$ke^mrqPMD0btqT?T0SzT5-ChFilv4^GYTN36K7$a~Nj*`f6e?RT+ z5i5eidc;Uk9}xb7jVS$XMUxRDS66FpL}u9BS<3B<$+5GEm&@H`8*l*$)D(N*F2Ik*qX zJe06$y%muDt+r2?SJEZ`M*>Uz=Yd|q~c@~p^wNTxVN{T_88=Lc9ry704dLX zrGQ>I(1Y>vz$S)0IE0_$~^lFYA2qIn5(47s|HUkU6Soieg+iCxbRAjB-7 ze#L6wO9%N)0uWYro6bK;s3Fv6kwmy30_H&SmRF7AahGhAWhNW}e@P+%4wi#el52zC>! zJ4V(=ZS{Z&rc)*JQqA9}_~l@+;($ScED0f82*8r*w8#QI&k*%LT{yv zt{n{6Qng+XgX!Woy&&EA{B!Bx^y;W6sl6+g_R{&Ecs!l?nM?Kdm#2a&OPuum#_P^W zV)i@NCA{#`emeahFQ?nzcOeJx`b90$q4Kv@(%u7`>GIp|;d)N}`qgy*-~H%9dU3SA zlrF#do^*I_HJ$m{i)rJdH$#iYc5JPUXnbdK$5-k75rcEjyy*_UdGfaRKb2O93D@;$ z*GDqD{B?J;?hwd%?x!ymH(N#%hJP(n@mlK_U@s$Rvk-YDPk4tkxX7)0?Pi-Cl+Ag{FP4>5rAs##u zybZPlqh&;0Dp$p_?R@|iHiPEnRkdxTQB!@6OKt1f%t0$PWvYVkedSTy4pa_nt5lc& z@Clh(BaIDBCjjeDzxg#;wNxVCETt#Bl=n#ho25iIl@WVJZru|#q#qKpA=Ci=y{aHN ztH^S>Xj`kZp}e9Sn$Lcc>W>V7WJqkzB`aN;B&SLE# z04$u$OE`zHu;g?fHxf$NTm~qhF(D~!*3X(9(g$z?FOTT|>+{D0P3M_vJWYTQSP#-f z3C9s2kQi7L+M`#;D^qQC4I9W+mKS~K|0N`~y}{3c?Wwsn><_h1a$tqcPPm0If(N#_ zDXR(ja%?^sGZ6h3W|r9}%p}_%B2P}9K;EaPvr?FyrFn_aqg+>T)1+*C1+&H9Linn^ zEX**GdW0mMSuwU&fUWRc=-Of$`uusz*e;c|8e{6AxZZB8t@JZ8u*|Pe#;fUU0I-B` zg_&90yr(AQ@JN_Yk##DJB;+!3mWqUj%VHnH%_N7Cgt&qIB6=t}*o@i3>ri65uuA~< zt}~~6)t7z6!M=cKipdFIOy`<`t=d-t!z?V1-d2W|tXXp4LN=LztM#?@w5~a{_>e)v z9NnU7xVw%M*(CzqO8_g%2WmeMnC zJfAMU=K(8|%AxY^`A3hY^+&gTU#tr4dhL_BPq<60qnG~Fz3J-L+$pQdQA(S?dp+I# z4O&zC{ZvTlV(rxd%pupG+85bSddvG&d`0rkn_U~Dj zsj_>R&i~ls>D>F3(N}9!zGh@4-gy1Fbm=|!GjKc2Sm~2$`P9nOd+E-9`dHffm8-LL zV(-C?^yHs?h(Xdcg$a!{@9-!s@5=3_r#|#d+WNI?Y4yTx!PbPJ28tDA6NQ-zd-vhZ z^whUMn06oBlpWB_4<8up9dVo19^Xw{AH15@AKghSm-o}^#k~nQ2&bv-N^RkWk%fsG zZD&iN!dxrF=Eb-5+`b8q%$*gj=MCqnIOfBy=2Dp&vij3F84O31gMvDGH?~s~k4sAB zA1&)Mc4meOa_&mCWwk%zki7V=+U(i@XBw>A0~@TiIPfBtHDfS-2;mN>}- z)CfSes#kau`-(s;cihFfBv8k$>8_}-ZG;TCKs$XqGiYf6VEM_h?C_$qY=_F)?+CVl z4S*AWu&?$G_ML&Hn+|b^ksMuwjhhFlgJgaLyb|DwPVAAyJ!7*NbBecP8Qa1&49Q^y zVsI@|285O2`YHeF(D|teH}m_P(WJR#C z42Ky2E}+^}J^@!ddwXenXO|BQ=x==B!Av44hgn*?dkS(9Csx={xM@%D5dqrBW=q)e z0f%vktwEkEvCk2}+Mr7c)|7?C`K91fAh)3$Jb-14n+qjLx>#ifEaLhQSeRG`ef@DT z5FwfZVoAT^IA_dFWu-y>+$K%vj>|C6w)}7-%zQ3GtbkmRLX0{Aujt=K#xp<&t4?5G zWd{qv1_d7>dPt^&>chy`p?-N%+(iUkM;FVko>A)sM+mnRioC>rpgh&uPrucfPBeK!MO zd-tw;*472&N}K!5-@Bep|H>5(*^}E6r$5yGorh1Q?N^*l*S`36-aJ#DEMn16&aTtH zbcF#jC!h5xiKWD0mlyv0ix@mCKkJ{| zPWS!b#}rsnKs|e?T#OsLu<*{!*PKg_|K*2sU;8Mf^FMwe-Tr?+QQas`Y0=aF)&1$p zoA1uY>FK?6&;R_1f-yHwM08QWQ{VBB17rI7>QlSvp}+XM@>|s(iE{8=D6ua;^Sv)k z^z&AKh?V!iU;Rion9N<-SWb`qk1tNUFH|7#1RF_gL1HhS{r{d$r+@B>(=@o^u@Nq0 zscj-w+!NpRg0%gL(W$jd23Q22WtL3i!_^m2YmaU39o3ffDiR2t7AG%% zCjV7_%gIgpMD`#OqfbdZr8g6R^|i0E4UwF#>n(BsXE=O;PJ#)<0s{+4Y&|)*rcswR z#!xJ6hV)Mz(a_!+z2DTnv=_1SU>p=|FBU0sRp`9*%?E`M9tmrR!w4mp3jUKrYBBWK zq{*p1PQ1n87B-p!Seo;NWF!Dqp4c9Xhix!Tmo;~iorpV#1&6%^9&D5J8~|8w+}VsX zt4;Ec$W3Dh&cHf4w42L_frT(j^aTv8S@U>Wm9r-tzzTmZ04zzKjfK5ZK?JZsyT~4s z$(!qMxJ`?`4q>3EsiyB>Z3vhkAcKT{fo-Mw81nqcMAHP;YDXYb$eLyw16kD&oVrjW zfHhO>pMAVT0vUj%&kG|k8cGGEg1Zz!Dr~yVPO@@2-%trLc5@%}3BVVaQvk5y(u0dR ztPU`-RDl^H$!wf%`~i&WHkL^Fq{{?gZSU@;?QI3H^ZuO|Vp9K@24NYQdI$B@&I@?_B( zXO|)9GkKUJ06(xGsT>DtAY;g!!7B|Vj0yWi=Dz2LEwa!=y&!~uJ_4{fPn|NaaG+u~ zR4T>)6wst!5faK4(IceQ*^toCV2QIZ|18gjd$^fS2G&&ou&l_S)6V!pQysj*v{92e zNP|!^!*IwX@Aa%C`7wohQfmEk=MsQ#K9z;hW~@L1unyDGOW*tb*{)^^zzRNJhq-7y z($ndQ;s-_K)@DBdSoi(FN7L4?0>B!&rI`ShQo8tD3{;}_QX}bB!Gg*BEtlj;ik8-%<_#`P- z9-S5~_h7nHOXqQ(U89!?mcGC;~^6$(j+LyRX@4PQv{`z~G)t~<5D-4cN z-ZYao_iToB`$R zQw7}Q31VM8_Sas*7a`oT&rwQSzxqtN`-dN$0Jve%BY^M1Cbr!Z|LqIY{@pX#qBA;1 zcIVWuT}$`;!%tT(nwU`#Kk9mW0;`NvUWR0qfQ8oEs&Bd-!!>C*864Oi4+^A(0PkZM=X_5+W8Z0e?;H#wSv1P-=@5DF8Efvb?CM8e}d;Hk7Hs_hz*4=y9B?+-$fB+Q7Qb4{HH2krpqZGYn%r6SVa$DC-Q`d&VN1wQ z4R4~*%K`|)njq{C4fRs>XC1X$(g2Fq^rhA!dG6WQt_27BKf%{Z01LoH-1kO6OMs*@ z1QlbaZ}T%&k^mXO=Hc=IR#|45;IaS#Ol5ZtS3_-A$c2@G4+VfF+TtuQxGQ9H3Ao`9 z!o9t;!wf8CS8>?69Ez;0uBDybeFm_uU%$c6an34QYv}R^Wdehlv`_YX|A5Psyjp(f zq8(?OLx2{6SL^)WYT|HaWrG@1R$0Zuq?OP-2{n`)QV1cdX7dOCm6EoMAcLlov zcmTj6rmBZS=5AdadtN)x9!)@x%P^Q}1`u2GrEy6(%+WR94{*Z3jsRHd5?FujLWnT7 z*c9d#BCz+O(Flh$au_tUDi&sIb65(!4;LxC8nR!`}DJ_DP&|LGX z3`pg}8)5*y^gZ97L2*+6R=>?U0W&SM2_gLW550z)D*zU;5r!YCV(-rNwEMzS z>Bei%a`JNu?W4^zfmItHxz2f~)*svH2CfLGBBs;LSDi~&|HPg1Lk0VVtRs7r)<3nA zZhQZeoS=T~@tsOXOJS_+bF+fBlq(e#UPw&MoB_b5+LN126B!>(8bOf1v_k zJuw1cO^n%--}(^e(`tQ)k#fhsd@P;)sY||?g^BA^xX&4)Tv8OSSbhl9xc3J?rhoRb zrldwMT=+{bPB&jyj1vJ^|LD=Q^~>`BRI+Cfl$)>mi3`?Hw{~Ad0M-jQFWIgBtUa-tZhPOwbmnI-H}d?oTF_o7x|fj22Yq9d zx55XyRm9vIL9!G803ZNKL_t(-NwpmF(2l#qnd~TcukeS2Z7^2>MqlVCZOYU)^;y2C z*I*Edy=_1RUT6(9tY*a_95y9V?JYvk9-~&g<%=Fp-&6ot!Z-?yD?JG&K!R@|M7RY) z!4OUewntWj8qyF(fUglyV9uoiTA2u_3;Ktt^#SELNFhnF0Z!Z93E-@YQuy`WvPYr~i~O|2?Jezj9syVp zAY>qLUv7Zr@F3a@u2Q;o`5@;N=0uqzZ7|ns;N6V5Ph%+|gdWb~nivzjk7yNkHTnqa zR}u0x<^f8mQV7jy83fxMA$Lv=U_};|>7_D5n5lv~48RKP5`eHXWcS%eZ-oT%tWOba z53rNxy;5b(K`l)t9?>QXO%4DS-Wzk#~lsHCn+J8XsfVTWA3Y=N9O?M zKpDS>P~nh)0E^8T>=Idx>PGvdU4?t|tIsbvUA9HfiD4 zi)FW13n^6V*$;zAk5Up z!0JxO&a{E)&*4!z^K)0yT|fHi;@LjK`)mSOyol}`rqjRtOuF-*Kd!f>_O-Jmh{4;( zDsCLb8M-y<7&J#|2&S+M%I6nq^8zo0SKRUP#*CL(ykQS7&<<32O8~4~zyp>|F#xsJ z#}m!^Do1~H17I7WVgvr>FM2q=_iJ8h$$zHV^uBL+YSbJG)a+Cb1vRt&oEZCuKH(FD6PBXZz@ zWubE5r1mS4v{=|z0J${uGO)E21Ix~nJ^TSTHhPlU9Kfpdv&@M#ZGBJd2?m9NrV#T1 zA%vW?_(1Z}An7p444YbP2x(MI-^1=aGCW!~Y)(g}04#(tFB!%pJ7)e#P~?^@V1wl(mXLsNI8uM4^NPc(J`*T@mn!!JFt9kj$3Y zeuIrgidb9zsk9 zAl9;n>;>S;llOyVC6+C+iyat}?_lpE@QR#ctXJ9Iso0>XYs)ePQ`y2Ib2>RgiwN$!QMRqFec%4BMP`)^)L_y12w;{IF#Se?=@n-_j32G3#uR$Iw?04!=bjnzZ{!|(Ct zeJH_-UN#&g0kG~L2tycHw*bJhMCN`2OKT)3q5Z`_{b0KG#@nkj2}+Lsz+eApB0z7{ z|Eq~3rPKnj=;DGGeAn*|L&7rSrBcuKcj!_82sN-C)& zRh3E&-PH{31TrggL-POy6nKEb^8qbW(+xC;fM7cypv};L2qK`UfZ*Rhjy!?q@bn=* zQBZ-V>86JolFC@AA(c6~@3*GC*WPEJ;U=k~_4R>tD)*kV&mPxa>)YR2OTNmqHQFDn z++qOhaF&79066sGTcBnYnb=>HsV}U?-qEW?p~o`S2L@d@0RBEm|>o z09Nbybr^a5?d+cD>XexOI2}4#V6DFmmhRsT=O4S9fO2x5w2Dzw31p7#`S?TubF84& z2_UATR4Bi#z<)2#_{*0H>B*D1KevEQY^oI>iQp*emjW%Iyx;VWiti5;uEJ-^bd!|+ z;Hz5(V5O?925klu3P@L8q2{)PaUk%oCqLvc{N&a55Bg3$C+HMgVuGL&O-6vrfTRGH z1~_L!S-~9NBVGux!Il`NNDa_i3IVLtv{ePu1zBanI-Zo`sXt|c60izmU}XR-_q<9< z!@v>%3mIt4z7p_?7+2gZb|X{}%ew={ZMI;dx}cEGE&+|%KuD=My1JX0z}1&U`p%F! zf*PFi4K%J88fWT;#C?Ozt8fo<46Im57m&uaNL?tm2)f|(C}Lo-8iWmEQu!`1(*&h*@vW43*8?qof&Ff(q72;c}C3z=5SD;%sH6KGH@LIk%qC@U`lNogL6lOe71#`hKBug@r}&49QJz-Lb0_yh1Rn9RZ;>%!Vqig2Hg3Jxy6xCXS(V zWz%kQK%j|xXQN&?u*Cx)+Lsywi}xJK)T&Uoa}Q=YpsXteu9T5w<6k*FF9CX})X@2& zqLk+jyNjy4V^?Dvn%2bJBbgIwlr*%~4slb+D;_bZ%=D6@YS$Y(zPY4%CA?uc7>^>E}E!Y7ywHqW?ma}WJw0V+SLAD z_D~hWJ?vyOl8)bWC9#NxK6DIr{=@081(R5r&bp_Sy)d7Fb%NZ;RHZE|C!?V|Ej-m-#;}Q$_+kJ{f{Irj0lu*+ zfQ9$&{M*wMhpc7MQc#>BBDCI&zwU)?el=c#U^`;bn)quk<`c~+w zZ2L$hzU2$c=7Vm)bI%&exOi$^>vu1~@OzGPw$ZZnZ~7bSnsOn;45$Zg5CALakXTqc z6NE>pwS_WGUU>K}xbU!Du)3GCPG&A-j(zzY?D^dZVr6BnvMs|%jpkO4-ktM;g7=2% zhJS1RBUJ#b&G_ymT3oTe;?`RTBvnKtI;(YclXWRXu?xo|wQcYh3O<+WgV}hXak3ZzvAu&lfIJ5__(EUQ=V1?D^ z5wbR0(IDxwxd4_Z;9OqzO-{KaCIX8xG>+JHg~0(j5!c|l5_^aM84aFo03}qGIRhj2 z1%X%uU`ggGjbSA&DH;Pyfhg}{q57>bA~fTp8%t(&alEKdX8F_brYCN-^^kLyJDt|p zIhc`4?$uQB6x&5Ji;24_1BL5i=&DN_8+K0k+daU<{=ya}LER==QW?Oa4Z%SH;TzEHf|5hD-n~H6)!OW#VpGH(Tl-ogcJL(Txk&o&=?qHsP;(0jwq_ z%|*JEXS`)#MZjdhr^0)Ut|9s*m63_V#slraBOm-<*(vN|<-sH_L!YzzP>tg=sjC~h zM)4-#=bE}%H5$(KPGd4LIOmgL*seq%8NKF^b%a3G;?fdwj1WKGMU&-klf+%H-cIi z(9p%@lI)1u2;DCOAS(fRJAl$Kbp#|=(8@EgSZ1o+(8CMbYmn)T`>ZAoQ8#sQPj}!o z4P#c3cAqGtNMr@G_tcFr3ZSlMz~U0BIt8<#yh}3uEA>vx^m6itb<3s!EF(`nyD*%y z3~uSd;dfYOTr9}FeC9goy`g@@`@a^eb6S5hNM_>4Q4A~suzoEW11qqb;&C#YLbTNv zh@rBbq>2O!cHQU!o#FiP`pz~u@wWR>{HZ-3KLNdeHDm7Qx)6Z%sv{IY`q0b20j={T z0G8Mr=O5Y6F{Ac(!bUd-dAz4z$QD846*CU@e|7@u#}+G98Ch!MZ#jxbsWAGp7QB)E zuGQeoj|{=-XYYlce>g*6VY64c3nBJzfz=&!e>@gt)_S(K3lHpt$?FbggSb-+tcwp| zp~1fAx5uI9ALa_X(#0`J+_f11i{xWaR`|i>YY*qdz^VXX;Rs?vgXa#z`Ktz!Hfh`R z3I&*NKN-bvOIpr(<6HxbVU}_s#5hpJ09Hb<=|-j8+Ms`;x#iG&C*4DtBgGd3Shu3K zA$yo@quIQy&^5QL_q4&(s}I2P(QH6`bOqk?n`6-Z)$>v(TefLO)U8_su(bJ!_1jW| z_1$f7?n(V{_UfG2a2o)-{&o%qes7{#krL11?b(+~#5{kUy{Wm~Az?n|70`^Rt6Yh# zny(dxDz`2G@R7X-V%?Y(N=YKA`|R^m<1!6f#<7Yd=(_{;H;A3C^2jrBc#bhE zNMl8{usju4IdYmgx-~qvkuDP0lCM^A%dbLu05%? z`7vO*BNAV4#n3q9M#&5@2C+0r1G6bL>mf1Q)NN2)8TCK|1H03BSa@G1hlg1_`E zEB)JPMEL-gbxo8C3XYdq3(Cq3_YbFea2@1egI(w;237=M1lXm)NHKu5(bGz9bn}ncO@X-4 zQ2Y;lH5yPKTZY{TWSv-ow$rP**}u>gbNtO$kYpHry=AX>%)*}E z)>u2SrjT!ijKA@+{2=a>g|OMnzN>mY^exQ5x-oD>Q-+{J?CV7=nj970D0D>-SkMLiaBg1s~~&lUn$FTRz)V!G%V^Pt-)ZI4*F zi*f8)VeIWkiRl(!y?-_XyZ>lP6dWnn6`$7Z$%XLxY!G*1V7&$zSV_#ryjsmj-U8zb zv!T+wc-kIv_l_@I2ZJ9yMHv-KnPWL(V(TVZVpELXWlWk(EwbMgSW&7j6ivsX@5;no zuuWzQs;~;06~_Mlcs>`Elu{=uzFExL(z|0VCHY(ez@k+tZOKsPjjNzLJv6$e#}FFu z#0MXO=RN*D1~gHsJ)aJv!jHy8yUWrf%p>}ajRXR9#Kn%l3Y|Zu9;6ntZft-ZSx(W3 zE*aEN>uB8a6fgvzjDMgRjW-mMT_T-d#XPpMTl@yb>33j3n1 zO@fqDyEPE7P0g;rK{)LK&_M@KjW%^3RHM zB%BF;p7Pw{qG;SDAUmx!Swo&J>RB}$>|d%N%aStZ3G37YSXxb!Sx>U;sf#tOU76qh zw*ptlhLY@nvW^k_$E>a>8!U^JmkI9(90QBvU@fk!aKLtqMJTc5aJ^Dc>_&s!1~G#m zx)36eRYwp@g1S4`Mr4CJMy)(6?Weto+~3=Tp~!%g0&jW<;|^mK1jgSANE?+)S!-4$ zaJ{H8>jHdUj$j1%p+q9Gzu+E&dkxAa0;d$HGVY5Shl~4JAS-cG4s=Nqw<(-AI>S7B zUNfA^%yM%z)Ilt>N%w0Hkn=t+^H;M6%Zt4p;#q$D66I^B^R@ z^u0I^_2jZAjZ|nt(8da8_^90)vIYSfaN|FFl(GT#{lydv{K2>zPc4T4EOa462G%RS z4j9+PUI6X9=UK9)guwIkRLdXoP%`xag!EFAbdL&STc(*l%A%a4= zE`$hR(J^}rU?o5g?F0M%8o=y--$${g;;ZXl=VAE0Cya}t)AAGRl;4*RV6Er45JpAO zE9?%GeHDV6^N;O=(?5|0H#@&|0fygqk`hYfU&W@vwiprxh45F|8`9vJ1t{YdRe;+n zHzvL@Hquh{Ef(3K8IX5xRBq+^=9Jge^A-Bf>`?LQ4aYGnhivJpOu8u^uzVx{tzmSi zs8E^x#0MRO=MsR$X~VS~QdA|A6M{FyzA|hh4PK6?#hST^ep8md8W|yc`TDE9&!@;d zSGhj^UZ)^Cxx!Q0mgX4;`U<}Tk$S5s;x+!2Dx7ixP3$1a2Bnz^*{JX=Ev^#PhH6QD zfInzNi5n%IlQ<@u1uTM;xGoj}mA=(k!R#0AN8-Y1uzmw>1tj{BHN47h4kf8+Y6@z+R=VdjUr{JHwL!4?3X?qiUOUl zpBIVva1#p6H)q|MYKC_p*fjC#Bd~b?9%2R!e(Xfpq?))8UWYNTy5Z2Z-+p%O2?uCc0`(~z@=z=+R<57yobl^>D{QGf3<8$@}`{CT<2cZAc6VUe; z(@_~k#v0#B46IE7SQke{s0Ls)_wF=+)qsIdO~6LI1?HYToSk9~fL(t*3;mxw#lf=W za#U3#MB<0fT|JN+#C_=IV|hfcgg^J!*N4dC2W{V@03y-Dy2W2+6{bPO=| zRq`-4U+8$iAQCOaz}hT;rDcWUB)$BDdyPy|OVlaKVFfDzSY-mo)sM8Q;O_ZH_rc5y z_ho{lBinM{jduYBpSN=-Zz?wgzD+RmRkHNwl+g#8fA8t|WRw8O8g#3IVLg z-N$7XVvtD;VPaKD>?iuSkNL!>*_^6eK`hNsNCtzrHgG$*HnwbmJPd#(_m~r2E6k1V z7zHv8!2opuP$NuZV3A=Zr?(mdieDqA@4zGhv{4qbJ;k zVlk@r;c5q zYatNIHQ>zqULK)_^P?{4)uOjxAFijmxNHWTaagNC>HZX%9mLsex-ZRv-S^y@LLjq1? zaCOH5q|C1CE|5Cb5M`~h6|w%5-a}+5mW}U38G^B}5cI-(G>AGflMoO>`G9O!d>4XP z_|q!PSKMciU8SHL)?YUmbp@ooNCM1r3_FkLP&*}d9LITN@Q9>q6z|Egob8whh|M6D zFx;3XC*sa+((b+F2xl@9Qk*k%yVd~i0@&a_prDp_E6?fzPN#EY?sgS_sBQ$6GG#UM zBX25cbBBxche82>W!#soj^p(eE;S-m^I3+x&=6NMYfJSNWoda&Q&v>4!k80*=sMf@~Cpc#FF?|G`}x@{!L{XwO{u-mUeK0p@>z-?1sXRS_7(B z-ApRG^8WCgRi;;+U88)Xk;IZ zc2WTI6gy^9lJy?^5CRE@U-}JGL+;)6-R&^;3s*qv+zPq0#TU8&O7n!5;}Ge0?v3eI)OfI-_?NpEQAd>tPHGB;`3k0dSwmm zg$M0~>6eaB_CI@JVEmCc+>y?*nlrgL3*jaJEUVd7++o&->M(iT0azLB$ke9&6w05w zv#!o!U>2>767f^;XyVDdkK(bBzq4>uS!Wn^#Jx-Yk@u*5cUfbtb`uK#vkHwF8TOBB zS2NNmjWruF!T-#t3&m`zRCkm$KUwQ&330c01u8C6yUl}>slztIz%l`5t%7;ggGS-M zKK2Sel{Uf1-6=JJR03kz6KioHR2Mo9^v=O=HE^^CU|31Czzo-$wOTa)Dd<13)G&2D8oE9{6dH;ghlb-~k)c-59yOt=^BL1Uqo5|w!YqL0_O%Gy z-!;Gn001BWNkl$Fo+;uDK6)b9zPSvQ z()yJKo422;YeT+!vRY$u$d^z2qX;jt7()FA!xevt8TTF$1o$T^X1{z)559 z(R*~?!F^1Evvce#lMsV4Ir4=)M&OlUIdL{wpFP$yg~Mqb06a7X0$w=)%dLERlL9x? zpSb@3$NJLs?^)D*aOBz0aY7HPprrQ!tB=(M{9Da!fu(-wO zW;yoD_ksG!McDWDJG}(b&7$4{lh+=Eg$L|{z3;gjy8l&zL}v`8{2u)716bi4WB_Y4 zCy4tt16ZG&fZi|8QZ}~9R~{tLG`^4>H+=Ik<6>7n8;b#~yZ!nxO?RuuOW)u{%>q~# z9^MPHFW3hdLoU8BVEe%Dj6>Jg6}(EcDJ2>zh?K$@SS}0UW(sFz#a&qe6n+=%6aLvv z16bw5PIoLkWEV`oWF!+)3j2KI4R_`PScxuS7s87HU?ohW8o=5A(hsMfGn8!U@XaTo z``_j(_Cj`;@*k|Y2W733tO*#+&uRcx_jv4@q znN=EtgMb=|g~ec%xLhcJB|&G&bqr6vogra3R%)CZFoTqL17H!rCC%{jHEfdt5o)Zd zBB1Tmwh@3uF)FxJ1Y#JplEC8vV(D|Lh$1t9VqgjIcVaPmFCfS;HEP0OGB2g2E_f02SNjls{f4-vq^3}VQhSi$UJt82bq z=q^O=JDmLs*%O)q9_!7FJv2Z$c9>@$r1(NIUn2u#GYwbsCUhm_FlWJ<58S+TcF8Jq zKxDXJ2bjkXwobdhL(eqHTD$(RL%v_0}td5yt+!@6M|R@VCh!k zjdTxU5dhuBLDBJ@YpZMIK1lHcRo>!zG5DYoR+RmUV1NMN2!bPs)!NnuofPM)4jmo! zz%`Lro05G{nN|2V%3cI{^aa>gE+&_J&kRt>it7$}<-kPT!j*l+U^*WhCN_o0 zn4_u}D1ha33aOxTAJl^f?6;&Y=fU+%|GBEB0jzYj*`+qv3$4ndeb2kEyI1$&K$n!h z(DmiqYK@Dw0>e5mq))i@$YY>PF&xir09ir@e zhp+o)26t?9x5DJLhhX9RcEae--3IL^d}coEcmlA{g)kAHXv-}|3L|C)``s~E-_-`E zpE(STc8pyRmW=oGfBF=(Pb^biDL8X;T6(3bVzA`HFEcKL@(y$zI{EhdLf1DjevS?P z&5Hn89;aS=1eWf*14eGV9Xjq_;`b#1taQa0z}gYivt@aM7+pL5X_E}BjP6mP(?pB8 zv;fv50a!Su7k+RTOulk7>8VgZz65)3x;x|Mnm4%B0W9Ayfmln7-{cK>SqQTXti|u? zfti;dfc2eO@Csen2H$sr19Pk3<4F@Xr^1k>+FuR8vQoIx67ic(%+XCfu60lB6_o+3 zoPCBhru@!1f7Nc7{cn3SwW=Rmf_=YuH(=s`s@J9gEcb$_p81#oJ%P;G;~%&pnb@G` zf1jm*?#*1;-J-(NRpy;45cXc|*2J?xe1a%GOSU!<E}bj5AgMk?QBU zQHfNpxj^0e4vlHW43cn$`Fkwel-YxFr??Ly$b>9P{=o=$d^n-*%nV|C(4VmZWhn7) zVs{C{OWm|J%d3cf?hlDWh_Ul7EG!U{J`OIAZiUPoR;H(k>!^GumCpov>5s(1GP2dVNNVL}z!B(T-IoDIWwklLQ4UYy ztxa9>7{GGhx?RqLEwKxsJ+vs&nZ3~Qb&>Z30G2ky@2*ZiaPrT9TW6}_m5I@pGn16aA1s+Ul_le%mAMf(#$ z+#4|PNdd5Ehikyx(}rN~$A+?2 zl88ti3z)#qscT07T{q*a`)l(s^!}5T=8ryG4Zx}h5SZKOpE<)k^TNGw{xN--`gh#5 z1jFw+kx91UZ}g^j(XQk)mn{lWdRwyT;fL8<;!m=Is#1^U%`y9M=AOj6w++C`uXR3# zRMZzdK%%o2kJdJUR7EdwH4T()eZuHPCZ-D0@HM!(Ih}0)AOq{!kGb3_{(LIU8K&^J zGLQUkla5>g9SZJ?8J~oqg>E6rOtG{t6E6sBs-T5;>S9b>SC9oYf_rq?%89?mrqGj9 z%`ij(eg)9toD`CpOK~-IyAgH*1#))*c@-?wXA~q00^G*1jz3-AK8ROLZR|@CCMpRw#N~#K*c$Z>#jg<;!j+X(VsKEOVFx<{ z7s&Mo8CdP)O2}Xp&mjh{5a41rB=1U?U4_ER+u~`dJwYd9O!L5 z#S1a3cx!e2ot`yr59#!9E>mK()<~vC2RM`-j7-wv|5ky6}NgQ=Gug!zZ{ z!M=Ch1>OI4&Wnl~!1Df17)Jmrk&=GPvU#Hc9mkfS_w&=x^W{07>#Z%YI?_qZuln&t zsE;i>WAnm;cfs7#hhg`EVzU{o)nS_ql0eg87R_ z9E0Vbc*lLnP3-Vbf77!&N-aoVQu6>-`TTT}TVGT05xl(+zm*dmqJM)-fwB+c*ZWvMd~AJq^9*n2-{}=i*fv z+P)1a2e4|ed|4MvUw439PvZ*%fA|0HDGA11G;4iLLUCWv!A4jxfHj)!zf=~&BI`KV zNTLAPWs9z$++qOh+q~vW>y@s+^3g7s_?d&5_*Zy$-yhFF-=9q9gI|dvR}OW-)b%4d zLEOI+Bo|1^>x3L|qnPMY{BG%f-Eis+*({P6Gi~_&V^BXHx_Zaec3qd)RLh2~{Ci($ zFgg_Ie7Dx8Fcu)<`95Lpxj>(1ci!OzhPb``lEa_lPIJ4j@?b)X=(?-gZYG0O^pZH%?WAQ;L5j;qD4hxj2U%fKvz z>*96{6eF*_-VPlU6dv7=8&I!vmP3BO$)1SqRRGJy9&BUQm1gjx!vz0BhbTt&Qk~uR z0;n5yt&_#{c3#BXCkmcj39Xq0LWZn`uQ083d|lSfP@(dITr^w1&NZkz0$4A2XL)TB1ISA?Qs$HQ@rPE|=1=6c z7vtnqieC8MoiOq0!?bDcf9vhgahGusl)6s8_yEPp8v4+2==p~;t_8%v+S@@H@-P$M zRxSh{FasC{tG@8iURWJ$_Zh-A0J^?44}%{&39V;VLxT{5?(OSpE(6*pSXtruQ*_Hv-QRL9e8sb->C)*57D$_R#hH zONwu|wJms}^o23tlj?nUos0#wFO(n-xO9A@nWfm#`a;7nQKt|R0sKH(OFNdvY=KA|)pqz^QJJH>F( zfXBvYQDy`IdJDBd;giv;ya{ZVB zF=b!!D^CAqXL~$jA^?ltDei-qKnL|JF;L0XXjOg?$U*=MgE+gGVKV11i6|>CPG!Oepjg;nIr*1Wo2(c@kCtjvl z{q$Y{tGOQkZr^QZj?X|Rvng^d<+}1bb234)GdPlJo+poE^~h|+HL3uX3HI)|wK4lv ziKm2|;A~Tni$N#PKGA~$sjYLfrrjj!Zl1@Q2~gb!@h&Wrg1ajqCUT6xG6B0$J|KWa z2{DLCg#Z>1u-(?q02Y-`LALpT0WVrB;)=}jm;<^iaHYVB2AQ`jj$?cYgP0C%7&t)}91-fpn%z%^N_p+Zb3s}AC4P#Z?qXFdw6jG3|`aJh@ zkM|#*Z5lhRu$;(!&dnu@uNZec?GJT*Oevyit;p9x<*vI=>YGeHq4&IZ8J z(H#U}ZFIN7@O$qjhLtDDa|yH0*#~EyItT-w7>C}^dmw=Ttf4xbdi`Z&7;gG%01SL$ z40iqXX$qc9j96hG9wTrVnPbSFi7#Yc?f%Rp^!)vq z67Wi&EK;Xg2`IYq0IVh_XX)+jlPfUr(Q)Yfwg<*bA3}h#2*7%A0>G+J===}&!r7+` z!0JdA^u)(IZd-ui_l-fzytw$L%1m_arU5K0-wvZ0GN+8_>1R|I1mnkVJOr!zL%ECc zbMQA$!H$19UtnDpcUCyFs+nztca;?3zm7X2=fUXX=IWc;iBo%a$c?Yo3r_!*4h{`Z zhYFbP&w^J`Z)9GaHSm3L75mS;e=}M}wZ4$MaC7QDi`nMxsm^~^_K#=w=F zY?JGtQ|3*!rdEuH#RdQcGZz3$!7Tin!3e&{c+kJq=YZa?#t8FnSOFCy$pm@_2Vi;d zjSJ>|!6}}?5@MGbJ?%HKuvqzX%ovLIMOmygOBXT*Fc2{+vg;i19Z%hjX6@pANt?;# zMY3JlpzGAR^sX?KxHgYhhm9k`Sej!IutmU^V}V8TL=6ei8@!Pw!qc!Z{77iOW#_l1 zbmuvv)1yX8JQ}8}$eLKg%wek(cv&-!Q2=NO;;s&GIOmYb#x6NE$wtWTL3Iq++<|U| z_=DL9HJE$k>QiB_Y4#Qc8>}hL{}ux;(!tbasp@+i^D6B%W|#`u1*_wCFMw6Gx4--M z1#?FYTCJ8xv1J*1H!c;u^xI4Y1vUcVEH^8NLh+U?m?faTx))kGs>Z$p$H-0E%M=D$ znBl~0o>`>Kz+zd+@|4+?Hhz#c6K|!&7Yc&OKC^}ltkpHg=F+wysD=09MSDmaGc(x* zkQu%Xz>>b<_!!FQ0Z}hU48;BHH$RF zU|gn&>kq@)U_0#j*cj~kyVG8$kV>C<@*vDUZy)si*%b8u;e@Lgmaw{~4im3E0xLO2 zVbxY(yekC9dOtVKkF)^Au{!(s0XXw?13WbVTIbhb$NxDC1Aj0MH4Kkc16beD3QPCj z0n3NGq4$e3(0X>&$=dUe>4(!lz8BW}JaS&OUiQ8nUpWiIzn*30U~u^}PaA^$zj7yZ zniyd^ke_>_>u*lOp5GbEd3CW_aOnUnQ8Mk)PE>760G3gJZD&-9fo1KR8o-$! z9fY}OCVY1GrafUjiX~BgXXHLtSYUx`P7@XJw>I%mAyaWX0IZ^kBkhi~UMEWA(QIp) zX`gQ8{7hPHDPv+~+fca%Im~fqytvfrS~;mp1YrI6qmBds7G{c5RtydygDV0^NR~ND zr>-m{VIq+`ow#IBY=|U)WmVW3Wij$HUrwb-X_p_n$OMSOkFab7u=He`@(Lip0z;T^04vc2fB4dpWHolqb%O~}mg%CkJbRT5kjtwWb%4$|==V$4Y zzz*`M+O;h?OZR#CX#r8LOr!+J{L*=68JJW` z!o5%#Gg_R=MP>OYnBv_6J!=HS&CLO_0w!g!Y;nQTB}Fon*h10@6X@CjXT*N8E^^!| z{FnhO1Zsp`gszChWZfVjo7@Q1T}yy4f$*sc2x7Ijx3PSnAnvVnkisk&0SY9}mR(l? z*hWA&%J)_e!dV86>_aNA6~I!EUER!-tz#vqj)Aur4ExHUD~vCAS>@T!ND*dW&@$be z=79AS=2iTD$H1xrVCfWe6}3Q{0$H9{rERp@q3#OdoK;&aD~V$OOI;TY%`CZ2l?CgM zO60akfl`2rn`ZVu>1Upm$~5=xkE(YdNUFMvwlf7_#p?;%;rf8)y|14ca=+p?1z<(W zTeg8=-=&qy?T~}Tn=2Z16R$c9%ZIw4|Fe^@`%jF)k0@p2ee?iP2w1(q)FhM5Z~#+|!4|#SmjTHGgdxz{*U6 zoOz+vg%Ni4q*rTBF|annzzU>%*bhwuSdx)#`eg^mjWeT1ZU79w|2TAi)dWK~uPg?z zPNan!eQH;0sPLr#EX*i~^A4GXc^3xX-t${y(2gCMzUYp8`K`$|@`Xp*)dpv6EJvx^XvAvZ#bk;b_|oS#D++0L#yNX-9ab@7pKSzynwe>N!IO z8CaBgaD#%iBY1UTVG&kVFl!l~Y~mX@{+0Bx1RqBB0ro9sB1G0zXT1&`9d!b*aNg+r z!XDN+;#ZhCRVX#ysz`gjhi9M99EOuR2C!5z5^a1Jp_QjtOaE8n* zaW_Xfte`)2v0?L)>?YQiFh7+oEcfspCz*52e3343pD<%s>y@2Y7U1Bz2-Hb&#>Bl{ z_dY$~aRKDHJhwNh>`ThP;)5|iVtx;^?vPq@WvV&3uXEbz4zlk?g2^-7bi&vJC(jg& zA3?7RPU9$XA8`!XHoxB@!(IWB~iCKmwIk1>cF}n=Wy3tp9mL_yFzBUDCM_ zdH~CTV{X4v*A9Q8n^D}OxFXae;x?iHQ7qkDoEMoh{I|1CS$#6gMopNIi>b0!xg8Q5V?o#uY%Hxi2399AED+49LwjqR zW9ljUD9aPoR#y~m)s~HEA9s>ttSD2?=^*_6@L;@Hc+j^A7s3pHW!+EQSaDBmZ)+=d z%DuNmBkeoHfk#mvxiu+nx0ZqBf_a-~G7KzyqasSW4_ISem$S-m=Psx*jRdZe*gf90 zkO6q>`Q~SqFhM0?s?L1^u*9{GtHSe8=YGIYvF>QK7G_!zi%ZZMbwh4!kW9rmdE`C^ z4T*V$>`Ojq-dJB}*J1*>>%_uhHl(b*$n}k!)7|>yjHm?C5n0w`y;I;yz(jn6v!F^0 zEXuBnvdU*5%mf{m&EFn$@~eGzy6ir0=Z*fGT_D|IXKqRa;Fa!^;k-;O zTLmYno`Fsg0-c^Q%w4JgmIa3#7?@GP{K1{xugIs{Rb&EY^lIIlasVvtQ)OS}6O$xP zqcRPZ;w*LLgfzmyN|2p+-Y7Fpvgn$_4G&;><{^pqj4NXegSfvdYk`D1UL_Hm2V&)z zH&L0@w+@}iTtG1risOV?2do;!bI~unxl?I0jwc41**i0Ce`rgK+v;QAW6p2FHzh*WEs?eM=1%@81Kb ze&$GM05$;Xr9&{)57|XQ-BVZBH|AmJgJXd6 z&t3#z{X_|X#Y-r6%>2gBH%;DfFcSl-(&Unx+Q*h)_~w()HsuxY%=6K3m6xA=;8Fls zwKagj51fSVe@(<=Dyj6P0JCL15_qs8W%1F{c?LuOS8cn z1;bY_Y^=MxY=EN{Wcn#+zrQ)W&lr-)jxG>bR(4j9^ZCo5SOHR7$7&yfI|OSjbsulA z{N~3#a0Gt*k%!p;AO&B+D~=K3-76RrQGhDL!fJ0Nu!269;M^WWQ8z7C3+GBCv+QJU)MNT$O7Y&VPa4z151>9av!AlP6}YL+lv}->T*a7EIrkg z_$iu!kQrDuox1^(oFhWcD7$GSV;!AskxQS4rl=5gD^akFm^;E0H`&t3JqTGA0f5y?wbAT@ z<@@XQ-9Zd2G+wBJ3Sfnjjrt>q2WHfh0>K*qP^MFP9q5D3XI5V7-AV5Su(ofUeM#jT zhRR4Qo4g^Nvhc$F*gvm&Y<80P0|hU9V*pFAs!&GeFtDf;6A#O=eFQ9VWi@^@O(yi&fp@#BE%Gv2|f!v3_6U{h?jl1VxzReuIe~ z+S@TM6}kZWz~{a{@Ns3&vaCcoMa(W_%xYRcC-g)nieAA>9S>GCa6A82nXXJNyDxJ4 zLRarVO5{u{zu&4Nz#XqZXu#mn@?~!ku_JO`qh8b=>b}L}t?Va@^yz(kr)oyj1I{&{pY(@K z9;8ei3lIZPm{&HSy8};MO|r4m?HJPB*)9Mp7ByzeFp{xg2dXGPeK(2_D0%Mmv-iQ= zj|@WR?F+E?eRq2R2x>6(l2JJS$iAQi%tSc+A$GCCAl@@C+z;m--CtTe430ef8w_A! z_PFK4UBt9%S>}npwx=D={Kyc@KcX+l64o}m3cdeh8g_j39N@okimdmx!r80$(7kH| zJ_91U9b&Am?th<$`f&*yZFKGRU2U**-yP6Cz6|xTC1?h~I`Eb|e3>l(Ge5PT*kktE z@s)Eh{DI@1E!5Ehcm3v-RPX(7zYE%?SBe3w*!q&X7c#KEq5zg%!KPNRFtbv@Em)o_ zJgAAGREZ*A6~@3S1F&-5Q3zmtA$GlVXS!0O2AqD*UO4xp{!CzbY|rjLoq@j3P6Z9C z3}6KqR=7TSL+~9|3Sc#WGHtexufY6c`?7Tf00i9jd}N%mXeO^fzc-V+^k#np16T(# zPv9Cocx@t!kz2t-{(jHC-r_ zkH+&+<)K`$xAh8^g!!VWdf3j&d64zBsIBHtr(zcAmnX>X1f{+ z8X#BR;{dGnHHv|yso1to_3gdctDc}tUb)s}G8t9HmOtm#w zT3#i0!qwGPW?wk>AYot$lUy@=c>s&u2NmS}Zh2T0z_zS@e~k@IW`xj;amXd(DNU7V_fej@u6e^ac#&>gD!JM1mJ#sHQEcIR4%Ta@b!A83mhCj#^kOGiLvGW%tHD=Q`5gW3I2*eV*2iiHU@ z8pzr-E?IJ)(4u5t5#R_9M_OAMOj0(K{B~N20kAw{PQmC2}Xzji&i7+Ov*$zxz`N}TD^&yuA#Rb0+P$wA3|K@HA7ayLx<^Z{s}T7i8x z-9=gaR7qbt+6|Mh7=^Vxob9T8dWACS;cvar#c=MagQdoj1+dT^aQd19u>Y6u2;PT) z*z)CF6myH*|MWtJ)rlo?bKLoNbAW~@>NpsL9ziSwvoH>oUI-NJ{L&c$vn&GwT_vYp zHVQ+(aRRz-ohR4Du^TTh?S72;b?`OchSu}m;9a_+o3h{`yNZO+g>@MDr8@y#74<@p zZtNE?Cs)Yf_a0|(Fl8Lkx=MT@>uvmvhx4-#ZYO}n5OlUbqK_^qfc42q=>4K37top| zf=sUOY=!BUAArRxL&hMrXte=@9~*}qU-qtS%>Y>Z+HAix3t*uuBeIfk9?U&&7|vbQ zpX~1XU5ga>oB`YDa@LalJTqi109lu8R)zMM_YjbWHOZV-DQ*X!ukZrSTF!cU0=r|@asIa^9 zz7%aX=^d9)I1+24e3ZjGa`d38lPYI*<~?rSU0zYQ^i?s*EXPzC?kqqAcy3FogHir9 z(VWR^LxoOdU9mZ^FlTYNqeqpAW#E*1vs;SUdOYrd2jCfxyv!XTc$WrYEeSxvfR-|_ zIFLF0P%Nlc6QG-eyK{yoRc75WsR!T!Xh&MCfPn-OW@XdJ5dj{Ub;T#B%D(b(uh7t< zb6D4nLCh!_Gmd}73@rWOz{6|_i4N-mxMF+M=;C%GV}L*N0G7ma(!lpr1*u0yX^gTI zYSu^v<4CC%S4r(2%~)jtEQuk-so=#ZvT4}Op_v*?ew}#(UrbaVjM;QO^{oI{lzEVX z-gEF~&Oqja-Ybx%@zKyl2pJa0!Xl;x1^Q>JF=w~m+^IkXN#;)X9RtO>cG`0?1AIs& z^Hy*yGje5^o8o@l{T$2dj|z>t_m-RcTSAWr|{ovy4-w6qTn5FBC`-*~<(U&QwUxh~ZD~(}Nmy=??uC zUED!--$w9?8JhSkXLXf*g0cr{21M`L#qx?ldOcvl-wL&J)>vj>Irfo>gG2z9Y=R`0 zNLH$x^s+jmZ;)^j_LT!ptY?k%bv@7%UtuzCxDZ%W9B6`Y?m>oYI=cZm^ZqDc; zCCBgx;+(wkathME|7~|b$K6Z8t1;O6`5*3s+TsT6_~)}OfVn zT7MnJ-+UP$!^#3#7}sX+&Bvhg_C*)trcrN!jjk2~5txBh4q&y-tipjee+OC?LpL+Mx3WpuQ~{e-ak1fOAo5v_g1ziU zQ_HlWd!xw~KA$tr))sN>d{N^=-;|8_@=6zWLp;-KfDEi>JnAwrO#GB)9at28GB#M@ z$KMQIwGtBx*;WWrP=-0oI7dJQekaT)>izh=Y@|5FHL=%_@gjQ~699aBl|`f32APS# z83ic|A(bb2?evt}PAKU^1+dT%!a&5DEz6zO(lcC7#~6?-gb3WxXD&XNaknG|TIO63 z#NIYE4ParN{Ewu$*BD@dQN^qT1cS5=Xa_2Qq$~rSwyKk>0?&?)@;{3aY9L#qqac9A zu9gz)9s{(K@u)_C0E!zMG-qf&)Y~QA6=!P1AIjvY#%My=r~%INVyi+We1U>jx>HzF z-|h}E;LHXW-;rHC{=-ZRov3|Ij0kJcixnTCs7(Ie`+e0Ou;3Msob`^2OR)jg-FLy5 zXS05$=0j2K$^fifu9yH=*6>zPNpS*|)v0aL!2=3n34=;mte6Nx4SPTLxxM@zjE{v` z26$*YFmVLMT{6>Uuk_+Rv}2m1LRkjf^7Uwzj~BaMSFl|K@|Xt zIA{v61uP_gAc0bolSU|jlpQsJJBJXnX*jP6`baij`b!P zSb1|YWnyZND)7gy_IXk_Uw={%$%|~!XhiWyX|tsOmO0F^b1v3DdCqBEDi2_3xB$)S z80*PA)09!DSu#BXE5g@A_}dj4uGSI&E47hTGeaWCF_@`UOYje+)%OCp#65}u&+q=g z{Rx0V_qQI2^AvlO@ME00UThA>#^zvY&gx0D(z8|N9K= z`kyn;4_m!fc#831ygBr0G94@ zRc1ksv6}?202UtDlb?k!B+%7Qet?bc7MOX-2p}Msxf%f7|9lSieC!moER+Qp zkDe~kueT0h*%zdwRq-+@`!<(>)o8%s7vJV%;^nXf5ePl~yg>rS;|m#B1HV6I$|$Ri z{eH6mRx|G?z88}foP5XOqx9Czd6BHve&EfNj8~bG!UCH5@naHXt?=8lhZIY zbt+mNyW=f=RFCzX5s#DY*hCN&A`O5UP4hN)*Bn8N=%nNX17c~nKbqd z)(1f>t`~!BNaVmU9yD$RsfO*D^{e6$`v1jh7IKaF5h}X|DP|xgICH)Qh=pdOw_SB z-F!?a)fM|&!3npr&`5V_0WEt<3v}>(ARHB3w^CCjipmEsPgQWLox)5kVl5$qRoth@ zwa~C%6*OQYU$TrkJ4Isxg`kG6mB955*F44uY(+UK0kz3>(LhoTpzsWS(ssVy6FDO zz!A%HzPv(0treBn>L=>fnVx>3W?{s6334Aa`*MWJsW!=nUK$5Wemi!dOcpceebcj=iU3&6 zXoyk>A)CRL6OCuMk>o2$b}Ow`kD%n7M|i36e@?vh3RoHKgx#N;hJnvaxX-J|zmd<3TsoJ!@%$_8|O^8)Po-En9;&1F{wuzLRSEDZiu%-kq2 zBCumyYB2HYQ3B`&J~;uq{>r$)r3Tx`2JH*2doh58L9$JO8G2^k%gpHHDP?w%m>rfG zSO+pOoX`z*^!4A#PMdfRCaSbG0L#3f25|bn4#U|eXXCP=>uK-jW?}aqO*IW*ag`&p zE^0>#z@kiizkLdJ{9}}fPh3WE9n4&_4;H^aoyily)1h~taBRgurX-b@@>N?Mz^Wo| zWCtsMZRICCBvAD)1oe@p~$FWX$Kg|;OlEvXXZbzQhW7M!qoA)enm zRc31W1S}~fQ%5uD0v5b}o+?k*OEf5f+>TEbMah+We5qBCyRyM|TW3F<_d-FwINR*+JcFf8uo?7Ea|G<8D+7BNIw?pG5QmY|&BkptZn_UDE#6mU}{}2NU zSvMH0TY|a!VBT5D&XQhh;rq`@I?vMb{iktX)CExEUnzjafC`twr^@j-v!%u{v)F}@ z02u_ZG}x{j>*`6oV>My>Er=B<%Isz-!GQ%hqIyU?7Tw*{fWulkBT*D;Y!3#K*LYk6 z6gjiQYn=ohZ8XR*q(Jf%gr5^aBUsdi86hTGGOZrt6gU3T_N^NkVqkDTajXz! zTba{uWWTK=J4*npdOPgs>Vlr`E)J@zvBp;A%%SJ#%4nWn3Cyz~0s&4)m57w|DpmoMmI z=k}*^9sz*@0E=ItSp%guPK=90$e2ei=%8`=^G7ng#!+rC+k^ouT-PFrG{Co%%lnXL zX*w4z7gNwyfP2y<${=~f@=y~y@cIZrTVFyH8&2y$OkF|d6Ke(A!EVeF<4d|Aj&-C= zS}c}+0{6rsokwF;sVk$k=@h;Ssns68F-#pRccciNMqD4QSy-1qZ8UPT48T$bU6MEI zRH}s33ltJx7aLD3?k$?qG$#-qWJ;6+662e>)z-v^A3?4+KXVTamwXSyb1@BJpAG!0&-mZ&QZ_e9__6h(?rTcUzXXDTZPSTt> z{k#fU2we&GL^LfiQUDgZ$?o~Bap?XR0TvRXV0E|-)7Om(e|jEI310a!WW5;LTZz3m9B@Ae?JRuF^eW3cn~F(0ok ztbCpf_Nt}cUj$%r46J6lC9(L;+QE4;b=`hg+0QWv?S(S(;0!u>v7ijzlL-`R9?X=R zou_oSw>3(qNM`uu38%FBA(NtgZ8?~zZcASIvoCeCDdTSGH;G4m{|NlZ4;?aFrfO^4 zHwa*<>!6PV#hD5@m^=OebV!_|&U&5Q2+4Isg5{cyp)!@Nl7kJJR)&43u73@2vqM%8 zF|JH3EYXE6n8582#aZ2ABnB48yZjdR=@mnRRMlW0fh+l(Y-o88sdk2Bx=QlB=Hsus9xqq3BXmD!d`HHrRQPxa6@alW0R_+E;Bs4hSU7Kyd~a~55bV>@?kvnQbwPA( z5XxID>*;&#JDn4B8WSJPxmtwb0}K$z`?ZX}%M>gbCM7my#Xwwpb;$_22b zn|+V@erOWFN{pzPOn$p5kW2-FCl%+LcCe!2%=eisP^x?30lQ%0HHS(?UhDii9De03 znO*bbjYkO#D!Kvy3uExS;vj5vw2;Bo`^8!4{^~gbm1r#LEtLIm{$ah)vf6-MUzmmN zfA;_Yva!xRp&!tF(Mp)kI~Ldt@ozla2^nJOR(S65o{_Wf9d|+3trr-;`uXA*SQrF; z&&N+u@OXP6FgAJpXb6raIsoH(9eDE{j`dZpahOFU<&D4LP&$bFM-{*lG*UL7Y&CKu zO-3qPH7){av}}o?lw@F)0a#iwx0Csr<^xz$62v`!gZAI}$&SeYPQCF^(v`4%YL#41 z&p#@1Sp)!dGaSD8cw!_CfEAn+`&GpNRv6Q&3V?;{cXeMKX0F*!NenVq1EA;2XJOAr zPHoclEnN8v59ld~fpxI~tQ^h8?{yScDi^@ICWnEQ7_r4GyJ6;~$i(zux8BzE^$Rfk zp0NrRK(SaX2C(j|2q;OPn66Q!#=d>_`9pB-aeYa7Kk$1~u&7@7!}3LhlF6& z*Qman``WBRF7d3*8VLhSYYpSRx2_}_3qlJ~CDJeV?7U*}T7yS^|2}x?BM#D*Ns?Vb zJc&`o>>~``?lb!+MV|pIfHq8#-qr&3wl*LDtIpX7DPtchlF}dA1_CrNUXwcsx2ktB zCk5+BfRhGaCwDfViO_EwIR=OWu%sLeawS?uQ-^y z#(82xP7azK8v*;mGs5(wUO^*dL||Pws64y)VB2V@oa>K(uF?(!sIZ?293!R|j}vD9 zBLEATSfb49T$gHzaqdr=@jVW}3bKx^!|Li9xox@_G<0CcC1KxDT?ORA@$TyEAQl$S zgVw-psM@OB-n%@2#j8S%RbCkq^GDp1ik1DMdWo@`I4I}&#A)8;jsIa8SZeTTJJbbg zdq=E#X)L=!w=_hS3jvfa2^4HaAwNlutA3mC)CF}tbUpLGMM@H%5& zQz8q_J{)F38Ut;@#f~l8E zg|y){IXx8_3zq&pOn^=lcpKA6193!gDp2S&j>1t9f}9v}%p zNYy(OI8yeK9=0ezlO1?@(t=b1ppl#r1<$jzVv-M+NC1x8n{8IakWuE|Zy8{sT&S*L z=dv?nsjK{c&i6JX_`e<~$+~sp=MNjCl8zbdfJ*JgC<~`%PPSQ;aoliU^cU-I$~IQE zm>(mb%}_yluP-Yj(w0V92#Xk4DHYp@mH@n}u*P}**TK-4cK4kCWe^+hdy+YG8dApXsyBV zci$J*`u-Q9cnO zBd8R>Qq4HecuF#`A{W=}I!eeUzKLRBUE72UVWy<)B%glKzML3X3Sfy;;u#UnWA|6M zsa$yQPMCUSHd`A3@Q8BD{IZ2r0PQHD=`aJM>=5Yl_NpCx1erc zI}bzeL(nBp5>zqu0h$A_?7OO!-?Wk)6-xlt8*>;~O#oP^iOfB754)4bRc`?F{^cC( z{>*gwdMvnOQvjA*r>XrzUlxurxeor=09)+Qg~8kRy>raT(8>);uuN3^dj?jOT_+YE zT!X4uj$O5WLk_XU^vv_0^42f!t=s_>Zp@qVCBfY*lw9c+RV1yl6-dA;OR|7s&Y~WplHEucSPWuud?$`~h5dnS zry2ovSOx=F-i6S%Ro!AZW|z1$A_#;ruq3-5wZ~-#6W1RxG*wwwmX#{yN;D$|7G_Fp zXIDZ34c!mo3-4)yl-?>boH z0Ia~3$4IkG*5xXTJ|$k#5|UQne*yq2mMvZ~`M&UMy3O`sC9&;p()FxktZ&u2Id+!r zU#?o0qJAj=%dZ~`tFV-|ZcN(5s`WIbH58m7A;bq1vcK>rgl@SH`MvmlAIw@QOZG@X zK?E1;ie$Jlu^2QYE4N6c(TsqbaG<4jSSNbjGXnsNWf(z)IbEl7!?ul|@%l{>fTj0w zpK&FWImHICqwh-J3uqqo3y*`kR_Xy4Yinr}L~1VWQhdQD@RlzU3@iu8NIWZ+M_L{$ zs{B`VeUx?C$bP9s%=Ta!`}xQ&vYG*t%g}k~Ku_5ld7qT5lOjuX&tvt;$GyS>8_N!K z!QAD*MNg*`#G*M(f%kds@tCl@&R$u!?*ag;L|t~8MvlO%y6y|)W!Qwg0z;!dQ?2l8 zmK*UqYXE1j9)OwW?Sp|on1H^|&zK#d0Sn)^3r@YRn8B3?V0Hi7c>0a(>1`St)<;Rql=HT(Qw&Td$eB~zbd0P94-sxu=P^;1&}teiJ2UbzEi zUb5eTt-);@$VQxl-G4aE**Z6QH3wi7y`=j12J@?=-pvD8`Sn2d)#PhNVC8VuJ(JjR zAD$rAU8Q|7QEy~;PF=q*83Swdb$JY|s{Pg=`F8dReYxOOZKVNwes2nTzJ#vCo4Bfk zQOXo+>R+I67q>Fsm~vQw+l#7Y>eFgg?cLJeDnj5k)o*2QOxIi$Nqk!G$nEyHTeT14 zqN9C2H5x83H;a9Y(l`8-Eq3_)bPk#6)cbY2Fa?+~669?k< zimC!J>{5sTmS zY6xpdg1U=afV%5(ra)nWA>yPex&g3O*AS!;7dh6*`Tq{U!a(ZW2XwkiL5cZC*-Zpw z2?L8&bRX)28E4*5p#CFkp~boHP)sg~OJjq$OLlJo(tO%@e3xeTL!e3nGNW=yeJpN- z1RkL)C#A2K!1`LhXsKY+DV7ZV)+~dXanJ|6)p??i>j}3qu`p{Hjz0zVuXjMbUS}7_ zLN|u8b-T6i0}vxJOlZgjz;eX0ZLTXXpZ}-~EU(CVaLSH{l}#SvDv-2W8_dkSmF#mW zJrz4Jdkc@h)JQGVZLLLKValj7OkaDTAyo>by)dD|6TvcLm&KOnoC&ZbC=?s(T1U?^ zjce_hY}|M2T5+ij%-G`tX?CMnD-f3 z{H{#tBWB?$s1v&zatUs$aJHcxF)fIN3zhG(B^qvuWqY~K;PsXZU>Uv05o8pP)VaTY_NTU}xOKF^-M@Z+ivN^%l>t}?NKLEY2p-}CWtaw}{f=U6q3_7(z-Fcu63x9bL zR*V#fy;urhWhK4;WUF&BW5hLxL6;xI{f;WrEOSqF04v*|A}9xAT}{01Agm_h2Bj)m z1;8>(Bq)LatnaVrLRipC=thW4to7X{cAL(kwFdP3uQM?4dy|{$XMCtR0BaKyXcLdv z#uNis-)Y*765TT=es&brd$X>D_2bJh{LYimdY+R&q_6x2tsLUGRBHp_SYde2q; zDuah{^rn7#FD%`+D>q3-&zH`_z$d1*Cq7zEJb}`>Cc7uk-70Ty3PAxD_~y+`%&F9^ zX}GKjnpmn6HU(mt+IicndKX8oC4s$@DKE-orYFJC+pMC=Um4220nPkyq$I9ym!773 zw+}rrOvL!Hb%~07#PgFqSuu;i371h8t**6IN)1TBz>JV zj;AFtw8Z^{<4H;UD96_F#sg1NWe6}(wMsFU)?t-mSRrdk0W5zSj_)Fn2boCt&Q>p* zP%-A`Fnb=BwdS&Ou@NLefmOLBU`R6@32@bl*xN zzvka(pCFC(9u8oonN!LNVVT93+-U^9b4imsL_^OWT9vr%HQUP}v(5-Naj9~Ku&w?! zgOkN|wyurps;U^d1vv`N_rhkS88V*mqq~b42?Myu_$j+q>mJ8Ga&Vt>DVK3KRd#NI zvO((XC|l*Cg=}dQJmAE0QRlA8Zk?yH(>ivMvW_xq+{izjD&7s!@swPjI0bCt6v6M zyICf!H55pFD;*sLH2D;Mg@+719qCre6Pt&DWSsaGAOpyUVN^c`q9 zzh>7VjJ@S@SUQ>?2MYnLz2ZW6!MG4A11kowhCX-_F#DfKJiq|%V{bkZGE*8Dko_*` zxMPuA!tgqGRX@zUU?2Uv6u`n5ST_~}SiAn`9PIi1Q_@yZGumq8=7>zNgE!o^P2-sl z!{h^4r+g6i3bjby660#|O)-GgKo>#;u)>Ux_!ws)yqEx1x{*Zy7CwQo&c@$-s1ggS z3V@aOzUBd}{B^$geLGm)i+kXkNblG ztkHB3_iGry3JjbI#b0>nPMCh_zJT4SkL~zB^Dy+Ar=n9OGs=--YYlmFADfaOkG zX1PFYBm{`s@TUdZ#f1=E2?;b(Fh`@UG&mSM0a%h9k6a9qrA6;zmqgY#nWoRAC0;P@ zWVQh&P80)Jl(7#1DRf^G*9`_%xLz8E3E%6sVwZ(*gTSlRwKW&aU6oq)1QB--qBlqz z5OBjl?gU_&KYV984K3`TSEVQm_3$TRCC zz5?034NVCQUiZH2*ilW~#&mn)&zG7V{6E+vM+UN}7T-E-Q-y-gk z)ihnr|MWrTb?Dt5;9TBytBVyxDJ-F@VIR9S7JZ)_(_B5%uUc)7c8{N`k@jNT4byUi z+wB<7GH2X2B0!z$BG#Rc_dTEd0H?El=9s|^cKIhjQgjq{;kSuYeC9}X^G^X-4uBIq z%IR9V`P%hm04$AF<{4Ol+{xQOinRUh+;p;2)4w?!%uqChR8g6}vVGe!F>sUoEjuW( znoiwt7?uxq!ru2E_c5Vl9?U*xZ($rP3;<6tux^=$g&)`nlM(}~``_oug^&QO7wvZp zEd0y?SUBC|!K~9e=Iv?SK>SI0`%e z{tOJ-_*d9xqSW~{kqKasBmRtZitZSHV>XC;ZFvI*KRy9F{`q`COr#=7D*~U6SrsU+ zHb?I{0G1QMrCZ9m$M1&I&mE!!0Yw)9SnoZNd*oEK!gB$vkDP*T9H%C)`A7A_>`(1Y zf*3gdeSbC!y?;L2M5)|g3}B69o&0 z+HjpfJ9K$n8)}EMPehm3f?;g{bl$cILm!@i);T#yD4YcuttI#Fj2>My;p0-=Ynn9$ z!ugP#9hK&xo;)R|qZi3dteE0kQ<|c$XokF6Heqx7(|`<4IZM1JXRO@EHcJk^OEf@L z)ZFWpnG~G7>bD__D%C#^(1SIDqwZ|5NH*Os^WWx3$R+v#_M)bQ_g{EUvXR`c1K?B<2&dpH#NWc|XR-kl^j) zLWlsC0Cvj2a^Rnf3nMU=J8|YwPb-wLzOY10rs(;)TeC> z+F6s9KsRwI3=9=hFAS1TZX4@tD5%R&t;R+I0*`o6KxhIUg_XsvUy`tXmkAbUuPLC9~M*Hhxu+ysdWA;upY}p0W>-U*?eGzu1 z(jF_AOqqiQQ3~?+Gb`Ig(=j*eJfgK8yf>a<9M_Q7t^rLljbVwwYnN}dCEXL|ZOGOU z3RQ1M{S|FlOr%M!(P(;!;TG0We%k7E6roV2RJrxd`5rJ z@k#_qZ)QE^F~eE1`~5FjCRH{*WwSk{JA|=)Wzw;{6<2+6uf+I|njJ6zv821Puh@+c z4|;sRX^boH&aaGa)F-$;3Sfouiw};x0j1;M_vjRbRO7!XyQ_Bezomk>$4jJWYq@mG z$r@IES?k1B!4TGml?(G(4dDDEdg1Kj`T<%2I&WWuJ)b&7eKqsEy>RC00T}qBDd_u) zF!(WM1Vm5@fu_{eiowu-gM*=8_yG*!et=vLO93p6T_g-E48*>8We?0gcNo@paZq-= zE_)$nM{H~>fQ9Ud!`I#h2o~_geK_}wA(;EIK^Xq^6R_he=U`(;D@62E@<7F5e?d$2DB`1z}}lrnl_e~bLj!B zFau;DPfSDoB$lc3y}a}y0PBb_u!>9Z zi%7&h^$N<4lkYeJ8y(q2)_QgwhCXZRNN}MzPF$Fxse>1?Nz|}f2vXFhH02Z^57)V0^ z3+sjTV+NKg%?7|Ccf>UT!WhV+^z!P$XABMM19H)0fJplW`%445lS`z;#3CivT<)Y< zfJbFlu~Kfb0GfCy^tga|syr)T#N|m0kp|GX(J8dD#9CSzoRM*8fd(7Z+F4%u?pg%K@2)!vkCs{m~)JlNy_>lXgnKb_mu0>09e6dlMIxe({fMfjaaYa zI=RIgo{d#kFLH-DEPrdWLFcv0rsg^{OLH!=9=BGDyr%^Kmo?zUAT1CRAle)(I4~kn zTWOL7zLI)H@S${w#Td-?$MV&VcUYpIpZ7fQ3TvtW7XQ2Wvh&VP6R(4%Egb)x4gkL= z1f4>iB0h>$_OQx&tEO8ZMqA)?133iob((D!Hvw~DUwx-|XY#?`HPC0#vq=@KL zfhH%_4_oBNM&qJk46ITBYa1lzmZVg6t4W>r+vex-39uUIDtPkejs%(gdcQCWdp>ar z7Qbf)jKBT}^nB$kF`f|o&}(J13ns1~h1J1&vNf9pu$GT>!Q{20F!(#;&~ewI%d~|+ z*~AS80pGj6v(*4t12FS~y;KKwA!HYu-a_nyd6XQP-hQAd>mSn=?ebu>vpfOA*(!`!n6(@dmY(m92cbF*ijs~ou6a< zob^a-Kf8rWIdYG>LujRtiN+wFv>W?X7+n;1ivT-u`IPzSST7F1^5T>ESKA~5stWUh z`z{%PC5sVT&a4XOSh@|Z*jf>R%akd~kK@+L&)dtkV;(qJAmDQNt`NYgt`%)(ds#Ls zKoqi~JfLiq3|~(V06S&VstIvnIUViY)WRO%xoDgW1C~*`5AHcD*VoT8c&d$?GJ4&- z7vLvv9oSN>+jl0qx@CAJs^aCmjsyRu{aWKMMbFXrSOBZ6iHSPszUdwjhXo(pd;#4Sjfw z-X~L$I&5XM15Up6D0JO&0fs+#l4$n;h5!H{07*naRFK+H-`7(nCN}*&W?J0;_G8dC>&LUGFbd*+T_Oh7#0reQp(qAc{yd(3;a<)b zXs?Y1?D^yrU>ve=LWX~4PwKq?wK0k5p{4tE!Nhe30)W<*w)5}L!k&*w%(LVI@*l>^ z$JDD2kb9oJIMdxYbbnRdP@5ShF=^^GIQ!HAIP^lu2t-f5 z?m#mY+0woHe(5-L+!cel`9gALiUwsU@?G&KiCHhU~wRKbwk9MS{l@y zV{0*pLjaZu_f1*;BnB2|1LXEw@Jd}Gts#N`W&n->EV>#Da;Yn*0$J2wE;A&%lsFeb zS<~clNcBX(Y2C4}kRe6c0rj-mQ1jGflfIUe;~YB#jSNE4*vJs$N{tE{Jp%3+wBy)i zUW)kntEP$!ngrA?_SxQyFxbj7tkF0lDHDZaD{@Q*R(>h#&#?gRX+U1pZp8L%rCW?U zTGdzP-AACZVP@L(OtuHM9My;}4VdOwQrh|9KBDD%qg+9= zs6IxHvOBM5xaRJeIh~(zdE4rw*yLoW0z74k*7+;l>EcL5Dh>}?LP=m@?!HnN_aac1 z<@*0+?>)e5%dYakb*pZ^bt}hLFVsu@x?A0%Tiq=Ynr;ciAW#4kZH6FB9&$3lHW-ZY zfMLKA!vH3H;9(fazzm?z1P{nCL`kTn&hh2SIo`UVs^(j1?|shM=iGB|)oV!uS6`|6 z-8yIIu=cjHnoXeUs*Rdg|_I?u; zSlGzc#a|1oeJJM;1h6nri&Q+?;>yC8o^}kx%%!jV8Q+Ph%VFK_wPUWplDq}5?2K>$ zEN>|Qzd%601f@h5!Idv#5p?~aE8WF!c%F=g<#$fO)?>qP>Zfm59V~fp?F+_X{T*Z8 z({q=ds-`uBBfzb(-;n5L*b)gs=g|K(C1*d-eI^-76 z{mJ&r##={V?TaU1;Ez^ewFwbQc_c&oUsB4c!ubpLDi+y1q{LREJaC*}yw#mmp{u zDw&y@AxqBtSn67}FP=B4H0j%NdX2T1oP#MlrdK3OYb0S(?%Eg&UWr?lH*4qS+vmy= zS{Wlrgxv?JOpbe@IVZ^)is`vv3O@e`0az2nwjl-&1`5gcLa~s8N~r{Wl@gQ+1^V~V z;Q=$fB$^t5UA-9T4x@w=tH3UVmIY+Q-5q8TyGqJYL5*3$ zR@A_?z?JGpN#zJ6V}Pj_@&aP93!w+VGJ0B8OA7(4X0s)1EY^XF0$3J=L!gY@2?f|u zae6eO_2!;yVqF(pkV?mr0$B8$qWxLc4gp01GP$?E4CXNihvg*qMr604_LZU1SfB=V z%-F?I*i*v9>JhgqY}q zj+G8;rki|Bo#miwYK)Er*w!BhZP2b>!9L@sb=|Pzxm_xE=I{2PtnAJpP!wF1nep~2 z9xf9r9ZQ_j_1RoBIr~`RlnJuD6co|DBzXFF1?6_AAcjxUb!r9*<9z z8OPz??ckK+V_-Soxhx&Gm1Jt0^;y^HxRNS>MXufkys`k6y1WONO%C|v&N-h=K;L=U zRq7fiB}-ypi7gU0MtL4t;LW0YHnL{8FLZ2i5Ai&-Ok>`^>EcBq0@Ht+dh>qCb=P?; z7b_u=ce(&_Kt)%QfG%5Pk7M0OSz4Rp>NdhI_k;5 z=I4x%CKdq#s7gc{QVJuj%!~$20M=q7;P!cqyN9H!{GZ?QUiHfCfzieXA7|M)l*QPDbk;M z8i!E*(+wDUuaAir#m6F*3>6)Lr}ZxxgPq5u+=oEG*!a6=p?B+`qekEPw0;7^4iFfQ zVZo$KFy^r%=-EDi!S}6E8$>@&;6CgdLm~UUqqH4vk(diyaJGn?CUiC+PX_j@4s!QB zYEVM=kKqGKQrm_AtWY)Vo9Rm&b|sAFZf|45u44GC0k-Hx3xk>xI0pb9h~=wo!2L;* zH3vIoU^(DV_|UHQ1b+X>-6Qas4~|pO@IZsEcEvn`R|V)R6`@it5qO0{?aHhozdB(C z5aTE-k$=$0RmPGSrVRW9nM4X$1!?{Ys@T3^gIC3iF>Pc`F&j#MR5ywMAIXQKBXaaX zWnZZg%WfpxXJ{-_^g)e4LVpKj<+#J-sYyZtSk2c`r8Qr zSnkNx!>{>H=9ghzb^scja8sm6E@{n8*N1`qL|fjIY%n$MAO0?ykM<$4I-@)oQ!kev zqjpyq=19>9ukItfNE&92uCK|3hyqypeBffrS!Y}~R&M2V{b^S!hkqqtZ>MRTOv4Hr z$8+bMx;z2!%^e}UL(n)2Av%Gy#bqs#eWiOC=^I*|XBT|K9v~*H!@zR04VZw^c;@e6 z_LWQ^8A-wNrvb1MJ4gE7VR^gYnqQyI0$1uv$&6-X4l{#V8O|yV;HJYDUmP%m_H1=& z$A7CvrRp|{t)UTmnHkOOXpVL)muP{-fZYday^{URoflzC)Lb69ZO|Qn)!D@Be9|N= z;u7(qtr=`rW1GEvS3grEvFnYuj6!ay0q4H|C3eHaPAd1p><`R9YcvOE|HVttyKN87 z7)9&$k6etn)4BC4J-tJV;r`ua0uNZk9RaMvm?(r?ljf;BY=8P7X-(llUOxz&AoFMB z|6HW6(g0ZHr*;5c9``R4{Rhs&BN+bO6&U=lD@0k>54sO7eEV6z$YE!`|78YNj(`A* zh3`2>EUr)*VIe?z)XPje)G*^HZoyA{7HJNbazH5bK<$A(ILz}qIF3tC@A`GX zd~?MqlAVni0x|Z_mk5NzsD2c|@)&Irt~;`lYOg7CG{u7>C_S|sn1lShwnK2^3rzG3 z>fIHfi9odmN{AT+>A!Xw>gb37nZngN&!NZ|;B74FhOK^~2+dQhSC(CBLgAHt=rPMp zH;o!BL~|kw^-CpkjYa^l^!y%V>fM=>2h}X>UnzAwKPh?|X4yi~_d4WOTmJD9=!BFL zDt*VLPdyA&B`*i8Ue{wB=fz*EOB9tQqP=C? zM*r*KD-2+MF+qtl8#g^+hYMN$qdV`5e3;>O*NUAwWP+W9%ea$pLG)? z!(D1a|E>B!!kRE{bqe|%qHYxfH3r0Tj95&Hz$-LbNmM?^WhX#MqU4#*CN&LqVITlY zMcogf(QHAZr9c+C7b1XVSy(FMj)C}yfrdXl0%Q@Bi2)w#{>Pnc4Ric&mz`ueFF0Ox zENOcfAj}bjwl0S}@brIto1Zb!2dS+{Ck)wh+};deaX4qnL&~gS$XPdw^;vXav4;!K zC+tIIUNMM8$70W<>}LLUxuCXrO#wq~r{Lr48iA$7en|@?hqL4sa4F-i)xvH6i2+~* zYerjVvq^w1juB!q3Y#H#kXEJ^uRR9`Z1bXK8o9IbLKhe*!Sz)@UGt0`Q`(XSSO^$= z>=LIR>PP*DlR{_9SKSyAvyTI?+}RjnUQu+=_IqMnwl32}wyusrux?v4 zJSvS=AojPIx;(#9LReW zz_Kp>?raJ4n%YZhR~fb~k2_kz*$A-B=DH}llZ7^hPICc!G8lM;*A7}!j5|LASQ`99BNSpeHA=2wM7w*k)Z4W?n1g#L z02cqnw1x*%CO|DcfYtqEJKjVISnZ)(>0>N~&Z`J6UHzqd2~0o$E4R?#O|&;dY@p50 z8iBE2pM(DQ2la`zA02|Fua(F_DJq!^U~L7LejNBc8JPRQ8K_?<2X>naU;P|)Tok~% zMQPmpnajovv0brxYKJiOlQ*Dny%so3ZhzVUEPvfJ0b9fGT{8J^KRO62UpWQE7j|Ll zr#Qc3eRNnIqbobh-&J8u`(|J@Ou`}3CYa(m+c2RS5PG-WybNv%iOn6!D4KSpn|%G& zu1G0rAABS^LALYb43+K;n6|}CT~FE7Wl83ALu1N(XLC)t{ihrcolY>PaxwKx)8bk< zH;L$bsT;Cwmvs6-*RB}hiPXNiQo9J~)}3tMI{s)LvX;9@h3V*b2EYoPh~(%(QVppN z0iGEjGb~K|gl>J+b%PJUJj#?MrTmSXXTgIY^u5TrDY+K?WYa zG7O*fx(O)cb5JT4pjs|NwOl0j6@po)gT?wzqT!)nurx3Bse&1ptVR>UsD4J2Rr-W< zDaehFTT*qFY705{C0wamY1+Nq&W347OI*Ab`ZjHzqBXCIoEIuem@1QX( z%q!NT$}k)2zyetH<^iB476ModoS_>X=5$C0W;~RmYhq3#9*S^0yD$i&Oh7vVrgUuZ zX+WI{ouMHv69(ktI&rveS-mMjpy*SnZWaPj!m1*nb*8J!+Rpm~j%e zMKD7CP5q48S$xDLkWAQiZWJe~pWJ4XmX6nr$hZH0?ABWaKJ0vSXW2;sSRuUwU5gy? z_RcvkX;yRka z6d{)j2li2*#+KjMQy~z`9H0$z(XN2@=*{+yOfOFKV+dgB{%4DjX8eaisieO3xDe{P z>@FDQI|Wc}IV^OZrfl}8#+MS*z{h~Yjx%n908?84%Xa`#cR^*EI>m9>KpE!zJC6l3WF*2WA6 zGGVPou?Gaia-$@h5$`at(0<@{wdSMClx7>k0$B9irLX+iRHvNq6if9|yEzh>x6VlS zo|N1}VL0))<5K83O*aED|7~Ys_rWT;{f+&`oEcWT5B0;+*G&`S2BX)x(FoDa?&iP0 z2(97xNN;YA$U49XgSp#va=+U7WR66KtSodPte-0aiiRUNRC-~T$97K!cHYnr+n+iJ z`}bA|REq_${?}VjKUaeJ?>P&ot&`@1tR&RG3eThY?>!6qm&$PF2VQ~f8sFd`BWmR< zCt>@sK^Xhhd8qzHdM%6#tfx#@}) zPAyGSrfwAEc> zE!4d2n(VlLZ^QoSu-aUjn3vR;Ja&;agV@3aTb~|_dDe&R#+ti{3@kT;#0IcU)Na@% zG=8ThxgPSY!5C&=d3wc^&*?cSQyiNmuy#g_Au$6TV>wI)iLS^;@W_=B`0Pifpi(MA zwNiqCY9Ca~C8!kgP|S0L!Cs-(QzScL2iP)`0Y}EKKs(|RK;RNav2(=A(M=5jEM50G zf*xyc8SN!$DrNgvH#vLbY7Jn?Ls(c0rlCt?me^!0;Err81Y9%%oC?7rfF;7QV(6ox zjUX24Up1PCP)8R+1h5c{J3>a;fq+nl(34>xh@ub*fJMK>ebDMmvGBTFi5qs6dpmCW z+qen}s1!OZ(RL|1V0!zkK$wcVqtT847HV1<0IS&|293U>eWpV1EacA2Dk{H;)`)Fx zMTR-5AxAGH0e9(lW9)}_KUx4>)=gI{-Z7UnE`y5yTUgD`GMX317IBwDqK63G5i2B6 z+oTgtoCV}-_2sL)GXb(NQ?{`k325s=H_8}c?AXr2BE*d3guFX+*FC#=LBis z1vmqZMjd8nXK5~tjg3LIuL{Ltk&o_&!u&%GH5_Zoa?pZMwXFu6{aT~0M%%@#NOGxY zo{;8n-57q>-61fqAp6RvdDSU^B|T%>AWe-@Hdu#`#k&w% zlf)@qV7dgsb<0}j_9Jj4q_afKRvFtiRlN}5x9pbgY9C5Bm08-*1GGkinmV*>sTDKQ_51Ldh4XRs+ugp^meD2M9S32iyIEJHIs^tDh`YYp z2S#e(5ROC`p7(r*#cAMCW-Q~rk1qavi6xg=4g;GRZhWzXdlW`GRuD_01zY(72c#0n zTiMIHpV3(PzOu;P|uI~b$mJ85|jJRKUm7L{)|{h|ZPn{M0b?6anM0BwKD z04#ppG`Y&ne9ude*<~S4beFmPFJ}M+j3M}^Dr`^lfZZK`w7pM|*}I18=OJe>Q^msm5)ZPL^OA>|rr z*9XrF&W-z7Ve&&0tUTFJuCMz^$R!^hQCSMpBARy>Rv%|$lgS7{^!@=xKW z7FR6W!rU%i@WSl|PhR1+@a;A!nuYT>>5G9wiAw=uy3RbJR*e)W?wH}-)5-X74Z@@n z`^Q+IX~OndBsodLlT@0SZR=*;2&wvx29-94%{ut3>2EEHld&3`lutwuBREQ2ad7K) z=jIj7m&0W8;HhDU_#HG#z}?W!sDMx84I z=(_KA3W-|=r_R$r+e(Y_+7K#Zhz+MqQ2UhQilgAMjLl}FNq`gr)i_srasK3Tkk1$3 z=FMBMFuw?+qoXi9JOq_Wg@QLQV=7n(e0OJe7oL0eS=g)9;Pmuq7#bXca=A=tx6l=l zSb|x|=W{e(DIFuA?H;m&E}hDx^X~r+2+155DO%Tk+DZTWo^{(L&90(pwB5X%%)-y| zzcuoujvwN^;`}{smE`?SN_aw9Mv~!+BacyHOc#G`0~b!ZXB&2`GP{B<_+jub0B%Uh z%y$Azg{?WatjfSL9pY3&&AqU9hhe%Ja}0rCtLwx`xb49gL-xYS-A#k*lY-j3za$w& zw&!h5>RPU@@xnTjwq=oaiIywU0%#|&nmj%#SYnEp4{g0E%(mcD)( zc3)qGv0t8pzQ3`qjR=k*yNg8ae_^hhEW3CoVSKoM@(#o{ zh>~9JF8{bDYgbHq&(rqytCNg4qx1FzIye^K=rrw4pZB$B;(!Xg5WJ&K(bwh?&O=M< z_D>SCul>02m!aKsOi}W7L(kdNqqS=Pa{Lp%-Uu9bwD4_g;cy!y);aRWU=M``L0bST zZ1ZqY>!N}cL42YyG8_7R3g=|;QAL4Z? zutY)dO4$mUg#R+`Q}3UEfAZ<)VW6)J{e30+LH1QX+XFddG>N^2*^`!>d|Vb5eI;NF zy5%X8gAG(Q<3<09A{C;vpoGs>mKGVJY}7JHCRBZAXz0PCMQ(j^6Dx+Xinz1>h3HZV z`wBrU8zoWLULw-V2CzniLPHr?$elneG?>|FHg1Fnvl4)X?uw{^#d=r00`?&QM1NC; zk{ZE=wZ=V6tD_@5iTC?@b4)-VvZ%!6k=oJSmkC)CQDEAp#Knc84`M_})+k~ZKz1WM zXto&05|;};FmRsA#8THsX2oc~39umAR{;iA7{Cgb(Lh%z=iqS`Qt!LG2jQ#<09ZP{ zWR0S^W7r4XmX+rhxt6xklZmUQIn?U-Fh>XH;7Q-{IzZpX951*Q!F^Z_{oUPNSX*1C zG1!~ULSK~`RX9$_O;*4p1ETiy!s5artgNgNaD~t2^XyuzYrlI4#Wb7EreR=>kBvjM zT7^=vB*5#T0kd(uB51a~vrQl?&ihiS1eHoznkhtS6FngXyX@8>2U%kyDks#eSSLQZ zPAj6x%q!fA1;(h|BRsT;A(QEg)auQ1{uU8blurh-olmeYKuh_-fr zWLruAciQvWogaT&089Zl1(tZt!~aJRiz4!(JwQ61Sz$|yPNck|>owzN0&bD(eh|## z_H$ZAT}ImhSiS+{m{RFyKsNxEL&G$ybs)!%EbmBJQ8;`Nftv@bQ2nb-82|M-64%C0 zb2taLe(WL%HJ|>mYk^2{$c&o*_A^ksq6>ZcX3!^xes2YaFe03Uv_B~K!tO(Tu=&{| zBtBhyxdxRFY(e!eHvl!OaA07>!nJ=o0b6ez>O4d2|JD(V{>DPY4X`;?fY~3Kf$Uln zCf-Kgt*ZirUlL=`o7VC7krOE5t5FEo3QB?z(w4vAyKO_D6akFR-f^?F&Jf{EvAOJ~3K~&NuKGY!YV4eh8#!y!Vc2?V_ciSPkqMb87D7}<((R0=aQ|8s^=#{0Ylmeea(OnBQqLR zPscQAM-U4N0W36TIh3~QTJfSTdyyW}oouNkk)198mKw#xGE!GJ)xjbbmTF)yz=XO@ zLKU;o`P5ZJNFP`PG>{p%!k;4owAgTN5fFj^7Tx5UA7Nn;P$tYPbE~T^baKn9Cw<4R zp5M~JSk!2wACmT}YMXAV&Z3jwSqM^>c1k@i&piy1LC znk07>=cL+Uh9QP!6_=U-1IwNH2E^%n-RWj6ZTF6!f#rl>=hI0?*LSY{LEw{ME!_ZE z<}hwpNcP~Y`S3GVa9Qmr%bJz7*E|z#75vk};v&5G;)`@(tdz?zeR>)u#wX0f3Ya2W zirr~h&uV*nmk*ApdnK9Ua1H>jJsENp%;s_gVj(!%SLtI7tbESV%ChU+&h8G(&fbQ- z-94HI=yG`K)Kq9Ubkeyp9=YBA;Q(0i z4HRHr3BY4DD_N6Kb()mj!y@4^XoHS1u^*ISoIzLlfQ}*EF$6wgd&!tLqPIosc1T3t ztT%=k#B(pgm~!8fJ=I;u)k0IdMYmmLEe6hKW*+h0?6wyN9MO`Cexv+bFR`>8d9Ox2 zMg+;NUKQz!3DejW#5b2p0$}03h40dDVPKmxpn!&!y~X36*Cu3DBwSqq+KJQ`S$J@2G8!Jsc=y0t(?9@!6UVA@Yg>)dw^b`GqYZytu_ z|8WxXb9I<{*Dc5`GI)a>gxXJ=ZyJV)U!H^NUvJ34oy)NENIxuo^K`muc%DMHMRYA3 z`;|F3sP@9jmrs!!;E_a)qgM`rgw{viy9B-4Em;2QQ>2-NQ3AX9-M1mT+_bM} z0M_3z3hSRYMuPRDzqx246Jo@<+dp;z^0(^*V7U<))92q^Sx<~_o2sB)mN8Y@?H=+C z(01=QfA6s9ky+!NMvkkdX5~3!c2LR_cvQ=ja^45Gtd#3UhmF~Bt@!Zc|2TPjnm=7u zF4B^cRoz>M@vHyjPyrtW7%Nl@k{PcB&g1y4F1+=iPZY? zoP~hY#^d~2q_x52Lja3h2ob;%7ec%#$M#_Wi`iWY0HFxF-qx$NXaOM6jS?V@#eunR zG`btJpj7Oh>#bqOP3xMmz~8v-tj0J0g^w5PM#vymvxO`dyqe|%2eHKzcr)Vjjs_Pu zs4?nE;N5^%8vRXx6=wkv=qt_4e^s9G0a(rmHuQu}cXl(gWJ0T}QKxHA7{Che(b}Kx z`exQxqm{;`F#x)_=#U$c0IS%S>l+&|H#ZCQ`aX>mIC~}oGt6kE{e}P*VGT)?THeQ1KT*b^?(Jgy z5Nj4MAjnl-ev4gW+|mN>X`y~2?{r?XaYQ({nVHv|mFUw6ihmg4&qGnpSs04Y(q#E7p1x29|V@ z?%}p+II1Ew>7}ni5%=Ry+EmMk2fYuzm%>60gILB|GgbX`(0R3~+zs)#xu1ALrmvp6b|thgQ}ny}xMQlj6wKkc zgV)2Ww%Jt4y{3bNA~r>u_tT~yI^cIwu0R&?`E`rU#ikfeFk$G69mnQT(iBN(u1H^n zpG~nn$MtuLS0e*HQjJL2qppEQ2a6ga3IRp%H@$(7B`Z00ODTaHs~RPKJZsDd^MVp%f?cI3jQ{c0L8tJA|Rrnibkr_272h`igEoY zO$68unT3TnzpXqXLq#zKv?>XY@^sE@jHu|4LF_IGsKF``yBEYVZ z3q!*Aa?TJJGPaM{?I9S}oBK!(F6cgoEH}BqMo@r7+oe4W^UG>tDT_?U35^v8@S=X! zcGTmR9ERAv&D|@z*+WkLov4Vrn+H$8PKCbhQXp(88CTsY4GGxnVOm|M`H&k-&ELc41>3qY7@o*475Jnhn^m*GZ%ue^%GlV0CRB*4EeQH~#F` z_F;d&L20SZoz6`>xFdkYV-W$Y60xul#NwYk0apY4{V+T<0>i_@q@^`JHU_89oThhg z-nc>O4h{^!xpOmc>Eb15)a%3=EEWsI=+gFPrwIp8peE2YL)NI1A3~o{DgHwRu)-|G z!2YPaOyq*e0$5?dh1}jS0xkYebsJ?NR<;%o%nSw2pfwyXPsEkoW%U>Vab+C2mr}|A z#y!CSlXxkWkx$q~D0-o2VCmk#Sd)N51Qd}Uq}9T5UBfl{VhF&}Jw9mr*r<;xmM%qg zYy!>;S;7G(n@8_bBM0Nly0_?>MI3GczbJYkvZ5)Vih@@RF6wHC?aqv4VR#D=sYWR7 z!319Ab5P9Zp^(qgew)o8h{X|9Nn$|PZ{td6qZZR%h-jEF+ZpuZ1ut{ytNx=b!*;kG z_lTHowdwExAD3vi0G3*(M*vG-I|W;h4npa&8-5#q=qG`{X9XDp&Ah=^0c3i^f3o+yW#EYDqpqcA&_@8Gn;ID#ho;;g9WiUXM z{w;3R>EaZ90=?6H5{U>w>SWUogY-|P&O8m;kbu@$0L6+}rp`O|!Qx$_)~Vi4MqPlfAKA+N&9S|g>37lu_L@?RGTre<=KdFkBxec zH!O(I`)Z`|*U?4_lto>*=urU%V)b=wgf17zB4gIgMhsX2b21tD+)q9a-}v^|Lb;HI zQnrU!SJqxevz>LU3;>`YnRAQEfDyasksF$%ZB}Tyjm4;c98Q~rSX<1(BAZ;ap6nek z7MOpmP^$&w#2%-E1-cXPAp>2T7`U+zirkRWfkEA9RG*5=s^vAH6PD8fu$YC#+CUt> zTSKaI6hbn5DIF9}*T{U5uM7;*;-F_Gf**e2YWWZgN^kC!?ZhL5m;okQqtikf`Ayr- zbh0=Yn%nO~VqlT$hPYm+%a_ShHNwb{=Qd%+fOUV=y3t`nS!~3_@^M{`yH2KB?mBuX z4S?0D3nACiBGmZrZrlfLMchqKnIycTD#OCnh%sx(5sNfO2F-&e<%)ysFg7|$ z`dB!wMn*+)T2<*qA`&*msEI$9FT1c5l#dBd@37%}Qj>wtfDwfOiOiyaNz zE+77f0ALwl*V*I^faSS?)yLdR9-Ujt24dzA?g6UXgqIfw0;mY{R~W?11ZIXXrj0-f zGH`hf6@Y}a5jp6EuC2Teh~AS6SnHmkEGEI8bRA|vcA52tg(X2joN?dYGK)+LQGm_ z2?Ax0sf}_60j#u(R~j=nW+ic7^<`)No=j;t7|6o4|K&2Z$>|@v4#lfA17hvIt{)b^ zX&MSQ_9-G^?}i0{P?Ku;pHIQg>-)Q0>R!FqCQzjQ1KWWNk9sq3>nAV4VL1b5zW*xp zZercIA+b)&Upqx^j?+JUJ%N4YsYBYXzoXTEH42fGN5Z&HT{QQ>q$1rqOzaGo(T9@wGE90eZTq;@?&cleKy}hdTzi~%qm2}c2?vwxzJHHD z#X@S5bX8CS+|HIW*lVWBJxkIS=3Xj{BgD23{6*A?(WPx&as<$+_J{07~gt)@6@f_q5zr5SLj^ zXn?j*`--%5c>QH?L>NWlLMYO+MlXZhJE#uAmN8+qMMp~vT&^$sRIq_Vj)q;Ze~!?1+cgwxI82>ekrWC1+cIz z4Bm;cEPqoY+Ah;JS|himfON!)l1oc7dDOLpT_I7ch&0BG_6WOds>=ld3u5?_Mi{wO z@BxgIE%0ED0CqN;BNsyjCHOF`oK4%GuhuxT`Lx@>jK_Q=K9W3KA&vU|pSbQX6HZ@m}mqZu9vW6Q0SU%I;ZsP5R{7Fp7b_cEhq90aq(f}?W3^vPsX7CPuF4Ox0Vb@b<_i}^gm6*?n6}=|HV0umgxJO zMAyd-ucXA&jF&rExVW^Pa&??NZ~nng_`8l1O`N=KTQL^Ea+0MY`O4Kcbs2QS z%gG^LY7awk^Q6rXN|Bdu)JLYJZ)pit&$Oy}Hkvsx zx6@2TYh$z@EP>@D9KlKrxo9$Ol_IRGkp7h#YP`m3y%N?fBcjdyMo$VzVyY&~vo+4G zL2o?#T$V_H9-o2FeZx8U`nTN+rF@P7EL^2z8BimhZ(G@bL<^GX^H$szi$IioVp=GG zWh3RWfGcZC=}ju%42#i7H=%k%Os8hK#m$)LMXXPv*c9IqlTHbR*XG-DHrRzN=0rYH z016X8BUKL)2woL(Io8FpJr#%_yL zE)sD^5L2AsT$fNMI+Hrv(V_SgUjl zv4{ZH+WH!SO08Ct0vKR4z-!m9!^^L{3{O4v6uffvI;^d2z}7YbR(r%+$QAPB9*c7W z0Vrfg(fGkRcm&W_?I&<)9-|PhuENmJFboY2!9af%wl=rmxo4k+Oy&qiMuuTvpbF(m zAI#3p!{*iw3=R!Jp;(~uG@1=)*6YNoLMB9QcMtaV_MpCBCv7$y)7f5RNfcmwd<;%a zO~Hc?J_xV9?>?BEoPe>haTppNCLpU;tC1ep-rg>Zj*P( zhy52AJWu2I;S4#2Yeqjj%#wnYN~sld1q9ar&j z0ku>>T$#D3DM%MH1k}p9svuTxkBEkIR9xJ5P=5(8P8b{!CYDCrb;kuA{4I-!{^@v} z7`J@NTi9X(T4_)eVmQ-2tCvO6QUdZSV+yn7%L#TZXQ0MjuBc05FuJfZzICV3@$R@| znoA!U?*^Q+7hkrTPCcCcSF5ZplBhey`eYoLm+!!MY%>d5qxUk@&lg7-+TRhxDv=8z zGq5xWi+kxrOl@@2G-B>{ZP$I3mt0|wW1qVKR{UA()jCeKJM@Np9^BdEvq{?}=e)o3 zhJIN3>M7bePyNhID85)Tc5Z#T0JneWJPEv?{*mhvIgk@S>g|EGFCK%9&mR7mEhb4B zqwqR{P^G8Q1<-yP(|N!MgD40;@$OlQdZ-`N!l-8PVOBSo80)!PyC>4{33UiP+pe~$IzF&Qrby8meiXo^Ni&CG6=R z-Bryiaqs%aV|*3De@WOp%$$!~C(PZwX?>e|v;@g_FYQb0c3GhN+*jofrbV6h3)Iv( z7>37}x#@DrmA>L7Ed`Ov2HTlUALlzyH@IK1L1X^Uq1D^co9CUI$9U>v&c?Q zU2*0zi-i_JtODa1;2QeWEKa1I&wk`Ie9c>~K#3SwXaF)if#x_dkO&wO@JgzPX_%W^ z0c*_dvH)1x8fCjC7FMvE#|g8sH1d;x zUBVnw01JV~oG=6EAfpEub&GUZtU9$wGvxml0G7^E^^%Zw_d-}QYjuqhRMofyb-W?E zFZlKv_uv|w_cXfj(0b4!FlTjj1y)v;VRdC0c6WD3i2d62Yw*g|tMKwGS7Bjs8R~Tu z@y|jwpNGDIei#@Wgw5?Os5kZrDC+O;4eW#|U;rSO{q%;sj8XX#fk>L^8 z+Sq`PJn>;DmrHQ*;(6$=Rv?!z!iz6og|&?>xNz|z^i}&{dwUD^>osUK8qklz?fw0* zwz2{n>zmN1H|VF1E{l76Bp{D-5!1Zy-h1KhyRX31)D)aPeHvzFEN!+br?lPk`symBNc9b<{%8cZxx1r2ZhjshVHF@cODw23LO{oPQOt7e>Y(4R~CZV z^kiV|i$-DNb4Q^17n?BlYgYRT$NBtspMl!F6&U-~d8qznka5;sdGFL>+FfaUo0{!U zm^eBZ#*2jVsvPnxMVt&^&sJ6eNgZ=l49)v!_8YssB=66JJ1TJK0Re(bkh{Cj^O>mzUth7hixUpL`OozVb3$yKx;hx3*w+ZCy!l9v+0Ptxee7-J__0;}a7E96j;TkHXW>JPZB({Uo$LIy4MBTU+q# zGf%_V*a$rEz$X#Q0S}(fJ^v!CZ*Ifu9(o7{1_mf?WLsg0rzR%g^wbpGzI78;S5~2~ zQYGCi1k1Lzwqa#?S(sTh0-eAV*s#Ofn$byWIo4gD{{?rU-6Caq!Y)T0Jw<>?3tTdj-!|$ zOlJL5Ku0R0YdyQCpGT@H1xw;~neh;x8b+5sGV)L00&sG3Sb*%)r5}|gghg`V0u9&!n z5xgYzS1?hf0(!-*p6kIs$V5fJs+dCo_Z-_f0${O#yX7NtJuQHx`?hiG51a+qiWLCs zT}iu2_j|%|-t?U%PPCN%!^-;Sj=<^{k3n{|38((UO=4WJ0Rj}IZ{b@{Lu;@XPW{9! zD891i)G!0+O1St9Q-FF}A1|N6^?jK9>D$n|ExKJ&Z3O8SzUwsf)Q{lQkKYLBde!bN z!~FN2h5XGrOup+jwMF_*hlfBXVPt}#rr5{q6DYbIK960P?%U&dS^M)1oFhZHKqSA| z`IfY0x(48hPFN{k+%aAAN`1mkZeBOJ*u!_60(L0r#KU`+y_`(h=`v9V0SGj6nl?SD zzHUEXFcNAHMuY7rOHS7w?cF8{o0Iyt4l)QATmS7O;g%qb*V)(G*FUaveKky*TA-%# zQuy7V5pCPdK9_Q!M+%kD&hn?=Nr%-__A zbU-rBQd>YIRf8-lm`Eh!bT^X##l9~$_!9>sBW0GKj~7M8lU zkjStJ_ilmj@G8ZlHth`WeoHusHw|+^HPO7q4(>B90PS0?xpyq^c)Yf79faJSg8MjF zTn6J1v|3+Zhxvs$n46u2Teok+_3PK+>a}Ym)V{Q`OfJ2pauLQSCZSj?!{*j5^k(xg zFfa(ka)qJ=KKb<1aP#I3xP18{xdLwQY{S;p7KyrJw7|3H&ch2Yz67say+$sD{e2ba zE0th(XB)0xy$WOFV{rfduc7nle!U6Tu3d+n-95PPwXY?Os~b0NzTd%HVOtL+iERV)-?VtkTZ36cFZJv|L)&z^z% z@4p}Jx%+O&=W<5eom^*~2&yU)eG=m+eHuvsmYR}x&Y3T;C&p}V=q}A`fnBqF^)s)B zE?~j{hP!_ml6s7t=&mJh@zPj4>cSpdR^Qwu(={_0JoH z%HMCp_^-}G&z|DGN2Hat{`OH=f5&M0b@mQEiO~ipfA%)yZ|(=1GM9nbe{~L;(*+p+ zg*m8v$O^kt)WxrvBJHc8-(P{D-(O{GHSoCuMpFi0^-IQ}_L|BaY>|IV`X5`Mn-;hO zk$u*B);^!BkcT*07;dY5`S0R8R&T%09t`oh&CVc~3dE6TvYwOeQ8->sR)YEiRiMPaToc5Rqf$Dz78Z~^Q$!smu^03-T zWDKgPI10f#Zf}Ok6!L1pt0H9zu_lPMm(*=hh1A(N$73n#V%dm>3X(A^$+{G>L3{vp zar0S{U~x^e$uW(LcK8gkKQ{7b}8% z%so=weWR=)J^XRU9~`#e=8YTh(km~+N1k{Bo_^+OcHy6ZI6Q#b4l<^e$gS|g#S1jXYWw@Jyu3m#f#+ssXq;WUdX03hkV!Q@ zJ__SwV{qg8RoL3zf(IUa0466UV0&kWA|P&WZ^PiwFicHOz%sc*u25OFHnvD}3){P| zuMb}Lx(DI0#~yeWn-Rjh)uUrzi339r3Cl!!WI(RjJYY5(wkQ5K?)6e=4YZQW zk0x0$3B>XX!oE^+W(GpM?s#B^O)(3+pRjo&$EPYa_M^{V3bqL`n{h zOj=)(0W5dw*wGm^X%iNx$e+@f*q&$F09BDmm&We)Sp8d%4#Lt`Pf`n>{lQltx6rUR zZTSq``nMOLHJXL-Uz&%$zf*B@!IOJ4F!uxJVE;lX?v&JaZ8(Vs@Q^q1o+ar2v-QB) z1EUUZAPDyk2I0^}u&1UV96;@!GKsh2B5?YLZ*<7MI$p_lUSEa1hx$59q}|5Y{@|59 z!*+S4PwB*-JVudxdyu)k_na|LtjrxHBo(Az?rGA!C6@$K;jE#9s(GhPLni&%3z&o| zndX^}+T|ba!`amq4F1>6z`7LxA^clbpuyt1)7cQ(&aJi&m^|IBh~DzN8vIJP@MHF~ zJAD$9^4CRnwS+fqd$B2oZ=`P*N;vNEFn}e=`}t8}0E>$pF!B;%IFBKaWN*Z@YvdKL zPKbT#Q|=jsx4z+&qY1(NjxKsGc!l30fQ33)tQ{p({46u5@Z5+1mWJB4pjD_uvcT); zQVlE?j};dKare?_P$Za32Mc6ZQ2;Y$hY7PtT|)@K68Av`u+-2;;~t~(sa91lhSo*^ zE0=|8sR(`LlBpNfMO^vJ@US=~^`hQllWV0!Fw#NF^Gk$f<$yq;xifh9b&u))ms zkJV;Th94iAj4(B6bMZ|)iIkDSZrudsbYRM-jeolLoNDidUFE9?+VNCLNej41HsL4OUi{;Q8mD zgXf=r9-e#tIk-JL3)?%pP^$F7*!UzsPnH1N)S ziiHx)&o9E}#yYW@`Uk2MK@f$~cWZmZjvAksB4!o-WHP;w%>d+jGjPyskk%Ffro@im z^$uMR(X|nyAfnsw`r0}Hu7zSAN~I!{N_m)@n}wa-9k~0RD=;)X$gYl#+v3@?XJKi1 z3D(!vXnY>F4hY2B+uo(fiW3v#aQ?!1xc{~H!E5ikA1=(ChcnY>U}R_rN|mwzS#E1~ zxF;NQ+oPOgKo*|UcH_~KMfcxh7a}4vV{;9HOo?umprC8U7`9X0lZB*n zSn7ef?>Ynfmr79i@HUM9r#a}^w`H!+6k+~5PLny9U#u1Q)*U)b-v#X8ssoh7F>}@E%;;^$a01MwX4SS!|2cy5aM3D(! zy^n7IwOJ$suOtn?cIZKh6Ys0i5GOIW(ib$kzXulyY8Cr`frO(y6E1t&4KDOvqzR%E zIiiuHC2PB^c-lAVof91vp1j+vnY1(o%I6p+i7tc+B6PGU+g(B1GwJnkx9EX0u04~6 zLwF62TMEqgZR*u-x`#0n?>eFzsnC>9*k#k&&o=XDty1=1!ehZdrA*J6>D&tKI?u(R zbnGQ<%AWL6c4>?(j#;MM^7^MvoC=Q&!oW*iw3m16x_LSo909!ko)P%$N2UTHrKvSl zC>DiOMKg=_B-r(?SYS;F<95eNry_tWg6rberiUXooVkGb|9WGpfQ|w%d{AIlKn_*T zH_mvVpooK_M?x+eWOVWfG1?gP4!R?tR>=Vw`4p({h(+AV&^as(;9>9*`JOb5X$1V4~nfG&hA*4qPot1ZAGwF%I_iD`!*R#qcA zIRKUsfwujae#ifKcv8iO<+qtH+}^=$B)9?Vqh@)Rezu33@Z@W25X3f!%fzZT8pKRO zhSCnY?OneHFTe5*ZVvWpHHrXu;o>E@|C1g-&L6qoUB7k}Ha6Db@?Cck zv+~1Fd=wUzmT63&`(UNgM}p`GjE;_sK&f1U{n|dwKXlm{7#tuW_dIG&WpkuYg={K3 z7~)vNLnONW&CSmfh=qqnVnH1N)a(1iu3#5j21E~!4&b2Ggw?fGsMl+7dU~2%9I=dh zwS58(PEDPH^XJdQ($XSqZEg~atXwRU!29a*D$LH!LbKU`-fRZ$y6ZCBd-px?@IwzX zkcBL=(NU@!2~s=zX1M=s<0tJI-HzEXfMs*1Q6a}k`Zf@d0c>$#Y`*} z3n!ajq42{1wi6SA^%3}9iI z=(33}U0m%+-s^Qwq)QLEsNqW~dznM~ys(AIr5%BJtdjs&`;8_6SooVo+>dCT(K2CF zReXvje1`n|rt z+Jv#+Sb$6;*gr?T0CPWh4(jKNF#78Y(Ek^kfwRfZ8>+DM^;1x|whyQN{VhPPnUnu? zdMNNmw1}1~F5RFJbn^A-G{w}X%}x_e@q94vsK$g+OeLwvM2?OJyA}Adk7@gkhCsU2 zB$#^#8Fag*v~6v3z0mea^FXNBWOhW#=NS5JQ|_Q0%;v6%hB(RLyu5&phq|t|llLyt zNigMl(;m6;)f8&3LCzQwL2(^QEiHOu8I`;j?iQu;n-#r5V!^4v%>JW>N zTO*Ys0TI(j8CX3~F5;~w-)zziZ5Cy}*`U+tf0T3o~B#pBgi3u)!Pddyqzr7-9Afy-)8r?kl7}#=`Sh4!mI}(P7d;;l3qZG$Y7s-3Xl} zBrsx?32DvejwW1}Yh3!*T&A1O(KyS(rpk5Dnz$>RkCA5QxjOao8?t-Ke`|lsIEXC# zoFPUReEH><;QEbgaO>7BxPIe0=}K*EZo>Y4og)49=5ho|^$!ff#MCJQt6I$_JoV(0 zaO>txn4Fq|e4zyEn_Dy|7--_YN7o$e?^3Bm;3YD!5YWozvM@3-0#j3y6yzYE%M%EU z5k>d*_F;FoMy`LzxI&O^zh0;R-mldtl3}@Ap#x-3ZXf|qqnjZCSS{A9A`L8#B21Sv#K1!EE6)rpWLcwBKoMD|d1hY` zfQ9=h>v3sxM7^BS`DldRLj#Oi=7$)C@ZG^xA~0^#EFkd)bDFo!1a&79J^Q#`O$6ovtXHnYFe(eHu53JITP)Zn0~Ff~Jmz5XdS7PU+twXj7Nv3)*4c z4yQ-V|0VT8yYUjX+TF}e#r)GE?E4iMBl3z&AOB2s@=CLYr)kc_XY`MHSD0>dh#i`N zR!LJh`-0nl;h~kT$Kuz&&PtM;8y^JIr5Jun=YRXRlbtQF!x1lg15>01;6`p+gCUvSy7ZyrnH1YF|#ajvb=+)&*O(f6>swFL?Jz`)=XYhB1KEdf{zUMZ-hQ3uWV5OH_a3!!L6 z5={|r&#_gsWqOVnz(S)PZ)FjbL*o{KIb@k3h(%zI(YF$VSC|2`SE)M%9T*r%a{*3u zX)t2x>Ov^SJ$}zy4@Z+zS3<)i5QCX*d5t`10WZ|Tas_f#?}~5TEeMIaDF_}=q(XIj z6KxjNzruI%?;1KBfd%@(h)r~B&Tf-@0JZD~IykuV(=aDKmij~OXN_UHnI7VSXM45x5(lfXkQff{Pa~!G#MK;PT}waQBtF zC?Bks0_tHD#m-r0e|B7mgO?WZwqSsuK@;0&+X}R)0G5*+1KPg5h#zvxndtJD;#?9w zyI6~)?G6=K*EUV;D{g2cP~4cOU75UW7|7HdNaP)1di-sCTNkI)Mhxs1Zq zf!WCX5Cdk&ux8CD)womuiiV(+AnDQsZ`uL(Cg5}mO_ z(!E0F6*9{>qNA`jGXRBLo`5J0^wJ{{7!kbUpe*QG%=-~?PD%QY_A7FML?#)@9pK(x zAniWAY&f0Id@hZ;5bEVq=F&Su09IfWx0_IQzy_y2Pmt)_ zKEqoFQOxwwgu6MXwJUzYA*6Pt1aseg2A~&U_`S<8_{VF3ryEmwnE$Rba9Hkv(cfBv z>R)a~*1y`7GOT>%B;d1m`h(!r=>NV1*_B|_KopnXe9JJbeZeSTRKoH9Z4PqF_8E-+ zxAui&u=!a-P=0cUz^$IW7=h$em2gLb(*gF>7D`2*i95*nkG~11N2)C(RaNBX*#B%y zdE1}Z(q$d{RCq#ko?(!EC0m^&WB=ytgvP>iHz@ypAJhBEb&fqJcV4&DjT^h3xP=L~ zft$KJZo65W;?_H-&OXap4yE?(F7ggvm-$Zrh9YDQ5Z{p^u^hDAtAWH%dV4h9ZVYDG zZa75hC9iwlYnN0Xjw?oh8p&>i`r$0N-Xs_tx^3r3 zgEEKl#f%)#2*BdQ3b}SDBaHxotPy-yD3PLPk!U|NvDnqniC{$lSy2BgI>%x+)sE-k zoq0h8j^(%Kv=Gi$SqK(nG{?ozqdME{tkbR3j@O_}i3P&AJm@ZX^_5rPBTqg7fBiRq z1vhS9gXNVKVoYU`4Fx?=DwpBh%y|N=Zr-}hx>4&J}e~-q{;u30LZ9+dr7_3&I+E=9rhu5!Pg~7oAI6rd+u3WwVm(HJq zYF`CfM?G-!);!#}H3v6u&C#K3{WPd!bS;LbY0f{%Qr*R+nLI zZH>VZQn zFYiwXULo*8F79qH5xR(xz#^)c%e6sJ#o~0KvJlrjS#rl@wLYQMF6YT{ELdkxOmn|%G zZ(T1b9gUzU;JLaF%HU>Ofa=1`X%cQnP_Du4SHt>96haC@k?Aomgt$kM#-_L)BEWvw zYQfRL0RvYV2CyhVOO_eLDgckVUU*4`7jET3LEN9&2B7_rE}yXdg`F)ni;r2$i#+dZ z*lxs3b^)yDL{D=#^4)=GR_^;Qx!JQN#?9WO6LHchB#p(Lv@>S_R=#8$Hr_HsZFc(K zT#M*k)n`gD_b<-CVW9_3{nSk;J+~K05m{Ud-!e^+4e!Y32%z%8ZJ7AQIT05P=2E+_ z0*l{r3J&ubat$oLR0}*%KUaWxtV5}Xgxk?Al0Uq#rT&<{=(NLvVO}8YdtsBc5@@C zUTx-xnR@;_Tx|*e9Bq?##GZ0lXQ2ULo^?*UfyQmqe{su*&#DY1<)8gA`6Ug$4qr*j zI*N?3PV({SOr%@wTr*TRbpJsv-jEI&tZrAh%eY&fcB9?y8PS=Sc8161Vc1u}l=yl1 zf9GZT&&c?4>Kw`_W|pN}LZk@ojsU(q9=>}FK7$xo3N%>;78M^U@?yHPn?Z&FA95i? z7Y7EgDDD?UyJO&qs*mg?F@BK&fyN~X!HS{lR?dP~;v%2`7P$~&xNrfmB)T99ztUlW z04%;8r{XGrMG>JyFUyL+=&6Mc&InE+3#&kS8R$yLOf0M)3cRCGbxxu)SwV9Zcvrn7 zd#Ld-u(0t003Pa3X@n_mSdspcHnaEV@<$m+!hYhecHAfg_~N|Tg_EKb>Hs7Rk`Ek8 zg-{m>0=iHWg%17#s>yiPGILmUb_<~!d)EzAmTY#h;Buy&XXyv_oqba0j5$oU$xiFn z9>B8ef*yF35fTBgWU^=*qE6J#_7=>}-h#jR+rNPi{r!jFBTs%5cK3D(m>L_OfYH%0 z(viZ5gQH{P#6ehCSb)Wa1#-PZfM|4N6sA#6YGwu=dE^lo8JmEGUDVL+2=^3 z3I_nXC(h2!LSJ7M1_w~{Y6P~oHsOWmpQm)rot=gUAGjaxyYC)mU>yJ~EH1*FghWMUY|X87A{`81chRem{B(cD3&AcXxE$Oi1co>9N%;d;|;i2PVU24X; zDFy*7wSl9?O7!ByeKwM-Omn;QwsWmBi*ZO+s(R}wn}S}7v)h-lSvkNxGj=TltAQ@pxX&O9k-!$b@n9_~cYjgwcLcDA zu|?^y`ylN-bb-Pk7O{m%JB!`LaqV@>LF`xBD|^Uww~$4h$viQlaD7IM1@oxw*I|3F zPVB4QIz}E84JTbgT#(SL&k~RWuck=r&|W+s2t)D!$iBh=EeQ1F5jbN;7DXDSecJ+9 z2=pm{#TQNDz9$-2DiOea$EXlp!jSf357hQ1@bSZ_}U<}mp54+VXh^1?{Sre$8 ziBD$%tTdZnyb%x?KJxU!%7d)PBDV)thm(Wz!Jl;48A1> zN@(0fO@&TtlJ@zKP% ziW$nhZTlq`f?6rX{0gd!DT!$b7Dw2-*BF6H-h<}|_#`CN_EJah&ajZM1 z%jkLN$|!v1>n2U4AiM!KfP~O{$jHUp&0ci5>w#jf7m8?P(@iad8%n1~0EKk3MC4p4 z{p6}f%p){1*&RSX2E3BnRnie5;Dw_PGI-_wW)}}W46qIqyLSkHMMk|aukf&99p|i0 z73w`XbrnkFzAIqAGR+8 zSlAXC)|?Yi5Yes*GHMmP5~c&@$E*R=0AavN%Y*+-hb46_kpm6^eF`&Cvd%csh*)w+ zQ}++V1=+>0hg{CI{G?+{oUXF9lY@3 z%aF?#Ak&+rdADENgWc^dI5jyzg6400{4sd_!;ir5@GvZ{tid1t$^QdSJ^LI*9>jh| z;OE5`UxMq`uhYNtg#zhDwHggrSz3g?z6y+wkHP~F+zIiJ6%pMi5zIpOM64r%YNW;0Xi!A4Vz~&XPqP?2YJ{z=t&^+Oz4yKb-uU?A@ELD> z6MXuoe402lD+py>`OHz&9M|G@i_QS7xM8gOp0TdQ3bs`N_lu~);u+GUK#+41=1OK zLV&~FV|ahj2!*W8h-@srG||0>zf-+N26~iPtb3QyGsHZIp~NnP$Qml;3pBowRfuUK zP*$rU`>M`D?g*R-7^GuL-37Vnaqr>1hK1W@r0c$pZg&XQU{q1u15pPL0W6CACnD|y zU?Fy7_iNmDsBW|eGm{Ma*+kb3omtp%5(d6 zw~C^LGg)&UvSbG>~^u zaE&`peSGP~FD{9|er(aaZ|T$iabVNpx}_SHP63QT5W}x^(@&LlilGqR!tEYlw*tRS z5zhg(WeXbRkurzA@csR`^^D9Jr^4YO1713}6wE!;BxAdZb4J;_4@d00hBAkR9D7(6A){OMi=- z0m(p<;V-x2Oc>)s1OYe)?5-jEJrz+ak7Wb~u{gRS8p{}AF)Ko^cngk(uNAU2+8ETf zTw%V^cYcc=3H?=ta}~f6_8H!&lLiN#iIhA>AfdW>NMt~>fQcI+x-3W)SVUN~KnR=? z7Z($`kwu9)N)wlnHFmV@)fiCYJUkrl{IB3Va>|mQOj8 z@7!a-(b9fxYqNs$7*Tqhun~NvR~T@8V*{2J=ismY>M!6!A4Gua1z26*fJ`7hr9D4W57L zD*V}B{3Sg1;>)nOxJAUK=jUN@X&K<~05Z88F|csnB4|`96rjJq0(akg1ukBi zfxX%eMMCTC$x^h!)wKSlPX^VY9vmnvL4O;e{vV?qnjR$%A zk*KAP#!mYST*rORS<{TECoCh~f$?I!{b1(Z0gq z8O9Bsfgb!D3B@Z@3)7bN<2-o1RXwUA>ObLn3q6!JM)X7xchtZl#uB>lNt>vEJGUpc zy0B$|8P5t}@qWd7H0eeO;|Lj77?Bs*SLi~Bd%FfRK@bR^(|{tRd!-j8a*4zjR>3I4 zIyUHnO5#RhC0WPv5b7vIPaxJI)LIN^;rDdeq5zg?a^c>C`@DjH$STG)0*($0a|%H# z`jH?k>i*A{W+(}umq$7?lzGLG3-LV^(AVD#Vo4-kS;x6~?V*SM9dscKP42+Rj?R+y zTa1~;CZ$yG7%NZmj1$*;twS5uE><$6)^9>mLwRtGKvhNha9()?7 z3$XaD)6g8vLI3;LVf6pN4KjEr-FZVltbEl3Wa@`7@$>WITA0R^@3c+*CPNzc#5AP| z?tx<1>b{sz)T9G*(%<42`;%ywR9lJXp%BZ6HdcS@MQ4b8*ZhrlIe$L%ZPGdsUk5iu zy9}kMv&k-H8%L*cz-CEY)=b?)dJM7p3kl`7R*iiqQUx``l?jq=)bk-NrkmO}X{ZpA zm`N_gzqcz(DB4=e?(i;jp|W>3=fcZhT!Exb1LK0neX1&Wx0O_Hrn1jnP$}s97R@7Q zlsdaKwNMv>jS8lPk7(G7h3aAEMe)-kITmByoR_mN_`r(ob#QypfeM zcFhdt?w0Z4E2x2W%IH$D!6whsgDlXBUy-Xp4?v!7G}+iw0E^rVgegRHd@+pGh(rTY z!*Ht$AsM&|$cWgwxnUJI4?Kw0G13!;3>Ov_x*4D*78>>VK8c|tAST)xWaO%#t{B)n z&zzB~20Q{-W~<02XOs<$6TWo!unyaLzgzcGA*KyfDVXZfMwM>Vkk5*m#Iw zS4w50VMI38)>6Zm+6Z|~zQ$HkvTWEO2F+Sf9u&tj^Yz^iNxsm28)W5yJbY zig#nbKKJ}{@R27z4DWm2@4-hu`UFMa8yO#m$*E}qvaVje3ghEr^mFy^$7OJrB2M=U``Rhg|e< zj&YRA1IQH$FgZCv+B>LCg=0RO?}eH3XW`75Y2YI_&w<(=16U~LKEJpEM?E>3ODL?2 zqR3b;jDT6I?U8FwpjEoFHrCOmn;CMx`_|?@_xOL+uyzYSq;n7ch z6yE$9p9K#-@Bptk5+T(+=DAEPH8IsP;@&250FXwD#q?Mx40>d5B_Vau zE5vjW+-Z>5IbQ1E&moY6xw=H^eq+ES-E(=rVZ@OEB3zT`0*AB?GXx4VfQ7DhSpl## z0--Xn_#%b(9A>fc{>KBuWoha7AU8|LWfQ^MRtvQ<(H*h@dyN+Cw-CTOG5{7nkBm23 zGpH=Mt`H5(0D%<6l==l3o6K%j01H{u%)H|L+KRHP1)v}v>wnQ2C%~67wd}{5mcvRftbV~LY`t-iw6aG3^P<@teSb_^ zU&CXFPJ*7bH&XTP=S8}?7?-|NnMB{jm`aE0mdcpzcF_qhRn9m`)p~(^I~gOXQtx;k z+ZWQMpVVxT+Q>n`{oeOX?BC5n!e2J~Uf8X|-3R?^uD`75=B>MTF@Pl^?#jMVmJViO zT;f<{76B~Pjv@d{fDHm=gmzCio+^TlH_8HLks*m;u0?N&l9vu-Z41$?65|*Re>C5!4!qC+ofn8?kk=?MaL(1_=-+o?gO3D>UQfQ6+MazDCpYZjh+_Iar7)!^vhh=kh_P(rW?T}9D_uvje6nBnN62T3QypG{vv)M$}NS*RQX4KHgFllaK)Il7h znC|N88r;5l8`js?VQ*_2G6*c^@&sb_^;e;U~QHu$|EMz!|UX>W2u$JW_gCZMJVmX*$qj(GeMLpvX$#{lZ_<@S_S~soNk$5;Dub zFwn%6kbo%!Vu)eI;i@tE7mKALONnoDNr*Pf0_dbgf$Sqmmm>vPmp^txVK4{{S3MZ; z4R#p7k|=~?022dCTnO=Imlzrc?8ec;h=mxXNDOE)PaHxk|C_-Uavz}EUJfI!46ITf zwZ6nv(lD@`wS~&4x6!QIWn7Gu@g=`C@*;s)&f$awa+$Hl3^l$r4~z6+uJj|_%HW-7 zsvv-6whI=zMMh1X^n>c`E<&1BJf@MM!V#l5F*=l~R+cilRKtuSC!!l+53zDkRF@+Y zW?2N64v{>X@xS%9yQ8_{xaoY)2>0E0Kb$&s8vgEsAB6w%p7&6Dmx~2r50uJ%aPGnd7#o}T|Hyj}Fxjr^ zN_bUwSB{& zn46!MG0CD&PEBEGa7fr$wQ5b+FDuI{IC1=hL`2*ul~AwN(5z{+^8Q2u<5N>2U_U%E zEI?axYa6AFB8r6qPM$a}d7PP^!oGcbaOlthRBL6-&d%cKkz-h#U&6K5{tTXV%{6$! zWlzAqJ^RdPU;`Q5I_nnfbTU^vsh55yP2JNHC8NdVpLPMTobD5pu1pAS2lE109f3IG z*6dBr!XE)$)xUnV+#qvr(1BgYIta41cCpuJWngsxu)J=bzJHt2SkOg?Arkn)Xk8gy zC-y}Fu*~-=6Xp6A%GCF&v);|Y6d70m zA_SGp+RNe)5VU|D7aXRj%wPqulzpXnwg8qKa0#erKgvQ=W}ORQ(RQI7K+ufqzN4GP zdCcfQIxKTzPl&jEFo4y|l%ebn>%oP47pG={_291V-^85dWw^afToMU$KC{TN}alBTSEhAj1GXBZJdRu zwKlMAl9&JDH=CS9Ba|_e# z3!yO+kw6Ts7sopLNk97=-$#4XSxwDM=6S3!7Dh7`(nzD7rpqptAp7WcvJabs{n*O( zOXO1adDa`pTVH9r9b6AAvqw0)FNCd3A2vq@usJ+{?L-KnIwU>mclj;PSnveq=vtTF zS=DT0{J)x6l8+ ziPtoUx0_m9qthJZ+#56(c&2>)*)zu4?hm#C{ONbJ6k1a6OkiXb!lz#}>GlpsbX+$_ z3d*Qvj5365v>pp!DR`wDSBiaGI)BJH6{UepgOataA+J@R!=4C1?&Uk+6E7nEroqXRFoL0wuHvg|m$)QvTiVe-~f>#@BGqefQwVk)s$Jn?O376)iWm zH?`^V`2rT_=aEh&kVz%6u~8HjL*GDHKwGB6cna*lj2yUk|9(_zbyVtg2~p4SK>%xI zB`?e*0+QKuMxqsFvl-OulmlrZk%)_!JKLNfC|OcWyHc%)dtbh=j$&~G&1MLRR7$kD zQt1pLCbFQ_jbSGxYcH9M3s6OuzH*tsS4~9dhlhql?~3fR<)vk;uB?h1q1;oU`=YYB zsJXSt`G@*E$rLi#EQW^ZHaH}kSN7XSA9@I@%ge}S(-<7gh)ZE4!ciT<;^Gn(7ndbTzCiQwIWinS&A6RnV|vTbRU7 z^g+YGQrC7pco6n1@3*dp9*~7=uJjV8Zd5RlV^~}XWeqfeOpNZ9ts+N@${z5Tda;KK z9M=N+5a=O5Wi+FNh3v482nH!5iJ*>XRyqewy1wcfWHM+Ehs?o;>Mp9*mWmMA4_Q>| z4p}weRZ0HphikkXWQi-i$`$ba+}N z(e{DX>kGHTA*^0Eiu~1s5)O0lGb_k_dDXv>CW;&FN9pnmR$eeH13P_d5kvpFj6MO2 zf-eFF<#UtRxFn7GL>P&?$`bi7eqUKO!=0*&fX&*qLnuBei-DDfL?le#yx#tj5MY5d z0ukfynML%GRt>EmccXM%MS?3K1gu|~6&9K1an8+Sj}z_On`cltGmhxd8YbR#Qo)Xv zw|Ps+`kQ^rj6`J2el3sTe_r-&K)lbEE=^(abrZn=RuclKXJKjp03ZNKL_t)3(8ZL% zTl(fAVh?%iw|g%mATs~P2?16{KDLC+Hv`(REeXwCZGQy$YjUWb8OK(--vBUjBrAD} zK3J9fBi)f#A)FckT%UuvkEXe$o$S8%TY-glN}( z(7j_f#>1F>>lB)ifcx0Q)olzcZOZ!+cU6(PwdA(HV^}l=cv}2#qo|%9!=B$cDWKDC zE{>1lQ&T9P6Gwf2#OL}P+5#fS>xkc5LFOAJPukt*)~`yVd|n*&J<38QC`Zta z3*^As7Gn2Rk@;2;(MP?Yn>9fFCRAtsZ1;K1carJ5we>k~hv}jAd`-3!Q_gDyYT7+c zc|Bz0F{HL*CR$c`S}Q)+TW>-9rY>{Ujvcw*wEpIG32I~Lwxt!+b{)>fTcq9EZ3X>C z_cl9hqTHSQ?GVWnf7!Gt<64!n(77 zm5q?3j4P|(LG39kgzn5*rtdo&0MobSUDoa1aVb={LaXOu^|6E@OZN+@7u}e#u0auZByzY9FB;K zA%VD!YE?G2(Rd8g(^EKj@BoH}2F0cFk%u1^T`VJqC-X}#m%-TBn6SkN{+&E=0^$BJ zUiy-k;p(Sfg>%k68`*4DTgK?jc}2y&mV-OxwzskKjRl!aMA1%*r*~Wki^+6wr(ftK z@2pGmp8;#2d=>$lZFlQn}8FwNRyf@5f;J3r|Fy_+>lfGrVk zcO&G=eTJp$L@1OwS`TPM=-mKV^4I8RaUS>1!vtYMp?>3<*c2gn=8usNb$vDx)27qf zLm^?`Isg_ABGfgJz_PB_RR^dqW0kdBa`6bH?m&;*a55^3|?mpo-$Sv^n#s@ z${tMTp2jjkti@MPpmbSA1kgurSVHE;Lc1kSmd11x^S?SJ%oqx<)1|P#xQ*I@D8dW% zb}@K%vT#U2gL+dpbDmt0`BmQ+6Md`LqZMqW2e9ylNi;?y=wIK z!JdZZc%|L31Q zgtg}ng8B%r)IJIic!SxtH@^E zvmOX=M6jWDFe+deL7$2D&Le(LkPE5VF?oux`ut(!pFJq$jQ^;Du@5YGK$Omds=haZ zgFD|!&PLzm=~~#t;pXBSLaYYD=v(%!B4Fs`;CIsr>|dyLzw%W8PxVf5MF8^ z`?UfRKP*fCCToX)Qt1gPDQ^14bqxRGN>5{D^=F4sxQ0dwgz2~E`eVYZ^SwNv>k&xH zKYvgFH!=`eDccdUfBMmw4x>IDk#WK@5riFk58Zh?fLLboB@=A^Hz%c?`l?Ndycxf< zEa1=Pco-WOB~dvqE{p<#B@^$SlQs;x$Z|XJ$1}nZB0xpPl@?MNO7+PwYKLROrVG`# zG4_Ea#P9UYcUF-2VFls&hP-#`F&_(Fso=Yws0xG2yhJsY^mJDNECo@l=&Oj{Qfr4BX$iHx zDUk?m*m5$kya1MfSH=xQ?0+An(bSIB>#%t+cwnfxZN%K^Hb~%#V(t{R)sIGHQY{Xv zm1A|NtdOn5s4;E{tu5#S{{*zMI$;X<@q||ZB_l@MZY#R2E?Zu+TM!nSxWXuVO8!b6 zXap^1BOw|pWMI*Sg&VdlCwimwB~$lWEruJxlW%GoiME+C)wpRO`zjiVs5Xc_jW!eq zr?)w-B&Rfre?lL!dN9_t%7G@_@#!Ta&`Z+sm$-t;Zpc+-uTo|(qMgNJbL zULi)wUq7!%{8 z7#_+YH#CGuG={$Z0hFsXEH1C%!H18aSgOdF8_Z^e1$A)$KJ48ygW;hp;?c0AUn;34 z7hRv!?MM3*b+a0qbzv*gg@+)Q#%2m3o=hT{NUHm4ttM&kr*xVE><}P~u91t2i#TxL z0H&uV5sik0Id$7@x8c~4<0$0UvDr`nfcfqp2um6GS0b@VK!=*JuV!YZFui9A69Q6| zP%0HsTrXgCbrnmCiz58KXJ$sgKDxX<_|StWtmSdW;WO~W%b$qro_`$<9ylPHT5KsB z2~HZz+mU@tS^q5S{Fk|3fn@_4m}R_mUY32n0a98!x^K2_3C7&IiE!?V$F_sYv2VA3{c{{MGNazm-k@8)S+Y71Z1}3q1{d<#I6A>&mOi7z)~Pc-QkQ5 zqhU*lOS%E7EI{PyEb4r#Y#s%V1ej@Vqro}Wuvs<0hY>sX{Iv`$iAd-GS>_N%Kq;Fi zv+)!Fi|*kDBnx0*xnP~!fu*n6|JlGQ!lYH#c#dOX7a0(U>zjNC962s|3Se0mJS#x& zvac+7rE8INdvRSf^=`+8WQIcQDs-<5tW9hXoHo%Fb$xGQTXee=ykcG~TiW(FrYsQ@ zeQuCO2g~YK84WD4EsSQFvbZ!VqPT{dU@q3?>BqJ(zQmQ#09bLl&a<8(VH1s4gQZwo z$pc`y#$rz^nAi3*5A@LY-K2NKNp?!jo6A!Hu-Ye_;BvR;qdpqO(rYGAIU_D00|nbt zw_E0ezcT2aMz_QAISJYP(GATqShHWxW9Sph;wsqbvLz$9v;6XLl%ALth5|QzOslWH zjl>-r82QLznY-Cr563_TRr*`& z!bW4gO#ZJE=r376`R<7j7(DrwJ>q^ut+L#g*D(0W6@&t+m-R}3Vd2-N1W;ssZYBG% z|4oldJ(?lnTT2DNdie+jKfi{-&#ndng#^!*Up6cZJVuF}eD`d-JE70lfqH2DIQ~EP zh?^c+Cu9hXzjr}^vaVNO2rDldM&YUqvR^4+=+j2?%u;vFT)J^d3M(&BM$^>0P73hg z9WjM#av<15z-aXEmmD`r?+78tv-p}Z0q92mZV9Px2lXL0w`6h6|N5l3gvK7JVdH`% zMn1BH)VGR0jhg`Gu`t01U=9DnGSWA-zlZLU#VgV%UYQ2R7lEjezgtqkudPppK$hLo z>qk-BA4T#zB@BIh4gL9c0Eb}A$}2`tJu@b(sj>Ghq0hLKdfUMQSbEQ*C!m7+a)QnI z>jts@l#Gng$+ypmJLj%0g5U(OerE#Fhie#ppSNxNXY9o*QdoWAptzDw|NfjXvb@*s z0W2*G*=CEc8$tE7C=z#7F#JzzE#=UKlIgF$d`Q?-krNG!y?06aa}ZOHd0c+w5K5OM z5x=*J;TzTvp7+*`IhE`WA^*G_ice0-_?-Hq`QYFct{LYR*%+|;MUWXA)Dm{<+Hy>4 z0F$2DPLk+6F}lCB+|&AqHBP(EvAdXncX4a?a(WZ$NL|t-0^hkqMl9ChJl`IT(B`jg z)o;sAd&70K6iyky>QWwW9}H;UAOOp)d+R13$c$5+R z#+8uYTm38plBw9Njb3PVDvYsjHk6FEMD|ss-VhMWhT2y53*#1GTmuByk|EN~Z9OY!Pq#Jx zEE)quul04gYcj?tk!p%r7ot|H1t@bl?z1M@FTMzWd$ppi!&g^wSRGg7eP9 zMHgR)Bgc;7-uv#u?LW9(m`enV;?cMWmy>mrN>RTmhD0(gT2sTrqryx)dSVXWyy<2v zt>i`fDw|0Oi1kyCI|t{Sbvh=;M+LxISy@7%P{c;LBH#|wAv3B{sTx)lFfu%dW^)tE zE6V~hb8}6gDH@FlctzJn5od2gzUO%5^JH)>FE8WZfrHpHGbQeY`PCJC`<8Fxp$8wv z(!w%oRWij)gtfkYWq3tmGMJfWVZDIdUP4jJQw0;r1#we4j^_@Yd>)tX*dM0RuvkKUB zoC5&`_FZPJsSxv>&(olTZQ=v|Ixes-knhZm9u`}x-CzT3xHLDT`DfZ%0V$(nNMJ>n zyG9eslv#DGY#rF>g37>B#*~6rqI*U6Z2_>1E1Y2!`#>zi*p+*!i)Gvi1q>r2%*^3D zh>!?>M*qqOU>O#dvbNlhJwMT>Y@29M1#x+kLy10wWj#}75kJDT5`fDdGBq7$uxel_ zfF*e}>}F@Zb69sSQ0VAx**KX)!GP@}vMdbhRT3XY$>1h~Hb*o?$wHEq*Tm79Xpg9>@F}CInEK{NJ;l4ZrEt z-tJ0mwP&-91~GiYiZHfLyls!T>y7=*V%MHeaB}uHr_dN1z~1YRdvvbcot*8*l`|6p zjAg%G5D>sI^9Mp${KYX;&P`zS1B*!Bu3Brh%-*cBZAzD?ko-Yez`1T$@kwc{ynI9e zsO0xbSooC*VbF}fX8|Fyr8>IegbaX{!^nr1ktX0}F5f68xHA>O;;)Q@Y@VSTR+0XO z$L-SN#+3i*EDG1=6zKYgWzlNtbP;%4dfh1M`=c2A#2PYRYh_o4gmpv)R`j7-3xH)R z&SaG1e(?=ss2z%8_#-Pw-P|(Hor$1xO}YS9y#>JX;{#-tE&kFds)wQ&f6t<@q`X%k zfMvm!F4O1w)6!V|*&L!r>KOaLa-i#>ji9rg8Nkvn45NB_6uHl@BlktJ{aWYP5H>DM zVCffz5INq!`1^y?v~x3=ck5SWP&*J&@XYAib?tnQ#re*3{NAR#9YClqnbaqPp0^{m zn-h?N8~!=80dRJy#SUyX|@|#?_cf0HbS8a;tDgs0k8~Xz(gh#7eazq z<~a*ssS5}LS`>6xO$c_3vKN4w>C-dgiSvEd48lkwA^lLe2&IZlh|F;5IiV!$% zu{zd_evqf1ujW^A_dR#w>tFvjeDYJDL?jl)p~HvJA080V<)y_1aU0BKvN-#!Gx7AN zJO!y_0;P=&eCK=L#VxnqhDVPc!A7x&GfzJQW22)o7njQ=S3{-DUJk0;KX?CWHR|Fe=p=@`WN+>3X<9G588* zrl$pXqB~@*TE+wS-;YNgdK5>G97l1zBrcB)YURkLS%sqsPFLvuSXvjR8O7RDnIw|Q zga(o@EJnHuKJxGpVSv$PHkFJcolXd_$61G>?uFfTPb*o}WqvzmvBwthT4;98YXjPxbx-ehQfyrqJ?kU&(Ig!&lgt8g zoH>oiy69XPz{s+$tXQ}swC+U7HHRm1fMM8I(np&TwUD5cL@#u}E7v_+T?%!cCU8X| zcDdiU5-Nb@9*$V|KocfIBlXJ11<)*jW!E7Gf2$A0B>nP!z%)&9NSDXfXi2{NobRH~TldHYc^oh(!MrjUsz(10y#qBKy@AmmkmO+fFX)Ps@q> zTI;pvw;pX{TgW|qA>`>E_ks~&evN!|5ox+QcH7+bwrlHJan6P&@GgBp(B`XpIF8xh znic?M^lukLXnXd}(*jA)Tz|v|42sbfkk`52m=f@4;xFce9anfp4pZ->yJU;&ks0*s zS7ovC;t`C$XI@xX`R5D@iz)YowZ{Zt)%M0P|7#NhDiVyNtC_0{<6q?HZg}DkXGB+O z{IBN4t(00=<@1u*`=9LsWTD-KqXIC za{lQflD2L*f6%nKWzlSF+U7V1wAz6T);jLm-m}B=t@roZJN@tVR6w&S8dw5g z*>-Koq&4uohMpB9SH_SA=vDwr-44QJT`{5&0W8w+4Ui>K2^}GHJK{8?w|Ac47dDa; z*&PhAT_J!~CmV|!WFvrUPNwzbo9;{sVDY0T=IWy809dAs>T2ORU=eqRZ4r5=(M-^d zhO02JxXF)35ECXAPpYjRh>D(bV{Jo`|B|7mIw0KCsHU0fn%M(DcV5wVx|e^A?XU>_gnw-T5G{rksdn}i=9Ir) ztK-PANAZ=fei`4o=|R8TAx1xSj& z1i7k}ngD$inlF`jptvpb(SZZ|1h`_|QfF(=%pP3vq$_dlwa>-G*aTAPlwm9CcHA^# z%Ua{ky1x0>;zQ<3XHD=dTCHnj`#qhzex0mz}Nw`nec9x5pd<-r@_7(qftk*fldFWyREW@Jmxeyw+ zbpf!fTO>8R41guB{-VvPtYITgX%6Yswh$1|^k;#zWIx_SXq!xIWps(4y#QDmnUQO> zjjk&0k;dK(9e(wDJf>R@7G}qB?ujhr47B!}y~DZU#u z#q9MnqOoJI=&>56-hQlIL_X1v{Bwp-xGE>^OB9>WeBA(RyWC`TYVJ-Zk$$f)>Gf5N zu(tGbW7xPfg^`agA$`-jxIQkwY!t;SG8p|EWtrJ42*4tkbM#LS2#`4bm-FbWZsFux z_lP^<@V~TcHgN#V|Hc#=BVo+^?lF{}pp2o!J!Oo&XFg~Rg`a`7)^V*WJ~1VEj~=OE z;{VLKE}{xGyH(l;6rY&E@+(G={B8-OA6gQyv2Ih&NgTZ@xwf4M06rP<$?h6Iv zKHCYv>Nu&2j+q6p=+bDTWVSxR`GEk{=1@PT|8QRP+`LyHfYtU|FF2yn0gu0PTHF^W z|E!e_sCDOU7h9Y2zdj~n@l$`;4tmw66yS#0pD`>V?%htk+ZkBu zUS>6$SQrani5sDDC5(mXj@R!nnlvOfh00AWVGG7A001BWNkl3#PX*8?-BO4nrXUbiD}^bO-GC8zV%Y`2k_b_T6=w3uvMQ*jLhfW)*>D2G+9KAcMtn-@mU-K7JN)N?fon2g;i*>)2UlaYRk9_pQ zxc!H>3utx01sC8M*IbRGM~~u>haSSQqen29&Ei+y_y$~X{&}cY%6RC(2k?VC?!sa(Z9 z_dS4ewIQPIv1k~PFgLj-8rxMK8uVXP+y&T#hy2u(9-; zpaXAb?XgpSOMo!HUE+^2*v*y<>f3<;)~OBxXD#tALamFM*-P7qeFVZSlikcqqT^*w z3M_ynYp)H=A#4{9fMxRQtganwqoCE-T`w)W(d5^VtGH~s{5i8v@VeyNe>;Gbb**;w zsnpHSMiaE`ECs3zan~c=_qc8 z%HXo@Z32jy^~D~@DC5?GX$r*18br{?2tum6H$VLj)0tIIS4p;ru%wOaAVHZZqwPr$ z7L@@IoXN0;g)Pmph<25-znuI^6huA15x8D75(!j^!=gFdQXwi?GtIhXgPsV0CF{EW zCEJ>ZQ*bw`Z$>tU9-Ch}0nxYm37a0`IdYJTb#rQO=|kKRrubw^v@JRrY&_YmHE9wIce|*`$*$hFzD}r71$p{AW zo8opzJt{uqFQ2u--28G=U3^LgYtJ1Pt)|$+6^wppQ6k=XFEYHAUNer$*`y>xT=0^& zm%6wOo?5BBQJ^|)8#>I9Z7;0PM6mG2NfGLvdFydUyqruJf_?<}#@;vY04t6m=6L~y zy-)t$j4+tUsG|Gc!W$+~+Z(~&>yNdSpThbl-o8h)qXs{rMXIoUmDZX{ZG+U-5lQuU2Lr*=vm07CBx+$R{b}_Ag!3{5YCKy8G=ZG`Z<{xGHXQ zu?K4%-BQ~}k-w$MKC2y$3ZpCbfVvuP_k}Qj{S+vszUQ}3psyU@#%IR7AHX7TsV*s< zuGN?Ub{XDeV4 z4QCgHa=DD}i3{K@_{KNBjQhkzoN=R#%o~!!$EJiDzANjfj<(iUpiJ zc^r>CdJOme=pj7t;G@W9hcGml!o=txqTvuqrGhYzO69VEJjr+p*FNW3T=}Fckw~OO zy#2oWAH;fbL)ww3T`Zg5x_UF^RRG9u%Qu-HU%D}>eMRm{&V z;-QBgMzvPM$k-SXDQahhQLk0ds8umMJcvv>EgSh#u_#(ubdS9F!b@@0RnNfHS6$_J zJ?IGb%zrz$-N~KZBHXvE)&BY2wejs6Tf6m-6~Hock(&oQLcM!fbI4)aWZIf& zg2G6a`CZp7hqYt@ECJrg*3|TQ*huIjapyA2M{s_HZ1y@sOLJ7##b+PXfYyVZR3ZY0`G z%OGQO=Vd+k4sTil9KDiYL`q;&>L`tUXh9hvtw#4iNI@${AEu>_l~dPNGLhT=bC|sC_i|+fy=IjQ@qY^0nsG0$60^P&doD`XSNM8Y2VpRpev?BmcaD*pK{? z3R~+^+~0n4O5Qc~&RPB0ymaNo!zes0i=of1BKO6-I~JUZc6&wX@hPl6e-K-l0g#DC zCSd%&szfs+duCv{fxhwLmkJvwB57!X8w}RM%Rbe3!bdr82 zm)|tDd9Uq@V)iXl^6t?O8ew%at~V}EVd>{bk!7U3Pq3YJk#qZz7TybBc{Q*)^~J)o za{^Kg{nIKkUtjlSO@OE;r9_ZD@q_ZtZgXaCS${?rt1lW9)>i7G3+)6`y?_T+q^%&CH0#93PCbE zH@N9I0M=bb*PdELqqyefO0CZwOV-R5O|yR%5AjfgwJ`ZWSui{w6U@*ME$ zpd9b2Y5+I@mYF=;JU%@q*RnJSfTc_!IaM{A1T|m@{?P4!ET)jlzM`=#u7ot031I1| zt{`7xC>s!j3@D?M!I0q`e>{<`Z7P6OuJKbh2JfZ;u=;d^u?;yHZWx^`-C)=VPDTJ$ z3}Ba?OTmVu?tc6O<; z8cBL2q6V?m@lfzeKq8|trHm`R~ivc-4=y)MjbG-0W(wxS=t#Q zo(vlsAxoGPQim#H&3kx?E+XzmTZlk_0Ba%rj>f%pA@q%l7VRr9pwpYX@@{+Zf35pn zrkTzQWT+@RMLImz)>iP5kA4JS`?s%&tKZ1@D4y_y%doPtf_v_{8(W*3GFHw%_gtKQ z_z;G2IoWJ7@?LqPgkq_Tle2UaTtXxgMStHm>Xjlw*hC^8#Q>v24h$ffN+FjW#O0S= zj-NXBJVc^#0iy1_>mJN4ETd8_qr6d+Pa(gG!g>+)O=`^5#m%p{zAn-H)(Zu3|J$=? zAI2vpv9PeH?4?pk^29>Yg^*DK`Iq`|iDW|hFWFoC@3GM_#G({o4@rc>TD6LE&pj7s zoPHSDY#M8;%lPIuzkx>|J%Unk!?^zTi;LvuHZZei5BBZbkAtTj7DiWLJud?Elapf@ z8p*1y{c?|d)dEc2KC&m>#ZTr_yMez zylPS0gA3~p>HgK6JCR)N^X6@i3!wu;lzmOeS;CVwk+v^`hwgJw(nrBwOOWJ^>3Df^o z?`m7z2J2fY0iY3xd7nA7F~@3L>tsH)npTu~H=^_cVu>rfek@zcin)thz9mf`BtZ~U1KHh_bK>;49NyA8B1Y}a*Euyc{fkWa{ zNCyMIi`{SYK)`{~2@6*b3Xnp;Vd&#ah&@v6R0S<1JhhFIr>UIug1)mqwsa3=*3ez+ z_h*D{Blb zE;vj#YDOJ<#~#s58hhV@ikkO_F!vU9DWpzQ;%>|2ajVJ#SOf=sz$6#Xa38i3eQ3r) zh(1~qHdX58A_ns90`fM+rJoxWQS^zwSP=1c@70)y;KW;}K{wIyzglo3F*=p$?|}p; zDAG<4lfW2(4Mt)l`pu|tOh0{73E?Gw1VZmSDLPKqull~IFxSYI+8i1Xz?2{uBgPR> zVxHOtyR;>+^3ox3`yBe@Dzabo=)o}z^H>;*Zyb{}r{8u`w86Zku)T1NQ3#C-VLO23 z_Er0@{54rnYij6UR+0INN5~z(@~cO%@%W?&peOEV0kFDs`}L<~u=>&=jQqn2QvdD; zKgEUc9n**$t7G^dSKUa3eIWsp*cP?@5tJ`VqA@Xm%vX!ZeP*pCz(a3i&H=C*O^wv& zWo!0_WS-ed_aVHnDS%`0)(z7>)@0EZCb+ryi^CF4aON$HQs|HR=bsQXZ~13tuy$P* zV}G-PlpmBGPmrNzcz!lpUx_{^?83=anOqU?W+cZU(*Ce zKC+55SzY#UqldYAH@CF+F8Ar6zAC?Zo3giN^<=5r8{2c}#f7s^)z`Ah4|9;2TamCK9 zioB8xV`(9^Ede#RrMpjo>aOB7%_|S*`9=F{3ZNw5W?AyN&=be8( zW@k_02S4}$5{Wp5b6K2o)*09{Gc7DVZceM!syx52up}F3g!++AWe|(@qgE-RFSI2h z@6lKc;c&!gmPK&R*^k5i{Rib40$1O={SM5|FN)3;-4gks8&TiDfVk=vitCu0Ul5iQ zH^S74qUid8{Rc#Nol*W)*VeGKv@A>~(VhxvA5|c$UqB`@__)cX+f6o`l?^e=P%IXO z!FAbXkH-ZUoG)c$xjyyDPvVX{?!+R?N7PCpeX{?BF)})eq2XZ+4i3t=UR_iAKj(Jv+8xw&Itsu47eh2 zj(N^~tpPvmA%!`7aX~N}Y{SgJ*6q-gO+4_#CD1aS+*-0MECI3z;+VPJ%iL1dmIba1 zYs)gYjHZ!{YC?vsL8qK9P|STwPfk)^s=f+rbLi3Bd8tD`Wm)P<0sn2m-j zQEyFf6_=ex7efVogjFOOSjK%&w4GD~OBufgxRiCnb+MGZSOCkEK@N&Ye|B8l`yCfT zlZ;`)8Gz8#k+=~W!FmpNf=Mj90Ep6240Fm8Nl+~+>(Z$Q$X*c3vX~XXQkOrLOAp&z zS3-@XXab%XfY!P{>fx0EugE+WJuHAWi|T=y^h_RQP5W^HShm8vBgH?i^}pN&#tgVl zo)^lCP0*V|^Wo$AM)Hy;%su(eaDhSsR)SdISOq5wxS--P=x_dg~DFq!!C zdB+uRqaZpvm?kzy25|iCdxTXZI$2dc9d@n|#J#X|X%Z8Ex!4A9 zb=se?4>Y3&NJ;mh_@oR_eQQU(w$;WL@%BJdyfXpMWuB#1N1mc*lC| zU*E*UyXO&|^#Wnq#sq69-o80FfSI?R@I+rUiT4rU8pirlG8p{y8ggIA2Nomm09Y%& zD1@zjL*5z!)}EI`{y8~}{{1qNEs_3KUos@_g=B*zzvpLCb(>xC&&?r!Z5E>+;B$U( z(E?axsr8jT?Is8BoNXa2HoCFqK3fnsx)4M9oWf-RtjLi%M*n^V{fyw~xj5fYG@or; zxF#(OIciIhdFQ=416V=%()KJ~k;L*VhcNuHHDqoq2DDW$_)>ZT-CBn*^vOK3U-r9A z7OqMQt1J8EbqsyV18|z8wxc0z5j3@pYYLHnP6itn$1(a3Ys!c_wd!nXf%ZAE+bn4f zWz+52TeIsFYkurp-9f~;ws+Xacb9W7M)Fv#@W4^nQ_pUjXWZGdjj!En^Ezg(r*Q%| z2!YNLrW>{F8d^6I-CUU4@)=Y}qXFd`x0Zp`3Sh}i-qUv7gjkmiE1YVzpe*A@DgFFV z6H5ikZ6rb~jBX?OiNGpDWIK!>rSB^P%hh=jvDd98D)lXtg@x5{Tn=dX(hw$Fi}fRs zoygcSS{f3K(5{VkY+H7ei5#fLzMjxhOT(V#ieYT>LjzXwPZpVc!ordf;dRNYYD;M( zLStZ?NK*W76U5wuBw1ikMdQ8E2~`B2A2Oa4#B#f+qL`Yd$+u{ZxXdzwc9IWEaI+`r zR+A*eO^-$=v^rR>Mwo62osTfmR0Lnd-i48+E`<_>(CDMIGqBv*$zi;iLilvOdK$4m zX*ZcYhBXn*4wC)jp@$y89e3Q0kA3tbxa;0~aOm)9IB@WwfLOD$v$*^2yD&UFgvs$y z9NNDRqr*d}S1Tx2tKxdMxVR)5Ps76_n4FlzV2!(H)#s10ihzKaRS+8TgxQ;@;AW;OL^u#CO z(n~MF>8BqSarcjX^kcZ~w(sEB(GvoiQFA8}i6Ih;A(>1G07WpBz}o8SG9Gu%8F=!O zufS!GzZhqobtZoJgYV;k2k#evZFxD5`GqBHlxqSM5J1ahvzT9)N4dNq(GLki^Ik@J zWMsqV{mk?6s#pFTMn*=E%j6ukhi;ke4|4 z0jvD$ggft8Mx~>3Wj0h6Om96PQFe>h-Oz3^vF%KAefMs%-?TR&M! z6f2kY*oeLhlhD!q(sH=b4-Es$0C8Rb%d)SSj=a^@hglbWAfUuB^+a$qfSs)`0k9nA zlo~X$rdh##Ih<0fNaPDl02#|JBY4Gf2{1Q6W|#>?WS*z3poc#0SQ6H;xDYA>OF%F_ zPiX|lT~S%c>Y1s)Q4au?gWK*n(!IJ!K|`af=^XGH-rqXBTEFXQ(rU?h=S{$lMeMkt zaLcPXrl|Y!OGkteLx6=YX9Sj#_mu&Ogmx-9cVADoOy$f3R(^Iwm@WPJP2|3k7qNEN z&1?7NIkhKRTB*ZE&S^VSbZTCmd@I>k0~mkryrTi-o4}hufef4LhLQW+Dh5Bh=JpAD z0-El}!Y_`Aj@9)4Jb}ounz<(=zzf~+hW}{=nQyHN(@Mau$EPs$E(++o8+`&`i?1CO zU991cuQ*L)TT0S;`3MF-pU2?8b`Wvr#1QYp+;2>X))__EQ@54;Q3yi-h0_a9%}P3K zH=abv>Td+k}&q+ro zbGqi`pOr!S<_!#gl#DNTp78@%!5Ua@wlp);)|&mTab&(x!tg(t$ejM>4D5(2FUn#4 zsx-#`Y8mmnD!y)3IVXnsUmX=taP%Km5$Y6#uqEaBH;tltID)aiUTul6xYJnZiYf&@ z+~H6%kS*v>pu@X%T0%X)2ilaLcJ8z$+FLr7*7?ET`3<4OGZ~n$^DQ+KZ0zn-_pQHo zs0dG?dKj8cqIz$u?m+PH?l$bL!DlBdClBTy9y6 z&Gy#2j$5r3!}KwSKK9g80W8DVk-yZXP$5)x#e-1r#a$t6w6NsVmjF#a25dw=-$|;T z9_!o57TQ(-OCk{x#GnZ=XbZPXh);pQe`(`c5c))PNgbXLWOO%y$2 zkXkmBHJl{}lE1U*}!vWWA(6XXmgFwC2*5x;goY^`9_#)9#)$G zSUfcrJrV`595+0s;#r&Jd83mh`$%!ma5phFjJusQn4WAdWMiQKmUSbPrPvzzX45Hd z6$YT=?-Gg7e1wr@41R&nIu4ouHlYDiHOsr78+SY6|1y79|#kR;BGRJ5O9Z# zBaV=VA9)lf=H^f;ZJ`)07Tw1AC`bzy&1Ds{}x zEuvCkI!&ar8Kg5AaeZ7_UBUV~b+$H(`%0$945wbOm=ch==j#;%D#s|Of1+MIdb<4SDDKnNsWx$ubLJrxD7WAh*D}?3vW#lgoYHzXY$s3DMFp|A#u9{6fK5O&0fAhtE2d$E z?WZ9VjET%oxRbLNk2w;gu7^5@xH4*kOu&l7Wx@YbRz;Zk8PD4J($W~<0 zr82jWP5d@S`@Ywjs=imN9)9cUz4H#$KJnO=Z};i8@*3(ZH?r$b$s&Js4g{RI;boM& z>{s%L9jUZOm)ogg&F_^n5)xsM%ox^d;?50ZzmyjN?p`+MJ-#O3HcyRps=O|h>#L_G zP@-1OFHNdu(*qTRs$O=9CwfeF0F^Ui=r3<$>TM@P-^-mCfW~+P^KY5}ftvkqI)+f) zO^0o8{2hD5C6JN&=vKGz#&NNpr~lxD0Uxw5)PXww&OJ!nRTj5BE3R*WSp~3$cLcDQ z*6Irek$+}R1hrMe%FYB$aqpA-4iBhC6?M`AE&`vG$Hg@o-n-{TSL&47Hv}{$!#Mf7 zQyNk3e=oQjFP{vZ~$PGVrm=34=j+25H&ZGTj>$_CbgT_=U1cySVa z^(IC?u!zK6EfF{gU_HkJVBJ)7_oyv>j{ixf*on7Ki~Hi<>rWz7_s^Fy#ECy!>ex@bDbq#ro@7ZaxZA-38`awVW&=&Uw`B&>w=(WSmZ}PZT2BgarVB4^Jk#?$|&M)Zr zOWTsJU-*jNk}0o;sW-S_r+2uUUvZGo)Xaj_ZB}&i;BnmuGD&RytPw;8)|tb2Y8!y% zf7lDaSiLGWF8!g?^*8rJ;D<~s8p%8jRp5uZ8y@4*XlIH0p`5xJ0LuvH@}1?H9PKCJMp?}eR}fYs7r70t!nf4* za#>jMSj1ssiSVuN_B{ZWxiifMT}z9NDAM&GZ-x^+>YF>Xcj2@v=-8nsW@6a{oL z3@Ik&({{0&3)7tah7}{-%7lxzY%Hh8IbMkhOv^4QV;-5CaGb+#(yM20s4r8}P+1eqIH^-2Y`N*U~9XPt2-a)U#n?M4Cfcs!0n2M@}J?NhInas1d3EX>b}zSjKw zB4$s{37cx8T)~r{@)TTj(IrTx)5x!H;QK$kLjbH=t&Vg$gQ1}z5&tJB^}xdqVSZsz zfJ`#DHcA`fzQ}$pF287Eqf|n*S~nY9?ZnY&1c_uE;fS)Y2%hoXq%hOnG#-y38jZ@o zHGn_^xm-@f-E+CDjFZ`uvsheO!ph1THXByfL7;FM$Lv)sJDFH9jy=vJk+2BdGm>Gg zRuMt>k>L?}W@U8^_4<~Sg_>OPL_##Ms5SP$gAWL3HaR&dKpWqC`0(kt@cavL^;K8n z(u*&V{%N3z9T`~8YqFamW7tbNcbM5s#Ibepb})MH z_RK~jG!J=4c6ac~HI5uW$vJ}1B~j-qyGB~j#${fK>syPCl|1KVX*vI`=~*z!tp*FI zSis5(y}NFLcD}Wsk><_(ZuFKcn@PbM1x-Y_U0mLc4i*n(jJUf*C*&F?j4fqj*(ij< z>=NxO1Nev@mPX*UQ4S@#o-9WS)~Khswh`ABt9vB?mK>O16G+ z+Erv-8TUbgSOlU3z_Ni=EO_OBSjH|eHW7Q2FpY&h8rH)$If%0^ges6vTcrbl)oS7H zG<;ir_dafa>R`_X0$84r>w+C_qV0xcHw%52c@MmOmz#-JBieKbY6;E1eiCHV$XE4k zWN)O9^>P>2qV{)lW4-*M5tJ@XtM#?r#K^y_ApMQPDZ41O7u!1v?y?TO4b+nTR$PnG z(-vPnhK);8y}zUh4BxPV%vX78W-b~M2V$6g^Aw_F2K_H1hVDs~QToc~B{1`r6Q~`G ziksW;$CiC=g7)^K@7{+{t%*Iqf81f#*t}C0Y2{@*F|ZWvUcGJz`Df>ZVMWH47kFB~ zGL4m&4GSBr*NdRq#9uD>K+mn*0E(9-k-oXqrXAM0LnnZ7;t!@Uu(*loKb~^{EV^bg z+8zbY!}A6hXl*RBSh4@j|LV8^Z1sf@0pw z2VlK-*(c)8e!cR_ArQz)-nM~}53hD%M0Q0aW+-JySh!8<`+eC7zA=5ZnP>V>$K<*#8Yy`;d4jf|&x zw?K}Zj0zJ=Bkj=;6aY&;Jl&-6tQ3D5gX(&yniiz;TYV22`Bef~bRi@It47Tb1+e%A zmR0h=hfU-{o(yxt&uE0QQP@<$U1eXXA#On+E84EniZlwM3fUUF&a{c@dKvAIFa_N; zIw3a!JoObWn$gqHlXum?vhVWNx$PbT5Sde7jT~iM7@gB+HQ=3RJ^fH!@d)~vd-xyr zW4e)mR3ZSZ-AY{&HOPy)wCDy$^J&AOYmc(sMI%|Ueie-Hin$9b#zcy8qfWW33422B z^koAKI_0(<%mz_06=Qh-cBK5|Kw6d|;un-0n_MO$UfJo)lphsN4-|ZR->VPhd~wU4FQytHA{`Eenbc;#nr`+ z-$_Knnx>-wXg?y+C=&6Q_A3E;jjO8>xgQ9J#r;tHK6 zy!@pv!!xhG#tbEm`ngwMX28gGi&T6lX zt5}9d!^k^-`Awnjh7rLK3p{u&YMssufMpp|a#)}Mi2UxjbGz(Y3tkET)w;-;xlmHH zAf1`|?E#ftmMsg*dYvg)V_nUnewYe1BQg*Lr9yIF}zY(^T6Xh{v04!yx*>sXn| zrsp4i^?Q37_r5{3)25(p1Kd7a_yDXn=iT50y0fizGVD9eSX~OUQ#p4r36d#NcuE$< zC#F%Kh{!}k@$l@w6_C7RLj=Wxq7rgLT%U?yBd{?;)8s#-S+^S?5V%DHju zx&FAr^s;va16W@75gqJ|QaArAW5QS(`S3E*x6p;q*uvou_zsGtPyG3UL?G;VF|Ay` z0B!`kCf>K;i)2@PLK@3IH!R}h!yjK0QS`v84_LnW}7}HX~DK?#&Y-`cA+ncE1NCYOi8Rb@7+SP}>*5 z)E|0*FnweGIfLR3CoY5rG->T>WZRXlOe6oCtVY~?|FXDR`ivV>8Rd%-Qct03Q=$IbmA zE`;8VI9q5t7Q*Tab0}V!Lh9DCh@FQ#fihhHD-s~$-kFh9d0Y&OuNg*YyNS`iSwZ}P z4s{m-s%J#8^z%d5j)ySv;WZ?_Z`gGvv$iL({^ovt1O!A!|9(}#E;!LG{Tp`nk>ywB z(3l)h_rV_q0Fb9Te|4c@X_7rGWPt;Y&)H11X3kp~9e(S&u6TCRz0k;Zzq+^0iEY_w z$+q8!_S|i)&kp7BNe=APhE6&B1@iruRQnEwc~D+VBKpTz83Fay`jzIt<=eL40^W$A zo_m|XMFL<=Iyv&YY}l{8<3Y7ZL>tM`Z=%M8>8rX6P$m{53<~w0x)K_dkl+g=kb8dTys*l%4H+_LFiS{`*T)aXsr4WXbr0W1PpBIwS#@BmoqqF_aX zUELQ}lhuK;K$%x>%W7h|r{=El?)D4ayjj;napg3d6#Jay-0E-{T@=|A5acuZELHml4yj6A!dbwo!(>eY7jHmwZ^qi91&a_iLzye^VZK#8i3_8 zc65vhu+Rk7R@bnwIETOa+YjRNU-%sMAJ~V9$w`S6NCq5*%_qmlaN40mxaY3BaNj-m zqF$?EVr(4OUH1Y!{_&S#X3svESIB^(Zq=sfSJkn;p2vd^{s?okC&YblWvzgvrB&IK zaZDUOd>W>vCxv0Px|YX@lXI9~T*C6ossco{IyN?_vsE#nxKy;iNqwG5MYO9n8(Xp| z-K$Q*9EuBj|Se|Y3;Hp^rXLK3*xaMY`}WElo)*@XQ^}ku^RwOM~O4fdgc-D z-rUY3UQ@$mc^crz09Nh+kn3(H5SE#OWKMSU9bI_LIau=S`J9#5G_*2{EJ$r~ZPr?I zCgNduDUjoWW|}j5kRm!*bS0EXe9FdBad%~9RYl8@tSsKAOe`A-PyiQ)fu(?wxb>L` zhXTfI*@%kDLbUF95?Rk-5{CuMB12jt19N?70kAB1C7_rGtg<|70j;dol{pkq*0a@@ zau0-bqG*iommO!u>#mA2Pc7Xs;Mx%|ta0bp)__9hAEo`);Bhe8Ej2 zXcB4}W8LSeZomHL099S9qYtQ$g;BaVg~HQv;?~2BA%O=*t;>9~fY_r7AW)2(AjkTZ z8B`C)ML?TE(22V?ko!tObciSrzw>3v{aD*G2#E068&wa*M0mZnFDl^F#9vt#G+i&M zr^PTw4X6jJnEdm350DbD8Im<7gq0T!q42Z}2EUNU;OAU67vH(`%3+i)O(A-`E<)SM z?{D~Ym$q{KAmgj>^o#&bjCe@ql(S5RLnu5mi?!$Gq#velE{f>5xM`Z32)+-)iYxv=q}n*_gJ7u-{l3crrx#K z0(QFjVK9ME%`FcB=KQk=6lO56x`ougZwNp}w^!@FvN_a`(q#!0pO_SO9);Tn8DY>e z*F5utyr~bu99(^A4%loWb!!FbZ&3lJ@v&-)+9bC|lO{gnTP?FYj?4@UQW9yBbvP z*0%>*2j)xnH_!IQ`BF33`h4I<$Om9~JHEG&YSCYG#t5D&3@p8T8w2~LVa}M9)L|$w zH3cLTNOE#$01WF+C@iN?Q{4!|eG2?UB8VFhOY|#@jzvh!TI%JffGzc`$iOPsx3E#$ z!UpwqM5LXL2&zA&ObarR`eaU`QA(DG+$ZjaWSY2aBzv-Nfg?5E)eS*_ERXApTV@5i zMBsHGGH6)3^+(;H~T0p-e1wqjc-iw3j)-XU)il$XNQK z*I`^F^u$`-2}Mv@8q=@x)GL?&a7io#;Ec%L<@`TF6mb$Fo5EHO{o(CTH=aWD(j>toA7>N$#8Q#F+Ps{ z`}c{MJ%Opk#RaJ!x=}Kn!J#4P+k6j!KC*MpI`a%nO-+j+{?hU?jvP6H(#D1e#uM~r zT+P?M<`?k%=RRMw$0D()aXj+Oj-Gvi!8LSFc4VVE@BbX8R8JsMFFkda;FXil?mJj_ zm63|K3xjeSf&eT#UOj&D4gl{1sC1;;R9m$H{aY>tJ6y)H$+NSk)0{Z~k=0M~L>_eX z2no*Hdo2*+09Bf{LaYql_vj7zzKTgGk9GL)!sWq~Ur z?5+_CH3&(Skw<0iBO}WdbZ6iat2?CtnKGIzfW>uDSy+ZawY}xIm@BxWYnbReQI9gL z2TAI-?nahW_d^eB*#KBhna!rfVPP3&vn_)F-Nt?1VdELiD{6oV$Y$IjT>#8EqA|>5 z!~V4!B-3})MllCzmN9MeE^E55y6s1U!dTlzqYvtuWEpZ+pk6?=EoF4^qW~6}#~M+Y z_KS5(l&~=}JvI?K{F+l>V09het&5*$AUcMcYYqBse6N6A5b)7%M7mjNe~&Ml|7mM- zQ2G720%p79UrY@rhukJ>ZqiRY(D>*AJn3TC`)mN;Q?YvG>h$Z7#`$tJBCo zJ0l>X)Kg(gTokv{eb~%u-LZcVys~bAJ}n`)$LRTZ2-vtNj+K{Yv6U412l`7*^sR59 z84HP?9m~u7 z((iihl3iZ9n@z8;WxVh1YTJ7|yPFZafeFgmPFn?e##z7YR^BtrS`zU7r!l?TU+WFE z>kPl(3KjtC0@v-@bs=m?)?`fp2Fv!b02bL#RtLq>n;b1H6)P7ZbZ(9Z`j8-aMctgJ zM)Q+MK~_%*JRMadod6b3p{t^QMF6XTjjBdhQvgfd=R};`09eem=wNLTywdxWf#tHH zY{^tWUBN5M!m>i{&gRN$RoN&+0va(YAzd&Akg#Iz60JxZQ<+z;`-mFKx=XV4r21hV zCYyD~v&Nd%^**OygJ>?#?^z#LeIScl`U!H{re?-Gj5vJ`+R3Ln11kOeAsW;C=yf zo7{*HhcG%af${Mv%P3LT)Or()wPcR7B#fkhuF#4_pK1Sg2PQTYBd4EWSkk$mMkegPj^HLtP{v9 z6-&zcB5T5I{yDY?0M1NLBb7=b7Nc-`*|-~S3R92(RHI%Ob{l^qW9`f{&cK2F`;bm0 zQLk5V;=~En>I#KWSYH>$*9%|pB3yIzGX?0%WHTNB%d%qK8Q7YZcK+X)RpqWwJKy{N zQuiKQmR;AG*sk;{=dMoGxzUYACp3UYAix|!Dp8t|WXl>+Oj@#*J#qA@a7rQ*^3R&+UkP|6dmpE_c-PW$8jPxw$c$YEuoRqO z_7xb#x(DmU0$+f*y2!qXxhK^%y)y~mBKxhm;fa_$*kl4=>AW{LKn0+zp3(*)N{?Mg z`d`<6y+mRc`S3zRn;boAd$-_Qew^_|j>i5CwK}=1&Rt&W#qNx*?ahr|_GPSXC3c+` zyM=|}H9Db>4ZL9hs~L+ooET~x2J;{eVEI9uzCh#|tRMcxQC7Y44lRL|94sQX09SW( zGWf83w1=wWC5~8V{}5TQ=Uo6=i`4VxiaS&$yc8NOqD_C_O#k}CrEhfMO&m-_n?( zQr$4|AYA1DV6`o-vEaQ3!6)kpun26V&P!D(TksEn;_TytDQ+qNRB+g?GfSoOLWLPt z09hjcT3Tr0Pc{h<^u#Qe#r@0PYxt45&kb-y%d!6gU7;BB4$Q6tU93ZeF$6$ny`z=2 zm%uXWyi{S}N;Io{o#Puhz^(S^oN!@vSFk_6!D4F%vzTAtgUCsyqZZ_ zN*{Z}HvY6~WOh>CLXlIV<_nurg6u?!Chw}6)zo3GsSLL80Xx{FH&)>u3-8TzprzRv zVS4F@k)o|2>3=TO%yjtV`ARt9~*TmpavT`Un=1poxY zSv53d3NmA4xd!d4RR*w@0|1N1vNAJR$XyS^=29Ud?s6mTBJ$aBYuy{l7KU4NxCG2{ z>8WjOY%O+KFk$)<04&kLLOr091;f`^Qeb_sajz~5W|y$(AG+w7&XfUKj>#1h9kvkS zF47>3c-0C~h70QmF+e1t!(p)FU;}0hGh`sj&6}n_YysR7@B;lPx9}Ws5Qm#myVDS1 zmY9Ym=k(F$SU*{hNLCD;FbaUb+9XPn3MuvuIW@egty1Qxjj&Z)_U#nH< z-s4B;$dMD&*FQpCT>}jMEG^B^$hlTW|q3TdZ-m5>g>+fL0#QF)YU2C>HvBnuFecY=(}}yv#T9ItBz8M zpOJ&5u%Lv|fC!;=s#MB6_dDQcBakTrSa5U1SOjnd02!78gPzJ1T*FwbuQJeu@grMC3uSNZwA{(c(UG{yiG)|BO?C2nJ+ z0oK)?J$q>X-d%L?zV^ys4>I*8gtlbWAdZ+xd1H`LmWFyUz(2 z5^*8a^_!VTE`pzcSpquM8CVt#taWBz0mwoGUi_}qpowLd1YU~@Adp?uV9%4krOdn* z>E6ieI_o)!NIBME`&(QI)jduDAZ}&n1}ST}5Gpm|pt=MKQwuCGUk?0@{Tu6rxi6ae zX}Xlm1a>Z&s+Fp;1iY`?n&ToI2EhV!U$!#IRw7J09(yuGgvkX>JriAbZv6^iak<5f zQ`lJ=-B9-{4&K5SH?6E22FU}o6Ji6KMr{KIR&xef>TVUns%&6HpGp8&?rY0CdAHkm zvAW%TGpKjSKhHgsS)N5KbDfO#N-NQ7e>+w7cGCQ(hN!l=oxu|@vD#->6C%=0op;ij zA~Mo$x2?ju=wVNfYOb8N%NXj9aZn;!U!}xBId8}#iU3HZFu~x47|~fVBM|8#|F!%%!)c?eLHTWQQ7a_9LqHl*uq8Hw z{C~C*yGa66T1PPf+ynGMbjQdIi}hK!W$C8Ty3XyyX|$sa;KwFFiK|=e49$Il{9y*&m?N>@S|KI>ASRp`6;Hg>p1F#Q_N542Mk02pm2F!)_N zSwdkdNzj1%QJGKa9j5Jxw!vj6*RjdDX6=M>y1C=a2it__5XN0_qn4Em`Y8m+-E)50 z@_bC6A4)5SN!ep#tcCjo{m0|O**O`m!$HB~*u+{%<|m&}F_)_A)MjlK>54SdE3aLf z*uydblk|>DPq~Twnivkzah{P!!K{Ps&M1M7-BgG_yU>lYPqdW5eTcRRIUmL1B2iAI>O+L$OAKJJmjt{5yNX>Y0;6A|5@LBXFiwQ&MGLEg0Xb-5!PrH6*oju6&na_683MfT z8i0jcV$BOT%_3zbARf|iQMB}Lb4_%jx~zIDy(9h5${JN*&vdkRFbIb-@S&z!RbkyV z1`_x?J4it=1u3cP1illuE`V4Xg;1jt@?k`oUa}>w3pmCgh}Rhtumi4H!pve9P26CE zu?7Kuh;^$Qp>w6wD~JF80$4J0IpUUTJ)w<$@$;Y2-~Yq+XliHPQGahIhie}m?4yCf&D7I7OkLeWtj$zjnWtMfFVkAR!hq7u>;mgp{o>gd z=+|$*L#ykpv{I?kthyFfsuk*D(eyrAmAGNi2un;Rovh{Y{#O})|f)Qr2Loso18GRBR$ zM=}Vc&0s*cT>OV+^W`$IBXL%?G=jZd+R}~)!QQXzFTcS`hCV<*OS}iwzJAEt%{s6p^AAl*9 zx&|(BdtaRcnSeK7pbv@-fE)WI2QAUD&TfQ!X(H=0?`7&n$8PEzQBU?N>=~HzSdUqg zl0htUqgR$JpLGPlQdv89(IH?UMC7s02!I9FG=RAJTDXs*rDR^jG{=SXun^KWgW3XN7D zHCmZ^9$hTcYaKmeM4yS5&o2@MS}=X_F8pFfJsY253g^JaRP1R?xcJRUysuL|1#@!E zKjtLsS*VISrqb#VDT>=0ijAA58qcOc<}kkfJneAiv;d+wU8Pba7i*)<#mYm1&G~;Vlib0WzTm_XaQcSfn;uwpw zdr~~E3y(oJQL+o-Yw26uJsn%VV-CTo#fYp0@f$?9C1}F2OOSAEq$M8NGYU6?Z9_qx z0W~_AOn9T4e=+Riv^6Q*K^s-q6J(3^wLDe468_2H9cxlfD{a2y zuk6wOPG9Hqz~Q7-k!+=Kuaf68@`=2fa+Oxd6p^$axO+6!g)rhus2W&OBF`?te~Vj! zzu{C8l-_t6h@}w;0kjY?1Bas#n)_WljA+qCT4y&3iP8j@2^`EJX8+t`( zW4LhPfDTtJFkOsEfWr#h03|Dp7^Q~0xFohQdj>9K@B-u8Yrb_4nPUQuF#u47ptu59 zdZR8bW37&X#mp^Ew_OfPCDB>(kstNY#M4vSDdIZP)C$mO1-i4}htti^MjinS>OAwz z)AYCh?K^OerTQ8I5iB!^w`<2PI(+C5-GAaZjSTfuXQ_>r=4WVOsY=~FL)6_nM1B1O z>^^wq>IEvVEb(}rnwp_&*KW}FfA9po^vY}0+0%nqT(r2n%pfKDYIJmz#>TeL+Uh#h z@l!|8gBAvPy8C*lzkk3B`m_6|uqF9`i?IQ{sg_pi?&)QBJTSBX9PyZCc3z3K<-qpB zJBSV_&#W>qhW~~eAedYz55_FUA+u9fSCt)Dr^Tg30kO)Wn+3sjj$W#IS2A}24y*}) z#adn!X7ymb!28g#!n%Mb8I%JMyS`3cB}7N;rp{6)b##;%$OS;Xb!>!2M+RwdppVBk z%DipcR@$|DAMM(;kG7BRrje0N%ytXiLJho#>>xIw-DN^>G7M}IvwiQ($ZJCTswe}? zt)uuuh1hwm($&m>Fat#t_%|TH>J{4d*#K4)2(x!X&v$2U=z8GyBk#^nnk0+GBe2mCb~PAu2K+%);1^uwhds5Tuvwp zh=Cmju|)SuT;^-SJjUPERR*xw9i0WlvA&9{Js6kJy~CWe3myohGg!<3mbapW0jzts zy7yr{W?d|}6M|vHY%K};;Vy7ogkD*j4ZJn>6-Ng~894f{xD^8NlAL|G8F4wpk1((t zretfry1$3usB^v7x;QqN+Q%|#HIigth}lJoFtBjBWMfazQeKz9zygS`jA;Qq*BQX# zD9K=^stX}Au$V2bdlbri#{jH?2i%A;87x2%o6$X#cQ_2q+M)*Voms-tQ?Up#X8g(k zjvqeaW^o~VHk(`$Vd80*@$n&*=9ZLK#I!QyKA-q9`E(Oa zQn>BRz;E(}#*fDe8@6X+ie*$xMzJqpv`xcrvu}fR4J}^Yl(82FMWV&c?v=*lve+8a zxbO|0NF7_T((!+$YyU-3Pgz77dRw^!QrfD>T-Vnkgj8GV!onqP9n<@!VRM9gLmJZU z@@`^A8X%Q7C?e~V{zro>QrGlYo5p5JFr(7PO$4NkSd_6w&jl{6)1rAK_uvp#^4~Vr zwTji;{imdneh(hrgj>0a?%!d4$#+uChKy+$zMc3xl910ctCSHKEAmkC-EerF%mA>m z>ZB-3Q09dPaTB+1% z1>hBocLlG^;5BfHZ@$$f&L3XH)xwNgV+^FVh5$*P#pI$IsX@)gcK~7mzye7VMlGTc z0=(+&DshxWFqcdn#EH498;gN!X3R_bsZhE_^kYh^m_6>$WA6uSGQPpC;Q&x)P(VV7 zw=wfZ1h>Vl69+9sj01SU>9)Wa7j_kZ3UhfBmlkpLf}zj)NBG`cDgo>n(@gz@-S$Tf`~fL-@=7OMWL^uo|xq&Fz}X+s!pR z!?_j(ooykMQq`(uT3%kHA3ymc`u2DJhBj~6L<2+pG(9^_i1)Q?=Po*aAj?o`m?d{B51NgbVjxh(f!V0?x&d$!V78nlBJWiN- zRTHu5&Mq1n9--l(VFs{T*6Y;WRbr+I=CPf_0VLjg;(pqC_5%N^3y zIZ4b&jT~c|J!US+vKwc)d)9b!BQg4PVw}e}^E~@N_k&EYq44{_&=&J2xqr(X(b=hh zmN)G@xMmCu4m-l349&vycA8}7WFT*sY zolq3htK+TXV5G_-k#tl6GiFJl+F z*=#C(Ff29y?f)n8u5Y)nEYf+ICQGo&L|X$4tP%S3eL)mLEl-qfAd`xL2zN`W)PC(h zaV;~dzv@USFvNzh#IRrkSR(m}z7h;))4v&cgVTrxSxmTfj9^HMMM9;0!OWgEe>K&t=s1HDE3r z$2<-Us4~qij`SqJAG7d)47w5T*9X}RgGEZaFL&KZPRjaEfN<=2?4cX?cmJr=Y(z%fJ)>Gq|u0j||i1Et_e_ z&T-BgqR1FG7?TsXCTM1MhQTY0VF9pYelVDdXl#`lAIQ=3DBswoQR?pptE+?E4a+Ob zG&MCzQ&Usy%7}6^qj0rG)pA*wd@U`^rWzd?)j$Jvo?om_SBLhN{P*E|4$*!0-A_l3 z9H+bPI!Jwe0}Nmp(*(m!e$dy!g35z6u~8;*tft3e^o5Yw;$i@3SC z*Fm@);MKxPh31#b{5Kd_3}B(03}CehTWeJ!7eX%*^Tk}u4V{g59oI{3LmN9-f3XhR z9)`;qX3VmSp|G*=tX)c3J0cn2Q~;|`e$T=ZF?Wmj8@k%^zODPBL?V=Z+}hrcDGwI% z9<3Ua5^2}O-ED_9U|H|q9cbr4G2T6N?AREUASY4HG6A()INC0|5c1^^eiL;tfF&-N z+%CwcIR;jvnHrnSSvThm7nF>A_*yG!Bxjv%8fLMf2eQ}^;pQ78tksBkz+~hbH~sU9 z_o3A}iXue@b;ILEN?r4txWHJ-NTA4@NuhiHR?3#Qq0tb3DVf6^Nj6+tnrxAc&6Q~T z+AUVWy2J-(kH_PhwcDO#YM=OSO_&BmNG0;414Dk{CP6Uq5W7an>G z_LOhPl;%lmvB+mB)lO@P=piRfugGlB>?oWK4Mer!;-e=%jtjSo?8|DE#g@U$L}Hzz zMoMC6+Xr`g5f5C=B1P1E%y3LAegvors=?bWTQngtFl$UFD^#G@=aL$ zuFo1Zud7$=COG^&y6{E^grpyqDPUU{8E7p;_a7XgPo3~l2y^#*1Gm)RXOmXV5sRv4 zx1I(9!N4BGSq2Xk8-*vLLL66lXvya2+(m+!$CaBCEHja>E+9 znFP1bzGF;SMO#;0q0W32^c<15smmI5D2WOsZio!St-}pU!+k5mNp6~j*=EDuYhU@W<`y;`X`+AzNO9CaK5U>pRewtj zbaPn*i-o~MxDskKKyh*O8dfg4p=xy5jkgUsq>sL0;dTIIc$W_|B96-=lj|YT7VW=n ze4xzis;J-vKYHQ^^zHBbHI47sM&sjKY0K8lv}trR4fGFFcUP}~x$Ujg(b38b ztht3nnq63=8#gEDo%cVWi&wzBnxpxpWm;Y?^BihxX{X-aKGw1t9vz|X-d<|OT*w`2!3^8sdCnjlXdWuichYMm0)`=F@ z<{IelqfMj341$A+wYV@(^Yim8_`bZd!s8hS(rTqb%ZrP&u(;@=En);=UI74uc>d7P z0Ik>Sw7j%H1O2@WbbaFEpQ48zdW6QuchJD#AcI~!W|5yLV#!wIqleMNd93(87w#ZhYZonc6KL#8T)A{ciO#_%ieCkH*q9TelZ0x4EQA z^`(Bs1meFH@DlJ!Gz%f%j)=PpD`f_-0AzuMRjCsPVpwl!qxDt^kN^OS8OnO`W0xk} zcNSD6V9IgrbX~S}6>L~$ES5AfA^w}!C3TrocW>L3tXG+#X*yi>b-*F|XC1!G7U4M@0b4C^i=Jy7OJxhQ zG=ea%0AR5`CIeWwfI~1E*fH{53V>Dg;FdFO-CEMfjEtv|ceo5`GtqRL%_Y6$vAp>| zBi6sZW)?xXHe{3_ND_l3>p<0P`I~({THjdt(;6cIJVp)m)b?XbDY|oHMrsy|fZ zWq*5fBPe7fle8R@rEY2j6)k9zT9wR3G~83Cx%)7ybAx40b{RElA{`%Vmx5(?n^>^& zB}i7GJ=IhLrac@5TW@QaroNn!B3sqBUHAkb(rk*UAZA2|BW;gM$1zh|*LP^j*U|Zq zxjLq_Q|JnmU1wYDErFatSl|E?HBtOgnx_MQnLodixu*bFiMmEV5CCg)!ERQG0>{D< zqfmY^RI-~Mgrd!53~p@7+G0c2395=a8jI6fSa6HlWUOrHWjS$kbr&=S zR-iTIe1yy{&}YK7b)XyTUj?pmraj87BbJ0{HlZHt47_!9N+d#vxkJ|rV%BExg3V$8 zmfbpw4wY$XsoNsl=mO@Kv9e@7dqxTi<7$Xq?Up{3A!+(J0u&(nAiG~ML!w2)lGmNq2)8E-;@i!*ju&o6 zVY`V?E)Gv6VTExYcwHJ08lw5dC3@wx*XZ2&3p6n?!KDV6bLrA0x_0e4RaT%wg%C8y zrT_pS07*naR4CD4$^k^`pdCAR(cK63(`P>YNqXeL2k7F(^Zfpqv*#Gdx}xCKsSi%k zY6a1MgWwA7?X-F8W;%B7F*8?l ztWt@3`Ua?{ub)|E(9}X3_4f9#D`RgDw5>X51sYh3i_8M6R4NRLB8_ULOp6N(G&?uP zLhvR456}y96o3^#J&X;2cVKiuE9{|%AEAdIdW0T+_Mwi|BX;fV2 zhG~1XcPr$}1YU>5Ro5aCcCwp404)KtBoc1`!s&Kk02VHtz?!y*hz`JV0ZA-!qUcx} z^9t?97a#88Ng6f*VCi0Ddy2P{v?F+r@mh_3Lh9!{fjxj|+G)}qp3W%l?+Q>U1I@Fq zT37?C6htR%Iq#vNxYv@H2x^7bKU2S)+J}XG+nLuAWth#@_^H9HreI(X`5C=vuP`RVFR!IbH5Uq zGmb^lcoj}rx>KuCl;xM*JNixRfdqh+yI&PtxpF`(-y)ip6O}dNO;(Y-1v}EJoJ^?6 zQEVhUaBze^d1A8@u}yOwG#9&2=oZ=8ttP({+FQ!JF(FuCH3{V&UqF*?oCbu$|6GHU2|bn;6~g8)fJEd zEK4^KRafzOPTRtVTjV8xU;%I^BI+duvY4@=Lhb;f3~*x>SEL*ar3G%JtpcV602bO@ z%DF1;U>qG$A|8rch6>jM&{Pq5qzXn6+8$BsP%akIkGo~*KFMj=(AEhM&c>|ufyZlx z&F`IiqH`uH?3_NIyzL-|UNhHGpIf)C(dkp~(=$&$Nk9Dl_vrYsd+5Zm!z|jqeaCKE zDc9+}56;lfe*Oz)K_Rjp-0EhabG5k4fX?D_nGdY(r7mi1N87Y9vkLBX+qZ3FjVXXP zU>}uNRv4(-v114A+q;+c@7qgTHjmNB&=B|A`HPq7$)}&Dn-f#i)7wjniwiV8Jxy=D z{T7}6;1o0I&}nf0Lu;WQj~zQsAOGlM^!VeSr;k1MC{5hDLD#O|po^C-(OYl7O)tFo zBAq&QhAv;aY~nnA*&?EW;X&GeU>`mD(Z}eEkAI#vjgC-HR~G|V7cN|)r=R&Lz53eg zbp6^5*3U9V#ae4Cb%9|vG(_XOcF`!byIKLzbx?12H#4z@2K#Awae)CWb}>_}HPi!O zR;65~a=FZIl3<6;&d$-w@*=Yjd%C-5a6lq4V*D-4FYx!9H*ckb2M^KLzWQ}~^wCFo zez1;QeN_P0_BL@%c0g|6Qm8D_#=BjywK@5ejP!;kRO-G{pj4sB<=n4z-ZU~nE&0HP zjIzem4V{4kU3;Bj=9v|?K1NEbWsxl=)VcD(F+4-dSW{7p!qO9MH{Dfb6LXg@0)*>I z;XVhzkC()8T?eRJO;*~7?WMYwSv})%!S98sJdwE4RHY-+cl3Ar|RF3dam4CpB*_p1f8Xo^* zb0gKOG}82q%AD3u-t?3mEjb|@l~YNn0Yqm;ateHv060O%zE#A;;4A=Y7oMeQ4~Dx# z3eXfU&qkWol63}3Fl8I2m+s=1UFD1f%}B{Z!8t3kCCi;!r@={dT$V?jLt}< zLZ)AM@`#)t8+KL)SG10%CK8y7{s!y$ePU>B;lb(h1>0!usykaky~DguE+K~vrg2gcY^Iw zX=C^p00R~oBBjBYhhfh*)oSb`vLZxqQP&o87j(=pVP63xLWVdvvl}HCCw$XuVY`*J zq)pC3?Rq;O>V5HHUk_S(uPldn4V})cuJ(3LMGg`;Jg%`2Hkdce*fJ4r)yXm)B6j^_ z_d$PCFNZOS;{`ecTwNd}??j8yyvh=@gNJh=RJTYGj~7=#c^1Okav%YK)!o^tks$Tp zXxcHs5OjO;>BM;DEe;>89bh7Y87cbCz@4w5x0U+Tt3SBLXLjaS|kvekt2z~UUkI|RD_&9z1V;`mI znJISngWDc}uP1-}V|w?U_vq54tL&Bp@Qb5l^5J!j`uclmeCIfQ^b;SY-}&v|qS4_& zo-@$Wx-~IHPe1dI^x`jHrZZ>G(c;{EfY~FoVK;U4_tUPudujXj?F`m+GxMsQ8CU~g ztj*4_`=9|>9FzdU))<=_6%kr(aEqLso28}2d2Tm$0Y;#LmNp*CRj^yiRj$M6$R_&T z-~AW#iBEi-4%~GY_4oBMsLmE*5Rub>4I67RLS%G>)@8#*xakLS-1;>0!WXD%c?STP zn=6?cYFKNfsPRV@=tI_N+aIEUj;`Uhoa#~15^O9 zSOW_HR&AA5z`BClU~Nq!6jrGWS3+fH@mjCiTCyK_0-0kysqKTk!dix1lUp%|^)d!P zZzq_svd0NiR-+QKYhnwp{j7h*z!dRsi4-h9NZuk1@-xb;_Rnaq zG_Uz0DJC9F_DROl6I-#fz_|SKXRTR@JYiJHzzrCjmbUy(FQW}`AKKrRp(&w+s zZcfh7^_#co(v>UBYN{%`uDz{;1^IjX`e|fz6K&bLo%SC%NQVyH&EQpUcNe|)-aB;h z;zb5((0FVyJu`Oft=wlzD-}>#}WHEM#toQVEQ?0f}zxvgy^zzHE(yOn$ zMpF}$u1C4U5z(`&o3`)TNxOFMqJ8`Kab!d2^{_TiM>|bT-lD0=Db5ovt!RfhJA=X6 zQU|vI^sd0dDwm=8RiP?`;;S|4EOk7$>Aq}iD*>_OhgsF!U+Pw_K$k>K1UpMK zE-hlBfLwYxV(#L4amFKyFH*dFKl;pz!3$7k|Kj>y+(&9t3D{|UX112}rvx4W0~MNk z3ShOjaOAX z(dK&I9FHGE{JtLhCQKx-vvQZWNc$8J-iRk=bB@y~S_>gmX8%j+Ag0_lIH=^EBAQ?0 zgEyKK0gvTnr7luDe|(N6lDKhirapzvcTtln3ACgo60MP#UH-GIx-?UCem2D;RL^Pg zMoI^ZJxVsZ3NpaG%(VOm$ugAwqtX7$sx13 zj>!Zkn@p#1g_BR*eij)iB!)n^ayH5}zH>C!p3OZSl%-LznoBs?LpStd=1b9aK?@!I zm6Ks|0_0l`;rh^gJrZL(1Go=ugZN4u&ox|5Y(=xBE55R4mH2^!!}Q7f)P*q70MUUE zVPb{PW=vc=6u{U84Ic)dh3Yl|ab{p~2=E$59TWWw9Ddb3#2s29+j)XT6W+=T)5zbr zhhUHU+iv02w+%HFfGS+J^hmFIO~%j?FA9zYCGG_4n zLwf+L9gHLe`9urLqGG9mZ2%mvsU}Dp-R}WnfX!t8@GZN8bd;E7#Rfm$^4B%WqA;8+ zggY~4EQC1st?bZzNL1H9%aOIOAe4Zk)RRclBpZJ{Eo1;LhqmS(A?QJZJd&lvp}kW z0EL<>S1!<-zkY?TU%f;Vw{FtDefwCq>g~7QqVt!o&`PC7GxG~HF*!vyZ%xpRTQ{k# zy+g#$!Jrx+r@edj(vF=wY3tT)v}tUNMn{G@+TYaVBwfFLm2Tadpk=raF0ata$_l$8 z!W|BWF@S+z{_WqQPk#Ip)YsR??nRT+Gj!?dH9CLcJpJS+Kcyc&@dRs52_q5_DFuv# zp4H0oGHuQ#E~xfkf%xeIjb<`ipY0SIDEG>H4x z>(td%qOr}J=-}N4=){S8X>oapCMPFpbkip4>F%LxS8vdT^B3v;_ui+unb{}<3z08N zowNyBUVC=Yv3rlx*yha)@Up;kM;l!@f0oXlyFk;E(+p670oD$Ew~h|#>glH5-d_Fz zbBo9G+A7tmWm;KTr1`ly7I}y3BHEy{vx|W@xHDtkKm+S@pZy%2eBdMv7M{6d`!UwzsiTRT|&& z#QJ1wbSgmQ-VMOz;DW+qOzGzxIp&%!pRA?gnr4w_Lv1KaL){1YKa*C1U7*Of!5Wle zi^u))y(zSR<4rXXR`3s&8iYI4!Ww`31l~EQV3$zv6{RIUwhkshOn1^2Jk?gM)lp z^oZ#W7-m_eH9&6h(--8hT_Y_UVZxa~8qYMN^m;PNZ_Si`%(Lq(tK6M8*(iBsh)(r9 zbSO;4*V(@jTj;G<-3DZR9UDQi8y1)cO$?MoY6a7ezqi5Hk}9Res+aYYM4<@^6B!55 zw>COIqp37s@#1gfJXs)-a1D^h<1eL;)7$F-d0X<1@dgT%xw*XWc!II6_3696vbLB) z_-XXztUWDl{V&`u!7?f7N7tYDCgQ$zhmc}z8op;`D>9!RxLZWr?LZOTr<03HV!6vX zESW*f02ai<0rGIDZn&^Pe+jA^#DEo85M=;ZEJnL3E`+L^;p^d}2}KbsI|!&jt*#4v zaT20JwC5OI4BsvklCT6PukP;wE z+R${doa-iw{38lqI|BpwEr45{-8_&#-T{CheJA~ldZ?F=8xH6@v909xLk z<`{Kq2tGo(*yV4PY3SWPg}Qa;Tn|7%ke&zWxpRgMaz^tcf)|I?Ap^XU?6a7himd{^18dpzr_v z52(GnL|xt8G9Ojczh0}crWSOfHg6iG(V+nv9_Zsa+}cs%vI7i*{?*jf46Q6xHF{u& zMBikswp9itH*Ff>pV6^Rbm_`fI&fv#P>#(>;?_ufaJ{mf_S%U}L7 z4fgl*JTs82746m9!t;s&Z9RB1BT@dYtUngO!5i9(^c_{0c#@H3AG2G$rI*$gSgXv%+d!sO5;j#0dRQ#fF4|Yi3R=xCS7?5v!a&x7 zV`i<14wgpj<(Ron2U1zgszJr`(=-~j4P`wQcW%rtXkXzXh69vzf?WyMIk}+0_sY4` z03f)$5T-CQ=(M$1=Zdwl5RgSct19%m_y=`DgyA{^T()Om+B?Rr?mH3%SNEWRQ57@mi)oxO7#;7$TRdTr6)cTC zmX}kwn(*HRLE*f$!8$d)pR#)|t(*a!ocJuc}}7#3W&u< zKYnmyZ2*==)Z^mfkSj6Z#a#op-K>EnE(;dD5EcNQx3Oe5$`S!l1@JXuqOqhz8%v@a zav!iLe4BHrLSE7~%8p{eU<0sxof+`cA32C58N6aPT8A)!j1k6cGGz(L`XC2h`KRS`zkLKx15nxh#5u^R zgP*li2r0WUmAATQuVe;Y;caN7RVxd$yf{NwFQ2D#7cS9T?|eY-pE^f#3rn=Hv`EY4 z6$VeHrl+Z+y+nO|{j`7oU3Ay}eYAc1R@%8^2Me+97~e)?BO^3%^Co@p0raL2HSij@ z0T@K@zV|*|zkY*RjLRz!EnnfW(^cxEKl;P}j=uQ$#~Fx%+h29HMi(w#pf`T~CjH{s z=jrD^dzMA_I??L7MB;^8acvbYcSI|dRo23qa{%0&zyD+c1mJ*94fuo{!JD%*?(L1{U{65E0n+4Cw^f9gVSOz?E#R zfu~nsN16^;>WSW56`6qrrm*bkuvgf1u+&a{-JLYp)5!o1h#m3pjOX<^(E@+c9PR$*NgaYrE$o?Hu+~vN!=GU^ci_Tz@+YAhH)m_6WVnOs{OR zwDC`(Ian>CwHE+u%;`czhg@_dh1iZUn5=9egNxmec=(ESV(xMhej0!cT*j0|q$6Fl zG3qP|jzc!zM7x`M8EtkuEWlaFXN&4um==~4A-Ek60T~BinP!w|F7ezmR++oV1?vev za?oL+Xmxd9{U$Yf+2DuU0gJqf3j)8xAef4)BMY!SG;IN|jDaO-8-Qi2fM<)Tz^sa( zi`I{T1))0%>R?(xj%i>A7!^G>z)PZj8H<7BP{S;UP=7|jJ_WGkz$Y3&>~4mGKf8X` zslrUUvWk!cXn>ZJuwuZ(5?2oCJ994-A?7t*6T=>H)UEdB>e@ zt=+f{48StC!!%EgaH6|Omom>%-gUyk3QmIM1CXRzS*Ew&euG~6)hilyIFtYYAOJ~3 zK~(g{n{U$xXU=j?hy~5z z_H+8&c{+9GEPZh549(2UQ>|R577jwtrgCp`P{zE0?$y?9a0A@Sr^9L;3`?R~rA9Ze zU1#?{xGO@3%dIB{;kLEW(C`TBXzkd&lY0C67=&ea-R>@)FIY2Pf9(xAcjg=es7(22 zA?ob!XTa;g!2@*HUHf^S;qX1s--{zQ&Cbry?A#p9&d+l{lvm0$KR?GzFw6nyV=XN$ z)2+1!L*)M~0G3qf=RhS0Qo_t)VP65v!fyt#a0%t=C~LcJ zaZZa1Wd}&bjH?><32`BW?qwwaux#cC151F#P?$Y>u_+fa0)k5Cg!{gGRu2{oTp7q3 z>qoXHG_ST6*_*Ma<1(tJ)JDCXU|)68U~dX3t8tc67H@#YTils8DkRucMKT|@fskj8C+pSd_@*N$HP?-|X?~5<@{Hyc zIbg(GYa(k;UPigaPkz~GO9|gdJ)XFN;Yq7w^pN3;n^!nZD6Q*Kle35-#m8Cnu#-aj8wbtd$>?RtqiAS?a8~r>z!A9#}Xqe}&GI33s zhGRKtB<5E+t6lv}&MHFYbV+2`JPS85#@!8VPJ8Q1$#=8X&g8nsut1PNd<~Q4kCwp$ zSn=qe$+lHEN>d2LitYAW``2`ITv1>Uf^Eb%yRCd{>kjc7H?O}+s|TiLxVxv!Xo4bVA)U>R+MOAF%t_~ zU&=B=6eAzCNmw~@6D)V*7@JP}O5ObAbA3(+uer9ERuljpya#a1y3+teV=XcJ3Yta% z`^bY;fkv1fz6{V3?IP2jiqeyWIOSOj4rEmD5#SYELIlu4guFTp{`#-{>tel}$3v!=`-8&5X< zZ2Q%EvAYvf8rEoLW{R#{y+kj*@I3wGAAd#*OUtylvcm3!0Qr`emuX~Vg!PrSY~Dh{ z!y~L!)!*B#0M-Dz4vvj(qT!(-x_0FXz4_*wG&?)X;Mdu6XX(Pli>#kDzqrT%u&^lv zaD-dbp#ukK=lHlVs_NpNyR@=G3kypedGN~RtExS>O6{E`YVBy3fr)WYTjhBRotMvl z=2P_9&wPRo-*Y#$wRh5!Pd!D?z3@wV^Ub$uZg!E@p#QJ#K5j1u7@=&6ZQHlfT?Y=( zp~Lsk!9$1W^qJFi=F}N_@16JP#?|XQ?}dpIwFSWHf^hrL=rE0J8lj%vUS^8{yz1%g z=15^{^>zC7>%XRRXU;R|1n>?2I{OFs9SGkay60}{?dzeQ?oOV|>j3jsR%mu%fo5iB zX{B6Yz;0oFjzO%s*;(!%%mpyxHjizl`|rP>9{tFpbkCtfw13}z>gn!f7hMK?0TFP; zlWS6uZLj%fa(CY5le?Wa!bLc;fvIh$MHS3hKyO)#lmVnsS^eBjJ^gq#R&X(4X*v|v zgx3>5o?Z?Zt4DvETQ+`Y+DvXk(EWg?n14Rq{XVp4edJvG)Xx##5X5~_^`ne^%$GW< zD+urkY%H*r0APWAHM^)F78qFNRayo>q|pF@;j;dewzZ2ss2W-9X2|P>-xvK|k7_|O zm?N545hv`YUZ@>?jj$XSP)u1B;`D3e!w_9j?5Vf54Is z+MM~z%5`ztR-P2C>z|rJyqBW21AeTHM`Z)M%Q)UIus5$$d#fimWAJvbYqUMLRp=g zR-ClYG6zS4`ZP?d&`3{j&_+$!c*r*xDbXRlq2(-ZBo-`xQ|oUezak~h>LA%z{Xetb zQ$&Vs-Z$#X)QOqQzu}OHuil!k%RWpXZH+0?ERDuatdM@z+5YcmWIU+|>=dtTqVoBJ zq~H*WEYXqjxVB4QuS0Vt(QMkEsh`KT-?&+n4q!zG5=SAtS4G@|^~|@QFAn=@3@ko?JFS$^?akTA)YfW-z5rQZnc)Y~38Mg(fNpS?<2HZ@yaG{RhcHOS zN*~g~qVFUC41dSJB~8|nVn9gB=OQwxevC1&3^3wmaV!OML6Vk48-o$V;2{LsO@v+B zPWnj?0P1!rhZH&d;2#bu3|he*1Oo3>M3$_Ixq><{pe8r!4EhDXO^b$wbK6A&i`zpr z(ojAwDZ3T=Jf(TUU0M1^9~BoAZ8KwF+2{}3#h#C!Da_p|zP6-|TT5>pb+1$y1UY;D z9R2#OH|dpEU!h;U{4%@ht+%vLStBnF4Gz&=`}foR_uof-y?xRb%%-dJ*y-)*qAg=% zw0+xl+PPyVEzU2}<;$07Vse6R+`K_Az4Q{j_3pd0i0FDNWd^5s=(o1=p^)mUG&VX) zn}&y}ueXQuU#V7Txm=<0N`>ZT=4obnmX;Ql+3mBftCQL~I^<-f02Y1&5PJOcpQ0~4 z{(1WJr#?=DLnHL<@BS_Q_^D^;az5nh9bmh_&W@DL#QmL<>hDV3#=+VP;!RmvU`}!JHt7TePSfJ^dIhvfA zrIuDiNNuN;6&1S#PD`un3FSHAEy>K(qZAd{hLI;>gbWvd)0sOOFB^psKtcu&u zj3H})Sl~@8AiKJ6>fT{%P{``xHQhxYG@o>H+V+69tvfa@?Y~2l#{*ba^Wbd5ADLdC z-!;W8T!UoTC4y;TF_?ulRfA&iZvn92a<@{g)7(-;7+B20s?q|4+-uOx5(1(yxWuKN zwGYwGx(A@$0bpURwupf~3ZmDKGM89fg0%Amlv3t^nuFth-?wziA=U|{S7e|sCp`aF;}(6*O1JqtH#!|Fwx z*(m_fTGsiJ4dU&+0I<4B>^=wptGBzvj4XUt>S&=(FwhQs{ae2HN)M0D!IW7Px7G?z z+LW|Dq;(-tq)6Q)Q>#YSI+3}yG%RzYm8WroMe~mRmrFh)pF6#FM~Zv68PmU4dO@&`eXb!5R#SakA10_0jxGPhikS=GvH?)VG0(=Vno z)@YFWJi^@k0Z!^2sZ-Hn#S_d&N{bJd=#C#blBOoo48WO~gLkq|8m~v0kZI92PtC&W zV3L%L#)Ku3=s^9ViNeI^W@x;pxwxcd?dqiYHd-!xb&Ip!c)(}WtKmLWq+bK$B(-^c zrTn(jV4XBqp|E|L=$hQ7PM=8mS874O$e;d$z|Ido4MEIM7tx;>!fwf0SEC?S*jdsT z_a7LhPu@G`OQZ=&cZbgh<&9W?cIXV&dNrJ7Q;@L(@XA0exB8~$CFL>(mQ4d=W;mmk zpYrYlOg=LgKzBG14G;#fl-VUrBS~Ej+6Ho{i-B`ZQ-Dehayu9~trTq^0g!M&S(E5! z_yK^WVYpeiTyK<_fu$@ga}yNdb{qhpDFSwr3fL-uC7_)!zxY`NyuiLPF?W0~dR9KF zlouop06!Hv7FL$Fjm` z?55F%1CcPv42;9yU8NG0n2puJ?ZNB>7LFHyjag;^6U@qHV4evx8+c{RFE<>6wpBl* z*z)G>^1Ri{&k&CbnJwN`b2$oTec?2>j^*;jM3 zGj!$36>SfqrNsqWtJfGHIdInjdg#H2nDMhxUZD#YF3{=Ir|2g?{VBcl^2;2>aA~D1 zQ3P4wzm40!S}xPr=rE0M+eXKa9i@>?n`mZkj&4reqU+ah(d^6|EzB)4khQqDNbTKS z>_*5_00+xTmDcNP)Uv)t4?TE-KKj^4==cBS@6qnvd+6`K_Yd^rr=I30gwxaWiv4;3 z%jU59?XZCRp1phMfB577p1$&xuh8=^JV(#|{5g8!2T#yDZ@ue-A_e;%>H-b5&0Dun zUwx6I0W)X>2n`eMFSPN@azCLWsP>#Sn7~$~{*xTt@t#BX2wSS?wb3YZ7Bi!&8^)H?NZO? zbk$NFRRg#qmQoOT&&1h=hV+k;C2WhtAEDDBxY-@Mujwbqe z=00w0;;5Y=>Bt^v#dO|ckA@o|7+7FZdjPA82K%}>5+Pg&5uFgsRP6I!#65Fjr+g6% z?DWaGfmPy;tOi*O8J~D~0FEHL@%%F`;-im!IQ8V_jU*jCwl_THHGH5^V`tSXT8>7k zM83~$s>m{{uieSEji!}-JKjW%qSpYyi?MRwPBj`Hcmu!pAfMnhSFVi>iQDM!%%=2* zqPEB7Lsjzgp4b5=ki;T zuB`?V83V_Oc87pU=x`GltL7dM6i3>~_curN(}M+{7u^gDgxOj9NSckK=J8E$0AL|S z1&5d&ghcodXMcpQ3<@lTx*YBh1mHpdEHJQ43#)^L)Rna*J!XKlJS&~MX z0@}uQFqOlJ2=L-FlmnjuJb|uLtyW{838jE;5e`oHC!n5)(VGSsyF;or7z=d6O$Ce~ zjr6uwS6356KI8+hVWV;|5tf&Lfec_VFe&*sJup2%y2Go@4`b|^6H73m{GY~Jvo`g6 zh~*EaQn|cBmo8qQXP??m$}7t> zH91K)Z{A=aX>oC$CMPBs6usx3d+6xVV|4HF6ATVszkZ$BSJ$pyrPtqho!)x;U5;!x zzp%vMPFs5i_X8MN<>h4>=*fT_&MwgG z^c;)9w|A7NwY`n|93uRPL?}Lq>vZq2BlPe?C+T1P@gLEFg9qvRKlmX%_0-e!k3ai4 zO-;_~8s^tWb0g+S)k3ssY!mI?vzxy9)vwSu|Lhy|(yx9=&;8xcl6q8Z-_{b z?t{E)!F7?N3HERlLI6nf3-i?5*T?B>-MX1JZQ4Zdyz@4_`_8)zUR9P>sFe@TErjt> z>h7U|p+UO)o2=B%Xcvgt_D8BrM={xKR6kl=V5-?G!*arkz_?g0)=slVG>A^leQu zS6#iZw{^-25dpAt1q=Z!UK7>s!ms#uRufq&qC8~Y7ZSJhw)ezsk8mz1z#Vu_+0JYN z_A>P0h-xmD0_rf>q*_?azyjm2wnhsp0I;gcz!D+%rAnPDbz@((GKghNE@ogU!wcye z1Iq(g5(!XgzfLdAdKdexwF$4^Eu?ORU?R1PMixZgOJL9<(x>d524IPhyRfi~fyMe) zwK~_28CaUV^hs>c1t0J(YW?Hd)L-&B##WGq>&bXvoLEL^HPj8;5p*me;NIU=q5+7w z_jU^d3jh|}2O|JhqXP<$kJv*EEyk3Y*Vv{jv<_f_^#($82D@T$ha@W&HCWRt;cs^^ zpc^$#kpD*N7bM?Iljc5KIH4kS3m1p@LJ=S6dEHkuFSm>p8VlhzlU&Zy^2~v+@`@O5 z(+Gf-(hg~TkT@j9fl5io9q!$}8aWCkj#6pKMkYwZ@er?g!xyx|nK{QMMSfR?=0hT9 zT_ocpFPkJ&WSnIbuTZs9(zlP?{4bJ_zO>P%Z*q1-=SjxPO*UP6Dvc76o-~uNNJ|we zd$aAKhExK??BR$M8ugb@vp?7n#5;4ppq1Y8KiT#_0S z@m#}$hT4<<5s1eslZp2dr$wYXBo<9djrIt0iVv@nltl7MY}wwu7P&z z$^e!N^BuCaR7@N|iGo*dDGj9>bVxJ!qi&3Lqc03B5r1V@3)aFyR6+UM1l#2qVPqLl z1=mFr%LUjX->W8X9A4`4}y1uO>XP}zc2yUHEP04k|Fp6SroVbVn0 zt>4fY>~r+S^s9OX>~~3+`X+a;akOJhGS-=Y&+) zoyQakxY;7Wv5qT?TB+a!m>&$3DImDITBV7}oAmbEZ_yJ^K0&X({sx^ncaGUn&;{GN zbt~=Pzn^~Rw||Qse()sq_x8}t)Fi$4?mNP`T3e$tXHL=S)2HeB^=s7A(@nqgJHJEs z-+z*}Y}v}f>(4*`JXI0paji}>GqZI4#w~j9{ZlkOGfzD|(1*g|v6YsVm#Ml~W~6lY z&h7Mn{O|u8ef|rd<97JfD=*Qvzx`c0fBqs(P0uojwYadTLe}c02{07CNIVeM>DbXD z^x(+{=uiISk6E+pM?d-z{rJaEF$-*RVkQA#xy3*Mtg+3TY2Us*^p!vTWBSH7zD{qv z@jAWu;!E_`fBhZ$)l07ki$(!X=5e*OQ18GXi?(-kb@8|Y$Oq8sfs+r=jveFdTKN3) z&(SYm{3VrFR%pFe=g5Hg2k^AJyPNulhG^&RT{OOH7cDL?(OSJqLj(PM*oNlS<;z#; z{rBGID3JYw{dDBm5!$zZA4e<%$Tc}}i)N;$Xkl)S78VxSjT4pa>gu6~9(sfxd+ek1 z+0TBCcJ17)YnBR;1Bl>-#Iu7u%I^0^nXzeWT*~(OVSL0{rw7mSXHcn!v0$V6PsaN6 zdkoiz=Z}mZb2?`bh1Ze5ojFqV6rIAzMTK|wvK_+kE@@HIOtOaZml>gLV4#)lEv$bP zoagP?5WW&q%`Q-Ee~a>{E&p)OGC<9-zg%BS#f^RDnL+r>Tr0f`;Hs{{(6KA8uG8X5 zjTR7%klhFok+8x#SOB*WCA7ZYN_DV|t=XQv3TBbq7eBf?!#SXkmtD6WG7U`ap+N1|h9wC!8L{;wZO zDdYjsqf|}I;J%HmdsIQ0c<$V$dzm*WyqmtA1;D^E7eYi5?nMN`t`bKd?1u)H0$5!o zFwX#DHDq8pYbI(FZ^+n=8L*AgNVAB8MI?TpwMiu#pznmn>yA7e0jf4A`IUL;ny_KB z&2lYG<6`R*na$|FD0&3Q&e9>lHh^=Jyq)}tY$lD;4_h#PgtCF*E*f;8WYs;$tI>G% z>vl9Td#^~bb3oz-)4}h9@p5cv9Bj0*g@>(wFy^wJ227c)>)Sw=yrRX76f3rJ#QVjJ ziULC-Z^krkiADn=Jq3F!t?JS5GSV-UZKFY3D3OdNkTCZ4FC9*9GW~3fAfpWK)NR{F zzm*IBnt(qe& z)XM)%Yf9QuF6)%0@5HQSt~nhij#?xK3lUaFQCXcMwnFOq8ZTGyR1)0sx8|Z-rEYQx ztk^BI-1c&fHQJGYM#z!5N#?DfhOn!xR5B77$$%)d3A@D^h^4NBqHCp52UYutfhxEr zl8V~%jkX82~ z^#^T5>wK%<+tW>@&Jy3~b9i=hsewxh4nB1e>&DmuaAi7MCbZALwH)HAC}5g4Lu3cw zvEVj-dq#jhAc1b{U)HAfvCU|^vg+JyzTQs!wjzI`kGyMOm@={J7k zi!?Gi!~oWR`cMCv&YizV)3b97U@goqsA!IN+p;wQAm@=Ihw0?Wlk}CZ{0SYt=N@|M zsUOo*Pd`P^Jo6KpoS5X9!>+k*-LbJp@$x%UAuSE=FOYw=gbv|g{VNPZu)DZ07r5R-={*y?(n z4%~f!_U_+D+s3ytz*t^cqPdxAX2i`*&CuM;3@tCOPBnb&%8n{7 zaEwyv9wB>?ts$(%7jaDvY_Z_tL)KmIz9;sK`Z-1nO=Dqt5X;Z;D5xd&yX}o?f0(YH z+xmRs_E+-kqx(~6PMJLwu+k!Ki*={2{<{D(2#5MrMk!>=SCD z@UcgO;)mr?^CBnRjn~^7(rIagpM?W5{;W=T_py~YSO_AeFL;=W&jDS}V@bLH%qnf_ z!8WTpZn7tvJJCW~9+N_hzLA$fR)2+==M*GmBqT;;gCW7Gr>-&47gHD3rq`xeU9v#K z+Zo3Gx^Lt2uh5$rg}kk@7s)uVU?M}SNX8+66?5z@SpNV3AOJ~3K~y75d%Z~ircSm3 zWyzkTjT<2`7}FMroQ*UGtd_Sn+8AM;G2n%hOkWEMv{rtb_-)pe-R-wQ;!QPqB+aZg z$u5?wY3NE3H5Y=`u>CaFMnQAMdpK=qM)&S`ZKJJx@&EuVuYr{Y3K{4jx91XV%ei4W zk#m48q2`pjdabE;1_Lm{AhMfNIna2Q3E_ar$}MJdQj9lp=bd6Op?1!tOc4iW4XM#C z2D*gb#y^XMC(-HxcQme}9?2{~p?1G#UMa|=E)~dIZg0hvkijPf!32mBV9Eh33U=A& z9K}fw2Il_e-Qd8~(svcaVt`Bk=5!e_5}-;BhyVmU8!cjz>A=BZ2H=Y^0YU%^wdX!< zX;rXM7!-T}s;^NQLhTGp3F`_PPr~3@XMhTBUnmm*Ea+k}NTHx%v>g-_G>tHl_j`N0 z`8FRcEOR?D9V`Ge0L)lmxXrt*aG#osqK-LXXo)yHGw6af$iPaAgeYCCS}ZL9yjqz_ z6Ykhyq(~hxG(R^-XU?9c|L`CG1O4Qu&(N)jTU3K~QdcMK*tLre?B7p+`1^lAUwr%v z)ZN)h^K-NG`fIP!g$w6tdU}#|tyYAv{J9qv9gIXBNU=|?? zU%kFc^YhDe>hw99oSdPxHDjW62(tnr`s>8*cK_2~{005SZ+(gO?%hqVzV*wk!yD~oTzytKvul^|=J#v_y`N=c%^wUq# z(@#G`lao^n7{SXC63qC@Uo^rquaX%zzJ(qUkn&#wy!c+ui%xiUjq@K42 zU5HGmtXURwxAHSk1^{cF=OMGO`0_&lEOR0B%%7|`D=_WRa?DwL7#bWgxZPeY~M%@6hl!b-gh(g%Y*+yLq*0q_4doU92gxwq;SZ=Yf zUMMi~K9onY&F8`ZR-%1w+w@P=G#kK5=9PKAYxdxmD22}}31H=QPTl|tzjLcdfu4@1 z8B|UeXr10N$x~A-&`()7Pnc-9nk2@#eIR+|)-bJ*1&Sy+L?3ibkijU(=Q=dXG_S(R zbtAk;ZIrUrB^$uf^tA|g2EdA!xmYQ)2Wj@2Qea>gcqFHMw_Eg-u@ugu#&wRno23;f zy?w-ZiW-&$8YAVA+h~L$L%Z+=OWuN;meFmLJ7|SOu7S&~EQA^P#6I45X@WN+#;E1& zUCRU>iT;ZeF;bZ*4Z3hQWVKBi5S6)J2KS!&Uc6{-ONezq{GcVeXZ6Wruuqhm$CI+On!S#RnB;Q~+ENLl-~dz6DT3Zkt^sB)xq%@XA;Uww`udRT#4(R;9Y^6qp>Fhb}@39V{NejyuGL36 zcKNGG6v7}1oB&yJ_%TuhT0w5q>kQ6-6@;5~xP<^r!eK-N^1WN8MQ~)1d5ni({&8EQ z?cJ?9>Y}&%2;1I)!;k=B27a=(7V@l0nE|ljwqFF_^?<5cDlCkzI$@@T6sQw!z^kDC(p^z~A2e?PPT0JI{K;qYKTZ5kb-uC8{fRjPFB z#spnBcafGCSGZ04hKFg>*3ES6-eYuN{~i{>U$0kaW@?HVax>F2G&M0vQ`0jH$_@+; z(aDn!(W4)Ej6VLcPtvAMW5O6@CX#{uNs}RNZ$iX7&92^foQbHal239#h$)9AT2vQ;ep9}!^ zYq)*x&C9_3PuCy=X`=gjl$&oY8G^C~mL-Lnq-2&tTt0}GWnE+4c`0Hmm>|BjfdGBH zM`BKpGMLuZX}KZ{toh|Kv#@3t5RDLSgf%MH)*0lguC>VCsvs6h$LqHOV&UbHu$OFa zG$2wgLaeOOqbW2Gg#`r=3u5l}12!zXyTdJ9brcyCQ&t)F4(MQEP6EUdv3m6&cHW%k z-e;!)AIZ_V+1mw$4Aw~0MP7e+c~7Ul*u{efFVz(tdp84Eh$bv9f`~NOQ|h3;?oM_g z?CTL%$?i^QH3Go;#dEaz( zG69%?eW{6N);Rt}X7P*Ft2qEmmXXH){GyouZ0uCzm*kY!B+a5DLFZUz_Rba!6OD}F z=;1A%kgH+Z$*o}n6`zFZ%YN2~ciV#g(I}tTq|NEtI0)>QgfRSjvRn!9I4uut!$fJ* zPL|;aXgCxbK9JE)joPGVx8dAvy3%j1*QX|(rX&=V-Fqd#p z+F*-tCCFQUA~Q9Nb{f1C(VLRZBCY3=23S~EU$FSvl{E_D>~HL;Cl8F!r|%onQ1DrU z&yEaU&&7ZM7<(c@E?|UgegbkxG&|7=a-!YPjBqZ5UL!-I=vgEtyB0SNRMg$xZh(#5 z;dT?fjrX{OSPgcVw&+gMUJ6#AZ0c^v?-`?v4QX>)@beRWA}*2QqR60$nP8Vkwvwu)>U`WNvmWc+M;~1F=lsN)B++#&FF8@5_U?ez-fX zg1GwdVMcVU@Ego3`)BSY)hhI@JktW-qptv5$ql+4K#-P`F>)@Y1`1lA$@mc95{C}c zFmbM%fr!26R{@*?dkXqi9aIIN!Y+$-(acge76!01+9MyjTHuC=NQUj|jwzt2xfP1g zyB;V_0G~zV#Vv;4WAIA-IL&nv?aCmQxP2}z%rhACoo|1KzW>7?(CM>hXm);{Bi`-a zwSx{Fx|{Ajew6M%aWC!LvzxYU9%CTn*5ou@yLpRFpFK-&zWp{`zI>Uk-?&b-T9w@~ ztCgyV;IFOIuAMvRu}2@FZCkcbcW*bl7+$@0l}B*7vPxI4-lVHnZ_$nGH`x_VNGj^4 zyS`3aHgBds{nJ0CFa5^jEad*{H{YPY{MNVV)R{AMYif$h=tnR&R;mnO!R-^;WB>pe zEL&QlJ$v`k@uSD+FaF0rr-vSXh+cpFRR*xW``z!-l`Ge1t^R&EDq4m`@YQx9@dt_~uTCi5M3-}E*6(a4M z$HwT`v7_|hgAdR{k32+AKKTUw_(xCDDY)73QSB zBv4Uw1>I$zvN5B;i!#}GKJj;$7jPq7rzHlkG!o%*g=Q93SPKhogwVl)n_*?Gg~1`d zh~Ts&e{rQ3H*>zY;>MIq8ZLvDg$caMluI1v8QYhAkS}4dW@<1J4mhG3Sl+M^$Ow6G z;17;g3t(AUSasy97K-T;+MLj?x24#*)a%6#Pb&aetoJ1#p8>0Z<>D+e*{^jE)e9zk zCQ%jzz+yM;HjOIW+CtqWu&_F*zo(P>dOE466E2ewb8n-Tg9>1|M#`JW+}Qt=Gd(S@ zEOaK@bX3bOvA8%>nK#qM^~!pp(Qz+*Rm-niBu)Jfx2)-_#q(`kx4f0t0Icl#%Qw;Q zQ+ABJObQjT&_jg)ESFNOZ6ihW)@PK*p4RYTbv1Ek%;#=vMe39_=6%B1t!?S&jh5Im zks>wIkI|@JMVE^35NPitN~=~zJk5~t6>hT4SrS&^B7KoRQ}Xl8N&j}UPMLwtwL$#p ztU=yns^J_;wU{iuJJJBzg)2H3o2=f4`gqVJ(i@2n3T5y1xwNN)B;z1U(<8#`v1(~` zUkI0%SUA_v*RGyl4)7C5+xA~07wu32@nJU zB4?lx8|a*>yE?7k^xf~?x)mA(cOW%^uDbWj>3zQEeO_ZKu~E!AMAT}cnd3rws}={} z4%3O7*)Oz~D+uU=d|Xx&57u6A0^5!+=Dd-_%|&aV^(4I`VLT~-W$Yalf2Fnx16bCG zxf)o)RFE9V8sM}weP&@9(@Hh0%#Bi_9noQ5a1zQhU||tBrpzr9cGuf(W3g!yIY5x= zLVX}CEMte+K_D2d=5*r>BfZ&Y5RnCcMHhuccZnH8h6ai7(jSX>NPQ%_R_X%6;G=|Z z=Qi+k#B7S#n4xq6W|#JZGCs_eliQ5-(i9X_Ju7NuVH8L?>4(M_*IU6sGjK?Yg~z1Q zJ-AI61hg?oQL<>9iuMxqBY}+U{%F7#u?Q5OCxeZdajJVoOgk1MCpOYsZ({eJJs8ep zP@S&9lBJ8WYUOgQxos8N=FGzE8Le2nU_RPr&1CWL-oYVUxpp0gjveD@h3C$n!<8#n zg@KhF@DZ@BbLPKiJJe?U~FN#>S@5+0}=$XV0Uz zrw`eYthh{8k}KgDT3TB1o4@%Rc;?xsnYncM@Td6e@BA$eA3cT(moAA8+5{Nrw*omDXS!g zM;Xd!qLA)cCWBeCXJgaGjd<+wN4Y+)z4m>)_Wjpz{b~pLd;2-B>e?FCy`qUlZmk4h zWrl~aZrwVpU3(jDTfH2a%mB8%vlXXLoIz(tHzvnt5+;x5UZxT z62n7-?Dk3SgPEZr3=R#Uv#SgJ{rx;Q7R+CSd+xpun>XLhkqLAEhkrJ%13IOZemAq8@OWn2!7?(g1dIE6zgPIEa z=bBrfob!3TRxq8l`;-}*TbJ-!OwR>m$+*Up!-1Ve7(7&v(bA6X0^Rrn5G_bYE}vxW zcPDsvsUfLyetPi{?6cCIj=vFZXoS2 z7rq${zKNFPv#-pijgc>aNeHk(aFV@~6ma0f04)^kYYS z$t@gt+gw)cV=tYXF49fE80;uooY;O+h1ngw5>uzAiKZ3YGse)-B|u5z~>M zHThBo-LzNZQU`OPPAigWXpy}ojgUXX|6hQrxH^=w>Xb4jByCPD+BG+kMea@+DZBS; zv7T{h<-B8yVnm2m*T`_X!EfRHEzkbVX%vIjN*RBCn|go|gEYB$`|V#!vj=s_bpniT z751zESh)fYgQuO-SK0Ui=seH>$BlgKE5Ma(C5yCnBCWtRvON{mx7Aee#0 zYle#B+nnL1H^G0&n*l5aFeex^68A`9>e;P6fgxl7(^wL=fEYsTeyS`DDl`3IW}CJf zfltJsN+t-vB3D(_buxwk868?S7N4J-;BhK_B=4pY3Fo#bj*nD#6`d#M(@2JOugHb% z7r*#9_V51~r_Y>2U0p3}UTxa65i3_LWfm40T~iYiShQdP=C{p7U0of!V76bngae-* z#QQsUF%#?J#Y-3&9c8^I27M+bSzLYoyf!@c=%aY*$tUpCQ%~T%9ozB78^6Gft{WH{ z8bM7>0|tjiaQgH)T))xDx>kuq6{@SMI65C`X?^Qkzlx`yev;i8j~+dO?|k>W*njXK zPMtX`)*;F%aa#czw&; z?EXlDCzVKIa*SMzM#a^b04!pM&{)Z4F}sa4ur}fO=by!wzx)dR{_nqw?|$d+(0=|R zx;lH1Or?;nt3^X|Ge~i5cz6hd0|Us8j9~K@He>Uh8?kA_S_};I;$Qyhhd6fR1bVu9 z1;8pRL%OL6O*3a;$+D$bzHAYeFI~uti?QqodV71&-Py@=oW>1-SNvI54@V`OKYtPK zf8ZfJ`Q%e*YHUJHb&UXb8ja7b%DVXa$9Mr&N?GNneYh&VF-10LcU023Z2OSInVhOu z7{KCwasuu$wXz=WBLPh0z>`2IU3LimiMT)7s&7{f zZa47u2syUJpFkK?@mO2}s|PNBaR8RpSdx`B+Q2}rop;%0`x4I^JLWn!%m8p=78Za^ zb{v`P7zQ#FfiR1{K?1S}z{(1MHAVmyMT*sReL~!FCAg@LG~3#|+Xi>s^KS8FTeEjO z%}RaGwK?x$dhx=HY`uJ7m*fgm5{Okn`-hAhnnQF+A^?^!#k_4^b}4h~*NDE%^itPB z+bcxhlE5peFI}qeUdBu;ZOqVl(V_qc(SUg$Hw{Z>U`aq02C&Kmz)CZKMGUMeW?qp# zo-(lhyJX{8jGxa`E_OVQo9oe%>*Aa=w}N&Ue%a51VUSJ&Ud_U2g`B^tyiR9N=zX-PD7f0Uccvbfv(8jaugZjh1$YxKgH3- zP(7yA$;DgXmLzve5-DC*zd5HfUJIuDIhXx&2dU!AAK}RqSiORk+0D*Sk`WL#I;2Zk zmm=*SUFSmc$9p!XW(Ah4a2B3RUI9SK?;1Hg#xZkc-wG}qi;R~Ds2$q&{8tMm6R?R4 zObIS9yw;1k$SS2f_?d7rIWxrC!=9xmgpY0r04xD_X7 zrHW+p;ZzK~Fn~q65@g_t3mprCTNFGpZdF5x410DxG*=T&Ps(CZuEgzuYM`Z6OMpkT z4t6t=%*cpt^>VRex*Dd3B+VD-VFkvJXE#Yw#xPRNEWSxsEhTOrxu8~;1P_GL8)Tnp zK8EsM_6&vmqEk$eM==JlgVzyNe762#0Zek z=h-Z|dx${04KR9-MY~lyif_P)MW^D!Y_O;v7iBLlisVjY3=8c;(mJ9DRtbq-Mc|RW zN8>0vJ|>`!x+)T|!yp>#nu(x1yD(7=#peZ8sidT(kq#+;)4(!d&&2Op`-?3nadjnE zMA6<#sJo_sWt4%q!iu5Oe&IZ`uXgO%f%kU2$1Z&X0|S`9U;%Dhvj+FycQ0noY6Yey z(0QW+*REW{lEq7~bn#NGUbPzOnra+BbpoFp*pClC+=JsMPvP9T3vA3y5fh2@uBL#2 z{(iL0nS%!(cmU5n^9){m@p(#X?*#WSMba#{d2w{sW$T>Iq!B)Q)$yzKy^5i@(6>Q)e+cG9GgEGR6jprzesr z9%BSxefgD_@SDH>O)Ouw1d|m>{Fndx<e!>FvkF*f^5q2?m?8LxVEbcatE`0>B|3l4pH6dhNtW1Lj4%gRvK+JctZv$16PQp}$_2hB}&sHvv0RKc#I zSFc{-abXNKV$*eXbzxv|7^B&7Y}#}uo_PF8+_riRmM&hV#yUY*!Ws?s4P9RYKRI2x zOIhiQAE`=xA~*$jyS4kLf63wzrE&nQK$Kk8TVd-8Lz2KNTd%`9X=S{w=ie|xTM$1Q zXkCf>u|{O|^b0MuQci!)ebXUoh00Nj8E|oyXa}q4FY*YZ&F>o zBj;{A8*tmoEt3paX5}haXDlx6TXi4R!A50wELhfRlqA?4kM#)U#{fqHx*2$)y=Gjs zFr5x#pz&yIT$*>Jv*llO5XepI(-?tu{4*(a9+Ulx!8&7?d#vCv)7jrcNkdR|u#|m8 z46Nz|3AdAgyZq3ZCsp~m09d6A-BPEwZ;a}{Z?)kvEyF?Ure~38EvCKn#WqzKwJDfp zRLdi_S*P0{(dTnZ;7aH{8g=6er&72K_O1h+BUy&tj>|L7ObE`>xvi3~QA=*BxCir~ zZT_Pr50K)0AeHi-a|exRb&I7{a;2v`X>G!W-}BqR@5^ZwyA%Lxy2T9&lV^J8CU{Gl z?v^A{pt1$VNXg@|P+NXZ<#)UJbo)_`+ohGNw5R+MA zkjL|l*0^~e9^4PIHKlv7$X>&l zL=1yy&IJLi{Of6`E)ka%za3qVO#u$T(pym*y{7GCO~z1>847Aw5`e|Rt;BX=0E-oD zcNu^$y#^^U@@z~>nSz@I45aIwRgqn z4UZt(h~i9qOE<&!9?k?Den=9Mtg0t3uX z$6OAHQ6%gz6UY~UPU>Wl_MGUvf@=0T84SWgQf(-KCtMZGa3z;N2C)j= zH3k@2Qxv%>P5L4=HAq)iiIIaT5#P>cF_INGM*3Zygj{U`@p;lulAH6YWKsbracML6 zOlDE3(Mv8~G#1T`NZ4fxU?nvayt3E~xTSu`j*hY`*}jkVV#}5{aN^`i7GWRFj&KA# za#Oqg_S>;~^-7LNdE@#uoIiJ(L7vTb-i13hZN{pVtC2{SW8c0HarnrmBIbU!9cRzC zvlbNTUlDtZx{D$Yw#{k7efQpn=bw8HFTeaE_Uze-ty|y3`SYjI-P4Pf88cB{UWv}` zUUYQzqNB41m8ojfRHrdKIDnd}Dm?e>vv}m8hp>L#TAVn39N+!Bzr%-nKEmNcM^If` zkLq+{^T$IJKlI_JGy%MFp(WYMOg(# zhK4aT(2sEvs;53DV3OHb<(M&h7FH}@#!R$VzVs44{9qThZQp_2AMC}MGv`rLSI?0P zQ#EN!k}l4~IO|uDDSs3l?J2hCA@^LyzL# zyYEAyBEf6l1g(j>lJP|{X^|2A+N~ z0G89t@)=mnAPV%XY&m8ygsCxB2LBA9pScBE+{g@rH$AK%fQA>$!rR^Bcj4&XudVI7 z5ytGjTuw$~0^KXuPh5?l&14tyS>S?DppI3WzIKo?8*S+5N!d)BjL1{Ga!P(Lb$ zObjl)WRi%pGIR|Lbox{k0$fotw9fMRz=CS9Yq)6TQCT>OElUW9EP#;j0%o&gZ!3UB z3@nbet6M(pEA+kqSW_6uid!P@VZ=PsOBTKY(>>evP1}owu}6851|R`gQ|vm(KgPgH zk$8I&)dXOXxO)zOtwN3S8QMIz9ZG3DD@-I~ z|JP7?;|iGHd~=&>QA4e?&9{^qmHteD#x8B*hYt{W-!XT{qO+p(qWe~n=bGqp2-C(2 z00uExI?nQE9*iZ_NAoB&ta9p7fV}DDXzBu=TP<$kr9}KJyfr0vu!n!%3yq%=y2&0X zW%|41@|VBl19vo}u?Hj-Yn`0x^38l6mp(n9xN3Td$5z>!%K4T@e^-&A60=7atAqh7 zk$d)F?}_Z2k%M&pecjv`!hN6neD2;z&qx%)R@-e|BsM-9`rwWJn}v5Rf?qjB>M;O| zgxm$d5@wtE1E|=mMm96oBs+al8Q3j?**;4B*JyS@ghF%rvk>2^v%+1WxB8k+z`P2e zN@7IGp8$jt<1zSL`c#DqyhE>iJ%tZX%A`p@sj=2z$I~nUJDS)M; zNs?DVd}663%2m_J4)SWy$N^vEZY_FZAY2>(TMQ~XAjaoe$f1<;Gw>?lxF}#W!u>(b zR#BNmS$QS@JDbfSlgTI$HHpzt65$nQ78wx4o)aT!f(>`pprSERQO0^F0%DCjwiCM% zPK>irK)_XNa}yfs>)FsDAdobkC{h)Ti_B=2nOL08#H6}13i!!7Lz9z85tEC+D|TlU z;LbE=NRy3#852}aCR5x#0pOwlRwb1?fmAA`Zk)>UPp8V(AY)_#l=qU&c&B0ZRAO*=6ukq(=iS0f_1}FT@9fxx z?w&r3jgB#3J4^spe?Nmoqk{ud4st&xkh7km2sY!9habR8FFc1Um)ddc_-VZL_EsD^ zavZgF4XCQAVIg-$GpDA|-`9hofdQ;py^7gaPe1WE8=za>cmsR)?8A{G$B-q}>xv32 zSh@sr=FevVcub9BpuY#HWCdE9n~<(fBb7>`udf#)nIX)a(Taw;S_T>@s^pn-XW8|$ zsi7IKzVa2k^uo)iN!KDlE|gQEFQ?0l1h-HIWpJJ0R?nP`+_6i&Z=yS(bKfiB7~rSp zrxWmf{EHUd?}9_AyS57Qq%Q+zEU&hXRU`liKf!KnvQ9eknL+C@5mR~1R{c8xkt~3P zfFQyq)f1u-_6l4eh5=RuOG5gOJ}cXAY{}a$?6@iHKM`3SfkNbuofmwQ!Wcn;h`NG& z%4(7*y#W|(ZDvfi36vpAQDBvYH9R6(Sj@hnU<|}UnxH6zz!+<0g?|XtVK$cOPCETb zL8An~(jX<==CWs)X5~1soAk1Y`_lU(5nNTPiX{U?Q;-93C?i%bvB*7K7_`RrB_PW7 zZ+~yIOBrEcNz_AL*EI+S2O^%X!e|B^F<{ zhWrnE`Nuz0tO7;SpH4CJKI@gg#O~mvg55qoWxwvFRP$!)QnY<;qU@jNI-C9+K~hk3qjz=$*|G7ee{o_)K(&l@qPg88HqFxdzbT&Td8N zV973Hc4!Y^XUBRmLqx$b1F$vIBtNh8vz4AzHu5=E_$Hu3>txun@u$}Sa_BW^Cmp&7+AsD zNY7Fp5@}Fe|0KrD~Z<%yUxfTgZ*tg*%QAZ@O&K1`UG1v&IjkQNeI zoFt-M$vQ^#97o4vKuMwi4rNA=85z}n6L&&#Ii%;vNFfkO3`WsAAw$F5`B==K#?=%F zcN1Hy67_YpsH?3(bt=V%DFJ45lTOCk;P5a828S46Bli%}QlT<2ql;ZN%NPVBcR6A{ ziE%5p^fbOGEn+i?=zEz)C?uULb8A(d78=hMLVDRV7EpK4!)^}L{ zsv=Q=rlv;RvH1=b7hkb*IqGU_nW1#%>=_(Ac9f&m_4oAR%dfnQ#~yx^Sy7~a_2J$< zxOTmR!8j7j9~>OUm8%`N-f@E&K_rY$2IAbgbFq2zX1w^q^Z3eFU&TiseZT+tY{58&>*?#707>(Socj-USYb=JTl z7sC36MpRc-UkY{4#D_yNr{k&f)c+zkvgv9!70_ zBfAh105w%!#!S$@?rseA^Rxu#@zRm*=L@|(k06=Yt}4gu`qz8AdY}H!t4>-!&}|?;xV$Ln+SMtpo%E5dW;?KncQ=M z&%6r0wI$J9*tDQpw#Wv=Ws`YL|BQlIma6I0@%IXJ@LKJ}j)FBgu)lPzQvGfQtT?J& zh2lrXT(tlXw%-Kz5rxhZ{+7+ytdkM&FM@)9%kpn21`-D9RUELxtj+!PHF7?%es*of ztUS>QlZy#yCkI}Mh?IKIic6;Lb+jguyBxU@W=6*`lo`eF=oo8bjZTmrR2jx;ebmT> z;|gTa*1>=lX+@C>xLz8G8y{&6N}n3|Z_xxf=!$}m1gi7%W1^X7qk&}wG*WIt1GYE- zOBt`69x+f)SI8Sy<#kIKe+u zMqy$}IVF&Q{NcTU_fFBJG*Nfrn^hQqRauTC&)zwsxzO+q8>_jK-%U;VM^wWq`hp)-u(VTpJbTpAEs%yNR|J0w+afn% zsW<|9q>_0e9)+LMlI7gO=PO5iMW<8hQkz?sP)`dbrq|u-9{H~1OiF%m8hw~=bmqxR z7ee<|&STT-i~Murvwl;ctx9jk+(I~8FNV1hNjK*};g;x}30`2ZOz*4U>0;~CXK92| z`X-Y8Ey*s%8uyD*@?u^>`KJjgl#pWVq|dig6k4NVo3h0AEtw_Co2C}oFeN(#ib0$g9 z8J4`|5?W_s_L#V_6l!mMz<*8*kivt?&&mNCh z!>Vd8>FubcVbpxS)%D!wnE#{wM@MGTP7)AHz!75E(4p4;ZEg?DxMBvL7$2nlBZqo< zKkR~FOe52^3U7je@fAOMgH{X}f6NB(MAiv7;kv1%;qfBW0N#rjm#cfGyc`1I3Hap=fl96oxKLBOW^8oc=IGr0SXO*pXsV;nki z6lcy|z`$?@i9`xjRn-iRP(;7>_DksR8$xDS-16Gm+OToc2E6p*i}=Q`e3e}fw{Ck2 zAMf9bbLZR9)Y5|Lnp$p?-u_{9+~`7Cd4gTvYOAX-b7m{;p(0=(c$}1C?nwZ4pOP6q?<2s9;Q}jaul8l8_U7g}+ihuNnf4~41wb8zPd-3Og z{ukK0Z$H}GFDqz9I%Y{8PdqkAq(7NtHWZDn#~*nZFFyYa?zw9-T4v9|Km5}_O)(JH+tr2Po*vAbKOgJYt>HGD+1iZvckaadJ3qkAT^}NuN~5`T z25Rf;QJJhlcXt=ESz@mxP+wQY%)nHtn)~YVC1T2TVs_gc7PnupU_OI$q;+=T>=~Ro zbq4p{`yd{DSe3*SEC}9P=Sk)I3|~@ zeg@i@OSJ(f^tZQ(8rVjUD~Mn&aJHE{n8(v~G60L7vEUl6UJBTSK>&+hCxIJiU9zAg#mh zg38LH^)V1{SN@iQo3h`@*~9=Y0;Sk3aAFc8*)evRBk*d3*jEJH5W9-NE7F-H?K#>@ zy+9iTV42vtxbG3*L%LCNalw71+EsSx!fPqH`%g{ra|8+z;Oqb_-P<_`27^1I!ASq+ zwbn@osBWXBH%Wk#ux!PhTXq}U*IdM2+t=uvp?xUg?GmMtbioL`qBbFB8toZWCj$Bi z*cZLVfL$jnH)UY)c}B(O3BW3!0=fMsE6IhB_EQ0{ShzizU?7Y3E~#H30LyfQV&-ek z5iJB-7e2t{KWyJDfTj6Gvn@5bX`TM3U$@-mn?6{Pcgc(bSgv@{6Z!PZ9oH<;a>Shb z^R#9jmlHF6LJ7-4V+&?!-E(W|=ch6qz%E=yFO`yt6_=C$V(G11T3gB175k^8@`f+0 za{DPJkyzjMJT|c2EJ-RMGe(O{pXKSDQp;bkp>9bcMY>|TW2Drc_2y3K1X1Aq0)sww z3B5^>s`TYJTA*-$+|<1ErjR+JhJl6{G{Tz9qSutt1^$7{0W$u0EpcqcZLpF2gLb&7 z7IAYcm}jM@6W(UDes0MQvup~j{C4OpJRQR+81NFjQ~dJCzuER|0NZ`!Z?F1sOk>}m z$$egvus$z3N2IX`!1`h&3LzbP1(XT1uUMBtZ)Z8;8%60+@QSJZ8XeCVKjz{gOc-e+ z(UuDLkGn}FBb5Lwy&0y1XGq}Hk5WWNtr~*@UWpJnr^O?S+ziCaAb@CDluHB&&g;a))s**#KM{&_RPctDmW@;83SI! z!x{7s4Dj>is=-3}5r{5`l z=J=d?| z)S2`6!4H3gT_1deibRS5vt(5j%BT-1Vq56yKN=D{`Ie*t!)+#96W#> zJ3qwM?eC$yGKt2<7I9@J2FutO(p43h+cpCY_0`PS>+c^zcULb9&JSmX(K>Sm=FXpo zRjXH`K3#?3fj(TiaFzkAwmI{#Y}rb@_~OgB_uhNCT`Cg^ji%`@^*-XFs8ERvtl)Uy zpHcH1bo~v^+dSo;x)M4;a#=TRpAvkTo|JvoXA-$}!F<2mIVaFoGIo(HdFEzlY}k;) zovhrNhOD2$lrd0`@)r$7sZj3Qny%TUS_#`bgZe6Lu3(}uj{*?O*eQ|IL+IEnbmQP? z7kMYxK=iW3_Gr~aBj8FwEOLS7`b=qEmH8~r=)!`u4xvjMX1h*`NISXAQ2>Ea3bsL) zKg2fT{ZX_H*{xd{NaMu7B1S5Wab;oAcn<(9(KM93MK51?O{|b$AG}8kyGdBJ76?W9 zN*KfeJIM*IdqVq6>n43V)xNao!|dMe0a&JUQYYnanF=);@I2nyeP9N{HIWIadw1zzCqablPM?U*ZRSe8I+Z+nh^73Orxs{3@;cx9Y zE1aMA?R4fzo@pAMTA_s@Z*!@_Nhn2rGuVNggNkjBc`0$Xr0H%+A_c~-4a5TK(|Pcw zX-tUxYhJNL3XKCkGv&6=bXu&?n&lrmf@0=dl*6CrO*b^XwC$r)&YuRM`o(K6a4NCu zNuHL-n_tW(nzLt>-nuzpO5VQq3m;8C3N4keQ$?nFI9nO#GN<#89hb{AXl=$&39T32 z;*itz!Q#zDj5w;fH7ZnN{Ux^*V)oa_L-uP>C7swg;~~5j5PHVmQ-5fr2cR1@n~=2v)AP!@z@hR&$+8Fx-gEzYfwL|#=~T>&i9_A&sA4J`$> z80@11Z$d(evm1rh-3bSA1gBgE79Zl(Xe4k?TsMSaBu0j~K@d{rv+xx7^^>@*RHC=L3va#o zCf=+IoJ%VE=PU6I=)94=@#Mnp% zb7!_<(Y!Wn-n0qLGiKoYg^Re-(Sh#n9@N#as896Wr4g`hDpjv37@tm#BXXjf+!PMYzs2l2ykp^Zp62L z`#15_Q%^GMjKtty`^O*Py&b!-Z~p-#lGR*~y1IHKQz_OkBjY)dN@ASG%IF9-tzU=x z@4bsPxfcDaOW#j_@e91Sb2m<&Im5tPy0(sm-)YQ|9v8V1(io{CasOnJ`)q7<7?0k6 z55D^Hix}$d!rAuA`2K4@#P;`hvB64Xmsn-g|D?ktCdw^q zkC7g?5EtpNsTIC3xrywH`JgK?;CmayrR)$4RF zB|0&?`{`vt$jlO50tp(Sdz$SRa_$HMqlk{A?u!aw(WMaUV`>y!0iCJd(k`OMD8Q9~ zbjs)^084>97O5w2ltDw$tE9R*;ELE+8ZnroDC%B7EG*h<={t+490ssL10q!Iyq0?G z`M#L(^grr*SHH*tRl?bQdPNS>kD4xVa8qpBg^HM`y!oqfD|;!|I0@lZw%SIFm^kyS zc(a#o)Ro>ph0}Cd^z@hQ;0RR08ty+5(;U8ta0pL{?h_?6W!`>quG_p_m%dCD zcry2(YY%JsH<=B;R`A{6%bcy$p9T?dFsCYR{RqB^t|6g!yn`%1C-kJ)k>k2bH>D_> z%GR=+E-i3*p0j7Wm!%B$t6L`{-4U*T(1rqFk%+q=IVk|IxRz{Z&^vn2Bk)Sy;^>e{ z;FY-wh%l-}hEi(2-k{s)i*|3oz*2@03%U#Yii|~xCS*duf%U?!gXAJXu7(7dI7>$i zBLU7hfSLNkNGk+n<3+Rp03ZNKL_t(Wf#_m{)(UUr32SstLeKBs2mdHTfi`N#GW_v0b=u9zS^P zHEi3y4abikW3g^x@jUtXqj>JQr?7CrJTx^mswgAaXl_xx`eam&*9YR)7;<9O-&3KWin&9cC8bauXNztxpvlABK;~B zasTqm3}EfqyBoW9zmJ25j<6OP4Tn@!73ym1(a_k)e^cZ}loj>u(Ze%liMQX`j_vR60Ll_9W>0Lgs_JTX;UpldwxNy&9VW)IShZp~HmqCA z46MaVm*V~1A7J;M57`Z|Z(tBLwROzGA`$(r&QA38_A;QBNG4EST@8vJSvEC+hwi%@ zufF&k#xg^=a=i<${qRS4Z|8>$#?iQ-)qnsj8gm3*(GQ8)FPz_oue|aSRxDYB8(m%4 zwPzoG_RBXhJURgq_9v}0nqxFC=e5nmBM&`*+H?}vu3p3O<0okL_!>4hAz^7E9IW3h?hx5v&fj5y~zhK$QSk z9*7m)P>n&w?pw;zRfaBu7@nAU?#g6)RImrzzrrcR*c1 zBmELOf2cd9QcqoQ2-m!>=}T?k^>UKn9EP1_57Je zTx1tR5v!NrBF0419o<;rv?mhVj9l+4NFPzpGZcJy&72p2r z*yDLT(2{$)l}VG&3eGdpZ{^21Co(_r$d|#04jE#~>p#?|%y2H(0N+&o6pb|z;I%Ot2C#TMI|I}=KO~*pb)$IMX#uv4H>Vjq zDsX%gmC^vWu>Etg%Qxl=HM*9E9^v!~E@Jr$&+q4{f1YBMP^y@L=ZR7reZx1ua`wwT>vq=xhA$2r$Y?h3h>iR%k%g>n1PXq9MJ6j^UzV35Zd0W0kOLM%4Dd8f7`whpC3eMXv4 zRA$n`x_r4E2M->=_rCY{_~3&N(9_d{Idf)X!@Aq?$V2zzk%#YRH@)iWGzNx-aq84* zYn`DT3ZneDcYDt`zAkQJJ!1Qy3W; zM`u?rjvhOSR5Hcxf6qSiEM9r_OE`YwC_dV^2OodD7e|ku#Nf~{yAKj@)!f*`K$y+N z?C1#BYvaa^Shsd9mM>p{fxdoxa_}&Aez+Gqc6~^3w~$JdW5K*Ov^F<#e{^^C;Ov?6 z80a5FHao(7*w|2uZ-4u@@YIt}GUM&ihveO4rt+ zfk3fDCA+;YoIejMmM+0PcYOg17caq)V@L7vflsjegAdWuH-MU&I@HwFGn4CjM+Y;( zCML#tePW$5T4Tzl@W=!A;ma?-$b!q=eM9)(5B?e3-rtR(ku1AFQXd-wi~4?qw6vxs zF}t-HFTe0C)~sB{W9Y+=58|i4+=8CL3@@8zkWY?}W8u6xc>cMkQCpqDxpU`m@W3G) z`1li~(sfAJ*P@}h88h4FV8x1Mm_KI*n(J%OdF?VzpFV>#XV0Od<2vrW_kKM1;6r%g z@h7o#$ue1;X`J$LK^RZsQmyN|e32v2?z^gS8WHxeJBAeku+$~k-uF*7;WM-CAL7y| z=VECaTfIe>kA9T3WpY1~xN3b##8d;Z!u8baQFRk6rvL!POr_eZ)}XmCdrPycyL{&D zQ3Y;1Pjq(;TtFQIOIfVJ(N54mUM~qqApl7KmME&y zlDwAbjw>cdcyA)6Ej?v!aJ0sWJD;+RbRT4(Ux6tf#3JyBSW4_}Pv28oyoPI3LSjj> z3!;EM^bqe&(hw?zMsA6slSLo^B0=50zqKi!6Eu3E3oN4SEvM{X++!}P*K){lMOXRjs`y(;1*!_^x6PI7p^%C&P^3l9_PY_o_VPM&1jr1w4ZG5ib zGYtV)q#r5TR}9`63yc}k!aSGr4vpEo09HPpQ0~DqFkAia;tr_A4tB+Dl=vrt!Cf$g zs7;a2#>h#e#KU$>=5EQ!IsZ=I>WF@?H0s?tK}jSlxu%{Q98S8XSr=r;Pe z{wksT(=WMiYJ8@*i@)rZztkZnN1~WA#(fr(sDFwH6|lrv>`qR+g%wzVg0JFIE>zv% z`S4Svy;Gpo0~A!L>_Lhpvs7L3MOb=qx)!$UTmKbmnAjy?I)fx{M;B@!Em@JV5cxXv zYjjA5_Pj{>3wXNbD`ZX!xDUL<;))-d9);=`xFts22n#zv2AhnZx^H-da^+uqPGGo9 z`AQg0JAO^f-}7bIyrNM7tN^Iue{nk+lS&C^bkHN+D`HltOB{n&rU${dqjFR1T!UT@X+|4Sx54am#L6*#QkskLMSiZZ6 zfmhT%){e5A1^QOL;l!=0#s<}p4$@LLeO?c|eoyjq3gY=U(-xgvqBbg9ipAFh(OUz> z$WUN#kK055EJ~M+d5-#4uHv%9z#`U=9P$lxq-W*F+-(YjSH<=zGc{OaMGY!4A}Au( z@JN;!K@>5te~>hg$jxt(Sywg0&Z$W=AV6Rixnrky8Y^RkOjeYuEeOzI_{h z@ynm%)X9_F=4;m6hKC-!AFEd`#quQ!(Kcr$np;}gKsy*PaI7`l7< zFft@MU~^`*;*b8|5Afi_58(WTGdOhk0QT z7vjk$pTgI^`W2i$dlH`<*oRLK9mLtQ=Q)r8xxdYuH&4XIlL?GvM;WxsWQKWstX{PW zt5&XN0BdMy7)Oqsz~21_@Zm@MS@1bgUWQpSThLfv%g=Y-=wes6p}}EhU{OCcHq>z> z#LZv$0+0La*RSL7;UgTyZ_h^`Bb%Mz?jZIQF{VgMjI^j~>S~1zH#x~}jq}>(VBOl= zF?Zg4T)5bdQ)kZL@R6e!%48V8s%s?uu1559_b^yEG&G2j5n`DU6LTC>6JvP#iO298 zzxGYk*HmL@bR2*ASKq-K?`+3NmW1Fd(NNzYkt8e1Sqz>8{D%hn(NI%`7oL6s>u+1d zEV2EEj^Xt!Z{d1RKSoDJoh}{KdBNN^Jp1$$+$PsMuH&PRKE|#cyHJ&`MNLCJX3d+6 z*>mS&-u$_k)7pfVh8pyCU1xEB0iQOYzH#F3q1Did&U1u3Pj$-aMtNuYkd_n! zbOCS_2H~WT;x1=m+OiVxTBVl|cB(Wst2By~&v!>JwxU@%76^z<#I7cOjNo&qJ5a+2AHco>tyL!f}UkL06Oom239NsDZ?3WL<(|T0?thDy zDK^u5ulXl(HyCpppKV5eP51gEz76uV%*~enCf|$trcY}e6nnTpnQpeYmZhBjixt3a zKtbOWw_Jk_TQ@#;!1b~#CF`Q4yCsPf$R(2gt;)_eyu9t7C!@U9?Jb@QUW*h?Ib6FIh2A_tKxK#tB)CvU!D%SQcMQ;q{ zehYgXK zEtabod>#{uJu=^1Nkikl40n0}7K^uglryJCq67hEU>ShrqVR}Dh5%V~pp!#i2*6TT zzChGn+EM<95y0l0hQ#JuRnLWxU4rEkL zgE4E5DDX!N1~x!U#GRt>(V;$(P#q4_A*)1HlElaf6mnARuBE9=zR_3eiV%KIPSFyr zPz@n=B_v^C0*c02+=gyzO!Grtp$$^h?=InWnKG-^ACRVRrjpoJ%9z&VoAq));V02`J$Jer@ zOR;##QY>7!7@5o{PMtl6{huCU?W!y@Ehbqji?qP#{l30_T)cP@qnT01pdr`P+g7i} z+`03(&FGoSSFWP{;w6rpNOP9wJx3fP0e*GSOr`iU>dA(>Iu@62n=^+QW4(QS=<4o4 z$Bi2dUK4wZA^{Q*H#j)NLhfVi7C6S5L8GH17#{3rA^2ba);G~MYX(qRg}?l(zs1kD zyp7)eL0%)8o0>VYBdtvYdJ&-4)7_0^#T2_Au3fbptutoe=*ctqjS*~=G#bC)u6Va9`hG3!pu2ssH?9*b3+|ww$x*EXaJpE zooK&s0hg~_W>((PCCl+E-}olJu=#GZw6p|b?hO3s_%*3LwP)<|Am62+zmM>08`_GZ zyO8{@@_{mqqFa|H7}&^`hU_i8J{o|foaJai9`g4RuY6YGC>HqdptGfa1MC3&-snKyaSk zmoh^YtYRR`1DOn5^XuljmP>b8`vmJD?U@Du85kr&d;pd;hqDqAq^Lg!#A_hq@t0Cw0 z=nMV>a*zzShE3_4J-$TViz#ohD&%YKpugjm?MS}_=U-jo!u7O6XH;8I7TH_)Cj=P8 zrCg-HZ(&iwNfpR2jv^G}_mnE(Q08n@Dq7T~jFi;0DlE-n^GRxl>b15f*-qFIxV_4S`0nMGe-WD8Q7{ z^?9r63*{GY?_g{hfEBDfj-eD&QNNqRo*ubE{f2uMx?Bqx>JAX|42&pBR%~2&ljhFl z%D}QCow{YXn^cP)I3q@(!V9yvSCix72>9cWqJw+C=*!V5T{j zR5lRw0B;9h)tZu#;*9`3;9EPe%b!KTVoAt^l>fgabhq3R#0T#v= zAa9(<2f0&{cGlp)0GEq8y1!poOeBa;KOClhG|OO^u-$}7BlDA7kPI*+M}PRe0~+_wkb-{REZCDx~Y{uz2Y* zG|iZS(d-CntCMJ()r!iBDQ-Iw`KKT1gXX4Iyu{H6AHa$gD^XKZBWr|PujK3;@C$8$ zF1%;ExoXTQb$4R_p`S3Fg*9C0bnU|BOr&Z=>c#RvKYLxCA&d0fG?fWWYyQgG_QX;7J&u zK3PI{0jKvQ?xMVYYd!&3Bf&2GKeqD8MTxct?`h&(ttx8#x3Rj!B~chzc3ubxxAT4} zj3silXJ!@)xQoEK=?n6jZhB|*i-JLcc9nofEIO|d2t^QGOKL!@{wfzmLED-uxByw| zQmHQTwwG950jMPB3)9xLOD_Vi*nN=B08|&%!elnK?z^`3_&15%KC&4)halQ+BpM+_ zwH2)^i>hpwRr-nuz8io=eIfu>l=7bsW{BIgtdnh6xn3_Ywu>KN^V&Q`UoHATe7Oo5 zIB~B8i%fiiR*u}Zyjc(@=P=}}8Hhf}T!g3oS7y{ZcUf%hN5gIn0FMF_q>Az&>jcNIa zp%8h(7V$!x+h_l-go=KqOrrBQSo?TWkFu?z^P*_pF>P3AI2TPX`au3cn6F2p8+oBA zSIig-FHI%Pw@`7tUrKm2Z`0&UbJ}fL$_x2AFWe9QO6`v@pM4YOdJx*9bz0^$P4sFw zRP4C%;IGJbL@2P=@gw1$&q+1Zb^b5Y>qz&e%P#;lxPuUG@aMBJ@G1wC_Rpj%Sc&^`;x zm|yBHLHiw_M8mF=%$71nfV#_Age_s3iP)=!f0v`IFchS%`TpFwSCU(krAZ?ABHAv( z?Zlqqb}c72Kpp4m631FtWH_k)6(6EaJf1bQ%9-gzqT~c%(ND-airZ&PSytRL0f5D> zBnDuq>kRj)Mz|s-5=A3qaeaztrNaLNu#rX=jUUn-@tjkFKJxc_qc=p#S!nHdMr$yE zovS0W5=`8f7-Lz|70WU^i$&ebfZB8oni?8#{Mb?K-~TbTyh-eEp zFnjha5YW}z(~X|aPOMnI42>-Kf?AQc`2Q%pF8^DblUAWP4oi(6lw6@@X z`}hAI_uY3NN5R{+Z7aV25C4Gd*eF_Ov|`q50;a~Il?869CTYIvC3^d?c0PBX|lH95{;3^A)nl)U45Cr3pjadPTs29Zes zzLG-Ar#W(Rs;$M~&>-q-s<3duTr@S*aG-*|z8-XUccSB3 z2P!L)c<_OTasT}f;r{#XM{{#?XziDw?H}H3;D+~t=xH#R5@xV#O1jqhN5lYZ@z|uC zU@p)Uo@%lt8VifpM~{JJ0FNwm9(ZNHIk&_pcrJ*KFtEh++yPdmJ!O|ET1MNOY<(@Z zbWt<7dUNq~x70G(Ixm=3egG>>T?=~4+rj;=aF+y*xn@yz)qPRioDJBa^<2}`4wmk- zn<}$p0v$;Puz3BoGRxk`uG0*X$)4jbc{JJ}16T@B3Akku`t$?1IRb zC8V3FAeN_d<<4iihq{X>tD0@r(n*4*@jgB2&NZZiB~dWVk=@QU1gKS@tU`9M0sxlp z(_u%oz=+d+^8fNCk=F^{NRKhu^3Q{O=UqL36`MfQ`o3tvyv58tTgrhvF5$4DlbcGM zp%I#+!7TO;H$L7`xMYz-y8p0#Rk#ENTGpR@4*H0eCNA|rj4wC!{9A`SJDt)NODnE! zdD5RwwsFbwoc*kcc<_?ms9AFaDd*&zcrV*@i`E$qH>PfoQ9H)myT1n<4Uv?=qL;4p?lg+e&JElE2a8TnVD( z4f>zH38&@Sp~w;_pq}UEr1L45KAtHZsh;H+1p~cvwA)9+M}M!=ykbXd;Mc+L=Gb5> zW*|j|I|EqjTbxUq>}EopcL0#GdC0iqNImNACby!Z6(Mef24E2z$OEtR;3?7iw7vAk z+O#_OZ#8wP3<5MrWF!Hwf~#F&)X43vxDd!KvOQvZa#R4AsxAhX9Kbn0)%4)>J${nh z`b$fSv)YLK001BWNklwaTEF`t;#r@C-3x-~i(=#j!%mE)AUwD++=!J#44Ei^ zWy1H&z|yubV~pxR2YUvvv`?&UNfe#HArV7Y{TUk^w+g`0Mi3PrX-6?~tzX0qWt;@l zS)5szR$_>V=zIvg(p!2nGD3$-2ND-wJFJ=pUp4< z#!Ovp4U3^~-?kN7w)_&G9QXv6E?vZonXL>|ZQgtbNF4q2sZ;C@+0@v`0M5`z20M1X zkB;ltF>n5S)TC?KHtO#kKu>oUMusz}tF6WF{qFCwjug2XZri>c-~0aeFg%h$Q*#qq zTU*i4P=~8mE~B&aI_q{VTf7|4KJz@j`0!)6@BVvn?%XMSdgv2udv_~7`Q#u*N5|NO z@XkB##Hv**uyn~{)~yoZdeU|pL2XSfrphZhQsm{U*Kp?CdGrqsATu(8k?bflsYv9W zm{TO6o~{-F`|+_+2CObzxP(g=FPje%kVv77M5PIYAmBBbWbLWSib{#DW>GTLC0FL2 z%|BpdWK;kwey$wlsU*rsfTny36hn|dpPXbMYVo3lm_L6m+S+Dwq{+UXZgzPj4Yk=b zW}u8WdhxjE~a?6Y9=UlhyyrX|wJU8xJ9Tr4=>Ik!F<3rzkF^NYoC zPcIA9h0xYR1G3y&8<1s!yh~iiWcdxRfv!cp1~dSR`$IY=#E#3^zqPyUz0eVhMfihH zeD)EurL;VbnZ)~!yx`6YT82OiN-tG(58Q7J&nh-R%S6pZFUkNSia==5`zX@y zxCS#Zn@s7`N>kzzYJ16kZ5KWYOtbhtwXDKRKD(JOUsUJI04xum6YMC^>@x9r>jwd_ z0!>RPhsX&C14}QkRKT7uOq^Szl}ZDt7^9E=me99OjDAx54tZTM1{Uqjq=6`7Q_liA zURef!*`|422&1Q8-!$>Z2rrFp`j={F6t%hB1E046>-#>IzDdU~Hr~W32&?4gQ?xz2 zLr}hhb9f?_P?sEch}_$CSEF$E>&JO4hMe=iSG%0eBG9?wL9V(Z_o%Vfwe?R4g@}|gI;Lf%$oI!ffBIP!ZJ&}FF*cRh zfuDbfmO7E$JkS^X_i`F4PlMRUCFbc5rLbnh%{6%3Te(HiTua>;qAi=Z`ERbwB@C2l zJrcBOv^;W4mw!m*l4|6L~ z+;;DQRw7F3~IZ&-{=r$e?rfcFf{FvJ6AN|vGuLW zmU7H`1zQB1qG#zMl3fKk)U>z@(!V9*5K-#oGiGV|%q=}M>UmLhBuv;<#a!9o4YWI` zPEMoB-Ok!b4>&t=!z?$j65YvT2sr~u>ttQQ;FTC%4!|$q^?9J6eeEnkY;*Q~)E zcWlJLhkfnn~5E1hS(Uq>`0byl^3ITeSuo*WZDaD^_92;)S@-evTs%?)~UP z96x@N!NP{dCM;XFoHdrx)z#=H_EuLHdV6~rnBvHblT#QO9Yg=X0J?g5xV|(HiG{{& zsmUoM5=k^QH8Kk;nMx>VTY-z0uHee$YuvZgb5u@>GDz$z7HJmhA{(*%72 z0O@ziheZAm}O%T{f znpssTq^hdf2&YJx1dL@y2y~;g$^BTF9~7;0d>l1Zl~{Az3anqd3L7_Uz~!qQ*tYFm z96WRc$B!RJI$eXx$^`oQdXY|7apcC$ciw?}?ztBS_8-9OKl?duT<_$_k~FsIhxEN> z%xuPzrHjzg+K7hwI(C~S0P)hrc8=uO(mVrq-E|Ls^_$xL&EpI?1s&b z$lm78YqB`d2XaxtWHg!gK>tm4ZncZnr{oCC0Ik5QmjF4~0o%xO_{U+;2An4)s&Ly-t2 z8et`$Yk03#ZBGZNaa2aq`Gco{6*_pupTg`I6TW3E4q!!7%RSaco`^g57CIQlpPut< zy83YOLgjhCkToW+1ja!Lr`f1sZ!@>RtHIeQx8lW17i1X4=0nDTEez2FOKEF;Mqc$3 zDAeeswN(ixsREDW$>Ww}eM=Gv%I;3yX0dtchYp;IW-9}$5UI;HSn1k00IPWG+8W?L znXiY#pG*1qvs>I$ZWAkB{1Tst8T6rs%`?kNntYM^yLYD9D8=TXKU{1smoPI5&DLVG zIr@DlyXmg!pU)sEvHzowwK&*yw8!mj>M)zUf8ihmESTR|cG)y(ZXnup8E2e5Q~weS3A ztbO9yR3scJTEw@ZJ_ETqVF1ENj0&|*sw! z(jz?(VQz^?vALOW5s2xe`d%!sUS7c>uk;QBHk`i+%#$px7>K0l!mbAn7}J|xWpz1S zFarJv;9>2n1T#d4QDuj1^SQ7v^kRcbTQZA@fJ9=ys0*UgCDTK@X~)VT1+IEUg6jOA(x4OD(7~l+A@xjdngSXq~ywReWCl z77&YASi~$KFk-O3A6=a{@cPewhM&FuQ}p%sqB2o|O`A4ifrOQ{))zgdK{(g*%jtXGK<6Qt>iinp=Rq+_6MoHJypuVmi%`MHSt*PPf zNqE1yx&~LTUS~H#iVjLmNzW26MUni7Swe1@)bHdbIXOsIYezSHa@|OGICEOLHxenLG<+Wu_%11vJ7|Lu@-lKVH57V?_ONL-ifVS zx8tLI`*HB#r>Lu|XJD?oyNBoF>QyUn_dR#v@h?7(BZrRQjbCoTxwGeS`SN9Mv+`65 zjm=G%Gj}!?Em??ERV5qP0wRN5M@bxhYGMi-H*Ugj|JJv$a^))2)zIuTA#LGy9tT0U^=%0W+W@|64 z1q|{yy(<-Lcg!VXF3S&JL@2;%T3hNLsNk5?iG|&5)R>FBXO}n@nCGg^>y2aKc|ifx z#ZWY>Wb_5%^0H?JLi^!-?ZS%c=iDJVvaDRG1iEQ5QXEs6qg%?Y9A83FIaQ*7o}>$w z$_ntFRh1+Fi}rG1aIrjsv8;)0%tH7CVEqnhU`=OJjfw!53Sb2bL+-&gvQ18B|BM{C zO0G+Eor)HUzK<Y6Ru;kMqT? zm;Ch#4)7(m)HEL}&;uoRPQENZa{?vQ#Ri7gf(5~osDQIq#!yq|j?O?Bw}fI9fFgsE z+V&I$s^m7O_*gGij?cOMqjTPy7vYk56EJrDDO8Wh-1#hxlG7ad+ozOl;+DK{ihdvF zn)e0sh+WffeSc1C4K6m^?E6SD!}Yv%bqFpd{2apR`)5&a>CdzAJJHNyZ_c!Ts0nzm0HSR(8d{WNZ0j5!xL zV5-!)zjDf|Ws67t^ z@uc&_Xs5&_fDBD>b0AkhIYiUn&TYcl*fqFSC|J8pLxc6Rn8D@U-kM&NYgRQ>_;eqH zF6T1ntu{aEZhg&tkZxluShSvXzeMyy4%@8vM9dWd#po+G5cRg#HX9Dzu7`B90L0iK z8(X6gvip^|1QO7}(T%L^s%_$y0(EC};Fp3}Ts~!s(Yv1;fTeT5jcG0z9q6U~B}BaJ zzoc&?q0j}qa;tZN^L6+H7{21ne=1S{zu3850aDZNav-X@o{*t(^~x2T`d4B0EpNPm zx8B~u^x#v??kqkgiEHFvILW0!_)~G?8Gj^QNX|c4H)sCIYr-f~Ha_2Cyj2uC5+-pQA{C z1iX-oVQqaK$|}kkyc!+LVmzyEfs<1bmY%@bWP;a?sqzYpPnBbw#QteCOim&@GRjc~ z$4Ic9`k+iAMox@p*>EH=Wzv+YW^FgpubgvkW6BZ0x|;i(>PYOc z!GS@nUb!0I{N}IX_BCrUbH+>!dN3g@HwHf4HWd1|OfQe6m1BDaFB;>AS6$UbVvtWa zcAAf(^X08Ej7s?|ESZ6!@)&@nbKSssW1>3Z0l#SOiqZ3#tl@I^t*jd5V)A;Z02c2L z3ik6lrtaAOep?*C(se`kdVjx^Eycj4KoilGmb3S*PGuh%v(4I;U>^f?d{<{{16#js zPcKu^bOx{{TqsxDi=#|1|LEs5!eSOc?!5>@O73C^-0=dQI3P=aEn;3VfJNo;8B2O0 z5nN0d`^t_@))UsoL0cOT9!f(QizQOL zgoU3dC4H}Dt&hBg-P>G&9zUleu|&_dJ7kv??V47Z8qOrd5bqpz9$MT?)kTq z=r_TrwLS0VOB7m4bDG1#V&_l4Sl{J)GX{T&UoW&wvC}0saqop9nfPXKZu-F|{4dXC zkh6_|Yw^$UgI+1+kP|JI-R3%QLtl#pr0l>}pvyz)$90etHs>ZxN?Ha1uv(o47K18U zUjwlC_R<5Zm_~0mlB#QEg6^arK_HJskrPP}k49zsC)!p5U`f=niAgfFq_TGNE{2W9 zpR#_@@`>3cKoU#lgtRwQt3$7&A0E^p%-6+*vfhwYggwwH75q4t)S-5d}k0T1IF)Mwbb6#~s{1L`LBDoJHDv=_$ z!Agk?X#k^(?&r>J0l;H|h2>FJ`jQ6*E#y!t{fBN((?A!Md-hSsTy!YO_sI95S!Ugm3?6Xf} z+42<}74wr%KEakPZ{os*3+TLY1FKiB#`^W^@W>+%u?ye3?`_A8>(|%?g}|Y7b(+Uh zLwy6Ddh#jEU$g|L&Yj15J9pzJKm8ecd;8gSZT^CVSh{EdR>NLtKl9;MUu$Vjnu=E|d3l1{~CmLj8j87ny zO0eL+n2MApc@2)U+u_jgFouSPBv=CjT^0OY4*`nVaVd9gE$ZtU8N8xMkdx!&)(B>E zty;N^0ZD3ut5>dJ`}TM7_FHc=W2>T~lC{AId~BOLhjqtZ`O?d{die_Wey|50fAld9 zA34Tjsk*k7qZzJPy%Os-ti`D_r||B(+fiRvi*00-$ zMGF_Byu6ZGr?kGYQEe<0w_Jt|!a_$z9>YF}VOmSHwvNli0R4~Hp}fxUdaf)i8Ty{U zRn9hMq$+dh3)VHq+tQiETTS5NC@x$6$|WlR0}TGfkf(LT&nvsf7}1=BcZ4srhs&e> z=BqAuM$2{UMZjir%w63V9dk>w4Vb+_TE^g!b;BAlI0i5X=IMV?@%gf5QW(cVQxyZj zt@XZr8+zII8nl|V#RlW?|`GdoZunT2G>E(<+ z{#0L3_E?FU$V_S7i}`b7POA$l@52h5ksF}|h~OP0I7gW+rTaXAbCedduslI}(aV$? z8Dr4xi^{+<_s@U{XUyg)2FmG&T(~Ky3SD5y1)bE}^f4z$hihW$W&tc~LOt;0*^T4Q zweBq~U#L<2>H z(<-IbF2x)gRDogY8aAfv4q%A9AM%m63%fB2jy#Lx*4rLv?R>t&3fo>1> zpYVnq_lme`_&cTiZqM@HF&8dDH6nc)n!dq}Wv~a@Su2-m60~=2N!`Bm8)x;(&!nq3L*`fpg3z|smr0Y2Nh4wlR*?B*XOE*A-A>a z&JhVFZvd9lNKp+73ArxZE(WmZ&>OkcHL+PcteO$$8+w6;Zm=RrR6${znXVKASj1Q% z!;i$PNko@z^a*xhqOy=-NQSg&Q&~MZKR&RVyCLOexB9m5+FC2+a8VBf(?ejwr<~w4|eaw{I)i%z5O=4`syoK zxM(r1T)l=pAAN*(-rkCHXU^g3)ebCQx&#|HZNRs_^-TsYe*B{!;l#;fETT?se=W^T zNG4OvqI&YlCozBFVw^g24%^<_fq(wzA7MB%jJmo8+x4gT4@rIYocnOkses8x&}idqv#*XAX$}W;EaGh0>VZ{GOTMQ>jW`d2*64* z1A<%(Es`ZoIx@J2hBM4Ot4t&qXrkp{Vqy#f{eA2bM1UOqnHZnMwJROCcJ&&Pi7F&h zl}M#3(c03CrAwEvU_H&H^R4h#0zr@z zlSE}v(X#BZ+LD9hu`G?-9{FpJ=bP?v&)99dE!!j8ZA+Hg5`!d5%n5-65r|9@IaL)3 zsGM`0-g}>Y?z#8f``#-Mvj22_U$Kby?mao|v(DOUU%P_6`(8sVH-?hZV${{uq98XH zElo|RC@aMS_dS5SHf}*<<62~9=7=kqnTpE5iM#bMi)k_d%VWJbtRfT5RTxFaC5xD~ z900;ZcBB0DH+Ys(9LUGOa)5a*o9;$x-#7q*UjDcMkC~LlAiiSsg2D#W?I>EvcI~12d%6C@djy zXLomKfB7w_rSQ5VLLS)E4Z~Le9dAt*29~(+DHCf(0&Gw@SU*bs>Raw#b(81)+XOk$ z((-81fGE1In!Kn8;$A5i1L|ri8kG+7N?ix#wo0DmecZH@bwl)yK?-OJyUcSRlt_ez zO~%`?bMe7Zd%XZE!kW|wTONbOzI-c2oq+>*AX zJRk?>RGY@G9{~W%S2h(GjZ8E#VKm)ICoxLxT(+QN4bau&#dWf_)TA~V@LGC0Lb@WNcioPTo*nd~XGYYGpA zme(0HaWf^Ng25%tKIR(yA-j205fe35ToJtaoNS#))Sux+nfn`|P9wf#{E=Q#=%oaY zgw3`1GW!`kQ4`Bqq$8{CZV+Cv<~+6&0$72}gZqfd*3%kFoV(tFC2D6$!AnPo*5=DwgSYU_=#EVKUB(nGXc(nN=L z`*yNHkOr0qNYTMmT?3UB#H=FKxH2N-%2J{OpoobRfF*+O0??>i znF;aj7?s*$Z0xE?xw3Jn$xYqJosL;aO#j!&h+c$58k?T*s~EHrPMmIhC0dfY@7c&t z3LdEeO?es36^WKdU=SD-VrCOFoU%mJm6=i*VsINHSPtn#cA++)U-O(9KJuJ^bW#>C zDw7;A)CJN!V-9bsLuTxI+SX%md4oi^_}gb-`RBOb zWKeN^(PGg<6EkE?f2wG^Z_cT(y*nsVHGiDv?0VyT#@%Y>n>Rz9m0aDn3>!op9FHD5 zf@hw42CpAHfKw-qqhaY1Y~6GhKKq$ZGw^h^sR;+)Jd77#dkPz@s5=2swRN@l(1$;QrOTEJfVFoYe)z#@d*YM~Fu3f*5ch8>3t&UEPwl_2~hT)-M^!N2+Vr-I`Lo_zi z(=yl=6pIQ9IYQs;)HJ$!dU3g_8RsrvMp||@3MhIZ z1$>}6HbsEcEYAx9un4po9iPO|=om7xa(L`g`ZQlyJ8OCpv(r-|?oV1Y6iqWd4U@#| znkM!TJvYm4e?udq7#JExERVFfh&4qn$dD=&zpoG7UEK@-PL7kC;y5T~TyB00TefXs04r^J2JJU*;kB1v!NE5V zG4mrk7Q?*iYOGnimKj|)Z{5V9BZn}PHjA8CHWn>jh@$*FT)TV;g}E_o+j=*)ZrP44 zTedTxCi3bc@GT%ynip-)$DH+C2>pA52UamSqEP`Yz@SW2v+tM-0BU=e_367PwO0c& zYcxOoD{Hf-hbPOYnQeCOl)CU%pmW>oM`{5nfTjISUklSn*;#rna90eEN$a!mElb+J zqkBv&!xmB?&meYMc6CALnz<2jwO@QpDit92E@eCxmFJ47YmYL2{S09fz0tR%I&R}; z4{$p`$x&_uW(8w>fDE-^y3x8bEG%Iv$-by;C>bxpUJ@At12CCR_gwN745EgSUXsXy zCb)>YR9fIl+s6-JDf5c+Cw3K=O)fcTlc4sJy@LeWP1&a9FOM0AwMUkMF#-e1G7{zEcTEcqEF z?Pi%1PRGW{jVDg+jqg7|7z7wrx8OWQ3~nnBT-dO z)D%&DYO|Fi5Z@TsgOP`FCvQUMi3IqAd(blWzkg23ik^V^5mgem#{$pj08Mno75QDT z;hePN+B8AAHT~epHGB#tMpHxkIePrK#Y|z8MaPyTP}H1YNj8W`C@Vis7g5FHx#Z*zB)$MJeP>75SGp)fLck#)PMD>n-1*`T9T9!-)^bGKIIUBlh3X z-S2DXxIPN+d%LulLF%?K0ay=hC>McJQ#TbE=g-(3PX4lZyJ1=BO(dm7ze=+gW|m|m z?t$Jdu!hsN>$?;dJ04yB<%!YEnD`jEH;mu(yxKY8lEaKk5k(4+L_%ypx z@;YLoA4=pT?=GJA;F%fj2Xf0&5qELX6E`cXXXcR){L>_Ak|kYrltCCaIpqLk+t?gL zsDE@^DM+Y`j5eXTGP!(%;H7i)2B0{;55O{yQ#-m^Hj+V|Qbtcte@BY{DeFC6P z9>e7e=dr3`Iqu%F8Ncwk&tcKhWoT)=iG8oXfuH@$&v51PRkYvi#M;J2Y~QgBzx+$T z$kFnC_{0yefB$}*Jb8k_5MsQLe$|RqtMG*{d;#m$ug8@u*RXfre*EBvKjiVVc+p}! z@V*DIR~Xm3Y#Tc?B$#o(^LEWpQLc7BkO| zAuqo`Tw5x=rnn{Ik)Qo`70kr=vw&?44O?tj_r9@sxHh=HLI3=WT= zph%+r<>uzF(EilqBu8*0Ad7&nS&A+;Eg&|zM2?M*p?{zsL&L+YrA3Pr&9VIaJQh}; znwY}G_yoHrj*X9EdUgsMHm=9VKl)J==H_C2WE8Kw_##J-ByF*@^h^{M7h~P}b$I{# zAI0#)R6KJM?#Ms78|~*tuaGZ&Of~HKtIFikM_hG(iEzC=bKB zW)XYi%IJVwG)~1mQ2Ik7ABqbh_(IABrs!E^O6z5gfNP%SBJH0ZfU9t<1c@Oa-e=bt z29{1RxwIl1hJvD)J)giUav>y^Gwtn;jDl#u%l=L4m;hMjmL{RyoT`E9^n7G`!7l=~ zHGiFw5g&D6Nb-JYUBWU9 z2q}MXJ<=7{J{nbL%`3W1Y*|uj+ps>2*lEHVL7Oh=a_v2ksQW{!?`>I8!!J(XN)HM; zc_dvo%z5~#ACRP-FNv>43G$naaCW)KM5P9jiISx5wy4(BRBD*%=pW`y;YVfDa7S4_r` z01XN#5`qYSRK=IT)EBg3>a>X`<}F|VS%U+Ff)S8m{9hEsRosUez{+L zt>w*t__F#Jldu(3-!VsBYiL^2&GEjMsURhxvQJD+;)R!<$KU_M-{bPt%jjxvV*qQ* zrj7XUhdzXwx;iwq+`y4z$Fc9VeYkYtGFqB$V(aEjxM%lHeCE@iL{U)zo_gv@j&67O z@DU6R%K>U$brDvqT!G*CjbF#sZCi2u`gI(7^AMhS_E{DVCtak~jg45mcnL=rY;C>C z+EyK%owxu&LB76mqXq399q8)r21RzHNO=TGRaRD^vb>z52a@g+&9~99aTa0E&C5kq zWhLg#t3rK!9qVV2z7@3txyYTncoC;gpTR8x%X+#Q2+GUN5!WU&3W>Fp6Qj?jSu?4= zu9n>z*RNmC(HdWT`4zl#?mVuy-b8L;5lRaS(AU$Af!-dB3=gq5JF&v3yg9jfD6gzS zMO8HeKMZt}b{q-HXJ%q*Y7!$OBbI$dAkxV2FuOL=;WRHdpX*M{r;*VK433NIu^$4AlA)6IX0>5)gSim^QIWdezbX*ST`kG}psjE#`!`ve1l`MG&=E}?_{ z)HEh0Mln1*h!rcB2%)fcy#9{k7DG-o3UD3U@Y4{$EDkyfwrFSd43%15nXZo>r18 zE6zH z2=L=r(nG~GgA%8(2YAOfHk+g{08mqm;M(X z`^4B-&QUP*oq!ufRN=x~J;5RDHo7T3ZzmCJuSqRLE8+I~#$ArY8VqXUIO*OlP!?=# zJt!t?;IK~e(fZ{9&)_o&-ey}wkE5t#s(%~vzaKs7y=o_TCbAAGR?Y|HIq!tDU)&f- z1;&jlM&fdXc4crKbh^*~eE9Lk_P+1@kifOqSH$>17>9k%WlF^*mtsGK=3y$7V7^6- z)nKk+BP?t>dWK8b+N`^De1{2P#p{5mS|=)R)OYsthzGpcpL{<_+Ldwr7gFblsDyS) zN}5UVf$(u{7WKfrga=sJx8j!l_}1r7%*R1nL;kI1ZTJO_z7sbeO~2pnoN*at!B*L} zya*3(EEo4Y6ZuZrFbZUGWIMir6gNQuap)`{k@o~-l3!^8x#g8eN8$n?hO=P-n0!>^ zmhu(gN*dXU$dd~SGs6rE%tX%8vPd*TFQSm%FbfMo4iTc6F1j{yNR(Sy5sep@KG7qY z=CchIMGV<=3t+Lf6xELaJ>CC}xIDKB2~?AdRaQ3tmFMZn_$aA%{;I$(>wO5&7mUOx zV(=Lfk-)YYJ*kObQYFfuyEdRQ5m znTX}Ycn%WCM(nGlOO{~us+H*J?q=|tN}$Or6?-M=Q%~%Gt_}3%--GG!y?x-d)nID(Am+6p}|33LrO|Z zP*PHglClbBp$(0WV|a7|lM~~tr9~hXX zpnY&)5Z&Ef=dVS=6Y(V*lgN;T3R3;L8eW@j4{zrEzGDpbZ-&xIQ) zp=?aM7`Rau&4&id5=N5qYXBH+bN$}`*RZIxF&wbVwv%hZ8TON0hMAfwAgMN;R!bSg zCQWW51*){|6!USSIofsK*eY(FXpgaDi1iz_zQU|h1{1S^4MR%Z4VAGaV4e(3Uh8R3 zHG8{t=QDeNu-CMWBo7~>P3-~qOihuAS#)0BwV;?yQx2g$(~EK{QfphTt06y&t*hM&Z4-?Ty}1PlBB$*q_~h8 z#3j`h^Xik}4f9ph6Eal;dybjE?sswTC#jOxYM#5b=hozs!7@%y zZfhvQBOA;4kSXjbqd{Ws-j(qrtR!JzDbtGCT1GERKov6(jB!i=79BJ-LZE@LxQ6m5 z#Yi$PZ{qtVT36;X7Kvuo75x=G9CfX;3@p=Ul(x_P!BD*Q_Ly&Ig8&w>!;BUO16YQ| zL<}mriDef;WjYzA8DGAd3b0!xv97X7A4@cX1i+GZ;<}l^DSy3Q7X1$qpr4+haNJTp zSHnh`XWA!vprwA2D1*e76SfwEjn1W^%K?zQ=RTVf?JnN1H_QVQflzM4Ntl`r#pG&9 zf9b?aZ-~;07vkJ-O%xbRwuG8Cl)U}*5%x;*dWL~-(kp4q^y%sC!H<6OH2(6hzQyii z#fACUzI7|suWe)@_Wr>koO=5V+B!QiHZqROm#*UKrK`Aq&;5Ac`|iV|k3P)WDNjE6 z6kdJx01h8MhM{2spJq@|S&D|0%kVp2`(JU-Jv(u;wFPHRoy39HU&r9!FoQ({14HN@ z7)EFf}V|M`FtmP)dL2&#z`Cl(4EQnGs1qO>bWx`UeKkKRAe3ZZ3)o@|gWo zUR;QU^|h$4t7j1FCc8i$#Mw(%ai!@7s%mOcT~UIpv>9M>3`2wcERsGpG0y!*+FJQ} z1t=*k#nvs`uy$=DYHF%6Haddy7cQXX<}I{$cH{iTOSp950(yITFxcOR@v$*J7!zwM zo!AQ*StuzlM@3~78dj`iZL!+wc_=O@U=6I%i3tpij$RaK4R(sC3Ol`@DmIy}l#i{=Y~Z4}LPXn2qTNdk2kU}nuHTDwHgj@A*%lNetl zwBO&~&p_7r*f@V)T2jnxv~Y7CE0r?sRW&SuuN%fy>aX(jMK{eC9r}^ zADHxX#3*Bqzf>1SjnFHD!gX=9EGE*Nnw~K%VEIdHI5Vj z`^)HUDWguDgTrJSpWF1caAXIXez`9 z-vmi{|4;eB1d}vTbKG9~D#sP}wlmK|jOX|_Qt2%5#Wj@3u$nqF&fwQ#AVxQj`&HQa z!C$`HYp>K-&=d>m?gz>2thsc5Jfq)V^n@KA`0@@nRoMM=>g^iUVEzMs{2Yy{ghN5~ z4X%*JwjU+xTj#sfPnXWPzQc_jXjt7ilC`&(8MpBh!jK8S9hbB{nskD^Jj=*?Xs(5G zyT#<}B^J+3xSiyq-$~Y|j{mj$sBb~@k8kf^`cQc8iNB3#bE|6*{(YQ#PH?b9W*Te< zDYI*gC0yOj>*1{#J-_W<5H^nDGL(bA{K#LI)nRjS%M!-YQxdItF0^-iYqZ~B4X%-K zZElFVQH#3UvR=zL|7R|!!di_!+qR+@kK9EJECGrP3Cd=dP9n?%)F=y!K^yNTlG3mm zM{0B%V_jVmtl_FI7d(!Pq6Rarr16D`R^a5wBLE96djt01vz)tJ1A38MfOM_QwZfClK3>bSk4 zy(N~o1+etC+F`0uov6ObiqqLc{lmAw3ScP!Xb-+2>usPMx3StMd_{msDIpy?6u@F} zUc=Rpab*B3Gw1wzUCGwYJ5}m%wibj&__oe*v!_6#b)lRn=%|x`As~oAA(s596T+@5cl8??GDH41V~-C-CZP2k_Qg zCow!S!64p(1+`eat`Wcam0!o*ci)Yc8!b3-@&xwn-G}C;7Ib&_;AZPBw0HE#Vw4j@ zacLP!IAUNSyU3A?>W1~}ao1fNS&xcXQ5P>=#FeX8n0ZB!1G96o8EmR7Ey3&*iNU9# zuBIAw^$W0M@lu?>a1l>D`838RCy`%Nj2dEQl@_7x<_&arv{?Xae0+jg5Y(}yWo4+H zU(0TCTeocGve4Y5LnOIWp1p7$&%gK*UVZsx?_g-yKLlRUn4t7#(`fz3#yz|5WmXe0 z+iI$-Sa*sJz*O&-UwsWvKKUdrU%rCQ8@GTg6B%M=8nMDcRM*VM;-$;6ykQka$4IYg z1f%2%$SgJ8q-F)6$;@ORZESRuSyq$i zKxIWKD$7e)kbY!j5X+Y?#l{WmaQ^IBynF5xo&ilN%OZ|Dqp4Ntxq9oyt}B}WRJy1O z$im>Vbv9w>#=q~HUSr0XvmeiG#ye5xLiTzOC=w=?*@CRgsH|P)5=0qTsv%_ zhMupv&df#@7xsy%Y5uFf6fi-uGCij5ho)W{^-@LGStQ=<{kk7WJDHW=w1u*v{3j0? zH#4NP$KaLh*>W+Zj3;j&X8>zT*oWlCN1!wBnQSxA#fcGxCnh+%*GfM~Bt!>aFv>B) zAeSIC1Y9YICCqChk&tO@Bu4{_%JFjouw+AwJZuENnDhQQ=NINMAKez7!)r;36qTx& zlBPlCaH322sIx{z8TC~Hh)1XFz?KJ)% zFrMv~u0`eV=6Db|m0k@SD*l>9Vy@<~P{7gGaLGF0J(e@Vg)nZ$(T&t~(2RT+$TQJ@)CEy4O^q9)ImoCu zy5uMNSM;M`n=-Nt*-Bt?$4It^11G#UyA!Glp}O8EfMvilb_+BbSgeIb?lv4vkHqE8 z0YU*RBk)d|GQ{#=mW=(v6TFYFs4%+fTbbV`9@vJqT@u4GLB26nS-f}bhmWwJaOl7@)~H{*j};X!~+8Z zXl-r951#k|{>xwd8S)DYu&|y0tOv1ST_bvXx^e096&yMG77K~zWar}M&34>uZNsAv zzaNi0{65@&|8AtG&ESbApJV{*$dThfS~iMH3bB4&BQ|Z`hzB2hAF8UW@z#kGcT2hst*s5s1Rk9~ zhqjIm24e_NCHJ?2f_xMgz+OM z*hfE!+}uK*8w6mf2)cJ*RaY}_O=a+%gJaOaoxm$$ps*Vitz`y4V4&X|$eGb1Lm%+|qeh|ip#T6N07*naR08GZ z8LKnypSkk*Tvr1Bs-XY!nOk~+YA!mwH#{+Xs{`eTk}GKF0VyV8pW{lW>l?4?x~Ut` zSGRB1^^o^C7ihAqWmBp+8^Nq}Mw^YJ*xLO=_7c}6QGhXFI;n=4+K`rYp=r4ml3}C5sAvUVOk46K`35-G)7ra(Dg7DG|0$`B`qwI5r32m5b9x$i;TyZ0m z%N++EbhWz-(~HMGNfc1N(}vA$F1-}MqPe9mkrLTZ+#YSzLt@35%S-AP0fW^G<;XuX%olz1zZ`h?di=_Y(z#qx`_ zhv)1Z^ph4M2o45~d!5>e*;HZKgr5sUV`Eiqaoj7--NP6hne=^b7qHuGD_>$!X(YPQgRcPst>M{SwupKhv*R~~zMK0asaGi3(bY}KJ{y*NSVED-i1@-=wWF&Xcly=M zBuOjzvP`{w=HB+!Vwm%*z9#gI9koo9B^l=C=wugCS6xF=t-0A#&5_1QJN^V7QBSQ+ ze2!t?BpZjpO#G>)SgQn&C7Q-w-oXU?gVA4y_!_A}A?c-7=2Y4x%*`$N;PX&r=G$qukB|S!lIH2EMB|-n>TI5`VDJY7inaC68jDw#K|-7 z;OdoY80;Is*vJ^S3yq`liZXT)T)%!DR;*Z#y82pFRaT&)yo|viYFHA8KYsEgt~NEZ z%U=<@y~UWNMXbQw>`YXYm0>|`4YqCFhPt|i7#*L$#Y^caOKJs zcBLZ#i1fB5h}|SvaoRBVivDId+t20 zUcZi;x7t|zoz?(imt|ySvJicB^?cOU)}y|D0p`!IW!4$ZFVeK?>+M5tZ!f!qPEJg) zD91EGHYoLxU{rPHmHum5#!K7^WviInA+AimW)n z{WLs0hW55j^z{vJbi>;E`MCS;tytEu6blwC!iz7xjJ;t-Dc`Rm6-EOjfr??kD5I zFU@E!rv48+^bL_Hh;PdnHJ&pdUw3IFLQ?*`tB5+&2eobvx%EZ6s*XylX&YRot{BMC=;N~htVDX%+- zlX9Y}$@-b(C+P#p5=i0uJCKLFj`1#jZ0m@GHOjpaY;KnFGnjamdSxF zdNNg|i<}@tmKi|qE(98pUQMPW98ZQby$ zUR=I<1y4TpB>w9E`)kzJ)uD0Kax^q7MtyBH2QVP5s-~u9T)TQ5SFbjqv$F>S{loak zM?QuRKK3Yf?c9o)=?T`rA^_{qkz-i4d?j}7+KIZ_8kCk6qp77CSFShX!j)@i>+ZqW z=r|@u$1pKEj=Gv!ELv2LO`A4i&6?GyC*Z28f_0d3^I|M8PGHmdbLVj4#7P#E&ml$; z39S=LX`H~7K^9Y=nVLjlK|U7L*5YFy{V3LL*hEkwnp#?M^5h8&5A|bqW)c@Kp5-)q zd;2glI?6)w#7?5IN#M^or8Paxzy}G<7Zenur>CC}kEFFl6Nl#7t@bvwceFDY#0;#= zOc6Y0#?T}tC#EnoFocnz5xnnx4`S<g>X$i_ufBLj_&OQC`&vObw07^;b7f^KNA z3}K?tdP_QGp4Oo11-b5Sae$KrusrQVS#wPt%w>pbT**2n`@nl$1ESX{{l;T2=^E^r zVg^DnksGaOxN(6KW~@9T0V;&OBWyWm-8O6|kL_y$l{o7k_nEoCV1UIi;#`4#emnqT z`TE)jm5VkNxxLG{_1IXZ&f+_2b)Yuwibp^w0X>GX#M+g-FB(@= zo359Rjt_1l zo82QBh&O*}?>Db_Zjf>S%)pFjUuKXiVFoA)A=?8+*OK;m*0(h6!CudzftAEkj2f+h z*WwIH`+@ghxN&Rk3?C&wnSq*o5_wNNwz(ev@pE_0<(1H9X`G*F>cvxsuH%{GH+UeX z@{<~X6_Ju=k*vMFwZk*q0!daB#;`vGi2BBNkK?(Mt&!*L%EFw`_u>I8KikZgecUkf zS&-hN5qc-z{?gspwX)Ke$EVTK&i6mb~&LR0iN|B&FQ)<-2lPmabvUUo;D@ZmbQdr@9Nd)$P zx3TQSrE?695I>J>o+JcDUk`^Q;_l7SL&fRr$l(;;ZthgpC&&m>29^b80!DN&yt%TJ zM4QPlrszX;t56pLBSfps%(tSB?gv@9!o-mw%l4pg4`jBJ5lzijc9XgFB(RBxdEn;S z{me7`^$_J9`n=n0ad)7@H33U3C~xMph`AaD78$V?z>n%^KK04Z;3FS?3|lsDz{L14v$$S=<1o&=a}Fz4uf^_r?`1z;a&J3%>J%Ce;+EVD%rJ;gxo1&AG-mL3^VAG8_PjW^*nsw1CL?V>a`%Rzguk`xOnLT#zu!2 zz-no}jvK8vn6*UgD*~k$#7ZM^cx6wGVR~wc#oJ3tiLpsKGZ{Pv2w0-`I=VX0)z!sp zL;`B)ut)0(A54v#+wjmZMu$hRbLTE>*su=8#f2Cf8{u{z85v_?^Nx-#G`F;1#4y1! zv$7dbo1PXn7%`qmql!f7H*DC5RjXHHcyt64Q&jxaMlpjV1hjjgi>w|b&}~>ItOewOSmaVj>?{W4Gc%E%ANtOS5%lbZh1ol9fBL8VW;_$ib2GQ>D&tnB z?r**beO5b(Kpqph*14TkrkX~+Rd%tMVzid4-6aNsGKVdQr5mKt2()&B0m+oMXa z*>UtqF0;7^G5d(w7!A1Mk1Xjj>bXQF${)L-GB9VrEOyUxA_w!3^<2J9^c5+lX&bpL z65vh&EEREQ{Ywirsr#V;-kj?iy^m1$LDInDy;+~Jk$4UJnxp($>%_zekv8Tw6R4N# zqWWH>TR1*3#adq+HIenPh{~LKe!K>bJhjKYuD8-* zbWEQ??t9Z%@_Y)kEq~9VS5%Qz|VJck0sqb_U<)gO@!TGC53IKbnIs%35e&7kGWrkAQZAWW5d*|N5mDn*)`P@n>^lP@CG3z?3Ynxw z6DHxUPGS}X*QXGuA|Zz2j&rA6k$}kU^v&(INqoWMKe^qsL+W9h)}$FsI&5OZ6(|)X zD7wtPx06*Z_;5sd-sAKp&fqq^oSSJOsazLfG3^GCswB%tSbp!;{tL;0S~&?khST8f{P_9m-87>q;3a zziMFF-cvm)w>wP}2w)`nvnlHX*c7x9!kE`#FEr63xWgEezB!k}u& z7%d%jy^+HSSJo++3gSv#?d`P{{dK2=v0fc^g8+xZUXYaISNuCMZ&FD^?LnV?XkO$) zwH~yc`F1D4E13azj)5gZHx0Mi+Hm^xDg4V%e}eCS?|ay}YX|PXe-B!3HnT1gv7r{! z*Q0L!e4IFb9N+)`5764$j^W{P{NgYE5+47=N3d?qDhv+v;(Oow9=iv2_Vl5qb^(?* ztibi=76xWoZ{0$7R~JS`Mp0T)f@RB=VNK&|tY5o^0jG?tEDV$I`1m;MKGjxNV$;U; z$j!-QSHb-U-o*ab4e5WeqE^Y*_=cb7E-k z=tNuFEf&AOdGjXP+uI}{gVAA9O(mLV96gWfG%?9S^lR6w#?oa=Sg(t~!|on({~N%i zOIPsjxpQ*31ek$E>jC}H`vibhR90fq!i8vTY{a4^i*faO6S{kQP*_la!u)&`vP&Y3vt7IP;8UOaoOK~20e1pG)a>v;ZUqnYP_C>X&s~i{1JkwyZjvq#0d`bI z0GUzR1oJ`2dQ*EEie= z^74E#v~e~u8op!ztW<0_ZP2-n3OiV0=RS9zUMgfc<#@Sd{C?_!NHYza7Pq zOI;zgl$9u9$($QMeoiNYJq1KZc!)f=C3rU#0Lv?e*AL=C_)uIOzy4hTu+(0RI&X&b zoOE1R<2WZO-B@Tw&KRQ7>Xp=~;c z0_mgwrt5?q4W=|H7bd!*z9gd3i=M&Wg^+6&gv@#EP`4yu*|}NGxq5ScA%y`DU!bH= zL9m-#+sc=tDX%q1tWDrAms_piv%U!v{Kp*H!+A7u{o>aw?|EZ#XtnGYp^JyN^!YOM z3L+mzmnMV=6WX8N?Q(c`r!)m3M@pcL!`M?n_hsi5ch=CyF5u&@zt@JLu7P3Y3pSnI z7rk+!dv16uCmWcF7Dcmin_|1Iq~OEdD~j=`bs;p*I|Y(((S~EAj45+-FE{$mSkc>0 zjRI)cQp_A8(8t`OvN3J^Fq}J7)^=hSJfk~Bu7ecSk2HM*Jn|1kHB^JTCOTw;%peyu z62_S5pD?S-aY2xBh#Mf~EBTAY6&tat)nx^dMGV@8qc?{-86)Oa*v=#WJk&CUEjG%8 zu;K=51qqP-p zy>%4NJo8gL@x%}D=pzr|10VbVPMto5_Kr3*G%UmFl`FBfaWxJfI)rcigCc=D;IaQf}DXzT1jW=<~h3yX2Rp~}CJo&^{TLma#O&-e3Jdd@-8D8g z%%bNbBSU;RCYBkEWd=ux@i94xfdK-y#<6zI8f@IO1^4dRgOajx)~mX3;R4=yhqSz| zFdIn$7&*X8NP9XUGs}phnxcy$3{IUogOg{-GlA$r z8LYFFnUTq5VhyUHA(U5DV)5d|SiEo{s%omya|5mI@XjhU6n!t|t#MIhhUs0i4X zSC9aGCX4C!_4jidZrZd7k38}yPMh=zhbSsbSdiIZIukfBw#czTMTV!`^c21<|koU_iWG zqv^5U7y-E!z*3OPTLG1QB>m#;*Y*;_xX^QiJaXT3gxupSE&f2(B#jVAAPcdG2!LUh z-P9EKwVh{9_lUcvVbB>!RQE|;uQ>-3`If;eW&s*DACD*VJ(tAM)e5l0e3q`hW7u25 zg3^3URKXbnvi$ah#Trav@c@=QuizC6ts54UMkAJCCTooB>4sfx_6cHvO-#*Te98b= z#KK}-tQlToB^Uy|L+MPj`ydIq)8znbUdZ|TlL7Vg#% zbx2n0#w6?t=cNG^1yKwv14Nk`1kc+HVErE<0Mz23Cl%E?ZLY$N40z+u}N1 zW@9vfb;!#gWaz#(04q?b1gG1?BQSpCXdA~HfL`Ca3ty@xu73jw?G$+=@ku>AySVl> zyX5Vpl~RT7z*-bm=9KdGZ4;qy_~vFJW?U+RBY0j8&GB~I!!1DkBI;!woxZOMW@(FT z#;`e@sLef_Bz|0m<>f1;x7H=>))bmf4cG9_j+nzKO(wSz&YBnsvgq_o(Kn7CPoZ+D zjQI%nJzx4svWlN>fmO`xZNcYM@59czNPoVNrOVwsX=#g#q!>Nsqqpcpb0%41DwD_G zGg5Ua%l4He0$>Ho$|FT}R}}2AT1><+^0YBLMvV%!@ft291{GvLKHmvpQZi&unK z%`+^bs_uhA-_Oa;vLF^QqTC<8g;qDfKvP)I&1^9qcx9Mb%HA?J@G9i4ZiIBmAVZZj zFz5g)OfYhb^7Lfru*-T>PNXk!l{9n5MvRKs=yYmDj4_SMsBI|inE0%a8yxc}aJ@xY!v%<}5$?!=ihr*P!xA)I;p9h8(;puDmY z^XARNnw1UMarahar2(DYJ)Gu+%hxbDJ&Wbo} zy`(WkAQpjHMMXu(&L&Vc9X;J$=Qh*-a1q)&I&l2hG3?v74`)uF#<}z7CCZmMbW*F+KZP*@amUQh#iB(Ev0_C7 z?%jPaHg4R2y83#YJ9hz3KKV2b9XiUu6Z!J6j+W79qJt{|N8=;ID6gu*;w6hXGGbv- zAx6f=n4(Cog|k!B=(u?cH=3Gp{aO>o#>O!{Nn$?f42U5XLrFyi7B5@IjJo+XHM~Ym zPffBW7Xj!5W)b6TXmE&usnM|!6crYtqN0pl4vFDL(IP2wCAm!w4G}|a5}P+~#v>0u zg68W@xP0j{I@;PXF+Pfg3+qr;T8ylWENtF#H$L$G4R;LY&?~w23k%-sx^LOa zp6i{sl^X_;MtU^OqweL}Bvb+dU6gr6tgG?KNsLWQ2;jmXwLy$*Kn#zS%K(#KH+xIc2e)Hbk;V9MLrQ>K$CWecL(wli~|*;mx2BATuO^p@#o z8O0i<(CBAcaCSym+^pRu0G95>cE4qpLzx2#C~A+8uGZuXfmJgYB?cC`MNfGEmI}Nx zfHg}17U^Jm0G4QCi58~F1UMR49EI@9-~G8AJ%fuv^rUeHdEj7@^z3O$pR5v502VQ) zh((p?hZ?l9C>ISig@&FU|Mc6|KNk^k&k;n9qBE(h0 zeh?fKkw{47QV{U^Nz$xg3iZk59R1}_(8d8kEevP!f0kMY+c}v+_r|-Ar|?orgE4x{ zxl2__H3}3dzJ%IOevKLk4u@B|+Ra#PCt-t(ai)h<)iD zE^M8R;kkW95#CQx2t$q(_GX!NqEvfIfh*(AW{hQJLFp~1MAecih)02wLqc(-w9WQa8pxFp_~LVT_L-mJ zv!DGmKL7d8;nb-UXluKPrAwCZ@8Ttkv48Jg{K=pGIj&u6!QkK+e(l$O1E2oP<5;w) z4!yly_|cDl!T{Fwrkm*K?nQS`FM~+r#@5iVoL%Vl+_M`C>gsr$ojZRPM~)uG;Lrez zrso$FproV()z$Nu^|fQ$Hss~xU~p&%7cUclbp>5LJ?QMXh32Mf=u7o! zSkbT)J9h2Fzx&lMVRd68yUrawauhGU^dgQNIl}BI6Hw20q)L#(T-MJ$#h>rD=U zceCj1Xh%;^4+B#Kn$c^-!XhE~tZZV0kzoD=`uqBE?b>9VKMHR1JlD%6&tmtxARDlS zU7>`HB|1hV&@GWx1wb?|-Fjg_2Xk86h?Qo7P$(ea?u+6E>Vau-dxhCcEVyMDNA5oE z0$3V-P-^@0wI}=lmb9?8v(;^~8d!R1BS4FF9kdbll-c91*&euP>%)tkM#+_ZQW(9$ za+Av<&sJ6Ub}kze)u`{J3?#5l+HU0fM!&)sBCNnf+|zuFIKIok(z*($W1W8sT7z@A)lS}Gh06EHwz*NKPw(fs+yaZkA zJ+_-CF`x`A119OE7Ug9G?m0TA1ufGsL(EMhQqMYA$cz8D~`m?>x;ttg6x zGO)h!Pbcu~$(xFE#Vw18j{;%G!f3PT+rN5y09MKk{a!7)IcZaQbx$3@@`D5^9kY^m zb@H(vY!`PtrBnz_;0|ndhb5 zY!;buS}R#%u0_M;2)vMJ;j_;sTVZ5&&8d%kphluM!z<`8+28Am60JXf+bIXi9P!U& z?d6|_t~nJ^FqdUyUQRYV{4+29y2d?Rh{fmSE#{u{qlWh6c8b672 zUDu&%pD_QkeMK?ezmWhe`O$GoN$MeqBQMbvs;g&WDD--;RJR8Pm5io_xQvK+urQYl zh^2Z?Jl#YGi*-RraF~t!GTXzAe5>rBH=dqNvNb}P0(!{Q z1CS%2>mN$C!&2Y7Z+pTfd@&y6)`2gh$#ZovZD89d+3b67<<;4mXk`#LQ|YtoO-*?H zjRSb?)tB(nOE2J;zVLZ`@mGEsP1moYudfHy^Qur*TE^hgtFOL_Z++`;aQ*rX3=NIp ztH1R%eD-snLV0BwnwziTAHMS)oH+FkI=lPO)ia2Z-X4&+N=ZdI9{Wy`U1$4+hs($uk{{T*(KEn*XzP>)ptDeU?VX^EOuVoZ*F(We#OP4O@2$ZxwY*>F6 z9(>awkM5Aalxea6&98UU};-gI&bwXr0)S(#9AfoD*^%u#9{!;5%H&sECCzo0xJz!3}i__7mm_t zW{27#RPQ+gSYex9iUyy)8uGaRqeLb_^f4@$Z1B($4Pfo{0IU@E^e;cufM0)jMcnLt zpGwTYx@jLz(9Q38txOHT zO0g4fw>0s)N5aFgzqdSsvOV|2-GT&1uDhk#ZFX)4a(&GhB;Ia)8;uaGP+Sssp#9^L zxC3cA<#eY=^okPSHeo%JS_|IU^851)A7OlWaUPsY*C$$mBUgJD5l}NM(O5}kp-9kd z!9625OH$mG;=9khD1W?J8rjdbVf{CQa~~J+Yxix}LEGOq?^7#LWP^loID(6Q!ciX7 z!E!oGn$UYYUgOHwDM>5hwOcsr%YGl4Y=TWYSiz_cviEF3R}Md_b~iDwHkA47R5sF$ z)(RWv%)m1HhSi8QhZ*A*p)Qb?wPhJtr1{|iSY#9uXeE*9QSOq>df}vn3v&OozaYZy5pa_7dUWNi$;szoOssNTUu;{Rwl}XGC z1H_Rxk|__n5E@-9X>Aw8^3USPfulNOCVx)Fxm}l5lCt^iSu>(t&E@fs9X-7T(!V4Ttko2nZ^79bO$wGH$J7#C57?4@F zc0IOjz8hmBjP4a<`7)h#iG(m#iM)-Wm;>Gy< z=Y9bjHmpZ^c{$!adlm-|y@_|jr(AlxZP2_d2>Ri`B`3GhRvHd z;rD*;_poE<4xWR@-g*nqJ^w8B@86F@hmM%2US<~Pr2$XB85EZkpsb<L?$ zylD$Itlx;0D_5hX`39bQ?m4{j%4^uWcdv~K%DW&HBMr#P$wq!*0qPdiVac*37#tqN z#Ml_tHa4Ph^=dS(T7|BTZv4wneu@*vPU7OFOEgiDm7UElShGY4$;d|8ylSjjvj!EF z<%q=y#K~ZnN{ZM>qVmm6P0Xyibm=mWfdPm*6%v@Aph1Odi$ih+HWDfJ%X8vtmrujC*+uW^Q zUtmua9W)cH!$fY?6;cv-?{;a}nxrLDaNVvJrrx~LGfT)^gfQUeF_H)fWB`!CEBSwo zPH6WQlZj_5_yH`rlp&yyuxkQAG>UDy)yndO*sTns$DU)Mad97{=y?QW5tE3(88TJ) z5=B8B*47dRv+PBN&7^>sqe;b){>(UF_7So4jO(fFfoTj9+h~-0rZ+IZy@WFp(zqV7 zUe~O&7YV^z_SH0jfac%ouCI2jvuCP1A&mxs##CBB8El>|r9}88|9y>YENc|&gH2Bv z)}djRv4$DA3@qHvOe~5%DCHsmOBiU=v5KytDHilk{~023DA* z7BSeF+UEQOPfd~kPBwW`IpIjY;U=eFdr1JSjd7;LhyU0Cuu?QMXpsKo8+)**s=)Wg z(AX4qe)9!$YaXFrl5*2V81%mPL!1Z`bcersvbfpy3pQe)oE3${z(b-Idy70i)l%6xuAwZSRmQldWf|m2&P+1=h(V#c&VzbME#; zOs2#GGCHd{HJd#A-hiD1wdNCd$eQXdZlSN6_u>i`Rk`2*yB+XLiR=jma>|2A3@7bNU}2kmbGT%hdu)euOE!-;)m@U;b{J_>;Hp^6?c+&@SP|hdqD< zNrhJ1au&F|p$Ly`EcIzoS@6mL69V-30W5X{QE^&zH*gLG%E+Q5$k-Hp6=4;55%mm+ zMeGhEn$E)M)_5cqmPP`i+fYe^-5XdK+SB%M4{|y`1)Pu{!LN)xWb`r=xFTy?T`WYq zM-B$65ktTgxe$u(hA_m)c4kA`uomPZ*kdT@IOcx$^-uT+l9IaLiCd+(ENC6%dkx{8 zeAJ~p`BHpPr63#-%~`FYFCBb6;Q)NMUjrZOE5K|_u`*^I*L5e2fgoZ+y>ajWUVmdB z)~;>DmQ5R3TdKGqA3L_+jq2)Z);)URg%|McZ~q-SyZSIQlZMAX`Dtw3z721meFtaW zeH&-ayo0XpUUs`HDXBnJRV6<1;Sb@FhabeEMT>auymjn24jw#+z5DiZq`;Lc8Zb0G zgx=n6T)%b|<71;()3^p}8rPz6)f(JvZDW!7uAWW|4G*AlUIjC$SVX+Hk9C=7OlL3{ zLE|(NAGddLaWP7ZOOVHUV+E+Gsb=85?N&RsY~G4bee%<&B3I6W0t;YSutoK% zqU>JQ8!}o#j)=PjWEe;=2YSOw(d9+7(a4pHbhn)7uf|1+T{4X>7H^g8O=iFhUZ({l zQE)@nBTo;}-Mjr7N8V+Hj4TEDZ+{KYc^(Js+XcXUV?itLJj|=D0$7G2q`)78F*CyC zu>h9ytWS%~Y%XSH7SqD8mqf5#02toWjE15HNU+*hrdX;&rHn5EuW0O%+uOv{6ecJl zr~xiD(yi)3S?x%g_vTW`S3l!6Pug0-mJ-)K27M+q5+4DbvK~s%6>%Na6T0qi%HkqK zSy<4s5S=gqv8>A=Yv`#frUwpM7kS2?JX?$7tOu%ZtjUw!{deDQ(ham9b%AH9N(e$|rl zm#io^%iLmmuaTe`Yj6cCp(|Jf4n{^?ac-8gT*&_pjf%>@8gan_(n4O6m+gEkK;O{V zB-8rDN{jE6NC1nY5E=$nDjnyXR94m&;hvRMXsjznWpNAzIhh!noJQ~P1kT?az+0Dl zaOh%}ptAtJ{i|CeG_Vo_ScSP+jO4mMl+P&La>ccvJV#Lw@^eTx%j=lY38Iv`?*PlH z3$S}t6;{qKLUl=u-=Y5O9-2UF&nWhu?ZAm^y-wKGuo0i=GpF3k8 zrTN*&%}xgasGS4jc&DWwuV3iG`PKoOFdaq;Tph4kK_(#%TP?3k-D=V<7wh(n?xhRZD=+(i|DYW&E;rz`( z9KPI*cUlG_@1PPLmT93c&hu-kQNF|D(=1Rp*PoosbmZkwsA_-v^o>x&qL7l9jX78b zy4|35^8ZMhl|?z2SDeH1pl5gzOzqrtCe7)~r~#T};6_~W&M9l( z!*ND_(xjr88fN6<=FOWpe&RR|A9)i8550lxSSAYd@-Q+qh|2OZ{Nm?7k9BL;FtGH} z%P-+?|Mu@OF)@w&f+8$$Sc&p^Rk(WnIHTxn~#Z>+5jrIB8csj~lJc zXl}WMt5=(Fv#k@O6tNHK$d2V9gEW%TGcYzXjES)k#Im!oZtYt9{_p=j?!Rvj^78U< z{NxEd^V~Cd^T;8bJb4;v=~+li&y>hvhHW=7Hja^zK@=C~qrAKXrF z-n5z7Nrw*|!B79?XL$PQrx`TYpIMnl`B?b&6;)C zx@8-N{s+tHnSc2i4(vaG!-tPB9!CHcGq7f7ky}*6BKmdpq(7E{k&$6;Gh#?pl$D_% zKaZm>-fC^byYHOE=;#;<3JWp6z77i(EksUkE^=cz$j!-NeLe!{hew9d+0lXi!2yg6 z4I?Kf2eF(SW<14mvQay~hV8$O_71FHw*epg;D@oGegP^gs~mkIS+(pucP6<TGaH3=E5RU z082#hr;QjoGv6Ge!}3e1gA|Oh?)4gRkfPd&@VK_4Mvv5s7u9Uyh=9g@k;TQ$FX>)! zUm74vE`vlHPA`9WzhnT*xSyK~9IN$Zbg2lVVg{0RrBeV)BLqrt5(yyck#KZ4s*5YT z1@d?@z?Bum_r%-Pb&wfZ20XPbXlw{dPdyerH$iiWM8KaBQ72GM?GCv>^VsFoj$T{Q z8Au{G(qE21I7vX@w28JT{V!?)MlfDAvwQ%S1i4U`LcTmRdoT?FT31N#D{aM>9RSOn zw7yL**>T4AqBpw3UUT-oWOjSN^b45K{zFl+v=ReY!$~*b;4$Fw?F;b-pI8_7-beqR z{kYN=h(>6hdf}T7V18+?@136>yMb^1^Qn~c*Lp6l%EwQC_rAFIe)~Je@zQB^>9fP$ zHdaMpHugtF6C^SAxF1PFTnH00uo6|mmLv_hcU2XB>(P}U04v!~d;b{z>cvZV`bZ1@ z=HG3ZJAjo2Jo~$QK<(xJJaMQQfB4ip=A(E@{3o{6+?Z9$12P3zGKqF5pJ=6yP41cvHCHr zd`+N7`XC4(4>>PKF)z%zm8dzQyCBfUZpnfP+C&oMWa&@gpo90O`9Hf5X)6R*1h2Ja z#|UZypo%KL*J*vRT?p#JmGj|U@EX=n9R;w2WnsQCE;aFJl$KWY zOe7aM*cvUM1gk{YivK@93ulkH>tI`ZJL^FmJ$?j-jvPY&P#?yIhtb{Hfy%NneEn;` z%`7ZpWF6SQ58wO#e@A9k4k{|EIJ)1+!~|My-NL}|2x75Z%&(b`hNTVId>6S6Ze?JE zfDelHceUv{o_*m3Tx)LPHH{+Gjg1WPF99aw47LDydHI-`PQ&2f5C#W^Su}mgvPD?7 zd?~VXvY1KJ+HwQ!Z6Z2OpqFJ1q-SAhV3+}{iSbD^Ha6m`U;Qd}@7|4t3umzt5JwMP+0cOh?d#vb1NYyL zlF|~KIDHb&JpU{XA3cIoXWn7pD=Rz3g7wS>K^n$K$1ph1hupkO6c*;9keF2ERan1n zJvQI91v|FyWUa0qH*qh`A0q4D6*Y!=;ICiIE zmo;VTxUTY^29vV0M7Z74!P1p8xSQ!ZWp_VaD(48obGbKQiVwgN7edi6 z(|{#rZ!m6jJ~u+cbe26;T=6(BWq5Ht4fBdXPAggGNN1)*lj4XI7YDAPWiG9X+IhW%`Xk zD|Wp!`eF2!TreldT~NyA+D!@$^H3uOs~P(YSl5~q!|F~*IWjcx7Efw zQlxn3a9cd=m4LnJ{WCm$Yt*G^1w@&%(E!#yN5nnFOfbvrD`H^-Fs68ur$NRw=IYR zun6$^r`NCJKYY9qAK6kj=Q`|tw*$ZZ-4nvni94W%jDN?~omfSG{)M}+qJ}p9x&3_S zz;(RaGJya5IX~d~r_WxrfLy{9L#JjM126yKLH?e@u(6_H%-Sq5v#v_&Bazxq`e{4Bz_YGVRp{E$_kX1mGMEgcc339&YVVb>kSMJ4xqQY z6J4F{n3@>H#DvjtnIWwk(q@VwKd%rOnb|y+$qlcpyo3*Q)00zZZ);<~g_u}lW1~i^ zg<2^cBSWJY9i3!06S2p>@|#}~0Bd0_PMkc7mtKAjLqmP&>mNpQa~lI#?Oi<}{(3=i z2{N*?8AzTQAIH@A7}tG4T|K_~8((1tR@J&%45)&XjnE*2k3l&2WQ|{NBCio__XOXYI9zAU!Pu2nF3BrB%RrntWa;DI+S&=Ae>20)^jk+u%p5LBnWS8-H${Mz(Y++# zN&qYg0OPpns|{i_H0d40hSEACFPx6<9< zyKO(BPGVe(E!%ra0ZrNC(xI6{{U7nGf@E6gOBaU&)+i- zvq#5fq0RZ!`j`x?04m~Ch`(mS=PX%5y;sE4(oZu*&*=kc->`eV^Q){pvD!U87eOt# z?&j@Uh)BI3U`*|3E<@Civ1Iq!hjQ)$ex$$mu6u9D3Uw60R z>AspL$B1U|N~0nQz{a2zZQvNdN-_YJ0C}z}rOUvQlVRg-U~N8ayVC8V+7fX9Sf>4= z4g?0&IsXsbJWv3up|KGcE}X-Tom;VC<2qz!ry(ah7bj1gV`&Gbab7W5;3n%9SW7F5yMI=5h@x%F8i%;v|e6GX^QC zDQIqM#qpCTajxtFDl02cRauUTOXbYO>h2=OvqskHMQTbKa`OsMTs#ydLraj9EZQ`k z1Sru@M+fR^YFR|Qwx$lv&8uXS3*Mv)zHK?ktLv4K{3nUZMD1lfbylbV%UfpPEY(hy<5#IIAf5J5@SFs!3;bTYe z;>&BX>Gdtxy=O17a&nQ8nS~T$ZxQ%0C=q?ciXfM^?hf7 z3}D@G!<$%_YR9&1c>d4N;mN0-LVJ5BmnStNoq;RTvPvU&&GvQ%ZZb16FniW4ESNtJ zZ7nU_4u5*~SsdDbn0MU-9Fp5$L2(g^h7HA#p(Q9PEI@i{GBVTCkei#s=@4K<>^fqS zRa8`YhsFm2d*R~A?XoNpFO$0r!1}+^1}F$=vYYqOFlGgumNw2A7*ytZicd0G74c_f-`GSYb@6$M@m|zYC$2 ziD(x>dM>ux6b*o1ePAhOjn4a$YOVajYpgjXS9JRJ((~Z;Thw;g!sOn?Zw7pHNND$`4<3ddEk|gJaHJ$ z>kvC>c4&ZO~`jc80a1w^6IC5=u{fk zh2jNhBJ!yH(mUI`i7IfUTYHOM`6S z6v$#hde!eT!t}B^)5wgRirFm52FW=;@Dl``FZu_twDoM)iT=jU-@n%y=%0Z_%$b^+ zYHZrP9?w1Z45m(9S=g9Xl2mFP7nzS6=1*N`l@im#@IQIdi!0G&DEi*vaEKb>3 z@-kFbl%s_-o!UE)LfT3R2@GZ>3`#^=dM0Z;Em^t*ot^D07G87tGP|th=47*2ds$gI z>sXySc@|w=PpnrH(~hDQJ6k`7H+%k4ix0& z;oyM-_~SFr;Fpj63TKUGj2u1`g#~%Y&Pd~WAvZ+MXKxRW_xid9 z)+M7ThV^wd7+PF}sZ%Cl+0td0GkYFpPM?jm)C^{oh-K!$E)L@F%w%SoQ@BJ~Fv`B7 zO*OH}+$ec6^@!V<00un2Q`9tajU#3XgM$PpQhp^0tb$DpTqTouzX4$=ieqvTQi+X6 zb2GE24718;F-iK$4iar9Wu^*{rS9L>S(TDcP2Sva6<0rNX)Ow9=iT_TNn$=%DI;}h zBY;I1MGDSHojTD6t>}&XtkGxVH|U~kfmrNbX++26@I`B8=GBSzO9?U9C(J7X z`^4Q+qF;(HZZjvn8WK>;)Wa|7AGL<3kGj0>SjEr2F?-!iH&6W{;mg`nU5>&t&Qgx|e> zE_}nz0M;AAHL&6Uu*wAJtu;Wj=%dzfI70y((f;QkJHa=-s4&F3-C~lZl66pp-2}T20?snq& zhgbIFLg>vJwRpS$*6FGiY&d!u=P$Q{SUe<@O~UHe%_!l?Anc-neEpX;u%NguKEeBB zQvCJ%7exYpB-sAswu{($vX=FsNW8xwGX=9o<>B_lBQU!kz)%3Jel)Q98LY&BA}uWc z^~Gn7;n!O(ggos72+SR{2oU>iLGV$+|x&VERicnPf5fdKC}d5hGc~1kbtk3 z4_0CSg+>;(r}qQ7##_I&-O}3%-ZfAF%Uj}LpCDJi*e-;& z!;s`B48V%jRCTRgsBGxug>+;=8diO2vjt%3lUEO9QVL#^#m!Cl_RyExh*!q~Z(Lf= zKvn`fpI!jQhDwat8Lar2Js_9*fI#={VdHqj+H!T;QgEH4LYiWwPohF8s$r z2~6V!S|qJtcMY+?R3iqlml?XG7j+AVW1R#1M$Juncp}(!pX@ngY8fpN>1H*2h%R9Uhp}__K2%iI<8oaKdioNPUyzSA zYt~@&sL?og{v1x8K8>TtPhjYY8eFb$6n&ssa}- zUSM~^j(;-FW5*BUI3*oNayO5TV z!2pqpfb+)F2u>4Qh+Np}>+2Z6nmlnb=Z63+VwW{GHsbjgUcj$^`#aP%HleAdO~!6t z575_*?94QF#mvl1M_O7cs;eqcSKEkDBTF%7_I%uX&%In9R5wpQ{S^M|M?Xe$ODoSy zg(X8#SX79dyj&!uCZnsni|3p4)HK#9Tef5|`g(eBxvGi*tnJ%&qO(J^$dH(XA;X7Z zMClj|88!?hMT3!|A2#qr^KC3{zq`g7L@uK(UX zbaZrzMpk#XaU*nftCV@=GO-3BiA3&Gk{Oht(IRVs0QoK>R3pUMV1t19DygIqLVH;!T?yzcv3e$W+b`nD;52wI_0&_)*>|pa?A!k z;4o41SijNKuhD^$0~N!LGr*rL^G4f|0Z4J5W#M?^qNj&L+zU)v^ta0zRv=4QLoT?c z<{5#Q1i}dTM64x=SShZ6>VoH#)o5}tQ_NyuX+23)KjT73Ya9bi6gv%=EtE=w8y?#~_yKO&Zri?mq^UqhN3{KB(Ut238*=fI&|mv#;oYyuGu_ z09jpJPKrb-2V@dySc1eD0sO=Sq$DRYcts#CGZMKX#l8_2Oqq`*nqyx)46G2VPK`E6 z`>(kC#;!N1uswkPWnr)PZc8MK0$_PXtSPPc{%AYO>g+ zfo0euArD3ZSh1clEIj+s6+Afn*O{socBi{g+v@m<`|p`Iwg5kP*L-gTJ?ka` zu(rqSgJA&H6CM%w;Ny2J9*Hm9;T3VW?`m%E#;2b=6ap5?T}8R6`1*abvCyaIq-p$O z!&!XwPserM49!0a$=@+8^g9A6Kl!^uXeF!1xx96J|MJoJ#9M+oZF>8_0j%&X;S(QR z6cA3QNPlmAbZdCKn9~y5pj|Ys0Ka(e{J{NpeP;&_TxbaF7yjQ(6Y$U1l!m7N)b?_G z?YZM15KAwYJ(Iu@Cf|L{7(8&@*wB9Y+L6n6@6V$HD-bI#9tKvtQ)6rZtH+W-cI&?+ zH#MMv<*y7{OrF|t3BTBU0p~88IWFEzX<}vp>2IEQlZ^ozSYO2pE~xG3?7W=@jhf+N zP6ZM3VlZP~ww3+T*g2O?bG)VNKd<&30Un=uO?X}hmUi%Ny9|tu#GI>~?xI$k={K>u zTWBpgbT_xo!_$Z|KEmrh{9V3Mhk$=!&pDr&`(wAZ_gkk8uK@GLXX1_1vz*PQmw_d# zzc8;1kfSHN#sxxzZQYZ8a-AT-2t9G<4UV#-98*h-T8*Tn5eUg$fHkiy_X{>Ojet9E z0z@s{;VcL!6%JqtBf(`~@x9W69JYb0-J-%3?q&*CiT{6o-s?&jRubtItb^0rh0UAS;i=#M7E71R z$I4Z!artr`TH8BNke`q4?sid4MU-Ev$D3}x88_Z|BUY_m#TrQ8 z``-6(_S`uJkQOXlh-+3|!%^q5GP3aMtLw03>lPe2au^ifY~-ks3`m_ma|%sOP3UNE zV^Ad}F_FQZ_Kps;w6x-uHE+g;KJ*Z}ySs4tay54C+KKYA3+$SfpP$P*GY1bI!>g}u zLQP#0+S}VPbofwa9d)#~qjdBb+;zvDSh8>t#*Q0<{Rj47-MW`K8sXui$B~ejg56v)*n{L61rOPmN>Qt0flw;eDZP>7R6SnWz&Jq9U zSy$($mvz5VQ`3Z9Nm2V+TUpmN)otd-Kq3cWTdAdJw1)JrW)!RF=5;Uj`sMDx4#3WW5%GYtPD>*`6T}1yWd59 z6X}X3VCblkC@LvNdPW)&Q<4PuHfqzeXHW#g`K)!;(%g*SKk)>%Zry>VMiPl9RBsT9 zM~_D7#EHl&9E{wYEOfTFASvMrh71|ZW4*4n7QH>hR!c;BI)Qj;XlZFdYfCdaI$DvI znuL;~5-eY~5^HY06)@98IOUPxB znuCR~Lx>oYj#X1KpQ~G-^4V+#R=^F@iaKl9yvo25V20)a0 zY6n?Mt%7^HhEZLKZRWn8>s_M;n)OZD!o03Jk^5ZnaXw#T07Y0_3^Xc>O(Xsi1J3aJ z+&c|CQ6{Rc@t4Up>8 zpJ^+0>o?K_%2=j@DrR7D02O6qEAv}y5Wk7U3^8(3WY(H6u!xkx?t@(dV3GSE{hRf~ z3-*cV?_7O!RmK9aetW>phE-MGiNc#x*1-B$YygXGH(vp- z8onAUi{7b=P;AXf1R&s#r^-e4K>Z3{Wihe(gOVCUlxP{hgS<=Q53?@ zK7A;1vnc?UHyWO1w7shrcYkMVK=j*oHDW*Z#032K-3zg3yjPT*(y49f!phIBk5t{E zh34f?u41N*|9bUMH6D6wUtBs`?_4zo53iXNTF21pZWx|Ea1Ltoi!u^1PKLim3O>Csr`9?7x1z{wyAS;Z)%B zuucBWb4&2`d!~mn{OVH6)Gerzw1^!LBRTXh`op>PzC#%Ab_Rg&?vgLiblUIL1 z<*m-A{j6u<)ntDfOdvE%{myPNZtz$OW-Az$g}B=^tk6*pN3@dv<9Hcg5mo0+F8n|% z?&3vNrFn__u878u!%T6eBAZ2K0a^X^0ULyzPXHEcV7U?gw3n(&9Yqr3h=6AEDd#}s z5+tY9dP>X&se}jOT5#O#SMR!48F30DBeD_44P_|QIV+O!^%Cy&F_Y12_vRgJp3 z2K4mwp!#wpjvYUOBS#M5(BWf9Ny$Kd{t&$REw^FGk|i7^kX!<{ZQF*XrbdodM{ahc zdqjXjYim2UY}twvCy%4=N-qnOmy{GU^Qxla5(6@%XGQK>$%#n}^3Z!bI=gVoEo<=L zgCAfQJi71Tp#!L{yo6CBh9NH}lL4%==PzO3fup!oS<7sxAw@%wlbgfh;-#ZTt1^W`}gm`iBo5gnVpBUj7(+_G0U;<3X)S(k)D>uLz>t-1kz-s zW#HP?Z)6~hA{$oKRAcXfeGFoe23BHHGK;1w3x>s+lgI@v)p5mbZE0a$tf9pvm_2hQ z*4%OnMvNHAjF;!1e;&X5)#EsK;UX$)YLT0p$Doz4x4JnBB!LUW03}^50-;6?ABB0d z=inXpza5h%O#-F=ho_##H^2RDT&}A_XHO4?j~d1GLCgx81G~tbv9*nLuNKW;fNNH- z=C+`D@9B&a+e82WAOJ~3K~$%n#+J=nQBhIFI$Vh&@dwVOp63?Hv5VyQ(4NAw1Wt}wPX^Kyp zGk2Tut^ZaA7Q+<=)DYJ$1vy+6jN!LBX?f;B!$uV$chSNUrjNR-^)bVRfi(kKuxnb< zAfzOxFp$VmSq&Rj*}3i^f|(PQiKF0*nJaa^bWAB(8k~8YN2t!tmcgy|r)M2@z&br4 z(fU)yt=cR0if3kd3*e&qWB|*ExQj@+1q>P%lxj9P0G0`aBCRJtlE=ib4sV1ZC3^+W zEMx#Ib>H+v*0ZAaX#_;kmy)q5QF!Hm#y!Xp*G^u~oJGmNE83?_|6!nxbg2w$i7*6a zXE7)$=_`Py?^As>$9<6dpK%}5!YK>eur^8i%4K1x!>q8d+G8(c;o**ipS#(4_+I#J-~FgWaT~*TX-QZ;rZYuDLc+G|-h;dsM$x>cEXoJIVhk0E=9XKJwTeY&&6e zbE4MiD+zep$~`P@v(S@4Sxv=Nn?|e7zmwqiZJPA6Ez65F-IBt0I|!HN@-k`Q+A%_}tTn zoWogv!HE6zZ+C_RSYLYP2p-=|A(-9EKl$nWRg#y67am>_3clU@-EG+CsRK8?H%u$W zfBxf~Kz-M>bm981Y+_f-c&{fPT8tUK=#BL3qc5EN>s$y;9j7G^!p2XpMs~Vai|Wa3 zW%w+)|2a#Cw?}FdWuzuz^JiAGTcCY??YR^9`D^5oYb62Tp&Q5Jy>ATm1&&tuU%P$t zlB`-$)61vdG8y+R^J;ie06$`-nL#PH;VCi&O0U!Wt1U`3LNEE`)Z$MpZ zcPI&yTva#tq7Z6cNfh$F@9)Bai%sr|-S7MwR?_%(^tRy_TKS#^^e;Ez?{Ko~wJLqd z`wOMw+HQXtaIwt;?sN8LH+;kmlmX>QF7Q-77jP0$_<7 zp#g_9jJt}rs~(n6yQCIE>^6C|`@NoKyKE?NA9Sa4qbKI*y2v-Q3TVVZ7r;t(bYUd4 zw#zQlF!A)P&1SI2nQ1wzCUl@v7<)Yk@s9e)9{zU#YXF14|6ApJLi&Dr`FWf;aRkLB zg&0~gl*PC&m0!Z8iVB=OeG>Z)?#H?F=TTX888fEO!ji?ySv-8)`0@DjbAQI(eS6W~ z-p0WP($i9rmz&KZ?3GnDxL8iW(_u6;)MM1>ktixEL~dR#Iy>6=GZOu-D8FRfj|TDP zp0Y-pY67s{|Ni%(wY?P;l@&O8>@aF7FJbu5BIIVJvq*AvT@x;pRpY{?YK}~ppPz@! z%uEKbMvokYx4z}A>@GKI)JPmWxDOjPtjFOa2RVx3;2}jw&&XoN0=dMI*f+Tm=H%os zSk&9ojmCxsWTvKL+2W;GFn2x!Sapr{ICA_b_Uzk(1BVV_P+}5CPo(*PL2MJzi?py< zLut?;w6(UeyB_IPO`bFfH(Y-`MhqLlWhLFPC!Tr=Cr+J4*`*2=lh4S^C;wzaYwVNOOSiVF)dbLv#Q{l0&|teLY|IR4pZpT##GeH3Mtm1rh5+Q<G9lHnuJ z)Y^vDwiX7aQqz(#a^!I2WMtqQ=L$x$Zj>gq6c z(llKAhU+kY?gGr1F(V*N;ZD^uV<^_5v!*a%Ebz(*i@T!OGMBLHnVHLNS2X=xzzA_a z6mYOd*k;b=s6dUFmSwN72et-8OfOC3i7G;V}WJ=?B)29RMl%>)8842Yw$ zhgL3Ghl=Y-*H$+guO9Tsl0|EYagTG16v?X|5-D(^ZL7>@2C>ZU!n3y7HWMEpshhiT zyJPm1{IHn2i7Kd35Se9UfGh{lGEodkA4~=BB?6)M5~j4SwQ>|jz#ogbJAj|NR&#$M zR<=2)VgM_N7=FTtR&6gQ0wcR2O1rWi7rR6X1FMTP-k5nMz*UC{TtM;!*fq2#e{JgH`z8FZTHOVg9XvXS;)ftYmBs(coeL>j!bT5Jmu4 zQRbDn?}Y}$EnbW=@8wvkdT{UG0e)z5+7#25x6~|`v6Sq#r{mVyr%19vFiZ5(HJBgY) z{o2K2G+AbF-RWg;(PX&#iyKhe;stPMh`s#C@_<$rt&wm0_BN2~qF&)+z*`s+fF~e` zKs5WJMPu=2H+b9-_50WWR`eM1b`bY%%)okEkb$+>FtEb z*Bm^s4ZRN+a8EAzeb%`37z4r9hyoOxJ3W8+z$vYih^!B6Q8S5{1$JQ1da%f-=_E4J zpFJ+z2J?mUHgk;0o_R+cgEBfd);Fe+LX!)Bhx4gcn{SB2A-3VxEhzyOxAuau2N?>7LJvk_p! zQqqa)A@%{ZY~<(>dz^XACEaY$b0Q`yE(Iz^t($LK+r()PHM^|wD{rzUKW~OSd3WmF zwwgjrIcNO+9l(lfW(nTpZh^f$#~nn?%?+rntLCV8nHiZldFmvNA3KJF2M^)M@nbl7 z_B6VBdy$=)gX^xl0c&o4Gg4F2(bC$2wJ)v3sne$z1fk7WPggrf@9XVLKy^(6>Kd9j z;ui^!mkcdtS2$vQk&7QitE;ZAMosl)v@|uNgT%+#)mHl8Ti$XjKJefN(ALq4OBI)} zZTnVSICBz1iw7e=I}=IC$!KWlL{&{AF4s4sp}qlmdAUeWPe*G@E3=($yx~U7n==pN zNPPXoF>KrZI!>KBfs5r8$j&9#!3?-j#S)N|oWh_5N4o3nVTMsgY8vLwnv2=fXJX3K zDQIkIVljHIn^ULQokuo!vT-N(GjaVH#4dKE>!mt0*;$zwKXxpxS$z$IKGY`Lx9`A9 zue`zxtcvPtB&Vja3omVcDRN*#Ln9iSjH4cX~w$V^Se#IdFLhkNd2fG#IH8*5)& zi|>B_`#65)G%7A%MqzO=19~*3iN)2_(7;g@Tbr7&Z1ECYfBkisHESj_r=EN6Ic(Ut z8HbM?LtkG4iiZtHN?JOQn9Qz7y?s5%&C5Yvehvx>@{xF@4=oM#s4OeP`3vVUY{YPk z8a)aHg$2mWNJm>+3tHQn(bm$2A%ll7`)c`;70lX8CB3s`JA$>}x-slP)0xGM$pBc& zz%ncx+5gG>OdD<0S#mYAj9ay7AKMj?04&l46Sp+O;4#w|&C{gI#@av(EJ$WlyUNzE zQbBQQZ_&IGtt>rtaM)VLt<3@dtp(3rGhAEUsTEnM9oI;EjN95$1iCuRHJbPNIbqbe zsGzvUF_2@{F#(DMl#-}}%63xbjVwKGR6TM8Ht?Da#2Fn(Wu2+(q&wGJD;McUIcu-k zeY1P10cniplFNv4na^%HU4zuM(|nqfbWmf~Z)#>?Qqhl!vzsWE%D`g1FY0e@;1m^Z z?=}Zm()GLs7~2S{`$gatfjuk$YC)C0knh5fPJd9_!{|~`J+YiXk`baeAeOrO>me00 z$V?to%S!;PUUU#})kOeSFN0VFUQxcUP+v4Q6!kmS+MuypM@x%tKfCF(*I;m#y|Bt8zvMIP(9%J=NaitS z7ljKSYkktBbm(i>1>Wxgu=?+E;a$pPWL$A3p8IIft?pC5KLRSJT)xu+1N8mseG4#u zY`!Oba+72Rly7rPqV0eASnxduE;fSnvh;E{%)SIdO7X=zrsDR6UiU@1?V(>Cz}f>< zTGP&x!}HT3G_a1q!@%;_sRxj8GxE0tuxOHB@o$?@)7<4NY3#8T-nhX}{cwP_MYObL zoaS~6Cr?8f%*0JSByawS+%lZP@)`|b*mpn%4$9eF9u+`bqmVR$fPrvsuc&w}{t4ZeyofxCa9K(vRQkBjYSqkfm{;Ed1 zpcq!Rn}8VQ{;|O`o-gzET?;1=14{ucSCU`E(Pah`EhyK8koQN9xT~vw#fGe8ipx&_ z?;7he_p1H}eaEgT3KBVb7sU3G4U$F%VroB3Bq!tEB8(;X@rk0zIU&g*oX2#_l5v_0Or z^Z)vN4v-nBTetPPdpbDMUrGvz5hq~(zWvy}XE(NP+lJ#OPNJ@%9wkGEVdl))%)Gk( zx*Krp*hw5bd=T5VZ%1WyB?=1*n32;|Ux((#de(AkZtFl-cOM21DaPQz`N+%7;lq}; z)@Jl{cX5=y=B6ezHZ-EVtOB()b?E69RzhlO5^lTgHhk#A523xIopq;PUH1x(9y)-6 zylmuVXCgf<9Ua|$Xl!mrOGg(vJ35hC5%`h@5fwuKtd?e^CZ%Hfl&LICKV`}kj^=m%;(44p zeG+HRooD72ZHgJdqH&!}(W?bep*&IaI|@}#5dcZ+YxJm5Sg~w5h7KKy#6gMJf8YQ% zZ+RW(%ga$&eVH}2h|xhCQDR_`9$0fr6PlWuMQlDL1%2IJ7*SG!d+xdm3l}UvQDGrA zzP1rR{@Ks4@9<%qCOxwJe0J%ihp!<=kk!J1hz#BMS=R;t;=?I9XX$~cnQ z+novdJ7(tygU|gj6OSR7U@`NmtB0cz5+jS^=csHFykxSc&u=!!}pOmjldl1W7BRBG(uFn*pp}du=RFPxX!Ec&um7j%Hw+Cf7Jn z6U?4c{AP1d|Hj`j?c7HJSX8<3xPXu$CzQ76>s!ws!_U{BiM%0x23G&3PQL(F1Y?Z> ztj`XNNkzGd4Pb?{PG0)t>Ht%Q2JE6wz05R2?-iT9M)y8)>lEC-VvOf81+c<^BkeuW z0M_BiijD%Xe(>^Xe0S|hwUMporEi1{9}@lF`K31o1jAoHQHyu|Xcs?c4sQ7Gp?PUo z_o<-1+1_&vxc5I@kj9(&&>g>X%h7LKA1EsWSnD+kp}%jthJF;T=ua>Vh}wU?5qJM5 zG331Uqm?zXARR9~vOFLT_`uKiVf~TI&MUNZYvvAR-75d}gICVtJ8MsS+Cc8H>m_{r zUO%G<-+BAYK$^s4`i3%@tZyS3SWo%@EPsj-^QVZo|7{ppd(JiBp6^+1l$wYBcIS~J z!F|w^eYHgF=fWmZ&pZ^^&3i%Xn0ZtNR(K_bfd_8Z!b1Jo{V|?}&7>v>LL|dAvKssO zLhX;J+qfF7AsI6{`{vLaH8Ib&KSq-FqV6@+qmp-?2o%f$u$=amKm03vtTOi3ox?}H zU0(CI_m}sTzL)5R!3D2;H-ymng8-KMiiH!halHYsxcp4zcU=fYfL81dqSedEs)^v_ zL?Lt|Iw=F(UW07cb~SV;*An(yfg<^>BJN`R!w9-dG$;N^6t_d&_-N>Ltp)8F@=j|# zH!dVxHgmZ~zq|EQ));GHP&j!uqy@a9A5K-HO6lCLz?i?Y*ye;wKrmz16)%>0x4=Vd zz6^ss{|;acY=*PzD+<7pULh`oUELk5Zjp zEw{c6W5$fdkRio*{q^nGy>|~Psw&Xb+RXiwM91rEFQc)(7IpOvNKVZ_dS*5T7Y;#o zb{0>jr0LYv(atQVtc)}UvfA1@aq{G8Ts&WnhK42%d7qj*2zT9e7e4mz$I#ZN4Z4zmN#iGC+LWp60!L94 z$!+e$$rBuTk)rRB<`jWn8a1q^yBi&y9gb!XG21fI(;37XF>DwXFIvJ3EYevzaNqzo zZFwE1&YneiWhHX+^N~v6TxTabySiDoiP9s+5VIo(0reCeF*^%)+;$rl%%6{vqGIga zz5~B~@=0vlwHpTxA38|M!3yYGh)b)=vtmsEI zh-3~Cp>P2(G!|LHWRfa6pt+GyO&L!Ya|4n^?fD`v1MWVWC zbVB<%ITQ-6th$DAAMwKfF$cIGEO1#?=6KqP@TZ42hC!uK{|ta8b)nG!jhmYRZbaY6 zjr7RXsZ1<6sd0qV`94|;9gEByUYIpYK^ce5qjS9p^dVYS1_-jZJO&8Txk&&NiAqQs zW&~iW9-6k9m^#wN@|+vt(GEDm3~F{E6&6-6gIKEMpP(kOf)m@c4@vyR#u zV6|zC$iKJ{n)+0>nq<$Jd7ZV_1dSn(*dgvI?5H3j*SSOi6dgF@4oM>JJp^D0h^4<3 zpd)=hu^kKpJOPG>l=SU7$#?pZzt(?c|cs1NsJ7* zHw5ZOG_ZmI7WuaB`SlE!w-;z20PF2m6hbdST@H? zCJe^U{$*aEVt&5i9KQDF6A=|=^%!n8@7Q?xkre?jQ2;DUV=AoI^fv^pXKtQTf^Xa# z1cKiD&8;|D(c*6Ut*kwG{W!e;IWFaibBbw}A%Wp&Q2Geb)w~55D(j`>^3? zjk9osS5o+VF)Tj~>prnO@CX5D@B6vY!LlA@0PB$u5qAc#bS#97;D|vzZ~!X-;zAhA z^RKpC#2259>LXEOEjAorJAQBqQJvgb5tR|>^QDb!sq271nNHi}+P7?9q(a0MumVBeW}dJB$Yy=nshs z>9X!4u^x^nGxs64XkpdpN#9d6%c!#%K9<261~P^*>Zn-4z{->P->d<8T&fH#JzZx? zy*aa!$XOcQ%8;v^?m$l(v)f{0iE%A2VqnY(Uu}RZb|;imQ59L$h=eK#FRTC;#NsGe zmJ5Pg4x`E9?-q8GSR%j*AUWuh{oI2?OU;9 z=T00tbci?jlO|5aqD70bYV{kCmX^tzzavMF1G*ItH+6 z>*_heUv^F&rcIy0%pDT_CM~C?hI(XWrlY8^fZYw-+k0^C+(n!{TZRkgFEZyzk#DJkquOQV{=8KP*Fjv9l> z6DMQlOp20yg`+4QKYkQPPn<+^ODpSWB@<9Y%!WY;Mu@(H`#g*45#nHg!gb#Pyk)oXjk&%T-mFG=4m0&zXsvZ+;VI z&6 znp<0uk(-U2f_!FS4IerLMTL3D&&%X?CKu7ur%rR!#mSSVa#X_U(`F)(wZqH-L13&Z z1IxHEkpO#74|;kDtTfh<0$9FhinG?GY2vXV7c053cwk6QB#q2jmZI&xFYL1qtWyPxH1t~&A6gx=|`2d1jI7p z<$VV5;s}HyYOYK+?3kp2p~3A|zui(F!RS=5~YEP9yi1=S-n02Rv@B+((6Ym-O-8DUuqz$&F9&`QPr ziIGYFW&lfVn`p9vWr_GL_p2~Kg9FApxcuL{_NH2&_8q|t*ff2)GXVl%%?iBw)~|2G z*{YUk?+^ce$@rFk=%z_{XNaiyg_<_J`KudwAo}h6cmOOZjg-@=>JT;+iIRtDV0}0Q zz_JS+KLg8KuLAM$%SySFB;+Ls#e_c_00~gSD#-qXDGgQ zFBvD^>l@FVz)w}wJkag^8#eC^zkg^ErjKx`(vK`}7JFWO`j6AKP>R zU-{GV0BeQX>Xk>9g8(7>`e_97iAwl|+o#~pMZ*Jia|cH}Y>Mboy6tghI?sJ%>*+qX4W$pWDb$2m`YnkFQj0{A3Wo`pTbA;uo8uT$%fs zto?JHd9f@IrhkPoJ8e)Y)+@rM@0gQ-NsND)zhl&^fBd;g2fvXl4`A`~B@z9u{?gP+ z_8W##T{nEI9A8=c%gaD#V7=eBUfb;x2ahUHqJFdK-q7!@PLZ^R4E-i1!Pi}NoyUCu zm7YaOQKQ;Ksd?V0$We?v0r%y_N~p%xyY6EPT$x zzA~B6jf)%IPyj56JR~lJY)mqp-x##UjZxWPs*}Z_nyE07zH|OI#;FR)Ds#=HIam}* za3Yof03ZNKL_t(WCt4I4tOAhfDXjihcNlpU)s6kz)Img>xW~+{F>bdu=i5YAQgBOm zk;0S+pJp^t)m0SPKdVC#qu(C!@KU<>oIb~ zD5RxjFcYGSnEVNY(ACq;5&14&D#z(FC(%$_gU}hO%eG3j9I>;<83Jp)4pR|++9LmYbWdU(=Aj)VYep|RqpLW;o!lTGkZ3M4;z8(>}*`Fs>Ye~ z=du6LA)GjUn$w|;a9dlu0kFi?hsG%}vAQ}t(a0cR2HteT4VXK7Hb#vYffGlMVeKog zV&m4W*s*&rQZh1-N?KD_h(VQv%!~}y^s1_?z{uglF>&HJyyez4Sg>F&jvYJ3?5lMf zHsEq?9n#V>k)EExzbPsuwcW%C6EJP+WXzj0ml;)0{_aU!ICBp5O-;zm%SGoR9SMEZlkf-B`W)jYvz)KvHs&v+MG$&TRhBOicSa zW?zxZUr$eff#n|8euCbSQRqzb&k|>I)Iaz;} z@}MA=YK^J=X$J)nfJ~TL_J2}&7Jx-eL}}kT=RrM#IAS_b4&~cXPq~K=nzj+3N8(S+4K(bZIDoXDI33)9JfT&w}*{wScN zYn+;4T1Ex1I6dxb#8gwaSCJoZ><5SKEo>;)#!;pmlR(W1tSmFtE0ao>h>9))i@+;( zX*O<>oF5GyKz*6m)M|H_05U9HV07DrB`%{yHN#l&-qH?p04!q?Xbz(Row%2-z)*ibL#sILCffX}{mW62Ud-NT1aqW!az*8Um`EI;+xOzYU z7Im1g{bSTdW#9motP}61X3UUGyzp>PWd4u4%JGTc9kA-m zZo}wp8KpmKbRK^D;9^gGiwj|tTb=B?LjkO9q=BUo@=TIe14IE>w|-*_PF5PmUI^LH z+h5(XefJ+{$A5qG-svEwm;ZX>mp7xlz9Wtth7(KneDNA&_@W@5B7pIm+X88_239Nv zR@~r~w9!3FhKITkF8X`~fQ4uP>yu9%#qW1S3(3b10Jz0=H*x*D`Nr1(_FY$#qwu$c z&K~x_vWEG9@@W!w)BoG$S*D@u-d2Aqc;9VPJOqI7_F=$m$Rf+nh zMx>?@qiHCnPMO9VrOJv*6crU?)W}f`yd)$h;_SuqIDPgEj-NP=>dH&3f7RODD6FKm z4rFHK;9vgby;!zvDVmy^m~FIk$5v!#reSR9NF-b#Py%Rf?Lc*PJ&qnb!2lM46}Q~H z2JipC`%ztU87EGi#O^(NaOU(WW;v-4HVJ}fWM&~ZH&!5G)vP-CMYDQ~k7Yn8n6Dl`5i~ByYjb!8B$E-2JEb?-5IjSK= zA!Gony&V_MpTpVn7tq?)#tbalERseH>E(2Fb)mDfivvGMdbAnsV*rYDsU}UF#BP7t zSvjl&R(1I@&Rx8KOI1}!P9+VjMD%nM+lT|#TW3kM0q;c%fkv4bSiN#3=FFUl($S+) ze(@rI5GivTQgStKEO8aV`FwYRmRzOIg0V5MV5;iem}!@Rk(QE{mphmRh^ zs~a}5KA5nh2#6RY09H#gCQq4+Idf)X)yh?h_uOYJzbnf{w+UB{J+ zzz5?(XhfxTk@O#JxWI{Q_GNB&=MEOaX7EbD6bIlje=FNn^BfmF0!_`lO>f}OsTvG(%>jtm zbx@g60d{U!RL3w~|SRnL`S; zn+TJ(Fh6UZ>7kMV%M{3R>fZoi41jW*8vx5N`0UNU@S_Y9i&*_x446g1BS_ba*jI*uMZXEa zQm{@BisT?nTm=QdB4CzuH{Cu=k_E!Tk{3~#3A`f7CyjVWzY``t@EgsGf}n1Ru6jKU zTm54%`0h!Kni}pv@(w9$_=`npK_UnDVY12(IbW;Xk&X{~W_I@vzLr?wdV|%gI=R#;_uzvu{SEHs% z7{H1Gz8JvrUQqxRx!*nfTLQ40VdHDR=r));CLfP~V3FrV0RYR_9mvdm;o;>Vz|X#( z3-aM8thUh z3}D?BeD|k*f7lX4_xF9xyu0|?<^9=v=3&W%0#6;pW?=amG`I&1ogGFF&cND-mj%cz zANkE8JioWnQ*U3rdm3(?=Z&czz%8F!Cr%UjI==1RqHQ7f%8kk#(fKr#UDeOr zBi%K=K6@3@*#D_VJO?Ajh44~2F|dwe=l0jJWA`q!c61;mJr%R(%tdj@Fm_Qnefk{s z?%9J?D^}pmYt}HJL!J8Y@nbl8;y6y7I>`W7<)t#Tx3#c~R%b^S@^bU>!4E!!RjXE` zxw(nO;s5-nKO#Fb1yd%CLq=K>1|_ATrL7b7O|7V^u0>sK9hw@Ov3m72c*i^6$q@*T z9Y2mEM~~vtrE=uv6kHSZfQhi zcVU5%evP=b5tv3`OfoUV66yV|47x2^umCfsO=I`Iruuqz zX?*Fm*YN7bO-M=4;JkKqb)vhw3%%rGMDJ*C$B@E8j2vEqRV$WZ_Vj7&wt4#8dAzo1 zGs-Si@CLZGxs}E6>+9;-opJii8CbYz5pKTeCbTs*;}5@o8VC37!->;pFm&`N3@>0-#zB;aI0(8g>;tKPL8=ks^%e+m1p~ISEtwLe&m<@)te(9lv zxDRq0nK{}43fTS76?1ohnZP_|PpGc-re`Kx4h()U&0Z|NKaS#9j>!dH}+GuHDnLft??}mBhxL6vO zN7oHgtP0MBWy5H_Nfbh~R#-pu_SA3QKND~AMPy_E>ub_a z>~@aQlKSQgC-D8^{@!mxlG92!cmnfBqCm_&soiyxOkH^^YtAfnxq^(dRZf0G9im zv@dC3ZHxtAc~>&`ag&#LwqV}5C!R4HPpa`vwV`+Q19otJ?e6a>fczskpGM@_cVqO* z;>~H;$)@{e>s?M}<@u=G$+vbM<8dkMC%1tj|E=52p8MRi{bdYd0aiW&{WLs}{q;(_ z%h>ChL&0Gq$>dkx8Ka+hauKWR#ApI-`b9>>U0fKLXJObD*28+jZ1r3|DK+kWylIgS z93x*&t?kW{0j?6Ruo$}lSaj-XA^{CbL~>#xl8wnmA0K@1 zA*@)r618=8*tBUA9)J877<8ozqeqrt#IPa^E-FD&YX=&d+fZBAh}Kqeo$KLLn7vhfxf%rp1<1+HW`-ECp(t9MY8Mf8f&inYh9+dBXJPuZ84O~L8Z`=y zjrF*6sSG=J?!cY{hfvc%pivLfGcu5#M$!F}8GLJKsAo4t`swYZA7N2Z6h%shw4?~^ zAT2J6_(kziU1jV8sGa%q%UD zdCI(Cr5`fV=G-V`yu!0~|d8%P0Zh1yq$^ozh zxO6}kXMHj(F|`vM@poZ0@j;O(pG;+f0?~nzvnCoujry$!ksDynFw_*xbZ{7UjdVda z2Coc=<+?gr5<_OK^O=;6UFm3d8C${z1(iJ^b*DN2#P&R6u5h}JTOt8iTJO?X z?N!~s=)^K~{nmheZffWK^-DChPyDAoqE5I+_>(%rvd?csYiFkSeq>VI?!>YmIF+gN|a{>=yEh!9M+Yqi$S+LC*}mEIU5QqQXn^>6@AGWcha^h zmTb>_nn#E9aJAk4?*P_-YtGid3V+yMl&+wx>>Q3AJ%m3#`v<(R_C<^tI~EfrO~SnS z^LZ=(`qpje?C8Ycfqwj3*0tiaL3N3ieU0c_s-IxbaKp>Rkcy1P4Zxw?wo?uhL} zKZElJ;7EiQ%P!*R(PKD!?kq zb7#-PxUu6=Qc{Atx>`=|)py0}Hfw_jIARmm&)a zh|t;5!BOe*^YW0Mn#xi6h}}d0lSC-%MMqZ`+S)tO($>zKN}3-OBw%I;MPcM7qI!w)Y?;5F;}s8A0;q_IMa&rbo}%RCQMAAO!N|?dL2gbi@^kZ0QZxi3 zM+|3OFk*h4FDqvt3yDb#!Vri?V(_G$MJzaCj?tWyo|1wU%NAq)>{-am$-(8?dc5?? zt1RYz@W3JTv~`%nsRSgYreO5gQp}n&8*A3AK}KpC_V3w?9b30y)9bG@fHizfDQfEL z(A(94Va0_QIkXs~M-6A8{)YNmT&}J}eO)6aO`>RyvvJMpH)7nlal&G?1;)+7AhWq^ z`$+UVcivX6sjbr_)4Xin36N43K~9M`|Awt&FJ5Mjaoh8lmQvdt7nPs)iVsDO)VEU62js}-duEDnIh`e1H! zKXo@$<`w2JSzT`(cRpoc34$fSiTTmL zZHty}a{xC3VmZt-!-nQD#?eEi)@(qEHLa9!M+_{(XcBwE3kGUX2XSbCNfB~yYE z(NRqgomKh01~3!dF9Gf}EqhLO4$!E=40xsAb9oJb<>c2KDmk_XxjGtvsf%6xgn8uv zw+twnLn_C0P}zZMBdF`3(bu#9EERC)w2g)sGqCz!m7=yL-r{@H2{CSC+PnTOPye}+ zJL220ULAlHmbSOL9({XI2a7a+R($r=KmmU7z#_~o&G&pxp(dAn`V~eL{Z~}O&|vxO z?bC6`;-K5nhkvyfFYULZ5PHiX46HCF)zt!6`dqNR{_^pa7+vU%yhj~;>1SR=b4O1^ z^F_DkXWljycQ5glIgEkj-!O**SY;sqmRp8c09KjbRV_wW)w9KK{=$vk5%(m1_bKHn*Ot!#jVp*W7RCFeDR>VFH}^T2Mfqo(>1F zWc6eK>r-Jagh#DNh;cMl}0n; z>hq&VkH(l$V=!X)aO~c-2L}%yX00r8FQbiPS9ce?+)<>vw&rGbksVr8j1NEbAuL|H z3}?@u$BQq&jGzAWCunM{Lw0sL#*7(>VZ%qFUD->a&mFQ^*7+&`|dLU)=^w2 zyU1>N#l^+!!bp+&Sfsh{3fel_(cUUi4(a_ZEiFh(O~<&g;~40n4PRwtCC*>Ci0bNU z25UOHy4{Ff#8T=eV5y6LlkhV2ZjC_K*+EhXS6JjdJ1djj7|GR_06rE?X6+e`kf$I< zvSA-4uqGC{B+}R<;qY$$cQ3QA6jUK58G%@IkVV>{N{*)$w*2}W(HSA zdIr+d(^!C><_3yPMw?jLc#6wUF9TR~ksBlV9TAvCWxUeUjl~NWVD7A$C@C&NZCwNY z^ylZX<@K#Nu>T;s+dBYe86~kUS7AvJCQqG$n{T-pMS}~OrL}Y0cD%ZN1Cl5TWJV@h z+dGh$(2L@t!R(?qcFZVbW~O5h`cP3(j*3f_D9A5F>6o#&_04Z#h8*c_5eQ^2C;GSh z+X#Z2XmN%(Yt{5N)w2AY;x#0!NY_CXj+OMigCL>_jBpWnL+hhuKm_^VtDZ zn8_sWZR&ES?rvOOB{x~xRDs;9W|ecVcg7JWlB=7gx>6z*uUc9bfMpoLYM0o+mHaJh zth?r#bWhPp|%%A-8cKuvu;TUIDM< z$8l#hX03pdDvPhBmUQ?)%pCYRhfoeHTJ*2fjj)@?yo`G;zp@mS#ckXK30T#rgnGE7 zfT6?SHZG~`>dF0sSYE{JlJ<%Nz#8DPKfv4FF6MtQ!qC0SwLT_*b-8T-cE8tfe(GPB zW8%qKe+YRmCGg>2?ehUx z-ej*1z)E28_iz`&XaMVL_lB4E!C&shtB0xw+>(F#$TE!gG1yoG>xU*%oPQHzy43R@ zTNcp3dSYuo0M?@6p-~90B^N>iVCe?UW)(yg>d^r(uxRR7|EU!WQrH&_*rlJ_00KyP z0t~P$!rx9BCkMU~1WAN}buRp&sLmJJYToht;PqqifR8Cv)7*s&J!7;003ZNKL_t(l zU)l_E!F%c9r2z)U+kdzRJI~NKpc?gUM9sfP6r|(jj|bUOCn{U;=0^qGbN%#Pzw%(V z-Sq$C{^_`3hF4&p?tkDH2e9r)jil*gRBZUT?LHr669u2;8mY2i9P zU;qm!$%}F!90-6F-()?|uHYD9G1*kX`8_H(-Yrmcp5?w^Zll;a(nkHIr!5(8F1#%t zT6bRCGzMG8q~*yXZ~rYr*Wc6nYc1DAcAt!>1JB8De0{}B_>1Qm7X`BK_Pb)*-}y@z z$-eS6Z-9+u0Z{fSXjr$Uci6y{owVE^bnTRUdh0+9UrKMuL;5Vv=?Y*aIvP`~J7PqdbsQ*QB!cbg8mK^)08);Ky8*9~8ORbA7HxV2P?8@7 zu~;0}FgcWg<=0hxx(QphZo=Mu`!Rq10!*1Ym4(rXv2*0;VWg%e zW6bDMq@|@J0f{(x@DR?PJBRelOcrx*Bi0oQq$Du=siCG8X-P>KQBr~rKlBjhFIs|Q zq|fx~tN6`tf5UEiX=y1KQZyL(1qJBr>PAN=xwy3d3L9 ztc69|PsK&W$jZuMP?|s^igwu6-ofBmQ&S_0#kaM!v6%GW!Gl>dr@p=sRn?bKQBlp} z?iL{o-NW^QFvh-8oml(QD`;$L zL0d-`=PNBW3B!jKVfgS8j2tl(dAXFIbY|yORaUV!MA499+;Q6-m^)`4gK&w11h`X| zG~Kw{)`hM?MiQUXaprb2?+aVX(n>M_mJ1F^eRG65$8L2s4{ghXg~H_~M{YnEMIsEZ zj2U4b3Co3o`}l3 zhc2|H$r7%B5HZZ$cCdjwzRNJMSg@SOwbch`P1p8g*GZ`e$8sriYPl`XE3*r%cyRqE)!1<&=kOulQU^k^`fMERp(3J zAwVC&*{;?VGXt$CnQE_y&7gLH6p)^G`U5jerGIeH$4~~AZR0wQnZ7RXvF5zS{Q%G) zD^aO>ljW;iD5K5Xo97L~m+zhxNcYxnY{FS`A#^sD@fh7w-bur<@%s-4L)mXXS&Mi7 z$bc%=8{fIQ6#shjq(B~izwILa?dijT&z*x`%VMWLv(uBY^$X#w4F<4O#64s$(?5Wv z#7u8?;s&s+>U-<_5%|(wLAK21EvNoV|d?v z)2w1Vdf$vdeMbUVk$d2H#)f3AI5!2aKC(RELQ1ZFq{a2XwO%*C3$^XIf$AdS-Rkf| zg;@Ks#Q|m?eSY`%c7a6T2XYl=r?4PNBu@RI^yxh)lE zn}y_{KPW`X7GvNAXEgIkc%J-ucDJaSP`Lh+ejB`B>D6{VtxWY(z^JdIYt#=`grwk` z%bm3{kZ6DH=KntUE*s{OZ~IG=?y+?)+`1AQ&exy474I0Q-Zus3DPzW(vEgk~&wJFg z3oPp{oa`*ycF*z`)5*5{p!Wj`tH73OV`-b}ro#ER z>8Hkg76Vz`Pt_tfD`Z@gSZJdKKm0p@6=y}cw}rb9+MjaIKv!2cTH0E$d+$!HTmLdn zo<4?(%4!C%CQg{do7SeL2AscembIHwQc}^=)5qFYot@pxxME-h0vHfDlb)V|hK2^z zR99nAUmuDJ3h@5-J%Cwr=VAY$!`QHS3;y!ri)d+WL0Wn$QqxiyR3XrYIxI1X^0ISK zSTGnXmM+DcZn_EQE}X~FV@FX{U5&QZHWU^XA~`vQ!LG)pCe+n8qNAe|on4*6ZtCeq zds`bvA|zKH5?rq(#uewe7s<(~49Ym0YfCGLT=z1vGWdJe)go6g*5K)5w?P8k3i9(X zq;N2Ld%Cy|$&HX$M7o)!F-c4Z`b_6<2FwZIW6-Ue^G;=^mPkn@y{j|^6A5r)aI3qM zzatQf7*@1FrSGV`#4aOnj?*IGud5RTkTJ-VnZ@swIZE1DU6BZwP=JnERY{2$KeiMT zCydA3IdhPll!7f=wqo77*YMIyFEiWCVd^C&AT=W$qsNZMO*h|+sZ%Dii{swCd$4xx z%M1+G)iok1IT?AmS(rR!0<*9PEaUl)>1qP}bhNeevp3y%6XwjCi^9P}keZw(%n?2y z_PT4ikch4%vYI)c8+MD%P_EdwD@?8~U#e|I^+5F_V2J2i@mtlEk<)Y!Mg96&j$pbG z1gEsb4O|X71SE4cu%hh%ON-HB=xDofU6=*ei4Ms5m0A+Ekh&1Mnpgt(xNEP}sv8NA z!6U;SW*1n}J2Ea}G=><&G5`p#YtEsHfKBp0SAIa&S&NBm4#d?~U@(j42^(B8u65L! zMgof0B?Aflf9$;nn5I{CCiqs)IahUeRd-kCEYVVT3x!rd0vXGI8Emk<>i{M=;W1{$ z9`86lcxOD=%-DErGoE1Cn=jzHi=e*B3=broBFa7^tE%45+RXjzh z|Nr}L4(Go2J@4WEwCpE!(U*Gr@A-sLCl_Mk)^Ay5W{>yTVg%qT{m8l!8dHivE?G;Z zjg9UW15<|CCf}Olh6YC=?I;hZQ=m}6C6|F^O(lNbi>4@8qm)hiTt+(8FK9|CxMu(| ztKUWc7X34tZ?5!#XmFY+nOq3nxBZt}TsI4FN}q}FK7oNz09L|V^WgrK$RLig98xi$ z{YLYO><_ViBR5%QVEtHF^n7IimS>F9f%mUIvKM;-E`gN!7hbxJ|NLB73x^^He(@9j zD0=k#^xPue^PgS^F}M8pi>4~h459Y;_&b{M@h6%i>-qfxu$&>q`NRTPUp^lx;!f`r ziZnrjMB9}q47+;?x|&tGgw zJ{$mi;_W z#s@Th?6D^N%9G(TTrOyR(!LD@U==beK>#ez=vSdv zIVcE-CCiCK98}}a>Pk5!b-^PMdruSh!E`VSi`Z439+oh$To8-FE)`mJh1!kCJMAd~ zR!PIDh`R-`tiF}GCFfh_W#fwI^{E>As@o!mVENY>8bfIegmm|G;rNLoc;Th*VS08F85vpFz55yb{31Pk57zacwh+23rnog^ix0iQ`oR& z3r?Lqhr`E?vzsD;G%r$iwXRcjekObaZxN zcz76j`31aFO^lP^`Ur-GM;Htuuqx9;H6~ZWsi|oOu}HXlY-|F{G|tKOE;okX%?A@L!grcTM#w~ z+a+e5p>nbw)ts=EINhu)WRoyFMLwLL$MgUmLE*lPfN#Y3qVf@dMY=@9nxeLynw*p< zg=y)W4(WeQP0Ix@75D7kjgpd5+_`fH zC*L@QmtT4X{eAtInw$|Gp0s7;6c%93+BJCWiN~>H+cq@R)#37`i+J(HS8(h09dvf} zuv=$!RXO(Vy_f$^PK`5wNaZdoqezbxm>eHx_s6$C@Bnsg-;FhEnoy8mWLW&vv&wJr z_HJuVntj9d7O<=n3)qRP6Gzn})`-z`l66zoa$&L>W)klM2E^j*jT@G+hk~xxY$+Ka zM%lN#J{yLMfIR}Ls5^I*O{zgMv>6sIid-rCd^01#;vwW*HgKf%h%*tCoqj zs_2Nxo)-;Zi94YP<&)Nzlw5QYg^8tLo-%v6J?uW}0)euzOFdlxOPJ19&&-;h9t%s; z)UT9vrGTC>Nn~$!war*K-tQX8EGNTSVrc@)baL*yH67!kZ-#-Lw;of<2d{dr`f7L> zwii1f8y&D#<$4)l%#hKX3u@0wvv!U(z#Ra~w!bNxpqE?#UArXMfVq6LG6d2u z_KwtHdg+)Hmr@VF5(d^Mz7p8ZB@w&HB;2xMP7EvF=E5)d8aDX#ia<7bIW+()qTqZ0 z_J3Yol8fK{SKD!5V`XGbKlERY;X>PpW2wo1(qi(;ZyiKwL3Zf9Q@4ll^ItfL*#*b_ z$mZ)6;BD*6@r94<4KZ6ZK>@IO!{suoZmJ9{I|ockl|{LD?f-ZrlO$Z zemVA_FHs0r0$_RNk20EL0j&Rcgi9VeD5s_2JHLJaYbyL2V)QJ5K*VH9=&EMg<5N#> zz|TC~7&%Tq`|Pa<04wn53a7YRkB2r_;4gn>chc2>7Uai1a|GRXEJVHH6{Mmt8!!FF z0ptW&Q}otXk9XqVf87)sXDCFpBY|L_i~zwj(ffbrb;H04XG8j8hko-w=nG+Bi3Z*ZyN+Mb4c@!@ zNnt!h;WzfR6_+B(c(L$`WT_edvpDdEG~%YZG{aggCVp{2%dc5P85(I%6WC znxt>}s;WsC>&xE^;qrRmQcQh=D8`1f10a!`b zm{cC{wZF0D`}+EE@$v;6JAN344!w-px@xRjzX4mfZbwyB4eqqIp}nJxL9X`Bc67A2 zV|j52*_l~*;J^WF-MR(S(^KqbI5afCW3i;Th{fEer^w|l4aG$zc>3vgqjuFQym9I@ zjvPOZ*N+@!(5s-JfPtjk+#CjJ2>hz9szgCFAWtt_> zW{!ZfIR?UJrl%Q%B_N4FG@76!_C8H|Oc|NHLhzhs4WM*(do0M$Lw;T!>sghSl(Op` zy({3pVRR_Fk=+SBT_X~Ar@RT!%FfERARg&j(VV0-iG4$BifCgIqnuoRmM}Xz!+(iE zrl6UCOLGh=(R-9OiMtbHiw>Oxuu+}_U=heg3=0yHC(wJ*{Kz?zz#WQN+*pNm`$Gcp-uVg@P!T4`x47~j;`#LPA-Q(tc{u3f#3wmWU;XzRq{!V;5t z%Bw4}W?dup?tL4!Z{5mnhj(t@!qH>Laq03k+`M%MS=rgBt*ypmk3Ni=>M906+uPf5 z`_65wS+g1&)~&t8*pqu zDVrJN#yIkrXtr7rj5lS885SRxPyA-o#?s5QOp-t_tUxQ6Pp#!d8g|Dl@7Y%DU&e~K z5RwL#1+W~WI3)lpXyp1V;#BsrgwLqqA_m8s|A_;ze(}GbM(2>@5@xGqM=NJun45{( zl03Y9b0r?zQG5-35TvP?m>hKmB&zB!WM8`ls;m|9%?uH}2=j zoi+FmAKVf7KE1;L7BR4#gQ6}$n&z{=eju!Y^?e7hoCT7{kpE~(E_~rAgj0Ar2Ed{e zp59%HKZ+16r|(|8)Q^Ar)k~fjexLzqynOPhX8i0U(PNDs|Lk+O;x(}Da>}`Ll@_P( zeR@Agw<^)k>(>YIb6+^?t&VXIJ4?*!)YOkUEBQ|B_Vr+(tV zs*nyBegE9~K78^^7kzU$3TXJoFYm>+2EYEDmgjGeb>fenyM?g`rd&yW7PGfLv_A~& zy7ln@EVuMB)QN$W48V$Nn-ELHdB}I`mO>wR3$y8%Fz#`eqsW}Zbujs>Z^wxT79`&z z!h1+eVVwt~_8kXjaa%6JC`@hRl04#exWo;bw7CNhgmOtzS6}BjdQl-j<@X4ji{Y z13*Oi2D`UyI!X0ScmLONNH+eNr~sDV5iv0AoOZD3>nL*F544T}phBw<)gJPl3xtJx z#n}Evq}{u9zOT6ek8aHq7XwG@LiHrvh(SvGSCM7bvoW{!UeqLs7ARDG4@_e4%D4>D zKFsbV3T9dMm2olTn^EIhXf?15C}lt@1*ljr#{g)`$WpgK0YcH(;Y&Rcm_(THD(>;vosP&(1Hf_8fsm z93e0>gWVA+J<@_A_84hEkxL_iQ~3pjSWZvJ!tydRkaBaf83ZcG%SB;f0Y^P#{T#zq zk|Euob z(Y~T}mNdLbPmJ6$39up{kfRW0h(6WA9O+ywfo3~tDiMH1AQw4-(fjJANE%thV58|s z-_Oht>ud&d^Ro<45!g3AF~K@vyvFe+w$=FPIC?sJ z(An0B`MCwmFD)RyqzF|cvRu~DQiFJb+X@RN!n>VqP1tZTfdBp_p@Z9A5ZgWC#@$|6NRm+Q@ zC!C{%0G8QT87NR~E8Qd2ozU5PJ@%CeKH{8sM7z-uOlQ|dZ6>Epcsm!sk7Q%TebBfN zlBOGjT86o1CIF?Qnv7gO%VhKR8w++AAVz^B&u-D^hr;e+{Yg`21>L;<2=3<&OG#Z5 zS^rGW8HVY`?IA#!y@awZgvRCFY=YKB&){0RS2{#0YbEmKmT~nn+rI@r-ROw|9T@=2 zx)X}dp4DZudYMvNwf_~wlj6CoGCS0T`DVV?cNLsddq*#zG!Tq3w7tKEZS9NvX!dfm zFDTwBK&TO*H)DjxO8~%<7PPLHKBO?&-lZMA0=OyCG7Jx$6{HwZNTC&ohD!-vFcy%ZG>%*w#MSOG^o`CSCo=<0RRwr(b0vuRmFy=L zz%nl~11kv-KD8kcw z>acfRw0o7dg8*13eP=-b5ho3a0jywc<=;tN2+eE3vFRS9Tp&#VtQueUwe%+juxK9s z^@s1lzGk`+3jYjF%;6tScH`L1A#{(-@&T!;C&KXHQqE$at(g| zQa@S;ra|cz=VdYA_4bYBD9DM<-z`rR153-16u{z@KRh~p_4R$7q;Fl;Ym#Kctr}4l z-f9A!9kvzX2aUH$#Xb`Z1Q2@A7z~l0YwN`pG4Xzv>LEG#jEb(FuUPgUUYRsqzgwo0 zR)iHESC%m0InXGf@!$ejQM-vTCC&aH1g+fsg01W`uFTCG)yiKYXS_xBpI1JY0j9>1 znk63C6)1(n{;?pOT9dXdydDsP&SO=nf&I31`8c>G4~s0=E+V~Rs5#-qo!dt-$Be+K zDXb@m?iX2iT?g4+kj2_X$elne`^(x_%EB@rl5ta_&(#G*jZW38V#bwm_tR(G1BIu} zWxze(t+pHjxGL&OU>I7iYogb6%1&@sV%OauewnyywpCP;Zvj{d_wn$ThC#xIOu4`e zUXmE%0&d*8iRYjHF5Ysuxl$l+mhecxTMMXuZsHjABO)Uda#4w@LIDxjTPiL5o z#C9Sei8Q6=NYH(b^r#j@m_38iDQ0~qVj&O+MH*HGg@p`$Ei8xtJOOE>UA43*+ExTC z5e7g&0hNy!oK!AyH7hGCW3hD-Fee=?5}+rbist&{)FkF+W-aK#kqem>L(&FvsuVD5 z*|;?3GXO;lE(W(41P8l(l4cgUS(2zdm7VHF`eo!oy+p$EFcm>%7g;=$! z9*;eK5KT>uT<+T~EjWAb9IC2ou%@97qeFvOnx94E>ebk_>mEGu*psNMZIE%wj2~HZ z6o|4bkY(z~nyjn6f(FdKad}*3{r7yq{cI?)7o1drOj6xwg8R1Fi3>(j<`d5E2T2jLhGU(50;nZs~7jFWzEU@n_1WbPW|1Ko=kq~6$aK17Qp)Kx3A-Wyqa9c z=VuSD#V@}z+I1Lz%I0jvw;LMTxPfe$-yf%e^%=j2yVpiC2BVK_U=j6|0$7w@RdEjf{+I4Ub+JF< z-J5MUdS3vn))bRU?Ccai&dVp{?)U0%KEQ{hs2_@`_~0KL1_7DLfBb2zF3-c?e&Qa^ zk=$~FjKc}HRr$&X=R{oPgTLYNT1 z3RTEWJ)$+^2DbZXWEUr2oA0jglBb(=V~ee_Yqt7J=N_u%o9JA`AdP7p2VY4%tDN^^ zfEdZ-F4`hoK$Dr=8oFuvQV(Y3*3mPG0inL;Ic9!>$!3e>Gr@p)LlpG4=r5yEYe(Y!(1Z zv@sOG@-!>>9cv&e+slAhTrjx{)o6plh%oFcNBc@aECsHJ#hpbOH2l|NWa%MVbgulr zY9OnoiqBn8bxF)^DyI_^W7h)=4=>{uLjV>TvIfB7JbYSYPGft`>g$t4=A{L&5{=tb z7ofKQtW;Y{@BXa`%1jep6Wws0a#$vY&gILO@$F~-3D<92MNdyR_S~}z`}Xa_rj46W zR#uMNEq54fI(6n8+B!NhJT!>Tb^@?^@e3dSC_eb(AHdqRjp**~#DDw3U*X)@vmAkt zz?90$YHZlB5nHxy!~XpbAiuZ>uO2#t3zsjUt*ss91!65tPqW+O;=+QkD4A&`%pP*RqXTJfULK3Jv&)nLPh{;7S3F9KR>h?y z(y^Mu^5PhiOdIqN~~)|VeIE; zE%TJXHp-XENbE3TPSIZpG~pd&DGdVLh^eL^9l0?wK(VxlF#-!&FN~r{E^!*fVk2OY zKoD;0C18GO2_s|Um|t8(X=xd@Z{3VX9(oY{Jw2?Mb@=cxoH=y{=@db-wi*vV@(?y| zYDQ5>G1@yiarWGK6c!evvaAG?W5ZZpm_;7{YS46MC7E~Ck^OelM3Ex)-bKpt}c& z>z@45vkFYHE8?Q)VX3R1)?4(qjQ*sJ`0LfzwlO!J#~$_SEhVxHECy%%-bV7QYFTPM zRJ7mIy%bx<tCxJe0kk=ckDb%$jOSQwwN}Ni;u^EMQRH**rbC zz!}}z>yfRwwK59k|>0JlU6}j>q1FuuhCjd z+xUsEMmW5#V4u=Q)p)&&S5to_xuG7H)(;ZEqDk;4&k}eQ5X26gVf03qCg11&x7~O+ zAaI>}I{+_S?8WWgNqponzmT*Kz*2+3NqA)dme<|_V1=UqiUyVgU1M8~b=FYIvsr&x>qD9;v|IFdoD1^GWYN6dt zE)KwYmvJGKccRDl`sxCF@uS~AphnA=I)IhvnC;(+qt5Jq{Gsi5=T4<%`@8?kM>_C( z-*f{WtYnTaV_j7~{`$jv*ro2x{7lX+;$vUDfaAA@L%k4l9Ogy4swf*@`S`t9Q<2zB zGEvz+^G`SN*w#wix6VH|7{HpEcT6a6l(2~VZ|n~x`)LNSx|1}87u_V`gK;OrC=UJq z0+$rQy2SNcqPga#5jE=lqdmIy5@19A7Xt2Zu}gqmQ&Y)3L77sSAOVmda#f0*q6#)7 zbm%jOf`A)@b9?E})60wvL1X3FzO?|B`<8!A4^~@E6>-UkW@FjZA~cn}_q~)oL(mw> z&Vj>tf>`|v)#bRSDGv{C&UJ1`T@XudbS-$r=}B9t;i%)q8k8)QE(c8kvBVXSHLdu+ zVVPG1ToJoFJ2L}W1Y)r(p}b4E1OY5!h%nPiMTcFzD|_qgxi7lzg$Ao~hPUZGmw~k` z8d+99%N%^eLrn~SZw`B`fT-c^9eUhxbeAUYTL4xnD~MzDx~*>xmIlDm-k4t?x3Y1Z zJ$Dx0{MP@CzP?^Qt2M1{M04|cY;0~ub#)bsqu*+2#mO^gar1U7y1Tj>|VlPci&!VTN4}AlJ7$2X&(8vh-2L>=WG|bP6yBxXKW%5`h#t;El#YM#^ zEG|MJv5&Gvn4G{XVn&hcAc0i`%8ZVVp|7tG**V$F$Rh2loSbaTPETWUasng6!h0eJzE$o-Ml0*cr;KR3&u z5#>j$CURXvdIqmA#8jtr>9f3?TxOn;`yjEi2&kKwoMbmZ`XTU&KqZc>NLpWfAkEV_f$P=V+lzsLeiphXh8wjP z)iWbgd|Nhc#FI}v&Mu`_uUx}RFTR4quODSJpt!sQ2i|@F z+jefnn#M--_6^|NxeM&NNG$xh=?P?D0kzfD*tK&Ho_^OeXlPhtm_iagO_*5WmB_U( zG%B10gepyjT7m*tDVs|7V`>ZD_Z+z# zfeF2K&}(`HwbboS+St9oG7$j<4Kxie5lAh2*+>Og=Cj$GHS(mg!fYf&jowG?X#h%* zA_y~MjiC`9^=`l#S31FJdx^2i7gD5kWuhL_U$rSb-7?31G8dQ3qBHC<`>nDJ9k!pc z%2p0w{V#Y>NxZAdz=+epN^wVyeT>`%|L~hvS^LT}s=UYDq3wB4gCCL>+ta>{O(yH0Lz1QIoZSjmZyOgJp3gDu+A9(%YDhW-pfBo zbo;m7vpG`KJy}2e)0rN8?zx+I{x{z4do&ur@~0LJV0GfRzj4JF)n@TTSCQ3 z24J~cQfdI!(OA}&<=Yy~qd)n{9oV&|Bw17WzNdxiKRtU3|N33)Ln8Qo7s9Ahse9)U zlWhuk)BWqq@WqepiA;bZ_Fe9pNTE)F5$XK1tRM@&_oJKf_%?sU!xR$bN6xp8;n%)$ z8Lfk&g{M{W=NPQ0C+11)xWE3nUD#L~j`WzQ3rN2$Jam(Qgzn3AO&NW$kv=sWl(OGv&Cn=Z-A=mA*n zK|2bcP7IOR5?TPuE3<(zVi{mkcKvY?`T##QK-9HkKcbp(@L8ai_O>v(rQ~U`gN=UOUPSH<{KV(ylBlWn>Aslx189bFwm!Ls8GN zGLX%>SO(-`cSDH~q+;$Y_^u-D=Fn=RS}}9VdNzsyuZFc6rKWN&gv5Q%AeH3DEHbDD zmiL|i2qs)RJFwXn4IT)knY4eR04(3Ujv6X)OT$|LR%(l;(||A>*%5q7_8Y;453wM{I(O@Q(b3k9uJ(2e_Vwde ze(9I+<3IiZRFs$E=FRK)(?9)F96o#$9UVP<_RG%7#G{Wsg2x^`h{vCJ9OV@ic;&U% zSWAlzsrjsXRfzWXHnewkV|H!&*!Lw=_V2&x&6`HX7D919|Z-4d|)RxLvr^kD=TG|*VyPNi_cF_PGVs} z-0?CqsmGfYG`Cu8ZW5U zl`smx@)i$o6;gLRcbTGh#Vwo}U7VC>KQaKqI!b2O4s2)oo&~JTEOgBoPSPyIlAF5@ zdec?_92dayE?hWwVzw|NPFQgs6U)Cp>ZJ@b&4M~fru>3k8gY5n!7?K8tP3S98U?XD z4J>6{2{TIB$pZ9v`@hzKqvetdE=La)Mxw9}C4FHW85ezfZ(-V++!!?iB9{|bRFK4I zmD#;Qb-@k8i~36=PD+Cs7ecd7O8LzG#Ne1lYxEpC1%y$cO2I2n1f50s9njM0MWZC( zxcKwFOpGTJ)zU}|P*=DB7Pp1=FS~@s+q0f4WYA_*y)k3Mnein3D`2m<4@!AFH$oG6 z(_y+B3cVey_EOQkIJEAN%JkC6o~(go7+Ah~BsbDi+{t1d`#z-~n~XPbv;f}^1{S#( zjZMv?bzlnTT1W8Gr9NC}Q{XDPsy+ZKVz5wzy-&VtV^X~$n!Jav58%(AzlHNAPXez# z771V(Jt5zMC=-k{l3tBqQhn;n=UIy?^kdqX0j%GOU|{`?GOz-y4!3UtM&f-a3OkfJoO{)hzs{Xda5^|Bz?@4K%KA3oR!a-U1|LyO~~YeV>>Z{Nht-bq~i!-Gix zEK1GY`sAi&CH8&n-~n*;|2!D_`byUX>rJKh^v>zZOdpabAfKe!qnd1MVpq&?Bk%={9*dAbLmf2ozV%joAz zKfgN`z@qPi{SXUaeeEi~ajM6@5PUCKLkm7QhxTOc_U67%y^Z76qD12?s%*9mRs>*q zhvOhTlBoVnlJPQ(VO44yBw{uuZsqXu8gbhik%ZpBChtS9j6r5-f~DO9<5P$Rr#Gp7 z7L2y8&tu6{6`XAsa0#kjxu>l*;1Ce&mfWLPLR7G0aglN(O(gEr-J~+ zMKgw{(WX-HiWpqhASKrz<0>czGL1B(3@yW?a(D->oPm~|T|OusWnLMrB)x&vFzMkn z*J1C8V@PO$v~CC1?IgVJM7@`A2)zYhr8vXfay0uulwu$qbo|Wd#ns{yMsPx)_jR_R!Q6u3o*0 zo40SHppe*9#V9Q+XLq^oo?eWNi)$M(esZ#NP*G8Vs>(`KSCMvB0oN}hGn3g@u?Wl}L3(0l5$lQ=W-Pc~Qi7tw zA_nQm6_FWZ#*K=F?Pp1kip-(s=8)t0QF(@0OtzX2RH+r28HhKtK*PHSEq{{K#G4M9Ujx4$FRIU^A1E z0!|8aFyqG+Z88ZmFk&Lj5!FvvHO6&KpV5fAON;7fXsT?$D+6M&I~eP;iS`w1tQo;` z2GGnUo3d_nxu@1v{W#h4Wb9Mps78`7umnUC`@!t9+-Sl&6IVmghw~Uw;?{3k+jH%6 z&PepNG>sYqW?wSwVQLd)poxo}f^dGFF12ecNT*CV*M*a_F{`NaSG1+b)i^^gu6S?u zBKb;WV*vvd%u_&1Y(cdfUBgxCqxOaDlV;2*!_R<90#>R1rnDAcMj5s?Yg$@{oG`Q8 zOD7kU_3Uf`z`U_*M>M~xA1iphpu#g?(Dwg?YysRTvsD=*AudMhzBdPZhIAP#|7ePeRiO>}_p)zSG!qPpu? zN!~sQ+9c5_&z_Q<)ek^ZRX!frSb?ppiWykT&&dD@Uk^>p;Y!yyj@=mIzh>^HJV^cZ zNZyZePrRx2aM!hzOD-=(=IeY&{k5m51aDhg$|B}v`E(xt^o-8pV#gQ`T^r>8 z*2JO!EMjJT;nko9mVaI)Z-d~7)CJ0GRXRvr`phGtR`~sI-N2U)cdV#&51=S7My)Uth-Vg%yQ#6Pbpw znFX{D&fr4FI1XJO;&Gn(Pt2HzIJiZnX{VoWp!?HIK1)(Btvq>`DaO8bm+1xZB)4eB zCCh*Mje{hd`X^fk?W75=)c${`Hn-e%PrVHy*L1zXv`MCtUa*wO-thxaiJrDp@c;uW z>K)IJm%;~cqa*ji5J$Dfu)*^1}xeO|8pKq$u!Qd5XUkQMfE-r*d)IBppbu^6IA+xZI z8zM(7lv`d`3rhhk%3s9X#b9NC%XOS_G*HCg6|jr`Tb?sIUIvtNBPwa%+BG*499`)+ z^-^`m4yO_~Zr%d0QrrX-nAbq+`kI+Fjy*UvJ&E>?R-8I>63;*XJuELRqPDgcJ9liy z#!Z_TRHEM-H*R8lauOwFWen&nE-YepY8s1k3;56nKgf~hsN>F`KZig2v(Mw$@i)-h zH^e6^a?yMGUGKzGPd3+o#^iFVU`t%j1#k{Vbv;>S61*r ziNGy#`=i5gUVc6cs23F%b2LF>G8N_%cm)B7NDFFVku|C)njwKRq(4QVOl4&SyF=F2 z)S$Sem;tf=!9koneG1pFUPVb!0SXK9kdsZWf-@K$8Ddrzfkp&a(F#;s*MREk8Wb0o zp{SVjwTc;ls;h5ck^48^IDz~Ey4YOeD2;a(se;CK9W!t*b@D zss=PRHleJn0=YT)SX@}b%-oy^tk2J}3*pf4FgiOs(be6}`eek=BAbTVfm|nx3JV!@ zY^ZNwMi{ZhB*LCVBc%KZ#G<|>#v1ErEiAAb;`qcQrlv_>Yz74d`Rr0j?U$XMWk7PV zhza1M$dY5DBMe{;42@!BjKH-ScHty|u)3-mb#?Vjw^}eUF^T20CDb+4VcYht zc<}8HvYX?TOIL92%sE`Sd>)%OH=}u7BdV(_8NfPt@CmFj0G3>Wx{eqv5#3K z-7vKnX!4kARA3vNL|xnYd0{*;XrpPec9gLljBCCCSRMp9T=i*R&kz{^3u2kJ zP@q%WLdDxP5+T*yx?GyJp%KlaT2U!GV5J^rI2-LP)vl7rkj5F&0$;ShOHdZG-&-b? z$1IcTEqU`N&_-%!sqG`}ZpII3c)fW5E14;m;+~gsGKt`usJy&QGy1+e<&6D_t1TJI zGTQuh4I{lB^u~sNVT`k%bZJv#HQEHzNorDYFDE047Tub6(I$>jlDNlRBSu~lo7{XZ zdxrVkYl*}q@_!rGesSfBOWSSl*gB=qRN+VBk7%)Z2KS+;0@-K$=@;f@;EmsTDD=i> z{_zI>=j-jURSRy{Db8fOrR(z#Z?3>!{Pa%W>+_3Cc<}d+U}S1uK2O{UNwZGe=g~c| z(sAOJ(a!)$TD%kDdCs>lB)4j_y6HHKV zm2n>m(hCC%n6DU#MoNOUC*c4~#J*ZV8^k;sxvt-(^iQ~HQ&^34IZsqRS5Lt)oT5gp zH9mbe#_mYgog`*(2WLTKxx%ZjWnP(yX)gLQh{GYcCP_Lt0M7g+<8C&P739KHl}@Q`ozAFSEB!pFV}Z_{+b< z@i$JPr+0|iKqRLA%rifXr=ENV)~_ec*kv3!as-zzU&Ni(Hgxy)qpyE}1If_1TeYSE z7+8zm`FEHDvth@qc6_w1);;3fq76r`B&N4e_c9z`X7MWc|Oe^w9qWMygpNsmM zT8@^tdQ}61JvZ;P;OzMeEKJ|gb_aE}RVXbgWVgDpu~GC7^fGg5a%x(%uPBOgMJ1}L z>#%Co8q_zeMt%Ki)YQ~*bj9=MFR~jZ9eO7w$8h!P74-IWTXA)o&m<5(JxMIG4A$r> zEh|P{eH}J#+=SJun>ek^^lTQ-o+E&1b{4~hF>GwcM!^ebVEtyhP?L(=Q-#uDJ9kV5|r~^$Z zWl6O@ap~LlQ>jX*K;BEqUym}H18+s{L&;K>ml`Yc@tsfY3zhJKbj?xmM% z+lBifc&G$E`@wB^*Dk+^`*+Uw;aC3VQuOPobgnZpqQ`ht4U)B&$=KWDy^^@Ez9}Fe z)wRz5oUb;@A5Yo_@eLWM&YK#&vAL{hy-&H*V;+po%w1vpFS<7n+PZNC4v*=$(uPKz z`@!9gp%jO$$ME$^XX~$<|B9M9B+bVr001BWNkl<%kktdQl-5t>*V|AVLfmSR7)n36_K|_l5yaAv#lOVBO0xh~F6+{Wm^-;5 z2+PUQ`a!J$tdPc^yY4JazgMzW6`? zFPu1e8XX9-9!yv~JA4Jm`P??$$eJT=U zFDo;yak;qynw69?h*eZlilL!lcF!YL)9egI(p%s|B)iD*VNx`xXkL^Smtb{$J+^J# zin^K_b{#x%>J*-T@kPwc&mnDj0aX=c$V^*CcUK29r-*$;k^YF$C1Td1(UYHFi1p1I zv2*7h?Av#ML8si@0(5qE;ZAD{ZnxaRjhokS?(7*BMQ4}9OcGPhw1Dya>^$ZcW*H

MCtgn@kmC5;bbamn4rOWuv_rA*j771#zz74q{Q}jX-n$OQ? z22@Q=4ZBI!)z&kZM0L+17v-!BW@1rfMLJ+pTai%v1i33t&tjgmw~S~w4SfOt3-WRq z_#=>lz$hy13CZ z3fy?*GiCDaZL%QO>VCD4 z&T+ToA~-g*;y9{5#sHRgUR!~|nrM@aOeRs*7wi1Xj!^I4)0M5eLwu@KduKw(ZMUjKIwAUDe&TK2<#eU3G{68gj1BomLb__8KgJ3>hYJ3nw} z(fO8A!+4`3Ne3nQT6Tm~!S|Gk7Q@I2bFxxA7XHB3&J}Moz8BQokPn0X@@Chs=(2hJ z5Ll#ri><$8O8HN<58a8AcxQEYe<`m&53ipS?ZUSCoGPcXr!XKD*xR_gW`m~xw#K^^ zJ`K04n}p5>8zm^F0Yc@AsG#?1^qh?{Bixzcw=<-1H5*$_XXvRr0zE_k*1q*w*2w1D zP@kKp=57v2)IR2bV5$7ZaMS~YwxvebB?F%fOJZLs!-{~c9C9Pf%s_6o2rEl8LV8A6 zRw@F|2Lla-?TdOO*R2{A$?raBgxpoz#W1h58GJ4Us-dASgsP|F`M}sMLfvY-(P7#r z;PUAoJ;~;HYMZKajCgZP`oEC3?e1yp&>)jeFKEZchjHoh1sp$dltCo|K^{1;ACnW4 z9R2Uw_3P*#9Af5DZcY})$A(Z?kc+ySdaPd6h&8L4uyxBe)YaFbr?(pyFP+D8-}x>s zT)cv|_Acb*7cy(=zWeuKF>9 zLvCIUHf-34o!fWe-aYpsGd+ueAQG^ryeS&v^&8jmy%%0UYg;>SJ1oqsY|Qj@7HFq7 zBiGMWt5%`0aV@)A(xI9_J^H0pk#)JICNMTS%zZmHF@@=wd8B2~;X9kf;Hhm%K%Kx! z`X$QE!rUz9No`E-n8f~?n401!k;B6yMreMPT^*T8H!q+ciRzR77`cCvyX5YjyHHwG zg!H9loIi60=gytRu3g)(c3mR_IQ6xw@W6qG7{H?b4g*+$-IJG&XaFm?&nDU{U1qHZ zSa=JC-A~Lp(x#;+chz;WhN3IZ?QMFzS2@fYj_yalMrdE%1?dfWOV&>Mf4Y>g?q<#& z#m^bG4Kr?i%rVE+(5FKss{?^i%)T1ofl6VpsZhV^ z2e*AJgG%fnUW1H&rUF>DtxaG17+A`1GXNH)B5s79w1f*_DUhiQLjfBNcp98Erk!m& zl3lUs7ry4rhm~xuZ|dNZlId$o6MWW;5L;I7d-tFh0MiMvhv; zk>3T%Yem`o@zUbTT9H-&d2Y+uMWTWzRkWodPiq*@H0of8y-85BkJv(E0dQkP3D#6G1ib5^)Y|H9%N*$>ARmUtTyS)%(U53^h+63q?K@H9KSAA+EmRS&+Py7- zaJxH>qV%M6tb6NspdjX-_GVL=N(rjs>*vsdAFinXlju?6dqxZG4oBxTch7e%4*h%w zGqAD@yFzX(^>sZ=$nl6W(yLCn2;fgxcS0!qbW_bY(AH3-sDw)_+)l za?cO|i}bJv#3J`X(#PWGG(5SA#G2byt4+nFP&iHwOrGY2(Y-Kbmo_sjtsr2f`Ympq zjKOQ`X`j)Qq`^Z>_TX4ZqFJS5DQP+@Sqk2IHiZ`OX3@~_0J{$ofOYif5!BVzV&DFK zXlrf7&6~HF2}JBC5_Qkc0J_>+kei*3n(8{#)HI;3W)+&7H=(k+0-as$xYcq4mo8t% z?Ur_QbarETIfI4Y)3eAm4!C`%l^IUrMwf}~oNQrvEH5+YQbH`NvT|`3EG=a%D`F^8 zl)5!*8j+rn&Mti?-gpDou3lvZOIBtkiVE|PmqVa1urNP~>6tkeU?*W{a{1f5X&dgp z?*K|mDlj=Ug%c-F;N@3eMrnB|iVJfwGSrX0-Y(o}xy7Iiv4}FWve>1L#Nla@lPLV+ zBA9h`-+lY=zW4qp8tUsAprNRLREHx+4&%`4ui^O@UO-1jJIX7|85E*AD%(PIu4dRB zkml^Vwd=5J$1dEz_kK){O)yYJ`H~<#G1Pkd`|-x9lj!R1;YfiQvt`JhF2O*!8crrj9{E z0;og;eo59ijcCSen6NwLf5POLHelSqzyNys1~54_gPGZRq@`!_dO9;ZhsvsI+_QT( z8dt4CZDj?{o;-zb~S65Rg_n8AFXX%C&Kmw9{NsRvO2r$8fA;>pm+DD z6efaQ))QaT8}?PGG-f?C8;aPc-hNMQXD@k7VW_(Fz0|-&fjfi`Y3Bn7jx+xmAjVYnJ9}*zs0azX@hfoaNYbXzOg;QNBUH=ut zQlLiwEaMhv*gTf4qnBoau9yToa9Vr8I7d(j0H&t28lGLd=-tfIY|)*b<_91SdcsU>=3B2-V& z2PLW`|C_;jkDcbVt8s;7;E+d(+1rI-MJ}5HRC?}#+?qzNK*txQC%~rB!n9trM$?Sg zY{pGh%jCIIdaQLB&Ynx7nSh41mJGo9fgM`nju4um{!Mn&kO|@~9^R7SexvRR@~sh7 zi(Oq($usI@e_4W0q;kMblymsIK<7B8>tr?1WzL^MJk2$-seE+72y%mcDRH}`w8)28 z17=W1yzCy7LT47|dHbC?SVr+pl8w^nb_^HFO~;pyEvzF<7(oZ5Md0b()%f`1O;}Tr zhoAn-vp8{kB&DW%dUp-}=*PE)o*kcF!2aKTofomh<0ZHVMCe)sXP}edmp;0O#pd0g zzj&z?fBfB+@F|4dd+rx=m)T4tf~%@uFWjT({eXi?MI z%SGM@uHixWEHsW*GEG7)8{Gz8+2UDy{HA%`1F&3OC$&>dy`1iI>yRA4^2+F|d(?!A zs7}&ePWpgpGyq#cq`s41aAlBnMEZT_>P+lwrh}aqwMvU=!4+PA(#33{yv46V3`^CY zFzy9>u%nxD&pbE!6yicCtSYc8VRm{taxybPE`&Ljg+*E#6y~0cW4+;(C`Tq>paIAv ze~*=9z%=8&;2wOmx!j`LsDt+4qgRS@XyJnkfmmjQE89$mqqLD3JHa(8u*4_kk*c#! zs-2pA%X;gHU<(A8%nHVu#|DS`as0#)96Nr50j&D^dK`G*0o=NE3)in-M}0#*8k?H1 zWBXQMej0BaeGMan6lFIZ>(*_;rcFDsZTl|NHPoQ9yB%#EchJ_}j@GtLw6%3%U|^Q)*JkH2qk zZ^!N1x6yj16$1nP>?%idCJhTnTb@Pw@+=nTCNMoa$9WN}BQL)g>(_0@qmRB5t5>Z< zW>zLTI@{TGa$#`}Q}E!>HW;k&0=tH zkk=s+U*EoEEB5Yr8v|HWM~Zq#3@j2?9~c_K&6e937#zgxJh7oNm?gz7Rf~%ZAkl%A z7+7o9t;6;mJ6U&(03ZTLNJFe3FAvL0b7;AJ4Q+RBp}oBg<5M$OTuw)3P9Ab{@=-@3 z^)+>@r$sKL0uISQkqD?H-oJpQ`FUVzfx-B^JZc{iiyxa9V}bXna)>SD~i1iUAsOeY|(iUaW3t?nyR-y_!&L^bFCE2uF`?Sj*<@M7Z*9u0JkY2qek4E-S`Y}!N3dw zh>l(%J*SKrcP)0;dVa>Zu!+`|3t)MGoG_#W#3ENhVqOutLwh3cWGdor7)s(^sOz?g zerufIWZyHpp9;Sly(Be182D5W&ln_>$^w;v8Ca$~1n%+pHo8|*EOB8pOe*OoG4}KV zhtCRu_7O6QQ!dth@&j11o0|Vw?JYz?Db~7;P&f*e|x6FyX{Bk#VW6l5)xBxf*g=46x{l$(zp< zT(eOx1@O~8v*Z&81QZ6A8F@Mw12zEvGvWE|`?_n#net91p+^!K*2ZpjX-{#kgfvC?UqD$B{;l;c_cKFBW^+Br;D4iO!}vGR^t z#5^1~WZlmb^>@_DX4u=3qYI|3WIa#T&Cd6>p2mE%83(s))6619sw^UhbH(3#hZeU8 zK6kvJ3qwS`LLb==0xcdG|8^wse*{vA13$H1&Xy8YcKuA-YX^zAZ^*W81v(e#dl$eG zHx*MFr@YF*lIGM<=4vb&nOZg=CEU0gpyW=d3@ie#ax92NT3DILHpVgiWnoxzyQ(ZI zDW}{RtIwm+*QoR&rg_-z+)tIDF(VyP!Sv&_lR!^CkmW+qZAWuHCzF|9yKg zH9m}QeC;c^cq5N;+bcD6g#%x zgX)?Zq-BtB^a9%2TXEz16+HLcKjO@(6PTKsKw5eR3JQvt0YxkC7+man%;2`TR}qVBbaaFd(v=nE*totK z_w3xsLg^Hhk;*`a+M(eQ433OoU}zX)6BC%4o<=$afXK;~y=7?$W255?gcO&Qpt-pj z`}Q9|L16)dU(-`ln4O;HNQGFM$F-}M(AshveI&}ixP~l zP+3*UEHBE0+KF8tGc!0nD&zdz3^LPzva(X-7vv)=I}7uR3+x`*Nl_)c`!G8`_dPjbUJ*4+RWN7NWYUl9^ZJN=fdig@r|iapdg*E?}RS zG4+F)Q0{J|dxU5^d8;FT?vfc)P@Z3QPLgS9++Oo@bHdD7B(|G?5A14YKpBs1V;DEO z<{D9XUsOP2o$CHBWfbO;Pqf<5;+Ap-6MB8mIpGL{!Ti{FaPtBAVMNK*AC!)>zg z6=f(Y!M4YBbJtOj%2f zfji~aY1*O*n6~K`|IQ3;Z_-7X^D8?vt@IERobaxwfm)4Dnqg}ua>a-{_C(hul|xL_ zo6dD)r=eejw9i3F~Gl^sD2aQ_i--&usminmq5bj{TsnFK*4v+Gz&ww*VepEfYJ;%#q zeN6%W;g|2_+wiEL7cURsTc>+)u5Anh<8%C6RZ%wXU0Z^8@2SCo4dt;-_JKb;jq~ke ziNTO4;4v9^6NldlYKw2a^<|LfW4eBHxYpyay1r#1%Mr%XQtIy|Zx$#GV@ z1KJFdzhem#u|;>k&}}R3;gr{5-%xdS4^B8jG$vFL@0sXjEtT~$IFq6#WL!GVx*FSZ zsg}V%@l$R?(^T;tmpFgfSXYvpKRy4O@#%PDIeO>zHu$?}uariu%YQU^1hTUK^Z{26 zK*0|fce#jSdd;XJu6A{eM09s$soCDv7kn_8nJ@oll^Aj!*;>SKAL#@_9%WbckIhX(G98Trp2+*nU> zO1$-0(EhO+cV6EN4EEyi;X^p_#!-$S*x0ld2M-=(H^7S*FJkAeo!Gs5H}1J-55|TE z@wKn~4c<6*1Xr(K$36G##lc6Pz(Wr`g6-QkV|ch9EiE^3;^ax3zjO^(uiwV-_!OpQ zXIbBh#J>xRi<#k5T~&>$sw&pGBG8Hi$!BM0_&}eNm4&jB60BRh7Hd|oW`@$l_yjsS zJ8rFVdG6 zF*-&O{1(~uuBW#TUA=wi=R1cWQEqT^>nqYSrr1*tKU5GnhzE zPh1QanSn)US$k_M16ahco0y#By5{EQAvZ4<6_u5!tgb|DeLdHY05Q`1BJhwz@u^=# zvuO_Vvm~59&!9Z}NmH$i8x=(*Bn>gr$Ql_NM{oZSdiw{_-`9`osw!;VyhS1;E-s*? zxCm916&#&%Q}ae_-n0c3WfeRg1kmwxi2mOOusmzZ<74?Qb`&r&n+*M7kVLh!%)UZ+ z3+*Zl(y;rWME+A3IT~l|0%o+YG_tI^OIj@~!=}+Zf(stAZ496$(dHNd5|hX%4m=5hsxLy_LDNOj6yv1kE5}uW#GDNltCK}R~m?&Pc^EqanBRiK>^WJ zGfH%^s4Yy86=n#T@(5MQxw2E{u`*+vUf^{!MdK+7h7eFt$l z<0%klmV9A=YTm+bQ!gOy@(`$Jt~`v5Cdr8?KE2BTR`g-rKOCcNw^WRTl~{cV)Hve` znIQS_SE-aYiQQoaga0WpB3(9B!c?4s$ux*(Rrrl)fBE%aL1R6RQKNb3LYUNTF0yTd z9|rm?V0@=SoJqyr^m0vjx>34aWb?ak#t$2Rt46#0dC3bxE$@UF9uXCb!+&HFhU@mT z53j+my^BIWC;p+y>ry!H5YK(bZB>C-tZ)WxoI3uiwuukM7UE z`Pxxn-2Jx>AfNhL9_IAlviQoax zBh!(q+s+-k(Ae0B^70A>JBEjcF)}=aiO~_(g)1u|x4*S$UcUj&%^NY$KZuK$F5+g( zEwpyDqm&{P=4E1jW*jr)Ll_+%!ZVATrV1s+g*-Stx^bd_s8Jc3|tKEm*&99m+~dSyPNPUin7aIiuZ`J@kEe=Zj^Msbb6-SCVOdMt^B&HwwBkZYx>xio3~gx@+h?Zl)K2g~OaYyl)k*a+AQlI( zFhG{3q<>jo)8NFOpu3C%>+)~mIU&r{HCuC!}1xdz|3Z@%X z2?sZF4`k8j6n|wr6FQu*eLvxWC)G|1q@Qw|CVnt{o(O!Bpz*`wA^_v*fy^SuNy_2_ zu#%6ql`? zmnqK&{@^I4=g8kaZVdS+y4PRyc^oS+dK@$U;!Y0xm?^Zc?8yda;Lw_IerQI4MK}hi z4lHN>%7m86WaTuk2T?n(F}(Ccz(mA+P1Ru2V!7>|a1jjlSzNsmtu-mOMbMwgyBIQs zNHv|P2^0VB-2ta@YqBv;k}^xeqbYI`IO`I32=)Kl!ZtotSMckXSB`G~{xQ7!qWVBuU z&R6uQTw)v1RsKNi9=?&Ke{!PNU=JiyZxwgd%NxDG(VFwQ&k3C1X<|v4HRL(D5DEiJT@X}jOI$l_dXDhBeCW9; zNKVd@=CoM~+oA7~gi-)2P3&Lz^KP&Bwg$UG$fv}>I&%0B&YV5TOr#wkCpo40PomMvSbdDCX}_x0i{U;Y~$K6D7@&tJfU4?T<@e&$DT;J^b|v#Jg+zx)D@ z9XW(E=gy&TXbf}6z+xH!5nwg!jbtFsqp&Y#8b*a#-3Cy|+*f%L^0j1F{TWS|R!1LU%{AZ~hT zbTCe5V1<}Ybo8vQs>Qu;yARbh^&I(dW_kvblarX37-y!`wQJYV+SZB@a_d`OX16$U zk!8|~S#DUThIEVOW>HsDi@k5V2V1vp#>NfnF+Dwj!I5!XzuAIISFhvbsk1D)PA-V7 zp=Fp`G#9f;-zqH~qr+p!NXx*QRrR=c_clEA_WMvyj+wNk+xVNM?jpLnZwQNw{ZRH zbzHf88RO$)d;n)L_OvC`*4Lu0z6Ny-^$cJY78RqYsDw4jh#5+nKU0$vnB?DaOifKP z_(%s?Vrq$tJ0xS=;r80h>USHoaodC+ROk1%dsISV6>!AvaKB z($O!08E$p;zeUWQ#<((zWDjOnM!Mk8J;LOrj2d(+(r#xXBc8?k7yfd{%i+W832tis1Up4?+!23E915>LyyLmx-F^; zq34R~wWqs<>Uh(}V+IzjX)XiHKOz0I)f#P~joC5S?&cg|XJC@EgjmNxQzg=lG$u|W z&W5Cuu)O|lH<>*Ww3!nnEo~X~MA&kU)hBX6I`dlaK0aBQgWvmdk2K;_XpE`MIVI*5P$ zl`EK>T?o&O$o}?c6xhE#wi_>y{%3#ZJsa_X`|Erk{{0(0_|30hOTafwp>9danQ+*K z+Bx`iT>cTOpYPQa%AKswqSiL&o!DxpJmBuWj50rxt@E-=$Bq$OmqZ=7(lWZwn{-oJ z)4d^>!my9%xnM1WnI>U9rCiO3`Xw7j0cJ{YUy8ljFKglMRQ0W4tw=pHQY zJ!+VH3y;2+Y`qFIiU0Wzq)8|9|7RbNzR@w`O)$^ylh0TK>*yg|AQAIhH?d>K4*bx& ze~8@&&z(Jo4VyNhxp@QDtXYGu&Q5&wZ@+?LM~>jqUrDZUaf?UT4yjs70Ju|QB>gq5)KF*@&J>A_H9O!2~DH3a^ zabHzYhAmq*qp5K{YHRD!*EfW#*RNt`ZWi;4a~K^P!RSyg`nuaN(A$Zj!2v!D=H?Rc zBrbdGE@W67MMb5|ISTDZbn5_1xJspC@({KSs9;_C&ngm{@evzxpal~%}CEGo3yLugsE0p zSBcuXTC7>S2DP^?|`=bo-EboX>)aBzSbR`ip}%q!FG%ge~i&EdW* zFE8WIXJ%$OBIMXOF|tN6JTij8!6A$ckD$1?m?I80uWQD}=4J*h*EKd_&6?Hhw#W#b z`x9%Tr@X1Zi8<{suQ(NNW0iBFBkXQ3M5J8wq~%E2D1+36={yE$j*$B-xx5m9MSzAz zrc+lpN{2xarj8#dxsJX1rbAE#7qd%AO12T9yXB*}rs)XEe! zY`%w?BGI*qI!DGCM3KgMpq%jstB4AzO}XL*_g?V#bBLl4KF9<)o1wguFX)loonjsC z?%=73hs)*%v1C+4_i19_Gc`OR1>-uR9kws0eG)Pu-2US=`eKo-yJ}4UZyXnAN%t&IMX_s3^`6-HzzOqpD`|f;lx&O zTJ`Zb&4%}823}~`C7&biQs=8n2B6m!xX`O>3yFTVNo?-G-QEciVUe zMIl^IZZSfiXX8&nF2~-nm&HtZFeS0k`izn4nwtjvvCJkuUW&=ChOpkKk}IM7g4tFC zViEHyKPMXnc{#|<$!3ODC=#L7GSkzM9x9xQnutYWl$)DdHN;J1D+SclSl7_$E`TM# zmAtS2Ew%AWVY^Y$+w@ko=DyT(EygbC+m{*>EK`=jvap;moHyH zdwVMy*Q~+5efOcSuNOT%eb}^VGwWheRJ)dz+xYt5{~b=9d;>Rb-NwU@Jc_4(=oyTS zPok@<6ED5=BJQ-_Vc;VtFCQ6M+5DFx4Q|=A1)Dc-!PYHXP*GWd!J$EBe4RLcoI#4R z(h>0krmhCH^>wJPtK)VpE-YlW(_sG~PMtiB%a^X= zPRkw4&CVbvH%EYzxp`#g=b)sl1RFPR;%J6-^>wJJsbP&Sa&xAvFI_l~iuz>rP+~i0+zO}6lqhq5OA14OaES8qj zP+3uhjm;bI!2Sc+xornFZQQ`%nh(Ho)(B;@=pGrmOI|Fc<@gdq+-tMPtC@PM}#1nCO600ZhibdoIF~_(|bd+%n z=)1dxPu_NJ?UNtjyeA@WsC7&vJ>zLQ{v7#V&Y>g@i1I(@_KY`%llOZn<1y+P$z$j0 zV!Ur}E$&-ail$1x#+1I*Ixr0qOh0mC7~i`%z-V{S-NKgx_ji0Rtfa4MigWPHJvF}M zXBU?6KVI)hq2fAj+_D5`Rx(&Q(ID^+rO|~+F!z#OOD`&5o1v07_ks$G1lsB>uQ<#am6vZ}k z^cQi8T3#_CD;rTt1+XI4SYBp4Kq9>4#LrI|UmlRGweZ$zHL1fzO5FNUdzCS2gJ2(9 z-`)!ZjWN#Zb zfGHv&okg?KVfC;?2P>0VSnNiaEh5ouH1iES{WS)(x%E|1T3c|9Vx>A6&dsudR>V`0 zLxrdN;Ti89+gX{<3UWE-y0u`u77wg7KGJlsUmOrC62S5qLCIFsx4w5;AUS{~d*#UR z08XEI1J|xyVgQTSGqp8UtdBG?IfecEAHcTlJD5q++S-C=pZzCXxpE0z-Mwg9+l-By zx1qDE2W=f4xN+kqM#sllm(hBs z1%>(fsH?4JV2Fg+hlU1tyx()rz1XpH54LXEft=hz28numyV23v&P=cK=g*+OzXuZ& zqYRFan_PBIu5pT8Vo`BADiYI)w3mqKvwnRuyD!q=oZJVAy+qOaCdQ}G^Z#)7op&k8@Vk1`ir(gOf z{n2V?wVIvj>6y0EWU~o^@Pzl?6sl0(+sv%2g5sQW&wcm3d@l{yqfw|BAPSl9U2o3) z?svX3Fo>&HuVZL<1Pcp`d_blHrRwo8fJ=<6xipq_w&A%0`|<9(@8ZMX|B%~qa&i)% zeDYfyI`k=y96g5a-d@D263k#>R!wFROXTLrFt*rx@tOqM+FG%!s|_obcjB90e;42T z-go&BPP$7*kUW6HyRJX^7b9Q^l?8iU=#x~i=u(GxX4T_>J!q!Qq~Xw z3=$F0XcqaXM5@AMTnd$WqwFgNgN$&wbM6#K&H!x&Y@*UjJp{C3v2kTZak>PuNVG!U zJLG6%fboD0z^o?KTT~Fsb6?cGm%%=sUZS(5>`4pe7>z7CM)92V0a()i3O?Dt6+iPG z3k2+v=_lnUU`oI!Q$9x)Kv>q|vg!SiXn>Z%Wrv<#=$P)e`Fl2%-)1t28vQW^utW#U z=y5tmi{`K3nPp)adyf0f(FhZBMnFM|Jjk`xzA|icW?(5ONPwWZ%(JotVP{fhU{U=x z{i#GD41yGej(G*=TFwJS81RJ-W@?xlj z_gwqRyx_f;YpjJGM2gC%^v=$C!|faWGWRIvFS8yK+|429kQ_3={m(@8Th!;#En@Zv zyNQJZd*){NiQBA{arT&nMBD4)s87U@T3Ev5d=}%g3r1(kUkGW>QqnKB62aBN%_D;G z6`8bS2sm9)+BnVkbm98*+l4X=O{Q?##kQzDsOKD@i%%iEt93;zzN|SLFS2@jQbf@Kr87JvVShzSTSblnofZ%DxOqP(Jcf3k%-iUjf5= zdHV`tU@3s*$gS|fK+Ig%EyL>Ch zXQm-!XECs=1)#JQLV7!bW#zLoY*)!)OUvZ%!BT98uxE>191E`w|6hHgC;$t<)bu!R z+_-`}cW$D)`yPge2U$#gbYz6}jlT2kKftT6zJ{8bB>D&XaOCLc3?R+S&SP|Z3L|5a z7#p8r))I%RH|}y>U7hR#NGz(Sw?BiG%U7bkt%E_6`w#BnSO5463=H<6vA&K)&>L!# z=zG+Q-rk2892{WA&I>QRfc^Uq;@Mq$QD5K4hgt$qu3f*1Q>RYg^5shy9UI|jg7J8q zK`L?U5n!1#YN#E^Rgn(Hb#?XFv12D*fBkiy57Sdqm>3^tv2QZ^!%ZzmGrq!#`qS^_iI&eEge_@#&|Z;>4*_tbtWi zSBC|T6gZFh*?DB6```aQuOH-M_g8=QSNO%x ze}#(|udt9kk6d@LA$_q#0u7B#Sh;EyYU`57E-s+GvkmLluElDK;@H*2!s`_E@UugQ zasK>8JnZh_{v|yv*JZ0RQH^cew_(%fjaa#ACF_+tbR?N@MU}R(rpB_4l z%U7;qc5a^Ah$0xab#$=nA%R+nnj|x@5>=H*R>#>zn$|xS0e`%R@riK^kB;L}{~!j2 zMld!ufv)yWy!GbW_{vLP!NKRAW6+G(%p8-{iy-H21w7LWn4URo&=Q!Ry56Y|nwu4` zgxWdwOeDaN_naTVQm{cUt{K2G3@ie$i2WyG?#6x2Xl0Q$l!~bfPDcNeu`cd@5^0Ya zHpU%LeixRmxUWfVBub%K#R$MD7sjA8rJtQ6z{(;>y;lJy#ujB8ko458&+MVhz9L4R znU@mCM1vzx)r=@Tdzl!wUu6s#piZMCvZ%XpYa~F1NdW;ywCr)7z&X{#iy^O!CeA=gS<1HN{m_WIt3@NzRom1Bo)y57Gi#QjFfwQ^{id#* z*6!eLHWyh&j=+Ly&PJ^+&*JSP0G9r4I#!r~2E0<19y8h;cAQ#3#)1hsYY+qLPk$Ub z<)pe#au_es*e_`ZR+CPRwcNa9x+%F;5-)TX^`3h2vilBiPMvb|*3v~+ytwjeC7m({ z7Ar3Y8hP%Qj`5wt8!M?pp5S4B8~f@Sa*2^^MEYGv!VJtphqhp$HH} z@5#qm^oVxSbhIa*po1b_DOBdrqjWUuE1#>4GieLAT^ZC_D=1MA7n+A}V7pW#oqeeAKt zo*O;kc7NIEUo2?rL?h(SxUfr}sJrT6v7ov{1*8KWyArYGO0Aa_ucQ}jo02lU0p54Cns?J;(6Sgv$k+>CW=*I?V$ZCJm49oDW{hlctFR93`r{rYu|RCwj; zC1f)5=xA?6ys`{sOIZvL_G55x5JN-5sIE@n)z@Cf?%jJiGGbX-B{Qb(-o1@mw{POX zgZu1?HZU}Z$>}MM3`mDfie5*+3F#-%ftTC|$HvBy$z)KIsKJXbzJwqC;0G*Bo=&GY zo<@JkKU4#&G=PDO|sKAH4%3D32%Eb&?P5ON)GPC3n5KnQ1iC)?w48jd=f?@8e(m z=wE=uwWp>h@!L;{eMO@97cek9%r2DV_LNR9u!wp(l|goaSTy@vC3`8mCU3W`>xqNp_-Dl%ckv5sfV^=7#bYLFMjbWoH>1t-6aViiN(mZj}Fg^D34VjSzpIO{%hB+ z=DwtJOFA{jZioch)z{TBByfm;uyYqNI6TZ0mX@|ww05+ky}g57NbBqB8T2IP6$Pj$ zdrTtbY3>(d`H|b=Y$}Zh4}0+N(IX5F4521bi`_eS(HKR`I z(A_?&7&!?>xgA9v2|^AdPF}uqh#i_CKwLzHBkN?dbq0b{aceY3=_Hk866NW`kh+>R zRch;gA8`w62XII>r5q?+-*r1z)J_iCUQxJ)^SQrg3$%gn;oM%2Zf>>GbJH)S?z!m~ zn%*Or;s5|307*naRCmEQBDY$3(B7n!G;q{bC;&VM+bg8Aip|!ZUSvWQ+lJ9=M`0){ zs%W7t8nv+b5-GLsjF@ETYq=jrVGV9uam4S)AyOR0KJ0z2eom1}udiK73k+M{TqE1I zw3qX(2W|}n1oH0}^pSszIb+=2<-?l7B$Zp*eC020&32n6eARNbt^9LAZnIrYBhRES z)UqCchm>dnyTYf|&9!>IF6HgzX?!nLf}{q3LqIdj-E zb6>h$4qB-+=~q3(jhk0-<_v)(1DKkgVxjG9I)iWh{s(yNE3dGY(p)-)yAST;i!-P3 z+2_abuy+7MBjc#8Z(?90nIxU5<=DC78EoCU6*U7R)AJD7r7ULV z=F#2Li@t$D2C1kwlZhJCR3})deU4lMXJ#-sG=#a?EaGwCy?5WmU;f*_#Ij|be4sve z_6%;_yoTncI?T;X;Pa!$aN+75-0K-aRc$ltWpT*+?1BJT3k#T>m_V{RfwgPa;2U56 z27dHMKjOJCHZjH;Sf{=?iR(9SVt8~6WgLZ&oOR1Mbp7JOBD*Zkr&36z(=5o|+|-EH zrUtY%HsGDN-o&@Q^=)?9B(UojzxXA7{p*kM*=L8*+uO&?GCJT}ZK%phG`F{-sjU@F zEzO9>Dv?Rgqq(U8E0-_FzTLa9d*@Cpq|^NVfBEab#fcNAFfuaA5gKFhxN%)uKuvue z15rDk-HEPcok*qTF+V@Ykq2olqR4`q)~`ovYX^=VIfirRE~2~pAr>AlqPeXFjcqMx zZD~alxsVd5*3gJ#O*OA;Bot5SRK?>A3Q~l^%6J^N@80DxMS}I&g(bALwBz+x-^35U z|9!MkeJU#<+#;Ico}jx#{qrC#b%o|bykiuJX({vEKg+#~cyspm0V2V@(0x}|9lbcx z6;$^?As?9>oige&z^q;dD+I_?O(IH%01gJQG7GE^wwM*SLG=hwmX-%%(M3f$k0S!F z7=$qUl^40s=tgC;mW{)1fd>B)y)Ievc`Y|AEM{pjlgkf&QTc_9r67y4y(ns+f@_A- z&uP;BWA-&0y|01+Be_(O9_IS93!(Q%M8;{gFs_VNBg*uU*;IZy6HT|QEVXHJqywxfnc4azO$GV5KQ(WP0%~;7SX7Dv11Q>lTE~j*p{oygGeP!G}HL{>(*=e5ivY9^$a>{rxeIUcl=(TA9yv%%hY*7G~ z8cd}+07dSVk$bfH!nK48S+bgmYd_>1ciALy%vS&5z-xKGrLRU*co70+4cfuhkn>t0 zcn>9uOjHF68#4T+uinnhp)nl2)C1{-Wa~D2RNqB+N1pN)u8Mo4aO_5TQTjm^u;Ag< zcW4gDCqDoYn03MC3+Y4M7_{mA?c|NIV7C-+H-@#a8optSFmuHF%>I_Qv7-7cID>Wd&)<0x za@nl%MGOb~i1Tbtt#T%6kkwH9jPPxZ#Z}3_o94^P*Wlp~`qyZ!bTOkNIt*P{MA^cl zI#1>EE#6L1{iQC@m_>{Qx5XswT)@@^A2dn++Zuez(h6o6td#e?Js8--gSSVxYqYON zeVakP%H_68!QKuhH5Zt8-q#ku(hDP>z^)^D;TW}k@XrHgsAddKnf+3YVQ&eNpyC2x ziGeH800q1v5Q~g_aj_7Wzj&;IMcr%SG1i|+R8=vcMTa^%6w-69y=``GtF=XGP}&4w z5h!L|2n`|JimTW))EiA~Eazdgx_x8Enz4V_t;BAdqHUr-Iku5K?74P^8>}eGXbKs( zIm62v`Q8db>AAB;dhY*kKYkZN*G=Qdr7l zaPYu>JpI&DtVh(--;cw`j^O;IOSpFPHYO%#F+0D2y80&8aoV=^DXdw&3QdiT3{b>l zG1k1I2!_<+#3(v^_%qzQdkYN>HHL}NK}=7KU}ACxGqY(VYHG1_=PqpC zycsK2uHdmaJ2#7=p#cmJ5AorDE}g-^@F==_`*7#ZUChnQ@w}<2CgJ!ROwY`+ju*Mg zJziX5H@~;O`WF7;Fa8{BRxprC#;QzN)|`3kPz>%)Woaa7hcqqVKg z%xjsu!oZqAyfTK?mKMDI)wl4&@Bfh9dZ%Wlap?2UaN^Vn+`N4YqvI2(tg1qJB}MR~ zh z_eN?L5rZeM#xks0w+72su0VZb1FEa5*maQpZfvL*5FB6-eJT4GCyt-OjjOjXF*Swq zstPo~XqO-^87a0nCQ zQ<$I4VAF;z_{z&KWB1M-*s*=PsxBJ0IRj>Say~q`t?QTX^50p{!X~)26Acr|tY6-G zr7NoQve7Z*Rm5CyDEQ(Nw>JB-x@x&Aptuea&?7E`77$>ue*&-;SyVrjrnbuRST{r` z3vj65I}2~Ko1OuISnG)DQ_kY}G-{cVqwa@Gk{^Lr>{{loeFP?{Qn?8n#UP<^XXD?? z6yy+{ChMkX^DyG;26Q8BGXZ?aO}<=Q;E9RFmo&z;u-v#mTHwkBvWR^}e?<3+{wUK( zn^-P#Ok_UYS4~7hbtlwSp8s}iAdOt;T{;C10rGFFJ7t(;w3o_{ltw?yymp zP2@?44^uUDF(6_U6d1o0*M6lDext~2CP4`zOeYcNlzGGX8qU8OD?;VUtLX! z`Ni*l&1~U{ zD`gmVB8PMH^TcIznE_rRZgRzyu!uoXu#9031ap_(^3H1o6D^`(?i|mZUB%SjF2}jA z2l98yYY&EQ4n?#bbr)u5tt_o)d{66bSs|A{ z@0Kta39it*i5^!ubJ6MZkmf031Ig16B@J(PY!w<)Y8L2oVKcs@%)QMwZ@>PIR~EDP zdbM@xT~hJw3@+)Qo$LOkMwX0oWnyuYaCzK(f=h#+apf5^av7v+o|;qk?P95vA^j4% zzXp1;xb-5CxMLG-TTzY!>m*XEr|)HI!IMeCYV!@Takul`(efh#beUtIaU*ct`)m{< zh3kq(Vjl@-js5&$bMtgKj!52|8BYb(fPmr~2^ETv8E zh~y^30G8tl!FD%C9Wrd30Q*qVE`Ffer6#9S9QKtiZ93k}vkD4&L@hZHh#gE1dG6tU z^TertD8bY%zuBLidMZGdGj2<&`Ip!%{s~`IjU06|^~p1ENPB79OnMHZV?(%l?Gg?h zI)tX?X6)X*TMj_kMXX)53au^83_e`Gb`5|3^Pl0yo!b~6pTYv`^HiXvwF9eGt-uQh z4`SuY6_}ZxVwTdx*f`d$U5jU)eufY0v$M0fc;Ny@Mh4N|-h!pY1q=`MV{BxQ|BR0b zh(Ycwv3NC$zpq=j4qLZAh5C8{QKqIQFgZESZhh(OBBp2Oalg9R5yc>lcvC%wlR{7!Mvk#Dl(3 z^bAg-yt;vf=;=KImuaD+NN$;QnooXJu{d6Pd198Gn#c<-&R;yd5@4q95;*p2Y; z;UhSD{5ZZieHw$qBMic&=2NWSMS5bye(G4(g{IaPc1NUMO{eBL@*gpn_U+!yAXZgn z45Opt_`4tf1jmk^M0a;LW@cx31Xjjlh$pJCeaF*Svu+Khrl*lkr+I1X=xE2LjT_m0 zc`3Vq(cvNVKN`drr_SL1-EIb_tCBSgUQroH3#+cSj{9rbvM#hX6N{=Gj~BB@rRG@I zi?qgwh1Jy3genqhFMEv9QHlaNh`V#7Wys0UEh4DoHhbDgB%j|BkCyN12Q z%s%V3Mc)zV1ZKu%GNOS+Ko$i6VD~}>ki^}LKF?$gxJBiwFd9-Ep_le#0)+@{Fz#s_ zgK?@Ex%OVzj zxBcw)v3b_)&8+1`Q9${5(=M)UP-eg`vKx$9WtnWo9aBI@0j}f{O4ec}FpIvJ?5I4x z18#@jC8UB_w64gZO~6TY5tV+{H1zh;)%a2nQW#j`e#*7t`iY*JGUCi|Fwuu)M3fZ` zVCA(X@_cD6ixPIrqAbG@gFpK6J7^J?P#DKXEBY;e*&?fxuT4!yMjb>A!0a!PGteR_ z?ICg%W++70u6R4rzt9xXUV){_z7Zx0>rc)rlzVV4YUo6k%U@Cb*OyDv+jK(wpo(ZA zvkK)rNehnu2Hx4_B5J67S(s&)8vvuiVa#j-=@Ihig?iTnAg#;wOFRE80f39ptId zE{R$MqK1Cx=q|pzkpx)ZSSYY@g=H5~IsZq&L82Lk>}5sI;OKh$^DcHWl+ccO$|ytK z<aT|4)(%PmikW~Jkz5H~#}r+`M~_T?4W z&j6l5VZItzdXefpU~YBgI3j6@IJ*Pu7?4YDMb+H&zE|)-y22R6#`qun0DjbX{ZGx(-%U2!O?I8|1R#^*bL-%wD=R({NUQRsStxn)*MRO=EU;8nZK&6Pwo|4jf^C4)zg@zM(~;*bBUKgPOsYth)$ zg!AXl;@Z{oSV+%cZgv8r<74O@oWO%eBgmFjGZ4nEyHzo9AzWHy04X&;&n&2yUw8@M z`_6aK*3yQG$_jk+n~!k#$mh6r^9Cj+r&yn=sye~0dSowBzbq^)U@n!$@W=?pCnhmJ zJBM;&J5`qBgRj4bAN}Y@Sg~Ri>XNlMe&Qrfp8f)7&!5N8C`D(CGpme%AlB1bT0m=i z8ycGGIe$9*X3{BCRaK#}t`7V6?7@M3ds(wgs@4)7b8`0j{g675sT)A`+7cX4F#S53w^Y9T5=L!PW>yl_` zZ%5a%E+lJfQCnNb;8%M~6B=r3Q2uxkQ&W>H_D{?>iV#T*)AqI&)YT;!AnhL*=02R9 zoZ+GS)i=M2-+%uDEMK;qqbU+UB=TJ10!O;8xidQo#Bx}y(L1z%b+pN=+ndYa)yoWZ zWi+6LFlqD8HikMhd$I1X^?0#rjSh};zdQTTNmYqYLYa$==r$!@-Sz6{t-QKv&q?2V_(HQu! z7eEB~7zUOBun4?j5Q|w@%1JiB3xidn2d4U0S;M|k*JmvcUj&(eDatVB3m}cy>qZtd z8@<#}Ku_K)jmW&L_5#@1v0!W{NzYs`Ssf~~_nL>LOpgsH=Uq%&S3Uy<(!X6|kxCUP zh~MuETczl#DYz!Pio-hF z{HK2xLE7-{htx#*r``MlhDOxMF46*Z4@l1G>331+$d#oSW1l8>v4wCRQ~*ot7~hW= zLFOa(l_F1vp-o$K8H07PmSD;EhB{5vSo2bjU=l@?(K8Q=Y3JfAT3Wi=AHnpCJvavX z*ylPKUS`{mrDhrF+7{k^VKvC#HX-E=90GiYgFv=&u5fcL&}aD`EpqOLKNj+7(QZT0 zgVoNMl7@yDpZZf!A11Vc-7@(*#D0^<9aNI^FFd|l@;?H%2%*dbC#9%y5!!sk&)tG6 zfoCCvkblg|RBCo^nx+7`U0hP9=PvREE9Q}zyqto0M$FHUy{4G#KHBe{dE&3Rv(p4J4c|KRuYASYMd7B*V{FR-u)O&ttRSzv z3S%jVB~8vP>Hvj$1Ml^kZEph}seX-j`%41u;#$Ffnzx z$e=dvKjx0rB8jS_rQnsOsk$FtEj=Mz>oDkojt0c?)+WP>3ihvAa(GNpr$kJ#sBso# zVC7u`Eht;+;-G6DpDewVl#6V41UrvR&xXyc;-}<4$l=nt`jh#56HK8iyH(r08|88w=!r0glMurE;F^WO1WL-T2GdFKPz!#@4;_%T^n44b$${(Y%s~s(^ zO{k2OqXOkv%x3ZY{sZ{I_kVyjYXrbLclIo}AB`ZhRLQ_o zvNnmDnrdDT2q2oDpXbPilVjs};lM$B_uJpa%4N$@lT6}QAN?AKKR=8cw{Bv5Y8tim z^@vv|n1Llgg1G4r!-g1DBco%OnwY@C{45?XWbnZ^-ot&YGO^qDg_eeNvI zoIi)5u~AgU;+P?wu(1gihRWHUba`Afu>^$wUJC_wL2>`}d>0wUza^ z{_$5I;ppc_asI+Zc6p3f#j$G5YOLL`4h>BWNF>Sia+*OpV*a$Wv@%<5{n|BHzj`%} z9R3VPjvU98OIOj`(=Q{ObgHUiXzT3cNQhO51cQep=HK4Zh_2RVRALEZV<5ReC^ESGB`j}1k{DFh`+S^~luARG?1x5~UK>*9!>jJh_ z!EN5Lqs*(GDdb*2`t2=o05{AeyHf*sV$=x+tenEqt1HZ%$$_n{8tzE}I=e_yQ#D&l~8rf~n-Bu&_LU(?-llDs=Knkt^ zw&ja`vZVdo)~iTbmu}FZwD;g`Z4t(gf8FvG-F8^ynyFv>ZjMhm2wF}<7VLQQhPOmJ zCS2$}`F2h;|?ockJewxP^KxUmv)4!@lRD z5)C#@Xt|^f+_6zq^X08b{*!8S9i4BSfsp(Bmmg>TI_4P%X5tqQUKQ1PVmJ6!{V*&# zw~-6-16=SbtXlclpaq&W_sHkfHP}bNau!}&3bAYaEoO5LNmw-yi(3yODjoc|a0T*^ z%>0Q-I~I{(V3g#HER$?b4IBoZekaSPQryGqoUh8V_IWqPS{7Rir#ksAj{@7Lze;%* z*hq{dbizel7!iQAZ!J0Nh5vX_{`{_adc09h3c1fUre*~5Qw&XMH!_kv7ed3pVsUmd z?kiBK2D1UN=yP)6QCC88CnRPT-5e`oq>LLX2^r%8hMCBQMh}F`V1P?KfCzI+T=aM> z>H*6%NpP)G!C7y)%B4&R6D#+}ergRUdBy^TI);PhQ^=rp*=@zHvXrgIOp*@a&pb+n zU%1{ErO^X4i_Pz!^En@Y<+Pu=;CN-DBkv+cM~89u&TUjzRiUf13)R)td=fl&;Q~&5 zaT=d|dI;S;J*=}-5sUNKBjD=QS6*RvvBkv&oIG)y1=bVQB-~xj2ly4smNScLR6zj02Df;lM5j+i6+M< zaB%gH>HCP*a!0uRs0>M~{=heGew5rcq{G2i5h9g|AV@Zjw{eGnkm1#>Ds- z=B6f*o}I?KZ@q~h{@{n$@$@rTxnd>Goj;E+&Yi`H)2A>nGK^Tf3bV5*OiWB7lg={u zSY1t#7YS4#_b6e1fL&1f>WnXA(cs^xwVCvSF2X9 zWEaF(yi%BX3ybXLSevZFimqkYx@9w-*|rsjKRblOhmPRvx%240-z&q2g}*D%+|`Ly zYuCuUDl0=RxiL1?W6g>#R967QLxY$}rP%eYI+;X$Z4K&^)u>A**yV8{yM+G1A@n@z zLw9#CR;^f#r?zavTW`LN1N#qHcVY#xJQkh*Z z1n3!%PJ4%PSLPL8*qDnS7B??95qOPTU^zXR1NuC+dXwxTY=A0eF&Vc`VOEQFq@RJM z`?rh{DTnNz%>LrNSy`?c36j7|Wi&Z}r$_0=(3yJtxRKCS*BKen!C{~QVRcP#omLO#M=K@%HDp<_; z4eeg@qHq0--jl+z@z1#@FJstr_W(o##6%?Tva+;&gKLb7JqRFR8bp~ak?gDRG2^9Q z+~!ko5BFuG>sk1mEC^r)w8F&g!0#d`x7=R(3JwO_Pd)OeMC!hvhBq^%Omsogi{V>p zb|n-+SQTOy_d#J{#mVTV@bn77INDkw3}23zio`SfOEfKb)lj_{K4=QrmcP@3i{sAX zUt-jlHqRT^Nzc{L8(2E#fq))&#v2$M=*PqE`?z@V97cu*&`@8; z`dL$x(^$1~CAMtdf~TK;hFMR2{rz~@(~VoVZ=!#o4-=CU=*sNPlr$y>SnRj-14eI}g#_ z(~adTmotD>Qac0Bzw-h21!ShZ?3TAEvM=FC}~JNE_d+_{c{fnH|0q_azy z&nyC!Rm^0nAveNALRd6($jfF~yJ~uJ8VC07$A|BKfR$Yb|HNJz<#V>w+>aYYJB|hCpi4s zVH`bn91BZXEL*V*?Oh#c?`RWkA7aT=R$w8W#mMjoYHRAScGYT*EV*abvp9C-2tNP( zC=0>gzD4eud}0S;F*LPzVA=BJ97S&-yTG7dYf~N8ty+O(RRwF85vWJ5i^NPLv42|2 zh}}k!7~@q{SXjt#zCAsU*yXY+p1`~Bd>t>p{4z8Cs9xfNB?oaH$vj2u>L#;Vg|)4j zWL6$)N6NhLF9$nLYmo?Ttc7h^E<~*M~4JQIC2#A$Gs&l2_lrparC}QRk3ALLv z6u?q9!OVhaWvLDnji>YijZ&BZ%DC<+GnhrUophPiWFim>`${yjgcaspN~xQh z0zb58aFCI53J4+qmc0Za@XY8o$s7p)SVnu%6>%5+D^CN9`@*t_9!q3Q({@}x4uN9! zFUxikh)%R4h1n$xEF$d_0~tlhx^%&ha-40!=8*9h`$L;R1R(QHrDg$X;6Tc~Sp6lW?H z_f*iFD{&9cTVBufFLeGWSk{~ax|gCg)bsdVppwRF43?o_Uxl`nGY6iuEggH&+Smo%x=P8+tC{zk)V|apm>rC*%gv8eSi8s!b^;jkoauNPXl zB3=$3HU5VqSz4Yw7kr^W?ei42gnEPnSh-n;t!%vShLzHO=rCe}&zUkttuN6#pz}?> zmjgOW(Y=wIlT-XB7`U>6*i>~o1@5veun^i;W<>cC@fStc2V2&l3!&?t6x4QIQ6^ppX<@TB*7+JHD(^et)7#&0nfThB=x-P14tY~itBaBPy z93b?NW%YZVF~M~+H_i%%<+Otvy51dw4tqg6TJ*N0kHj3%%yQ?5%O13B2cP~;{;A`Q z1rNMZ!=Br~Wa-_X>%Q!<@Cq_tpK$hut$yZwT(TNh@IY$s&3)5PT7zNG#{|qQ2#cVi z47YFH!iCG1@zY=Y0>@9CVx|T^TULhMyLRKfcizFyojb63( zXD2PI$?+-d+_4iczWfT7uULtiWE~5VU%hq}(=!uT$Yz+W@ZiA%T)lFY!6Evg13c+& z5zDB#u?0JKK8v^CdIukV@C}TP^rQFTT})4nAw55bWTF~1iE6~FlXx^VhHJMT;MCbm zIDPgknp>OE)Y8lm5^JgxtXcKc<}G;hjW@A+^%}IdcHs2sGdO+vB+j2dg9qLBSVyQL zUd0R{5?>cBFk)yB+ff+{BBD(o-`;0;THA#H* z(I@!y(?d9Nlp;TSE0JL4z*29%xWX>k(g|Cb+u@1uEW}u%g|6)jiqcBgF{2; ze$dU@VkG2VOL|##bsXuiu|fW(F*HokCA)i=iS_EMZ{VdDU&glW+tJmz%m6LQBr&IU zJ(a7vTYyKvYfMOlLSAuvbHcyosDQPshhF4C-BNU$rRT&2i)l6-MUL553hbD*m4E`( z!&0)Au$PRBp>dyM2G#-rf%He%NDIcbFhc++Gq5C(0l5ScQ;FG2l#gu-&rMOI%}Mk_ zmbQ{8h0NB`ycL8qV3E;?l6fz{5HT4Uh%(~qteM5a@&>pv_2oJm#;dvzGAr1CJHnU} z0e1#_8~}^nWtT(++o)d3aaI>{8~IO|R19EIq)g-HCl^KpaLG!p3@P1SG@yy@#R6cN z_R_^p8CZrrMgSfamG)DP7R-@=RScehG;tkdfR7$>Sax=oW;arArB|!O1DfPX9&aY< zpa(3)Hz2 zc6oxaTd0_MzArG`iU4d1PMnb3b?xA#+%$n(l8`niv1yCfob$?{1=Ry`PAOErBj+gk zgnbtIS_$cev`g+s(R0}5l>19KMB^0A`_(P4|AAs^q6Z}ZK=Hrn`3}CUrD=r6Y=+a@Jyo}jb3|z%3QB_%q>KOe_ZclnhTOtn~zOiPe7K`7C;ZFdT zIYaRCWMngA%dof@#4^UNR72b%e9g&iXar*&abeepb?@zLy-d1#6R%@Oa68imCTZVz zGB?2%aJ645tAajoAte1gpewI8$~lM7{F|;fWDMg#$GzG^PVfUQnzGd7sNg^J`sVeQ zum^Hqb@`+DR`cA^O;u5VkALR_pExgExN!a)?%uwJSj8e17iKXvIgZqPn%&Tz-MJeF zUwQ@Ug(XZ(&*JR)3%GaxE*7#W#Ny%tI6O3r`}gi+YI2HQ^XSk{;0!UCnwwhj%+ovZ z-aFsGAAINcF+M5)*38rh16VXys^gWYh*e=Gy@-*id3|{ao zg>)KQHf_RdufC4etJa{StrK6IK7%u7zQDEXSJBt^h@-hxR>e?NlRyQDzgLp06GbqL z8CNHA|6Anp5rDPx>1XifYj0qA*D_{c9XWm!=P#ba(8w@m=H?k56qXBt0>XHno~0;+ zbC{f(;dYJ1W5{OGn46x$Gf!{Bi_brg=l1T!QyVwp!TozUf8`o}d-!wQxOblg&RT)K1xWtDNn zYLcj_Z$M=t!MbS-;s9u9sAmS&vaVLt)x`05DT}_|KHR=_o0)U<4Na(Tls^P!(X;KX z4Jcb$V7A}&>o;-b%5`ktz7xB4?ZF#wyvZ(whA(7Bco;9ozX|L5?FX=&*=BX{a`!5~ z_`334&0I7-TMG6ofW>au1mqZCN*Gx3t`%;#Odnz7afCn?L1(FY{@Vgq*+pjTk?Un9 zyMzplKLxND*dp*j+yNOh@-fBytSZr%G60rfZ6X4105H{=k|21xPsqY3>?4ZoXQJjR z6N^OH4a>-Nl~hKWFrvhroiA7nh{XUFyXbkM@D@}tg7C~*<7jxK@ntR;oU?$v4B~VZ z!15yeF;HdqVzaC0Ws=!D-3XQpK03EH;zB4aXa=wtyb{(I?XA408^#xdb57l;Cv4f3 zspsr5?)i(yj58*5R13G#Ft7|Dr~sCNaMVw_rcB_t2!JLGs7X&VPWv9?>pwZ6ZoVa3W@ROid0suX1a<+opQzz)AFgUXzntbV1#2aJh-d-Qg469K|hCrL>oF_|&<)7ib z;gvMJ9m75i-PH@`=|rOo6epNRzII?kIp~rRIVXzP2m|{^QRAeDhoT-S7QoUb;u~G7 z>0#^%O5BY?WxL(n`Wn|gVK$gUfMH$<2nA+SRWZAYz$kiN_FPt^FupWO*ldKE{_1OZ{gv17>Z@PDK;I+WxN#kW1AUkrA4D=y ziEL&D1O23D^%%)y9ky?O2D|qhz@@76@QhKwDcIi+I2H-Z$|F-~N4!4nM-f?%SA~8Am2HCvLW7CgNEFTO#RL2vDRgyjwkV>W5g>Y_W7F)MGg_mD^8Ou7lkgTu8iBl(V{?d8$4fJDfF2#`) zNo<~6|JV&|afyMsNz%WXm}UTrbjOH2l}^oJ^M(!BwQ~oa-?tB2H*ZEy_d{I1aTAA* z9>euJcUVN9#MP-BB=SvelvJ+jsyG_!>sfz{fNqMCI5RbgJQM0IT~YU=BeWpVliR8gRbM1tJ{Tbk<8+FXz7SQ)Yl8T35t z;RuMynj{*Un$g_ShNhMlG#UV_t)&6+3M$6}u3Wu_bLTGbGwauH!XN(dM>w$mdBcQb z*u{=~ckgs(VF8Q8PPDN3WA%S*1VN95#rvL#(5JwI2w;oQJb_V*Sz=ZRyGmTL96cl^ z(ug}BM;IiRxonolh|Xt9kF?T=y+`9@o;0xx>q-GE`i}IWRE%8#EVC`ybwS-1ZG<{z zVR^1%0%FN}LW~@O^av7a^Clu#Bj?ahIcqb^oxypE;fL#f`ey@xCW+h|0pU zHlDiMnKfR^OJFpcT#iefu3v7{K`;8CN!#pqa-rk^SZ2SW@gXc{WndWq%K%OUV9`<_ z?vn<D!RMmKd2V|vfaMFgs&@v?8bE1^SB3{*c?P$$4ulk1 z+!q`-11qlXiL5h#6%*GV0e0?k7IS9TL+NCyLPqag4~ToBa_(KE7L zw?Vq~mLG4m_HJ&)bweX&iRiTX@eMEIQfJ*POu01Fx^r9Z0z7X2Smu@$NLPt1s$d!mF$aQSKe(IDKh(`BAqd+dM^TWO>7+g#9CYx$wJ1 z*|`-4Yk9$t?6$^kGjx(&#OTNnZr#3(9uid_7{Ij~H*n+TEi5c%c`OjKX7k3)_}W`v z!;bAwWA&<)xN-9u&YwGrbb1!q%q%mo((_ZSi8Vbvi&TaHs17V&u?F+$EN17^7#*L) z)k#E|73_8L=N@j1&{Nl414}rMDRe_8mY+ zdnan^k~n?t3@%@}gh%~-937FO7*17AXe6=q z%^No2;Qj;H_S948?did_TeorK)G6G&cNZgL<2*krDk|BHEW03XpOi*jZ7r(eaRv%f zsd>yzPqXm)o?W|eVDBDubuDAC?!?KHICS_kc5{qX#ZaA0Ad#pM)=wsbkr4r}#)d|* zyt51Y_wU2YFCN5KUVae|A3nhKn|JZEUwnk~m##ANEuKiArZ&mUAd1jP<*AHSvWC~n z<((|lK0h;sd-v{QU~mwlqhqLVXhd^MD_UFI(9+tD_VzZkG}fXv5l2;}%>M`7-MD@G z4g);(_09Ob-}?{;_8(;JG6KnjiRG+MdPt9&D|tQ-&Ping@hWMUF~WpV_&^T%)=kg| zwcBUe9g9FLT~CcjHi23UQW&73tc(FJ0-`9QAOTt4`c%fi6lp-ENcW6be+ya6XT*Jw z-eEl}!=hofkN(bJngRL^IM3y=u40B^qvGf`fUJtR3wR;sl75YfequB-y|m>ex|!v9vI&+c8cx0*5;mY1-h1VB=T7Xwe$ zJ>1j7lJ#8P*FYjXrVNN^!6ue@Gwd;QA;b(UWt6$hGS=Y|O)VKaUYqEi!Iwzo63Nkc zwi>pSTpB6(M}4IXE_>@@S;xjjlEF8Pfk>dL(Y>;aF1uOD?9j_N7>A88yixiVef)XcB7!Z)NeneW( zzAwC-quQ>BL92&g_fQh@T6CX9)xU_mwKjQ|OI0E8|c#rP)VPPn#tPa_PFfKTenvE+PmON6?mZF^JZ=o^Biel z?O!V)sB_9|D(y0E)Zk%}EzF@r-`9sDur9i1Df+ zZEl1EjpMm_E2B%8VSEVSTj6p!)My);^+;hikKvSS!$`9_5V`$b_EQDl+_gipiP#NH zKbcig4n}UYFwIXze9fVQkEzT$P$0{g9F9AR@1$k4MHnc|v$AU`ByYb^AWXMkmqO*n}NB zp2hp$cppFb!5?5|dJK;qJ>bZJJ>B&F<5E7_z@cDySv0^1!+uCsM+<9ESdKvSndH$2mq`2*fNg=0q0T_r;6R(V;yrP^% z=IIYTux{-JJiB8T+FCo1tgXR?OBZnM`Ze_R_c0*Gg6fF`lC^cr+9LK9fmZ}b5G#xR z&_SEnNvXLxw6(TidJmj0_EwsEwWz=% zsw&AHGKR77QP#|&w#=j#@#-sYV*lRfv3c`T?4BrWO2fpmV2d}03T@e8tA?bhkd3$h zTVO^RoQ6Tg2mi&aj1dO=v;B5YuXLk^74PIeM1oB{B1eX+O27BLJ0!-vwl_EExu{0$N7K`V(fAf)w(e$8Iuf0xt{X@~YZd zvTAzEiedgJtH}tt^PP%{x;qSXWps(1U;q#6hNw&>6WP$}RXHoU1=Y-&?XY-tonuy* z6>T?b8Vk;gK)ifs05ZED84$~CA_8F9l~bw79$QNDU`Dgixnj`DFwzv%OSocX!2TKC9m|ak#UFyY?HScw=mB205+fTtl zNB@dlT6O%Ios~f=84X6TKQDllZzFTQ%VC;?Y-(Xi>24nNT~XN=ULHbCiYUu6n4H~c zb4<&UPkuH_Ct6xg>GNop6k=Ks+S*=Ug+!cO0c5hM4Rdd34s#UIBU&xl&+y7gH_wfI+MZZi-|mxZ(TA6x7^+eTl4Z& zB&_X17M~*4slv@wxSt9?5x(B%yl0mjyGw^pb@Qoj+~qAqDSRvK#N0JomUGj=o?Ym3 z=ZPLEW_;=c4nAjWkYYJIoI;p(mTxJvM?bGb)C!UPU3egrFbULv3v^0&xBAm{UJ36~ z_f!AFQ9~f=bFH$sw|a0$)S6aYGX-)q9bDYIA}v zg^8o@sos+vo`I0p^sE@t1Yn8yx&T?Cqd~t5fF~$pLvr;)AHP8gaILXBIX9( zMrxFGO75P60G1S`kwAckgZ|vRYeRD$(CuZJw2QzPA8}6Ke zv9c&HTSWh(hd6!iERGyIfkU4kL26-EpP5?Gk2Zrm(Ou&*LPM1?DqLD36i&dNu0n8w9+ns%EN($Z!AvAOJ~3K~#ofHl4w$ z6)RYTzH8YsW&ja@b>-R>%*;+>K0PlCEHfsAB_kjN;lu2hPIX_JnHVoPk;7P zJnVhM!u9RTmNSUh($dTT*1EN8(cDmrYtxr9JUAy+VPJ`9ySR}F5FN`9UB`~Y80|F{5O^?MI{f~ep zj<`$ORm7U2bQqBH($aqLG@*=(w=pLvH)dTKk6+P+GNSGTHZhRpxXv5qtYy*~R+(KV zbzd|?N!%V)yGzq`z$;e=i(UC?4^*v5hp%h)UEYTcsAhwgShqjwH)80SJ~X2I;dS{Vf~Yw7W8|99MW5IODO!+yU1zg@t&2a_RRIfW_4dI?nB_qLODSPNNn*5(s@ z%9|AONHP6h%rp7>%N8fdr13}A)T zKP+!O)q6SlN0@FbriVk4C{&hGmKbjwg}mkF9obj8^$yM$-Q4m|pFI6!$5+(&h)&rn zc4^}vm}2eG5_Z82BGkgr47l&bK^4?<*o~Yx^39QjLaW4f(=+j20KL_B%yV(Bh>Xz z0IV2;R|H0hN#W^=5WvKmCrk1-v0#=KvrOkFBb@=Psu(jK=ue`GK&(o{jBu`n-JE4Y zZstV~MQ(k~q1{-tIu>0$7@cn{aBJ#r#o?V>c^!=k5UHDpb%oUaRU=%-zr(OpBVUKM zvbX4zqs$^lvBhpX_BlHxoLhFTuS5)EZ5P9;(gU27S9LxdxLcz?*+Y;SxTcY)jGkMh zd+q7%T=bjO?{dbhtLYUrXB~o-1A;~EU6QA0#`x!?cX*=_vB+*X5ANT=r-wepk>e+D z?Bq$5#bT&UCehj6jtv{uvu@P7)oYQ>EMh4uV{bk^i~0Fk%%^6Mnw!GZgrsMjT<(jwWS@&+9WPrxr94+?=T=n;1Yp!bZDhCMAJq9Q<`%G zW-Kf$^1n$3jDR1~vFd2=!0w&9nDsU~GK%{>4{`3&MLZ<8#QAwFQ2Sd~Fd4%HqLBL^ z10eMKLIzo4oUK`dr#5e5Vfc0H*5dyCdtBdRCywL6!yZgbPnj}RSP^HcYnt3WhetSI z1OZUHo_z+-J+}{KWlNY%E#T~hE4X#98#A*cR1enPBIXsnTCqDe}+t|2aJ!>$@P9kmKBN{k+q0A=*K7z2acQK`N)3PIV-*Ggs z6u=iZF98mz?OBA|(qo8$Wdz%m*E{_nwjz#cSbAf&H#y7<9YvBl*7#n?{CWH;nmEpr_zMd#-=$9 zxTO~o%JP*3m)pm(*@P*lDJsY$;E?Dwa&$uuJRruHy1X0n!Z2rL?X=8Z<<`Rho_l?0N`;-D%CO_SCbUe5^Sq6Nw{b*bgy?Nrd0fk*fYl%dG zq%wH_HjyxCtlP1W7r=_zm^>rZTv2(uXw)e=uhr|MSMa&g9}R=~bkLkv_)-Tn zu4$k$IbCfUF09V}kregBlMJ3heGtg2)I&zTB87e@{@c+%VPi?3cC1iuH2RYY9qwx@w7{<0glpu6<>5|}obM(5&}N8e8~^b%m|$>`i%i|T7})dzheO|*l@~OY zSqzO~jX#h1%Byj??QP@!oRY~m=`qEI?TwpAzx>j~42YQsX{X;@KZ zBlUmt@n1ZRb*2N?sHN8g+u4Hu_wbfMy#EJ>qiy2s+a5vRcU2y0iV_9Bm zFgs%3zFt>m7GL6dg0%d*1+R<&ug11dNY@zitjppBmr>)~(A&H&aP~z7tU|X$({G%P zJ*=2Pt?Q-Hf|2(0!rY6S4Ew>z?YPlokt97WEL8!KVc=gC?V&1!sTtrxTOnR)S1F?p zAao8YUR{L}pthjCE2ZGMnO#0468K*u{(htfAo%OiWC&h&qX~ zzxLYec*7KR>C6&l=293O8pGu)H`pDpwS5^5 zzW6HMd-om8&re}!un%X>oW$iTSI|E=z;1BlqSsL0z}iYR6cw+ghM8CKSQWP|0V;E| zlwT{hY!n^jh@*g9!V(GSf#(!gqO z@51_Z8`09z&Kg*kE?>g!JGU9cAwY?kSJd93ttDfV#kvg(hFlCu(0nnQ#q{(vYLm5S zX==tZPd|h8Yd2tgd>juSJ;KGSSI|4q&j1!_dl8FC+!O_4}$0=iQ7lB-%KHIL;T zomjJSC0;yu5bM{kLvL>{E?>FKU}bl2FJ{syl#|PGyo$?3fE@vEsks!!M#njlBn6k) zv12=)e{LUYlL;)9Rp9E4o49+w8^a@`40aKiG&41g(a})`&q!GQl~=xk=l1Qz#`Wtl zG|-11|M>54`RaA_J?cm2%GFrEVLiH*b)loP9nDQmNG7UKM&L>&&0~YWD`IxtzI7A# zA3VbBYzC{>Y``D>@Q?7!Gf$(wHp%Onbt7aqYfmf5Tel2@#cnh1Hv}g7ZDwU$u??V1 zA}2ze3U15arp?W|&+j_m6@9Fc`Iy<3N^>7h&&|skZXyWM-vk=M%SoELq)~$H(IGXTc`E*rEN&xcr$lm?P{uI#Rrb8Cy%b*|^Y|y;XvwDEmrv zu*6+o^twFvLYE1~j49p6?FE&BTT)gU+ZthzqY)Y%EZNuXDsBN(wIQUA0#;ESsXh`Z z(J+-QQ%^3Ah>1r4)&h+S2D0Q*NspZ#Kxd*XI`)UMiFLo=I$5Td>{rSVR2H(`Q0%-Q zS8NklfEZYYiAB*c?H>iObaX^BupEmz-^nSjE$do>g^k{VR(0M7{04kjkr}{hEfv6e zvQiapvfTDib2{>{WNuRb&wsgtSy#pUL^H4oyltqIdg|iR1`PPHLr&pCcJPTWGcLjo zLSj(;PJTj9ab@`PH&^4mo$bCX9*w8)ga7?<;YJNPpgbx2BRVsGyU4n$r!%(z4uTT| zu=2KH{yqzB{eoRmoXejtnLNd4PR8()KY1pniT>xG-^XvRkIAquSSGh;yv%%tNuhxz z6UVdZ?UERld31$}D5@=qHv{rCkRGZEl|Scu??pHD$eapJ@4{uY%#D)E8va65TSkwE z@G^=nkUx))|2!JN^5>hIW=paXfB&zx<`nwh|MDSzbDb_Bko(d+|Oly$_Nq1zmt`h=k(Scsw3Q4nyz$*cr!~mwW z=ny~#C260~!G~_^8NebpLISYL3LLu)>#dEp1!&*>aDdoUFbN}Tk7yJW^U}xo3RpmP|F?%i)tJ$v ziQ~*^J_^>`%rdi&$wQgyN`yL0C@M#o0Ey=d$UV7e$#+hP?GJ#cAB zq6a1tXsEB}{HVPMB&$u22FEIX;G8{_O@OxGqdq(s;U^o zB2FwZ{6vVm0Qf)$zYP8Tedv8Oga_S^(A3g_AO7GEv2V|AEbr`OHXM&`WmBqdQh+sV z&1vIeD|22}M2Wg*4MW2)(P(h$KIr|;fRxcC3^FGfBrxuK0$h=|sjMF~4oRDhz^n1; z8O%^WW@s!BP(f?FM0g`%e+IsoeI)=E_vgYQ7KnXoqYmo&A#0xqfJ?b)?G{mYW!O^w zqIJk11?6KT@TGL71+195x|@3-o_DTOd)folEvr@mGX`FkB!6lv2f(tI9qRt4u7n1} z@}d*^S2c2LRHmJcf@d@e-FJj>W%RGujnKF!vTLC_P!r%qp9>hod$eB2ILt2Imx&Fn zAeI@Eq9kCDMqOcPT`+CWJ!2TkvW{>kg~7vv~hE91k_6yE$_&iKpyPd*)TGth&aoNe@Q=d^;`6~5QKqvMmcnOAlDeojJWvC5l4 zNQ3KsRl?wDtBc|If4?{9jsNy!LwYJ-C+ zYT9aJIQf@5a$4!X`SE@H!-dh@30B1VQW(IBPQ*LjhId>P9;L?km+gA5pYpFwF6k(U zN=No}5rHGzUGRzLV4g8g46J=?^LL^iP^2y8S!Ma;TQg*^NvS20nYa+LA#99m3HdGV z2x1_Yv0EV<&CJT8NQ7cw(*ZzSO%@r%Qe%?cMjkJ*8yEpq(VJX3@)6*phO)Xx7!h{`e~fmA91hfVLUpA4 zJSJ^p?{Cjd(6?#?<~}{|f@1_iSw~T~FN8e>? zasn65U%;`WNAZup{uQQXrjSV1VEv{I*t%sCp4z+-4fVA+f9?!3Z8mS*gw2~aW6PE; zxOe{^vw4Pw1{t^_Kx<-h9K*xI48{<^Gdebg;lW{i@IC=p?_uYT9f-%uaQL&|;@Xvq z=uUn0#hC0;N)uW;^j!ZVokqD<|vsf&v!q%tv;H8&eVhyH|;Xz!xb_I7I zJiuHkjmKpbNY>UONn+%QYSGjofppXD6bX(*&8d6}U@cp=5*_VbEL?y4?ky}mUPM{> zV^mdD@z^1dDU-@zK9%yA6~+xpUDpU~AmD1{$~DZyYHX^<&6_uH_ud^03=CjuYKmDe zssR*_6VoXs0`O&J>~=>$53#Oj>=8?hBdAqWVmkp?>o#!ILSmU+xO5SBAKb^_@GuK{ zGjoSKRnQK0o2snfD1_CCYGy&r&&-NTVrv^-e(@zd_0$$jPEK+eKmO#mxOM*?#-^qa zOC(TRTZ=^k)|efZMTXqfX6G?CpGInaj@er~p4pDh4guljF!pPR+>^c3c1XE8E1iA$HSqcUED-+TW9Jbz$6p4zkt$!cO-YveYgloViL z$vBYpN`ZTwb1Hx?AeLhxIE*XN{4s8d#{HNBYZ$#Dy~Oa?S^`=H0WA7AffLiI6vn4! zFg`PjiRl>z3`km_tRluNP+HsRS#rPC2yk?1A(00K&|=1{EYQ}Ta=|na>ei@)RF*Od zHp<`_YhNa1j<5?N3Iu-fZHsUhBRg7aXjG z#nC>6Ev0*-1$q=>GmJN_xMfq(9;%vGhIPeYkzshzKE?a56OmBhvA6jc{8n}Th>eC5zX5xph5#g{9! z*@#O`#MUpj!Hv1>-{1?ZDun?o%`ku4VxWtdN2fTei^WqCmuA`Yxi@Y@Q+7S8UKm{p7P5ymH8q!~H3}jJbQS ze6p1Qtko{lJ-oC6B3MokFVkXJyIVuJMZsW!d0xe3MGM1;PRPc$7}qw+kr8}n1Dlej zn^Egxp!yW9*!mKKUe)mmB&y=5t%{*8QN@1}q=OZ68CZHIaa>JI|ZoIkO+Sj4X3Nu>I%=$?H3E+w8Hh#3j&; zF6C_DdI)6}4T&b30~Q(mhHb-cSsGc9nF3l5?_w%yBXzYuYig}lx2kU4 zdve%k@BLkS^(GV*Mldrqj+4ia3!7=}nzdNaun-j$6%ui8=gu97#-fPF$D}OzcW+-W zVzDs+Tzh(Yaq&VI-geL1ar^Ce;PQ0}U_JlbGuXXrI}YyOhtiTl0k9S>s7GyWtz?eC zQRjswRPSX_zA)?bC|uD=ek=m>gyy96ZaIDcNGbhDX^z*m4sZbYKjX`fNakOf=` zNYQ_&ysQk(%`M`ARb5qwqm;t6p2F1B1ZJRYCVofE(Z!Q!%0vib)Hnk;XJyI8m7BV< z(hAhoFF-^6LR3{(qP6uD&Yo>WM`s5H28TQ_g4YwgBETe@Xps!(3ge3GC*GS3DD4ZG zSa;dw;;qGvZEt@s4jej&Q>~}a-gzElA|E6}QcnRa$jP+JW;;7e>Vgu&iqbOFRoCFU zS6z#hD_3B2bQGsgpTe`xKaUfqThZ0mhpb4R_??keHcMYUF&v*poD4LwgvR1%XlTIF zB`v70uR}>`3C^86hhxW&V*9r3=s0%{v++q}P-dB*Cwa+@01KF#dl4X@8T;U96um>k=;g%xTjh=< zmr&P1l)!v(uFdQvR8&|}LJB4ofc3hsy_90ZG*=1zo@sQ_9c)MQyRXY{m@B2u6yW_C z`kk;h=a-zMTF@#;IH8)O*`xxn{`%La@EebT71}9NH%@cnqZjzc%73`5`WtSysO0_u zBb-aHF%XB`Ate zgy6r<^^fDog;-L53BYq102x?2KA9|gB?Id>`}@ryO}ZYMTmcGT<#^9l53EZ7u#yfD zOmCcP_iUe-(2%WXj$1zIWLlv^vRy69y)`}akptVSwfky0220a6f>+#-!-hxmUh+Lx z*Jof;lLA=sL;cet>Ud@7^{}mYxHw$E)aN|y3#{;l*!xHeq z684&bkOK75Q-AJCi{Mvk*aLyB>Z$_q^ ztP_->?^1SFwy<8#ojZ$P{puIkzWoKXww{*HDk>^*`|Y>mjc>RWUFXlCx4RR=g99ij zF2$NPYZ1xK!)SCA+qZASmglz!D3cqB2zzOAYEpcW$iNz(oRlbfogH0x=e_U3-FMw1 z02ozY+qOP0GQt<0e^w+q_4PGav3x0-o0~-LH#9Ve*4DE?Mjo1$tinC#C1_|^fU2q*F>?ghW!L*H?L21!}8nQCnMw($W(2_H^Uq$rE_ynWxcl z_AF5mMDilSgd3k6m$7NxW$UnU{d&CW+G|l-TqLIP`wkq!j$M0DT3#t&7+Gm71Ex7U zb5lR zxPY?#j3A)B){Zsa8s3hrhV`S2RUK<3ilB}({yb(tDk~e*Yjke3V-}w`HaU%<*cf{H z2XUddAJK_v#HMC2#cPdMmB{6o2ks#WZZhhn@yQa2ml^*BNVC~=z$6`Sb;R+QU;^Ar zRjEO@k-W)sbdjrUU#CnYK^_#SPjZJTkD04fTtB*@S5^rUOb2xG*i(j`OE8IjSLQ!@ zP1!>UyUMWgMpI!r9wq=-BBy1W^2cf~lAsyGmF=YwfGwb9*;vAU&S8)h4YWc4i+?M? zW?4=~X7AOvVJ!(mZd!mr%9;sG$-HR~4eVSgjBK8Wa9mOV%i02riℜ)@}@38PCid z;rlXLS)r9o8V0dFATvyFtuuR=;?|}~pX_azCwgEhyN_w0-&&l$Ym}~%naTVpwalNx zmw)6p=~l$)=E-?}mSQpZir0uKb{bADQe`MT1IyjXB#b=s%xTzVw#y}EH@GI6y9#*4 zvbsV%@K;wPJ?1n2aRUGO(#6nJroD5@4_|TRq(1RZ%chzu|IV!7t>zP_hu@=;Lcf~2 z3_f>fOR|KpKaOw!D&m1e^#Cky^P6yqeVF&QlV10;gk*%3dFo}|S(Z7E#~PV;QLp}gb{;4Iz}0k|}e^Kz3^RH?s|*sJCXm;{zva}29<0$9m= z=|G7kHC3qihpMKj9=)YJedfEO@&JOiN2K=s46qZeaCt>sYg?^%di^01r`ODf+ z7zUOwwO~(&4fDrHJ#17Wm9?1YQv7?G+u2!-MwpX@g4|32u*wQ4Bg_%@hn_O)X|=cb zH=6)ml4~!sCc-vym27~hJ&_l$Ao!*LobMZABP|iE64wv?+(uxs`Svy){)}Q-RC+LI z%E^10>l5j-9efWI->b!CF?s$UHsVuYK2ft{vQ%6E%aeTA$W`_2vT`4&C-;%e%5^;D*@NBO~?^ zr0MPH!I5K!@W2EAhW-0rLVtfh>TBz;YSn7obmPr<^)*-G#Ib|uY;VQv)C39&i%?&` z0ON52Qx|dk#4#K@eoU&2X65vuB9KJDhRmJOXbh)YTXF2@N!OzJX+%%&{ni=Y#MEE=2ZCYI?VSV=}vQE?IK>ly@zsj05R>DDu7Yda&} zO^gaCOhq|(rYzT&y|QizG-Z>`n4K-{W@K~}kw^hbODoX0s7V-PeSO{Nx_BO~XHMf{ zZ!gBiCowrYtDA8c8Ix_>Gy06YNS>rsV>C8`*0ZP4cJ2($ zb#!7RI*#!vrce)REby)jMD-k+o|y!urchN;fri>zY}&XHEiKIwX^{Zij-4;!_^DQO zTu=auEHDKP6d31*H9k&{rg2P8Orf~26y>FrBAF~JEyn2RFgiNU;l&+0aP~|qMuvuj z6+;;#rBE#MHS5+I0P7l5R#XVEx$od%Y~Ar9GIJv+E-Dn+XMTP}z`de^2r9};B$6sO z>y!>gM@Ge*KO;MWlc&#MWGs$_3mb9GrmOI#*S`UkC1qyF@LIgL98O*{_$*-y*vNRt zanBCiR-PR8+W;08(3As=#C50%xS`PreYusbqZwq18T(*#4Bh=hxX?F%k?~24PEKQ- ztUAgtX9;X57-Si-D*IEg!^#JFPl;G)#%)7_@(t4MA*VM_7;h~DV0jEI$-Mt#<%d#! zl0k)1?3imuX^)j`4iN~>F*Qu50(Lr?c)*`M@G%!3JZ((lYlGU zp|J(!jA6d16Ef!nh~ke#6jbwi%iy+SfXt3E=x0jF3NT65BSE7{GO-lEvg|;6V5ViI zbFi#SjC5Gm3&!WtdVyKFp&xzGX9tS+mdr)kcBBWGLrFGSf}8~287zPRR-E7}8DSFm z#2nyBBbX%vYrX(h*z(v;d2?@0E_rYA|HBu4^U)L%!rz2R2ro4OspSe`rQ;7g^IJj_ z1>dl^1V8y;vPa6>zO@&JJ4e&+C&E5;<8@zZcEhd@Wqbt}OX1sr`8<4%-QRp}k#x-~ zyJso@D_KGqlBl_g!(T)D>-E5G=1TLW0a(tG{E~n#yOp@~VxMD^m$Jy_%6IUKX#uR4 ztp`>}WrQI}-pW38Zj*blpWdXDUs_f|>LuL`(q$k#{h>m=z#~HL=_sH4CVPn)b1qN) z&H2qO>1Lp;KDH>jh9#qHhpsfSaZtclj}E>f%W-)m)>p7H=I3w z5HfViGO4vFR^YVbu-=l;pqv!WRZZyutYBq$_X=fTr6`ubEnZ3G1}n~{VO2vWHZAsL z2o^|@mgZ(E;CGr_PT@XTzW;=71l+vYsCU7V<%U2`dg+5>7x@U@Kp<0D%Ym zShHH=E8@u;j4Z^CQ+C7Q8S>hQhEha{_3LjsU8a^BQ8BF5ST8F#Y`J%AY`j_M(PRNE zm&qXCHGV1@-OaQSv#IhyNX!26y}fv?8Zr9}4QqO@Yz+TYUTz-vHXqp2gtMphV7N6hJ<$y1EJ#73C-?Efon`|KJb~ z95{qsyZ7R)_uPv&-+mX?t-D;J+U?r89S0A-j1wo1BhE;8^qb+vF*^&h)AVAR6vk9- zZ6h{ryb9|sy8>%y20k<(o?AVA-C`6^(20IT1h8nn&&_RiPOeA^ZMzgeW`a=&qbMva zL|uKo0CDwo3($71U4WPY0mEVf^opEMSb55BQAUS?Vq~b%IVoJQfw9VKJsLGqzPsH18YEmSGwN+Kvxc+i1X=%pH z^b|Te+p%NkP8>VgiuUst6u`>Mle|-Y$otVWoZuiqtci&!}4<114>C-sh-YMlv19*AmW?GX7Z-rHv;3TIR}<^v5hQ_;may%VO z?3gZx69zQVamrmSC>XEoQ7uhfIv8Npu=DheDyOxqE#>$q)TOdSGe60k!M~L?tn-Y5 zxq6Ud4s>i8nrpnn7Hh07IJA}}4|lB8P*NZOmN8{FK@2pQNRZ_#0aG&B7qgI;lY@u^ zOQG+iGO=>9vP~pl9{6y)qa2q^XpJH$V2~*Tm2cXpky?%xz>3p9&#lp`?p;e@P$hPuwHRy1J4Zwu+p4_GYi+Wl;QjDTbEQAx81)R=laHy-q#XI zNbm1c)LxONE`#vfr`lAfO3d$B#z|i{Z~P(h{<{Hi{vKE<+HF{Igr)gX(<`HWDgf&h zlxeE3$mHUF_(~FLr*F56?7)<+zt8WpIRPv)Cd}_{?%Po*ZxpgIg0x7?rsxO-_A&_<2eQ({yexwYoqIZ9O5~f8J%1;?c=( zyW>HcnPr{_G5#HVK*xJ8Z9BW9Q6lxl30a^A76B{;uJl9uudY+AY%Z8M`Jcz0N^qlh z)({r_urdN!blO&AWsB}eV#009iK^!nWu$uEQo?RB^ow#&`7vhBnAOF&$Z>K}l%I=& zyd30F{zP971AK_zmNBX2rd2&h{KN?RO2T>TY4GGEy>U!PbaR>SF=E&*vdH&kk77t| zBQbG@VHW?^OUMKM986G4I&8h5D5CW>^1E5kpDZ9xG~OVddAv2Xl`2zkjvIAZoZAhl zv%wG+k4O^DDZh#8r2ZwrdC2|0WgPhaEqZNWZZYf%SudDPn=B7tzT*tW<54LiZmtPh_4f1%gN=FRZzhuw>T0Sh)yFC$6T>4>96NR#`}QBk z^*7#vYp=Zl%`Ho%uf4cqJB}SajC1YhFg`g!LmFff91?I&nHkJ%byYo9ty+iW%hyO0 zJquv<_V!?4a6syh7Ycwysh~4m+j_TYq)%6Ik+R76Q&-=BuC5;RbYH~4V88flaic9} z#cc123~GCv%@9D18%zF|zsJVnQXaXv1hGoQj66Ob!`N6cn^$V3zQ4FO>DLqmB= z^8^?+UW9jmxShH#+uDbF{ENo~Hu#V5$ zwPz15_Vi+4U{KOc|FXu$Ml?3mqM@z^Bg6eTb@CJjhlV8@C1tCN7B!-;uMg4D5n+LB zxO^k-zVj`ps;Cja9}7hhY%ydKhl%AgrIdMM#!l0Pb*MKZzg@p4p2~=}&M=}38%5=W zzC=#Dmx9*>E_B0h9%8;fO#o|r3WK9D^b8Ce0BZ`P6Em2QsB~JF?CAnv(I1OGeG=VH z<$v~X8$s5y1#lR>)^o{<-k1t&`Ys@o04EMu=YnvCm1ajcALuZhi`~M2`R*tv6ng+5Y4jMk!3B*TP`Hr+6_DcfBKMQIM(3@-brR)IS(LgywmT)VAUVvC zp`49;%IXPZk+CInA)^hd-xUFNkq+h%u-3pTIwxy1Vdlhodud%O;AbNUl0_wk`{J*t zpL;;2VVvm%Vpy>rvyR?ZMsjS%dTq;oR1hgku@KNQ)jQ8>q($%GMZq?WNUCY)j|X5G znY|u}7*NVc2nk>jAhn)r1h5EX**2|gGF>RJjfMbNDK@6w+x8E4HI{DEFrS5T>NQ{b zPv+jNIP(eS4`BKCrKdwdZqU<&8shQEpebBSO#!Z3QGu29g{Uo!pfEQJv59H)M<+p# zs^^aNV{hBAcfvKF#eQkNP9`=FuUcM?``)@DsYu@WotJU0pV3N!FFu2Y?mo(`9iX(p zNJ>mLCnskxIzAozvUzTGaV~00bEV@kFA9_;mwRG<$_lb^{qhQ|Sx|)L>U@;sXG@u| zF)~e^1LHV)VH7)058-sT?+@=I2O0cQ96s(WB(p;%KcDB*@G%gH{`XLP{nK3_-@Bjxe6|5=?w?e~X}eJdv>p22Vh-YyGZ+)+ z$N98m_lbJia7{}oHZCs4in;<+7UhU<5bwz}p6!d{V8t#$}RE5GHxh~psFxO2Koy_6X+h%#dfeZ z62ED-a2de*#v)w3qy($#3Q$v$gW|j_S-3KdZGCYZJ|Dxg$A{28tf!gtfB71A?>iv{ zRgym2xw%fR zc&3?U@4n(wv!<{3?@F7^;fBY*M@?}K9{r2eNxAvbW9@igA5GlND`7xlWT2$++uV0P z02bw5H!d&5hQ>m)ROg{IUn%ST(JAzfPGMhr6i*%<^7~?n@(z^7{HErlI|aYy&wZ(? zI6eEy|CXP& z?`Tvif=p%^Z#TwH2UIXZ7xi}0=`FzRJ!QeJ8+F;7m=j)&0H&J+HF=#uUL+d@5wfqi zSkFdomPR8K@QMp_N-1QnBJ+i((LOL^Svz6|Eher6dNdFE6mDYtsC|~TB>o~2w%jbJ z&2L#pd4|*W^xgpirI?(SAb%!oYMc#??oEuWCD9n(>7Tww7Nw24Ikc=M@gAW$Er9?j zN8K1GV?t#ax&hS9lz?%RSqVeJwuan1g z7+{)D%fKS2LC}$Du`B~=U)EgOusAfI{(Pcsa#reRA|A)H&pw6cp5KCh}Fx-PV#r@I4#1HFijj$(qoNCaTw6T)U9=tYz7*_jDcRhFT? zu1dg&?Ce~OM#pgGY@0BB)~wrr6|2{wx~2gW<70Sn=S~4X7-5egZ1d>kbu z#b~HsfLh83>*~?l+mC)>bM;|lWC-KqaRF`E-YozjQMsn3F*+JUjAr#>az151C}mhs zx`<5rM)C7WVQ;YR351OsGjyTNWMrx_`Z#^8v|o|wL<9P=@^a)*rkKTuaZ|#mBy&=X z>1BgW_E$tU%NE$+ZvvA19>FQLU5TJLF)8`Yk3>*hScDDh*JI_1<>CQG@bdhH3utX? z6F_NrbX3wK?BQUo=Ktt2d1BSepqDc877m*%CXEN2OQ&57;TUM)^Kbb zeS;&oI53Q%u}N@mGMSNWn}`Qs>EVGN-Ht0S7s!%+Z^tO@;5sH)R;vwUV5Tkw@Dy;d zGIVz#renKhmYFfmi^ynh;<281C}HNez@%(7^7;$`c&t~K8Jm4m^TgSlBd(@GMy~{x zmYA=bsD&!+Gaiu^u;TTqJ2XC(=3exhld&%Yc>-YN2#Cd?C%HVx5m_ODD+RCA`-*Lz z;8vE1b$tn+&6ff@0`APt3i!nO64P@7JbKJ!Q#T$UF71M#63fQ2b`|_o19)wul6onB zBPkVsD$^c>nWyurWmPMXWhI52({=wWF^EkN0y`&oY+!Ge$W(xo5<-cXNgpf&U>ToC zk+`apz0_&O@{c??$BxFOPzNV;zv}&oYVO6|D_t&ztcVleN^xuZc4`3YRLW%EePta! zch|DO=ihkZEPn7@ySzux>d$Xk92yxg@uoc^6Zrb$XYug9u6b?ycYNj=6y@pW>6O0T z{k{Fzdv@5ab_85|_EVb!x7&Jh03ZC!2?uBYb>-)_BPPH_ z@MX)mxhfwYxpgsaUR5cbbw00S7ozyrt(|!2?dJ9Qv&RSVfgc_VUYh~DWn(qId{0Z#J#PH!K6DIF!Vttm z%(6Z7nJkNMzGErgcv%nxJ=rye*MDPw%5>hjz8d$xEtrO{KHiS+K6l=${~K47;T>1j z;M$fF0mRn(w@Fb{?}_3;7_lw4_tJ%Zyc}x#^HH8y?y_Wmg4$lrGa~V_*ZA}*x>=cDAF|l zjf)EL%l9WA8eIRigE&9r0(W|oCqBG7Bnn|KKJ(zYKpOu1#yWiTmWFw?$+<2fi1_}W zo=&(->p2|2QVAjZ;D@fS!#g)u37D4d#q|u!>`TAxMAtCQe$CZ}@}Kg%<~rx{IkGdq zIm0flf;Tfy3EaYw_Rq0Cn5&$Bzt5BNMH6=)!14>qf|^Re@E7Cyd}mwao$_k0^EN`f z%scop3sD2MSZ@%YiRG@{RH9&I73v>l!Df>_3yPRUsQ_1gAR(XSG&_Tw9F~+I_>HCKVKLfIJImvJ7~lFWxpr5~T7$bGy(!Zq z;FV}*tckG!2Zf2JLjyrJS3W5lS~BpmG9}VnbaWVxKKclr-SRXJ9X^1ZNVc$aZoK{` z+)YBuIA6ls#A-%=e;>NLE*ijT#IU4vlPOZc$w`&|&1R_Sx_}$XKA4=G5DJ$FgVyR3?j0l$atEi|5#l`$75s4!~XNe#f zi%A)>Y%0pi1iUIND3EI?yNoma@i?OKxa3X!lz^;k8sV#qQoy{4Nd>kHfK^pdE|RUW z*r-GxJkxp>r%s$gY$S%snJJW%m7=Vo9HnJtXsE5hs^!bDxN!k0D=TrXy&bz>dI<*) z9m0`g$3?PKP*^PT(3a-KXsD}3_r>$ryKkR>J-PV>Sh;EynieiVY-A9lLjxG>AHeF> zm*MWa-;VnFMJOyRuufJEcgT^#d4QFUH`e3N&LSLMI0m9|bPbH6dvFxvWWVqMSq7vMV1&R01jM4Z*fg*4 zq7BDhNmwZRpZYg?@S|6z zkPu!vfc4Yuo%qZhOL6;#An-7sMedfPefaBN9+O6v{PNSg<1<(PVF0YQ5pTmG0M;ir z1s-bwEOxF>yrBv2xT+y3(xLrAB7o(tmEL#V0(|t=rg;NbiFtqN>@Yt3^P}jC8V1Zf z3UgIMA--|%N?|3vlGmxO7(Vig;~onvVeR*a2e1;EU$aO7U>y_y>&m7Q0i;spFA>0E z`tN&7Dgf&eqK`R+nI6EJU#Z`)q8#_VrDfg#qkC5lzQ5Sjg)cpF7G#@vFZ1Ug9KiZf z0)T~d0M^SMfHl98(5{#szzQGy?%Ys?``?-XU_GG#7TJbhyQc-$EGY?1h7Vw+9&t7< zDw6v*Rz&8T6~8KGfgkVe!j~WK2xTVeh5q1eC*rVi+P=5Gu@Jxdz{;ewy#AXT-wardK?;zaJm_kF)d2uBgq_TK}*lAW#O zZ~MpBB}XCr{61W>q!?d+Ym>+pFXhFR1GTPjBFX4c{c)$t;c`p@=EzRhA; zHbZt@Z{%BANeL&a9t3OwY_r+%0FGT0a?`XjQWzs&Zsj%4`+6HaAl$9?@O_)X`cXaxkWnak&w&zcxW#dJzvYR$jZsIp$ zB#ataPd8^OpV3W<+s9O1W7#zNd;(vrmso5BJ>6Y+=%N3@3tOMV`STqpuPDQ{*Ia{5 zS8T$S8?VIl#5AJO0rYfrqObP?h6el5e(oF&9z2MGygV#jx(w?tUyrqGFT+bO?ZK&2 z$5B>Nh^neG0k9;h-OMy5C&q>STHm+?)pd=Sp3MT~e|ulrgEOtI=8Kz}c~x|p5;M59ro@>Q^p} zWj8Hm<>loS$S){BBrhLr?d|AjZx?3Q(D0DlGZq^|Or(GGew+5%oA{;8sJXIiS|_LE z`r+Xb0lOxrC=DDJAgj2fSO6@hgMEg5C^wRay!-+IugGHaZO0+Zs)GCiWQdQ~3}R76 zMU0C_6hSAlqGUrp3wh?y&@c)L3kAF?Eh!Ojs<^mV<)Pe2Pfm*0mW`MOR%7}8WUqtj1CT<>%v7WU%nc5-TgK!TC@aZWo4exxPX`D@IXNU z%f8a12ajFkE@Q*?w1LkZBXZ+6Ch}6lXb~2TNRrhnQ2fUN`(Zn_E9ju6-4Gu$Mj*V{ zKZLISVMM7cqTE!Zg0u2lC!kDei!{`pAOpwoO|pjWGKCq>Cp(W>XOf%(pCy*Kc+t5*b71E)*C$IDSSHws z0$4U!h)Itkcix=fkIyP0RoF^g#pkdkiciRpj?A4&wt@3SRlZ z5+e~>HWtTo;~(j?MbXU|i#7dirGy6PGws(NUa5RfWqkz5c$lPYFT=p{A{m>giiUyZ z%Sg2p?17AWo2kE|&v#RnmmZ=J#8MwDd5&SAT6w$Hb_S+qrr`is?jq1#ycv^5e+83b z$(nA#mk0|u>&Us*iSt@r+mO=fFaARTSpWQNJ2o1r+Psn%a?!Sv1NhL7kNBpUA=mt2 z0IUNdU9=rF6@c~OpB=*w-nRzp7lm(tZSt=C+zydOIzxv1{pmL?!F#U#{TT&kd<h z?;gN#Ott>rD`byC@aiY;Ul(ASypsAD8k@qO{_uzZM(!Sik3aN9*AA0jvWl_x5+L4+pTGIx>Kte_$0V3sZv;a{*X)ZK%S1cQ^muY{MO` z!}#D&PRS`>y4TzXBDx^j`ti$>*neMrq67c3waeT-VFGdf`?}R-_~zS}Bqd{bY#LX8 z<$z3(b5UU*`^(iLt8-u9+HwK^@XQ78yYB3k62N*$8N0UO{`n1mNCwuhVPLr{;nV=u zU;X+F{_*Y2vQT;@uZgKyy#J@I*xovvy7=VrX5pOhkVHwge`WAO=N5il2Nvduvrzin zc=Z&(p2E{ON8^1Z#TJ~)0IU)K%Pz)kY572sU${Xglq)-RedzQ~cH}Y4dC%j>YkHnZ zZW0AC0p+tN=x!^~wY|SUw~JKD+sr|`k?KurIC43e)#zs$ep|K_DkC%@!zr8KVxGU% ze@LIGX2b@>B2&c3?0k8nhIyA|y@`Tk!7H9}%MXDpO`FAR{Hdp&!p@!B(BI#Ktjt*~YHUE`f;wSj zWoOb1I17!S4ZCFKXXdHKkWXg)}leq7pgdk3*Kz*mztF)+u4^ z>Ft%aPWBZUWBmg|@`KDQL?XE;E2GhPk#4LV1|92)QbmGA!^5NEdzBlZ0d%eaM0|~p z#icGN`xK-0oE-I&o1I2pBqDXfI%b=ozm*d0W-&E6A<+c$^YcVPs930uE#u=8!k8)~ z^GYK56$)TT_M`eik<>UD&>3CwA}J4P<4B+;H8xby&S>1(q*gijm<#96EeNz{t$(9Puivtt@9@ zBRVvIb7$MIq-6!}xbq$?S+X3pHC$^;M*YAACL*32tyPQG8jPDj8s4nnu#}wZtnAsc zu3W=>JK8HCZN^IDpQh&OW-hR7Tw|Ip@IfXSgTTa01_nlB7#N9RFdD}&!Ba{=IYvlx z%S1+2mbQ=S8H~m!!~}j)7_v4Bp&5fMz+&ZhMsh8N=hm~zFgY!NqUB>|G>56il)IjX zE?dhU(zrmB$8_?*Cp(W?&a$&MN(8Z-*_`?HA`_Ywj0NU&-l2rhn6AsbV)Nz$c=m8a z{R<5l`gcTy>`eLxW+9TRCho$%k^>hPz{*sB%pCCO-()81GrhUdc%3Qx$}+Ef29^Sq zhTZGQ41GzZ59}EL%dphUIhQO(Bp-}UY8X)#z_JoWf|@EHRYQCmfzZ~q8`jRQA#@01 zK6Ks@rkpk27cVYb?-s-&fTezs>igxda+tq)FtEZFxq%g+Tm2z_`zL~zwCYR3ywWVT zlNPn%Pf815g{`Uqh=lOYrI(cS`Ck0ZC)@D-E$+r9_{~2kfMrIzQ~(w!rMIrFnltHP z0M@-%*WkALH;*+;E$>5gmMF8u*$JzpyCs?pX;csqlp6jxCf4=?H5Z?F0V=~a`YZm_<0W3d535NmZ zgKyru6mMLYAR+9ggz!MHES$y|24H=A%Xz%{@=7$8r)N#21F+tFStY*yww5^oMthn# zS6_PS=pa7y^VFGc$+k5f`FTr+m z;T2m3GOdhJhgvg67&eYI6*m!*?7~$xB*I`Zeols&B@ye)Mvq0SAQp{kGu8LQ08LhM zqP|PUmqQGv^}e!@cfe5*6&mj=VP0{QAYcjQ8M;9bsfWpz0xCWW%V%TxUQeF+uUY8} zcqQx+HR$z)7=CNzhRU8YTVTj;dK71~V5#E)V@-xl+4CNr2auGxwgS6>6*kW_P0KY8 zKBK?~J_TSh(F;95iXfC>XbA9OWJsP=&~7XQu;S+`*^nd{;EcxY>g(hHSQfC7&6NS( zB-#}>GzP$;Z&yYJ^284KI8nzd{3$fJ+q>8GB+k)sC%V5+Vx zLsMfNRxDkF%CaKl7nNh>+AGksbPc9vvcxd`=#j(d?!Jil_=Fr}OiT2@2qL-a`J_L& zC@3fq8DVX00~#9YFg!effq@>8K$00m@J_&|@d>#Xfhv&zPK--bJohPj`a#?Xj<#wdeiHgxy&qL02r!=uQ^%0VPTAFfiASCk+>FBdu4ITA^b{eU2Z zN;R_t9HN&M8BuxpdD2G7U}C!1p7IIM(IlN9vGh5DV>tp6@x|*XMVy(|J}M^Jl;j#9 zNEl>>5hjet3Hog1N_p`fDh=f(QzeOvC`jg(fOdv4#_y0VM&ORo8w(4IP*YQbEJl8u zoyEv#R6r;)rzlM%h&3}cEt18|tQ=vGl~-1xvZ5Sir6uCaMKH3zpN8!Hh{t1?oR|=B zOuWCw$K_tjmM)W@<;#|%ucsde4;;h`&uzul?OP>$TtQJGR;*ls)vH(Hvdh+q)U)-> z8T1bf2*6oYU5)DUG8E?JVj>p9*)wOw7wye&z6(p2u0%rvZ4MN`;%_l2H&Vd>+r_dr z9hR(b-~jhP2)~dZ6?cFgVRe~tkag;M2k8)@%o%ICuBQDO7{X^Ei9?qL+c42urHy1{ zK|DI?ITxS6$k+s;WW&*@-x-@GrYFT~bs#z>{#oM$NTzIrLhbu9a|dL1hH)!nrEh=6?@h^Vw2KOA!-+*JTg6 zj9odDF$Xgmc~5^7ywUNW0GG~%z66`O<&dmWL6s5O!xjEtJ+M?(FW{At;7J5RIXH2A zDQP_^&o}o z@&PPi+j$ISb2wz-TxU_j@@5%vJ|MGCqFG9Qv>k{f)tJ(2`js(g4_&Mwy{75+2Cx#U zKk(n+#x1a_a}k1s1*^Z93LcIdU^RJhILF%6{WuiB+Il5H-CAz&`#|D!hHVrqgRM=c-V`E=}#T$ z!|{tTjKrtJ$i1#KBGR}wudhzYo_gnZ4`AOp%2YyL85y|usycl3_GESi4W9q+3+M6J zfnK!rk4dLxU!kEjqd30%ntCw~4|_d(tRElxNl-p^{fcry-Q9Nd`8!%ro8S$``~BIE z&36O+!2c#Cl47`?@cQCi$sSm#>VzGdCg<^q87aFb4)@{yCxZSusR1nYzVTnqZZM>~ z+LUh(1+cpCc>%BjTT|}@kI%Tgu^7Mn;F^>SGUnsA2m5fmD+aP+3L=?USzCzP)>U9h zbue0}o9eGW*$x6X_SuUn^U#uTJw3br_O9gi@yLNb{O0A}lue$d@%!mh7T88-7!R!E z``!3ef}XAyQo?}bl&kxRNC-m#tb<8aWD|4e<&{YuSn2w1`@p#LeNKoh-*1Zys#JFLw8s z53~@xqDTo0I3JilZ(dP~@4Pbzjx$}a`szUpkfoX8#R;F_O)9UoAMNPI-~P5UEr9jj zYisc7*Dnk_f&Nd|-G3;_tIurpFkb*`aYe*1yZk&?6=maZ?^u+Sqel)6;5Yl#vny=6 zW1Br-0X0+5cJa3T<7<-uti%U!VY=nSF!r`b(K9-U;z$-6%5rhrnldn*sa`+Z)r-$Q z+>!io2pVMH^4ox)@40Xy?{?;oIi~y+$+e(^DMKegsqdF6Wl6aSd1k7+`jd%B2nE~M zYbAvSF!2}<2K4YF&$&_K{AYM~@NQz{2By)N+j{A=k)tf*!v5BDSPv0RlefvTVWhkh zR~vaqK@DAGbG@QbuqsTTqva6-yUmY4buXYF>tGUUd`J zUA`I9$dY@VJb6s~tayq)7N5XqY#iCSd15+F;DtaN)1Q}Dh?3HBR9DxcuC5l*=&(e; z8y}C!2A;Au0y+bOL+I=8M{i$0x_Y|N-QA6Nj6ltpfL5c?D0+JPF+4ns(O6VuZdKJ) zn2|=K2Ib@9leloPTTIQl5oI`p%*okcPsAlc;K<0Rc%Km{8yp;x?=y@CZyeX>nVUUrUq9=&iHIV8FP?f zjmQaL37BmtOs?F{n*9raC19goXBk>DuG#OIXoDG)x#mRVhtk0DnOTt*j)@644Z#(d z9UC9VNPH5#!%_5)j3Fw%Y&=v@7A)&XnzG}esFGvzV`mZZhjZpFb4n!hll2EPrQox! zj77eQqU(O&8~yA7fB_0zR+lFS^gJWYdNhQzqT{s%jO;;&mA|n^lEJHtVwL!**OUCV zW2ksN>U`vRA&T5u16c5TDsd-pr4o0t;RU=B({{b54R~Vb5I$F=+Y&oP8FvC$8400y zMM}L9d?bM7M=P`kGRm;h@m<@I0YF){p0A|C05+4FMhDDLe=P~BqV0p8Xx{q8GMf$C z+BRmlzU+F!9ze1GNxggQUkhL-Pk(2+Dl!fm3+$kh3W^orqax6umb2b~2>MbaDNo z_pia`gfb;KbnkZ$;B-%-KaNeeN*6x-nnn1)4GTi+<8}A%O^WCkY)2XR{2fd1_RT?G z9Gb%4`ZWU(dBrrJtyTsUzzUkKCnoM>cMRWtrUTC&8wf<53wy%c09MFOIH51P_uU?9 z;%)(~U`pkCoE$TN2mX8=RyPzTl{4EH!LMKMPB87a+G_xmwEfNPO-T_zc{55_Z@K?v ziI5f;R-ElU``wODZA^OhU;p~F17L*?9!a1aZ=xpd$pF?31h59x#NEE;+V=9gO9HUW z4d(-35!Ctq3m5V0Jv~8yCnQlU?q7dk73h7H_-gHqlozdFz^TeEqFU zl6%RGckp%*`SSrWkZsR!Edz{`E+s^pt&ZYsi0-Wv?Q z;pUN`<1PPiI2^z-?eM4XT?XFAef?s0FFqS!Q@Nnh>^uRi(4j~CsCIl}ZE~Cak2d^f ze}4eIvOXKhck)pl{xuhX_1NJ-eD2{60j?73hQ)CA`U-sU_JzWDO?*)%dfoj;=I|^` zUEkg(A(vPyYwgmSCm-escF{x_Cn=$cV_Trx8>7`ZdvAE1&FkG1(||-FY)bghEGT^j zmb2K_9fJ2r>v5!S=ykpYxL=!|8Ezo4=6Z+eWpC}Rv#bQge$Sv_{HA4F`5=vvQpl!Q zK`LA9?y5mHT(YrNxsCN4@uY^b;c+56xiVDK7IYD;D_-$_VLAz*2}8;({^^IslWqaD zxJgixcVT^*jfNNY+k`^*?`h?FK>&-_6BrT(lDCBQ!6P@Ha>{IEjn?Sb0!JdrGn-4d z?!1$JBR$kwRW_BLPLuUO;J`$awd@25aqqL$B%PFVnM86!D`viiks%u^1A6iFo{SmU zR8wju02ZIeXj5d`Ovon84T~<(5sj3MGBf5yjQnL&M>dXvV5|?3zpxxKA^uWDMFrTg zeJfsgVGEvn?pd7gY{zBm)}X$=MnH~*3m0Pf(q+;{#>dBS?%Y{nN^wKp)76c`hYpLx z@U}PHh7B9mW5tT)c;u0X@yMgU#k0>nkCUgmh3QaNlZ|C9i_q9mjk@}UxaBps;p%Iy z7nT))4gs+GdW7}FQ0@FFEGk7&VS%#f46`LazX%nT)u^hjMNM@zMn{GuA|k=B!Qo+H zB#a0+)hFPUf>?d>IT>6uVrIP&SfOG2(D1N;0;Q#;sI0Cstf*XMWM+#841ppxb4uW( zyG>6CcvV(H8DX(7o(TRBJQANRDQ^N(G-%HeFpJ<3WqQ*Fis__&EiX*`$MM#kfqn$$KqH9aYELEfA4L_VAK&dhKl zN;7%&;F=I1%=5V#XFJo;O?<>=X65+=-w3*~JSe?1Aso~|o1S^bD4M_N|HTM_WUo@C?N$@WKGBAGGNv_a1|%YYVMR6Vny7d9n94E9BC^rcU$^x9>vSkOa(3kABf zvMDRg6@z?s9Ih(_;2@)meUQNe$j*z!&>x*Z*Wf66Mq(26SQv#S3L&Fl%6w$z43*vK zkM<`skC{B_xM$T_R#@(^upBuduaogl<_`Uyd*GtCGR!XNxc-WP?a4mbO5**g-Ub8l zCr0U0CRm2d4~A9Bxx-~&aXb{}l*b;{LlOa>#QV=RFlTyr@S^jkdP3TuCMp?JHnM_O zR$j02YhUhegIf#WBZlf)&lbR9eMp@c0Ly1wIUZ`JigYUX4~DFCP$Z*Xpb%e}qW~5? zsWb}V#H1R<3rml*DKlnjpjQ8ek^!pS2L0yTgTQD(z3@KsiXxowXXyKENAL9 zH6FIt@T=KgAI9J?EhurL5?p&F-^y8BIRI_=S~Pv)`~_aZUk`pH#Kb)SU?p#a?*3hL zxKt9tv59HC`@08lvMV7%noXZsK(Jwc_m5X60WM4)8BRCdw<{?Up4Y*h5=aeTy#xYA zso)Z8n#Nnzl;+~uPXtZe-9qjgoy1@L>}YEClXEdU?+c&Wgc1{G-hR|QJb|}6C-{XKWm_Y@3*Cm9C73bK|6dVMAV^a{&!dH`!6@RiiP z*nDDsZA-(z`j376_{0O}lGtRyw9VqxEyeiJA1@7+nEuTp9r)>s7D!A}lTJJI{&WEA z;5UPfR&k49j@|!xA9*I{Vd+R6jnMU!O4VQIYNM~@^EHe@m;hk8j402;#Ex-_uxJcDD$C%6tsAT{t zjm)iS;pV{JpXt^65|AML^#7#H7 z289Jh!k#*L;uw0nyAWmcJJxz;4$3R5QC?aq45IP)n1BL|P*+pifXb>Gk*<+_)!WmJ zvuDqsz4JTcMDG{G3){oSeFtiL4V`fH}SdqM30d?3e1_uYl zM4ccS?^#h%DY8ETNLGTT8)DtjDqF^QnHhkV*O3_|UTN71#1V87nN)U`jx94Z+m8yU znwJ-mdM6ueW_n7PTP4LMC@CtIYY6nw1B;Od39b+vB_Jk-?*!zsvZPItJw*v7+o8x5 z$%Z3)(cN^@+3iG7R9Xoy;2M-@c!-54^P+yPQnkoS|Iy*bjxUdB`JKh02X1I>dZ49giH_t^*Y)am<>C`2(y3CE zy~V#}qFFDj;GFIkvjx(md=*{uq9xjSjdjd9$g-%E4W)C3M7ovnkN_5?>Y3u-NM9?B z9;k9!dpM%=utAM7be>~*bM6tK%(Mq(9$OQ1!|HP8COfy-zN_pc*Yk=Vb_T#=-5dF* z0#jOMp8V3VV?{zLOicr38N^Z8%o6F=1+X+aAop+9z?}dVe>gsv6A<56-+C}6cxz?M z`e3F7&1^kuAOb%cF6SfxXL%0;aCv)EV?3X+{G$&AR)+3>lJ-7fo1sM4>vStQ=jPs0 z%HQdE-wY%ugm#sfjMR&HzgzIH)Bsju2y#CY=>V+1d-ybdv4b15kb()kH!HHa2S2ZB5W!`~}_70j)(pz^+vf!fksJd*;zVq^TH?;pZJkx1u2YVb=ZAGadNG z)2{3&6~dxZ&^=ew;J&+)fun~H^x-4FN-h0O4`A61cSvr1`az%vkb(7;lmM11A=H|6 zhc!2cW*=vw5T*mLlFNla(fw~tE(<=dy?-2ceESF(kihBg2@NrL&!7Lv3S8Bk%zk|D zk51zGlS65-CS8;G_xt4sR^W;RCKp*wH-G(*mPbN%^uPMAzt{+G3va!m5?{PMD6L~O zysN)_05lX2>#I+Gcs1x@WnW>wPyg`r1$_H?YX%=|3-r$V>fI6|&U^8ho8*~xcuZU- z;gtbcrf>wn`gk(K_OC4i%PF&9k53$L%y>BqZ2S0{Pzhn@-~?XxkH^3~1z%1%cni;2 zeC~~nc+XYI9*HlU8o?j`xHUa4=~Sy%@8;h25pK=fYcwVHv{h57jCK1-U=5pC2uc69 zeJ`xE{MMNGso#^+t}{{(V=4RKntI?W17HOMUbBF`>1#)-gW_N zK`eUpvo{(5HDR0|4saj%);A~h?xKT95B)k+9`-xj-vleKfE zZs1)1DA!0nP{dXmW56=sFU&>-RId^_A*a8Hu&@~ZoEs5i!YgLmYT6qxb~mN0i~@V! zYZ+d8D(-K@%tlMbILpk^jTvDcZUl2JfMp{0*^_VSrCvE2s|aCQDKI3T3!q0ph!RMG z2>e{ZEBOH#Xc{$4yh5f3CTVPRZl<_Nl^mEolz?#D7-eKh0tqI>#>WJ};x%H(E?}84 z2Nrgg$-7~>DFe;QOm$;zA0TWXk9npWI+ey`O7y^@f;>F=#BcG$6OUo^R*oV!V zuE4r=tA$NfSy3TC*S>vwv1iX73=IuoY~zr`qXh@cF~V%HZxlc z+{-GeQC?Pxya;`;2mofv=A2T&SbRbZ*$G~CcU{EAix<$<*M~7m;^b!nBcr3j%A%JP z0g&?YG6AAko&*hO`cA-r?5h&_DM2Jpy`Cseq7RlDm{UT>I-ADqw3@Bw<>U$=LBNL~ z5ScL|t;>xdlBbeEf=Kj`V*4OKMjt7udogpK#RUDgCZ;S&MmN#Mblu8V)pN~k6OEjg zAPHGt+}IWs6-xVO8>Yt>!9HHk`%u=${zMiQH|=a|0$>%FV03g;WR%gdn53QQBAYBf zzd-$}2+9#)nVyvLBZG{7R?IKGz359tHke2Vvj`YOB+4S&1;IO(D*>@+Yz*;n$`r@Z z)6<9ecpPLtX|%NijqPBFixC2 zg~LaVpuV9&z{s+)QptN?Uq6}_wcw_kUW>(zOH>Lf{YP1)o(GnZH(O?s_I0usErU^~ z1_7H*GL>aqZ1eyn?#g#GdYb(Swa{vgdS=#Z2E@w{+w^X z3*(7M1k$qd?Yu7Ygcs_=-}(inJ~LU_@!4ajS%A}&Wngv_vn6fWa!g^?T#CJEx)jgy z!6yOhdEg=bRKC%=^{%4FA{7Dzu<~+sj2Jm!>{KjhgazXDVdxYN*_pikiC-Nyc5 z?)AH0pSx=*?!F=@J>z%3^5_}-WV;Kzgs;Wt1h5jkn!J8&ZpV}mz)Hoy`oZ&^APAHi zys{h4@booR<>Q7G<@njo3)0Bv`?_Uy1^($>E0ZpN?br6AW5AU#`E|7Q(^m?6%Y9L< z_^$6A1nG``9>UYiCij|E6*$oqLwkSRJ3;mKY)+YZ&oBe$=kI6^mk@dktoi0#uS*4B zG5qt*U)v`vy`)!SKXVug_uaD;cWnqWaZmKX3f?tUjim#y{O_0qWdQZ1xp@BL8$H0LuoFa`{=49M%r+E8tebofRv%_)=#THw))n!K7ipZbAyX_ zfBG~FFeCYM7G6m;kz!4fj@hkApJVZo@NrVv>+0CN5_TYoWs?CYfMq_gk_jWfvtW!#i}e!j#tCv)PZqfGk!O3d&0Ki^mNk}jq9gg+50hRi zhjACIw(l5vlWiAPZlY26^v5eslV+XSHGPIxX3p}he8rTQFpB6oq9^8J5^qk{#3Kk;=9mEjO;gZ~2%lltRSE6DdTUup9_vWV z)&;~eK$u8UxT(xGVaHX1NyZ0L!JG=~f}0k8mnPv;lWIsF$(8R~W|#U>sjm>NtM^ZS5UsYimPqcQ^WadW7LL9E}QliI@6xm0`#l@&7FGqZAOh6*0iyOZsOO^=WLQrRTXh=Yp$*D@sXU_CNYqu^a{l2jqFRH8nEbPK=LZfF|d|gVM&xzA7v%l#REtvXdy&Fp}fR=tvaJO-pg(4Y#1aevtr@Gt8CrN&cnd zssLFg8X)_%GE045Bs&c2_^0EE^fLphBu*I~2w}!PVXP3qA`^<>Bm)wN+;did%J>9j znq*<=djdk(g9I_^S1?-uarquW@flC{OV2WH;|NwzIyN?)fx-9`24WNFmxzVqh|(KP z*geL(NB}Iu`V|n~KUz@G+syNh#L&KHFcxQ3l{_B@Rudk($UMbi8r!j3a1MJQWDZb# zz)(ROdl+H+g$1ru4rmTQvI$mY%TIo84hqP+VvvyBOyozDfh7Qz1Xgei*A2Ae$^A{f z`3!lU8CUK6V%fc3#9Na-1xRhANggg}Kb6RU{1G;kN`WcWl?dBLGVC4#+V*AJV#4ao z(|u|+*~OO)I-)W{55O{p?i$rpflIb21+i3yZln2Hmav?y@Xih+%=NgmkrVZMKKsh+ z3kK{pkfRG=B`=CoF6Y8Na94AoU!32f+x_ZXi}U35a^i!7iF)uO8`FDWxikUu)l>|u z?WYFuXFodZZD#xePDquLgw0FJ@GtL6K4E|0rEYxofiS-FFXL9cmVMEgX$^fjCy$N5uYe}dF*3Wi!;r~4B z%A~@2MDl&_drM0=fMq?pybXBTJ*(FawtsqK3JKv^@8rm8pqawAUQr!tp#H<{7xAS> z5+$C=X-FJO2#8V6HW3PnhL@`{utET=f1?MMD|t%Yn%z&{vau=!11kt%g^gbU+OoOn zH{a1RH-MFpwNwC>N)HJlm@kBm&rWVKG99G#{c&D;4Q}=+m+9B|(4=l&!3xj@YzueO+{!NLmKfSINAH5~W=zROXoWxr; zRN!q___AS6xYz&vVUb+A;0Bo*FMe_@iXuUYGUav;yxi}N`SS*__VmqPLKw!t`pZvWUC)FwnBXD$-)E~VQic=TXti4~pZz(o6C41Vv>i#3RFyu4; z0`;6w>AG0A>>LxV#$&GNVp3oJiK(}g^4LT!h~b|srp$uePVej2bDEM1V^k;IJaL{) zAPRelPTjT%U~Nvse9c18wk==vXZoHk9v1}imYR+v#XR5Eo=t_C_}c%uc?gz=EObq| z`M{UmV5yu=qtW@%{PeDRpcjnA^gUfbP0svp!T_WJ9ykH@g~NPU)3Q;5kWE zCJeF}VPSF8Nx6rWeu!Ly@0;jO%8W4P@tz-+$_Y(NRGFhh@A9MV>1PW1xDl9af01hi z0CURL_)qZ~eorKc+SENC7rXH1rc}X%3}FP3iDNfD5+#t49z}bZsa{~lOj{$3%_@ME zo8xUNY#G`R=G<%$2%(HnH@Rw%uXShV5@lBKc?3h4CIQww*%{daDktMhq?VZ~-4st4 zN^S^XNwhj;!9D%d<9PO&C((N9I3_2@anT6M3T`9m@UVZ^0k$jOe61-B6sVre0 zQKlJ-j|=Fa{Zs3YGCKN6@i%{14@}o+OoJ0qTE{Y}tEmytl5#(KKQWTvqQ#2@P>M!J z1bpi6>oe^oLnL>?`m$^*ANy6HgCLj4h_ZzdCSF)mQ}R5r*(l2+uo#PuVr(pCA{%n! z3Mo&5O=A8(%gB?IHZm%rf+h6mB1lO9i+~Abjf{{;pf5k4Y_x0v|H!%`(~L&!Oh4IM zv9XwxvG}shsC=-rv`o^-en6Sx5RKbK8kggNw9F^3BZ$?wQ00JUTU&AX_z7I>?hzR% zzf)3Fi253OT~!Onc=+&9?B2ZxwRQFKUTt-S0I;JYBWP+`h8wTH1vNDd!rn4G631wo zqmM5~w*AGM-@N`694lqqHRDs*dP{nl0bTSbI|1<>chFn)1gO?1|+yC8IKz z&jh%54;cd_f*!rAC?iuNe(QH8k6|ze`OYk6GBPlgk&W@`48$0Xa5RR&SX?3(j`4FN z=~Bt0AFRSk0PP59e_N2wV{!)AQ+8z4G1$%#-b`xpZy7~8uNx06bCJw@W(ac`uO232 z4??_QPRDlZbEvXGj$a1A%F0B3jsjPOc{wO#L{$N>vXDmrD@Wzx>U|XiuuO#+Iiw%K z*Ul}%ByzmM+=CpS>8g3;IBY>Hk&Fv?H7#{6URVaynv%X9TzvU$%Sab3*kqVfIt7_^ zz6YXOK$7!-Mk6FRM&b^cdE>(LQ-D@ok?A9Siv@YOI1JqDHrWU+@g zHt2x2^GH}&N`97q^x?VIz{xAH&<&DpIqA14skVz=!*-sQoUp`uCvJ81%fUsPW}mN= z0M>&c5<+w9Q~=gLZ)wN3o^Cg(br*#u1p{`Y7ig%p#j6}#UZfz-nJ3E`+KSVcib;H>))hJsrOkz}@ixBY}3+0(>56$9(#l<7(Qz;Bhn7w=voQn|#}d;j$)wx2d~Ml-N@ z*QD%b8BhQ#DEB!(IF6ef0L#x>n*M4&+Wx5!0PDpreEvaYqsY)@jZc5)=J18voAHj# z$@%%fkBzfTx9L1X&mxNLzR zX;iNJ`eD4Pr5HbWcQB$M0kB{E4hWNWY$}YNPyhEl$&nAQ{>ottGV-AXL)@{|6z>y% zxhk1~H7@`w1Jy;@;Sxdtu;_th9uhJx>EgjDd9!-k{;}1e0M?Sv?holcsb*)r@5f$K zj}Kj++^_HXms8k#&S%*LlH%Y|Zt`RSOGrR|`)nP%$a3pL`;Ot;H~^1_#W)mmZ`GPO z$T;({Usmb*fBJQdy?x3%%wtt09#}z@svS+uwCymaJmX(~Mz_)w_ffv1L--=iMkdqr zJJ)3R#<4W)jp^nr{5v-tIk*N6!Mhk^bnyxn{m#Ky2etg*5FwrnNa2JC69 z*WIiUmm_1eG7xvXQqV~Qw}?N9@iJkWJ=vg<`guN7LMk$#ni<|S&%9THLw5hV42Mv^O%>LYa&NZ`XE?JLRk~bSwl0b(Vs^^Gw=%HDM z001BWNkld$AX4h6cp`yGNIgHk5M04Jzn}Cir9ruD-XaqT>S=oae1&i&x z=l%8~tp+DDySJ5|Y#3Ey&Q9RMfLH{q*oH?&V*+H+gndTju*%G08g0~8)+_tB^l|ab zQh-E#hqNtdkPJ$WvuQ;x2gyUxF$~1w7^YlvnlfeuI27Bql4WPyw?^I0w4>v!BSp5m zRc||O#uVp(%VQHc5$WvWjpL!NG5y0HmXkHT_vSl0pLqlZ!;TY!b)P}XagCDm+{`RQ z$VLxhT%h5!oQexkw~S#%CSx6u=6~%sDpr(HA|2odx3DCgCyEbRN_p*pC{k ztSho@t$DkZi_!ya76h(r1j3+XLBT+s_pH~XKiAshnnVDLNze$uK>%xfdPWT631UfK zw+t*Jk5xvo9%rfC(HOq7JsFT(e%pF9j4TDP{P%rt$rMga9)Oj&yGXmX3t!xM8@9y7 zqc?>ncSir6KrN$_PVF1?8c3i-h0&E|Xl8|!r?`@YjeyaHy zJMX#$h1k?wg3A^bV@*RL>dR7xV^5XmcYp5?UTPZ&{g|h!KmEWOT;7=M;gk3UvdVV0 z4ha~v?c`8Eel~9i!@JN%Aq;NhBnsjEX#gyz9NlN~ZDC-A09c#9^pf#3N(4v~HmeC4 zPR+pb)90V;r)zPV((Rx6|7iOT@XD_8+NIum?;6c$x~F@_<8BPbKp@6+Qy!rQFa&HM zgpj}kUINBIOelengv6m2gTdhLu|4k7`)D*HX{vgcuKIiH|Mxy;pL@=gG$!xz33;yW zJ!hZY|Fzdzex&~jus-;s6S)77Yw{h(#E7WyyWh0} z+nd5;=lS-LxMTqf%}V~GM_upPQzLlCf3$eumEB(YwoRGT>;WLf2 zE~EOEo*MIIuW6Y&uH?>r(0DSt?^mMZU06wm#p8iTUO$jt;ejsd2^C~sae(`5C>(@r5zU}D$BEy z9jPnH^kmmO%_wMP7Gj1il0*ZHN$`^*!45b51OsTK&g)2KDoNFDWoG&vdjCi^HUmD) z%udU{h2>%x0R)@~crnOVrh?!8;+tio1XKUQ>M&-{lA+LW(F8m&S@Pt$7}p9b&9FI) z`LCvlSGE<)uAW6{8VF6t@X&*Qz>dcr!eD<7aB+e?@cBS0U@?^W=576$rGHD40Hx~A~Hoepn!bFn@tVcS@vmZ)6{fj zQccgQ5j*|D_KD*`)YgDM)Gu9Lq#7 zEt!5zX50~cV|$E>ta3=ClLW8mnMVIFN*BpKWS!_iiAtN8D4@EsLb4_fkB(u_zWq4X z(kgX9aBbbXOR#qBYOGnkM*80V{fC4#mYdG?Y=Vr-wmozrx^2@JAeqNCR3=*#^ zP$5he8<<<9$(eEmymX>9S^tEsX?>V%mcqzwrS4T6pD1fVCm?~C<4+4qj{p{dEVBCu zcoN(gkCAOjW~YKSWGXTf=j4>KD>?7TY$wm;OCj~&DWGGH80C*m2zWKhzQ*U3sgB@1 z!4{i|)?d7AHE6O8yMFuYiq?m7U?ZWd1+c>PU?q8ah-D<@9)M+8ZN~WD%CXG~=GjH4 z0$To0fG6?l<2W)P77qc)z~WC*k}|L|Qjt#pD?1HYX~{@Wr;$4ue}48rAH=dZP&u5v zueZMupoWwr|M=TqHx0OFfJ9;C3Ij@kAYon^Z#y;Yr(cxL-}dSnJ2~E-!QN=DFA^&zs>A^!2(#8EhcO}DW?Up6fD*4fR>-n zVVUASW8B0E&Zb7zZ6Cl2Z{~bBB)E}F1XLviu*|)Ko4p`sA-rv}+o6apqQ5g^N$e9DWSu-z~x3`1^mc2HTo~8MRJ!kK@npn%|#@7fuXd z?QtZ8i6K8;BN2f0<@?(3!-PIu!H0?3wDS{A0XTIf43=I_TlV|dMXj%vRP&502qcKqbxU~%-9sw)aIyuP)g6W@H)&l*aJ;QxMg zZJ?-c|BqHY*QSXnzVh07(4gJEc$&EF%Lm2G+}`@JkF5$Z$-ex+Is7Xn9);Ga;2P)zkX~ur4DZwm^=@ z#PaUtJg8|$4P4CoZatXivurC*Qeps2xwnxXC>vEEBq70jzP`_iCST-Y}%|^w{T?CPm8NfjTLY{(amHN^a zk8$d;%xu;~J-HVH;FJ_&&a39k3|KsgBcI1JNY|`k1Ok+Wr7U)W3pBdsdzRgx3=0jQ zY@lEzH}vR12vK^H}+U$p#c~QYO0kD{@D?LMG zZj%$Ec<}z;e)KC#9syXR0czuGiNY7GK7o_ zWla%a)&4t+agpQElWIbOe*$7OQ}=#nWh-MWB~92)1a~NNB)~y=AK50E1kLE7m70v9 zVFH08T2DggA|r)NGfD+brcW8Gn(a;iTxPhNBmgxkj4b*~4N@vNJg9)L^z~FEQ}3IU zBJ8--Gy-~A0_?F%vMl}med3ihHadpkkzx671tU@fz~dOCM;4!j-(i_W7MV=8SrU#M zJBE`d34Znq@U?04Mr_)|pUvp(?81qbRvCxH0qbh2P+DAwjMQ{AG&Bi_nw_1eW6CgC zt?9IYc-C{!TTc|Gv0Gpjc^LrMk)6q$W4>d5s}xUmQQjWfT+L21Ci@^|rqdW7pAZmh zY>Xav2Edw~6NVo_Xo9)))0WH2#XrtdlnXszN8tusswZZs#kvUFV?=J02>dU5wQ`RHPjvrZV zMNMrp0!M7hc%S7T|Gl$I3U)mEheX@laQLAGj@W~GJE8ckmV5r^7t!CyF1R_oh|OkV z083Bc121#qL;%*!-`tB6U5SFmP^9Kv`k!uDAzAy}S6k0GUj0uC0a!@}z*-e5>MOtQ z16ZN@at1uVmh-qo$1||P*X9KA z=NroKm)F&Z9PwgaM1$|$*MqwrK7;dvHj~`KJx(Nqmj=!Fg@F|bU@cr9Q2-WA%CG*4 z?Gr)YlE5=MmuJcO&nN)vtVjqK1F(fh^@0GF*F7`>+xe-DD9;Z94Xod*?pVzI6SZKl zT>O{6P=?z~P23X!SoFY(d(H)#i2&A@69HJBiMw7TdR{coWs15u0Bdm)!k2vg0NQ(l zM)J|M=$GuNPp*rUmR-#FStEiw1lKhC-gv#E)42N1BXau4*GpIC<6CbE8V`Ns=WV$E(4h3ERh3!z%?Fl; z9_@y^j^b2Y9fx||+}u12ECXOA>}N(oczakPe%m4eEVs~h&VK5)RiSo1czztO`HrnK zGm--3it52hSY4Tg-~DBCsBS*`iw@j-AX*yi0$A=e;h#2J@WGy%I(t;R`SSoQCjj>t zbHOZy_S=EBady-T&+d!q)xpm!c+JQUBw6OOZLzqoo_Cm|^(eJZd z{^s3CQ)F_`|FhtX0AR*gT>~DU#UTDyChfUqkz$}h5t*@BHY_j?h>_*X&w3IKA8}^g3R2`2o8Y~Oj zD@`-giI=2a$pq0jgf{ z@|UBkybQhFofsPI!|2ceRxDqJ=4H!p_S{*tojQdB`wyV?R+cak@=dJ*nxLD6gzWSw%IfDynhG+VyB&wp^aOzrP2^jvbcI zi?>x*4=!}~3GJ7g&C>urjl<#IU@krcS`H%*<>7LdfDFpcjh~pqfEWP8JFa@_@N% zOiWGU^y$;M(A6m(RqS^JuL$N5fTP5*upnQaiC_uqlFT3iVq{3sET27>AYFf7FNTMQ zqyQK}=f3~YpNXLa`=~G)g%y;79D;;7lm})CKs_={)Al)GNwMEj-q=4dAO`dNp>aIT z;^|W*pP85xIi(oSr)OcHe*it*y#kbyjkJ30YHZ%J1=}y*j-kOJ@nECOabkQ7%a$~v zuBKX&0@T$tpn2H}WM-(zy#fcy93xeB3 z5PDIMv1FuvoX)H#l6c!q&=8-}%SmNm&CFqBJSIOhu9r-5v%vV&v;tBDtS9LQs=ylO z3ra9KrU_)n2v|)KxS;>hEGC!%k8DkmOBy40vm{9gZSo7_`zLd{2fzhAt8}ffi@JWw z`svyKj@n(TUy_-}O#PZ#mgF09N%37WURri}GBP@{A%)p0YeT9BUfF|-6qA{eznOh7 zD?J6d+3Cn3fSba(jq6G(G6-M^d&|hl4Vz1^!!noy1c!{^9VU1nO;Byjn!BoM;b^SGRL$0BGSpbU+JpK^4 zA}N7=$Y)*Jt5_1BT+w5U3D`A7wx;pMGEzceWLY4~Wbw2E$4ceZchM5WO^HJQma_qh z-*ee<=)b=(gUY*{7j2pjc#IT6MiEa!0L>a5Sjs)2*A4W&RsY+U_pT;$)nO`{H^@A^_`U-#CbqJ+UC|F;2nf#LwQ%c7AdlD&zd3#Eku} z!wK6akq6c_cOEdA5Eoy6&;0c|Fzem_@7JlG3B2-KN8)Z1*wuxK;Ppxg;PlV@b=i_! z{Ck`?75{eKH;xDZot2h?XFjd~&tWzwL|crceH=Lsq3* zudTqX*H#9~bh2jxFaPGTK)XbaoP_`^DVEbladItXU|lSL72W2x&pmZ}7{L1F-adTd z*Vex=ZgF-_c=dt(CtX^afd_A05o)jb04&>j7ALWQmg^_v8F*VSEawigu{A6fJ>fO- z3vV+M4`BIU4)i1EIp&-75|4-YdJ2A0nljWB3C5!-KwO|no~<`p;k{4P(MW77mcRL;X9+suB3{-hE`Q(G9K^wcdvNAVn;3u>6_=xF>2g$7*Q2ts8l@!_$jdE2 zPj?T_oNY%-%VC^5*MVLFD&vzFo1Dh@l=?UkFkwK&XH20tR#K|4p7L^YP*|9cg2H^{ z=jS0iD_afjjmL{TA7yQ$qvB~rCKmm!=*Lu1QiP?A^=PcC6}cqAN4D9iQ>SqF_;Eb+ z=nfodX%P^qw5SMG73Ihg1NCH6CS^d)OsUsRPEH;wD=Ltkoh9X@M_5@|nfP1LFKf@< zJ?QG}l=tTJpK19VRA3 zR!E5`C03l{2tx92WNQ($%Sz8e5+!jHQ&Kl%xs{ZcVa4i|*s^7dj2-%(F`2;dzyMaS zTp|6HSrBWgYq4tOY82!bB0V$H_)#f%CE&4lB0*e?D*B zwKKV$ll-|^XJB0f?L5utOr=^hbf4Btgk)AtOc`b>O2AbVaK`dRLm6jq?vzfQpw{#US`!4GV zXtT50y%GJnM6#{kg*Jn$$JBLzEqfok1oR=U#}sP_h%I(-SMr2eD+H);3k_-%1GWp_5^- z8em4jDS!R7`y4wrTL6pCC7A%NkCX+qO#SPcsQt*E8nYV2gUcdaUg8y9H@#;~GR$L2 z?2X*e0$B7oQ-3Wobk)RtQjFs%H)k7YKhQ%Lo0LT|qZs3Nl{S-wC0<=K*5KW&J=VNE zVBMk#MCL@2Y#H}v&tl-)AOkCI;~2jqOB5ct8>Yz51l}|QFY!)MHzo-~(*?db4^!y3 zAKe(?ffWZ}`Ryq;x_NW7gz&~YcY`2<-TEyQI%*xw;f^;hPXJ&o3|3sZyb#}c`(gkr zH%JQB*NX$N%=H2RrM~ywcdW$K%M(lZi25HmJ0d^y`fBYOM{D=ENOtUNeO)eo^8U4< zhP@a7%k8TKuP$rK$Cb?m!dh!6S(ur{iQ)F2x8V2tdxPEH>)d{wDu5LwAzTQc3E~{~ zfxi?XAzTcAWt+nve_Ft`n1f_ca`w!KN?nGH=ae%D&L>4n=1Xkz*1BoQY&$EegO2kLK5IEWsVG3rh%J z`<)}$e})+^<7Pnz#8RBX4HSXaFNPB-D1b#%^5}M%AHcdeF#VB_twlpg*q81uM~=79 zoaRl`rp>NjQGnG|>M_X7gF~@d^o>p9$Iq)t`g|{Qa1{86hwqrGV=zRCU7q7%#V>r} z4`=b;&-LPEs|xVVHwIm?-+lK<>}(wgw9Z{`Xu!)?`!epq@fmEtzEHjCJyzWujn;O;T7^n}^| zcmS5$B(hJoV47Y}gP$ZHz%nMg8dR7WR)PQpa3sL6(iZWu@r`6HfW_~Td6gkvDCx)$ z_LCg1%Ma^~Ae;Du(BO7*Qup&l-X}%YN>UIjnL)KLGZCLE@yoLQBq^RWP@ai_u4Kka z(tycG)ht+~5-pm4tFbQSU*i)om1r36C1pV!oNpdIWp+?8YDea6b+lJc_~Laa?`vOYy$< ze*jCHmZGGr42KRLz`lLE@%-~ovBl_~(1?O!5)odf#%2GQBwi{8EgjE)Q;FE2-~OW=;u zM`1llzn?;GUarZ&I4VA8WaRNT$0Gp`wk^S|3>v%VMek!@-PK-?7@Kr$2E&3 zr#xX#3Ug1BVen;P9Lr7cd5=*`bIsMq`0tcL`!6fDrpm@$z86NsF`(C9b@M`IWq zi(!NwR+H11m`%duToT4<0?*HS*-teyE61^9A*H_>0SvNm43HvzMc!eD@wW1hM$BBR z>xn%uu~RpH+k*#!dD;`zw@|Xg8o4y*DP^bGb;)MNQ!gm-fU>_$!U+Wnb;BkyG>3hp za%~=J7zVA#u$46`fR0&v^f1GN<`j%iNm9Tnjq~uF7`JDqrwN!UUUZa`^KVvCDC?37 zV3~DSm|-U4r`cC(21f+|bzv59o`^^d$>{_dHyRh5 zT}0cPfmvOcfoqo+;`-Ia*tR4;q0Dh8HjQh(vIk^j&G))E04rEton!*h6fPdXnjZlA z`&T#Ot=q!c!Y=*NZet4XK3yCD!WmAHJVFXOUb-txsg z7#N@Sb>Z{JcY(ipQe&^`d@q5h%PbDST6|x6#o8i#^UYx|ybu1U755+R56>R~AUzyR z&JSR@Pvn>JrVYiBSqPPZH4lIlcuf7rFW$ET8|!icRmTN!!&oaXgujaeup*3_ z5(8MLO%_7)WC^-$pqH7tqlEC{0Ib9lfD=RmH;gVI5O4k`CZu!rp?GF0ZgEM1%6c*($GpklmAjD*mhDr*2?8A!gw!-7{ffM5iz znF|Ss@x)yLESq)8XjG)^oI{yfoHD|RDYBn52(+>e21F7>IAegln;UfoVgyCRsM;7i z8|sD)4MgUYPJ?gp-BK{iN{>7c&jiK<#F$|)Hc9plfdCT}soSpBwKJp9<3yz)JXtqD z8YP$X6iU*x@&ZN)>q{Gxz>3J*WVHFp?;VB*5g! zTFt1pj6L=}KKI7;8wA9me;AGF6(mr}=-^-mw%OnQnGqWN;92;X+ z@mXP)Rgn>uktu#&!^5K(8Xgi>8s(k@C3rnyc*Vwrjb+(!1ZrlcrjeVSjhw73ky#R~ zWxvnP%|S_NDf06Q1jKA@Z505kxv3F_`FR)`7(`iVCDvWC0S)y{sIIA2@Q92t!(vrQ zoln;ApdACOh@@9Q8N<>EEbTTTxACwKU|BCId%$1~+&M1_$Zwb|d_I*CG7I6901sr+ z5x^Q4i=lsH9K#co4o+i|0M;xJo7RkW9RF&ht&%d1e_mG-K6n6%xu01{JyUrrAvEic zzve4|#D194B*@mHn!G+a|2wyd*`L zQx7{i*ho>CGr=YvMx>{6j#BVn5*~O=HoG>^ze<^5l9iAwR7wSfjSFF8QBs(bl`e@5 z$WYXbw_#U`-c~n5H2dN@MR{YxoLRoWtDi>l~pnc#lQac z*C+9dUGY-N;HN(Knk9Ji)_4Zi1aA16VPGv#CT$zjLUWi0z)H;MnlDiL==HVu&~??J zXM4-{k6>3j&8+QenZO+0{F(PyU6qaBd??J0Qvjfin49mc;KFW{rKy9 zT&bMiEjv9)q=r0Av#Cpi|Bzgoc3}BgF8}W5! zP<$qmfpt1;;vOiaK1bk^=H&Oq16binOaZL$fyGCEaT@m?jP}5CCL6C$@yZsYutB%y z@8tC>|NizA+e^7@*;o$a$8G|H_Y2Il`X_(djR3J0wU{iX%P#mCeqc>Cu&sd);j*37 z!Nc}9yQhlZVMOgX>@xQL6khn@zu08|JJ)+bx)k!5XM*-TG`Y zjTwA-i=7Xo_nWb#bB6E3r2v*WX*VBqGZd*wtnu*>fXAI%H0YzmPfysDfu$ZL7Qj-_ zM}|GwQUtFAbTB_sHs4Q0vn6SICB3#v5!DNY5)vDHYWOCB9sw+Z4w8~yGx%xNK`rc@ zVSso{Gy4CCpNVFMlPq8Y;u%wR<6UCe0BIs!B#5LLvczcDWJ#3ZFDXd^d&<^WUY1{lx?O=HDx0RaDZgv|D?c|1T;pXNV%67;u~O!0G0p{m=%L^8${?yIj>}| zZ4Ks?^_M&w!($Kr4o^M)05CHy0M;9CzF7b)mV;hMG>|VXEkRLX0S+D5kG;EJz>|~^ z9&JV6;0Uh1?q&GUhdzw@`g&nE9XoamhYugX-o3lf+t-cq@-o!c)nmz$CJc{`iYfcy zqsP#Cs$Hd$42EWA#2;yBcvvzy(j%$7q8t?!m8dAMKz@F{1Y81230scfT^hF6y1cKCA7yX3ZL0vi1^e+PDdI zb@d8T(Z6PT3Z2~-aOTWu?Ao&n2M-*S;MQ&nY(LeBHc7xh)-64|@^bUAWXTdV)X@v9 zRx&WM9SAPPm^G2iE*iU!jS8Esx36FB%RWf3k4E`32CU#`_$(Ebl}Js?!01>^*jZ$q zk-^0=P(-^;cv!|W<+w$Kg~-g#mcb-J^~@Z~$}3P+ zRgJS}&S9{x2h~-Sb*5uzULnayru2G$-=LTD#zyF>O$;afv^1358(Wx$F=$izhgSQf!_H|_jyWnd)$ zu=a#Ku>3v0c^Fgg+$`<+yREW0bYG7g?Z=1iwtg}5?c@Ch{N^po@zT{{Aj|`>LS4|F z6-W0?tHO5g9zbc6fNRP6dRrKfAb3R(EBdAP`}@~4;w^Ci78z&P3xH*(^ZA1zx0%0m z(~?jYLX{A{H~{Mno6GQ}*M{Y8Uw`N%N9 z`#hAoef9NCp(?!l8GfhDk<;lS@0BOvY!eZn2ZVOPYw&s{IjMN|(_s_$PyF%}e!Yh# z?hCzqgob^Gay!cI;$J&khwzSnZ*hX*_;z<|M*p^~EED&CG@NZN=z$e3Ut$33AkJK* zAKzQImf?TDx-N8+?>yd#J0G%r#B8DxbmjQBy|u$Lde)uWp9~9FERdN;Gg9!>Css>v z>b`#Td@pXfGziFj@F(qfz(q|(8Ec#Xbdf!3-(Tf4F=4qMuA(aFOfc4?|0IY>uS~fQx z5aKXyEU0B$%k&$?I-FBTD@!v$llp-8O&qn;2m*U{E=jb|28V>x^@4whsGoVJ)yT<4 zJg^$9H;SDL-GIftdsIp6d)7OHw{hAa?i5@KVGLfaR6*Y}>wzt$ts0Zwo57aNgy)ZE zvj*E#+vXB#mTQ|N4#2VjnFCqF^pOw(;BR%tTD$04G*4l#;1AFh6II$N^v#=1{$9de$N7l zWb?3XdC%08G-RdD;*ke_gQs>pfb6t6)Krw?%I(|5CyD+{1Uo7!D^TCqh}xY+VO>RyujvhH8vcR^slZZ`>35$uD=O~3bbM72Y zwYLk1CqHB`O-u=!foABG1r`<-pt!h5{#$->a*>sprShrtbfjly31h05jHUy zqd7b?`*rtRKo5Puy3b>3a!l$?WjAWvEXMq^vjR*}Qn+T-I$VF<%dqv*%duhoC77BV z$K(V7p)p}F_4W7T@g0xjCqMfcM#(l~=0N^PpH#LSUyL2aYifKPVdGoC zYg&rN`UccU+vNzTKn5QfSRL(cICHuK-Q8URFcEO&Y$8m)bh2C0MXr}$SSZhsl$biAnqYmib*vhXM^93K;3t5haMNKY34 zgz{T5@5mY>7?g||)YnuYKPO8vCl(fzU`b;$mNuZd&3s8v$0)uy!DS@ zu4TWvt3!CZsLM*=x*FlAX}2ROGkrrm&y0yXnS0}8gU-xhG&YIe!4dS1jAMYlZ)9A} z(qx-Jg8rTm55E~q8riWj$t)8{wcJt`{x%D*mtoL7SaNh-Iv-e;mC4d)=1>8!k~J}g z1+uJHp@LYJ^{GrwR*%kMoXdOwi}FbE{3C!RAl9^c35q09?@ch7;6MA390FKIt|a!* z1x)7R8OklmTqTQ^^D;9w>eEW13MTMixy46o4w>o6lAVwe!pw9YaF8Xd0G2$Lk+iGV zp>s%M+MVmGjf3oOS$~}M$V~s*7LK92xBW44LhXfq+jx5t({6fjr~sB6P?&=tmDQ_s zo#R(oR|=rXx@6c_Q|vS5-<&UO)=4R!(~o7pz}m&pB%|C``(&A0s_umfC7xDmOD4{gyF-poet2;(+Wfe*!9^CEAN7{EFe zApz1G3xM_K;b8p6I}LypSB5a>D)<30abFuDA-rn=01HM!_>L$B*4_XEYrd_y09c<` zEP&-#e*87baCzcWVKev-|MxLGe1s|A7uPu1=_%Ox=}nQQ>u>wl!+4=>*xRhS`)l66 zsWeNxmX?%ei818YA5^x5J;CsLQheb}(RO}n6H4NYtesYd$p%)OUVzeMpK$`QX)e>~kcVK9cTEe{P95vEK8cH5eYB z5oXW}?Zep9F^Z9i`DLjESt;1{nT?@xf99Tc{PYC^wa#4@=&EvZoDA&!%m(CS=tjuC zIKf{1)q}V&w0IAy+g?_K4_*^A3g`7a087dfF4RryDIpAliPzk@7yv7Hy_&*wJbqia zk8}=A;hL`>k_F4_zlrL{0jH`9((#!atMTaZAv|(?2m@ovK9DC_+*Dwybm0&G``ed@ zp}YIyLhE8$^w`_})x(&eSwqC@<_$&oKd-5s_Zs};2Y=FrhmH;F;%rYr<3Lv(PkN~b zZe0-}A#?z&z~h-O$*&|xpZ!$W1M4&Qp2bgh^+i61`(^;VF=gF(+sXtI!ZX@D2@x7| zW$&U%SXxE^D=G^i8CZjHJDBL=+Q+w9emu#T0k8r+-<}{E8oh7ku7$G9EFZ%P_nlDd zdsTiB0M>k6(q6`XW`0s@pi%_Ds`pROJqdtKx9y&~B$yMl9_;o}=TmZktJW7`H;I`aOncdp9-_^;%u&~Ujs?W%BzTurvt4zmx zxsnXoeA|<5%5xOV5fgV~d@iz))KoDDmIFS+7V=EoZ5As>vMTozut+!e47lWxjmfRN zCxMFk1L@wwW=14v=Qv!wP}9M08c$r4De_qm}Cb@otO+^7JQTEFtQQ`Z5*ezzASJ^LwPF| zt?A&>se!NfMl7WMm>gI|Vx)xEIep@gVZEQc+$~j1|k9F*`Ydg9i_yw5$y4 zHmt|$HLJ0_sS(GI97J1d3;KF{(cM3cp1vV0U9kq&U;i=`mlTWS??g)rPM$i63!UdN z9vee$ejY~0#&G_^1+;gZMq9^eq^6~dL~Lw~OrKd~q-Tnc6al5uvJwGCY(U3Mepwj= zxAFv(;ZI?42}(;!gq_4pch5fk6pkJ}h$PI2WQYJ3*-5-FKO;;IF-0X@mX! zl4-A@z8-JAquuBadR|)6d}Ksdi~Q)&s9QF&PsO zh=3t8;Z;@DprNiFt5>bU(j`r(si{UmUY?ly6KtXf)$TpJB->8 zB$J=5s;oqLMI{P~iUg!&hD3UFW#{AxQ-k2$L~Kl?l(|`%!o(8U7{P1$)=?&!m5p&q z>qbY>+ue=9{yupw_Wh)kWCg-TM#O-h%&&B2Rm{#rLv0O;i}J-3yr{4gwY80CsB1!f zL%oHsbbQJ5;?A7@gvxjICnD00ic{>gYWM^Ei1pU8?o1qa%5G86MgT1F;8ReC7A~Wc zGZ-3;p=)3W1N3?$I3w8ulRV5BdRGcCVOfJDUgXLr$jExGc2_ zP^Bp7L-5M@TTzlHbC(6MJmwWWsq{OV~$A3mTnSAPh zB?&|1@PyZg0kDi@)W`~jx$GY1*^i&OaRDsd|2VdamZ@bxEN@?Gx}Pvf zEr8_$R~E>!hlU0)vY8Ia#wBn?<8`VXlo6%L3S^b=q@DimjR{YrhjZO9eM8qkdoW~~ z$I9-qzFyvLz^q5!^BUhTVGkQ=?jiuJ;E0O%%35$o9q|FXXAb-+ut7BcSZIHlXj2(A z377!mw;xTw!20beEl$KW69QOYa~W9v(bv~5Wq?tXW;zwr}6080y|)0w{h^Ia=I*zqy{8AC`W4w+(XZ_EWbFUDFi`vL9p~}2hj{-*R;F|LAHH)r zu2>p=rvG}j8=s4lQzj}GC2kM?)tZ3R&3?9}D~21tIgf;JQ2^HBpX;aZX~vd@FgW@3 zhtK2NJ1%IktWGDvppr!@3HaByHQ{Q*UgF8kuJ%zpcytK&9UKrN_wZ{m=t*=fzI|&6 z{^rK8MArTEeTN3|@m~fduI}Fn7ExZu4NRgJ!LO}fIV{JayYjR79D$-(y*2=KJvgNyPj)FMxGmFj$ZT z&+2d5+!H{3=9Lek1lYAsDZDmw%i@8M&IcFTODqP!vJ+P%fE9fK z0$7*UyP5B_OkV%8Z4dzjd2iXzIF;aeUl_KUT+wEGirWv^V*4fZBPH)W$HOBqKL`3u z6oBP}Fs=bs=o8SqM2Nk&S@Q+)}bjOlIXt%GQJiRP6=o3Ym#h&9c6lusyE>-EM#s_9(}SAo8mwQx9$PQnhD{sS z3j=9HX(A! zin4NS+qxB(tXU&Q_GC!W?An5T&pr1XcJ10FlF**sKFRKvlE#de$s!dkDk_xgGs9t7 zSvd-e6u?AsiU73}6HF2?hP<3ig7wkCj9Szd|isyfuwHi(q4u&BsmVENjRz@lSjbsbz$ z;8oNLVQ>d;P0)Xq&p2%dieQBXDCpG2K;}FjSOIYX*Na%Z?X?;jLStEaY5MvillYLO953{D2-&zL426QBc zT!s|5V%_qP#rRasDA;7dGm-ka0G6pw%f#mWwBK6eeZxdHYoRi`Ocp~P${2>YcbMk@ zUeZQ}rDd%JlA3S3FTs|^E}S~(BJqHPTmR_2wjHE;EoaF7DHnGa_{7MC-0`9SEOXtP zHziOKDHD+w7``~6Du>cej1^-l=_tZ%psthly{+r=vb>tX?{;PlFW z73ZYk$-fQ*1Yfwf4L^FWGm4`S>J)3Lb8z>2R!6e0_~AqV)?dG(0srgrFoWf()K_ z_1T^Yyz<*8=J6Dam|sj;pZa(dfHiurd%yiovFXe%I>^Pr(cjTLVViHa`VD|mHfK!zZhKH-Q zWiujq3c@^WmwY#X+1+lI~SR^jBa!{|EKF2OERGBJ~sj*{|fG&D8|P{%qw z-`R=NXV2p3@#FGyo0XC*(N@EMYELe5S6w`f6<2xDiX6nvjv1CfNrifKExqsgtMB z(sBa3_v}GidxwAr431gW{QO)L7t#1W6Iod~0-%+YluDLJN;Wln=|O*gKe973kw=hCk|v~y ze6+f%3Ts!d#q#D=SlZN#yu3m&fY({pUo>SbIXhg>yU%;iUsMvQp1i={%lp!n(5lR_;NPfDGo4&oVHL)Qr?Zaizc*ea18afjtoCZ|VOIP%7*#8pa#n zHyO{(AHUDU((Zr?@3|I*F+~L&&Zgh~IdrW>UEG!_?k4U(Uo3z{4=is9H%qx$<8R(v z7A+xMB!FeFYm51nH!hn;Lg-MaII!YkfGe7#v-Q358~Y+8gz+GbmLM^Jb#hS*EVm6G z|Kui-i@7hF$-n;F2R(^ba7y<-d0A6F?s`iz@-l;xEcaRjuwH1RhmAId-3za(%E7Nb z81^ILcOO4KfWP_GDfEmc4(JJpeD57ABBgP+|NNv6LfJ?l@Pu=C$;u*p`>o+Xu4iNl z@BH_pIMFpeFT*FkyMO7X#t09rNn95RU?m(yW{a(by?$jOz7tVK{;hj>3b+0IB%V2C z>o!OzxqMl^u%4<4qQNU(g8uQ6U?)Y5-B>(*AIehPl z3-aIbFJ9ths|xWCH#edn%Qxk=pCkBo!#^EDjLwr0FMGv%Ke$Rv=;L2Me7Xx?`on2s zlpLHuoY*VWhV&?U{Pwkx=Kq}Bzi{6f{P=~QNT8vqG!tL^^LlJ+3^Sf=`GNpeIBHf2 zVMFM7R6@8204u_C;YaUUhOH50;`4m_@lJeyXIH{{t}9B%=l`rO5vl)!7YX(P4G7L<^w)>B{0oAPZSpS z&-eIl_X}QjzI%AMfHR>c{=5QM{^_J{UrZq6?VJ31(G8v7rR|mFcSKTF55Te;i2xYp zhggz9&YSHVt%_+6|M{I$b}Lm3NfzA|Uw6jZuIdrx{Wb7CXPA2J8ti~pcIbXzi>I~V z16V!)D^@qj^rNHL&iw#oENG&U~9W!o-CR%R~7#z(Q^$;a^I z&c{(un1{TaEHQB=P%<+`CeJ8FMg~R3HZ{r2jI;8)ySoResaaUD>JnVG{c2qQvKx?- zm*@G+@bl*{oWoI>8#Q1v=|lBkb83h%eLV$cO+rjg9pJWEB<^ zNXER*&I=-c%go6^UO^%H1_#mJ){fDUG4*pwPE~Ij%@iU1OJI??Sq$_KpucAnYgRX4 z!@6~N$#vJFq^uOrJo60Bo;xQ&WY->mBsSb4a_9H7N2N{_e;;AN5 ztcghhQlm5x`2~fjuWt}}A={B)L-O1-sw+wb#F`izmG2J?kICQYn?)Ad zz|f!oKO83P6U9Zv$jQl(w~w}Is7g4q*B(6n(j{v(~5Fc3);-hC1Wf$ zDGbEEfgyAcj$tr1jp2z|#5m_zgLWC~slKlgSvT}NqKP?y^(h~~^8B`pho85vGT=C+ zdNx2KP{V^wF*`R&FEaU?EG36^Ws^tHA4}(CyK^xKIRx-AUQz-KsbpCXV@y35`5E`C z3g#)Or*)w<$j=HO@33&~K?ZN>`w$ZN;@qqm_ISWxjm2%k3oCbIxdi+%S$Hk$S3RzD ztq|Wtky2WglO8ZwfX*HiSh+Rp%nAZL;K$7AR=R2TES^`E0kEbisWiS-nux?}Avx{w zqeeAa*E!tG+oq1}{z8B}GNUZ}%E|_3WR+AYrSpDTS&ywJ>zG(m(paIrv?Ih>L{ zELnH`ERtM8R9YYR@|f3paHL?Xnz|bRiym0vcsqVrMQ+&Rzi7V1U*6~AHe3m>6Zpdd zn?&~+O`Qer7qOe0*TmgO2m^JePq7#Yp{>BcbNf9la1wn-A^_`~`$LsxRHR<16u=4_ zk4FMnp<`*S(?12ka`(S{=Fh&W5w~m$dO`6X2hWb;^S^Dwp>w0bv*;vXV_h!ZvaJGt zwl16jExzx*l@h`@IifAYx8B+;KvL9ebYceg?Ck;NfGwTl7>dmZrL(p$9hWaF#M>_` zM@4=ZoZ;PZOkA@(A7o!8di~{( zTJhkKg-xwLa$OZZ@{(wPf__u?A07Zbp9pyHgrqDt4Fn;7_Cik_d&F-80yZ>2PxRvT z9y&UJbAwYDiOrxaFI8lEmp0_iD_7(7{zm|;02t&>LVinmt&s#YmSo_b_b-oRx$zr= z<1={T#4rw>*EZtis|(WPnYJ}D6?Syn(p3JY@3vrMLN|)~f4&z_bp1uGI?>nv=yetN zz?ISM@bIxAeCVf%<%1RwXWKmfv6Ydq2fOlBUpt2G5gN(bs5;2uvABTGLLq?FjHZ&H zEcwST^x?AtU?o`BoT2=YYst(1nxgFh|VEB9puKREH@QBqtp1=?yyG|mw^8< z0LwFRUnB!7@TkEvX4@YE>?`Rb!O!Uu=AZiN2FpslT(HQO6Nc;fMF3ZBJ30H8goEDw zL*U$K{x4e(EPHluH+=5w?qU(9Iy6XfmId$jaoZm2jb-c1(0cUa&O9N3miJvfL3LLb zD@n8`!!}BDPfPWpCSVA#4;(M2xa&p@2XCY8U&>rLZoQL2`~AiGLkTcr*h_)H!LpPL zc%{rR4Ff!{Cv&QffA_sfV_JmFZVXyTv~KxOSnE-eBXk`?woA_Fq@Ii z4azh_m<_5l@bUVlBeRs?)kHrMh#J2esbk5urm{vdRq`^D(SP9#y3d}%i6i?lF*b-x zH?KohdJ;~ZY!%Rk+27W0*o;e7HRHsw186&O6rBL(KpDRm&SPRa3He23sIG0olBG*U ze%EpO3{IXph1Rw<@w>Xv-6j4~%m_$HTQ)NSW@n?Osv31QH3D9hmX=Cpv)Ls%&j^ zWC+7ULvkI0Hz3MHQ|Ku&fO?UUk&R0(*?>zg-HywzxKdOCy#oW95pS?xz^`*>&qzkX zQ|%oX85`x+a>t?majf6444XG@z~xt5j-ujXys&$>Fx?nr zl8IDWT!PjUCvf!m3AA^dL0|u%u$nS6Gm)N2M$)W!5si;cAT~aM^wf0m8oTD2Yp`nd zN|6JOjg8^Lg$oh@lL^IVpseq?=by(uf{`a$LZLo6P^((I7RzLEqHV!ob?q0w>l4UVFxe+b<}BN&|q=;XjNJw>%1l%Fqk32AY$~9YnV;-D#j6AWEYGl<*;=(# z`CT=FSFbM13=`(5n_*CF>MV$(j44TgVn8grMp*w(U3(NjR_3ZXSc%#u+WoUv?|PWU zmS7ucCO_X}%HuV=#9}f2R}e@fhel#)ceTR!k~-A5l>nACZ0B@FsVNU4tZdv$%cVU$ zV9^|nNZlLLb+eXgViPU5O&VeEWdSV97!M2*wt@$gYF`!B8P~Yxj~f8X_D4IA9E!Fs zT28GdMzf;!k7mQ$-#h#o2)gobF>9*IAV0rlO`O10^{@#ukfpesB_dPmkagYl{QL767YV zP28PsDgQ}{+dUs#8!}-}^xTVi|BJuxz}?T#YsRg4_s)Lh{N1Y?zzlsC^LqWi9L9k& zqvk9A231YmgA%N>1Iobiw&?!Hom<8SXTgC&^YtISXJx?L`eMpE-)CI_EATl}MK!@ZHM%G|3#82tbP}17(2ky}LE~(sK|n^1fSF zp(2iXc(KnzV2D0U?n?ozBMC2+kb(8JLnaI1d=q6H+~R!n>Sg)(-YrW6yJDwb`Eq{vYLRsuKy&7Am9U&KYAw-gSO80VRM-n^A-prP^e%{HWCvdHy%W;V=FR{) z+Mfd^>p`q5?%|Ep%{kwdE5z*+e1P{N9PSsh$8=d-0Y;eK(LSzg?(UtKTd9L(Ul|a{ zi$7$%+c3>CvCMdv2UIg*29Dm8X6l zr^@K~6tvJPXPc;LuKl-x6ZK2N5V32nFu7)?1sD*o6_YaEwv8CA+sVQ+i#PAhG5l4w z4+9nPaT0kD4|ym-w32+EQKx$pYhW*D^y>X(fERjfk!6#fnug5OButJDVx+$t2X{Y* zv7s(pzI7dn^U~4X)rr};6r^Y5V9nYMShb=F$B*pC{yop*k%u2bSMMO|8=J9W^*XFw zw*kjmj^p`VyTrGspFjoKC`L9(-zs_}(JQH{q5@4z8qn0xAQCV#!X?PEgOl9 zEs;lyACu0tf_)iwn3t5o^Ho$pOb!Js`_-;{Nvtm&vsRj`K$gyp-d@PGzp}El9(2vJ z>#8q~vj+|C0?a-j0Ha~lDS&0x3>$};?W(fcY1Hp$nH6BxfPA|DaKSwNoc&R@CfiHp zmo_^j*Es^(q2z*AK}&NT!tmuw?zTprh2e`YW;z+n2k?5eAlFVaWlI z09cZRFzVxp4~!$oAHj`H;I4M?#%-Fs!D|-e_1+ctzo$XI&+kK1tgJY}@D@0wCXJd=Mfcb2hzC!T}q!x3EM zcYJJxFp%6A7q!dpJci-ejCBDpMa6wTl8+WSj+OgFlIZ6>+nrrI~o}!^=W{`RFgs;NB<` zcSnz_A;0r7-O#3U4zhXlIgC=t%WhMlGcW)EAOJ~3K~&^2fa2#p`FH%D!AVd3r}XKl z@6J2#E;K2d3tA5>)4_ZY%O5ySp9_~F;c&8>bWycfR*!CsEsI8~%NY`JxAg1Mn=V|c zyFb@jIfvH035OhDDeB-e-YX_@g|m^B(`!6n%yy=zsmz$bx>%hBRMZp84Hxw$HlWZ< zgFf7*w}~@yx0TKy#Td+5X(WR>%}%H%{c7Z^fg6u1Sl^NMR+jP%SboIT%(6K!o6VY#QKQBqWb{MMdUZCx#L@(VC9Jc6-FW;mR~ z9Kn+5Y3$p*2mAKz$Kb#)V&jtnE~I6oBQqxpDe3eWO2g>LC}Lw1ShH#kmNqw`ys{i= z8EF_A85RJBqmN+H)Wn3Cyc2ZmXm3Y54f)S>U@SI<)Z|o5O-v#-IxbAE?A#ozT(b&| zOPfSGSz20xQnKx`vcyQcz3n7UoovCeqerBzCx=)a+M2`=AuIWF6JIWF6_)vz1g+0Nao zxU;Lf$2<0hm%*kzkV)8AP8LGRK1g3Wvai@DjO1-{CJ8+wID4p}v56J*nsgAL`$$ZN1QFy3r0+>F4rL(+lTDdN< zMx}0?EQ4%MD+{;Mc$E340Z+|5H!T@%{!UB?-Z~tT5t~X-479T+`xIuGv7Vge6Lf+zC z+66`yynb*e9Jp-!Cf4q2=jIR%V0GaO_b$Z1iU6>_z87Q|1zw?Yhj&=YzzQ;r+IlR2 zWqYW&*e=&VjUfeP>g z>8NYb*N6Zb4dEB_dfmSq!9kCK<$q%#0Ly+d7_cZP5I*q_m*kz7SKw1GuU$~W7XQu1 zTL$roU!Fp9c{c8TSI{(@0M_S!*Rdd$ZLfLd(tLd7b&V*05zHleT`@D>4|YanVvBFH zxXnTmaNA33@PVr;7S%r^0jxl;&^|#B>)W?9p)ig`wNO83>z%+yenxri7+Sv&1d;{7 z`sbr^36CJ)TyXIKR@9lExzIdlD49cFer+8#)rEb_7J4rJ{gGos_{_a$L20PpXQKhL zXsWIUu_d_OoQLmo(f|Cbs_}-6K^gHAts};G-Mxfc2A#z$W2dGt4G-TMHiUomcUy71 zOS3kGfs^n8W#5UE5PA%(c`85diEn#JIX-Yz*}UMj{fZA@`4_Q4?u(NUMwe3=Sc?R( z+<7#RO^tsrz@*)*nZH{Q%YIe&r7oD|f{4KibCY7Y18BajMEu_t-#Sh`CmI-$HxAxm zH9fHE+*QYUKI69(?|l)tU8r9DiAwHdHtgPRLIM?2pYhY=JQZbU6UjK_p}0DZJPDd% zEQu4DMT9&Oll$Cu%`(B8VKas5J|4ibA21tvJ1{(XqhUX(yhKav1p@?R1iUgQ-Nu_k z`k@0@iR8n6&%Q67NcysW^Fs^^ELk&b-w#VYQIbvCcm=c=EYfh9K@GF#v8=qK_+c^I zl?fC?bYg-yn{CO4x|)H@H@lV1zKL|@B;T?U7_b>xil#I-<1QefwDKV9rKM6*%>PKvxQHtr16Ss*Vj10^NJxb~WBam7_vV~h+cF^7*~G8Pkd*@>3p*!BD_4D=0P zd}Jcb)b+y+4a`%4?U!%E#?9+Q!bllrR!%OGQ_}>bB+z)_+y(4<;RWp9cgU(Gb-tlw zESoaIbn&U0oS2mFY~Q{e%`2KQIzEQs(P0b@4N5jddXtd_6&oK%PIi`zlQXB!2#c(z zuNUJJOn-w|e^yGv9hI#pUC@3sIXIB@x zy1Rwx$LxrdWM*gP2s`gpulO^(>5Xqhc4n3sz5DZ+PGA;)LKx{X0W6WL$!83JWtJ`iPFJ(M!=9YT;gVd6rkG@DwbHJSCEM#D zY5l=I{@_2rJ`U%sk3ZPQ-y~7Xl_;hmDRRh3J=3`x9nt87oI{~<72xv=@4fH6bt_<` zZ60uds(as@e$V^-o}cVx%8iwboc?6i6SJYz)zV>|$@<5@6$47jL^ETAK}v}_OW+l) zrv|_h_f855U*_gB)1nw8g%D@>0;g!b&RkJBHfql|1%$e zRqa4#nIt-DYCKs3z^Zmibk=3>VW)O+>@dUb;mvc!VBMYzfaMj){r)8%faNP6GqAo^ z31EHkf4$+j5ISY7Kod3rVEyk_6hdF6P195bu>Ln?VEHvBD*8+{u>Sn{ie~*En1Q7L zmL7in54ixAIS#o`oZHoo|Nh+}91al8_NOzsT)_YH(G>pb@+>2~w1fu&SnNW$R(C|w z0|W{ZgX{FpwuXQT0!4m#cZr3>NrNf)pQ*8T(XgMT8;0+k>BU!{>j7y#)%y3J{9kuj zAI$%+DuDIBc*jK0)Tsopf+rYhO8t*t9>TfZ_1lNql*pS|-?04#DL46aah0P8Ns9WcEH zctypxllEm}D9mpk>cGFg(2M5-TH;t`1=9J53 zU|FYZP3qNsZTNTJ@v=Yvryoz@`&XB|D15~Yhu2N&2mflXM>w6>Y;XM^BhDeuUJip? z((E}H3}7ua>_TX_61hqK!MSd{aiFdCm~|Lf)*h%(MRfqHPE^Ez?y3o34cCtN=)b$- zF17$H{?mM@4eo#~)`8Du!FdZ9h`&_b59Qr|asaCqT4ql?MVF5BZ{YL}1tauER>~!Z zHz&Djw-nU?EIM%Nq1Dq$3P8CBW*6k~H;B75xMwVN3e$#j0W8IMb;K$1q}Rm;c=42j zKh#p_z~FqL1n?i~)d!OR;e6B#D%cr-d$ z2EcL);RWvu*ecpBEE>$3TKb+I;3ZlY=~EG#sYO{>B$%r%FGi@gLit}^NlL+^@_W|dvvCBuaP2Ez;!#KIE9H$AA8Hh>=) zJp_I+n~lIX0`NB0L1bTIUhN<1MRX&J$+2fhtz}RslsU@a;Luh)9=V5+2X`1enx0?6 zMoScQE?7yeVRmjFv$Jz(35AeIBw3(+`_K?;DGhDkfn7UxG1I1_y^X=Dxw%<<_UT1D zdi0P?KE&e@bau2M5~e6<8z`0X3^q|DJ_3FskvR75JBn9c`yvv_E~GOVjzm~2=J52{ zV~jo;!SL`6jE_G>CQav5(&`})Ln3vFs5hlsW&n#cn_8Mf%oa;!vPh+~=pZIgYZ94s znqAO3J35igWH9z@4D<5~SXx|W0E+<%(s=?{ON>ARVv~{EVKNcJ7vFgsZ-41sB$90) z1d1Z+EiW%2ol4=}y}P*d*=5Ym%ptY3#_c6h2!-(?0{${a*p)8QjFT^%z|rG}(AC|E zZRDnS_z2os+Zj|NJ+154Z{X95pW^!U+lt~Um_UGKB!p&S$}~5lt-T$cU7a{|=n(q1 z4lv`5Kq)E%X=zdaP(jFraA|RY!Lg~yDS3`SxKdH{txD_IAj7&)V!fUH2M^-Fp+h)w z><9yp#F`_Jlvr349g;M~2w=N==MIBU#8OJOwz57~C=y`}wf+0{BNmMz5{?KQGHG;ncA&R!3xg0;?*}8K_cg}ju2@`WO|2JBoyKdgyowi2p2D$1M;xHoQLwU( zExM|>7h)cUy4jPA;ZB!zGT)8sphO^aL1)42Wqc8ERVWl$Fh5sX$7;5Km23`kD=Eya zQY6AWRtvG$b6Xj3b^@Ob?Y$R7(QCiNmN!i`nfG~zpWiBUl zspt1Cmp5^{7U6dTHc6^_Nn-^H;c{5oS4K}uE>m2$Oy1>`rOPgO2F-MiX~u0&wW|#4 zTwO#30Cf))-ZPZ$L$n^V;+!y^IGQBqrEOwd1QnblV9M!NZlf|s_A^ld%LH($K)PW& zIYfHa|B^_%3}A&r?B2;>q{Xb0c5rq3jDDPnhD(5(=s^lw&amd##ZXyThFNUR2`+f$ zj>#$jR-l<|oj=U?HBM_4Oe>%9;r~7e_z65>+Q*;(@XDNv?DU1_DE(;{xu(%u+aj)c zPW5DD16Xz1%}UfU<*Z`V%+oYW9f^sC(y-F1W=K2j={c3kALQ0|VQ&Za_s3c9ifHti zLKzEdC6I9Tr6(yCIQQ#pR3z06WNYFi7Tn7Pm#4?*r*=}CJfd)Ly?`ss>s4&x` zp=Pqup)$U8xC4880O@m` z+>yk={y4jUQhVi!8(7Jf@Mu1Vn-dv)GMeJ{ll>_m|A11u9|b>8f{+LM6Bz7_a0E@- zV94)(F;n6`8e1wLr_t*gZQEqD8LuDcz=`ciZc_rbXklK?mN7b)!K!}gtgVX zOzzII=*ij)V8b8OmZj)J=1^?PX4pzv2YVLsl=cXv+vg~K(s36wCY!ZhJ9A7!Ygd^A z0(8jX-)S;RUJv2KT+&~iA!3|>1*BrgK$j20zLN8yaU0}Ydo_|om&7oa+=gRdNh+-@ zG656qD2*ciu6e2vWY#`8YO2y<^da)!df9< zi`YNOWE-=YTEbB@ha>zu8Gqwr&sYeaSXeClK0A-GC(rQs@e>x4rZGrqgriX|2N~am zLXLqOY?Scs7vI5`zw%Y=+OrRxT|JnbnqpQM3Dn=ca~qc~UBSfo6z1j@5Q`>Q?}`mo zazi7Kh;)?71hhpEi-&RK=s_Gjv=_a7J=nkh05iPE#cwT@#+9qr@cwT;zy}|Eh|8C+ zp{XfE+zfU3mWj)*Va-h#92&&Xt{vzf=x5hIVl$Q2OAK7~_4cB_uMgo+m^awl!?$q% z-aSlBO<`qqmFvjB0_jvSfF&RnMHAeA@PGhVM~`r%MgqUEQD#7I+rR+2ySi}e=1ttV zaRXPbUd8HaipAeU(FoR?HqgIq8+HtB$F_m3th-e%l6&MjyT1{LNq{5?`geA=A<07e z&8$~OQ5UDCrm?iV$`LTP4sOT6eFyOMuY3(}zws6lu>@;rF{I$PYjv$ME4x`q?4876 zp72^NCpw#X#eW+BN-+@^z$&pYJq3kW%NMX#D6$sTTq=vX)hw3DJ(p&l5lVM5mXdJV z1YWVWlDe8PYerT^y38h~5`!FCH=_Y1OiWobs0~T1oj@#(MA*`Vc$m)kE`Y_FR?NZ@ zRu7XERqjVtBqa)3>yT$}(6XDo!3{K`>{Vr|5|Cxu%e6lgbW`0x&dV@f9StTI1X4Uk z&$qf?=-JXlCp4~x(vI?s(^q;aVVc|F!z#GM>{SC4s++hevwK;fdy=zVDZ5IUy=JX3 z0G4xJRSpU!;?cx8>MH)J65$+o{uVinEd8=$(>Rp#yL z^aQr(CiHOaw5|28?r8HqV3)$pyqb|*Z*&BkWllU-Z)asN7E)!SDXyM7I9_Eye1PW?^on;&*j1AE2# z(EZiEfYLD(&{lGwufH-^JmTD9*4`~^?^ccNWs-ML%T{SPEmAOm#n3|KIikig7hop| z&|w!ziz03c77S}?LOFP^wazuEP?onQ*4PUGuz1usfSlRKYK%N){ZI}80G6fG#3|@H zXMUwW#c-0hOh_ z1B*ig{TS+PLtk42rSt-xJ$lGM9*J#tbaWt|h~o04PjUP94b05WVSXirm24if%fzNy zU_&d^62|G%XE(W4Q}&ChUD!lz@8 zF)=a5U=dZDG@MvSn<5daaY^k#jGb&Y&w}W?_w2>Cp&hKnl+6=ZlET!~1k&kMv{5v? zbs)Qz#r-??aP{g<24&*0B(uzjK_srHGOjXft5{uG!pkq6#~W|HjaOcI9S05_;RuT) zEdS)mW8A%W2gAd6@Z`xD#>Xd-Ot!PQJC%{xT_OyhLnfVJ!SuGaI1U`#jXnEzV#}5; z9N2dNZ@uv*whs=WR9eUI?K}AR;-~oO&)&oP?|+DvmI#`gLu`x^_*N+7S#XhJIK@NhhPm@cGxn)0pcYP2iq!qL29QFYaXWY(nxxDaDSBj*vY zL;w~AgOI?ZX@i9r@(3xMk-gvB^>fIeQDm5szY zSyF#0HUl@Z;W$g2X&?W89Z;TK5yj=rtdXwUpaq_obCfxPcm&T)bVGG*R3@t3q4c_V zc$>1i{_pag*Nu-gp&U?4fNyi*%GPN`#?|0AmMgl^_!3<(apg0hkO949 zX?ATB(Rg&(yW+Mf0`B4_s%*NjxPyjBt4vvSqM#;eah(iMWn38@cR*<){+`E|(ZMp1 zoSdx;flVStx&re}`~R#4faRQ8svSNWJK)tli#rc&E5Mr?z##Rft>=95(yk3}Ns*6h}*SqHRFm4xc0&ojo8 zocUw3Ym8?i)^D_WL$RWYu5h8Z-8PwT{gO5QL_it+FT0P_Sob`KDE}H-dyZ6s#+Hkb zJ@o9!q06K*Ed%Db-X{gLMbP-DwWgcORgR}%Pb@dBiZ?uNT&A7msaoUQ$;U2cy@^qG z6x5q1zBSKRSvz~@cN<#_ET0@eJjdd_DuAZyR8-k7j{1c)Q1x|s)Ua+S3jsH(L-F<& z64a+sN15Q9wo#HaLg74FT27Yv<%VC* zW(;02C@Q6;lDko)+_gi1BYDQu&}fQClNn7d0kE7U&Hc z1`?5wTslPD*1EmcXjl?ykf<%{uBc_Cyp6jg*T;7!z$^)CFiJbh+;+e_?HFUwi6FfZ ze5c}VAVgX>Y;=mjNo~n`Fd@=H5w{?+G$>_ZXoyRv7>8n*G?mL}-YA1YZ*(ML=xvW+ zu%{K_auy47GyE=r6eMb&T3f}{Ygcgp{#~TfX)Ld0v6M<;oIZo& z$Bv@Avjg#H1jRxTv1lA!UEK_DQG5O1Z~p^+{r;~Ji$&4i7Dr!i7dFayEY8nhy_{zk z!g4v!E^6tu3`dJiEtmiRAOJ~3K~$VOfBt3c+IJMK?Y+q4fu-eTJbp5Yr%xYqz02!G ztgbF$dS()jA3s7alS8OQ7_tQJG1IN7iJ5hoOb&~S%joIp!_i~Mar(>|oH=_Ii_6Pc zT$si5^aR${2rP*(o2gt}$BnBu@SER$h;Ssv%&pe84vzH4hON51QT~f_vm7z-rI%j8 z*S_|3oIZV)Bj-&{j^qA=ySR7n4({B&kEhQjFg`JjM5_y65r{G#+Dt{Jpz&Px{1iT`kxQveWb_N1dtE-rroW|wP zE@Nh9mR$#X2l}vm*G_DxOWN*TyD+$QD+7;-cntAaM3^Pv5Ed5~81SUAODwat_6}wt zQIyE3>1h$}UrTYnpFeXRFP{4XF1&bwS%4H6fPiz^irjU?U2B8)I|Fu!`EJ-(;x=U% zS?2H|dPU>{CXw?LIP8%oydM6w(i7PvnSshW(>Jp>&_> zFL_+SC2eM35eL>>=I~}9>#M6_XqdOIi=nh93GtJFyy$j0AfoO80$`af%lch+C1+$g zkq;HzwDPC5f>?SKWs+S8bu3A}C0ZzhSn570yP3uG({mbM$}nqAfGdu&OaCPoY~BY* zCsA0sa;YTDUIDMv^-m)vik6kl!jfmW4LEY4>pp3?SmJ^xAQwkRlqiJn`A8K0V_%(< zTb*-X@YkOs&45>2yC_)qrLhBSwF*>bSUo-O!L>1%U~_HIa9x5ftSho|Th7$JB7G+s zqH8$Gl$7IK{qk&L996Mhs+LW^s9zR;zkII2>b_((TfN%VZ=Zi;S**wqX7Tps8C-(u z<+3`Vk!GuSMjOX+zpic;*`;vDS7nQAZjRJ!(ZD)wKK+0Cel^gIm2%*GZEU;*8JQJt z`alGWk6|eZ`1(Z+Ag5@?)^k<_*9vZ^_;z*qg=&3KYkc@#t2ZgDZ#Z^OrqfCN?y1YAu9y+M&+yu(S8iKK{F*@_94yzEatL-cR&t-`F!LxL9A zspwMyk{tJaM}w^T;0Xe-ydbvse86Srv${l22mq^bVY}9mF{*7RtRvI>))~@rW#Q60Y%*zcIh?C-F@ZL6)$amg zY5+)ISm2fdJKX-pwSwpj^pA{P`iz+nYLFU(k`C%DLNDN#fI`~;^k37D3b?U5Aw8!C zm?^(&tVthn-84M`%+|SH=6Qa^(vG33a&$#<7tttU5>8#2VWxwP+ob7N7G0J|g-zum zVwBE$84J_nXenlJbl(uR5{N~h5Q&zT*4bU_&b>PrpBTsd;yj6RVJ(x#i8_ zi|5Yam6u;;22E=sj`3$tFf%oYrNt%m^>4+=lc$hKv~u1*{QJMhCl^1)(9jTid)m?5 zR7O6N!piajGni7V%hIpp(pla>M|%g3pE!l~u70F4B|M#&#iK`$I1*sFTtr`gFS@(h z8Q5D|n#ah<1J>h8t){p`2)rUudFodJ#8Rm=R+iT|I^v;2NAT6Jeg)tB-QUIH(jpe- zr!hS}hLz=c0Vhc?d%X#lKD&bVe(?_kdmG7gf7Bu7u&w|h4ZA3TVyeSPTc=*IW|`uq6t zkA8}K_aCqZR-(0)*+7{LNm`KGR|}3GdkzN=9YnH?w7#0Lyt0IBI*lUffrUbd$D`=! z?q&wo?94RAo{nSq=4~v@E-=d5yKO6W@88Q}^JHibZX09(YunZVv?b%%pa_J89P)*n zFw{y#tgNgelg%-!FP>;cGMU8E@*+kaj$myq{GWc?slxm4hBF{P+!3-27r_$#H+74V#uQHG_rAnH<1rn zuZgsrNO+vrI|a@doO0c&4RB?cO49xYh@od)ph_+`TvnP~lDGgC`_yU_Ua{Vb_LZ)k>namfgqT%OMS}gz5%PKenxO!L0JX29FR+aJR_#> zbfW@vj#d|oxD$ZIQ3yZpsjb$j`E#UM_Z9C0axAisc$MX;eJ-z^VNlxc!O^<5^esMa zDe6|JRs(vzbL*jpS-;J}rxl&+HBv)X~#`-WJ)k&C^J8*jYIBY2?MAO4k}4 z_ULJ#8+^^?ue%>Y^&1!su;VFB@ zos{CDAq*+{)We2wZsdspLV%evu-u_yfpLbFC9Z=Uq069}+8+dJ(LZ8@F>q&e!I%+N zcG+O6cfyP{75ApnadbizY9{R(a|_SRE1v;Lu3QX$vFjrvL+lRIvR*=xjGgr&M(+-z zxVDJX#}8ufj(&7^wqs^)5hITtVf67+21-`bYe;3%$Q6pn=88yXa_H;Zih~CZ;MA#; zIQ9Gq%*{??dSV=-BM&e?D~y?a`w!yfmtW<`c?9NseDNag-M@!@`}U%{qZP}Gvshi4 zWAJKuX%S0{i^9qXg_)I*OtxajuDxi9CNaOfhMDZfAzQTB(!6R8ua}g8wT@gSjr8g&_U_t+BZrUTTfh5l zynNv$wrxZ2mVW%;-~TOs^5dW3`t@6w zoS8x-9^)}X(H)bmZOo|Kvv(i1?-)WEq#0MlS~`tVp}>8fjK`RHMg2o#a%yrCljBo( zGWrzD3o8sxboTaO+s+{*JKFeJ0@6q`YyZAI=x9wKwYrGesR=wAdxmf%!fuB$Cka&C zKqM05sD`9JM$Eg##d#LmC)dhIIED)sUdFl8=NM?~?df&dR~!k{zrpyfS)4sgK4-CO zb-^NlgMd{k1J5a5qX1*5%-w74jNr7 z0<7tWfF)Ubr2$0bTL21Lm+XCl#wUGeA`LS8%!(Rlwn)b%nt@LVG+`ncip#Swh}aF> z>_vQa^%4WrD6t~;7j!onipQQZ495~LHc zPxl4QTeK97yP&!X>iBf`4+Fy4x>3Z!A^=NVyv> ztJ-OF<&<~hbr?mo!y|7=nR7( zwqLbcS#2Ct+(rkIlT2kIUIWnIr@qeeyk5Qis*T&KUGM3e%5>dNtVv|nL1W}uw}Bo2 ztHydM>G}aIZQRz=m=nHtL!Dmg-~*`S)qYAyotbP?RqBqkr@T1 z%p$Drh9`Fg;4QZo17_*VM%32MU)l55+F?UY78)D#=2{;$?Z8E@I3&QGRVYzMzpI)w40v^g)BywunSnb ziGU`fXQg4#seT0BFj%#*j!+X=%fj9)|5dbv>My3dL{$qlt)rFLFY6`TxqcbB zl{vh4>KKmf+kvh9y|{MsCVu#%pI|MUVZ)l*A(JQO)eJ{i>*(mlsgtMi)?1{>v=yD5 z?fB_WeuNL+e;+fG&!Npn3%w`@iEpc+PilT60tBIk3PWc^aNH{ z7Fo2Ne#jsTg(B>pM4(Q4M;A(H!P065BsG@?Wr?Tko8(?M;YpN-ekRs+~*VeG5yBkA;L- z`1W;NyM76mu3W|3(h647IfO{WJsL$z3u!%3M8XiVxjdGaR(X7eQABTN0)1Uc^mcdP zz=7j<_sd_$o;`;d5FDQz$AgC>`0Ym@;NqprEE=96x3#r2vgtMC(;2k4wxYkk2a#A9 z;Yc&0q$3pyGr&S)nZ)i7?A?d6r%qzmjvW~2+lrt3_&xmmy%tr%%xoCJUHY zLQNRlz8!n^?qy(+bigtkp->`IvrAJr%z0A8$sDo3QYp+#O<{Is9`iHv%#tDoN~|@3 zjxF67*uD)z+qbj3AqmMpcl;PSTH~0W9K-FK*I0|Iy`ux$caQ)*jk9hnFH8H7K3gP0 zdT%8Lu!wm#Gc$+P)iieR-iuSupTgI^@-^(;z25;={5mnQV zqlRjfSYFaKz=gQiDQil>6N=<#+}#+YBEUuU6pb6Ulv6<(!zk0W-MGSuei{8(QE2%Y z1nwcEXL;9D& zEAChNUBD~pTNUPK29|LTG_I1aJD~wY4KOFHIt8#8CpGTx!e(Q3vJs}I?;8WKHgQlh z^Qz`6pCdi%Oc`YGRX_;tS+B9vXuwn6BVFxCI-l==T%{d0**s1;eP__djEmrsZ|2?V z&jy)}0hJ3%z%pcNm&H67kZzDFtuDV67M-UV8t(uxFI>CH-BtoD=~{E6S{t|t`Z~&M z>DB8me`zYlj8lmkBe|||X*RddHyeWAvihP{x728E)8%#3uTyL{3twwH;%=qSzkSRIX)q7&lplr#n*j-!@Q#Xyp;=DMQV1H zGbumkIP~E`TpBHs7clYmOD)j4VN#LP7L5*Q-=uV!&ew|$=uyS}+i5eWqS|=1$8^1Q zr()Ro*1+ni%QrR0rqKebx^_2yjnK#;A*igIs=uwN2H@yc;M`7O?iiOaO3xKpcY`w6 z(EvSefW9_z#;RY}%5gc@TJYXzF|d4Plc1o%ykfK6379SE2~*1OqznTq05r3qOb^q^ zq~Z#(S1xe|JOCX*;=cEYPC5CzL|X-{oJp&UD~H6U+E)r{Innl1&|cUL7Mo2E(Wd`R zv@J2Z^jS7wq%SEwVQom%K?&C`ZNfLp;(H?Fn?XWJNc!Ft%ZrPN6}1YqeNtK~Cp zkj$2%|FQVGFb+&Vu>t3RpJMRx4LN~STnPi7$;~~#r_W1yg<(cO0Y^3@*CGP2==Po3 zMvX!H-t==T6ESVx3#33efzKx89_)5i{=uPui3+6r#mx`huu{+L}Un?fPX zFD_waZH*Zpy*+(6a_9)NTTVRp9D@f>pFP3#YgaHja-Z28iC6@k9UVA$=rGQnJI`R$ z^70B&Yir14v)o^+tBV+Ua1ZlyQ!M_S%Ve1OB*v_`5E5G`+1ie9ED3}nXoK<~N_hO}9>$(M#LUbj3WXvIn~#l+WBA@fJQ|zAWba%Aj@Zl5q);GV0BS)TReX^OkX*_!R7{B@8eSG}s zXUG;x$mH@^Nv$z}MXWH=l-jbT8}WDq(HH@I6ucmWOg7J80BLO)sVo! z$+0m!dHfjn?%u`NQ;HBt!ty2L$;~hxM{8FHyAkf+yO*OewkDGp8r+7S&NdbtAA9-; zSFc>b^6DzH%2;%Na64;#(GLM0q_x)8nm{hQ#=zF&Cr>dsHO&DC_U_(?-}&d?z;nk> zpsTZsfnSAuoOy0oMFzn3tO3eEqPfFS0oMh^<9p%uW|);=OlMA znX|Iam71DS+yHXr4HkD#<%&pUi&!g^k0D?4^5(Hoold9QeQ}Q~d z3?XshlXXiXoQj($0a)U)=Q48WGhycl0AeB#vTHLhSCUq-yut2t1W>U?8?%OtTfG1p z95Ig=MNZT}*AV0NPXT-9zsySYMy2KTOj$)D9H?ubuFVojPjsS;`=$X;h(Sc{CXxFH zaM243qbtc}768k%5x=W-H05R>%D4_{9}ts{04xTvcr2LxME3`En{+`e!?cqBy38@X zPEyxL^BvWR_Z36eHXD&Pp~Jwk_5wS|2Q!eV|7^EG1+rMoo%)}cb;@3rw$uK!^s5Ab zGhmf6%PjCpjv($C!_mOfHl=>C0IbhpeEAKQic{d{NVED$(z$EfOsYHt8-Bt2V8!9I zVJpP0M3u}NE>o=raTBS$iFV(seaH?jh_qW{ETziyH&M9;EC82GXzJv%irr(K)mVP! zhGhnCZcx-5k?x7jYf0Fb-3=MwRV}qDZE0K8)j4jJE#pTv8fbq{9i0<&@EHH6Fd1$C zb%#+=uNNw<9n1Q)jr>iFO(2?0(XD=nhG{pWG5RG=CayX**qi!%4r|?QE8Oce;5;xXsF~ zH0T*6E7rZKC`!LL=XDxwLQsx>#@N z8sh0W{aVhlnwxKY%WEps?zvRbx*B&rh1yJCvIsme4ut5zK#u`$%qs65-lg9d@M6Cc zolnNC#(+xZmYa+#<4&m&3(2rF8dwIba@J9;lNdZ=_=t@mEG5YusLeVf{5p%KUsH*@pJ69&G8~iWuonMWQV3O|ALx z;Rp+_M7yO z)_2g^)`3WP9Zw$L$FrxD<`|0k91Dss%+F%<*)(pCJjJ8&S!~_02R+?g0${C|*@!IW z^9&f#IBrd};Sc}CAK{B{zsq3R?VGo7 z?eZ0T^udR$r^V3>(S#fWSTVGAcHqF_LpXf+khs%sY%mbnzoi=o_wGS1y~^X{`i+~o zaq}kjA3Vsei@m-5h{co0q^W*U4D@Xwh=N@lDW8#tqe!LJu%)LDU;E0}aqjGk*uQTd z;_)~Gz|4O%YdEugbYUYyT<5rkn9%5R@;m``#NZa&#E0Wt8MMxzeg!H*mnH*Nu zGRPH$fk}E`v2d8ji1_q{7!XP23Rp_#Ft?IMy12nCMaLC&@2ot>@1`AWY%r7R=dnAVGS{0uj`hq-y%kCmzDNKVz#yD8CF!Q1bTEu z?nOMD7+3_d5i3smL)|;gWsU{#(X*^W7BI7dvv(VIqlE5=%VHxc# zalLb+^+}XJi6TjBpAnAdCD;rx-J9&oFK7G--Ava>-kjy|p_f|Do@itNbVv~)*ytg$ z_7#Iz!fJDb+?#1_k+KrtM{OlRN`%2C!ts_%B=32K`fV;(T=#k^r45=k?f>(i*FWRc zJa9L38gJ-;SZT5}jy>@~At0Cfl`}6@IiNQLTGeQS2AikiTxgL`&GFD%J#)O$v1Ylq z_?tnGjn(@gpp5cPEda~=QseFHD~9JqD^2%&XlYxxE#b3iG|?JHot0kfG6O43Z?{%2i*H<3He;3XY^BIgG=@=n4dNP|-EbS!r3h_e$#BY}b=I*{YrX`g zUSqDhRSq6`jhD94-L%@!bc*9ES7r0pUStBlZD38eAMrR0nP%p_&V5RLvln8!q-Im} zT_`xPaVKd203ZNKL_t&rZsRTZPw`}BF9fe=2K3RX;+zQVn%V3br)>WAZD^iV?gBLy zfPkBs+T*}6N*iuKbNX@jNM~R0q){v1;P3onyCGcN0y0eYPK$Y(&i%vNq781wp1R3` zT<^_Bdd|BK6MzMr-z7KY{GF|Bp?~ufbE3sb!DM-Jd&1nfniG%!BtB_Vww(0G+%#9{ z%F%o7Jat%Kx>2|XUUxjWCGxeBy#~7%>`wVLWRnZ-S#FV3GgoMy#OUqS*JWYJ?X25b z!OOnh+_MIa0zQJ~ks}Tpm8^rpH}+7yEH_=lj4&6$!fsL^%|xuy=uMKW=}W!+X2ZCa6nHHfJHy#u4P<;$d%Bnjr6<$7}+JnL`hQtewj(c@(>1CUr!f$Tf>O1 z=P>u|AufOR31;W#kSXM_NZM57vbE8Kw)QTZJ$nwPo_ijL4;&;VX-rK`a)iRmS1+Nj zZwq?5+7WI6gD=ZVOX%$zz;h=~VEgtR7#P@w^x7I078Y^++I2j5cpnRkb4aCAtY1aZ z>%bB0RAYq%$(jAJjzn8K2DWX-(c{nK%$YOXzoe;k|K2@JPCP>-(t<5LUD&;64>H*z zo{df7+VxwwboC~dR@aa%l+n}M$Aa&z$v9%MFe0G{-gxy*eEq9mM+Zd~i~!?f5Ap2D z19l}$EibYX(AvrpW|r3Qbb1NXOBrM`0&%Hf6 z_u==x`};V3>MVMCx{*q+VrF&o;#Ao@_<;mR<~O8$dK3 zK})z9*?fjwGV_HZkEYhvHtgBG8>dd5#GYNdFtlwDqYob9_KjQk$&Y@_z#RcA;b;WW zM1t8|6uq#$y9=Ei?J_@zO&Drnux?;WH(KLSW~B|^zKttauOddQt+oyf?c9Z~ZUU{q zg6~_pJK434=E~^fCwThoDVA4Ok&L(D?AaG_?#zokZi#WntAJriitLd4Pg$5eOUV^n zqYoM;E^8zeT>vYeFEW6~Zgj*(%jc2G=CMo>2Fn`^AjCpp7ELEGs)>M_P>APvDx1Rs z16UbkH)z3=@5r5)<|oCIY~EPs_mUJjFx-p;MGSO;b4am`n_r37D_LELy+{C-Xsc;d zKF=kH1i&y1QRgCnb)i((irHrC>nJk&YMlcY5ZjHxE4dqRnfeTJNjuT= z5@A;Ktyn-`*H;tu&p!2KUL?^05hrLCf(g;tCcmtfT;kl zsuZN|`MsL^p}bfNvoOchN;1FeUf>>OtbH-ZVDeYYqmJKMxpl9Bh2Ua9_iPQ2yWW`bG@m~F`PMh9Ouph(?zlDRSZ1TFbsh+))TZiLWg%&B9 zP$%gL9H4-waTQWS(PkdVExod?G&-0`iVaB?g;#^nluPSH@5(>X^kSEvCeb<}_6+G? z5ja65G5HXSfQ(pnG2+{HaRCy29M#5AHU#PGY#-=FGPI6~M|bh~-VNNkc@61Y4lU6r z#wI2)Jw1b+J9p#op(A+xwKs6|@DX%(b>qqCV|@J4Z}H^GLrhJL;n>lG*s*;pmKPVW zI5&go>1p)zZN>8^&tUKVL)f!t59Vg)FflQX%a<-;^zlQK%0=XhS=LJ;0H|CnqFgLF z(Yo>k3Z&AA#*)}JxC8He>C5=;cfX5rsfeYeMclu42NUB@5sNgVH5o-$R~L$<4XmuD zaclT4uG|>L*yJ1*SJUX}8$eH22in>a%-CvaYQcpUU&fc-c^6&nU5G}TFg5uEPai+P z?b|mnGd;=C4h#7#GKF<4XNpMW%1E?zF{6o@c*IH};Eh=`Bqm)(q$P&0ef4+n(uG&i zmTbe~@*J*SyCgr?udyp*vaQ_#u*kKJ0W4;Flu#^F)IHK#DvGul38-f>*xEmcZ+!im zIQ{$?cIC?#GFV)m$0rv*!Y7|y#?fw{ZM-|LxjdsIKpmw z#||CBOE1320`!C1wqxwsIPToJhrj&Gzru}M!)Wj9VD?&PPZt}@#8fGkrOX6kQMt(_ zbKl-Qc=6m>7KPujeLE(ejpM<+`}qD}{WZIz60IiInq)RtZ(l$92Kw2Ri?!e+0H`pQ zA`&T&fK}2_doVJBYuB%H6hs0KNZ+b&V1V5_+glUpY;Wav$VG5!dWy##fu|d2;fRDM zS*z`B^lj;7Mx0@|I(G>MxK;qcg_#u;GEwgoz+w=K^u{tdq%&D&CvkfhOGxJm%)rW* zWxmq>ZtrHdm3`WGDs#?|t`-&Vr7bdVtgdqKkF3a|J6R{nd6PGN4z*q<+-NT zakla}?cx4^&Z;;9Np+0=TFJX-Mq?(qPuoXKy_&6PlYnDtz(_X775giz&=uvkOB`g{ zeBK807R{e+J##Lw^8OE2|5e@UN z>Qu48vD5f;u8)H2VclCWQw~31PrjWn@?Cs?Vd0cFbN zaUrw|>s=md_jgs?!n3-0(y0CoJyuz{s?{|vNt(Jl7ksXQCU=V|!t1I7?#L=zvrp== zupF!1Y26y_W+MqfPyS1pPk=kr*HMa=6>T#zve<;jc)C&Q6uxC-dY=2 za_2+)yc9I-f=8(-*Rib|cyXry1(Ku+<2up#v~-rBsu|j5MhZ*D9Af2p$5qr~SczMp zarcv_#3jSLW3z`$>Qa6K19>(L=MQ(#+HK`9mz)Mx;7Mtp~fUq?#*E)$K)<`TAu4Iyn#En)yHzI8WxQN{(@u&uOmCJh6G3CT&KQ5oGS z5fwIPHPJB<9V`NNBviY*P;kkde)Fs+&J;G^iw_PNs3y#~qr1g!f>LKTFcjnv0eCS! zc3=)tA61gQMqEWOa;z-7#M3=(K`~+@X`Vdo3A0VAs!_sOB^UEv9YAzVzY+ zoI7(4hYuY_Z*L#h@y3mt_{Doa#zr}ZM63nhdBR_d9kS!1)WWA>P`> z&AYU?z>xwUJsQRAJVh!bBRPvSMLAqv!OGGy16ZWHL%;yJg=MpOL}Ll`^>4$w?|ub; z@CU!o+?Z5q6;B>N#Qe+zVi95=Q2(nd)gEO+YT2MQ?W>-hBNnJa_DQ3~t+oQknFwmhtIlpWxF=S1>*`g@xs1G`EDr zRj63taZY21(?58B&1SqH5( z5#upOKvsKe(qW!0F3htlDS?@L_a4C8Z@+`Rd-kEPuOH1##BXxfQ-`hSxP+^_m~oR* zS21cs27}cFi}b(NGFfI`5fhC-0diL*EwY@l2Wj3?|M6TU4KCHKV!{1<3F$oPp@rDB zlj<4{wn>MeHxvCD6EqiwC9A-ZB>zrhLjt z)@_8I6IVk5>IJZ;_vI2oKp0{WQCqW{V~IdeiU3L9nI&D_gob1vJvU zI8!~LFndjbD<$x9`)V{vqkqN!RiM!5hnb)xro9ZPMX3uA=kAO4K4@5H^qdW3@o8ZH zU;LuVsZT#{2*7H@8mc&9)H^$R4tC~XQ|~2rtFINktbTbnfB3DRX1%gkes9wB8Aj$@ zTrJCh!fV`{fFgJema0Zg#TWJra1U$Nd9~tlx3T(HsdE(wqJBU9$Ltq>jRM-CkxFwB zHy0$J;d*=QSZhxE69~4ojK4|)G?~v+_f7PTYbRM2mw!-fBE7(V32Kx^I?y-N>lVX( z!2hVbRn*Vd*>o(oy_#89{nDLtZmt&NLy5&6??8P}wg=tZ{6(%drtIf5Yj4rq^nyl} zTiUt}?OBcjThu31ZRh8V2ItUVQm_sZp6}`bSdB*1H2Ku3pFL9QtOgb3_qK%lHZ2yF zc?PELd#sVJ_KYnve)zxs$?f^lJKtRdr?NYJLge*lkoO6@O5S;BePd&1*4VF?m+g*a zYJ7Yv7{D^A+Xf9^glnR#!Qr@bxof!KQyP8FxTiSpn31eIKZ!MqgPa3O@ywMN;?6BF z9Tx4`Y(Ne5WYgYq-T2(wTQ?nP76rj9fY@n8>mY7KS`BN=j0EqPG%eg9$;)-oC>#??|H3>rjT+@cJ(UlH8S>@eMSapvA~85fdk1z4DE>o z+DQv462j!OCwTI37&otdf`!>-C;(P8j@~T;`07{wIsW*M|A>W)v)MH~ zel&vl>1PNxk(*r}rDC3G2`%9WQfnE^EoX4`=6&3KIL_b`MJwFW(}8fPiG{e&o%sUZ zdFx%)OCko>-0TEKAKk~riy!0BlPBzoM!-WXk>q+4)qxCJ8uzhSltC=AW?P!*r-|8G z8|7xa`T9FJbNW2GyLynxrf}!ZFoy5kz^&n7?z0f-ctuE)iom9_00FGWBXd?nsY{}3 z27s7o-5uSyaQ*_09zKR0Lqk~KC}AzVic6P2#b;Np;@S8(=9iY3;YHvoGeFpVR2YB^ zYLU(uS^27oQ^@DAZ`W?Tc=ikq@86HzyZ2#bIfb$D3Hv!4(!F3zw|Z^?cc`$*4kP93IMKn&pRg&F73BV#2 zR(EGRnn}~DT*T7C0%m6C*_E`fe=FX2<1L(c?j#N$KFT8YJjWb&U0Fwsic&4{pREMakHeQ|e7N=wQv z7 z>|z#?US9zZU$U_h4)vrQPSNWl{B5??0&q)H(RwhAUI=JZpVlB~8!A0fv$H zgk3wmss>DDEvo}v&dJ!#%VOS`4?QV1)B)9-%5o%7>{ZWbzE`{l?iys9I(D8n*`PsE zum7FnXO&9XQQO={oMJUZg_1IO+or~Fa}L5*<@x$9pb_;Dvx&iLJ?b$z>W}Zwmx;b* z`XP8dXe{Zf6R5G*eM6ygXw@4l)->|9V)Zw@-`I=111>e5ZGBdnWvtuof_4@)0jx$^ z(n`!*^va6(KiSN5cHXT>);lNNHucSA{~Bt6CHAeD?Yr+(zv}uMxM~KjZnaiPT@d7v z8k=FYJ*{GQanBI}jIw`BFPK`?>uKNe;VHPjTTzV9$NsE)il_ou)tYA2#-$&`I=&6K zu&c7$Y^^fq#?cr)_SL8}eDqe|b^|jv{d#+<4ig|I7K#6wJnZ=^;Dx`B^ahCSAiHu)3l5H7Zk3+&RXrW|&A8E&d)y)ht}7P>;G&*>x;Aa;r^ z3@i~CmS{;{_Y!*1jVkDjEE|kdhL)q%Wpr$m4aZq)z1Vfi3SBOLskRkQ*r0XYghMx? zwh}Fl#oU{lGy)fyuF59RvI%oa+LC}sLSqoo_{2E+zKxy@@2GcWBNUbfi z;4tY|QA9xkL#8ICurR-Xg{5US8j0Dmn#v#&j-hu;Kfduh-^8E%=l>a^(Gc?a4DQ~( ziKmb6qnKSq2n8e(QDGqQL}*57BZ8~9?&J1@r&w9bvLW5q+sy!2K3h-#>r3eE-HNuh zIOb+2@$~5^Zrr@ifDlFWBNrs<4=M|ZcT-=6BVn|)wILRdu?r^)&y#CdY6bah39r8L zCQhF`%Yx(N>UaPC9Sq;OiJP}>u_4?-?w`>Zi_sHMMXra!{FE8S!r8@wGe(G6*VEa9 z^JmU8fVF$qPL3&=$)s@Q>SbKMb`4L)#xT3Eh!BCBIz|aVDdh7E7ztP=APnhj<#Krz zLf^T45T~C%$ztyN_a8(ymuD8%Pv3hFpI*L%iRnomUlfUu#xIqR>fh27#_CE6YpDzh zxg7TH-hsE?cnyaS>|-JKQnAD!)~|l`Yh1c{6RX)g3LD^hvl~;f#Gnw>JrRqsxIP61 z=CE`%NcOBr0o z&D`EYrLDESDPPr>a)4>)!pMv{2}DAbxOh`S~4 zr6#}!v$AO3ibfh;3@{k0pr(k=(`w@Gb;^m;Ly_9Lx>p(3Rm0Tcy~_(=ZOZ!bo~avp zwbtRckpzMa)*vStSM;so;2&hSR-8Ds;Tkc(8hWNi-3+=MXnUCVf&i?lem9jRvg%iP zxVEeneKW8*8nhPO$EtuNjo55XIqb6eIH1?C$RusfotZd>c z*;Ffi@c3!4OVlW_o_5OE$ee3rfP34g(Q;L!><)MRs*&>5>l=H(HIkmMR5f1-Fg)ro z1?@M2Rx?-Gu1>rA2z#}OvY(^gmW|4X1Rwp%NzrmMl;;}!CpMzDpEt3jRm(*T$6)ej zwX*r^X1fu3mMbkU|HnhImZ#j~fvYPG7Bc*SGZ2UXn{YXd)xEM2v0 zP`%Ynt2I1k8W>tZ<@M}I)y8N*Afw69U*V#o%FfD?mFxUkzlIIO+IT-z8n zmLBBj2?ykIT-8k4(x2uTb6Y76X7WD)hSY?zz$GVVYhJpk>4IS9r~{bD!_JMa!{D;t zbkAu1X0zv>$=2g?;whAm)nx%#mFttb5Ndzh02`ITxY;=%mJ?!K-S6~JZTie%0GM@A z7XbqTIqL*Bt=zHO%m;R(VBuc*XP9SFBRy{#R~zkT7ie+~Be?+=4H!|%5krKD3A_lY z>z^8@hAGqXvWlZ^5fJRY0D z#PlM&cG0X$CgVId^4TKJo_P^(zx5^bZ5cpYdjj+G9n|qmCHzH zvn<*jjzl?%VOx7U|Cijqs6Pm_BLFX#Dd3ftUdIb3&vKcIr5r{^@8iy$TexxS7Bh2* zJ`qnOnN>$_eKZb)`6=v7$}^wKF}OwS7XmT~z&i87SsXun414$PVFpGfvxe(8uHov9 z8+gP3)&euI*o})cjTGdhaX>DmX8cqC5UVRo+FE^mICAI^jvqUUV@Hp(F-r`)_ul(C zKDu}j4<3#noy&40$!4l+Gl7m236jQ8p0%I|FdE$2j|=C|;@FWxIIw>ogBgW<0Uv(! z5w6_4h3WYPqzgqvV-yWg0IWOx+IfXq3 z4r0g7oy?-7KIrIZ6X2>fhV~>evJwo2Z4j`O%VK_E3HL`H0!=N|s`mvThjgU~MK5|QEBdJ~6lHA|Rs)uHPE03ZNK zL_t*Sai%Ud>&w>n6F@`uD;7B~3;T)yEQ!7+^)sv^TGnikgWE!xX}b9+`$r-R(imj+ z4}&Shz@pDhWJKS=SvE?Oj7Db_mqTW+>3kNZBDo6^z$O5e0hze06kOF@7AYH+#*0MT zqvr|05_iLO)nlY`h1s1}nQ9zamH-`BBwtu)>VinDLBo!+4x#2wOUY^K(&)0UM95ta ztpCbhbEe#fv>ca9cHz>UqKmlA@=M{eSVxMo!Rbc+D$r2z?GE$5AlDrMnKrVPnAZZvcD-uUP2T%}UBbGr z2IgHkukB&ze7mW{YmD)F^{>|Ao+0l=m+Yc#iiKrYuA;BKZi^Mg@~?Tm_6b}Ie2G+R zQd`R_Xb9TtngdknhwfRT$_`{0C!eDq+*dX=800nIKn+^YH^*D5KDQ+8M$72mk!(FKdSNUCB z8eE`9yW7!Hk*+regokNEU+@5@OFn;VQJtiZ1E;1|S>_7$mE5))?+){}y%I@I@`-27 z&`$(Yk#D4q0`l0cVO(rHK%(ld@S7S4qT(u3BM%zvoy(`pD+6HBe}#c%LcH7F^2#J| zz%13W(!vVUKv)TU^KO7B$1s%^p}MePN`l*5Zgux_-qA4O9Hq()ukN%bS5ntTiUi2) z0Qs+(=4|9TbDkPfj8QvWyvzL3@{p?|Gf_wfC?pI9*0v%Gql`o(#F5$B;xQx=33j(5 zcR>Pt7{JQq+2Ex22$&+*Ko*ZCove^(WjO-*&EU@yu@EMnJ;oCfEFZps@$qN;%;M4_ zMn)cDU|pFEAzr_bT}pGazsx@iiz^7XL^z7!_rCi*{Mmo^-y)fep;XLa_||pYzI7FM?%crI>LPl2 zI$7MC7$BspwUWxBP$rS<7DVH%+z$k*PxTTg_CC(z$&d5 z@c8jV+`V@jH;0F@md>zHds|xv;)$3Cz-np|b{}hh<+2Q7)ua)_A~tU!w+%u_HAa}5im#*6p7(R^(Mh_Dle6lm{Q#xZ8&l4D4sul z3@1(;M?4~vE~!G0g}rcX`Ri@%wleC4tw|R#eo9{aN@)Xbak|0 zZh8tgu3f>efBimIQ)_H!@7%o?gG1X9iNz5k7ufbBl5vXi*MinWm|Y4>d2%By@(Mt} z?)2;&(%Bp-?BVs--o&@R{d;Ilb|4fEaUYQTEl*e7QdyIW41CqF5->u68jX(W81lSM z==!T*2f2QhN}@X_LgQryvdGOan=i2Ynqh*PKn%n_j7P)lCddpd4fNnfWhJdWDw6=2 zlz*s2bl7;UQ>`oG;%CYyQRfttBan(gHsk*0GE-^260k~K2qkKtMBS4g1yOWAFwyK7 z88#M!P=rRvGUY91)T75)fJdJ$Jw1wqQ`t1+NIqqJFou1@xjy zif{5VZm3)(YwXZN#`WG@Xb53cm{QI@%xp7pEvB}X&&}?wd%5)|^Q(-0q_(jW-Iq32 z?LQg=h8>Sm$WX$3Fk)b(t`TJpfk40WaVv78sSzoNUZ+@>?3!PVN;J zY@jJ+vkNLs1pByTz0METII-GaRk4`^ZRu)hnv+!E_x@wHYhBnbdrlH|D_G_96tij* z2h`chelrG(n_sm;RCX7?Q>8tRf<<_#@L@5^P{HSsPzgghc#`zW8F0cD(733KCd!ny+*WeYz9v-Uj{*Q zIB3pSSqG|>tD+h;)(Zc!V*OqFt@>$JjG3CR)K9OGanr~%oRfc9w-#d0c4j@S+nX;7 zUoDmO;T$BKrvm^iO0c2z#Jk$pn^yjHqhf9Hd|=H2O}GNY@&Oe7wR$t_ZgBrJ(D(KB zG=Ee2>e9%#sJ5rpYwv3B`D^8Gr|PwK-OehWX`rdx!EIL2%9kqVfR65}bVo1n6WAu! zhbM-b@X8(qf$TNKN?(>pq0bX(l}1_R%Svw$2<=>LtvSJ2)_shI;cC+ui%cz9n5sYzj^PrS32)2YG` zbsx2a+cmlry(er0*WH9%y`+6y_YuM96#lW8XJT;Z_)#%>hJQRvIVrX2D`qZOfSpq- z7Fjl;yJAqWo{JMDP>eQlmuXUvNQ@3D0^RPDF~!E12?4K$m|>rBxzxplZ@`xCO1T2wI~QsVwG*Dzk14>$;RVsvH@>{9HUDqR$~=cF+$4Z7T4~ zOo-4r13$NiuVH3toS8cWI?+!$oyDO;NASu^ucDdp4%uhh}GTR zioX6nw32{#B8j^X?&J2IhqyoT6b~N}=rzLz=8mBq_|A8}hyUik{;!ZsL{To~8GO4v ze4UwC#GZ=B30Mg+Yb{UF19JsL<4MHmC(+6bC(_0uSHSgh6HdQy4zIoTCc3+N(VC25 zX?X!tQ{#9ra*x5dOg77|e8k+y6@>9d01ij_BB6Y0+m;q)#*oe!F`Cv(z=aoI!O0UZ zps%+NrE&pJpFYCq;}Ld+BOr{}IK)H>M?(A_gQ|v|2Ljm$n9K_EXPsOO*U{11fg=YG zov*HhpokD?K@wRRq zzzZ+Dfb-|hArg)-`1kXl{{kO;^f89-+~GEhCWyHtu1LJDCs%v?by!1pmVG zCvf)6X(W;fp2JtKUd8p{+qggan4|Aeq{!wCppeb6R@LJxATghPi9ichS?`%OGT-RA3OxVI?tG;j)TYpUb#c(eJE%q?Z=# zj;uh3noz{jBVa&&2nf!iBa5%8kRwG(BP%4Aq}1XS?)qC)2KyL@l@k6;ADG%9a2ss5EPmV}u@YoTE^ zsV*2ZpafVE_cP{Y@fb5fDhQk-0E@wM!w6!4Mj2SF%C7qhFSC-48K|;Wy6%HqPwgM$ z5=nV8vx>(!xpa!SI|GCY5}A$Cu%blAN`O2Q;DgpiDyyOMoAWT$O58$;okqG_F5^y$ zs-Ti$F)kQn+D_d>b?;|(pq5ScJ8BEFw-^9R{$}q51+HA3Mavklj7|5_mpVXZr+6d^ z_-9ypGFHsE)j%drKP$V=?3>p4!+%Oq;<#QENk2C2|F^%aP64WVD)k$SeuG~IYVCt~ zK;l(i@!zafEpYu)v|FUgld~RMw6i>95G&!DzB<+FZGY~y$m}9>k$h~JO7KprAn}wp z{ja(qRhd}L=B)B1f9!l`rCGPE-UNdVyymc1{W~jbZ$W(RWEskKgeT{zx`j2JP-l$G z*J^g?v)0^cbiCS@lrKl!6RM8`Z3k~wauD#0pNjUXV-5QQme!gV2B`8sQxm`n>VpRQ zB>)VqKIu0%eS*6y$b~r|-6}=*H-XJ&GO1K+zRi_>^G|yXcs~QnHD>Mht=>bv5omO8 zf+`oZv{fvWR(;HOes5swbI)Ms6OS6bRhy-9gK&yqfmNpXX8PFcYtZwR+1Yz(1LNC1 zOE?20xDr9TQP3E+pA&<;!Eyw2LG@AQUr&PPjop4a!h)0Bd=Wj%K&@FTm2;G0@ylv!S4jC0pl$4&@F5OAovX7P$bH z>`eCUs_Twsm_=5Tsq32iiB~U+&%QjZlxd;t0t07pZuT)sH%1W|))w`+3FtV~d1^Bx z-E~n-+JL>sacOi8RW5)fx9b`eQFT%z)H-!L<*Sa|$_RE0MzfQfJ=J2x$qlsV!boH& zVN?hhsP*G#1i&)=Nydznm0%-d=n3q{0FXxfV*z1`nx^1eA{IrAm?_O9@DJ6zp=f3D zi~vU>tSjsZbs403tIm}HuP849UJUz++JUsLqM;VV!y&{%1U!+Bkr<&8QBjOo0v0G@ z7csA5VbaJ_04q#j4jGXYVqGGg5i4wcJ&%t+ejk@EeT-5m&j7{P*aR~h2y{7f`Yhgf z{dHWvd<7Rj{)mOL`}=yCrPIBo8>^`mtYy+DWY@4fH;u*FDP&fcS-Wa{VhXG2G=oM> zO{DPzv~_f$yQc>S4j#bZ;2^WG3Yj&uC8FqVPok^41CeNi+iGrM4il5}xcJ#MT)BQ5 z4@RDl$&NjH_ThKG^&R}_pZo~}Sfr(FtE|p*~4t8m6b(IPfudx;RDRg&mo)53S`P|NMgWd^Eng? zMV?1Aj>rX!w0Y<=0*jiPLO6f+3mh$QOV1XR%LP0edyMgkXPBItLMEHzaUy-U&Mt)n zQb_;+F?x%I60^jFjVEI#5ldib`wkr3cK}C^9tF9V<#QQ4d^m!84<9msH8nTS2D*%; z7I8f*ksG2!&ts#TKv{JwCBTQ6WaPqk{_I&?c00s(0XvQF9ZGDo%?8r+66r%vL+g)guU8_i=9uD^Zv9`22fB9+NPs zI%}_ec!-7hSyYxEpuM>P-JPxI>FUJZ&bFW|)Zn5<+0xPyW@cwGF)@v2pM3$}`ObII z(=&kPmKJR9?Fcw2Y@8Ta;O4($W0`Ik=beS-$-3bdKuHq8a8+u0?Ky^1g1MvNgc?Ff zu$f_jOsGKZFV1hydxj2{5xf#MX;KnN*Lej`-5TN6MFr&*m{1%%V(nPgyb!#SdMH8` zWiS*58MUM|j8KvY81u?)C9;>fY<@BqEY!}uUjQMeWyp{`0eM|nLvi*f!>j>Ux|jL` z2SZ!kzG&NufKX0AUH4V1FBw=0U@3^@fG{6=s5=S!OUiHUpy#Z+& z237=OSz;GW$PzKHY#a&m&DhKi4AP9Csvjo0Wsb$Gz_n#@)KEgpUaQO~7t&}#@Cgoe z2w*7_S(#W0COVd$?Z1*8SLj}j-4%hFQZx@-MF(in!I9Hx^g{1ufr$oI7($qIY7^#e z(vgli2*n(vXcLcL8TU-`+oh4AU#j1)JzSt%33SMt?q*N2J?_TZF>qygdgQO1yMG&lbU-DmSA9l$zbY17t&BR(Si^2l-bRf{?HNg`trFfRlb#R#%_ zQM}>&)>ClsOF7azX@w&>TC0=%vZ6>$r zY+UO%zNSSc_|fNo;ms-10g6`2q^a?l3};u#_$ZB+P2U@6HYM0TNmgPw9->v=)x-3l zqRA7Ckup3zP=+s^wsls28zV{j!duX4G>f6_!4b=RsLI)!ZIdle|gbeR|jPR zFe{kL{3Z{K=Ang=@DmL&Q6P$c)REOXkp&~prvsBzYlQ;byK;?BEl=hOPvC=aM;YJF zSuxRFAt-4=F#(}nAiW_Xc`BpVBoIe!EQYzw z%}?QtH($fM@4Y1e3p4%A%`Tv)rw_mS5Gtc7O`3nMI4Ly2< zx#@8n>~0`iU54hyI$=*`GF8~x-oWbm4o1eN@o0Dgckd5jb!`hZwT<}7S6{*J{O<2a zJ@)r@aqH%%xP9j)9zA-9`Gr{=9x^;s+s;u!(A3z3+PVg5d-luv`nrUOp{x>DE6s}E4e@#N0wR$erGBTfL@cwM^sjT&rO$V^v9+}&?3-twzJ^N| zFQcQQ69+^m5>LIT>Z%O7 zI=XS{G^n_@g?e1>l(ZdJ0``{t&Ja~YSiAiaDW`JuD(RB?!6Y=W3eF^&`kV#q% z%e%I^irShiI@{Xu+_TT(#g|@^43-QFeDkfhaQ)qP@!=<*U}b#`wRQRc3PJV0Jhmf6 z<@rpC&MSb$Fwb(dwYK1?D^KF37hgbAW4(YFw{PFVC%10l!;f!ZdTve<3mi}rYHJI- zTiXKaJaPF7E?&BXix)4VyQ72gZus!sckyTc_RldsHG`$qb<{UCqqdZ@a%hC8W){~RW$x$-tU5-H9Tp_1@F9SXiKQA|##VIxBwOx;kn$)_@`FKpkmU2P#=PlP06-NGaH2npG;c zPLNX=ZVo82?cM`3BFfJFS`V94mr?;8uD=TSxP8TyMM5csS*rk+=|_3rCT1H1V3VyE z24d+(8HM`0ZZ&3a1n}v>iY2oZK-;ykA76oC8rms*zDXKHwuL1ZaTbJPR|=FnW}daR zPgG+zj@xIGd#CQbQGx*3`EvlQaNOp2SK*h*zZWrU3o@5%3s1A!BQr*u;)uZ*7V_vv zRn(wnoTdFfnvtF?_tEZ7^H%&5lI8Y=E#$T4y~(v;p_=D@XJ%8}m5W~&8S=?;6)I=` zawK~_yfT057Or>cwGL}qswbHXQN>GBs79riEY|&g3dRAy*wfNjPHuBD%4)DK<((YX zi$@*V1#6b?Vd}jlrbY4gi^gEEXdbC)3-@(c+#<_aX^V_5XWqps?U^a_(;aLbsj9Jy z3)DO42IpeO$b0cJ$Mu5ptt9$+>GR4z$Hqm@B#7RWwgSWfi#+4V-B@a=yj$!gj3VdO z1sg?cZ9WaGQeRfWMim>IdHOcrbc^k%MJD*s=6`AH=;Mz2(#Lx=h@&PC{uWxCZf!Ip zJ{&s*Nv3WtN5A6xUZjr{UGdC7Iez7gGxTIim@%uyeeg)1X4)H-P7gyvJk*g0K_Jx< zF(Fnr<2+E58$mDc^5{%j%Nm#+veDuLn7fb~;t7_3GfX82B^VOMlG2ZymEj&Kc6ZPK zl6@}(&w@FX3?J0h#rj;IB>f2ugHhpjM+T5)*K(U^ue{kYv}|#XjA`xH(7{t*`fr1l+*45r&$x_GncTwT{`#r zaLE8CK!V;Af$N&xjt(rrDLQ=op8aRqTEbwEkT7j4VP#cSAycj5&Sd|XFtX1+<(O>( z5DIuD)Io8WsS`9cK~U%>-hTH@eE9MEk|l35Iz?w6@;r2Opr`#m6ZZ; z2q3h!hVAWLJbC#l&Y!!0uFfu?>;RLKqZpsy&$x^O_PYTOyifFvEX>ce+V=K*i0c0C zu4K<^Zf?WzV!YNFOtl`J9zujqgigd*^@ zx4$ddB9|5xk*TagTXPGZd*)fZ@WP7{#z{y2gAYH%dmnv>cR&09iz`d0&SZQD7#U#- zhyXh~dm`M=b1{njU%Ge^&p&q!tu0N$G9p8aEUq`Nzl}#DBLa>Qz@peXh3`4yFFpAr zEKY`BvAn7h6%^91$)J{5HH8IP ziA+^FYHO-cUz9;2j=dd0`%p9*yAC*^7Aj3tz^$3s-RB)JXv|1;8?p$^%%s zw($SV21${9GUfW}8bTO_**Snt3a<;Vus9PSmavpe3rqkZI{;92 zAnU7u&Vgt{c|mZ;a^>32^^QLR&N&frt)E+yoM3*m0K3pfV{^%#sXQlt<|50d9h&Iw z!kTEA3}n*w*0ooEj0vS#1sUqE{UAG%9lkiwTf+C;ef*x!H2_P&D-A&m0W7mAEZkJb zh}(xu$I@@4wx?V6S;v%eYql|=W!-jmh_dHgI|uJpQ^iE?l?5o{&=L*!G3xe71FxKI z<=NpOo6y~3;j+fQvhl9Ekr8-hds#YwRn)&ov%HI#wmH^cnkkvjBn_Po{d?REi5q*R z8@BncjI^oJ>Xqgu6?8dZlzxX+;lT z5TBuW8EAQ%{_*-GENA)?N_=jKmpRukr^Uh{s7qgRzLq`@{FT4dBaT#|c;R9omitHa zEAKeXb@=lgKBO_Xl4I#{)?6!E&H|Cs_@3W!gl39FwgVPc7+x53yRUh2T0F)uh}|O3 ziwd0ivNfTSWJ-Q#Uul!g} z4#Y(F8)HjC8=ONXAe8_zqEw{}ELRuxrSx;FjX&fLzylo*$+nQEc$Sk7tqC>(yN7A# z?etrzZ0g+5Nwso{a}WcuqD+F?Uv!k1_DaJxe3(jj>Mr$jdRsb(bdG(NOVHY}PY2GUsIx1k=p=eQ6S60YxI*7)|@}keq$KtBr{v~|#o8Q3n^cY@y?I+mV+Y-=he`iMkf#RO|^)s?`&^jb#+yKv)%+#rf28zez^gx001BWNkl)6hKEvwdv`}ee<~|clc_-_ zL)KW0IK?avfgEaxojr37Cr_M4S63Ix$__9+J%NddQ4z8?0L#`CvbM-*;&>H?O?9=D zRmI3v3ypQDuFj&Nz8M1p$8qt(dDPa{;P7A%!y}LIXlO)2H>YQ3vAVV{;0#A3pGQ%5 z4L2b~HZLMgiuf@dp7;fLahadm!RouRN7ptpl z!mtt{cP1n_IKairR|Ld*=GkjFbMhn_>*{g$<}Liy4}XLkx9{TKqhYkPccHPR1&5M# zuTnxznb@GQt`6AW!_M{wYBCi9Vzo5Yp_xMaH5sfgFX7>%Ve}22#M9Sa#8c0{h|8BR z3wWi>G);&gfRkm_bNXHeZZTX^uXCVOu%;6>rZc9!x$%(g%fIGJ=7shAoF1N&}u2sO?F+j?~*z^!15`ZU&rRx`2 zSPEKc*s1EtzehvRm?c%%qrw(*0G8-IIZ(ziv0`SlF`ARQlD6hs zq<~aVcLuZjs2L;Al+#yq+5PyID7&9u?)`yI#KbkmZL}W=n8}cJ$Ivw)cj*fOH)FeFbV%WB6bm^t z7O`$G8`L z!wsW-zBu4mLi2`~wtUjyPwIST?)dDVP+$`$)}Q+QqqJ)^uhPle>87 za<7Pdt2}p?R>r8E0%t9KdG?=%zIzhvDfm|BJjT|C=&8ZqN-g_Q7KG%rh1b#;lf#F9 zD_m&k_tR56)V6MZ}1TnkN5h=dVdDfg#(H@4hxzj$b8!Wv+rdnO3cc z2qdx7Mvf;vS&u>rH0;8K5SXxSpbcVUR38}}TKI6d5QqzF7cYEryNid-S{_<;#XP*T$C7X}Qv6-?DOON_z=xMrwRuKcs*fJ4oCO)zvhE*a3 zx$BoOEZLk1VQINjXk%T&s=&(n7M50bu(Z03%U7Sn*T3_U0@A!cSKMWbtc zd|bvD(FYBqB7KH#dYW!coU?PKFN>cq7os`*wD>v9Y#}{hd9bv0Qul8GP<@ zpBJsGii#>cc=!-EZr{S&@4bVm*;yP&cxIrLN3eq+20@_h9hoN-!#*~63>VLzLsw@z zTAP}%xG;|gLqquCkAH%XZ`{P(+#C*eb{&AVE1FB^E}j<@e}JF9 z`WoJS|08_($*1V)9~2#|eF=FZ=u;-b@$D^5IM`*Pfpx+*A{x$&lFfCsXspd*Yjp*~ z!z1YFJB}+)J&WgG`aGU_`Wfs}w`^}uz&-`4R3~h2cVE@_O!sVWU&17nv8CaL!um0g z%8Q2E7G`XiNN-4|;(-USgwe@)$@Rp6TE?uh{ZRJ|)j?F?O95E{teL@6#*ea%1XOW5 zm@)Yx0Lz8_8NG%3|mMEEfiC;c_C3E})H~AHp!*Kky-YB5v+jTOzL|3;vrnm({}#E!@86L-pPIY+;PXAeIb_ z++zgjE7!FkI4tvFt{&Jliz+z0@rP+{qn3@w_C1qDPy;LUB_rZmJOp2N5|ifeyPwz7 zEIadG{W!%Z4Nbj5PQVe3NpEaK&-4alic=HwzDsyje%Hp`T#E0LFp!RXO9|yn_YZP! zjJ@0cqtp@w&kL(xs&A9?8XI)!pi+8St)_X(oJ-M&HI3ZmZZ%^s=ELNxOQ}ti-VyOn ziQ z@)lm)o}zEecR|7FnT&=^dq}DCGByDoySVYuQh=ReZwUQFf9#N`SKijkJBM=bh(2M1 z6zjZv^|$+uGV-H$CHJIQ@%=wSN_pU{=M#7@35j=Ou+*`TsNPX(8?{{6&T(Pxyu&o5 zqm{c-dI<{8w8x)^g=R$BF!XNsZYo*~ebfAQ_LMPt=P7GVIbmYpGk{oWXs@l$W z;x1#rePzz4wUe?R$YRm)Wo^d1ZWLb6R#l)jQzao@1cgM%*TO+03~Ub!B@*;yI5aa!CP;>j(`7yzrx(ytc1*MY_4OlZvg+` zKmGeScjhb>W~cG+!EM~S^$}{b6=hdBM78bF*x{B5H4Seq9&*NL)`VKB%ep0}lk&#h+^zr-n!4Li&?%ltG zt<6=mH8-HIrvuGRbzs;Z`+%XC^YcsCM>QInyYT#rUlag~b>80I#?a6sjEs(8a(Y5E zs~Ez^KUG!Lk|mHJ7DMUk>*~PvmvFG{Ed>S2tI*psfWg62=<4c2b8{0`R+cfhFo*H+ zG0ZQ_VQpgJ^H>KzZ2# z=H{j`IW>-ni3uq;*AEHDaT-eMIJ%@J&RJ&{>Vd1iud;%mTn2qTeYkkxq5yMrav2gz zX4fS3$QBl)ESuZgSlytO*gDqM*OATEqOPt^lMxV@kq}C!n?&GdXAf7dJc;M8J%^T- zR%EI(7#!0J*-gF8W^$*^JDot+iE5 zO-^Cp*hxJ7%=38eh0o!sr=Aw35wj4IUBwVV1+SP*(lN1IxE2AGt(|RQnlTJh02ZgG z#I;7(m1u2IcCD`40zQ{~1~8mZ)K5A$ScjMxzQ z8zge-;>_8It&j%-Og=K`gCsDW8`xT?gYpfeev=E@+C8o%YI~9BWA#Qu*4xDA@j=0spB^~P>E)=17@8wr0u9BP%4k> zU#XJIpyZ883ueo+5T^9GKM8lYgw}#GiXu%B>kl0^(Fig}C^oZWXGMCg>0fDW)PayD zw{{9Ba=8Fjn9w3*?5QD7P#^@b_&zz!b`R3iYfVQV0-}}*UaO?f@rQQK_A#f7Y$>t~ z*uN5r$P9$kyb)(nogOjv1t8d0Z5wFTCj~$Bbe&Eq-&KhN)K*ubE>nftOr>NsBom7c zEwAT^zlekrG}zm9OsY!MWwQcciPn|t2|K+Hd%migEUJ2JZmwc-d=ziJ`E&gE$NvG7 zQb-}}Aa69Mf{K6)Rc!}l;XIgGNyZB$fLqot({-QB$+!d_lgjR%j0 zaP#&Z+_-T=01CEWV?zV#vl;AdZ)0U?0VBi1n4X=(;?fE}|D`YDH-F=MxO(*&$tE~F zJc^G${TM&~$$!9up$C#pk2+Yb%?+r_YKFFh{ax(tY)i;lO|}L7$Ijrn7ruaB`IRqA zo0AbWGBS*jv0+S3PGDhiUcig;@=9d0SyWfoNSIk8Mciw%*xBC3_STk^m*Xx|ofY7! zzyG)}u$o(%u(G-$&tWD)0(=y8C)aIs4>nQC#&P49?dfOIsOdGXjW0$9h; z*4B=S@@23HCNVlTjMQAW_PiWw^_1oRx}>k&U-HkQO&di~I;25r4c^c2X@R9&nI%hTE0_#KIihrkunX<8zy+-h6iy#;4Xu4Jw za=g#})^$z#k8Di0EDB)Z*KAw2b?Ff;yYdRukZ~zu=XzkmInVXWLfs5hm$gS2lvSwY z+8`l>8XBg{rQ1D75gua_B6AWn8NUyeY}%h-ADAVon+ z)ipG|Eh|q%XR?se2*8RGF%Zb&*wk#3W*3Cu5?jD)K)NzT@&y{s9{zX$%V*y;_LT!e zJs=yQIu6e?xiFMP09G+;In5|3_F2j^-ADeL;F5H6I($d*G8Q}qPIF#OfeL*6t z+0MI))wmQEM?r_T*b9m`fqz22_RJRs7P~Q}9EF@D$(WQ{v3#yf5znLqHcUKHu!sv6 z7`?@s_-Nm!*CTIfay`Gq>yFUD&c4rKUj;=f+SmCiTc8+e&TI6T0svNWj`^F8Q0I~_ zE&0Nub+=s|itrYiaRmXa&$x_*9_KnOFMw4-UxZ;ZVORRUJA*21ZI3l_unxzT4Rct7 ziz7ERd_uUg6`fGIn08J(MbC>nuF-|bTXd<5U<)7S<%+4_>s?1-Cb=8*DJAr0FdPev z<6>*AyEV3M6rUE>^2w*ii~UQE@$mNKhL#iNS;ANd+BJN%jqOzSRW!go>m{{y{OhA9 zr)`Ng9$q+6fv;Uq5JJYHZ_$JY~2>$aMtnTfB8R-tvqp&~=Rnaq2*I+r5Mr#`T!++)r4-D5;5f?TCSf9`G zsFqftdFI${7WUvL44E(r0_6v=g882;c1kFrIylO}V)?|`^M`Ftd(4?h#*&gDEx4tM ztrIvBAj>%(mK{*TekxE#C-dMy^n~b;nUhDS&oo0+4~+np3k7iuECppv%$OlW2dK+b zqpqe}vZ@ih%91@Kz?%wioA5Y8$_Va|r6o))G8YZ3kQKCzgS{OA6Iup1pQW+K=MrWMB=C4hw+8tcV1)7}7^@r>3S>fEzNE7(OTZR1{g?+LAD{Or{n+ z-TeY!b#!#2si_fb>#L%DH8VRU0M^37oM^OB=Zd2A1Wl-uX3QI%HtxT}Lt$aHnp9*J5eOmZDDR|xRRzOG4~0Rtzq^ml z_6}S)e-X{iEy&c=V0oEYC1>#9!95Y5UtV1jR!mi<20I7)686Z^pn7TyH?0sB59`9u zMSy;L2WQWo!;_bv6rujQx_T_k&*R?1hxqv$Z(w|CQr0_yS0-9dutwN^We`Aab8Q_< zOH1fzYsabM$1vF6kKXQX8K2A|_{pa?Ma-SLWmDtKUOBJ&apmRc?(469@;U~pcA5^7={MBrXT_;;~I5RRD#dV>&$^+*ytHuueWQ}woZ4Q7j0L#MB1dK9XgIfzVR89eNt*3%h zWR+@IwldEM#&eA`z@EU>4gq$CDDs(Z9}y5sKsjZt60{?VB^eZ*5WP<{VF?TvB`rXc z%QEO0K+Y7CFl7hMi8hxqo+7{|*u)&W(M&`En5-_Ig`sOc%Mmi)l)Yw5FkRC_+fw&C z)6R1Ho(bqnTSXa*rNu-)&h;}xzGW^dkZgS{;h@rWx?gBJRd{etLRbm1GU0~L5UH#) z&8Vnt6xPEI(L|$7!X489tY{yPhe4XAY-C^aO3VHjX>5T2)=!Ff{>2R0JO*kJyEXTO zD}2u{Y4pYpM+2)jR#W$mysye_miQ-+Uq=6&d@cX@j}979xeRHKD%jz{mpRw@PD_7s zXsjol8XMxdqp5IZ^OiMVBNiT5#RhYp@AI`{j)fkY+(q8?nRK#iRyF1QpP=!JPVT(L zNdF?fq`1Z1o2_mc%lpz2>s;bxrGUkc+2Mt6O9QV$W>eCU_2EgMQE9^V3ER3*yV)k= zugSNXnW+<&Rp-02PjZHtZbKm}AyLnK<@MvHum>CRz3lv|lEE)|HO;WVoA^Kh71jxB9oo`afA`HPBu>S%Gg{taPKu0WnVNCE81siN!yX zm52@x0W6C9I%8i!3_Hb*zsu$Q6Z!P`c9&+87?=F+=y> zh(TtcOuo??o+K-H7l8@39)y{bBC|wmXc{uIb2~6h916#*FrZ08fuihM^iU+Lp+mMj zYe1a5@Yw|D)N!!z5-XRA^r{9HK_C89l|vj`0!dkFTvb*G5J%8Mm>cEgsHs+MCt)@4 z{Vv4OG`_5V?RtVZO$~LJo1MVNAH9nY-g^u0y!)PH2i*8;G4|j1&F|uCzxEYeJbxZL zTU+w|;`}6bch)dJJBGRWMKm|HqP499y?q11z?xfF#L&nX9^Ahxx>uRX3iS4Lp|`UQ zO?5Tc-P*vz2M;hbJc{9waXj_(HGJi3ui(;?Pvh8$GXj8pdg~^B^0S{}cw`v6d)ufN z0ILDSMCjm=xkHGhrY4Klwl4Jc9mlx~mqmb^vuJC33q!+05<)mVJuU1hwpDFyEt;E~ z1-xP?AvLAgf9vb(*xcL@p?5Z0byW>IyL!>vJLmzd&CN9|uPjMcL$aop78eA-A}Gcz zlmhz1lW2eyHe+*q+-2(2dtSkzEH8wVi&Fw7-WfVOsKCg@* z(jGR}H$)^}HLnO@Wpu4@TbDTCdjzmLaqirCw6?a1;5r#<3yX8OcmFO%M~ASqOaN06hXM0@xC?*xSSDQ>XF76HlPMwH*!e+*Ldr9u@#=XmmtE5ea-L z8;xumWhfDhle&}bwX}?u<`xX}_2KwHKl*!nr7s!INFnz-_wVE0y$6_@n8e)7oB(!o z#yh$?FnIhJUVQOI)z9i^7Y5$K!V-S*=5_q^XRl#tWfiL%o2aVEqOqk7$B!SwiNSuH zIM$ENwG~WF&tPV5PQq4O+uG34(ulU^dK~Uz*2T2 z8Ccu=*(L*v47q(_rm@WlW=OU@mkCZmAg3$kK4W`RCyOALv@HST0OY>g51Cf}hG#3wXS4!21w2 z7pxtv<;K*C!VHaBrUK_t7%u0$*r_)51;Embz%r!*i2@1NcHx-PUQWo~GC784NTyX~ zAeOH7P82;5_xJ0tgm!CR^G6bIxU7R52MQW#A^2#-j=G`E~GknH2UmU&wJ)M*R<9Nn-_D`gy5I`Zj!&LfZRJmjrMQ03ff;%-CU zu1a;T9#wtX^mL&Rf&EMsM7us$?=$Hf+ZPDB^M#z`sKRL zm>tBD=+umN>XAIdToqT001BWNkljw!@2SAjum%OHxYX};X zrlq3Tk)4D`8U2(nX5nZS>8GxVwsF)@`Yii*axu`wCuCB^0999c3Hb}!MdzD3vIbK5 zUY0>_yIB;rU_$O%0?mbFkF;53tV(m_!jYprr{&d*Xu9tC@W5b0u<9$TN&zPc7x6_) z^o0xClWU#knt)d>DCo zZbNfx2Tq(gjq?}Ii=(x*wSl3bA&icViGca~#)de3)IVx%Z4teo@`_3g?V&@yOTc+c ze%Mo$mDOl#>yj`+GO$`&ny|gSiIvqQ2_c-HpA$_i4l#xclDWj^+izu&s545?V|`-{ ztE(&6*w{vY-*NQy4Wh4a0NHG{XlaopMsfJHwN(M%$g-l?JpT{?BEZHFQRz2kn5?Rn z&k3doBSS((%hA!%fzzkYqNB45P0cM>Tid|m(!2s#W5ZGgg6m|AQS4lOdL6T5V-aMb zC_LX^<=#(FpU8@doZbe2BUEIb>@HGB(Mamyl@!cTNa> zYjX?hYwKueXh2s-2TlwQVz94Q%Duk1iTjV3EpZsbBcqs}n#SDhyj;(=Xl`jmZ(lF2 zU3(Vi&z=zgi=n!k+dH`a&bxT^wO;PT~BSQ<#~Wz^&VN zFu%Acnroe1o#<|FL1$YN4tF;(H8qWfh8F3QFMjFQ@VS>>7SKk(H)CKCz#<66HJvOw zVN+^Iu!I{1tQ=$KkfpS~wS{%+qp=<2St`;`a8k1b9tg8a*plo+8IKOI5T>VwRf8h= zhlj}4R14F}Yuh;ychSv~b%JAqW5*?v;2z*WFFojSx<+0HOEsB{ePudMx?bu^DvT;7 z6c9EQ+k~JLe-j{4)|2fJ8gdp1zVq3_+H%Rf zi$Bsw6qb(;whUkr1x^R(IX-RxaB8dDIg->}&O)3PnH%eRAZ7g@+Popdj9Ca{46HoX zS&2qluI-!ud5`_beBOB82Wm&lph-3AbqkLFDeP4w-JzVT)4~#i7sUNVD_?Hwg~n5% zZ;$ewFRMR^OuswV=q>>V%+qW~_R*|Jk*%L32^^)$iEB$8d3l^(e|z%#sIY$c=3ir8ZqY088&r1L(8}@iOGTtwf=)r0;9hD>^BX z7v!$@I%iYL5p3-7*GH#BRv+75jx<|Smze^3jRodY?7eAYC}0kTLqo?$)@4>c=^BpKn3UsG)Y!F z5mBxZFpSQ-F;UFD(=xiOfzF|kP>^zEQfam`-p2qY1q1bT-u*D-uc89A)m6w=RwCoF z2Qtiv%qu#!qPr!4or=|~)|QSsmqA{^Jz*K~o+@Oj$}u*2A8)_)8b0~xZG8Okr^wbe zp|i6WU;p|yapm%5(Jx|%-RjaDwlLtdfHpiRF{!vUs_tj6y9aRm%mwrwJB_A}9*j@T;`W`} zc74fpyt>)YjFbwzeL}kDn9(i_Y2R)+Rc3E`q+Om-T9K8i5*UiMTp}Q)OD&xFt(SG7}P*D=WjX!9kopeMU64T3T8JJR6&w#2eSI zOStIN^rYysH8nP98HG(#DeqzEu=!EFva?3P*q)nwvH}bxNrfN zFJ8cvOBXRWGbMuaWMM5Vt)R87746OSXl~33z`C@wjHaem^!6UZ=Rf}?yzu;s!oX5( zAs0f(-=c-3^IF1)U2llExz|wA#e!ps85CEywz0OgEnpje2=0=V>y}d0`IBse<+6U3 zIWS$r@sznEK!^cY3=gKZon-RUd8}FeG|W(#Jj_(;LX7zyVPiQBK!W95=WJb55YE6D z4S&?EcFMMqa7Y2J4h6v4_8A5bWh|4KrNEGdpGmN{f>;jVvuE%*CO%JqP($w(#1goT zbs^|mso7JFMMgp|%PpBy-H#oJ=yGgtGyqEhMFLC&4H?#J02W(So+a!q(uHl;cRE>a z>>6V=zK@i-_K5&L0d?G-=-F|RG@Z}(tL+>erfRsZvg`DaLIErh?U%h!^%#Za7h||N z+sCpHIxtB9_+8o_8b-LYcYrOiLm1ww`%z>gSSVqXM#k;5-VcZvyBZp5?JPi?V|B^+ z=g^cW*vRr0u*(>4Y@0Lx=%@bqk8hBcXw~^0z6dF#kTVttg`1|}f zd2dUvb4f)B>VMShkG5unBj_{eqocjtpUM|oeeyk4S+?&Z3C@K1c;>6y~v;s zR{?WMled^7XRAhOLo?WuK7;8Hl_`IPw4Ax&ph^6pwDLdBRp}Lt!Vtn|x?XeDi4WT% z^C{naNSS&zJfk5P=_bWO2m>s(l$uBM|HPW%43U>lSK-^2>2Nz>#Z}M@I$>})@JgJP z{R0861jO2*aI^Ah9OFLPr$UCir{dd*w>$lIg|l?rZj!`wuGCq!&^R};eP2YOdAh1c zd$e}|Oe4eXpV|t+|K&ytC`pWqL{xFe!1C>5EUP@UINQQQ04pki1FlpH+B@&|DEZ83 z!6X)P)s~`8nM*bA83j(<*0Ko-OUrAAxwX?7-w_xX2;2Jharz|t`@*6kC?fh()fowI zqb7;Z+T`0n9VcPGIPqHvlPRwdy)+St=9rNTi6*4&LWjuoVJKl`C9+kOs3B{kybRe) z1`Tz!BKS=3OnO;DT*wkp5X-am+*o0|X_+&^{5aU(!O+9o0$_c5<2~HEbr&a2p2nFo z=W+Jz1$4Bwislg=>DHD;Y;Uh&ad8Ig>q}T$UBlSu7?zh-BtzYWC!WBse&uU2?(f~b zjfeMdWBB1c5uk6Vt3gj^JGwer(AwN0noSG?>uB#p@8Bu4_Y9)0xgF!v${6~^8^6G# zp@+gss;{p@dwUz|YO^9D&P;^$wRMsakDvt^Qxr!haKW}CSj23B(=#mRx-ee^EOgtg zYO4`ARA-cLtmUOe$*@RJjP0n-9L3fZgk;zl z!9xyQhW?QeMm?~yvMO|U_sdUjPakS)Yp}Vsfra@w$rMP26vgIkt+nth#ad-n3FD3c zl8)ghD<8QNdifHbed;Qf78pW#A48*K z!qjSPY83se`kE?~V;5wHwYGGiukRRMdg*06`^K7KDxZml;NB*yd4r|*mgzz6b0IR4)_8C~%k@XOo zG5*co7b*2sRx5vf+?#o#rxsWGYt1$@Po`*1;}-;laewuV8S`x1U5CKx);|8?lf~!* z_qRX!2j_62of}g0=ij`)fdAl-@kru9{=sX8%vLA$cKXjE_`81 zlQ&6AXe+%oGJuojo`tuR*r@@4_1y6~oaw0X&*xiKHuv%8pDd-gAte+wc}b#3|IOEW z@x7;8Vplzy+s1GFZx2!)o{!F;Z4u$2LHp#4^zgAkrO#5?{aAkn`0KZ>?f_bvMskD{eYFNdG>nOU}lq zHzX^Y(soB_kHV$QQ}2|Ib4sBX0|`oo{9rl29)Vr`-~P^b1XLOseuVpXZ{yybo08#habXU1*%~x9)}y_p1=W>R5*GKwg$sD<+Dqu{ zJ&yX8PK-~@;lacEc>jZUF*-Jiwe>YLG}O!UsqsTlg+K{`EP^bOQLws3gwfBPJ1bpH zT`+1@&CbpUC`3jU`;5#75xRB`nz0EaoT-AWqe=}O+u1|5wh@hutpYZ+wzmi=^1>c21!f-8NV5z1Q*$$SGkV4>lyF1w3B`8F&vl<=kJrbHo23B2tt%NNuFD*!@ zBf&ZXSoRF@C;iw{#viqz816@%EYaR#I3(Ajg9Fj{A|OccitI5mK)1HmF+BVb6BDCY zT3!?}a)Rm_w(1x+!ctM-Q`l%OLnn=7f;NK#{Wx{<6bAYS(b?H40L{$&96tEy1KhrM zSD11HOskxbIN5;ICnM-U@qDtdxE`{s1pJuMva`Ki!VZZLP@8LXY#g`m+`$?Fyz+AC z_tlj(VMy_P=g*(V*)ykb`s4|;x3!?Yt^qf0+{E?k@8G@nKE&Po_fgZ>jJB>WoIH6F zmoA>i(@$Q;{?3+Uyu5k)HXaTQi@1G#wi?Y1wL&@|>#4iDPeM=$UR}QYqys>-JuE2) z!A=oScb1}OGLbFg78tJevWAOJ6hq1Pu(h{`?Y%v$Z|-1eWesavY>QoeO1Wkrm5@YT zjBW8!{WAe5_9EcbX<_j#rk%vOtRaY+tyRU*BV8pGfmZ-X8Fk766~2h9%Pv&SWi?d| zM-4+`wn_pan^KQ`Y)RN4*E9ofG+U~L&RVuvU1jyh16Q886KOH2&10dBx-OGN$~mQ4 zP-Kv4xHId>@h;$&5A}AsS^{F}9>iY~J}CRKF|d?1C-dAfpNw5)_Jd{alR7wEE}uli ztruRvJqRH*n?w&`0^8jVmwb4Cq`{@3lFFJB;HpwVM`6{;S}hw;G_C^kA+#mDNWIio z$BTei1RDuFvhQ|uU$Kmn7ADHyUUWS$J$2vFjn*{5lv|{1GX)@xm8A!GcDO2Kllvm@ zEdgMe_YnRrY^E0fHZU2Je@*{N$6dh(7jp{q?*HubUHF49^%O7SXMDxz;tpQk{ut z_C|VL^DO?cdRW;K3{%$(flC~(MC|+0N1e6q)xIqL^!EpIZv5N-`zWptZ=^r)s6(vu zV!11$7v!yXz6~|CO^fZlVF9Ce=ghPcmWS9S`NpJq+R54m*PFGH)^vG`5#mL5G8n$Y zK%gXvS=ib+O&`75Gj8}%^6l|?`gsCaS5)X(Gsd}lT$r3`R9M)BF|Y_o&;d}54Bliv z(fw-mMOpyvKoP$qIt0u>)Q~T^#J$s3%a~b?#pA>E+`p|>i6BL(ztzq_s2l)Gv~;xn zBG^q=KKrq!gobo}9vl3=1HI%R>gSwg;ae9Oe=vY_m zEDa3`!V$d_sF~&n0ufZ1oteU&TOZ;2TR+Fx$bHPr%;5aF3pjD&qzGISkYni9V1FN4 zT3awVH6>sGwTrel*YW7y9W2bvpuM#P&p!Jce*631M?*s+rY0wF^V1vnG>Vy5S7#+_Aie)8Y^({8#CKUOqMU_)K*k# zrZ)<9XS0o>jl?XAWPfe%Zi`;k%*-@aS5~pJ%?y4ne99rM3Ph-e5r6OP?T9ElfjaV0 z%FC}cBTob)6f>b+uJa8d+N^p(fDTf0En-#z^5SGA% zfGHwUpG8|+hk#eDtsOWxEW^(B2FAvQF*!Mkg~fSnF!LaF*Nio0nc7Ut&t)XzJYXF+ z*4NSB--lBtPh)Uk5Z#^K;-oGvE#T&zTeyAqHtyWLD{j*xcH}tLyy_Kf;Y$ zx1_I`6rruT5sh_>oXOxA!Oyc71iU(T?gDn%cR@x$0fOo9I}ju~V07$PS(_9QlCUqw z+#-k~45Y(DZ0_!3d2I`8n;K4N>>Uw@cWhmbMG3uhnnRjVj_g4f8Z6~t22}-PBy>>N zn8q$VL`4~Y%1}+MG@0`b9C7QHf=wD$XxkEj3$Rtyv6R&q*9M?XsmkMIV^|2&`(XEmE z&1aeRme0uNvOOw*t(x{=kS;kkD?uR@*)TbS&gp+QBohbkE>HgN_Z?22MB1 z!uM?b7m!Z&lrmw`3VV z%cPG5m^E?u=nyMpibrDkYQ7kN6>2)NOd3+FY&+SqEJ=WiSuZ>DkAGIcS58=ud5!A= z)@sUE{-fZ#G?yq|utHX&Qr(j_@c$nGEYGC!_HJ%V{KY>!m&3sN)A#4`&x!$9Wk5@9 z75?P!pU&yI|M3SC`0?$P#OLWP9=oWJ^P4AxuqYN1z91NK#Q?0h1LOv{e^v<|RHF7r z0X*4?R34#$m1VCXKeYI&XMFf3+ zqUpXD$bwF=D`NP4qyeQgVm(E5BgQF^(7~gyKjNV{$F@Y+P4QIw#W3 zE{sflx(IUgWw-UyX|QM*k!DHc*dRM9Q&k~Z0x2*}z=8I=h*?wDiegJH%{!S}kq!&6 zhcawz?+Dw$xu)s_I_E%IM|8IiQB`(`+DsMd`ID`2VT%lfa;Ml&P744$=g$2ya z%?qQ2W!~9b$H>F`Se%52A7_=jB{r$;Mj>15qrl0P@3o=U|_ie3=I*J71&lWX-m-*BS7H3 zC0Mw3ScdI=U~6X|o7)TnRsB;MaR2}y07*naRIrG3BdBPMT>@ByovEWppn+?LvV{nY zDS%~6FeM8))(*p930{>$Kr8AhskTyu09?wzqQ(+K@ybzFQHC;JOt6dq7Im&%23>}o zZEWwkpIrg5$iUjs+z>%s^}xZxSqc2GoO(@gbnNX#SH_eQ!djWK zQ`#`1Ad5ZW0W!Wy zvp*UOiy-9A-l1w?IbEzB0kxP=fCp?`2izfz9Z(swDzFX0eLpIX3uuO` zmHbFds-RS90M@^bF|fjZaiiTeQ+s_Se)eBp$f@HW{@JL8;>8*{_=hucj?_4L95Y*f zbDvenlPkkNEy#$9Moz+qJyMawi}L|kU;pEKDf}zf=J_0%yez^JJjj9!#N6@!&%fQ9 z%D{T@U*-X@a#|?<%yg&Vv77ZXy0NIMTH<>Wwaf8B!WkPqvd~DitMUU_vn7@-epz~r z(^yCON_P|hEA4H;;1&nZIe>Y(BK%nQ!}x{y=4lR0@t6}jeZR=F>ZD_o@r%O;mH|)p zW$}NeF|dvTV3jhEQb$YS@gLi1f_KDr&4TT!U*;6AglQLD61NY+cc)d`Kq6n=z(7cS zZQ{d%MGK7DkR=(rClEU~gVh##rMai_Zu8G&U&+M4adScK?&!NOp02`wLfK1+oa;N^w+B%XE@fs|esZdXmb?pptF$Ru|wXJU%2Pl#0K*x&N|0t$zAt7`Y zC8fNCl_`KFrJ%tte^)@1?Y&W9PX(~I|llRnAR|&EPw~{!RSd-}!y?^&dxbYZoS`W-vBBilJd< zx0}Vr<_4;(GN_}zk_#VF=39jTTQ%7_WNYfs*FT6;r%p+mvdsygEiBAoZFN~P2+~0& zcv6$8k+$UgGyqGo!r>4*+glRywz;{j8d%Nk=pQ(auC7jD1QAS|Uzig?djdw{beENB z=-q(|`tuJ#E6KvQyQ3^Pvf)IF=TN}5Y;C=0hLNd6K!VIGWr}S|hCdBUEE6zIK&)K{ zVmbeb-?5xzCJ~g{wH2u~h#`SwDQXW#7!! zQXD^v$|{0S%#wE~^;}$75cXSNZx2o!KaRehUeUWEu(r6gh=)Uu@X3uEm|IxH+WH16 zn8i@C;MrQ_Sf~UAI1Vc+B_y@Ep%IM@4bq2nc9)i@)ir{tnP~yB1m`cS!0PInXlSv{ zU7a0xN&u`rDbw`S42Fk>@ybjJzs9=I;E?4Rfi$sQTp1~j zL31b}h7@Ek$3a=SXccLuIEHrZVSRlQYwSnKR(K%UA^C0sZB_;YS%j4)p}`6~2rTHp zbO{@j^+?0g6ihevm5QKi_?-TzxVut*xDW7M1h5EjZ0-=i+Qqv2A&X~w?-09EO{WPM zcwDB%rVOlb3spvvj4_uHR|V9S0U3c#f2Oa4Ao?J{BaI#w3@QW(Fg)n_8{ z7Qrgx%7+LV`#NNbYkg((xjxkQ>jrDtb``Tbqy|F7>-{-K2s{(l5u{ZRxSSW$}uQR%jE`h5%OA%teGx|7(V09Jl;Jja;{ zyDsXRxYLp}`E!Owf%gUWu>4g3tfx~#2>QjQQFY=Z&*XIy<0jxi|m+-~YS|Z(@ z3Z19;AT8|4My76&4*KhiKluTyJC98R%W*yn7q?iimiT=^m$bxZ1ec|Db8e4>07^b* zH-Gh`m)!a%7xIJ<76-7Bv&d?Z-XiHUF}H!t125(JG;ck3T{ovMtuw;6=yl1`7w%vG zZSt}rW3TwoOm5bpxN>R3iceq&;V%zh?z6He6^iB6f-$c(KW0d*+~sc?p4U`UFy6bpZJPLlMWE0kHY zW`PE9RCr2kYp58W0ee8r;%KF_A!(n;eQvyXMp@dpcBqp9FeXfFHP_NcZSG++ck(Pt zlLMTrJS@Lyj3~&Z4qU{l3U+T7BIpk&osnapmS-@ylYFg~O*kDSe1(EP47t%#C=-Lu ziyZ5#HjA*YG<2~1@K7`s#i4Uxi)I$22(w!QgbAQJG<50?2uAQkTmUS0`tP!CDWgGK zi<#&cl19c3omDci>S{7*$YvBgV@P6Ppc%7FG_MT2lJFbNdeu;y6#(kNgL}CC_8a)& zkNyg~ds}E}YQXXSJ`D8sDBG){0bO0)SYBSndmp?nEFpp%!adnP!20T{FoDQydg6%- z`1NmpTfi}DIuTeP1MB9k+jwyQ5f&FIQm!E<&CQkQ>+QlTuY3jH``-73>BO+Nsi_%E zOpalAWJnlT)Ue|F2w-J08k!~v14MK^BMdBNA?)t$$MIvwWL%MfwXiUcrKJUIk#)4Y zC7NY)p2^%2#*$=|)4^QH?2%->Y$<@Wv%M$bgDtHT_Z~z?XNR;bK`8-@Hp!G)7seLH zA%)5bDDi0oiU{(puC0i0x%9mQqo_YcP=-t=f=vV#87|1SotvK*Ruu*3>+0)JQcG6KhL-gUNh;1pS7{R5I6^QS+59dBHJ8;i@! z$W#Cq&YnVFcLy5l8*uvcIb6QrljC^=qut zn39l9msyYp8X_=GrqjkIRyQ?U;l|dEhU!TO`ksUrbN{d`f-1JIEFj71$Bq*4o$HQj zDUod@EKm!VbD91KoN)Y$9v0U#rvoUAB>_E@fknm+0j%|{9jtBd3JXg@;-DYy3f;_3{o>iioJ;OZZ((97PsYELa?P&o;=lXL3HO}H zC4T8-1L`wzm1nZGZcS0-Ic9do%J3Ke@NBM#`}>6etjM8hudgc1z$)CDf%%z!VKKKW zFMyRgT;fj9Q2?x5_o;v*lvb6)LtN~s!9Z(u?Ax{N1HArVEq2=M?YLrc?N zOL(+*TJwew{!0Q_kN3yk?}vA31uFV7t+D>U_#?wo6nJ#0U7c{y!a1k)jF%{M1&fyz z_+}!8FC07iaWM80h4B9j zKd13l;&P!YkXwn|Gs0)u8WmQ{uY&G5S2h>CvUh#?Oa|Y5D(k^3j}ryj z9s*zqt3gF?H8h8SmZRvq>_2uwYEgcChXP`*9Rp!h4GA<5%a~6QfaSmUAg7%IhpeRN zxdwuG)>pvha(1=@jGXP`2820jb_VLW6cH^dG5`Jg92mKJN~~yaUiR0-t*EFjcokOzxsFy_M3pQp$gHj`VQy|lz_C3tF3E=4 z-j=_UF~(5Kg{1{7E-pz%zPh@4Sr0_NieY~ThXN+C{|U?xh*?-%lxqkmQ;ePAg#-dA zEN|J*$gZf$)Sxz7Bfu$#6T>`LRv6OA%!K8_Fk>5u;Jp)h7mTC4TtF?(83Jw++9+A! zlp$7=%^*|FGF1v7zrMCEZAtbUh1at+)o5*QlphN56FB7is9&|Pydq(66#FKCr6Hab zGDisZk?kfSgib`8tiFc&Ite2rm_?v~OtINHW@99PIpr8h3f>VYWBmwvojP$6J>A`C zYi;#_;>}w(asS~%1s|CKbpHUYO|3ZAKZpxw&g0z0C-CYo-oP)ezm2KsX;hXU;F+tJ z(A(7}ZN!Y5Pd{}H9qnCcY-)DzW{7E&eOA_E3%POt7Qa`0B)7yRB8+UqvxE==*0}YB z`d*yV)WBkh-ulii*0+@P#PD1SaFa#DP(%WATmvjoi0T+Q082ts4`rR=Iz&w+GO@`2 z)1WIe zAr%#nr_K`@VFdd1eq$uZ0W8O=HV})9F2BdP9nmq)EPR{KweWrmTa|Y>h85q9PQKn- z4c<@ol(k|d%~Y1*o&WlB&Sn4oUykEX-kT3TPguRNG6q((^t>5EdV6FDm*g7AJ?Q`z zMcfS}OFE0u@%rO4u(W(}pCE3=N1+PETGrNyWSt8+UWa)ZSg$w+R#dk5bBhj{@bVn* zD(TS_ATbqvQ7Irz?y#~?O7N}a(*NPxefZ6*4ybiEQ^ftnUjo1id(>C6g!)GJ<&N*P z5nud~ZVk#eUBU<0HEGM1yDps(XQht6Bxjf;hks(&mkeO#JUIXSDcXu*ox}N>)?VHt ze|*409vl777d-hoy`)f&=c!q-B_b90%riLTW8d+y^(?Sk3PP!2OXUZ!#`24}`^lV~ zQNcP>a1!K0Wo&&8Znkls7!&zMS90p)ds9H_$zf9YO)acvDRVV3UyPbdFH|MY%21p!Xx)$6Blg;w0XKV0VPZPj$Oc+Dp+=)9iC)8l1W(l<>=yXuq z#A#)?EMLaN5~E!-AP7VOkMKA|ME!aIwus~rXuS|-t02tze2 zyupP|`Y;RCCgB)~SXz;0nlUOY41&N0HKJHG-eb;%fK%?YTpb3Ar5}h>V=3RsV38B^ z!vkThZ0{;#M8nD$(o>0Srbg1hi*A|I(~*o?d}k#!X>^RKgITV6F2Z1-gT|0VjvE#6 zmW+C35HaeynrhS#z^WvR$iftzP7AfS9Fxql8Pefn#>A%jT5PSa;lmH!!)vdp$$wZjRqN1`I?H!%y>+6%gW*aTc%?W@- zMic=n)e<6*SRud%!2{lx$z;*o(t@U@Mqzoe>CFL zA57K+$%a@h;ML%<0kpTZO7=c7D;V}yS)CCP`^I{PPG*F?Mcpj2m2~TOU_q5;Y@yWK)kPt$K)DmQ4d#^f%o(iBVkXoC~O8r_}T11PDtQ3NP)X|!nVF>9Y)*UFw zv7&6OJz@D#gR7&h9j$FGqT9tebNkM18DsN{i&$A(6SiVgLlXvi`|>QbkGp7YAm+d z!kHD^SEi5OI&FP+;fE@mt>MZFU}-oSwWUNjeRmIQWMge^3j>NE7W(|uJyz0}aeyk<`H7}u+~_FoH0N45X?{QvpEIgMSs4Vt`ol{(^~wdX z!YLG7?q8PI74QgFamPJ+Ze9kKXL*H1j>m=+2e9&4i;+Q_Tid`x3X(GUfi5dYNy8(D z^%CBdkAd~d|9ZdR^X1k4I9{h|(LV*cEa%?Tx}}ZBlnYBJinU{504sX--!y;~>&{q} zO0JAlsRV4Iq^>$rU&j1<^YC+@khV_v@}@;erxc=O0IO&P0wbl+wMT3IXnH1*i`3r9 zv&Px^QQ$dqDh`zaiRVq6WzwA(2sWwXY^m2w@2T zR+xi;*5rlxmMuKB-37f#3I>&&~ zpj3g4ARtfKfz~+V`VvNsw&acP>0R6RlNWHJ9zcApW&~5@Rw-sXu~sCFXQ}~lfuMW znwybqgJcVBZ|^vU%oHXjCQy^jqPejiCyyP&@qvDHb#|h=yB9ru{h~88G&F>R9jKrho)Rh@e} zPR@BWno$-?NQfXn5TfbkcHC->R~aAymH~)EJ(wXmK%qQ*zY2Ld#u!B^mqJ+} zDdgklW?43g`h?`~L$ODLV=+HrW{>TwJeda6; z3=MI2N2bGd>(9#hdF-)79zO5EQ*Q^^z{(^tCMp;_kpFom?2@Svo@fA4S>`nd z0151vS&{Ee<=KY{02TmD^nLWPsacq-i)S9{U6@EJALNXLFlko+OF<8N22*V_i&Oz8 zkq=_dQkfZmG?o%7TL*I*OBTVv64sVK_6sYA!Jj}zU6^@mMm@Z%LST?C+rg$`A>=f@Pj05H;$Z}~jum@b{ALd@ zX4W~`)WOMf^!A)C7^fTa>uHg{*wGm)%ftYbN$W^5FunPx*q zck+C$q>aqZz?fO$$!2SDW6m*vb#G)izSw#@`g>=`FKTzRC_)LxA5I{_Y zJc+?8k6vPT4<8oEl(K`|B5`bpYRSZ%fm_a=OSP&3VJyFbfS=$#yU?u~zD^wQ5J~S@F4B#rVm^sV^09X~} zoH5Y=te;P{+5i9`07*naR3{#Plb|e9kAbt9f>?_H{9y1ZQOUqZI#WZH$to%@Pta7p zKx1Pg)ZgFBfZORaXJ~k2l!3O<@o_d7hd&dTPWAN-?Aw$~r5M1OFSFG3Gt}MFOQXZ1 zTux-71CW)iuBN6HO`P@37#VE6wXnecR{)@9XGB&gfF{^>#KC@j1B}kADU;36%={eX zAnQ{wfWc0%%?bk0!4C|qGypod5&9SI53mh?!}nl=A>haLA$J6D1>g*_Nd`?lFhoEy zF|HQy1?6MFt}rd8^Z-4Sc?J*<{$!bKHDxpS0f;5ZFW}8J4F=r&0;SR!mH}3!l9WxS zX)TfkbhJ@JLmhiL4Gs-b|KK2Jy5uZ;kXKGjGGh(@4;gNCwwk4fE1H_9It$;fDthj@ z=jgcu2kE(k2O0dTNF=DWwUst)+{BqNue|aqX2YF5(@9S}@dQoe#^^;?U&-Y>d*%$a ztZ1RFTes6iyDy?G+qN?U3jh|Hi2))8T>vhkukl;yv1x4VWo7GES5z~B(&pdazG!TGqD($rF zgUrH$#8Gx=c)ar1&!LSZCO9i^+ctE>rVF5w0;TFNW?2c*)?i>UQ(PH*3|jI3BVoWS zXT}5*3(P><^N@`$SqXTXW;*H1-<3h<)s+BUCZlBL_3{BMcOmF6F%}K3{I@Nz3@th@ zY%c3O5WmbZ3&+0)4uTk7Qn&)RhKrC z)?h7RP#X81r8MeF3ABsdpS65zGH% zlI7gbfG=QJ>OfPhfYt>v3_J4a%#Q=3rp?>L*FvWhJ62~rm+hb zeA_oSC+WIP)wHcOMQt^ee9q+bJPl3EQP=1U{p{ETJ=rj4${do zdhw<#UA!tyn^q(V?=fP$@%%h>j?B=r-Ff=)ksS4DU;X6(ti@U{;=#02xG+PM)XqCo zhMM4q=TrZWuEL%V3@Wnxn0=Arx`3{GXm}o8?5UltzarL+z2f0(c>mV_ah`7R0Yw*M z?t$+0Wb}{st@2-hMV~CTEY=1BV5ND%Y2Heo z=rZ^a5b^GPIo4>B!7Eu&MpcOl%BGT(hQAD?Dr~MUPs)s#LV>2(qi2@bf*p($_+AmD z8yWxsG%72nWH|sb0AUGFX2bv%&9n5!z%vFRJtJM43jsW-*Nct^65vREA!sts7ni-@ zn+=;WF90*JAkDsi~=jvH-A#M`>`dpL+XyXl#6xK_2)z zfyrcnsv6R8`<7QESO(bK(n>2=t>XHanVa$CeE>Z`_6OK9m7k>CL{2jJfjNaV^MzR& z8X2YGp#d5k>ZkGXQTDNt6!XO334RcyqdS3l1TZL(N^$)IqMXPVC^tDp{X;`EF*d>F ztRQKxL@GgG*uiTGK_Gml0Nk;}bVf|t*(1%EB=D+A!Kgh+nM|6}FzHVvxja*aDK@l+ z1aASsJe~=L>|p7zUmNN|yu2WF1fvWfmb^P6O@xU(fIr+H;1#}yp}R0^0IC2y6*(84 zSEPv&ShH*y>_3$z;_m=RQMV!kMn43@t%5S}_(HZq_qys7`$q4 zZQ(4Icpm^B0XT%T7R;m3v2m8H!t5LcLO+1tT1#^?`)8pp4jur2b%>sM?f`>`XrqS4 zM(XJ3puHDgOjlfS1r_oI1~eah;6WN19H2`sy+o1?z!R$?LA5otblo-A(G^!+&8#PY zN^GFc@0S{Y>vIbV|>6a!cautV0$i6$h01ej3b2dLu`Z`9}pg=I*@Sn8P83rkGA z0?|LQ4n(^M7$(3!B-*%sn!&3CvuCSPkXC|8C|Ma<4(@q#N%m2+GnjCkeUkmYR8Gf9 zPLN3!{|1;QbH2=ymbFmk9Q(n$fw3BG!S90tadMXYa27)LKm-7Z_7gLA%VO%!b-o9i zozJ~Y!9hrG`I@XZxB4_MF94KcabOHAv>|7jWMFcR3fjKNf;&|}c0vJHeE`e6tt5d7 z%U_LEsKAynu)NU;Pj6|D zV0=x}%RlYkFZ|qV8k6*+-wOhSFnxdf*QD+?HK*uZ*EiEmTWkGYftVITQ2(We2IzD5 z4^Vz4o>>v*m;J@9E9o^CE!6|7_(gpG&8_sdE1Dup_1|y>Wj7 z{pOWT)Lx4ny3!vE(hr=>(ck{OpPuWs1P0bp;qp1125hreb;zL99(I52`^&R()IR4F-HW1#Wmg;Cw&wV%KQWZn5+mY-mc-e|s_dWp$vAO5Gno))yZhqVGOCDuhv2Me_;otmhfWCKN+&eb-eme+` zk6{&Ew?17#e{fABy>4$UgOa5_n4EudBu5|pNk6T~RxBbRTx60fIZ?%ZiEH{}K|Fw^ z8y67+a}ZSWpLXfJrMQLy09J^>7xyL?T_pe}h0oHq3}H#$^K0Rk`wT%~LA$XPOz-6# z6MC-Ldj*)u+Ey{m=`35Q7{C(X1Rn#icy}055CgE-18YwFO*CVa0SP{U;{!~RrBJi| zXr?>ggCp1?wj;_(@B&8c3V~YTt&9=0RM!v6YL`i~9^)#QUzdZYa>;Jw0$8OaoRUu6 znHO9?D=oK42K|A;7UQnbxiu1pM83?>z#DH25r!5%oHdFY$j>V1G1|N~H_4)o*cyOv zFvx5Hk=Y>-N~iFQ&U#)WEEo&dyFcaNs#H46iJs zk->f{o13NW+qTi}y_e9XmtRd2`B^%0_z;bc3{ZY@jGF3e*dGb+#mHEWI=i}QXn2fr z6M5RTdoNvi)iu<}46IsaJ`E2K(!fwZ<#Lee71(?nY#Z*ox)Fw!V_96HimG5D-`Gqo zEzJxR&CC>NY;=SfV>lOVBY0_nP1ZNi$NxVvifhAkJNdc$?D@kH&d3R7|$)+e}0?35F zff)vHNld0;`Yy~Okvqcw2mmrzD6^ERN;7aX1Lo9Jo^s>kTt;SV4`dygBGb8s$Mc{R`7i|DFOO9f`2fvrp0Jo zJahomrNl6wfd|N|XZU9mtA@p18Q?Kb9C>$_fU6t z7wz1&lWJL% z#w!4p)~P7rxPBPG0(gMm3?hlo71lO38l&4I8{^GNzP2B~!vJDzxCE2=C#!mc`8A=RbiAlW;y)0d1 zkY2MQ0>I+Fqf$ARsqti{0G9bxRq~v}?Vw;1mqF{qB!tF3ccZNBPLH!v8B6U;E+ERQx1a{!fQMCEC+kgTlyX(B_oX&;LBJB*4H7TL7$$flC>H^_I&U>A&CD$_V&!K4*re>8)Qq!_1SY&(Z;`ql@15 zwmo(9*SD>VJnl31576KKtgj?kxNmiaK6YCNGo6?HmEx4LL(!rw6oJhk(VzkY8WedLxPs15+@ zD~}G-hhE-Fx9=&=`np(EfQ|L;Z=dHKz1U9-llR(<8Ty-B+Xx`may|f;zwy*4{ntx_ z;3=;0=C8s7Yf9$OK#`nL$BDN~4piYmsp#PN3&oAW!TGB6TNYa$!M-r(H6D6)^&tgs!-EiJyhY0(}OS z-PufAIr#DXue@&~H@I8?i&uwUQa;@!w%+1ZxbzosxS|M1MzR3b6e&+?Ckq_>TcL8iOFt^w+ z9PFvWG)+xSu|d6ov(h)^)o0JQ0-k@G*;c};QGi_~(6~2z#vr={c!xT|v%!EK3^H5_ zo?f-JHQd&?F8tAIYHCHEW&jw#z3OVJt*@u1h6X}5Lu5znJbRXo9y>wz-g7@4JARTX zz^Fo>?P#Z+dv?>M`!8X@E1gWyz4!c_PMtYTt5&U|+WJ~kr# zZG`f2y))ZK7+73~mQB@7I>B|JnN~HrcgK0uFOS_ODK{yc0uBP8h%8g2gt7@@V3D-d z0)wr&JU}dXU_Z>0O#sfk$P6d}R5`;dkJFL~ zQ8L8J`TP!5h;N~QS4m1&2@?x4LT0BaLyf^c_|owlEZ`Wkrvb(?aEJQE=qz<%nfjQC zw6->0>A}N&P%wJKM!~m|4sZrQiy!P?fT*_!v&oN;?>C4J$ z83a5C$x1P@nE(6bZP5VMXHNtI#U<6hP5^SF;EQ56j|Z?$IImT(tZ@L=k-h>mk}mYq zJvu{oeCd=YUn+H-zqqv{hJjTYz}mAiO<#M0V6Ci6(8q4?C<)5M0a&;$By?Z-uWPBUYI(rM zV(ok309J7wg#S|NU5qQ&pS-k{-gb?hE zsLSHtvgXMhUCAI8iEQr6%o_#SjI!^XCqxtj;bcJ{e1M4dF7lw#hg1VUk@cZS3OH#6 zTRj`VW;e2Rqb+I!Z-LSh@HajmftF?Ha#&&hMvt(oyf$!N62F}_6O(nj0MhE$fyMxO zEqMd1E^Rm2ieLbiWattPFk=j0Q!9m^1Og)L=qDLe027PlSF-@HAR&ZdI|~TCY?T(| zvPTumr9?WzAXXy50X%!^@WAW?hvI4C%KErak1NYK*zWXhzZ>VM;psTLDinedvK|lZ5&*<>sgOo`p zY30f`+O=~VjSLOY;e!Y0eD^sz-+i9Wb)Ms3c|W{{uDXV5nGW8+5 zJ_92GK2-A4M5(H3Dl1RYR34f0#%Oe8fQEF#pDAF9{>Th0$kbq%4tAI_ryyI)O)v`z z6ElDX2E-IRM*E!ZLq}%Rc};CC)zsCo4^~}m4SR$Q4h+!QGw0~;AN+_89z4vPpX$0AYHe?) z?Ynl+zKi$L#&zpyMSTO^|BL(R*ootmsi~%#x*7&S`+NK8__34Bz`Es@S5RGDJ^O{R zzu3Z@iW-gX{p;ZG%Oaz$z00BgL{ z47jPcnP+@&eacu^VAOf6I{AM9ckGG9@2oPgJOE3L`W*nvRu>K-)|VCekBi~Gfv+3^glZu-U(F%rT>GnDyD-aBKMR6Yy^qMySV1;+*Klrj}0PB^XJ?R7p zeh=aQ3kPVn{0?*^1F(V*@u#n7i;)llz>5Av0a%Omv!#9yCfD2krBe@&e-q*WtgAkD zw3t1mkKCNCr0@LJ2KK26e-8KN>5ea-_WZaalp^%XowfAw*NP`ZsgLQ_7X!I|e0ZGR z`3*d4+!f;itPkDYLm#-gwMf1fE*Aq>Kkk*C8RyGY^$Gg!Z?9iAD`zR~xHy0n{k-m9 zF9fKHD%+bcX`nxS#S0@b#`S;r{5bu=znzbK=j{Gb0M=6KZ7Iim{GLJj>;pq38G?45 zo3>=>ldtP|!NDtBf7t*QPAWaIIgh{mInKLu_#R;dWhs^HjH!J1lFMxu_j__N`zo#g zE+VSwo%K)`SSosR+%ID;Er&Q|3LWQv70gap^fX0YTEV$HV!By2fQ50_4Gvgt!6~VA z7gxb3EG!MU!cM9OPFa#{9q%}}@XnEiqp&cfVFTF*6_D~Ifq|^Pi*y`cU02Mo)9YAf zKo{)u0Vh8NIcHgN<^)ens|{sxAu(Rppxq!uTZ}kBqqLHNRpC)qg0yfym4BP(m$a;V zKdW!?PV@c8V6a=xK?den$^57B0dKTamM>5ezF3KJ@l*kW2Hr;`3x7#m@4JWw`+MoxC!b*E*2$BnX>@d)0jpiR_RuAlUPf2H=vu0%NK()FF80uR z{LzQ$*wN>yf1sDPY~4(&*RG<5re-Ry%+T~~Ic?aqllJVnm}Oziz#1K;@$q4rm;kUb zDGVRfabcQ4h3e`WYHe-j^lexZUhsGaNTrQ^qs(%Ca7sq^e98Xg&-5jJAaF^dSE zJQV;@s?t=Z0L&CKu>_<*01H!d&K!x1=P*65N-H=3AW^`Z^2!9Ivl(Uq0T_b0|J39Z zGoG3n8mYdafof}O*|!R90Zf86cl zzM234AOJ~3K~$NiGRR$FQqO>A83TA=p>a7YMdHZcmk~`&7@Rb7a#4N?B zJTvOR-~xk&gL`JB;kn8gECcunSsluQ_X{#au(AXcoKtT%ku6rGGgJrQs-d158ycvs zwUs*B+bBOZMLj+J^xf~=MNdEVEQ2;x*$g$TXre9Kw$VkqcG2z~J7{%BJ3aQuBXs2W zF)GZ?P*o;PEiJ7KaGpGIieC28m($B%_A+W}YGQ^T*nj8`0<4JSOaO8xYpT4&`VQLo zqD&$4HdOYNjNi`qZ>&}ZD16UDllzHZmNKd!D^#x{WFcgBJNh)nsmcmZ@(G3@JjYBD z1}P%gHUf@`BvFjfh5ZY88E>2@fF%Hz19F*(x-yAn{FHM%*03^--E4yXnpnVft|nz1 zir<=jCvr|r2^FQhv)KDH1{ktJqxLAI$+?VNJ(%i@BK}ItXB)UaVZ6G*pf0Jy6t)-SKyp6$&UP za#8Wb63|%yEb;pa+8g+Brh>1^Aa_?AGNtQw7@lYI`+re#Nm?>Mb!U2i+bOssA93}i zu7Tr^iwf_Sx*89!$bA;Q09ZSVF7%PRV*o5?%^Gxeh%QS>0ITSc{69oX2#WzMfGO)& zr2LyB-D`Cv{pl?oMFqP1&=}qMoO;Gybkj+(NSw5};hx9qH? z+7hgv_k631esE~4WaJnNVEt_bfJMZM=6`w1IyPJnf6(r)`Qj-81I(KOLKU^8rHa1& z_VsFbAG`tvv~NEB`gaq?olgWGZR@>NLIfqB^>9YfWT>eenA|^feDCj_P;| zkqoT3)<;=R4^7k5%mN#e|Ht8R`kSBj$ueG_3BcOd-?onZvZ6llUHaE2MhGl17<)sv zkG9*pGEHyTS08(xT}uG0f#nQNfmhD0`jW5WB6k2#`P1Lu5bOE$@aakV(UBY-?kjNr zM18@}?9w%9x^;Ig|2yjQhJWm&C%eqYta!LsDu8u-V4ChZK0&94q>fu_DrrYs6}@C@ zHkMU~$??WdpQfI%(g^|DYAfl^-vYZX`WfKu^^K>;=!tWa)Su&I&eUF8Nmr~*(;N5I z5dh9opV9!NfuS>iyp@d2bh!!T&FH;^zAY@4a;JO3zi$K(69ni~mm-U>EXq z-u1koptz2UKrH7*t_N4RY;q;Pk^;bU#ET3D*01fW^5i}ujnk{>&bg&SmtX(@mhO71 z9E4>L9t%i!Zhd{A$DqaSeE`dLcx~x#(hV2HQmKwZ=#S`NOX#3#0ig^6yQ9Yr(cJ`F zn0jnAhZ)8_K>MFnqb?o9+}Q#R4PwIWAZ?;n7NIpja0x5HQ267q!PGZO2w=*pQou@p zFHO(x7_4)^QCVS{2?eqwyBF_{mn|rRs*-~u{9reI9vRk*<$z#Y%~2450H6ZX3Tzlo z9j`m@mO0BnJr3$nH)_IezF^#kbpo`Y*D^c77+dPvH)fZB+G`nQT!F2VQ~(Cgqy91s zTnHmgT3_lqxaKyzw-@BSC!M2jT>p-MSE$>rcHGG=uyrHn9gLVW7SI9wR1c5 zo$sQj9)Faced*I&;bQji)x_UI$@;Dh(m(Ibax zXn24w+PjC=Z&*jQ^$oN@U`@@@#?3ou@7{}r^^(alfR!5`VfNMB43d(F{|w$M&Tv;< zL$$T_Y~J2KfUI@HG&nRuon7bY^y$+q9mKtn?G5JuSm7*v%tA^r!wP^h2d-cmY2b@q zg&>xtItxU#Fc`0I5GGY+g4-JJGC&}dv#!2Qz?kw1mhb_*sjID{Y)v%-hjP6cX6=Dl z1U3?+c>pB2^Robb5@N9Fl(_C-xrs9m6^K+cJ5kOGBP*7$mKmpumPBS3F$X+w*RaP?C zIKiwk0ryP$iZ*}`S$&<4>=W2%V3Lev0%cD-2HMTT(3dsK%%rR&9diY^5mpeu1^j>| z!(K%SVDWfUUM^WrXXm(|8v6;i*I?rSU^pM7OaCt>f1T+s~MS=Oi^7K2vo z3MRmkZGJPjq!L0Kn{B?Z%>|pH&5)k=67*o(-0>vT$i%7sa+0xCug~uV3Lz!ov6H7{ zhk;dDt^ih&0W33fXCrq8lT_lzV=mq=OTc3FjNdBbWa*%95g?WTRyUeBgvWLPo#Z_Z zf>(a_Ma@pg>@#ECigesSE#7p|%?z6pffP!+iH{u!)xDrCX5xjTOMU=RI4B3iH12b_D^fB}W5GKCq}bej!XU>MSfnfeQW!04r?R z%>dTtPTDHp>3T~jSCPyi*mdIpEX{ftf#xm7z`_&$pL_c0iw_M_f#d9;IXg_G-*ZDV zz4h|O$nJXZe4cLq{Hf@Up^yBRukN7RqfFfYHd;c6RmPKyh zGO+NMum8q6+PAtG@Hsg+P4E2rIXW@mXR9j;28ie-+iK|VUc0i0F@){G32fAWJ~`r-4r$TmRs&X3>LMwhLP1{lBm$S{5M zCjbbeo?B|~W4E=@t9C|%rhomj0s6wj!{*&v6ux3k_~D4jk~{wpbo`WkZkoU%5AMH#-*DTZwsKuVj%daXZO;JM|uc z$MKn2#)$E6wM2wZ?|oAMz*0KDPK}=b2k(%JM+Ezbn1_k(o{MLO_-xoBkONdt3T6vb z1+Y|-$UC4K49TpdUKG5zv|W66uF_|Vm_v)lc#9si;v7SGt39rQK#&ofi>>eR74+67 z0~DA^{#eYwvM?{aC=E}ct}(qmL2=>~odNX#Kl7qwDh%~=eITiOVGgn{3FImWGU0No zD{>B|I4}YWL^hQ&sT5V~&OVqp%x+-7QrIGB7qADw%Bh0nkd5EP$QTkI2J$rEI@AH4bdZyJWRj%#V@FN=Hnwl7=g}E64UO01Jf(^`*sWdYn09wJc z`@o^+>DbAW)ITu9hTjO}5$x61*Hb1_#lQ;QPFw@;=2X5wQ;>cZrda9+PpNEmmOZP` ze*yG?l>~64qrHRKQ)LyEY%V`B1u3Cq^UGwi3_Rk)^10~(19xDK0IZpqnq-eEu($w( zF@RN&vf#r;&l*sRKaK>r_`9&75FnRvUem8K4-oTXtu7bOERWkOd#C zD#)gg0Wp!}v4;JJ5=jQR&{qHw!OY$a+Kq(*A26_Ze85+X+nL>xOt3^yf^}gsq9>yK zl8ht|m)$)fr9{fc_6z8w~aNCqKoY7Jx;_MPYzHm7f;Rr+H#l*5p)ykqLeW z9Z4;G!~hb45r|O)nFGPZ>u6s|nQWGxeeOAW{>TwJb@~iVF=MZq+B;U#x;3lm;@!Jx z^M>`*)p?dqpFKmzPM)A-x{7x0+{N$iVE+K^z35`P_~MJHwWXD%ijXz}Y-Hd{z4BzB z@#TX29%G#3cT(!a6a)YY84O?m#$>>1sLo)!7-LJkug2HTV9nqJBwp|*DuA&kOhIfQ zG80L?_Hc^Gn&;T)ok1-8KW8(XWxp)(kHV3{==F@fd2SL0m;e{D5o5rGN#w;7O6DZb zTS=eS_rG!`1DUY=IfPkKe)0@q!|FVt_Y)vTecDuG#{iZhWz0HN29`XD3t-K8ELWBf zRsq10Y=lV20RT&k+>v2cB-{XJ&9GlG5K0zd?}x{CV`AAnuJz;;!1Lk)0}II%uz{i3 zY>j=z2J+^m=6N+L3(I3=`9K)gB;#_rX{DJORq?NFFMWyq!PK`)4Cu|2-Zsx)BgD1c>6s6P8#S5Y5h3_7j91OQ7H#}<}&FV<34!eLL8&;odg%RGCP z-B(Wk-&r^;bxplkxiyP19zUMZ$CW}TPmyRcVFL3zkAJ!$m75`JKArcP;uKV2f+G` z%bQqk7xnq$?{(9+p9!+^ymrzPZr)ZypT1*N(dp+#X6SWaJWT@=rP(lcBFy9e=C)#H z;NRWTPoKQcH9Zfu=wblYH=i1z5B{Ks2U%wiCh~bP;NSbMjno#AIS~x9-}_dVw}A66 zP~5|Q^NL3Lz|GMh%`XdJ#dqftJw5alQno+z-!>Ncd-aXa(rsTnBR*@3yxJ?WmGmF) zTvv3B{@g5G^>@OEw9wHlb1498YG$79_{VbuzqnE#$Zfv#rj^Wy3V#MC=IH8AoYG}` z_}c~A*p#Fnykl+T;{o{k(j&gNVce*PMZ^DjZ3o@FH5*yXUpaua90Vxrc@sc!i(l%?&^p2vrS?cmn~h@L+!(;sW9vARiFR$hPzeCbMO)k+7hNqB z2CyVckUW*QOR4e+lM^z4Wf{EG;N5no#SB#z;S%UL#^Smw>Uor?KZ!sswySSD-NMi? zqhOvkU1-;No~YT>mj_w^A-}`yHQPPcJ#O9p_1nwtFF_n%Re};{4mU}j#}W#!J!3n& zpi2D#<@7fB+R0EHjZT zl-@SEdY~X!DyM{kV5mp&Y|%_p8W|Xf3Bbfm*A2|#zM_B{x{AmQ{Y+K%WNzJC)+!g6 zvkh!93>Sa~AedyggTKlQo$owG&ph!U{ zTIxP~nq`3ppM9F1IdF`Qo$R9gbQxWD!%cMKP1n=SFS&uLtE(6sdH9h>=@<7uNWFc1 zY$(2O-(KqIXlEu7eDCMx%V^7%?X>sei&-AXChvs;P3HmD69Urvsz|b&_PfRlS15gSE;|R8A=jX)qe0GLCv2b>7a)QAw zNFS?GX{xKKWzq<4~Iz zCW-V3V+Q1u6<}IHwhFdMqLQks)9lLy78tT3^0Um&u%vHlYJw&v!OUj#g+X{c1Hd=5 zkH{8nkd=1vk+RLBk_sG&nrU&kheUpOsU_b%uljRq*p-a0_5uCDql|Q=%$KJ$=3W(|x{& z#>R34bLth%tqjOsviBm|zGX9w3=UG~`7Sze=nz#TA${FVHQ8zgem8B}M4L8lrp8A2 zv1PriiowJpG9vrlWd>#`d)$#{`*VcKM|nJvaXa7_#R)XzjrKeRF(#?+6oV7!v+U0# zOe{9wX8=p;mVK{g<`}pG=nU{GKRZWL_^q2PI^}qNZsvg{;FbP(X6yp-n~Y3=D*>=f zHt(~wWL}be0SovXNq0yh?#(|6VEI0Z!q?@o9^aJ#7WJ>ofWO|uA5(FTY&3{W8~wxw zuuMMa0az81P=f)ivT|>eNH(5OkMmTRRwf&JL#e-%$}bt%;}J!ZnlShzGF}()DU%NJhJi>I1(fv}v&Nhi*09JBjfsm&;C|v5bq(FU1Gv7 zM)V9=I*cm528fy}B{bHSmo-^|Q(kxYQ(I6`6i`h-Jo-7uoU4-&6t&tQ|!c|M1-cU==M_B0v{AIjT5I00I))ZWB}{kQ4FkZx-$S^xsM%JnZ>I?S(FCaP z!ROz8a~*Au$bk2;pY_q_9vIX!iXV1q09F}YwLVK87nU^w~EQ zgKYyf}B-<+V)0$6i?aBtTt1z`QzfArJ8JU$X7+9`S* zNcw*GJ8LPOC@$9<{^=Y&<;WPllNX3S@RDYF>t)5vv-?g=(r^B2mwRYL75WohQ?`O0 zdC!K(YJNcgteE+C(ZM5pKnTFH%X*tz5ys>EiWiN;&YzY%zJ?Ff)q}4;TK41k_*Rg8 zg$peW!19lZny!m`tP4{3#kG2LgAH$OB$})EXLG;OLg1GxA+!ar1uhIqnenb>gu)_` zWjN{=;`vV~tIB{KPZGd8$`UXeW#0k`4ieB;6cDmB)`7*W21ByrAM<=g-wDtp%p4yC z^8hU8`Hg|)U)gCP1>dBdb>~=R1NNMJv~SyCssg`XXroylGEmRDJ6KEh2?mjVQyQDf z+82Q>fB00NDdK~D5&{U@MzX0%IfKUj?5)Bdk$6=i16(q}0G7n$*u5872j5BMiNd0h zboS-4g)S@=-GMhCj^!WB%79!;yoiKdC9D$xH*u~7JL2`CRUCM?te;!3@3FB&U&Ggu zfKLM`uxZ%z8!6{2XndrPI!_;=bEl6`=jjtvn8?x0)C3i#CaEe@Lp%5Er7hcb(58(W zsQc_mdhFr*sps4o>g?{P1J56)vD`FW{i5sXnrpA2Yp=V8rC!6s!}RE5kI@4UK1hQ@ zL(GiYy?Zycv@|mdiU=NEY1+Jb8|~h+hrugI+?aJTJIy{w0|R~3+1W{FJI_&PXBT@~ zjf{>{Zemh?CZ`xELRLY@!5~8f6A5(&ASR!mWB>~RCKyvSkhj&;3Gh)~M(Z}Lr`4-h zQ>|tlgkM%Z4k4crHYuN)qJhC7WP89j3}E=0S>#K4WWDv zgGmPVSf)ZVG&g@OAC!~fROU9{H!-;SrMWy8#g*ObNzt9Wy~wx3}Ejl zyjk<;pCl&k24Fe4?Sd@)%!^z2Oq# zDG>{|n2kK2?;N<;J{Pz~rnps24cz=GB7O{q=*9lSmQ<|qK`RsV3x2jZiqS6)CC!e|L0*gV&L;y3|(TI%QHuUSd2 z+ErV0_@Di-m;UL|_^hK**S}$NHGScY#bDUd04%>_1iDE4P_xuWj680AQ;L;n zKYjU;XqMxH?_N)kA-W&j@zyVN61=bct`!Zwczpf;lybc9rWN$|D~bWUB?DMCZ!WdM zFYq{@iS2_vE`Swx*{Es{fLqQ1Za~D>3w7M0Yh6HJcB?A@G}-!Mv4Pcj(5UhhgICT_ zZ7W%QI4g^L&T@!xQC&Rjfo0Me92@Y7&;_E<@fE;wsQ9*1&5Kc!1$t~Bxw8c+;y)tP ze%?K`ol*wO%%8$CRLSz&?*kDlF@0?u*w5SHmGgp3F1H>`MkrMrY9Wt7raQ;Xz!E@+ zOQrH6>v{&n$n`C3kaOi2o&P;Eb~!S<*%of6VgO4!hR662aFAtG3Rp=I6v*=Yxm*T; zZ>B5d6O&*BB#@&Z_%TM41S5L9BX<&mn0Ypa$0fk9@~}1CRkzkMA1=t{5M<%sYJB1a z@1E?@-Yx6!YHIHVgxVQUpSY**t0i@5S+TGo2bNB@DoKT@Q5x(!M+cvKoSuC2VHzDC zq}=ET%}(d3wyu$`xbkY+vv(hD-?E9$cb=ff9=?w%X`0F_)9isYGha^YHf*Bx_}RD# z;XMOb2M-;jXPRk~7Hr02~8|0h>sd_z?@1Y69m8n8Swz3n1mTs$@gLg7??BpX<=X$rWjV8m?2Y!hE0xY!vt? zi9~je7C38WB?DNA$^>OI8EUAjrS{eqW@G`x%1ub7LIIE$Xl!hhCMGACbtYL=0pbdS z3ji-nwHq4h8C2wJOi$C$@DMZZCa0#vU_MdF*F=5dd%RDn6c}dkmV-PO%r(d%1;iAu zCds-tHa1E9{X>+_)X<8C2HJn|MYMb8cCL@1(NTKnkw+*um8aFKR@2r^n`pAa_}$%%O-4|FBn`A zP=T33@CWn!jRe@hy8+M&;1zzr!YTlaVMB5=9`_W|%C3SJoUwCMVrE05#)~|h2(qH! zjb;W^Uo9?=f}a9_nAev4zc=19{;si^N(pu6!0UV7uy>^KzkKAg>H8Fcp#bgQesmS!5r?gc`W3k-Kf2Sh5jjDtq$^HZk-M zp3%PodUkKmzY0=OB)Slje`a9m#+s}l)b~tfnhf{pwRy8Z*;d@YtS@k%RjI3&T)^84 zQD(BNJZxRTpqR5c>#a9R16VOjJO_ISPx#)ybwkJfw=Nl+Q{v@Z?uxjGz8=63VphgM zoFTH9{-R43;NpQ52Vf2RyBNAi3fInJq2Tg>D1UKv=R0B;SaQF+t^o(Yu`SwFdUYYaYQ$UonK(?a#)_Yoh&vW2<-od8%t zwgx=6UjAtVu!=i=DFAERN1k7_efT-_DD=O_|HsxMZ>Y}U8M^V4U?l~5taohzu!2%c zNcjxFf&uq8-?ol6H9H3XdiL@D0=@oArzuyk1&U4y5s~ZbF0QA)cvZ1q)Q5lA69M=v z{sPujRnQZERLlW&*Ru{a|3-|JTO| zeq77>V6r>tbo6y4T<*|*0sYQmXk5LB>ATD>?ag8QKT@zb){TEZe+aU&yl?9von{N@GJ4 zz4*qP=+a9rqn+C~Q_s2M^u$B=P;*0?np@k6$||WcSw-~?%~Vsrf>O0jG*g&kFyhq7 z6LjLlF=6OT<*BZ51!b#isWO2Ke;LYVYG~!k)wE{qIu6JI9zFm3VLE*L7@h9yq?2dQ zuuKrXNvJK(V#itYkX@{b0VuTp$k-U0c!Pz~+S)l_GwzOGh$(3AxU0H(USnzB_Hma`Qmr)Xq!m_|p3 zX*@SZ$&`4W!Dt=e8O8&EYGR@ehFKDh{Zw8K5Jp*d<>lRJ{CY0OZXBAen(lx2a|O8e=$p>l7FUW(a-0o23Z3WkY^&R9_nS5M-?#B zX5inIpOXHjFDdFL4-f>I1flh;Oj0tD;-LzC8`o;AtD!ZkR#JUUmVv3ssXUF1=UBFc zKze9oght258Mx$ZgPN%m!T!P=z_SHvZ*8XL6;0GoU&mS4z~aIUGerY~0}O^D z+aW-`xmhGH0$@;1=@gh;85$iKrO{lD19#3gnMhHgFiRt&IjXFzV#e0a9ouNzmd(`M zynDW9dzZTm(to*s~EuIpkB~Gk2NJsDYY@zN!K@B_hNbl?q!S> z2A2GY(Yb6q$oQlZG|furF|hc(ci0Bnz6=7gACzROWl14ea!3fk*>9z-@N5EL!4pdW zECyg4Un|^xegW(^HF7tvE|n1)qm0L2p8U#rEHufYfnI29Hse=WBS2)&(4FTvWvGV7 zElsFl4f)4QkSE zGD1Y);$5hlBD&77?=8fVO(EYW6Ke$a?V59p`%zYSb_LAlgP^51>!^oa7{KxXS6z$9 zeVrM{+DPYkYb$9>InK(;{b%zB?st}%#jDH%eFXr$?V8LT=)9Bd;z4OM2;IN>8)}qW8B_fnDg?@y`$3yn?gVxgTVe zd-dl|2UvMN))I`EoEXdL{Kmr4u**3m9>6k>A1w*qbiFtOSiie5vQsV>z`{lT^{vGj z@t~dF{n5h#hLn3lu$bT}<$esnLNP!6hE;UqmSPj@k*PU)%@8TcwPCM9#DH+$yEairT`JdyOd!ahkw4dKjb{wdxK?c2q1%J>x!zF`1sKL9Mbq8M;X z;l#MqlGh1aN(^De7s)eX){J+q&j@FP(!A-Wk`rJ9yTHC_ESss4?0DNQynOF6u$;aX zH!3>5EY>)F-B|Ak&b#)Uy6@^q*Z7^(z|JNm22s?z#Ph1sj_dkWk zwkT76vOPFv_eeHo;Z{Zmt&tu>7>{V6vnVJoc=MOwXk39SU_4S^ofxaFZ8tkWR zwwhjY)6I0r{!3}w=5^F_?ifAw$i0*-D^Ma;#ehjVQ%!5vZ>E;^HI%GdK{NRU2CdGX zJxyoMoTOnex+V)$Q`bnf^-WaY(8L)9!6Ygpu$IcGyZbzy>*}Tx@U`mhrvBkk8X6s= z5%_R{IR@4Z7;2n7QQ89L>nIcg}hS@vM=-FLo+`g{ARudj#3#z$ykGRNli z)!8&<(`g0=*>em`A?i+-;Py`QN(%>xtzV3seijH)7;qVh^SJKjftla&mx;+jp3_0-b5g0^kjO38GFo_Ok6 zI@{Gvlerx2+P00ZyZUO{w00>q1N6o8%??$^QqGWn@wUi3C=oM^$; z3V!@&Y#(oCka~4CEt!F(Ks_^HIoqq4rk9t2={m&O8Z_7+!qHBpP*oZe^Q4@Ic&}Ru}j&%WN%dsYQ7F z^37coMXz#;3gs?>OO?3jrtzf+2LMY4u;PNp5(O(GieyqTfThfl@abCgyDk{OB5JCx zq=!;&Ke%YLg(@$4A_4{ZQ*piFFJNH3 zCL|eR0P7!4D={Lb!eTmQ0D;$+#SQpk0j$qx*2BPc<=$}s*4g11y7^P_UQTW;x=-=v zuWX~&?Jf4~+4omRm?ahUDFtA?_l9PA=ZlKX;W1#o^`FnuBd0CnpfdwFO(L(ItlYoy zU)Io->oP?}cZ;4Whq;FIV{U@aakV^{<{OK4GDZKKiP*$Sj1H{Pi&cAg61B zMGJEEhAjQluNSjvzWC4(ee}nDivU>BW6C}6+CZ!8gJ9g>-#18~xEERS+)r^tA2&(` z$Ec-@sEaSDn4x4+R%KRae%XGEQb zCkCek$N%TA62SW9+cy9_M~u})BW-wG4tLEW;*Cle{MBJ#A!w6B=_iT)wiF;_i&C#C z!XQ-OlELeT@8&bF!VT>|ymwBx4s~;eyL#|H%kIlJZB5b}_otQG?~k*BV43VdsQ35? z1>e$FtK3f)`?7l~@&g1N0z~+YC*Lbjg=2KV?8*-%;Lsg?$HYC@XQKY)drEqHJK^^6 zSW`|1^D0m`ggmCUEeWLjuDnAQyQ(|Txyj@bGHqG;q)Y~2NlHGQ*gUy|{KaH&d?#)1 zAb@3?a&~?&_|dBbuJ1|zEc=)1Por!_kqL@V52R!)TVZb`0kD{bh2R6h39s+P8;2!; zTolWsC~`i0IN;PD6C2^W0I(2zfrSPC6s|=!YL@3m0E=K9Ace^x*{6%`OM`wq!c@>K zZYo)k9sUK$e8->#m`n)j5NzS^3v}wlQ9AI<6Ev9{q1@OIojrAe`|H(LUqct|y_mLd z-avg_C+V5T@28289vaW(+2j~LS$p?gN*gzCr@H2Lnw?&t!J$DqckV28cAlZ(ksGo}uopbJRc3#|$a-xVqXJ zs@E)h=~O}jZg`tjCaA2ul1=8PV3IyN&y1|bhI(4FYL!U*venevKR})5y6L%t2kG?5 z6XM;KPEm7n6ZZ?q{s4f2aRt+R09w)?h&`bss~RXNl|m}c1@g7z|G(M+ak4h+QwqKWYwO~Lq`vl>DXBWxG2$M9le z%tEF?)OA%R&443kuT#Tu0Eh)Jz98?MnO4(l^hY3S3p6u5%|Sl;Ch8IZ7K3(`kQkzD zc@Mw>5Q*!|!1N!#;n4+#TSWx}E6D`B$Eum_X5=!M&+pj2gR*t?bo2xg0CZD-UmtDX zyqT`O>PnUpu3fjzO9o(UDI3q20i{`B1=!LJ43l>&P$yu9vUGKf=keXi9&1Z6&l}4d zx@<)+10DV)Af-Q_@J0ul?gK2E6<`qHB>*gy4?;F50E_@w%phVALp`w6`^sbb>V}K} z_r`dV{>~sQK=twpIbY{G1F!&ILB7Zt5W%9AqF z6@X@1Ww1wCRI-tPF&U%DJWB-uh%y5U$q^KsW$!DN5BgdD43?4KE-P8)Xz{Z|9V08B zfPLuS0POf@Rx=jj`&o<)>RD)#ahn?wk~D+;4LuWglRt`IVuB^QGM~ttgE3tJEX`WW zo?8lFNun6EuVlfUDhPl$J%e(goIw_r%#}WXW%DriNzL-;GxQX|QYolRxIuq6$eG0s zK>$zdr#^sXiBihIz*+>rT6~)^cHvekD8qN9aHvw>X>WDzyZnWJ2&>_1Ee*gj=9c@| z;Z<%_>B}gRNmUBK(p%ic*$bl>SYg>r@!}E;tVjUsd))*EmURwq5#}>}y$AGnOM|=K z-tJ}~ZuK)DxDo+tp{O9&7GrLW;z`~g17O|y4-pKRFlESJPI{M(1+cVmA9{JTgzy!g zJ?VkN{^oFL0P9dsei2`&;@1XOL?*&_Usnt`K@J#~;V%xrf)wu)uU#4We*UlT_t3wB zRmhJKLrHMD6NZu>{oY2;06g}ke*wOL9PO6RiA>aQJo&#U01Lq0-oHHRcg~0)JY1|> zch}O#ZZGz8`pcj6(dQo=@&-<=o#0p%Gu(XV?Q3awd(g=J!T>D)265xy@<%+s2H=79 z=1c16_C2*lSp_eo`3%6~y7HrXzEm85^*i4@?|?{F%b_OM$=dzvKfP%sUAZo3{C{F# znqKy~V!-pyZ)v4F_7;0)z2?iE^lZ25v9|Qud|?2rrQh#D+QaKJ{2s`=?cUK1&coxe zu0?{I4Y8B4d=dQGzf&oRUfgp9mKzSfGux#g^Jwk*fWc|S3 z95Y)0htuyA#9Imn04({d#};=Q-hU)pMr%jWXVx>lcfd1=XFn_i3Mx-me=Ph>vR(<> zLbe4}3N$yX9zcGu;RQjG1BdH_ch!~Y#m#|Ez;Zq?u!PCNrn|GqEGtqL3CaXmg4_i% z7z4zt>q{UgOba}Rcxp+&BlRQq1=C1|6k`oaki&orZfm>A5E#rnAQn(aF>2XkciRSxYaz z>7}&)k}GJ##w|3rP|ngX0kF<8LkWS^s@3bLx~7h0dR^T;boBU18X6v@v0RQCn*eN8 zvjO+{-XS`A{1o-}57T5m&mcy1O_o8M>P(u!jph}Nw0_+>YHMqwdPvaVFSS4nLc!eq zTz5AO505ZQ3Gz1pMgX)RQ-q29Tw#*7Y+Ot0S9dT22(m;lTIw4bXwB-i)YRBW^|kdL z0~kF50L<{{2pvBBJl+4`{nX#z$ENH6(f~rC9JSdhszgA&0G}dk*g<{;FH+=($V85sK2*|L9~Xt8g9GEsT>Ut4baSVp4ngk z?7-OLEQC}}DM&K2HB?<&M~P$=l~*P`LwgvV=clF^1VJCDO2Nk}McHhIhKB}eV4$Cd z1_x+#bd2SG=%eK@Ua!hf3bMsaHDxjx?yJbs2wy5NwZM7Tu?^YZWa!omabP$pupE$e>oGRFyFO#`Uc0j8poH1pdmhOZEWka)n@GkH zFt5=53}PvO1=$-*`Zx=n05B}|Ge0CVAy;1~+aTe4c+5>7OkwsAq{uwpaEd&U5(2Q) z>jESLfCBj<04(^)!BpJ*u>dZzni`&f$|~~eNv0|VLu}5nInhk-Z4*O)AiNJr06)km zsK6A)FJtr}<0v)*B%uaCE*bkU4*H2Zbk5LC2H6Zy3B0kLlzD~v28adF2z3cy5YLC_ z7V~tN>I-1UGE?0pLVfW)IXQ=HVlarNazh5#Ocsr?Tfr*>m3`X+%NQt9Py-IR9LO{Y z088bA*5H56G800Ftjxb1Dp!9GIP#bcgf$qIo-*kX*)`?l+_tg zH-nhD&Hz@4RoI0uwWAm}`cg%%HtkNK#fSHl7haO^?V{J?WmHv3u@b_sdlJG$^#`$Q z=?ep}%IL1&*-%14=z?bv09LjXfHk&geB=f=ZVULko^BQ!KTs;7=kqE^cbOya8qN$@ zM(=ycibw|5ZJ!qaD-yGc_@iMoi!!iE0a%Kf@}kj+5aSqFpS*8?@Uzs9t=Hdjc>{gm z=3?2?)gM1b{khr5%S8cLdH547Kz60Owa%GeeQcOuRPL?3wQWk36>sGO@7YYPHOpt{ zEVT~oII!1V{7Kh1-yhtf0Ic5eS-Se;$Cm|Q{o1~I`p7HWii-Bf-|Znt7?+g!G*p3K ze$y(tc4LrH<^ot={O1hZe)u0ZUd99c(IcWe1_Y0Q1n)i9ui&hFlE(do`2fIrqEjVw zO9Zf9`T0&d+7G{s5+9Gw;dj-~ysn*Y+7hf|_|(1RGiQP*4H13(wl;dz&SL58^`AOJ z$acBdr?|a{mJVROaP_-bIUOpH-y=iaz%NaNmyy$Ek+4qWgy|m{i*H4;Zc9H+@lwPE z;9PLbt|I|J+$TI|MIYzFE$*^P2S#_wcc)v2vEyAg)MsPM#sF4|-Utby?t_}rVFF!J`dJ;o5iS<*J`v$%qLrYCsEr>F6c%h5fN;3#x z6+JeyD0Ju9{4Dgh`AFH7iZ{rdeOE~H6fO}kMVJTvj*^GbI-{`uL&&D?%QIAFy1opf_+1&nB735d5oulx7PwPaFi^!f+CX zmIq*Qe-P;pyo1a`1_2!cKA=bbIU+fM^sEa0NKT4*mU*bZ43~`oF=2f%152NWGa0f0 zy!2}PSXM*^u~gOqk1Y%4I0bwe%D+IvL;W<^bCx<D4pv*PYq4Yv}WA~ z+Orb?Ru>(7`Y}3s;3+!r{4wh6>ZP)Z6y5Ub+v%EXuA}WccCu`1V6dP1`g*Cazn6WY zrX~vvgrM*D5023JzJBUD-^;<*%={cRHZ^eeH?XmK`iAM$sV*8DFE9vGS69p5*Ve&2 zy_TAr8mYOdfk7iME!a34^;KR$#&(Yw>DEng7*EO*5I)c7&Nc4tB*sp1>FhOhD zo2a9uks4~iOiFV-HZ(L)NBb&jUeQ8LjVm~dAS8gOcVx;tboh|`963aD3v&!4)z#K9 zTZmb0G)J?ANt!QA(hSVe%PJU5f|+=xI!no_G`IT*16WDgykQ-!?&zTA);4mpsH*QOEjCBnkidT!v^`r zo|pp*hYjNM3|MBtW@9N~1)V&3l8zrgMx&#nY!)x9Bly2na#>RV-ZEJ+ZdWNIz@WKV zkvFp!6HCWt7-Zs1kJ&UODxmX>u~hb;_pMW#j=C0Jhj@KcA=E3fS*>rB3!tSYl3|m1V~Ym?DR+a*EDChi^JJ~kPt7tx z{NQ8~m-*e(8+nU3!5Zu^-niQQfd@m|OQn{B;mN)9B0Vm^3M_adz%vIQSaj{a_yNVG z@P~}x*;SS0^w=L4``CQ=hd~c4+Yj^4j$OhBZV(S(g}?+mOCzXA0Lx`=MOK15_lhh$ zu!?0b?_&m5X#mTQYy9Ba{-#Sl+u#p)m-yh716Vmb*M5`xoj)|@awlW}Yfq3t0SO@h zEPtSO9$uTei2m;l>W0MosJuxvaFtRFEdMUS$wC0E4Mi>R{yWdpzds`kx5YjNtl_vf z{-?(jq>SMY0IY$W(9FZ1C;$st`7qejrGqBrIQIu;$4Qw003ZNKL_t)C#_7HP-X+qM zrFC82!FcGsn~O5KE%s~|^8LxdX}bB-QL;^ zzW=Ts`sP!9yG2(|^k2X7>#OPNkR(z7tijk2+Z~JIA*|wNS{^)7Mm4E&`qGw*T(- zHo9d;b>I*Nus(}1A-K8l@mpIX0jwK8bC%8wW1+g((-(gq4PbTuKk&dRmS>hKy(|v& zh(NWJ2C$;9>GZa^4TA8Ai-A{>9XR3*2mnU7iF=GbpaZ}a6~p;MVBRS?KFD=#jw)3);Uuk1Wm3WCmIa8ga%!lOeLX zuKAP5PAYcT#Rtm=rhJ2VrSp4jZ~xZ$RR1ng2@4p+=$lQ=9Ya>BOTR9>eOvEu#=7!f z&M<&w*Tda|>yhv)ZJsCo%b*aLwys|eyM0_+76VxR#+}GJ1PDag%twe>R=n#iY$gmX=27r~KBZr=50IMRAWPk-G*h4*Cbm*BU==o=#qGt{qrsJnNX^s+f z`)lu@8*aFPcJJQ9Wds8&H!;qc=vD?6yAWd*ggG&4I2ET8eQQ5qZ^p!3~bT>t58mV@${ zg#~6L0aRMKY853alhoVSPiN0{(W%pCXk>JZ^0^VpB+99}s)8Epsu_5}H5=;dskym@ zR&}hV)vMM}eSIT)ZGl;G=ImMe(NBL&Cr_WGnb~P->u94*8#ge=0onW}#>Z#^epq88 zRG1iN)(@nEmB|#BC!NXCik23tt*_@kQIp9~M_U`UHm{(@re^xZLl4srfBaMSa!MzY z%ru*uo~ARWPf&k<4~>ltQCXR^HyC61jW?{kB1!3N4f~6&SkXd_O-Kz=Wo`E5no-bn)_pKW@(nSEUwr!)WTefhv%5*y8fmJSO z<$;2lq=Cm3P6~kW*_fMnQh?#=s~5A5aT(C!h2?u>ne0pP2Td9x>|OvnJcc;(K?Yl> zOl4&%b5pq+Fi!DPlo8oBM`ZpGb`O^rAeD{_EN4?tg@Hev7Wha80%fBDBOit`u#?#M ze;R&r)8e59kOyY+?9GHR4`ZRQl!T=#YX$ZaGhj={YD;Khn>6Cl5`7h5J^Gmd+st?ZFk~`4Wyl(9)&MMT$)R#Zo|PD@5dce`Qvf>yu>c-T zu?H1cP&4dH#dEc{86-(Gc%y=)j55yKZ!oa1X@TS*csIq<3uTq|F!ndf0iQXUI{;7- zw>3Pv*nf-xLzOnNk-Kf zs6_x+(SgzO!X@t^+(n{y318P3y;yb@AXPt*u))K)?5?!Vu)`k z1%-q#f=Tt%i0^@A>#R_@?utAQ-dV+&x59OLp#YXw1Sb%2K`R?@WC5u`g$q(?1R&q| z-V#x=5|0@bin`u+b2NZ;`xinCEL}AF&#o=(G>cr?S1~xzST|t`0J~SvKr!kUwdMN{x`hWmeO^(Vi)KqzqgUrHU_1v z_~!4I!88l^&zrVX(~dR)RsQkOVH(TN(cr`!{mbKi(ggRMcmT@*yp}KwylPi1ef|v?U^z%AwnD4bIagPAb>$r2d-Xz9{p`KZzW3bw?t8CVmU&vGs($z0 zb5B0|eCONWej+!b;^&^3#Gf2?#l`bikA)7H4F1D^+<;wyE`<33tbB9e`oAwwSnJZ4 zpX$IneC#m$9b|M+bUt#eJ3E#_-&7iX((in0}&@$uWTxKYvE2m?W%QK4Mbz0$~r8j@bYE@l8YAeoj;SOU(vZ554kZt|$EW_sB^DRs_k z^<NX7xw-u>AAsdBBow66Q0pe& zPTBZ0-RMWLtBCYTA&r^#WB@BGn=5r8{QFzv_;*%(P zmuwKl{YRKoPBbd>JZ)qM#G(xh*MZrvYP2yS3Ah^@1>|VMCK@UNNV47xfnucuZW%X1 z<3hs>3$v*rD1k)WOIZZD1Qp>DG}J^<5eE9spT@}87`x|@u=(cR4VW4q#hH`Gas0?@ zc>T>&=<6TCT4@9ye(EE5;DP&bm@I&Cy*u*4e<`$4#P9qYH zGB`x*8fh<0&CFnSo(^njBNsv>O3?$G(bd_7wzd|uwUSnqw2J8L2z#bvZ55%?64X{# zvHKsfrO4fhKqLB{PG>MVHHnLt`Y>>92ty-de66}7f|?5XT}j$n6!nfH1B&2#YjZ2V zd-J9(XlZL@ZLV_{FW|Z7o@3yrt-S?p?XBo+Z^iuF4CZF0u(&|r)dG?PUZs-Ejv~N@ z03eM%NB|Z^x}&t)+d9zF)XeNAip==J%ZKs3XP!l6O$|rRqsVHc)zyFb66WTnkjbQ2 zyNcRFXHOAZ7B@u_$M5Ry;mD4iUELCmjP!X3NFk<9Ce1(;38artjN{U!i|D)DhpPiu z1(-D;sA#THpQZj;*eJ8}LNP;|z+x;j)>RWe9Hb+oWBkL5%H*>svCED|tE@1_1Qx3Gk{#W)N0lQ=ztWu0Bv zws|x5?b(AHci)KSmKM}j*P3}%fV~xnAi1)Tblzof%VuCXBJDDt%e?P0xpY1fT|am4 zW$Rqe-2~WlI1bWg1hD$1d#(0 znEGS@i$Sb4j`k?PUD^?|m*|kIT;E(>W-Vg(SY^Tzz{@U>qDRQlZ0W}V+ca9Di9$;t zxw;QB+s+{eDS&v*d{#;k6;ul~DSHd!z2r9lJ&QgjSkUUeOxk z70hN}6=DGR%`cnEetX zvfb#+z-kU;U_J5WYYz1`sMuaWOwCx=K6b$@Z^!tJceUcf`@90`#O`?Hk9>Me)=NoH z`nx|Q1IspopW0uShk@0{3@q0acQf(1$J_DvjR8>zKi`LU?-H%2pkDd=FH8yeRBSMs zSAFf@Z@}Izul^7%Qa69@A_E;i+K-e#04#4=nSu3t!HlhZdAe<51-|kVxgzcaqJ8$e z6K|;~FaE-&oQR4x1ItUYy`H(Oz`g58=Aj)`_=6ARf^}3#a;5vzS7-6flZ&}+=yUnK zXGDJ3qR_jXYxyP_d8cPtu$E>! zN1ogj1o}*xRvqQCue?B!-0BC#9;0J9C%SryLPnY6(koOWRaj?Ytiakb(g$?MapxtQaym zvyr_y)J>uD+p&G5>-g`L2!pCUqpm@QMPW9W^je8RNv?z6QUpj~Ji7|ejbe?*;J25dfhO?(n z;nkO4!i$IBK;M;Nl$2NE-~H52T|aKr9wPGL^)Iix+X~>=~RncMg61S6Q2i zm<%LXPM||WeFLVZrZF%$#NZOKV>a||LT_&`Hg4=?F?A9-Z)$8nV_hxA$44}Zt$s$sxIe(I?A--Lky#DDBcq?ZmAu_eNI2d9Zom-B?2O_UY>LCpd;QqtUji5e-0RfI5e9Omi+V4axP67<%O;sEUSA z6%C`NGR6@xsm%$%(&(QuXA1+Xq*R$$MkJkM=9-Uj;nx{f)(&G+n7`>?1hz7OWy+T( z0BHpb&Qa7yai7evn7u@YTt(KDLzYUzh9w4;f>->T04!o=iO{?-#RLGN$b>5Fu69J4 zB2JomcHBi7yb^a!2CxV~%Sw9_2+c%HJ$$mtr)!nlzol=;X{YvYwKWXEMCe&&anf4z zukA*g(QzSk*Dx<_KF2JOce~4fo*T?^sLAFr6@wnu(d0eNEpVqbW(%h0^rr&5_4NZ- zR)wu6Z|0t23@kOD{LtDD17J0>2G;et5UTB%172CtXskm;?`fm8B@G6!ycMQp^`CT7 zqAcPb;6nJsmj~R#+MN3LMnsZn+B)2|CUD2_Gk<*MU9I@gbpu#oeD~*ib8>M#E`*K& zxke1E0svM#4}e7stULe~W$a^z8u3f_=DKmwwcmVt9A7!2Y^Qu1SgD}jeos3-aI+UY zqVJ#j%WI%Wg!wNeu-w%0iMTremLG`lRk6EemP)uD0PDTGs`0-b&vg_1@@sSW?H^2E$ILCa5-t1O zujaZ7=Vf61o3N>Zieay~L7m5~Wbay2prf%hVmHn@J7vM!TtFzO6z-$BfK*|!SP=lr z4pHPuD9BQ=Al4kFvE+K)2Y;L`aUG-21LQ(@AS$dDW9=#6p(!hvWb0qq0F$_`iQAyM zMetjUAt<1PG@YZTWu1x&1B*74s%s%9*YZAn&NVV+3uGc!*?^Xr9;Jw8qvV;*6})l* zEUpU^l}evcW)jz{Gk)A>osED=+XcS76Ne-CYMl&onhpcY7~M8ODqy_k$PwrPo*vri znqce9s16pnN^$#`5cRy-F+LpDSmHcsoAG8!dX+}&QUP@au(&Epj1GwnVChpDrO~Z? z-Zb$B&A6I4;onS)>9T9i8ZCZbD0a9qOtoSlfxfK>|xgMuyRUr5{I*9>wJ= z{g_`|e1ZVj`r3T5L<}qWR-N8SmUgeb)_nzF=jof@ zG%odBVqL16cHe+-s0^9qC5(*>V0?4{OY^fx5J)G;6}zVL=5R$=X5?Z-E`?2v&A9iz z`>}7|E!enW3(CvF3}78UbrNqLKaR@kDs~k-e~zLNUc%V;D6-i!v!E!F8Fc`5E6%PW zOCr+gG)MmbfZ^(qFh zUB%Gg5WA96gOht=I6?yNw2OGBAhofw+g$*=+BuoOWhM$FKTrSsq_l7lt>qg04$D{M*tjySmJ)k z^<@7c=@}TtvA(m4Ri(EWdk&%3UUlgp#Mt@*!)E+6oHLYTq-fxCLSf z*yxr;*M99E_9Er73t<>odex@J=QTWCm?d~Srw{rJ3b*^3V(IC6@IE4tfmOs94o=DY zt$kkQzrQemHJ3m6!g~bgx%B{8?uN~6lyCnK46KIAGQ9AMTXXXMsec^BKb#8EXe#6m z=;ldKWMgJqf2gTx4^A^51*w;qj&DkBH9CFsDUL$u1x!c-ix^lo&CtW*uudeM(@Fi# zC;#$q3t$!Oyj+o#-=_}Lu@;yAbLb0w1w`Bn16Y*Se`Das%PynuY2x^$Z;s%f&MX!f zK2lRZw!aR)8KBSghc8XzfBws4f#>bA2X7L+R&@TP-W~u;^7GO!ZbDm)SCpRW_meb$@!Z-(K4in4Xkhz^!gyMY> zqjg#{?{!OMgJtU*i5i`cOJb;Sx;dme6ws+mqKdI-yP!b?Vvw(ziYn{QP(V$!=;dz( zo~WM4Rgc`ygpmc_P%tp&*gK}Sc|Z#TL#~-C2S(UdblNYQBxYiZ!1P=Kp=dSUaqk1zwqrX-p*wT#ES`Dx8C)A2 z!o<`hs;a9IiB&NBinMVk65w)@T)~!6Sy73anmX2QYHlUBy>13I$eoRZ#Rsnq04o_5 zY$gyZR#k(><~Fpnb)sj(Ml{scpq!<^Wjjq8Ni(z4IC<&>PMkc6V<%3q>sez{6S{lI zC9oIOHPsAu5%9upX6clP&{u}$rY7|C^m0VMNGOJy+In`Ydgb-kaQf^SjE#?>x-!ZP zu5>Da>B&({j*nn!a+F;N2}ojQURgPVBdq^K?o%lOUDB)@MQPuE|ARPm=x*F}(_U1> zs+mo6<=Qp$U%7&CG>YZrCA{#$zu@%g6PTTy<~~I_Pc&|*E3k_YgG|D{V&+$dYPb|P z@7;@g?!6B?cHDqX8+us$oIotPhurB>sWiJ(zH#&@1_rOOn`neUfM|q4J?b+YHIP^( zh7m=KpPr2y(bKa5Jw4rMBQ3A$YTj%UFcvBg@v{U(rIwd*`0&d(bLI@@=4M&njF?%> z&I*ad1%Z3i&aEwN*x1|4^-S|vGMUC=e3=2NmCQ1lo9fU|SIr1ECf<)Nmg3Kh{PGsFn+AW&_3W(qUY)0ml?#mwA1rf23DNFhep8UYjOEE0BxolCF?IV+r z%LwHw3O-m<56w*+budlB`J|2KvZI{&hSw}{>tU8H_M@g9?+=! zJh{Iz99L4pV0J~gjDbx8uskk=#55)GcGi-j0|v#~WM$;mqh-y2F*>E&CJqDq#uZ!H zSahB0OT_R^6hd|*1eQreJ+p!YjX`B$5s1Ygo%98>{5Tq13SyCKH;K_R14}iq7{D^_ zgzD;TGqKGffB;znXptV5M0^yGml2!%c5<=JfPVww<}et%a?=w4E0;wf z8d!7QeMnFyT}xL-p{IJ@8k4F7KMa6X6D`BxU&;lrKJ(9G`1?_mSP6Q-xPj%j9z4Yy5V14Qz$MB6p zBJNf=s*eB-R{>OY{9b^m+;J`CCnyl8g%f? za(w_+;kn{-?`_M8a!GIf+%r=i9W1jh6=YyNx~m$$_r8vtOe=t;7Ybuk#pbp`vu*IT z=BhHh^2uD*(8sB`vKJJ|(Ekw;_vJwM;JhO4egMlcTnd*l z7{JN|YG6@H&wpYAI%{(yXR;2~u&vuw;Js!-{H=$Z@MHUOHMN2PES>N?5YhEFpe)$| z&)KtOvFn9~W05}Rzno`r&RfcyR3m;3 zN82^A=;$@mpg!~9Hez6j239_1M|R)<03ZNKL_t&rmaRV}0G8q$V$eGbEOqrWSc!sN zya7@d5Cc+(dxwBw%)T-kBFCV&3`=EUsgbOk00GimS3s_QbAYPu1ln%w_(p{`hP`%a z2aM879)@d>^{B?Ny1uDfqr1V=^~c%t_!tKYg1PPH>TLz-bNUA!)vL*c2YloD_C!Uo zT@}ckkMw>hJiOUN**+BZOl#MXv+#&8Jh7Y@m}1rq2`<~zSuyshT^K+rBVlb3Gj`Zl zMpujI2h19%uM&LF7>B8nTIb zEX|A|IX{Ku!YmH%+k@RZx3OE??94Qx(J-oOs?gL>hxwTa3|zU4WPBd+Df6fC6;;P90^BISy{#ITAMa+=16`N{f*j) zL)G&}jMya^)KtXKR9Azh`dZZ1H6m77gNn*(R8&;*hPIT1%EdbqL&Nm$%Q$lM2+p26 zhlRx@j-t0^b1#}2Ynic80@8(AL7G@m%Sj~S2?lkj4x5^rv1!vbY}~jF8#Zo5c__y2 zf3F^S4QJ1vV=$>Q7RJV&PAo0VVt8->qa#C@m>3lya}v)tV%RiqP#e=Goqh;_nVg(r z;N|YS@8O@j?!1Rx|AbwXz#F8p+mQ0C7VVzO}bIb!gwhu!==7Hynf^jJpaOrc=?rA z5Q)W@$r7Uog5h#51KmsYLaZ|SX=!amM`ssy@7|5xjT=}*ow`zLIVJ9iWfG8RX(^8H zegAtndGZvyBGOnUW*4&p%SxHuMr}>tWmPprm~3LU7}W#mg;5r%pCl6tsIG{jl36xk z9y^pafp!eAv0G-E!9l8D(p9UdAn|??|!{uZ$A#~JBV9vxdj~^9i)CGF2Ow6n!s#EM^AtkmjUH~PIRb!GG~9qdGJn%7DD%3w6B@U42VAlu z-#YoyxzA$sTCVK&0gVW+OMdiKdWhm`DwXgUCZX|VW+$bQBmj#dVw&-t&WN6q0AxI+Cxen5I47`~!Li<6E znrHwco=1!ZmWa8N8?5}+pdcI()VLB7z$pNhfSAf>_PG1gx5j-{4%6JjChelS++KR z#lSLo%*jW=G9ggQ>hF%t;WtT4JMZU*0kB9kvlOrYaxQ@NCofOq_nx21Uj&;vy0lo_|${Vc>kWzp(_J zL*n3ux_%9;5{L#?t_vXnSl>K3U&QIm=ai-{gzE;dq#Xa_vG$?>7TrgE;j90y2Rm9L zIqgo=`Jec!K^E~YG`{}kr#9d~w^s*??*IIAQ}}}yZMQ662MMT&|MOHA?l!{WL_vPz zS_0oYzl3j}U0@-1=VJ}){2EwSoK0YX0(dUnxv2tw@#9@Nx6d!H;NIWAf`w&wgJ8Bu zzI&zqX$||%&u+w)<{*LlX?*boQ!i$hAKd$jZhx(J7rNIw2X1N%<9i?9kW6S4Mp0&tI<{HRX8bx ziKC6hE-PlE!C;pHW_pS(0G0w-PS4bhf^myeqn#Vs=pwo7D|1R~>dtHf3QhxbtJ`H12}xLEREp;4%D8sU6l=~ z9-Yf!pj$G2$XNDlzOM>sK}-)B*51v4<8EQtbPPg~juC^G2Ebys5pt4|{=#iRc{3sG zHA0y%;^c&0KsnhUvkM$Cu1W|<6TK_dR-qGrf)-dqhBjsdG*I1?m4R&P?9wb2CWf#y zJ%ah^3EXx2t=NC_jTjjmU^g#GTKR3q$?F1MQ8zUO4KpnaAwX~vlV=uOB*}{w&V#^Q+Lu?J& z1g@2cC^Ko@RL3G{sHsAAO&!9a7($^413lz2M8FHz2Uc8B zu@i5i@5*H);)^VH-&9wPiLqhy^p!n5e_zs$_3SVaW`pTc#N54Zmc z*iA9ML{az_v1Q9f+;Z>$o_PFmJow-{kxayqN+poZNL0jFv;xh~X zr|%;aDMKV0Mny#wktjtUBv(KZMbA0_7BT6Xn_F@4mV?-_V>?HL3`as(A#Ez5g)*CI zVQC4^Jo_&=aq1Me=gMl9T^|KFUt_mM`KjW_fb`SQ(2VwuPG+Z(t7n`6EUIe?YEa7h zM%3Sv2@=OApm3FeQ3B{~7~1H13lb0n+ zfH$*#GJr+FCIFrzqM=fbKv)?m=XRyPqhX4CNiKu}+>_1}2f{E+4qgqFX{+PL0FwI7 z901GlyOU^(#Bk*3g9gOPtU&%=5ixfKua?s*3}6wkMdMngauLO+Iaq|;jXPnfNMBIU z0~#X|OhE`h;87te+#D>=th{=yfM4O0_Kkwsq@{q z23~CQGO+#)0IYnBwS3I2&-$Ve2JJ1VhL8NpRvwi0hs4Pr`;#liJ;1b=-k`>~Wt3~D z+1wOHb5+Pp1?GVg;P_CI2bx|`Bhvx4%&lU$dBH>%e3F5vpHDs5g!c!z5dPUU7Y5qDA6AeSHMaURnx%(5gYg0El_@69;pF1?oa1 zntyrP%7YQBq$Ga(-K}{<+^-+NqMr7H|I~{O4bq?O&+~n8eC%r@phbkcY!DP_y6Ugq z-;AHREw?Q6oS%VZ*DK982N?|X&Vyr%SzP8ekOkZO37RwW&3$WVtSrN8|2da|^_iz9 z@s&3SlrOw{r*Xf#ErP%K$xarx4Eh8DSmxFb?jaHPT-~gDzvKc~9FDsf)N8=!FFp|@ z;+~&@)m0Z_;E7J0{GTtpFpK~Fk{#_bxE`t8fBs}U4)#d2O#i1afE83{*SnS$K%6)! ze|m0xI%}wnCtnYMWhd`>Zk=VwbDIl7SO8YQz0OzpjETJ2$j|>S@Q4MD1U9ujd@bND zPsaTizRrxMEDvrEZ> zfNTMG2fSiEEHU);y1El8_T(N483vY6w`X(P#lZiEaA!ep8@qx50mhs&uH zb+h?W5i}cmZ`KHWnVp)z)YvH2vKa;&2!N@osAdqXwY3G^-QDaWnaV6P&~)_p8=OVdav1i)HaT0$ZoM>-{1Le$g9Eh~{&!M+1`;+}WD8$BDhqp_(0 z{R3ApJ~_^!;;Y$ZtY(&R`O-O@IDQP{6B8_kP7EN@&=QxOHFo1+v2Bw+F{S3_<{79Y zvGD!-58&pT_oAw*hTRL3%PA};DOz6{;)zAPcH~tYJN^dFoIQiZrDX;ZxsPc;0d8kv zOA&Bdiqvuji;Hn=*|Gr#5A4H(58RL2Z@(1-SNkze46#fW;V?yitmpfNN5}A;r+8-*U^X*mLtu*uH%$*G)7M;b?@ZM3Va` zm4k%)&z?Jvv**uaYI+LUY=&7(tY<{fXK5+Ay1LNX*1>}AwRH{bMo8cj^%Dj!Rx&83 zsEd?05F3o58qPAKirha#6nQQZW>AVWe~9TrnoraY^>uYG81+Wq}m;w)SkfQ7@Gyhl#>a?zFkBXy< zOQ9T+xFCj1q0ai^uz^)~QC!$%ol!X(SJp;eYk+kEK$#UpjLH=QUDs1( z`!biy+^wSZ%yHBO%&dpRz*4O#VOJ4wL;wbqW~8DrumG1Xs##r8G)2EAF{TV0j;S0vIiaBPO7diexPah;kWN`3>%T&;8aq04&Po-~IGP>Yt;Krhc$#j{NnTTolY8PU%3 zj01m&+bd)TRdqZ`q{LEf&f;)W`thL46FhGmb|_A zM~lEB?(fPKo<8)2w+FzYoa|_c;Hy7HCx%{7ldg>}WbvUtAHdjxL2m4c*8Kg~Khcd_ zHdN#kiYC4Yv8FUt38P1+dmz;pPqR z*VMejri#8xsmSl-n;-7fUf!wp8rHH`1yCo z7w})c?T>_Lzu!O6&^7a&v-ffDKm5sFv{ZQk%Ym5;9{WFoSW3AIj~OwZVjk+P!0*4W z4K>l+zM?n2bpXpmQsRX2j1u#;UR@V}Wo=X`<^TGwCOo+}cg~_~1Y&*Z~!qE3$b5|bFDe!rVO-0vpYsz0XNkzJ+FtDE5X8A`lN%b`Wf;q-QE-ddQ*2ba?uE|DH`~@SPsj#Bz%Gybpt>QNTQxn6Lgnah z`A<;I`l{=~RmaRPJmX^?!B zLvA(fOK#h;5Nk@YK2K^HTekFK|GqsqbjK~Y>82ZTrN1Aeqa(~VBQf^6x(1$V5{VSP z|AXi7gCD%;_)(RH$lb4u-3SRta9Dn8Ys^3)x6Rvczk{PN-mq&28X9W3_YhaoJH6vnjmYIt*s&wiLi@mG!|oVcy^~V^J`62HCkF)*iDfDw&|%U?u#^j zXao|Qip1Rspk+F zL3DS%q{x7xg=aHU2-NWFXX$+6q^EY0aUrBSW7jYOdyMXtOt^-VC+7tGao;b0Df>#@ z(&a!!7(Ak(Wq>L3tTMCcx9hg(&Z911VOD5919066MTp&ixW=_jSV;u*7{T)t37`v8 zNi+i`4+H{AgjN$2gY~Z{Kn0jtN&prC(lG+C4Eu^S^2oiAekfWeM{+HbKpV`FGlxIA z*Hq@JS>?E|^ZWFG#U@;^ei)4VAh|?lrQTLcSig&|Q5iTAAOToe5q4*Aj@(^WB*LT| zJh*eZ=z59!vq&!*1{MQwG;b3)EqDgCxwtQyD1`ie5$6|HwzMbfWpdO@qpfMmp=*uZ zSJWcXHQ(toK48c6AY+~=W+3gZ2Q~cL^(=JO{E}^-e${Kv=CfCe+Ob7%2($t7e<^;o zML#*O&G(S0kbDWQ2fzxdLBBQQPv6Q;ULfjevtiGZ^|uUQnY#J8I~(zHcQpl;yl*On zXD%#(bc_h8rjFiJRgUR+7T-LvU^D z73~v6Za6u-j3@uXA8Bq4zwt;bKI{`ZC#KpXe|$BMlPo}hOdx>uZE_)8@VN2h-OZUL zf%^N86u{z1Kqd%s-TRXdcLXw1i2d{7zr2R|q=FmXmfP46#y5X@1F9mypa!|%y>K~> zvtucC1*AE$qqZCex+`$&#tJ8dx4)SPoP7764p^Xyb%)8q^#NEGuoK)fxn2MABb~UT zHy4njM=1YaKQWJ2t|l-tPud7TOLZCcb;a<3JvE@ZDD-gwtlYj%?4aj=eq+w#xd2ws z#2}_kaG$d7|JU~Z%tOui$bsDGk*7ve`1S8h;Phz9lLtz9Usn`AexMc<$*P3FbMP9}P*H||{+TW`RSGl0|LL1b=g6Yu6uN3#*>|&B2}X-95;0@$YPh# zPKw&%fo)+txsNok3?0cD&$1y<)6Tf^7&k)agxYi`+x?F*3)2(z1fGpQ=SvgfoD5PG zfY;Mi1+WZ20_p?G;and4${JMw6i<|%(zfmC(PcBq{}kPVPVlTh9Twl5o5eN zE`{!pc0oDUu-DB$-6hN!`EWUn0IuEZr5{jX34o#v7`cn_6a2&PFxo5tBSGB0uA3rl zV92*;)nO6v-{daH`d1QxP_$IYMaopBu`^26vIrrIaOo<_*D?sNCb6}<85>$_Fg<#W z1+}Yc>QG%%&*JCvvr`xx=*RJ6Z{Up+XRx@OL7a4KO3HadMVdCGJ2g#W+ld5&4L99% z6L#&|g-yM^3{DUWi3GwaE3K_<=OWYOrzH6>h58;wZUtHxOnj*jvYIWndyX3=m(z@4lM>tgTx&qdZiKxtSTB3yD=l;3Bc_nwnd%u(XKpeCKJ_+M;q$9T3n+ zBJbJs3K|;g*llp|n5p%0wTke~O$);Alf#J+u1eX6G1aTwEmg)+GDWlBj$IiTSUru*)kk=}4oD z00-(1q$k$V){cAbdIxU1^)?(haFCzTdD&&PSO@(oaLsEyK@=q})6xKfI(EfXIM?M^ zwF@~30$>aSivc>-ymA=7ddMJvw9FQ+9m6w+0poRDlAs{2s5?gkWB|)V#HB+Q6S+`< z5tl`*Li7eW;|WUEWdhIjeR60c>?;8li9JNRO{5t`01vUSC^{iAvdA5jqDqo(AXT8z z>@$&6X{yrTunJ&BLS+WT3K?B20k1d`A!$p6#6?d)SaBD3K|ePtu;kZ7l!XDX?Df(d zCehrMA>BL%sf6(-ZuUSH_y(QdR(q z7A%K-Oz+$FYd!#rdv#%hFuy5yy;llYhxQ@d+h||g72~3M@&aaH{Ynr6YrL?CyXG&? zK1^$+D1fD7)mM#00W9(M{X??PA{!1CGz1xLu*8lHR$ z46NUMydCfLvEruUE0&16saeH4%*65J-dcS2kzBSHJFcb1lz}szGL7766NA4@L}Di{T6VttY(BM!|~eL}sgMm1xu_cT*vNg#%(5 z5Q{er#!W>|%;l8T1+3f?R~5|FlX3y7Os7&C%_rV&_iS&A`ZhiWw-aNVzz^xLdCe#T zZrOTK(xtsR8R~qZ>@UfK%ZAfs&^rQcHytyRSmTA=KP+t^w~nm{U7noFrbS+Da%_Q0 z_Q|rlp%hm`*G)p|Lf@?VAk6YG;FsuAN&j)!Q=%?x?$Kyvrtu92j{z)4NLbt`UB@h zqJ*sA{MJf zc{q%vL=sDh1eTT-F~2a4*_lba`Q~eQ@r4)IMUH?GDo-dBVm1|}Pv8}8I#*XE5*%$R zGpP)NJU8y%gr}?3j*eTI+Y}>kl!K~vJv>y-qFFJ z-r-kX#pyF=(cgcS^AQS#nTbZA1~Km%ni_G#?p_9~&=~q>vvZ@Mo^>t{htz}?# zc4`XW|L)T`bM6ch%LzncVbs>uBN`>fTLiVW^{A_>VK+b0@S=@7xoZ*d83~c5SA+pL z$`1hwsWe4mOmcatE;vGBD1`Beag0w)G9!zANN=kuR)tL)HsOw2Zo_@=d?!ba?i^Dkk)xC|wp^9^fDT?rk4fdOu7zBH^VnvWO&B?ea3Vqh6if?eQBN!!i^ z#~skY%*%FQ5XzIVuS}F&! zauG$RI-wTfb(CB=&0&T=QY5p!bY`UHQujN9O_IY3MWZADi2y8`)_F|RPYHp%iSG7ri9Bhs`y4>bGGnd2%k{bK*DU~x$3{_8&oR4;;5F9R zE1sr3Q1hEG>oFq>=Spm(+&9qTT@b*sHL!y0<-pf^^ZSoKyAc~3y^IZVA^feUEq5W` zu7my=6opWp^KNqUm7H?%)3-O^llSCm(d0AzU%VX0C%!)730+P1<^{0+&}CrRUD8-^ zo?l`(dh5myUQw6*^n)!w8U~gJz;bhYeE^o^pIiu^{&+5n=F{IE!#7SY%7T-Bf1XqQ zPwuPD>q0o?xINlQmf&|EZwm&nzMxSEB@a$E9G*DvEB7_wqjvIg=-&=o(FMKP zy=!w7{`dRaSsea{`AjTj@iSi?#+k7I@JiQg^MaxPR?ZYrZ0?a-A#FEujm*c=Sx@o*FxOKy0z`l6Z${V^?<4!YY_7KgVBPZvq=Dsi zIrgpr!INxp0Lwh*>{8wKfAoeb{IB;m2eJ;=QwL;V%_Rlovp+ciR-rzq4Heie^~-gv zto~c_AU+NuLMGkZkBddTg>$RIV@p?A2SBj$;0JyD>p^gFJSlNm)=^VVnfd7gS$6Z_ zyD3kz6f%{9t~u$OP5%Ac%JJd7VMim$nU=Lp^kmm@Hxt8N^hDf~Z;d1<5QPZ8>nW$2 z6E+J=9ikm@$`4@CX2LpE*ZbUex}Desa-=m}#-H57`<*<@b=u6B{gAmgw>9l=Y^_WO z#8UTKZDq50Q^t~;2Sv;DMsI7&#={)eSb&q>t@Aj)lD8@SSPIW8)uotQ;n-btG(0<@UfV)Sub%`8*rX2T{C>SgmL*pzG{ z`BdK#OctBjy^rpfb|q0@VlD7KlUXv#)DX885=bsx%QA>X5&DR|ys5Pc9d#j04fP?O z%%ZJxBSO(Cj*|EC%P-+u-})v;bIX*JAzW31mC_K#CZ{nuG0AM7^3rl<5Rr@Ao}2fe zyQ>?G4Gox|n?)v-W>>L}j!tabx($^TRSY6gM8N6kDSY?4PviC14`X!n8mg+I*uG;s z>m)TaHL-pZX&4bmLF^o2*wj?kpsuz7Gt=|9GH{i(moD~Q5(ZXV6T;y>wab^b*d+Ff* zy?F3}dkH3BcR}iV1geosT`XFKR}R01qeqT007UFC0)NQ0j#y)?hh(DM5impG5iyvE z-L-97FZS%&iOR|l*L5`srB_xndy0S>`V0>bh8wF?|K+L-JQ64wV&Pc$Q5&LexBU~iPc7KeXT7m3?5v$dKJUN zBbXSUWE~_2gyqfmDuZ3yc5Y|Tj@We+L6AVK*0xr(H8&%jOk#9s2;chqZ{p2kZ(@ES zfy(L#Gq*@Hi=r5kE)ezeuFeiLH8paS!}78a_iqw$kH-_Jsjg<%Oa`-7R~U4RCzjaN zv$nPd&CSi2o14Sr^fa^Ks5}ffP|-74?7w+G9)0xP*t}&6y1RPZsDuX6x50CrO_cHE zUDVvUnd(Ax!PNbnqM=$qz6EqKP|1S*hS9_zimTyAc_r;6jhO3bTIpKDV3Zr}Pu$a` z59#3uvv&-5rH3u@otbm^eg%O{DH&Wc`cZr!AnO~atNLlA$z*h!sPy8Fx5h4Z$;=Ak z$qW({M1k`nK@1eIVtqg}cM>2akyT3!XeA&P>F4QhW?z*Pa8KjgxMdqnFRp9j`l*LX z0stGPv99Y@Ko(VC6gR;v_cZ~fg}Ei_YzDwu^|}#~NIe5se7{i)GlwMh3N0X(Ks%z3 zMY@ONMp@*$GW{tLiAezZ3a@Z|zn#Tt>a@C)x~!hgJ@ab4&B1YZ0+ z0a%tLPHFsRJ_eQnusn5awS#Aa64c2pP*IKGUwi0BpWbjt%?I!-hNMW-0wbC2*C2|iO2$GZ)`vRzIHr%L$IsZx6dr% zm%cfgw|kQd-S51&m0jxI%IBGjOZYF}9>+|=iaO{dWR;aOTw+Ary?RCjguLVTue_Dl zdj@V>O*wx5{TlG_j79L&JF z=SzbwfaUIbivSYqVPM%gw`)xPCL#7OKHh?ss$h4*d~H0JT*1$Oa{`a-ti)43JuL>X zt`&;jx!$gs2Pp}Byx98aPCY@xDQ7Y&nA|$wwVq;{q&z8l*iUjLXo+yI6kzET%7c|C z|7kC><~i%_^38e%U0&TRH4I$QR!yIl)%&)T;X@99tE*dO^sbamVPW?*0kNuL5j0npU`u;7dK#lxnjXedGJ|lm8k5rt zICbVM&R;l>^B2!^l)Cb0CFYjmm|cuxc5Z>0HKcDvjH=Gg4i;DM?(XDhb5#{pCSqU= z)s+;TunrCNjSR}r2KC(evp93+G>#rUf}!DSsIIC&Yg-d~db(M>oN9~Q5i{vDZ*D7N zF?4oxp}nIA?QK1no|?ynOBd1Ce;LjcUuH`6!_uuybW@ibQnZv?joLN|@bc%tswzg)Bjt=7N*$X&% z@-%}%6a|j}9|Ds|be~=N%F0nzPP$-a%nBl{ECQd}+gfq+O*i1-hweu-T#BLLA!a2J zGq1X)23RY{=~GlE7jXWL=Pc^rd-V;CEoLTPEp)Nz{AV*pFXu<7(S?Y#-RcJD%0 zS0~EK%P=rNtg1AstE-tQM+`iUkXc&F>?#5|&z(JovC(mMvm~|;yP7d@T*~jE@^tld zqj&Qrj%?V_P|raFs;ebZVR=ajQpqH)^k2rMOP6u}`~^%+O(UL6vaVWVb2CEGD5B8_ zswyj)!vK4pTc^B?HbeBZIEH7gLdEW3_YmBZcG7sq@<+^aYK)*yi6_DNB z>`u(i7}fcVSziQPDtKku#hJ%sBIW0tLlO(*=I@v}B-e@6Lm(FSCF6dkLhq`rq^v9b zEiQ#-jxz6}{>0$9(Mn{tm;zYlx3a$|cm-vf#LrnTD!nRtQ7K_75{O0jh(4eEux=EC zQSzHy1Br=6U=K60%F6hMzcW8{4|!C2bh(V%C2Mo72n$fO%tUufZ~{3f;X2nSzeXgV z*i{+@(1`%dKvD^^rapUHGy2?)mKiReG>GN{9CzVn>fZi3Tvmd={74rLa74V^&;LC#htGc3FDmZd zN4a@mM-_hN_6FR%4)BK-ufzRu{Ndplyw2J|rWZJiv2%3qT++8O1MBAN1+dn)+o8M2 z*!|GWwfNW_^{j7J=tGM!MJxQBXQyy!GL3idstyFONCzwTQ-V&?!1~07oJ*{Mr2v)= z?qYLl!JN7e-?kx!Pv75&8`?zAq0onb!7slyhrfAq!C~PQ2Cyv7uSxhrc{H&60M>fu zXBwo18CWL3hEv?&N+a#IkKa*;C-+vPw!j=nMM!4W@c&LO;tMa%GW+VY4>#edyDjc}7Sbh86W4&6g z_)3u1)Uevg1728>?VR>@btI*zCAe=(DL%L-zMsI=XBFCN{#XBXiw3}xjDsl z#8x#Vx{v*F&T4vfqcL``X;uTk@H?fgB@a?EyBT?N;#)s$9Ts&L(K@jK ztDro(b?1&2*_g>`IIY#5(`f_ld1nJJfaS2;%qgmDBBdQE+8pcFSZ;m1`7;rtq{te1 z(1jRT=-mOZR4=AX!ltuGyfV5)2%cCAQpY41ERnecNRVh(%pq9GpfVakQ^gv#b=IP{ zr2?77Nscl&w~)k{bA5Q`x#yXovQn~!%IYdaD=N`{^%_RTCXh;JnCa8Iu@{?qH(~SU zO{lA@MO9S==OW1Dj)nOd%+F3@er}$D4+0~$Y}tXW+je8y_8T!Xo4|#O7a0hen3_O)M;jXJtC3A7 zF*z}c3m48}XlM`|>_D164B_#wpWjQh(Z8nL$vv<$UICRGy7#$g7w=&YU zAwY`U+?tyk(bd(Cx%nAf8yLc?uf2&kkDZc;V{5AjM?&J377n2-6k-5NT;;usAozLjAQhRoJ`lM%;P#9mr&tkw`4FI~)OHt*x!BFU5f2xpR2wF znDr6?GrcSzVTM?0#s!J`3jvl7zUx68IJlp+#%5<`F+4KNWo&QnKqx}?ifp*oR>nrEZY3owoK9)Cw6H6Ro!XZJ4xD+s8ph(!>K zL@_Zjjl(a$iWA39;`G_GsI09j5^*Hi?J>b(o*VC7b6k zea-+_W>z;Eej$~wBoE9j=Q8Q zD-dMGOIl3U(qI6VO%xEm#fcUvYp9h6!xmO|SRN8K1IusL72Q;<$L7s3*n^_@xo@(w zT=@O@ULO2Z@pP^9bcWE%%dv;oVXhag8_AKRWEnKR`U>t6u901|jZAv}?9f2m)*NAR z?dB@-(-+$1Y;pxdvuS2Wkf^&eiRH8-0X{8`>)L}~x@txCGZ3ypgx$SK{z|cpB4>im z<9p{Xv-59(x+SOP%Y5~d^Sx)Rc=PEFGP@G;9J@R34S2Irk4bFM+(ZC^<8^SISy^A4{-SOBnSP6rH4m1?I;VvLFHU=Pt)FMs9Ha zY-?S*9p9a@^AwTl>iJIy5c<_)3;4Bv&ShW~FWvgu<9kJ`X?ayL<+Pm7(C433#9R%4-^_o#KPF^d{#ScihSv zQLH@0CN+89NhRk!T0pnl`BIdj?wi1KmI&*8CBVI#OY#02DLSYDx6Fn@PfQ(9$Yg`w zt;Qn%t>Mp21SAHV9FR)IPIWz$oa;$78@A~%r4g#kZ^tw;TPfXA(f7`& zyrbhJbGvImdmUl4R$Tzg?NFA|mg73$05NRXT5j>4dDg6@vfp#(T{FWwK$U5A2ez@g zl0CIadEJEktSY(e?G;>J266U0GFuSVcrMwg_+vhuK|}Hq1+l zab}xDLm}+mxfSn!;@#NT)y6O_eV<%TVSauAGc$|KjvBZ&f~y19kW8l#t&E{OOpGpa z_aoS`l{aqSP4yo>By2ktR_l%OXe(4Gm~+ZN}aMd(pdPBZGkCZb{$`fqyK9URlM= zF>+&E&1P}w+eY(q2>LTWjQRnpyB zm4Gc2MY6rU9c$SVT<*JyV{e|si-!+`bmwE$Rp{E#jkdNnp5H^|Ayihz7{IEkj4_zi z)X;#6XoOwONW6cJB2Z>Ch%cv*h$lFDWJ7%eC~{$}B8J7qd5(B^ZSWeqgOUh8xq@Xg zE7-sH01n-D2>bUP;CvIP!~*Ch(x3xU@gzY#On+p?RQ4p#H6G@VZ9Q0wF0&oye##LD zg|S6xGw7l_RAufOkjy<;afJeu4aR91fQsD+RcBE_QD$SQYoP!(>T1aAlSXtkQ36@3 zk6Bn|wRR3_#5Izh=Yt4}wr9Xg(T0@Be(V}YKo&8aOcY54*BM}ECYESyQ5xb>D1eqk zCnNw%el+qRMfUS7Fa}gpHZ<$P83vZ|v~vJPhW^;SS}LF1^%THjS4bKwCW@n6quD^} zl-O4^Ul5Q*WmC6I0RVLkRtA=}cJUHLfjH#A#Pk-2c_nLyktQ&8>9sd4+{O~q*R{&L z(G^(tMXY3ZNE^U%nAe&|eYcf&W1UIAGX0GEfGbr{vhCMjcUE8991Q%js0D2sa6aQQ zuPqsTp_u8pK5l~ikbR4H>iQ+ z*gSSe^S$G@-_wSNjG*(O&tE};1;3?(Ihcg?jE9QqIUIJW@M<8tfL7sxIjvz3zn1t4lW!;lwUN!g zcXDMnpg*f`Wri(Q+_$;%3U>GFcvrFU<+&bI>GCc)&nxm?>#}{PW0(e>3AkT+7+ArB z!`BGKCNnn|vi|x0z24N!V}-{NzrgB!C3wf?5m2Y?Hk;ah z^gO@I`f`v_5iRq%``k^x@UlUtu@G&dzqUwKg*lL*UWu z^aNJ3%P1>Z!NUAB>l7_6EHZm16pG@8-3Rg5<4>ZgrQ2xlq>;{~Fg$#Xe?~`#aBZL; zeSMc$V~dzKR1d_mB2b0&s1k`JGi@kxVmy%ndC%Q-XdfPZ^bvHlwV|Q0QCytJ#cypD z$>b8|=cbX(rht+V&Ythb*>jh1vF|FTrYBKbSBuK(3f5Z+MXBY5nR1C#B8B(EP_&Ebd{Ae8;n3K z0uPtt3CvDSBV1OFmgWX**|HHkcWlAJ;tUdr6!z`E1zWf7VDa(g)H23KM{(}_IUGN6 z5);!in4MpcXmRAql~_hHxy%Cj*>oDKnG7~==)vZ#o6)nO8}&_f7#$yDT`6)$q55(?s=R(d5Q(|Xw;SZI2u-!1z>63i7}*ZggRTR)|9L}G7s{c%Yc-CB}5_>9MiDDn5iVCC9sOXP$!s$ z0kC-OH6WJmfmHyVfGh>IZV41)zj;5yA5RS{Z z)2`~C>MWwNPFs6;*{?g6iMy0KRiprxB0&~jdR_uD-x1M_f ztI>Kea9#dDyW27?Fw2ii^Bp1g3=Gzg#>TQ=v&{8%NfwVgk5{x$*?ht zwZc3NRM>U4aNqO3d7TAx`jKBRE2!TT*rcv!Y6$GJ)_jq#qdT3ecwY{_qtFP_CkpkU z0_Ar4{aei&@Dm4W@tKDu$ik=pc@lqnO!d=(K&*AXr%3ZVCCUT9<=c?2^X7^=8}*-oUlcU&JDPqmhobZcc2y5HWIUzdTUC+Z4Pi76oKpIPo* zmXYZwP6R&H#qzrYm~tub$s*tuK&K2WaYyrgEas2f8{9dZzq1S=%Q;S#Y||z9RNn)- zdOH-`QEJQRJC%{-X%hji#9fazByx}^Vdssei`jhgJ58Bf_dm(IYSl=DDiJRhK+7$^ zumnsvd()<7H{hI1E9~W%Ct6;!Bcu0n*m|NU7`F_kE&@y!TLVj~Rr2SyjM?;Yeahxg ze`wRUx{^g^Imzx;8=9-o(-1{dbQNcg9>($0XK~^3RV*Y^sHm)FvGeKKSWA;oOGU8&^oiiKp96VTv$X`dn+D(;C|eF$L;JsNBN>?h?g(-<8uEMW?o&n zGJyUoSCL4i7(7IIIrlGWXX?fbU?mcmpPgrov9{($Y~0w1Et|TLOw1#bS;K9&-G$w| zZ{~=P#4zi>av8@@9>xVFBYBN%dINRHB&7Vx#X zi9ryGQb>aRW8>qPn3&))L?abQCCSZm4G%x`DDJ-dF7#~NfSTG`)=*m|_cvv_Dy>H* zW3%70)9lvJ0t)NgJc%d*JQzSKqCN_YAX@2 zNX#NRXi?Wf=Qn{@3U(Pmasqk00G5e>s^*vh_+2wk=2d1?k&B$eNHuGs#ZY2*O#^mG zBvw}oP$ye1xw8+}D1IXNF5la_Wa=ho%1dsyH0Ke(WLQ${Zprhe3t%ybWqugEa(+aV z-PWd}en@LPv#w0K1Yl8nP(8Eem`VefLnj-+@~nqU4A%8s-3C>hUDkH7JKS~0>n?99 z!8%~q!z*`R>t0j~OAbe*Vl{oqmjJUWHXzHI+^KtE7r-)N?hIg&2G;-gdJYj^GGTJR zE+f$t)NgBC&$E6T#rbz`BDOK>$!mdU?BsK|sks?heMkxxVYaswTRz*+H!dc1h6b~$3kfA z4)37~7I6>p7R!!)RIE*k16XE`bUJn3R?}I|dSxJ!$(vw6FSSbJ!H}-M@A>N`w>I*n z>94~)_pLKac0P*tXMgVvcw!y>xOmGKxg%)GTjzUavva*UD8bIwF!pst@vHA_6@4Aqk_V7r@0zft{<+i z7H%~&c=^58Q}}iC1-mSTCz*95=9z@ncYo0}!p>Bo&TZXSsETy+@5`O@h@b5nn5?u1 z=ceFz3z~F;3hchbU^45gJF<_0-fxmC)>G(RclDOwJvW#&*9g_pa}2N;Ku0hKFH^{+ z`>Sq|%!R%ea121^cr6<|4Oge^O#+P@5#=CG4I2WTcOrvY8j zbIpO@jZnchj{fK9W(fm|%WlMBXyeB&E-XfDSn7P@Eh4`X{m&Ko6*hrZq`CwNIApUg z+-~S<$JpId->>DRH0fO=G^`zs-TwF?%bnlU0Wrz+8FwRNI;m+*bxq-|$C|j^D2PQa zUj$Y(Hq>ELTOFd=MPO+P=Z?RMbAA1oA;wd773Gl#i<*y)j3W|_p{BM5`}XZ)VQ+Hr zYOZfYWvqgkK;+;yIx>i%!7G@Y9K+(m66*`Kwzgs0w(V$aYC$wwiIb!Ld zZdffXltu`N#aX16mzaSwGc}2^u~B3*X^wbD5%~zHICSW4>_2!nZrXDzN=hp*H#>{u z@*S`Gd-Ej~0+;jlV zEp1%SeV6-i^!S^2<+ay^fwdF|h>f^ff<$~7@udXfi;Gyzq)>)cY~8$(1=dj_3>9*R zlqj2P4Bm8fbTD|?+S1BE(CpMK{{9=^!fUU*#+qLQ3=%j;QOal|UsY4XjIG|@UbMBh zvSt`X1Dv0mVI8B|no6{`G@+%r5y|)xGw~>@Wo88!8JWPDa~IkDF_p@&j$BP$J?hxa zu?@8i^(^2{Zm2CyO{lJ{L}f(;6Jw*8m>9*(^c2@yT^&U*tY!d?h27%`23H9*BfyJ* zw26svj89B(gh?8U;c$$jUCzxe;`ZC`#BI0Vj@xd(4P9Mb%m^eF7LPj9*8YV`rZsC; zE^$FA1-WH9bwP9+z;c*D1hzZ#xg4M<^H(G7IWC0kZD^RDI=!pQ8!?}Z`=A0?66sFF z-7`ibOLUk7*pi?J@_q%DsDC>wEL}g0o3t)-JlBwJRk=pkGfY=ApDDvt=1Q5HWM1=$ zgnJEFbGIACPv(A^``ooj=1tLy6jl_q6$4oOw^^ro0hS+SUolH;#Q=OHmemoGUC^U6rkIgBlr^)B{9 z5WtdF@b+?-86LEYyxqzGg=QmFCbF`(OblQiPh#Jh^sT;|?zB448qjdz|NJu44749s zH4>vNQRlExr#VBzkeu95&ExCI>bN!zh*GCUh<}X1c2pdTsg_QZV^0it2dti z>u`5PO`&R1zAxQL>py$fI*gdRV}G&hoHxG5tO5TDgC}yz1q%{Un}AeSy(Or3%vR=V zjCfy0Ra&|#I#j!d>dmHN_yw1VI{Ve%e$nOo?f-NV{jH>fBme#TZ?^Ei{`HDCm+I{Z zEx0eMYAa0k%~W~u$`uHfyJ)@ZeKeT^37MS+qVV56&KrlK0NLYMMtCVE_+R$P#Q<<44ZeT_7w zP?#Jzbf}3$aNttKfO&FLP{|hdG1WoH)(wYSXIkJ@_ zeoX0cV-ll6^5Xg$<^dI04x@5lQ~=B8dSu!~>m@Emk`6P=G>jJ2-G~Eg-3bmOofsCq zCl|s}5j|a<3}DSZ|Av3EOEXx@Zex#tmtqM!1}GuG=lr?zxODjvE?gi6))@>A44|{E zoyC;bR#q@M{t{n(^##8C-Dj*t)ZX49`dCB57#tc#S9dR3+dJ{i{fGF~uRcLjQwB}+ zTw4p0aUj35iJk2YW?c~jW?_Dw#k~oz*x1-$(d{4o(Z{&+=KDB%?kX0SHu2!WH&|Ml z!}{7XQmMERQ;)MQ)%5fXo<4hqhYuey>w+TrkzP_`V;rSoncJ75(TQs#9YV>Ku!Mi| zr$56-Kl~x{*_6C8oCt)-bYjYz+WK(g{d14ds?;EUhg#V>yOE6$&^w}?qa5gLb>&DFy| zUS~%;`g?mho#sp$V=rG|a$<}bUBtj5_FsEP2S*nqad(=7)W3;%49ABC(AL_*E~oUf zvMO$b1eoQv^X!&6G;{*5UAlyS@~3}>OP4OOc9{t9dw_yH(-&w9^ZRDj!qG89!C{x?mQlTk&=~O?#@wYbOu|Y@8 zg5|A+{*L+|ztxTZ_RS8?cWq}M|Ht1f~e>N#uz@<8>O^Ye z)Mi4ui$Sf@1=_dz(63sR(41;!?__8Pb@f7!DE#C9<+MGt{ijDc{BM7~j6%7xWh$4s zu(2F0WHA5A0q;L+hpj+f&K6#%)wZ?T$|R}#rN3^PxMM_^#Xf4fR_)BF2`kp#s|@Mr zcWNf*j*&nzwY#c%Su5H+1TCtwU+j7m$vBJJeQGb9!6)p$O@CCR;PjIn85Q*i85#U= zwcXS0e}AsEh<0J%m3EGol9Ogc-QFbt>oo%i7;PlWxUxihaaRz~Kqi7lnbXKYR7){J z>86!HEInNK^(E9|Rq)Ev^NnVS=T_jk7-)1TArW~dtpH=Dj^;Z7rOesL-c&1y=85p? zVM-VS=AdGZ8sb)`H`X5eiQ6{}z%pIzfl>0D|Hjzxl~i2bU7sCRAScDxm4ASFtFglu zRdy9uSeinNaO0;~R&x(f;zWWw89CYj7t#ix}0AhS%sE#Cn^4~@o^P{y9*%YYRB zvq8#ag!|P%v$|XSxH9g@mC$9>xpgsrv!;xIWDKNoUUb-`vxJ7ZC)cwBG#nm+`CJUh z9w1Jl<`jmWz=DQ7%sjh?g|UZ7qsYvwmCY@zZ{@I^+vR9*N{Bb`2+nk8>0{ zV!Tirkh|Zrr%&*^-+hLe=_xEPE#lP337kAR!Xob!39q}Wm-V#hut%<7zy9^FaIBwn zv$`30!eI%!xea7DSFygfg0;0ZtgWsx;6!YX&8;k&o0{?7w?4pYm#(9)ZwRwj%;>Y`Yje`QTcQxgXZRDW?_-rQgN@q zT1-FwqaWdW-~T>FMo#hf^K&!USY5!*)*9jsWh7D=6!#mjwNu3JzPg8}qhlzPN;qhY zbDA`Ksb7TcCdNFutdW~tQ!0(~r%&U1-~JAM@{^x1tL*S_pCbf5dG-`fo<7Ft%a@p) zpJQ?8G=Vj#3-2`>xQmb?%JQ}N1Xi(bQ(3?( zj<#p?sECEd!sV({WdJPQM>ry2JkG!rvpiKpP+bVkqD^y(#n=si#bWCQh*4lo*Eqf~ zFc$+Bz%omybyd@Im|m8swP^Mhu`N7?2Q!aaLJj+V$ zf-vJ$w^?a#X<%!XIWDe2tbmH70G4HsaT$$syxIYjUK9gM3#6O+kq-&J1RV3O!a@x@ zvHK4(k#@I>9r+6A8WEKx_oY|2Q6JR;uLfX+9Rb43?WiNA_kPV&lV{&JRd5dudN9?A z?olHxNN-2%iOx7qbtkcz-^ZhcJu8aGQ3i}5t&_waA#4{*ZNd%!?l`Mq*H8{m8gATqMjx?mZuVMPYDR~5PG6F#i2Nt*r@)Lb2fQA1MxG^K`6s6u+4fCx z12l&|1#m=I*)*yH9?^kAMa{kS-LUM8i=Z%_8#{Ydcz?FfiuaIY#Zk<)iX&Sat!-7~oPy1VIJ+Wn@wb zbhfo(V|4|~Q_rwI_Y%9S(>T%JiGx@IkDk83+|nul0YU!0GkwmTJ%cxI-@(;Om+{)g z*U;VB%>vkzLpHm{g6yAu`YZhW=YPvAmgB=ic;k)Nap|?o{A@>iC$na@b32%sTfpzW z{0g6b`Wu`*a~j8w599EF^oVwl+u6X{>LL~w<~dR!fi=t)1K8b*KpbL!_4N%Pk<4Im zaTViZFLB|*Ib6AN3CUEP^_GZvl`rJc*4DwgT{E+DtfBPm*>j#>boeHbc5;VIXVMI2 zC6fu13M6En!?)l60N?u7`?z}TI(m9~v9h#)rTIxL&W>Zhn8RU145{W8AeO|v2aoXh z`Af_#u41ozh}QNFBSc=ZKrp%gQ6KDV=a5OJFmn6^zVrSE_~}o7$}W~Pa2`K-j7N_j z;r_$>7@HW!W;V+a+8W{s{-NLBxV7~z$fBZ9i z`~C0Z^yxE5rIT1+U&Dik_wniHpW(&W1SV%^kw~SPmBemO5&nfI(`BaTXJiA7k~XXe}_+g^(h`ce!_qwiMaP3>&MXX zVKfm?m`Y-OliWmi(AtznPggqzj`cIxN>K}mokai^v9L(QJ)6y9a&i`5-Mxo}Mba`W zu(ucemmqi6&Q82``7%z7oMIPFaz!LI8?paL+l|_Vz_QU7&oMDQjg_@^*3Tl>#AAKO zFg!TOpyKvc7X7_F45rcer8G$RUD#ObXliOfOG_(*S;Rs@cJ9K&_6K1>syZW z#Ej6kvhF+vmAZesQIo}1^F+@LGpJmamC9MDRm5GHpX}Cb);Iw~lzk~$iVXHMa70n8 zCEBRfdL!^u8QS-iJ)iP+Z4bOFv~ENtP7#xOB7i}uHXjY2*AcK4c>|;T9<0`1&oUa=g zQrE8E5zbDok*>zE{cSJr1Go52^?WsTx>3ikHTY_PSK*VSvX7%$HUzt}FGt}XRU5Ld zHVixzg;&%u9D-)Df3YzCvS-7v18aRmlA1-S(pd6tT@6!vj5<$*GO+YyWOtRLBuQng zS<^ZabPqR99|Yg5Xp-OrsiV#6c%*uP-2`ea)|CS_8i_nd_|Y`oMeWpo`S zwF*!y@Pa8-crvfj#!-tiPlaj;1{$JP-jREwTa{Xg)G_QMlL(tL)%rfHi8YOo_W~aU zodoUI<_|xE#pG4B`gOET9W!1Y@zUbIg3CPj)hnzqdSe(!@7;zyLHk9Y$VXu;99tGS6ipw zi#hG?_Pcw_?LDH6BkUgQ$`QJpi_VhthP+2&**0I3lyz@#TtKWVh_Vdael?19>i_^C z07*naR5z}hK`2%C6w5y|{UactgeE5>L2tzs#NxxDX>c#HlYe!TcGN3B0q|@%bAvF- z0YI2x3UF!^COwFF3_VFpz%>7VdXR7rWh&gP->K%7mP^)Nzq_X$M|^@c`fO%R)c5G% zNZmjTtW+X~mUIfs3$vIReTey0U>oB_XQzNCPha4{qld_DZLvEU0az3{u&KF; zffWKw%7p@o`8?i#_g%dG&U?6W?jMjHUSr%uT&ODZk16m~3idV2Qw>(TQ11 z%q(I%zmH5)3*vEt_5?I^^^XWNZAxd*-_wit-gy^)^6|%LZE59=^!fAWc>MG+zP$S- zUXG8kSUDY<$<6POb=nH4um;xiu`x`}%pjghv-_k(N)wQSz)fetwa?w%g>_w}Kxql5cnc4h|8o{i#*-+hJUm30c7$-pd$ z!S|B*`oJJgpF4-X{sF`i1hAD*EEJGT#*oRRn9-F=#Ie1-h2^z1j7?5qYiE}kcgK4B zabkEF`P?pxy;JnU&Q8+M>Sln2z^m-$25YaSl1X;q+}zwkLoA6Kx8B0lYd3KI{A=7U zG^UuzV>Fz+z7in%;Gk@P5}o^IJ*72f(1?15X(Y@maVJ!FIbCm+DMe{BIAz=dd3`qP zn*je_^ix+aOO|DFFO>C@-#2L}h^70yQXcHyWEMGh9n`Ht8P2wi?1hZCztWn(x>O2c zmBsDS1F+QHAL3F;ZkEJQV?mIPlR>j*?{S^HrJLg(mY(+xB4-9v*l8yz7&^-py-M6YIQa5=5wcBeDw)xg#c z)HG~b0V6BKdz36qU>o*0%avEbPg!S?@jg*RU0Q^--XTYunJaN1;X0C^0VM4!KSW{g2mkSfIekkX~%J$Y_u*%h}ZOk z*4I$Blsgr&j!>&8HOowDi%lJh3!MS5JP=FSbSBDGzyMGkDG@D}G35iH7>}TKkvpC?kn7mZrxs@!}yeu`<$)CFHj^u#w%y(#kqo+B$Ld$~D}$ejPX8cmq8I zN;S7}dCR2|HrChi=*a{8{XhIIvRms6l$<_w5@$}I!ftNc3YRx!nsN2&b@cQNBAIT+ z#MCSctoKvozSb73EH7YXbrBmI%UE8X$HL+Q_6mD^xTN32&RJbsXMyMIRF)ezar^dd zZWjWp_V)I$SKPyPZkzL^=Lr}g_Ee^+74bw0PoKTOy$265GdGX5jZL(7b}(`NNY{YJ%h+ls4DSq|oXZZY!-(jba$KWuz_K^!@QX=dbac*L_ zC*#!Kc^2W1#p7scX~W2=Q#gD2Gz+;Cfc4_}3*5i|5WoHH=h#@==JB0u%5a(|Mn-Vr z^x_WJ&E%C=@I}oy~5cd=SH_GZ%63(skUtb%$LNvzu84dZ>@7ee0Pmu~`zKYRge(~QlHj1S(gIDYt%FH_Idv7j#pp~(?_&dXBVsSEA3uT`oP)PwS zS?A~xj)-aWuZUU1;8j^bECRNOouxwK%os9mgar85wUCw=!=fTam4a7t5uj%&&(O3{ zPl>H%8CV{G#Zd=UA4^@b4O=v@Gg>!z`Mfefmit-LA!G^1Cf>yU8wcSEN3m;P8l)oZVt*w(6|EVLP zRw?VSbp8DnnxK0&I^way-dQTih0P>;%V$LG%!qN0V=^Fvpp#qe2=FR+8EB5A4k~H! zZ>O%Jh2i_J-X_-d%{LJO%_ye{nHZ+~+_R*8I@q|?y02PCRP>@_vM7W|{Xr^IC)1{z>Ds1sVB{< zbqPuT2vw@QCaRTLl>%3cGgFYjE53gQ{!veJ9I1M~hhH)Ex?ijP;M*q;@T2pt5h$aB zApzZwmEmHk`rd%C2A@t7!@klRQnRg9bSoR74q)YiAY!13Yk;!2#HG#8z!KL1t)sJH z+2XlE=w8Ds+e^(Q^#Tp9njU=R?n!Q*F8j)id)>$b(?HzX%sf8^dOc??L#0^i}_ryKa6w*hUQ(#-(<*bbm zvt@X(+o1=9x(qDoPf1V@g!Ulg)K}}EJ>}YYJf2ir%ZSyB+a#SP6FuGC%)Hsy z*u=)>1~atCYm)$pbTW?a?rx+r&4|U5tcCULY^TIM>m zwYKBp#n*7@wTtNM?P2EE)Z`?-x%UA7^}qfC8|zt)$k^W5fp(5Q*oUsJZUzdeeQ7*4 z9umVX$u5MXgC&vk#N{%VFJOLYnE{*TmR5AMcc81Y3;V>v*)K9^)tpH&ct(Hk!FWTd}^**EZmY(&>%0VO=$?cWO8501D)@q(B z#wF5T3g~`f7GJZM*mY1ZZ5+0hGO(Q8&)%`<<&QAS1bE^-z+9*hV~SXh^c?jA>w|IB zLL=@@bI-W(ON2pTbd|{E+x*B}*9#|c6IJ&?7r?T6E?|ED0RshSOnUVIg*bU^& zXZB^QM`f%H+kDQ+LN7VY9xH9?oYBt#$}M!AHGS$*>DPS+fk0XSeWCToco- zSwZ(8RkL(8Q}c{?bJH9$qiW|;`-#eeL^YhV*jKz%ea*Cw%Y^pBC-&8l^dpKA{;~II zIIFJ4#IDvO_Ej$pue45SBFCJ=da)f__YjDFFlr4k?Ob;bQB6~=K2abTy;Dz9R~?#x z1S)QO>KWIb7LheTA{s>ZqNw)rH$&z6QM;Y1He~qgM|$N*5Bu_a^Y}hKx?tSG+{+XT zQmEnXT^!jv9To5Oa2FdETiqa{dWt?*qgF5#Y!)P0Z*WG6bFkx}(-_8ptdwuBP_ z&>gCN=9P)K$o7VmR81#u7(08BFS4;&$4mviRn3!}2qT7?yK-v~y8xC8*o4|l?q!;q z6XY(VfKC*EWe!xtjF1DN3Z9dij{pS1fRN~gBJ?XIsI+%98kRY@I->Ee%P6~NIk)5b zoplpb@plJ!a@`AUTbKi>1P#!rgXCHzK!bp80&WTW!mzhAid16^O>tmnX$n(M?xMW8 zz<^J&NW$m4SXy30BA&$CZ@q&%cizO!H*T`aTXVVzF?Lv^dhD~n`mcZe2_8OrfW@VG zbai*&;)OFP@9kh`dma15T^7h*Ut8lrG%$DqSFhi}yWjdg66p>W%l_?Wzs5KB?qY9m z7lpzOc6YZ~czb$!8hb?naEO^g5d#T0A(uir>=R4o&h1;caN#^gMnhWa{|zyTUjEYX3NfQSQjOQdLbwm;aN zh^ZThH^x{8>*n=0@PiM3i1v<7j?yiU*PUH_b@&+f&88@f70o+1#flU3&1K2 zJ$B=2q;V^!W&#X%b9vmkbq9BD-ofo#x6swqfvxRLOiaAQqo>cvS@8@M?1MB_H-lD(u{OEg>sPq&O8H7sdx-s9qs7uXhUa52TH{v_6h}d zHQmhZU}I~W0}1r@A7f3cbUI_~uLG__G7)388o3>oOM47{5o%X17x~`=R252%Xzw1t zsWX@G<~!d)Yik?V!*d@rE0wc0vSt~BSOR9rf1Yc(f+-4?uvU}#Ats&zTJ#)gp9vgI z8hbIs8N?JokVMr9d}ClpSy5)uEtAVBv5CqatB76Xh>>*I2ufA;pO|%J#C z(67yGz<#@7h*hhu)eLr-9|qYPCGsOh7*#h!E+#Mj!fI6;#d9zB3`GT7bf467Fa1_m zO9kAtNO~c}kr+)RUvbwoEN24}avQTSKLLsYU~$x6vwo81l>$);V$qsJeI(k23SgNF zrhxvHbwxM%$)%0i8|=uC-BZdOz*uZFLT@vYxha<=-hM6PP}7lr7ywHe%3%`AMU2lj zv9^r!spG=xwy)V4J@Sb#uw2X6dn9NL`!;r+JJuwt$8W@8)zq|uE6s?YZC*2pfO%>S zf-q?(9hns-Z8f9Wd>3_?(O#`>W&558)+;=Dop|)E+h<--q45gzw3yh7EjPVf+RMUIkX=c~ zv{>GUk@c@KX1sT*9iHsUam3MQ9ygQ4=A~I_7loY=yk)IMo?c?UX=fHX9drIfs@3(? zsu=y2lUK0bN6PA`E0kvDJCgZtDtra~>nQoy@*ZKlhqYN9+m_D?sWx}ry1J+8szr2|yj2<{ zvP;eK<sG*RT4o3+^1>#}Ci#8v%09y-RWv0a|tEceOa^du8lU z{?b(PmS;T6H+-Y%*gO2GjV9?U=so_ltF*D0`O)<8ul^w7)fR;>WueUzQ zp}@ERSnVYGC@7jMxA5A=(gx1H#($FfmHfx)D(Iq2E7O*8HSU$kwVA|luV%lh_LRxU zh|j7`WBbUsz^ML|eD28|Q2E5=$AmUFK%atIDwu4YA`L)fSz5*|ilfarMwhgYd|+?L zNpP8&3yn597Uyr6VV+EcGj<$)Xpn_QsmpaP`U?7#uvo;Lg~~C-~y?Pw?#NeP&A~(`lqKO=yfInAJvZV5F@>^O8Ut0$aF0 zK+G5!U!}bg1q4JUk;Lm)uj9Ml`yM*Fx{*w!F*P%bmlNao-Pd2S3t?_|hZ!|gHahUj zv|?Dm^s_Jp)pd!$RsymJcq$i4xN_+Vu3x>5JGXA5r>6@$J6o8X9K+*h&+&3%3KO$) zKx3TOGX^jz0%IZ1LzZ;0$Srd>UtlI2GfbE%R7N4c$NFaH&z#0vx8A_JZ{9`>`^fK= zF*!YphmW7(7oU8Bnb{dGGr12E2uDApC1ofs^sX)$-~(CTHi+&=|+iiIZq*YG!sDMG_?7>Tth=SOY~yOtXF#>3%U~WWU7V6}1sX zCnNx?sjU~oBNuV!?e{o90col+q-1=&1gjM0m(`;)YoP#y=5oS>B&EJ1<`02O?4m}( z;Ox3qMuAv?r82MY3??%BPCya@A1UZiG8t#kjp{*dLF2_W)g&sOu#Sj_%_a>#=JhD2t8POah@iw|rqtN!zn{J?VoL$*ptW zxDOfzD+%w@`-bVHY%Fp&Bmhf*M(G>Qg8@s!+Opb}X0K-VKw}>mX0?`AtqujS1e!7y zhznquJ;t*if($Hg|1`^}bByzB6GNh^ur^&rxbEQ|E@fmD%v-*(Qt3jd6*Zk4Fg`2o z;(CB9-S~A-sufw&a`c&-K|9^pO7$NP?BP2w-fTi)hrl|@SjQvv7c$C`!?c|mYu+%c zl62GoT17$SRo8tm3YW0J6}O>NVHZtxiB5J{s9_Z-X4PR6*3(YKEB~z8yiu)SUkW@B z-UeQsYo-^Ku>CwLt*Az+9ALpRxSPmP##;2VULOSWs$KtDPk5!(!-*M)9+X}yi9bXo zqdw+)I>gm_YJ%~5dn_4|JuWO=)W~c|(nx(JI zBJ7pA3tJ^WpV6XwTp)Y@vhDwpzYC;at*lW+sj^)9mm-ruWF8@nVxO&Ng$dTBwv%T? z@>*c+?z;B5Dx<2}aPhU<(Z`i&tY7UFM8T)M$df%6ZX%|DN zcXG85mL~#k{q($OhFWDcL^Ya}{M%(_serq>5=y~Do8!QQxpoXH-w{NO+u+{s9SEeV zQac5y6nrtwU>m~&=TtAsYY}xdu_zZO88YeY(Duf-Z42Mp?sua%_tO?g@u~hJRK3meHFlRpBL8~12i#9OAbT~Qu5(MSX#=m;l5YqLIq7r+<~ZW>cYtVWy81= zi^9|8k}XiubD>aTv1lH8Fy;f3(ZAsqW|v0M|6*4r0wz`1T(_5!Xz(P17vp2k@WmIu#*-)C;Kk@Di?uhkw6aDOgM@TgHHTn|zDF*E z!vNq_kH=!@(hv@dOLwfAGO~(AC|;;LYs(0>-B%*@bX)VvI%5>44wX+A4r2 zgOoHz$em9ZSHv(Xm&xU?Y_*Seck?(X?Q@jCOBXM(_ahjW&F+6Y#cW%6n_uhUJaRR~i53snr ziWj5f_~oyDg|UeV?vsXCBa+D!>u52XjE1&xeWW}Jg(7Qf0gX6)`W()mJA>P+i6eE4HbP~G-VT*ONw{yCL6cB(#Kn`hNwYSn(ZAB)X!ut9; z<`-8OxFgW+_{kA=Bc!O76dkjkmKcpgazjj~k{s+{pBZX-AwkgEv#e_59dTgPz$H`Op!xVH~z6k3TssLZQIjuy#a8v$6v7>kqZrGZ8m z03zm_UT%12VV8^KUJALccJ|zC7=K!1E*!hrNk9%&FVu@0>JwVh#g$WZ$ynf?T?ok} zl&}l}uSrRi5iR;+0xnvuECXP%_`7X?ql0DGv$9R7pugGqtj?mh_eaEY3Qk&zb1w2CRiYlgO#aE6^>-(Ny}Br6N_Ib$L^6fu#^;Xw{LM zQ=34&^;XcBkJf0m16GY1GZEEL*IUX8HdP4SJ*qA3xT*?Z1rJLh#{exjpdpBDaX!;-L{1zec*&8YpbTHDm@ z@+$1Tn$1|NCu?RNXcImDdmq8)Mi29sav6ldH4Fsx2bxoXdpr-Lo1|SwBOIa`iF4xF|tj$?TPS z2vW@sN2Jy=u$;Blz1{Z?GX&NcJJ)EGQR<>Ov=lyTzEBesha2>+{GiO<-|h8RVIi&a~hM zKlmZued}$U89B*9+N&!|n3|lx=;#ZaKX;aOis(?gwVlJ)ckd#*wT5H;J!ojyM}Bt; zx$RACXE*TjF7A-msU|eXh36vBGzTFm*2t8))sEQ@j7n2aT~8+ zzlq_Ylgv1qo*u*fZ@$Ef7mqRe@+GsTQt2i%#uHZKhgzEstFc591Y&{NFpW4UAK;J# zqxWgdQ3SRaE?vBcci;UMdV2cM+}w(}g+)wEPvYLg`xu{|WblU$_!Om((xpC^el=r* z7&&E%(kOt2p7jX8+Ao$Fe7t!60^WJ+E%f*Iv76@H+zdv?#xXfFhne{W?2ub#agPC; z{c?#JYy>FLAzsHlx&M)XJAo`54RSNfW3Ron88=_QhWFln3z9W-&fFjZc34 z8@wDJM>e<3Oc$CXq|?Re(3~OHH)aEpHq#+?cga03hmnypxNz<)PM#RX;NUR^qULAk z@OOXvH<%n7$5xJ9024@O(%35%xs0Si6;Dt^%p!wV#JuWiZ%0>W2LoUP&Mhx3Gk`TS zx5!Zh2ZxWNy|a@+EOPbi>}cis;BX%kW1}1ulUP{2JzW?)){leo9*X%L7M$PCA0XY@ zgMkz0@cNBA%%D3sXfToOh_OSU2Z0~bH!>9oydgHEu#H3)OITJ6I1>wr!DgAS)Mf;r z6pCdV<&OH7UDu4JAN4u0my)ptG^dkjO2t_ipT;`PB^LQNtRIQIC$4amHUTmOWGR3p z8d&67C%^RqML-G#);+c?p97qAP!>{WZ!j!Zbs6Qgid|jB)sf0cEGz=C2vjFmLXAMk z46H+8ugR)xhP>U#e zkgt1;VgY)2;R0LsfEeg2-K%ux(cE2I#O{wlZ7pNUs71-FJt|uzfaMt^KHJPSI^08{ z{XEPs&lnG{ZYS3DW-YV3y7{c%>S4Z;0d>R^dmUx2WpRg;!SbGJzgyAj-aPasza1bB z8_OLuh9)oQsf>6#;JDAj%TcQ@1hA0zYdu@FAtfO@tZkjG?`^fz>uf{!u_F)-E6W`` zIeH1pGUXgbey>LHa;`|GW|ae#bt>UDb^XP24rEn2Qq%U9lwjMKmuq%s%?j2rFU^<= z8Qv8a-8Qv9RK8B}oFprm7Ijvm#$(~7HlO^}L*@sqDT*(2AS znk`~B(u(Km9n5ugu``EF-P~XNcUU8Yl_8jvTX0*J=t6lt5bUj5Ep^oAYYno>GHSnv zR!N40*HGrB#CBg@{a_Mt+SUG9M;FyKG4sY~ zk5G|Gm|EJv2rMfIVqqnzp{<^?SlK<>GG|IENyRbnKbV@?t$Ds&i=`HIeJwBPWk7aWl~bTu?H}MFhJ7>?cd?h-#QNeiN;|8F@9$z|ZVcn&lj!X1!_e>ue)Q3gaqGtGNGIZ0TUx?{ z`}Z(0F^1XMDcrhsgQN2`#*@hB_weHRbL8_|=1Y_zwx;h+7pzrbJp)nB2jr;9a}zPW!7&mZ5#?9?-q_BPSm)rPi~CN!s0 zXl$S`_Hkr)_OQOai@C)$Y~=DdY)k@iin5o)-p&rQY~Hwb4cD*T!1ZfyU~u3#YeUV> zPU7*CZ!kLg6l3G#NTxCZV8!C1L&RER;!4y=%o2`LC|X3s9y=(Lqn0HK;@sJ@+?FJk z-`3WN1p=^Urtsj&BTUUrBVQ;m!-jP@U-HmWg7tdnjri<#l{u2Gk7{js1)u!#7Z`i-97{_}EZR;QW2`G>JWq%v zLwaj1%}p2_IL2@_fe)jxcO0}^z0^{@_FxlED$N+!CW z0kFzto|oER937BYl!m=SKp|`J8GwseS_)W*rkd1ISw9NAFd)N1>Tw38o06of7DJLi za$XC>t=I#wyvTVJZBT#|2!O?|gv7)Wh8KZYy4MivRCTQ6uqmjFyWW{C&|Cz_%4Nr= z0l$QGN|6yg04teLCRT!hEOvY3#nRE)B%-)~MFA_1H1p2z?f^^Nqa z0>#0ABC?MeuuRYPDly~&ST+r>Uu*yqvsa1f;q6J>rlwK3xy^Z3Ef#Jcy`ndpm%O9b zcEJr?*}@jUA`y4*)+)@vQ~*Paq$*aV@1WqF`0G6<)N4G3J?G_7rRhdM-I{Din2!{PWeO~L`ik_;s zG5t27%Ymu$5bf4ESc>Rz;VxINgzov~U+}yfR(WG_`x>%xeCwK2`Ax7cVPme|`C@mD zkZ$!D0JZwu|9x2fYNZg~U(okpxOX9V0-8n|zOL*B;9qs`Zj_DFL z3^a11eb`?C04t1dY+tLgj_QJCOR5{5`5(L zu7nsh;;5{KIU~iUa`<(v^eRZZ-Dk~Jj6e5gR{<1x$QrT6?Lb@Xi~BldxbHl@rtuC_a`oep$2C({7@k-3Z$5U6sEQ9w+-GU=J7 z^=|5vnB*TY9I{;xfJSG=wT;-Q=Yy02^xn=+hdn+Nny7I+{S0WQq2)!@OQK{+)%iqj zgx=*=-QM_{{^jUa23*sFANL&#tPA5pwOW)pWrgF-=El`m-4o*$#O_DjNCyloD7(x* ztRx&fB}38nni|T;Z>}J>I*;YqaU7O%Xm3tnVP*_ZpFGFq%fvdmgZJP6HqM?N!TRb7 z9^AW&zxkX0%#i|#?eoD0@8N?FzRS8%#o|8Z7v`~F%A>ox4W;5P*4I}!V&C@GCNs7c z7gy2I(TmQG9<;T0u>0A}%rs7poW%9(*RY+-A-lPWx%oM4Z*QR~lSX@cE4sRSu~$04 z*7h!@XBRL#yMWEj95y$%SD}F3_=`XPGyLVh{Y!Lqc5*vBdGZiXAAgN!PrkYQ;SY(i&yE4zX1?v=5*Q^0n0M`8cG@d>iDFkOq2T}+=EJ4Fkd8nry?3-4WNJq zq~%0znk1ax&>&*qnM{UV^q5I@aKIoJ0cr7u2AnxH!XOq!42;K9aU?>=?THdN~3mX{B|vHM7egxe9Jp$-6-`$La+HBd+H93)UFGRNWWZh0(AV`69#otukmb&Bo}6CADfS5K2s9j z9;9{v<*%;9w0BUt1XMCJkKJ;Oo1wCMjgFzZg|Z8;(eF}b8ME{Z7%1)O|IhC2dLic6 zc>JBqbWzL3*;72?iiT7%0G1jbR#!}Ow#b?nuPu8{Byy^i__5kmzd5!sXqUDMBsLHr(ru0~rqUspI3Rt31UND)_NRTiP3sb|;es5UX5 zSG}Cmv2V~2yDrw%auprUZ`~R$;|FIH!16#J*;*9DIkbc#U!EFP+T^cQQ#+TRHSOzc zgGL3z+_t(d@#Y#+jbi#Ox3{!+>R#_PIy(~iKrFXIlqsd}=_YD+hya_PjC`?QMU+;W z+JuK!aK%YJXhGOI8_-NxOZ0-+M3T0D19SUYnQyWK>Osc5@36G&h%^i=KDcp2CbchQ zaZ|8Jh0axweLKgD$$8? zYW`}=Y7 z@Ndw?09GTOK6!#?&+cRN`9rL(%mIfbc3Da%;|yTsO9v<&G+@6WCZJU^jaVXu##oZU zB@&$9&28hg^CTvI8CNb}V+PsYULFezGZ-Cxg6ZjT%+Adr7EiFKxcIHs{$Cao$n z1R6;%j70Sfs6^USr7}fmEHgWg@;KIa3};79GXraAXn-T?O-+vD{-ehXE)fIk(C8ac zR7nDtNVuK#oY-ec#ud8|avKSNMbD6HF4gS#&>+r?j4)e|A}P|4T;JTpgGY~9(`$QY zM_dSFjSOJzm&>e$MUfvBtR@|-e4&WkP66#5UFhxUW^nJsiQ_od*N0+Z7mx3MgC`H~ zGkcGK#+J4=2J`j`MQm^7WIPu3&_B?RtJkjL-1&11U{QZ=Zmi?e-~0wIUXCN4${^EB zZiAg@Yis2Qg4Bi-L?Dw+qB)adjW?>_`o;!}+V2+&47#Ke*(n{hE!7vYb6nYMIc3Sf1iP@Qb|}h1Rm+URN@b<0Q8*%I5koF2*6@@Gg;rsfW?+%qBe@U?GmWDa8sLfMv+80A zC}&Tr6 zfTZpn4yDPQ*yQ3vqDFEXo8Q91GGhHUny|Va8kbU&2CpZkuAbXq)a9>tiDhM@bWgC0 zl-FmjiNq}?#))Y?|K92Dk=9;R%pk-THUO5Jh25sTB840h!F>o$n%NKHVo+t zJL%Z*5dfX&LU`#11RQ@8!N(ZEXvF7lzU~ zhp?!+`^sEr|5oWSJ7k>M6H?MD-_|`GD%Pi{(u-S@_g_RedHonQeZ$s^Iu`?PS+1jv z-A6(T8}ebbMWK!?y#@+a$f4D|V%NOVYr%o!>l3F!bEz~;Hn=AV5r zm`m{A6)hWhplVfY|3=h>KlTP_bd75)2|Wxq=FR> zD_Elk1GP2yKw{h~wNJQafsor?-4pJqwVG%K)rT0E-`V{p8P(PNuQ6JdgkQAO8csx&Jl0Q=J|e!R_0(`1jzz5SEu$ zu#?N9v$F$-hb648EMQ|}1=-DYWV0LmdueGAtE-#XEfg8Rx_13_3=AAYOLH^pO%aeW zJ~57&=_zb&Wm&7JqoW=kx6g4{uw7*ItN_kmJJ)g94V6Bz6dah<5*umPMtc7{{8_AV9m_UU~+l_ODjtZo>25e0;LF4A^p#{>2x}Zfj|6!$vlXTsDW|UWubSl56SUi6Pv$brWYVoWq&Zr?FouVRt8o zCy$?CZgC0mR2l~jjoen$Mg)d2Gptm!!tDgCwzai$|88z(v9i2?RFe8M!Hmc9VFLR| zqN{fZSFYbgZ~p)b`V&j1K>bBx_Xp(uCx8e6TMU3OE7Wnp<2^y5|0#Qy+DY8ds3qw; z2@bG-K>N`lgR}%*5g<#V?Qz5WYb3W)`f>IRh5a?MApa)T6|n?~bwxtu1h$b#`C)^& z$uUcdeyg^V2+H&Nui#J+B%(dh{Kyt5>zM`C&6>?F-UPG}d$19rgGG@O3BV#DcN0C4 zpD~dN1@tll(aE28a=UkFAQKVC*9!=B*=A78fMe9>?5@cHBTVF3)=NC#c}DE3f@NPx z+i)KmeJtJ=B(Nm+8uf>`J{tC}`9kdm(bbavcgF&OhoVI$Z7%MxG)DCDMS9O=?=d&c zH4oK7vp3n%0G8e0HL|2l$FrG)t?Mwm&Bc?I4RHFH8DUYlhR49Fa=s28ILyDTDdJSL z;&AKOanWZKHN159^^C}hcWT(sb)JK~%Gwi=--xb$SO`B&*UZ~3yYp~(mE_Z-*8ivg zmUSg`SXu6^r7c5UtSNgsuw@Uea&Y|k8oS!TqI$1*#{%=5Z`_)6BThHIsET3P*e(w{ zeOD=0MFV(8aBFOaQZoW+R&BF-+C`sn$5qV{8$Jd@2c}mBNmT_kLi*EffKS_c zJ2Hq>W3dQrwjhAzr4ei`|7h1)bCkZQ?^$IyFf&d^v-@Z_*LVuX=-SXIV z@fGGw-LI(TkH7d*41Xf-zaq9xFA*h?RjfoF-CigMXV`EP!P`v$xEKk7NX0#XvS1 zN9KKg!<|P?R2Ls0W-J&V`zffIWrT1!SJiwH2N5$aoEvdtU~-vkcbc}a7fn+B3cxgC z{<;7b9ZD=eNdYXU^ZesdkTm|EvK|}_QFY;wh*Jt+iR&RpdNTs-+DkH`BnJh#L>yiY z8UkX;IwD2WdV9d5E+LkUpsYG}MKM;6iXJlqLDJy%6fqiezEznCz2Vf}Fu!^1$W6YM zTYyM$aZB!PU}NSPit95-HI`U#dunEeUEz9r`takAevI$D|6SIZ8k=~5|NPhg33KyP z=<4c3e{U}XE=}naQmG8uTHDdm+{)m_?oJldGZWa{Smj7}q<^)&y@~bpHFoyTi(F* z!YU@G=droIj^f@PzWeQO%tQ1qLejnLSga z2!I6IqzS~zAQ27=a?W5lWoSZyyn%xMG4GdwgP{0xaSmV#Jwzi1uR@Out zqk}1dOu|~C!!fb1Qi(KD$u!Co#jHdcQ!zd?>qj81Z$p-XvcH{KPQyfi_ z*i4l7>@2w`K4*QZ$=O-f>LSpDqo?LbLRj(ot+ry z??;M2u6UdQw4I$DEG#ZzWo;en*(?Kk1fc4gNMn@Ro7^hdl{OY<77`ui$?YLfS+`W63MYbDb39PMeU~6-W1?%@qQt$rZL0ozLD$ZYe4VPZK z$k89m#S)K;iJ56^@9d&bF7f0dAesO!2C|5Ol}Vw!t%bp}R3?L+-2!%Y^T_XRBb|z) zDV^YGlmuXx@xcoLVczJZRe9v~KH*E@C*BZd)C1Y$KJ6>CJC;U&FHAuwC_ZDqJN7(j|#0|lHCH#PyU z)P+#o22C_u3K&2*jnRElJuGE5DVU|V=Ir{Y%qyP@p(6mV8ifqt5?f3`szxMY1YnUn zq(mVlrWE~6Ag3_0be)s6*6*6{t^TYN765A|6+i$0AOJ~3K~%69FlLa+xM*5eP156% z&lo@@_dZ%{iUeToBd>0R%1$G|Ny1F>*wKiJR6Z&*myz%#!F|p8O?!|qc6n?NP{^*D z+6U4nBKmHA6ui_Zm8=Bs+G0jX-s}l%SA+mqvLyxWH$S7u?2>l>G8m=oo!+)4wu^$0 z_Cii}`zWSY6$VxSK?&G{)_!ry?gOv_mY>qlqYS<_D-? zGj@8lu4;sq$o4w0G9kq{?o&Px<&}o zM+zf1rYbP*im#eH<&-fXc>~KC+Srjs_Oj z!nn(M?@9k^&x)WiU3q&YkiSfeI-l#G`ddLJPtQxVMU+Xxj0gizi9QywWu&Z@+3MW- z3xE}qLy`*dDhOrL)iz@w%zP)M6&3&;PEE&J*C5q1RW=sop>vPxt|HLtdTE-%MjOe<( zD@T&!raCCIR?b0V5{qkD%rCEFYGwgTi%VEr-N2nYZ{g4W^v@aa%A}j{?AbGnjy}W8 z>=ZUP*ZAO1twINTV*ik~Pcq$vR62u1D#iV&?2B@-C@z@*gG)n$CvfS~HS`}F;s|%k zD|46_A4N91%3}1wx)R+e0-ER$NnlkQVedXRvGQVD&1eK>Ra z9QyhO(bd(*ubFTj`=wd??y<|cLrC3Btf+}hd}_qn}-unsxeT$wen z+FDw1a`*(k`|a;=yHgvG2s%Xvd^s_W@u?|??I|k)4Lo9f5gZlpg$^T_3QIeMQB4KmdmDt_TYA%ZFvu8$mfj=lK zt1)HPIbm8ES88>s7CMw+AR3oPQy&7Vh!^pdC2RLtkoj|z zIZ@Yi_C53mXrCh$@D=hq(kn-LxN@ij2E2cX(X?GXB1yv6yS50yz209okGvjiz~7?| zzfWJ7Y;O(j<9nxy_Hd`}VQ$l~neR1+&DG~^r~=*gay?`nay1Qje- z6iXcl{p>BzwNt?!``aX{?o?JZ*#JQ1Is-Ccj zba%F)w{IBd&R;@PODDei>K>-1#<07)O^!H7BpMmOQU+F*T)c`0px^Uzi#T=aG(P(1 zBfRzI+qiZ6CWBYgGgAyYEzHj{!=+ zR05WEc6YH?$fL8P9c``6d@v^fXeYOW?(S}!Ieng86npyyFh9S9x%pX4&rD)%eMK~{ z%oa<(WT}ve$H59fu5e{ObW`L(8W-$>Ms+4&D3)N>+y~$KfHkEEAXr{n#u$TFlgz%` zH@Zfy=|xN-iY7>m6sm`?R|p6t(RH$KjjPjsnIlG~lPL@j4RV`NBu4_UMn_+=2G;8O z2D|)`aCiZRQpSYjI|o=Eas;XW|hTgQh_U|?VXZKP3!17z3NFg-brr%#`; zFgyWEiwt6}ao>=#81-vscNhAO5r}o3h4}mXdePe4%&w(RU%X)OZhI$(R4UC3FzSca zmR7X4HKDa7gYM3DoH%)cbnX;ZqlI_QEA* zFf!0(q9QVobx301WfaN;WF2y}KXDBd_9laa`^2_NFhi06af!Z1E|vs>HZgcf{Y%fX z`>An%X4Vh66Vi`rk(-s)-IBzWnpi%<{Ndj=>Yx#ACqRo_2ARz(2V&aYxeh9jZr3Qi z1TllrBZ7(xp^5UR>#ZcGK$ct(hz^zNT**a&Fs}pvwb zt(Ph=XjDalB{lM+VP6?>cnV-3{o?^x>Ov~oXTsv*YTD?KMn}=^_1=ZP-M_3XkF=C4 zS0MPFb2UYe*zLyEr8fJJcOz$ac)^tXHV|7HCLIG{xu&6GnM9tdoFk8a{|h(kjBWEO zhqS17T>lQi@={2svj3k5hi*G`zX2u~q$R^KBKEpK5?eMTCK1 z8wA)i6>fBH`v)4v`DgY1tE+;(hrCki7_7IC>q9>3Nv)n|>Z@60oBQ9ZHNJi1xQHyh z(pD|EJB~wA^1WL%p(C)ce3Ky{WEWNSdR+;_-VaVjx1M!%YS;o`7X64(8rCUQsusO| zR$c8Py~Jw{L$55s2BT3cJe z#`+eDd;3^h-Ne|~B+i^Ui$D4JCwTw;5AfDIZ)0(Bj=`q8U;hrzo<7FX;v7eWJAZZr zecc`CY;8g!#)u6c0t*BrZERt6Z5zugTX_AAH}S_G{|P$UI~fRh`SK+u#>X%>H-pXW zx`0yTK6rS@V&oK2FOyC)s7EcwBFh{Vi~t4F!6|{5Sj55^7&wWuXD_0+caXsZ5~!b> zn?iPT4cobG%ZDRTdJ+()bf^q1Ev+b&O2}?+V>e$wxmZAVXNLe-jg71|MUfY~y1H=Y z%y|qBon#^RrKMFYEY4$cY67ckD_m}MEhAbYMqlFDi|1J1++aYCfVSFz*RM+yQSoM)HOU2@^1^~S7uv}Y)Q#qMa< z-CNi-7Qi9~7V)TflOe9w0S8bZeK=tGY z151R%MZn!-198+r0=o3Nlzre-hs#9XQvk~WQe5zYSy2WeA%IHPH+vCbE^*;#)()>Ab{MkXTHYCyFEWY%0!ya)U>s9b64Pb#D> zLYv1MP{F;RdS2mkzw(`WTH0N|BKpw!{ny(9^^b*mQ}jPqW6h_B>usWn0{s77b~i)G zi`mE#<@J^3$VEHy3%=HtoJ^kLo7nCYypOrf@o4UBj9cfTa9?<>scostHGr8(tVQ?^Rwt&psGT* zN=A#%tFO``FgLu8+oC%e{NRq`*yxDNiWZa!oTDy{rafGMNb`1Y{?(Az14nR3SVP}v zv*<0pf?&3MJSQ}|oam8wfS5_uxbE3^oc-BjQ;F6Ifh1BbCt6{Md7|~x$Xx=OdBVl) z<`}daOax37j;F&^CY?faCXKn7X{^mW#pe7d@@q3V*xNy-iP%&Fc=z28@X?1KvQ|`X zYYV^m)h8TnuPH;WV>Gx*M#MUWE0-?f{KacnS=+|=)B-;J^b5?*Pa{PU+?vx2(j0;! z+7%hVT3_G7POgBJ<#h(IPM;P4>s#OY0B^nh7K_Et%uM0)FMf*$_wQk1VwBy8MotXj z|KsgFgDl&w^RTbGZ|d8(bIxgUdz#x&LNS95^vdgAjrLuonvdXSvGE20r z(hrwJma8nvvT0f@28bXf5&%iyfgsWgGk9U%%yiDV`*z>Hp`&Z9wbwrToO{jWzqpzofb$*D2N30-XH0>W8;pD6lP4O0d@Iya@&wt^^(bAIP z`S9L*k1;nlgZ=$o2GLH>PMAqVE@$bMG`rP#qW7kw98i~Bya>eV?de5-|1hSeuA`@C zkO3^x_*z|C#$k33x#JwWgORwlh@Xot6pf8|GQ|Kzp;Tg5Eu5b*n~e0sC=wvCrLx(q zFtDbtVPs^2Sy($e``Fmp!2J9ycK3GJC5griF_UyVCL+=o>=sI(9x;7X1X^r^(Wp8l za0%#Y@5Bc`@BvJWPogEA!QS3J7MB(=zqr79Tghh9>Y@mY0(?<~LDDQM5>V!9wW(XJ z(dbc~EUFK&hhBc^CEUGx7o8m)$mMc)_0@0S$;=FP_YO!rPBgHLyBq0&(by&Nd1^yK zG!y{lNPB2PUvEFUI=k7Gj$FwuFV3*BzK*9)pK_GL!=oIty9fxRC~xstoB_e+bedfj ziG?*bJdEqtu3&6r7+aegSXx=e<0ntBy1tI=;UV^R_nE;(%(0PS`K9qjN^9bGp3Zm2Xa3vkytuu9vNG$LfryT2rwa@ zpCpQZ$!@b8rH{4A2(TjYdx!e zCnNTrXlh~?;)DUOi1EiDma&!tc5_@mBrviz%~Sn?s@xz;gE+>|-b>rASMeUu|pM)|ibBeXM$o zyf(>;vbOmFtY_O^*Zr1rbL`Rkqj!VRfPuIFvK8|crrMkOu)bZ-j?_H}Ie*uhWz7eP z8c!x=J0~{-7bVcmkb9XKUT*t-`}5Rh5p zZTy4XP`UfO-FNtNAv;9x2vYYnsrrKHhp59~*!y)2PxoP`n~Z&mEM8rCXeyP4xznuC zg8LDLwWX|5s>rWv9iNqZ%O>w6S3YH<^Qu+~Z=6?q(zAK~Cu^}YfoJ4oQ+1d|KTyxR z(KG#-3&878Eu*!baz1Nmo*|FAUa9NhXRSo#@lZn%e2;`aUqd3#QTm{pRM_zLEq}G< zy!;CYmLcTJVQO#~uid_6XiDY4^b;T6fOf@YZeFBSq)4~|i{u8fWj zmVj8%3@jIX@?6(ECY2;_+y+bodb7_ojtZ1p0L2?l^lXrUrC^wp%U#&L#`XbN22gXm zjMFu`DZZshHOXA94+9hm6G2%}rFm>Gy@%}PJo3BCILT$%HSYesm+;CfAI672_(9gK+S%U38?V2H z<>fiFW>UDkIAQn0woD5K`ui|3Hio`|5j=W4gC|etv9!F(kqi@w7_*v)g+(Z~M z9A%H(!bm5L7)2BfvXKwt>1GmkZ(?w)SST`stFyBclM~Yz8J)!N&?xryve??*#N7N0 zc6WCen4t6t2(wW!&D0au(MCDIn(?K92?$iXJQJO^_SQDM_`*w=7@t6UTL){Ft#59y z8{z!oJZ}?NCn!cbOrq073@l=#G{%}37}DScG#1&_kHoGEMdb6x7LX+X>;Aoa=gYyCM<=`Y5sQ$3 zoz0C6Jbv;RTRS`0+dsf@p};y?#K0mU@b-=lq?((V1=rTmj_%G*+`e%GlM`de?(bn~ zWd*Ol`34pi7qNeEfb78$ve`on^bcWVbO=|bC(z&D%b@4caS^+FS#~AtY;WWKBX?E; z-Aawk=opwlYwsx9x_WsI6Y$68(-A>p@KN2*7$_1qGy*Sp-m-YOxQ@}kX}*f)lL220 z<4U8RnrSZm#lIBM&x`g)4N2`OOf~_pl+`1eR>Hy}@JiS~A_z{_!jP-f_f6J5<3i}V zIV&Sjx0uGn$r@n9%{|j;7^2D)Ro7_4yiyyl`h%XW6DA?G1p!zbb&)`=gr}@uCL-$+AyeOB z8?Ua323S+KM-_}$K#}U<@Q`_?GV9ZTi>$pB1h5PfOV)d#Na-Bc_gP?{S;5B5(Ag8% zbu?@XZ59j}fepgK;%mR;d$-Idk*+_P^!YdL1f zGrGNW->5U+S{{!|zG6WuBpmjYO)HRDu%9Zvt9|4RaAg?T*UC-}UQ600m0?%4!^58l zxQ7K(af%k5L3ql+Pra&`zrwPvP!0cAI+om0`F+^r2`|^`EmXA$YkVLq&)RdZ`AN^3 zI^{BkPOXTq#Fa-$ONwTtHl(l)$?qh zJLkj88=h`RXO}$~Y{&XaSYDcX-ZzU}y|7uWSv(gQSIfAlxgh?;YJRQe2Wu&8m1iRI zdd?#FX2x@-<-2_;tBsR*C8HD;sKBIExp;wZooSmsVA;co ziC$+IK5ni-SG6FRQ??HXFu~NW2zceNa?BpfW77Gf1i9KvHhLayVohWvu9f3u=vy(k z0!q>I+e!J#S@&!xZiiV_ZDhOdiQ10=Hkx1IqFs5>7l z*kuar)};FfbwzaTINz`n3&!+~92U=nO~7fo?wYa}QSoMucy~!G8qs}Gacs&*+)j;_ zmP3n^gRzN9s7@p1P)zP+d7`)n8r$~EGv9rB_RI&-hVh)=d>+Fg)H95tA1|5#yc=I6^ z7MGCDWSGIj;06P9k9C1%kQNA~;dXMYqg+5;8w2GT1>(6zWP6`A(%W$Yk2_!V9n9V;}njYg*A6 z_VJUaSXh|F;o&}xa#)@r(AwHAF2SOAE&vX>XHtJkXYy}Hdpk!493P)% zfpunJ9qeLlbs5?0K61xLTqXjoSa*uRpHflSQVd9tT_DY^IE$Aj6BMPd5of0-{2WCO zY;SMJ@bD-`M<+2lGLHR&Lu~JCVQ!WHtZfE#2qYuc869+02T4F$Jr|6CA1W^yCct*#kVCd5XtRpWq;S0CIsO?JgR3G%j^4leQDJ8R;<* z6N&>ET#&nBiGiQpogHplVha&?b^F$B^!9XfyS)C|8+hlv_t=e)#%D{W#YUB5H%$_P zr~Wi!p63Dys~a{O>4>$rb)u)IhXwr;u^2P39=-R78C07)+X8x#nElBK_Z^AnHxOIc|0r+vJu9W*f{t2pg^YDJ8ds{ zQvocBw%CMJEQaQUv_H95QUpe7Cn~7~%b;=*SnRD|99golNg^CJ(fk%JuK-x&dMm&W zwGRpK=gEDL0j#12U@>crKu5M{-er}#J*ozl(d`nAEfeifwZ3>9XkZXZLe?VDd?V1C z`pW>0h9&0-=<8jFnd4@0W(JlC1fV))K3Br1+dZ~#vZ-P-r(SwWXS2#!0@uhri&=LR zz%uTl3|5-U8oLLvrzK)w{i5qa7_s`-b+~)(U1w+^YAr&g=j^^Bs)*Ijz%^`+_dh^N(_9!oTy6X2+N^2Rp|tM@4O;8hSs}HO?zv zSqfE>l&`g;+%`8eGOQa+b~Ti?S|{q(I-1}T$i)B8Y9%o45>-o4**}C4L3@;J;mz(Z$Oy^L; z85~++c}2BaXng~2y&=nmYa@fB_+=5xEg`sbs|YEl-H%Vv_>Sp~4ns%Z4oMW@DH1ccpV0W1rMnLUwS^>RD8<&Ya~ z{zL&o*QZ*UMA`;UU4r@7GU%o4ybC!2`aDIbK*>DIVfGllrwxduK%I4oGxq{#IpT`4LzMZ*(D%^9ba zX-Q*bWC-n@-PqYXU z86M;VYXj>!oifvhVIkH8BPK=?sZ<(w@7%*jKl+1cZcgL!vJrE$b68qgK$Zb40%wl- z9oD}}r;u*W;NpV70|5|RS4?hq6Je5~>veVZVr+bpfh+>BvIis{zrqYGav>z}Nl3k~NW8pIEHERizi$wuqZ8~#c$ht6*FkcDBmj&0 zpVDQ0EyK1DHkksQ6s=N5J=KGsAw4z*;~F^19z|xnbNdb^Cnhx6$3z zh0{_AZ#;N_M~|Oyq(fqukp2~=mq;c!svohuibgkzz(o>&C#Ds%?D9qKPXe*}`v=g` z-o}ynwhRMnd2I!28yiTbQ%EHeoZmU?X#tG{7$%cQrCZRNZea%2mB~qVk6m6_!5@9; zkMQX6BOD(WSq8nSDT$8G9`y9~VEW2528V_ai^o_GX=itr+nRwZX72!PZS6>Q4I$G% zj)qJRPA;2_rj_XFv6#7yoagn8fF;IelUtwxmY6AJ)(vI|S&?%BDNQ6(Mq33!5f+id zE;938?1F%g#3-T&gCsnzx=YHyQkOFZu#6c|-7d2#d8cF}Ag*?gK@(LJHz1Q<#s~vT zEwC3A(7FzC;<8wK0^p9oyL(w-<~cF2lElD@$IwiX850yRAjV8aip0opJ+}=3Ool_& zC^o_ZSd9|hP@)(LFh+Kp+JP=MSU>Lc49A5N92*xx(tj%wxJl`n0GAh+EK#pGob)kA zOq583+UM*NX~%#7TC&`${-f+7RLEZ#bA}mbToz?5k;sq=BFQ=>G%|MURE;bH!YP1d zTDWZQVm2_ADMxFmSX52fL?8*w4jeUG>M(e+ZuZqk2dE97HuMY|B1%};mNYPP+wyn*Ut33V8&! zAHh0RvS}|5o#Er-MPKb@qvvUasgSn1ib-~^E1%4L0gdEkVP;5$)D6LA;?s)K+iFc! zX;$*I>R`#1+_;{Zgj91xKs58LxjolBwMk70Jr_br+@xegUdx);eBijUsdh;@z!sv@ z6gH+T`^s}UG~RUffbR0lb<^yvBW4q>b2V#9i7JT@DP?)7O}86hez+d%RtJ`-X0oaP3YftAhfVRK`R(ge_5@zOR z@$dfhPx05^`WE)~_Bi4lv8`C6idcy8xByG36a!ckxsU!%rc!8c?_hRRYbL|mVlTb$ z0`A_q!^|}T&K^8?h{rQev9P>?T%o|_BQ_WPQX3Q4NkAF_a>U@Hd^0T>9OsXb%N=t+ zQ9BL}4sirW0dq7Z{hcT@AvTix8CA08H=aT($a=ZYdhN7+c7jUjDf*Hbar)d6YlTtv&$ucpl2r~ z*5Mi&9!BTLRkRIG;0m`j{ zgR@X5c*S)w<4hvA>H^`guuPB)wqr*7%5@U*-caVKxdgInwgI6UVO$8CkV*)EMNBOE zFS!#ENJRshZ5|tN6YPW9h(W9-7Jz3~lwplg`_cH&=#114B-nnG7xzJ8VNsw60<~Da zj@g=I)kNt_+DM`s3K(Y6x7uDt*NgJkh=+!yW=MIqpF9^p@`FK zOBq-?hA9zn!d(T(XnjfzD!P*+K?5Sr= zzvkC!e()K~UuJ~L(|O;D@N5ZHd&?W!GB5b~YA;2#R&d(8=~R!RP=6oz@^dmXe-Z=h z<6|CxB~Xwz|2+nb-a<+dJoc5#Wb!nSl)A4BVqJQ~26(i7Zc6>qPF%0hx|VrBme&Nz z`qEE4O)d{ik|ecOrsLc_h56e)!C9-FG3&6y0YP<18jvitSQNebHIWQQ6O$QqHhDI9WIyw6o;wI2f)8!eG4W~%r40{_Z*xy=0 zZg(9Q#RFtg36Au346d^_%$M2R|eL zR%0WU7MGaSMeM6$G0%)A0u2a^5kP@}0n+CZcPIq~RntbJq@~l%Xl?Cem&dN|eq5Yi z;^=UnMduIpcNu&+CHF=X!H{&JNEeHlOGzp>F_scsZf0ee126q80M02#Lu~Kp!pQJA zMn=X_D4u{ovYFY(tPMtNHU@HSRJaQU3<(S(rWDnSMX1k3Pm0F_#EtCi^o+sAL_C3; zH*VtUm8+N-o8VzY0_H2Lt5{fAz#sp~pWv_l>YLc!-r-1k1dOTstFTK*pqiLu1i(?G zxESY6Or;w)uA{fN2kq@`c=5#-aQC(VSf`~Ey#4mucse(SrPWpJXAc>eB8C->9|FM$ zBr6sRtfxiuo+2c+q|+>hPLUhQ=PQv+p})T$9UbjxPNsMqZf(n*2Di-;#*9}p*Hr(CqXU}fC~XmOZ(kdg8>tbsJyIgo;bY#ks5W;V`3}NNPVTuDRmnp zyF}&EzVhwvE!)l?5m|1R_ySwFlE@%9B~%;;sC@*LC^G;ks2Thq)X3e_?QU{Q7g zqM7<%|HU_SpCO~7(&n(z2{E|6d!{pNMCRsWFUi0Njx4vA-gs9GADKv(Z9>03bBwh^ zMW3teQ7g2~)!qbN8A;jp(?|dCts@kPBWQlgn#DmM%aX6MQFqfadz^|DC{L~dpT3sH zul{In*?T|of2?3HFG8T@T^T$HlxJJ{IPC780%Oj+=pU59^nZ(vwel=IL)&kdQJIv$nOEKP;L_*6iDFm$@;9W z5pJ2>`z5yxxK((}cz_W7Qvd@=!E>`PtO3?465vM}RGua0l1el2>)z%K%q!6e z5j_%p(X#FMGZDw8gPyvLh%mCa;;3F0AH0mPFQr3uU{^zzv1cNZS(gpx&}zX?Q+Ne7 znl4U}!U(<=_Cevx-it=i~gQ2bar;I z1{C#ezHo|EOE-G^C(+t5fR?saEH2Doeqj#F%S%{ZTgAr4CNot?L_OWo%n{&-xj=_d zV&M=og}@nNMGye1Bn~4Fer6qRr%jL2-IW1ZS8-1smal|w_Ka)cu_q5R+ zBd~_*9b>WRIMV5M*1+oN9^jEdZLqbqhP~Zw>>uni6O8~YLfGg~N`MUYEdf3R$PiG& zEIYIPWEUnDLZ?W9XYAHUnq0%fW6Z)LHV6T4Po6x&`sOMNzSGzv_f2*=VjV1DnaCIv zCJE{2lu9Sog^<835*t6t9dlW(U%Q5DSFSOLMF;xBqa&=ZuQOYX0G(IA{ta&T+)=)K zd*VzB`y~N6QgKL?=u6dv%Lf7r)R8HH9Nn6#g!H89PG1;DY5Cu z4Us^u=5({P!x@#e$XZ3zhi4}zD6qB|xk5IfyQha4SS{%mj^IeHmlR3x-FMzWJP~J5 zljp?6IfG$G#{~w=NYuZxy&aQdqnMf)$F-|h8Cv+tSH6k|4eFm8z=@U8aG>r%E= z#>y$X$1;h73@o#J>Dp)6pSs35F6rf$En-RKSLPUl^=6^;@?>P1zt`u*MOc4@4N9(r zaWgkl1YVH~A^n?v8Jtpfl8ESwpt?jK6d=nyV?^&2z#;}*p>)as)^X{KqYu)*DI(#? zsQ`=w4r^Np6IM1Vy5

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ +" +``` + +Now, let's do the same, but this time from the `east` cluster. We will first +export the service. + +```sh +$ kubectl --context=k3d-west label service nginx-svc mirror.linkerd.io/exported="true" +service/nginx-svc labeled + +$ kubectl --context=k3d-east get services +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +kubernetes ClusterIP 10.43.0.1 443/TCP 20h +nginx-svc-west ClusterIP None 80/TCP 29s +nginx-set-0-west ClusterIP 10.43.179.60 80/TCP 29s +nginx-set-1-west ClusterIP 10.43.218.18 80/TCP 29s +nginx-set-2-west ClusterIP 10.43.245.244 80/TCP 29s +``` + +If we take a look at the endpoints object, we will notice something odd, the +endpoints for `nginx-svc-west` will have the same hostnames, but each hostname +will point to one of the services we see above: + +```sh +$ kubectl --context=k3d-east get endpoints nginx-svc-west -o yaml +subsets: +- addresses: + - hostname: nginx-set-0 + ip: 10.43.179.60 + - hostname: nginx-set-1 + ip: 10.43.218.18 + - hostname: nginx-set-2 + ip: 10.43.245.244 +``` + +This is what we outlined at the start of the tutorial. Each pod from the target +cluster (`west`), will be mirrored as a clusterIP service. We will see in a +second why this matters. + +```sh +$ kubectl --context=k3d-east get pods +NAME READY STATUS RESTARTS AGE +curl-56dc7d945d-96r6p 2/2 Running 0 23m + +# exec and curl +$ kubectl --context=k3d-east exec pod curl-56dc7d945d-96r6p -it -c curl -- bin/sh +# we want to curl the same hostname we see in the endpoints object above. +# however, the service and cluster domain will now be different, since we +# are in a different cluster. +# +/ $ curl nginx-set-0.nginx-svc-west.default.svc.east.cluster.local + + + +Welcome to nginx! + + + +

Welcome to nginx!

+

If you see this page, the nginx web server is successfully installed and +working. Further configuration is required.

+ +

For online documentation and support please refer to +nginx.org.
+Commercial support is available at +nginx.com.

+ +

Thank you for using nginx.

+ + +``` + +As you can see, we get the same response back! But, nginx is in a different +cluster. So, what happened behind the scenes? + + 1. When we mirrored the headless service, we created a clusterIP service for + each pod. Since services create DNS records, naming each endpoint with the + hostname from the target gave us these pod FQDNs + (`nginx-set-0.(...).cluster.local`). + 2. Curl resolved the pod DNS name to an IP address. In our case, this IP + would be `10.43.179.60`. + 3. Once the request is in-flight, the linkerd2-proxy intercepts it. It looks + at the IP address and associates it with our `clusterIP` service. The + service itself points to the gateway, so the proxy forwards the request to + the target cluster gateway. This is the usual multi-cluster scenario. + 4. The gateway in the target cluster looks at the request and looks-up the + original destination address. In our case, since this is an "endpoint + mirror", it knows it has to go to `nginx-set-0.nginx-svc` in the same + cluster. + 5. The request is again forwarded by the gateway to the pod, and the response + comes back. + +And that's it! You can now send requests to pods across clusters. Querying any +of the 3 StatefulSet pods should have the same results. + +{{< note >}} + +To mirror a headless service as headless, the service's endpoints +must also have at least one named address (e.g a hostname for an IP), +otherwise, there will be no endpoints to mirror so the service will be mirrored +as `clusterIP`. A headless service may under normal conditions also be created +without exposing a port; the mulit-cluster service-mirror does not support +this, however, since the lack of ports means we cannot create a service that +passes Kubernetes validation. + +{{< /note >}} + +## Cleanup + +To clean-up, you can remove both clusters entirely using the k3d CLI: + +```sh +$ k3d cluster delete east +cluster east deleted +$ k3d cluster delete west +cluster west deleted +``` diff --git a/linkerd.io/content/2.17/tasks/multicluster.md b/linkerd.io/content/2.17/tasks/multicluster.md new file mode 100644 index 0000000000..63b327a4a4 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/multicluster.md @@ -0,0 +1,496 @@ +--- +title: Multi-cluster communication +description: Allow Linkerd to manage cross-cluster communication. +--- + +This guide will walk you through installing and configuring Linkerd so that two +clusters can talk to services hosted on both. There are a lot of moving parts +and concepts here, so it is valuable to read through our +[introduction](../../features/multicluster/) that explains how this works beneath +the hood. By the end of this guide, you will understand how to split traffic +between services that live on different clusters. + +At a high level, you will: + +1. [Install Linkerd and Linkerd Viz](#install-linkerd) on two clusters with a + shared trust anchor. +1. [Prepare](#preparing-your-cluster) the clusters. +1. [Link](#linking-the-clusters) the clusters. +1. [Install](#installing-the-test-services) the demo. +1. [Export](#exporting-the-services) the demo services, to control visibility. +1. [Gain visibility](#visibility) in your linked clusters. +1. [Verify](#security) the security of your clusters. +1. [Split traffic](#traffic-splitting) from pods on the source cluster (`west`) + to the target cluster (`east`) + +## Prerequisites + +- Two clusters. We will refer to them as `east` and `west` in this guide. Follow + along with the + [blog post](/2020/02/25/multicluster-kubernetes-with-service-mirroring/) as + you walk through this guide! The easiest way to do this for development is + running a [kind](https://kind.sigs.k8s.io/docs/user/quick-start/) or + [k3d](https://github.com/rancher/k3d#usage) cluster locally on your laptop and + one remotely on a cloud provider, such as + [AKS](https://azure.microsoft.com/en-us/services/kubernetes-service/). +- Each of these clusters should be configured as `kubectl` + [contexts](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). + We'd recommend you use the names `east` and `west` so that you can follow + along with this guide. It is easy to + [rename contexts](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-rename-context-em-) + with `kubectl`, so don't feel like you need to keep it all named this way + forever. +- Elevated privileges on both clusters. We'll be creating service accounts and + granting extended privileges, so you'll need to be able to do that on your + test clusters. +- Support for services of type `LoadBalancer` in the `east` cluster. Check out + the documentation for your cluster provider or take a look at + [inlets](https://blog.alexellis.io/ingress-for-your-local-kubernetes-cluster/). + This is what the `west` cluster will use to communicate with `east` via the + gateway. + +## Install Linkerd and Linkerd Viz + +![install](/docs/images/multicluster/install.svg "Two Clusters") + +Linkerd requires a shared +[trust anchor](../generate-certificates/#trust-anchor-certificate) +to exist between the installations in all clusters that communicate with each +other. This is used to encrypt the traffic between clusters and authorize +requests that reach the gateway so that your cluster is not open to the public +internet. Instead of letting `linkerd` generate everything, we'll need to +generate the credentials and use them as configuration for the `install` +command. + +We like to use the [step](https://smallstep.com/cli/) CLI to generate these +certificates. If you prefer `openssl` instead, feel free to use that! To +generate the trust anchor with step, you can run: + +```bash +step certificate create root.linkerd.cluster.local root.crt root.key \ + --profile root-ca --no-password --insecure +``` + +This certificate will form the common base of trust between all your clusters. +Each proxy will get a copy of this certificate and use it to validate the +certificates that it receives from peers as part of the mTLS handshake. With a +common base of trust, we now need to generate a certificate that can be used in +each cluster to issue certificates to the proxies. If you'd like to get a deeper +picture into how this all works, check out the +[deep dive](../../features/automatic-mtls/#how-does-it-work). + +The trust anchor that we've generated is a self-signed certificate which can be +used to create new certificates (a certificate authority). To generate the +[issuer credentials](../generate-certificates/#issuer-certificate-and-key) +using the trust anchor, run: + +```bash +step certificate create identity.linkerd.cluster.local issuer.crt issuer.key \ + --profile intermediate-ca --not-after 8760h --no-password --insecure \ + --ca root.crt --ca-key root.key +``` + +An `identity` service in your cluster will use the certificate and key that you +generated here to generate the certificates that each individual proxy uses. +While we will be using the same issuer credentials on each cluster for this +guide, it is a good idea to have separate ones for each cluster. Read through +the [certificate documentation](../generate-certificates/) for more +details. + +With a valid trust anchor and issuer credentials, we can install Linkerd on your +`west` and `east` clusters now. + +```bash +# first, install the Linkerd CRDs in both clusters +linkerd install --crds \ + | tee \ + >(kubectl --context=west apply -f -) \ + >(kubectl --context=east apply -f -) + +# then install the Linkerd control plane in both clusters +linkerd install \ + --identity-trust-anchors-file root.crt \ + --identity-issuer-certificate-file issuer.crt \ + --identity-issuer-key-file issuer.key \ + | tee \ + >(kubectl --context=west apply -f -) \ + >(kubectl --context=east apply -f -) +``` + +And then Linkerd Viz: + +```bash +for ctx in west east; do + linkerd --context=${ctx} viz install | \ + kubectl --context=${ctx} apply -f - || break +done +``` + +The output from `install` will get applied to each cluster and come up! You can +verify that everything has come up successfully with `check`. + +```bash +for ctx in west east; do + echo "Checking cluster: ${ctx} ........." + linkerd --context=${ctx} check || break + echo "-------------" +done +``` + +## Preparing your cluster + +![preparation](/docs/images/multicluster/prep-overview.svg "Preparation") + +In order to route traffic between clusters, Linkerd leverages Kubernetes +services so that your application code does not need to change and there is +nothing new to learn. This requires a gateway component that routes incoming +requests to the correct internal service. The gateway will be exposed to the +public internet via a `Service` of type `LoadBalancer`. Only requests verified +through Linkerd's mTLS (with a shared trust anchor) will be allowed through this +gateway. If you're interested, we go into more detail as to why this is +important in [architecting for multicluster Kubernetes](/2020/02/17/architecting-for-multicluster-kubernetes/#requirement-i-support-hierarchical-networks). + +To install the multicluster components on both `west` and `east`, you can run: + +```bash +for ctx in west east; do + echo "Installing on cluster: ${ctx} ........." + linkerd --context=${ctx} multicluster install | \ + kubectl --context=${ctx} apply -f - || break + echo "-------------" +done +``` + +![install](/docs/images/multicluster/components.svg "Components") + +Installed into the `linkerd-multicluster` namespace, the gateway is a simple +[pause container](https://github.com/linkerd/linkerd2/blob/main/multicluster/charts/linkerd-multicluster/templates/gateway.yaml#L3) +which has been injected with the Linkerd proxy. On the inbound side, Linkerd +takes care of validating that the connection uses a TLS certificate that is part +of the trust anchor, then handles the outbound connection. At this point, the +Linkerd proxy is operating like any other in the data plane and forwards the +requests to the correct service. Make sure the gateway comes up successfully by +running: + +```bash +for ctx in west east; do + echo "Checking gateway on cluster: ${ctx} ........." + kubectl --context=${ctx} -n linkerd-multicluster \ + rollout status deploy/linkerd-gateway || break + echo "-------------" +done +``` + +Double check that the load balancer was able to allocate a public IP address by +running: + +```bash +for ctx in west east; do + printf "Checking cluster: ${ctx} ........." + while [ "$(kubectl --context=${ctx} -n linkerd-multicluster get service -o 'custom-columns=:.status.loadBalancer.ingress[0].ip' --no-headers)" = "" ]; do + printf '.' + sleep 1 + done + printf "\n" +done +``` + +Every cluster is now running the multicluster control plane and ready to start +mirroring services. We'll want to link the clusters together now! + +## Linking the clusters + +![link-clusters](/docs/images/multicluster/link-flow.svg "Link") + +For `west` to mirror services from `east`, the `west` cluster needs to have +credentials so that it can watch for services in `east` to be exported. You'd +not want anyone to be able to introspect what's running on your cluster after +all! The credentials consist of a service account to authenticate the service +mirror as well as a `ClusterRole` and `ClusterRoleBinding` to allow watching +services. In total, the service mirror component uses these credentials to watch +services on `east` or the target cluster and add/remove them from itself +(`west`). There is a default set added as part of +`linkerd multicluster install`, but if you would like to have separate +credentials for every cluster you can run `linkerd multicluster allow`. + +The next step is to link `west` to `east`. This will create a credentials +secret, a Link resource, and a service-mirror controller. The credentials secret +contains a kubeconfig which can be used to access the target (`east`) cluster's +Kubernetes API. The Link resource is custom resource that configures service +mirroring and contains things such as the gateway address, gateway identity, +and the label selector to use when determining which services to mirror. The +service-mirror controller uses the Link and the secret to find services on +the target cluster that match the given label selector and copy them into +the source (local) cluster. + + To link the `west` cluster to the `east` one, run: + +```bash +linkerd --context=east multicluster link --cluster-name east | + kubectl --context=west apply -f - +``` + +Linkerd will look at your current `east` context, extract the `cluster` +configuration which contains the server location as well as the CA bundle. It +will then fetch the `ServiceAccount` token and merge these pieces of +configuration into a kubeconfig that is a secret. + +Running `check` again will make sure that the service mirror has discovered this +secret and can reach `east`. + +```bash +linkerd --context=west multicluster check +``` + +Additionally, the `east` gateway should now show up in the list: + +```bash +linkerd --context=west multicluster gateways +``` + +{{< note >}} `link` assumes that the two clusters will connect to each other +with the same configuration as you're using locally. If this is not the case, +you'll want to use the `--api-server-address` flag for `link`.{{< /note >}} + +## Installing the test services + +![test-services](/docs/images/multicluster/example-topology.svg "Topology") + +It is time to test this all out! The first step is to add some services that we +can mirror. To add these to both clusters, you can run: + +```bash +for ctx in west east; do + echo "Adding test services on cluster: ${ctx} ........." + kubectl --context=${ctx} apply \ + -n test -k "github.com/linkerd/website/multicluster/${ctx}/" + kubectl --context=${ctx} -n test \ + rollout status deploy/podinfo || break + echo "-------------" +done +``` + +You'll now have a `test` namespace running two deployments in each cluster - +frontend and podinfo. `podinfo` has been configured slightly differently in each +cluster with a different name and color so that we can tell where requests are +going. + +To see what it looks like from the `west` cluster right now, you can run: + +```bash +kubectl --context=west -n test port-forward svc/frontend 8080 +``` + +![west-podinfo](/docs/images/multicluster/west-podinfo.gif "West Podinfo") + +With the podinfo landing page available at +[http://localhost:8080](http://localhost:8080), you can see how it looks in the +`west` cluster right now. Alternatively, running `curl http://localhost:8080` +will return a JSON response that looks something like: + +```json {class=disable-copy} +{ + "hostname": "podinfo-5c8cf55777-zbfls", + "version": "4.0.2", + "revision": "b4138fdb4dce7b34b6fc46069f70bb295aa8963c", + "color": "#6c757d", + "logo": "https://raw.githubusercontent.com/stefanprodan/podinfo/gh-pages/cuddle_clap.gif", + "message": "greetings from west", + "goos": "linux", + "goarch": "amd64", + "runtime": "go1.14.3", + "num_goroutine": "8", + "num_cpu": "4" +} +``` + +Notice that the `message` references the `west` cluster name. + +## Exporting the services + +To make sure sensitive services are not mirrored and cluster performance is +impacted by the creation or deletion of services, we require that services be +explicitly exported. For the purposes of this guide, we will be exporting the +`podinfo` service from the `east` cluster to the `west` cluster. To do this, we +must first export the `podinfo` service in the `east` cluster. You can do this +by adding the `mirror.linkerd.io/exported` label: + +```bash +kubectl --context=east label svc -n test podinfo mirror.linkerd.io/exported=true +``` + +{{< note >}} You can configure a different label selector by using the +`--selector` flag on the `linkerd multicluster link` command or by editting +the Link resource created by the `linkerd multicluster link` command. +{{< /note >}} + +Check out the service that was just created by the service mirror controller! + +```bash +kubectl --context=west -n test get svc podinfo-east +``` + +From the +[architecture](https://linkerd.io/2020/02/25/multicluster-kubernetes-with-service-mirroring/#step-2-endpoint-juggling), +you'll remember that the service mirror component is doing more than just moving +services over. It is also managing the endpoints on the mirrored service. To +verify that is setup correctly, you can check the endpoints in `west` and verify +that they match the gateway's public IP address in `east`. + +```bash +kubectl --context=west -n test get endpoints podinfo-east \ + -o 'custom-columns=ENDPOINT_IP:.subsets[*].addresses[*].ip' +kubectl --context=east -n linkerd-multicluster get svc linkerd-gateway \ + -o "custom-columns=GATEWAY_IP:.status.loadBalancer.ingress[*].ip" +``` + +At this point, we can hit the `podinfo` service in `east` from the `west` +cluster. This requires the client to be meshed, so let's run `curl` from within +the frontend pod: + +```bash +kubectl --context=west -n test exec -c nginx -it \ + $(kubectl --context=west -n test get po -l app=frontend \ + --no-headers -o custom-columns=:.metadata.name) \ + -- /bin/sh -c "apk add curl && curl http://podinfo-east:9898" +``` + +You'll see the `greeting from east` message! Requests from the `frontend` pod +running in `west` are being transparently forwarded to `east`. Assuming that +you're still port forwarding from the previous step, you can also reach this +with `curl http://localhost:8080/east`. Make that call a couple times and +you'll be able to get metrics from `linkerd viz stat-outbound` as well. + +```bash +linkerd --context=west -n test viz stat-outbound deploy/frontend +``` + +We also provide a grafana dashboard to get a feel for what's going on here (see +the [grafana install instructions](../grafana/) first to have a working grafana +provisioned with Linkerd dashboards). You can get to it by running `linkerd +--context=west viz dashboard` and going to + +![grafana-dashboard](/docs/images/multicluster/grafana-dashboard.png "Grafana") + +## Security + +By default, requests will be going across the public internet. Linkerd extends +its [automatic mTLS](../../features/automatic-mtls/) across clusters to make sure +that the communication going across the public internet is encrypted. If you'd +like to have a deep dive on how to validate this, check out the +[docs](../validating-your-traffic/). To quickly check, however, you can run: + +```bash +linkerd --context=west -n test viz tap deploy/frontend | \ + grep "$(kubectl --context=east -n linkerd-multicluster get svc linkerd-gateway \ + -o "custom-columns=GATEWAY_IP:.status.loadBalancer.ingress[*].ip")" +``` + +`tls=true` tells you that the requests are being encrypted! + +{{< note >}} As `linkerd viz edges` works on concrete resources and cannot see +two clusters at once, it is not currently able to show the edges between pods in +`east` and `west`. This is the reason we're using `tap` to validate mTLS here. +{{< /note >}} + +In addition to making sure all your requests are encrypted, it is important to +block arbitrary requests coming into your cluster. We do this by validating that +requests are coming from clients in the mesh. To do this validation, we rely on +a shared trust anchor between clusters. To see what happens when a client is +outside the mesh, you can run: + +```bash +kubectl --context=west -n test run -it --rm --image=alpine:3 test -- \ + /bin/sh -c "apk add curl && curl -vv http://podinfo-east:9898" +``` + +## Traffic Splitting + +![with-split](/docs/images/multicluster/with-split.svg "Traffic Split") + +It is pretty useful to have services automatically show up in clusters and be +able to explicitly address them, however that only covers one use case for +operating multiple clusters. Another scenario for multicluster is failover. In a +failover scenario, you don't have time to update the configuration. Instead, you +need to be able to leave the application alone and just change the routing. If +this sounds a lot like how we do [canary](../flagger/) deployments, +you'd be correct! + +`TrafficSplit` allows us to define weights between multiple services and split +traffic between them. In a failover scenario, you want to do this slowly as to +make sure you don't overload the other cluster or trip any SLOs because of the +added latency. To get this all working with our scenario, let's split between +the `podinfo` service in `west` and `east`. To configure this, you'll run: + +```bash +kubectl --context=west apply -f - < linkerd --context east multicluster install --gateway=false | kubectl --context east apply -f - +> linkerd --context east check + +> linkerd --context west multicluster install --gateway=false | kubectl --context west apply -f - +> linkerd --context west check +``` + +## Step 3: Linking the Clusters + +We use the `linkerd multilcuster link` command to link our two clusters +together. This is exactly the same as in the regular +[Multicluster guide](../multicluster/#linking-the-clusters) except that we pass +the `--gateway=false` flag to create a Link which doesn't require a gateway. + +```console +> linkerd --context east multicluster link --cluster-name=target --gateway=false | kubectl --context west apply -f - +``` + +## Step 4: Deploy and Exporting a Service + +For our guide, we'll deploy the [bb](https://github.com/BuoyantIO/bb) service, +which is a simple server that just returns a static response. We deploy it +into the target cluster: + +```bash +> cat < kubectl --context west create ns mc-demo +``` + +and set a label on the target service to export it. Notice that instead of the +usual `mirror.linkerd.io/exported=true` label, we are setting +`mirror.linkerd.io/exported=remote-discovery` which means that the service +should be exported in remote discovery mode, which skips the gateway and allows +pods from different clusters to talk to each other directly. + +```console +> kubectl --context east -n mc-demo label svc/bb mirror.linkerd.io/exported=remote-discovery +``` + +You should immediately see a mirror service created in the source cluster: + +```console +> kubectl --context west -n mc-demo get svc +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +bb-target ClusterIP 10.43.56.245 8080/TCP 114s +``` + +## Step 5: Send some traffic! + +We'll use [slow-cooker](https://github.com/BuoyantIO/slow_cooker) as our load +generator in the source cluster to send to the `bb` service in the target +cluster. Notice that we configure slow-cooker to send to our `bb-target` mirror +service. + +```bash +> cat < linkerd --context east viz stat -n mc-demo deploy +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +bb 1/1 100.00% 10.3rps 1ms 1ms 1ms 3 +``` + +## Step 6: Authorization Policy + +One advantage of direct pod-to-pod communication is that the server can use +authorization policies which allow only certain clients to connect. This is +not possible when using the gateway, because client identity is lost when going +through the gateway. For more background on how authorization policies work, +see: [Restricting Access To Services](../restricting-access/). + +Let's demonstrate that by creating an authorization policy which only allows +the `slow-cooker` service account to connect to `bb`: + +```bash +> kubectl --context east apply -f - < linkerd --context east viz authz -n mc-demo deploy +ROUTE SERVER AUTHORIZATION UNAUTHORIZED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 +default bb authorizationpolicy/bb-authz 0.0rps 100.00% 10.0rps 1ms 1ms 1ms +default default:all-unauthenticated default/all-unauthenticated 0.0rps 100.00% 0.1rps 1ms 1ms 1ms +probe default:all-unauthenticated default/probe 0.0rps 100.00% 0.2rps 1ms 1ms 1ms +``` + +To demonstrate that `slow-cooker` is the *only* service account which is allowed +to send to `bb`, we'll create a second load generator called `slow-cooker-evil` +which uses a different service account and which should be denied. + +```bash +> cat < linkerd --context east viz authz -n mc-demo deploy +ROUTE SERVER AUTHORIZATION UNAUTHORIZED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 +default bb 10.0rps 0.00% 0.0rps 0ms 0ms 0ms +default bb authorizationpolicy/bb-authz 0.0rps 100.00% 10.0rps 1ms 1ms 1ms +default default:all-unauthenticated default/all-unauthenticated 0.0rps 100.00% 0.1rps 1ms 1ms 1ms +probe default:all-unauthenticated default/probe 0.0rps 100.00% 0.2rps 1ms 1ms 1ms +``` diff --git a/linkerd.io/content/2.17/tasks/replacing_expired_certificates.md b/linkerd.io/content/2.17/tasks/replacing_expired_certificates.md new file mode 100644 index 0000000000..8b32830509 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/replacing_expired_certificates.md @@ -0,0 +1,124 @@ +--- +title: Replacing expired certificates +description: Follow this workflow if any of your TLS certs have expired. +--- + +If any of your TLS certs are approaching expiry and you are not relying on an +external certificate management solution such as `cert-manager`, you can follow +[Manually Rotating Control Plane TLS Credentials](../manually-rotating-control-plane-tls-credentials/) +to update them without incurring downtime. However, if any of your certificates +have already expired, your mesh is already in an invalid state and any measures +to avoid downtime are not guaranteed to give good results. Instead, you need to +replace the expired certificates with valid certificates. + +## Replacing only the issuer certificate + +It might be the case that your issuer certificate is expired. If this it true +running `linkerd check --proxy` will produce output similar to: + +```bash +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +√ trust roots are within their validity period +√ trust roots are valid for at least 60 days +√ issuer cert is using supported crypto algorithm +× issuer cert is within its validity period + issuer certificate is not valid anymore. Expired on 2019-12-19T09:21:08Z + see https://linkerd.io/2/checks/#l5d-identity-issuer-cert-is-time-valid for hints +``` + +In this situation, if you have installed Linkerd with a manually supplied trust +root and you have its key, you can follow the instructions to +[rotate your identity issuer certificate](../manually-rotating-control-plane-tls-credentials/#rotating-the-identity-issuer-certificate) +to update your expired certificate. + +## Replacing the root and issuer certificates + +If your root certificate is expired or you do not have its key, you need to +replace both your root and issuer certificates at the same time. If your root +has expired `linkerd check` will indicate that by outputting an error similar +to: + +```bash +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +× trust roots are within their validity period + Invalid roots: + * 272080721524060688352608293567629376512 identity.linkerd.cluster.local not valid anymore. Expired on 2019-12-19T10:05:31Z + see https://linkerd.io/2/checks/#l5d-identity-roots-are-time-valid for hints +``` + +You can follow [Generating your own mTLS root certificates](../generate-certificates/#generating-the-certificates-with-step) +to create new root and issuer certificates. Then use the `linkerd upgrade` +command: + +```bash +linkerd upgrade \ + --identity-issuer-certificate-file=./issuer-new.crt \ + --identity-issuer-key-file=./issuer-new.key \ + --identity-trust-anchors-file=./ca-new.crt \ + --force \ + | kubectl apply -f - +``` + +Usually `upgrade` will prevent you from using an issuer certificate that +will not work with the roots your meshed pods are using. At that point we +do not need this check as we are updating both the root and issuer certs at +the same time. Therefore we use the `--force` flag to ignore this error. + +If you run `linkerd check --proxy` while pods are restarting after the trust +bundle is updated, you will probably see warnings about pods not having the +current trust bundle: + +```bash +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +√ trust roots are within their validity period +√ trust roots are valid for at least 60 days +√ issuer cert is using supported crypto algorithm +√ issuer cert is within its validity period +√ issuer cert is valid for at least 60 days +√ issuer cert is issued by the trust root + +linkerd-identity-data-plane +--------------------------- +‼ data plane proxies certificate match CA + Some pods do not have the current trust bundle and must be restarted: + * linkerd/linkerd-controller-5b69fd4fcc-7skqb + * linkerd/linkerd-destination-749df5c74-brchg + * linkerd/linkerd-prometheus-74cb4f4b69-kqtss + * linkerd/linkerd-proxy-injector-cbd5545bd-rblq5 + * linkerd/linkerd-sp-validator-6ff949649f-gjgfl + * linkerd/linkerd-tap-7b5bb954b6-zl9w6 + * linkerd/linkerd-web-84c555f78-v7t44 + see https://linkerd.io/2/checks/#l5d-identity-data-plane-proxies-certs-match-ca for hints + +``` + +These warnings will disappear as restarts complete. Once they do, you can use +`kubectl rollout restart` to restart your meshed workloads to bring their +configuration up to date. After that is done, `linkerd check` should run with +no warnings or errors: + +```bash +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +√ trust roots are within their validity period +√ trust roots are valid for at least 60 days +√ issuer cert is using supported crypto algorithm +√ issuer cert is within its validity period +√ issuer cert is valid for at least 60 days +√ issuer cert is issued by the trust root + +linkerd-identity-data-plane +--------------------------- +√ data plane proxies certificate match CA +``` diff --git a/linkerd.io/content/2.17/tasks/restricting-access.md b/linkerd.io/content/2.17/tasks/restricting-access.md new file mode 100644 index 0000000000..699d726c68 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/restricting-access.md @@ -0,0 +1,186 @@ +--- +title: Restricting Access To Services +description: Use Linkerd policy to restrict access to a service. +--- + +Linkerd policy resources can be used to restrict which clients may access a +service. In this example, we'll use Emojivoto to show how to restrict access +to the Voting service so that it may only be called from the Web service. + +For a more comprehensive description of the policy resources, see the +[Policy reference docs](../../reference/authorization-policy/). + +## Prerequisites + +To use this guide, you'll need to have Linkerd installed on your cluster, along +with its Viz extension. Follow the [Installing Linkerd Guide](../install/) +if you haven't already done this. + +## Setup + +Inject and install the Emojivoto application: + +```bash +$ linkerd inject https://run.linkerd.io/emojivoto.yml | kubectl apply -f - +... +$ linkerd check -n emojivoto --proxy -o short +... +``` + +## Creating a Server resource + +We start by creating a `Server` resource for the Voting service. A `Server` +is a Linkerd custom resource which describes a specific port of a workload. +Once the `Server` resource has been created, only clients which have been +authorized may access it (we'll see how to authorize clients in a moment). + +```bash +kubectl apply -f - < linkerd viz authz -n emojivoto deploy/voting +ROUTE SERVER AUTHORIZATION UNAUTHORIZED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 +default default:all-unauthenticated default/all-unauthenticated 0.0rps 100.00% 0.1rps 1ms 1ms 1ms +probe default:all-unauthenticated default/probe 0.0rps 100.00% 0.2rps 1ms 1ms 1ms +default voting-grpc 1.0rps 0.00% 0.0rps 0ms 0ms 0ms +``` + +## Creating a ServerAuthorization resource + +A `ServerAuthorization` grants a set of clients access to a set of `Servers`. +Here we will create a `ServerAuthorization` which grants the Web service access +to the Voting `Server` we created above. Note that meshed mTLS uses +`ServiceAccounts` as the basis for identity, thus our authorization will also +be based on `ServiceAccounts`. + +```bash +kubectl apply -f - < linkerd viz authz -n emojivoto deploy/voting +ROUTE SERVER AUTHORIZATION UNAUTHORIZED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 +default default:all-unauthenticated default/all-unauthenticated 0.0rps 100.00% 0.1rps 1ms 1ms 1ms +probe default:all-unauthenticated default/probe 0.0rps 100.00% 0.2rps 1ms 1ms 1ms +default voting-grpc serverauthorization/voting-grpc 0.0rps 83.87% 1.0rps 1ms 1ms 1ms +``` + +We can also test that request from other pods will be rejected by creating a +`grpcurl` pod and attempting to access the Voting service from it: + +```bash +> kubectl run grpcurl --rm -it --image=networld/grpcurl --restart=Never --command -- ./grpcurl -plaintext voting-svc.emojivoto:8080 emojivoto.v1.VotingService/VoteDog +Error invoking method "emojivoto.v1.VotingService/VoteDog": failed to query for service descriptor "emojivoto.v1.VotingService": rpc error: code = PermissionDenied desc = +pod "grpcurl" deleted +pod default/grpcurl terminated (Error) +``` + +Because this client has not been authorized, this request gets rejected with a +`PermissionDenied` error. + +You can create as many `ServerAuthorization` resources as you like to authorize +many different clients. You can also specify whether to authorize +unauthenticated (i.e. unmeshed) client, any authenticated client, or only +authenticated clients with a particular identity. For more details, please see +the [Policy reference docs](../../reference/authorization-policy/). + +## Setting a Default Policy + +To further lock down a cluster, you can set a default policy which will apply +to all ports which do not have a Server resource defined. Linkerd uses the +following logic when deciding whether to allow a request: + +* If the port has a Server resource and the client matches a ServerAuthorization + resource for it: ALLOW +* If the port has a Server resource but the client does not match any + ServerAuthorizations for it: DENY +* If the port does not have a Server resource: use the default policy + +We can set the default policy to `deny` using the `linkerd upgrade` command: + +```bash +> linkerd upgrade --default-inbound-policy deny | kubectl apply -f - +``` + +Alternatively, default policies can be set on individual workloads or namespaces +by setting the `config.linkerd.io/default-inbound-policy` annotation. See the +[Policy reference docs](../../reference/authorization-policy/) for more details. + +If a port does not have a Server defined, Linkerd will automatically use a +default Server which allows readiness and liveness probes. However, if you +create a Server resource for a port which handles probes, you will need to +explicitly create an authorization to allow those probe requests. For more +information about adding route-scoped authorizations, see +[Configuring Per-Route Policy](../configuring-per-route-policy/). + +## Further Considerations - Audit Mode + +You may have noticed that there was a period of time after we created the +`Server` resource but before we created the `ServerAuthorization` where all +requests were being rejected. To avoid this situation in live systems, we +recommend that you enable [audit mode](../../features/server-policy/#audit-mode) +in the `Server` resource (via `accessPolicy:audit`) and check the proxy +logs/metrics in the target services to see if traffic would get inadvertently +denied. Afterwards, when you're sure about your policy rules, you can fully +enable them by resetting `accessPolicy` back to `deny`. + +## Per-Route Policy + +In addition to service-level authorization policy, authorization policy can also +be configured for individual HTTP routes. To learn more about per-route policy, +see the documentation on [configuring per-route +policy](../configuring-per-route-policy/). diff --git a/linkerd.io/content/2.17/tasks/rotating_webhooks_certificates.md b/linkerd.io/content/2.17/tasks/rotating_webhooks_certificates.md new file mode 100644 index 0000000000..1bc14563a5 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/rotating_webhooks_certificates.md @@ -0,0 +1,104 @@ +--- +title: Rotating webhooks certificates +description: Follow these steps to rotate your Linkerd webhooks certificates. +--- + +Linkerd uses the +[Kubernetes admission webhooks](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks) +and +[extension API server](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) +to implement some of its core features like +[automatic proxy injection](../../features/proxy-injection/) and +[service profiles validation](../../features/service-profiles/). + +Also, the viz extension uses a webhook to make pods tappable, as does the jaeger +extension to turn on tracing on pods. + +To secure the connections between the Kubernetes API server and the +webhooks, all the webhooks are TLS-enabled. The x509 certificates used by these +webhooks are issued by the self-signed CA certificates embedded in the webhooks +configuration. + +By default, these certificates have a validity period of 365 days. They are +stored in the following secrets: + +- In the `linkerd` namespace: `linkerd-policy-validator-k8s-tls`, + `linkerd-proxy-injector-k8s-tls` and `linkerd-sp-validator-k8s-tls` +- In the `linkerd-viz` namespace: `tap-injector-k8s-tls` +- In the `linkerd-jaeger` namespace: `jaeger-injector-k8s-tls` + +The rest of this documentation provides instructions on how to renew these +certificates. + +## Renewing the webhook certificates + +To check the validity of all the TLS secrets +(using [`step`](https://smallstep.com/cli/)): + +```bash +# assuming you have viz and jaeger installed, otherwise trim down these arrays +# accordingly +SECRETS=("linkerd-policy-validator-k8s-tls" "linkerd-proxy-injector-k8s-tls" "linkerd-sp-validator-k8s-tls" "tap-injector-k8s-tls" "jaeger-injector-k8s-tls") +NS=("linkerd" "linkerd" "linkerd-viz" "linkerd-jaeger") +for idx in "${!SECRETS[@]}"; do \ + kubectl -n "${NS[$idx]}" get secret "${SECRETS[$idx]}" -ojsonpath='{.data.tls\.crt}' | \ + base64 --decode - | \ + step certificate inspect - | \ + grep -iA2 validity; \ +done +``` + +Manually delete these secrets and use `upgrade`/`install` to recreate them: + +```bash +for idx in "${!SECRETS[@]}"; do \ + kubectl -n "${NS[$idx]}" delete secret "${SECRETS[$idx]}"; \ +done + +linkerd upgrade | kubectl apply -f - +linkerd viz install | kubectl apply -f - +linkerd jaeger install | kubectl apply -f - +``` + +The above command will recreate the secrets without restarting Linkerd. + +{{< note >}} +For Helm users, use the `helm upgrade` command to recreate the deleted secrets. + +If you render the helm charts externally and apply them with `kubectl apply` +(e.g. in a CI/CD pipeline), you do not need to delete the secrets manually, +as they wil be overwritten by a new cert and key generated by the helm chart. +{{< /note >}} + +Confirm that the secrets are recreated with new certificates: + +```bash +for idx in "${!SECRETS[@]}"; do \ + kubectl -n "${NS[$idx]}" get secret "${SECRETS[$idx]}" -ojsonpath='{.data.crt\.pem}' | \ + base64 --decode - | \ + step certificate inspect - | \ + grep -iA2 validity; \ +done +``` + +Ensure that Linkerd remains healthy: + +```bash +linkerd check +``` + +Restarting the pods that implement the webhooks and API services is usually not +necessary. But if the cluster is large, or has a high pod churn, it may be +advisable to restart the pods manually, to avoid cascading failures. + +If you observe certificate expiry errors or mismatched CA certs, restart their +pods with: + +```sh +kubectl -n linkerd rollout restart deploy \ + linkerd-proxy-injector \ + linkerd-sp-validator \ + +kubectl -n linkerd-viz rollout restart deploy tap tap-injector +kubectl -n linkerd-jaeger rollout restart deploy jaeger-injector +``` diff --git a/linkerd.io/content/2.17/tasks/securing-linkerd-tap.md b/linkerd.io/content/2.17/tasks/securing-linkerd-tap.md new file mode 100644 index 0000000000..d6505f345e --- /dev/null +++ b/linkerd.io/content/2.17/tasks/securing-linkerd-tap.md @@ -0,0 +1,223 @@ +--- +title: Securing Linkerd Tap +description: Best practices for securing Linkerd's tap feature. +--- + +Linkerd provides a powerful tool called `tap` which allows users +to introspect live traffic in real time. While powerful, this feature can +potentially expose sensitive data such as request and response headers, which may +contain confidential information. To mitigate this risk, Linkerd has a configuration +field called `tap.ignoreHeaders` which can be used to exclude specific headers from +being captured by `tap`. Access to `tap` is controlled using +[role-based access control (RBAC)](https://kubernetes.io/docs/reference/access-authn-authz/rbac/). +This page illustrates best practices to enable this introspection in a secure +way. + +## Tap + +Linkerd's Viz extension includes Tap support. This feature is available via the +following commands: + +- [`linkerd viz tap`](../../reference/cli/viz/#tap) +- [`linkerd viz top`](../../reference/cli/viz/#top) +- [`linkerd viz profile --tap`](../../reference/cli/viz/#profile) +- [`linkerd viz dashboard`](../../reference/cli/viz/#dashboard) + +Depending on your RBAC setup, you may need to perform additional steps to enable +your user(s) to perform Tap actions. + +{{< note >}} +If you are on GKE, skip to the [GKE section below](#gke). +{{< /note >}} + +### Check for Tap access + +Use `kubectl` to determine whether your user is authorized to perform tap +actions. For more information, see the +[Kubernetes docs on authorization](https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access). + +To determine if you can watch pods in all namespaces: + +```bash +kubectl auth can-i watch pods.tap.linkerd.io --all-namespaces +``` + +To determine if you can watch deployments in the emojivoto namespace: + +```bash +kubectl auth can-i watch deployments.tap.linkerd.io -n emojivoto +``` + +To determine if a specific user can watch deployments in the emojivoto namespace: + +```bash +kubectl auth can-i watch deployments.tap.linkerd.io -n emojivoto --as $(whoami) +``` + +You can also use the Linkerd CLI's `--as` flag to confirm: + +```bash +$ linkerd viz tap -n linkerd deploy/linkerd-controller --as $(whoami) +Cannot connect to Linkerd Viz: namespaces is forbidden: User "XXXX" cannot list resource "namespaces" in API group "" at the cluster scope +Validate the install with: linkerd viz check +... +``` + +### Enabling Tap access + +If the above commands indicate you need additional access, you can enable access +with as much granularity as you choose. + +#### Granular Tap access + +To enable tap access to all resources in all namespaces, you may bind your user +to the `linkerd-linkerd-tap-admin` ClusterRole, installed by default: + +```bash +$ kubectl describe clusterroles/linkerd-linkerd-viz-tap-admin +Name: linkerd-linkerd-viz-tap-admin +Labels: component=tap + linkerd.io/extension=viz +Annotations: kubectl.kubernetes.io/last-applied-configuration: + {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRole","metadata":{"annotations":{},"labels":{"component=tap... +PolicyRule: + Resources Non-Resource URLs Resource Names Verbs + --------- ----------------- -------------- ----- + *.tap.linkerd.io [] [] [watch] +``` + +{{< note >}} +This ClusterRole name includes the Linkerd Viz namespace, so it may vary if you +installed Viz into a non-default namespace: +`linkerd-[LINKERD_VIZ_NAMESPACE]-tap-admin` +{{< /note >}} + +To bind the `linkerd-linkerd-viz-tap-admin` ClusterRole to a particular user: + +```bash +kubectl create clusterrolebinding \ + $(whoami)-tap-admin \ + --clusterrole=linkerd-linkerd-viz-tap-admin \ + --user=$(whoami) +``` + +You can verify you now have tap access with: + +```bash +$ linkerd viz tap -n linkerd deploy/linkerd-controller --as $(whoami) +req id=3:0 proxy=in src=10.244.0.1:37392 dst=10.244.0.13:9996 tls=not_provided_by_remote :method=GET :authority=10.244.0.13:9996 :path=/ping +... +``` + +#### Cluster admin access + +To simply give your user cluster-admin access: + +```bash +kubectl create clusterrolebinding \ + $(whoami)-cluster-admin \ + --clusterrole=cluster-admin \ + --user=$(whoami) +``` + +{{< note >}} +Not recommended for production, only do this for testing/development. +{{< /note >}} + +### GKE + +Google Kubernetes Engine (GKE) provides access to your Kubernetes cluster via +Google Cloud IAM. See the +[GKE IAM Docs](https://cloud.google.com/kubernetes-engine/docs/how-to/iam) for +more information. + +Because GCloud provides this additional level of access, there are cases where +`kubectl auth can-i` will report you have Tap access when your RBAC user may +not. To validate this, check whether your GCloud user has Tap access: + +```bash +$ kubectl auth can-i watch pods.tap.linkerd.io --all-namespaces +yes +``` + +And then validate whether your RBAC user has Tap access: + +```bash +$ kubectl auth can-i watch pods.tap.linkerd.io --all-namespaces --as $(gcloud config get-value account) +no - no RBAC policy matched +``` + +If the second command reported you do not have access, you may enable access +with: + +```bash +kubectl create clusterrolebinding \ + $(whoami)-tap-admin \ + --clusterrole=linkerd-linkerd-viz-tap-admin \ + --user=$(gcloud config get-value account) +``` + +To simply give your user cluster-admin access: + +```bash +kubectl create clusterrolebinding \ + $(whoami)-cluster-admin \ + --clusterrole=cluster-admin \ + --user=$(gcloud config get-value account) +``` + +{{< note >}} +Not recommended for production, only do this for testing/development. +{{< /note >}} + +### Linkerd Dashboard tap access + +By default, the [Linkerd dashboard](../../features/dashboard/) has the RBAC +privileges necessary to tap resources. + +To confirm: + +```bash +$ kubectl auth can-i watch pods.tap.linkerd.io --all-namespaces --as system:serviceaccount:linkerd-viz:web +yes +``` + +This access is enabled via a `linkerd-linkerd-viz-web-admin` ClusterRoleBinding: + +```bash +$ kubectl describe clusterrolebindings/linkerd-linkerd-viz-web-admin +Name: linkerd-linkerd-viz-web-admin +Labels: component=web + linkerd.io/extensions=viz +Annotations: kubectl.kubernetes.io/last-applied-configuration: + {"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding","metadata":{"annotations":{},"labels":{"component=web... +Role: + Kind: ClusterRole + Name: linkerd-linkerd-viz-tap-admin +Subjects: + Kind Name Namespace + ---- ---- --------- + ServiceAccount web linkerd-viz +``` + +If you would like to restrict the Linkerd dashboard's tap access. You may +install Linkerd viz with the `--set dashboard.restrictPrivileges` flag: + +```bash +linkerd viz install --set dashboard.restrictPrivileges +``` + +This will omit the `linkerd-linkerd-web-admin` ClusterRoleBinding. If you have +already installed Linkerd, you may simply delete the ClusterRoleBinding +manually: + +```bash +kubectl delete clusterrolebindings/linkerd-linkerd-viz-web-admin +``` + +To confirm: + +```bash +$ kubectl auth can-i watch pods.tap.linkerd.io --all-namespaces --as system:serviceaccount:linkerd-viz:web +no +``` diff --git a/linkerd.io/content/2.17/tasks/setting-up-service-profiles.md b/linkerd.io/content/2.17/tasks/setting-up-service-profiles.md new file mode 100644 index 0000000000..0950e937c9 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/setting-up-service-profiles.md @@ -0,0 +1,149 @@ +--- +title: Setting Up Service Profiles +description: Create a service profile that provides more details for Linkerd to build + on. +--- + +[Service profiles](../../features/service-profiles/) provide Linkerd additional +information about a service and how to handle requests for a service. + +When an HTTP (not HTTPS) request is received by a Linkerd proxy, +the `destination service` of that request is identified. If a +service profile for that destination service exists, then that +service profile is used to +to provide [per-route metrics](../getting-per-route-metrics/), +[retries](../configuring-retries/) and +[timeouts](../configuring-timeouts/). + +The `destination service` for a request is computed by selecting +the value of the first header to exist of, `l5d-dst-override`, +`:authority`, and `Host`. The port component, if included and +including the colon, is stripped. That value is mapped to the fully +qualified DNS name. When the `destination service` matches the +name of a service profile in the namespace of the sender or the +receiver, Linkerd will use that to provide [per-route +metrics](../getting-per-route-metrics/), +[retries](../configuring-retries/) and +[timeouts](../configuring-timeouts/). + +There are times when you may need to define a service profile for +a service which resides in a namespace that you do not control. To +accomplish this, simply create a service profile as before, but +edit the namespace of the service profile to the namespace of the +pod which is calling the service. When Linkerd proxies a request +to a service, a service profile in the source namespace will take +priority over a service profile in the destination namespace. + +Your `destination service` may be a [ExternalName +service](https://kubernetes.io/docs/concepts/services-networking/service/#externalname). +In that case, use the `spec.metadata.name` and the +`spec.metadata.namespace' values to name your ServiceProfile. For +example, + +```yaml +apiVersion: v1 +kind: Service +metadata: + name: my-service + namespace: prod +spec: + type: ExternalName + externalName: my.database.example.com +``` + +use the name `my-service.prod.svc.cluster.local` for the ServiceProfile. + +Note that at present, you cannot view statistics gathered for routes +in this ServiceProfile in the web dashboard. You can get the +statistics using the CLI. + +For a complete demo walkthrough, check out the +[books](../books/#service-profiles) demo. + +There are a couple different ways to use `linkerd profile` to create service +profiles. + +{{< docs/toc >}} + +Requests which have been associated with a route will have a `rt_route` +annotation. To manually verify if the requests are being associated correctly, +run `tap` on your own deployment: + +```bash +linkerd viz tap -o wide | grep req +``` + +The output will stream the requests that `deploy/webapp` is receiving in real +time. A sample is: + +```bash +req id=0:1 proxy=in src=10.1.3.76:57152 dst=10.1.3.74:7000 tls=disabled :method=POST :authority=webapp.default:7000 :path=/books/2878/edit src_res=deploy/traffic src_ns=foobar dst_res=deploy/webapp dst_ns=default rt_route=POST /books/{id}/edit +``` + +Conversely, if `rt_route` is not present, a request has *not* been associated +with any route. Try running: + +```bash +linkerd viz tap -o wide | grep req | grep -v rt_route +``` + +## Swagger + +If you have an [OpenAPI (Swagger)](https://swagger.io/docs/specification/about/) +spec for your service, you can use the `--open-api` flag to generate a service +profile from the OpenAPI spec file. + +```bash +linkerd profile --open-api webapp.swagger webapp +``` + +This generates a service profile from the `webapp.swagger` OpenAPI spec file +for the `webapp` service. The resulting service profile can be piped directly +to `kubectl apply` and will be installed into the service's namespace. + +```bash +linkerd profile --open-api webapp.swagger webapp | kubectl apply -f - +``` + +## Protobuf + +If you have a [protobuf](https://developers.google.com/protocol-buffers/) format +for your service, you can use the `--proto` flag to generate a service profile. + +```bash +linkerd profile --proto web.proto web-svc +``` + +This generates a service profile from the `web.proto` format file for the +`web-svc` service. The resulting service profile can be piped directly to +`kubectl apply` and will be installed into the service's namespace. + +## Auto-Creation + +It is common to not have an OpenAPI spec or a protobuf format. You can also +generate service profiles from watching live traffic. This is based off tap data +and is a great way to understand what service profiles can do for you. To start +this generation process, you can use the `--tap` flag: + +```bash +linkerd viz profile -n emojivoto web-svc --tap deploy/web --tap-duration 10s +``` + +This generates a service profile from the traffic observed to +`deploy/web` over the 10 seconds that this command is running. The resulting service +profile can be piped directly to `kubectl apply` and will be installed into the +service's namespace. + +## Template + +Alongside all the methods for automatically creating service profiles, you can +get a template that allows you to add routes manually. To generate the template, +run: + +```bash +linkerd profile -n emojivoto web-svc --template +``` + +This generates a service profile template with examples that can be manually +updated. Once you've updated the service profile, use `kubectl apply` to get it +installed into the service's namespace on your cluster. diff --git a/linkerd.io/content/2.17/tasks/traffic-shifting.md b/linkerd.io/content/2.17/tasks/traffic-shifting.md new file mode 100644 index 0000000000..991adcb8a5 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/traffic-shifting.md @@ -0,0 +1,247 @@ +--- +title: Traffic Shifting +description: Dynamically split and shift traffic between backends +--- + +Traffic splitting and shifting are powerful features that enable operators to +dynamically shift traffic to different backend Services. This can be used to +implement A/B experiments, red/green deploys, canary rollouts, +[fault injection](../fault-injection/) and more. + +Linkerd supports two different ways to configure traffic shifting: you can +use the [Linkerd SMI extension](../linkerd-smi/) and +[TrafficSplit](https://github.com/servicemeshinterface/smi-spec/blob/main/apis/traffic-split/v1alpha2/traffic-split.md/) +resources, or you can use [HTTPRoute](../../features/httproute/) resources which +Linkerd natively supports. While certain integrations such as +[Flagger](../flagger/) rely on the SMI and `TrafficSplit` approach, using +`HTTPRoute` is the preferred method going forward. + +{{< docs/production-note >}} + +## Prerequisites + +To use this guide, you'll need a Kubernetes cluster running: + +- Linkerd and Linkerd-Viz. If you haven't installed these yet, follow the + [Installing Linkerd Guide](../install/). + +## Set up the demo + +We will set up a minimal demo which involves a load generator and two backends +called `v1` and `v2` respectively. You could imagine that these represent two +different versions of a service and that we would like to test `v2` on a small +sample of traffic before rolling it out completely. + +For load generation we'll use +[Slow-Cooker](https://github.com/BuoyantIO/slow_cooker) +and for the backends we'll use [BB](https://github.com/BuoyantIO/bb). + +To add these components to your cluster and include them in the Linkerd +[data plane](../../reference/architecture/#data-plane), run: + +```bash +cat < linkerd viz -n traffic-shift-demo stat --from deploy/slow-cooker deploy +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +v1 1/1 100.00% 10.1rps 1ms 1ms 8ms 1 +``` + +## Shifting Traffic + +Now let's create an HTTPRoute and split 10% of traffic to the v2 backend: + +```bash +cat < linkerd viz -n traffic-shift-demo stat --from deploy/slow-cooker deploy +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +v1 1/1 100.00% 9.0rps 1ms 1ms 1ms 1 +v2 1/1 100.00% 1.0rps 1ms 1ms 1ms 1 +``` + +From here, we can continue to tweak the weights in the HTTPRoute to gradually +shift traffic over to the `bb-v2` Service or shift things back if it's looking +dicey. To conclude this demo, let's shift 100% of traffic over to `bb-v2`: + +```bash +cat < linkerd viz -n traffic-shift-demo stat --from deploy/slow-cooker deploy +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +v1 1/1 - - - - - - +v2 1/1 100.00% 10.0rps 1ms 1ms 2ms 1 +``` diff --git a/linkerd.io/content/2.17/tasks/troubleshooting.md b/linkerd.io/content/2.17/tasks/troubleshooting.md new file mode 100644 index 0000000000..e5f338570e --- /dev/null +++ b/linkerd.io/content/2.17/tasks/troubleshooting.md @@ -0,0 +1,2329 @@ +--- +title: Troubleshooting +description: Troubleshoot issues with your Linkerd installation. +--- + +This section provides resolution steps for common problems reported with the +`linkerd check` command. + +## The "pre-kubernetes-cluster-setup" checks {#pre-k8s-cluster} + +These checks only run when the `--pre` flag is set. This flag is intended for +use prior to running `linkerd install`, to verify your cluster is prepared for +installation. + +### √ control plane namespace does not already exist {#pre-ns} + +Example failure: + +```bash +× control plane namespace does not already exist + The "linkerd" namespace already exists +``` + +By default `linkerd install` will create a `linkerd` namespace. Prior to +installation, that namespace should not exist. To check with a different +namespace, run: + +```bash +linkerd check --pre --linkerd-namespace linkerd-test +``` + +### √ can create Kubernetes resources {#pre-k8s-cluster-k8s} + +The subsequent checks in this section validate whether you have permission to +create the Kubernetes resources required for Linkerd installation, specifically: + +```bash +√ can create Namespaces +√ can create ClusterRoles +√ can create ClusterRoleBindings +√ can create CustomResourceDefinitions +``` + +## The "pre-kubernetes-setup" checks {#pre-k8s} + +These checks only run when the `--pre` flag is set This flag is intended for use +prior to running `linkerd install`, to verify you have the correct RBAC +permissions to install Linkerd. + +```bash +√ can create Namespaces +√ can create ClusterRoles +√ can create ClusterRoleBindings +√ can create CustomResourceDefinitions +√ can create PodSecurityPolicies +√ can create ServiceAccounts +√ can create Services +√ can create Deployments +√ can create ConfigMaps +``` + +### √ no clock skew detected {#pre-k8s-clock-skew} + +This check detects any differences between the system running the +`linkerd install` command and the Kubernetes nodes (known as clock skew). Having +a substantial clock skew can cause TLS validation problems because a node may +determine that a TLS certificate is expired when it should not be, or vice +versa. + +Linkerd version edge-20.3.4 and later check for a difference of at most 5 +minutes and older versions of Linkerd (including stable-2.7) check for a +difference of at most 1 minute. If your Kubernetes node heartbeat interval is +longer than this difference, you may experience false positives of this check. +The default node heartbeat interval was increased to 5 minutes in Kubernetes +1.17 meaning that users running Linkerd versions prior to edge-20.3.4 on +Kubernetes 1.17 or later are likely to experience these false positives. If this +is the case, you can upgrade to Linkerd edge-20.3.4 or later. If you choose to +ignore this error, we strongly recommend that you verify that your system clocks +are consistent. + +## The "pre-kubernetes-capability" checks {#pre-k8s-capability} + +These checks only run when the `--pre` flag is set. This flag is intended for +use prior to running `linkerd install`, to verify you have the correct +Kubernetes capability permissions to install Linkerd. + +## The "pre-linkerd-global-resources" checks {#pre-l5d-existence} + +These checks only run when the `--pre` flag is set. This flag is intended for +use prior to running `linkerd install`, to verify you have not already installed +the Linkerd control plane. + +```bash +√ no ClusterRoles exist +√ no ClusterRoleBindings exist +√ no CustomResourceDefinitions exist +√ no MutatingWebhookConfigurations exist +√ no ValidatingWebhookConfigurations exist +√ no PodSecurityPolicies exist +``` + +## The "pre-kubernetes-single-namespace-setup" checks {#pre-single} + +If you do not expect to have the permission for a full cluster install, try the +`--single-namespace` flag, which validates if Linkerd can be installed in a +single namespace, with limited cluster access: + +```bash +linkerd check --pre --single-namespace +``` + +## The "kubernetes-api" checks {#k8s-api} + +Example failures: + +```bash +× can initialize the client + error configuring Kubernetes API client: stat badconfig: no such file or directory +× can query the Kubernetes API + Get https://8.8.8.8/version: dial tcp 8.8.8.8:443: i/o timeout +``` + +Ensure that your system is configured to connect to a Kubernetes cluster. +Validate that the `KUBECONFIG` environment variable is set properly, and/or +`~/.kube/config` points to a valid cluster. + +For more information see these pages in the Kubernetes Documentation: + +- [Accessing Clusters](https://kubernetes.io/docs/tasks/access-application-cluster/access-cluster/) +- [Configure Access to Multiple Clusters](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/) + +Also verify that these command works: + +```bash +kubectl config view +kubectl cluster-info +kubectl version +``` + +Another example failure: + +```bash +✘ can query the Kubernetes API + Get REDACTED/version: x509: certificate signed by unknown authority +``` + +As an (unsafe) workaround to this, you may try: + +```bash +kubectl config set-cluster ${KUBE_CONTEXT} --insecure-skip-tls-verify=true \ + --server=${KUBE_CONTEXT} +``` + +## The "kubernetes-version" checks + +### √ is running the minimum Kubernetes API version {#k8s-version} + +Example failure: + +```bash +× is running the minimum Kubernetes API version + Kubernetes is on version [1.7.16], but version [1.13.0] or more recent is required +``` + +Linkerd requires at least version `1.13.0`. Verify your cluster version with: + +```bash +kubectl version +``` + +### √ is running the minimum kubectl version {#kubectl-version} + +Example failure: + +```bash +× is running the minimum kubectl version + kubectl is on version [1.9.1], but version [1.13.0] or more recent is required + see https://linkerd.io/2/checks/#kubectl-version for hints +``` + +Linkerd requires at least version `1.13.0`. Verify your kubectl version with: + +```bash +kubectl version --client --short +``` + +To fix please update kubectl version. + +For more information on upgrading Kubernetes, see the page in the Kubernetes +Documentation. + +## The "linkerd-config" checks {#l5d-config} + +This category of checks validates that Linkerd's cluster-wide RBAC and related +resources have been installed. + +### √ control plane Namespace exists {#l5d-existence-ns} + +Example failure: + +```bash +× control plane Namespace exists + The "foo" namespace does not exist + see https://linkerd.io/2/checks/#l5d-existence-ns for hints +``` + +Ensure the Linkerd control plane namespace exists: + +```bash +kubectl get ns +``` + +The default control plane namespace is `linkerd`. If you installed Linkerd into +a different namespace, specify that in your check command: + +```bash +linkerd check --linkerd-namespace linkerdtest +``` + +### √ control plane ClusterRoles exist {#l5d-existence-cr} + +Example failure: + +```bash +× control plane ClusterRoles exist + missing ClusterRoles: linkerd-linkerd-identity + see https://linkerd.io/2/checks/#l5d-existence-cr for hints +``` + +Ensure the Linkerd ClusterRoles exist: + +```bash +$ kubectl get clusterroles | grep linkerd +linkerd-linkerd-destination 9d +linkerd-linkerd-identity 9d +linkerd-linkerd-proxy-injector 9d +linkerd-policy 9d +``` + +Also ensure you have permission to create ClusterRoles: + +```bash +$ kubectl auth can-i create clusterroles +yes +``` + +### √ control plane ClusterRoleBindings exist {#l5d-existence-crb} + +Example failure: + +```bash +× control plane ClusterRoleBindings exist + missing ClusterRoleBindings: linkerd-linkerd-identity + see https://linkerd.io/2/checks/#l5d-existence-crb for hints +``` + +Ensure the Linkerd ClusterRoleBindings exist: + +```bash +$ kubectl get clusterrolebindings | grep linkerd +linkerd-linkerd-destination 9d +linkerd-linkerd-identity 9d +linkerd-linkerd-proxy-injector 9d +linkerd-destination-policy 9d +``` + +Also ensure you have permission to create ClusterRoleBindings: + +```bash +$ kubectl auth can-i create clusterrolebindings +yes +``` + +### √ control plane ServiceAccounts exist {#l5d-existence-sa} + +Example failure: + +```bash +× control plane ServiceAccounts exist + missing ServiceAccounts: linkerd-identity + see https://linkerd.io/2/checks/#l5d-existence-sa for hints +``` + +Ensure the Linkerd ServiceAccounts exist: + +```bash +$ kubectl -n linkerd get serviceaccounts +NAME SECRETS AGE +default 1 14m +linkerd-destination 1 14m +linkerd-heartbeat 1 14m +linkerd-identity 1 14m +linkerd-proxy-injector 1 14m +``` + +Also ensure you have permission to create ServiceAccounts in the Linkerd +namespace: + +```bash +$ kubectl -n linkerd auth can-i create serviceaccounts +yes +``` + +### √ control plane CustomResourceDefinitions exist {#l5d-existence-crd} + +Example failure: + +```bash +× control plane CustomResourceDefinitions exist + missing CustomResourceDefinitions: serviceprofiles.linkerd.io + see https://linkerd.io/2/checks/#l5d-existence-crd for hints +``` + +Ensure the Linkerd CRD exists: + +```bash +$ kubectl get customresourcedefinitions +NAME CREATED AT +serviceprofiles.linkerd.io 2019-04-25T21:47:31Z +``` + +Also ensure you have permission to create CRDs: + +```bash +$ kubectl auth can-i create customresourcedefinitions +yes +``` + +### √ control plane MutatingWebhookConfigurations exist {#l5d-existence-mwc} + +Example failure: + +```bash +× control plane MutatingWebhookConfigurations exist + missing MutatingWebhookConfigurations: linkerd-proxy-injector-webhook-config + see https://linkerd.io/2/checks/#l5d-existence-mwc for hints +``` + +Ensure the Linkerd MutatingWebhookConfigurations exists: + +```bash +$ kubectl get mutatingwebhookconfigurations | grep linkerd +linkerd-proxy-injector-webhook-config 2019-07-01T13:13:26Z +``` + +Also ensure you have permission to create MutatingWebhookConfigurations: + +```bash +$ kubectl auth can-i create mutatingwebhookconfigurations +yes +``` + +### √ control plane ValidatingWebhookConfigurations exist {#l5d-existence-vwc} + +Example failure: + +```bash +× control plane ValidatingWebhookConfigurations exist + missing ValidatingWebhookConfigurations: linkerd-sp-validator-webhook-config + see https://linkerd.io/2/checks/#l5d-existence-vwc for hints +``` + +Ensure the Linkerd ValidatingWebhookConfiguration exists: + +```bash +$ kubectl get validatingwebhookconfigurations | grep linkerd +linkerd-sp-validator-webhook-config 2019-07-01T13:13:26Z +``` + +Also ensure you have permission to create ValidatingWebhookConfigurations: + +```bash +$ kubectl auth can-i create validatingwebhookconfigurations +yes +``` + +### √ proxy-init container runs as root if docker container runtime is used {#l5d-proxy-init-run-as-root} + +Example failure: + +```bash +× proxy-init container runs as root user if docker container runtime is used + there are nodes using the docker container runtime and proxy-init container must run as root user. +try installing linkerd via --set proxyInit.runAsRoot=true + see https://linkerd.io/2/checks/#l5d-proxy-init-run-as-root for hints +``` + +Kubernetes nodes running with docker as the container runtime +([CRI](https://kubernetes.io/docs/concepts/architecture/cri/)) require the init +container to run as root for iptables. + +Newer distributions of managed k8s use containerd where this is not an issue. + +Without root in the init container you might get errors such as: + +```bash +time="2021-11-15T04:41:31Z" level=info msg="iptables-save -t nat" +Error: exit status 1 +time="2021-11-15T04:41:31Z" level=info msg="iptables-save v1.8.7 (legacy): Cannot initialize: Permission denied (you must be root)\n\n" +``` + +See [linkerd/linkerd2#7283](https://github.com/linkerd/linkerd2/issues/7283) and +[linkerd/linkerd2#7308](https://github.com/linkerd/linkerd2/issues/7308) for +further details. + +## The "linkerd-existence" checks {#l5d-existence} + +### √ 'linkerd-config' config map exists {#l5d-existence-linkerd-config} + +Example failure: + +```bash +× 'linkerd-config' config map exists + missing ConfigMaps: linkerd-config + see https://linkerd.io/2/checks/#l5d-existence-linkerd-config for hints +``` + +Ensure the Linkerd ConfigMap exists: + +```bash +$ kubectl -n linkerd get configmap/linkerd-config +NAME DATA AGE +linkerd-config 3 61m +``` + +Also ensure you have permission to create ConfigMaps: + +```bash +$ kubectl -n linkerd auth can-i create configmap +yes +``` + +### √ control plane replica sets are ready {#l5d-existence-replicasets} + +This failure occurs when one of Linkerd's ReplicaSets fails to schedule a pod. + +For more information, see the Kubernetes documentation on +[Failed Deployments](https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#failed-deployment). + +### √ no unschedulable pods {#l5d-existence-unschedulable-pods} + +Example failure: + +```bash +× no unschedulable pods + linkerd-prometheus-6b668f774d-j8ncr: 0/1 nodes are available: 1 Insufficient cpu. + see https://linkerd.io/2/checks/#l5d-existence-unschedulable-pods for hints +``` + +For more information, see the Kubernetes documentation on the +[Unschedulable Pod Condition](https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-conditions). + +## The "linkerd-identity" checks {#l5d-identity} + +### √ certificate config is valid {#l5d-identity-cert-config-valid} + +Example failures: + +```bash +× certificate config is valid + key ca.crt containing the trust anchors needs to exist in secret linkerd-identity-issuer if --identity-external-issuer=true + see https://linkerd.io/2/checks/#l5d-identity-cert-config-valid +``` + +```bash +× certificate config is valid + key crt.pem containing the issuer certificate needs to exist in secret linkerd-identity-issuer if --identity-external-issuer=false + see https://linkerd.io/2/checks/#l5d-identity-cert-config-valid +``` + +Ensure that your `linkerd-identity-issuer` secret contains the correct keys for +the `scheme` that Linkerd is configured with. If the scheme is +`kubernetes.io/tls` your secret should contain the `tls.crt`, `tls.key` and +`ca.crt` keys. Alternatively if your scheme is `linkerd.io/tls`, the required +keys are `crt.pem` and `key.pem`. + +### √ trust roots are using supported crypto algorithm {#l5d-identity-trustAnchors-use-supported-crypto} + +Example failure: + +```bash +× trust roots are using supported crypto algorithm + Invalid roots: + * 165223702412626077778653586125774349756 identity.linkerd.cluster.local must use P-256 curve for public key, instead P-521 was used + see https://linkerd.io/2/checks/#l5d-identity-trustAnchors-use-supported-crypto +``` + +You need to ensure that all of your roots use ECDSA P-256 for their public key +algorithm. + +### √ trust roots are within their validity period {#l5d-identity-trustAnchors-are-time-valid} + +Example failure: + +```bash +× trust roots are within their validity period + Invalid roots: + * 199607941798581518463476688845828639279 identity.linkerd.cluster.local not valid anymore. Expired on 2019-12-19T13:08:18Z + see https://linkerd.io/2/checks/#l5d-identity-trustAnchors-are-time-valid for hints +``` + +Failures of such nature indicate that your roots have expired. If that is the +case you will have to update both the root and issuer certificates at once. You +can follow the process outlined in +[Replacing Expired Certificates](../replacing_expired_certificates/) to get your +cluster back to a stable state. + +### √ trust roots are valid for at least 60 days {#l5d-identity-trustAnchors-not-expiring-soon} + +Example warnings: + +```bash +‼ trust roots are valid for at least 60 days + Roots expiring soon: + * 66509928892441932260491975092256847205 identity.linkerd.cluster.local will expire on 2019-12-19T13:30:57Z + see https://linkerd.io/2/checks/#l5d-identity-trustAnchors-not-expiring-soon for hints +``` + +This warning indicates that the expiry of some of your roots is approaching. In +order to address this problem without incurring downtime, you can follow the +process outlined in +[Rotating your identity certificates](../manually-rotating-control-plane-tls-credentials/). + +### √ issuer cert is using supported crypto algorithm {#l5d-identity-issuer-cert-uses-supported-crypto} + +Example failure: + +```bash +× issuer cert is using supported crypto algorithm + issuer certificate must use P-256 curve for public key, instead P-521 was used + see https://linkerd.io/2/checks/#5d-identity-issuer-cert-uses-supported-crypto for hints +``` + +You need to ensure that your issuer certificate uses ECDSA P-256 for its public +key algorithm. You can refer to +[Generating your own mTLS root certificates](../generate-certificates/#generating-the-certificates-with-step) +to see how you can generate certificates that will work with Linkerd. + +### √ issuer cert is within its validity period {#l5d-identity-issuer-cert-is-time-valid} + +Example failure: + +```bash +× issuer cert is within its validity period + issuer certificate is not valid anymore. Expired on 2019-12-19T13:35:49Z + see https://linkerd.io/2/checks/#l5d-identity-issuer-cert-is-time-valid +``` + +This failure indicates that your issuer certificate has expired. In order to +bring your cluster back to a valid state, follow the process outlined in +[Replacing Expired Certificates](../replacing_expired_certificates/). + +### √ issuer cert is valid for at least 60 days {#l5d-identity-issuer-cert-not-expiring-soon} + +Example warning: + +```bash +‼ issuer cert is valid for at least 60 days + issuer certificate will expire on 2019-12-19T13:35:49Z + see https://linkerd.io/2/checks/#l5d-identity-issuer-cert-not-expiring-soon for hints +``` + +This warning means that your issuer certificate is expiring soon. If you do not +rely on external certificate management solution such as `cert-manager`, you can +follow the process outlined in +[Rotating your identity certificates](../manually-rotating-control-plane-tls-credentials/) + +### √ issuer cert is issued by the trust root {#l5d-identity-issuer-cert-issued-by-trust-anchor} + +Example error: + +```bash +× issuer cert is issued by the trust root + x509: certificate signed by unknown authority (possibly because of "x509: ECDSA verification failure" while trying to verify candidate authority certificate "identity.linkerd.cluster.local") + see https://linkerd.io/2/checks/#l5d-identity-issuer-cert-issued-by-trust-anchor for hints +``` + +This error indicates that the issuer certificate that is in the +`linkerd-identity-issuer` secret cannot be verified with any of the roots that +Linkerd has been configured with. Using the CLI install process, this should +never happen. If Helm was used for installation or the issuer certificates are +managed by a malfunctioning certificate management solution, it is possible for +the cluster to end up in such an invalid state. At that point the best to do is +to use the upgrade command to update your certificates: + +```bash +linkerd upgrade \ + --identity-issuer-certificate-file=./your-new-issuer.crt \ + --identity-issuer-key-file=./your-new-issuer.key \ + --identity-trust-anchors-file=./your-new-roots.crt \ + --force | kubectl apply -f - +``` + +Once the upgrade process is over, the output of `linkerd check --proxy` should +be: + +```bash +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +√ trust roots are within their validity period +√ trust roots are valid for at least 60 days +√ issuer cert is using supported crypto algorithm +√ issuer cert is within its validity period +√ issuer cert is valid for at least 60 days +√ issuer cert is issued by the trust root + +linkerd-identity-data-plane +--------------------------- +√ data plane proxies certificate match CA +``` + +## The "linkerd-webhooks-and-apisvc-tls" checks {#l5d-webhook} + +### √ proxy-injector webhook has valid cert {#l5d-proxy-injector-webhook-cert-valid} + +Example failure: + +```bash +× proxy-injector webhook has valid cert + secrets "linkerd-proxy-injector-tls" not found + see https://linkerd.io/2/checks/#l5d-proxy-injector-webhook-cert-valid for hints +``` + +Ensure that the `linkerd-proxy-injector-k8s-tls` secret exists and contains the +appropriate `tls.crt` and `tls.key` data entries. For versions before 2.9, the +secret is named `linkerd-proxy-injector-tls` and it should contain the `crt.pem` +and `key.pem` data entries. + +```bash +× proxy-injector webhook has valid cert + cert is not issued by the trust anchor: x509: certificate is valid for xxxxxx, not linkerd-proxy-injector.linkerd.svc + see https://linkerd.io/2/checks/#l5d-proxy-injector-webhook-cert-valid for hints +``` + +Here you need to make sure the certificate was issued specifically for +`linkerd-proxy-injector.linkerd.svc`. + +### √ proxy-injector cert is valid for at least 60 days {#l5d-proxy-injector-webhook-cert-not-expiring-soon} + +Example failure: + +```bash +‼ proxy-injector cert is valid for at least 60 days + certificate will expire on 2020-11-07T17:00:07Z + see https://linkerd.io/2/checks/#l5d-proxy-injector-webhook-cert-not-expiring-soon for hints +``` + +This warning indicates that the expiry of proxy-injnector webhook cert is +approaching. In order to address this problem without incurring downtime, you +can follow the process outlined in +[Automatically Rotating your webhook TLS Credentials](../automatically-rotating-webhook-tls-credentials/). + +### √ sp-validator webhook has valid cert {#l5d-sp-validator-webhook-cert-valid} + +Example failure: + +```bash +× sp-validator webhook has valid cert + secrets "linkerd-sp-validator-tls" not found + see https://linkerd.io/2/checks/#l5d-sp-validator-webhook-cert-valid for hints +``` + +Ensure that the `linkerd-sp-validator-k8s-tls` secret exists and contains the +appropriate `tls.crt` and `tls.key` data entries. For versions before 2.9, the +secret is named `linkerd-sp-validator-tls` and it should contain the `crt.pem` +and `key.pem` data entries. + +```bash +× sp-validator webhook has valid cert + cert is not issued by the trust anchor: x509: certificate is valid for xxxxxx, not linkerd-sp-validator.linkerd.svc + see https://linkerd.io/2/checks/#l5d-sp-validator-webhook-cert-valid for hints +``` + +Here you need to make sure the certificate was issued specifically for +`linkerd-sp-validator.linkerd.svc`. + +### √ sp-validator cert is valid for at least 60 days {#l5d-sp-validator-webhook-cert-not-expiring-soon} + +Example failure: + +```bash +‼ sp-validator cert is valid for at least 60 days + certificate will expire on 2020-11-07T17:00:07Z + see https://linkerd.io/2/checks/#l5d-sp-validator-webhook-cert-not-expiring-soon for hints +``` + +This warning indicates that the expiry of sp-validator webhook cert is +approaching. In order to address this problem without incurring downtime, you +can follow the process outlined in +[Automatically Rotating your webhook TLS Credentials](../automatically-rotating-webhook-tls-credentials/). + +### √ policy-validator webhook has valid cert {#l5d-policy-validator-webhook-cert-valid} + +Example failure: + +```bash +× policy-validator webhook has valid cert + secrets "linkerd-policy-validator-tls" not found + see https://linkerd.io/2/checks/#l5d-policy-validator-webhook-cert-valid for hints +``` + +Ensure that the `linkerd-policy-validator-k8s-tls` secret exists and contains +the appropriate `tls.crt` and `tls.key` data entries. + +```bash +× policy-validator webhook has valid cert + cert is not issued by the trust anchor: x509: certificate is valid for xxxxxx, not linkerd-policy-validator.linkerd.svc + see https://linkerd.io/2/checks/#l5d-policy-validator-webhook-cert-valid for hints +``` + +Here you need to make sure the certificate was issued specifically for +`linkerd-policy-validator.linkerd.svc`. + +### √ policy-validator cert is valid for at least 60 days {#l5d-policy-validator-webhook-cert-not-expiring-soon} + +Example failure: + +```bash +‼ policy-validator cert is valid for at least 60 days + certificate will expire on 2020-11-07T17:00:07Z + see https://linkerd.io/2/checks/#l5d-policy-validator-webhook-cert-not-expiring-soon for hints +``` + +This warning indicates that the expiry of policy-validator webhook cert is +approaching. In order to address this problem without incurring downtime, you +can follow the process outlined in +[Automatically Rotating your webhook TLS Credentials](../automatically-rotating-webhook-tls-credentials/). + +## The "linkerd-identity-data-plane" checks {#l5d-identity-data-plane} + +### √ data plane proxies certificate match CA {#l5d-identity-data-plane-proxies-certs-match-ca} + +Example warning: + +```bash +‼ data plane proxies certificate match CA + Some pods do not have the current trust bundle and must be restarted: + * emojivoto/emoji-d8d7d9c6b-8qwfx + * emojivoto/vote-bot-588499c9f6-zpwz6 + * emojivoto/voting-8599548fdc-6v64k + see https://linkerd.io/2/checks/{#l5d-identity-data-plane-proxies-certs-match-ca for hints +``` + +Observing this warning indicates that some of your meshed pods have proxies that +have stale certificates. This is most likely to happen during `upgrade` +operations that deal with cert rotation. In order to solve the problem you can +use `rollout restart` to restart the pods in question. That should cause them to +pick the correct certs from the `linkerd-config` configmap. When `upgrade` is +performed using the `--identity-trust-anchors-file` flag to modify the roots, +the Linkerd components are restarted. While this operation is in progress the +`check --proxy` command may output a warning, pertaining to the Linkerd +components: + +```bash +‼ data plane proxies certificate match CA + Some pods do not have the current trust bundle and must be restarted: + * linkerd/linkerd-sp-validator-75f9d96dc-rch4x + * linkerd-viz/tap-68d8bbf64-mpzgb + * linkerd-viz/web-849f74b7c6-qlhwc + see https://linkerd.io/2/checks/{#l5d-identity-data-plane-proxies-certs-match-ca for hints +``` + +If that is the case, simply wait for the `upgrade` operation to complete. The +stale pods should terminate and be replaced by new ones, configured with the +correct certificates. + +## The "linkerd-api" checks {#l5d-api} + +### √ control plane pods are ready {#l5d-api-control-ready} + +Example failure: + +```bash +× control plane pods are ready + No running pods for "linkerd-sp-validator" +``` + +Verify the state of the control plane pods with: + +```bash +$ kubectl -n linkerd get po +NAME READY STATUS RESTARTS AGE +linkerd-destination-5fd7b5d466-szgqm 2/2 Running 1 12m +linkerd-identity-54df78c479-hbh5m 2/2 Running 0 12m +linkerd-proxy-injector-67f8cf65f7-4tvt5 2/2 Running 1 12m +``` + +### √ cluster networks can be verified {#l5d-cluster-networks-verified} + +Example failure: + +```bash +‼ cluster networks can be verified + the following nodes do not expose a podCIDR: + node-0 + see https://linkerd.io/2/checks/#l5d-cluster-networks-verified for hints +``` + +Linkerd has a `clusterNetworks` setting which allows it to differentiate between +intra-cluster and egress traffic. Through each Node's `podCIDR` field, Linkerd +can verify that all possible Pod IPs are included in the `clusterNetworks` +setting. When a Node is missing the `podCIDR` field, Linkerd can not verify +this, and it's possible that the Node creates a Pod with an IP outside of +`clusterNetworks`; this may result in it not being meshed properly. + +Nodes are not required to expose a `podCIDR` field which is why this results in +a warning. Getting a Node to expose this field depends on the specific +distribution being used. + +### √ cluster networks contains all node podCIDRs {#l5d-cluster-networks-cidr} + +Example failure: + +```bash +× cluster networks contains all node podCIDRs + node has podCIDR(s) [10.244.0.0/24] which are not contained in the Linkerd clusterNetworks. + Try installing linkerd via --set clusterNetworks=10.244.0.0/24 + see https://linkerd.io/2/checks/#l5d-cluster-networks-cidr for hints +``` + +Linkerd has a `clusterNetworks` setting which allows it to differentiate between +intra-cluster and egress traffic. This warning indicates that the cluster has a +podCIDR which is not included in Linkerd's `clusterNetworks`. Traffic to pods in +this network may not be meshed properly. To remedy this, update the +`clusterNetworks` setting to include all pod networks in the cluster. + +### √ cluster networks contains all pods {#l5d-cluster-networks-pods} + +Example failures: + +```bash +× the Linkerd clusterNetworks [10.244.0.0/24] do not include pod default/foo (104.21.63.202) + see https://linkerd.io/2/checks/#l5d-cluster-networks-pods for hints +``` + +```bash +× the Linkerd clusterNetworks [10.244.0.0/24] do not include svc default/bar (10.96.217.194) + see https://linkerd.io/2/checks/#l5d-cluster-networks-pods for hints +``` + +Linkerd has a `clusterNetworks` setting which allows it to differentiate between +intra-cluster and egress traffic. This warning indicates that the cluster has a +pod or ClusterIP service which is not included in Linkerd's `clusterNetworks`. +Traffic to pods or services in this network may not be meshed properly. To +remedy this, update the `clusterNetworks` setting to include all pod and service +networks in the cluster. + +## The "linkerd-version" checks {#l5d-version} + +### √ can determine the latest version {#l5d-version-latest} + +Example failure: + +```bash +× can determine the latest version + Get https://versioncheck.linkerd.io/version.json?version=edge-19.1.2&uuid=test-uuid&source=cli: context deadline exceeded +``` + +Ensure you can connect to the Linkerd version check endpoint from the +environment the `linkerd` cli is running: + +```bash +$ curl "https://versioncheck.linkerd.io/version.json?version=edge-19.1.2&uuid=test-uuid&source=cli" +{"stable":"stable-2.1.0","edge":"edge-19.1.2"} +``` + +### √ cli is up-to-date {#l5d-version-cli} + +Example failures: + +#### unsupported version channel + +```bash +‼ cli is up-to-date + unsupported version channel: stable-2.14.10 +``` + +As of February 2024, the Linkerd project itself only produces [edge +release](/releases/) artifacts. For more details, read the [Releases and +Versions](/releases/) page. + +#### is running version X but the latest version is Y + +```bash +‼ cli is up-to-date + is running version 19.1.1 but the latest edge version is 19.1.2 +``` + +There is a newer version of the `linkerd` cli. See the page on +[Upgrading Linkerd](../upgrade/). + +## The "control-plane-version" checks {#l5d-version-control} + +### √ control plane is up-to-date {#l5d-version-control-up-to-date} + +Example failures: + +#### unsupported version channel + +```bash +‼ control plane is up-to-date + unsupported version channel: stable-2.14.10 +``` + +As of February 2024, the Linkerd project itself only produces [edge +release](/releases/) artifacts. For more details, read the [Releases and +Versions](/releases/) page. + +#### is running version X but the latest version is Y + +```bash +‼ control plane is up-to-date + is running version 19.1.1 but the latest edge version is 19.1.2 +``` + +There is a newer version of the control plane. See the page on +[Upgrading Linkerd](../upgrade/). + +### √ control plane and cli versions match {#l5d-version-control-mismatched} + +Example failure: + +```bash +‼ control plane and cli versions match + mismatched channels: running stable-2.1.0 but retrieved edge-19.1.2 +``` + +Your CLI and your control plane are running different types of releases. This +may cause issues. + +## The "linkerd-control-plane-proxy" checks {#linkerd-control-plane-proxy} + +### √ control plane proxies are healthy {#l5d-cp-proxy-healthy} + +This error indicates that the proxies running in the Linkerd control plane are +not healthy. Ensure that Linkerd has been installed with all of the correct +setting or re-install Linkerd as necessary. + +### √ control plane proxies are up-to-date {#l5d-cp-proxy-version} + +This warning indicates the proxies running in the Linkerd control plane are +running an old version. We recommend downloading the latest Linkerd release and +[Upgrading Linkerd](../upgrade/). + +### √ control plane proxies and cli versions match {#l5d-cp-proxy-cli-version} + +This warning indicates that the proxies running in the Linkerd control plane are +running a different version from the Linkerd CLI. We recommend keeping this +versions in sync by updating either the CLI or the control plane as necessary. + +## The "linkerd-data-plane" checks {#l5d-data-plane} + +These checks only run when the `--proxy` flag is set. This flag is intended for +use after running `linkerd inject`, to verify the injected proxies are operating +normally. + +### √ data plane namespace exists {#l5d-data-plane-exists} + +Example failure: + +```bash +$ linkerd check --proxy --namespace foo +... +× data plane namespace exists + The "foo" namespace does not exist +``` + +Ensure the `--namespace` specified exists, or, omit the parameter to check all +namespaces. + +### √ data plane proxies are ready {#l5d-data-plane-ready} + +Example failure: + +```bash +× data plane proxies are ready + No "linkerd-proxy" containers found +``` + +Ensure you have injected the Linkerd proxy into your application via the +`linkerd inject` command. + +For more information on `linkerd inject`, see +[Step 5: Install the demo app](../../getting-started/#step-5-install-the-demo-app) +in our [Getting Started](../../getting-started/) guide. + +### √ data plane is up-to-date {#l5d-data-plane-version} + +Example failure: + +```bash +‼ data plane is up-to-date + linkerd/linkerd-prometheus-74d66f86f6-6t6dh: is running version 19.1.2 but the latest edge version is 19.1.3 +``` + +See the page on [Upgrading Linkerd](../upgrade/). + +### √ data plane and cli versions match {#l5d-data-plane-cli-version} + +```bash +‼ data plane and cli versions match + linkerd/linkerd-identity-5f6c45d6d9-9hd9j: is running version 19.1.2 but the latest edge version is 19.1.3 +``` + +See the page on [Upgrading Linkerd](../upgrade/). + +### √ data plane pod labels are configured correctly {#l5d-data-plane-pod-labels} + +Example failure: + +```bash +‼ data plane pod labels are configured correctly + Some labels on data plane pods should be annotations: + * emojivoto/voting-ff4c54b8d-tv9pp + linkerd.io/inject +``` + +`linkerd.io/inject`, `config.linkerd.io/*` or `config.alpha.linkerd.io/*` should +be annotations in order to take effect. + +### √ data plane service labels are configured correctly {#l5d-data-plane-services-labels} + +Example failure: + +```bash +‼ data plane service labels and annotations are configured correctly + Some labels on data plane services should be annotations: + * emojivoto/emoji-svc + config.linkerd.io/control-port +``` + +`config.linkerd.io/*` or `config.alpha.linkerd.io/*` should be annotations in +order to take effect. + +### √ data plane service annotations are configured correctly {#l5d-data-plane-services-annotations} + +Example failure: + +```bash +‼ data plane service annotations are configured correctly + Some annotations on data plane services should be labels: + * emojivoto/emoji-svc + mirror.linkerd.io/exported +``` + +`mirror.linkerd.io/exported` should be a label in order to take effect. + +### √ opaque ports are properly annotated {#linkerd-opaque-ports-definition} + +Example failure: + +```bash +× opaque ports are properly annotated + * service emoji-svc targets the opaque port 8080 through 8080; add 8080 to its config.linkerd.io/opaque-ports annotation + see https://linkerd.io/2/checks/#linkerd-opaque-ports-definition for hints +``` + +If a Pod marks a port as opaque by using the `config.linkerd.io/opaque-ports` +annotation, then any Service which targets that port must also use the +`config.linkerd.io/opaque-ports` annotation to mark that port as opaque. Having +a port marked as opaque on the Pod but not the Service (or vice versa) can cause +inconsistent behavior depending on if traffic is sent to the Pod directly (for +example with a headless Service) or through a ClusterIP Service. This error can +be remedied by adding the `config.linkerd.io/opaque-ports` annotation to both +the Pod and Service. See +[Protocol Detection](../../features/protocol-detection/) for more information. + +## The "linkerd-ha-checks" checks {#l5d-ha} + +These checks are ran if Linkerd has been installed in HA mode. + +### √ multiple replicas of control plane pods {#l5d-control-plane-replicas} + +Example warning: + +```bash +‼ multiple replicas of control plane pods + not enough replicas available for [linkerd-identity] + see https://linkerd.io/2/checks/#l5d-control-plane-replicas for hints +``` + +This happens when one of the control plane pods doesn't have at least two +replicas running. This is likely caused by insufficient node resources. + +## Extensions {#extensions} + +### √ namespace configuration for extensions {#l5d-extension-namespaces} + +Linkerd's extension model requires that each namespace that "owns" an extension +to be labelled with the extension name. For example, the namespace viz is +installed in would be labelled with `linkerd.io/extension=viz`. This warning is +triggered if an extension value is used for the label key more than once across +the cluster. + +To resolve this warning, ensure that the `linkerd.io/extension` namespace label +does not have any dupliate values, indicating that an extension has been +installed more than once in different namespaces. + +### Extensions checks + +When any [Extensions](../extensions/) are installed, The Linkerd binary tries to +invoke `check --output json` on the extension binaries. It is important that the +extension binaries implement it. For more information, See +[Extension developer docs](https://github.com/linkerd/linkerd2/blob/main/EXTENSIONS.md) + +Example error: + +```bash +invalid extension check output from \"jaeger\" (JSON object expected) +``` + +Make sure that the extension binary implements `check --output json` which +returns the healthchecks in the +[expected json format](https://github.com/linkerd/linkerd2/blob/main/EXTENSIONS.md#linkerd-name-check). + +Example error: + +```bash +× Linkerd command jaeger exists +``` + +Make sure that relevant binary exists in `$PATH`. + +For more information about Linkerd extensions. See +[Extension developer docs](https://github.com/linkerd/linkerd2/blob/main/EXTENSIONS.md) + +## The "linkerd-cni-plugin" checks {#l5d-cni} + +These checks run if Linkerd has been installed with the `--linkerd-cni-enabled` +flag. Alternatively they can be run as part of the pre-checks by providing the +`--linkerd-cni-enabled` flag. Most of these checks verify that the required +resources are in place. If any of them are missing, you can use +`linkerd install-cni | kubectl apply -f -` to re-install them. + +### √ cni plugin ConfigMap exists {#cni-plugin-cm-exists} + +Example error: + +```bash +× cni plugin ConfigMap exists + configmaps "linkerd-cni-config" not found + see https://linkerd.io/2/checks/#cni-plugin-cm-exists for hints +``` + +Ensure that the linkerd-cni-config ConfigMap exists in the CNI namespace: + +```bash +$ kubectl get cm linkerd-cni-config -n linkerd-cni +NAME PRIV CAPS SELINUX RUNASUSER FSGROUP SUPGROUP READONLYROOTFS VOLUMES +linkerd-linkerd-cni-cni false RunAsAny RunAsAny RunAsAny RunAsAny false hostPath,secret +``` + +Also ensure you have permission to create ConfigMaps: + +```bash +$ kubectl auth can-i create ConfigMaps +yes +``` + +### √ cni plugin ClusterRole exist {#cni-plugin-cr-exists} + +Example error: + +```bash +× cni plugin ClusterRole exists + missing ClusterRole: linkerd-cni + see https://linkerd.io/2/checks/#cni-plugin-cr-exists for hints +``` + +Ensure that the cluster role exists: + +```bash +$ kubectl get clusterrole linkerd-cni +NAME AGE +linkerd-cni 54m +``` + +Also ensure you have permission to create ClusterRoles: + +```bash +$ kubectl auth can-i create ClusterRoles +yes +``` + +### √ cni plugin ClusterRoleBinding exist {#cni-plugin-crb-exists} + +Example error: + +```bash +× cni plugin ClusterRoleBinding exists + missing ClusterRoleBinding: linkerd-cni + see https://linkerd.io/2/checks/#cni-plugin-crb-exists for hints +``` + +Ensure that the cluster role binding exists: + +```bash +$ kubectl get clusterrolebinding linkerd-cni +NAME AGE +linkerd-cni 54m +``` + +Also ensure you have permission to create ClusterRoleBindings: + +```bash +$ kubectl auth can-i create ClusterRoleBindings +yes +``` + +### √ cni plugin ServiceAccount exists {#cni-plugin-sa-exists} + +Example error: + +```bash +× cni plugin ServiceAccount exists + missing ServiceAccount: linkerd-cni + see https://linkerd.io/2/checks/#cni-plugin-sa-exists for hints +``` + +Ensure that the CNI service account exists in the CNI namespace: + +```bash +$ kubectl get ServiceAccount linkerd-cni -n linkerd-cni +NAME SECRETS AGE +linkerd-cni 1 45m +``` + +Also ensure you have permission to create ServiceAccount: + +```bash +$ kubectl auth can-i create ServiceAccounts -n linkerd-cni +yes +``` + +### √ cni plugin DaemonSet exists {#cni-plugin-ds-exists} + +Example error: + +```bash +× cni plugin DaemonSet exists + missing DaemonSet: linkerd-cni + see https://linkerd.io/2/checks/#cni-plugin-ds-exists for hints +``` + +Ensure that the CNI daemonset exists in the CNI namespace: + +```bash +$ kubectl get ds -n linkerd-cni +NAME DESIRED CURRENT READY UP-TO-DATE AVAILABLE NODE SELECTOR AGE +linkerd-cni 1 1 1 1 1 beta.kubernetes.io/os=linux 14m +``` + +Also ensure you have permission to create DaemonSets: + +```bash +$ kubectl auth can-i create DaemonSets -n linkerd-cni +yes +``` + +### √ cni plugin pod is running on all nodes {#cni-plugin-ready} + +Example failure: + +```bash +‼ cni plugin pod is running on all nodes + number ready: 2, number scheduled: 3 + see https://linkerd.io/2/checks/#cni-plugin-ready +``` + +Ensure that all the CNI pods are running: + +```bash +$ kubectl get po -n linkerd-cn +NAME READY STATUS RESTARTS AGE +linkerd-cni-rzp2q 1/1 Running 0 9m20s +linkerd-cni-mf564 1/1 Running 0 9m22s +linkerd-cni-p5670 1/1 Running 0 9m25s +``` + +Ensure that all pods have finished the deployment of the CNI config and binary: + +```bash +$ kubectl logs linkerd-cni-rzp2q -n linkerd-cni +Wrote linkerd CNI binaries to /host/opt/cni/bin +Created CNI config /host/etc/cni/net.d/10-kindnet.conflist +Done configuring CNI. Sleep=true +``` + +## The "linkerd-multicluster checks {#l5d-multicluster} + +These checks run if the service mirroring controller has been installed. +Additionally they can be ran with `linkerd multicluster check`. Most of these +checks verify that the service mirroring controllers are working correctly along +with remote gateways. Furthermore the checks ensure that end to end TLS is +possible between paired clusters. + +### √ Link CRD exists {#l5d-multicluster-link-crd-exists} + +Example error: + +```bash +× Link CRD exists + multicluster.linkerd.io/Link CRD is missing + see https://linkerd.io/2/checks/#l5d-multicluster-link-crd-exists for hints +``` + +Make sure multicluster extension is correctly installed and that the +`links.multicluster.linkerd.io` CRD is present. + +```bash +$ kubectll get crds | grep multicluster +NAME CREATED AT +links.multicluster.linkerd.io 2021-03-10T09:58:10Z +``` + +### √ Link resources are valid {#l5d-multicluster-links-are-valid} + +Example error: + +```bash +× Link resources are valid + failed to parse Link east + see https://linkerd.io/2/checks/#l5d-multicluster-links-are-valid for hints +``` + +Make sure all the link objects are specified in the expected format. + +### √ Link and CLI versions match {#l5d-multicluster-links-version} + +This warning indicates that there are Link resources which do not match the +version of the CLI. This usually means that the CLI has been upgraded but that +the Link resources have not and certain features may not be supported on those +Links until they are upgraded. + +To upgrade a Link, regenerate it. Refer to the [multicluster docs](../multicluster/#linking-the-clusters) +for instructions on how to do this. + +### √ remote cluster access credentials are valid {#l5d-smc-target-clusters-access} + +Example error: + +```bash +× remote cluster access credentials are valid + * secret [east/east-config]: could not find east-config secret + see https://linkerd.io/2/checks/#l5d-smc-target-clusters-access for hints +``` + +Make sure the relevant Kube-config with relevant permissions. for the specific +target cluster is present as a secret correctly + +### √ clusters share trust anchors {#l5d-multicluster-clusters-share-anchors} + +Example errors: + +```bash +× clusters share trust anchors + Problematic clusters: + * remote + see https://linkerd.io/2/checks/#l5d-multicluster-clusters-share-anchors for hints +``` + +The error above indicates that your trust anchors are not compatible. In order +to fix that you need to ensure that both your anchors contain identical sets of +certificates. + +```bash +× clusters share trust anchors + Problematic clusters: + * remote: cannot parse trust anchors + see https://linkerd.io/2/checks/#l5d-multicluster-clusters-share-anchors for hints +``` + +Such an error indicates that there is a problem with your anchors on the cluster +named `remote` You need to make sure the identity config aspect of your Linkerd +installation on the `remote` cluster is ok. You can run `check` against the +remote cluster to verify that: + +```bash +linkerd --context=remote check +``` + +### √ service mirror controller has required permissions {#l5d-multicluster-source-rbac-correct} + +Example error: + +```bash +× service mirror controller has required permissions + missing Service mirror ClusterRole linkerd-service-mirror-access-local-resources: unexpected verbs expected create,delete,get,list,update,watch, got create,delete,get,update,watch + see https://linkerd.io/2/checks/#l5d-multicluster-source-rbac-correct for hints +``` + +This error indicates that the local RBAC permissions of the service mirror +service account are not correct. In order to ensure that you have the correct +verbs and resources you can inspect your ClusterRole and Role object and look at +the rules section. + +Expected rules for `linkerd-service-mirror-access-local-resources` cluster role: + +```bash +$ kubectl --context=local get clusterrole linkerd-service-mirror-access-local-resources -o yaml +kind: ClusterRole +metadata: + labels: + linkerd.io/control-plane-component: linkerd-service-mirror + name: linkerd-service-mirror-access-local-resources +rules: +- apiGroups: + - "" + resources: + - endpoints + - services + verbs: + - list + - get + - watch + - create + - delete + - update +- apiGroups: + - "" + resources: + - namespaces + verbs: + - create + - list + - get + - watch +``` + +Expected rules for `linkerd-service-mirror-read-remote-creds` role: + +```bash +$ kubectl --context=local get role linkerd-service-mirror-read-remote-creds -n linkerd-multicluster -o yaml +kind: Role +metadata: + labels: + linkerd.io/control-plane-component: linkerd-service-mirror + name: linkerd-service-mirror-read-remote-creds + namespace: linkerd-multicluster + rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - list + - get + - watch +``` + +### √ service mirror controllers are running {#l5d-multicluster-service-mirror-running} + +Example error: + +```bash +× service mirror controllers are running + Service mirror controller is not present + see https://linkerd.io/2/checks/#l5d-multicluster-service-mirror-running for hints +``` + +Note, it takes a little bit for pods to be scheduled, images to be pulled and +everything to start up. If this is a permanent error, you'll want to validate +the state of the controller pod with: + +```bash +$ kubectl --all-namespaces get po --selector linkerd.io/control-plane-component=linkerd-service-mirror +NAME READY STATUS RESTARTS AGE +linkerd-service-mirror-7bb8ff5967-zg265 2/2 Running 0 50m +``` + +### √ all gateway mirrors are healthy {#l5d-multicluster-gateways-endpoints} + +Example errors: + +```bash +‼ all gateway mirrors are healthy + Some gateway mirrors do not have endpoints: + linkerd-gateway-gke.linkerd-multicluster mirrored from cluster [gke] + see https://linkerd.io/2/checks/#l5d-multicluster-gateways-endpoints for hints +``` + +The error above indicates that some gateway mirror services in the source +cluster do not have associated endpoints resources. These endpoints are created +by the Linkerd service mirror controller on the source cluster whenever a link +is established with a target cluster. + +Such an error indicates that there could be a problem with the creation of the +resources by the service mirror controller or the external IP of the gateway +service in target cluster. + +### √ all mirror services have endpoints {#l5d-multicluster-services-endpoints} + +Example errors: + +```bash +‼ all mirror services have endpoints + Some mirror services do not have endpoints: + voting-svc-gke.emojivoto mirrored from cluster [gke] (gateway: [linkerd-multicluster/linkerd-gateway]) + see https://linkerd.io/2/checks/#l5d-multicluster-services-endpoints for hints +``` + +The error above indicates that some mirror services in the source cluster do not +have associated endpoints resources. These endpoints are created by the Linkerd +service mirror controller when creating a mirror service with endpoints values +as the remote gateway's external IP. + +Such an error indicates that there could be a problem with the creation of the +mirror resources by the service mirror controller or the mirror gateway service +in the source cluster or the external IP of the gateway service in target +cluster. + +### √ all mirror services are part of a Link {#l5d-multicluster-orphaned-services} + +Example errors: + +```bash +‼ all mirror services are part of a Link + mirror service voting-east.emojivoto is not part of any Link + see https://linkerd.io/2/checks/#l5d-multicluster-orphaned-services for hints +``` + +The error above indicates that some mirror services in the source cluster do not +have associated link. These mirror services are created by the Linkerd service +mirror controller when a remote service is marked to be mirrored. + +Make sure services are marked to be mirrored correctly at remote, and delete if +there are any unnecessary ones. + +### √ multicluster extension proxies are healthy {#l5d-multicluster-proxy-healthy} + +This error indicates that the proxies running in the multicluster extension are +not healthy. Ensure that linkerd-multicluster has been installed with all of the +correct setting or re-install as necessary. + +### √ multicluster extension proxies are up-to-date {#l5d-multicluster-proxy-cp-version} + +This warning indicates the proxies running in the multicluster extension are +running an old version. We recommend downloading the latest linkerd-multicluster +and upgrading. + +### √ multicluster extension proxies and cli versions match {#l5d-multicluster-proxy-cli-version} + +This warning indicates that the proxies running in the multicluster extension +are running a different version from the Linkerd CLI. We recommend keeping this +versions in sync by updating either the CLI or linkerd-multicluster as +necessary. + +## The "linkerd-viz" checks {#l5d-viz} + +These checks only run when the `linkerd-viz` extension is installed. This check +is intended to verify the installation of linkerd-viz extension which comprises +of `tap`, `web`, `metrics-api` and optional `grafana` and `prometheus` instances +along with `tap-injector` which injects the specific tap configuration to the +proxies. + +### √ linkerd-viz Namespace exists {#l5d-viz-ns-exists} + +This is the basic check used to verify if the linkerd-viz extension namespace is +installed or not. The extension can be installed by running the following +command: + +```bash +linkerd viz install | kubectl apply -f - +``` + +The installation can be configured by using the `--set`, `--values`, +`--set-string` and `--set-file` flags. See +[Linkerd Viz Readme](https://www.github.com/linkerd/linkerd2/tree/main/viz/charts/linkerd-viz/README.md) +for a full list of configurable fields. + +### √ linkerd-viz ClusterRoles exist {#l5d-viz-cr-exists} + +Example failure: + +```bash +× linkerd-viz ClusterRoles exist + missing ClusterRoles: linkerd-linkerd-viz-metrics-api + see https://linkerd.io/2/checks/#l5d-viz-cr-exists for hints +``` + +Ensure the linkerd-viz extension ClusterRoles exist: + +```bash +$ kubectl get clusterroles | grep linkerd-viz +linkerd-linkerd-viz-metrics-api 2021-01-26T18:02:17Z +linkerd-linkerd-viz-prometheus 2021-01-26T18:02:17Z +linkerd-linkerd-viz-tap 2021-01-26T18:02:17Z +linkerd-linkerd-viz-tap-admin 2021-01-26T18:02:17Z +linkerd-linkerd-viz-web-check 2021-01-26T18:02:18Z +``` + +Also ensure you have permission to create ClusterRoles: + +```bash +$ kubectl auth can-i create clusterroles +yes +``` + +### √ linkerd-viz ClusterRoleBindings exist {#l5d-viz-crb-exists} + +Example failure: + +```bash +× linkerd-viz ClusterRoleBindings exist + missing ClusterRoleBindings: linkerd-linkerd-viz-metrics-api + see https://linkerd.io/2/checks/#l5d-viz-crb-exists for hints +``` + +Ensure the linkerd-viz extension ClusterRoleBindings exist: + +```bash +$ kubectl get clusterrolebindings | grep linkerd-viz +linkerd-linkerd-viz-metrics-api ClusterRole/linkerd-linkerd-viz-metrics-api 18h +linkerd-linkerd-viz-prometheus ClusterRole/linkerd-linkerd-viz-prometheus 18h +linkerd-linkerd-viz-tap ClusterRole/linkerd-linkerd-viz-tap 18h +linkerd-linkerd-viz-tap-auth-delegator ClusterRole/system:auth-delegator 18h +linkerd-linkerd-viz-web-admin ClusterRole/linkerd-linkerd-viz-tap-admin 18h +linkerd-linkerd-viz-web-check ClusterRole/linkerd-linkerd-viz-web-check 18h +``` + +Also ensure you have permission to create ClusterRoleBindings: + +```bash +$ kubectl auth can-i create clusterrolebindings +yes +``` + +### √ viz extension proxies are healthy {#l5d-viz-proxy-healthy} + +This error indicates that the proxies running in the viz extension are not +healthy. Ensure that linkerd-viz has been installed with all of the correct +setting or re-install as necessary. + +### √ viz extension proxies are up-to-date {#l5d-viz-proxy-cp-version} + +This warning indicates the proxies running in the viz extension are running an +old version. We recommend downloading the latest linkerd-viz and upgrading. + +### √ viz extension proxies and cli versions match {#l5d-viz-proxy-cli-version} + +This warning indicates that the proxies running in the viz extension are running +a different version from the Linkerd CLI. We recommend keeping this versions in +sync by updating either the CLI or linkerd-viz as necessary. + +### √ tap API server has valid cert {#l5d-tap-cert-valid} + +Example failure: + +```bash +× tap API server has valid cert + secrets "tap-k8s-tls" not found + see https://linkerd.io/2/checks/#l5d-tap-cert-valid for hints +``` + +Ensure that the `tap-k8s-tls` secret exists and contains the appropriate +`tls.crt` and `tls.key` data entries. For versions before 2.9, the secret is +named `linkerd-tap-tls` and it should contain the `crt.pem` and `key.pem` data +entries. + +```bash +× tap API server has valid cert + cert is not issued by the trust anchor: x509: certificate is valid for xxxxxx, not tap.linkerd-viz.svc + see https://linkerd.io/2/checks/#l5d-tap-cert-valid for hints +``` + +Here you need to make sure the certificate was issued specifically for +`tap.linkerd-viz.svc`. + +### √ tap API server cert is valid for at least 60 days {#l5d-tap-cert-not-expiring-soon} + +Example failure: + +```bash +‼ tap API server cert is valid for at least 60 days + certificate will expire on 2020-11-07T17:00:07Z + see https://linkerd.io/2/checks/#l5d-webhook-cert-not-expiring-soon for hints +``` + +This warning indicates that the expiry of the tap API Server webhook cert is +approaching. In order to address this problem without incurring downtime, you +can follow the process outlined in +[Automatically Rotating your webhook TLS Credentials](../automatically-rotating-webhook-tls-credentials/). + +### √ tap api service is running {#l5d-tap-api} + +Example failure: + +```bash +× FailedDiscoveryCheck: no response from https://10.233.31.133:443: Get https://10.233.31.133:443: net/http: request canceled while waiting for connection (Client.Timeout exceeded while awaiting headers) +``` + +tap uses the +[kubernetes Aggregated Api-Server model](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation/) +to allow users to have k8s RBAC on top. This model has the following specific +requirements in the cluster: + +- tap Server must be + [reachable from kube-apiserver](https://kubernetes.io/docs/concepts/architecture/master-node-communication/#master-to-cluster) +- The kube-apiserver must be correctly configured to + [enable an aggregation layer](https://kubernetes.io/docs/tasks/access-kubernetes-api/configure-aggregation-layer/) + +### √ linkerd-viz pods are injected {#l5d-viz-pods-injection} + +```bash +× linkerd-viz extension pods are injected + could not find proxy container for tap-59f5595fc7-ttndp pod + see https://linkerd.io/2/checks/#l5d-viz-pods-injection for hints +``` + +Ensure all the linkerd-viz pods are injected + +```bash +$ kubectl -n linkerd-viz get pods +NAME READY STATUS RESTARTS AGE +grafana-68cddd7cc8-nrv4h 2/2 Running 3 18h +metrics-api-77f684f7c7-hnw8r 2/2 Running 2 18h +prometheus-5f6898ff8b-s6rjc 2/2 Running 2 18h +tap-59f5595fc7-ttndp 2/2 Running 2 18h +web-78d6588d4-pn299 2/2 Running 2 18h +tap-injector-566f7ff8df-vpcwc 2/2 Running 2 18h +``` + +Make sure that the `proxy-injector` is working correctly by running +`linkerd check` + +### √ viz extension pods are running {#l5d-viz-pods-running} + +```bash +× viz extension pods are running + container linkerd-proxy in pod tap-59f5595fc7-ttndp is not ready + see https://linkerd.io/2/checks/#l5d-viz-pods-running for hints +``` + +Ensure all the linkerd-viz pods are running with 2/2 + +```bash +$ kubectl -n linkerd-viz get pods +NAME READY STATUS RESTARTS AGE +grafana-68cddd7cc8-nrv4h 2/2 Running 3 18h +metrics-api-77f684f7c7-hnw8r 2/2 Running 2 18h +prometheus-5f6898ff8b-s6rjc 2/2 Running 2 18h +tap-59f5595fc7-ttndp 2/2 Running 2 18h +web-78d6588d4-pn299 2/2 Running 2 18h +tap-injector-566f7ff8df-vpcwc 2/2 Running 2 18h +``` + +Make sure that the `proxy-injector` is working correctly by running +`linkerd check` + +### √ prometheus is installed and configured correctly {#l5d-viz-prometheus} + +```bash +× prometheus is installed and configured correctly + missing ClusterRoles: linkerd-linkerd-viz-prometheus + see https://linkerd.io/2/checks/#l5d-viz-cr-exists for hints +``` + +Ensure all the prometheus related resources are present and running correctly. + +```bash +❯ kubectl -n linkerd-viz get deploy,cm | grep prometheus +deployment.apps/prometheus 1/1 1 1 3m18s +configmap/prometheus-config 1 3m18s +❯ kubectl get clusterRoleBindings | grep prometheus +linkerd-linkerd-viz-prometheus ClusterRole/linkerd-linkerd-viz-prometheus 3m37s +❯ kubectl get clusterRoles | grep prometheus +linkerd-linkerd-viz-prometheus 2021-02-26T06:03:11Zh +``` + +### √ can initialize the client {#l5d-viz-existence-client} + +Example failure: + +```bash +× can initialize the client + Failed to get deploy for pod metrics-api-77f684f7c7-hnw8r: not running +``` + +Verify that the metrics API pod is running correctly + +```bash +❯ kubectl -n linkerd-viz get pods +NAME READY STATUS RESTARTS AGE +metrics-api-7bb8cb8489-cbq4m 2/2 Running 0 4m58s +tap-injector-6b9bc6fc4-cgbr4 2/2 Running 0 4m56s +tap-5f6ddcc684-k2fd6 2/2 Running 0 4m57s +web-cbb846484-d987n 2/2 Running 0 4m56s +grafana-76fd8765f4-9rg8q 2/2 Running 0 4m58s +prometheus-7c5c48c466-jc27g 2/2 Running 0 4m58s +``` + +### √ viz extension self-check {#l5d-viz-metrics-api} + +Example failure: + +```bash +× viz extension self-check + No results returned +``` + +Check the logs on the viz extensions's metrics API: + +```bash +kubectl -n linkerd-viz logs deploy/metrics-api metrics-api +``` + +### √ prometheus is authorized to scrape data plane pods {#l5d-viz-data-plane-prom-authz} + +Example failure: + +```bash + +‼ prometheus is authorized to scrape data plane pods + prometheus may not be authorized to scrape the following pods: + * emojivoto/voting-5f46cbcdc6-p5dhn + * emojivoto/emoji-54f8786975-6qc8s + * emojivoto/vote-bot-85dfbf8996-86c44 + * emojivoto/web-79db6f4548-4mzkg + consider running `linkerd viz allow-scrapes` to authorize prometheus scrapes + see https://linkerd.io/2/checks/#l5d-viz-data-plane-prom-authz for hints +``` + +This warning indicates that the listed pods have the +[`deny` default inbound policy](../../features/server-policy/#policy-annotations), +which may prevent the `linkerd-viz` Prometheus instance from scraping the data +plane proxies in those pods. If Prometheus cannot scrape a data plane pod, +`linkerd viz` commands targeting that pod will return no data. + +This may be resolved by running the `linkerd viz allow-scrapes` command, which +generates [policy resources](../../features/server-policy/) authorizing +Prometheus to scrape the data plane proxies in a namespace: + +```bash +linkerd viz allow-scrapes --namespace emojivoto | kubectl apply -f - +``` + +Note that this warning _only_ checks for the existence of the policy resources +generated by `linkerd viz allow-scrapes` in namespaces that contain pods with +the `deny` default inbound policy. In some cases, Prometheus scrapes may also be +authorized by other, user-generated authorization policies. If metrics from the +listed pods are present in Prometheus, this warning is a false positive and can +be safely disregarded. + +### √ data plane proxy metrics are present in Prometheus {#l5d-data-plane-prom} + +Example failure: + +```bash +× data plane proxy metrics are present in Prometheus + Data plane metrics not found for linkerd/linkerd-identity-b8c4c48c8-pflc9. +``` + +Ensure Prometheus can connect to each `linkerd-proxy` via the Prometheus +dashboard: + +```bash +kubectl -n linkerd-viz port-forward svc/prometheus 9090 +``` + +...and then browse to +[http://localhost:9090/targets](http://localhost:9090/targets), validate the +`linkerd-proxy` section. + +You should see all your pods here. If they are not: + +- Prometheus might be experiencing connectivity issues with the k8s api server. + Check out the logs and delete the pod to flush any possible transient errors. + +## The "linkerd-jaeger" checks {#l5d-jaeger} + +These checks only run when the `linkerd-jaeger` extension is installed. This +check is intended to verify the installation of linkerd-jaeger extension which +comprises of open-census collector and jaeger components along with +`jaeger-injector` which injects the specific trace configuration to the proxies. + +### √ linkerd-jaeger extension Namespace exists {#l5d-jaeger-ns-exists} + +This is the basic check used to verify if the linkerd-jaeger extension namespace +is installed or not. The extension can be installed by running the following +command + +```bash +linkerd jaeger install | kubectl apply -f - +``` + +The installation can be configured by using the `--set`, `--values`, +`--set-string` and `--set-file` flags. See +[Linkerd Jaeger Readme](https://www.github.com/linkerd/linkerd2/tree/main/jaeger/charts/linkerd-jaeger/README.md) +for a full list of configurable fields. + +### √ jaeger extension proxies are healthy {#l5d-jaeger-proxy-healthy} + +This error indicates that the proxies running in the jaeger extension are not +healthy. Ensure that linkerd-jaeger has been installed with all of the correct +setting or re-install as necessary. + +### √ jaeger extension proxies are up-to-date {#l5d-jaeger-proxy-cp-version} + +This warning indicates the proxies running in the jaeger extension are running +an old version. We recommend downloading the latest linkerd-jaeger and +upgrading. + +### √ jaeger extension proxies and cli versions match {#l5d-jaeger-proxy-cli-version} + +This warning indicates that the proxies running in the jaeger extension are +running a different version from the Linkerd CLI. We recommend keeping this +versions in sync by updating either the CLI or linkerd-jaeger as necessary. + +### √ jaeger extension pods are injected {#l5d-jaeger-pods-injection} + +```bash +× jaeger extension pods are injected + could not find proxy container for jaeger-6f98d5c979-scqlq pod + see https://linkerd.io/2/checks/#l5d-jaeger-pods-injections for hints +``` + +Ensure all the jaeger pods are injected + +```bash +$ kubectl -n linkerd-jaeger get pods +NAME READY STATUS RESTARTS AGE +collector-69cc44dfbc-rhpfg 2/2 Running 0 11s +jaeger-6f98d5c979-scqlq 2/2 Running 0 11s +jaeger-injector-6c594f5577-cz75h 2/2 Running 0 10s +``` + +Make sure that the `proxy-injector` is working correctly by running +`linkerd check` + +### √ jaeger extension pods are running {#l5d-jaeger-pods-running} + +```bash +× jaeger extension pods are running + container linkerd-proxy in pod jaeger-59f5595fc7-ttndp is not ready + see https://linkerd.io/2/checks/#l5d-jaeger-pods-running for hints +``` + +Ensure all the linkerd-jaeger pods are running with 2/2 + +```bash +$ kubectl -n linkerd-jaeger get pods +NAME READY STATUS RESTARTS AGE +jaeger-injector-548684d74b-bcq5h 2/2 Running 0 5s +collector-69cc44dfbc-wqf6s 2/2 Running 0 5s +jaeger-6f98d5c979-vs622 2/2 Running 0 5sh +``` + +Make sure that the `proxy-injector` is working correctly by running +`linkerd check` + +## The "linkerd-buoyant" checks {#l5d-buoyant} + +These checks only run when the `linkerd-buoyant` extension is installed. This +check is intended to verify the installation of linkerd-buoyant extension which +comprises `linkerd-buoyant` CLI, the `buoyant-cloud-agent` Deployment, and the +`buoyant-cloud-metrics` DaemonSet. + +### √ Linkerd extension command linkerd-buoyant exists + +```bash +‼ Linkerd extension command linkerd-buoyant exists + exec: "linkerd-buoyant": executable file not found in $PATH + see https://linkerd.io/2/checks/#extensions for hints +``` + +Ensure you have the `linkerd-buoyant` cli installed: + +```bash +linkerd-buoyant check +``` + +To install the CLI: + +```bash +curl https://buoyant.cloud/install | sh +``` + +### √ linkerd-buoyant can determine the latest version + +```bash +‼ linkerd-buoyant can determine the latest version + Get "https://buoyant.cloud/version.json": dial tcp: lookup buoyant.cloud: no such host + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure you can connect to the Linkerd Buoyant version check endpoint from the +environment the `linkerd` cli is running: + +```bash +$ curl https://buoyant.cloud/version.json +{"linkerd-buoyant":"v0.4.4"} +``` + +### √ linkerd-buoyant cli is up-to-date + +```bash +‼ linkerd-buoyant cli is up-to-date + CLI version is v0.4.3 but the latest is v0.4.4 + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +To update to the latest version of the `linkerd-buoyant` CLI: + +```bash +curl https://buoyant.cloud/install | sh +``` + +### √ buoyant-cloud Namespace exists + +```bash +× buoyant-cloud Namespace exists + namespaces "buoyant-cloud" not found + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure the `buoyant-cloud` namespace exists: + +```bash +kubectl get ns/buoyant-cloud +``` + +If the namespace does not exist, the `linkerd-buoyant` installation may be +missing or incomplete. To install the extension: + +```bash +linkerd-buoyant install | kubectl apply -f - +``` + +### √ buoyant-cloud Namespace has correct labels + +```bash +× buoyant-cloud Namespace has correct labels + missing app.kubernetes.io/part-of label + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +The `linkerd-buoyant` installation may be missing or incomplete. To install the +extension: + +```bash +linkerd-buoyant install | kubectl apply -f - +``` + +### √ buoyant-cloud-agent ClusterRole exists + +```bash +× buoyant-cloud-agent ClusterRole exists + missing ClusterRole: buoyant-cloud-agent + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure that the cluster role exists: + +```bash +$ kubectl get clusterrole buoyant-cloud-agent +NAME CREATED AT +buoyant-cloud-agent 2020-11-13T00:59:50Z +``` + +Also ensure you have permission to create ClusterRoles: + +```bash +$ kubectl auth can-i create ClusterRoles +yes +``` + +### √ buoyant-cloud-agent ClusterRoleBinding exists + +```bash +× buoyant-cloud-agent ClusterRoleBinding exists + missing ClusterRoleBinding: buoyant-cloud-agent + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure that the cluster role binding exists: + +```bash +$ kubectl get clusterrolebinding buoyant-cloud-agent +NAME ROLE AGE +buoyant-cloud-agent ClusterRole/buoyant-cloud-agent 301d +``` + +Also ensure you have permission to create ClusterRoleBindings: + +```bash +$ kubectl auth can-i create ClusterRoleBindings +yes +``` + +### √ buoyant-cloud-agent ServiceAccount exists + +```bash +× buoyant-cloud-agent ServiceAccount exists + missing ServiceAccount: buoyant-cloud-agent + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure that the service account exists: + +```bash +$ kubectl -n buoyant-cloud get serviceaccount buoyant-cloud-agent +NAME SECRETS AGE +buoyant-cloud-agent 1 301d +``` + +Also ensure you have permission to create ServiceAccounts: + +```bash +$ kubectl -n buoyant-cloud auth can-i create ServiceAccount +yes +``` + +### √ buoyant-cloud-id Secret exists + +```bash +× buoyant-cloud-id Secret exists + missing Secret: buoyant-cloud-id + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure that the secret exists: + +```bash +$ kubectl -n buoyant-cloud get secret buoyant-cloud-id +NAME TYPE DATA AGE +buoyant-cloud-id Opaque 4 301d +``` + +Also ensure you have permission to create ServiceAccounts: + +```bash +$ kubectl -n buoyant-cloud auth can-i create ServiceAccount +yes +``` + +### √ buoyant-cloud-agent Deployment exists + +```bash +× buoyant-cloud-agent Deployment exists + deployments.apps "buoyant-cloud-agent" not found + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure the `buoyant-cloud-agent` Deployment exists: + +```bash +kubectl -n buoyant-cloud get deploy/buoyant-cloud-agent +``` + +If the Deployment does not exist, the `linkerd-buoyant` installation may be +missing or incomplete. To reinstall the extension: + +```bash +linkerd-buoyant install | kubectl apply -f - +``` + +### √ buoyant-cloud-agent Deployment is running + +```bash +× buoyant-cloud-agent Deployment is running + no running pods for buoyant-cloud-agent Deployment + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Note, it takes a little bit for pods to be scheduled, images to be pulled and +everything to start up. If this is a permanent error, you'll want to validate +the state of the `buoyant-cloud-agent` Deployment with: + +```bash +$ kubectl -n buoyant-cloud get po --selector app=buoyant-cloud-agent +NAME READY STATUS RESTARTS AGE +buoyant-cloud-agent-6b8c6888d7-htr7d 2/2 Running 0 156m +``` + +Check the agent's logs with: + +```bash +kubectl logs -n buoyant-cloud buoyant-cloud-agent-6b8c6888d7-htr7d buoyant-cloud-agent +``` + +### √ buoyant-cloud-agent Deployment is injected + +```bash +× buoyant-cloud-agent Deployment is injected + could not find proxy container for buoyant-cloud-agent-6b8c6888d7-htr7d pod + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure the `buoyant-cloud-agent` pod is injected, the `READY` column should show +`2/2`: + +```bash +$ kubectl -n buoyant-cloud get pods --selector app=buoyant-cloud-agent +NAME READY STATUS RESTARTS AGE +buoyant-cloud-agent-6b8c6888d7-htr7d 2/2 Running 0 161m +``` + +Make sure that the `proxy-injector` is working correctly by running +`linkerd check`. + +### √ buoyant-cloud-agent Deployment is up-to-date + +```bash +‼ buoyant-cloud-agent Deployment is up-to-date + incorrect app.kubernetes.io/version label: v0.4.3, expected: v0.4.4 + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Check the version with: + +```bash +$ linkerd-buoyant version +CLI version: v0.4.4 +Agent version: v0.4.4 +``` + +To update to the latest version: + +```bash +linkerd-buoyant install | kubectl apply -f - +``` + +### √ buoyant-cloud-agent Deployment is running a single pod + +```bash +× buoyant-cloud-agent Deployment is running a single pod + expected 1 buoyant-cloud-agent pod, found 2 + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +`buoyant-cloud-agent` should run as a singleton. Check for other pods: + +```bash +kubectl get po -A --selector app=buoyant-cloud-agent +``` + +### √ buoyant-cloud-metrics DaemonSet exists + +```bash +× buoyant-cloud-metrics DaemonSet exists + deployments.apps "buoyant-cloud-metrics" not found + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure the `buoyant-cloud-metrics` DaemonSet exists: + +```bash +kubectl -n buoyant-cloud get daemonset/buoyant-cloud-metrics +``` + +If the DaemonSet does not exist, the `linkerd-buoyant` installation may be +missing or incomplete. To reinstall the extension: + +```bash +linkerd-buoyant install | kubectl apply -f - +``` + +### √ buoyant-cloud-metrics DaemonSet is running + +```bash +× buoyant-cloud-metrics DaemonSet is running + no running pods for buoyant-cloud-metrics DaemonSet + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Note, it takes a little bit for pods to be scheduled, images to be pulled and +everything to start up. If this is a permanent error, you'll want to validate +the state of the `buoyant-cloud-metrics` DaemonSet with: + +```bash +$ kubectl -n buoyant-cloud get po --selector app=buoyant-cloud-metrics +NAME READY STATUS RESTARTS AGE +buoyant-cloud-metrics-kt9mv 2/2 Running 0 163m +buoyant-cloud-metrics-q8jhj 2/2 Running 0 163m +buoyant-cloud-metrics-qtflh 2/2 Running 0 164m +buoyant-cloud-metrics-wqs4k 2/2 Running 0 163m +``` + +Check the agent's logs with: + +```bash +kubectl logs -n buoyant-cloud buoyant-cloud-metrics-kt9mv buoyant-cloud-metrics +``` + +### √ buoyant-cloud-metrics DaemonSet is injected + +```bash +× buoyant-cloud-metrics DaemonSet is injected + could not find proxy container for buoyant-cloud-agent-6b8c6888d7-htr7d pod + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Ensure the `buoyant-cloud-metrics` pods are injected, the `READY` column should +show `2/2`: + +```bash +$ kubectl -n buoyant-cloud get pods --selector app=buoyant-cloud-metrics +NAME READY STATUS RESTARTS AGE +buoyant-cloud-metrics-kt9mv 2/2 Running 0 166m +buoyant-cloud-metrics-q8jhj 2/2 Running 0 166m +buoyant-cloud-metrics-qtflh 2/2 Running 0 166m +buoyant-cloud-metrics-wqs4k 2/2 Running 0 166m +``` + +Make sure that the `proxy-injector` is working correctly by running +`linkerd check`. + +### √ buoyant-cloud-metrics DaemonSet is up-to-date + +```bash +‼ buoyant-cloud-metrics DaemonSet is up-to-date + incorrect app.kubernetes.io/version label: v0.4.3, expected: v0.4.4 + see https://linkerd.io/checks#l5d-buoyant for hints +``` + +Check the version with: + +```bash +$ kubectl -n buoyant-cloud get daemonset/buoyant-cloud-metrics -o jsonpath='{.metadata.labels}' +{"app.kubernetes.io/name":"metrics","app.kubernetes.io/part-of":"buoyant-cloud","app.kubernetes.io/version":"v0.4.4"} +``` + +To update to the latest version: + +```bash +linkerd-buoyant install | kubectl apply -f - +``` diff --git a/linkerd.io/content/2.17/tasks/uninstall-multicluster.md b/linkerd.io/content/2.17/tasks/uninstall-multicluster.md new file mode 100644 index 0000000000..2133f83bc0 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/uninstall-multicluster.md @@ -0,0 +1,41 @@ +--- +title: Uninstalling Multicluster +description: Unlink and uninstall Linkerd multicluster. +--- + +The Linkerd multicluster components allow for sending traffic from one cluster +to another. For more information on how to set this up, see [installing multicluster](../installing-multicluster/). + +## Unlinking + +Unlinking a cluster will delete all resources associated with that link +including: + +* the service mirror controller +* the Link resource +* the credentials secret +* mirror services + +It is recommended that you use the `unlink` command rather than deleting any +of these resources individually to help ensure that all mirror services get +cleaned up correctly and are not left orphaned. + +To unlink, run the `linkerd multicluster unlink` command and pipe the output +to `kubectl delete`: + +```bash +linkerd multicluster unlink --cluster-name=target | kubectl delete -f - +``` + +## Uninstalling + +Uninstalling the multicluster components will remove all components associated +with Linkerd's multicluster functionality including the gateway and service +account. Before you can uninstall, you must remove all existing links as +described above. Once all links have been removed, run: + +```bash +linkerd multicluster uninstall | kubectl delete -f - +``` + +Attempting to uninstall while at least one link remains will result in an error. diff --git a/linkerd.io/content/2.17/tasks/uninstall.md b/linkerd.io/content/2.17/tasks/uninstall.md new file mode 100644 index 0000000000..42f176db95 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/uninstall.md @@ -0,0 +1,52 @@ +--- +title: Uninstalling Linkerd +description: Linkerd can be easily removed from a Kubernetes cluster. +--- + +Removing Linkerd from a Kubernetes cluster requires a few steps: removing any +data plane proxies, removing all the extensions and then removing the core +control plane. + +## Removing Linkerd data plane proxies + +To remove the Linkerd data plane proxies, you should remove any [Linkerd proxy +injection annotations](../../features/proxy-injection/) and roll the deployments. +When Kubernetes recreates the pods, they will not have the Linkerd data plane +attached. + +## Removing extensions + +To remove any extension, call its `uninstall` subcommand and pipe it to `kubectl +delete -f -`. For the bundled extensions that means: + +```bash +# To remove Linkerd Viz +linkerd viz uninstall | kubectl delete -f - + +# To remove Linkerd Jaeger +linkerd jaeger uninstall | kubectl delete -f - + +# To remove Linkerd Multicluster +linkerd multicluster uninstall | kubectl delete -f - +``` + +## Removing the control plane + +{{< note >}} +Uninstallating the control plane requires cluster-wide permissions. +{{< /note >}} + +To remove the [control plane](../../reference/architecture/#control-plane), run: + +```bash +linkerd uninstall | kubectl delete -f - +``` + +The `linkerd uninstall` command outputs the manifest for all of the Kubernetes +resources necessary for the control plane, including namespaces, service +accounts, CRDs, and more; `kubectl delete` then deletes those resources. + +This command can also be used to remove control planes that have been partially +installed. Note that `kubectl delete` will complain about any resources that it +was asked to delete that hadn't been created, but these errors can be safely +ignored. diff --git a/linkerd.io/content/2.17/tasks/upgrade.md b/linkerd.io/content/2.17/tasks/upgrade.md new file mode 100644 index 0000000000..efa33b96f8 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/upgrade.md @@ -0,0 +1,681 @@ +--- +title: Upgrading Linkerd +description: Perform zero-downtime upgrades for Linkerd. +--- + +In this guide, we'll walk you through how to perform zero-downtime upgrades for +Linkerd. + +{{< note >}} + +This page contains instructions for upgrading to the latest edge release of +Linkerd. If you have installed a [stable distribution](/releases/#stable) of +Linkerd, the vendor may have alternative guidance on how to upgrade. You can +find more information about the different kinds of Linkerd releases on the +[Releases and Versions](/releases/) page. + +{{< /note >}} + +Read through this guide carefully. Additionally, before starting a specific +upgrade, please read through the version-specific upgrade notices below, which +may contain important information about your version. + +- [Upgrade notice: 2.15 and beyond](#upgrade-notice-stable-215-and-beyond) +- [Upgrade notice: stable-2.14.0](#upgrade-notice-stable-2140) +- [Upgrade notice: stable-2.13.0](#upgrade-notice-stable-2130) +- [Upgrade notice: stable-2.12.0](#upgrade-notice-stable-2120) +- [Upgrade notice: stable-2.11.0](#upgrade-notice-stable-2110) +- [Upgrade notice: stable-2.10.0](#upgrade-notice-stable-2100) + +## Version numbering + +### Stable releases + +For stable releases, Linkerd follows a version numbering scheme of the form +`2..`. In other words, "2" is a static prefix, followed by the +major version, then the minor. + +Changes in minor versions are intended to be backwards compatible with the +previous version. Changes in major version *may* introduce breaking changes, +although we try to avoid that whenever possible. + +### Edge releases + +For edge releases, Linkerd issues explicit [guidance about each +release](../../../releases/#edge-release-guidance). Be sure to consult this +guidance before installing any release artifact. + +{{< note >}} + +Edge releases are **not** semantically versioned; the edge release number +itself does not give you any assurance about breaking changes, +incompatibilities, etc. Instead, this information is available in the [release +notes](https://github.com/linkerd/linkerd2/releases). + +{{< /note >}} + +## Upgrade paths + +The following upgrade paths are generally safe. However, before starting a +deploy, it is important to check the upgrade notes before +proceeding—occasionally, specific minor releases may have additional +restrictions. + +**Stable within the same major version**. It is usually safe to upgrade to the +latest minor version within the same major version. In other words, if you are +currently running version *2.x.y*, upgrading to *2.x.z*, where *z* is the +latest minor version for major version *x*, is safe. This is true even if you +would skip intermediate intermediate minor versions, i.e. it is still safe +even if *z* > *y + 1*. + +**Stable to the next major version**. It is usually safe to upgrade to the +latest minor version of the *next* major version. In other words, if you are +currently running version *2.x.y*, upgrading to *2.x + 1.w* will be safe, +where *w* is the latest minor version available for major version *x + 1*. + +**Stable to a later major version**. Upgrades that skip one or more major +versions are not supported. Instead, you should upgrade major versions +incrementally. + +**Edge release to a later edge release**. This is generally safe unless +the `Cautions` for the later edge release indicate otherwise. + +Again, please check the upgrade notes or release guidance for the specific +version you are upgrading *to* for any version-specific caveats. + +## Data plane vs control plane version skew + +Since a Linkerd upgrade always starts by upgrading the control plane, there is +a period during which the control plane is running the new version, but the +data plane is still running the older version. The extent to which this skew +can be supported depends on what kind of release you're running. Note that new +features introduced by the release may not be available for workloads with +older data planes. + +### Stable releases + +For stable releases, it is usually safe to upgrade one major version at a +time. This is independent of minor version, i.e. a *2.x.y* data plane and a +*2.x + 1.z* control plane will work regardless of *y* and *z*. Please check +the version-specific upgrade notes before proceeding. + +### Edge releases + +For edge releases, it is also usually safe to upgrade one major version at a +time. The major version of an edge release is included in the release notes +for each edge release: for example, `edge-24.4.1` is part of Linkerd 2.15, so +it should be safe to upgrade from `edge-24.4.1` to any edge release within +Linkerd 2.15 or Linkerd 2.16. + +For any situation where this is not the case, the edge release guidance will +have more information. + +## Overall upgrade process + +There are four components that need to be upgraded: + +- [The CLI](#upgrade-the-cli) +- [The control plane](#upgrade-the-control-plane) +- [The control plane extensions](#upgrade-extensions) +- [The data plane](#upgrade-the-data-plane) + +These steps should be performed in sequence. + +## Before upgrading + +Before you commence an upgrade, you should ensure that the current state +of Linkerd is healthy, e.g. by using `linkerd check`. For major version +upgrades, you should also ensure that your data plane is up-to-date, e.g. +with `linkerd check --proxy`, to avoid unintentional version skew. + +Make sure that your Linkerd version and Kubernetes version are compatible by +checking Linkerd's [supported Kubernetes +versions](../../reference/k8s-versions/). + +## Upgrading the CLI + +The CLI can be used to validate whether Linkerd was installed correctly. + +### Stable releases + +Consult the upgrade instructions from the vendor supplying your stable release +for information about how to upgrade the CLI. + +### Edge releases + +To upgrade the CLI, run: + +```bash +curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install-edge | sh +``` + +Alternatively, you can download the CLI directly via the [Linkerd releases +page](https://github.com/linkerd/linkerd2/releases/). + +Verify the CLI is installed and running the expected version with: + +```bash +linkerd version --client +``` + +## Upgrading the control plane + +### Upgrading the control plane with the CLI + +For users who have installed Linkerd via the CLI, the `linkerd upgrade` command +will upgrade the control plane. This command ensures that all of the control +plane's existing configuration and TLS secrets are retained. Linkerd's CRDs +should be upgraded first, using the `--crds` flag, followed by upgrading the +control plane. + +(If you are using a stable release, your vendor's upgrade instructions may +have more information.) + +```bash +linkerd upgrade --crds | kubectl apply -f - +linkerd upgrade | kubectl apply -f - +``` + +Next, we use the `linkerd prune` command to remove any resources that were +present in the previous version but should not be present in this one. + +```bash +linkerd prune | kubectl delete -f - +``` + +### Upgrading the control plane with Helm + +For Helm control plane installations, please follow the instructions at [Helm +upgrade procedure](../install-helm/#helm-upgrade-procedure). + +### Verifying the control plane upgrade + +Once the upgrade process completes, check to make sure everything is healthy +by running: + +```bash +linkerd check +``` + +This will run through a set of checks against your control plane and make sure +that it is operating correctly. + +To verify the Linkerd control plane version, run: + +```bash +linkerd version +``` + +Which should display the latest versions for both client and server. + +## Upgrading extensions + +[Linkerd's extensions](../extensions/) provide additional functionality to +Linkerd in a modular way. Generally speaking, extensions are versioned +separately from Linkerd releases and follow their own schedule; however, some +extensions are updated alongside Linkerd releases and you may wish to update +them as part of the same process. + +Each extension can be upgraded independently. If using Helm, the procedure is +similar to the control plane upgrade, using the respective charts. For the CLI, +the extension CLI commands don't provide `upgrade` subcommands, but using +`install` again is fine. For example: + +```bash +linkerd viz install | kubectl apply -f - +linkerd multicluster install | kubectl apply -f - +linkerd jaeger install | kubectl apply -f - +``` + +Most extensions also include a `prune` command for removing resources which +were present in the previous version but should not be present in the current +version. For example: + +```bash +linkerd viz prune | kubectl delete -f - +``` + +### Upgrading the multicluster extension + +Upgrading the multicluster extension doesn't cause downtime in the traffic going +through the mirrored services, unless otherwise noted in the version-specific +notes below. Note however that for the service mirror *deployments* (which +control the creation of the mirrored services) to be updated, you need to +re-link your clusters through `linkerd multicluster link`. + +## Upgrading the data plane + +Upgrading the data plane requires updating the proxy added to each meshed +workload. Since pods are immutable in Kubernetes, Linkerd is unable to simply +update the proxies in place. Thus, the standard option is to restart each +workload, allowing the proxy injector to inject the latest version of the proxy +as they come up. + +For example, you can use the `kubectl rollout restart` command to restart a +meshed deployment: + +```bash +kubectl -n rollout restart deploy +``` + +As described earlier, a skew of one major version between data plane and control +plane is always supported. Thus, for some systems it is possible to do this data +plane upgrade "lazily", and simply allow workloads to pick up the newest proxy +as they are restarted for other reasons (e.g. for new code rollouts). However, +newer features may only be available on workloads with the latest proxy. + +A skew of more than one major version between data plane and control plane is +not supported. + +### Verify the data plane upgrade + +Check to make sure everything is healthy by running: + +```bash +linkerd check --proxy +``` + +This will run through a set of checks to verify that the data plane is +operating correctly, and will list any pods that are still running older +versions of the proxy. + +Congratulation! You have successfully upgraded your Linkerd to the newer +version. + +## Upgrade notices + +This section contains release-specific information about upgrading. + +### Upgrade notice: stable-2.15 and beyond + +As of February 2024, the Linkerd project itself only produces [edge +release](/releases/) artifacts. The [Releases and Versions](/releases/) page +contains more information about the different kinds of Linkerd releases. + +### Upgrade notice: stable-2.14.0 + +For this release, if you're using the multicluster extension, you should re-link +your clusters after upgrading to stable-2.14.0, as explained +[above](#upgrading-the-multicluster-extension). Not doing so immediately won't +cause any downtime in cross-cluster connections, but `linkerd multicluster +check` will not succeed until the clusters are re-linked. + +There are no other extra steps for upgrading to 2.14.0. + +### Upgrade notice: stable-2.13.0 + +Please be sure to read the [Linkerd 2.13.0 release +notes](https://github.com/linkerd/linkerd2/releases/tag/stable-2.13.0). + +There are no other extra steps for upgrading to 2.13.0. + +### Upgrade notice: stable-2.12.0 + +Please be sure to read the [Linkerd 2.12.0 release +notes](https://github.com/linkerd/linkerd2/releases/tag/stable-2.12.0). + +There are a couple important changes that affect the upgrade process for 2.12.0: + +- The minimum Kubernetes version supported is `v1.21.0`. +- The TrafficSplit CRD has been moved to the Linkerd SMI extension. +- Support for Helm v2 has been removed. +- The viz extension no longer installs Grafana due to licensing concerns. +- The linkerd2 Helm chart has been split into two charts: linkerd-crds and + linkerd-control-plane. +- The viz, multicluster, jaeger, and linkerd2-cni Helm charts now rely on a + post-install hook required metadata into their namespaces. + +Read on for how to handle these changes as part of the upgrade process. + +#### Upgrading to 2.12.0 using the CLI + +If you installed Linkerd `2.11.x` with the CLI _and_ are using the +`TrafficSplit` CRD, you need to take an extra stop to avoid losing your +`TrafficSplit` CRs. (If you're not using `TrafficSplit` then you can +perform the usual CLI upgrade as [described above](#with-linkerd-cli).) + +The `TrafficSplit` CRD has been moved to the SMI extension. But before +installing that extension, you need to add the following annotations and label +to the CRD so that the `linkerd-smi` chart can adopt it: + +```bash +kubectl annotate --overwrite crd/trafficsplits.split.smi-spec.io \ + meta.helm.sh/release-name=linkerd-smi \ + meta.helm.sh/release-namespace=linkerd-smi +kubectl label crd/trafficsplits.split.smi-spec.io \ + app.kubernetes.io/managed-by=Helm +``` + +Now you can install the SMI extension. E.g. via Helm: + +```bash +helm repo add l5d-smi https://linkerd.github.io/linkerd-smi +helm install linkerd-smi -n linkerd-smi --create-namespace l5d-smi/linkerd-smi +``` + +And finally you can proceed with the usual [CLI upgrade +instructions](#with-linkerd-cli), but avoid using the `--prune` flag when +applying the output of `linkerd upgrade --crds` to avoid removing the +`TrafficSplit` CRD. + +#### Upgrading to 2.12.0 using Helm + +Note that support for Helm v2 has been dropped in the Linkerd 2.12.0 release. + +This section provides instructions on how to perform a migration from Linkerd +`2.11.x` to `2.12.0` without control plane downtime, when your existing Linkerd +instance was installed via Helm. There were several changes to the Linkerd Helm +charts as part of this release, so this upgrade process is a little more +involved than usual. + +##### Retrieving existing customization and PKI setup + +The `linkerd2` chart has been replaced by two charts: `linkerd-crds` and +`linkerd-control-plane` (and optionally `linkerd-smi` if you're using +`TrafficSplit`). To migrate to this new setup, we need to ensure your +customization values, including TLS certificates and keys, are migrated +to the new charts. + +Find the release name you used for the `linkerd2` chart, and the namespace where +this release stored its config: + +```bash +$ helm ls -A +NAME NAMESPACE REVISION UPDATED STATUS CHART APP VERSION +linkerd default 1 2021-11-22 17:14:50.751436374 -0500 -05 deployed linkerd2-2.11.1 stable-2.11.1 +``` + +(The example output above matches the default case.) Note that even if Linkerd is +installed in the `linkerd` namespace, the Helm config should have been installed +in the `default` namespace, unless you specified something different in the +`namespace` value when you installed. Take note of this release name (linkerd) +and namespace (default) to use in the commands that follow. + +Next, retrieve all your chart values customizations, especially your trust +root and issuer keys (`identityTrustAnchorsPEM`, `identity.issuer.tls.crtPEM` +and `identity.issuer.tls.keyPEM`). These values will need to be fed again into +the `helm install` command below for the `linkerd-control-plane` chart. These +values can be retrieved with the following command: + +```bash +helm get -n default values linkerd +``` + +##### Migrate resources to the new charts + +Next, we need to prepare these values for use with the new charts. Note that the +examples below use the [yq](https://github.com/mikefarah/yq) utility. + +The following snippets will change the `meta.helm.sh/release-name` and +`meta.helm.sh/release-namespace` annotations for each resource in the `linkerd` +release (use your own name as explained above), so that they can be adopted by +the `linkerd-crds`, `linkerd-control-plane` and `linkerd-smi` charts: + +```bash +# First migrate the CRDs +$ helm -n default get manifest linkerd | \ + yq 'select(.kind == "CustomResourceDefinition") | .metadata.name' | \ + grep -v '\-\-\-' | \ + xargs -n1 sh -c \ + 'kubectl annotate --overwrite crd/$0 meta.helm.sh/release-name=linkerd-crds meta.helm.sh/release-namespace=linkerd' + +# Special case for TrafficSplit (only use if you have TrafficSplit CRs) +$ kubectl annotate --overwrite crd/trafficsplits.split.smi-spec.io \ + meta.helm.sh/release-name=linkerd-smi meta.helm.sh/release-namespace=linkerd-smi + +# Now migrate all the other resources +$ helm -n default get manifest linkerd | \ + yq 'select(.kind != "CustomResourceDefinition")' | \ + yq '.kind, .metadata.name, .metadata.namespace' | \ + grep -v '\-\-\-' | + xargs -n3 sh -c 'kubectl annotate --overwrite -n $2 $0/$1 meta.helm.sh/release-name=linkerd-control-plane meta.helm.sh/release-namespace=linkerd' +``` + +##### Installing the new charts + +Next, we need to install the new charts using our customization values +prepared above. + +```bash +# First make sure you update the helm repo +$ helm repo up + +# Install the linkerd-crds chart +$ helm install linkerd-crds -n linkerd --create-namespace linkerd/linkerd-crds + +# Install the linkerd-control-plane chart +# (remember to add any customizations you retrieved above) +$ helm install linkerd-control-plane \ + -n linkerd \ + --set-file identityTrustAnchorsPEM=ca.crt \ + --set-file identity.issuer.tls.crtPEM=issuer.crt \ + --set-file identity.issuer.tls.keyPEM=issuer.key \ + linkerd/linkerd-control-plane + +# Optional: if using TrafficSplit CRs +$ helm repo add l5d-smi https://linkerd.github.io/linkerd-smi +$ helm install linkerd-smi -n linkerd-smi --create-namespace l5d-smi/linkerd-smi +``` + +##### Cleaning up the old linkerd2 Helm release + +After installing the new charts, we need to clean up the old Helm chart. The +`helm delete` command would delete all the linkerd resources, so instead we just +remove the Helm release config for the old `linkerd2` chart (assuming you used +the "Secret" storage backend, which is the default): + +```bash +$ kubectl -n default delete secret \ + --field-selector type=helm.sh/release.v1 \ + -l name=linkerd,owner=helm +``` + +##### Upgrading extension Helm charts + +Finally, we need to upgrade our extensions. In Linkerd 2.12.0 the viz, +multicluster, jaeger, and linkerd2-cni extensions no longer install their +namespaces, instead leaving that to the `helm` command (or to a previous step in +your CD pipeline) and relying on an post-install hook to add the required +metadata into that namespace. Therefore the Helm upgrade path for these +extensions is to delete and reinstall them. + +For example, for the viz extension: + +```bash +# update the helm repo +helm repo up + +# delete your current instance +# (assuming you didn't use the -n flag when installing) +helm delete linkerd-viz + +# install the new chart version +helm install linkerd-viz -n linkerd-viz --create-namespace linkerd/linkerd-viz +``` + +##### Upgrading the multicluster extension with Helm + +Note that reinstalling the multicluster extension via Helm as explained above +will result in the recreation of the `linkerd-multicluster` namespace, thus +deleting all the `Link` resources that associate the source cluster with any +target clusters. The mirrored services, which live on their respective +namespaces, won't be deleted so there won't be any downtime. So after finishing +the upgrade, make sure you re-link your clusters again with `linkerd +multicluster link`. This will also bring the latest versions of the service +mirror deployments. + +##### Adding Grafana + +The viz extension no longer installs a Grafana instance due to licensing +concerns. Instead we recommend you install it directly from the [Grafana +official Helm +chart](https://github.com/grafana/helm-charts/tree/main/charts/grafana) or the +[Grafana Operator](https://github.com/grafana-operator/grafana-operator). +Linkerd's Grafana dashboards have been published in +, and the new [Grafana +docs](../grafana/) provide detailed instructions on how to load them. + +### Upgrade notice: stable-2.11.0 + +The minimum Kubernetes version supported is now `v1.17.0`. + +There are two breaking changes in the 2.11.0 release: pods in `ingress` no +longer support non-HTTP traffic to meshed workloads; and the proxy no longer +forwards traffic to ports that are bound only to localhost. + +Users of the multi-cluster extension will need to re-link their cluster after +upgrading. + +The Linkerd proxy container is now the *first* container in the pod. This may +affect tooling that assumed the application was the first container in the pod. + +#### Control plane changes + +The `controller` pod has been removed from the control plane. All configuration +options that previously applied to it are no longer valid (e.g +`publicAPIResources` and all of its nested fields). Additionally, the +destination pod has a new `policy` container that runs the policy controller. + +#### Data plane changes + +In order to fix a class of startup race conditions, the container ordering +within meshed pods has changed so that the Linkerd proxy container is now the +*first* container in the pod, the application container now waits to start until +the proxy is ready. This may affect tooling that assumed the application +container was the first container in the pod. + +Using [linkerd-await](https://github.com/linkerd/linkerd-await) to enforce +container startup ordering is thus longer necessary. (However, using +`linkerd-await -S` to ensure proxy shutdown in Jobs and Cronjobs is still +valid.) + +#### Routing breaking changes + +There are two breaking changes to be aware of when it comes to how traffic is +routed. + +First, when the proxy runs in ingress mode (`config.linkerd.io/inject: +ingress`), non-HTTP traffic to meshed pods is no longer supported. To get +around this, you will need to use the `config.linkerd.io/skip-outbound-ports` +annotation on your ingress controller pod. In many cases, ingress mode is no +longer necessary. Before upgrading, it may be worth revisiting [how to use +ingress](../using-ingress/) with Linkerd. + +Second, the proxy will no longer forward traffic to ports only bound on +localhost, such as `127.0.0.1:8080`. Services that want to receive traffic from +other pods should now be bound to a public interface (e.g `0.0.0.0:8080`). This +change prevents ports from being accidentally exposed outside of the pod. + +#### Multicluster + +The gateway component has been changed to use a `pause` container instead of +`nginx`. This change should reduce the footprint of the extension; the proxy +routes traffic internally and does not need to rely on `nginx` to receive or +forward traffic. While this will not cause any downtime when upgrading +multicluster, it does affect probing. `linkerd multicluster gateways` will +falsely advertise the target cluster gateway as being down until the clusters +are re-linked. + +Multicluster now supports `NodePort` type services for the gateway. To support +this change, the configuration options in the Helm values file are now grouped +under the `gateway` field. If you have installed the extension with other +options than the provided defaults, you will need to update your `values.yaml` +file to reflect this change in field grouping. + +#### Other changes + +Besides the breaking changes described above, there are other minor changes to +be aware of when upgrading from `stable-2.10.x`: + +- `PodSecurityPolicy` (PSP) resources are no longer installed by default as a + result of their deprecation in Kubernetes v1.21 and above. The control plane + and core extensions will now be shipped without PSPs; they can be enabled + through a new install option `enablePSP: true`. +- The `tcp_connection_duration_ms` metric has been removed. +- Opaque ports changes: `443` is no longer included in the default opaque ports + list. Ports `4444`, `6379` and `9300` corresponding to Galera, Redis and + ElasticSearch respectively (all server speak first protocols) have been added + to the default opaque ports list. The default ignore inbound ports list has + also been changed to include ports `4567` and `4568`. + +### Upgrade notice: stable-2.10.0 + +If you are currently running Linkerd 2.9.0, 2.9.1, 2.9.2, or 2.9.3 (but *not* +2.9.4), and you *upgraded* to that release using the `--prune` flag (as opposed +to installing it fresh), you will need to use the `linkerd repair` command as +outlined in the [Linkerd 2.9.3 upgrade notes](#upgrade-notice-stable-2-9-3) +before you can upgrade to Linkerd 2.10. + +Additionally, there are two changes in the 2.10.0 release that may affect you. +First, the handling of certain ports and protocols has changed. Please read +through our [ports and protocols in 2.10 upgrade +guide](../../features/protocol-detection/) for the repercussions. + +Second, we've introduced [extensions](../extensions/) and moved the +default visualization components into a Linkerd-Viz extension. Read on for what +this means for you. + +#### Visualization components moved to Linkerd-Viz extension + +With the introduction of [extensions](../extensions/), all of the +Linkerd control plane components related to visibility (including Prometheus, +Grafana, Web, and Tap) have been removed from the main Linkerd control plane +and moved into the Linkerd-Viz extension. This means that when you upgrade to +stable-2.10.0, these components will be removed from your cluster and you will +not be able to run commands such as `linkerd stat` or +`linkerd dashboard`. To restore this functionality, you must install the +Linkerd-Viz extension by running `linkerd viz install | kubectl apply -f -` +and then invoke those commands through `linkerd viz stat`, +`linkerd viz dashboard`, etc. + +```bash +# Upgrade the control plane (this will remove viz components). +linkerd upgrade | kubectl apply --prune -l linkerd.io/control-plane-ns=linkerd -f - +# Prune cluster-scoped resources +linkerd upgrade | kubectl apply --prune -l linkerd.io/control-plane-ns=linkerd \ + --prune-allowlist=rbac.authorization.k8s.io/v1/clusterrole \ + --prune-allowlist=rbac.authorization.k8s.io/v1/clusterrolebinding \ + --prune-allowlist=apiregistration.k8s.io/v1/apiservice -f - +# Install the Linkerd-Viz extension to restore viz functionality. +linkerd viz install | kubectl apply -f - +``` + +Helm users should note that configuration values related to these visibility +components have moved to the Linkerd-Viz chart. Please update any values +overrides you have and use these updated overrides when upgrading the Linkerd +chart or installing the Linkerd-Viz chart. See below for a complete list of +values which have moved. + +```bash +helm repo update +# Upgrade the control plane (this will remove viz components). +helm upgrade linkerd2 linkerd/linkerd2 --reset-values -f values.yaml --atomic +# Install the Linkerd-Viz extension to restore viz functionality. +helm install linkerd2-viz linkerd/linkerd2-viz -f viz-values.yaml +``` + +The following values were removed from the Linkerd2 chart. Most of the removed +values have been moved to the Linkerd-Viz chart or the Linkerd-Jaeger chart. + +- `dashboard.replicas` moved to Linkerd-Viz as `dashboard.replicas` +- `tap` moved to Linkerd-Viz as `tap` +- `tapResources` moved to Linkerd-Viz as `tap.resources` +- `tapProxyResources` moved to Linkerd-Viz as `tap.proxy.resources` +- `webImage` moved to Linkerd-Viz as `dashboard.image` +- `webResources` moved to Linkerd-Viz as `dashboard.resources` +- `webProxyResources` moved to Linkerd-Viz as `dashboard.proxy.resources` +- `grafana` moved to Linkerd-Viz as `grafana` +- `grafana.proxy` moved to Linkerd-Viz as `grafana.proxy` +- `prometheus` moved to Linkerd-Viz as `prometheus` +- `prometheus.proxy` moved to Linkerd-Viz as `prometheus.proxy` +- `global.proxy.trace.collectorSvcAddr` moved to Linkerd-Jaeger as `webhook.collectorSvcAddr` +- `global.proxy.trace.collectorSvcAccount` moved to Linkerd-Jaeger as `webhook.collectorSvcAccount` +- `tracing.enabled` removed +- `tracing.collector` moved to Linkerd-Jaeger as `collector` +- `tracing.jaeger` moved to Linkerd-Jaeger as `jaeger` + +Also please note the global scope from the Linkerd2 chart values has been +dropped, moving the config values underneath it into the root scope. Any values +you had customized there will need to be migrated; in particular +`identityTrustAnchorsPEM` in order to conserve the value you set during +install." diff --git a/linkerd.io/content/2.17/tasks/using-custom-domain.md b/linkerd.io/content/2.17/tasks/using-custom-domain.md new file mode 100644 index 0000000000..03919bae57 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/using-custom-domain.md @@ -0,0 +1,35 @@ +--- +title: Using a Custom Cluster Domain +description: Use Linkerd with a custom cluster domain. +--- + +For Kubernetes clusters that use [custom cluster domain](https://kubernetes.io/docs/tasks/administer-cluster/dns-custom-nameservers/), +Linkerd must be installed using the `--cluster-domain` option: + +```bash +# first, install the Linkerd CRDs: +linkerd install --crds | kubectl apply -f - + +# next, install the Linkerd control plane, using the custom cluster domain: +linkerd install --cluster-domain=example.org \ + --identity-trust-domain=example.org \ + | kubectl apply -f - + +# The Linkerd Viz extension also requires a similar setting: +linkerd viz install --set clusterDomain=example.org | kubectl apply -f - + +# And so does the Multicluster extension: +linkerd multicluster install --set identityTrustDomain=example.org | kubectl apply -f - +``` + +This ensures that all Linkerd handles all service discovery, routing, service +profiles and traffic split resources using the `example.org` domain. + +{{< note >}} +Note that the identity trust domain must match the cluster domain for mTLS to +work. +{{< /note >}} + +{{< note >}} +Changing the cluster domain while upgrading Linkerd isn't supported. +{{< /note >}} diff --git a/linkerd.io/content/2.17/tasks/using-debug-endpoints.md b/linkerd.io/content/2.17/tasks/using-debug-endpoints.md new file mode 100644 index 0000000000..87261e6142 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/using-debug-endpoints.md @@ -0,0 +1,64 @@ +--- +title: Control Plane Debug Endpoints +description: Linkerd's control plane components provide debug endpoints. +--- + +All of the control plane components expose runtime profiling information through +the path `/debug/pprof`, using Go's +[pprof](https://golang.org/pkg/net/http/pprof/) package. This endpoint is +disabled by default but can be enabled to gather profiling data. + +You can consume the provided data with `go tool pprof` to generate output in +many formats (PDF, DOT, PNG, etc). + +The following diagnostics are provided (a summary with links is provided at +`/debug/pprof`): + +- allocs: A sampling of all past memory allocations +- block: Stack traces that led to blocking on synchronization primitives +- cmdline: The command line invocation of the current program +- goroutine: Stack traces of all current goroutines +- heap: A sampling of memory allocations of live objects. You can specify the gc + GET parameter to run GC before taking the heap sample. +- mutex: Stack traces of holders of contended mutexes +- profile: CPU profile. You can specify the duration in the seconds GET + parameter. After you get the profile file, use the go tool pprof command to + investigate the profile. +- threadcreate: Stack traces that led to the creation of new OS threads +- trace: A trace of execution of the current program. You can specify the + duration in the seconds GET parameter. After you get the trace file, use the + go tool trace command to investigate the trace. + +## Example Usage + +The pprof endpoint can be enabled by setting the `--set enablePprof=true` flag +when installing or upgrading Linkerd or by setting the `enablePprof=true` Helm +value. + +This data is served over the `admin-http` port. +To find this port, you can examine the pod's yaml, or for the identity pod for +example, issue a command like so: + +```bash +kubectl -n linkerd get po \ + $(kubectl -n linkerd get pod -l linkerd.io/control-plane-component=identity \ + -o jsonpath='{.items[0].metadata.name}') \ + -o=jsonpath='{.spec.containers[*].ports[?(@.name=="admin-http")].containerPort}' +``` + +Then use the `kubectl port-forward` command to access that port from outside +the cluster (in this example the port is 9990): + +```bash +kubectl -n linkerd port-forward \ + $(kubectl -n linkerd get pod -l linkerd.io/control-plane-component=identity \ + -o jsonpath='{.items[0].metadata.name}') \ + 9990 +``` + +It is now possible to use `go tool` to inspect this data. For example to +generate a graph in a PDF file describing memory allocations: + +```bash +go tool pprof -seconds 5 -pdf http://localhost:9990/debug/pprof/allocs +``` diff --git a/linkerd.io/content/2.17/tasks/using-ingress.md b/linkerd.io/content/2.17/tasks/using-ingress.md new file mode 100644 index 0000000000..905a212afb --- /dev/null +++ b/linkerd.io/content/2.17/tasks/using-ingress.md @@ -0,0 +1,733 @@ +--- +title: Handling ingress traffic +description: Linkerd can work alongside your ingress controller of choice. +--- + +Ingress traffic refers to traffic that comes into your cluster from outside the +cluster. For reasons of simplicity and composability, Linkerd itself doesn't +provide a built-in ingress solution for handling traffic coming into the +cluster. Instead, Linkerd is designed to work with the many existing Kubernetes +ingress options. + +Combining Linkerd and your ingress solution of choice requires two things: + +1. Configuring your ingress to support Linkerd (if necessary). +2. Meshing your ingress pods. + +Strictly speaking, meshing your ingress pods is not required to allow traffic +into the cluster. However, it is recommended, as it allows Linkerd to provide +features like L7 metrics and mutual TLS the moment the traffic enters the +cluster. + +## Handling external TLS + +One common job for ingress controllers is to terminate TLS from the outside +world, e.g. HTTPS calls. + +Like all pods, traffic to a meshed ingress has both an inbound and an outbound +component. If your ingress terminates TLS, Linkerd will treat this inbound TLS +traffic as an opaque TCP stream, and will only be able to provide byte-level +metrics for this side of the connection. + +Once the ingress controller terminates the TLS connection and issues the +corresponding HTTP or gRPC traffic to internal services, these outbound calls +will have the full set of metrics and mTLS support. + +## Ingress mode {#ingress-mode} + +Most ingress controllers can be meshed like any other service, i.e. by +applying the `linkerd.io/inject: enabled` annotation at the appropriate level. +(See [Adding your services to Linkerd](../adding-your-service/) for more.) + +However, some ingress options need to be meshed in a special "ingress" mode, +using the `linkerd.io/inject: ingress` annotation. + +The instructions below will describe, for each ingress, whether it requires this +mode of operation. + +If you're using "ingress" mode, we recommend that you set this ingress +annotation at the workload level rather than at the namespace level, so that +other resources in the ingress namespace are be meshed normally. + +{{< warning id=open-relay-warning >}} +When an ingress is meshed in ingress mode, you _must_ configure it to remove +the `l5d-dst-override` header to avoid creating an open relay to cluster-local +and external endpoints. +{{< /warning >}} + +{{< note >}} +Linkerd versions 2.13.0 through 2.13.4 had a bug whereby the `l5d-dst-override` +header was *required* in ingress mode, or the request would fail. This bug was +fixed in 2.13.5, and was not present prior to 2.13.0. +{{< /note >}} + +{{< note >}} +Be sure to not deploy the ingress controller in the `kube-system` or `cert-manager` +namespace, as Linkerd [ignores these namespaces by default for injection](../../features/proxy-injection/#exclusions). +{{< /note >}} + +For more on ingress mode and why it's necessary, see [Ingress +details](#ingress-details) below. + +## Common ingress options for Linkerd + +Common ingress options that Linkerd has been used with include: + +- [Ambassador (aka Emissary)](#ambassador) +- [Nginx (community version)](#nginx-community-version) +- [Nginx (F5 NGINX version)](#nginx-f5-nginx-version) +- [Traefik](#traefik) + - [Traefik 1.x](#traefik-1x) + - [Traefik 2.x](#traefik-2x) +- [GCE](#gce) +- [Gloo](#gloo) +- [Contour](#contour) +- [Kong](#kong) +- [Haproxy](#haproxy) +- [EnRoute](#enroute) +- [ngrok](#ngrok) + +For a quick start guide to using a particular ingress, please visit the section +for that ingress below. If your ingress is not on that list, never fear—it +likely works anyways. See [Ingress details](#ingress-details) below. + +## Emissary-Ingress (aka Ambassador) {#ambassador} + +Emissary-Ingress can be meshed normally: it does not require the [ingress +mode](#ingress-mode) annotation. An example manifest for configuring +Ambassador / Emissary is as follows: + +```yaml +apiVersion: getambassador.io/v3alpha1 +kind: Mapping +metadata: + name: web-ambassador-mapping + namespace: emojivoto +spec: + hostname: "*" + prefix: / + service: http://web-svc.emojivoto.svc.cluster.local:80 +``` + +For a more detailed guide, we recommend reading [Installing the Emissary ingress +with the Linkerd service +mesh](https://buoyant.io/2021/05/24/emissary-and-linkerd-the-best-of-both-worlds/). + +## Nginx (community version) + +This section refers to the Kubernetes community version +of the Nginx ingress controller +[kubernetes/ingress-nginx](https://github.com/kubernetes/ingress-nginx). + +Nginx can be meshed normally: it does not require the [ingress +mode](#ingress-mode) annotation. + +The +[`nginx.ingress.kubernetes.io/service-upstream`](https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#service-upstream) +annotation should be set to `"true"`. For example: + +```yaml +# apiVersion: networking.k8s.io/v1beta1 # for k8s < v1.19 +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: emojivoto-web-ingress + namespace: emojivoto + annotations: + nginx.ingress.kubernetes.io/service-upstream: "true" +spec: + ingressClassName: nginx + defaultBackend: + service: + name: web-svc + port: + number: 80 +``` + +If using [the ingress-nginx Helm +chart](https://artifacthub.io/packages/helm/ingress-nginx/ingress-nginx), note +that the namespace containing the ingress controller should NOT be annotated +with `linkerd.io/inject: enabled`. Instead, you should annotate the `kind: +Deployment` (`.spec.template.metadata.annotations`). For example: + +```yaml +controller: + podAnnotations: + linkerd.io/inject: enabled +... +``` + +The reason is because this Helm chart defines (among other things) two +Kubernetes resources: + +1) `kind: ValidatingWebhookConfiguration`. This creates a short-lived pod named + something like `ingress-nginx-admission-create-XXXXX` which quickly terminates. + +2) `kind: Deployment`. This creates a long-running pod named something like +`ingress-nginx-controller-XXXX` which contains the Nginx docker + container. + +Setting the injection annotation at the namespace level would mesh the +short-lived pod, which would prevent it from terminating as designed. + +## Nginx (F5 NGINX version) + +This section refers to the Nginx ingress controller +developed and maintained by F5 NGINX +[nginxinc/kubernetes-ingress](https://github.com/nginxinc/kubernetes-ingress). + +This version of Nginx can also be meshed normally +and does not require the [ingress mode](#ingress-mode) annotation. + +The [VirtualServer/VirtualServerRoute CRD resource](https://docs.nginx.com/nginx-ingress-controller/configuration/virtualserver-and-virtualserverroute-resources/#virtualserverroute) +should be used in favor of the `ingress` resource (see +[this Github issue](https://github.com/nginxinc/kubernetes-ingress/issues/2529) +for more information). + +The `use-cluster-ip` field should be set to `true`. For example: + +```yaml +apiVersion: k8s.nginx.org/v1 +kind: VirtualServer +metadata: + name: emojivoto-web-ingress + namespace: emojivoto +spec: + ingressClassName: nginx + upstreams: + - name: web + service: web-svc + port: 80 + use-cluster-ip: true + routes: + - path: / + action: + pass: web +``` + +## Traefik + +Traefik should be meshed with [ingress mode enabled](#ingress-mode), i.e. with +the `linkerd.io/inject: ingress` annotation rather than the default `enabled`. + +Instructions differ for 1.x and 2.x versions of Traefik. + +### Traefik 1.x {#traefik-1x} + +The simplest way to use Traefik 1.x as an ingress for Linkerd is to configure a +Kubernetes `Ingress` resource with the +`ingress.kubernetes.io/custom-request-headers` like this: + +```yaml +# apiVersion: networking.k8s.io/v1beta1 # for k8s < v1.19 +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: web-ingress + namespace: emojivoto + annotations: + ingress.kubernetes.io/custom-request-headers: l5d-dst-override:web-svc.emojivoto.svc.cluster.local:80 +spec: + ingressClassName: traefik + rules: + - host: example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web-svc + port: + number: 80 +``` + +The important annotation here is: + +```yaml +ingress.kubernetes.io/custom-request-headers: l5d-dst-override:web-svc.emojivoto.svc.cluster.local:80 +``` + +Traefik will add a `l5d-dst-override` header to instruct Linkerd what service +the request is destined for. You'll want to include both the Kubernetes service +FQDN (`web-svc.emojivoto.svc.cluster.local`) *and* the destination +`servicePort`. + +To test this, you'll want to get the external IP address for your controller. If +you installed Traefik via Helm, you can get that IP address by running: + +```bash +kubectl get svc --all-namespaces \ + -l app=traefik \ + -o='custom-columns=EXTERNAL-IP:.status.loadBalancer.ingress[0].ip' +``` + +You can then use this IP with curl: + +```bash +curl -H "Host: example.com" http://external-ip +``` + +{{< note >}} +This solution won't work if you're using Traefik's service weights as +Linkerd will always send requests to the service name in `l5d-dst-override`. A +workaround is to use `traefik.frontend.passHostHeader: "false"` instead. +{{< /note >}} + +### Traefik 2.x {#traefik-2x} + +Traefik 2.x adds support for path based request routing with a Custom Resource +Definition (CRD) called +[`IngressRoute`](https://docs.traefik.io/providers/kubernetes-crd/). + +If you choose to use `IngressRoute` instead of the default Kubernetes `Ingress` +resource, then you'll also need to use the Traefik's +[`Middleware`](https://docs.traefik.io/middlewares/headers/) Custom Resource +Definition to add the `l5d-dst-override` header. + +The YAML below uses the Traefik CRDs to produce the same results for the +`emojivoto` application, as described above. + +```yaml +apiVersion: traefik.containo.us/v1alpha1 +kind: Middleware +metadata: + name: l5d-header-middleware + namespace: traefik +spec: + headers: + customRequestHeaders: + l5d-dst-override: "web-svc.emojivoto.svc.cluster.local:80" +--- +apiVersion: traefik.containo.us/v1alpha1 +kind: IngressRoute +metadata: + annotations: + kubernetes.io/ingress.class: traefik + creationTimestamp: null + name: emojivoto-web-ingress-route + namespace: emojivoto +spec: + entryPoints: [] + routes: + - kind: Rule + match: PathPrefix(`/`) + priority: 0 + middlewares: + - name: l5d-header-middleware + services: + - kind: Service + name: web-svc + port: 80 +``` + +## GCE + +The GCE ingress should be meshed with with [ingress mode +enabled](#ingress-mode), , i.e. with the `linkerd.io/inject: ingress` +annotation rather than the default `enabled`. + +This example shows how to use a [Google Cloud Static External IP +Address](https://cloud.google.com/compute/docs/ip-addresses/reserve-static-external-ip-address) +and TLS with a [Google-managed +certificate](https://cloud.google.com/load-balancing/docs/ssl-certificates#managed-certs). + +```yaml +# apiVersion: networking.k8s.io/v1beta1 # for k8s < v1.19 +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: web-ingress + namespace: emojivoto + annotations: + ingress.kubernetes.io/custom-request-headers: "l5d-dst-override: web-svc.emojivoto.svc.cluster.local:80" + ingress.gcp.kubernetes.io/pre-shared-cert: "managed-cert-name" + kubernetes.io/ingress.global-static-ip-name: "static-ip-name" +spec: + ingressClassName: gce + rules: + - host: example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web-svc + port: + number: 80 +``` + +To use this example definition, substitute `managed-cert-name` and +`static-ip-name` with the short names defined in your project (n.b. use the name +for the IP address, not the address itself). + +The managed certificate will take about 30-60 minutes to provision, but the +status of the ingress should be healthy within a few minutes. Once the managed +certificate is provisioned, the ingress should be visible to the Internet. + +## Gloo + +Gloo should be meshed with [ingress mode enabled](#ingress-mode), i.e. with the +`linkerd.io/inject: ingress` annotation rather than the default `enabled`. + +As of Gloo v0.13.20, Gloo has native integration with Linkerd, so that the +required Linkerd headers are added automatically. Assuming you installed Gloo +to the default location, you can enable the native integration by running: + +```bash +kubectl patch settings -n gloo-system default \ + -p '{"spec":{"linkerd":true}}' --type=merge +``` + +Gloo will now automatically add the `l5d-dst-override` header to every +Kubernetes upstream. + +Now simply add a route to the upstream, e.g.: + +```bash +glooctl add route --path-prefix=/ --dest-name booksapp-webapp-7000 +``` + +## Contour + +Contour should be meshed with [ingress mode enabled](#ingress-mode), i.e. with +the `linkerd.io/inject: ingress` annotation rather than the default `enabled`. + +The following example uses the +[Contour getting started](https://projectcontour.io/getting-started/) documentation +to demonstrate how to set the required header manually. + +Contour's Envoy DaemonSet doesn't auto-mount the service account token, which +is required for the Linkerd proxy to do mTLS between pods. So first we need to +install Contour uninjected, patch the DaemonSet with +`automountServiceAccountToken: true`, and then inject it. Optionally you can +create a dedicated service account to avoid using the `default` one. + +```bash +# install Contour +kubectl apply -f https://projectcontour.io/quickstart/contour.yaml + +# create a service account (optional) +kubectl apply -f - << EOF +apiVersion: v1 +kind: ServiceAccount +metadata: + name: envoy + namespace: projectcontour +EOF + +# add service account to envoy (optional) +kubectl patch daemonset envoy -n projectcontour --type json -p='[{"op": "add", "path": "/spec/template/spec/serviceAccount", "value": "envoy"}]' + +# auto mount the service account token (required) +kubectl patch daemonset envoy -n projectcontour --type json -p='[{"op": "replace", "path": "/spec/template/spec/automountServiceAccountToken", "value": true}]' + +# inject linkerd first into the DaemonSet +kubectl -n projectcontour get daemonset -oyaml | linkerd inject - | kubectl apply -f - + +# inject linkerd into the Deployment +kubectl -n projectcontour get deployment -oyaml | linkerd inject - | kubectl apply -f - +``` + +Verify your Contour and Envoy installation has a running Linkerd sidecar. + +Next we'll deploy a demo service: + +```bash +linkerd inject https://projectcontour.io/examples/kuard.yaml | kubectl apply -f - +``` + +To route external traffic to your service you'll need to provide a HTTPProxy: + +```yaml +apiVersion: projectcontour.io/v1 +kind: HTTPProxy +metadata: + name: kuard + namespace: default +spec: + routes: + - requestHeadersPolicy: + set: + - name: l5d-dst-override + value: kuard.default.svc.cluster.local:80 + services: + - name: kuard + port: 80 + virtualhost: + fqdn: 127.0.0.1.nip.io +``` + +Notice the `l5d-dst-override` header is explicitly set to the target `service`. + +Finally, you can test your working service mesh: + +```bash +kubectl port-forward svc/envoy -n projectcontour 3200:80 +http://127.0.0.1.nip.io:3200 +``` + +{{< note >}} +You should annotate the pod spec with `config.linkerd.io/skip-outbound-ports: +8001`. The Envoy pod will try to connect to the Contour pod at port 8001 +through TLS, which is not supported under this ingress mode, so you need to +have the proxy skip that outbound port. +{{< /note >}} + +{{< note >}} +If you are using Contour with [flagger](https://github.com/weaveworks/flagger) +the `l5d-dst-override` headers will be set automatically. +{{< /note >}} + +### Kong + +Kong should be meshed with [ingress mode enabled](#ingress-mode), i.e. with the +`linkerd.io/inject: ingress` annotation rather than the default `enabled`. + +This example will use the following elements: + +- The [Kong chart](https://github.com/Kong/charts) +- The [emojivoto](../../getting-started/) example application + +Before installing emojivoto, install Linkerd and Kong on your cluster. When +injecting the Kong deployment, use the `--ingress` flag (or annotation). + +We need to declare KongPlugin (a Kong CRD) and Ingress resources as well. + +```yaml +apiVersion: configuration.konghq.com/v1 +kind: KongPlugin +metadata: + name: set-l5d-header + namespace: emojivoto +plugin: request-transformer +config: + remove: + headers: + - l5d-dst-override # Prevents open relay + add: + headers: + - l5d-dst-override:$(headers.host).svc.cluster.local +--- +# apiVersion: networking.k8s.io/v1beta1 # for k8s < v1.19 +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: web-ingress + namespace: emojivoto + annotations: + konghq.com/plugins: set-l5d-header +spec: + ingressClassName: kong + rules: + - http: + paths: + - path: /api/vote + pathType: Prefix + backend: + service: + name: web-svc + port: + name: http + - path: /api/list + pathType: Prefix + backend: + service: + name: web-svc + port: + name: http +``` + +Here we are explicitly setting the `l5d-dst-override` in the `KongPlugin`. +Using [templates as +values](https://docs.konghq.com/hub/kong-inc/request-transformer/#template-as-value), +we can use the `host` header from requests and set the `l5d-dst-override` value +based off that. + +Finally, install emojivoto so that it's `deploy/vote-bot` targets the +ingress and includes a `host` header value for the `web-svc.emojivoto` service. + +Before applying the injected emojivoto application, make the following changes +to the `vote-bot` Deployment: + +```yaml +env: +# Target the Kong ingress instead of the Emojivoto web service +- name: WEB_HOST + value: kong-proxy.kong:80 +# Override the host header on requests so that it can be used to set the l5d-dst-override header +- name: HOST_OVERRIDE + value: web-svc.emojivoto +``` + +### Haproxy + +{{< note >}} +There are two different haproxy-based ingress controllers. This example is for +the [kubernetes-ingress controller by +haproxytech](https://www.haproxy.com/documentation/kubernetes/latest/) and not +the [haproxy-ingress controller](https://haproxy-ingress.github.io/). +{{< /note >}} + +Haproxy should be meshed with [ingress mode enabled](#ingress-mode), i.e. with +the `linkerd.io/inject: ingress` annotation rather than the default `enabled`. + +The simplest way to use Haproxy as an ingress for Linkerd is to configure a +Kubernetes `Ingress` resource with the +`haproxy.org/request-set-header` annotation like this: + +```yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: web-ingress + namespace: emojivoto + annotations: + kubernetes.io/ingress.class: haproxy + haproxy.org/request-set-header: | + l5d-dst-override web-svc.emojivoto.svc.cluster.local:80 +spec: + rules: + - host: example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web-svc + port: + number: 80 +``` + +Unfortunately, there is currently no support to do this dynamically in +a global config map by using the service name, namespace and port as variable. +This also means, that you can't combine more than one service ingress rule +in an ingress manifest as each one needs their own +`haproxy.org/request-set-header` annotation with hard coded value. + +## EnRoute OneStep {#enroute} + +Meshing EnRoute with Linkerd involves only setting one flag globally: + +```yaml +apiVersion: enroute.saaras.io/v1 +kind: GlobalConfig +metadata: + labels: + app: web + name: enable-linkerd + namespace: default +spec: + name: linkerd-global-config + type: globalconfig_globals + config: | + { + "linkerd_enabled": true + } +``` + +EnRoute can now be meshed by injecting Linkerd proxy in EnRoute pods. +Using the `linkerd` utility, we can update the EnRoute deployment +to inject Linkerd proxy. + +```bash +kubectl get -n enroute-demo deploy -o yaml | linkerd inject - | kubectl apply -f - +``` + +The `linkerd_enabled` flag automatically sets `l5d-dst-override` header. +The flag also delegates endpoint selection for routing to linkerd. + +More details and customization can be found in, +[End to End encryption using EnRoute with +Linkerd](https://getenroute.io/blog/end-to-end-encryption-mtls-linkerd-enroute/) + +## ngrok + +ngrok can be meshed normally: it does not require the +[ingress mode](#ingress-mode) annotation. + +After signing up for a [free ngrok account](https://ngrok.com/signup), and +running through the [installation steps for the ngrok Ingress controller +](https://github.com/ngrok/kubernetes-ingress-controller#installation), +you can add ingress by configuring an ingress object for your service and +applying it with `kubectl apply -f ingress.yaml`. + +This is an example for the emojivoto app used in the Linkerd getting started +guide. You will need to replace the `host` value with your +[free static domain](https://dashboard.ngrok.com/cloud-edge/domains) available +in your ngrok account. If you have a paid ngrok account, you can configure this +the same way you would use the [`--domain` +flag](https://ngrok.com/docs/secure-tunnels/ngrok-agent/reference/ngrok/) on +the ngrok agent. + +```yaml +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: emojivoto-ingress + namespace: emojivoto +spec: + ingressClassName: ngrok + rules: + - host: [YOUR STATIC DOMAIN.ngrok-free.app] + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web-svc + port: + number: 80 +``` + +Your emojivoto app should be available to anyone in the world at your static +domain. + +## Ingress details + +In this section we cover how Linkerd interacts with ingress controllers in +general. + +In order for Linkerd to properly apply L7 features such as route-based metrics +and dynamic traffic routing, Linkerd needs the ingress controller to connect +to the IP/port of the destination Kubernetes Service. However, by default, +many ingresses do their own endpoint selection and connect directly to the +IP/port of the destination Pod, rather than the Service. + +Thus, combining an ingress with Linkerd takes one of two forms: + +1. Configure the ingress to connect to the IP and port of the Service as the + destination, i.e. to skip its own endpoint selection. (E.g. see + [Nginx](#nginx) above.) + +2. Alternatively, configure the ingress to pass the Service IP/port in a + header such as `l5d-dst-override`, `Host`, or `:authority`, and configure + Linkerd in *ingress* mode. In this mode, it will read from one of those + headers instead. + +The most common approach in form #2 is to use the explicit `l5d-dst-override` header. + +{{< note >}} +Some ingress controllers support sticky sessions. For session stickiness, the +ingress controller has to do its own endpoint selection. This means that +Linkerd will not be able to connect to the IP/port of the Kubernetes Service, +and will instead establish a direct connection to a pod. Therefore, sticky +sessions and `ServiceProfiles` are mutually exclusive. +{{< /note >}} + +{{< note >}} +If requests experience a 2-3 second delay after injecting your ingress +controller, it is likely that this is because the service of `type: +LoadBalancer` is obscuring the client source IP. You can fix this by setting +`externalTrafficPolicy: Local` in the ingress' service definition. +{{< /note >}} + +{{< note >}} +While the Kubernetes Ingress API definition allows a `backend`'s `servicePort` +to be a string value, only numeric `servicePort` values can be used with +Linkerd. If a string value is encountered, Linkerd will default to using port +80. +{{< /note >}} diff --git a/linkerd.io/content/2.17/tasks/using-psp.md b/linkerd.io/content/2.17/tasks/using-psp.md new file mode 100644 index 0000000000..b76e78038c --- /dev/null +++ b/linkerd.io/content/2.17/tasks/using-psp.md @@ -0,0 +1,11 @@ +--- +title: Linkerd and Pod Security Policies (PSP) +description: Using Linkerd with a pod security policies enabled. +--- + +[Pod Security Policies](https://kubernetes.io/docs/concepts/policy/pod-security-policy/) +have been deprecated in Kuberenetes v1.21 and removed in v1.25. However, for +users who still want them, the Linkerd control plane comes with its own +minimally privileged Pod Security Policy and the associated RBAC resources which +can be optionally created by setting the `--set enablePSP=true` flag during +Linkerd install or upgrade, or by using the `enablePSP` Helm value. diff --git a/linkerd.io/content/2.17/tasks/using-the-debug-container.md b/linkerd.io/content/2.17/tasks/using-the-debug-container.md new file mode 100644 index 0000000000..f51d5ac99b --- /dev/null +++ b/linkerd.io/content/2.17/tasks/using-the-debug-container.md @@ -0,0 +1,104 @@ +--- +title: Using the Debug Sidecar +description: Inject the debug container to capture network packets. +--- + +Debugging a service mesh can be hard. When something just isn't working, is +the problem with the proxy? With the application? With the client? With the +underlying network? Sometimes, nothing beats looking at raw network data. + +In cases where you need network-level visibility into packets entering and +leaving your application, Linkerd provides a *debug sidecar* with some helpful +tooling. Similar to how [proxy sidecar +injection](../../features/proxy-injection/) works, you add a debug sidecar to +a pod by setting the `config.linkerd.io/enable-debug-sidecar: "true"` annotation +at pod creation time. For convenience, the `linkerd inject` command provides an +`--enable-debug-sidecar` option that does this annotation for you. + +(Note that the set of containers in a Kubernetes pod is not mutable, so simply +adding this annotation to a pre-existing pod will not work. It must be present +at pod *creation* time.) + +{{< docs/production-note >}} + +The debug sidecar image contains +[`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html), `tcpdump`, +`lsof`, and `iproute2`. Once installed, it starts automatically logging all +incoming and outgoing traffic with `tshark`, which can then be viewed with +`kubectl logs`. Alternatively, you can use `kubectl exec` to access the +container and run commands directly. + +For instance, if you've gone through the [Linkerd Getting +Started](../../getting-started/) guide and installed the +*emojivoto* application, and wish to debug traffic to the *voting* service, you +could run: + +```bash +kubectl -n emojivoto get deploy/voting -o yaml \ + | linkerd inject --enable-debug-sidecar - \ + | kubectl apply -f - +``` + +to deploy the debug sidecar container to all pods in the *voting* service. +(Note that there's only one pod in this deployment, which will be recreated +to do this--see the note about pod mutability above.) + +You can confirm that the debug container is running by listing +all the containers in pods with the `voting-svc` label: + +```bash +kubectl get pods -n emojivoto -l app=voting-svc \ + -o jsonpath='{.items[*].spec.containers[*].name}' +``` + +Then, you can watch live tshark output from the logs by simply running: + +```bash +kubectl -n emojivoto logs deploy/voting linkerd-debug -f +``` + +If that's not enough, you can exec to the container and run your own commands +in the context of the network. For example, if you want to inspect the HTTP headers +of the requests, you could run something like this: + +```bash +kubectl -n emojivoto exec -it \ + $(kubectl -n emojivoto get pod -l app=voting-svc \ + -o jsonpath='{.items[0].metadata.name}') \ + -c linkerd-debug -- tshark -i any -f "tcp" -V -Y "http.request" +``` + +A real-world error message written by the proxy that the debug sidecar is +effective in troubleshooting is a `Connection Refused` error like this one: + + ```log +ERR! [

NH)n^rnE)(z zpH;q9sr+r#JziOY5xcr7n?23PORnNk)h_h<-sf*;@N1v%D=Y5n%SHUX-&wO;z{tIt zyVnS*^v}K2hX3KyJ!Ri~>YpuQ=h((x@PR>PRj#oOf^Fe$@XL#)!!Nw2K6j%9zy4$8 z0M;k}`7(Bn3BYm&PFWIR=z^MwX9ROhlHPII%{16R)eha|b>=s`|BD#DRRAn^w_6iq zsOl`KZskI#5NT~pwMOM3-sjpm$TFY3y)x)27hV<)trM8Ew&4$`) z=ja`|7hts&p-L9-OClBW2&C_`J>hFju+6HMu=*1=C!4tPfGWQ$RyCr~wRN6(>Jl#x zp0Ng&Zot(u$5}ybP8@KJztF9^2ZFfnf=b=@His@w;@qgRl!&>#=cG)nyk$emsq7KQ z5PKIDdi(FW3j~(N00YZnL6Wpx>s`y?{T=LyY5y5CI1L!kyqah%GBYDvw(XgrY{#rMjK|5q|4(URy-tc^+3LM$y;XgSJctM~8>l+T6gMJ9lvF<_%^Bm5K#CdiNdv zoZJXcN(G!0^SC%W!9_zHSFYZ|==c;fU5ce+tgI|zV`CLNTN~Kh-o(MqHU|59FgVbM z(UBo^cXc8bOQExO3?t(=(cU$TOnV!amnf3qJOfy38=KhM-{*cKw=`nw&@Tf@tScp8 z5DAeJ7}eAm$Mp17y!hfvTxJ?1i;D|bT@3-S7(_Ho3Nyx4bIb!4=zz*2ha;U4fHgUJ z4ZS^s9P#fsm&Nw>I`;OqvA4g6Q=>*6M@M)bzV`a-c=z4+SkOI|NT9R38^w~aZn}E<(9_qCk>L?so}OTS<|$Sd=CHK1 zi00-5Iy%}gF*Sw$>AUEgx{E~j2ny#E2~t50s-qWJL+Y!nDgm%KQYwuB(yF31VW(Ts zWV7}`0UaA*PST+f%+d6i{UboVf*~yC&2~V6E4ln&n`&54E`VjsrezK5WsJIrsh!me z5SOi}YnYA`waV^(fYW!(HD4^~3d_tUxkTW(qw-m1wbN*_q6tQzujr3SRKi9UuaA?P zGYQ!W1ZGiU1o{zRTs%2N{^T5a0%PnSlE#(Wg5Dxf?=fkeHImCM!u&QcrMVQMy3?4k7dr-2V!bkZ!C?R_w&}9==_$Zn zbEMzs0mI_8Om3qmX_(T&s+6@z_c7kZhgqAI5ogwA-?>4Va%K*z3#)HyWkI(~G~7@I zR$%j0wo$X&uBf9^#KteUA*ySWSN^a+_h4C~H=j`e7Ul4dzq*Uxc_ZuFRD~9^!rt~j zdZ``%@YCI8uYKyDFJUKV7+%4>(Q~$i_qsP&>dm4mfMqRAU`xkYzR#VjN!mL~w}0z6 zlvHR}IRrQvg*>Yh*?y(Ph#KNiQ{tKXx6Zm&%HPMhEpN}L7LH7^rnac^Pz~*3^RGAr z%1fyxGMGgqaPZuHS7%?j1*`fhJy713VVubF`c_Rm)Z*9Nb0Nw5`Yh!8X92}(7%I*q zb=0|zM}u~@zB2irjvR-zEI1Lk$+HdNXKH}@s{Raa)9#3m%1laLd--eKCAcnMzN<`A z5Z%~4`#AP`pY~@W;(lUL9XDcM+1jIrJ6jf0E4J?n(71qI=eA-Vq6@a1&aC19zEq6k_BmD%vCL$^}Zg5aA2 zV0n5l!Z5Jm;ORhWZqbD?We)E;M(oYFiC}4>%CY{E(YNx=4Hb-Mjd42k8dnWw7LYKw zM&e?`jNO#zFw}TfLM9HhB^$9e{{*Y^kFhxO4lYYaxO?*&hWh)^+LFfEX%YEc9{29v z#f|INkv~4h&h9pzK6!%eoo$?*mT&-RL6*LDMnc&o?CoqJdsxIPAN(lp-G2q6V-twS zfsM^oJbCgi-g@{D4?JU=&& z)zu}AKuF~#1{~`Sk*1IVc;xU;z@J1tV3#arQiv!txg8P%t0moz2?DTs2RUzIbrFEI zzqi8-EO8%{=x1yn4WObdECQ%>F3~}nqa8Mg=GIB+gkADdsTPckPGEd|iou6`A&0s7 zr_A&^IVHEiOLo^G@QO68k|d^{h%?)W57!)dP!8H0J&=Xmh2=*sg!I$j+s6?k@7=kF zOiK%cTN|63SYBSnm;U%m_{+b16|*yQ*x%0@kVU`|%evt)X~r)2Dd!!wUwz2#g}}d>S*OBf}UO z9!6hJ4}%+Xb8}djpTqp(BKLV)M<+AYj`Bscw6>$Oy9X2F6KK4=!1DYomS$&|UD(yt zf#IP6jEs$;bL<9M2dB~0K8TZsgaM&MbXypn(pDZIFXG_@V5u1-ppNRvqI1N+aac$U zh#A*Hu`x8hM8w?!SccLg0G0qkBG4`_Z~O)$Lmq&owvxW)U!#ZRuG$QR_!fHwQp_rA zZgb4k5y;8dbl=*fw$98A%S1H!av%Z%?aV@GBjOqRDoiYaZG^cKT%Dj$A~(Ww6i#XEP(TI(uZYnnI%U$I-sKC=cfEWt zK%#9oQ*U+~RzY_Icqv;~qtNochSw%>`KC4%AW{V8?GndepvV5Uu6o=)o(`FQ?$L6* z+bD01=8_5&r}q;803ZNKL_t(os^h>ip#yt2^G~}Lne~Ut>H=84y|cNR+s2SCKGEaw#wP~WKm1e( zfc4Logvk_4x5k?KA9FTV20W^L8y}uwMF5Lj2=&K=#kBu?rt;VNl6Rw9>l?K^=RaUa zAJs#LZl#m`GqbRsxA&@Hh?2e@yy|JAV99Ep&Sh;;%aPP6nUirvHe^I)qRJTw9Mn{? zN`|dUAM)3=9-&>s|S<()Fr|t%*BkPLM0P095_^1vT*>DAaBIj}l=n*!q zy%urHA8z3NU~w(bRi*aU&AHTwT?i*i=7!iOB_R(uZh#tE+%NHA*fyqtBxipa8DjF; zRAuO>yMczzHd(Sw@lW0`Gb4vi&CQEyE4lky&7YzIL7rLkHm+`Od5V3uH0BQloU{z$ zYhWT3g)ACgs?OqMZk)Zewe@V%du%tm@s{s+ldi5RTwSM521K$4LUW)L0N~uRAGA;C z0O4o3(;-R@_WpWGztN$cm@(Q#EWpgC9(6O6+DgA`^d`T^J+~W!EdJRc!M$`&cyq(D z&-A2YMB@o4;UvzAXl}YhOB~o;U&iM04Bmb7J18CQ;O@<<7#|rzZ+9mWBrbk=iRsBH z3=It8y+`k1acL3xVgbdI63)+0aZ<{okk4UjYaIs%d3@$GU%*E{`bmtBPa=_QWWeS7 z4_{+FrSE<3b-ek;Jctz4-k!kp^f-ox``BIX=B*d-10Ve)i@5jp^*wrka zV4Wz^Sdxin`jWMt%32I+%y78P%6>%z#$B)YnK`52u$I>0t*U}Z@I>j)sbhG-G6R9Ajfs?DkbC9ASQb23ypZwcD z!C(Bv*YW6`N7&xpH5yoI-(?Q)!Po#Q%npsmF+Meo4}9Qd3=WcuUj{d>U%~aO*DyLf z!fd&xPiL5cMIhF(X>)eBq6l!L?ZuH4yy`zHx zEOIF&f&2BfRh*QH+(yDgx@0#>(h(C4Ey-(iWQ4`*+uB;0wR3cMfL(fjW1S%(ay8u9 z-^cF$Aub!5kj}K@%JdbaVolg2pzO(ec=YaD7#|>;J;0$5@{y%k2Rt_xndw$vUfr*Qu>n=!cr3_&4ul!BF1Yi+RN;+;7rICQD zV-jwsxkbPy1EA!ROYWTpz%l_8m{=(WTo-6@^|ba}zcg!}i5RKwkmBYlZi5<8)hq}m zlAmGj832p>-7L`BgT_hKfLorRIyaD`b*7-8yIb%;MvWS15_cDI2Ql;3egk$ok_FU1 zegMnA-y|Da1ArB_!LEe^5OQt{+l@wkR@=tArt>F&N&prW;kBg#{`22i*BwfEsj3vG zDu7j6bpqQ@uNc94`frQtYFOXHpS#(DU;jdg3*m39_<=WBA${-G+V;_}*Clkk*PW?J z`#)TBIVG&WUe(NG5a6lQ9Io9AAMN!vidoIfK;S5Z4uIv(H>KUn=HAg?vicFSarX&( z+rxn}v1C^G=9|@?@+P&MQ=%`8guN63gqfYT-)b5#%e5K4^&n)i)Mm63M5$w**tyTR ztE-B`iqac;*TTEj+DlrGTi$x%GO)A{l(A)963zBRZnDjuM z(V&cu6}wu{O}NCo_rNOSq8J8XQQ1WBS{W9qbEWO&2SIIQE@xfP@(EbLeq&DFdWdii zPzpv;9nG&sEL3*UO{WoD4JmM~PdP2hA0$@!|P2=v}dq^ab%*rB$4KZ{ma@@rQMYyAA zee~PJk^c(C5`&xs@-aKhFtL;^$%p-h1}-a!xDOAHqqDP@=Q_I(?ht^ti)=QF0=b@* zPPn{sP&IG#=zkXu~gAmKK3z1bR}mJrZyqBL>!G1B!(l<`)RS+F(sF>RSS- zNc5e+x3h~g2EeGVsb17Z^g|3S0vwO?1yH1SJ!BH7O5*6F!=nbk$}m%lTs1ehHu2>@ z`!c@vwO8@r&4<`n-(*%I>uZ^IUh)Iyr@xUw#3j!+q%M?ZEUDX-!RG zd~}=z*GXe)W?=!3XXmg-ZB;B-{U6vy`70kWjY#bWLW zWLh(-z6|S2 zS7Y}|PTdyyzh;B)+bYml6&J$5M$G=R@&>IUxKQnMD#N$#?R3-&)v~JwU{Sii_SIed z>o*T0vIsj4c%MZASmZ)@d>**dEU$MhE#a@DJ+jr-h7o<*-`a$GgR(fe>3@B;z!S~g zRC`;#%0Pj?KsD6N%{cJ5kNO`~)6lw^8)9eTX(g+HV%5e{Suu=1dTkw1<*CT#3N}n2 zow7qfu7}n7&tnd;=mD8(fm39n+z|_sd z=jIYp_A+}`sWkPBvZz6!_NUq$Gj~)Gj|EHOSvCK$J?y!#(Jagi-OYsX&#J925vI-e zaoEr;t6#NtaZ2xT)t_S;hp(gIWBysPsjWU?D^>N}ssXXpQ>gEWU|lNNr}7mgboLlv zquL&!wpR3xgYtY>d8?&VUP{-V5rFlH$rFEZ0|1i?UNO*Ng)U?x%HKPiN}pax1q!Qt zCFK*15O*%P94hY%7wEAdO<3C~bIe@FNme0kVE{MD+;i3A$BkQu3d%|nYR3ZWh1Mes z8FySFl+h-($!w&}-)<)a!7J^3)=aSnL*d&Acg>9-T}iC+m=gmM|j@=9_p$ku0Teln$t2 znK|(a@L+Uh=cK0gekB~jsWv10(wuGPfiJ!s8KmIuk50SReDVCRK8Nhn= z)xXBWx8K8~_h!+OA^oB>`ue;0zvNPP|K3aZkSeKW`=MS;Bw}rjkE$r^?GEhQ* z5xXC9Br=KAN983qCMut@SS z>+2i%`q#gPZ+zpg@!juy4=c;7hAF0z6Ezy1SR@{1;<9igcK1X~pKo78X}mF}tvUm5mK-Y;ExvrXKndQb{C?J82<*%!2yG!ZDABOiKm?1W}~RqoZSFvqvlfPXItqPp|pyMtfTt z@kU^0YYp$b^A47l*RZ~^g<|OxXO|7=8yG>~;4lVC8#j^{PScLn`2!Bfu2eIa2W97bqKJy|M>ilNcPj(L` z8%r!9($*42mw>AZL1bdX2t)x2amDpC0(nI>Hk7T6*(cg{OkJMs z<}tAD2X10q2B{19`_^l-?8vxsT&x|o7Bieo^iFlhWLsx~Av87`*TSX-0je0lGP+nS z`YtRiidabhCA}>A-UYA-^du2?64WOEQd|p#oke3v+=K~G^42*qvC@yeorWU|!(}&- z6v@q-gGgx9L1hlxmrcK`mYU;2sN;iP;jv)_-c6qc_Xye-3T~PGgjZ6BNvBR3S{LmT zyP=o;haJDpzJzNZ5H|Mqx5U8ur8fgRi~2TY6^~)|%aF}+J?A$&jw4Ps=6ipV`Y)+Z zEdW;j1*naIRiRCMhi&tZXP7$P zvLbZs+I|AhRe3G!>&l}yIzeBxBMPf~zi8~@KQvGky;x~|D%<4p_VyTUVJlI1`?*h6 zZ{e^Wsx<$qeCJfuP5I@)Q+#5w+Ip|S*?44^lqU34#~=FTgm_|)$_6R0i_HW@XCd~eTQ<+j#72D%6jN3 zo5QXfoF5=l(2Px$^B(o!1_E!McQjbs{6$%ArBC&oMyKKfWK0bk4w{9`WLkH)Dg#~P^lYUf*T>+U<$F5f5DoW1? zBP+%XE^2=QLF7A%^d?$GiFg9(bSrC9b@%j3{sds{Z)0zF6WhBx$Q~XccbsQng`O9o zb^@*(2A0|5Q8YjqTjHWfg6~WjYiMGY7csD!ni4oYD`9bQo&l_U{+OW$VxTF2MJ|@) z3P~Uv0aMM*0$>rKS11*6oX?|lQeu`G`i6(uZScy}Fs3I+D7~M>;wQ!@ z(Vl7J=#zG|!#PaGYR@XO}B}Newo0uI#K%oKrSin7wbSlMB`U*sxT$m94p#{%%JnHB~R^Z5ez$Khd)#kooBzpJ~O0j!~+A!ZuJ8i2Kx zC4BFD-(z>v<>fWj&bn-hVR&p3gQMdZ7#c!XYX*s?1}rbk_p`cIX8&j-q?$FytTlp(c^56p_T{%6a9#ssNKM4PxO_#Z;D+5v)tt)mfBo>wdu7sV{ zh{jkPXWUm8$QMsoGmV&61YXe?7XV8@EDylaAOs!@RxVAf3Ag>N>xKYW!phW(3UOj4ESlDbN3^5MRP$zWn$^`W*gz2 z8FhV>|GMj<`J1-wH-G5?FROMt;NMj$rW>^jb@&SMqTR6Q8zBcLvrmgmGx`hnWaJx$ z_BPRNEcc1e--_12a-aLoVgdi6;k&qC*Jp~wVXoNRsN{_ zO|e7Mat>FXwUj5LW^BMb_;dBnYW8#gfjs1ah;qB-wX?PsB*150f(Eo&C;fZwV>bF> zJrQkVD4J66rxIqP?Hzok5-<{)o|zA!-__L*=HW1`pi*;3Rit7U1`>RZ?hJpmN~F&k ztwwMJa9(yp5H;(cqcYWoedzar4TXIs$nFcw)C$FP-wd*8!(j6Ac9MBgZkwV8WLRNp zFK?NxGp~98mY_D4q2ss>T13RT%<&jgDo*QxE}EBJsqG;_4iaT-tEzpfb$3K`*&I62 zjqFXmu}Xmkm;IjiA-6jv>ly_E?s#fio`o~}chf%do_jORIyV6z%B`p7?+501vdBTn zHkxTQ1)7|CaQg22GHfuZnr!$r`WJo12S?Vt5^zcm3=%1fK4TXhW>BGQSjinyEz>x*l{ z09FH1u|{Nfw~*gjM0RZ!@zX<0j|?!V(ceFSUS_Fu(r59huXMgxdFgP&G;@ry=fpBGk0hPnt5%*?1LF}hAl5rDpkK6`NPuV?; z{_6oyF^rCl;l}kF4CYX?EG|+s#5Hyoyf`PZejPi;6^qy{4I=8UZat@Gk;(0Am5 zSt=G;6YGqk7y@X`v|@O81UGNqMq6t;mtkXb11qa5c=+HUUVH5g{P|b^60@`O;zHO& z;GRV2v{UU;*eMrOzf?22`uj0CK7yOqCUEQ81jdIc+T<7}$EVQV)`9)~1FWpCGXraR zZH)meYO8#)h(-foQJavP7j+SVSFM>evt`JI&;zi9-O8XKzZYYXeG+Y_=$RBPvnAck zZiocj5u=9l$rt(W?yhe1_V!_Xd>p;q-5_VZ`MFuV`n9j)>600(F0TSawv5LyL>h48 zlNcHqMsHUqGR@7{SY5`u?>t1T@e-L#0(b7*!ocKh?fLGKX1Z)X_~`3#oB%Ax9o!FKnf(s4tBe4@83(2tY=Lm{#y~ zSuqp$a29r$@ea&kd$L*qEPD4>zPyXye@Kg5qTaZSC%-gm3L|x*j3(*<>tkgObz7^W?Rh= z@xob4y8k|yN#SEFIK(SWkBas+@TKn}%5fq8ez^0l9j;N zfE0mP`eWT~g16d6sMkBFdhP9&SwTK!W(dkBMxRA~*@aLvx-3h=^p^`zDpN+zD9+73 zF&4xRl3k_}jSVQ}4{>p@j)T>wh!yuR*58eRfnf{`4&(B&5&2>sPiLNDevv>7(r&s$ zK6fmPr^|B;^mSrlY#9B$o#^fv#>m(e^!AOihEqPbkCo+lEG^Dpc76eiE9+QZ-9Yh_ zm_}!a#mNOMg|^ll0#b}wTr?&5+4 z$_dC38znA;BO@cYcI`TAWl9xvNR9$YIM+TM{6o zEJ*@OnwvA2oSa5aZ$IbB0M_0Xve{i^4-bXqL-mU#q|FEiRS|yUW~Acq%pQuzg%Ngn z#t|JUvg7I5B?bmYFg!wH_-TSzvAMa)fCw^0N|GrKh+ z8jsId9F2)2+PZr%Ix>LU*C%lA<`s+%_F!aa1Xri8p}VUGx#MH3ZERw8ex3m=`a4T5 zmxUr?i6pbH6ucrv8i}~4Q%R(oQ%EFJILha7oG+q8E~A&1!Z;&Qe*;t!(06!v2y!PR z_7+8`Bi3E9L|R}ab|oaC{mw37V2zCufYrrd!rICT-gxbGJbv^TvrlKxoNPv_tqqyZ zF0^*{pr^kNecj#Y?drnb&NgPBKEnBF0kNiYyzs(33{Bs`L8$?S%M>n?88kJwBG%G| zlLiu~H{g|VIa6&b<#?*?pz(M{z!izM(|?tv#b+%Ncv6=&XI?8aR5yYSmcsMju&>y@ zseB4QE5E$_*+nS`aJk%Bv8!ZjJnJ6Z===8xY8%D2daIz?y3jSr1+om=hziJ7Q{D88 zZIp`@VlaA(1GkiMm81SAfQkj(S=61rqu?46y^w(|j!Z}{sR?HGonJJt1{y^gq{xp9 z&@zBUuAnrR1X!d#<^D0zIGrL0$m_a?JB%pNzY-8jn2e@fd>as5Q)Ml*;HLqP)vmMq zpw-;8E0MkU^6lBIsJ>Z2%^EB1YStuOPaI~Q3ewxY^gUy5x1B)8%G0RjkP)7i_i6Ax*88R&0PC1s34d!18;3zxLX)257eJSD`xTcmqB*oyNVPB&K@e9HN+_Asm)2*v0X!^%MN%Odi`gZ^M&{Hy}yeRp;lZ zM3hl)AO<-x6fvVE5!~bh*@DI*2=8qwk0Zyy864y_BiUd!$AKT5YL+^5#nF}`)Ed~$ zUtl+Xj_y#)Z&q)Hr+po9;eczEOI=AJFGbr?H)SIQDHe%WhP)u6{n77NPuB)2o9_hww2Y zrdyts`R-{=MY|O!gUneCUBJu54b=`AB#H9SUv~^CfF*}4&yg?eHs3QDUI=mhOv^0n zHK~AEPI4wm*kM-ws7Nc{Qy6tTiCvMZ0#nBT@= zR~vf!1~4!%gx%c(EG#aF2A9A+$mjD|Szci_PispG(-Wh(d;1#ty4%swHHhxs5wy1T z@geUpyN%W5dF<_NFsQJ1aERT#0~W_7pof4dswOd-?%lnQPk-WvG0-mn*39fqnl597+!s|;*V->$5zU~6lG)1zp2 z+K;NgM4D23ASIT?$tfRDU51ak`w*B#5$ec=u&1Yw`%_&Ak8=me7YefYGMfg>fTQvg za3mu0!Xgp9C(+d+P>z8~5MxdNrqk1N^z{v4Xn33fEE4M8+uO$eJ_*GiaGKN(G!6*F z;_@|89mM6)Vhl#-i({W zcX;QW_ZR@8a#Qp_2KxwL;fQDyF)zkUCBzbF>FmT{UpMaDoW@IcZ(yju6GH>TxOw9y z`uhf1uWVy`n}Y$6tK!<`77mWYEij%+v9LCQ3+hfu+E~h zzXZgknwt$v%t8nQha+8fT~M4o0quAa=|H-x4=0TY=@$oR;IYgz%AD|w?NEVs0!DcJIClji!tTLNJa$b$3G23H z_E*YCVn!FcAd9sL+E;5m1Z^=7S<7UDb4^E{W4g^ zV4}Ei>Mw&?MwDOl2|e5HE-AXcTdgv4lSH+Xh>^l-65!m~Z*Igde53n#Vu=`aV{(XZRm~xC=jhztvZd|Kztf@cnht*{~(>egC-|Y5e*Z%G>3Wzp;v) z<1heEjtyV^g%R{+JmiN2-(UHs%bYfWO#j7)+VL~@Gayi{(hs%XmmlZxzx?GMwsHnA zvK?LCADpS9%H2n`(XoqKNqF_nAMBWd(6wQA#`35tIs6!wf$3JIezIvaP-Hw{7=x$7a7Ac2r5N#{lO}#$txO15K>Sro(DrNS< zZbZ$Eus6@OHN1x-4oE%# z%x5&EH8paRMpBbaxD$O#0Vvad#E@Zk9V4)-8*~P6)x9tT5VHW90j+$jFlXRsdVKhx z1Jb#;e+dX?w7JakrHm^si-aBHX5llZ5p!1eL;6P80p~_|TLpLJpu^w^y-)pjagJES zB~mB*$gMp^tUv%(D>^#5n2~dEaESGd4GazrqN}@$!K~$_MQp6EGZ50#)rNuIP7L>V zqnR!in>%pz`h5(KUPVJ=9NB{{%*{SR?r4{vXT7GAQ>?D9V`Fm%hq*k?E*e;W>CWwY z_@N*C1bTb=kxr*DJNpESOA9CxW9saT>r00=1}zc^1}zA*(YB)R7{H>j(Ab2b!68gf zPa}~?@EBTMUBUL&77LxT3!%D!Qd^w~a790K7^Zg!%pq`zeptwz^svs(_`BwG217%m z=(6H{W=OFMjb$c<|sY z=;gZ@=;^>f{~+sZ5s*d9wC$Z8W?&J3wZ6H<46IzCz%GQWPefn>1A3Gr)7Q}4oMK%s za^EVIPH}jYKbJcaoiGCIh)N;PHEp(bAGZx~(1OkO+&Jwl?&1c4DBn7pJ8Hc6T;#u)mFb?f|d6 z@)Aa-Z(%!I#6jT_B_xpQ>_hkP1d0s_)+bW{OXjYC-P9YRadpX`5yMB^28G=trc7Fb zKvo*d%DN$!Nt*x6=5xSmvCCp3C3>lMS>i2C&bnoRD`Qv1ILew7dhx*zIP6YOzgXTXMB1ny&$N6l~LHIZ7)R%C4R!a;SG6!q2R=FLCyxqOn@juHmd)#NXUE|&-<*psSp%hB^5g6U zRffbNc4@mb+%f=GU>8;PPyfMEzm5X2B6fl`Y;rjtCo{Jb%QrW{Vn%21`CBca0M^g{ z_6Gj9pXl|0F`DWx{n;+Q_*Sl3({Ooz_N7+*gD?%O-&n=23k2B>rp1mdjD}ljMH=Q~2 z(rw{y{p77Bx(kijO#pN7QY3U_W2! zpjLf6%E0#0aOxVI)KQ6Pk;{xt{hC45%3Hav{-baCp)Mlz8oEs0togxe)$k28T~Ml~ z@3;|`trr0o!>|HK>7(o5wXNIA&kA4#^3kzW%h(TXyHoS;gn7CdMMWFD)T4E)X^fy)bOPw_owdqt$HAupZU%>&-uVI zwN*jDyCwk3l*MNOOyzVl?wXO%I+^Efo7nF18cch_8&zhMn0iIpZZ?)$L+fZMhbRTb z%pu;-3^3~)yWa^*MXD-pAaY~xIH{WSh#f-=6=AdZrG$0!uIX7Y%Ca3?QC&H}1YIPp zoiQL315SLvk}@i2CBsX=2?Bwrt`@|i!>l>{GT>%hQdpad0W71NqpS@EcgV%AiB8RY zxF_-Ama_xoH)oJ6?qIm59c}F$Xl`y1!R_T07DJz$n#7YQPcT0>gSE9))=}zgZ$UcI zh-A|R8ZS=J7;nXge&AEMdFN%s6U_`@J$d{Vaz{I6PK!`ErMb4bi+u46myHRuws+yi z_1pN!hkpQFoxL1cZg%b|mX;UA<&WLPJXRcmNEC%o8E-uA7-$lf3u##m3=CpwYKjHE z>ASVnRd&B)Ac_Di101M;JGCRFOKxfuy^eIg=-=$3SS&K5hd_};EY1w9{()h1baXR_ zbaIl%(cuA(kF)F|M>cm#KE-^0l8D1#{!2!O!Qm6cW2!(z9Hfp|lT0Xd|7u zQ`StQcA%+9>@;FhF@TkBL4sWmNefGau?zXUVcHRpDD6QEG7_>U!GHRtSw&#n)Z`TU z`uY%SY~()P+TO>r=vuy~35Srd|-{pcQ@LZKmvQt3qaR;sCHz*j5OZonoHZI}KM;74s8jaUzi=J!bV zj>ne=UBQvp#{*?yG&;?4Fc4kez&;`+m&zqiPyRK|qcPr~aSO%Oj^V@VD z)!efAn1tsZ0*rus$Tm>5xPAK+v#(IiE(Oip%T)orycOGC;#lbbXMYvgR0X$ZR)%xrULB82MPr8=Smm&>3_L~%_HNc zR|e#W4>0w`&%QtaR%clnpJo8dbMs^8VBfAzUiry88T?P5=@z%V_wk1StnWJjmT$8Q zAQHg(&9!g_mMQyJf1w<}`tQHAga7r%dO&W8&+ntk_KQ3C^QZa1`P!cX8S-EFNIU-i-;hWt?$7+*DgO4q+CbsdKdM6yC(be6 zejg&19n}_55nnos@CR#H9)>%pMS@RF^ij^5aH7gd{v z&9D}Ip;|^kNSVByPYuJnmO2HK3A|JJpP}s>oYCduv%KzMCH0;PfUxBa9;igf4#gc1 zbvH}209`PtuwIR>n*$C6$FQ9hwdCMc-(~Z7xNN`{g^ZkGsa-G50+)cGi2(!fv?6J!0CY4iW66dB70v-Fs#Z>pjp#GKvQn~tg!Mb~gBbf*; z6Hafx?FQW(N+@5BM(8lI_^@L%gy`_=val?JORxGJwt<3rBK~gdvmVMUKxfLOhXTjG zD50#sHM#%wlv&wLj}%#p4#Bv93G@yduHzfx$scPEIm_MenYztzu_;i@^}l zy&@pwjDZCbJWr=v(9zk6wzhT_i>JD(=smSl_Fx}7J39>eH8#dENDQp5UIw7f&Wb4H zk8pH!fb3xwN4Xp`v6$^<+yr&pP+IJsXmoHqGcSMvYjd$%;3Y>n?C&39;G`+mfb798 zGqAGReJ;CzoHDoA&akVK3x4p9JZVWTowkF(Y<28M1n_HR*g@qP|OPdGI%Y37=zcwChLEc>7)P_x2-a6 z0t>jZcq|jhIfF3ls-T;XQDc}zMkmm_G*PCJk~%aq6AZyw8^s*aa~?C_Tdv&wP4F_+ zq{;ZaaZ}T^B)}>%R@e+xPvD(CptCyxS1j&s%A!vYCZzzD=#WvLk^dn9T*l6-_Lb=r zy=YL@m0bf&RT!XEz`&~l_np{z(-g8A@$16A@-|NPQcTxnW!stc$SeoC_>|pS`z~ut zvbrYgx??Y_>=xhKn>yPGZ!DT}>USP}LDwax1}+0Dh|gG0%HRMs4dQNHYB^f?w>s7S z6|rMhI+=E2jTu)0uom`D@vA@D19~R-^Ue7J{{A0qS1T<3&Wo-12cHZ9uzoWDU}@Xg zwV(kXztW6<^5eblJ9tG|34mqX6nvvm1~LO!pYJZK-zQxFE2NEs02U=cOt7E^SJj3K zJg|Lyj=%L=8*H$neyBKKxYfc;ui#I%c!9t5e{C4hG34ZMdC8hw|M$=Jv;VUDL*@Uu z-`>RIEs3fU{0SZo_1`*D?e{f~NljlCAkV1O)@I@JBfKo(1&S_a#M}#Qk&tJtf@7F) zQgt?!7<7N>>TFV{q~Ue(z{9Ze%j>d;`*~$m*-f=|UX4%H+7BVgMZM}aWEnHV8isUJ=|FeZn`)ePyYoNh*zkV1?Zci`|V>&Lo6sTK zky}n;AGBN?;e3AunadoehI%kWV%0s}c>3NWeDklrg{kSQxN_wh`uh6OfK$Bl_5&== zKgIUu8rIiVu)eyCWV{J&9Rv8=Kl`8Jhd%Z>G{uw5z?Va67Ces)no5G#DFQC1(3yEX`3j|=TE-?d(-0-Z+jnP!0HlV{GM}{P@iK670 z!|=uVB@1+qj*c*ZMeVSpb9nUR2@dneEU-@e z!UlE+rnV3;k6VWX>k|TC(YI%37swt`Kb$jTjsQp+GsLVT1{p<~B&Hp`PyIuBX~c#* zIy&NrgeRwGIL;k2$Tc=P#xAm*9Ua{6B#=*Tv&$}n934Hwh^5+*EnOnt*o?DOEAkB~(F#+2JO-g$W&lYA zstoXCOp^t_xRs0>x3~|gJF$*hu?Yfb3fSb{cG~ra5*CBuEz-VgQTa~omtCQ(o|j2m ztcqC&Wjzd9b(ejmpqbcSb&*u2kE4BM?4+9I$iI8lbq(Q zUm*>wur0QEDO9}IKOi*uYUhz>+2pxJujy|m6F0vv+-_lzD){p^|HV28z#@V1Klr{NY>2c(_&qfjgAS zKx-2|FqUF>!J)QT#b){W|JMPqd`3WCBLFK52>R4-u3?*8A0u|~VE|UJAOr|~W3Gq? zYb9o(Ws;2;Y-_@&uca~85nb+o{UC>5WmiDmfVsy#Z>;{x=eqEdcgjJ>*Op88d%wG7 zZeaWam_*xu|L+c9q`f@XN=&fyFEUSy8BoQo&_itrxd7DV> ze{)zV(|yuSy=q{2u88hx{QvXzCQ!C!Rhi(vaqo>g$2`7y$Rsn#Odv^y6cmAEOrQ~& z8kNC;rpwjs(q3w-ORKE5#O`Xltm?9=#i13j3sC4PY;h>4UWkY&Qx4?#US_^AUd(al zd*cofUEkhkpL71<4)L%n){4v*_x}GG_L=ti&bPm#8yNwF)RQ!|41xcCHPvV5k?G|f zthme;{*oY@4L5gjo*Fgai`RM`Mjdy1DB>@HkzI+~{DjTvuT24gc2fu2MrL!Vp=b;M z7`-4H(r1A#2ihsyMJET*Xfc2k>VsSVjQ){3wwKvNH!MhBZ!}au%MXncvzS{5O;{0I z*%(r6t@D#vH%xeo4Vf|FIIQcU{gT6uB+Mt@uTiqKLo>+^on4)ymH8Q3m?_cL+Ese; zsf)C-dXkQxI7Radi*(p)(L>+*dkzh}a`_orzp>72ooptCEOoUUBC$hQFQRjO30H~0p)Idcmfm`?|NqT|O;)7^L7L(pVW0PEWItJLiYyB{|X z!Y*JifjtAQCg@;6rwHIvsWe4kUICP-RqOou(&7STvbYIwf^OWn&Nu9VodZ@^tJS8- zOpbw@#idnRUS1Ipj0K_1IJAB3klO7gwVHL>0f<#^@lB1ha|;ZPKolRqNu{z&ySqEo zY$1fLO-TrnL(Cm4zFwcYy{@$8M1t*=$!1Mh0HQ!$zY}f>ga#TupXB<&ep6F(3}U6z zS!Ol0+jVNS>eOh|C^?a$Lb1gC2!Ip-Ezv!5H*;Dhg#kqbClgU~*7Y))UQ?xMW}6-K zdQ`1e_!l;V-qhyS4qd&vMi(wV&A0!h(isuB?sXa9K^o{p0F&@N#QCAswX`%xXU?9W z=RWs2bjNLX(yixjrDLlnSZp05V87F*D_5`36BnLh9jwir9Ud=?MaZ>{2A~n94D1YM zTr!QD;t)<*q4s{4g|{==9OZI3f+m!PK;n`CeXm%QJx8mJw#V;2)$4T*^PHWXqxrcx zT3%e@HbEO*zI>S;d;BqG-0hZYluTzSHJRgZ#X_M#Q&UBnpP!?Z#W^bPY|!@Rb;@Q^ zl$%b&zi+G~vP+*9@>)(R6QUsklDB^4wo}Sc0C$ z@WXO1v!kMzFF7woEk_CS=e^S0k#qf5IYR{pA6a`Z3Wx){j; zx6!@xqwBO)8*nQj5i_uUHim)q+TU6Wh7blEE20lSFi&s11J~L{fByHsuFyxnRyAm( zes5Y4lkk7OmhhKfJ2&usydeNqJfjHT4+F5a>v9WA^d~`I_-~KJ>W1mFpMR=JzxJQX z-VK9}b%5demOG2|ORt@cWo!ZXdfji|pj{(=Kd8we5dWzkTBdXJB97_*{Od1Q=p$dP z%12(`1Xu_5R`}=hPqpZ$KD#{#uZuiC&PIHY?c(d>p4Kg|doH-$)z4#xtPXO2P)BB` zQ6=!cA2~0?JuqMk=zTok3DZ<@-x_B+GV8@-6J`rF*1RUQHR%UToQS_5Y6}=Kg{5A94;NJBelt0vSbbh~gWuIPk8X8zW1Ih?<=xujqDtexMNr_Kjf(fa1b8`yC!q{-8m*euHMyeL68;qS->43TdKt zWrwzR%Cvgy6s;UP#bWE7c7-1L*5A^FCmy0JS1!?w8ymE~xlNOkIhvhYrgy*R{q)_h zcnu3}@9eD8v(G-s0M?bOSE<%)Q@hin#pM-dcop+`%0Q#4Pn^eHcRrs=r8!DZrs(oz zhoG@(#B1+FY`VEV6aWJPcqdPxFc0(8PV_~9_BWRm*b9(6hZ23vf?Bmk^KnxIa% z&o}!`c6J!Nf-Y7M+Fd|1d4qnyfEt$-;egz=Cj`Kv1nrdpVD%`S&M*)O zFtdMv+Z#I!j&(b2>UTSA`(mNM+FkhRf~D2zvQ`;DOaP;WT#n}F=V_`~T7FUkLh?NcZ}#;XbCWDrY3#rO_N17JD%dV3He;`;`~vCEIlDLlU_NU8If`CB#K z!tSG-PFi}8*w@>4>0F{;;Cp$-qB|~6!z|+3*!j`jW~)=De;A`orSPhzJ?mXEpkaiu>Lnvb(p6j&$ZuxL5EK@&e3;*ClS7GgD2H^DF zlE}aH9e2~OO;@_67k(<8G;!xYdpO2tb4z?Uk3oB3F=>!iIH;_{wje|6H|WdgX!4tg z-+I#>g8-}>bZOU2XhihkH!U!z6aM+qGcEe5{{ZpGxSs^Q`vrwq0PA%hi2_(^!?SZ~ z`t%R4#A1j4;){Fq@o&`4ptD^$k~xMNbf;c@D;A&V&vyo3$)Xh3Uc&$^u+@I)FLooS zE{lblYg&=+cb(4BZ@pt7w*DXfPkZ!AFi#SHv14fNn*tPCB znp4sIY}?o{Q7!)v7H>=yZ3vHV*Rd=&tZxmmPvomX1K9K&`+RsU3?}5cIH9e$R3-|P zxO{_KckN$3faT>CD*v#a5KY%F#~6KRtagZB2LqoDog3)hA=Zocm!DI;$|~;IRgv9fcnj8MfgivT>7J1O;qj ztto(Jd@`=#V+O>sn=HwgSp-J=$c8*Bh$ats1q@v+&tX=<%_2hR!1}>k04VT(2C%ri z#=Qd5i1R$4+(C<`l0BNs9MDp6k}}kxeyc*MKE$q*bn?_WI(GaFrP7nssBY22-})*& zbK%>xwswuKudUPdwGB#5W@vhLnSStxeuQ4}%GXh|wNE?SH|W_*Ptmoj&(PKD*QwLP zEs7Jgw7g1lv$N)kdxVOm>DcN?y8ZUMs8pPx)MSdTUIjRIojTop-taR})bCRhx7AHd z&}4d&PM$o;0^}0bDYowJcc@;gvAqD4fYAgkB>+!gPeA}3A!g8WLU`WEQ)elI5WOVC z-c<+ClTF}FE=D!Ll^$(w0>G-#oMC;TT>UN>Jr%0g%B-^lW*#$Jj9wQ6=fT`56^jg9 zsSb`EQ3nSc+6GoxwN_=VFof$>tN6P~sZ@seqQZWM!}Fjc*6qk)HQE~a<+2h+$J%B_ z=Sudmhs@3bXv11zhLMBM0k8q!K)4|EpSqoW0ayVZG02kOn*r04StFL7rDST75)%lC zOmJ8pfGD&DLLULfAuO>{DHC+vvzasxF4%TvW|rn==4pOmfkpZOb|AbjoykzW)nt$i zZHxBiu?1bIUXNPM2Gy%IF5iB)M-!}RKEnOXJJQ%}<0eEG`^qORZAq5{H8=N4&xeo?|q zOGTQQnW2UGY1(g;sb1OPTL~v73v}+byJ&IsG*NDvs+6JaPJ(Kbk=p_}d>U=mr#{+9 zR|~M;gwVv}LzpcxPE~~82e5qbM`i|t7MQt&=L4gqr9$K31&`nJrgS%(2K`Jo^%@W+ z3}Bf=bl&5BAG5#r!7D9`%+-OM?HtYZ<>6=mI%Pib;|^SLj3{sA^8voV%&7pJn|CEO z7ha<@wq|0AUD2zz+z zmOksR8XBtU_Z91{cz%O@SM?|Zxr>(+T!Z5zX1q&G(2PdBo^2flu%wXA{j#0ITHP2q z+zO$hjDrLOU6+^y{f}ZnsuAyaUk?MYF7FBz7eBZG@G~D+rMZ0c7QKJ`7rXSi$C|N# z%e!7sq@R8DOr$`u0G8=NKmE!X`hj~(k$1jwsZIYK>uwEe2lpDv`nexlrEDtd*8i6V zu-2+QdfOlPBIqG!Da1JV`B%@-d+rI|oQRsi1|RzLXzejP`;O-o>7TqVsz1iS)WIYHldNWQhjq44e^wl95X90?tU%3>4BuCXszYjB~hSkTP*WHTi z=N-23QCi7rSB`7aBR@BwG~thrG(h}9cnQVetl{}#Q1Oj##_btgh1_3pLv2jLs+VoB z;^Ug(-qn2pu*|_9_X-6!B7HM(H+D!HLoK2?NBssV?5JMlzvm_rVfCmsM|?lGn+&sw zKs8)Qo#s5uGG-HC8cR05Vc=ED=dT;cM?>5Ep{twiz{#>7H67D8wFGJ^f0k0q$c9S5 zCB-Ln18BwBy;FPfZF{zgbmFx7%><-=_T8bM6su5W|-5f z$4_yH9t)!Dkh6fL7*GH#32Up>D$Lx0=yx^)W>kXNK8<>X`rS6))W^+m2!IDnCy4@K zHXHz>9+*xNde>vkrVjtzLRe$FB{v>&h~qw0t990Tg3ePq1+jSOOSMFYtJ~*xhrU)S zEr1e_Db0sc=KyX^rYH^2D>1?PS72aeb6ExzaSI>-Ko-185OvKB ziWsW^#1J;f<=gMD-M}D(NIU~jtv0j601KgvU`_$11%nGf)UDdpeFl(iVSb*jUAsaLKlC6y`}EUv<@y>;&Cc_M1NlOU3dJH7 zOC=WkU!0q!Zo5wHMui%+GW97%XK%fOmR3(vvN%VzM4ooKNvbAtLIf}xUl5yTZ6#F1 zj7R(pY@8W+W-jmna-Pub*q0DQom(7j)!cS!fO-W|xX(P zfaOj08jkMIQ^7S}%NktOrC6agMgbw6^L*W?I0lx{&`SLOnSP?gWb$ zOwzfH(hjyP!NUWYZ;cjKWCeFCmP!e@Lw0|?AAVS^Ypu4Czdz8GLM>}O3|n5mFL;{| zkIAcbPy+Sa~i2qoO0otV%z2C!Zg2VmWx9cW2~ z>Ib|1#}BR2LP&E9cKCshZ_txlTBfL{72|u+PrYJ>-uI#?7$yLgtDieLl~jgmVAbW+ zEiS)746I-OVwpbn4LPy0vzGmL)PY`|nxH@bv11VddxUMi>^HBwWCE{7`^m4rWu9Jt zTa< z&4-UsULL$M`)S#AIWUjL8)0<68^<+__646;#p{PCmH5$ zMCb3YCo^&;juP2*7glkEADck%W8(mMfpJkhgA_w`3z9cXhMJz~bI)L+lI$ z7H(h;_0p}AE01pKoDPdCvur%Xkw#s?M&S^gKx^u0yz_6_(v0xoaU+hcn-mDNoBFUO zmfd(w$hGXq6YL6Q)oWNM z>af?Kul?;`(Z<@d+>VK4ni)A0sSIUuQ}nzSyo64kc@8tMc6T@E+LdQ$ZS69xt=}M; z0B8a2ryR3(kT(D_XfT~Taf)uef$&5E?boC3KJ>Aw^q&<%7;Hir(X90bz@`QZx+64?!Kp@r^_Kt`AsiBVSzun_ znSE$VAxx5ist#4_b=LEOZWO>CfH44>kS6*QKq}nAm&Xly9SP?{SRz0nu(9|iMRP+P zte4Fq)GlMdZRx9eOC5kG){O#NF^QW5CBzi0J3I%#r`2pxqX`CFQf`6t=5&0PnS_Q^ zpPKa=HJf#6Hycze<|&uWQJqE8aho6jB;5L#=QO~K%ohqA0xIEP0NEzEtkcuelu1tt zFn1^+c87+o)BzCK?XzfnVnTo^fQcB2uoHd}df4mkv+fxKi3#Gc(wW&gzEKe@x9y!B zYPa^OSe#;Db#Z>4#riK_dWJ4uc#59Aa+OLmbCfHT2(&T?#sk0tfVwz8ONYHSb=wWv z-QM7v3eTLsm6lhJ)8zCb)srRK>87bR0SOeefYJ71pv~yfajz0qn1X}4+2{Ge+%(AJ zfQJD3mIq*&Nmr%~w_;&l(fJ{~^y=IyIcq4PTYnsY?#6^XtA`ZOk#cL6T@zyceiud- z^kc(1PO_fq`UnP|VlIxorE8x5f2T>PTp*p_WleVLzS~#%E0vk=z31W?WI>>c=VJr< zs9)pOED7Ta0*AV8%KW0NUR_MxHbB;I-<^#(CI+BXAWgwEp6C7Bjy*rcF|af>*H>g+ zh=vU6x~IUO@h0s0FDV#r*Mk0@*JJ=J&YPLS3}8LNPuOM|=JyR@mAJk>(sQ+^jMk8T z8RM*blb`vH{{wgAV>PfWfE5BM|Ccw$I%^ zmiN}VxitOp`Ji6XtMv(i7w`cg%yH_*xvG*)R(tF=0HtAu6(Zv~ilm=GA4HC6*l#NYJ>!MM)khL#rT_usup_nyFsNATyhzkP$&YbLD`-3rXAKYssGtT_8O zuIMmWUCop13zS+)lGe#aSFKgEkMvO~spsmfr z#y^hQKPE9REq`;Q>=V2Z1+nC%!E<+X{nDIc+bQ&+m0BPo3t)w&c1};3I_7F^gLjyD z)AYE2u)AiY40*GG@K2m&(hZXKLk184!_+8LRcw-MuQa;>5r=p0Xcz~F?F8m`VQ~f7 zpBlOlBajhZH3VeJMqa`S z`6etdUCf3FzzKie?+f@~nOPH7V+)%Do^$JMtm}k6 z3IGc?7iu2>*a%<+-!CjI)5_{`$&&#ZGXR)T1aWcP;tc=`45cK48e5y2w6iTCgs=x# zTwq`cfCXPRusxF@9q7~YJ-|eOBh5yQ>dZhZQ>WEn_Ej2Rp4snZ;saQE0Ak02 zov>qs#6waYI-k0^$c?Dj_1e=-;&%P`M~I ze!~1G{BHw6Ie)`;8NK7%#;-}-WdN+;4C_0dUSBm8AGAHt zQ#6;>AlKU~pf1&8Z>U2HfpxY9XIrJ@0?J7AeEv52P+X@!eDOV=s-e$KLyiO?pr@ ztj0+7uGLBU_gLa!LY&%81~+tqBUF3%T;jW6V>W^1T|K-EA0`Y((_b*g;4>D^+5-{5G~>0fr^y z&(8s1B@i-UHWB8eIefqn2Cx|DF{~Xu;+2i89}=P9mYz5}drLVK$dQ>h{>KBa)X>HO z#-9LTI3*P(4kg0&Gz>AB-Ob5=8~|waNR&OMc6X=t{*91=+%b5-r^C{UqFtp|pu63K z+6CiLHQTDomsbw6J`Va>aQn zS8BAkyGh$y>$JPGPTM=X3^pK7fIKX2o`gnKmO~Ry96!knEQIzQ9QNqy)yuSD04$Ur z>>Un4o0_4y`9)e-SRsP$RiFzR@$W-`iibx33+>!z01G1SwOWn)9d0e01Aw)3jFKrm zjFrB|xR$kuQp-!hoPy;zQ01$ORJG&Ly-K#Ler{1X3 zUZuhsSLpWuk!ELRC8U*apyM1RU$AgEBrnO~czuMLahRR}Jq%!Vx(ql$KMHIh2-I_0 zW*h@7;&4lZ(t)LCG}{1xfzdQoDoVcruw`z*glz%h@Xd)Dk_Z;r;Q`;=*Jy!B)-*RI zBHs-ED%lY22tX3RmgrWsSi1_peA{9sW9ln?9(_0s241hvpcvRutkcC|l~QH^RLs&! zrP*%Kz(N^OX6SOE?$F~xe@dkU$jf9VS?nL_!MfAaQ&cGA7&HV!4ZsxJEt}&IJ^)gi zTieubcUYi(Zf=opt^{*zXM2OLUb#$H*KV+Ae5Zdv^=6B~rqa|jEiJFmspG4ZNl(zk zVUI39`!wy9%XIS8DOy=srNY87YEI75b}vh1DsW$7Je&K80iU_=3Oj{wBDCXKKm#kr zZIA$6WB4{vJZrpPxm8a9Z!`+CyV#DHn=rQlw6+vO=MU+eWWQ9+V>!4`@Yo+?oQ%Jy zdke38?5{%RMn4sr4?)6_wS#rQ%$gPlVEKNLv7M&DbEa9;WR()#zrX|$6K-fBu+YAl zXLHMljq#nm`P?zDyj9!G%K=*jJg{JzlAk*;vK~o57t8b)uU2-AGGV{6u9`{Fsu;++ z=fJUG-ikk2z)^RsW=)eh${kv{DVG;Mv9e?wD~Rr?001BWNklP_KiZn6*D`*xGV`Tf1S56{sLIQ?x?qmBb9@^~NxYN(m^?G!Vzh6tqUpVGxF!rrrim1JPjgDnx6B_cy%obrw^@X+C9 zz8tV*#o>j#=nk#x=mtM(t%8fcNq<-(qn4C`-7O~3;nP!mWuw!7%yYx7pr>)x+(T^c zgEjF5GP6i1jaUGSpV11qF%+MD*w9g9y>NA(UUf8^B&jMS_>CW=dC<;Q|B|9J&h{sWGf&i?+S6tY-b`H3*Gqmz0HaG`YV|-ruYpL z0;mi&(}Lb!&o5UnZMTvd`|1G~myLyRywz5jc@lc5p@zCqv`h`%_~A{%0+i>?LAYUI zu|+I^C5@Fi>`*CvNIB|KvfH3*&pb}w{K^-pzI%guoesV89q*#=d+Ybn{Ol|pbZYd_ z*S|vBH!icVIX3p4UY~Ns5>3sl&>eT)ODo6EQMpp5a(RpPb~YKv;#=k*F3-RjZeyFE z$xMbBUI3+5R*uoBQ)eih0<)(_Yin0&YinHuuMJR`&lhQ7afxQ8=lKRf2+T`=(+($N zi*3k^6rptBmcSioVD0WuwNhaK2LRUW{1PoLu23=s4J$yaVP>K9^;EDlpFgjC6Zw$0YbR48BQNTvh-bu#Zf+A$f#< zYe*=D8~`kUK_cwlVrCU=0R1n$RSsI76%`J;yQ~^{4aKzePM*E9zM>Mme zKMjC&m&@mb-GTnoLH=Fow}$bNFg6fC=78B#xZ%(-mF%obNe!D!YuRwaW0K1XV5^YN zQ6`NtCz+L%E99B!1h8ytdz!EFm> z*z)Qsoj7rlPM02cM>`jtymF7MIu(h@B#Em3Ll1T`{qv~!TB-NS<16gk1Lu@Twl z))7D*?H>T8&?gMbR4<#*LlFQKIuCk>1F)rBEP>*K;e`-m(J|9JbdFM1j7(N4jAzy* zyOtRcOL<;)jQOEvZY}dyTAg#<|KnD2H?Qd$BmLCO*XX~2CCSaFZoIn(L|2hlVX2m3 z6a}yOvc1tOP!L1WYT5&k*fMzYjmKv8S#AEh9d+S?d2$vWc%?mC*HX(~He*S?7jMcP z*a)N6t-oHb#_8zG=KAw6JphAdgggOEb)B~o1PiF8iFl#GHH9jmIbh)(3NWw zpZ4x|ol(B9shNFctmpl0B zV>?^`;vC&iB2Vb7JhbNKtw{BQANZ{~up|S%@F(U`eO;b)dHbdC$CpjVnRN)T5Y9E4 z>PYL3d?3DN!^O7M_Az}gGB=FwpJvSo6=d{#!54-BSVqv-yl~W%1LG!QE^i#&q^)CH zU?6L4^!dSH0P8!cxj(uGjRu$gk@4D*wi_cfIXHDk3mMw0-?q+TGr!w|(E+=*hD+S zv4_4!*DpWGT0t8-+qAy9O$*D*bo|tF=;h!2TDs--=ToK9ph|h0c6Yb<|K)O-y0|fq z_sbKaPnFHFm^*~n7nfFObrs=!5bo~M`ucU+-r8Uhceyza`bE?H41k7A7B|ZI09MHN zvA0b2Sf{F1t#J4tZukSxg1igG87fW9(!n9Xj2?qk`rD}2%sUmn^$+0H?%odVfO)mI z%U~63m&<1vm;x9F#!hk@5H*y!1}rJGJD6Db0b{G(0{aU$ zNtzHja}y$fXMi!RB~};hF9tLr_-+7y=xBk31z-)pAJ|>6sW8I;WKB{oo1sEB%lRS% z5bc3*Rz^#{J)~^6SBXgS{#-}kG5_T+hmNnHo z5(+IK{tCzIBnFT5=jB_C`Lb?=P1vkIk*aHcG9SyKRMdsi^nw7EuJk4i^P*H;*01oI z#r{cvO=eOwpKI|V{ug`za}%WPm&T^DPMQ^)*~8kmyu+gqfW`0J^{d}@esEl^O=;pz zx5jZpfAgn~N6h`c5P&5P zn3*J?fi(tzWuNwTOkeoWN<;(e@r^FM`wxBnu0gHuPb5UQFQ(~_-W$~e``OR!(w{$p zTbkTYcz+b_gNHPeOVXeG@G>C`H2m|>T89vtXbywDZZo8l4erFDZ-NfAl+`(T+ON$t z6RK6PjzPpFZlr0tgGOPnKJru;lCtFryzUAzY>o*RH@u;@b3-JN zqqKE=2_v-~SWq)5$C+nXG2F34ykY$lEc--cHXP9?N3nw>WyPh(9uwm{81Ad_{e4hr z15QCCyHR~SrhKD@mOZHozB`RZ_pS8pZs4=mMH2+o2IFwqG?!c-;P#CJyhRgE{! z3}8W!JbY5^hvxZXz}LqL0$A}=ssmv~B$!=g$27Cfz0ChD3_#WZw5TM&5eEj~LR0_7Q{-=BP*0lL=axEzse9jkeb=(b}a8borTQ z=(VqT4ZZ4nznAja40T%-y7<_G^vqM=rl+5|NKagNnjU}Z0-d?#R=Vr%7ttFYcpE+c zp8J@wQYr7y-p&S9E4!=(1<`G=uo4J2OG0=XfI^XP6NE53KrCj)boUv+!YzgXpM*@5 zWT0#H*a^zzi!9)-0G3wTZ*pcW^|}m(;TNLr07Ag@!EJsB^+R5&Syic&>GI{vbp85u z7J(NatIj%32m^!=IKl@3exYp;nwBr-SyKvQ1EGD;xoR|9ul*w02(ofAvY1q4Vd~&UzkqyIs;b_N>4Hnmu6ip*4&zua7zJUqz9qg zC?nbmz#QtJKp5YI2;p&aVO%gg;*jdAAD>>;LOUukt5TgbpNW<8cRkecafh%&dtcL^3g;H!oKECW>8U8`AqxxRAJK?u!eiu+MNcm1(?ff`;X4DVeK=sUoy9B`a5W4 z{)tV^8hh7=JpfCJ9p@LANhaQ5R7Wk)cTFn3Gd?)s05%$M9sINhzHi$ybWM*}6$Y?k zG^gI-GqAi?^sNA$s9$+QG{kMMbwL01$2SQ7f7kPi^wTk+Yr?>CI!kK7Uwvadfc4hj z-=J${x#1#?+BnPxM+2~=wT1&&D*xz##KtgR_-~>B)}K7uq+k4ty=W05T`D*b&d#Oi zvmb~Du>RtSpw?J8@o0}cq?eq`(C@r+F>Q} zX$lrLuQIB~&uqYxTJeyx5a}1Qv5wa4YSz- z>mO+dp}*K@FA*T6L-ksj>a~got^lwAK(bHGHbV5;w6nX%p=1EBa8n^Oiui`c9d`$R)Y03-%nvN_hmVr@Av?+mEKLhQJe4+8N< z_?>T0H2R@(AppQO0Z#!uRcbY=RI41ii1q^L1u#x-9u)EQ6w;WGkU_m*fJZumSV#w- z1B~r+oxy_AaiThIlc}_=W2@O@{Vf2RNVnc>P`v@W*ID4+hRk_4h6;00#upe^2%XHE z8yQ*W552>LSR!rMjPo|&Vxdr^Y#xI47|U{NB)Bw4FP8(bnqx-Q=H?aym=Jvj@P%79 z+xtB#PEFJ5@)DgqwoI$b3-sh;-=-^NYtS&fNZ|j4N-E zl%ypcbK$5=op#AGYp?!o3drl1DWb)`R9Dh^2)eR4C&Bk#EO9J!gP@K7R`ACI6#Y5R z&ifYJ40=55N5t68Ez8b+>QiVNbI7jOhk}PR-g<6q8Cl`Y2Wp$dQ2;D1L>w#VD9*Cy z&;(ru?QA2w=_Bt>B*T#amN87&jWvCoe*G=;^op3Uv@cv}(J%bjo(Un0YA?Of09byl z@b6!^e}=yQ?&vLtANb@pJ+h9FKQ}3i+FxiReGN>_)?)(zEZgROcXl0ND1haQFp$O%3Y9##V~8r5)t*W6^}e|)4Q{1;=27&~+aTIpzC3@&HfW;28jcl(h9;aW$8B6UsAX9(C=hr(jm)?|7j#U15 z3&!`gXlaZ?AVokT#VFpR!d<=$)bVn~kRyHxRlP*GZL~6=H3<_e^M!*#yM_xrZinMcT&e4m!_y zpRq%(VJAj3-G%&_v7~Gzj~%X|bWwJnOFU3l(@!KnEw#CM$`sM`CIc$zUnV3l(yPNK z!{G-!A$Bdl-biQ|5nOLw!wen3?)bNeU)d5fa@@ny?KE(0PYH`k7v}&if$% z3g(nwLTU`)Wi+jX$>43^jI+xp<;vh|Jt~*CsZ!adRFz;XctYinzbZ!yGea?p}WPNex6+(4Mk6*y$<@X)lE*^s)8zUW@{`?wwM3Tqjm z3}8rs0flma-GgwyoxNS!+}fh8t!)ldgN=?KKSr~2vkcgv+yHb0z#`Ue0(&Tz%P@cf zh8Ea4(5qs`l@|)i02UZWd>fvGtN{qw?+7S|5HbKm(0gJQ6vXN~T_bLv;ad~|LLux8 zfEmh^%VrsjQjiD?u9=w`={IIf;T?c%_& z(V!YLj#{F9#i7Jgx_9G-)?I%{U3Jm||t zL>}z2W~0GC1Imx^Km5B=#SM>OzBM>(uhD86;dvPk2-{}n8S7+;s60TYndxc%Wp)^| z&LmV5wt{_8_GYui>4TBh?;|&1%i(5B^fNpUy)2|B!tpIG3)=eh*|U_%7HGFpmo_}; z)A=(e`S<#jXX(b;RjTamQf@LuCvLfeCKk@netwDesK{WT-u@|igQ8a@w~QLyJ0rHP zfD;2yOg}U$iJ2(*dlOQs02Vam4UlgB z9R$NeA%x28jN7z?(5T=V-8 z+vQ9|{^O(q{PbDy-_u?*mrVE|mh~ya5{+ik=bv?f1{ocb^%of2Fzp z&fnGOUwzr>U`4y<=#AmXemC-gxIy8~5<^%P;`AP2s0D7R@?nIVDr6{Qw;2eQ-c5J| z=Zlys1WP1kjVtB2)sL;=&}zq}>`mZ<%B*RIUylG-_V)O2laz-EPvFA$$x&#h0d0F{PM)js&U=GU!%iqV24;tG1+DG+B`Z!qMy8Ib)W8M z0L#sj!j_T0eW%#orsOC@MkLicV)wN-y!pT$K$#+Ny>(Y(`jG>bj0Te4xnxh&O-KT# zfzTK4z)>AuF1N|Vvk{BE>MePmQ7wQH0I)P%#XIHIBu$xJeL^=H+LLOvpJ`36@$pYJ zjTSMk*GU`1_eaNqiwP02;Yh;HaA1&zNGfAXHzdN+lKvxL5{CpCkO_u%Ae3wfct6Oj z5XbEI!CnPBc>@a2!T^ZuyDKA$H>{9ASG^Z$JK1nJogq74dwQc1_9%kck{$xc9Mdav z(4su;(_(Rw?l^OdPAtyQLNP<@moCt^A9k4o7(|lhe@!C4*Cp)wGisZV2_67Ngn`c17HLUD})dNbVCRw7(4*s@HzhO8C@r| z4fakO^8|r9#m#{mix)p{Yr<`5_(jdeqs6 z?VH@{kQ@i_qoJ#ML!E}NB79HvuTXFF6Wkt&@Vzub6`_MQiIB*&4R>Xb1)5mNl+ksP z@r*GE8$yo?;1rh$A+kN_ZgmOFD+u9>Ru_OIgc=@DwN_)GsnhK;BW!Q4Obvj9?Upbo z4S)q^8h|F)2Ebmikmp|$CCThM4%O^-8K?t@2!`DLewSHS06+yuOv;Uhl%QT$*lo;~ zG%UVyd6y|j=Wn@%N;C7+?)0fzYf+`VOXtp2D*2fi z->h3lr_4hln&J z>EQbd z)8c*VjcK_YfF5>;{Ng6={_wX$#kWg*s8Z2dI2v6@c!TS0W3dRG0^8fxE#^I`je3WR{TI74q(OHLKyBFrpNjiFa|m)J8rqs8wz29|5Qeb>0AgXeN8xv;1erE##=FI9Sx!RAaJr zH65J(&9;v}=A!$N;OT=kmz~kaw~<|6kfH970-0;z$ncts*Ak()L~qRvq&{9^0}2$= z7W$EKM8;vi4X&-1ez@D3mtvNOh%?}p%wc`UtW<-VGyH0t-9q6`_Rmn7_Eo#shgd4M ze?&<`;(!bu?gOU1u}tiz8tAJ7-(vFA>Hq*B07*naRF3ARKH4a@(^1B1ghdk=q(`3* zye=9jhT7IId$@o3e}~hteLbc~j#YEC5fK2eJZ*@`YO7%(>X7^FEcOl!q~oI1tP?D4 z9b_WeCBQq0*OO97OT}unH|pA<{+FBBc+S*YtT}gi;@{%zifFo-?alvn1ECHz z10sR%f&)x9JN$h3rb8)=J83ot$o|SV{){el^Z`X4y5`0`-DLReKqY*Qu}K8Cya17Gp7u&Y=x?MDaLo3_x`E>$GE{xJZvb^(@`<;+N4YUhzu$o>#n* zZoB=tEZSbL?NO^$qecTl=yksBZok`QVexFXNXtvdm{Bz|GtW9v2;t&zw{DvmSbKY$ z3`R^$q!?_-WeXf?2mmXa#Z7V&a)tUJd=IRz>({T+(@$TZjrAL}yNeLUZ7T2WaA+66 z7_hvGr6SGE&ohXH{MI+u>Bia(W)Yzca6=)ORt)rj9R-9zHvLxdC? zW*f$|9gir7+`PbG3%Z(UhY3SV&J_#@sO(q{uQlu|o&OA&&goiUNG3W3uQ-$x*_kOu z=WzwB)SJ-HEr6oy9)oTG#3cb?ZF!>U&N+{|xc1OM=W7GNOG@T;MqMXkoI4+6GC-V^ zTi)0CGz=_>9-+rl^42ar&k6%aLElKq;#^CAb&A`|1=mI!qUaqO`3GqM-NO(Ai)H84 zU+_%gaJZ=MmhS?i{e-3IgIq2l!M|iY>zc%%qFJB#z(avn3l6$Gm9-}Tv$r7#UEG$q z`@@gMwdfc=sGq9;cqqA8Pd}XeD7yBbvoJ562-`kP0az&6iJ27r-|vs!ymw){OYix=w$yv_K&&AJOc1@`*d+bl zyA~qt<^Zgi?N5T}_0JgwVCe~8w5>-1SjPPuqa)GTxio$D151%dfA({G^cQ{z;gH0h zw>n85efI)8DE?2Ydr1HMuPXFQ_k$K4{BE~-K;QqdP1^P}%El>gwDt=sPyIxM-|MCA^1Zr!(N3`yZxkk&U}#X+Mr@Eq_BAx8MXn zGuxw4?HS*gv6URy?wr-I{^M=I$I5S1U-gO?Nm`6JJO%IDz%kDe@(niEnEgL)gbtrS z-5XxW>o~7?NJqfr;dh4(k|WeAG7|^#8C2k)V-f9i(RK`v0bL(sm)WBZRUd$HsMyF< z#_7^gv&Y*c3{XWf54|RT20t7%1n9*hqTz$GIMMfD@q`s) zXA3{1!4}Fp7~`b;y1CE;N7ORkTaYX$y6!^$f|v71(ylCSGhhm$VH~co=FCpQ+pOM` zf@*361LSbZrf8z6Vm1ZlV^=L-70xUGHcZN79&=hQn?e5&QQ2e~GH3F$;S^3hm&>l; zp4}k2W@FnJoh&fgu+bOMb;*zG?}fPNW4Tt!5xR`A_f36z?#-gZ-Qes zhSpcFD>rqM4TrFL@WW+gAPgv*gs|Z_Ki6+idcQ)`$u6B*n4(jw3v}+pGHu_uLXQK$ zI(eE-96!PJYd6bu{qobayS>IbMb&zn%Jmkl96wDbPo1YTXK$ss`4tY&tJU|IebsDM znP~&&3pB7MC$p5#muO}AIL*y3QL#A1AP71JgFxLDZERd)0r*S?Y^@wKwsKkMP8FC* zg}lMc*{zgW%L=TW^^JAf+}xm@oh=4P=n&z0U`Mq%ED`m`t$+D^js?77LjVMOz+5&9 z#!`kw(6PS*NCMC)J(*=@5x^_sT3I$7$_kbhz$(_CN+ntF9U*h58vqpmQeb4|3k3!T z@hr5)kUj*_5h4iCk(pfmE{`>U9S8+QKStRB7H#kBFi?duO;1g+))PRSMytgF<^b7X zCxBNor4ki$Io7K}C?@iS))mSRTLI`peZkT~{iV+X6h_$Ofv_A852)AaGAIV&_o=BO zm5R`#>T%f-^2qG1%p}#DE!y3~Er1mc{lo2j=)MS1oJ>v7bg4+iLY8d~%`=GYi+Dfk zEMPPkSOOp)GP^Ag05q3n!FRCk&@Y?KHn$D>2QwgXt0J?t1Q>-aCbKz8XY!QFg>t?vL>ceU4dNx(?${cdYA&*keh`gffv$hjRy!V((Z0%aFG`S73xI z=6eyogXEb$Y@29`#_;2KsezZnPNmZAg8lZ50|2ad0l?bpc_nquTwGC>ib?w94=qwL z2CRy+(jWi}#{cY(EYoT!s@3$vpMnlnSCaEVhe5VU5dHkCr|BKfD@2O$KBRTSV;O}8 zz<)UaYw+|S46HE#tO1>9Dmy`c^h1kuY$|HYfBYZI^zXmjq@Q^C6n!uzWb^N??9&H7 zy%V{Wa72$ExtWQ5pUXd*Ip|#Q(WQtRN5RiLqeZZfL2WXiqYZf6O+31na1Xk@lRq`f zwcC2!a^xW|D{_Rw;(rnx(4Iy7HDI85-J;^!Vt6Sd8~Zq0`D;}mIqzXzx9qB-g^Wos zxL(9p(%NcBUowU>+q#jR&Mww*0M^L0K-+FuHiPGik%b$*(3m8mHXoRF$oJsIJf=I? zk34{8Sg#qomXQa?eKVN*VDKqM$kZ1A^{0?=2dn7^VybA*lCQP1$2~E6W{aEWY*D>7 z3m4gcW^i?aHXb&d$LZ10+9c>jt8Kdfbjxfug~?)vs{$hG+#7I9=Oej(Tfic3wl%Yc zvA2(JS;5>;pD=CXYfG>Winmm0n3!!c!?cNpeaML{=U^5E|8!Xd!gcm=PPCr3``RJ0 z`4=XWPAMWbtwQt~w&E?t%G|OeTyGyVl?lzMd_oL16N6&V7m5LLy&L(|atxE{ZC@T+ z3;>0sCrkp{F5ZSrb!AjPib)dYq`KShQP*sYQ4$u##&>4TvdlCE1?_3H@tuvah1Djx zJ0^kYS_(!PHi+tNY1tW+vKt&pml+uhT*!@vs_mt^Ib4_I1c$^S*IchoiTV~54;yrR zwm@f&FVSu1Ptnf$ReJpKC+O6vGYn#Zoz`mX(zVMMsMD%Yu~?wwB!ssoDOZ@Hd}*GF zQ;U?EEYV)2&J3(J7+B2;H5yF@uLQgS%V?UlujXbKIGhgP2MW)+MLmQNUS|eYE(5j} z7*_?Fm`HQmZ}05V+Kn5uwswQoHrA=uYSLb{LO0gesamN}x3kY64Q>iVAAwbRxQ!41 z7MMXSiY_5z05|~F;1}#VX$Jvf`PM$e+5u~8YHFIMr)OwtYKoaW7|#Ho07BIoEoLg= zXR27BQlY?_QD7=TWL(%>W^8z&V~u8;+8wacCYhnf?4MSXL+Ef*BI?Vx0HUpcH}X(D z;9CbvxVQ>-7;y2-5)T3!z)6 zSg)*0Xd?h=$REJfL^?}{6KTeP8`T;$t5v?CGoMXTA(y7P*&;0+KSfi=&QodS998-m zDz`h-K1k3$K&%7r#yO!?$=C<*#PgSaCUX1s&{#wItTvUd(+Ns&NTiuRC%`7_^Z2)Z zj{#>@S4}`H!LgM&r8gilsm<}yOMy+!G7d}u-e4dCZs;Jx6`mnJ&e#b)ps7HsU#0s zg`78GnXds2tic|zWkXppdsFs+)|YO8bTx}%9fS_*q>LVPWL{MbEQ^Z;KtWx9q+UK1 zMs6IHdN_d6)r(85eb{Jx+R}3WHl;!Ty!*qCMRwHwG9GYuBA&bVq-pCohcMz)`u;@x zUcl7GrKT~cgPU(y!xFvm_8k4w7zUOFu!h8{dQHs@`IhJA=oeoT6>N_y!5e?qgb>CU z=Eq-Fq7S?{s)P0QYaRMWpV={vV6b6Ls|T`LnM%^3yv zBm?URC+haZvO{ewkB3*_&?|0c56+oK?>Hmc zJG4zUCr6_=SdwVCFyhqz|MsIhUYl*4e%TT7_Z|(rWgIE3hdbFE%uO3KI(;i?@sDC7 zi+x1KuYLe0Z*ZL@&!9L~q-#0MS*mQ3lmDs1;#$?uZKz)`w3n+BDS3?Q)^WbZICDyz zWrnp?xL3zpR?8m$?Y%4QpazyY;MRnOiDO(_1x_@K%xxz8b4l%mCiKUUsS*hVrA)1K zIZ$xKG`)^Y8`5XQx}$x;%uW`Z(Lx&rmO*e_h=KNxAmi5cJIDHB+o}YIGOZZ=63r#) zYp!4GMnf1_GWLw0E5MX-l-UN}ro>UVWOL%)(c}dI)X+!SkjZSO|F;_)1>5-MFUO!_ zjUL0K!HWPN00`+Vf9#C2Rt?@0otXoaQ?CO&49>8+!4kj;%nq~3GvFZdQUFW;uOJob z=(KIjMvpg^dViqU!9S4V&6m-{(Hjr7M55JYEP(O=G@?Vw^=g!;Z_{+5O{bTp>GZJ$ zI(Kq~wwQtS1f4!}jzKJD1vPeQ?b_2+-dST-RkhZja-~iuPo1UH=blT)PC_SWg?9I9 zRIBaLej5N*l|$YjnvKml7+8hE6s@itr`g#>%4D)M!C_zKMz(`4H5+9HzrdpEbo*4R zHt5EUO?vjyB?hXtws1RKgX--TO{7zF07elrZF-=e2zWG^W&pjNxXY#)TQ z<(Z{rMAY|jL*YIHYv|jl2?;4hI3el=rci4Ly1I6qcFGlIOD)dL(Ye#7sAX7N(3tA8TTqZloz!}&`0Q)-oU23=X zsRhCKdXv{xfL{>b2iTg<;D*RF?e`9--R)DW)1!JDz*m#@n=R_L_o+E81_MeDTnx~!A=Hut#P`h^hYh<6tn z&SquuSj)N&D(8wpyU^t(f%Te~DCfNBcok-=KI!B|tY^dD=`#kv;*WgRlRG?6zsQD5 z>aybbrS^cwik&-)J64^Uw@uim^R)!%ll9K6uYwAOG&v1R&iM>tEqjajAE@Gq0C+C3byJ)_G67Uyb3_MOnW#>39Ikx!|H!?`kvBVI1Z8 zd47#^ZA1SunfN5{z`zMVKBQ2Q;uv3t0j$?WLkQpX@hxUx4R-CrrIsiE)mvxjzSD@a zAO7>e?{2aNmK_(K3l7E*Zp;gZy&=Vq{B4bX_wVaL5X+pX`WwPbDnY;bwt0Ht@hC8Z zbOgWxo68zm3TzzKHw*|Nd<|=0nQ}*}n4r&paA|}FmMv_&fjomVfc5?u2G*aIhldaz z68*qE1^T&HMRl*%s(pI<$G51yufvDv#B`EA{oW-igxGU%On>B$b_l@XSU)kH#ku8U z_M}k*E4XwFDb}cM;@|-|XoKdK4bxG^GRlyLyb0U&Jug&?KXgmfK-0vS)_vqQG~R6H zZF4+349XxTCfrXTxb=#wuU+cgm(gO4ZOv#gbweC(Q{B{gHFxHW;zvVE;2C*9SN4-0 zU72v12lvO(X$`iy_N&2Z9Ie!m28=tX3j16(HMIj0r(2NJ*wBp z$QwN8doE%yYtCevUoW7E4INQ4n*ckFt17NXjD+YsHP@#ZB&f(P+ z($&?4Jt&|dMbZvxO5r*Dw*M)(V;NuS47>3Vo<{|K^UqOTeL0K{KIw$qUgm7#gIuQf zFgr`yLxkhC%+8^gQ}NJzY3t>UdL4v%b-dB*umF}>vuyi^HWzj#1|ZdkR+aqlM%UBv zQ0AL!17jV&`O9oju<UbWd^X?EwEu4 zEQHSCivai%&}}Nvv12D`c5abFxr8ZoAWWGqZV9YXvmtDny>f*`)-PSTN*ABLD5BoY zhJ+h}RfSvr0Lnlx94sKi0)(B~oqfJ3Ps0Cl%!mT80rt>-8=-i8N~a{$Z>m(HLb1pU zB9sZtCj1S?)%3KmuXxi;31;RXWRJnCYMu5fHQI*&c)!Qs71&1zWdm>ppbdIf0I&cY zpo|2j8MmXbZNQ9zeGvkP@IHj-&CSiz!onhly`e4_FFsB6MxBNK1+!6pDHtztpl=X!^!8a(f$a{~=TCYLSe~UvaF>U}Jq7A^jgYH`YFhQ+O zm&&y!?bYg3tJJ82KGf+@9;~g*1f?bpDW6SKX>Ok8j-R9D)6bz^x=78#H0`zfROu4+ zk{Jukv(Az{2M`ZwM39!zg%8av_8&+N~E% z7?9sESY0@w%$SN#xj9{CK)aTD3yQ7=I&1SY5dcfsR|?FV3nmO2ui%vP7t8^VotX^? zq!X-h&BFc(Gt=w=i+9VcNk>`3K_ADY;`?_#TS?o6CwZj+X_nymeVlUSwV3=8!d(ryuo+>=w_l%j6KwG3BK1 zsSm07iuJ_KCSBW(p6`P9?*6sMJ-0UA9Sbe@Ht~Uu_E4{Hu(KCP*bkkHaY+Y%6u$uz z04pk*4gl-27eY8XD@lL3l%!Am;6elp3BNxKz{0aXfB!VS?XG-mwjcRwjehU%>w)k# ze|$}6C+OE6n4y=R8VsZXzFd2QQPrtMPN> zxGft$y&rkdjGJAwpZG+V@i?I3V`VJw>im0zS7N8A*kNzx%8_Y@rhD!MLzs%p zz&afSux#%!T}Xs&eaI)&&i1w=wL^&TXs!#i>>{rpX>pOdyIegC$QdzRV`ag9%!;HS zm|+V=hJ){{!~h}6^bt2WZf;YdVd=L~080QXUB?&-uuOUdsx)2ck%pLH-U+h4{0^a^ zUv_inv52KR2HICX(V26%u&8&VwnuB%F45B$9;b&N z{x&`Q$m8_TBTvvhxP|b0zL#Eg|Lf?vcizpS+m*^LH5yf#m^k2YHWA4_pk|}Z_u-v9 zd6wqpmKdx+Il$1V*Q->mlxh9O4O+jkMmN^iXnk{owzjvZ*>19p!J>hN5$is6IvmD{ z@IBZFfC$3o!05p(eb6of&{P08#lQ%_8oBK*l@xs~W?p5pG&3`8zzXOi$#bb>idjQ2 z9r`l>Cj5f!)a1~?CRJ(;2C#6G9d5zHt$+Zq0Q6MrH3mx14Zu>uO@3ftvBD8+#wD2z z1prNN@l#DC^gjSD%PT8XES6|(ZH>VsfIw5lBF#)sQ3YVq`a0jnhmbe`Mx9QZs?{=s ze*n&42mAuK1LFw&4ZsM1x!Jh|T3%jdO)!LV0#F0HjM-_Oj`Sz5?*R;Au&m#sh1pq} znJ)2-jJ<h44)X#y1*Z)3s@3b%lDPu)T%&fiY`bb;!JY1(Y`XuEYl-BiXfD-DYip?(HLV2wS) z?!;#Tgow5tvs=tP`aila{H=zee{0L%D&U{QVQ2NvkmtfSAW9S{=uTVHL2%;Gu| z>WdpC!#{uh>^}YYzu%2@rQ=72OEb>>9@;RGaGpV1J~!VDOfTa9o6-b!r6&DIL8F_8 zBiALSU_)zTH(A%=tN;KY07*naR6gMs<8uywDm^OPuLf;`qJ@j#c-|w1*x>bHkM}#o zFyXKG@1ceqJub9ZWA`#P`uORNJAb<8ByBCvKWt8sRdUSY4J%D}0lE1Sd;8?!!#eic z_&R^x&MI!8o5QDJ%%mWtBs6x1Rww#pjGHiK-*Jyg8iPwbd_IfM zE?BN;xnH!>qF2WNSbl0Mero4}0h5<9s(5?`XhH(yIAF)d6xwVAyov+Kf@PKsg8rJ& zH-8-qcP4(+SwS}^{t2uc!wGc`$V{1<01;CQ- zF>%nLe!EV^OpEid6FJ}ih4fJMX-ccJ_9tTHT{&vqo9y0?o}+uY16nQLQGx zjR{&=Jwe%Ak!tk@)v9Hx;J32Nz{19j4cgq?;?To-t48fki~5H>4mAYJ2*Txj10V~i zx0&&SI>H9HEwA4dh7^D%Xm6F6K{ZXYvvYjQpnwutN~ghwkuWXGN=i#;n}9vS3St%t z-{jb5=9e&os!W2W;VVgzg5oU>yLzXYoo9KF7>Y{#Nb_v~yT1~LM8q8wr^&ni|&l=M1n4jly3Y-?+iu3lebVSSW0l@#Q|6YdkgJ}zKuNb z8JKsi{T_8;vO}hHvKT$aP-aqu=utmrccJ|tBA)^a3e2U10ETIV^`%&Ne!5toNo>dx z2?K668LUFS2)zWzhj2{vIWX2178Yo6VV+W8D;^&5_q9fws?h!Ff$5ZB5DUN;-|7c& ztk>ak6sD$G$o@l}0m_rB?{-%2hx#&wZ#jtL={k44MtyM7u1U}0M z-4@2}8ClOt+}>ts(njH_P}AFz4l>v0& z2_aM`B5qUrl9QA4FW)-HX!}3(j{sP>u_M%5jGx5}tZ@LW&<^hNKNc54*rH#w0M__5 zIWmCtpHEDF?Typ1Ak;Umb?8U`c!%k^fgg`nSxhJB)9+oRm_uu&I8vUPNZ&+t+ zcrAi9jT?`#y?wj~L**ZVhr~_>F{O_@7a3fxua4D(gGPvRcmrL}??-;rh?_P;xf-Y3 z`*ipy9nZLK4RNX2>5NYw;&$p@A!4$Le&mHNjaRH#i@R6HZDf8{z ztj^-OC`ROF+}9%gBiwJtDc?BHL~R#%%U|;%%@I7c65U4LUP__^!uv+Ax}!Qzc&>}- zr=j^<2KlITV;U!D4EKOnO?4Dwtv#R#{MSd@WAI!!UayE2!a2zC9a5?BqsNSI5@+8y zXbd9muRhfXgb;?)54wf!l-Yky9cwp4oO3UZvlreG)8?Z9EPLY3PPOA|S>TBa=~>=) zc8&MyJJ#Iw6le>KC$B%6&t10--Fg_>>;#!t(ziKJA$-X2Gi)LGTLrDcW59$o7?45w zvMf}>I5OkdbF`I#rA#V5S!V4hzC%!0R}ezCBKGPJO1O`Ll)};y@o}pmBL$aDpSi-` zDd4)z(y);n7HStkWfxY6EEw!ESDwqhR&=F;v*}RR-CJwsPZPuueNz!xA z9jEgPIXYG(s;yn1ix)4_xm$0e6K8H=rb@NEL)WfcqGzAJKu4cyN~X>?>;(r?i}sxAoL9EmKIG-7io26mEQ-O=CFTAiDa6lrst^H?$VP_K1EMI zbAc{hewNDRT?P=Ul`4Y+GqbZ)nl4hVki}hg)M!DYh*+bDHIBMHYBb~~KNhX;_nDO= z_A+5Ti3F#!ytG8;&z+}}Cr{GS(lRBJlhlEpQN6*p7=l5B5Ir!a_(s2)u&2TMdWwl#7PDM(e^0Y_T~n&ndW9^ z*xtK4+f*saBQepcu+b)x%T%pJ}1-4tbVG#gUp8-D9 z3(PN_t6*P*^Qqnygx&F6XTQau5`^^uWFbUxG6P#f$Y1oAz$^op1!flh4)02D~WxLs8Jv9Ie=zG;_RRG1*B+V}$r&H(uKib|jMz$n75BqXo zE3>k)_IgXbz4v8$x_cH5r)PRNLsA^lTtri(EskMJv|#}>44Z-h8?ZpYw*J`g4}+2^ z+Jh>$kstYwc@R<-S!K=fr-O%&a%90_rW9_r{Gl5pg2o zyWjcFMVvZ&0W)Wx#C9i!-EIuEBhnuug)y48q)R7eBs0wV1o{)WNlY`5lQ0>JBTbnx zRfwVT$B_XG+7tV*dvwI$sse!6e<@ZMg`>&Mi~?n}kJQX55SfWGm`0<01V3d|~GukrE>VH}kPj08}m)&sRhSn@YY&q*(Fase>6IGZiK z4q4d+C2l0@W&v5wzEHgYPymx+k;#3UF4x+q2w+YCCN@LXFv$$SD3=j=t~H_fa)okV z-8oH^V@Vbu)>CztGK$*w8r>~BijmiP-7eBr6F{i|96g(2y;z%fWnyeuryzTqFdl#v zuAI|RUTw;W%)n8t5@eKJrF%Uh@8{GUSUL)80>Emy%^d(g_f&9S9=49~^S`@;&6-HV>ujn$Mk6uzfBuVQpS|hj#jpM$ zg&)c+kVB0fylr%!9a2Epj&tnk5TNVgJ)DdzOJ1PsqK=W`1N-$UV+17_*XNUgp}yS-*ntX{Vxo|20lKq(+QAq`kKVjVHT3f#c1#dr;%O zHyy)3cKtq;7aew8g6a|Epo451zD77z_T4J)^WJV%%i*xtlyJG|{cvUoaTr`5YsaBy zu6Is_%&~F&kXp3E#-FvRavaCd;qr)MX%w+h_nRpH*iZQs>paR|eRiQO0j%K_^>&fZ z%?H$3kfk&gPJ>v^M$pUte)Mc%E+Hz<09Lb(Tq=$y&o1HYOa=?N0qX0waOcilET6lG z#nWdQP^un~{?Q8VesU8ZU%85#x9;Kg-3NH-b6>(MuY3j1Jo7A0ES<#e-X0o_8Z%@H zg*;|vD6?G$^;#XfyZhK9c1^2`o!x!hxpx;E1cvPI^7T|#0(Yprxm*sJTn3qJ3f*1@ z2Zx7jI|2>~T87&XMop-?j}D;8s>5HX=R1TH7CCRPp(aQVs=)awM&k>Gk6(^FHZ9v-4z zJrttilyxs2>MTSJqvPUBGlo61C6k=vc(38T{2%ICphe4J^l5I&@9EmZNpC}-o z%W*lCyAL;BJuaUZHpD{8=Q2noNzh%4V@{}`#=8V)lPMCKr)-MgkUuixAJ%{YF z@O_udqP8T7ZAPrAB-x3Cul_-1Xcc#OfY1_}OG5Ba&%5SaaJr{hp znNY%i7zUOCF$74a-YH1Nje2Qd139+7l3M4bzY^fS^!5B41&o+;lH?fQ8g<0ir;ST!oOX&~> zRycrV+F=WVS{0G#=g&W##ee~%r6m4`AD_f@?s!zJgVquL z;Qa>v)6e@e8WMmdMBMEsng4wwjDhvrTiB^9Ajoc-FmxDz_1{SbmOZUi*Mv=V!N8jK z*-vO-xd7I=avXo~%Vne~=dI`Gzx{AlFZuiGlU%X>X|er|>ur=3>U8$2$DxR;ILe za%zypjMY>MaelL}L{MZkg_MR|ZPoCRQ_--Z=qiIp{5Wu3tDx;FT*1P#u2O0e= z+51YsR^8_Hbs8X2fR3!31b9>{`EUM1F|f?oQVcYki6(hj{8R>XDEz1|4yZy%UFl2- z5QM`4k3?oR5n>{q!@!dS*XTZx+0O#CwEv+F(t#P0!DcbAEO1YU_bII*$)up?s4Rr6 zOCvMIDG-d>qO*5N%@qn|qC+vUF+^(mfy_*2#Gn}nqeDA^X=K-a7rj;k`E*hMSko!Y zpd7Vds>1Mj^19Fw==LK28)TFf}#B zx=94^Fc8OWh_as3ex<^FLjV>Hoxvaq!Z0Ec686q$W=)|;`c6}fy2@txm$kFvLI9jX*C;z7l}%vFtxrBdrE5Cy zSw##Xl6fU&R5q94a6Zzc+Spj6kii_vLRsaEj!R36 z93DvhON=T40OK-?qhNlC&`|;(A3l7@jHb!rB=<9gFH+m+HQW22X%ru_&@licFORZZ&|Zv8fYy{;NNQ3om^c?RXBoepfR5+Jb>40eJGkbW}>k zqexS@ECFq#BSyaANMx)eA4CA5NMb;&r-)!;$?q6oiblDOCXCzwPBy+GLc#TuleX({YYP+uLs+M8J{&imP$hE-Id=v|qI{B*5NgFJa zcGMu2fB$4xTfY?2Ymn60lOUGJR%tQVJj*=QL;zK?_oN+Fh`jFKpqG-K?Ys?IIRMr( z|Ks)J>={k_oRwdF96*#0+Te$VQnFsY^N(YA!1_D^dK*Inm|9~3aH=zL5zjgsEijV(;zf;EfvS0V= zk3MSPH@`~@zxf$8uxTIpfBfw!ybzGV@w>NM`1L=w^}LQ#@{r*eh%tHX6MVD^@`=6? zH1Y%&(iif49OieGvl;fia_qs^1RtK2yB)vRf+p$cS_NLA7aJj3ILe0veXkZmU-|yC zVu0f~eiWDAW2jZnQv2`*TY2fbR5*tS6H+_{ z85N+?fh$Il5`8y{9wyvGy)m}RRSYEo0-1w@ebC{oXAEc=VPk%)&H6h+kIG(axfMDD zQGrHQNQShVc%EpFIsmG$Kw`4=`#sIdB9;n2LyF4_fn#YaIrNk+i(qj`wwSE5($*43 zDDk}ju&7;qM0#EHDeNqh##84`V7Z*cbgF~a_8mNYxPp_*=P_yw1Wtk+1cK~*5(%OKX`!EwKWC@ zNF%C401L5Dq7f8JlbD{FW@ZxAn?mCb4-QzriI^$`aFEr+nV&!<5_Hcan;~`*F^7_@ z+oRYblm(EOU&I6={i7(^hC=z;Z9+1cX_U$4I7?x>-Qui;^qmkor!0L5X1^$)g4jp- zi97==R6n}5R%_dbA(>Zo5_#`*7$jpM z_h<}_1_5;k7(_&tz{2DdGlv+=5EVAe{0av7RMd6AIi%Xa&PGPT7L*<~(&&X#|n4c|U ze|HP3Yb%&2V}=r4L&Egs=^5@v z0(%L-qwz>KBK8`AH|_c%4tBSZj0zEa(m$iHNGhMe8_EjUXp#O_3$0cct#*$y1`;qw zwj!1lWmIgo+8h>1^_ZQRLA`d!eMO;|NBs^8`5b36Bq4vgj{sm|@lmKCv8fJfb*!we zqIOteEiUR$0+cezI0IR!L=62%4Eu+595z~Lv^r?in+(`?yM0uU#q@>eP&)TC3X97O zV6tB!mRGOG<5{gDl+qwe^-jf+OC}h+qP`=fmg+?;J!T(D2G$@#Krcix1DV~D=8^!q zRjJDVD{m|Pgk*zCi6uvhgZ-oOC9))*r!w@9UzB)6yG_>4{v*7CeleCBWzcd4DXUVWqVGs9YV)|b!Oxj%X zGKZC=bro%Usq!qaNOq{L$ru?6z#8K~5c;Cp8YuRd3A*0Dt@M8~YJ0Bs_(QMLdq8oO zxi$cRb1FKdRL@s#cdCwYg*bz{OMOO}^*(nhfu|ReI9-Y{m_=1NY!9$f>EYvzE?&Ra zMx!g9MC`49_6vRh>+ezsp$%ZU4feF(Hyb@4nEnt0-)gk7(-0DnxAbt#QSQb(n^s-f zp!0|K6d8o-`YK?5;NLNa_qN^cp@mvsN~ap?IMt!U?x4{JE$;|6oOQ`zB2GhG*3n*T&;i^%2Vox$U!@ zg-|iD>|v#r-!cp-L@&m+WCtGUv#_tSZsz3wVyqt zGZ<}Fm1>_{2cn>`F2egcuFPP?93)1Yps>>0nIkz%YwI|1`Yfgw zPoYZL*DBlC-`m9D{w9m9AJm$tHCi}({t_-;dJ0qJIb?H_9M(r{6=E~3t*_xOv#nOJ zva*Uj3U{kf);`L#Lmmz^w79%G{4l!F48;RI;1X>j*CpkQjo=3J|P*Sq;nC(K~ zX8(v;O%!^zI6u$g-c&aVftx54IJ|9reFNLu+YGohTTO0zrLvD^qozaph>=CtQ}#U$ z0qgg$P5M@~8n=6La*9RfTg?tOw|7t>d)FFRI(ZsP3yYYVDlt$*+Ejb{d;H6~U9~Ev z$|aOaMFw|B*nRck1MKaP2>v01AH)bFP>nzz0y`qHIM;7Cy+t}P#$LZyhSXi8AHW-0!D-Rx`QX%FYiO2UD>?XDn_3z@+ z31;CDyNt?OTU+O_L25GrOo>DqJG;B+wA+}UpJSkkGD&t@4YVn|HJw0Cf>)^|=~q!$ zVicWTANvP~*xcH|_U;~b_bNONh|NVhU-XRfRGArPH0=niBn>XI`_|S5c6YW}myB3c z#KOwusBZ`>>hstrmP$xxvuw8q4<4|_7%|(9dL8t;LOeen86X~u;3yJBvrU5Z!dDP* z#ky~YHLTaVILgl;URuDyxhF8cbP|Qq6k@3iUrS-7G~Q^U61R}pkl9oc8JSSvs7o4e z9r>7(?^3%MNF$1cUbQhy6yB>g7)DybtUK_2#!3Yf99 zp#;c9K2!K${gOlbC2OTq>k^k^5?-hkl)sj1lEWSg+x2O!LJP!FYo0F1e-3ij<&X`x zXt3VZh~_DhiVB@nHFx(m4uB=WBL!md9SX>^V~^CfUfNNtDFVRaOo=kYl$SHP9*DI@ z7)|XA?3Wqbr82pN0I}qHuKGbXQ30r8Z8Du;TSkFcBq!i-?5xm11t^LgjChtv3Lrr^ z4Pf~;S>ph>Ku5oA)&j2zyVb6}bB)}TjI)Ov0!#!H8Cart_hwZl?0{z(-oHs4UPf4v zqMtqYhP6qdxmLrhaiS*z{o~7LQ~001>CYzkcYc2tH?~Ow%kvXZ!QeWpSzsS>Mg0S> z4>}=f8KnRKAOJ~3K~#{BHO)$2iZ>*LWUA8Uxk>bF8Aqx_F%amUSBH$V6Yb zpu5UOqV9JKuxZeCRfo+(k#Wkzc#He|zQRAQ$1sLAv>aDXbwdY%r(my<#-9UY)X;y) zBd$r~KWq5-(BBTb%vsaqg`V4g3w;;U#KTQzHc$-m`54P?&-pY(;e;LC@ zpgr%zb&k=k!c^VG_s82+cx@gu%R+4PXeI*#Sj!FlU=b1_+NWsp;!E5Ah=&;fODwoU z!;3Z3NZzZSD2JA|rZpUOrJRoO`bxnh(g2PHEQvab1B>blu@QD(6xkbd-Bt-y(VdzZ zB+IrzEM*6=>6W@P(p>s2Gq)*#v1K(y=p3mRNOq<}Ri<5U%OEQB&(Y>mp@W9iBti-; zfnZK+FSATBh$RmYij5`*yq$qkw9km=(p`=KvRpWX9#vFiF_SMS39!o+vlm$g zMI?yPrcu+250Vnh({KB2jV?+1k|q{_dlK2@2;ezlF>q#Z)f+4bK07zhOeGQ@CmYe3 zpEQ;Rg9w@wYS-zqE)r$Iqp&&xs^|ch%}@wo66s_DX_@)2*X{5%Bn(c!JlrWvkjjsM zK^bBSwVN$w%*>X{c&nk+EW zsW6deR@Bz!CIc2EjZ8X7B>GJ{O}Xp@PMFXRJ3+IjkWXr%<&VE?&66AX=;0 z#Dj+qapl@o)@17SJFH2SpU9y>jHUg3tgo-4TB)EzA&smVCP5McR(iw+i!f+cE|svf zxX7T&X8&o(B|iOO!Z8iIWk1*Xd-q|-?TCs$Wju(P$p?GW@U zF$XzRF_S@Qs>~sSWdb0hQLZ-wHj$_VoO0OQ+~)ouMi}Xh5h%nN1*4R>u?_04jtnKF z5WaXa#X|J4cmk1Fj58;0?d~x%i9$LvX&O%n^tuFOC6UkPg%%fukk%+kK%JR>lx2_^ zk2L2vqhrahW?-MxFjj)oni zyU*}RP1xa*vYmQ+q1IBBNmpkBG~kyKPiH&oeWrjMlspF6g|*-GS{%HAF`$xqL1JF& z(sT?0urwh~b*tT6`EOM%7r-+6E%oAtjHT5P9Z*x-stQ#a9)zaQTpo z&<)*~2Zn$~dq3hzTgCZH9{w!fhA+qpb~YWkk(6e$nye5T_jy5+M(nN3Ce=Qi`ZIFc zTXj#_0d=L2!~gcxg3oe4_s@mKmo=8n(LQ%o1B4i1vb8OR6Xtcg0CH?o*w5q&Mgu!GV5XR_EVD*Z6W3{wD5KZ$;HA<^Wihz-jObr-Hpihl!-Dmc*pTOQnXruSx(*Q;4i=+1$HT|FEt}YmmVR0)Iqf0 zMme9xvlmZeVIqQbuY%tGL+tEUuz2DOAGDjb2CDlT*xtC0gZ*^|V~#-C^HP|eoyXM7 zNyJkH95(uR`v)K3?w#8>tRArb)BZsPaSF8}U8#vY3t$s)L*tEDIut@j01p94&1Q!M z*2&)Kbe1y~w%T3Rsw$PIIUJDcUT+Y?tBEdUiEDKjbjbD0cgrl*+QL(g4XUBS)k*D>hzNP8Tq z6oGGjY;A8N7E59I%sDJCpU3Itv&`secY4e)A|URWr=DV6DAKwj?X5T8dK)duWSEL$ zB2W5HF|4gV#OB5tcDA=Ta~^{X49tn-00bIQI3_WS$cV%SBL>!))5|z}?gCQjJfg7_ zXLjuNk1#n|LNpdUEIBMm+eLN;IS;(garOj zs9>>B#B_O@Gbs|YiA2x|_@jO$239hazoPw zHfyNO9+s6*8*m$`QDBmmQD^1D-4eu05Qj@-Ayz6*&RS2c7d5ik z&dV$IrxpgGR8GXQV}}q5087E65$u@)wKsaJrd3e#i^T+^}SI5e>QrO5CalQ;4 zP$Rw=b!_$YOE`PT%oerd8p1=dHiH5C)6gTEb3j!M3p(hAA1i~%M*ryRMf}v`l5`)_3 zJR;n^je6Uyhmo_f7Zb*Oqz)#Q+mX+A%GW#Puy{8QiV{$5dYkC{*yoV(JHU6Pe|*S- zy>$qk4C6jLJiKV!62hC((mhSJxApehZOsJIY%A+6 zx!R;!S@Ber*~|d~z1&7e7sITT=8d&CbWzM2Ri-{-$Ttt-?YPBOlVQ))CJ{~{?dV~< zDTbJ+ff)x*Jv52H+H^~e68o*0-muG(s5*wBX0)rk`z0azEK5;}5kG2U zdLo18E}h1FK7vGR7u|hgP*t#W>KrB)PN7q8;$UwB47B;70u5!~9^!uHNKI_(ZODo2^^G8twpQD(bTGKHo2IV>$K zFpxwU-AMarcY6yD?%&1s)&>qLyQ~?N$)s3_oa(DY@&&-sMyt_eJ11fZ4jUvO_r4>iuBag#K1d~%G zW?s!q&+y+2WX;TAVPTQMLORqAjs%m4>PA3aI++yVtrTLpvxSw_hYXw@?C+u1ZZU9{ zOpwTbf*DDrQW^6L3z%J8z|8y{b}Rd+SDP&APT(rbHc<#LG0!BMDVt3(cu0&cV%i;4 z4j6c%`cQVpbT-FqLDHup_7=^_7J*a50PD6Hz&d^UBqk>(7@Va3r#@U?Tf@%I4yx5E z`%1c(+SKU-<=J^m6w9b}jhQcE_8Da(q>xGik~ox@ z1pg^hBY{)|TyYl8J_C0o>OMde#Ov!5GwTQ-9-Y>M(`$}W9 z%hGle3 zfEBbsS0;MI{i{1%tp5d+XFmG0ALedHL@k1!G0v0KBClIx-4t}D3>^G&6O>N^^Aj=L z-ZiW#ug$#oQ%1hO_P*970B>k#&}UGot| zgbtzOf8hZ}#2!xkjBLl~TB?5Xj$`+&fPaLA+TE_79<%aloqN=8g|P8)Os7X^iHaHV-Kw0PbzBQ|0-i61m_vCS+gAk6LHT&ilCVr3)JpFo zeSID3!-IU@G5Rj3GG5Tc@vA>%*+YEvBlNzx#p=QU1;pV+2ibPyf?;3acQ#=gC{+>v zm>Ifon)?6H<{#NG*H+`s8Kbmdxn5J*ar-1>2@74mg3#>HmGxLYkRFD|t3 zH7A77tUW4pj-TXg6y*j}PjqUzS{S64(OK+7c}hRRgvojL(qn8`R7K?CD4wdknicBD zXAh${<@i0>JSSgXxvI2~erHT`aJgm?GO=k2PvVhy{GAc=Ic`pi zme8Ty7#K532*D)5I1^itwZ(3Zv_CHa=qBux=QIR8ojoB85yY zk3=eiqeu+BBcb!ts5clOI5@0wmO27xh#@sMH^;h8lmU+bECR&lW@a%rGs6H`yWPOO zJD)H!?B3l^m{ml~0TLr8jVl5oGN}ZPNK~5+=#hwEcM-5LpaWoxfgdvAxwGeS{@i(7 zICma{$PtH2Ub}h)A6&kS0cC(oBw3KYkV`YTRIgUBv9`+K#{S+u_ZN*h0?r7)qBap5 zi6RT9$}>25Y8jUvdjc0OJ;AzE6h1dadQ7Plnhapw#}D5B5b0bViwm=8HV$yGzm4nH zKE~?G3im4wbJB_;_L0cCDMi5hM;y*sJ*=YF=^_@1;{3S__{?Wsz@^8Z#M$!~g#K2Q zG8>XE7=<84(Chcm?zEVxMhvOH{>#6@+u#2_3-j0OJtUH1Say46@?<9x47!!4%P5yg zNg;L; zq%0JRn4BtOerXZ&OG})UPv|RAXl{b9qj^X`l}Lmzz+@qZTsAGk{~FAkVw;f^JSd5@HiGvp2ot$NpuNp>roOf(q5y`)Ha6&ilhsqkw?5NF~tR2c~g#1in82qiSW#H=t1LlG}f2t<^bR;8cxCaw^!Ujii-fF)h8cCHG5 zSKx-Td6Vmh$dqeKk_7LI%FS+U;oI%`y^ zyf2m1v&`S7T($n%*QiXq0){g$rl^k05LPd5^ou=V2ewNf155X)13fz9=9t^r;oCa1 zgYaE9?gn|r0n8?O!6S4RvR@ZM?A(`cimJUAC9RaRy3@BdU^F+6o~(M z{Nq^uY4ia1J~^biL3X!33$JiEaO9iX?lXjK%x9)w9GV8XXG^gW#8{AhDVYhPsnP}_?U%^0r><48^725amL=9bl6|J$lru=i0G13b zq-<*pU^S77^e{h}!wXNG#Z0=7eq|L$)pgWrP0TMXV`6p@)e3g7UyQMxG;~2i3tXT6t95#o`=tM`3&fVo(SpiPLvG9US$J zFgrbqFaF3EIXm9Xn>TRz#p2HeRON!b?fZFZ55Ae?WA0VBbz|!I@HrF3w zedR80-nh!lG-9985A~BiJhFCNl%GZ8jF@W;61(4TV5U5YGw06X%dfnGFMjDuIIPuC zs}kd?#?K=+LH!paCLOUo`UCvgzxq?W@!IR?b%YifGiFqDuXHH%9QwRa%wc+_jOFEJ zEG{i!er_I{yI1xrxP9vuJ|>%f_#TINk~gHVzgRSaR3gFI zAZKP~kj`XyT*OnjX+b%$XF`mP{^k-IO=g2EddJ( zNT!fY5|pRxhTTq&?N0*tBnD3`C<-a1IYkUE66+^jFal`{6FFwHwcAbHzI79;t0I(> z?xB!b60=W})?2=aUL=LhN(0r_5!y#_TzKLceCDMuBA%IG0FMRiN%N~i0G0rlgv2`y z4>7)JjCT5cw7Px%n?gQ&#O7qsO0FGpeQMoB%A!xG6&QjsBIaZ_s{3HC7ta zylhhKl=gI@2l4j*3^~{BH#a?eLjzGeKs4oU;NGQRPisa8j;wb zi_Bpm2s31p6iO>kXRtIomC@bQ6;aX<~`HjdR6)pp;-7ISXIusYtTvpYy_^20lgoq535 z=9&IE>jw9jn_W=Llp0k2P%o(gEa4;l?%VR6LB8EOsEXP>x&{3pblAc&YGT+e9#WrS zzQNu8_}X>+R)*X$tROFj;f(J9q3IB_IQ>6t06O0tzlA)yo!h)4UVZr}Wvh*nw*f)3 z$7={t4?U6tA0PB#SUpGWCxX3|&5RlO;wIqH3}DGDguyklLnf?^v=d^i!VKjmPraq& zou{#p0z1UpV|#VA`cO7gY)b7=MO7AEpoDx4%&4s+4*`y*Uyy&~M+)DhYGN~^#Am}^ z9Ef@-|3n*iE=}FS<;#*SeHHgapx9RCTCw}`j%g88C-i5ufkX(OzFf3LgagXjO8`r- zf=Dpg08UP*gk&>_dj*q;4%{53$6`7aQv$^Q9MXv>2Hht5od!CMx&WB^#113YQ6Hc_j;AnLn&xmXI_Z~+lX&vUC(-V-arxtq zar4$q+`jXP5G*g3kxr)&J!)ZZa|PQQ4_G6s-fRnvF6v(bN+p0rU^NX{0tG3QjWnFj zUw8~pJ@p*Up1X+Cr%p0^iOOtud${vp6+igkGH0fJdEp2HR_*=~TD?BnEaE;8*R%Y) zb~#3jU5aV5Pf!31`6Kp+6m}@w5`D$~!UnJ;QGxxF1nM=Y#8naw&3i@_;oy>m!-GeH zQOX}$YoD{llDh^QxDsAbvWgT;%?p$8i#8CYRvc|F`GL4pfpT(LkZ(uSx+I!vY^`2K z$?D5Ku*2f*^+~nDB#vT+uVi3JV+j8&{X9Q+#EX9dZ}lF=+JFS^cI28Z792^swSy4l z{ernG$CJEA0a^Aw!L0nEZ3@8B*H{cMwZ`#S;BjWgMj(JS_Df4+SM@LX_oHrTgG?91 z!Lm1;kMb=0Ic6i`<4#JpZdRc(I5_~^W%=xz`<%=uUy+$HjvIB za99kROd(xpBel{km}*%2M|Wb3Q`6zs7@GvmYO{&8OBrRyumg@6$>B=aWH$f+AOJ~3 zK~&>dyf1No{LeGT0rMs(0H*AalvEDlpoku2fVVUO2B=i8}lhlq)&;xW=|ex zaSCfh=tu}`({NLaVW?4;IKv{KFO*9eRgSE^Z|pc9NSlvzNaHNo_BuPxa2PdT&5Tu7 z4y&e9ntVTD*5n{iJ#gi*Dn82Nx!=1U%d?7xed(F^!>sn=LK9y*UHABQKdZ~vQqJCL ziMA4hLAq+C6JhQ8#i}efyf%PkygOA|T9(rlsdt~Yn63ah_#XMH*X=ta06q-N6Xub| zqrY?pKiBp?*+xC@&0A`HhfJTYOfL>NCX=IKBJsmzQ&sJ4@mrUJs|2luhQ zv4-L#v5ra%{B(L<1_#OJ6e>uf>m)$UZ9o+HTo#2wi3PnE7MCzHJIC4Lnyofg*EVqf z;R9@JZeV+7hr_25$s~)nlV%e2O<|&lnesH2m(SqLsS}tjmoS;nGv`EbQ$$fKj(cg4w{c z&%c1Do_GrRTmglAfx)-U?M=M*{(D$iTVdu70W%aTMrQ9c53zdxHdgN4!o7QUIpiyz zN+U+huy~TeJRVb=c~WGMBc{;dL5=ml=H{00BVYPay!hgaICYXVmnIotd9bpEkFH#0 zU?ZPP;z6>Y>{ujWdNvm~CJ@38c~@WRqM(?XZS!hcej#Kl;k& z@aorI#nQ30#UNI2@J63ysP9_a5NQH{ZaG>(}w%{yhe- zsJ_H@YPUM1!LK*Dv-3rqzj%>D2b=9Kv)`slQ!KJiz$lG@Y$nT~B8`nc^?xys$%!m5 z=yB#l64!6FTbvEEP@H67b$5Rs+uOU?+1*E@*~aAL6mt1IGY5(BMHL{1A&n;jX;bto z#ph|B5(rf#5Vl5H3Tr~w3Ih&TY;_4Vilfo)W3Sdhx-f&{>`6TK>`ORz@giyj+*0T& z&s~$5Q)udmUt)F*VsQ>1Bmj#taMFAsI|yi0u=|9+5PpfXl(I`#$sJ^NRfz!!_LgK~ zSvpv1T@=hHne9}qQ}S=IHb{@E7aR3*#f04H7cO$V*ylmt%Nl3hmY}@N#3F!R`Ea#X z$$Qk=X#gzyEbj;$y9rA)h$ml2*{m$RR+%%A*+O`BN0v+syKN?LDGe+MEGcj8vzxsW zF)t=nf13Unwqr5h8Eq=LZ;-hSyl<7z$>w(v4@C@j{Yy-EHWT9 z>W6%V)*Bsh@o#>&ihpsX>0HIsKhMT{oO6yJZg_NCxwZ&v1aBD}i%Fj%J_|S(+fHkg z9o_GTw`I6}+;4-g{j`{20ng&;8Zr;PzHh{cA7>mK$8O<$;BAM;{^Jgg?}7hmc~L;O*9bSLV}C^cp3=hg${?oQvU8 z*W%pBMc|m76+G%y9c{vTP{EclbwOd?L~gF+n?+NaTLS{He(ZG3d6=g3^QB@_Z0|3W zAF&6UT?+x+1gzLH?9KaDROmR$*$lS{vP zk`v~k%d^-}_IR>3y|x7uxyfH0bpTN;wjcn@q7djXI{{z`WJ86~SZ}lCvMe;PM5v8s zMp^5%?d#dPe83a^Ar2?PQ0h=X&td?J*f8>Kz5u?A;I25_OSYFl+QdOq9uk!gp=%Ut zf`LgpJW$p}u^jCEmOd;hQGBj02V?Os=^7>bE#wmeER^zi{?al^i8dNr_mSxAV=#ze za%KVP!ZhyRU&SYP@8RaH+gMp&XVw*E7u>H@SS*~vqv!xFw30du$`OE&$!0~C!9tNk ztmv1*#iG$TUo#j)`LJHCHL*uvNo8MjeI&yAR>a(*ejyNGZ+DLwSQGgPl*?rn)1I0v zVs3gG%co9ZdU~3(#t|??cHCl?*gCFXzmA6w?=w?~SXz`BFq26#s6bf=n~fUUP4Rd2 z@DR0n9gSuSU1EO?z)Um(F`jufPu8InoR;zM25Xz{P%we zKl$T7ffFZ|SU{ebIeP~cX221Mk;`TA|NcLJgg^V!KgH@pkvX#0V?5Qk3L5t+1}#R6 zB4RKl8Bk=ME7DQw0x!JuEWY?7U%*SBdl{E5UgFS83LD+q+h?GU7+lG85~)NQfA!tJ z#+$EyANTIuV*zv7WeUaO|0|Xc{X3Q-eXl8;Id=w6Kl==3=jSk4oJ1y*W#$!yk}Brd z#`*?6`sgyQUAu}KH?A`nNyC5{Nu*KMm-Cb|DHhY1ou5aMLJ}v7NTkzjyYlo53;WX? zNG0OPX3{(kC$ecoj=Jcznpk;o59^!j3^eunq{9_QnV5MCi!wW6hOI-%u1LG7@iwJ{Q6h=q@C@1OAqTh1mVenjn>%6vz z!kE@NBpGsY55sGlGNf`LUM9HgCtU|C z`=Ynz7SUOT5bBP%H*@N?PwOpu$ZlrH$3fhyk);gXq+3=TS8-xX)0w7nZC|99}KfmkV)+8<+sBl@)aq6oUQ@IQXK}WSHcm|_6*tjKopJOj=;;ic) zqTJ$LD-17r)F2$y!DD{!RO!)r$+Xdn&JXv;;os_`GhZ^CjU2Kz+CIuQbU+i`k8Gbi ztiQ&zukW%T8;>)3AH^T|*IMUEV{I!;eI4IE-g%m2Yi*0GcCyEB&x>it?PIK2X`Gc(w+Qc)5{QUpxNQ-VLiT zKed^+n=7wVK30Sf3SYq)w4|nwEoiI5L=;3W>!I#cZ}gQu8G#L&QAG#zxMb7F&@gHo z9USPeC=P^DR#~k>UN)PgSJ89mdKG>pm{+0}e0Zghq!ja-J4tyM7gS@7}@g-X3OVrWyDuPfg;e+rZ)eHk!2qX5mz8hYVg3fJUKX zq({Xsl%g>-8Z8`FYdC-YBA$HmIehJFKf&RB(O8@TtjkwEVg?rJPv!HZS(Qb#dWem+ zhj{PZx3IQyp9R1v1T8-?!F@%5LcQMPXH~1Dr9=Q07vzyU>T*b5Hj~3|{nkIl@BZ%Z;m)0V*xo+msYSpEvEP{YGoW$>@S}bR z6QOa$U>}7`_WF48>BsTHi!b13e&(m~`OkfhLAYkUj{W_8G>L80Cw(&lB=dOVwKwtR z>u=(X*Wbk5J9l|3+M%%OIdax-^3=nfA21vrQaVg$V&j|L}?b4 z#t}C5>X;}mp*X*UrE`~%o1SC+HwtZ}Bm^<(j}()N{R+)x3NIuPcJfCOd=fojR#G7( zPu~k+ca^Y0xl|i7ppwNS zu$OneCMh&Xt|CrbH2@_?p64)S#;6r$de$lJx4kc%B~yyqYVOgu+W?jV zd{h{?*bMm0Wnd~{K$VaqaK~@i#O@2R4vElS#Vl5#gZx;%V#qLbdmCcy1>BcRZe1OD z22bS_yPEs)*?&wLSgsJav*G(8&K1F%z3~bR-@eOl#w$jd%c{x`yI~hanGN;uii8~$ zy|u{1fq(S%0$w>Q#1bF%=eOUks9l$3 z&rzk>Z3rkMh-2H@Yol&fufaN84Aec|B>WP1j zSKo1FkJ?NGfz<(fCRwMkN@SXFqSpb#A|ptx9oy!BE!@7pjw{!1Ggy;IQI@|rVu?71{gE(vtx;z! zAj)({_08sTD3!`sSUAB`x_!jcIZRAWp-`H^)KrQ4g~ZYy z+`EI7d!OLp-P@?{?Vv}Q4fA=a2bD&e#L5R?R@T&18E4O&!?VvkhnblLf@hkF}1+}*_PK81?yqH=I3fJWI_g2_TGr9LyH;_)P= z%5(VnpZ{fi{tI7b-KK-XecZlt6PugsEND+c^67M%!z*uIzlyisd;^;ss|=)&HW>ZZ z>vaaMh}lKJRfod;NKagn6`5p5I#0<6e&Zkh2EO&H-@}CexE`#DP*tDAXhAw z!aw_+{}aFedw+=QH*R5TYnRz@1ddP!K9T9M$Mq*+a0Y**_KgA(c+4CP@YJ(U;-!~g z!cTqkZ{hPVzrP?2*b)w#F=8f9(yt_Py8foxk`Fu3x*s`(5qH)fndX zNa`0S_lsa|aUM@R^8`+xUB=0iCsD{xFff-SZ7yccQC&p1+uGV1Zr!?t_uqdXmp{C0 zE#MM>=d6NJL=#agojQTj=ax|@5d*Hog6`>Tp3BZ8V@O1SnW-WcW@mBz$`xF>{1HC- z;Cm0gF;WGHWn!_EA|xm6IyYoFVruGFDqu1fUtx=l3y zsSXqP`o$Ff!54B^m>?H3{?CW&UHsFx>iGVHj&BCrgKGQ|Ev{e4O~)sW!4?w|1i5>U;5B(2{l>-)Gm+ zR?jh|hx*`gJgjY}G3Mx)-KsD1kHTY&b^BqV{i$qh^_Fz)p9%}uC+IUKY~`u1GsL`Q zT6>g71F$|lo2rp%O7zd~<325Te1?}|j~NB*iJ=fOQTYb1!OdEu%L_HGe^D1j2KY8v zg_jp8gs^U|QLnE(^U3Qg)Yl4L)!_*Nu1JNK2{#gAFCI%`q^r%Q2^LiL3bLCzNLb}c zN2)iR4u8i38tU6jdhu}pEODDW^sujVUqraA^!iS-33skj&9gS|-r=I2t4*owEyFxn zPlPx6M#xr-D#`*E6WQ$K0Z)NK^gV~@$U}^6H<|X2%Tys7%xI8V2*t~M!KUH^jI29n z)$8^|1~Ar+5@Cln=%(%whkHw0*g6c^0yHXQ(FU@Fq=f*m#9>#6e5d+Nl(R{knknF! z^CwZxL@;RVqPBe>>zh0H@X8H*eC-o#?NyjHGCf=7tZSrORBsY9BLDaQMS1S3VSQE))9eQB3w=gR8t5Yv47%;Ble3 zaqY?#tUi2zey5Fzd=ACQ0!ovUtUE+P-4v2V3?dR1UtC}!rH&?K+vB}^#2YzV)rY$1E%gS?qLLSX+OH%E2Co+mX;Z_1y;_euy8u`!3#m<8^FrZ*lk^G0#ZE z`=D}w{Ynj;j$mAQwhcV)=+PAF_YZ&LzrwHn>fc3qs)THsgzme{zUos3y$I>G#qo!K z`2XQw{>y)bk3PDB&8;ogaU!M^*_L&{C`7T_Wo8hCw-Ja%p?DVV$yIpa#pm!NU-~?L z^vhqu(@#FhAR>WY^h~03QJ*sim&)Spx8A{7q-ms(SSaCDc#1Y z`7$m&aS3P6pTXI)XF0TwfXHk*#Xuy1S0vC*;e}++)zx);``h2axBuchmiCoLTM59- z;w(;_K8dB%VjM-Hab~g zZG}8#G0ZcQszqUo4>V^vskKo>3Ku{7Ma-Xn3P@2nETQau zW?;o4QNhNddCz)P5y`9)epQ6<3LPx=C2F0};1%5?0R;(i2w`}$(t5)P?NB=hWbtkc z17GqIKx3H6&RS?M`l>9ou3KxP^0j6iQ9A>};^!67S})zbSI8@1%^0&56Yu_$0WA5W zhp|9oT-K4h-kS4(wI`7bKjq80&T{`PmtphT!CCvQvIDjRc9^)AU8VpeUen~dqxKBE zj%mlE04(z|%*D`59n{Xl{zM~m-aUz0Kjl^~9KZ_M>v+dl@c)P3?0h@)QnjV>K1JMQ zz75%wj#pXhs_`1_48S3`=wWUj>f{?vyJ})^nop>siHY@%izz&}m_RvevJy0t zVJ-Ezu(6p#fn#l~5ft3hBb#un^&||QGG6m|0G8QYI8F3c+CFcOs;_mgU|aZq)FzOR z%AO0iuop3Y-mIP~#m8k+Kg+`lfw^H}xYq4)63-afO!B&0uf#(;Wj zs_kMuN%xiX98R6>tB;2G-Y?>jKnZ*Dv4!4+qoO$tqtJBT7}Uf&nqqx@Gi{g8M~} z4@S)e&DV@4yKDi(xNDRLz|xP9SLroHzKYjx!NnK)t+C83q(TGiff2;OQVcc23=-N| z#wHdY;3IlkK2VB@x8AOX*9QsiHzb&DapyRm7tbHe=l#8NxxuYoL+; zBQ-<#feLt(dT27tPykj!h+TyQDj<^>69i(h&@zEc93H3uEF;Fx;Uk)%BMusN`xHZr z>r7`}W`2o7o~W~8Z4m=YJgeJnBiU183)O2|Y84`om6nPqkf=gaX6?L^b9&49@eq9e}G24jcm4nU;F$2Iez@de+siRvxr8IaCo?n zexF`OlL&i*!w|ps+G}|I^*8YL+wWj^r-F$>UTSj*A@6#<$038%H`FF#{HbtL%Irr! z@fh%HfB!$m-~NT4!~Fa#GU*f!4-aryrQbsa$`Xk*-g)Oeyz|ccc=z4+u)4l3vLI&C z?4788YBdq%LF14B5E={}4s{dYpW4QL_0=!o>tBBrCr&Id=(4%F!J&{eUI_RkK#W2l zC-OyHC1CUNHN5lIJGgiMfni_CiDmmAJ2Y%&aRyI3{Upv@IE!;tJqr3JbH-=yh5QUOil0!^ZYD4h{~O`L(pT#KQ0i5?q(QoUo8P`6I2BWDYC(1&rJ*8n0=IxLad@*E|(g zD1EbHzshA)Iw!flOQ1(Fh#dBo#TZtcQ>`h*n2GC|#?_Rq|~ zQqlIxiONcgbuIXLzB8y~`zjDgucbC?Q2|QA@yM!J759WW>N?w>+uIu})RF3H$;a!L zFq+qD$&ERU+wA{GNHbl>TI;hG`rI1x~o^-<`f z0(YZ9&+wKo@>pYyzR^$j3{}I3a7Lr=D&GfUQ))hTH-F;upclI47V)ogHioHe6xl=s z^$u{*?4!~;0%ha1e;g}#(Q9WAo4e$;+Idepx@Di%6~@8Y#!!ZgM31Cjtu|+AOJ~3K~#h5Qk2IZ)1af= zwXZnW636w#L3Z?)G1}Vh{21lR!^#V;eel)C0kFcuP>1!33p5R}f#c5r|3Co0f=M*C zf3kIVhCSZ~DSXp?{7k?^_Aa*a9`CyAU}8fa z`_e*N09ab!RrCIRuOigcWYECUBGC|&wfR$HO92q#prI;aD&(wdl*!L=v1+$si_Z!J zm<_1(XO`dK7h(>L$h?VFbya5c16W?>sRX&C$c2K?G=Qbw{FBJAs674UT`O!qNO@Ua#`koD|r#_<2c6f+9 z^vi<KQP78WP-I6Ym&*~MwJ4z_UP@;i9{t$&Nx-+U99i6SOSQz(|otf@po<;0+( z5H&<7zN~K8#7MhI)4i67msGC?w#9Er2o-qIx*@WtIbi~Y* z-Q7)m|E<^X;fL>{T06i1F-*@cAd{V7+qGMDk=d>N%moj`eN8o5jk z#fbtYibV#nu3W#0SUie!Dv2_Qe8-|J*1oy5hKDQnu)eX%tfd&~8d2yd>x7Awn^$*{;{NOPj?n880B38N3C0o`g6F?vNfG(x=YIB^`07_*L20spL_C6n!vj>L zcs^xl%;k&N+1|(6+6LZy^KH)JNLeA1=`@G@5r9R^GSc#*5Iti45PC@h?PR|}|A<2k zN!0$;uYMU{``Rl=CMlUf9~+yS+$W@SMkA2eV})W7#o`n`xpfz}Zr;JQt2eN|vFV$~ zUiVASO=VIzary+FdhTh=EzSuoGSc(vb`Xz7gwE68h=HtpHqQVbWmJ6Q_3z_*-+O}v z?mHxurV<}m09Ixq$KiudJpBaDpFhuRw_Kit@Qawp5^IduQgI}cXW^Gd+vq1SKsX23D8ncP32ZL@9-vBKehLpGa1qa_l2C1Vk!DReO&LtFwqV!RxoM>=OmK!*k51rtmBL@e;icy*DPP%&H$ z@XlU^LyTqCQXPsW%5qu4%8RRzHMI_z#fi1eEHH(?Q7lx&WYvC50R6&eS-xK`3Oa(_ zJ}>Je7>2d%u4&o~X8*6jD*>(;FiNhOs`^w93GOIffPPWn-AY=DGTw873URdASN8hH z!`|RLq1!Rd`m(~xMHhP)LJOR;ny;QCw9VYdh<=yxjMm;l?LE~xt)3*VHAYZ-7Al9v zq{6L20IV@~hQTH79 z-_3e05>S$lg(k1DhKlW2y(OyF+fLq`^SsEBwP^D{ZGST!M{oQ-_K&}?dq*7Uhdk1? zr#_62s^k!C$klW6+RtzOphtzXtHgod^^#PAvOtI*vp@FvD>oZy7^6FwVx@ev^cMV= z`!JVjHQr1REecvcm9@q%XH-|Jb#2_S#VtJcP8nnU>OqVlfRS9qM9? z-*{=Ug>NVTi#tR0g}rH)<4&`*JOGvgWSkAV>ofF5*5P)^x>{h9dh=}h$a=#r4+$>t z8PRV>^%FIKrD#OfAwY4(EGH=XnEtRg1DlSWQ)2mG-T;yse4rDg$jpaz)AL<5@=TkI>C3c z03)I}Nv4Q8P-zBMG{Wqm9*a>M?HS%<5O}3U=aqQKfa^Hm)07AWWGqV`3}v_w>EaOk z;)uj^RH&jb0O{K3Lx*H(5rCCBYUAwO6i!Y}pqxwKlj|ShU;ptRVSDW!>a8Xw%hM>7 zN*o$RVQ7>gk3bRnjVDsbWb;^9Si-{M5^}i-q|#Xt{w71DCJQ2CV0o&{I#tA!O7bsd z0TkfXQICL$Ha@v^6PK@ih-=p`H{4uUvyMkhA66I16(^Hcy=v}Go;ogJ0xN-A3 zHn-O~yJ0GsW`Kgj5oK&0F{SqR4{%Va;oz{3ue|a_y!zE2!`EK@I-Yv+86+s&EYb%^ zlZyV1MzFQ9#`;&pzA+vjUWb?2PEISI7Bi0#dk%8SL#=u(`2~4?g%1S3bUi+n?OQVMQd;N>8Lvm@1$=Gldz}Z!4i( zo??)cn1U2WC^BJYG3d3?Yd5jCyTwB9({u9-8dBKf;X#!Fw-ZYzasJ#{v|CLf9w^{UUL$3edRH-c|Y|XRBlDC0b9g-`ZGX zM)^8_W|+r?txq$nK{>Fs(hMS95Ff8DLVMbL3j*ysxs>arJCV%+5EN zt)*11CA?D01zvp1mQgy4+RmbmGK5eTGi<{+ax>{3BD`Bk@0KjcL?Nzf$j2iqCGPcH zruRE`$-bh@2VP{++~yv|?Bk7?oZ?C|Ppp3hXqc#SgKXtCB>33j`1+wyZ*r%7e1nhQ z7s`BkSh(ZEF37f(v4Lmhvh6iaw;wm^&vBA!%m_P$_y2JW7*gqg1v+TF41bc1T92qx zkg)@AvBv*#nkla}ciRKOh5%&BbgOJ{7X&?4T;n1e!Bf`-48ogWcR)ZNxxUn2ThBOi z*f7@I*E80-KG;XNHT93Z;{bu)R*y4rhIh8@F9D_h?`R`-ksB>cWItRC(})8lBY zu|1q+WrydPK6S^{P%y^XIR*EbI#w^sWxo+}0 zx<`UXV#tYuvIu?0hcP=P;{RF z?>Gd6*k2Ota?5oWH5MUfAVjdZ1gs{jI>eH?79;>Ohv@b(*j z1N57Gc+TW%hM!Tvr2SWOa( z?{!&EsLi2Oz~tm4o`3EIyzs*3@YxqWN5OZ@6npQ3_weE64;eU_pPk0cbO{*ru(q~} zo40Q=xV62r#aZvD-mzGm`-H$nVyD!qbA0+<))@*RJ2jYp=b9J9i$S(WK0Q!rdoRDb`3z5P(I(_I=Vp zBaw9yXg^{mQm@ltpy@NuJ%fvv&Lf^o@HlHU>*%t6)e&;J9EY}LGC2l9-+A{3xOe{^ zV(~baoyw%S9i*{F`enU#5B+WrUCOLiYp})@;UFhZoWNs`U%=x}T)@SPXVC3Z#zB#V zu~u(jb90lk>(Swq#zY}s#EomWaO>6`tUg?0O)tSJ^e}X!-=_K$CJQ)w?ktwip2n%= zlj!!_sO;}?cpqs+5r9SDD6yd^Tyd&YMz7PyLFEuvKE8&JFW=I0%bt^RmLQ&{jF}lc z`~0(b{PD+7C`_m(5W0lxd)zr=(4D?FBx*#vTh zEHlI?qa^`h69v*;D{*#70v_pa5@+Ar-oobE3f5L1qFS%x?D_MUEKMM=k`p@kHlxwg83MyhDOD z*@Kz50I*^zIfM+Mq_9B|J_vMWSfTNA7Q;t)Q5{Asm`(NjXjnoK)+Dx=yc>@>;V$b$QOtD;2fg==IRj5VV(I zCpn&f?KQ8Wq({|EW6$|htw7dZM6;Kr?akUq%wNS^Rxem=0Lw7kRI$8%h(%3q9c5|G zzD9gzgI8)#$}ev8hRs@?9afvT*Sk;C`*3-!?meqKwck)km3$xBA9(x8Ib>+h7yRW6R6-IPM5I?)6UhjHt6-FoK7#pCn0~^IomNP6gDVMyx2FpAaW#e|+2y zbsz3N&-MXhR7JPfnumH55n$!u)_7-<_`k8AeV4z2q07WEzHr8#bzj(e5ez)Z4pe~0 zu)*eR5~QKr-Iw^#9`I&2;CYE-CcvW)g&~XWIP0*dukCqYSUK)RK_(b;=~3@QeJ`_y zPHay*RG$aWNwe;RmgyPjFE2FljWafYnUPNa$UyHFBUhA%p;jeh~wUMckQOVL}~gtc&byL zHeJi2^pc6yBVDimpSJgIjx0&?#C}LE0VK4pLg}um?y9b?)@pioc6L_H%yMn*jz;5= zJbs(Iy$^844?yw{-q{&%d9>Zx9nm9Nl<1NuprEx#tuv9Cpt*;5@m{_Zm>Jd>293;k z@j`gGd;H?(9<4JD9UBRpVP-IhM)nwA{qmo%v9^qSHiePl7^Y{Z87!&RYaF(g&(qC; zb@+Ti3?)V|IX#P+`FX(W=kfItOC%7$1Tn6L2QeIv0?kuY%Vh?MC|rtwp9>cjnT-{V z#JFv#Rgo}yN%qf#m}XhQwEcJ&J0eeWI2%uQf?d>D-;rG5djl=KvqEaiPT+Cx?VjPnb zW6Ucebf5Vd}&&4_kcn}ErF@IqWbMy0Dp2m@W zV$mq#6rRc;UKH!AD_DB*9GmNF$ma97dhHr6EG}YdW|o1!^^GmW;zQg=0#Fl!aTIb{ zmJeceQG)!FlOr4-?Bj5MpF>BBo;XfJV+f94#HCyJFg!MnCfznjmmUy9%;!PSOKds; zq%cU;YNFm~q0TI(VPt%UCiSyy zXqRl0%0s11tJPM)M79owY>C@B%-wDd?F=kCfF(?Wb*LgG{AO_aIqgx2=gD%R;Bl5nSQM(|RgW!0# zady+Kl=CU$@4njO_Pn(cEFjIQ%;_+x8u|mUL}|NIXV@<(4nin;{4-HYUDOS|b+6wx zm%lfF&?C;FQ=|PIU*tbq<=dJ+}R<+al;R>dFP}Fei@33>DIA7Jskr zjlIS1^?chy+BdfkSZ|r`u0Yxw*Mkw&_CSwuH{@Q(h*{npwz98ZOC{P~?eekPoZ3dq zO*M8{$F}uv$c|FpdRt_E*Cu1e2W=Zg=bD#)_fjfu>!quNonyiGUDPVr&vI7HYp=fB zT2}hi{*+;kEph6(!rVI6#bz0@Wi!?mbm9)4nB7rzv@H+yfx|P=?^I5YS%GPg%=OtO znA#?_FOM#h+xNV88|XhuB@Vd8QD=ws+t2j7&9x z+`}xZ{e5E&v_HXqfgQkNAB^%p$=6w@xlX+z{I51I$xFuDWm};aE?k*sL>f`4X0b$LWrS?!u|%*+soKoe!&UJ3G0eP zf{4Zkks~2&yzlCZc z1vDEdm5K~FG23t8jKlA0^&0YpGH$$a5C8gq_+PPj=@uuMUwZi*FPC0$0`!rQK@Q_f zr;qXS)k`eBTE^1K3Ny8`*{lw)WFV&HMXlPzDgD$NeA6N2iu(Ms&+*a6AL9D8YZw}i z<6wUe*>n=6QXaKx8P!?^!LT3UNQlGNS}i};)_1VNUz?)nXZ^aiYHogyY*cN$2^!7@Ziy z^HDi(LN9qRF7>-acRfHLu z94;+$vPrPe2B+{ro&oGjQ^h)4Xk%*wt@O8cf#m^%!Kl@`UAslf6O=V_Oljj4IKV^k{ou5K5U-mZm1$`{MriV74pLiib6k&zgO4x8*m zcQV4oW$vX}XxIJ`4R6%Au`{`rwbVm*`x-8gLEt%?-dU@Vw_~rUUSi(+^YB52fe>GcY4G5CQvD%e%h;z z$2nfny{OVDUF6Z+_;+cfsi@f;*j{WZ!454_YRoyYvUsS;I|2XsvXmrsL%C)egEL~>M zqz~GLrc*3ym&rCx^Xwq7Q&BpE-IUq>ho{3t{-G6^enz{ovakQnvedg3cG+<&-|2vg z{Y&So`v`d_0P9B-LTJpnuE&wLLZ4`hI5lOVw0ovLwKIF#$HNi{BS(jtZ%1NWdfM!U zUD7n2$p{w_08PhG$SzA=pXf_}z1v!|F|X8EXhE=VfNTI3n{{c;WU^+B+_+Az85&^^ z6XD!b@+4dVSQdz+oa`2dzR^v4DlxLn9hGgSzH`_ghwg~P?u<_{Ye3Z{ep9#+CvKNA zBj#J=brC;G#~F+gwf$oTl>)2ex?-?P_&d}bmF!&rX@Zd<642A8UEKyH$I$Cxh8BSg z1e_34Dj4v?Q_14tul@;JOOMg27T^!~n7u+TAaICSPV}1+w}-+pT)*}PW@hFQ9~|b; zCfcOWU$}@Xix)9DK8k?PgZ0-dSYCR8=TE*vI(fvP2IZ=XMdSQ4K0bl__us?Ss{{lM zVQ+5--#+-7L$QvNCw%i8g!C zS!o0SR?Bp&pqKL<5p#|}q8rz5;L6o2n3$O0Io;S;LoS=MYvr+h;u0a#v-51DihUw`#2HrBV0&SrRhknGQ2n#JO!MTBE9M50kn#6C7Qiuu`D z#G(;q0X};00Kfa~Z}_&xT)u$#&>$uzr&#t9qhkm~qRd{)rBj%np5h#A9whm5ArXkQCHxVHmIV2{eZ->7gn9hk9XK&7p%m_ep1rL4YmVV!gUm#*UTqw zv$dzO+YTe&qYc1PP>_*3Q68MMh02S8<8k5qi|T!9h{a$?JEVL>YmCgjib&pXv`{)l z%0AI=W(~_wQ&q3PU4*UT*E!y8x(wz#>!ve+)t498#p$*=CT^~W^z4lW_Vr3vho`qI zYJ1G3*={|t+S6XY{dCZ%-7MM#?9xl}%2Or)03ZNKL_t)M%e1W`b6vFcxSvsX#VQ>u z)^!1QaVY!ys^7UVTG&sAOvK%-A)SY?Z6S2$y!F|Bqs@IbU$mp^F>-syI%CdS!}d2V zT}s*8FSV#r9m3;kTR!TOe*4~iR6Db^%+@%qjq6a__nd}>vhAI3J?5j+5ck6twzc$+JKk-8n~MVI z_D1*b`eoz6Sw~qdR7+6LQEPc|d!uQy@lns*NB6NY!ZBwhfKwJ+(_;U(TU+YSSa;h5IBoA_O)G29^Mq6u9SPOc8)3 zX;*dzmV%MwJG>IWGTSNuuqJ~d0svDvwxk`D18JVH>oMfE8XDcm&&7KSUUxE7L=3SQ z0GW4-+TA>@ArcJm&1{*IBV_j1vHs!_a)(=p2E7b?5WrRAgzXgu+6ags&}n>P6651j z92P~lti@x47)~TGHa>x|#1L|sBo6m?@c7XK?CxxHVs;UbaJVg|Kx4wY&Z$#j-kMgu-S{9Ye} zYXrg!z>7C--o;OT@^`p?{Y?g$O63v?`8@y5W|P?5UdO?~E;5-6mX=@R;luB^zGATo zf6&7T)hQ1a$pnQ;dIm(Ib(%*4i7qT$V1`X%WP|}U0xmoQXBZnBLBLN;Ct@NIa7klN zxBG=KHadZ9CXWXXA7OQE13P<1V$3GS5Fd&o5DxGyf0U4(#+&|8zbI!DCA%l!jB;Il z@%=Aw^X5$kJt$Aq{=q)~CU7Pk4s-j~*4D7IzmIILfB~ljYN5sikB&81MO)DVjg@?296D7tZy!U(svcd)*`iNk|Kq|+JB zDdlGXYXG&{DFavptQ8AIgn}W2qajSqOkiws42coSe-=YD65{YVN+i$u+9;3N&=4ZA z7=y3$8HI4}Z0+II%VnG#3GmJIWr%r2Ij<=9+VtEE#>PjH7)|j0n&cs!N}^IJ!%sP* zf&b<9N$_vHZj4WvlL!BF`B?|JcfF;%-|z|Sj3Q< zni@x~QbH!3M73N(rUE2OEg+P@P~i^!Z`7$3 zwR3(MaZ}%ycKX3O7ZNwVxs>5NEq+Vgo z%>#T>scYxdzB@4p!CbXW;;!w4Bg|iwQDbdFRtnHmY%@J4a&}Z}czBij&VQ&MWx#=JCxtz{sd;9xo`X8%|`{#noTJxE)32j@+d&{l249 zU%SY#{Sj5r?tF~rJEp$Q(foustWA4iD_0l>sYDn zqhq^zomyetVn}7I&4K}vnM^im9SEplHi(*2`A*Iw#Nmeq^NLQW2UH-BjhLrBP_EA- zLJ}V z(D|;pO~K6$W}PEnddG zx8KM2zxW|$XD@J`DPj@OSZ{4@Vtr#3%PTK&l04$Ec(uHSU;p|mB$HW`N_7Mx6p9w) ziKMZn++PIJMJNGyAOL^BkI9J%jExhMXc#_!fI%U;jc#FK4g&*c3`7tJQLU6vuT~HY z1aal^Wi%TtEHA&ti5SUo5j-767t0Yha3_JNH_PrTzZMs^$qMFo-iASfHrCaT^c}u5rJVO zcf>NPR>ZA%tws~G(^I&1^)dzrqX>rrs8on)>fu~Y2?`Yrg*h=fCGy|fKfun;9(Hzi zagt2&&3u#;odAz|ok9~U3|dC_wn7S9&1DK4Hu$^WeuHv>!W~appv4-c9BCnDJWWndacE*B8e;ZfHk&~Lfi zAJK3KC*7uz-BNfaLK3hN2O~!a=@u zkyv*0EU~&SknEs^TBVF!E`wygj%48!@DF0~jXRiHyo!;T3n-s?c}-Cx2_&WE-#i0O z36P{Ym3i?9AP_eQ5{4>%3yo;8IfXv4K4ZX2!X*Nz$1t4Yj*G>EFLgKRAE=Qxp zIEb<1TW=MMie`q(%8iBboOxiRM_D=z!p)GEg2*soi44lmEq_GWALVbDhc@~%S1-`= z0W8qZYM}M37(a2519el~)vIJoLS=XUJ%td8s_ZUn_cLebeyZ0VUJIRUtN8W*heK=$ zOII)YJbNuiMK-FOTFhN`_9lR(#LB8tK4>~*j#cH{WQ(D*9_aFF{hHooe!sb}96m#< z8RMnj+a;e*r+L!Pc51x2qcLR3UcBqX^cF$&xC=9>t9+gJOScV?t$*jOupJn5DoR_8 zy#=I;EcMM#k*Dj%o7==rX$E&-^Y@d|K6Qd~i2Hb%eb`LHWM>^Z6|?o6p>-`)&^Fm7 z^TPbnZH=@YB6Sp-{_<4X1v#(=&Q;8SBtZ5ZmSJ9OCN69q;47#u_wjt8_P% z#dnZQdeH>iCeC4mwBC30uEQGX;2-p-DBOqH8kY_Oe7?jOjml3kG@9JNS?ko^4|P$YVB z_~2vQym1>tLnH9|=!Qdz?rULveT@OE&8>Ch3mFa*TwCA9*I(1EeS0`ONWvo-ShV3M zz=r^&7*3yfm6+Cpwm<;iFRLW)U2Ql0z&lKJGM~Te?0Y4{nFXW4O@oX8t z`|Y<#r}7+nM{`Pf(Fpj7#G{B3n~QDQp-b|G918gY^4To29O)KI%DXi*80Wqb z7)RlLxk8ECoX_O3v$ca_u4FJ4!C{`0Gt&%^CB{a%ogrq$c`%k3#?;gl2IFxKVLUiI z!uIYSUM?@=IF)9AcYJIN^9u_Mpc3oKH_$@R=fTME5V!O2=!oSrLEvM+3!ewbWiv?T zs>qd_fIp7eOE)ln;R;6Q7E$#CP_9%Z3MKMhol@>A0(l@l;rJ1mWdMVIG z9To_-l`N}(F3rMHxs${fPC&&(Yn19~kAO1#My1=G`zOUrlAw;VNy=WbrZ${s{hyMB z)D}HsjD=#;Ds<93%n)NC$4$Dy!k?i3mmzevcPq{A^m`0zq!KoYDm3$1+XTu5C0W7x zRod*SFm&-!6EGBSP*&T@yD0i&Y}mPo=!~*~EC(i^O9PXZ%m`VL;G|^pnn;r{N|rC8 z=i4~p<=YVz_^Clt1A)2w@7LNqMmg^74qQ*~u!F;@ky^`_=)0;v$V>0fmv`@IXII^A zz)Yvj=`b1V#1I)%aHS~8f*PRZi7+<8WTH(v}qD9{_Y|hsjk8~vHSjOHQ9AT8~Gt|CW?oUs28ez9p?w#ME7=CI-;|Db?>fw{m!MW*U@>0$##pR9rv*H)S;MM0W1}EU^>i3 zxAj;U$+_FONK%>DHwW&wpPB%cayXqwnHG!5=#63XwI?HeUZ>5qHX!yKg=YIqCYCsb zcDE|rM%f^@gG8t4;yKlu5@`#?ak2Wta$`&#?+6L8PNyBZ)?gIq>&T_2MBtR(An0(s zb{og`S+aDvX-XByKUD4z{Un9-P{<&K9V(DZ-HND~5d68wd8IcUG8BW~Cjl%1BIrl` zt>;pHFT(w-TM`*k)p>GS%rF{_1(Due$L{J26pnXLEoL!0HHs+bh)N^F?35B3XOw*2 zi^auDxU{&);eKOd6U?AWBt|ekHjbd*&uoJ2?M=L1d5JH-{5h7FUtoABj_IihT)MQ# z$;K%(i^A6k5To$HiHTX^i6>9K<7C_uVJ*%@TBi)I9UZ0c^3`jst!-j`a|^Y4gIPutj^*=vIj_=iVi+T%34}u-1Oh$=PlCZP z!jUL5$i~OV5sgHcwO1_UkxivgEM%F9H8MQNx9eTGbdf=iz5OFBEwAId=dX~?mQkiM zqY1=^2RY1-SXX|3fJ0absBAVHIIW-J@bHk6cYpN$`}pA9_i*pt+dO8J$19aip-{*p z6b$g*V{?=GvV*nFZIr904D^VwNDse*7-b}2#P%Yvq+YFZ4zY=`Q7p{QGP{VtIto)G z#@y9wH*j(B5~inTDf>Am@?Truz^j!NJbd_we-ju;+g<`!2yA8WO?)6^h3T0| zj8BXp7K?K3C`wjN;ia`|jhS);w9QV>Fn~pErR4OLat+U)FXK1A{szZKX=YW0q7ep+ zVhmhG7&r_B{R|`$=YxPiO6Xs!)R+ZE;3d72Kt`Iskx@#*K8ai|k8C!NVu3>Uve?_* zN4Zeuu_30FKNP^l$$ConQfAfsTo5j&6)vJXZh97aftyos?fUfbz>0bf6Ogte_L zRBLr+8P3kpm_`tyHBc$ytZ~Y0Fq#v(!IGF*#HJ!{vr6RJW2J)2_&U_J!&0S*f zYIOb*PJJO%Yo~(ULLejoxC~&4iy7<;EXnX}vr7^T7n=+TlFB6S{FkshN^di`C4n$^ z0L#*kZGN^^+3FC&vJ%2}Ih=H6kgEJjRt`gx%_VpsrX{g}9GfoWKZJ5-wyTjZlGL@j z8PEn`X}n3Xf-N7<+K+Yeiyg-@$|o@qB*XQjewcR7WZbHjw}XY28Ki2N#l^S67#^45 zkBHaFTZj!{QX))-T{gzluxDmyqN+>%R=}DTBTe=dZLxo^@>~J~7Jwzat8+PT{TJ54 zB_HYU$^J^&+}ge$aoI44`O%JzG4{4sv~50JHmvRBGHci2bnp~1WWLWV4D#_;xPa$ny&K{ox6*#y@?x2jhs z&`{(Ug;(6y^ci+THT-1fVPra6r zR+5f_Zpyv4O!t0U`y})`4g#cdYDar==I-xzQ+6)PTo-eb(N62V!<$uuZNq6-PR>!a zjfcEtuG4Di`mAe{x*%rSjEY9PNya(Us(gE2ka%a%*4YQMQEg_-__CX->tSC_|3<&U zvF4oP{=rNce|EuOV99n1UC`m+N~+y9AHvaREB}Teds5%gC#t<7q(L4|$)e%}Sp|xS z-U!Uc=z$x67Rj!WM0}Ez+jP>qXSlz`^QstUv!2 zaqlT79}kE9IBT6EnM@&9D5F@eVQ_d1Q&ZCnR8c-D%KtPwGl!AHD2Egh5FxIBKf`z5 zJ;Jx&eub5lC8W|PSeT!|)Wj%;;}NtPlOBUj2qXlGl)fr-iw6-C*w}1j=AkKQxlk;7{&PL zF#KL(29>eAzJu?cFJt#0jbtjx>@)&nC`^&^SP>A#;i_k6sMV^R8;cU9544)N`{rBt z;QqV#-shh&J8FAp2bA~h%1I;ESZ=b}a#Y;%1GDx1JaC~&k|6M6p(Q2N-@cH@0wml4Qo#)FkDM8^`!)f@Pza%Zdc{ zl$<{vrb8AciJpF+9D%AXdX4;k0ln>XAFP{;~H zQ=o=!gvis!jj}HGuzO+yGLXp(_fv-~5~$Ikk96~@XfKCRGUzAz%e|D$SY<1PeX{&a z3*a(ryKYQ7uUgfst((;QmbKHyNv6rP>JUX$?6~uI%We~tQBXEgKdVi>^fct*hd2-! z(3iWIz>+kl7Fekot8!^cpF!Dv(PDAJ(pHar)=WIF$|%MkkLlgNR}3sS*RyRHySOC1 zzfz}5c88&po86_pb3M|fu-h)kScGN^I*pE6uu7EMHi9m%cXd7;A+u%~tC>b+Zf)=9 z&|G%P{c*c@-_J1XGPeH^oiX2G^~V|i+gomwQm_=H%QI5Bv{S^KJ(UX0tirCMExgFI(_kK9PwM51JIq_*f(%0U3 zB?gw_w^&f3T9?{8^}n0ya42}wpesera;w&xI?2#V-Plq%u93Gl$6WJvLAA=AV*;tD ztzXKZxd~F2f#Jv8)|Q&PbF`_447;0m_lN9V>#&I0WUFmZy0^$#t?hC3rO-1y|GCvA zhtT?}zqMe#t-mMit#eOn>OeO-cBoB>c38t*fSI1aMHkKB)?vFj(=E5RR2Aw|209dT z1+aLDC^?Ypj5aD#zi|@x3wfICs(IE15Xt}x}C zi`vCA;+=-Y(9c=oV1+02A@weyBW~d&c45;_xyI70lUS$8Fx9hm&bdP}#Dg|mj)t0& zpf@WD@KU4I(JoUS8Nqlm^}p7J99AQk4oX%ye2)^mt4*Ig**E*in=mh*joWU=qTBzd zE|pB4cJktuK((=w8$8YIlAV<|PO)h6t%d^VQnwhkgI)sEVt{}KMKaE)O_YSXTC1X# zImF54a~!Qc#q^+$*+?z47%VyATky`{4@NOIF^jp`IR>wYX+j}h6QdJ+i(t@4teX~U zwF)ZbB7XDRFY)W&e95e$0nZs`XQwb64FZiS2AVa>s?GU`DDTqx+B$N@Q+)i{4{`6^ zPjT(WP0m~N;L$@2j|}0`;sp*H+~22U;jgj1vyD{h1gSKE7?jAH!qS4M(`|ayIAcv4quB2!z3NIxd_xO-ZWpH?S zg6*As?Cl*PoynomI%TkAoWjVaCJ-kUPdJE1gYrl}tpqSV@)Y@dOO zhDhAqYT@?v8+iZzef;oGf55q|C=b@_wN<=&wZs4*-QY+$k_ddP)SGCYQLZSzNW@J* zk_2E0j3F5zRva;%DF2ezGXO6w2EJV26vccVkw_eW`IkS&C!c(d+qd7s(9jSsm8Z|2 zds@XJ=;~Jb%7|U;OfS*xEkC(eWV?{}Y?2Cj0@X>lRHtC#~ zt_5ULSq7$Po%@57Gb@0(`B_|Eyo{5>BOL4T@$Q2n`NlYwr*T$u#E*3;F{XNhB~iPU~kJ z>C_3b8Ip|>1Ic6KV|2R&%7r|F-T_2|endk-37w)C8|B!>QVV~LvDpTP^A zN6@;c!dXUHHIwm03ZNKL_t*6SzbyTTHK>4)+_BVw*z0+=7&o;_XZt2#C{w{ zQJtG--|m^~QZ7!Ja?EUFWIiApWA@k9KI4ym+ihFSeT$#_B%98-hLbyOCi{4oV>TU6 zxQw@RPHmc4{$aMKZ9MJjxSL>`GGsZ&QYl%YX0O6F7M+CJE;A!T|A*AN~xb~)J0sDA683gJiNmt{TF9F`$4YzqFZt8X0nzs#PyU=vfC+*|k zT`{>bu!ObIRoS<>ZZrG`EFh<~GO8Ev?KDAc@sm9SrjNzkt%!7D&Q*(>y6vk1b39#? zfgZC?8q{rZcaQ_ukK5<7T~3_F;k>rk83;ztcdnzSj&XUky%)XsJzXZJ-AoDqCqdZ0 z*RcmXNz`a(!I&Y0V$C}>g1UlS-LvE9NjH|3;Z5pVjSxRO1Is#frZy_}4XaPh;&CLg zbTF{gsi+x_(U*wJLKd*&77}eOX{$YQJl)iSpghSTm#6gF+}Igd-7K5lc-e$rtSReo zosvMy5IfpnO9m8g?in1C;SUPHlACbeg3u;khVK!;pic3{8`KH9s7Gv?tn|r>9mUT` z78SKg-9$)?81a63)<{+_+a<)!+6XEDO8}kLyoDIx+1N_U+e}*r={3U}u6e>0}7=!1mj$G;xA@3Q6hXxtoNgkhIdF3^d=@Ra|{UP4_ z;B$Qb#h-A#DGDPT86Cle3v+n!;wfIfq@U+lTVKb~@iB+e?H^=`e1&K%B*N_myvSv8 zh=rs0?9N}j%wF7bC=%gY`sil8a=DJf<1`Kq zli1naM>e13P%;9sh_w^v+)yEA;Si`qp>LE^>E7G-aOKifOifNBlg?m!a~<_s8Legw zk&qvupqIfbucrlg{5VMFu(o}Km5n`YZEZ7qiITxnSR8>m6aq)U75x@rg#is<-MDfU z@4a)Mley2#&M?Tevicg&o;}6Ghu`A)i)S1@M_@)E6ooGkVgQTkqdqG6357$PXNy2M z0*VOjAuxu@QBJH{wSr7Kjc_Q2pZxf5@V(E!kGI~si{arR2C9}|32;P~hS)k>Y2 zW5lGJUzp=$`xh53V0U{Lo9i2R^xzTa^P<}#3CJBxBoG@KM07CD^H1T7bSow$z$d*C z3x_y|6@>&68;kOCl?r*j>99HAL#cKOg0%c}`=SIV37{Jv8$ltTLoSoS$?+lT6iP@5 z>j|);_30a6X4eSaN*Nu&Nw$J&(~H>H45Fixh>T95?hT?QLtF{GA_f+b0V$l8=A72N zO5RQYIq55*CyYZVmn;ZuLl|(9AeJhl4^Ko8pXKuk_LgY_+x!d%fMq{)QI-M_e$V57SRTfCpX%G+?Ym(AE$Fgob=}aJ>%`$ab}R3G z=4|z+(}q<)*T)RC7g6wO=c(ydZLiU`Z2`J_fv&)+8QSLFj_$j@uJhA}1UP{P*F94o zpz^^RhL%D zYRu42ZGbvMUZ!U6EfLPn8tv=!u$v4z*SaZZTA7Qzmu)+1{Vn%h9RKy%&F3Pp{Y&h($oAEa*>Gdv4=FjnJqiAB@t9P1Vf(o$G zA*Tw|B2Z2;Cqx40CI&ndTIJ!eBm$A5{sANpcJTVy1Jnyicuw<3@XdQ6l&dvV>vd*$ zjEqd+%9ZPwpTCIt*;xcARPgK!sgo1bY7I{6Jvuspk&zLcq)xE9_8PzX@>lrgo8RI3 z^(&a4pN7wKhDNP~LMDk;qrzch6asd9e8M-_mC6mgbN^#}^zj$?{ttf0;7BH$VG;NH zJsgVo`t>VpZEav}eUm}2-MvGkGc_&~3<3UN5CN|brF;qTNE9D^_#x&N<~R(DZuO&E z-e~M7)REdc7>~i@Ib$HDkk4XpFwS|Oh<$Y09KhDj0k(Dzv3GEcbS8t-Mjhd31Y-o6 z3=eYX;TeYzHc=^8IDz;5d-rkkjayi}cp1ff3H!TS$fS>v&z|tjiIn%KT*~9LUSYOO zt?5Cv=|M7ELME5P8K+S9Fe8T;Z3O7>WdZ|WaDy0Hg?t`ojTSD>FW{X!_wZML`InfR zpJzGQ-KX%!b$s>BR~*Kf&1F%k)!_>S8ARdyR20r9!yXCLpgL(j%HLnFf&B!DR%;k;H9jz`JcdEKzS9bf>fT&g0M&4V!H(a}*3@q6RObffuC+Z40sU<1vy_80h$Ax z>#K=UvB5sOCXHUTtvY?COJi`?dDEP~O*5Qh*_7Ozmy z&&k_!{_;kmUE9Sc&C)$T1h|jOV-8rrzqR z&RRBbegNzDa177&$hiui*H5yScO+l6zU&_6pwK_(hE&noR6Sjtd(&ys&aI<)LNd)} zwe{DXP1XOfxV6zf1J++=Go6dY{Y+bqqe~a~Bl)@h`kYhWOWxf_K`Dz~$cMdsO4Zov z)a^CprNd-88)MrD$S>8VLY1{`kffgKI<+pd=^Rs;A4eGyrMO*D#ty7bdlT%5dE1-U z`Fq#t<`2bIN{@M4ANrSX8+oVm3+)6S%gUU0w51ZZUZiKl5rU%(wAK~of-uFQtp&X@ zc-wVG*R`eFWMAWMTBy@nvLwzadz}|^$LVx@;kxE@Lsa3eT2_|sr)(d}M-}N-w8Jo* zpYzj4d)hJuNj=ohqwb2V_rh`+?v661?5kU?wlCR9uat5&I@uYk^k z1I-E|0l@ERhy>i#I{%KwhcGw0fE(9u;>zV~3@9AzY-4kE6%W7t7AMIxZr*+iZ`{0% z8#iy__~ZoNJ$r($zWEx@pFYMr_wL~G;yfzlJgVh9Dy1BXlzcsx!wKaaI!Q5OXTTH0 zhaY~9Pe1!UzWCx#_(nGZM@~*oaB#Sbo$U?m?QL_|;Ks%dzWU}7c6JU?t~5oqHv%{U z0}QU!E2o@P`~COd!RX25m-XW(TUweA#9X%o^D!9Cyy~UGK3q~E;Cc= z%oD)!>rJd~?BY0;VX!Tm&x@Q$gK@q+Z*(-lY$XD)C?S137Q=h*zK6SS-Q$}N>$L`w z$NSjcSi$z@YaHxtVSj%QM@I*ozl+8=Iy{Pr>3IzJLpbwz8HC_O+@}p@h0*PRB%+i= zo^oP^!vtXE(5N*qH9mzqZ{EdEfBX|H(Cv0OLpGa5GJS%tzWxdiA3wm}{w{|W5(9@q z1u5CQ$0Kr7F_`Hk04vBcMB!}oJ_7joCcscg0wWEiQYrX70et?+_wfF^AL6Yy-(rD0+Qu%vdH4j6pS-~Hr5A|Bqa3103@i%iB<7yD zeNg0uqdaTWmRjwUfBXF*maQAtuHx;xcR56HY;>IG@9^Ld|HuFSf8sY^f6X9}KNQB` z5V6Q8k$nKCr!}rG9uqeW(po2|h(JsVBTNhrGqW%jjpAT`A3J-8*xcSlqcwmFiA9m)<~VcobE5QEm;O z-lTj~#DE!)3@mlaCjq!XTOemT9BJ;fRo9?R}_QhP5%Zo?x>n{Yh@4c^jh*fO72V zrA<}jhIpvcY^k_k zRlvC~QS}?cWZe1C8FlU6H-(NnJJe+(q_vfL##o4Lom0wB906Fv?ks4%&+KPA8sf50 z+?w8PNjL_iZG8Ay=VqnP<>6M$`2v*-#crbnB4r59WklU2_4LgNqJ&G!Dd<~LINLUVX*kM`0q zlG5L+m{UsH1fZLXAsVNRu&YS-YJmB4A9kmUva`PGJ;r^!N%qFQq`l`|m)f}&dfU?O z@N~yfbx}V2QI`()H-Ej?sT&o)|8Z6wbv)r(fkcqp)Kn)m+f58zOvi_m1M8xd#GO~Y z;pi*1VLzkpXR4KQq2H!1Q98>6vBdWlyH$j9u%k$)@zPPYVLYY-V**&xx3NxQ-3El( z;IekQvB|i&Xs7Zwgd=O_=CE?+>bza1=Fp5+tACjt;&Vs24IOzh!r}hPRFer zJ#w6Np9D)pB}>=kh$};^Cb>aUA%qNy(M^N;I(p?@h+Hz(0jdD7tfA9e5DAc3dCz!x zN*0C5z~YUA3|~~67FAA2j|g2PW(GBsleUKg2-Nc^9&RDIxs0u~CHOooL?g7BPNP_^ zV!-Ri;9vrmE?>p2QSuYdg|mX}^~g7@n;Z{hxXAK>#ZzK>k7 zz&VlVHoD#IbzHl00TW{hWYfnemvU&H){vtx!=ob{9w%{}Od~Nej)jFw_|qT!8Qyv4 zeay`*a1wI@@d)tQ++4#hgFic*8|&yei*3$hJXY&XntBvk${`nGsJQs#>;Rlgt0^n;Q(b858)`4!(lSV02U>4r#9Cc zO$IZFfkhw|<&2`l=aiRfFc!y$?|+E9cizDp*Kfh=37}faVRhv>R+gUP`O`;OdA*F2 zWRerIdjkQCP0nEU!XiMSePg6+Qj(CINrK- z2Y>U^zrn=|7kRd`xeT-59z1%0@18uy_AY^bDP|TD6Dk~yf^tGNn;SAU^x(GrafC`*`#AZ439vE#!(Y@>&++-?Ll3qhM0TPRAdU6UkZ`|Mz z#p%fjz6FzVW1SqI;Q#th{~2FBc!0(k;0uMA-4%&Y_#c6M0&J#mS(43Kl>oQ~0t9Lf z#V|TD!r&FpMfDe(>UF%}wU{$ola?`n-ao(VwVVkAn*4jC@-K?ev zg%u@K__TrT%S%5jCtmg5je#ZnAZg=Nb_>$G(hOT}fb{NkWQ~E^iO%ppR|_f+Xn1Vc z5XzEfVL2Wul$}eMz?))MshO1t@m2ded!+Wflls6&v9HNynXR_5p+$%6_aO@gRyP1k z`@v?TWM2pF{{2QT@83T6MkOxw{qel)e*83BnLfN{VMBn>3+XI{heEpOlM4gILm3n)`lpL~XvgT1;-IpSlss;dZo2 z`R8W0I{C`-QSCMx<=P(UDA1io$PR89YQ6hzuB)tcXoRB)?SRDjC8E6+=g4c9ppI?>OJHKUs3I?5)y%H=R$*%z^ljTPY<7V1b$ z++{(U_4cEF+Vxr&G3`g3cu-8Lwb2R}JE5x72C1J$TRc2>-E6DFB%I!W_`t@$j*1Ai!%dtkR*4p1; zkb>;3aWtiK%Q`qKy+=YCVMjrmjdtc=_U0W2elyCvYp06A{L>t|Wo8}GDT z(tRY>kKxn`-6VDgoEV%U(o{ll{=y!DsJtXoPF35~DXcKBv9o$5n!5NYFT-@jK1p-9C-yh zF|}j@YCSHp4hFRdBr#9EWk`tm9>u^?3^@j%_{3dmSb2rK3O`gKi#7nu%*iEB)5QtA z%H1Us&rA8B4fJ3ngn@DjhpW$!+Fr)-{x*ER0mPy~93Ji?lg%@DH8*z=@4hR*ifdP{ za)Rw#CXIjizyAyV@&EmAI6TVz8-*iZG8;{2r z#3IHLfibykjsdKXKl&7J-+hM}Ym_qztvZ%pKEd;6kMO%+{{l~+KSMU3{=6ppxec!H&s zHN03}#p~Cv8B8SRBeA1su!59B%0rCEGX?=`)w%%CD3p+Hlk^2JIXQt_H*eyj_ut3F z*cj);I<21~lgZ*A{^7sj!Q)4$o}R)J2#WB;aEO_2JQrsqI~A0QWd<$J&}0CRz|8US zF+@UPPQ3r}#S%8QwwZku8yv>P#Y-4e0G8i}px=jy@exc~?XP$=e+t9davaS@4`%b2=&4W3X0>0%jW4j-hh5s2XBc@npn8X%M$ccsZx4lJd+ z^`1^|YSm4qA_S4=O(9Oojz|EDz9e8&0c1j-N&lD$JPME(pK0*RVES5i$ok%7h`4(~ z_Faeuq7=i|B}~wjA#8*dYWpeo#LAY6K3M-OW|;U)B#}2+E!Iu5rbX1Atz(a)WJ<8n zq+K%}w3t{*6Icg5;s38dC-fw=}S zI$qw{-7{-E&!BW3c55SH3A1q2q*^i2Z+j8TeO1a#E;Q3=wE6t1$u_6CM@Xk^y0aeX z#_5hp)!5e2wz2Hnm!@`|5AE-^2*hw&%U1i-E)Tgk(frhH?kySrLl>h>Eju=5(%P7_ z;(#Hf@)qLL^~xz57sSCn$+Fw+HJjtCjj-ye)E_;WgVLzlFLZORZZ+C_|H zvo8*swoTvn)(6h!cMQ$!*^YiRpi1Q6RBH#?esm#k19?n?smM=an`kkG z`jNoSEMQ9?QT=A_3bk?3kdJ2f$c==}U$N+$N-tTykhHW80L$z@da7&+y?v%l zJ)sy_s+1kT5{AX@x9}Scn`8oVmdmZf3FYR=4sI#%$_U+1HA)BEc`C2KBh^mM;p04& zmSRuNKWz}zskZ8X0+eWzp*MLl^ihQnaw1^K3{$reG7x5Nc;x)4_ghKftpx3AjI_=i zked?8b|dytBe?svbzcaI-28z>TsV`^#^*KWLl`}g1D(6^o4JqDo$&gzJUeHdufvA?^C zTrSIOjdVJN-Q9f#g-((geERA4@Y$zd;PcPE!1UA{_74t_&89go(DCsR4i0uuD&|lw z7X(Y^w1sL-B=zlHN5TJQw}hz|`htB4pn z1Vj)3;qg&;p9i&CjT8EFUN!phibT;gM{iy*((%kM50 zO9=Ucc=z6WxOe9s?!5UHk0t#}rjpn{JiyPt6b!6`qeIR+Mep+Y=+;9ph(ydQ&cg=E z!DS_ym9q1CPoq%jE1?cqf`c)+xvL7w2W7;UNKWI5D4%* zFn|>fGN>Z@QRk%X98TCeV}Opp9=Zwe_RX94?9-1Kz@l(KugAxXs$c%krDbgI?!g-fAwHDA z%-kF^*64eBPo-4kyl~NQ5ZA9<#>B)p&n;a{u(JG$*CV~RP%I+X@MHYq8yK0phQY}> zij_sKR6&iw1_63g=Q$S^0ota~7nCFoMA4kn!G?0&MOkMUocK%tSVDh@N|o1R+MpIQ zO_c_=?_i`3cNjc%@S=Qet7a=#pmHsR{xc7SP0!0Zd{sJEA8Jc|=VX{^*VWYF&VzH~ zo%A--6|n#<<3<(bJxlwib+*G*vixTYP2#!@yD30E`vI8A?A62v=i!oOV9BwP`v}v& zGRa*8VA+g+`#x3s1D4y~j>f4&C8Mr^yZ@nI2A0Dk zY;Qw99${M z88YY0IefZ%ZIkWX^tw+_e;W(i3T<1irn=KTcB%MW?{bAn`&q6=zg-C-F0$5E&Nd@L znRgLU)4cT4LbYmo)oU`=Y_E52p!X(n^6F?Ly01xR zm)nMfeE>)6v^DEGIsjt zr!LZFJzT-y&L+b#Z-ygjdq#VFhPJjZ-Hvupn=akv9{qFHYg@#fdScf_J=92lQ`HMS z@3R&zCS}Tcq_@pr0PA92j%)io>CguAMA!~@_0dA3UZs=NAqm@JVP(YfwsK2}Mp>aF zDx^+_HgI`UHXY%7vd&IcTf9@`$*@U_aRSdRvdNTr`=7n*ZYSjG#9oxt_g?AusZV&z zMtwDMj%fy#?x!_ARIkcC;$(rTutw$J)8B&CAo@xhdQPw{V^o~sIOa`*isdE7LEKuX zHYkD}r??B$9dAWolZSv2&xP9{u?!0vm_uskCH>RC6Px0u%H~85<{}VPg*Ku%kfbofOBt}LN z4o8_ubnV&=4zJ4P3J8b73|_TP%P1E!*xlLWr0mq^WGcmp+YgVDNTqZ5;)@?Jc=i5! zA7OZCgqbx2q}5I%j7K7>rZh=ZdfHnw)KLoBI$ zk#C)&5H$jAh7&{h?DJ3YH$VLeM#n}OuvuAo#UYOMYMxnAk)U9vCE{TOJbYy%8pPr` zZ6KQ~;wW9f?okTmQ_4pbV9WSW^!6wVh6$Qu(Is8q^mo}OVS zp1}1hH}IoB`w`~n7dXdRwOmEMl*5CE-{SGpN7&xkMkmiLHC3p||Lb&_pUA+C)UEF!=4idu&UKa$A9ULFxm%sUv zb71Ws9im*WAWXmz0di;HkVLwXkU`#NlW#|)5I z&)vLn9iM;t2`0zKIfqs#L~U!~>#x7z9B%8In|z7E(9kgJ8)AnQ^Fi@Q1?~9TiNka4^U~Zsz2e!)YmWmGXQo z%+F(VbcDk=mzS40l#@U`Vv&_RQA}QW6N7VC;f)S+m}#j>w@V5pDKoGrz|jT365zSK z1y$aJYUwD$*O5M=8DXHp@I-i+G8aOJNsNc}6#=rGYl|;>_ajRzaut>bANS=zb#IaRcdK zLTGo$*wl5)SKGb?Q47S~$yL+X*6ns*)F@)MzMn~H-w-(8r}i{$pBrN=l#FujtU7Hc ze;Onf{Z`6HInT-!Rt~YV^}1)~^mXfE`+!?rFcgKGAlv*^cfoZXbLZ&G{eV%ny}|BX zus&7F)Yc4#4A>QxD(RHuw%t|7o;l~u+L`rNNBi??cHNS>8}ia~tYv|&qTP?&J6`0z z1Ut0GIX9*#xXzZ?2bu;*PK{N%Jz=CxSbL01JK;*a%(iiKRcwy-I*nqRly^XU)DF{a z;dB$3PRgZQe@&*RTRDfHB8nKw!1a53MQ#K(rQdoo#e^EJT z@-*6gjdt;$T#mprfW>0!SdWaU$lM$nz>;87kC9QWu=US{{Yl?j0E|NsYS~erw+Wad z!Mu6ut8|cE581#Tb7cxTm0YfNAk1V^wS!c4n_{kAt4gyz0a*#3h1g8upH4t)TW>0V zl+qz`RqM0~#(I%sr8iGf<*3aV-%Q8=l(>mdo#Ke{GDJ_Wd9nxMGqJf;*q68&O>BS! z1BDnTsxAh$WHNYB#=*XF$c!Dpl2@|JHqyXwqIm&r>ZCIaz7bQSUPd*wjl=b)@KjTr z6DwaRBAv-H>mnK%#0T$vj5}}M!=;Oh@OoM}IXT3yfAw?x*Z=3gqS-S=OVhqt( z9MwtHz zIyuQ8lg=TN$s?Q1@wS?73;g7hkMQFk|Ckex6Zo~gy@|v9ZIlXWluKDuOL>I+9wcHB z_y)xM(d~T%>Kz=NAXhrYKp=|9;0O|@nA55UjX%oqlG{V6!KKS4x+`W4bHx+MSQUazm=wAp|!6u@vI!GINw2_*+_Hi%Uw!{2H(7L9Ny!nf8%qY<7{ zVkS|(q-Ns`vB)4UFJ8e9zW=9u3n4M92>2?N@_6#>J3M>w6r0-{970HWtSB)%g|Sf> zA%Tt*=10Jk0yL;kG@g_ziU2HnAF+Vwr(7z*@Ac#M&D*$h`z^eE_iYBSNW!w2ERIsg z_{~?p#e>HWv9-I6LZOIABr1}Ydpry_Mk7&{djigK`5d#%2q2@|`v^p$1wc0*77BUp zM-TDnyYKMi*)!ye1q==jF<3=?q?;y5 z)*B59=k#%i*55x$L)llPxC8FcdpLO^^Rf33DNQ%@gaSU<^+17^}`XV%;sDzFd3Q+wQvvRaOWB6a>nv(T#u0LK40;E@di?AZr zErymRwhmn+9A>qN!_WlqZtX=3ACN0iHB0Bm;iKCQJWW5<84;ntAcJ~hBS;u$mZ~iZ zz_Lt@rC+CJu<7}9r2|QShbK;SMSC84>mjVSImQEb|HEc?Kd#H>r|nH`Gtk||bTaSE z$K5s(w(4CsK(eQuDt4)~cjt`_rVLnhd*(dOu<%zMi^}Mnt(ndtG+xyHPPZMJQ9*wm zzjY$&Qr<=>l)|P2)3*0;nFH&z*A8Ua#inz6oepphKi>Uo$G=PyDk&xu%ylf?51vef>#b`t6P*>$Azy=yTMR# z^x7C;H+|4PM!n_0MopI$^qfBzpTIWvT89{e*~c{7i*$d$xx`JiZPi;mN>q+OpYGd{ZFiPdM;y%mU3#~-?awKUi)Fx4HkSH&iNCL0?dj_yLuaN}W zsE4gHPOhy&x14jU##zak)*`07Q#*Bne6g)$FzxJ&fe6YERm!H2KU~AX`cniNIV6S# z8NfP8rTNyusqtxi`tj$uee*32x5{RcSbF&kzx&;<@yjoN!C_OB|A>AQL#S9NFuUZ^ z;uXxy%wuwL1|x|v#A6|BZNA3#)*ANrc9?-hw*ej;9AIsIgF&Wpv4Weo-o)KIZ{w3s zKE>?pJTi2PUA@ZS)4}0BwzoErPA55sRx}dE*ysq~)E19MIAoCkEXqxlOy`hHWsyqf z#eXN$Xf*1GMI-p+;}03Y8Xis{;16PRa}zr|8%Un)Ba=BnF`oftpNahg-Magx@b1SbMvh*xp>j zlkXlffJI~A3j{DYJS0Nw&Qx7=3nqp25uiovBntZrGPpvaawMOWG@cT`69X&Y58>j% zBEJ8{4=}%Qfp7eyu(?7hj~7eN@oM=cc6PU!@pek@Fo*e-D`kEc$q0Q< z3?)jy&Hz@k$zTs9B`1cS-{Z%%%U2o1y7%@yj3h>QNmBl=lk^F`dGr8Jo_>eToo(a` zc?5%Dcol#Z4DoG#MAabxkMd0sphPSqYRm9ooYz9LNer+O-$pnyJA?VD31(moN@i8L zdWu51f|svWIM&A^3xSW|*DU8$2Eq;#sTHO@uXOxlt(N;)M&GV{3kP z7LyZ`97ag`=;_m^c=+98eD(D=NM_QA#|KfNu)$QC6TLU9r$B&MaiTwT6XpDcS_rI9zgFzK@-NF}hZ1`Cl%Nn;)4}KO5~&u6g@HR0_{R`!zay4!Loj z!n%)rr+(WRc%9}=ImtY#9X6?MO?KNGcidzcb7)hNj*8o!??c#xUT@nbSbL4OC_c9> zT?e5vmb_gdIi#nH==B!Q^U3Ww#HU@_UDmrU6A`7!JKke zig1SkXwz10>_f{a^fQL-+Rr&4)(Ws>T0Uj(gu}pgQSs8~StZF@15IwyJ@YqQS9J=sCRdi1+GhjAo3(yY!DQP zWHO};K-`5H&Z=JlA1(^T29h~Ww`~T(0I;}y@=NZAJWW>{Kh=J-oFV|)my`@y)CRVF zge?}6cv9qNk+m2n7Gl-AVj24l@igzmJ5j?)GMEOON~#>PUmn#P$n3u5j>0%Y16 z5EF&|DQ1d35m&b@(by_Bmfn*YC)q}5r-A?(z@j`xk{w0h6*(uwAfYkhWXK!>Bsb%f z_}XMWD4>gOg_Gb0w_mnH$sbFX{G0&~$;2W6D;6Pk(EySMJ2=@|!v5+LgjxlRkBy>G zDkGWBVs`!lu3fsu0M_-ZH<;bBwzh&_{_8obMK3X$K!R@IYc@D%QN3DakZ5jZ z9=C4a!8`ZgM?9W@-v_*S{uC=KFL8Ldhjb=`O09yO-5snfzeYY^4u3ukM43#+Ruc)haB?>akca`Nl((P7-YaTO!Oah9xnv5ZWvz=_42Pk;d;dKKux{VJ!vIdBUXcLSDxQ4z z2>%~z@4+NllAMWsRhgAlnORy_mu}rX(<68E-YtYd?cEt*xC3Y~BWVQfK;u6kh&}#< z!!MzcXXGA0Xth`XyE`-8JuORXt+KMTq`78!Z(FYkFgwNh8R<_Q25$`Gmw)+JFgA7z zg+dFC3BWoi;q}BzOisVX#^yTqN+o9VP=5%#p&tS>`IbJ;DR$0!muqZfQ10OHh(D*c z5V%A?6w*cvqS2ud+`oIDLrdvaN@{1Rw9f$6(`Qfd;`MVZE-#_9UuH%W=e(+;8}%~W z5Bi~Y?3E}P{~-f9G^TB>EodUJD^o8Fq>FQOw6~+Ts~tmqy=cuhGN3~_$tbMz)#Maj zy_zs!8zqaU`iSC0|0TJ~T)Q>^7AL5u+ZZ!hPMrSEqemDU8NuLCVqpF4 zKm0w`H#gDT+{&yg3X45DIKt`i33A0Ea!pNaBih@WF*Z7c+qcGW_s(q$^!GC$_5AsB zeDmTpC!1eh-N4D|IZlpGaB*~uY_18#LL*w53utR8G9XLf8{HO3VV8r$Bdlk2^;tAD z=26$$gYK~h$aN2*e0s%lkVQwV3j^j?bd#enJT=S8T1*u}=;X(;WCRUhY5&)7B zVv3on_koTN#hz}2fu+|*Ub})d$*fuGJ(hq$W7K-5ZnqVtk=$CT;5zlX0;f!WMUJK% z7pQU<^eDl=h5>5CPyor`pK|MsPp|Mw!*JtuO_+Ily`@*oDDWS)f9BLxjf0LS4fpo8 z9ZoxyV@UXN?=R!!KME2#AM!j6UVP5zy9_}yWV4SuW?>nQ1OT?fo= zR_(hHx5z0t*tIzdl?q__7>mtJDXnU^lbAC$WejGwUX8r!lB`&BUv_H8?HsYS ze}3Z#-=`c{YFNYxl$MGEsGL5Xo5>y13Tt0%KAMIx=p|1G++r7Cqa~_rqjs$7kyB&s zL^@N5Pq4XoDLZMI)HUqtmMNo`YJj-^)JD!56^4QMwujqm{EwvQsVv?cMV+nSq*-<> zW-Me(Z0p_74=rC^w*e0*Sbz$px@*N5oo>cjzoFneX(z5ftzJ$M`MzWpvn21l8(_44&|{Mn!X2^JQKHMPy5 zefdJ3nLwvU2iV`;MR!LV-g)Oe+`s<_ckVsJ!NDnZcegly)zgPqWBUgs%+Al@ z)r(i082tR?oB^f2{yu#E#pn3oL%PB59_K{b-{0p@tci&UoSmKE>hgla0S9_JaQEgY zI$9-fk%ao4a4xK!(h+vb$JpE{V{v&E`+Ix1x;VpUpMHYh`pw_Q;0;Qq-HEB`X-rH` zFwnEUxsL0r3*h<^^$a4NGf0rl5TKGVdO&%`2>c@+?yH;xI91M5JJj>_44I6m|s}LDFJ2m^&HYi3@ZX#k^nc-dzl71TTO7W5e0+xe@*XB8Utwl;3VWp;92^~)8|Abe z<(z5CZXKVVa0nx{g8&|4TM;lvfDf_1iiH9v#itO$f!==Hy>k~IfAldrJG)sA_bD&b z?iOCWdX9;y*PI`X04g#8)CUI52)v>s?gac@U!#0*h{NM!24izs3Z={Q&4V-nsV!tn zTU%Pt-QJ2Dz1?VTYUB{hGh(M*USVo>4wF+eD3uR*3ATE5$sZ<6tTPI| zJf-lz3!Y1Z0|R*L!9&~{AII3}7@Bg8Y#|pG7V+}+Yy9Y+evFm1bq>p5E>dX=RWrzGkzcWo?)C^XB1#1wu;Oi z=?l+sWw*`69%6y{e+1-_El{y&1~4&ep$q0H#+2k1tdod6qUbpt=hvetD6Q?sLh(S#6>uHtyC9fy;Te>KA2H?x>(C)F}6#n z{!Ou|1gMi0)i}F}ONve7Ez3&h!VZ8vlV4GlXV+1k2T`grOkxG}*=A`%k>ja&ga#YN z?j4A$wKvU8wIP{S7Wy--GX}tNGgz3M-=>A)J35DX2845#aZyKUjcKRxJH@w%FtDn5 z*_GTsZQhd3gzt>Rzpv%f>R^_oyz9+$wH8~=Og?EoNda2iHdlDt?^;S(@qI*Om*OD7 zp}Vi!5Zgkf$-$9WatJEyQAEMWa2TIe+k?mlA%JB!wqd)h;tGPV|4xDhzVjV6KB~!H zqE@Z1VqrZSR8<*WNxMCW&!1=?m0heh{d-y$sU*o@6fD_^L~>>%P{Dh1l@Xl5K+1r=#01cxQ%vy z*VjQx*)^}LiJ`2)uDs#!$DFHhKKy*O`fuC5Cs$nCbo&&yFIe||081x8l?2dYrqwB< z1E#p)8=;8aWIPOr<+8Zc+Mv(CjbpAAS%aPGIXkCS^7jDrp~qq%mcNdR_u;a}SX&i< zC7YV0M2&n%<7s#9u4_sV$@*0}D%^pmni)QSA(PFITbrYBq9!Par9k;o&B(b|n!c1-EHdrIVp;45(s-A9X zlkhSPauEpO0$BVO3tLYAnbk!sEDBY;x3(J%#7bU*PEA1m{G0x&VkUGd4Diciwq~ zU-*Sz!1(wW=c`&>S>~Krl-!!a3J3c8Fg(zMk)b{`=NlNzVdmO3aC&xu5}>W_xvXbTLpdJu{7GFTTP0<{IBJmnG&7kG(Jl3H%`N zh;D+T+x;kC6tR1nn~C{V#~|0y@d<~iQJ$stwhp}i-iLVmtw*?b_W>Fk3%I&G<7Dyk zl*oN%5=*Pg96CquQrQ&tN6F1;jA`uXhB^XjD0HtON9?S625||bAT}JelfnoIz@p^w zy*+*S?svb3k&$r}6o6IQ-^JwAYs}5h@Qr>H3W<6F;x33acX7_i(sKgr)#E0+&hH(pP^!Zb13wl+}O z-{%D6bgLqTKTv^aun;qK$WgNQOSuJ6vok2!dS`13pwlXF001BW zNkl{E#LvF|8jH)z431GAt%LFrc6Ro#TPpE* z<%@KIKr=d8o6+6bir(%{^!0XgBKPj@E*u<`v9Y;_C*Qop^xPtLc1t)cA9C1cTWcFS zJKM3hx6PrFLqj*v+1<@!L7}C@Cc7q9ChE|bZ$`Gg7ro;T(A+uZfpUw1qJvv_QITn1%9W>!KM!nBwWq2&_F_JOUIGk&rC6+D36(9C#YAuyWz=;zApI?e6|%rr^fST}e$_d5 zO)>0xZ*)8-!tq~H_7~zB2n(6lFHKVM z+(s21sAU-(riyEn+{?Rbp7EcIUm#nmy7&I`yzlo^lD_LCRCF+tg;a7dD;4EAJL=Tl z-3*4>@+MB4?}7UYkZ{mb==#;`OFp4#m8RcD!E~+P#?@wX;E1wv8TQH4``MhC7=Rlt zrsl-+hBazL-`z;KhQ%0;AOpVkm-#(o{RDl8$y+{?3E=vpRv1ZHB$-%_^c;)(^RiXk zzPoy!Xi=pPstjw4Rc35Ouu-*+zN*lSrE$kA>yUj-uNH~tzm4_)8A0a0hI7GR2AtRt zUB5flp#iD60qGAqdjMtq)2)C(PLm=r%y*+j;=2PU^%ukQI6C8 zv~a-4q|<~KC9F7u$+h?4L5X~)dh6O-XE5FO6JuP1o`$ParKyqnU4q^jlg68toTfCf z8RS13onzWZ2@Jpcv9>K7LO8bXIoozD#HlkiYM@+)RhZFEpYzpx6FnX6I!wQ*(`Tg* z`V(KO!CK4eqt<6{6Qnm0YEs!_qDbolGaF@1`Ool4xeF>eC+i9?RIG1b60T3_EcM2B zi1`MZm88Ke4HL6J^>)m9xQC_|^(rJkkF80by?hadll88eNIw9%*hNaxru?c(I{2=&)>xOew1 ze*M?Jk6cp$TiYf4>MY@zTiAXrwlSQ zHy7~s+i&4_f9H4b@T~`EZ)?T+#v115W*KZ+US4LfqqDsk_im4&zo!F*JmqL=Vm8w$ zF|kh0u)TMHjqP15EUjW=eUtMoeel7D_;>&IH!(6Y#=y(e)HEiiCYUj_v%Ae~8e-lN zcqv0IIzZqU0Xf7-qR>7{vQ2Cs0-tE65v%8n0IUm27T=C{-+2%B?mgsuV3eck^5PUL z%X3&-c@F+8|h>5nhw~N`iX)G?z;qdSP$DI2~LeC`kn&jHbWQp08;V@1D zxm@s-o+Ge}lB^Rmi}Wd5mqBM+J8q5N#3vtritg@SW>^V;wTr3g3Czq+V`XgxTf4gq z)YUg+(Ohh178l(ZNVguIoDpm7gu@gGP$5u`7+S=zBalin4k`CmOQ8wfo$V;lO@ox^ zo`Gp_c<9>3Cf3&1v0K_lLnDO{N_Zmmlk$?~8gnvMJdT&xFYPnvN`2|=>BXHpcX4z4 zCT@<6$=IWg$9ZjIg8?kc%kLP`A0Yhrj##ALHfgX_OBLJR=!j@y&+B(z>`jW3aTZzZdNto!keq0hHs44nasS z=(D=!Zgh{`M@#=0GQ~F59SU(JFi%3Dubcw|Wn-Oa8D@<-c0(t1cWsVYL(H=-aY?OW z>LIbe7Sxcx%+Ad?P5u&~d@5%_lr}j`S!K-iBT}NS)L+5Gjwbze6GG^%P!0<#1;En# zS~mfD)Dv-Rx(%xn|I1wq)F&zjp#q%L18iTE&t@!txY+A`x$AF68O4GBqn-(OCB~!G zhge#&nt7+jl<}otty6W9cbVqT`731Yr`_Jk z(VIAz{_O*mVa;?WE>UAOug-bFd$cNm z?XHPgqo{qs2G7*&PFAHq)IvVj3{HL%EqASuZ;_PN2hOZxt7_LWP5n&MpFjtd(fGF9 z1HEw(<7EH8YI{?LRljEtdL;ub_JmC{rzW;WYr`EO8ynyogV5-Q?M^ct71YmZNDcCE z&HkAIbW%*;DHf55B3~ukWjj(`x(u#$SMQr3ME}u27trZ_j0jbios5Z^3?J2*G zSS#JZl;7Q_tetZ{Rlg<1-k!fBdoJ8BscdPbk1>Jwyp z;An4?vc8EJi>OpxKt~DGlwV;OLOE8n8jkP4GsUB5sZ(%uTcoy)qT9Zuw3`lfvTndZ z9YT_9unq_0jUN@M8B<0$q6InxMNZ7^Eq^*!h&HzpqN2uB*)}d$C&yLmmTSe_!*ga& zDEfk}N9VH9;hK(gm8_`!I;@bY(D}Nw+zGI7+aLf|6EbyISYMpQ{^~T2w&sz$*hf=i z4*5bWGk7{WdeG32#n)ec$;qa_`0jUcRacL1UcA8h)fI|`CS0AL;_UPg+Z*e+JiEm3 z&@euD?*shuFaIjGcT4!$SC8?3|Cb-)Pyg&sFg8Al!QmTd=Y-{1oE#rxXJ-c+>+1}h z5P)@1KHyvK2sC-?!F~L}AN)tW``#n8wYOkBH;Sukm`~6=vsV zuvgw?u!C7R>J~L-BV1C_^a}=C7`)0#{-_4J<&If#8O8Rw;IKEkL6O*3w{P8JpsXR& zh>MF;tgbHbEsV3X6IfYYW$=OCFE%$b5JqD~020+jY^8i-6SJYHJ)AQNl-&PH7+Bd1 zgFKv|{P+}|?H%~=!;dgHIErF(D<`zy+ugzZ;vANj7jbZ~kHe#5W+oA{ia$fhTZQ>Yd93O=UsnA!(AwOJo1tnybcbIuvgk+ z_7wqVOUp}G-`eDmIAUN?f`0;%c9t-T$cU3BwdBZuR5c6XwswT*#7zBFKOPuO|H zz{_NDmG3~;$X&GFxQRkX50J^?==2ol%*auAgKN>5r6z1pVPRg&jfHHBROqN?NjYnv zU>NGq!hCKKAB|hFb+dms2M5~vSZA5-WUzR;j3NeSotqIQ@0`Cc)$IyhwM6t1HI?&i zg-j~{^wwBY_W}(UD671QPb_UF3_eKzV9yjKUQp+QG;53FfW($oGhRAxw!QQGSIBU~$?4cR6A@n0xvne|r%dfurT>L*09S ztQc6j(1au$$G;YDDBN$np+hQr4z0jGF01w<&Ph|6%b7~W@j)Q#>81Kh)to_lM(T}< zD$lyKA$2GwN^!D+NnFX3`&QqDJF1ww?2)gcwYX~Hsf-%Cn0u?IMZ%dh!xeFiWBTan zly&}NC#N-uDA>&V6EsRMs9dZskeZtC-}WIpXQLYf?L8~!Sn77>c?w#bSV*cgTKVJt zA&B|#=kKuWYo#S-nG0MxPv<%n>KM*O z*y$r!N9;U#>Ve(B5-2D{L_#B5eMaceDU3Xg!$ia&f%AV6c*Y6cIlqzU4b@LS#JoB`CDzv^x;wk^ zoew`^23B)xyX3&yFJWPEo&l`A(k_QUY5NA0L z)K_8x5u57j>;ldC0>(#1@yREjp|5WM*@i|2$SA)Vv9Bm>kr;M#gWnM|&A?y}fpG*% ziHTBdFwQwg7b4V2-Z^zc8?(_k&)YScat#a$H5Zy}E~m>YmN|uQF0ZXILy%-hfK@(U z-~{Vbrw*GFhT;{DNDe2*JXRD2+SA*I!NDPn3=N^s)PzD~Be!#}T*B8+o?vQb2CEwz z%&yC18*qL>dB@Ii%8bDa26_q1B%rCSt%XBzyF1!B9~{Z)@bDCW{uh6PXU|^qEuVDo zPpmr%Kcx9EICO)5x_Y|!X3Sl>&2e)ZYin!LchUn2>1=30=kOhLj@(7h@J-|j1stB9 z;auIoNOmZr0S(HmWkQXwO@eiu&(E4EyMR{yKFS zRz>RF67>5X>{n}diZCqA+txCKTw z6;W{|pYt~pZgqCMsqI+8v1S&$-!YxnA=wvKwnj<(P=Tn7Y@1_WhhYV-e9ZGnQ8~>^ z-R)G6{hNGMt^8Qyd?T71qiSWwSsk$v&^<{qx&qr?YnMY{p5L?WO|-mPSEBXS{*pH@ z!`D(5tIFm3dgY8&#AMjftyHFcF^I}dmAW-ux`s&k-@^Rc3e(!_CVO_9SJ}YXS?rcu z%_vrTwt`G+R}sreao&koRD&<2nG^4XDQ)Cj07$Jj;aQPBD>eR?vrcJ!4kcIZ@Gv21 z=Yyon_C~_1YAEbl9Jnco`B@2|~ZZ+jcJZr|hE^Xlt!I5|1OPyXd!n7#AK zr=OvvtpmIJWxhSFwWWZ~wPmcYE@O9l6Zxhhe&Kt+h LqEKwX(`V1|mw)v)l3e@r znEgTmCg>JD0!%0bjzh)H&T)Knf}_JDW?&IBivT1_5dJ&=;osxt%~52tb=cY2#QMfM zR@YWJTx@4&8>h#IXv}5Nkfn_~m=)I6Tx13feiJ_-#Zz>t!- z-??)SH*em-$nZFFxjctjE)#&YJde%IRqXEVaoGg8klv9#QBraWO(cMiz$>bU*kt_N z`8lf)fkggKs2kEjFX2P~gzb(m@$dpM8VLnHemtEaUR>nq@$2C~7wWu%xfVCZoPIH8nBA zkU|H$+uP99-iD60Hk@Bv<8S}=AMwqzS6JWNW-y78wNv;ZG3_2cyobAYZ}SBPwDYH= z^aQNV&&_c?#bTaic9O}XbLbX&M(<+i_5&2!+HrDmg|jQUJ&wkX{wIm~<#GXGUkNBd zz!@{LTn3NgZn2cDvYs z0l5_Q$E*?V`(}NYmE0kW`8i1yi^=m6oP&*+A7DIf2V^tsS=)K3SFg#c9{St8_`@=$ z6Ap=YND({qvG!lB&z_^;jjZF1Sk@M=F=pJh%j(8 zwd7(l_2;9y8X)MZ(!|)Ofoq%$X_I*z-&A@9@-r!eu8cvl0iISxo{A)puc!m|OSPx+ zO@fn?TPCLMS2|uDYytg(Wr}MjSbOrGBGk5t3MY*zLcK2fR$E!ofv)MpO66DZ=)Ko` z9dKn_>r@LQ9tE{+mFnqe)7=l9c2(?V+>TV-L#Bwv&IrH4N{dRRVX8E{D%sqc%2b7$ z?NAM%QMx)tTIziy5(uA)ozz!sdsHCdm{+nPW+|^^B25#1{@GWdgrC1~akrdFmb%hZ z`9go~!N*?SL0%NBTuiukV&;lmwL=y71xdD_9Z-K=tFUs2ckewARf~xJ84WZx-O-0? zlg+KMmI)m-eidx0nH}M}YDdTT1%Y^?!|U`%|N8ljLwtX8l6KiK?dUMhRPV~y^ z^vjHyPT8S0ApYPa4>jmL`LO_&yOQe@aQmjq#IpIE#8r_TK+;E>OxLwHq}S%O*0p;) z99nwH5=O=?VW+$~X91@0Kr{3)d;m*Y?aGkb>FBn{T5>`q=}q@L9gfFxQ;ZP}%rTRJ z^YrUHSvCQ_eul?FUr8?XDg}56!%9Ld1PBvJ%f?d<{&h|+V&n*5p-=fusEq@*iPLBE zi&9_AO@+*~q4$9dZJrw_&(AfE_P0@9pT)-93v4eDR6)-e#1D}5S8OyR*Z03AiM<+*^ zo1ewP!aPSL|sV_h}lJn>t!iq04*!IzgW+&2vh@)X?sgE zgRcZ&(U?*ac)FP2;_@2nTie*#+r!DJB!4Ga>BRUvE;?~Jt~p^k16VZ94LJt8`uhhM zkZW&kWe|(>vwV1nm#<%8YGxX93kwYXQCK5^b(ELu;_RFOMv^muX*5Ua!U1An^>%jf zt)4xdowz~Ea+-<-w6?dStFs-C-hPOO5AS1iWSI5!CqMZao;`bk zSFd059O>%rVnFevt_dB3W9S~fjp5r5(9+qB%lZbKA!GBFDIicm@x~ux;EHZ`G?zcf zaxZ2``8)c+fNT#XKzGTW5A4yVf4okET>s)$amJhoE>w^^6+ZAi6 z?7cFfQm=%@`p5SA_GVcT-L=acwy5<-)(&@}k2o>zTIDcvjaQ+adbyue? zyxduOEl@4hlfz|3>0UT)3`-($La&%_@}*rDRXP*B-f6!{&{^<0qMC-4Ht^L@i5wlI$Qx#(&lufyBxhERqf1fCEWLx3LvO`LD5sS$;| zuuF(#w4(s5gYqGUhsN-`|KZ=`t+(!@qpbzAGZT3HXt%lC~3A!Fh}7 zrGJIIB<&_95w(MIY*CmZ0Y0~H-NnbBe8!=YU0uDL&uDjd3scjtv9K_Ujg2*&pPw-( z#@fb7*7K4?n*bk5s$HKE-|$j^Af*&MRs@PrlJeovG zohX+W>n#IK0$?fiR}3)8g+=Y-g!PmMsv(17QzM5GGBfS$oG%k#nWGN7r7}tfhd4Pq z!`0hudm+&ut+Y4$1P>AF#rG{07*naREL*+ptrjlb@e%X_4pZ{JbQ%~ zuU<1FtmrM2fAyV%m%fVXn$Ad+hXRI0>%j7;TJW-%ZI$!Ix8O|T-WSQR{>aNDO2#33P%;2 ztU(WVFQ_cPT3_7t*RE&Y;$i(W{hK;~kp57Zx~zj-vRRI(epg;DfThFgME=5_6Y1H# zn`J2K))+tCJG^iy)3WX-4n|G*p)Sd}HCXu$rj9y$p^3t}&Hlyr(%kSG0m$4PgLEh9 z^l9CbwM)T}?|>N-YGAsmq}Y4*Ige|@-#><#M29 zh>O0_dZ_G}2E)}e8o)9+qynAd_B+gK`?b|??LTml#u;(!caRw01F&LCn+k^r)tkd+ zoB?3wRCo|*92<9PJ;JIu5>JUYbg-YzF7Czi_HyZ7+j@BS-fvlL3UkH7ufzrnx!^N*P^MEQX> zHny0#mCxrfFn9yw%@xc?&`t! zzW1*&Had*f<^twsr#PHzdTtJj%S#Nz5KFMw+``}v$%JkuBw($jrHEpo$oflw3x#?S zD7L>}=Fr5?KL0NI`-afb(akxDwzoGhKR1P?<#`6M2+W~yLCT**%&Tlp*hj=5;-vqa zvx&yV&U4OHMU1bDO9q-Kr_#{SID=TZ#v*WiiM6#QtgbEz18Z-O%yix$p362ksIHyy4TN?vdH*elXZ*ME>M5D|8UIiSA+?u6A~`Ak8G&;bGA{W% zhi1|a?dnSOl5~V*-`m&6Ij~xrTR4P}fJ#a*Pi()r#d%CkPvh|Dh=HV*mKFx82)v?j z#4?4xo}8HQQDR^bFhya6J>A{NG&JG$#0*}%n!?lP&vANwf!2<8G!=`S(`$Tm1mk1F z7#kfyV=j+{`6WDi{sKS!$xo5ZWzo~ygF3P^`Bn}c>>s<0)}9-ls3UUU(F6?ynijUMdr3*x&~1QvQ+w`1OIUI0gb8C>t!s zUM(ATzpU2_@6goLCu@ne;W|@I=xND;3E5Kz{84t_dIHIVMPvGvBjtGwYTZ*SqA8m( zI1VG%{Zp)59Wtpqu6$@)rXC;VPpYs_9p9+eWZTM0zLJ!ha5;3|MrM7?0$hpxb4NB{c!%C4lNBG#u* zy1%Y7k?{YLHJFW_xjI-O1#jZlhOIE|i`8c(68M%@Rv}uL3Sb50^EzgcjyG|cqtANY zYV3&=AywPs8z0ubA03&XO5Ah2u1NvB%aSILVcZ`%&AvYjcHF8_&{_bhG z4_c^~)5pU3#?U<@a;=oaucEHLi6Xy=#v~?JVlMhMdxA83n6P!)Xr@l7TDrAz=pqwM zinW{jSn~`>r8L$!l4^MiousJ5QbBoF_VRmdt*kcM-uE6Y|Bc>EvEcs=bki%My6$j8 zQsykZ9Rsk)!L|;!`+8s_jeyPY(oKE8{jhp z?X8LWj7BONbZMc3Z2vDz^M)WUa`1JE;{#%4x3R) z*Ap74@>=Q7>1};$6ji4gQ`!vZuuKCgf%4JlO(FqZ`aoO_pa!4ZgCfcgrB2OFJ`&zU zY5>#OjH!*8w5v{X+z|6Z>5&H0j9irf^|*?NDU7ckgjKOeYr2nJSNfxwh731{erbBJhHeol_eQ4-awc z)@^+J(WmI|A7lWlR4QY8YYlU=lUSvs_ItZL#spqbqHX%2oKr-x(Bo=ig_XH9Hkd;Q z&p9k|U|p8;zJjf-bq;qU5QanBRNf~7QmCCrM+eH}(5-;y zEMF>siFtE=afZpsSIojHQ^NhDBTgL8 zdAEq!NBOT*Qgs63NOq(f6c$H-lGY*4PsPdVGYmKqvxyj3T^*gcfByl85O#EQ;rgnM z0Wu0%Tv}dW2G%Asu*xcNc_WV*=_oPJDE}GdxFT?q0YMG}B``*29|3H910sbQX6iXn ze}R~Lc>=Q z{8!!W?Ho=>0Orct2Bv2h@bsJKC>)J1X4c7l$#11}C|<22qrSBAcaF5n3A<$a0vW z9!p$>5DE?^z>MR;sC7aCQ~F@R*k()#`WA8O6r5IRp;O8Zc)RsIrtPK2G^QZWGoRd*6 zc+Ps@%0FDI)XHW)wryAIg#xZr!AeK`F?CaA$avZD6-dKfhulLZRgU8z${H4ilsXdC zA`jMduF?gt+(yaKQDT`^2GUp0_*2d^!5DbYr}}}(FZ4Wd-}k7{l^SBcOQ|s7=;`h| zu6;xvG7iBP2E~jVUMAY;4_u1KgSVqJU0*kx_tmfd*+VE_MIdk*=}I%LjeaZrG4k5xcHTK;_ufwopKfv5f>U{> zCBF4OaP=)fU2C#IX__6*C_M!t`joc5Ml5u)NiJgT*tf`(vj+ycl$7P~+cFM)c!*k(OvvMg664F#>(Y#>Vj8dmk`B*4f#E(q0K$o2!_aevQqI zWzLU8Y?oZFQ2|(a)^}ng5t~Pnjaz-vAR~_>>NxC5ahA?2fzjklCdfDp09NJohIMQkFH8*8Wv zon;1AeZAaBNV;)xf%eum+`4s#>+A0BW7gOC`Ke-GEngTC zI4Oa3)OM1CzS&Vi3Z*W}%SG+sTvc_~Xl*X?Pg_e1v$<%Di2by)U&i|O4t7fWIAuUe z!fpv5qni=+{2-jAE?iw)FawL&V;ftW%qF88 zZjy9g0W@?o;Q0mjfo{+w5R2-d+c4!8!VYw_w;`Wz#=+4ER#w*W^qXg_!-vNw475?I zfk%(t!ovsm(Ld0Kww87Vk0xGE;;;VtuW@>D&hi=>9YObv5u996ylxTgeS^q%_M)Ms z6Q^}K2IF{437F)iMwp!Rf0D#q!eN=8q=0z7;6dB)@La$H@{>M@0dvh7pw?>*x*NM~ z-{s3ajZSG(tlMN|YCKfWo-0R3+izzDvcY$1ouXcG%0Qb>P?_6c(WvA-%A>+S((9dC z^LQE8Iki-7LsNk|in!LkpR<3_X(bZXx{Q053ZfrOwo^61^vA3hdd=Yj8l9I>G4p~P zSSBRhm5Qp$uHUjw(VUXs!Y#6;DpUlpwCls5rA8#x5}5?BoEAkkY;JpN@H>4x%=99r z3xS|3=tt;Sr8_#+mCUpx;joIJ?3tj}MYq>Vph0)SNtE)nCukP6*-V%cs=r$83AYcC z$6g1ebG*-Mx z#gy-qb&KpK%p2x}!mq~feZ&%nGc>e^CJG=J8{s@x7zAmVt2)-iC#5QS?JNSJ5mw4> zYjo<4EO^e;aAtpUqT4P+>Q2}yZ7(b7UIlwx#Zstj&S0REAaEq)Pn#~MOECaT>aeUVKbKBq9L#B?G)kXNy605lAXxp3s+#$*mN8E= zkU_Y7m32((VuJ3T8ls#WY-c%<+EV65m8QJG*Qx?%d35J86~qA6Sjo8@L^w?X{7@*4 zYN!IRtZA_TmuZmBRpBy|Vy$&-30qGEkWp0@z;YNoTF-)zKDmZlpPEZJnqDtCXvE~l z@EKUvZtI0abl7KI>4sODv?&ZMydKX|z2F3xGwTVs`Ul zSXC;@lyc-ym=TY$`VkQ;@JSFYk%`(on(xeHjRROLL&d<-O0Jn%x;_n-$^J^h*LVZ# zgwANdQ6FLpfR({Hg*H++UoM0E-VVzL*j(G-jXx!_e*4i|`0VpfP$)JrII*_6iq+Ls ztgo(Nb!8dLi;En7MYjhQni^2ZH*%tG0;T9?xJU22hu{DG{}~V8dVpMGBc>)N@a5NE zV{>~OyZig7%TUg!Ml>}QIo}iAVo2>IW|?N%NLZf$8WfI4?4Z#xVwk;)f&M|hg>Y|Y z4_linSX`LF_T~x>56ir1rJPUH76Odw>L|&0y}H#+_$&fyU78!-3|Me+$$5)318a2b zj$&Y4VRvT}TiY90TV3Yc`3U$UK*Z!Jt0QI-lXsn-l(?d|QNOi9@(&aa->O${nhJhhjY zNlh$20*i>*M020yNT4qPk2?H|60FnKn82a7)>hoTa}R?(0EZ;D>0-r2qEFSSq88;c|C=hMs46p$Vl2VSZqr+nc{#gHVjRIhCC}9VKtdw+q zad8>{@S`7NVR4y(HM$UiOvw8myvOrpV4xq}UEL_=i4*NKx_XH&NF$O5#UJRs=D1y%$@)^Y#U^eFw7|G7lDdq->m@` z?dv#8t8Z7uBJmtBk;~5BLOCSX;s-kfwZ2Ii3Sd(6DQ%VTfp~MYVwQh7Fk+a6*=GFD z09f{Nu!O^)_oTrgiR**OGA^sC>{7H%7iUyhzIy#t1SXQD@fZ99c+VXT4=cGG$I(df zi}cxxZj+It0;tRyz`3>T8mvJseF>%QrxVhzTx`3ql0{vZ#{rhYgQz@#$j!dqjze$p zsE^7Y((4m{;uFdRX zYLH0c0NR$H6pyt={&%{NG}=L2mfv0_t*om|1+^dq!=N_nX}M3FC8M$cRpnKgS7teg zANZ$NQYmiLj(p|zh7yV_e-Qvn7LOXhKfMP{08)+~x!)OGuVv(tl1W{N(|`qc%}UJD z;LGShC}pu$FY#0=kfn;ZZ5Hq&(Fa|{w-br0U94blGOxJGinb}GQPGcMGa)HdKYYsn z-WFQ{xC+{=*OG8e(S74ZTst&QyTjHRXU=6_IVLUbFd+?#^=vbnte9=BW;4@aWP>_7 zMVQTa+InP^L;YfGm{~mDNPnuYFoB}Prd&8joi-AH_5Cr)$6`;k=>ZL5xtOXA2h+eu zI2Sa~;;*qOzMDQBHViKXm?+0vGc7{B({&hU*MM!>;b)C>)Is&dar*s9?E_d^PwnO+ zea0slSXPcMIK=JY+*RVsn3G(q7HZQbve$FLm7HZZS?D@MK_xGbvvDD&le%S2B+?Kj z7O{hDZ|&w(ddR>W-#RBbaWeJSDB=W#x)ZF=zQU6){|Sv5psTF~J)Lc6ZE3~v(GiM; z0`5O}h^6H<{69bZAtolLv9h*?p58umc6W1f@WcH>?3eZ#NIE+`#us0FhX3w&e;d7h z-5etL?3-`!^2JNO)o^}x9t#VrI6hPxJ~eBojeO%=6Y$yRAK(Xn^hfyUqYu!OZ^ZP( zEBx&1ud%aN;$+?RoHt8u2jqn11cLCmNXQv6h8TcUHip0o0%Ar+hVk~>j~Kw}?&`(P z_71kUR47lbH1MQ1bp)0X_)C2tdEFS099Scx zw+(=`x3`6z?G3D~EHN{QbxMJcdR#fl_T>eRPmWD8c}`MKZOKRia~fx=Uni+20E?a> z@M>ga6vIQK$Yyf5x;n?y^dx3yr?9=fiT#5zF0U{7mcM+Vz~Bodx2JGP`k`<-VqOuO zhw7ueS_B^PO^6rgDo>T<03*Z)b`v-=Q$u#2n>H@DPXq>08y(0w+ep_ohkKO$IBL3u0|36I6 z%;E6hNN7UYdVKhu5Af*Sw=sBQ00aF4=;`dj!rTHgu;!PRu(i932XDWP@jLf%bb5hv zn!Jrg6nclyH+~Nnjjep^WS!12#r8(|6W8GR&h~}?EO9i9?umVM*t9Ma%N)XK8)MgF zwo%5Z@QjWf%IM}rdmLgL<%~cb0yuWuBc7NwM}FZo%fLxG{8}^3lrN$}wRQjWS|zqw z_GbK@BIUXmfRyj}LM9KRy3tRyldX%+fu+_ZZkd)L0a*zjG(4;fcB!)LI*0l$=|=V4 zoPeqQ4`ECy@0lJFaR*d_{-6zVIf#~{^i$gDv*GkAtox}i6)~he$EjqNsM(`gU{v(Z zca3!3s{p`Se3Lyv)B*JS>A2}isLF4Mds5-2>;X6*1{=_1W0hi?MY{?CBGDK#@`?6o z_d4m&C|8KI38#}c zq-C-8d6X1ofMU}y+44$d+R7s884*IPW#QznCcC)w9SdYP*3NuLNHi`aQ+XVywl7sR zpj98xRmJCWY@44ty*-i1g6qxc#O6QEqS}IzAeNu(-ean|rn`zMNjDkE0dYTZdlhPk z?v1a5jsdDP)~Vlx^D|{u1s|u)y(qaW@}c`tH2_Pdajcz=O;f*W$AZnT3t~C;IMfQ) zrpRN#6A>MEt-8^{2pAk$2@_hJ#H^}J+E5RjziXb36)b2q%M|-QtXDz^_ndr7Y5)}2 zVTQw;<0i+_&TYBw+&rOAJ;PIC$769x{C1&`@G`M^R-b&!tivB17P<*DP~&1=aKJb- zaa~7WTA?@esfU8fNp|IGo>j-iTD9zdt-Q?q;dW`w)EgUBYC_f#7J;vn$Snqr+b=k*_;POT!fowpXw;^BUKu2WYrHMR!{f?QQLxW2&>G z6a52&n3$Tz|M`FY7c8%?;ppT9#bPtx&_@Z$cXvz7W+Eoa`Pm76?N@&ZfAAmwC-n7p za(LRSmoM@1)k{oFOyc#+3A}jm8s&YVaF`7r-;5^!*5{vpf*<_gkMPlV-bGVm7L%`^ z<7Z!fjlJ?A%16gQeU_7oXLG`kB3&n0O2U1+fg)KD*ht^g4S9ougLrWNA^Q6V(AC)^ z0M_OTR#)Z(z$)!ZxLYnK09LkvK{C35k8>)WQtl}Nmn0E60W1WX5nz^4hQ830M_(U- zEaMm(yNkvq%7Jx-EeavrSjEQX8um*i87tcO)={!~0gea|F~3uOEOkKujiA1%kO5D{ z^dk_8lG9V@+Su4QMn}dlGBSpSY$G$cre~%wKR<)*olP7Z9-=-&z+6@UD+-}IJyZF2 zD393@he=XBG-kx4qkLt=EFw_PgsO5P_A|7$G;;{y@bEZp+!#SNODwKS2F!?owYI*( ziPnkr#o>pP6rb5-83w>8M2~<+0yfMxX?9buN=}YMwU&Cokh>-;hgKh4B-c;t*{SSNHiE~?H=OiKRMDyhzNMCBO4c9- z)?xsbvdOLwW7aHQxST_cxO3<4!}QurIjhw366{MhOPKgB-4?X9iMa+_P>d{qps2##dE!eM1%YfT<6>Kxl^4S`+iLfEaPQp zr3jLk=}06eY$Yj?Dw0SFA+n*ZK&~>5Ub5!sc>23W?9!_R_F#jY((r_x zvujTUWebg?_fmyE#=yUz-DXj#G>Yj})PmzCCFSf6 zmr7a|Yhb{3a%sRpl%$cWS)iO5s{0fUNfowlOrD8XyoZARrFGY*8hDeiGRG=eVANNM zieA5~)=a0U)Mh%Ozq z#g?0-&yZwg*=OQ<7=g?Db2kagU+8hw_Go)?cPfw{7hVV2$jllT+u!RGWOq z9)vb1DOc?%(l^RQRdsrfEbEocm1N6Nj9Or5#a)i&L|;AYFtAJx8f6O%hfHs@oO$bhC+*UVJf#)~@oT??|Mh?Qee`#? zqp7J86O$7RVtwR=zWI^> zF9KQ!c%sio7}QY!Rs-d zt@tL#dJfS$IXlJ4*%`}{LmL$Y{XJUA?4dUgh@>+4wG+C)KKbkmy!ZZlI6OS!u*{XMJ!HEEap%MDqOQH4LELM~yXOE{+HBK|XB(t!p-T%g zxvbdO*tJtL$uuiR+i7jyoF&0C$a;-3P`q=9<36atD_ti;Cdv?-G89uv>Q-;7cAA#5 z`(l&4NRoOAnUogTGNpTbbEw+b@ORGI>K;H?yRK?-4jN39p99pe&qn1l1B=!Odu(J_ zZVoF-E#GR*6Yxxop;}v%Qz~+H4`_5=D_1DNp+&^Ou_G%iX3ytS`S3W&zXJc|Xu)6i zth|CKC;lR~PC4smoezFV(bkWydzSz#U7wb@>4>A4iH5nI4+=;XgkDS|&Z7HKigy(M z*cXrLNC>Cl06>AkTIC_`(f zdRTT1`Wc(UHN0jv(V-frH%2{KL*b5H3fyv+KoDg`#+qY4t5mlGENjfE2K&T|V46ai z>eB1=O^!DFk>}H*v?|yJtC^t`RXQG7SG<4j6!Dp5 z7)RP3M(`#`y`dRQYDSsUb>6IS8JaOgHAwy)9TsSA0CUcyJwHc>@aPST2gWIYEy%MK zyJ=9*MG3L=b(#Lsj0n<`OA1?409^yFk*mK#2A9ZP9sx(&xH{ZIvHpw`Wm9e=N(er; zu!PC!89aaW8kg5VzF1V@W^&8l#kqvEalWYQD}46x2l&l@_Z#Tz?qDEfYHAWMUOdB( zfBet**_Ti8{P_e*rBj_k#k80%i~bSdLHUOWB;gQ3?zey;6iP-pxBC0~ap%q*^mO;4t-S+#ySv!g zTE)iNBL8=Pe~%fE#1`UP2pgNY9tt0%B;9nA9|2e#X2?KEj&oko4S~5_1Lstt(9-Vi zUJMS7VQl;!n(_i*Eicbud1)Ty@*Yl3jv1`uxqEfV;0Ljv2%I9eS0+p0g48c!*HO-^ zGwu_CKvXw@I{Fqp>L0P;2KojtaAOFA#D;1R2G-)@9F~_CvAes?N!%N<#1`}O{&J%G z^GgQjh-F6o5e5{s#e!XwRGq*ky77?!EE?D0;ZbH_(T$4@**vbVFR;0_jF__%;5_9;%QZ4Uba{RXTwS8OvmJNu+)=>U zC^ptNFuS;jZ(h8_)Z82nPfi$Qqw&+B>cqGrhME8Yl;~W{If0T?_u=s|vW+=3=L_iX z?c*fw^%U`2Ux!>Hg*zT%ZG*t8Eo^LUp`OAa6&Oc(@Tgo)2v49K-3)nrEPBzDM_XGP zC%bPgwqSp+gs;B*8m}g&F*m=6Y(o>8TZ`x$=t2KrA4W%qF~SV29$cK9U~zc`FJ4XH z$@3TZ@Z(SL=~*3_LpLtEr4a$%lOJ}^KsdARTpgAsKF+)?y7J{ z{}8~oMu0Fm_|bAOUK$%h*C*DwvouKLGM_aYONIQYLjk?sDp$`Gtqm9hR}la!WL_DU z!Yl@kL{t1syL>r`(DkULVHIjU(LOP+12!?1_%jruOZyxahxA)7*&e8*n&>W3)(6zL zK3Ydah+>w_<>Cica55fs@BU|pf#qn7?U#J$4uA;JRj-KC8BtWDJVxc6hhoJ!U#B{q zDPDhgVrjfc*I{$p=#=9n-;Ow**5mX_aR04J*ANIk@ zQykiF^G~xelJDAfn%`2Y2{#sDS;-#9We~N870pAWja4L}K{9t-{1H!+qhrh7K+rl~ zT{PbXYT`2B+RXwJ8*%-a-*;)XJJ+0kRNBPr1tQiQ?~iB-HTVPL5$ zO+FHBC-es0HgOdO~7!z;2)jZSA zvpv0c_9wbg+6)EEE3+|j)+n9F!)$^$p*@B9sZc$YH-$IBDumDgL+V*-f#hIP36vf7 zmls0lu0J|ojml*uQ^m5VWZz9dhn$PMVP(A8R2vX^B?4fX&t$$5+r@;x)zRH?S7^x8 zqa}NZhO<4?AMYT4eT4ct0!CUGD4Cg^$LzfPQ1W&H2x!AjfCjav(Ab3Do^G@hi_C(0 z`0ydV`1~_wpyZo!n0WmXFP?vcpZ@fxc>3%$re_wgTcVIPN*aES(-X=cBn+%#a{=G| z;xqh!7+CMWja&n;FgJyluU}(hYX{qVB?i&z>a%Ff7Z~uNe+*!8f^JC$ZrznS2Cyih zcVAy0GkChYdeGL^jy(#0+*!vaGo#jVbVzxkoSaP*&&Y|euerYrQkiAYZ07S%JQ`nSb2TgsKpV5CPL7dpYQ&8j!x$O4iLuc;XlNh+>k_-W zTiDoKE`2L{mJ+k-5wQQ9vvv+VIV&vEa; zL)^M`3nxd%*xlL1>$xRlx(4yizy3AUcMftwcw%4?h-E_vT>winGi7(8!949`h;0%; zNAj|fZW-e#q2cOB)|#XbF7BsmsUxejTIY=a60S>;HB_Fpr!CS__W~JzMfLy|-B!K8 zd51R6s^_i`3)&>6hodk{I>GNwq~s)ugV};IM&? zXwseRbOjA1Ta&EROJet3m$|05YkElfLKesX+&Qi^xt96Ocw-t%^=&NtRzvg)UZ z&&WFveEK+4>3XCd#gT|=y1!wstyaBptpq2UbwnAEgvbK4G^XJd!Gvf(Q@UtukA11K zxpgk*iWHeP;%G|9i)=Eb|U4XB`GGXdS#W`G^cj`}c-?zaD zu>|4d;!oH_ng-CSVxEi>s5ZFzao5KR{H5vq}U~4wT*tU9Dz4 zY?D(*JSO0zmbQ+g80k#%8z+Tj2 z*Zi#jFO^l8LmL%nr8ho0#6@g{KJk`B;O1|oHyX(Do+S|Cni7CtNX{r7!o~^SGic6S zpm2GB{AC&Wt3&Q9sP$rEhv>~Ib&`i#QQnwy(3(9?yt@889ZzHT%% z<}p5g2X8%k4~1eY8Zy^-_UtiUz4!*Rvoly&TF2VvF1B{|vA0*o=EgSvFj1uLnwdAB zef}x_(+~a-AARRNwZ4M+#RV*_tYU3*gFy#koiw+!BG*89uq1a5hIH> z@x)dlRuaj80iU`$98iM!x;oB*MF7_D=q;1Poo+f@T%5(xQJDcO3gsifhC&-P7{)g! z=JU*Yqc&)ujBmXorq;QH4070@N{UXQlLUMf3eD*08Nkr+P2_R~%D#r>l?AMDf6aEvI%+xS-BK#i5rRLMULJzKM)N@eU6UKp~U;{WmZ^b_cg_ zKjbwz?~RVS$dvtEv(1IIfWS>U~_wi^I#E-EVh6Wr(g3kl#rcRdIZW5Q%`O} zBsO6S&yQk0&q?z)H#g-L&$$KO_h%a^4^|_JEkz6r3}A4e4>$Vz(422%`}BHZ3ST{W zijJ;s*4dUKPDxu8E*K1ex*k~(PgR+d3{Pb z^aD@oOeEGRtC9a~id#j&oMG6tz0f3@+o6VJ-m3eh`ht>ovMSFCZV zrRM6-C|alUpleXw_p9n!#Yy3RY5%J9Qrec^m#M2;Rhv+O+2Qv!keqHxP(fUO?Yp)0 zQ=U)gZOY(P1Hl-HzCUYod zgaaJGG8h~S79?t-d2%7DTy6-Cr_KLBClZc{dN1aH zD0Irzddt94PLV3UT3cmo?5US`@~CrTsR8uy8x^X?-&rTnI*N|IrkJzPuG+dqPZO{C z4G4)!X69D1p8hnfMLOOB5i@Yk1CcqC+8AH2KJP!ozhMTJ&p~o+oCcCyphvF(#*qv3 zB@vFHPPqAGSe^Ci`Dt=5X=hb4fb{s9jfQr{rLAHEQ9mWSgoXPTnqila>aNJ&SFx z;0-;6vRzzXagM8=wr1QLA4Xqi3nvi2|JDci^z&atzNH%t^_O`1(~`$rCHp5pl|l*WdCFBq$=Ky4N=jOuMWN7w zzP=%hj^0KtCyC=%R*8YNh^?)493GSfyiyD`VhNEBFbnSNgv+JAl3o$G#W}r*u}7ei z_5uh}+6RVU8JClq8+OD%NwkEt8mB z1cYflrhHOVhs!iGw@Ip72x)9O+FF@GH_8d?$2o7;+QufHK7Wph=_zdQ?lOp!RUw3g z_HZ~Lg@tA^3^Y=|s9p|-q|iU=b3+dKTqC+WyZF+AM#_Jd%`gj#!X*!n4i$j4$qYRz zkF6ftV(M8v=Uw7N|0j}^o~AP8!73CAJV$8GQF|8`mzjxmadE}$whS@&ig~_ZU}$gv zgZ;f|Z)@i8)rqMoeEHR5*1KY%nUmKy7hABhRl-SAJ6cBWGJut#kWtoGVowPROYD=r zZO;X|C6q8`skM!8*+<$M|X==M*ElF&zOz}0vZZ{Rijg3cAGzCUA6AoLVkM0Kvfw_uP@lEebMn4Fa@%Nw*nRT9^db$a z5H)69h{%E%bU5BsA4nH-;^#}!PM2F;$cT1dF&kyoDYv(2+TnsCo=sL`8<<5kCfZ>M zZMy?x=nBK3QbXgtsT^Aus&&pX0|Zw!A)KSi5ct)lE17GJYnnM+ekG+1I_f$Trh?@A z#K8JDlmpA;SxO2l4q&NJGYw3s`Dny$PI_HCA5u6KlgK0wm%Kk5!loEE+EbSC(n(yo zG6i6%Yq%AVWeyFaR6yM~0gtrpG@qu}Sa*D4ARd1oJ#kiGtJY-(D^G~2oxZxu}fHsf>VDYo{atj`B&Q;zd0y^yO zMY>I!dIr;!ASI8M3&c<^Bw(9}dIYUSG3_VQ*iqvCmZ4Kr966a=GURlA{j~`=edz){xqfkT!d9E(elmWWhiYVr& zP4)Qfi(kZV{r2ynt)maQ>@}Wz^)Gn&;xRVXSFyIWi_P7A&SiCYc!r&w61KNWI69!5 zNJlK1k3RYkfAqiqAwD7itI&jvwH3_H&oPULzy!%?mQlCO30qCrVkaswy2wZ0Ku2;T z)=y7&4~L(1b@!mXy#wWP8KvDVtgbBJu)K#%rjGkc<4Cs+Qb?dS>kLvc_(80tGiF;6 zXh3rO|4DlfILWT+PWWG`tE#)YI_I9y6D5tLQ9u&PfgltBi6m@tGO#9tO)$m_Uhv`o zti86sZ@qv)z?x{1gd_wCNGQk2Gn&vj=UDms&N(-|SFfsj*w(K#Gga^1cs zOAIIio(Mpod`r#Et!VG;MR)fW)FkSJ4K;KM!z2AzSzcgJB%YvrT_GbY8jz%}aY$i7 z=OLnb6(Egdh*^M?cdbBjrUA4l(&%$0=V;M^Uu;>;=>U({CBereZjdRbv0P%P|LZJedm*z1)KaHWG z0S2(>=03i;k(g|1jnn#|_w`!ldK9?DAa6KqlE$;VGca2~bE5!QeSPw~va*J$nHfC$ z{PQ?`ltN6Wm>o#0CJwQtI*74aDk2_>akwSTm8?k>LP($>C9}^J(9zz(AZJ}|9Y0I+ zM!+8B2P3&3pPXcwC#@UhFhW|pv@T^l3!E6AZjvNs9*1+W{doTQ zeGGOHn~#`&iP~Ch>7&~fdlLTiKFt8ulTSU3Y%Y&jB!+X(IR~BXU6`0##&od; ztMMkFu?y*@7M?o>1(oh&=BP>T!w&!eAOJ~3K~w^;XuK(mR&cWn9RTi_0&RGvpJn9-eY}2Sx$ofzu{^d* z0a4r@7r^r5ur&EAj7>5im1j?+7-5R-F94_Nr*Au{4}IwMG7w9>&j&4f zb_9VwUb#P4ahDqGBPyrUe(4?LO77x@8hbhbmhoo2n-S|zRe(`cLxS2P8xr$BXF9#T zstm>jIK*WGQq7@u9M=tb=<<-e1=Y&Tv}8jA@85SiJ@m6Uobt+wb}HRywOS2syt{V% zN^Z7Ur7T5LRvF`s4Zkr8b|<#M7oCpq8=PcS_0o|oe}6rcTwhi0ckW#4GVDIU9re>_ z?>dieY=v)p1}i^Vp&zhk36(za z*H<>@G5gXlo|*K zo&@QORqd5*gVs#WBvqU%@7QkCR#cYv)6jL^-c*sh%4G_GHS19Ry*;ojIemgH-}8K{ z&7{7mu56;p)}y;&u(uG}bzpNR$vnxiIn}67)x{ZCEGu=au0!LL&ui&Ieh`bNlS}gf zSn75pm6Y7;g?NWmbfFz1|Rvb$iGg`Tn)5#9A05PSs#xRw>u0T zmj%URs1h5?CeXH3k1cYl+vi~IKaUw88a(}6? zOU5W@gH8ZXPHve~zdHPr!nY`IQ(Id*`ues>4y?u|X2i_RPB8;(X>m@?tH>s?ya;Hb zsn)D6+5Cr*%TwqdF{hwz2PDQ0g}W8`&xVF3w6=Alt7kK6;sRh1NH#h;z)9SR@kAkj z#E8-xdMoV$YH4}nI|&JZ&;XVaSqcRuP=dyvSVi^eMs#;?MPJ`82Cygx*5t$(CMHKP zIyTHeB(blEnWaHi0$Bt^5&+493j%73ywG?`zAO#_%;&MTDml24iCS#kx)W!gb3T%Z zdW6FztSrxCVPO_S!vmbeeQtgpE32!_9#i8C5a}1Udm{cs}5F@aY04%ztk#3G;aD-->!jGjd z!~~;6^u)v>@Q^^q7hX7y#~ynEi;GJfzR0&4HZ%x;)zgiRwpMhsHgh}r2L`Zj{{ikJ z^=0q5=c2c}2Qy0U9+e4s#53LY8hQw5x@%4|H}5N@?Ffr=sut6aQ$uVFKUlO z+Y954nDh;tiQFOf$f*q1vJM><-Ug{MVZ=y92A)w z;i7`r~f-UR2!k-f0b^9TW4KAHXtFTMh!aimiO~H$H!^ z@X_8o=uMeo-#5X&aAjF8E7)E3f4~xO7+Wk&s_okOHKngJ6z1zn>;W}7-dR`Dsui1` zAN2kM3#hE(~gni%U1qp8@lG=f)A*{5Z?!6SuUyR_c=^y{*+5%G4k(mFrA zDRXtaZ}nAJ!`k+k&1YFds_YB{X1Q{E)i(jgwwkc4zh0_KX!+@uW8@wCD#$XJPryCj2VXeSf`^QLjx< z?xFjkYGUKY-iYgRg!LmE9PNDSI(5DjeLIoJq-JS)0W6o< zrZ+r+K9{ybzS|V-Nw#aWZ7wP8dD#mU`AL+_JNjRrOuJr+2?J9(vxGsQK`9L`QAIW^P(UR)q}Ct|0a)&dz1B%Q zhcqopS80GugA&ZtDHK$4dCE6L%%q4()-3%J0IRhokG4b}SenGr(jsPNrZ6`*!yD*i zZ3;cTn>Y^@ZK}s7B%F@`l+5Z1rY6Uc%dGM3Yp;9lZTQ3|K8fb$cGN@)3|<{N@C*(e z+K<7JQ7o*iB3u(keSI?~CucD{G>-mL!{fer-1$hgQafmf2_Nf=lp+mtAMb!7$Z?d=SF5Cf|rEjh5}W+;Sl z1d9uE3|KI$sgM^P>}+m1Jd5$3Fej0xF(nz1+*>hbgV8heSt^xAODlyDZbD1}SmR@Z z7#knL{M-yP&4}T{`I9)bPUW^^-A}AJE5EX#6ab4rI&G?m=|lgfc2FA_z%mT1I)ZO7 zGds!ouZD*DF*iHS@}=hiAchE%6+EBCmN~2 z=1qOrvu7`AYttZ7Am#X4T$ttC4=HC9g=rG_NdOjiPXV{YWTO07)D8ynX`M01;$?2| zzbTBcR77LC9$PnW!BzsW`nEGrw7j~E=lAWy;iHE!GB$?!r9~7ef0zQ>c(VHK=xl36 zS63%9*p41MhOzMptSl|!ymQaRrk)-wWlNYYBr#p8L#eSB&8=-Rr*vB*BQJC~A~$g= z0TXbZKwr&_QDD2vA{9L->q+#BW|=x?4vLwli#8Tlv76j2vIcRNzAC<4FM zS~?hdI<1ykr_pr_wIimS7gM4UDVKcZoPyi-^56Ud@BgSmOZ7(KbUISmsSlb5XXNR& zDBn=qru+LJ+#<6Dt^#0{RpBr_0;;dv^$OjQ@%F1Ety=sD&FPG+Q(-{e71hSNdnK!Q z{R+|rwEQQ^K`k$@%KM3yanCp_eQ%bMBLso6WJG4Y+D>O|{cHa;)JTTJNQjsuRS{6+Xm0S0suA3;<3piE9;x; zz3{5UN-eLXcgzLI<&_viRc=w%8&`SND=X%mb*9C#ErM$aFaZIqsd5SRx5nrQEm1ao zjk!_D+X80;ttQL3TKeDGAyJCK+f_9OzW#d-eAW>HSH+7{KBt}Li zF*mb>+C&VOUv>rl^0S}Ci!P$jv>J>NfOYBw78mESxHQlCr?}nm1m|lqECQ8~o^lJh z3={$0f*$Yj%~b%PE6 zBw)wNvtmdoADDnEWuxh(en#4n4O)*;NU6DOi!UyBK8o0 zegy_^a)mtKD9Hd8!8|2N9Ix{zai}VVO{(=JEWm=<^is0)irSbGP-4P zVPOWtLjqtCNJwqe0IarJ1U#;0*O19k=%R%B3A4k7E9$UH3Lzu_t09#_Pj?S9uy*X& z#q&Ub=ApxfaP0UojEs$9W_|$~0+qDNQfrI)K!98_S*zG@5e|o>8xbXhvVe4b1JdaR z)YsQ@-YV`d=RqrQ-ZuiU78Vyd9J4l2gLsTsX?bMn2Et5EZpYLB7T=T^Ml3@4$?6ys zYiJ;OAH*Y%K8AsTK?d9!TAI<^+KR58Zfxr6L|1zoy4%~((b0~X*;xz@4dM8S6POww z!~W@*H#)0M*WnYv9~b3qDLKQ#=*UBYdL9EfnBP&%GHj z(|XY$t^?%-RDyJ@D%huCf(L{cSdzruwxtYIGfh;j(Rx^e5ymIb4|?U&y9S+g?VEEs zS(YEFNq{43vE9>P88#0JRUW~p02Bg9H1J~Vn8m#8F{Iq#k1(HbEOodr~bo9BS5@t(WQ)=8aC?Zf-+VOfDU6B|WCl4Eg2#sW#=FrKgw` zDwmPeOCeANBohg=*VmvlKZ3Q%e)R8uoEcB`=@eR;o0xgEnL@X=?Zm;uM{)oC_v849 zlNcBr#PaeA16T_S3p_@2>)M;%_{aG4r$2*qDveNajTu-+kL*MLspA-*p212chY%&N zPS)etu~Rs3;0UHB=QymYHc`tAtiSm5XK=xV=OZ4EDFEv@=H{j`KR?6u5&I^UZa_R< zE6L1NdIp*^0X`gth6ki3*RVrX|Y7|qGqkKyr z-QuScu$$ax=9WuI%Fee0s+%Ht%^5IDvoGaFNeXYHIV51MqrDf~wx7Y_e6%TDT$^-&GF+e;N+f{M*-?D|jZ)op9p`jP6iB>Gcnwj|}Od-ih$KjXiV1wsT?bVFVSNjmw zJ4&~C{_dzwb4H>}g-*AqZH)XW8b|9fEhuGr-?hcQI*cju?HO%7+PTtTy<^vWmf8R= z`Y6%oBJeG*25=F}t&Nn}9i>5iOn6@uzOf_u%&E%ko^nv zdJXWY_n?%-{j0+j?5F?Zpp8Qnw|u=llE+7ohsEj8UzBeU*4+^K{f-Uxtm11G2DogU zRNIK1#yE&LSMQ~Ji-W)2mHy2omgRYJ274n@?LOnV&V2n=7)9q>5!HGcq+;yzz6SWw zVtP<-u9Px%@E`M~i{h`}3-yFMMb+lEY(u&+LGW)pUGU15;O5e(z#?**>j#&VF0`^1 zz^rj;no3)h$)=ePXS~aMsRyh||2H-?0aNscy;xE1d@}CY(Nz(U!17K@Sq1mQvzb-p zl^5&08<@*&!;&5Npr^hHI>2Ml-9(SNL}#;Itu>Wqvz#F2d(vw-oGQFFq+F4p?=PMU02}~RDW-Mp!baCt)q%H)T#C~VS1+933Vb9$euAEJ+Qb0XW&yD5 zrrB!1Q5>}B-TDjx7KXbki`nf0qi$`K*UnK#`q8!>TH z?dW6J0mu?2ZLYgCP3Lt+WbPUduYOR3?ytJr_UvMyAAb`jgV}B4A`ae8fj({J)v_7F%ZTHo@Fyb%#+$=ExH>M$j=U8Y4kYy z4?KbXfm2AO>X1&?qp_(8yU#camt1-U`Ui&a$Rm&9x#uZt>nOK}6MHYr^YquJQh4<% zUxoL-@BOGvBvHsMGk zaJY=_b@B6Ub)Qczy_Q85teH>@0;$t~pFXk?~?k$|V*U z=f_ex<}~}oS`0{Z0}(9)t)_PbG|iV%nc0>VrXcPZ>pq3?gU`bh!J~? za;ilm5iBk)FxX16Pho_TgDk?9odB%0)iuNu2@dsZZf@a3?mE9%vbGjW%PW|gnZ@YX z7^bHt&`?h~wc@;vXbr9MB?4KwanZOe0;ZA-rR(d_)z!_Q=?lk>W8d=!@Z7$AoUbdM zti`6yo3O2K3wG_;hVIUGG&MHxd=NnS_+yXb(1HC7UTxjfi|)Ri2(@g*QcVkH!)atW z;lIcSgGf58R)u}i#_G}4EVrrvmN->rAOp%P|416|I@5u#c_hXwK0zSPM*UT9 zT}E=OFqNG;26xK4Sk!bmvSr&7>>*d_p0`5Z@H*#>6}LuaR@QNj{XMHXhQ2RNTx}4T z<~Xlz9j@b~kyaT;2dVc6V)Y#9hJxzrh~MEYmruO_Wfo*%+jwGkZYqw6|BK*h4iFxn zEN}Qd@7~#UHi&5I0pC3PBuCM6U2enItK8jMsICM8S$15{|ZlgD5oCz_`@_!`CD$b_>GoXJ~-A;c(cz}jwt-Y^tDH4m+|p@GwyLb^mm$) z?KmP@RGe-F8AI1#l#hUt?{($IJ`l9Ntvw2U&PA9iS5@I%FEVZyk}7oFrn@-AMh$rd ztL)lc*~n<^=qQZ}YuvRfdY;V5YJd(lnn#;iQMLgZLhClAkBtp*ok=BBZrjS*X{BeQ zE2<(QSy77w=r+%@ZfAXkY-FN+uUzf`SQZ3U%p9|nN&i#fHur{MJO;_00!yrp(;k&J z+%Bx7!vrfSO6~i2^K5wi8~ZP93k)#kW8}HwP0#YL`JY!-H5TXJFu6dV=q*1$tlOh* zS>%j9cEM;V^z=b(EOZ#4WsG?z)eEY5bCggG8U*5Ysc@YZ|7)liKN6Z}+LPa5mEiJ9+Apk4gh}znEX4KFvgal$`GE0a?gl$BC zhOC+p>eFdvl@Z_(izN_^66=NlEJ+Mc;ef=bqCc6X6(Z(O4Tli+ZQY>&tP-ZD#xOZG z#vz0RN)V_)&vIy@w#U5IDDl2xYN$|8+9=Yq%%)L!xrC8tLvHE4rlxjm+O&-UtY|dE z?5o+iDU6SgDu7V{J_6oYzUfv$k_*b=MERgp_#o9mpbyIxg_&})_#!7HClHHo(p1UH zTUy$%Wy>~|J1WI2FG{w5>eNXL4-YYei1LroI?#YHiF1+v1Ak7rxcJ6E#eCrvYyQUx z$56;+Sr+If$z8j4;hb~!s=Q+b?%(Jrg_)k>u*GF!rIl#BBzG5$70Kty>WT>krSa!5 z(HaR8CE26ri7iEPLUT^-B_>vVLjx9)Fl%P9Fc5gvpHsSQ8|)J zNa?~*h!eO|SYl^KCstRp7#SYLv(G$_C!TtWbGSugHRx3U*6v-~(b>_;Krn%?v|b;3 z^ik}8?pd_8G+|SBC$^q>4q_eKu~gHHY1Csim-pmr(`TR_Z%6sn+G3l1oufyL&tUdk zG7+rDRh~rAac;@Z0gHnGU&5O6tlRR6 zNADho!*+E8y+LPv2z29c|6I@t&etSl!4Au8-ZyW@=656lKO7IE` z_|(52rFpB3g|M0{Aw!3JX6jY@9T3QDK25vjOSep)du?RXV|>644NrvOwN&xr5n3 zWhX42wug|60`Vw~5wOhutP^s<{|weOp7wf%KDZs$8TAidWg%uG({ zI-gssG-rzPuF7=VV?iACt}Zu_J*@ZUr#Wa<=d9c@Ih{3Dx#-|FUf#867+A(uI$(;J zWR3w+mO_IW=2$2=KbyM=QX4xBM#$Rqu20WFQ$Q#57#PRebv%{gHz9F4YQPyd?>g2! zl`+vFarAd~zR6kFYyhV%?g?{c$&wQEk4Y@6HZJ;LNVfX&!y<3kTcXEY+pEj+)UOh$ zdt_I$xQrX6PMlTQ`h;DNwW*z(EX*m*wvrGl2{qH>!wee&kyIF;W+})sURI!aMlU1H ztWaA93Y9bcGE2>dPg+);fLD55YG6Q*GS!=)5W>1Bmd8(E=F~x)*#9_QIChMaSJNh+ zSWA~)b_H&^^)(n89>s$XJ&c2g4q|X{2z$=ngWjGV6e$@uF_t1xoORZjxb(%Ba(_2!EPe1(}mRGaLXLAgOz374q@c#F`59ge7 zHiz;NK+)fS9ILAfSY2I2W^ENj6pBRS2uBDAig36e-S$TLx~L2q9|Gqn3~PC58B0sc zXl!gkZ|^2%U=e^dH^0E()%@%vvKeAUg_%u5Km@UFQuXy{Zf-_>xzw4}l0!+rMOWJs z2%>K;6eeESgicahD3N%5eG@u6HzAowagHsz4RCILnnN&&AxHCL04xR05-=sqD+(>7 z>+MAj1?&tl0Hgs}%JU^j&`S#F%b~fs4O=!-Ua>YbHa2jQ_)KOEgM$Oiz?v8z=Nl{O zCP)dXi}Je+Xhi@bLEXN>oWG43UJRZQ0H|1x%82ngW>7JMcr40^)_3jNjlFx%Lo7;( z)(e=N9OpisJb99D$y{1lVgE=%Jtb69@>~h?jQU7z;Tr;LYgtYxK|QsLs-rpxxFj|p z0Z(*e<^19jM#jc5Ff@#bu@N*h)H8r3tTt&s17R5{M?!i<57Ar`o3WLWt>=oEo|?sT z&+fzHPd>#r7g88!M`tH`d%MuLbrV`znmCtSeI4b_O5vHOpTXe+`#9%TYjY!Z?%9iY z_b#j?TQNg-hSEk?fi1%Rw0g_o9-{K>&9V;9My(~1K`BP?2@(p;j5Yp(--ap_Our{*T&i!*-`&F&>5k7P zxbqyach=pccJQwrT620LAGqbJ8I{{@)m(5pHB&jj_b@XbhXC!|8>y&iiBUG*Wn>%tgbx-H6^u%MsS9B{|cJpT97In1s) zVy}jV{%EfY;f^;a@o!J%@NZAbsYKw9dmN_w>mOn(U$%$}WAm+B*qF3w7MHxs z?`-Tv=P?BUxz&p%@^wKg%}TwiJk|Oe^QLcY+_Wo#FI^YK7az>yhX)mc#ZB8hueDy$AF?ZzD;{I_dD`10>d z`2InCs<-|)R_uxS!hJ#pk5@$%5nI1Zr(N2>1uhDyV}o%ic8>vg*A5>NWu(ul`Q( zyj2E(%XNWflKM-ksu_H1K1jm^wrs=d#y;qM#Xmk;vju=|0c|uY)vnet4^b*`ZPN5x~grj~Nh416V2)klv+@yJnelPdEXz+8A-TpDvfegH$e} zG5||+hSV*GYWx|xQZl1A3|gP*z7a^&k_=;QY5)sEN3s90`}k%zVv|r<)wb?owq7eos`uk5H zlUYG#ZJEQ=a`_U%ks8kZ6sw7&v7wQfGX!E0m?hw0fpZ^Gg89kG2?hhYx_Xdqln}y& zg+(mPPh)mwf6h=tnH$OkeZ6k(MmXgh@O()5o-3ZI(ns47L5FjZ4mMk}7Wkosv z6)gx(AitJDQ&TH8Z{CXb)($kcG^1E5Ae+fxbZi7;W1|?K7{}t`B7=QY9syWXeu35q z-IT{Ur07;e0f9KgPp=J1>dx{{EU+9i`sgOXT|0N-yuIfm7K?L8uu%f|W07~WJYNWhW=?0|gQmC&_F@QP0w9Gee z5`aY^t@WuoBoZ}@G}4;nn8JKv@|v0=;6aS@xl>g*H$=r{I)aCMs3e-6w=+84-*56 z##2H11OO@kOM^oi+_#5IWd=s8OVR%(AE3-TJuNrhS|G*M$HuQPhQ##~Elbevix@So zeN~Td@3j-mB6V-wRmLmOVmpm<^{|%}Wxo;4={pe8ezZjEGV6m%qv4v0=5jcN)_c2w(*)3GaNW zBR|z5|Kq;!uprs`)~z*V0G3-!@OYKGHZBzwfWT>NOMALbY}%6st3#& z5O4Vwb+5LGIsHwMovAV~&}qxfyCV3a2CxoMzJPM*Q0Z2awB21(=IcZGQYERQAIFks4t)@_tJwR3CIC08D)pz4BzT9u?WN`BsxJxTWhSWk@x>)oJQ z{i4%d58Qd1mD|_-xP&7!(rfOw3p$hmhElIMEw*H9#C;l18+Y?@wGoqtG=O!@cb&34 z1Flz5khD~0Sb1tLYewaEt>5ARTfkQ^2WkKHpch9EiH$cK2rn4t+5`Je;Nhwp23BD{ z&71=G`VIN&0G8>OkG03m5M!y^Q7MGcvzFF%5LB7fU@M;}aFG?Ai4D(a@B})ax&W3v zU3NkUmHd13i6BbcH!!)uEDLh zz7|76!+7w)2eALZKD==JDB_74L__wx(+EJl&I>d(hLVym1?Qt$I#lRqd ziJ4P;`eB!g z18Zs%uGv!pV1dD&)zvjLHZ)_?rY-1b??!7|3xkH4>>2}x6O$AC=fdJVgLZOAN}!d6 z3y6tD?V%7n2F)mER5YfRcnML{t`djhrD{{yv12C#ST)f&GrneKCYgmrdD{rUT3A}f zs>(-2$< zx>O3a$vA3iqNuA&pedb3YfBT_TU#(PG=P!80ZdPg1I0Xgx9vo#cQ-5qLZ%R6 zk^$v~D=DTghtsNXQzKU{3rU3>i~thQs>W#Mmj-E9DtH z%b{o)f56WUGPmPe-_p2zZf-B_YI)o%pAA)DjaAdCJ&tYBR@Q=if=F?0Hz7)i|Dah~ zx?Voa(CI*|@6JG$%T`i#1%>qmF{NB)nuqbE^A%dByv(Yb14^Gi?kz|3m*m{jtTS~J zvcvwB9{HlC+(>(E=9GPO8^a^#8!su&`ZQYB7|>Jm>IJYWdFfR)!2S^lJhiThQUp7M zYCWv$1bVSFTb7*$}9HYG#czKJDSG-jdcuJE7# zmrl0xx^`Co;;I;KIU|CF4Di|C=J3d%19&((jB0O4gz%}$qj<@-Fh-Y3c;`>Em{^wf z>hkQwIw2)aZ%h-6)9YOvOxp~UEC0^J>(rMGSb&7B4`6BO^v#`rGMuTPCvV!R0Ic8T z@uNdtz(}uODZ(aWb;qF+Q_evR^y{`)YK;6trPt}VUoEVrE57A2utMtsSbvC&RR^%D z$gKK`LLJHBom_Dyt>SHrR@S8NGH2E1wjzL4Q42Y34p=kt+PXVzw=?GNRo^mSR#mJ@ z7NlXszM|iE-w8a)0G1XEyLk%grXLi0_j$kvUlhXchk(m^fp0zseC2U%x}0LQ(e$j} zGO;vls!DpV!U_wXkr42!HwgH8&37x=6~`d@jg0>lk6sII$-1V|U#5A%_eC|e6(}L< zLr*bohb&kxk2u<+!cwaQV0on2!-{g&m1>Rwu>Rf4z_Q)5l~+E@ut{0h)5Z3Cw^Qz{ z_{Vwu_2>nlD=z;3>n{kvx>4OiD2|~%v(`mBj0#sXcvG4wr&4PhS0~w1(`t&(KO%ag zP%b9&iEJXRRG54ist=Z4>Sbce8uylJnPFZ^sL7FG-f`u|4K0zu5WgbG*f~CudwT7x zLs=Obj&m4Iu1@zjE^^CY`Hz)y19<71{Zv0pEy_6*hMgW)VPM$IbaT?rx?Pwfv>ETHkE1j{ zhPBB7Ja+Fd@z@hjFpH!%RnLIIl~-JaSHJoe3=Rz9fd}uyzWvYP=&{4dW>%10UBSxI zJOfx1qIdHvUxRnN^Sy}H)FGEy!ttXAG1&hC<`-tMmdzs^t3f7T#L8M04?X-C?z{gX zghEkfPW5f+!xfibj<>$$&DgPH8v_Glqr({JKgBl$=CfG_L#S<$XpFR}05I~oDItABV+$u8Us_(q(!#6&Sj%(FXdv*4!r>^)us+?$U;`*@ zuq0!u%SMRiI8R(83=Iu%4kik1BoHIcj2Z=CCDWW+YmSn|&rD!;ZW=4gD-6cy5JH-J z0;eRzl=8iapH1^FAWH;vJD(eRBuUqGLUv;Oh0)a1hMt}+s3!ocHjdTRB`hv2Fhgu+ zW(q~RfsjJ=Ouiu{PoP@|6@aBer8uNdZFZT_!Y{WmQeWxM zWFm<(cAbHXUUV@MH3`0XZ*G2uSy;m(Ll_;Oz~t04gIFtTYgnV)RK)Nq?Xuo+0({2|fW>sk$VZ8q;WRX+lR^ z3#P_Lc?}E?obiGgE#87$DS})P%xo-_#9rvVfq?XWHmtHU)(DiT zL33-QI?S~UQKjc}=${6$)K*qhlg*{%(Nug8A-d7}q&lsNwv*c4_$-<}!14HVwkD(N zSj4<+pNa=r`bIo99l8SotVmu#?_PsHR)$JP9J-jEfLN-5et^!p1LhfbZ2VgcWm;^$ zE}s)+N5|Sr*M4dM+*Iq>Cj)r#Jn8w=PnPe=d9F0m%m7%vy{~Staw+8SM@FnHOhwI+ z!A}cl_tk~ z3R!6s0(>lIF;xE6aTWpGyfcEox+aRLl@k8+jvP+R`dZ~93}})0L?ndpZc)%> zs-TK^1$|`!tWt0Y;ReLmFCP^+Yz9fuZT1+$AVUH8LJ0jrx^Y~%eADe;#T)48deE0U z85Q-Xt*0Eo(uTJJ+earv^0nhXUkCK0fE&IK+;JP_4FsK0e^$dNZ!y{&sV zVdYkjt+i@aw|IMIFA30Zdu*8XbCmb$IV@F0$s1pPg<@d+drejC5a?Doz=-jW4TC0V z#&pAca>b7ZtY0zoj?NEmqM4p`=E>&`c}gyS)%iqqMQ$OSQ+YfzfTcnUOo*N2L-A{L zcgY(a7cf?=xm99!e{ZE3c1`GK4fx{ID*|A+4urizT#u|=X|Ehl_o{V;Pq_!2CN$33 zG|9=YO}Z;hwCp17_sITO*X00Mm5h{g&|!TiH4%=_U_<7-;TpQvZYYW0(f9gfPJS;+ zj!v6+%G;wt{uroId4fbNb+U8`#nLwx>hI)GOLD1j-Xp`7l0FciCZS}KOq{~B^!N%x zMsB4u{qXrVe%6;+DQ1Y&CXol8lDg+n%;z{)5D#rZL;jQ8W|2k*g?&pgXFtHqN^ z4k5h!vMcban_r3k{sG)~-*2(+!1FkAJq?~EnRrSZEwN{KlCw9 zu%68<;nayE7#TW=rNwz<33!UdvAmkW%-jM4Soc5pFaub%$vSM`wjEboekI=WmN#Mh zwmu4an?h@I8@juC(be6>xrAs8rl+SdF*(k_9)W1Y z*pfDvIE0bFNC8@P$f8Q-t~S1uIG(^ZN~%ulf&eg*S-KtZtTXrE@=LGa%LfR9URa#t zg!NWmv#^FnBw@U~Ut}g7?MX{TN<^>fqL9R5iQg&lB?(EysUH!_V^)jWx_X>C zHHd>pj$(Ob4Vioa_4N%%rD~B##*wbCLo)+d&FE}v!Q9LgCMQO5?C2pZ&Cj80OCOpx zpMi$nUC1X}kq_4(TMQ#p3?W;h+;1Wq)L+pV!QPk!v&$V-22+*p7dx)Y@Rp_RjbN^d zrDePc*XhyW>B1H?rD^7s0_|OJ%dl#d!D1WeI7HTCu;Kb*PUs5%}fC*j|eYF|n5dacvC1DsPw(qkz7e zkJ#eMYzO&*o>$GOlItJ^)hnM>7-DZ-N@@Q6^)(s0G5U)HadC1t5X215dP^&e-5l_tJzME zeM+6YcxKLDhNE|U8{ze z%8~)B^IZm(yO+1C*AyRc=&-v5_`$8f-6w!Q`z`P{*8n%|0N(LSfWi{xw8fsxx-;iU zp|=n2$x~Hup)&u_H3k~My7s&J)Z1$;Tqnjel6Eg#b+&>f)pfQiz3$9Uz!X)INxy2_ z*h-PkxGK&+dSy`-0#&%@ zCI7N;-`LoQx#MrwKxI(~F4az~K6$JrOd7zlhXdL((VQRwK?J~(a2@&ajfhhIZYY7v zBJ%?)9=oHQa03kKQ*o|R+gouQZLLZVnL$vpVf3s5TeLInhVkjsSlts9lHkb!V%nep zGtB_fn7i|?tPj;rLA5lRW&J$g^0a+bde3v{WkI?iKVJLK8c_1cjo)1`;VY7ST|%IQ zgT)&VeN&Ekjt*2F`dG;u4dF0mJwN<#S{16g@+z_6vvLAK)wWAbnzv)_Udc! zikDxH<1ZY?J-@yOM~@xF$$^s$ict9A;`|(H6LD_??|mpQUk03ZNKL_t&<8XDvfLIN@f03t?ILsK)_+dKJY!9+Z%*jI{uru!KJmX_u*J~oVE zA7``mkv+}s^|sE-{c8Fb?hD0P4%v>W)P3dEtNgpo6ytS%leH%0jH;@IB7qHR#F0a zorj9PWBDi0jKM*-c8 zCRq-M$wjvtj*g9Ee0)qLeJ?N=Ml3Fd$T*q1^nro8T#msc3XLVk9f3)8sWi*q;NUP0 z9XW=~ZV&qT4 z?c^}W9>DOUj&q^g;#I|##pJgG`Z+E_`R9C);qHkYzg+`gp7K4ekv?+78L&YS)EVCaYJ;za_(>2G4itlYou7WS^(y_^EtrtOvj<^A!DV znnLKLdOI!^d_v*n(< z3;LvLLipJq#ZeOp;T5;9@hx8TBLG%hLI|JEBNdY{#cTT_=&lcO4k!wndwjTvA0Etu z5}OD8P+urqaVcBEj}I1DL0+{rf{S~?oQI3v`^qD7%^^MehO;A_tLtB$pc6LZQJA9X zJ7PUuzB!DZbeL}lT+EbkYQBVr28#H}!2;*3+UU=#&xqhJu8iX0fg(O~mp@s(nu$sz z4geQ)hVcKsGKT#VMZE2&^uBK+1n^Cex9y4IqHbz4QFFm;uak2n+;ObPxyp#*s@JV{ z)ak~nKe;f9-wze>*iaF-o)N*Tc1O_HL^m~tFgRbrT`v^yo#*rB);kI>dgIwqykchr zo6^$$le1J$0Y5lcU^=bU57O2%Tf?|aFX=jD9R7Gu2racC{Ld%d?HTnOxPCkE<3qsEBFzu* z>RrIa-9Sf5+D-Fze}4%-IV`sz1|i@KU|sD8u#DN|Hqg3$=iU(F5#WJ=5}qC_AKM*G zz#GmC;i7JUaz>Fn&#nRcCxKrcE8#aMD}%T%+ZMt(Z4{O#<(}OJT)PF>l&0GQfxmkU zm~lfW0qkl9-h8(7x4llD8(5(B0pHnAbyEWO5(8N8xih3f2(=CL%Bq%ES4nCq{OHBN z+s_3)a&HLt^#fOI0{;2sCH&|x@P&tr88rjqO7Hc3;C}u6W3=9Zx1IxB)&sQF3XAKR zap2qgLU?xE&dmj#z?=4zaDF?5PRkfRF#>$!`4EnB-Yxktk{AN+c)c*NuKhm|UQgF= zE8&)%CG2S}@!D9<0*9wV_}Q@#?l?}4M)2CupVF;{x1CwSRhvraYb zr$YGou`svG+YoP=S8poehV3Ps*Iq(%QZ~qwDWY;gOLretIl|lk>I> zsX7UYeVVuX}b!xGbC%JU#v&0LgMWD zXAnk@iyF_8Z=Sdm|KXn++e%Ee@*(!-wF;Ie2{Yu)95JRG7MWFCHdTPgfXi~Wn;#p> zL;GgBrOX0Q#OgBO7$+;Xw-V~{piK_7g`T6n(*{+u*D4;iE09eCYC5#g1lSa^$Y)m3 zP+yC!olR(om(UQ&Q%QeV79h0kHLW#FflQNd@jQvMWImQ8vw_~ zr*PoVG3+~d2*aZjSe#$tTvk_Jc?~}H(T`xyo--N1nw%KJ$jC4-yp zy3pF*$+x@3IJc0NX`LTTSZ%8-iH;oKnHDP&ag>zs{O^zbFw#=b_P0j6S z@904^R;!YX%ckFejdrzYekE2`>6XIe`IP#ulXN>rg0CE~XXq51hc{#5jY0k#LBaOLE(xge>xARDsf3PKiN8a%gVR4IHlw+@5v?sPoV$v^#7riOq)<8L%FrBW)h_XV41UJ1@_bU=&)C=)+tvT ze72p&RnaUiFT>2*3aQW7W^(|d3UHWL9{WOT8<=n^G8@Em7a|a~TMe0KsS=vIg z(wL9Tl@4ikzE_Fg4U@{}I=hE(x*qn49G6bpZ)P0t{n}_bqEN-d(~geo{8Xevac^8_ zQne(&zw~ZZwWDOZU|Xafv_&W(c92K6`ENTfiuYX<kTS7sB0diR1R?^Ej(5j0?NMcy_GFA&vw*UfdHxVt0<^KQkO*Pos7{YU7 zMgF`Y9>R-z!#rlsju-L%J91u-vjp6{D~vB)7sI=LPPgTR@YU<1ypcUMCm<8mMIc-{ z4rB_zC-2SUf&TJs;7vQj2EZC#DB&MouF9D&VPpXyK#tl*Idc5sgpzISVs-+%Ep6iBM-pz-+K+oA$s z-KG2D(GRj@20nYa zluJMgeMd6bTQ8s&t))M`JA^AXl>=CAxf*0OQmZ!2T3^!m-~C1baIX6vCH@qKtWds;~`I-U<#G*0npAWG-(c0M6T;jt4T5o^$+X$W^(8Sjq z0%rdHngTBG6&B5rnGhycD8F0@o9am>WW4Sl2;(ykLYCeR~ zWePDMz`KMkX&HM0pFaAVCD=L5QNtN)`m*ladN!mcqj4jhf0@#`^p{=&Wy5k?7 zh~Y;^3wVY6y+-5_UF;-6UY`Pw$O#nc9JpkqY6J+l%<`SLgBeUq!LI zsf0hjxWIkUa{7gbqxk;e(^O35!)}jR0#)8d%0GPoOQBe*HKMOMOozMf0$9>pkK-xB zV;smbVKm`?-genit-UG-uBGuuxMCOsto6V-y5c(_YMkV zk`1!}QS>AEwww??XUw_n8k|zMZ3%E_Q-bMGN8KJ~kocI~vH|q^EXLd7a5pvLocpDO z2nq<5@~8=ykct%09510I0n84a#L*KcaOd6kU}Ss(7hiHIuDR-JyzC_}#ligt@Uvh1 zoNt!P7xUP$b0=C`nlU#$#Y_|elPJXNg7aU*z{>K{EQW_qU}kCrp%4KvIm|CCVs3T; zQ!{hu9~#BU{vqDPPfpGtRhPzPmtBERed<#<=bSwZGEn%`$nX$y1c2oz%!@#tB-+}$ z(9qO^R4UCZ8MPfX`uzMXKSN*_v3_I| zE-Vi!kHXC2i8$)&Qb^X-B3=_`;DhFr7);B{OITW3;y)#SndlUHKc6pg^7gj&ZZtHs zAeF8|sgy@1yUI!CDTHusZAHTH;&G8(20|53rOIO#7KgD?-YE%D)Ib(7hzN8d0E-z$ z*&L$L8YGf+*tBUYwrt(P2ff59qY%RB$qBvzadCd00W2C9VkHs7jFZBv@HP&YWdM)t zmF(w&8;F&gam@`gDrJ_tw^ynSnJpGJ;bBLl~c&#LOIp zc83s-3cHF~UF_@;qmkO6*QLtK#2{T5jp;_TG&iBEvlFRQ9gh{YodCOW0NkQPPA>>fkb0F!l@QyBDMUxTB6WY zNhnYKG-1gEd~2)3bFIK8_jW-?bqK>$7If<85UssIYu5tLqe7u6pPJ z#T=%wdPaj>(pC%DNq2RBozGRD#QNDW)bhn+wD+qDz_Qa?@o%2(i6`{K?@R=D*pZw- z21HQB)0&MY1uadw+kn&|&39Sg*5^D017`QM}_k z$%XKzcjoZaI_b}7V{qTw=++J3rQgnCMKiYo{C8P&-Wk-llC{;*Mo%{T?n0xn`P@}e z-pK#$!+G3!tiYQo{X=d3&?Qm4=FAA58!zIWKh4p(hjA1Iz>G3$}{+*PYI~iH|`8EfOXgL60X}C!okTB zzWhkhltcZXa$b8z7$3fvj4<%wy9;<^*j08i&>eNacW;fLF#&vMUlCt_Ms9<2f3E8b z;nSDNGk<<>0lz(^Pk60heD5^^U|sSJy876zE!w0%^mZQuOMk76k7vI9+XS~IGG`XR zs*nS#0urvPx&7542f)%-M*}zP06u?Z3BNc7ymBY-%$P8Jh^3=jMb7n~oKIs*;4bin z{}gb<)ky+i0bhOuWg&z#FJF5Z@ZuieH>ZG4-6y#U-1k3pkua1_%>jS&2=D|kYh-7@ zf3(&DAG;X1VLNbO5_tPBg)Qa&XaI{?O|Lrxxa&CZ@B4sbGjzFx0F}C03g7$dt4qu( z`tqY8-0=cAm8!H5aA7C#smn^}P7zoGykx7FfyGa<NCj5@G;K3j={*pL}tV zftDx7LU`|8l-I(J8~tr(6L9-0^USpS=JR2EYk!!*KwSpu^VgnH#3wE;G7$6XAIC7` zV`6>rsse7@R%C|MKR+GD=(0DS|KhF^KJuah&TJ_$3+ugi$qlda6T+>#iul~+dG5;> zABp0?l-CI&@aTQ#74Y)DBBobEc>T{}%nsAk6v|`w-J5d^GCepL#@C*5K`yD~lCB~? ze?=ax$r3(vZw)iD{6C+)EQeR`DB$>92w#3IhNs5lI&_+8a=>5FSHLGP$uaOmy8P_6 zU;yjN-Xi|TOXTvDe|I(Y|>S`DXBD4!phLjx*2QD zoKg*uTq>^Tsq6MS_|h(ifu;LW2Cv!n*izNWu_srU4TJQa`~(45&UpCQUCMdaC(;@? zvf&f9be-&4Uo)FLOPN|a}6;}!&u2=@uQ#q6fc}Sg)`6EgUeogDPH!{m*c?x{rK6>{*x1y zN24K}fBs%7ikW^wGqDU1$}Go$C?i!a5eKmBQ(d+yl=z@kLtlv}At44!ZZ$=Z5!bo8J; z-NZKs63`(USGG!4#tCRyWdJFk&oJ;(pQe06X-)>eOaRv8DArbpITb@=b2~b^HY)~} z8bD?L^+FN0R6#%(O1_Q~3Y_<8fbvq;L33 zrRq_iPBVa&NKy!+gpJaVB(Gm#_7*Xki2Xz063Yt#K)E94+iGd;GyoPQna}3dFfua4 z%&%2qa1|-+O>7hc>prFxhs1^=%sL{lhjLvB>x88rF z&)kEK_D(c6H}QAG&Y~PxL&KvuIWWMt5l+v}avy135kSTX?A2){g&q>H6plzZlmWL0 z;H*z^_+W2O59(7X14fbTPEJkn@AB#jgIeK8M0PU@z@oX(^OnnIIrkSQi;qM&_ZR_K z9UYyRo1Mqd=s14+!0+(v^ZU`#)`2zxt~%P$(Aa?bx+Geg(r9aLL{mD2cr1cLhYn(R zZ~$w$JmU4uXzS@is<{KP#t!5YjmXxdu~Z-cOY(8iDi9FRn@C&qg$A*#ui@fCq9WwL zOb!X`T=6<{0W77rU3+2ljRH0FL5(2^X&YofBS%BIY+vuGhXcllkLp@6krG=@z!ukl z{tUi((?2@l{mO=VlDNA&E30Mgr(RFNu(g8dvBo|MYgsTjNxR@i==f7c1Y2QmFSR|? z{)V0tvx3l*VjgIY`TOu{Um?_;=I_~5W-L15M#jR?LV!8UU_1H z%jewP#B0Zjz@_x>`6Cx_iOd*$F?Zi+HX>ce;C@nFBoqeTp?R0wy!Spck$ z-;=|=ZgPIL`03WVAH1#x+nc4#+kTYA;VJL-hQ6tbh470%j-fFg!gb%yG9am2anmjV zu;}O6u@e5|jvUL9rgfaU(w)r9bn z3L*T{yVhgt={JLNQ`v=Ob6^pGrQh*xrtC_T(KY`M0k^*j0$_bxnIAO)1PBp;ML(2_ z>4WzOOUF}#+S`2W5(-NLesl=<((k>iq!NHd;MG@ND!1+tNb~2vb-^p?^SSN7H*S(p z#kc=5Bwz>qIHxe$Jbvy9;MU#1S0AUaId2;@fJMFe#&f{`d@@+k5xD#F*Gu@-d+rEf z-=w!3{V!qXXkTQ2mtl2J3@Gp!zQH+VorVgl||fr zBE;;fVBSdx|CQe_;qWx@M?a%P!+xAAgd4Y)@ZYbI8t>~5;luZO+o|pOJI*QLBNvr$ z`+*St{!y=kMF1ADo9O2w_eOC4fGWe+Wdf%D_2mUz&{@LgAEGciFL3kEFE8M-o)Z4` znF#*Za}LGFH_XJ2`oM(++`d1IuRLiPOf5;^*S8T+9>QCG8MDk$-}~`M2;aUb$BeFz z{U!J6Fv#W^j9gN`b9v7#We%^6T0Ux}uz@XHJ z?~S1#ew#;c(X;2amGJc&vN$vy##`_3GN;b(DB^!zpJnFOJAW0&EVV;}D~^bt*;2$e zZpgAcvRwFbU=cX=(_3?BNtBpf_2{U+@k<}ZX-Ny=`o04G_UarC&xG*CU)1mw-@KF@ z0E_*Q)!NH@uKel;^miHnnC%C}+Rmwk!cl^)T4 zm<0ozkudBluN~HXwmzKhmyCrxZCh-Qe$_@PAXzAL03f zhtS#GjSJ7e5HEY_%W&x6A>4V#&oMtcg?x4eXYAgA&Ar`7)I^c2i6Ne-MR)IZ^zGV% z%vzBFtm(-i%+HP?pIv2e=hVpo&YuLzg|$kzyRG2J@sk)C9!CgKTzJ97`1r>^fwRv( z6Li}jg%C1;mCJAl)D0yA`SWCI(S-NRbr{yHF|57lrmQ09GuauC5NXb#=_B zSzemM%+wfGR~C4)-_YES&aN$p#*zkPu`E8tNZ_zPO2SWojwE;r&YjKx03ZNKL_t(9 z<}-X7-qhq61_lO^Ox9uN&NDcij}mh)Q3&C}EM{k?u)MUW7&`?9ZIa1aq#GJIyo~;g zL?q$2D^~x?feh;RaXs-J-!&IKg-qUeWZO(kTfcE)0HY}&LLTekLbh$f9O zvBW43*1*6?%+5|TfMsqrR639IcPU_unPe*YIp+c6n>Pt8BN-QT0@-ANC7s?vI;SXN1=oCtJk0o&!ik-jSXq^ zbakU4UC%%l$qL=3I6FJX%r44@wU*KQK+$oUu|^?-l-!;BOE*R4vfLL6N2JizmX=m5 zE-YbeavBf(?qM7}@&eA;dmb~`63HaXL}q1)fve88X0*37qOLZ9V@Ho*V4xp!{~v4b z0cS^XWe=ZzX=dK!JPM;MApr^qM3O*cM9z}I*f@agwT->I#_I&eIeVQW*dUTI0wj~O z$RXKe^j(gmTy;;G2DE5QtVry2tlzz|NuPWZqT(DQ!^ADAMbR|G-7P zO|92CmbcGtQF~60Jrxc^qf)4l`nNPNo&Cph(9FpAOkGy z9=&=SOV3`<)u+LW*7u)JVa>)sWJAyTlUMz6841Zp zn1%H^Gr>%OR(~kL02VQjzWrjp>l12oacE5hzg!k$aO^)H6ULKag80*3 zIwitxd$+xv!7s=SR4ts$z)}F#ffwLg@lkwa z-Up1iM^boxw{X4avH`5iR;93|!{4~d4)xmfho?lbY`TN*ypYA3O=gBaXNH6CDgbN6 z{aI|~bSwi~4OU%;KTzp>`*})7^)DA#(BR;f^J93k*~Qflj@~Ym} z{{;TGi-G`_l$w|@FDV9=AHW)QAWGKtCOI&$!U3$%>B0NZp2Bax0GM7u0G5A(CO11` z_|SFfeGYapE5}^AT4{o&4faFJrF^H}LE@F>zAylbbaj4q8gN1*xq1nB6=Y3O3V&Dz z95WvH6az$7tMbcDolzd>-INCc#!kLN-0}2v;|VUi5bo^(F1$|xJzmc?>3sSK5@vUC z>)XJuUbi=ODkZC#j+@}(_h(A|B~>d;+j8n&sl=4Wxl)WsWUCA$8DU-};YBWl%m}Z89u7J4dAn7tenJYm4!*qBfH}e9(Q8T5>fQ@8Xc+*`T4mTzq@VY<^U|m+bg^tz93vTPO#t&i z48IKQdI=zW=0hpg)%x&5CJh4iZaq7Ndp1V#qgPBG!`7NpCyQI$pEpEt(|Xy|&>LUB zY6QD_99+7FB4qj7)gBj=&nK6U;ML{`KKq2^f#xJ)R-H2~i;p~<;QYxKz8~Vr0i+mvWAI}`dk@Z=8@#zF!+9&1k8EDqL{`n))_~bm9rv$(72c#4C9kd22Ek)4Sf`_G z7TWm^vWP7A39k^I6-v4xCdb;1Pu?3cFL}3`b{*kh-5HP$!QQE^Sztj zp)D4brivJ**)4vToB)8QH}vDg&;ck4FccY7!OY6F2-^be=eJurlS zZQO!gyY?}Fb=1OR@Z~T64-TJuC<9oeEk!IM*3e3)xYWtw3QTOAiqf(wI1v##&j)i7 z=tcTj^eh1yq%T!aSjcW|0~)~U@8LQsuc&1g!dO8uyCuq4(}2GMuv`ItJdlNfo)r4~ zd(hr?0Nb~3M?6-@(Ge>vYmh81!a#pFdi%Oq?43m1i7w25R65NO=&EaL8Qdr-E$66* z6iv}^|8?1jx=p&dDGUzuu@)EsSoE{6e*n>F0oO-ac@@ek$^e&K0Ef}ivY!DgVsB~P zCSo~}ZkE`2miCP*7qQXE-BN=E(p?o$qap+n&_Z=UU=RuE69Y@Y#3+M11Y8k-)!t6R z^?gQ1js)ZZj?zaib_AGt09Gc0R4T2srDDSNl99(C6#-Zcwe^@eVQWU}+yLO}bKr1>rJ28@`=!XOp3h2lHH|JR~u#|u{l}_u*6&56zc{Q%C4&`NK z?AkdrJcQofK6H0?qpQ0cz5V?d7?S;pEWhMRN_kH)OU;YwNMO|PAVVu9#l_70D=jT! zO|723L9Bi51-!p`8;(7G31-fk#r?9czaRUX_MxJz2ooA=QCC&YqWrsd?!ex?yV26x zhFGEq6B?(WwqXKF8m3?%QI5W7DSA;L;1vN?Dp-RwuL1FVYZD9V=LfLpE02X06!a$d zOe-)1YpH1$LbY_*gj%yAXb?lOy1ey5?(nU-yiORPpLMA$0873l+%)33nhVfnl`<^D1E6wtf2tQ%ZBBqt^p%-1&hodnMK- z^A5{G0W8Uf2C%&6tuo}ARsN%EdySIP98b~8xR1^CtOmD@uM5!1{Cp-Ar88NKcn8o*B2&1o=g!3W3 z9*-#m&8DXd<1V`6H=Qe+Ci}kN zJ1;vliW^Rh;rg{{Jg`aXkn%|NN(?NTj2Hfy^vJAo`$ngHKDW-nZ5KrG!fqG;`Gjc; zVqksuBoSO*^cO=L@bY2Job=h@wGM8-FpB4QyUae**LBB5@!`1Nk{Fe%UuS}F1_F0KIKLY)K6b`tjkQW&oEG9@}L2% zn>PTzdqa0F{geS^|9)YX^`OqYJHi0WSl7Bw7+@%uffeX5ffeDT$u53znv0e1IQWGJ zmYJse{E;rMUf|;T=N&w_RhtF=9DVnMEY6?l;_J^ve1L?xOP0wOugst{0i4d|^5@H5 zmY=#j&F+Y#btSbV_rCeDG`l>1@{wq+n71!E`Qx{zr?Gf~iz^-!%_aLH){u5_3)Zha z1FX3?g|ZJowNvg+c)fXiiHnCXO<`-NgDW43iwk4eMUjkX0}4NDkZyhC(iEzTTwJmy z!CFzOpoUCjWw$U&bGl{bsqdr=X6ct*haiUDDEi=p`WwfkapBA~RyI z#AQRQd3EtW3cY#P6Ps4Jk$x+=AwIcW*4cTt%G#)}d(I!h>?#*$-<#m{@?E;?EvU;f zGwq3;5&ZWv2Jkv}dImpQn!)-O2Uk9qzU3$i3XUteqq`*M8|!(FZF%-$(7^z;k}Z2|iCd5D z_M*8cHh`r!yv$lrqSp2y9o_3=Td8adL&_?H^=|EYrW;-Zd;&%(mIOz9Qkq$sd7w6G zHmITjIJ<0~-j;P}A{tu`GjCWQ$IXI9Bmw=|)G)IBov4gwQJ0Kh_N00wl1bdXY8Bqy z_&&Rb&6_t5i;rK7ty{O@xwTJX{hP00)BEqBC_$pvrI66$NKm>D&1;c-}c$}*&~ zaSZi$psi&O+FSObv;6>C4z#ihAw?XF7Zsy#IEAjh0lc~4U2NOB6A{F5%+ZT+{q;9s z-h#QzuIXrRL38syX0nj09<>9x%T1U#jR6~C0ZCQcW8GA~=qHgtI_WuO5R1q89|1oD z{at8pZN^|f34TXVT3(IX+6gEqDrHS9|1v5)Rre~HeW?RP1T0DovDVi1?b|p?B1PsS z23Bcl5`%+%=B8Q9yV2Tu039723cwQgMCy-2L&FR( zX&o;D#0b11v3FvC5sOL2hG>qZ(jzS5Pf-G=O`3{nQ>H56coKO}p{>0g2U-QhYH4dn zdq)QbhlkkJkN%N<7S*N4z~ab@b{)%iy%0rnqg#{T9eG&MDIJ5$8YhH(>6GJYC*qh;udl%NlV z434rr!kyRH{q{kKo-g#;6Gre5FkP{l80azp2SYPdc5Q*MUY2NM=)($YI#)x}Z}ZCp zDe2q1sUX|@(P39g;uz^d(B|JtfoYCWU)O0DO6>p+ND zYzksi6TY>6YZ%K1GI^ugnzM9n0zpAMC`F|ivi{jjTm!sG`ZEu+gL{ zj~G@2R6V{mi|e29)1EYdb=qyi=;fsH=OqYW>9#qv*1@08ld!ROznj6m?`K&|-s)1` z;u)5H*d%n~WQT>uS8x14q<%~QYwS&l2?Nf%0CSkD!L2}3Qdx-UMgr--JDUW>v-s>I zK?YVF&+N#u>!t7F>`0#G)e{gD$Ex=-_}=px2=dAK@tqgUj^H~d#qh1?(yWE0OGM)9 z1Ypto|AXGIzOi26YcmogedZ%kX4ovgHRF|2TnHn0b)SpRDp1HPa-ad|b3*#ps&tOK zMaoUr-!F|~R+WR3Zchu_&hBXbTJZk5=i(@4R5@6DYucx&_P2{f1pb)6+B<9#nkEKT zBnQCK8Xn=V@%MossL22pMR$+UQ-cB?Tnn!j5)%y7D4 ziHq;Q3OTPssRQbX!a@D?sq>sISpc0k$C%`)<^NeUeRgt&r>QrUzd>q z{h>LeEtO_{tD81N@yPZldetic;*vL_#NZYu}K(${`3wr<^u=bu}P_x?qI(;Byg6t%T?ptHS;SvSeja&+|%p|z_UZ>)OTGkCgot!qT}(c8^4A5N6h0W zgv45EInWGp1tdlhRYfvcj`8F|SV9ae140C>7gaSnnx446QCm`*l3Uwge-~?D5r9Q? zUR+v@s+tBACd(OU;LA*E#_Zjgv-GUvD>d@7l$J`QvFB)Y4lkpMeMJBeugwX z>3)hrn9ZbE8;TfgZEdY+Z);-~8VSWSyNueNb+Ck)MExp8?@?}m8o&}pk%BCeytfsA^Pe*^E5vJnp0F@>_cy@ukR_SP!9+OtFPPzZ9A?CRwn)h+LTH{B$iXD+d@84_& zuyLi=E0vBG$UUFID;*p|vy~0#L+hcim}QM*tt)R*koy_LRN$4DeLac#7g6un$+NOG zlXX-8OA^y7GWTI?lGf`jmq)wetHVfPQu}8ysY7cO^jy!?dpriPh7QfNWxvZ5(cf;` z$h3CzCign;YTEJTOs{iZ7trgJYUkj>X1w&t z0=(6n#it+CV2iwP^@rl1h;ql?JTeM&C1unA){R?`-i!-KvFn{a?zVx(Xxsm1O zcljI_Up>ynzuJJm{VPwW2s}2e!o?@%0}pR?n7O2{8<&s^p^HyG9Kl-$^rzku$RCiv z_&pb8@%$c##na7|e@@hlt#AO#YELgQX>-zsd*+G^ntFkYRx4Mykb1rQ0%C-@IPGsy zbc9T`H!c!SOj95pZB^@lSvAeYBQw<>L;Kv(7`9pKT+#GpLu9?|>I*Se3({IKv= z1A64!#L|6B8?*T3sTth$UIagTO}qN}^Eau?WubM7O$2 zB?tuO(A~{}d{rSZw}$ecdu?2C#nn zRuq3+Z`@h)b}03Qe+C=t?yW&e|9c z7^i`3hvrfPoobQv)=Yj@3`5DSc8fEKnl)aIXAO|4+|0bX4zSjPE{R_M_K!2!WXJ}? ztmQ^m&%7`2oG&ty+Ftm|=dTHQk1nTVhJhos0pMCtC&J-9K{m$uv_NR{E*ocISTKO4 zm?r`PL2c@ZsiFV?ZC@(@iCxSTNG7^LQr|iPn--s8A#K%1ygJj-3@sflKY&GS7|qu5 zBi;F3IBd~i;rGO%5e7gAz?xQHiaCw79FcTjU=a7LT7}J9He>ee**NsjLos*m;n=ce z3!Z=edFS|*_@R8vG z)mEM+_~}z#{O97(sL&x%?4; z1&4&wGiYsXWzeH2N!nNysI9H%sEcxmo0c~hNk?aZgxm=UI3kz6g2FgP$VGCXk2S<7 zP12+y23ko;2?Htdf&vC+C~BaNsz|IeVh3q(ig7IkmdS85<5rJBdbX~#7v81DEil>-F?xVgZQ3C~RjK@R(o#vI{fk9?P zjjylAoLPrp=B$|vM3NpD^{v*94(xAfK}&lF+B-VY+b5t?Mr$Xrpn3!eiukC2B(7Bg zM?1Mh9xhWhanF`=;$lc!BX@4x^yz4tE4ixZeM zu2ul7qC)OB#|}=fzOD}A>g!Q5eg+1MYSCX%jUKm<>&anPN#Xm7%be;bTvmG} z)qs*=!phudwX*`J*x!VQkgZv2*ig(o(}xG@9@~3|hKM}^y%p7V3-{I!g;l7o?y+1w z5KDnqx<~4@f&eV>dGxJ6Uf1=a>gqMa>>UJ;(>10^M**utzLrs-4-z~EmM)Q6TP%_U zGmWkF%416XUjQss$7TsuW$>+s{HvE0T6E=E*2CzgQ%77}~zzVKjA8e3cyC%UA=RRtSr#ryv6>*doIyiNu0DS#oCv@F=5<+l z-bbMnf~uO*ye9d>*-;!j!NG<1WVk%^#l^E7Tz^6Ye_8M1cW)RpF%Z&7A zb@5+|viR{U5#0U0S}4*(p4_J%VpM?`LzJHYJN|=4UXoQc6L#O;ex4E^zy4e(HDF&GClg(+a@y zyUpobksBZZFT}<=tS0Muc9BT=!`q@*y(P*zjdIy-DP<<1_tU3Pw80FH9+&0Fh;$w3 zcktMbC{}HXa=!HQb_xW%eeQ@fjvH^@ON_4Fy$(O$+~;ugz)KIwU|K~MHh}f1`6*mI zH-+#1Gl2)U>C&R;aq2xW&MRH#P9wdr41V-#6nFefvnRsp&Oah-ohI*_v4>4ySpC}%$n$w@4rX9A z8WDH629Nm3XZ5Z+>2>-C79D#gUUpfBi`MA|7z^mz8!}j zb{J;QIRuBynu*PuH{sdmUqpLH7rQ$34-BD?fP?)9P*zfcxrZN)lTJPvXP$Kyvr`89 z+R@s)3!UxzkQ(ksZ*M=duxPKFC`_WOZxF2=-FW%cH?U>PPBhd_z;VZ&h);j&GnjeE z3>Ki7ZsF*aP6hJCyi|1|>98UHSX5AzLeEPf5-r9tr zfgWbX6(%cCQdW(k;tB?kq<019b9*(@?-q8{$j}gLF%jd3ST+P&6qhF1m5-t!5`fj$ z+smvs0^n-eS5%|2ss`~yp~;2r6RPCG+|-&{Bb<+D z#NoQ4f5cj%^m+(L$z~V~BCRC?QYbnfwLfoA$rWBPumq!(KCi7SU4InmO;3t4cezL= zi&0uq%KA?<)X9~O073$I28RdHuR$qxIgB#`kI7+8kcWYp17`+37tWniNnpHi0%xEI8OaLem8>`Bq)>g?>` zD3Zj$VjZmFVrF#}m6T)s+wWn^_T4Bht3Yi-17;jD8-0U=c>iB-qcG~CuA&5Wm8B>v zBNo^Qy1TouW7}4wh6hnqQI2tSH7J=d3nL}tFqEuEms`mBXSSYlm!uWe10UGcPdn@x zNI{~_Gq*_qAfJ2)0i;R`OJ+WA`c_9E0oQMlkGDsThq-Dy!>5u+OeC>Y&0J{$a8cgL zSy6P-{D&??=bmB6n5;@>t7(ByXjm*A`u0+M_1y8M|CLwuv%qyye?lPmK`0XI1FMNNI-g z=bDYCu{_&8@VpLvJ8Mf5OwX(gV1=L=R&KpY_okf?i!8@r`Zqo>H4td5v36KW%fnx@ zX5CSb|L>V`268_8aEjSadh#?2_Sku?E2gMpK-+*>j5L5n?rUFpN`WW&P8wBX`v5Fm zJOZ$m$5C3~;Edb-tSXZ;Qx_{Qj4?xL$t?n!jaEx!=*+2gu(&aTlcqTADn=LSCVl7m zUi6yoPoLlSr^{3Ii(~!16C9!IKNw zSloWTD8lRzdCxkrx4X2J*9G+s{&G$hcf9L(02X~sOs?-Pb#d=T z2TLcpph$8*dBwph24wPISIu+rg`-?NvdzK0oATTn$V)WhVrn@>qja!^-15|=0j$eb zM_4~eE^EOAaM%Y-nmf+V;_00Zu6t$_0LyBt+t1D7@LC06?LUaQRlWI^b21F_kam@3 z?wQ=0bn248&rZoOD`@!|TUcH0CIIU~1z_zY23DRd{PD~Tjv4Rb$dz%PbA7j2e>`@X zfJSHEs{j#Y$gcZXkb$L5=lm<8z(5}kZ!{N1sk4F@ zu&6$Z6B;u(Wl|QTJ4K-XpEtzt*LNuYrmqm_^}Q2PY*0V9CyGaQM6m8a1f4@VY`m$H z>yA$0L$lL90P7=%rf}`T6n^%40{3iE0G8^Gp0US&%eF)SEUkfM0Ib7nT-s1kUl+o+?{b@pSp^HwKRhtyb@v7oW8u_6;kJ+(?FiN;b6evF{Zsy z=L!v+&`nDk`f&~eSh<-F0`Rga)W|{rNYSnhA*gVU0ZT8|(dw*|X8Bl{t=iC6)~|$8 zH_(np;@}g|pv!{AhRUg8+e+3wRWX@-AduP|df<+BVe_g6L4hfUwL4YbwX}` z=Ic}eO*5S@?Rv+Xsu@UU5At&>0(7w zeGFjDo>^YS(rL?GB$1Agcn|Tfmt#nL`{+82(;<#?nY%< z8D`Hp4D%N(#F2}R#?WvY{k?5y-MFVR*2Y-O37z%GiC7m{NHnYY*vkGJduN)h9R>V-fT z0*R8z0%S77NGSk|m^8#zAqLj)NSdPumX%e(RSc}2o^GT@Mo?Krg6x$jEvsP7qwv0@ z-KYdEUQ;9w&cSK@ZB?<@>Q+-P5yAcaX-lJSqK>!i~q>3?5 z^A52IEp*TT@FWE$Zklvazaub(gS#+`F{YSF>O0D#VpHJgAVt9>FDed%-UKJP)iJ_QWzW>LLW1*`WWQWKo@~Z0|(j*7}k7JO%h7`ZZz3@fcXsUd1d0yKw*hd|K{iFs94 zR)+G@G6tt+n}^`NAv5cRdyD4RG7*@}q_Vs&K;*;SI6ZE9}kv9E9!?j;@rOGhzP_LX8Mah*!F zdo!(OZAo>jxyU;@(0xz%hChX52~zs zY1sz`zBNG|&=}B7FC~sIh>6h_mC|_mQz)FS0$vXk@Mo_{{Ha=N^!j1j3?2w)m7cWN z%;Ae+YuRhIw+^WFUzpC?p0ILY5llQwGGvX{YpJX)md&8Xwtj?bK{uqmPP0U(wqw*d zwHRG$N%h94^ciyIw$ z@$ocX-Vwwvnie*#}lcQCsX_*_~;0)BeVB@P$PVJ~A(Yr*^owVXX)<>-IKp zk-8-2N7zXLT|e8W$eKfln$`y zuXF+=Us2i(#lUg5WRT8=kGddl(n~aOJGm&%s05C_#S&`QQ3$V68dwUzGDB4-l7Ga9 zeKQ(>Wov8c$t&2a@3=q!tm8Qfp?L!VSl>Cp#ZO;xScgiCBI6?;Z0QB{7!|-G5%=eJ zlO9tRlgq*4<-d77uuxfTJ z{ZZ^Bk?=fo*B{SJGk|r}$~e+KdbNL_uK}!cG=QZNeCuO^&MxFAc>XKc1k{DjnV!XW zmq-M_KdzUJ+>(h|{QA^12x$Av6Y(4|`Cz(Ftr$T?K?s1QZ}jFwzrS`e?% z=y|PpAi?j<#WSqYWS!d(u5i+%4F3D5G)Of5TQ9}&z*Z>(<>!%0B~T+D&k%-nrK^lSd1gf#6$QY;+epJjzBzZg%M2_Au-*>=utG*b_&T4* zcYd@r_1`jZ^1ju};S!EQXhNn6NTqAov=M)zG>>>GQEq0k?+%#q`SR%LcSyS0ru6ha zv_b8a-!s*vr|8YSWG{3>9LR}sGc*liYy`{2Tf5@k8SK{eeQwJRhubv)LW^dWL1 zbB1~_y}k^GO{ztCJcYsjemwl}L)f!tH|EWoiy1SfqjBOyY}>XKufF;UyEBap5Avp* zT)f z=BcKz@$Od|*kgdG9Wj-hqQhwh*2qvF3JMB2iejR$6vd?!5wKK^WowOB%nUu2WE?60 z%W;_{)7RU>T1d3DVNk3fik|Kcba%C(r>7Gm!^6UYN{~=_A>su|6ciStu&9*X776^K zxq|eshmB=Csb z014zFK(4yFn)5O|LL%=y=pP(lV2JWmQd}a;Fcvu%`;eH0lsBov0Cw3mIF(8B_vGG4-~+jG z4i5A)dyPOY0>p@&)zw7;?p@6AqWsW%6Y)6bnHg6~n4dr~DmMW?#C#)QjOv732&q0R zD=Se^S&bdL_F&K6W)5UfTv?4{mYj$YM6v0;cQDf1foN)w0j#>3YLu6kGIMY1=8foV zZ-q;4gtgVEo^mJySn0BH=s{A-sK>eLuQUoYxa5H<*4Uu&q2~qFiv+-uX-^#@c(aKB z9^CKsPcz92&?I9{{>gVLDKj3`haSUL+afAmZ}p_Z2Ni69AzGU#pk8a%E%m)(@9A}f zX93^6*4pkdmSrrlZkD&6*sgziWmorcf&4a@z1HY?SeM&7%(3kQwI++3r)nWJe+5~= zk|_nM5qnD;8>%S!kV6-h0bgt3&sjGtmwS4KVQD>4TJH5WfTh#m{-kXfuVGc)d+*e9 zuVU7zKETg;Z9xpIUya4U@-OsPXT-Xbbd*SAs$-BM z5vF`$-os5yeb@``gOF-3YDjtRI$iy@BZa6W|y3LM;ZgEzzf7e_7Wl8CSoPMw8zDNKAwLwYa6Hf zVd~HXe*N;yC^LUP^^nnzdgSsbNM!%4yVAl4@{Xvi13$>rxX|ns=(CSuaKno{oK z_v<3KX@hLSbjiQDID-pkW^vK|u{M_g^>!()#+;69rh`A|Tkzsx0n2dkE`W zBKY)^;)^b`qWq=}OwA5TM1WVX%muIrXnS_W2(!nQ+!e=&#jNvYzQANvUjjUJSsL%P zJ6QgJVTdq*bz&}nrSsGI(gMA*$?cZLI43YhQ~7Rj8r#TW)T zgBn2qYt(WC0XrRO&p#l12Ol2m%W@0Q$%L@YgJqP{V!5O^=2Y6Ou7*wK)tfGt8ZSBx zvG%MH9N84;56o$BF3@F|W}3;OPp>s&jZ)D7mi~;H4Bm3A z+)u1}qx%U^k@l4nar(#UfI`Yc&Go`eN@UtEE;&2swJ%W9E_b`ApZQ4|f z8#fL+cW%eJH(y78Pd95)RaKOsqO1%hB}r6PRG_wQ9BS$tQQa^Z1A}Swb+B zt3p{>g)o%VhMc>j2C&qNybYbwz#_&I=}u9!JYrZ;Tg78QS7!^lI$JR`(8v9xq@c)6f`OqS7P%)Nj_Ni<E;&NORkQU9bmWx@7zn%QTSmF1|dt>*qo zE_|eO<^c;z+fLYyS(KHRqqMA4MG15;IM~l17?&+2Zi*xbPnud3jj*r3pFuj(WGgI8 zFaSZo5dnh)Zc*Q%d~}nmZ9jow1Y9OiR$7KC($=b~#{T^+Xx@JSO$S<0P*#a0r=AHE zB(ZJtM)b8cW4OBw6Kcv?kE_0}mZLLo-?9lU%}wa*?LvJ`HR@)}gC$oNi%yS&&O&UPa>_=~%PzL}4d#`OYyF?a8$$>D74Fk(#H1YkCN4*|-tUPND@NV$E-vB&*wzPVu(o?k8Krf3{I=&@a zi^pqMb$h)G=x^yoRqyJ=+ay(kC7(uks_fT*=x*OAVaE|1sOHCU-ZN3|~L_o-SJ zdr;M+FpgFIa^)IZp1-nO2=zLy4@SjQh%mlKWe{O~)fWSsSZDsPTJju4np(EEe`A|$ zX44YV-~0xReS>E;guUV5EX;iN==V>F;nZmni-l!6t-q9}L+j7Kwj>JDM!NHz41T2q z!09^%ur3z{RxW^LMN9CKbnx2ManZn9Z2?&9LKp&I`5ManvGT$wyAYmmt4V`4vcxh< zWq>!D$8I44l#ZL|;F47t?CG)GDnlxegoy9EECvFLzW8`1z``=MCpq*Bo6xhjUJzkn z_Wyc3ix(Axiw+oH`9u_3J6v3Tzos3BZ8oGY{rI#fPMhj5fb}1b7$c7IL_in=Sent~ zE51y^1YrHu0 zILSqQ5_oW{W1>P5Q;A*eTwJz>TnKfbVS8IC<@?@=84&a9YtKa(T+4qss7Vr&O6H4e z9*vI8z*33bb$$kiRJl0)?iffH%)8X<^ytxjsWbsRwIaoOOc$;8gC-t;wORnIz&hk5 zZ39@IE3ws|^mC6dPcaa3o(*6*z(bd$n2q%7H>0@q-EdKM{W5Z6e&~`BlqOu9e0PD@ z4mT}J;mGCz7SHaEvK!)P*W8*c zZaXK%Q3k*9f&g;0Nf+~Kv)I-Z5x|eHZ~%+GdF9F>bPYRLwn{*>PcKO0)AQ2`mIz!L*lt>*p*FB)Vw#f$z?gaZR=-BcEXx1m*r3%NA@{3I#tyjzv% zyUO`@786jI#dXg{@%RqEJC%K8q3h}Dd0BjMVHUq8?KK8N<;o9W`8lU{eUH5&j@CN= z-=5YfhiPyvsV4?jw=tqUutn8~GDm3^C@ZRaU zX=?XC!#JZVV0H+lr$ppE083Srb_b+Qr^m|D+Am(8Gdosq_R(&Sys4n}qfK@Ov5`Ij zuqM@_DBF+To^Cwx#A9e`+J|}b4#(7~Q_#>*&jQlx*S(4U-X3;|tF5X;eSIw^HBRIW zc6oU<3X+wG7L}pDKg9r6%l^Gc5A|XCv?(YqDPe$Q+qUgk|Moj5Az-6n940nSM#H#C zC@LyPJf36#McnQN(ACw7j`lY4Ph;qlzz$+yRaQ5ku&B&1=A==Tc9P7sR8Isvkhr-p zo3bcM7NV%Az++%_w(VyZ!e}IhXrc(QcoO9mHK?epvH&bK+gkm=t9OfmMF5-DoEjMD zXC_Ys1TqnOY?xp<28BrAorTmBg>WKqb{~w!3gB?GLB)C@P>O~6fx*Ec^!D`%b4Y2Q z(eETI&JhSn|7mc5UFPU-0Fhz&5syVBxIi!?-zOp7hSQWsBaVKL`*b^_9wt2fss^RDh~l% zoCn2jB^O9y6w><$EFwKH*CpY2VoHf{JLQR(Zt+9{k(fj}r2azklv-s$?UJ;VeaRhU0vAUydMWzBnl)wTUlAbfL>Wyx!lv) zg`Io$A(AY^@u!@DXh{W{_UuGw(=K#2@5bc1DvTdjk8$;ND2PR|d)E%^Z`zBtmi?%$ zu0+Gkxo|2cB3niPRuUQ40rA0kw0I0G&3f_M4OHJ6WYV^p1|8H0lDU$ZPkPQY?#wm= z%WOUM-rTG)p{uhu|0~$TK2TBb;!&pndp&n+pvt%Sc;J@J2s4Y4u~ua!_N@cHzwCoS z?PBTQ*9NT#>CGB@QygR20Q!opL3SI9@!0_?Xr0FZ=CP1_fFva}b!I>)ZQEIPlwJ$0 ztZ3ko-EMscQszKY4GC*)@dH@wjvv^vaJwi57nhNNcq0K2W-2hK^?w7fM%yq2tKMpd zFkHv`dh|3$Gci3QF{jxjO^Wb$`^7P4EPVfk3?AC7K@c0U(HnS^4{|B{>SAHue0X&l zy~F0j&IYi=txOM9E2lm{C>+3|h9pLmXkaN&%Gw|XH^4psOWj9;(+^)BL&qSn;=VL* zm~uDnW=gq#c@*PHfm3f!qc1EtW1uNcnd0C_r$$*!{R@v}u(2%{>GB>?zt92kx0Xh* zY`TLNcDwlRC;fU&PkcDa+AOEvnHF(<@3hwc@}tH@@TYTSBR?8|^)=fi&w%kf-7F-) z;=G8*z%qujec>Q30%okI6->#qTZ6;r#E;$q2LP?Caz6Tzvk> zEY@sx@ST@5@Dykl^#Hl%-E%<(1n^$ACdLdWT?JYz>asOaY_p=w1sA>}>RtTxYyzMi zT)HNT5jr~aE`M8Ge|#2~93p-8U;(VjWiHlSlEFXsIr!X@G0xxEEe!nplnhRul*JVf z#;~#7JfQ)sixq%nr)HLT2Y+6c#-fHSNAy#6C+9o3ra!Sfh2acv-hG;ZCGUFR;t`G# zNUq8kt}YOlGq z#jpnNL)wPe!4F=P;_-3b>X-=Bt2t7l5N1PM2!kWUblBh;>YD()_lG>6zw3m5GwJ}z z1=s|@q6I=5kIKBX<}2e0Ckz~qb(1G5j|>)-5pP||f2gQ$(WkETQ;b^G#(GEWl~|{( zdO{#9w+&=Ty<7Ea8N8BQ{yEEg&O7~;`#s$qD`|_5Yk(zXPjFxLy~n)Qzw8?AM5#j4 zn4#_%R(Cv~#D}}l+0lWg zo_Puf_BUg}g87&-WfE#@s5+a+oidr-@<`Bo$Ie}N=iT?vFm58Vuc~Y6QCeONxCCOz{K)`T zYJgquIy>5l&&Jh6zy$$U6;*X8C@f`dC9f~4`t~>!%9U+skRsbjw79||5-=}hcfaAm z9(1<1U}&J5>w?%&l|*0_F?KQ;ita6}K;4I1TidaBUlYkZ@rIs29RgwqC>u_tS;L6faRdD% zoKGyL3<}}|{tyUN$Qxf~8MzWfps0vI!6FP0m^L)T?@1I8tEz`p z!;9)5$>$4HCen!`SHt%9PPDgoptY@)=OhwjFD_2VmYf+epqji5Xnw$2bY42`SSC*q;#$kw6HzHC#4t-7% zX+)5wNRq4#r?oO=p4Ky>UQPTAY!5q?`AMxKde-K-LK}4UoE~KIT5Df$-S*zArf|dF zQgfm;&uj2aLrQws$)Sp7^r!A?N-p{gK{C%84Vh72eV}fEP>V|xhA3A0dzxHZX!9$>A`$( zaCtm&as)p-HA(?l@RzqTSh*o%qKgGO3;|u&ER1r5yrC5E`Nz_DmxyYX(Ify?Ole>l z0jKeCLC<*bnzdLhBL6f_DpWg z>l5W8#yR-Qxe@&7t*pgl$}RV$b0WCmgb2Q|HiL&g&jo7emXq6V<2?vEVj;Kt`%?>%;1QaZm|M(F^5-2nXNb$bSoe4jqm z!B0+g7})y!V_B|e-^CgLz!#2kaMe68NOH-2mXN->`K}8O0>FCQq&%e@xbG7A`=mR7 zKE*DvOf+?~Jx$9;J^<@&KU*)X7kWKHHSL|Gfu$H&`hJ?2&z=E%=Y%YN@@gc9fn}$w zH!SQzI3|GQ2QJ8n{K~OeTsqrj@aozpBR+tM>iUlJvY1un;^y_Fg++p(a=8}kfg;-d z@-)$-qKJKeC)YencwYlpB!q56+`~934t}sS!|szW?{o0qPZKDRTZAm-`ekB zVFQV{kH)|<6Uu)ak-?|tXK}*|Q9QhDbT>NttrThRrzdAPLYxL;==*OjPO}T)#jE2M zqsTm|N3RC3Si>rGYL^emZI6OVoOi!p>xuxZ!8Aak@-#L+_hbS+A+a&eo|eIPmXHgz z09~C!3Pd0=|7jwA{@k7jzOkIN{(M$E2`qY6fo{h~TLDEUtN?02`DB z7Nt`Vad7u}gObm8;{1=DwPniY4QxE(;`=A0a8hFy@3uLZU+ZG-t+`_D*B_h3irHDb zw9mnppNoaE+v<`oetTL5bE;hY;>`&D@{WH)p95fdcuM}2*BHXe5ZBM-eE0LBChCWoHNa8<@)E`T*!b@=CT4TRaSk$>ga zb6Hqj`776BBl+^D0aRN9%IgG1+rx8a;ED?^K=4z;I2#MVGJ07an@O=M*bOg)Nu|Zo z$!&-ux2bl~043#715T!+>GoFOB~L{9Gpo$HguH1GR-G`g=#*TIA8%?m$ccBVuk)-U z$I`{=wXzn{+Gp3It-TFL9kmdXCpEGL z&-QIw@cNq@kSHucNqH4!%$$v>jT2E_QHEq80av^&;z8Em+lStsc67AuM`mOYlP6DP zjiTPZeg;prZrh28lcr+U?88u0REk7FlGj<+)qo%YScB;8=|ERkr$kj_Vd@AH1;wbS ztYsjJzy#TqsJX%05=t8rLq|Xy0Wk>hBDN2^qKyooyR#L8{ap;8MB_!w?qUtB5)z1~ zbnQN^c6B+RuHCM@)93W%X_{z-4K*}4fc}922Be0DheRAaORj(}vviu9o3V4}4(va0 zfI%AR2QIohyZJL>HG%?SJQWb@D9(TkiF>mf zP$YtMD#NaB1Xz)a9O;)4xI^zsyDm~07hS!*Xm9Ia*EhPK?&0WpMTMMBUtcfxDPkU# zSCp}vA(fBZCk5CNW)gK@VsdHsMgn~Zcq$|z`MBhb-ShefFv4R?fIAJ^(wHK>uvje0 z?Usng_-_KTNCci(XvAcqe*{>`_$6j!jCHFB)S`dXzNA5wEG}XIi}JxBjbc)=)|ILg zVo_;un7$`4t2kN2z$5{U#A1sl3Q$^FhKh1>39Lj_MFl7-A^~0G3Q6r0jgt-JU?i1h zb{x5|a@4|ji~+cw?jB}lz5D(q^kgEKbL6oosh^0L zs33vf?oJ%o--KN|x1*x01oczrpr~#V64evYk3yu}C{j)gnMj;Ey8^GJ@AF*cMV7P= zv5f8H?RWyf6tRJr?WTpey*;-bbjj?w^o~c|7S-;8pE0iUvaVawG1i1G<5}IW4~Ue} zqHmLL&G=Mr_i1n0i@w~epUw|pX*X?IvenqOj#0ELJeQ5XH+HwqLw-BM=7U+wnr6#c zBq9I$rpu|6?bVkGYEyHSef*>kD7`B8US=X5df@_nvN~KxJTMftquS8)66iBi*eP<%rkrF|7tQm!QD1h@#wO`8eQPPPoq*0k7tic; z@m_0|-DAiXnNEHWt8;Mjln4k!Am-KApU&XjR)1HZJ{JaHg?AW}J>x=XcACP#5&-M; zJ4DQPw95ckyqgh2h)xG$0BIvpR6pA25WqxWR!cwlB%7kp5x_<6hs31%^g|i!>)YMDD?OFWkoGAA6Xcs~$xVR8T*oE+GYeS4w zHHlK5Zayc%%qe0}<-0V1_4Tz`JgfjL$~OT|KR7vxAH9@i;OX>f0sua;)y2ME7sYW0 zb7~xX=r9Lm1yY`Gtj!9u%xX~qupE5)5f_)v5fJM2W*3ic1@`pM4sfOU)i zJJKh6>7x)ALL0!U09GpiYw7KfO{lkr3G2P)vlAL!b|Ku=4PjN}y-ZvF;AIEKEJ>wTdCs68Fr)4p{!o~J32aj%d_-86h!s{-MAMb+dfX4i<--uwP-ke+O;x|>a zzAykQxY&|=_iT*d?G}gK4zGDEmg_Wo0DAHQbwyy$J@hWN)bM%aa~W5~gSTcaH1v2Dm< zk#+(@N$ZN3U<4dp^LT>WUf1Vm7o>5`ybSjDJGkrpDE`&vU?}6Dx=`LtU{Gz5%h3z> z^f|ckxRe60Oyf|Wn^NZDcc%?=J~nkm@Q&SYS^F-{=yEjJggI9@N;BR;auujPGcXx5X zhOuo6UVW?^*$y5{IAPRbi$QT=K3uGt56HP zdK&@bE@)0^J=56;_Ij0MjCEtD+1miS@Wy3t^jZoWfGL+WJ0;#=C=DSGWb?$(RXvfV zs~AQ6tZHb@8uC@k7%NT?z|!DU*kf8(#bc^5SfF&IYyeByAhdbr&A-}Yvt^(*zgiDO z8|JdNv)WK?f((FZ`mdK~swa=xpcn?0HkRId1zi-i3zfJ+sS|kuuoM$aKoHV^BH=ol z>!w&1P6WjSU^SHEu*MpsyPFv-dEvzuSf}XdqZeUP<9L)57h=oiO?c&v4JfXtM|FK8 z4morlrZrAPaU#L?qqLm}-&3SCVqkT4v>=lj#H7XvC`uNyh7h^1?cB8w6DCf<^qF%Q z5KF{K2wNW(QJ#m9$qb>lw-eo6oeKOF<{N2MRaDfXD5(G}o)7H)%so#v0RchOuF|$C z(lZ(n;c?QwBKB1_JtUw?vJA=6O3n|to9Q;>lu3`r$0n3sMZgDvQN%tX_7i~|RNtfn zMI!11=p5L;A1y5{tldQIMW7G$B}$h78`7<6@90EZTPybM+l!8lHVKq&(-KAc3 zjf)qE`y0994Gj-6KvZ5)j*^mMB#V=3yk!~aA=fz;K36V(^gikr#O@+i73oOPyNMA* zOe1D?xnMSU|IiTn`v;Is6XOXeEhgqr5ra-t*HmVjy<_nxzq_=gm|17Uz@jn2U`+w7 zhxD#Av!H}g=JF<%(kX~1SYVyRh{R&^+>5Dl=(SnW98>k91m7v*G(`dI z@9RNd{}2)hVucm4TOk2bB;wBbB%n<(vr0-!P*hyPZla{o#nW8GK{OT-_sT?^*=^Ks zcI@7ZKEyF;&U{ohPD4#aIa+pZ#?}pQpt2x>(&8j)YpPI^EaFI>_PGLZrdBZicdfXe`uFxJSOQnN)h1(S=cPWM#tJ$9x(RMBe^gXMZL z=Q&*i>3#r9#)@9$q)v_8fr3EnwcBIp1nqp`fcZH}Y8_Lz>Tmt4mwCS*T+(x&C06c( zvm_PIB~LMvH2uh{AGJ*Led+RpT-9c56i>u~Gv1~>J$m#anqnL^QBg zs#84cYuYG%=x_%s4vnzxP4J?y^aMKn>a{GI17OBj$eC`bnN<$1K0-h$+IWRs1epB& zJr@sb(pm}r+EL>O<4eJer$ys)I~r|H>3IU3$PMV>%N2n2sN{s6sH13XDz72}2e6<3tO&mMVixyrbQv_d;_!$VUDib#;@jVL z@#l3??%*XFSPrg!$i=!AmvyNwKgjPE!lDXZ#4cI0 z8Tj2BF8Wg;Vz~hBx_RvefF+wx17L;q22;lx!1^}^EG}OY!KMy*A|HSy z+EuOxVCe-R=RImOksrX)8d!=Mr4!&H7z20t>@2=~3`J`JzV%|%r$I%a(ie}+;{2J} z(D6ZTb-#Ht!mfGVWo^LN)oxZ6@ zMw$UA`=T-V(!L0O^=6!bsc$by`2Z~YZL_Pg`24~&Go-Xvj-3{POEjgoF8*gx3dfBnbqxR2-0$E=uSW6Q9tStFD1H|6ZWXsv zd)&}pR0khFJj?&W*53mIz#rB}aPJmX>4B#E{{_IZ87p}wqx@FOzcYWCdjr8WTwqB< zKhAA53$cI^{)<;N--l!6%h+Xl!ytyDvaYO6G=n?=H!{ELoCb;P5gK$a^g%6>dF%8& zZ*ILq54uAOv)iKTsvZ>Dr~y1lUYAkdA2NnD3nL&~k+1DcJ*%^O27iRj6LcY@&&8d} zn!`L@8*vx(SOdNn5@SZ#O#0GpSppadW5x!VBptDByp~n_3jUPElWB9Sq91zIrdEqU z9$C9Y|9Gf=2hnHVnhpPHUjBA{MLl0koDHF$oIGs_Kkarc`!2t$)dxSkj09JYk zjT0yEhQ5Db2>V$uycu;36ESJ>3=|d-U{ol!67Tt_UlSW=7=3-693_vzMP|McfR*$B ztXPb+j&!%x1JDXK#Vi7fI7h93)Q2o8gW`$3OJhZI1Fp^FqMc@|oar(|70F0s$lJ-@Bxc(`;nQDTbr82P| zRV>E&CcuvVW!((-83M8hEadsii7?1V8dkJI5s)NN0*eqYNHAlH+$Xi>6^Wgfm6k9V zNM$9hE{>!ajben^P{Ryh5&LRzV2D8~0*3^s%<|`5-MtKEQ9Y6S9=ZI{SQuu3dy0Zc zuBBkcT`7s{7ngEg2;d{&ivY>gun6M!ka&CF07^Bb;O<+(ZcmvM~%Ifovoy3?~)A zRWq=RTd`T2#I;+kU&_T<_IZ{S;Qemfe)jri=6@N=W<1I`Qm)Th5S*td4RKg2jaq*U z`!U2?Rk!D}WBqf!p6m6TsMZ8MZ+PpS&5p8N(oG$B9>hADp5EVS#<1RN*lAjslzGHl znxSSMQ){&X91R;xM?{po%Xx*pe#y$J!6)5zHm2z@z^OJ4vc7e58Sv4tnx$Rs zb1SGFms%fxfi{9lg(V2y=pi~`!|stFn}dN~d=By!CVyQL1+Y|Pgs{Z&H@ zAp&EjR5;AGqUD*GMB6%CZ140VwZ4;-pn)kZEn{nx9iGWmux5hGS~$=UT6&dKu*5V; z6DUDtBUTTIySEMi@3pz;88XIbFilQJ9Vz+#nr!EdU2Z4?4 zF823nq*WURs*cnPrJjrtIGHn-ogx(oOeiNb2>+kBZiKEReLxc z_{;7?HT}CBJ<(8mA5ufi3@{5r>d;O{pRk6PmM5p+?5Jmf0R7ZXa!#R}}AMhuwU zo*=g#6Jhn0XN;;oqhDv&9`&Pz^;u>?Qb~xl_U3-oK6d^_X`ZqAt*)V*Bt~uWvHF9V zBM$D)gS*S>x*!l~c1{BwBme*)07*naRF#Wl+(plbgLm6(VRRXXcB*zyC@*laur7m| zBAI#)^waYW+6VLJBe>?#8z`N_s$FKak$WJy-frtAp?<&iPWZ-GfJzdDCk7b-Swl3& z`y6JL5#yFGpADz~kp4%a^fbp5#$0p_Ie5Rr!LA;&$%K zp4r+7W>L{bO0z-qk{DJGx?L!+1nFW;E0^+6eNbKetDOXZ?egSJ#W(8wca8px`S#$_ zKKS9E>sBB3te)eRGz{R}Mx%kHPeJWDP|xoM$S^7T3IDkUsc*b`0G9N3ZA99-6K4Ha z-AOfM(5~_39sPZ2w2sj|8uZHTkKygE z%gM{2c9-)3Sbo<*&Z#oQ>31)ZpT~Ui&XyTyA|OZ$R{N%8&oxh6|1_(^*3zQ6M*whH zq~&m&?w8tP080&G`A+FE3z$!wFdl`;67&xap{1<@dz)HN-!K7u0HZW?#JtqV z2r}srcJCulfLy;wP(724un;zjbZ4?0X^y~&!GS>x4h?c-I{HU$W+NlR*w?fV%}ved z=;&aVFao0D1#whVRPeL?eSO%yYZvx6H>0My3UzhWm@r}7|6}bvwj@iED?xEL&ds@p zhX>2Zsw@I@0caF@F+hL79CYvckLCmBG_af9>}N6m&~s+c=+gj-WF-sE+#{Trxp6+{ zil``i@0nR-RTdoKZuXuMQBhIRt5-y+*{Csq2+)Xu5`apxDc{ToAP8Vj9=BZP@>DRa z9?99X%gOM;T$<0P48TAy-G8d%G6y7-5xJ+p$dd3qfGmUlz~qsVn+2f@96Ej=OMgIAM@3FVXI>3A98i#j*$&4GA7kFgX+8AAHN!h&q| zcF(>2eQMNdtb6Du#*9O2W#V#~2>Y8%W(Pumh#;N;fChj|+Aw913otZv5^~8E z@(c*h@Gg?ooBUd8Q~~-ycF0w=z-^SZCe;p3>HfVFT1|#D=v;AhNTpolP{mfG&aA8M z?KOS>-8ZzDO(<7s(Bb{Zba?iNip>L}${r1=M8lmj%?a{{fe}`uWu)4?c>bO@3&2WQ zuk8Ae;MM=0%ycUI481n*v{`X$xU`@hMMgO&OWh4y6HspvqPf)<9}Vz-~ON8 z#y<`t4A4a_KTYviQ39)#ur~}2r?=5lz2HPVYd}NI{!`kKEp2Gl-18gE_Hna*Zqxd- zwKdHaZB>?CkYed>dOMnwTi9f@TgG~d08DpQ!YJIU;HGb&kcY&`?#$Bb)m z`sFjPwm39O+MdKh<=9Vt=RDohdE@Mi-=f$~nDxjT4|UwEeKi{b&5y;FYLi+xD;)?? z?AWI9jJ^+iiqM|KC1oGsY*{Dw>vJ3ER7&6c+tZN&u)=yno1Px)$nv-0bfTv+RTP|( z-+f)dUoMQv=(KMjjAO0xR{&_8RD6&qF^@bZmZ*+#q>cQv4~Afr&<0)4biAZz>g;c$ zT;45{)LL;e~tVa)!3H`gi~ z0Rj}jLbw)kwhFTf{|Ix+j4`w4%q>mU7@3=|^cF&Ghncs!0cGGTS{M{8)4po%7HOwp z9I))<_9@PHG@Ego8o34i{Cto8{EJiSU%a6A@7~exe)l^D1^)W4|2^N(hH$lK&wila ze*GQYJAX{~&Yw`N)}-;^j{fDJ|36wxM)Z>}pVC)9`#Jsm7r)>Q{h-&O&h01OXfune z+MvOBLZ7ZXba8P-$0uiW{@^j?^Ciw%Bx3>@0B{0;HKswoOTAu~L&h)$NPbb4RneuPH*^I&KLCP;W^zuJE4Pv z7L`kR22jRR{7h*&mrz24!hwl}`f~t60N8Otam_KdqGGwkEF=L>#$2zkth8(H(gE}} zm(TIdivYdKr82XI?z%l@K;Z|V59~@X<^Eq|Rsbw@MWDOIT5Zc?jWrB`>i^IR{%T#VBz21U59@7?i(5o?r65$q0{rnbo$^4 z)%K2Pr*TZf-6{=ssx;+%asd29*I7OE)<&x<*7&$XgMfh*u0!_V#2zsCtBaS{(6Fue zRzp)eTT0gyx1dVP@QP-^+T1(WbCj7y`8@1VYnU`X#EtkP8sbpL+oU`^Q-?FC3x}$XNE|htm=Qn=j)svPef6_ec^?3CEgu))Z@==ojOOMd;{qvON^AkD%IM$ zw{iTeEr`ISw2hpe;>(0~8zL>kd5l)q6O%K0gXkL|ea+3SNd76#sXEE_bae{{HWuG@ z0M<4d9BwGG=T)?E_rRgpu=;?CZ()03T9T?8o7%H>gg$GA2Q?+^YGUiR)%JM(OqOr` zdefdy4Ex$bx3?YJ31`dlwtOtjR%~iVwoD@3@c#5Inw?EiK|V+#UuAc~KWWQu?;2h8 ziVoJQ4eHIWnRorxrP){iS$#>}2;JZ&4hw?LY(Ll1)`@sJC*_m|OT{4w$u(*HQkm9f zNMifGgyo0poB&vHEPvXGZhCL!@H5#KE5GOp@jwl|OH*WQo$dAIpABL;3-6wBPORra zSSFN33XElvwHW|_I=q1v+S6peEJ;!xe3IY?2iT17ucuCF-x#~`;YZC-`-cg>6CWO2 zy4(6hoC5SnSItSf$z$UKB-ps(KWxM`q)+XbCSVspO#mzlQcA9G$JjDVD?6oq97gB3 zVKT7X?S%l2ZRU0*s)HI?z%(ztTT2)N%xXcdrW~~j3;O9LvZ*+h=reaz+P7XSCYMQSasx{pR<2UIA4frZ>kMsi?at-!dN z(qMpazb>;|z$U8K>Qt?@O#=6F62P+aNeZ*>1cO)$8jS{gOCQ3p5dH^-4g*sC0soG? zU%9;GW&%)y3IJXKxEc%x41NIY0T_mmwSFJrYeSg>xOfL_B;-RXl{iEY^&>woaws*C zr>cV6^Z+W%d43@H6E_hek^3Bp<-zvhO(VkkKnujTa^t1)EC9YJpo)t98wMFO*@C~NeUH?}4W7G>gjw8eoFD^4h1saB}K?Lyu;u$QEt$~5F#2=fJ6%)pLX z@`f8>g2?@aJW~u5O_84r*BBdCngNp;WX7kv0z!e2hUWkoXyb>B*d4T zSDO4?=Z^rWxM^`k%lVwayiy*3p6n$jvl$IJG_*%!gcnXBBLH#>mKo>P+sP52)zM5Y zCR@U$E}{Q(2E*$0DxDl3(ecp%?eDc{wV2cG^(X4zb?B}?pu^KMIz2n5_R$&T_wUoV z*rNV!jq_z<90Wu(H{cp@%9u3+7&%8m$HA^m(J7YhR{}qU3o~n(ED8bhXla%v$!#We z@&D{{VLTDP46|eg2f_OKmdkg%*HXKzt8t|2-Xd-08g$kILUuWEcFK}Ivf0GJ%5N^{ zP?nVd@A^Nip~!kw}kn5KXS_*PyATQ zO?duh#kNKTzEy*_dB}xw_)kZHdzl5LlN934Z7Gwe7B`9A$!=(TywJ2Lu2xjdlVFMp z*pCuUY200Xa?^HD-gEAUnS{=ljL>>lPuAAt?`;U-%7zeHw>M3!VNNUg8FM+++N3_a-7Ltc#_c`r>`VuRx3OK@JhP=N(~=bU<<=$GLjSGLF-+U&efk=vwfybLW&q1Ma$#9|!fX9R{aO|T zciWSGZjVG=?`7zH(8&YX0^ld9&7v0yCb^sOWPcedRCpR~8e~|e3ZzJaR!PecvLgPs9GqW+#xGP>S4o!c)&JOuk%2Qtm$=tk$pyd@Hw}Ip&ng)RzO;FgrOt zy*D>!8734z4}igJz-0bOn-tW-1^^pu`FPi|ua*n5dGq?fxrq{hg304z7*)(8G8+$h zHqtL{jA)nofHvF?c$UeFg)pX8aYaA5*QB36IH2p--_n~`uj%{mzN6)0L4Wff{zd?- zL7!d&*n0k&8v7?y+dHAjY)So_OM3S8zwyNlfAtrC!3?aYKmCd(V}#FjEP!?I^pwiA z1~ZPXJ9l*X@tXGbkLdLDKHoqHV8!`DXduGQW;7c1sNd^x=pO*AX0yc%EZjthTvg2M z_83?YEQbp+7&K!B6o5J;EJw)S?d>&PUw@*@%MX0>-__L>gH`|-kRNL>7;sLeM!n7q zBaCae+vU$^2-!1?JFtB4!#SjOHCI$l!tcOdLS8Z??MC8t&JhK$0=b;#G#d43F`w{e z4!0r#Ad&GDs-E0(S7g)XSVs#1rFO|AikO5z1f?%H-&(Rx2D@h%vTnUbqo}T1w*Dw2C_yY$-9M%1fZA9UMnEq7V28kY`Nn3fjnTiOep5 z-8-e@qeEt6m5a!YwxAJ!*j|s?`-gOJd_u?fA5!`F5lu>a)ZeYs5IHpgaH`GVJa}ed z@S`HUwL<&>QAU}MzHQdeVq4bl&0vj&&<} zGCa_&QOUy{hM`_Uz$AcPurgWfpjHDMs^a}Kn~X5}#!8+e3)TO8V)q=oYl z;#4`giRT*%m7eOR=emZrB&aczs{mL#^uPT#0kE{pwIbE>*dX{)3H4GPa=*}615(Kw z-olW6Qjn#RuKq+lDRhkB8DGJ?{<&x3(4%Ax`da$JuxT2Fi(!aj>CA~}S?h}YQS&&X zK-)Ckh?wW>=h>TSSE8Hi;jB-e=W$EIWqKXyCu(Cv_}erJ>EEY~bud%X&0AV0;<=cr zMk!_gh=xni(FR>7WtzTc)RDB($xo8*N=jkbQzo-_u}u>r`x%Wl%Z^jwY^Y6anOCE6 zU@VYj!`e3Rl-Bff8{3ev+DCjO=WP4J%U)5}t+k(_Tv_@Wt#MfZ);2Zi$*EmZQ;&m_ z4RLFQ=!j($={)d65QH)&oI8&hVH{yrBi>y4r_D}REXLv=YN(%wi+*Dv5ys{h8+Nou5?ULU72jOv@@&C{(AyCi zATZ%UcwWO58K^R2#K0J{MVR^}Aydz=Z3eLNg^EqK zZdIF;r!8qT98kZ1#|hQDU|02ebaj1AA1^QH;^IAnR|vfu&m^Z2=Y0Y|QZ5s~6R?$# z6A9o5z#N1J0_b37k73aPv|upA_=W(Qz$8LHKor0%fFAg)R4TI`f$;^l4#uopE^-+F69=4=Yr?*1qtW0{K(qz=0|1E`MI0h3 zY$U#Ya3x`i3;^Zw43wa40I!M$c!NB^6atWivN>1O9HDY@VFHsdn!v4GT@`?bK+<#5J+I01Fvd48R4C z4QnQmf1ssoDLcU4!sah0Y&F#`8g(%IKLJ@3Mz?mGCF;5V#&#P!@RD{!P{KB`;*5FUa#Rq=dH zDV*&D=dwdze)V6k5?)*QL55S85sH-dG!JR!7wbHBZ)=?KSg`nPCS`o)K3Nb&z1njS^!Js$|t+oLuloqkEoxnQzI0oC6{ii(p!O8 z5vnal$QhEju0T^_wK1;+(A>7nC);PcT6y;BbM!r&Zh`IvoyjsDTUk0ODN7hBV;*R= zl}W5@D*Hs?w&k{H{UvRRMwdr$Gi_V5W$8}3j0S8a_BBS>|H}UEH9S+1qcStsiMW7m z%FcSn$w+HYow^zGIi4}0jms`^i(%Pzx+g)m1c2e|msji-;~eTxXdxw%Wcgu7D zta{H|kjyOHaZ$>^!smJ-s}8WhoNDuoMbvfM7mPircVUDpYcu_PBidfy0gjej8zQHA z;CIFyBqjX;nJeN%yUmoeTA5#d<6Sa$7+VWq8DI??Um<$w&23@0i@26f|CO;N8+Z-< z5JS#mjXYZh%;48F-<%;t2w}@4%?5zQOd0{2n6;pxCJaKzreF5Ca;qFzKpetk6UfVE z!{4BzHO#<5n+)R&AQr%jz48uydD^6}?(fm%v)|DRU8ARK7a!Z z1~2E-xw+<>0lVE>>UO%+>2~SU)hGJ+@sjSkx6~i>7)aX93%Iabki1USTA7(w{N0YQ zd%(nDKxZ+R{AcEJRfF@I@GRms0KfpiB)9d+ZIO`SVAyA{s8lL4IK}`MkK^31w*Z7m zf_8vH$lruy;v5Dy1`vfr<1+@Zs+BT_Edm7T4@Wd#uBckAa-D$9!0bU-9`a}bM6{F) zllP2sWtkfRQSJgaCW4uSoKFay1AsM!%#BX6ULhBjguVgTLf?>dpTlMigOPzOb91Qb zx9GL76FHC7d}h?vSS&La7+}jwC>?Kb!Q?`6dd@rN@_A|QHo1)uK$0Y8S7wzk+!*2F zzT^yehVf*O3!#+x9FYv}=o@sQ#^A18fGFkhCLVxM6@Y8Wuo!2Y z<85~bU{#KG5q7$ZM%*Q!)&)amT;6KdT52`w8Z%)**do}UNHlR>h%Ve#oD z6~=^F#+9!BdIM~*&(@e`c}Z=s*f`&B5E%wrJhMjV5-K2_URq&nya#~!{+O;qZY>ji zVvBE10sOW&mT%~<>tT+10RqH`C71ny0$=8E*nH=bLx|ICJimv+r> zWkS;ZHCg<$a06gvsk*>M&07b}THs_P4ury=y4O*lDP%@@&W7SYmU$JTDjfW5=BL5| ze0c+deRb@szGqJA(Z`R?D5QPJ!)iva?=!9o3O6E>HUn9AkobYvFRyoj38O5R)NCpvsxP+O92nOHp*OzY~>o$I_PF?JlfuTPU)`ykzcgm zhU9DMjRvA@8>>~=DudwSaJ zheg<3lG->2ThAu}ACAcI60fXQbNpp61hNXV938%>CY z?L)l&hhwc9E!~83a%eMd3^*AeE41q}){=kA$kyDnrzh9Upfccy<`mKmL~ybWHi*)^ zxZmc+KEsqjcouF;JFMjdz&hKf_uu~;J%9e3Z_Puf*NPG~sj(p~3<7V|OZ@Tt`5v{>%Y?Ol&U z2wQDoVC9Qt4wGVr&}>HI(SX4#+!BazDI^sK$N^v{mn$$p0HEj1+Yj__|MnZYyu6@p zw}S;<*8l(@07*naR3l)@Vn!Dq-cjfFhQ|;LD!JKDSWsYC)f-i+)v8pkRvCyv&Z*&e z$aODQ$O{HW7VZrj7Hd8m^^8%2bu#;Q6LZ6LyGpi0mb75I?(lVP@qE!iHOc1qJZP z+*&Dv1I8g3QZr^uiPhtvHYy;*vrw>?4Ds!c`8<^>B@;3TU=aTy&z6ke{=oq?8chN4 z76?BaQmL4uIy0eKRBtwU?D%I#efaz1vj7AF>RJzPk;#6wppx7NyXr6q=|yfT4=NowA; z^<{Wq_MpYw?&qwI0_N$qR+c0hB=|>!Vu_m4_x_r3@-r@JD1A z18LR=v-8Br+6ybx^%^Z=5KRwCyuCMnmH-9KIP0#%URGi-As%CMGolwlsH4q*JRh_e z+OYLsoDB3?N3Ia5a=(OrX>89@K*L}CLz02z4}`C3xosld1}IVSkKe?lZPVnl^lec*|JMN)p&zVls<3R8iTziV#8j`~ zm9HCWM11q%!U#=5wy2>25aVrA*N+VKv zat{Q}`V-6=pY`a0RN*FLUHkm8O+J^}!VJ;IA6v(FEnpX&n5X2N%WS<^u<+}Ywuvrh z&lV}bSGw#unOH;P#<|^`{pOFdM^RH;S>8-H&zSvWLf5vjFu^8tlRUO5Fky$bm+@!J zChyT`WKz^3b?oB(;-<=NA+EG|$ioeJdIf1B4BO}a+FIP=Kl(?RP6reH+NjCF8>wx` z=tSruIwp=5n5(r5xPD_r>8ny+4ZC{m8|My%yg`fzaPm#4zXD$PS9vEX%Z@FT)@KipVT3Bq zIp!Q2XG~P7MKk1Go7=~#GBgc-viNXk2a;5+gg<}G!?`JnknsnDN#e_*` zz%FxKF8wljy|k@Di81Vj1uekpDV6BBQJ|-%P5Q}ci{5?z8)jf#eY)b1rN8>Czhvgn z`}gk{D0=zvjtYBcRM@*ui+q{(3k$m6D$!Z9K<#>!%H=BU6w5RjjcGKv<3!WT#e~@= zrAm!vi;^WDb0f38(kM!*M zOZxijuQ?>ISQ54jcGtI^TN;ms42A%Z;6&jj91Y+E7(2MF4*7?`-~pHekZUv^F?a%S z33;LF)he@f_?ADDzX|^W(Bj-s(-|{?B*D6{f$H@Jmy1tu%OK}y;*gmY0~n|aU=5fv zXd9R@0I$Z7*Jv!crZ_~dAo-IPE3RiU16>BF|dcQHH6&(sA9lQ!6byz;d!vNCMLoA4zaAj zFtfSVOgJveR>qo!xiYY}SV-b@+TrqWyCT{GkcojN6S@RBaW4>Zh(0rTC`>cF2WAKZ zTlfy_F@z_XFj|0q%tBf&B$w9|wY ztpuQ!8G}f2k1)(U)$275w{7pWS%)O)JJ@{)Nd@S-GCCpPCu@y~OqRYPuNc^KQv)Qf zXgXW+?~oC~5v!Fd_v7a3iUxxo>kMBUz)Zpt<=Q87{KYS*dH)Nl?j2LUTp`L8Xt@Kh z(KEgV)RbrdzCc00Ps6J6!?3My@7SkoIjn6C!wLLlPHi}9bDpo(;ophqdkhg{%IIu( z#He+83#RIKl7%$U2s|Po16Mpp%*O5eGL^4`d?YN|QwDD(a9OtOhn_WJGM*39*%D29RG(XmY zIv&swOe9-ZwpXiY3qGSXUHSzUwd6Q_3J0b0Zw)$O=q1MT|ZP&yRwIEX9cG{&hP!ISGeOzh`y>h$+#d?CI#14$r>WE!Y-v z^3`MQAlarz3o$G4I=h!TVa=B&C0uBfTD#h zUD48v%;uV-d5?||yK zV&kO$g88U?Mb1QFbV?fN%Uc5^{DUlh+Sm(ipF6d6 zN!PcrsiFtY_mr0C33PnIXc$|j@7z}2cq@s6IaD?rQ2OF-=S^#m$b+4NRC5#`CfHMK zZ|-r6&Ax^=mQ25r5z*6UY``s8XPtM+{i7qLNvcIBOq=|38Os_AZ+?@Z5Ox@cOPP>F z2eO&<*&nkYq(r*UwHkTEI>;l!(NjolKBY>zM5paCJvpw^)8i(+`{6hA>g6jAy+bl{ z+$@N`zkKzAK3;yHH#b8DuZnx;M5Q`4cc)a}8PQRh=xD!1&1Rcw4TKO*Xf){2u-~QC zaz;mohg2+AX*`)zZ!n_n-GJJAhje&+3h4@iPuKSqfC7B5WVQ*CSzms< zPm-lC7^IVA?+XSJudi<CPI-3BrlG_#mIN`=jgeI2CC2F-A)M~e= zTq#ktQenm)KqvWE{s!w2Kp(&~fXH_3R|XLBJDqTN(YaALdOrkp#9VP)IK_;T)D=fk#ebl+<+;>G+|V+ zj11r%g6iu3AhEYwT>UjyeHi^r%F-3UJC9b-UJQP~=C$jNzXZqlfFS!OExn*c(QD-lFmDlv9jWBx3`B=r|Tb9fpH6$ew8NW__f4XI$u5{3)rRwy_M;%>xwQWTU6{G@%x;Cjz)9S&W+4D zy-b6LmI!kGxBtEmn z-q>W!GOu_A64v)ZzD>4$o3}panMlt~I~l-w*tcObt}!kblfzSz8m_ZaLI5;(liwp# zuX&aKvgn^@8|?&$5TE7osS!#q4hy5oNK*2$c(guyLkajVnhjSKbVtG+=)f0U|mM)Xe%gRw;L_bs| zxWH1kTAbHt$~l$p?N#XUQJtO~)#$_X-_x7dZ#eHxrCg;y|Fb_sz!|-G@r-jwy}KPz zasL4o_s?mOt59=yLVKkpo!0Yoa?qw4atD>lGzD7N*{&IM)i8ewCO$Q}fj;Riqg5@eSPyHwa+ zF~bH}hKBv&_xX|}$I)({nNmmyk5D?ii}3^?gGB57{?N>YT~5>un3Dl4B!oA4&%m+* z8)?qK700Y{qIK{fB&C|%N-4R~c7zoLRue)}Z7v^1TqR-q&Mvcmm^lST7uZGs^>%j{ zAmW@>^C<&O2nDRw5%y?+9?q3Cqhc{nRg6!iO66jihC=~<`olhhTnyfD6805?X2_+s zzu%%(Q*wy$ZHT!Xv-m3Iib<@#Vz6#Joicz078x_^Cio0V`{mX_fMF%RwGlT57O2%| zP_15N00?@G@JIk*xY-Z=1oaNU6~N8cuix;El4u_oWB|`J#EKK`uT~PehlKs*GBcv^ zxq>(tI{;V+J!KG!8DA5cPbYSB&!Lu+84U+RnoLFvLgC^8Byz`)fYntj08q?RxmaY` zK-OTWRVpQ_RVo~oi<>D6%$k$S7+7CTE-*=epXVHJ2)P}hJ-CfAUtoO@Te8dln@#|N z;x@$v^_IId+9}e!Sf!n6lS-`vs_q|C>-dZgj}AD@5p7Vr19?i0EX)UY5r%`~jg3JF zqp@GQ8oGa-Z5JD8ZX7h*OYay%@Idq8x^iR{^wtbEjbiT^95a^;@NIdz3@~`_v2}yj z@sMA!eyISKJ0M}aAy{V}0^uMX=l#T9urjN;S=N=*=otqHs`nzxx91l+hu1D+_JB$K zF$-XMhvr^GTYy2^gZ3kLT7eTEch>dF(_62r zSx#*7J?E7NTMdg`>KktE8bs4`a{XnC_;W8DgS73A zcLlhyFY=B~rS;{fYo?Waii%~20cOl=SB7Um*KW2m70->Bn{rV}KFA!DlYXkqC7L4q zu~x$<|E9M#0I=*MaVehB52TsSG>WzpGLkx!wm;!hStsV&@?bPmnj_zDGnY3gexQHp z)@hqh(*dklpHo%S>qnIHCN_EAnqhmsPVLuZJxod^YbJP~ZzJw)gyr=sT!vg-zCB3{ zb=;0MLmZX3ZR^4+x6Dno4G%BTuOKU5ID^#-@?DY7>VWsKwZfjP?Aj0&Y9C3F>t^sO z^(A#per)rDo}}CVthr@A&(x81_8}_M=p6v8|MZ|AINCC<>_%H)BDPPy+6MeSWk}oV zyu455C2Q~e5D$CW?N(2J-PYnHUxwIAd&kbH$Q*veF$^JeENMzPUC`sse)z2yqieREZkRI+e?~ zT@FB!gm`i8CPuSFhPYvl0kGjv5|Pj6Mq!D62eYYIDpRpsp+dRBiP0e&fGG$O16v0& z1+xjD5Wpq5c?&(=rNxSr2axc5q41#Nz@tS0Jw$xVJnlXOK!nKC?j%8jfNuzoX}5Bq&}MxtpL+4 znJv|7H8~^>fDY;b3kv@h3TO*hL{&~e4u%iL;obYU)afEDbiv?OyVYXw3t$acYYpT< zLk=+$f(P~%`orU}mO`;jrHN;l792s-_e_Q?-|TOyXuVwgPO2J0PO%?Jvcw7)8ixB-``_B z1t_XFHF8+zaw(wN7-5}g(~xxsfKxGV!b9hC>f(mLL7&-RVB3vG15VhFf7#mX5apRo zDZ6oisgM(xfz3vZ<S z`CWt&7HKdidhz~}-d%U;x<95xu1vXVlg^&}gdRWr37tKBNC(F!v@`}AdJJII<`wf; zSpK?U2)1th2<){-p7g`NjeTalH3tLg_o#i2?Q|lPPB#$V`X{0B(f~aWFuT-fE!L37 za20d;8eO=$eZpg4sV&tuyS=u|L-m_ZX4v0gsV;h{!n?9R$kq?fN09J;}5jgvsb|8V+ zw(())naFvF_Qks7XP4(UD-v{4?!E_}+%m)tjnVeaZ3rJswlyKTcqb6Ok}7KVVGOCn z8w}@?rft&|wDQnh6us_-$utG_+UQ(aonSJsF_0DNsozS&x{W30ouH-(RsCq^K&PM; zs$zl2*C<_uYbC5b`uD`nSyt-jk9rIl-^p(!JMLZy`Na~4zTkLptP zo-4>{L0q`6xv|{B@BC94Q%XWM#=vhfM`oc)6J&-x&ge?~v|q97^TsmQSj5sf7CRk^-=)_88+xn!wZ zznV53;uA*;X!-R>4cm=nid^`bdHvkkrbx5o5&k+2vCD$4Qlz}4Y0e&>H6!Pho%&Sf zR9_pXp0pclH2LpNh74foh`8_tR30a4x5ixD+Z5UQlC|rtaVCY-?p=Fs4tcmN&#Und zo5D~Kvx)HPcATkfdmpT3X~s<_u3=!Q45YbgyQCDJ$9h8Rt!+VwgHcfZ+9jfQ1MXN_ z+B)@rTx)$GPU_WTG2=5SbA{1K?z?DM%$C znE(xDSOXBzO+SBRL;2}@Ql{vJ{;Mn!x4DZzRXo0&^X9!?Ez{Wn0IV9bur6Nyf!@D+ zPtyrD`!#y{^b4BLCk$X+Uw@>_-hv8y=ag@q(Rf*)R$)Ppj+%77SD}NJgo>f(a{x_X z>HsiVE*T`r1H3|l_vxHN$B-EQsnHBb-TK z4lqi>=D;8-P_YQGB}dcAh{Mt(%u|3Y01}Wh!t+okLfQcAaEKdjb>uKR05>_ljSx2z zjwVwEE&!~6>7(Ig_C_}Y4hnmbvvf%)A8zqOh#M!&7Pbt4Cgi+AI3^fDxq{@5;;_3? ziGdx?J7s{0VhM~L07qqNHyd6>rAqaFi3GY-GY?-J#6J9Mz$ zqMv>BQ@Ve8N_(v)E$0aJ92qbXz@o?!?Yz3Wp*L^eu-;&NkSx93Y%xO&ast4GzHpL$ z;sVYEUqhs?q zO*nLLz!Jo~z-0r_GlU#Y7DP9_0d){sIGobmXinYHoC>uzRoVyi_@_UovnNlf+S;db z1?2+#M7}l&UDf3H!tgS7(HJB(mByTkP4|6sKY>4^kO3FTE&{rY*d96~N7o6rOd51tcXLa51R$OlZH^2G}HQR}JQ=$Xpd`&yV z`jrK+^clAzx}gi+|6DiQ8y)}G6k)iJ!a9P#)>WV3M;UYI)gD%!w!ty#oFwyzX-(;r zSNYZr4rW|bW;~c4oiJ!Z2&$x?kcZB1+y#G9Sm!un*qqVHl0!7Py}Vh0bL@3p(QkQE z`fW$Z8=SQH6ExHD?o(yy{AWA5=DBSgaCs(htnCbmTb9k#$|fwDe*0E_%^2ucq4Vj# zux6szuf*~2N< z;^Hp@k@zyQ1D-K5^6W-E^*ecq(ZVpG2`y5@{plF5^*iLNleSU1I^-mXzf$L)0w zdCl?cO0?ek7Ty{}^NeRF>}YJ57_l{v^>dRMO`VBpb*homdGfh>5H;lQj)j3`Q3%i3 zMfD8kSi>rMq%0^u=TzK3Z8|%mfnj!6maEZI7uj`1*k8f|OIkDCQt&F_4OyCuwM?~k zL3oB;z!c{+^;z)8Gt4epLx3dj1YJYmQZIPbP?SVF-GQ1rpqHcGaELV|M(w^enuhIU zQ7w;yX4=O|pe1=U=Z3LidG6HTXH7ZqO9kV?adm58K^@;(oj_UO2uuhi%u-<=QUEQ-909d_VpBl|3HQQ}YTE4rJXV8a3 z_`q6&+;?^exBKp5g~qH;~>oJ=wOeYJUpjzA;+Kvm_PtqaMK}J zJg6V?21`pgK04=i>GC7M!E0viAoLP9+f8Ou2KgS`JE5k#F=n@uvWWC2m1%qZq}($tI}vNpx&J@?Z8-rdSSi* zqydQJ|-%bdCjgzednBtos7u43NeoM#On*ls>g`v(C0_NatBV@Mp&Ik8r9 z!ykuJE*b0uScrBF`U7TZ0c^6jBCeJ!XTE83KB0w?7YKt0y_C>Hgb4!oUDC<%F&!Nr zF*6ImB5V>u8W9SMP)`gxZjl6YPk?LUv4-vrCkwjnj_C5HPlM@-2Fo1X`|@XW`s6D* zJby&({R3tl5|Y?6018GN@_-?9S=gd%o4l|vwLh}9$e8-XAUw;~()a;fhOzu$W{v;= zAOJ~3K~&$?YxaOH55c$ED^==xB6Zj`(Q~~4c7})V9(&g`(5Ri*)HtV>w}$!aVc=I8 zyWleu@I4=9m!04;(d`08b+ZyAy)_UW8*I@HoK-DIZs z(0%HEZyiikHmiK0f~{o%tr>ByD-FO3E^ttUIxNVxb87%=vz(5 zo9BdXMO{y`fZHtu`jn1GiqftdnkdCVG%dX*gxAw=-L|OiR6XQpHm@t$bIz$tqN_>s zkZ8IxMPhrIYR^7b?fv0NjCs`OG?3I%Q{2nz%~Hy@zR=SQjOmk`Rn9tZhLY3Q#l%wJ z4~(^kX+7D-=sH;d!20|1o~UhPRAcs&4xKu%8mh+HmvRD!=i@LxX`N$X@ximPz2O0Z zapb*z>$_Y6|KV;f;<}_E(m8u_ZvHfSz+rG{bH&SDrL!sYrp#ZaUe^Y9t5Vj1faGNf zmDg@=OtM;$tqH+XMv}EHnvYDo=C9$dY`6Ak=qGOd;-pxz8DGlAP5?vAHDvNtnNDk% zpk;dn20_C46tHt4gyNc8{jvU*3Dq!q6`oBbeN`V!;}Al=xlBjh#BrEH_!@dPxAepFm-L5kzo$z8D+r0|-%-Ec6Xs4~mv-}D;~*3c zw+bSOc!R+j{6PMaTzkrZ0@y@IqK?Gc$S;J%*Z?B{+;NE2V##0xLj17J9gYwx)@Rm9 z1$mJWcDEF!&1g8`5JPPI!J>LEa{Wvhi(y^EuDXN-o@e_;v?O3JG5A>I7|{@eqTJiPhUNKOjWSgAoB%) z5QG)tvI6PD&Fw9{dw)TfpFYvm%`LU|_PIZ;cANWxVa5-@s=-~C?z*>XDzo*}R{S9^c1ER%*e){w=J$-ym z56%u3%RszI~|%#X0&&3Kxg;QS#Qdv0t0^NC+qc>7qBG(QcWR)fU}* z@>9C^;1M02o>95plv^b+cL3IMqW1;mG^`mm*n$|c;0PEbtB(R$_)FQbCPkIc&+-ll z#5n8RacQi$gkULfSChDpWv$Zn%4grY0}D2FT9k2seFDZB*T}50T7^59v1_f`Wa~Ma z!zt?r=xXdoh8bI|mxJh97%gtr7qFUJbxl`xqqaTa8~J-TJzz6c zS$40Fr8mJVfBULjxq)VRH6+TC5B!g9 z%RGhR;>?7N+Y9MtbBmI_)4CM7R>KjV#C{Hdl{N00b;ug67^?DeJZvt-A4%7ic=IHq z9y^I?QzzW{kJTnurT_*=`qhh-e^hY;J{`~TY z44DI&W(&5_sjNA=O}3(N`UjiMw5n671lww6^0`gcFCC2ZSGdhHUN(T6{@Y;Od?t=Q zy17tqbL#6vXmQgRwzjof)S=G?PS~dIW(huXIS8&AiAv9IWC&nIVYfE>ax8nVyiNVj zTt~t$^u#o5c(U;IS`dAkU<9s_L&_@aZ0QyYt0~&86Db4CYlXL71txxze*5LgvwwFy zroX>002W)aU@|I8D3WM!!s!5%7{oH}Uc{2}$K7?@puH3>ZTj?+cTQK`CDACDh2zu_bwub|pzO0eIM9fC*t=jcS?hAJpmmph^$+t90?|8@l*# z!E&h8>huTz)_6eApM6KySC@2gH>X_tKJ7NoXu4aWgYqtYd3H!=?J70O*xb))JRUM= zH5l}0(C^Xp^%XsT{+z!1{s;Q{58u*l_l^N6u+6~Nz=j^7Q(*R#t7VhtslZ9Q!HPks z9B%31;-f^pFhJ_)Cje9w3uY$UeQc#Z+A73UWk3?u@OrI5^=6B~ zC**>9{_+*y-UwDutG!209zUdqXQ#}<0*DFl3hIEcKhy&T8S;4n_*Sv0L1=aK$jPn9CnJIcB{=dTb|!Pqhk)UL}Gi~!dPVen9LXS-Se09 zyKldvi;tgZGV0SWfA&*)^6)-~4uZ9ZTR8Esng{d~pw;!w4SoFhiP=a9;X@9t2M-^x zO+_9peULDGZ_z=xrXpVxmj_< ziSB#-I|jWlCICAjQ;d15iLtLTsDv~fwhg$fm`4eHzt=|g8g zZ?AjQnXG94-a|Th@R;sD`I4Fk$5g7;X|b$rz>vJVL3;Pff?(ydC-_|45Tsc#M4ZEJAcggo?$b!JD4e>KU;Lu$=EX% z`r&82AB~oCk;QVxTDNY?AM8;wR3f}^U;{YdIj+XSdnlzh79PkD7@$CZ+?K$s2@Vyq zg{P1)J^934O6#KgEQ&{r1||5@|HCS7+BDj1C7gh^c{ZxUYezzd))nX0iv)!Hf{i@HsoweR=H+oZ4|fBzqm_*!g>}qs!HdU|N7_8^Y9I=+GL+_tNXgK zS=&!je#$f1uVsJZw&IosBR1D>AODdyfl>{d?`0-AqNXW<&0CumDzrfx1*nfF+H5US zisaLd5d0o{8nNwxl*cF&6C3p-(8+bHO11`W17OL>=>eO$na5kFv(!)ziTuMNCj~Dv zs;Z+0AWKiBF4<_9hs+799HDy*F9n`LF}b5Vj|HSBs)2fH=z~#H)Mn4@ZJqjtXCv$> zvvO^^YIQ8&W*HmSOY1pFrKV~DLeG$i8K_D=8yqmO)Omwrv zVSR3ECmRXFph8Tqu^GI zFr5(ESI2F2g&c?7^#?r;PeYC&goQD~$=uu~H|8xQ1e23sOIRSnwx)AoctMUF&S!ia z41t7pE$k0KlF=AUr#|)iL%Gcj;aG(<`0lNucmn20d$%({Z&4l}c5JFAHj?Vxdfh7ed62KUMJCG;B z#W=igwPe=Q$(6}k~V^U1hD73AD&aU*QeQh#$eChev7K*5{E!C18y>=(QwGR zFSi;l8Mx$I5_5UZGlu>Fi~~@I&^OE(4(sFu`@8%;a!4TzZaT#elBP@IbOya>Mf(R} zeeHADB3NwzBYT4}1E5zo9qM&DbbfY5_wU`~9{{e98FVFAC{Y(T6Lx#_>g_w~-d@wg z`}a63vr;NC`wNUHj0^PO=C(uEx5&eGNrOS3#~PuZ2m52oH=vLhGAgY_02phrK*$Sc_|juaUO`+KeyKn!Vb-vV3&D+{TE|w3$nHFf*I}x zVK%W{|!gp))y-R%6979H{0wrjX$+TPyU!kyp|Z>EWNap z!HGLzedV;?rEkn+8koeS0f6Nhf*79KxDhqLyWLaiHp>UFTxZi560WsgyQ958Vrvkf zL!lJiekfUTw%FHiDYLdF0VEI=kz{7+6iC)(PYBlOMJ6KVfG=k<*F@o1D*h|!o2`bG0B1A$u7E7#`C>B`w+{+^v^J;v^S{`>!7X*JaEst2eRzLCZ{NP9x9?t4_wI&GtlH#>0`YOd53#lLBCXQCNa0Hb+AAqTB$8+)RYT(>n}eA)HWdYm_AB0In8uu#&KG zB4$*f&+;#EE~mTRfRl#<89-PYKr18xM_3#FMOfM%*kFYM0|gAGfo+w`F?fSeKZF7T zSOehJM7wKMX2gK$GoOx#7E{XSR?PH4co!Hg7$@Aihdx6maAPC0y-+TauFvLFEZ3-1 zkskmycl|yCZ(uvE=2ITGQX$U?zmb3)tQ@{Q(EM<2FWi)uE6{wk!+_My^^Jfsbz#(% z3wa3}1W>eEa^EnA5XSiFrbF*PexlWGUT(^3pl@YbE~d<|0;>*S6Z9Y88O9Pi3EA=u zirgpU1IuyPBE}2PAz3=WFZ>Rs8UP@GG92!T(9ijTS!j26x6~ipF*^xK&P$~VH5yH- z)*4iAyEz&1k8o;HyqH>(E%r=2g?f#K7d$Ye|`Ay zfj)lxNS{7^G62~w=aiGA@B^N=U{Ip(xP!Qlr+ukkS(K01PMC-rZfA z%;z+muIQ>eq?@}jgIUvDh01%UR69JQ*3mtxG}~0Fw`r$XX4WI?tp{K!Xd)I$Y!h3U zXag9AzMDtmJ&;*9>|um5mw4HdhxI$LhZ3Tx9;H2eh>z%a{qgZBc_(lweE=(3_WgBN zzVgD%jbXM2t?I9tHAa1aIKQPIT89#uf5qn>*#MTTp}ImFQWM*Ev#c8#IiiY@nO*x4 zVCt{%20$|c6tasR#i+b=9f=&rh_R*=D;r{H)?gpNV*6_HHp-gg`6YfEk_;?wsAB&v z&GAh0qY{4GW{-7~0~{++)-ELxf#Ve%*OAp7bstnW!}qpnX{6Qh6j&#Yt&3mJUP)_# z`%KwX&Qa1+z$Ei3EXg@XYih73^3L&AchLgZI(gNiq!@x^4WY7aEvk4M9H9LntL$^i z4BDsr%wViztE+FQlNnF2G?|)bBE=3Qk*ZJ04?}#<`#!MFt_|+_G(anE>!vv#O4dRq zDX+N=M*L-#JlAWx49TYUMP+PV)%Ib8armHvjm$Q3E9LVZGF?hD!6~!W`zTpaDuiWj zy-AhsXNog@gfc900AOVph_%pG);rS6^lKaXG3dm53afh<_<;2wV-<-BGlf~Z%=vwNr zp%O`_JY`nfu2QuOC|%})o2aa00`u+K?B{=SRxkwqL=Mh5R-Z&F@-~Lbf z&A^&1Qph_b70H+xYsUA>H+R)E^=wYr+hoMx((YTS(%L zTviP9?%&a1Z8Cp;V!2y+L5^?B)ubAReKMxFv8p z9?{k1CH3y^m>sphzemSMhjOFgV#zEjB%xo@E+MOxXLZ_GoXv`>p zKitR%8Q_O+kK|A;8s$kS}^Q?q?UjlDw}&sH=Z z4(a(1&*{UvceI=@nAL<3J5GX*kVTAru}Fuc)Yb(yio47e(CXGuFhTwYSA z+o1;!9@6>w8J(UUGxO>8=8DDxFyMyFegZp8fX+Mve*k)T>=$!RPA>pfmy^H)sDkb` zTYL2A@l$H;9WXF?@$rh@ym`a(0W7+o|NLikdU}ub5f>RefBu4AynID3Uc8j>RfMY| z=aoqSKSF5k-5m}3_~}xmQlNUh!g;|?PflrnZ=Y(FD(lu9mo@O*n9yjtV(@P~2aq+Q z+tGsh^Igi<_o;Dsj~WNZRNp_Qa$}Dw)tU)G)0awB5@8jkkQ(FE*(Ic>c*zQZlEdCQ$eD zSebEg{s_0k^DmsQq9K~>XV}FvT%(mqCN@C&!lR^2G1Zx0{ljfIMp+w^tk13AkalHu z`XH|RbX{YDCS-1)qH|_X(UbN5xLsI$lI^QVKg=sHElCK7cW`CjN?BNx*_ZO8cyprBcz?$JQuQS zN|&&1LAPmzaUaqjwW4v0g}<3hzPt5^r%YJ?-B7PKt#7F#s7{mahApooS@n-^_4+r% z^)P*+g(Y})&7VtK&e3!Ue!e#Nh=43J+eygR=!BGYDKrjU@O{)jFtGmf`Cz^J8fP)= zo%zcG9HC}t)#7}bd2IoZu$ReZ`sdWjQ8LycZ8Ucl!yn=C&ZMa+XpT|bx2x49LMyMu5e z2_ppH7i=(ssj*@v&ulcLcC$fWoE^~FUYSmtMSAnYZ|U9J_Y9u28NfQH9h%eC#}Bla zjc7teT9sQg%T?*k#Wh{Lc|otAearuTy1bAOFivhQiKW4C0ceF=0s;EeYgH%jAx$|M`;x)Ia;eODj{s?sxVbpPHd9UtOGy@uTIHlNeM-admu3_O`|IozhlH_XjuG@DEq zz^GPAG@Fk3ISz%JjA=ON^G$sDU4T~zpDQxE3^}6&xG7VqRA$x}hd!DdT1a$`{&Es+ z&dVfux&UD1z-&TD8gA*!=UM-d#|)qhKoHJ3wS%@V7zFCv^_X#kJW#>}+F^ieG#t_8 zb4L`y<_x6wI=;V|y6aY(WfQ0mmC7nNbz%t)QQvcZ_VN{d^W6`e zK)-)?$K%rCTOVt*TFj~2xuIScp@to1e*vyQf_dlzLR#@0=a9?i*bbn-GlbUe0s zq5gPIoza4B2UD8ulxVloq;l(!s_i3c9^RwY!2y-44ayZu!d^5v=#C4$TRHzdV=Q2r5c*sQ4frC z-N|q@t=}&;-#@4@#yPl{tI70a)pB z_d1&5Wp3y9Wt6Ec-R!#ZJbGYeevS3Ji>&Qw0AP8Jt=bKrJt{5q+UYmhpZNAM z_keNDG6y1fa=j>`GP3)fXkKtes(?Tm-077W*pL)6o`$z2n&gbrHfV!$c6GB7qZD3w zMjG~jeH~KbZ${Tm30)g}>+C&m9r`u%c2fvqM$sE4>J~fbw3RlqovI;DFacXSsP1zt zR5;tV1F(DnJDm)sl~sdC4hbDy*Ve4>l7e%$$7tIkgKzCYdYPXiF*h&L#@MU!@g#Pmb0kG1?Oe>9b&pC#UrQ_Jn zR*CV8-de;TN;%wGGx1|-uzPQqTM>L^la%|>toE=WUP$@A#D0KMfBqYf(_j4GgCP*M#jVC6yTbec03o23 z0oObz*WZxH21nWr0Bb%O(|)T-U!EV)X{$&_wY&kaJ}`hK46JjiR!e+~8_|M8xSqeh zpl_bPq5u9r{)N8z`nPoT3Eh&sBYx2VznB|HSSmS3r8d9;Cqr<~}4oxdns+^-| zG@j88lBENz+0Ao55c)KoEtn|L>Kz?1bu-3g=G(V9{(g>2QCab5()mbA5Boxx2tH zg7lEcJGX;SwH@kpZ>f9N<sU)iwR*x4)yC&Mh<9ASbj5`h&bnj@c?r1pZ zu?zvawf6R?*=lon0L=hS0jL5)O>T&s&~P+lxgiV?tShj>ILFsy%B(o#{X)MPWZFei z^BU*6f?W3Y_o!3`Q*D>tzI{XQ-@l>Diw`Vc=q~cI?d>119QO8(Xg3cabWXqj`dfPW z>NSVpVZ_0v12B%CKmYSTqsNaQQ>W9RkCz|m<*Qf1?5b8-&gdsXWuH8HNMAmELhV+a zK3=@1L9fGL92j7YW|KoOm9@n-ijh(Y(?x=IBxC2B9CwIA1W`6Z69JeZ_Zs^61AF>34tlj{fy`zo(bao-xq+@cf*<{Nf1%Rh`Za z-Qjk_yAJCYLL0lCTbdyBvXG-jy+Q|jZN5kVx!fR6LRcsC7Yxmv91Rds*cno9G^fFQ zhjuG%Dm3=#@caoKpFNu}PQ zcg~q{Ijp0g#cb8YSj!bm@tXem<@m1F7S4sOV2heOhb>uh?B=g4PXR15Y4x_jtu__w z`y{tMnBlOep5ErmYgX!Z$4+3sF=6bl--4`O%I8@-l|Mm8jfr(8I4m<^8@)z{PqLX# z2z6aVYcKQ(6 zQL_t^U4_D;*3axM=DjTCDec?zuDlmp23wG6cq$Xix&iCtx8BBt<~0J*)=pwq?xr4Q zQ_(iP>D7_?sNZk%KtdFo>WGIdDNEM)6cOw6i@&rXSiWM*X<9H|l zYr`da!$P>-49T_u#@c5pdQ`n1QJB@T5Vc7iBi|fuqY3}<1PrX9tuYB=nI7^QD8EbY zD+M;FA>VSTwq}o3+@EhmGU zhFoYkl8Qrbo08T^pOb^5nN6ghNT4ot=)swDf4zQdUMnryT=K#RW4)7p{|0IW)*NHn zTfwX!CLkDx4RV+t7)^R=Y%6nP!pYL*7C`*Z-uB0xi1L702334(lnv@j2uHy`%hCYI zKsUcKHy@e-H!FciOh7TC3tqB*T`}}@p8JIlk;HvEp?xs0?jO=g6986@-oN;oE-yZD z*i);8B-(9SE+*8uxuWY&m-O-Kn!f(#2m1E==hQ*6=*f`7!3xEkBxOgI@tqY7$0HgK z5juw)R!D443}7MD34j;?vgK-*=1YuqURYzx6^9Lu$5Wcjz^+0*8wp1P;4+y_4WI?! zPk68{o++IXzVVzp-HUnm0!2nzU$N;f} zeRXhf$c!V53E#YjP&(wUGPnC7Oc7z2xRnrWGsq7h!fp;Zrb={n_JHo6-D407HxdF! zLil74xt_oR0!wVMr0HT#V*_9T_~~}K^v!qQ)2p{{>D`A5>J5hsECJv^!t|d${etcv z?NPmyqs6Gt;2hXvU_jMtNDkj%@Ty!z=wyMDijM|Exj}ItAj(}IA#}Gi?DrYanepv< zQ=a?C#{}5`5K?fLb7vJxRI4=&fVIzg&?>bmvzc&#z#K`=2R-WEA*683pc&Xodxxh~ zZR}I7P@~S>fG$2=(X$t?STDgat5?g^Zq(@)Kl_S90|&z)gLu!LKj%^4MrR`3fUk(*Fn3*3HndY?$h0HLLaVf=>Per zf2QC6<~Iy%J-mOP{`}8=$zu*c6nV{{R{-TMFE99Z#$NY^XgTBjYhchJHybV(09&wF zE;B=Q36|V)#UX`vg9-J9NbtU-dA>@kQiJx-9?{X+BRYQY1&0&@>|&sFA%L(o=4L(c zqfqp+9Di+)!FTI`+D2Gwd+1dp zOAZojn7Y=x#tG2XgYByxU>F9X^}n@BKDaQRy8)Q+Od5b?7xBP3GW#gcwG@BS077m- zu#2P(L(~-&OhFU6==_xAJ|qO-yu&bE_KoaC@gpJ7tFU%jAj2G)}dWENKvW!C)PUEnRinyv$`<|ko>mhTPGTZ3I6YE4Zg@n$P z+BARjwn1Uigcwl~eL|Gz#Ggb7*On964J)#^x!ElVzgc4ggW<>~My>C&ovZ$1X8!wS zIz2EC1`A508EHcBk1o80LEdyPq=gS!8JNd5kK*Phwl+CiJ?M>6RCQwf+&Y+1^0p)H zFX*PItZuK5nsp}EPqW%+hN*Xrr4{r_IevNT~QKm{z-;6L(W?<9@iSkKVO{l zLtDa|j5vfWVdB%T-{z81)&>ddQ@u9;lRj%tw~gl}4fD>Md>Mu}J&RO?wGaSUskyXb zR+Ab$6MASiBC-Z)ogttcgzEW;Y|WV(vv@e}N|KISPzt%G7JA#Cu%GZBGoVae@+>xc z2F$Z?oc1}?CEmms;7Nh7*yoX=@E&9&fDN9JTLz^)${^#@d}age*zgzz1HIc1(Pl7r zc2)~oPN%fjtkaWw2Mk~x*79`q?gzTMx@DjNxsb5w0U!Y;%J2y?bZ1AHMhLy)oI%JRR4ftg6wn$5s=)AI@M)!w6eqbcB!2`3X~BEkj{ zu7)tHChawBLyLZQ{>7* zPjCxhP1>@*f55*Zq^sXUuA&}?hoRpG2S*HqpueJL65L(V6L z@H7cCJUTk2vwQdGr(b@_|5mFN2D!l8Vg?3u5aD=Wt}PJ$mZN&DL4)ClUcY(EHxqvQ z!w<|3>U3`TradGrfBN_lH7Z3KBB_4AL!-ffK?}^KgM$NVxAzz<1gL}0`@J6DmA3jM;p+ z0kT@=FwLt^A33@C$B&mB;@EBu+!rs`sycN za+n_4aeH%1-#>fC%qOs-pkJjzj(+jgm&`t!Pewep_(2$GrCQ<8#c~BKCNRc!I0qU+ zD{i0q)R$`+xt5e)F&YO3hl0&hDMkU;f2k(80kz%LAb5U@)N9uV2$^ zW}jWtUH6veQ-FME)08Tu0w?;%MFZ7(jdl@IxC^~l(s;U};bcy|!IV0~35}OIn(Y*6 z@ARAw?meROr$3{;<8z`s=IRc!8zujd=L8$z$v>c%M|3TS!tBi2f^P-9GNFJ5YO=nf zsY||<^~UaX%vxsOx2!I;um0MT?p^RafxR^AsU&`P%wB0`1_RyO@o<}be@XK~X)L?f zM=edPius?e=N1fdg@=2o(3!ETu|2qm($%0|lS@k($Cl&fF|gvbK49!xXTZocPQfFN zO(2a##Fl{|t$x^LS$@d|utJ~48%0kLzD(BmE(N$W~+j3e|1RYCA-wCGo+tw z?Ubh17*B$<`w6N@|zw)>bFAlY*X3Eo?7rcFiPS0 zh&&9Xa8ni9D9_e}(o&Z;d~ogFdZW0vYn0hrB!(hwyw{bOe11~{BjdE8x%O)r@O0H- z$1(mYVS$nj3+nd%@a%*8)S6LS&boP?U0Jxn*(9wW_kH$8bX|Fgv0O8_?km}FWd65F zc~T6{))HEm^U9R#PRzVgKU-;aQS)`g8~sR+oV8mg8+|Fm0*8x&Y^PIX8Jm{R?po&9 zxrIC(OqWTrcKQZDqFPSx6c3ui!gAkjukR^6&FXwKwf!!Kdc1w@_Q^m1YnXZ)isp8B zcE>%wP0Zluv^!}V(!>^PX9!@$Zz#oH-;#fwziJZo*b`EdEZ0k%s?P?eqMpMT*jk&I zRb76KGE8ctk9nyrNIQ6lCFq~r@+|f?4yvtkDlSUw_Bq~+Of<(NclCv1)L-lHr@aDy z@|j^r8JXzqhjvqBPQJr_n5~d89xk7ht~m8 z$Wb+$(tfi}k52dLq*bD$T7jm6E9!Rc=-s>b^zQ9DdiVYvefso~lWQ}RXgFkW1Rx3W zSfMQByISyVf&V{m@BJfbmR*V6aG4PqHoZ6HT~}9kPj}C7IEECL%Uxh4YK7Gb`bE+o zC6W6N2m%3tSU?~t?vNsvvl!Fe)xOJQW>tFcA|o<>33Xfr|RUfdkJ4DJBb0?@+s}+b`K8e@c5W6&d-GLlmz1pZlzVK zmM{4`05*;osaR9ct%`C~#WsUDh?2Lzx67c_WvNW{W>a*{z`klC3L^pvbh(`X&Y_PA z%B@XY4qHku3+%URj$Vj106+u441Ek&Mbr&$q8R@d#dFriYBuYHE(3EblgYC{dNh%w zt6GybclPMz%a=4VJj6iKJC7gHty{Nv?3FG{^mb!|wsv-DZ~uVVRZ|nAv;+b4$#ISz zDUtU?6AW&kEJ{zrU=ij307>Xll}eYQ`Nn0BQxeQR6_FBk1#2sl%`+1i4pALsGY?OfAU`AQgtBN@s)K@IIrr)1G!c zR5Lj4kmeHGvJq@U&dMklz)}SZG~v7kgmbdEiN$wgHcY>RZIIiG-JsqEQ(J$JW1@rE z>UVn{EC#5(Mr&P<`YheB6GN~;6P#_>LC&9s7o?C)Ke!Bi@hjiaOEa)!kQgw_gG~Dk z)qaiHzbAZ$sJ^U#pfm$dKfc1*3y^!9^)6>vj{R!ik4fh1Co3cWQl)2te@fcrGv>1y zS^;AutReL3rrzzv>I-$F>DefDS^AHS-tB9p_0LTz2!;yUp;UofAK5NTVT)JL--8w_ z534D>T2925o>jL&u0fY8Q&xGw%q%M-e^UA{-qQ5R)cdg+m-fmg54n$p&K;NCjJ~xb z(2q7?RQVb)uwVhbZ|`RQx|)NlHdNF`C+n*d`6axS+@FNCa<6&fOF{j?{CyC+z_d^A z{=8}VoDtT4CA9{DJlwM=dejEHc@CJH$>wL%4f@lCsd8Jasv8Ki!?huMY+rfe?fN( z;@c2RPcaCT5-ly|mWWmZOAb0rwQ7}t0I_KEdiNpstQ2D~)U$-g1iL=u)`t5Ij zO{=Rfsaz^jECwB>jOYnLlPQ~Lwif^*Fm+I8%)(Clnn4M$u4>gX)$0`o7gz^tBrR@{ zXfqaC7u_y^Hvp#)0TS#o%ug_t;4W4!mARdD6hPDi^&J~6(89t3M{b;&n&LEz#S$}p z09Z{-OtRY_To=(V03eFxGK+&>KuEk?qF5}#OfqOq6)#Sy%51SV19)R&6U-Qs=$5EU zg@F<1Eghd6(*d-iDpwr&u-hD1 zFsO;{0O*A1iU0#M0I0G#%I8Lzodw{kczI5x@+C9;Fg_CTAsQW>pmctWQt3Qx?;p`u zUwy@5=NKE$-hGGe-o3~DTD__;3+?UJHoe){q-=haRu*PyG?%74+y^6F7S;!25D_EM z&JevvyI)+Kvv@k|dsVJjf2v+@@SIAfk_@<|hLfBp=652QqRHu5nw*)V>DgJTx0-Z# zbVNIQd$hN=%i!b0Qx9c!&X10LweO zd+a(|Ycwbac3V2lEHMC?C@b7u&rgrJ?=bJt2LKcCuYFCdLkAXC1$uAjzgC-aW8;*Y zSfu$|0I*glF_L3&u*>5|f+;xYx~+TV_Sn%E3^voszJRcQ*1MFfSIQ(kK-o#`$mp>{C0Pwr znsAM(?7Rt^uHgPrrvcvI%pPsoGWvPf8D3pnJ^NoTgH5*I!QrjnLECLH_RG+JxCkPT zXcN=eqP=ZnW&XH^c8DG7ofct_h1bJXl)i?toqoTz@jN@=Mgi}+ ze31JCSh_z4Z>R7hL+~L+9|m~qQ^T+C0C8vHYuj+f#2_g<%UV!f!p2;{Tjo*u!LjGv zJuA6*`^w6v2Ls2X95h6N##}%)efTATIw#@1tUs|^dXT|yJwM3f{R`0Z2{+ThdNg=X zP!EKRp0KJ0l1jpk^4?C?2WPV@S({exQEZJi|8lQSsd}mfw32%yhvn6K?e!5QT;QL) z>rc7g>>PBxA9QfI^RxFUDW81qYR?{|SNp*3Fj;H>%d7s=Z>@A;8zDeWziT8XkKoqr z*XF@xbhni~Vm#@o^~RfvvlhxgaHZ$l)Z_tE(}4B956Tr#iQszwY`RJR%|gxGcgn8h z%}|&~ZoyQEY^Seq@rD?G&b!7CRzl%g??Rzn&YaLiQ%1G5Glmkb9bHRp@P`0@3UJZ~ z5U1U^#8L)zkkD>whJmGB2vzy`n*w#@%%BW$wUjxd!s$PG&Z|l(Af0CBh{&~77Acf* zVQ~)+dp&jP5HxDdlQyWVG>bHV1(uF>MUe<eMtX%0fm(3hw{pV&5I%cNx^C8KYOFvHZ!OSxI!@WdHNE=! zQ$GBE_UUJ|y|u-Mc^szUria84ZB9hAaQKC2cay;@fDkA<034+#h zBI5zTs?@*^sj}-7fS&QO2?k#lmlj!z3FQZv!ypqtsYF6pIiq6?*g)3@0_q8N5riN+ z-0<)PunWKs+zw+r7va(fw$Q=BK5cDoGD``7!Q$c~N2Wug!SxG_7JSDzhN~mKHa9ky zef9b0pV7(jA&rjaSjP*1QydZWhEh}*gKJ%Z0W1J+%?6?oHW-kBD(BAG29qjMY(a{0xUO~7$8jDaQmZ0;?GMyL892pSoF|eja z^97om9H*gSXncXi1abO0*9`y_7*+rsYE_Byh!9leoh|@$>D(BNPtQ@YT%*m+O^#p);OV{hp3#GQ_ZirMsQmHC3GM9e)7#B$ z%8icF^1>Vq#fXNZL?goqX3{|f9{qzh-{0Gz&5gHG_F9#OhZ5Xw_>4iwPKTd|>u4P8 z#BP_hsal;bjZI9^+~N}5z5jql$KmRjqJyI&cKhpgI}Gl@-4wc5a8W!vE7IFHZy7X3 z@PnC|X_}gx;s}&7Cq^iN{G(AiI6R>BH*Z*2AG&G~naB9X7z6N$F;~1eXYD%lapkJS z`GFM(U=jV_1na8NVgRxUA^PiU%EASAe1WEy?^9uFnc^dPc4_R!hLj$btW)A%t9P+r z@XA@g#r=>~3IQBx_Nv7u(w7Z3pd!1Zr4_066VW>axa9!zvd;=2fMovKG?{e!?*3k9Updx>Fbg{Vl zT6a=ktjHf-Y%beAwlBfBzn}eYApq8(cDc{s8u&%^pdKo=;b#4;MN4}m>pg0?4n<}p z`YcgbivHt;{juj=E>rLH!iwvi7|wIoyAGpSbq1GaDU@L+!BJ@Ng1S}*XjCmr;xtZcXhA3ue~i4HWCIqu6f@MJbp=I z%Btg;H@XGf^T+k5dc@twdeyVjG`6!RA8Q;1Wv~C%d*}on&RkoCk0oc%GyQYe-1Dv@ zo_73x)Aa_^ut#r)#~ir98q}9U7~tg(H-NAz*d6J#sdv~9+HCFvw$4+-0KI0yKX2Xh z?;hTjJg5eP%}i_0zQH)?xAOM~fn4*{D!#WSJl)KkQ>KQYwf7#6dVThl)^tbk`-8Py z|2p2JK^-o%Dx7JEfYNyW#3MUwiM7`)XUM9i30sHlb<%B~;5woH z=-ia6_OVU~!gSJNyi#Th*0jJY z<9BBo(OPYk>xO1(+2EXJPsvTXb!f5rLFWTtN%xI(hXu@OV9nf6t0;!Xuu^rkuB2>0 z3|ck#pB&N@ScYfWjZtv`)cT>Bn;ICG^<1&ZEKm!7g$r1`+o9oDgz_Uvn#?7sTQ5?x zbV6@lenqRRtF#MdN2$yjKmZ%?9bgJt5N=`+X|DmG>2wr00v241*;W7?0F(gqfcSW; z4ZR(JU83QH3C&FKK&wgF&RpsR?GUh#2=MjgC!F4u}18n!yOTZIv!B88m^gIT&Af4{778 zhBgCuSE;h_H(b-0b(Ku1`3}t`M7+z>^z;maSaA7b*GqP7h1+7A!4YOXRj!zw238Kh zs|WY*GkXnV=;Y*-nLJ=;A!;8OR5Z8GBAQMhvP2xi%bbJQE@^jkRJ7E2+TrNxVv$J&T_6jAF zLllX2+5Hbu`Ov=rC?}_;xPMV*fQZm`8iH$k=xLjZ%!A0@% zqDbXZiJGl8#S%%%k4>=fKU`7|kB;f^;E?Xzy-O?0%dClov9-6iN4tCbw6nL*(F|`b zFH*PNB?x~6KS z!k{fQ!@y#jUs|T=**Th+nxWQpmw`06BSMs(HL=ne2C>TJ3T_Yi(4kZKrjz6S1T0;#K6eH7)3pp;RjYE%F<|Y z)JlL??QWNHg)z#E&(qY>J<3llQ9PBW=una;wm2 zbMKG>-Z>Q(c9q_@>c`o zMe6D7ecIL+vjz?Cx%AWJ@&I-wPX&xg^;NwTQ`X>RrfIA*j0Z^MeSdHOE6_x_i5=>B z)-sk{Mv|S6V?>4-&fZ~RXQIZ?KxGU}|94$w3-mJi4R#_>bqILaPmA)^*G$PC_371) zc7m2|t(GA-*5SIjwisA?BJ0Vh)3n>cTRZQw?urf4IbjDWz2HcWPD;*CgN?V|Ln}OT zpq;v>9$~Iyo|5*;Ijq0^^|Tf{5B1i)Xz3dh%Tf+1fY~|xQ+<%$(ssG?wtF$Qjt{{= z-awfQv>b#y)MK)mc^LkTby*ace)zG!H+aPXl{|pDlwy#@#r=$vj%s@^S!=*GWbpi* zZPec=LFEsgqyE3z0Y8HG6#qhLkGJnTPI`?I+cm6r`r6o%Y47bL{jR%ScuF5cdxHPo zHO5RVkG1G6qWaj^x2AZuNp#cp^R$~Qub?%$-`Mtyt6oFEV~RL4$GzgX=ac8No@-Cw z&PG3*YB7Li?}ZM4pjKc7fVh*_2E2S1qtn^Roa#6$ihf4BNa*$5yCw;fON>gBr|t{8 zPt<2md~-9`VXzB4Fg$p(m&7?OGlDoVRa1}jY9f;_<} z(Rr#Lj8&jrHYB9H+OM_isJk-8?Iq~afyaklM*w2ElMY1G&3yIkT#8n1)^xstd+XqgiK7ATUUZr82vrA=(`d!EnP$3@7=}*J@q! z!M$2-P^H#j9VUQTcoqkKu!5j(bZcdW-g*3xo<4fa!q2LqjFX)@^zN4L;J^G*i z=l_NN^}qgCEN~4F2>M3IE1%CZz;dv^O|M^lM_Ze3sM}RwQ!>f*ObjJyetwBoR_;(L z1?Cme*~uZD93Rl>$q}8OoiY%FNPLxARe-!}h^$vwnEmVwKthW_m~1*jxqOb=O^Dw^ ze+lk{Nt&CRr-{i)%H>259xN#6Q9&!~)u= z6^k@8JIeqRfH|ZMS4!=+h<--I!`+>2Iz2t+eg^9Y>@Bc)pwR@ebhJ5K1>yDvEilv% zZ4Ph->@$FR(RhlEPm8pFcus5U8_ZS$AbID`Eqe0g5i|G_i5P8ezU7E~&{@O3`MG&! z*JZM40bHsT5g|u85p@#a5bKPI)>uvnyFd#;WSd`fqfA;0e~jJXhbK>kBw1wLKs*%2C#ArV0EJj>TpCt2f$J_ z6+J2oz}GBP#}!R%8#{!DEOP?lh-RPcC;SYr<>EdFfC}TlX8mFv)$A)bfE8@F=zYju z^EHc=m+P+V9biWS$n#m%=6qmTs`_$+NnDOqz~Y>yYAn=KN$CN_|S??eoCLtunbw($7Hd zm3jYm>{+({uYZre@P}X4iQFVRr@5^3JO=3%l21%pSBUI@ZkAD`c(M}nrA^}aQ}!%~$;yr24YUNps2R=g$@G}BT$ns8 zQ)hVePwgfx&CiMjFc{vZ5_f^a&LxmCtK^};lK%6imdU+uHw5>fHLc^3fI zf4fk($wo3AjK-9I5IOPk++e6}z?!!lk9h-f*=!$s%IQ780kC8SIUGv&8jM2op+W!8 z+nze?w@O7DtWq{-`f*fI{m=osEA7;B**cPCrNyrKUD}%!xjTauOfRAs)^^ROFiC-4>l4?$P$@w{*6@ zL6=8cl!~=EG8#n5qY!Ss1~aBXjarQXh~d--RS_w$-ee7(ZZt-T;S_7*G@4+1w5e7{ z#JmnQz>0yM72FEb5aiACG!TJ>H|sqUZ-j;zN`i$B#S_}wc|!+#TXcGI!1_?^ZdR``aM$TZsNEG153Yp}JcoNB<{sS6&>j#` zN4vwl577pp`vk2lfLVq7C^K=ES629|)dbK~VRjHA&w<4=Rw&TQ(hAK^1K63Q^YaS^ zN0`NyN-{{sE_C$tCbUpnA1V`};>MP@h9I z$k9BFj~9p{*9=_MD`l#~Rk8uM!WQ?f=!XqaY9zxE{HCX7nR%2-L36CjU{moDplX}4 z*#b??&eO%^6&)U*QLWyhL?TKby!VW<*%5m6@&${YLo^*4VT+6N%uE7sHawhQ<_cUk zPft(i@L-R+*DXp8#i`pB2I0o$7M-16a34Wn9&V5TXVLE?DG0d(jFt7ZiS}-{soRZG zd^k<1OrGWzS7>GBmbe2ZhNyUX$y##5DS)F1W|Hk4oY4BlE}fhesb0O}NQ&cy97kYe z_rh9@rlzLp&h2GNr-o=a5v5wC#N$G?1Q~b0| z%<4*HRg6o0X<)73JVv22$L_XDAWf5=*maFHtVDOvxlHk_sg^sT-WOzjwcY(4ar3rH zPh1@Jz9YJVa(;5sXNH(zRyieC_Z{-A9gR_Kc(R4L_W&EhlBL|SPs}!C@16S6+iX#4 z&r_O?7<*d#&`Qd{WYQPfz)<@iUjV4RT`{OlIW5Mo>ylMl7^lx)YKgbcj_qV=Xd z!Nghhp!ufyzE3~+lehm8_Oea4{byr%1GQr4LtNZJ=2zh4Re!YKcMfQM3#K;|`$3b` zP0OT5tgerDGCP}`Gq%;>4=AXOajK=bZ*`mpyk+-}64gdGNYOm%E%HE1v#e7=rEum? zkM_1+?9~=-Vr`-OrfxXx_uN!tc_qW?@ z8H8o*&c&*q`q9jWfb#lB!uOktvL?&BKbv#_EZ+r!0$JEd)b&+HYtY(c?=#W&RU!AfhGnLXcO90))r^G^d|_!}SEI4Yie%#jb3?i4q9 zz|b`=hQ>8giT6e!C@wBV(C&fo_h>##-A0x6H`i(H#aHy*7r&+0b)9m_D2?X-d z0U!l!jdxp!DhKc@nWAnK?niM3uR7f*)mv?5zm%`4tYri@IULx*Oi87)R2Utj<>h4t zG#)>E$ZQxKx=)Xf=xBeJfrAddT6JpHL?ry|{G5)DPq?=rUJa%Xm_!rf6ErzFL$fmr zG(9uN+F2+Uz&Z_{qAhSR2e1RZAAlC6%M02&IHdpm|M&~~KmYPS(ocW>2lVrw{)B$~ zdq1M(#RUdj;BEz7C%90)dhsoTUqo#Nq9U<4&`uT_vtfcgQ3sYSJ!B5?Ipc^ zvr0QV8_Z5Z8UQqyxd=gb9uFV~p_~zMrEE00d=M;OT3Dd@xfvRtn56xK13Ec9V|_40 z0R)>3qVD;8fqwYIAJR{L@>6aLFtH8~57`}VYipAkTwtl)US6Sl_wKPS8C=H@`3`LZ zCKi}dqS++#6A}4}mlq6b0GI;cg}+0?3{12_Ay4Jv zDHfg|$j#?OeRI|zxRyYRq-zR2H+5wM-YX7`*xH27vKXT_DxMsGC&Hj zuv#iorBtLA06@53qW#%j5#sg`S5MH`_#{nDO>$I9fM{Tx0aU6~svP|fW24c!rqWfN zBMw5>>qkHQn1QnOwKcjpzhGdlpftMhGZ8S}8@jpH} zqtBjy&hCe^bMrJeJ4f^LbDZAV+H1;Z(+t`TC1N~pThNDVBHChy^`;ul4vkID(A?Yt zJ$~{IEiNsyyXR%O#BBtyF<%&`t7?-@&M)cZ>vcNV+oSiNJ*Anc3FU%$PM4(;yP4j< zcbno-fCn9lbfF>EQm%z{0Wmikg*Gj$4npiQ+wTUUp zO)b#a>Lf5Qk7p0B`U}?Vry_VZi0cB-%^!&U`D>2c#YMqTx40>#4jgy_n zxCnL>3ro2Yn$MJu9Ojn;s`xh@eOYSnQ!Zi!SHNL=@%rmpWF>Hhb9p5Dk#phb0q*p| zt?D3odF>U)CDJ*&xlVq*if{_{UZ+7Q>jJ~SPdCD2ESqC9@ z_5t2&8vjmZc^+wRT+AFd7M z?el&mQ5$W)$83N29^=KGjG9S<3?EPa_G&D3)#bFy>rGfb8@PBr;$A>Odk$;o!|*D) z$Dym5Hz}yEe+FpO0n;}JX_JR{OAX1(Sxoy>OTF&`ucV)xl+`+GYhZb`*Z77k=wHbE zG>^*X?tRfdy}Kv>_rDRd#%7p59OS0Q zv}S^-r&M#~@gf$c#W|Opy0kHU{Ux7i0-lst)b&HQWa{F_^93CC==eAJd z>dd;buF}PAMmP-kXEV8&U7!yHlB_&u{-Xg$ou-PC$Wge|3#zv@Qvp#2^N83t6sN1= zITep~X>VhV&JTB}cy>VXNSjg#lnIO%h@W@(0L;ZuWo6Bz*bp^4h$h(O=w*mp24Qx% z9-)9>M1d_eJ~qy-g3v3%_vxuAniwlkKAWNPV!?R44;EO1nLCKQ#?b&9P5P_< z`xo>#fBOqc=W?{Nut0zE$A3hRA3{4S!9dRL?iTIt?y$R@jz|a=6Tqv5#U*A!jpp-o zRVuQ(;P&QQ+S=Zt{rx>UyEtdCuMUP(twE*o6$1@${ew#$m^z45h~acqt=`|L z^q7G!uxbF-0la}*9Oe+1L_@I%4Ml+{2p|JD$#x6Ov1=C32apAJ8g!!;(I?}RtVIPN z2CO~IT`;xci4;ZSL$tBEO=oAPG&eWLE|Jg<19%9~Y6Q^(vstsQfboU4git+zEJPH9 zi)%igWi7Q*>55*yUZc~q3kI+tvOY6C&4TgkYpWEEb}2cW5Jp`z%I&QfcvW`H?nkFCR~w6oOSZ1xAerzu942CqbLUNc)ID2CRw z^0A67=9%8tRI&-iW7I=5x5;;v{ zF|e2^1-C$(s%2jfyX2cCKl5MB)K+$@-p}-2XJq8n-o$rh3^jMzC^m^{2~l zur~1UAH9~`Ko(=~lmm31jLjEhIC`@58`yTETI0bgML!eYRp5Z~4b)WLhg_m%9s|@@ zC-=)i9%06SG3O1d-c|*JZs=V0j~X2QYFd;>V_@3id@hUA6j&SKdJcLikgmnT%+@|9 z91mzDY1owv=n;HuwX18&n^%Jl_`S<=^8;PKx~Z~lHNTy?Lt*T~owEvvl4ITQ6nF8MGgq#V0gN z17Nw=Z9NC%5H0RLdZc+S0==uCHBkl}nM$zJv)csp=%Dqsp5tl_u$H=B@hsZ9Bq|x- z?DT8_PWKE}Uf)wai`zTRpDPza_fzhxG~0F8)J46ZK_A^}nylq$f+%*BN<{QT+)P(p zeES`J3UGiBCn}#H5@L~x?uZ73q!ji(>%KV_-78^tNhis8mBWU1SKz~hVkhAMqJ`+W z?h0ISSW)&m@9qelx1=xs@VY}pQo`-p4bZfyGX!1zqN>g1R(>o_TdEnTUXYKWYZGO6 zB4$IWxvSeu>hHKRI=9>EQVBQUiXkA;?VP(u)YJfu>Hy<_WP0GM7uX~dfKW5=<#3|h zP?QUf910u&3(xBO0RkmsT^h}%DM1~2^YUBTdGnHvciz%ET!mIy#0aL}Of10Y~-c9vF_7Fkq$d2x{@CMIZXbd)j> zf$z4dTE3*!m*3GRpZuB*kM`-};*8SiBIIFZSXsQ3;-&%D!>dx z?~Bv?+yXs$=P4~LEYkGM46``UPXIE&++jDp2(gwIM9GJeDf;!NpV2RW^&8sQ+95zN z|MtKBH}t`~Pbr&8(c$49y?FTzot+)Cn;!#6@dQmyPSgDS0^PZDhZ6B2x+-1J=G#?T zU;U1b4|eF__=GOYSM0tvlu9$WcUi8|!OM;nGh%-YF zKujz)L<5)0Zpb}VEaG`|`*ZAltgOCvK-`m>}_q|Sw0jyXg!i>CH z^~#y=6yd&Yv^ta@pQ3TZhU||303ZNKL_t)Ht;J=|2knnKfGx#eL&LPYcgWxy*k&l} z&dxTA)5Aq{<<>3w_`@GC+bas`dS+`9N9RNtAoR~HyW)j_@R2Cx3!^*_&M%5|eqLlC z4sDf4j?i#AL&wHN?+$4oBe>ARkdLF@FuyR57C1P0$5WX=auLi4Yex*`fqB~8(++&jMTZ0Q1lit_ zr2AB4Yzzy)GUc?aJnlu~;wY||3}AUc0l#@9prB@BITpGOOr!Q{b)lne9KAR3o}$1= zzSMd4=jDOU*IwJwZ?xNnqO_43oQFCvTG&yL?vyy-gW6BS$^|*EK1G4tdQd{e4HSgit zG;l-pd@yLR+XtBNmhRPOPO3fTSB*J`46tDsdktc7}&s7D{_sqK0_{CWGpI7nahZ)0bxcG3&3 zOW?Ug+=w4_`DP6TtcJYy!b`8+G$AcM%hu?uW)D@`k3uU%rl z>YpoaF>bYT^(V-Nl;1z52N@~OGe74jgu=kG%gV-~om3DAs(>Fh{8e~rEo3WheWDFw z3`I`V6TwgABOj?}6*yx?t2Zj2VoT|F%#FAyuPw7{*|RFlpMW+N>q!~<0Iv9^+y=0$ zu`Em;=`jcR(rdomTB=tpgTd9dwyC0l9Cfq6BTPN48M^YT4pHdrHvqBtK%)x7?^=fe z+l3GS6sMvLe(7+hRE}$jwb1l;t8=!oeDh6u}sEK(t(L?KQ!1 z>rk$a>fnHeki*|KWwKcs&!(teI;Ya0*7h{QO0-uY#P%9SQn8`qRfWhnyenpky1^t_U^(XY?!99vb zI&^rrOY7^e=&}T%>^enbLzK?s>CvMn9L*0=;7(6YXzle2+S+(cyIbp2y(&_r(WFE& z&EVBgD#PuwdvHPr$LDl%a?E1&j~_jtcnofpF?Qhthy-`8XylrbLkXIk7^Sh%0v#S5 zvH(25igYH+03Z(b0F;X7=gjmO%@-K7`S7D3(Y<>Q85Fy|Zn5iSy<3Tg?^fv5+D*l4yGVn;*QTQ z*p;r)MxcNw-MM{-Zr{GmOtMC;LI3oR|Cv7f2gFxXim+|&(p`h_anM{ z?>!)Y1? z2sAduU=pGk3UFED$a+J=U}|MJpa7Uzhet>3GKaAVW)%yr$0E!oOOB*i*Qa{Bdg#h|ht5t4y)?tdoXnbOtBlQ8?yegGwXM2lTS6~?eq{Di_EW&z?8CdmNl^K8- z!yOK0(4bngL&MOgDvZ;u+jp7u#_NV+0zqpIOe_FZ0M+0&iZuytoO}BRw6n9z?fmga zA5v;~h}l;a^uNjrV+~*<^vW32Yt+~swJi6`% zC^m{dyUXQ=W?(r-OXuVz+p)Fhx!A_)a^EVa@d(owJ^DRG_CTP1 zlDncF<4vd0<4mD#gBzKBK8A+Jx*Wu!?ExwH$}$L>%6k^S88J07_}uq*mJmyF3MhMry*@2Le~S^y-%z zcd{v?xA%gkhQ1x|J9In@h42!)!7JxE_X)QDNVJwb^RT-{&h2sk(pz2b+X#A|B&}lm zW`pYw?w)s+Q17-QB?+Hd)+asZiaA;Jb`@2Fx8F<-S`(eA(7&|y*a}$2-D^tVI^h}T zHwGqq)XRRhPKopC(&(+;Uz>Tvu4XyRodjqT4I}+tbvx|fch4mQvDH_DG#c;h0 zER>s#QQPIvi07)YW9yA+Hjk<>gJc1f*SEHg+k{R_3D@e|YzD9#@JhQ7iW{MQi)}Hv zjeCZ(eyfr0Uf%*XUUz>moyyWbal5iRZsscFxv8mkAymvUi@hWumDa&RZgSA#cDCIz z)IiqYl|(hv`E!q${YlzF+zHX%%oNfag$5W6lMJ`@60y)Q=~Njs>q@|GOW0lI#0MYc zLW%<=N&pu+uxdur3EJOWql3*=+S^#A^2G@a!#k}dqUkLhuCKu`fg4zdBC!OsY9J!c z?n9kxKJ;E(l)&|1hRE#PB5M#W%rCHe-OBP3&CkxVkhnM+VO+GRQof|M)mOB>`jXzP zy{6jLr7!@&x`@YVbPR5W6Er8f%`^+uc7J5y7$ta&v#F-E0}GkUZBn!fzAC#M{J5CGNC@Cg0rN54<+K6{^*mzF7=PH{U`t5?ia0@DgQSzw`6uC6#; ztStbrkUv}-!N7s`RTa8e*BxdifvE=YV{d1NUcC5@TI~jdGBdLPipD7(gHBbK$H@NS zF|EDbWL+nW>kmKt0X=#2h=zxTX=i(f{_-#XBfWg_k}fVTxu4-)iZPuUNzo5J{E(i! z^MuDutJ9^eojrQBwoa=rzop5s9L>*+)AHgR>!o#CO?LZ3bjYh}g#ox^3R-PhN+mPQ zw3?lrXE#YOebA0zmjV2Y$0Z;Ez^B)1>&!R;(3KuZQ7$vW?yH!?Xg@@S1bA4lRTvP$ zX8^bM_YY`&{SAXB!^0_h|NReWeqoW$PS051>(fs@VK-USzmU%{P^}L?hab>TJWAb8iw^hqnDGUm3;^BO*cip*QFbY;)v64dX7dGh!A1TR0DH9tC5BRz zDU4AvlVk8ImKve>aF)6;=-mxdhq;Q1eWkRZ1ngG;mIkj33ro3&=}Q$2V5!R$UR4c% zrA6FDC|z_1owXBVEeOEUU=xG%TsGOCn1!V;g|yH)RwBM6uv{IjjfBghK4Vsw(yWuT zC4K!*?}xnKsx?>$9=c8rL(H(al(wQ{%jweYYoga2c^Z-Jd zj&CNG+w}95+$3wI@0_LF?dObthYsmXzTigD?|9$!wxt&(=0V)Uh06eEefq+hv){AV zg2s^FtPUTVVn|y{owXzlQY0sTI}g(~-hQ)_w2RIs_n`c|Y_8xVq$??3ZS)^{3}7pP zn=Bpf{u}Hd?5d@&&LJmreyM-@z817M1sSvh{_}|22fP(jQdiq4_rkszazdWeR5?Rt zxIf8(>(#3?gN+ZvmQYE#)&aJ1%m?ZqY3J$WVFR$edfnG&YEA7u8u~2O0qmN7O{mLj z*-$bnT@h<+MY!$o#2!@p!|AF1h~WwHZun7-=0%#(3Ra&#h#5jSn0iu=6cKL zUMm^;cLIq*_@{Glw{k!vHth@>N>lA61=rrF40!apyrV%VM?_qMSa7T0G(`$WrR2U$ zLK>{81l&XUyBW~T(=5g{PCQVAXNAq)C7>bRt$7HV6- zy*4--kZxNueo(J&mjRK~P=ZCJA%@*7pVID|7j(F_O0~;Vs#VI=YSvhHDjJKh9#XMX zqHI1-BbhvF2emp8DqU5nQmHW`NwC%^-M)Q??%uga_wL@KmE~o2jf0T(2(*ckNlNiS z9R1v;YUPrSkM`;LXTPO4Z&s;ze#ZF%=!A~boxAsFacPMo`wb5znKc6d1b`D5E_z)Q zAQAO~xOtO-000EXM~9-3)b7yS>AXnU z{3zuLdCC{^G%}K=NIXHs%L;An9@2F;P9w=7x^ruRrYFbfH^2HNy?F7OHHT2&k3aq) zjZchIA`z$c^>tcZeZ>F@7)N7cqa0;#VF3WvFuSpK+ShcAsByJAwcB0FWec>te2YH% z=wq6loneL*`W@O|4ucRbcvU(&JY@GafO#zl+&5ZudVaa4eC63ex zFf5(U0-~ivBFS!^Xv?wjFPR}p zpby;ckRM!1nb{PN)7tu5dj9#BJRUL5KmO=rcIo^4`RDZImtWF1-+V)(g;9F?^eH`j z_<-)*xy@Qt93}GXgaI`GP{;>;i?YFm6LSpX9fI^@W8(}i0wCiHj5xI45+=GR`VGqq zA}1alpU~#kHiNbwy#I_EwJW*=xVpB=T5N!EAg~Yc55U^^_$bdA09XJ{;nIi5n5}M< z+T9q%lW9tUfi;q$#7LTALn(?RQq+wM(KS0AN0r;Pd^dKQwl{@Bsx~KSbMcuLS8Un8 zB&dV_r!R11EmnGutTUyUU6ws$n5@k5by!$B8|=4X z-=w`9rWS*DzJJQy-m*bBeT`3f2+F}mr8|I&JqAq4j0d8#i|T#PPSXQmT?Jchfd`jR zdsmE;(2u{LVHkGG(}s%M-%?rAHci{--|4kp-Q~J@DJ{?-pzhwoP-yzDV%aCJkOu8n zP+xk^AhygoSK>i-z0SsW-tnTWCMBorGT}S`mdAc{*UlL~`rV+%^+Yy?s6om7ZRKyK z{%z|V5`x;^-QPXCK^e=gHgvU9uesDaZ||q3RGvhz&+STlLRMA66VZgJ2 z%@WX-{hC*9@vH%@g)m(pmKtL&kV)^6dOz@wOVhqRmLR=~2FYQ$&8t2G!P`c@iU%NM zgN&`74fwrghG(nlzj~N;)_T*+3T6h@yaur3f&pxEPcOUYYzBt*X7hiu$ zdt0yR@Z^-Pn%7kCL@8aEWPPZiM4WYe(1+Y^7gvhlq}d zgm$n30SQY;?;QrBH(njM{-(@3U3lVb&%o1SDg(0~5N|A)T% z>N`3*Ib)^|x)H8_tZ_9m!oul@IEZ#zT3)85%!t9J$Z~V{YVMEU(&|r2D6{Qrb7^d>+3d;S42#N3oP`|0LH;(c5-Tl=LMoV^7?Zv z%r@4LVpd_7nPt$gIyyRLcHYx>9@E*$5gqJq)8@uH1G6lKpB!SaZ3-ah{5&($FgDR9 zxL|sI^trVtpYXdmRTYFkqD82Ek=eU6wdZRCP(AT`xIshU1#3_hSXs$d;mj zF5CXpuGaXDy$kK*FtOkkFSeMrY0VyQJK-_=OS8a4te-{ZbwCd766q}c7Vzb#KG;kz zy$6^}3{TJxgJ2m=M%(_CpN&hqafQ^EX6kc&rt#V9n!T(Fjxj48X6}QX%N5b6)Ss}O zpifFR3*2gh$g@8S0kG7D?c4ssHbkF6Kd7PD&s^_qvG&WwY~Y>;{qOZMz5A4r(c(ZJ zkbfkIC1w5|Uj9Bc^L-qA5(+Y;y)A0q^mle}<6F=9bCu(bwy`uVUf-8nwwHD))V8M6 zCSJ;;&crpwoCBP@jyF0&g$yob=!bNHDNf&^E6Y~j$9fNOGhTdC&$7*R65fNY9&X+; z=v#JQ)|{qY@!-oU%!2_e zd-b<^#{4;q9p@iFzFh61J5xvcFsvKxhUk3`>M?>t+UzE7+<}AC8Sz2u8CS_y=6<_H zpXJWG4h@=quWW;tZB-D@i+Yc-#oVnj=`m$kHrBXtmQ*Xv0k$<)i>T*ig?IfYct7)| zAG)lBkNePp)wAs1ub+K+nRT#NMS|y^^Ma% z*3B&HBnGKb%20>F4wi+mE$l;pas%PN$>CW8V4O7Es8qT1p+k>R(I;{C zs!;RQ3>np52Ea0R)#~0y3~xvqAr56OH@KU>oD!25gelRIEyd~i}iNYKf~y=hpMWBuoDD8)W8|Qo=j?( zs8yxrRgt#VU(wd;Hx$3FQnXc}+7&dOs#I?@INBW|$-(t)IF)8rNT(a4lk-cuxU8~R zH2{DI_aD&Hr|;5x&z{lj)Fe%gkJE4>PQ&p8B>=Qqb`omRYPP6WFVWWK8f|aCp@V}x zIzB$)h<9-Hd-vUEbnEsVW?=zb0uZscdq_uz$8>sj&LZbv8fpEQY&OF>KugO@G&?g* zxmW!r(vyEVpKZUF*7C%-00X z%`ej3+siEY4%fIZo_|W4TRW6WrWvfbb?Y{L^wCH3lb`;SUHT3W_UQA^pVP+18)nc< zPL9*9l@*SF$BeWXqW{Guf?vBstE=l&uQh08d4--ld53=RgC8(k3m}D_vS3WL8V%O& zf?FG+&#?|rG)f1DM|6CAB5r-D5f++99oE)XMJ)VapIK5XE6WTzVh(^k1~3Z!1rV#< ziO}4_A`AB)AMVrk##{R3FaL=)Hg_nM&M+WQDpwfLMm{6y3`d2Gv3s5{AtxrL>CT<| z3}nG=@a*)6PLB5IvUo=2Qjyyh;^fduL*2nfYPZ^47J!rh1R?AW@D*bI34D$=P{2w) zmuCR$yjY^clQY`h-eEVp(L#=aG>D&P(kV)(hIy`QJtwTWX!nz|bK2S2qxr=pTAZI} zkn3P~m;UCj|C+XTb|{z2vw%JH!4{zbx3WwtD=S>yFTVVonSx-*0R)75=Go~f>v2i2 zfhLblu*m@AVq8EE3*!^@mQ{gw7am)f7nQ3DRjM_bot>jc5AM;{#v6LO{+fyxry_I@ zJt@{(i?D9l?CdP%@;Q#$2oMmF3BgE<42@7UnITGmah0UlaEis;qxd;7OauTc66Xz! z0e=R7RiH0Lf8y&A-Xj#iqt_zV4YYI_6}!r?Z7qvK+cx@QL0{D9Jwmfg4RB>$pg1fn z0g!kdycVrNVbp3Sle8h$VOawlyH*RuWAB1in~83SeM|-7knKgp*!5m&xM)W2N+A4h zR9qG@=6N4PG*?w-QwB>*(%IdlQMB#hFu83;lf!5hD^3A`djE6X3_G9e{Po$&T&^iI z(AX!|UTYI2WP6sqm|Z=s%N0pmwYvte%zoy$Z3Y>ck!OE?6%bM0F}i$qVh_VH&`5T+ z(NJ6Tdwt-sM6?0pO-qa?yIbXnup4~u`!_L#{l-zB6M`o*cV0m`Tj_-sOnu-2)I8;| z4kBSJx1N3CdOzq%HGb4!)_oH=N7U=~AhcOP@~(AC^S~y9v~X}!^?%d*UjJi^yPV%^ zT)SSfT_5ZZoRT>}l(V4fRm@*QXFIzYs^)G9SGxV1(bo+2EB(j3`*mgk+_+)&_Tk6e z22P7lME*8btBJovJrWLb6*cMT_dM*fL1c?{4PVL4|aZ8l@9D-P@p}?R7fb-Jm$NDB5XIvtFSZ*ep2Af|1dUP$UM{#W2+x5@`*r z3y7YNj*hdNnM4nz001BWNkl>CWxjbZdE;SusgOqeIj)igL6yk!R*n!R|z0 znVg>=(fSorWN-n%O6l^7BOFRI z0iXa&CC7*HrKKghckdo+08LL#ayz$L4c2->odA-gk|_oTaM;4`1`rD(<-GKDuUY8* zs(eZ7>#MZ4x6STpV9GRGO$H(0CJ8Mru%5pD>PuRE{etUqRlZ=rFF!s_ld}s{ZxaK7 z(By*HHUOqVzQAlK02}F%Bz^hC=k)cLU$CJ2)m4=>h@jtusErRE+@}xTf1f5NCs_CD zi!Ywj>MGm}8~pp7+bhgelCoo9M`&bZgukz@u2J!#$n2jdPoC1xfA({BLj!=R0abt* z0Bg#ZCDy?LLkH0Vp>=kAa>_1*@kD~%A0ZeIQ1A8XEAA822crBC3uoc+dYz*)0(1dz z%dDZvDb6#W&(rhIKBcd|{DR)Tc}wL=l^IcJ`%<~g;0xv$o&^{Qaq&j0!5Ur3B;4I5 z*)8?a!v{oNh@jWlJrtnl(eWXJ4shFp+aJE*=6G2Iqf8h@U}K@*$HphPef6Bdyg@qx zpsm$gbWtpGodc6^VnqS z*T{Q+4hB|$)okDT+qP;CO7ftf(2dSXy(rM0glyo${zw}fUa-b7#QU1v?wmqS@B^O* z`ZT~m=b*rcEaS|?iiQuP^UUvLU^_jm>!inp zyDpwq_2g}@(*bL?cSZ1zvw%)Be^P6BFt``MRO;0(A%nx(di?-IV1sDxqMjf2_U)~n zJJW&IksFQ59x0l2K@xOtSW9PT%54x`Jsz0oC*wsO%Jbl_s&ka8YY_*7|-GUk{Xp9H7iOFw} zz6@H+t;irjQT)s+L798=3|JU?rWrh`yr}}f`tKH-DttMjw#E3M3HKBYV5vJv{;&OX&K|?rrZqdyk$xd`S22 z-l0q?#p4>H(D;fmOAuo{E^VvXP1kMO-QA|`?YC4eL1*cRc6PTZo=DN7$M4eZI}hmg zttECBJ2~2?Z@&J5zWw$)T3=hIjklY$ySGo}GQ{MSr4c0>8V2(SQ2{fwvT~dL@DKlp ze*EK~(1#y=#GnEA7p#xfZi!niMHrX?w2Uzczy)j?^d9;GQTfi#Pw4gQ7j$s2OVwJ1 zb+j;+9zS_PAH4q_Rmx>LJw9S!=JnbuI=?t)cKZmT15VA-)a*QKgq>epvOxIRd69+0 z@7!9U_n$qbX01y5`}_3CC!f$)Uw_R&6Qbh9;zM-ZjZnMUqYV0wYkk~9snB;A3ml({ulp}K|O#K0IjgT zKuZaLB6P6;VD0SgGH`Wv0Ri_*X7qr4l^RJiuml%RXkS&UWnOO<7Z*7Kpn%gT^>t+{WpI@zy9@acx^&@a7o0^SCt9_RbczU#SZ`v+OkwG zak<*f7G1YHEJpwM(Ic9ln`P}LxQFiUAJB`JFW9YgacQ0zZTIfpri(Lxo=4Pbws}28 zf5Xi+lgTq^0{~Mr1S2$(LWIE-1GNw?2m9%&a>YRl(69io#z*s1$YptMoSqlyv(LX^ zmqSE$eDvTx{p80#qS=`#2KxT?Z+}6*{p}}oa&pQnDljvl+XnG=1R6kl|M4IH5qO^7`9fFJJFl&C{i`iF-$*VOF&E*L1D~j=Ct!vIIX-DnTK#k)T z=#{C_7aE3Hd0x!Ma&)IkNPY4Ldgtk9if_j%0%Gsh9zevzLw4q{yD)kTQS-jWL!t)J-t zX}ousqlU#^_PEXC8OFtw-K=%Md?ylpampT~4v4ASRX=Y4EX@~G(Qx&ir}t!SgXm4# z0kG_xjWO)DHl<>IgU{^$H?}p^3!LVSPADN3qDA*sPdJ@ndPO0)R(>+N+-bT#9;|GG zJ*Be=ds-P>K{mPin<;Kc5_Ui7!%lF6X?moxLCr(jDD`BZe(hUN^?=RDGe)7OnQhQh z%wY#8aCb|u!PU1!%93$fK~giPr0~|(g|NrHZl1749hf8J$=|kZ)m$@wQpT~F$i9`r zJ%xNNV(aGUy4a0BU=xN`S(Z-U$KlC(D{J>na9_LA(p$|SC34bpo!0_i?J>^0AN6W8 zGj80O^j#tYAJ8C{j2HhSdL0eOt8a!u11Y3UeGWQ(gOx94nmO5*%Sz%?WdNcF>Za-r+Mn5*- z06pOu1Oab^EzP~AJA+C=l?dJadM_T|1ElgN7`*o2xj&q4)4yA6@j(fo6@UY{H37(C zHkQ6P6?F_gsNfL745hXLvG~v|z=jSbF76L<_%b2J*?<%fE5(W^Ke zl|LK!YQ095oV=i8GD@Ac&}=SStAyQ`G@HxZ_)9-&29N+QmOvFmz?F89~y@Xa?AtDW+g1NZ^P3K%pH?gkJ6P@&oC(p9ZP1d>F(XT>NW{Z9gN0E#KRctN<2~Bg zSf}HY1J(o^N(@sbo2UB^9@3MC_vy_VA}7A0S1(`C&cOlInoSx?j!TBBA+M&IJBi0=PqlHzQVhKtmhiNzw zW8J9xcW<+f73O!l(_*(XM6Cm3Ck~e+6$k)h2H+8Z^3&r}Di(_jI3j}M(|4ZH<45n% zqel;wi?T2W(H5AOh)}n&z0CmO{^1de*<(Dwr4g=qSi8zsm#kR^9k6UB%U}v3L;|ci zJQhF+DtTZR-C9~;*TIeTHTvSKuj%FMRodR&H(*#{Y?Rye@ZgZ$-r&A=_s(5fSX|(! zm(^O8F3!)XR;f}4eVhh+X^ep^2>Ziz6&g|NZ#U?ycuCR7H7(3f(ZhSUs8+e83$A;W z8A$*d;I^60Qs%V(*O%P=GG{PK!^ z`}_;q-aBA7zW3jKLjU3qe@5ktGul5mq|cszNgJEn%=p4U1sGPTR2ZZJ8xd(ddGeV1 zVdd5>%I0z$MG@lg5{(c+2ZQ4P!Motmu%mzlv!1d)gcdkVlF+z25ypUq{NU3DE# zQ8%8Z$Z&>*+`IT2Tn1S)E>4Ld5wX{9=+4@&)`kbrr#N z7kFiW663ROSW225r0^rfbdtTmxD9F+7WcU-sqNZtA|b*R($Ry|EMndZOaww5bU=V7 z2C%e!s0-mZ`tcah< zF^m1^Y?fO0Q6e8Z5ArU@9`J6#9ODn5_dLTW)_bJ%l?J7lfu#W~T*zp9!=oAL0_fiR z4;33Tu$aaE8*{w}haN$CS*||d%d2}4V(kZ=Rm9Zr8^Iougn7dMgUc|Jgo2FU-u7+( zPi-swCZ`!aO`RN^=5vf7=TmpXYePsc24UEs`P}nBuLDX*Q+k@hsjF*nX=B(U$Y$nt zD1hbkP2XPX+sw+S3>-uKd(?g+oN;ImS~)bzKUKIMWwhH@v)sZ-h;~BG81T+hS9V(T zP?ac*wb;8QocidroiXG5MQUu#fx!lk52Ue2)4)J?KpX2><#SQJS+@s29i(X8Bi&w0 zr8(sUy>Hbk{Alc~Xu()&kK9%Iq04S)oqE^EyyhDNz25WJFnsEG=azoA&x&DZ-*@fM zwXj}t4|h||zU!3Tjvk=IJ>Q)|>7RlDEF1i{ZYb>=IknC4;k<8mc^~ks>0#r*9zVW3 z`etfvc!7AhV_Evv@30X&KnMShfhu3qSZ!htu|J&d(7#`7Dex-Bx8}^gG60sWomzQ= zbuj=Ua6~bHSZ(S+Xjrj}G=L>wgwXI^02bH+aCuROa52>tAmZ7~yu+GzG3~CQ3`;JX z-n=dFM*~)R$CDdpbpxx?F`>=1&WAGoMZ8^HE)0OhH_%GZRz-V~Fz9l#ZTGOYH{31? z3eeR6R>;`Z?q*s;ML=PhOX3!&_A(Xu3eWS6yJF>Vv~x>Os?=7A0yr%Qr*EG_tF#8DO4$LcP5&?K=wY#iwRlcfGqY1YWvna%a=4YIZl&P6U<G6}N^zn~=kADBBKVy&rb5FNF07x7@A=r*KML8h^560Nu?k?@_ZPWh2 z4l}U;uH^Hh9N7&nj?iNI^{;+OUp)VW*<{61nIeeP#?^NWNL)9x-i~q)e5_1=CT=j`0ze0 zEX*-Lh)9doYK0o;t5%ci#`yj z+P&G>Aw(DmUDKBW1jMUMCg))W9A2)l!Yb=_$)`w8j7)vsP}5Jh6F zC8Yr@o?qA3ltkpi4<>dvsI6qW#nD!7J#ShCK_im3nDu7S$k%m7$ADy`dAl(IW4DcQT6 zv$MGbQLcoVjip8Az55ymRZ$?809aB&q{;x9#lF%PE!fL!1{Rk=ed+RPj0k&(xTEX9 zAhP=Fa<;COHYB^G>j=|UITU-^eLhufV(Chm^SAmft&P-3Ibc=s~21}wB{R;Lj(JEh;y{C?p0Aafz8Bm3;L|386L z{o2HC^FNyI(EqU1X66;dfEmDo8zJjh0cg?!w=#AZ^idj7tUUx4mePh1P{RVQ*f7Lp zvC_m+p~fM63>QKJY6PrT#?bbGLsAaBBBM`_OS{(U@L}Js%cvDy6>4S*7g(H3| zE`qAQ2H4U!+yZXFh-aY7qEqRWNNam|*DS$vEVqcDJx#d?>NU&UoU7@p*-vOc%mWQ# z@u9++DV&!Qo@N${y$D(t+v*Bh@GN5w>8mTXOK9NGTI+=wqX8^&CDfKIhjdrB^+=Q5 z^H`8r+gFajJHQ$SXE;h-jI!A@v!J%uzN7PaoeM~|K`U~uQ|eb%`uMT zY&1^~@86@bLV?atPN-4EAw5d>9==0A_~`d&@z!0MpPzT#Hv(*HG#gwF9Js+OL3gaJ ztd;U!Ny${2-61h>z{Ug|ZQNlj}*bHDLVpJ+#P@`HA5R|owhUondKBS-i^k?ig2bW8& zc?3WLdRK2ZHt6k^fLIts@mQSm0Z;+A%B!nODwT?q$)sp%YMR~g0Aw5;pRnE&fE&~w zu7eQGfBotu>wAHLh3I*3k<4VXygrpmh+rv9AYl$s7%*^PoI3h}BVyN<5GG;@B)s1Xo#CvFa#W z#%LufKwjxWYQW30e9Ar)V8`pr9Hefd`lgtW`xvmwh_YXiTDy$} z{kgxC10yEkb@iR@LjWM_T!!6-nMfFh{?ZSltnS8tm4{GjWa&w z0Sl$I#-5qjy8q2hueTL$)+*koZ$4(-qbB^f-sKDhn>??nV`}IjRS)IBv0(kt{#>W& zo(A8eCBhEyp;iALdEBUbZ=Sxal_5Ms?K;wL$f?i$@QwPwUa0W0$N z&qJ?_eHuYo6|R;H%+v`X9F(Gc@N+FAKJcnvjRIzb4fJ@7l28CAY?1X9G-#=}+U_P> zhI+QwE82(?*CE-5-K(sW$Hg$zhLbW5l#O9g!v`GbmbKH1q3c^~d+z0f?Ag6WjO-<< z)&r9>d)K(f80*uY?vH!75}pNs^*=6mI21cTEVy;B3n7D7T8tgWvy_+tEVvQEFm8!< z3r8qYkqKo;2ymruD>(|FVq}R9mQGtm0#fZ~yRVr;fXCR>cAs~};o@1%W*CCj8u|aS z_8v@{Iu4IiTRVpA}sv zl|Gr$YhpH&!8*{g3d#eGC8Uy>YbGmAfpo3j78au>y{nbEmpI#5LhfV>5ig0S2a(Me zah1#C?BWU+nIdw}_wr*K&<;TLAZGrqP@1#O3)Z&W;YTe{h0i_YlS= zW^n(#A7bX-Jr-Uk0e1nm5#y1>uqj)eIH(qjWxRd!7OU$kD3%H+RfKlXt;vonG1%?*6<#c!~? zvyF6`z@T;pRG5WSDsgC*KNw;VD-dd9_S6-DV3|uq+JZ=R#xZmE4pQCStjj~7BWZMT zmcw!h!GIsFEx^^qDJm>R9zf;VgM6WayZ0XAo3=bYYL`O#)S67#u9Dp>WvY9Jn7@(;#lZ&*P2sENGU=|h$veO!_RQS6T zQpn7sRzGKaBn`0RlT!vsh!K^!6z$IE^K8okq%qag!^r}2S6A5C+Qj_aELK)l5hpQp zj|YoOORT##I5f!mSF{e#FD^Mmk${n)-^(nuiCZIh^xh+8r%~3z^i>9hd=^6k{fKu& zu(7_*>^1`8LhbFmUZ{VG4M-pv0bge5d4<6;0{ckIiq?CzQbe^}Kr3Z+#0|5rve_%7 z(`jZ15`ZEu3Mk`ak^!u6qyzr;7(D(k{~e0NS-c&-00UU!!a``=u|?GOBxYQ)`C(%w zw-qJeEs|i+9}1^bz`MR@tDRL@6@AAxbpjYfC|bD#NU1yi-?S%BRq_Z6z%rc3TJLjvfMO^Ka`ju;xQv}v1AQ@#H-Wn25ke)Lk)(S2>JH;i>>0cmUJvax#f>O0vM%UY;s zTN?C(+H8!fSf8)O58km~8%!Isw8mj+_9RIj&1)x{}EWx%?g6(A~*iI}g{ScrsGbw;bfme!wB}8rISm>9k+T7>MITdoC03NQF zbs`&UO+Peg1F8-ae6XSa8NR$26E02*E1?4o9gexLeZ<<4i~%`B3LFzdCU+TmfDxf} zCfdjM;Qaoz%rZ$~cXFo@Xq>t2$g*^Msn`xGtdyJ2nXSa>N!{f8y&iqdh$lG9pEyi$J}}(e2!VED1)ZH;;Psm~SYKZQT5jO;Q%F|` zqa&l3xpNmM$0w|fwX(W|t?hNrPU!Rd(bLz*<9c-^00km-CE_HG-Nm|L1d@<(F*vHn!I)hiF3r2R7GB8d}PO|1!e_ub>i^gYdZI#1LNu-_tGh%ZQD~=drkw}ag zg!Dfumzc3MmuU{tBp|TuB7MmM{4}l!tZ>v9o6zYl%gUATYm9(wxwnZZY3 z)%MmVh6ekQOmyJnm@+LM+9`j@q7YEDZG`~RHQveU>t?J5zyxIwQ?vT z0e;t&B8L(Zn=KR&8A2(eCS`*pz>Yu^vSkFmQHW=IIEG-jga5QeJJH^egg4L*4~gA_ z!f?&7Gu`fpdjh_CgX$ZyMB{ShkS5yVxD>kqAz0#v1 zn?!X`VR|w&Pwprxv|9OEDzmQvUK!_M8J4I7-Q`}u2}rcd7F7rRaz-#^1&C!~V5u#^ z5QLW*3AKwGwXUdZ3{69I8O6+P8J4Fpjurda^ebzTVCC$tpd zP@dZ-8v3U;frM(gUPiq zZZgf=e&Lr=#ngeSiBgrrRnxs1c%|BE>2vKSyHVHHsfP7c@h{8Swb^OwR);3ucYVb6 z3wcJ>*n!Fzm<=>vY1}D#dG(g7bNy^bPWu#X^!d8|(&%OP0jieWc<1wXGoIpC+yM-Rj?5pEkBE zsvNBW4cnrvBa0EBCFfEveR}Et-LQg9w$rXjpoIqsV`XNH;eW~n;I>~Y7M4!4xBRyP z#k4yGdsjF%O*TjTCI9gb`?2dhwR6edVGL{Q*+ic=EWe2|v=7^hGtydHd<=8Xq33_m zeU1NV01i*n%yim2Jmrwju2df$|KKD1 z>MwqYXnPPhl@fASY0m7HBAus160vBE!3i}E1^~z)ngAflvm{VpabXsFdz&~u-p9>N ziNm!XzyAXa4UOXD_yEp8F~10FD+_q>>RZcifB(=W%@)S#of zlJ3#Y?k?u$=CQ?@5xodU!$>8Q%!r}z$*qkI%+AeX|8O72r^f;W2?jZotynJO@Zd-= zuc|i~AD`f`!QP&3RLUhhd-@b_-@d`p;u72ZNF>6*2{ClGx3@WqA2EkW{65;zfmClF z`UVCC6U*1aSr5}^XRHZDj3EluyL#*9%?16vw@)@ z+`dhK&lq}p2e^*35D35`EhW-xnp;@Fi`TEv;`4HtAp=^sH99iF+EgS!PT2;DO+_pu%7{nID+-D92Li}svdkJIyFhwW1OidWJh7FC4<_o{bC-voLxz65$!Yw6uh|g+*oGXDX7T-SkmWA#KykepKN(C3^luhu6fiD6a$8S&IrlkeNN|nP2GnZ+2uB$8# zKQ=mw$*C!32-5F}rPrAtt*~~U*JtM!SX*CXtu$hh^-2a7jUCNDVy96yLt>dx`za{` z*(KU@C>)Ul;#Zazd7ULXVj|2m7{KLKhUW~iU&*e7!x2sbK$$e#BMC&}NkkJV#5%j- z3r67ax1n<5mHxKUVKnWj04oToD)qjNoY(;WJ-on z8k-_NtVe1YsG)hMrFmc^B5lj91b6i z%F`Mn9@QL8i_hucq1L?H;A1wiTXBRC2HpLC^&DRT0==7S?C_V$+ftvfq;m8EFv}N*+9p})?b%xDxOq_<==|LAg8r7?A)2`8UG+A`w zqYckoZc|0Q==wngjylZ)>x^~nC+ifn6jYlIqV_vYw@n&OYYF<>?nh+9TIh{1)>8fV zjPJQtRC~XPPU1)G&soZTH#<|;rYI20z7}Pp%pW`VfxXGD_?+X|I8BT{#RA#~P38Nw ztg;4%uEBTp4fmZ5brWrBFv%N{B-J+!T6bd5d~EfNPz zBYerQ(M{|r4qc+k{F4out#);5(a@+gF=q8Xpp{?Si?tnPVJ5+YU-n+(ew#KGNv{3CthGXk!$TU)r%4(>9A?eVoG~*=(uqy1#n+z+JF;F%|g;vmkK+Z^U zFtCQpiVafv4(5$K-z4jBgmGJJ`k(^1GFgr$Q_(b%q6bLSSPJ*bkP+1{W~z1>MlAKm z81ORyBiV!UV5Tw!imwO*r1pI!CeN$^*)E}TCJuo7T@{ZahuxTmN0h(iwCmyU{x^f=@pC2_~oSv#7VZn8cWF zZf&v-5rGAVM+fk=`jAM(F*-7go>UT@@fcPY3E+8+vx_vYaybt93x-0h?L;A6yL$&r z;iJ&MhY#Pw^u%q}WZK)=!tZ|jZw!PGLnagoAr^}`1boUJ4=0>QP5r9RkAj;hLc5V*OUVP6CED9HGZ*Swwc@*|X zOgaL1ws&^1xw*+~Bx?7EAAX4G$w{u$*5(HO?TasPaB#?dN`MG4uY?X-nb}P@o)&a< z^>9`|YCkdHt~pbn00b^G83yF&d;UNxQmG_@p#X<8?(FPhkHQcA0eC$(DCBd9MI)HF zJ=Oe2q#;Fu`z6-R^7Htv zuCHTrYn$0*sjdWm`SYJ5;BUdp7cZIVwY{^)`dS1=5|~P%iNx$WK03mS7cUqni+6US zcVGaizCISoCot0M0fMcqTrUD4Kl$WiHggo>M}Q~w3$e^-zPz2CL;CWH+fCu41O0;x zni1el;gggEK!j^iz66nFliEaWqjH`-{SKQO>*(x^qq{4Kp57j0a(V3T?XfNw^*e=7 za!6%3f=H|riLM?bQ@u!}`r!)^fYpu?0a!Nz@Z#hbicPBQ8v|HM&s^APb%{cM6M!YO zAW8d8%s+O=Y;p+tfk**j%GXimlvv9q`&{lTN)t;HNmpU%3h+@t5i`kDCS4WE#+TLN zJZ9($Qkis-B<(FyCQx_RZH;c3Ha-HM_mE4w8d)4nbgkELi)x_S7%On}B zt&>&k9*$#(p1H+Y04xiu&2kAPoMZMcWgw``QlhqB^JpXeXx%?D*u%<&*FZBzcS}3B z8k(01zG4F1Sox=Ue-w^g|q5*OYEmoqmxn>pORW0k+gau=WL{%C`933OP1C zX6M-0dQf1)!;AAAGTQ3cXqTRl3rwvu+mO_JNL!EE@61`DJE4t6$5MF1scl#c=Q_D8 zEBlY#=Y!39yvrCk75YxX%cfCPE3URkr?qKoog6&3Ha0r$8;1(FzSIvEb^H6>S6#g~ z%$Cc8kL}wImbt-fXv&H;IiqT4m>34reyIA_pHl9l(`cR8YvBByCdZ_1CEaIMJpfDC z4B^Px1vvF^VJ=;MLce`8*jL)`EReY4TGPk4mI+(GH#GW(ZM%B6Nzp`~H?%WNlu@rz zHRapvoWs?E(OcT1f-bKBg&X`u5AeT?iGw3Cu;?&B02VPK_-~&k=5FL7l+Li!kYW~= z23|2BqQDydwy=u?UNL~hJ5%X8zZ%<%(>kvDK zX}}l6_~HJzZTWW-syf)pI<5@)aU&eng@P^bd|;c;q%Fr>4=}-7N&iIV6k1 zAZh-IFi6T8N6eY+?M*B!%;M_m0@v3i^mLO>Qa@73Zq|q*V28xri^U8|#Vj*t%GDcG zNGphizhg*s_aYpPF+jGlwuL`v-?OJ3T}pn?{SLif|~1 zE7CLCKR~5Wgr~I~Kl_Wn#>2-SBiI&UK*U&2xWUTW3KkX@u(P)#!^M0^rMhtU&J;R3 zBJj5W3vXZH>5Es$5{u{>h;+o6xe^Qt0q}!^BhJJZjm0@UlClnNZ>(Z^0>3{nW^(cvMA*$e`$EttGL zjvxHs2bh?c!pPV-(iHx7d4{X>Ida)F>nZuXKqwSowokO96CH61JM6>_L`FFZHzQ_U z`sxa^b8~q5{c}FElHH1g+nIrt%jIyD$s&E3!QR0kGsdE^7*eSegD+jl1lE?9u(U9b zx!GBiDivm4QQuJL9*M*gC`Ak%>ie$lUIg3P*>nh9Bw`8)?LS(B1jtZ0VX>Hpua&~v zq8u)HdU}DA6A^}2EM$?-W>{3eBNoNv#BI)iNUSlhFMyS`4eae7p~dGz$WMA+L9~VZ z%nGZNs|-j5{6PeRer8sMf&sRdlrb@zEg)Ykab`#g`=fCqpfZ(+Ve<9}@|g=fd-e<` zXK55l6&C3y#u_mX37DdgQ3~1HSleLcS~j0YS6?rB2KpKJEaa%}IR?90TUuC{|Ngx@ zEDYb(mE=&(OJZq}aC|NFN=N`9%@G0xiGd{qv~M`H z^4llhU~O#$@puda{e8H7dz{CJ<{gz!040qL?N=nW&lwMU`q16ek7UmvTH8nys~u&C zkZB`yP})ER`6!)0)3)mhCpTO#+WT6)J`VBZ*VSEvx?rh^jH*o*CO2E->O$FOb(x^D z$1>QYE=km0BS9sV8IOTDU0aGu6E~ zWF|uBC5wypd!>JAu$4ud`8h3#h_Ro@gQjKw&>cjZ-=fZ?$|q0&mgShO9bV=2mI36+ zUDdoSmHV68k!sGh@~mZC*vR_m^)=4`;%)U!F?Vj@dGMd}f1-CMzplUvi<8>WqkK0X zw%MoawZvFN%@*eHT-}~BX0zqR`c+aMZOxDw6wG(6t=aQV;eGEgE*3wiQOBxUIym;W zPm1+pK4<)w%|W)(A7%g8tMN_%N8_Fp#TzF)_ZRHlsBTSb-Z0mQ`jv2y&41O5i0ucB zeqUQji#x3Gww%VW0ZUK+xIR!e5Qd#}+lHdqxyBu@UUr+F+FUdWb69Q;v#Rd5jq{!U zRGr~Bt7q*?`@huXw&TZZHeTno)3DQYd+WG7-RfwW2|!I_#x zTth81t)YEF*zHT5>c4}jvzAiZ2FIe_x%|d9)Usx@@(l+-{)b)Pux6RcPFG(Phj(#e zb*+WP-a9M^oiJ!wBk~`vLuIvr&fl-sH>MZlWCqNdHc>{s+3q-=jmor!)mwXw?7Vfc z+w~s)vJd!Q$2@`+C2zyoahG9!tOeo~njq>{RRJ;NyosAx3MU|7M>xhNu0#NoXGAk1UL0UM6 za2W)kMs4N;g9`K0_iUr8%EpO$?FLp;%iRH_eyLnACwO{^he;}A=M01^5_eUYb( zhua(2+7f>%l@k1ZFK*wyh4Ha5TwYvoSlG8up78HU)2ez+;MFyJtpT(Kf~?Qu_Xk<$ zs68BEq3*f4Iehiim+0;7!QGjM_?y4|@9^V4{~3qGl?oYLoFAiD$N<#}_P4jOzPyCB zI(O0gFZ{TU;-*ut-4ro3H+W`PtX3Ar%Y;(c9O@ zI!q+){?*q{@bu|(X47<~dhqyz57E`tja(s*)3XyC93LXo9%43Gsw;(PI4nZ#F3xd& zdQ6H$42XU5$!GYdXl!*>4t+>8v!SxM|Q7Z!?^lbtX z34kO0t7qRoV<3svL@Y)uDIaHiyvpQ|FA5eFF|nv`hK2?aZf{2}o58O?{~U|+^9-aA z>xx)D1a4Aj+sf)1j*pJf*WZs$*6oV1#uWW8(CT9#h6UKOIc6(Ss3_}#9UWkQe-|C` z7>0*O;q#HE7qGFuiQ}UKUfbnT0aur4baf_hYityseEdUv@ZrbU*xbSP?g8tmm5Mn8 z1Ff8;kl0ZaGMUTdcs!{7{r$a2btM^aqwqlzaX&aZW=$%})kYv6g(61VLky7a?`~mX zVUd5=9_>J(SmDsd_E3lcGER0tYwrfw+u6nJ!UFuEAR_S&boci1H;I`@^O;h8hTB6( zCgS+P2alPFMOhVhcX#-2VqP&QsKK+h$-H7cqJUobp4<9nij>1MSE(!Fcte}Ef6%4f@7VqRR)1KY|boC9w-`;_i zKo}Jdfxe`fB^X$S{Zd&xWEi1hlN-AfyC~PZ-%$u5YeM>D7DMeJ-bWOL%eJRm%9P($ z7To}@Bp9SvS1L=O(qGiG35p9Lq5oyD*VOm5@H{2ruJ&hfu_X9OmTZS?cTIgP-p6H< z5+meLUd||OMNV`m8CQJaBmXFkNCk+geS!N&yXdsCiG?31e8}2en|C-3s1x^D!f&+u zU%Gdsd>gTYTERr!f7LxE`}+zJRQs~nw#<-5#k5ivSMLsB)p6Ptm9CzTSpRoUr)7sz zs-=)-esAnQ+MBiCa{78reQSj+T$*Had|msk@hQmRxL1#NBqy0D*KQzcD%<$;{EF_x zx{smL!Oww#rB1Y3LB^Y!*s9@(+W@87uQ>IPQ!N`EMw(#f)SJNd;(fKnudIOO=wr7G z>Y&=x_&D{us;F_|m43NXABYSg4aZfzTCYwPi{w(G>ym9WKB7F+kTy3H9G9$qD64bu zZrB|8t~q~|`F86~YiMjkTiI~@YgsXMzAS&GwMvdffd%BihO zoo%zGf7}6u+KM(Y-x{oG=f>AtC=TCLhfA#o>|2}>6mBeMci>r=SMeR5`xla#XlH_cDYFEB;4+ zi%<#Sl>OB}3;y?Uq4mLG6O@6FwLd)Y5kpFb6N;N`EnGq3Vk#_wz!DYiXE?Detz@ny z#V`^gxuOmnoFV6*vaTYuOjK59`RGn#P3WG!ziE9X%93+Y-6j)&MGm<9yUd{$5{Rpc z`igd$0`008LqkdeLaLs+FoV$??e^MamQih#PL^`Wg}w>*kAT=LD^cw?DjbH{RC@Y# z$sD7ab7&u07`zf8B*YXEZDNp-GrFludzopAs4wzHUIzvFISF{FjDz}GRyX+~t-D~- ziA8Uli&`dU#UfLO5~`a3lUn#->cuq+I9JO>WX|@mxAqq6bI%aC$)KgR9eYQYER_DU zpZ^6O-Jd}+9>wnF8ov7SkJ#Va!}<9s9zA@B>FGNNx07yDJAB?&>($WUk#&teX( z6rdSp9$a2tz|PJFj!%vl2#H1sh!{eDZwd>uZ?H5!i}lqN93CGdUtG;n761Ss07*na zRHBTCe$M9SA#E|5$6g<67mbaL@*$J-sR#^N-`YZ3dl<=NH-7b({|$N9-IRu&hqxpRP96EhecpT^M0EksERN%k!T2oZSo`t57hk)m)w z0ttqPh8V!|daiMNu#4F@FYx`VH>i5N@U{k!O!XidjdIAA05d(T4VFkGvAegA?X3;W z&A!3z&KAvnBs&wFJ&)#PK3~GiS8p-DxPsokLG<cBGJ*o;dANpa|Q{CNkr_V-rjyZeDDxcQ&S>=kff-bCj!Po;#$|MXa3ji!?6MSIoeo&`t`KyM1d6?&#>4nN0+WknUD4bA@;;g2DbC246q=9-M(Nka7`d>`=paJavR!-G8> z93F6J7-fyj<_jq13qnIG6k>peG67Nu=Ed1LHn+D}q@RGmTNAg@)6>I1B>nsR^c0?( zYp&me`!jg__F zoId^TJ1nm(Gf>#y--m|}A0Ql!vfw=RE47tE35i8X*(Jl#4)pZ&qqlDW-TgxdMiQKn z@Y?H_Hc7)sl#NoXUnMkd8gavZ(Hdp|i$VyAfn^IZs{yYJn`dTcHuf+LP!YhC(EcO) zT#<<^Xg@N*E2%N5GXB!DWLa64P#%=j#f)(gB3%Gw>!~^>14{_BE4)qFZB9U<^s!`p zDAO*7#w&KQA~_p-;tk5xDk>Glx)y9+6Ff8bPtkt%IAjl~jYk%0+xK;ZitV%1lhgq$ zwcN;a%v&<^0r31sB>aqIUEX{-9)?7*6_5Y zxpAgLr^>GDtST=;uSjEW*L>PiHT#jt$pO`aGHk7P@>T0L-Kp}HhB$O@W2f3pwMegu zJ=DZ`92?cerZeGKh;ye{ok^#DHVYGnEh~Df4r6K|IM0=O^RQ7riq+-#RHIiN-f{vA zjq%V1#&9-`1F6;zTK`&Rp{*eE0BEhKbt>9V;LeRQZIRPNmhU*&oZ6{S>pa)cYg`w+ zQ{AjT)BokLq??(pS*yV;Q@N3Ztv zn$G-_OESy0mD#Mfqg!@*M>*qkIQ{EEFaD3)t*m*)p?w5kNicUDiO234| z45S_u>pN-sATpf56j>Kz!Oo)+gg1yeLVJX*gARPCpUGP!0bVK5T{Bg<YLagy z99eB&XPp}Zz@kHh%Bm={K(PZa*h?CL%&M7Ui1aE@P#Y%Y@EZLhYoY_W(i{rVN&tq! zxuzDWKgvlr*PIDH5}nN}Ge`-Lie6(T6NPZeuueK?Fca(Mh6SlfxLMCwNQWXCb2?xX z*rfw_?SVEM50sb@w9RuDZe0{KE>SJE9~uUA)C!G>1-AAMP`+tFiNMjyH9q_F zGkp5-XL$VH`xqG>L<`L>523tOf*1Mk{ncfxZS0~7AKD^uj89Cnz83eroR_cPyu!=Z zFPQmMDwNQb?84aCExh;WJ~MdMRu-{1{|2-3OB~(^FNv)u7%(6<34uMGiB1tV7izkWyLT7}qyD%|U*P=g97hMoI5|GWFMsh%eDh56xV{d<-=P`w} zU0z<`=Zcj{LVsesyM`3d%3O6O-rCdZj z){frpBtHG&2YCMnKg9DFuNfT7WOKa2!cr9d;`{=gofO8}YlPZSpAch7Fr7qr8wu(Y zh{oViFn~lN!F{s1xxpc(G(TAj=?2VRBdsa|JqeVf^+Y$`24LbTEDisihM5147st95ll`^Vsc`V>-gl`Z?V3%#$X1`GXnPlfe_b;Kw}Dj zB<(Hg(~I*nwnHS)PIc|+N-_AnxwejPzj=a%#YJA4-Ki92?%zXiUk_p(F`S;C;fMfa z3d<~&S;LJ4_9<+)uWtZ71H)*KClQJyfL5WqMRrZFeT0poxuk5H9+D?FC*jXV95j|#`#LcfQyYwxi1DARgjB>y`&|`pcMmCdg$IYYcCRukoF*z)z7#TlA47g zq@DmQ0i>zDQZcji&zpOs_?F4+(!$_*e^wa}#m_}D7O}6AH4?mP}V&a}b%SEyl}WQfa<{g&ZI3CkinCzjN~)tKj&kJl)pq#YSB$8>P3c(JN*nT$^nie1r>Iw|iWFsp#mA4>Yc% zn&XY1RF0;YH-=$QYyvf%WIfFC>XiJBO}3O|EZW93cLc8NOTjYd6!qWMDEmJh>u<75 zj038}^f4_&?Z`VHJlrOfL;K%3bkoX=sV!04gzP|ztqvx?^M{W7;L)6%A=uV0PKUTX7ND0dRbc+Ng?(j!Sf*o74!h96ss*qF=p+7!8z$L4LBopS08Hk!1@{EpPtp}tljmNi$#@@iT4mNN2ZJ2=~0!S?b?tgdb$)iZ?AThsX2&whdKWDN6fUt)D} z7Avc(EaW^kK8eZcyBHf8<-;tlt-Zql&)Ji>skNc5H2q-IUH|#Y6|0H!-%wnaJ0XR zfByW}*w{Nn#p6S!SVbXMz`Z*&cy#X}KKT7kh#ERrhroU zhO;gvlHCZAm^X3L=x}*c#hbSRz`97E6CB>x7WA{w`kUEBv`0G;i+7{D zZ-~XYJCmeM1)N`;p;{pU_8SH_^4Tj687$_r4CoPPL0Rf(Zc!gxoLwM&af#{4Y0TW4 z!6%=7iqTu6sFW)LT&+}Dq}v|~Fq^AXDe)R?@laS@kpHGWSXy4d^Ow(Xkv?O9CY9=D zrVlZ6C`;nT)-Gr1yDpb8G|-39;X!mI;y{ZZuVxppyt;wCy#v|k$q7bgVZ zWJ#326`?i~*b|oEG;atZEXz%&^OS}SrT`4cNmB)=5y%ipit2+%*@=w$jB%&(1@i);gkf( z5EG0N77%zv466CI3qS+vBUrt*>7Uyb#`{4r>74+14D>*b|aEVq9xGAfFc9%(#a4Y7X6Wc zlmtnPjH_aE;vJ4d-6?SZh3!$20s^qeo|uX|Y~{r^D{Px_+|sqGr0rAS4~OV6P$U?? z3LaMt8Hxyc2 ziX}{Cm>`x4Nmt?bdS+g+@2GuIB{!+{(=B&YHs?iWUNeBj`Os~PUgM-X9Eh}MYOCUYE#2sl!0qU#iqc2NQhW_~ zWo?Q0mj;ly#MCx3tj0vPv#<;RODjcpxa%Hh^wtPx+x>qIZL^>7r1NWAZ?%ih&Wd~4wq#weJey9yyavEFbCe}XbJTL0c7WeOo@pU|; z)+_+|gF0hjhI6>r$Jjq@<=77l#&}rfQ-gB#L9~=_zE>9yvrPimuW3#IufcbmpUMWf z;!ZV-MOCa>tKha`Z3fhBZCfyv=D%s_2HS>f)~NaN>X~gifQbL;Up33N0$AcXOO@=^ zkmVUawoMfK+E>Ck5Rqd&zyIQO#v9*ntKXE5y3zou)= z#cYV`n={(n3!O$(QRw+bnE)NNSt~-BJO%hjYbm#IGlD>6T2f|P8Sd}hZI_!oByj#zi>@5StAr@9eintTV zqiJCA0fIyDR0tuJD}w|%#6p&*04xhIr`ClTs%-*o=JHZZD$%bpQKc+gV1KqYg8x6l5FXU|^Z&h!J;lY0FA z2MD&_;JYV(#Lngl0|e7|?&E_Weu}nmj5U66UFCylpf$jKMd2|Xj}Qc>exN>}gZJ_A z9+sBg;^N{MKCcfwz5Og~etL3_y`5D&fBGd>mfpbQxrWCVLTfOLSR%z?Vgz8FpI_kP zk3YtpsR>+OoN^f8Z@&09Y#$uq+S7`wLJ8TcECzcAaBE}~pM3N&hdGXn3^TyP=i-|( zZir3fB^q5T%EcVSj>nYK!xHWnUqa$O?>LOjO z`MK9vU0uY=`XIb7xnEZ|L{Un4`q7#$tK*yt#Bwzn}mJB#C!V-C-vJ_&{>1TDq$ z;q3GjtINxnonOSAnTNPD^8n!(F^^&luF$-_NMA4rNFiR#Sge+Dw7N}9hTB=UX>4p9=jkhKZtmda ztJfU*NbEVaekkmZgzG6BkeEuPQh|ZBn`;8rya)sYJ5cEg(Oe>+hQO*I6ptf+4%*|PR|eshA=)x;MIM6^25hiU7E+U7q9X3d&&~Hg?ML@nMwpkjf_x8 z===EK@ngLI@DZLq{T44@yui-Z7K2FsfS-YP1Ia zH+-QmuX|>GGFwWpuQ>Cl23#>PC2bx9_fn{zAbhfde6gT`SmOL-+IT}+LECKA1rZw` zd1=J}mfT}_ok-m&1Hj@ezA~(k!`YSH7SEDXEPOB-6JuQ7=mapuOcpjinQ?iq+9v>x>D0ALxc7g1Nk1CZx$6~f8W%4A^4iRS27 zy1CbGUaaz#^xrpmGHSvxwtDYc&*@&H+ox+f+`W$G0ieFeTfb#05X{;zV+gf6yEmQP zB!@#zZM}5hs!pwIM%n4x`YmeB`O5UI%u9V+N7Ud34J%|WJ|n(ZE;{pI?ViT1@ziPj zgku#OOkKD0tWl$M5 z%&8a6hScjWH!FIh0r}4FJL#@DkF{d?C}81lhkf`@lYW^pTnM={fF)gJBYn4I3JF@j z_@DW=2|Ds?Vg zyL8M|CM5>2Dpiq5&JJKnVS0JTY64j5a?3Ik`&Xa{S0-4F}w21OmflHoIa<1fPnc|X@Cl?hN~8jE#T;A8-aii?a>61sXq8a5wx`U_`4KJ zMhvV(JcjR{e2teco@0Jt0jKE!UGBiCGm1TK692jkCz0g1pr5yPxA|Nn45o#t1HU>)`E%KlNcEqMQ=|EM~6Fj z`SKaIHdnE^yN`6Xh)ll3p@hUhdT{R^Goy$#H9I$p=g*%BojadT>K6rBT${j+d7SGeZfdLNNq)c%n;!U6x0TsklqHKl-`@5`zH8{|RyLawl zgaq~b2hb7g;C>@E7YXYVh(^E->5qx*hY<#mNN}FON78p9aFGBD0*L7O?cHq#&q-jMVd{kYwK88T7sY1X>lYu z^eu?BwKdkRB5_Lyhp)cI?*1`O&(qA3Bb_J$%I@F0i=Y4Wr?@jc zgl~^~fGCAi_Vsk* ztTWV(98hA=Nv8M0Xz&T|Ef2M;VM$eZuS| z30(2D4B2XVX(Jd`l4T{qEMX-)%);Wn6S3X~16J&hR{cg{$4sqAwu2tYN|LsYnXoc} zMMbi($QBDAON8+m2}Tq%O9DyeuA&iHR9L#S&$(l{+2PlDRJr2F&c z+iokWzHMv95Zl}2{3RzEvgm!8HKp#{Z=xP@M|2+h+B!9B-}SYr10GG($i)L2 z7qxAWf8zd0CpMgxK~CGlbw&)m^>@Qw{9goMQMM(o5OCK4EcIRER@uR#SpY|k4P*+< zN-ZS0nHpdyH%QmMQ0}4vRm?dkB0&V_M>x&$W?CLFbZe(Gy?CCe^yKuOyqV_EK>~Xy zO}zxLgkvslro}-+gx!fgFn1l*Uh8a>d$M)eNGwbJP91Ip>q>x$Qe#YsxT^~t3uvhW zit=44y01iijYAQK4BoJgNtpl-#WJI?K>}|)9%i|ygOspq5=`XKQHGI>scW);X{#rcnd#Y$_DWlz2!Qtj2w$`^X zIX=N)O)MP7#rXlg{pNSTO##EhW9aD{K~L{6*4B4fj68FdhTrGI=-4Rw`iIcf-N#u2 zg)i-47RdJY7Phxnv9Ym&mX->J2M3Yr>PBZGiSM2~#aCbd7H8)N$mP=rh60Gilj!ap zgwNm3!vCWqqqsdjA+o~dv-td<|0}-#{wZga%N5F;1+Y-QMx|I{ZLhXKfJL^6G4=4# z``J1uD~ax&6#PCfHr7_r>h)m!_5^O=WmePa#U(PAX(W@K z48+hk4)=FaEaWgU)Q|Vydyhe^sfkI}-Xh?Km^xQi85|uQG9#z0jo4QrdmVv71ila; zLx2+l4g_NPd@Np1A#2S3qU?C#FavNT#9l!QS_5r3I61@m#s;2z^EGRvk@&27g2-H6VD`;xynHi@ zT(N>&v5ZWX1mY|F`{}9M_~eH_L@L>dNP8PzJb#Y)xi<_Dmdgd!t*chc%v_^y7m7sz z^ilS|wl)rzC4g0g4Hgh;3!@{R;7~x~7L`g>X0ENTucKTp^0;;;V73`_Z4FZ(tC62M5@uqyRg+65tJU zooG)f<{f07*naRAG)}g9#+_2LtHo zNikb78f|CLFjpwBwpb>UV=$<#tsR}6Nu+xE(b?0FWKTcZA~Cdu#2Tgb&a6^HS4kLY z1zHi!MxG{EW2V7ov{k1@#Ml<95!9d*rndN%;e zKEoVuu4^We{yF|{vcF;ryvP1z2YBePArrExoCPd4Z)-3*!b zM5}}SyRs*YCu#=Fp{?~6p1r)9p4NbdCXJauNu1x1UW;xw?I#u^#Mw;key66jn#$s9uroQ=KNH>%dqTE%vRztexJe4*jII8vR$& z!%)tZ0Wc}gqsi{33Od$aD@XmOGpy#+$2ApIss~NgN?%^4ZGQLpq)m5sU&3v@8*C&6 zf|wdqRM_7Q`|$Tu0hxW!D>Oe814|F}Gd2(LA=81h8X_@{=B=|D7y7z#TSqFn|! zV(Lj5S4k{|Ax6%;@zs0A*hvIPqV)$m-9lI{ zz*Vid<@}Tt0#Z6%3bYcp`9l9oXsu9vy{!46Zl0~ID5E*-hzo&XVx2JqOMyXB--=mS ze4|cn0{=I)k=seyDC#gI$4S4Gq3{~cyePv24X}ypNZAeL7- z3?R`#k;3Kz!8Z7ag+*b7l^c}GC2VZ2VtsuTSD8zGW@>U8{r!Wiue7oM z!STfvs-9MO0`2JT?MEUOg}=pvg|~0;&!7J@hh&kCQmfy`+2DqUhZ)44ot?+kWe%ZW z7!Mvk#;2ctg3YZB?C$Sie0&VU1O14G+Yo6BGN7=3bjq4ixk8C`l_+eBwDh{Vk_fj2 zSlf#-?~xdJf8PN5di(g$O8rmzVH9R}$zWUyqS1(87x@LyNC$1wP$Kbp2GJ#mMdL~= z90HP9(3}OkDJx%rK|^04gu|0FtgWx(yQk0a{fqCJ)fJCM7|0tS@%E7sx8tQi2X!NA`V?6Hk!}JZJ;&U5$`~EcQ%DV=#x-Xcb-*$`uaHqb!G{Jr)VKaW=>7d6>%;SeTx`Mgnx`XQfgF zS65jUuBXhM1Y&h26BrpDVF0UCEMtR0P%qP*!LhTelR*s%&sV+n9Kx;9A&id> z;npn@dkFHt+?J|>Lu<$CAWp*5~;Yiz!04!o*b@vS-8mBcHWogcUV` zd#VSC;S=ae^Td3B(>H?Yy#gI)Eh|BRyoAcP;763+zS$L^7<~U;`5i zi#4(2-c%JfoBpl#Ba=*Fx&eZ8tl4#SS))SvDLhaMArzs2l7+>ggTe+Y083{!tIUN) zc0^;3GzHyNXrW?Vsmmo5QmEeLy+cU@SiG1T{*~p5%-qT)V_)|#)cM@#ck78+c?V21 zkTL`6)4UH!_ONn3oTN*XOKk2@+Ww_3wk;y=7DvqLmDxE37Khc%_pWj5Tuv5_rz`DQ z^`G)@(_M1*W!;Yg^=?x2vg)3Ij7`|_>osk$x1(O!4ku&#iKVXlZf&_6;G#dJJNn9z zRi9{lhwsqSwSKL1EQNdN_CI67%UfY})G%~BG+(yf_!{206Pd5326ZN`OI4el(yAWL zV_;ufbq7_mnDtw3mdcjZxx3{QGuM#Ia~Aerll7~=Ak00eiREQ2%HD1{JM2GpMHuP9 zTGYy{hFOsP%w+qGF}=j5px08(*gAb>TX@FWa~#%Mu7SPe#_K>|4axzKrP#)x*|H4V z;ApdLHPpUQV@qTQ3Ln7yy4%#y%}PxV*Sys1I&l~)qbyTAz0vHiv7ydgY-y*qsOu3j zjmHdTi-L+QAzPM>u~Bv9)^8d}#q=<2uzeAz65ny%)-XuehTDNsz0h}^g-+x5-=GYw zSmkV+17UWCr8{hs!1x`T9jg$(2;=kM?}mK%zo$(A%VY!zpo_s0w!Ar%Yhaq+sjjtugNjt#s!HC%a5{#02oXA2b#Pdaet9QlU zDy&cdUnXly?V+mgI2?pB4$@6Ni+)qsnY_)HVVFt`SoID2H?myS%`?&rJn>R1omqpyj#<-*pxJoe9K3 z0UYjb;c$POftpApz#)Yc-n6r|!|bQSqZ7_FcX^dXBpS#2k3YoU{@s5-Pwyat!64_) zEENk_rtq@ORh*n0FvH`)y%_|20Qo=$zdq!%89e>=3BG;y9j<9_@RBrDD}zZsUl3iX zUJMTnFBK7N3$gAMfjd+e zVyrDKEhCpJA{>rka`FxyJh+doEfPK7#=t-yMh5$FYit%NLR%;V z&&>_DapvwFbay3iT`3_HBps?KqR}|Q(HLh>%;mD&hFmVg05btmBs70{b;aWHDr2V5 zQKB$PmBo$3%)|s0p@kwl8_gtQV=<$W`aPRtX4uZ|9(MN+Sc59y_pvq_v787PX%9!x z8Vq1%bq(|L3k>$qobKuEWkwpUS7L$*G50Dnb2uE%>tpeF(qp2rBH(RkaDdAvd$O>& zgr(&**2n7a>Bdk0{LdNqqdB*+v5vR1Z+Q-Mb@!mf=Vw5jz@(F-BV>qWMQkt13V43T z-yR+uK!0Bki|bSH7llv~;B|O(%uK4QY?cMxBe5vros@AhqKS!mSmb-;>;EHeVB(ii94hJk@WluH#Be?L7rL-o3hd-rA#>xkm`N7&xkhdm&oBX1KiCkE~9aM~2voPNQGr*Av8676MD||6;!@cc3__tzD`s__?X zUT!l^FL#9PbZ4oDa*kXoXZvwI7gjkPwIw-xznQw*3v&8+J?f6-eH(zKMy{r^wvV{f z)9J@`-Fxkq)&r-@TkIWazE!;;bcCI)X<>OxV6}RaB=}S z8qERY_m<8Rex~EQ4q<-w@pWWlh`wr69mCPJJZS3!r*V?cH&=fBNpI;{TQ@t8hEs*= z%~Ut-rFyk@2I{!0wb$$0MWVa>fr zqaD2HMFZ{as6PhMCK%?h_Gz7jV=vp-)9S5xhwAfJ+ea#okAxl zj6#Nh8RE7|gqvrRri-Ndhf|b0crpZT$X?{O$*gk%JiIZoHz~G~IrdVl))*sEw!~N{ z7KBSx&arWxu(iu5Pxc5iu;i_`(i{;iEDF&OK#vkYSBDEjH%kwBu-zh?3?v0~IrN7H z-Ut9o4<)=2S+8W8cClw$7KGWkHXuxai=uh9 zmM0;20+EVUjNQ78k3am7^^AJEllZUy^iTNwi!U&@vWk<7G&5mZ(89V-g)C)$%i{e< z?_-iO1zug@rdmZuM+D)v5HnS#rtjkM;~#LS7iE~s%S>(byH5rkK$aY;9#B@Tbq8F;nI& zokmAzCz6Q-{|N;GoTZL{nM&oF!?U81FlXYssg_w}ysI;YndwO$mxZNeZ0#N}Xp!vh zV=-?6W=NR(!TozkCF3aNv+%auAQ%WS0NCOSAboL#%+&=dRTAO`!eIjH0u0W+c{__I zPoCf^bA>{oz-%bR$RZ$wfG=WX5%5NU2xrqH<_zn2`B5yF8JubHwW2)|L$ED^KwFsm zme$t6{vHEE#ZnOi1N{upm5L>to?qarufN6o;u81g@bDmy7qRDFeE*z*PYVAe;eBFW zy?FTwhsVdvEE^sgz^$2o>fHhj9YisLRUR-1$bILYY$mbcvB2ePJNB3~|?le+eNd~YsHa0k%FO#7V z!ZK$XY^ThT;dTUqeim{kz=m|eI-)VeI^sMo?HpaVji2Ih##ba|P< z*?F4hKrqmXhY#-~6!NpK+up%3&eK^$IuhvXPU5qVKES={+c?KFP`1VU1nHZACQN1PddEZ|-#^ZKT6(aw$-Yl0ELdUAA#lao`CK{1!(@eQ>FS)Z%F zzZZS|{VYmP;1;p%NaUYbdK5Mp?MR@fcYpz`&aNJGbR-zaWQ$Ch2c-re**=;ptUpLh zFs}(<(d7c!XX7GAY5ECcDFG3aaVoBXG{0VgS8~^qtW^hpSYGmwtyURhm7V6x71qO& zc3ZNr#GWQBwF;$E)Oev0X@(2ZUPjNUpBYRjnWa|gRq@3Qfmo8IB|_0NU+yT7%P2>M7D|8Q#sGa3TTGV;FfYs4KahXazGnE=rsFLkF5O3S2C%F?i?cIj z`pzb^!tI2tF8*lpC?@$k0$92;s!kRSy*%>)!$EJxA-1`-?|8Cya_wA;(40?EGq)$* zey%MN`+8{_yi$E)p~zVKu9X-8P>)71@F za5~d95q9W2LbVf7k_74>+-=>|nBgbCQ-cP$z1f6;v6ba~)U_SDjpgC+bG<9{Icgjp zw6&$57#zmUc@{a%b+b%pZ2K`bLG-haN<4+2?_(zopOAbJjjLH@sRy z=WgGvA8dXrsRLj+u*USS)J)mBw%frrI?Ypi|JavD^9{4mc2vEU&XH+i>b1z)Abp$D zSEn(z^tItShcts^=yNrkaJHVUb$^`ax9RwrCiC4!&3IZ>Tk8a4O6y~02!e|m{rjO- z2C#(ohX9XE5K9W%8sfKB084MQ9nYiwXD6BdPpw`4q$q=#M4I1EzY^f34q#cCU0jR; zK)8Iman=Z3;sIj^*Bxw?#$4!&h|mnB4@HL@5k?_zqcx2!6$+tl1uP+O+#EBkQD^&E zCWHc>WXPbYF-BtLGG)8Lz*29@IVbyy+al3AYN7fgw1u_IR3rmV3@mD=x?QKg8Ke`> z2{x4o2^0q$aoExSr+_I_B17t1$+;i^Nu`$}^wtQ}k|S&$FtoOl_72T0I?SkbF1~55 z7sdACU6jRI1h_^TZ86_9x+8wHp@`MFS2#O6mYPW+MB4q>-dMuI>`N4~X`Ek`v3qoZ zi%bQrfiUjgeTbj`;#ZiQyvt0dd?CZ^9|9Eic6V4jysx(h_h+V&&t712Z3*iu3s~OR zMy6Onu?hhOwFVLJhcG!YjgLNj41dcFO8G1Nmw)<4{LAnEh@In86mC37_4J~Z*gIEO zxF(&ZN)`9--N*R&xDYFE0g{O*>t1DZd31L6Vqj!+u(-Mgk56cG_4V|ywitzbQ5Yj-d7}`xlcNLHI*LZx&>jkKSYRw1V$u1N zvvXt$WfrPW^$%irV30v9DvJQIwm>VcD+Ty{1g5m3QuUx%x2F4S@VkK8*8_*rcsqOxd?nB9WWAGC-xlyK7l|0ZS7%1 zqfw!=6>Mig??79WK^FpPL?*o>1_22)xivP5WG6Ah;#gYU!20G6&Mrg-#j(*5t~-Si z65ET)r@x8OvbD3r{WLNz7lnO<7Dbr&hz=HAw z=EdWk=>`8mjR(E`Ll_?!#KSwcG18yH=K2~IS2yu?VFd@r=g7#EVE4S`oA zp5MZmc!dd*ELgeS@Q$L8Bg07Qha9qvW+D%1(kxOm63H?z>*NIwhY-rpK?A^&;8jU# zGYS@&ybzM067R2?8_U&`>|thHQKnhBXIMfI8UB=Ego|+_KsAWi0?5qmwUCFRR z6@I7zO%mJVE)thOLOYW87S&&JZ&v#ThmLF8wF>cLyDv67%SF5j;nUC9j$WCA`y^pU zxi{&%joN+WhH4}gQ5hf29ntQEDlJiNLVX5S6CSZsOPpRad>ig2Svw^%Y1_eV|E!Mz z)vu%RrG`z>PnQiJ)@oSK!EUA;?R~v#EECMyA@(oYU(=tq*1+Ycs@VhGGzfEIbLyOi z%6LfrhfA|vxknBfD)u7HgOGVVvam2@y=q27I_^fbtt;1d_BZE1{W<3r>S=b4pk+3H z_;NZrIcdC^BVr#Z`=ZedgtF>2W2t{t)wNEYwa1&E+3w}lU~$b9DmOH97Bu^k4d~IC zGA^1{#{9R#6jko51g^qYjm}>AW+R=b?zlDF3y;l z(bg73ptS|NTdP=En#K9)Ar8-SIKL{P>ItE{kMyR-F*P-ViHT`UOpGI)K4X^B($YLm zj!zJaMHzUR7$3t``h>x&ovl@D>>S|iDu-;TicmO)L_CS!?mkRUP2fg5C}(cYy38Y2Y_5ynLT z*4x=R4y82}`w>rcFtC}=mvNEKz(ZpHejf_uB1)B#2>F#n z>{hRjnPVjMPGxeY#jX^FhK4zOa$|Fo^`uBgifkCMe<%d^{34CJq}eq%fXg%q((iF- zX`xg>s6C9^6VrHbcM5%}1fp$z7WLoU*~igYnl;h(_79oKM{|fkC(`Abn4CbeGl_Ki z0_SI^I6XaP;3yVp$LP=?hWh(?JW9mQx+bkI3MDMy=mo* zGCWcD>&1E0y!g<)QUwS}H`)qdNyk#S9Ok}g(X5i?)@;9$$!*rdu23oUHl;=!&=XoafVC!z|`wmnIIhvwooePl5LZ57eD;jA0NT$lg=AOJ~3K~xyuRe)WI{1YZHryF#hzlh-l zjyU&vhuE;jbmovdot&v17<)Ro(ET8~KW*Ag2B?2c^bgF?SDOy_M)TEf{ejN%C+c%y z3t8KPON0fxbTYwp-dQojR)m1Fo5Sug%qRcg58rJXHn=e$J-5oJvD0K~MC^3VObql- zSa;R$TJCVhXw_ZseTTEJf_FwJ8{EPh_k1e>EExdew7hxmq=LDTT!ko3LtWZ znz`k+hZM(!Tz@BSFpMs!Z5cU$XmiEf?kg7>BOBkQSPRy*#4bouDn&k3`=X#;4{nG&qc&L@!oWuHpXu zJ17>iNT-u{@%*WPak1xi&|YJ6iQXxx%&V&Z{60BAwV$6!WI;yEqlkJ>UqAW>hp@182^SZa zgfSHBRBn*$Kk8ah)SY98(fN*!QUd5Psw0KZ8F^5~?P*n5N1uQ8OMLL*M|i%rj!##=kW8U`!T<*C z(tjhPBQn=0eE#g&Q;8hOsETCYks&laJtJdbXJ;4d8yk51^qGub0x;Bw>h0;p-X6ij zjELS(OiZA&s}p;Bd-&)Vzd*i_7f|}u2e074{d*Yf@5kBcsYD~(-Q5x4eXb8(T^+(k zBA`T9NP=Teo;<~qC(rQY=`&Qynter)bBg81x+I_4X;qkx%B`|n+$3|^0*;PT5|OZW zT9Z2Vc6TdAT2~i_hK27nT5^^nHUS1K`N8^e|%`3X?QPYe7CfA6&ckg0$b`H;; zGfL;0Xml|eWsvfB-WHg(U{peT^ zdcU%JfMy!mOIHJEiB6OTeZ;k$;FY;x@xpydOw^nPF%&MH!_TD!$fo*)?6X-;4d zqf=#pGtD~oT>n(w#)VMr9c1zo>|@%t2)m?JcO?d#GVbo)8Nlmd^)IjgB?{q5w6IRp z$u7dA3_pcf+oIuH=3VEkXl#=D_nICk%qz_vbOyicx#v4AI96HH8q`lFA3wZVaU#+W ze=XRpt}*2OJNRzX1E{2zJL%YC9sIDWuwCcVJ?eu07vaYvVW~D?AZB<71|4miA z)NbUBqCk`R|7@*2qsr%&tLgN7i3jT8y9hwftkq5DZlIoKvwfK|`4-3enw#EN^T3@! zjWRJ0s<)f9r+Y{ZOEuD!$61o?C=Fws>9O+?&7!aAB0MSWCfi`HshuWTU(PLXRKX(V ztL+nMTwR91v#o3kK{l9I+K75JNYrd^-o|g%OZVXHq6Q(A)`|GCaTuqzRCazi`&Go0 zum8BUwITSFzv|AnX3qJCd<#RZ`8sWkDrONBm$gIC0krwqf4h*t|FD{{bbb@%u3hV4 z@tKwYEN3mTfRCQZ78D6e02%i6QmWx_gpH}+U6aylvaz1Q6}}(`XzMJ6DF2`LZ)0YGISVqRSV@>V<;Q^PU%{? zD)M&8(9sWtZKhcYa^TQ9S>hTf0>vJfXIv3g9hD2Ax~Z?(yd{jih)XL0dBfJCkh0`+ zdWJ+ij*$c~(bs{VwlX%Keui8&E!s)7+6i*mW9;s1VS9^=k_-wbZ5SS($I$p3M#iS) z;9V}3u(G^@*IvDka;1QLHYMWZnM@8tgCiIloxs%O7*a=jc>d&}u(=*STSK;Vg7dBf zE?-^6wdGY@TfL6qfgyBuwBeiI{D1L({l$O6qeq`%@9+>8uUr)-(%|rjxXEp9?O<{7 zGVb2FjVqTg)y^XHH8{`>D?dv^o-$u!W}jZzKb*4E$MjoisRLZDTYvLBz*Eb;So>HlZqvRoujt+z!MUa9*+XNu!@P&&cv`~oJYCXwjwMzLIyNR_2RL12X5o^An~u3Wl|h531OClc5> zIKS<_>Eut zGTwacRU94cV|RZao7=kr5R8wHOFL5#UfNKiD0T|dh*1k4KY4~1YnxJ^{@z~DIS^+x zaj)y`@59dSj=10v#OWUx60q$sc_d&PfhVp*WQ_Iq^@`S7Pj^E8CKySVykshcd@hHT zl@%;rxPac?K3NA3l1JFy*~8}6rU>Tu_4Nw~I5sgUT3=6}J{J*px?GZR_Tb)KeBqS` z*j!)3*5*16_Vz%g=i@8Bk=GvEBJ^ve$OD zwxsQ6=jJdmH6^0-1a5QrJdTczMH7p47#ST!|3JS6<2t1dlao`zDjXgf5im6tOQ16r zM|%f>D~id}^*4@q7Xy}bqLbhi-3B|=rGYSv?Y^QfzGO|8#WUpQUVUy?cOzu0fe=e_ z&=K$q6H8ID$ez-yD!oT>Y>>UAfUE$3MSUu9$0JCk>|;+rU0>Yj&&>PAy|PYd-FKnm zMI;o^%dobzE|$19YH&^IB)Liuzm!#} z#N1W8*HKL*f3wHvLg^q549296--e~E*lO0?vT_I!CkGQLSN27-M~1@@HqC|rmaddP zyJkjZxaI6IT$-EfZVtxSjAMWSZa$2Ds8=UmsL-w1n@n-84d_HH8XOV(tov^85g$`jed(6TySY?}gtn&9n+TNAM56M)6kG=aH>S?IZj*D$ z?ByS*2q%Jnd9{FfE8Wvz2rZf`E*mwahoy{fecNm_JPZ(|^P;(}*1kaRnnDqqn(vpau%Ws1tNj9D+ubl@Di_Odo!)#K~03EiNUYF&@-M414z>4Ojup({VYqp&M z8wEEp{bZWo6|i?SP|Ub80G2DOpl-D_!^~)82~&VPF@jnOfa7lkjCs2Nfj$FZ^&}D) z=?2F8I?&rz!QRFbBB*{+tzqTbHH=M+qrymT#S`QTCDGlYOBPM)leys*^(2+68n&cbP8o> za~bR(>|%RoLtG5^k{Q&{iSlV1^2G`!M@I1FFTR0mSFegj6+s08iRy@WinG%iPAWyw zd*YmkCAyL5=@YgOqXHfr9AJBE3%P6tLqh}T>+2Puhi+X2Jw``I#a)a53w6HYv4jYQ zcXY;7RJ)@?VZK#L1tnlVFeD%uSwv(h5u7_etD<&N7FV@TKYxUWPo82wnUZI2+`NUh zj!tZ>uVZg#8;ARQ7#kT9-J`2lR|L=@(rB+)!C_l zG!Gv=!iyIh66vp0I+3-I0{Hy7d~p%eGczcbDB7-~9}1|@)+T*V;En(d`$4qA=!RFV zis(CC0b_{-D%DfuiUk33$zkVrJ#lPw6mzq)QdfFlK7904060cR zoS7WQ?VHze>pFqlRebu%CwTPeAyTQ70C88Bmr*`B5tq(q&z=httD8|I<6Qz^QrnHL zdjc2^4oF**v9`OtgTsRZEM8c^#MC4@ySmWcsaSjEa#h%4Me22(oJc#2jE#ui62GTQ z;KcZ(09bS%932}M@p=l>(|wTRk7H5X4`U2i!pM~n@T#MO0G2rE+Vh>+Jh&d2|J(o- zvL5SORAKJehrDB%?-EsmSVqH8t%)vxr2r~%-8$l z{t{A^-4(u9HkozqGaEQ(fN|Nk3@k4IjI^=dj)mzh&wCrc*sBhUS(!hc>tE2&QjBip zD({odag8;TpR=d7-Tou(LRe?IMVb0xW_Z})#5oRV3UsJ-7?zD&Ks!Ji9X%S_ogrV= zo3KG)D9ItZrz71-Uop-dgB4;2Wf*UkQJrz8M;fVc%g$B^v}R z8tQVHq(dfrc?oAb09KrQ|kGNtz9h4Ew=`+XzWYaa=8gtIwHon7vtXru=IN9>pI8qHF@)v-5A8) zzU~(Yw!oDzsno({+Q@U~^G2_$&Eg?Unti4(rKRopV>(&urKnUmE>t*q6EfX($1v}j z@~Zar0z4>vDpf+!L>Oi5IR82%XMwpCdW%YD- zW3;CoqdjftZ9l=$?iz~uEMi^l;!d}N9Y?Ez~JyC<`*wxaAXqID&&Am z=G55eI0grLkjow+ojSnQ)*6b%6U@&qVsvyu4%U0S8+iQi6Rf>>jA!fHNasuFNc7>g z*T0B6H*ew6;v%-z*YSh5e~9-#cpo4A;vFEj5nPVi=Ipj)Jl&WWlCwehIGmTg8-NXF!4ElQMf^{lU-bB#4vmLeS ziTqF_iery`qg?jLkUEn{eH)vb$fS=2z#_}1yE`E)EcPu0(&?T>kb(1^+D_C~A{&I- zQK_ROPN~s^Gl^{2-PD^ZS6Vo`K%Jb@94tT?g6&<4ly%(0aH`d@fwh_ zGI}9FJl3D>P$^gN;`s}tkB^0^x3IW~(eZKY?d{|J4}ONd{e7gfS*)zAik{h7t%l^` zfqZvxcqri7^&2Su`c}h-FNVOZ4Fb?Gq|$6j0X?yqdOK8Fi6D7t5pG| zC|piGs-4{f5opili>Q=}DCDvz=CYWdoyOGEq-bYxg3#SBmCncyBmVXG^+~-5jvghG z!m{G{qOKcV0V&+h1%@Ci!9~`U3^@UiJGw-?eRuBwkDojdcf5(oN#qL!9H+Bb-`Emi zcedx{#S3`t!Cfp}n8Wn+G(P_LV*$Mig#zMt$55cR?e)%~*`Q%gd_V%N>_~0aZCV$8c1%S#om1zZyZ#L{3C-Tl;Fq*+)Ruu*%T0-gkj zvTP{DhBf<`bwkvyf(qbrwX3`!CIWQfzYeQR!#382ms3agAQi^I@)>${ z#q%OCc_4-=fH`x8gI7)gtdD}1Q&=lBI>R}uaOgkXE)6|=nhYb(h~6R}HaHsfS;SR* z)1loYO<(`{ddNBGx{F`y>G_K0ycXEDUIKLUSJqz={g>1JHlL6pH?Kv5CmQu_pcwji zqzmqjnEG|i9UDz%Z_{44wCuVkH7$dmw+M1I&&*?9w)AY^A+I^>Z%*uYb#3mgKmM=W zb*a%!On4!}ySDjg3D(=UoCaj=%(J0+IjkQqO9Zbr}97TY*-?nS-tHGY(dV~ldOFDO*N>^%0nHsD_@cH`e(?^X5F zdkvW{;#T3%=#9Nuzpw?+KVv>=;4r8KB6(O%DP2Dk8ByNVOs9bEr~%PJ0W8C`aw9eQ z04!ygn@EImP|)sz=5XK>(luHjTHk}@F$-Yv2G;>w{ClT1Zf$fvbEE5RJ2b3KQlmTyu7E8`S$>IVuXfv0z=u0S)xm%V9)lRE!;J!!oWWul zT0VU>6F}TBz9jK;sf#&q2q@LA@-QOrF4$#m;Dvo<04&osriC?lMWC#&rw3zwofwRr zqr0tw{LwB-#jHf}OC|RNBzXE_4NsoGK)+}UP2j@9MfCLzB9+QwW@a8=eB&)lj8CJd zrwf_m1925R*xy05c8-OGix?Of5pZRDdks$>{}RcA9qb>aad4DHdshN)efcZ6dF>h| z$42qfAO8q{_V4~3*0;8h%A_$hJByjANsNsQOAqYs?g|s+*6q8PpI;EYAx3$lCJ}|K z2l@wuEyMp#Yc(snkf59-vE~dXH==YEY3$MG%WU$al%|DV0jnH*^7G z1VOT;sEt*vRwQp8{>gSzkrLa*g^geuSyy}~Mi)hDFXeLLR!G-Ff(8`L<_{S*3V+~w zqjdJ@N-8eP9qsu1;b(aA?6H7fj3&5x?IwEq29V9<@ZryXhPU7TA#UBgDFDsf?3{pJ zpM3la?C$MoAWpH`7!~i}D2?H<35<`92rG%YO9b!~z^nm*vvYj>@uzt9Y)wGB*_kQ4 z`pN^0jg3nG{QToj@eeHizHBsw}uDukK zHv;a3QW?ckS->$yBRn`f5-^GSRM(d;#V5$ImG=&weHAje#rTogFf-31*VvmrkVw6eB}!|KLy}H8Kxj#|m4PV9c4g zFft+|S!V=Q3C0niBKSLZVL{v&31m?di&|?0_^6@BANG@qwoBJ|6M0tySlYm8lW46P zEzqatd zrO!*@N1JfG!M^~RH`S*;ww%w!&?%*xcd+orKz9!ozGW|XP;I4OTbL*Mkl+?4a%{Dd zrCa6}vbXC}$k_9L*K+3mmi3iE_mz3V9U8tBCv44$8g1d_`V~uS$9yaA`({Sqg+?>V zSCdxz$YH0{ZN|QF+5o@`G+{LFBx+W=OQ`P4IyP0HLM|hql?CI!Hakn_X-j4P5h!MT zHv~7!h#4Auv4y>$Tnosx&`+%lSJe?-V%|72eG~+$RI2rCUuDF9V<~}ubB$Uf z9w;V}@_49JovtUR21M$5GCbV1xn)*1q@OKn+{(;)VDeU3u^wu(cALyZN%YbCjmWy* zON<7Vimc~>PE1opTT&vmJ{>F_^+|n3&5u(ZNl8bFGGWX0Z`F_<2p8Nt#mqL^RVJF1 z7}nk#P${VPR}3tDyDVK0P=yPQP2=*X+sZ`qlgFfsJdt$CrJYP4v%Z?LdxsBdhA7ut zbI37+MMnnIi~*OS;5vf3Ae(CkiY^ubEPHrz_F^Lxui0EK147zU7gzuW9)?a&C3@UM ze+<1HHN?-#C}s{&DQ0ngTEW3S*;mi-Vsjg7+q;;Up2f^G-MnU{;-7r-8OFw@@$0|- z+gMt>ipj|lWYY&YPVM0+xrfu!HY_Y&MsLpm%9Rqfww~kZlh2XOB$3INahxfjE8dGY z-}*8xF3bU^Rs7(4-@zaM>7OB)&Y%il>C$Ck$8pGi@E>+AOJ~3K~!HDEp2VoDpMdD|KsyySyieh;?73q6*Y)>cxF1( zB;yF9V7H0*re=iJXrmTfM<+Vkm^R%dJH@Swu8_OCTgVr(IH{haGv0%aj)aV90x!>= zJrh^I%aAiDi%cm zovxZEr6NwsC8UyvI60}{=1oSBoD=P=7wg-2_r0H@Bi4<{@i75bhX?xPSw>1EKr=cv zhKoxVC7L1uEUq_abeBULa)lxuKYogGxs1ul3H0~%BbMmFKJ~EnsN1!N{euJKizRW# zTbQ52t<@`d_0COHOIhq69*K)=xmuHmh7{K)Se?zJvAes6XHTEw@uMdg=pRJ?Acfbv z(LtTHN`)eL=xlF8cf3nn3@JFza`cgv*U>3r@}+WFw7bYeDwR*oOJ>7G>V`_mOcIvtsSMoDm+X(I1pGM=2B9HB7c4wHGOG zLFdNKh<(e)dQCMK4%%+6x5xF)=D1#a`-E~A7ac4Cg0x0s)dR6at5NTFbiNjSL$0kl zIER2(TDwXBDgm@K1IxI>>x&F;A2e?28pJv`?u%+KRN$2cunaJ!gKrquK>~To{ZX-& z6%eK_LX3u$i{$AR^?CLLEhwKgXBoc=z*2W?zLStWji|Jp9oby!==~&kfobh6yXmM+ zRQ0K`rwl9D(c_XpExH^mp8!}U-&Rg?EgF}G-BM>5x_P{;T^ebK1`7VN=>`#7U!emA zouu8Mp#mM^J8$~zU(aNWJiA0#)vnHg{|4MS!G#tvAXZg(c&HzojSYL%Hu{9+JQ~Q{ z{Mo2qnjA9fs^fD{@v;tP)o8exw)1sa!vSk7JoAu~TV46X$4C^*PA$|{@++j-n@moZ zm7&XG3~OIv?p|OQ3V*%a@l{ul7V8;&FRcI6O!C^Wentd<#Gs$A&ZL!P%g))5aTbwm z-6~)|(3@*;6x7dyMzbfP)Dct194vi%ga_@{uSvdiqMX9~jiFwNZq25yWp(R`S&v%l zA={p2nX<);dfyX!Y`jjHWy(t@Y`F6J^;7co%eWi_y(6zWV zLZYdO3pm*}we~@9pY@qL-acR-(<90^F5FS(2Vg?ylhd*FriT}GE^_W^{=8ZXUv3-* z*G;!Qf@Lv(^LH>XhzDRP1Hjnh-&pF#zgg|Iu3TnV2)GiMi~jJ^&PwUl$+Bq-aAj^k zy?Tq*k-O^hM%-K2LYI33TnPh98?^=)W6E+EaF|m3Ooa|ttBDI<8I2GDtb_%jZjhC@ zyJAJ~Hd>{jHKg<*z>MVJp5YeSx-S~H3td~!`7QujIoemD4Cv6d(QRm5B=kHGtujU$ zB)dc%%*?Pe`X5Rx-C0TPMYoCO$hoXTC2F>uy9`4yDfKwh8x|HWiJKiGq-}06 z65Qt~6nKcP;iLxi^^f2Suf2|;{$6anc!nST{de#efB9F)7K%7)@5JJz%b1!NL*_Uo zQ6*<*rp0aW%`d(s!rv^*Pv3hFpMCnNMCF^9n!}xYuV8p&LfpudD6xu8N4Gl*uA>b# z9^gx50acEVQ{qNQ77GQ@(-}r0Jdq=mZuo%;VPe>lp0o z696TBoD%&lGJ+V@jnV4p2Fd@Zp+q-Df+l2DG2$JCu*t4sBtoSN%Sm!3AVM~mLx%{v z$I;!>E8^|BTu#K!OQnLii&2A&pn-8cRYKO91tmZ$8D<1s$&#VyJDFQ~oK!0~Os4UR zPd-B?R}>e^f&P9GjvpNz6L525eGS>nF@}eRkSpZy@X+6nV za%=N_)0s5RYgJ57j!T3~YM><&2>}Lc zbmgmZeAQ4nsS2Q!&Spd`os6tvAurD`LS!zJ5zVaC)vH)qqzm07p1s(>-+ueMsGhe8 z`-;N$ zi06Oy@G&+vHU&f)8=t_f8`p7T`4X;Oy@=h77x?Ap4-xO~MQ{HAX6NS7+uJQsCXF%U3ZqH7(35>XUNb2>VK} ziv~RR_BI`j&}gzt$^ZL5&hbzf4p zny#%=)RxNF7;EwyK4Amj|Ct3ktU(`Ae+LcGCWAF%%+scWtWh0ys~gp{zU~Y*lx==h z@i2Qm*lzk6_gG=pkH##ym*|V=^QU*i++awBz8=OF@U@vca2oZa|F*eqF4Xmd+kmcn zNZ`R%$EP#(#O7@Tjz)BMu!wei>B;YVt^O2PS3{r3pBlaO&$vUa!B~x)V<8J?SWeNs z7`zP#l+l@ostnPG*XVPtbMW(3#18~FJ{GrdXjUEXtaFV@98spohIT>1h)%2D0YZB; zxJLLNYW!_$Lqw;c%TtFP1;(yl8>zvf95NT9ra{ZoHsV41aozW(lg;f>Sc~{ysxPB+ z#}(BUb)PqCdH>jSqgOhmZ8&>^>y>Zq(PeSxmo+7=C1o80T3bEb}6+#C?7GeQQ1zBN|v6DkU! z0kFhvLmvhds1Ux4`&J&OOvV5LLH)jc&gDQU%-;hMd9X4q>h+t~#%@1&`52=~xuSTx zwt8B?JNeiHu=uBU>+iU~*!Fh@o<2Y*hL_4qvEV#0f5X1=U0}+=h~ml-6!s}nc*yOB$2Lvm~RN?`f zeMgrqy6X`bqAMTWr3g0d@9inAs?(~xLwCO3o&@5FE@7CE5ybbT4LiC}ELY|C#Yh!ED($%%DE zBrroDj4UdaU2k6{Os6lnxq2*4Bw^p@M9&g3eesdb;Bn z8y=K4V_6KSOomQZyc>ImDG_c@CXaAZ$|FI>&+Ig=U%!Us)m2gUlD+dBKjZv>?6@2BY-(EIfXahcwHEX zBZIwo{L4@9(+@tt*!U!-rl;jSGXD%HnoK6KwY@7YhGY)bPHX6jsr>26M^vR;DkD$# z$#fdCvon~Uo)Y#P-C7x$l0xi^#F@z#u(yAJM0cM=m>eBdKr5MExhw&!JWeWA0eJ|_ z#d~@rk|zPI+qduH;?gBy7&7{!T5I*~gki$!P0s_dlopdQI@DRjtisl3TQ6~b3()Qn zK3m@ylX~qF&`D`**=U5u4Ntr9NstkW^J_Ok6CqGoSHgVluS z#&8IL<-=3-#%Z!MNja<OTnJpNZp;ot(kFtgQ2D~pXn}=u0yN&Eizpgym7j?%2$T^HV@0k^SX_wfc-e4 zl*TX&Mo6^n9dwjXBclGl@HrrBM62V_P1MZtz*zi8jq{Mf?hY@Tc96Z{JBfLVlJ7te z(Z{U~EAJ`WiaJ_WShB688Q$CBBgmgeSU<|KBAS@t^ly|al(&SpIvE@yNW<~dU~Osy z#~CW0jPq7{vK}}y`%B$!Q0MZe7WKv@joMR!i@!JjycO4(W4`VS>>oZRT1Y>Hv~&Ib zqB4krv+GjTY5J0G$t6-xfRH^yl_|P4ZJB)yRPSC`-?9;D2FlQS7^zLr86N294$Q)2xj50cv z7M2lhRX~VxYcMJ3h(yNSLJQ$iQ-t~=UZ`@q@u;YH)&)XqUn%Vm&qz0J6H4e+mB+BH z{B8~IdT##hw3-o^wIG)Fong=fThm+NoJf7Tk4&AF{)c-*>lp~*QX&A}sRqw9AgIww zRX0ZU(h(Z#C>AovWsk8*HprtVNFL{rDOT~j|Lhz1(wkqz?)Dbm z|H)7ACx85>$mWW8@ZdH4(|`KU@vr{nH&Bvyk5DS+fc8#tv13uTceb#(`2y?f&ydOR zFnxlBh0Ee%xUjHxA+3BKY>9*YU2JZw3lKw5Z|V?H%zJ%f zT>uI8>)`=eE$hNkp-vS6nBJZ^=H{o-Pv%dpCO||clS3|7K(YEb0_-{t>WaS;&%; zsDyoeI4PeTPwlcOb!jO!VM{ZjbyqVH7{Qx>eDW=)&;eptvfouC5C3kjWMB zt#5x1PoKRIy`|y7egT;FcDF?c{qmJ7xN`L>`uh7N>L7tF0*|b(%%wJ^HAcaEGFQkt zB3PM9r-gx4s#Ii2NgW;G@bFN8sOj-h+_<)at8`PGokccZ5SA1H9L6e)i#qI7+23 zF)@j+|MqWTVr&GJVh$ht^v8JTop-Rfuq3XsY!|xqQLl`^64Tt-+ZUa#68GG z1h6P9Pv|gtaEOEb1MKbYl@NP)XN$f9+LiJ zFo8^#Agp3wiRieFBD=VB5m&D+GFp$?{f~^Rs$B3;bIk0ET1(4-X4+-YxZ%c*z{>T?N(nKAG zA`X={%P^XU|Mb(KWy4H*--*t5hzu4{Y?LO4J%FkV38jr2|zK>4R8$V%dL)}<(=C}X5um%ku$xT68dnog-4Bio{Nsk29 z9Cz`3S?I^j$=1dI9xY7N$Vc2cC*vi$Rs3l*0J-ehRJuzDzwtI&|7J9E@H< zb^DXEIMk(E_d$fNR7>;N0k8tkH+nt1uFkbb5cmppH4JQ0b<Apwt$$fQ z30)5BciYxhixvvQdF!-Ea0vN~pl}S=R~z53idg>D#{mFKGo#da<9A+Ex!+sr#viQq z2N+I<5oJPFtCA{!OS^ZOHC=29!vbaw&I)h4((O|RZ1Qog>Q@$}qM_M2%A$3)4X^#B z1jc? zzB&m5i!NXqkW}WRayRt36&m+M84mi0sDU!ql2ssva-CDSqywsHTZ1er0v$YvkN0&V zcA7_5EsyhZ2KjsjsiOm|uRq6UkDj4;0-UwQ@%7*R=XmwOeSG@y$9VT2-o}6aPyZSD zd>J=x+!g@qzyI%kA8n|jc2W`mj6mhY1;N&tqX}NthBmK=$9*SpPj?Cd;2(bQ zcX;&K&+*EGySRS)0hTUbN8jMMwDI2V4%S~h!;5E6@bvi__6`n(iF0_A6rhD}Q*@|+!>GJ%AJ zbxuL?E_B4=h;{eKZ?;1_P7&*9MJaaEUY6ku#6T~S-`GS?C&3lo)mSp zF3e0}c47=uW5WVYQ4@+l*Us*q0CwqIR)pC(ADJfw(y1v$V39g!jO0mhvc0oYbhZdu zWhk&;t)Zi{OWKxV{R0DRrvV%sBn3Q69;Jj?ck{*##5!5mLu_xXV`F1oSalQQ6T+Y( z(~!DU6p*JdJ;mR5_YWk3A;Bh!yHmT35d*mnaEz3TWzn5mSeVD$+ziOvVj6TeWT1nA z!66)HvRK>LlJX7q_lX-J$3DSc0=C5h-41I4{t*1lmrBCYo1LA6^Dr7iQ^lWbPFQ7&25@o z1C7#e_EJfGsVx(~Y=dQn8Ji>`$dWu4I0OV3TejE#{{^sorbOLIuLUzS`g9m_sAzJO z4E@??)aWNXv)VD*w4oSAyK(1Mcp1V@1n!e=hdDX;KMqOS3|5`KV`bNuDO$|8rDKF! z1>5$`>g6wT_|wj(5x!h%f~d5@7!qOWh67mYN$PG4jCEtUgiS*O$@X&-L%sz0u%n1|niGLB{VVlu5S(xdA^&`dMD3$)nt}HlCFlRn09e6+9!7f%15cVRa3OVb(hkA1 zTiH{BL*L!o&8TaZPU!c+59``E@IWiek1mi}vjRQixQ+Shz{es1tl%2p&9l&TG-B6L zhi7MD*5f>E-bF0yf!n#Tnbq8(nt+h|pYJc-4(1lH?mPQpben{(UcR>Vc3Nu^y2ANB zcQwzIi_d;zsRw^R7eWzj*X~}rNo~z_(F`-jWrEs;+cypZx?mR6QcNtvlyad)Q+w51 z-d`-E=RR1kH|M@5qtlYTyb$45AXjdeRfH$yI;cf+b;xi5RCLI26^dL5*qU_hZ=Z{x zdLVeq>+ffE1Tuh+b(^&9?C)WhC1+fm)cZ_T{it?Pf2!1Vs|5^nCF<_!ps+0%2~5}q zs^m_&yl7KeK+7_+Jf?vYv?&$ZOFza21M#RBUD-;vvT9(pvB%jlcA>z@L!YUuCn z!B}r65-1{eTEKaQETgnUds|z3jz>?P104zU^pD_czwtYA*na1oxAFJi|9gD<+uug1 zNFeGe{>eZ2UHq$m`FrT^OCZ+Oj`Z;ns?{@$j!z21VQ+sIyE~iM-dRWTa1WVm5zEUr zaOKJ>7A`EITrT3H58oG{iyBYYu3yLPJ9m*hIub_9==cP>d-}wMj)&~Q{sH9D8Hs54 zjkL zbjQV|j{pI6rwB}tO*A$#gs#pu5$+b|Rknb`C3<28V>*MV8Y^xs0dJo}o}G2_vphu1NI3BE|1d+t5ESf`Nfv0Ym$G=}wps zEhK`dWML8585$lzAEPufpU!sl_jDr>qkCqX=$j=E_Ax&k_r8bcFJ4I0!7sh_7T$dGO<{ZyOrlPi(qB@SN5*ZEQz)CuB1?D9f{H*$wvDV$ zwVHre+uPf?xU_@|vr|ZPwxci6B`&pOClRQ5`s_L0|L|u5;_zJx;&%}Q?C2C%yWznh z(F>z)6d7j(Qpk`afK@CN<@v#(5ovn?C97m8F>u15Ft@0^#&U8T5;WS`*-{!-6k$)O zb|gT_er8lgvh~OgOQw!R=$+9F$;u*=jx02BAtYd0Igxgc#bX#68W3QS8gyin_4W1% zAlBR8k90PVt(_fl@$Bm*DAyx>LNR!{%TgasE+kIRMEpLT$;cd}rrXu!RjjNicGtxv zMgyHfM?0i#RRq*_#pZRv4{hGHQ|#UeIN{&qofTg1X~q`uE;IDSj=uEa`-XX?R$lK? zL;+7~&oYq!tEV;T3j*b)Z zK&z9g+8>oZqz2Z4ZiG(6Us*wP#6#<%ZuWea!R%{5bFtwbhW)PeYL7A(UJ8)1`;gfR zO+y+x(2*jryQRbSa`!RWPlKRT;O{W|(p1AR+cX2KIRq1G$kl!5SKqbvtuaKL=bIf6 zLh}=&!EDg2m8g}cw4G~>ipacOwR>xCJJzgx7IqA1P>P7Ak8GciFSHrgw5m~QdL^ze zd(*VUL%A;i03ZNKL_t*DL>pAy|5fn8=of?EG*_%rZ}<+Wwy#tZ`46zIj6|;#p@(0S zs(Z+6HVj&2&bZ?vKV2I;xdv7q-9H&vaS=##OUq!+;s4c-0Y`YqFl;PSsk+t9%99wOT+jVMz$$`Q2E=lsEa}^0Yt(C3 z4iTp{>{oM#Wbz=($Oo7@^{I1d4ub41`lxCVbeUjJNS!rGaiy zee-T2Ly7yP6Ctn;c+4DII#AZxg~I#e#hGzOg&vKEbrFdFtC`o z0s7=%Nrq0Xh5<6L`n%B6UPkP!gjz8z0_J;rJK}mrLF-t&7lXs&_`>UNVR3N@-~PMr z;D%d7-GBffJ`8WY$VE3|;X)%C?JJS-C_|DvRTz18nW?4`XIcDcCU}pY;xVbG~zJmLA?qOndOz!|9 z@vQZ(&LqO2l(kfp*%zlPUm}5cJfY9`=W_5TYe-yC0RgD!Qb_QlP%Ma`cDYiPa#F0m zvx|C9dVC9;OOM;Oc40r!rI5c(zq8%QXrgXZ=J*Jyon67dCy#x(wc=YfQij@;gOikguyf)Jl>7eaYiB&{_vf5vAuhMd@h66 zUVR0xz4`#-BTBD{?sH^ZiHN!u{UaDjz>lnn)>F8*a2!`=^mjGY{t=TU<-8~o?9Yv{9l{Dz;8}I5A zP*4CY9blk*QWY?aY`}b;%(9}aab2;5Xm>3wUBbP4cX54nRiZ?)KV=Q%m5s~#bijYI z@}!^41+!+5D)Oo460giQ6RA)S?!ew=Z6~&q!_E@8#;o5C(8PA+sBKLeKR=v6DRjOS#vZNQ2&Q=B?7z zfj=}L=0%+~JGffUjV7F){d&*S`R=2?ZESl$ir0(YEYkn-0h!j^ltX~2vI}5E zF_!qOL}b%tP{QFfW_ceTp!5aTQ+>FQTWG8Ep&}`n8+vs((2B?nGFz^@nwN`P7oHFd}kR~rLhNz^N)4{zK&48zP;+l&YO+b|it z1Ea^*G6yj;R?O&;c!~tD&T1Ic09IdT4RMrE$)|9fN?~_*2U}YkSXEjef1UGymL&58F3=WP66N@f_ zj7)f(IzTeHi*%-l8#nLa%9U#v8XiS=cU-dq7|BtAKk}p9Yh~=|_993?H!yL#J3T>r z8yPrf!sco3h@-8oOBfE-N(Jq0HFS2Ip`+~#`SJ<=_S@gV5C7puc=G&(XkJkdh@cA7 zqIMF&n&F{Aj0_E6u&+nhLev2|&g5~JOoQAq1>zZbuoImf9g58-EJkW)L7w4w;yB9W^2lYgvOJNE zLk11MmojVM%V=G3yc7H)h{UuFBaicxEFrSv&T17DavA*WgZJ^##~+BG4gHajTJ_NhwW@gbZ5ep%1f(Ls$q8moBc`~4=*Okr|@N|6}AAbB94pKQ( zN(EfMdKuSOu3&0>RH7u(y^{&4m{o;`md?vJA*qgY*86(-)phY#`W`E#tTujAI8JNU|%-cqak z86#0D(RmIE_VLN-DU!!&>?M;Ticj_$0|%TjAb^gLYAhm-DFVYRkIW5%?zI}a;|Yl} z$@N=wzRncSw6CXIG43j50j>z}2otMZLAgXm76ClvQpkvy)3dX9aQ{B;+`c8u%+cXt ziPC8RENk9a085*O0%EE8Y)=`6k!4UJZAQ7QD`$(>i-SH?X!f01-_%;^fi4CN5^#|K zR<$awuyiLC29|Z})9&ti{Z{NPk*2qxl5+JohZ*m4r3V+fhz@G$&Zf6 zTeXn}O*BHo0#k=KwP&ln%v=Jg&s4jKj-=K_bhkyz+_f(Fy2Olt>|UBU7rUNK9R#q< zo*DvR*@(LigWGlU)ctFES@oZ>Yg_|P>u^|i}=zHC>l;qBhrv{zi2V7$nrX6i^#9J^MpU~W+hUFw0f%9vu?`X zp`re*FlK-?jsx`yu_<*njY<;+83cgQW@ADxazXRoE4x=v-=iV@;`_+{;V*wn1i`wr zquSsl>lz&YI$5!k1Lb|0G2rYV-q?wpC(Sw}?DXi2N!={LEJCU{&s*jftw=A z?^{5fs=Qo#SgFHM{=LiABv2*)EcYW--aD=LayS#zr4E|3g8NW-hq&c7>rhl(ObSuVEVo6x zdPmgFj3K93(QOs(hF;(A4aRg(U#&@#HyDZDvZOXQXNeD)`@ZQDmZ=_>Iw?1WDAsTN z5~AD38S<)VMqkLI;WN$OrwgF~SSknUcMW0~xI{6Z!WJth0&vaP z8%{jPCJPVqZHg{EAJ_{``&+}=03(iF>>Yemp^OHLoQq5ujYVVGk8~^10G1vH#)XhA zEPd{C)lkN}T{#Sp=#xCw2LU^8J@*dd>SzHg&EQh!J?}!t14Y|>;_^~_bD*H8Jl(F& zPBGBijnTd?48+gS-F|{{_6SF*BLT2BH#e}hwt=bXIdS#7aA66Z@dW;lKmQN--Vc6= z{r!Cm5A@;2>I&}Nxruvs?_zOr0n;M9`Pqkf_s2gG9U{65N_4_XMX^-Q&%~8&dSV>C1l3M!$YioO zPUmox&Z3JE_j>!}@IE>*E`Z6@#I!K5=BDQ)Jt4TsA((*iDQeZSfLM%aarvl&zCP{R@F2vb~Z4g!w89o$FzjSd)qWRJ7ET7GY%PB!V zimu1vap~(^p@dYfjAXiq<6IfVd=~xPF%0&0%eW%|NM;+y0_!czw(f)gjs#x_!V%!3 z%ND_>oxME)qR6l#lZrqT-zRuAKQn=)3v*amzJkTYMa<97iz_SNp=dgV-1CK!xS3`% z8DW;um9DEZCi9#?6v0LIE$d7mi|adqR^{#)!`jA%0971MoU+$euZeaR#pyS;wj?6p z?YnpJO9BoG=xKuio(VY1pIEF5 ziLMx83=}}!v7TN5uBc~5Fz2jV6&FwfSj9p?`r5c&GFqaDo>x!BWtc!F^Px`KjT<*` z=gw_BxOWc=7cO9GYFh7U%9Yt=>8NGR?1zdmY5{r!@C%rx0emq>HK3vY?bA=N)M&%F za_ljch~%i&a8GExQma9J$S|W0mW&Y$DFDmtOU%<+JbEv%d!AI^ z+cR~k9h<|oX-!+1joI5wZTgNqDfznqmf0Vjiy)Vg9(}UVouhRi4S*%bh}(Y>j6&GD z5#PW}wO_fWmoH`gg==gF(+e}(>ht^+%G+APtyHhIXX^56Ugno6qQ711(+;N9Ja^w& zz(E|`H~of`Sp~um9D%d9JmjY393C7aTqagXLj(^L{!+PVhlu28L|Ls{I^U?qcGfym z-e!-w1ET)i;nuU^boG|;h6AB_PlmNk^S7K@$f?Tw-699cmq9c>Zq5f`wQ`77Ue=8eh{V)#pee+bjF&Z4hfr;YK-J7TC zpBr^!$*-KC`oMOb0c%|bmU0bL0M?-6La0Cn!wmAdo9gP=E-~qA2@%Dh(cp?Up6&YO z02pH61{MsHrU5!k{^GgeL>&yS$qHYgBa{hC?r4ONkszVLbyOu0p!VD*%#F7Kv2;jt z=U`w$m1_*gi*RT`Ee&iL>V~Y;0^{ zap^Md+@^5$0P@8${^(Et4B!93+o+T)Se&21o3DQX5ANQ^o!hrDG(3#ne#LM(J0;tt zA15a@(Jvwci{kJUtIicFxK99U%kh!*uhac)EaM#ubTRMyEuJBWo?6OXJ5sdKaHRd?apZ6!l(QT9Qb0>znKH9@Ajd zx~`5cVK9lXHwEn(k+D!lI#)ubP(knDurT?0dlCX*b@1Jos*?a&9c?(Tv25q!vN|z7 zCgR`Jn<8i@?6g8&Kp3*76x)bQ83GMJ<+Kfjat)`_XSuW14~#fwJHj^9NN!oxOII6H?J+@`sxa%r>BIO$385U%HrC$ zvAKogbXtk{CyxZQXFvf0R*LZ!7k5Frr4p24R6>5v`NuwI+aDYr3LtiHm=s161>`vv zwzjr$cyuJ`Us+zpy*szj9git6&<4>^>>vT-@&%+a1hI~BoH`aEcY<-upKAc;3fB?> zSM44A-6kUW35h}(N4!gco9EOi1GTxT0_d^KT^$_~%z#>69QSm?BcZ%b) z?b(h5`)=O6iC15F1=m(rBtm3+8>4LM;1)zM7`sDInJAsQ~F5+X7%o01(CSvjCR5XHx5-KBX9qFY8*UFM9;Qav9Uk zF~gjLJr>)Gh?Oe!|gzQyVy#~!34aVT6o)cNbn4X@Iq;8!hRVne=DYXAmxUyv{3$#f<`9U zNVv9zbizy1%BR+R4jp*fey$q}#`M#(%^Ah|pT1FCUyk4>nq2BnF1Rk)zr#uc3uzxY5lhk_N}fBs`Yqw(oAi&L(sK@l;;+>h0(A?%>A6+`U=)}_zP@92^2 zed9YH)q9>qSJ_!ZT#&Nqh|uMC^9_aC+y~qPY)GY?+BA1}s~a{==KHVeMp)mOsz-we zRunZS(DLDJWF9iJ)*Bo)n}{*!ORw3Ir_O!qzq<4quSHQ)zWg3j zfvC}H3@+z;&4s92-~4%p*Uip#J71hy`YP0G{AwsmG`Eja*!-d^tA~%^^Z+)Y!-3cWv8!^gEry%pn1F-C_=C+@+2AX>TW#!d( zynnfL#B4*yh&!6=7Xib5Qfsm|nvC|2YEI`p=K{qnTlPH*gsFaYK`8@LsrFQPdE-pA ztLZb3J?1R8`Y@ox+?5NH09(fG^z2kXovwBu)(&*HS25h(j^55wlyfPhGie+g?qiqi zlifWmFJH&2UwA_z4z6!(;eY+#{&&3n&by)?bm!J}{O)i67G8Vh9&X>hEzv>AI-tf- zrFl9M+pa06_x& zCU7C5(c(6zgrn*5!$To~EP^L$9%+Gmf+f`oUTm!4zx?H2;%6Uzh~!aH#y6QK3h+9| z)hm}VGc|>iatUSXPZdfyI?mznD2<-}Az_{vlb9?Q>q_YVw+U^~C#SfD#&u|(~woPcz~W@9AA-ad46bji37 z_cvjt5oFdNvZimew^IX40a!|#joL+YUF;Ah6B$pRfA%T%_72b`T3qd*xHW-C>P3-h zB@8aT=8%O&aETxb*+@HkNt939aN5?1p8jER2PEjyo#2lKO5zk1KU2{VYf7Aaa(o<9 zljE3~o)))40itSE`5|B=?O{fJdk0R>+i@b%+tj$qQo+_+ zjOFEJyvk^t_wV8Uz57xxu33uFq>&i2pUE_EPkHKk&#ZakKCGWrd!7bL?0T*DS;IEc z=7#}se2iv?p(Xo+j0FZ9ITs*M*jFOZ?`cyh(9_StGP?o+Kf}V3Raxtl8I3c=OxAAn zqN#N*I)KcFdSfMOv+?g5-4_XFg#%bpRvFUXjwU;S2GZoW9@oZA)qU35H+s!!L`^Uk zDE3UI+u3bL1>pHkO`Zt9d!;Ik;+fBfJ0k`I~Fu1VxuynOT2$=jEH z$Nfz8%rsb9qY;jTq>k2HG6`L6!4R{Fg$1ubly_qRl|JOb;7=+wBACcIt4W}I() z8lb8{o0>Hux`cW)3ZpPaw7GA|Xs{bA@W;=-5?4Z9UjF{QMFLo!3!$1XE<;KcLfwuU zmXGJ9z#DWqeA|Jg|K(#~DTKtP;d8g}mQq&}#kw*2HU+;cqXB9Rqf1=n^dU_BTSr{7 zzcqNJHJ(JHL#jpB3KQ8$-87qU=SEM<90**ITHRDum&$-{>}y%Rq@5Mz%4?s{>l=Gd z6cby9ZtEZ!eLOO}m@evLV z4{(^|PYNq5H}J}E@#br<;&*=YYgoN{2~%@(A`H)i z_}>1$xLYL>-2#pXAXTk+KW817nOnrz#0+AIUIAOk9AUqbEroN%T54hhHA;6#qG9s6j!t0!iN=_? zr^Tg`Y^kBae#E=FkUBaN_qI}*8dwD+kFyvU9L4y=guFu`b{^#WdU~)hH;bt-@{%Pj7V2Eb}>N0k~wrLq771iR?cMQx<+?jGrD3Tao$)LY7v%Yrrn zMZE(8_O-QlNZJIjn7$etYCK64J~^%_HX#2k8c3a;8o=rl@QO@0iu4manVg`IeOyH1 zj~UtVI3>Uk0VM*U{Exr~UC9_ZkFJ;7dr4HN`GZdM3=CtiUq!cLRLh>8gc6X4a&aVh z)qZ|1qVRJw)0mu?z{v2Rv@wAW@FN+BOQ7VOO zHm{@QRfRD}hFMo9#|Xh1>QONbAf3x&V{=>HS4^#L`8n9z#c8F4x8C>yUb}w}w{Kp@ z;9$S7-_Fizvc_c68PSE?(csm7@(B4tSpbSIGMf_J(zfElM>p4w4v91=jI4Gwc16@( zHV(SCD)yMLn%GzEWDPP(T~)?Eh3z}r&gF-#C;+Gy>L&n~r+!zVh`obhwos`603ZNK zL_t(T943?E(#Q8DC;&mO%89f;$6-9yDei-e*hrAKc2br8WZ4)&kpPro1Jd15T;5J9 zDCCR6#LQ*$GDZ|Gs``R#ExyCN=*D?*=^`FHc!1Yme;seU@rE!7&3yC$SiaR-ubFyH z_bvxKXFX$Y>!nif$d1jSFJg?vA$x;0YFt}S?Hl|t?(YPxlzX4jsIn0%b>v*`aSBw^ z`>S3@42Z<<6#GhPjJ36C9Xlh=eyZ451h5EJl{5pZtih{tRk?$T>!M~~@i+Gjv;P^F zL1P~nCYXR%dS5VN@uBA**`B;}g=&LdC!I~L;gB6Y6EZhH)`bIJ)XaxnbAKrdoKo^!tv8j~H2oK1Hf#tbZcwxg0D5YEqbh;Y6GTo^_D+OdRM^FDs zwScfC^v$&@s|)NY(9ayCwa&S=34;_TZ}_;3Qg)R@-ZTHXg28$o1c|M(r^w+_9Ud*H zr$uuO>&jZD8oXsLaw9KM*a%=KV_!fFIRq&KUBuvZWH>c$)FPnvG7oq*`P%8~OcHgF zQHLz$zNp(%r*94n0$>R{NtJ~fNS!#719D$?48uL07>u_e(N;w|$w+~R0$}j~%gAlZ zS66ZG{wsLz$3Mk8KY9<}`R?B%lPlnNzW#Om`mcQjUwP|`7#SLbAP7}5iwfA-Tt_OE z5+(=_%VdL)0V0R#7`1|W(4l`~@ot&01Z0%!nsR-TGy8c>+KLPjf*gE~-~<5|{+r`M zX^laE4C>l&e06rk1Qa4Lre-q%Mv-O4(Qy**{p3e@`0#V=?(Jay!WKwbGtwVsXqg|rWb;V)=@FWlSkxcI6D47JATFcAVFfu$UIzQVx+j#o?DUzwA zxR42OB8)Ib_ES;m$ig~E9wT4j;rv`&2!{s;F)==h;lTl6RR@oxW2NC?w$k+ zg}m+q*0~}YWQT`IBaLo4Q1hYnun_YHS09gv@}dzeyP`I zwHZ5RgSG@M>Sfkam6v4?Yp|QZm1SU2&rt(dc3;zbhF0d1^;2nGsd~xYLRVdxCmuj% zG$N@TMwh{oL_JhsmibZoTVzgZ7s3F5WiBVY-<$(#e-uWX*`xKIBCDL)1I(5ZkW&Z( zU9v}*wl~)y$qtHJh@{Tslnfps-=%BC4VdI^19Da8Y5EYy;mlU-@6M&m)Gv zzba0e&hy^kC;TYrr4c+d2FmCzKn(^rUvw@+%fWbcMY-=;xHZ-{6(#TKHaa1ySnOI#r(Lqp0~4X4r<-P#;R{GThoCVW&cL z?tyPY+RJ^SZXXJ%y>I)9$hhv~2sYLK$J(3!MwVq~VkfvnaNn6^lFUrzR=HJHW^KJy z^`h2hdmxXY8Cw!Gk_E$n4Fk3%|23W;W;7W81!EWn1_mS>V+(S(x?3%Esn)FAxbLwr zA{b;ajPES>-gn=75s@WVgUw{bdw0L*-uvC}d?)c7{)p#O&<=@N6;H7)M5A1D!(W6g z9?!!Z04vou@?N)f%-e<}yUr(-(U6Hc1!c*!QE#vY#r8eou(&b>`9xil(*kaZNPcg9 zA0(1DGkq(Bnd8&2eUc5}T)cG-g_(zA)zQ-P=9cTEZgbi9wFj<@d6i@?|K1G|aW`Ef zHdjWEk8XbaCSKDI+%3FEnh#BGqs?rl2RS_J%s?R9cuOQDJs>E+;oj5y3^Fx$Koe9I zky&L8u)wWpc36}q6WZ0^-dHPOrGS{VfxC6L&d@OE0fUTt-TsaMESqm=(-iQev(eg= zpT!|VBl|HaMa6RET3!I7OaO~F-KuM)t}F(m`NM*YM>o7(l&3&ESD7%0u^Eg3bDxm) zOi~gOn=7xd}==J(Es&%l_~dg5-tHB@F_=qBc#BkJ0>Ok)}rms6;I~ z+}&jG3VJ=>0I(RQWOuefy`(SF^!q`0Lb7!01Sfwv6RKbES+|X zI?QV7Fav1-?3w}mNTfa-mcb5cp0yaX0Du8T6ElHyJaT&$h)(M@`ugiHX=i7XDwQLe zo*t)_l@&T=-5=;29W!tR_c921gGGUedk04q0kE#F(CFAG4MS}F5*k~?Y@+q+*Xijy z@6f`+0!>X#GLUf52IEC-m@?@AWHQ?YZi1&Z2K-QG08G%i0!YI;VEl6-AjZHT4Gtix zAblCr7li z2M}|Q+W;UN1o;7Q;CJidob{28PHI$bwCJ?irqcKXO^uH+hzY<1U?tiGUo0>o1;IbCMVdv6Tm6T zfiZ;Wi2%-6&>mW2XH5Y{+80!ZOXKM&&nL`({057R*^L~v?}7#08Pq&Gqot)Kdi(9i z^n)LKpML$vzrk*a0At;H7ik%a?Nqy|YofQ;NgYSS^WB=4xO_0M-`ilnqIj#!)1Swe z09bHgH+?kdP$d{x=GJFxl{=5Am^LyU1~Xk31vpoZ^blml%$9ik9_*uoEzF{9F{Q>$LL0LmPe$!PtC|9r3o2KE5lr?svdIpbV zo=1an<;?`og2||U^irA|)x9y2rOoK0VEhE8D?uemex592Iz>BpS!4DnL1g@#;ftEW zr=kb^Zo{ohlgMjtFjm9%Pc=kFI&OoV1B7%lhf%q@mNEpe+`{Y^jqWwfuq5FNdBA#9 z|J-Jd=2^TYNm0Y26K7r%+#%)4JT&={^E^xz`)``n6O1j z0E?YS0v8E6c!XBiU^xYZ1F%<~(wlmRPr>!fbfgfaOBr4Ku)dLF3k;|<_L6Jo@T!}$ z^wB68WYNyBev`ITw-bF{I#K2ffKJbevo;NfxYplp$rZS;bdBj?x<|%(z+2*iY4?6O zYF*M`r_DdJljC${dW@z3U=>=lzxA4S_IBAdsa&m4{j^S3t}L?P^ycO!os{cz|KU4y z{l*=dnVDnY2@IPy4!GwHdiCN9dj0YlRV#e@Q3 zuHB@S)$7b!!hx8Na;#|umnRW+rw*7kEfycgK^;*BI~_#18)2rExYM1pOBvWB&?JJu zG~DrwL1d!`{fPtnN%@c(rzdoNeo6&8XO`0L?mlgA?=l#INO6e9#-Po4n+{KEw7qvo zv-8Vzb#;aFD21O-89Fu(wmKwMlHZ~(>R z2Ps17vcQ0b*9_XH;vP(@=4Q#zuzO zeGriwp|`}06zVWgQv_JkzF@!#8dwYSvkbPty$uDIa)G@hfGk`p0h}Saps))8dV;}- zc`d*WT=p($fSE`~Cn)a$YlZ>55iPAtYBbO2yw&D0(r8`K{?Rej>Y^9LT1yPB6=-34 zoPPcLAJK!mw;0$3@CHz^Tm~?9%;NRU))@n${4+Mr;@ro_C+uDaT_^yi5J3l!39u0T zSuBdEJo*NCqE2wX15nB0?*Jtsa*v3T&}33=DU@GqJ%Rxs%A_)x(8q&A?2cAzG-+#h zj~Q5SaYVWk;}QWAU=$h?u807yX5ijAKE@y$#*P4*05cKQ67vW4u+3~R{D-*;4J@$6 z0FI&mQ8vsiD z`8UQ7^!aq2%H@wRLIuFO6v1|YgXfn#{>*JqfUI+7X0eF7y~{wQnmn2EZhaCvuI#Un zffcO3-c!vWbHDkv?XEx9M;EkN0G5G_4nWJ1ISE-=Tu{#_4wt%6SIe{SXFX;n|;!Ucx`Zg?<0>c zy;^sN`C@a~e#*~{G zUE4gf%JGMRVQ`7%zSzgO%VU6qRqWCi`7O~$-hIq5pNi~ayA2EXZ0ez?Ed3NMr>FSU zV4j7BI({XYP0adBKAntenNz^La=XbE=NROX)o@wq^G5mg8CFi(%a+js7hpmR1yrmYV8PARM zaL689{<%H@EFC{m{$6~^ykQZPC2q{<(B5ATVcoiEYvs%z_i@g;5jAG!v(-Hud?*Ako8LSS# z%CO$%=I1PhBqpGdg#lL($lTXLmX!mCv=8jYUx2F+#8US+b~6<4N^XB8FYgwhmclmI zT#nFfAPr!dOQYBQ&`mhIF$V7kZD-=#;l|j$=G}ss3U&2xAUJ;+9uWFl%;YscP|d~C z7zH7d%KE~_im}Pu?Y3hesGvR%k07#>GE(f2CN7QMy)XvG#PtwBn7Gq9Ky5(6*^3L1 zST$zEfZ5YNr`ah1ux7`GsZ_Y2-L03jy|c?KEF9Va8X&?SSS2{rQ=v$Y-}!(6tl{D) zoz_lidwZL{{NhXc{L{aqt=G@!Ez^?KL6qis#H!njC{3LCty{- z_T%58?|t+mx_AE}16?>oGwXy)DG>$1*cups77_HG0Ak@V5BI!+0$3#mEjVIdy}^e^ z2y07JzoOHD^4(UT7MMHxJ9KiqL)Gd&jg$%;b?)`XHobWHnnkwZR>gwW01N8STsonR z?LC@Xyh>}=t}%E8(1qQkRD^tCZkBGZ-=w$h-eq^fHln*JC?|(%U3k#9>_H0MC)5q1 z`fx=8Xb12L?w)?9&-0Vr0VPtR9T1t###|kV$cVCdL3;s2@eZ;T&_cA3gfSv4lvWFo z<<60E6FNRQWB>>6;|HvpW~)W@W|IM|TK$Y#tV=b(u8pImVg4BzhL}0} zOali1j6{B&4h;_$Xlinj=4WRZ>>C493odsGR{9OaL+EgI_DI;V&hX_WiSpT z(S*BVy-u}L053JF)~Zyi)frdcM@ld3Meb38AUQQ8P6PCFUYPBLGy) z8fycL0wd0Z-bE*i#n%B$g53n5OU3LF97DAJ1mFkz3G6F~fdde!fGJh2vI{Dr5W-Cp zd4OSvxdc@vjLAg+hLe*tJ~l33Al%8>)e#^t08N0RZDx(3EMRG|uzbDFY%KhZ^!W#D zG#1WBpn@|7dl7)(_N`m2f%T&w{TeMTEz|tm0t0nmq`}QrfJbjX{UuDu433sXectaB z#R9vvJ_N4ZIwU()u^{@NG7=5I;vgb$OXe{q02aFvDxky~WwxdvH9i}_j)Hv!R-DW^ zq4wG$E&T+55Ui`SwzvmE^Qv`zsjMsLoQX>zz%AtK04%L5uS6jzrAw2oXY9V{G_y>4 zAi#`*%Nw&GcI6eeiL9A{AbubzAj?Ov&IJKf61za91pCi|Tg${=Kg;ugIfibZVr5H2 z?Dhbb+m&mN2E|C8`h2f*0ea(K{7k$9v~iQpEwyp$ddNsXI9i^}{d)Q+k+-dv#l61` zOI{j&Lb)wtes*tIG+p9cdj8O;zP-WbT}$550#uUb+N^koz3gSO!RO+i?;}jS zZz~5v#Dxlg9$zNOhc9?p&|Mi=!Jf#KOo0zKP92~m0F%3UR@Vu+CC1@U7%`@!6kd+; znc2W2V_^k=l@pImu$^oU*}9}R<|!fAG=RnWCw4s-vbqe23m924Bqa}R9ydw_=Mm-^ ze{aky{=@bSb(dNTn`03t_P`@A!8*E>cIe( zF{QXx%Bs=YS~<*REC9f){DyBi@SVlO^#G{=7QO?^1OOIYv}kU6f|h2+X?9!ytep)2 zSlhIBaKQZ!G3wS?lU=O(}(f=U>p@{LRnkCx87PsC>Lf zopzIc^Vfe!4<9{Xx4>7gUeZth=4W(xTp{SRpOnGIx}-n)7k@(k^q>ANJ%0QSU0GVv zK9B>dh+JQaU^~lL0o(#32aG2$AprOc^8p;}5RS;l?q~sMfd2A^*Zupf*`&R_9XdSN zq~oIdAa1Ox01jsKgnC-H3 zWs%-~@Q|K9d52M6(K-`d9~rAQkEQSB7zYps?s14>2iQTF93tYcZojGn#x8-z_Tz|! z!de2r1n>jx0XH&aChaIfbn z!DBE5@f-u1U@n631U490Jzxrf>C&fKMF&Os{7U@|{8FM1GI*t68Ro3A zwd4Xw7+kt)=~xN%!DKBLad`o*JfqCFEYEvgxB1_;Mrztgdl+bDh3j0TrR6TBQfGeG zrLJd#lK3w(w~MmA$k!~4d%xvP91?6Nmv}jcWsvCm zpj=TA`zUc>2vhUM*{j_8bOo@&vb)yr(KPY6&0{BI*Nn%0-ZYFq&nbI$KL_(MakAHP zM8)YBaLlZQI~epgisCffLBd{Vs~fg|cH8+GnKg*?Gj7A6A*~Hvg}bHAt6@&1B6}A; zmSg9n82wxdWMrvn#-lQAFEZZEn{HtnXAcWk|IDc#WYzC%NtMo;(e@-+2T8XHNxtnD z<2cpsw%U@*V{(P5rKaE;-Wm9L#e-V1&Kn;=#__OqqqvWE^Jk#}^C*jyCo7*cTqcLF zWUIz@&*vI5A@fXbU+a@4n-K&;z6vi@l7Gj*c(hCf_azzjqsP|BfqzbBNLE|}tbTue zg8uZul*=*(ujD}MGqJ6?A0=WZ_>vcgUKRnz^SZ7l=CmC81xQnOJab%9tqj|cGcdrR z!X?DH6Lb$cN!V06;@n1AM3hZ~LrGoiaghNSL_%u#X0vi32Sl^uqVmbew#VaXq+WL|lYTQ90z zH60U2KamJ>I+Cs3wXgLH-R#?%77b1X&XQnTSO+PmM8X3brcDKC1zn!g{LCaR&rZ_R z$RG`MTD0}*IlCpDRLVT~z$#(4wTlaJiztC~ZL4Wa=|0n(Om%pTE&%S0B*52+G zO-+<&>B=1a)^Glp?%cUeFJ8W+ubzEHpMLfw)z8jpaA<@hxZyne$A9!E^gF-vpK=s4 zL_>4)Sw+LoFU}b_VMb3u8B9t<6VOiDfyXk~M}uJSKr2dI&aCZRf9eNdY?V)rs8Zf% zSI5c85eBdjp$_b@=PzDx#5pif;39Q=Qe^<^_0}FOEUnPB8#lytNXH2N30E|@k3pRL z;r)B`?$f6$1&x<3P(juL}=E^x@VC;qyiv?s82cW>S?HJUOkO(!tRY9UmQ1xuWcz zVv(BXEjnUdG=NwQnwXfPsp%OiF$1f}8dpODUSJ;Jhk>fnsj)AP001BWNkl88R$L!_HmsBsG(6>K$mp**@gr2_hHqFn?@oa=^ zCzw{p6^!oKH4VW;*j7PXN8I;tZ;(8~G)eRRYSPET(ydalwHFc&-6hEilLnTLA(3<)tNh`t&J% z``h24Yirl(>eW?twS=pu2e5R{VeHZX5J>=7IY5c6AI2UEEV=`l96KxCbQs_d5J=ZR zFtGqwvAZ9$3_UA~8CZ6yqU#K|7k^QpOW>5oEaqhdD%LEhB`@&UTr6uYDAt=moomv8Q-Bw&4V zPlcCnnzpS|S*Idd#=<>ibVhRPos^8_zHCVg-9D{sP6Lb639@wQ1`A>0aFtcOtZjy8 zs<=&W7vSiPHmr$*Le??DS|h7m{eI>bLH|Z}-NTK3@~z}1G~Q69OOo03(dH(rH2wC8 zyc@Qddo!~c?c2;ZQpHd7VXz-e9E8HnVus6_uSrIo;ytD-LGsyn6WBM%mwB4f9#vO^ zM5Vjp4OxBSM@Qxi_^^d3j_sMq>WyAN-iJ;)&57PuDcepEJ+BHHiSY?7D?h zB3)|v#1}Js!cOloh|sIua|TMFIUJ^t<>Dr76N;CoCyM(d-H>V|vlrO7^zl=v~EH_)h$J4d6Mh1KIw}R*pBWih`kc6Z5g&l7$aH#CEGGKC$_-kHEXhb-kq)IOvy_y z12oL)Im_2=ViTj^ecNkrcK<%S-F5DP%Dl0SVu9%QZ%ojiJ(zNEEV}`*K&oNb9>DT| zQ8dFfYMFpnrh%o!3pe??@pPa|Ack%clPrQDyGIy+rBR|n;3Hv)hoeNr=ouaGrQ#3wYpux*C+J60#_V@SraE|A}z#1JHVSoZ-5UeMFSTA0@ zrhofy{}=knPk+jcEwD$1hX-hNWr^0WuhNqzZ_~o!BE8z!ppA_UdcCzfG$vt1No%EEkv&7dXVX6xdOhG{;^-JK-=Xz=pMj=n9EAHa`(g zd7hiXa{vg`Y@AZFQK3eoN@HWg3_uXGQ7-ArFQ3uNS1(!j3Hm}u!Nms5LiVJ-CjPMnoS9EF}d}gau}E3;iSj7QhcM%)lBM9vr68 zu`vdG06ZPCnEfH`?rhUZ`Iz&AaQRWW%-U!W_MVxUrMbCzLY|1YH(C+~4}cbcAOOPf zq5zBHMu#om_-K(@@c~y6NKbf&sK5T<(~GCH=_Y72FuPuK{4GtFj*Ig}Z`w z9b^y;+CqE#2eh-l&x|a%7lI*n4h^imL#l#Z*J#qr+#HY3&p!X0j`#QIgLj|Mhfkl< z`|m!X`T02kp)dxyE&^C>Y;4l@?hdoNFhAgC2e(zQmFDN>X>M*-T;!|I;zef z2PYUD;_-l)i09!_iTNeM^a5a6z7YCn79BI}G@@w%^#o|!VK+j!^v!g^qQQ6lyj^BBx4)cKsZSU;xoC0g@;lqdY-h1!UjT<*=PI4p?D1m(6mGrkl$MjI=S}KziN63&`d#ce$sZ{_B?S#)LJu zO+?1dP&Zgo-khzn+pzmxu|H&Fy%QXQx^E8?-@5&5myPWkBo{rJe~8LT(;WDs<6EKu z{daNN$-_yyS%V5jhl>0(d(=E7Y#LWTDr4p;B_j`uj^l<$R5wq8^e<F0BHfeu2fBE(-sLb94O+GLt{T3KJ?2EXmvuY4?D-mQy#0lAJO;A| zL>gqvcrVu$_})>wm+r1^E`I?y7#=F(F`wO1LEmR&p4EK)*os^*FzADH+Iejj9&w^=NP@vzIR#Il3yk5Tv*~n`=rv#&LA{V>Gp|o zj*`f*np&J>8>d>_HZmDS%3I@dfy<0GcNSUqIW{V@_pw>yA#BxXhKF-ET<&zR`puV) z*+PMS|He4|*#q3j+s4|AUHV4E04!r+g~$*N9~KGEHib6)Iqjf=?hvA%<8bQ$EY{mV zm~e4nVC^0Tu*6kD@Fib1c6Gvm(?sC)##AC7`AuwS-qAGt69~Hdzik#;W9n}m7x>En zEasTG+iweh?m;ZSm?l|V)-KFOix%?)1Iyi1r^i87dxq^Cx`4TQhQ>&flyr>wq85Rp zAqo&FEC#QO#KH2M8;1$Pv%reDgd}E}2MCicX)2lH4qpZ|%G;uS#HUn_KsZ#mq$_jN zw6ZWwqk}{P?Is=UY_ba$T*#0&^rRLS7ioEEnGeD^;2j;E(9eJV3;Lh`<-eq#|Ke}? zusb_9N2@E#w6?lT%U2dyBphP}>=GsWa zdi>}iM{?x^ati2N4%@nMeP0zpu!~|{zpbjG&MEFKo8Fmp3@@g zZNU~8SkU8YX$0C|!ob4k04SJ6s0uqgn?AOH@)2EbGS%rdZy0CWx%Xli_v7UyPZ zd3i|%*&+B27e|Pomza&l03BT7AcU_jXik$)+dzPQ1@m;q9i5!eKESvA13IZz7<8>w zPwB;rS9I2F(NM8SYuB#RjrDc<+h6`IZEtMQyN@5!`%jG-59Al)hY?34k}xw#op`c}O&wnxe)1SlwM!XajLp&w_br)YM1nq3J2 z@(c(0PYP8u~u89R^_n@U~Ol6n{Z2$T~}@0JBkUFx$7)-B9dKn{s^8+ zUTWwntgKdmR}5gGy%oeV4J`iK03%z^^a6#0f54;ytRfL=hmMwLQbDL6fS?MuGy4j_ zmFQi8eFf$fo`oJ8ezSGsiupCs{Yx2FCJHZkg!+K8UMrl<4dLAS85EL6mUT5)JQUCj zFKzglXuq0h^W=upukq35N_Rh=@g)mq#s)jw1ln6#&S0Ndc>1r;{4pYL&z84|P7JcF zO}-}R_SSg`^?4XegxmI&>hpM!^H`USYJPDu(=q_dABU1I0QOR1Ji3%@SCiM5;Rx%+ zs?anNgEF12uU-y>6E{t=2+;vEW22YT;;ClMYUg-Rhv)4S3n!d>@wwLxKDSwv9Zq1_ zGKWA;Fj5gBDES62NZLzs1=kjgQpwj^z3;_;j& z&8$m~&61DvSWxlA4iA!=i>D3b7cG~GXeCW_rlixijSa>lzn5+Q-B`uf_DYvLvcRuI z!Lr^B-C?_}jqVmJZeJ;w+Ym%)@SmCKW~~8H+V*Gge)lF0zm3{BD2KNJ>D1CGWTcZZ z;}UL!I!DuEIyG_=DJ3>lp=pYX8BpJOCItBfH+VTKmVTUJ8`B+?oCMZxcvYA%+Vjf5 z`kx-m=rFbDN#Q;qTwesb@=5c&B;e+~TbBLgDn}n#bUk-rfT&!9nO8tOC7p zHdheQWbvSsF&bERi@_EssaUi@E29EuT!o-B)Hd?1u=WWaiI<~zIWY?>E|9*BEqUic zXt&UTy_4H|DTV=H&LV|omy4Nf^KLGT)|%GGj>V*hAUicP_@_)f1N)>sz2=LUGyyFP zyzs7xp{s`JJc|7=rh(|k$lubQ>3$F0J!C0WmQDb2nu{r12#2Xn!-Y#)nwzHOg&7(d zyrhBl8I_Or>G=4F!5icT0qiSRmT74jtRrCoAu`)%pM6UI?tlGv^!LB|g!T`PSZ8Q) zex9x@&ePQ7IDPfy=X6r8(CW1{b|r!?%-+E`~_7gwpj051YqNVGVB2m*Te$Zp;Odv{yRuLAdp2N;9_Zj2^wSq9#~Ks!1-WKnRq z5W@8g`d42(dr3p3F`Ag15?8DtXh{vQOBUJ|Y?W5CNvl_v>Gt|M-Mw?0u3uXd*FU&z zI&B%9*Km7l)EO{1IM}1|@i7Z!8(V7tfX?s`%`Yr6hzLNUR4g%|0CtW6Skl)*GXz)^ zx)6fVV@w{zp9F@0HiQNigH`|rSqz?q#<*PpkX28sRH>9{XJ>~6{UO9(shu(l>!ebl zljCEWoS2}QnQ0mu6_y^{B?0E4JP^N!s~uQz&{h(*m>j|j%*N@^%+w@{xr2o?20bhW zcmZM+sW3Pc09arTDFaEzwsT8!5mMV+59C*^oziioLfgB$ba;HsfJC`mrB|;v8E63T zwz9UyOeFxZ8!und+YcVlyYD=q?|tXnw74)w?Ta(kvBLOb;H`7Xpw<4tA-&$%VDWO+ zq^i}}B@t0C5d{$QoAu1}Rs;2hJ0Uc!7{D4HW>67Ub!Kvs=4PfD5CzZ&pod)um2n0e zjn4r3u?r@cY%B;5FmRCdxxfMg)9m2zh@QWA&i%J?b(yXp+T+3kv#1zotJUcI?2Jmq zVP;iMgZb7GcR{$^Vw{-<7K^yo>ddlh)*H;oW7`EcMAj$+*ml9=c7GpQd2OEKH`mwc z-o5*D=gwPn^X4s@1b|g43V?el(GSh-)tFpnXPrHC=HIWGGBfQ`BE3g3XKl0Yvit|T z4IMLLKcz3(br5cYDyD9~d3|KpJ+U2fxg-}sJ|eF~)@25lx&pEoJU}XdRv~c3>5EXj zq^;l;{|VypcEq83mK7S<6V6u5jw*g+wE{j&c zzVsuluXgDFp{Ptf`oeE&gH2{Cvj{Yd)6BpP(k&Bz5;R13ND7)MyUu#M8M8!!`CvxG zZHA+S@<(nT^Dam$^>na#&24raAnwo=pGD$IyK$CNwp@V2Clo9x3H;9%obb>avH?=< zAI*zIx?KjS)itYX?r@Wu7wJxOP*JW6R!$+ZI>Xrn8+_fye|HmX?U;DV@wL;2ESz&$ zy_zUVUjIgQ%39Ro5zx(s2nLYW(Nk=oi&aY&Bprr*7V?=42Y`Y3Q87 zFFzjbB0=7_RC3qp+`2^|maT*kl>cL3SABP}@tDe&R+ zcH|Ji)0(3J3Q*!%QS!d9uXKa0n`dm&AzT}NZiirTGYZD5F+>bB(Lv=R2iddHfrHB; zN-!B073NlubOn@VQ^9)O!1D5>eZc*wZY$QOoQLV)nEqEVxvV{;*w)K|Ma$S&Cqb(4 zz3|`0j`I3LU^cnve?jC%*Ov;eIVK%zz!>8|7UD#4%oWwzoW()}^std@>@RcGbhw|RJ zfs4}_9i1G|=U;qIpMLrU{pyoXsorR@%iGk%1Pu-l{pDZ$1#NF{(TCspHeFp=;r;`7 z_0{v2bmi(Q-C4g$-}~@e^xl&v%v6Fqnq6EN_=Z{-3q>@f2AI)-|1R3+4E8{WXLNK- z1*73YC_s#BCkKeiDC)pJ4^BUh$zg+xC6bwyb#$~(CuIN>O{$-s(s8-M?t@=`{gT=R zxKNg8Y;=skc9OX$Ohx%$hvufHX>o3j?%#WhZmwSsW{v^H(l-D)_I9^vXM2k_H(t@v z;XVT!Xg>f7IJknnab@W$t*)%m)sNIR>^3 z@)ppoP=Hnv*k^FrgUx`uUW<-Tj_Bz4h}|dwSb}|2snzK0?3~H~ZBCA9Vr-12rY2}& ze2hUXfFp2CM4uT84&Wj{8?aqO02^$kb9Q}$+u_3e99>;nqLr&ldVwkKfM9GfqeNW? z0azhj8|U`7Xf(my^n&vN;0oXjY%#E<4vvl)=qZ>wyAoRD$Fn8_7l^8fXAG~0 zNnn9>h_Qo>Rj<=m&z@1OT4f*+np8KgU*|T*cmXH{HrDXa0JF5vXK2sHXh z5}~lK7{IbMmEGYbiYv33+X7_a8F9y#sDLa6Z@`sCGlWRHxg_$xH4O%_z~XXir`UB5 zaLf8A>}e63=VukbO0u?sb<)~QFONJTW0ySA5aDHqt$9JXi_``=Y`%C^beAQ5)0x;` zg?lY~#JPZG9y(+X#CBBxEM3BLg_c7d5qmf)P2Qi0O+eY&=8 zAiI|7v)rl2vRX1owCjN(yw~$fr)}S|H_BbgnYVGyU@i4zA;_$c{_9rPE~79ta^1*E zz7!vl68E0H`^N(p+Ja#Nx{Y0C#a!a)HjnF^^ImkYF_A==wI89d%oGu$U4`+mo8=smLZmOgke zv$^6A?aUAsI)G97$~S(fj{p<>b|sS5BhWW0N^%(5ypY_}v!raPPW7?-)bjZTVi+vx3g+mRUUv0c`ibZ6b73K?)^n?ig157sB? z&mPQpYiMqFc5~@iG#Y6v0Dhz!js7pcSpZlMpo(k>8;7-E{J}WX!4R-YBDy)(L9npY zg@Q%gmBE0`v7hu_pcJTr)Xkwo+hRisM8suOG0F~CNHg6Oyai=u4= z&;?9}(cvPEl}hyBEih58GZ+P(ZW~YN1GuJvef9d~*Yx_;3u>Uvo2Q7UN1gT=YdOIM zsd?U}>A3}3x^k87-Frl9Yd5sqh{gz)NQZRu2xlFzA%IZ=VzUcjTMppH#P}$Uj*c)e#sC$- zHEkDwQD`54C;$vlNB}2rD@FdLp&`1qy25Ukh)P%-8DRzs=8&^D3S?p|*!bt@gzO>- zU`w=%7+@)t_%pO0BKE=c5x*B7N~Q1PUo#UHO~-mKp3nLy@&hc=GL}GAZ##83Ct{X1lkns01(URcByt0-tREQ zOqfig!$UMVHcB%S<1{k`7s4R{MB3^is+SXJGmOKbK>&@Ofr-8aPzRClq0$I7&RX>1 zE_46GYBZm768*opu$TMV!c4G*wh8TtyK78rzZ4Fn*|!0Gt~M;NS>5uFl3 z{|#p9G1HORal|g7hJM5tbS$j zYglv{d_3)3*hci=f-I)b*W$2YGD4bDIoCD^K338Ss1K4BY+Xvb`9dX)3&pL+ny z9reOpT|YbKymLrgs;so)&0x<{MEa2FUWw8Vkyd%eZb0)g>2aXSdM$Ba3O4k9Tk7|G zQO5=Qh)kD}{LgtA0k8u-!on7>xh4=-(f!1wXs%`Bc z7#?~08N%^lIFH?v&5p=!ssz&{qY(bU6)`LNYx(3;c{);I!-_3W|7T^3zq6=5+BkWS zbuVs^Xh_+O?5le!7?$pEA={J;@G8#P7Ac+Wi9>bXc$Y(g{HLXm9ba}kCE6(XBYgZ# z%t$U!mFkSlW=?1ICYeVD$u&Xu*(i^NGcYkVlWo~$a5($ib%IJhF?wAR-4ONbk^DG)1lxfWW7e&?5eE)8JG82xZKncPM)5b`N%W@zEepJC<0W7g;gDe(I(+!n`irQnfLIc8UVt4Fc;(HrX?`$} zrMfBsc;(8ZJ705!GoXxZf^ICsdj%;f|9_%4O)r{*kh`WbmpGr6Y_0_a3vZvp`R~?Q zWkI;IhEV|3q=(jl%Null5++SY9h5pI``-f&ICP5ZnlaU^%m7nxV1+0$enSHY2R4cF zs4O_W?Z;u%4&YAzNZmKtwMzTg_FYyUsf(14Su_%UQQA&fSxz+HfJkL|;d5h%0R&}0 z?Yv1vx}?#e0sd->u8M}tEBD#5qo;2_ zruA#rX&L}lsCcNN>kLv{zzwRwU@aIOTo3$@-Fl!E1>y2yVjVGH)7BT+^Lckc-Y(%_ zdT~L!JG=Dq#dG@N%g^Y`FF&W9-5q9N;V=)N3}rrTw5Z-Zr+W_{bF{T_2VjZY8<;8h zJ%Awucei$%?%%yjH*enL$Z+h|#~NHR$2;(s001BWNklZ5o@Hq?wsT`ryOw(p&c*QK>k_Z2;f~|5%o93Kv16D z-aLS%qy}yyJj2g%@b*D ztyS3Fm>F0jqqMrV#>}e+4<6FpyZ2~nYKH5|0G4U6sjI8ZN81_5zolOGn^zD1&vuFK z6$QARo2Gj%j0CIixjljMBLRN1Ti*q@9RNVsFafa8N8n)=#Qk1fm<7m^APWLw0nk+N z3ZLP509Y)xFOdeF7`%a8?7ApSEm@NV&=Pa)?K%E5FwX;IR+fON8-=cyWDMZ+X-F%u zweuGPdI{n#-3*Mf3m;uuI8APAz0eB!LoR`m`yhQSaSqMir}|HYSsksr*5gnATr{x! zHZ4aamwI(+mu3uyr#C>^xIvsuaxBM{@GWlNB)TZ8 zzY?3+uraeM(DkN2=$JHbAX!%DS`=i{eK=(>Av1~?P3Z1}xsSQvj96}7-R7&AhMe&n zF{IprlrmVsLM2v{KZtB}_qryGZ%#kE4zL4YRJXjUcAHmyv~jxNS>rlssoh^O`=!Uc zHXGQrIdTS~HN6M0G_#yM-NzZ}r7su~mLM@J;@4v!IsE%gK;~q-N0sPd+p`9nyyBy) zgnh){1ZjpdB8%S?4n<8hon_x;RFGUcKQ5L}H%u?!-^<7S*`K(OZ_*!rJK*~wJ+zW* zkZbdxYN>Ts2d+0Ap>>vjC;HBrhi<@me+wvYi}@s=K#UHL-$N9_`?JD&P>W`VHxnY3 zjjA!I)ZQ65r9!NBU^51m13>H++XQfRW6hgljgDmQ2hP=jfh;>v>89M6ObU=VfXc>_ z{uV&MgFIX-Jq*TcCIeW?R+6??BNn;%SvMdHU$1!9+Sr!EiDzAT7edS5C2w_!1}m>8 z%Gyf$?8%BF01+RXm5pM+sNFDo;7izWaH>N@yJRI23wxYJgQOsBmsKu-h z=9UG*{B~Hu!N}Q=;NsAjLd;xn2HNj_7{F525lSoRNV!GmTg0D5q+12yFV1MB(4q0+ zL0X=lrlt8A>YO*|yji2l$)U2ZgiSI&F-^n82^tz6=Lmv0-nCi{2C`6Jqz_=?`HL6y z>8Jm|Zhg=Ws#YolF>SbU0YsRZo~1_XoQ}&?8XKRag_&9U;OV>c_`xH(wz|e_jnIJF z+&~002x<%ahB%5E12ituAYASSnbqQ5jPyVpT#iW7L9fi(`I62~Yjk|LPaCga(DUcd z>DjZd>Dkv`(^t>FX8ok0Vu=Qak>3!tF2Hy>r+40cpT7Iu@35#k7(5ag51-P6|Y4i1S+Szzc2fG_o91{0Nu-^b~0W`w60V4L~sJ@K>9x|reHZV*>L!&e> zFsw!rT2mKPt3klNLWc(jbZ~SifDM49Gq@L)>EPgi`vZA#l**A3jgCOX9bl7;e`8?@ z7$b}?FoEz5m{MR6RZfoS%KRMNSX-l;*RRpi@-lx829}kPfia{BV9?EJe`#U!!mf%< z{}1`1kQko;uK;9$K?c`QXo;Z>kB^QyG9lb3!E*cdw?1SYH^i9(mld%biJ z@CRWjgSCp;XO~=_vx{>Y92(|mi#xk}46tEbEG}N5^&9Kl=VH@g8zizK#tQllj8UFX zx<0}^*YvFbAfjC$QqL}g0|jA$srWzZWSv6)3yiN0yCtrytZ)RvhY#PTd-opD%=8?M zV4R*q15RC<6B{MZ95&My0$2=a2WKvhHY(;#wqfCVl7mv{Y}ZjE01s>m%G7MNcuq5r zrLKfbih9esW z>@!`Lr5s5OEO&fz+jHA(+D=YDAp?foR!?8#{x+R9wu`|!mjR|Z)~{}4Y^^kK%hqp6 z%8yg)y43zYL5q>D@pIU96&P3{fR((ZOswshhp;Y4O#T)**gwAsSQc*tr*Fak`?lM+9;hU3`0NT-&i*8**Dr(cvm-L5ZM^{ zz3Tw5W}Mp&>gfP1bxH8z>AI0O@G7`56?_8VgSZg7LmeX;GKeh7m}qmzEkACLS*Jsz zEb&HM87uPd5Ww;`wgP}?3(L+_R^$NSl26pdQP)XZFS-BpJqEpa$&0qKhG%iYQU|M> z{1x<^{uA|fAR4o;gh9jUCq&d`;c;Mr^Hi|+?dCXpmZQ4nh9-vqDUBChSN$Sr7~ue4 zD9{KPSa97^0cUP9xDyTx@WKA^4FU(@!+3)# zC+Ly}xG&%P;6rBV%+5|T0||ftYdb+9jCGLUN-84W(001Ie3h1#mT4LQo%P@4C2ehP z((`BkK$W9yIxR!{s>P!8M@NVHb40Bcz%ghYozq2Un7;p`-=+`0{e4=${T5A6PqP~y zM<4_SqS5NWtN|FppQ-DcMDUZK4Cdx%`}V>B1n@_dg@s`Q0IN->r&V?l+lP)6K&-Gh_3A>$vod_^+Xo#6r7^eXL@bBZJ z1DZsn%eh&)duyH6)~@NHUI7Xn@61?b5M2QwWo-(eA`;Y2&rh}SSY#ipCb(?2TFjUN z00q%?=siJnz1e^}EHtz(X?Av=-h1yo*5xXo9WI64#nD>B~bh290|w|{uR3^{y|ziw#V&_@3q{8^H`3iD1#4dc)I|H8wW!&G%c-~# z@|vkXj(KH~5FxtGF0kT~&x|b2e}I80=v=X2JJL~>7RNnB+0kzn$yZ$oO&H$v;y69E z{Q>}c@X9f4tuJi>(C2L1!fEMchX=6yj>%r*eMJOjc&``%pLxVFgICzcwhxfseh(P3 zrxQA6p)P3nvRl0TF3;9>eoVJ}NdT)5qHKQs>;A7^XifBX*iOCovifrGZD!96cE8mL zHn@r6#np_z%)v2Io2~d3KB`*chCVT-k`JbbTc5p@muBC65p1MVSw@ogMlpuS_oYe@ch;d*3|hjPsE7F7aPDmF$bm18d^U)TM^~93sPd21(f_%hxXX zuYTHFj~xP%>(13Lf>GVw!AU;PDVCqFQMJ3awRK5&gPb^`Xx|4_3~wsCj{FR5o@Cj* zk;@P8pg0BP9ondgowzoCHliyqsHS4UNa#qE_j4nnq#W;-HAZMkJ zZJroiDa(kQpXhGq!cN`|nnlViLoSjbg27aV0m;29hYhm?U;LJTFkz9qkTNZAX>9rc=4vp#6g~{rmspFX^v-@>4o2SLp2Gl1gLa z3{v1=`rzRsdiUuQT3no`*_kN?*<@}(e+q0Q00C$_MCqHIo~8Bmby}ET;!2GF6|Jg3R28G7fPcNoAz|AC3d`eE!E+2;O1G{#r2UeO_gMW+mE!oFgBpnZo~ zCkmQp8a0pw>BYjaM%w^@Q0S7KGk|3g3)%jfn;mRG6W|p97O>IIx$@F~(zdYS2rvNg zb})&c^>ui3O!Y>Ch2WQ0R_X5TJIb&U`zy>)W#L}5*^Ls+Ie_po-=!_V`eLoK3S1;l zIocq@Gyp({BH-ou3Xjvv$h1l5(buC92xUU*ks~Hh#wPZH>RS1cLHDuFy>t;jfExo z2WHIvsrv{1K4hhZTe!p;Cke?~nA|=2h~rI_t=|d)js!&9KsaF^I6T_EDY5Nll}^0o?vEUE>l&JT z{Wby2Md*5%U`9|4vn$<4qw$2oY2R%wW^CjDs74^xe|~M8{`9T^SayRc3zEB~)cqqL zUeo|0XMejXx+>!OBT>WLf414vEgjxr=9LTWZ340)Sj&R23Sc1(2?=hRSpsZ%y%oL1 zO|-Aw7sWHhY^;8+2p;c8pkJdbBZ0B9Z*}<1sL9bQ+^q3I-2EN&YM1V^-t{-U+`>u{ z)43Ng+fWw#Fl$NM9B+sVlNVygVGr@{aIl6e4hxIJoeUrrJ|7%p0b|xGq5?I}&gm4< zy>Kvv>zB4I+N4w(=7?@ZxF8MJ8RJS1zgRl%)mN4K4Ava;n4|gZtu{I^;>lR?mfDD z>o(n9ze(5OLO3lNSZ)Q;gRQu__;tl>9*<#VY;ZAbTm;X`6tQt<`vMPOwdyBSKH8=s zYH<|9dgGjqPO9|3{qO&t{__9+E85)Ir*geX0}!q*4Ddk~QPv(ld_YS}iwxL+8DxUu z!^1_^gDN8O9wNIztb1gXZr!}aQQ^SS1Bh_mI-}RGU(vHKKVkM&y>>+Ha{vW32C(3k z1?COAH=Ui+-u@vSm+SPskAFow?7GVB zBmkD!8310Wp9sH0{|d+FMg#6+rwm*Hz}ns0qiU_rHU{N+wXs39(+0D{CMG9odTN5^ zW~XU>K0Ipmgcwut}vy|Crppn=*bDeH8s|;>~7+2^IJlDP~Q0=ryW8)L_@Zlo{ zumJ9u>!N^5ZJv{ezPPcmK?eY^sx_X=&{N{}NBa&A2!IKfK(O&pZ`HG6cGch@15+30 zEe5ZKh7eh^D8R}Y06Ve8c!u2&0d_$Xi$PH^=zN4j2&`A@r&Mn?8NfnhL;y~W#u+Ux zF0uX^fN_AD4)~T8h}#vQ(`X6hlQjk-gI$7Qry3$qUkd;%3?;4;qAW5f2(7FpU3S`B z@0pn?TA05=j~+dt2M^w+`S~j}Hf{ixfzN(F&UV#ld?lAQ=PGW`C}@YF%YEzEJu=6| zs{8-M90+6C*hIoeL|_KYtuqF&V3*HwBk-8Wp@%2uZ zIin0cKZ@E>6AjzR29FJx-WX+&W=8drThuq`$EYs6#msBIRI+^@dILJREV%h2#BQaWGMB>Y zbTu5Y_49e9x+OPyT(W$beUJc(jlCPZ7iH$t@Go|^9JWja<+n6#^AR;;R{hc~onbG# z6~x)oWTVUWI5j{b`*F#wQ3~H6b0@E=I$U-i$uG_ z1l&bXTwDn4rq}X?zKR?c4Ahdw@%B1sXnYv>luK!(9&*T3QE_~s2WZg%lY?{Dv7>Dg zvW0DaB$s&K2}w{&%jp<*=1QS%CmM}UZt#7yKWk(8Os97Tx=IpV&a)n53>mn{tOZ^x zEV`Syaw=0u-xu&{kZi2dBiqK&{@OCcrL@;AIRG z$Ewom8i2*4Rv8v{pwSZYVP&XrNfQu_E)CJh5Yc6$LXGkP6$uAv=oW#=BkV35W=q8p z7ECXe#%X+VjwYw)S;XBP2VG=G+2ftJnhaj;?rhQC-Zq0+mD4(H?}5E@NP7oIw7t7W zTU)#I*8KoIcA)M92j~vXnZ5=3;4Yc!cbkqo)9@>WjIsjyo!?{D4 zjkyMq?q-=z%X>uaI)i`!+z=)4|N0OA5B=ole@EK~$8=I{us#j|L}(2my4r&W_h{+L zBF)WAYnuss1`*nzt29z9GH?LU0DuEDz5rm&OivSZhTxjEx$&Bwef25r?YyGHy-jM? zD=dtDcy!3X5x}2%qs3!kV{@DK_G|Rf_dli|{_r>GxBugRLU-=mW`F~1H`ZSo6!6pB zk<5U`+a7Xku}~JvmpCxt*sX1# zKu8u53X8>2dh6ajT9}*Teq#HkI)%s^fdtBxGK;t$?C-J2y#P$OXaH!XmkhAM3ThRH z;XVm{yrPSe*=RPHy~K>IVbKu7uw=JEh}| z%3YYM4QDoz(`dvP@VuVTh9lkZjNw)+9{e8Q1j`aZOho$%ZruQ|U}MF7(76y|opcuh zaw+6o>v^mhUhP1DYJNBM(>6X$+uZg$26NAuK|kp< zj&{}fGpp3S4%0!7(d%K~S=u={WHe%4O`?;TCio`popl7%Gg{6NNzSBnUVd!H<0Vco zd63A;&d-K$yt^9$J4EOqF)nvJ4by!c_Ok~^Lx1etd6E$cuA3#}@3g|{-i-RuC6smS zi!4Mp8>nV7RjwT4!MSxwFA7lW!Hy_{topfgfuVT`;5a)|mrkm@0XQ8uN7fw3>8oU} z*8knm;BL#Gey0;XRU`f&e82zMpIXndUJV#Ke3#d?AH$La4VWmqpAVr!VrIHIW;`|S zLcKmWSImN{Zb1O)Hm~*#DN~Rd5Zf!1iiA$ z652-0yMMMiM*scoNdd3|Hcvu$);8+wjvyQS(6S&+KEN3G6^_Wj?TJ*r5Gg2yXR5^e(U|L~DUt7CIYbz@ZdX0>Y@Ue7n zXN#i`zI^@_ZM=R)m6Ic8ULpD++_KKkCHi5dTBog@eL6h6pznP93H{)QKc;{7yZ@XX zJbXZ{R#SilcI_%Mz~*NWPr}SCj{B6`L;zM9`FI=S2LKk_$Evh{a6tQqhx{8+5g{nQ zySvZ*iShy5o0|t4ZHnCh0m6#TcZUHHfS{wL5{rC;y#wF|V;La309Xxf4*^=%Zw_9licdTao8prN(Bz0FLy{rx=#nqUhsHUL`k)MS<&A}*>pyMkCI zDv$3j+UMei%+V0R%!4gxJLZ*%hXb%;T{U${WLBgy>i{0HU4R}IbgNn|Iy^Y0SFbmC zyiQF{(bVJwYqh}zQgo%n{s9~Wa6UFtq9WV^2Zz|b6W|#$KZj4e-f7-~opma;0 zXBxW};`X;|5vi4>CvJ|xVFdpUA{R1)%Vn-`lL26sjthvQDce%v+`y#I<6Z=O@$yWOHx#g(yxL!a%a zg$pB2q}xevtP_n9rk}ID35ID;_pzv_!?0*c zmXhVvJHHSWPmKQ{aX)6F^rG`a_HDYm!d3(4$ALGt88ctoE0JRem}JfsZ=AvdjEwuN z|I9ry>YL1m(=$hF(tRr0x4j}0x{CVEme4WY0E}@Xtarb=Vg)Ueumd@^$oZrPway3P zgA}=IlI6;pBjNmVMF?+f!tHoY8J+GUE-plvW`y)4v+KW&vj(4}l{cSsbCEZ) zGKPd7i;{AptU>#w!7F>ROMNoh87vcb^_^9hg#E~#fax5Ag|q8gn16W`Hd(4>88*e2 z!CEl9;Lv|ZT7AJXn`~$^KS9~UYW(ii5&G|LO)wh)E+htGS?F)kC{le57AUs8vGu93 zmV$kgPCh&<3={7%hR-Z=k}!NsXja79y`m!{f-iEMN9N$GNBrF8mPbibh)@)^9 znJ8=)fFzn;MZGV*TexZkyt5%@>vRYSrWQc7(g7`7-6@GtvB2){B15l zB3$fQr~>H8L69|RSP(xv4EVi@*f?08V2JfK|eW1kuV77oAHQ9U!_gJ4qLfD!u&jA82p$Ii2jk zrrC)iP0!3QtLBJZt8id0QV9Uo*d&cl&d{T`-=%jy_zqoON`ys7EGa!jfFi9wG=r+u zW2#n;sZu?mgTrHbwXsQGJbOmJ`s7mf30NhOwfJ2y?C`j$K@K2%Y`e;v@k!zAS_%^<#;dqEny%Hvpc0Q z{nTxlI_!Q3087|W&}15-(c&;O+pa9k(dyN!G&woJa}0F_fMhiiH#}h!aUTOD*15v0 zq$Z*bwitLC869O7EWjAB@xUTNo=6kyFo4Ejy20faQS=bO52E`FIO$vmFboD(rBb1t zoo(9M-lEOTO$M+qHYO(~87Q)OVdDO<(dNtHSs~0n_IKrja zUt2d|-@pok%bNu4z*e+MFPXqI7W@eh1e_&mOfE?R|5}2Q3!u%XAirXsO z5o;285bY=+p#bd&?qJr(Ttb-{cL^}@oQg#Rei*06Z$G6+4@db$r^~aayGR$F1;XV&>b-4(@xWmPOu&)3D z0(cVFKWR&uKMe8c8fy$JcF6?`i_51jgnVfvuKJvgvTF^%Vz5i?KYly?D<|46(@`b9 z5|IyOn#$@U>?mu8G=L>*jdv~NdmFAxHWDC)!gfV|mul>6vmLgxHyuVi>2}suAfa6Q zOMf5BMWzt1OKO^wNzNAxdI->JxqT+v^C$l%0vMUV@2pOWHb%~#zrledBZXa zbg$%8E^E`!7a)^NF99s%_Ng5v`onyB)*+Ekch{NjU2EvD4w{^UN~&MoPAMz(@M+s< zL}x>N%^Ty48V8oz84^86B(Zd}7(E7YP?T;@y8Cxsht>9EzLLqnN_DY66bKO5i!o=7 z;|*_mUdbn^;bu3lecGV-u~aW~t9)W%2p5U&tsBjroQKUQCu`o*zT{wIx$h+yR{=9c zU(j_iaI}l(ahLKLyCOZc9CIVAe77#^&%X9(otzB9j}s}RY;e!k&lr!vQQV&>0w$Kv zB!4XGh9DU5;j<3F>P=6Ugt${P+;!YOp!XWxt*^R{*gofF)}%e*A#?Kq+}2krQuT^*tSc74nNSge!8u0Fbn*LP&O(EM}*Xoo)s6@{D9 z2)yDAw%(f+}4YRT3wCHxAlyj~!=~C+tbateD!P3Fu4}#w)6(Wg&@d8E!fT4i_NU4i3 zFb*^TeQ>J}5qOAb^e5@L;sLQCgaA&ME_|Q9Gc^R*l-7HtjN7Y?J=_CqJcM z{OWVsKdDlse(nymXvga}ZqVJ^w`pl{k>=-SXb2z&bd=gsW*#p(HXu;mzG%~(+qdcF z`c1mFwnpQV0I-NE$49ici%5i@(TnGw)4{>6FrA=xbyBA4DFnk$S(B?=L3WjnoVdoW{Rn+9S0=<-~>pp?yI zk$LTsCWyvr>?2vHWK27+3kI+x(xUq=_#RoXD?I~L!n6W-#p49}SIlfx=9B?gOsJH6 zB%-RFQ~X?ES3m{3IQe9i^!)5^?{X;9lNnLL-o?&W zw%bXZw``^>12wgKk=v-iPPmOy0+@2Es{JEai?j081QXfuTwwNGaKRG*SlmLYQzrXQ z8&?Kk#d~YF@K^=1H)r13b=g^lt!9tqFp@IQd$~#5j=A^2AS`_X!s^9>=uz$Lud~a; zl)7(}p6)QBcZJ>3n=2*LKl^wSpE-gpo_2h8fxVCXH?EMTpA8=%WGCtPvY* z$s?NWlPZsKkl;zZ0zx z{L$ZxjLXn#V8=7HpLv&+W^f1&l0fmh<&YXLkx2?9Z`8(x20lDQ_!raQYtUO-m`tE0 zLy%l-T#&ZbO+E__!_m;yVG@ka+=-CHd@Y^8q-2h@jBe_(Qc7v#`IG}Jg>GiP{+3}z zJ#=vmlXGRU?-J$BACtVd3ECjBu=T27qHppVsK3?>vr3zR-geuK824zBA?Qn?ELwdo zwm~twGi!Dxn?(}(o#i6^H`mAb=AT_fR3pVgmFs}eQEa!Yc9~&%Ori1d<>%X6)49?x z*S<03&#zf5?4VzM49_t05}+MB`#1Z*seCl z4#_5^1b{^xq;c4VTM!GpL+6II&MeBddKzJHZqp{kU`Q|jb#K`iBUKn7vw&LX()eg34@734z?6Y6e;@mjB`}jWX z@4TdE&%UOwzI;aIN|nC*-H&K>?FOCJ&uCN>Bh~sX#LK82VlALd1OzWC}(`s<(k4ZYgfro*EOUB7vo-nxC80j$-fWx9Ut8qLnk(jaRwnJZf` zUz5hn&zY`EW!B~)cmV)bt3r+HA+=joc2V0qIHb+(Z7%CC{{BpCMVlMXX?yDh9Ut%0t}>hU_716BYtX?#nRfS%=@cN^#U(v`=P`Z!(MR-O{_!8t z)2EN=vJDL?VadRS5H4^4uw?zPAE|Q)JS*prKlf|3%_H>TB{k|bI<23I==sSpyUkUq zHFmLr&e9h2%y#x^@9>D`7nf*pUUaYkK8b#u1p|sHhd81o&r6H! z*`Yz|Fq><6=?cxw&C%rKB)2_WE74C7cL%cy|AFBJ8-qlck;Kn6Sw{?Reqc<28C5Kn zTst5?d4Wz_q#M`QX?AX&!89rXx47g3YT%qC6+H(4Eo&ICe|B%Cx0W|b#2P}Qp@m7ijqvOOPRiL z;yG!4I;9G6|KdbDnYWpZOOyLi#03Hr&_ zXT5_YSLxoi)YT`W3lbl7(PWc(74>E>gAt_X9?kVgjS_P)F)Z##B;xMrAYtvwGjre z#EnouEZkBXqsRA?MN2YM;CUmiYT>5Zxeuzqtb#r4D#6i@{O>#fOEg8oh@#x5AEvF>&*=Hr{DWwymzZ{4TKnK>$#Pibau zfo|V@K&#ho(bct^blCy4plxJrt^gmvgNutZ{%K!;sR8Y%2D5k&u?^7&pTFFsXU|{J z!qO_;SX*Tm!qufEx^e9~&CShIaR?eh24G3MBu81iH|uSWJ@d*&vyOQMu$rewba7Ut z)_IFv<2JUo>8C&YIsM|3&uC-kfGUj^gG1;j9NJe`SLycpInt`b1H;s`Xbh-xQgIyl&(-JMsozqdh^3f%Ng=<64+Xy@RF zYNsgA32kj1&`G&Y&3c30dHWH4^u6!VfAuGSOz*w_gaNE}yUDB`lo1RpFx-R{Xl>)c zaBs!b2Q=J1yU8vtW9R2hYMwQzS}D`f@gV~?VD|vTK%~2q>M83+l~3#J7CJRC#u`|o zBO+iAAP4_R;D`B$M2nwp}i>1hTKQ67Lq zHtw1EG&Cf_=E}n2XpsyywpkP(Oe{ID7nr@ok@L>ZL~wj&ibeMUDg(d*I59mlPct*~ z{Cf})ICU0Yb}p!izyy^lyAU#nwY|-N4*;iX1tR=aW+S02h`d;0;rb%mV}Q9FS+Lcj zVTih`2s+jVu%DQfRw%G`7FbTu=0fy9iNY!1Ha;uC1(`uF(X2uQL;zjTt-}vknwy(D z?1I|5IH#GJ8JeD+mS~kK3NJSnm+Y=NF*ZtL+Gl95|F5+xZHnu-qIZU67(gp zk-(Ocs@P>qfLy8kfRvq|kg}uvuQ*@w8}cEQq$;12*s>GFyB4;AVH<|Wz_7T^U3z)b zv!IBou{>|y>(}e;?$hU;2*CaD2+Gp;+(P}Z)6D4DNSe zu>!mThzOuc#o7@}13;Y@a2F<)u$EPiQdwYnBB6+ucL#Iawq_Ft+0= z*zQ?a%6QI!SFqVOPA#~K%+sQY#cM;YGvRjyZhPitsJ7X*2yS_&m2Ngwt|u0W!QqjR zwQ@U$K&vxvfpg1ynQt}!t$Ed!c7VGF+PQ4+ex?9cxBv)Ox2c6$YLk_kC-OOU1~7MX zY9rciL7Ga_O_V+0AURe@=jpANMQJY+WV8%!ec&Y*-;z*1k8L)l(L{flJa@l0O%jlN z<(syZU6m?B?pi1a7i1^Z6_PC$qRzbU>tO@hrCM9|CHZ1RH{>^Xt+}*2+Vr@%5u)VM zY32Jy3xJhpL2`au(`se!wHfGcTuJ8q39M(pSRPvYi0)i&csdtRHK zk{W)tk%@ov`HakaS70%!$(B5JY2o1Ku%7Hh#M-r|ev-5gzKr4C&vmITwkU7G)AU&ED083a{*g#o`b=kDZpPqt7V2rkTFqI)^1~{2U zg}5WYolLh`5rAbNR+@puX$8W#PDoWFANeEbV9aXAlud_dYuWOa=Y)_EiC=j0CCn=c z)vj7tK{P5ZS2#Plc|i?J(9qTlvJj3=RYHptbOgE2T)OyQ6~y=BMcthO*FgYSa2Yb- z3E%|43)C{Z{~?ULYcJIyGr@4xWU<^!J&P-+MfgKMkVsxW9XU+m8g$G9-t0iYT0^uW zlHu_wA{m}jqlpb!Q}t3T%(`zY>B3@RQ17LS6Y4w7sK1#};q-|1cPdm_e@-h;zoi$? zU(jn;uhQ6SWAys?I2DS6RNdL5iK!WS|AQsEIrA2cPfRBOESU}Q7U(@4W;HrF&gl3! zqoX6ZCLXcd5%P&>b>BT*p)bCALRZGd8N8aBn53DhDZ2IMEqeX>IB(9u_>f@{lqF#f zdL5F+;;?<1^j&dxJU=<0<7}6jjT&#pE1O%ivc69L`uFGb`G3Errz;iOJ8V#YX^7q5 z0Gv$UoTj;3x9FXPdAfJ^F1`1QcWHKZmW9BXX>$Um5!~BO>8yFefHFV~lnoz%3~1;2 z{yyzgH>kR`LOa{*lpXF_LKtSYUn zu2OXy8eNCF@jr8$|G^=+p^45FMAumWy|1Y5QsVL_u4Zt3lZbSv2WB5J0EG`U;QB=e zu5dy9MWVs}es=K_Jt|>XL2F5X7|~Snk@@id{TvBWBJ~x;#ZHCd@hpHUfJ0!FAzd(& z7{D4BWZg03YjpG~jf{@b$SB^4{)ip~TL6J`MEX0R^~wgj5pHZ$m{kQJsk*&Q+tsQ> zhNKGy-oUgf4GCikz!lhGup`Wvf)*0mjS4JuFL^HT^8ksYUZfo6c8zNQyM~8{Il3U% zDG@WTa4+044-PZhs8rb{66svKevPhO8{@h_-AmsW%P=(1Pb1|Lv*zGN2zSxLdR=G-kvB`*XTu#@Mnbgc1Qb1hB+H@<9>{w`&=6t>FMI{vL~& zv+kG9`{wR%>`DW*LK1&Ac!_3R{xTsn{NX<+_H)ep0~pu(I2$Q zUDpbFIBRWe1efs0jx7*ejv2tp|Mjxziq^2bPZjP}xkY4R{%O6Ga`{WWy0t_;tzcIp zkG8qF*CHh|{;JdLRG|FoEzG!^dAhQjdaD1Ho3!&L>MFfCO>8L5>d7c*Uz>?4$X}8L zp$#Y>R3=PRe(j|`qYfVBtJB8V-`LALyfOAHw0wK&cV|@WnN;apOB&h+exe|8W_!cwqe^s4PpZhUnx8u>T-?i&++<0SN{&}@Z#H$T(02U~Mpt99T8R}w&W@+_rO z<9A@W^*)6pTyxbPrVj^l8bP7y?C?_S>vl_=cIZITzG0JA=M}i(N6|2Qued};k;CxB zu*)cnx}4n`JQMz}<|}lwb2cg0bz=*gUZi|HQKCn)WvBmy7GMyEwT_DXuV)Rko`Sk| zRC|sr*f(0%Pyhf4D@jB_RHD@ZSV<9gS+rXyZVA`z-7_p5=aRq|Jflg#Fnek6^1zl_ zKBR$k4hiujTet?UgV+!Fh<_gJ;@9Vft)**=cX_qc2>vVjE3q-~c$Rlf5g}`HZ&b`H z$9zO8?7pWAE#7YMJSw^3O()zOIeMmi>DP5?_xF{ zm{{1Hioc??ty_HPMoCZSnNi1pVS$?G_&^s+G+o#QhDC!dEV`~Cc&KPSU7S;inlw6C zpdo5f;j}?teeqBF+h6`nmDT4|+uNnZ#Rm+?;E{TEOzV{@-JG7K#id`;%o}rbV{(Sh zAmR=d4QpTtqYXgKDcDPu4O(4&#>^dNVVyPcqv(1S&?gJ@!;5u#{N!7@GIoO|Cnjln za*Aed&d}VgIc8u%b4b{0G6RNdf^ZhSj0rK|*SeV7_yM479#ZpYj{z*Odp4_Ew6?K9 zpFjSRzIgI2egABgcIyo)m4~_SqWuv~5C9f*u-;x+pr75nM>nUZslRWKUC=lR6xXYpp@k2>k=?T`1DgL7nz?H)*T#f~uRVlx6$0vsa^MD{EAN4puFrjg4JeS*y~{ z?jdFMI^BKyZCYAUjW2{ZdD&^AQ^zA%Pbi)ZZdFIMLUUXu7$7{ z0$2d+gjI8Juur=?h|aje+E-vIq0dP$0Xzy(^b!Lru=B8S0PK(~`lO{R^)9Y-B5W?~ zD~wMb3t$Nj4pM0Vz>R=d=v#258v#qGT&D8S5Q9GWNT7m(bHz0+IOn>HzzG;P${b=4 z8Y0_Z-5fXg{ScRDkf~H+5Cd(5D0;*A3}2-}5yI;zrD$LQ&^ydBs#dF1*{smo+B$#7 zv-`CgYi{8?@&~bgu#v!)0&s_NbKaPBCUp+CJlGkOQJA?!2ASX<=vX%jeB(ZVd=O@b zusuLML81zL4d5JXH-M|nt!=8Y5PRkTEOzE*#6H+<5a0*f4PYnSC;I_lmK4BRqJ{YdnwXg4{wbJ{f=o8VovR!` zA?Z)(p*APP^PL{jFbD*|UhcLYEomF*WUQ`p)~51N0)>Sofid7h*yIm{+`+yAxFz$Z z=yjPDa+b)V^a6a;bXm)a1E|PBg8^EoXXlE@;G61T>0E4r?d*i9pqBJB@6s<=V{mZg zYRDgAhHQO5mwGpLn}b@|CT`NTi5tT7es3l~r`EDEq#}rc>S)1Te|wqFK!_$At;bV;GzEETSHw8Ep5LKfC#X1XYm zHVfmIPEUqH*T4TO{jRAeZs?w;G^;91D(+&fFOk6%j+bOkqkTndnr7Iv&)(}YtJlh<)VGsZvx%~TuYkJ7=?LD?l3qW9vAGi>vL4@w(wfo5Nces5? zhc-y{v0nP~<@;uP+ZHpyl+0*t7d;m11_jOPvSaPkcJ|=4S1K>*O5!b{-xmhOPTk+> zTB62Y8l(xWlBFBJyKVpKFdc`_Nd4t*&W&NaNB;GZT`Wgkr2= z%-!k4rMh73TB(u20`YaNL4)c$2p_Pqz$iFsiW>|z=N2goc{g_x~@7O*QNT*I1l(#Yt=vmfc3Z=MKvb>3tl@cv?fh7sWmY@9-oeq5>0 zmtX%tqt_;A^2Q`hPfgS8^eoN2b(^(v*rkj$oMh02n;~ygE;r+OuvL1P0k?3>yl7^0 z+Ne>p0oOPIu;3c@_^bcW=}dkO#$04Qcgfs58BuBHG#7_i58EkD2+1F)C} zbbik6aB!&u;4?HdzRHC% z6qspnm#wP{UU_&}Tm#jm5w-&&@eF>ms68SM0u;Xx0FUcZ+#gv7OW9fgj{t~)#buz| z*ww3a?fRGl^TF~0_zS=U0M=G@hg}JwVRn5?7+6RXK$0D7fJTJz3DNvge;*AD^l{`y zxc(ZLgsNiz>qOp!IXOk=U~{P$ zJoioYVCC7t&PbSU zBJPf|GMI#yG0<#c@e09y;{~ z02Yr*XHNVa7EfpK{?C4sc_Cc?82!x-gG98R?=tpz2w>@W@`pr{oCFL}Zvxep6r1AL rdJ&*yL0p`b(Z!W5^pqWIYmJ`(hU-#JdyC-J00000NkvXXu0mjf<4I)I literal 0 HcmV?d00001 diff --git a/linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/thumbnail.png b/linkerd.io/content/blog/2024/1202-tilt-linkerd-nginx-part-1/thumbnail.png new file mode 100644 index 0000000000000000000000000000000000000000..5a5c9f777faa4f7cfeac4cc8ee22ace820d438a7 GIT binary patch literal 72437 zcmV)7K*zs{P)Klk|NvF5r}cRuHydEU|Yt@Yb`pL1{3tJm&pzpkot z&)H`WYy8%?*2?_;AN${s1{q{>Su{#T)XPOQ$_12)ITZ3)YwGWc~t*B|7HJ9jv7Ugt}!}yp^;wWd+m4j z@9qwU%l2!q*X=Guiv{M31*WqF#?v_t+I@WR3Be`R0NOO zC>F3;FJf!0ib^q$T+Y605k=??C+H5RX!pnHO=p;4fg9@$G|Kt-9A~oykcm((=20r- zkz0V+<&DwW|`{~!iYvMWc`xf&^fAV-)USBR3-$31KJvqCn;h9Zm zbLhYM0>j}1`Fu{_HJi^-%I8ohWO47Xi-)IuoQ@_~EF$D{S=?B!;)U%xTKzHJe$vtB z!@cKsL=r8(vHC(6HT@#_$@nwVXZ>y2JY_43@oZtQ{h=TK+fgph8_TB*9h^65GMiyA znd#WsOa{Z*9H;#e=F_=-L*xf=4T*)v?u6Y4KbP?37pjp9Xq3t71~p3sG|EL(`M~p8 zlnPlrDBd`pmxL^9=fn%Kn@!`kny502H~Rc zZdS_Js+F+WD5F*>pi(Nt=N~PA;be-zXo|sjhNJEXNBxn6{_1)SeB9MS9*emtH;oXD zQISGP1<9MD6mk@FGf+~J*oY*?fag8axzm`={W)5-VP`kcReWa~yRBm{CE@)HziSAevS{G_niVw z>q()TOcxS>cOSRVAJ61rWPxRkGZK=kYc&acty++9^SRNmWoc~O$Wi&ag9$o=DLSJu zMze(s&RV&EX0@Pu&S#L%o53)}$f8ilA+LYabDNUzzNPQCJZlu`oayO?;~C0@9EyBy zb`$l(^9e?cpXc?_2(-E*3@3BR9U}yOqL|I!Me&X*$)pAjmaWtJHNBfusMzgstlyB;fr#KyqaYAcG z*TXY)mnq?sTb#ujqL9OtX4RYU@yZG_Y$_D6T`TK>^TwLO0L5ZnR*nxWSWUj44>Fez z;SiA5jdvk*uNuM_DFMR+_bz(460oc(On9B|afPt&k7=IBmm zh@#8|_uhVH^i7RF=M`<$`Sy6j*3Im?gEq;(NxZ2C!vp0U~_p~YE)4z=k-t& z!+PKmEMo8$^duAvS~L?d3tN&rBq)=8L#!YkVkz7TaWs`Agk=iXq!vpGX)%BBq-L&y z#Y|jQ5;90ZC}3^?ctjJrMf|-XtcyLAABdN|;Qd=fn9LUF^+)%sv?;k4M0>cZ2 zzxk|;Rxy`DrI5pVt%zEsXx7fJl}bj1pf1m&h4RV}rqQ-hSnK5i*6U>y7-~fejA^B3 z7CrD@Gk2mg%8O)ko*#Hlm-eGP_r(Hd{V^8w1oR#Z(J~5T?RiILeEBEkjGF&%GaL=aQf7vA%6&XMrh?4)xhxI90;Oz@w?fa1;dpmE#dHCMXv>~tH91ZP`kpwt zFs7A+Mq#H>Qi#7=19*}a^CgK*Y*AM7 zjzk-he8gRXC9nA`nnhZ%f@{7BF;9{YpWn@Y^FbGxJmsk%v}_?^HIEa#O!(6*HvhAS zY+1@_3(b4cNERti&$Jp#id0K4uqcz zIfx=xg)9*!(-|I|baC&fs}RXDf1p^%qh2bYn$Mw9EZ}5lG5nSFib5eiM;bO7xr5$F zVcV5vRUYSLFp?MDtd+3UsGwdedLG9JfFYcTbcoD(j`G@kCXx?Jypwz{cs>iU=oRH@ zbYDFgjUssjD(HAJ)$^k)Nogii^u}`~+ouczCo=||DCcvi=JS}$=TdHY5clkSoyWS| zC=1A8IL7Nd8&4DGv7B05kTV7a@h~|u;ECtFQ7z)eMosr+tzJUrkN)J}i)g_a?hwUb zj88$LMxOO};v=*NQ;ex36S{g!Hl!YI)yyNrGH#JzIuZ%FQd-hz{quPVFg1Xlp_Dfy zhDyVvk(Puf8uE&wdy#C;1Un?vN`M0rrCcH?NGkDG_|7oSZiHZoRHDA5AfDg{^y_H~ zk|?`!^=1$+OrkHhv5$NiCzElOS?o56OyjNN7l zr9uJ6-67_4piwE{bjas5#+61zp6IwgmVnnwIb2(>BGB6st!tVKPUXUS&K% ztx&*5r9hvK;dF+R@kHL3&upVy(mmkU*GqYH$1|La#+Wh8aibmQhAxB>F`ZCIEiKFs zmcU=ePP2^5&5FD}k-f_sHDvy+|N7^nN{ODsZWN6K1&#;gh4e==91{iU_H_~wU70MS z0y1}@DG^E~Pw}fM1qq51P#!*Xznzv(7vV#r&@Vp_ z9Ze55fo?^QaedI2}!qXL*A6 zjbWpQxRU#oG|}XSK^t?NypsN*LO#0=zD@&uZLNYvC68*cAcM2LRz>FD{0l!X50cFj zPPGKh5DP=KhNG$6SbH$mf3%XcW=tq8NlVTq2)YGd%Q0XQQnBAGx6;*I=4*!kK+euf930tBUS4?;l-;h3Ra!Loa7meP)k!l<~9pjbicK z1y4_B3h5XMs!rxW3x7`~V_l8+mZ23x$HTLMj>~gC>Wwj&n!w6S(lby%O9c#OQw$l} z)BAYjBBU*o!9=JY66Rh%pWiN=(ElcIk0p&>l>T zaJk?IxHl+5$aj>Yr;w$9UWJ4^|#-TRg&^@GU*k301A3wfE#&6+GXy>YYRbrP82qarYJ zAOc3CLocD6EI{I(x1|-DIY_$R6cmI)PY*JkS%H!YNI<7nr1E94Rx9g#D6j3_NHWy! zk8rm=kbJR@LZOxc0TkX8sZgOnO29%fR0&e*WSG_MPXxoZxg9D@-K-(=ga6$x=uy)(G7hs4hRLy6C&Fp^2WEt9(f_Q~0#@n6FL4h#D#%y04o>Aa=SCw>I;(adv;A{RMgHkG4cdx^zO`)4i z%t(#LQ&cNO8LwdF>B;-Ui6B}EC5;$i&+BV7Y_63RJ_YYe%Wgsuxd%40WzU@9S2(WU z6NkP-&K7&$RADw$#EEXI&aznG$!Q-ay)hnl27-2(Gf)v3f>ld-$H3zE^FY&i@6jptyJLL$+B$CRG?Dq^|NTFRZ%#b7+g zWHDEKJQz+)(p-Z>vd0iBD1BP?gAmyXTPSDfL!u-KZTvy-!SN>3-4UB+Jj-*VC$ZSr z1wB}0-MDl$J>(|tZCog=z!^MHD!hn`g9&|wiV%uo;Xd#+v#N=}#>Kxtsc>Y568qK4sdFUEEap4Y)i)T-TP&G~17fTccr zfh7nK?h=|6s=rQEk@a?D%}5F!ayVF$_FVjx<%UMR;PuhVs5m&At7u4}6m`U{F^{J6 zcMUYe$B;j(UWyld#CX(Os=a1)-pt%D)pQ5K0+tV;R0(sgr!}S9*{~Cq1-BQ%qT~ z^*c+0%X&wZOpdjRWSwaQ$(uy_HtS{4cZgX_T- zN8&Xb&qZtlbJ^lM(YoPFm-~!Kw^bO_*rwi-8m?vOq-WlE{k~zNDRaJw(bO zp=Gr<1^K!c;W=5ogh{8>I?|y{T0sJ>J1A_BeLg5!Nm?0&cY)a&3Zx;4SDc#UGQsmG zl=0%G6vT5B0VHmeLNp$XNZ`4}jAZ|Xg`+8&i$lsGY_;$&xyc4kr#MS7u`+n8@P3m{ zc?5b%(M*h!b`Hb{SC>Cg+&?xwrjL{6M+&}Hfm0($>8qc z8BTf=?AFUV$67gyttMLt3dsD>|L}{tfB8HgU``cuhFP?bgy<*?JP$#;a-Re2w|Yi9 zk<~HblN%Q{9n6p?Ug2q{l;56RoSMZUP;%iO7BS}bDlS7T)&Qg+0unsgR&mq$JN{=< z^-b=xg;0rt#PyI6iiHp>1#_Aewx0#ba*o=BWIhO?@b(pyOG2eEl8FU9tqX{b@0r9R zgW;56t1)bq2d0EQgmD3#Gx_m+&CfTvm#e-xxtn(Dooy_|O#MzC&%KT3NmLHW06~zL z#cLijO?wad5WUx6G{N!N&^$#pi?beiRuepE_r>E2rED>bh@!Djm!Lb2K8EwMggtn` zND7jMbe6A`9^sYUCN8a&g?`SaGnEMFF#{}WnjFXQ(gU@Fmi1y^bh~`)g;<15#zzRg+@d;#Mu`NM&=}oCsSl(L7{^fHDDt58^SW(Zo#`2YK4cgr0a1~o_aO8 z19}MN;;nEL6p0UlsLWQqEJ%_emXdU*$6HQdj8mdo^e7=mumsa9=&nqmaAYBuWB#c+ zNZ?>ul9&=C@rqo6J%kD88jvb}BCf~8cs?W2kS7EyY>Go;#N?JCBF~lSpz)SifMs(K z8<{N34c;Zh=Q08gOoRkGtsseV`!$5*Jka*Nc}dSpf^PKzfi{^8@@|AI;z?0XQuLtk zoEbe(j!1hy>J0IuGf;7l%CAIy5fC_k;4A4wT2A8dFpj1|j%@GJ5wfB$%CivNBu$=? z1>s{RnLaXkkO%V2Qh-QmmGfb4GB23LnB)elB>N zq&|`K#l%e7l<~3eve-(B=FoMJQz|;Ydn%OD!Xz0Q2TMXosyr&-!~S8RVGe2c22(sa z?WyiTYfeF=qLbp1jtde4xB|~OC(NWJZ*) zPs7H64G>3^{EM#36gwpUffqypWynT>V)(_-w?cMGd96- z)Jj2C$mjhhI-TG_#OX?kufg-$xh8ZRyQaX1HBZRMgSixYxerf!s#lTd`rbiH5eK7C zs|C5C49r{I4(73zu$%bAL3m0@($>~;yTHtjBYWLsdk%~!NIhW%pM~a|n>E!z-q>qt z)`CUP?3lC$t{7ukL6tK9>0kXvkzE*DJ(Ju){REvM&IV%@P{ghB>aS7VonGR_zTo~X zzVe%};w%ybBCZd*MfIXcxHW#0Ob9IpVa`E1JiQ3n0>IZ9E2G{Cne`6MNpqJ}|0` zc^0E-@IUgT_#U;fveK+x715eK_jvmil}5?FjV8uhfmJbS05NRZW~-c5~1hwMXXLc898>cg5(P#GLy$E_c=Sz`-A%yYa}-nsawz$q?A(hKmSD zON`8f+Dd?H6*C&ajtx~z!pa5qvYT+~IGR}EFtBow5RO>BL3e5bkkCy6pDQLQdae|= z+y(`4|IQmsRD?xRW4l^aKBk+b8rG!XlCxy!L2Ngaz*|^gVG0vkGG49wPStXD`LSrr z3`{d2#heaPdrzX?xhcf@GAC;lrIt5Qt^o^ z&AD$&oT=W1H;$r0u@@3-=J;`Bj zh{>4kw&reyyoH!{33ZAih!iw;&XuH~twg=j)+#Xre#YvvG;_)OMx=p+Jk~}6+9J+> zsH%J42XA^PAgYyABX>d^ZO4*r4t*k_jn`r<-RFRA1ux0_qH##98F@`aHDM`+ff?yg zC!wGu zTtR5@!}VFM!=IDqb}_1_YjSTMLan&z%aAXI=*MRRbb1rqYxU6TPh9a=MfJSVk(`_`Mc((K9f|FyzWjbOJgWlev(^t2<5HKkcDCo`KYpfm2#6 ze3Xwu=8yf{x-ZvqO| z&(W(ys1nj%a(B&k1$u@;6Y2vYL{}_Y_waiewiHh*ws5X)jS5JTo z9}xil@Z!g_2nW5Pux%ydam75i!H{z#7oOahlm@5Vpk4Pxx6drR2mK0_*!#hEifE@K zE`v;v48Ap&70h?3UKL4?;TQ7{H#Dn&Z>0{XqE|IN{<{1>0W-y;l?f7hk&gHSTzJc9K zm(i%#Q7*ExlLgwm0}LjrHqXl_?*tXtU;f^HTl9M?4nE(H%?UH`K}?Mm@i?E4P!`TN zwWY<(%$gHd-TRUqO!-y-OTiC3TMTw=f}HFjg#<@+h*(&-hshrZvw{ z;HcPSWp30;@*wqU3FV?Cw1JWlZd!<`4V_sY?k0%XCpU&-Uf>yp97TwgSItAWn!-&_ zu!C}&MK_mce_GZUs3ZQ^bZZz=1VoIMGbo4hc+WkVu!pcs#VcnVhq(xGikivbY}m)$ zk8h*fZec#Po}GN&MgW;&&%r0lbD497meX(OE#!fygx(_`&8HInO1+M?txbIP<bPtRLd121_H#kCId_>Bl&z@*61 z6h0?Hy1UhigExl4?RQ7$PQo+r?@lRa=8yf<{~ZyAi-aCTDg>5ud7O?$vIs_%=I;X( zwyfHoW(NrQDV|{!(Oy*>6QDVC51#jupzu70)%0-U6g0cc30J%OrWhQ+Rz zVH6d>j?GTYI0A#=vH;xSdzqL4C1uTK~+Gcp@Izk%^<}FQH0kV)=D<9lkz^8 zP6d1%55{VsGQ*cXvXff>)L;3PXgW2zGTr0e*+8CzZHX)h>XFL}$Lamb`30efZPbOr zZZW*09#1zCsbkxN3q2GRdQS5ou1(?R17#OjsQUBbNU&u7L~>d|bD|RK9;!g$riDKl za*z&U=ubdtLV_Cz(xwh3*nWz#R$kLcJ>1x{xT#Q$z*|AXoLjZectTGFVGThw4#B-< zEMiWZhcSX>U0HcACzANmL^I0_N4SgpSi)`;VAD*By znqodppxO)Uo~4q^Ib1Px`*b>fk5f|c$;y$uSujF6CvlHL<5w+Y@%gJ8x;IZ+LyQ-5 zwQMkGV2W$VVKCImd1QX{ul~b`^HJI4!Uh+@b9!@Vqm7eKLoqJS9hT&J4AnqtVM z?}yIHlEC1N>}dWuT6_1RQ~-9#k+?|i46Ok@2vH?kQvTSWYajIBeb5G@TGEvuGfATo zm4rpc5LzXvf>)=PC^89Cc4=-_JaWdYSb%P6{h6OwA=9es0gmSTWXT-?Ga9?y1&h#< z@8YYB&AY<^9zM8>v!g>qV$d?|U7%1bOA(ZGXDv@y%x&N^=bhzBWxZajRB+a5W5Mt% zV&hbS(u!=hfJ-|&I2#Ty84jf+U^q6LU@{&mCt;|@P>ds@O64LhUAl@ZSFY%6kK28G zxZlyh!7wDwfSmL8lJ`MF5W{4o)RX@-3K8TaG0lFzRM2%R?4SmpFAXe*%~7_kOk?E5 zM`t~B$6gHA2{`0MgG8zcM_so26FhA7FyZVg(G5}=mJ8Q;*LLwMfraUQU4K{wI7}Zj z1+cb-RMfeINO*pu3Kl(>5BJKGvri={U|so!^=4CeM1f}&J)gCP8Si8Z{qZ(c#4J^y zyDPM!7g-`U1`pzoAW+-gwkKXB)Ns;|$}%5ox3!!?H3ZG$N_yfA0St=dsF)9pQxj8M zKe6*2jz)O+_#yW0-Nj@uuqlI;DsqLQLMC}mz(@-k7N0xw@^I^=r#Wl{RpP}8yG>yv>5K_F=_aBydtX3E)_prb>}d@8wa&XZFL4kp zB<7xaIDaZ>wld{U6vT2AGb*ZWgtY+P$Q0-^2>{^Xz*2Y?db?BY$C(K2P6zM4`xZu> zj=Y9wCI!N>1uP;07Gza(`r-oFLKRag$cSEm9)yL)9M(6sv9+;*gX1F%`&}tVcotN$ zT73<*S`}opP(kQDEPp8@n=heOt7D_l#L>wSdfg7Dlc5wdUn=49<;&Q;dJ}KnKgN8K z6-kkx4)_(T<8qg{R?lm4&DvX1?y4b!DORCfhH;M09nfBJYJ(^BnXL7@U#^!lBa4$v zY_f{KSAY5^=|MQpi1V0Q!!h|HLDf7DUno|no0cSYz07RrrgZ-80 zihGV=pB0*DhHwZy?B>uii?79g5e+|{W2eTo041k$xJL;0id1IiF@m=3cY;4f>-LVo zczmW6{Y)P&u95Kb=9uiN;^JS5AgBlH*KTog5=?}!FEm#>FFW#LylNJhn*|8(A-$V!J~&5blY)KZ1sf< zwlCelm%jKp-2V6jJbAol6HQoadW#eaw zcx+N&6xjV*K1Sw0`78e@3OgxCF5{$${jW7z`&Aa8|@!z7M7rUH=9zjCFDFMs*>;nCqCPM$ncev!-=w=qsv zZ@!GreC7qb^Y(YqIyn{D&r>6m%4HNvB@G*|Rx5fo^h&cS(X}Zi!@fLEHeW!cxrIrt zf#bnUMu>yo)TW&ZPkH|G(0PVCSv4+^Nxqb@c+wu%w0+{fNrDv=&1jwLRr7ZQv+8yt z+zj3DU|7j>^QwCYg|+)7`N{m}fBm0Egee)rb2KD-KR6rcxI6GvWPvOj!eXf5)2YSs zyPuNer@hiMqO}X5U`H+%jGr8;)4dRE%Nhv>JJ;36Ze7CG!b`TPZLhMa@m3*Dau4$s zKJ+@k!l}`u1O+q2RR$FPE!W+qs5r=M=MH&k}ToP@ZpXZC}Qhzx*XUeDnYh?%zi= zwGAD<1J3~K~KRjEAQWi`7yv^fWE8j~O;4#z^Cnh3`; z#Uuns;sYiIogtbP!<|E}?nj2hNylfLdIv=9&;0B^jo7e5qM25#Ef#`%Nk1XftI94z zF0T}Sk1VgHaF5?xE>}>hHn6t7 ziCVR)V?KOv52MKt*<1+Ei0#_1T(uQ-(2y5?z8Exx{6L!QNF zZiVxqCt$%)=kM3Y*JfUYXJ;d2=hn-w;MUC>_?@r*W?Xv`hpXC@H`v(T#?JOOI_)l= zJb8@4ppR;;hRfGqK(SKCn~z!w>vkJuwAjDi<>=2~7((SI0VkG%iWPM8*+TLx*-MNo z^AY8OW=&HuRmhAyg!_q~`)3im*M`pFC%v76;iwSwChR2SbsP=`QW&-{#ydhhys_** zk#hTr?mxRc9KI53RE!B}wA!X9=brUnzlja5G4 zC*&X@_D!Q$Ql0od2Wu2Oj0F#Tm4&>3Xod14pU>&(DZcf)UsIuuLN|-Dm=IQ-j4&Dv zv9Y;}OreCq*|9>zaN$&k*00U*F|c!uT0*A8 zOz&hA>vvC)kYKZ=?L{^1G!8Ahlhul zOh$s2o0o3jNe`HKxu8!^u2HKij9U+~&dJU*k*}Z-X~p;?18v?)QAVngc@ZHp^W#7F zYmxO0&$W2vv_~$@NH{i&P#oh(v`({EwS8)4lkT(&fn7pO=Dg)LhAcnn1cQ)2{e8+#3jy%OR65T73j8`i-3-?CA-UUH(2tSiG#d2bEECycTn0BR+X+?oyam zDw+oyb27S>0`kSO6#CUyU&G#`+ZYTjKVe?P_K0@-!~}8e3VNv7ly*(8_szH|O8PTQ zpFPD3Jjthu&R4P=o>vl1Ez6Z&XGr{C{_L+sVakIhwcG(jJl0>3n{@zqFcJWuH6vkU|ISiVcV!0YXL+MCU@zn}e zKn!~dt((qd)9^3CUCDlXH##7wx+QPLodxXD+mSa_j*`N$L1|~eT5P# z<%&GUjq6v@AC7SU(POcCS!LJCAsRq|3+x4&S<@7~F^A~QCdyw*)h1s1{1@={8{g0n zK^8Dse5^OtrOf;Lds>!M-FXSENlx>f8RKh(#&gQY)AEt?3bJZILu9l1PG-dtxRfRb*OYisN={=!`#qt&A7S&P-Th$`Ae4Vn54KnHplUVCi3>YBWW$T*E7`yoz_<{x+uLiEeX!ZA&D{ z=K4Cuy#XFPyo>7k7LKAOdNab@N!#wKj)br$9cq1=gxyF{F?%kKAtWzP%V$=?xS&?C zf^hyW2gA|z(PL0Sv>$H5!qZf}AVJ-e7<%>6p4T2c%WOQ&0;KY&)W?^UBqUpona3v_ zOh4txCqn85$cpB$St;T2T2)i|)c;NRH&oeG2MKkQ(5V-iu98)1>3k%pc+hhP75%Z9 z;xI2bX`kXd-*_F9k>w4nfLH2kf@mkBzM)Y0l9a)QffK%+SR+%RfLyMq2}|n=ihEy$84DrFbtGdKF6*-OHP|Uc&y9eH@=0 zq1f2KlW`T3MY81cd7Ma`D_k65UvP-zjmx#ar-bM!#j%38M;!mfU;if&S)zn_Sy3k^ z>u500v~cZfAi~0YV`=h3NI9S9(!SUCtmY@HUS;{Xc74gj5X-&1;K-05Fj!?8U9I#W zb6TyyVG!hak*dOnsv@G4#5_ruh7u?!tJ6d5>sGi~0!hwyIMBeb!1ndmzlO7uQ{;;k z757ADWay+mjRG<`<`2Z^=a|z-k$KBdCjuJlJIEBv7!NvnM#D}k1yvgV>ZQ+q0WZCL z3-7-7E{+clFdf-uCxv)!%_PfWIOvH6&zyx}Uai)&(V*MAI5|F+cN*rJcswj{Xy|hb zM>?5~?ch^Cot7OR)#QMceI)h0q0+eISyBqZ9E7f&)8&X)@3ndwWX6bzi78iMwFotG zHCVi)w7 z;729lbd-1nfR8TKXqj}eFU8UFlL!i%p3WE^3=`bD_wV4nx8G47kzo=Y&5>sjjaEBb zP*)$rr3G?=bD3XEXJdshgm|0VSEZ1H_OYS{RZ`t^%D&x`=K40i_@ytQQZC{fuYV1r;lN0W-pxoaQmr+Rm$DR4sZ^E7b7L)Y`C7e# zdZmWLg9EXLgOLa`$u3{Lg=}VllaphtuW#bX-kubuo!!LA*e3Wt?@vIP;t!n@`llVu z7V}*A^R!ZYFnBB!a?tP@Hx&)1xYz2UgdFI&IY59`f&C1c#T)jcf2zxR-pl`__dTDr zu~^l)KVx z)Ir=e$0LK5J16-*<`lp6)qjEZsZ%;Uo@dUW&`%G|xJ*PB8Sjt!9VrO~u-@E4d2J1o z@d%UNnT^&Ifh!pdM+Morw5z_6PW#NN@FXvK?ZJk~Ww5b*3IFQ9{QIzf_yq62^R{x7 zpxh!l=JRN-Z((C|8{3;}c(nJx8tCLpv~C!sQU#YU?V^3!#_8#iP&oDF6!O^IzATUY z_{kp1l?uwm8V(NjP^zur-k^fh2O}rT|F^hE zeGo;Iir~q&C*yQRp4!5kM@KIPZGuk(Y}WnTROBarE%|~R53N8KM?i~ zjt}wrSHEK8ZJ10K80+WN0ZAp`F-!Fg^Z2FIBYq>C~uy zUKCVsxoRLjXPI+qXRK{mh~Yj}jZw8)P4$_6=S*IU$F$=vl%SXEO>Avn!uDoUwHnF* z6Z-;_{8AZ{c@}HUI$pSW6RlPo4<6jZY&H?KerJ0Z8*2@`|Nc8DmaAy4ZKB`nV$koP zm)peAgpA~;3#`JyP;U$WNJ4}--!cKe$bcoazDffIopao+CSw06Yb)2*7COhr zSg?-4W~Wk3UQa#b^C>Fzbu4lv%*F%EM?DEW<9aQ+@u6{478|u{{pK@I&RG*tk{Pd| zw$L&RW-}$_##y437C!O}HS{g?`in+Fz#^w9C#2Tz?p{VNGsoL+eA~h_f)}|wYK?V+ zi%UgpZ*OZlO1sm;@!=tc!#=zf8!!7#Y+|EL z{l?nI)#rm2Wo>;F4 zkCkR1pvm z8IcqJnRhgsYshBixcBjgOKq*pnHpgM4?xu)_1!lF0uUWy zvdgE(5J!c+h+!M^9@_JypS8@eSZd_m6#Odj=CdE%jLtpQZ!P;5_-CiHa6>zs-!DMAv+-fc4{4)(f z)pL3fIUP4Qp}3o_>A6*PQxS zeBB?06%?&#M`7)a2Kb$?eGR?#8LIWBXdw)3SpQ&nLy88a)HZwNMFWYlBwAWHLoMbU zVNyUuFeJUilWme2nNU-K*f_=S)pLs5l8-T zR?y?q9zNb@E2R&Ji+ezxrok8K;3vd_&-it)?x9k@!fJW0Bt*xE9o_Q9OZ?Tz<_l^3 ziwu-7`h+a0-k4QW6}ejMOeAc{I^9cR=Oms;sG{lVxFqZ-`RLOAi2m>c0VJQ@2m_wMCo+QArBnTGDRVhY}bE~E! zjQTxH$*m%M+~37Qc>nJDH|1IHrF;HT)DK1YO##{;}djx zeT;{FAez|%B`(~F=BU)_`0^KC!^a=Ijb68_5T&`Xi+rK1`*{625v~^Q-M=SDxZ63C z(la08-%s*8=+8Kf#eSY<2A`@RAw-grB*)3KrnjB>Q?BD!n5fKe7 zqaV%jxZT6!R!>TzCaI@N=_gzAWgT9*=&;>rNz*Cwnq#<$WEpJ`lI2^=6?1{QM+C(%AVBStno~GSeh*qo7mSSZ842 zkcm0NE*28$vDC##ddX~pey1&D%NoCJw9n?wWz^TUF&g*PlG|+^$2-@RXL)aUfzWPa z1I3yd1)?y zg`k|%#d9ZZhJ7tm?kiWX%hT-bJyNfTwcM5jGj}^}oJ`9&omW562+H=Q+iV>*jAIdc z(ADrc1Zg2$3zqo&8%-&Kit_KInlQwYf{bT4>JHKBjWubTBY;$3yHHU+or1)n&(huo zaUPacAedeA@&5a#g>#9!Sn?I|Khil9!;~zx8x=K6v0BcRTbyXo9gS_&k?)NNy|(lk z*VpTUdpXQOTbJTpeTH1wysIQ9F-l5;Zt?2ge)nyS>(O>xuT5~a6a{bwvzozkP_V?N zU9e%z`pQd{8VaSVLLL6T-|Z-Lijz*#&hrJ_eCbuZ_S!3W``veO);g6EaSBQ}A1?=? zME1beWqkf~uVOgp;{Lrm=$y4;3#RX^R#C08f?mejdK2qw>nN4VXtmE27P0M?o3Uu0 z2mPLM6{4HWsaR2(O@{JPRQyGzfX$6{)M{l-fj>Du(ls-$Vj*`l=;3TI!IR9TWg5sQ zs*4-bc#KuN4an}PD?%(i>3l|twbGy!lU)-Zmid!^>6as-BE88JXXIgVAIOlDXcHL8 zD3^MwZuoo2I|5NXVJ9WlK0wGODltUjgXEKb_+{+d-fhQAj-I~9K|#zcF#g_cR-fV8*@U*2#Dj9OclyPOyZ1A%=6iapNY;R(3@1aPR z#X=c-j~<{@qQ~Jfq#RnEGwk6qrjZR!f4(1XL5@pZuHY-^=mk`gpg8H$hy@Q9_0>e%PU@oi%5os)g>Ho)iaZR!j>o!$ z`HS|c#EYH7$W~lR$UQjZnj?YQ;|UJA+=X6)#}C`Jw0fF-+F2C~xjTEUT2km>d;4rW z5G@AJRlC}KAE8m?Jvq;2F`A9>oo~L5Ub~}yZwdzYZQGV8!nFqNGRKIJSLiev_LN`P z&1UCd4I8`H)tf#zJHm`%4I(K>$hCNFyO(d^%RlfXbO%G+yZxaWtGeAY!N=s(*<3P1 z-Z&(V{o=2D_9cAu;d{8l+D6FF;sFzps^qn`4G|94nl+3DXBs+ZbPJug|}V_pCZr#+JS86rgGN)hYo9xULXH_&n*Du}Azt|0MJ7N2&q z!!1Nrjybi_|H%Lc9|@$HS~mDPUc#fiqlGPV(^#S*fGvOESi z!ICIA8FY2O)UB7xWBc-T2aqGqvyz$1j@%Z5b^Ti>N^*hS-2gOII4`T-SX1ZVc+T|{3)MjgJRBSz;c)+nl#?MBtLrbnbPESh9ts&Nm+Q!j!ao%# z!2Ifz!?$yrI2@cW{jG|OjA)!kxY#?n(h~AS72+^U1}#b76SzOlIF>v}?1%ofpZvSg zqtl)yx_2j>*XrXysZ!$cSntB`_2=oy^Rfq71^Mg(Q)VLMFsY9{H5-cWQ&K&rH(;HC zL-N$o7RF8LLM@~WU4m4cjcO4)^@`eZ3G=GVsDhh8hPEHjIuFCLp7C@nVVVy5Hif>* zc~-Qj<9H;f$dZjUWQsMTl&}Y6I>ETtF~7*IOSN^Z?OxWvhT-50<9;_rXgJj*kR;hT zxO4dmF7581)o$VV=ukp89P}|93UVr_!al$#jKC3Dy zie_b9zlM3HjB8h~qE;#3o3H=24cgW?Q#Nhou(^E+xqMkl&91~^p(L1>gFf!uy({=w z<59tdn)GBDwG~$@HF=%AM~{S_5g_PhYB(4hvmoFl`m!Z#CKali+e;dvR67a9K$i-J zp&H9-g;i3~Y<;;+{#RZWdOs{Bwn!(CPyhH&|6=r{)yIR=p7IWcTY^2q@dJwgd)JZg zQO82wv3#GB`*zN$F1r`M!<^nu*p$=?h8f((Y5tTO{D2Zyf>I~^$x^9>f}L^xz#!TJTmDuyMOu4@Y8u-8_%pLGWswVeXk zSldvN90tYNEM0EU%F8ooJdaq#7Kn>%84qd5+C;;6$Qx@doZP~kpo~VNfm*$aCwq@D z?DuR~bqXP8=(DlCiA=7J>({PvxGBE%&9Cczg^@^nKjGlDtxL*_c#P{eZitZB>2w7A z3`qm7JrK9_PBoqqmQSqhYmlkBonHJZhOP%J74$$M5EH^ZflKR04LDszhW zKYACv<3k&uR<4Sr%LyYB<_t{2=bV;4#yV>RwWh+5!P$wz4TfE|nA0cEhaqRaOh*u` z2DTN9n!;%$R057;B|Y8^o6gZ!r`c*pPC=ZCMZdJXwv6F0A4!*JNeo8S3n64N^!pU2zW-nG>Vq`%K6Sl?iaZViLsM13tBNZ9SP zG)jn|0hP1Bt;NLxn(I3_Iy};xFRuDK#Ex^yk_vh(z)K3^wG9t2_y=1T*dEUPgz|D) zdyvPKW<|?7Tm7k4NSttUb82sUoXVy`kq~ZX{)35gA!mF{sy&JR93&tEZV)QL#gKsC5Y}T2k;g z*HNvnQL3ys%Lh zluVz?>un8fn!D|9PyNX9S&M+==|B3PepyNS>0pG1r#Y6qi-Sz4p#9!`7FHR0W+-5X$GQz*saW&a2H zR!&*b2qDe^)>;Lt>6FX1pYZf>-ymL_T%khe_V%W{^Ar`l_UbEmvUe9x9+OT}(x8WY zv5G~+rmJ;Rl1C4P)^T3%jhnZS&nz@erF(je_Hd5F+$DLV^MLEB)Om6pJcwVfP|g^x zwRvE?9ovHu5z(q4GFwL?H~S`UlK&cc$-SH-x?@^WhI@v>P#v8 zEaI5$X~MjMxw-f*i**WNN*yK@4K63;7ieQh)0V8v5(48NT8b$>`8E{d9OiA%F8i=^ za?4hyBnx(dV%F9z&`p!HNbH^lpMuB-GMEhU-kaY>G#bcqa*UE{BKeZ~${C-tdQR)E zS-@=0qV=csoY)Qz3MC71f_%j$$a-Int(*2$khUj9zh{L#XA@628!NLAW0uu=hDgj& z_&(+=w&sm_mMuip0Ph?>Z){*u=~*<>ghkrKnL;G~gU46Sq|7Q{yykg0rDV! z6_dEQ@yVt*?(+y+mQuB`;Awd7wgTKj>@b*}wWy1J((rHQPyNro5|J9s3nJ9Wp$*&< za=@Ah=_ac`ak!N-zZVLziSO#@mKB+`_XKK5DD{TIR%jtz!TFxW)_wXdHRUxu3KjbB zZ+|VULkKNax}$`txH>qG9VY8#+iGR|N33J-?t_of*?(lsN4bKnBtQn0`UXav{K4Li zh?G2sZ^`M>cja}@No8l!&U}H&Rmc}Hn~jaQ?#%r3x-y0(6ml8AY+mDivYqR(fm(fC!ygC%Z)|L!+wI}bo!epzGvwM>XO+E`Pw?Qww~-~qyHt@iq)=%k zS}unL$A@xMkA~H;j=})~%q z0g4f48X?N@pIV8aF{@cweIq;4Ycbczp;#%4zOEcos~AXcA+^QU6cEjzqDxu$Pac~J zF3K1~PPPb}2dq^qsB*`8p@d7jmvFHE5D)L)iPtX>h1=M=?4jcf*REd|i=fvV;P7Z4 z!@*E>l1rC%(d)J`nrHEGx2y^F&;IccOK%FsAekzYJat00K|T|7Du{=Qwya6zvKWOn z^H@G2D#$;U5>iGP-x5jqaK8oa3K1%zp>ipSin&yQOt@OiTrSe3$&Tq{Iu_LAOydLU zeZI~>Ldu$%6l!7c9=525!)rYxEfSH+3U1@tZ9=)Ew9nNd zYxS3`+E!UV5rXE+gXXNIOh=-t6D<;S&COYw6q(Zospi_cQBMj5bb3P>L{dXEmNcTG zvhA1u_8VDX$VbMlEy-aMRWzHRz|fP&Vc6pASW?=rT)Bp`))5}u{a6J+UUn{9&|nA_ z7C9AiG8y9POI56I!XJDeGo@ zs*MfXufduG^QLme=#s-F_3%sHZT- zMg~zyL#3Goxr$W-N^9Bl^W@623&mbw~p*bm75yGbVQY~f? zQ&EP)9;QRW#a=X2G;HA+1+7tES9c!?lT1>#w>Hsg9Vyw?KE(wU*CsYffC{G6ygRSG z@>!u$drzLA*B@Xw92tnfWS_FbeTC5s1+sY+PBQeW*?Kmr8yn3k8(3T4!f4P&`{cmt zG{puQ%{3_#L4`rTi;eX)JeibmI4sH}Kj)|g*O-K6V#X<;luitF2g4~fC12!O%H?o2 zo(i>O0kJ=2eTjz0O9Fr5r+-P(&B}6nFcHIb!Xk?LBT@dnCJypYPXP~WA zlk;|d68|Kk#Lv;=R7*v{*GET(vBxxL&wYk@l(-SMSQcN4;U2>$e(s|?_t5Ef1WohZ z%*Ezx@8tv*Le|rv@+W#qDlz*_2&|DxQ(4>51e9_A42K7g1OexY>}6la*48HOl9n=^ zpis!5Gb`cIkP5n5(n=?ft4}ppWs7zM6~_wVe^JW<$2x_^I13S3T;%hnClLqHDMaGk z{r(^S+YyCo#Q!D}38955VHR&X)_cw%e~CQf3pv9~DnE%ho>74-gg40wUc#=dM|@^? z4Lj=On1P4M`%k0+fWCfc-W{3@yIGfqG89^u9(Wm`eO zzUQ3nx2%WsPwruUcB~MHq(XT(g-8a|N~kpq!YC{fDvb_h2jE;GlLk#^vZ&V9Bv8x) z)U-re#$+TO6YrBfUb_gM2gl`HyYUk8r6NvSCz$rTf=QWs=v{unmao}GQ{c&)dilj$ z7>@^9)JX*iIfT_!Z15bztV+EpPsT|lOujcax3GV7fRn=m3k!WXgqG-3Dr&JkX>mW| z81v~6RlE&IDYRx7F-443l4#u1@oUh~lfcL|r zli)fpv~=l*O2!xIQpqI6KvuL1ONY?`rgB7cRW^JmN9OvU{9BQFBCJds-%vG4#R1lN zUB2*KeYA>BDqU2Jxfveld(~Q$dM4i<1}%kip?{-M#`Vp*U{x)_aRKXKGJTIFbLUfBBgtZUVDNN!;x8S5fqD=H0LZLit3f?*xL*_Ia+n4dhFMb|m zPkr>!N9ebXbbV9K_ew$QK{@z5D8O9R`~zQn75DGo#qEzi!q9gd#zJK7PUlpv)R1NF zr1OlFMAI>GHJm8)GzfWKBWW*CQ`OZg*KpGA;P~Vei`hscQ^kEF7ix1$xy*XAfp2{M zD+=Z6&2>$IFPE7YHF5vmZH0QnSq66p3{O`Btc%k2<%lHi4N9?n<4^hg!&r7xGt17W z2p;)d{*k{C8K9p2x#-`kCl{p0MN7utZJi@HM*54359anADio8?6Cv9;?<>^!A^&H@ z>4(L<+G9C>M~S+(y;2D2zE#!rK#h3-S2>U>bN{r9I+ssYigt$!|kQ<#K)8?vVqslW$=JXM!w=CLGk~ExcG881b;M7DG@MdH6h%-+K&1>{J z>$^AAOHPa1YwaVNS(6jvc`1ulRNKAew2;f!Z{dqycoiQ%+{fwuLyUS|YvrZK@mfn# z;I$$d$A@0M@d94?%!_#Yt?%N=qeo&72TyLj_-5Fsgbc?BA(KqW+^JH|q2~j#m8)og z9T$w!b5<0hS1Lt({?*Uv^B>-Opn@XNHTCcp@~GDuc;VKI`0ls9Ca&Mk<*V9dNMlE& ztJmw|^n?p{^0+r5jot?ouExO6e1aBQg-x}w@*Aue$2J$KTB0~fD3`hNLqEIn^*&lO z7VKx7O>B0PuhR)Ba1QEfClE#1Jd`B=)fB^+&hep+YdMJx zcQE#ZLEW^vw{E?J&%OFG-oN_*`wwnwGKzRzOrGPXX*DZ;Gf}gx-7C0p{W@;kyrvF9 zcJwLi3nlu1@bH-wN+@x(Xr+M{UwAJ^;_CoJB7xTi)d)>7z6Sg@;<%II}FC|9T)oSag?`sNO&ZejoN9!ixWP9`Pn^{u@i z_UIRs4=;Y6NwU7AAS-WX)S;uN#>FpH(dmyb|Ip8_xQmp6gabZX-BvEbxkEzfQaOe9 zBgBnQUYulZ!9C_YM-C65j?Xa1=(RegFO{+O&)Zm==e@(x5-KH=nT!-?y;{=nX|63` zRa%QjXA4`W#_8wNnTB#7^@bRalKtS%uP6cXjgXt1qB1&)34t8ZLq%Yw&Dfj!GAKNp z9;gtDC^;vT5K&`W?Q|@1VhCeMFWI_$3;8k!8$=j(PciCs3`Js6&(Dye5-2|ru(f*? zufF<<1o7?n-^Y_jcSS5EG|b^{YE_6~cng!64{YvURsONNyMu3j^K~3Nc@huwj>9;w zY0%Q=OC=PlO?>e+_O18u&RgH{5H5v>YXw^g)p`Tjd>L!aCbl*=QE$|-_xOnx0&(0A zYc8ELhFxqFGp|rCl~K$skS~=51*^_OZ@Y*v7<6$qT;T4Y_S`CwC{cJ`{z_aINuBpa z4?k4YW#7%Ps^4Z=L7q1W|0MAWd~idpf_{+@nBHw8;Ml9xD#%rGn18N`_8+VvGhQI~ zc#P?1s;Im_z?HX0$PFX3y4;~>$5oeLo`V%?+E%L#y_^y`oG4kVa0PU=EOe_qnqt4* zMWlksC!PQD@5%JdPdg~~_9V#at0)jRH;N9|lX2N5Q7q;?wET^YT@~4=6hv`Edtb~{ zBcRaJcyN|fbLXm%BmS;+xED`S3@f6=qjH)!E9lp6y^J6D@)uC8R`B{azK;F92bfQ0 zS{Y66nIP`TM%yaqU+rARYp;F=)mk0D^E_qzwxz3H7JV+eWKhtwOOUMFj6r9US3LL^PzRaR=A&dD|9)lm;#q{M0>i_r zM_4p-=>6~|L>on{|Gy{5J{ln!%n?luhGxCwQk^IXi(90CLkmcGTS?zvt8#*SR-WXb zGZc$-G@STTejY_(PBcQP{|H%8E+XX%+~J{B%Va&z#y*8)CMq`xi}lSbmY{1k6_?!D zJYRYn<_f$+Tf5i2XM_OP7{`zA`{pQ{eiE3y+VHhls1fPKmtMxJue_|^|Hg0pf9SPO zWqq|4T9tV28X@C1%oTu!ClJB<(icCk;_Fwx@-H;I$^^`~D z?G+sC@8SJ--m+Rws%_PB`Uu?L&iT9RTiZA}J`wx(=FJ;8JlMl@7O6H>tyHkRb4l&E z{j*bJ8gN7^XJ%cyAy#p_(?YqrrjTba?Bn2Uj6>Mc9^Nk^m)F;;V&OjS4D9?vOL)5O z9)m>YHDWPNdy{kFmef9lD?1}PQIO@d^n95-NnGM%UjU7r7rAhHNi3-&d4tmAMhX3Y zZwHI@JgUEOiqdzx$PSW@Mx6(1AUDbw{u`T^T`Hpbn=O>S(*?)&@dg!H!7XtbITzrt zE|L@1XuO!COzL_rtDDR9!>9d``T`WId*%J4u zOs3fgW%s*4Pbg|y?R9xLZ~pWzy38*Lp1n$ZnPGKeBLHaw240)xx)=luYK+noU~5xt#5uyOpl07*naR6-&lS+2w8Kx%HU{ru-XEBd-Ah||Y|-Da-DjkcAVl5mDu z^lTjMg9Y1&Ilh#u5^9)CfNG_TTQ9tb`wt(Zb-eEgS6=h7*n4u?I!2*bSJj_`?3l3c z7q3g{dH-J6tm1OBif=zW)oMVsWhne~?{PsgzXbC>Q$bR~9FQe?mGdE1S`kuzKaYd@ ziLDMuc$&B+?kFl{G5c&4!#})%*>(|?ub-j(wH7jCN?^wR3{xEm?G_F3A{T3Rvy8#N zy@jZnMd^1tD8Ai8wl`BvgitVZlueG}Z?Mo5srbomNzT}9R0j+4BA6VOJnFX>Pw$joo3^6=AQ6d|rt}6tJ zBGj8}C^5m$a6(C6ZMRHd*;X5-D)Nj1WGCZ*bYbRX}%^H!WY1r{?=EV6Lv z#Z|N{)Udm~f!^6Mj*lKI0;p8VwxS_dz-Y=nA~k&OmCxb!{RcSO-?Oepc5kxiTd5#h zD4|?!2<~Pge}7oS3s){H*IcWYwT1be$1R-pIgG*|S{yfBV4g2jisjzjbYiX}xPl02 zT=pQVG1UbKLh76n*Of*BE|{vIrwByFEGA#5qyO*kA~Tw!_G?EdJQ@QdBQ=a)tD*Cs zT}9=epQ8Tj$D+E>bF_c*1_~bz(ERzwHlM4I!J?7F@Q-X@^as{Z{z?ngue6Y5Q}c9Ijuxf}O2xJbbi=gM%mkKWpCsCtF>f{mh)1Grez_?Yp<%OTTnP1S2SxSTGum zC1TJ-Mbv1pMWaa+5JZTLs6ntrV-jPdNf9pPa^V)Zz3twuv%AxKpYMC#|2eaB_wEJ# z^3Ct3ciEjebISkyzwLRSN8m4{GIhH>fK`_%MH@iSQSWLW@^nG5R(P z(;8hmD(Co78+Jfjs6yXYg#Bm<8mVZ7_Mc5Uqaq>vRmLJTc5=!1mm7#IniAZF8R5BA z-Dabz#O5PsK3YcdER#s&sI3Z9hdb0|pkhlhYc7-8Bu5i%5mk+oN5mc9s5mK69F>f+ zn=PRa;pj$ZTS)Cp#Vix@V|KlbTt&hkX=5muJB^6AEXji!G$2;hREQ)vU(T@$sRN-c ziqeQpL86CgXv|qyjbr8O$dSW1w11zPWEA>SO@_Pt0k7zX@OYZ;fz9E^`qd-YzjqfB zi?Q}R3QM^Tj~6<{N-cINQM@#aMvonp(|qv! zW)aS(vtlq}D5}LEhRE;9zph*U+w;pf^ocTT)cGNFzYU!+p)baz$T5~zy6dnPj=|m_ z@Qy@siZxw;cto<=T+;Ip)^uX4`0-Xt!V;DT>jt?qe`iV>$iCkuWl-Qn36qRbR~m^J zf;l%YKx!ill7-D(+u$xY1vU*}qM*7A!xADqsjQLbR~Z8vf=UBK?Ve_DL{a@Hh>Xcp z!VQFjQB;;9=hd1ut8nzlQA~^<72*eaMlNLL3?yBUxp*Q8oIx>?HLHekXy0?P=v7oM zJUK#uNBSeOH2VDv`T7J}LMY1Y%p7vLv}|5vccCN$L(p77k%=6uM+A1#4uv~*<|QYf zzD>6CrS5|15IVp*9p&D3q}5TVFjIQNFDwhO+5wocdd$S*1?r;9a+CV73#E%gsI7Cu zHeH6}nXK&S)~u5Jk{2Ja(~9!B0hBKe!Zufh^NBR<<3(6%%5|162%;X<;r?9`)|`U2 zH$yg*&kmq+mLFQO3iog0u*EpC+OeZ(7SskE63WqFcs$pmDd>Chu&~5yUYVi1bOQW@ zi>8`{v$Ci<MYv#~bBQ1}u?svdFSTrTP|O^g+h2NWwM zi32HyRAR2!+|@k1azI>+O}LyKsrA5SB`;S2=~PPCN0_Hj-PWWu<>z!~KoG#x2swOU z59VejjoBSFMJeUuKoC|7L&27?y%UR-NG2pnXLXB!M;1ER^yR!dk;AD>8WW9f)D5xE z6XF?zqRG5RX4rL{9?!`tS)B%AY#wHQZZ7LTFb8=d$Fa0Hv)2rw-tU0($uyi>v#=D{ z5jT1v+^8Lz{JpxtEen|8lIy+%Y!Wu9+@dz0;UnPqtR`L zeWDCYxdcaH5*kao49RQ`H7jB0W;p#3#Z*$Jag<=wZD$gMch; zI;{rVuNt26Vlubi*)CXI&3HxjTx=}S#I5=X|>S+2MXa=3I3bxIv1VJV7S6+>? z?yS0n!(liQWt0{c1y9Djhp%d-23J=%n!RBRjrPk#;oR)Bxfja5=(IcFu4?eqNyhC* zGBJ;}Yu1aDA0?ur(LPKbn-q9X*=>Q|6NJ;_MX6lEY~72BG>ajdoTbo^P~Es-Rp=B8 zF~OP3WS^JkAZ?tMLK{eu-f18mw6`ndAf3jrk_RzuczHq(ByLy>@6YGq+?i9rM;Zs$ zif%!5tp}yc!e9lBjDmABW^O8`a^69wCxE7AQ{C`dQR@B8hzrMVd>LAH4Slyi3-_}zSy*c5Nx@~R zAvdPKco7;AHynpE=(}kCNx9jwwU zr2UoF_%QYH&9bqqzGVlT$0#{Kb{0Z)47j)5hWy1*#QtIxv`iJlpL!Z7(&HL~T=W`t z4Kp7)1;urN4n4zV8)C0A5Z)|{&0i3U>1Br0z^8AD;wmVSFXQ64TuT(5n(AU?G{c}fg==~c}9`?(9r1#@hD;7kB)3cVF zuuWCqxi6(c@yZf?lN2|WFU=E@bmPR#-<%mJhLm)FAg z?=d)bkzW?5jX69<%%LUV6MShK4;7+_CmZ@sUQsPjK4X$T3Q#v(HkxngYEz34*2h-%z<6Vra6zo zx%2#4U6}p+dCIxfn~40+1iF8E2y6}rGl~KE=hJ7EslF=Q*0V?7e+CC-I=mz25;Mm@Ka_|EM*1MEkOFb9xQy|G&G$WoD(^We11D@RfWWr z5$k#bb(;l8Zn*%}UNX zQA8O+wYfCpWhx@`8QBz)A~aXSIX|9;WpZAOOrRZB2Lgd0D&1cE?&@w-LJoPhnh5lC z@b$_UDmV$(lxs^C-g{Eek`zGg;Oy;u$S3n4=6jaGOyp99|98bs`U@M#i8U>wQ)vMb z|Fj04|C)z$S3wS*`ou6izfQn@kVavoAiPo5mKaX%>H*YySR+5VQLK12jN>a!c>iY+ zp5MfmyoIWpqUqL<{mVW$pUp{b!`I@?YZ3UjS?GHUCp8e)lZ)uP@iCxGQ5Zf5R#e!V z;EV$X3=}w6VQ$FIf?eDx88I1I{e}-UQ~QG3_m!FHTT6ZRd68J z)CHE*2-;A5c@V`*0}^@gCfld0hAGoLI$Lq0HNvwzio~Iy{Js@1EEwJeh|u ztVwMs?blL%uHydW->-uE-UM7U5K11uzaN3`&B9t~iYu>;IZ(Vfi0XQ`B;X8vjyusm z#(5c)BWr=)q5$W%ESyhg#BlgxHA_p^B|+x{T)b&50(VS9KUh4efw;HKp!cRH(W3||Co35Jr)_Xd=EOspH39Es>(DJKXLfV~wmpYR&%n0W6dEWE4_)_Mz< ze_|&}$s{~}m!NeeZ-f;kw++v}dlgb^eXv(rIP)V9!j>%ydYGGv%i~9*-;XChv>FAs z1;h8xV%=}1u~_qAv1AS`%e({{K`U}^>O%3Qez_LcGkFBRGcRjRs`Q9O{)*$q?N!TWj7og}2u{>L*&~?KT zu+~)atcvbUMYv{EpBM%)VWqwv!I#DLAxz$Ikr+tt*LNWDz%iq2YH(L+Hl)r7WA-y= zi*a=S>@bqA9Yxb+gYTIb2EMutEo##n-FzOqzPcBOzi_UEMgu=Mg3trA0;|x#aIcC+ zvxf9}y_o#SIkJQHfAwhuw#=we-QfTxKTVI|f-PIc`Twy9*MS@o3klS#RRIW6tHkso zbzQ^0n=V47*Nw;nQy9AY06aFQkWdGML8-cBa|NU_8RQEklq#e#Vk5I9p(X=5mY65s zXBtQo=e_SS*f>Px_YjXPUXeyts?`v?avcu5aX=pbh8v!Sd*_^>jR|%nWTn{U!j6w` zLeXu((0w!5cux$4hK}((tAXv9NG0S>D^efmNBIn|tg*;VQ_v5SNMf1P({iQU&N6Z5 zf;K!zXPLNdAj?CiPUARXadr&XEYYk0nfDE<9AQgZDoC044IpsmESsb#T-A;I8+%^Z zM{skkwO}WTcYrh9fF<96ma3sP;(E~ueoLu==wGtq3*@irg>9+~=e7)*J{uDMunOTX zPe5BVfQrVMbQ*~F@fmc}K-erNC8yynME=2mpbI^y&8egl=t0&7Fms zZ1qiF!@oF)$Pf3RNf|f+G-}XJ8O5Q`oh2dG zz}*MX`{0}`Ac7((y;fQsV-|vtdyjmEJ5!Ww&J~A(Lhwi%P^VFLRPzgWtfj?D8^#Ty(J1QQ-|yR zxP&#CzZyW`?m4uoO%&eHBc1XUUtAa^R$d?|Uhgj!R2Vkwg!8d9S{^Ghe>JF(ziv&8 zZ>1NTkiFOJm0dOWwkRCW<)v!HPJZ$eqlkR|2pE!?ks^<>+=KMo_!KN;loY}?MfET9 z=n@8yFinM5q7Fr-_Dx|--uP1SAklB^MBtvI0!CEqBu-&=FP<00vFlG416lL2EfQ8t z{M}}h)`wxuSJC~YEpTj8FdE6|)^%g*rpv_3bbWgVBKI7D#~(($)kGMHSUj|k@ZrPpOr7SfOmKjg!Wg*mi9q|3Pftc zo@@8ZADE=O?@z!sQ;{lK?l1Zf`pN`g_3&^J;O|p2w!qbJJE>h5AJ)A8{^% zFmi@eCdnHU+(w1eH%(MF^H=}rz!2`LV8n%2h=#n5H-PsY);bsiQn!dt8ehP$BYI-Y!O2y+*P<@?Wg&!g}V zz$mC{vP?SAa%wpE=3&fV*dv~|f3|_K&pnE2z9`*vA=##98wg?7XU>)+ea#~YY`kY) z{zmSs>1G$o4Fzp!zw8#I-_?WSB>`0-yk!RVeJslxuNA$=QoBqUkorI4AIX>6AMd;B zmL)a=qtVocUYO@${=ReTZBMP4Cj!A*6)y`T@NYBH?_ko-nBV`SIaE&ZB7NQP(utFp zY_bf;)+{O)`lSTuek=pm6KRyr^`ZERh@f-{foBqKEjEySS05^;`vmIFibe6#5Lzx{ zpr!@bj}+1M*~6%u=@$cG-^Bg9gnW1T`~duSseGu@t{Ve3B)+sx;(gB+hFDLEfe1Mq z$>3z}Lk-CbX32n}a}<_0GQZk|sjsLiR?ltEz<1AKndg>;P7U)$1BDCwG5fiT#Xv@{ zdlapG)5;rMHj3mYUm`h~`|&A6zO)6_avk+mVZ?5|LJXwmJI^EZ+rv`+t#Y)sraJfe zmkwd!?=F-|jxAo2CZy04mFwug;VA@n#0>*!$?U$z??XJEkidYQYIAp&B>n4Gh=HsK z{_9)=0Q$BjuTYVKSfCf` zc>R5KfSv5Ejd=u!w<(o9PIt47aq@ZZ_7n8QQf& zEyMhbq`MKYA#+VXLbpvyM?Cq3)e2l|JW;AHJH5bG>Mf)`Jtp2k9&EEEm8{TLk0E{SFv{onVV@`= z@`a-)T@a8w#PdLceXX|EhNW3VtGj^tuf9wwMl_J<%}+ybYC`xXM!}?(4C%rVW=aeg zII2bsrFB6}-K-2G{MD!6`Q-ssE)fG6x%Oc+_p-~}k}h}V{bwWh zr|aYz0(b6$|7ZKq7!4x!)ytKEe0Mj(zda(=Dw=7fR1!MW!X?AXKy*!d7h0MI3p9fc zXvs20Zg>`czSV#%3H_&z-V zaZ}ZF8a+?U!YZ;Dq=eH@qwtajOkT4|%DnB@a&!_acZE9q#|qf=?~@1>Ezmi~UoA@& zER{&X;qk$>VH6KvGk~(kiq#J-;EacI0&l6+%1D=hnW|qs8zVew(u2IW52XuzuvD7} ze`N;x!43~%z;Bj&6e;1ZXdHYeOT0?|(bD&38i;8C9aq)HO{o^Xstlf3eNx1}Mm*@z zkpAc}LbpsvxwZ7tAgqO^3_-C|9lvp{cosQQtp)#gXJDTy!y2!mG3XRSVfa)z&kx%~ z37-2B(m5?&9!71gTM7WoPncjb-$;FG47D+3AlyCZF?>InL%q*|%4uHchl&Cp$z9bW z%}f1IsXfDDZ4_Y3&!Rc(!tCu=hzIdKK8vB-pGT8$5y3LG6kDKBcPU8%R%4{xD@4yt z=|Ioie5ss6_~s|!`Sn5BY?z$dIU`}QAa`yLV*hZl81dM3kD#%eiKmK<8zC3s|8yBD z>%#&m>H5O&VT)I=a0?AYL-fx5@c&|uD$pMzhAfF=r>;_9wc<{Q4HO^AN67x)pA8h6-Y7{ z?urQDks_mFT&C1Di@r7o3e_ei-@8uAyj&`mKU9;ggfsFB#T*X2DuTMl2G3jx=YMM) z)^r(GK^T*CgUhRlVyOt5!v}4w4-a15Ejh^O1G89vPh2Dy=3|qvIlMTM_oCD=SP#)c z!>b|r@j+=yOAhjx322EW+~4tOgYjR>8iSq1F@gUGuhww}V!Y)zt5*kGDwuVQE-vj8 z?Ql@4tqvLY9mhM z{;WqO>5pdwuvi<=QG9Ke9LM|1MYtbIA@TPe210}T_B32uQsS-nJwkeIvm*b-Zh@I- zDMQn*nS(7i1Fh9WWjKJj+tqIEdoqUTSGU7nQzNW222#+Fja>owDE?Si6M{tJqKW(( zFJia8Lar%v^Aqs=N*RdT?N!{fXd-(~H)5Z^NDO4vwGW|nAZF+bDkG_`k0AcVOHuD~ z!#eq;jkil=RWk@cT~Z>8%kJ>$zN1&n=HRSR+xIAIBhP&|l_w}RXwqWG`8Em*W0l&|OOnMRQ!Yo#Om@k_` zohqzPeym?1A)d`4`0aV|BqvYIm-;Co^g1Ghd4txlMTk^_)QIk`PGDc?3( z-w}}-5@=UZSnWal8?TXb2!4eIazK)Ek3S-Y)kFi?GlN+8g7P4%KKu~u<5`pnnWZ~! zv7m6pYNS4Kk+9m^lVvo54h3KN{(kh_KOv{UUA&mh$pbB3GJ=Iqvb+p*-S9X(4htHJF!JBSi`1;?WF--$8rYPI`D=jn~c8q^p8A$lParA%pc?E#9+l6wJ zlYQjaEs^)voJrxVrUB)5x!thncIC=;d2 z5YIG_QI~j(z;|bm{PdV$s66*11X9q5I-nmYqPo_N!j%!}g1hzFKYgl{RJekZbVn1L(eQLLL!eBDqXfsDz4_ zj3V)Ag#inHc?&#`Oc-Tp3*6yuSl)0dj=W_ERow#TR2IEAJpuh-LV0!L@ru`X>X`WU zt5A#j(DlFsdhgf?yTu`l?2&MgyhBPh%@EOPqmL;dO6C}s3%c8bgYVgh*^6i(Exh`( zhp=vB6xn>H{Ql@WJbHA~rvbV$+WCq8r8aZsgt=L3NGVAl;8-;s5uzbkdL8v)fH>UUz2- zp-e(Ri4qVR`=DtcqO0EFK~`Aq%iYDY|295xoJksAqFaT8feCuyHQj>5b!^R`#8U4& z`c$>0Z6Ho*0x~gAergn5*B_GRAm>E#Z|IQ_jSarsJE9;zesE_2@mB>616lGQ-iZn} z-;oeLtS3L#jq`t$g90mZ7$!Bv-FUD`YKn%paYXOlvcA;5O zo`>utin!XM>iVe?S{Z6^5CZN%nWWL{{D^;}!$5v>NR*{axieA%RW9hm^k>gkeUOj* z9`=ch%$HD6)^zR?LOC_0Zhsvr>q3I35(BwwKf3QfrV{W*1L<^Hv@s|N3u8ar*d>^S!ASBrr}o}S0xFDQOv zLp0ipzTR#uEX-kYV!S<`Y|mC<%~#q}okHjr3gPg3Pmv^DYqW6nZCM1|Zo!4k#^#Ys z#3kvSyEKXeZx}>Vv!G{d5@UBAgtemNsR?EAxE!eV_^|aOYfq8c{pqH?5OKpBTu$F~m|HL=5DU zqv-nNA(So+31rrl;*<(c}({ws;n zs0)j)44~&w6-QndKq%J08Q+}6_<`MM6w>V*NaGN3n2`X+Z@dsq58d|3UyN&m|8od| zZ$G2BX{ldMw#3zLEd0xrvN(e`KaRiy(*_xXDnr()MKoSAj42vOqlq;ieH4zVoRn%pQ4@pT-Hph@(`^GO)dAlNBB{*}xeuqX z`g4!L+CiG&@OUu&fz60r+$$m0yS_S)pf@PaF&3K^Kqe)jv(-F~zGE%sF6fpp=*)ke zfc@zi*hN23&8Hyh!}jY>Lm{AMO;&svb0I`?dmc=S_b?m4%iPCOaI?&Nm<1=ZWPDr{ z)LGqPnRlsryA)7$22&?E3A4=GVH8W23PI|oK0X5b;Sz%1nnLc+qwxJ;PTXJoA6KKc z$}PL8=hur8N3zrHzk3eJ>qim!)FG5!5tcrPZMp*Azt6+QME?Cu#57?tDKP22JBIAL zq5^tk#Vm5;q~ss@KMBDeufrYGG5Z(Y=ssLQ_m{V#l$aN`cQ&s?6HwC?wA^Jy?89fE zygINX?a-EaP{J@0iF?-`BvJ;1Hcntn=Cbuj^SfqPg z&ZS^m-HX^4FNU>L$MB8Mz@8{e{zB@VO1UiW=Q)v5DALsp=iAT1v*+k&B=Q)!p}eW{HE5c|wU()I8C;udHz*8VM^id8Ta!C7aV3a3NIw(U=0&zlC3-yDVK zu_<(Y=UI7FLiRv56CxfybRH@f3=8+L;<{pKTft?7t+7KZ*|%!}{omdJjip{=hMqGl zxz}&NCJQ5-ZE;$C3y``5zib>h|cR*~8^iA*96 zyCyyo4VMk$@7;j(m`}~X7~bBT4Pi;Km2JZDQ~|E79CR7h#8a?>*y z6-)4@_$ATVuijfhuqbD z3XsMoA;X7#MTBpj60ekgUmpT@#n4#oLgDpY=>5u0SShe+(WDdYAYYZReAv-wswq9z z@#}=JwCYk_GATsKi0<+RB)lNpyuO%1qr_PeYLF`z zOG~HO*%wjLZ8^f`Rg%jwSuQ}O&(7|<8>7P`Shrynrpp-|e1119*^(?2)st_cQYMy6 zDe^Xa4>cA z6Icqurw>M*{oCkUy{oGS`FutU zx|q!)nRg*ob9YE|7>U&~=##mM6*G*Hn{;@GB}(277tkJ_l7e<;6|2K2R`L*?HnUQ~ z()l~$Sv(q2pBzKzOXH}maiMs57lOA+}W`_br9 zJ(SKD2^}JTe-ySv1Lzs)wz<>})v}^iqc{z<$Q9o! z_m>8dvQpLreEuL@zK{?c5GGF186s%~-D>I&N~c|ogR-PczFtMbK&E!)82L6;Ck=}P zYf}CeMiWKHBeUO{4L02^JN8*;oF?pqd-m_c)WoFXe^SAWqGD|-0t<6qT>foyV>t!p zvT4IQM58^3CllED%r-G_gA+&@mT6pukWVP+gVXJnV^-?CCcAL*x?B!C_Q-=`ASQ5= zM#9jPn*!%Jy1Kih?3_+zg%6DUU)|v#a_KlqWOtFxn+x6!mxn|TcHzd#7s-xd!`R3W z`l5;rKAy_p==eAq)q-MOwA$eDxY64i#e8fQRLrGJTejuGu|lVT7(4oLFm`j59ACLw zo;sKY(%Bm_dn4i@6&A}lSo>JZfAIoIhuLLcs*|aMSuK*B7hf4h@YZ9fjd@Vr=z{M* z7g6umk^JnK@&x~z7h%%>J}(_~HX3tp?Lpx7Db!XwQ9V^d*PUA>9N>@;(YV~<6e)pX zOqW_Z!v#Z9S=iT01z{u)c130JGFKq0V!4oOL*TiXlzg(PZt$UV`cQar4dz1{6HCKp zdsSKp2D^ydcp0@-d`(;kHisLlM@O(~)rjoWPi@_X3t66rFu19$+ ziue#*x%rIK5D55ibo?le966%;A2bW$E>;vlCgB_xuh-*(!{spgJa(zxZCJNPxV)a& z@~Du?(J;-K7zJRoARGxJ7!IkoA zTqqPuBEPn7^(t8f4EM_AGLDQNL$#a}m=C>vFc=cn7_w#(Nsw#UakNMc#AUCJeuv!S z4o`9dY^npCxRi&OU=j66aVE!k5c9X~?_EmYm+EDmmbvT{#aN^jDHwiwfW((q!~dOW z*vBhKe`H8{BE(i@-`XqeB`03xA80X5Bqz&=d}dsp0P_v|p%U~xIix-{0{@S8Ah2`J z7-=QntzEH(m=euws8Nwgvx`!cXpd`(JdN;b%7t+uF(0XxOG5J_xdZ2(23?SOujpui6 zQ@I?IY{z>cHIk_$ve`7Ey;0FfpO}~s)n10B^q!#rOXoT& z<)V z-$xAn@H;G`u#XK07LZ`+s>cArIU(1=q8AR5rN<>=^vkEUIHV z3a|4c`j3wYbBM?;+uhRcr>NY!k!Js7Fqa#By|FLW5vx)}D@IDOJm`ikZhs0x(!-kLLyY&fLQBY!>zd1vCa+NL@cHrQScr zlkf(3?n%P;)0i~)vhRt?f7^}~k$q1ug1^`a*U=;z)tY*UqzWYidaW!Xo3OcLcVros z!kU$h5tPsAlZD1oYnuj?glyCu=lcv-VD5xWtW6RHmV4XoggY&z%}mn%cIEH*nR-eN%S>MbaAP<@$p@HI6 zrCh}!r4)44&vFbdV5bYgfKQ+;b2GDY@61q<$7OCpxq~HrNCnL)mFw{Nd7?rBxO3vjdtF2_DY0{}wvdxgV`P6n4%N!Y|X^8xN{o!7|=Rz4Wltj%u@o6iaz3OHgHARp>W%f72KYxVQSfvDJ1O zifpGZredvlp@_yUofkmp=3@dO$y_&t!0nT;E!0uIC?F7d;^Q57+XlSqpL|kA=EaQN2u83bV}H>Zp~^D#LN{6 z*tv6;l#%7>8S-asz#%6hr8}>R2E0e~UQC3$A`u~&Cd7Tmv(E}ioKex1e>rK$AuQfA z8Xi4NGLaD(HqNq-4i8|*Gh0zCvLeOWn|id;<)_BG&5mp)tp?CIW76M`;o&jNOdpX! zvt%+Y21sJL>A4tEi8vbdvTOh@rxS^q9g_t!@-S9-hefRDJvu@wS-Pr1Z@erByLI%s z9hl3Nk*+fG-~emOG>{JSY8#6A;T0MkOFC-HEO_PrYzC}Ie_#l%EtEOPpn8S}_B)Tfm*o? zD|xNRcWdz03b(DD^W+Voxg;T6Qy2o-sM8S$bxX&YyCg#yszLEM!ahiYX|Qsmi$^j! zY)SCUN>@do;3|ya9b*%a51EZgdMlQLWv7vO41+{l;18-yYl_ndKd&&xtFo$sxtjw{ zswB-nIe9M$V$1vGN*n0JV!72|T}348*P@+S@Bq zZRvChdv-rB2CF2ZS#EAYci4p4opb9v_f#@1{TZw7#^BH}hKC05+|Fl^O(m5VH0V|N z8UD<$k8G7>eXk24bprzfy=V%fBVe(6BA~RO5cVHDBnHB8mt=h`^ByaZjLtNU z6aB?<+|}}hB?cl)^_26oqR;O{K-Y0Fk&}BO%#;d?MGvyvK-$6cNerMfc|VzrbQqSk zg?hgWsgDoK@DyR^#mhoc>J8mKEzEe8jc#NTl4~zq8G@x$M(}4(!!APd+}+58!FoT(XIW=;N-Rv*-fAcU1n%m*8NNUeZa;-- zT8fyOQqBCk@aZZl87@}oeGupfMNG|`%!Mhty^u*8cT=>|HK~FLY~C~kgP>aVQdGxR z8H6e(O0~%FRP-w5cS^5>;yV0(lJYTh5=1SHThW!as4zuxyJ`(pcCYPrC9+8ra-$&} zUHm(BIG9wkamt*EO!eIJyl$7|L;Zby67nr9EMQ`MT#@G)!awvtoRLw{yONq9jHE>k zdy7qkLWhS2v1j)#EXHQVVEKL;gWpfsdP=4Tc|Dx7XBju0N{GfJD^+~iofHMtrHHa| z!$w)K2M+8fi4yE~CoH-H`?HkRJ3hHq#UVr5prdo%S+-qzK*~U_>WRf-*Idqk^CU-0g5@G>1w+2d*#VR;3Bvb-7_`M2$}b6^e6|;XuRRNg(C%|m z)@e}Xt7Mdn8XTV`We)kBn2*o^B<#|x=lpm69Xv~3i3B5#njzlLy-M=HZ-+HQ%wsJi7Vs_ z{Cg8F-42ZgG7yy+jM?cKOdV6b7@i|fNd#1-iKol?5h^2wO^@5KpufK#Bg2C@a9|In zrj9`;Q@h85P$(?Bf3;Xdp^!(hP=(d)MOQF@Y+}xku2Z=UlXk1ii)1z{+UrC8gOX1z z&d7cz&^%R{Jc^uY6r z1z6*Xe7Zj7MDdjo>BhUZX5n}|t&&8tzF!m&9$p%UEz>}C#EJY>-SB>Y29CpfVQZSb z2aCwRtI{f=9J*ShBD6^@LCQkcf!5j0-8LA;IQp`)mi(uNC|A&W~#^7U&G*q4O& zU`jOtIoY?V8<|aE^!(}wnz@qX2g%DvP>H%>q0Tu=n6r8KcPF9c6grr@Hb>|Zm-NFu zQ-JG0QW9Nxc$$W4w+rbDqNs6mDA(bBb{4K9lu%}|!;bv|?~p~sGSG$XqdwGws+YzFv~x#64NJB6aV0lC7IusAggp)< za%E&Ibx{cmIBggRy3rMIVIfsQB40(JT1U24MMXTT7|5+gJn!XCldva`!o~-!Sy5t%QFebr9!yx%+3ey(AmiDxoDXqA&Tt6x*Pel9 z$O+DaI5SF9P7{2vc*yampSS^_S@MiSf zKLuN%MrH)WFCT^;E1>5$s#im5|9Z%Y>5rZ(W#v_$c}(WJg;>q+z|qfLfZn_JK%dT| z<<*h+)79wt(LQMLA~Kf^p%!u?@Z_v`vfTN7sCB#0fA?NFCmF{*ts4thjzC{1A^O9; zXq1Wb0<3;Frmr~_(O({wx^^w%!rW^|(DU#t!cWYhR;i#G^mlRf{hb64h?&+=*7^}adbaDhm6;O-Pdfu8-G(pY~KMS6N}30_6Km}nlmu`L>$qg z3-j3w(r;LWv9ylCt!a!OK7@MEiRV7B4m}TLk>6Jq&sMt7FML?u`;u*1MP9pG*KkIE zNW5U!=afx~{H!{Y7X~*^E!_5@q`1Z zxSRN@%zL9UIq3cGMOaErRL=1sech0pS=Zklf-Pah;tb8++#_SN_VE%TUz~uY+(MN( z$eX)m%1}R007?sRl;e<^4>48cnk1ZrfDnEmi8l?zR8e9|VhCnd&gw;VO-Sg5oHGUZ zb}ouwCk?bR;z#nbA;4uv-_H&}OIJ|$IS_lxS~=Iq?`Po}PYX-Q%m>ay^hf)krz^6F zWzOqEWi)`^|2Ql&Bn;2y-o6g@`67y|1MvTT8lL^618oVjAz|($mLut#B-8|SvKP_> zVsBjq=aCHj+ZNj5JCsMTRTSQd@)_}WZbInsIi&t%5Iw(|fMqVL!XK9%vA;Y8gLmzL zqotVVO9LLvU$qXazq=3hVhJ;Uz7C!}NqD!%RHvR^tO29=A(aT_RowLS6^v(k1Dsc%3$s zt4(A}iabr3xbg_c6P~sU2xfoaxI)5-xr!MgshGZn zhK~dfL&8)Nykl09JQ@k-Kpgv2=hplT7fSIJA(=V0rW?X^LhvHNkM;>ZtOm6F5jaWV z$RwN+pzGSQ!w;{1M(T> zLQP%6{MDyo{ zcH!wtxav6gr~TM;=QymzvLxS;?kJWC%+wK^p)7AOJ~3K~(o% z)WVvla~LVP@W8oE4FAsrT$Lu~wJs!m8l;%bMr5XeAPcmNIH}g_)KRTB5b-+2Fqmgd zlMh(4!b#=hN*y(6WU9`UDoUI17z-@XH!pb*Ns8MBVlbGr8&k(G`c4Bm(QBNu~+p9G!a-)yQ8YWSW!H;AKA-SA$r?0BELNMfin?&WE%eM^I{aU?>!B^ z$EQTFg&|Mx?ayHD`U}zj%PBPMR%FiWM&FMQ3oX#(UvGqG$0D>`6{Mr74*6ioRS~#< zT9VlOrGv6CJ&#PmV$%@6?o9OFxgXYrqI8HQFCX-wH5f#7(2MGj7r~z#5Rbzgpy79* z+V4ia$BoJ<5$JP81n(hPb_?;hu7RGaBK%kkEuRCE*KWeV?axDF_~)=<;oTe1`)~WC zKO~etE)5G;pMv3^92H4~10Opb19$I(Hj!*ojdH^A*tKV3=*~URGgZu9wHD=mH>^Y` zP~4|s#pts+1ZEVWT_ImYC>$08DYUBi&G}VCcO~FxS&?tmvAD_$*Nzy1TW1kGWfgY4 zcP*~?X&PO27oOSrxKzf*X&?{Hi-D-VQ4L*veR%FIqv(Hd4$+(qPhaLi^cP3qsQ`Ib z5C>OzpxHHKU+zc$uQKo-s-RSFh_W$Njq8o32(Gd_&M}sn$#d2wYarm1q3*K66myW} z2C`%%YI&N_s`k%@rJg*L>NJiQU_vq8MwY$uc|H_g*9FJ!0$dNJB#D>tNhwcI&cG_v zl7-jsJ$ZP3n@}w7Qmo)ia{H1z&z67#Pc#;Tilqv*3>?%nGV z{o+$HCmz4-`=Nr#Sd3Ely=R%*#!NRds-G=fiAM8ic2>xgv ztdwu_+TlzWrAJ|LXu`kSblVWQe;k$m0PN`+npKPJh}AA9=DvI(Mn16>^;R8opV|!9 z-V|(PH@5^Qr^`G=`}vJqJea#4s8azj$f|yJM%OYz1i`3 z%t_2->4*%qyLA*V4WfLJAC4W$2&|a~Drb99xFRe@onDAj?a6}uz9ZoeOicb%w?6>uPV*)Ww=Q_cKvn=fv4jVqSnTOn0xCOdVe_u=b;2DH2!yOfd9!^grAyc zAy6u0^sJtvIaK|2OkR5y`hIc%?jvc~DMH$6AruH;cw_{c--r7)*RbYSGia6TD0x~q z`sxALCsOeJXeYv_uEL(bITaWDWFAAoFb*HwC&q0X4rALZBMAKJ0783{QU#lS`zZ*` zlyTMpD>!nj4@B_b8v_`4XbyePWsq|PG5#lA2$X;gJ8GhDvcQgbxrThLfx0;+*|CNt zfLC~*HboG7Wq!L2g&H~0lqYyW1L<7YOBH6L=+!<%N9}o;5&cogzVs$7BB;Y&2&WMl zYLN}a{cu`lJOrlE;kp!`Q43lv4OcmddXqb>A~%!a9;4pJhMR($sOA>C=G-B3n@Of^ zfqz#*p<_kz3&?E@N9*{P_KpD%Ld^&n32+JxzCBjm7{2S zbvbkI_5}pC%n8{vDK=AAjG(+BBG*SR75w=)>iG&vFCT&9`9;{~@)AA~0BhB)h+jE^ z@Rm7f`6}k#vR3k@79lJPWg*Gaj}f7)c24fzmGu#%F6~3pugmoYo{hu*bPSCGCkmU$ zUpN5IL=LV5*$|r|la}8UM(=}Duo;OlpE(6~oIWp(y?#^#b9mor+}=Ye1h-5fA4?!O zHh`n=+5n5)CdlJjv4m3|UW6x6LCjso!Lx&?h1_sE-RM4;L;o`iu#~GJ7Rszl>+#{4 zO_1USCm^l+Dj3*R!I0M_90iLk+1BdFRvV}Y#nZ`FqXka8hOvkneE~PT4!iQu^(Lkh z1%eg7CZw9nUn}kUX2YuUy(|8%lYnuh6KezbI_d%DK}B2Lf@a7rRUAqmSXtFMp3TJ& zNZ~@OKr75at7Ih!6GISaxIx)(cB$#5jIKGu9|0Ot;ND`Bij2Td>NO?pESN1jG-$HR zx9U{M<8XpSO1w6PK&-`!{-IU%DL7Tg?>FEcY+T7=gjJBY4eqdY=0+5su?TxQ^CNOs zaa@+ikONXE*I^NwA|aACe$PcA8-h-92fOqYTD7KXXc=tnP8%l^Z4y!ndX^K(?7gsX z!LFq=CL2N?(X7@*&#)i*PuEmRpS#3=a;VkjtQ+r@=NPpDUCL zs5u( z!6>5F>%dsI7lUE1OrAUk`fQh?*<_=3Qok*cdfxLIR~Z41W6_q)eEp0h9<}XfvhNYM?!ZP#>#9BtE*0j z^!ruf$6Z4;Xx02kQw)bVFBh>_jV5xLB!WRds%)mZy%-rDMx|Upv5+-jHcgaEWzk{L z93BkyMRDZdbMl-x_~!8Z-yyt!ABzhMD3yys@w(Xb3#6vZ4Z&iOe~S$@b8jxW_8x4p zAmFs4FW|)LZa;iZC99|M5_7#7E1m}OhlWDt@;g~hAq(Dsl_+`)H9sLu_zujG5&SLt z+7pjz=2zw%79W7ZJ2io77FsR_YlRGb+%;_?3qbgV!VQ_)9x8O>)E}qq>J)`!v(O-I z<06pjl7(%I(6X^5H2_1uoD*~+J7z)_l*F^JUI<-HT?znn?GkVrNKt`_XvBZ1B+*Ku z2QE@xgQ4#&s8NCzNf;pu&loLehlJEIC(cU&5xMI(nlv<`gblS?&Vx9W_Mgb5i4jV1 zSQfCLiVf8zxi{iTm%xxB#nvPPd|1h)5iKlzqo!;i<+7T<` z;-DD0fJC7tI2FE3okL$=uNoU})xbw!cX}nMC$c)3jG>q>$Rs7h;;!f*npPd7gM&D< zf2Y9i2^sSEyX0B&>2Ow^=R8yMqTJNPMrqtNHlT?QGdAbWE(E*lXZ8mX4Y=T-OoP!B zZX1Z1y{n1B7dDViqxeG%gr!PRFEcDr(Onv+*FIUbC|@XfZx1FKxJjun$PU#6GE>lt zNkbdkq;sOkjhazV4}+6$HenQ@COJP(%{`G1U=xX6p^_K+ed4OvRHP=lIio@ArJORw zI0>SYMNF)efDM&iUb9|OQqKlyf|!ALHghMksEScjNw_imk#`#&jU;#M{Ij6I^CbdU zN}I;cFPn=@`q`!Q$}mX0hOp18kkRjTBit26Je?QLU^=r3u95xqw@B zwTUToKEM!G!dzAlCACAdTE*J+>yS-TKT^lwz@U&k?B2Oe`VjnHK9jzoQ8b!10Y6S1 zJA_h^IhGCK?mm>OHAF%o%*;&6XV7{tIG5Eh4DUFP|mnGv+)2?ot6$3su*7XJ9 z&@F=IHIWm_@YN?2nzzG1Iur5Z6ZECOyl6#A#zd4jyX;1?T9@E4D{36B;KIbF+LF)) zRee1VOKJ*ED`z2i0h*e2Gium$wI<25O{U#Q^-~j6C>JdUc$^M9TCJ)?YFym1;K_X@ z+*D*dQOH^~?Z@22lnPMyKn)%-zhL-KRj_eW!dpaOxY(63abeqCUe$o&hA%@_s&v4$ z!=EW4z@3rCA(F_Z7c$YmZGa=E1~nNr;*3jOW?Jg#3WcD1oXBL!#=;(l6?SVwp!_Di zk2w^j)Ra{IB~0}#qKyqBAupF^!J4&e;cz*HtBZy(H#a9U=>$;HYYLW4@*XZg4GkIn zRUsHR9r32MilC(hC}{vO>5bYQ`WC}3T?VWCfgt>WfZWd=&pavjMhryPF|vA{gnxZ~ zQRGr_%rDM?!y39b;%i-em@2&L^C>yT6$CIBty_p;mk3R1u)6-h*t9FCNq>12Nvq@THc7 zEk6$@LAgvWC8@3(NLa<3!QGnZRPMA)^f+`R#=#w%v^WgWTBOZUp_6iM23XLDrv>^d zUPy(AZ5M6Cr~E8q0}?!#0y*5tWlqCHlN#Y9;q#iqAo6DQ%s`&qAL=@(8!34CdU&=#1qv}^C3S`^ zd=K$%A`>Aq@8)w?E0r`zT#an*lGcYzE>AuFs4NVTnAYtWUAta9NGKeFL$l(*fxYc0 zfzN+vXb3a2v#K)b^desOVxd?O@1eZ#(mIon5*7p;Hh5?t7D&a)=d?j5rL9|+&C?tx zYv(H~g;*~Z{=CrgUfygm6LQloI%B~XGZW%>=pC$uSvad{$u+nmnGkCdG02RzFnYLQ zVVER|H_@qT5zuR}3Impa>s5I$5_E7@gbX2dCg0*tRIVcBUR@TCB<{>VjQI>3D^`*# z@CXf=w4(v4@^Sl?%4Q(a0l_YH9x}0KkReNa3xS)HdWihIrM%*uGG{}~d!_OS^`y<> z1E(HOJ8SdOAeAwp$S{`q!u0I_WxeO3=9qBDDVaa=`UrF9roqjCUanMAITd$MhHM)* zZGhM9!E`K!**Rjr_!t!GSHdh7EEq}|5dvWwL&KviF=2Xc9>qdgpzTB^5D3|cuQVk`8KcI7cNhw=O&=xo}8j3D|=EgvSUeim0Y+aRBjEzjf?H9{IUThJc z@ONYP{G&g&>;p11Po};644f@Ry)VN+Bz2RCJcb8K&zx-P%s*K9P!B;ZEZ$@_L8o8@ z^f=NJk^DhnxRjTWBB}(<(j&3j#k26G;OL5yMv_~h{%=azvs`3ZveO-!^=tLrBvs== zRnCYy<4sX(5+XUbPll;7@kKQbY)ly%(XYB2ONUc-0;L>FQBFygnVSgdoLyMf`8`LD z9uerd)Yi}hEzH! z;aLCRfQ$e;ogQ>|bz{%2ZOCR)QuJ`SoWdgM@di+0GuYvT?u+7Jynsx(W+;Mn?pqc( z4C7!qoO>@}C=6S>y*k$S2jQ@3%FB1ODgOT%NJr`Re`_3~fn6`amYINVVZTAS|0?B) zb(Z8v*;7+WvUaB|Qa)flBqoRqpV)7Zuz|aTT_ISN2n`uJR5{gr;8GrLG~o1xR6jrx zaic`a(k|z~<(L&&%-l^2`D{BuH^U(_f8q5L2j+Bpgi=T(p^c&h&sol!yui%{vWbOu zH&>-xONH&FuvXnso+qhO2^5rb5$_=-Dp_O!uNRB)xT?w-%!ekV!h9yGVXC|(MSe&; zO#}iNTIiWsI5_i+(*z{Q4J8(vMSNjaHU!1Tr4nJvpw(M8X{e#0^w+uAR!ox67l9kW@_msDyf)`N&l3NLPr=Ri4?WYv}i>GB{DZrCI}}dL0pu zj#WKA_}zACLi0Xy5KeOCKgxqF+s#%of)m24|0hc!e^U{N9|Zf!yn(X&n$vUa2Q;}8 zyCl(62{=Q9s`Nt0Z_69T=O(3FS?M$mHst7in0PN4h$333LD!w|_=92qTnvooHH!wf z_x}|4UOkeoS$5tIn;9ADeU|sfb@vP@O4OwQL83riQ4)=A1OgNwUI~yu>1PO_eu*Fm zG8g1%O!w(?+RgE%yw9wvw2|SR@T~Q|5mD8rr<}|V$|=*DPSn?z5jufDOL0)ov;_L zUdMySPi0^n!p`|w6oJl(^8H@am)RR5l?ydKiSxS`_Vg@^#cJ&B?Zy7n`|dJbu28RM){W@OWB zw;P=n4J~>M>3_*ca;MQ${ZJYJ+^u;6sQ08rd?som_KlP(lIU~|h&d!%2Etx zwH7JJ_q*}U7k{a|f6^l;7Lv#X^YIqL>yHc3fqFk4DT))xZoT(@Ak!le3Yw~j=?w;P za&{gEZ;ljs=&Fxrc_V>wZ(b@+T}WRYeuh;@4WCQi=|BT5Ugxw#dM|A|@3e|EjFc)g$f+gpoKQYBkqq>?bjXrFPQGBv(k$cN zFc-eCFc+KaD{>YO9z2R}3(euF+T!$KPHVHg0vbbRdlTx25cX zncCua2c~fhqHy{+N}XeOj#C~e>Igf)%j}^`yF7>jBN}}ehX?kl892D4UMOOSww|Je zcuDF`gTM^6)ycawW?eb8V z@$lh;I67ugXRcmmRHJiOIRBnI#jtK`3*u6N00>%f zQlgxjS7Q;|KgxwfeMXMr#wv(aTajtLwxqQUN5>}~-PQZ3{qS60^I>J60SEAjBz z%XstVO$<6sMF$#qK;zOOW>HbEr|$du#)h2c%JOo&dbKafqguTlmoHuQZG8)Rw}HrQ zBzg`M6e12zOX<5lk0Utu{H)niO;o{A{XPT92k37mm3r5NJnU3Hdn8O9s)Cv{y6ACK z=9gjskR}n$DCu1dhEZEsmKd76vU#R53>4aP0iAE8GY%i< z`tq702i{u*yFpjR#RKOnA1sL^h?nG51e4A(^t_Z3%-8CghbI-npuzh`y><+{=NkP~ zI3HplgJ`i{fZ1~8QK?qQg?iG@&4#$N!eN|`o40OA9u$iI7hirJ&z?Ssv(ttP*3{^d z_e{Nu3FU`0v`mz)2!nv74M#Ru=-QKA0)+2d$5@buIul^B(4aeRCnrGNlhlAiCaTkmPM{_MOJ zPo6%HX5&ovUx10kJIm)a-vj## zuYbs?VpdPI(Wf+a9MPe$AC99#H2gyi z#Q8P`Yt+eqPQga7Dk&D}MO}vvS_t>!Fd{TN^6%K9}-}v z+lhw{zKKB>rI-9XO3@paqDw6R^`}%&O~TLeUPv~f$$R+fb&SV-83|<3%3MtjsNHJD z+S*#&y!l={y#Jl9^XiS;s!_5dnFZYihUa~I<`)0}AOJ~3K~#G&<1pTh{Dwis(L=nW z(T!JUoqvl4LORrV6mx@f$#!yZy;`gwf*%wS;MkJX5ZwgS;T0v^%IxAl6^rsBN`sz#*b`7u+nwY4qzQnpR;gD1zY`KGGv}osO)-@J9LFkm9MdkFN#xuzQ zVN-IJ=jQ8b6hTWMBA`M+er$dWX^kn}7HoEY%0m{n2pJx>7ZCvlD5UpI50MJFYX^RY zNJ1YZ-@FBMW7l_tGHK#Y(}#mNJ$f}w`(_Lz(^F_t;!Vko^EFUMsPL`TwWVooV=WF| zy@~yo2hlt`oC-;&+Kzl5Pb%ObYxT~kwoeR2I=ofUSGG1c%iTNt~RX zg(l#rS!STCjD9JNNb~9(^p%yxiK-*%6>HIc^x=oGy}1^j{QNKC&A~w$Nw8lv5@)S} z9D!9MY9$-9HuLHcZSC&rnKVyMV|`;&d@11KPk#C*ie3wgq;N6JXRukB`>9v`aaA&;JTU-^sMhlhq0!HCJz_rbaiDlKKS5H9G^Gi#q*cZ z@0@Gv)LXEtCIK)Ii$CXn<0QA5q*s2(cx0mGrArs%=1mIpQoMfsD!%yaH*tD$rdbOP zY?d|3ux=*b5v}mJ)E(^jFmtsK{gEdM|LDgb#_IA?{Mn!Wt7x8`P41twK4d(N8oIVK zI00d_T4tJaD1gHX@$+$d-ZWfXF2~-^X1sX%#1K8g2rEmLWCHab7ot6+*~wy_l6Dr- z1a$FiG4s z7<4n0C*j#O>x_YzLEGuN_p!LlzKXe2Py(G2B`i#>uCmypCLJ27$dSaW4_4QNJh=OvhMF?uth6VA1-i8q z`XU5+1fag)wP{X|xW`cDEAh8}@*@?%fBvWcI+~618T8Qi(Vb>{M*XZ-(XlJg_gK3d z<%r5LUt?xPY#Q;+dTnHt3=v}_>^Ic*DN@|>e4KX%f_E3@tMSo?AL^byfAL%fwzahr zt-&xJJ$V-Gvm-eMj7cNHOg{F9@xezwiuoFA+1{=f-|E@%`RV9Wgr`kmM2z`rITnyz zO4WOth(0a|=KlXR#S+Xv?ndeOe$-0#)TBS;;6#r>j}>X``-9d|(R=~Cx1-fKbHT5o z*N|X#|FbupD8dc*dr=S7bZFjx?@ny*Y{xhEA4TKjC>lqvl@?}Li0{u+m%MP^`;iyU zWHc-9HN^OMT{bV>xpPy?FEQF*{p!=$e*u}0Yp`0pdjQj3N{*y?4rOs^F?}xLB@U$& z<+=Iz&r`NrwR24`v=>K*dM%iTQ`3HVBgPvG>qk?)u=76#M5UlqIGsG zfPvR!`cbm3#Zr9u;g3bJpG;6Hzf7ff!g1-4dvPoK86(cyy{OHXqsGsrCMxG5k1hXy zZy+npLi zw&8!La35H?o#NH|J4`;yhgt_StxYB+Lsf&rL5cw9NSYXWEi1osdkx*@4IjePCWJQc z`b+5sTdL;kv8*Ec!>BLT-|RM(;WlRx>_GG_j4A&F^Os$s9mbfiagy{|k|`HNy5Fyqbw&_DXgN6PI#{^_4b zOWpk}m1MfV=kVF=@=-&5cA*ARrX*L#%v9h+N zZal_7&j@-vRSuDNV|^oDA3>Qv)U#x?YjbNSYD=r}=*d%U9Y(HamOHk!wHX&vFJ#t8 zrqA5yrfMk(OL+aahN&je(J?+VEed=8=wIf2g}*mB`k`+~!-7e&^sj!2arC2f^j*vq zDQx?arniBxK7=%2PBY~FPD@^Wgm5vrs>mYV(yGx^Ru?2MwzjcjYKeA!dsz*uoTY#v z0;B7P{3~PNoc+1lqS(I~`N2ani!f&UZ4zYQ-!fh6 zd_@NO#rJn(|LIeK2HrI5$f<_}Au?5vK1BI&XRnfB<2;XEQSXBVn;cNK;Qs8VKh<`t zyoD;00~Kv`eG?4F_dqlAMy53KOM`D%isjYS`0am~{1dLrU!{`r2@yCDs?`SCQt&})1D~Pg6 zt@N3AUM477z`~C7t%$=@oi&hInb8S)l6qHfi6|(qO^-A8w*CO~8ut%luJK%yZ_RU{ zl2NTi38pGxxDi!YYtWtczD4ILr{u<+u-Qq0$vy!$&rzuj(2Ym4R8Ra~;+ z$X?1`#W_74dxmY;c$+Fu8DA6W8HTbFQ`P^Lu1_i+xj*5Jwo}0_K!&P@dp`Q`{n*}N zQ)?mq^6RhT#p5SQ&LZ_viG$@a*>c>taV;+F?dT9N`|A@cK}0vR<#pjT`U9X|ox3zyDrar-+E8STtjo7FXix zwHuSB?(B3R(Zfhz!SYQw2(cGt3j54O%#j`gaf*<7Lh1ScP6Npg?Va!Yz4pNf7tsS9 zZhkg#kyt&fR70b)PN&EzmF^^(hH8}p(PpZU!H26cNth%rNr@<`+wF6wN9p=Vf!xW) zNE}Y_9!rZ$V%lPqd^3vt%}GX1M0h4p6YPv=Tr0$w#rc zxTv(`<6r(tBe2s5mWoJU$i&_-@Z14+PsM{tt|vU{2AW5&Vry$d(dqHir}D1+Y~F>a zS|)FoZ$-ZSDPhK3vv&RoaYvIx0pm46Y@4T|p zbWgjktXIqNWOe^Q&JdebdcLMhryEbuc@Q$L3j4n>m6Y3=Sa><;jXj zh&QiYQUrPU;O<*Y1l`+2#1tzT$CaKdy(4-iOZA1gdHar>$Gz`9cin(PDK10@p}0yh zZr%Doo&Wn!p2zDKPh+9xS_oO!aSRjnix-xh9=GTluVIW75B61IcH5Ci|Tn z_diss=XXaDL%Wsce)5DG^^wI(@{|5X+8NH@wSjLFYLe;g+A)|qyIL#8Y`0PhHw_1< zgPb=sVVLLFIT(0;FS{p2W6|X(7VA*FF)oA)oOcpE&d-jNF{zh;OGkhC*3nPQ>Oz^LGFI%_U*WEVOQztXTSNC zK$5&3TAvwV49$;w6Y(TxPc>Pm-BlliSwP5yx2|7}#}Dtv-S5Bl2=k0L*BwI>OlpnJ z{UH!8F4kjbdpBOaIh33!Gw!e7yo^r!+|!h`#b~rZGwGu5#>Golgmiv?@17hZH7(c1 zzhAv_Q!^u(KbH^xyHO-Z5A)!rJL6SbYyClrAhU-%Kg=9Jv~B6H^)-k%dl++rRzj}4 z`H4eFJs|`OC>1nG^b0hnEZIZR&4(nt@ILX9!lz+6=h7VDo_32vK}o|@(r2^KTHXVg zY$2AGSE5kl^|HM6IGX1TuX0u|V^)Te_hJ4WPv_=UMu(L8aZN>!!ftME#QX2x(TZgL z{{EB4@y(atOpGIs6J$@X8H5?_VAs>R3Fm82AuR%DG421mG!ba{^q0TVFcbGGqf2g- zy1pO+WD&cZL+9Fq>*M_-I9<2Q9FGwS{+$BV{cT-ja&qJI3={f2S;`AH_G{up!G=KFH$8H~q066zF7{?ILD0#4X|TC3*XN2ZP#N~QUx6>A`6sdnH>7}g;I6-ul`=I|rC zIn=O_Jzd7b9bEFw)!CgXT62n`s0O?{SB;xDZp5Wa7gRv=AU^r!FXQ;|Bt0}ca~l-W z)ik(BE1i02y>rTuEpeMPfK^B`pMoI5^#IDGSJdhC;^#mARK{numKivEf*M&$)eLD# zA9_qVHA}g6h>8FpP**nBSEJEr#8+Q`DdBBVb_5#8Ei1pzkUKBJb5Rc`O=i~W%Mwjk zTV0KtH?GB-SNrjsU;aYuVZOKyZQ?DJVsUv%O+oq)>0dsd$O_@qHaE88^404p1@`l^flLprft%@8+*yvO zp1~h#AhRe|3ffaUn!f&I;m&je6<+>4=1(3NTV{WG%GupLrbAnbxkZnSLOU7sEjY%A zrIZuXAw>Lmab?v9NlJZ0kG?4B(*~fq|0>RTAetpe=?g0bh&~)9)fhGq7^g`1xS-2( z$$8&4uWVHkS567cNO6IiNOOyti41ojj{deC_^7}j>=6gC-w#+q&W?4j|$wu$3N=WpSD|4!C zm}@^hJB#nW{l?J+SUXGLU|h*5-`QI)pQjEC!p*)CI=vb{T8U>fD7`TiXx`&^a;n z#Lx?Kvap&2&L|c^a!?k@(wDySdF1rx5@S~e;uH;91vhk>icLa?i&Q1HHV}uD=^rIG zQ>nz(7R=pSN`E-OkDfk_FFyY&QCqTToPXHqjr$==qY{70P_~)Kvjrmthhg7VgK$yN z<-70iYM?29N!BQx{!BTM%xU^Nb(DD6@T$w+xO4e*QG( zJI4kcm0J08ySY|X%H$5YB|Yh6BZqHlhP^K6#@hO}mn{-G(#~_~#ZJzx54>(hD(W*1 z&hOAP#OhU}j0fa#T0D^NmA$Ohv~tVDvO&I^84Gu~=8MCN;ei5OxVWe5r6`yd=k|l|wmBijKfL?E;E;Bxeli2 z3cBGysZ6!G(Wj`P2tta5m~$exC2MCG2I(Eo4OW zVXqm2O$v(nA$YIGBoj`?nRvy_c4Kf+h>I8Y;_{^ns==VwfBxlHVlrz!W`aBakSm)K zH0>qL8m4zZXSv%SDmuYDUaHsQ#f#_h^y#A%HK&vsrAgd3A|3|W?@9xJFQqf;UYDZP z>5J2L>(({hU-Wi~9Q>N1i$?xPjj0`hmTB4+=ju^gSc+RWugAl?-)JtyP<2RHVsVM| zI#j!C%g?cP%4MWn&aXQE?HWz$CA z8F7bvpHy4fKz`R(h8$A}dgt3_GL7H)3TWAuPVPl@45@F*<>BNo8jIkx`xx{>JbdIq zCvQ2$`^?WT#L~*Ti>xI2CY>b;dF`R_!8T%r^pEGaGlWQ!k<>^0FTuAy_KqHH!=4f% zn6hoNz;hNT$Oj8Uag_1|B*o*_#-{3noL=33{3yQt_Im*ZsEFWb*{7Jaa z#+0su_r%~hc-OC8iJhHop)xL{zn-91POrS1B{%Q{1Sr=^oTD@g;x0D(K`@Yk3}j_> zRkJIgZ_l1R)rhQ7J5ytHobyTt6!jD5jln0-D9_wfWX$KCzE-N;x_L#^o4@?^&owca zugh~gmV4#>4__avwpriYjN0O=#J=h1KY#K-5hQQB1ocG3PqZYdF}m)fUji7=>fm5| zv3KE8Jbv;#%4OG=Vj9;rV{v&sHkWHLS9N-qGm{C*mpMq8%nB$WU98_@Ad_zLgrxCy zB>7>VHFcbYVLQqv_oFm6%~(@u(oUMw9&AX0nH-o6MA(TFRL>7AAF8l@(qyxti3P-+i%n{6^V@?{ihn!``4RYxk}@{+x&#I2h* zVt3c{4_@WdU;SEgo6c`6ypU5BBWlwHlDQ7aYXY*Tu^5^qS1}3@tkty@rKGQ3zm6}y z_`)4@9Tuc_5VCL{?E`HpjM355O;7)xqd(9r&xCbmw{Bk32B=4mO|BG0r{Z0S0#_z` zPfTYa!fPK1j9PTHdcBxmT#fTqH((3XNoQu`(~tkmTqm@rl5--u0~t5Y8j6NoCkC>( zx+&WI2X}78$(w`t{MVmO*abK+l>2?Kjrvhj{jIEYcBJF(Du zqJbD52oH=yvaqzG1FafDeUE_tLnSYQiM2o1a`)eqZR^i%U!K-ksaAva&2=X?HvE^G|;% z;+}gF$lzos*R@Y34eCH=d79j$Ni~;}ymYOgLf5ZfRf7-*^X$dTc=GtM4@%-gVel?2 zVdtVhtkJJb=5lH^sVDqdNKN{^VeIbhXh{vwD)K?chp(0PA?!fJB~=B{67;S$5=D_r z$@Te_iI%K;XtsO0C)6Ok-miY~v5Z!Qx(uZn?N(cc;k}U5or754+KiR;ofwXbie|0z z)A;o#Kb_2v&=^+YnIa!_cbo`a`)fCE$II zgZg1CPpM`eh!vlgo(belG@?4a=yZEpfyR^~hYof4HnSicKW+UnVU%@lIJ0J}t<;k5 zsl<<>r!0FH6zb)ZVoZJWA&Xd45wO7^VYZb1QUbSA-VMH zUwkYeLIT%Sl=_{P>Q}KG%S$T~rn`LcQtVy28c&`+k<$Cc3l}w`-)f#m4=z`s6uVb$ ziC!d;IPPn5KG`trjC`LO?Li!#Lz>M7GGi2Q-(7V3km|h5tX_WW@7}KK-wrc^wFXgb z?MJ!Sbe$oY9?w-v?-1mLC6ZDpp`$*9Dmnbz00@ef6E(z06v6wWp=H{(ks9a7GhRM< zZM+8WDdD-~DezjPS2@4t5KP3-GVNJum{U3Q*D=URUL ztKY=Y8&(CRfv^-2RNN+j;H}G*CedIB3&VI#8nEa355=GBG#yWZhsSdj8(-wqF1HyWfjx&1FpoyqtpaR;^UC zA+nIeub_2`_Ub~k+P$bRENZ9=1NrvbujCwD53$&j?sz9o4pCd|t4YhDr2nzAcQHEs zh#S|h3ab6(Cx4;(1)dcgtHyax=LSlNQac175d3JjV|QmqysoomC+Z7xvAnV#&!0b2 zZ3{hrd37t+8I3RnS<#FEFXb5{)JAkK_4@@;zch zm3MoutgNUu03L;EjW_;IJQ6$In43WWqc%Kz@?=xVAwQ}CS*?g! z@WoeO>k#J-sB4vJWY2lJ8+vK~UD~GWfAiXFnuN5BsG)YYH+4UWAX*BPq+0V?P-?@( zVA`MyN|dMfg!5^Oa4}k~ek{}%;=S89qF!H&2M_LP6Kz(!^q!S*oV?lB9uq~7lm=h8 zbT!(&kw}xPON;T{SHD#H?Rm9vwEN@eb`2bGW|mn$H(!r#w;fgOxhO?tuC570R2J{v zyDKd%etf>Z5^I~6CMx_=O%&kbv0w>Bq_}Y0=*Gj>jpz)BApbbQyh#r#cX1N{GI8!F4!tCEdNK~Qj(8o@Ln_ud z5~(kxRyiF@sv}k@nZ7gK*u0U+41hg7C)0#;X1|yBszBL}68jYr8*iJ=1mr14l zoB*-^L_vBANpMwqt{XU(qAJPZW*_}<;`G~2^o7lU+Y z|90d244I;K^as>x1>MiROIKtd7cT6@*7{m}|K%@ZG%^(__jb-%HP>|?=KAg10t)!| z)5fVXg!zRP4SP{jA$LkQA7i3HytaEINlR&Qw~BlXe5p}u2%P5#RQ>qPd7QNSGZAE_ zzRrkO?mDInV^Yvg-0?d!-$|Ep)Q|GuEULXz_caDCrWeFQwH~c^4AL?0MW=}zr;BsG zZ+UrDUD=#kIkhntNGQz=nNWvTH-5U|)V+{mEH5rj<~sNu1R$o-!*R|%luYYR!#o)z z$c3^5texJ`&1H>Oy;h6W71K)G4KKy<*=f9a#mchWPqD#+l<+=K`o)G#d)fs7C#@-o zC63i`Ep+lK+Ar#&Vd!wX|gdjzodaXQZZ?V&Dq&1fkT zt$>K-I_vP5HbkbD-7@2Nden@LYLI`D#j9r#s2P+hL8ggtk-T;;mNG@#C(2Q06y@fN zsEv@-0SWL{RE$H*H77;6nYy4GuxK;Gi378>y*J5M9qMO!K+_#^_FQgeX?|m}%P(TF zJ}=mEQr59MdpL}973U@iYDh;zHtx*(GrDLNT}5`2=;QMG{XLEaD#3*)6b&Hcy|jigksULVHk@lgUTe6Q$x zOeQ_4Heo;vy3y{i1#DhMhk@)L9K;z^9z|cKNXuGxfRQnt&}+ApIs$mC?OuvbcPzz| zy`AlN_54A++J7p?NXNb1=_^V=iys%Nv3u#VB!6B!c@(E-CvuY1w`}jN%@KjiLbrG? zW<-{@Z^Th+5RKj_>eW*0t=6>qpwk~oRRswkUUS4@j=c||(FZ+qoqDQ$7{sx6S3D8(*C>b6G^Z3^Go3k9 z?sBVXnfPFNd~-6%p#snbN8e&9B|5VmRw<$yH4{l9(xyyzuwZwJY-~^}7h_?5UWK-1 z`H8gT;ByP=GSgM(dibIOq5xH)EwKd~yOb(*6UzdlcnLK>*O!cN`e8#4Nu=={wmi_?$ z#yz}n{k9?q%8?iMcH{VPKfd|=*U_9PM!Gpmjl*)!jqRPdc5=D*q7Gre}Y14AFdc&Bj6lDml-XKm}T`%HEyC~<&t1)4mGmX+>WHaSHwFBYTIJW*6aXMlMS`Zs+3Zm$6HMQR1aa+E6bY5^dY{p#h5*gtsTt-YnP8lR+f ztEE|=7(Yn->#)Vp+HPmrt|{vOeFNOj)KYa?w+s+Chw4x%E7HbFVPWuCv= zfu26E#wL-#yeFE(y?FNWWej?ze=yR3a{;J9I6693w8D{GzWzb9dyeze8mx`u^N?Dd zv6hWRP33~N-Lm?iS}Fcb8ptTh{nMzPA502r9wwSos!URm>t!@U(E!vGOxYcU9kgr1 zxfJa7qddD>CU?-yc~aM6hPvS%N7^frihGg!m?f19%&x@u0>h-S$m`2UGNmJ>Kx+1B zuES|k7IYTk0_QAqnv_=g;OP6fTX}^-a!NGfDjL#4)XhMQ8r z3(~QgygoYya&j6+$KE!j{>n_hNV6V=f<~4p{7JEZrZEuf`5IOR&0^b>uw|*Fj8uOD z<GEaOoG=FX`Q1ymY92;^2bE~6rmzDFlD2Te}QY*|s!7vb!O^sGdyhKZTF=UVCrqf;GVH^y|cB;Ek+ z8u0~;!~3@L#F%+m<`Eg9HFH+AQfdTppy*-b?!6*MoZWld`F^mO1w)fX+!z|WqYHR9y-RCD8svP90r^^)x~ zm{uxA^Xyo~G)gIGcP%fut}#?@agC=hUP@9Z?`7;uA=5;|#ibRhHr&kJ+qse$ASVB+V}bIuQM=D9o1&V5uqJHo~EJi4c{ zVh&0Toz{}oE-drU2(6ViJZ4LQj3=b+Z&9+0SV1FTr8ApdwW>gLaHCE%r-%&ZT2Xi! z)7B_(f*X`7WYKznrPAB+#)dJR8(Z`<{lcx4PL!AZQX6vBLF>)`%hLwwB zM=|Fqd`9Q&F8sAfMuz9lrT?WHt!n~tA|fR(&F2%0nOL>%rML_1^f3d(o|zYbz(GyQ zgZ|8fq6DNc?#t_O?@B8vt-8iOj6``0Iiu4d{S=A8jV`@y|b8W zzgB&LL1>RfeNlP6=B}m4mm`MCG<`2dlEWe)F-L{${V2d^XRUKLTgIZABgtW^BDZ{` zJbjw?kntonjePJk>LRcpt%1(RRQ&%LCB=bKJxlKJkn_Li!%W0-x@QSXvsDcWSRlAT``U7!2S?z~;(2;2#PC zWy{l*5Yk0*8;}S>e~99k?@M+xp@-15CnsNCTvCC&xW1v0*L*g(-^`I8ym%(6IR>_| zz7{|J(T`(mXWI?`WF!CuPo6MH#?~)J4H6{=Ii^Y}Mgy;LyLj<}CLDkL>CfZv=(WxU zf_0=@u2F|mf<@rOxMaNLh-^LZ5dOmTVe zNDV??y_=&)qMZ}o(_HwZcwxu33iy=d zrwdbT5Y+j$5{a9G?w?GGbvXsA{yD`mqJ_uI-E{5Nn0V}|7jd1E(ug!_l?(1{l!_x0 z0W+s}hNevs$-FI7P`vth(ql>WRIWqxnrUisGIO7xZ#x4=Eq?Q?J_64sC;ELH{`2RN ztm}XtLnms|?FG8Eu9(w3nzSxvDYS{U(AimkR$p2Y>`XU)WoaRP@#&|U`U8Am=eoXk zVL?02rxA7-k5HPVz}FTpFa42_!{S1mvGI0Pkb=wl>S}!d?U!-*W?yMHtZZ%Mg=x%Y zfsP}zd>H5bVLThI#$a3&;&yRqUa#}=yd$`G zXK7Ap)?5<9=K9X)q|Zi>-)9uR_3uQF)_zoaXA`KE#uyif$5Y(q*O0n|h+)dYB#p@u zm=bfVB&5RiifZ7LMu1>>j%0e!oDQ=n#|(*J*T}05Je#ba<-kfj&%msn1HBPy3=S038;E%<WPX`wXj99WjQt?&1mGt zEQYmOUy2KtE=Fa3E}HGOrUMZj-`m>}+C-g0!%%>Q2HuA8@Da1-hUV$b;1D2t!hAqZ zm3o;Oe?Ww1PaedJC#XkyajdPt4#U&lbGcL!%NcfRlG zKhhKE%r&HY+KLw1D4PlbAzCz|CMw?uDZ3xRjicC>=$Q~A7rm?k#=d|J-IthU_4?p? ziZ1C(B|v}=jKaG-U>YcvSD#tdn7!<5e(WAbKJ9KwW<+d)WC=>-_@ugHrXHJ>vdk~z zlrJ|OJ*DQJ%}m{q?m>R%X{1WM!W?nZH~1d;{oT~`wTi~AsGD_zaTctxL$Y1=1d?yG2bBzB!OU!9M=3wwdO3D7b% zgx9AKez zmnB)mhT{u+7xa2xefEna2FOCC&6uy)S)ZLA$8l>IuL~ zvowV`h55`toYp}9m+$sL-YG(Umv`F4Xl*^h#?6 zRG=pPTy>_&nb}dUK7=7fd7pG3oRj!)=%7syo~(4@zmum-1~X|I=GRD`n?p7|U_Mxx zF`Q}9`5}@n=C8ch!>aBMO}QX)A`@I#ud&xOBVKSxZn zjMHaRt&zus9rN_P$!TyH00X2emI_?S|7e_aq#?G(KtSeZ@&4B&WKjt4Y{UqT)c8Yjlt4fJ@)o4#$2@$_rCj5PC1IzfEmmPakJHm z^Tt`cZbuxA7WBS!%6Z@Oo*gt!o3slf;nud%3M;a4Al@|)lhpp|FHfeGyRW0tKGIEd zpTgsfJPbFuoci!U@@~5o7Yn4{|+3r+YJJKT#p)D+9)`KE)|5I~jOuW^U#bRKSXhj`yH{nF(Nu05-ZTK|l2#$W#GO?%Wimo~4JO^jY8 zgUDb&t~b&|Ew6K)R*yMq`CM@Q>TwjIWiOaOSV&uUlQ(vxN!0Vih6Vir#?0-PtSV>` z1HZUcc-#b?yr*8LtbPClJa(l}Gf2fHZIH@_K3%Im(|=KKVgkhLerYfXPFB*jnk159 zDi4*qObYbWc+~8@;CQD{xqB|=b;?C^1fwp2(w=pH#bD5QEXNI@@wwPoU5%ZK7o$HO zN3&(gRMIMpY;R{vbM5>4&s9j{fcEzGbbmho&8N}obmQdkaH5>JLyfbrAgFh3V@n17 zm!JPCiUruga}xPLW&Zh7hNk-QW;h?mW9TCxN(uiH;+4{F{>*#P@XU)nbsm4nK;F*9 zbKJ%?^rP54i^BOq6j*3NvkS9xl93K!CirEq?!zE!Pu^VHiV`m?*9eXnro!_e<(0D+ zo*8Q5@A5|5Oo;ULI<1-Q4e-Ets9Ig1rkYnpJAa?j+*4vAFAWUYVV_>|n5unvkd?CX zYVE>Eo;as@qQ=0GK!LbJdCa&hg{j_!6zMQdgkEA6UU>WCtG zn6~&*SVQqp-G@LPjA8CAc!>H=d2O0si}x`nEOlLGqKwIjS-LclG=fDF*%J$yU5BIU zVw{vWqC={dmz6}Z9EI-lwB2ixT1kuhEq{NZq(a? z+>lCBVlYLendL$dgP`#Uoh4I8GR*3x;LLWXLP2n*1RatSuFlsq6lI=IieZy|fF@Ov zmcSDO)N>7crX zqbqL%ObFzNy(4pq5cD>1FrHEjH3V@oyz_ji7&mX-j%CP|)oS!Q&3JY2GDbz7eN}TX zkS_0j`<28nUOanlDn2xs&9zuwsxw>>%WIplwYeoSjk|mQUi6FA zcv;*`=3qe!rGlE2owSHuI~R)4OZDwL5yUywq*G1`&~HUFUPP&Xu5hbpfCqsLs9Zb2 zbtw(f;7-N=#+Umb9_sOeNmCxYWi*L*<++I5gHWf~a~JYVNcO-K7TeStf*c7FnJ?=> zrFGA$H-=+94BkQ$jXg#;S-MjbVJ}Z4s+LhBFO}6@=At4}8V<`{cCSu0Iy?3b>1s(Z&cfYV0M`NUP&vS~P{SW0J-*U(F_lA!r2itX3({z?yoM43`7`g)qZw%mRy z0MpVEEuKlMcJoYv^SutXjg^7cPVy)xELm+ivJzHUfh=BP=nQ@yt$`UP0s}OQ3 z<;=`=3y264d_)vxPgsUSs>JFqUc>BF7vJJDiJ^d?Qs<`N&6V+5^fSJqnXiG;jOp8t;3Wa#`)=qnG89lWwwKYeZu0Mu94ONmueV`{uu%D zX<}!fc6=mcOjjW^&c>!^mg*1=J?EezGNFlwt{*+4PH|7tdFk@Sn6J%8sX8yRBhTv9 z%g0hNdHndHwiq)oMPaY?aXt34FDo6R(fQ!}&o#G?zShd>My#)|$Gz{qiDI=D-?ZvM ze02Jpox!^XGQn1S7BP@iEu{2e=sM%<8LGshjPqJRkaR{T((&No>X3Uk246_>tHs34 zA;0YP%=1wL&oYpBSkeoS4DE-*D{)ZhUC3k4$NXF^)YsBrRbTuc@uw0N?zw6g-)09V z5~3hs*r?7UYoR53f&x&cy63|DLA(t{*!$?I|dxZm1T zTNPPQsZIfUhEqv#c`Nf#pjR+AC%TWPAje8!v_gUdI~uCs6&1c-7jj4>;yM5p^w}zN zN;7+{wyq7zI)H&!9?)ncB2(lt7vrctUzry(nEQ+PGzcPVA!LZ`eM~eQBB78o5k>W& zb&W8A0eXl^KmPDXv9ZIbaV^eHUMq^l+;F8Kvukhfh`8jwRYJ%IP8D>(g zRK)XlGadPyZscN;k2oPDCPT^S791ZQ3v0Xz9N0Xym!RUDiSkg1Y;cO4f=!jdO;2GB zG9$fgc{Myrk*?^HY3ss!Iq0mrp3>lrE?bpD29l{UL>`957Q9<87m!olTY}(~mJOqz zL9N915)sjSFVqY#T)Y$oA{R!YWt)hE=d}}lU=-#j$45G--7by^0HQ2LFMlQ>q`rZI za^7slo1^16J2_RV>OPF4q-i_A_9lPw8ba$-FJ`k%j9+#A)6ZexDbH5~#*vH|pzBQ> z6`~Jlc0q07`X4>IuPH+u63U#*Ya7ugzbsW^b8}b2UoW3N)JQK#8G~EYAq{5gi`Dq} zX)C(PapovE%{BAW^WS8-g~A?D>kI?ZBNE9PV684>-ShV?1Z@l<#)_YU%ytdWvjXNblw z(KV+T8V)KJMPZ(xV#R87M-hF^Mcb=Sy5gu}%vqexQLdfVH>dfNw0aupB8(X)!uaTb zv?;;Lf}H(dsh3d<_Lnk8Wf<27#9N^-Ja_i!CKJqEC=Xy^JUityS>#kh3knkW}M7Yb#%+=jfTa4;#|{=vQkq#+?f`s2Q3MnFy{m8xP$ zgMJ(ypK3)~kX2oTCI;Lsk*tJoE;AkwJ;y7PmHa)axj$ zq{4M+wxe+xj~}pi-S2bh>XoF(Uy7yG^;ln9kC)G%Mz3=gJyDP1D_; zJm$*#@DS|nN*js*02*9LL_t(_UDHU2K+tHuFmt8QN~&=f%HiBSU8LutEo{tMW{sd~ z&Vv+s&b0BF;#ReQ0D!FSVHcr}F)HS&XS{S$O)gTuQBe=3-?5-wZo+XmA;WRgB!xQg z+;l!DZp@uxsH@jq-ZQd_<&!1vo8761fAlx`fJp2qW+FEvbs7s`&5&khk$pPf`T$vH{-M+LkE1Km4w zM4QaEr*Sb7_saELu_`#3 zbaVf>9iJb0Px|ba{);*_2atD+rLg-S|F`2}`!H%Wc@h~8PL8}lN&&I~92w*0Bu_s0 z#S#!6iin0BrJ0oAN_VTr?!=}w%?ZCzp3k9IiXv8KKHNUw9F}Yx9E!XFRU9p<8*zbV z20v7cPl<+3Z(P)BjspWuLIqF}hIlH~0j21Ti;~UM0Vgf1R+XN(KjJiq)UQj;l2*jA z7-nv+qI|laCgEJbQn(rk5+aqwo|DHevZo?3e$D$$sv~%@R0Las6S&sJviA~Bpf%6Y zjF@|Y<~^ec29%4oRIj7-R4E*_80wGp#kg?kQWPq4G6L*6L*%wEvIMV~HstG}G-?E9 zIwtg)L*<&{`n zS&j4VFn;>*Or3Lm_GAc?)e*Dmp%V)lN8$2+@L!E7cyx0RiBA6$n=_#-;_j=+@&Too z&P5FutvwaltD_27os+JWe1k$s3ela8gxol+?7Q|@sZk^fJsu(mkCxv^3dey(#-kMl zCPYpE2-!g<4!SGq9qDPlI|~b_ARMbtp!pM`V3eZM>qd{&YsG@*n2 zAJ>Ps2YeBftZBw18>DkVjmX|~6e^i5Pf4YsQ&~|M?W)&DCvk9a5GTiHrnSrI(i*VK zB$ADo4eEAMT3n8~g_@p+`e=+yP-5`VWk{r8M(gVH^Kte1^=P+QzS@bog+(<6`7BSK z+>beB4Q$4(2`&aD`_p?T(MHB`f@E0%Cf9i>oF(&ceOI{tAO2H)2PlCG@F6@L%lZ@M zQ6hAcDeWT{nGmnx!<&`8Gl7n9#^BAYCpHqrsxOo_SUPV{?=d!vk8q3ukguY^p4Jp= z9CaYUWehND(ei*zeoNGmwAY-UCrwccQ7fBGto|K#6D6(mXIhMDI!+OBMAk(%ZAO!TBTzYSnaX_(kS-dOL<+7APfVe{wY#Tu7<6G2fA7EM zJSso8z?ORuJRB9AX;rXN>NKq#tKq5KNJ{#riRzrW zMT$&`YQi_ur3I;xdU=xjv?3qI>Ec&#W1%2e(sKOHtGy?qEVL@mw7c)qSaSx7la)O5Mx>RbjdNa3L{k@LY*p*C zOX@`sWmZ;}+%_u|qS0){07h;SM-aum>>VLoH;9%ZUqTnPjhLw4_1LG8161O_kE)L=RsBx#z=p0t;+9KR}}5glskI?J$_6qDjePX`$<<%W|zD+ky4 z?6j^>&7+86tyOzwCw#`Hy*62M4~c}Bn`@%WQ`{wXt-Oq`J#|f!(6w#@PM}it@|_}5 zo75R?ivZ9_8xNz^Z0Mlk$?$|kxH3?bW?Xov389kKFN{`ix|MOHkz=7gK%#kd^vn#0 z(kvoJ=9?)ivt*5+^R#!+hu8mS#)6TcDs$DWNzNTCfh9H=^=)J%L#0Wa1o{fxpKCX6 z>iej3D9Y)&8?JYs262PwP*zMdhjSAbv4uBpUV9cqpoj^gI6)b7N~ft`01p6Ha6(E$ zB@R~*VR0L3`)C*so<57yI;OBaQ|C7oqCC4cs|ZwgKvy^QK;E95pN_Ta4c8*paHS!} zzmrdT(<~mZFm{6~0|BOF`Di~*$bqCYOGAkE_pOf z(xH`9jvfkwt!6APt|*-#a&Uu|>gf8yIEJn4L+4a59pH43NvFgaQ_gRWPZl+>7d8aW zb!8De9L({_aq^%p+v%yyHh0`}KZu{gC{e65EL#X{cXl40zx7T- zirj)2uS;tia&inKx#^d`#&LRj=G0IdX>B~h-G;+BIXjKB(?&GgE&V*)Evdm!4=Hu@ zj6V^DGr+8gg*Hfsoqdo7;auj+MMbpLtu39OX0sKCN5^q^c$|kVK~M6@CMDseUwng1EpD92BbvpS!XbebEV8~ z?PL&3%n{uEdw=hrjWzhALrks*RA_Dzp&1DmQA;MM%FJNSh&|hF<&8Q#;xsv5g`ue; zmBTf%)~j-G<^Nt6#?FT#hLL(FnVst0c==K-mY^C(R&MHbX23da@gd8#N&d7-t4i$D z$TRJHM#^);y?9_?KhmsveMu3IG=fDdrE+3JC3#Uv$|UI8({P5T)%8w|GySf6Wud&x zvvQ--1-_EcVlm#ld1LAY_o`l3#~H0K8hnjL(|TZujW?)o*z8-27bgu2e%hs;a?qAm8fWzV|Ky*gQn?&`3`C1IZ7gPT79{9qM9ama z(kEcfv>sW@DzmpMv(tOg9ptILO#M zIjq%0%ok$(lAPK)P0Xkdl%or7)pE(Q5g#?zFe1wYnf;66dqk^ormi!o1bVV~MmPR^ z$kmTYXqp;W)B?Cd#;B1yPWNK)c?-y)( zcILhUnqll-PtjY3mTWCrvg z8s}$nionB)Bw8bFM`fCdoo4>KiE*hG>?IWzM{6?ovo*Jp_ zuDo;mPAn`hyRQSXH5|v$=~+B}@+4Y~miCA6?1`8I*yJ%*-9b%D4~|vO=HmexAm3Vu zQNORX5u&sdi(1aZS$uK|-JPg7j?;EO8vW_gCOOO*l++RAKl-O*ye#v*9&0sBsg|K(iwj!sR-7WH4~3Yy>yGv3sXZcx zpi-?3W0t^qJgy}t`=4L0?=%89*$oLY(oAGB^4vvwjby4@2=(|9wH4*CY~;KkDE9P*+hWuw3ZP z$#Fcqe=mmJovjlSHjiJ{!jx{xt>c_V3BX0*$03B zzX5@av4-;9EVSk8h(x#FjX}4Qy3M{f7!V9qf>DPXs}a;W&rFa?h>q>0n-t0*OS;)~ zPzR=E@MW!Dx~fBqENiFVbY!&!gsFqXwc$5>=;)X59xRDeb1BUbbBKhr01hDZAeOEn z=@AovBv+zzSWlNPrC6X z!Fy$yn`M^r@%rLgf`O?qVEA_8Tst(1k^&tG0CDeu^iQ3(msjDvAp*xQNC?QNk)@SW5U?X}f?&!|;Sn=;KmM+J<6qWtXiM88DB zl*5}+cEr!>4}uM08(Z5-AvH2kD#z)0BOX3_9F5~sMG~T)BE)DAw{PE$#g$bVnIju4 z?`&L0vA_Q+8mH%S3ebe(GYmD4v42;P@@YkRP9EY{}K^nzH)K_H57e@Kbo zHE9k@sY#13bKX~yXn(d~qE5XlsV9ej^9A2qpR#Yh#Vs~>db}nCzLgJZycmH7=9qcPY z0?>>K6|H#q@S~4JwZVzx=f`Iy&BgE!-n@zX4aaVo4!&V`_-apk|5WUKzQ|Rl@BjTz-e)6CFca-IfdMVs7kDwI-lEwgj zC<)&Nslc)b<9WWD!jGHIT3tm5Es*h|MFSQdD@FC4`Sl5PB3)1xC9`LA;jPpz3ejq{ zk|!y|u*bUMt`^O!!NdX9WFCDIqb{URL@|08R`Y*=Va+HjDN?)R)z{P!sH+Rtchms3 zY&M#b-q%!Ks!i~G>+B<3Se8-IZ#X_is?&pjL@uZkrio{Rr(JoT zsA66BkyQ1@wQDgCkRm2TPtllk%hEo{%G2wUKAoK$Ykl+S*{P8#shN0hi-xL9AaJCV zm|x=crDiSH&2rDZi&tW82a)PR+<){W_Mbfyysy;@q`7mIc<=oW)G~l%n6h27jyv4T zf<`4CJ$o82U$AM56piepufZ#x71u$^D|A!Nr6>`(3tQW?fJ~`zRyKT~GIAz-+*~TLK~o*2 zG%=xJ;yxv))m{7~t^nfF>uQcb^-4M!P)zhnbiyersaHTz`m6?q9^RV_LvcVH{ahr1 z(GxL9kFDe{@plXmZD5IY+iv3u#F4jzt$9f*8Rez{kbNJpb_ zG@A`g^Bo@^MT?0(LH^9LKuRRV<183rr*Y|7k%D!&h~0^kW`|RZ?X8`-bnPZB{kZq| zS?oW578L7>tfgvftgXbAtJl3KXR^M#pn6xM5sGr-I6gg%`wyQ)qtQ_P6T_~u3Xve` z!<1=GLwf9}R%vwyacOrq7Pqg&S1-@wyf;X*Ha>yb#wSL?8Th0B{9ll0Xj$TzLcQo! z!#c9!0+plLI*$Sj(FGLpm^p{(+Ea(r(l<^IXe?R}*SbUF5o@`;V8%t1#hs<RdC=ckQ5rISt$s?gl3ky+CJK}jD^b3&kpDS0js=yIDBYiH)yPcK}D!UCu8>!4m z7m5a+@3oB{&EeJMwYYufmVS;1%En%wlBtZ5Alcy{4)$Nf^XD&39@V6!rDUm()YVQn zsGc9umz8?3Gc-G5k|fVGlN)h5^@XLl`TmCj3%+~!C=Q-Im631{D>bA|m*div%dr4~ zG%3>X%vs;9s7}0r^f->V_vlHyc)ssO@1QODPz;4AT`sdinqG<5WHip(v9ozm+ zJ|Sn5?)%6GBte+Uhv`cQs}_UL%eglp?}trinq#oc+;WNJDgE|ClN1b4I6tq=yoe7ALktbf~ z_3PJ~|H$J4?!|b5Q+fl5f2AryKh$c?Uusfe+F3?3)hArH za(7_qfkhc|AkLYp*BF%Jn0W}%$I+Ob)4o5!<@))7(x0wcI6G&O}ABHR? zzBU5kDaF?2rf_>l%#n6$$jjo*?eGm;DD2y-s|yV`j5KRF(&((9dp_^HceZd?-+%9x zqT#C66nK2usj0^h@YYYBzjUKEAw2psx>9-jRgx3$w$3HnBhd));?jm+jp?Jj*wV^o zcGe;B=ciwwn^{np=ulMA(;!QmgfCaPlpxQ>ld%bvo^Y8(b1DHNl=RQKmi#%IvO4MY?W zJ58W?*M;1(?98rRz8D*u8yZ#R_2_AMB2+IFkDff0cb6V+YNS#atL}!OJd=`j+AT4C z1=*L1v9yQ~wCONPLq~{aoEs!46ooofYc)k%?%B25cjBbcj4wX>OlOQ<2fY)9q~81R zN0XFz7TL;F86%k@3*neetDhR4oHVyPtB7p4ieNx>Sk7M=nop^9e2j1y8 f6Pc#)*--u;2)=wIJWqrR00000NkvXXu0mjf^n Date: Tue, 3 Dec 2024 20:26:05 -0800 Subject: [PATCH 03/20] Add missing troubleshooting slugs (#1882) Signed-off-by: Alex Leong Co-authored-by: Flynn --- .../content/2-edge/tasks/troubleshooting.md | 26 ++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/linkerd.io/content/2-edge/tasks/troubleshooting.md b/linkerd.io/content/2-edge/tasks/troubleshooting.md index a34f3456b1..e5f338570e 100644 --- a/linkerd.io/content/2-edge/tasks/troubleshooting.md +++ b/linkerd.io/content/2-edge/tasks/troubleshooting.md @@ -1084,7 +1084,21 @@ Example warning: This happens when one of the control plane pods doesn't have at least two replicas running. This is likely caused by insufficient node resources. -### The "extensions" checks {#extensions} +## Extensions {#extensions} + +### √ namespace configuration for extensions {#l5d-extension-namespaces} + +Linkerd's extension model requires that each namespace that "owns" an extension +to be labelled with the extension name. For example, the namespace viz is +installed in would be labelled with `linkerd.io/extension=viz`. This warning is +triggered if an extension value is used for the label key more than once across +the cluster. + +To resolve this warning, ensure that the `linkerd.io/extension` namespace label +does not have any dupliate values, indicating that an extension has been +installed more than once in different namespaces. + +### Extensions checks When any [Extensions](../extensions/) are installed, The Linkerd binary tries to invoke `check --output json` on the extension binaries. It is important that the @@ -1313,6 +1327,16 @@ Example error: Make sure all the link objects are specified in the expected format. +### √ Link and CLI versions match {#l5d-multicluster-links-version} + +This warning indicates that there are Link resources which do not match the +version of the CLI. This usually means that the CLI has been upgraded but that +the Link resources have not and certain features may not be supported on those +Links until they are upgraded. + +To upgrade a Link, regenerate it. Refer to the [multicluster docs](../multicluster/#linking-the-clusters) +for instructions on how to do this. + ### √ remote cluster access credentials are valid {#l5d-smc-target-clusters-access} Example error: From e322ec87a8b1e35a885dc4da34b22fa930bca18a Mon Sep 17 00:00:00 2001 From: Alejandro Pedraza Date: Wed, 4 Dec 2024 10:41:55 -0500 Subject: [PATCH 04/20] Rate Limiting docs (#1877) * Rate Limiting docs --------- Co-authored-by: Flynn --- .../content/2-edge/features/rate-limiting.md | 55 +++++++ .../content/2-edge/reference/rate-limiting.md | 70 ++++++++ .../2-edge/tasks/configuring-rate-limiting.md | 151 ++++++++++++++++++ 3 files changed, 276 insertions(+) create mode 100644 linkerd.io/content/2-edge/features/rate-limiting.md create mode 100644 linkerd.io/content/2-edge/reference/rate-limiting.md create mode 100644 linkerd.io/content/2-edge/tasks/configuring-rate-limiting.md diff --git a/linkerd.io/content/2-edge/features/rate-limiting.md b/linkerd.io/content/2-edge/features/rate-limiting.md new file mode 100644 index 0000000000..b13011e457 --- /dev/null +++ b/linkerd.io/content/2-edge/features/rate-limiting.md @@ -0,0 +1,55 @@ +--- +title: Rate Limiting +description: Linkerd offers a simple and performant HTTP local rate limiting solution to protect services from misbehaved clients +--- + +Rate limiting helps protect a service by controlling its inbound traffic flow to +prevent overload, ensure fair resource use, enhance security, manage costs, +maintain quality, and comply with SLAs. + +Please check the [Configuring Rate Limiting +task](../../tasks/configuring-rate-limiting/) for an example guide on deploying +rate limiting, and the [HTTPLocalRateLimitPolicy reference +doc](../../reference/rate-limiting/). + +## Scope + +Linkerd offers a _local_ rate limiting solution, which means that each inbound +proxy performs the limiting for the pod. This is unlike _global_ rate limiting, +which takes into account all replicas for each service to track global request +volume. Global rate limiting requires an additional service to track everything +and is thus more complex to deploy and maintain. + +## Fairness + +In the `HTTPLocalRateLimitPolicy` CR you can optionally configure a rate limit +to apply to all the inbound traffic for a given Server, regardless of the +source. + +Additionally, you can specify fairness among clients by declaring a limit per +identity. This avoids specific clients gobbling all the rate limit quota and +affecting all the other clients. Note that all unmeshed sources (which don't +have an identity) are treated as a single source. + +Finally, you also have at your disposal the ability to override the config for +specific clients by their identity. + +## Algorithm + +Linkerd uses the [Generic cell rate algorithm +(GCRA)](https://en.wikipedia.org/wiki/Generic_cell_rate_algorithm) to implement +rate limiting, which is more performant than the token bucket and leaky bucket +algorithms usually used for rate limiting. + +The GCRA has two parameters: cell rate and tolerance. + +In its virtual scheduling description, the algorithm determines a theoretical +arrival time, representing the 'ideal' arrival time of a cell (request) if cells +(requests) were transmitted at equal intervals of time, corresponding to the +cell rate. How closely the flow of requests should abide to that arrival time is +determined by the tolerance parameter. + +In Linkerd we derive the cell rate from the `requestsPerSecond` entries in +`HTTPLocalRateLimitPolicy` and the tolerance is set to one second. This helps +accommodating small variations or occasional bursts in traffic while ensuring +the long-term rate remains within limits. diff --git a/linkerd.io/content/2-edge/reference/rate-limiting.md b/linkerd.io/content/2-edge/reference/rate-limiting.md new file mode 100644 index 0000000000..86c5018cbf --- /dev/null +++ b/linkerd.io/content/2-edge/reference/rate-limiting.md @@ -0,0 +1,70 @@ +--- +title: Rate Limiting +description: Reference guide to Linkerd's HTTPLocalRateLimitPolicy resource +--- + +Linkerd's rate limiting functionality is configured via +`HTTPLocalRateLimitPolicy` resources, which should point to a +[Server](../../reference/authorization-policy/#server) reference. Note that a +`Server` can only be referred by a single `HTTPLocalRateLimitPolicy`. + +{{< note >}} +`Server`'s default `accessPolicy` config is `deny`. This means that if you don't +have [AuthorizationPolicies](../../reference/authorization-policy/) pointing to a +Server, it will deny traffic by default. If you want to set up rate limit +policies for a Server without being forced to also declare authorization +policies, make sure to set `accessPolicy` to a permissive value like +`all-unauthenticated`. +{{< /note >}} + +## HTTPLocalRateLimitPolicy Spec + +{{< keyval >}} +| field| value | +|------|-------| +| `targetRef`| A reference to the [Server](../../reference/authorization-policy/#server) this policy applies to. | +| `total.requestsPerSecond`| Overall rate limit for all traffic sent to the `targetRef`. If unset no overall limit is applied. | +| `identity.requestsPerSecond`| Fairness for individual identities; each separate client, grouped by identity, will have this rate limit. If `total.requestsPerSecond` is also set, `identity.requestsPerSecond` cannot be greater than `total.requestsPerSecond`. | +| `overrides`| An array of [overrides](#overrides) for traffic from specific client. | +{{< /keyval >}} + +### Overrides + +{{< keyval >}} +| field| value | +|------|-------| +| `requestsPerSecond`| The number of requests per second allowed from clients matching `clientRefs`. If `total.requestsPerSecond` is also set, the `requestsPerSecond` for each `overrides` entry cannot be greater than `total.requestsPerSecond`. | +| `clientRefs.kind`| Kind of the referent. Currently only ServiceAccount is supported. | +| `clientRefs.namespace`| Namespace of the referent. When unspecified (or empty string), this refers to the local namespace of the policy. | +| `clientRefs.name`| Name of the referent. | +{{< /keyval >}} + +## Example + +In this example, the policy targets the `web-http` Server, for which a total +rate limit of 100RPS is imposed, with a limit of 20RPS per identity, and an +override of 25RPS for the "special-client" ServiceAccount in the emojivoto +namespace: + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: HTTPLocalRateLimitPolicy +metadata: + namespace: emojivoto + name: web-rl +spec: + targetRef: + group: policy.linkerd.io + kind: Server + name: web-http + total: + requestsPerSecond: 100 + identity: + requestsPerSecond: 20 + overrides: + - requestsPerSecond: 25 + clientRefs: + - kind: ServiceAccount + namespace: emojivoto + name: special-client +``` diff --git a/linkerd.io/content/2-edge/tasks/configuring-rate-limiting.md b/linkerd.io/content/2-edge/tasks/configuring-rate-limiting.md new file mode 100644 index 0000000000..5b219fb103 --- /dev/null +++ b/linkerd.io/content/2-edge/tasks/configuring-rate-limiting.md @@ -0,0 +1,151 @@ +--- +title: Configuring Rate Limiting +description: Using HTTP local rate limiting to protect a service +--- + +In this guide, we'll walk you through deploying an `HTTPLocalRateLimitPolicy` +resource to rate-limit the traffic to a given service. + +For more information about Linkerd's rate limiting check the [Rate Limiting +feature doc](../../features/rate-limiting/) and the [HTTPLocalRateLimitPolicy +reference doc](../../reference/rate-limiting/). + +## Prerequisites + +To use this guide you'll only need a Kubernetes cluster running a Linkerd +instance. You can follow the [installing Linkerd Guide](../install/). + +## Setup + +First inject and install the Emojivoto application, then scale-down the vote-bot +workload to avoid it interfering with our testing: + +```bash +linkerd inject https://run.linkerd.io/emojivoto.yml | kubectl apply -f - +kubectl -n emojivoto scale --replicas 0 deploy/vote-bot +``` + +Finally, deploy a workload with an Ubuntu image, open a shell into it and +install curl: + +```bash +kubectl create deployment client --image ubuntu -- bash -c "sleep infinity" +kubectl exec -it client-xxx -- bash +root@client-xxx:/# apt-get update && apt-get install -y curl +``` + +Leave that shell open so we can use it below when [sending +requests](#sending-requests). + +## Creating an HTTPLocalRateLimitPolicy resource + +We need first to create a `Server` resource pointing to the `web-svc` service. +Note that this `Server` has `accessPolicy: all-unauthenticated`, which means +that traffic is allowed by default and we don't require to declare authorization +policies associated to it: + +```yaml +kubectl apply -f - < Date: Wed, 4 Dec 2024 18:26:05 +0200 Subject: [PATCH 05/20] Add egress documentation (#1884) * add egress documentation Signed-off-by: Zahari Dichev * Apply suggestions from code review by @kflynn Co-authored-by: Flynn * lint Signed-off-by: Zahari Dichev * Apply suggestions from code review Co-authored-by: Flynn * Warnings per William Signed-off-by: Flynn * Effing lint... Signed-off-by: Flynn * :man_facepalming: Syntax correctness would help. Signed-off-by: Flynn * C'mon, lint, tell me all the errors at once... Signed-off-by: Flynn * Warning tweaks after William's feedback Signed-off-by: Flynn * :man_facepalming: Signed-off-by: Flynn --------- Signed-off-by: Zahari Dichev Signed-off-by: Flynn Co-authored-by: Flynn Co-authored-by: Flynn --- linkerd.io/content/2-edge/features/egress.md | 26 + .../2-edge/reference/egress-network.md | 110 +++++ .../2-edge/tasks/managing-egress-traffic.md | 443 ++++++++++++++++++ 3 files changed, 579 insertions(+) create mode 100644 linkerd.io/content/2-edge/features/egress.md create mode 100644 linkerd.io/content/2-edge/reference/egress-network.md create mode 100644 linkerd.io/content/2-edge/tasks/managing-egress-traffic.md diff --git a/linkerd.io/content/2-edge/features/egress.md b/linkerd.io/content/2-edge/features/egress.md new file mode 100644 index 0000000000..a9068acfae --- /dev/null +++ b/linkerd.io/content/2-edge/features/egress.md @@ -0,0 +1,26 @@ +--- +title: Egress +--- + +Linkerd features capabilities to monitor and apply policies to egress traffic. +This allows cluster operators to make use of the `EgressNetwork` CRD to classify +and visualize traffic. This CRD can be used as a parent reference for +Gateway API route primitives in order to enable policy and routing configuration. +Linkerd's egress control is implemented in the sidecar proxy itself; separate +egress gateways are not required (though they can be supported). + +{{< warning >}} + +No service mesh can provide a strong security guarantee about egress traffic +by itself; for example, a malicious actor could bypass the Linkerd sidecar - +and thus Linkerd's egress controls - entirely. Fully restricting egress +traffic in the presence of arbitrary applications thus typically requires a +more comprehensive approach. + +{{< /warning >}} + +Related content: + +* [Guide: Managing egress traffic] + ({{< relref "../tasks/managing-egress-traffic" >}}) +* [EgressNetwork Reference]({{< relref "../reference/egress-network" >}}) diff --git a/linkerd.io/content/2-edge/reference/egress-network.md b/linkerd.io/content/2-edge/reference/egress-network.md new file mode 100644 index 0000000000..52b6e8a5e1 --- /dev/null +++ b/linkerd.io/content/2-edge/reference/egress-network.md @@ -0,0 +1,110 @@ +--- +title: EgressNetwork +--- + +Linkerd's [egress functionality]({{< relref "../features/egress">}}) allows +you to monitor and control traffic that leaves the cluster. This behavior is +controlled by creating `EgressNetwork` resources, which describe the properties +of traffic that leaves a cluster and provide a way to apply policies to it, using +Gateway API primitives. + +{{< warning >}} + +No service mesh can provide a strong security guarantee about egress traffic +by itself; for example, a malicious actor could bypass the Linkerd sidecar - +and thus Linkerd's egress controls - entirely. Fully restricting egress +traffic in the presence of arbitrary applications thus typically requires a +more comprehensive approach. + +{{< /warning >}} + +## EgressNetwork semantics + +An `EgressNetwork` is essentially a description for a set of traffic +destinations that reside outside the cluster. In that sense, it is comparable +to a Service, with the main difference being that a Service encompasses a single +logical destination while an `EgressNetwork` can encompass a set of +destinations. This set can vary in size - from a single IP address to the entire +network space that is not within the boundaries of the cluster. + +An `EgressNetwork` resource by default has several namespace semantics that are +worth outlining. EgressNetworks are namespaced resources, which means that they +affect only clients within the namespace that they reside in. The only exception +is EgressNetworks created in the global egress namespace: these EgressNetworks +affect clients in all namespaces. The namespace-local resources take priority. +By default the global egress namespace is set to `linkerd-egress`, but can be +configured by setting the `egress.globalEgressNetworkNamespace` Helm +value. + +## EgressNetwork Spec + +An `EgressNetwork` spec may contain the following top level fields: + +{{< keyval >}} + +| field| value | +|------|-------| +| `networks`| A set of [network specifications](#networks) that describe the address space that this `EgressNetwork` captures | +| `trafficPolicy`| the default [traffic policy](#trafficpolicy) for this resource. | +{{< /keyval >}} + +### networks + +This field is used to concretely describe the set of outside networks that this +network captures. All traffic to these destinations will be considered as +flowing to this `EgressNetwork` and subject to its traffic policy. +If an `EgressNetwork` does not specify any `networks`, the `EgressNetwork` +captures the entire IP address space except for the in-cluster networks specified +by the `clusterNetworks` value provided when Linkerd was installed. + +{{< keyval >}} + +| field| value | +|------|-------| +| `cidr`| A subnet in CIDR notation.| +| `except`| A list of subnets in CIDR notation to exclude.| +{{< /keyval >}} + +### trafficPolicy + +This field is required and must be either `Allow` or `Deny`. If `trafficPolicy` +is set to `Allow`, all traffic through this EgressNetwork will be let through +even if there is no explicit Gateway API Route that describes it. If +`trafficPolicy` is set to `Deny`, traffic through this `EgressNetwork` that +is not explicitly matched by a Route will be refused. + +## Example + +Below is an example of an `EgressNetwork` resource that will block all external +traffic except HTTPS traffic to httpbin.org on port 443. The later is done via +an explicit TLSRoute. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: EgressNetwork +metadata: + namespace: linkerd-egress + name: all-egress-traffic +spec: + trafficPolicy: Deny +--- +apiVersion: gateway.networking.k8s.io/v1alpha2 +kind: TLSRoute +metadata: + name: tls-egress + namespace: linkerd-egress +spec: + hostnames: + - httpbin.org + parentRefs: + - name: all-egress-traffic + kind: EgressNetwork + group: policy.linkerd.io + namespace: linkerd-egress + port: 443 + rules: + - backendRefs: + - kind: EgressNetwork + group: policy.linkerd.io + name: all-egress-traffic +``` diff --git a/linkerd.io/content/2-edge/tasks/managing-egress-traffic.md b/linkerd.io/content/2-edge/tasks/managing-egress-traffic.md new file mode 100644 index 0000000000..4d6115f009 --- /dev/null +++ b/linkerd.io/content/2-edge/tasks/managing-egress-traffic.md @@ -0,0 +1,443 @@ +--- +title: Managing egress traffic +--- + +In this guide, we'll walk you through an example of [egress traffic +management]({{< relref "../features/egress" >}}): visualizing, applying +policies and implementing advanced routing configuration for traffic that is +targeted to destinations that reside outside of the cluster. + +{{< warning >}} + +No service mesh can provide a strong security guarantee about egress traffic +by itself; for example, a malicious actor could bypass the Linkerd sidecar - +and thus Linkerd's egress controls - entirely. Fully restricting egress +traffic in the presence of arbitrary applications thus typically requires a +more comprehensive approach. + +{{< /warning >}} + +## Visualizing egress traffic + +In order to be able to capture egress traffic and apply policies to it we will +make use of the `EgressNetwork` CRD. This CRD is namespace scoped - it applies +to clients in the local namespace unless it is created in the globally +configured egress namespace. For now, let's create an `egress-test` namespace +and add a single `EgressNetwork` to it. + +```bash +kubectl create ns egress-test +kubectl apply -f - < Date: Wed, 4 Dec 2024 11:51:06 -0600 Subject: [PATCH 06/20] Generated images (#1891) Signed-off-by: Travis Beckham --- .../cover_hu16836827327051943010.jpg | Bin 0 -> 14976 bytes .../chris-campbell_hu5767321052028082074.jpg | Bin 0 -> 2362 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 linkerd.io/resources/_gen/images/2019/05/24/linkerd-and-smi/cover_hu16836827327051943010.jpg create mode 100644 linkerd.io/resources/_gen/images/authors/chris-campbell_hu5767321052028082074.jpg diff --git a/linkerd.io/resources/_gen/images/2019/05/24/linkerd-and-smi/cover_hu16836827327051943010.jpg b/linkerd.io/resources/_gen/images/2019/05/24/linkerd-and-smi/cover_hu16836827327051943010.jpg new file mode 100644 index 0000000000000000000000000000000000000000..3afcbf88e4090b685867ecdbf1b0123a2df904d4 GIT binary patch literal 14976 zcmbW8Ra6|X+vbO2MGD1T2X~5lf#R+MgB6#--L<&8L(#$A-Q8VVoZ{}%?f=`|@9gF7 zzUSmBxyUccNuE4;^LOR%I^YKY0S+Dk9u5Hk9sv;%;Un^AWMm{HWNb8a)X#X>`1p9( zxVVHQ)MSK2Kw?~6awc*h4J|zbJpmar8#5gnH61-23?d>T@<(JWWMnKlLR><+|L6GI z1HkwQ1Aqa*!cYP}V8Fm)!2BJ6$p-*n;9>qN0RJmsKEVF#E8<5aWR%Z<4=}K>AK+l& z;o;!^weJ{uNjZICu(n1WZvCL_-HG z$}a&QvBl!^YI~7@9IBT%Mvk+{xKy0m)K~vO`Y)pYJD|Y-FQWej`fr}UYXDSOn12%n zivbV;{IKdGtq*?hwP9$*pLD>}Y@U;yFA$)L(y`=%Z_J(#)@X8c>a9vu3OwgU))PCH z67#4?vKFz#J##`-s%_}xh+IHnh+=roIHWbGF;K#MTlrn&!r$2tw}F(m{k%-(e!)C( zLH;y)P)vX0fkT`3=bh|oumQKEx@dh{l82otBU9%Jn{dKVb&PIURYk$WCn}RodIYf; z;wP1Hq1uj{;veYc5aBzio2oi?mhBo|aFjYqITlu=o-ougc7(}nbp(7V+e0t%)Qb&i z6y+FT0fHE(CwOs2-GlnvJUM?^*9|kY9z$u8$aiTj^3bu68nN%_|M=2&U*7fl2o4cU zA-N#5zZitC)r-|`C=oF6Q;Bs%+{sF}o?ERrR{e0n-j`+71Sd+BK=5uLVEK6dteO$# z6Mbt=op!#5NwP74g_>ih%#zsydIG_$9C)|c4R>wk9qmRM4>Fkg9Qr{?xP?laX?~rf zQ}dfjYKtNg0wv0}PgukJI~O;1M5(YpH+6)mW?u!IpaK@f=9vU=^u1M-^Ritbc$UmX z8h7jJf9Oxf{o*-K=*zQt?z`_7XL(eBwa4ck#glnDcxHhX%R=?K9ZVx+a6t-zm&4A{ z9PClV@yGPwHK4xH6x7ZEDwnnya5`f7EZJHn!OrYv|MgUNS-*?t@=wUeTzRwghxA%- zV!z=|v{3H1xhSezrwE6@veV?>dDCYZR!3Q)%eJOzNXW!FGT?THw{&~|X_{5`DMTFh zOVTP7X&}6mJ|uC`FlFv&Ck@ACE232;31^L4tt#95>HPi8j&q>yYzpCF|x`ZJbvwM$+C%G4m8& z`n#i7#8LibJH+6M{U*F`d_5*85lpcA=~Er9?t~t z7@ekGodFkAteyYhlT_fll|Q@YA+!sOS11u97JnUrNHlyxHm4L)#R!N`sWg_$)<62B z4w11n6-(S4(d>6ZmbuNA$tt`|QCW^CD$|wA+dQ4G>Lp1>bJF+=*rr`tNa6WHvN>|1 z-Eu9UMO3o6G|C0 z&#Qvk=ocX3m9tf^qOOtdUEdrquJHgc7ZIzON>|hy6#HGl>VE-9JtNh^m)TXNJ0yyX zL~_-vc9X4{$Su_%GL$>|?`kw1b9_L?mR+229kL(&<0)m!3t?OPte$kkiBd9`3A#Y( zpSEjGla5_s z8GOv)q2k-n&#BE#Xb~bxa>VWHS z%lMejq!D!G5$>Mev%zPx%+k>x$8=UocW&ocY=J%)ra+M|@!FVQ|D3c+?{uD{6Tb=u z50n~W*5D7PFeYC;M81+#XmRqpMD#oRo|dpd#-SNgjS^(0)P9V>%IyW?D^gKsU*i+) ztFG0gIBCQpt6zm4)Zp40xl4iNvM6+!`p2Xtu;*GYblv~wr$LX(N#L+&YS^apCWmy0 zC4s#p<51Q$#ICQ4qU+zz(mJ0-1&vx%uhy2h7LrlV^HKWN`e?qR4K?E?A~eo|?WwXG z$bntHr6ct^!P5ejSCebriV(g^5&BO=NjWlvv|kzMEmagYw9*;IeUAdgDpq|zNZP7A zcHy0Ciq5eCdM~yb?kK1!1{gK8Cs4uWXAEZ0G9F+A(|r#)N3^ZoIz4F6$>&%X)j{s>->khnAah z#zDW@;E-Qe24s{_QGM+}ndl|$T|MWkP}*EospnUvM!Du<9%2nz5%%ICUqk(X=vcK& zqDO&K0q<{Go9v@BZKa&(Ag!@L0N=zz}|wRG>mSwdB{~^DaG+EC|LPSMU!FqDN8r$kY97})9Z%eWheS7gR^XGYvqjX&9 zhDSB&hRmchDPc=I&Z3?_A}?ZuLjkfw1LoItubiTtk6SHG4ABJE_K;DRNJ~m4;y{i; zmoF1y;aJJGt%n(dOBMUAu?&T7M~VysSsf=ebQcj4BIM;?)~(}#@gds_YOKaug=^XD zI^g4-t|kh^0|G(yrIwd(9!D)2o(Wi?sy<&xtpiwAAFb%RXE zrgljI+Mtv;@X!TVN~;F35&@TqYT&cBu?284lG6%$5H=rwK+$ zRc5zRk^y3OH+%ci_cPxEE@V-h{^Us6Cq3so8k-MeX?O6RKfMMliG(3@@PHe#y)=~M zj+)WhyaAqu+!5wPoK!)H>dRYEvnfc(ijUl0iGXxrzbojQ3zG$V=ldDEvGEMy>b!M| zmlzqrv}|^Wsm>r)dx9gN1d|I*@%X5_Mpp7PwB$(p%h9x1mvs<>mj-vGA=QNw@7u17 z=En%hf$t%-MG)|#fqJX*thT)99|u(q9H(S>M~il5chZYvJV zEU-1HfkJ6v=9sQhE|`8H`Dc}5Gx1P62o}en(U~wL-oqLRxgsZ7NoIaswHxzg=SVNYJ-rH)B$k~|k3~nbuBWZ&y>F%~#dF~YbY7Ys;c?#yp*bhN8TtlloECb{1qVZc>OvTzTEBWUQk9bPVP; z9tJPPO1Bx`Fa(@i>7-G8qbh5-LUVc*t5b_~m7jCBs)^;ypW_wS6#BI#(_VU^!TQrI zai2Vn4N}q8auWwEgTKdFJR(K9?A(t6wZ#-)jqM)93OH!~8y;tN+0(0CIR9PCQq0v$ zf|{S68TaYlJX^e!&M)#+1K-(<9Q5T%EgdDwCvD6RlmOmTnM%M$x&>8N@y2F;9RhW* zr0e-V{bf+cw8|^2axNunmR#m%yzYVLdP1R?j$`_2k|#T8jv3LX6)8ZMGspzZLAHgc z(LnIA+{2Sst^(HTPn}Pq#Z_=|m5~ZhI~jeKoVqGh`G2GQuFSn#R8~b=-WXYMcEtvO3d7eHo1?Z$*a>WXj*p{2~N zP8Nbj9z9iBFBcM+s?hD^A8t;YToaUEe}3n31y@E{hSWDltN7l}PeKTqN!$b{O!@6A zc9o1$R|RqGt}`uBjN`SyIjKboK<>c0(&I6SFX!mL+c6P^CLxb{Kg0BpOf)uHP`y+Y z^|Yr=9BNLOjjp8x8OineN~#6LNjA)A8Wf-r=3x|#p(-uk(xzMX*iIqB0#texbEqyA zo!RRa&p6@H{0?p4CnDUOPc3Snp8CY&wm_!;1PEzf@j8?J7mRgA4Z|y;*cGEDx{F4! zc=hV4yd+pV0>dL6&V5L(2u)Tdvo6Flrs21Fs|j8IOGm^GE9%mNYK6qmC+BCMh4|@C zARrbzy$o#cZqw9=VPPNkR1LBkHbd^N%bv1fv872?DRgQHSn32=*n=gomu6r0C3kh# zEZ@I*BxnVdl>S_-(h8e6mEJN6n{VnHGRlU~&a{>=6@P_ggKe@Z8p>qe46=4XB@)c& ze9QFl3Z?KDJZLbz+^abXNDu%1#iJ63wslfbLH5t@mMhy(Bsxw*U^QF|2}Jm0$o0CP z3ggfHIB|q>Afosqh{p|Xnm)z-wUz9^MezFrj#h=VuScFidBkvX=W0%fkvlplJ93zi z$t0oGcC++Bvn@0@UyD!!?Jt0R%}Gz{m74viO_K14HcNOx;{Bp~u2l%67Npabu;c3f z+X5e!eD_I1@kTdAfKAoe{7iF@kE{Jj_--OMpz3ftxeOv=#pA|&FdX&4DGoCI7ci6L zH*PNCUzOPF+2CnQZ7 z(ld5p=CaXJC!^K#kL$0qZOs$xLx@GDC5azqt`OB&)638aWcW&ha3pO~zU;8Mz z<&|-09>7IqS&1DPFcJ6sQmKDgR3AA&EqxFygE2A5irZUuyf%^Wt()>EJ_#eY0+G6$ zQ6D~b$><%|k=QDAEE<1=-Mu<&LhJKPsf0j5u~zyRGD$4woXJ9Eji`$e9H%X~Z%Tdx{&UM>;^|;N1838^al~~F) zW)y|gQx3rrQQGSY5)OIOuBZ~jkZO%+k(mV<0+rY<#G9hAxNloJ3Oa7_Kj!dYDn+Q)WbLEU6`G^2)cd^&WxOSkt-s0;O?$FTN#x zn?%k_tT7%mT!mmBfqrR1ZT71iIz5%=YU6*4+I&=L<-5a9ZGzdR{%RP*t~76Z`tLq% zV^4+n(pXW{<27udTNgc2DV>iH0M8BM(Qpe;`*-d_}wX9B3E3lLG6k(S@5}G&hE(op|$b-vl5zUI2HdCB6~KG{HImC#Y+4e#>?{ z6zCjMQuLHnF>yYu3&ww2nIftbU|w1HHK<;LX(moswWBz@R;|4jrWFU6)N8u7wNdrb z-pSzTUD+tT1vUy%nu##fJ|h=`*d{aET&ArWt91Mudt?DV^Oc?JguV_9mXIko0b)@uq}0L zwH@V1pTfbi@)4+vHDGYMce!Os>`8d5gyLQ{KY$U|tHla<$~Wr~-g+o7H&f*yG>ZiW zLQ8}g8fvJv8W2A%8@?x7Nq-gLtPQxEWS6J|h8j)3GIbbb(v7isuK;sBO_$PbykH^@ zs9l5$GUhRd>DPIM=U}FHWtYxABZi32hROnN#{U9PtO(_YPQ=nzMMq-={{rq#l)hf| zg=;Q@qk8F{R7Ue|OWQ31@0fY+3n=y%s>g^GHHW8x) z1gM>#EHVw~4yhT3&F2Nxw)lbvGe@1E^iz_uyBn@mzx&>W=Uw(cZ`9Pc57Ptfm1-+C zmv$8o#cngQMpiQ%LmaBgPX@?ik(e1{Uf)}`L8eTv@iY8>%xyW-5-uam6qTXzsBr)=S#mp zYhO>g61?K}!5}!|&%D)SPx03=AxuxcETuAbYhvS)A+{ve z#PG4zg4|lzDGLIMRP);o-qT_WvxXLdxj*VP&!I>%xMq@smwB_cE^a$~6GkYr?G62= zgfgsvq#w>+w3Nknq8X-QRQ;Cf(kEK4{loc&KJ+&n)v*AN*{feR6`Zv65QE-8)hA6= zCAC5A5Z5r0Oi8a~xJ4~=_Q%L=ZiVNnObqrM^Jpoh`_Q|J?ho#bx1qS83UKc<;=2dd z@1ryQL9U6aV7*Z>Hc)Lf@zr5)Od@+%t(Y~n?bpLG{G4Ppq?rqtVwXg zXL&Z25XhLI##ZJTsbtsO9H_w{Gq#iLF96)BHE}F0X?oW?WQ9qcRTu2>@5HIRC8_dQ z4)(U16Lig}4@hiKbRT|M{DW+>3CldkpA!u89TItE;J@bc;Au4sw+W`PhxHLUNtkJT znMB)L-#}!i?;m;t9myHe8n2#JkvAvWYoeL| zz232yxo=LtSghp~d>}SrbW4O?V8gErS+Zu0kD?T(Od#b$TN2|B6adYkt!0e|2Q2tC zJyxf`b38Jt&b+F*RIGEV6rH5cQW__0*bVPa37yDlc&y7{(OnnJs*aYox+*=1JrGXLh0mTSgl|r@yr>BPUD%KZ zj`7GSt-(Cau6mIEgw5?s2_o|$XlP}>_)P$_8|Ozz8v6QB@}vJ(;rxohS|-9@K+O2ze@A-LDf@)1pO~`8d}3$JxV7kn{xN<9yaIQUUm#g&bB{%7-G{O9}X&+ zUxUu6=-*F`MJiFz39tM@i)L7dCZ|nVLzisJ)cm;hE5$~t(VP9 zrEr@~sY6OGs2f@iJ8V{$H$agm&qB+gca}`&{?xuE$-bwhtEnsR$%zW=WFU*1}#;W;-@ys+i@#gPDzL)xbgijA!&Ee;)ci3|*u+r`F!M(j2DhYmqzD8Z) zmwTx^s`7Ci-|za#_H`SfW2ey+MDhCWng`cpERb@ot66_0KhZaS>#DoP3rlulIhB1c*;R@tBUC}UJv;U29v4z!?Iu}^3AUtd#k z0tAhUy7uD<|u9Y}m)L(vKuQ%S3cm_Wpl%NyTqw9$3%xKdYr-vl3b;VvX8CVYL<2oo?NEm#2gZ5v>$Ta~CDyH`S$ zc^!T2iuo7c#FjqEuKw&4W#AEE-&ZOTiuRc5+&-zqRTD&=2b+guf3L3h^sxdr_14}Z z23wOSNOqXtBwz)@vlTtZbUG|wR~4@v+RTk?@gh?3kT273;fZcdQc;}nU!#7;cafpxC zYlT3MFrhD#${WC80w#BkN`NOWj?qocg|uOiu= zbxK}*Pt1kFXAwfL1v^R@F*lj>h=qq&8LpCul(3EGwSR%Ma$!>^H&=QTfna zYpan6MMR?3Oo#9q^L}MXwEP-jEO++md7w@aCaq@WGb0Z+o(GMx5iJ;l$6Y3nSX{ouN~CHLMO8I5;3 zFpu6D+nN{xH^VY8@!~4ih0~`=7*pr$RF~ZF0G);7`-=Y8>JMaRupb?|nOo9r9D3m!G3tt->2kIQ7-{u3Np?R;z5yT}#UDi=fAR7}vARC($m2;^v)|O&0 zclukqiw{!7k%X0;fa9SY=4zq~8A5bht4|2`UT4Cz%0B`E zWhyC9&mM|UPV?&<$67%zytQv<{qcWzf3AY1#y=gt6&JOo3{A=z{2u&FvY)K>lyS(# z8YYZ7*L&0W&!qQ~NJl>!R1NZ?;CA>YsbBfbxpUfnWfKlNAR*b~C{l^{*p=|UqBpu1 zd+<#+dhPwjYgn(jv;ZTNm)kx$kaUmzj^o+`Uxc_UCS0idp&A@{>ae?Lv-OdCVPyAs z#p^X>%B6hcfFr&g)OiuK!dG&!hDH5SWioP0j;iTlP3&4UbxOL^WW@T%j08ajAyuHU zpz8*!CDWJYde^A;6AB3g>(nfuypyKv9m z&9cY3Vfpa3VPgU#k$womgk#U>P=hfe%U zu%k%-0;W2L1X|Xpjp_Da4MZ&FhnAffnzU}_VPj<<{7{RMo`o6)v1>)MhdWKRtsn}2 zz>q(n#ZrlZsqWThr$>!h>IP%v65+rcmihtd$wy6uV0N6>ApiJSCnZ9Y3K1Vi-$>1V zJrU`^HwD&Js9!f5=@|WrLXOf^d!K>>6l}%sD8n_tx-Z>TvWdRsm+jtop6LfM#o4&5 z>#>Kmg{yLkiuvu*4K&cPTC=GfjH=b!!0#`G84q6bB8BX|`6;Iml~)QSAV?RPZgv(D zz(tRztO+^7yBhADjhPB>8?)XwhOVH$`mTp0EbP7+-C1;XYWrLZEPYMo#lILr} z9rec=cwRq7j>h9}HYXqr2^atK^wQ?eH5~-~Sk*N*gpzz18dm+1_oX?E` z%@QpeY_EPVgb#XH1}(MG#+pwY37-tz6d3W^nZVwJmlM`xDv7EKh3B>`(ukM3Ahlw5 zU_YV$r<7pmP=5g@#rlnP#*`mEJ8KgcvgrD$RfFfijTmY|?W>iZrfR@CV&LY7(ikcd z9DBekL&bCQPfbmmttgC`k5$|{2SPGsb$YcI+Aor-fxv|hvTc;ec>W_40uoI=0*$T$ zE}VnVyzDOrQ_HgT{_?>*6&~LmdPfgJTWLGL&1cvaz9f&urnC-_wjX9D9qNe*U9#O0oAb&#?xL@mw}L${K! z*kd#6<)bFS)&s%oNnOS%Vu;=V(%G)7zC+KNn=hlj56)ORe%ONT-p^AXzN+LZy;~w8 ze=SbT4yr@asE*juswd*1*XHAyE0(!_{0$#|QW1vn&UR&j&w;M-Sz7>+Y6IWolx17t zqbHpl5re*RB|Z~|LTlJZPorf2x%sNI?Uvy5!e2W08p=OO_YQAy&i&ABPuJz*S*g_7 zc|hK%gim!I_lZ&WLjUnzcUEsGYu@?GX+H~ySG+YG%LyupLn9~^=61p1X{3C*S7yI~6G@UlIWIi${ zIw9ZDW^j^m1UxQUx(HZ2k0zc;@r#;G^M!81;Zcc%35u3mF>iRZVrtS770{A^ z)+P4k-lY!#)>?Mq_OfmwdS);3o6>jMHkLpr`y1rPpn7x{!PxgsuipcIx|;;)T?haj z;uG>{KR{Cy5l!wu5nYfTVb&E#mWQ^VdP73r)!9CShW*&dgWkvgXpAyD)L+S!7Q0$= zIU{kbHtL<#72%5o&v&M;65nlCM0bBR+>wVWcVOfxi+<;=@;p&))&BSk0ZnpkwgV;- zYas^>!f=mCK z5#h#blMi;B_;4W-d_*u*g!g{|A@8)1Oq03=Cz7$NkgZ(5BFCjrHR-NUsN`V`L~>16 zOu~3*wLFq$Wzw-;UB~0?7_sF;$v9ux89f(G3Tx+d=Qmppb%IH@)>ry~{#TuO;{}%6 zC(1;dlcABY4W^&OXNdJqJwl!?)nqMU<#lawJ#p$$pM8_h-i5<$nVFi)nn*$?_)$Uh z9tG==uza)6$Gj-Sr}i|rm|o93hkCcB=Zsm6obmf}C2&C_WeNSkBS6yR#xgA>;}Qjk z8$pc46oHae0hPDrfeF86o5P<`5-+Vb*=)|{QR^pUHmaBSX!KZ-ogh~6Ih z$2E6mnTvX(84dNiBl`G|t94tZ`Iy;Sdff@7Kk7L~1l(>RN|rG|Pn-3f?6S~OBPr&G z3*eATRxVr~g4H}qK#qQ%bKCbg1fV@pfML4nU@}q77agIpeRr|z%@`c`#XXOjkYbS{ zR(&`8sHr|dNUPToACNd#FUai4>)^I~!I)vA3n7d&p+c@$#j8HsC2l<&2mV6Wu) z(~PvCpACCJFDZN{f#;>FNWnd)8*0Jt-q!qLI?y~uWNp>$a?^Lo9;=pd51*THZ4i#v zoZ;JXVo4Xsr!K7Wq4w^nHsepfi06=tW-9MCRZ}w(Lu!P{_c71Uo-rN-umrZ7-uc&tTZnfeQ4!GkER^ge-tIA=JAE@;Z0Q zI_r6gvC10HdZ_I5Qb?5RPWUB8Y(G09d>ZD-_PiusO&r0qfXp$;KLFG&)Ed4-AXg`J zIbCzPbz@`4q?mr`pR1@DXY1iDbE28=DV))L=IP0y3e}qje*fJGi;50DG4rWKe)8&V zdtE~-CmtIfHG&IzUhbUS*(7@r<||%c-W?f*AM#_^E?0o&bx=F$}I85!FI>4FosPXrE>$ zeW3ZSkmR{fTlPi>tq^D*UhZteYAZ}Ns+2+{8=qp5g1#p0>6FYUt5ZfRgWGi{O_ z`?|lE<~Iue4L4(2SBE8NAX}FP=m`6|65td1%025*O*UtvtM zcW$C3Qv*jcGmGpqM zZrC5m9!VrwyxJZ4lem1$`V^Cq1En2t>;;`rz-^wow5G5VzlY3&ctClBKh9 zB+?Q((%#0|O)iq{)fH`AB#J@klEi%)Y79+*E%4;=UQ&$RDNNYkUIfY!q?pI>uwK`S z2Xd@-mhvY+zHyAE{cXe=GW~Q%OxUlFHP6Mq zg4A}&SAo)k|J#%VNPfO?=FjNLvdfiTwU(sBK?e5vAk^Kvyz`*Y&;kNce>LJaaj9z3 z?mQWK|8(q?pVK={w?5-Vc&A->rtjl^JvOYt-xNS3@jPLSMB`ixX*(XReYNvnQ5ZI|!pOd3BR zYVLzq)Vyxi;S;FDk>pbo*BRAObZqll;C=Ml-SO;SfQoKXgnC?0l)Y$qjRF%M#w2V~ z3O8z@XT-`CNt?kMO`}Psrg+owKbt4T(en)*oSjCT4x9L^T#f*Uzf+9^?KgICUuVus z&=lEFwd@4+#3R?1q=E8}a#1_v$^!N+r!jM)S@B;P>t=mne#?qmrHZj{DjU@$Yq1o_ z)c5uXS?y;BZ|>SOHK(Zhwf$ILXjAHqhE-&k>$4?x^YzPibtNU5yS+oPvBWfnj%)M3 z#p^=HGRXQ3Fs$T@Y*1yrx*tJxkF47o1Kg#!r7nS;+^EE!pwe-n%0f&Ts`x?`mIGjZ ztY;~DSOr>|X#}&SvF4o&O^Ypyr!+w_fs6( z0udG#=P;$~OQN#e2?KeQ)c~KeXr4e%WkvY1_&^f(ei4d{%N^{Os@GcBR?Yb$_sUKY z<$cVYgRV=^Xh(FlhztQpWKi1o1W7?anSzg8zBkq7L2hG_|3(Xm313x>yPbUCY+hqS z2q_zK37neC3x#7Y%~1~ga^q)YZT!@ix$OLQ64oBVrgZq;1TRS1VOU|)tN*X8=ZL$^ zu$(#92+_b#>`82g8L67`i4)%FTb&dQ13B*-N}l-tl8|=3pl=S^^zZlpMHi4Ip#1CW zW3@7r10N8CI*;#53Fcf_&prmcaIWYilXQ}nKjtc=sy6)q_u2@0HGh#Ay0Dk>1oL>n zoVHotKWI8kT4MwKzrq#??+8{&fv=T5SgAeo&oTNqUU-AB&UCZF>Ss)rtA_g2QGeh7 z$z$%K3XG-Oa}0L;!ek2dkNK_dt07+45@&^JW_&GoI1?7XxE8tAsapjW1obs0Fj(2o zx8!sFIl9%5F1&e{)~%HHRcdz`I_bN!+j2s)0K?*e+BF>sWV#;YpWoHGzlC@dC*~ce zxU%)5r6n4aAl)}7CB@6^r@2fq=FN2xYm0Kt8p(f&yP}&qalNRyCtY049LJ~8`sav? z_o()BiN4Bx?rLpnY|7cMw5MT@!2^m!a~Ad;#3XOOFoM#Ts6A-c59*^X$iHLh5nEt< zC;=evb4F`iT-4DbnSSvrXsf=8DOC`}mK|R)s*8s#4BsH&A7( zK~d%gJATEU3ke4F+Dh<@r1v3{C;`sMW2h9Z^L_ZVrs(e@J)a?1V&{sJ%&>e_6BlLv zy(J<-@SjIL5kd81r>NVK0)ldkVvnkNEJ$B$w1!$kgxYP{GVTFNYuiJ{-W~{3s>q3re|f5CvcyeT>+_lrm-6j9=lFH(p&Q|lJX%Q3jW=CqM+)eOv!e!=IbQ4=d|FqywSAu2u^?g-oyS!Zww{f;=}^a}tv+So{5DZ8oT z+!n^s86UXj^ym*wlvDn?a*z3J%6(jD%`Ktl-}hu2+AR=Wv~T8Ldkv$f*gt; z4W#GeP;~Ht!(!N)|B~(_;hLMcGnA#gidgFSp1zjhfrp@8G#1&q} zrMysj0oHAFDv2XI{$ihz1uhE(3yL;&bfx;R*q|^eVBqgj5TFKBJ#a~3!^~AJC z)1>xKV}CsFv|Z-%aIWhC`mShl@58+R3}0Z~;fyjS3n+LRMqvbva1A|%D&jUHNH0Iw zP0!4xxh#Uvhu6Mkr2N<+PN$@lfbC+`*~*Ptd;a}Gq@MUjLrQ6OJbrXn>fFBVW8oGh z+f5bWMR@JwJNFmx?MiNAMS`yXDZUPw*$01KxL)5fiZSKUW5?_YA)IJq;BxclIwjk% zaN{DDvV});gdl~$34#}=2Q!O-_egXIh~%SCFvQ)fAFr08wY}ZFdXLvE>T-OAr}Uw! zXSY(6>lSzQrceWRVbO`3(hmL4{j*K#YMe*el!?vje)uR?%TE}8HpU+vSA)R?)-hjC z6%mC_au>RQx*URZUH={t92FoR2#%L|*w!WWJ#etyXj=8`hSpr5_1$9$xBsvUGsTrR@D;3S@wXo#*6Ep^Q6UzwG9;>+2O z$vI-*mt{oHT(fEUoR-{Hxt_aPCoVYLl|`xIOqMH!rb1Z8(?1wjF+%4%U<`3l2S%hS z-S{_*1P+87u@Nb2?h||@7o$qNIf|t)B${+Rck(XpvNSV_HVj4WwrOjsqKt83$*;Lq zHtebJIcX@?1_#$wi0qP9rX;ag`I;?MUbQL}oR2YR^>^HtNdI z+w;QCB`^BlDxpmuY6S~{B63{T4u93YGP2OJC-#FB+-zl33%Ii4^UVx(BW_}`+$kX! zm|Xj9d4U%9W6?9Y;JdI>y|yS7&d=+pQ`^1`70+mYZuGFW&pJCJq+HLa#s-r^iG+fk z*OWq-t*JeXV!yQX3ph$wdQEB$O%2Ia_9h6U2|-9t25!Jq9J*`RO-cS_LL76sK(FA* zwA;sBT|gPSAgXG^Qp#DAjEWZOR?gzUxQ~NKm~CYv%5Vgt!X?g@h61Zp>Hs(1sPpwx zd^;7#USMC0dNb^db2fNcExfSK=T8L)SS;a0N^wO4h3bx|;xCbJ8;ki``X+nz@awJ# zhmvIXZSVfOQ9g9)EO`r9mh1OAIkkI>xFJLq_AJ-6@Zipld_^5Yf~_q+#vOODovk_M zEv#vb7{egeMmcvF&Ib^n5_<xR+2>Kd-{;2VAqCwT+s+4p_a-;pgGaiV-qP{m1!tLeH nV@ojlT2A8;X_5eVD6zexg1hEl5?Z_&8@8jm$B}{gyZS!>goHaR literal 0 HcmV?d00001 diff --git a/linkerd.io/resources/_gen/images/authors/chris-campbell_hu5767321052028082074.jpg b/linkerd.io/resources/_gen/images/authors/chris-campbell_hu5767321052028082074.jpg new file mode 100644 index 0000000000000000000000000000000000000000..89b22cf926359a909eaa0c18877849aea296d2aa GIT binary patch literal 2362 zcmbW!S5%V=5(n@vq!JONgx;h#SE_UnP?`b~q=h1c4kAs86gg5AA#_m?5kgm@prHy# z30;vEn$&0FbEU|g}`7?7#t2mAkQI@ zw6sVTdIq|4Y%J{TY%Hv-oIJvOoLqw3tgQS}{DLB);u7K5oIh)D~JiHm{Ya5xfy zWJV&H#W-0x#s24R$zlDYXpyXJ z>>QlJBBEmA67mX{6qS@!bgo?0)zddHG`neTVQFQJadLKXb#wRd47eK@6dZCdG&&|W zF8<-8gtYXG%qLk-pJf-|3yX?NO3TWt-n}PQ*VNY4x3;yDIy$?$dj^MwN64dN;}di9 zl!e7_OW&7QHn+B^JG*=P2fsi7_;1c>{~Pol9>!A-4Fm#)!2k4sXo61*%m{&=mw_>9 znZh0Ym<41XAXv0h^DA3u1?A8iD6Ibgl2u54PI&WA(qE$g4ixo&iT(lo<2jiC=)j=U zhk+RZO<*EHqAGQ0K;lO2n_TrM=}dtlCFEA~!zRr%u1E4o(5Hqm6{ObP9rL{%`8l|v zv#1cR*M9SUD&EJyZF~LZY#Y4qaF?=|wi?*~?`|Ddgt#IcJoVqF%L<2<>4O5dlOy9dQWneE!`xO#2?2 zwA7Adqmi*35r(jG7d;EiiFN6Yml?*Hn3xH#+8|%yi`W4(hzLXyjL!|pkb zgf|X3Y=j2)`NI{A=d23_-#FS1=3wyTSb1{kY(+R*kxixeZNhQIr`wUO;vTzLh-sN- zTg?MId5hS4A4QiQOPaI` zxzyj6(lx*ulRmnrcK>Nf$U~`m;Vt8rZ_*AQ{IXDNi5G1f^*ECB>zpsBrzomeL@-D) z8)+Afnl(9QN12y>(&JyffwdP%XQ3D*0EM})MZ`lUy=F~vysA#dO50Gw64SPQ zO;xX98j5GwwS02Fd@vZsWHM~2Jl~8sSXo>gem1lJQb)7B z68ws54C%3(g(cYRtAI`bTOK6UjTf8IU#u%GUvo{>D$T3`8{1ES8tOGkYAhV(&@TCX zE3o_ACzbj93Rz7LTFHNQEd&Y27_r?<_EJAuWf{DLW*+xDTI~aTAd4pqOkFIOx#zLkP3xmH`-5KI#Dtme1d$l!ZqCUopT2!oD zVJvr<^Q;V4LLeY$ai{ckxv+gMdn9H+!D0vh`z!rNwf2}>Xqd^ej-_r!Aw>aOoa4fh z-mMJuT%IN0sovCX+hcdQzqO%Ncz8G4W$CA^)6NbGyL5Ai5dZYEY-lp3xdDu6Cla8>vXZU&ZB4F?8n)m7p}st z@NeR%87}HHuPMx>1Df+rui%N1_{rS%-3w!pnAIfzX`0%^v9H!{zXjm*l<^L|EkZ%H z>7s>N`A|SkZCrk8*_!A3esXD7BX_1sqpQwE!#A&1tLv`|7kdv<787|5P5{khqEah5 zyi(iW)Y6sIw=t=`ZL6PpC0c6T7f!L|t(kWx1lp)p$aA1c-E<-JCUhDx+|GL>zlpfU zFoL~0x!};-K{##P7|wT0Xr4n)*59LJ38;NXQ0`vXoQYzfBv8N44hOzi;@$jRsm2h-4^~zu9_)xGOCWJ%u zq-cG=ihf~CTnY`U40CAf3ECQCm`X8R!byh)Ry Date: Wed, 4 Dec 2024 09:55:16 -0800 Subject: [PATCH 07/20] Add federated services docs (#1874) * Add federated services docs Signed-off-by: Alex Leong * feedback Signed-off-by: Alex Leong * servce Signed-off-by: Alex Leong * feedback Signed-off-by: Alex Leong * Feedback Signed-off-by: Alex Leong * Update linkerd.io/content/2-edge/features/multicluster.md * Update linkerd.io/content/2-edge/tasks/federated-services.md Co-authored-by: Alejandro Pedraza --------- Signed-off-by: Alex Leong Co-authored-by: Flynn Co-authored-by: Alejandro Pedraza --- .../content/2-edge/features/multicluster.md | 32 +- .../content/2-edge/reference/multicluster.md | 35 +- .../2-edge/tasks/federated-services.md | 415 ++++++++++++++++++ 3 files changed, 466 insertions(+), 16 deletions(-) create mode 100644 linkerd.io/content/2-edge/tasks/federated-services.md diff --git a/linkerd.io/content/2-edge/features/multicluster.md b/linkerd.io/content/2-edge/features/multicluster.md index 6b7281dc34..71d532a4ac 100644 --- a/linkerd.io/content/2-edge/features/multicluster.md +++ b/linkerd.io/content/2-edge/features/multicluster.md @@ -39,8 +39,8 @@ splitting](../traffic-split/) or [dynamic request routing](../request-routing/) to allow local services to access the *Foo* service as if it were on the local cluster. -Linkerd supports two basic forms of multi-cluster communication: hierarchical -and flat. +Linkerd supports three basic forms of multi-cluster communication: hierarchical, +flat, and federated. ![Architectural diagram comparing hierarchical and flat network modes](/docs/images/multicluster/flat-network.png) @@ -65,11 +65,18 @@ several advantages: * Better multi-cluster authorization policies, as workload identity is preserved across cluster boundaries. -Hierarchical (gateway-based) and flat (direct pod-to-pod) modes can be combined, -and pod-to-pod mode can be enabled for specific services by using the -`remote-discovery` value for the label selector used to export services to other -clusters. See the [pod-to-pod multicluster -communication](../../tasks/pod-to-pod-multicluster/) guide and the +### Federated services + +A federated service is a union of services with the same name and namespace +in multiple different clusters. Meshed clients that send traffic to a federated +service will have that traffic distributed across all replicas of services in +the federated service across clusters. Federated services use the *flat +networking* model and do not use a gateway intermediary. + +These modes can be combined, with each specific service selecting the mode that +is most appropriate for that service. See the +[pod-to-pod multicluster communication](../../tasks/pod-to-pod-multicluster/) +guide, the [federated services](../../tasks/federated-services/) guide, and the [multi-cluster reference](../../reference/multicluster/) for more. ## Headless services @@ -80,8 +87,8 @@ communication](../../tasks/pod-to-pod-multicluster/) guide and the By default, Linkerd will mirror all exported services as Kubernetes `clusterIP` services. This also extends to [headless services][headless-svc]; an exported headless service will be mirrored as `clusterIP` and have an IP address -assigned to it. In general, headless services _should not have an IP address_, -they are used when a workloads needs a stable network identifier or to +assigned to it. In general, headless services *should not have an IP address*; +they are used when a workload needs a stable network identifier or to facilitate service discovery without being tied to Kubernetes' native implementation. This allows clients to either implement their own load balancing or to address a pod directly through its DNS name. In certain @@ -110,14 +117,17 @@ exported as a headless service, the hosts backing the service need to be named Deployment would not be supported, since they do not allow for arbitrary hostnames in the pod spec). +Note that headless services can *not* be part of a federated service. + Ready to get started? See the [getting started with multi-cluster guide](../../tasks/multicluster/) for a walkthrough. ## Further reading -* [Multi-cluster installation instructions](../../tasks/installing-multicluster/). +* [Multi-cluster installation instructions](../../tasks/installing-multicluster/) * [Pod-to-pod multicluster communication](../../tasks/pod-to-pod-multicluster/) -* [Multi-cluster communication with StatefulSets](../../tasks/multicluster-using-statefulsets/). +* [Multi-cluster communication with StatefulSets](../../tasks/multicluster-using-statefulsets/) +* [Federated services](../../tasks/federated-services/) * [Architecting for multi-cluster Kubernetes](/2020/02/17/architecting-for-multicluster-kubernetes/), a blog post explaining some of the design rationale behind Linkerd's multi-cluster diff --git a/linkerd.io/content/2-edge/reference/multicluster.md b/linkerd.io/content/2-edge/reference/multicluster.md index 1ab60ee1c2..7934291375 100644 --- a/linkerd.io/content/2-edge/reference/multicluster.md +++ b/linkerd.io/content/2-edge/reference/multicluster.md @@ -5,14 +5,16 @@ description: Multi-cluster communication Linkerd's [multi-cluster functionality](../../features/multicluster/) allows pods to connect to Kubernetes services across cluster boundaries in a way that -is secure and fully transparent to the application. As of Linkerd 2.14, this -feature supports two modes: hierarchical (using an gateway) and flat (without a -gateway): +is secure and fully transparent to the application. This feature supports three +modes: hierarchical (using a gateway), flat (without a gateway), and federated. -* **Flat mode** requires that all pods on the source cluster be able to directly - connect to pods on the destination cluster. * **Hierarchical mode** only requires that the gateway IP of the destination cluster be reachable by pods on the source cluster. +* **Flat mode** requires that all pods on the source cluster be able to directly + connect to pods on the destination cluster. +* **Federated mode** has the same requirements as flat mode but allows a service + deployed to multiple clusters to be treated as a single cluster agnostic + service. These modes can be mixed and matched. @@ -66,3 +68,26 @@ together, a Kubernetes `Secret` is created in the control plane's namespace with a kubeconfig file that allows an API client to be configured. The kubeconfig file uses RBAC to provide the "principle of least privilege", ensuring the *destination service* may only access only the resources it needs. + +## Federated Services + +Federated services take this a step farther by allowing a service which is +deployed to multiple clusters to be joined into a single unified service. + +The service mirror controller will look for all services in all linked clusters +which match a label selector (`mirror.linkerd.io/federated=member` by default) +and create a federated service called `-federated` which will act as +a union of all those services with that name. For example, all traffic sent to +the `store-web-federated` federated service will be load balanced over all +replicas of all services named `store-web` in all linked clusters. + +The concept of "namespace sameness" applies, which means that the federated +service will be created in the same namespace as the individual services and +services can only join a federated service in the same namespace. + +Since Linkerd's *destination service* uses "remote-discovery" to discover the +endpoints of a federated service, all of the requirements for flat mode also +apply to federated services: the clusters must be on a flat network where pods +in one cluster can connect to pods in the others, the clusters must have the +same trust root, and any clients connecting to the federated service must be +meshed. diff --git a/linkerd.io/content/2-edge/tasks/federated-services.md b/linkerd.io/content/2-edge/tasks/federated-services.md new file mode 100644 index 0000000000..4605f3f3fc --- /dev/null +++ b/linkerd.io/content/2-edge/tasks/federated-services.md @@ -0,0 +1,415 @@ +--- +title: Multi-cluster Federated Services +description: Using multi-cluster federated services +--- + +Linkerd's [multicluster extension](../multicluster/) can create federated +services which act as a union of multiple services in different clusters with +the same name and namespace. By sending traffic to the federated service, that +traffic will be load balanced among all endpoints of that service in all linked +clusters. This allows the client to be cluster agnostic, balance traffic across +multiple clusters, and be resiliant to the failure of any individual cluster. + +Federated services send traffic directly to the pods of the member services +rahter than through a gateway. Therefore, federated services have the same +requirements as *pod-to-pod* multicluster services: + +* The clusters must be on a *flat network*. In other words, pods from one + cluster must be able to address and connect to pods in the other cluster. +* The clusters must have the same trust root. +* Any clients connecting to the federated service must be meshed. + +This guide will walk you through creating a federated service to load balance +traffic to a service which exists in multiple clusters. A federated service can +include services from any number of clusters, but in this guide we'll create +a federated service for a service that spans 3 clusters. + +## Prerequisites + +* Three clusters. We will refer to them as `west`, `east`, and `north` in this + guide. +* The clusters must be on a *flat network*. In other words, pods from one + cluster must be able to address and connect to pods in the other cluster. +* Each of these clusters should be configured as `kubectl` + [contexts](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). + We'd recommend you use the names `west`, `east`, and `north` so that you can + follow along with this guide. It is easy to + [rename contexts](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-rename-context-em-) + with `kubectl`, so don't feel like you need to keep them all named this way + forever. + +## Step 1: Installing Linkerd and Linkerd-Viz + +First, install Linkerd and Linkerd-Viz into all three clusters, as described in +the [multicluster guide](../multicluster/#install-linkerd-and-linkerd-viz). +Make sure to take care that all clusters share a common trust anchor. + +## Step 2: Installing Linkerd-Multicluster + +We will install the multicluster extension into all three clusters. We can +install without the gateway because federated services use direct pod-to-pod +communication. + +```console +> linkerd --context west multicluster install --gateway=false | kubectl --context west apply -f - +> linkerd --context west check + +> linkerd --context east multicluster install --gateway=false | kubectl --context east apply -f - +> linkerd --context east check + +> linkerd --context north multicluster install --gateway=false | kubectl --context north apply -f - +> linkerd --context north check +``` + +## Step 3: Linking the Clusters + +We use the `linkerd multicluster link` command to link the `east` and `north` +cluster to the `west` cluster. This is exactly the same as in the regular +[Multicluster guide](../multicluster/#linking-the-clusters) except that we pass +the `--gateway=false` flag to create a Link which doesn't require a gateway. + +```console +> linkerd --context east multicluster link --cluster-name=east --gateway=false | kubectl --context west apply -f - +> linkerd --context north multicluster link --cluster-name=north --gateway=false | kubectl --context west apply -f - +> linkerd --context west check +``` + +## Step 4: Deploy a Service + +For our guide, we'll deploy the [bb](https://github.com/BuoyantIO/bb) service, +which is a simple server that just returns a static response. We deploy it +into all three clusters but configure each one with a different response string +so that we can tell the responses apart: + +```bash +> cat < cat < cat < kubectl --context east -n mc-demo label svc/bb mirror.linkerd.io/federated=member +> kubectl --context north -n mc-demo label svc/bb mirror.linkerd.io/federated=member +> kubectl --context west -n mc-demo label svc/bb mirror.linkerd.io/federated=member +``` + +You should immediately see a federated service created in the `west` cluster: + +```console +> kubectl --context west -n mc-demo get svc +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +bb-federated ClusterIP 10.43.56.245 8080/TCP 114s +``` + +We can also check the `status` subresource of each of the Link resources to see +which services have joined federated services or if there are any errors. + +```console +> kubectl --context west -n linkerd-multicluster get link/east -ojsonpath='{.status.federatedServices}' | jq . +[ + { + "conditions": [ + { + "lastTransitionTime": "2024-11-07T19:53:01Z", + "localRef": { + "group": "", + "kind": "Service", + "name": "bb-federated", + "namespace": "mc-demo" + }, + "message": "", + "reason": "Mirrored", + "status": "True", + "type": "Mirrored" + } + ], + "controllerName": "linkerd.io/service-mirror", + "remoteRef": { + "group": "", + "kind": "Service", + "name": "bb", + "namespace": "mc-demo" + } + } +] +> kubectl --context west -n linkerd-multicluster get link/north -ojsonpath='{.status.federatedService +s}' | jq . +[ + { + "conditions": [ + { + "lastTransitionTime": "2024-11-07T19:53:06Z", + "localRef": { + "group": "", + "kind": "Service", + "name": "bb-federated", + "namespace": "mc-demo" + }, + "message": "", + "reason": "Mirrored", + "status": "True", + "type": "Mirrored" + } + ], + "controllerName": "linkerd.io/service-mirror", + "remoteRef": { + "group": "", + "kind": "Service", + "name": "bb", + "namespace": "mc-demo" + } + } +] +``` + +## Step 6: Send some traffic! + +We'll create a deployment that uses `curl` to generate traffic to the +`bb-federated` service. + +```bash +> cat < kubectl --context west -n mc-demo logs deploy/traffic -c traffic +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-407945949","payload":"hello from east\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-420928530","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-433442439","payload":"hello from north\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-445418175","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-457469540","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-469729132","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-481971153","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-496032705","payload":"hello from east\n"} +... +``` + +## Next Steps + +We now have a federated service that balances traffic accross services in three +clusters. Additional clusters can be added simply by linking the new cluster +and adding the `mirror.linkerd.io/federated=member` label to the services that +you wish to add to the federated service. Similarly, services can be removed +from the federated service at any time by removing the label. + +You may notice that the `bb-federated` federated service exists only in the +`west` cluster and not in the `east` or `north` clusters. This is because Links +are directional and to keep this guide simple, we only linked north and east to +west, and not the other way around. If we were to create links in both +directions between all three clusters, we would get a `bb-federated` service in +all three clusters. + +## Troubleshooting + +* The first step of troubleshooting should be to run the `linkerd check` command + in each of the clusters. In particular, look for the `linkerd-multicluster` + checks and ensure that all linked clusters are listed: + +```console +linkerd-multicluster +-------------------- +√ Link CRD exists +√ Link resources are valid + * east + * north +√ remote cluster access credentials are valid + * east + * north +√ clusters share trust anchors + * east + * north +√ service mirror controller has required permissions + * east + * north +√ service mirror controllers are running + * east + * north +``` + +* Check the `status` subresource of the Link resource. If any services failed to + join the federated service, they will appear as an error here. +* If a service that should join a federated service is not present in the Link + `status`, ensure that the service matches the federated service label selector + (`mirror.linkerd.io/federated=memeber` by default). +* Use the `linkerd diagnostics endpoints` command to see all of the endpoints + in a federated service: + +```console +> linkerd --context west diagnostics endpoints bb-federated.mc-demo.svc.cluster.local:8080 +NAMESPACE IP PORT POD SERVICE +mc-demo 10.42.0.108 8080 bb-85f9bbc898-j7fbq bb.mc-demo +mc-demo 10.23.1.43 8080 bb-7d9f44c6fd-9s848 bb.mc-demo +mc-demo 10.23.0.42 8080 bb-74c6c64948-j5drn bb.mc-demo +``` From 828abd15f2c8407e2d2a0154a34d25cc2e57127d Mon Sep 17 00:00:00 2001 From: Alex Leong Date: Wed, 4 Dec 2024 10:00:35 -0800 Subject: [PATCH 08/20] apply protocol detection docs update to edge (#1873) Signed-off-by: Alex Leong Co-authored-by: Flynn --- .../2-edge/features/protocol-detection.md | 101 ++++++++++-------- 1 file changed, 54 insertions(+), 47 deletions(-) diff --git a/linkerd.io/content/2-edge/features/protocol-detection.md b/linkerd.io/content/2-edge/features/protocol-detection.md index 541230e3b7..b19b1508fa 100644 --- a/linkerd.io/content/2-edge/features/protocol-detection.md +++ b/linkerd.io/content/2-edge/features/protocol-detection.md @@ -9,17 +9,17 @@ Linkerd is capable of proxying all TCP traffic, including TLS connections, WebSockets, and HTTP tunneling. In most cases, Linkerd can do this without configuration. To accomplish this, -Linkerd performs *protocol detection* to determine whether traffic is HTTP or -HTTP/2 (including gRPC). If Linkerd detects that a connection is HTTP or -HTTP/2, Linkerd automatically provides HTTP-level metrics and routing. - -If Linkerd *cannot* determine that a connection is using HTTP or HTTP/2, -Linkerd will proxy the connection as a plain TCP connection, applying -[mTLS](../automatic-mtls/) and providing byte-level metrics as usual. - -(Note that HTTPS calls to or from meshed pods are treated as TCP, not as HTTP. -Because the client initiates the TLS connection, Linkerd is not be able to -decrypt the connection to observe the HTTP transactions.) +Linkerd performs *protocol detection* to determine whether traffic is HTTP +(including HTTP/2 and gRPC). If Linkerd detects that a connection is HTTP, it +will automatically provide HTTP-level metrics and routing. If Linkerd *cannot* +determine that a connection is using HTTP, Linkerd will proxy the connection as +a plain TCP connection without HTTP metrics and routing. (In both cases, +non-HTTP features such as [mutual TLS](../automatic-mtls/) and byte-level +metrics are still applied.) + +Protocol detection can only happen if the HTTP traffic is unencrypted from the +client. If the application itself initiates a TLS call, Linkerd will not be able +to decrypt the connection, and will treat it as an opaque TCP connection. ## Configuring protocol detection @@ -30,45 +30,53 @@ connections, you are likely running into a protocol detection timeout. This section will help you understand how to fix this. {{< /note >}} -In some cases, Linkerd's protocol detection will time out because it doesn't see -any bytes from the client. This situation is commonly encountered when using -protocols where the server sends data before the client does (such as SMTP) or -protocols that proactively establish connections without sending data (such as -Memcache). In this case, the connection will proceed as a TCP connection after a -10-second protocol detection delay. +To do protocol detection, Linkerd waits for up to 10 seconds to see bytes sent +from the client. Note that until the protocol has been determined, Linkerd +cannot even establish a connection to the destination, since HTTP routing +configuration may inform where this connection is established to. + +If Linkerd does not see enough data from the client within 10 seconds from +connection establishment to determine the protocol, Linkerd will treat the +connection as an opaque TCP connection and will proceed as normal, establishing +the connection to the destination and proxying the data. -To avoid this delay, you will need to provide some configuration for Linkerd. -There are two basic mechanisms for configuring protocol detection: _opaque -ports_ and _skip ports_: +In practice, protocol detection timeouts typically happen when the application +is using a protocol where the server sends data before the client does (such as +SMTP) or a protocol that proactively establishes connections without sending data +(such as Memcache). In this case, everything will work, but Linkerd will +introduce an unnecessary 10 second delay before connection establishment. + +To avoid this delay, you can provide some configuration for Linkerd. There are +two basic mechanisms for configuring protocol detection: _opaque ports_ and +_skip ports_: * Opaque ports instruct Linkerd to skip protocol detection and proxy the - connection as a TCP stream + connection as a TCP stream. * Skip ports bypass the proxy entirely. -Opaque ports are generally preferred as they allow Linkerd to provide mTLS, -TCP-level metrics, policy, etc. Skip ports circumvent Linkerd's ability to -provide security features. +Opaque ports are generally preferred as they only skip protocol detection, +without interfering with Linkerd's ability to provide mTLS, TCP-level metrics, +policy, etc. Skip ports, by contrast, create networking rules that avoid the +proxy entirely, circumventing Linkerd's ability to provide security features. Linkerd maintains a default list of opaque ports that corresponds to the standard ports used by protocols that interact poorly with protocol detection. -As of the 2.12 release, that list is: **25** (SMTP), **587** (SMTP), **3306** -(MySQL), **4444** (Galera), **5432** (Postgres), **6379** (Redis), **9300** -(ElasticSearch), and **11211** (Memcache). ## Protocols that may require configuration The following table contains common protocols that may require additional configuration. -| Protocol | Standard port(s) | In default list? | Notes | +| Protocol | Standard ports | In default list? | Notes | |-----------------|------------------|------------------|-------| | SMTP | 25, 587 | Yes | | | MySQL | 3306 | Yes | | -| MySQL with Galera | 3306, 4444, 4567, 4568 | Partially | Ports 4567 and 4568 are not in Linkerd's default set of opaque ports | +| MySQL with Galera | 3306, 4444, 4567, 4568 | Partially | Ports 4567 and 4568 are not in Linkerd's default list of opaque ports | | PostgreSQL | 5432 | Yes | | | Redis | 6379 | Yes | | | ElasticSearch | 9300 | Yes | | | Memcache | 11211 | Yes | | +| NATS | 4222, 6222, 8222 | No | | If you are using one of those protocols, follow this decision tree to determine which configuration you need to apply. @@ -78,27 +86,32 @@ which configuration you need to apply. ## Marking ports as opaque You can use the `config.linkerd.io/opaque-ports` annotation to mark a port as -opaque. Note that this annotation should be set on the _destination_, not on the -source, of the traffic. +opaque. Linkerd will skip protocol detection on opaque ports, and treat +connections to them as TCP streams. -This annotation can be set in a variety of ways: +This annotation should be set on the _destination_, not on the source, of the +traffic. This is true even if the destination is unmeshed, as it controls the +behavior of meshed clients. -1. On the workload itself, e.g. on the Deployment's Pod spec receiving the traffic. -1. On the Service receiving the traffic. -1. On a namespace (in which it will apply to all workloads in the namespace). -1. In an [authorization policy](../server-policy/) `Server` object's - `proxyProtocol` field, in which case it will apply to all pods targeted by that - `Server`. +This annotation *must* be set in two places: -When set, Linkerd will skip protocol detection both on the client side and on -the server side. Note that since this annotation informs the behavior of meshed -_clients_, it can be applied to unmeshed workloads as well as meshed ones. +1. On the Service receiving the traffic. +2. On the workload itself (e.g. on the Deployment's Pod spec receiving the +traffic), or on enclosing namespace, in which it will apply to all workloads in +the namespace. {{< note >}} Multiple ports can be provided as a comma-delimited string. The values you provide will _replace_, not augment, the default list of opaque ports. {{< /note >}} +{{< note >}} +If you are using [authorization policies](../server-policy/), the `Server`'s +`proxyProtocol` field which can be used to control protocol detection behavior +and can be used instead of a Service annotation. Regardless, we suggest +annotating the Service object for clarity. +{{< /note >}} + ## Marking ports as skip ports Sometimes it is necessary to bypass the proxy altogether. In this case, you can @@ -125,12 +138,6 @@ Note that the default set of opaque ports can be configured at install time, e.g. by using `--set proxy.opaquePorts`. This may be helpful in conjunction with `enable-external-profiles`. -{{< note >}} -There was a bug in Linkerd 2.11.0 and 2.11.1 that prevented the opaque ports -behavior of `enable-external-profiles` from working. This was fixed in Linkerd -2.11.2. -{{< /note >}} - ## Using `NetworkPolicy` resources with opaque ports When a service has a port marked as opaque, any `NetworkPolicy` resources that From 55a4e0a54ad6a39134cd0c4f08a01216e2458007 Mon Sep 17 00:00:00 2001 From: Flynn Date: Wed, 4 Dec 2024 13:12:07 -0500 Subject: [PATCH 09/20] Minor protocol-detection doc tweak (#1892) Signed-off-by: Flynn --- linkerd.io/content/2-edge/features/protocol-detection.md | 6 +++--- linkerd.io/content/2.16/features/protocol-detection.md | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/linkerd.io/content/2-edge/features/protocol-detection.md b/linkerd.io/content/2-edge/features/protocol-detection.md index b19b1508fa..c89d50885c 100644 --- a/linkerd.io/content/2-edge/features/protocol-detection.md +++ b/linkerd.io/content/2-edge/features/protocol-detection.md @@ -107,9 +107,9 @@ provide will _replace_, not augment, the default list of opaque ports. {{< note >}} If you are using [authorization policies](../server-policy/), the `Server`'s -`proxyProtocol` field which can be used to control protocol detection behavior -and can be used instead of a Service annotation. Regardless, we suggest -annotating the Service object for clarity. +`proxyProtocol` field can be used to control protocol detection behavior +instead of a Service annotation. Regardless, we suggest annotating the +Service object for clarity. {{< /note >}} ## Marking ports as skip ports diff --git a/linkerd.io/content/2.16/features/protocol-detection.md b/linkerd.io/content/2.16/features/protocol-detection.md index b19b1508fa..c89d50885c 100644 --- a/linkerd.io/content/2.16/features/protocol-detection.md +++ b/linkerd.io/content/2.16/features/protocol-detection.md @@ -107,9 +107,9 @@ provide will _replace_, not augment, the default list of opaque ports. {{< note >}} If you are using [authorization policies](../server-policy/), the `Server`'s -`proxyProtocol` field which can be used to control protocol detection behavior -and can be used instead of a Service annotation. Regardless, we suggest -annotating the Service object for clarity. +`proxyProtocol` field can be used to control protocol detection behavior +instead of a Service annotation. Regardless, we suggest annotating the +Service object for clarity. {{< /note >}} ## Marking ports as skip ports From 1b14cdcc244a17959306bcba6e1885e54103dc00 Mon Sep 17 00:00:00 2001 From: Flynn Date: Wed, 4 Dec 2024 23:30:41 -0500 Subject: [PATCH 10/20] Update 2.16 K8s versions (this got missed when 2.16 was released, sigh) (#1894) Signed-off-by: Flynn --- linkerd.io/content/2.16/reference/k8s-versions.md | 1 + 1 file changed, 1 insertion(+) diff --git a/linkerd.io/content/2.16/reference/k8s-versions.md b/linkerd.io/content/2.16/reference/k8s-versions.md index de4c6ccc2b..8f7de765aa 100644 --- a/linkerd.io/content/2.16/reference/k8s-versions.md +++ b/linkerd.io/content/2.16/reference/k8s-versions.md @@ -24,6 +24,7 @@ chart below as these situations arise. | `2.13` | `1.21` | `1.28` | | `2.14` | `1.21` | `1.28` | | `2.15` | `1.22` | `1.29` | +| `2.16` | `1.22` | `1.29` | {{< /keyval >}} Note that Linkerd will almost never change the supported Kubernetes version in From 99670ac7de8bcd4ef03c43334986b13f0f8eef89 Mon Sep 17 00:00:00 2001 From: Flynn Date: Thu, 5 Dec 2024 08:58:06 -0500 Subject: [PATCH 11/20] 2.17 documentation (#1893) --- linkerd.io/config/_default/menu.yaml | 3 + linkerd.io/config/_default/params.yaml | 2 +- linkerd.io/content/2-edge/features/egress.md | 5 +- .../2-edge/reference/egress-network.md | 1 + linkerd.io/content/2.17/_index.md | 11 + linkerd.io/content/2.17/checks/index.md | 10 + .../content/2.17/common-errors/_index.md | 21 + .../content/2.17/common-errors/failfast.md | 18 + .../content/2.17/common-errors/http-502.md | 11 + .../2.17/common-errors/http-503-504.md | 27 + .../2.17/common-errors/protocol-detection.md | 36 + linkerd.io/content/2.17/features/_index.md | 14 + .../content/2.17/features/access-logging.md | 62 + .../content/2.17/features/automatic-mtls.md | 154 + linkerd.io/content/2.17/features/cni.md | 137 + linkerd.io/content/2.17/features/dashboard.md | 105 + .../2.17/features/distributed-tracing.md | 55 + linkerd.io/content/2.17/features/egress.md | 27 + .../content/2.17/features/fault-injection.md | 13 + linkerd.io/content/2.17/features/ha.md | 139 + linkerd.io/content/2.17/features/http-grpc.md | 22 + linkerd.io/content/2.17/features/httproute.md | 81 + linkerd.io/content/2.17/features/ingress.md | 11 + linkerd.io/content/2.17/features/ipv6.md | 14 + .../content/2.17/features/load-balancing.md | 38 + .../content/2.17/features/multicluster.md | 138 + linkerd.io/content/2.17/features/nft.md | 62 + .../2.17/features/non-kubernetes-workloads.md | 16 + .../2.17/features/protocol-detection.md | 152 + .../content/2.17/features/proxy-injection.md | 72 + .../content/2.17/features/rate-limiting.md | 55 + .../content/2.17/features/request-routing.md | 24 + .../2.17/features/retries-and-timeouts.md | 27 + .../content/2.17/features/server-policy.md | 170 + .../content/2.17/features/service-profiles.md | 33 + linkerd.io/content/2.17/features/telemetry.md | 77 + .../content/2.17/features/traffic-split.md | 44 + .../content/2.17/getting-started/_index.md | 271 ++ linkerd.io/content/2.17/overview/_index.md | 54 + linkerd.io/content/2.17/reference/_index.md | 6 + .../content/2.17/reference/architecture.md | 115 + .../2.17/reference/authorization-policy.md | 562 ++++ .../2.17/reference/circuit-breaking.md | 155 + .../content/2.17/reference/cli/_index.md | 18 + .../content/2.17/reference/cli/authz.md | 11 + .../content/2.17/reference/cli/check.md | 56 + .../content/2.17/reference/cli/completion.md | 9 + .../content/2.17/reference/cli/diagnostics.md | 43 + .../content/2.17/reference/cli/identity.md | 9 + .../content/2.17/reference/cli/inject.md | 24 + .../content/2.17/reference/cli/install-cni.md | 9 + .../content/2.17/reference/cli/install.md | 12 + .../content/2.17/reference/cli/jaeger.md | 51 + .../2.17/reference/cli/multicluster.md | 67 + .../content/2.17/reference/cli/profile.md | 13 + .../content/2.17/reference/cli/prune.md | 9 + .../content/2.17/reference/cli/uninject.md | 9 + .../content/2.17/reference/cli/uninstall.md | 9 + .../content/2.17/reference/cli/upgrade.md | 9 + .../content/2.17/reference/cli/version.md | 9 + linkerd.io/content/2.17/reference/cli/viz.md | 175 + .../2.17/reference/cluster-configuration.md | 134 + .../content/2.17/reference/egress-network.md | 111 + .../content/2.17/reference/extension-list.md | 15 + .../2.17/reference/external-workload.md | 105 + .../content/2.17/reference/httproute.md | 319 ++ linkerd.io/content/2.17/reference/iptables.md | 194 ++ .../content/2.17/reference/k8s-versions.md | 44 + .../content/2.17/reference/multicluster.md | 93 + .../2.17/reference/proxy-configuration.md | 62 + .../content/2.17/reference/proxy-log-level.md | 39 + .../content/2.17/reference/proxy-metrics.md | 279 ++ .../content/2.17/reference/rate-limiting.md | 70 + linkerd.io/content/2.17/reference/retries.md | 105 + .../2.17/reference/service-profiles.md | 135 + linkerd.io/content/2.17/reference/timeouts.md | 68 + linkerd.io/content/2.17/tasks/_index.md | 12 + .../tasks/adding-non-kubernetes-workloads.md | 540 ++++ .../content/2.17/tasks/adding-your-service.md | 96 + .../content/2.17/tasks/automatic-failover.md | 176 + ...-rotating-control-plane-tls-credentials.md | 202 ++ ...ically-rotating-webhook-tls-credentials.md | 340 ++ linkerd.io/content/2.17/tasks/books.md | 351 ++ .../content/2.17/tasks/circuit-breakers.md | 279 ++ .../configuring-dynamic-request-routing.md | 191 ++ .../tasks/configuring-per-route-policy.md | 465 +++ .../tasks/configuring-proxy-concurrency.md | 131 + .../configuring-proxy-discovery-cache.md | 82 + .../2.17/tasks/configuring-rate-limiting.md | 151 + .../content/2.17/tasks/configuring-retries.md | 51 + .../2.17/tasks/configuring-timeouts.md | 25 + .../content/2.17/tasks/customize-install.md | 104 + .../content/2.17/tasks/debugging-502s.md | 75 + .../2.17/tasks/debugging-your-service.md | 61 + .../content/2.17/tasks/distributed-tracing.md | 313 ++ .../content/2.17/tasks/exporting-metrics.md | 172 + .../content/2.17/tasks/exposing-dashboard.md | 247 ++ linkerd.io/content/2.17/tasks/extensions.md | 73 + .../content/2.17/tasks/external-prometheus.md | 174 + .../content/2.17/tasks/fault-injection.md | 209 ++ .../content/2.17/tasks/federated-services.md | 415 +++ linkerd.io/content/2.17/tasks/flagger.md | 547 ++++ .../2.17/tasks/generate-certificates.md | 92 + .../2.17/tasks/getting-per-route-metrics.md | 24 + linkerd.io/content/2.17/tasks/gitops.md | 524 +++ .../content/2.17/tasks/graceful-shutdown.md | 164 + linkerd.io/content/2.17/tasks/grafana.md | 111 + linkerd.io/content/2.17/tasks/install-helm.md | 146 + linkerd.io/content/2.17/tasks/install.md | 114 + .../2.17/tasks/installing-multicluster.md | 238 ++ linkerd.io/content/2.17/tasks/linkerd-smi.md | 218 ++ .../2.17/tasks/managing-egress-traffic.md | 443 +++ ...-rotating-control-plane-tls-credentials.md | 352 ++ .../2.17/tasks/modifying-proxy-log-level.md | 45 + .../tasks/multicluster-using-statefulsets.md | 336 ++ linkerd.io/content/2.17/tasks/multicluster.md | 496 +++ .../content/2.17/tasks/per-request-policy.md | 33 + .../2.17/tasks/pod-to-pod-multicluster.md | 307 ++ .../tasks/replacing_expired_certificates.md | 124 + .../content/2.17/tasks/restricting-access.md | 186 ++ .../tasks/rotating_webhooks_certificates.md | 104 + .../2.17/tasks/securing-linkerd-tap.md | 223 ++ .../2.17/tasks/setting-up-service-profiles.md | 149 + .../content/2.17/tasks/traffic-shifting.md | 247 ++ .../content/2.17/tasks/troubleshooting.md | 2329 +++++++++++++ .../2.17/tasks/uninstall-multicluster.md | 41 + linkerd.io/content/2.17/tasks/uninstall.md | 52 + linkerd.io/content/2.17/tasks/upgrade.md | 681 ++++ .../content/2.17/tasks/using-custom-domain.md | 35 + .../2.17/tasks/using-debug-endpoints.md | 64 + .../content/2.17/tasks/using-ingress.md | 733 +++++ linkerd.io/content/2.17/tasks/using-psp.md | 11 + .../2.17/tasks/using-the-debug-container.md | 104 + .../2.17/tasks/validating-your-traffic.md | 141 + linkerd.io/data/cli/2-17.yaml | 2872 +++++++++++++++++ 135 files changed, 22583 insertions(+), 3 deletions(-) create mode 100644 linkerd.io/content/2.17/_index.md create mode 100644 linkerd.io/content/2.17/checks/index.md create mode 100644 linkerd.io/content/2.17/common-errors/_index.md create mode 100644 linkerd.io/content/2.17/common-errors/failfast.md create mode 100644 linkerd.io/content/2.17/common-errors/http-502.md create mode 100644 linkerd.io/content/2.17/common-errors/http-503-504.md create mode 100644 linkerd.io/content/2.17/common-errors/protocol-detection.md create mode 100644 linkerd.io/content/2.17/features/_index.md create mode 100644 linkerd.io/content/2.17/features/access-logging.md create mode 100644 linkerd.io/content/2.17/features/automatic-mtls.md create mode 100644 linkerd.io/content/2.17/features/cni.md create mode 100644 linkerd.io/content/2.17/features/dashboard.md create mode 100644 linkerd.io/content/2.17/features/distributed-tracing.md create mode 100644 linkerd.io/content/2.17/features/egress.md create mode 100644 linkerd.io/content/2.17/features/fault-injection.md create mode 100644 linkerd.io/content/2.17/features/ha.md create mode 100644 linkerd.io/content/2.17/features/http-grpc.md create mode 100644 linkerd.io/content/2.17/features/httproute.md create mode 100644 linkerd.io/content/2.17/features/ingress.md create mode 100644 linkerd.io/content/2.17/features/ipv6.md create mode 100644 linkerd.io/content/2.17/features/load-balancing.md create mode 100644 linkerd.io/content/2.17/features/multicluster.md create mode 100644 linkerd.io/content/2.17/features/nft.md create mode 100644 linkerd.io/content/2.17/features/non-kubernetes-workloads.md create mode 100644 linkerd.io/content/2.17/features/protocol-detection.md create mode 100644 linkerd.io/content/2.17/features/proxy-injection.md create mode 100644 linkerd.io/content/2.17/features/rate-limiting.md create mode 100644 linkerd.io/content/2.17/features/request-routing.md create mode 100644 linkerd.io/content/2.17/features/retries-and-timeouts.md create mode 100644 linkerd.io/content/2.17/features/server-policy.md create mode 100644 linkerd.io/content/2.17/features/service-profiles.md create mode 100644 linkerd.io/content/2.17/features/telemetry.md create mode 100644 linkerd.io/content/2.17/features/traffic-split.md create mode 100644 linkerd.io/content/2.17/getting-started/_index.md create mode 100644 linkerd.io/content/2.17/overview/_index.md create mode 100644 linkerd.io/content/2.17/reference/_index.md create mode 100644 linkerd.io/content/2.17/reference/architecture.md create mode 100644 linkerd.io/content/2.17/reference/authorization-policy.md create mode 100644 linkerd.io/content/2.17/reference/circuit-breaking.md create mode 100644 linkerd.io/content/2.17/reference/cli/_index.md create mode 100644 linkerd.io/content/2.17/reference/cli/authz.md create mode 100644 linkerd.io/content/2.17/reference/cli/check.md create mode 100644 linkerd.io/content/2.17/reference/cli/completion.md create mode 100644 linkerd.io/content/2.17/reference/cli/diagnostics.md create mode 100644 linkerd.io/content/2.17/reference/cli/identity.md create mode 100644 linkerd.io/content/2.17/reference/cli/inject.md create mode 100644 linkerd.io/content/2.17/reference/cli/install-cni.md create mode 100644 linkerd.io/content/2.17/reference/cli/install.md create mode 100644 linkerd.io/content/2.17/reference/cli/jaeger.md create mode 100644 linkerd.io/content/2.17/reference/cli/multicluster.md create mode 100644 linkerd.io/content/2.17/reference/cli/profile.md create mode 100644 linkerd.io/content/2.17/reference/cli/prune.md create mode 100644 linkerd.io/content/2.17/reference/cli/uninject.md create mode 100644 linkerd.io/content/2.17/reference/cli/uninstall.md create mode 100644 linkerd.io/content/2.17/reference/cli/upgrade.md create mode 100644 linkerd.io/content/2.17/reference/cli/version.md create mode 100644 linkerd.io/content/2.17/reference/cli/viz.md create mode 100644 linkerd.io/content/2.17/reference/cluster-configuration.md create mode 100644 linkerd.io/content/2.17/reference/egress-network.md create mode 100644 linkerd.io/content/2.17/reference/extension-list.md create mode 100644 linkerd.io/content/2.17/reference/external-workload.md create mode 100644 linkerd.io/content/2.17/reference/httproute.md create mode 100644 linkerd.io/content/2.17/reference/iptables.md create mode 100644 linkerd.io/content/2.17/reference/k8s-versions.md create mode 100644 linkerd.io/content/2.17/reference/multicluster.md create mode 100644 linkerd.io/content/2.17/reference/proxy-configuration.md create mode 100644 linkerd.io/content/2.17/reference/proxy-log-level.md create mode 100644 linkerd.io/content/2.17/reference/proxy-metrics.md create mode 100644 linkerd.io/content/2.17/reference/rate-limiting.md create mode 100644 linkerd.io/content/2.17/reference/retries.md create mode 100644 linkerd.io/content/2.17/reference/service-profiles.md create mode 100644 linkerd.io/content/2.17/reference/timeouts.md create mode 100644 linkerd.io/content/2.17/tasks/_index.md create mode 100644 linkerd.io/content/2.17/tasks/adding-non-kubernetes-workloads.md create mode 100644 linkerd.io/content/2.17/tasks/adding-your-service.md create mode 100644 linkerd.io/content/2.17/tasks/automatic-failover.md create mode 100644 linkerd.io/content/2.17/tasks/automatically-rotating-control-plane-tls-credentials.md create mode 100644 linkerd.io/content/2.17/tasks/automatically-rotating-webhook-tls-credentials.md create mode 100644 linkerd.io/content/2.17/tasks/books.md create mode 100644 linkerd.io/content/2.17/tasks/circuit-breakers.md create mode 100644 linkerd.io/content/2.17/tasks/configuring-dynamic-request-routing.md create mode 100644 linkerd.io/content/2.17/tasks/configuring-per-route-policy.md create mode 100644 linkerd.io/content/2.17/tasks/configuring-proxy-concurrency.md create mode 100644 linkerd.io/content/2.17/tasks/configuring-proxy-discovery-cache.md create mode 100644 linkerd.io/content/2.17/tasks/configuring-rate-limiting.md create mode 100644 linkerd.io/content/2.17/tasks/configuring-retries.md create mode 100644 linkerd.io/content/2.17/tasks/configuring-timeouts.md create mode 100644 linkerd.io/content/2.17/tasks/customize-install.md create mode 100644 linkerd.io/content/2.17/tasks/debugging-502s.md create mode 100644 linkerd.io/content/2.17/tasks/debugging-your-service.md create mode 100644 linkerd.io/content/2.17/tasks/distributed-tracing.md create mode 100644 linkerd.io/content/2.17/tasks/exporting-metrics.md create mode 100644 linkerd.io/content/2.17/tasks/exposing-dashboard.md create mode 100644 linkerd.io/content/2.17/tasks/extensions.md create mode 100644 linkerd.io/content/2.17/tasks/external-prometheus.md create mode 100644 linkerd.io/content/2.17/tasks/fault-injection.md create mode 100644 linkerd.io/content/2.17/tasks/federated-services.md create mode 100644 linkerd.io/content/2.17/tasks/flagger.md create mode 100644 linkerd.io/content/2.17/tasks/generate-certificates.md create mode 100644 linkerd.io/content/2.17/tasks/getting-per-route-metrics.md create mode 100644 linkerd.io/content/2.17/tasks/gitops.md create mode 100644 linkerd.io/content/2.17/tasks/graceful-shutdown.md create mode 100644 linkerd.io/content/2.17/tasks/grafana.md create mode 100644 linkerd.io/content/2.17/tasks/install-helm.md create mode 100644 linkerd.io/content/2.17/tasks/install.md create mode 100644 linkerd.io/content/2.17/tasks/installing-multicluster.md create mode 100644 linkerd.io/content/2.17/tasks/linkerd-smi.md create mode 100644 linkerd.io/content/2.17/tasks/managing-egress-traffic.md create mode 100644 linkerd.io/content/2.17/tasks/manually-rotating-control-plane-tls-credentials.md create mode 100644 linkerd.io/content/2.17/tasks/modifying-proxy-log-level.md create mode 100644 linkerd.io/content/2.17/tasks/multicluster-using-statefulsets.md create mode 100644 linkerd.io/content/2.17/tasks/multicluster.md create mode 100644 linkerd.io/content/2.17/tasks/per-request-policy.md create mode 100644 linkerd.io/content/2.17/tasks/pod-to-pod-multicluster.md create mode 100644 linkerd.io/content/2.17/tasks/replacing_expired_certificates.md create mode 100644 linkerd.io/content/2.17/tasks/restricting-access.md create mode 100644 linkerd.io/content/2.17/tasks/rotating_webhooks_certificates.md create mode 100644 linkerd.io/content/2.17/tasks/securing-linkerd-tap.md create mode 100644 linkerd.io/content/2.17/tasks/setting-up-service-profiles.md create mode 100644 linkerd.io/content/2.17/tasks/traffic-shifting.md create mode 100644 linkerd.io/content/2.17/tasks/troubleshooting.md create mode 100644 linkerd.io/content/2.17/tasks/uninstall-multicluster.md create mode 100644 linkerd.io/content/2.17/tasks/uninstall.md create mode 100644 linkerd.io/content/2.17/tasks/upgrade.md create mode 100644 linkerd.io/content/2.17/tasks/using-custom-domain.md create mode 100644 linkerd.io/content/2.17/tasks/using-debug-endpoints.md create mode 100644 linkerd.io/content/2.17/tasks/using-ingress.md create mode 100644 linkerd.io/content/2.17/tasks/using-psp.md create mode 100644 linkerd.io/content/2.17/tasks/using-the-debug-container.md create mode 100644 linkerd.io/content/2.17/tasks/validating-your-traffic.md create mode 100644 linkerd.io/data/cli/2-17.yaml diff --git a/linkerd.io/config/_default/menu.yaml b/linkerd.io/config/_default/menu.yaml index 53a883e833..9645e78ffb 100644 --- a/linkerd.io/config/_default/menu.yaml +++ b/linkerd.io/config/_default/menu.yaml @@ -39,6 +39,9 @@ docs: - name: Linkerd edge pageRef: /2-edge/ weight: 99 + - name: Linkerd 2.17 + pageRef: /2.17/ + weight: 17 - name: Linkerd 2.16 pageRef: /2.16/ weight: 16 diff --git a/linkerd.io/config/_default/params.yaml b/linkerd.io/config/_default/params.yaml index e28ac90b97..cf99272048 100644 --- a/linkerd.io/config/_default/params.yaml +++ b/linkerd.io/config/_default/params.yaml @@ -12,4 +12,4 @@ social: twitter: Linkerd # Latest major version of Linkerd -latestMajorVersion: "2.16" +latestMajorVersion: "2.17" diff --git a/linkerd.io/content/2-edge/features/egress.md b/linkerd.io/content/2-edge/features/egress.md index a9068acfae..d7734610ca 100644 --- a/linkerd.io/content/2-edge/features/egress.md +++ b/linkerd.io/content/2-edge/features/egress.md @@ -1,5 +1,6 @@ --- title: Egress +description: Linkerd features capabilities to monitor and apply policies to egress traffic. --- Linkerd features capabilities to monitor and apply policies to egress traffic. @@ -21,6 +22,6 @@ more comprehensive approach. Related content: -* [Guide: Managing egress traffic] - ({{< relref "../tasks/managing-egress-traffic" >}}) +* [Guide: Managing egress traffic]({{< relref + "../tasks/managing-egress-traffic" >}}) * [EgressNetwork Reference]({{< relref "../reference/egress-network" >}}) diff --git a/linkerd.io/content/2-edge/reference/egress-network.md b/linkerd.io/content/2-edge/reference/egress-network.md index 52b6e8a5e1..de4510ffa3 100644 --- a/linkerd.io/content/2-edge/reference/egress-network.md +++ b/linkerd.io/content/2-edge/reference/egress-network.md @@ -1,5 +1,6 @@ --- title: EgressNetwork +description: Reference guide to the EgressNetwork resource. --- Linkerd's [egress functionality]({{< relref "../features/egress">}}) allows diff --git a/linkerd.io/content/2.17/_index.md b/linkerd.io/content/2.17/_index.md new file mode 100644 index 0000000000..6c28dc82e3 --- /dev/null +++ b/linkerd.io/content/2.17/_index.md @@ -0,0 +1,11 @@ +--- +title: Docs +cascade: + type: docs + +# Redirect +type: _default +layout: redirect +params: + redirect: ./overview +--- diff --git a/linkerd.io/content/2.17/checks/index.md b/linkerd.io/content/2.17/checks/index.md new file mode 100644 index 0000000000..fc6ac87de5 --- /dev/null +++ b/linkerd.io/content/2.17/checks/index.md @@ -0,0 +1,10 @@ +--- +title: Checks + +# Redirect +type: _default +layout: redirect +params: + unlisted: true + redirect: /2/tasks/troubleshooting/ +--- diff --git a/linkerd.io/content/2.17/common-errors/_index.md b/linkerd.io/content/2.17/common-errors/_index.md new file mode 100644 index 0000000000..68771bf652 --- /dev/null +++ b/linkerd.io/content/2.17/common-errors/_index.md @@ -0,0 +1,21 @@ +--- +title: Common Errors +weight: 10 +sitemap: + priority: 1.0 +--- + +Linkerd is generally robust, but things can always go wrong! You'll find +information here about the most common things that cause people trouble. + +## When in Doubt, Start With `linkerd check` + +Whenever you see anything that looks unusual about your mesh, **always** start +with `linkerd check`. It will check a long series of things that have caused +trouble for others and make sure that your configuration is sane, and it will +point you to help for any problems it finds. It's hard to overstate how useful +this command is. + +## Common Errors + +{{< docs/section-toc >}} diff --git a/linkerd.io/content/2.17/common-errors/failfast.md b/linkerd.io/content/2.17/common-errors/failfast.md new file mode 100644 index 0000000000..ac3a4af6ce --- /dev/null +++ b/linkerd.io/content/2.17/common-errors/failfast.md @@ -0,0 +1,18 @@ +--- +title: Failfast +description: Failfast means that no endpoints are available. +--- + +If Linkerd reports that a given service is in the _failfast_ state, it +means that the proxy has determined that there are no available endpoints +for that service. In this situation there's no point in the proxy trying +to actually make a connection to the service - it already knows that it +can't talk to it - so it reports that the service is in failfast and +immediately returns an error from the proxy. + +The error will be either a 503 or a 504; see below for more information, +but if you already know that the service is in failfast because you saw +it in the logs, that's the important part. + +To get out of failfast, some endpoints for the service have to +become available. diff --git a/linkerd.io/content/2.17/common-errors/http-502.md b/linkerd.io/content/2.17/common-errors/http-502.md new file mode 100644 index 0000000000..1b42468938 --- /dev/null +++ b/linkerd.io/content/2.17/common-errors/http-502.md @@ -0,0 +1,11 @@ +--- +title: HTTP 502 Errors +description: HTTP 502 means connection errors between proxies. +--- + +The Linkerd proxy will return a 502 error for connection errors between +proxies. Unfortunately it's fairly common to see an uptick in 502s when +first meshing a workload that hasn't previously been used with a mesh, +because the mesh surfaces errors that were previously invisible! + +There's actually a whole page on [debugging 502s](../../tasks/debugging-502s/). diff --git a/linkerd.io/content/2.17/common-errors/http-503-504.md b/linkerd.io/content/2.17/common-errors/http-503-504.md new file mode 100644 index 0000000000..17c8f659d8 --- /dev/null +++ b/linkerd.io/content/2.17/common-errors/http-503-504.md @@ -0,0 +1,27 @@ +--- +title: HTTP 503 and 504 Errors +description: HTTP 503 and 504 mean overloaded workloads. +--- + +503s and 504s show up when a Linkerd proxy is trying to make so many +requests to a workload that it gets overwhelmed. + +When the workload next to a proxy makes a request, the proxy adds it +to an internal dispatch queue. When things are going smoothly, the +request is pulled from the queue and dispatched almost immediately. +If the queue gets too long, though (which can generally happen only +if the called service is slow to respond), the proxy will go into +_load-shedding_, where any new request gets an immediate 503. The +proxy can only get _out_ of load-shedding when the queue shrinks. + +Failfast also plays a role here: if the proxy puts a service into +failfast while there are requests in the dispatch queue, all the +requests in the dispatch queue get an immediate 504 before the +proxy goes into load-shedding. + +To get out of failfast, some endpoints for the service have to +become available. + +To get out of load-shedding, the dispatch queue has to start +emptying, which implies that the service has to get more capacity +to process requests or that the incoming request rate has to drop. diff --git a/linkerd.io/content/2.17/common-errors/protocol-detection.md b/linkerd.io/content/2.17/common-errors/protocol-detection.md new file mode 100644 index 0000000000..4a366e5a4b --- /dev/null +++ b/linkerd.io/content/2.17/common-errors/protocol-detection.md @@ -0,0 +1,36 @@ +--- +title: Protocol Detection Errors +description: Protocol detection errors indicate that Linkerd doesn't understand the + protocol in use. +--- + +Linkerd is capable of proxying all TCP traffic, including TLS connections, +WebSockets, and HTTP tunneling. In most cases where the client speaks first +when a new connection is made, Linkerd can detect the protocol in use, +allowing it to perform per-request routing and metrics. + +If your proxy logs contain messages like `protocol detection timed out after +10s`, or you're experiencing 10-second delays when establishing connections, +you're probably running a situation where Linkerd cannot detect the protocol. +This is most common for protocols where the server speaks first, and the +client is waiting for information from the server. It may also occur with +non-HTTP protocols for which Linkerd doesn't yet understand the wire format of +a request. + +You'll need to understand exactly what the situation is to fix this: + +- A server-speaks-first protocol will probably need to be configured as a + `skip` or `opaque` port, as described in the [protocol detection + documentation](../../features/protocol-detection/#configuring-protocol-detection). + +- If you're seeing transient protocol detection timeouts, this is more likely + to indicate a misbehaving workload. + +- If you know the protocol is client-speaks-first but you're getting + consistent protocol detection timeouts, you'll probably need to fall back on + a `skip` or `opaque` port. + +Note that marking ports as `skip` or `opaque` has ramifications beyond +protocol detection timeouts; see the [protocol detection +documentation](../../features/protocol-detection/#configuring-protocol-detection) +for more information. diff --git a/linkerd.io/content/2.17/features/_index.md b/linkerd.io/content/2.17/features/_index.md new file mode 100644 index 0000000000..5cac0e9ec3 --- /dev/null +++ b/linkerd.io/content/2.17/features/_index.md @@ -0,0 +1,14 @@ +--- +title: Features +weight: 3 +sitemap: + priority: 1.0 +--- + +Linkerd offers many features, outlined below. For our walkthroughs and guides, +please see the [Linkerd task docs]({{< relref "../tasks" >}}). For a reference, +see the [Linkerd reference docs]({{< relref "../reference" >}}). + +## Linkerd's features + +{{< docs/section-toc >}} diff --git a/linkerd.io/content/2.17/features/access-logging.md b/linkerd.io/content/2.17/features/access-logging.md new file mode 100644 index 0000000000..795af3e273 --- /dev/null +++ b/linkerd.io/content/2.17/features/access-logging.md @@ -0,0 +1,62 @@ +--- +title: HTTP Access Logging +description: Linkerd proxies can be configured to emit HTTP access logs. +--- + +Linkerd proxies can be configured to generate an HTTP access log that records +all HTTP requests that transit the proxy. + +The `config.linkerd.io/access-log` annotation is used to enable proxy HTTP +access logging. Adding this annotation to a namespace or workload configures the +proxy injector to set an environment variable in the proxy container that +configures access logging. + +HTTP access logging is disabled by default because it has a performance impact, +compared to proxies without access logging enabled. Enabling access logging may +increase tail latency and CPU consumption under load. The severity of +this performance cost may vary depending on the traffic being proxied, and may +be acceptable in some environments. + +{{< note >}} +The proxy's HTTP access log is distinct from proxy debug logging, which is +configured separately. See the documentation on [modifying the proxy log +level](../../tasks/modifying-proxy-log-level/) for details on configuring the +proxy's debug logging. +{{< /note >}} + +## Access Log Formats + +The value of the `config.linkerd.io/access-log` annotation determines the format +of HTTP access log entries, and can be either "apache" or "json". + +Setting the `config.linkerd.io/access-log: "apache"` annotation configures the +proxy to emit HTTP access logs in the [Apache Common Log +Format](https://en.wikipedia.org/wiki/Common_Log_Format). For example: + +```text {class=disable-copy} +10.42.0.63:51160 traffic.booksapp.serviceaccount.identity.linkerd.cluster.local - [2022-08-23T20:28:20.071809491Z] "GET http://webapp:7000/ HTTP/2.0" 200 +10.42.0.63:51160 traffic.booksapp.serviceaccount.identity.linkerd.cluster.local - [2022-08-23T20:28:20.187706137Z] "POST http://webapp:7000/authors HTTP/2.0" 303 +10.42.0.63:51160 traffic.booksapp.serviceaccount.identity.linkerd.cluster.local - [2022-08-23T20:28:20.301798187Z] "GET http://webapp:7000/authors/104 HTTP/2.0" 200 +10.42.0.63:51160 traffic.booksapp.serviceaccount.identity.linkerd.cluster.local - [2022-08-23T20:28:20.409177224Z] "POST http://webapp:7000/books HTTP/2.0" 303 +10.42.0.1:43682 - - [2022-08-23T20:28:23.049685223Z] "GET /ping HTTP/1.1" 200 +``` + +Setting the `config.linkerd.io/access-log: json` annotation configures the proxy +to emit access logs in a JSON format. For example: + +```json {class=disable-copy} +{"client.addr":"10.42.0.70:32996","client.id":"traffic.booksapp.serviceaccount.identity.linkerd.cluster.local","host":"webapp:7000","method":"GET","processing_ns":"39826","request_bytes":"","response_bytes":"19627","status":200,"timestamp":"2022-08-23T20:33:42.321746212Z","total_ns":"14441135","trace_id":"","uri":"http://webapp:7000/","user_agent":"Go-http-client/1.1","version":"HTTP/2.0"} +{"client.addr":"10.42.0.70:32996","client.id":"traffic.booksapp.serviceaccount.identity.linkerd.cluster.local","host":"webapp:7000","method":"POST","processing_ns":"30036","request_bytes":"33","response_bytes":"0","status":303,"timestamp":"2022-08-23T20:33:42.436964052Z","total_ns":"14122403","trace_id":"","uri":"http://webapp:7000/authors","user_agent":"Go-http-client/1.1","version":"HTTP/2.0"} +{"client.addr":"10.42.0.70:32996","client.id":"traffic.booksapp.serviceaccount.identity.linkerd.cluster.local","host":"webapp:7000","method":"GET","processing_ns":"38664","request_bytes":"","response_bytes":"2350","status":200,"timestamp":"2022-08-23T20:33:42.551768300Z","total_ns":"6998222","trace_id":"","uri":"http://webapp:7000/authors/105","user_agent":"Go-http-client/1.1","version":"HTTP/2.0"} +{"client.addr":"10.42.0.70:32996","client.id":"traffic.booksapp.serviceaccount.identity.linkerd.cluster.local","host":"webapp:7000","method":"POST","processing_ns":"42492","request_bytes":"46","response_bytes":"0","status":303,"timestamp":"2022-08-23T20:33:42.659401621Z","total_ns":"9274163","trace_id":"","uri":"http://webapp:7000/books","user_agent":"Go-http-client/1.1","version":"HTTP/2.0"} +{"client.addr":"10.42.0.1:56300","client.id":"-","host":"10.42.0.69:7000","method":"GET","processing_ns":"35848","request_bytes":"","response_bytes":"4","status":200,"timestamp":"2022-08-23T20:33:49.254262428Z","total_ns":"1416066","trace_id":"","uri":"/ping","user_agent":"kube-probe/1.24","version":"HTTP/1.1"} +``` + +## Consuming Access Logs + +The HTTP access log is written to the proxy container's `stderr` stream, while +the proxy's standard debug logging is written to the proxy container's `stdout` +stream. Currently, the `kubectl logs` command will always output both the +container's `stdout` and `stderr` streams. However, [KEP +3289](https://github.com/kubernetes/enhancements/pull/3289) will add support for +separating a container's `stdout` or `stderr` in the `kubectl logs` command. diff --git a/linkerd.io/content/2.17/features/automatic-mtls.md b/linkerd.io/content/2.17/features/automatic-mtls.md new file mode 100644 index 0000000000..2513dc0a0e --- /dev/null +++ b/linkerd.io/content/2.17/features/automatic-mtls.md @@ -0,0 +1,154 @@ +--- +title: Automatic mTLS +description: Linkerd automatically enables mutual Transport Layer Security (TLS) for all communication between meshed applications. +weight: 4 +params: + faqSchema: + - question: What traffic can Linkerd automatically mTLS? + answer: |- + Linkerd transparently applies mTLS to all TCP communication between + meshed pods. However, there are still ways in which you may still have + non-mTLS traffic in your system, including traffic to or from non-meshed + pods (e.g. Kubernetes healthchecks), and traffic on ports that were + marked as skip ports, which bypass the proxy entirely. + - question: How does Linkerd's mTLS implementation work? + answer: |- + The Linkerd control plane contains a certificate authority (CA) + called "identity". This CA issues TLS certificates to each Linkerd data + plane proxy. Each certificate is bound to the Kubernetes ServiceAccount + of the containing pod. These TLS certificates expire after 24 hours and + are automatically rotated. The proxies use these certificates to encrypt + and authenticate TCP traffic to other proxies. + - question: What is mTLS? + answer: |- + mTLS, or mutual TLS, is simply "regular TLS" with the extra + stipulation that the client is also authenticated. TLS guarantees + authenticity, but by default this only happens in one direction--the + client authenticates the server but the server doesn’t authenticate the + client. mTLS makes the authenticity symmetric. +--- + +By default, Linkerd automatically enables mutually-authenticated Transport +Layer Security (mTLS) for all TCP traffic between meshed pods. This means that +Linkerd adds authenticated, encrypted communication to your application with +no extra work on your part. (And because the Linkerd control plane also runs +on the data plane, this means that communication between Linkerd's control +plane components are also automatically secured via mTLS.) + +See [Caveats and future work](#caveats-and-future-work) below for some details. + +## What is mTLS? + +mTLS, or mutual TLS, is simply "regular TLS" with the extra stipulation that +the client is also authenticated. TLS guarantees authenticity, but by default +this only happens in one direction--the client authenticates the server but the +server doesn’t authenticate the client. mTLS makes the authenticity symmetric. + +mTLS is a large topic. For a broad overview of what mTLS is and how it works in +Kuberentes clusters, we suggest reading through [A Kubernetes engineer's guide +to mTLS](https://buoyant.io/mtls-guide/). + +## Which traffic can Linkerd automatically mTLS? + +Linkerd transparently applies mTLS to all TCP communication between meshed +pods. However, there are still ways in which you may still have non-mTLS +traffic in your system, including: + +* Traffic to or from non-meshed pods (e.g. Kubernetes healthchecks) +* Traffic on ports that were marked as [skip ports](../protocol-detection/), + which bypass the proxy entirely. + +You can [verify which traffic is mTLS'd](../../tasks/validating-your-traffic/) +in a variety of ways. External systems such as [Buoyant +Cloud](https://buoyant.io/cloud) can also automatically generate reports of TLS +traffic patterns on your cluster. + +## Operational concerns + +Linkerd's mTLS requires some preparation for production use, especially for +long-lived clusters or clusters that expect to have cross-cluster traffic. + +The trust anchor generated by the default `linkerd install` CLI command expires +after 365 days. After that, it must be [manually +rotated](../../tasks/manually-rotating-control-plane-tls-credentials/)—a +non-trivial task. Alternatively, you can [provide the trust anchor +yourself](../../tasks/generate-certificates/) and control the expiration date, +e.g. setting it to 10 years rather than one year. + +Kubernetes clusters that make use of Linkerd's [multi-cluster +communication](../multicluster/) must share a trust anchor. Thus, the default +`linkerd install` setup will not work for this situation and you must provide +an explicit trust anchor. + +Similarly, the default cluster issuer certificate and key expire after a year. +These must be [rotated before they +expire](../../tasks/manually-rotating-control-plane-tls-credentials/). +Alternatively, you can [set up automatic rotation with +`cert-manager`](../../tasks/automatically-rotating-control-plane-tls-credentials/). + +External systems such as [Buoyant Cloud](https://buoyant.io/cloud) can be used +to monitor cluster credentials and to send reminders if they are close to +expiration. + +## How does Linkerd's mTLS implementation work? + +The [Linkerd control plane](../../reference/architecture/) contains a certificate +authority (CA) called `identity`. This CA issues TLS certificates to each +Linkerd data plane proxy. Each certificate is bound to the [Kubernetes +ServiceAccount](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) +identity of the containing pod. These TLS certificates expire after 24 hours +and are automatically rotated. The proxies use these certificates to encrypt +and authenticate TCP traffic to other proxies. + +On the control plane side, Linkerd maintains a set of credentials in the +cluster: a trust anchor, and an issuer certificate and private key. These +credentials can be generated by Linkerd during install time, or optionally +provided by an external source, e.g. [Vault](https://vaultproject.io) or +[cert-manager](https://github.com/jetstack/cert-manager). The issuer +certificate and private key are stored in a [Kubernetes +Secret](https://kubernetes.io/docs/concepts/configuration/secret/); this Secret +is placed in the `linkerd` namespace and can only be read by the service +account used by the [Linkerd control plane](../../reference/architecture/)'s +`identity` component. + +On the data plane side, each proxy is passed the trust anchor in an environment +variable. At startup, the proxy generates a private key, stored in a [tmpfs +emptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) which +stays in memory and never leaves the pod. The proxy connects to the control +plane's `identity` component, validating the connection to `identity` with the +trust anchor, and issues a [certificate signing request +(CSR)](https://en.wikipedia.org/wiki/Certificate_signing_request). The CSR +contains an initial certificate with identity set to the pod's [Kubernetes +ServiceAccount](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/), +and the actual service account token, so that `identity` can validate that the +CSR is valid. After validation, the signed trust bundle is returned to the +proxy, which can use it as both a client and server certificate. These +certificates are scoped to 24 hours and dynamically refreshed using the same +mechanism. + +Finally, when a proxy receives an outbound connection from the application +container within its pod, it looks up that destination with the Linkerd control +plane. If it's in the Kubernetes cluster, the control plane provides the proxy +with the destination's endpoint addresses, along with metadata including an +identity name. When the proxy connects to the destination, it initiates a TLS +handshake and verifies that that the destination proxy's certificate is signed +by the trust anchor and contains the expected identity. + +## TLS protocol parameters + +Linkerd currently uses the following TLS protocol parameters for mTLS +connections, although they may change in future versions: + +* TLS version 1.3 +* Cipher suite `TLS_CHACHA20_POLY1305_SHA256` as specified in [RFC + 8446](https://www.rfc-editor.org/rfc/rfc8446#section-9.1). + +## Caveats and future work + +* Linkerd does not *require* mTLS unless [authorization policies](../server-policy/) + are configured. + +* Ideally, the ServiceAccount token that Linkerd uses would not be shared with + other potential uses of that token. In future Kubernetes releases, Kubernetes + will support audience/time-bound ServiceAccount tokens, and Linkerd will use + those instead. diff --git a/linkerd.io/content/2.17/features/cni.md b/linkerd.io/content/2.17/features/cni.md new file mode 100644 index 0000000000..d944a4dc60 --- /dev/null +++ b/linkerd.io/content/2.17/features/cni.md @@ -0,0 +1,137 @@ +--- +title: CNI Plugin +description: Linkerd can optionally use a CNI plugin instead of an init-container + to avoid NET_ADMIN capabilities. +--- + +Linkerd's data plane works by transparently routing all TCP traffic to and from +every meshed pod to its proxy. (See the +[Architecture](../../reference/architecture/) doc.) This allows Linkerd to act +without the application being aware. + +By default, this rewiring is done with an [Init +Container](../../reference/architecture/#linkerd-init-container) that uses +iptables to install routing rules for the pod, at pod startup time. However, +this requires the `CAP_NET_ADMIN` capability; and in some clusters, this +capability is not granted to pods. + +To handle this, Linkerd can optionally run these iptables rules in a [CNI +plugin](https://kubernetes.io/docs/concepts/extend-kubernetes/compute-storage-net/network-plugins/) +rather than in an Init Container. This avoids the need for a `CAP_NET_ADMIN` +capability. + +{{< note >}} +Linkerd's CNI plugin is designed to run in conjunction with your existing CNI +plugin, using _CNI chaining_. It handles only the Linkerd-specific +configuration and does not replace the need for a CNI plugin. +{{< /note >}} + +{{< note >}} +If you're installing Linkerd's CNI plugin on top of Cilium, make sure to install +the latter with the option `cni.exclusive=false`, so Cilium doesn't take +ownership over the CNI configurations directory, and allows other plugins to +deploy their configurations there. +{{< /note >}} + +## Installation + +Usage of the Linkerd CNI plugin requires that the `linkerd-cni` DaemonSet be +successfully installed on your cluster _first_, before installing the Linkerd +control plane. + +### Using the CLI + +To install the `linkerd-cni` DaemonSet, run: + +```bash +linkerd install-cni | kubectl apply -f - +``` + +Once the DaemonSet is up and running, meshed pods should no longer use the +`linkerd-init` Init Container. To accomplish this, use the +`--linkerd-cni-enabled` flag when installing the control plane: + +```bash +linkerd install --linkerd-cni-enabled | kubectl apply -f - +``` + +Using this option will set a `cniEnabled` flag in the `linkerd-config` +ConfigMap. Proxy injections will read this field and omit the `linkerd-init` +Init Container. + +### Using Helm + +First ensure that your Helm local cache is updated: + +```bash +helm repo update +helm search repo linkerd2-cni +``` + +Install the CNI DaemonSet: + +```bash +# install the CNI plugin first +helm install linkerd-cni -n linkerd-cni --create-namespace linkerd/linkerd2-cni + +# ensure the plugin is installed and ready +linkerd check --pre --linkerd-cni-enabled +``` + +At that point you are ready to install Linkerd with CNI enabled. Follow the +[Installing Linkerd with Helm](../../tasks/install-helm/) instructions. + +## Additional configuration + +The `linkerd install-cni` command includes additional flags that you can use to +customize the installation. See `linkerd install-cni --help` for more +information. Note that many of the flags are similar to the flags that can be +used to configure the proxy when running `linkerd inject`. If you change a +default when running `linkerd install-cni`, you will want to ensure that you +make a corresponding change when running `linkerd inject`. + +The most important flags are: + +1. `--dest-cni-net-dir`: This is the directory on the node where the CNI + Configuration resides. It defaults to: `/etc/cni/net.d`. +2. `--dest-cni-bin-dir`: This is the directory on the node where the CNI Plugin + binaries reside. It defaults to: `/opt/cni/bin`. +3. `--cni-log-level`: Setting this to `debug` will allow more verbose logging. + In order to view the CNI Plugin logs, you must be able to see the `kubelet` + logs. One way to do this is to log onto the node and use + `journalctl -t kubelet`. The string `linkerd-cni:` can be used as a search to + find the plugin log output. + +### Allowing initContainer networking + +When using the Linkerd CNI plugin the required `iptables` rules are in effect +before the pod is scheduled. Also, the `linkerd-proxy` is not started until +after all `initContainers` have completed. This means no `initContainer` will +have network access because its packets will be caught by `iptables` and the +`linkerd-proxy` will not yet be available. + +It is possible to bypass these `iptables` rules by running the `initContainer` +as the UID of the proxy (by default `2102`). Processes run as this UID are +skipped by `iptables` and allow direct network connectivity. These network +connections are not meshed. + +The following is a snippet for an `initContainer` configured to allow unmeshed +networking while using the CNI plugin: + +```yaml +initContainers: +- name: example + image: example + securityContext: + runAsUser: 2102 # Allows skipping iptables rules +``` + +## Upgrading the CNI plugin + +Since the CNI plugin is basically stateless, there is no need for a separate +`upgrade` command. If you are using the CLI to upgrade the CNI plugin you can +just do: + +```bash +linkerd install-cni | kubectl apply --prune -l linkerd.io/cni-resource=true -f - +``` diff --git a/linkerd.io/content/2.17/features/dashboard.md b/linkerd.io/content/2.17/features/dashboard.md new file mode 100644 index 0000000000..25dfbec517 --- /dev/null +++ b/linkerd.io/content/2.17/features/dashboard.md @@ -0,0 +1,105 @@ +--- +title: Dashboard and on-cluster metrics stack +description: Linkerd provides a full on-cluster metrics stack, including CLI tools + and dashboards. +--- + +Linkerd provides a full on-cluster metrics stack, including CLI tools and a web +dashboard. + +To access this functionality, install the viz extension: + +```bash +linkerd viz install | kubectl apply -f - +``` + +This extension installs the following components into your `linkerd-viz` +namespace: + +* A [Prometheus](https://prometheus.io/) instance +* metrics-api, tap, tap-injector, and web components + +These components work together to provide an on-cluster metrics stack. + +{{< note >}} +To limit excessive resource usage on the cluster, the metrics stored by this +extension are _transient_. Only the past 6 hours are stored, and metrics do not +persist in the event of pod restart or node outages. This may not be suitable +for production use. +{{< /note >}} + +{{< note >}} +This metrics stack may require significant cluster resources. Prometheus, in +particular, will consume resources as a function of traffic volume within the +cluster. +{{< /note >}} + +## Linkerd dashboard + +The Linkerd dashboard provides a high level view of what is happening with your +services in real time. It can be used to view "golden metrics" (success rate, +requests/second and latency), visualize service dependencies and understand the +health of specific service routes. + +One way to pull it up is by running `linkerd viz dashboard` from the command +line. + +![Top Line Metrics](/docs/images/architecture/stat.png "Top Line Metrics") + +## Grafana + +In earlier versions of Linkerd, the viz extension also pre-installed a Grafana +dashboard. As of Linkerd 2.12, due to licensing changes in Grafana, this is no +longer the case. However, you can still install Grafana on your own—see the +[Grafana docs](../../tasks/grafana/) for instructions on how to create the +Grafana dashboards. + +## Examples + +In these examples, we assume you've installed the emojivoto example application. +Please refer to the [Getting Started Guide](../../getting-started/) for how to +do this. + +You can use your dashboard extension and see all the services in the demo app. +Since the demo app comes with a load generator, we can see live traffic metrics +by running: + +```bash +linkerd -n emojivoto viz stat deploy +``` + +This will show the "golden" metrics for each deployment: + +* Success rates +* Request rates +* Latency distribution percentiles + +To dig in a little further, it is possible to use `top` to get a real-time +view of which paths are being called: + +```bash +linkerd -n emojivoto viz top deploy +``` + +To go even deeper, we can use `tap` shows the stream of requests across a +single pod, deployment, or even everything in the emojivoto namespace: + +```bash +linkerd -n emojivoto viz tap deploy/web +``` + +All of this functionality is also available in the dashboard, if you would like +to use your browser instead: + +![Top Line Metrics](/docs/images/getting-started/stat.png "Top Line Metrics") + +![Deployment Detail](/docs/images/getting-started/inbound-outbound.png "Deployment Detail") + +![Top](/docs/images/getting-started/top.png "Top") + +![Tap](/docs/images/getting-started/tap.png "Tap") + +## Futher reading + +See [Exporting metrics](../../tasks/exporting-metrics/) for alternative ways +to consume Linkerd's metrics. diff --git a/linkerd.io/content/2.17/features/distributed-tracing.md b/linkerd.io/content/2.17/features/distributed-tracing.md new file mode 100644 index 0000000000..304dec3603 --- /dev/null +++ b/linkerd.io/content/2.17/features/distributed-tracing.md @@ -0,0 +1,55 @@ +--- +title: Distributed Tracing +description: You can enable distributed tracing support in Linkerd. +--- + +Tracing can be an invaluable tool in debugging distributed systems performance, +especially for identifying bottlenecks and understanding the latency cost of +each component in your system. Linkerd can be configured to emit trace spans +from the proxies, allowing you to see exactly what time requests and responses +spend inside. + +Unlike most of the features of Linkerd, distributed tracing requires both code +changes and configuration. (You can read up on [Distributed tracing in the +service mesh: four myths](/2019/08/09/service-mesh-distributed-tracing-myths/) +for why this is.) + +Furthermore, Linkerd provides many of the features that are often associated +with distributed tracing, *without* requiring configuration or application +changes, including: + +* Live service topology and dependency graphs +* Aggregated service health, latencies, and request volumes +* Aggregated path / route health, latencies, and request volumes + +For example, Linkerd can display a live topology of all incoming and outgoing +dependencies for a service, without requiring distributed tracing or any other +such application modification: + +![The Linkerd dashboard showing an automatically generated topology graph](/docs/images/books/webapp-detail.png "The Linkerd dashboard showing an automatically generated topology graph") + +Likewise, Linkerd can provide golden metrics per service and per *route*, again +without requiring distributed tracing or any other such application +modification: + +![Linkerd dashboard showing an automatically generated route metrics](/docs/images/books/webapp-routes.png "Linkerd dashboard showing an automatically generated route metrics") + +## Using distributed tracing + +That said, distributed tracing certainly has its uses, and Linkerd makes this +as easy as it can. Linkerd's role in distributed tracing is actually quite +simple: when a Linkerd data plane proxy sees a tracing header in a proxied HTTP +request, Linkerd will emit a trace span for that request. This span will +include information about the exact amount of time spent in the Linkerd proxy. +When paired with software to collect, store, and analyze this information, this +can provide significant insight into the behavior of the mesh. + +To use this feature, you'll also need to introduce several additional +components in your system., including an ingress layer that kicks off the trace +on particular requests, a client library for your application (or a mechanism +to propagate trace headers), a trace collector to collect span data and turn +them into traces, and a trace backend to store the trace data and allow the +user to view/query it. + +For details, please see our [guide to adding distributed tracing to your +application with Linkerd](../../tasks/distributed-tracing/). diff --git a/linkerd.io/content/2.17/features/egress.md b/linkerd.io/content/2.17/features/egress.md new file mode 100644 index 0000000000..d7734610ca --- /dev/null +++ b/linkerd.io/content/2.17/features/egress.md @@ -0,0 +1,27 @@ +--- +title: Egress +description: Linkerd features capabilities to monitor and apply policies to egress traffic. +--- + +Linkerd features capabilities to monitor and apply policies to egress traffic. +This allows cluster operators to make use of the `EgressNetwork` CRD to classify +and visualize traffic. This CRD can be used as a parent reference for +Gateway API route primitives in order to enable policy and routing configuration. +Linkerd's egress control is implemented in the sidecar proxy itself; separate +egress gateways are not required (though they can be supported). + +{{< warning >}} + +No service mesh can provide a strong security guarantee about egress traffic +by itself; for example, a malicious actor could bypass the Linkerd sidecar - +and thus Linkerd's egress controls - entirely. Fully restricting egress +traffic in the presence of arbitrary applications thus typically requires a +more comprehensive approach. + +{{< /warning >}} + +Related content: + +* [Guide: Managing egress traffic]({{< relref + "../tasks/managing-egress-traffic" >}}) +* [EgressNetwork Reference]({{< relref "../reference/egress-network" >}}) diff --git a/linkerd.io/content/2.17/features/fault-injection.md b/linkerd.io/content/2.17/features/fault-injection.md new file mode 100644 index 0000000000..78d31f9bfc --- /dev/null +++ b/linkerd.io/content/2.17/features/fault-injection.md @@ -0,0 +1,13 @@ +--- +title: Fault Injection +description: Linkerd provides mechanisms to programmatically inject failures into + services. +--- + +Fault injection is a form of chaos engineering where the error rate of a service +is artificially increased to see what impact there is on the system as a whole. +Traditionally, this would require modifying the service's code to add a fault +injection library that would be doing the actual work. Linkerd can do this +without any service code changes, only requiring a little configuration. + +To inject faults into your own services, follow the [tutorial](../../tasks/fault-injection/). diff --git a/linkerd.io/content/2.17/features/ha.md b/linkerd.io/content/2.17/features/ha.md new file mode 100644 index 0000000000..6c33602ec1 --- /dev/null +++ b/linkerd.io/content/2.17/features/ha.md @@ -0,0 +1,139 @@ +--- +title: High Availability +description: The Linkerd control plane can run in high availability (HA) mode. +--- + +For production workloads, Linkerd's control plane can run in high availability +(HA) mode. This mode: + +* Runs three replicas of critical control plane components. +* Sets production-ready CPU and memory resource requests on control plane + components. +* Sets production-ready CPU and memory resource requests on data plane proxies +* *Requires* that the [proxy auto-injector](../proxy-injection/) be + functional for any pods to be scheduled. +* Sets [anti-affinity + policies](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity) + on critical control plane components to ensure, if possible, that they are + scheduled on separate nodes and in separate zones by default. + +## Enabling HA + +You can enable HA mode at control plane installation time with the `--ha` flag: + +```bash +linkerd install --ha | kubectl apply -f - +``` + +Also note the Viz extension also supports an `--ha` flag with similar +characteristics: + +```bash +linkerd viz install --ha | kubectl apply -f - +``` + +You can override certain aspects of the HA behavior at installation time by +passing other flags to the `install` command. For example, you can override the +number of replicas for critical components with the `--controller-replicas` +flag: + +```bash +linkerd install --ha --controller-replicas=2 | kubectl apply -f - +``` + +See the full [`install` CLI documentation](../../reference/cli/install/) for +reference. + +The `linkerd upgrade` command can be used to enable HA mode on an existing +control plane: + +```bash +linkerd upgrade --ha | kubectl apply -f - +``` + +## Proxy injector failure policy + +The HA proxy injector is deployed with a stricter failure policy to enforce +[automatic proxy injection](../proxy-injection/). This setup ensures +that no annotated workloads are accidentally scheduled to run on your cluster, +without the Linkerd proxy. (This can happen when the proxy injector is down.) + +If proxy injection process failed due to unrecognized or timeout errors during +the admission phase, the workload admission will be rejected by the Kubernetes +API server, and the deployment will fail. + +Hence, it is very important that there is always at least one healthy replica +of the proxy injector running on your cluster. + +If you cannot guarantee the number of healthy proxy injector on your cluster, +you can loosen the webhook failure policy by setting its value to `Ignore`, as +seen in the +[Linkerd Helm chart](https://github.com/linkerd/linkerd2/blob/803511d77b33bd9250b4a7fecd36752fcbd715ac/charts/linkerd2/templates/proxy-injector-rbac.yaml#L98). + +{{< note >}} +See the Kubernetes +[documentation](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy) +for more information on the admission webhook failure policy. +{{< /note >}} + +## Pod anti-affinity rules + +All critical control plane components are deployed with pod anti-affinity rules +to ensure redundancy. + +Linkerd uses a `requiredDuringSchedulingIgnoredDuringExecution` pod +anti-affinity rule to ensure that the Kubernetes scheduler does not colocate +replicas of critical component on the same node. A +`preferredDuringSchedulingIgnoredDuringExecution` pod anti-affinity rule is also +added to try to schedule replicas in different zones, where possible. + +In order to satisfy these anti-affinity rules, HA mode assumes that there +are always at least three nodes in the Kubernetes cluster. If this assumption is +violated (e.g. the cluster is scaled down to two or fewer nodes), then the +system may be left in a non-functional state. + +Note that these anti-affinity rules don't apply to add-on components like +Prometheus. + +## Scaling Prometheus + +The Linkerd Viz extension provides a pre-configured Prometheus pod, but for +production workloads we recommend setting up your own Prometheus instance. To +scrape the data plane metrics, follow the instructions +[here](../../tasks/external-prometheus/). This will provide you +with more control over resource requirement, backup strategy and data retention. + +When planning for memory capacity to store Linkerd timeseries data, the usual +guidance is 5MB per meshed pod. + +If your Prometheus is experiencing regular `OOMKilled` events due to the amount +of data coming from the data plane, the two key parameters that can be adjusted +are: + +* `storage.tsdb.retention.time` defines how long to retain samples in storage. + A higher value implies that more memory is required to keep the data around + for a longer period of time. Lowering this value will reduce the number of + `OOMKilled` events as data is retained for a shorter period of time +* `storage.tsdb.retention.size` defines the maximum number of bytes that can be + stored for blocks. A lower value will also help to reduce the number of + `OOMKilled` events + +For more information and other supported storage options, see the Prometheus +documentation +[here](https://prometheus.io/docs/prometheus/latest/storage/#operational-aspects). + +## Working with Cluster AutoScaler + +The Linkerd proxy stores its mTLS private key in a +[tmpfs emptyDir](https://kubernetes.io/docs/concepts/storage/volumes/#emptydir) +volume to ensure that this information never leaves the pod. This causes the +default setup of Cluster AutoScaler to not be able to scale down nodes with +injected workload replicas. + +The workaround is to annotate the injected workload with the +`cluster-autoscaler.kubernetes.io/safe-to-evict: "true"` annotation. If you +have full control over the Cluster AutoScaler configuration, you can start the +Cluster AutoScaler with the `--skip-nodes-with-local-storage=false` option. + +For more information on this, see the Cluster AutoScaler documentation +[here](https://github.com/kubernetes/autoscaler/blob/master/cluster-autoscaler/FAQ.md#what-types-of-pods-can-prevent-ca-from-removing-a-node). diff --git a/linkerd.io/content/2.17/features/http-grpc.md b/linkerd.io/content/2.17/features/http-grpc.md new file mode 100644 index 0000000000..928498e795 --- /dev/null +++ b/linkerd.io/content/2.17/features/http-grpc.md @@ -0,0 +1,22 @@ +--- +title: HTTP, HTTP/2, and gRPC Proxying +description: Linkerd will automatically enable advanced features (including metrics, + load balancing, retries, and more) for HTTP, HTTP/2, and gRPC connections. +weight: 1 +--- + +Linkerd can proxy all TCP connections. For HTTP connections (including HTTP/1.0, +HTTP/1.1, HTTP/2, and gRPC connections), it will automatically enable advanced +L7 features including [request-level metrics](../telemetry/), [latency-aware +load balancing](../load-balancing/), [retries](../retries-and-timeouts/), and +more. + +(See [TCP Proxying and Protocol Detection](../protocol-detection/) for details of +how this detection happens automatically, and how it can sometimes fail.) + +Note that while Linkerd does [zero-config mutual TLS](../automatic-mtls/), it +cannot decrypt TLS connections initiated by the outside world. For example, if +you have a TLS connection from outside the cluster, or if your application does +HTTP/2 plus TLS, Linkerd will treat these connections as raw TCP streams. To +take advantage of Linkerd's full array of L7 features, communication between +meshed pods must be TLS'd by Linkerd, not by the application itself. diff --git a/linkerd.io/content/2.17/features/httproute.md b/linkerd.io/content/2.17/features/httproute.md new file mode 100644 index 0000000000..199b6f7ea6 --- /dev/null +++ b/linkerd.io/content/2.17/features/httproute.md @@ -0,0 +1,81 @@ +--- +title: HTTPRoutes +description: Linkerd can use the HTTPRoute resource to configure per-route policies. +--- + +To configure routing behavior and policy for HTTP traffic, Linkerd supports the +[HTTPRoute resource], defined by the Kubernetes [Gateway API]. + +{{< note >}} +Two versions of the HTTPRoute resource may be used with Linkerd: + +- The upstream version provided by the Gateway API, with the + `gateway.networking.k8s.io` API group +- A Linkerd-specific CRD provided by Linkerd, with the `policy.linkerd.io` API + group + +The two HTTPRoute resource definitions are similar, but the Linkerd version +implements experimental features not yet available with the upstream Gateway API +resource definition. See [the HTTPRoute reference +documentation](../../reference/httproute/#linkerd-and-gateway-api-httproutes) +for details. +{{< /note >}} + +If the Gateway API CRDs already exist in your cluster, then Linkerd must be +installed with the `--set enableHttpRoutes=false` flag during the +`linkerd install --crds` step or with the `enableHttpRoutes=false` Helm value +when installing the `linkerd-crds` Helm chart. This avoid conflicts by +instructing Linkerd to not install the Gateway API CRDs and instead rely on the +Gateway CRDs which already exist. + +An HTTPRoute is a Kubernetes resource which attaches to a parent resource, such +as a [Service]. The HTTPRoute defines a set of rules which match HTTP requests +to that resource, based on parameters such as the request's path, method, and +headers, and can configure how requests matching that rule are routed by the +Linkerd service mesh. + +## Inbound and Outbound HTTPRoutes + +Two types of HTTPRoute are used for configuring the behavior of Linkerd's +proxies: + +- HTTPRoutes with a [Service] as their parent resource configure policies for + _outbound_ proxies in pods which are clients of that [Service]. Outbound + policy includes [dynamic request routing][dyn-routing], adding request + headers, modifying a request's path, and reliability features such as + [timeouts]. +- HTTPRoutes with a [Server] as their parent resource configure policy for + _inbound_ proxies in pods which recieve traffic to that [Server]. Inbound + HTTPRoutes are used to configure fine-grained [per-route authorization and + authentication policies][auth-policy]. + +{{< warning >}} +**Outbound HTTPRoutes and [ServiceProfiles](../service-profiles/) provide +overlapping configuration.** For backwards-compatibility reasons, a +ServiceProfile will take precedence over HTTPRoutes which configure the same +Service. If a ServiceProfile is defined for the parent Service of an HTTPRoute, +proxies will use the ServiceProfile configuration, rather than the HTTPRoute +configuration, as long as the ServiceProfile +exists. +{{< /warning >}} + +## Learn More + +To get started with HTTPRoutes, you can: + +- [Configure fault injection](../../tasks/fault-injection/) using an outbound + HTTPRoute. +- [Configure timeouts][timeouts] using an outbound HTTPRoute. +- [Configure dynamic request routing][dyn-routing] using an outbound HTTPRoute. +- [Configure per-route authorization policy][auth-policy] using an inbound + HTTPRoute. +- See the [reference documentation](../../reference/httproute/) for a complete + description of the HTTPRoute resource. + +[HTTPRoute resource]: https://gateway-api.sigs.k8s.io/api-types/httproute/ +[Gateway API]: https://gateway-api.sigs.k8s.io/ +[Service]: https://kubernetes.io/docs/concepts/services-networking/service/ +[Server]: ../../reference/authorization-policy/#server +[auth-policy]: ../../tasks/configuring-per-route-policy/ +[dyn-routing]:../../tasks/configuring-dynamic-request-routing/ +[timeouts]: ../../tasks/configuring-timeouts/#using-httproutes diff --git a/linkerd.io/content/2.17/features/ingress.md b/linkerd.io/content/2.17/features/ingress.md new file mode 100644 index 0000000000..4b56cdd00a --- /dev/null +++ b/linkerd.io/content/2.17/features/ingress.md @@ -0,0 +1,11 @@ +--- +title: Ingress +description: Linkerd can work alongside your ingress controller of choice. +weight: 7 +--- + +For reasons of simplicity, Linkerd does not provide its own ingress controller. +Instead, Linkerd is designed to work alongside your ingress controller of choice. + +See the [Using Ingress with Linkerd Guide](../../tasks/using-ingress/) for examples +of how to get it all working together. diff --git a/linkerd.io/content/2.17/features/ipv6.md b/linkerd.io/content/2.17/features/ipv6.md new file mode 100644 index 0000000000..e98e37024d --- /dev/null +++ b/linkerd.io/content/2.17/features/ipv6.md @@ -0,0 +1,14 @@ +--- +title: IPv6 Support +description: Linkerd is compatible with both IPv6-only and dual-stack clusters. +--- + +As of version 2.16 (and edge-24.8.2) Linkerd fully supports Kubernetes clusters +configured for IPv6-only or dual-stack networking. + +This is disabled by default; to enable just set `proxy.disableIPv6=false` when +installing the control plane and, if you use it, the linkerd-cni plugin. + +Enabling IPv6 support does not generally change how Linkerd operates, except in +one way: when enabled on a dual-stack cluster, Linkerd will only use the IPv6 +endpoints of destinations and will not use the IPv4 endpoints. diff --git a/linkerd.io/content/2.17/features/load-balancing.md b/linkerd.io/content/2.17/features/load-balancing.md new file mode 100644 index 0000000000..33be276075 --- /dev/null +++ b/linkerd.io/content/2.17/features/load-balancing.md @@ -0,0 +1,38 @@ +--- +title: Load Balancing +description: Linkerd automatically load balances requests across all destination endpoints + on HTTP, HTTP/2, and gRPC connections. +weight: 9 +--- + +For HTTP, HTTP/2, and gRPC connections, Linkerd automatically load balances +requests across all destination endpoints without any configuration required. +(For TCP connections, Linkerd will balance connections.) + +Linkerd uses an algorithm called EWMA, or *exponentially weighted moving average*, +to automatically send requests to the fastest endpoints. This load balancing can +improve end-to-end latencies. + +## Service discovery + +For destinations that are not in Kubernetes, Linkerd will balance across +endpoints provided by DNS. + +For destinations that are in Kubernetes, Linkerd will look up the IP address in +the Kubernetes API. If the IP address corresponds to a Service, Linkerd will +load balance across the endpoints of that Service and apply any policy from that +Service's [Service Profile](../service-profiles/). On the other hand, +if the IP address corresponds to a Pod, Linkerd will not perform any load +balancing or apply any [Service Profiles](../service-profiles/). + +{{< note >}} +If working with headless services, endpoints of the service cannot be retrieved. +Therefore, Linkerd will not perform load balancing and instead route only to the +target IP address. +{{< /note >}} + +## Load balancing gRPC + +Linkerd's load balancing is particularly useful for gRPC (or HTTP/2) services +in Kubernetes, for which [Kubernetes's default load balancing is not +effective](https://kubernetes.io/blog/2018/11/07/grpc-load-balancing-on-kubernetes-without-tears/). diff --git a/linkerd.io/content/2.17/features/multicluster.md b/linkerd.io/content/2.17/features/multicluster.md new file mode 100644 index 0000000000..71d532a4ac --- /dev/null +++ b/linkerd.io/content/2.17/features/multicluster.md @@ -0,0 +1,138 @@ +--- +title: Multi-cluster communication +description: Linkerd can transparently and securely connect services that are running + in different clusters. +--- + +Linkerd can connect Kubernetes services across cluster boundaries in a way that +is secure, fully transparent to the application, and independent of network +topology. This multi-cluster capability is designed to provide: + +1. **A unified trust domain.** The identity of source and destination workloads + are validated at every step, both in and across cluster boundaries. +2. **Separate failure domains.** Failure of a cluster allows the remaining + clusters to function. +3. **Support for any type of network.** Linkerd does not require any specific + network topology between clusters, and can function both with hierarchical + networks as well as when clusters [share the same flat + network](#flat-networks). +4. **A unified model alongside in-cluster communication.** The same + observability, reliability, and security features that Linkerd provides for + in-cluster communication extend to cross-cluster communication. + +Just as with in-cluster connections, Linkerd’s cross-cluster connections are +transparent to the application code. Regardless of whether that communication +happens within a cluster, across clusters within a datacenter or VPC, or across +the public Internet, Linkerd will establish a connection between clusters +that's reliable, encrypted, and authenticated on both sides with mTLS. + +## How it works + +Linkerd's multi-cluster support works by "mirroring" service information between +clusters, using a *service mirror* component that watches a target cluster for +updates to services and applies those updates locally on the source cluster. + +These mirrored services are suffixed with the name of the remote cluster, e.g. +the *Foo* service on the *west* cluster would be mirrored as *Foo-west* on the +local cluster. This approach is typically combined with [traffic +splitting](../traffic-split/) or [dynamic request routing](../request-routing/) +to allow local services to access the *Foo* service as if it were on the local +cluster. + +Linkerd supports three basic forms of multi-cluster communication: hierarchical, +flat, and federated. + +![Architectural diagram comparing hierarchical and flat network modes](/docs/images/multicluster/flat-network.png) + +### Hierarchical networks + +In hierarchical mode, Linkerd deploys a *gateway* component on the target +cluster that allows it to receive requests from source clusters. This approach +works on almost any network topology, as it only requires that the gateway IP of +the destination cluster be reachable by pods on the source cluster. + +### Flat networks + +As of Linkerd 2.14, Linkerd supports pod-to-pod communication for clusters that +share a flat network, where pods can establish TCP connections and send traffic +directly to each other across cluster boundaries. In these environments, Linkerd +does not use a gateway intermediary for data plane traffic, which provides +several advantages: + +* Improved latency by avoiding an additional network hop +* Reduced operational costs in cloud environments that require a + `LoadBalancer`-type service for the gateway +* Better multi-cluster authorization policies, as workload identity + is preserved across cluster boundaries. + +### Federated services + +A federated service is a union of services with the same name and namespace +in multiple different clusters. Meshed clients that send traffic to a federated +service will have that traffic distributed across all replicas of services in +the federated service across clusters. Federated services use the *flat +networking* model and do not use a gateway intermediary. + +These modes can be combined, with each specific service selecting the mode that +is most appropriate for that service. See the +[pod-to-pod multicluster communication](../../tasks/pod-to-pod-multicluster/) +guide, the [federated services](../../tasks/federated-services/) guide, and the +[multi-cluster reference](../../reference/multicluster/) for more. + +## Headless services + +[headless-svc]: https://kubernetes.io/docs/concepts/services-networking/service/#headless-services +[stateful-set]: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/ + +By default, Linkerd will mirror all exported services as Kubernetes `clusterIP` +services. This also extends to [headless services][headless-svc]; an exported +headless service will be mirrored as `clusterIP` and have an IP address +assigned to it. In general, headless services *should not have an IP address*; +they are used when a workload needs a stable network identifier or to +facilitate service discovery without being tied to Kubernetes' native +implementation. This allows clients to either implement their own load +balancing or to address a pod directly through its DNS name. In certain +situations, it is desirable to preserve some of this functionality, especially +when working with Kubernetes objects that require it, such as +[StatefulSet][stateful-set]. + +Linkerd's multi-cluster extension can be configured with support for headless +services when linking two clusters together. When the feature is turned on, the +*service mirror* component will export headless services without assigning them +an IP. This allows clients to talk to specific pods (or hosts) across clusters. +To support direct communication, underneath the hood, the service mirror +component will create an *endpoint mirror* for each host that backs a headless +service. To exemplify, if in a target cluster there is a StatefulSet deployed +with two replicas, and the StatefulSet is backed by a headless service, when +the service will be exported, the source cluster will create a headless mirror +along with two "endpoint mirrors" representing the hosts in the StatefulSet. + +This approach allows Linkerd to preserve DNS record creation and support direct +communication to pods across clusters. Clients may also implement their own +load balancing based on the DNS records created by the headless service. +Hostnames are also preserved across clusters, meaning that the only difference +in the DNS name (or FQDN) is the headless service's mirror name. In order to be +exported as a headless service, the hosts backing the service need to be named +(e.g a StatefulSet is supported since all pods have a hostname, but a +Deployment would not be supported, since they do not allow for arbitrary +hostnames in the pod spec). + +Note that headless services can *not* be part of a federated service. + +Ready to get started? See the [getting started with multi-cluster +guide](../../tasks/multicluster/) for a walkthrough. + +## Further reading + +* [Multi-cluster installation instructions](../../tasks/installing-multicluster/) +* [Pod-to-pod multicluster communication](../../tasks/pod-to-pod-multicluster/) +* [Multi-cluster communication with StatefulSets](../../tasks/multicluster-using-statefulsets/) +* [Federated services](../../tasks/federated-services/) +* [Architecting for multi-cluster + Kubernetes](/2020/02/17/architecting-for-multicluster-kubernetes/), a blog + post explaining some of the design rationale behind Linkerd's multi-cluster + implementation. +* [Multi-cluster Kubernetes with service + mirroring](/2020/02/25/multicluster-kubernetes-with-service-mirroring/), a + deep dive of some of the architectural decisions behind Linkerd's + multi-cluster implementation. diff --git a/linkerd.io/content/2.17/features/nft.md b/linkerd.io/content/2.17/features/nft.md new file mode 100644 index 0000000000..82ac78afad --- /dev/null +++ b/linkerd.io/content/2.17/features/nft.md @@ -0,0 +1,62 @@ +--- +title: Iptables-nft Support +description: Linkerd's init container can use iptables-nft on systems that require + it. +--- + +To transparently route TCP traffic through the proxy, without any awareness +from the application, Linkerd will configure a set of [firewall +rules](../../reference/iptables/) in each injected pod. Configuration can be +done either through an [init +container](../../reference/architecture/#linkerd-init-container) or through a +[CNI plugin](../cni/). + +Linkerd's init container can be run in two separate modes: `legacy` or `nft`. +The difference between the two modes is what variant of `iptables` they will use +to configure firewall rules. + +## Details + +Modes for the init container can be changed either at upgrade time, or during +installation. Once configured, all injected workloads (including the control +plane) will use the same mode in the init container. Both modes will use the +`iptables` utility to configure firewall rules; the main difference between the +two, is which binary they will call into: + +1. `legacy` mode will call into [`iptables-legacy`] for firewall configuration. + This is the default mode that `linkerd-init` runs in, and is supported by + most operating systems and distributions. +2. `nft` mode will call into `iptables-nft`, which uses the newer `nf_tables` + kernel API. The `nftables` utilities are used by newer operating systems to + configure firewalls by default. + +[`iptables-legacy`]: https://manpages.debian.org/bullseye/iptables/iptables-legacy.8.en.html +Conceptually, `iptables-nft` is a bridge between the legacy and the newer +`nftables` utilities. Under the hood, it uses a different backend, where rules +additions and deletions are atomic. The nft version of iptables uses the same +packet matching syntax (xtables) as its legacy counterpart. + +Because both utilities use the same syntax, it is recommended to run in +whatever mode your Kubernetes hosts support best. Certain operating systems +(e.g Google Container Optimized OS) do not offer support out-of-the-box for +`nftables` modules. Others (e.g RHEL family of operating systems) do not +support the legacy version of iptables. Linkerd's init container should be run +in `nft` mode only if the nodes support it and contain the relevant nftables +modules. + +{{< note >}} +Linkerd supports a `-w` (wait) option for its init container. Because +operations are atomic, and rulesets are not reloaded when modified (only +appended),this option is a no-op when running `linkerd-init` in nft mode. +{{< /note >}} + +## Installation + +The mode for `linkerd-init` can be overridden through the configuration option +`proxyInit.iptablesMode=iptables|nft`. The configuration option can be used for +both Helm and CLI installations (or upgrades). For example, the following line +will install Linkerd and set the init container mode to `nft`: + +```bash +linkerd install --set "proxyInit.iptablesMode=nft" | kubectl apply -f - +``` diff --git a/linkerd.io/content/2.17/features/non-kubernetes-workloads.md b/linkerd.io/content/2.17/features/non-kubernetes-workloads.md new file mode 100644 index 0000000000..315edb880b --- /dev/null +++ b/linkerd.io/content/2.17/features/non-kubernetes-workloads.md @@ -0,0 +1,16 @@ +--- +title: Non-Kubernetes workloads (mesh expansion) +--- + +Linkerd features *mesh expansion*, or the ability to add non-Kubernetes +workloads to your service mesh by deploying the Linkerd proxy to the remote +machine and connecting it back to the Linkerd control plane within the mesh. +This allows you to use Linkerd to establish communication to and from the +workload that is secure, reliable, and observable, just like communication to +and from your Kubernetes workloads. + +Related content: + +* [Guide: Adding non-Kubernetes workloads to your mesh]({{< relref + "../tasks/adding-non-kubernetes-workloads" >}}) +* [ExternalWorkload Reference]({{< relref "../reference/external-workload" >}}) diff --git a/linkerd.io/content/2.17/features/protocol-detection.md b/linkerd.io/content/2.17/features/protocol-detection.md new file mode 100644 index 0000000000..c89d50885c --- /dev/null +++ b/linkerd.io/content/2.17/features/protocol-detection.md @@ -0,0 +1,152 @@ +--- +title: TCP Proxying and Protocol Detection +description: Linkerd is capable of proxying all TCP traffic, including TLS'd connections, + WebSockets, and HTTP tunneling. +weight: 2 +--- + +Linkerd is capable of proxying all TCP traffic, including TLS connections, +WebSockets, and HTTP tunneling. + +In most cases, Linkerd can do this without configuration. To accomplish this, +Linkerd performs *protocol detection* to determine whether traffic is HTTP +(including HTTP/2 and gRPC). If Linkerd detects that a connection is HTTP, it +will automatically provide HTTP-level metrics and routing. If Linkerd *cannot* +determine that a connection is using HTTP, Linkerd will proxy the connection as +a plain TCP connection without HTTP metrics and routing. (In both cases, +non-HTTP features such as [mutual TLS](../automatic-mtls/) and byte-level +metrics are still applied.) + +Protocol detection can only happen if the HTTP traffic is unencrypted from the +client. If the application itself initiates a TLS call, Linkerd will not be able +to decrypt the connection, and will treat it as an opaque TCP connection. + +## Configuring protocol detection + +{{< note >}} +If your proxy logs contain messages like `protocol detection timed out +after 10s`, or you are experiencing 10-second delays when establishing +connections, you are likely running into a protocol detection timeout. +This section will help you understand how to fix this. +{{< /note >}} + +To do protocol detection, Linkerd waits for up to 10 seconds to see bytes sent +from the client. Note that until the protocol has been determined, Linkerd +cannot even establish a connection to the destination, since HTTP routing +configuration may inform where this connection is established to. + +If Linkerd does not see enough data from the client within 10 seconds from +connection establishment to determine the protocol, Linkerd will treat the +connection as an opaque TCP connection and will proceed as normal, establishing +the connection to the destination and proxying the data. + +In practice, protocol detection timeouts typically happen when the application +is using a protocol where the server sends data before the client does (such as +SMTP) or a protocol that proactively establishes connections without sending data +(such as Memcache). In this case, everything will work, but Linkerd will +introduce an unnecessary 10 second delay before connection establishment. + +To avoid this delay, you can provide some configuration for Linkerd. There are +two basic mechanisms for configuring protocol detection: _opaque ports_ and +_skip ports_: + +* Opaque ports instruct Linkerd to skip protocol detection and proxy the + connection as a TCP stream. +* Skip ports bypass the proxy entirely. + +Opaque ports are generally preferred as they only skip protocol detection, +without interfering with Linkerd's ability to provide mTLS, TCP-level metrics, +policy, etc. Skip ports, by contrast, create networking rules that avoid the +proxy entirely, circumventing Linkerd's ability to provide security features. + +Linkerd maintains a default list of opaque ports that corresponds to the +standard ports used by protocols that interact poorly with protocol detection. + +## Protocols that may require configuration + +The following table contains common protocols that may require additional +configuration. + +| Protocol | Standard ports | In default list? | Notes | +|-----------------|------------------|------------------|-------| +| SMTP | 25, 587 | Yes | | +| MySQL | 3306 | Yes | | +| MySQL with Galera | 3306, 4444, 4567, 4568 | Partially | Ports 4567 and 4568 are not in Linkerd's default list of opaque ports | +| PostgreSQL | 5432 | Yes | | +| Redis | 6379 | Yes | | +| ElasticSearch | 9300 | Yes | | +| Memcache | 11211 | Yes | | +| NATS | 4222, 6222, 8222 | No | | + +If you are using one of those protocols, follow this decision tree to determine +which configuration you need to apply. + +![Decision tree](/docs/images/protocol-detection-decision-tree.png) + +## Marking ports as opaque + +You can use the `config.linkerd.io/opaque-ports` annotation to mark a port as +opaque. Linkerd will skip protocol detection on opaque ports, and treat +connections to them as TCP streams. + +This annotation should be set on the _destination_, not on the source, of the +traffic. This is true even if the destination is unmeshed, as it controls the +behavior of meshed clients. + +This annotation *must* be set in two places: + +1. On the Service receiving the traffic. +2. On the workload itself (e.g. on the Deployment's Pod spec receiving the +traffic), or on enclosing namespace, in which it will apply to all workloads in +the namespace. + +{{< note >}} +Multiple ports can be provided as a comma-delimited string. The values you +provide will _replace_, not augment, the default list of opaque ports. +{{< /note >}} + +{{< note >}} +If you are using [authorization policies](../server-policy/), the `Server`'s +`proxyProtocol` field can be used to control protocol detection behavior +instead of a Service annotation. Regardless, we suggest annotating the +Service object for clarity. +{{< /note >}} + +## Marking ports as skip ports + +Sometimes it is necessary to bypass the proxy altogether. In this case, you can +use the `config.linkerd.io/skip-outbound-ports` annotation to bypass the proxy +entirely when sending to those ports. (Note that there is a related annotation, +`skip-inbound-ports`, to bypass the proxy for incoming connections. This is +typically only needed for debugging purposes.) + +As with opaque ports, multiple skip-ports can be provided as a comma-delimited +string. + +This annotation should be set on the source of the traffic. + +## Setting the enable-external-profiles annotation + +The `config.linkerd.io/enable-external-profiles` annotation configures Linkerd +to look for [`ServiceProfiles`](../service-profiles/) for off-cluster +connections. It *also* instructs Linkerd to respect the default set of opaque +ports for this connection. + +This annotation should be set on the source of the traffic. + +Note that the default set of opaque ports can be configured at install +time, e.g. by using `--set proxy.opaquePorts`. This may be helpful in +conjunction with `enable-external-profiles`. + +## Using `NetworkPolicy` resources with opaque ports + +When a service has a port marked as opaque, any `NetworkPolicy` resources that +apply to the respective port and restrict ingress access will have to be +changed to target the proxy's inbound port instead (by default, `4143`). If the +service has a mix of opaque and non-opaque ports, then the `NetworkPolicy` +should target both the non-opaque ports, and the proxy's inbound port. + +A connection that targets an opaque endpoint (i.e a pod with a port marked as +opaque) will have its original target port replaced with the proxy's inbound +port. Once the inbound proxy receives the traffic, it will transparently +forward it to the main application container over a TCP connection. diff --git a/linkerd.io/content/2.17/features/proxy-injection.md b/linkerd.io/content/2.17/features/proxy-injection.md new file mode 100644 index 0000000000..d81cfc971c --- /dev/null +++ b/linkerd.io/content/2.17/features/proxy-injection.md @@ -0,0 +1,72 @@ +--- +title: Automatic Proxy Injection +description: Linkerd will automatically inject the data plane proxy into your pods + based annotations. +--- + +Linkerd automatically adds the data plane proxy to pods when the +`linkerd.io/inject: enabled` annotation is present on a namespace or any +workloads, such as deployments or pods. This is known as "proxy injection". + +See [Adding Your Service](../../tasks/adding-your-service/) for a walkthrough of +how to use this feature in practice. + +{{< note >}} +Proxy injection is also where proxy *configuration* happens. While it's rarely +necessary, you can configure proxy settings by setting additional Kubernetes +annotations at the resource level prior to injection. See the [full list of +proxy configuration options](../../reference/proxy-configuration/). +{{< /note >}} + +## Details + +Proxy injection is implemented as a [Kubernetes admission +webhook](https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#admission-webhooks). +This means that the proxies are added to pods within the Kubernetes cluster +itself, regardless of whether the pods are created by `kubectl`, a CI/CD +system, or any other system. + +For each pod, two containers are injected: + +1. `linkerd-init`, a Kubernetes [Init + Container](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) + that configures `iptables` to automatically forward all incoming and + outgoing TCP traffic through the proxy. (Note that this container is not + injected if the [Linkerd CNI Plugin](../cni/) has been enabled.) +1. `linkerd-proxy`, the Linkerd data plane proxy itself. + +Note that simply adding the annotation to a resource with pre-existing pods +will not automatically inject those pods. You will need to update the pods +(e.g. with `kubectl rollout restart` etc.) for them to be injected. This is +because Kubernetes does not call the webhook until it needs to update the +underlying resources. + +## Exclusions + +At install time, Kubernetes is configured to avoid calling Linkerd's proxy +injector for resources in the `kube-system` and `cert-manager` namespaces. This +is to prevent injection on components that are themselves required for Linkerd +to function. + +The injector will not run on components in these namespaces, regardless of any +`linkerd.io/inject` annotations. + +## Overriding injection + +Automatic injection can be disabled for a pod or deployment for which it would +otherwise be enabled, by adding the `linkerd.io/inject: disabled` annotation. + +## Manual injection + +The [`linkerd inject`](../../reference/cli/inject/) CLI command is a text +transform that, by default, simply adds the inject annotation to a given +Kubernetes manifest. + +Alternatively, this command can also perform the full injection purely on the +client side with the `--manual` flag. This was the default behavior prior to +Linkerd 2.4; however, having injection to the cluster side makes it easier to +ensure that the data plane is always present and configured correctly, +regardless of how pods are deployed. + +See the [`linkerd inject` reference](../../reference/cli/inject/) for more +information. diff --git a/linkerd.io/content/2.17/features/rate-limiting.md b/linkerd.io/content/2.17/features/rate-limiting.md new file mode 100644 index 0000000000..b13011e457 --- /dev/null +++ b/linkerd.io/content/2.17/features/rate-limiting.md @@ -0,0 +1,55 @@ +--- +title: Rate Limiting +description: Linkerd offers a simple and performant HTTP local rate limiting solution to protect services from misbehaved clients +--- + +Rate limiting helps protect a service by controlling its inbound traffic flow to +prevent overload, ensure fair resource use, enhance security, manage costs, +maintain quality, and comply with SLAs. + +Please check the [Configuring Rate Limiting +task](../../tasks/configuring-rate-limiting/) for an example guide on deploying +rate limiting, and the [HTTPLocalRateLimitPolicy reference +doc](../../reference/rate-limiting/). + +## Scope + +Linkerd offers a _local_ rate limiting solution, which means that each inbound +proxy performs the limiting for the pod. This is unlike _global_ rate limiting, +which takes into account all replicas for each service to track global request +volume. Global rate limiting requires an additional service to track everything +and is thus more complex to deploy and maintain. + +## Fairness + +In the `HTTPLocalRateLimitPolicy` CR you can optionally configure a rate limit +to apply to all the inbound traffic for a given Server, regardless of the +source. + +Additionally, you can specify fairness among clients by declaring a limit per +identity. This avoids specific clients gobbling all the rate limit quota and +affecting all the other clients. Note that all unmeshed sources (which don't +have an identity) are treated as a single source. + +Finally, you also have at your disposal the ability to override the config for +specific clients by their identity. + +## Algorithm + +Linkerd uses the [Generic cell rate algorithm +(GCRA)](https://en.wikipedia.org/wiki/Generic_cell_rate_algorithm) to implement +rate limiting, which is more performant than the token bucket and leaky bucket +algorithms usually used for rate limiting. + +The GCRA has two parameters: cell rate and tolerance. + +In its virtual scheduling description, the algorithm determines a theoretical +arrival time, representing the 'ideal' arrival time of a cell (request) if cells +(requests) were transmitted at equal intervals of time, corresponding to the +cell rate. How closely the flow of requests should abide to that arrival time is +determined by the tolerance parameter. + +In Linkerd we derive the cell rate from the `requestsPerSecond` entries in +`HTTPLocalRateLimitPolicy` and the tolerance is set to one second. This helps +accommodating small variations or occasional bursts in traffic while ensuring +the long-term rate remains within limits. diff --git a/linkerd.io/content/2.17/features/request-routing.md b/linkerd.io/content/2.17/features/request-routing.md new file mode 100644 index 0000000000..d47f642786 --- /dev/null +++ b/linkerd.io/content/2.17/features/request-routing.md @@ -0,0 +1,24 @@ +--- +title: Dynamic Request Routing +description: Linkerd can route individual HTTP requests based on their properties. +--- + +Linkerd's dynamic request routing allows you to control routing of HTTP and gRPC +traffic based on properties of the request, including verb, method, query +parameters, and headers. For example, you can route all requests that match +a specific URL pattern to a given backend; or you can route traffic with a +particular header to a different service. + +This is an example of _client-side policy_, i.e. ways to dynamically configure +Linkerd's behavior when it is sending requests from a meshed pod. + +Dynamic request routing is built on Kubernetes's Gateway API types, especially +[HTTPRoute](https://gateway-api.sigs.k8s.io/api-types/httproute/). + +This feature extends Linkerd's traffic routing capabilities beyond those of +[traffic splits](../traffic-split/), which only provide percentage-based +splits. + +## Learning more + +- [Guide to configuring routing policy](../../tasks/configuring-dynamic-request-routing/) diff --git a/linkerd.io/content/2.17/features/retries-and-timeouts.md b/linkerd.io/content/2.17/features/retries-and-timeouts.md new file mode 100644 index 0000000000..c0c62260ed --- /dev/null +++ b/linkerd.io/content/2.17/features/retries-and-timeouts.md @@ -0,0 +1,27 @@ +--- +title: Retries and Timeouts +description: Linkerd can perform service-specific retries and timeouts. +weight: 3 +--- + +Timeouts and automatic retries are two of the most powerful and useful +mechanisms a service mesh has for gracefully handling partial or transient +application failures. + +Timeouts and retries can be configured using [HTTPRoute], GRPCRoute, or Service +resources. Retries and timeouts are always performed on the *outbound* (client) +side. + +{{< note >}} +If working with headless services, outbound policy cannot be retrieved. Linkerd +reads service discovery information based off the target IP address, and if that +happens to be a pod IP address then it cannot tell which service the pod belongs +to. +{{< /note >}} + +These can be setup by following the guides: + +- [Configuring Retries](../../tasks/configuring-retries/) +- [Configuring Timeouts](../../tasks/configuring-timeouts/) + +[HTTPRoute]: ../httproute/ diff --git a/linkerd.io/content/2.17/features/server-policy.md b/linkerd.io/content/2.17/features/server-policy.md new file mode 100644 index 0000000000..757d7e5603 --- /dev/null +++ b/linkerd.io/content/2.17/features/server-policy.md @@ -0,0 +1,170 @@ +--- +title: Authorization Policy +description: Linkerd can restrict which types of traffic are allowed between meshed + services. +--- + +Linkerd's authorization policy allows you to control which types of +traffic are allowed to meshed pods. For example, you can restrict communication +to a particular service (or HTTP route on a service) to only come from certain +other services; you can enforce that mTLS must be used on a certain port; and so +on. + +{{< note >}} +Linkerd can only enforce policy on meshed pods, i.e. pods where the Linkerd +proxy has been injected. If policy is a strict requirement, you should pair the +usage of these features with [HA mode](../ha/), which enforces that the proxy +*must* be present when pods start up. +{{< /note >}} + +## Policy overview + +By default Linkerd allows all traffic to transit the mesh, and uses a variety +of mechanisms, including [retries](../retries-and-timeouts/) and [load +balancing](../load-balancing/), to ensure that requests are delivered +successfully. + +Sometimes, however, we want to restrict which types of traffic are allowed. +Linkerd's policy features allow you to *deny* access to resources unless certain +conditions are met, including the TLS identity of the client. + +Linkerd's policy is configured using two mechanisms: + +1. A set of _default policies_, which can be set at the cluster, + namespace, workload, and pod level through Kubernetes annotations. +2. A set of CRDs that specify fine-grained policy for specific ports, routes, + workloads, etc. + +These mechanisms work in conjunction. For example, a default cluster-wide policy +of `deny` would prohibit any traffic to any meshed pod; traffic would then need +to be explicitly allowed through the use of CRDs. + +## Default policies + +The `config.linkerd.io/default-inbound-policy` annotation can be set at a +namespace, workload, and pod level, and will determine the default traffic +policy at that point in the hierarchy. Valid default policies include: + +- `all-unauthenticated`: allow all requests. This is the default. +- `all-authenticated`: allow requests from meshed clients only. +- `cluster-authenticated`: allow requests from meshed clients in the same + cluster. +- `deny`: deny all requests. +- `audit`: Same as `all-unauthenticated` but requests get flagged in logs and + metrics. + +As well as several other default policies—see the [Policy +reference](../../reference/authorization-policy/) for more. + +Every cluster has a cluster-wide default policy (by default, +`all-unauthenticated`), set at install time. Annotations that are present at the +workload or namespace level *at pod creation time* can override that value to +determine the default policy for that pod. (Note that the default policy is fixed +at proxy initialization time, and thus, after a pod is created, changing the +annotation will not change the default policy for that pod.) + +## Fine-grained policies + +For finer-grained policy that applies to specific ports, routes, or more, +Linkerd uses a set of CRDs. In contrast to default policy annotations, these +policy CRDs can be changed dynamically and policy behavior will be updated on +the fly. + +Two policy CRDs represent "targets" for policy: subsets of traffic over which +policy can be applied. + +- [`Server`]: all traffic to a port, for a set of pods in a namespace +- [`HTTPRoute`]: a subset of HTTP requests for a [`Server`] + +Two policy CRDs represent authentication rules that must be satisfied as part of +a policy rule: + +- `MeshTLSAuthentication`: authentication based on [secure workload + identities](../automatic-mtls/) +- `NetworkAuthentication`: authentication based on IP address + +And finally, two policy CRDs represent policy itself: the mapping of +authentication rules to targets. + +- `AuthorizationPolicy`: a policy that restricts access to one or more targets + unless an authentication rule is met + +- `ServerAuthorization`: an earlier form of policy that restricts access to + [`Server`]s only (i.e. not [`HTTPRoute`]s) + +The general pattern for Linkerd's dynamic, fine-grained policy is to define the +traffic target that must be protected (via a combination of `Server` and +[`HTTPRoute`] CRs); define the types of authentication that are required before +access to that traffic is permitted (via `MeshTLSAuthentication` and +`NetworkAuthentication`); and then define the policy that maps authentication to +target (via an `AuthorizationPolicy`). + +See the [Policy reference](../../reference/authorization-policy/) for more +details on how these resources work. + +## ServerAuthorization vs AuthorizationPolicy + +Linkerd 2.12 introduced `AuthorizationPolicy` as a more flexible alternative to +`ServerAuthorization` that can target [`HTTPRoute`]s as well as `Server`s. Use of +`AuthorizationPolicy` is preferred, and `ServerAuthorization` will be deprecated +in future releases. + +## Default authorizations + +A blanket denial of all to a pod would also deny health and readiness probes +from Kubernetes, meaning that the pod would not be able to start. Thus, any +default-deny setup must, in practice, still authorize these probes. + +In order to simplify default-deny setups, Linkerd automatically authorizes +probes to pods. These default authorizations apply only when no [`Server`] is +configured for a port, or when a [`Server`] is configured but no [`HTTPRoute`]s are +configured for that [`Server`]. If any [`HTTPRoute`] matches the `Server`, these +automatic authorizations are not created and you must explicitly create them for +health and readiness probes. + +## Policy rejections + +Any traffic that is known to be HTTP (including HTTP/2 and gRPC) that is denied +by policy will result in the proxy returning an HTTP 403. All other traffic will +be denied at the TCP level, i.e. by refusing the connection. + +Note that dynamically changing the policy to deny existing connections may +result in an abrupt termination of those connections. + +## Audit mode + +A [`Server`]'s default policy is defined in its `accessPolicy` field, which +defaults to `deny`. That means that, by default, traffic that doesn't conform to +the rules associated to that Server is denied (the same applies to `Servers` +that don't have associated rules yet). This can inadvertently prevent traffic if +you apply rules that don't account for all the possible sources/routes for your +services. + +This is why we recommend that when first setting authorization policies, you +explicitly set `accessPolicy:audit` for complex-enough services. In this mode, +if a request doesn't abide to the policy rules, it won't get blocked, but it +will generate a log entry in the proxy at the INFO level with the tag +`authz.name=audit` along with other useful information. Likewise, the proxy will +add entries to metrics like `request_total` with the label `authz_name=audit`. +So when you're in the process of fine-tuning a new authorization policy, you can +filter by those tags/labels in your observability stack to keep an eye on +requests which weren't caught by the policy. + +### Audit mode for default policies + +Audit mode is also supported at cluster, namespace, or workload level. To set +the whole cluster to audit mode, set `proxy.defaultInboundPolicy=audit` when +installing Linkerd; for a namespace or a workload, use the annotation +`config.linkerd.io/default-inbound-policy:audit`. For example, if you had +`config.linkerd.io/default-inbound-policy:all_authenticated` for a namespace and +no `Servers` declared, all unmeshed traffic would be denied. By using +`config.linkerd.io/default-inbound-policy:audit` instead, unmeshed traffic would +be allowed but it would be logged and surfaced in metrics as detailed above. + +## Learning more + +- [Authorization policy reference](../../reference/authorization-policy/) +- [Guide to configuring per-route policy](../../tasks/configuring-per-route-policy/) + +[`HTTPRoute`]: ../httproute/ +[`Server`]: ../../reference/authorization-policy/#server diff --git a/linkerd.io/content/2.17/features/service-profiles.md b/linkerd.io/content/2.17/features/service-profiles.md new file mode 100644 index 0000000000..adc9bac675 --- /dev/null +++ b/linkerd.io/content/2.17/features/service-profiles.md @@ -0,0 +1,33 @@ +--- +title: Service Profiles +description: Linkerd's service profiles enable per-route metrics as well as retries + and timeouts. +--- + +{{< note >}} +[HTTPRoutes](../httproute/) are the recommended method for getting per-route +metrics, specifying timeouts, and specifying retries. Service profiles continue +to be supported for backwards compatibility. +{{< /note >}} + +A service profile is a custom Kubernetes resource ([CRD][crd]) that can provide +Linkerd additional information about a service. In particular, it allows you to +define a list of routes for the service. Each route uses a regular expression +to define which paths should match that route. Defining a service profile +enables Linkerd to report per-route metrics and also allows you to enable +per-route features such as retries and timeouts. + +{{< note >}} +If working with headless services, service profiles cannot be retrieved. Linkerd +reads service discovery information based off the target IP address, and if that +happens to be a pod IP address then it cannot tell which service the pod belongs +to. +{{< /note >}} + +To get started with service profiles you can: + +- Look into [setting up service profiles](../../tasks/setting-up-service-profiles/) + for your own services. +- Glance at the [reference](../../reference/service-profiles/) documentation. + +[crd]: https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/ diff --git a/linkerd.io/content/2.17/features/telemetry.md b/linkerd.io/content/2.17/features/telemetry.md new file mode 100644 index 0000000000..471f01cc4e --- /dev/null +++ b/linkerd.io/content/2.17/features/telemetry.md @@ -0,0 +1,77 @@ +--- +title: Telemetry and Monitoring +description: Linkerd automatically collects metrics from all services that send traffic + through it. +weight: 8 +--- + +One of Linkerd's most powerful features is its extensive set of tooling around +*observability*—the measuring and reporting of observed behavior in +meshed applications. While Linkerd doesn't have insight directly into the +*internals* of service code, it has tremendous insight into the external +behavior of service code. + +To gain access to Linkerd's observability features you only need to install the +Viz extension: + +```bash +linkerd viz install | kubectl apply -f - +``` + +Linkerd's telemetry and monitoring features function automatically, without +requiring any work on the part of the developer. These features include: + +* Recording of top-line ("golden") metrics (request volume, success rate, and + latency distributions) for HTTP, HTTP/2, and gRPC traffic. +* Recording of TCP-level metrics (bytes in/out, etc) for other TCP traffic. +* Reporting metrics per service, per caller/callee pair, or per route/path + (with [Service Profiles](../service-profiles/)). +* Generating topology graphs that display the runtime relationship between + services. +* Live, on-demand request sampling. + +This data can be consumed in several ways: + +* Through the [Linkerd CLI](../../reference/cli/), e.g. with `linkerd viz stat-inbound` + and `linkerd viz stat-outbound`. +* Through the [Linkerd dashboard](../dashboard/), and + [pre-built Grafana dashboards](../../tasks/grafana/). +* Directly from Linkerd's built-in Prometheus instance + +## Golden metrics + +### Success Rate + +This is the percentage of successful requests during a time window (1 minute by +default). + +In the output of the command `linkerd viz stat-outbound`, this metric is shown +for routes and for individual backends. For routes configured with retries, +the former calculates the percentage of success after retries (as perceived by +the client-side), and the latter before retries (which can expose potential +problems with the service). + +### Traffic (Requests Per Second) + +This gives an overview of how much demand is placed on the service/route. As +with success rates, `linkerd viz stat-outbound` splits this metric into +route level and backend level, corresponding to rates after and before retries +respectively. + +### Latencies + +Times taken to service requests per service/route are split into 50th, 95th and +99th percentiles. Lower percentiles give you an overview of the average +performance of the system, while tail percentiles help catch outlier behavior. + +## Lifespan of Linkerd metrics + +Linkerd is not designed as a long-term historical metrics store. While +Linkerd's Viz extension does include a Prometheus instance, this instance +expires metrics at a short, fixed interval (currently 6 hours). + +Rather, Linkerd is designed to *supplement* your existing metrics store. If +Linkerd's metrics are valuable, you should export them into your existing +historical metrics store. + +See [Exporting Metrics](../../tasks/exporting-metrics/) for more. diff --git a/linkerd.io/content/2.17/features/traffic-split.md b/linkerd.io/content/2.17/features/traffic-split.md new file mode 100644 index 0000000000..8e4b1aacf0 --- /dev/null +++ b/linkerd.io/content/2.17/features/traffic-split.md @@ -0,0 +1,44 @@ +--- +title: Traffic Split (canaries, blue/green deploys) +description: Linkerd can dynamically send a portion of traffic to different services. +--- + +Linkerd's traffic split functionality allows you to dynamically shift arbitrary +portions of traffic destined for a Kubernetes service to a different destination +service. This feature can be used to implement sophisticated rollout strategies +such as [canary deployments](https://martinfowler.com/bliki/CanaryRelease.html) +and +[blue/green deployments](https://martinfowler.com/bliki/BlueGreenDeployment.html), +for example, by slowly easing traffic off of an older version of a service and +onto a newer version. + +{{< note >}} +This feature will eventually be supplanted by the newer [dynamic request +routing](../request-routing/) capabilities, which does not require the SMI +extension. +{{< /note >}} + +{{< note >}} +TrafficSplits cannot be used with headless services. Linkerd reads +service discovery information based off the target IP address, and if that +happens to be a pod IP address then it cannot tell which service the pod belongs +to. +{{< /note >}} + +Linkerd exposes this functionality via the +[Service Mesh Interface](https://smi-spec.io/) (SMI) +[TrafficSplit API](https://github.com/servicemeshinterface/smi-spec/tree/master/apis/traffic-split). +To use this feature, you create a Kubernetes resource as described in the +TrafficSplit spec, and Linkerd takes care of the rest. You can see step by step +documentation on our +[Getting started with Linkerd SMI extension](../../tasks/linkerd-smi/) page. + +By combining traffic splitting with Linkerd's metrics, it is possible to +accomplish even more powerful deployment techniques that automatically take into +account the success rate and latency of old and new versions. See the +[Flagger](https://flagger.app/) project for one example of this. + +Check out some examples of what you can do with traffic splitting: + +- [Canary Releases](../../tasks/flagger/) +- [Fault Injection](../../tasks/fault-injection/) diff --git a/linkerd.io/content/2.17/getting-started/_index.md b/linkerd.io/content/2.17/getting-started/_index.md new file mode 100644 index 0000000000..8dbba9ba81 --- /dev/null +++ b/linkerd.io/content/2.17/getting-started/_index.md @@ -0,0 +1,271 @@ +--- +title: Getting Started +weight: 2 +sitemap: + priority: 1.0 +--- + +Welcome to Linkerd! 🎈 + +In this guide, we'll walk you through how to install Linkerd into your +Kubernetes cluster. Then we'll deploy a sample application to show off what +Linkerd can do. + +This guide is designed to walk you through the basics of Linkerd. First, you'll +install the *CLI* (command-line interface) onto your local machine. Using this +CLI, you'll then install the *control plane* onto your Kubernetes cluster. +Finally, you'll "mesh" an application by adding Linkerd's *data plane* to it. + +{{< docs/edge-note >}} + +## Step 0: Setup + +Before anything else, we need to ensure you have access to modern Kubernetes +cluster and a functioning `kubectl` command on your local machine. (If you +don't already have a Kubernetes cluster, one easy option is to run one on your +local machine. There are many ways to do this, including +[kind](https://kind.sigs.k8s.io/), [k3d](https://k3d.io/), [Docker for +Desktop](https://www.docker.com/products/docker-desktop), [and +more](https://kubernetes.io/docs/setup/).) + +Validate your Kubernetes setup by running: + +```bash +kubectl version +``` + +You should see output with both a `Client Version` and `Server Version` +component. + +Now that we have our cluster, we'll install the Linkerd CLI and use it validate +that your cluster is capable of hosting Linkerd. + +{{< note >}} +If you're using a GKE "private cluster", or if you're using Cilium as a CNI, +there may be some [cluster-specific +configuration](../reference/cluster-configuration/) before you can proceed to +the next step. +{{< /note >}} + +## Step 1: Install the CLI + +If this is your first time running Linkerd, you will need to download the +`linkerd` CLI onto your local machine. The CLI will allow you to interact with +your Linkerd deployment. + +To install the CLI manually, run: + +```bash +curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install-edge | sh +``` + +Be sure to follow the instructions to add it to your path: + +```bash +export PATH=$HOME/.linkerd2/bin:$PATH +``` + +This will install the CLI for the latest _edge release_ of Linkerd. (For more +information about what edge releases are, see our [Releases and +Versions](../../releases/) page.) + +Once installed, verify the CLI is running correctly with: + +```bash +linkerd version +``` + +You should see the CLI version, and also `Server version: unavailable`. This is +because you haven't installed the control plane on your cluster. Don't +worry—we'll fix that soon enough. + +Make sure that your Linkerd version and Kubernetes version are compatible by +checking Linkerd's [supported Kubernetes +versions](../reference/k8s-versions/). + +## Step 2: Validate your Kubernetes cluster + +Kubernetes clusters can be configured in many different ways. Before we can +install the Linkerd control plane, we need to check and validate that +everything is configured correctly. To check that your cluster is ready to +install Linkerd, run: + +```bash +linkerd check --pre +``` + +If there are any checks that do not pass, make sure to follow the provided links +and fix those issues before proceeding. + +## Step 3: Install Linkerd onto your cluster + +Now that you have the CLI running locally and a cluster that is ready to go, +it's time to install Linkerd on your Kubernetes cluster. To do this, run: + +```bash +linkerd install --crds | kubectl apply -f - +``` + +followed by: + +```bash +linkerd install | kubectl apply -f - +``` + +These commands generate Kubernetes manifests with all the core resources required +for Linkerd (feel free to inspect this output if you're curious). Piping these +manifests into `kubectl apply` then instructs Kubernetes to add those resources +to your cluster. The `install --crds` command installs Linkerd's Custom Resource +Definitions (CRDs), which must be installed first, while the `install` command +installs the Linkerd control plane. + +{{< note >}} +The CLI-based install presented here is quick and easy, but there are a variety +of other ways to install Linkerd, including by [using Helm +charts](../tasks/install-helm/) or by using a marketplace install from your +Kubernetes provider. +{{< /note >}} + +Depending on the speed of your cluster's Internet connection, it may take a +minute or two for the control plane to finish installing. Wait for the control +plane to be ready (and verify your installation) by running: + +```bash +linkerd check +``` + +## Step 4: Install the demo app + +Congratulations, Linkerd is installed! However, it's not doing anything just +yet. To see Linkerd in action, we're going to need an application. + +Let's install a demo application called *Emojivoto*. Emojivoto is a simple +standalone Kubernetes application that uses a mix of gRPC and HTTP calls to +allow the user to vote on their favorite emojis. + +Install Emojivoto into the `emojivoto` namespace by running: + +```bash +curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/emojivoto.yml \ + | kubectl apply -f - +``` + +This command installs Emojivoto onto your cluster, but Linkerd hasn't been +activated on it yet—we'll need to "mesh" the application before Linkerd can +work its magic. + +Before we mesh it, let's take a look at Emojivoto in its natural state. +We'll do this by forwarding traffic to its `web-svc` service so that we can +point our browser to it. Forward `web-svc` locally to port 8080 by running: + +```bash +kubectl -n emojivoto port-forward svc/web-svc 8080:80 +``` + +Now visit [http://localhost:8080](http://localhost:8080). Voila! You should see +Emojivoto in all its glory. + +If you click around Emojivoto, you might notice that it's a little broken! For +example, if you try to vote for the **donut** emoji, you'll get a 404 page. +Don't worry, these errors are intentional. (In a later guide, we'll show you +how to [use Linkerd to identify the problem](../tasks/debugging-your-service/).) + +With Emoji installed and running, we're ready to *mesh* it—that is, to add +Linkerd's data plane proxies to it. We can do this on a live application +without downtime, thanks to Kubernetes's rolling deploys. Mesh your Emojivoto +application by running: + +```bash +kubectl get -n emojivoto deploy -o yaml \ + | linkerd inject - \ + | kubectl apply -f - +``` + +This command retrieves all of the deployments running in the `emojivoto` +namespace, runs their manifests through `linkerd inject`, and then reapplies it +to the cluster. (The `linkerd inject` command simply adds annotations to the +pod spec that instruct Linkerd to inject the proxy into the pods when they +are created.) + +As with `install`, `inject` is a pure text operation, meaning that you can +inspect the input and output before you use it. Once piped into `kubectl +apply`, Kubernetes will execute a rolling deploy and update each pod with the +data plane's proxies. + +Congratulations! You've now added Linkerd to an application! Just as with the +control plane, it's possible to verify that everything is working the way it +should on the data plane side. Check your data plane with: + +```bash +linkerd -n emojivoto check --proxy +``` + +And, of course, you can visit [http://localhost:8080](http://localhost:8080) +and once again see Emojivoto in all its meshed glory. + +## Step 5: Explore Linkerd! + +Perhaps that last step was a little unsatisfying. We've added Linkerd to +Emojivoto, but there are no visible changes to the application! That is part +of Linkerd's design—it does its best not to interfere with a functioning +application. + +Let's take a closer look at what Linkerd is actually doing. To do this, +we'll need to install an *extension*. Linkerd's core control plane is extremely +minimal, so Linkerd ships with extensions that add non-critical but often +useful functionality to Linkerd, including a variety of dashboards. + +Let's install the **viz** extension, which will install an on-cluster metric +stack and dashboard. + +To install the viz extension, run: + +```bash +linkerd viz install | kubectl apply -f - # install the on-cluster metrics stack +``` + +Once you've installed the extension, let's validate everything one last time: + +```bash +linkerd check +``` + +With the control plane and extensions installed and running, we're now ready +to explore Linkerd! Access the dashboard with: + +```bash +linkerd viz dashboard & +``` + +You should see a screen like this: + +![The Linkerd dashboard in action](/docs/images/getting-started/viz-empty-dashboard.png "The Linkerd dashboard in action") + +Click around, explore, and have fun! For extra credit, see if you can find the +live metrics for each Emojivoto component, and determine which one has a partial +failure. (See the debugging tutorial below for much more on this.) + +## That's it! 👏 + +Congratulations, you have joined the exalted ranks of Linkerd users! +Give yourself a pat on the back. + +What's next? Here are some steps we recommend: + +* Learn how to use Linkerd to [debug the errors in + Emojivoto](../tasks/debugging-your-service/). +* Learn how to [add your own services](../tasks/adding-your-service/) to + Linkerd without downtime. +* Learn how to install other [Linkerd extensions](../tasks/extensions/) such as + Jaeger and the multicluster extension. +* Learn more about [Linkerd's architecture](../reference/architecture/) +* Learn how to set up [automatic control plane mTLS credential + rotation](../tasks/automatically-rotating-control-plane-tls-credentials/) for + long-lived clusters. +* Learn how to [restrict access to services using authorization + policy](../tasks/restricting-access/). +* Hop into the `#linkerd` channel on [the Linkerd + Slack](https://slack.linkerd.io) + and say hi! + +Above all else: welcome to the Linkerd community! diff --git a/linkerd.io/content/2.17/overview/_index.md b/linkerd.io/content/2.17/overview/_index.md new file mode 100644 index 0000000000..fae411108e --- /dev/null +++ b/linkerd.io/content/2.17/overview/_index.md @@ -0,0 +1,54 @@ +--- +title: Overview +weight: 1 +--- + +Linkerd is a _service mesh_ for Kubernetes. It makes running services easier +and safer by giving you runtime debugging, observability, reliability, and +security—all without requiring any changes to your code. + +For a brief introduction to the service mesh model, we recommend reading [The +Service Mesh: What Every Software Engineer Needs to Know about the World's Most +Over-Hyped Technology](https://servicemesh.io/). + +Linkerd is fully open source, licensed under [Apache +v2](https://github.com/linkerd/linkerd2/blob/main/LICENSE), and is a [Cloud +Native Computing Foundation](https://cncf.io) graduated project. Linkerd is +developed in the open in the [Linkerd GitHub organization](https://github.com/linkerd). + +Linkerd has two basic components: a *control plane* and a *data plane*. Once +Linkerd's control plane has been installed on your Kubernetes cluster, you add +the data plane to your workloads (called "meshing" or "injecting" your +workloads) and voila! Service mesh magic happens. + +You can [get started with Linkerd](../getting-started/) in minutes! + +## How it works + +Linkerd works by installing a set of ultralight, transparent "micro-proxies" +next to each service instance. These proxies automatically handle all traffic to +and from the service. Because they're transparent, these proxies act as highly +instrumented out-of-process network stacks, sending telemetry to, and receiving +control signals from, the control plane. This design allows Linkerd to measure +and manipulate traffic to and from your service without introducing excessive +latency. + +In order to be as small, lightweight, and safe as possible, Linkerd's +micro-proxies are written in [Rust](https://www.rust-lang.org/) and specialized +for Linkerd. You can learn more about the these micro-proxies in our blog post, +[Under the hood of Linkerd's state-of-the-art Rust proxy, +Linkerd2-proxy](/2020/07/23/under-the-hood-of-linkerds-state-of-the-art-rust-proxy-linkerd2-proxy/), +(If you want to know why Linkerd doesn't use Envoy, you can learn why in our blog +post, [Why Linkerd doesn't use +Envoy](/2020/12/03/why-linkerd-doesnt-use-envoy/).) + +## Getting Linkerd + +Linkerd is available in a variety of packages and channels. See the [Linkerd +Releases](/releases/) page for details. + +## Next steps + +[Get started with Linkerd](../getting-started/) in minutes, or check out the +[architecture](../reference/architecture/) for more details on Linkerd's +components and how they all fit together. diff --git a/linkerd.io/content/2.17/reference/_index.md b/linkerd.io/content/2.17/reference/_index.md new file mode 100644 index 0000000000..f2045c2b56 --- /dev/null +++ b/linkerd.io/content/2.17/reference/_index.md @@ -0,0 +1,6 @@ +--- +title: Reference +weight: 5 +--- + +{{< docs/section-toc >}} diff --git a/linkerd.io/content/2.17/reference/architecture.md b/linkerd.io/content/2.17/reference/architecture.md new file mode 100644 index 0000000000..9179a450ff --- /dev/null +++ b/linkerd.io/content/2.17/reference/architecture.md @@ -0,0 +1,115 @@ +--- +title: Architecture +description: Deep dive into the architecture of Linkerd. +--- + +At a high level, Linkerd consists of a **control plane** and a **data plane**. + +The **control plane** is a set of services that and provide control over +Linkerd as a whole. + +The **data plane** consists of transparent _micro-proxies_ that run "next" to +each service instance, as sidecar containers in the pods. These proxies +automatically handle all TCP traffic to and from the service, and communicate +with the control plane for configuration. + +Linkerd also provides a **CLI** that can be used to interact with the control +and data planes. + +![Linkerd's architecture](/docs/images/architecture/control-plane.png "Linkerd's architecture") + +## CLI + +The Linkerd CLI is typically run outside of the cluster (e.g. on your local +machine) and is used to interact with the Linkerd. + +## Control plane + +The Linkerd control plane is a set of services that run in a dedicated +Kubernetes namespace (`linkerd` by default). The control plane has several +components, enumerated below. + +### The destination service + +The destination service is used by the data plane proxies to determine various +aspects of their behavior. It is used to fetch service discovery information +(i.e. where to send a particular request and the TLS identity expected on the +other end); to fetch policy information about which types of requests are +allowed; to fetch service profile information used to inform per-route metrics, +retries, and timeouts; and more. + +### The identity service + +The identity service acts as a [TLS Certificate +Authority](https://en.wikipedia.org/wiki/Certificate_authority) that accepts +[CSRs](https://en.wikipedia.org/wiki/Certificate_signing_request) from proxies +and returns signed certificates. These certificates are issued at proxy +initialization time and are used for proxy-to-proxy connections to implement +[mTLS](../../features/automatic-mtls/). + +### The proxy injector + +The proxy injector is a Kubernetes [admission +controller](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/) +that receives a webhook request every time a pod is created. This injector +inspects resources for a Linkerd-specific annotation (`linkerd.io/inject: +enabled`). When that annotation exists, the injector mutates the pod's +specification and adds the `proxy-init` and `linkerd-proxy` containers to the +pod, along with the relevant start-time configuration. + +## Data plane + +The Linkerd data plane comprises ultralight _micro-proxies_ which are deployed +as sidecar containers inside application pods. These proxies transparently +intercept TCP connections to and from each pod, thanks to iptables rules put in +place by the [linkerd-init](#linkerd-init-container) (or, alternatively, by +Linkerd's [CNI plugin](../../features/cni/)). + +### Proxy + +The Linkerd2-proxy is an ultralight, transparent _micro-proxy_ written in +[Rust](https://www.rust-lang.org/). Linkerd2-proxy is designed specifically for +the service mesh use case and is not designed as a general-purpose proxy. + +The proxy's features include: + +* Transparent, zero-config proxying for HTTP, HTTP/2, and arbitrary TCP + protocols. +* Automatic Prometheus metrics export for HTTP and TCP traffic. +* Transparent, zero-config WebSocket proxying. +* Automatic, latency-aware, layer-7 load balancing. +* Automatic layer-4 load balancing for non-HTTP traffic. +* Automatic TLS. +* An on-demand diagnostic tap API. +* And lots more. + +The proxy supports service discovery via DNS and the +[destination gRPC API](https://github.com/linkerd/linkerd2-proxy-api). + +You can read more about these micro-proxies here: + +* [Why Linkerd doesn't use Envoy](/2020/12/03/why-linkerd-doesnt-use-envoy/) +* [Under the hood of Linkerd's state-of-the-art Rust proxy, + Linkerd2-proxy](/2020/07/23/under-the-hood-of-linkerds-state-of-the-art-rust-proxy-linkerd2-proxy/) + +### Meshed Conncections + +When one pod establishes a TCP connection to another pod and both of those pods +are injected with the Linkerd proxy, we say that the connection is *meshed*. +The proxy in the pod that initiated the connection is called the *outbound* +proxy and the proxy in the pod that accepted the connection is called the +*inbound* proxy. + +The *outbound* proxy is responsible for service discovery, load balancing, +circuit breakers, retries, and timeouts. The *inbound* proxy is responsible for +enforcing authorization policy. Both *inbound* and *outbound* proxies report +traffic metrics about the traffic they send and receive. + +### Linkerd init container + +The `linkerd-init` container is added to each meshed pod as a Kubernetes [init +container](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) +that runs before any other containers are started. It [uses +iptables](../iptables/) to route all TCP traffic to and from the pod through +the proxy. Linkerd's init container can be run in [different +modes](../../features/nft/) which determine what iptables variant is used. diff --git a/linkerd.io/content/2.17/reference/authorization-policy.md b/linkerd.io/content/2.17/reference/authorization-policy.md new file mode 100644 index 0000000000..3bbc98c618 --- /dev/null +++ b/linkerd.io/content/2.17/reference/authorization-policy.md @@ -0,0 +1,562 @@ +--- +title: Authorization Policy +description: Reference guide to Linkerd's policy resources. +--- + +Linkerd's authorization policy allows you to control which types of traffic are +allowed to meshed pods. See the [Authorization Policy feature +description](../../features/server-policy/) for more information on what this +means. + +Linkerd's policy is configured using two mechanisms: + +1. A set of _default policies_, which can be set at the cluster, + namespace, and workload level through Kubernetes annotations. +2. A set of CRDs that specify fine-grained policy for specific ports, routes, + workloads, etc. + +## Default policies + +During a Linkerd install, the `proxy.defaultInboundPolicy` field is used to +specify the cluster-wide default policy. This field can be one of the following: + +- `all-unauthenticated`: allow all traffic. This is the default. +- `all-authenticated`: allow traffic from meshed clients in the same or from + a different cluster (with multi-cluster). +- `cluster-authenticated`: allow traffic from meshed clients in the same cluster. +- `cluster-unauthenticated`: allow traffic from both meshed and non-meshed clients + in the same cluster. +- `deny`: all traffic are denied. +- `audit`: Same as `all-unauthenticated` but requests get flagged in logs and + metrics. + +This cluster-wide default can be overridden for specific resources by setting +the annotation `config.linkerd.io/default-inbound-policy` on either a pod spec +or its namespace. + +## Dynamic policy resources + +For dynamic control of policy, and for finer-grained policy than what the +default polices allow, Linkerd provides a set of CRDs which control traffic +policy in the cluster: [Server], [HTTPRoute], [ServerAuthorization], +[AuthorizationPolicy], [MeshTLSAuthentication], and [NetworkAuthentication]. + +The general pattern for authorization is: + +- A `Server` describes a set of pods, and a single port on those pods. +- Optionally, an `HTTPRoute` references that `Server` and describes a + subset of HTTP traffic to it. +- A `MeshTLSAuthentication` or `NetworkAuthentication` decribes who + is allowed access. +- An `AuthorizationPolicy` references the `HTTPRoute` or `Server` + (the thing to be authorized) and the `MeshTLSAuthentication` or + `NetworkAuthentication` (the clients that have authorization). + +## Server + +A `Server` selects a port on a set of pods in the same namespace as the server. +It typically selects a single port on a pod, though it may select multiple ports +when referring to the port by name (e.g. `admin-http`). While the `Server` +resource is similar to a Kubernetes `Service`, it has the added restriction that +multiple `Server` instances must not overlap: they must not select the same +pod/port pairs. Linkerd ships with an admission controller that prevents +overlapping `Server`s from being created. + +{{< note >}} +When a Server resource is present, all traffic to the port on its pods will be +denied unless explicitly authorized or audit mode is enabled (with +`accessPolicy:audit`). Thus, Servers are typically paired with e.g. an +AuthorizationPolicy that references the Server, or that reference an HTTPRoute +that in turn references the Server. +{{< /note >}} + +### Server Spec + +A `Server` spec may contain the following top level fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `accessPolicy`| [accessPolicy](#accesspolicy) declares the policy applied to traffic not matching any associated authorization policies (defaults to `deny`). | +| `podSelector`| A [podSelector](#podselector) selects pods in the same namespace. | +| `port`| A port name or number. Only ports in a pod spec's `ports` are considered. | +| `proxyProtocol`| Configures protocol discovery for inbound connections. Supersedes the `config.linkerd.io/opaque-ports` annotation. Must be one of `unknown`,`HTTP/1`,`HTTP/2`,`gRPC`,`opaque`,`TLS`. Defaults to `unknown` if not set. | +{{< /keyval >}} + +#### accessPolicy + +Traffic that doesn't conform to the authorization policies associated to the +Server are denied by default. You can alter that behavior by overriding the +`accessPolicy` field, which accepts the same values as the [default +policies](#default-policies). Of particular interest is the `audit` value, which +enables [audit mode](../../features/server-policy/#audit-mode), that you can use +to test policies before enforcing them. + +#### podSelector + +This is the [same labelSelector field in Kubernetes](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/label-selector/#LabelSelector). +All the pods that are part of this selector will be part of the [Server] group. +A podSelector object must contain _exactly one_ of the following fields: + +{{< keyval >}} +| field | value | +|-------|-------| +| `matchExpressions` | matchExpressions is a list of label selector requirements. The requirements are ANDed. | +| `matchLabels` | matchLabels is a map of {key,value} pairs. | +{{< /keyval >}} + +See [the Kubernetes LabelSelector reference](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/label-selector/#LabelSelector) +for more details. + +### Server Examples + +A [Server] that selects over pods with a specific label, with `gRPC` as +the `proxyProtocol`. + +```yaml +apiVersion: policy.linkerd.io/v1beta1 +kind: Server +metadata: + namespace: emojivoto + name: emoji-grpc +spec: + podSelector: + matchLabels: + app: emoji-svc + port: grpc + proxyProtocol: gRPC +``` + +A [Server] that selects over pods with `matchExpressions`, with `HTTP/2` +as the `proxyProtocol`, on port `8080`. + +```yaml +apiVersion: policy.linkerd.io/v1beta1 +kind: Server +metadata: + namespace: emojivoto + name: backend-services +spec: + podSelector: + matchExpressions: + - {key: app, operator: In, values: [voting-svc, emoji-svc]} + - {key: environment, operator: NotIn, values: [dev]} + port: 8080 + proxyProtocol: "HTTP/2" +``` + +## HTTPRoute + +When attached to a [Server], an `HTTPRoute` resource represents a subset of the +traffic handled by the ports on pods referred in that Server, by declaring a set +of rules which determine which requests match. Matches can be based on path, +headers, query params, and/or verb. [AuthorizationPolicies] may target +`HTTPRoute` resources, thereby authorizing traffic to that `HTTPRoute` only +rather than to the entire [Server]. `HTTPRoutes` may also define filters which +add processing steps that must be completed during the request or response +lifecycle. + +{{< note >}} +A given HTTP request can only match one HTTPRoute. If multiple HTTPRoutes +are present that match a request, one will be picked according to the [Gateway +API rules of +precendence](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1beta1.HTTPRouteSpec). +{{< /note >}} + +Please refer to HTTPRoute's full [spec](../httproute/). + +{{< note >}} +Two versions of the HTTPRoute resource may be used with Linkerd: + +- The upstream version provided by the Gateway API, with the + `gateway.networking.k8s.io` API group +- A Linkerd-specific CRD provided by Linkerd, with the `policy.linkerd.io` API + group + +The two HTTPRoute resource definitions are similar, but the Linkerd version +implements experimental features not yet available with the upstream Gateway API +resource definition. See [the HTTPRoute reference +documentation](../httproute/#linkerd-and-gateway-api-httproutes) +for details. +{{< /note >}} + +## AuthorizationPolicy + +An AuthorizationPolicy provides a way to authorize traffic to a [Server] or an +[HTTPRoute]. AuthorizationPolicies are a replacement for [ServerAuthorizations] +which are more flexible because they can target [HTTPRoutes] instead of only +being able to target [Servers]. + +### AuthorizationPolicy Spec + +An `AuthorizationPolicy` spec may contain the following top level fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `targetRef`| A [TargetRef](#targetref) which references a resource to which the authorization policy applies.| +| `requiredAuthenticationRefs`| A list of [TargetRefs](#targetref) representing the required authentications. In the case of multiple entries, _all_ authentications must match.| +{{< /keyval >}} + +#### targetRef + +A `TargetRef` identifies an API object to which this AuthorizationPolicy +applies. The API objects supported are: + +- A [Server], indicating that the AuthorizationPolicy applies to all traffic to + the Server. +- An [HTTPRoute], indicating that the AuthorizationPolicy applies to all traffic + matching the HTTPRoute. +- A namespace (`kind: Namespace`), indicating that the AuthorizationPolicy + applies to all traffic to all [Servers] and [HTTPRoutes] defined in the + namespace. + +{{< keyval >}} +| field| value | +|------|-------| +| `group`| Group is the group of the target resource. For namespace kinds, this should be omitted.| +| `kind`| Kind is kind of the target resource.| +| `namespace`| The namespace of the target resource. When unspecified (or empty string), this refers to the local namespace of the policy.| +| `name`| Name is the name of the target resource.| +{{< /keyval >}} + +### AuthorizationPolicy Examples + +An `AuthorizationPolicy` which authorizes clients that satisfy the +`authors-get-authn` authentication to send to the `authors-get-route` +[HTTPRoute]. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: AuthorizationPolicy +metadata: + name: authors-get-policy + namespace: booksapp +spec: + targetRef: + group: policy.linkerd.io + kind: HTTPRoute + name: authors-get-route + requiredAuthenticationRefs: + - name: authors-get-authn + kind: MeshTLSAuthentication + group: policy.linkerd.io +``` + +An `AuthorizationPolicy` which authorizes the `webapp` `ServiceAccount` to send +to the `authors` [Server]. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: AuthorizationPolicy +metadata: + name: authors-policy + namespace: booksapp +spec: + targetRef: + group: policy.linkerd.io + kind: Server + name: authors + requiredAuthenticationRefs: + - name: webapp + kind: ServiceAccount +``` + +An `AuthorizationPolicy` which authorizes the `webapp` `ServiceAccount` to send +to all policy "targets" within the `booksapp` namespace. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: AuthorizationPolicy +metadata: + name: authors-policy + namespace: booksapp +spec: + targetRef: + kind: Namespace + name: booksapp + requiredAuthenticationRefs: + - name: webapp + kind: ServiceAccount +``` + +## MeshTLSAuthentication + +A `MeshTLSAuthentication` represents a set of mesh identities. When an +[AuthorizationPolicy] has a `MeshTLSAuthentication` as one of its +`requiredAuthenticationRefs`, this means that clients must be in the mesh and +must have one of the specified identities in order to be authorized to send +to the target. + +### MeshTLSAuthentication Spec + +A `MeshTLSAuthentication` spec may contain the following top level fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `identities`| A list of mTLS identities to authenticate. The `*` prefix can be used to match all identities in a domain. An identity string of `*` indicates that all meshed clients are authorized.| +| `identityRefs`| A list of [targetRefs](#targetref) to `ServiceAccounts` to authenticate.| +{{< /keyval >}} + +### MeshTLSAuthentication Examples + +A `MeshTLSAuthentication` which authenticates the `books` and `webapp` mesh +identities. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: MeshTLSAuthentication +metadata: + name: authors-get-authn + namespace: booksapp +spec: + identities: + - "books.booksapp.serviceaccount.identity.linkerd.cluster.local" + - "webapp.booksapp.serviceaccount.identity.linkerd.cluster.local" +``` + +A `MeshTLSAuthentication` which authenticate thes `books` and `webapp` mesh +identities. This is an alternative way to specify the same thing as the above +example. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: MeshTLSAuthentication +metadata: + name: authors-get-authn + namespace: booksapp +spec: + identityRefs: + - kind: ServiceAccount + name: books + - kind: ServiceAccount + name: webapp +``` + +A `MeshTLSAuthentication` which authenticates all meshed identities. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: MeshTLSAuthentication +metadata: + name: authors-get-authn + namespace: booksapp +spec: + identities: ["*"] +``` + +## NetworkAuthentication + +A `NetworkAuthentication` represents a set of IP subnets. When an +[AuthorizationPolicy] has a `NetworkAuthentication` as one of its +`requiredAuthenticationRefs`, this means that clients must be in one of the +specified networks in order to be authorized to send to the target. + +### NetworkAuthentication Spec + +A `NetworkAuthentication` spec may contain the following top level fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `networks`| A list of [networks](#network) to authenticate.| +{{< /keyval >}} + +#### network + +A `network` defines an authenticated IP subnet. + +{{< keyval >}} +| field| value | +|------|-------| +| `cidr`| A subnet in CIDR notation to authenticate.| +| `except`| A list of subnets in CIDR notation to exclude from the authentication.| +{{< /keyval >}} + +### NetworkAuthentication Examples + +A `NetworkAuthentication` that authenticates clients which belong to any of +the specified CIDRs. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: NetworkAuthentication +metadata: + name: cluster-network + namespace: booksapp +spec: + networks: + - cidr: 10.0.0.0/8 + - cidr: 100.64.0.0/10 + - cidr: 172.16.0.0/12 + - cidr: 192.168.0.0/16 +``` + +## ServerAuthorization + +A [ServerAuthorization] provides a way to authorize traffic to one or more +[Server]s. + +{{< note >}} +[AuthorizationPolicy](#authorizationpolicy) is a more flexible alternative to +`ServerAuthorization` that can target [HTTPRoutes](#httproute) as well as +[Servers](#server). Use of [AuthorizationPolicy](#authorizationpolicy) is +preferred, and `ServerAuthorization` will be deprecated in future releases. +{{< /note >}} + +### ServerAuthorization Spec + +A ServerAuthorization spec must contain the following top level fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `client`| A [client](#client) describes clients authorized to access a server. | +| `server`| A [serverRef](#serverref) identifies `Servers` in the same namespace for which this authorization applies. | +{{< /keyval >}} + +#### serverRef + +A `serverRef` object must contain _exactly one_ of the following fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `name`| References a `Server` instance by name. | +| `selector`| A [selector](#selector) selects servers on which this authorization applies in the same namespace. | +{{< /keyval >}} + +#### selector + +This is the [same labelSelector field in Kubernetes](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/label-selector/#LabelSelector). +All the servers that are part of this selector will have this authorization applied. +A selector object must contain _exactly one_ of the following fields: + +{{< keyval >}} +| field | value | +|-------|-------| +| `matchExpressions` | A list of label selector requirements. The requirements are ANDed. | +| `matchLabels` | A map of {key,value} pairs. | +{{< /keyval >}} + +See [the Kubernetes LabelSelector reference](https://kubernetes.io/docs/reference/kubernetes-api/common-definitions/label-selector/#LabelSelector) +for more details. + +#### client + +A `client` object must contain _exactly one_ of the following fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `meshTLS`| A [meshTLS](#meshtls) is used to authorize meshed clients to access a server. | +| `unauthenticated`| A boolean value that authorizes unauthenticated clients to access a server. | +{{< /keyval >}} + +Optionally, it can also contain the `networks` field: + +{{< keyval >}} +| field| value | +|------|-------| +| `networks`| Limits the client IP addresses to which this authorization applies. If unset, the server chooses a default (typically, all IPs or the cluster's pod network). | +{{< /keyval >}} + +#### meshTLS + +A `meshTLS` object must contain _exactly one_ of the following fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `unauthenticatedTLS`| A boolean to indicate that no client identity is required for communication. This is mostly important for the identity controller, which must terminate TLS connections from clients that do not yet have a certificate. | +| `identities`| A list of proxy identity strings (as provided via mTLS) that are authorized. The `*` prefix can be used to match all identities in a domain. An identity string of `*` indicates that all authentication clients are authorized. | +| `serviceAccounts`| A list of authorized client [serviceAccount](#serviceAccount)s (as provided via mTLS). | +{{< /keyval >}} + +#### serviceAccount + +A serviceAccount field contains the following top level fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `name`| The ServiceAccount's name. | +| `namespace`| The ServiceAccount's namespace. If unset, the authorization's namespace is used. | +{{< /keyval >}} + +### ServerAuthorization Examples + +A [ServerAuthorization] that allows meshed clients with +`*.emojivoto.serviceaccount.identity.linkerd.cluster.local` proxy identity i.e. all +service accounts in the `emojivoto` namespace. + +```yaml +apiVersion: policy.linkerd.io/v1beta1 +kind: ServerAuthorization +metadata: + namespace: emojivoto + name: emoji-grpc +spec: + # Allow all authenticated clients to access the (read-only) emoji service. + server: + selector: + matchLabels: + app: emoji-svc + client: + meshTLS: + identities: + - "*.emojivoto.serviceaccount.identity.linkerd.cluster.local" +``` + +A [ServerAuthorization] that allows any unauthenticated +clients. + +```yaml +apiVersion: policy.linkerd.io/v1beta1 +kind: ServerAuthorization +metadata: + namespace: emojivoto + name: web-public +spec: + server: + name: web-http + # Allow all clients to access the web HTTP port without regard for + # authentication. If unauthenticated connections are permitted, there is no + # need to describe authenticated clients. + client: + unauthenticated: true + networks: + - cidr: 0.0.0.0/0 + - cidr: ::/0 +``` + +A [ServerAuthorization] that allows meshed clients with a +specific service account. + +```yaml +apiVersion: policy.linkerd.io/v1beta1 +kind: ServerAuthorization +metadata: + namespace: emojivoto + name: prom-prometheus +spec: + server: + name: prom + client: + meshTLS: + serviceAccounts: + - namespace: linkerd-viz + name: prometheus +``` + +[Server]: #server +[Servers]: #server +[HTTPRoute]: #httproute +[HTTPRoutes]: #httproute +[ServerAuthorization]: #serverauthorization +[ServerAuthorizations]: #serverauthorization +[AuthorizationPolicy]: #authorizationpolicy +[AuthorizationPolicies]: #authorizationpolicy +[MeshTLSAuthentication]: #meshtlsauthentication +[NetworkAuthentication]: #networkauthentication diff --git a/linkerd.io/content/2.17/reference/circuit-breaking.md b/linkerd.io/content/2.17/reference/circuit-breaking.md new file mode 100644 index 0000000000..c8ec1877ae --- /dev/null +++ b/linkerd.io/content/2.17/reference/circuit-breaking.md @@ -0,0 +1,155 @@ +--- +title: Circuit Breaking +description: How Linkerd implements circuit breaking. +--- + +[_Circuit breaking_][circuit-breaker] is a pattern for improving the reliability +of distributed applications. In circuit breaking, an application which makes +network calls to remote backends monitors whether those calls succeed or fail, +in an attempt to determine whether that backend is in a failed state. If a +given backend is believed to be in a failed state, its circuit breaker is +"tripped", and no subsequent requests are sent to that backend until it is +determined to have returned to normal. + +The Linkerd proxy is capable of performing endpoint-level circuit breaking on +HTTP requests using a configurable failure accrual strategy. This means that the +Linkerd proxy performs circuit breaking at the level of individual endpoints +in a [load balancer](../../features/load-balancing/) (i.e., each Pod in a given +Service), and failures are tracked at the level of HTTP response status codes. + +Circuit breaking is a client-side behavior, and is therefore performed by the +[outbound] side of the Linkerd proxy.[^1] Outbound proxies implement circuit +breaking in the load balancer, by marking failing endpoints as _unavailable_. +When an endpoint is unavailable, the load balancer will not select it when +determining where to send a given request. This means that if only some +endpoints have tripped their circuit breakers, the proxy will simply not select +those endpoints while they are in a failed state. When all endpoints in a load +balancer are unavailable, requests may be failed with [503 Service Unavailable] +errors, or, if the Service is one of multiple [`backendRef`s in an +HTTPRoute](../httproute/#httpbackendref), the entire backend Service will be +considered unavailable and a different backend may be selected. + +The [`outbound_http_balancer_endpoints` gauge metric][metric] reports the number +of "ready" and "pending" endpoints in a load balancer, with the "pending" number +including endpoints made unavailable by failure accrual. + +## Failure Accrual Policies + +A _failure accrual policy_ determines how failures are tracked for endpoints, +and what criteria result in an endpoint becoming unavailable ("tripping the +circuit breaker"). Currently, the Linkerd proxy implements one failure accrual +policy, _consecutive failures_. Additional failure accrual policies may be +added in the future. + +{{< note >}} +HTTP responses are classified as _failures_ if their status code is a [5xx +server error]. Future Linkerd releases may add support for configuring what +status codes are classified as failures. +{{}} + +### Consecutive Failures + +In this failure accrual policy, an endpoint is marked as failing after a +configurable number of failures occur _consecutively_ (i.e., without any +successes). For example, if the maximum number of failures is 7, the endpoint is +made unavailable once 7 failures occur in a row with no successes. + +## Probation and Backoffs + +Once a failure accrual policy makes an endpoint unavailble, the circuit breaker +will attempt to determine whether the endpoint is still in a failing state, and +transition it back to available if it has recovered. This process is called +_probation_. When an endpoint enters probation, it is temporarily made available +to the load balancer again, and permitted to handle a single request, called a +_probe request_. If this request succeeds, the endpoint is no longer considered +failing, and is once again made available. If the probe request fails, the +endpoint remains unavailable, and another probe request will be issued after a +backoff. + +{{< note >}} +In the context of HTTP failure accrual, a probe request is an actual application +request, and should not be confused with HTTP readiness and liveness probes. +This means that a circuit breaker will not allow an endpoint to exit probation +just because it responds successfully to health checks — actual +application traffic must succeed for the endpoint to become available again. +{{}} + +When an endpoint's failure accrual policy trips the circuit breaker, it will +remain unavailble for at least a _minimum penalty_ duration. After this duration +has elapsed, the endpoint will enter probation. When a probe request fails, the +endpoint will not be placed in probation again until a backoff duration has +elapsed. Every time a probe request fails, [the backoff increases +exponentially][exp-backoff], up to an upper bound set by the _maximum penalty_ +duration. + +An amount of random noise, called _jitter_, is added to each backoff +duration. Jitter is controlled by a parameter called the _jitter ratio_, a +floating-point number from 0.0 to 100.0, which represents the maximum percentage +of the original backoff duration which may be added as jitter. + +## Configuring Failure Accrual + +HTTP failure accrual is configured by a set of annotations. When these +annotations are added to a Kubernetes Service, client proxies will perform +HTTP failure accrual when communicating with endpoints of that Service. If no +failure accrual annotations are present on a Service, proxies will not perform +failure accrual. + +{{< warning >}} +Circuit breaking is **incompatible with ServiceProfiles**. If a +[ServiceProfile](../../features/service-profiles/) is defined for the annotated +Service, proxies will not perform circuit breaking as long as the ServiceProfile +exists. +{{< /warning >}} + +{{< note >}} +Some failure accrual annotations have values which represent a duration. +Durations are specified as a positive integer, followed by a unit, which may be +one of: `ms` for milliseconds, `s` for seconds, `m` for minutes, `h` for hours, +or `d` for days. +{{}} + +Set this annotation on a Service to enable meshed clients to use circuit +breaking when sending traffic to that Service: + ++ `balancer.linkerd.io/failure-accrual`: Selects the [failure accrual + policy](#failure-accrual-policies) used + when communicating with this Service. If this is not present, no failure + accrual is performed. Currently, the only supported value for this annotation + is `"consecutive"`, to perform [consecutive failures failure + accrual](#consecutive-failures). + +When the failure accrual mode is `"consecutive"`, the following annotations +configure parameters for the consecutive-failures failure accrual policy: + ++ `balancer.linkerd.io/failure-accrual-consecutive-max-failures`: Sets the + number of consecutive failures which must occur before an endpoint is made + unavailable. Must be an integer. If this annotation is not present, the + default value is 7. ++ `balancer.linkerd.io/failure-accrual-consecutive-min-penalty`: Sets the + minumum penalty duration for which an endpoint will be marked as unavailable + after `max-failures` consecutive failures occur. After this period of time + elapses, the endpoint will be [probed](#probation-and-backoffs). This duration + must be non-zero, and may not be greater than the max-penalty duration. If this + annotation is not present, the default value is one second (`1s`). ++ `balancer.linkerd.io/failure-accrual-consecutive-max-penalty`: Sets the + maximum penalty duration for which an endpoint will be marked as unavailable + after `max-failures` consecutive failures occur. This is an upper bound on the + duration between [probe requests](#probation-and-backoffs). This duration + must be non-zero, and must be greater than the min-penalty duration. If this + annotation is not present, the default value is one minute (`1m`). ++ `balancer.linkerd.io/failure-accrual-consecutive-jitter-ratio`: Sets the + jitter ratio used for [probation backoffs](#probation-and-backoffs). This is a + floating-point number, and must be between 0.0 and 100.0. If this annotation + is not present, the default value is 0.5. + +[^1]: The part of the proxy which handles connections from within the pod to the + rest of the cluster. + +[circuit-breaker]: https://www.martinfowler.com/bliki/CircuitBreaker.html +[503 Service Unavailable]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/503 +[metric]: ../proxy-metrics/#outbound-xroute-metrics +[5xx server error]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status#server_error_responses +[exp-backoff]: + https://aws.amazon.com/blogs/architecture/exponential-backoff-and-jitter/ +[outbound]: ../architecture/#meshed-conncections diff --git a/linkerd.io/content/2.17/reference/cli/_index.md b/linkerd.io/content/2.17/reference/cli/_index.md new file mode 100644 index 0000000000..6d7f4f8dc6 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/_index.md @@ -0,0 +1,18 @@ +--- +title: CLI +description: Reference documentation for all the CLI commands. +--- + +The Linkerd CLI is the primary way to interact with Linkerd. It can install the +control plane to your cluster, add the proxy to your service and provide +detailed metrics for how your service is performing. + +As reference, check out the commands below: + +{{< docs/cli-commands >}} + +## Global flags + +The following flags are available for *all* linkerd CLI commands: + +{{< docs/cli-global-flags >}} diff --git a/linkerd.io/content/2.17/reference/cli/authz.md b/linkerd.io/content/2.17/reference/cli/authz.md new file mode 100644 index 0000000000..4c2fa226bb --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/authz.md @@ -0,0 +1,11 @@ +--- +title: authz +--- + +{{< docs/cli-description "authz" >}} + +Check out the [Authorization Policy](../../../reference/authorization-policy/) +and [Restricting Access to Services](../../../tasks/restricting-access/) +documentation for all the details about authorization policy in Linkerd. + +{{< docs/cli-flags "authz" >}} diff --git a/linkerd.io/content/2.17/reference/cli/check.md b/linkerd.io/content/2.17/reference/cli/check.md new file mode 100644 index 0000000000..4a2724c7df --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/check.md @@ -0,0 +1,56 @@ +--- +title: check +--- + +{{< docs/cli-description "check" >}} + +Take a look at the [troubleshooting](../../../tasks/troubleshooting/) documentation +for a full list of all the possible checks, what they do and how to fix them. + +{{< docs/cli-examples "check" >}} + +## Example output + +```bash +$ linkerd check +kubernetes-api +-------------- +√ can initialize the client +√ can query the Kubernetes API + +kubernetes-version +------------------ +√ is running the minimum Kubernetes API version + +linkerd-existence +----------------- +√ control plane namespace exists +√ controller pod is running +√ can initialize the client +√ can query the control plane API + +linkerd-api +----------- +√ control plane pods are ready +√ control plane self-check +√ [kubernetes] control plane can talk to Kubernetes +√ [prometheus] control plane can talk to Prometheus + +linkerd-service-profile +----------------------- +√ no invalid service profiles + +linkerd-version +--------------- +√ can determine the latest version +√ cli is up-to-date + +control-plane-version +--------------------- +√ control plane is up-to-date +√ control plane and cli versions match + +Status check results are √ +``` + +{{< docs/cli-flags "check" >}} diff --git a/linkerd.io/content/2.17/reference/cli/completion.md b/linkerd.io/content/2.17/reference/cli/completion.md new file mode 100644 index 0000000000..40e8438b72 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/completion.md @@ -0,0 +1,9 @@ +--- +title: completion +--- + +{{< docs/cli-description "completion" >}} + +{{< docs/cli-examples "completion" >}} + +{{< docs/cli-flags "completion" >}} diff --git a/linkerd.io/content/2.17/reference/cli/diagnostics.md b/linkerd.io/content/2.17/reference/cli/diagnostics.md new file mode 100644 index 0000000000..740a753b09 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/diagnostics.md @@ -0,0 +1,43 @@ +--- +title: diagnostics +--- + +{{< docs/cli-description "diagnostics" >}} + +{{< docs/cli-examples "diagnostics" >}} + +{{< docs/cli-flags "diagnostics" >}} + +## Subcommands + +### controller-metrics + +{{< docs/cli-description "diagnostics controller-metrics" >}} + +{{< docs/cli-examples "diagnostics controller-metrics" >}} + +{{< docs/cli-flags "diagnostics controller-metrics" >}} + +### endpoints + +{{< docs/cli-description "diagnostics endpoints" >}} + +{{< docs/cli-examples "diagnostics endpoints" >}} + +{{< docs/cli-flags "diagnostics endpoints" >}} + +### install-sp + +{{< docs/cli-description "diagnostics install-sp" >}} + +{{< docs/cli-examples "diagnostics install-sp" >}} + +{{< docs/cli-flags "diagnostics install-sp" >}} + +### proxy-metrics + +{{< docs/cli-description "diagnostics proxy-metrics" >}} + +{{< docs/cli-examples "diagnostics proxy-metrics" >}} + +{{< docs/cli-flags "diagnostics proxy-metrics" >}} diff --git a/linkerd.io/content/2.17/reference/cli/identity.md b/linkerd.io/content/2.17/reference/cli/identity.md new file mode 100644 index 0000000000..576d175930 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/identity.md @@ -0,0 +1,9 @@ +--- +title: identity +--- + +{{< docs/cli-description "identity" >}} + +{{< docs/cli-examples "identity" >}} + +{{< docs/cli-flags "identity" >}} diff --git a/linkerd.io/content/2.17/reference/cli/inject.md b/linkerd.io/content/2.17/reference/cli/inject.md new file mode 100644 index 0000000000..7c8f1ea298 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/inject.md @@ -0,0 +1,24 @@ +--- +title: inject +--- + +The `inject` command is a text transform that modifies Kubernetes manifests +passed to it either as a file or as a stream (`-`) to adds a +`linkerd.io/inject: enabled` annotation to eligible resources in the manifest. +When the resulting annotated manifest is applied to the Kubernetes cluster, +Linkerd's [proxy autoinjector](../../../features/proxy-injection/) automatically +adds the Linkerd data plane proxies to the corresponding pods. + +Note that there is no *a priori* reason to use this command. In production, +these annotations may be instead set by a CI/CD system, or any other +deploy-time mechanism. + +## Manual injection + +Alternatively, this command can also perform the full injection purely on the +client side, by enabling with the `--manual` flag. (Prior to Linkerd 2.4, this +was the default behavior.) + +{{< docs/cli-examples "inject" >}} + +{{< docs/cli-flags "inject" >}} diff --git a/linkerd.io/content/2.17/reference/cli/install-cni.md b/linkerd.io/content/2.17/reference/cli/install-cni.md new file mode 100644 index 0000000000..c7c457a6f1 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/install-cni.md @@ -0,0 +1,9 @@ +--- +title: install-cni +--- + +{{< docs/cli-description "install-cni" >}} + +{{< docs/cli-examples "install-cni" >}} + +{{< docs/cli-flags "install-cni" >}} diff --git a/linkerd.io/content/2.17/reference/cli/install.md b/linkerd.io/content/2.17/reference/cli/install.md new file mode 100644 index 0000000000..3610734968 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/install.md @@ -0,0 +1,12 @@ +--- +title: install +--- + +{{< docs/cli-description "install" >}} + +For further details on how to install Linkerd onto your own cluster, check out +the [install documentation](../../../tasks/install/). + +{{< docs/cli-examples "install" >}} + +{{< docs/cli-flags "install" >}} diff --git a/linkerd.io/content/2.17/reference/cli/jaeger.md b/linkerd.io/content/2.17/reference/cli/jaeger.md new file mode 100644 index 0000000000..a4792690c3 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/jaeger.md @@ -0,0 +1,51 @@ +--- +title: jaeger +--- + +{{< docs/cli-description "jaeger" >}} + +{{< docs/cli-examples "jaeger" >}} + +{{< docs/cli-flags "jaeger" >}} + +## Subcommands + +### check + +{{< docs/cli-description "jaeger check" >}} + +{{< docs/cli-examples "jaeger check" >}} + +{{< docs/cli-flags "jaeger check" >}} + +### dashboard + +{{< docs/cli-description "jaeger dashboard" >}} + +{{< docs/cli-examples "jaeger dashboard" >}} + +{{< docs/cli-flags "jaeger dashboard" >}} + +### install + +{{< docs/cli-description "jaeger install" >}} + +{{< docs/cli-examples "jaeger install" >}} + +{{< docs/cli-flags "jaeger install" >}} + +### list + +{{< docs/cli-description "jaeger list" >}} + +{{< docs/cli-examples "jaeger list" >}} + +{{< docs/cli-flags "jaeger list" >}} + +### uninstall + +{{< docs/cli-description "jaeger uninstall" >}} + +{{< docs/cli-examples "jaeger uninstall" >}} + +{{< docs/cli-flags "jaeger uninstall" >}} diff --git a/linkerd.io/content/2.17/reference/cli/multicluster.md b/linkerd.io/content/2.17/reference/cli/multicluster.md new file mode 100644 index 0000000000..912d45cab0 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/multicluster.md @@ -0,0 +1,67 @@ +--- +title: multicluster +--- + +{{< docs/cli-description "multicluster" >}} + +{{< docs/cli-examples "multicluster" >}} + +{{< docs/cli-flags "multicluster" >}} + +## Subcommands + +### allow + +{{< docs/cli-description "multicluster allow" >}} + +{{< docs/cli-examples "multicluster allow" >}} + +{{< docs/cli-flags "multicluster allow" >}} + +### check + +{{< docs/cli-description "multicluster check" >}} + +{{< docs/cli-examples "multicluster check" >}} + +{{< docs/cli-flags "multicluster check" >}} + +### gateways + +{{< docs/cli-description "multicluster gateways" >}} + +{{< docs/cli-examples "multicluster gateways" >}} + +{{< docs/cli-flags "multicluster gateways" >}} + +### install + +{{< docs/cli-description "multicluster install" >}} + +{{< docs/cli-examples "multicluster install" >}} + +{{< docs/cli-flags "multicluster install" >}} + +### link + +{{< docs/cli-description "multicluster link" >}} + +{{< docs/cli-examples "multicluster link" >}} + +{{< docs/cli-flags "multicluster link" >}} + +### uninstall + +{{< docs/cli-description "multicluster uninstall" >}} + +{{< docs/cli-examples "multicluster uninstall" >}} + +{{< docs/cli-flags "multicluster uninstall" >}} + +### unlink + +{{< docs/cli-description "multicluster unlink" >}} + +{{< docs/cli-examples "multicluster unlink" >}} + +{{< docs/cli-flags "multicluster unlink" >}} diff --git a/linkerd.io/content/2.17/reference/cli/profile.md b/linkerd.io/content/2.17/reference/cli/profile.md new file mode 100644 index 0000000000..abd573d34b --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/profile.md @@ -0,0 +1,13 @@ +--- +title: profile +--- + +{{< docs/cli-description "profile" >}} + +Check out the [service profile](../../../features/service-profiles/) +documentation for more details on what this command does and what you can do +with service profiles. + +{{< docs/cli-examples "profile" >}} + +{{< docs/cli-flags "profile" >}} diff --git a/linkerd.io/content/2.17/reference/cli/prune.md b/linkerd.io/content/2.17/reference/cli/prune.md new file mode 100644 index 0000000000..68675991ed --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/prune.md @@ -0,0 +1,9 @@ +--- +title: prune +--- + +{{< docs/cli-description "prune" >}} + +{{< docs/cli-examples "prune" >}} + +{{< docs/cli-flags "prune" >}} diff --git a/linkerd.io/content/2.17/reference/cli/uninject.md b/linkerd.io/content/2.17/reference/cli/uninject.md new file mode 100644 index 0000000000..9ad619698a --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/uninject.md @@ -0,0 +1,9 @@ +--- +title: uninject +--- + +{{< docs/cli-description "uninject" >}} + +{{< docs/cli-examples "uninject" >}} + +{{< docs/cli-flags "uninject" >}} diff --git a/linkerd.io/content/2.17/reference/cli/uninstall.md b/linkerd.io/content/2.17/reference/cli/uninstall.md new file mode 100644 index 0000000000..d5e00031ed --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/uninstall.md @@ -0,0 +1,9 @@ +--- +title: uninstall +--- + +{{< docs/cli-description "uninstall" >}} + +{{< docs/cli-examples "uninstall" >}} + +{{< docs/cli-flags "uninstall" >}} diff --git a/linkerd.io/content/2.17/reference/cli/upgrade.md b/linkerd.io/content/2.17/reference/cli/upgrade.md new file mode 100644 index 0000000000..c4422b57c9 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/upgrade.md @@ -0,0 +1,9 @@ +--- +title: upgrade +--- + +{{< docs/cli-description "upgrade" >}} + +{{< docs/cli-examples "upgrade" >}} + +{{< docs/cli-flags "upgrade" >}} diff --git a/linkerd.io/content/2.17/reference/cli/version.md b/linkerd.io/content/2.17/reference/cli/version.md new file mode 100644 index 0000000000..159f0b2f65 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/version.md @@ -0,0 +1,9 @@ +--- +title: version +--- + +{{< docs/cli-description "version" >}} + +{{< docs/cli-examples "version" >}} + +{{< docs/cli-flags "version" >}} diff --git a/linkerd.io/content/2.17/reference/cli/viz.md b/linkerd.io/content/2.17/reference/cli/viz.md new file mode 100644 index 0000000000..8e313a47d3 --- /dev/null +++ b/linkerd.io/content/2.17/reference/cli/viz.md @@ -0,0 +1,175 @@ +--- +title: viz +--- + +{{< docs/cli-description "viz" >}} + +{{< docs/cli-examples "viz" >}} + +{{< docs/cli-flags "viz" >}} + +## Subcommands + +## allow-scrapes + +{{< docs/cli-description "viz allow-scrapes" >}} + +{{< docs/cli-examples "viz allow-scrapes" >}} + +{{< docs/cli-flags "viz allow-scrapes" >}} + +## authz + +{{< docs/cli-description "viz authz" >}} + +{{< docs/cli-examples "viz authz" >}} + +{{< docs/cli-flags "viz authz" >}} + +### check + +{{< docs/cli-description "viz check" >}} + +{{< docs/cli-examples "viz check" >}} + +{{< docs/cli-flags "viz check" >}} + +### dashboard + +{{< docs/cli-description "viz dashboard" >}} + +Check out the [architecture](../../architecture/#dashboard) docs for a +more thorough explanation of what this command does. + +{{< docs/cli-examples "viz dashboard" >}} + +{{< docs/cli-flags "viz dashboard" >}} + +(*) You'll need to tweak the dashboard's `enforced-host` parameter with this +value, as explained in [the DNS-rebinding protection +docs](../../../tasks/exposing-dashboard/#tweaking-host-requirement) + +### edges + +{{< docs/cli-description "viz edges" >}} + +{{< docs/cli-examples "viz edges" >}} + +{{< docs/cli-flags "viz edges" >}} + +### install + +{{< docs/cli-description "viz install" >}} + +{{< docs/cli-examples "viz install" >}} + +{{< docs/cli-flags "viz install" >}} + +### list + +{{< docs/cli-description "viz list" >}} + +{{< docs/cli-examples "viz list" >}} + +{{< docs/cli-flags "viz list" >}} + +### profile + +{{< docs/cli-description "viz profile" >}} + +{{< docs/cli-examples "viz profile" >}} + +{{< docs/cli-flags "viz profile" >}} + +### routes + +The `routes` command displays per-route service metrics. In order for +this information to be available, a service profile must be defined for the +service that is receiving the requests. For more information about how to +create a service profile, see [service profiles](../../../features/service-profiles/). +and the [profile](../../cli/profile/) command reference. + +## Inbound Metrics + +By default, `routes` displays *inbound* metrics for a target. In other +words, it shows information about requests which are sent to the target and +responses which are returned by the target. For example, the command: + +```bash +linkerd viz routes deploy/webapp +``` + +Displays the request volume, success rate, and latency of requests to the +`webapp` deployment. These metrics are from the `webapp` deployment's +perspective, which means that, for example, these latencies do not include the +network latency between a client and the `webapp` deployment. + +## Outbound Metrics + +If you specify the `--to` flag then `linkerd viz routes` displays *outbound* metrics +from the target resource to the resource in the `--to` flag. In contrast to +the inbound metrics, these metrics are from the perspective of the sender. This +means that these latencies do include the network latency between the client +and the server. For example, the command: + +```bash +linkerd viz routes deploy/traffic --to deploy/webapp +``` + +Displays the request volume, success rate, and latency of requests from +`traffic` to `webapp` from the perspective of the `traffic` deployment. + +## Effective and Actual Metrics + +If you are looking at *outbound* metrics (by specifying the `--to` flag) you +can also supply the `-o wide` flag to differentiate between *effective* and +*actual* metrics. + +Effective requests are requests which are sent by some client to the Linkerd +proxy. Actual requests are requests which the Linkerd proxy sends to some +server. If the Linkerd proxy is performing retries, one effective request can +translate into more than one actual request. If the Linkerd proxy is not +performing retries, effective requests and actual requests will always be equal. +When enabling retries, you should expect to see the actual request rate +increase and the effective success rate increase. See the +[retries and timeouts section](../../../features/retries-and-timeouts/) for more +information. + +Because retries are only performed on the *outbound* (client) side, the +`-o wide` flag can only be used when the `--to` flag is specified. + +{{< docs/cli-examples "viz routes" >}} + +{{< docs/cli-flags "viz routes" >}} + +### stat + +{{< docs/cli-description "viz stat" >}} + +{{< docs/cli-examples "viz stat" >}} + +{{< docs/cli-flags "viz stat" >}} + +### tap + +{{< docs/cli-description "viz tap" >}} + +{{< docs/cli-examples "viz tap" >}} + +{{< docs/cli-flags "viz tap" >}} + +### top + +{{< docs/cli-description "viz top" >}} + +{{< docs/cli-examples "viz top" >}} + +{{< docs/cli-flags "viz top" >}} + +### uninstall + +{{< docs/cli-description "viz uninstall" >}} + +{{< docs/cli-examples "viz uninstall" >}} + +{{< docs/cli-flags "viz uninstall" >}} diff --git a/linkerd.io/content/2.17/reference/cluster-configuration.md b/linkerd.io/content/2.17/reference/cluster-configuration.md new file mode 100644 index 0000000000..9f68f8378e --- /dev/null +++ b/linkerd.io/content/2.17/reference/cluster-configuration.md @@ -0,0 +1,134 @@ +--- +title: Cluster Configuration +description: Configuration settings unique to providers and install methods. +--- + +## GKE + +### Private Clusters + +If you are using a **private GKE cluster**, you are required to create a +firewall rule that allows the GKE operated api-server to communicate with the +Linkerd control plane. This makes it possible for features such as automatic +proxy injection to receive requests directly from the api-server. + +In this example, we will use [gcloud](https://cloud.google.com/sdk/install) to +simplify the creation of the said firewall rule. + +Setup: + +```bash +CLUSTER_NAME=your-cluster-name +gcloud config set compute/zone your-zone-or-region +``` + +Get the cluster `MASTER_IPV4_CIDR`: + +```bash +MASTER_IPV4_CIDR=$(gcloud container clusters describe $CLUSTER_NAME \ + | grep "masterIpv4CidrBlock: " \ + | awk '{print $2}') +``` + +Get the cluster `NETWORK`: + +```bash +NETWORK=$(gcloud container clusters describe $CLUSTER_NAME \ + | grep "^network: " \ + | awk '{print $2}') +``` + +Get the cluster auto-generated `NETWORK_TARGET_TAG`: + +```bash +NETWORK_TARGET_TAG=$(gcloud compute firewall-rules list \ + --filter network=$NETWORK --format json \ + | jq ".[] | select(.name | contains(\"$CLUSTER_NAME\"))" \ + | jq -r '.targetTags[0]' | head -1) +``` + +The format of the network tag should be something like `gke-cluster-name-xxxx-node`. + +Verify the values: + +```bash +echo $MASTER_IPV4_CIDR $NETWORK $NETWORK_TARGET_TAG + +# example output +10.0.0.0/28 foo-network gke-foo-cluster-c1ecba83-node +``` + +Create the firewall rules for `proxy-injector`, `policy-validator` and `tap`: + +```bash +gcloud compute firewall-rules create gke-to-linkerd-control-plane \ + --network "$NETWORK" \ + --allow "tcp:8443,tcp:8089,tcp:9443" \ + --source-ranges "$MASTER_IPV4_CIDR" \ + --target-tags "$NETWORK_TARGET_TAG" \ + --priority 1000 \ + --description "Allow traffic on ports 8443, 8089, 9443 for linkerd control-plane components" +``` + +Finally, verify that the firewall is created: + +```bash +gcloud compute firewall-rules describe gke-to-linkerd-control-plane +``` + +## Cilium + +### Turn Off Socket-Level Load Balancing + +Cilium can be configured to replace kube-proxy functionality through eBPF. When +running in kube-proxy replacement mode, connections to a `ClusterIP` service +will be established directly to the service's backend at the socket level (i.e. +during TCP connection establishment). Linkerd relies on `ClusterIPs` being +present on packets in order to do service discovery. + +When packets do not contain a `ClusterIP` address, Linkerd will instead forward +directly to the pod endpoint that was selected by Cilium. Consequentially, +while mTLS and telemetry will still function correctly, features such as peak +EWMA load balancing, and [dynamic request +routing](../../tasks/configuring-dynamic-request-routing/) may not work as +expected. + +This behavior can be turned off in Cilium by [turning off socket-level load +balancing for +pods](https://docs.cilium.io/en/v1.13/network/istio/#setup-cilium) through the +CLI option `--config bpf-lb-sock-hostns-only=true`, or through the Helm value +`socketLB.hostNamespaceOnly=true`. + +### Disable Exclusive Mode + +If you're using Cilium as your CNI and then want to install +[linkerd-cni](../../features/cni/) on top of it, make sure you install Cilium +with the option `cni.exclusive=false`. This avoids Cilium taking ownership over +the CNI configurations directory. Other CNI plugins like linkerd-cni install +themselves and operate in chain mode with the other deployed plugins by +deploying their configuration into this directory. + +## Lifecycle Hook Timeout + +Linkerd uses a `postStart` lifecycle hook for all control plane components, and +all injected workloads by default. The hook will poll proxy readiness through +[linkerd-await](https://github.com/linkerd/linkerd-await) and block the main +container from starting until the proxy is ready to handle traffic. By default, +the hook will time-out in 2 minutes. + +CNI plugins that are responsible for setting up and enforcing `NetworkPolicy` +resources can interfere with the lifecycle hook's execution. While lifecycle +hooks are running, the container will not reach a `Running` state. Some CNI +plugin implementations acquire the Pod's IP address only after all containers +have reached a running state, and the kubelet has updated the Pod's status +through the API Server. Without access to the Pod's IP, the CNI plugins will +not operate correctly. This in turn will block the proxy from being set-up, +since it does not have the necessary network connectivity. + +As a workaround, users can manually remove the `postStart` lifecycle hook from +control plane components. For injected workloads, users may opt out of the +lifecycle hook through the root-level `await: false` option, or alternatively, +behavior can be overridden at a workload or namespace level through the +annotation `config.linkerd.io/proxy-await: disabled`. Removing the hook will +allow containers to start asynchronously, unblocking network connectivity once +the CNI plugin receives the pod's IP. diff --git a/linkerd.io/content/2.17/reference/egress-network.md b/linkerd.io/content/2.17/reference/egress-network.md new file mode 100644 index 0000000000..de4510ffa3 --- /dev/null +++ b/linkerd.io/content/2.17/reference/egress-network.md @@ -0,0 +1,111 @@ +--- +title: EgressNetwork +description: Reference guide to the EgressNetwork resource. +--- + +Linkerd's [egress functionality]({{< relref "../features/egress">}}) allows +you to monitor and control traffic that leaves the cluster. This behavior is +controlled by creating `EgressNetwork` resources, which describe the properties +of traffic that leaves a cluster and provide a way to apply policies to it, using +Gateway API primitives. + +{{< warning >}} + +No service mesh can provide a strong security guarantee about egress traffic +by itself; for example, a malicious actor could bypass the Linkerd sidecar - +and thus Linkerd's egress controls - entirely. Fully restricting egress +traffic in the presence of arbitrary applications thus typically requires a +more comprehensive approach. + +{{< /warning >}} + +## EgressNetwork semantics + +An `EgressNetwork` is essentially a description for a set of traffic +destinations that reside outside the cluster. In that sense, it is comparable +to a Service, with the main difference being that a Service encompasses a single +logical destination while an `EgressNetwork` can encompass a set of +destinations. This set can vary in size - from a single IP address to the entire +network space that is not within the boundaries of the cluster. + +An `EgressNetwork` resource by default has several namespace semantics that are +worth outlining. EgressNetworks are namespaced resources, which means that they +affect only clients within the namespace that they reside in. The only exception +is EgressNetworks created in the global egress namespace: these EgressNetworks +affect clients in all namespaces. The namespace-local resources take priority. +By default the global egress namespace is set to `linkerd-egress`, but can be +configured by setting the `egress.globalEgressNetworkNamespace` Helm +value. + +## EgressNetwork Spec + +An `EgressNetwork` spec may contain the following top level fields: + +{{< keyval >}} + +| field| value | +|------|-------| +| `networks`| A set of [network specifications](#networks) that describe the address space that this `EgressNetwork` captures | +| `trafficPolicy`| the default [traffic policy](#trafficpolicy) for this resource. | +{{< /keyval >}} + +### networks + +This field is used to concretely describe the set of outside networks that this +network captures. All traffic to these destinations will be considered as +flowing to this `EgressNetwork` and subject to its traffic policy. +If an `EgressNetwork` does not specify any `networks`, the `EgressNetwork` +captures the entire IP address space except for the in-cluster networks specified +by the `clusterNetworks` value provided when Linkerd was installed. + +{{< keyval >}} + +| field| value | +|------|-------| +| `cidr`| A subnet in CIDR notation.| +| `except`| A list of subnets in CIDR notation to exclude.| +{{< /keyval >}} + +### trafficPolicy + +This field is required and must be either `Allow` or `Deny`. If `trafficPolicy` +is set to `Allow`, all traffic through this EgressNetwork will be let through +even if there is no explicit Gateway API Route that describes it. If +`trafficPolicy` is set to `Deny`, traffic through this `EgressNetwork` that +is not explicitly matched by a Route will be refused. + +## Example + +Below is an example of an `EgressNetwork` resource that will block all external +traffic except HTTPS traffic to httpbin.org on port 443. The later is done via +an explicit TLSRoute. + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: EgressNetwork +metadata: + namespace: linkerd-egress + name: all-egress-traffic +spec: + trafficPolicy: Deny +--- +apiVersion: gateway.networking.k8s.io/v1alpha2 +kind: TLSRoute +metadata: + name: tls-egress + namespace: linkerd-egress +spec: + hostnames: + - httpbin.org + parentRefs: + - name: all-egress-traffic + kind: EgressNetwork + group: policy.linkerd.io + namespace: linkerd-egress + port: 443 + rules: + - backendRefs: + - kind: EgressNetwork + group: policy.linkerd.io + name: all-egress-traffic +``` diff --git a/linkerd.io/content/2.17/reference/extension-list.md b/linkerd.io/content/2.17/reference/extension-list.md new file mode 100644 index 0000000000..2b8ca95a0a --- /dev/null +++ b/linkerd.io/content/2.17/reference/extension-list.md @@ -0,0 +1,15 @@ +--- +title: Extensions List +description: List of Linkerd extensions that can be added to the installation for + additional functionality +--- + +Linkerd provides a mix of built-in and third-party +[extensions](../../tasks/extensions/) to add additional functionality to the +base installation. The following is the list of known extensions: + +{{< docs/extensions >}} + +If you have an extension for Linkerd and it is not on the list, [please edit +this +page!](https://github.com/linkerd/website/edit/main/linkerd.io/data/extension-list.yaml) diff --git a/linkerd.io/content/2.17/reference/external-workload.md b/linkerd.io/content/2.17/reference/external-workload.md new file mode 100644 index 0000000000..21f70bf986 --- /dev/null +++ b/linkerd.io/content/2.17/reference/external-workload.md @@ -0,0 +1,105 @@ +--- +title: ExternalWorkload +--- + +Linkerd's [mesh expansion]({{< relref "../features/non-kubernetes-workloads" +>}}) functionality allows you to join workloads outside of Kubernetes into the +mesh. + +At its core, this behavior is controlled by an `ExternalWorkload` resource, +which is used by Linkerd to describe a workload that lives outside of Kubernetes +for discovery and policy. This resource contains information such as the +workload's identity, the concrete IP address as well as ports that this workload +accepts connections on. + +## ExternalWorkloads + +An ExternalWorkload is a namespace resource that defines a set of ports and an +IP address that is reachable from within the mesh. Linkerd uses that information +and translates it into `EndpointSlice`s that are then attached to `Service` objects. + +### Spec + +- `meshTLS` (required) - specified the identity information that Linkerd + requires to establish encrypted connections to this workload +- `workloadIPs` (required, at most 1) - an IP address that this workload is + reachable on +- `ports` - a list of port definitions that the workload exposes + +### MeshTLS + +- `identity` (required) - the TLS identity of the workload, proxies require this + value to establish TLS connections with the workload +- `serverName` (required) - this value is what the workload's proxy expects to + see in the `ClientHello` SNI TLS extension when other peers attempt to + initiate a TLS connection + +### Port + +- `name` - must be unique within the ports set. Each named port can be referred + to by services. +- `port` (required) - a port number that the workload is listening on +- `protocol` - protocol exposed by the port + +### Status + +- `conditions` - a list of condition objects + +### Condition + +- `lastProbeTime` - the last time the healthcheck endpoint was probed +- `lastTransitionTime` - the last time the condition transitioned from one + status to another +- `status` - status of the condition (one of True, False, Unknown) +- `type` - type of the condition (Ready is used for indicating discoverability) +- `reason` - contains a programmatic identifier indicating the reason for the + condition's last transition +- `message` - message is a human-readable message indicating details about the transition. + +## Example + +Below is an example of an `ExternalWorkload` resource that specifies a number of +ports and is selected by a service. + +```yaml +apiVersion: workload.linkerd.io/v1beta1 +kind: ExternalWorkload +metadata: + name: external-workload + namespace: mixed-env + labels: + location: vm + workload_name: external-workload +spec: + meshTLS: + identity: "spiffe://root.linkerd.cluster.local/external-workload" + serverName: "external-workload.cluster.local" + workloadIPs: + - ip: 193.1.4.11 + ports: + - port: 80 + name: http + - port: 9980 + name: admin +status: + conditions: + - type: Ready + status: "True" +--- +apiVersion: v1 +kind: Service +metadata: + name: external-workload + namespace: mixed-env +spec: + type: ClusterIP + selector: + workload_name: external-workload + ports: + - port: 80 + protocol: TCP + name: http + - port: 9980 + protocol: TCP + name: admin +``` diff --git a/linkerd.io/content/2.17/reference/httproute.md b/linkerd.io/content/2.17/reference/httproute.md new file mode 100644 index 0000000000..b94f709d58 --- /dev/null +++ b/linkerd.io/content/2.17/reference/httproute.md @@ -0,0 +1,319 @@ +--- +title: HTTPRoute +description: Reference guide to HTTPRoute resources. +--- + + + + + +## Linkerd and Gateway API HTTPRoutes + +The HTTPRoute resource was originally specified by the Kubernetes [Gateway API] +project. Linkerd currently supports two versions of the HTTPRoute resource: the +upstream version from the Gateway API, with the +`gateway.networking.kubernetes.io` API group, and a Linkerd-specific version, +with the `policy.linkerd.io` API group. While these two resource definitions are +largely the same, the `policy.linkerd.io` HTTPRoute resource is an experimental +version that contains features not yet stabilized in the upstream +`gateway.networking.k8s.io` HTTPRoute resource, such as +[timeouts](#httproutetimeouts). Both the Linkerd and Gateway API resource +definitions coexist within the same cluster, and both can be used to configure +policies for use with Linkerd. + +If the Gateway API CRDs already exist in your cluster, then Linkerd must be +installed with the `--set enableHttpRoutes=false` flag during the +`linkerd install --crds` step or with the `enableHttpRoutes=false` Helm value +when installing the `linkerd-crds` Helm chart. This avoid conflicts by +instructing Linkerd to not install the Gateway API CRDs and instead rely on the +Gateway CRDs which already exist. + +This documentation describes the `policy.linkerd.io` HTTPRoute resource. For a +similar description of the upstream Gateway API HTTPRoute resource, refer to the +Gateway API's [HTTPRoute +specification](https://gateway-api.sigs.k8s.io/references/spec/#gateway.networking.k8s.io/v1beta1.HTTPRoute). + +## HTTPRoute Spec + +An HTTPRoute spec may contain the following top level fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `parentRefs`| A set of [ParentReference](#parentreference)s which indicate which [Server]s or Services this HTTPRoute attaches to.| +| `hostnames`| A set of hostnames that should match against the HTTP Host header.| +| `rules`| An array of [HTTPRouteRules](#httprouterule).| +{{< /keyval >}} + +### parentReference + +A reference to the parent resource this HTTPRoute is a part of. + +HTTPRoutes can be attached to a [Server] to allow defining an [authorization +policy](../authorization-policy/#authorizationpolicy) for specific routes +served on that Server. + +HTTPRoutes can also be attached to a Service, in order to route requests +depending on path, headers, query params, and/or verb. Requests can then be +rerouted to different backend services. This can be used to perform [dynamic +request routing](../../tasks/configuring-dynamic-request-routing/). + +{{< warning >}} **Outbound HTTPRoutes and [ServiceProfile]s provide overlapping +configuration.** For backwards-compatibility reasons, a ServiceProfile will +take precedence over HTTPRoutes which configure the same Service. If a +ServiceProfile is defined for the parent Service of an HTTPRoute, proxies will +use the ServiceProfile configuration, rather than the HTTPRoute configuration, +as long as the ServiceProfile exists. {{< /warning >}} + +ParentReferences are namespaced, and may reference either a parent in the same +namespace as the HTTPRoute, or one in a different namespace. As described in +[GEP-1426][ns-boundaries], a HTTPRoute with a `parentRef` that references a +Service in the same namespace as the HTTPRoute is referred to as a _producer +route_, while an HTTPRoute with a `parentRef` referencing a Service in a +different namespace is referred to as a _consumer route_. A producer route will +apply to requests originating from clients in any namespace. On the other hand, +a consumer route is scoped to apply only to traffic originating in the +HTTPRoute's namespace. See the ["Namespace boundaries" section in +GEP-1426][ns-boundaries] for details on producer and consumer routes. + +{{< keyval >}} +| field| value | +|------|-------| +| `group`| The group of the referent. This must either be "policy.linkerd.io" (for Server) or "core" (for Service).| +| `kind`| The kind of the referent. This must be either "Server" or "Service".| +| `port`| The targeted port number, when attaching to Services.| +| `namespace`| The namespace of the referent. When unspecified (or empty string), this refers to the local namespace of the Route.| +| `name`| The name of the referent.| +{{< /keyval >}} + +### httpRouteRule + +HTTPRouteRule defines semantics for matching an HTTP request based on conditions +(matches) and processing it (filters). + +{{< keyval >}} +| field| value | +|------|-------| +| `matches`| A list of [httpRouteMatches](#httproutematch). Each match is independent, i.e. this rule will be matched if **any** one of the matches is satisfied.| +| `filters`| A list of [httpRouteFilters](#httproutefilter) which will be applied to each request which matches this rule.| +| `backendRefs`| An array of [HTTPBackendRefs](#httpbackendref) to declare where the traffic should be routed to (only allowed with Service [parentRefs](#parentreference)).| +| `timeouts` | An optional [httpRouteTimeouts](#httproutetimeouts) object which configures timeouts for requests matching this rule. | +{{< /keyval >}} + +### httpRouteMatch + +HTTPRouteMatch defines the predicate used to match requests to a given +action. Multiple match types are ANDed together, i.e. the match will +evaluate to true only if all conditions are satisfied. + +{{< keyval >}} +| field| value | +|------|-------| +| `path`| An [httpPathMatch](#httppathmatch). If this field is not specified, a default prefix match on the "/" path is provided.| +| `headers`| A list of [httpHeaderMatches](#httpheadermatch). Multiple match values are ANDed together.| +| `queryParams`| A list of [httpQueryParamMatches](#httpqueryparammatch). Multiple match values are ANDed together.| +| `method`| When specified, this route will be matched only if the request has the specified method.| +{{< /keyval >}} + +### httpPathMatch + +`HTTPPathMatch` describes how to select a HTTP route by matching the HTTP +request path. + +{{< keyval >}} +| field| value | +|------|-------| +| `type`| How to match against the path Value. One of: Exact, PathPrefix, RegularExpression. If this field is not specified, a default of "PathPrefix" is provided.| +| `value`| The HTTP path to match against.| +{{< /keyval >}} + +### httpHeaderMatch + +`HTTPHeaderMatch` describes how to select a HTTP route by matching HTTP request +headers. + +{{< keyval >}} +| field| value | +|------|-------| +| `type`| How to match against the value of the header. One of: Exact, RegularExpression. If this field is not specified, a default of "Exact" is provided.| +| `name`| The HTTP Header to be matched against. Name matching MUST be case insensitive.| +| `value`| Value of HTTP Header to be matched.| +{{< /keyval >}} + +### httpQueryParamMatch + +`HTTPQueryParamMatch` describes how to select a HTTP route by matching HTTP +query parameters. + +{{< keyval >}} +| field| value | +|------|-------| +| `type`| How to match against the value of the query parameter. One of: Exact, RegularExpression. If this field is not specified, a default of "Exact" is provided.| +| `name`| The HTTP query param to be matched. This must be an exact string match.| +| `value`| Value of HTTP query param to be matched.| +{{< /keyval >}} + +### httpRouteFilter + +HTTPRouteFilter defines processing steps that must be completed during the +request or response lifecycle. + +{{< keyval >}} +| field| value | +|------|-------| +| `type`| One of: RequestHeaderModifier, ResponseHeaderModifier, or RequestRedirect.| +| `requestHeaderModifier`| An [httpHeaderFilter](#httpheaderfilter) which modifies request headers.| +| `responseHeaderModifier` | An [httpHeaderFilter](#httpheaderfilter) which modifies response headers.| +| `requestRedirect`| An [httpRequestRedirectFilter](#httprequestredirectfilter).| +{{< /keyval >}} + +### httpHeaderFilter + +A filter which modifies HTTP request or response headers. + +{{< keyval >}} +| field| value | +|------|-------| +| `set`| A list of [httpHeaders](#httpheader) to overwrite on the request or response.| +| `add`| A list of [httpHeaders](#httpheader) to add on to the request or response, appending to any existing value.| +| `remove`| A list of header names to remove from the request or response.| +{{< /keyval >}} + +### httpHeader + +`HTTPHeader` represents an HTTP Header name and value as defined by RFC 7230. + +{{< keyval >}} +| field| value | +|------|-------| +| `name`| Name of the HTTP Header to be matched. Name matching MUST be case insensitive.| +| `value`| Value of HTTP Header to be matched.| +{{< /keyval >}} + +### httpRequestRedirectFilter + +`HTTPRequestRedirect` defines a filter that redirects a request. + +{{< keyval >}} +| field| value | +|------|-------| +| `scheme`| The scheme to be used in the value of the `Location` header in the response. When empty, the scheme of the request is used.| +| `hostname`| The hostname to be used in the value of the `Location` header in the response. When empty, the hostname of the request is used.| +| `path`| An [httpPathModfier](#httppathmodfier) which modifies the path of the incoming request and uses the modified path in the `Location` header.| +| `port`| The port to be used in the value of the `Location` header in the response. When empty, port (if specified) of the request is used.| +| `statusCode`| The HTTP status code to be used in response.| +{{< /keyval >}} + +### httpPathModfier + +`HTTPPathModifier` defines configuration for path modifiers. + +{{< keyval >}} +| field| value | +|------|-------| +| `type`| One of: ReplaceFullPath, ReplacePrefixMatch.| +| `replaceFullPath`| The value with which to replace the full path of a request during a rewrite or redirect.| +| `replacePrefixMatch`| The value with which to replace the prefix match of a request during a rewrite or redirect.| +{{< /keyval >}} + +### httpBackendRef + +`HTTPBackendRef` defines the list of objects where matching requests should be +sent to. Only allowed when a route has Service [parentRefs](#parentreference). + +{{< keyval >}} +| field| value | +|------|-------| +| `name`| Name of service for this backend.| +| `port`| Destination port number for this backend.| +| `namespace`| Namespace of service for this backend.| +| `weight`| Proportion of requests sent to this backend.| +{{< /keyval >}} + +### httpRouteTimeouts + +`HTTPRouteTimeouts` defines the timeouts that can be configured for an HTTP +request. + +Linkerd implements HTTPRoute timeouts as described in [GEP-1742]. Timeout +durations are specified as strings using the [Gateway API duration format] +specified by [GEP-2257](https://gateway-api.sigs.k8s.io/geps/gep-2257/) (e.g. +1h/1m/1s/1ms), and MUST be at least 1ms. A timeout field with duration 0 +disables that timeout. + +{{< keyval >}} +| field| value | +|------|-------| +| `request` | Specifies the duration for processing an HTTP client request after which the proxy will time out if unable to send a response. When this field is unspecified or 0, the proxy will not enforce request timeouts. | +| `backendRequest` | Specifies a timeout for an individual request from the proxy to a backend service. This covers the time from when the request first starts being sent from the proxy to when the response has been received from the backend. When this field is unspecified or 0, the proxy will not enforce a backend request timeout, but may still enforce the `request` timeout, if one is configured. | +{{< /keyval >}} + +If retries are enabled, a request received by the proxy may be retried by +sending it to a different backend. In this case, a new `backendRequest` timeout +will be started for each retry request, but each retry request will count +against the overall `request` timeout. + +[GEP-1742]: https://gateway-api.sigs.k8s.io/geps/gep-1742/ +[Gateway API duration format]: https://gateway-api.sigs.k8s.io/geps/gep-2257/#gateway-api-duration-format + +## HTTPRoute Examples + +An HTTPRoute attached to a Server resource which matches GETs to +`/authors.json` or `/authors/*`: + +```yaml +apiVersion: policy.linkerd.io/v1beta2 +kind: HTTPRoute +metadata: + name: authors-get-route + namespace: booksapp +spec: + parentRefs: + - name: authors-server + kind: Server + group: policy.linkerd.io + rules: + - matches: + - path: + value: "/authors.json" + method: GET + - path: + value: "/authors/" + type: "PathPrefix" + method: GET +``` + +An HTTPRoute attached to a Service to perform header-based routing. If there's +a `x-faces-user: testuser` header in the request, the request is routed to the +`smiley2` backend Service. Otherwise, the request is routed to the `smiley` +backend Service. + +```yaml +apiVersion: policy.linkerd.io/v1beta2 +kind: HTTPRoute +metadata: + name: smiley-a-b + namespace: faces +spec: + parentRefs: + - name: smiley + kind: Service + group: core + port: 80 + rules: + - matches: + - headers: + - name: "x-faces-user" + value: "testuser" + backendRefs: + - name: smiley2 + port: 80 + - backendRefs: + - name: smiley + port: 80 +``` + +[ServiceProfile]: ../../features/service-profiles/ +[Gateway API]: https://gateway-api.sigs.k8s.io/ +[ns-boundaries]: https://gateway-api.sigs.k8s.io/geps/gep-1426/#namespace-boundaries +[Server]: ../authorization-policy/#server diff --git a/linkerd.io/content/2.17/reference/iptables.md b/linkerd.io/content/2.17/reference/iptables.md new file mode 100644 index 0000000000..1d927f1f51 --- /dev/null +++ b/linkerd.io/content/2.17/reference/iptables.md @@ -0,0 +1,194 @@ +--- +title: IPTables Reference +description: A table with all of the chains and associated rules +--- + +In order to route TCP traffic in a pod to and from the proxy, an [`init +container`](https://kubernetes.io/docs/concepts/workloads/pods/init-containers/) +is used to set up `iptables` rules at the start of an injected pod's +lifecycle. + +At first, `linkerd-init` will create two chains in the `nat` table: +`PROXY_INIT_REDIRECT`, and `PROXY_INIT_OUTPUT`. These chains are used to route +inbound and outbound packets through the proxy. Each chain has a set of rules +attached to it, these rules are traversed by a packet in order. + +## Inbound connections + +When a packet arrives in a pod, it will typically be processed by the +`PREROUTING` chain, a default chain attached to the `nat` table. The sidecar +container will create a new chain to process inbound packets, called +`PROXY_INIT_REDIRECT`. The sidecar container creates a rule +(`install-proxy-init-prerouting`) to send packets from the `PREROUTING` chain +to our redirect chain. This is the first rule traversed by an inbound packet. + +The redirect chain will be configured with two more rules: + +1. `ignore-port`: will ignore processing packets whose destination ports are + included in the `skip-inbound-ports` install option. +2. `proxy-init-redirect-all`: will redirect all incoming TCP packets through + the proxy, on port `4143`. + +Based on these two rules, there are two possible paths that an inbound packet +can take, both of which are outlined below. + +![Inbound iptables chain traversal](/docs/images/iptables/iptables-fig2-1.png "Inbound iptables chain traversal") + +The packet will arrive on the `PREROUTING` chain and will be immediately routed +to the redirect chain. If its destination port matches any of the inbound ports +to skip, then it will be forwarded directly to the application process, +_bypassing the proxy_. The list of destination ports to check against can be +[configured when installing Linkerd](../cli/install/#). If the +packet does not match any of the ports in the list, it will be redirected +through the proxy. Redirection is done by changing the incoming packet's +destination header, the target port will be replaced with `4143`, which is the +proxy's inbound port. The proxy will process the packet and produce a new one +that will be forwarded to the service; it will be able to get the original +target (IP:PORT) of the inbound packet by using a special socket option +[`SO_ORIGINAL_DST`](https://linux.die.net/man/3/getsockopt). The new packet +will be routed through the `OUTPUT` chain, from there it will be sent to the +application. The `OUTPUT` chain rules are covered in more detail below. + +## Outbound connections + +When a packet leaves a pod, it will first traverse the `OUTPUT` chain, the +first default chain an outgoing packet traverses in the `nat` table. To +redirect outgoing packets through the outbound side of the proxy, the sidecar +container will again create a new chain. The first outgoing rule is similar to +the inbound counterpart: any packet that traverses the `OUTPUT` chain should be +forwarded to our `PROXY_INIT_OUTPUT` chain to be processed. + +The output redirect chain is slightly harder to understand but follows the same +logical flow as the inbound redirect chain, in total there are 4 rules +configured: + +1. `ignore-proxy-uid`: any packets owned by the proxy (whose user id is + `2102`), will skip processing and return to the previous (`OUTPUT`) chain. + From there, it will be sent on the outbound network interface (either to + the application, in the case of an inbound packet, or outside of the pod, + for an outbound packet). +2. `ignore-loopback`: if the packet is sent over the loopback interface + (`lo`), it will skip processing and return to the previous chain. From + here, the packet will be sent to the destination, much like the first rule + in the chain. +3. `ignore-port`: will ignore processing packets whose destination ports are + included in the `skip-outbound-ports` install option. +4. `redirect-all-outgoing`: the last rule in the chain, it will redirect all + outgoing TCP packets to port `4140`, the proxy's outbound port. If a + packet has made it this far, it is guaranteed its destination is not local + (i.e `lo`) and it has not been produced by the proxy. This means the + packet has been produced by the service, so it should be forwarded to its + destination by the proxy. + +![Outbound iptables chain traversal](/docs/images/iptables/iptables-fig2-2.png "Outbound iptables chain traversal") + +A packet produced by the service will first hit the `OUTPUT` chain; from here, +it will be sent to our own output chain for processing. The first rule it +encounters in `PROXY_INIT_OUTPUT` will be `ignore-proxy-uid`. Since the packet +was generated by the service, this rule will be skipped. If the packet's +destination is not a port bound on localhost (e.g `127.0.0.1:80`), then it will +skip the second rule as well. The third rule, `ignore-port` will be matched if +the packet's destination port is in the outbound ports to skip list, in this +case, it will be sent out on the network interface, bypassing the proxy. If the +rule is not matched, then the packet will reach the final rule in the chain +`redirect-all-outgoing`-- as the name implies, it will be sent to the proxy to +be processed, on its outbound port `4140`. Much like in the inbound case, the +routing happens at the `nat` level, the packet's header will be re-written to +target the outbound port. The proxy will process the packet and then forward it +to its destination. The new packet will take the same path through the `OUTPUT` +chain, however, it will stop at the first rule, since it was produced by the +proxy. + +The substantiated explanation applies to a packet whose destination is another +service, outside of the pod. In practice, an application can also send traffic +locally. As such, there are two other possible scenarios that we will explore: +_when a service talks to itself_ (by sending traffic over localhost or by using +its own endpoint address), and when _a service talks to itself through a +`clusterIP` target_. Both scenarios are somehow related, but the path a packet +takes differs. + +**A service may send requests to itself**. It can also target another container +in the pod. This scenario would typically apply when: + +* The destination is the pod (or endpoint) IP address. +* The destination is a port bound on localhost (regardless of which container +it belongs to). + +![Outbound iptables chain traversal](/docs/images/iptables/iptables-fig2-3.png "Outbound iptables chain traversal") + +When the application targets itself through its pod's IP (or loopback address), +the packets will traverse the two output chains. The first rule will be +skipped, since the owner is the application, and not the proxy. Once the second +rule is matched, the packets will return to the first output chain, from here, +they'll be sent directly to the service. + +{{< note >}} +Usually, packets traverse another chain on the outbound side called +`POSTROUTING`. This chain is traversed after the `OUTPUT` chain, but to keep +the explanation simple, it has not been mentioned. Likewise, outbound packets that +are sent over the loopback interface become inbound packets, since they need to +be processed again. The kernel takes shortcuts in this case and bypasses the +`PREROUTING` chain that inbound packets from the outside world traverse when +they first arrive. For this reason, we do not need any special rules on the +inbound side to account for outbound packets that are sent locally. +{{< /note >}} + +**A service may send requests to itself using its clusterIP**. In such cases, +it is not guaranteed that the destination will be local. The packet follows an +unusual path, as depicted in the diagram below. + +![Outbound iptables chain traversal](/docs/images/iptables/iptables-fig2-4.png "Outbound iptables chain traversal") + +When the packet first traverses the output chains, it will follow the same path +an outbound packet would normally take. In such a scenario, the packet's +destination will be an address that is not considered to be local by the +kernel-- it is, after all, a virtual IP. The proxy will process the packet, at +a connection level, connections to a `clusterIP` will be load balanced between +endpoints. Chances are that the endpoint selected will be the pod itself, +packets will therefore never leave the pod; the destination will be resolved to +the podIP. The packets produced by the proxy will traverse the output chain and +stop at the first rule, then they will be forwarded to the service. This +constitutes an edge case because at this point, the packet has been processed +by the proxy, unlike the scenario previously discussed where it skips it +altogether. For this reason, at a connection level, the proxy will _not_ mTLS +or opportunistically upgrade the connection to HTTP/2 when the endpoint is +local to the pod. In practice, this is treated as if the destination was +loopback, with the exception that the packet is forwarded through the proxy, +instead of being forwarded from the service directly to itself. + +## Rules table + +For reference, you can find the actual commands used to create the rules below. +Alternatively, if you want to inspect the iptables rules created for a pod, you +can retrieve them through the following command: + +```bash +$ kubectl -n logs linkerd-init +# where is the name of the pod +# you want to see the iptables rules for +``` + +### Inbound + +{{< keyval >}} +| # | name | iptables rule | description| +|---|------|---------------|------------| +| 1 | redirect-common-chain | `iptables -t nat -N PROXY_INIT_REDIRECT`| creates a new `iptables` chain to add inbound redirect rules to; the chain is attached to the `nat` table | +| 2 | ignore-port | `iptables -t nat -A PROXY_INIT_REDIRECT -p tcp --match multiport --dports -j RETURN` | configures `iptables` to ignore the redirect chain for packets whose dst ports are included in the `--skip-inbound-ports` config option | +| 3 | proxy-init-redirect-all | `iptables -t nat -A PROXY_INIT_REDIRECT -p tcp -j REDIRECT --to-port 4143` | configures `iptables` to redirect all incoming TCP packets to port `4143`, the proxy's inbound port | +| 4 | install-proxy-init-prerouting | `iptables -t nat -A PREROUTING -j PROXY_INIT_REDIRECT` | the last inbound rule configures the `PREROUTING` chain (first chain a packet traverses inbound) to send packets to the redirect chain for processing | +{{< /keyval >}} + +### Outbound + +{{< keyval >}} +| # | name | iptables rule | description | +|---|------|---------------|-------------| +| 1 | redirect-common-chain | `iptables -t nat -N PROXY_INIT_OUTPUT`| creates a new `iptables` chain to add outbound redirect rules to, also attached to the `nat` table | +| 2 | ignore-proxy-uid | `iptables -t nat -A PROXY_INIT_OUTPUT -m owner --uid-owner 2102 -j RETURN` | when a packet is owned by the proxy (`--uid-owner 2102`), skip processing and return to the previous (`OUTPUT`) chain | +| 3 | ignore-loopback | `iptables -t nat -A PROXY_INIT_OUTPUT -o lo -j RETURN` | when a packet is sent over the loopback interface (`lo`), skip processing and return to the previous chain | +| 4 | ignore-port | `iptables -t nat -A PROXY_INIT_OUTPUT -p tcp --match multiport --dports -j RETURN` | configures `iptables` to ignore the redirect output chain for packets whose dst ports are included in the `--skip-outbound-ports` config option | +| 5 | redirect-all-outgoing | `iptables -t nat -A PROXY_INIT_OUTPUT -p tcp -j REDIRECT --to-port 4140`| configures `iptables` to redirect all outgoing TCP packets to port `4140`, the proxy's outbound port | +| 6 | install-proxy-init-output | `iptables -t nat -A OUTPUT -j PROXY_INIT_OUTPUT` | the last outbound rule configures the `OUTPUT` chain (second before last chain a packet traverses outbound) to send packets to the redirect output chain for processing | +{{< /keyval >}} + diff --git a/linkerd.io/content/2.17/reference/k8s-versions.md b/linkerd.io/content/2.17/reference/k8s-versions.md new file mode 100644 index 0000000000..3cb8262454 --- /dev/null +++ b/linkerd.io/content/2.17/reference/k8s-versions.md @@ -0,0 +1,44 @@ +--- +title: Supported Kubernetes Versions +description: Reference documentation for which Linkerd version supports which Kubernetes + version +--- + +Linkerd supports all versions of Kubernetes that were supported at the time +that a given Linkerd version ships. For example, at the time that Linkerd 2.14 +shipped, Kubernetes versions 1.26, 1.27, and 1.28 were supported, so Linkerd +2.14 supports all of those Kubernetes versions. (In many cases, as you'll see +below, Linkerd versions will also support older Kubernetes versions.) + +Obviously, Linkerd 2.14 has no knowledge of what changes will come _after_ +Kubernetes 1.28. In some cases, later versions of Kubernetes end up making +changes that cause older versions of Linkerd to not work: we will update the +chart below as these situations arise. + +{{< keyval >}} +| Linkerd Version | Minimum Kubernetes Version | Maximum Kubernetes Version | +|-----------------|----------------------------|----------------------------| +| `2.10` | `1.16` | `1.23` | +| `2.11` | `1.17` | `1.23` | +| `2.12` | `1.21` | `1.24` | +| `2.13` | `1.21` | `1.28` | +| `2.14` | `1.21` | `1.28` | +| `2.15` | `1.22` | `1.29` | +| `2.16` | `1.22` | `1.29` | +| `2.17` | `1.22` | `1.31` | +{{< /keyval >}} + +Note that Linkerd will almost never change the supported Kubernetes version in +a minor release, which is why the table above only lists major versions. One +known exception: Linkerd 2.11.0 supported Kubernetes 1.16, but 2.11.1 and +later required Kubernetes 1.17 as shown in the table above. + +## Edge Releases + +{{< keyval >}} +| Linkerd Version | Minimum Kubernetes Version | Maximum Kubernetes Version | +|-----------------|----------------------------|----------------------------| +| `edge-22.10.1` - `edge-23.12.1` | `1.21` | `1.29` | +| `edge-23.12.2` - `edge-24.11.4` | `1.22` | `1.29` | +| `edge-24.11.5` and newer | `1.22` | `1.31` | +{{< /keyval >}} diff --git a/linkerd.io/content/2.17/reference/multicluster.md b/linkerd.io/content/2.17/reference/multicluster.md new file mode 100644 index 0000000000..7934291375 --- /dev/null +++ b/linkerd.io/content/2.17/reference/multicluster.md @@ -0,0 +1,93 @@ +--- +title: Multi-cluster communication +description: Multi-cluster communication +--- + +Linkerd's [multi-cluster functionality](../../features/multicluster/) allows +pods to connect to Kubernetes services across cluster boundaries in a way that +is secure and fully transparent to the application. This feature supports three +modes: hierarchical (using a gateway), flat (without a gateway), and federated. + +* **Hierarchical mode** only requires that the gateway IP of the destination + cluster be reachable by pods on the source cluster. +* **Flat mode** requires that all pods on the source cluster be able to directly + connect to pods on the destination cluster. +* **Federated mode** has the same requirements as flat mode but allows a service + deployed to multiple clusters to be treated as a single cluster agnostic + service. + +These modes can be mixed and matched. + +![Architectural diagram comparing hierarchical and flat network modes](/docs/images/multicluster/flat-network.png) + +Hierarchical mode places a bare minimum of requirements on the underlying +network, as it only requires that the gateway IP be reachable. However, flat +mode has a few advantages over the gateway approach used in hierarchical mode, +including reducing latency and preserving client identity. + +## Service mirroring + +Linkerd's multi-cluster functionality uses a *service mirror* component that +watches a target cluster for updates to services and mirrors those service +updates locally to a source cluster. + +Multi-cluster support is underpinned by a concept known as service mirroring. +Mirroring refers to importing a service definition from another cluster, and it +allows applications to address and consume multi-cluster services. The *service +mirror* component runs on the source cluster; it watches a target cluster for +updates to services and mirrors those updates locally in the source cluster. +Only Kubernetes service objects that match a label selector are exported. + +The label selector also controls the mode a service is exported in. For example, +by default, services labeled with `mirror.linkerd.io/exported=true` will be +exported in hierarchical (gateway) mode, whereas services labeled with +`mirror.linkerd.io/exported=remote-discovery` will be exported in flat +(pod-to-pod) mode. Since the configuration is service-centric, switching from +gateway to pod-to-pod mode is trivial and does not require the extension to be +re-installed. + +{{< note >}} +In flat mode, the namespace of the Linkerd control plane should be the same +across all clusters. We recommend leaving this at the default value of +`linkerd`. +{{< /note >}} + +The term "remote-discovery" refers to how the imported services should be +interpreted by Linkerd's control plane. Service discovery is performed by the +[*destination service*](../../reference/architecture/#the-destination-service). +Whenever traffic is sent to a target imported in "remote-discovery" mode, the +destination service knows to look for all relevant information in the cluster +the service has been exported from, not locally. In contrast, service discovery +for a hierarchical (gateway mode) import will be performed locally; instead of +routing directly to a pod, traffic will be sent to the gateway address on the +target cluster. + +Linkerd's *destination service* performs remote discovery by connecting directly +to multiple Kubernetes API servers. Whenever two clusters are connected +together, a Kubernetes `Secret` is created in the control plane's namespace with +a kubeconfig file that allows an API client to be configured. The kubeconfig +file uses RBAC to provide the "principle of least privilege", ensuring the +*destination service* may only access only the resources it needs. + +## Federated Services + +Federated services take this a step farther by allowing a service which is +deployed to multiple clusters to be joined into a single unified service. + +The service mirror controller will look for all services in all linked clusters +which match a label selector (`mirror.linkerd.io/federated=member` by default) +and create a federated service called `-federated` which will act as +a union of all those services with that name. For example, all traffic sent to +the `store-web-federated` federated service will be load balanced over all +replicas of all services named `store-web` in all linked clusters. + +The concept of "namespace sameness" applies, which means that the federated +service will be created in the same namespace as the individual services and +services can only join a federated service in the same namespace. + +Since Linkerd's *destination service* uses "remote-discovery" to discover the +endpoints of a federated service, all of the requirements for flat mode also +apply to federated services: the clusters must be on a flat network where pods +in one cluster can connect to pods in the others, the clusters must have the +same trust root, and any clients connecting to the federated service must be +meshed. diff --git a/linkerd.io/content/2.17/reference/proxy-configuration.md b/linkerd.io/content/2.17/reference/proxy-configuration.md new file mode 100644 index 0000000000..377acf9999 --- /dev/null +++ b/linkerd.io/content/2.17/reference/proxy-configuration.md @@ -0,0 +1,62 @@ +--- +title: Proxy Configuration +description: Linkerd provides a set of annotations that can be used to override the + data plane proxy's configuration. +--- + +Linkerd provides a set of annotations that can be used to **override** the data +plane proxy's configuration. This is useful for **overriding** the default +configurations of [auto-injected proxies](../../features/proxy-injection/). + +The following is the list of supported annotations: + +{{< docs/cli-annotations "inject" >}} + +For example, to update an auto-injected proxy's CPU and memory resources, we +insert the appropriate annotations into the `spec.template.metadata.annotations` +of the owner's pod spec, using `kubectl edit` like this: + +```yaml +spec: + template: + metadata: + annotations: + config.linkerd.io/proxy-cpu-limit: "1" + config.linkerd.io/proxy-cpu-request: "0.2" + config.linkerd.io/proxy-memory-limit: 2Gi + config.linkerd.io/proxy-memory-request: 128Mi +``` + +See [here](../../tasks/configuring-proxy-concurrency/) for details on tuning the +proxy's resource usage. + +For proxies injected using the `linkerd inject` command, configuration can be +overridden using the [command-line flags](../cli/inject/). + +## Ingress Mode + +{{< warning >}} +When an ingress is meshed in `ingress` mode by using `linkerd.io/inject: +ingress`, the ingress _must_ be configured to remove the `l5d-dst-override` +header to avoid creating an open relay to cluster-local and external endpoints. +{{< /warning >}} + +Proxy ingress mode is a mode of operation designed to help Linkerd integrate +with certain ingress controllers. Ingress mode is necessary if the ingress +itself cannot be otherwise configured to use the Service port/ip as the +destination. + +When an individual Linkerd proxy is set to `ingress` mode, it will route +requests based on their `:authority`, `Host`, or `l5d-dst-override` headers +instead of their original destination. This will inform Linkerd to override the +endpoint selection of the ingress container and to perform its own endpoint +selection, enabling features such as per-route metrics and traffic splitting. + +The proxy can be made to run in `ingress` mode by using the `linkerd.io/inject: +ingress` annotation rather than the default `linkerd.io/inject: enabled` +annotation. This can also be done with the `--ingress` flag in the `inject` CLI +command: + +```bash +kubectl get deployment -n -o yaml | linkerd inject --ingress - | kubectl apply -f - +``` diff --git a/linkerd.io/content/2.17/reference/proxy-log-level.md b/linkerd.io/content/2.17/reference/proxy-log-level.md new file mode 100644 index 0000000000..f586319636 --- /dev/null +++ b/linkerd.io/content/2.17/reference/proxy-log-level.md @@ -0,0 +1,39 @@ +--- +title: Proxy Log Level +description: Syntax of the proxy log level. +--- + +The Linkerd proxy's log level can be configured via the: + +* `LINKERD_PROXY_LOG` environment variable +* `--proxy-log-level` CLI flag of the `install`, `inject` and `upgrade` commands +* `config.linkerd.io/proxy-log-level` annotation + (see [Proxy Configuration](../proxy-configuration/)) + which sets `LINKERD_PROXY_LOG` environment-variable on the injected sidecar +* an [endpoint on the admin port](../../tasks/modifying-proxy-log-level/) + of a running proxy. + +The log level is a comma-separated list of log directives, which is +based on the logging syntax of the [`env_logger` crate](https://docs.rs/env_logger/0.6.1/env_logger/#enabling-logging). + +A log directive consists of either: + +* A level (e.g. `info`), which sets the global log level, or +* A module path (e.g. `foo` or `foo::bar::baz`), or +* A module path followed by an equals sign and a level (e.g. `foo=warn` +or `foo::bar::baz=debug`), which sets the log level for that module + +A level is one of: + +* `trace` +* `debug` +* `info` +* `warn` +* `error` + +A module path represents the path to a Rust module. It consists of one or more +module names, separated by `::`. + +A module name starts with a letter, and consists of alphanumeric characters and `_`. + +The proxy's default log level is set to `warn,linkerd2_proxy=info`. diff --git a/linkerd.io/content/2.17/reference/proxy-metrics.md b/linkerd.io/content/2.17/reference/proxy-metrics.md new file mode 100644 index 0000000000..743aebf3c2 --- /dev/null +++ b/linkerd.io/content/2.17/reference/proxy-metrics.md @@ -0,0 +1,279 @@ +--- +title: Proxy Metrics +description: The Linkerd proxy natively exports Prometheus metrics for all incoming + and outgoing traffic. +--- + +The Linkerd proxy exposes metrics that describe the traffic flowing through the +proxy. The following metrics are available at `/metrics` on the proxy's metrics +port (default: `:4191`) in the [Prometheus format][prom-format]. + +## Protocol-Level Metrics + +* `request_total`: A counter of the number of requests the proxy has received. + This is incremented when the request stream begins. + +* `response_total`: A counter of the number of responses the proxy has received. + This is incremented when the response stream ends. + +* `response_latency_ms`: A histogram of response latencies. This measurement + reflects the [time-to-first-byte][ttfb] (TTFB) by recording the elapsed time + between the proxy processing a request's headers and the first data frame of the + response. If a response does not include any data, the end-of-stream event is + used. The TTFB measurement is used so that Linkerd accurately reflects + application behavior when a server provides response headers immediately but is + slow to begin serving the response body. + +* `route_request_total`, `route_response_latency_ms`, and `route_response_total`: + These metrics are analogous to `request_total`, `response_latency_ms`, and + `response_total` except that they are collected at the route level. This + means that they do not have `authority`, `tls`, `grpc_status_code` or any + outbound labels but instead they have: + * `dst`: The authority of this request. + * `rt_route`: The name of the route for this request. + +* `control_request_total`, `control_response_latency_ms`, and `control_response_total`: + These metrics are analogous to `request_total`, `response_latency_ms`, and + `response_total` but for requests that the proxy makes to the Linkerd control + plane. Instead of `authority`, `direction`, or any outbound labels, instead + they have: + * `addr`: The address used to connect to the control plane. + +* `inbound_http_authz_allow_total`: A counter of the total number of inbound + HTTP requests that were authorized. + * `authz_name`: The name of the authorization policy used to allow the request. + +* `inbound_http_authz_deny_total`: A counter of the total number of inbound + HTTP requests that could not be processed due to being denied by the + authorization policy. + +* `inbound_http_route_not_found_total`: A counter of the total number of + inbound HTTP requests that could not be associated with a route. + +Note that latency measurements are not exported to Prometheus until the stream +_completes_. This is necessary so that latencies can be labeled with the appropriate +[response classification](#response-labels). + +### Labels + +Each of these metrics has the following labels: + +* `authority`: The value of the `:authority` (HTTP/2) or `Host` (HTTP/1.1) + header of the request. +* `direction`: `inbound` if the request originated from outside of the pod, + `outbound` if the request originated from inside of the pod. +* `tls`: `true` if the request's connection was secured with TLS. + +#### Response Labels + +The following labels are only applicable on `response_*` metrics. + +* `status_code`: The HTTP status code of the response. + +#### Response Total Labels + +In addition to the labels applied to all `response_*` metrics, the +`response_total`, `route_response_total`, and `control_response_total` metrics +also have the following labels: + +* `classification`: `success` if the response was successful, or `failure` if + a server error occurred. This classification is based on + the gRPC status code if one is present, and on the HTTP + status code otherwise. +* `grpc_status_code`: The value of the `grpc-status` trailer. Only applicable + for gRPC responses. + +{{< note >}} +Because response classification may be determined based on the `grpc-status` +trailer (if one is present), a response may not be classified until its body +stream completes. Response latency, however, is determined based on +[time-to-first-byte][ttfb], so the `response_latency_ms` metric is recorded as +soon as data is received, rather than when the response body ends. Therefore, +the values of the `classification` and `grpc_status_code` labels are not yet +known when the `response_latency_ms` metric is recorded. +{{< /note >}} + +#### Outbound labels + +The following labels are only applicable if `direction=outbound`. + +* `dst_deployment`: The deployment to which this request is being sent. +* `dst_k8s_job`: The job to which this request is being sent. +* `dst_replicaset`: The replica set to which this request is being sent. +* `dst_daemonset`: The daemon set to which this request is being sent. +* `dst_statefulset`: The stateful set to which this request is being sent. +* `dst_replicationcontroller`: The replication controller to which this request + is being sent. +* `dst_namespace`: The namespace to which this request is being sent. +* `dst_service`: The service to which this request is being sent. +* `dst_pod_template_hash`: The [pod-template-hash][pod-template-hash] of the pod + to which this request is being sent. This label + selector roughly approximates a pod's `ReplicaSet` or + `ReplicationController`. + +#### Prometheus Collector labels + +The following labels are added by the Prometheus collector. + +* `instance`: ip:port of the pod. +* `job`: The Prometheus job responsible for the collection, typically + `linkerd-proxy`. + +##### Kubernetes labels added at collection time + +Kubernetes namespace, pod name, and all labels are mapped to corresponding +Prometheus labels. + +* `namespace`: Kubernetes namespace that the pod belongs to. +* `pod`: Kubernetes pod name. +* `pod_template_hash`: Corresponds to the [pod-template-hash][pod-template-hash] + Kubernetes label. This value changes during redeploys and + rolling restarts. This label selector roughly + approximates a pod's `ReplicaSet` or + `ReplicationController`. + +##### Linkerd labels added at collection time + +Kubernetes labels prefixed with `linkerd.io/` are added to your application at +`linkerd inject` time. More specifically, Kubernetes labels prefixed with +`linkerd.io/proxy-*` will correspond to these Prometheus labels: + +* `daemonset`: The daemon set that the pod belongs to (if applicable). +* `deployment`: The deployment that the pod belongs to (if applicable). +* `k8s_job`: The job that the pod belongs to (if applicable). +* `replicaset`: The replica set that the pod belongs to (if applicable). +* `replicationcontroller`: The replication controller that the pod belongs to + (if applicable). +* `statefulset`: The stateful set that the pod belongs to (if applicable). + +### Example + +Here's a concrete example, given the following pod snippet: + +```yaml +name: vote-bot-5b7f5657f6-xbjjw +namespace: emojivoto +labels: + app: vote-bot + linkerd.io/control-plane-ns: linkerd + linkerd.io/proxy-deployment: vote-bot + pod-template-hash: "3957278789" + test: vote-bot-test +``` + +The resulting Prometheus labels will look like this: + +```bash +request_total{ + pod="vote-bot-5b7f5657f6-xbjjw", + namespace="emojivoto", + app="vote-bot", + control_plane_ns="linkerd", + deployment="vote-bot", + pod_template_hash="3957278789", + test="vote-bot-test", + instance="10.1.3.93:4191", + job="linkerd-proxy" +} +``` + +## Transport-Level Metrics + +The following metrics are collected at the level of the underlying transport +layer. + +* `tcp_open_total`: A counter of the total number of opened transport + connections. +* `tcp_close_total`: A counter of the total number of transport connections + which have closed. +* `tcp_open_connections`: A gauge of the number of transport connections + currently open. +* `tcp_write_bytes_total`: A counter of the total number of sent bytes. This is + updated when the connection closes. +* `tcp_read_bytes_total`: A counter of the total number of received bytes. This + is updated when the connection closes. +* `tcp_connection_duration_ms`: A histogram of the duration of the lifetime of a + connection, in milliseconds. This is updated when the connection closes. +* `inbound_tcp_errors_total`: A counter of the total number of inbound TCP + connections that could not be processed due to a proxy error. +* `outbound_tcp_errors_total`: A counter of the total number of outbound TCP + connections that could not be processed due to a proxy error. +* `inbound_tcp_authz_allow_total`: A counter of the total number of TCP + connections that were authorized. +* `inbound_tcp_authz_deny_total`: A counter of the total number of TCP + connections that were denied + +### Labels + +Each of these metrics has the following labels: + +* `direction`: `inbound` if the connection was established either from outside the + pod to the proxy, or from the proxy to the application, + `outbound` if the connection was established either from the + application to the proxy, or from the proxy to outside the pod. +* `peer`: `src` if the connection was accepted by the proxy from the source, + `dst` if the connection was opened by the proxy to the destination. + +Note that the labels described above under the heading "Prometheus Collector labels" +are also added to transport-level metrics, when applicable. + +#### Connection Close Labels + +The following labels are added only to metrics which are updated when a +connection closes (`tcp_close_total` and `tcp_connection_duration_ms`): + +* `classification`: `success` if the connection terminated cleanly, `failure` if + the connection closed due to a connection failure. + +## Identity Metrics + +* `identity_cert_expiration_timestamp_seconds`: A gauge of the time when the + proxy's current mTLS identity certificate will expire (in seconds since the UNIX + epoch). +* `identity_cert_refresh_count`: A counter of the total number of times the + proxy's mTLS identity certificate has been refreshed by the Identity service. + +## Outbound `xRoute` Metrics + +When performing policy-based routing, proxies may dispatch requests through +per-route backend configurations. In order to record how routing rules +apply and how backend distributions are applied, the outbound proxy records the +following metrics: + +* `outbound_http_route_backend_requests_total`: A counter of the total number of + outbound HTTP requests dispatched to a route-backend. +* `outbound_grpc_route_backend_requests_total`: A counter of the total number of + outbound gRPC requests dispatched to a route-backend. +* `outbound_http_balancer_endpoints`: A gauge of the number of endpoints in an + outbound load balancer. + +### Labels + +Each of these metrics has the following common labels, which describe the +Kubernetes resources to which traffic is routed by the proxy: + +* `parent_group`, `parent_kind`, `parent_name`, and `parent_namespace` reference + the parent resource through which the proxy discovered the route binding. + The parent resource of an [HTTPRoute] is generally a Service. +* `route_group`, `route_kind`, `route_name`, and `route_namespace` reference the + route resource through which the proxy discovered the route binding. This will + either reference an [HTTPRoute] resource or a default (synthesized) route. +* `backend_group`, `backend_kind`, `backend_name`, and `backend_namespace` + reference the backend resource to which which the proxy routed the request. + This will always be a Service. + +In addition, the `outbound_http_balancer_endpoints` gauge metric adds the +following labels: + +* `endpoint_state`: Either "ready" if the endpoint is available to have requests + routed to it by the load balancer, or "pending" if the endpoint is currently + unavailable. + + Endpoints may be "pending" when a connection is being established (or + reestablished), or when the endpoint has been [made unavailable by failure + accrual](../circuit-breaking/). + +[prom-format]: https://prometheus.io/docs/instrumenting/exposition_formats/#format-version-0.0.4 +[pod-template-hash]: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#pod-template-hash-label +[ttfb]: https://en.wikipedia.org/wiki/Time_to_first_byte +[HTTPRoute]: ../../features/httproute/ diff --git a/linkerd.io/content/2.17/reference/rate-limiting.md b/linkerd.io/content/2.17/reference/rate-limiting.md new file mode 100644 index 0000000000..86c5018cbf --- /dev/null +++ b/linkerd.io/content/2.17/reference/rate-limiting.md @@ -0,0 +1,70 @@ +--- +title: Rate Limiting +description: Reference guide to Linkerd's HTTPLocalRateLimitPolicy resource +--- + +Linkerd's rate limiting functionality is configured via +`HTTPLocalRateLimitPolicy` resources, which should point to a +[Server](../../reference/authorization-policy/#server) reference. Note that a +`Server` can only be referred by a single `HTTPLocalRateLimitPolicy`. + +{{< note >}} +`Server`'s default `accessPolicy` config is `deny`. This means that if you don't +have [AuthorizationPolicies](../../reference/authorization-policy/) pointing to a +Server, it will deny traffic by default. If you want to set up rate limit +policies for a Server without being forced to also declare authorization +policies, make sure to set `accessPolicy` to a permissive value like +`all-unauthenticated`. +{{< /note >}} + +## HTTPLocalRateLimitPolicy Spec + +{{< keyval >}} +| field| value | +|------|-------| +| `targetRef`| A reference to the [Server](../../reference/authorization-policy/#server) this policy applies to. | +| `total.requestsPerSecond`| Overall rate limit for all traffic sent to the `targetRef`. If unset no overall limit is applied. | +| `identity.requestsPerSecond`| Fairness for individual identities; each separate client, grouped by identity, will have this rate limit. If `total.requestsPerSecond` is also set, `identity.requestsPerSecond` cannot be greater than `total.requestsPerSecond`. | +| `overrides`| An array of [overrides](#overrides) for traffic from specific client. | +{{< /keyval >}} + +### Overrides + +{{< keyval >}} +| field| value | +|------|-------| +| `requestsPerSecond`| The number of requests per second allowed from clients matching `clientRefs`. If `total.requestsPerSecond` is also set, the `requestsPerSecond` for each `overrides` entry cannot be greater than `total.requestsPerSecond`. | +| `clientRefs.kind`| Kind of the referent. Currently only ServiceAccount is supported. | +| `clientRefs.namespace`| Namespace of the referent. When unspecified (or empty string), this refers to the local namespace of the policy. | +| `clientRefs.name`| Name of the referent. | +{{< /keyval >}} + +## Example + +In this example, the policy targets the `web-http` Server, for which a total +rate limit of 100RPS is imposed, with a limit of 20RPS per identity, and an +override of 25RPS for the "special-client" ServiceAccount in the emojivoto +namespace: + +```yaml +apiVersion: policy.linkerd.io/v1alpha1 +kind: HTTPLocalRateLimitPolicy +metadata: + namespace: emojivoto + name: web-rl +spec: + targetRef: + group: policy.linkerd.io + kind: Server + name: web-http + total: + requestsPerSecond: 100 + identity: + requestsPerSecond: 20 + overrides: + - requestsPerSecond: 25 + clientRefs: + - kind: ServiceAccount + namespace: emojivoto + name: special-client +``` diff --git a/linkerd.io/content/2.17/reference/retries.md b/linkerd.io/content/2.17/reference/retries.md new file mode 100644 index 0000000000..e3e7f4cb66 --- /dev/null +++ b/linkerd.io/content/2.17/reference/retries.md @@ -0,0 +1,105 @@ +--- +title: Retries +description: How Linkerd implements retries. +--- + +Linkerd can be configured to automatically retry requests when it receives a +failed response instead of immediately returning that failure to the client. +This is valuable tool for improving success rate in the face of transient +failures. + +Retries are a client-side behavior, and are therefore performed by the +outbound side of the Linkerd proxy.[^1] If retries are configured on an +HTTPRoute or GRPCRoute with multiple backends, each retry of a request can +potentially get sent to a different backend. If a request has a body larger than +64KiB then it will not be retried. + +## Configuring Retries + +Retries are configured by a set of annotations which can be set on a Kubernetes +Service resource or on a HTTPRoute or GRPCRoute which has a Service as a parent. +Client proxies will then retry failed requests to that Service or route. If any +retry configuration annotations are present on a route resource, they override +all retry configuration annotations on the parent Service. + +{{< warning >}} +Retries configured in this way are **incompatible with ServiceProfiles**. If a +[ServiceProfile](../../features/service-profiles/) is defined for a Service, +proxies will use the ServiceProfile retry configuration and ignore any retry +annotations. +{{< /warning >}} + ++ `retry.linkerd.io/http`: A comma separated list of HTTP response codes which +should be retried. Each element of the list may be + + `xxx` to retry a single response code (for example, `"504"` -- remember, + annotation values must be strings!); + + `xxx-yyy` to retry a range of response codes (for example, `500-504`); + + `gateway-error` to retry response codes 502-504; or + + `5xx` to retry all 5XX response codes. +This annotation is not valid on GRPCRoute resources. ++ `retry.linkerd.io/grpc`: A comma seperated list of gRPC status codes which +should be retried. Each element of the list may be + + `cancelled` + + `deadline-exceeded` + + `internal` + + `resource-exhausted` + + `unavailable` +This annotation is not valid on HTTPRoute resources. ++ `retry.linkerd.io/limit`: The maximum number of times a request can be +retried. If unspecified, the default is `1`. ++ `retry.linkerd.io/timeout`: A retry timeout after which a request is cancelled +and retried (if the retry limit has not yet been reached). If unspecified, no +retry timeout is applied. Units must be specified in this value e.g. `5s` or +`200ms`. + +## Examples + +```yaml +kind: HTTPRoute +apiVersion: gateway.networking.k8s.io/v1beta1 +metadata: + name: schlep-default + namespace: schlep + annotations: + retry.linkerd.io/http: 5xx + retry.linkerd.io/limit: "2" + retry.linkerd.io/timeout: 300ms +spec: + parentRefs: + - name: schlep + kind: Service + group: core + port: 80 + rules: + - matches: + - path: + type: PathPrefix + value: "/" +``` + +```yaml +kind: GRPCRoute +apiVersion: gateway.networking.k8s.io/v1alpha2 +metadata: + name: schlep-default + namespace: schlep + annotations: + retry.linkerd.io/grpc: internal + retry.linkerd.io/limit: "2" + retry.linkerd.io/timeout: 400ms +spec: + parentRefs: + - name: schlep + kind: Service + group: core + port: 8080 + rules: + - matches: + - method: + type: Exact + service: schlep.Schlep + method: Get +``` + +[^1]: The part of the proxy which handles connections from within the pod to the + rest of the cluster. diff --git a/linkerd.io/content/2.17/reference/service-profiles.md b/linkerd.io/content/2.17/reference/service-profiles.md new file mode 100644 index 0000000000..ac4af46148 --- /dev/null +++ b/linkerd.io/content/2.17/reference/service-profiles.md @@ -0,0 +1,135 @@ +--- +title: Service Profiles +description: Details on the specification and what is possible with service profiles. +--- + +[Service profiles](../../features/service-profiles/) provide Linkerd additional +information about a service. This is a reference for everything that can be done +with service profiles. + +## Spec + +A service profile spec must contain the following top level fields: + +{{< keyval >}} +| field| value | +|------|-------| +| `routes`| a list of [route](#route) objects | +| `retryBudget`| a [retry budget](#retry-budget) object that defines the maximum retry rate to this service | +{{< /keyval >}} + +## Route + +A route object must contain the following fields: + +{{< keyval >}} +| field | value | +|-------|-------| +| `name` | the name of this route as it will appear in the route label | +| `condition` | a [request match](#request-match) object that defines if a request matches this route | +| `responseClasses` | (optional) a list of [response class](#response-class) objects | +| `isRetryable` | indicates that requests to this route are always safe to retry and will cause the proxy to retry failed requests on this route whenever possible | +| `timeout` | the maximum amount of time to wait for a response (including retries) to complete after the request is sent | +{{< /keyval >}} + +## Request Match + +A request match object must contain _exactly one_ of the following fields: + +{{< keyval >}} +| field | value | +|-------|-------| +| `pathRegex` | a regular expression to match the request path against | +| `method` | one of GET, POST, PUT, DELETE, OPTION, HEAD, TRACE | +| `all` | a list of [request match](#request-match) objects which must _all_ match | +| `any` | a list of [request match](#request-match) objects, at least one of which must match | +| `not` | a [request match](#request-match) object which must _not_ match | +{{< /keyval >}} + +### Request Match Usage Examples + +The simplest condition is a path regular expression: + +```yaml +pathRegex: '/authors/\d+' +``` + +This is a condition that checks the request method: + +```yaml +method: POST +``` + +If more than one condition field is set, all of them must be satisfied. This is +equivalent to using the 'all' condition: + +```yaml +all: +- pathRegex: '/authors/\d+' +- method: POST +``` + +Conditions can be combined using 'all', 'any', and 'not': + +```yaml +any: +- all: + - method: POST + - pathRegex: '/authors/\d+' +- all: + - not: + method: DELETE + - pathRegex: /info.txt +``` + +## Response Class + +A response class object must contain the following fields: + +{{< keyval >}} +| field | value | +|-------|-------| +| `condition` | a [response match](#response-match) object that defines if a response matches this response class | +| `isFailure` | a boolean that defines if these responses should be classified as failed | +{{< /keyval >}} + +## Response Match + +A response match object must contain _exactly one_ of the following fields: + +{{< keyval >}} +| field | value | +|-------|-------| +| `status` | a [status range](#status-range) object to match the response status code against | +| `all` | a list of [response match](#response-match) objects which must _all_ match | +| `any` | a list of [response match](#response-match) objects, at least one of which must match | +| `not` | a [response match](#response-match) object which must _not_ match | +{{< /keyval >}} + +Response Match conditions can be combined in a similar way as shown above for +[Request Match Usage Examples](#request-match-usage-examples) + +## Status Range + +A status range object must contain _at least one_ of the following fields. +Specifying only one of min or max matches just that one status code. + +{{< keyval >}} +| field | value | +|-------|-------| +| `min` | the status code must be greater than or equal to this value | +| `max` | the status code must be less than or equal to this value | +{{< /keyval >}} + +## Retry Budget + +A retry budget specifies the maximum total number of retries that should be sent +to this service as a ratio of the original request volume. + +{{< keyval >}} +| field | value | +|-------|-------| +| `retryRatio` | the maximum ratio of retries requests to original requests | +| `minRetriesPerSecond` | allowance of retries per second in addition to those allowed by the retryRatio | +| `ttl` | indicates for how long requests should be considered for the purposes of calculating the retryRatio | +{{< /keyval >}} diff --git a/linkerd.io/content/2.17/reference/timeouts.md b/linkerd.io/content/2.17/reference/timeouts.md new file mode 100644 index 0000000000..b7fe8b8856 --- /dev/null +++ b/linkerd.io/content/2.17/reference/timeouts.md @@ -0,0 +1,68 @@ +--- +title: Timeouts +description: How Linkerd implements timeouts. +--- + +Linkerd can be configured with timeouts to limit the maximum amount of time on +a request before aborting. + +Timeouts are a client-side behavior, and are therefore performed by the +outbound side of the Linkerd proxy.[^1] Note that timeouts configured in this +way are not retryable -- if these timeouts are reached, the request will not be +retried. Retryable timeouts can be configured as part of +[retry configuration](../retries/). + +## Configuring Timeouts + +Timeous are configured by a set of annotations which can be set on a Kubernetes +Service resource or on a HTTPRoute or GRPCRoute which has a Service as a parent. +Client proxies will then fail requests to that Service or route once they exceed +the timeout. If any timeout configuration annotations are present on a route +resource, they override all timeout configuration annotations on the parent +Service. + +{{< warning >}} +Timeouts configured in this way are **incompatible with ServiceProfiles**. If a +[ServiceProfile](../../features/service-profiles/) is defined for a Service, +proxies will use the ServiceProfile timeout configuration and ignore any timeout +annotations. +{{< /warning >}} + ++ `timeout.linkerd.io/request`: The maximum amount of time a full +request-response stream is in flight. ++ `timeout.linkerd.io/response`: The maximum amount of time a backend response +may be in-flight. ++ `timeout.linkerd.io/idle`: The maximum amount of time a stream may be idle, +regardless of its state. + +If the [request timeout](https://gateway-api.sigs.k8s.io/api-types/httproute/#timeouts-optional) +field is set on an HTTPRoute resource, it will be used as the +`timeout.linkerd.io/request` timeout. However, if both the field and the +annotation are specified, the annotation will take priority. + +## Examples + +```yaml +kind: HTTPRoute +apiVersion: gateway.networking.k8s.io/v1beta1 +metadata: + name: schlep-default + namespace: schlep + annotations: + timeout.linkerd.io/request: 2s + timeout.linkerd.io/response: 1s +spec: + parentRefs: + - name: schlep + kind: Service + group: core + port: 80 + rules: + - matches: + - path: + type: PathPrefix + value: "/" +``` + +[^1]: The part of the proxy which handles connections from within the pod to the + rest of the cluster. diff --git a/linkerd.io/content/2.17/tasks/_index.md b/linkerd.io/content/2.17/tasks/_index.md new file mode 100644 index 0000000000..96f5750677 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/_index.md @@ -0,0 +1,12 @@ +--- +title: Tasks +weight: 4 +--- + +As a complement to the [Linkerd feature docs]({{< relref "../features" >}}) and +the [Linkerd reference docs]({{< relref "../reference" >}}), we've provided guides +and examples of common tasks that you may need to perform when using Linkerd. + +## Common Linkerd tasks + +{{< docs/section-toc >}} diff --git a/linkerd.io/content/2.17/tasks/adding-non-kubernetes-workloads.md b/linkerd.io/content/2.17/tasks/adding-non-kubernetes-workloads.md new file mode 100644 index 0000000000..e70e751893 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/adding-non-kubernetes-workloads.md @@ -0,0 +1,540 @@ +--- +title: Adding non-Kubernetes workloads to your mesh +--- + +In this guide, we'll walk you through an example of [mesh expansion]({{< relref +"../features/non-kubernetes-workloads" >}}): setting up and configuring an +example non-Kubernetes workload and adding it to your Linkerd mesh. + +## Overall flow + +In this guide, we'll take you through how to: + +1. Install the Linkerd proxy onto a virtual or physical machine outside the + Kubernetes cluster. +1. Configure network rules so traffic is routed through the proxy. +1. Register the external workload in the mesh. +1. Exercise traffic patterns and apply authorization policies that affect the + external workload. + +We'll be using [SPIRE](https://github.com/spiffe/spire) as our identity +mechanism to generate a workload identity. + +## Prerequisites + +You will need: + +- A functioning Linkerd installation and its trust anchor. +- A cluster that you have elevated privileges to. For local development, you can + use [kind](https://kind.sigs.k8s.io/) or [k3d](https://k3d.io/). +- A physical or virtual machine. +- `NET_CAP` privileges on the machine, so iptables rules can be modified. +- IP connectivity from the machine to every pod in the mesh. +- A working DNS setup such that the machine is able to resolve DNS names for + in-cluster Kubernetes workloads. + +## Getting the current trust anchor and key + +To be able to use mutual TLS across cluster boundaries, the off-cluster machine +and the cluster need to have a shared trust anchor. For the purposes of this +tutorial, we will assume that you have access to the trust anchor certificate +and secret key for your Linkerd deployment and placed it in files called +`ca.key` and `ca.crt`. + +## Install SPIRE on your machine + +Linkerd's proxies normally obtain TLS certificates from the identity component +of Linkerd's control plane. In order to attest their identity, they use the +Kubernetes Service Account token that is provided to each Pod. + +Since our external workload lives outside of Kubernetes, the concept of Service +Account tokens does not exist. Instead, we turn to the [SPIFFE +framework](https://spiffee.io) and its SPIRE implementation to create identities +for off-cluster resources. Thus, for mesh expansion, we configure the Linkerd +proxy to obtain its certificates directly from SPIRE instead of the Linkerd's +identity service. The magic of SPIFFE is that these certificates are compatible +with those generated by Linkerd on the cluster. + +In production, you may already have your own identity infrastructure built on +top of SPIFFE that can be used by the proxies on external machines. For this +tutorial however, we can take you through installing and setting up a minimal +SPIRE environment on your machine. To begin with you need to install SPIRE by +downloading it from the [SPIRE GitHub releases +page](https://github.com/spiffe/spire/releases). For example: + +```bash +wget https://github.com/spiffe/SPIRE/releases/download/v1.8.2/SPIRE-1.8.2-linux-amd64-musl.tar.gz +tar zvxf SPIRE-1.8.2-linux-amd64-musl.tar.gz +cp -r SPIRE-1.8.2/. /opt/SPIRE/ +``` + +Then you need to configure the SPIRE server on your machine: + +```bash +cat >/opt/SPIRE/server.cfg </opt/SPIRE/agent.cfg < +kubectl --context=west apply -f - < + while true; do + sleep 3600; + done + serviceAccountName: client +EOF +``` + +You can also create a service that selects over both the machine as well as an +in-cluster workload: + +```yaml +kubectl apply -f - <}} +Adding the annotation to existing pods does not automatically mesh them. For +existing pods, after adding the annotation you will also need to recreate or +update the resource (e.g. by using `kubectl rollout restart` to perform a +[rolling +update](https://kubernetes.io/docs/tutorials/kubernetes-basics/update/update-intro/)) +to trigger proxy injection. +{{< /note >}} + +## Examples + +To add Linkerd's data plane proxies to a service defined in a Kubernetes +manifest, you can use `linkerd inject` to add the annotations before applying +the manifest to Kubernetes. + +You can transform an existing `deployment.yml` file to add annotations +in the correct places and apply it to the cluster: + +```bash +cat deployment.yml | linkerd inject - | kubectl apply -f - +``` + +You can mesh every deployment in a namespace by combining this +with `kubectl get`: + +```bash +kubectl get -n NAMESPACE deploy -o yaml | linkerd inject - | kubectl apply -f - +``` + +## Verifying the data plane pods have been injected + +To verify that your services have been added to the mesh, you can query +Kubernetes for the list of containers in the pods and ensure that the proxy is +listed: + +```bash +kubectl -n NAMESPACE get po -o jsonpath='{.items[0].spec.containers[*].name}' +``` + +If everything was successful, you'll see `linkerd-proxy` in the output, e.g.: + +```bash +linkerd-proxy CONTAINER +``` + +## Handling MySQL, SMTP, and other non-HTTP protocols + +Linkerd's [protocol detection](../../features/protocol-detection/) works by +looking at the first few bytes of client data to determine the protocol of the +connection. Some protocols, such as MySQL and SMTP, don't send these bytes. If +your application uses these protocols without TLSing them, you may require +additional configuration to avoid a 10-second delay when establishing +connections. + +See [Configuring protocol +detection](../../features/protocol-detection/#configuring-protocol-detection) +for details. + +## More reading + +For more information on how the inject command works and all of the parameters +that can be set, see the [`linkerd inject` reference +page](../../reference/cli/inject/). + +For details on how autoinjection works, see the [proxy injection +page](../../features/proxy-injection/). diff --git a/linkerd.io/content/2.17/tasks/automatic-failover.md b/linkerd.io/content/2.17/tasks/automatic-failover.md new file mode 100644 index 0000000000..ed9b8d0cb9 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/automatic-failover.md @@ -0,0 +1,176 @@ +--- +title: Automatic Multicluster Failover +description: Use the Linkerd Failover extension to failover between clusters. +--- + +The Linkerd Failover extension is a controller which automatically shifts +traffic from a primary service to one or more fallback services whenever the +primary becomes unavailable. This can help add resiliency when you have a +service which is replicated in multiple clusters. If the local service is +unavailable, the failover controller can shift that traffic to the backup +cluster. + +Let's see a simple example of how to use this extension by installing the +Emojivoto application on two Kubernetes clusters and simulating a failure in +one cluster. We will see the failover controller shift traffic to the other +cluster to ensure the service remains available. + +{{< docs/production-note >}} + +## Prerequisites + +You will need two clusters with Linkerd installed and for the clusters to be +linked together with the multicluster extension. Follow the steps in the +[multicluster guide](../multicluster/) to generate a shared trust root, install +Linkerd, Linkerd Viz, and Linkerd Multicluster, and to link the clusters +together. For the remainder of this guide, we will assume the cluster context +names are "east" and "west" respectively. Please substitute your cluster +context names where appropriate. + +## Installing the Failover Extension + +Failovers are described using SMI +[TrafficSplit](https://github.com/servicemeshinterface/smi-spec/blob/main/apis/traffic-split/v1alpha1/traffic-split.md) +resources. We install the Linkerd SMI extension and the Linkerd Failover +extension. These can be installed in both clusters, but since we'll only be +initiating failover from the "west" cluster in this example, we'll only install +them in that cluster: + +```bash +# Install linkerd-smi in west cluster +> helm --kube-context=west repo add linkerd-smi https://linkerd.github.io/linkerd-smi +> helm --kube-context=west repo up +> helm --kube-context=west install linkerd-smi -n linkerd-smi --create-namespace linkerd-smi/linkerd-smi + +# Install linkerd-failover in west cluster +> helm --kube-context=west repo add linkerd-edge https://helm.linkerd.io/edge +> helm --kube-context=west repo up +> helm --kube-context=west install linkerd-failover -n linkerd-failover --create-namespace --devel linkerd-edge/linkerd-failover +``` + +## Installing and Exporting Emojivoto + +We'll now install the Emojivoto example application into both clusters: + +```bash +> linkerd --context=west inject https://run.linkerd.io/emojivoto.yml | kubectl --context=west apply -f - +> linkerd --context=east inject https://run.linkerd.io/emojivoto.yml | kubectl --context=east apply -f - +``` + +Next we'll "export" the `web-svc` in the east cluster by setting the +`mirror.linkerd.io/exported=true` label. This will instruct the +multicluster extension to create a mirror service called `web-svc-east` in the +west cluster, making the east Emojivoto application available in the west +cluster: + +```bash +> kubectl --context=east -n emojivoto label svc/web-svc mirror.linkerd.io/exported=true +> kubectl --context=west -n emojivoto get svc +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +emoji-svc ClusterIP 10.96.41.137 8080/TCP,8801/TCP 13m +voting-svc ClusterIP 10.96.247.68 8080/TCP,8801/TCP 13m +web-svc ClusterIP 10.96.222.169 80/TCP 13m +web-svc-east ClusterIP 10.96.244.245 80/TCP 92s +``` + +## Creating the Failover TrafficSplit + +To tell the failover controller how to failover traffic, we need to create a +TrafficSplit resource in the west cluster with the +`failover.linkerd.io/controlled-by: linkerd-failover` label. The +`failover.linkerd.io/primary-service` annotation indicates that the `web-svc` +backend is the primary and all other backends will be treated as the fallbacks: + +```bash +kubectl --context=west apply -f - < linkerd --context=west viz stat -n emojivoto svc --from deploy/vote-bot +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +web-svc - 96.67% 2.0rps 2ms 3ms 5ms 1 +web-svc-east - - - - - - - +``` + +Now we'll simulate the local service becoming unavailable by scaling it down: + +```bash +> kubectl --context=west -n emojivoto scale deploy/web --replicas=0 +``` + +We can immediately see that the TrafficSplit has been adjusted to send traffic +to the backup. Notice that the `web-svc` backend now has weight 0 and the +`web-svc-east` backend now has weight 1. + +```bash +> kubectl --context=west -n emojivoto get ts/web-svc-failover -o yaml +apiVersion: split.smi-spec.io/v1alpha2 +kind: TrafficSplit +metadata: + annotations: + failover.linkerd.io/primary-service: web-svc + creationTimestamp: "2022-03-22T23:47:11Z" + generation: 4 + labels: + failover.linkerd.io/controlled-by: linkerd-failover + name: web-svc-failover + namespace: emojivoto + resourceVersion: "10817806" + uid: 77039fb3-5e39-48ad-b7f7-638d187d7a28 +spec: + backends: + - service: web-svc + weight: 0 + - service: web-svc-east + weight: 1 + service: web-svc +``` + +We can also confirm that this traffic is going to the fallback using the +`viz stat` command: + +```bash +> linkerd --context=west viz stat -n emojivoto svc --from deploy/vote-bot +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +web-svc - - - - - - - +web-svc-east - 93.04% 1.9rps 25ms 30ms 30ms 1 +``` + +Finally, we can restore the primary by scaling its deployment back up and +observe the traffic shift back to it: + +```bash +> kubectl --context=west -n emojivoto scale deploy/web --replicas=1 +deployment.apps/web scaled +> linkerd --context=west viz stat -n emojivoto svc --from deploy/vote-bot +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +web-svc - 89.29% 1.9rps 2ms 4ms 5ms 1 +web-svc-east - - - - - - - +``` diff --git a/linkerd.io/content/2.17/tasks/automatically-rotating-control-plane-tls-credentials.md b/linkerd.io/content/2.17/tasks/automatically-rotating-control-plane-tls-credentials.md new file mode 100644 index 0000000000..3215b04470 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/automatically-rotating-control-plane-tls-credentials.md @@ -0,0 +1,202 @@ +--- +title: Automatically Rotating Control Plane TLS Credentials +description: Use cert-manager to automatically rotate control plane TLS credentials. +--- + +Linkerd's [automatic mTLS](../../features/automatic-mtls/) feature generates TLS +certificates for proxies and automatically rotates them without user +intervention. These certificates are derived from a *trust anchor*, which is +shared across clusters, and an *issuer certificate*, which is specific to the +cluster. + +While Linkerd automatically rotates the per-proxy TLS certificates, it does not +rotate the issuer certificate. In this doc, we'll describe how to set up +automatic rotation of the issuer certificate and its corresponding private key +using the cert-manager project. + +{{< docs/production-note >}} + +## Cert manager + +[Cert-manager](https://github.com/jetstack/cert-manager) is a popular project +for making TLS credentials from external sources available to Kubernetes +clusters. + +Cert-manager is very flexible. You can configure it to pull certificates from +secrets managemenet solutions such as [Vault](https://www.vaultproject.io). In +this guide, we'll focus on a self-sufficient setup: we will configure +cert-manager to act as an on-cluster +[CA](https://en.wikipedia.org/wiki/Certificate_authority) and have it re-issue +Linkerd's issuer certificate and private key on a periodic basis, derived from +the trust anchor. + +### Cert manager as an on-cluster CA + +As a first step, [install cert-manager on your +cluster](https://cert-manager.io/docs/installation/). + +Next, create the namespace that cert-manager will use to store its +Linkerd-related resources. For simplicity, we suggest reusing the default +Linkerd control plane namespace: + +```bash +kubectl create namespace linkerd +``` + +#### Save the signing key pair as a Secret + +Next, using the [`step`](https://smallstep.com/cli/) tool, create a signing key +pair and store it in a Kubernetes Secret in the namespace created above: + +```bash +step certificate create root.linkerd.cluster.local ca.crt ca.key \ + --profile root-ca --no-password --insecure && + kubectl create secret tls \ + linkerd-trust-anchor \ + --cert=ca.crt \ + --key=ca.key \ + --namespace=linkerd +``` + +For a longer-lived trust anchor certificate, pass the `--not-after` argument +to the step command with the desired value (e.g. `--not-after=87600h`). + +#### Create an Issuer referencing the secret + +With the Secret in place, we can create a cert-manager "Issuer" resource that +references it: + +```bash +kubectl apply -f - <}} + +## Install Cert manager + +As a first step, [install cert-manager on your +cluster](https://cert-manager.io/docs/installation/) +and create the namespaces that cert-manager will use to store its +webhook-related resources. For simplicity, we suggest using the default +namespace linkerd uses: + +```bash +# control plane core +kubectl create namespace linkerd +kubectl label namespace linkerd \ + linkerd.io/is-control-plane=true \ + config.linkerd.io/admission-webhooks=disabled \ + linkerd.io/control-plane-ns=linkerd +kubectl annotate namespace linkerd linkerd.io/inject=disabled + +# viz (ignore if not using the viz extension) +kubectl create namespace linkerd-viz +kubectl label namespace linkerd-viz linkerd.io/extension=viz + +# jaeger (ignore if not using the jaeger extension) +kubectl create namespace linkerd-jaeger +kubectl label namespace linkerd-jaeger linkerd.io/extension=jaeger +``` + +## Save the signing key pair as a Secret + +Next, we will use the [`step`](https://smallstep.com/cli/) tool, to create a +signing key pair which will be used to sign each of the webhook certificates: + +```bash +step certificate create webhook.linkerd.cluster.local ca.crt ca.key \ + --profile root-ca --no-password --insecure --san webhook.linkerd.cluster.local + +kubectl create secret tls webhook-issuer-tls --cert=ca.crt --key=ca.key --namespace=linkerd + +# ignore if not using the viz extension +kubectl create secret tls webhook-issuer-tls --cert=ca.crt --key=ca.key --namespace=linkerd-viz + +# ignore if not using the jaeger extension +kubectl create secret tls webhook-issuer-tls --cert=ca.crt --key=ca.key --namespace=linkerd-jaeger +``` + +## Create Issuers referencing the secrets + +With the Secrets in place, we can create cert-manager "Issuer" resources that +reference them: + +```bash +kubectl apply -f - <}} +When installing the `linkerd-control-plane` chart, you _must_ provide the +issuer trust root and issuer credentials as described in [Installing Linkerd +with Helm](../install-helm/). +{{< /note >}} + +See [Automatically Rotating Control Plane TLS +Credentials](../automatically-rotating-control-plane-tls-credentials/) +for details on how to do something similar for control plane credentials. diff --git a/linkerd.io/content/2.17/tasks/books.md b/linkerd.io/content/2.17/tasks/books.md new file mode 100644 index 0000000000..5f4ba3c095 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/books.md @@ -0,0 +1,351 @@ +--- +title: Debugging HTTP applications with per-route metrics +description: Follow a long-form example of debugging a failing HTTP application using + per-route metrics. +--- + +This demo is of a Ruby application that helps you manage your bookshelf. It +consists of multiple microservices and uses JSON over HTTP to communicate with +the other services. There are three services: + +- [webapp](https://github.com/BuoyantIO/booksapp/blob/master/webapp.rb): the + frontend + +- [authors](https://github.com/BuoyantIO/booksapp/blob/master/authors.rb): an + API to manage the authors in the system + +- [books](https://github.com/BuoyantIO/booksapp/blob/master/books.rb): an API + to manage the books in the system + +For demo purposes, the app comes with a simple traffic generator. The overall +topology looks like this: + +![Topology](/docs/images/books/topology.png "Topology") + +## Prerequisites + +To use this guide, you'll need to have Linkerd installed on your cluster. +Follow the [Installing Linkerd Guide](../install/) if you haven't already done +this. + +## Install the app + +To get started, let's install the books app onto your cluster. In your local +terminal, run: + +```bash +kubectl create ns booksapp && \ + curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/booksapp.yml \ + | kubectl -n booksapp apply -f - +``` + +This command creates a namespace for the demo, downloads its Kubernetes +resource manifest and uses `kubectl` to apply it to your cluster. The app +comprises the Kubernetes deployments and services that run in the `booksapp` +namespace. + +Downloading a bunch of containers for the first time takes a little while. +Kubernetes can tell you when all the services are running and ready for +traffic. Wait for that to happen by running: + +```bash +kubectl -n booksapp rollout status deploy webapp +``` + +You can also take a quick look at all the components that were added to your +cluster by running: + +```bash +kubectl -n booksapp get all +``` + +Once the rollout has completed successfully, you can access the app itself by +port-forwarding `webapp` locally: + +```bash +kubectl -n booksapp port-forward svc/webapp 7000 >/dev/null & +``` + +(We redirect to `/dev/null` just so you don't get flooded with "Handling +connection" messages for the rest of the exercise.) + +Open [http://localhost:7000/](http://localhost:7000/) in your browser to see the +frontend. + +![Frontend](/docs/images/books/frontend.png "Frontend") + +Unfortunately, there is an error in the app: if you click *Add Book*, it will +fail 50% of the time. This is a classic case of non-obvious, intermittent +failure---the type that drives service owners mad because it is so difficult to +debug. Kubernetes itself cannot detect or surface this error. From Kubernetes's +perspective, it looks like everything's fine, but you know the application is +returning errors. + +![Failure](/docs/images/books/failure.png "Failure") + +## Add Linkerd to the service + +Now we need to add the Linkerd data plane proxies to the service. The easiest +option is to do something like this: + +```bash +kubectl get -n booksapp deploy -o yaml \ + | linkerd inject - \ + | kubectl apply -f - +``` + +This command retrieves the manifest of all deployments in the `booksapp` +namespace, runs them through `linkerd inject`, and then re-applies with +`kubectl apply`. The `linkerd inject` command annotates each resource to +specify that they should have the Linkerd data plane proxies added, and +Kubernetes does this when the manifest is reapplied to the cluster. Best of +all, since Kubernetes does a rolling deploy, the application stays running the +entire time. (See [Automatic Proxy Injection](../../features/proxy-injection/) for +more details on how this works.) + +## Debugging + +Let's use Linkerd to discover the root cause of this app's failures. We can use +the `stat-inbound` command to see the success rate of the webapp deployment: + +```bash +linkerd viz -n booksapp stat-inbound deploy/webapp +NAME SERVER ROUTE TYPE SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 +webapp [default]:4191 [default] 100.00% 0.30 4ms 9ms 10ms +webapp [default]:4191 probe 100.00% 0.60 0ms 1ms 1ms +webapp [default]:7000 probe 100.00% 0.30 2ms 2ms 2ms +webapp [default]:7000 [default] 75.66% 8.22 18ms 65ms 93ms +``` + +This shows us inbound traffic statistics. In other words, we see that the webapp +is receiving 8.22 requests per second on port 7000 and that only 75.66% of those +requests are successful. + +To dig into this further and find the root cause, we can look at the webapp's +outbound traffic. This will tell us about the requests that the webapp makes to +other services. + +```bash +linkerd viz -n booksapp stat-outbound deploy/webapp +NAME SERVICE ROUTE TYPE BACKEND SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TIMEOUTS RETRIES +webapp books:7002 [default] 77.36% 7.95 25ms 48ms 176ms 0.00% 0.00% + └──────────────────► books:7002 77.36% 7.95 15ms 44ms 64ms 0.00% +webapp authors:7001 [default] 100.00% 3.53 26ms 72ms 415ms 0.00% 0.00% + └──────────────────► authors:7001 100.00% 3.53 16ms 52ms 91ms 0.00% +``` + +We see that webapp sends traffic to both the books service and the authors +service and that the problem seems to be with the traffic to the books service. + +## HTTPRoute + +We know that the webapp component is getting failures from the books component, +but it would be great to narrow this down further and get per route metrics. To +do this, we take advantage of the Gateway API and define a set of HTTPRoute +resources, each attached to the `books` Service by specifying it as their +`parent_ref`. + +```bash +kubectl apply -f - <}} + +## Prerequisites + +To use this guide, you'll need a Kubernetes cluster running: + +- Linkerd and Linkerd-Viz. If you haven't installed these yet, follow the + [Installing Linkerd Guide](../install/). + +## Set up the demo + +Remember those puzzles where one guard always tells the truth and one guard +always lies? This demo involves one pod (named `good`) which always returns an +HTTP 200 and one pod (named `bad`) which always returns an HTTP 500. We'll also +create a load generator to send traffic to a Service which includes these two +pods. + +For load generation we'll use +[Slow-Cooker](https://github.com/BuoyantIO/slow_cooker) +and for the backend pods we'll use [BB](https://github.com/BuoyantIO/bb). + +To add these components to your cluster and include them in the Linkerd +[data plane](../../reference/architecture/#data-plane), run: + +```bash +cat < linkerd viz -n circuit-breaking-demo stat deploy +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +bad 1/1 6.43% 4.7rps 1ms 1ms 4ms 2 +good 1/1 100.00% 5.9rps 1ms 1ms 1ms 3 +slow-cooker 1/1 100.00% 0.3rps 1ms 1ms 1ms 1 +``` + +Here we can see that `good` and `bad` deployments are each receiving similar +amounts of traffic, but `good` has a success rate of 100% while the success +rate of `bad` is very low (only healthcheck probes are succeeding). We can also +see how this looks from the perspective of the traffic generator: + +```console +> linkerd viz -n circuit-breaking-demo stat deploy/slow-cooker --to svc/bb +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +slow-cooker 1/1 51.00% 10.0rps 1ms 1ms 2ms 2 +``` + +From `slow-cooker`'s perspective, roughly 50% of requests that it sends to the +Service are failing. We can use circuit breaking to improve this by cutting off +traffic to the `bad` pod. + +## Breaking the circuit + +Linkerd supports a type of circuit breaking called [_consecutive failure +accrual_](../../reference/circuit-breaking/#consecutive-failures). +This works by tracking consecutive failures from each endpoint in Linkerd's +internal load balancer. If there are ever too many failures in a row, that +endpoint is temporarily ignored and Linkerd will only load balance among the +remaining endpoints. After a [backoff +period](../../reference/circuit-breaking/#probation-and-backoffs), the endpoint +is re-introduced so that we can determine if it has become healthy. + +Let's enable consecutive failure accrual on the `bb` Service by adding an +annotation: + +```bash +kubectl annotate -n circuit-breaking-demo svc/bb balancer.linkerd.io/failure-accrual=consecutive +``` + +{{< warning >}} +Circuit breaking is **incompatible with ServiceProfiles**. If a +[ServiceProfile](../../features/service-profiles/) is defined for the annotated +Service, proxies will not perform circuit breaking as long as the ServiceProfile +exists. +{{< /warning >}} + +We can check that failure accrual was configured correctly by using a Linkerd +diagnostics command. The `linkerd diagnostics policy` command prints the policy +that Linkerd will use when sending traffic to a Service. We'll use the +[jq](https://stedolan.github.io/jq/) utility to filter the output to focus on +failure accrual: + +```console +> linkerd diagnostics policy -n circuit-breaking-demo svc/bb 8080 -o json | jq '.protocol.Kind.Detect.http1.failure_accrual' +{ + "Kind": { + "ConsecutiveFailures": { + "max_failures": 7, + "backoff": { + "min_backoff": { + "seconds": 1 + }, + "max_backoff": { + "seconds": 60 + }, + "jitter_ratio": 0.5 + } + } + } +} +``` + +This tells us that Linkerd will use `ConsecutiveFailures` failure accrual +when talking to the `bb` Service. It also tells us that the `max_failures` is +7, meaning that it will trip the circuit breaker once it observes 7 consective +failures. We'll talk more about each of the parameters here at the end of this +article. + +Let's look at how much traffic each pod is getting now that the circuit breaker +is in place: + +```console +> linkerd viz -n circuit-breaking-demo stat deploy +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +bad 1/1 94.74% 0.3rps 1ms 1ms 1ms 3 +good 1/1 100.00% 10.3rps 1ms 1ms 4ms 4 +slow-cooker 1/1 100.00% 0.3rps 1ms 1ms 1ms 1 +``` + +Notice that the `bad` pod's RPS is significantly lower now. The circuit breaker +has stopped nearly all of the traffic from `slow-cooker` to `bad`. + +We can also see how this has affected `slow-cooker`: + +```console +> linkerd viz -n circuit-breaking-demo stat deploy/slow-cooker --to svc/bb +NAME MESHED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TCP_CONN +slow-cooker 1/1 99.83% 10.0rps 1ms 1ms 1ms 4 +``` + +Nearly all of `slow-cooker`'s requests are now getting routed to the `good` pod +and succeeding! + +## Tuning circuit breaking + +As we saw when we ran the `linkerd diagnostics policy` command, consecutive +failure accrual is controlled by a number of parameters. Each of these +parameters has a default, but can be manually configured using annotations: + +- `balancer.linkerd.io/failure-accrual-consecutive-max-failures` + - The number of consecutive failures that Linkerd must observe before + tripping the circuit breaker (default: 7). Consider setting a lower value + if you want circuit breaks to trip more easily which can lead to better + success rate at the expense of less evenly distributed traffic. Consider + setting a higher value if you find circuit breakers are tripping too easily, + causing traffic to be cut off from healthy endpoints. +- `balancer.linkerd.io/failure-accrual-consecutive-max-penalty` + - The maximum amount of time a circuit breaker will remain tripped + before the endpoint is restored (default: 60s). Consider setting a longer + duration if you want to reduce the amount of traffic to endpoints which have + tripped the circuit breaker. Consider setting a shorter duration if you'd + like tripped circuit breakers to recover faster after an endpoint becomes + healthy again. +- `balancer.linkerd.io/failure-accrual-consecutive-min-penalty` + - The minimum amount of time a circuit breaker will remain tripped + before the endpoints is restored (default: 1s). Consider tuning this in a + similar way to `failure-accrual-consecutive-max-penalty`. +- `balancer.linkerd.io/failure-accrual-consecutive-jitter-ratio` + - The amount of jitter to introduce to circuit breaker backoffs (default: 0.5). + You are unlikely to need to tune this but might consider increasing it if + you notice many clients are sending requests to a circuit broken endpoint + at the same time, leading to spiky traffic patterns. + +See the [reference +documentation](../../reference/circuit-breaking/#configuring-failure-accrual) +for details on failure accrual configuration. diff --git a/linkerd.io/content/2.17/tasks/configuring-dynamic-request-routing.md b/linkerd.io/content/2.17/tasks/configuring-dynamic-request-routing.md new file mode 100644 index 0000000000..4e38c7fe6f --- /dev/null +++ b/linkerd.io/content/2.17/tasks/configuring-dynamic-request-routing.md @@ -0,0 +1,191 @@ +--- +title: Configuring Dynamic Request Routing +description: Configuring HTTPRoute resources to perform dynamic request routing. +--- + +## Prerequisites + +To use this guide, you'll need to have Linkerd installed on your cluster. Follow +the [Installing Linkerd Guide](../install/) if you haven't already done this +(make sure you have at least linkerd stable-2.13.0 or edge-23.3.2). + +You also need to have the [Helm](https://helm.sh/docs/intro/quickstart/) CLI +installed. + +## HTTPRoute for Dynamic Request Routing + +With dynamic request routing, you can route HTTP traffic based on the contents +of request headers. This can be useful for performing things like A/B testing +and many other strategies for traffic management. + +In this tutorial, we'll make use of the +[podinfo](https://github.com/stefanprodan/podinfo) project to showcase dynamic +request routing, by deploying in the cluster two backend and one frontend +podinfo pods. Traffic will flow to just one backend, and then we'll switch +traffic to the other one just by adding a header to the frontend requests. + +## Setup + +First we create the `test` namespace, annotated by linkerd so all pods that get +created there get injected with the linkerd proxy: + +``` bash +kubectl create ns test --dry-run=client -o yaml \ + | linkerd inject - \ + | kubectl apply -f - +``` + +Then we add podinfo's Helm repo, and install two instances of it. The first one +will respond with the message "`A backend`", the second one with "`B backend`". + +```bash +helm repo add podinfo https://stefanprodan.github.io/podinfo +helm install backend-a -n test \ + --set ui.message='A backend' podinfo/podinfo +helm install backend-b -n test \ + --set ui.message='B backend' podinfo/podinfo +``` + +We add another podinfo instance which will forward requests only to the first +backend instance `backend-a`: + +```bash +helm install frontend -n test \ + --set backend=http://backend-a-podinfo:9898/env podinfo/podinfo +``` + +Once those three pods are up and running, we can port-forward requests from our +local machine to the frontend: + +```bash +kubectl -n test port-forward svc/frontend-podinfo 9898 & +``` + +## Sending Requests + +Requests to `/echo` on port 9898 to the frontend pod will get forwarded the pod +pointed by the Service `backend-a-podinfo`: + +```bash +$ curl -sX POST localhost:9898/echo \ + | grep -o 'PODINFO_UI_MESSAGE=. backend' + +PODINFO_UI_MESSAGE=A backend +``` + +## Introducing HTTPRoute + +Let's apply the following [`HTTPRoute`] resource to enable header-based routing: + +```yaml +cat <}} +Two versions of the HTTPRoute resource may be used with Linkerd: + +- The upstream version provided by the Gateway API, with the + `gateway.networking.k8s.io` API group +- A Linkerd-specific CRD provided by Linkerd, with the `policy.linkerd.io` API + group + +The two HTTPRoute resource definitions are similar, but the Linkerd version +implements experimental features not yet available with the upstream Gateway API +resource definition. See [the HTTPRoute reference +documentation](../../reference/httproute/#linkerd-and-gateway-api-httproutes) +for details. +{{< /note >}} + +In `parentRefs` we specify the resources we want this [`HTTPRoute`] instance to +act on. So here we point to the `backend-a-podinfo` Service on the [`HTTPRoute`]'s +namespace (`test`), and also specify the Service port number (not the Service's +target port). + +{{< warning >}} +**Outbound [`HTTPRoute`](../../features/httproute/)s and +[`ServiceProfile`](../../features/service-profiles/)s provide overlapping +configuration.** For backwards-compatibility reasons, a `ServiceProfile` will +take precedence over `HTTPRoute`s which configure the same Service. If a +`ServiceProfile` is defined for the parent Service of an `HTTPRoute`, +proxies will use the `ServiceProfile` configuration, rather than the +`HTTPRoute` configuration, as long as the `ServiceProfile` exists. +{{< /warning >}} + +Next, we give a list of rules that will act on the traffic hitting that Service. + +The first rule contains two entries: `matches` and `backendRefs`. + +In `matches` we list the conditions that this particular rule has to match. One +matches suffices to trigger the rule (conditions are OR'ed). Inside, we use +`headers` to specify a match for a particular header key and value. If multiple +headers are specified, they all need to match (matchers are AND'ed). Note we can +also specify a regex match on the value by adding a `type: RegularExpression` +field. By not specifying the type like we did here, we're performing a match of +type `Exact`. + +In `backendRefs` we specify the final destination for requests matching the +current rule, via the Service's `name` and `port`. + +Here we're specifying we'd like to route to `backend-b-podinfo` all the requests +having the `x-request-id: alterrnative` header. If the header is not present, +the engine fall backs to the last rule which has no `matches` entries and points +to the `backend-a-podinfo` Service. + +The previous requests should still reach `backend-a-podinfo` only: + +```bash +$ curl -sX POST localhost:9898/echo \ + | grep -o 'PODINFO_UI_MESSAGE=. backend' + +PODINFO_UI_MESSAGE=A backend +``` + +But if we add the "`x-request-id: alternative`" header they get routed to +`backend-b-podinfo`: + +```bash +$ curl -sX POST \ + -H 'x-request-id: alternative' \ + localhost:9898/echo \ + | grep -o 'PODINFO_UI_MESSAGE=. backend' + +PODINFO_UI_MESSAGE=B backend +``` + +### To Keep in Mind + +Note that you can use any header you like, but for this to work the frontend has +to forward it. "`x-request-id`" is a common header used in microservices, that is +explicitly forwarded by podinfo, and that's why we chose it. + +Also, keep in mind the linkerd proxy handles this on the client side of the +request (the frontend pod in this case) and so that pod needs to be injected, +whereas the destination pods don't require to be injected. But of course the +more workloads you have injected the better, to benefit from things like easy +mTLS setup and all the other advantages that linkerd brings to the table! + +[`HTTPRoute`]: ../../features/httproute/ +[`ServiceProfile`]: ../../features/ServiceProfile/ diff --git a/linkerd.io/content/2.17/tasks/configuring-per-route-policy.md b/linkerd.io/content/2.17/tasks/configuring-per-route-policy.md new file mode 100644 index 0000000000..cc2d9edf1c --- /dev/null +++ b/linkerd.io/content/2.17/tasks/configuring-per-route-policy.md @@ -0,0 +1,465 @@ +--- +title: Configuring Per-Route Authorization Policy +description: Fine-grained authorization policies can be configured for individual + HTTP routes. +--- + + + +In addition to [enforcing authorization at the service +level](../restricting-access/), finer-grained authorization policies can also be +configured for individual HTTP routes. In this example, we'll use the Books demo +app to demonstrate how to control which clients can access particular routes on +a service. + +This is an advanced example that demonstrates more complex policy configuration. +For a basic introduction to Linkerd authorization policy, start with the +[Restricting Access to Services](../restricting-access/) example. For more +comprehensive documentation of the policy resources, see the +[Authorization policy reference](../../reference/authorization-policy/). + +## Prerequisites + +To use this guide, you'll need to have Linkerd installed on your cluster, along +with its Viz extension. Follow the [Installing Linkerd Guide](../install/) +if you haven't already done this. + +## Install the Books demo application + +Inject and install the Books demo application: + +```bash +$ kubectl create ns booksapp && \ + curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/booksapp.yml \ + | linkerd inject - \ + | kubectl -n booksapp apply -f - +``` + +This command creates a namespace for the demo, downloads its Kubernetes +resource manifest, injects Linkerd into the application, and uses `kubectl` to +apply it to your cluster. The app comprises the Kubernetes deployments and +services that run in the `booksapp` namespace. + +Confirm that the Linkerd data plane was injected successfully: + +```bash +$ linkerd check -n booksapp --proxy -o short +``` + +You can take a quick look at all the components that were added to your +cluster by running: + +```bash +$ kubectl -n booksapp get all +``` + +Once the rollout has completed successfully, you can access the app itself by +port-forwarding `webapp` locally: + +```bash +$ kubectl -n booksapp port-forward svc/webapp 7000 & +``` + +Open [http://localhost:7000/](http://localhost:7000/) in your browser to see the +frontend. + +![Frontend](/docs/images/books/frontend.png "Frontend") + +## Creating a Server resource + +Both the `books` service and the `webapp` service in the demo application are +clients of the `authors` service. + +However, these services send different requests to the `authors` service. The +`books` service should only send `GET` +requests to the `/authors/:id.json` route, to get the author associated with a +particular book. Meanwhile, the `webapp` service may also send `DELETE` and +`PUT` requests to `/authors`, and `POST` requests to `/authors.json`, as it +allows the user to create and delete authors. + +Since the `books` service should never need to create or delete authors, we will +create separate authorization policies for the `webapp` and `books` services, +restricting which services can access individual routes of the `authors` +service. + +First, let's run the `linkerd viz authz` command to list the authorization +resources that currently exist for the `authors` deployment: + +```bash +$ linkerd viz authz -n booksapp deploy/authors +ROUTE SERVER AUTHORIZATION UNAUTHORIZED SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 +default default:all-unauthenticated default/all-unauthenticated 0.0rps 70.31% 8.1rps 1ms 43ms 49ms +probe default:all-unauthenticated default/probe 0.0rps 100.00% 0.3rps 1ms 1ms 1ms +``` + +By default, the `authors` deployment uses the cluster's default authorization +policy, "all-unauthenticated". In addition, a separate authorization is +generated to allow liveness and readiness probes from the kubelet. + +First, we'll create a [`Server`] resource for the `authors` deployment's service +port. For details on [`Server`] resources, see +[here](../restricting-access/#creating-a-server-resource). + +```bash +kubectl apply -f - <}} +Routes configured in service profiles are different from [`HTTPRoute`] resources. +Service profile routes allow you to collect per-route metrics and configure +client-side behavior such as retries and timeouts. [`HTTPRoute`] resources, on the +other hand, can be the target of [`AuthorizationPolicies`] and allow you to specify +per-route authorization. + +[`HTTPRoute`]: ../../reference/authorization-policy/#httproute +[`AuthorizationPolicies`]: + ../../reference/authorization-policy/#authorizationpolicy +{{< /note >}} + +First, let's create an [`HTTPRoute`] that matches `GET` requests to the `authors` +service's API: + +```bash +kubectl apply -f - <}} +Two versions of the HTTPRoute resource may be used with Linkerd: + +- The upstream version provided by the Gateway API, with the + `gateway.networking.k8s.io` API group +- A Linkerd-specific CRD provided by Linkerd, with the `policy.linkerd.io` API + group + +The two HTTPRoute resource definitions are similar, but the Linkerd version +implements experimental features not yet available with the upstream Gateway API +resource definition. See [the HTTPRoute reference +documentation](../../reference/httproute/#linkerd-and-gateway-api-httproutes) +for details. +{{< /note >}} + +This will create an [`HTTPRoute`] targeting the `authors-server` [`Server`] resource +we defined previously. The `rules` section defines a list of matches, which +determine which requests match the [`HTTPRoute`]. Here, we 've defined a match +rule that matches `GET` requests to the path `/authors.json`, and a second match +rule that matches `GET` requests to paths starting with the path segment +`/authors`. + +Now that we've created a route, we can associate policy with that route. We'll +create an [`AuthorizationPolicy`] resource that defines policy for our +[`HTTPRoute`]: + +```bash +kubectl apply -f - <}} Unlike Kubernetes CPU limits and requests, which can be expressed +in milliCPUs, the `proxy-cpu-limit` annotation should be expressed in whole +numbers of CPU cores. Fractional values will be rounded up to the nearest whole +number. {{< /note >}} + +## Using Kubernetes CPU Limits and Requests + +Kubernetes provides +[CPU limits and CPU requests](https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/#specify-a-cpu-request-and-a-cpu-limit) +to configure the resources assigned to any pod or container. These may also be +used to configure the Linkerd proxy's CPU usage. However, depending on how the +kubelet is configured, using Kubernetes resource limits rather than the +`proxy-cpu-limit` annotation may not be ideal. + +{{< warning >}} +When the environment variable configured by the `proxy-cpu-limit` annotation is +unset, the proxy will run only a single worker thread. Therefore, a +`proxy-cpu-limit` annotation should always be added to set an upper bound on the +number of CPU cores used by the proxy, even when Kubernetes CPU limits are also +in use. +{{< /warning >}} + +The kubelet uses one of two mechanisms for enforcing pod CPU limits. This is +determined by the +[`--cpu-manager-policy` kubelet option](https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#configuration). +With the default CPU manager policy, +[`none`](https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#none-policy), +the kubelet uses +[CFS quotas](https://en.wikipedia.org/wiki/Completely_Fair_Scheduler) to enforce +CPU limits. This means that the Linux kernel is configured to limit the amount +of time threads belonging to a given process are scheduled. Alternatively, the +CPU manager policy may be set to +[`static`](https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/#static-policy). +In this case, the kubelet will use Linux `cgroup`s to enforce CPU limits for +containers which meet certain criteria. + +On the other hand, using +[cgroup cpusets](https://www.kernel.org/doc/Documentation/cgroup-v1/cpusets.txt) +will limit the number of CPU cores available to the process. In essence, it will +appear to the proxy that the system has fewer CPU cores than it actually does. +If this value is lower than the value of the `proxy-cpu-limit` annotation, the +proxy will use the number of CPU cores determined by the cgroup limit. + +However, it's worth noting that in order for this mechanism to be used, certain +criteria must be met: + +- The kubelet must be configured with the `static` CPU manager policy +- The pod must be in the + [Guaranteed QoS class](https://kubernetes.io/docs/tasks/configure-pod-container/quality-service-pod/#create-a-pod-that-gets-assigned-a-qos-class-of-guaranteed). + This means that all containers in the pod must have both a limit and a request + for memory and CPU, and the limit for each must have the same value as the + request. +- The CPU limit and CPU request must be an integer greater than or equal to 1. + +## Using Helm + +When using [Helm](../install-helm/), users must take care to set the +`proxy.cores` Helm variable in addition to `proxy.cpu.limit`, if +the criteria for cgroup-based CPU limits +[described above](#using-kubernetes-cpu-limits-and-requests) are not met. diff --git a/linkerd.io/content/2.17/tasks/configuring-proxy-discovery-cache.md b/linkerd.io/content/2.17/tasks/configuring-proxy-discovery-cache.md new file mode 100644 index 0000000000..59750968de --- /dev/null +++ b/linkerd.io/content/2.17/tasks/configuring-proxy-discovery-cache.md @@ -0,0 +1,82 @@ +--- +title: Configuring Proxy Discovery Cache +description: Changing proxy discover cache timeouts when using slow clients. +--- + +The Linkerd proxy maintains in-memory state, such as discovery results, requests +and connections. This state is cached to allow the proxy to process traffic more +efficiently. Cached discovery results also improve resiliency in the face of +control plane outages. + +To ensure the CPU and memory footprint is low, cached entries are dropped if +they go unused for some amount of time. If an entry is not referenced within the +timeout, it will be evicted. If it is referenced, the timer resets. + +These timeouts are handle via these two config values: + +- `proxy.outboundDiscoveryCacheUnusedTimeout`: Defines the eviction timeout for + cached service discovery results, connections and clients. Defaults to `5s`. +- `proxy.inboundDiscoveryCacheUnusedTimeout`: Defines the eviction timeout for + cached policy discovery results. Defaults to `90s`. + +These values can be configured globally (affecting all the data plane) via Helm +or the CLI at install/upgrade time, or with annotations at a namespace or +workload level for affecting only workloads under a given namespace or specific +workloads. + +## Configuring via Helm + +When installing/upgrading Linkerd via [Helm](../install-helm/), you can use the +`proxy.outboundDiscoveryCacheUnusedTimeout` and +`proxy.inboundDiscoveryCacheUnusedTimeout` values. For example: + +```bash +helm upgrade linkerd-control-plane \ + --set proxy.outboundDiscoveryCacheUnusedTimeout=60s \ + --set proxy.inboundDiscoveryCacheUnusedTimeout=120s \ + linkerd/linkerd-control-plane +``` + +## Configuring via the Linkerd CLI + +As with any Helm value, these are available via the `--set` flag: + +```bash +linkerd upgrade \ + --set proxy.outboundDiscoveryCacheUnusedTimeout=60s \ + --set proxy.inboundDiscoveryCacheUnusedTimeout=120s \ + | kubectl apply -f - +``` + +## Configuring via Annotations + +You can also use the +`config.linkerd.io/proxy-outbound-discovery-cache-unused-timeout` and +`config.linkerd.io/proxy-inbound-discovery-cache-unused-timeout` annotations at +the namespace or pod template level: + +```yaml +kind: Deployment +apiVersion: apps/v1 +metadata: + name: my-deployment + # ... +spec: + template: + metadata: + annotations: + config.linkerd.io/proxy-outbound-discovery-cache-unused-timeout: '60s' + config.linkerd.io/proxy-inbound-discovery-cache-unused-timeout: '120s' + # ... +``` + +Note that these values need to be present before having injected your workloads. +For applying to existing workloads, you'll need to roll them out. + +## When to Change Timeouts + +In the vast majority of cases the default values will just work. You should +think about experimenting with larger values when using slow clients (5 RPS or +less across two or more replicas) where clients would experience unexpected +connection closure errors as soon as the control plane comes down. A higher +cache idle timeout for discovery results can help mitigating these problems. diff --git a/linkerd.io/content/2.17/tasks/configuring-rate-limiting.md b/linkerd.io/content/2.17/tasks/configuring-rate-limiting.md new file mode 100644 index 0000000000..5b219fb103 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/configuring-rate-limiting.md @@ -0,0 +1,151 @@ +--- +title: Configuring Rate Limiting +description: Using HTTP local rate limiting to protect a service +--- + +In this guide, we'll walk you through deploying an `HTTPLocalRateLimitPolicy` +resource to rate-limit the traffic to a given service. + +For more information about Linkerd's rate limiting check the [Rate Limiting +feature doc](../../features/rate-limiting/) and the [HTTPLocalRateLimitPolicy +reference doc](../../reference/rate-limiting/). + +## Prerequisites + +To use this guide you'll only need a Kubernetes cluster running a Linkerd +instance. You can follow the [installing Linkerd Guide](../install/). + +## Setup + +First inject and install the Emojivoto application, then scale-down the vote-bot +workload to avoid it interfering with our testing: + +```bash +linkerd inject https://run.linkerd.io/emojivoto.yml | kubectl apply -f - +kubectl -n emojivoto scale --replicas 0 deploy/vote-bot +``` + +Finally, deploy a workload with an Ubuntu image, open a shell into it and +install curl: + +```bash +kubectl create deployment client --image ubuntu -- bash -c "sleep infinity" +kubectl exec -it client-xxx -- bash +root@client-xxx:/# apt-get update && apt-get install -y curl +``` + +Leave that shell open so we can use it below when [sending +requests](#sending-requests). + +## Creating an HTTPLocalRateLimitPolicy resource + +We need first to create a `Server` resource pointing to the `web-svc` service. +Note that this `Server` has `accessPolicy: all-unauthenticated`, which means +that traffic is allowed by default and we don't require to declare authorization +policies associated to it: + +```yaml +kubectl apply -f - <}} +Retries configured in this way are **incompatible with ServiceProfiles**. If a +[ServiceProfile](../../features/service-profiles/) is defined for a Service, +proxies will use the ServiceProfile retry configuration and ignore any retry +annotations. +{{< /warning >}} + +## Retries + +For HTTPRoutes that are idempotent, you can add the `retry.linkerd.io/http: 5xx` +annotation which instructs Linkerd to retry any requests which fail with an HTTP +response status in the 500s. + +Note that requests will not be retried if the body exceeds 64KiB. + +## Retry Limits + +You can also add the `retry.linkerd.io/limit` annotation to specify the maximum +number of times a request may be retried. By default, this limit is `1`. + +## gRPC Retries + +Retries can also be configured for gRPC traffic by adding the +`retry.linkerd.io/grpc` annotation to a GRPCRoute or Service resource. The value +of this annotation is a comma seperated list of gRPC status codes that should +be retried. diff --git a/linkerd.io/content/2.17/tasks/configuring-timeouts.md b/linkerd.io/content/2.17/tasks/configuring-timeouts.md new file mode 100644 index 0000000000..6ac672a5be --- /dev/null +++ b/linkerd.io/content/2.17/tasks/configuring-timeouts.md @@ -0,0 +1,25 @@ +--- +title: Configuring Timeouts +description: Configure Linkerd to automatically fail requests that take too long. +--- + +To limit how long Linkerd will wait before failing an outgoing request to +another service, you can configure timeouts. Timeouts specify the maximum amount +of time to wait for a response from a remote service to complete after the +request is sent. If the timeout elapses without receiving a response, Linkerd +will cancel the request and return a [504 Gateway Timeout] response. + +Timeouts can be specified by adding annotations to HTTPRoute, GRPCRoute, or +Service resources. + +{{< warning >}} +Timeouts configured in this way are **incompatible with ServiceProfiles**. If a +[ServiceProfile](../../features/service-profiles/) is defined for a Service, +proxies will use the ServiceProfile timeout configuration and ignore any timeout +annotations. +{{< /warning >}} + +## Timeouts + +Check out the [timeouts section](../books/#timeouts) of the books demo +for a tutorial of how to configure timeouts. diff --git a/linkerd.io/content/2.17/tasks/customize-install.md b/linkerd.io/content/2.17/tasks/customize-install.md new file mode 100644 index 0000000000..6c8c12288e --- /dev/null +++ b/linkerd.io/content/2.17/tasks/customize-install.md @@ -0,0 +1,104 @@ +--- +title: Customizing Linkerd's Configuration with Kustomize +description: Use Kustomize to modify Linkerd's configuration in a programmatic way. +--- + +Instead of forking the Linkerd install and upgrade process, +[Kustomize](https://kustomize.io/) can be used to patch the output of `linkerd +install` in a consistent way. This allows customization of the install to add +functionality specific to installations. + +{{< docs/production-note >}} + +To get started, save the output of `linkerd install` to a YAML file. This will +be the base resource that Kustomize uses to patch and generate what is added +to your cluster. + +```bash +linkerd install > linkerd.yaml +``` + +{{< note >}} +When upgrading, make sure you populate this file with the content from `linkerd +upgrade`. Using the latest `kustomize` releases, it would be possible to +automate this with an [exec +plugin](https://github.com/kubernetes-sigs/kustomize/tree/master/docs/plugins#exec-plugins). +{{< /note >}} + +Next, create a `kustomization.yaml` file. This file will contain the +instructions for Kustomize listing the base resources and the transformations to +do on those resources. Right now, this looks pretty empty: + +```yaml +resources: +- linkerd.yaml +``` + +Now, let's look at how to do some example customizations. + +{{< note >}} +Kustomize allows as many patches, transforms and generators as you'd like. These +examples show modifications one at a time but it is possible to do as many as +required in a single `kustomization.yaml` file. +{{< /note >}} + +## Add PriorityClass + +There are a couple components in the control plane that can benefit from being +associated with a critical `PriorityClass`. While this configuration isn't +currently supported as a flag to `linkerd install`, it is not hard to add by +using Kustomize. + +First, create a file named `priority-class.yaml` that will create define a +`PriorityClass` resource. + +```yaml +apiVersion: scheduling.k8s.io/v1 +description: Used for critical linkerd pods that must run in the cluster, but + can be moved to another node if necessary. +kind: PriorityClass +metadata: + name: linkerd-critical +value: 1000000000 +``` + +{{< note >}} +`1000000000` is the max. allowed user-defined priority, adjust +accordingly. +{{< /note >}} + +Next, create a file named `patch-priority-class.yaml` that will contain the +overlay. This overlay will explain what needs to be modified. + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: linkerd-identity + namespace: linkerd +spec: + template: + spec: + priorityClassName: linkerd-critical +``` + +Then, add this as a strategic merge option to `kustomization.yaml`: + +```yaml +resources: +- priority-class.yaml +- linkerd.yaml +patchesStrategicMerge: +- patch-priority-class.yaml +``` + +Applying this to your cluster requires taking the output of `kustomize` +and piping it to `kubectl apply`. For example, you can run: + +```bash +# install the Linkerd CRDs +linkerd install --crds | kubectl apply -f - + +# install the Linkerd control plane manifests using Kustomize +kubectl kustomize . | kubectl apply -f - +``` diff --git a/linkerd.io/content/2.17/tasks/debugging-502s.md b/linkerd.io/content/2.17/tasks/debugging-502s.md new file mode 100644 index 0000000000..7aa05f21f8 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/debugging-502s.md @@ -0,0 +1,75 @@ +--- +title: Debugging 502s +description: Determine why Linkerd is returning 502 responses. +--- + +When the Linkerd proxy encounters connection errors while processing a +request, it will typically return an HTTP 502 (Bad Gateway) response. It can be +very difficult to figure out why these errors are happening because of the lack +of information available. + +## Why do these errors only occur when Linkerd is injected? + +Linkerd turns connection errors into HTTP 502 responses. This can make issues +which were previously undetected suddenly visible. This is a good thing. +Linkerd also changes the way that connections to your application are managed: +it re-uses persistent connections and establishes an additional layer of +connection tracking. Managing connections in this way can sometimes expose +underlying application or infrastructure issues such as misconfigured connection +timeouts which can manifest as connection errors. + +## Why can't Linkerd give a more informative error message? + +From the Linkerd proxy's perspective, it just sees its connections to the +application refused or closed without explanation. This makes it nearly +impossible for Linkerd to report any error message in the 502 response. However, +if these errors coincide with the introduction of Linkerd, it does suggest that +the problem is related to connection re-use or connection tracking. Here are +some common reasons why the application may be refusing or terminating +connections. + +## Common Causes of Connection Errors + +### Connection Idle Timeouts + +Some servers are configured with a connection idle timeout (for example, [this +timeout in the Go HTTP +server](https://golang.org/src/net/http/server.go#L2535]). This means that the +server will close any connections which do not receive any traffic in the +specified time period. If any requests are already in transit when the +connection shutdown is initiated, those requests will fail. This scenario is +likely to occur if you have traffic with a regular period (such as liveness +checks, for example) and an idle timeout equal to that period. + +To remedy this, ensure that your server's idle timeouts are sufficiently long so +that they do not close connections which are actively in use. + +### Half-closed Connection Timeouts + +During the shutdown of a TCP connection, each side of the connection must be +closed independently. When one side is closed but the other is not, the +connection is said to be "half-closed". It is valid for the connection to be in +this state, however, the operating system's connection tracker can lose track of +connections which remain half-closed for long periods of time. This can lead to +responses not being delivered and to port conflicts when establishing new +connections which manifest as 502 responses. + +You can use a [script to detect half-closed +connections](https://gist.github.com/adleong/0203b0864af2c29ddb821dd48f339f49) +on your Kubernetes cluster. If you detect a large number of half-closed +connections, you have a couple of ways to remedy the situation. + +One solution would be to update your application to not leave connections +half-closed for long periods of time or to stop using software that does this. +Unfortunately, this is not always an option. + +Another option is to increase the connection tracker's timeout for half-closed +connections. The default value of this timeout is platform dependent but is +typically 1 minute or 1 hour. You can view the current value by looking at the +file `/proc/sys/net/netfilter/nf_conntrack_tcp_timeout_close_wait` in any +injected container. To increase this value, you can use the +`--close-wait-timeout` flag with `linkerd inject`. Note, however, that setting +this flag will also set the `privileged` field of the proxy init container to +true. Setting this timeout to 1 hour is usually sufficient and matches the +[value used by +kube-proxy](https://github.com/kubernetes/kubernetes/issues/32551). diff --git a/linkerd.io/content/2.17/tasks/debugging-your-service.md b/linkerd.io/content/2.17/tasks/debugging-your-service.md new file mode 100644 index 0000000000..82b5ba8e1d --- /dev/null +++ b/linkerd.io/content/2.17/tasks/debugging-your-service.md @@ -0,0 +1,61 @@ +--- +title: Debugging gRPC applications with request tracing +description: Follow a long-form example of debugging a failing gRPC application using + live request tracing. +--- + +The demo application emojivoto has some issues. Let's use that and Linkerd to +diagnose an application that fails in ways which are a little more subtle than +the entire service crashing. This guide assumes that you've followed the steps +in the [Getting Started](../../getting-started/) guide and have Linkerd and the +demo application running in a Kubernetes cluster. If you've not done that yet, +go get started and come back when you're done! + +If you glance at the Linkerd dashboard (by running the `linkerd viz dashboard` +command), you should see all the resources in the `emojivoto` namespace, +including the deployments. Each deployment running Linkerd shows success rate, +requests per second and latency percentiles. + +![Top Level Metrics](/docs/images/debugging/stat.png "Top Level Metrics") + +That's pretty neat, but the first thing you might notice is that the success +rate is well below 100%! Click on `web` and let's dig in. + +![Deployment Detail](/docs/images/debugging/octopus.png "Deployment Detail") + +You should now be looking at the Deployment page for the web deployment. The first +thing you'll see here is that the web deployment is taking traffic from `vote-bot` +(a deployment included with emojivoto to continually generate a low level of +live traffic). The web deployment also has two outgoing dependencies, `emoji` +and `voting`. + +While the emoji deployment is handling every request from web successfully, it +looks like the voting deployment is failing some requests! A failure in a dependent +deployment may be exactly what is causing the errors that web is returning. + +Let's scroll a little further down the page, we'll see a live list of all +traffic that is incoming to *and* outgoing from `web`. This is interesting: + +![Top](/docs/images/debugging/web-top.png "Top") + +There are two calls that are not at 100%: the first is vote-bot's call to the +`/api/vote` endpoint. The second is the `VoteDoughnut` call from the web +deployment to its dependent deployment, `voting`. Very interesting! Since +`/api/vote` is an incoming call, and `VoteDoughnut` is an outgoing call, this is +a good clue that this endpoint is what's causing the problem! + +Finally, to dig a little deeper, we can click on the `tap` icon in the far right +column. This will take us to the live list of requests that match only this +endpoint. You'll see `Unknown` under the `GRPC status` column. This is because +the requests are failing with a +[gRPC status code 2](https://godoc.org/google.golang.org/grpc/codes#Code), +which is a common error response as you can see from +[the code][code]. Linkerd is aware of gRPC's response classification without any +other configuration! + +![Tap](/docs/images/debugging/web-tap.png "Tap") + +At this point, we have everything required to get the endpoint fixed and restore +the overall health of our applications. + +[code]: https://github.com/BuoyantIO/emojivoto/blob/67faa83af33db647927946a672fc63ab7ce869aa/emojivoto-voting-svc/api/api.go#L21 diff --git a/linkerd.io/content/2.17/tasks/distributed-tracing.md b/linkerd.io/content/2.17/tasks/distributed-tracing.md new file mode 100644 index 0000000000..c3c42c47c4 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/distributed-tracing.md @@ -0,0 +1,313 @@ +--- +title: Distributed tracing with Linkerd +description: Use Linkerd to help instrument your application with distributed tracing. +--- + +Using distributed tracing in practice can be complex, for a high level +explanation of what you get and how it is done, we've assembled a [list of +myths](https://linkerd.io/2019/08/09/service-mesh-distributed-tracing-myths/). + +This guide will walk you through configuring and enabling tracing for +[emojivoto](../../getting-started/#step-5-install-the-demo-app). Jump to the end +for some recommendations on the best way to make use of distributed tracing with +Linkerd. + +To use distributed tracing, you'll need to: + +- Install the Linkerd-Jaeger extension. +- Modify your application to emit spans. + +In the case of emojivoto, once all these steps are complete there will be a +topology that looks like: + +![Topology](/docs/images/tracing/tracing-topology.svg "Topology") + +## Prerequisites + +- To use this guide, you'll need to have Linkerd installed on your cluster. + Follow the [Installing Linkerd Guide](../install/) if you haven't + already done this. + +## Install the Linkerd-Jaeger extension + +The first step of getting distributed tracing setup is installing the +Linkerd-Jaeger extension onto your cluster. This extension consists of a +collector, a Jaeger backend, and a Jaeger-injector. The collector consumes spans +emitted from the mesh and your applications and sends them to the Jaeger backend +which stores them and serves a dashboard to view them. The Jaeger-injector is +responsible for configuring the Linkerd proxies to emit spans. + +To install the Linkerd-Jaeger extension, run the command: + +```bash +linkerd jaeger install | kubectl apply -f - +``` + +{{< note >}} +The Linkerd-Jaeger extension currently configures proxies to export traces +with the OpenCensus protocol by default for backwards compatibility. OpenCensus is +[sunset and no longer maintained](https://opentelemetry.io/blog/2023/sunsetting-opencensus/), +so we recommend installing the Linkerd-Jaeger extension with OpenTelemetry as the +proxy trace export protocol: + +```bash +linkerd jaeger install --set webhook.collectorTraceProtocol=opentelemetry | kubectl apply -f +``` + +In the future, the default protocol will be changed to OpenTelemetry so this step +will no longer be necessary. +{{< /note >}} + +You can verify that the Linkerd-Jaeger extension was installed correctly by +running: + +```bash +linkerd jaeger check +``` + +## Install Emojivoto + + Add emojivoto to your cluster and inject it with the Linkerd proxy: + + ```bash + linkerd inject https://run.linkerd.io/emojivoto.yml | kubectl apply -f - + ``` + +Before moving onto the next step, make sure everything is up and running with +`kubectl`: + +```bash +kubectl -n emojivoto rollout status deploy/web +``` + +## Modify the application + +Unlike most features of a service mesh, distributed tracing requires modifying +the source of your application. Tracing needs some way to tie incoming requests +to your application together with outgoing requests to dependent services. To do +this, some headers are added to each request that contain a unique ID for the +trace. Linkerd uses the [b3 +propagation](https://github.com/openzipkin/b3-propagation) format to tie these +things together. + +We've already modified emojivoto to instrument its requests with this +information, this +[commit](https://github.com/BuoyantIO/emojivoto/commit/47a026c2e4085f4e536c2735f3ff3788b0870072) +shows how this was done. For most programming languages, it simply requires the +addition of a client library to take care of this. Emojivoto uses the OpenCensus +client, but others should be used. + +To enable tracing in emojivoto, run: + +```bash +kubectl -n emojivoto set env --all deploy OC_AGENT_HOST=collector.linkerd-jaeger:55678 +``` + +This command will add an environment variable that enables the applications to +propagate context and emit spans. In the meantime, the collector installed with +Linkerd-Jaeger will continue to support both protocols. + +## Explore Jaeger + +With `vote-bot` starting traces for every request, spans should now be showing +up in Jaeger. To get to the UI, run: + +```bash +linkerd jaeger dashboard +``` + +![Jaeger](/docs/images/tracing/jaeger-empty.png "Jaeger") + +You can search for any service in the dropdown and click Find Traces. `vote-bot` +is a great way to get started. + +![Search](/docs/images/tracing/jaeger-search.png "Search") + +Clicking on a specific trace will provide all the details, you'll be able to see +the spans for every proxy! + +![Search](/docs/images/tracing/example-trace.png "Search") + +There sure are a lot of `linkerd-proxy` spans in that output. Internally, the +proxy has a server and client side. When a request goes through the proxy, it is +received by the server and then issued by the client. For a single request that +goes between two meshed pods, there will be a total of 4 spans. Two will be on +the source side as the request traverses that proxy and two will be on the +destination side as the request is received by the remote proxy. + +## Integration with the Dashboard + +After having set up the Linkerd-Jaeger extension, as the proxy adds application +meta-data as trace attributes, users can directly jump into related resources +traces directly from the linkerd-web dashboard by clicking the Jaeger icon in +the Metrics Table, as shown below: + +![Linkerd-Jaeger](/docs/images/tracing/linkerd-jaeger-ui.png "Linkerd-Jaeger") + +To obtain that functionality you need to install (or upgrade) the Linkerd-Viz +extension specifying the service exposing the Jaeger UI. By default, this would +be something like this: + +```bash +linkerd viz install --set jaegerUrl=jaeger.linkerd-jaeger:16686 \ + | kubectl apply -f - +``` + +## Cleanup + +To cleanup, uninstall the Linkerd-Jaeger extension along with emojivoto by running: + +```bash +linkerd jaeger uninstall | kubectl delete -f - +kubectl delete ns emojivoto +``` + +## Bring your own Jaeger + +If you have an existing Jaeger installation, you can configure the OpenCensus +collector to send traces to it instead of the Jaeger instance built into the +Linkerd-Jaeger extension. + +Create the following YAML file which disables the built in Jaeger instance +and specifies the OpenCensus collector's config. + +```bash +cat < jaeger-linkerd.yaml +jaeger: + enabled: false + +collector: + config: | + receivers: + otlp: + protocols: + grpc: + http: + opencensus: + zipkin: + jaeger: + protocols: + grpc: + thrift_http: + thrift_compact: + thrift_binary: + processors: + batch: + extensions: + health_check: + exporters: + jaeger: + endpoint: my-jaeger-collector.my-jaeger-ns:14250 + tls: + insecure: true + service: + extensions: [health_check] + pipelines: + traces: + receivers: [otlp,opencensus,zipkin,jaeger] + processors: [batch] + exporters: [jaeger] +EOF +linkerd jaeger install --values ./jaeger-linkerd.yaml | kubectl apply -f - +``` + +You'll want to ensure that the `exporters.jaeger.endpoint` which is +`my-jaeger-collector.my-jaeger-ns:14250` in this example is set to a value +appropriate for your environment. This should point to a Jaeger Collector +on port 14250. + +The YAML file is merged with the [Helm values.yaml][helm-values] which shows +other possible values that can be configured. + + +[helm-values]: https://github.com/linkerd/linkerd2/blob/main/jaeger/charts/linkerd-jaeger/values.yaml + +It is also possible to manually edit the OpenCensus configuration to have it +export to any backend which it supports. See the +[OpenCensus documentation](https://opencensus.io/service/exporters/) for a full +list. + +## Troubleshooting + +### I don't see any spans for the proxies + +The Linkerd proxy uses the [b3 +propagation](https://github.com/openzipkin/b3-propagation) format. Some client +libraries, such as Jaeger, use different formats by default. You'll want to +configure your client library to use the b3 format to have the proxies +participate in traces. + +## Recommendations + +### Ingress + +The ingress is an especially important component for distributed tracing because +it typically creates the root span of each trace and is responsible for deciding +if that trace should be sampled or not. Having the ingress make all sampling +decisions ensures that either an entire trace is sampled or none of it is, and +avoids creating "partial traces". + +Distributed tracing systems all rely on services to propagate metadata about the +current trace from requests that they receive to requests that they send. This +metadata, called the trace context, is usually encoded in one or more request +headers. There are many different trace context header formats and while we hope +that the ecosystem will eventually converge on open standards like [W3C +tracecontext](https://www.w3.org/TR/trace-context/), we only use the [b3 +format](https://github.com/openzipkin/b3-propagation) today. Being one of the +earliest widely used formats, it has the widest support, especially among +ingresses like Nginx. + +This reference architecture uses a traffic generator called `vote-bot` instead +of an ingress to create the root span of each trace. + +### Client Library + +While it is possible for services to manually propagate trace propagation +headers, it's usually much easier to use a library which does three things: + +- Propagates the trace context from incoming request headers to outgoing request + headers +- Modifies the trace context (i.e. starts a new span) +- Transmits this data to a trace collector + +We recommend using OpenTelemetry in your service and configuring it with: + +- [b3 propagation](https://github.com/openzipkin/b3-propagation) (this is the + default) +- [the OpenTelemetry agent + exporter](https://opentelemetry.io/docs/collector/deployment/agent/) + +The OpenTelemetry agent exporter will export trace data to the OpenTelemetry collector +over a gRPC API. The details of how to configure OpenTelemetry will vary language +by language, but there are [guides for many popular +languages](https://opentelemetry.io/docs/languages/). + +It is possible to use many other tracing client libraries as well. Just make +sure the b3 propagation format is being used and the client library can export +its spans in a format the collector has been configured to receive. + +## Collector: OpenTelemetry + +The OpenTelemetry collector receives trace data from the OpenTelemetry agent exporter +and potentially does translation and filtering before sending that data to +Jaeger. Having the OpenTelemetry exporter send to the OpenTelemetry collector gives +us a lot of flexibility: we can switch to any backend that OpenTelemetry supports +without needing to interrupt the application. + +## Backend: Jaeger + +Jaeger is one of the most widely used tracing backends and for good reason: it +is easy to use and does a great job of visualizing traces. However, any backend +supported by OpenTelemetry can be used instead. + +## Linkerd + +If your application is injected with Linkerd, the Linkerd proxy will participate +in the traces and will also emit trace data to the trace collector. This +enriches the trace data and allows you to see exactly how much time requests are +spending in the proxy and on the wire. + +While Linkerd can only actively participate in traces that use the b3 +propagation format, Linkerd will always forward unknown request headers +transparently, which means it will never interfere with traces that use other +propagation formats. diff --git a/linkerd.io/content/2.17/tasks/exporting-metrics.md b/linkerd.io/content/2.17/tasks/exporting-metrics.md new file mode 100644 index 0000000000..31a71341df --- /dev/null +++ b/linkerd.io/content/2.17/tasks/exporting-metrics.md @@ -0,0 +1,172 @@ +--- +title: Exporting Metrics +description: Integrate Linkerd's metrics with your existing metrics infrastructure. +--- + +Linkerd provides an extensive set of metrics for all traffic that passes through +its data plane. These metrics are collected at the proxy level and reported on +the proxy's metrics endpoint. + +Typically, consuming these metrics is not done from the proxies directly, as +each proxy only provides a portion of the full picture. Instead, a separate tool +is used to collect metrics from all proxies and aggregate them together for +consumption. + +{{< docs/production-note >}} + +One easy option is the [linkerd-viz](../../features/dashboard/) extension, which +will create an on-cluster Prometheus instance as well as dashboards and CLI +commands that make use of it. However, this extension only keeps metrics data +for a brief window of time (6 hours) and does not persist data across restarts. +Depending on your use case, you may want to export these metrics into an +external metrics store. + +There are several options for how to export these metrics to a destination +outside of the cluster: + +- [Federate data from linkerd-viz to your own Prometheus cluster](#federation) +- [Use a Prometheus integration with linkerd-viz](#integration) +- [Extract data from linkerd-viz via Prometheus's APIs](#api) +- [Gather data from the proxies directly without linkerd-viz](#proxy) + +## Using the Prometheus federation API {#federation} + +If you are already using Prometheus as your own metrics store, we recommend +taking advantage of Prometheus's *federation* API, which is designed exactly for +the use case of copying data from one Prometheus to another. + +Simply add the following item to your `scrape_configs` in your Prometheus config +file (replace `{{.Namespace}}` with the namespace where the Linkerd Viz +extension is running): + +```yaml +- job_name: 'linkerd' + kubernetes_sd_configs: + - role: pod + namespaces: + names: ['{{.Namespace}}'] + + relabel_configs: + - source_labels: + - __meta_kubernetes_pod_container_name + action: keep + regex: ^prometheus$ + + honor_labels: true + metrics_path: '/federate' + + params: + 'match[]': + - '{job="linkerd-proxy"}' + - '{job="linkerd-controller"}' +``` + +Alternatively, if you prefer to use Prometheus' ServiceMonitors to configure +your Prometheus, you can use this ServiceMonitor YAML (replace `{{.Namespace}}` +with the namespace where Linkerd Viz extension is running): + +```yaml +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + labels: + k8s-app: linkerd-prometheus + release: monitoring + name: linkerd-federate + namespace: {{.Namespace}} +spec: + endpoints: + - interval: 30s + scrapeTimeout: 30s + params: + match[]: + - '{job="linkerd-proxy"}' + - '{job="linkerd-controller"}' + path: /federate + port: admin-http + honorLabels: true + relabelings: + - action: keep + regex: '^prometheus$' + sourceLabels: + - '__meta_kubernetes_pod_container_name' + jobLabel: app + namespaceSelector: + matchNames: + - {{.Namespace}} + selector: + matchLabels: + component: prometheus +``` + +That's it! Your Prometheus cluster is now configured to federate Linkerd's +metrics from Linkerd's internal Prometheus instance. + +Once the metrics are in your Prometheus, Linkerd's proxy metrics will have the +label `job="linkerd-proxy"` and Linkerd's control plane metrics will have the +label `job="linkerd-controller"`. For more information on specific metric and +label definitions, have a look at [Proxy Metrics](../../reference/proxy-metrics/). + +For more information on Prometheus' `/federate` endpoint, have a look at the +[Prometheus federation docs](https://prometheus.io/docs/prometheus/latest/federation/). + +## Using a Prometheus integration {#integration} + +If you are not using Prometheus as your own long-term data store, you may be +able to leverage one of Prometheus's [many +integrations](https://prometheus.io/docs/operating/integrations/) to +automatically extract data from Linkerd's Prometheus instance into the data +store of your choice. Please refer to the Prometheus documentation for details. + +## Extracting data via Prometheus's APIs {#api} + +If neither Prometheus federation nor Prometheus integrations are options for +you, it is possible to call Prometheus's APIs to extract data from Linkerd. + +For example, you can call the federation API directly via a command like: + +```bash +curl -G \ + --data-urlencode 'match[]={job="linkerd-proxy"}' \ + --data-urlencode 'match[]={job="linkerd-controller"}' \ + http://prometheus.linkerd-viz.svc.cluster.local:9090/federate +``` + +{{< note >}} +If your data store is outside the Kubernetes cluster, it is likely that +you'll want to set up +[ingress](https://kubernetes.io/docs/concepts/services-networking/ingress/) +at a domain name of your choice with authentication. +{{< /note >}} + +Similar to the `/federate` API, Prometheus provides a JSON query API to +retrieve all metrics: + +```bash +curl http://prometheus.linkerd-viz.svc.cluster.local:9090/api/v1/query?query=request_total +``` + +## Gathering data from the Linkerd proxies directly {#proxy} + +Finally, if you want to avoid Linkerd's Prometheus entirely, you can query the +Linkerd proxies directly on their `/metrics` endpoint. + +For example, to view `/metrics` from a single Linkerd proxy, running in the +`linkerd` namespace: + +```bash +kubectl -n linkerd port-forward \ + $(kubectl -n linkerd get pods \ + -l linkerd.io/control-plane-ns=linkerd \ + -o jsonpath='{.items[0].metadata.name}') \ + 4191:4191 +``` + +and then: + +```bash +curl localhost:4191/metrics +``` + +Alternatively, `linkerd diagnostics proxy-metrics` can be used to retrieve +proxy metrics for a given workload. diff --git a/linkerd.io/content/2.17/tasks/exposing-dashboard.md b/linkerd.io/content/2.17/tasks/exposing-dashboard.md new file mode 100644 index 0000000000..0ce84ee2f4 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/exposing-dashboard.md @@ -0,0 +1,247 @@ +--- +title: Exposing the Dashboard +description: Make it easy for others to access Linkerd and Grafana dashboards without + the CLI. +--- + +Instead of using `linkerd viz dashboard` every time you'd like to see what's +going on, you can expose the dashboard via an ingress. This will also expose +Grafana, if you have it linked against Linkerd viz through the `grafana.url` +setting. + +{{< docs/toc >}} + +## Nginx + +### Nginx with basic auth + +A sample ingress definition is: + +```yaml +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: web-ingress-auth + namespace: linkerd-viz +data: + auth: YWRtaW46JGFwcjEkbjdDdTZnSGwkRTQ3b2dmN0NPOE5SWWpFakJPa1dNLgoK +--- +# apiVersion: networking.k8s.io/v1beta1 # for k8s < v1.19 +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: web-ingress + namespace: linkerd-viz + annotations: + nginx.ingress.kubernetes.io/upstream-vhost: $service_name.$namespace.svc.cluster.local:8084 + nginx.ingress.kubernetes.io/configuration-snippet: | + proxy_set_header Origin ""; + proxy_hide_header l5d-remote-ip; + proxy_hide_header l5d-server-id; + nginx.ingress.kubernetes.io/auth-type: basic + nginx.ingress.kubernetes.io/auth-secret: web-ingress-auth + nginx.ingress.kubernetes.io/auth-realm: 'Authentication Required' +spec: + ingressClassName: nginx + rules: + - host: dashboard.example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web + port: + number: 8084 +``` + +This exposes the dashboard at `dashboard.example.com` and protects it with basic +auth using admin/admin. Take a look at the [ingress-nginx][nginx-auth] +documentation for details on how to change the username and password. + +### Nginx with oauth2-proxy + +A more secure alternative to basic auth is using an authentication proxy, such +as [oauth2-proxy](https://oauth2-proxy.github.io/oauth2-proxy/). + +For reference on how to deploy and configure oauth2-proxy in kubernetes, see +this [blog post by Don +Bowman](https://blog.donbowman.ca/2019/02/14/using-single-sign-on-oauth2-across-many-sites-in-kubernetes/). + +tl;dr: If you deploy oauth2-proxy via the [helm +chart](https://github.com/helm/charts/tree/master/stable/oauth2-proxy), the +following values are required: + +```yaml +config: + existingSecret: oauth2-proxy + configFile: |- + email_domains = [ "example.com" ] + upstreams = [ "file:///dev/null" ] + +ingress: + enabled: true + annotations: + kubernetes.io/ingress.class: nginx + path: /oauth2 +ingress: + hosts: + - linkerd.example.com +``` + +Where the `oauth2-proxy` secret would contain the required [oauth2 +config](https://oauth2-proxy.github.io/oauth2-proxy/docs/configuration/oauth_provider) +such as, `client-id` `client-secret` and `cookie-secret`. + +Once setup, a sample ingress would be: + +```yaml +# apiVersion: networking.k8s.io/v1beta1 # for k8s < v1.19 +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: web + namespace: linkerd-viz + annotations: + nginx.ingress.kubernetes.io/upstream-vhost: $service_name.$namespace.svc.cluster.local:8084 + nginx.ingress.kubernetes.io/configuration-snippet: | + proxy_set_header Origin ""; + proxy_hide_header l5d-remote-ip; + proxy_hide_header l5d-server-id; + nginx.ingress.kubernetes.io/auth-signin: https://$host/oauth2/start?rd=$escaped_request_uri + nginx.ingress.kubernetes.io/auth-url: https://$host/oauth2/auth +spec: + ingressClassName: nginx + rules: + - host: linkerd.example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web + port: + number: 8084 +``` + +## Traefik + +A sample ingress definition is: + +```yaml +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: web-ingress-auth + namespace: linkerd-viz +data: + auth: YWRtaW46JGFwcjEkbjdDdTZnSGwkRTQ3b2dmN0NPOE5SWWpFakJPa1dNLgoK +--- +# apiVersion: networking.k8s.io/v1beta1 # for k8s < v1.19 +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: web-ingress + namespace: linkerd-viz + annotations: + ingress.kubernetes.io/custom-request-headers: l5d-dst-override:web.linkerd-viz.svc.cluster.local:8084 + traefik.ingress.kubernetes.io/auth-type: basic + traefik.ingress.kubernetes.io/auth-secret: web-ingress-auth +spec: + ingressClassName: traefik + rules: + - host: dashboard.example.com + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: web + port: + number: 8084 +``` + +This exposes the dashboard at `dashboard.example.com` and protects it with basic +auth using admin/admin. Take a look at the [Traefik][traefik-auth] documentation +for details on how to change the username and password. + +## Ambassador + +Ambassador works by defining a [mapping +](https://www.getambassador.io/docs/latest/topics/using/intro-mappings/) as an +annotation on a service. + +The below annotation exposes the dashboard at `dashboard.example.com`. + +```yaml + annotations: + getambassador.io/config: |- + --- + apiVersion: getambassador.io/v2 + kind: Mapping + name: web-mapping + host: dashboard.example.com + prefix: / + host_rewrite: web.linkerd-viz.svc.cluster.local:8084 + service: web.linkerd-viz.svc.cluster.local:8084 +``` + +## DNS Rebinding Protection + +To prevent [DNS-rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) attacks, +the dashboard rejects any request whose `Host` header is not `localhost`, +`127.0.0.1` or the service name `web.linkerd-viz.svc`. + +Note that this protection also covers the [Grafana +dashboard](../../reference/architecture/#grafana). + +The ingress-nginx config above uses the +`nginx.ingress.kubernetes.io/upstream-vhost` annotation to properly set the +upstream `Host` header. Traefik on the other hand doesn't offer that option, so +you'll have to manually set the required `Host` as explained below. + +### Tweaking Host Requirement + +If your HTTP client (Ingress or otherwise) doesn't allow to rewrite the `Host` +header, you can change the validation regexp that the dashboard server uses, +which is fed into the `web` deployment via the `enforced-host` container +argument. + +If you're managing Linkerd with Helm, then you can set the host using the +`enforcedHostRegexp` value. + +Another way of doing that is through Kustomize, as explained in [Customizing +Installation](../customize-install/), using an overlay like this one: + +```yaml +apiVersion: apps/v1 +kind: Deployment +metadata: + name: web +spec: + template: + spec: + containers: + - name: web + args: + - -linkerd-controller-api-addr=linkerd-controller-api.linkerd.svc.cluster.local:8085 + - -linkerd-metrics-api-addr=metrics-api.linkerd-viz.svc.cluster.local:8085 + - -cluster-domain=cluster.local + - -grafana-addr=grafana.linkerd-viz.svc.cluster.local:3000 + - -controller-namespace=linkerd + - -viz-namespace=linkerd-viz + - -log-level=info + - -enforced-host=^dashboard\.example\.com$ +``` + +If you want to completely disable the `Host` header check, simply use a +catch-all regexp `.*` for `-enforced-host`. + +[nginx-auth]: +https://github.com/kubernetes/ingress-nginx/blob/master/docs/examples/auth/basic/README.md +[traefik-auth]: https://docs.traefik.io/middlewares/basicauth/ diff --git a/linkerd.io/content/2.17/tasks/extensions.md b/linkerd.io/content/2.17/tasks/extensions.md new file mode 100644 index 0000000000..899eecac01 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/extensions.md @@ -0,0 +1,73 @@ +--- +title: Using extensions +description: Add functionality to Linkerd with optional extensions. +--- + +Linkerd extensions are components which can be added to a Linkerd installation +to enable additional functionality. By default, the following extensions are +available: + +* [viz](../../features/dashboard/): Metrics and visibility features +* [jaeger](../distributed-tracing/): Distributed tracing +* [multicluster](../multicluster/): Cross-cluster routing + +But other extensions are also possible. Read on for more! + +## Installing extensions + +Before installing any extensions, make sure that you have already [installed +Linkerd](../install/) and validated your cluster with `linkerd check`. + +Then, you can install the extension with the extension's `install` command. For +example, to install the `viz` extension, you can use: + +```bash +linkerd viz install | kubectl apply -f - +``` + +For built-in extensions, such as `viz`, `jaeger`, and `multicluster`, that's +all you need to do. Of course, these extensions can also be installed by with +Helm by installing that extension's Helm chart. + +Once an extension has been installed, it will be included as part of the +standard `linkerd check` command. + +{{< warning >}} + +Installing extensions in the `linkerd` namespace is not supported. In general, +Linkerd extensions will each create their own namespace -- this is the +recommended best practice. + +{{< /warning >}} + +## Installing third-party extensions + +Third-party extensions require one additional step: you must download the +extension's CLI and put it in your path. This will allow you to invoke the +extension CLI through the Linkerd CLI. (E.g. any call to `linkerd foo` will +automatically call the `linkerd-foo` binary, if it is found on your path.) + +## Listing extensions + +Every extension creates a Kubernetes namespace with the `linkerd.io/extension` +label. Thus, you can list all extensions installed on your cluster by running: + +```bash +kubectl get ns -l linkerd.io/extension +``` + +## Upgrading extensions + +Unless otherwise stated, extensions do not persist any configuration in the +cluster. To upgrade an extension, run the install again with a newer version +of the extension CLI or with a different set of configuration flags. + +## Uninstalling extensions + +All extensions have an `uninstall` command that should be used to gracefully +clean up all resources owned by an extension. For example, to uninstall the +foo extension, run: + +```bash +linkerd foo uninstall | kubectl delete -f - +``` diff --git a/linkerd.io/content/2.17/tasks/external-prometheus.md b/linkerd.io/content/2.17/tasks/external-prometheus.md new file mode 100644 index 0000000000..d127017e51 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/external-prometheus.md @@ -0,0 +1,174 @@ +--- +title: Bringing your own Prometheus +description: Use an existing Prometheus instance with Linkerd. +--- + +Even though [the linkerd-viz extension](../../features/dashboard/) comes with +its own Prometheus instance, there can be cases where using an external +instance makes more sense for various reasons. + +This tutorial shows how to configure an external Prometheus instance to scrape both +the control plane as well as the proxy's metrics in a format that is consumable +both by a user as well as Linkerd control plane components like web, etc. + +{{< docs/production-note >}} + +There are two important points to tackle here. + +- Configuring external Prometheus instance to get the Linkerd metrics. +- Configuring the linkerd-viz extension to use that Prometheus. + +## Prometheus Scrape Configuration + +The following scrape configuration has to be applied to the external +Prometheus instance. + +{{< note >}} +The below scrape configuration is a [subset of the full `linkerd-prometheus` +scrape +configuration](https://github.com/linkerd/linkerd2/blob/main/viz/charts/linkerd-viz/templates/prometheus.yaml#L47-L151). +{{< /note >}} + +Before applying, it is important to replace templated values (present in `{{}}`) +with direct values for the below configuration to work. + +```yaml + - job_name: 'linkerd-controller' + kubernetes_sd_configs: + - role: pod + namespaces: + names: + - '{{.Values.linkerdNamespace}}' + - '{{.Values.namespace}}' + relabel_configs: + - source_labels: + - __meta_kubernetes_pod_container_port_name + action: keep + regex: admin-http + - source_labels: [__meta_kubernetes_pod_container_name] + action: replace + target_label: component + + - job_name: 'linkerd-service-mirror' + kubernetes_sd_configs: + - role: pod + relabel_configs: + - source_labels: + - __meta_kubernetes_pod_label_linkerd_io_control_plane_component + - __meta_kubernetes_pod_container_port_name + action: keep + regex: linkerd-service-mirror;admin-http$ + - source_labels: [__meta_kubernetes_pod_container_name] + action: replace + target_label: component + + - job_name: 'linkerd-proxy' + kubernetes_sd_configs: + - role: pod + relabel_configs: + - source_labels: + - __meta_kubernetes_pod_container_name + - __meta_kubernetes_pod_container_port_name + - __meta_kubernetes_pod_label_linkerd_io_control_plane_ns + action: keep + regex: ^{{default .Values.proxyContainerName "linkerd-proxy" .Values.proxyContainerName}};linkerd-admin;{{.Values.linkerdNamespace}}$ + - source_labels: [__meta_kubernetes_namespace] + action: replace + target_label: namespace + - source_labels: [__meta_kubernetes_pod_name] + action: replace + target_label: pod + # special case k8s' "job" label, to not interfere with prometheus' "job" + # label + # __meta_kubernetes_pod_label_linkerd_io_proxy_job=foo => + # k8s_job=foo + - source_labels: [__meta_kubernetes_pod_label_linkerd_io_proxy_job] + action: replace + target_label: k8s_job + # drop __meta_kubernetes_pod_label_linkerd_io_proxy_job + - action: labeldrop + regex: __meta_kubernetes_pod_label_linkerd_io_proxy_job + # __meta_kubernetes_pod_label_linkerd_io_proxy_deployment=foo => + # deployment=foo + - action: labelmap + regex: __meta_kubernetes_pod_label_linkerd_io_proxy_(.+) + # drop all labels that we just made copies of in the previous labelmap + - action: labeldrop + regex: __meta_kubernetes_pod_label_linkerd_io_proxy_(.+) + # __meta_kubernetes_pod_label_linkerd_io_foo=bar => + # foo=bar + - action: labelmap + regex: __meta_kubernetes_pod_label_linkerd_io_(.+) + # Copy all pod labels to tmp labels + - action: labelmap + regex: __meta_kubernetes_pod_label_(.+) + replacement: __tmp_pod_label_$1 + # Take `linkerd_io_` prefixed labels and copy them without the prefix + - action: labelmap + regex: __tmp_pod_label_linkerd_io_(.+) + replacement: __tmp_pod_label_$1 + # Drop the `linkerd_io_` originals + - action: labeldrop + regex: __tmp_pod_label_linkerd_io_(.+) + # Copy tmp labels into real labels + - action: labelmap + regex: __tmp_pod_label_(.+) +``` + +You will also need to ensure that your Prometheus scrape interval is shorter +than the time duration range of any Prometheus queries. In order to ensure the +web dashboard and Linkerd Grafana work correctly, we recommend a 10 second +scrape interval: + +```yaml + global: + scrape_interval: 10s + scrape_timeout: 10s + evaluation_interval: 10s +``` + +The running configuration of the builtin prometheus can be used as a reference. + +```bash +kubectl -n linkerd-viz get configmap prometheus-config -o yaml +``` + +## Linkerd-Viz Extension Configuration + +Linkerd's viz extension components like `metrics-api`, etc depend +on the Prometheus instance to power the dashboard and CLI. + +The `prometheusUrl` field gives you a single place through +which all these components can be configured to an external Prometheus URL. +This is allowed both through the CLI and Helm. + +### CLI + +This can be done by passing a file with the above field to the `values` flag, +which is available through `linkerd viz install` command. + +```yaml +prometheusUrl: existing-prometheus.xyz:9090 +``` + +Once applied, this configuration is not persistent across installs. +The same has to be passed again by the user during re-installs, upgrades, etc. + +When using an external Prometheus and configuring the `prometheusUrl` +field, Linkerd's Prometheus will still be included in installation. +If you wish to disable it, be sure to include the +following configuration as well: + +```yaml +prometheus: + enabled: false +``` + +### Helm + +The same configuration can be applied through `values.yaml` when using Helm. +Once applied, Helm makes sure that the configuration is +persistent across upgrades. + +More information on installation through Helm can be found +[here](../install-helm/) diff --git a/linkerd.io/content/2.17/tasks/fault-injection.md b/linkerd.io/content/2.17/tasks/fault-injection.md new file mode 100644 index 0000000000..1d4cfb4b79 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/fault-injection.md @@ -0,0 +1,209 @@ +--- +title: Injecting Faults +description: Practice chaos engineering by injecting faults into services with Linkerd. +--- + +It is easy to inject failures into applications by using the +[HTTPRoute](../../reference/httproute/) resource to redirect a percentage of +traffic to a specific backend. This backend is completely flexible and can +return whatever responses you want - 500s, timeouts or even crazy payloads. + +The [books demo](../books/) is a great way to show off this behavior. The +overall topology looks like: + +![Topology](/docs/images/books/topology.png "Topology") + +In this guide, you will split some of the requests from `webapp` to `books`. +Most requests will end up at the correct `books` destination, however some of +them will be redirected to a faulty backend. This backend will return 500s for +every request and inject faults into the `webapp` service. No code changes are +required and as this method is configuration driven, it is a process that can be +added to integration tests and CI pipelines. If you are really living the chaos +engineering lifestyle, fault injection could even be used in production. + +## Prerequisites + +To use this guide, you'll need a Kubernetes cluster running: + +- Linkerd and Linkerd-Viz. If you haven't installed these yet, follow the + [Installing Linkerd Guide](../install/). + +## Setup the service + +First, add the [books](../books/) sample application to your cluster: + +```bash +kubectl create ns booksapp && \ + linkerd inject https://run.linkerd.io/booksapp.yml | \ + kubectl -n booksapp apply -f - +``` + +As this manifest is used as a demo elsewhere, it has been configured with an +error rate. To show how fault injection works, the error rate needs to be +removed so that there is a reliable baseline. To increase success rate for +booksapp to 100%, run: + +```bash +kubectl -n booksapp patch deploy authors \ + --type='json' \ + -p='[{"op":"remove", "path":"/spec/template/spec/containers/0/env/2"}]' +``` + +After a little while, the stats will show 100% success rate. You can verify this +by running: + +```bash +linkerd viz -n booksapp stat-inbound deploy +``` + +The output will end up looking at little like: + +```bash +NAME SERVER ROUTE TYPE SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 +authors [default]:4191 [default] 100.00% 0.20 0ms 1ms 1ms +authors [default]:7001 [default] 100.00% 3.00 2ms 36ms 43ms +books [default]:4191 [default] 100.00% 0.23 4ms 4ms 4ms +books [default]:7002 [default] 100.00% 3.60 2ms 2ms 2ms +traffic [default]:4191 [default] 100.00% 0.22 0ms 3ms 1ms +webapp [default]:4191 [default] 100.00% 0.72 4ms 5ms 1ms +webapp [default]:7000 [default] 100.00% 3.25 2ms 2ms 65ms +``` + +## Create the faulty backend + +Injecting faults into booksapp requires a service that is configured to return +errors. To do this, you can start NGINX and configure it to return 500s by +running: + +```bash +cat <}} +Two versions of the HTTPRoute resource may be used with Linkerd: + +- The upstream version provided by the Gateway API, with the + `gateway.networking.k8s.io` API group +- A Linkerd-specific CRD provided by Linkerd, with the `policy.linkerd.io` API + group + +The two HTTPRoute resource definitions are similar, but the Linkerd version +implements experimental features not yet available with the upstream Gateway API +resource definition. See [the HTTPRoute reference +documentation](../../reference/httproute/#linkerd-and-gateway-api-httproutes) +for details. +{{< /note >}} + +When Linkerd sees traffic going to the `books` service, it will send 9/10 +requests to the original service and 1/10 to the error injector. You can see +what this looks like by running `stat-outbound`: + +```bash +linkerd viz stat-outbound -n booksapp deploy/webapp +NAME SERVICE ROUTE TYPE BACKEND SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 TIMEOUTS RETRIES +webapp authors:7001 [default] 98.44% 4.28 25ms 47ms 50ms 0.00% 0.00% + └────────────────────► authors:7001 98.44% 4.28 15ms 42ms 48ms 0.00% +webapp books:7002 error-split HTTPRoute 87.76% 7.22 26ms 49ms 333ms 0.00% 0.00% + ├────────────────────► books:7002 100.00% 6.33 14ms 42ms 83ms 0.00% + └────────────────────► error-injector:8080 0.00% 0.88 12ms 24ms 25ms 0.00% +``` + +We can see here that 0.88 requests per second are being sent to the error +injector and that the overall success rate is 87.76%. + +## Cleanup + +To remove everything in this guide from your cluster, run: + +```bash +kubectl delete ns booksapp +``` diff --git a/linkerd.io/content/2.17/tasks/federated-services.md b/linkerd.io/content/2.17/tasks/federated-services.md new file mode 100644 index 0000000000..4605f3f3fc --- /dev/null +++ b/linkerd.io/content/2.17/tasks/federated-services.md @@ -0,0 +1,415 @@ +--- +title: Multi-cluster Federated Services +description: Using multi-cluster federated services +--- + +Linkerd's [multicluster extension](../multicluster/) can create federated +services which act as a union of multiple services in different clusters with +the same name and namespace. By sending traffic to the federated service, that +traffic will be load balanced among all endpoints of that service in all linked +clusters. This allows the client to be cluster agnostic, balance traffic across +multiple clusters, and be resiliant to the failure of any individual cluster. + +Federated services send traffic directly to the pods of the member services +rahter than through a gateway. Therefore, federated services have the same +requirements as *pod-to-pod* multicluster services: + +* The clusters must be on a *flat network*. In other words, pods from one + cluster must be able to address and connect to pods in the other cluster. +* The clusters must have the same trust root. +* Any clients connecting to the federated service must be meshed. + +This guide will walk you through creating a federated service to load balance +traffic to a service which exists in multiple clusters. A federated service can +include services from any number of clusters, but in this guide we'll create +a federated service for a service that spans 3 clusters. + +## Prerequisites + +* Three clusters. We will refer to them as `west`, `east`, and `north` in this + guide. +* The clusters must be on a *flat network*. In other words, pods from one + cluster must be able to address and connect to pods in the other cluster. +* Each of these clusters should be configured as `kubectl` + [contexts](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). + We'd recommend you use the names `west`, `east`, and `north` so that you can + follow along with this guide. It is easy to + [rename contexts](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-rename-context-em-) + with `kubectl`, so don't feel like you need to keep them all named this way + forever. + +## Step 1: Installing Linkerd and Linkerd-Viz + +First, install Linkerd and Linkerd-Viz into all three clusters, as described in +the [multicluster guide](../multicluster/#install-linkerd-and-linkerd-viz). +Make sure to take care that all clusters share a common trust anchor. + +## Step 2: Installing Linkerd-Multicluster + +We will install the multicluster extension into all three clusters. We can +install without the gateway because federated services use direct pod-to-pod +communication. + +```console +> linkerd --context west multicluster install --gateway=false | kubectl --context west apply -f - +> linkerd --context west check + +> linkerd --context east multicluster install --gateway=false | kubectl --context east apply -f - +> linkerd --context east check + +> linkerd --context north multicluster install --gateway=false | kubectl --context north apply -f - +> linkerd --context north check +``` + +## Step 3: Linking the Clusters + +We use the `linkerd multicluster link` command to link the `east` and `north` +cluster to the `west` cluster. This is exactly the same as in the regular +[Multicluster guide](../multicluster/#linking-the-clusters) except that we pass +the `--gateway=false` flag to create a Link which doesn't require a gateway. + +```console +> linkerd --context east multicluster link --cluster-name=east --gateway=false | kubectl --context west apply -f - +> linkerd --context north multicluster link --cluster-name=north --gateway=false | kubectl --context west apply -f - +> linkerd --context west check +``` + +## Step 4: Deploy a Service + +For our guide, we'll deploy the [bb](https://github.com/BuoyantIO/bb) service, +which is a simple server that just returns a static response. We deploy it +into all three clusters but configure each one with a different response string +so that we can tell the responses apart: + +```bash +> cat < cat < cat < kubectl --context east -n mc-demo label svc/bb mirror.linkerd.io/federated=member +> kubectl --context north -n mc-demo label svc/bb mirror.linkerd.io/federated=member +> kubectl --context west -n mc-demo label svc/bb mirror.linkerd.io/federated=member +``` + +You should immediately see a federated service created in the `west` cluster: + +```console +> kubectl --context west -n mc-demo get svc +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +bb-federated ClusterIP 10.43.56.245 8080/TCP 114s +``` + +We can also check the `status` subresource of each of the Link resources to see +which services have joined federated services or if there are any errors. + +```console +> kubectl --context west -n linkerd-multicluster get link/east -ojsonpath='{.status.federatedServices}' | jq . +[ + { + "conditions": [ + { + "lastTransitionTime": "2024-11-07T19:53:01Z", + "localRef": { + "group": "", + "kind": "Service", + "name": "bb-federated", + "namespace": "mc-demo" + }, + "message": "", + "reason": "Mirrored", + "status": "True", + "type": "Mirrored" + } + ], + "controllerName": "linkerd.io/service-mirror", + "remoteRef": { + "group": "", + "kind": "Service", + "name": "bb", + "namespace": "mc-demo" + } + } +] +> kubectl --context west -n linkerd-multicluster get link/north -ojsonpath='{.status.federatedService +s}' | jq . +[ + { + "conditions": [ + { + "lastTransitionTime": "2024-11-07T19:53:06Z", + "localRef": { + "group": "", + "kind": "Service", + "name": "bb-federated", + "namespace": "mc-demo" + }, + "message": "", + "reason": "Mirrored", + "status": "True", + "type": "Mirrored" + } + ], + "controllerName": "linkerd.io/service-mirror", + "remoteRef": { + "group": "", + "kind": "Service", + "name": "bb", + "namespace": "mc-demo" + } + } +] +``` + +## Step 6: Send some traffic! + +We'll create a deployment that uses `curl` to generate traffic to the +`bb-federated` service. + +```bash +> cat < kubectl --context west -n mc-demo logs deploy/traffic -c traffic +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-407945949","payload":"hello from east\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-420928530","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-433442439","payload":"hello from north\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-445418175","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-457469540","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-469729132","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-481971153","payload":"hello from west\n"} +{"requestUID":"in:http-sid:terminus-grpc:-1-h1:8080-496032705","payload":"hello from east\n"} +... +``` + +## Next Steps + +We now have a federated service that balances traffic accross services in three +clusters. Additional clusters can be added simply by linking the new cluster +and adding the `mirror.linkerd.io/federated=member` label to the services that +you wish to add to the federated service. Similarly, services can be removed +from the federated service at any time by removing the label. + +You may notice that the `bb-federated` federated service exists only in the +`west` cluster and not in the `east` or `north` clusters. This is because Links +are directional and to keep this guide simple, we only linked north and east to +west, and not the other way around. If we were to create links in both +directions between all three clusters, we would get a `bb-federated` service in +all three clusters. + +## Troubleshooting + +* The first step of troubleshooting should be to run the `linkerd check` command + in each of the clusters. In particular, look for the `linkerd-multicluster` + checks and ensure that all linked clusters are listed: + +```console +linkerd-multicluster +-------------------- +√ Link CRD exists +√ Link resources are valid + * east + * north +√ remote cluster access credentials are valid + * east + * north +√ clusters share trust anchors + * east + * north +√ service mirror controller has required permissions + * east + * north +√ service mirror controllers are running + * east + * north +``` + +* Check the `status` subresource of the Link resource. If any services failed to + join the federated service, they will appear as an error here. +* If a service that should join a federated service is not present in the Link + `status`, ensure that the service matches the federated service label selector + (`mirror.linkerd.io/federated=memeber` by default). +* Use the `linkerd diagnostics endpoints` command to see all of the endpoints + in a federated service: + +```console +> linkerd --context west diagnostics endpoints bb-federated.mc-demo.svc.cluster.local:8080 +NAMESPACE IP PORT POD SERVICE +mc-demo 10.42.0.108 8080 bb-85f9bbc898-j7fbq bb.mc-demo +mc-demo 10.23.1.43 8080 bb-7d9f44c6fd-9s848 bb.mc-demo +mc-demo 10.23.0.42 8080 bb-74c6c64948-j5drn bb.mc-demo +``` diff --git a/linkerd.io/content/2.17/tasks/flagger.md b/linkerd.io/content/2.17/tasks/flagger.md new file mode 100644 index 0000000000..a7c6e06fc5 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/flagger.md @@ -0,0 +1,547 @@ +--- +title: Progressive Delivery +description: Reduce deployment risk by automating canary releases based on service + metrics. +--- + +Linkerd's [dynamic request routing](../../features/request-routing/) allows you +to dynamically shift traffic between services. This can be used to implement +lower-risk deployment strategies like blue-green deploys and canaries. + +But simply shifting traffic from one version of a service to the next is just +the beginning. We can combine traffic splitting with [Linkerd's automatic +*golden metrics* telemetry](../../features/telemetry/) and drive traffic +decisions based on the observed metrics. For example, we can gradually shift +traffic from an old deployment to a new one while continually monitoring its +success rate. If at any point the success rate drops, we can shift traffic back +to the original deployment and back out of the release. Ideally, our users +remain happy throughout, not noticing a thing! + +In this tutorial, we'll show you how to use two different progressive delivery +tools: [Flagger](https://flagger.app/) and +[Argo Rollouts](https://argoproj.github.io/rollouts/) and how to tie Linkerd's +metrics and request routing together in a control loop, allowing for +fully-automated, metrics-aware canary deployments. + +{{< docs/production-note >}} + +## Prerequisites + +To use this guide, you'll need a Kubernetes cluster running: + +- Linkerd and Linkerd-Viz. If you haven't installed these yet, follow the + [Installing Linkerd Guide](../install/). + +## Flagger + +### Install Flagger + +While Linkerd will be managing the actual traffic routing, Flagger automates +the process of creating new Kubernetes resources, watching metrics and +incrementally sending users over to the new version. To add Flagger to your +cluster and have it configured to work with Linkerd, run: + +```bash +kubectl apply -k github.com/fluxcd/flagger/kustomize/linkerd +``` + +This command adds: + +- The canary + [CRD](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/) + that enables configuring how a rollout should occur. +- RBAC which grants Flagger permissions to modify all the resources that it + needs to, such as deployments and services. +- A Flagger controller configured to interact with the Linkerd control plane. + +To watch until everything is up and running, you can use `kubectl`: + +```bash +kubectl -n flagger-system rollout status deploy/flagger +``` + +### Set up the demo + +This demo consists of three components: a load generator, a deployment and a +frontend. The deployment creates a pod that returns some information such as +name. You can use the responses to watch the incremental rollout as Flagger +orchestrates it. A load generator simply makes it easier to execute the rollout +as there needs to be some kind of active traffic to complete the operation. +Together, these components have a topology that looks like: + +![Topology](/docs/images/canary/simple-topology.svg "Topology") + +To add these components to your cluster and include them in the Linkerd +[data plane](../../reference/architecture/#data-plane), run: + +```bash +kubectl create ns test && \ + kubectl apply -f https://run.linkerd.io/flagger.yml +``` + +Verify that everything has started up successfully by running: + +```bash +kubectl -n test rollout status deploy podinfo +``` + +Check it out by forwarding the frontend service locally and opening +[http://localhost:8080](http://localhost:8080) locally by running: + +```bash +kubectl -n test port-forward svc/frontend 8080 +``` + +{{< note >}} +Request routing occurs on the *client* side of the connection and not the +server side. Any requests coming from outside the mesh will not be shifted and +will always be directed to the primary backend. A service of type `LoadBalancer` +will exhibit this behavior as the source is not part of the mesh. To shift +external traffic, add your ingress controller to the mesh. +{{< /note>}} + +### Configure the release + +Before changing anything, you need to configure how a release should be rolled +out on the cluster. The configuration is contained in a +[Canary](https://docs.flagger.app/tutorials/linkerd-progressive-delivery) +and MetricTemplate definition. To apply to your cluster, run: + +```bash +kubectl apply -f - < 8080/TCP 96m +podinfo ClusterIP 10.7.252.86 9898/TCP 96m +podinfo-canary ClusterIP 10.7.245.17 9898/TCP 23m +podinfo-primary ClusterIP 10.7.249.63 9898/TCP 23m +``` + +At this point, the topology looks a little like: + +![Initialized](/docs/images/canary/initialized.svg "Initialized") + +{{< note >}} +This guide barely touches all the functionality provided by Flagger. Make sure +to read the [documentation](https://docs.flagger.app/) if you're interested in +combining canary releases with HPA, working off custom metrics or doing other +types of releases such as A/B testing. +{{< /note >}} + +### Start the rollout + +As a system, Kubernetes resources have two major sections: the spec and status. +When a controller sees a spec, it tries as hard as it can to make the status of +the current system match the spec. With a deployment, if any of the pod spec +configuration is changed, a controller will kick off a rollout. By default, the +deployment controller will orchestrate a [rolling +update](https://kubernetes.io/docs/tutorials/kubernetes-basics/update/update-intro/). + +In this example, Flagger will notice that a deployment's spec changed and start +orchestrating the canary rollout. To kick this process off, you can update the +image to a new version by running: + +```bash +kubectl -n test set image deployment/podinfo \ + podinfod=quay.io/stefanprodan/podinfo:1.7.1 +``` + +Any kind of modification to the pod's spec such as updating an environment +variable or annotation would result in the same behavior as updating the image. + +On update, the canary deployment (`podinfo`) will be scaled up. Once ready, +Flagger will begin to update the HTTPRoute incrementally. With a configured +stepWeight of 10, each increment will increase the weight of `podinfo` by 10. +For each period, the success rate will be observed and as long as it is over the +threshold of 99%, Flagger will continue the rollout. To watch this entire +process, run: + +```bash +kubectl -n test get ev --watch +``` + +While an update is occurring, the resources and traffic will look like this at a +high level: + +![Ongoing](/docs/images/canary/ongoing.svg "Ongoing") + +After the update is complete, this picture will go back to looking just like the +figure from the previous section. + +{{< note >}} +You can toggle the image tag between `1.7.1` and `1.7.0` to start the rollout +again. +{{< /note >}} + +### Resource + +The canary resource updates with the current status and progress. You can watch +by running: + +```bash +watch kubectl -n test get canary +``` + +Behind the scenes, Flagger is splitting traffic between the primary and canary +backends by updating the HTTPRoute resource. To watch how this configuration +changes over the rollout, run: + +```bash +kubectl -n test get httproute.gateway.networking.k8s.io podinfo -o yaml +``` + +Each increment will increase the weight of `podinfo-canary` and decrease the +weight of `podinfo-primary`. Once the rollout is successful, the weight of +`podinfo-primary` will be set back to 100 and the underlying canary deployment +(`podinfo`) will be scaled down. + +### Metrics + +As traffic shifts from the primary deployment to the canary one, Linkerd +provides visibility into what is happening to the destination of requests. The +metrics show the backends receiving traffic in real time and measure the success +rate, latencies and throughput. From the CLI, you can watch this by running: + +```bash +watch linkerd viz -n test stat deploy --from deploy/load +``` + +### Browser + +Visit again [http://localhost:8080](http://localhost:8080). Refreshing the page +will show toggling between the new version and a different header color. +Alternatively, running `curl http://localhost:8080` will return a JSON response +that looks something like: + +```bash +{ + "hostname": "podinfo-primary-74459c7db8-lbtxf", + "version": "1.7.0", + "revision": "4fc593f42c7cd2e7319c83f6bfd3743c05523883", + "color": "blue", + "message": "greetings from podinfo v1.7.0", + "goos": "linux", + "goarch": "amd64", + "runtime": "go1.11.2", + "num_goroutine": "6", + "num_cpu": "8" +} +``` + +This response will slowly change as the rollout continues. + +### Cleanup + +To cleanup, remove the Flagger controller from your cluster and delete the +`test` namespace by running: + +```bash +kubectl delete -k github.com/fluxcd/flagger/kustomize/linkerd && \ + kubectl delete ns test +``` + +## Argo Rollouts + +[Argo Rollouts](https://argo-rollouts.readthedocs.io) is another tool which can +use Linkerd to perform incremental canary rollouts based on traffic metrics. + +### Install Argo Rollouts + +Similarly to Flagger, Argo Rollouts will automate the process of creating new +Kubernetes resources, watching metrics and will use Linkerd to incrementally +shift traffic to the new version. To install Argo Rollouts, run: + +```bash +kubectl create namespace argo-rollouts && \ + kubectl apply -n argo-rollouts -f https://github.com/argoproj/argo-rollouts/releases/latest/download/install.yaml +``` + +To use Argo Rollouts with Linkerd, you will also need to enable the GatewayAPI +routing plugin and grant it the necessary RBAC to ready and modify HTTPRoutes: + +```bash +kubectl apply -f - <}} + +## Generating the certificates with `step` + +### Trust anchor certificate + +First generate the root certificate with its private key (using `step` version +0.10.1): + +```bash +step certificate create root.linkerd.cluster.local ca.crt ca.key \ +--profile root-ca --no-password --insecure +``` + +This generates the `ca.crt` and `ca.key` files. The `ca.crt` file is what you +need to pass to the `--identity-trust-anchors-file` option when installing +Linkerd with the CLI, and the `identityTrustAnchorsPEM` value when installing +the `linkerd-control-plane` chart with Helm. + +Note we use `--no-password --insecure` to avoid encrypting those files with a +passphrase. + +For a longer-lived trust anchor certificate, pass the `--not-after` argument +to the step command with the desired value (e.g. `--not-after=87600h`). + +### Issuer certificate and key + +Then generate the intermediate certificate and key pair that will be used to +sign the Linkerd proxies' CSR. + +```bash +step certificate create identity.linkerd.cluster.local issuer.crt issuer.key \ +--profile intermediate-ca --not-after 8760h --no-password --insecure \ +--ca ca.crt --ca-key ca.key +``` + +This will generate the `issuer.crt` and `issuer.key` files. + +## Passing the certificates to Linkerd + +You can finally provide these files when installing Linkerd with the CLI: + +```bash +# first, install the Linkerd CRDs +linkerd install --crds | kubectl apply -f - + +# install the Linkerd control plane, with the certificates we just generated. +linkerd install \ + --identity-trust-anchors-file ca.crt \ + --identity-issuer-certificate-file issuer.crt \ + --identity-issuer-key-file issuer.key \ + | kubectl apply -f - +``` + +Or when installing with Helm, first install the `linkerd-crds` chart: + +```bash +helm install linkerd-crds linkerd/linkerd-crds -n linkerd --create-namespace +``` + +Then install the `linkerd-control-plane` chart: + +```bash +helm install linkerd-control-plane -n linkerd \ + --set-file identityTrustAnchorsPEM=ca.crt \ + --set-file identity.issuer.tls.crtPEM=issuer.crt \ + --set-file identity.issuer.tls.keyPEM=issuer.key \ + linkerd/linkerd-control-plane +``` diff --git a/linkerd.io/content/2.17/tasks/getting-per-route-metrics.md b/linkerd.io/content/2.17/tasks/getting-per-route-metrics.md new file mode 100644 index 0000000000..5cb7b2c26e --- /dev/null +++ b/linkerd.io/content/2.17/tasks/getting-per-route-metrics.md @@ -0,0 +1,24 @@ +--- +title: Getting Per-Route Metrics +description: Configure per-route metrics for your application. +--- + +To get per-route metrics, you must create [HTTPRoute] resources. If a route has +a `parent_ref` which points to a **Service** resource, Linkerd will generate +outbound per-route traffic metrics for all HTTP traffic that it sends to that +Service. If a route has a `parent_ref` which points to a **Server** resource, +Linkerd will generate inbound per-route traffic metrcs for all HTTP traffic that +it receives on that Server. Note that an [HTTPRoute] can have multiple +`parent_ref`s which means that the same [HTTPRoute] resource can be used to +describe both outbound and inbound routes. + +For a tutorial that shows off per-route metrics, check out the +[books demo](../books/#service-profiles). + +{{< note >}} +Routes configured in service profiles are different from [HTTPRoute] resources. +If a [ServiceProfile](../../features/service-profiles/) is defined for a +Service, proxies will ignore any [HTTPRoute] for that Service. +{{< /note >}} + +[HTTPRoute]: ../../features/httproute/ diff --git a/linkerd.io/content/2.17/tasks/gitops.md b/linkerd.io/content/2.17/tasks/gitops.md new file mode 100644 index 0000000000..a7fe04fce8 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/gitops.md @@ -0,0 +1,524 @@ +--- +title: Using GitOps with Linkerd with Argo CD +description: Use Argo CD to manage Linkerd installation and upgrade lifecycle. +--- + +GitOps is an approach to automate the management and delivery of your Kubernetes +infrastructure and applications using Git as a single source of truth. It +usually utilizes some software agents to detect and reconcile any divergence +between version-controlled artifacts in Git with what's running in a cluster. + +This guide will show you how to set up +[Argo CD](https://argoproj.github.io/argo-cd/) to manage the installation and +upgrade of Linkerd using a GitOps workflow. + +{{< docs/production-note >}} + +Specifically, this guide provides instructions on how to securely generate and +manage Linkerd's mTLS private keys and certificates using +[Sealed Secrets](https://github.com/bitnami-labs/sealed-secrets) and +[cert-manager](https://cert-manager.io). It will also show you how to integrate +the [auto proxy injection](../../features/proxy-injection/) feature into your +workflow. Finally, this guide conclude with steps to upgrade Linkerd to a newer +version following a GitOps workflow. + +![Linkerd GitOps workflow](/docs/images/gitops/architecture.png "Linkerd GitOps workflow") + +The software and tools used in this guide are selected for demonstration +purposes only. Feel free to choose others that are most suited for your +requirements. + +You will need to clone this +[example repository](https://github.com/linkerd/linkerd-examples) to your local +machine and replicate it in your Kubernetes cluster following the steps defined +in the next section. + +This guide uses the [step cli](https://smallstep.com/cli/) to create certificates +used by the Linkerd clusters to enforce mTLS, so make sure you have installed +step for your environment. + +## Set up the repositories + +Clone the example repository to your local machine: + +```sh +git clone https://github.com/linkerd/linkerd-examples.git +``` + +This repository will be used to demonstrate Git operations like `add`, `commit` +and `push` later in this guide. + +Add a new remote endpoint to the repository to point to the in-cluster Git +server, which will be set up in the next section: + +```sh +cd linkerd-examples + +git remote add git-server git://localhost/linkerd-examples.git +``` + +{{< note >}} +To simplify the steps in this guide, we will be interacting with the in-cluster +Git server via port-forwarding. Hence, the remote endpoint that we just created +targets your localhost. +{{< /note >}} + +Deploy the Git server to the `scm` namespace in your cluster: + +```sh +kubectl apply -f gitops/resources/git-server.yaml +``` + +Later in this guide, Argo CD will be configured to watch the repositories hosted +by this Git server. + +{{< note >}} +This Git server is configured to run as a +[daemon](https://git-scm.com/book/en/v2/Git-on-the-Server-Git-Daemon) over the +`git` protocol, with unauthenticated access to the Git data. This setup is not +recommended for production use. +{{< /note >}} + +Confirm that the Git server is healthy: + +```sh +kubectl -n scm rollout status deploy/git-server +``` + +Clone the example repository to your in-cluster Git server: + +```sh +git_server=`kubectl -n scm get po -l app=git-server -oname | awk -F/ '{ print $2 }'` + +kubectl -n scm exec "${git_server}" -- \ + git clone --bare https://github.com/linkerd/linkerd-examples.git +``` + +Confirm that the remote repository is successfully cloned: + +```sh +kubectl -n scm exec "${git_server}" -- ls -al /git/linkerd-examples.git +``` + +Confirm that you can push from the local repository to the remote repository +via port-forwarding: + +```sh +kubectl -n scm port-forward "${git_server}" 9418 & + +git push git-server master +``` + +## Install the Argo CD CLI + +Before proceeding, install the Argo CD CLI in your local machine by following +the [instructions](https://argo-cd.readthedocs.io/en/stable/cli_installation/) +relevant to your OS. + +## Deploy Argo CD + +Install Argo CD: + +```sh +kubectl create ns argocd + +kubectl -n argocd apply -f \ + https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml +``` + +Confirm that all the pods are ready: + +```sh +for deploy in "dex-server" "redis" "repo-server" "server"; \ + do kubectl -n argocd rollout status deploy/argocd-${deploy}; \ +done + +kubectl -n argocd rollout status statefulset/argocd-application-controller +``` + +Use port-forward to access the Argo CD dashboard: + +```sh +kubectl -n argocd port-forward svc/argocd-server 8080:443 \ + > /dev/null 2>&1 & +``` + +The Argo CD dashboard is now accessible at +[https://localhost:8080](https://localhost:8080/), using the default `admin` +username and +[password](https://argoproj.github.io/argo-cd/getting_started/#4-login-using-the-cli). + +Authenticate the Argo CD CLI: + +```sh +password=`kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.password}" | base64 -d` + +argocd login 127.0.0.1:8080 \ + --username=admin \ + --password="${password}" \ + --insecure +``` + +## Configure project access and permissions + +Set up the `demo` +[project](https://argoproj.github.io/argo-cd/user-guide/projects/) to group our +[applications](https://argoproj.github.io/argo-cd/operator-manual/declarative-setup/#applications): + +```sh +kubectl apply -f gitops/project.yaml +``` + +This project defines the list of permitted resource kinds and target clusters +that our applications can work with. + +Confirm that the project is deployed correctly: + +```sh +argocd proj get demo +``` + +On the dashboard: + +![New project in Argo CD dashboard](/docs/images/gitops/dashboard-project.png "New project in Argo CD dashboard") + +### Deploy the applications + +Deploy the `main` application which serves as the "parent" for all the other +applications: + +```sh +kubectl apply -f gitops/main.yaml +``` + +{{< note >}} +The "app of apps" pattern is commonly used in Argo CD workflows to bootstrap +applications. See the Argo CD documentation for more +[information](https://argoproj.github.io/argo-cd/operator-manual/cluster-bootstrapping/#app-of-apps-pattern). +{{< /note >}} + +Confirm that the `main` application is deployed successfully: + +```sh +argocd app get main +``` + +Sync the `main` application: + +```sh +argocd app sync main +``` + +![Synchronize the main application](/docs/images/gitops/dashboard-applications-main-sync.png "Synchronize the main application") + +Notice that only the `main` application is synchronized. + +Next, we will synchronize the remaining applications individually. + +### Deploy cert-manager + +Synchronize the `cert-manager` application: + +```sh +argocd app sync cert-manager +``` + +Confirm that cert-manager is running: + +```sh +for deploy in "cert-manager" "cert-manager-cainjector" "cert-manager-webhook"; \ + do kubectl -n cert-manager rollout status deploy/${deploy}; \ +done +``` + +![Synchronize the cert-manager application](/docs/images/gitops/dashboard-cert-manager-sync.png "Synchronize the cert-manager application") + +### Deploy Sealed Secrets + +Synchronize the `sealed-secrets` application: + +```sh +argocd app sync sealed-secrets +``` + +Confirm that sealed-secrets is running: + +```sh +kubectl -n kube-system rollout status deploy/sealed-secrets +``` + +![Synchronize the sealed-secrets application](/docs/images/gitops/dashboard-sealed-secrets-sync.png "Synchronize the sealed-secrets application") + +### Create mTLS trust anchor + +Before proceeding with deploying Linkerd, we will need to create the mTLS trust +anchor. Then we will also set up the `linkerd-bootstrap` application to manage +the trust anchor certificate. + +Create a new mTLS trust anchor private key and certificate: + +```sh +step certificate create root.linkerd.cluster.local sample-trust.crt sample-trust.key \ + --profile root-ca \ + --no-password \ + --not-after 43800h \ + --insecure +``` + +Confirm the details (encryption algorithm, expiry date, SAN etc.) of the new +trust anchor: + +```sh +step certificate inspect sample-trust.crt +``` + +Before creating the `SealedSecret`, make sure you have installed the `kubeseal` +utility, as instructed +[here](https://github.com/bitnami-labs/sealed-secrets/releases) + +Now create the `SealedSecret` resource to store the encrypted trust anchor: + +```sh +kubectl create ns linkerd +kubectl -n linkerd create secret tls linkerd-trust-anchor \ + --cert sample-trust.crt \ + --key sample-trust.key \ + --dry-run=client -oyaml | \ +kubeseal --controller-name=sealed-secrets -oyaml - | \ +kubectl patch -f - \ + -p '{"spec": {"template": {"type":"kubernetes.io/tls", "metadata": {"labels": {"linkerd.io/control-plane-component":"identity", "linkerd.io/control-plane-ns":"linkerd"}, "annotations": {"linkerd.io/created-by":"linkerd/cli stable-2.12.0"}}}}}' \ + --dry-run=client \ + --type=merge \ + --local -oyaml > gitops/resources/linkerd/trust-anchor.yaml +``` + +This will overwrite the existing `SealedSecret` resource in your local +`gitops/resources/linkerd/trust-anchor.yaml` file. We will push this change to +the in-cluster Git server. + +Confirm that only the `spec.encryptedData` is changed: + +```sh +git diff gitops/resources/linkerd/trust-anchor.yaml +``` + +Commit and push the new trust anchor secret to your in-cluster Git server: + +```sh +git add gitops/resources/linkerd/trust-anchor.yaml + +git commit -m "update encrypted trust anchor" + +git push git-server master +``` + +Confirm the commit is successfully pushed: + +```sh +kubectl -n scm exec "${git_server}" -- git --git-dir linkerd-examples.git log -1 +``` + +## Deploy linkerd-bootstrap + +Synchronize the `linkerd-bootstrap` application: + +```sh +argocd app sync linkerd-bootstrap +``` + +{{< note >}} +If the issuer and certificate resources appear in a degraded state, it's likely +that the SealedSecrets controller failed to decrypt the sealed +`linkerd-trust-anchor` secret. Check the SealedSecrets controller for error logs. + +For debugging purposes, the sealed resource can be retrieved using the +`kubectl -n linkerd get sealedsecrets linkerd-trust-anchor -oyaml` command. +Ensure that this resource matches the +`gitops/resources/linkerd/trust-anchor.yaml` file you pushed to the in-cluster +Git server earlier. +{{< /note >}} + +![Synchronize the linkerd-bootstrap application](/docs/images/gitops/dashboard-linkerd-bootstrap-sync.png "Synchronize the linkerd-bootstrap application") + +SealedSecrets should have created a secret containing the decrypted trust +anchor. Retrieve the decrypted trust anchor from the secret: + +```sh +trust_anchor=`kubectl -n linkerd get secret linkerd-trust-anchor -ojsonpath="{.data['tls\.crt']}" | base64 -d -w 0 -` +``` + +Confirm that it matches the decrypted trust anchor certificate you created +earlier in your local `sample-trust.crt` file: + +```sh +diff -b \ + <(echo "${trust_anchor}" | step certificate inspect -) \ + <(step certificate inspect sample-trust.crt) +``` + +### Deploy Linkerd + +Now we are ready to install Linkerd. The decrypted trust anchor we just +retrieved will be passed to the installation process using the +`identityTrustAnchorsPEM` parameter. + +Prior to installing Linkerd, note that the `identityTrustAnchorsPEM` parameter +is set to an "empty" certificate string: + +```sh +argocd app get linkerd-control-plane -ojson | \ + jq -r '.spec.source.helm.parameters[] | select(.name == "identityTrustAnchorsPEM") | .value' +``` + +![Empty default trust anchor](/docs/images/gitops/dashboard-trust-anchor-empty.png "Empty default trust anchor") + +We will override this parameter in the `linkerd` application with the value of +`${trust_anchor}`. + +Locate the `identityTrustAnchorsPEM` variable in your local +`gitops/argo-apps/linkerd-control-plane.yaml` file, and set its `value` to that +of `${trust_anchor}`. + +Ensure that the multi-line string is indented correctly. E.g., + +```yaml + source: + chart: linkerd-control-plane + repoURL: https://helm.linkerd.io/stable + targetRevision: 1.9.0 + helm: + parameters: + - name: identityTrustAnchorsPEM + value: | + -----BEGIN CERTIFICATE----- + MIIBlTCCATygAwIBAgIRAKQr9ASqULvXDeyWpY1LJUQwCgYIKoZIzj0EAwIwKTEn + MCUGA1UEAxMeaWRlbnRpdHkubGlua2VyZC5jbHVzdGVyLmxvY2FsMB4XDTIwMDkx + ODIwMTAxMFoXDTI1MDkxNzIwMTAxMFowKTEnMCUGA1UEAxMeaWRlbnRpdHkubGlu + a2VyZC5jbHVzdGVyLmxvY2FsMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE+PUp + IR74PsU+geheoyseycyquYyes5eeksIb5FDm8ptOXQ2xPcBpvesZkj6uIyS3k4qV + E0S9VtMmHNeycL7446NFMEMwDgYDVR0PAQH/BAQDAgEGMBIGA1UdEwEB/wQIMAYB + Af8CAQEwHQYDVR0OBBYEFHypCh7hiSLNxsKhMylQgqD9t7NNMAoGCCqGSM49BAMC + A0cAMEQCIEWhI86bXWEd4wKTnG07hBfBuVCT0bxopaYnn3wRFx7UAiAwXyh5uaVg + MwCC5xL+PM+bm3PRqtrmI6TocWH07GbMxg== + -----END CERTIFICATE----- +``` + +Confirm that only one `spec.source.helm.parameters.value` field is changed: + +```sh +git diff gitops/argo-apps/linkerd-control-plane.yaml +``` + +Commit and push the changes to the Git server: + +```sh +git add gitops/argo-apps/linkerd-control-plane.yaml + +git commit -m "set identityTrustAnchorsPEM parameter" + +git push git-server master +``` + +Synchronize the `main` application: + +```sh +argocd app sync main +``` + +Confirm that the new trust anchor is picked up by the `linkerd` application: + +```sh +argocd app get linkerd-control-plane -ojson | \ + jq -r '.spec.source.helm.parameters[] | select(.name == "identityTrustAnchorsPEM") | .value' +``` + +![Override mTLS trust anchor](/docs/images/gitops/dashboard-trust-anchor-override.png "Override mTLS trust anchor") + +Synchronize the `linkerd-crds` and `linkerd-control-plane` applications: + +```sh +argocd app sync linkerd-crds +argocd app sync linkerd-control-plane +``` + +Check that Linkerd is ready: + +```sh +linkerd check +``` + +![Synchronize Linkerd](/docs/images/gitops/dashboard-linkerd-sync.png "Synchronize Linkerd") + +### Test with emojivoto + +Deploy emojivoto to test auto proxy injection: + +```sh +argocd app sync emojivoto +``` + +Check that the applications are healthy: + +```sh +for deploy in "emoji" "vote-bot" "voting" "web" ; \ + do kubectl -n emojivoto rollout status deploy/${deploy}; \ +done +``` + +![Synchronize emojivoto](/docs/images/gitops/dashboard-emojivoto-sync.png "Synchronize emojivoto") + +### Upgrade Linkerd to 2.12.1 + +(Assuming 2.12.1 has already been released ;-) ) + +Use your editor to change the `spec.source.targetRevision` field to `1.9.3` +(that's the Helm chart version corresponding to linkerd stable-2.12.1) in the +`gitops/argo-apps/linkerd-control-plane.yaml` file: + +Confirm that only the `targetRevision` field is changed: + +```sh +git diff gitops/argo-apps/linkerd-control-plane.yaml +``` + +Commit and push this change to the Git server: + +```sh +git add gitops/argo-apps/linkerd-control-plane.yaml + +git commit -m "upgrade Linkerd to 2.12.1" + +git push git-server master +``` + +Synchronize the `main` application: + +```sh +argocd app sync main +``` + +Synchronize the `linkerd-control-plane` application: + +```sh +argocd app sync linkerd-control-plane +``` + +Confirm that the upgrade completed successfully: + +```sh +linkerd check +``` + +Confirm the new version of the control plane: + +```sh +linkerd version +``` + +### Clean up + +All the applications can be removed by removing the `main` application: + +```sh +argocd app delete main --cascade=true +``` diff --git a/linkerd.io/content/2.17/tasks/graceful-shutdown.md b/linkerd.io/content/2.17/tasks/graceful-shutdown.md new file mode 100644 index 0000000000..17c5345416 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/graceful-shutdown.md @@ -0,0 +1,164 @@ +--- +title: Graceful Pod Shutdown +description: Gracefully handle pod shutdown signal. +--- + +When Kubernetes begins to terminate a pod, it starts by sending all containers +in that pod a TERM signal. When the Linkerd proxy sidecar receives this signal, +it will immediately begin a graceful shutdown where it refuses all new requests +and allows existing requests to complete before shutting down. + +This means that if the pod's main container attempts to make any new network +calls after the proxy has received the TERM signal, those network calls will +fail. This also has implications for clients of the terminating pod and for +job resources. + +## Graceful shutdown in Kubernetes + +[pod-lifetime]: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-lifetime +[pod-termination]: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination +[pod-forced]: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-termination-forced +[hook]: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + +Pods are ephemeral in nature, and may be [killed due to a number of different +reasons][pod-lifetime], such as: + +* Being scheduled on a node that fails (in which case the pod will be deleted). +* A lack of resources on the node where the pod is scheduled (in which case the + pod is evicted). +* Manual deletion, e.g through `kubectl delete`. + +Since pods fundamentally represent processes running on nodes in a cluster, it +is important to ensure that when killed, they have enough time to clean-up and +terminate gracefully. When a pod is deleted, the [container runtime will send a +TERM signal][pod-termination] to each container running in the pod. + +By default, Kubernetes will wait [30 seconds][pod-forced] to allow processes to +handle the TERM signal. This is known as the **grace period** within which a +process may shut itself down gracefully. If the grace period time runs out, and +the process hasn't gracefully exited, the container runtime will send a KILL +signal, abruptly stopping the process. Grace periods may be overridden at a +workload level. This is useful when a process needs additional time to clean-up +(e.g making network calls, writing to disk, etc.) + +Kubernetes also allows operators of services to define lifecycle hooks for +their containers. Important in the context of graceful shutdown is the +[`preStop`][hook] hook, that will be called when a container is terminated due +to: + +* An API request. +* Liveness/Readiness probe failure. +* Resource contention. + +If a pod has a preStop hook for a container, and the pod receives a TERM signal +from the container runtime, the preStop hook will be executed, and it must +finish before the TERM signal can be propagated to the container itself. It is +worth noting in this case that the **grace period** will start when the preStop +hook is executed, not when the container first starts processing the TERM +signal. + +## Configuration options for graceful shutdown + +Linkerd offers a few options to configure pods and containers to gracefully shutdown. + +* `--wait-before-seconds`: can be used as an install value (either through the + CLI or through Helm), or alternatively, through a [configuration + annotation](../../reference/proxy-configuration/). This will add a + `preStop` hook to the proxy container to delay its handling of the TERM + signal. This will only work when the conditions described above are satisfied + (i.e container runtime sends the TERM signal) +* `config.linkerd.io/shutdown-grace-period`: is an annotation that can be used + on workloads to configure the graceful shutdown time for the _proxy_. If the + period elapses before the proxy has had a chance to gracefully shut itself + down, it will forcefully shut itself down thereby closing all currently open + connections. By default, the shutdown grace period is 120 seconds. This grace + period will be respected regardless of where the TERM signal comes from; the + proxy may receive a shutdown signal from the container runtime, a different + process (e.g a script that sends TERM), or from a networked request to its + shutdown endpoint (only possible on the loopback interface). The proxy will + delay its handling of the TERM signal until all of its open connections have + completed. This option is particularly useful to close long-running + connections that would otherwise prevent the proxy from shutting down + gracefully. +* `linkerd-await`: is a binary that wraps (and spawns) another process, and it + is commonly used to wait for proxy readiness. The await binary can be used + with a `--shutdown` option, in which case, after the process it has wrapped + finished, it will send a shutdown request to the proxy. When used for + graceful shutdown, typically the entrypoint for containers need to be changed + to linkerd-await. + +Depending on the usecase, one option (or utility) might be preferred over the +other. To aid with some common cases, suggestions are given below on what to do +when confronted with slow updating clients and with job resources that will not +complete. + +## Slow Updating Clients + +Before Kubernetes terminates a pod, it first removes that pod from the endpoints +resource of any services that pod is a member of. This means that clients of +that service should stop sending traffic to the pod before it is terminated. +However, certain clients can be slow to receive the endpoints update and may +attempt to send requests to the terminating pod after that pod's proxy has +already received the TERM signal and begun graceful shutdown. Those requests +will fail. + +To mitigate this, use the `--wait-before-exit-seconds` flag with +`linkerd inject` to delay the Linkerd proxy's handling of the TERM signal for +a given number of seconds using a `preStop` hook. This delay gives slow clients +additional time to receive the endpoints update before beginning graceful +shutdown. To achieve max benefit from the option, the main container should have +its own `preStop` hook with the sleep command inside which has a smaller period +than is set for the proxy sidecar. And none of them must be bigger than +`terminationGracePeriodSeconds` configured for the entire pod. + +For example, + +```yaml + # application container + lifecycle: + preStop: + exec: + command: + - /bin/bash + - -c + - sleep 20 + + # for entire pod + terminationGracePeriodSeconds: 160 +``` + +## Graceful shutdown of Job and Cronjob Resources + +Pods which are part of Job or Cronjob resources will run until all of the +containers in the pod complete. However, the Linkerd proxy container runs +continuously until it receives a TERM signal. Since Kubernetes does not give the +proxy a means to know when the Cronjob has completed, by default, Job and +Cronjob pods which have been meshed will continue to run even once the main +container has completed. You can address this either by running Linkerd as a +native sidecar or by manually shutting down the proxy. + +### Native Sidecar + +If you use the `--set proxy.nativeSidecar=true` flag when installing Linkerd, the +Linkerd proxy will run as a [sidecar container](https://kubernetes.io/docs/concepts/workloads/pods/sidecar-containers/) +and will automatically shutdown when the main containers in the pod terminate. +Native sidecars were added in Kubernetes v1.28 and are available by default in +Kubernetes v1.29. + +### Manual shutdown + +Alternatively, you can issue a POST to the `/shutdown` endpoint on the proxy +once the application completes (e.g. via `curl -X POST +http://localhost:4191/shutdown`). This will terminate the proxy gracefully and +allow the Job or Cronjob to complete. These shutdown requests must come on the +loopback interface, i.e. from within the same Kubernetes pod. + +One convenient way to call this endpoint is to wrap your application with the +[linkerd-await](https://github.com/linkerd/linkerd-await) utility. An +application that is called this way (e.g. via `linkerd-await -S $MYAPP`) will +automatically call the proxy's `/shutdown` endpoint when it completes. + +For security reasons, the proxy's `/shutdown` endpoint is disabled by default. +In order to be able to manually shutdown the proxy, you must enable this +endpoint by installing Linkerd with the `--set proxy.enableShutdownEndpoint=true` +flag. diff --git a/linkerd.io/content/2.17/tasks/grafana.md b/linkerd.io/content/2.17/tasks/grafana.md new file mode 100644 index 0000000000..dd8936ab7b --- /dev/null +++ b/linkerd.io/content/2.17/tasks/grafana.md @@ -0,0 +1,111 @@ +--- +title: Grafana +description: Grafana install instructions and how to link it with the Linkerd Dashboard +--- + +Linkerd provides a full [on-cluster metrics stack](../../features/dashboard/) +that can be leveraged by a Prometheus instance and subsequently by a Grafana +instance, in order to show both the real-time and historical behavior of these +metrics. + +First, you need to install Grafana from a variety of possible sources, and then +load the suite of Grafana dashboards that have been pre-configured to consume +the metrics exposed by Linkerd. + +{{< docs/production-note >}} + +## Install Prometheus + +Before installing Grafana, make sure you have a working instance of Prometheus +properly configured to consume Linkerd metrics. The Linkerd Viz extension comes +with such a pre-configured Prometheus instance, but you can also [bring your own +Prometheus](../external-prometheus/). + +## Install Grafana + +The easiest and recommended way is to install Grafana's official Helm chart: + +```bash +helm repo add grafana https://grafana.github.io/helm-charts +helm install grafana -n grafana --create-namespace grafana/grafana \ + -f https://raw.githubusercontent.com/linkerd/linkerd2/main/grafana/values.yaml +``` + +This is fed the default `values.yaml` file, which configures as a default +datasource Linkerd Viz' Prometheus instance, sets up a reverse proxy (more on +that later), and pre-loads all the Linkerd Grafana dashboards that are published +on . + +{{< note >}} +The access to Linkerd Viz' Prometheus instance is restricted through the +`prometheus-admin` AuthorizationPolicy, granting access only to the +`metrics-api` ServiceAccount. In order to also grant access to Grafana, you need +to add an AuthorizationPolicy pointing to its ServiceAccount. You can apply +[authzpolicy-grafana.yaml](https://github.com/linkerd/linkerd2/blob/release/stable-2.13/grafana/authzpolicy-grafana.yaml) +which grants permission for the `grafana` ServiceAccount. +{{< /note >}} + +A more complex and production-oriented source is the [Grafana +Operator](https://github.com/grafana-operator/grafana-operator). And there are +also hosted solutions such as [Grafana +Cloud](https://grafana.com/products/cloud/). Those projects provide instructions +on how to easily import the same charts published on +. + +{{< note >}} +Grafana's official Helm chart uses an initContainer to download Linkerd's +configuration and dashboards. If you use the CNI plugin, when you add grafana's +pod into the mesh its initContainer will run before the proxy is started and the +traffic cannot flow. +You should either avoid meshing grafana's pod, skip outbound port 443 via +`config.linkerd.io/skip-outbound-ports: "443"` annotation or run the container +with the proxy's UID. +See [Allowing initContainer networking](../../features/cni/#allowing-initcontainer-networking) +{{< /note >}} + +## Hook Grafana with Linkerd Viz Dashboard + +It's easy to configure Linkerd Viz dashboard and Grafana such that the former +displays Grafana icons in all the relevant items, providing direct links to the +appropriate Grafana Dashboards. For example, when looking at a list of +deployments for a given namespace, you'll be able to go straight into the +Linkerd Deployments Grafana dashboard providing the same (and more) metrics +(plus their historical behavior). + +### In-cluster Grafana instances + +In the case of in-cluster Grafana instances (such as as the one from the Grafana +Helm chart or the Grafana Operator mentioned above), make sure a reverse proxy +is set up, as shown in the sample `grafana/values.yaml` file: + +```yaml +grafana.ini: + server: + root_url: '%(protocol)s://%(domain)s:/grafana/' +``` + +Then refer the location of your Grafana service in the Linkerd Viz `values.yaml` +entry `grafana.url`. For example, if you installed the Grafana official Helm +chart in the `grafana` namespace, you can install Linkerd Viz through the +command line like so: + +```bash +linkerd viz install --set grafana.url=grafana.grafana:3000 \ + | kubectl apply -f - +``` + +### Off-cluster Grafana instances + +If you're using a hosted solution like Grafana Cloud, after having imported the +Linkerd dashboards, you need to enter the full URL of the Grafana service in the +Linkerd Viz `values.yaml` entry `grafana.externalUrl`: + +```bash +linkerd viz install --set grafana.externalUrl=https://your-co.grafana.net/ \ + | kubectl apply -f - +``` + +If that single Grafana instance is pointing to multiple Linkerd installations, +you can segregate the dashboards through different prefixes in their UIDs, which +you would configure in the `grafana.uidPrefix` setting for each Linkerd +instance. diff --git a/linkerd.io/content/2.17/tasks/install-helm.md b/linkerd.io/content/2.17/tasks/install-helm.md new file mode 100644 index 0000000000..6a32a6a2bb --- /dev/null +++ b/linkerd.io/content/2.17/tasks/install-helm.md @@ -0,0 +1,146 @@ +--- +title: Installing Linkerd with Helm +description: Install Linkerd onto your Kubernetes cluster using Helm. +--- + +Linkerd can be installed via Helm rather than with the `linkerd install` +command. This is recommended for production, since it allows for repeatability. + +{{< docs/edge-note >}} + +## Prerequisite: generate mTLS certificates + +To do [automatic mutual TLS](../../features/automatic-mtls/), Linkerd requires +trust anchor certificate and an issuer certificate and key pair. When you're +using `linkerd install`, we can generate these for you. However, for Helm, you +will need to generate these yourself. + +Please follow the instructions in +[Generating your own mTLS root certificates](../generate-certificates/) to +generate these. + +## Helm install procedure + +```bash +# Add the Helm repo for Linkerd edge releases: +helm repo add linkerd-edge https://helm.linkerd.io/edge +``` + +You need to install two separate charts in succession: first `linkerd-crds` and +then `linkerd-control-plane`. + +{{< note >}} If installing Linkerd in a cluster that uses Cilium in kube-proxy +replacement mode, additional steps may be needed to ensure service discovery +works as intended. Instrunctions are on the +[Cilium cluster configuration](../../reference/cluster-configuration/#cilium) +page. {{< /note >}} + +### linkerd-crds + +The `linkerd-crds` chart sets up the CRDs linkerd requires: + +```bash +helm install linkerd-crds linkerd-edge/linkerd-crds \ + -n linkerd --create-namespace +``` + +{{< note >}} This will create the `linkerd` namespace. If it already exists or +you're creating it beforehand elsewhere in your pipeline, just omit the +`--create-namespace` flag. {{< /note >}} + +{{< note >}} If you are using [Linkerd's CNI plugin](../../features/cni/), you +must also add the `--set cniEnabled=true` flag to your `helm install` command. +{{< /note >}} + +### linkerd-control-plane + +The `linkerd-control-plane` chart sets up all the control plane components: + +```bash +helm install linkerd-control-plane \ + -n linkerd \ + --set-file identityTrustAnchorsPEM=ca.crt \ + --set-file identity.issuer.tls.crtPEM=issuer.crt \ + --set-file identity.issuer.tls.keyPEM=issuer.key \ + linkerd-edge/linkerd-control-plane +``` + +{{< note >}} If you are using [Linkerd's CNI plugin](../../features/cni/), you +must also add the `--set cniEnabled=true` flag to your `helm install` command. +{{< /note >}} + +## Enabling high availability mode + +The `linkerd-control-plane` chart contains a file `values-ha.yaml` that +overrides some default values to set things up under a high-availability +scenario, analogous to the `--ha` option in `linkerd install`. Values such as +higher number of replicas, higher memory/cpu limits, and affinities are +specified in those files. + +You can get `values-ha.yaml` by fetching the chart file: + +```bash +helm fetch --untar linkerd-edge/linkerd-control-plane +``` + +Then use the `-f` flag to provide this override file. For example: + +```bash +helm install linkerd-control-plane \ + -n linkerd \ + --set-file identityTrustAnchorsPEM=ca.crt \ + --set-file identity.issuer.tls.crtPEM=issuer.crt \ + --set-file identity.issuer.tls.keyPEM=issuer.key \ + -f linkerd-control-plane/values-ha.yaml \ + linkerd-edge/linkerd-control-plane +``` + +## Upgrading with Helm + +First, make sure your local Helm repos are updated: + +```bash +helm repo update + +helm search repo linkerd +NAME CHART VERSION APP VERSION DESCRIPTION +linkerd-edge/linkerd-crds Linkerd gives you observability, reliability, and securit... +linkerd-edge/linkerd-control-plane {{< latest-edge-version >}} Linkerd gives you observability, reliability, and securit... +``` + +During an upgrade, you must choose whether you want to reuse the values in the +chart or move to the values specified in the newer chart. Our advice is to use a +`values.yaml` file that stores all custom overrides that you have for your +chart. + +The `helm upgrade` command has a number of flags that allow you to customize its +behavior. Special attention should be paid to `--reuse-values` and +`--reset-values` and how they behave when charts change from version to version +and/or overrides are applied through `--set` and `--set-file`. For example: + +- `--reuse-values` with no overrides - all values are reused +- `--reuse-values` with overrides - all except the values that are overridden + are reused +- `--reset-values` with no overrides - no values are reused and all changes from + provided release are applied during the upgrade +- `--reset-values` with overrides - no values are reused and changed from + provided release are applied together with the overrides +- no flag and no overrides - `--reuse-values` will be used by default +- no flag and overrides - `--reset-values` will be used by default + +Finally, before upgrading, you can consult the +[edge chart](https://artifacthub.io/packages/helm/linkerd2-edge/linkerd-control-plane#values) +docs to check whether there are breaking changes to the chart (i.e. +renamed or moved keys, etc). If there are, make the corresponding changes to +your `values.yaml` file. Then you can use: + +```bash +# the linkerd-crds chart currently doesn't have a values.yaml file +helm upgrade linkerd-crds linkerd-edge/linkerd-crds + +# whereas linkerd-control-plane does +helm upgrade linkerd-control-plane linkerd-edge/linkerd-control-plane --reset-values -f values.yaml --atomic +``` + +The `--atomic` flag will ensure that all changes are rolled back in case the +upgrade operation fails. diff --git a/linkerd.io/content/2.17/tasks/install.md b/linkerd.io/content/2.17/tasks/install.md new file mode 100644 index 0000000000..96a1006f23 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/install.md @@ -0,0 +1,114 @@ +--- +title: Installing Linkerd +description: Install Linkerd onto your Kubernetes cluster. +--- + +Before you can use Linkerd, you'll need to install the [control +plane](../../reference/architecture/#control-plane). This page covers how to +accomplish that. + +{{< note >}} + +The Linkerd project itself only produces [edge release](/releases/) artifacts. +(For more information about the different kinds of Linkerd releases, see the +[Releases and Versions](/releases/) page.) + +As such, this page contains instructions for installing the latest edge +release of Linkerd. If you are using a [stable +distribution](/releases/#stable) of Linkerd, the vendor should provide +additional guidance on installing Linkerd. + +{{< /note >}} + +Linkerd's control plane can be installed in two ways: with the CLI and with +Helm. The CLI is convenient and easy, but for production use cases we recommend +Helm which allows for repeatability. + +In either case, we recommend installing the CLI itself so that you can validate +the success of the installation. See the [Getting Started +Guide](../../getting-started/) for how to install the CLI if you haven't done +this already. + +## Requirements + +Linkerd requires a Kubernetes cluster on which to run. Where this cluster lives +is not important: it might be hosted on a cloud provider, may be running on your +local machine, or even somewhere else. + +Make sure that your Linkerd version and Kubernetes version are compatible by +checking Linkerd's [supported Kubernetes +versions](../../reference/k8s-versions/). + +Before installing the control plane, validate that this Kubernetes cluster is +configured appropriately for Linkerd by running: + +```bash +linkerd check --pre +``` + +Be sure to address any issues that the checks identify before proceeding. + +{{< note >}} +If installing Linkerd on GKE, there are some extra steps required depending on +how your cluster has been configured. If you are using any of these features, +check out the additional instructions on [GKE private +clusters](../../reference/cluster-configuration/#private-clusters) +{{< /note >}} + +{{< note >}} +If installing Linkerd in a cluster that uses Cilium in kube-proxy replacement +mode, additional steps may be needed to ensure service discovery works as +intended. Instrunctions are on the [Cilium cluster +configuration](../../reference/cluster-configuration/#cilium) page. +{{< /note >}} + +## Installing with the CLI + +Once you have a cluster ready, installing Linkerd is as easy as running `linkerd +install --crds`, which installs the Linkerd CRDs, followed by `linkerd install`, +which installs the Linkerd control plane. Both of these commands generate +Kubernetes manifests, which can be applied to your cluster to install Linkerd. + +For example: + +```bash +# install the CRDs first +linkerd install --crds | kubectl apply -f - + +# install the Linkerd control plane once the CRDs have been installed +linkerd install | kubectl apply -f - +``` + +This basic installation should work for most cases. However, there are some +configuration options are provided as flags for `install`. See the [CLI +reference documentation](../../reference/cli/install/) for a complete list of +options. You can also use [tools like Kustomize](../customize-install/) to +programmatically alter this manifest. + +## Installing via Helm + +To install Linkerd with Helm (recommended for production installations), +see the [Installing Linkerd with Helm](../install-helm/). + +## Verification + +After installation (whether CLI or Helm) you can validate that Linkerd is in a +good state running: + +```bash +linkerd check +``` + +## Next steps + +Once you've installed the control plane, you may want to install some +extensions, such as `viz`, `multicluster` and `jaeger`. See [Using +extensions](../extensions/) for how to install them. + +Finally, once the control plane is installed, you'll need to "mesh" any services +you want Linkerd active for. See [Adding your services to +Linkerd](../adding-your-service/) for how to do this. + +## Uninstalling the control plane + +See [Uninstalling Linkerd](../uninstall/). diff --git a/linkerd.io/content/2.17/tasks/installing-multicluster.md b/linkerd.io/content/2.17/tasks/installing-multicluster.md new file mode 100644 index 0000000000..baad394eeb --- /dev/null +++ b/linkerd.io/content/2.17/tasks/installing-multicluster.md @@ -0,0 +1,238 @@ +--- +title: Installing Multi-cluster Components +description: Allow Linkerd to manage cross-cluster communication. +--- + +Multicluster support in Linkerd requires extra installation and configuration on +top of the default [control plane installation](../install/). This guide +walks through this installation and configuration as well as common problems +that you may encounter. For a detailed walkthrough and explanation of what's +going on, check out [getting started](../multicluster/). + +{{< docs/production-note >}} + +## Requirements + +- Two clusters. +- A [control plane installation](../install/) in each cluster that shares + a common + [trust anchor](../generate-certificates/#trust-anchor-certificate). + If you have an existing installation, see the + [trust anchor bundle](../installing-multicluster/#trust-anchor-bundle) + documentation to understand what is required. +- Each of these clusters should be configured as `kubectl` + [contexts](https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/). +- Elevated privileges on both clusters. We'll be creating service accounts and + granting extended privileges, so you'll need to be able to do that on your + test clusters. +- Support for services of type `LoadBalancer` in the `east` cluster. Check out + the documentation for your cluster provider or take a look at + [inlets](https://blog.alexellis.io/ingress-for-your-local-kubernetes-cluster/). + This is what the `west` cluster will use to communicate with `east` via the + gateway. + +## Step 1: Install the multicluster control plane + +On each cluster, run: + +```bash +linkerd multicluster install | \ + kubectl apply -f - +``` + +To verify that everything has started up successfully, run: + +```bash +linkerd multicluster check +``` + +For a deep dive into what components are being added to your cluster and how all +the pieces fit together, check out the +[getting started documentation](../multicluster/#preparing-your-cluster). + +## Step 2: Link the clusters + +Each cluster must be linked. This consists of installing several resources in +the source cluster including a secret containing a kubeconfig that allows access +to the target cluster Kubernetes API, a service mirror control for mirroring +services, and a Link custom resource for holding configuration. To link cluster +`west` to cluster `east`, you would run: + +```bash +linkerd --context=east multicluster link --cluster-name east | + kubectl --context=west apply -f - +``` + +To verify that the credentials were created successfully and the clusters are +able to reach each other, run: + +```bash +linkerd --context=west multicluster check +``` + +You should also see the list of gateways show up by running. Note that you'll +need Linkerd's Viz extension to be installed in the source cluster to get the +list of gateways: + +```bash +linkerd --context=west multicluster gateways +``` + +For a detailed explanation of what this step does, check out the +[linking the clusters section](../multicluster/#linking-the-clusters). + +## Step 3: Export services + +Services are not automatically mirrored in linked clusters. By default, only +services with the `mirror.linkerd.io/exported` label will be mirrored. For each +service you would like mirrored to linked clusters, run: + +```bash +kubectl label svc foobar mirror.linkerd.io/exported=true +``` + +{{< note >}} You can configure a different label selector by using the +`--selector` flag on the `linkerd multicluster link` command or by editing +the Link resource created by the `linkerd multicluster link` command. +{{< /note >}} + +## Trust Anchor Bundle + +To secure the connections between clusters, Linkerd requires that there is a +shared trust anchor. This allows the control plane to encrypt the requests that +go between clusters and verify the identity of those requests. This identity is +used to control access to clusters, so it is critical that the trust anchor is +shared. + +The easiest way to do this is to have a single trust anchor certificate shared +between multiple clusters. If you have an existing Linkerd installation and have +thrown away the trust anchor key, it might not be possible to have a single +certificate for the trust anchor. Luckily, the trust anchor can be a bundle of +certificates as well! + +To fetch your existing cluster's trust anchor, run: + +```bash +kubectl -n linkerd get cm linkerd-config -ojsonpath="{.data.values}" | \ + yq e .identityTrustAnchorsPEM - > trustAnchor.crt +``` + +{{< note >}} This command requires [yq](https://github.com/mikefarah/yq). If you +don't have yq, feel free to extract the certificate from the `identityTrustAnchorsPEM` +field with your tool of choice. +{{< /note >}} + +Now, you'll want to create a new trust anchor and issuer for the new cluster: + +```bash +step certificate create root.linkerd.cluster.local root.crt root.key \ + --profile root-ca --no-password --insecure +step certificate create identity.linkerd.cluster.local issuer.crt issuer.key \ + --profile intermediate-ca --not-after 8760h --no-password --insecure \ + --ca root.crt --ca-key root.key +``` + +{{< note >}} We use the [step cli](https://smallstep.com/cli/) to generate +certificates. `openssl` works just as well! {{< /note >}} + +With the old cluster's trust anchor and the new cluster's trust anchor, you can +create a bundle by running: + +```bash +cat trustAnchor.crt root.crt > bundle.crt +``` + +You'll want to upgrade your existing cluster with the new bundle. Make sure +every pod you'd like to have talk to the new cluster is restarted so that it can +use this bundle. To upgrade the existing cluster with this new trust anchor +bundle, run: + +```bash +linkerd upgrade --identity-trust-anchors-file=./bundle.crt | \ + kubectl apply -f - +``` + +Finally, you'll be able to install Linkerd on the new cluster by using the trust +anchor bundle that you just created along with the issuer certificate and key. + +```bash +# first, install the Linkerd CRDs on the new cluster +linkerd install --crds | kubectl apply -f - + +# then, install the Linkerd control plane, using the key material we created +linkerd install \ + --identity-trust-anchors-file bundle.crt \ + --identity-issuer-certificate-file issuer.crt \ + --identity-issuer-key-file issuer.key | \ + kubectl apply -f - +``` + +Make sure to verify that the cluster's have started up successfully by running +`check` on each one. + +```bash +linkerd check +``` + +## Installing the multicluster control plane components through Helm + +Linkerd's multicluster components i.e Gateway and Service Mirror can +be installed via Helm rather than the `linkerd multicluster install` command. + +This not only allows advanced configuration, but also allows users to bundle the +multicluster installation as part of their existing Helm based installation +pipeline. + +### Adding Linkerd's Helm repository + +First, let's add the Linkerd's Helm repository by running + +```bash +# To add the repo for Linkerd stable releases: +helm repo add linkerd https://helm.linkerd.io/stable +``` + +### Helm multicluster install procedure + +```bash +helm install linkerd-multicluster -n linkerd-multicluster --create-namespace linkerd/linkerd-multicluster +``` + +The chart values will be picked from the chart's `values.yaml` file. + +You can override the values in that file by providing your own `values.yaml` +file passed with a `-f` option, or overriding specific values using the family of +`--set` flags. + +Full set of configuration options can be found [here](https://github.com/linkerd/linkerd2/tree/main/multicluster/charts/linkerd-multicluster#values) + +The installation can be verified by running + +```bash +linkerd multicluster check +``` + +Installation of the gateway can be disabled with the `gateway` setting. By +default this value is true. + +### Installing additional access credentials + +When the multicluster components are installed onto a target cluster with +`linkerd multicluster install`, a service account is created which source clusters +will use to mirror services. Using a distinct service account for each source +cluster can be beneficial since it gives you the ability to revoke service mirroring +access from specific source clusters. Generating additional service accounts +and associated RBAC can be done using the `linkerd multicluster allow` command +through the CLI. + +The same functionality can also be done through Helm setting the +`remoteMirrorServiceAccountName` value to a list. + +```bash + helm install linkerd-mc-source linkerd/linkerd-multicluster -n linkerd-multicluster --create-namespace \ + --set remoteMirrorServiceAccountName={source1\,source2\,source3} --kube-context target +``` + +Now that the multicluster components are installed, operations like linking, etc +can be performed by using the linkerd CLI's multicluster sub-command as per the +[multicluster task](../../features/multicluster/). diff --git a/linkerd.io/content/2.17/tasks/linkerd-smi.md b/linkerd.io/content/2.17/tasks/linkerd-smi.md new file mode 100644 index 0000000000..3145a2a79e --- /dev/null +++ b/linkerd.io/content/2.17/tasks/linkerd-smi.md @@ -0,0 +1,218 @@ +--- +title: Getting started with Linkerd SMI extension +description: Use Linkerd SMI extension to work with Service Mesh Interface(SMI) resources. +--- + +[Service Mesh Interface](https://smi-spec.io/) is a standard interface for +service meshes on Kubernetes. It defines a set of resources that could be +used across service meshes that implement it. +You can read more about it in the [specification](https://github.com/servicemeshinterface/smi-spec) + +Currently, Linkerd supports SMI's `TrafficSplit` specification which can be +used to perform traffic splitting across services natively. This means that +you can apply the SMI resources without any additional +components/configuration but this obviously has some downsides, as +Linkerd may not be able to add extra specific configurations specific to it, +as SMI is more like a lowest common denominator of service mesh functionality. + +To get around these problems, Linkerd can instead have an adaptor that converts +SMI specifications into native Linkerd configurations that it can understand +and perform the operation. This also removes the extra native coupling with SMI +resources with the control-plane, and the adaptor can move independently and +have it's own release cycle. [Linkerd SMI](https://www.github.com/linkerd/linkerd-smi) +is an extension that does just that. + +This guide will walk you through installing the SMI extension and configuring +a `TrafficSplit` specification, to perform Traffic Splitting across services. + +## Prerequisites + +- To use this guide, you'll need to have Linkerd installed on your cluster. + Follow the [Installing Linkerd Guide](../install/) if you haven't + already done this. + +## Install the Linkerd-SMI extension + +### CLI + +Install the SMI extension CLI binary by running: + +```bash +curl -sL https://linkerd.github.io/linkerd-smi/install | sh +``` + +Alternatively, you can download the CLI directly via the [releases page](https://github.com/linkerd/linkerd-smi/releases). + +The first step is installing the Linkerd-SMI extension onto your cluster. +This extension consists of a SMI-Adaptor which converts SMI resources into +native Linkerd resources. + +To install the Linkerd-SMI extension, run the command: + +```bash +linkerd smi install | kubectl apply -f - +``` + +You can verify that the Linkerd-SMI extension was installed correctly by +running: + +```bash +linkerd smi check +``` + +### Helm + +To install the `linkerd-smi` Helm chart, run: + +```bash +helm repo add l5d-smi https://linkerd.github.io/linkerd-smi +helm install l5d-smi/linkerd-smi --generate-name +``` + +## Install Sample Application + +First, let's install the sample application. + +```bash +# create a namespace for the sample application +kubectl create namespace trafficsplit-sample + +# install the sample application +linkerd inject https://raw.githubusercontent.com/linkerd/linkerd2/main/test/integration/viz/trafficsplit/testdata/application.yaml | kubectl -n trafficsplit-sample apply -f - +``` + +This installs a simple client, and two server deployments. +One of the server deployments i.e `failing-svc` always returns a 500 error, +and the other one i.e `backend-svc` always returns a 200. + +```bash +kubectl get deployments -n trafficsplit-sample +NAME READY UP-TO-DATE AVAILABLE AGE +backend 1/1 1 1 2m29s +failing 1/1 1 1 2m29s +slow-cooker 1/1 1 1 2m29s +``` + +By default, the client will hit the `backend-svc`service. This is evident by +the `edges` sub command. + +```bash +linkerd viz edges deploy -n trafficsplit-sample +SRC DST SRC_NS DST_NS SECURED +prometheus backend linkerd-viz trafficsplit-sample √ +prometheus failing linkerd-viz trafficsplit-sample √ +prometheus slow-cooker linkerd-viz trafficsplit-sample √ +slow-cooker backend trafficsplit-sample trafficsplit-sample √ +``` + +## Configuring a TrafficSplit + +Now, Let's apply a `TrafficSplit` resource to perform Traffic Splitting on the +`backend-svc` to distribute load between it and the `failing-svc`. + +```bash +kubectl apply -f - < +Annotations: +API Version: linkerd.io/v1alpha2 +Kind: ServiceProfile +Metadata: + Creation Timestamp: 2021-08-02T12:42:52Z + Generation: 1 + Managed Fields: + API Version: linkerd.io/v1alpha2 + Fields Type: FieldsV1 + fieldsV1: + f:spec: + .: + f:dstOverrides: + Manager: smi-adaptor + Operation: Update + Time: 2021-08-02T12:42:52Z + Resource Version: 3542 + UID: cbcdb74f-07e0-42f0-a7a8-9bbcf5e0e54e +Spec: + Dst Overrides: + Authority: backend-svc.trafficsplit-sample.svc.cluster.local + Weight: 500 + Authority: failing-svc.trafficsplit-sample.svc.cluster.local + Weight: 500 +Events: +``` + +As we can see, A relevant `ServiceProfile` with `DstOverrides` has +been created to perform the TrafficSplit. + +The Traffic Splitting can be verified by running the `edges` command. + +```bash +linkerd viz edges deploy -n trafficsplit-sample +SRC DST SRC_NS DST_NS SECURED +prometheus backend linkerd-viz trafficsplit-sample √ +prometheus failing linkerd-viz trafficsplit-sample √ +prometheus slow-cooker linkerd-viz trafficsplit-sample √ +slow-cooker backend trafficsplit-sample trafficsplit-sample √ +slow-cooker failing trafficsplit-sample trafficsplit-sample √ +``` + +This can also be verified by running `stat` sub command on the `TrafficSplit` +resource. + +```bash +linkerd viz stat ts/backend-split -n traffic-sample +NAME APEX LEAF WEIGHT SUCCESS RPS LATENCY_P50 LATENCY_P95 LATENCY_P99 +backend-split backend-svc backend-svc 500 100.00% 0.5rps 1ms 1ms 1ms +backend-split backend-svc failing-svc 500 0.00% 0.5rps 1ms 1ms 1ms +``` + +This can also be verified by checking the `smi-adaptor` logs. + +```bash +kubectl -n linkerd-smi logs deploy/smi-adaptor smi-adaptor +time="2021-08-04T11:04:35Z" level=info msg="Using cluster domain: cluster.local" +time="2021-08-04T11:04:35Z" level=info msg="Starting SMI Controller" +time="2021-08-04T11:04:35Z" level=info msg="Waiting for informer caches to sync" +time="2021-08-04T11:04:35Z" level=info msg="starting admin server on :9995" +time="2021-08-04T11:04:35Z" level=info msg="Starting workers" +time="2021-08-04T11:04:35Z" level=info msg="Started workers" +time="2021-08-04T11:05:17Z" level=info msg="created serviceprofile/backend-svc.trafficsplit-sample.svc.cluster.local for trafficsplit/backend-split" +time="2021-08-04T11:05:17Z" level=info msg="Successfully synced 'trafficsplit-sample/backend-split'" +``` + +## Cleanup + +Delete the `trafficsplit-sample` resource by running + +```bash +kubectl delete namespace/trafficsplit-sample +``` + +### Conclusion + +Though, Linkerd currently supports reading `TrafficSplit` resources directly +`ServiceProfiles` would always take a precedence over `TrafficSplit` resources. The +support for `TrafficSplit` resource will be removed in a further release at which +the `linkerd-smi` extension would be necessary to use `SMI` resources with Linkerd. diff --git a/linkerd.io/content/2.17/tasks/managing-egress-traffic.md b/linkerd.io/content/2.17/tasks/managing-egress-traffic.md new file mode 100644 index 0000000000..4d6115f009 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/managing-egress-traffic.md @@ -0,0 +1,443 @@ +--- +title: Managing egress traffic +--- + +In this guide, we'll walk you through an example of [egress traffic +management]({{< relref "../features/egress" >}}): visualizing, applying +policies and implementing advanced routing configuration for traffic that is +targeted to destinations that reside outside of the cluster. + +{{< warning >}} + +No service mesh can provide a strong security guarantee about egress traffic +by itself; for example, a malicious actor could bypass the Linkerd sidecar - +and thus Linkerd's egress controls - entirely. Fully restricting egress +traffic in the presence of arbitrary applications thus typically requires a +more comprehensive approach. + +{{< /warning >}} + +## Visualizing egress traffic + +In order to be able to capture egress traffic and apply policies to it we will +make use of the `EgressNetwork` CRD. This CRD is namespace scoped - it applies +to clients in the local namespace unless it is created in the globally +configured egress namespace. For now, let's create an `egress-test` namespace +and add a single `EgressNetwork` to it. + +```bash +kubectl create ns egress-test +kubectl apply -f - < original-trust.crt +``` + +## Generate a new trust anchor + +After saving the current trust anchor certificate, generate a new trust anchor +certificate and private key: + +```bash +step certificate create root.linkerd.cluster.local ca-new.crt ca-new.key --profile root-ca --no-password --insecure +``` + +Note that we use `--no-password --insecure` to avoid encrypting these files +with a passphrase. Store the private key somewhere secure so that it can be +used in the future to [generate new issuer certificates](../generate-certificates/). + +## Bundle your original trust anchor with the new one + +Next, we need to bundle the trust anchor currently used by Linkerd together with +the new anchor. We use `step` to combine the two certificates into one bundle: + +```bash +step certificate bundle ca-new.crt original-trust.crt bundle.crt +``` + +If desired, you can `rm original-trust.crt` too. + +## Deploying the new bundle to Linkerd + +At this point you can use the `linkerd upgrade` command to instruct Linkerd to +work with the new trust bundle: + +```bash +linkerd upgrade --identity-trust-anchors-file=./bundle.crt | kubectl apply -f - +``` + +or you can also use the `helm upgrade` command: + +```bash +helm upgrade linkerd-control-plane --set-file identityTrustAnchorsPEM=./bundle.crt +``` + +Once this is done, you'll need to restart your meshed workloads so that they use +the new trust anchor. For example, doing that for the `emojivoto` namespace would +look like: + +```bash +kubectl -n emojivoto rollout restart deploy +``` + +Now you can run the `check` command to ensure that everything is ok: + +```bash +linkerd check --proxy +``` + +You might have to wait a few moments until all the pods have been restarted and +are configured with the correct trust anchor. Meanwhile you might observe warnings: + +```text {class=disable-copy} +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +√ trust roots are within their validity period +√ trust roots are valid for at least 60 days +√ issuer cert is using supported crypto algorithm +√ issuer cert is within its validity period +‼ issuer cert is valid for at least 60 days + issuer certificate will expire on 2019-12-19T09:51:19Z + see https://linkerd.io/2/checks/#l5d-identity-issuer-cert-not-expiring-soon for hints +√ issuer cert is issued by the trust root + +linkerd-identity-data-plane +--------------------------- +‼ data plane proxies certificate match CA + Some pods do not have the current trust bundle and must be restarted: + * emojivoto/emoji-d8d7d9c6b-8qwfx + * emojivoto/vote-bot-588499c9f6-zpwz6 + * emojivoto/voting-8599548fdc-6v64k + * emojivoto/web-67c7599f6d-xx98n + * linkerd/linkerd-sp-validator-75f9d96dc-rch4x + * linkerd/linkerd-tap-68d8bbf64-mpzgb + * linkerd/linkerd-web-849f74b7c6-qlhwc + see https://linkerd.io/2/checks/#l5d-identity-data-plane-proxies-certs-match-ca for hints +``` + +When the rollout completes, your `check` command should stop warning you that +pods need to be restarted. It may still warn you, however, that your issuer +certificate is about to expire soon: + +```text {class=disable-copy} +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +√ trust roots are within their validity period +√ trust roots are valid for at least 60 days +√ issuer cert is using supported crypto algorithm +√ issuer cert is within its validity period +‼ issuer cert is valid for at least 60 days + issuer certificate will expire on 2019-12-19T09:51:19Z + see https://linkerd.io/2/checks/#l5d-identity-issuer-cert-not-expiring-soon for hints +√ issuer cert is issued by the trust root + +linkerd-identity-data-plane +--------------------------- +√ data plane proxies certificate match CA +``` + +At this point, all meshed workloads are ready to accept connections signed +by either the old or new trust anchor, but they're all still using certificates +signed by the old trust anchor. To change that, we'll need to rotate the +issuer certificate. + +## Rotating the identity issuer certificate + +To rotate the issuer certificate and key pair, start by generating the new +identity issuer certificate and key: + +```bash +step certificate create identity.linkerd.cluster.local issuer-new.crt issuer-new.key \ +--profile intermediate-ca --not-after 8760h --no-password --insecure \ +--ca ca-new.crt --ca-key ca-new.key +``` + +This new issuer certificate is signed by our new trust anchor, which is why it +was critical to install the new trust anchor bundle (as outlined in the previous +section). Once the new bundle is installed and running `linkerd check` shows all +green checks and no warnings, you can safely rotate the identity issuer certificate +and key by using the `upgrade` command again: + +```bash +linkerd upgrade \ + --identity-issuer-certificate-file=./issuer-new.crt \ + --identity-issuer-key-file=./issuer-new.key \ + | kubectl apply -f - +``` + +or + +```bash +helm upgrade linkerd-control-plane \ + --set-file identity.issuer.tls.crtPEM=./issuer-new.crt \ + --set-file identity.issuer.tls.keyPEM=./issuer-new.key +``` + +At this point you can check for the `IssuerUpdated` Kubernetes event to be certain +that Linkerd saw the new issuer certificate: + +```bash +kubectl get events --field-selector reason=IssuerUpdated -n linkerd + +LAST SEEN TYPE REASON OBJECT MESSAGE +9s Normal IssuerUpdated deployment/linkerd-identity Updated identity issuer +``` + +Restart the proxy for all injected workloads in your cluster to ensure that +their proxies pick up certificates issued by the new issuer: + +```bash +kubectl -n emojivoto rollout restart deploy +``` + +Run the `check` command to make sure that everything is going as expected: + +```bash +linkerd check --proxy +``` + +You should see output without any certificate expiration warnings (unless an +expired trust anchor still needs to be removed): + +```text {class=disable-copy} +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +√ trust roots are within their validity period +√ trust roots are valid for at least 60 days +√ issuer cert is using supported crypto algorithm +√ issuer cert is within its validity period +√ issuer cert is valid for at least 60 days +√ issuer cert is issued by the trust root + +linkerd-identity-data-plane +--------------------------- +√ data plane proxies certificate match CA +``` + +## Removing the old trust anchor + +Since the old trust anchor is now completely unused, we can now switch +Linkerd from the bundle we created for the trust anchor to using only +the new trust anchor certificate: + +```bash +linkerd upgrade --identity-trust-anchors-file=./ca-new.crt | kubectl apply -f - +``` + +or + +```bash +helm upgrade linkerd2 --set-file --set-file identityTrustAnchorsPEM=./ca-new.crt +``` + +Note that the ./ca-new.crt file is the same trust anchor you created at the start +of this process. + +Once again, explicitly restart your meshed workloads: + +```bash +kubectl -n emojivoto rollout restart deploy +linkerd check --proxy +``` + +And, again, the output of the `check` command should not produce any warnings or +errors: + +```text {class=disable-copy} +linkerd-identity +---------------- +√ certificate config is valid +√ trust roots are using supported crypto algorithm +√ trust roots are within their validity period +√ trust roots are valid for at least 60 days +√ issuer cert is using supported crypto algorithm +√ issuer cert is within its validity period +√ issuer cert is valid for at least 60 days +√ issuer cert is issued by the trust root + +linkerd-identity-data-plane +--------------------------- +√ data plane proxies certificate match CA +``` + +Congratulations, you have rotated your trust anchor! 🎉 diff --git a/linkerd.io/content/2.17/tasks/modifying-proxy-log-level.md b/linkerd.io/content/2.17/tasks/modifying-proxy-log-level.md new file mode 100644 index 0000000000..c4fb59c4b3 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/modifying-proxy-log-level.md @@ -0,0 +1,45 @@ +--- +title: Modifying the Proxy Log Level +description: Linkerd proxy log levels can be modified dynamically to assist with debugging. +--- + +Emitting logs is an expensive operation for a network proxy, and by default, +the Linkerd data plane proxies are configured to only log exceptional events. +However, sometimes it is useful to increase the verbosity of proxy logs to +assist with diagnosing proxy behavior. Happily, Linkerd allows you to modify +these logs dynamically. + +{{< note >}} +The proxy's proxy debug logging is distinct from the proxy HTTP access log, +which is configured separately. See the documentation on [enabling access +logging](../../features/access-logging/) for details on configuring Linkerd +proxies to emit an HTTP access log. +{{< /note >}} + +The log level of a Linkerd proxy can be modified on the fly by using the proxy's +`/proxy-log-level` endpoint on the admin-port. + +For example, to change the proxy log-level of a pod to +`debug`, run +(replace `${POD:?}` or set the environment-variable `POD` with the pod name): + +```sh +kubectl port-forward ${POD:?} linkerd-admin +curl -v --data 'linkerd=debug' -X PUT localhost:4191/proxy-log-level +``` + +whereby `linkerd-admin` is the name of the admin-port (`4191` by default) +of the injected sidecar-proxy. + +The resulting logs can be viewed with `kubectl logs ${POD:?}`. + +If changes to the proxy log level should be retained beyond the lifetime of a +pod, add the `config.linkerd.io/proxy-log-level` annotation to the pod template +(or other options, see reference). + +The syntax of the proxy log level can be found in the +[proxy log level reference](../../reference/proxy-log-level/). + +Note that logging has a noticeable, negative impact on proxy throughput. If the +pod will continue to serve production traffic, you may wish to reset the log +level once you are done. diff --git a/linkerd.io/content/2.17/tasks/multicluster-using-statefulsets.md b/linkerd.io/content/2.17/tasks/multicluster-using-statefulsets.md new file mode 100644 index 0000000000..a4991fb0a2 --- /dev/null +++ b/linkerd.io/content/2.17/tasks/multicluster-using-statefulsets.md @@ -0,0 +1,336 @@ +--- +title: Multi-cluster communication with StatefulSets +description: cross-cluster communication to and from headless services. +--- + +Linkerd's multi-cluster extension works by "mirroring" service information +between clusters. Exported services in a target cluster will be mirrored as +`clusterIP` replicas. By default, every exported service will be mirrored as +`clusterIP`. When running workloads that require a headless service, such as +[StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/), +Linkerd's multi-cluster extension can be configured with support for headless +services to preserve the service type. Exported services that are headless will +be mirrored in a source cluster as headless, preserving functionality such as +DNS record creation and the ability to address an individual pod. + +This guide will walk you through installing and configuring Linkerd and the +multi-cluster extension with support for headless services and will exemplify +how a StatefulSet can be deployed in a target cluster. After deploying, we will +also look at how to communicate with an arbitrary pod from the target cluster's +StatefulSet from a client in the source cluster. For a more detailed overview +on how multi-cluster support for headless services work, check out +[multi-cluster communication](../../features/multicluster/). + +## Prerequisites + +- Two Kubernetes clusters. They will be referred to as `east` and `west` with + east being the "source" cluster and "west" the target cluster respectively. + These can be in any cloud or local environment, this guide will make use of + [k3d](https://github.com/rancher/k3d/releases/tag/v4.1.1) to configure two + local clusters. +- [`smallstep/CLI`](https://github.com/smallstep/cli/releases) to generate + certificates for Linkerd installation. +- [`A recent linkerd release`](https://github.com/linkerd/linkerd2/releases) + (2.11 or older). + +To help with cluster creation and installation, there is a demo repository +available. Throughout the guide, we will be using the scripts from the +repository, but you can follow along without cloning or using the scripts. + +## Install Linkerd multi-cluster with headless support + +To start our demo and see everything in practice, we will go through a +multi-cluster scenario where a pod in an `east` cluster will try to communicate +to an arbitrary pod from a `west` cluster. + +The first step is to clone the demo +repository on your local machine. + +```sh +# clone example repository +$ git clone git@github.com:mateiidavid/l2d-k3d-statefulset.git +$ cd l2d-k3d-statefulset +``` + +The second step consists of creating two `k3d` clusters named `east` and +`west`, where the `east` cluster is the source and the `west` cluster is the +target. When creating our clusters, we need a shared trust root. Luckily, the +repository you have just cloned includes a handful of scripts that will greatly +simplify everything. + +```sh +# create k3d clusters +$ ./create.sh + +# list the clusters +$ k3d cluster list +NAME SERVERS AGENTS LOADBALANCER +east 1/1 0/0 true +west 1/1 0/0 true +``` + +Once our clusters are created, we will install Linkerd and the multi-cluster +extension. Finally, once both are installed, we need to link the two clusters +together so their services may be mirrored. To enable support for headless +services, we will pass an additional `--set "enableHeadlessServices=true` flag +to `linkerd multicluster link`. As before, these steps are automated through +the provided scripts, but feel free to have a look! + +```sh +# Install Linkerd and multicluster, output to check should be a success +$ ./install.sh + +# Next, link the two clusters together +$ ./link.sh +``` + +Perfect! If you've made it this far with no errors, then it's a good sign. In +the next chapter, we'll deploy some services and look at how communication +works. + +## Pod-to-Pod: from east, to west + +With our install steps out of the way, we can now focus on our pod-to-pod +communication. First, we will deploy our pods and services: + +- We will mesh the default namespaces in `east` and `west`. +- In `west`, we will deploy an nginx StatefulSet with its own headless + service, `nginx-svc`. +- In `east`, our script will deploy a `curl` pod that will then be used to + curl the nginx service. + +```sh +# deploy services and mesh namespaces +$ ./deploy.sh + +# verify both clusters +# +# verify east +$ kubectl --context=k3d-east get pods +NAME READY STATUS RESTARTS AGE +curl-56dc7d945d-96r6p 2/2 Running 0 7s + +# verify west has headless service +$ kubectl --context=k3d-west get services +NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE +kubernetes ClusterIP 10.43.0.1 443/TCP 10m +nginx-svc ClusterIP None 80/TCP 8s + +# verify west has statefulset +# +# this may take a while to come up +$ kubectl --context=k3d-west get pods +NAME READY STATUS RESTARTS AGE +nginx-set-0 2/2 Running 0 53s +nginx-set-1 2/2 Running 0 43s +nginx-set-2 2/2 Running 0 36s +``` + +Before we go further, let's have a look at the endpoints object for the +`nginx-svc`: + +```sh +$ kubectl --context=k3d-west get endpoints nginx-svc -o yaml +... +subsets: +- addresses: + - hostname: nginx-set-0 + ip: 10.42.0.31 + nodeName: k3d-west-server-0 + targetRef: + kind: Pod + name: nginx-set-0 + namespace: default + resourceVersion: "114743" + uid: 7049f1c1-55dc-4b7b-a598-27003409d274 + - hostname: nginx-set-1 + ip: 10.42.0.32 + nodeName: k3d-west-server-0 + targetRef: + kind: Pod + name: nginx-set-1 + namespace: default + resourceVersion: "114775" + uid: 60df15fd-9db0-4830-9c8f-e682f3000800 + - hostname: nginx-set-2 + ip: 10.42.0.33 + nodeName: k3d-west-server-0 + targetRef: + kind: Pod + name: nginx-set-2 + namespace: default + resourceVersion: "114808" + uid: 3873bc34-26c4-454d-bd3d-7c783de16304 +``` + +We can see, based on the endpoints object that the service has three endpoints, +with each endpoint having an address (or IP) whose hostname corresponds to a +StatefulSet pod. If we were to do a curl to any of these endpoints directly, we +would get an answer back. We can test this out by applying the curl pod to the +`west` cluster: + +```sh +$ kubectl --context=k3d-west apply -f east/curl.yml +$ kubectl --context=k3d-west get pods +NAME READY STATUS RESTARTS AGE +nginx-set-0 2/2 Running 0 5m8s +nginx-set-1 2/2 Running 0 4m58s +nginx-set-2 2/2 Running 0 4m51s +curl-56dc7d945d-s4n8j 0/2 PodInitializing 0 4s + +$ kubectl --context=k3d-west exec -it curl-56dc7d945d-s4n8j -c curl -- bin/sh +/$ # prompt for curl pod +``` + +If we now curl one of these instances, we will get back a response. + +```sh +# exec'd on the pod +/ $ curl nginx-set-0.nginx-svc.default.svc.west.cluster.local +" + + +Welcome to nginx! + + + +