From eda7ceeb9c358ac2ab0a03408d540acb037ba14b Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Mon, 28 Sep 2026 22:50:21 +0200 Subject: [PATCH 01/18] Add a project icon: a lock hiding in the fog 1024px and 256px PNGs for use as the repo avatar/social preview. Co-Authored-By: Claude Sonnet 5 --- assets/icon-256.png | Bin 0 -> 18778 bytes assets/icon.png | Bin 0 -> 135267 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 assets/icon-256.png create mode 100644 assets/icon.png diff --git a/assets/icon-256.png b/assets/icon-256.png new file mode 100644 index 0000000000000000000000000000000000000000..81d6eba5e25f6171bc62637295225fdb1565e5a5 GIT binary patch literal 18778 zcmXtfV{j!**X=p6ZA>&VC!W~0F|lpy#I|i~Vmq1GwkEcn+|ZgD!v6yRkR*{55ma%{y72L;qPI{}_fc(n z`uVisb=gqbVb*>`GJh|Fya~=S(3?gA7eR$~&q$5~mQeNsj~IZ%;8deYKc+&bD2-}ZW{(Q0`+Uu&{j zt{Jwge$bA+s=PmJ>FG!_PNnosI%!m`&3S|A#<_%rIVHhV1)ira=B*zX%`&ZqtIOTMx3qKWDiz7Bm0z z!(q|;oh+sOm;#A))ZGLwfD*Uqzm^9P5Cv|-f`#Ef#~KuHtp7i9BA5)bWqC(A64Pi{ zF+&NJdjjhC0s_asX3LPwe-SbJ|AmpkFi%jF-Yk{`r@*b1arqyg|N513t$a61p+@BT zhyRbV?O323vtjxv;2+Tvsq62BDHd8u|M2tYGyk)2_5QQ`haUrzWw!he_#dAN@PAbP z%hu(`|K&jqmG+Oq(Es_u(N9nuSAlLFc1)<`Z8F>BF2CBfi&kjwxUZHZ*JVt{*r}0l z%YEdh{*ygc1ZW{aMzYBA9?BlWfY?rO&U6Y&q{xyeVLiq>X+GYe^ub992eTo%U(T8> zf@+ibMx1!j{S94k%;Xf3v<(@XgeUVo*TX!K$EB3iP`a`Uc-67)H}@akOe9jj5runA&Z#kTS!I3FfK~bdCYk!}E5UI5Ko@_yLMl}J!f^GoxYpZ+*L^-2e>||TIRImt{;Jxdy+S5+YSQn*P4{hz=yjxlsOLSz>F%Hi z+)cGv19&NHucv;}WHoNK)%{ibxio*}GyKBX>8YXK0`9{YY2x-dah_Z$?)Mhz_jcs> z;Dr5XChMek*dQ~+KGqD?w>fHO)_(UE*`v06l1v-<)N}VP|5f;uy`8Jm-JG^aPO)mM z3fZ1kCN*A?Jw3+K@!<9`9{YLh_qiZ^bVTa{SZeV;O%JykzR_N_lVOL%*>Rq<`Fp7pQBMP{;~&5WjB9us}snfri6J-b-K4 z&HY_&*URit?L}?{UK#nZgG*y%Rb;_3PPF!>g+=~465&dWhyPx6Pzj!874BA}v_gKc zHP44S*sD7(ZOgM>`WV_*uV1|qe?OQV?0TxI$4A-6u-`$p-~9=E?;9-{;?SHhy_M!DUe=fey=*S7{zL!Y`ITa?pXXEtxx)04GZ8Vo54 z5F zD=P85wV`h$oOfdF4#vY({8A*ZnxtQm6D3LxjpyIEINpM<{Jx4C?g~vhB8I;IzP#A7 zO^&!H@;zzb|B%l8xRC$V;q5cqe65)tq0Ie&9(&>Q0sZas(awFmxS`?Sh^yM^ebTMh ztgl!1T;zH`r{?%r_#u0eJ3^3Mc9fy0*ikecXD5u>#23mg`cJBYE=6XD2D{eYF+NvL zjS>sP;@ctazVfeL6YO5vhjqKXRWetnfQ{De4W(!N&*#xsA9b-Gd$m2Rwc}lzW9q|e zHJm(_wM49Xx8jdISL?a&r%%7yy?sz!h@XR+FCJYhWBp#&a=&uS%4gf*Igx9($Q3Br zYfmm~@T`lFtP8-1?+Yafm|g}Q!8cBbYVTLXyR$5M#}Furl`5EZy6WC5%osk`d!C9p zV)2G7`Dg2`*Wlk8%=lej7{3~}y>FTd;on%yU3XIa-g;zag#S%V9ftL*uQPd{vs~Zz zWLj~78+D0!XYA=I-<@s#r~KT{K=>p~lL@%?JB}$)`!mH-yUo7se8v?fwv{9<5VM^* z(~`+x)l%efvUMBYHRuK81L1qpD!+jJk-xi7tz2QYsrTk&S6xwWqn#=XlU!SJ^7v#r z?fZV(^3^L|L*$H{y{*G;BL&+T{M&A^rH1zLsiK+w^E38SSL%Sn?;=yTqnWu>MQx~Q z;8MH$a+3e4GS~0o)KE=0CyB1}og~W5Cwm6{+#J0%;+jwj88i5=y~BNsa**@wx^w-- zRgd+Uky4=lQgQ%+*{uy(2p_JyGNjgkpPDD+m3|hjexOFci{ASUqt^g*ZkzLgsj`}C zihGa(&gA=6`RmK{=6faob9`p#1upTKC?fvRY%71irfOEM>h{}ykKg0OJ3im_b)|Z$ zSj`5x1gyrqksas5q~6#!3JFK<-21!ozkneZ33~=GG!E!pqES#JLxUkx(jS&&09zZwcGh zm^{5inF*v=prcyrt)ZJ&oc{a+`%Z$7?;DSmngB*t&INXB`9bys=*H1qn?4Iqg!{b4EkEH$pq1scrjh*BO|m8= zV7u~MU#<1n9#FS)Egy8y&eH3{j~$m){>8)n7N7eySo?9A96ANOD}OMAe}F~xbXF@p zno)ff=6@^q`y{*q8+>GdCftoKyo}uL{3_l08ex2&p3dgg5svq_;kOc67g`0L*#>PD z*>Mf>GyLx3FUQNGGHS==vPU)qr8$2asjVtpE0?G8vL>&`54C{eiRK6eQwwiY<98&z zmsII(!{md#U@lW~*#G_3Uh8h`XZN|rHnNEGeBj+tlQ}&m@BMjg=6f&%f8?s1e)>16 zhq|`h?pok^wAiUZ?`vi8>m#0)$op`wDX^Fe2u^P3y_%x;|+H_b724Z~o2Et-@Q+{UhwJhGjA!Hh?8;Bq9M0icaN+h09~;Gu-`jaE*KWGP?5ks~;bsvRcg%v%sd)(xd(L zciML^xpFd?C9S~W2+N)SlL9emlmO@PiKti36E-s6zY?a!&T@pMdw}LydF~dT~40(y;`|zu^?Q4JogxENK3lR+uRj;`Un)JWpt-iukx|g7d=Gj{ zcq`McpkMWvH^ZENI{Jt<06P1134cK{mcah@Zw0zS2qF?78-fYIl#MyJYVh0*2CrKC zI@N(N$bAD|uuV~Imb16Y{a*aK?r)nOH%@*cfFXGlrKP*@iF^CE0kdR^U#_ORU$@+T z4N8FKyJh4AzyXbsHQtBe@Lwliohs8H2*pxD5~5GEM~gPA4k$gPWoH!Rq;NiIp?Fr# zL-X_kFJX3qKOhoH($+oK2Bdq>=F1+24N*uOQ?5Q)B;0`KYB~v+AP?g8{nqZCoH*o_ zBRO{65_0y>&hNfLKEaVttfGmzQzu=g>68o%YxTlfdjVpa5}T8Sw;Z`0zMghw?6j5d zho;@qWRJ{(szS;BU;NtG(|*1$ZOeHXORPFyc}lBo|m&6S$&F}gYIwzLJ+SZ z&VVm=6KUVPAPyVwO(&a71$+%e){sA1{*bU)n@U6&_n>{FHZ)<>01oiLmC@7rCxO%T zODJcCX~2a?XZ6W^c$GY=J5uq!xmAaLd%kogXUW9jR_}BxL*HfLB=k6=XI_8ip7_Fr z#jL>ZF+sw<2gc0D*@n`s`;hri=^go`cZ1W3FE?(NmlJF|-@~DU)h?Y5EsulLE?E_0 zM}aNWqIxL~TXv$i`(1UPldawQ^54vKB3&%0pY02AKIDz;gB!&een9>`+_)?I zT$&KBaK9rRf0_V!D#+5Lh|9wQpZDFakNHw0?C6a${ZF8Z%fqbvhIPa#>%-Yo!P{|9 zeFN;-ZwkQZ#P-X=t~#HNTe9U*Ux#Lp{>JAaoa_$BCwG60y+T^2c#J-GQd~g;se;Lukn`i+iX6OqEgA;>Ez?-q_d}8O9)R%^Y*psf(TND#?PeQ zg1bggo`mQ;X6-N9Z(in047-#F&S-^<8TTW_EZEZ*^eM7BWXsUlGduhOyeES5jjF3E zm{m}~W1|OvOa3pRAV3ZPM=?_!AqdiV6Wwc}Yn+?4bi-D96#Q%6a<4bmG)1$Q+?IAakk_ZQQ4PK%BTbXg* zRW<5yCt{DqW6DZ6ql zT`n0K1I2rRhb~bSvAz9*@2=z1^FRZXvp*u-p;_Foq|E|ZuMUf^`*JI2Y4cR5jY7OU zxV&rWz-PORigI@o*n4QQeYA9xVG03i55*CD&9n-2qqtEw7>qO{aT-`F^_uT<<>-CvJ~GF4Sk>Q#X%uqig{ zbfTzuF#f>LGN8$Pqe?9&<@>ECU zwHSxg1>!#dzH+wT->;&Ft(-@ESW92} zfoS3>ej_P%hdGZTjYD5Kd#u^AOS|xDH;BmP4&D&+4*H*LPir zMQ7p921-|0Pg30@KvhQ*G7M7{_yx?)7UVw$-QmvV9IGcyYTf`-D?kepH_7q|v` zxOKSFDo#&VJ5MT>qLA!imxbn#xAnT_WwOTd0tBqP z#uiza2WK@5t&+6Ipbv+pSWZc?l<+LQq|x!z4bc#?_Qoh|RF94elB z(2sHX!I$y+3M;lRfmhzQVbM>dddl@eZnfIoBnN-9_AGuDXyh4zfgY!=1t9?ZIJ-`V zX4cwfIqfCIb;|^gS(*9B15CWbZ$Lv0r{!2+AsSS-0#>jKs6#&gI(ba`=!x%c&ruCK z;e4>uY<|gReIe}&n5X{ir>tHEysjyydCqbU5q(!7zU_?;fMHq`u&+_b1dwjyjIh&c*6~@CRy)q z6rR80qZ-__l9garp%nP(+w{>W5_Ys9uWE!NGeZg8d!k5%gzhkx0s|M=gDdDhRKZ`%U|$A`M*d6 zD^@wbwKpwep6GyFDESrnk14vakPIrEM$xEAoTLWUq|~ zasbbu@TbU^gO~_Py^7pVvelr5#Y@y?zQl z#67sb0wR+}u@uHsNR7MUgxkDI@pmIuJ(&_p#J@d|G+4m%*)45Q!SF_>=6a)p69J_ui4 zb>x%_Xc7@cpieq5QIyxPe_|tKcy87*@8gf&0DP({_=;($ru`{3=1cO$d=l^>KDD8- zhs0F!gMnot)n#bYns@++@|gr(54%6(BYC?D)-(mOfLv4p0`$CYi+ID;Sy#dq4E%C} zpglfSB~XWk64aSMPgPyos3Ar{?Bx36x(0@K>9{`QPFyKcl{$cMF@i#=6CwBmwKMtO zr#2}8H-(xJBx*s&PxPN)X0q4lXGanoDgNp2VS#gkU^mMXar!l~fAV2YP1}=-x!()i z{%BpF>zPXD1gq2MS7tlqYh41p`xVWDntdH9V3@O1!#OFvkjH+1C+r2SSQ={(?sKjX zS33MgYI6=}LJVU&hOMi)BeC@pEaPoD%R@m-3M99g9gj(h0QA|De(U;D4J|6K>m*Y=O`=3GPq&o_e90K zvINuXpE^37bs;nM6D#OW32_c*VRY>(T8NRO5=f=|uofuhAckU;i*B+HT)ndgg{&NWu>Mk6&67<%qMB`Gqi38&I^`%utr**52ib04|s26HW3K}75 z6@T(5+}G{imUR&;xO(+$XP5Hfdqd5gW2KWTro)4e-5JBUUU62pnVw2&%vdR)ysY4z z2KeS&PApvj6RLFa1?f3)mMRQWI-@DkMBjywGV%pMw?boz-%Zk^Umv{S*T~lo8big3 zW&*B^m|^A~##cgV0>F(-t;~5RIrs9f9`bU{69id&oUSkforh^P!}u{u7OVn)x^SK# z?LdC;QupOC-NTZ{5(K=XK#WiLb^;)9{RrN@yV_I3aAZ>Z_?TbU0pBjYSg=$rseQMUsKWI4;G2?%(DKQsd zGN3R~7{TS`li+*ZNMqRJlgyLElSKXQyZT#M6m%}VG#8Do(X%r@o2TzXO+Ia5);+^x zyDgF6`r@cE;UZ(!VbTrxRG6+N`E06+(>2@oDn4wWsW_~%ll8M@PH7e@3^fQyVBahe zmG_n(`1RA{REcw~0p;43X;nhXyivKm+b1GVb1yIG(O+u?4H??}ypnoc-VA?Ytaml_bqtukn4=&3==__Hq* z6X|K|u){%}Crw1Vb>QTwt<(*k$n0Y_Vp9>m5{e4B;&ufMF_JS;7_3Not}Zt}4F~*9d*4;pl>zpSp10 z=fT8{Eq_bEa3U$3fV3~YXMrL(XX!tsTt<2`Lvj?z8O2s-sB+`VhSOWk~Bw6V~A7K#9 zTPuuKxWxjpq}r~y?+cb{@P!43EzWX>V(2ET^)EE-jDtb^+IVi5gZNS z0^lYT6xuft6i*BzDmvc}D^k}`Q@uE(Y=L%K+xyq3K|oTqCiCXt{GEnWax#VQZ~ zc5~9w+`21tJYh!KM7j3yZG{y#6TxX5(*b$HM$^HCP~&iZeixLc$=$dg2w-E)0^hRp z$`KjWmJ1Af>4W1L7vkgAwaA}<@~(JN74+EW&VY)}MtS@!&{xVNniUcXiZDq*h-uNk z`wV7bE~(cW_qoCuPA>hsLL}owmMb0!AchSRYtCoc!IO&~*;hBqaDi@#ur09~JFzr{ zy#jJCk^rVad2IgpjYGpq!1uAk>o7ro7^~pn$^?_A_&3;Mo~cG8dWg*t_ZanpG(@(; zg1AKuL9MLv2SUmrr?96tTot;D^dk#X`<`kZ7ywa$cw%o~@}F`dv?!n9RUQ3yDWc6ANEyxtCtiMu>30rWL9R49e3N2>^Up)I zD9j0dJa3{OLHrL4%EX3C-HbymBtg3J+q_kp*m}_#o>)ytXD#u5{8YZt~Nq|$@QPF<*oFcgU(ytj#sg~z>I`6Wr?Ry>Skv?^qdUcfn1}S4P6DhLj_*~D*;JOt8_8Y-=sDok zoO`ev2-YO~w&8iZGUh2Cb^X>7ez#q!ZXzQy=MkOzkUaRd>(e_Xu;}SKt%2Xs%+$d8 zKbGKj%VaAkyY17o{S=kv(MO>l*g&M(J6yL4SVss{{8E-WyEo>P~7ql&_Sv+dYzr$+2&?8U+fguOu$R56iNw!v&@L4u7OyN`KK^;+#By% zIO-0IrDoGl$E1lGi*9273s3;k)2NOOQmi7Ra|EjIY@SoxQP58Q5xJ0@q(|p>$NM;l zb54>B=r+in=iyrXv_yp%9i;WpsY@k|peX}S8uLr@Z7WkOz055coj3IfNBxY$VquVC zA*oGdqEkEvsLz6vInfy;HN%F{7Y8G$BvCP>mSSX*V5_3;nHb1MJjl7y9{L)gtbEiy z+@lmH1G)F>EgxJ6J8Et4kZ2p}Z|0$pdPYn{f|nTp%S#Hn#%)#!HNtHd<1$%kKOy4i z14rt_$%PjR*@@SZ->J|}-*shVPf4q^uGNjD3>A&{wtnB0S(`tRXeqD^#oISuUg#sI zv-l^*sCq5j@!l#V5S?@^CJ6ok!^{dNsEhN?}&)z4zw{}v2rPu8%$g!|)6rww{moyxC z&*OCA1oIYY`Xd<_*w58APPw-qTF)^F0cUKA)*b1w+3E9`e~pv)II|T^4Tx@4IBHf* zDxI3_-6s>W-Qgy5|DwD3(IYte``ZR6Ad_^f3A;3Z;e=B9YJDpgVZyx^o#K6=Q&%H* z>z1ocC5^JcLdTf{TEE9{kri^`Ua|?6EoyGoOa!1~rpo$9)u)O~H zcA|XtZZX&+GEhSamY8q518?T#d?_dI$LvY2mL??5yy)6TKdQf0O{mG04)X2KTEK}7 z?x}J8JD{1~_RD@EP(By|SJdovk4@Y+<(57RZ{g~&pI7Jx+-$&;@B69HOkr;@#wD{k z#W`%RjBtepZ$h0HyHC|xiBiJrB5#nW9!ulzUX6^9*{ps_8e~G`Yh-SrVg>-5zG^_! z$6sELI$ExkkM3_l#$|b-p)ObjfI5UjaIjs0E`^mpeKYq6Vkh8}C(vW@B9gTMqQqcY z!d;uFe2zc$xcR+i%!nnCa6H(*2TUhc5oE+D-pDgi*3Be4M~t_MW!T&CUdp`rzZZSD zU&X$%L$*UV_S~U?hxxwFkIsvTQ5^JB#K=piN~c37qmQ9J=1=UgVCbT+6iUp2LC<3+ zpCJS%QQdztKo*0QMtn44Wx|g1-@YNjjX7i%$T1P^Hk$QJxkt^-141kTsSxp41OyQ` zcnAe?nei_}AfEGkyOpW#xy>AEzbriMs|#WK()O}cguYPj7+m`30j$kQ*LfR#G*!3* znC91(yPQG4kcr`050;1bb>?kK7V+$3iihHy zu&PSN3Y&vyvSiFHQIpVE2r20=>t3$iF0@S+_~+#N=d<1y#lEJ<(Cm6k^Xi_;o9MJJ zp`4b!DWL&vhvMB`6+!6p>`h)I*}Uq(R2$Zwpr#*8kFufJ;!J2bLcp}7_(+p77}GBs zf;yD)nM6F|E4A5M5W2phDT#pM)kHB`R<15Wm`{SU#2yuTKd;-(TYO7|_j1aKUo_ID zcMX$6gQJalKSYqTx_t~4uStV}tu3!VU(6mmYX&n;DB4COi$8ODktK7QQl-OTF=sAg zoC5@uA!8~{eNoTFTz;m@riXho|i)b?#oLdoBD{WGNo=%^ zqYt%X@6kV99?SWnw6`mE2kIQI0aHj#FHJoH_w?bDDiWsrGa8THigHYxJkW_Q|ya)P@)1t zNAag8bW~W5NFcI(aX4|@&9wycsh_Ya%mqL1TW-9s=m!X|6~L(th0Juf8(k7ea9=o} zOdhW2gi(LpWf<^8F?9@me`KmSf0xx!6A@wgsILxrv=%PfQ^+|RRZh-J_d)h;mYL4c z|GR3CU3{rIoZ=q1D~o1UMX-MN?q871@ZkO01VlR3i4(z=kDjzy|1SL~Zd<}a=s?rL zZ?Uss8Z_s4u(7SGdhvA$uZWJ&c)}o4Jo-e)%mDY2%SbeCPbzVt4{=W7);TEBp&qaM zx`JhH!OgY~m3ZufX1%552Ha>ECyc?_n<%WdWBxm@Dtx3PEIIK?qMq6w%2W;80ElkQ zcCsuyd=}lMRz>MQ6>ug(>iW27wS=xiNv1z)9IT23kgPI#QPJ!g9K#Y|2mH^abROy${D~F))PQD}lN;yEggyrXJzf!t6^6UKE8C2N$&B_>&09y7L9Q2Yo?-o7>oo z(5UYObVDebOi(d?e?8%|wVOD!tX=LMFo)XDTRaHuvyx?9%(0RQfsJ4$(zg)Lcc87( zi|wSD>8QYYN<~f@dE3~3@gabis1t$5%?fpOgd>%M48KecHSfbQ$MWKPKw}U6otroQ zJDiear+`#-G3uNiZVYfD#tA$d4QV)u`utB}vqbu%6_RivRLdW3(m=-|635N+A`HSG zOYs~T+ogq$ZHkEG$7flwLoz^g;hL&5*n6162*Ye%cuaD!AmJ@q2#9#52F&8SlCu=R zZiIz1IK*58<>U}m-X33Z{@AiYgP00vhvL@)0eDzV4Xw9K+94s~Yc}49B$AJ*6k7NK zs6DIq?^~`Gt#MnUL2sZxecqqEUyL)?3IzgMXHJD0$xg7%AOqW~-(=|Z{O4^UOVHx@ z?9GF<%1A9VM-*LJAwlx>B*6?R5+ygnbK-?a45M}(ACTmap>x^!(<(`h&}wf533&kXKi>B?mSs_gykfuY#kT+{DV;K2q&cjq6%2Hl#8c?y7eeQ=Q`B2KeIh^8l##g? z^^aKy1>+g%irAZ7DfQS#%>>F+E>61;dAbpp@O>SmP6n|Db&>kx_`Ww*&&F>rL$GfI zT7}D8x)=@+VhraJ7M(x7)z5Jg;q*mW(Fdb?`)tg%d4nr|+HqD*fq$2Rv*Acn&m8v`Quo?1*%YTL}4NbFL+&n#KY}CH8 z7P&dELJj_&MN{$8BBMt({hVdnf%b;}#SK=NJD?<0CWS?*YvDx!dOu(e>NuU#t5Bsq z$~5k*ZCRbNL3W{*#Ae|~8St|uM98RFMDDkG6pI%R|BIDh%iixD-0b&Q!Gzl%S{5G} zv`NWFwXl|%)5fW8>p1x}G%?jnZMqleuc0#f2o{SCC!U^d#nS~mJuQ`YHS?pplrO*u z^zG#Wps3UH*J8l(Y>N=Sg4HS@7FJ5fx;W?4VI8K?db!-nI>qebEFH`RfhF%k<}4kQ zqneQ-=rpS%lDTWBwvrZ<7D(SX4jEe#YlwwWbCdfkv|bm1>&yVL-}Xw+UEL}0Sl;Rd zU~@<~@`JziI4T4#_%qvKnm8->S4G&6(LpWp*AgF&Da_L$IB8HNP?lBLrDu8tNLR1f?!q>0=GcP!Ebxf?`VDnpHQYhYdY~Y!WiWs z&o1smZM5QxFjZiqF9svEY{7V%HiL;8X!m*;x5n%awTa(32D$eFHMG6gaCQ1y-PDxX z_AX;xU!F%++k7_1YA0elW2t^Z?%JU8-tRZM);G ziiJ29cB{K?9xJj@u?lbbW(w$o<3UCo&LOp|*vYVysD+u6kv7LI&74tW;jBu{78aqE z6FZhS#+eabg`al1wR>i8Fwy)d7pdl(I)@_JeHSS3{;o&4S@|nQ;6g{>O#hNP?g_?w z{r=IzF=cc0c?tVz)1#fxxVyYZ+RenAQMb><+Z+pg1F=opo}Zl%gPQ{I2ZAl?e8(>f zd&57r6GARbzysQy2`1q?oMO74rKoCkITA(l$BLl&KB~6YyJ=a>PhCk z%Knzks&>|}kfR9=S~@ol_x3}vgj)kn!jbzz(We#mp$HU(H$RvQETo{ISk*wpuPOww zcn^tNd-J2GgEgQFRoutSs7PkpsK%JqERm+a>hCwi`v?9;3c|lJL9~V-pTCbHZ^ick z4&@2jbc5)(Ob`jTr@bSn1q#L@&hWE1uR0rztil9FCT*W;5h;2zZ+q`v%dz$O;(vCt zkjd)l-0qoQx2?3Nkyk3}sqo6F9o-st7mMpu(T~Ah!18CPcZ+=RF5`9P7J3>!-uPOx z$OD#0hUr(-J^5Ami3RxcA>MXbn9kQ=C+Rah9?#HTBa-_&q7m2fsPh0|k_dt2h$GR! z(km-?-me6*tu2Y0Xb!eHgT(fZot*4v%#xo5xfKk|z}QyIDH7PLI|DHo$fRq|f3N8e z2xmDn9VTawm}~;ov&ITc2fXit2>BaL=s>QHWw&R{4@F;v$HVZ*5VnuC#2s~sEHWiL6Y4$?QBGX}t&IgQ?AU?z!_iy~Z z=hEhyZ{L{wQ%Pe^^jl`l<_DnE~bj<|}vE<6|S!ccFLdq+YEG%hT*;p7zQZH8D8Y8mSLEzG5URE zYNlm}Og%c$9#6FXBz5OUWRggwKt#HD?32mA%#|~fJhJe@>?0IG{$%jKIGzyg!BNo+jCZ9sY!d@s`=A1yYTHBWfeTpJk z_geo%^X;;8EJiIp{WpG)7xUsD=z>`AZk>fZn5W}VgY8{)A=<{}0Btg!CjoXbpxhqx z{bB`!7W}})%=ti?XBwHFH5C$I$0toRB|fl`ESy2eb7ZZ+1}>6w5`)>6bp09#lYXS)cQwy+o|L?JH=&2*68iehLP224a)`Ql!ff? z27Mw~g(lzJjyr=2&teV-VpB{UUe@-K$Hh}?8IfZ38GA9YhrQtw>JL+-_~{xqBRz&s{4|MXV$hr+Ej@fq^`R zj_B7UvocNGSBR9m)75;C(#YmZ5ed}E{**!N5y}mXZzT$UUV3oNCK6fYfy7w=Le-av5%~r`ZMadNr zRnDw+dmmh%4r5RAIN18xHCxx=ugbm{TM8T?@>(MO;Hg9%gcmv3ODR zhQ(0qMAJAyhj<$skp)SP0@X}jk11=rU0v!}LOqa=^UwI~FCq-pk|Rsrs`*=QyWMot zCZ%>f38q360ORf%iphz4g{B(P_p)}>wP$E=8N4*C-|4}RRIZoQ#1`*F_l3C;l}4|x=x887+h1GnLfi5T~TjXlBZ3*IzeTJ8JEpY8vchD ze8w(M&RlXBXWX%u_yL%%dQMKuoVNihdB54V;70muhLaPydpRNX8{Pf~w(=`6hI#5g zQ7B9wF@^w`&Zbm7f*@l-^6x3Qofir|+2fwVKe-=zS#o7nL8|sdG$?D71R`?-sOL^n zK8X&9F8H1PJacp!AH9)0o3rt8S_7(=5F14n9n;>sP=z)qAGbB4dN;x9NVUA}JPqm` zE45c}U;!MN#Bx28vr(@=Y8wZCb(I1Y{+S!q+xd(WYdObekXKb^>)BeY+ef^yv-x!m z4`;n3-0u>EE#*MWRV8U?$j82riA;MhcW)IWn^ygUo$##ei)l)e%CWtsO7Ugn6wIk` ziXApy`|~JyleTl+E>CA)KdAZ6Hv>+kthh8`_fBtuaD|gG6tp^RL=6lwhodl~h!wJ_ z>Ck3)OI-QTPv2u{UTS>*Pef%9TS4&;kM(&VHuT^4z;iNX`2F|y@>{ZHvXdM(EXxrg zDSgL=`c7{j;OJyKKX;<{q!k&>_JI|=`KcNi!>UaB5brXOOvpcC{*UY*F6#A9uNe+uVhVw}1jaFARMND7;BJaR|30qQ$K*t@EGPEIW^|X*7}|{FDb4 z_1BHRPK#tV;;Ol?;G-M$P~L8k5fP#ZOWIgJ`>Iv2{>I3m(03I!%fi|a-<$uicvU=z z|F_LaU?S#w?GD_)80b-j`)&E>dkyl4HR~sSjm7YR2IqmH=J#n?48AS(AkCQvE!# zW_Ola%JuJ%yi94IEkP3P5-&g97rGLngphR^2hZR4hgBPf9~;}7cwziI$3)R!#+!dq zHpm!fYrg9J_FrwBDd09`m@Ko$v%t9gJY6kIxj3y!zlE>?;d)JOW?p{QWzuyq;I6ty z6>MHs+e`%;@af=P=LKpdT<9HnyHW_pDDz6TM&Tp+By{{F{RAdiGeBxT*3~?;R2`d+ zx~)FppOR`o(>;XIS-X{b-_KnpOt$e8v{aWJ)LTsFrt5HaG+6&2svV-T+-nwI3M!hG z!Rk^D$KUyRaIF)+m^TuQFu4>9@mT+zz|E6GD?b!~ zZr)D0UH|o>j#RU$F;TIA&_=-e&ci!8Z^y4*3<0O#S4o(@Pm=TE-nEbF@XAgh9LxVw z&?2PJbwlCD`i;1&CW8#sQg30QU8hOsN9CMXE)Rd@_`pzaVuNIgY>Rcf8^6P6|0j=8H@;%;L zZDR$4JZU#{)BX2@fWdb*Q;rcIr?MO{4Yr2tb=B} zQN#7$YDDDzI_IrsvQxwm&iJ->XXoR5b#1QC{4*L1>Pve!DkgqUO>RCF6iJ^@9Ru`? zRc~+TdWakk+SqirN}N9AB$Rp z?a_J>Y@q_chi{I4?N&9nJwRh4cEZp+*2d9uZ|=bW&V+je(?fzQl3h-0_Sa)3|8f( zEA}`$b9Z22m?JUyBK&?vp&!PD<|OE0D;@&wPWYSQCtioN7ivCV*0qRY)W466h#59h zSqa*?wf9cKE5%`{mI7u8t}<2T$34k;`VBk-A&Pm4IvZ))xDg1?wchnxN@IL1aiUW! zgRag{-`L-5oN=$IF(fgKIyR z)B}FjS^Y9tj;v0$Q3e?}IBngc7&I(dLi$iuDepZN?xK`Rr3SQ=yo&&{=*m(FPb1o; zt~`dxKk0jF!46~1@hV?m<&D~%Fkf{B&(B-&rDvRAh`Vq4z5ib`_x{a<-vPKGfzHKa|y zQ&LcF26jLkO{9Z2v$jnX!zD)4qg<2OK4@hF85l=b?GZOsT~)nhL>@cXU;b%8R9B`yT(D{$Hs%J`Z3&j|GOGr+0eJr0@Uc zNYuwpn%eZ*iK;sh%7%YenHi+~QMe8Kn6giV8?R)gQu+9m&_S)@vR%csBCCDO{tX^o zj;?2${Kb6JcPiq?!2m58(>y2aNe}l@0Jhuw^4B$~(ra*I1fL>+d_w1vjpXJXw%sb_ zFI?vJqFT}>d#*PJ%=I#8aBM0wp}Hp@KnRKt%!e5cJ;OddsQ(As#>>?Y8zOFA^Uayo zwG`$TNhD?0UPXp`V=l8%y} z_qIO>l8ruJo;!xa&DL&1@faD^b>_W_{@SL+2R_`BgYOq7Jsa!C$poIBq~_CS&kWoG1B*cgGDB-BE)zE3 z!No40X0+z~ESDDby-oHmBSW;1$$Pnax~=0wY5E+yR}}|W9DS;Hm=eU(Ty~|&o1IGB zr+Nqn!t*YzLnek4#TAq`J;0xG_=`()D(tAArY?o3IHZ;|sgK^AaaSpjLXh}*KP>A8 z@aUL)^T$&pt!m>0xZK2v*Sb#1j1lkB$Y7g@B=7A>K|0Sf3^BKE;Bu~{bM^h185xTT zMiE62K-x}5Holb3k*Dh3Quy8e_ULc0-b6Y_ z%g5$lMx1fb_iv&ihD91)&R{R-8!NWRY||GC{J{Vcej0qRF-ebNO=W|h;o-9`alzP2 z=T4f>qtm!=ZB+}wTrFk{=_!I>7NXO2dA1p zgPJ;K@IIs~i{Z?#)jyt4$_24sKpJV*KZlQNECTj`3>IAC$@C~RpPLdJ+niZ0eFL%u z`FbQfv(Ugs9KOGaFCmGW4{c@T1%B=G* zKF$0l#p;-#wk=jrh$YI#{St~1&nH8wKrbYxTGF%Og^@GgOC--O?=GYbO%cR)t7I-V z@@n%+Uqxj=Csb`QsC%YhKSlNJ=j4wgB=?rbWBO%z8qHf(f09YMPl}PpsZ$>FIId-a zAi(i3>3FdRt**;dOheH9>FA}1kHwPl^*31jiOI()0!pcEVLUn=!AA zz-kbun}yXEbH5v{jiw|MtQ@~t=J@6JQZMyKK5|E1lsES=qM|RDCat`FZQ#2ZDBka% z-`BvG2)a_#SizkITl>B6_t+9kw%3}9T1q@NimhM2#hl%vy0Bw~M4nAr^w$`H@FRb2 zBv=4(Snz6yXK;p%h=bZrOb}PhtksvU&IXlxC7+r6${?3EyK~2^RfvKrxrt=_g!9&n z{w)&;?cs;vw>^i2jP-sRdiLUK5pN z|0E8)7{snX_G&GzS%+!jrV+Rm&t?7)%H6UMfIuxGhFf5Yd!vHBJr>O-rSzb+!^!s% zf+hE_6xNYJ@m+Nqh;0*Ca+f0Y+?YtgM;$mjEcw&ucAZHA{i;OJ%E{)s6!Bke2ULvP z8*$lXJ53tMm?O@R?G)Y}rC9@&s$zPUV2!Gk2pXu?BdC_8uHD2Bd0`DakYEW0B~TyO8@`> literal 0 HcmV?d00001 diff --git a/assets/icon.png b/assets/icon.png new file mode 100644 index 0000000000000000000000000000000000000000..73a109e11d9621cef6de049ad70ffa8e7e4419c8 GIT binary patch literal 135267 zcmc$_2UL?w*FPG1?;u60fPe_0NRtu}6{RXllM)mu0s_)|0*IgpC|xN5MFo+rfV70( zi2_oj_fBXbfwUXWch0%zyX$?|f8BSz>)y4p!t>1R*|TSt-`+D5p5HPxU||$s1ONam zH*Z`u2LPzakJJEqO7fpwNaF~A0sy#qRqt+a&K6-48G#HFe!5Kv&x7X=W?KdhrKPol zx{}x`7w?2er+t*UTV!IPqT0dm2*DuX3%$g6>w;*3g;;^cb7<59+bg&3o}A;ckTJ~} zuhi$1x-}VVSj5A5CE_P3A6YiqA5pgxwqp}V*jlYC?;}QlkPaTB{a@bLD31jowUt-P zk0+bwud-9?oqpOQ=H^S4b^m(XjG}~!(np_ucIdeQ|3gFl#2_E=XKTDBB@N(@k<@xq z9MXXQp`~9)(xv!|Nf0$7;13S;(RJdt0DrL-`fsz=$}?T99i;kG81{1N!GAqh@*&{d z|A-lnqj3E%NF2N*pZ}L;Ky%Fhp*rUG{11AU|CvM0zoz?pX2L&b4qno5 z{7bQ*U@d!Tioe{{L6=wbU-{+0@KSllr zRFGps2Oc2&r$M5FC4FfBUd(?COHaGF*eK8ci3AP*M1tLJC&XXIkNh_x{WHw|0gV3^ z3xv(I7+(Il&>h<3PfTW%f4;?sQP@NOn(m*t`Lt{JjR)Yb9tXtZzfGI;Z`}6Z2=(7a z>*UNnTi2++#2=&l*C6_|>%eyPFEhnkQT=PG|4MQY27cP}Tp7OeGzp4-2mnM+n-nep%HoAzw+Hb zOSRTTTh~+9RDTh)Rv!|%$$V;$Ful`CZEt3m^_XyQU>tk;;_yfHw)YkrzeN1ykaLb4 zSqmzEv_0{glIw$f_kFKQ=2OT2hv~{_pA)lrRbnZ~<>P&=JozncatbP2%-;gdidoB$ zr#Ks2NRvRO$6lSwzs^ow8D;R>kPK_wOGz+c!2|MB9U0E!aWv~hq3B3E@_$F#T~f0 zsmPDQr&%ICnJFc5!9-V)%%+R>l#K}eLwtJ})fhV$_1@m;qT1sC#h|??feX&$UX;M; z``!FWASBYv6bc?SACKof_8*6w#tHOsDG(W)oeP($Q9zBXbCA5jU_W zcd%|n#p9?y(U5zMw0r^Q=@)*rc*TicE}|y4P-#^Si_tGw=#uE7#~C6;$|v02uw7OA@2hDIRSb)|73I{Ow^0Xl%AdXiIbLZ1)233N2@FB zK$cU9y#9#wJ;7HPuJ+9sLo&VV{9fx!jA*=v?uHq=H>*4+nYX|n3eguuNs*WH2PbAN z`ahDA4xM^F7j@+y#l!=lLT>6ky%q*CU-#1_tVmT1(hGOkA^9VC6x4eRe>5-`60ddwiR~DXh^5WQ-A@kZf$elO zWGjbX$boN^!2c{gykfvQgJ{g6M=>MW7j#Gyy%QvHx9)F$LFaYg=mD!)iT#> z-eO>HZ)j^fjr(}cha^m_=6zBS`s35+CVss}%~OAvIje3x!@HBg?ss91h$tp=2dYDU zSwW^x6KXuGISJPaB(-DU0cU1}!MGR@nq0U$@SiIA=(JLAr8LG|hU5CQxd+kjkFCZy2WL9Q z-DC%{p6d0sk3_?rSKntCFZP7dXqrU_>-n&dr4&>Toqm6?4g} z0LZbt&|K6xpg~Aj(75VzpbdGhNq}oL@5EKn*3GXPxZ|R!H zx$<4gb#{?2eUkB*Q=G+qU1aC)k@acW%#z*<*Q#Cu-(?QIfCr$y;UwdOSmi0t$CvEw zbP5k81WYyhN3M6RV@RFY-W@ambx`tg@rN8DGFg=M6h_P1CfOznabdf@&WA=IViWL; z+7keH;y3S_Q^ZmlwN+HEn4TaN4M0z@<18Bz1;fB*4QL&{=5-TiEgHt*K=y@OOa**c z`rw1+ICA8iq9^P8Pp^IV+r%-G#$6LV6N|2?e;ecIe!W2C(ahEg_Y5cw_`uEc^?jPQ{fQlEo3}AB~QAZ zrp7-vD^oDp>ft%BgooIoaZ!xx(le_ggJ(UU93QDqNbpFC+svL( zj!#|y!hU-k#M*MDC9XM4xn2&59eJbP6cqkov<~eK{BgxHB|P?{&*>@{m+WI# zTbK2BiIeSN4OPA8jX3XAp1(%(hTIKZ!AJv@xz&Tgt z7|nhf*O%pCuP|`FX%OeYJuNk0dA8qMFkTIg*`Yyf+oDT&*2YN4$dlN6-RM0naVp?l zub^UTX{z|JQ%z_EIYxkIfL+Q5Ie0K;D?4+{v~zfzbnnt9v)IYIePOa`x2YNh&o-~v zL@a5iP3Fo(siETN7vxTLlgU=yLrAQ8LgN8X@BV)LGbWQ)T-SCBBKP)}geeMe_S<)x zNwu)&Rvbt$#7z;g-Mu$&Po<9q*>0XmY|=83=8R}7;=m*&pof#$Yl3T3H5Ap#V#HHx?+|0H61R->lwuK{!H52 zmrn>%BphlYb<6b}tJRscLe5#bgP`!XZ>fN|7tSD$S^jeR03q!;NA1aWZ_z`V{LuZI`C>AgYL+a3Gne!%We#3_7 z6hmw+c3G-B0Km=)Ocg#?GtQi$@#4&OoDn;a(u>M)>Z}ec8e%^LhcwUC7diMBAJVGW zn1u$90{eySOm_B1uTm-Ro{hwQO15lKYZZqa%wlJ3T`uwt9P?PTG~ToHRVZHDi&Cw)hvQ%rVSEqQ%CBzgDE3KPZRNgn(&ION_%y5Q}kSDCA}gjEW8q+5WR=X;nH zL*qf-OL9R))(5%TfS)H>i4nqF7|Z(Fwkp+rQjh&i8FVRgCD~TOW|Af7jX@*Y74y!$}=VE{XHmk*na#xu)>l@}`&O z?l()*x_0mmUdtSoku-169~Jg?LS$Vh<#m5eG%fJnUAgZU_AbOFX(9E5W)I=Ga1f&m zXxE-YctxO|o`B*o;M%>xB<`ROzVScclt*sQlEe#-gns6l62Kt`MZz22`0+u`u-E6G zpsjEwm(8l+k3IJ%RcITB-?&1a>O(KD5#^o-KAU{GTHOQ1{7UC&e@u>-aIZ#MG(=?v zVmky+A3YpxD|oV(J`H7UxN3ww`{pY+8!#U|{eHYQJX{>%#j;za{=2t%JuWlkWx$ud z81ysM53N8^+N~X}4J!-E)51cGe7v#1wYYz~h!oHW>Bxdee@3V1CJ^W2FwS!sPZ#s4 zew41tT0UrKWI%&_1>2h)_k`ffL2||?<)m?MohF$thM4A^q+Cd6O;n2GOHtLf=T^w6 z+pZmQpZqB<47msOu{-%nR@wfv!1|l&`O}@#ks`ZLxTW0;4I1Jx14?|z+4qti<~?8Y z^?6C)^i%@R^?kL-tp<#NUnt#L5_asqncVi!HN|&uV)+iRO}nmMuJnn2yBetsw&xmH zhc)KZ^b9N?e%lF=;H(QHEOjJ}u+3LXQ@8^bs-wu}_|$$BIcc>BO*s5bh`D~kD^9rc z`BMQBxOmx@-l|JgxmQODSY2p}dUhfb`txxayj+pgIoq_m4nHanAG>E>PI0LTmACSC zDsca@BKFfzwh2etwhyu&;d#$7V!C3x2X{9GrS4QgX-W@JXVVQ=B||ATJecE%^zJ-~ zSLq1cg;hjb6eu-RiB5Ao!Rv>fy&q!xE2m|!Q->@*JpnRS} zHS8HV z6#L0O4vU?|Hjt{8i%F|RR!Gww;zdOtCdmphsv{YSUMOuZU_luwuiO4fPmzt-&j&Lj zcq4G-Dn}>@g3MibFdaq1zE4T2-YvH zojEQ|@6SQbo`glNloR`am&<*%>yLJSS7&;X@_?BK*X;dU@93#w(MIz6kN9GY%+@d7 zy-eiRxx)1+cSz5z<^i^#Vd2ZAX(5kT7>fH)Mk|^OMd7rksurwM#6iflXjB48xGIuo z9rirV6AkQ};}_NgR+8A>?LK8C9V&<+ZkRWO1e-0b6W1m89Ga_r(L?XXTyI@Z8kyx%KRVGAKDP$|U1BWpR1gzmoZ7BZzt`e$|fQxyjoqZKqw% zEt1=vS!?>R@Mo^tttjkk7(o`Y(lEM@f6M&Yc3##kqZeJ}zGy`!mbhIt{0{tOG;t;T zrK@sE=yV0jmJwCI$UQHtKhUaiwt{7lie2O^`CLkeoVA~xh`4N@?Idbf-5-8k6zu+i zdNg4-w##sD1NJG!xD z0m9`D<7^eD1coU|N2(0Bv~F21@>(`N`f8?ElXybsH2&Sx5t)N9aiPj9rq=mFJEsNM zi`wg6F$#ZZ=XFKgA^HT)i2}3Pd2XflFWH{EFWkodwOK1+)e?cR`NUx~I8Q_@^a?tZ zS@+c2@_DB9)DrVx{8nyT2|<%09;>+rN7pTmL#vb_tI7Cu7(rQ?h-i~x%3+Nt_gvjag=T@6?0#A;zbkVw zW;Cy^a)@xQmY<}9N#tYi_)VW<;}OzwFeJEUn$oiN^|5>2{qWRV76^Bxozt(?B&Z z?$I%%D;eJ(xEuR2d6cyL!hS#^@Yf>f>|(OE?L#Nwu_I5!^6zO=jKo(iaydx8fe-*J z#I!~M_kH_JJA2BI@q&K zlnA4y0pi$EciyclUh}+F=ko#Xt-4@l$+Y#BOTFrf?s>_%oe>G}fbx>4{)Hd~9t4`~ z+~niqc(%COLL!cT*Uy-U+a~b!ygbB!S4;RHAIt(9*EHhioTI7i~xJB$J;kmoJqpH0^uA=m=Jv?X+H*4MR za|-}UUNdvDMk{=FBF@Z`{2+Va&nk%JjA2UOh>|SEF!-V3-o3KKAJQsDD=%g@?v>8< zow<^6Ft?gqiFiwqbLPh{$}^wyxYTQIILCuP>025EgRK(PvBAfC~5%z}qo zZa`#bV6B+gg!f#24Asj3Hc|eGV`fjFsBoHQ_>WL;+*cwOh1y(O$?W zLR#FOz9AxGFfIb#y!uT^-MK)6!K3?H8nSfO#~+FpQz6G@kz?LOgGki|!Xf5Hr0!y1 zPA43u`wp-QVSEY-#UYZN3>|j_(imOOQyC@^XC4An$Qx;DX+V6?i~G0WjkX)`M?$%; zw{qo)6>WqXQ^fYJb~sOd_oPm)LQ_g4QoqcR`HRlLrdi0Em{sSyPP;Q2vO*z-w#O1c zgHgV#;bX~o<%c1qMJHl*-}!Li#3<120SFC@z`19vGI;AK3+!U9 zy9MsW&0O5)zH^rb+dQGMO_BW?4B0J>F?T>D(!KxHr!1+E&Hlrn%tlNhl_HQ}@(@9n z!4dM-Uz$(KcG>!-uAN|^b-)wv z=qbEir*EFwlaX%`d1T7l?_JulI}OLUraH`AYIu0=m3L^(w%Iuvt~DykDcqrq zvx^BdrSE^J%cjfkLrsSNFgjieE)-=+|H}S)F}ZGnGuxCz%MHO{JFD-4kF*esXwXxB zWkd-G-38&Yn;I@VGN!T1gY}?}n;^@F?z4C0MyGU2<>fXXHzv7ddf2r=0L|8`YB|>g z%OX&yljW5maMSGI6=Z*%Fv@uxVbl?8-3hunoQ&18! zS#>i&a#7Vtk;JFO=6@I_-c;I#&m_aOZ!dsr1xuT0|70a`nQr3A@A6n73CS>!=@G`T=CTCnMNnO)m8o`I(}W{7=^O1?!3 z;3eG_OFJJ9M%i|$7Fwt?nve-35ER1)x}fsberz&+j`VqjWY6JAACnTojr`L0hKR%v z+Ca5uHo{Agk8_Em$tXPI$9IaMc@lUqu_Ij|gn#C%tLdEoi6#kwEQO`=c$ui4T+#-J z?d4gM5@e!(-54Ff$DOAh4P+I18+1artB5LbrONABm~Hw)!Q!V1rh5lo*dJDU(t^5z-fn|NRMZvN%y_3wE%&HE8qDPbze z2RW(LtyeB1A5COs?t*rc@r@7nZA5--w5{4o&pdwoYSQenU)%#6ir4}pZ~S6sFWIU# z-mbDOvNHc9Sy3H7Y#^3|{-n;6|14M`Y7q||P&;0N4lu7pJ$T&rN$;L+iK2HTI3-N@ zh0y?>?_$=R6c?q>1h^)Lg)cj-R$YSM2knW#$_Y`bb_B`Ll8eR4{iHN-FQ6B2mFo;#gP4ro=oABBTK3dA2e;xY4D7KHi{audtvPx%>8d$(& z`k+GN6F;d%gmgq2OqNdt@N{&co4*NL%L+B`0fr63Y&QJI+a_&uB znK$8wz6rNdaui3a(W(IUcE~pgjSO&b*KMm8XAg*zmruMW_K^l5@XM4!^8~8(StNGz z)wMTszn9>WV@c**a^?`i7L-LSKynvNlX$U95+51mTPWp zl6_+JoOoeuHWJ?mw1RJokV+s#Nc9SRT7`;S1sp5?=1iP*dz!qQbuq}$dW>rH$BS2Y z6ctRFpq#I4YdjsVF>ohPe`bhs+=ApW^F2Dz@53$=dZ0-`;9$c!h#9ebVeuZ7lAtMWA!C|Kp#JoI9B6 zb^`uJMI8EoP-IWej}e`|KD*sPv9V%yVzxiB--bg^|XQ<#IVfyr_i>vvpVNtZAo! zEG3rhdPOo(C!xVwQ;8JM!iDY3au_|GpYJ+j8}N>^58Hmo?(Xl;wK4a$uXc)0E_`aC zTR3^# z|8>s0_VHmC)Whe3N3CbM?c7RG2bU9}g+tBbU6?|ci{I-`#xZc^+N!2s#5f1W(d2$O zXyEeEbQY*43q6+SY5BxXhqzmDNkn@@_TCSb8dV#|WGSGiVvbQ3A0m_@>&)8TVL491 z4`9|bUkm{m-!VQIW9tNrt060fFag-?AXwBWNTm4mQK`OtHZ+DtpI1L>~D5 z*_q31?e+>p6WUr}hIS3|a=&oNl4l}ngguhH6HqyJ8d()@1U)&CDVS}+MiuDwToS0> zU$~}c(#n^ooW;6|J;L{NKv2oV>uhyr`Wy>8xGg!s$lpu7-h?iqc%OTJ$FeF65`b|> z<=(?2nUxww?;DE4`Z^#O7;a^N85|dJo4X@Y2S(a~;LCp_KixO_Oy91-`4$}9G z-G)DQOSoNVuwSk0L<(1Rj2N1GF#&y`v~<0iqFhVNN2R8DIr&mJ7mU-6YWMZ77$0fx zqF2C*RY>v|utzwW(rlmc-aQ_ zib?cJIjso3BwO|5GVU5u^?Vg4!^6w=FzvcXkH@BSa8exc?Y&H(8oo2Aj9?!$3{%18 zUWNDxI|f?{A8(V|fp|@l=O~~cxGa~a*!|qSk6oTOH+W~?ult@1nJo7Giqs>-dR7m* z+(~{$s#dvOeTbQ$`pz^=S#u9jic*!TP$%7Fj)?iJV=>RfjPHO4zX7RxS({57sEwwu?1$n!pK`eJr|hm#wC5 zLF;l;9eEbwn9>a-MV*JzXf8xGU#ydfG8!81Gu6{peK=2K{i!0|1NeYFJNazp2JM_{ zy%jApM;T%UzyJLiHmEv;gM10dn;#U1(LVv}h>Y1nlTXZMp(j=ptYJ6_?N{3;Z%#f* zFo9rlGvE~B!xfRDM%LLoHx)9h?L&h%Elp>VgdC_zN1*rDmw%fT1P6DOmNfBZ03b*a z;^qOJ)dOp}vd68n`XL=CQv6XrRnF?qGtWoBYrcE4C*X+Ti$-DRCL-5@w@GZIZm{2F zxgE8bm_%(6sv>2x&|cES6Oa1Bx^k|;gy(lU9ZP+Bj{-`bmIpGn8g=DFe^w7#SX5ZE zPkfUCt&kS5Ju*f?ty5jFwp?Ffp zQpJy&$IhtwNySdVI42?59Bv){gREDMEe}~k_m6eo+*XH8E>Pz(+%WafUL~gt*^!3` zqD3n*izWV!I(sns+{~yo>#MoDKT%maC;^tfkERy7b}aRPX`yvUlLU+q7}o2$QC5)- zvkE-yN|*qMc;_bX5_zOx-8d#mXdy^L+`?ZW4Jj%kaerPi)i?5dZ@i)HJJ8U#kx_Py zdg^W5t#@s0cRjy;=axmp(e19j)vDM5G}#o=vUn(T4zS8Y&;-z6?LLanR-f=vQq9F~j_b94Ks5|b8`_Twhdt?rz zqx>Dy57!k!`RgH-a=#GMNmjnw7^dfzXMmSALSbSxVXg=_lw|&GP!1VceJd z0TCVds$m?2B7l>*6ZFt6EuLM+*{NTTes2*XG4|V3@>La`wZ)xzRJ{d0nN$o0Pzv$; z`7Tl@`aDmr)pp_i&Ae6GG6&k-id%ebolUpy4Gw*&PbGT6 zp5`yY)VDTkfMFa%LQ1sm#=r?C;XsIn`JkBZWd3#GO!j%$n``hF>`qxWhkd+X9t>Jd zS-8h>>fX6@wN9))bgi$@LaVzN(bS?z(`kihm=2$btc`6QTBsKplri|lG$8nN_X;KrB#C9h+Xv zZIX7GP9T9ERr_gR(lzDkMQWB;a~yQ7^kjVeP0t=tGGTAm;lAuxvMfV=A_8Mr=1sY+~WaZ#{{a_%^7@i;0$& zt|0KkSriVROKn=FM+o&kCdh?e53R_X9)7{R%L@_W2Vi_S#-*vstSGZyj4f?)%%YQn zk#?O%0(;W5@c>3BTMy3r40>DXJ1PQ*RK8y(36Vq@xZA$waX!*8esC;~Hkg_9PHcpe z-cwL@z>_e@mxTGtE09;(x+uy;wKG$*PObE^XW}cj_U_tPMS3MZm^IE#8{R;&xrB<-y4N_Z;6*dzv~r;>)N* z_0Xk3lO1_d6E0s3#)3q@wZ5WhfAVctn(9lPWfE)fN9Hw+tkQLn?}J4izSc|HF^N-vsUoLP{>=nXR_lq7^16A4{0cQ$nQ ztmK7P31K%$ZWSmA;LBda`w7tkhEApCrkmMLPRTJe8a3~ENt}!$w%iRBh&SXUTv13ufn`LP zE7L*xy$xr6=zx>so7;-SA0Ql44?+9!M;TWd?j0gF-p&dc#=L@gmT*58dQH8l$ia}$ zs*>5UM$55Lsg4M8eXQ$s)MllKL#T#qY(L+!Ra$&Pd7z@J=wmggBJ-rpJw$5R*ey?w;50)$mIUY?0#Us17BW zCX~4ygCmPFt8B80Ya-nf#m6T~*dYx=#I?#cLd!GT_c;%-p>0eejN9S4=1UZ@)k+i%7^*VHOVy!FT@e3saB;ZaTX zSEW?1UxHHvNmVp{U07$xFzk{e5###ARQK)UuY^o4O5e&y&&p{E=wRsVle%Aa9fem@BZ&%EjNcFBm6WTFzMv5y7&;zTv6*~Nv_+&OlXiyif zJb91*O~_z^9bqlKQyZ?F(#H)M!0jP_dwh6Dl%3JBxx#Z#wN5^kC3mjNQH?-6C$+!A`4*A!Fy zym3UN#s4{UnlnU0!ma;DULq8V_uuS_10wkE@d|Oho@b`a!{=X(H>@bMDrHy2BbKl zpQc))Jai}`rT-K{cK*_U*t~;_zcDFaCNz=+ykRd+r1mfQ9VQnxIv&685qUg+#1#z3 z9y2$BXi{Oah44vJm4g^9Kpg4r<@YSXJNIK%s$NRQD2FHNFS6Ea<0nAa%~d_E@!*JU zncz_E{R1CD9BCY4_n|=wovSV~OeLP_eSPQL5(2$AcK;19PfjYnmpK!B1S8%qZkNVB zi!(r$4Dsa<2iCnt`i}jHxsXHemh0w@)wEVQPhzYOxD9Qilkz|nP-h?N&oJLH(Za!Z zEEmt3&3_7GeI%%H&=CNS_I~KCJ~JSK@`C5DZ-;0v1CTBy+eygjUhMWX~SHZ69eS3?2O1!!&VM>Ymr%G_bO(z z9o@e~QOsC<#pk*fmvB^}dl(X(atZ85IV2v|paF+9eV9f08hh{J_NKM6JA|w1`AA`} z&X`S}TiYU@r1Z4l;VS}5T$J0T)4;WY0s6I?D`k@>Kb`1YsltaZr0VWRA51`pe_xot zBvv7KhV~ohm3Bi|qI_{@d48#;K|k*v@G}c_!+y1m5|X+pMn^;%Fate-UqXS>e#ts` zV7!(y-}eYUzz3M-wcuPwK=xBN30xmkGl0CZiV6k9&h=ajQ~JyR&R_^a8|ED*d>qkt zMuB*rccftI*}2C)to9m+u(|s$NO!3i?h8Im(bQW_%9PRy9(lg*rr`CEyoG%60UYo6 z>4HYA9$)-$rd=?UKj12&P^QDK+k_~_476G;Dj znye;KEgzfL6mBIMoy{L9`u&i`>$&l2x5vt~4ow`>EBU*+P=iv`F05Cos-@Il21wqj zqYdyKM@j?^0cE)nz#GCpsHjgmb+_$i4w$+D(sOG^T+X`Yl$O&?IoD_l8BM^1LhUWV zJ9#%Bf+beCKMg7hUE6yhr{hpY(kD%l!sc4c=@+lIFPTVLgLM+TRV0Ln-5hzf(JYJw4@n>D6}B(; zi0Jqde}d33VgejBc1=>DbM{VAkv}%4MlTH#Zs2**!vysR?XTJawP^ zPF;gXz-7`XGUfP1ktduCn2lL$VTBaD^Gs`r_d6Q3LqzANuNt)4F`ctF&b|b99W81A zSc7UMx9(Dk2<1=&XO2L?Lz;ed2ij1xFFrw1u_bj=3aKhTWr7)qi7%Rr&5O>w@aQDqAPi8Z60twhFx?{v*Qa^ZZ`RD@9a7>);i&rBmH(xH+^x$M>YOCcI@F<>VjR@*RuS?|vfWKF}5W z`JHzyUiVO6nCnv}y4ZA2|2FlLp)!LS`+*PiFFBqHa$DFOtf;KDlxWn|nawR`fFEZl z>4>ScdnTzazA(RT;b_(AOa&*I;TK}$ToR9s`3wfO+1!p2StNvauvUs%X&UuFr)@!!In06vrF&@%4YTPLGD+c zUw^O7==*L#adJ1UelGCxi+X?Ri?8gM3~7_5Dx{|6pX2=?on!n75OM{uY26glK3rU9 zGlu((M__ja)$Y<)v-z7{|6DtHkD0yy+#{N_t~5|zFzR^jDZ+sK|6X1<3Eq7;*v*q# ze#jnPSFb{Uf@fg47vB&5sKCA>O3(~}EHreJa}mV%_Bl3F-q$Cq`~a}Khao^cL%D)I zMmDY+honKV2>{CTdvByt>9I}(NGhh7mjQkVF^;cQvz|Sk^vq%Y<>?7v*D-(auKm@gZI83}#q2Ki5qMZ`rlb}~GKy=#y7p#vJ9vQoF zI3VPK1@tYQRetHMsQxTK$-bj{U0}&eyZU5kg*UOM;^;lyD;OIa7|PZc3eIL+D<>AN zMBW@gzT*n{u@;Q`ghEmo<~PO2MiIAC9;Q;*yU$TBRD@bX4uxXdEpFnYL(eqSuuuGO z5nu8F_m%vcm;9fxtW#;!ZB%C|me5FK8l9CJ zmtaB=$ELaRW1SJ$I0jKr0npXikN#DN;R_~82lb5Q(F zrgO@j5Mk7;_deTLZUWtgw_*c{&75?dGPJ0~nD~({?I&uEz^>UC@=`nVCYW~|=6O-I zGW^xKf~QP@S?i(jOA{g=FKusTKVS!4xiMUCX9_vQ;J1GTi<|xk?&+@U;xVVW|H{v$ z?;~)M^Q5KNV%7FJH`r^e?P1dPQ?aWG4#EMEWmkb(_>{)n75^Ok0_TBU?vZO#=IyW* z&Zf>$%b*w!lNUw6zQjSd-K=j1yD#a^{0_fNcs@%?7a^p=bAmw|QGLsY*V=W1C@3ET z4D;c;%f)KROQiR)zqT+}s)4K5XxHw|<(UT&Ido>5gU98*R!7cHNK=jAz?3lxYowa2 zx4P2Kx{X=Rx_RvJvGwPuQaBMIT9XcH8uZ%*KdW2(dkrwVQF8KO)4yZHQyh0|KF7F^ zS-5>HmAibU#v3pe)gIPLV1$l+BqA3HRw=|p^)a1;=j%R_(*>o8n zG9VoSfz`TK3KRiZU;P4)#*ePZ_h#F|uHV-C;4536%obyc0Lq7Z2vm5Ttu`VZ!jDM! zPmtAf8>-IG9JuBkdU>j$misdbt%r9d8QPyW53eC`vE%2E>++X-Uu9?CT0M!N`rNmS zzb0@{bu(>)+KSRLKBA*sgkmUMbLc6+Q|dF0l*P<`{L>lA8JSKY&FrsVAeAi$)i#a* z5ApEl2jt{%7`kl7NLhB#`K+VP0MoJ=F*t{u$`y zCgK8=GY^WHf_~l7)>C``b|p3V?9_Weu+<3Z@(e_19rlUG7^v@Wi>lXZ9L@I32pV9r z;wK51@Nac4+lzOJSKn+`v%kvuas(8Dy?SA$r?xY-2vl+KrU%qbY2w_8OT7k8I*InY z|7`h%7t78Okzvt5j=JSRap(5=DjI=jNB)rCSLxb9;BQyBx8N0ZPXsxXN!3jPPFhqn zTkTZ%?g51t$&Y9=62K=b$-!ft(+3YlnW<0s7?qFMHyMA9edKCmzFn9B{>W-#1f2Ip znuh4Nf5*$}M>hM)py-b~FUG14eGhsg-7og?tHJNKwl@6-q_;^46uJDbWG@(oiD#rY zy`}Wr8?N1;lZ3jOkl|AQ{cfM>v5wf>FyK7ZoU6ymgQc-w7nJ#TN6st0V}4~`_7Lju zHAKm6=7~_nw~$&oTc`3gfTf90CBfwnB=+e^{T6UpZ+rN?77E%F z#hDA=O*?RGS$MIsuYFQ{>p{05m;psUNWAj(Ujyj3slwfS-#q}w&u0vU zkc3pTaH|Bl#%TLYC1}D*>YZE0+lQ4pmcQE`HC6Vw_wp%u&ad~239U0G(dP+p$2~nO zgU0Q?JKE-kCcQ5wgC&T~;#h8m3JSMK~Srn&v<+Rf)C_djtB z3Y+`n-cZkH2`q~KF8nIl)gxnZN-D88CnMUO=FG|QQm)e6z}~Sdz#;nt+=m0F9hM*7 zE!h(p+%^=(?_BEG4*pmOe;{SG8`)^_YWfC3{K?okSwVu_wlU$rQfJpAzCO9FVpLbY z5XLoAett~&hH(}@?w5DJ$P6W^I^Ej-{ePE^~3U~{z4Y;^#a1gZZz}hvngjmW8~>^cA7NuCd%k&f@peRfUlgS-o$_fw9a&`J^3_;$wKz4iDuU%H|GioF0C zMmYz}82C2joY2!@O2QK@3F~%qbb;HugJkKHLG6u`q8r`A(XsB+DbyvQj$fY}t7`>c zaF4g&6s!r>a7M&+u97c5<4$j=QBrG2Ndni-&c#pzUw1{@*YpRPRzC=QuJr*zC}0t! zCn6C~*Sy2*y2sT0Tl5Y@eDVe=H=XBgejwUrl~9F|&S7u?o^_G9Fa%bLBo!CVD(4yv z(GuA$_$sbUKMR$?@6LBAwn*g20*c`JWq7W45Y?#imtm zzHqUb_RgC+M^{}Q)X4BsP+vV}jG$JzA?AJTbh`nIRSfL|-U0HyFfdWd!e%S-soi;z zo)hBW%1O8RUZkDB{lG=L=rn50|HMcFzV_4nj;dN%?$hci1DzTL`#>q{54* zM<&_KKW-%ATYy{!R1|AW(+x#4L)WFLkIpgkXh+vM9Hi$Ut+R1(0{M~h`@|phj z$8lW5lv-$LOQ{4$^#njXspA4i7SoUKLXre~X8Kv)%t$qS-->?j2BvO$cQzeSrIl|^ zY4qw-tT*WEz{BCE0M3sRjPe};sTA8ZY&}p(wg@$I8HF^8UosS&ogdRJkC^t81!`X@ z_2dT9wW_|n9Wq%YNfG&p&W$8&UWx2*i?H8+AwfTFv?Kq+Wxiy8^>U$(F5>!YnS&WA zs{G8zGtyKJEFunosTY{?l<}OUjRA()>6^o_7F^J)$c9_Clz~eF#QLp>y_?@h=aCH) z{TJ3jjwrRfD(C$!sA(-m<3!3(ZqHvy(VW!V2lwAIm_a>in{fQdVCY1;aq@E<6_Q~R zbtS59eR4*tA3+_MEvqP3`VtK`rQ#FmPSBmI49;Q=dN%IWD}3%KC#T8Xs$a_X{Q&o^ z!2p(Hp5H0TBeTtYD(}(i2lhx238NkG`Dv*4f;q;hS8){2R_0YH@ZejXDesu->B+ zDOh;^!hSW^TG>*Bl|pjeHA-oYXE%xl;gOBE0-@9Uw>}UxgGmQBNcSwo^159%E?P9} z$Hf!xEe)&7wmAkf{$BucK#jle@8tbTSAd`>(=AQ@fkxx@nn<=ak;19R*n7S)y7z#1 zNGAUfk;b>l`?Um8;+BQww>kMd*mRcI4=M(_Q zzuts%L-Cfe@3OdD$dk4u&{PREgpUZ@aJD95o$sc5Xvpr+p&fX7H z84zwu%-3vBKBe&!JEs_w|9K_YUsclZvVo>tmLsuNUh_}=AODNr_xJuPC6nPnO?Rk; zn4YZDz+!+1V2zAyk^^ZClTHuK%TC>WWFH+^t=pgM>|R)DC;pvyyAl|G${znJH&r~? zMxTwi_pM0F2?3+~U)rbeG?52J+Sg=&o**X7zU>NxTZlsC1sM=d2^gG(#9eAo0_`dM zvT`FC=Etx~!c(Umsvsw{^+Bbtau@9{1G$yqfFvmOKqUsG8~4ju45-pwCG$5?0!3$g z9FzesipTpj_Dh7j6JEVJBfe#dd-(bWgD>JaM*4f_TSQvW`r5+^814NZd!UCYQ!y`yD>}ORQ}VB(2w5(eF~e`lAfU^3ozu5^9kchmJ2LyCk->W%|eJSR#PQp+EA2 zzvhqqfkE++)aUpFeN3`6@uH~U9t;wrT3#7O{kq~RYOU6IadVCIj_w9yr zS{Dow7+G&(^KhkE;5w<+s7f<`b{uLa!j@cL8Mj`D3>`v)Azw1m7X0e7Ap(fqH4eN; zCm(CG0d}!0H#;rZLb?SPOLc+GCM4IOP`@j4{aSlY9wI*&^5Tr&h&-G;l^B1T(dyJB zEh)&(3m^|hRnRlJB-e}NsWGKc0FlcAn~sGt4tUUFN5q>D2>*<#xcwz1V-=XbAZY19 zc%_yT-ov#xwk3PpVC@eLPGdpo*rl5|e8eirG^qVYjvRNbbo#quo|7!NvK1`2)7=*R=uY3e>qWxDpB5*Nr`W9zg!+tBY;lPdy5(zYgjN z`84DyS=3^igf8n2^uRJx4o}hiFA3vMb%t8ruAPY1m^TO)Dc1hZrZ!Xp>oNel-iz}x zR|2T%Q4C}}=*a{aeuYA8XakL6Hd>{GRw%)WFgPR$j*EdQLATDZbP&Qr7x(gSeR3Lr zGT>d}@zc|NkAHVQw(h^I$^Q`V-$(lGcm8rV!p{n$Byd*~{XJz;-U>W5rL@;Us&koh{Oz?r6kt69h$P*@5c#fDeArfm3#(bXVU0Di~ z&AJ`^jJg>U8z%&;syo?^-G}{8SBLxB(@^QY(^2~+Y+SN&S&n!!7a+5xce*XUEW(_h zq^7$7f)xWe0boi%rzf7Co*Jia^t!L#?e=Q?^`ysziSbyrfIWgv=eF)3 zIleDV)ntGy^OapgMY`xul>to)^;rX0IgnNfw_NnEQBN83>q!Yf(~to8K|`ev%>Y&@ zTcGJszOD^0*k+hb7o##ESZ9*1w|~+N@t8U+1_~t*X*&45VN0mb7b~JopbYqEc>I)H zKcsam^jh$m3Clk-tN$L8zuV4@`ghB+5_XBHU6CYXT#5Gw@(%(j$PawMepv@;EI{EwYRpaS zPqI7Ir`eE|Cg;`ww!rjk!Oq)%kZ*>_@HJr`AP>oh`^Vfr6rV}W*ZszL%fAi?5@!YcxBubEsiD6g>Lg_V zdyHjArSKM^*_=+NAN%wFyG{{d|GWcgI!2cII$v4Lzk5B@m`auu%V)5_l~cKn?KT1;A?({hai% z(C1e(`CrZZbI4$7%dzYXnO|W`rIastHPIidDF>L8Rq0z?8vFf^9lSr#TwutS+(S+M zopA#XccOF!^$#+@O#bTJACh@k;r$ksT2XPMPnr1seJC8|3#BnCqXzIj$0GOE6zV9z{9!mJbN!- zs+sz?pDOcW4p*&g^{v6yJw5^zT$MRqIq$yi30QNAw@_ff#c`3f&4!I{Q5yT(Rd3Q7 zz{^e>Q9L_9h^tc(Wm>(_+SE|DD`zIzoZ)@WYSOLO`U^L#5HX&iNB2H8f`GBg3^O%)C2p)!1&bK zoIs@nCayt8jPWlo12`4%_5$DyDgKDVS@}%7|2$7ixEsR8U}6l0)R{$<7~Nx9LPkRn7gb^`5oQltBk z`d_k-5N^@m-bGIj@IwR4wZC)?QVozif!eQ!LIy;?pezIWH#L(1@YBu~J0}^SKbHjs zwquYjAnx-bD-!~x62Nb@V5=wwqI7SCs`U($EYsLS(+99m)gH5pa%ir2Szf4FFp32o$w>yOSqV&)u7{&rhz>_@1-@G52Y z4;A%CpCu=7%9S;SG+W_(9ZCP7l=^5ba>8CFk-1co!)E-GI^XK}@p4{9tbd|qx$U0_ z4Md5p`weJh{b97($C&k}UeFc6Xjg_qP2Foj9$frGbPG_WBRD*}1ByHseK3xq_zcr$ z?eCEZI_&5gKOYNuTDcxtS_(gCIsXhhY-xmLDU?aSh(Q)wiQ~P#h}GV}ip11EMyv8n zJx`pYf;UQ-gbF-z*@$zYx!v%8RxyAJYE2BJX#trB5Uq)hKdM}uZx0g!dt?CIGn0B3 z9M-M$=)bJW05}IM1_?5tPwrh#UwS^yqL*YH!f9nfV3!gYrv*UPXvp~O_*{W$xcZBl zYJ*AS#r?_S{l&`%iojze)f54KO&elhYg*t6B~b29TKWa8$pB6WygxjCEV@7Wi1s|T z{oI?G{3j&ocBJ2*Sz-L^bbpiUUqST8V$6|Lj6c!M-K2k;_iGGt$WHQ!5BwQeye535 zqkmfLD;WviKF;!C15n@WQ~nTcWC83!%QyU%7Y3OCH~K)@fA;;3G`J1Ws06J1H8WUs ziGcY?02gpD3nt%+^vBSK|LJe}ub0=&Yz!l%8@*xIk@08?ACJIVZ+{pIF=rxY9_KHM z)YEag8G6k!m+bz^x?NFEt`C2t(*ul@kEaS?lvOi`SwWgI^hUZ_ z{6Jqcw8atlkg31OnIva=mX|#NtG$PsQ8${N?@VZN~o*deyRz9;if(F^yI{UlmY25U^&=MHuu*(I%^rw7Jj=7=$XN#0JcWp z>D;FvPRr8gbMy;J69QOyqY{u6!<88D2etKv&m{N@bt}%4cjBUg8mp{f_UJUlQi{ZD zy`WMWiOp|_fq`wOX@R{;KpXZUzn~3!eEG}^$N(yVkGBiZRo~#|!#C#rBWK+v%Ed_h zBD}w5TCu;_$@mAIkOB@xv-;LYxqeD9sJZRBeEZ?OPC9F#4jCo03+Fug7RnVwXfJxXA}vVmtggQ@L| zB5w`nW<-@CP81RAdmYBCj3jwF-Ithb`ZHE@LEGgzd|lYFta$!}t_PM*$OjOzfdV8| zSpRV`k+CHMOtL{cbGF%n$ZfC`10A(G7N0JE8&9gO^A^6^XO5pcBt8eF~!eB`bnO z8q6mIa?!ihe^m@b$(>?__!8=#}M9QUgkSxz%%(fmB0rU0O#jE|MI+le=Mazn5{>^{?zZ6$3WB(S952;{Y zmW)q?P(X33usGzOk>%%m`L6w=D{?)P_zrEMvsOG(c_(dVQuvgAgE^Kbu! z|LV7YzfbjeeVD?OElRce{F21lmj|rM00{surhDegYe`MZmnjTZ-1Q|{Ed=o77e3@l zKp1gvMt*cxTRz`-^wxwxn?IQQ1+@!b8WrD?0o^mF8|g&`EPhQ{2K0`^WB{lLl>xc{ z;A#0Pbtypi3+hz6Tp{2G5rB8lX+IUimy_ttxc^e37Aic&z*)%LS9!Z9qFj1xX z(Z=C-_q8|45K9JSfG*dy78gn6mt`41ZvowRrES|UM}~Ex-koRMg~x6GQ3=RuU}5^g zk2fa-9-?0mcm#nAXv-76JnWSLdSsY5>vxYD)B~EhObp0MV3h%C^j`umd!FhsXSS6P z%nB&2HzgpA5!MM{Ee>L!*I8Vf5$L$7g1n`}Lsd)EBd;{Kpg!;b; z?~gaN)2m4T5OO1{>5bOs1lHoOAKy-8Qf@1xe;@CMD1y6-GU7wtJ|UWt`aj4bUP*ih z_19IuK|TQQ_pIS6W6fsZ{U8<6&lXSzaxJn{s#f&Q;Z0u2NZ>>Z*njwAXyg`GM)|e+ z@L7GHvqoihKqcgE*Dqy8+Mg%s1T>VTfvb;X=Vc4VXzxd-q`;pOE5XsUm{Z5U>)y;a ze+r@6t5&@Y3PSvL%$v%?*{6XSanBg&SghF$bv5f;AkU_S%Fa;=X4aW!;^Nr>b*Jxw zB1c+8U_nOUd?AO2X@QoFfaHuXq4_+kd{+YFI)QHT@1}j7-@;`Bg9X>1Ug$V2AQZL~ z1Bt?dB*?6^xD;ZDO%a<@ArcPFA&lCfm@zo-)dSNr(NGLbrUlSJD9i~Qm=Fjro1T5{ z@_^kk;D!?dhI^I-k2mDzw~J{djRT3Skp7jJo@4SK=I@FjujaTrdH*V#huC}*8^~Lg z|IGmN@Xs;oPs?FQ1n5I9%(0-%81I}0*qvQ5I@|Bq@O4UlFi4C*9t;Wq?BeB)YClVzpF zV-!)MsMG7)%7nzWQ1xPia<+0GzZcMRQJ(n66}y>qeatXM-#O31tP4RtCpL9bN$+ToD8MK2GcHI6`Sl7Pw~f zMKJgt%L#!bA%^?$6(@RWj|`aip4a0%CyJk58yuJc*f%1*8Qs?>HXgZ}_g5q9&_n;g06cCP32RmohFRm=}6+HdQp89JZSf2l}DWB zY9#4zpxixzn^1qB5QuWZCLh}GCPp3(@P13gO2++&0&BDAOmBg4N}F8jk{QC*-_bFs_vWic7Y`uKGkde3+=0pi}uB}J-!vCbyZJYnbI2Uw9WS0Fv_#Yal4>BMg9S~L$ zfZ_j3yI@lVdJ}g8HJzdv(b|45Gic+(LfF_YJ{D(r*`?%bPIj|81@siT5ji9J#(SYAd?|LLD) zi*b7dFD0-%T$jp<&~qK?PTA~@EdPd9V!0wsssYD zmNRirPu+i}@WzpRbm6hM_3H}YW&2s*R_Lja0n0w2hh@Oic!U_7X0|9GpLmdOQ?*O) z3EPt3UL8#|*c#$W3D|WX#gZ5RVw#N(?(GLZ6NC5N5;Rb3px(MNkFPFT{L!qTg#*t< z(jOmLIo)h#>4#i;mP;i79nJwIustE5HS(e|U`q*LU+_*T_A`XUE69eo5CG2;RXdAv zCDikI{~ijv?&|Y0yubexi`neiNaAy_dC2VnaIK%G^FE#$?t_>^ptm2fa#imtErH9RCWG{Cq>Sn4uYV^IU{NodF{%rYF^0fMv_#z31YT<4N?u%0 zbVGSafetr^ZmPOB^ifei`*$>UQ&u*8-JxgF56_i%0)2>yqKMq+Iv{)FyiLGtHb5Nr z!%eF@$)4$*xY$?b3P1*EYf;A+)ApVFcmCU})eQgUK4V@%z-=WqbI$S2JNxS0{#UoK zBe93gce)ICXr_7<6`kYD`h?5V<;e&?Z0p%$adpvx_mc!nJe=AQ0g?|mC%8Q#g(quv zFLDM!Z{fZ#kZXif^D64)-Eyc^u16EJzh!l>T!(3auuxdVHk`2yHZLHhJv^{wZ!nR$ z#=GJ1#6jl@Azw*mjxjSaaIFU-)%U+cW7g-gYhnz!ssysJKfXJJu@kRD5e2OkWdJIH z8LOYlfFaHmvdR0W0hIlZ z4;IRydf!o~OkZa=*Pj#p@KpIoDGX}Hze@V?y6;L=5ouo;u(!*L<-txUJjC1J-OF zinin&&FfKD%?|A%tjE=qp44d{J=m)${c~mL75*n-fV0Y|8N`R~`54A86Cx6SF!VLk ztX=Ta0Nme92`MB4_P=mA?tbk2Hpe~(IyAkdGZ~sJFc*B;NvIvHrT#wRBjj%Sy-RDa*UlHSBf*+DP#F+*2(^{Mu)ok3 z*;mLW1-chcUJcxTn<{8!^QFD3_(|EM1neBTWJM-0d=fz2{FLJ@LPUM0+GyreTp}0FfxQFx?`K;*vluta5=&wFCFqNSIQ`xSNe&;32bhz+TWa&LxC)8?G z_Qkl*rv4AMvCv5UA(k-FU@L=Nz9^?jiMo2QSMw~$Gca?ZYV%M|ne zj~hM7J$uj^3q&3=Bu59Rtq}}_#n<2YbdXvajXYIU2Ac5Y5}5FpUr&P!X!iQfM|xU# z2!vOnE*6)-=hNx8f8T%O|M1iQl^l|##9c(oq6AK9BY)Avdg3qqPaI%;yUgyb4if_E zf+Guedu+=ZTeIeO(yv>bULMY)40!4$_$?WrEKhb%C8LV+}PCny6W^5cw4c?RI&Lz#(sa+oyu|~s4jve81w)x zA%KvD7=WUfDuH^PK-hC>J|We!sB%Xm0_av3U`wt ziliT&wJYjXua||j*p=ptVkn@cN~LprnDFp{p^*hIL^XW25{%8si&rzHhX^?3%HAVs zb($7gXb3H)*r1{pNc09yCw`Sq{NMou*YVI_7dkR>4#RHS(FDe@s3_Y1{?C8q|Fayb ziVGNo6sAArCrBN?eAS88+A@G1 zT{B(xopgl2^sRfkQ%!X7>E$h6JkG-9{9q4i$9ow=?=3(MA5)x>{#C|5ybl>SL4geN+O$bPtp#TG@eZXL2q>dZhd#^$#(*wvZD7 zln&z@fX-J09pZw)slUFu=ni~Ido%5}op>wn_cH@T3u#%Jy|YE}phx-G#Zb=96APoR zRjfXeDS9NVGF-ygb}mNrz!yDe81gU~8~x>tG`px6^kEyYjr;-OH7*F3mp@y5jW+7! zoM5pilL_C`SZISD%Ba7!(VqyvpxiA$U1LuLUIa1)lumpICqUaapqT3hI4BP#zU-$U$ zU2dK^WLi|5mjbRuq4Du&`=NYm6WDL>r)c5_W4S37m^ZJz&zd4KNci zVCN|Nj;uMipeZQv!Io(O#K+y%1L#d*KpNBu7*=cC)B+Fkv>cQh*v0k& zey?X_2dO!<-Hk7G zpzF)sThUkKyN$#8Euio4^~qd`wGC(D5b$E#gX-2c*z%yE^rqAo*}~_UUL1QhrLN-4 zVYkr_L7cXLirK`Oaed5s=QS#`+_}I1hV{W=kwROkj z3S!weUm3D360iw@M%QJ>OwkHY%T7T?1(U~4mjNwcKaJ~h=??zO{J{B3YmrY64@|W4DV|P;%^-{_RCwS=@~hrQ5;_n&%HV?)ylFO9$W&wYhgU ze2=?UYEP{?RD_D-7+^u_=P1lnn`9kV#bz zcKyWWQzJ1QkP*2&?8qr&Sic_>gIFqtcRn)H4suN=z;*sCU zx-JE_?Ln8{56d2(K=E{m?6RoXButnPXvY55WOZe2-z8{~Sj&p|M*N>T<@U{g)X(S3 ziVS#KDyLKXumNb8QwWS-Gq7B23zMS^kX6X_gg}!TB7OSFYC`UpgruunG6g(Or<2?r zNaC=Xax)ElJGjl|s12;w!b_z}2NLeV))hiU@ui;(4`%-*KMPs2=WWj#i+kpnM%pI& zkgYL*ZL(w&ecpM1Ii#Kt=ojpPw6&<000aqnIO-P^%X!YgZzl#;u--B6$J+{t#}^{{ z*TuSv>u)8nhxAv>1IL~^ScqgK$7xI*DJ=esyf$;Df%hj0g?v{@O2|e@`m^nP!uU&e zzL)D`3B_k)c)wc33{MTV&q;|vS;5Q7A(}vC%;s&yTk?MRsa$v9{h%h0;tS*V$Sb#> zWwRfdGFavgqN)J>5UGEo<(P5j<}jBKWQvlc{=Dc5-5*0N*7kB%GSbDH*65p^Ls47x zbVF}w+e*ExqKvGECV}?a5jqh1FBnI0iEa10P*buEy~xpV4|q#@+*>k^M$z&J&9>Px z!+Yp;Ws!XaM%(wqqOy7mp0c_Bzq&WZsxbKCLkVA-qx^aW*rEeWud zz_ko$xfKT;RSnWx$dZ9t2K3Yy9f&eOo#M&~0ex5X^U;J)vYOc`owo$v9u&F(9r9Eg z^~yo^@13OFOJ7xz2dWIyrVff0KjI z`lJEq1f%;tZc1*?D>6XO=blUmB)*<$ef&L>0oN;mu}6I|J#aP7Z>k)wcL92)aJUKA zU%$Ui`ZEE&1@E`vrR4p7H$5wa@d)pS*eZU%O8U!-yXgKp*RNTAF6XT>ACy2YC@YYd zt1JeDw(65wyjI$>O(k&lX!6%`uBd;v@af;ek!y^=|hj%>Z)#0N3eo!BhBw|f|bfnlnMycGq&?fv(yHzXd9XL zA4sO%;)juYz$s=QnKrom<`Snq)?Lz^8BD%wb#v0+x)uJ~BlDglf1bgU1{erN>D^&W zD+-#R{Ko6O{Ifi;hN}C`2u+pcsMc%r_NmL|wZ>#N$4mn<&1fuMSJk+Xz_q&ylX+5z6AjQ z9Cz@{85-wuKJoB{YyHBNLLnr1FlYn)%;O?;Bl>BUV5SFF#6VaxFmVvtPy(SZ(nM4S zNNYdU9kox;A(O9U0KD~H8E|_gkRp2Ds$dVQH>q(sBmkbt>~m~K70$JEU+*3x{Ws_R zNPxm4$l5buEy9Pva*g*do6uq6F%ryk%s>(tW$L@fcr3Lmi2hhIIfj(&sBKUTxYL5V z{U(dPQV4y|f%ogUE(%~U`8O+E>mqfztl=}Cbfcn_qP4n`Ti@N9oxX`X)B?dY1_aB3WuqTxsG$v8_|O>Qg5WMZI*=<{ zv*@FPs!ubqM31m2Hu!+Bt1J;1wU_ViaaJJ>pxYN_pl73rVoP1^|QE zb#1+4ryn*g@gjl4y}Cj$@AY03(#l%?7gzh{vhPy?PW{bmrwfBNH>55);UC>7sIU0% zTzsM8YUbB}h1A=k;r5=LD}HGk@h{Zf?<-qxvjKZ$z>K92uOjO8;`AnkaG%Eipf{wd+Cl04LG0FObjqI@;OJeHiI|PhY&Qp$8(;` z16(qTrhU(bt?X(l; zjsEqc3x<`~dweF{Kg{p_$-NIAW&Cxn>ap!G??;N6BEo?-(o+vVFjpO55A*(#+|RCu zw@4*cGydVl)7zyIgkaAj`eo81L4kK1t3%erh4KXYYNXk&6ue*U=h5VE^w*y9Ww-iM zn7V2Yv31&Z{<=y4R{1V}e(}Y{Lj7$|(jWl>_3zURea)c+gNiqwpymI>sYtI|7CI+b zW)jp|AEl``8Z2+!lPuM+E?4eg*Du@8fRRkbLK_d1;`eot z9#bngU5MF3hVe-+NoL_;6Bt5v#rtS{|JZ2zm~E0nmm10tp1u(|5*4EeQs=U#yTjLA zyJt%bM@}6-a3{}R7siICTZPIK7_+WVm&Oy`F@-g)2ZBMGw)_;v-vWoiv}2yV0aS^IyK4`-xw$Luilzn@&MC8z5_igAB0szA`nZUPx_aL)bhh zPY86P2}+=svuv2uUO?HYbzrbqTEExx@LfpN;0b!c9VmT3!$Est>R@<$2K)?@JV0%L z!oXLU43c0&53GxUs08F-=2azN6am*6Z@30+`vo~)&oV%24hDs&$F7(Vz+QA#UDxY@ zO+1q{zb7H__#)&!M|8ebz}fg$XLXhIAL5{qh92hqz*FVhyAkil81Q<&GKTkC72{u_ z`y$q#OGP zsS;oQ)@zIZziNfFde<~Twr;hCT@9PxgY0Clfe$9{A0%6x0eO)828kOz# z;{>v3Y~F9{0N|SiVSA6po_r=iYC>TvPc_Vj6FN$JF8W&3aOV9mxuTY#8C zx3I&;A@WCa%{Cux-EQ8Rt2#tPi2cIf+PsI1oF&{Te_t#q2640e_be!9)?NSmA{|^I&|?wO-{|6Eq<1TQH`{j~qJHr3 z>B~a*D;c0}LMQ_+m!}7m0ft7{zXZ3RWxF6S^t<8TjymfRgb4wq|DXi=pRi7#_ZAmC z?77QFV6NU8waKWH-eDH#95l42(bXp(Bd|p!lQw`q&ZQ*S)C22c0F{8}_A*fd{+biP zJXk3%NBn}uZ9{`~Kdut?Z)!yb98m)6jC$53Ufz&}9}*HTlh4Q7u>6CPXlL+i%w1cg z{~44t#5hu9B=5yVd6`D#A|!>i!q{B}f@sOT3Kq-D4B?#Sl6ElRdF>UmGq; zGTw>6%uec#YANA=_fvf3WfyHHd9jV{HG%H&)$^)!T?n*%@f7uZs}2A z_V@CQwgbkD`irWONe%NK(zu0fw?MuExV`?Os?4iLD)g!1{a{fDYXFY$_3qCJ2vdkv zca(?+OyZ@<2blA8y^$pWd}W0m*c1b(1fV>u&x}eSt{6T#A+YKf1Ra72<@)r1BYr{N zTw^ ztAo9hd5K0tG%D@8UbJwVi2g#u zn!M$(CHxtmvdE*6st=!@vNjlZ)G#LK?_vX7p+(Swt5)KsG1nCEqHfI=b85IQ!J1RQtYR?xefz)0B2@<1UH7r;Yhu+{ zE@oWu^J&z1*%(I_6Lb$Y_aRbe{dO2YS|+S|;Y*|R?aW_shFr|*osHY>KD7)`nE>1U zh-uf3CId%*_+Q@@s8e;I{(3qB{OsLY6A7o~Xk&945@)R^6Cy^ho5PaRM02}xhc%;b=|geMqSyBZ(y-?3HOW$^jglmvqw2p04eF|eitwC53f)1U-;G47ub zfZp^nkpYrq=m4ML7nJ7^CQ4va3=EGR!1>uU__c+^kqkfgB;cb@?<~zjbicg3M*1fl zw5FjWpH5E!cgnPQi}%BI3$)Jr*DvOTkTJ|i{|e)u(*3IRRwThj3C|08Ea$QOg8+lc zdL#WwUx5+dcsBg0omk}e(p^TkAH3{Dxp~v;0^im}+iHY->1jp^vx0soDLci@9bt3YyEt(n^bUvttZ*U8dr+n%p zB%WT}(~kGII?th#OTVknu)Nzw_`d%pj@p5>#~#mP)i1$&xl0yMWB!$d&I7biQ1tnl}0^J>{ui=r6 zgM4mFJZ*fbZ0nYk{C8g;G0Mw~Q`_0!toF+pVNnKvk5D(kcW4!Bog+BG=*N=+A600fff=7RI4Brp!0c)#AgOvJ!GC7?-%azWQ1R01m# z0+HxfenICw#|iKE3yK3f{5~iK#z#X9UQVxoD}=-=Xoi)8z+U53r$m1%6Xl)#q`zdY zA=*t!T2bWJ;{DOZMdP@R^pA{xM)wbK{hdU=C|C?OR@P9$`N28qm!C#Yt%!__FV?ZV ze@+ji=VJ9+%bqiOSy)kW2I{1|8|NRoVKvSgbe-Un1Z@^z*_{)z>A}_f-}!>_d8Pj9 zFytA4T{~eFgscTtFBmK=W%G7sT3a$0irq(}yp6o?=m+Cz=+^Zv_WVu_u_;6!+-`E# z0Rtxr^glL;Ofa1IYf1WeWOql2p(`HI_>ZGbSRdTWP4fz7E!$2MWROMYBj0m+;rJ?{ z>$7qXaR#fKU9!FctZ?S?V|5yPJxehf$UUG{H}n!QM>2PYPf1DTzBx&_b08=@vk;##cX%)+d^C z(z$JD+UF-E&|C?~N}NtZmEtd}na$-&t{??=)4vnGz8J&mJxl;b(w`;|6ANrdvia|! zcZt&ofri3mw@SDr9J6PO^3N|V70zG%YrpN9#}1a+2GL)wgxQ@k z&Yh%xKSRwd(*t-U`PQ8JC*BV+?BV^^1%yl{-oHuuaU7n!NGgHzVXl8I(GSs1f(>Fo z@&MKp&6U0KSkypRm8Hq85PvrL+hwKhQ2R>B+rIwl`6GFGfP+J!h8kIitv;0tp^iYZ zZ@>B|=4Xisck?&%rNwPhLn0b@zgjh+9E67FLhHAD$4_+hP$Qltg1x*^Lqut?k)Z-Z z!!F*_9!>_DFbu<#x`Z%};7v*Q8pnmb;J_dM2?P1KO?Y4ga6N{?5{SR5cba0YGab51 z*JM$?h>9IQL+B9P>W*AL=znc`A$#$|#7@I6^t$exLkD}a(02v{k9oO3R8sSpJGbxl zD|**`nqgHTNG~Us&U=)@AQ#jd;YRLfh1+hG*GC-`)8yd6ABXmL*~Yw#9klc39TVMf^A8< zwbZ&WR%?S^nB(;rGh`UAp!C|hCBwu}2=V8n(4v3lTJ^0F@qKLgveC=FEM84TOj6fQ z@T-5_w>^j1AE5Y<#_>BhVEieDk*!8jdx(QN+m6INU$KCJsx~4Pe+K?4tWSoGF)_b2_N5q;}m0?CFCP>tTX zvO>CJ|1b&Qxqx_jCG~GlvjS4VuZ6B6&mDyJ<*NiN9*HFuyXg%eH^N!mk4%l;fu_u_N&t&GUBr?Pxt%Ei?73zNLHon{y|yarY9+A2r=P*KFK;Rm zUO_ONzvgRy)2?twN2M(xaRt{ehOuh2+(r7sSQQ47aPgMBA4phWw@%PjdB51(M&2K6 zw9Z)%kp7YJ4`Lt`+99sLhv+A&kwT>y#yT?B$@GH3evYQhK#GC*Di;rKLdd?m!O|Hw zF!bemcXQSQzFJ6h*hw~hQ4YHGr~FjvZwf&d8tkS1T_Sp&`_uA-yoI$it8|SQTa4FH zBJfzDZnu>#9+dN`H0Sr9p#?;TkI29~bwh7cJN63#Tr#spD{>rM%u!WG*0AGf8n@Es z@8dti@TQSyVGYD0{f_DGM8UQ5z0C66LJ(;u)ZzRLAg=eqoX_8`qs8-o{N?woyR z*)sECCm)dq<A1M>q#1%8 zG5{&RP75fH7xTP?Y$pS6$^f5V=zc*M;b7vAO2Elwr2Z%fVD+;<)QvUvI95&nqr2Z| z1W<9yD;1w-#jrhC>KRr^XLYHUmumoQA0f4Zutqb12g@0*^uQi55U*Q|g%ZG@s~5Lr zfWP1vGG)&{smrHyc*2R1`) zlK#jzhj=!4e@G%x{E>0mMPX@5)$!-(z=NZEVsjW^r1+7#8IjF74>^Q91aVRk?xM6O z;-{>mvDoWMsS0^~FC9+Cw-{xWmXoty{k!{DdVvOmyHV_Lq(I*R5KR2SbJ7Gt_xe$z zde9!aeiv%kwhDrb0%w;ELs7zX-JrRUMTOx($-k`e4XW4H6Lh5#TDaGeyZ*P*?n{i} zdi&K$kv43oe3Jz6j*q6;9txU_?Fi!WVI~Af5kxyMj7I2zo(Ch{o-jm-(qf<;Q3LdH zlt0&UR}KmAM#IbKh2i6hlrfw}3 zFMj_)2B>LVw+a}7XKcmXCb7JEc*Ty zz&B0wK)(F6FVh3ApdqkDJ~B(Jx*!4Ib3*$!{u>)idH{()cE8qc`QLDAM!r=T0tP#G zBEia@BljJMHR^;=m@_2+(L#xZpI9K)HpA?u3`=eox%}~Q*dqSqjH%b4s@2?5;U`I!i8CiAsIr4scEU;K% zWS2x!ktm}A2$=*XZ4vHa{3B&AFBT@f^hZ@OiRjlP!>c7Q2~SX#F%8w>c6Kf2v0yRB zSaNDrhoU#O4fgj?LCWvj^Zj&Qm>FnGa^-xVZrxWdt|xq{wos28&?icOHD*~+e;uexB8Wtr$3PQjNUYpokBC|DV4qJJqdl;M8 zTZbp2FtCk%BJWq$njX=V+I#6L0?cb1sbmdt&cEN+ajPJ)S76=^W@Q$F0n@I(Ywt#S zW^GHK*gX1_3)ZBq_my@57JYqc*-ge=bfTDCeM>nXHxvD?IlY24IWe2dnr<(1JjAqL z1imG4+6(C|+lxjww3k?ou?D*1BrO=(l?O*9Fv6 zR+9dGj358Ii|gNl=!a^|8bIEn8QRjVK}|trguU?ns1&FMFI=PE;7boI8?}NjAXZur z^j}H2FEwa?E=R_yo;mfGZMJLbj|q93Qu^g`K;6E@R|9^GH7G4ao2(Fe zYiJr0y>v8;acXOF1+B-A2RUMPpx58lF2Wpu4uWtOskTOyn7wn)YD|I?gyp6ZKINI} zWp2qvn{gPXC!{hkMqGs9)smNP>pN%??qJ?Uk@I%B>d_m)k|5F-xe}0I{eqncrmS6* zXW+_%3=qX~s$@Xt+EW=2E%t%Ws|_D#15~}N$N-oY=rW>7h^ImZtSAAK4O&XsjE(Hy zc1<Uz9A-$ZRqZ`($PqIc22&{zr(@XD<`AO{qqnT}y((?Pp62q-lYjN&rh3 zhqx@ciZR&>eu?M&5 z{&1-@KZp4D@&0u`pVjNm`vWVrc#|m_{766X=Q*z`-bM@0ElT)`DFFapt_+>Mu$H+x*|iez52(BnDvQVKYxi4weDv25p*> z{XhwzxfB&}ihKXN#^{vX@`2^cIGGLiE8ybSJb1fXq zlGiIR_%@*dv|eK|YSjxzsFOa}E-FuIF(T_SCD7vq5*%rp8T)}ZFAhJdDzg&kQJk|3 z=p0?*i?kmfv<1j}WI!WjK8G&JGnl{Fbhyr;`sQ;_0x4Z zl5)=Y!&~R_l*gUG3q5uk-qY%Ywl?`23)h8}LHH^4U;Yq39+*UE;ncn7R8xOw6~gi} z^*5h>2yI0KONWhT1rnd!grsz>{pgf{Xap$`Ok$g;VJ46GdH0_4fG+mQVkxcBaH2;y;8I(_GC^u~LBA(852*I2m} z_WifI8p3+j$4rbOA7jVG+2`3FpDWrRWnNa-w7+_1Cj6F@VPp{A+tA!LEzD;Nl#e zd;B`Qnr3)u!QcX57p)JEZrwjf^fN)6Up>nBXJL>MjZAdL`||?5)g{ zvP01Y{}~GvSbq0qv1j{!KW@8MktR~0|GjulJ70$%eW8Gyy;@LzdkCpN=n!mEoq&KC z?D>&RU9kG}^k4Jr2hx@Fs4+m?pgnKx;_HHwXO1^zr{T!#oTOQ0$0-6}UCKf&z%X3I z9rp3oWop0g12||C7>J!0io*}YAGAv#?jaM!k!PDj$n5rdKRxjT3LRY;K8QH29rWP| zGEW_d2BNQJ*blZE2))*tfA9TDT5~+;mOAT(&N|Y&_pfL)^hU`6k;K2m#Gp*b9=D5` zfC{yDUS+$!>J^D$?i%D10#OD4Uju?}yW@{C0NDD948TOw+(2ahknJb~OeB~>@QH&~ z)>4fhk$bdl!L^J<}5-8dHv|HUxr7yQo2)h!x zDZ9Tevh%P0_1`^Q+x_tBShV6YG<|N1>#tM51Ee3hMr5=jzaL0&AevL&kGvBjLatx& ze!HTy$+!O8&-(+r4X@x=!bN!b#G%JRtGWJ7i9S}}Sa&kM7Wza<@j&`DRXH!rDlKfN z1IF||azv9q$SF&8(na=efv+W1aU||gk1!7)#7Hty;LWa$8S&7Kq_Abvr#E4!yS^q8pE0xh(8Z0fmk;# z8YPt&rx*4Pzn~Qvp#N2i%NR1&Z>Y*GC9p>f?4`w*7h(Lj6%sF`7S6x=>%aRbv-eS0kp6)_CURd(g2b_%D+4`8sy#FL2P<`<1bPy-*wY`YdB3JLWd1z8 z0-b*~9U*^^Hf7m>LLcaBT&2b_yCZAWT~W){GyVb%tGr z(sr_GCIQm|b=GKS3M27bbVApZN=mDii^wct)6YJ$Ad%r&0j<3|Ig{{m1=kLkWjfLE z^ZBIP_829$Q-_tDE7`AQfb!^ZiLf3B92A7gfNoC5$bkJR&o50I4Vv%7H(3Qv;N_H-K0X=yd1_ZxX^Gl8{W`^r`{I@QMBJpw3c0NeqnB0(+G} zR0Y%d35U6~u0k&1aUTqUvMO010-B8FuiNz}MFk>ZV_2m_zgLF|983q(|*(mG^*(Ed3w0e(fZe;O(De7 z8nRRBkRCKD`}{C#cxKp;b5kggUz8AQCx4mr@}{eLpfisUr({^JX%C}h%U;u0eTalH zg44bRlMP^6^<%%J#RkGA%T2)0A07FPcsadNZjWRgnP5LNSXuZYC)yjQ*#L|4>FLQg z`fLt8=*Od{gUM|O30k84r7M_aDj+BoeL?qhLav!P;RaWB_N70~5vWyTW{@K#YUw_d zOb$dselRl89AJfYC7btPAg|bel0d-Jq3Jlcwzgo+4wZnnpUB!#tTEe5c{Dax}_0z>mC3jK!k`tmYt{}5B3#qrGN&%fpyzGrf0$HNmUzkYXeHD4~w zz$*b(8GmG!;cn)sx8VH)!*+^@q*DkP()-9jC*J>SygyTTC%2wM%wv3={B}+o^IN-* zQ&EOtXpY5FR^OcK=PHAZ|5KHX^_3=M;H5wqgpvvh2lw#zmA#F?cb^BL&`#zTXCOTS z*sH@FiDHdh{Ja2ZSU~-~Sh0Gs)o48NO^y1C2(YLvh9K_NByr$~X0Ek}BsOJN{`D!B z^HNuar8>c47<9s^Mz!aU623TpAk@Fl>3fs&F$|(`JplS44i9;N!PCULYzXv+ zRK=CNAIm_Jg*)K`%r^V@#ll~`cv2NZ$r?G1%}K9>W0=irD0Cf8)H~V7c*DM*nefMo zN7`oD_O%|?%CyP&tNFTapY};`>Nbz_BSzMZv%E%Y2za~52HKK$Ziv3t}o()SvpRv{!s~-PUv^6 zHRjAf`aZ7%sbaf@?8I!un!`6j%@(hFk?m9hsdmQRweE`dvF*#VDfKkw%iF4j`tkFx z`3>K5l-chIHosBa+2r~~n2Pb&oMw~s&q*XYx+H4duZ+AOh#K%cp-_G|aJRwooQ%79 zr8&3-A-|xp2y+XL7REgy*`^xJ2 zU|1v|+o*)59+?wVj2n!#hY4ICP5sE@Rv2))HT=v=L}d)}YxZ|04Ka}LKbHZXK_mk> zBveNT_n1{8gq~hi6jBSLo10y%m1nxX-B}iLYQ2k1+s-N^UsFktWI$XtVCH?VV7V1`gpyr^aDFP31Nvyo6`-os(O@!BV0VYlSy;p$Ae8B8NM;{S_$~y zNf@L*vl1A7Sw2A+%w+&RhS99ZfUE?@${6cH9)N=00kqeD{R{NMh@ z@4Zd{tc937UPgO}>yL5oG4rQ5N6Yb1-jCF7oo6RkA01wiPM$}iZ_mO{r^s2bdzpkxX9EYs^8s{C z#h&ebg4(F^KZ`)ztKi$LqwRqsx7Hf=fGX58X5Q376E&{(1{Ks8Xv zfTTNC{DOkKL3L0F8?U2L31r5cXyN?1+96+_&(+_7a=1DR=fC}%zAs? zQ_{bm@q1iQcK*s$frC`2s&8O}L%ql_i&c~I(8#H-KLw4{1N4C(e5e+OWtc7L90kf% zl^4`?Fy`BKJ-#Jp8}W?$>+;*u2dHnC(v#@>AI7L*FCR7cWA3YZ%SU=ynMAiHy%MGi zjC}O~uoO7?cXTS$qq>YNQi+!*YEjyRK!|e%k!nh0p-rXb0n4^0_&^>$oD~AqRk9|J z2px><5%{0P5ozV}Q*tqN^+${WdQp!P8S90z;||t-9Znjh48WybU+!b42YO8Hn_9OT zOm0V_k5O0z(|7W;;tR~Z#gq&}3k#Nfdkm_{<(5=5#O+K)D>}_2h_KQ9>CuvH;q5<{ zdO`rn77{k#`=$gU(KlX?OK*{j*D?Us27tAHSQ{YJ-93yT&7ehK4Ff0vG({_UG{PD< zEs#Semq`!!8eivy`iFk^BU4PoNWQZiOxuUl^m({7KC(bvkg6=UquE3EH@W`2B8GY|p7q*ny@v(J714+CAPF@8V)pX_*NW4(@E7&6 z^>o2$NGP+Fq}$t7Z)l4N#Vl84m9NGnHg;w^Wzuo(;A$FIL-J!FMU28OuN(-=X{?novR|Vw6(U$L< z&yE?ET-pi&keRD%0LIt!a@D#^>Gk)J#vx$>Gm{yib7A;*pD=glFvhRfmygJO;^BqC z%xg~AoiztTe!qsyt-AsZGN9iR*Y@m|qi^X%90=yX@Rxu4hM{2OwIu--$mSz(@<6gT z_yyTpn{)ua+kg60h>M?2sYha$IHJzhgfJK&`siZ|Ff&E6yN|8Px5g?GijRzQ4w=+? zC8y8Qiz|x3RWSfczy!pa60nj6J(d)m*Zs)uvEe~#7|@anW`0jQDhjI#zmjX&la4JR zmMT<1s^(Qa5bs=0$8nuzm_+qD&#b-a`PY8)_Yb}KB1nSxBdR7Q(M2whezfuQQ(R53cck%-A~b2fd*&1L+S@4Wv0TX)G%wgOJ3a1jg$? z^v4Pssy=dkao`!+#vsNj#iISW7cxEq>t#Vpcul$mUpL0_`JD6G-ac0Nuv3uLgH^&R z_4fq{nd19mUmw_1Nq~CPJ$d9cC05v}GpRmv0kV?>>X>TIUpGfG8fP z@rjBcy>mB3vy)p!lyqrR)8^)WKgNvonld?E@|%tEVOqdtfU`O@$M@gClSelTP3H!< zvycQzHh&=hNy4DE5LW8>23D+houUGL45snGnC*HmLyIm}%8Io(wEYR2f+TzWlqvyo zX2x*O&yZmw-?lP%Y(kM+V+`THYup@^fEA`RBxo2Q5-l}ok+BkEQb8b~@Z7yTKtKFJ z23(;8#vW-y59E4&8|VHjgv4Ryzwd$b*M7?nYzJEDpeMJ+%iBbM7%x^P0YF+b@J7l?OcH?J$=VTpy{yuO%9zFwqK|Gt+4-mY$$JRpMNYGO%E48q zKihnI!j_$C&jlIKpKRp*T+0CE`=ty3*YCETcaQ{AvraB&My0vFD?Nw<`R<10un7>drt$%+^lIk=T( z{uv%CT!T{G1yzXxGieXVYRu>U)z7H*+f*>2}uEAy@K?^e=YDX-jC!EXd#3Lst$Zk zxgg{Td4EW72k#HsV}~pZ&Vhly+ z0X?6uY@T(*g?)Fuul1Yf(|Or7#h*j>j}RsJgGd~(-()Ye)s*seqtDxf7;?Mkvaz84 zpSZbEC{6o}>;amN`w@8|N4gl~#jh#Y%Z z=qn=;YJe6|mpUnmyenkSW!he3pK*KFHbE6>#-xr!5c|G)P*HS|3aiJC{q|o2`?u~S zs+vIACCp`H_8WDau^|IguttBfawP!DxyEm8qaRJm^@9ZUy zEv;m%1wIsQu}Iy}_r+*bH|Yaa^T1B)!l?nCveUuL>icG(t`3myqrtcZlsAC;s01qe zwQtgoY*;QznIosSFv1|AhC+*q)ZD+>^x>3rf4t>3`|#-jBaaaTUOP~Hd`)Y@kvI$e zAH-e|OQ8a=nS_Snj%dj}t5yXlE>Hp_Rj?vO;Fm?7+cW6AcyX!(*2Tb@9>7|xa5PguMwP6d*RrSR8{qsT|3RYtntNO7<%j z<4}nx15UxWU7vE(`2D0pau} z5_+#?WKKzqNCmBBITBb{k1ckUS}i=c~L3()9a44AOPm|D61G{guA)EC*TokvdKpZvlBm+PWz>co* zJCa&V5A0@>?nDHc^N$j%1occy!s_v4?5_anzg-f!FyZfNR(@asRq^VWF3WvWsd{z@h3 z-^2LvO3C%DGJrw%>qTdZEPK2ab|3`(CTU-uVrGDJK~6e1#|nfxmIq}lmlCvfvREy; zQ3=i>ajWJ0Q!V~;+T=@jR!{(e0USbO6S#AFn}=*l6Zs9>4;lGxUl z5V(y$?$m^Nvdcyuf}2nX3>pC}%2-vd3xo%maOjx?-YzkARtysYlAQA*eFf#^&8(0J zo-G6b4)2-l8{kTePY@Rxbv3FW1JLh7XBON`NZj`e8K4iEA5r3(re&;5fFibsrGXV< zz{@#Bi|r02Mz0g^Wx}_Ggu7^aDYoLH%KTEMWXA{1TPh@tq;{aH_U=|1i55rd?|1W! z-F`b+4`7=}GGK@wThUB)=v|-lis@jXq1@Y20`^%|bRRFpsv9aZ{l1Q8$7c>da@Es& z)WYHXx8Ucm|Bk=wN)I2ozU%7X`Lh!FG~^21FYm69ei)XWf=7CE+R6K!NoS*c!TTXC z2-Q7bdprfFb(boBsMGLl;2e-o z_x<;naEab>mT{BFNs2(_$6Y|0XFmC1wE9!Rad*=>cOq` z)<~=xY+F$*h- z2xQ;*V5iRgr!ETCHv^3Tq}K^wV(NY%K*4zWLT9T1`75k_!KbumOSLwJ92J6(WyZb1 z^KCGD`=g-jsz00rJISx8|K+F>$kabqRh9veNR|OTpM?b2kO84>L%GG`nka$LhmV!A zPr{9XM_kS5uh9?swRT_2O@4HKitU*AoG6B0P_ApV5F3-5d80v^czc9XZ$1GPh3Ax z(pWDLS@>(54e0+~Ry08GzSHSoL!CP5cZ!qiboq2cooWe-#nXz=7x#KS8b@)ik5$#Z z_F;){i`82L6nwe8j~bjj;nYxl+CdbKzo(EYuQlHzG|dB4JNYp5`Tp>%K8pZZDIs=sFvhnu*|Pu|66b(MALS+sVN@fgFJ6bi$F7~>_MAO?cwQ_^V{ z#0R|+ioPDyt^2S5+*p~m{9Q`GNN-?6vImYlDj$+kKQPD!Mh_f*;BIy;P> zCJ$pvcZR+))e^?A#<@R05f-hyP7wfJWnK z&18TzU~HV$bW6!GpAc9(6(K2sx|AwCP}Kf}8edLFaIGrXN%1eYifVU0&)@Xjzpc1B z873wi{d`Cm%!vLju0N;yn~Z-(`hnXI#_vcOS9t%(#eqeG`4*{v;QDwo68OmbE%kx- z+t0vPO;v=S@K#Ao1SVY;)IhI8k$YVfRUkuHuD-Fxr?JNJ#K^dwcI2NqOqlX7Xx^GO)D!@irzlhs|0z1EKQ`{j`W`G?N zVjcE(hh~_`e~=a$0*9E$aj|d;%m0|Y0<+F~g^=gx=Y497BfhH%X?*7*Dw!C7xRg$7 z%-V#4`10aS?mgbi6mNpH?12g;I5-zMiL|{$LoGX5z>>{W5CtK;qI5V-Gxh>^8)j?& zVa(N*hNf{VA5#KuJ~pn~`H^fBsgWyRkNo;n`)D+x3*=DAoJ}?0W6~oJ24SOT7*Sw+ zK=<%kB7*XMSqT_B^rDZPSbB+At$jXoq=2}&53oX1kjX-f6{V3#;LG|WdeH;J!CrE! z;{7fO65kDESC=|?IZW8Owwm2apppT(wgdTJlL3}amH|m`Xx9BLv?f#G#MfL^0;^&m z1PcwKsPU_5x&+=IbVz1LkR4%e5y|fn4ETwcM6;w&+ zPs8=V+P8^*ZZkHTBgX>`;LO;gRsVjkeb99wt;WQSheN7<9qjR@sBo)(Ey+GAXjP-n z157J*ccI2tR0o93Ks(#8Jw1D9wZE%yKreoG(-AQvkMyGNNg3C-0*R8$4dQO24K<4l z&*g*-)_A!JixnD7v1vo0`7S{Cj0VLP~?77rBV!Ord zIm4n}pS6f90c@XsiNuYR8gMotfVmKIW3EQRlEqivnKaBxfHl=QwDYPc12h6O^#?MT zb_((!k*7Ng^a+5#DYf4HGFoTx-R-}<0{SEaFg$q#UlsTuutRjg2L*B7qCP&85ZXg{ zL@hSst?;2B`!v>W0m>|fRm5t9&y))1Z~30TJN%vuF(sQ{ zRSrjpejM6DuxNu!SuCu`n~Wc*n6vQAWh0eZ<^A?|Hp2&MZ}#1R%lG6S?3gJP924Ge z@o)0}WbDUjjcw8&f6nOs3fGVIIMA~>(I4-ghwGQB(#v{my|Xt7FK}T$P`{9hFXxr* z-bJcuJwgdswT07-v!lP&f>_aY=Aaw+p!h`~332jT5W3%QIrXzqzw?Ikk6&*VNLJYJ!LQ zyT_W6C%vKh4UbbRHLmTM5-H5^d1U_(y&Q&++**Qk30H#1vGVN0hs6Mu5XDu=(Y2+` zl)w#SfF&{N0?;SG`^VN`4cN;UssBU?Y>9z%b?C5XReafR&A+^?Bv=o*5z8JWFoZdO z>-YUVS1|jPkOQBH0Rl;?pGr4U0DKNDwfhLsmx*558 z(`)5>bpHc}u{#y?(htrRLERv)&%Q3ITJRJsk)xpGq_dY7Cs<7c|q zM*bE}DhD9!deyVzMt>-4ou8gK`g=v`VURwbVEjI6Fgqj|H~mbz`)dh!-eDsosl&W! zCFlSsST8JRZtCuXYXi#9P(}w&X!!86bC7YVg69vm{(`z;+FD$-ThPGNF@t@e$~P;v zUu3Q~>G1_{zM!+EJ#uNE7{EZYPXBl!>1xj}9^wY~!dbudVqYyqY$$QMq09!XmX=g{ z%Y?m&(q=y1lJLR!2a@(#nZWU08oQgOV@2y-qmi6Nlrv;SX2ht2D zvLV~nPstyTmFna$*aBj&wR-w*7&6MV5+9v0ROGc9sQZrriyb}Vbp#1Y5KQl0w}B!L zH2q~{fM;g#3$pfHX~OA*fL`&hrc?r(Vjz8JgCo#oKU==+=Ihhswn9Hw32fzXS8jTT z_HEz)KbQqrx6b;NxjF6%qMyS=<~M{4w@Svpi}WLbJ;3{o_n~1p^L``K!26A`TaxE3 zS0Cj4{>&!tH-X~XCTNtx%wID8#Kn>Bmt23=07AW2kCZhoy|LYsKHBmL%r!GxyRK~7 z)d8?)j zWgb8d>5{NW{e@9w-mk7f=-Dq}Y#F6hwv@j#6YbL>&T%K8z`P=%?`08&+*x-rrS`_- zv+$^PfI$w2jcF*5oQYm~wTXGuMEz>u8JMm1Pn`bPhx5K(9%%M(E9YZ!=x<6e?|Bse z$_0QPJL%dW1GI&MY5(v5Jmfh>73YLdis49VLQQYRoCFsWe`&vq%?t<)R=67ef$5rz z(6E6;={0AEsx=~khQLP90>TG!$|gWrq> zh$2o?H)5&^0*|)pUROqI{Z*F57a=oHD0ZHgKXZ8qh3L}HPae~l9<=Nm;qHq(x~S0e z#ek06EvYBl<+K02>@1|Oga5JN%rneW zNkQK?QBvD`RK$e026;L@&@<`30;{x^VE*SZE_bZ5(Z%L+gtd7j&;ZX{`_lMzmrZ-R zPHlIgC6_^C?>%(0p#VHi2#_N;DP6=DW|B0Bg|wOrQo*#h--M_|doBmxf?Uj1+}Xc= zW1&VypP+J+sNzc3;hqI=(M$T$ApINwv4lfRS~)iVfW4B(h%GsHhjSH9og|E za5n^n$d?{Zf9hSFh{VxK?IQkBh&E{7vD-d0sy?sVulM+MX;5!COW&>6rSy6})FaGX zJTK?=%B_aFyy-JArm%Vos+54%Z7cG=lx+E<{eyqoCFzn|m1+A5tt7=-#c$`n`2}%M zlg~?SJ#wkHPk`b^+DQGkdH*EQLTu$dC2uI zmy0*ERSf{OoP+fa*FOGK-D9;T_OGuhVa*kPfpr{hpc5yZc%E(#+lKv4$8{qeD_uFp z*Wan_{t4Uo=(+%JHtGg!6kpzR8D%?pK=$9MLaUVr-08f}Mu^D~Hv?6!qH%Z9Aic2) z0oVc&?fw1#S#_2;S_~`daI~ak3M9*7!9xxRj} z`n6abZoxLzsFY4Fy9()Rjx`38;$Z$%?%RmC?rzXpr#S8aRrSAmcVvz|@@}m^lLtl6 z_diSz=-gZD)%36}BWo~2*UP|qDp@<-cQ)&j6H@;25s7AjU6@r+v^jxhIq6db%BZc= zM!M$H2z`Flcds&gFf?mfRn@QOZT_vT!33&=3>}z1<%^`i%@FpyQu(1Df^;Ac57Hc6 zSE{^eh4f&0pb!J92HUu4!a!fMHK3#foWG;Z-pKl3uz$Kdy^sv(Eivi>`3C(Xaj|Lw z!3$AL3@{;}gOk2+>MlZM;UC&H#bEw%oI^aW5S9^P*cWX`TB zDz87l`{B{3A$Euj%U}voyq$)?pEJgf)qt`gRJV5Juo3>Kf%lj3#9&KC1&j z&CI)KO)pt=KR?~$cuRT3>>`}D#2^3eIWn&iC<)wN}a>&j}ZR5mc5hvaLWcD*Pz4Tmodr1FC7Y+7)s30%DXy`7;q|dL|qiC8NIxq;? zhKlk0Cd=8t601&0vnq}ab`e^X{MSk^yuhLjOch`PM$vqXvV2^o`N>qb>Pm+Ko4?i? zqOX2@=Q3Y;G{inO`#E9ZYkgW71>?9-LXnjqfaCj^+>BfG=NSadYHpAat63i9Q^WTf zCI`kz6;*Izhjwl)Dtx)!&#!$rFVfLdu^9qr4&w5lH2^i?>wx4xCMbmE_b)fjQ+0mT zsZaag!@~o5?ucEWKPpU0jSV=fp=J%6Zq#)LZauI)HkH`7O^bzM_<4!Ct2+g&0tGQSjbT35iNT<^ei|7l*6~Q~z>#nE3@Q zM@nBS1Ec|knFe)FwFv>0%VxmW=F(r8T3d zXx5D~g+7_|#IyN_k-LZcbG2}IVxa|kR0oD>ZpxxrqxkXmEM$)JJdQ(EBoif&2qgsX zy{&f*>!cqeFveE!eoZv^^6?xnQ9Dnqny*j`IFs-B&4K>BO|4gjR~hE=9_2 zWl>y=HI%Bd5(D@URy3Gl7C8ZPR&qlvOd7x2@?f~NdYqX5g^tK`JrOIq{y&idMx}d) z6&i+G#65cR_5qub6|8#&_(;-JMOwz&&1HS*fuyX*0Go1Id@XeLTxX(tRNXqLkwpu) z`5LGjQTF_h*ldErEWTDk7~E`YLuczB;Q(0Tc?wenup1J_lWijIC@k(cwa!2)KlW+R zU_2S&6EO?g0ClKBao~i{ExSoPK$4L@r_9(VunXSa@}1E4ON*`~2{d$kI^^6k=4M@d z9@XJ2Di5yQD6J~S*O0woXV$XoCy!pbw15Sq$lX^7XB*keIXx_`TwYPS$H5w1eqD= zbkqdS1z5jO&fY^RHB-&7>}DsX|3y97k_R;m%j|A2!iX$;aGLl>m9zIVKBUc)#mzMTn9sSkCFGCr?^ zo=zO-o>$7(rBTCV4Jv`rHRwr{!J1#t!=()*F^;FFH5ssMd;0VwBiNQ-kZOI|Frzm~ z<^J+{Ni|vbs^3=<1K|kss0WfHkj4;yUeJ$VxE?X>gEQ@3*9YEkCKjW?PbsI8USUO< z?3-A4G*{@AY*kjARI=0Xd4#C07j}K5jKkf+ejKlFGX7npU;Aifz`JiD&AN?&`NOa`^ zM4ht8(m%qzL1dCIsN^D)>G+|pwpeKuoTMp`?{%=~{Vkd{B2>~#Ai_Kfi66$-V z-uJpIsL54ulW$&ty2!Ni%-)$Oc~bHwy;G-s*r&@30L%smxfP18l-8%_v~$$iN!J3l zf}@ACg9U99Cph`9&tjUgSh_Sx*rZWs%&H370+MFPm*SGwGItUjmdw%Tq2l+U{!M~e zTa`f}-bNJ%t05pNbHrIPX+DI&P*o$~`d3-`&>N0Qov<@3o&={8B+AJx6e zL~)u#N_|IS5eb_l9wXc&{6p&bf#Ah64l)P5m5xp!Z_myToBU_Toy>M5|ob$tSb0H)7= z5B4C^2<^Y%aSs#!Lfv2;pDmHpkrO{JT>t4z34i^Mht#MgR^(M5qljq zJ6e(BU3?sxwGtZRi`LAHtQh1+=v*R61WE9Db+JCw(dy+jyRU{}s zwc(;WM0Hlhv7-8EbD_EEj%<}+o5@^dwrV6mB5D>Gl5Zm-t>V#v<%@38gf>x>2 zLR`J_&pLZjWx1I}En&fWckGXZF+He3H>?)=#Ki!Z zg+c@A$+W*T|0e%DF)@!}*?7%)&VAvsCe|haV2!V3Ks`OB$J3p8BoUi6=)OK`L(=L% zb68xMYzy&}k@p@}-7(?WypfK)D-3_je;$TjG;H#7R*naJKAZFPGlDwy1*K_|7`WlH z3&Q%tmZs(E5hG z#8{190^$y*enClD$o}gbO!6LOOiR_Z<_g0UR)25vY3ES8Zw~!N>9OMcRf8Pv6sujf z((uVfc`I?tF&lW44H~EL-bS>|eCbB;NcXcc=sqD*FHP2V8Q>B42EpB~VQ%}jq*A1S ztp0`d5zCriUB7&Zvk2m4voKqwq%K>qLsuV_CQEcBfEqr;8A(jq-W=5BNb1_Rz3Fc! zjzsW<;T}zJREw_eHM{;2Kn%~;oSg1sD}x3!EDMHp0^TB_T?Kcb$`?pln+{Li_*_st(GIPQlDlP1l2rkt-Yl3<(IwJ9ga9ca{|i$!P? z<#@$ z*`(0@zuI_}q6Mzi0!T|R384XCG6gbtu5ujYOV3zwZUE#;rM5pAM*aSG+YD6wNR*j* z5tzAOxf*;nMnY}1tL4hxPFCI8+U8DcmHNq@JbH^6R6JumBC+YqJOrqhZgqBQEKE`V zUP!<5GUZthvX!Tlo-%eNZ_;_lF^1jR+-!1;qq`-vHW!Xyc!sY zygT4-JH)yMjjH~r2cz&e@t;YL7^FkcSISG zif9MpH)Vo#i&P?30q`NK%J6Wg=p1yV{R~n8Gn|(9S)SdnWc&PhF<3P4g2Am{UJyiN z(;c?qys+K2-K1=RZWeYO!o=%T=w>rywPD6R8P7Nm;M@B|%XetUxUaS^|LsGaZ5{}Q z65Cj#Uw-Nh$x0O{oNb*hjZOZ-OeBN4vw8W$Nfv(jqA}uPUm0e79JT^18-o+I9$WA# z2?pEHPIA94rI48V&<*C?1NTfUTc`eq?k-1(vCF$p1jGEf)w|=ISa=eYRrul}qxXVK z4~ONkDR^%HZVio8U+vM6>`&OgFlktXyLxI^bv-B$G!^S!``*s5`FgR)WPyg!(bk5K z7DhR8-%h1RFX5%bP$?0bDO`sFkiGhqk~Q`&4a>dwq?G%ou3Pbh%@&t1%?_<63+RTS z<}d{70d(hJbysg)nmKJZn%ma~yGuq}&E%^B#EGRD_+43bvx)M$Whqr&8mpWAcN*Dt zUj;HQivfIl1aC+{lEh_562s;Qt;N?R=>52IEHFCpLF%2fvwx8{p0vD0HxJng=8!R4 zf-RFj;_QDOR{*QYp^hViVZ2lIlR*A?Rt{eqYFjK_~djP2_>yvrza*BDS^EK`LLC z81TYS_&!XAx>~8?bg`;vH8mi8u@r|%hOj(V10>3Bc6Y01h)!QmeA8`dZ?note`uu) z_68SIws(!J?)CX_R~Wvxo%0E-9R2j=zj~gJosFU!5ZW6lV^O1AOR4h!d$YVa8fGvo zCY!(Z9E6?pBRP{78l8Rc`njT$UR^-XeHeuxReuC4B>NzYtZ}*WU_13-iq1u1{E$F2 z3Iey2yTgEkKZ@R|>ha?x>CEFl+mGRm@lKlLsC@KeUB+kStCP1<(vwW_-gfM>3#ohc z49f;WzNCbGr77mcKc2=W&FxK-^JvrjgSxDT>$!nBBTRY#SSNhHuw|Q!QO%xvy^E`$FOjug7dGQ}rx)?#@s7#0udiR#C8}ELBES0@C)pAR z36@h!-yT6b60@81y@VtK(zhD9?F_C*W?S3X9D({WHT4i?TC@vvd8ku8T>@E^;$8jh z^h5Fnp{l^@wcob=yiT&rAbbOoXJGus^kG*}ZvnDPvo53REZuiFwd254IN3Mf*3tHT z+>AW?_dz7c0Nt>n3rKGR7IQ!PSA|jY z?p<7re5OWh04__?8b!&EjLP5)WNgTeoHQ!$GRLj|;Qo^AtfnF0%L;e&H%NM^8Y?mR zSrJRiXU#fQKZs5NO%?@+Tmv`su?bckU;NJP@@PNKZ)Y!+?m`G7uldI0cbcTlZGG>! zQ^Jktv+0tMlW;Hof(LD*tds~m3GL9uqO}EVXGLmo#*sUEVUlUKsUFrab!?@$ro{bV zdSe44pR%-6Jmx7BB#&7E;#NXvq4Z3cnOs?6?a z^|xs~3z&y3^*;NkDy1(YwkO--7omi<(`f5`lxXU@3kfDg+1K%E(uESxFSXl!dnt(% zdh4bZi+&H@JLf(gNetG9D-rgU{#t(E?T~byy?l>BtGNC0&O*v9f1K8oRffqj10C+X z_X4+*-hx~eSjTRD{QZ?>xpf~i?DU4PWu6wYy85fFTt+bE`N1C_%wx+P+3wT5^rx14 zT^6h^USDJnP}?w6hxBFcNovAY3hz5d%pS6(2s%M+{!OxfsLvp2UjSc^v@rdT`zpe$ zj`kZa-=Zhj&^(1ydY)1MkAoqhNe)WSpK`)twyWI^C`0%oFV&sb@~pL-tBYnPiy?g@OM50Hit?bXfl7R9++-R~^-?C$Qdv&tb$fpc zAwyWds;WSlyD;@uU%qly)I!$@wv&(M+4t|a^S-dSeV;g3Zy@wsU34^X`$xA)Q*C1} ziKJdCxi1U`KOeK;x~1K_;GwR90oL0`8k*gGIWa+`MJZle^yxQ1Le%|HXu&BPW|Nfw z!-9bP1J7NpRROfIX@C%E**Bh!V=|!R49v5HBEeh3DA8bTCANi_LZK!?r#zPd=--}S z1vy?P!qK_Q|LC+Jw9oj;Mg-&AnE}-M0ca-|kO7`1Z0=*Fp$j^T34u;zjG%?oVG2xT zkQ&a#J70E+(Om0J{&pG}kRCrbz;+K3N1*<-h+cu^!b+;zg5u6ed!v_*@zPGma|5g_ zW{^PAC#&-YEbQ!C-w3y{{mVezxp$N*Hsne2qc7-6?%h@xGS#7?3B9R;vKm{b|0(&k zjA^docj}`XHr%)v0qS0^n`U%Tq!S|&TOkId0hqAVRluqQgw@VG{#!P_;IfZ6AS*p~aAzUWb6-S+P?z(!3yO3aeSe{ccxY?OC{rrqo%uE;wa{h&_6vo=ET@P zC;jV;zibKS?})wOtUaXX;cn`Pr99M9Fgyj{iTBp_=}xqYa2X)|8r+ulV)f}{W1j*> z`=S-3`1JRE`msPlqwKrPfTKT*CB1jjk+N^uA!!Q*fc6}}0~cu)xpQ%y&&TnwcSg>B zh585kzZqRk3X}#_*N48nW?{R>*FC3L;vhP4JBOyxACG%SX0vb#t^g4PU5I){MTG2@ z9b~+NrsYw`3=i+WdIciMo}>cx9G{ABr7l&l*0$1ck>$^B7-f`?*T|X0UkDiZySw0r zWiU>Ig;#nU8k4rn&P&F34J}d^TNXP4X_WfGI+?f4?}HKuvl+H6P>;e=7t4V>s$L@c zi3QmjWSYa|%%M{aw^QN~vfZRkQ(N zWetOoi4e7OJA1Tk?#&UXbK79}2QdKdRldSEpa0dW#fWjK1e(9jlFz5S=+``n3^sZ{ z)Vl)}wttfWZtvQj5P&zr!c4zxJ#s0a#)7V}OARhF?{9yJvq@cUQSSUQfop6~+(z z$-3=Cs+971Xt~u{UVq5wxZT2N6De1!?vmqblmE#3A-B7DzmYJIBvaB~lvs5o(eE{` zf8Ns`>TWE3XKz(ytO%XP?BAs!72+|=$LTPO+Bm_txSC0Ab0?Yu`vF&TGER$ZEI{y zDN(3F$eh26&I2glQp5!VT2sM*gTUm{-AMn2yblPS7`}HEHl+r%HGL6vwmsTuFT2tG zu0I9@JiUN4TF8ib8W?dLo^5RsX;Y}9L1@?x^K##KknaboVFwj4eJlU=T_NDO;0&T1 zUSSf+PU>*WGf?L&A)>_^)3OItx9CIwxSN=zO^(!s0ud{&-m_b}FHrxFL;?eiTT0XM zVfy|0wmVWy=Fo3cy6@L%_Wn*T-M2^hvuz)Af&k{F(l;>hu4YgIJ#{%tNL!!HIA9-VN~V`yJ0$?+mPIbdK6(XMlZ27Mrxc{Pyjk|5lO8vEoT`>{ zmT&$PO8V72n=^OPmuZ!)pG*2uQROuH50yWxYPwf=kLKU$W+5} z+^_nAHO{Z1BFTiN6Y}zaxeSQMnCWIfu-_3X0rL*(wP3Z@8qGlZ&6EcMOl#NcC@$Qp z%spp_qlA1_TRLIY?OszauGUYLf?*)`rBs-DB@H(oN5%$GSBa&(SApYrYCZJ(f z2oeWP8JIJEVfy;o6bo8jPc{;T)f%3 zvL*cBYNYWojpeIejv0?EO+Geg5o0s+UG`&Qo(FJPG7DCEHIK*Xw@%JLetMkYeRMiO zX-D6`-*)zts6AekK7mogxwlQkZ0_IR8ZyW0lyk7`bt21ugld&AcduVY~7PeM;< zF_&aNr(fi@z@`bRiVkvuiG)v3Ag5M&T}upuJCO6`D!0}K@{EitkFZKXwxJoPk9z1r zGQ>gA#40f9AxnAZQ26P^fh!B6>S&jBSCi5~NMBrS212g%TX0h1rKg>aa2okujjHOu z!#9gr^m&86KtPp^6K0hlHjkr6B)P|byQJp^z*LF(;`C>_bdat|=%#-U=Ryg{H@@&d z>r<>zs__Dg*O|R+?CIqu)htR?b_s3eqzBOY5Nt)F z#$yM>V=8X-WAgyc_cbZgz^FgkHlRh|a4C(2DSS!kW~^?7=&x{n zCuC!m2DrPpAhL^r_ z?}*LE#^P%Ml;Ef|TRz~;ojs+FBEQ8K)WO!QgA!pM|8y9XLjZ)x>tI?t`a`i9HwqT> zP^`+@L0=&k=u)A1F(EPU#ur%PC6=qo^TZ=`Q6mHj<{BVJ!vT3z>bwoA3y=YlH+up3)ceICG{U!O9uV>q56kLJKde&J&&(Xe+zTAeT!^H>_B_`` zwDK1Iq1r@%ED!(*qcfP6aPPai`;%S~=OWpLQ70tjn}p8Xn?i3NA{Bb1U<$C#PraY) z3EyGVESf@r^`q^!5}1p$q;tL7yvbr1&>cgYZ)J9=f)2_RLhn@3wh?-3EB&tc715@I!Ha?;ofC zf}coSfC@_=;a!9OjcJWP=DZ(i_w8MM_VfPmvXGxtjQbfsJSFMk!Rc7Dh4zb-#572} z3`1PaADW*Az?cKpG{vIWAn3Z%CjdV8+U4tnvr<7f$k7bin?LGB}EfzEDs*U5my++8AMxWWgkHKkrA$AL9IfRW= z{dIb}GN##7f^!E*Em##p8l%AmWesi;0wEyh@Fwf%PlfdbNupvTfg|jQ*xsgyYpPM! zW1M!I#X3&ed&<8G+!BykYH4+e4FL|}g zIFE*s0v8W;Ew6}v5JJJ$tFi;W^V&cHdBP@>3m{6z%qhbc5Z*KQWmanX*I=OW*KyDAD#A0-wIXX40jO6kWSw=YLtJsd+R> zfQ=3-4>y5wt5C}f~$(aZ4=|RA!%a`-|Dq%lFEZY99t2v+5Ue(^a+mo3JxePC#=-j8{R3yXKz`;GGzuLg0;^$F=m#t#+f<>`~$71y5=eVorv*ClW0 z&laPp;?V&=a)pp=vSV5c(GOBb_qJ8P#V?zF#ztm4jY{XFq+Cr!`WDS-*8k)0s>j6` zpD$NQKSW*4$xZ36Ipu!T}f0M=k;zG!u@d zmKmWlsoF!bc04_`VS}UcSqP8i5JTlxDLcvQaNc))lj^72 zQBHd(@n7?>Vq-2o((KBgrx_qc+zv>?K!9Q;Kx$WmFA!8;F$qwXO-yhJZbpZ$TFu|g zJaa0qWypT?{AphMus4@bZ`&up{G!`&!r1pVYH!~C{XN?LW1zTuU*_w2wQ|JkM$5z% zi|$?1D-c%(n-*G53uvi`!NLnWJ9;&0=S!AbD!m^S(hm)!^{Aj7l-M<+i4s0*Ik-&4 z57`bCrlX(!(!lwPd-faFBri)~UDRo=p`eXF@`at)A2jp9wBL~_SGlPU%uViz(bu@F{ zuNN?y3GbJF5Rx;pzsCE835HmEazh5Z+>#3Le;}h0$-wwCt&c?whw|ojveiO7p)r{3 zV-O!Py9qg{(3-In=xpd`jn6dIwZNiV2 zw(L+b;tCk{vQG&V-V!+{x_+|E$>{He{JUsHRqX~jVBbgV4TAKvNBW1d!Tymk47jAf z`Vtp?Z5Nx zXd{3w29WguzW5=Y( zWZfXrdY@pFQqqbL*FqUJf{_A#EWBK3ENBR=J8_V*0*@lVrY!oZ3Ta4Y{qT41IT5yM zt}eRBqs_5MukMSb+QzBbSguSz+WxmD1k9PINx|;Sa~ik&7hfO{7N!AkmGF3on5DD~ z*tkY=5U`cdLG#4f4_m#aVnE6VFGg_%Z9_$$-3p&EO1(31iFk28Ry=%W0VG|# z0@0<*iQ?ZzD!{{!UvL}HQ3*_FS#ft@`GGQqkoIrByOZl5r280K!HJRTMHXHe`~5F4 ztw-LkF?dwK#?!6(FT9wv2maGz)f`PTfNvBMgZEu0{Yak9lPYi)J+y?foy?j_`stRQ z*k;lr>WR`HN$twcoC$k1Nc^}IuazJS^-7?1iNF~zcCW2=%Nv3kCXA>TMe5^5_Vu?B z*Y@_q^^wBhmFXL|0U{v|s&e0UO?E>`V*h=3>uI$YROi$9-!RJ{#n!nAYNx@cDDUut z%xnkyPY?-=iN$S0fse&Pq+c zS%#QsEZ1G8qTPRMLLfQwpkj4r9^KDJe1TM0fP+w>DAxUgjPd&{fcXpQ{c-j~zOo<& ze7MxJEZ__oGrvXZ@BAdY2^FKo-1;9PnRSI_kFlvJDl7h=QeMVusLcTAiBoHtp38t_ zJ|6>>jBQ5rsEG%2y6Un${0qv6OPfjni#|64=vVR+^2)8fI+edw}|kCtE<~oqf1h zgBkK;{%w~bi!6vt=lT+b3{cH$D4G1NrAqthYyrHG+923(>nSI~xrJCjR<-++fh7z- z&SLQ$k@w4FyG$wsFCF`CT2E~!3<3MsXN5Hn&foD@-r;9ppM_^fs<#x{!pex^l~Ef(Gun-*0v9!O}=S#%Gaj@J~F&K--vG;x;9BH_?yY%PKndc zzqJ{=mT~D5jIgSUjrL6aWL@-==%FODy+c7UBn@`l8VG#f`kX)y)mfcUY85Bmt@V|` zokO8fMn{9@9wUU!Qdg6T8{>U3fH(#9-*CRO59m4-Uu>(3@Iztr5jF>rAZ+_ zmaeHGdeC%_pY|gZ{!pR1QmtqSp{i1~VG{|#G+OVRXCadn zCk_IBI8Jov*U0sCG?*3!ZV2t$3~N?|aA1q_rYdC^N;T4jc*<|ixwUpzDd1maB*Wx~ z6@ZR${i4R`=VZ!A5{>)1wyo<0`T?m`Fg_9*;?RJSEJ#PW zVaP=2$F9%fz^aW+H}|BNg`p>%W%+t3Fb1kt>CVIAwJ%e- zOI<2#-Mf9F#+8Gwvn451-gDRfGB2QB1VHqAwC0p(6A@wEQ1@=}IKvc;E)|f|4~?3r z^IV|G2TX=Y{Nbzs=nrg;#XmNAS6>TZ7so1>c>pLLc{??@_(Y-fkU}ZqBK#6LYd1z-2h)C=&q>VLXN+d~dwUYO65Yr9L7eO%{WatF`taT_wGU5!2hkq`de=WZHIU3I(Lh-2b)=uM z$lbW^w~X0zH+nhHOS&G|*I(`9FxsbPsY8|z9xgd7kbC>Ie{8hq)vo6v0=sge-$E~4 zwOI1(oD`W;h7yhI0W4QY?@`B~MgY5OVSo=EEv~1~5?zz2AEI>@lWjMf*f2m%!o+}s5*S7xZSo@4@T)TI9Edc& zOYk*2?Q;4b-l5nO2%;S?`2}Oe=6jKL&Vs;ZXv|^&FRGgy8u){x(ZAiIFE8Ia5AzAq zT#2rL5>Wnbga*uhYC4AB-8bJS6xyREchod(O3Hh6pAQk??_HC8=(w3b=!Ec<+w8%p z1n|fd@ZI;WtFNyGt1W(0&FkBTmb8^<|3irN+(*>)3Mv-p$=xdqb{CaJ5iqj!QiVeA zyuR<0Z_&C6Gkt{(UiWwv0d|23?t{ouT5{rYx0vfLL~Xp6DpC{qz@^dVU+)NX2ETsa z?Wa##>pnosIRJ9nub=H@w7;(mkaYE|ur$fgnGDPiD1|r2AQd)3^U;~f1}Rew+5n}> zZ1IU7qh>-G4h6$+5j}qrl|D^LeZl5ax4r5Mq=CZoa5;DNsiT+(hVWF(fER;>pG+xa zmGdZ0%wxAZA@?b8e(j3$T}AXaxxNxQ=Q0rC7ULJPqYo>g)2Cv9PQ(T z5(GB!8Xwg!-N)XL6ns~9HamX7&|3U13WK(U*PZ)qkAHpEHu=HxzEm<`-vm}hP#yS@ z#1nnB>(Y@@4V=CXID97J5p3@J5hF{p47b5y$O0wh5GoM+7Wlr4 zBYq?FjO0w_ql@-P{Bv5^A^HYRmFk#oA#b;0C!Yx_{FUFzCaLk3wgJq)x8R&sPNqnC zA132Yz7_9Bh8;t6i!`3XB>{m~$MErAh%>PHQ6^Ne6j?UPF3rqZzNTeEVAciVLW3TF znaaZlVx%9lWCEcdbL(%1A@yZFC#Eut>iTG9>>Nzdjcw!pzpWO)Os+-+eZXGQtnF=8 zYVV)GzsDxV^vV7%%bua=_ymiabt+OVuTE1UEf(=&eUmC0>vDT+eO*C#3!~j;sTIwj zd>gV1s{>p118@AMHU0eMbmb)=D+`;$#W>0r^l zrqo1WELcZqR068NZB8JpyFHzo=e_M2T1^Nfcbx}W?tMzT{(R|E1MvwF4*kP%H6U9F zVPcl335j6=fXrzOXBqeQC8ur38fQHxLBC~L31GWm>pVc{2fSy6X`C>nGwE$F>rOZ; z-a>OBF~*$uNltFaSyBswO<~N@R9(c2I}QSyk^7j#9I~{E?I-%1T;HyP4HYgX1u|#= z=lA8s3F(KJa?ow@p07UKj0zIDs8J(coLZlt#16FCuMdD zfLqxKLT{#10#I*-RPc`}lO&up z&Jmw>xg|L$~Dyx z5078QgSbGG+FOO;caQ;4s8XJ~!rxg9mW-wXv{&<~@1YL%N_voFpy`A_^b67y#Df0?jt9_2lc?ISc>2Wis?T6{;|R?Kr)P(Ffi{Q z6+}r4SoL;I=psSKI%(fX{q1g`4c;hEq2Yz*IyB4Jp7Cb77h?zF>AT3E_xnF9ydPsM zc)v!v$JJ*@S5u6vkG#rl^zs$RBqyt6Kf6+x>Apr^Wa)jObG1o3z9y(pAR6uK*5wR ziw2@s55^&SAovAU69Um6$o+csm#lNpIS5VCzaiuLK?(NPoOPvUz(T5qikfFfCBK`pj1M8U+tBA!g39>qI|j0iTG# z7n~XU3)}y^Y{%=tn2(h{C;FMYkDpx9oA!lcx=uNOf?yW_Uqax^J}!o~^v5P7vz}%_*4)Cl*q>7qN^oj~p3jR6fB6P~M$E0Rh=pJ9 zek(BDkj<~lpTK8*4E9zq8vK>wr?VGI@1ocf*z>VS7%<->uB~I}(_=@bq89RVS7fBQQjauxDwu9w1CDR24VMMmGTC z@kz+$y(zk$KMia!cH5eRC^Ng)sl+|6{$%M(t5ZKM8598#MS%Pey*XpS| z|H2h@&Js5*aS`ha46M52nO4c4CwbNTgup<+;V3UH;k=tC`t=8QAV}J|JURr~KP!6^ zp_ox6;J+gEAFoIQ13h3158!vT*8kJ+5abseyO z?HYOTQ&-&pMtZ*y#yliH9sur)|Fuolyw{LCqCn6jbjLvaoV7fWv4er%ZHQK^W5?(p zYb6nKc|!MqjX+sss$ahOKzx~8H$<~)Zn1R2W$BRxZ_?1cFq}h4T zg%j4{VS9Hs48wdtWS_7XkdGbG2l&_3KMI(`lujkqSnt4XA^=2^+6Y_;zzSapy`luf zJRl_~-DzJy<;MsZDba<$ZffZd;@W8Jxcc#0@^@cyWqw5BNM!whypV16X0MRw2Qup7Tc!85nj$`o3 zQK~;^4kP%Q#1N;3>KTI>08M3u_s2p+`IJfjd0L^Rbw4zpp-#gc7$L)58KEMEuL&)D zngL|1!O$0MaNZu|O><+wsPf zKpdpKjj3%uDiD3|YS2gOX_6itghBy(N1?&w)9<`aUAjaKxU^8}0PF0n)6@M{qVRUg ztV#L)l(B!yET=Cs*1NiC^0KFm_jLMtvcH9H(BMoikZBP$qEEt%39@y6Fz@IPT1D>B zK~z~0xkXwS80@zsPi1?T$SN5?fsI)P`XsMp9{kMOo0?eb#bJ6-T7_8VZPHhifGPuV zeiLVX%|ZJ^4D)?bp$EV-y_DB4=`59T9)10nRl;FfK-PH6Hvh`p+V)y0pml;ckqCoVt}qwJXJs0WHLD?~rWlVYnMPh3Aem}V7L7{Agc??l4# zU+6Xlle=Y0qBT=Jgvg|PTr*(L$y1T{%LpW_J!e3bhUD#P-ajS%P}HM@o9VY1^%z=K zY+41c4}a7%05kFiNxFd_#ueW@U&o=8MSmS9+-B^TP9=C2h5YJW^@KfFa>dB{C=X=# zwxL;sfzxPA%6N%(o>nq)-cKM!zyWNL=IHR_bU=Gr%bDdj$fBs>EIK~ABnb3G74##UvnrBJ}3>hM=!!IAE!rafL;`yB>~anyibYzNHU zNS=a%3R5~`TJbWn{!GQ;mzw-%9zIC5aqtU7Jg0)qGZFovduPex4b~DVQHHD;q2h&>7A| z3_>r|STKxPE_T6?q-E2?T2%Ho}`-(!!> zdlNq|Kn(c(zWIIVsmx&M*NK43=>!{o>IuTev)y;cV(w>rxv#&>3dCsvS@gT?IgR@O zJsj}<*Z9K1UvOcv71Hu9@~@a7vL1*B1LG(kt?FT}CQ*(H_K^v5-yV&3O8Qq~&aOM& zzC4no8PX$F3`Ka*#`=W@6Gk-yFxY4lcf&t%ES-$21JMV@6~E_-P_A=*4-n%V>3+Wz zzU_hdB5juN@lhx1PSi0zH_rFKFlXQZfxLBgel@7?2UpmlTh5}4KK$$@)QsNQgrE3v3j2}DVTb{Xgs`;UA5V+Z7v zzUU633DI2_jQ5*&6yA^CP&S$2@)I0hF(E)cTnq{by%h2(1dww*JHbZk6-^mDjfVh{ zj7Xf=^k&gQrYk@c)4qO+Vc7BOgJjR2)p!}_YE~8pL)feVfS09%d&6iKJm{Rg&F_Z$ zu#cqg4N@#Z5ZWVA%14?J5?#w^wZoLXugyepV0R@tFSp81Z8Li!k9d{v` zHZx?WkF^xxySFocbs!s=67qb=yJrO7rg3^*LI9mvjskr`ZE_$Ec1qo`Z9qb9wb5|B zWs1b=LvXW`TO>XYfGx;I3q3C^?3%B>_O?}yPYA%rfI`9bLOc_ovHxYpqd)p3o(N`f zEwd7OCYbF4B%6?~djE?6aGxJ@`WemuR!%>PfpD6#ALZ$*`F-4!e_`Z~lS_k0K#Yy- zz*N9gQB*fl4#!*#TtB^0owxl`A+G@#-zqbz6jh>tLzw3f{qoa79+p!C&Ti?gG5$ym zH%Y%fr6eUV{te#mks$B480W4&kk)xU75^J^UfKIMjQwy0UoF=W3az54K*N}ZnOxC7 zR)~JlGUG$zCUm8lU%GhzHbY)pd^(h>wEp2UD0F(2eQTIY>GrTvDKAVq`gdh4u_w)fAtq{?S@YH^POIG|rr? z#l}Knun>8e{RmDJ+4irxOPJ@-BJ6&wU++EQ_2HHznLE7}b)I>inUCsbIzc(VTs#Lu zivN^%My<6fNAMLQA9H08^a4a_6IP}gvjf=hz2=8PF_ki-ba+Ld8KnLYl|Pv{M5T(9 zVZwqO%!co7c^MS~{_RU6Oq1EE+#VkH09BoZrv*qZ;RVHaMZd&8Cdm7BK7geid8eAR zL)9p8cO~HZpr2|i5BS7`WJxJ*BbPlhvNiy$9AapfIZXSyJDr72SPL$G(c$}(cRZ`< zUS8GdyLaU7r-XV~yMe%o+%lmxVm&&1P43v~c4&zi6{Z~-(xUdcYg+alCbN7B)x8;}II^Knc&)afh;{OvL&$Ac>^~bb^#gJ=K0kiS= zV4n*jv#aT-RMNh3PT&fnZ?_6{fjmCZedie)j2{Dzq`&{18T;{Xd49{@-$RC;8yA0=F=pXX40sJx06Y6pbW4VmU*wpRDp=#BmjDig(D7ZUO`zMbgj}s zfqIaL%?hu~Su0s+lRL|Kq2SBux>`F`3+gEd#^4%cd|ln=)Y)sX`9J7{fOt=}k!HE5 zL=(%gd&>8emCrR+BECXC$PQi{(1hZM)F&u7t?r-7m-Z+Eik1A3RIcT;SN%9*AKRvk3E&6vcU`P8(`G7JaOtvL5rr@k;p-7O@Rc1Sk94tku3^mVSE* z-%UCosb9BD`d4QRJ|v*EphhuWS2wAa_Q^P!bgc&SN~o%VIg zN&GEBo7sNv^m|P$+!$$e#GjExpLXrTIffAcO+d20eGF9Gn6g0p!{W3+;jRrFJ7k(q1Rz32Zj!n^Qj ze678=yWjIBy}2R6A;1{C>b@*F#82rA6oWfWtSr69eF~WoF>PO7%JOE{IKdQ)Qoeb- z56jx1RXiz6cfA!gLmu9!|8i^)>(UzWMQzJg|MH`Lfa!s#@~8H=4Bg>-m{oaD6A-_r zTfj#*>e2Emx%4DkvwZ0Pa^JFc0S&bbzT4qVrssrv~u|pUm%TxPKAHxvyygKzUN?+Mset>}H^R_xK=~a#;N1 zoas9nK@7AenqMU5v8J{-Te#bX)-s@`aiI*bq=zTwXS+n-A!%dBJ9M8_CW7XPb;P7U zpOqSbI6M8lo%iP-+^!!f0G@VCoK#xH=M{LpRPqgye%1fgOyxfo0fV0;`t(-k14^ko zazhXn8#G*wm#!_PN-e;jEqzh6Hd!U_jMJxqE;pl?8S_xL*w>gCJXJ}!0`~V6Ye!XlKu1~C@+=Dgfhs#b4<2w-Cgi{C+^5f3*Wxs{s zQC~-Q`fq8l6{#WTwSQ&0p>$#^um4-r+A3+=fW)rIySN-7QU3OME~hotgk6ZcsYGgk z;J0{x%bMwhthXrr)L9cI#8j>^)$5Y-Q(BZmI#%g+=8i=MPzE(_7UIh%3^3}SYA{Mb zG%WM)s$0v4BYh(B*Ei`ZdVNZ)P3BB&m?#@{t-m4fUzBmsfVfi znO+cGQSe}~bURoQigK)shutSl9JJbEb{RH!@u4tX2sNVARz|UEDaif2e!$62T3LJT zz9QI4xF}5$5aB?yk8+jV#L=y~ zs{uHRrQ^&VQ0W|Jw=Uza8OKP!`k+t=ZQfs-BeGV~K4S8(t);S9Q`trA;{BTRFY#TF zH_5$aIvG2w$hb)r9(E1AUHMvXcTkQfK>Xm7R?D{Jxx*?G(mhaS^|20S?aWF*&cI>I zbJp(|X@W9Hi4^5Xx%=YNSEzq6-pT*c-d@7AR0PLCMZw)|A+ z5g5_{;y3ra*O9(Hh9YFGRh2%=ub?!VLT{=ir_5MYeN4f}VsGP62IS4182{s4tDaBW zXcdu6%%*(Ixj!MD$}b;Zk3U<7$u!g6S&YB7+>9dxMQ%<>Q(1l{@a5eQ`;q11WHb0I zaEeqZ{sCslC$$<44Ul=Jewo+w`2nC= z4Ua&YLQa#Zhx9;R6tosa0rqq}UnwQamTnf=lX{hJA7Mgn*xLP42Joo^S_Z5lcP%Ro zI4NLA$pBvJZ)I13V&~V+1q$#f41ZBdpxl$9`sJ(u3hyBSz?}nBbiJoF7D%`SnB1~l z{LUYk!O!fVY?z|{jO({@wRM8%jdFmew`$?{bsso~yNI7^D3?UZP1a!fjDYq}SsJNM zS?j(ir^oo&@oGWmKMm2>8lckg9`8?oyS$%H86QCX+YtPYL@8+-ykGXD=`r^{y7!w* zLC%}x>Ac!f5Hz^S_P7MM%-+=aO-_?i57j>OTPyONA{XDL5b0ul$w z_f5f~Wk547!Ke@NCvvsfmnd76NvBuLE8BhVk4<4}YNvMZM0Gj@P&dITL#`u~)9Jm6 zltVz(!9xP#+BcjJt8C|7!p!cT4Xr90^@K6)^~Q=+LXoO0<&CR;FRz>1oL}VAR)4mz zdi4)1O*s(y1;P-c>WWG|T@Ap@V_u8Mj6=~t7RUeC2bW}}-5;a8+oVZ)_m*zNx^hky z>!Nem*vh?cF_xDr&7VDrtgIhl z8tG|~XA%#2q|fo3WelgSZL=(`N+7!)vfN4=ilt{SasDEi`1IcVP${FoTA8Qi4an>L z=lK9^N^g2g#KQk&TC!O9Ul&YU0dQM?RRY;#QvPRIQ#8DRdhaFH^2vV-ID(Rs9{ZUWqxe`8X(FPN>8KI`=t4Y_r%^2+@67e@r# z7yeVnvRbg%(u;EudEG7xa@;JbqIK;y_PA4H%M}IYf7KO&{Y!}GosxzJTi1HU6{y?T zExB}Oz@wbiLUY1^{p+gCA^9n)aV(~%=RiTnM<6t6v4d8fu$%0~>bPJlCYr@{_yf&3 zJ{8KTvrp*bMSe;E@JyJHKFT{nUONOUw*ko_t>kR1100E;(?!bPJ1(c`Wju2{@53;$FET_5n(z6183G z@}Q+aw&Z`wk|z!4Pb+;!vcjMVvK0SOSBm6AU19uuc5{x}r=s}tk@hEJ7A-#15l<+A zDLFm&_GG3@cPH_Cn!&s-095Z#Z9BzmrTdWmGu82wuAww;DUw)h`yj{hfa&%*x8qy+L;^SN+* zzI%PBgO zMEZw!Zl^-Q`gJe6f3C%fSRivQkK|kf$g_NQ%gS-sQdP0pzCPT*Vm`TJJ#((%-2-5G`E=Bp9m<>O8Og&O=(nk2q2#H9+u<8KzZAc+uU-p4+ckGRAV zhF!NLFTIzqqzpX|V#tU2avO^{%U|ZwEBOwUu$i(vXqKOkZNpMAb-1F~C(`qoIHs+% z_{XD+p)4k(TqLbPN>3v_CUtC0cfP&?Y#UMZ-Iv-vnJ zA4JqP`?!j1CJ$}CPdS7rfAgud8U&POmx>EAYx9?8twsIzTbUVL=y#e4K>jjnllxt#zNh zin4IU_=)@8LJh!4f9AQh+VpOTLtWmV{;tJZe?ZgZAGb=kL3S#;aIZhPMj9sl?t`Tt z3NK|z6^wn+ix{~D990<gysb&3gc3&ej!fzj_&8Mx{w}S|}Ts6*STSj%dhlL*?>? z;Z)hh|71b!@pGZ9MS|$g}&Il|4$pE^rRR+)#kaq4WyAZHXOByjVBcrcw`7qYama|9UVf!XZ z_vni?E{M83y8-x|MK<@EKCE?sbK^Z|TqZ`$8Btjsh_6Pv=o!*EsU#aUG$^Iv@`H3m zZB<<0BITu)h}%;x1%f%l+Ek;GhP(1V&Ub9b*2YA9*$(VOYN=;IX05#m7N;AAZe=HpZP|5fB>|Xv66pBRhewK!H zBR}Ht{s!sy?r#~}_@k|Ey(C%SNcgoM8HVWDu;5OozGesz>paaL(XB~8MY1<`g^Tca^_>*$?G2*@_; zbb@}m-{w^N1n~_-4AK5#ni?;$v{IMcUYRbuqEQ!3qbXbR^GCiJ2~-{wp#@gno9_8N zXic$Rin2}MkLMpSQvqs2Xt9*WH9I1Kp@`#JauJdgLZYuXCoAUO`ejTtR9Yj1bSjXa zodU@c8F!RqK$(!hSw1b%xwei`hkKc}T0_-23(r=@94=I+##a9aKbj;!QE%i7r2mq6 zndtr+=$}*bU66Bkr&y!94J=z@G_!dMloubupB$W1Zw2X)^#44OK#y{YOiP7lcI{bV;TUnI!N zfOL&~7H})CM;SeiTuZ$JM447Tbd5n2MdXrpMj>qbA78*X~3jgWTE3;{)Q);M>EL*%g z4^HCy=YAH|)j2&<40Wb0-hNul?jED{d1)u9B#f%FY3c`bprRgVLAvOYw1sJ8MB(mf zS5x>mWQ@kQ0-{U-ZU@=}HK&mHot7w8&Si(sC0=7Vo#)SBalNNk)$m$fIjBMFiQTevY}Q9R-sQ(2|g*?`m+5` zq(h(#B-uGoufK8*@s*;lSoxsQ$0@g}M)UI-5&86EQZIFy-Yp@Enbjjv>?rz!pZ8F& zhIf(*Y*g1|pT$d-J`$hdRB#DKXX9*HAE>GV=J~D6jCMTEO9NHsKyt+94lfH_lJ9~} zlof=^R%=!1(Y^ud#makZiMXH|+F$zCiwkmOK(ggfUXK}~m!Te=ld=CZb;_s&JM-X_o_yZoWE*{~jIz*mESrtf+}vu+H(Ku2k?{`p-^ z71Fpcc(V*JDNDHLS7@by@t)k?o;@j~|t~ z+_{SS>2T9=iy(xdaUMRD5~!~o7&s>@TIm1v$v_jkIxY%4AtcuE!p7| z0-h!{wbl@M2iRS7+fo9mD?{*dGu!Z}24Ec{TImfBPTP{DZ%g;NB~P21wXHik!Ty%- zm-mbQ%x275gix?S7{8o9;HNIl<=f>pQhSOZTew-WWOHxIfGSw)N%mRhTYz!f-pEF4 zs+P?DGUu(=S*bvsd{TG3sy0IE%<{0w!qKCsInY_!IY;v4n zayviGBsBQ)O}VtXu5|i}l~Akf1t`LRvhz!L=pq>xRQHhgWI(PloF3qN1LQJ4aqppVX@|N zm_(5+Qo_LK1To@kw}7t8Hj3{AYzaz4`P56bw9|-kMu@&3N8(h(_3J5D157f0mN6f3 zsk1yd%KLK_jQ5KV1ZVcLKz=Q5B+Jjm{Xx_l`g-UUr(-$tel=*y)0R^*}wfTb#%>r!o;NDxO= zTw@)hi84}Gd)6QBNYD$minHZ`EIKVaw0O8nGLZkQ6Q=9JbahYPhi@U9;aOZzxd%EX zXKa?RmH|av5FzIi0(^%6E$7ds926zMql4J0phW^@_Rl6rWc|sTq$Gjy28eHq4Sx^f z|8M=^{(*0>t1H}?A8ka_W)>Z}B(B=38Ko;c>MsVG`~CNy-((1oy`(W2&}R8OF_X%z zv$I^^;jirduUt=l9%e~@`9{}LA;r*LT{v*7+MQzFE#pVx@t zl1;JcoeWbqj!FxGEHp3XmIgex(VU*paI3DuJzTG1!cwShlOdg_QEiF~j?k5`VYVTK zGqslGT}((hbpseneMbeyIov(bt>0n%xq0aEz7y#G8BjIFKjM|h^I1()(Sbs3=k&Um2w z&0;n)dk9^fAZxW!!3;(@%kN|u;7~)aA$j4chB;pqJ3;iDr;Pg7$9YzDP%(a&9}C)D z8Fro`lmAwEW8R-%)tOKq{*zraYjcD85AyzEW7EAoLi%HU$nq{*SbmRf?2!;dq@S4_ z#}Y=h@?)HK=-h4wRco_XVvg1f_+iiHB=u}~LZ1JG`> zId|rMn(Om5d(@?g%5x-iCy&q7`P1H(TAx zTvtv<7cHm-ceR!#)loM;h;>XXcZUj~hhZ%?S<2N&YsCOj2sYoMYynURT$!U#qTZ7m zr$*Tn8Ng-;kiseT(L!BS2Czv3X^H>H8z6$p*ySr3ASU`Mhd>Sd*GeE4zIJ+^o1C|% z7Gj{T>&o;14Hb;((s5zNanD7&M$2(9^;I-KGkKoeodjQ{t@H%>9RxmbCUEi5yt*KUM{73Emr9ryG#T|C;p!?jrF45am&`z_o!??aUZQ49e`svGNlADD5-Lodo)}^wi zuYLpc^xWd1*6Zi=z<9_E#oJ=}56fp0552@?gs6upvN@Ij!j4Y$4~0t`qoih)*kFv4qX&N$bNCQDj(tG>Zg`vP8LMxlQ=Woo8DjglpiZFvCsaFde8lL*+GuI@S2$iHDy6(|`XieJwcCYD>c zKG22YR_k(M6}%g0l;M_t>h8MSXzjof0mfQetjuN2P%?q1lQklo_bOX*M-FXlq!Zkc zUQ-?XpZGtm7MhQUSDmy0W%)@0rGCikqN}+9MImG{PzKzzil`!Cw6jVUJ#}=Z&7^6P zKnbqNVuKt4RaTVU=vFaN=Hpgv(O)cx%YbxadeZ~)$6GlBXj@;a1Zs2;HNCh6v=}HV zNa=xcoA^c(+-cKc?NW3v@hSF<=`{T5@N0+)Z)y^e%asa(gox5ST_F?O%h9U<`IjUQ zxfH*}5f38zstQ$xl>waYv)8Tsv_zScET8mO!X5E!&ihryi1+8j;?lT{pS6T#saBhS z_cyLlcZybey&LL}jy$dRS}Z5BeBCfk9VJz7w84F4GdWHpv@$c6yCZpUJjYgsCd=BR zD^jm_*!bi-o#lnh5IB)*uA+9@%*aIw*C0AjmXoU73F4HB>z5kVf6A{ss`DcASnpAM zH7%fJyl0=nASQft^vO zgz{*$lP}Dl`G>gP%=7f>So!%djp1{0Yr+~?lLi8c5u##vza=u~SWJc;0({kY)@ItD zp*mfPLx4#YVzyE8`#BF}Og->`jM5o2R7tl>F?N@=V2bjqfjdP)lpqmicW3=C zZWUSli|QzZ-Tz5LVtqLCm`i%E){3V`+3QpJ5+2mM7KH<;=C_dWre~a zz(Rvk2d7Rbwtg`>Ct>iATZ=zEps`qxkO5hsl{w!=2BZfjb_hs6K%fL_DdlH!B~T|@ zJwT*iOetY5H5ClR5ov>aKl;A|sT`Je;hsA}S^8(CLL;%A51mW+y{x3`Ty~4+snK!i zBy)9w>$9_G`MVXJveF{I(;mT9Y}geNifY#*vOrfe_%xlX6dURz)3jG0RgGz|e0xNE zCmcNx-sSKXyD!YLk?1$&Y<;`>Z>Z6bQ!NqYmjOjv^T83u&E#Psw7pEW^&=~U8-~7mCs6nq)bQ36I}ZiETM(J<%3460H3xiI5NuWb6hxiwaXD(lchpQv>)efDMy>v_p! z3t+4D>niyzjA>}tdD+}fyRniC;7@CP_e&Z*^?`pZ?S7uTb$KN)imK1omoBa_{W?>Y zRuW_kjjo=mGnToyZ}E6TeXSF=z(TRw8M-7ifhPHusksCWzt+06@ms?Z>s z9ZNF=%I;ppe4e*%DN{Sx_PlE&yv2eTf6ss9bzKYVFLMe?Y>;?*>+(P4y%FL5%tw$W z{^mzLKg%UWu6asKYjEY zyg!w>hxfC@qGPQd@SQW_*7;q^I#L~Iag?se9u?tHI_1Ul2-s*{T$DH;g78A4QoC1H zIenah2fx}#D$Qtu0zB#;x31DXnMT(mfBTeARLjkYH5o0h;m~LKFWz8|EBtLHrm*W-_vZz&ncLQ65lHkCdAhKl#Dfx>-jHc zwJ2-gq+QwSo?>J#%D&)g{;&El%Ya48faEn0)_t{RXbri_=M$-~S)^${OBufFFs=4a z+?_iHSg21G1KvE~e2c3}tAn!iOIYK&{M33D_-K^3srcyZGXO)o>tQv1HiG!gmq|5S zNg91kj@Lj-pzHx~uE82`_`|Lkw#V`%(e!9#QwF&4CoF4yA51&-DQ)JKG9Whdi|mSa z^TM4H=*?F@Loq;2>k5zhsj^By)uKAxbchx_;aTU7j1u7n*B@s2UVQ^ZzgusVnmafA8DriS$|A=?U_=JoQHxp2jp+O3KeT*wx6j9a7RL6x2}BEoo~|K%jRqLV_X z1<3=-OwD_98UPPmV62}8V)B_m#meQ0a3PrX01}=@)M#SCq8_#vzDu~F6qc{ z(Fy4dvofHTPSGHVVyTNz_n0?;Vu6a)emzxaMsWowx^2w)`Q@XBJ}=ow_fKlr%sJhQ z<}p7MbVMbr6{fSl9=jCt?_#zGbI*BQay0uO+%a!P%WMsmMyJ$le=%`$ z=^?74fBquV)5n;Y;Pu6slP&J_e6CF?k0_UyM0Jz*pjg~9=}-S7|9eF_^&gs>fq2xu#k6((@q4=Qed|)!8&Q^AmKzYIy``171Jm6GUkp#J~dQm;~ zK?$t&cRp@~AG6L-Yn+o#`E=NE4yZs>W$BXF=uh@lq@_vyQx*N4fQ`vt{_;q?zWg0T zU((ibu3yVgr(7F9OI8nR^}-H{qT~@bq^HaK^G9K6wWLk`{ZJp-KMme5xjny+;)L#h zL3aF?(3W4bh!-k+?VQqv2?rZFf_iP6oiSS#L8iO9(T^%nR}mE~8{k;|rLEFyh?B#< z!-e{=k4r?r>tJR+nz~lgZ~SoxK9TOdOCNk{6l3|0dq4*Qv69`nl6nzOMqvcmEY-`z zxn+E(WmZLHmGYQQL%*|so3~wllj*2o$zG~_uKzml9P{koJecz5)Ld{I>z`d%_R?E~ zze1;~vn)-|)Mza_LLXb+hWzvw-X`bsGM!S$G06aZsWUR5d{v6^l8mNY#MF@VHH4ei zrWZ79f#{-o(CH5xQ)r!OFSYO0FNJIJw8%m8jEffC!3*nGYtiv7Fufa|B8%@i+pok=Dm3A)pQEsX8YAJOV*M}g2Oaafh+ z@O3rWS8o@fgH@GO2we)i{`KhZKM!A$$L)GbAfos@rR4VFM@i`op;LcB9a#BdB4yAF&6WIn9kyBTMnpgPH(Rg1ms-^-+t1`Qk@9#^`PGuJ7t42o%exNKE^8%SS>v*J0a7qbs*~7l z9ah#rpdvoAD}Xl1O4Oeg39ZXeF&U7hT_)va#hYCyc{VRAJKZ?xuVX;Y8;b$nfU!`Yph@b8 z>M7lFCMisRik9=EHi7MVS*^jqyD@Id@0RCL08h#K*QqSqRR=+uHa(2Y1K6TTZkQYZ82HQqV`vg+n)QQ=DQG@~coRW9L*8_E6;F6N}Jl%8o?KY->2}0kC5W3GR zimpe(EbQY*1zujNK~yTLbDDp@-PtNY8+e`|=8A>7g*a)(C4ozAsjP-z7?%p(XGI-M z^KYuXq$W6m_t%Q}5w{08^;ZY!tHXLZ>VZMtZ`=<2SNo__S_2Kz-muzF3Gv*bMhh6f zw>!UtwX?l{v!7RgTMK%0UdE&1`f;2Cd zoIE1vqVH&m9&1nK@WUE_s}oHC{eT~$)`HfgR_JSH_BM6Oj3!HPwceLm-VE9M3i(bt zl+VMmmF*A08j?KfpZ|#Jk0Z|f5_6S>rx6z@>FXCvJ^tRm^vli;=cFj|j)n4^imo!C zd5;EU0Fm%4p3AGuEvGzB6$)(`PdbdJ@aedSflJ^k1>&ik{B=FaN&`lDuhpf{q%^>2EfrmOdKA&y#K5wbU}2R-#Yk zEnI~?(s{!Wb!AzizK8+F|LF^qL;Q1(v#&VKDlQIzGB72B1(yM3U$9K+*X(Q+P|y6I z$14i#r@B&L5KTDXYl>3VbS=f@kR$xbOTjL@x(~{#v}LW&ygpJkI;BS;D+$hs=o_my z1gMO-+79Xvllr)hZAzan>V^$|Kn1gp&+13QjER;8jB$OHo}FgirXUuwHo{v4$Rzi) zf%?gRbGGWI87KN~ac$?oHqU?`_QTkD$wpS-bV}wrl=p8j`R6i9QTup*pY#W`yG!?H z={j{_KXNB1z#IvNY5zfPwTiw;?wUOOb`OS1*A*B9k6FLk!`J`VF;W~*(Zt>hm`Aws z5#~+;CkMI0g6N;1rP*S{nULl9@oy%^M5W2NSGWHXZA;V&YVl(FHxujD_fK@fMV7~00qzUNRVuKeD5&+CMIt5Yb~KL z*Q$Pq7ME4z)8B=#l`bnUP(E3Po2pk=ek zEM0hEk9;s?Rg|5@sAtIrT}E|%-$k?uo8u=7sSJTSypG9gK{J}vP$LGp5@4rPse14uot_YPwPC{jz|K-CFQOlDOK zuzkUJ{|8Y(2+kvFxYFSBKS=v zS;J{LGdG`@Y=5F1L}gXbbxykGz`lq}lu7ss}3rVw4BFaLL5)*s46P49HO#KeR$+ zexH=dpTu%@2vD$`rThHq$X6f-kdmXu%y6Q}G=Tqfi(VmKY%F5g)NMBQcIhz^NHb%_fLUy(iZoI?*oUIt_1XsVhw!`XP2ZxO1nRGpgRjib6@qBZdTG@EwD)bk z4Z^j;6i&WbX%W_<2rBjGGN3xXGe<9*9(W4`6}u8qeet)e1ZbiH7X!sBLefI$0eTJjiElKJ?i`A)A|j( z-`waujDIW9@8;@o9jDqJJK}vmka+p^iy}wOr$K%!oX-IBr`v|s4bq(fln-OfgjtC* z)fHVuF|I3ROG0=$8D~%W?r}(@I$L`YFS}}$5TIw3DWX`cdVzX zVS31@m9atDb|3?PYnMW|cus?Lxy(9Nv*%B&wo*f7Sew>>diD*JT!>1i zu*AX!awm%~5q%3YS?7;SvGxa-&tyQ^H-H}cx@IVM0MK0N6vMNoud_vJuz&ud<{2im zBB-1ktdv0dX{oUC47hqAkEJAxxhP^!rX6bn2f)ppJE)HcAt93LWO{6=H;7+pm-jDG zF6sGkbpl;=P^oB~GYNQ*qBX>TI^m}YhOj7&wd>3G(|xa6XWNW_nDm#IQ!($Yyk8wu zm#X{#tc9lWvbDT74(I*thh>uPPbH3ObO?7k(+;80HzK6te#Sa)Oh((tzl+g=-cnN$ zaS3)jG{mw`1`GbLJBE4;jB@ZZEb7$ZE;LAbGXc^G8HmUe=FXvZnnlfo$O-~}*vULJ zR=&?DOgUK_Ky8h0rS>K}UIOo6hI8ClMUI2PSIuQU z9qkZA1T~xz_33EFFX{YIdQqu^`~CjA!X2FO)B6i>-bu2@#(vsr*%2Gg!Pjd{y8;KL$x;( zKm%$e@`CC*Osqmn^$Hgx8L(z8vxHMY)xPh` z0QR)gO%*$k->nQocu*E{+y&gQ&Sx=K$_Fcg{_jHmP`G^j4;&}wKM~7 zZVuh|LmQ&6o*E!xX(2y?;?~KhNfCWtDzN0WmqiK2TE$z+a|sW?GDzt(bCo9rDfd}s z#6)FQ_2PQf_0q`3FVR`W?7dU|aaO)_T=^nKqk4Ens=7L~nQJjEWR?599rdKm6(rFG z2IwYmi`|f^Ti~uj>7J%YTfPjxFrTYhomZ63_W4xZveAeN`e>@s@>cL^fTqJiT)c=6 z=BF$(E|xf57%yF^1!b1x-$SNwbd6M?QUz=eQ(law>ZP29aa~e*zQ-5Q7ug{uDn$Hd zy)5`bEmX<|TfV0^x{$dANotieK;Z|I3*q8a>8)?!v0sx<4A*`W^g2z$trmixB{K&q z3rvhftfZcd{*2eHQy)tZIHzV;tNEHH zEikjllzi38`oAGhEOTeeM==xlwfMwMQxDe=x25TF8#8=$$FvU(1}~{r=gez5gK6znsVN+Y13naX-_P zoP)g!%BR-)JQRaO@KMObJ>dOy{LUwHVsV_Ylk_mL!*%tyQ~;YWB+B*M%_+P3uQ{u) zpaxy$QG#btAwa5w-OpT^=2%--C;HYy()d>X?E_8GvZc^yQg<;n$?9)`%r(`Xz3;UFovyBVH0z~BR<~=SjPY7>tmMw+6!#bFthZR)o`s6sGB*^-i_;Z)VHOsE0w={Tn|(i>ta=b zy6{x6e3qCq!9EWzA!&R_MAC+|h`a)xQ^G11U7Plblq@>rsa1=}mG=SgKM>X`Y*HCI zF6d`;YJ})Fk{JTJG}5?qKS-eIvZpTmQ;PHt@_stb#sg09oPem4O#YFqk_V$vq|Yea ztPLt36tac7gd6lQ{Nyba&5JFmdZWcTbJ>$ppJY? zkyOn0<$aUVsZGk16430wFc&&Yp50gjus~?0j@U;`q>^_giwo)p-ecyV&do)G>~NN# zb}5g(;+#uV!04XoGS<284JlCvjLT#V(u22de?w3#md6j%Y1n_Z#@c~N3cL27Z$POA>-E*2llvSSqg0F-y6 zuCdc|ca@kRTGgkNRtP9Blb>>C1#pXgP#+H^5*msR>&3XvhgY&cJ)Wm}Z;tpnJ!XGaE<(J7Z-gq5B&TmpimOMzW2t&Sw9e;@`zJ-|P~ z>;VwZlpF2ie06IrG3*z{PcNSHfbpAllq;2=EzgN;Lw$lQVR}CX>2_b20rlCQ_g-lR zWVbry@!u#DRz#D&>+Q@eZ@RyoTU5=dSkz zhH87c`yPvlUa~_8{9ahu!;i6NQ0hsUu29!|qabttnO@M{=Zv$u?iz8yj;j5+=@C`S zgVyvbDXMc+v+J&;m9b%Bn9Dq^1n|(XuEug-22?^%u7JYc1P3kJC7qP4TD{sOWUx%Z z&EZAv7m1dWXLKZ2QJd{N?wKC4YopPV`!KcUkiSY6qK0hLq^5}C#2@8ith7nJTFE|j zSK?UaBgHo+)1Qet%GZwom7J&e<{L@l9rN6>R$GTadAcGQK;2W9(@EK7bU4X?+~Pn6 z&`Us*fT^3+SV=$WI?Bdg=~XEXh5TasVnD50OYSD#jr8gX)4v}*F9#4ivfs?tp-CZp z)1E1`oVO{|vsBA8;W_#%rdFhIv&1@qjdt=_un|~5@Z3-~nV|K%VfgO`@YrNs(|(jD zN-)9rW76-o-jDMU38>U%5AP4J?ik*G80p_;%imo1GU0Pjq%B;RlM+OwON!qrP(=Z8 z5+EG(+``Aw3M0C7m|G`6)enRJm8Go4PWFqPuJPTBgcPU0X>^`AsaZD<11iI(^D*O_ z0PrHqr!gST^nFzQTt*vTaj4FAzU*9T6o0lduck529})ZqGnL~d_D_1xY5Q^C^A5^= zx59dKSINDp7=2RDziFBh460hS{+*y{lJ@XA%ac+ghK+$gbFK2uXgbVgD&r-I91}S! zJiTg$Ty~9Q5EBg81;nlZ7F0t|TnWRMu7E_r`>)4#M!s7>IxhJ{UY*hu%eJGc%OC}6z3LiiFyhVu zK6#+@2D?OdocKNM2ubb&a_ms~+1pFxx;zr%)3SOW>bx~21LW2Lv~2*NC0xq5SyjLt z0zwHep+Ik|atmlNp!5Lqd(?MadI_l0m66*qbB*jIx|qRX0Dkmuy#o&8*LCD4G$j2> zC&+J__%JG$LX;~d%OOCG*2|{%4-K>Yy+ps6Y>MtXjDL{yTXHWVie`EL$)P@*cz^hP zRA~o8^AE(a#f~rfNwwGUtoLEjg`07mczm5RRR(mnrY9?^jNH|fNF~d9WlhBvLu!K3 zR}vs2cR2em-*M^cm!UC|=d+aJToMxY@gf4vKK;FkQ?iu8d`M*EV!hj9?!nrjzp4Nc z_5N~K`H^!5xJuxqrazsJDjU6^8-EpQ%qb{*!nMwQxIQ2)r~ z@k`=zFGEzt!pY?EO2}9~9tOmdm#0(O?8E-b56&Xo1;wCS-yqTn$`z0oPb@3$*Xv{Y z!J@=j7b`fMdR!d~YF4JB|z0_w}2D_ksc6yn$3+C6j@nVd|x;J zHn$+Y2jh_iZpvn*`VzbV9%cG4!9s#0VDOt$cIkef z@q46ShB@hitRLVo-ruAC5$`wY`59A%xiXVDI@2g^8eXi+}bw5F(FCsEVwksH`cNam$~d zI+_#v2%P||!km|f4CSwld<-kym*0UpF~GV4=E8wWQA&67K4mNW*BL?Ld~Go6JzCkb ze6RRrxi^@;SZik5n?r0XoUdOLC-Rf~kw=T^MDj_b4bk}bvix1X<$*SE0)*I~SuJ?) zvLwFwIQMpBu_S$G zse-!~VXPA>Uy?e(l?p23@ASw?Z{DlA2N|mYszK91_a;95}PN?3$ zyB1{PbM+tLFJ*tJmv3#XYKgm0L=d138x zNUs0d2q+dO!w#y!kf-4H(0}QyQXsdLBwcYi<%!~tY$fsmSrmaZ+EpYaY#~zR6QSSt zM4KkUf%qI>rU4kA6WQ~*5-gNHo7srVx_ae)r5)Ms&O>~3B##C6Ez~$DI$2i-Qa7RW zM%Gb<^tO;=1wA$HB6U;dn&R;&%7jjZ73U5w#t)H>G?KPbt9ig&0Wm?wla+mc<+d<1 zYKSMfGXAW8j0~uBvryGkC|_2e=EE#MG{Lv}U6@0lY+hFU1EecT;~Cv#4d!lv`VexV z&qEArsdS1O$yG)AJyC!pSu8@ywtD&%wsuDDjXWO;18Z<$t zMTBW>FeTv(KEM3MavgUCV=RP=rj_GEHi*MY^%Jgc>9j_@y$nuAxDqc1n;QKS>W5 ztLEDYhcbXoHDH&Ql4Kbmb`WEPhs6bzIRJ@+mW6<5RzUR$&^!ThbLDYUi2*Wh&QW$zWQS1tJrzq$G-H=o3zV`TiM_>?se{6=zQ~4L-KGx2$ zcCO=yev9i5(*0S+-zWV&W}k}0Kkq**I$tsD8liZKByj8W)6~xy+0SZ> zP&=pdO~}>}?^JOPI8K0viCPp`hiZzu&;Ef*>O1Cs8}zS|7HZ0-_OcokD`(*dB{3(_ z;`3OTx5M(u+rbX8Y&3+GF;1M8q`7`$C4Z@eo3*hx!Ku$hLu+1KF? z7{zf?)}>a2jYn*UL}e%v>5Xra#&h3|Qbc*}@$!p>Svw{22UH3_ z@et&mJ&qJX7UL15_EHlyuJz5Nd$hF0MZ)P$oSdH6_uA zyg3xB%h>+SOaR>z;+Obf^}n>Wk62GA2G5&n#_LSo^R459a5dA<3>oy~X`d4Ps@sF< z>!;boMdQ^hZHGWns*?S)uTjezz-9^O!K8l892r0j<&iuo^ou@;`B<4K9Pxfv2~e}i z*_F2fperqxU*|^iZ8v#W+lS7(m7N(NH`AY^*e)$B-M3#v*W2J^bd*LQFpOGo<^YVd zw{GN2Ii!BIbV6HKbVWr&C$vO@_`XGHf?C?f{++y^QZ85L{l`wpeJY{>z>nki4oVuw z4f(CLfXrB4od7%yAMol(C%JnOBf^bPDr1A3uK~nwR)s8qT1gC*m7zm+Xe9}5Ph1o ztUILXc6n-}o!mvYT6X|;ZnU@u-dG+@^G-jN0F#yLAZzc+NX*E3DPX~Csum1VEqHg+ z7H3xIVdXgwM1KOSNzBTu8lZASW6)1VSs4MRMkVqcFz)CQao<}IHn%WkckTZY(P83i z8qaB+I6K&e%+j@ajSuAmb3pmk*f)UoM`L`txD@JSah6x8!7>k56kfvgvz(AJfXyCG zHI{zPYrh)lFo!D%RPK3uNqRV|WlbdE3zP*qDNh*g6KTX;D_@g(kKjR-A0ky8|FHxJPB z$|=bs=YacqG6pXtgg8ay*w6_r1L(Lb11Q)(kO5-rfLvpZ3*yU$jw*q|-gB6qCkE1S z^;>!=#;!dF%mojk$+m(iq@Wu){ViSzV(A#j@9kLiRc28lZsvH)n#0T^xi z0Lwp~=yzFfgYLHzN9OjB^as2@nz<{DEc}DkZ^Nl3|1R}E(Aa;f2AD0JEf%EL7mMcd zI*WluYXJ>70aUo8bOJDf%SeE90u(4+piTXiT;7!(pIM{?({RKBoyg03FbXUq8A>aD zc^d*$e*}%JZj6r3_ zHlA|-c{S}<-_6FMhwS&|V#0wYFc52fP@FTgMRZjHH20bX%2(>kgKCsP-IW2Q8*Yva zpeMz12#5>zpLt3vl>mK;%P5&d1zm?E?nV!=b&9GakgA{@FfSLs4Ncs+5nu||+|3D3}A^U(6;Jz~oh?m3lLu*|i&j~=2dh=z<`Mt$;E;T?I$1A(8?e!-E&|%t7 zK*tENskzGRU-xUT1Ay5Ol!Y4CFqqof(pe(7sE#tKlU?dxh&WAt)Az&m18AaI=aouc zCa9ry6~qjlocPpLjPe^wAFBoNc>SVIai3vRY@6oPYZ7&Z2=-Xx1y|Tu+Q&3vMr90&Q&y61w>HfhSH^CzpVgug0E_Y&F6=Zv2CJ^4oB{X3k zcgGw-^t)WYOZPiGTbI3TNZF0^8JyaC2=CuU{ogpUU&9$Qt9Yn895S*l>{59F5H|{F zTE1{{pAT@WztIU!Y_TYWudz@vNO@2T2{eG5@mo)2uX=r+(y)>kgmnef4yrBzqDA=v zS+^~LU7n>Zr%U-c0ok|IgU!Z?GOCI7ctnZL2rLIm-RJy20?F+o4lq9HZ33*>D*M1& zIxhIWPyP)rcId84GJ}HH4@LzXm7=tgr*G+eUQsfvR1lH$r%@DD%;s4p@+IW$a;FMJ zGN5#Hy=$C*Xc@40GXcb-dmmz`T({eS(Gs08zLLEUB{82NO1llp_lsWuzv|QoXR%H? z?KHYF9{%~E$;M*f%kl0pNty%u>`V<_cAu}(&m<3uCB8o;fYof$s+B9wS!o7Ps`a+I`oVt@JU_$4Y=_{1U6$o{%`*eUQv$}*KZ)r3xta$44&!eoZq0UxX}WYx zUeVkZnDn&Po4l+-BBXVY%_QSw zUu%GpFMao!USN&`&W$AdFEYafJCT)CSpu2LD9PCL0d`r{50Uvlzu>Y?zc8((K&Hyi z%!CC=ql2Y93;pBoE3dqc?jod$-L&dTC?%FLmD5iVP!%dk#rNx^2h|oYr{L9n(ijy) z7i(mTdVswT@6f^;Sv}<^UWzT<_3WXQte=asa2~MSIzsQQpl**7<0PW*7Q)QBRH#=`>o;HQXat4wmhZ&Uj`%NO66|uPW=n5F z-3Lv23G~~pE-WZbZT66k<$Ao_N(R&@(_pb6*BhXupkVyWXH-#<)%a`Dz=jSA`~J2bPUrnlP5`Im zU&)5dQf;0}EZgD>gTjaD6h-Fflrl`HwyTg(>ACVXK(=&NkALA;;sS*ufs2Q-aWNw= zGO(U_a++Mmw*Mmci%6#F9MMiT(o?~CRXb+CEJaoSa&5m-5F(T0fvhHZoDIUZe9;6| zm}SqbNt*d_Qs_REA)^;3I7Rkl0RPc{o*4_{`J%f++4`RpA+TBv31pHG$XQ3SW1QYI zVv}WRy(W^brg*lB4zICTMN6!08NaDyM~BFgBV+ucjro;Ovlqi1HytYM8AP+-XO`wh zLuELSEGEE+4W56IOZxcst63FED2S=c>AR#3o`t;B8FLA>O;IJ6B+UHlSB{nciV-dF z21pj%l>yxS;>iGa2Qf~%3$4G6D1qF_`(uZDYQHN6xS*nk)0YILCH{08_l@XtgCUG$ zXMwD(1di=LDt}s_WYAvL}cK3E@*ymLkYN31s=z=SxG!LN(R&|ePyDy4B#2K3~(5K zVd=av{DWSrqlaF~gSwMIrlzH2HrKgaQK9=anJ)?0n7|(_Lw$AMF0C)feeY8vmJI2N zUYENE4uOF@IXZu;+u@*fh} z2hjO@dIkn=g5Pj}{$5pG-AX-j!etHG|B9l5JJt zyO;ZeJ?TvE)V~-x=KO~@S>D;;LiF_Bk*lZ zuhtmvMPcPCA`Ku8v-$e_L-U#MVXUCBPiQGoJb*7}|1RllDS^NtU}V6EHy}Mc?0Fst z3L4ouptgd`gY=IIiBXdTNX0V8h>d)c1Frm#8A+g20hK_1TY13Ye^QspN8FUrBH2xK z(RNKZQ-OzdLQ5)?Zd%q5pn1yJHI$7NwTI|WaQ&@1q09K)G{^G(LF&KZCcd2dKdtsX z6AawwpvF|-aVJ23voO9SC|UipVZ=xRM(bD8Kc5WXXn=fOmAX?nD(@@$>^iOh&i;S@ zt&a0VN62wuJ5~Nws9c?N!6!0}-MEsG20|}IvapH!rHW`p4Qb+T8Yh47bTZF9pwqgL z;9_DfD}NLrFdi3u5B{y?(Vx^We4?$BQWVaP%lF5Qr@SgLr9~7_IFL{J{o?)SiI1S- z(THe7jfJq6Bdg+9o&V#=4Sor7&r^3c>BP}k3pIHE2EZJct)V3 z<_No&*=c|B=E+hd_>oUMw)tb4iGCylXx`e045*AhnmtUd zi%XdjtP@2QKjx|bunkK%6_ju^(l_3lmzO_C)8`ayG zPaGBEe~6`85F3H@d#Azt_p|&NqCd{{$EAXQ3HwR^X}o_M^*@PukAy!SR#%T0#*N{o zl=>-g*8-xcy(3P5nlc&?$EFPsLaD=ipP&0~RJFmkgj2W9?o?PO=|ME-|jMqc~$I*X-&vRYGwoc6%& zzwX6%O3P;?8!bU!C0*;aA{tLqFLZO~UP>iRqF?ra7rv!n#xM3)Nagb(-Q_B!^|8d4 zE#5fpdSX0BrRc@`8pY^QTTSCkrSaJR(B3Ql;txd*_2A4p=w^||0R5-?yFG)VRY`8- z?5M%FKt2g^rwui=KPa1F%OMUAaDJ@9X*x21pRLmp>IX>305Ls4I|R~`noFQ&R-Z;K zoN`q4LSlf+fapY57o+~EXZhK-$0fMQ4+aR~fk z=5w1Y>l4QGl?KQz08ayyZ$zENTUuYf!eU_?>TLSsk$W}yb5fvXK&vOk->fFNx{#v& z%r07vkQs>`*1PNSYUIe^w$NjcUZAZ^mIZ^>2x1iEIUG&1$n{EtS0`UVo&FhX3e`j{ zt5_+c>}4}bqcz;l)@OpZdD|xRgIxjONQ} zPSF3I77?izLn%vF2dcH#m~qh%taJ_jqp#zs+$(3F@AM;gNb_wHPa%bb550kzDdbga ztDe~M_HKXWW7f~l1l`J#IXz4<1BDIpM_EOW)z({_7X$KIZ0b(! zXHTIFH#1r5bv2`nZ@>LKisCZ_8Xr3`Ex5jV^(mCsA}Oi9%r$V2(MPdVPYUheP5`AI z)Sy@UW{ED$y^$WR+>w-AYQNTJ>eKU7b_Seo%iUUOfKc3|;)}#{d5FXvJR)lv%Cv z_fTf=_B+O`8Cu>A?5R!?mTH?aRT=#Np$m*xEDpy%WzE|?88Gb)s0kipMq0>0%K+&w zVjpX9AUG>mwWEXg#``aA|Jqs*2!m2XcwduDiq6hH6OCuNG2erw(dVNQRK9M3;aq=H zPcR91C@!dZc9P{EN%Tv$sVs9sXrE>n=lvIt_OV{M7ixf++8w&CBwS0epY#z^pfPaR}G?Tr{|JMC9|_|4tvoRu?e-#<*MUWrg*Iv zOTlO+U6ujkd45}OOh*Q!xxc1rcS(Lb0ibTkU4GMCWL;+MZ<6x^Oic5hfkCa=mvz0< z_3Db)FrT1TAR@Ka8{o5#peV)im63?g4ImFzzWeFB!hN62Ay5u^Z>-S?T`}OWeC>GG z=^NTG-$9-Z&m_??Y`8&w)+Z-a%@LO`o+CY4b6J#TlO0zjj1 z-V}-L5DEx;J*;8rpHY!y5*SAd6RHksF!gHU`$L%+|NM^!+4#j0^Yvo{|ClIA`rV zRXVo88^Hg}8S}7H5|^?o?RJ#_Q=+b0AQS`nlM+h;qYA`jx5IIa^xupnzI#0nHBaf5 z%+n|_uvaGp50&u%jJn%;L~~0B&?bw1H{+H$%9D(L6JMWHAeX29SI_{)QgT*HntK8W zlGvFI%nEdu{7;L4)^V+>1vX)}6d^P~FbSBBD=|O`iec|@?008x8V9_Se;(_&amFvc z@qDmn#9qiD#s2H4uxb+-m*hs?GwOfun+B_C(v*@qSQLhk3KTTfIoPkB_c*LJU_3T6q_3yO40G-AoqJ`DuHdUeCxbwLBDI95znugm?$}Y0g9G>;8)q0yu=Eo><;@+|M_iMd=0>RV-1AWt8aw!clo{=ZnN=7&OE>F;kpQGr zzMcax$|Jihu#>w@=Qn2DK3}VXE5RDV{HcRlfyV1Qr--kAH)a+{Ft_Ooa9WtMb zCtT{(2Wd$!k;us?T6M=&WEq_`dd*hE!2Q>+GJ`v2|LJGiMoh>6^IEbs;MrwViBa37 zE|GsXN;5WYA7&>2_zm_F55HP>fAiBgzrL0t2+9ZU{)(WWW99}h@g}6Xhzly}M@S(4 zp=>Gv)|i@wol%lk-+SdHutSNHe$P!={KM0;hZ~oyQr18wd!xGz5HG$hv)zK^0gy?D zU)*lG%`AV2_4exDVBPPQyp^UOUf@uIqp+=_gEhd|BKkAUsH0rF?8w^Gb^Ua?T%SRVQyb|)ytF;DA$@9dQFn)e!F2@w-)}S8pl@DWOQ8aADkXS zBP|N`=atgg+Wh2gOFn_>3efDI0tA;D4ivnWJouX`O%$-C<@1Fozti(F7Rc?#WLK^o zCzo_pcRtt}tai#eKKSsUV_$Tu}Yku?+-9lz^N_pm&7O z%+=w+Ru!zmq1EBJb8d%Wam?p4#V`F_;(@$R=!7Y$pq>zK4nWjEr`CbAFC_W{@ADp~ zL9g*!c>f1b|7T)b{AiS0?EGa755@@~qUvj*A`qy%B9NW<8)*RlY_M8rS`to+hlkma zCEyYNr85epmm`6c0r&fTB_F)+m_4wt1#YFTf8R7;5?X-A{M6hf535r>n#z9fC1J<- z4Rcnlb3VY5-<4m%;-78_yb-2GH}SpAaV>pi0X8Ql0h~rN%~T#s#kH5gPepXk_>7dAh-;3=9nu89W?Tb)yb;`P&rz9Iei`%TApB19 z=|M#U@Tf7P1S-{LN}#ZL&g$xmRGydKtz^rQ(N2rSHMSP+E#aTNE0WoFwhCq$oo40e z$NIH8WPncGdXg84k7hgR;M{;g8Njpf^bHxXO$l_wfcc!L#3hl}r2}hc`JDG4Eb^8O zRv>z;l`c$E`{&*kKe5ta4Sz)WHd;A^?u$QA+Fqi+o9mBMv6=B7QTS8o_)DmN$7!(D z2{2N{&aypz&+00>9Oa!FE_m}{_q*{@WhBB-XaF8fb435uZp>W~;oPx2sIEowov9?BI9 zMw;(ovjp7$F0OddK{=#38x_=*^Ha$-k0IK0H63eD?}{2J`Px-{U0a)}N#!MPH)JZ7 zcK3;fvIfiMXOE80X7X_z@Z*)usg^FInicZoe^bJ5KV?dQVgE!sGTUbt!Xx|T;y;pS zv%4f{y4RiS$AAflK*6aCwMGq=Xz5CAH?gZdbWzb0rN3F^D?NVeg2ui9?i%x+47hEP z0ba4L6438TTMQWEeplD2#*9t{kuh>-V4197#7EJQly%@}>V#%By^X+@gDK;#F#U-{ zPoVpyo*h+OjrYHb`j29ar_W3UZn_W#W&(@{0x{cJO;f2jqw;oF;C$Tk4Ajpk^8?U) z;!=A0j-)t&x}Jk_1^o6?V)~=Si_(9RF)$2~GGjAS0-XKpP*h>_5DeC1q2g3?&{$g3 zU(r6FKGrHK)#cXFkZ=#uceZ{@N!2SbHz%bxtjA5q4XEi)rvkx)c*#M>FoU3Xg#v41 z^(rwgTqdaQQ6xiTbvcdr8t@j1=UkLvqRsq^lC#7cSK;UmHYJmPuY#&eUhyO zl-|z3q!(yJHiYw@S%OZb{4*(&{XWtUv!w6g?>a{Cg-@fBHLt6gIt=%&^`YG!vo}+~8q}F&@=w-15w%C6a^gro+Z{R-W2Vf7) zT^;n+2ht5GS){{|cOb1uJWldLqi^FTsQMy|geuSrIy}&yF+E^BB50=!a441x4H{7b zT`|BcDcY zPpy$f{$z8was}iye`Kgn3bDMCWs#4aY|9u<57Mh3DIu}s8dX52dhxf)a?S5SEBc;Q z9Z>%yg8W?RLdZYjniY-q;8$6GHxNaXEPgD`dZ04&`zS@W(v05&>3CQM%WOb0ZPTYY z+}p{=1T_VF-$z)!Q+;`c!|M#u(YJ+s$9HD?$v4a)z)!7Z84CW;i<>PWYYWoL2(N@kz&{bzz8jr5Aln~oOW`q1#-j*@2h6~3&|m-caZ4V|h-3~LBm6 z&IIsRUbBHfI+xG@jmZF&*?Ss*tb`?t;|Cz#&leI^bA@x{k6t*4HVGyR+%I!Qxs}V0 z8iM83*0P8+RQ4~~WQYB$v+j6Hb19q9Qie6yyAE!VtsE$1)nV-;lv3x2Xtu_cW8hX`=>9JWw%)vuxHR_{gLgO}whuyAM6NLsj(}g{^fW0-Y9w>uj z^J2%kU0?Odq@SQKehi}-MjoBv+VxJr`%4s=E}VD%u`t+7%rS8i#p zZ&)OCFF)Q`{a%zOKPp~*n>4`vx1ZY|(tVEDydmql!n^l()9a-T`DS}yQHj2Fi<$oG zJ$kNs6=%}xb1Lx&bFEQ97xV@=PnT-HvG^M$&=UiZ9%x7c(fIC7U?ceLxwx0HaysKM z=^RNUm(p&**#}?>v!d!$V!ds^*w6u6CQiJR^k1P3&({ELCxD#^&@OA+ia=ZgDC@N6 zD_E^KzkUg0zt#Y0QbCC&DuE()?I26{m0(yG{VW$>BUbZ!#6p4U;8D1J%4d44Qr7xG z8@}f)>OYgcNBx;1T9eyKoEjx%V~2g}ui1KYfs(NccZ9}0QU#`*fe<-Mtq1M{^MAnJiAwYK~+Y6^()`~d2E|SA0y{kS+6vIxD3}1El3(7$be|UQ1hYI?`h-^aFsw?3`BaMAqhshWkMkwh5IoSD=)q`Sm8(&)@v7_ z&H+%^<1U%)giXEnB(8tB^nVGi(~_%h3f6N1h>AiDpi2lQ3Al3x%H}xL9xpV2+&?&* z1hYrL+dGWtyIT4)SN~Y{XPq9v4_8J^Va(MCEC+x_Z$C(Z92?BoQBc`K`AZkdrY7r~ zKuLZ@e7szZsgB#!dk;-O{mC}!eu+{ajz5nf8|DWbt+5XDl9^ZT8MS-}`N?1z8P!V< znUYRT5h6SdrkYk0N_Mu=t!_{^w|5N<84$&a6wAKQMbRZ#rQ`0eG{mB#_!b%7|1_r}PZ4Dgv|b)G^|4k6b?X4e_47LzzAx+z6ZV)6@ z-+g~iG4COmE$zo5%Nw`~A-1f3c zF~bo}qdH+C1Ze&uw)OLl+w)Yezw=4D6xF^|V_t%7GXaJJfou_@{(*)Ds6S~EaMJWT zG{{(-3*FD-Cr-7rWy=4{@j;_3tK8;b?94CMeY-M+?7w+4q?~4sn3`-oY4!yPw~1PG z>#TvR{@<*e#nhwM*Fk$klE!v#v^dakuX(~mpY>!w`q}zQs6R`7N8EOw7bfEv>n9b$ z67kn;7Lpfb7yqHZT~7ip zum~wx4I3G0lEY#4!M;sF3JmUI-O-4sVGS8z&&D#KuLMLl%iG7xa<>>$*;?MUxa4t+ z?jUv!r}F1Lw=zstJ^Yyz9)LsW;?@q@Sof=l{;`D|j%&8+>|KFp_XKE~Np`IWh?qa9l{X9OFUX@e>U7yZQyN~9$g)z+P&T7ssL>Cvz!sd!{0EzQtNc^Ut8MI9 zf3T2Rt3&ura9*hD6%t)7NxC!Tz*f(CXYeWn!4FSW`P(ju8GZ$caJhc}IUqt^$$o84 zro56br(BJttW2dvK={V*g5Q4be@Gs|SO&Nz{~Eg=+x{6>E0dUb$WX4SL@iQ*`9CVO zl3l9N2|R)A6`fvb1J&|Ud-+L!gnej=R>xX5AR4mw59Rd>KP(c0xS-(cB-NBEVN?&e z*}O)Kg}`(YJZ(bo%@Z5blbEMIbu-V*@Fd{F9>*6D{bOIGE93etJPgAcAfou*!N3yS z*&1wE0~7*bH9%UlTW2g9Ku7{c$~mhp5kzv6;KUzjQH8uP=vt#zC3zS~D~Q*kvoNS* zunoptNAvaC6ho^_L0L)HS<&W(usw#@4N)wY5;$YMsJ?WXEYP8*F4&is&)GKV2EXJZ zi5iLB{HkBlf|_bQ!Ttct5i&sk={A5h zj|mD;hkNk=98DbGnB|{Q)D!St ztv%*bI1rO_d?1iWI-vn*7~>26*pxL)md^p;k|2}v<(FL5C-E<{B2fNWw*pFe;0pf2LZz=5nZC)PHNPF+fLnvfN;Heo`0^Odm zSDUl&qvD0ujd0p1?@Q_sec^&rXJ$(t0BTh=Aw+kE^3&IXUexsSp#g%)0Kfm-{-UfV zoNM#C%C{x^?7zAw6<@DbdC$O4dcfWJD=+@zHqQNE_?B-ccXZY<|3?!5;t3>!XvFR8 zEVEm9Lk4VC0<(Ic!I;Cio%6`geeN!7YshR+lQF=}2n<=-mYsn24=pc^HF`#A&&2z- z{35e~8+xD}2;>*i^8>gVVBN#3Xn;rHyhr*?uuut*DWOE1^p}ocB7v$arDrWc_S(n2^!;EWwme)9t8{F$AgA ztJYFNg7EodJJc%lK4#RN7yAWT)?*jYES% zC9pvcL{$u$(l^KVJ2;kH#WZ6o_qa=;8-2v*036ICkLo%Q{ZGA$E;fGzyBc7_lA!HC zAmtTyC;mnnAjP~YKR_NMm3ZL6Lgi=m8#tstH;u~wqu(m;uQFgQ_2;)Au^uS#4<6jX zKJuyc#RSYBNWPv(*%&PSFfsk5MH3EFiM_=BH(QPV4JRHMf!wZpQlPm zUjtCTgd5}9T9pRiPjy*jiTjy^kVL zb)`#0+(SiCT>=jKFK!H{gS0b2r*SC0AN_BCHrM~@oB#E}@a-FU4<~jGj_+2RDvUS; z+DgEqwf%2STMyVO6grUsM^o8xbhO75ZQB~xH04kDeGl(HmW3WpYCn%9zxx$!AoSa2 z1CNw5r~$%2p!ODEj&)zS2-Jg2NI7DO#!q+iGYTI!oMCZDWJsTFW-F|+U9>7=aYY$o3=Dgb)GlTGXw1W z3H#@CgN~9E8DZ*8&p=KRHNc|bncs$!JMy+cd+d#C+Bg3p-UncL8w&gGw783pzra^% zfOhf&H2~iXSe|;2Z#rTP|8`pN`a37MGl9{t{jU`Nu{O}}j|l&IA$E0P^_5@kkk$Gr zvoIS!ag`MFO+Q!RlMB+j+vbb*O}q6(aS)Wb$hj%buwp)>g0XpUW1LzCL}q)4HO@WT z8VLC_)vK|!@u^9999rQ(W!YJELa`$!JJ*Z(KO$MV|GY9&zd0)kk&@#!B_u)_P=cbp z<_NceBN$Xhl9Ji&C{VVgo8~npAea8GRe->R4zCqs4*!uiP4=Bp_KB7gv=Q1-jP}p^pGP3jV{w@5 zi6atUUVPRlM$z+yghBj#FRyX|vLD6iJb6GQ7axui$duW?S|Lb8*$2tGm?HI6Oq6E%MMYG8Vupcg|52P&xry1{kTsjK+OqS)8z8|VnZ#5Dmj@G9 z4cXhnJ;8B!ChE0qu!2`v{iQLgfwD;c9 zI^jhJ7gFCW$Dw4hFY_12maKL9mbIDPwff4Hl>9oSDDf3u5i+(?_E0lBg({n^3sje9 zGR3%}wZ8I1>p4fi-S0n%4(2oqr~aIv%PSEyoqtIc`?t1#=k*ELze>X{$~&pTdrY*C zH;H-joe4OW9nFk*m9DpK!lnJw@P8$wU59h+mFUjm29?5S_2?y5aRSkkfxt~Zs z%$()rN6TahL7r5#)Uji2$s*)_Acp_lVq*)HczkxiHHVB@k#(z$}6 zA$T}dcRHuHkC-bV*g-dJ$AehH)1;L0w5};cXIW+R@=*{@?#ul4t_NFdgL=x9UR};g zfB(7t`?MZtc0Vqb`m-{m1|TPZQO`u*s9gC_FLKZ4Gb0B)JfM`|!`W9~1r{jVSL zTnjbv_q6uEw1%Z6fK;E;7GYFa0jY($RFN@U)`RZq{=)jEXkv*)5IstpN>#nkT;wM{ zUws-r#AUDl6anMD#r+4hEWy;PE|~f%Nn;ybejhRQFjp+MSY4X_(0Si_$(K4ML8y|D z+Gue7t~An0t=E0wvOo3a$fsSRJSHNumJXDLNgQ2iHO!aU|0`ApVt%2r3@G=(Hd}AK zyDkUx^Xm`EPLOALmVTzKdec*`cJtK*i;cbV1c*FMLQwzo?UKF_XQhAE2ld;z4|f|FDr1!W^Pk=)`fLp_!|&(xK!e(52kPOBX?Y?CnD&d5nmz0ykr^D!|s?N2Q29?J9$s%&k zpJL}xoY}>~D_)(w&ngZR1w+~BKjmSRk5T=%XakSRi$BXfZ7G51W9v4t?G1Yz%BdblGIwb2LDqd2%6Vu`O^3`Bl>if^Z;3%_+8r z#%m=5l*izYe#@kQ$$&bjGbvKZ1z-PXT|LM(IEf{Is{N5To#2~xwBnu2IX}0CD%2ow zOZ0WpT95iy6T5a%uF>1J$S0mcDcQrU0lX2WpY0&xlKa}-bykAV3{Ku<)58BMm)mVx zPOz(#E%7?H?v^X6QWxcaW;JVXOPIQc-i!>Wq&2LK#GbPugWU{R{=7hnTqti3Bekh>e@s@PGGW zgt!b)9)movmZ+V)@aUTNr!440BO~=v8io0+Us`dfC;>74dyzkO;97LcwbZLX1z+?X^%X1=v4h;KgWZzuQYq88{*}#N` zi@u*20`ye?*FP3#?Qb%?Ex^NtGj_p7qP$06rYw3xODo{HZmmV4o5?>=37woKYZB6&p@6 zS)^*Qd%N$>pJ`76ACk!GQ=&9!)NEB;TjQMyu*E>}OK^s+zKl_3 zWPa~i60WM`Y~0Xwu!J*ug=BH}^v&YD%nz<}lhPC9hW%(ZpBOgV@{DDv8vv;5GwgqH z*?$!LQ@0h9?a}7{wt>H6{?{d+N-d6+0XrMEQxEKKhJKi@swI}OWLuiv>pBR43Q+tH zo(-JGD3iBm^`F)Nb!{JM>vApqN&_&yRmeRhEPs(5j<4P$#71IL#Xs<{_ZQChkQ3Ee zkj!l7HzFs`| zM_>NW&o+`UV*Y;u4>?2z98QOx&&BN}yo%%9pBvpYUfFjE08sp|&;Y|rf)19yWrHxO z0g5@$SfZo}KXerExdUYpP$zJx+Hv!^{qP2Gkw61O8CKO0sHS!mPFC$GW#t`3h`BYA zcN7;C^`MHg^}~L6rgBa4cMu(9;Luc7h-;?R2mJ8;Ten$mjhZp*e2VceW5u^u%3#Yh z`EVtTSaF8hAV{7j@~$chDHE1Sr-Z8kd@Vt9w2Pvr4-QxFUPiOCK#>RhrPIVNade{o{+3~e{VR$e zssh%Vmi=qiFE7rre}3c^=3P8~ug`jr(!vzd{kaG0!cGS$fs=5^LO1V%W%#x}St@+2 z007tjYIqtzY`Z(j_{|1k!g?KQ0AZD0QtQCF{K(~9sCrgEuIYha_-HD%dYm|aa4 z_yovG&A4rn2z4nL+XmIWMX}@tcSi(&wb@2SN7b*H(wjq`H#q4EDl=ybP{r2uv!23fK+g5=YilFG=5|!0?|dU~SD`wvhc7 zTLUYEpN|C_icwZ*?Sd1OC@X9jaIcw*?5tirbqBj-*p!lDG zvnB&rBtpGa0~k25K;%95DL!rKrJ{W*HO|~!l7sBWPXXLQ1|(O2lmRJ4KA4!Ixa4XJ zl!b|AFX3`;l_D@hzMS%#o8vHbo+URW?BlA7)DfA;H!2s>V>7t*#UjBW?%7n$GnR;n z2;LdCEkl&G%(`aQ=cRK&akSM~tF|DRiBW5D!p6BO5dTqWcsx*`5lwQ<7vpK)y_-fW z@o?9M&KzC7OU?cH8V&D6ZHXZ0yv!jDus%HO{mX3>AwK*~OVT#qyvI6VHLD}RRQ`HL z>(}FFoo-Z$pC z02jHhz;!ghQ2NHIpqn&+_W=#}3ASebWRD*V86sZ+*}$1LU}=fN7aB~*SL3o!BX;Fx zVcTcdSohds=j%cl!uEf2JOeUJh;}jKBY)|;#6L7^tNRcOqQlD2nnS}|n|K<0oTwD``Oi1L-72@;1Fg(|$Y-Wmppgf@VR?Pb zMb^$LPr5t2GOMq_quMSt=eObBpysLvm=ezKvT1d<4NcU*_`BIbSX>9iVX458y!)TZ zs<-Zv+?sC~OoBnj_S6^OJ_wJ*KgK0Sd47&#|88e(2>v;jrMOQ;uST~?gX{N$bZy3l zt~*IHjI`uJ0szk(aGnMzgL>2CHysNkG=L6=aKnKLb?mqTY#OrDNQ2(mJGVzxsvWIDxcKvmKdvIi#XhpLlIyu8bUN;isbd9YU|krn46t-GHLcq6&IE z!Z(hyTiPruQX>s0S>>oK?+D!yO-|jLs?yYJ^oOA#858dnz^wjsgggmV_*ycawfH@h zVnW9A<&Tn_FaPkbie3Y;e1N>h)61fFFA#o=RaNBnk`o|rZEiTdvu0=ssdBvs^cd*b zz#ehWGtmt>-pT&GvMOV#sXFHW`k{`~?87GWe>)`~w)Qm+c$=BTCkg;OM!-ceGZ|o9 z15oMwtWH@1_gk)jNGfm_L2(6?8d)rViC9i0X6hT-d+LT?#b>}&q!=Vy}a3gPTn4Kx^}A(i)|a%^ivevPVK1 zolDSjO1-M(k>c&reU)DtCVsPQXD3gBb zYg&f?I$Mcj4&9Ax`KpSZS%k$^Zz-_>f);g0cUXU?E(P&9(Wfg z0PW0GVJP@64Um@L6dIs2C4fd#fa(q4bibNQ#j1aLLB^F{b0rYY z{biD)_NArSP6)~x1Z+tfQ68dj(&BISruBx&!hU;<-4E*Ey<}L7Taf?Atw&v2sdMRG z5T?aOKIM5xe~O#QdobsYO!LlN6IF7Ww!|(SiY?C%kgkX=O{-4$Ubx5)z<)+EK(uzd z3~-udJPG;9u}@s%*7FXMzJgSk9aZIv%%0VBnf$S#Diq^a!8+NCN2dPhnWIg)Qi{jT z%4-qaC^~;-_#W@41whN*!0FZCp+Wp2sYXWV`S;D`bjaD z4WpHC*VrBM6No02!IPHmpm3f1Aqnvuol^-S-qZ9I3GQC#CglddSFIp8xXXT@u|Kr_0mBVlsPZF@+Wj!N# zMG#%ZW7*m*akAPURy}#;$-TCkYExF>#*IboSra=;d^wrb4B{Z>jmk0)KZWP8gX{ag z$W3r{X0kYEOG4r9Trg0&WTjsjK5M;5^&tBt?4K*jmf>Hpe-;QN*?-a>6YReY$GtEa z{Nu8w&GflmQQXio*ne~!O5h{$JGegZy$gvRG#`K&-_*WNIvhxo`%3&DzaBgF%9Ly| z&6W(v<6MaX&%>y{@o>F#zA#{3*++ct#qK=J>Xr-RmU%}oh;oDpnaL1&IA>V}gXTr% zGnFr=$Msou5#HmlJDqXt%NPfPL?z|96m@ZR$8cW^`zqXrR&S4oWXbs&ZEBqp|MpaY zl?17LQULUf(SJ%Z!OiH|Q{}VdRMP0ZG6FWr5=I0qU6~PoJnSN%C6u0tu3n8JEB~l8 zq#cSOKflH6UsZm16Xw%_68NPj_0ki`Gm=d}Q~z9~TA3+N;dRc2lY=>lFQO&SFBoM1 zG+n@5^wWJ8HUlr55Zd%Y`fhss)s-8MYZx;0Y<^ znH3o$x2eKe!a>_aQeS5|Y&BK|Ob*+oS&MglDjCP~F1jS^=n(dpw|7VOJPf9RUNU{e zXYygKN)@;YS=oQvSHZeEb7}G)lv%iZMXmaIse5@my7i}!au&m*xj3~VxT*e30ACv< zadDS=s(r!uSe`cmTj|9*JSze%zxebk zpIoA}A{HrEon(gUa8ByEkAMD0P3 zq4HEk*6=+uf`)`4Umr2j+N;gtTY|yrkVq1E>W&q;z6+8^lUypgFYWUsIEv4`~l9O#;`ML`n01t0)`uWEY)Hd(idxZPfaDDwB-3@Z4;OB4S3V)D zADQS3pY*7yVgGvd%Sw%8Vfu)?=CWQR?}9P2aXHSzrC7JHyJncJ+;h$4iH-#In#5~# z&by~VE56>M*_8yUg=901DzelkF;+f<#8N>0jESod z%1yDNLdMx^a>uwYo)U-XGp;YVS3Svic%|xg!ob~&X<{WI_*ty#Z5`;VAC?}X{#pDsQ)0K0o>PzYB51OV_k8ep)FDQoM7 zrGfGx3e9I^C2|EwaxWO98xiEr{bkjb(cdnAw5Cv|bTiYdMhCINMHT#<0s6X7nb zpv*{SyoZzWl1$U4+m{R*PfGo(OF#@Jt9j2mdiFXNzrxe$Xyy(%VYtH{K7fhCBD;ju97G3@ieIwGl z#;;6%i;DbaVfrK!?h8}OW<#$!S=So%v(18ql!Y-rWcX(XEvIKsKwT@zYR+A8|1<1g zJ<(wQ=i%)O<1UDiOUd@)~hp?Z;f)NJ$X2J#P9_go)!MD z(Vg;N+9uCS%$Krt8^U=tk!6=*yVn>+9EEX2oXakqrZ%e96qXzJ%W-evCaUw-%F~TU zrLfx^G^Dt0sp3vs1gPeeT?OjGV)>5*uTPT z@Xs`heK*PrY`fP_mI@F6z$Z@zXq7X+E)XxgX~NHQZ*RT^2weeFG9YI!^`-x^xxdxc zP96Zs>GctzPs$2_YFQq(vI_sA@#e|kpv;{#N0-6Ys`s5gnW7Nou;0HlX>-Ctypdm5 zN}b>u_FN;bxPxRAcS8O{P*+oWCreovl#7gdHQg7+Ut6b&0wxLaW7aBCZTuWb0;vjA z1C#;PtEFl%_5=v7B_9JL+5E<{?AGL3dPMPX^+fqbT9v^&7ia*sPESv+xC}m>uoHq= z;`lMFn_emQUwY>e;ZwD&SGt+x< z8o@u^nZEI&`?g4@O~98+h5K#k&}+Ik_}Y{^;@eNEIv|=Wdl| zBmuQhs{&S-eFi*XS^j1V2Ps3pRxhR~=U}u>XvowZRoS}7L$N?yCyr=<+NrFW)l1=W z{c<;Jgpr;QEEqPw%uMy|7p!jXTW@LN;kAn-t6t3#>l9)U(3HPIG4*G~bs~J)VL$3m zcCaH4Vg~Qp2s91|{^{q1Lii#qz1uym5Fh}6&zudsEOi&&Eof>0H~K$pc1H%}jF}Lb z`N6!P(z0A?j{eVMI$O)1h(6<5o-LnORQsxq{?tTH=8ZprmnR4wohxB5dFVHvFEZTP zp;VeiB{f&%v}LJf8!C&EO-mi?d*z#YD=~e(XKSs#o0UBEAB-vbIq|lbXwGuYYwmimQ)A ziLKW+j9fJNSDGBcX}37-PH6Y9g)0hs0o3;LV)8|J@>{04yW0b-^5l;YZ+aN>;~i8D z7RTkm^22+!CfUDo0z~ZJeIMu8KL8woaX|LW*zzT*^Poqq;@(+2#nJ_5)wq|65uGqb) z0g+XdrZ{@M+n1%V)JXQ1XpFG&3y!YIhC`T26uW2Hm57cjL1p^F9FbQbsJ}GD%DuxX zUv}86SD);oySFo!uv0qud81seP-}Gp8OBsWEu}~Thq<$&q$qL<^fi)lp*eL31u~}Y z96gy`Yx0q>;XvAB(bfRLs~6;Ak^JKQVn55nBrjhG?D}Ae2p_L@u@RW+72eVJJRPSz z&kk{yE*bv(i^Yq4@!(N^c03t3*z^Ntw^&YN|K{&e_CIo@1F(PKOh5nt9|*;s_s<7t zXn?2+f2shhMKm&vsLhGRR1xDxl{c5RhWf#pW?4#0xrj766jPDEBnIlJuSrRjDmJ!6 zbvawh+;StArsqy+Px-A^C_fdjokyCyVr{C$kur_jOEQudn0amI?%Ijy zu?Dbnf=h`l4d5#_Vb^Eb>nj#PzugY?SM8}Dulz_bDj%}=b;dB6`FZ+$p6x?oc)c!6 z#{zNo@0Q;U``O0+Ro87`|I^X`;P=4EfB*nKe_yb@<**=vDGd-F_r!)f3WVMOo?S2g zvuM&^t@uR96qR2a$<5H3D^zJwi>=2MQ(>1(wpdOtq%oL}#pNGwv7kEW%1+V}OZ1I2 zjD|Wva3~FDh0GeS9gfl5C>}9MSE4X78w&%L(P4G!`K zi{E1Y{N&#>%RDaDcL;DKtF(0(*<4j`h*`9%pQ1%VjaG5u-?z>Q4%wdPe0W@Pf88g~ z2uK$ICFX5lQ9R+{vIo_iF4O(wP9|x0( zFVBICe!hzR!+QWg0037*{*)9q`%tiFDjuc6i}S-WTN7fbzQw}Y7)z)NK>4w?MMNv+f$f^8FjTkIbIo&pE};G@u7rf}E~(3}#G7UJ~J$1{(W4A7DKGu{BJFjNWL z8!zi=M+fP;$|=<@!n)~LO@H_KbR{7!?_>otgC8Z4|2npRyUBoQtMVuK0xqO5)rY}I zr3@Jne^v(VRg%;3TM$wJHQ!g3DO6B+)@%ap%8|wv0c>C9DhX@}{Fk-&bB&>D?!^)D zCyJJrwNI12?-UfoS*5x@uK||Ii>-0xsoJuZM$Lpa_5*m`RlYU!*crZCBw{(c{*({> zjnjSN+Ya$%7I<|D+}^KSO~>oP{K6~IH2KSiwO(mR{pnR%Kff;Zf9yoYb{5l*$Qb+Y zuzB`X@Dm&|@fQG|0tf)$4e)|kpn&7ENwMjtUrT7D3{E8`8_9qX%3jAb?Gy0ZK-K1C z(kjmbFx-MYmgCi8nUc6-MdD24k1!${_AePGZ-pg7th!FimFf_)DRogQi|uT!*Rs;l z5|7c`0d4Sz-w#;*Vs=Jzxkof(So1e8SLK6r86<1%9VwMW9H==5Ky<8Ef{+LN_m2wm zkwvk8m1?zy>nI$^w6o<0P!Fs4Nw1gR3AJFq{YI(jsS$oT>YQl8{@%Pw2C)`}nblCq&CEHI+*BtKl+CAciY^71&a=tfn zD%NX&xQm$`y3K3M?u~D<+PGk~i|241)2IijwDx|dc+(PB--h~%j=P*jgxqivD|(8r zj_TIc&;asTYw@a)wL$N7Hvp#|ZG6_39PmuAE@1th_wri!1+hMEtUPv-2#oe;%u%c%3xh3SB3FaM_}xC8)@@8nZx*h zZSAdXEP*;HEWJbx)f6o;z#A3Q6sxOSK7=|kpr#T#e+BUMr#CHFCJXe8_p^2RC57#N zxu8xdD2wR$qI~WvUd_zl^9omrV%sLu6Od>1lw9fCP}BqWH>%6AEBSP(fBhZMdWt6U z2>k)gIQX8m>HqY&wQ#_avHlEd96 zSlRA83odVkae$N}9CIv}ULv~U*6^96|N0}koH48~W5C{@@*2}`;rBttV0+_|%VXYZ z#eLNfzn*}{xMDS(D6dWxQgLidu4a=4a5kc5mo9$JY!KF(%%BsyQjR4vvOJsgAKwru z#`Cq6@E4ckub`x&j*2wFHSlQ$p7++c ztI1g-3Oq$Hw}(=uKsKUt18u>3eA0746y zyTc6e*1ma$B%m8+?onz)j>3|pvsT6SMeb>>{IedkT_n~B3dpoK2f%4qhkwNyz&43* zkRUa%$)XnMm*?Xt3gP_}vwJ0zb|e`S-qrN4%A({sRXB0s#2lSfHt*a_DE>^=gZ^pgTWUo#m1Jf}u0}ZnP?qGuc-i zH%50i-bY&4X+(6$bc&2+2h@cU8|2nRX4|wu`GS;MURCP}NTl*7xKj&=9LfL!{~8Pz zXT-y+Hycp>CaI~E{A`oTv!t@*CV96^lkFephdgvcfZCG4sIr_PdoYsmS5F-#T`Tv5 zR+pDkRfDf=LfB)ObL%Ick(OIn}SVQIrtd z*^3hqHewUK)FMPH98DXHeh^udmJrt-jjI9kW-a9Zy0(8=ctD}#b?Fj>WGW_Vs?zmK zM1!?XrQ6e$1poM7{X3S%Q4D|cul+}KU6wNxy6Uirh9t;MD}PkeZTe@ejjtLjJx^XW z^8It}%UXgjwE5G+rKm~iH=tU;?Qtzp{8Of4e?qYSy)1%}8s1sW^v)vuK{Mz?Qe&Dm zC#y$|^SABi277Wt+?z&y)`d!X)@^=e;oh&*BTPXL$NY@2_VS4fODq~=f>pnY{e$`g z5te`b|N4K2CjsEvhyv?(mNt5p)~|^(S~{*0{Q4EH!Ke7TB*4i|YzUvom^W4W52ehf zX~%!``)_p26yRP_vDq>`pw5b)eh_?yUGm>^7u3q4ik8TGpm$1bivh>>FA@)}suVp2 z^px6m2_~zv4bD7ir&@0R=wJSMuM}Sr{K;SYj~uOOTG=?;xd0RWWv$^sA#ROUc{dss zYJlL9{hu8_fZ$#v`ka)(d;lkV*?i4ukMQ@@|Arlsw;Q|N{{3J4p&VIw6wv?g51D7H z^c-yI{i+HUn?|&PlYSL+b6b9NEw0s{PPo)x9&E9HM+}S+^dHmC2HS42|6u{Jfy#sZ z0}Vg`0Pl^+j=ra~@#BREkMSH!a+?B%AN(Z(_pR$AE_S*72fz7cCIJvGsj1T|vpsKv z;nNNBUCsXuN^N9QpbeIh?9N5~l8dKIJv=??AA}6)F7X6iMUznvJ?;0~Kl;~A-rp;O z$GZK=!!5v%wfe%H^e`f=+Cr zo(95oyeYpyuJPcX{p=sh{s3nHAwa-;lWpvuMOs5fjSCkO+_CG$Fkmty`g?zql^4Bxem+Jd*h=Klw{Fb@k_1&Yhab>8R~Ls|ti6Ivo_# z19EL{zbJ)ZX|gLlO66+B&UzsY3}^t_H!9BVUqXD4G_+00f&x>3eSTr3gf7>aj|$SC zquWcztY3v_QbA77qJZkg*|e%?ZJgizq8IFZo=wzWB{;_LuQKxKRS|j~9WZ;~m4E;M zJ^{!20k#$xuf-=ye*CvvcDn)TtWCpy@*!EWlWb7#wAM}$_PL4VHjRKHN-2%*f!N8k zqvmuiyY-+umDc@PVwz*yzc;BgF_q@5hIBkrDqq2MGP7xtp6y&ElqLP?zx;Q0(=Sdi zm~%;`Qf*7ZBjC*UJfk4X0Lz$TNl@k}v*QslrgGNq{PCv;hz9qFWl0;lAGikSiia+5 zYite>tTGhOWVa==SDL14=jYD6*!%^INIbjaRXqp_Uf1<0tXDl+wE^CpPiBpVijd7q z9)Uh1KZ5#iWdCEwQ}NG^`v-tQKmY(Af-^M0h$}!Q2tWDWNe=1$Llh^5LDc<~woc6El-*V$Y zw%${sUyS$L=f~Tz*r)LJZzd<$L&6&9?rm1gDBK3Wf&J^viACwnqT0th>>r#SxCS5q zfG>~UIms0;V9R3zL8As5|JEgcW|V+xg*4f9+osE}%`udHUF};|<}|Dr-FdXPj(AZm zWD96oi!51dCv5+vNrUX)8d5tM)4GQ8pdReafyT&r?u8;I|LJ@|d zU?oS@FRgXmO@isQG(v8fSrt?iEB!NVt0P>#t;NyU!1wtw?8^XU7q?cWB<+&k1iEJ~IXD+GVu zg(;w%z7zZRvU8V>(~9UqY&ll@a9;91{>wlATmR`FuMu0;k02|s?Qr-_ru@8aJ_VM# zy2R`RGQik+n@8 zV{t?+$#QSCxw={GwyY|X*{>j!M$vuAKmYV!{JAbj?FcPhK}rv}i$%3MKb|7|r~l&5 z{`PA?m|nbpU-=t$AG4tsjp%>AOpt%VYm#mi8;Aab-)+YBMqrdO zGD5RlIZ10Xfl^4wr-i$~vx3WJGuU3Feuf^i&_ zgVl^4R?QVlPfHNJi&ctLZ>`(^7k`m<#?Wd0m%q?eu%H@Vx~AZ1n_Sy6yE0IC!rNw7 zP=ArqVgH5!k52X-r~c-rY}r^{>ua?9suBDamJK@0h9Ty8x7sdC|35ciGvk9 z!?W8Ouf}gZ*He#j$^fZH!scdM%w6DxNys&bTIKKrIgo)CS&3prG~Mj7f5-68SyIrl zHowo?KzV1hbWH3&rM4kIejQFcjJ7g+Y%OH-N`9ui|L~vx+28r=e=KHv)N<|-EoZ7g zHm}EENJZpX0X3syiT2v%5v4|Q5u~SyON%))@$H@p1oEmbkE`nhXxE$DUjC~VVfA8x zl+IBtDRDR^x4YI)@d7LjX6#>W&R%L`-zfGK@~OYmW(UtQ{Db`iZv_Yd;KOl7IMD8r zLramNp)9&~tgh;Z*UQn=O03zewX#nxR#7^hBpme0KT0_?O!!U%JX0Vgh&o5v{#)f! zEuAQlQsaY{#10&{qDBLHI!yny+WyL4d5T7Dc&C+pQHYt!TteY5D);s=i>|w zz~k(v3TJ6U8IV)fvkx*brv%Ds_w6d^Y$OIE=Bn7THQzQ7mCECY+&0|D^ob@?x}N)- zrC%NSskFqBOI}OQ>fgv5XoG+7Ps^-d_vW@#0WbOhkpIi5snMS(zE!ek$6MKt0Kl z=Sjv{(%Bo=;G^{|lj4sve$KtMn33)alGf^oPzF*^ghao0%0Mp{8}aX~6=FtLL)?N> zV{#%`p-6l^h}W0Toi`t#9Aqnl4mce6GcVHTn=~7%6J6#O>;3@yZ+r=6xHy7;fF}b2 z0Qe$oGT7fwmH|G08Zx90hyJrHf=IRNS^QeY2z`xaW~bu`zEL^WPU|H$#ICPBZZlWG z*uP_!EZO?n;NG>hH*VuU_^1EY?FhTZ)2$cBW82t}a8!#|Ha9WnKmLb*{%3#pZ~SGi zIPp)p7N6^TOV}pz*?1CGM_-u|U}t@}HgZ*hdnjA%3*8lM3LPm-Ke*+`4v-%1!{xYb zP&s@VQ)d{5q&YZKIJ=Mq>|>%P=CZa<80H75e^n_bQU8P3Kd3+O5?~b|;JvZU?!IXO zpSkRjRldE7WzD6+2jZ$#ML8og=>CU)WU5<_|Ir`)&UmLo&C7V=*~=N3YiuvoSoz1s zt|(i3+=gD69rmwUJLC-*H~dG(M@;@M(uMqY|I@$SQ)uUj^`gy#zWP+@jv6%apFhRbUWk8U$G(c=+cbnSa?)*4s&-PjN8erO1)qa>UAN-5I_ycQC zP4oZ#_v!FjP>NJaFP9VaZ;yz%0X5yy>hRJ8ue3H_j{<~#RD@N(s0sETMH#{N54;25 z0RX-c=gkb}RSZZ4pZ%u-SemZoQr4T|Z+r84ZEJZ;g8CveurMVK^sQTtIU*DHN_7m| z&3Z?65aT?`-`$L5Xi1I+b&0x5@V^C-YJGJ{PxpgvbNvG%CDhA98j8vD@$!2L zczIyU9_r~k?S4$$@zVAsLl%n$@X`>5K>{( zydtjWzx$_u=6j;r8-b~lCYMdC?5$CSX47B6=hDgl{-6EX|2EAAt`=-zIF&_Nn$BBe zTGE>_vN$V*wv?Wo?AuxxR5z&;{crZ=Wr>BUn`abe^1zY8eOWrK~Pw_oExAdP9u>a4H}GfOo}F#QjunKwVK}{nq~qm*$kY zWD(`Bo-t7x1VfYUuV3Sp%e=HK3C{*8lt%KCLTdKZCgt<*v0O ze^{sH1CeR79*ZVXB-+KwE=B#f|K#7;dmDD!<6*XC2OfsV>^{L*?rb5ROoT}D{`ddv z-~R9Z*MFH&Y@*Ohy!@xD7)?)_U={C5ZsQujOc-b`4622w{n_T+(IvNM7^_U4U=XUo zMN>FcS+)LEC+dJQ`@q8J~db3WITdFdX`C(%0I9d60&^=++1;sXVdF zZus@98!;a(&$>>0Z6ad&LR*&qxSGZLTMJ9}e;dgm!=_WZ)TM4^shbp0uGii28<_NY zc~E|(G7+oYFNwE2tCzLyWAQ*X5U5Fp{dxyxQ&>^M{%9Ky>LNfTlURVCtr1ke9&Hay z3Pf~!D9y!oy#y@o$T=I=molG0{X4hjehI@rJPE)yKmY)5i8ILh6D9^wMeD!Mscobs z(=kHIFz<{&;etOyQ8BiK#y%R?)@$uhy`Jsgo9!x&)K!v91K0dsMfp^q81nRJzmas< z^>=g*C@JE|2xZZC>dh;?iUgS&=kCf;CHKh-m%BgLE1>urlgn?U-7Q$BGJ#2L<2`kX zn;_(2cK>0{wS$ChfguTd>u=ThiDb)r7SuybecC{->+EK4xDj^o{=;K_T=wsJDxL$d ze_%5p0D$+ydBpkHi2>b04y{g*g@+UqOP#J%EbYZ}a8t(t?KUo+5k&|xY3-Db8VRKE>Z3AQ)O6%TSUCjN_{(tko z|KI%Om|*7F8rHm>TxCJ;ctYI}eD)M^4bWoMo@#PBGIj#+0v7)Pa4tr5zW?{A6M$!y z-T>wVXtHhQ3*a+>_{#l!vaTbFQ>tE6%%G_7x%FP7{$bR=9vjmD$MSWse_#(F007{X zK|#F6+3GwRbXbEGm(2^{Y$={w&^a;FBB6QtO@Bfw_{XvLtGE??R-gd#(&Nv%N2Q9OY*?jUwcEc+eY;NdN2@L(c{$C04nfo zWHLZQ1GN6O?uL53Lo)$nGomxiYh>A(J{V%Ir6}{-Ryjb*V5i+ZnkjPtvmd`w58-Rr z2O@ufs{sN4cr!eilpk1Qx0qa=jj`yKd`Oakwz1NvXAbF{#LI;~;56u{JFwxWYwXs) zX9B2#&54;VN~vn$ZZWcax0TUsZ^qVimX3p{AqgmfI4ozX=9E6Qv*Pq2T8jIV`mA@=4wOkFd1)AYmTzH(f^OM{*TkgZf@uH_*FPzD7_qZl6NQx#8Ra9 z+wH&kC;#^U@Sm+~0hPX8+^edYU1lR!i&yQA8=y*PFA6lXGk_92qfUTcv9@j8LE&;^ zuZj-ewtFNO=SRu4x`~4B9nlZGRUs$t7E?mOn$b0FD*V`XAlM6RqA|mUe}CB`kagga zfB*o1XLtiP)A*>~E%84=NcVb*{i#f)rj&MTZN^?xZRGm2Y#?GCNCk)V*bR(*)3j{& zz!810QsqWqk5B65507$}S;F0x*PM<t!XZ~!#tC} zeN_GVCzR4I3bgnkSgnUA7Amt&0C94_VBaOGO)Gfxyox7+J!#^d;3j(gDk%ee(-z)r ze)_j#%^x)957F*^s-EG0e;Zz2Ch(nr007kiMt!)q6}a_0Lg* zee>*~TJY7BTF+kU0?p~~k3Ba!_c!HS*1b8*;j&t2DWcnL!<^pHCtk8ss6SN)_77Yf z5C8!19%;PPX4*uz7w3;Da15_f^C-GuFxgJG; z^Nk2E&1}#+R-0|FQ?Rc^Sw-3*P;zu?CH`ou46N+d7$4DDk90bweZNKBdPkj8^W<=eLO?_Y@?+{b1D;`Y8t*Hj#Q)V_sV(@Xde#0Nw+y zUo(Gae2&J%<@Bd!vNXdBfVx!GIh8A6eC|F;ow|^b99$kmgu6!n=YK|55c1Ir{U3__ zaamMdEM{y8RKoxL|M_oZ@@kEg$451io@VT?0_0~^zqur2E5L|$^5g%_|MYMEkN??U z={%fTROH@tBW=85hBN@F1?B`$X&OJB(%5o9gK;}dEe)icf2Ydp@Sxx}USGu^$z1i< zeOcq?2Tkd<=+VShNOaaI+A|FxYM~EMf8c8X0RRAd^~MuS^5boILNhE=CrQvBraEi? zZ*EglD)3V#erh1}e*_)dzZk+L-`%zebUE$>a>z7cu~B?~I}M$o`pOhi)w6}M2|>4n z7h*I(sU}(#reg^2@50er71aDZYIUG67C-6)zYz8WIl5)0rJht6&!`#`rkyHtq#I^v z@xUVeyQx3eKk#0F004l)FsuXyDCaDR=Ry0^Vqh-?E?#^YGu$t~ZCSr>ivI6i%kV5= zz2^OBv!^3}8Uwt0`x^K35jf)=j?$Z!*aAn===h&n>+J4GZsK*8!K}%jZ(QZpDNp*Y zyl$oOo&Y0%*CXES--)$=2H`J_I+NYIQ__LwmOmh!2E&kM3GrOC&&8-e*gtS8AOHa1 zc%1DMr~yA48#CUj%C={9LNsta(MvKA_0(uh4wq;KmK+xMA2mT}xj+x}i?Ny5e_O<> zEeUMYhi>*G*2dJ(3fFQ>;E8pP#R82_2)^0bz+=mR2A&7v=cBpKLS@oUlN#`MQHTj> zjssgnh|ct7PO|w8?vZz;{$T&W*?<550F47#`xT;t2%U{`b`~BQ?D^p}uJf;|cH3&Yir(GkJOH5B3i{ z0T2KHa5`w6#Fxo{=8~qHoCDjrtkaU<@A(o3LP?a$R}aYT-k1YZ|?8>?1IQC;ob#5*j+E_Ga2(k5jeVgHa)ZrNuWDq6-6bH1aD0e!+16%or zj`NvW%`)YW2wh&XUnbtNC{X?Bt%Sn@ff^)xfPZ%i8H)l6-^lSTfy0#P>RHwO`{ag# zt-U6M*ZA`@n9M#!n`8C2WqUF&2m1$}3O19bXzilrIH+zqoaJor?Hf3xybu1Rhqm?uZcCYK8(~S9r z|NZ!+K_pMjp@)o=t)E{^WAOHa1a(K$F zUR!3kPNB8y6Q!9bZ#@2|!}wS8f7_Be(2{7wFA-{@sM2&C(X8SBj0LPz;lXY7C-@d4 zt{)##THAXH+_gdT(T0)UMj7>H0!;8@@+XM)cqupS2<9f<&Jw%r@z(&Qn>SnE)Y3gc z3H84la&OD_5>gKK54;Kx003|>wvn*=ZZU9$l}07}_6TcYO-YvHUr%Vm4DTBEpYT*} zjF2Cr;+nDlPk-~T{@4HLf9^HrskdG+m1U`O*{LDvjBMNO@BPic+AFZ8Kt#DQMfcmUq4<*d$DomAijhQf31%1J zDG3CDb6TQ;Q#QhF$sEJ(>=)*%h^R5T?Cx#=tO6Saq^ojp8I z#=h*LF-H}3k%|DI0SEv9cu%nD!;guQdlo0XT@&&8Kds@DI};q8&|Cep(FPw*Jkrp; zXs3CsS7;W|*LQjLrVp+;J1YZ%0CCGrIT~?9QB74Sm6@zz9K2jxYxHu;dY~I;1&pl) zbR@hxHRfTMj6U+G0R#*CjFjW0ABzWLB@L$>YSPmH_77YH5C8yhU3hCj_Ty?&vUy2x zg$SY}+u$+{7IY*lURST_71{QF)PiQq>7BigOx5+v+UFwJL00$_(pp}#Z9OkR-nols z@U7tO<=`VHKs@8(K*q-Fu)=8>n9R%EfZN-!OhxbyuiK-ebkdQ=B;eAXK`igi#lil8 z>i_}(06q}XT*t}Q%UQmi0sNdMb!u@Zsp{YNfptIkwxpi@dw=t<{MY~3P6J3SxgRI| znyrzgHRkeqryj@u-rxKy@<=nzC-mNgX!rr#N?S$MaQ%Ixzmrw4d1;A1%U9sHqo@u! zQQ?3FG*<1s_al|>|2Tf1;Yb{NuS1^FwpV5;ibBtZWSv6Dri{orC{#wJvPX-gWMz-r zh-4h09Qz=f99f6socntp&)4Ta`2P65f2iX==UR{Jv98Cuu!C1d|L{BcQWyYBT03YH zDCCD_dbT$M{yOa>v>jt#nWAw@eaAhWjETV=;1E|n+0+j5_zoAo7xecV6i}}|OnsO< za;_npJhG~Ir$^Vby0n$)Oz?Qh{=$DTH1g;R{Yqm%6paP|TdtX2=PypJO_(|J{Co1= z2@1gNi^mC?#j$U3=blU}pi?sD`g*6z^9bY*Z{$zdxN#|EN|`NxE+tSt9-Uq1h^(#)MSBBP4f}9McvZe z%O6f;I2OigaZMk(0)3i2qNXMRB?_M}f*yajpm4fY@pMEbXEpb1L4P(|8wO^SKcwPz zLI{7Ymfq!DDxai$Ke?`@*rZi>-6#&{{(Puw)JTimcD-0FW1^dR_VKBe+S1;>$8vcF z96yqVyV0Os?)!Y4(y{L9<+8XScMr4lkL8Hu3*Qg6 zPAd|veY4T1FP$4-s$>=21`W8OV*+D@4Kz`;!A@CqAoKO!!JpV@rjB*1aBc90YQQTu zKmoM&a+TKc+Wz~rls<(8h*-ltynwA>|Ik2xgOlOcajVjXa3vK4UZ3fbxJ5t{APeR^ zQz1MebWr|F;`!5&!^@i{JEUJ5A0B0Z2gR)W(j3paQel67xtqQZpYM=#?=>_-7W zYcCb{tV>K{*IGt}e@)qjVSf4fnpMLM)&x?jrlj)(L|J? zI3@K%!nLnt0(;v16Q4-W1HO7yHk$eVd{kh*El}`F8lKA@_!vzQZJIfJXawf45`C9t z9?^nThV+Z6GqVwIM8om?fUpws2z; zlBUm!17iuI1?cT05f&bON^PwzikcOJ=%SJvWP>6HkRI-hVUfF}X!@wMNnXU%2XRXM z_7LPd@y#IUT0P2r1B zi-MKPf=Eqn`j(^()5&pcT?Ik8!=hw>l6v(B`&62?Z^0^Is~XCuGy0)*9FycyJ_qdt zGH*3^A?req%MKZB9hOqQ&0MY*{C z-UluH^)An7KgS_cY;=aC5dzwJ~q@iH+;-+EW3_w$`Kl`f-Ey*SHp&8Q0Zcc7{j>*+&Ko zb|2|_igwp7pJ}xJ_LJj}*%^rQaOyDygY?@jpXo52S^)4~)hNGouDqMvYVT+JmDp6H zU=}2$QQkljbt5)s3akuYeX5v4 z&bqDb4`2HkmoZB1wk~kiwta?HNQM++EUI4iD!SY|qaj8+v4Wsj6Ja!bJh7C{@tHDJ z12!~{I4uQ($J=wneQE1V%py`u_pT8Q15gt%Kg?!s6eFIXaJPAMf4ZXRh*u-TvXU_u_2V~&A zNBO2oyI%asvCrn)0!Dy&SuUbr2_19{y~OD{F`2#j+&m2;H3WZgWpDg_Z|PK+r+eao zMrz1ac*d(Nar*gHpGe`r^23zM^()iCijB9FacsAp?!0m9Sw0vLAeb~HvOR`>x%G`U zq>O`B1NL0GH7JXz_?)xT3DI>W3y#TH0r*`-}PF#5i|gO!)KSN1b&r`DZ}z^_^`H z1GbZYVh7vVX@RXMnd!6bDZ`2`u1_bunto!Ashp44Z3$ z@Vv&eb^xn{uJ(W~y)-IHV|ZILR>`z15}xeu`JU9IlHnJ;S%4&xzLN4K;4MA2nCq_S z!a#&BEXF@f$ZxpwZ0GhxttD;nR+y<)r(>~8iRTDfXOJqn0pGNJs9O_Ccp31N1F#5L z;Opf9ys<&>veJI2YRs&DYWvc&S6cAE;zX_&dzos#(6CHvGctoT6#r-^c>m2#sO0n# zf`{$VUWce!oNZj}<-Gu?iI9fnis)yR*rQ1j?d5#U`KN6?uIW!DcW>o!pMye>Hy4gi zsF;l9HT73%FS~`BY^{A?=91(FeBf|SfHJA1W-0wmzud8fJQ|O@7XKKT`bW$_*!dDl zQd?2uE7jxCZ|ywtpP!yiQ0r+3J_B-OhKI=>>i74F!RWj{3PTYEixHy580R?)vyn={ z+Q>J7Uk8UW$4_!|(pEz7w;8>E(kVx6mG>>gnf$RF@OjcG=?ta$Zmf-6j9HDB7Ofl2 zy*gaPDGJo=%En49{eQ`^KJ=EFp9l0`cF;p?Or^hvV&d;0xx~@}X^6~i$&95E341D(5PnT>{@`-Phr5*>R^Rd`$P)nYgve5YTuKPfT=2Xm)@?e|)Th{ct#D~< zDc=tni&P=A>RU0QKSu95ly=W}6zi@3@osC*D_SQ+aco}*oH6Cv){Y8Jh7fp3mb@P3 zEe?!*Iza!)CKlQ3|6sG7ZredZ&u+GODS%p@cA5GT6?T7v-Zgm+N$;ozE*~qVFT0WN z1kX#TsG%yH=GepYY-*N6?ri5u0Q#ITqw+a!Z?Kr&c!K9JRm*5Q`{^Aq&K)xUSLs{C zhj%=sh#_~TL_g}u7SnzLPbh9PS8LQVPG&GG>k372AignSXEU4v%_ zhJ|j-giXxfI9_)<7de)&NH%WqeZ0ISj_17Ks=WB%dfo4e?_otY>t}~KW{RNktjOG( zZ=xbfG7kPdxcu;+oe}DQ6+4iNk_bn5M=E$Hte4Keex#uZE?TM=JHIe32@d%sGdGn?}?Vgq8X?hhR$yPMeD?7&f2g|376>EK-5l^+;@qC803BGFE|0LE!YSGES z>CbY_7D088jr)pb;2n)lzqyRuay5$T2NbcBMHQLh8IBRy#iFJTSzi;B?pngypXs2l3E^>TgI6vLM^+&PC@ zwEOO+nzk%-^wEf>(5v8-#4;$)$t;oKT{Y>F0?7sIUZGtlQ7==C$Hp~x7ExoI_W^`= zlma_aDh7*C4pH3T6Zbce6>q&iA!$Xa{k!d$KZ`-ev7d-*MUG52h6kKR*B(N^3HJIIcRx~ zm`Gc0PKib~(+xBq#GD#GkYUM&(d{^l-?rU;`}-Jwlhb10);&Zxga z%H*CueANSGiU=Fad6Fb`U(S5-cfu9D$7a<0GOuK7D%#7ZT@WXB@B!1mIdvsO4eV<$ zagTNaTe?Hn>#=0JK0|t1MqzohLS%K+qqqS=ZhD40v^)m6&whCp_v&-2<;YCvpMYg& zX6GAzpp*q=dHr#BIwnc!453;?6I%vW7-%)pf~Py2**Gk36~`Ps)4|PoV*tl_TaccGWj>5uLA~~}X^GnpJ*44s z&&NqDO^@iIXh)AMc>g#96tdth>ir7A-TXts-IFX6i(7EQk+a%w0o9V0Z}g7tzbA(E zNz=9;GLS{xDl_^OY)}{TCJ$O56Y7<{MrBrt8V^39qtqqa9O~mZ;V`acP8c|3o_+a= zf_8)T2|cR5+5(*tl(8XB+_}Z09D|2T5(BQFK9=51!nooLPGb80Hogee(6y2+Nx818 z^B%geIEIxJhvqVeC3kui?*>j3AP26}E}RSWvqt6;|F(*xgaH&Tn2RjOC21jknP%CJ zFuqAAKSmz^&cUm|oen6Vk)5}Qq5l-MUB;AJ(=mzA6RzZo$j@aLy;2{ppqn7$4T3F| zl)XjJZrw4Ef_n2RQl@rH%%4O2M!FpkXoE^5A}H^&Xq{8uas6IQ!5H$k&-fBL68-)$ zc%kUtRPz({`171ztNj~!?{oso^z3LgLX2wp1U1DMYTZ0P@&bxV772TvF-SsMx|@O2 z+T=s6o<^GOf4Ol*D-$QW5i)4_2tzfec1{kZ0|M(F2|I3GXe}oVAD>%ZCktVn6EWYVw0vlqIF z*hQZd_y)I1@qj-W^5+^xHaDq_CeN0RG>pRKnxHPDAcMm+mxMjqQqhE8*}?$j5{Lo- zi605q65>`G_t&^6cRwqC>YfeG9nBATJ6yN#N%^5!@R@!H1NbD@l#fz>G?6=da!7vo z^>exBbF?^cf5lj4_Qt^`sFz&7e=Rd@@d+iXb51kL>PvuF?nPCLbB>5^y+xb~0w`nY zj^ud!qPFv?3AqV1>uzkuVVT0Z1QVIJC(DYmtiM-u@)UOZ>E5^>|H0kiZ%{`|DI?6f z5yCne)ygI5j%&`YZ{1gzk=ekh2W|J=-!ky}U9;uzJ@4$bqfXt{&xa2R!ywZxn{G*OWP#7z;mO-#z!Tr`0n!6x}8~mOn|2C-qC%T(Qd@}!*Jo|6IOtQZnAwe2V;gX znc!{F__uVewyiFt2GL4p>Ii+g!n~fO-FKQXn4kjD&$fTj)mK;DV#^(C96qsupx|Ld z_fANX=r8}`55?nq4=>v`aVS0A4=3yY!P~{U6Q5GDx=vVN(%+(uMSF&uR1#^R-)myl z#rIIn(wO3g{&%K{&ARb4G&RepxBo*BZLTgA0QSK#dO!si?YKdjm6NV=klgRNzhiuI zQ?6%j%LS#9L}T(fuh0%gEA;PAoydM5b?oK0uF*F}zvjG;K!n98VCXyFoOABcnPTYL z4!Nl$gAvU$f0b(C_KEOIWBSM{bXzK<69NE99+rG^`@P^|9q-=Z)3@mNWZcKdwpq)# zq*WaMG59p9Sp_`$eW^)SOsNv@dWjNF50Hw;_%zsU78xk(VNp9Lo8=`kRSapw-#b`V zOU!W6(U)sYh63LWj)(%ZLo6P!s-%7-?w<`u%Pz^C?TZ2}@fsPx-(34Q_9^DuJ)B1+wCFiPV&pah`vqsoF1I6rpGnw zG=*e}$*ASWw4lOYst!QKAp=?1#roxsdupyn9@X7I{pDJP++QH?@1-J$uxfnx-iq_l z3-3Y#*lxa4`%V@TmPMmX04#ARgCswGe7)zVh;d0hl~Kw*LUsRgElb z17koT;+~m{Bmlq!u_ak&#%7ixr>bb+;r>!94zZ{YC-py@|SQQ`{h=a@ z6@7nUoAg+Du)9s^plVR@zoujDS3h`aBLWt&!&SFu?hhnwav6ZxF8J?4g$)uQsmwY( z(bx@`lPnaoIEA0ad4o5j4Xsk+Eg?R)?L!-5+PaJOvu48qE?)6Wt2x}*>zgIRDmk~% z@OB?$ZO?;5db>sOO>C=h>vm(n8E(cAI z1_6Bz_*9lV&LNJMHZms;ahMZ-M0xrmog{U{D27;Y@Md0R$lJ-iWCawQwQ@o}`(OT= zF5RaE9#8Y>J(8yxo1#pM8<4;QwV{B*t@{0go=k7e_M?*l%5Ww*4g>RwioK$Vby98X zhs^@CHxc26zU}?!>um~dfSU}@dRxt5{56b+|DFRIst0zAGc!<+#hYUrLfknJ>toI| z+~EAer45IVRIkjS*X>~&7H#or(DKfA1Z?|N;t-`7);!2-(dapj7@Tuy-#j#sP@sHS zO4_vE+q`hfJ`T^Z8S}}jh_DgB6=Qla7h|U7bZc2aV>{y(wXCvUXhJyVcW2rG?&Bt8 z)atbjgLJ0S5t1fUKQ|)|j7q`!j?X{#D(4nQZSc)%$QSsX$QPjVbvdgHGut)4@flqey`3P=G>K$>Ze+5XN&6nrZQC)h zts8naln<;LP@jU5tQ?I|4+>|OYJBP?E5!Vf3#I;X*+p%@r@QgVJQUlTA*P0bH>qGl zWhKIegf0|wcrZoH>1y6izvXhKP+Tvo4OMW@_%>rm+<5F*TYCL8hCRyLh{t z3rdS%CftD9e}`x?#kuSHbq6+b7j#z*0ND5r2fsVjd_N+XWqZuO$Ws6>XB{0n?2wJn zFz1MIVe1foVI)>~mLt|F_!^lMj!pLZ^ruOGJxgV0rgc3g8*(Xx=*o)(rOEsw6HiI6 zQrM>nKr;JDB0%{nI?&F<5L0MkoFuvQ6`3OE_S-88g;l$wwC{|x zLKip@@vCX_x^8=ldtkh`W*N?AZ{MPIl5*E49d^wNkN_Dnj5seqm`PkpriVP)!U04D zmI-v!cRx{Fr(CVca(=}VAubM@WA-F(@06i3F|(f2Q+uRcN|fB9Mif!$bBIJ$^sq{B z$R>qNcv$W|^n5A=wLaFu{N&=6$=H;%HBC?$h)ulpw#Nkp7ep>&jbMJl<5nPf zsYW2%trh1rppWIfLOq40R0(=jvnq*Y=c19(;C^MFC~5M;+O>As?CKzb15dgWjUYv@ zmug}Lo`%Nal_2kj5CXtUD8cMWAEcFbs6Tu+M~1E~z9MyO4?EX|er`aSOy6WvJM+8G zH~2dmB#{JSz8i!ncTc+e7TAeYUQa0OY9`W84?vzc`j{nCctf%NXcBGBZkm$|SY{7` zD@nF;qV8lapz+gdsAIv96R`l7P43J0yw}Ks@0dXaN82H$PU&>H>{P4>`Ske3+JIlD zDlU-7IB9XMA?-T3>0A;sjsMs;9hrOOaK3t5Ss`Sh4jI`2S-Tci`N-y%wl`Bp;;XjJ ziLZDgM#6wQPK_kWQEZ_WNxB{H_xzv^i@W= zozTIj<3J}aRl7vXV~(0-1H zb>>bN_d(v~{?iBi8p5CTKl3K?AfjBVfXFB2^U=ugo!eiK&daW6DG@6k%kDAclC~3g z5$ffFEF7WQNK~MI+V=b;_=!N;_y@d*2;DUynxzBm7^EI-TKXZRB!}Ym+oQ%$c0zS@ zKfnD)Fd}SV@(ZrXWU^q`hyhpLh1KLY=5aa07$qM-ONhk`fx%03@)Yr|xZ&Tm)&s}+ z_N+Y=$Adz=qyJ=0Bz$FyyUH*bMjm>1>vX7oW5sMT7?mCp1aZ&TH&G#}#d^M-CW|(K z-u#%d!2xGTiG%{f;1xTBD;&Yx#mjUv%VOD(o&%!`+v0e=d)bHarkF)5@4AO+GoVTq$dpwgdIKzv!7*Ofask7h8AoLJaIt2(z9nin z-iJ+64%H%woZJsJD82F;O`3dem_6DXthAn`xnmH=NXXO;n97>$fG$j|lmdXqZZN_R zQsD^{SMDWqAgOO-KRQqtqjw4=*yESQH9c2>G=GXHGQ!WC1CjK%FFc4;M|iCiJ&!M~+TzsB@{r?KK|NDD#>I z-n6-*tgnkTeZOraf_bFWT9f2+5}3@3n}6%g+rr!?PpE7VELx^DxN<}|YV5zTjkb6> zI8GK0J-u#VIV*yL{&-NzLCI>=-;Y3(B-W(P22(=*^t+%bfIFx!7HLOvEOud^^ zlnzyJiC#wXMW*$mtde;O!R(l9Zy2~U14TC&d5h2#7fu|td-iaMPGU!PdT4(sYWY+^mlDUfH{833 z+^9sxKZWlu2YGXGRIbI+wfg(NPJO&>wb5<~9XuAMMqkDa^Y8SYsg^wRJS1X}bf1C) zw8U9dBX2+qypeXptrOCNFND*Q8~cbz%@5en;~~93(4QMFip2yCwNDcGk9WA`ynqR& z_kF!toX+CT_cBO>G1BswfsDKc)*>idEC^my>KqhX8o4rfDek;~e_oMcxm*sqqVY|` z;81!<8W;I9dVe#qa}GEAqEg~sj)nsRpbvecZ(2gCT+qm4seTDqQybzB>^Y~uudovZ zin01U%!d48ey*RaURi$JFtaWuA4DWfO zEU9B1WK^Uo>UA<}RWD`RTX_d3xkf;27^E&>57KqY#DD-e;|~~Z;V4w+buCe#@M4wl z^#(GMu0G+}Mo!@VXyU||40?rRS6fy=pn}*>UewSmuU6FdV*{OsE?kg^Go&$DK*7PT zA<7Nbx~xtr4pd6w_N+~df%Lb3OaqhHwBwdp&Zlogb1tI=};QxYM@-axyLr2Za98IZ};`n`%u3bV( z7ecbsmVNddIP|NUv$rce;LhikhPM!JBBA;TBMJ(1f!ePx*1uqW>j8jdHkKn^`ZDVM zSHr+_7@viwN1RRhJ-UIC7TQCf>^F9Z=x@XmiO?10C;qnoEGmG)qXB1Rx>xg{n@y1N zb%WL-0^K^f#dX$z!@oP^f2J7*GCbhYJom(mq`dXgUS3_=3KY)dV5P75Nk`K zJqAs5i&xCgDm%DlX41?9CTS{CA9g0d&aKdc1!erMv*n};MY{w5u9`Iw+ zy^M)H7=EIhIAy=OIone@M={J68zu0~6Vx}xNFhG6(B)33TLKJZZFc7UW6lO{DnzS4 z2a61qdGu{jrwWJxDK2fqV0oo~Kg!FC^yKTM3++*BqbIy$CgGt@X|mj-bE8r3Me?Tq zoYB;t)dF-`%xZID3qG}ox26Nt>fq8hVE2`n{@6+t291T zNqX3mI*)D+7v47yRc6i-%J&A(i}gX;*9~-Fhv)4L11lu}AOWnMvXJQ>awi68b>Fli z#_t(aK*itQbFPZ*l2ES@Hfc-kTz?31*&v<8+Sp;mLI5BNzLH zLu+anzwjo9Q<~Ha&-s@>K#c^PLZAOm{85n|X9^ZqUDwM#w7yrLua!4PDwbfdOb}W( z&|REy-5~7uZYgsBeAEpAU@SiW6Z@b;_~e>lHddUn@!Tg{;XAQg)~AMF>m*M_X9aJ7 zD)W2|l-dWeT{m!?t3R@a`+%bP!A-%_sPJo&JAUGnlySpJ&mlR~zGyIJ&v^5VNq^_I zG48X}oZAHUtxO6d+7j}Nf>4ZyrU{2@Ol1INY;(Nr0Jet=|gY2|Pqkm|*0JG84GzDSzUw z94{mQG%Xeo9={=O{HnG>as4b}ZgPwpTKKTdHYai;6i;Yb7~(vIwKAFaeD5Q49^J1x zzFwa?4h6tQ&&!K##Cd=SN3;P!dI9J6g#CM@JFzL;tN#f?jyt?XH@xAsxV(jPjkt#D zrxT;~&Y9rP_pp})vi60HZgCxv1njY_llJx{isxb)w$$V+QtC6p*bdRlccR(}e9KSm zp>Y#CUovBk+Wod3v6$ZXva+)3*s{Ts?JO4>41wkN9qqSkRzM>PU>W+UZHb7RHoozg z3cV4b!tJ
ZDc#Du@8p#OBeGMria7UD{TIP)MOGW0ii z5eE;>3h1IpsDXm+xIQ5IJg2k|TM*xg+;$@4)rp~I!&C2$@l#bJ5IJ{%IfI9r%WvUe zE64=H2>dsKfdX>@n5PsxNEBu}egc)w&#gATSIZ7_pF8}MDgGSS{RehF`$0d;#@gqa zvk?ioOsngV(NshP3VgxZdT$Mh3R1P=Cq$H!AxQ{NE)g*AwX1chHiC~~8Zn4O=SFrP zWqb9$bjRdBB|-H``2Eu}=`j!|94)FBA>J(w;8{NZq^42BY|U;U!&c9Vczug|W_ggV zse^`%1(Bknt4KB1j>M^X$ybBt>UUyWSD1$_q0e|IoAMv&fkGL8TaB)xKXD-HBc$hO z3NmA|QO@8^c}ji&U`ds3ZYljBwqnnEy&xUx_=bbA)|CY{eLdj= zYMJJhd%AuBQp~~s*p5Y~Ni!&WH~Ye%^N-Af)$;varaW(%F5*nmbtrBb*hc^;{=16~ zKrZ$J^kmi#_|3or(&P}I4@Ih66ewV(bW8*Q4H zX?>9QKFP3fg3`oMa7CmnfYspH)$EqW^@c5$y zfvDH_a#HVTmD$gnjY~bWp_B+oTqHCx861Gltt#Yd-AM^JG>=6nfsGni>Ox%?N_tRX z^Q}*IMgj4S6Zp{xA7C-&DF3?Mv5G;xrW+oT(Ln!f#8BkhaC8CcIqB>GtNsJ*=`$z# zVtqp9pA$>$5DIO?0wa70zgEJd`T$ad}9%W@rzz!ku6fwyij=jlLhza+q^^U`esC3cClD2U-X`~f{_L=TKkJV8B z3oR}ZC;Hp)vAz9wICFU~S%6PX0kv@)&25P+d*cA@*z%j0bg-yX;YYv9&cz)b511!3 zu$Ib`v@axPqXrX{dKkZtUSov6!qH*Rwg#r`U%giYedvQ=QDo_yJpxd3b|G^IDftc& zHnMEyC~9DZ(zU^)zd;9JcF1-0&AoTjHdMc2i{L;=rou%iasXoRjrBVy)8fd`ooh&7 z8Lrt1(1fuR6NJ#P#2aP{e0b*kPCOfJXu%<=i1Faid3=|H+sScg|NAa=O2~V{rt|>OT4b%V>y(m z>E}_SZ0&Wcz5QXq^Mu#q^((I`(x#xuyT{fF?LH_2RAUwhmU{p=z=X$R{~d%C$ms-L zfv=3`3bmN6|0?RJle$KN^VVN6>5XBgpL~gw%N(2U#8JR9D_)c)8S6@P*c>7qzjaOQ zNji}0M(qDiy!Zl)6?IkrEhpdLXWJO(v3$A)vhE{9F{;O+oj++V?d{HIzYm8(?S?LE zn-lXkDhi0&*g|7qNFVOS{dB$Pl! z9}2!QKf^K1L5hYjb@aOte{v`Za`&b1Q+2Jtarm-0Q^TL4m#TjJG58i{o)H{sd^W^A z^x!gK-@3tpMFqwWb;u#k)8UgIKn-94fYb*p4TL>H_=tfSz)UsLULF;2Fg&u^(02W4 z05tRW?a?n%-HqqpLe#Fxz3YKEfpzsDhbBlp4Gnm+0x4+cu-#t#+6X_>xxGHHZm8-E zw)DjFqS9g^&*|0s>^_R?$78EJJ)ZTH>&OT@7?AAYxY| zd6E#-&%qxzK#ha%SDk|}5<};=EpE;DN5*ShfE|)JT^QQZEILl5(A)p;gSqGmamw8S zV(rITtLb;m#INjrU-F+Z^}gy4Q9tXS@|Id73|v8gbe8&Dw@>)MtrvdCt5$HXcKYI8 zvT-#};2!FY@+1$jrIcqB&N=;Y-Bg-+AK^ZudKz;7yXaoF7Z}|=mhROzL_Iky<2>+Z zZ%_)C)@6>xqdV^M4XIr7nLp zF^v$I4QmuQGfuxifCUNcdSR(h?18UO8lkwVkWo%x!0A#4O!{$$4ZO1D-dinK?Tn<; zjaQClUi@JuB7R(TTHyvHGXPK@uy*>hKk}64V>K}QFl8qun{kQBVG8~W(&?(pR^urm zw0SmTlIBi5Z29yX0w^Q9Lw!OB-f?v&%Gn`cC5K7QoH>BF-0z;W7%HNhvTBE~e3ffS zXlE*#e^wmT1%d)u2x;XG4AsEbu@?Y`#`T=R#23UN`Tl!KnGsVN3-{#L%d-SoD`{bM zPXdQvapL(+sQU_%5tA+F42B$pb|@79z{`L3)QL+78^zW;xEE3t$amG4W!xL)AAd@i zan5^aeQy108at4+o2SHI@EOt46mBb){f6(~aBbiE?dJr?g}e*y2TcV18l(a~)2X6I zaD$osmQYLJo9f#B5HaT1>jwaJ_i#QlUQ9=ObF%--cVcf%I=`wK`BCJy%loVZnzuR+$Vwc4Ojp_h)MUY;q2e%VpF9<#f*kj2Lzrqe zkhR(u@Ogrvn9V%4Opr5W99u#Y6Igb=8d2}@y{_M0MDc4`V`{E&=qmos=}fezQEj8Z z^L+FDE6m9Egl78Z+a}vVZ*q{J35&w)69Rt#OF4(^Pu``diTRWo85T8}JwoL2Ihek+ zhqF3LuOC`c`9>RCJGnMO%v{&sY#G;?JC^?ipyshao==HW1O2b*sGCGw{VK<(ZJoJ!Bj!}w=bL9l z2qz1`rRhPXdPf+h+2h-l~P|&8ZOyE&#_;u_}Z|%}~1jN8iM8hv!wYH;s$vY;4`-*H82C ztf_KK=^hC*%VA%KK5C#qc2<1EvFP$%fRuy~Fr}1T=ICg?;oXO7?YLZ_!Clp|wC1Zn zCb>X3_T}D1aYjxjhRCy<=)t#Kd>Z6@*FIoMd3yKOd700i8Nxl|F;ZWwdrxP^d-nYa z+vj}AdU=^dcep$m2%CWFcGG_CKp`LFIAadnP1Ie~4JA(jU^$E5j7n#{MI3XEg+!I9o)v@8%^v5 zflxR&1rB4TUKghv=SCo#!LPn2Oz$@Amx{2cJ@&u2k7&xjx3@|@FD$Y#!vk|)S$Pdf zhtA(YfFdly(%&ocwjC!d;)KwnO4?@Kv#)=Uw$hM<0mfJ{K{UhA4_rZy%_5~~CwsPx z&u4sPcMu0cRat{Nt~?b$jUL-K_BZ#jChc;N&g-oJ>?qN@!Wf{LvmmZ88L19RY@zD{ zHpeX9y;vS)o(OGoM*e4|(wFpZO)wZ$pkA+r!Z_~j6t=rf<{uLV>R1`sR3RF_81<=$ z&bOA#fZDMZ?)v$=_479nl(bz5b)UzvC2L6_neF{hIIXd3r_l`apQR>Ls?HQ+OAxw1 zIZiX@-^sAT0uJ1)W&9i3w1a=_?av9=g=#Yxf7{uKpLf*?#X8uEi6{p(QOzQHu$^Z2 zoD>jR$wlO+9U`v37J#t<000@33Xnz%`^PXqyBkh{_y=AdV2QBNVqXJwkdpn#dq{xD zO0fXADZGUsdZHbP)$E1As}9Re_`#Ac5JfH4a}zynIBX+GCBrt~<C*IUJ%_t zSt@#TLwSVL>+YfMTG-tJu%;n_5cA=?vH8pf7~S%t2*W{!Eb}X{h;#zm5&LMKpcH)4 zQILUOX#vTwFV6*41AAy$7jpsNQ=$>P4)*s30MN?95aJ{v8g9xCCrtsnK3t*zLLLB0 zU@s=HTc#4Aa>=Oe0jhv?_=PqR?i9{if%`ZD(h)$A3Tu=gL^exWz++hLPTLA;3eYr& zn<#+lX9$1q!(qq)`z_%tHJ|{+0zv`X0R$xxrZHf*stjxegU755ds9C=aTSzr#Hr{nHgO%T^l zf1i%g7iY*RSmZh0F70F6QI5e<^BL)Sq-<)Vc{N_gj9W4FM!{HzhglZ;E{2f zjYRaoPJUL+djQU(o&l>-u{hQz*0hLj8XRYR4if*M{3iUdKVD?2M`t*{trW7Ap9T6uu$RucnA!H|6{5wRQUfz$}ELYA$HG}y&)|p SYb{y5o;_`Ts^BC(;{OB1k!|h( literal 0 HcmV?d00001 From f16000d0c546ea111e72fcae9ea50fa78914a5ee Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Mon, 28 Sep 2026 22:52:25 +0200 Subject: [PATCH 02/18] Revert "Add a project icon: a lock hiding in the fog" This reverts commit eda7ceeb9c358ac2ab0a03408d540acb037ba14b. Co-Authored-By: Claude Sonnet 5 --- assets/icon-256.png | Bin 18778 -> 0 bytes assets/icon.png | Bin 135267 -> 0 bytes 2 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 assets/icon-256.png delete mode 100644 assets/icon.png diff --git a/assets/icon-256.png b/assets/icon-256.png deleted file mode 100644 index 81d6eba5e25f6171bc62637295225fdb1565e5a5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 18778 zcmXtfV{j!**X=p6ZA>&VC!W~0F|lpy#I|i~Vmq1GwkEcn+|ZgD!v6yRkR*{55ma%{y72L;qPI{}_fc(n z`uVisb=gqbVb*>`GJh|Fya~=S(3?gA7eR$~&q$5~mQeNsj~IZ%;8deYKc+&bD2-}ZW{(Q0`+Uu&{j zt{Jwge$bA+s=PmJ>FG!_PNnosI%!m`&3S|A#<_%rIVHhV1)ira=B*zX%`&ZqtIOTMx3qKWDiz7Bm0z z!(q|;oh+sOm;#A))ZGLwfD*Uqzm^9P5Cv|-f`#Ef#~KuHtp7i9BA5)bWqC(A64Pi{ zF+&NJdjjhC0s_asX3LPwe-SbJ|AmpkFi%jF-Yk{`r@*b1arqyg|N513t$a61p+@BT zhyRbV?O323vtjxv;2+Tvsq62BDHd8u|M2tYGyk)2_5QQ`haUrzWw!he_#dAN@PAbP z%hu(`|K&jqmG+Oq(Es_u(N9nuSAlLFc1)<`Z8F>BF2CBfi&kjwxUZHZ*JVt{*r}0l z%YEdh{*ygc1ZW{aMzYBA9?BlWfY?rO&U6Y&q{xyeVLiq>X+GYe^ub992eTo%U(T8> zf@+ibMx1!j{S94k%;Xf3v<(@XgeUVo*TX!K$EB3iP`a`Uc-67)H}@akOe9jj5runA&Z#kTS!I3FfK~bdCYk!}E5UI5Ko@_yLMl}J!f^GoxYpZ+*L^-2e>||TIRImt{;Jxdy+S5+YSQn*P4{hz=yjxlsOLSz>F%Hi z+)cGv19&NHucv;}WHoNK)%{ibxio*}GyKBX>8YXK0`9{YY2x-dah_Z$?)Mhz_jcs> z;Dr5XChMek*dQ~+KGqD?w>fHO)_(UE*`v06l1v-<)N}VP|5f;uy`8Jm-JG^aPO)mM z3fZ1kCN*A?Jw3+K@!<9`9{YLh_qiZ^bVTa{SZeV;O%JykzR_N_lVOL%*>Rq<`Fp7pQBMP{;~&5WjB9us}snfri6J-b-K4 z&HY_&*URit?L}?{UK#nZgG*y%Rb;_3PPF!>g+=~465&dWhyPx6Pzj!874BA}v_gKc zHP44S*sD7(ZOgM>`WV_*uV1|qe?OQV?0TxI$4A-6u-`$p-~9=E?;9-{;?SHhy_M!DUe=fey=*S7{zL!Y`ITa?pXXEtxx)04GZ8Vo54 z5F zD=P85wV`h$oOfdF4#vY({8A*ZnxtQm6D3LxjpyIEINpM<{Jx4C?g~vhB8I;IzP#A7 zO^&!H@;zzb|B%l8xRC$V;q5cqe65)tq0Ie&9(&>Q0sZas(awFmxS`?Sh^yM^ebTMh ztgl!1T;zH`r{?%r_#u0eJ3^3Mc9fy0*ikecXD5u>#23mg`cJBYE=6XD2D{eYF+NvL zjS>sP;@ctazVfeL6YO5vhjqKXRWetnfQ{De4W(!N&*#xsA9b-Gd$m2Rwc}lzW9q|e zHJm(_wM49Xx8jdISL?a&r%%7yy?sz!h@XR+FCJYhWBp#&a=&uS%4gf*Igx9($Q3Br zYfmm~@T`lFtP8-1?+Yafm|g}Q!8cBbYVTLXyR$5M#}Furl`5EZy6WC5%osk`d!C9p zV)2G7`Dg2`*Wlk8%=lej7{3~}y>FTd;on%yU3XIa-g;zag#S%V9ftL*uQPd{vs~Zz zWLj~78+D0!XYA=I-<@s#r~KT{K=>p~lL@%?JB}$)`!mH-yUo7se8v?fwv{9<5VM^* z(~`+x)l%efvUMBYHRuK81L1qpD!+jJk-xi7tz2QYsrTk&S6xwWqn#=XlU!SJ^7v#r z?fZV(^3^L|L*$H{y{*G;BL&+T{M&A^rH1zLsiK+w^E38SSL%Sn?;=yTqnWu>MQx~Q z;8MH$a+3e4GS~0o)KE=0CyB1}og~W5Cwm6{+#J0%;+jwj88i5=y~BNsa**@wx^w-- zRgd+Uky4=lQgQ%+*{uy(2p_JyGNjgkpPDD+m3|hjexOFci{ASUqt^g*ZkzLgsj`}C zihGa(&gA=6`RmK{=6faob9`p#1upTKC?fvRY%71irfOEM>h{}ykKg0OJ3im_b)|Z$ zSj`5x1gyrqksas5q~6#!3JFK<-21!ozkneZ33~=GG!E!pqES#JLxUkx(jS&&09zZwcGh zm^{5inF*v=prcyrt)ZJ&oc{a+`%Z$7?;DSmngB*t&INXB`9bys=*H1qn?4Iqg!{b4EkEH$pq1scrjh*BO|m8= zV7u~MU#<1n9#FS)Egy8y&eH3{j~$m){>8)n7N7eySo?9A96ANOD}OMAe}F~xbXF@p zno)ff=6@^q`y{*q8+>GdCftoKyo}uL{3_l08ex2&p3dgg5svq_;kOc67g`0L*#>PD z*>Mf>GyLx3FUQNGGHS==vPU)qr8$2asjVtpE0?G8vL>&`54C{eiRK6eQwwiY<98&z zmsII(!{md#U@lW~*#G_3Uh8h`XZN|rHnNEGeBj+tlQ}&m@BMjg=6f&%f8?s1e)>16 zhq|`h?pok^wAiUZ?`vi8>m#0)$op`wDX^Fe2u^P3y_%x;|+H_b724Z~o2Et-@Q+{UhwJhGjA!Hh?8;Bq9M0icaN+h09~;Gu-`jaE*KWGP?5ks~;bsvRcg%v%sd)(xd(L zciML^xpFd?C9S~W2+N)SlL9emlmO@PiKti36E-s6zY?a!&T@pMdw}LydF~dT~40(y;`|zu^?Q4JogxENK3lR+uRj;`Un)JWpt-iukx|g7d=Gj{ zcq`McpkMWvH^ZENI{Jt<06P1134cK{mcah@Zw0zS2qF?78-fYIl#MyJYVh0*2CrKC zI@N(N$bAD|uuV~Imb16Y{a*aK?r)nOH%@*cfFXGlrKP*@iF^CE0kdR^U#_ORU$@+T z4N8FKyJh4AzyXbsHQtBe@Lwliohs8H2*pxD5~5GEM~gPA4k$gPWoH!Rq;NiIp?Fr# zL-X_kFJX3qKOhoH($+oK2Bdq>=F1+24N*uOQ?5Q)B;0`KYB~v+AP?g8{nqZCoH*o_ zBRO{65_0y>&hNfLKEaVttfGmzQzu=g>68o%YxTlfdjVpa5}T8Sw;Z`0zMghw?6j5d zho;@qWRJ{(szS;BU;NtG(|*1$ZOeHXORPFyc}lBo|m&6S$&F}gYIwzLJ+SZ z&VVm=6KUVPAPyVwO(&a71$+%e){sA1{*bU)n@U6&_n>{FHZ)<>01oiLmC@7rCxO%T zODJcCX~2a?XZ6W^c$GY=J5uq!xmAaLd%kogXUW9jR_}BxL*HfLB=k6=XI_8ip7_Fr z#jL>ZF+sw<2gc0D*@n`s`;hri=^go`cZ1W3FE?(NmlJF|-@~DU)h?Y5EsulLE?E_0 zM}aNWqIxL~TXv$i`(1UPldawQ^54vKB3&%0pY02AKIDz;gB!&een9>`+_)?I zT$&KBaK9rRf0_V!D#+5Lh|9wQpZDFakNHw0?C6a${ZF8Z%fqbvhIPa#>%-Yo!P{|9 zeFN;-ZwkQZ#P-X=t~#HNTe9U*Ux#Lp{>JAaoa_$BCwG60y+T^2c#J-GQd~g;se;Lukn`i+iX6OqEgA;>Ez?-q_d}8O9)R%^Y*psf(TND#?PeQ zg1bggo`mQ;X6-N9Z(in047-#F&S-^<8TTW_EZEZ*^eM7BWXsUlGduhOyeES5jjF3E zm{m}~W1|OvOa3pRAV3ZPM=?_!AqdiV6Wwc}Yn+?4bi-D96#Q%6a<4bmG)1$Q+?IAakk_ZQQ4PK%BTbXg* zRW<5yCt{DqW6DZ6ql zT`n0K1I2rRhb~bSvAz9*@2=z1^FRZXvp*u-p;_Foq|E|ZuMUf^`*JI2Y4cR5jY7OU zxV&rWz-PORigI@o*n4QQeYA9xVG03i55*CD&9n-2qqtEw7>qO{aT-`F^_uT<<>-CvJ~GF4Sk>Q#X%uqig{ zbfTzuF#f>LGN8$Pqe?9&<@>ECU zwHSxg1>!#dzH+wT->;&Ft(-@ESW92} zfoS3>ej_P%hdGZTjYD5Kd#u^AOS|xDH;BmP4&D&+4*H*LPir zMQ7p921-|0Pg30@KvhQ*G7M7{_yx?)7UVw$-QmvV9IGcyYTf`-D?kepH_7q|v` zxOKSFDo#&VJ5MT>qLA!imxbn#xAnT_WwOTd0tBqP z#uiza2WK@5t&+6Ipbv+pSWZc?l<+LQq|x!z4bc#?_Qoh|RF94elB z(2sHX!I$y+3M;lRfmhzQVbM>dddl@eZnfIoBnN-9_AGuDXyh4zfgY!=1t9?ZIJ-`V zX4cwfIqfCIb;|^gS(*9B15CWbZ$Lv0r{!2+AsSS-0#>jKs6#&gI(ba`=!x%c&ruCK z;e4>uY<|gReIe}&n5X{ir>tHEysjyydCqbU5q(!7zU_?;fMHq`u&+_b1dwjyjIh&c*6~@CRy)q z6rR80qZ-__l9garp%nP(+w{>W5_Ys9uWE!NGeZg8d!k5%gzhkx0s|M=gDdDhRKZ`%U|$A`M*d6 zD^@wbwKpwep6GyFDESrnk14vakPIrEM$xEAoTLWUq|~ zasbbu@TbU^gO~_Py^7pVvelr5#Y@y?zQl z#67sb0wR+}u@uHsNR7MUgxkDI@pmIuJ(&_p#J@d|G+4m%*)45Q!SF_>=6a)p69J_ui4 zb>x%_Xc7@cpieq5QIyxPe_|tKcy87*@8gf&0DP({_=;($ru`{3=1cO$d=l^>KDD8- zhs0F!gMnot)n#bYns@++@|gr(54%6(BYC?D)-(mOfLv4p0`$CYi+ID;Sy#dq4E%C} zpglfSB~XWk64aSMPgPyos3Ar{?Bx36x(0@K>9{`QPFyKcl{$cMF@i#=6CwBmwKMtO zr#2}8H-(xJBx*s&PxPN)X0q4lXGanoDgNp2VS#gkU^mMXar!l~fAV2YP1}=-x!()i z{%BpF>zPXD1gq2MS7tlqYh41p`xVWDntdH9V3@O1!#OFvkjH+1C+r2SSQ={(?sKjX zS33MgYI6=}LJVU&hOMi)BeC@pEaPoD%R@m-3M99g9gj(h0QA|De(U;D4J|6K>m*Y=O`=3GPq&o_e90K zvINuXpE^37bs;nM6D#OW32_c*VRY>(T8NRO5=f=|uofuhAckU;i*B+HT)ndgg{&NWu>Mk6&67<%qMB`Gqi38&I^`%utr**52ib04|s26HW3K}75 z6@T(5+}G{imUR&;xO(+$XP5Hfdqd5gW2KWTro)4e-5JBUUU62pnVw2&%vdR)ysY4z z2KeS&PApvj6RLFa1?f3)mMRQWI-@DkMBjywGV%pMw?boz-%Zk^Umv{S*T~lo8big3 zW&*B^m|^A~##cgV0>F(-t;~5RIrs9f9`bU{69id&oUSkforh^P!}u{u7OVn)x^SK# z?LdC;QupOC-NTZ{5(K=XK#WiLb^;)9{RrN@yV_I3aAZ>Z_?TbU0pBjYSg=$rseQMUsKWI4;G2?%(DKQsd zGN3R~7{TS`li+*ZNMqRJlgyLElSKXQyZT#M6m%}VG#8Do(X%r@o2TzXO+Ia5);+^x zyDgF6`r@cE;UZ(!VbTrxRG6+N`E06+(>2@oDn4wWsW_~%ll8M@PH7e@3^fQyVBahe zmG_n(`1RA{REcw~0p;43X;nhXyivKm+b1GVb1yIG(O+u?4H??}ypnoc-VA?Ytaml_bqtukn4=&3==__Hq* z6X|K|u){%}Crw1Vb>QTwt<(*k$n0Y_Vp9>m5{e4B;&ufMF_JS;7_3Not}Zt}4F~*9d*4;pl>zpSp10 z=fT8{Eq_bEa3U$3fV3~YXMrL(XX!tsTt<2`Lvj?z8O2s-sB+`VhSOWk~Bw6V~A7K#9 zTPuuKxWxjpq}r~y?+cb{@P!43EzWX>V(2ET^)EE-jDtb^+IVi5gZNS z0^lYT6xuft6i*BzDmvc}D^k}`Q@uE(Y=L%K+xyq3K|oTqCiCXt{GEnWax#VQZ~ zc5~9w+`21tJYh!KM7j3yZG{y#6TxX5(*b$HM$^HCP~&iZeixLc$=$dg2w-E)0^hRp z$`KjWmJ1Af>4W1L7vkgAwaA}<@~(JN74+EW&VY)}MtS@!&{xVNniUcXiZDq*h-uNk z`wV7bE~(cW_qoCuPA>hsLL}owmMb0!AchSRYtCoc!IO&~*;hBqaDi@#ur09~JFzr{ zy#jJCk^rVad2IgpjYGpq!1uAk>o7ro7^~pn$^?_A_&3;Mo~cG8dWg*t_ZanpG(@(; zg1AKuL9MLv2SUmrr?96tTot;D^dk#X`<`kZ7ywa$cw%o~@}F`dv?!n9RUQ3yDWc6ANEyxtCtiMu>30rWL9R49e3N2>^Up)I zD9j0dJa3{OLHrL4%EX3C-HbymBtg3J+q_kp*m}_#o>)ytXD#u5{8YZt~Nq|$@QPF<*oFcgU(ytj#sg~z>I`6Wr?Ry>Skv?^qdUcfn1}S4P6DhLj_*~D*;JOt8_8Y-=sDok zoO`ev2-YO~w&8iZGUh2Cb^X>7ez#q!ZXzQy=MkOzkUaRd>(e_Xu;}SKt%2Xs%+$d8 zKbGKj%VaAkyY17o{S=kv(MO>l*g&M(J6yL4SVss{{8E-WyEo>P~7ql&_Sv+dYzr$+2&?8U+fguOu$R56iNw!v&@L4u7OyN`KK^;+#By% zIO-0IrDoGl$E1lGi*9273s3;k)2NOOQmi7Ra|EjIY@SoxQP58Q5xJ0@q(|p>$NM;l zb54>B=r+in=iyrXv_yp%9i;WpsY@k|peX}S8uLr@Z7WkOz055coj3IfNBxY$VquVC zA*oGdqEkEvsLz6vInfy;HN%F{7Y8G$BvCP>mSSX*V5_3;nHb1MJjl7y9{L)gtbEiy z+@lmH1G)F>EgxJ6J8Et4kZ2p}Z|0$pdPYn{f|nTp%S#Hn#%)#!HNtHd<1$%kKOy4i z14rt_$%PjR*@@SZ->J|}-*shVPf4q^uGNjD3>A&{wtnB0S(`tRXeqD^#oISuUg#sI zv-l^*sCq5j@!l#V5S?@^CJ6ok!^{dNsEhN?}&)z4zw{}v2rPu8%$g!|)6rww{moyxC z&*OCA1oIYY`Xd<_*w58APPw-qTF)^F0cUKA)*b1w+3E9`e~pv)II|T^4Tx@4IBHf* zDxI3_-6s>W-Qgy5|DwD3(IYte``ZR6Ad_^f3A;3Z;e=B9YJDpgVZyx^o#K6=Q&%H* z>z1ocC5^JcLdTf{TEE9{kri^`Ua|?6EoyGoOa!1~rpo$9)u)O~H zcA|XtZZX&+GEhSamY8q518?T#d?_dI$LvY2mL??5yy)6TKdQf0O{mG04)X2KTEK}7 z?x}J8JD{1~_RD@EP(By|SJdovk4@Y+<(57RZ{g~&pI7Jx+-$&;@B69HOkr;@#wD{k z#W`%RjBtepZ$h0HyHC|xiBiJrB5#nW9!ulzUX6^9*{ps_8e~G`Yh-SrVg>-5zG^_! z$6sELI$ExkkM3_l#$|b-p)ObjfI5UjaIjs0E`^mpeKYq6Vkh8}C(vW@B9gTMqQqcY z!d;uFe2zc$xcR+i%!nnCa6H(*2TUhc5oE+D-pDgi*3Be4M~t_MW!T&CUdp`rzZZSD zU&X$%L$*UV_S~U?hxxwFkIsvTQ5^JB#K=piN~c37qmQ9J=1=UgVCbT+6iUp2LC<3+ zpCJS%QQdztKo*0QMtn44Wx|g1-@YNjjX7i%$T1P^Hk$QJxkt^-141kTsSxp41OyQ` zcnAe?nei_}AfEGkyOpW#xy>AEzbriMs|#WK()O}cguYPj7+m`30j$kQ*LfR#G*!3* znC91(yPQG4kcr`050;1bb>?kK7V+$3iihHy zu&PSN3Y&vyvSiFHQIpVE2r20=>t3$iF0@S+_~+#N=d<1y#lEJ<(Cm6k^Xi_;o9MJJ zp`4b!DWL&vhvMB`6+!6p>`h)I*}Uq(R2$Zwpr#*8kFufJ;!J2bLcp}7_(+p77}GBs zf;yD)nM6F|E4A5M5W2phDT#pM)kHB`R<15Wm`{SU#2yuTKd;-(TYO7|_j1aKUo_ID zcMX$6gQJalKSYqTx_t~4uStV}tu3!VU(6mmYX&n;DB4COi$8ODktK7QQl-OTF=sAg zoC5@uA!8~{eNoTFTz;m@riXho|i)b?#oLdoBD{WGNo=%^ zqYt%X@6kV99?SWnw6`mE2kIQI0aHj#FHJoH_w?bDDiWsrGa8THigHYxJkW_Q|ya)P@)1t zNAag8bW~W5NFcI(aX4|@&9wycsh_Ya%mqL1TW-9s=m!X|6~L(th0Juf8(k7ea9=o} zOdhW2gi(LpWf<^8F?9@me`KmSf0xx!6A@wgsILxrv=%PfQ^+|RRZh-J_d)h;mYL4c z|GR3CU3{rIoZ=q1D~o1UMX-MN?q871@ZkO01VlR3i4(z=kDjzy|1SL~Zd<}a=s?rL zZ?Uss8Z_s4u(7SGdhvA$uZWJ&c)}o4Jo-e)%mDY2%SbeCPbzVt4{=W7);TEBp&qaM zx`JhH!OgY~m3ZufX1%552Ha>ECyc?_n<%WdWBxm@Dtx3PEIIK?qMq6w%2W;80ElkQ zcCsuyd=}lMRz>MQ6>ug(>iW27wS=xiNv1z)9IT23kgPI#QPJ!g9K#Y|2mH^abROy${D~F))PQD}lN;yEggyrXJzf!t6^6UKE8C2N$&B_>&09y7L9Q2Yo?-o7>oo z(5UYObVDebOi(d?e?8%|wVOD!tX=LMFo)XDTRaHuvyx?9%(0RQfsJ4$(zg)Lcc87( zi|wSD>8QYYN<~f@dE3~3@gabis1t$5%?fpOgd>%M48KecHSfbQ$MWKPKw}U6otroQ zJDiear+`#-G3uNiZVYfD#tA$d4QV)u`utB}vqbu%6_RivRLdW3(m=-|635N+A`HSG zOYs~T+ogq$ZHkEG$7flwLoz^g;hL&5*n6162*Ye%cuaD!AmJ@q2#9#52F&8SlCu=R zZiIz1IK*58<>U}m-X33Z{@AiYgP00vhvL@)0eDzV4Xw9K+94s~Yc}49B$AJ*6k7NK zs6DIq?^~`Gt#MnUL2sZxecqqEUyL)?3IzgMXHJD0$xg7%AOqW~-(=|Z{O4^UOVHx@ z?9GF<%1A9VM-*LJAwlx>B*6?R5+ygnbK-?a45M}(ACTmap>x^!(<(`h&}wf533&kXKi>B?mSs_gykfuY#kT+{DV;K2q&cjq6%2Hl#8c?y7eeQ=Q`B2KeIh^8l##g? z^^aKy1>+g%irAZ7DfQS#%>>F+E>61;dAbpp@O>SmP6n|Db&>kx_`Ww*&&F>rL$GfI zT7}D8x)=@+VhraJ7M(x7)z5Jg;q*mW(Fdb?`)tg%d4nr|+HqD*fq$2Rv*Acn&m8v`Quo?1*%YTL}4NbFL+&n#KY}CH8 z7P&dELJj_&MN{$8BBMt({hVdnf%b;}#SK=NJD?<0CWS?*YvDx!dOu(e>NuU#t5Bsq z$~5k*ZCRbNL3W{*#Ae|~8St|uM98RFMDDkG6pI%R|BIDh%iixD-0b&Q!Gzl%S{5G} zv`NWFwXl|%)5fW8>p1x}G%?jnZMqleuc0#f2o{SCC!U^d#nS~mJuQ`YHS?pplrO*u z^zG#Wps3UH*J8l(Y>N=Sg4HS@7FJ5fx;W?4VI8K?db!-nI>qebEFH`RfhF%k<}4kQ zqneQ-=rpS%lDTWBwvrZ<7D(SX4jEe#YlwwWbCdfkv|bm1>&yVL-}Xw+UEL}0Sl;Rd zU~@<~@`JziI4T4#_%qvKnm8->S4G&6(LpWp*AgF&Da_L$IB8HNP?lBLrDu8tNLR1f?!q>0=GcP!Ebxf?`VDnpHQYhYdY~Y!WiWs z&o1smZM5QxFjZiqF9svEY{7V%HiL;8X!m*;x5n%awTa(32D$eFHMG6gaCQ1y-PDxX z_AX;xU!F%++k7_1YA0elW2t^Z?%JU8-tRZM);G ziiJ29cB{K?9xJj@u?lbbW(w$o<3UCo&LOp|*vYVysD+u6kv7LI&74tW;jBu{78aqE z6FZhS#+eabg`al1wR>i8Fwy)d7pdl(I)@_JeHSS3{;o&4S@|nQ;6g{>O#hNP?g_?w z{r=IzF=cc0c?tVz)1#fxxVyYZ+RenAQMb><+Z+pg1F=opo}Zl%gPQ{I2ZAl?e8(>f zd&57r6GARbzysQy2`1q?oMO74rKoCkITA(l$BLl&KB~6YyJ=a>PhCk z%Knzks&>|}kfR9=S~@ol_x3}vgj)kn!jbzz(We#mp$HU(H$RvQETo{ISk*wpuPOww zcn^tNd-J2GgEgQFRoutSs7PkpsK%JqERm+a>hCwi`v?9;3c|lJL9~V-pTCbHZ^ick z4&@2jbc5)(Ob`jTr@bSn1q#L@&hWE1uR0rztil9FCT*W;5h;2zZ+q`v%dz$O;(vCt zkjd)l-0qoQx2?3Nkyk3}sqo6F9o-st7mMpu(T~Ah!18CPcZ+=RF5`9P7J3>!-uPOx z$OD#0hUr(-J^5Ami3RxcA>MXbn9kQ=C+Rah9?#HTBa-_&q7m2fsPh0|k_dt2h$GR! z(km-?-me6*tu2Y0Xb!eHgT(fZot*4v%#xo5xfKk|z}QyIDH7PLI|DHo$fRq|f3N8e z2xmDn9VTawm}~;ov&ITc2fXit2>BaL=s>QHWw&R{4@F;v$HVZ*5VnuC#2s~sEHWiL6Y4$?QBGX}t&IgQ?AU?z!_iy~Z z=hEhyZ{L{wQ%Pe^^jl`l<_DnE~bj<|}vE<6|S!ccFLdq+YEG%hT*;p7zQZH8D8Y8mSLEzG5URE zYNlm}Og%c$9#6FXBz5OUWRggwKt#HD?32mA%#|~fJhJe@>?0IG{$%jKIGzyg!BNo+jCZ9sY!d@s`=A1yYTHBWfeTpJk z_geo%^X;;8EJiIp{WpG)7xUsD=z>`AZk>fZn5W}VgY8{)A=<{}0Btg!CjoXbpxhqx z{bB`!7W}})%=ti?XBwHFH5C$I$0toRB|fl`ESy2eb7ZZ+1}>6w5`)>6bp09#lYXS)cQwy+o|L?JH=&2*68iehLP224a)`Ql!ff? z27Mw~g(lzJjyr=2&teV-VpB{UUe@-K$Hh}?8IfZ38GA9YhrQtw>JL+-_~{xqBRz&s{4|MXV$hr+Ej@fq^`R zj_B7UvocNGSBR9m)75;C(#YmZ5ed}E{**!N5y}mXZzT$UUV3oNCK6fYfy7w=Le-av5%~r`ZMadNr zRnDw+dmmh%4r5RAIN18xHCxx=ugbm{TM8T?@>(MO;Hg9%gcmv3ODR zhQ(0qMAJAyhj<$skp)SP0@X}jk11=rU0v!}LOqa=^UwI~FCq-pk|Rsrs`*=QyWMot zCZ%>f38q360ORf%iphz4g{B(P_p)}>wP$E=8N4*C-|4}RRIZoQ#1`*F_l3C;l}4|x=x887+h1GnLfi5T~TjXlBZ3*IzeTJ8JEpY8vchD ze8w(M&RlXBXWX%u_yL%%dQMKuoVNihdB54V;70muhLaPydpRNX8{Pf~w(=`6hI#5g zQ7B9wF@^w`&Zbm7f*@l-^6x3Qofir|+2fwVKe-=zS#o7nL8|sdG$?D71R`?-sOL^n zK8X&9F8H1PJacp!AH9)0o3rt8S_7(=5F14n9n;>sP=z)qAGbB4dN;x9NVUA}JPqm` zE45c}U;!MN#Bx28vr(@=Y8wZCb(I1Y{+S!q+xd(WYdObekXKb^>)BeY+ef^yv-x!m z4`;n3-0u>EE#*MWRV8U?$j82riA;MhcW)IWn^ygUo$##ei)l)e%CWtsO7Ugn6wIk` ziXApy`|~JyleTl+E>CA)KdAZ6Hv>+kthh8`_fBtuaD|gG6tp^RL=6lwhodl~h!wJ_ z>Ck3)OI-QTPv2u{UTS>*Pef%9TS4&;kM(&VHuT^4z;iNX`2F|y@>{ZHvXdM(EXxrg zDSgL=`c7{j;OJyKKX;<{q!k&>_JI|=`KcNi!>UaB5brXOOvpcC{*UY*F6#A9uNe+uVhVw}1jaFARMND7;BJaR|30qQ$K*t@EGPEIW^|X*7}|{FDb4 z_1BHRPK#tV;;Ol?;G-M$P~L8k5fP#ZOWIgJ`>Iv2{>I3m(03I!%fi|a-<$uicvU=z z|F_LaU?S#w?GD_)80b-j`)&E>dkyl4HR~sSjm7YR2IqmH=J#n?48AS(AkCQvE!# zW_Ola%JuJ%yi94IEkP3P5-&g97rGLngphR^2hZR4hgBPf9~;}7cwziI$3)R!#+!dq zHpm!fYrg9J_FrwBDd09`m@Ko$v%t9gJY6kIxj3y!zlE>?;d)JOW?p{QWzuyq;I6ty z6>MHs+e`%;@af=P=LKpdT<9HnyHW_pDDz6TM&Tp+By{{F{RAdiGeBxT*3~?;R2`d+ zx~)FppOR`o(>;XIS-X{b-_KnpOt$e8v{aWJ)LTsFrt5HaG+6&2svV-T+-nwI3M!hG z!Rk^D$KUyRaIF)+m^TuQFu4>9@mT+zz|E6GD?b!~ zZr)D0UH|o>j#RU$F;TIA&_=-e&ci!8Z^y4*3<0O#S4o(@Pm=TE-nEbF@XAgh9LxVw z&?2PJbwlCD`i;1&CW8#sQg30QU8hOsN9CMXE)Rd@_`pzaVuNIgY>Rcf8^6P6|0j=8H@;%;L zZDR$4JZU#{)BX2@fWdb*Q;rcIr?MO{4Yr2tb=B} zQN#7$YDDDzI_IrsvQxwm&iJ->XXoR5b#1QC{4*L1>Pve!DkgqUO>RCF6iJ^@9Ru`? zRc~+TdWakk+SqirN}N9AB$Rp z?a_J>Y@q_chi{I4?N&9nJwRh4cEZp+*2d9uZ|=bW&V+je(?fzQl3h-0_Sa)3|8f( zEA}`$b9Z22m?JUyBK&?vp&!PD<|OE0D;@&wPWYSQCtioN7ivCV*0qRY)W466h#59h zSqa*?wf9cKE5%`{mI7u8t}<2T$34k;`VBk-A&Pm4IvZ))xDg1?wchnxN@IL1aiUW! zgRag{-`L-5oN=$IF(fgKIyR z)B}FjS^Y9tj;v0$Q3e?}IBngc7&I(dLi$iuDepZN?xK`Rr3SQ=yo&&{=*m(FPb1o; zt~`dxKk0jF!46~1@hV?m<&D~%Fkf{B&(B-&rDvRAh`Vq4z5ib`_x{a<-vPKGfzHKa|y zQ&LcF26jLkO{9Z2v$jnX!zD)4qg<2OK4@hF85l=b?GZOsT~)nhL>@cXU;b%8R9B`yT(D{$Hs%J`Z3&j|GOGr+0eJr0@Uc zNYuwpn%eZ*iK;sh%7%YenHi+~QMe8Kn6giV8?R)gQu+9m&_S)@vR%csBCCDO{tX^o zj;?2${Kb6JcPiq?!2m58(>y2aNe}l@0Jhuw^4B$~(ra*I1fL>+d_w1vjpXJXw%sb_ zFI?vJqFT}>d#*PJ%=I#8aBM0wp}Hp@KnRKt%!e5cJ;OddsQ(As#>>?Y8zOFA^Uayo zwG`$TNhD?0UPXp`V=l8%y} z_qIO>l8ruJo;!xa&DL&1@faD^b>_W_{@SL+2R_`BgYOq7Jsa!C$poIBq~_CS&kWoG1B*cgGDB-BE)zE3 z!No40X0+z~ESDDby-oHmBSW;1$$Pnax~=0wY5E+yR}}|W9DS;Hm=eU(Ty~|&o1IGB zr+Nqn!t*YzLnek4#TAq`J;0xG_=`()D(tAArY?o3IHZ;|sgK^AaaSpjLXh}*KP>A8 z@aUL)^T$&pt!m>0xZK2v*Sb#1j1lkB$Y7g@B=7A>K|0Sf3^BKE;Bu~{bM^h185xTT zMiE62K-x}5Holb3k*Dh3Quy8e_ULc0-b6Y_ z%g5$lMx1fb_iv&ihD91)&R{R-8!NWRY||GC{J{Vcej0qRF-ebNO=W|h;o-9`alzP2 z=T4f>qtm!=ZB+}wTrFk{=_!I>7NXO2dA1p zgPJ;K@IIs~i{Z?#)jyt4$_24sKpJV*KZlQNECTj`3>IAC$@C~RpPLdJ+niZ0eFL%u z`FbQfv(Ugs9KOGaFCmGW4{c@T1%B=G* zKF$0l#p;-#wk=jrh$YI#{St~1&nH8wKrbYxTGF%Og^@GgOC--O?=GYbO%cR)t7I-V z@@n%+Uqxj=Csb`QsC%YhKSlNJ=j4wgB=?rbWBO%z8qHf(f09YMPl}PpsZ$>FIId-a zAi(i3>3FdRt**;dOheH9>FA}1kHwPl^*31jiOI()0!pcEVLUn=!AA zz-kbun}yXEbH5v{jiw|MtQ@~t=J@6JQZMyKK5|E1lsES=qM|RDCat`FZQ#2ZDBka% z-`BvG2)a_#SizkITl>B6_t+9kw%3}9T1q@NimhM2#hl%vy0Bw~M4nAr^w$`H@FRb2 zBv=4(Snz6yXK;p%h=bZrOb}PhtksvU&IXlxC7+r6${?3EyK~2^RfvKrxrt=_g!9&n z{w)&;?cs;vw>^i2jP-sRdiLUK5pN z|0E8)7{snX_G&GzS%+!jrV+Rm&t?7)%H6UMfIuxGhFf5Yd!vHBJr>O-rSzb+!^!s% zf+hE_6xNYJ@m+Nqh;0*Ca+f0Y+?YtgM;$mjEcw&ucAZHA{i;OJ%E{)s6!Bke2ULvP z8*$lXJ53tMm?O@R?G)Y}rC9@&s$zPUV2!Gk2pXu?BdC_8uHD2Bd0`DakYEW0B~TyO8@`> diff --git a/assets/icon.png b/assets/icon.png deleted file mode 100644 index 73a109e11d9621cef6de049ad70ffa8e7e4419c8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 135267 zcmc$_2UL?w*FPG1?;u60fPe_0NRtu}6{RXllM)mu0s_)|0*IgpC|xN5MFo+rfV70( zi2_oj_fBXbfwUXWch0%zyX$?|f8BSz>)y4p!t>1R*|TSt-`+D5p5HPxU||$s1ONam zH*Z`u2LPzakJJEqO7fpwNaF~A0sy#qRqt+a&K6-48G#HFe!5Kv&x7X=W?KdhrKPol zx{}x`7w?2er+t*UTV!IPqT0dm2*DuX3%$g6>w;*3g;;^cb7<59+bg&3o}A;ckTJ~} zuhi$1x-}VVSj5A5CE_P3A6YiqA5pgxwqp}V*jlYC?;}QlkPaTB{a@bLD31jowUt-P zk0+bwud-9?oqpOQ=H^S4b^m(XjG}~!(np_ucIdeQ|3gFl#2_E=XKTDBB@N(@k<@xq z9MXXQp`~9)(xv!|Nf0$7;13S;(RJdt0DrL-`fsz=$}?T99i;kG81{1N!GAqh@*&{d z|A-lnqj3E%NF2N*pZ}L;Ky%Fhp*rUG{11AU|CvM0zoz?pX2L&b4qno5 z{7bQ*U@d!Tioe{{L6=wbU-{+0@KSllr zRFGps2Oc2&r$M5FC4FfBUd(?COHaGF*eK8ci3AP*M1tLJC&XXIkNh_x{WHw|0gV3^ z3xv(I7+(Il&>h<3PfTW%f4;?sQP@NOn(m*t`Lt{JjR)Yb9tXtZzfGI;Z`}6Z2=(7a z>*UNnTi2++#2=&l*C6_|>%eyPFEhnkQT=PG|4MQY27cP}Tp7OeGzp4-2mnM+n-nep%HoAzw+Hb zOSRTTTh~+9RDTh)Rv!|%$$V;$Ful`CZEt3m^_XyQU>tk;;_yfHw)YkrzeN1ykaLb4 zSqmzEv_0{glIw$f_kFKQ=2OT2hv~{_pA)lrRbnZ~<>P&=JozncatbP2%-;gdidoB$ zr#Ks2NRvRO$6lSwzs^ow8D;R>kPK_wOGz+c!2|MB9U0E!aWv~hq3B3E@_$F#T~f0 zsmPDQr&%ICnJFc5!9-V)%%+R>l#K}eLwtJ})fhV$_1@m;qT1sC#h|??feX&$UX;M; z``!FWASBYv6bc?SACKof_8*6w#tHOsDG(W)oeP($Q9zBXbCA5jU_W zcd%|n#p9?y(U5zMw0r^Q=@)*rc*TicE}|y4P-#^Si_tGw=#uE7#~C6;$|v02uw7OA@2hDIRSb)|73I{Ow^0Xl%AdXiIbLZ1)233N2@FB zK$cU9y#9#wJ;7HPuJ+9sLo&VV{9fx!jA*=v?uHq=H>*4+nYX|n3eguuNs*WH2PbAN z`ahDA4xM^F7j@+y#l!=lLT>6ky%q*CU-#1_tVmT1(hGOkA^9VC6x4eRe>5-`60ddwiR~DXh^5WQ-A@kZf$elO zWGjbX$boN^!2c{gykfvQgJ{g6M=>MW7j#Gyy%QvHx9)F$LFaYg=mD!)iT#> z-eO>HZ)j^fjr(}cha^m_=6zBS`s35+CVss}%~OAvIje3x!@HBg?ss91h$tp=2dYDU zSwW^x6KXuGISJPaB(-DU0cU1}!MGR@nq0U$@SiIA=(JLAr8LG|hU5CQxd+kjkFCZy2WL9Q z-DC%{p6d0sk3_?rSKntCFZP7dXqrU_>-n&dr4&>Toqm6?4g} z0LZbt&|K6xpg~Aj(75VzpbdGhNq}oL@5EKn*3GXPxZ|R!H zx$<4gb#{?2eUkB*Q=G+qU1aC)k@acW%#z*<*Q#Cu-(?QIfCr$y;UwdOSmi0t$CvEw zbP5k81WYyhN3M6RV@RFY-W@ambx`tg@rN8DGFg=M6h_P1CfOznabdf@&WA=IViWL; z+7keH;y3S_Q^ZmlwN+HEn4TaN4M0z@<18Bz1;fB*4QL&{=5-TiEgHt*K=y@OOa**c z`rw1+ICA8iq9^P8Pp^IV+r%-G#$6LV6N|2?e;ecIe!W2C(ahEg_Y5cw_`uEc^?jPQ{fQlEo3}AB~QAZ zrp7-vD^oDp>ft%BgooIoaZ!xx(le_ggJ(UU93QDqNbpFC+svL( zj!#|y!hU-k#M*MDC9XM4xn2&59eJbP6cqkov<~eK{BgxHB|P?{&*>@{m+WI# zTbK2BiIeSN4OPA8jX3XAp1(%(hTIKZ!AJv@xz&Tgt z7|nhf*O%pCuP|`FX%OeYJuNk0dA8qMFkTIg*`Yyf+oDT&*2YN4$dlN6-RM0naVp?l zub^UTX{z|JQ%z_EIYxkIfL+Q5Ie0K;D?4+{v~zfzbnnt9v)IYIePOa`x2YNh&o-~v zL@a5iP3Fo(siETN7vxTLlgU=yLrAQ8LgN8X@BV)LGbWQ)T-SCBBKP)}geeMe_S<)x zNwu)&Rvbt$#7z;g-Mu$&Po<9q*>0XmY|=83=8R}7;=m*&pof#$Yl3T3H5Ap#V#HHx?+|0H61R->lwuK{!H52 zmrn>%BphlYb<6b}tJRscLe5#bgP`!XZ>fN|7tSD$S^jeR03q!;NA1aWZ_z`V{LuZI`C>AgYL+a3Gne!%We#3_7 z6hmw+c3G-B0Km=)Ocg#?GtQi$@#4&OoDn;a(u>M)>Z}ec8e%^LhcwUC7diMBAJVGW zn1u$90{eySOm_B1uTm-Ro{hwQO15lKYZZqa%wlJ3T`uwt9P?PTG~ToHRVZHDi&Cw)hvQ%rVSEqQ%CBzgDE3KPZRNgn(&ION_%y5Q}kSDCA}gjEW8q+5WR=X;nH zL*qf-OL9R))(5%TfS)H>i4nqF7|Z(Fwkp+rQjh&i8FVRgCD~TOW|Af7jX@*Y74y!$}=VE{XHmk*na#xu)>l@}`&O z?l()*x_0mmUdtSoku-169~Jg?LS$Vh<#m5eG%fJnUAgZU_AbOFX(9E5W)I=Ga1f&m zXxE-YctxO|o`B*o;M%>xB<`ROzVScclt*sQlEe#-gns6l62Kt`MZz22`0+u`u-E6G zpsjEwm(8l+k3IJ%RcITB-?&1a>O(KD5#^o-KAU{GTHOQ1{7UC&e@u>-aIZ#MG(=?v zVmky+A3YpxD|oV(J`H7UxN3ww`{pY+8!#U|{eHYQJX{>%#j;za{=2t%JuWlkWx$ud z81ysM53N8^+N~X}4J!-E)51cGe7v#1wYYz~h!oHW>Bxdee@3V1CJ^W2FwS!sPZ#s4 zew41tT0UrKWI%&_1>2h)_k`ffL2||?<)m?MohF$thM4A^q+Cd6O;n2GOHtLf=T^w6 z+pZmQpZqB<47msOu{-%nR@wfv!1|l&`O}@#ks`ZLxTW0;4I1Jx14?|z+4qti<~?8Y z^?6C)^i%@R^?kL-tp<#NUnt#L5_asqncVi!HN|&uV)+iRO}nmMuJnn2yBetsw&xmH zhc)KZ^b9N?e%lF=;H(QHEOjJ}u+3LXQ@8^bs-wu}_|$$BIcc>BO*s5bh`D~kD^9rc z`BMQBxOmx@-l|JgxmQODSY2p}dUhfb`txxayj+pgIoq_m4nHanAG>E>PI0LTmACSC zDsca@BKFfzwh2etwhyu&;d#$7V!C3x2X{9GrS4QgX-W@JXVVQ=B||ATJecE%^zJ-~ zSLq1cg;hjb6eu-RiB5Ao!Rv>fy&q!xE2m|!Q->@*JpnRS} zHS8HV z6#L0O4vU?|Hjt{8i%F|RR!Gww;zdOtCdmphsv{YSUMOuZU_luwuiO4fPmzt-&j&Lj zcq4G-Dn}>@g3MibFdaq1zE4T2-YvH zojEQ|@6SQbo`glNloR`am&<*%>yLJSS7&;X@_?BK*X;dU@93#w(MIz6kN9GY%+@d7 zy-eiRxx)1+cSz5z<^i^#Vd2ZAX(5kT7>fH)Mk|^OMd7rksurwM#6iflXjB48xGIuo z9rirV6AkQ};}_NgR+8A>?LK8C9V&<+ZkRWO1e-0b6W1m89Ga_r(L?XXTyI@Z8kyx%KRVGAKDP$|U1BWpR1gzmoZ7BZzt`e$|fQxyjoqZKqw% zEt1=vS!?>R@Mo^tttjkk7(o`Y(lEM@f6M&Yc3##kqZeJ}zGy`!mbhIt{0{tOG;t;T zrK@sE=yV0jmJwCI$UQHtKhUaiwt{7lie2O^`CLkeoVA~xh`4N@?Idbf-5-8k6zu+i zdNg4-w##sD1NJG!xD z0m9`D<7^eD1coU|N2(0Bv~F21@>(`N`f8?ElXybsH2&Sx5t)N9aiPj9rq=mFJEsNM zi`wg6F$#ZZ=XFKgA^HT)i2}3Pd2XflFWH{EFWkodwOK1+)e?cR`NUx~I8Q_@^a?tZ zS@+c2@_DB9)DrVx{8nyT2|<%09;>+rN7pTmL#vb_tI7Cu7(rQ?h-i~x%3+Nt_gvjag=T@6?0#A;zbkVw zW;Cy^a)@xQmY<}9N#tYi_)VW<;}OzwFeJEUn$oiN^|5>2{qWRV76^Bxozt(?B&Z z?$I%%D;eJ(xEuR2d6cyL!hS#^@Yf>f>|(OE?L#Nwu_I5!^6zO=jKo(iaydx8fe-*J z#I!~M_kH_JJA2BI@q&K zlnA4y0pi$EciyclUh}+F=ko#Xt-4@l$+Y#BOTFrf?s>_%oe>G}fbx>4{)Hd~9t4`~ z+~niqc(%COLL!cT*Uy-U+a~b!ygbB!S4;RHAIt(9*EHhioTI7i~xJB$J;kmoJqpH0^uA=m=Jv?X+H*4MR za|-}UUNdvDMk{=FBF@Z`{2+Va&nk%JjA2UOh>|SEF!-V3-o3KKAJQsDD=%g@?v>8< zow<^6Ft?gqiFiwqbLPh{$}^wyxYTQIILCuP>025EgRK(PvBAfC~5%z}qo zZa`#bV6B+gg!f#24Asj3Hc|eGV`fjFsBoHQ_>WL;+*cwOh1y(O$?W zLR#FOz9AxGFfIb#y!uT^-MK)6!K3?H8nSfO#~+FpQz6G@kz?LOgGki|!Xf5Hr0!y1 zPA43u`wp-QVSEY-#UYZN3>|j_(imOOQyC@^XC4An$Qx;DX+V6?i~G0WjkX)`M?$%; zw{qo)6>WqXQ^fYJb~sOd_oPm)LQ_g4QoqcR`HRlLrdi0Em{sSyPP;Q2vO*z-w#O1c zgHgV#;bX~o<%c1qMJHl*-}!Li#3<120SFC@z`19vGI;AK3+!U9 zy9MsW&0O5)zH^rb+dQGMO_BW?4B0J>F?T>D(!KxHr!1+E&Hlrn%tlNhl_HQ}@(@9n z!4dM-Uz$(KcG>!-uAN|^b-)wv z=qbEir*EFwlaX%`d1T7l?_JulI}OLUraH`AYIu0=m3L^(w%Iuvt~DykDcqrq zvx^BdrSE^J%cjfkLrsSNFgjieE)-=+|H}S)F}ZGnGuxCz%MHO{JFD-4kF*esXwXxB zWkd-G-38&Yn;I@VGN!T1gY}?}n;^@F?z4C0MyGU2<>fXXHzv7ddf2r=0L|8`YB|>g z%OX&yljW5maMSGI6=Z*%Fv@uxVbl?8-3hunoQ&18! zS#>i&a#7Vtk;JFO=6@I_-c;I#&m_aOZ!dsr1xuT0|70a`nQr3A@A6n73CS>!=@G`T=CTCnMNnO)m8o`I(}W{7=^O1?!3 z;3eG_OFJJ9M%i|$7Fwt?nve-35ER1)x}fsberz&+j`VqjWY6JAACnTojr`L0hKR%v z+Ca5uHo{Agk8_Em$tXPI$9IaMc@lUqu_Ij|gn#C%tLdEoi6#kwEQO`=c$ui4T+#-J z?d4gM5@e!(-54Ff$DOAh4P+I18+1artB5LbrONABm~Hw)!Q!V1rh5lo*dJDU(t^5z-fn|NRMZvN%y_3wE%&HE8qDPbze z2RW(LtyeB1A5COs?t*rc@r@7nZA5--w5{4o&pdwoYSQenU)%#6ir4}pZ~S6sFWIU# z-mbDOvNHc9Sy3H7Y#^3|{-n;6|14M`Y7q||P&;0N4lu7pJ$T&rN$;L+iK2HTI3-N@ zh0y?>?_$=R6c?q>1h^)Lg)cj-R$YSM2knW#$_Y`bb_B`Ll8eR4{iHN-FQ6B2mFo;#gP4ro=oABBTK3dA2e;xY4D7KHi{audtvPx%>8d$(& z`k+GN6F;d%gmgq2OqNdt@N{&co4*NL%L+B`0fr63Y&QJI+a_&uB znK$8wz6rNdaui3a(W(IUcE~pgjSO&b*KMm8XAg*zmruMW_K^l5@XM4!^8~8(StNGz z)wMTszn9>WV@c**a^?`i7L-LSKynvNlX$U95+51mTPWp zl6_+JoOoeuHWJ?mw1RJokV+s#Nc9SRT7`;S1sp5?=1iP*dz!qQbuq}$dW>rH$BS2Y z6ctRFpq#I4YdjsVF>ohPe`bhs+=ApW^F2Dz@53$=dZ0-`;9$c!h#9ebVeuZ7lAtMWA!C|Kp#JoI9B6 zb^`uJMI8EoP-IWej}e`|KD*sPv9V%yVzxiB--bg^|XQ<#IVfyr_i>vvpVNtZAo! zEG3rhdPOo(C!xVwQ;8JM!iDY3au_|GpYJ+j8}N>^58Hmo?(Xl;wK4a$uXc)0E_`aC zTR3^# z|8>s0_VHmC)Whe3N3CbM?c7RG2bU9}g+tBbU6?|ci{I-`#xZc^+N!2s#5f1W(d2$O zXyEeEbQY*43q6+SY5BxXhqzmDNkn@@_TCSb8dV#|WGSGiVvbQ3A0m_@>&)8TVL491 z4`9|bUkm{m-!VQIW9tNrt060fFag-?AXwBWNTm4mQK`OtHZ+DtpI1L>~D5 z*_q31?e+>p6WUr}hIS3|a=&oNl4l}ngguhH6HqyJ8d()@1U)&CDVS}+MiuDwToS0> zU$~}c(#n^ooW;6|J;L{NKv2oV>uhyr`Wy>8xGg!s$lpu7-h?iqc%OTJ$FeF65`b|> z<=(?2nUxww?;DE4`Z^#O7;a^N85|dJo4X@Y2S(a~;LCp_KixO_Oy91-`4$}9G z-G)DQOSoNVuwSk0L<(1Rj2N1GF#&y`v~<0iqFhVNN2R8DIr&mJ7mU-6YWMZ77$0fx zqF2C*RY>v|utzwW(rlmc-aQ_ zib?cJIjso3BwO|5GVU5u^?Vg4!^6w=FzvcXkH@BSa8exc?Y&H(8oo2Aj9?!$3{%18 zUWNDxI|f?{A8(V|fp|@l=O~~cxGa~a*!|qSk6oTOH+W~?ult@1nJo7Giqs>-dR7m* z+(~{$s#dvOeTbQ$`pz^=S#u9jic*!TP$%7Fj)?iJV=>RfjPHO4zX7RxS({57sEwwu?1$n!pK`eJr|hm#wC5 zLF;l;9eEbwn9>a-MV*JzXf8xGU#ydfG8!81Gu6{peK=2K{i!0|1NeYFJNazp2JM_{ zy%jApM;T%UzyJLiHmEv;gM10dn;#U1(LVv}h>Y1nlTXZMp(j=ptYJ6_?N{3;Z%#f* zFo9rlGvE~B!xfRDM%LLoHx)9h?L&h%Elp>VgdC_zN1*rDmw%fT1P6DOmNfBZ03b*a z;^qOJ)dOp}vd68n`XL=CQv6XrRnF?qGtWoBYrcE4C*X+Ti$-DRCL-5@w@GZIZm{2F zxgE8bm_%(6sv>2x&|cES6Oa1Bx^k|;gy(lU9ZP+Bj{-`bmIpGn8g=DFe^w7#SX5ZE zPkfUCt&kS5Ju*f?ty5jFwp?Ffp zQpJy&$IhtwNySdVI42?59Bv){gREDMEe}~k_m6eo+*XH8E>Pz(+%WafUL~gt*^!3` zqD3n*izWV!I(sns+{~yo>#MoDKT%maC;^tfkERy7b}aRPX`yvUlLU+q7}o2$QC5)- zvkE-yN|*qMc;_bX5_zOx-8d#mXdy^L+`?ZW4Jj%kaerPi)i?5dZ@i)HJJ8U#kx_Py zdg^W5t#@s0cRjy;=axmp(e19j)vDM5G}#o=vUn(T4zS8Y&;-z6?LLanR-f=vQq9F~j_b94Ks5|b8`_Twhdt?rz zqx>Dy57!k!`RgH-a=#GMNmjnw7^dfzXMmSALSbSxVXg=_lw|&GP!1VceJd z0TCVds$m?2B7l>*6ZFt6EuLM+*{NTTes2*XG4|V3@>La`wZ)xzRJ{d0nN$o0Pzv$; z`7Tl@`aDmr)pp_i&Ae6GG6&k-id%ebolUpy4Gw*&PbGT6 zp5`yY)VDTkfMFa%LQ1sm#=r?C;XsIn`JkBZWd3#GO!j%$n``hF>`qxWhkd+X9t>Jd zS-8h>>fX6@wN9))bgi$@LaVzN(bS?z(`kihm=2$btc`6QTBsKplri|lG$8nN_X;KrB#C9h+Xv zZIX7GP9T9ERr_gR(lzDkMQWB;a~yQ7^kjVeP0t=tGGTAm;lAuxvMfV=A_8Mr=1sY+~WaZ#{{a_%^7@i;0$& zt|0KkSriVROKn=FM+o&kCdh?e53R_X9)7{R%L@_W2Vi_S#-*vstSGZyj4f?)%%YQn zk#?O%0(;W5@c>3BTMy3r40>DXJ1PQ*RK8y(36Vq@xZA$waX!*8esC;~Hkg_9PHcpe z-cwL@z>_e@mxTGtE09;(x+uy;wKG$*PObE^XW}cj_U_tPMS3MZm^IE#8{R;&xrB<-y4N_Z;6*dzv~r;>)N* z_0Xk3lO1_d6E0s3#)3q@wZ5WhfAVctn(9lPWfE)fN9Hw+tkQLn?}J4izSc|HF^N-vsUoLP{>=nXR_lq7^16A4{0cQ$nQ ztmK7P31K%$ZWSmA;LBda`w7tkhEApCrkmMLPRTJe8a3~ENt}!$w%iRBh&SXUTv13ufn`LP zE7L*xy$xr6=zx>so7;-SA0Ql44?+9!M;TWd?j0gF-p&dc#=L@gmT*58dQH8l$ia}$ zs*>5UM$55Lsg4M8eXQ$s)MllKL#T#qY(L+!Ra$&Pd7z@J=wmggBJ-rpJw$5R*ey?w;50)$mIUY?0#Us17BW zCX~4ygCmPFt8B80Ya-nf#m6T~*dYx=#I?#cLd!GT_c;%-p>0eejN9S4=1UZ@)k+i%7^*VHOVy!FT@e3saB;ZaTX zSEW?1UxHHvNmVp{U07$xFzk{e5###ARQK)UuY^o4O5e&y&&p{E=wRsVle%Aa9fem@BZ&%EjNcFBm6WTFzMv5y7&;zTv6*~Nv_+&OlXiyif zJb91*O~_z^9bqlKQyZ?F(#H)M!0jP_dwh6Dl%3JBxx#Z#wN5^kC3mjNQH?-6C$+!A`4*A!Fy zym3UN#s4{UnlnU0!ma;DULq8V_uuS_10wkE@d|Oho@b`a!{=X(H>@bMDrHy2BbKl zpQc))Jai}`rT-K{cK*_U*t~;_zcDFaCNz=+ykRd+r1mfQ9VQnxIv&685qUg+#1#z3 z9y2$BXi{Oah44vJm4g^9Kpg4r<@YSXJNIK%s$NRQD2FHNFS6Ea<0nAa%~d_E@!*JU zncz_E{R1CD9BCY4_n|=wovSV~OeLP_eSPQL5(2$AcK;19PfjYnmpK!B1S8%qZkNVB zi!(r$4Dsa<2iCnt`i}jHxsXHemh0w@)wEVQPhzYOxD9Qilkz|nP-h?N&oJLH(Za!Z zEEmt3&3_7GeI%%H&=CNS_I~KCJ~JSK@`C5DZ-;0v1CTBy+eygjUhMWX~SHZ69eS3?2O1!!&VM>Ymr%G_bO(z z9o@e~QOsC<#pk*fmvB^}dl(X(atZ85IV2v|paF+9eV9f08hh{J_NKM6JA|w1`AA`} z&X`S}TiYU@r1Z4l;VS}5T$J0T)4;WY0s6I?D`k@>Kb`1YsltaZr0VWRA51`pe_xot zBvv7KhV~ohm3Bi|qI_{@d48#;K|k*v@G}c_!+y1m5|X+pMn^;%Fate-UqXS>e#ts` zV7!(y-}eYUzz3M-wcuPwK=xBN30xmkGl0CZiV6k9&h=ajQ~JyR&R_^a8|ED*d>qkt zMuB*rccftI*}2C)to9m+u(|s$NO!3i?h8Im(bQW_%9PRy9(lg*rr`CEyoG%60UYo6 z>4HYA9$)-$rd=?UKj12&P^QDK+k_~_476G;Dj znye;KEgzfL6mBIMoy{L9`u&i`>$&l2x5vt~4ow`>EBU*+P=iv`F05Cos-@Il21wqj zqYdyKM@j?^0cE)nz#GCpsHjgmb+_$i4w$+D(sOG^T+X`Yl$O&?IoD_l8BM^1LhUWV zJ9#%Bf+beCKMg7hUE6yhr{hpY(kD%l!sc4c=@+lIFPTVLgLM+TRV0Ln-5hzf(JYJw4@n>D6}B(; zi0Jqde}d33VgejBc1=>DbM{VAkv}%4MlTH#Zs2**!vysR?XTJawP^ zPF;gXz-7`XGUfP1ktduCn2lL$VTBaD^Gs`r_d6Q3LqzANuNt)4F`ctF&b|b99W81A zSc7UMx9(Dk2<1=&XO2L?Lz;ed2ij1xFFrw1u_bj=3aKhTWr7)qi7%Rr&5O>w@aQDqAPi8Z60twhFx?{v*Qa^ZZ`RD@9a7>);i&rBmH(xH+^x$M>YOCcI@F<>VjR@*RuS?|vfWKF}5W z`JHzyUiVO6nCnv}y4ZA2|2FlLp)!LS`+*PiFFBqHa$DFOtf;KDlxWn|nawR`fFEZl z>4>ScdnTzazA(RT;b_(AOa&*I;TK}$ToR9s`3wfO+1!p2StNvauvUs%X&UuFr)@!!In06vrF&@%4YTPLGD+c zUw^O7==*L#adJ1UelGCxi+X?Ri?8gM3~7_5Dx{|6pX2=?on!n75OM{uY26glK3rU9 zGlu((M__ja)$Y<)v-z7{|6DtHkD0yy+#{N_t~5|zFzR^jDZ+sK|6X1<3Eq7;*v*q# ze#jnPSFb{Uf@fg47vB&5sKCA>O3(~}EHreJa}mV%_Bl3F-q$Cq`~a}Khao^cL%D)I zMmDY+honKV2>{CTdvByt>9I}(NGhh7mjQkVF^;cQvz|Sk^vq%Y<>?7v*D-(auKm@gZI83}#q2Ki5qMZ`rlb}~GKy=#y7p#vJ9vQoF zI3VPK1@tYQRetHMsQxTK$-bj{U0}&eyZU5kg*UOM;^;lyD;OIa7|PZc3eIL+D<>AN zMBW@gzT*n{u@;Q`ghEmo<~PO2MiIAC9;Q;*yU$TBRD@bX4uxXdEpFnYL(eqSuuuGO z5nu8F_m%vcm;9fxtW#;!ZB%C|me5FK8l9CJ zmtaB=$ELaRW1SJ$I0jKr0npXikN#DN;R_~82lb5Q(F zrgO@j5Mk7;_deTLZUWtgw_*c{&75?dGPJ0~nD~({?I&uEz^>UC@=`nVCYW~|=6O-I zGW^xKf~QP@S?i(jOA{g=FKusTKVS!4xiMUCX9_vQ;J1GTi<|xk?&+@U;xVVW|H{v$ z?;~)M^Q5KNV%7FJH`r^e?P1dPQ?aWG4#EMEWmkb(_>{)n75^Ok0_TBU?vZO#=IyW* z&Zf>$%b*w!lNUw6zQjSd-K=j1yD#a^{0_fNcs@%?7a^p=bAmw|QGLsY*V=W1C@3ET z4D;c;%f)KROQiR)zqT+}s)4K5XxHw|<(UT&Ido>5gU98*R!7cHNK=jAz?3lxYowa2 zx4P2Kx{X=Rx_RvJvGwPuQaBMIT9XcH8uZ%*KdW2(dkrwVQF8KO)4yZHQyh0|KF7F^ zS-5>HmAibU#v3pe)gIPLV1$l+BqA3HRw=|p^)a1;=j%R_(*>o8n zG9VoSfz`TK3KRiZU;P4)#*ePZ_h#F|uHV-C;4536%obyc0Lq7Z2vm5Ttu`VZ!jDM! zPmtAf8>-IG9JuBkdU>j$misdbt%r9d8QPyW53eC`vE%2E>++X-Uu9?CT0M!N`rNmS zzb0@{bu(>)+KSRLKBA*sgkmUMbLc6+Q|dF0l*P<`{L>lA8JSKY&FrsVAeAi$)i#a* z5ApEl2jt{%7`kl7NLhB#`K+VP0MoJ=F*t{u$`y zCgK8=GY^WHf_~l7)>C``b|p3V?9_Weu+<3Z@(e_19rlUG7^v@Wi>lXZ9L@I32pV9r z;wK51@Nac4+lzOJSKn+`v%kvuas(8Dy?SA$r?xY-2vl+KrU%qbY2w_8OT7k8I*InY z|7`h%7t78Okzvt5j=JSRap(5=DjI=jNB)rCSLxb9;BQyBx8N0ZPXsxXN!3jPPFhqn zTkTZ%?g51t$&Y9=62K=b$-!ft(+3YlnW<0s7?qFMHyMA9edKCmzFn9B{>W-#1f2Ip znuh4Nf5*$}M>hM)py-b~FUG14eGhsg-7og?tHJNKwl@6-q_;^46uJDbWG@(oiD#rY zy`}Wr8?N1;lZ3jOkl|AQ{cfM>v5wf>FyK7ZoU6ymgQc-w7nJ#TN6st0V}4~`_7Lju zHAKm6=7~_nw~$&oTc`3gfTf90CBfwnB=+e^{T6UpZ+rN?77E%F z#hDA=O*?RGS$MIsuYFQ{>p{05m;psUNWAj(Ujyj3slwfS-#q}w&u0vU zkc3pTaH|Bl#%TLYC1}D*>YZE0+lQ4pmcQE`HC6Vw_wp%u&ad~239U0G(dP+p$2~nO zgU0Q?JKE-kCcQ5wgC&T~;#h8m3JSMK~Srn&v<+Rf)C_djtB z3Y+`n-cZkH2`q~KF8nIl)gxnZN-D88CnMUO=FG|QQm)e6z}~Sdz#;nt+=m0F9hM*7 zE!h(p+%^=(?_BEG4*pmOe;{SG8`)^_YWfC3{K?okSwVu_wlU$rQfJpAzCO9FVpLbY z5XLoAett~&hH(}@?w5DJ$P6W^I^Ej-{ePE^~3U~{z4Y;^#a1gZZz}hvngjmW8~>^cA7NuCd%k&f@peRfUlgS-o$_fw9a&`J^3_;$wKz4iDuU%H|GioF0C zMmYz}82C2joY2!@O2QK@3F~%qbb;HugJkKHLG6u`q8r`A(XsB+DbyvQj$fY}t7`>c zaF4g&6s!r>a7M&+u97c5<4$j=QBrG2Ndni-&c#pzUw1{@*YpRPRzC=QuJr*zC}0t! zCn6C~*Sy2*y2sT0Tl5Y@eDVe=H=XBgejwUrl~9F|&S7u?o^_G9Fa%bLBo!CVD(4yv z(GuA$_$sbUKMR$?@6LBAwn*g20*c`JWq7W45Y?#imtm zzHqUb_RgC+M^{}Q)X4BsP+vV}jG$JzA?AJTbh`nIRSfL|-U0HyFfdWd!e%S-soi;z zo)hBW%1O8RUZkDB{lG=L=rn50|HMcFzV_4nj;dN%?$hci1DzTL`#>q{54* zM<&_KKW-%ATYy{!R1|AW(+x#4L)WFLkIpgkXh+vM9Hi$Ut+R1(0{M~h`@|phj z$8lW5lv-$LOQ{4$^#njXspA4i7SoUKLXre~X8Kv)%t$qS-->?j2BvO$cQzeSrIl|^ zY4qw-tT*WEz{BCE0M3sRjPe};sTA8ZY&}p(wg@$I8HF^8UosS&ogdRJkC^t81!`X@ z_2dT9wW_|n9Wq%YNfG&p&W$8&UWx2*i?H8+AwfTFv?Kq+Wxiy8^>U$(F5>!YnS&WA zs{G8zGtyKJEFunosTY{?l<}OUjRA()>6^o_7F^J)$c9_Clz~eF#QLp>y_?@h=aCH) z{TJ3jjwrRfD(C$!sA(-m<3!3(ZqHvy(VW!V2lwAIm_a>in{fQdVCY1;aq@E<6_Q~R zbtS59eR4*tA3+_MEvqP3`VtK`rQ#FmPSBmI49;Q=dN%IWD}3%KC#T8Xs$a_X{Q&o^ z!2p(Hp5H0TBeTtYD(}(i2lhx238NkG`Dv*4f;q;hS8){2R_0YH@ZejXDesu->B+ zDOh;^!hSW^TG>*Bl|pjeHA-oYXE%xl;gOBE0-@9Uw>}UxgGmQBNcSwo^159%E?P9} z$Hf!xEe)&7wmAkf{$BucK#jle@8tbTSAd`>(=AQ@fkxx@nn<=ak;19R*n7S)y7z#1 zNGAUfk;b>l`?Um8;+BQww>kMd*mRcI4=M(_Q zzuts%L-Cfe@3OdD$dk4u&{PREgpUZ@aJD95o$sc5Xvpr+p&fX7H z84zwu%-3vBKBe&!JEs_w|9K_YUsclZvVo>tmLsuNUh_}=AODNr_xJuPC6nPnO?Rk; zn4YZDz+!+1V2zAyk^^ZClTHuK%TC>WWFH+^t=pgM>|R)DC;pvyyAl|G${znJH&r~? zMxTwi_pM0F2?3+~U)rbeG?52J+Sg=&o**X7zU>NxTZlsC1sM=d2^gG(#9eAo0_`dM zvT`FC=Etx~!c(Umsvsw{^+Bbtau@9{1G$yqfFvmOKqUsG8~4ju45-pwCG$5?0!3$g z9FzesipTpj_Dh7j6JEVJBfe#dd-(bWgD>JaM*4f_TSQvW`r5+^814NZd!UCYQ!y`yD>}ORQ}VB(2w5(eF~e`lAfU^3ozu5^9kchmJ2LyCk->W%|eJSR#PQp+EA2 zzvhqqfkE++)aUpFeN3`6@uH~U9t;wrT3#7O{kq~RYOU6IadVCIj_w9yr zS{Dow7+G&(^KhkE;5w<+s7f<`b{uLa!j@cL8Mj`D3>`v)Azw1m7X0e7Ap(fqH4eN; zCm(CG0d}!0H#;rZLb?SPOLc+GCM4IOP`@j4{aSlY9wI*&^5Tr&h&-G;l^B1T(dyJB zEh)&(3m^|hRnRlJB-e}NsWGKc0FlcAn~sGt4tUUFN5q>D2>*<#xcwz1V-=XbAZY19 zc%_yT-ov#xwk3PpVC@eLPGdpo*rl5|e8eirG^qVYjvRNbbo#quo|7!NvK1`2)7=*R=uY3e>qWxDpB5*Nr`W9zg!+tBY;lPdy5(zYgjN z`84DyS=3^igf8n2^uRJx4o}hiFA3vMb%t8ruAPY1m^TO)Dc1hZrZ!Xp>oNel-iz}x zR|2T%Q4C}}=*a{aeuYA8XakL6Hd>{GRw%)WFgPR$j*EdQLATDZbP&Qr7x(gSeR3Lr zGT>d}@zc|NkAHVQw(h^I$^Q`V-$(lGcm8rV!p{n$Byd*~{XJz;-U>W5rL@;Us&koh{Oz?r6kt69h$P*@5c#fDeArfm3#(bXVU0Di~ z&AJ`^jJg>U8z%&;syo?^-G}{8SBLxB(@^QY(^2~+Y+SN&S&n!!7a+5xce*XUEW(_h zq^7$7f)xWe0boi%rzf7Co*Jia^t!L#?e=Q?^`ysziSbyrfIWgv=eF)3 zIleDV)ntGy^OapgMY`xul>to)^;rX0IgnNfw_NnEQBN83>q!Yf(~to8K|`ev%>Y&@ zTcGJszOD^0*k+hb7o##ESZ9*1w|~+N@t8U+1_~t*X*&45VN0mb7b~JopbYqEc>I)H zKcsam^jh$m3Clk-tN$L8zuV4@`ghB+5_XBHU6CYXT#5Gw@(%(j$PawMepv@;EI{EwYRpaS zPqI7Ir`eE|Cg;`ww!rjk!Oq)%kZ*>_@HJr`AP>oh`^Vfr6rV}W*ZszL%fAi?5@!YcxBubEsiD6g>Lg_V zdyHjArSKM^*_=+NAN%wFyG{{d|GWcgI!2cII$v4Lzk5B@m`auu%V)5_l~cKn?KT1;A?({hai% z(C1e(`CrZZbI4$7%dzYXnO|W`rIastHPIidDF>L8Rq0z?8vFf^9lSr#TwutS+(S+M zopA#XccOF!^$#+@O#bTJACh@k;r$ksT2XPMPnr1seJC8|3#BnCqXzIj$0GOE6zV9z{9!mJbN!- zs+sz?pDOcW4p*&g^{v6yJw5^zT$MRqIq$yi30QNAw@_ff#c`3f&4!I{Q5yT(Rd3Q7 zz{^e>Q9L_9h^tc(Wm>(_+SE|DD`zIzoZ)@WYSOLO`U^L#5HX&iNB2H8f`GBg3^O%)C2p)!1&bK zoIs@nCayt8jPWlo12`4%_5$DyDgKDVS@}%7|2$7ixEsR8U}6l0)R{$<7~Nx9LPkRn7gb^`5oQltBk z`d_k-5N^@m-bGIj@IwR4wZC)?QVozif!eQ!LIy;?pezIWH#L(1@YBu~J0}^SKbHjs zwquYjAnx-bD-!~x62Nb@V5=wwqI7SCs`U($EYsLS(+99m)gH5pa%ir2Szf4FFp32o$w>yOSqV&)u7{&rhz>_@1-@G52Y z4;A%CpCu=7%9S;SG+W_(9ZCP7l=^5ba>8CFk-1co!)E-GI^XK}@p4{9tbd|qx$U0_ z4Md5p`weJh{b97($C&k}UeFc6Xjg_qP2Foj9$frGbPG_WBRD*}1ByHseK3xq_zcr$ z?eCEZI_&5gKOYNuTDcxtS_(gCIsXhhY-xmLDU?aSh(Q)wiQ~P#h}GV}ip11EMyv8n zJx`pYf;UQ-gbF-z*@$zYx!v%8RxyAJYE2BJX#trB5Uq)hKdM}uZx0g!dt?CIGn0B3 z9M-M$=)bJW05}IM1_?5tPwrh#UwS^yqL*YH!f9nfV3!gYrv*UPXvp~O_*{W$xcZBl zYJ*AS#r?_S{l&`%iojze)f54KO&elhYg*t6B~b29TKWa8$pB6WygxjCEV@7Wi1s|T z{oI?G{3j&ocBJ2*Sz-L^bbpiUUqST8V$6|Lj6c!M-K2k;_iGGt$WHQ!5BwQeye535 zqkmfLD;WviKF;!C15n@WQ~nTcWC83!%QyU%7Y3OCH~K)@fA;;3G`J1Ws06J1H8WUs ziGcY?02gpD3nt%+^vBSK|LJe}ub0=&Yz!l%8@*xIk@08?ACJIVZ+{pIF=rxY9_KHM z)YEag8G6k!m+bz^x?NFEt`C2t(*ul@kEaS?lvOi`SwWgI^hUZ_ z{6Jqcw8atlkg31OnIva=mX|#NtG$PsQ8${N?@VZN~o*deyRz9;if(F^yI{UlmY25U^&=MHuu*(I%^rw7Jj=7=$XN#0JcWp z>D;FvPRr8gbMy;J69QOyqY{u6!<88D2etKv&m{N@bt}%4cjBUg8mp{f_UJUlQi{ZD zy`WMWiOp|_fq`wOX@R{;KpXZUzn~3!eEG}^$N(yVkGBiZRo~#|!#C#rBWK+v%Ed_h zBD}w5TCu;_$@mAIkOB@xv-;LYxqeD9sJZRBeEZ?OPC9F#4jCo03+Fug7RnVwXfJxXA}vVmtggQ@L| zB5w`nW<-@CP81RAdmYBCj3jwF-Ithb`ZHE@LEGgzd|lYFta$!}t_PM*$OjOzfdV8| zSpRV`k+CHMOtL{cbGF%n$ZfC`10A(G7N0JE8&9gO^A^6^XO5pcBt8eF~!eB`bnO z8q6mIa?!ihe^m@b$(>?__!8=#}M9QUgkSxz%%(fmB0rU0O#jE|MI+le=Mazn5{>^{?zZ6$3WB(S952;{Y zmW)q?P(X33usGzOk>%%m`L6w=D{?)P_zrEMvsOG(c_(dVQuvgAgE^Kbu! z|LV7YzfbjeeVD?OElRce{F21lmj|rM00{surhDegYe`MZmnjTZ-1Q|{Ed=o77e3@l zKp1gvMt*cxTRz`-^wxwxn?IQQ1+@!b8WrD?0o^mF8|g&`EPhQ{2K0`^WB{lLl>xc{ z;A#0Pbtypi3+hz6Tp{2G5rB8lX+IUimy_ttxc^e37Aic&z*)%LS9!Z9qFj1xX z(Z=C-_q8|45K9JSfG*dy78gn6mt`41ZvowRrES|UM}~Ex-koRMg~x6GQ3=RuU}5^g zk2fa-9-?0mcm#nAXv-76JnWSLdSsY5>vxYD)B~EhObp0MV3h%C^j`umd!FhsXSS6P z%nB&2HzgpA5!MM{Ee>L!*I8Vf5$L$7g1n`}Lsd)EBd;{Kpg!;b; z?~gaN)2m4T5OO1{>5bOs1lHoOAKy-8Qf@1xe;@CMD1y6-GU7wtJ|UWt`aj4bUP*ih z_19IuK|TQQ_pIS6W6fsZ{U8<6&lXSzaxJn{s#f&Q;Z0u2NZ>>Z*njwAXyg`GM)|e+ z@L7GHvqoihKqcgE*Dqy8+Mg%s1T>VTfvb;X=Vc4VXzxd-q`;pOE5XsUm{Z5U>)y;a ze+r@6t5&@Y3PSvL%$v%?*{6XSanBg&SghF$bv5f;AkU_S%Fa;=X4aW!;^Nr>b*Jxw zB1c+8U_nOUd?AO2X@QoFfaHuXq4_+kd{+YFI)QHT@1}j7-@;`Bg9X>1Ug$V2AQZL~ z1Bt?dB*?6^xD;ZDO%a<@ArcPFA&lCfm@zo-)dSNr(NGLbrUlSJD9i~Qm=Fjro1T5{ z@_^kk;D!?dhI^I-k2mDzw~J{djRT3Skp7jJo@4SK=I@FjujaTrdH*V#huC}*8^~Lg z|IGmN@Xs;oPs?FQ1n5I9%(0-%81I}0*qvQ5I@|Bq@O4UlFi4C*9t;Wq?BeB)YClVzpF zV-!)MsMG7)%7nzWQ1xPia<+0GzZcMRQJ(n66}y>qeatXM-#O31tP4RtCpL9bN$+ToD8MK2GcHI6`Sl7Pw~f zMKJgt%L#!bA%^?$6(@RWj|`aip4a0%CyJk58yuJc*f%1*8Qs?>HXgZ}_g5q9&_n;g06cCP32RmohFRm=}6+HdQp89JZSf2l}DWB zY9#4zpxixzn^1qB5QuWZCLh}GCPp3(@P13gO2++&0&BDAOmBg4N}F8jk{QC*-_bFs_vWic7Y`uKGkde3+=0pi}uB}J-!vCbyZJYnbI2Uw9WS0Fv_#Yal4>BMg9S~L$ zfZ_j3yI@lVdJ}g8HJzdv(b|45Gic+(LfF_YJ{D(r*`?%bPIj|81@siT5ji9J#(SYAd?|LLD) zi*b7dFD0-%T$jp<&~qK?PTA~@EdPd9V!0wsssYD zmNRirPu+i}@WzpRbm6hM_3H}YW&2s*R_Lja0n0w2hh@Oic!U_7X0|9GpLmdOQ?*O) z3EPt3UL8#|*c#$W3D|WX#gZ5RVw#N(?(GLZ6NC5N5;Rb3px(MNkFPFT{L!qTg#*t< z(jOmLIo)h#>4#i;mP;i79nJwIustE5HS(e|U`q*LU+_*T_A`XUE69eo5CG2;RXdAv zCDikI{~ijv?&|Y0yubexi`neiNaAy_dC2VnaIK%G^FE#$?t_>^ptm2fa#imtErH9RCWG{Cq>Sn4uYV^IU{NodF{%rYF^0fMv_#z31YT<4N?u%0 zbVGSafetr^ZmPOB^ifei`*$>UQ&u*8-JxgF56_i%0)2>yqKMq+Iv{)FyiLGtHb5Nr z!%eF@$)4$*xY$?b3P1*EYf;A+)ApVFcmCU})eQgUK4V@%z-=WqbI$S2JNxS0{#UoK zBe93gce)ICXr_7<6`kYD`h?5V<;e&?Z0p%$adpvx_mc!nJe=AQ0g?|mC%8Q#g(quv zFLDM!Z{fZ#kZXif^D64)-Eyc^u16EJzh!l>T!(3auuxdVHk`2yHZLHhJv^{wZ!nR$ z#=GJ1#6jl@Azw*mjxjSaaIFU-)%U+cW7g-gYhnz!ssysJKfXJJu@kRD5e2OkWdJIH z8LOYlfFaHmvdR0W0hIlZ z4;IRydf!o~OkZa=*Pj#p@KpIoDGX}Hze@V?y6;L=5ouo;u(!*L<-txUJjC1J-OF zinin&&FfKD%?|A%tjE=qp44d{J=m)${c~mL75*n-fV0Y|8N`R~`54A86Cx6SF!VLk ztX=Ta0Nme92`MB4_P=mA?tbk2Hpe~(IyAkdGZ~sJFc*B;NvIvHrT#wRBjj%Sy-RDa*UlHSBf*+DP#F+*2(^{Mu)ok3 z*;mLW1-chcUJcxTn<{8!^QFD3_(|EM1neBTWJM-0d=fz2{FLJ@LPUM0+GyreTp}0FfxQFx?`K;*vluta5=&wFCFqNSIQ`xSNe&;32bhz+TWa&LxC)8?G z_Qkl*rv4AMvCv5UA(k-FU@L=Nz9^?jiMo2QSMw~$Gca?ZYV%M|ne zj~hM7J$uj^3q&3=Bu59Rtq}}_#n<2YbdXvajXYIU2Ac5Y5}5FpUr&P!X!iQfM|xU# z2!vOnE*6)-=hNx8f8T%O|M1iQl^l|##9c(oq6AK9BY)Avdg3qqPaI%;yUgyb4if_E zf+Guedu+=ZTeIeO(yv>bULMY)40!4$_$?WrEKhb%C8LV+}PCny6W^5cw4c?RI&Lz#(sa+oyu|~s4jve81w)x zA%KvD7=WUfDuH^PK-hC>J|We!sB%Xm0_av3U`wt ziliT&wJYjXua||j*p=ptVkn@cN~LprnDFp{p^*hIL^XW25{%8si&rzHhX^?3%HAVs zb($7gXb3H)*r1{pNc09yCw`Sq{NMou*YVI_7dkR>4#RHS(FDe@s3_Y1{?C8q|Fayb ziVGNo6sAArCrBN?eAS88+A@G1 zT{B(xopgl2^sRfkQ%!X7>E$h6JkG-9{9q4i$9ow=?=3(MA5)x>{#C|5ybl>SL4geN+O$bPtp#TG@eZXL2q>dZhd#^$#(*wvZD7 zln&z@fX-J09pZw)slUFu=ni~Ido%5}op>wn_cH@T3u#%Jy|YE}phx-G#Zb=96APoR zRjfXeDS9NVGF-ygb}mNrz!yDe81gU~8~x>tG`px6^kEyYjr;-OH7*F3mp@y5jW+7! zoM5pilL_C`SZISD%Ba7!(VqyvpxiA$U1LuLUIa1)lumpICqUaapqT3hI4BP#zU-$U$ zU2dK^WLi|5mjbRuq4Du&`=NYm6WDL>r)c5_W4S37m^ZJz&zd4KNci zVCN|Nj;uMipeZQv!Io(O#K+y%1L#d*KpNBu7*=cC)B+Fkv>cQh*v0k& zey?X_2dO!<-Hk7G zpzF)sThUkKyN$#8Euio4^~qd`wGC(D5b$E#gX-2c*z%yE^rqAo*}~_UUL1QhrLN-4 zVYkr_L7cXLirK`Oaed5s=QS#`+_}I1hV{W=kwROkj z3S!weUm3D360iw@M%QJ>OwkHY%T7T?1(U~4mjNwcKaJ~h=??zO{J{B3YmrY64@|W4DV|P;%^-{_RCwS=@~hrQ5;_n&%HV?)ylFO9$W&wYhgU ze2=?UYEP{?RD_D-7+^u_=P1lnn`9kV#bz zcKyWWQzJ1QkP*2&?8qr&Sic_>gIFqtcRn)H4suN=z;*sCU zx-JE_?Ln8{56d2(K=E{m?6RoXButnPXvY55WOZe2-z8{~Sj&p|M*N>T<@U{g)X(S3 ziVS#KDyLKXumNb8QwWS-Gq7B23zMS^kX6X_gg}!TB7OSFYC`UpgruunG6g(Or<2?r zNaC=Xax)ElJGjl|s12;w!b_z}2NLeV))hiU@ui;(4`%-*KMPs2=WWj#i+kpnM%pI& zkgYL*ZL(w&ecpM1Ii#Kt=ojpPw6&<000aqnIO-P^%X!YgZzl#;u--B6$J+{t#}^{{ z*TuSv>u)8nhxAv>1IL~^ScqgK$7xI*DJ=esyf$;Df%hj0g?v{@O2|e@`m^nP!uU&e zzL)D`3B_k)c)wc33{MTV&q;|vS;5Q7A(}vC%;s&yTk?MRsa$v9{h%h0;tS*V$Sb#> zWwRfdGFavgqN)J>5UGEo<(P5j<}jBKWQvlc{=Dc5-5*0N*7kB%GSbDH*65p^Ls47x zbVF}w+e*ExqKvGECV}?a5jqh1FBnI0iEa10P*buEy~xpV4|q#@+*>k^M$z&J&9>Px z!+Yp;Ws!XaM%(wqqOy7mp0c_Bzq&WZsxbKCLkVA-qx^aW*rEeWud zz_ko$xfKT;RSnWx$dZ9t2K3Yy9f&eOo#M&~0ex5X^U;J)vYOc`owo$v9u&F(9r9Eg z^~yo^@13OFOJ7xz2dWIyrVff0KjI z`lJEq1f%;tZc1*?D>6XO=blUmB)*<$ef&L>0oN;mu}6I|J#aP7Z>k)wcL92)aJUKA zU%$Ui`ZEE&1@E`vrR4p7H$5wa@d)pS*eZU%O8U!-yXgKp*RNTAF6XT>ACy2YC@YYd zt1JeDw(65wyjI$>O(k&lX!6%`uBd;v@af;ek!y^=|hj%>Z)#0N3eo!BhBw|f|bfnlnMycGq&?fv(yHzXd9XL zA4sO%;)juYz$s=QnKrom<`Snq)?Lz^8BD%wb#v0+x)uJ~BlDglf1bgU1{erN>D^&W zD+-#R{Ko6O{Ifi;hN}C`2u+pcsMc%r_NmL|wZ>#N$4mn<&1fuMSJk+Xz_q&ylX+5z6AjQ z9Cz@{85-wuKJoB{YyHBNLLnr1FlYn)%;O?;Bl>BUV5SFF#6VaxFmVvtPy(SZ(nM4S zNNYdU9kox;A(O9U0KD~H8E|_gkRp2Ds$dVQH>q(sBmkbt>~m~K70$JEU+*3x{Ws_R zNPxm4$l5buEy9Pva*g*do6uq6F%ryk%s>(tW$L@fcr3Lmi2hhIIfj(&sBKUTxYL5V z{U(dPQV4y|f%ogUE(%~U`8O+E>mqfztl=}Cbfcn_qP4n`Ti@N9oxX`X)B?dY1_aB3WuqTxsG$v8_|O>Qg5WMZI*=<{ zv*@FPs!ubqM31m2Hu!+Bt1J;1wU_ViaaJJ>pxYN_pl73rVoP1^|QE zb#1+4ryn*g@gjl4y}Cj$@AY03(#l%?7gzh{vhPy?PW{bmrwfBNH>55);UC>7sIU0% zTzsM8YUbB}h1A=k;r5=LD}HGk@h{Zf?<-qxvjKZ$z>K92uOjO8;`AnkaG%Eipf{wd+Cl04LG0FObjqI@;OJeHiI|PhY&Qp$8(;` z16(qTrhU(bt?X(l; zjsEqc3x<`~dweF{Kg{p_$-NIAW&Cxn>ap!G??;N6BEo?-(o+vVFjpO55A*(#+|RCu zw@4*cGydVl)7zyIgkaAj`eo81L4kK1t3%erh4KXYYNXk&6ue*U=h5VE^w*y9Ww-iM zn7V2Yv31&Z{<=y4R{1V}e(}Y{Lj7$|(jWl>_3zURea)c+gNiqwpymI>sYtI|7CI+b zW)jp|AEl``8Z2+!lPuM+E?4eg*Du@8fRRkbLK_d1;`eot z9#bngU5MF3hVe-+NoL_;6Bt5v#rtS{|JZ2zm~E0nmm10tp1u(|5*4EeQs=U#yTjLA zyJt%bM@}6-a3{}R7siICTZPIK7_+WVm&Oy`F@-g)2ZBMGw)_;v-vWoiv}2yV0aS^IyK4`-xw$Luilzn@&MC8z5_igAB0szA`nZUPx_aL)bhh zPY86P2}+=svuv2uUO?HYbzrbqTEExx@LfpN;0b!c9VmT3!$Est>R@<$2K)?@JV0%L z!oXLU43c0&53GxUs08F-=2azN6am*6Z@30+`vo~)&oV%24hDs&$F7(Vz+QA#UDxY@ zO+1q{zb7H__#)&!M|8ebz}fg$XLXhIAL5{qh92hqz*FVhyAkil81Q<&GKTkC72{u_ z`y$q#OGP zsS;oQ)@zIZziNfFde<~Twr;hCT@9PxgY0Clfe$9{A0%6x0eO)828kOz# z;{>v3Y~F9{0N|SiVSA6po_r=iYC>TvPc_Vj6FN$JF8W&3aOV9mxuTY#8C zx3I&;A@WCa%{Cux-EQ8Rt2#tPi2cIf+PsI1oF&{Te_t#q2640e_be!9)?NSmA{|^I&|?wO-{|6Eq<1TQH`{j~qJHr3 z>B~a*D;c0}LMQ_+m!}7m0ft7{zXZ3RWxF6S^t<8TjymfRgb4wq|DXi=pRi7#_ZAmC z?77QFV6NU8waKWH-eDH#95l42(bXp(Bd|p!lQw`q&ZQ*S)C22c0F{8}_A*fd{+biP zJXk3%NBn}uZ9{`~Kdut?Z)!yb98m)6jC$53Ufz&}9}*HTlh4Q7u>6CPXlL+i%w1cg z{~44t#5hu9B=5yVd6`D#A|!>i!q{B}f@sOT3Kq-D4B?#Sl6ElRdF>UmGq; zGTw>6%uec#YANA=_fvf3WfyHHd9jV{HG%H&)$^)!T?n*%@f7uZs}2A z_V@CQwgbkD`irWONe%NK(zu0fw?MuExV`?Os?4iLD)g!1{a{fDYXFY$_3qCJ2vdkv zca(?+OyZ@<2blA8y^$pWd}W0m*c1b(1fV>u&x}eSt{6T#A+YKf1Ra72<@)r1BYr{N zTw^ ztAo9hd5K0tG%D@8UbJwVi2g#u zn!M$(CHxtmvdE*6st=!@vNjlZ)G#LK?_vX7p+(Swt5)KsG1nCEqHfI=b85IQ!J1RQtYR?xefz)0B2@<1UH7r;Yhu+{ zE@oWu^J&z1*%(I_6Lb$Y_aRbe{dO2YS|+S|;Y*|R?aW_shFr|*osHY>KD7)`nE>1U zh-uf3CId%*_+Q@@s8e;I{(3qB{OsLY6A7o~Xk&945@)R^6Cy^ho5PaRM02}xhc%;b=|geMqSyBZ(y-?3HOW$^jglmvqw2p04eF|eitwC53f)1U-;G47ub zfZp^nkpYrq=m4ML7nJ7^CQ4va3=EGR!1>uU__c+^kqkfgB;cb@?<~zjbicg3M*1fl zw5FjWpH5E!cgnPQi}%BI3$)Jr*DvOTkTJ|i{|e)u(*3IRRwThj3C|08Ea$QOg8+lc zdL#WwUx5+dcsBg0omk}e(p^TkAH3{Dxp~v;0^im}+iHY->1jp^vx0soDLci@9bt3YyEt(n^bUvttZ*U8dr+n%p zB%WT}(~kGII?th#OTVknu)Nzw_`d%pj@p5>#~#mP)i1$&xl0yMWB!$d&I7biQ1tnl}0^J>{ui=r6 zgM4mFJZ*fbZ0nYk{C8g;G0Mw~Q`_0!toF+pVNnKvk5D(kcW4!Bog+BG=*N=+A600fff=7RI4Brp!0c)#AgOvJ!GC7?-%azWQ1R01m# z0+HxfenICw#|iKE3yK3f{5~iK#z#X9UQVxoD}=-=Xoi)8z+U53r$m1%6Xl)#q`zdY zA=*t!T2bWJ;{DOZMdP@R^pA{xM)wbK{hdU=C|C?OR@P9$`N28qm!C#Yt%!__FV?ZV ze@+ji=VJ9+%bqiOSy)kW2I{1|8|NRoVKvSgbe-Un1Z@^z*_{)z>A}_f-}!>_d8Pj9 zFytA4T{~eFgscTtFBmK=W%G7sT3a$0irq(}yp6o?=m+Cz=+^Zv_WVu_u_;6!+-`E# z0Rtxr^glL;Ofa1IYf1WeWOql2p(`HI_>ZGbSRdTWP4fz7E!$2MWROMYBj0m+;rJ?{ z>$7qXaR#fKU9!FctZ?S?V|5yPJxehf$UUG{H}n!QM>2PYPf1DTzBx&_b08=@vk;##cX%)+d^C z(z$JD+UF-E&|C?~N}NtZmEtd}na$-&t{??=)4vnGz8J&mJxl;b(w`;|6ANrdvia|! zcZt&ofri3mw@SDr9J6PO^3N|V70zG%YrpN9#}1a+2GL)wgxQ@k z&Yh%xKSRwd(*t-U`PQ8JC*BV+?BV^^1%yl{-oHuuaU7n!NGgHzVXl8I(GSs1f(>Fo z@&MKp&6U0KSkypRm8Hq85PvrL+hwKhQ2R>B+rIwl`6GFGfP+J!h8kIitv;0tp^iYZ zZ@>B|=4Xisck?&%rNwPhLn0b@zgjh+9E67FLhHAD$4_+hP$Qltg1x*^Lqut?k)Z-Z z!!F*_9!>_DFbu<#x`Z%};7v*Q8pnmb;J_dM2?P1KO?Y4ga6N{?5{SR5cba0YGab51 z*JM$?h>9IQL+B9P>W*AL=znc`A$#$|#7@I6^t$exLkD}a(02v{k9oO3R8sSpJGbxl zD|**`nqgHTNG~Us&U=)@AQ#jd;YRLfh1+hG*GC-`)8yd6ABXmL*~Yw#9klc39TVMf^A8< zwbZ&WR%?S^nB(;rGh`UAp!C|hCBwu}2=V8n(4v3lTJ^0F@qKLgveC=FEM84TOj6fQ z@T-5_w>^j1AE5Y<#_>BhVEieDk*!8jdx(QN+m6INU$KCJsx~4Pe+K?4tWSoGF)_b2_N5q;}m0?CFCP>tTX zvO>CJ|1b&Qxqx_jCG~GlvjS4VuZ6B6&mDyJ<*NiN9*HFuyXg%eH^N!mk4%l;fu_u_N&t&GUBr?Pxt%Ei?73zNLHon{y|yarY9+A2r=P*KFK;Rm zUO_ONzvgRy)2?twN2M(xaRt{ehOuh2+(r7sSQQ47aPgMBA4phWw@%PjdB51(M&2K6 zw9Z)%kp7YJ4`Lt`+99sLhv+A&kwT>y#yT?B$@GH3evYQhK#GC*Di;rKLdd?m!O|Hw zF!bemcXQSQzFJ6h*hw~hQ4YHGr~FjvZwf&d8tkS1T_Sp&`_uA-yoI$it8|SQTa4FH zBJfzDZnu>#9+dN`H0Sr9p#?;TkI29~bwh7cJN63#Tr#spD{>rM%u!WG*0AGf8n@Es z@8dti@TQSyVGYD0{f_DGM8UQ5z0C66LJ(;u)ZzRLAg=eqoX_8`qs8-o{N?woyR z*)sECCm)dq<A1M>q#1%8 zG5{&RP75fH7xTP?Y$pS6$^f5V=zc*M;b7vAO2Elwr2Z%fVD+;<)QvUvI95&nqr2Z| z1W<9yD;1w-#jrhC>KRr^XLYHUmumoQA0f4Zutqb12g@0*^uQi55U*Q|g%ZG@s~5Lr zfWP1vGG)&{smrHyc*2R1`) zlK#jzhj=!4e@G%x{E>0mMPX@5)$!-(z=NZEVsjW^r1+7#8IjF74>^Q91aVRk?xM6O z;-{>mvDoWMsS0^~FC9+Cw-{xWmXoty{k!{DdVvOmyHV_Lq(I*R5KR2SbJ7Gt_xe$z zde9!aeiv%kwhDrb0%w;ELs7zX-JrRUMTOx($-k`e4XW4H6Lh5#TDaGeyZ*P*?n{i} zdi&K$kv43oe3Jz6j*q6;9txU_?Fi!WVI~Af5kxyMj7I2zo(Ch{o-jm-(qf<;Q3LdH zlt0&UR}KmAM#IbKh2i6hlrfw}3 zFMj_)2B>LVw+a}7XKcmXCb7JEc*Ty zz&B0wK)(F6FVh3ApdqkDJ~B(Jx*!4Ib3*$!{u>)idH{()cE8qc`QLDAM!r=T0tP#G zBEia@BljJMHR^;=m@_2+(L#xZpI9K)HpA?u3`=eox%}~Q*dqSqjH%b4s@2?5;U`I!i8CiAsIr4scEU;K% zWS2x!ktm}A2$=*XZ4vHa{3B&AFBT@f^hZ@OiRjlP!>c7Q2~SX#F%8w>c6Kf2v0yRB zSaNDrhoU#O4fgj?LCWvj^Zj&Qm>FnGa^-xVZrxWdt|xq{wos28&?icOHD*~+e;uexB8Wtr$3PQjNUYpokBC|DV4qJJqdl;M8 zTZbp2FtCk%BJWq$njX=V+I#6L0?cb1sbmdt&cEN+ajPJ)S76=^W@Q$F0n@I(Ywt#S zW^GHK*gX1_3)ZBq_my@57JYqc*-ge=bfTDCeM>nXHxvD?IlY24IWe2dnr<(1JjAqL z1imG4+6(C|+lxjww3k?ou?D*1BrO=(l?O*9Fv6 zR+9dGj358Ii|gNl=!a^|8bIEn8QRjVK}|trguU?ns1&FMFI=PE;7boI8?}NjAXZur z^j}H2FEwa?E=R_yo;mfGZMJLbj|q93Qu^g`K;6E@R|9^GH7G4ao2(Fe zYiJr0y>v8;acXOF1+B-A2RUMPpx58lF2Wpu4uWtOskTOyn7wn)YD|I?gyp6ZKINI} zWp2qvn{gPXC!{hkMqGs9)smNP>pN%??qJ?Uk@I%B>d_m)k|5F-xe}0I{eqncrmS6* zXW+_%3=qX~s$@Xt+EW=2E%t%Ws|_D#15~}N$N-oY=rW>7h^ImZtSAAK4O&XsjE(Hy zc1<Uz9A-$ZRqZ`($PqIc22&{zr(@XD<`AO{qqnT}y((?Pp62q-lYjN&rh3 zhqx@ciZR&>eu?M&5 z{&1-@KZp4D@&0u`pVjNm`vWVrc#|m_{766X=Q*z`-bM@0ElT)`DFFapt_+>Mu$H+x*|iez52(BnDvQVKYxi4weDv25p*> z{XhwzxfB&}ihKXN#^{vX@`2^cIGGLiE8ybSJb1fXq zlGiIR_%@*dv|eK|YSjxzsFOa}E-FuIF(T_SCD7vq5*%rp8T)}ZFAhJdDzg&kQJk|3 z=p0?*i?kmfv<1j}WI!WjK8G&JGnl{Fbhyr;`sQ;_0x4Z zl5)=Y!&~R_l*gUG3q5uk-qY%Ywl?`23)h8}LHH^4U;Yq39+*UE;ncn7R8xOw6~gi} z^*5h>2yI0KONWhT1rnd!grsz>{pgf{Xap$`Ok$g;VJ46GdH0_4fG+mQVkxcBaH2;y;8I(_GC^u~LBA(852*I2m} z_WifI8p3+j$4rbOA7jVG+2`3FpDWrRWnNa-w7+_1Cj6F@VPp{A+tA!LEzD;Nl#e zd;B`Qnr3)u!QcX57p)JEZrwjf^fN)6Up>nBXJL>MjZAdL`||?5)g{ zvP01Y{}~GvSbq0qv1j{!KW@8MktR~0|GjulJ70$%eW8Gyy;@LzdkCpN=n!mEoq&KC z?D>&RU9kG}^k4Jr2hx@Fs4+m?pgnKx;_HHwXO1^zr{T!#oTOQ0$0-6}UCKf&z%X3I z9rp3oWop0g12||C7>J!0io*}YAGAv#?jaM!k!PDj$n5rdKRxjT3LRY;K8QH29rWP| zGEW_d2BNQJ*blZE2))*tfA9TDT5~+;mOAT(&N|Y&_pfL)^hU`6k;K2m#Gp*b9=D5` zfC{yDUS+$!>J^D$?i%D10#OD4Uju?}yW@{C0NDD948TOw+(2ahknJb~OeB~>@QH&~ z)>4fhk$bdl!L^J<}5-8dHv|HUxr7yQo2)h!x zDZ9Tevh%P0_1`^Q+x_tBShV6YG<|N1>#tM51Ee3hMr5=jzaL0&AevL&kGvBjLatx& ze!HTy$+!O8&-(+r4X@x=!bN!b#G%JRtGWJ7i9S}}Sa&kM7Wza<@j&`DRXH!rDlKfN z1IF||azv9q$SF&8(na=efv+W1aU||gk1!7)#7Hty;LWa$8S&7Kq_Abvr#E4!yS^q8pE0xh(8Z0fmk;# z8YPt&rx*4Pzn~Qvp#N2i%NR1&Z>Y*GC9p>f?4`w*7h(Lj6%sF`7S6x=>%aRbv-eS0kp6)_CURd(g2b_%D+4`8sy#FL2P<`<1bPy-*wY`YdB3JLWd1z8 z0-b*~9U*^^Hf7m>LLcaBT&2b_yCZAWT~W){GyVb%tGr z(sr_GCIQm|b=GKS3M27bbVApZN=mDii^wct)6YJ$Ad%r&0j<3|Ig{{m1=kLkWjfLE z^ZBIP_829$Q-_tDE7`AQfb!^ZiLf3B92A7gfNoC5$bkJR&o50I4Vv%7H(3Qv;N_H-K0X=yd1_ZxX^Gl8{W`^r`{I@QMBJpw3c0NeqnB0(+G} zR0Y%d35U6~u0k&1aUTqUvMO010-B8FuiNz}MFk>ZV_2m_zgLF|983q(|*(mG^*(Ed3w0e(fZe;O(De7 z8nRRBkRCKD`}{C#cxKp;b5kggUz8AQCx4mr@}{eLpfisUr({^JX%C}h%U;u0eTalH zg44bRlMP^6^<%%J#RkGA%T2)0A07FPcsadNZjWRgnP5LNSXuZYC)yjQ*#L|4>FLQg z`fLt8=*Od{gUM|O30k84r7M_aDj+BoeL?qhLav!P;RaWB_N70~5vWyTW{@K#YUw_d zOb$dselRl89AJfYC7btPAg|bel0d-Jq3Jlcwzgo+4wZnnpUB!#tTEe5c{Dax}_0z>mC3jK!k`tmYt{}5B3#qrGN&%fpyzGrf0$HNmUzkYXeHD4~w zz$*b(8GmG!;cn)sx8VH)!*+^@q*DkP()-9jC*J>SygyTTC%2wM%wv3={B}+o^IN-* zQ&EOtXpY5FR^OcK=PHAZ|5KHX^_3=M;H5wqgpvvh2lw#zmA#F?cb^BL&`#zTXCOTS z*sH@FiDHdh{Ja2ZSU~-~Sh0Gs)o48NO^y1C2(YLvh9K_NByr$~X0Ek}BsOJN{`D!B z^HNuar8>c47<9s^Mz!aU623TpAk@Fl>3fs&F$|(`JplS44i9;N!PCULYzXv+ zRK=CNAIm_Jg*)K`%r^V@#ll~`cv2NZ$r?G1%}K9>W0=irD0Cf8)H~V7c*DM*nefMo zN7`oD_O%|?%CyP&tNFTapY};`>Nbz_BSzMZv%E%Y2za~52HKK$Ziv3t}o()SvpRv{!s~-PUv^6 zHRjAf`aZ7%sbaf@?8I!un!`6j%@(hFk?m9hsdmQRweE`dvF*#VDfKkw%iF4j`tkFx z`3>K5l-chIHosBa+2r~~n2Pb&oMw~s&q*XYx+H4duZ+AOh#K%cp-_G|aJRwooQ%79 zr8&3-A-|xp2y+XL7REgy*`^xJ2 zU|1v|+o*)59+?wVj2n!#hY4ICP5sE@Rv2))HT=v=L}d)}YxZ|04Ka}LKbHZXK_mk> zBveNT_n1{8gq~hi6jBSLo10y%m1nxX-B}iLYQ2k1+s-N^UsFktWI$XtVCH?VV7V1`gpyr^aDFP31Nvyo6`-os(O@!BV0VYlSy;p$Ae8B8NM;{S_$~y zNf@L*vl1A7Sw2A+%w+&RhS99ZfUE?@${6cH9)N=00kqeD{R{NMh@ z@4Zd{tc937UPgO}>yL5oG4rQ5N6Yb1-jCF7oo6RkA01wiPM$}iZ_mO{r^s2bdzpkxX9EYs^8s{C z#h&ebg4(F^KZ`)ztKi$LqwRqsx7Hf=fGX58X5Q376E&{(1{Ks8Xv zfTTNC{DOkKL3L0F8?U2L31r5cXyN?1+96+_&(+_7a=1DR=fC}%zAs? zQ_{bm@q1iQcK*s$frC`2s&8O}L%ql_i&c~I(8#H-KLw4{1N4C(e5e+OWtc7L90kf% zl^4`?Fy`BKJ-#Jp8}W?$>+;*u2dHnC(v#@>AI7L*FCR7cWA3YZ%SU=ynMAiHy%MGi zjC}O~uoO7?cXTS$qq>YNQi+!*YEjyRK!|e%k!nh0p-rXb0n4^0_&^>$oD~AqRk9|J z2px><5%{0P5ozV}Q*tqN^+${WdQp!P8S90z;||t-9Znjh48WybU+!b42YO8Hn_9OT zOm0V_k5O0z(|7W;;tR~Z#gq&}3k#Nfdkm_{<(5=5#O+K)D>}_2h_KQ9>CuvH;q5<{ zdO`rn77{k#`=$gU(KlX?OK*{j*D?Us27tAHSQ{YJ-93yT&7ehK4Ff0vG({_UG{PD< zEs#Semq`!!8eivy`iFk^BU4PoNWQZiOxuUl^m({7KC(bvkg6=UquE3EH@W`2B8GY|p7q*ny@v(J714+CAPF@8V)pX_*NW4(@E7&6 z^>o2$NGP+Fq}$t7Z)l4N#Vl84m9NGnHg;w^Wzuo(;A$FIL-J!FMU28OuN(-=X{?novR|Vw6(U$L< z&yE?ET-pi&keRD%0LIt!a@D#^>Gk)J#vx$>Gm{yib7A;*pD=glFvhRfmygJO;^BqC z%xg~AoiztTe!qsyt-AsZGN9iR*Y@m|qi^X%90=yX@Rxu4hM{2OwIu--$mSz(@<6gT z_yyTpn{)ua+kg60h>M?2sYha$IHJzhgfJK&`siZ|Ff&E6yN|8Px5g?GijRzQ4w=+? zC8y8Qiz|x3RWSfczy!pa60nj6J(d)m*Zs)uvEe~#7|@anW`0jQDhjI#zmjX&la4JR zmMT<1s^(Qa5bs=0$8nuzm_+qD&#b-a`PY8)_Yb}KB1nSxBdR7Q(M2whezfuQQ(R53cck%-A~b2fd*&1L+S@4Wv0TX)G%wgOJ3a1jg$? z^v4Pssy=dkao`!+#vsNj#iISW7cxEq>t#Vpcul$mUpL0_`JD6G-ac0Nuv3uLgH^&R z_4fq{nd19mUmw_1Nq~CPJ$d9cC05v}GpRmv0kV?>>X>TIUpGfG8fP z@rjBcy>mB3vy)p!lyqrR)8^)WKgNvonld?E@|%tEVOqdtfU`O@$M@gClSelTP3H!< zvycQzHh&=hNy4DE5LW8>23D+houUGL45snGnC*HmLyIm}%8Io(wEYR2f+TzWlqvyo zX2x*O&yZmw-?lP%Y(kM+V+`THYup@^fEA`RBxo2Q5-l}ok+BkEQb8b~@Z7yTKtKFJ z23(;8#vW-y59E4&8|VHjgv4Ryzwd$b*M7?nYzJEDpeMJ+%iBbM7%x^P0YF+b@J7l?OcH?J$=VTpy{yuO%9zFwqK|Gt+4-mY$$JRpMNYGO%E48q zKihnI!j_$C&jlIKpKRp*T+0CE`=ty3*YCETcaQ{AvraB&My0vFD?Nw<`R<10un7>drt$%+^lIk=T( z{uv%CT!T{G1yzXxGieXVYRu>U)z7H*+f*>2}uEAy@K?^e=YDX-jC!EXd#3Lst$Zk zxgg{Td4EW72k#HsV}~pZ&Vhly+ z0X?6uY@T(*g?)Fuul1Yf(|Or7#h*j>j}RsJgGd~(-()Ye)s*seqtDxf7;?Mkvaz84 zpSZbEC{6o}>;amN`w@8|N4gl~#jh#Y%Z z=qn=;YJe6|mpUnmyenkSW!he3pK*KFHbE6>#-xr!5c|G)P*HS|3aiJC{q|o2`?u~S zs+vIACCp`H_8WDau^|IguttBfawP!DxyEm8qaRJm^@9ZUy zEv;m%1wIsQu}Iy}_r+*bH|Yaa^T1B)!l?nCveUuL>icG(t`3myqrtcZlsAC;s01qe zwQtgoY*;QznIosSFv1|AhC+*q)ZD+>^x>3rf4t>3`|#-jBaaaTUOP~Hd`)Y@kvI$e zAH-e|OQ8a=nS_Snj%dj}t5yXlE>Hp_Rj?vO;Fm?7+cW6AcyX!(*2Tb@9>7|xa5PguMwP6d*RrSR8{qsT|3RYtntNO7<%j z<4}nx15UxWU7vE(`2D0pau} z5_+#?WKKzqNCmBBITBb{k1ckUS}i=c~L3()9a44AOPm|D61G{guA)EC*TokvdKpZvlBm+PWz>co* zJCa&V5A0@>?nDHc^N$j%1occy!s_v4?5_anzg-f!FyZfNR(@asRq^VWF3WvWsd{z@h3 z-^2LvO3C%DGJrw%>qTdZEPK2ab|3`(CTU-uVrGDJK~6e1#|nfxmIq}lmlCvfvREy; zQ3=i>ajWJ0Q!V~;+T=@jR!{(e0USbO6S#AFn}=*l6Zs9>4;lGxUl z5V(y$?$m^Nvdcyuf}2nX3>pC}%2-vd3xo%maOjx?-YzkARtysYlAQA*eFf#^&8(0J zo-G6b4)2-l8{kTePY@Rxbv3FW1JLh7XBON`NZj`e8K4iEA5r3(re&;5fFibsrGXV< zz{@#Bi|r02Mz0g^Wx}_Ggu7^aDYoLH%KTEMWXA{1TPh@tq;{aH_U=|1i55rd?|1W! z-F`b+4`7=}GGK@wThUB)=v|-lis@jXq1@Y20`^%|bRRFpsv9aZ{l1Q8$7c>da@Es& z)WYHXx8Ucm|Bk=wN)I2ozU%7X`Lh!FG~^21FYm69ei)XWf=7CE+R6K!NoS*c!TTXC z2-Q7bdprfFb(boBsMGLl;2e-o z_x<;naEab>mT{BFNs2(_$6Y|0XFmC1wE9!Rad*=>cOq` z)<~=xY+F$*h- z2xQ;*V5iRgr!ETCHv^3Tq}K^wV(NY%K*4zWLT9T1`75k_!KbumOSLwJ92J6(WyZb1 z^KCGD`=g-jsz00rJISx8|K+F>$kabqRh9veNR|OTpM?b2kO84>L%GG`nka$LhmV!A zPr{9XM_kS5uh9?swRT_2O@4HKitU*AoG6B0P_ApV5F3-5d80v^czc9XZ$1GPh3Ax z(pWDLS@>(54e0+~Ry08GzSHSoL!CP5cZ!qiboq2cooWe-#nXz=7x#KS8b@)ik5$#Z z_F;){i`82L6nwe8j~bjj;nYxl+CdbKzo(EYuQlHzG|dB4JNYp5`Tp>%K8pZZDIs=sFvhnu*|Pu|66b(MALS+sVN@fgFJ6bi$F7~>_MAO?cwQ_^V{ z#0R|+ioPDyt^2S5+*p~m{9Q`GNN-?6vImYlDj$+kKQPD!Mh_f*;BIy;P> zCJ$pvcZR+))e^?A#<@R05f-hyP7wfJWnK z&18TzU~HV$bW6!GpAc9(6(K2sx|AwCP}Kf}8edLFaIGrXN%1eYifVU0&)@Xjzpc1B z873wi{d`Cm%!vLju0N;yn~Z-(`hnXI#_vcOS9t%(#eqeG`4*{v;QDwo68OmbE%kx- z+t0vPO;v=S@K#Ao1SVY;)IhI8k$YVfRUkuHuD-Fxr?JNJ#K^dwcI2NqOqlX7Xx^GO)D!@irzlhs|0z1EKQ`{j`W`G?N zVjcE(hh~_`e~=a$0*9E$aj|d;%m0|Y0<+F~g^=gx=Y497BfhH%X?*7*Dw!C7xRg$7 z%-V#4`10aS?mgbi6mNpH?12g;I5-zMiL|{$LoGX5z>>{W5CtK;qI5V-Gxh>^8)j?& zVa(N*hNf{VA5#KuJ~pn~`H^fBsgWyRkNo;n`)D+x3*=DAoJ}?0W6~oJ24SOT7*Sw+ zK=<%kB7*XMSqT_B^rDZPSbB+At$jXoq=2}&53oX1kjX-f6{V3#;LG|WdeH;J!CrE! z;{7fO65kDESC=|?IZW8Owwm2apppT(wgdTJlL3}amH|m`Xx9BLv?f#G#MfL^0;^&m z1PcwKsPU_5x&+=IbVz1LkR4%e5y|fn4ETwcM6;w&+ zPs8=V+P8^*ZZkHTBgX>`;LO;gRsVjkeb99wt;WQSheN7<9qjR@sBo)(Ey+GAXjP-n z157J*ccI2tR0o93Ks(#8Jw1D9wZE%yKreoG(-AQvkMyGNNg3C-0*R8$4dQO24K<4l z&*g*-)_A!JixnD7v1vo0`7S{Cj0VLP~?77rBV!Ord zIm4n}pS6f90c@XsiNuYR8gMotfVmKIW3EQRlEqivnKaBxfHl=QwDYPc12h6O^#?MT zb_((!k*7Ng^a+5#DYf4HGFoTx-R-}<0{SEaFg$q#UlsTuutRjg2L*B7qCP&85ZXg{ zL@hSst?;2B`!v>W0m>|fRm5t9&y))1Z~30TJN%vuF(sQ{ zRSrjpejM6DuxNu!SuCu`n~Wc*n6vQAWh0eZ<^A?|Hp2&MZ}#1R%lG6S?3gJP924Ge z@o)0}WbDUjjcw8&f6nOs3fGVIIMA~>(I4-ghwGQB(#v{my|Xt7FK}T$P`{9hFXxr* z-bJcuJwgdswT07-v!lP&f>_aY=Aaw+p!h`~332jT5W3%QIrXzqzw?Ikk6&*VNLJYJ!LQ zyT_W6C%vKh4UbbRHLmTM5-H5^d1U_(y&Q&++**Qk30H#1vGVN0hs6Mu5XDu=(Y2+` zl)w#SfF&{N0?;SG`^VN`4cN;UssBU?Y>9z%b?C5XReafR&A+^?Bv=o*5z8JWFoZdO z>-YUVS1|jPkOQBH0Rl;?pGr4U0DKNDwfhLsmx*558 z(`)5>bpHc}u{#y?(htrRLERv)&%Q3ITJRJsk)xpGq_dY7Cs<7c|q zM*bE}DhD9!deyVzMt>-4ou8gK`g=v`VURwbVEjI6Fgqj|H~mbz`)dh!-eDsosl&W! zCFlSsST8JRZtCuXYXi#9P(}w&X!!86bC7YVg69vm{(`z;+FD$-ThPGNF@t@e$~P;v zUu3Q~>G1_{zM!+EJ#uNE7{EZYPXBl!>1xj}9^wY~!dbudVqYyqY$$QMq09!XmX=g{ z%Y?m&(q=y1lJLR!2a@(#nZWU08oQgOV@2y-qmi6Nlrv;SX2ht2D zvLV~nPstyTmFna$*aBj&wR-w*7&6MV5+9v0ROGc9sQZrriyb}Vbp#1Y5KQl0w}B!L zH2q~{fM;g#3$pfHX~OA*fL`&hrc?r(Vjz8JgCo#oKU==+=Ihhswn9Hw32fzXS8jTT z_HEz)KbQqrx6b;NxjF6%qMyS=<~M{4w@Svpi}WLbJ;3{o_n~1p^L``K!26A`TaxE3 zS0Cj4{>&!tH-X~XCTNtx%wID8#Kn>Bmt23=07AW2kCZhoy|LYsKHBmL%r!GxyRK~7 z)d8?)j zWgb8d>5{NW{e@9w-mk7f=-Dq}Y#F6hwv@j#6YbL>&T%K8z`P=%?`08&+*x-rrS`_- zv+$^PfI$w2jcF*5oQYm~wTXGuMEz>u8JMm1Pn`bPhx5K(9%%M(E9YZ!=x<6e?|Bse z$_0QPJL%dW1GI&MY5(v5Jmfh>73YLdis49VLQQYRoCFsWe`&vq%?t<)R=67ef$5rz z(6E6;={0AEsx=~khQLP90>TG!$|gWrq> zh$2o?H)5&^0*|)pUROqI{Z*F57a=oHD0ZHgKXZ8qh3L}HPae~l9<=Nm;qHq(x~S0e z#ek06EvYBl<+K02>@1|Oga5JN%rneW zNkQK?QBvD`RK$e026;L@&@<`30;{x^VE*SZE_bZ5(Z%L+gtd7j&;ZX{`_lMzmrZ-R zPHlIgC6_^C?>%(0p#VHi2#_N;DP6=DW|B0Bg|wOrQo*#h--M_|doBmxf?Uj1+}Xc= zW1&VypP+J+sNzc3;hqI=(M$T$ApINwv4lfRS~)iVfW4B(h%GsHhjSH9og|E za5n^n$d?{Zf9hSFh{VxK?IQkBh&E{7vD-d0sy?sVulM+MX;5!COW&>6rSy6})FaGX zJTK?=%B_aFyy-JArm%Vos+54%Z7cG=lx+E<{eyqoCFzn|m1+A5tt7=-#c$`n`2}%M zlg~?SJ#wkHPk`b^+DQGkdH*EQLTu$dC2uI zmy0*ERSf{OoP+fa*FOGK-D9;T_OGuhVa*kPfpr{hpc5yZc%E(#+lKv4$8{qeD_uFp z*Wan_{t4Uo=(+%JHtGg!6kpzR8D%?pK=$9MLaUVr-08f}Mu^D~Hv?6!qH%Z9Aic2) z0oVc&?fw1#S#_2;S_~`daI~ak3M9*7!9xxRj} z`n6abZoxLzsFY4Fy9()Rjx`38;$Z$%?%RmC?rzXpr#S8aRrSAmcVvz|@@}m^lLtl6 z_diSz=-gZD)%36}BWo~2*UP|qDp@<-cQ)&j6H@;25s7AjU6@r+v^jxhIq6db%BZc= zM!M$H2z`Flcds&gFf?mfRn@QOZT_vT!33&=3>}z1<%^`i%@FpyQu(1Df^;Ac57Hc6 zSE{^eh4f&0pb!J92HUu4!a!fMHK3#foWG;Z-pKl3uz$Kdy^sv(Eivi>`3C(Xaj|Lw z!3$AL3@{;}gOk2+>MlZM;UC&H#bEw%oI^aW5S9^P*cWX`TB zDz87l`{B{3A$Euj%U}voyq$)?pEJgf)qt`gRJV5Juo3>Kf%lj3#9&KC1&j z&CI)KO)pt=KR?~$cuRT3>>`}D#2^3eIWn&iC<)wN}a>&j}ZR5mc5hvaLWcD*Pz4Tmodr1FC7Y+7)s30%DXy`7;q|dL|qiC8NIxq;? zhKlk0Cd=8t601&0vnq}ab`e^X{MSk^yuhLjOch`PM$vqXvV2^o`N>qb>Pm+Ko4?i? zqOX2@=Q3Y;G{inO`#E9ZYkgW71>?9-LXnjqfaCj^+>BfG=NSadYHpAat63i9Q^WTf zCI`kz6;*Izhjwl)Dtx)!&#!$rFVfLdu^9qr4&w5lH2^i?>wx4xCMbmE_b)fjQ+0mT zsZaag!@~o5?ucEWKPpU0jSV=fp=J%6Zq#)LZauI)HkH`7O^bzM_<4!Ct2+g&0tGQSjbT35iNT<^ei|7l*6~Q~z>#nE3@Q zM@nBS1Ec|knFe)FwFv>0%VxmW=F(r8T3d zXx5D~g+7_|#IyN_k-LZcbG2}IVxa|kR0oD>ZpxxrqxkXmEM$)JJdQ(EBoif&2qgsX zy{&f*>!cqeFveE!eoZv^^6?xnQ9Dnqny*j`IFs-B&4K>BO|4gjR~hE=9_2 zWl>y=HI%Bd5(D@URy3Gl7C8ZPR&qlvOd7x2@?f~NdYqX5g^tK`JrOIq{y&idMx}d) z6&i+G#65cR_5qub6|8#&_(;-JMOwz&&1HS*fuyX*0Go1Id@XeLTxX(tRNXqLkwpu) z`5LGjQTF_h*ldErEWTDk7~E`YLuczB;Q(0Tc?wenup1J_lWijIC@k(cwa!2)KlW+R zU_2S&6EO?g0ClKBao~i{ExSoPK$4L@r_9(VunXSa@}1E4ON*`~2{d$kI^^6k=4M@d z9@XJ2Di5yQD6J~S*O0woXV$XoCy!pbw15Sq$lX^7XB*keIXx_`TwYPS$H5w1eqD= zbkqdS1z5jO&fY^RHB-&7>}DsX|3y97k_R;m%j|A2!iX$;aGLl>m9zIVKBUc)#mzMTn9sSkCFGCr?^ zo=zO-o>$7(rBTCV4Jv`rHRwr{!J1#t!=()*F^;FFH5ssMd;0VwBiNQ-kZOI|Frzm~ z<^J+{Ni|vbs^3=<1K|kss0WfHkj4;yUeJ$VxE?X>gEQ@3*9YEkCKjW?PbsI8USUO< z?3-A4G*{@AY*kjARI=0Xd4#C07j}K5jKkf+ejKlFGX7npU;Aifz`JiD&AN?&`NOa`^ zM4ht8(m%qzL1dCIsN^D)>G+|pwpeKuoTMp`?{%=~{Vkd{B2>~#Ai_Kfi66$-V z-uJpIsL54ulW$&ty2!Ni%-)$Oc~bHwy;G-s*r&@30L%smxfP18l-8%_v~$$iN!J3l zf}@ACg9U99Cph`9&tjUgSh_Sx*rZWs%&H370+MFPm*SGwGItUjmdw%Tq2l+U{!M~e zTa`f}-bNJ%t05pNbHrIPX+DI&P*o$~`d3-`&>N0Qov<@3o&={8B+AJx6e zL~)u#N_|IS5eb_l9wXc&{6p&bf#Ah64l)P5m5xp!Z_myToBU_Toy>M5|ob$tSb0H)7= z5B4C^2<^Y%aSs#!Lfv2;pDmHpkrO{JT>t4z34i^Mht#MgR^(M5qljq zJ6e(BU3?sxwGtZRi`LAHtQh1+=v*R61WE9Db+JCw(dy+jyRU{}s zwc(;WM0Hlhv7-8EbD_EEj%<}+o5@^dwrV6mB5D>Gl5Zm-t>V#v<%@38gf>x>2 zLR`J_&pLZjWx1I}En&fWckGXZF+He3H>?)=#Ki!Z zg+c@A$+W*T|0e%DF)@!}*?7%)&VAvsCe|haV2!V3Ks`OB$J3p8BoUi6=)OK`L(=L% zb68xMYzy&}k@p@}-7(?WypfK)D-3_je;$TjG;H#7R*naJKAZFPGlDwy1*K_|7`WlH z3&Q%tmZs(E5hG z#8{190^$y*enClD$o}gbO!6LOOiR_Z<_g0UR)25vY3ES8Zw~!N>9OMcRf8Pv6sujf z((uVfc`I?tF&lW44H~EL-bS>|eCbB;NcXcc=sqD*FHP2V8Q>B42EpB~VQ%}jq*A1S ztp0`d5zCriUB7&Zvk2m4voKqwq%K>qLsuV_CQEcBfEqr;8A(jq-W=5BNb1_Rz3Fc! zjzsW<;T}zJREw_eHM{;2Kn%~;oSg1sD}x3!EDMHp0^TB_T?Kcb$`?pln+{Li_*_st(GIPQlDlP1l2rkt-Yl3<(IwJ9ga9ca{|i$!P? z<#@$ z*`(0@zuI_}q6Mzi0!T|R384XCG6gbtu5ujYOV3zwZUE#;rM5pAM*aSG+YD6wNR*j* z5tzAOxf*;nMnY}1tL4hxPFCI8+U8DcmHNq@JbH^6R6JumBC+YqJOrqhZgqBQEKE`V zUP!<5GUZthvX!Tlo-%eNZ_;_lF^1jR+-!1;qq`-vHW!Xyc!sY zygT4-JH)yMjjH~r2cz&e@t;YL7^FkcSISG zif9MpH)Vo#i&P?30q`NK%J6Wg=p1yV{R~n8Gn|(9S)SdnWc&PhF<3P4g2Am{UJyiN z(;c?qys+K2-K1=RZWeYO!o=%T=w>rywPD6R8P7Nm;M@B|%XetUxUaS^|LsGaZ5{}Q z65Cj#Uw-Nh$x0O{oNb*hjZOZ-OeBN4vw8W$Nfv(jqA}uPUm0e79JT^18-o+I9$WA# z2?pEHPIA94rI48V&<*C?1NTfUTc`eq?k-1(vCF$p1jGEf)w|=ISa=eYRrul}qxXVK z4~ONkDR^%HZVio8U+vM6>`&OgFlktXyLxI^bv-B$G!^S!``*s5`FgR)WPyg!(bk5K z7DhR8-%h1RFX5%bP$?0bDO`sFkiGhqk~Q`&4a>dwq?G%ou3Pbh%@&t1%?_<63+RTS z<}d{70d(hJbysg)nmKJZn%ma~yGuq}&E%^B#EGRD_+43bvx)M$Whqr&8mpWAcN*Dt zUj;HQivfIl1aC+{lEh_562s;Qt;N?R=>52IEHFCpLF%2fvwx8{p0vD0HxJng=8!R4 zf-RFj;_QDOR{*QYp^hViVZ2lIlR*A?Rt{eqYFjK_~djP2_>yvrza*BDS^EK`LLC z81TYS_&!XAx>~8?bg`;vH8mi8u@r|%hOj(V10>3Bc6Y01h)!QmeA8`dZ?note`uu) z_68SIws(!J?)CX_R~Wvxo%0E-9R2j=zj~gJosFU!5ZW6lV^O1AOR4h!d$YVa8fGvo zCY!(Z9E6?pBRP{78l8Rc`njT$UR^-XeHeuxReuC4B>NzYtZ}*WU_13-iq1u1{E$F2 z3Iey2yTgEkKZ@R|>ha?x>CEFl+mGRm@lKlLsC@KeUB+kStCP1<(vwW_-gfM>3#ohc z49f;WzNCbGr77mcKc2=W&FxK-^JvrjgSxDT>$!nBBTRY#SSNhHuw|Q!QO%xvy^E`$FOjug7dGQ}rx)?#@s7#0udiR#C8}ELBES0@C)pAR z36@h!-yT6b60@81y@VtK(zhD9?F_C*W?S3X9D({WHT4i?TC@vvd8ku8T>@E^;$8jh z^h5Fnp{l^@wcob=yiT&rAbbOoXJGus^kG*}ZvnDPvo53REZuiFwd254IN3Mf*3tHT z+>AW?_dz7c0Nt>n3rKGR7IQ!PSA|jY z?p<7re5OWh04__?8b!&EjLP5)WNgTeoHQ!$GRLj|;Qo^AtfnF0%L;e&H%NM^8Y?mR zSrJRiXU#fQKZs5NO%?@+Tmv`su?bckU;NJP@@PNKZ)Y!+?m`G7uldI0cbcTlZGG>! zQ^Jktv+0tMlW;Hof(LD*tds~m3GL9uqO}EVXGLmo#*sUEVUlUKsUFrab!?@$ro{bV zdSe44pR%-6Jmx7BB#&7E;#NXvq4Z3cnOs?6?a z^|xs~3z&y3^*;NkDy1(YwkO--7omi<(`f5`lxXU@3kfDg+1K%E(uESxFSXl!dnt(% zdh4bZi+&H@JLf(gNetG9D-rgU{#t(E?T~byy?l>BtGNC0&O*v9f1K8oRffqj10C+X z_X4+*-hx~eSjTRD{QZ?>xpf~i?DU4PWu6wYy85fFTt+bE`N1C_%wx+P+3wT5^rx14 zT^6h^USDJnP}?w6hxBFcNovAY3hz5d%pS6(2s%M+{!OxfsLvp2UjSc^v@rdT`zpe$ zj`kZa-=Zhj&^(1ydY)1MkAoqhNe)WSpK`)twyWI^C`0%oFV&sb@~pL-tBYnPiy?g@OM50Hit?bXfl7R9++-R~^-?C$Qdv&tb$fpc zAwyWds;WSlyD;@uU%qly)I!$@wv&(M+4t|a^S-dSeV;g3Zy@wsU34^X`$xA)Q*C1} ziKJdCxi1U`KOeK;x~1K_;GwR90oL0`8k*gGIWa+`MJZle^yxQ1Le%|HXu&BPW|Nfw z!-9bP1J7NpRROfIX@C%E**Bh!V=|!R49v5HBEeh3DA8bTCANi_LZK!?r#zPd=--}S z1vy?P!qK_Q|LC+Jw9oj;Mg-&AnE}-M0ca-|kO7`1Z0=*Fp$j^T34u;zjG%?oVG2xT zkQ&a#J70E+(Om0J{&pG}kRCrbz;+K3N1*<-h+cu^!b+;zg5u6ed!v_*@zPGma|5g_ zW{^PAC#&-YEbQ!C-w3y{{mVezxp$N*Hsne2qc7-6?%h@xGS#7?3B9R;vKm{b|0(&k zjA^docj}`XHr%)v0qS0^n`U%Tq!S|&TOkId0hqAVRluqQgw@VG{#!P_;IfZ6AS*p~aAzUWb6-S+P?z(!3yO3aeSe{ccxY?OC{rrqo%uE;wa{h&_6vo=ET@P zC;jV;zibKS?})wOtUaXX;cn`Pr99M9Fgyj{iTBp_=}xqYa2X)|8r+ulV)f}{W1j*> z`=S-3`1JRE`msPlqwKrPfTKT*CB1jjk+N^uA!!Q*fc6}}0~cu)xpQ%y&&TnwcSg>B zh585kzZqRk3X}#_*N48nW?{R>*FC3L;vhP4JBOyxACG%SX0vb#t^g4PU5I){MTG2@ z9b~+NrsYw`3=i+WdIciMo}>cx9G{ABr7l&l*0$1ck>$^B7-f`?*T|X0UkDiZySw0r zWiU>Ig;#nU8k4rn&P&F34J}d^TNXP4X_WfGI+?f4?}HKuvl+H6P>;e=7t4V>s$L@c zi3QmjWSYa|%%M{aw^QN~vfZRkQ(N zWetOoi4e7OJA1Tk?#&UXbK79}2QdKdRldSEpa0dW#fWjK1e(9jlFz5S=+``n3^sZ{ z)Vl)}wttfWZtvQj5P&zr!c4zxJ#s0a#)7V}OARhF?{9yJvq@cUQSSUQfop6~+(z z$-3=Cs+971Xt~u{UVq5wxZT2N6De1!?vmqblmE#3A-B7DzmYJIBvaB~lvs5o(eE{` zf8Ns`>TWE3XKz(ytO%XP?BAs!72+|=$LTPO+Bm_txSC0Ab0?Yu`vF&TGER$ZEI{y zDN(3F$eh26&I2glQp5!VT2sM*gTUm{-AMn2yblPS7`}HEHl+r%HGL6vwmsTuFT2tG zu0I9@JiUN4TF8ib8W?dLo^5RsX;Y}9L1@?x^K##KknaboVFwj4eJlU=T_NDO;0&T1 zUSSf+PU>*WGf?L&A)>_^)3OItx9CIwxSN=zO^(!s0ud{&-m_b}FHrxFL;?eiTT0XM zVfy|0wmVWy=Fo3cy6@L%_Wn*T-M2^hvuz)Af&k{F(l;>hu4YgIJ#{%tNL!!HIA9-VN~V`yJ0$?+mPIbdK6(XMlZ27Mrxc{Pyjk|5lO8vEoT`>{ zmT&$PO8V72n=^OPmuZ!)pG*2uQROuH50yWxYPwf=kLKU$W+5} z+^_nAHO{Z1BFTiN6Y}zaxeSQMnCWIfu-_3X0rL*(wP3Z@8qGlZ&6EcMOl#NcC@$Qp z%spp_qlA1_TRLIY?OszauGUYLf?*)`rBs-DB@H(oN5%$GSBa&(SApYrYCZJ(f z2oeWP8JIJEVfy;o6bo8jPc{;T)f%3 zvL*cBYNYWojpeIejv0?EO+Geg5o0s+UG`&Qo(FJPG7DCEHIK*Xw@%JLetMkYeRMiO zX-D6`-*)zts6AekK7mogxwlQkZ0_IR8ZyW0lyk7`bt21ugld&AcduVY~7PeM;< zF_&aNr(fi@z@`bRiVkvuiG)v3Ag5M&T}upuJCO6`D!0}K@{EitkFZKXwxJoPk9z1r zGQ>gA#40f9AxnAZQ26P^fh!B6>S&jBSCi5~NMBrS212g%TX0h1rKg>aa2okujjHOu z!#9gr^m&86KtPp^6K0hlHjkr6B)P|byQJp^z*LF(;`C>_bdat|=%#-U=Ryg{H@@&d z>r<>zs__Dg*O|R+?CIqu)htR?b_s3eqzBOY5Nt)F z#$yM>V=8X-WAgyc_cbZgz^FgkHlRh|a4C(2DSS!kW~^?7=&x{n zCuC!m2DrPpAhL^r_ z?}*LE#^P%Ml;Ef|TRz~;ojs+FBEQ8K)WO!QgA!pM|8y9XLjZ)x>tI?t`a`i9HwqT> zP^`+@L0=&k=u)A1F(EPU#ur%PC6=qo^TZ=`Q6mHj<{BVJ!vT3z>bwoA3y=YlH+up3)ceICG{U!O9uV>q56kLJKde&J&&(Xe+zTAeT!^H>_B_`` zwDK1Iq1r@%ED!(*qcfP6aPPai`;%S~=OWpLQ70tjn}p8Xn?i3NA{Bb1U<$C#PraY) z3EyGVESf@r^`q^!5}1p$q;tL7yvbr1&>cgYZ)J9=f)2_RLhn@3wh?-3EB&tc715@I!Ha?;ofC zf}coSfC@_=;a!9OjcJWP=DZ(i_w8MM_VfPmvXGxtjQbfsJSFMk!Rc7Dh4zb-#572} z3`1PaADW*Az?cKpG{vIWAn3Z%CjdV8+U4tnvr<7f$k7bin?LGB}EfzEDs*U5my++8AMxWWgkHKkrA$AL9IfRW= z{dIb}GN##7f^!E*Em##p8l%AmWesi;0wEyh@Fwf%PlfdbNupvTfg|jQ*xsgyYpPM! zW1M!I#X3&ed&<8G+!BykYH4+e4FL|}g zIFE*s0v8W;Ew6}v5JJJ$tFi;W^V&cHdBP@>3m{6z%qhbc5Z*KQWmanX*I=OW*KyDAD#A0-wIXX40jO6kWSw=YLtJsd+R> zfQ=3-4>y5wt5C}f~$(aZ4=|RA!%a`-|Dq%lFEZY99t2v+5Ue(^a+mo3JxePC#=-j8{R3yXKz`;GGzuLg0;^$F=m#t#+f<>`~$71y5=eVorv*ClW0 z&laPp;?V&=a)pp=vSV5c(GOBb_qJ8P#V?zF#ztm4jY{XFq+Cr!`WDS-*8k)0s>j6` zpD$NQKSW*4$xZ36Ipu!T}f0M=k;zG!u@d zmKmWlsoF!bc04_`VS}UcSqP8i5JTlxDLcvQaNc))lj^72 zQBHd(@n7?>Vq-2o((KBgrx_qc+zv>?K!9Q;Kx$WmFA!8;F$qwXO-yhJZbpZ$TFu|g zJaa0qWypT?{AphMus4@bZ`&up{G!`&!r1pVYH!~C{XN?LW1zTuU*_w2wQ|JkM$5z% zi|$?1D-c%(n-*G53uvi`!NLnWJ9;&0=S!AbD!m^S(hm)!^{Aj7l-M<+i4s0*Ik-&4 z57`bCrlX(!(!lwPd-faFBri)~UDRo=p`eXF@`at)A2jp9wBL~_SGlPU%uViz(bu@F{ zuNN?y3GbJF5Rx;pzsCE835HmEazh5Z+>#3Le;}h0$-wwCt&c?whw|ojveiO7p)r{3 zV-O!Py9qg{(3-In=xpd`jn6dIwZNiV2 zw(L+b;tCk{vQG&V-V!+{x_+|E$>{He{JUsHRqX~jVBbgV4TAKvNBW1d!Tymk47jAf z`Vtp?Z5Nx zXd{3w29WguzW5=Y( zWZfXrdY@pFQqqbL*FqUJf{_A#EWBK3ENBR=J8_V*0*@lVrY!oZ3Ta4Y{qT41IT5yM zt}eRBqs_5MukMSb+QzBbSguSz+WxmD1k9PINx|;Sa~ik&7hfO{7N!AkmGF3on5DD~ z*tkY=5U`cdLG#4f4_m#aVnE6VFGg_%Z9_$$-3p&EO1(31iFk28Ry=%W0VG|# z0@0<*iQ?ZzD!{{!UvL}HQ3*_FS#ft@`GGQqkoIrByOZl5r280K!HJRTMHXHe`~5F4 ztw-LkF?dwK#?!6(FT9wv2maGz)f`PTfNvBMgZEu0{Yak9lPYi)J+y?foy?j_`stRQ z*k;lr>WR`HN$twcoC$k1Nc^}IuazJS^-7?1iNF~zcCW2=%Nv3kCXA>TMe5^5_Vu?B z*Y@_q^^wBhmFXL|0U{v|s&e0UO?E>`V*h=3>uI$YROi$9-!RJ{#n!nAYNx@cDDUut z%xnkyPY?-=iN$S0fse&Pq+c zS%#QsEZ1G8qTPRMLLfQwpkj4r9^KDJe1TM0fP+w>DAxUgjPd&{fcXpQ{c-j~zOo<& ze7MxJEZ__oGrvXZ@BAdY2^FKo-1;9PnRSI_kFlvJDl7h=QeMVusLcTAiBoHtp38t_ zJ|6>>jBQ5rsEG%2y6Un${0qv6OPfjni#|64=vVR+^2)8fI+edw}|kCtE<~oqf1h zgBkK;{%w~bi!6vt=lT+b3{cH$D4G1NrAqthYyrHG+923(>nSI~xrJCjR<-++fh7z- z&SLQ$k@w4FyG$wsFCF`CT2E~!3<3MsXN5Hn&foD@-r;9ppM_^fs<#x{!pex^l~Ef(Gun-*0v9!O}=S#%Gaj@J~F&K--vG;x;9BH_?yY%PKndc zzqJ{=mT~D5jIgSUjrL6aWL@-==%FODy+c7UBn@`l8VG#f`kX)y)mfcUY85Bmt@V|` zokO8fMn{9@9wUU!Qdg6T8{>U3fH(#9-*CRO59m4-Uu>(3@Iztr5jF>rAZ+_ zmaeHGdeC%_pY|gZ{!pR1QmtqSp{i1~VG{|#G+OVRXCadn zCk_IBI8Jov*U0sCG?*3!ZV2t$3~N?|aA1q_rYdC^N;T4jc*<|ixwUpzDd1maB*Wx~ z6@ZR${i4R`=VZ!A5{>)1wyo<0`T?m`Fg_9*;?RJSEJ#PW zVaP=2$F9%fz^aW+H}|BNg`p>%W%+t3Fb1kt>CVIAwJ%e- zOI<2#-Mf9F#+8Gwvn451-gDRfGB2QB1VHqAwC0p(6A@wEQ1@=}IKvc;E)|f|4~?3r z^IV|G2TX=Y{Nbzs=nrg;#XmNAS6>TZ7so1>c>pLLc{??@_(Y-fkU}ZqBK#6LYd1z-2h)C=&q>VLXN+d~dwUYO65Yr9L7eO%{WatF`taT_wGU5!2hkq`de=WZHIU3I(Lh-2b)=uM z$lbW^w~X0zH+nhHOS&G|*I(`9FxsbPsY8|z9xgd7kbC>Ie{8hq)vo6v0=sge-$E~4 zwOI1(oD`W;h7yhI0W4QY?@`B~MgY5OVSo=EEv~1~5?zz2AEI>@lWjMf*f2m%!o+}s5*S7xZSo@4@T)TI9Edc& zOYk*2?Q;4b-l5nO2%;S?`2}Oe=6jKL&Vs;ZXv|^&FRGgy8u){x(ZAiIFE8Ia5AzAq zT#2rL5>Wnbga*uhYC4AB-8bJS6xyREchod(O3Hh6pAQk??_HC8=(w3b=!Ec<+w8%p z1n|fd@ZI;WtFNyGt1W(0&FkBTmb8^<|3irN+(*>)3Mv-p$=xdqb{CaJ5iqj!QiVeA zyuR<0Z_&C6Gkt{(UiWwv0d|23?t{ouT5{rYx0vfLL~Xp6DpC{qz@^dVU+)NX2ETsa z?Wa##>pnosIRJ9nub=H@w7;(mkaYE|ur$fgnGDPiD1|r2AQd)3^U;~f1}Rew+5n}> zZ1IU7qh>-G4h6$+5j}qrl|D^LeZl5ax4r5Mq=CZoa5;DNsiT+(hVWF(fER;>pG+xa zmGdZ0%wxAZA@?b8e(j3$T}AXaxxNxQ=Q0rC7ULJPqYo>g)2Cv9PQ(T z5(GB!8Xwg!-N)XL6ns~9HamX7&|3U13WK(U*PZ)qkAHpEHu=HxzEm<`-vm}hP#yS@ z#1nnB>(Y@@4V=CXID97J5p3@J5hF{p47b5y$O0wh5GoM+7Wlr4 zBYq?FjO0w_ql@-P{Bv5^A^HYRmFk#oA#b;0C!Yx_{FUFzCaLk3wgJq)x8R&sPNqnC zA132Yz7_9Bh8;t6i!`3XB>{m~$MErAh%>PHQ6^Ne6j?UPF3rqZzNTeEVAciVLW3TF znaaZlVx%9lWCEcdbL(%1A@yZFC#Eut>iTG9>>Nzdjcw!pzpWO)Os+-+eZXGQtnF=8 zYVV)GzsDxV^vV7%%bua=_ymiabt+OVuTE1UEf(=&eUmC0>vDT+eO*C#3!~j;sTIwj zd>gV1s{>p118@AMHU0eMbmb)=D+`;$#W>0r^l zrqo1WELcZqR068NZB8JpyFHzo=e_M2T1^Nfcbx}W?tMzT{(R|E1MvwF4*kP%H6U9F zVPcl335j6=fXrzOXBqeQC8ur38fQHxLBC~L31GWm>pVc{2fSy6X`C>nGwE$F>rOZ; z-a>OBF~*$uNltFaSyBswO<~N@R9(c2I}QSyk^7j#9I~{E?I-%1T;HyP4HYgX1u|#= z=lA8s3F(KJa?ow@p07UKj0zIDs8J(coLZlt#16FCuMdD zfLqxKLT{#10#I*-RPc`}lO&up z&Jmw>xg|L$~Dyx z5078QgSbGG+FOO;caQ;4s8XJ~!rxg9mW-wXv{&<~@1YL%N_voFpy`A_^b67y#Df0?jt9_2lc?ISc>2Wis?T6{;|R?Kr)P(Ffi{Q z6+}r4SoL;I=psSKI%(fX{q1g`4c;hEq2Yz*IyB4Jp7Cb77h?zF>AT3E_xnF9ydPsM zc)v!v$JJ*@S5u6vkG#rl^zs$RBqyt6Kf6+x>Apr^Wa)jObG1o3z9y(pAR6uK*5wR ziw2@s55^&SAovAU69Um6$o+csm#lNpIS5VCzaiuLK?(NPoOPvUz(T5qikfFfCBK`pj1M8U+tBA!g39>qI|j0iTG# z7n~XU3)}y^Y{%=tn2(h{C;FMYkDpx9oA!lcx=uNOf?yW_Uqax^J}!o~^v5P7vz}%_*4)Cl*q>7qN^oj~p3jR6fB6P~M$E0Rh=pJ9 zek(BDkj<~lpTK8*4E9zq8vK>wr?VGI@1ocf*z>VS7%<->uB~I}(_=@bq89RVS7fBQQjauxDwu9w1CDR24VMMmGTC z@kz+$y(zk$KMia!cH5eRC^Ng)sl+|6{$%M(t5ZKM8598#MS%Pey*XpS| z|H2h@&Js5*aS`ha46M52nO4c4CwbNTgup<+;V3UH;k=tC`t=8QAV}J|JURr~KP!6^ zp_ox6;J+gEAFoIQ13h3158!vT*8kJ+5abseyO z?HYOTQ&-&pMtZ*y#yliH9sur)|Fuolyw{LCqCn6jbjLvaoV7fWv4er%ZHQK^W5?(p zYb6nKc|!MqjX+sss$ahOKzx~8H$<~)Zn1R2W$BRxZ_?1cFq}h4T zg%j4{VS9Hs48wdtWS_7XkdGbG2l&_3KMI(`lujkqSnt4XA^=2^+6Y_;zzSapy`luf zJRl_~-DzJy<;MsZDba<$ZffZd;@W8Jxcc#0@^@cyWqw5BNM!whypV16X0MRw2Qup7Tc!85nj$`o3 zQK~;^4kP%Q#1N;3>KTI>08M3u_s2p+`IJfjd0L^Rbw4zpp-#gc7$L)58KEMEuL&)D zngL|1!O$0MaNZu|O><+wsPf zKpdpKjj3%uDiD3|YS2gOX_6itghBy(N1?&w)9<`aUAjaKxU^8}0PF0n)6@M{qVRUg ztV#L)l(B!yET=Cs*1NiC^0KFm_jLMtvcH9H(BMoikZBP$qEEt%39@y6Fz@IPT1D>B zK~z~0xkXwS80@zsPi1?T$SN5?fsI)P`XsMp9{kMOo0?eb#bJ6-T7_8VZPHhifGPuV zeiLVX%|ZJ^4D)?bp$EV-y_DB4=`59T9)10nRl;FfK-PH6Hvh`p+V)y0pml;ckqCoVt}qwJXJs0WHLD?~rWlVYnMPh3Aem}V7L7{Agc??l4# zU+6Xlle=Y0qBT=Jgvg|PTr*(L$y1T{%LpW_J!e3bhUD#P-ajS%P}HM@o9VY1^%z=K zY+41c4}a7%05kFiNxFd_#ueW@U&o=8MSmS9+-B^TP9=C2h5YJW^@KfFa>dB{C=X=# zwxL;sfzxPA%6N%(o>nq)-cKM!zyWNL=IHR_bU=Gr%bDdj$fBs>EIK~ABnb3G74##UvnrBJ}3>hM=!!IAE!rafL;`yB>~anyibYzNHU zNS=a%3R5~`TJbWn{!GQ;mzw-%9zIC5aqtU7Jg0)qGZFovduPex4b~DVQHHD;q2h&>7A| z3_>r|STKxPE_T6?q-E2?T2%Ho}`-(!!> zdlNq|Kn(c(zWIIVsmx&M*NK43=>!{o>IuTev)y;cV(w>rxv#&>3dCsvS@gT?IgR@O zJsj}<*Z9K1UvOcv71Hu9@~@a7vL1*B1LG(kt?FT}CQ*(H_K^v5-yV&3O8Qq~&aOM& zzC4no8PX$F3`Ka*#`=W@6Gk-yFxY4lcf&t%ES-$21JMV@6~E_-P_A=*4-n%V>3+Wz zzU_hdB5juN@lhx1PSi0zH_rFKFlXQZfxLBgel@7?2UpmlTh5}4KK$$@)QsNQgrE3v3j2}DVTb{Xgs`;UA5V+Z7v zzUU633DI2_jQ5*&6yA^CP&S$2@)I0hF(E)cTnq{by%h2(1dww*JHbZk6-^mDjfVh{ zj7Xf=^k&gQrYk@c)4qO+Vc7BOgJjR2)p!}_YE~8pL)feVfS09%d&6iKJm{Rg&F_Z$ zu#cqg4N@#Z5ZWVA%14?J5?#w^wZoLXugyepV0R@tFSp81Z8Li!k9d{v` zHZx?WkF^xxySFocbs!s=67qb=yJrO7rg3^*LI9mvjskr`ZE_$Ec1qo`Z9qb9wb5|B zWs1b=LvXW`TO>XYfGx;I3q3C^?3%B>_O?}yPYA%rfI`9bLOc_ovHxYpqd)p3o(N`f zEwd7OCYbF4B%6?~djE?6aGxJ@`WemuR!%>PfpD6#ALZ$*`F-4!e_`Z~lS_k0K#Yy- zz*N9gQB*fl4#!*#TtB^0owxl`A+G@#-zqbz6jh>tLzw3f{qoa79+p!C&Ti?gG5$ym zH%Y%fr6eUV{te#mks$B480W4&kk)xU75^J^UfKIMjQwy0UoF=W3az54K*N}ZnOxC7 zR)~JlGUG$zCUm8lU%GhzHbY)pd^(h>wEp2UD0F(2eQTIY>GrTvDKAVq`gdh4u_w)fAtq{?S@YH^POIG|rr? z#l}Knun>8e{RmDJ+4irxOPJ@-BJ6&wU++EQ_2HHznLE7}b)I>inUCsbIzc(VTs#Lu zivN^%My<6fNAMLQA9H08^a4a_6IP}gvjf=hz2=8PF_ki-ba+Ld8KnLYl|Pv{M5T(9 zVZwqO%!co7c^MS~{_RU6Oq1EE+#VkH09BoZrv*qZ;RVHaMZd&8Cdm7BK7geid8eAR zL)9p8cO~HZpr2|i5BS7`WJxJ*BbPlhvNiy$9AapfIZXSyJDr72SPL$G(c$}(cRZ`< zUS8GdyLaU7r-XV~yMe%o+%lmxVm&&1P43v~c4&zi6{Z~-(xUdcYg+alCbN7B)x8;}II^Knc&)afh;{OvL&$Ac>^~bb^#gJ=K0kiS= zV4n*jv#aT-RMNh3PT&fnZ?_6{fjmCZedie)j2{Dzq`&{18T;{Xd49{@-$RC;8yA0=F=pXX40sJx06Y6pbW4VmU*wpRDp=#BmjDig(D7ZUO`zMbgj}s zfqIaL%?hu~Su0s+lRL|Kq2SBux>`F`3+gEd#^4%cd|ln=)Y)sX`9J7{fOt=}k!HE5 zL=(%gd&>8emCrR+BECXC$PQi{(1hZM)F&u7t?r-7m-Z+Eik1A3RIcT;SN%9*AKRvk3E&6vcU`P8(`G7JaOtvL5rr@k;p-7O@Rc1Sk94tku3^mVSE* z-%UCosb9BD`d4QRJ|v*EphhuWS2wAa_Q^P!bgc&SN~o%VIg zN&GEBo7sNv^m|P$+!$$e#GjExpLXrTIffAcO+d20eGF9Gn6g0p!{W3+;jRrFJ7k(q1Rz32Zj!n^Qj ze678=yWjIBy}2R6A;1{C>b@*F#82rA6oWfWtSr69eF~WoF>PO7%JOE{IKdQ)Qoeb- z56jx1RXiz6cfA!gLmu9!|8i^)>(UzWMQzJg|MH`Lfa!s#@~8H=4Bg>-m{oaD6A-_r zTfj#*>e2Emx%4DkvwZ0Pa^JFc0S&bbzT4qVrssrv~u|pUm%TxPKAHxvyygKzUN?+Mset>}H^R_xK=~a#;N1 zoas9nK@7AenqMU5v8J{-Te#bX)-s@`aiI*bq=zTwXS+n-A!%dBJ9M8_CW7XPb;P7U zpOqSbI6M8lo%iP-+^!!f0G@VCoK#xH=M{LpRPqgye%1fgOyxfo0fV0;`t(-k14^ko zazhXn8#G*wm#!_PN-e;jEqzh6Hd!U_jMJxqE;pl?8S_xL*w>gCJXJ}!0`~V6Ye!XlKu1~C@+=Dgfhs#b4<2w-Cgi{C+^5f3*Wxs{s zQC~-Q`fq8l6{#WTwSQ&0p>$#^um4-r+A3+=fW)rIySN-7QU3OME~hotgk6ZcsYGgk z;J0{x%bMwhthXrr)L9cI#8j>^)$5Y-Q(BZmI#%g+=8i=MPzE(_7UIh%3^3}SYA{Mb zG%WM)s$0v4BYh(B*Ei`ZdVNZ)P3BB&m?#@{t-m4fUzBmsfVfi znO+cGQSe}~bURoQigK)shutSl9JJbEb{RH!@u4tX2sNVARz|UEDaif2e!$62T3LJT zz9QI4xF}5$5aB?yk8+jV#L=y~ zs{uHRrQ^&VQ0W|Jw=Uza8OKP!`k+t=ZQfs-BeGV~K4S8(t);S9Q`trA;{BTRFY#TF zH_5$aIvG2w$hb)r9(E1AUHMvXcTkQfK>Xm7R?D{Jxx*?G(mhaS^|20S?aWF*&cI>I zbJp(|X@W9Hi4^5Xx%=YNSEzq6-pT*c-d@7AR0PLCMZw)|A+ z5g5_{;y3ra*O9(Hh9YFGRh2%=ub?!VLT{=ir_5MYeN4f}VsGP62IS4182{s4tDaBW zXcdu6%%*(Ixj!MD$}b;Zk3U<7$u!g6S&YB7+>9dxMQ%<>Q(1l{@a5eQ`;q11WHb0I zaEeqZ{sCslC$$<44Ul=Jewo+w`2nC= z4Ua&YLQa#Zhx9;R6tosa0rqq}UnwQamTnf=lX{hJA7Mgn*xLP42Joo^S_Z5lcP%Ro zI4NLA$pBvJZ)I13V&~V+1q$#f41ZBdpxl$9`sJ(u3hyBSz?}nBbiJoF7D%`SnB1~l z{LUYk!O!fVY?z|{jO({@wRM8%jdFmew`$?{bsso~yNI7^D3?UZP1a!fjDYq}SsJNM zS?j(ir^oo&@oGWmKMm2>8lckg9`8?oyS$%H86QCX+YtPYL@8+-ykGXD=`r^{y7!w* zLC%}x>Ac!f5Hz^S_P7MM%-+=aO-_?i57j>OTPyONA{XDL5b0ul$w z_f5f~Wk547!Ke@NCvvsfmnd76NvBuLE8BhVk4<4}YNvMZM0Gj@P&dITL#`u~)9Jm6 zltVz(!9xP#+BcjJt8C|7!p!cT4Xr90^@K6)^~Q=+LXoO0<&CR;FRz>1oL}VAR)4mz zdi4)1O*s(y1;P-c>WWG|T@Ap@V_u8Mj6=~t7RUeC2bW}}-5;a8+oVZ)_m*zNx^hky z>!Nem*vh?cF_xDr&7VDrtgIhl z8tG|~XA%#2q|fo3WelgSZL=(`N+7!)vfN4=ilt{SasDEi`1IcVP${FoTA8Qi4an>L z=lK9^N^g2g#KQk&TC!O9Ul&YU0dQM?RRY;#QvPRIQ#8DRdhaFH^2vV-ID(Rs9{ZUWqxe`8X(FPN>8KI`=t4Y_r%^2+@67e@r# z7yeVnvRbg%(u;EudEG7xa@;JbqIK;y_PA4H%M}IYf7KO&{Y!}GosxzJTi1HU6{y?T zExB}Oz@wbiLUY1^{p+gCA^9n)aV(~%=RiTnM<6t6v4d8fu$%0~>bPJlCYr@{_yf&3 zJ{8KTvrp*bMSe;E@JyJHKFT{nUONOUw*ko_t>kR1100E;(?!bPJ1(c`Wju2{@53;$FET_5n(z6183G z@}Q+aw&Z`wk|z!4Pb+;!vcjMVvK0SOSBm6AU19uuc5{x}r=s}tk@hEJ7A-#15l<+A zDLFm&_GG3@cPH_Cn!&s-095Z#Z9BzmrTdWmGu82wuAww;DUw)h`yj{hfa&%*x8qy+L;^SN+* zzI%PBgO zMEZw!Zl^-Q`gJe6f3C%fSRivQkK|kf$g_NQ%gS-sQdP0pzCPT*Vm`TJJ#((%-2-5G`E=Bp9m<>O8Og&O=(nk2q2#H9+u<8KzZAc+uU-p4+ckGRAV zhF!NLFTIzqqzpX|V#tU2avO^{%U|ZwEBOwUu$i(vXqKOkZNpMAb-1F~C(`qoIHs+% z_{XD+p)4k(TqLbPN>3v_CUtC0cfP&?Y#UMZ-Iv-vnJ zA4JqP`?!j1CJ$}CPdS7rfAgud8U&POmx>EAYx9?8twsIzTbUVL=y#e4K>jjnllxt#zNh zin4IU_=)@8LJh!4f9AQh+VpOTLtWmV{;tJZe?ZgZAGb=kL3S#;aIZhPMj9sl?t`Tt z3NK|z6^wn+ix{~D990<gysb&3gc3&ej!fzj_&8Mx{w}S|}Ts6*STSj%dhlL*?>? z;Z)hh|71b!@pGZ9MS|$g}&Il|4$pE^rRR+)#kaq4WyAZHXOByjVBcrcw`7qYama|9UVf!XZ z_vni?E{M83y8-x|MK<@EKCE?sbK^Z|TqZ`$8Btjsh_6Pv=o!*EsU#aUG$^Iv@`H3m zZB<<0BITu)h}%;x1%f%l+Ek;GhP(1V&Ub9b*2YA9*$(VOYN=;IX05#m7N;AAZe=HpZP|5fB>|Xv66pBRhewK!H zBR}Ht{s!sy?r#~}_@k|Ey(C%SNcgoM8HVWDu;5OozGesz>paaL(XB~8MY1<`g^Tca^_>*$?G2*@_; zbb@}m-{w^N1n~_-4AK5#ni?;$v{IMcUYRbuqEQ!3qbXbR^GCiJ2~-{wp#@gno9_8N zXic$Rin2}MkLMpSQvqs2Xt9*WH9I1Kp@`#JauJdgLZYuXCoAUO`ejTtR9Yj1bSjXa zodU@c8F!RqK$(!hSw1b%xwei`hkKc}T0_-23(r=@94=I+##a9aKbj;!QE%i7r2mq6 zndtr+=$}*bU66Bkr&y!94J=z@G_!dMloubupB$W1Zw2X)^#44OK#y{YOiP7lcI{bV;TUnI!N zfOL&~7H})CM;SeiTuZ$JM447Tbd5n2MdXrpMj>qbA78*X~3jgWTE3;{)Q);M>EL*%g z4^HCy=YAH|)j2&<40Wb0-hNul?jED{d1)u9B#f%FY3c`bprRgVLAvOYw1sJ8MB(mf zS5x>mWQ@kQ0-{U-ZU@=}HK&mHot7w8&Si(sC0=7Vo#)SBalNNk)$m$fIjBMFiQTevY}Q9R-sQ(2|g*?`m+5` zq(h(#B-uGoufK8*@s*;lSoxsQ$0@g}M)UI-5&86EQZIFy-Yp@Enbjjv>?rz!pZ8F& zhIf(*Y*g1|pT$d-J`$hdRB#DKXX9*HAE>GV=J~D6jCMTEO9NHsKyt+94lfH_lJ9~} zlof=^R%=!1(Y^ud#makZiMXH|+F$zCiwkmOK(ggfUXK}~m!Te=ld=CZb;_s&JM-X_o_yZoWE*{~jIz*mESrtf+}vu+H(Ku2k?{`p-^ z71Fpcc(V*JDNDHLS7@by@t)k?o;@j~|t~ z+_{SS>2T9=iy(xdaUMRD5~!~o7&s>@TIm1v$v_jkIxY%4AtcuE!p7| z0-h!{wbl@M2iRS7+fo9mD?{*dGu!Z}24Ec{TImfBPTP{DZ%g;NB~P21wXHik!Ty%- zm-mbQ%x275gix?S7{8o9;HNIl<=f>pQhSOZTew-WWOHxIfGSw)N%mRhTYz!f-pEF4 zs+P?DGUu(=S*bvsd{TG3sy0IE%<{0w!qKCsInY_!IY;v4n zayviGBsBQ)O}VtXu5|i}l~Akf1t`LRvhz!L=pq>xRQHhgWI(PloF3qN1LQJ4aqppVX@|N zm_(5+Qo_LK1To@kw}7t8Hj3{AYzaz4`P56bw9|-kMu@&3N8(h(_3J5D157f0mN6f3 zsk1yd%KLK_jQ5KV1ZVcLKz=Q5B+Jjm{Xx_l`g-UUr(-$tel=*y)0R^*}wfTb#%>r!o;NDxO= zTw@)hi84}Gd)6QBNYD$minHZ`EIKVaw0O8nGLZkQ6Q=9JbahYPhi@U9;aOZzxd%EX zXKa?RmH|av5FzIi0(^%6E$7ds926zMql4J0phW^@_Rl6rWc|sTq$Gjy28eHq4Sx^f z|8M=^{(*0>t1H}?A8ka_W)>Z}B(B=38Ko;c>MsVG`~CNy-((1oy`(W2&}R8OF_X%z zv$I^^;jirduUt=l9%e~@`9{}LA;r*LT{v*7+MQzFE#pVx@t zl1;JcoeWbqj!FxGEHp3XmIgex(VU*paI3DuJzTG1!cwShlOdg_QEiF~j?k5`VYVTK zGqslGT}((hbpseneMbeyIov(bt>0n%xq0aEz7y#G8BjIFKjM|h^I1()(Sbs3=k&Um2w z&0;n)dk9^fAZxW!!3;(@%kN|u;7~)aA$j4chB;pqJ3;iDr;Pg7$9YzDP%(a&9}C)D z8Fro`lmAwEW8R-%)tOKq{*zraYjcD85AyzEW7EAoLi%HU$nq{*SbmRf?2!;dq@S4_ z#}Y=h@?)HK=-h4wRco_XVvg1f_+iiHB=u}~LZ1JG`> zId|rMn(Om5d(@?g%5x-iCy&q7`P1H(TAx zTvtv<7cHm-ceR!#)loM;h;>XXcZUj~hhZ%?S<2N&YsCOj2sYoMYynURT$!U#qTZ7m zr$*Tn8Ng-;kiseT(L!BS2Czv3X^H>H8z6$p*ySr3ASU`Mhd>Sd*GeE4zIJ+^o1C|% z7Gj{T>&o;14Hb;((s5zNanD7&M$2(9^;I-KGkKoeodjQ{t@H%>9RxmbCUEi5yt*KUM{73Emr9ryG#T|C;p!?jrF45am&`z_o!??aUZQ49e`svGNlADD5-Lodo)}^wi zuYLpc^xWd1*6Zi=z<9_E#oJ=}56fp0552@?gs6upvN@Ij!j4Y$4~0t`qoih)*kFv4qX&N$bNCQDj(tG>Zg`vP8LMxlQ=Woo8DjglpiZFvCsaFde8lL*+GuI@S2$iHDy6(|`XieJwcCYD>c zKG22YR_k(M6}%g0l;M_t>h8MSXzjof0mfQetjuN2P%?q1lQklo_bOX*M-FXlq!Zkc zUQ-?XpZGtm7MhQUSDmy0W%)@0rGCikqN}+9MImG{PzKzzil`!Cw6jVUJ#}=Z&7^6P zKnbqNVuKt4RaTVU=vFaN=Hpgv(O)cx%YbxadeZ~)$6GlBXj@;a1Zs2;HNCh6v=}HV zNa=xcoA^c(+-cKc?NW3v@hSF<=`{T5@N0+)Z)y^e%asa(gox5ST_F?O%h9U<`IjUQ zxfH*}5f38zstQ$xl>waYv)8Tsv_zScET8mO!X5E!&ihryi1+8j;?lT{pS6T#saBhS z_cyLlcZybey&LL}jy$dRS}Z5BeBCfk9VJz7w84F4GdWHpv@$c6yCZpUJjYgsCd=BR zD^jm_*!bi-o#lnh5IB)*uA+9@%*aIw*C0AjmXoU73F4HB>z5kVf6A{ss`DcASnpAM zH7%fJyl0=nASQft^vO zgz{*$lP}Dl`G>gP%=7f>So!%djp1{0Yr+~?lLi8c5u##vza=u~SWJc;0({kY)@ItD zp*mfPLx4#YVzyE8`#BF}Og->`jM5o2R7tl>F?N@=V2bjqfjdP)lpqmicW3=C zZWUSli|QzZ-Tz5LVtqLCm`i%E){3V`+3QpJ5+2mM7KH<;=C_dWre~a zz(Rvk2d7Rbwtg`>Ct>iATZ=zEps`qxkO5hsl{w!=2BZfjb_hs6K%fL_DdlH!B~T|@ zJwT*iOetY5H5ClR5ov>aKl;A|sT`Je;hsA}S^8(CLL;%A51mW+y{x3`Ty~4+snK!i zBy)9w>$9_G`MVXJveF{I(;mT9Y}geNifY#*vOrfe_%xlX6dURz)3jG0RgGz|e0xNE zCmcNx-sSKXyD!YLk?1$&Y<;`>Z>Z6bQ!NqYmjOjv^T83u&E#Psw7pEW^&=~U8-~7mCs6nq)bQ36I}ZiETM(J<%3460H3xiI5NuWb6hxiwaXD(lchpQv>)efDMy>v_p! z3t+4D>niyzjA>}tdD+}fyRniC;7@CP_e&Z*^?`pZ?S7uTb$KN)imK1omoBa_{W?>Y zRuW_kjjo=mGnToyZ}E6TeXSF=z(TRw8M-7ifhPHusksCWzt+06@ms?Z>s z9ZNF=%I;ppe4e*%DN{Sx_PlE&yv2eTf6ss9bzKYVFLMe?Y>;?*>+(P4y%FL5%tw$W z{^mzLKg%UWu6asKYjEY zyg!w>hxfC@qGPQd@SQW_*7;q^I#L~Iag?se9u?tHI_1Ul2-s*{T$DH;g78A4QoC1H zIenah2fx}#D$Qtu0zB#;x31DXnMT(mfBTeARLjkYH5o0h;m~LKFWz8|EBtLHrm*W-_vZz&ncLQ65lHkCdAhKl#Dfx>-jHc zwJ2-gq+QwSo?>J#%D&)g{;&El%Ya48faEn0)_t{RXbri_=M$-~S)^${OBufFFs=4a z+?_iHSg21G1KvE~e2c3}tAn!iOIYK&{M33D_-K^3srcyZGXO)o>tQv1HiG!gmq|5S zNg91kj@Lj-pzHx~uE82`_`|Lkw#V`%(e!9#QwF&4CoF4yA51&-DQ)JKG9Whdi|mSa z^TM4H=*?F@Loq;2>k5zhsj^By)uKAxbchx_;aTU7j1u7n*B@s2UVQ^ZzgusVnmafA8DriS$|A=?U_=JoQHxp2jp+O3KeT*wx6j9a7RL6x2}BEoo~|K%jRqLV_X z1<3=-OwD_98UPPmV62}8V)B_m#meQ0a3PrX01}=@)M#SCq8_#vzDu~F6qc{ z(Fy4dvofHTPSGHVVyTNz_n0?;Vu6a)emzxaMsWowx^2w)`Q@XBJ}=ow_fKlr%sJhQ z<}p7MbVMbr6{fSl9=jCt?_#zGbI*BQay0uO+%a!P%WMsmMyJ$le=%`$ z=^?74fBquV)5n;Y;Pu6slP&J_e6CF?k0_UyM0Jz*pjg~9=}-S7|9eF_^&gs>fq2xu#k6((@q4=Qed|)!8&Q^AmKzYIy``171Jm6GUkp#J~dQm;~ zK?$t&cRp@~AG6L-Yn+o#`E=NE4yZs>W$BXF=uh@lq@_vyQx*N4fQ`vt{_;q?zWg0T zU((ibu3yVgr(7F9OI8nR^}-H{qT~@bq^HaK^G9K6wWLk`{ZJp-KMme5xjny+;)L#h zL3aF?(3W4bh!-k+?VQqv2?rZFf_iP6oiSS#L8iO9(T^%nR}mE~8{k;|rLEFyh?B#< z!-e{=k4r?r>tJR+nz~lgZ~SoxK9TOdOCNk{6l3|0dq4*Qv69`nl6nzOMqvcmEY-`z zxn+E(WmZLHmGYQQL%*|so3~wllj*2o$zG~_uKzml9P{koJecz5)Ld{I>z`d%_R?E~ zze1;~vn)-|)Mza_LLXb+hWzvw-X`bsGM!S$G06aZsWUR5d{v6^l8mNY#MF@VHH4ei zrWZ79f#{-o(CH5xQ)r!OFSYO0FNJIJw8%m8jEffC!3*nGYtiv7Fufa|B8%@i+pok=Dm3A)pQEsX8YAJOV*M}g2Oaafh+ z@O3rWS8o@fgH@GO2we)i{`KhZKM!A$$L)GbAfos@rR4VFM@i`op;LcB9a#BdB4yAF&6WIn9kyBTMnpgPH(Rg1ms-^-+t1`Qk@9#^`PGuJ7t42o%exNKE^8%SS>v*J0a7qbs*~7l z9ah#rpdvoAD}Xl1O4Oeg39ZXeF&U7hT_)va#hYCyc{VRAJKZ?xuVX;Y8;b$nfU!`Yph@b8 z>M7lFCMisRik9=EHi7MVS*^jqyD@Id@0RCL08h#K*QqSqRR=+uHa(2Y1K6TTZkQYZ82HQqV`vg+n)QQ=DQG@~coRW9L*8_E6;F6N}Jl%8o?KY->2}0kC5W3GR zimpe(EbQY*1zujNK~yTLbDDp@-PtNY8+e`|=8A>7g*a)(C4ozAsjP-z7?%p(XGI-M z^KYuXq$W6m_t%Q}5w{08^;ZY!tHXLZ>VZMtZ`=<2SNo__S_2Kz-muzF3Gv*bMhh6f zw>!UtwX?l{v!7RgTMK%0UdE&1`f;2Cd zoIE1vqVH&m9&1nK@WUE_s}oHC{eT~$)`HfgR_JSH_BM6Oj3!HPwceLm-VE9M3i(bt zl+VMmmF*A08j?KfpZ|#Jk0Z|f5_6S>rx6z@>FXCvJ^tRm^vli;=cFj|j)n4^imo!C zd5;EU0Fm%4p3AGuEvGzB6$)(`PdbdJ@aedSflJ^k1>&ik{B=FaN&`lDuhpf{q%^>2EfrmOdKA&y#K5wbU}2R-#Yk zEnI~?(s{!Wb!AzizK8+F|LF^qL;Q1(v#&VKDlQIzGB72B1(yM3U$9K+*X(Q+P|y6I z$14i#r@B&L5KTDXYl>3VbS=f@kR$xbOTjL@x(~{#v}LW&ygpJkI;BS;D+$hs=o_my z1gMO-+79Xvllr)hZAzan>V^$|Kn1gp&+13QjER;8jB$OHo}FgirXUuwHo{v4$Rzi) zf%?gRbGGWI87KN~ac$?oHqU?`_QTkD$wpS-bV}wrl=p8j`R6i9QTup*pY#W`yG!?H z={j{_KXNB1z#IvNY5zfPwTiw;?wUOOb`OS1*A*B9k6FLk!`J`VF;W~*(Zt>hm`Aws z5#~+;CkMI0g6N;1rP*S{nULl9@oy%^M5W2NSGWHXZA;V&YVl(FHxujD_fK@fMV7~00qzUNRVuKeD5&+CMIt5Yb~KL z*Q$Pq7ME4z)8B=#l`bnUP(E3Po2pk=ek zEM0hEk9;s?Rg|5@sAtIrT}E|%-$k?uo8u=7sSJTSypG9gK{J}vP$LGp5@4rPse14uot_YPwPC{jz|K-CFQOlDOK zuzkUJ{|8Y(2+kvFxYFSBKS=v zS;J{LGdG`@Y=5F1L}gXbbxykGz`lq}lu7ss}3rVw4BFaLL5)*s46P49HO#KeR$+ zexH=dpTu%@2vD$`rThHq$X6f-kdmXu%y6Q}G=Tqfi(VmKY%F5g)NMBQcIhz^NHb%_fLUy(iZoI?*oUIt_1XsVhw!`XP2ZxO1nRGpgRjib6@qBZdTG@EwD)bk z4Z^j;6i&WbX%W_<2rBjGGN3xXGe<9*9(W4`6}u8qeet)e1ZbiH7X!sBLefI$0eTJjiElKJ?i`A)A|j( z-`waujDIW9@8;@o9jDqJJK}vmka+p^iy}wOr$K%!oX-IBr`v|s4bq(fln-OfgjtC* z)fHVuF|I3ROG0=$8D~%W?r}(@I$L`YFS}}$5TIw3DWX`cdVzX zVS31@m9atDb|3?PYnMW|cus?Lxy(9Nv*%B&wo*f7Sew>>diD*JT!>1i zu*AX!awm%~5q%3YS?7;SvGxa-&tyQ^H-H}cx@IVM0MK0N6vMNoud_vJuz&ud<{2im zBB-1ktdv0dX{oUC47hqAkEJAxxhP^!rX6bn2f)ppJE)HcAt93LWO{6=H;7+pm-jDG zF6sGkbpl;=P^oB~GYNQ*qBX>TI^m}YhOj7&wd>3G(|xa6XWNW_nDm#IQ!($Yyk8wu zm#X{#tc9lWvbDT74(I*thh>uPPbH3ObO?7k(+;80HzK6te#Sa)Oh((tzl+g=-cnN$ zaS3)jG{mw`1`GbLJBE4;jB@ZZEb7$ZE;LAbGXc^G8HmUe=FXvZnnlfo$O-~}*vULJ zR=&?DOgUK_Ky8h0rS>K}UIOo6hI8ClMUI2PSIuQU z9qkZA1T~xz_33EFFX{YIdQqu^`~CjA!X2FO)B6i>-bu2@#(vsr*%2Gg!Pjd{y8;KL$x;( zKm%$e@`CC*Osqmn^$Hgx8L(z8vxHMY)xPh` z0QR)gO%*$k->nQocu*E{+y&gQ&Sx=K$_Fcg{_jHmP`G^j4;&}wKM~7 zZVuh|LmQ&6o*E!xX(2y?;?~KhNfCWtDzN0WmqiK2TE$z+a|sW?GDzt(bCo9rDfd}s z#6)FQ_2PQf_0q`3FVR`W?7dU|aaO)_T=^nKqk4Ens=7L~nQJjEWR?599rdKm6(rFG z2IwYmi`|f^Ti~uj>7J%YTfPjxFrTYhomZ63_W4xZveAeN`e>@s@>cL^fTqJiT)c=6 z=BF$(E|xf57%yF^1!b1x-$SNwbd6M?QUz=eQ(law>ZP29aa~e*zQ-5Q7ug{uDn$Hd zy)5`bEmX<|TfV0^x{$dANotieK;Z|I3*q8a>8)?!v0sx<4A*`W^g2z$trmixB{K&q z3rvhftfZcd{*2eHQy)tZIHzV;tNEHH zEikjllzi38`oAGhEOTeeM==xlwfMwMQxDe=x25TF8#8=$$FvU(1}~{r=gez5gK6znsVN+Y13naX-_P zoP)g!%BR-)JQRaO@KMObJ>dOy{LUwHVsV_Ylk_mL!*%tyQ~;YWB+B*M%_+P3uQ{u) zpaxy$QG#btAwa5w-OpT^=2%--C;HYy()d>X?E_8GvZc^yQg<;n$?9)`%r(`Xz3;UFovyBVH0z~BR<~=SjPY7>tmMw+6!#bFthZR)o`s6sGB*^-i_;Z)VHOsE0w={Tn|(i>ta=b zy6{x6e3qCq!9EWzA!&R_MAC+|h`a)xQ^G11U7Plblq@>rsa1=}mG=SgKM>X`Y*HCI zF6d`;YJ})Fk{JTJG}5?qKS-eIvZpTmQ;PHt@_stb#sg09oPem4O#YFqk_V$vq|Yea ztPLt36tac7gd6lQ{Nyba&5JFmdZWcTbJ>$ppJY? zkyOn0<$aUVsZGk16430wFc&&Yp50gjus~?0j@U;`q>^_giwo)p-ecyV&do)G>~NN# zb}5g(;+#uV!04XoGS<284JlCvjLT#V(u22de?w3#md6j%Y1n_Z#@c~N3cL27Z$POA>-E*2llvSSqg0F-y6 zuCdc|ca@kRTGgkNRtP9Blb>>C1#pXgP#+H^5*msR>&3XvhgY&cJ)Wm}Z;tpnJ!XGaE<(J7Z-gq5B&TmpimOMzW2t&Sw9e;@`zJ-|P~ z>;VwZlpF2ie06IrG3*z{PcNSHfbpAllq;2=EzgN;Lw$lQVR}CX>2_b20rlCQ_g-lR zWVbry@!u#DRz#D&>+Q@eZ@RyoTU5=dSkz zhH87c`yPvlUa~_8{9ahu!;i6NQ0hsUu29!|qabttnO@M{=Zv$u?iz8yj;j5+=@C`S zgVyvbDXMc+v+J&;m9b%Bn9Dq^1n|(XuEug-22?^%u7JYc1P3kJC7qP4TD{sOWUx%Z z&EZAv7m1dWXLKZ2QJd{N?wKC4YopPV`!KcUkiSY6qK0hLq^5}C#2@8ith7nJTFE|j zSK?UaBgHo+)1Qet%GZwom7J&e<{L@l9rN6>R$GTadAcGQK;2W9(@EK7bU4X?+~Pn6 z&`Us*fT^3+SV=$WI?Bdg=~XEXh5TasVnD50OYSD#jr8gX)4v}*F9#4ivfs?tp-CZp z)1E1`oVO{|vsBA8;W_#%rdFhIv&1@qjdt=_un|~5@Z3-~nV|K%VfgO`@YrNs(|(jD zN-)9rW76-o-jDMU38>U%5AP4J?ik*G80p_;%imo1GU0Pjq%B;RlM+OwON!qrP(=Z8 z5+EG(+``Aw3M0C7m|G`6)enRJm8Go4PWFqPuJPTBgcPU0X>^`AsaZD<11iI(^D*O_ z0PrHqr!gST^nFzQTt*vTaj4FAzU*9T6o0lduck529})ZqGnL~d_D_1xY5Q^C^A5^= zx59dKSINDp7=2RDziFBh460hS{+*y{lJ@XA%ac+ghK+$gbFK2uXgbVgD&r-I91}S! zJiTg$Ty~9Q5EBg81;nlZ7F0t|TnWRMu7E_r`>)4#M!s7>IxhJ{UY*hu%eJGc%OC}6z3LiiFyhVu zK6#+@2D?OdocKNM2ubb&a_ms~+1pFxx;zr%)3SOW>bx~21LW2Lv~2*NC0xq5SyjLt z0zwHep+Ik|atmlNp!5Lqd(?MadI_l0m66*qbB*jIx|qRX0Dkmuy#o&8*LCD4G$j2> zC&+J__%JG$LX;~d%OOCG*2|{%4-K>Yy+ps6Y>MtXjDL{yTXHWVie`EL$)P@*cz^hP zRA~o8^AE(a#f~rfNwwGUtoLEjg`07mczm5RRR(mnrY9?^jNH|fNF~d9WlhBvLu!K3 zR}vs2cR2em-*M^cm!UC|=d+aJToMxY@gf4vKK;FkQ?iu8d`M*EV!hj9?!nrjzp4Nc z_5N~K`H^!5xJuxqrazsJDjU6^8-EpQ%qb{*!nMwQxIQ2)r~ z@k`=zFGEzt!pY?EO2}9~9tOmdm#0(O?8E-b56&Xo1;wCS-yqTn$`z0oPb@3$*Xv{Y z!J@=j7b`fMdR!d~YF4JB|z0_w}2D_ksc6yn$3+C6j@nVd|x;J zHn$+Y2jh_iZpvn*`VzbV9%cG4!9s#0VDOt$cIkef z@q46ShB@hitRLVo-ruAC5$`wY`59A%xiXVDI@2g^8eXi+}bw5F(FCsEVwksH`cNam$~d zI+_#v2%P||!km|f4CSwld<-kym*0UpF~GV4=E8wWQA&67K4mNW*BL?Ld~Go6JzCkb ze6RRrxi^@;SZik5n?r0XoUdOLC-Rf~kw=T^MDj_b4bk}bvix1X<$*SE0)*I~SuJ?) zvLwFwIQMpBu_S$G zse-!~VXPA>Uy?e(l?p23@ASw?Z{DlA2N|mYszK91_a;95}PN?3$ zyB1{PbM+tLFJ*tJmv3#XYKgm0L=d138x zNUs0d2q+dO!w#y!kf-4H(0}QyQXsdLBwcYi<%!~tY$fsmSrmaZ+EpYaY#~zR6QSSt zM4KkUf%qI>rU4kA6WQ~*5-gNHo7srVx_ae)r5)Ms&O>~3B##C6Ez~$DI$2i-Qa7RW zM%Gb<^tO;=1wA$HB6U;dn&R;&%7jjZ73U5w#t)H>G?KPbt9ig&0Wm?wla+mc<+d<1 zYKSMfGXAW8j0~uBvryGkC|_2e=EE#MG{Lv}U6@0lY+hFU1EecT;~Cv#4d!lv`VexV z&qEArsdS1O$yG)AJyC!pSu8@ywtD&%wsuDDjXWO;18Z<$t zMTBW>FeTv(KEM3MavgUCV=RP=rj_GEHi*MY^%Jgc>9j_@y$nuAxDqc1n;QKS>W5 ztLEDYhcbXoHDH&Ql4Kbmb`WEPhs6bzIRJ@+mW6<5RzUR$&^!ThbLDYUi2*Wh&QW$zWQS1tJrzq$G-H=o3zV`TiM_>?se{6=zQ~4L-KGx2$ zcCO=yev9i5(*0S+-zWV&W}k}0Kkq**I$tsD8liZKByj8W)6~xy+0SZ> zP&=pdO~}>}?^JOPI8K0viCPp`hiZzu&;Ef*>O1Cs8}zS|7HZ0-_OcokD`(*dB{3(_ z;`3OTx5M(u+rbX8Y&3+GF;1M8q`7`$C4Z@eo3*hx!Ku$hLu+1KF? z7{zf?)}>a2jYn*UL}e%v>5Xra#&h3|Qbc*}@$!p>Svw{22UH3_ z@et&mJ&qJX7UL15_EHlyuJz5Nd$hF0MZ)P$oSdH6_uA zyg3xB%h>+SOaR>z;+Obf^}n>Wk62GA2G5&n#_LSo^R459a5dA<3>oy~X`d4Ps@sF< z>!;boMdQ^hZHGWns*?S)uTjezz-9^O!K8l892r0j<&iuo^ou@;`B<4K9Pxfv2~e}i z*_F2fperqxU*|^iZ8v#W+lS7(m7N(NH`AY^*e)$B-M3#v*W2J^bd*LQFpOGo<^YVd zw{GN2Ii!BIbV6HKbVWr&C$vO@_`XGHf?C?f{++y^QZ85L{l`wpeJY{>z>nki4oVuw z4f(CLfXrB4od7%yAMol(C%JnOBf^bPDr1A3uK~nwR)s8qT1gC*m7zm+Xe9}5Ph1o ztUILXc6n-}o!mvYT6X|;ZnU@u-dG+@^G-jN0F#yLAZzc+NX*E3DPX~Csum1VEqHg+ z7H3xIVdXgwM1KOSNzBTu8lZASW6)1VSs4MRMkVqcFz)CQao<}IHn%WkckTZY(P83i z8qaB+I6K&e%+j@ajSuAmb3pmk*f)UoM`L`txD@JSah6x8!7>k56kfvgvz(AJfXyCG zHI{zPYrh)lFo!D%RPK3uNqRV|WlbdE3zP*qDNh*g6KTX;D_@g(kKjR-A0ky8|FHxJPB z$|=bs=YacqG6pXtgg8ay*w6_r1L(Lb11Q)(kO5-rfLvpZ3*yU$jw*q|-gB6qCkE1S z^;>!=#;!dF%mojk$+m(iq@Wu){ViSzV(A#j@9kLiRc28lZsvH)n#0T^xi z0Lwp~=yzFfgYLHzN9OjB^as2@nz<{DEc}DkZ^Nl3|1R}E(Aa;f2AD0JEf%EL7mMcd zI*WluYXJ>70aUo8bOJDf%SeE90u(4+piTXiT;7!(pIM{?({RKBoyg03FbXUq8A>aD zc^d*$e*}%JZj6r3_ zHlA|-c{S}<-_6FMhwS&|V#0wYFc52fP@FTgMRZjHH20bX%2(>kgKCsP-IW2Q8*Yva zpeMz12#5>zpLt3vl>mK;%P5&d1zm?E?nV!=b&9GakgA{@FfSLs4Ncs+5nu||+|3D3}A^U(6;Jz~oh?m3lLu*|i&j~=2dh=z<`Mt$;E;T?I$1A(8?e!-E&|%t7 zK*tENskzGRU-xUT1Ay5Ol!Y4CFqqof(pe(7sE#tKlU?dxh&WAt)Az&m18AaI=aouc zCa9ry6~qjlocPpLjPe^wAFBoNc>SVIai3vRY@6oPYZ7&Z2=-Xx1y|Tu+Q&3vMr90&Q&y61w>HfhSH^CzpVgug0E_Y&F6=Zv2CJ^4oB{X3k zcgGw-^t)WYOZPiGTbI3TNZF0^8JyaC2=CuU{ogpUU&9$Qt9Yn895S*l>{59F5H|{F zTE1{{pAT@WztIU!Y_TYWudz@vNO@2T2{eG5@mo)2uX=r+(y)>kgmnef4yrBzqDA=v zS+^~LU7n>Zr%U-c0ok|IgU!Z?GOCI7ctnZL2rLIm-RJy20?F+o4lq9HZ33*>D*M1& zIxhIWPyP)rcId84GJ}HH4@LzXm7=tgr*G+eUQsfvR1lH$r%@DD%;s4p@+IW$a;FMJ zGN5#Hy=$C*Xc@40GXcb-dmmz`T({eS(Gs08zLLEUB{82NO1llp_lsWuzv|QoXR%H? z?KHYF9{%~E$;M*f%kl0pNty%u>`V<_cAu}(&m<3uCB8o;fYof$s+B9wS!o7Ps`a+I`oVt@JU_$4Y=_{1U6$o{%`*eUQv$}*KZ)r3xta$44&!eoZq0UxX}WYx zUeVkZnDn&Po4l+-BBXVY%_QSw zUu%GpFMao!USN&`&W$AdFEYafJCT)CSpu2LD9PCL0d`r{50Uvlzu>Y?zc8((K&Hyi z%!CC=ql2Y93;pBoE3dqc?jod$-L&dTC?%FLmD5iVP!%dk#rNx^2h|oYr{L9n(ijy) z7i(mTdVswT@6f^;Sv}<^UWzT<_3WXQte=asa2~MSIzsQQpl**7<0PW*7Q)QBRH#=`>o;HQXat4wmhZ&Uj`%NO66|uPW=n5F z-3Lv23G~~pE-WZbZT66k<$Ao_N(R&@(_pb6*BhXupkVyWXH-#<)%a`Dz=jSA`~J2bPUrnlP5`Im zU&)5dQf;0}EZgD>gTjaD6h-Fflrl`HwyTg(>ACVXK(=&NkALA;;sS*ufs2Q-aWNw= zGO(U_a++Mmw*Mmci%6#F9MMiT(o?~CRXb+CEJaoSa&5m-5F(T0fvhHZoDIUZe9;6| zm}SqbNt*d_Qs_REA)^;3I7Rkl0RPc{o*4_{`J%f++4`RpA+TBv31pHG$XQ3SW1QYI zVv}WRy(W^brg*lB4zICTMN6!08NaDyM~BFgBV+ucjro;Ovlqi1HytYM8AP+-XO`wh zLuELSEGEE+4W56IOZxcst63FED2S=c>AR#3o`t;B8FLA>O;IJ6B+UHlSB{nciV-dF z21pj%l>yxS;>iGa2Qf~%3$4G6D1qF_`(uZDYQHN6xS*nk)0YILCH{08_l@XtgCUG$ zXMwD(1di=LDt}s_WYAvL}cK3E@*ymLkYN31s=z=SxG!LN(R&|ePyDy4B#2K3~(5K zVd=av{DWSrqlaF~gSwMIrlzH2HrKgaQK9=anJ)?0n7|(_Lw$AMF0C)feeY8vmJI2N zUYENE4uOF@IXZu;+u@*fh} z2hjO@dIkn=g5Pj}{$5pG-AX-j!etHG|B9l5JJt zyO;ZeJ?TvE)V~-x=KO~@S>D;;LiF_Bk*lZ zuhtmvMPcPCA`Ku8v-$e_L-U#MVXUCBPiQGoJb*7}|1RllDS^NtU}V6EHy}Mc?0Fst z3L4ouptgd`gY=IIiBXdTNX0V8h>d)c1Frm#8A+g20hK_1TY13Ye^QspN8FUrBH2xK z(RNKZQ-OzdLQ5)?Zd%q5pn1yJHI$7NwTI|WaQ&@1q09K)G{^G(LF&KZCcd2dKdtsX z6AawwpvF|-aVJ23voO9SC|UipVZ=xRM(bD8Kc5WXXn=fOmAX?nD(@@$>^iOh&i;S@ zt&a0VN62wuJ5~Nws9c?N!6!0}-MEsG20|}IvapH!rHW`p4Qb+T8Yh47bTZF9pwqgL z;9_DfD}NLrFdi3u5B{y?(Vx^We4?$BQWVaP%lF5Qr@SgLr9~7_IFL{J{o?)SiI1S- z(THe7jfJq6Bdg+9o&V#=4Sor7&r^3c>BP}k3pIHE2EZJct)V3 z<_No&*=c|B=E+hd_>oUMw)tb4iGCylXx`e045*AhnmtUd zi%XdjtP@2QKjx|bunkK%6_ju^(l_3lmzO_C)8`ayG zPaGBEe~6`85F3H@d#Azt_p|&NqCd{{$EAXQ3HwR^X}o_M^*@PukAy!SR#%T0#*N{o zl=>-g*8-xcy(3P5nlc&?$EFPsLaD=ipP&0~RJFmkgj2W9?o?PO=|ME-|jMqc~$I*X-&vRYGwoc6%& zzwX6%O3P;?8!bU!C0*;aA{tLqFLZO~UP>iRqF?ra7rv!n#xM3)Nagb(-Q_B!^|8d4 zE#5fpdSX0BrRc@`8pY^QTTSCkrSaJR(B3Ql;txd*_2A4p=w^||0R5-?yFG)VRY`8- z?5M%FKt2g^rwui=KPa1F%OMUAaDJ@9X*x21pRLmp>IX>305Ls4I|R~`noFQ&R-Z;K zoN`q4LSlf+fapY57o+~EXZhK-$0fMQ4+aR~fk z=5w1Y>l4QGl?KQz08ayyZ$zENTUuYf!eU_?>TLSsk$W}yb5fvXK&vOk->fFNx{#v& z%r07vkQs>`*1PNSYUIe^w$NjcUZAZ^mIZ^>2x1iEIUG&1$n{EtS0`UVo&FhX3e`j{ zt5_+c>}4}bqcz;l)@OpZdD|xRgIxjONQ} zPSF3I77?izLn%vF2dcH#m~qh%taJ_jqp#zs+$(3F@AM;gNb_wHPa%bb550kzDdbga ztDe~M_HKXWW7f~l1l`J#IXz4<1BDIpM_EOW)z({_7X$KIZ0b(! zXHTIFH#1r5bv2`nZ@>LKisCZ_8Xr3`Ex5jV^(mCsA}Oi9%r$V2(MPdVPYUheP5`AI z)Sy@UW{ED$y^$WR+>w-AYQNTJ>eKU7b_Seo%iUUOfKc3|;)}#{d5FXvJR)lv%Cv z_fTf=_B+O`8Cu>A?5R!?mTH?aRT=#Np$m*xEDpy%WzE|?88Gb)s0kipMq0>0%K+&w zVjpX9AUG>mwWEXg#``aA|Jqs*2!m2XcwduDiq6hH6OCuNG2erw(dVNQRK9M3;aq=H zPcR91C@!dZc9P{EN%Tv$sVs9sXrE>n=lvIt_OV{M7ixf++8w&CBwS0epY#z^pfPaR}G?Tr{|JMC9|_|4tvoRu?e-#<*MUWrg*Iv zOTlO+U6ujkd45}OOh*Q!xxc1rcS(Lb0ibTkU4GMCWL;+MZ<6x^Oic5hfkCa=mvz0< z_3Db)FrT1TAR@Ka8{o5#peV)im63?g4ImFzzWeFB!hN62Ay5u^Z>-S?T`}OWeC>GG z=^NTG-$9-Z&m_??Y`8&w)+Z-a%@LO`o+CY4b6J#TlO0zjj1 z-V}-L5DEx;J*;8rpHY!y5*SAd6RHksF!gHU`$L%+|NM^!+4#j0^Yvo{|ClIA`rV zRXVo88^Hg}8S}7H5|^?o?RJ#_Q=+b0AQS`nlM+h;qYA`jx5IIa^xupnzI#0nHBaf5 z%+n|_uvaGp50&u%jJn%;L~~0B&?bw1H{+H$%9D(L6JMWHAeX29SI_{)QgT*HntK8W zlGvFI%nEdu{7;L4)^V+>1vX)}6d^P~FbSBBD=|O`iec|@?008x8V9_Se;(_&amFvc z@qDmn#9qiD#s2H4uxb+-m*hs?GwOfun+B_C(v*@qSQLhk3KTTfIoPkB_c*LJU_3T6q_3yO40G-AoqJ`DuHdUeCxbwLBDI95znugm?$}Y0g9G>;8)q0yu=Eo><;@+|M_iMd=0>RV-1AWt8aw!clo{=ZnN=7&OE>F;kpQGr zzMcax$|Jihu#>w@=Qn2DK3}VXE5RDV{HcRlfyV1Qr--kAH)a+{Ft_Ooa9WtMb zCtT{(2Wd$!k;us?T6M=&WEq_`dd*hE!2Q>+GJ`v2|LJGiMoh>6^IEbs;MrwViBa37 zE|GsXN;5WYA7&>2_zm_F55HP>fAiBgzrL0t2+9ZU{)(WWW99}h@g}6Xhzly}M@S(4 zp=>Gv)|i@wol%lk-+SdHutSNHe$P!={KM0;hZ~oyQr18wd!xGz5HG$hv)zK^0gy?D zU)*lG%`AV2_4exDVBPPQyp^UOUf@uIqp+=_gEhd|BKkAUsH0rF?8w^Gb^Ua?T%SRVQyb|)ytF;DA$@9dQFn)e!F2@w-)}S8pl@DWOQ8aADkXS zBP|N`=atgg+Wh2gOFn_>3efDI0tA;D4ivnWJouX`O%$-C<@1Fozti(F7Rc?#WLK^o zCzo_pcRtt}tai#eKKSsUV_$Tu}Yku?+-9lz^N_pm&7O z%+=w+Ru!zmq1EBJb8d%Wam?p4#V`F_;(@$R=!7Y$pq>zK4nWjEr`CbAFC_W{@ADp~ zL9g*!c>f1b|7T)b{AiS0?EGa755@@~qUvj*A`qy%B9NW<8)*RlY_M8rS`to+hlkma zCEyYNr85epmm`6c0r&fTB_F)+m_4wt1#YFTf8R7;5?X-A{M6hf535r>n#z9fC1J<- z4Rcnlb3VY5-<4m%;-78_yb-2GH}SpAaV>pi0X8Ql0h~rN%~T#s#kH5gPepXk_>7dAh-;3=9nu89W?Tb)yb;`P&rz9Iei`%TApB19 z=|M#U@Tf7P1S-{LN}#ZL&g$xmRGydKtz^rQ(N2rSHMSP+E#aTNE0WoFwhCq$oo40e z$NIH8WPncGdXg84k7hgR;M{;g8Njpf^bHxXO$l_wfcc!L#3hl}r2}hc`JDG4Eb^8O zRv>z;l`c$E`{&*kKe5ta4Sz)WHd;A^?u$QA+Fqi+o9mBMv6=B7QTS8o_)DmN$7!(D z2{2N{&aypz&+00>9Oa!FE_m}{_q*{@WhBB-XaF8fb435uZp>W~;oPx2sIEowov9?BI9 zMw;(ovjp7$F0OddK{=#38x_=*^Ha$-k0IK0H63eD?}{2J`Px-{U0a)}N#!MPH)JZ7 zcK3;fvIfiMXOE80X7X_z@Z*)usg^FInicZoe^bJ5KV?dQVgE!sGTUbt!Xx|T;y;pS zv%4f{y4RiS$AAflK*6aCwMGq=Xz5CAH?gZdbWzb0rN3F^D?NVeg2ui9?i%x+47hEP z0ba4L6438TTMQWEeplD2#*9t{kuh>-V4197#7EJQly%@}>V#%By^X+@gDK;#F#U-{ zPoVpyo*h+OjrYHb`j29ar_W3UZn_W#W&(@{0x{cJO;f2jqw;oF;C$Tk4Ajpk^8?U) z;!=A0j-)t&x}Jk_1^o6?V)~=Si_(9RF)$2~GGjAS0-XKpP*h>_5DeC1q2g3?&{$g3 zU(r6FKGrHK)#cXFkZ=#uceZ{@N!2SbHz%bxtjA5q4XEi)rvkx)c*#M>FoU3Xg#v41 z^(rwgTqdaQQ6xiTbvcdr8t@j1=UkLvqRsq^lC#7cSK;UmHYJmPuY#&eUhyO zl-|z3q!(yJHiYw@S%OZb{4*(&{XWtUv!w6g?>a{Cg-@fBHLt6gIt=%&^`YG!vo}+~8q}F&@=w-15w%C6a^gro+Z{R-W2Vf7) zT^;n+2ht5GS){{|cOb1uJWldLqi^FTsQMy|geuSrIy}&yF+E^BB50=!a441x4H{7b zT`|BcDcY zPpy$f{$z8was}iye`Kgn3bDMCWs#4aY|9u<57Mh3DIu}s8dX52dhxf)a?S5SEBc;Q z9Z>%yg8W?RLdZYjniY-q;8$6GHxNaXEPgD`dZ04&`zS@W(v05&>3CQM%WOb0ZPTYY z+}p{=1T_VF-$z)!Q+;`c!|M#u(YJ+s$9HD?$v4a)z)!7Z84CW;i<>PWYYWoL2(N@kz&{bzz8jr5Aln~oOW`q1#-j*@2h6~3&|m-caZ4V|h-3~LBm6 z&IIsRUbBHfI+xG@jmZF&*?Ss*tb`?t;|Cz#&leI^bA@x{k6t*4HVGyR+%I!Qxs}V0 z8iM83*0P8+RQ4~~WQYB$v+j6Hb19q9Qie6yyAE!VtsE$1)nV-;lv3x2Xtu_cW8hX`=>9JWw%)vuxHR_{gLgO}whuyAM6NLsj(}g{^fW0-Y9w>uj z^J2%kU0?Odq@SQKehi}-MjoBv+VxJr`%4s=E}VD%u`t+7%rS8i#p zZ&)OCFF)Q`{a%zOKPp~*n>4`vx1ZY|(tVEDydmql!n^l()9a-T`DS}yQHj2Fi<$oG zJ$kNs6=%}xb1Lx&bFEQ97xV@=PnT-HvG^M$&=UiZ9%x7c(fIC7U?ceLxwx0HaysKM z=^RNUm(p&**#}?>v!d!$V!ds^*w6u6CQiJR^k1P3&({ELCxD#^&@OA+ia=ZgDC@N6 zD_E^KzkUg0zt#Y0QbCC&DuE()?I26{m0(yG{VW$>BUbZ!#6p4U;8D1J%4d44Qr7xG z8@}f)>OYgcNBx;1T9eyKoEjx%V~2g}ui1KYfs(NccZ9}0QU#`*fe<-Mtq1M{^MAnJiAwYK~+Y6^()`~d2E|SA0y{kS+6vIxD3}1El3(7$be|UQ1hYI?`h-^aFsw?3`BaMAqhshWkMkwh5IoSD=)q`Sm8(&)@v7_ z&H+%^<1U%)giXEnB(8tB^nVGi(~_%h3f6N1h>AiDpi2lQ3Al3x%H}xL9xpV2+&?&* z1hYrL+dGWtyIT4)SN~Y{XPq9v4_8J^Va(MCEC+x_Z$C(Z92?BoQBc`K`AZkdrY7r~ zKuLZ@e7szZsgB#!dk;-O{mC}!eu+{ajz5nf8|DWbt+5XDl9^ZT8MS-}`N?1z8P!V< znUYRT5h6SdrkYk0N_Mu=t!_{^w|5N<84$&a6wAKQMbRZ#rQ`0eG{mB#_!b%7|1_r}PZ4Dgv|b)G^|4k6b?X4e_47LzzAx+z6ZV)6@ z-+g~iG4COmE$zo5%Nw`~A-1f3c zF~bo}qdH+C1Ze&uw)OLl+w)Yezw=4D6xF^|V_t%7GXaJJfou_@{(*)Ds6S~EaMJWT zG{{(-3*FD-Cr-7rWy=4{@j;_3tK8;b?94CMeY-M+?7w+4q?~4sn3`-oY4!yPw~1PG z>#TvR{@<*e#nhwM*Fk$klE!v#v^dakuX(~mpY>!w`q}zQs6R`7N8EOw7bfEv>n9b$ z67kn;7Lpfb7yqHZT~7ip zum~wx4I3G0lEY#4!M;sF3JmUI-O-4sVGS8z&&D#KuLMLl%iG7xa<>>$*;?MUxa4t+ z?jUv!r}F1Lw=zstJ^Yyz9)LsW;?@q@Sof=l{;`D|j%&8+>|KFp_XKE~Np`IWh?qa9l{X9OFUX@e>U7yZQyN~9$g)z+P&T7ssL>Cvz!sd!{0EzQtNc^Ut8MI9 zf3T2Rt3&ura9*hD6%t)7NxC!Tz*f(CXYeWn!4FSW`P(ju8GZ$caJhc}IUqt^$$o84 zro56br(BJttW2dvK={V*g5Q4be@Gs|SO&Nz{~Eg=+x{6>E0dUb$WX4SL@iQ*`9CVO zl3l9N2|R)A6`fvb1J&|Ud-+L!gnej=R>xX5AR4mw59Rd>KP(c0xS-(cB-NBEVN?&e z*}O)Kg}`(YJZ(bo%@Z5blbEMIbu-V*@Fd{F9>*6D{bOIGE93etJPgAcAfou*!N3yS z*&1wE0~7*bH9%UlTW2g9Ku7{c$~mhp5kzv6;KUzjQH8uP=vt#zC3zS~D~Q*kvoNS* zunoptNAvaC6ho^_L0L)HS<&W(usw#@4N)wY5;$YMsJ?WXEYP8*F4&is&)GKV2EXJZ zi5iLB{HkBlf|_bQ!Ttct5i&sk={A5h zj|mD;hkNk=98DbGnB|{Q)D!St ztv%*bI1rO_d?1iWI-vn*7~>26*pxL)md^p;k|2}v<(FL5C-E<{B2fNWw*pFe;0pf2LZz=5nZC)PHNPF+fLnvfN;Heo`0^Odm zSDUl&qvD0ujd0p1?@Q_sec^&rXJ$(t0BTh=Aw+kE^3&IXUexsSp#g%)0Kfm-{-UfV zoNM#C%C{x^?7zAw6<@DbdC$O4dcfWJD=+@zHqQNE_?B-ccXZY<|3?!5;t3>!XvFR8 zEVEm9Lk4VC0<(Ic!I;Cio%6`geeN!7YshR+lQF=}2n<=-mYsn24=pc^HF`#A&&2z- z{35e~8+xD}2;>*i^8>gVVBN#3Xn;rHyhr*?uuut*DWOE1^p}ocB7v$arDrWc_S(n2^!;EWwme)9t8{F$AgA ztJYFNg7EodJJc%lK4#RN7yAWT)?*jYES% zC9pvcL{$u$(l^KVJ2;kH#WZ6o_qa=;8-2v*036ICkLo%Q{ZGA$E;fGzyBc7_lA!HC zAmtTyC;mnnAjP~YKR_NMm3ZL6Lgi=m8#tstH;u~wqu(m;uQFgQ_2;)Au^uS#4<6jX zKJuyc#RSYBNWPv(*%&PSFfsk5MH3EFiM_=BH(QPV4JRHMf!wZpQlPm zUjtCTgd5}9T9pRiPjy*jiTjy^kVL zb)`#0+(SiCT>=jKFK!H{gS0b2r*SC0AN_BCHrM~@oB#E}@a-FU4<~jGj_+2RDvUS; z+DgEqwf%2STMyVO6grUsM^o8xbhO75ZQB~xH04kDeGl(HmW3WpYCn%9zxx$!AoSa2 z1CNw5r~$%2p!ODEj&)zS2-Jg2NI7DO#!q+iGYTI!oMCZD
WJsTFW-F|+U9>7=aYY$o3=Dgb)GlTGXw1W z3H#@CgN~9E8DZ*8&p=KRHNc|bncs$!JMy+cd+d#C+Bg3p-UncL8w&gGw783pzra^% zfOhf&H2~iXSe|;2Z#rTP|8`pN`a37MGl9{t{jU`Nu{O}}j|l&IA$E0P^_5@kkk$Gr zvoIS!ag`MFO+Q!RlMB+j+vbb*O}q6(aS)Wb$hj%buwp)>g0XpUW1LzCL}q)4HO@WT z8VLC_)vK|!@u^9999rQ(W!YJELa`$!JJ*Z(KO$MV|GY9&zd0)kk&@#!B_u)_P=cbp z<_NceBN$Xhl9Ji&C{VVgo8~npAea8GRe->R4zCqs4*!uiP4=Bp_KB7gv=Q1-jP}p^pGP3jV{w@5 zi6atUUVPRlM$z+yghBj#FRyX|vLD6iJb6GQ7axui$duW?S|Lb8*$2tGm?HI6Oq6E%MMYG8Vupcg|52P&xry1{kTsjK+OqS)8z8|VnZ#5Dmj@G9 z4cXhnJ;8B!ChE0qu!2`v{iQLgfwD;c9 zI^jhJ7gFCW$Dw4hFY_12maKL9mbIDPwff4Hl>9oSDDf3u5i+(?_E0lBg({n^3sje9 zGR3%}wZ8I1>p4fi-S0n%4(2oqr~aIv%PSEyoqtIc`?t1#=k*ELze>X{$~&pTdrY*C zH;H-joe4OW9nFk*m9DpK!lnJw@P8$wU59h+mFUjm29?5S_2?y5aRSkkfxt~Zs z%$()rN6TahL7r5#)Uji2$s*)_Acp_lVq*)HczkxiHHVB@k#(z$}6 zA$T}dcRHuHkC-bV*g-dJ$AehH)1;L0w5};cXIW+R@=*{@?#ul4t_NFdgL=x9UR};g zfB(7t`?MZtc0Vqb`m-{m1|TPZQO`u*s9gC_FLKZ4Gb0B)JfM`|!`W9~1r{jVSL zTnjbv_q6uEw1%Z6fK;E;7GYFa0jY($RFN@U)`RZq{=)jEXkv*)5IstpN>#nkT;wM{ zUws-r#AUDl6anMD#r+4hEWy;PE|~f%Nn;ybejhRQFjp+MSY4X_(0Si_$(K4ML8y|D z+Gue7t~An0t=E0wvOo3a$fsSRJSHNumJXDLNgQ2iHO!aU|0`ApVt%2r3@G=(Hd}AK zyDkUx^Xm`EPLOALmVTzKdec*`cJtK*i;cbV1c*FMLQwzo?UKF_XQhAE2ld;z4|f|FDr1!W^Pk=)`fLp_!|&(xK!e(52kPOBX?Y?CnD&d5nmz0ykr^D!|s?N2Q29?J9$s%&k zpJL}xoY}>~D_)(w&ngZR1w+~BKjmSRk5T=%XakSRi$BXfZ7G51W9v4t?G1Yz%BdblGIwb2LDqd2%6Vu`O^3`Bl>if^Z;3%_+8r z#%m=5l*izYe#@kQ$$&bjGbvKZ1z-PXT|LM(IEf{Is{N5To#2~xwBnu2IX}0CD%2ow zOZ0WpT95iy6T5a%uF>1J$S0mcDcQrU0lX2WpY0&xlKa}-bykAV3{Ku<)58BMm)mVx zPOz(#E%7?H?v^X6QWxcaW;JVXOPIQc-i!>Wq&2LK#GbPugWU{R{=7hnTqti3Bekh>e@s@PGGW zgt!b)9)movmZ+V)@aUTNr!440BO~=v8io0+Us`dfC;>74dyzkO;97LcwbZLX1z+?X^%X1=v4h;KgWZzuQYq88{*}#N` zi@u*20`ye?*FP3#?Qb%?Ex^NtGj_p7qP$06rYw3xODo{HZmmV4o5?>=37woKYZB6&p@6 zS)^*Qd%N$>pJ`76ACk!GQ=&9!)NEB;TjQMyu*E>}OK^s+zKl_3 zWPa~i60WM`Y~0Xwu!J*ug=BH}^v&YD%nz<}lhPC9hW%(ZpBOgV@{DDv8vv;5GwgqH z*?$!LQ@0h9?a}7{wt>H6{?{d+N-d6+0XrMEQxEKKhJKi@swI}OWLuiv>pBR43Q+tH zo(-JGD3iBm^`F)Nb!{JM>vApqN&_&yRmeRhEPs(5j<4P$#71IL#Xs<{_ZQChkQ3Ee zkj!l7HzFs`| zM_>NW&o+`UV*Y;u4>?2z98QOx&&BN}yo%%9pBvpYUfFjE08sp|&;Y|rf)19yWrHxO z0g5@$SfZo}KXerExdUYpP$zJx+Hv!^{qP2Gkw61O8CKO0sHS!mPFC$GW#t`3h`BYA zcN7;C^`MHg^}~L6rgBa4cMu(9;Luc7h-;?R2mJ8;Ten$mjhZp*e2VceW5u^u%3#Yh z`EVtTSaF8hAV{7j@~$chDHE1Sr-Z8kd@Vt9w2Pvr4-QxFUPiOCK#>RhrPIVNade{o{+3~e{VR$e zssh%Vmi=qiFE7rre}3c^=3P8~ug`jr(!vzd{kaG0!cGS$fs=5^LO1V%W%#x}St@+2 z007tjYIqtzY`Z(j_{|1k!g?KQ0AZD0QtQCF{K(~9sCrgEuIYha_-HD%dYm|aa4 z_yovG&A4rn2z4nL+XmIWMX}@tcSi(&wb@2SN7b*H(wjq`H#q4EDl=ybP{r2uv!23fK+g5=YilFG=5|!0?|dU~SD`wvhc7 zTLUYEpN|C_icwZ*?Sd1OC@X9jaIcw*?5tirbqBj-*p!lDG zvnB&rBtpGa0~k25K;%95DL!rKrJ{W*HO|~!l7sBWPXXLQ1|(O2lmRJ4KA4!Ixa4XJ zl!b|AFX3`;l_D@hzMS%#o8vHbo+URW?BlA7)DfA;H!2s>V>7t*#UjBW?%7n$GnR;n z2;LdCEkl&G%(`aQ=cRK&akSM~tF|DRiBW5D!p6BO5dTqWcsx*`5lwQ<7vpK)y_-fW z@o?9M&KzC7OU?cH8V&D6ZHXZ0yv!jDus%HO{mX3>AwK*~OVT#qyvI6VHLD}RRQ`HL z>(}FFoo-Z$pC z02jHhz;!ghQ2NHIpqn&+_W=#}3ASebWRD*V86sZ+*}$1LU}=fN7aB~*SL3o!BX;Fx zVcTcdSohds=j%cl!uEf2JOeUJh;}jKBY)|;#6L7^tNRcOqQlD2nnS}|n|K<0oTwD``Oi1L-72@;1Fg(|$Y-Wmppgf@VR?Pb zMb^$LPr5t2GOMq_quMSt=eObBpysLvm=ezKvT1d<4NcU*_`BIbSX>9iVX458y!)TZ zs<-Zv+?sC~OoBnj_S6^OJ_wJ*KgK0Sd47&#|88e(2>v;jrMOQ;uST~?gX{N$bZy3l zt~*IHjI`uJ0szk(aGnMzgL>2CHysNkG=L6=aKnKLb?mqTY#OrDNQ2(mJGVzxsvWIDxcKvmKdvIi#XhpLlIyu8bUN;isbd9YU|krn46t-GHLcq6&IE z!Z(hyTiPruQX>s0S>>oK?+D!yO-|jLs?yYJ^oOA#858dnz^wjsgggmV_*ycawfH@h zVnW9A<&Tn_FaPkbie3Y;e1N>h)61fFFA#o=RaNBnk`o|rZEiTdvu0=ssdBvs^cd*b zz#ehWGtmt>-pT&GvMOV#sXFHW`k{`~?87GWe>)`~w)Qm+c$=BTCkg;OM!-ceGZ|o9 z15oMwtWH@1_gk)jNGfm_L2(6?8d)rViC9i0X6hT-d+LT?#b>}&q!=Vy}a3gPTn4Kx^}A(i)|a%^ivevPVK1 zolDSjO1-M(k>c&reU)DtCVsPQXD3gBb zYg&f?I$Mcj4&9Ax`KpSZS%k$^Zz-_>f);g0cUXU?E(P&9(Wfg z0PW0GVJP@64Um@L6dIs2C4fd#fa(q4bibNQ#j1aLLB^F{b0rYY z{biD)_NArSP6)~x1Z+tfQ68dj(&BISruBx&!hU;<-4E*Ey<}L7Taf?Atw&v2sdMRG z5T?aOKIM5xe~O#QdobsYO!LlN6IF7Ww!|(SiY?C%kgkX=O{-4$Ubx5)z<)+EK(uzd z3~-udJPG;9u}@s%*7FXMzJgSk9aZIv%%0VBnf$S#Diq^a!8+NCN2dPhnWIg)Qi{jT z%4-qaC^~;-_#W@41whN*!0FZCp+Wp2sYXWV`S;D`bjaD z4WpHC*VrBM6No02!IPHmpm3f1Aqnvuol^-S-qZ9I3GQC#CglddSFIp8xXXT@u|Kr_0mBVlsPZF@+Wj!N# zMG#%ZW7*m*akAPURy}#;$-TCkYExF>#*IboSra=;d^wrb4B{Z>jmk0)KZWP8gX{ag z$W3r{X0kYEOG4r9Trg0&WTjsjK5M;5^&tBt?4K*jmf>Hpe-;QN*?-a>6YReY$GtEa z{Nu8w&GflmQQXio*ne~!O5h{$JGegZy$gvRG#`K&-_*WNIvhxo`%3&DzaBgF%9Ly| z&6W(v<6MaX&%>y{@o>F#zA#{3*++ct#qK=J>Xr-RmU%}oh;oDpnaL1&IA>V}gXTr% zGnFr=$Msou5#HmlJDqXt%NPfPL?z|96m@ZR$8cW^`zqXrR&S4oWXbs&ZEBqp|MpaY zl?17LQULUf(SJ%Z!OiH|Q{}VdRMP0ZG6FWr5=I0qU6~PoJnSN%C6u0tu3n8JEB~l8 zq#cSOKflH6UsZm16Xw%_68NPj_0ki`Gm=d}Q~z9~TA3+N;dRc2lY=>lFQO&SFBoM1 zG+n@5^wWJ8HUlr55Zd%Y`fhss)s-8MYZx;0Y<^ znH3o$x2eKe!a>_aQeS5|Y&BK|Ob*+oS&MglDjCP~F1jS^=n(dpw|7VOJPf9RUNU{e zXYygKN)@;YS=oQvSHZeEb7}G)lv%iZMXmaIse5@my7i}!au&m*xj3~VxT*e30ACv< zadDS=s(r!uSe`cmTj|9*JSze%zxebk zpIoA}A{HrEon(gUa8ByEkAMD0P3 zq4HEk*6=+uf`)`4Umr2j+N;gtTY|yrkVq1E>W&q;z6+8^lUypgFYWUsIEv4`~l9O#;`ML`n01t0)`uWEY)Hd(idxZPfaDDwB-3@Z4;OB4S3V)D zADQS3pY*7yVgGvd%Sw%8Vfu)?=CWQR?}9P2aXHSzrC7JHyJncJ+;h$4iH-#In#5~# z&by~VE56>M*_8yUg=901DzelkF;+f<#8N>0jESod z%1yDNLdMx^a>uwYo)U-XGp;YVS3Svic%|xg!ob~&X<{WI_*ty#Z5`;VAC?}X{#pDsQ)0K0o>PzYB51OV_k8ep)FDQoM7 zrGfGx3e9I^C2|EwaxWO98xiEr{bkjb(cdnAw5Cv|bTiYdMhCINMHT#<0s6X7nb zpv*{SyoZzWl1$U4+m{R*PfGo(OF#@Jt9j2mdiFXNzrxe$Xyy(%VYtH{K7fhCBD;ju97G3@ieIwGl z#;;6%i;DbaVfrK!?h8}OW<#$!S=So%v(18ql!Y-rWcX(XEvIKsKwT@zYR+A8|1<1g zJ<(wQ=i%)O<1UDiOUd@)~hp?Z;f)NJ$X2J#P9_go)!MD z(Vg;N+9uCS%$Krt8^U=tk!6=*yVn>+9EEX2oXakqrZ%e96qXzJ%W-evCaUw-%F~TU zrLfx^G^Dt0sp3vs1gPeeT?OjGV)>5*uTPT z@Xs`heK*PrY`fP_mI@F6z$Z@zXq7X+E)XxgX~NHQZ*RT^2weeFG9YI!^`-x^xxdxc zP96Zs>GctzPs$2_YFQq(vI_sA@#e|kpv;{#N0-6Ys`s5gnW7Nou;0HlX>-Ctypdm5 zN}b>u_FN;bxPxRAcS8O{P*+oWCreovl#7gdHQg7+Ut6b&0wxLaW7aBCZTuWb0;vjA z1C#;PtEFl%_5=v7B_9JL+5E<{?AGL3dPMPX^+fqbT9v^&7ia*sPESv+xC}m>uoHq= z;`lMFn_emQUwY>e;ZwD&SGt+x< z8o@u^nZEI&`?g4@O~98+h5K#k&}+Ik_}Y{^;@eNEIv|=Wdl| zBmuQhs{&S-eFi*XS^j1V2Ps3pRxhR~=U}u>XvowZRoS}7L$N?yCyr=<+NrFW)l1=W z{c<;Jgpr;QEEqPw%uMy|7p!jXTW@LN;kAn-t6t3#>l9)U(3HPIG4*G~bs~J)VL$3m zcCaH4Vg~Qp2s91|{^{q1Lii#qz1uym5Fh}6&zudsEOi&&Eof>0H~K$pc1H%}jF}Lb z`N6!P(z0A?j{eVMI$O)1h(6<5o-LnORQsxq{?tTH=8ZprmnR4wohxB5dFVHvFEZTP zp;VeiB{f&%v}LJf8!C&EO-mi?d*z#YD=~e(XKSs#o0UBEAB-vbIq|lbXwGuYYwmimQ)A ziLKW+j9fJNSDGBcX}37-PH6Y9g)0hs0o3;LV)8|J@>{04yW0b-^5l;YZ+aN>;~i8D z7RTkm^22+!CfUDo0z~ZJeIMu8KL8woaX|LW*zzT*^Poqq;@(+2#nJ_5)wq|65uGqb) z0g+XdrZ{@M+n1%V)JXQ1XpFG&3y!YIhC`T26uW2Hm57cjL1p^F9FbQbsJ}GD%DuxX zUv}86SD);oySFo!uv0qud81seP-}Gp8OBsWEu}~Thq<$&q$qL<^fi)lp*eL31u~}Y z96gy`Yx0q>;XvAB(bfRLs~6;Ak^JKQVn55nBrjhG?D}Ae2p_L@u@RW+72eVJJRPSz z&kk{yE*bv(i^Yq4@!(N^c03t3*z^Ntw^&YN|K{&e_CIo@1F(PKOh5nt9|*;s_s<7t zXn?2+f2shhMKm&vsLhGRR1xDxl{c5RhWf#pW?4#0xrj766jPDEBnIlJuSrRjDmJ!6 zbvawh+;StArsqy+Px-A^C_fdjokyCyVr{C$kur_jOEQudn0amI?%Ijy zu?Dbnf=h`l4d5#_Vb^Eb>nj#PzugY?SM8}Dulz_bDj%}=b;dB6`FZ+$p6x?oc)c!6 z#{zNo@0Q;U``O0+Ro87`|I^X`;P=4EfB*nKe_yb@<**=vDGd-F_r!)f3WVMOo?S2g zvuM&^t@uR96qR2a$<5H3D^zJwi>=2MQ(>1(wpdOtq%oL}#pNGwv7kEW%1+V}OZ1I2 zjD|Wva3~FDh0GeS9gfl5C>}9MSE4X78w&%L(P4G!`K zi{E1Y{N&#>%RDaDcL;DKtF(0(*<4j`h*`9%pQ1%VjaG5u-?z>Q4%wdPe0W@Pf88g~ z2uK$ICFX5lQ9R+{vIo_iF4O(wP9|x0( zFVBICe!hzR!+QWg0037*{*)9q`%tiFDjuc6i}S-WTN7fbzQw}Y7)z)NK>4w?MMNv+f$f^8FjTkIbIo&pE};G@u7rf}E~(3}#G7UJ~J$1{(W4A7DKGu{BJFjNWL z8!zi=M+fP;$|=<@!n)~LO@H_KbR{7!?_>otgC8Z4|2npRyUBoQtMVuK0xqO5)rY}I zr3@Jne^v(VRg%;3TM$wJHQ!g3DO6B+)@%ap%8|wv0c>C9DhX@}{Fk-&bB&>D?!^)D zCyJJrwNI12?-UfoS*5x@uK||Ii>-0xsoJuZM$Lpa_5*m`RlYU!*crZCBw{(c{*({> zjnjSN+Ya$%7I<|D+}^KSO~>oP{K6~IH2KSiwO(mR{pnR%Kff;Zf9yoYb{5l*$Qb+Y zuzB`X@Dm&|@fQG|0tf)$4e)|kpn&7ENwMjtUrT7D3{E8`8_9qX%3jAb?Gy0ZK-K1C z(kjmbFx-MYmgCi8nUc6-MdD24k1!${_AePGZ-pg7th!FimFf_)DRogQi|uT!*Rs;l z5|7c`0d4Sz-w#;*Vs=Jzxkof(So1e8SLK6r86<1%9VwMW9H==5Ky<8Ef{+LN_m2wm zkwvk8m1?zy>nI$^w6o<0P!Fs4Nw1gR3AJFq{YI(jsS$oT>YQl8{@%Pw2C)`}nblCq&CEHI+*BtKl+CAciY^71&a=tfn zD%NX&xQm$`y3K3M?u~D<+PGk~i|241)2IijwDx|dc+(PB--h~%j=P*jgxqivD|(8r zj_TIc&;asTYw@a)wL$N7Hvp#|ZG6_39PmuAE@1th_wri!1+hMEtUPv-2#oe;%u%c%3xh3SB3FaM_}xC8)@@8nZx*h zZSAdXEP*;HEWJbx)f6o;z#A3Q6sxOSK7=|kpr#T#e+BUMr#CHFCJXe8_p^2RC57#N zxu8xdD2wR$qI~WvUd_zl^9omrV%sLu6Od>1lw9fCP}BqWH>%6AEBSP(fBhZMdWt6U z2>k)gIQX8m>HqY&wQ#_avHlEd96 zSlRA83odVkae$N}9CIv}ULv~U*6^96|N0}koH48~W5C{@@*2}`;rBttV0+_|%VXYZ z#eLNfzn*}{xMDS(D6dWxQgLidu4a=4a5kc5mo9$JY!KF(%%BsyQjR4vvOJsgAKwru z#`Cq6@E4ckub`x&j*2wFHSlQ$p7++c ztI1g-3Oq$Hw}(=uKsKUt18u>3eA0746y zyTc6e*1ma$B%m8+?onz)j>3|pvsT6SMeb>>{IedkT_n~B3dpoK2f%4qhkwNyz&43* zkRUa%$)XnMm*?Xt3gP_}vwJ0zb|e`S-qrN4%A({sRXB0s#2lSfHt*a_DE>^=gZ^pgTWUo#m1Jf}u0}ZnP?qGuc-i zH%50i-bY&4X+(6$bc&2+2h@cU8|2nRX4|wu`GS;MURCP}NTl*7xKj&=9LfL!{~8Pz zXT-y+Hycp>CaI~E{A`oTv!t@*CV96^lkFephdgvcfZCG4sIr_PdoYsmS5F-#T`Tv5 zR+pDkRfDf=LfB)ObL%Ick(OIn}SVQIrtd z*^3hqHewUK)FMPH98DXHeh^udmJrt-jjI9kW-a9Zy0(8=ctD}#b?Fj>WGW_Vs?zmK zM1!?XrQ6e$1poM7{X3S%Q4D|cul+}KU6wNxy6Uirh9t;MD}PkeZTe@ejjtLjJx^XW z^8It}%UXgjwE5G+rKm~iH=tU;?Qtzp{8Of4e?qYSy)1%}8s1sW^v)vuK{Mz?Qe&Dm zC#y$|^SABi277Wt+?z&y)`d!X)@^=e;oh&*BTPXL$NY@2_VS4fODq~=f>pnY{e$`g z5te`b|N4K2CjsEvhyv?(mNt5p)~|^(S~{*0{Q4EH!Ke7TB*4i|YzUvom^W4W52ehf zX~%!``)_p26yRP_vDq>`pw5b)eh_?yUGm>^7u3q4ik8TGpm$1bivh>>FA@)}suVp2 z^px6m2_~zv4bD7ir&@0R=wJSMuM}Sr{K;SYj~uOOTG=?;xd0RWWv$^sA#ROUc{dss zYJlL9{hu8_fZ$#v`ka)(d;lkV*?i4ukMQ@@|Arlsw;Q|N{{3J4p&VIw6wv?g51D7H z^c-yI{i+HUn?|&PlYSL+b6b9NEw0s{PPo)x9&E9HM+}S+^dHmC2HS42|6u{Jfy#sZ z0}Vg`0Pl^+j=ra~@#BREkMSH!a+?B%AN(Z(_pR$AE_S*72fz7cCIJvGsj1T|vpsKv z;nNNBUCsXuN^N9QpbeIh?9N5~l8dKIJv=??AA}6)F7X6iMUznvJ?;0~Kl;~A-rp;O z$GZK=!!5v%wfe%H^e`f=+Cr zo(95oyeYpyuJPcX{p=sh{s3nHAwa-;lWpvuMOs5fjSCkO+_CG$Fkmty`g?zql^4Bxem+Jd*h=Klw{Fb@k_1&Yhab>8R~Ls|ti6Ivo_# z19EL{zbJ)ZX|gLlO66+B&UzsY3}^t_H!9BVUqXD4G_+00f&x>3eSTr3gf7>aj|$SC zquWcztY3v_QbA77qJZkg*|e%?ZJgizq8IFZo=wzWB{;_LuQKxKRS|j~9WZ;~m4E;M zJ^{!20k#$xuf-=ye*CvvcDn)TtWCpy@*!EWlWb7#wAM}$_PL4VHjRKHN-2%*f!N8k zqvmuiyY-+umDc@PVwz*yzc;BgF_q@5hIBkrDqq2MGP7xtp6y&ElqLP?zx;Q0(=Sdi zm~%;`Qf*7ZBjC*UJfk4X0Lz$TNl@k}v*QslrgGNq{PCv;hz9qFWl0;lAGikSiia+5 zYite>tTGhOWVa==SDL14=jYD6*!%^INIbjaRXqp_Uf1<0tXDl+wE^CpPiBpVijd7q z9)Uh1KZ5#iWdCEwQ}NG^`v-tQKmY(Af-^M0h$}!Q2tWDWNe=1$Llh^5LDc<~woc6El-*V$Y zw%${sUyS$L=f~Tz*r)LJZzd<$L&6&9?rm1gDBK3Wf&J^viACwnqT0th>>r#SxCS5q zfG>~UIms0;V9R3zL8As5|JEgcW|V+xg*4f9+osE}%`udHUF};|<}|Dr-FdXPj(AZm zWD96oi!51dCv5+vNrUX)8d5tM)4GQ8pdReafyT&r?u8;I|LJ@|d zU?oS@FRgXmO@isQG(v8fSrt?iEB!NVt0P>#t;NyU!1wtw?8^XU7q?cWB<+&k1iEJ~IXD+GVu zg(;w%z7zZRvU8V>(~9UqY&ll@a9;91{>wlATmR`FuMu0;k02|s?Qr-_ru@8aJ_VM# zy2R`RGQik+n@8 zV{t?+$#QSCxw={GwyY|X*{>j!M$vuAKmYV!{JAbj?FcPhK}rv}i$%3MKb|7|r~l&5 z{`PA?m|nbpU-=t$AG4tsjp%>AOpt%VYm#mi8;Aab-)+YBMqrdO zGD5RlIZ10Xfl^4wr-i$~vx3WJGuU3Feuf^i&_ zgVl^4R?QVlPfHNJi&ctLZ>`(^7k`m<#?Wd0m%q?eu%H@Vx~AZ1n_Sy6yE0IC!rNw7 zP=ArqVgH5!k52X-r~c-rY}r^{>ua?9suBDamJK@0h9Ty8x7sdC|35ciGvk9 z!?W8Ouf}gZ*He#j$^fZH!scdM%w6DxNys&bTIKKrIgo)CS&3prG~Mj7f5-68SyIrl zHowo?KzV1hbWH3&rM4kIejQFcjJ7g+Y%OH-N`9ui|L~vx+28r=e=KHv)N<|-EoZ7g zHm}EENJZpX0X3syiT2v%5v4|Q5u~SyON%))@$H@p1oEmbkE`nhXxE$DUjC~VVfA8x zl+IBtDRDR^x4YI)@d7LjX6#>W&R%L`-zfGK@~OYmW(UtQ{Db`iZv_Yd;KOl7IMD8r zLramNp)9&~tgh;Z*UQn=O03zewX#nxR#7^hBpme0KT0_?O!!U%JX0Vgh&o5v{#)f! zEuAQlQsaY{#10&{qDBLHI!yny+WyL4d5T7Dc&C+pQHYt!TteY5D);s=i>|w zz~k(v3TJ6U8IV)fvkx*brv%Ds_w6d^Y$OIE=Bn7THQzQ7mCECY+&0|D^ob@?x}N)- zrC%NSskFqBOI}OQ>fgv5XoG+7Ps^-d_vW@#0WbOhkpIi5snMS(zE!ek$6MKt0Kl z=Sjv{(%Bo=;G^{|lj4sve$KtMn33)alGf^oPzF*^ghao0%0Mp{8}aX~6=FtLL)?N> zV{#%`p-6l^h}W0Toi`t#9Aqnl4mce6GcVHTn=~7%6J6#O>;3@yZ+r=6xHy7;fF}b2 z0Qe$oGT7fwmH|G08Zx90hyJrHf=IRNS^QeY2z`xaW~bu`zEL^WPU|H$#ICPBZZlWG z*uP_!EZO?n;NG>hH*VuU_^1EY?FhTZ)2$cBW82t}a8!#|Ha9WnKmLb*{%3#pZ~SGi zIPp)p7N6^TOV}pz*?1CGM_-u|U}t@}HgZ*hdnjA%3*8lM3LPm-Ke*+`4v-%1!{xYb zP&s@VQ)d{5q&YZKIJ=Mq>|>%P=CZa<80H75e^n_bQU8P3Kd3+O5?~b|;JvZU?!IXO zpSkRjRldE7WzD6+2jZ$#ML8og=>CU)WU5<_|Ir`)&UmLo&C7V=*~=N3YiuvoSoz1s zt|(i3+=gD69rmwUJLC-*H~dG(M@;@M(uMqY|I@$SQ)uUj^`gy#zWP+@jv6%apFhRbUWk8U$G(c=+cbnSa?)*4s&-PjN8erO1)qa>UAN-5I_ycQC zP4oZ#_v!FjP>NJaFP9VaZ;yz%0X5yy>hRJ8ue3H_j{<~#RD@N(s0sETMH#{N54;25 z0RX-c=gkb}RSZZ4pZ%u-SemZoQr4T|Z+r84ZEJZ;g8CveurMVK^sQTtIU*DHN_7m| z&3Z?65aT?`-`$L5Xi1I+b&0x5@V^C-YJGJ{PxpgvbNvG%CDhA98j8vD@$!2L zczIyU9_r~k?S4$$@zVAsLl%n$@X`>5K>{( zydtjWzx$_u=6j;r8-b~lCYMdC?5$CSX47B6=hDgl{-6EX|2EAAt`=-zIF&_Nn$BBe zTGE>_vN$V*wv?Wo?AuxxR5z&;{crZ=Wr>BUn`abe^1zY8eOWrK~Pw_oExAdP9u>a4H}GfOo}F#QjunKwVK}{nq~qm*$kY zWD(`Bo-t7x1VfYUuV3Sp%e=HK3C{*8lt%KCLTdKZCgt<*v0O ze^{sH1CeR79*ZVXB-+KwE=B#f|K#7;dmDD!<6*XC2OfsV>^{L*?rb5ROoT}D{`ddv z-~R9Z*MFH&Y@*Ohy!@xD7)?)_U={C5ZsQujOc-b`4622w{n_T+(IvNM7^_U4U=XUo zMN>FcS+)LEC+dJQ`@q8J~db3WITdFdX`C(%0I9d60&^=++1;sXVdF zZus@98!;a(&$>>0Z6ad&LR*&qxSGZLTMJ9}e;dgm!=_WZ)TM4^shbp0uGii28<_NY zc~E|(G7+oYFNwE2tCzLyWAQ*X5U5Fp{dxyxQ&>^M{%9Ky>LNfTlURVCtr1ke9&Hay z3Pf~!D9y!oy#y@o$T=I=molG0{X4hjehI@rJPE)yKmY)5i8ILh6D9^wMeD!Mscobs z(=kHIFz<{&;etOyQ8BiK#y%R?)@$uhy`Jsgo9!x&)K!v91K0dsMfp^q81nRJzmas< z^>=g*C@JE|2xZZC>dh;?iUgS&=kCf;CHKh-m%BgLE1>urlgn?U-7Q$BGJ#2L<2`kX zn;_(2cK>0{wS$ChfguTd>u=ThiDb)r7SuybecC{->+EK4xDj^o{=;K_T=wsJDxL$d ze_%5p0D$+ydBpkHi2>b04y{g*g@+UqOP#J%EbYZ}a8t(t?KUo+5k&|xY3-Db8VRKE>Z3AQ)O6%TSUCjN_{(tko z|KI%Om|*7F8rHm>TxCJ;ctYI}eD)M^4bWoMo@#PBGIj#+0v7)Pa4tr5zW?{A6M$!y z-T>wVXtHhQ3*a+>_{#l!vaTbFQ>tE6%%G_7x%FP7{$bR=9vjmD$MSWse_#(F007{X zK|#F6+3GwRbXbEGm(2^{Y$={w&^a;FBB6QtO@Bfw_{XvLtGE??R-gd#(&Nv%N2Q9OY*?jUwcEc+eY;NdN2@L(c{$C04nfo zWHLZQ1GN6O?uL53Lo)$nGomxiYh>A(J{V%Ir6}{-Ryjb*V5i+ZnkjPtvmd`w58-Rr z2O@ufs{sN4cr!eilpk1Qx0qa=jj`yKd`Oakwz1NvXAbF{#LI;~;56u{JFwxWYwXs) zX9B2#&54;VN~vn$ZZWcax0TUsZ^qVimX3p{AqgmfI4ozX=9E6Qv*Pq2T8jIV`mA@=4wOkFd1)AYmTzH(f^OM{*TkgZf@uH_*FPzD7_qZl6NQx#8Ra9 z+wH&kC;#^U@Sm+~0hPX8+^edYU1lR!i&yQA8=y*PFA6lXGk_92qfUTcv9@j8LE&;^ zuZj-ewtFNO=SRu4x`~4B9nlZGRUs$t7E?mOn$b0FD*V`XAlM6RqA|mUe}CB`kagga zfB*o1XLtiP)A*>~E%84=NcVb*{i#f)rj&MTZN^?xZRGm2Y#?GCNCk)V*bR(*)3j{& zz!810QsqWqk5B65507$}S;F0x*PM<t!XZ~!#tC} zeN_GVCzR4I3bgnkSgnUA7Amt&0C94_VBaOGO)Gfxyox7+J!#^d;3j(gDk%ee(-z)r ze)_j#%^x)957F*^s-EG0e;Zz2Ch(nr007kiMt!)q6}a_0Lg* zee>*~TJY7BTF+kU0?p~~k3Ba!_c!HS*1b8*;j&t2DWcnL!<^pHCtk8ss6SN)_77Yf z5C8!19%;PPX4*uz7w3;Da15_f^C-GuFxgJG; z^Nk2E&1}#+R-0|FQ?Rc^Sw-3*P;zu?CH`ou46N+d7$4DDk90bweZNKBdPkj8^W<=eLO?_Y@?+{b1D;`Y8t*Hj#Q)V_sV(@Xde#0Nw+y zUo(Gae2&J%<@Bd!vNXdBfVx!GIh8A6eC|F;ow|^b99$kmgu6!n=YK|55c1Ir{U3__ zaamMdEM{y8RKoxL|M_oZ@@kEg$451io@VT?0_0~^zqur2E5L|$^5g%_|MYMEkN??U z={%fTROH@tBW=85hBN@F1?B`$X&OJB(%5o9gK;}dEe)icf2Ydp@Sxx}USGu^$z1i< zeOcq?2Tkd<=+VShNOaaI+A|FxYM~EMf8c8X0RRAd^~MuS^5boILNhE=CrQvBraEi? zZ*EglD)3V#erh1}e*_)dzZk+L-`%zebUE$>a>z7cu~B?~I}M$o`pOhi)w6}M2|>4n z7h*I(sU}(#reg^2@50er71aDZYIUG67C-6)zYz8WIl5)0rJht6&!`#`rkyHtq#I^v z@xUVeyQx3eKk#0F004l)FsuXyDCaDR=Ry0^Vqh-?E?#^YGu$t~ZCSr>ivI6i%kV5= zz2^OBv!^3}8Uwt0`x^K35jf)=j?$Z!*aAn===h&n>+J4GZsK*8!K}%jZ(QZpDNp*Y zyl$oOo&Y0%*CXES--)$=2H`J_I+NYIQ__LwmOmh!2E&kM3GrOC&&8-e*gtS8AOHa1 zc%1DMr~yA48#CUj%C={9LNsta(MvKA_0(uh4wq;KmK+xMA2mT}xj+x}i?Ny5e_O<> zEeUMYhi>*G*2dJ(3fFQ>;E8pP#R82_2)^0bz+=mR2A&7v=cBpKLS@oUlN#`MQHTj> zjssgnh|ct7PO|w8?vZz;{$T&W*?<550F47#`xT;t2%U{`b`~BQ?D^p}uJf;|cH3&Yir(GkJOH5B3i{ z0T2KHa5`w6#Fxo{=8~qHoCDjrtkaU<@A(o3LP?a$R}aYT-k1YZ|?8>?1IQC;ob#5*j+E_Ga2(k5jeVgHa)ZrNuWDq6-6bH1aD0e!+16%or zj`NvW%`)YW2wh&XUnbtNC{X?Bt%Sn@ff^)xfPZ%i8H)l6-^lSTfy0#P>RHwO`{ag# zt-U6M*ZA`@n9M#!n`8C2WqUF&2m1$}3O19bXzilrIH+zqoaJor?Hf3xybu1Rhqm?uZcCYK8(~S9r z|NZ!+K_pMjp@)o=t)E{^WAOHa1a(K$F zUR!3kPNB8y6Q!9bZ#@2|!}wS8f7_Be(2{7wFA-{@sM2&C(X8SBj0LPz;lXY7C-@d4 zt{)##THAXH+_gdT(T0)UMj7>H0!;8@@+XM)cqupS2<9f<&Jw%r@z(&Qn>SnE)Y3gc z3H84la&OD_5>gKK54;Kx003|>wvn*=ZZU9$l}07}_6TcYO-YvHUr%Vm4DTBEpYT*} zjF2Cr;+nDlPk-~T{@4HLf9^HrskdG+m1U`O*{LDvjBMNO@BPic+AFZ8Kt#DQMfcmUq4<*d$DomAijhQf31%1J zDG3CDb6TQ;Q#QhF$sEJ(>=)*%h^R5T?Cx#=tO6Saq^ojp8I z#=h*LF-H}3k%|DI0SEv9cu%nD!;guQdlo0XT@&&8Kds@DI};q8&|Cep(FPw*Jkrp; zXs3CsS7;W|*LQjLrVp+;J1YZ%0CCGrIT~?9QB74Sm6@zz9K2jxYxHu;dY~I;1&pl) zbR@hxHRfTMj6U+G0R#*CjFjW0ABzWLB@L$>YSPmH_77YH5C8yhU3hCj_Ty?&vUy2x zg$SY}+u$+{7IY*lURST_71{QF)PiQq>7BigOx5+v+UFwJL00$_(pp}#Z9OkR-nols z@U7tO<=`VHKs@8(K*q-Fu)=8>n9R%EfZN-!OhxbyuiK-ebkdQ=B;eAXK`igi#lil8 z>i_}(06q}XT*t}Q%UQmi0sNdMb!u@Zsp{YNfptIkwxpi@dw=t<{MY~3P6J3SxgRI| znyrzgHRkeqryj@u-rxKy@<=nzC-mNgX!rr#N?S$MaQ%Ixzmrw4d1;A1%U9sHqo@u! zQQ?3FG*<1s_al|>|2Tf1;Yb{NuS1^FwpV5;ibBtZWSv6Dri{orC{#wJvPX-gWMz-r zh-4h09Qz=f99f6socntp&)4Ta`2P65f2iX==UR{Jv98Cuu!C1d|L{BcQWyYBT03YH zDCCD_dbT$M{yOa>v>jt#nWAw@eaAhWjETV=;1E|n+0+j5_zoAo7xecV6i}}|OnsO< za;_npJhG~Ir$^Vby0n$)Oz?Qh{=$DTH1g;R{Yqm%6paP|TdtX2=PypJO_(|J{Co1= z2@1gNi^mC?#j$U3=blU}pi?sD`g*6z^9bY*Z{$zdxN#|EN|`NxE+tSt9-Uq1h^(#)MSBBP4f}9McvZe z%O6f;I2OigaZMk(0)3i2qNXMRB?_M}f*yajpm4fY@pMEbXEpb1L4P(|8wO^SKcwPz zLI{7Ymfq!DDxai$Ke?`@*rZi>-6#&{{(Puw)JTimcD-0FW1^dR_VKBe+S1;>$8vcF z96yqVyV0Os?)!Y4(y{L9<+8XScMr4lkL8Hu3*Qg6 zPAd|veY4T1FP$4-s$>=21`W8OV*+D@4Kz`;!A@CqAoKO!!JpV@rjB*1aBc90YQQTu zKmoM&a+TKc+Wz~rls<(8h*-ltynwA>|Ik2xgOlOcajVjXa3vK4UZ3fbxJ5t{APeR^ zQz1MebWr|F;`!5&!^@i{JEUJ5A0B0Z2gR)W(j3paQel67xtqQZpYM=#?=>_-7W zYcCb{tV>K{*IGt}e@)qjVSf4fnpMLM)&x?jrlj)(L|J? zI3@K%!nLnt0(;v16Q4-W1HO7yHk$eVd{kh*El}`F8lKA@_!vzQZJIfJXawf45`C9t z9?^nThV+Z6GqVwIM8om?fUpws2z; zlBUm!17iuI1?cT05f&bON^PwzikcOJ=%SJvWP>6HkRI-hVUfF}X!@wMNnXU%2XRXM z_7LPd@y#IUT0P2r1B zi-MKPf=Eqn`j(^()5&pcT?Ik8!=hw>l6v(B`&62?Z^0^Is~XCuGy0)*9FycyJ_qdt zGH*3^A?req%MKZB9hOqQ&0MY*{C z-UluH^)An7KgS_cY;=aC5dzwJ~q@iH+;-+EW3_w$`Kl`f-Ey*SHp&8Q0Zcc7{j>*+&Ko zb|2|_igwp7pJ}xJ_LJj}*%^rQaOyDygY?@jpXo52S^)4~)hNGouDqMvYVT+JmDp6H zU=}2$QQkljbt5)s3akuYeX5v4 z&bqDb4`2HkmoZB1wk~kiwta?HNQM++EUI4iD!SY|qaj8+v4Wsj6Ja!bJh7C{@tHDJ z12!~{I4uQ($J=wneQE1V%py`u_pT8Q15gt%Kg?!s6eFIXaJPAMf4ZXRh*u-TvXU_u_2V~&A zNBO2oyI%asvCrn)0!Dy&SuUbr2_19{y~OD{F`2#j+&m2;H3WZgWpDg_Z|PK+r+eao zMrz1ac*d(Nar*gHpGe`r^23zM^()iCijB9FacsAp?!0m9Sw0vLAeb~HvOR`>x%G`U zq>O`B1NL0GH7JXz_?)xT3DI>W3y#TH0r*`-}PF#5i|gO!)KSN1b&r`DZ}z^_^`H z1GbZYVh7vVX@RXMnd!6bDZ`2`u1_bunto!Ashp44Z3$ z@Vv&eb^xn{uJ(W~y)-IHV|ZILR>`z15}xeu`JU9IlHnJ;S%4&xzLN4K;4MA2nCq_S z!a#&BEXF@f$ZxpwZ0GhxttD;nR+y<)r(>~8iRTDfXOJqn0pGNJs9O_Ccp31N1F#5L z;Opf9ys<&>veJI2YRs&DYWvc&S6cAE;zX_&dzos#(6CHvGctoT6#r-^c>m2#sO0n# zf`{$VUWce!oNZj}<-Gu?iI9fnis)yR*rQ1j?d5#U`KN6?uIW!DcW>o!pMye>Hy4gi zsF;l9HT73%FS~`BY^{A?=91(FeBf|SfHJA1W-0wmzud8fJQ|O@7XKKT`bW$_*!dDl zQd?2uE7jxCZ|ywtpP!yiQ0r+3J_B-OhKI=>>i74F!RWj{3PTYEixHy580R?)vyn={ z+Q>J7Uk8UW$4_!|(pEz7w;8>E(kVx6mG>>gnf$RF@OjcG=?ta$Zmf-6j9HDB7Ofl2 zy*gaPDGJo=%En49{eQ`^KJ=EFp9l0`cF;p?Or^hvV&d;0xx~@}X^6~i$&95E341D(5PnT>{@`-Phr5*>R^Rd`$P)nYgve5YTuKPfT=2Xm)@?e|)Th{ct#D~< zDc=tni&P=A>RU0QKSu95ly=W}6zi@3@osC*D_SQ+aco}*oH6Cv){Y8Jh7fp3mb@P3 zEe?!*Iza!)CKlQ3|6sG7ZredZ&u+GODS%p@cA5GT6?T7v-Zgm+N$;ozE*~qVFT0WN z1kX#TsG%yH=GepYY-*N6?ri5u0Q#ITqw+a!Z?Kr&c!K9JRm*5Q`{^Aq&K)xUSLs{C zhj%=sh#_~TL_g}u7SnzLPbh9PS8LQVPG&GG>k372AignSXEU4v%_ zhJ|j-giXxfI9_)<7de)&NH%WqeZ0ISj_17Ks=WB%dfo4e?_otY>t}~KW{RNktjOG( zZ=xbfG7kPdxcu;+oe}DQ6+4iNk_bn5M=E$Hte4Keex#uZE?TM=JHIe32@d%sGdGn?}?Vgq8X?hhR$yPMeD?7&f2g|376>EK-5l^+;@qC803BGFE|0LE!YSGES z>CbY_7D088jr)pb;2n)lzqyRuay5$T2NbcBMHQLh8IBRy#iFJTSzi;B?pngypXs2l3E^>TgI6vLM^+&PC@ zwEOO+nzk%-^wEf>(5v8-#4;$)$t;oKT{Y>F0?7sIUZGtlQ7==C$Hp~x7ExoI_W^`= zlma_aDh7*C4pH3T6Zbce6>q&iA!$Xa{k!d$KZ`-ev7d-*MUG52h6kKR*B(N^3HJIIcRx~ zm`Gc0PKib~(+xBq#GD#GkYUM&(d{^l-?rU;`}-Jwlhb10);&Zxga z%H*CueANSGiU=Fad6Fb`U(S5-cfu9D$7a<0GOuK7D%#7ZT@WXB@B!1mIdvsO4eV<$ zagTNaTe?Hn>#=0JK0|t1MqzohLS%K+qqqS=ZhD40v^)m6&whCp_v&-2<;YCvpMYg& zX6GAzpp*q=dHr#BIwnc!453;?6I%vW7-%)pf~Py2**Gk36~`Ps)4|PoV*tl_TaccGWj>5uLA~~}X^GnpJ*44s z&&NqDO^@iIXh)AMc>g#96tdth>ir7A-TXts-IFX6i(7EQk+a%w0o9V0Z}g7tzbA(E zNz=9;GLS{xDl_^OY)}{TCJ$O56Y7<{MrBrt8V^39qtqqa9O~mZ;V`acP8c|3o_+a= zf_8)T2|cR5+5(*tl(8XB+_}Z09D|2T5(BQFK9=51!nooLPGb80Hogee(6y2+Nx818 z^B%geIEIxJhvqVeC3kui?*>j3AP26}E}RSWvqt6;|F(*xgaH&Tn2RjOC21jknP%CJ zFuqAAKSmz^&cUm|oen6Vk)5}Qq5l-MUB;AJ(=mzA6RzZo$j@aLy;2{ppqn7$4T3F| zl)XjJZrw4Ef_n2RQl@rH%%4O2M!FpkXoE^5A}H^&Xq{8uas6IQ!5H$k&-fBL68-)$ zc%kUtRPz({`171ztNj~!?{oso^z3LgLX2wp1U1DMYTZ0P@&bxV772TvF-SsMx|@O2 z+T=s6o<^GOf4Ol*D-$QW5i)4_2tzfec1{kZ0|M(F2|I3GXe}oVAD>%ZCktVn6EWYVw0vlqIF z*hQZd_y)I1@qj-W^5+^xHaDq_CeN0RG>pRKnxHPDAcMm+mxMjqQqhE8*}?$j5{Lo- zi605q65>`G_t&^6cRwqC>YfeG9nBATJ6yN#N%^5!@R@!H1NbD@l#fz>G?6=da!7vo z^>exBbF?^cf5lj4_Qt^`sFz&7e=Rd@@d+iXb51kL>PvuF?nPCLbB>5^y+xb~0w`nY zj^ud!qPFv?3AqV1>uzkuVVT0Z1QVIJC(DYmtiM-u@)UOZ>E5^>|H0kiZ%{`|DI?6f z5yCne)ygI5j%&`YZ{1gzk=ekh2W|J=-!ky}U9;uzJ@4$bqfXt{&xa2R!ywZxn{G*OWP#7z;mO-#z!Tr`0n!6x}8~mOn|2C-qC%T(Qd@}!*Jo|6IOtQZnAwe2V;gX znc!{F__uVewyiFt2GL4p>Ii+g!n~fO-FKQXn4kjD&$fTj)mK;DV#^(C96qsupx|Ld z_fANX=r8}`55?nq4=>v`aVS0A4=3yY!P~{U6Q5GDx=vVN(%+(uMSF&uR1#^R-)myl z#rIIn(wO3g{&%K{&ARb4G&RepxBo*BZLTgA0QSK#dO!si?YKdjm6NV=klgRNzhiuI zQ?6%j%LS#9L}T(fuh0%gEA;PAoydM5b?oK0uF*F}zvjG;K!n98VCXyFoOABcnPTYL z4!Nl$gAvU$f0b(C_KEOIWBSM{bXzK<69NE99+rG^`@P^|9q-=Z)3@mNWZcKdwpq)# zq*WaMG59p9Sp_`$eW^)SOsNv@dWjNF50Hw;_%zsU78xk(VNp9Lo8=`kRSapw-#b`V zOU!W6(U)sYh63LWj)(%ZLo6P!s-%7-?w<`u%Pz^C?TZ2}@fsPx-(34Q_9^DuJ)B1+wCFiPV&pah`vqsoF1I6rpGnw zG=*e}$*ASWw4lOYst!QKAp=?1#roxsdupyn9@X7I{pDJP++QH?@1-J$uxfnx-iq_l z3-3Y#*lxa4`%V@TmPMmX04#ARgCswGe7)zVh;d0hl~Kw*LUsRgElb z17koT;+~m{Bmlq!u_ak&#%7ixr>bb+;r>!94zZ{YC-py@|SQQ`{h=a@ z6@7nUoAg+Du)9s^plVR@zoujDS3h`aBLWt&!&SFu?hhnwav6ZxF8J?4g$)uQsmwY( z(bx@`lPnaoIEA0ad4o5j4Xsk+Eg?R)?L!-5+PaJOvu48qE?)6Wt2x}*>zgIRDmk~% z@OB?$ZO?;5db>sOO>C=h>vm(n8E(cAI z1_6Bz_*9lV&LNJMHZms;ahMZ-M0xrmog{U{D27;Y@Md0R$lJ-iWCawQwQ@o}`(OT= zF5RaE9#8Y>J(8yxo1#pM8<4;QwV{B*t@{0go=k7e_M?*l%5Ww*4g>RwioK$Vby98X zhs^@CHxc26zU}?!>um~dfSU}@dRxt5{56b+|DFRIst0zAGc!<+#hYUrLfknJ>toI| z+~EAer45IVRIkjS*X>~&7H#or(DKfA1Z?|N;t-`7);!2-(dapj7@Tuy-#j#sP@sHS zO4_vE+q`hfJ`T^Z8S}}jh_DgB6=Qla7h|U7bZc2aV>{y(wXCvUXhJyVcW2rG?&Bt8 z)atbjgLJ0S5t1fUKQ|)|j7q`!j?X{#D(4nQZSc)%$QSsX$QPjVbvdgHGut)4@flqey`3P=G>K$>Ze+5XN&6nrZQC)h zts8naln<;LP@jU5tQ?I|4+>|OYJBP?E5!Vf3#I;X*+p%@r@QgVJQUlTA*P0bH>qGl zWhKIegf0|wcrZoH>1y6izvXhKP+Tvo4OMW@_%>rm+<5F*TYCL8hCRyLh{t z3rdS%CftD9e}`x?#kuSHbq6+b7j#z*0ND5r2fsVjd_N+XWqZuO$Ws6>XB{0n?2wJn zFz1MIVe1foVI)>~mLt|F_!^lMj!pLZ^ruOGJxgV0rgc3g8*(Xx=*o)(rOEsw6HiI6 zQrM>nKr;JDB0%{nI?&F<5L0MkoFuvQ6`3OE_S-88g;l$wwC{|x zLKip@@vCX_x^8=ldtkh`W*N?AZ{MPIl5*E49d^wNkN_Dnj5seqm`PkpriVP)!U04D zmI-v!cRx{Fr(CVca(=}VAubM@WA-F(@06i3F|(f2Q+uRcN|fB9Mif!$bBIJ$^sq{B z$R>qNcv$W|^n5A=wLaFu{N&=6$=H;%HBC?$h)ulpw#Nkp7ep>&jbMJl<5nPf zsYW2%trh1rppWIfLOq40R0(=jvnq*Y=c19(;C^MFC~5M;+O>As?CKzb15dgWjUYv@ zmug}Lo`%Nal_2kj5CXtUD8cMWAEcFbs6Tu+M~1E~z9MyO4?EX|er`aSOy6WvJM+8G zH~2dmB#{JSz8i!ncTc+e7TAeYUQa0OY9`W84?vzc`j{nCctf%NXcBGBZkm$|SY{7` zD@nF;qV8lapz+gdsAIv96R`l7P43J0yw}Ks@0dXaN82H$PU&>H>{P4>`Ske3+JIlD zDlU-7IB9XMA?-T3>0A;sjsMs;9hrOOaK3t5Ss`Sh4jI`2S-Tci`N-y%wl`Bp;;XjJ ziLZDgM#6wQPK_kWQEZ_WNxB{H_xzv^i@W= zozTIj<3J}aRl7vXV~(0-1H zb>>bN_d(v~{?iBi8p5CTKl3K?AfjBVfXFB2^U=ugo!eiK&daW6DG@6k%kDAclC~3g z5$ffFEF7WQNK~MI+V=b;_=!N;_y@d*2;DUynxzBm7^EI-TKXZRB!}Ym+oQ%$c0zS@ zKfnD)Fd}SV@(ZrXWU^q`hyhpLh1KLY=5aa07$qM-ONhk`fx%03@)Yr|xZ&Tm)&s}+ z_N+Y=$Adz=qyJ=0Bz$FyyUH*bMjm>1>vX7oW5sMT7?mCp1aZ&TH&G#}#d^M-CW|(K z-u#%d!2xGTiG%{f;1xTBD;&Yx#mjUv%VOD(o&%!`+v0e=d)bHarkF)5@4AO+GoVTq$dpwgdIKzv!7*Ofask7h8AoLJaIt2(z9nin z-iJ+64%H%woZJsJD82F;O`3dem_6DXthAn`xnmH=NXXO;n97>$fG$j|lmdXqZZN_R zQsD^{SMDWqAgOO-KRQqtqjw4=*yESQH9c2>G=GXHGQ!WC1CjK%FFc4;M|iCiJ&!M~+TzsB@{r?KK|NDD#>I z-n6-*tgnkTeZOraf_bFWT9f2+5}3@3n}6%g+rr!?PpE7VELx^DxN<}|YV5zTjkb6> zI8GK0J-u#VIV*yL{&-NzLCI>=-;Y3(B-W(P22(=*^t+%bfIFx!7HLOvEOud^^ zlnzyJiC#wXMW*$mtde;O!R(l9Zy2~U14TC&d5h2#7fu|td-iaMPGU!PdT4(sYWY+^mlDUfH{833 z+^9sxKZWlu2YGXGRIbI+wfg(NPJO&>wb5<~9XuAMMqkDa^Y8SYsg^wRJS1X}bf1C) zw8U9dBX2+qypeXptrOCNFND*Q8~cbz%@5en;~~93(4QMFip2yCwNDcGk9WA`ynqR& z_kF!toX+CT_cBO>G1BswfsDKc)*>idEC^my>KqhX8o4rfDek;~e_oMcxm*sqqVY|` z;81!<8W;I9dVe#qa}GEAqEg~sj)nsRpbvecZ(2gCT+qm4seTDqQybzB>^Y~uudovZ zin01U%!d48ey*RaURi$JFtaWuA4DWfO zEU9B1WK^Uo>UA<}RWD`RTX_d3xkf;27^E&>57KqY#DD-e;|~~Z;V4w+buCe#@M4wl z^#(GMu0G+}Mo!@VXyU||40?rRS6fy=pn}*>UewSmuU6FdV*{OsE?kg^Go&$DK*7PT zA<7Nbx~xtr4pd6w_N+~df%Lb3OaqhHwBwdp&Zlogb1tI=};QxYM@-axyLr2Za98IZ};`n`%u3bV( z7ecbsmVNddIP|NUv$rce;LhikhPM!JBBA;TBMJ(1f!ePx*1uqW>j8jdHkKn^`ZDVM zSHr+_7@viwN1RRhJ-UIC7TQCf>^F9Z=x@XmiO?10C;qnoEGmG)qXB1Rx>xg{n@y1N zb%WL-0^K^f#dX$z!@oP^f2J7*GCbhYJom(mq`dXgUS3_=3KY)dV5P75Nk`K zJqAs5i&xCgDm%DlX41?9CTS{CA9g0d&aKdc1!erMv*n};MY{w5u9`Iw+ zy^M)H7=EIhIAy=OIone@M={J68zu0~6Vx}xNFhG6(B)33TLKJZZFc7UW6lO{DnzS4 z2a61qdGu{jrwWJxDK2fqV0oo~Kg!FC^yKTM3++*BqbIy$CgGt@X|mj-bE8r3Me?Tq zoYB;t)dF-`%xZID3qG}ox26Nt>fq8hVE2`n{@6+t291T zNqX3mI*)D+7v47yRc6i-%J&A(i}gX;*9~-Fhv)4L11lu}AOWnMvXJQ>awi68b>Fli z#_t(aK*itQbFPZ*l2ES@Hfc-kTz?31*&v<8+Sp;mLI5BNzLH zLu+anzwjo9Q<~Ha&-s@>K#c^PLZAOm{85n|X9^ZqUDwM#w7yrLua!4PDwbfdOb}W( z&|REy-5~7uZYgsBeAEpAU@SiW6Z@b;_~e>lHddUn@!Tg{;XAQg)~AMF>m*M_X9aJ7 zD)W2|l-dWeT{m!?t3R@a`+%bP!A-%_sPJo&JAUGnlySpJ&mlR~zGyIJ&v^5VNq^_I zG48X}oZAHUtxO6d+7j}Nf>4ZyrU{2@Ol1INY;(Nr0Jet=|gY2|Pqkm|*0JG84GzDSzUw z94{mQG%Xeo9={=O{HnG>as4b}ZgPwpTKKTdHYai;6i;Yb7~(vIwKAFaeD5Q49^J1x zzFwa?4h6tQ&&!K##Cd=SN3;P!dI9J6g#CM@JFzL;tN#f?jyt?XH@xAsxV(jPjkt#D zrxT;~&Y9rP_pp})vi60HZgCxv1njY_llJx{isxb)w$$V+QtC6p*bdRlccR(}e9KSm zp>Y#CUovBk+Wod3v6$ZXva+)3*s{Ts?JO4>41wkN9qqSkRzM>PU>W+UZHb7RHoozg z3cV4b!tJ
ZDc#Du@8p#OBeGMria7UD{TIP)MOGW0ii z5eE;>3h1IpsDXm+xIQ5IJg2k|TM*xg+;$@4)rp~I!&C2$@l#bJ5IJ{%IfI9r%WvUe zE64=H2>dsKfdX>@n5PsxNEBu}egc)w&#gATSIZ7_pF8}MDgGSS{RehF`$0d;#@gqa zvk?ioOsngV(NshP3VgxZdT$Mh3R1P=Cq$H!AxQ{NE)g*AwX1chHiC~~8Zn4O=SFrP zWqb9$bjRdBB|-H``2Eu}=`j!|94)FBA>J(w;8{NZq^42BY|U;U!&c9Vczug|W_ggV zse^`%1(Bknt4KB1j>M^X$ybBt>UUyWSD1$_q0e|IoAMv&fkGL8TaB)xKXD-HBc$hO z3NmA|QO@8^c}ji&U`ds3ZYljBwqnnEy&xUx_=bbA)|CY{eLdj= zYMJJhd%AuBQp~~s*p5Y~Ni!&WH~Ye%^N-Af)$;varaW(%F5*nmbtrBb*hc^;{=16~ zKrZ$J^kmi#_|3or(&P}I4@Ih66ewV(bW8*Q4H zX?>9QKFP3fg3`oMa7CmnfYspH)$EqW^@c5$y zfvDH_a#HVTmD$gnjY~bWp_B+oTqHCx861Gltt#Yd-AM^JG>=6nfsGni>Ox%?N_tRX z^Q}*IMgj4S6Zp{xA7C-&DF3?Mv5G;xrW+oT(Ln!f#8BkhaC8CcIqB>GtNsJ*=`$z# zVtqp9pA$>$5DIO?0wa70zgEJd`T$ad}9%W@rzz!ku6fwyij=jlLhza+q^^U`esC3cClD2U-X`~f{_L=TKkJV8B z3oR}ZC;Hp)vAz9wICFU~S%6PX0kv@)&25P+d*cA@*z%j0bg-yX;YYv9&cz)b511!3 zu$Ib`v@axPqXrX{dKkZtUSov6!qH*Rwg#r`U%giYedvQ=QDo_yJpxd3b|G^IDftc& zHnMEyC~9DZ(zU^)zd;9JcF1-0&AoTjHdMc2i{L;=rou%iasXoRjrBVy)8fd`ooh&7 z8Lrt1(1fuR6NJ#P#2aP{e0b*kPCOfJXu%<=i1Faid3=|H+sScg|NAa=O2~V{rt|>OT4b%V>y(m z>E}_SZ0&Wcz5QXq^Mu#q^((I`(x#xuyT{fF?LH_2RAUwhmU{p=z=X$R{~d%C$ms-L zfv=3`3bmN6|0?RJle$KN^VVN6>5XBgpL~gw%N(2U#8JR9D_)c)8S6@P*c>7qzjaOQ zNji}0M(qDiy!Zl)6?IkrEhpdLXWJO(v3$A)vhE{9F{;O+oj++V?d{HIzYm8(?S?LE zn-lXkDhi0&*g|7qNFVOS{dB$Pl! z9}2!QKf^K1L5hYjb@aOte{v`Za`&b1Q+2Jtarm-0Q^TL4m#TjJG58i{o)H{sd^W^A z^x!gK-@3tpMFqwWb;u#k)8UgIKn-94fYb*p4TL>H_=tfSz)UsLULF;2Fg&u^(02W4 z05tRW?a?n%-HqqpLe#Fxz3YKEfpzsDhbBlp4Gnm+0x4+cu-#t#+6X_>xxGHHZm8-E zw)DjFqS9g^&*|0s>^_R?$78EJJ)ZTH>&OT@7?AAYxY| zd6E#-&%qxzK#ha%SDk|}5<};=EpE;DN5*ShfE|)JT^QQZEILl5(A)p;gSqGmamw8S zV(rITtLb;m#INjrU-F+Z^}gy4Q9tXS@|Id73|v8gbe8&Dw@>)MtrvdCt5$HXcKYI8 zvT-#};2!FY@+1$jrIcqB&N=;Y-Bg-+AK^ZudKz;7yXaoF7Z}|=mhROzL_Iky<2>+Z zZ%_)C)@6>xqdV^M4XIr7nLp zF^v$I4QmuQGfuxifCUNcdSR(h?18UO8lkwVkWo%x!0A#4O!{$$4ZO1D-dinK?Tn<; zjaQClUi@JuB7R(TTHyvHGXPK@uy*>hKk}64V>K}QFl8qun{kQBVG8~W(&?(pR^urm zw0SmTlIBi5Z29yX0w^Q9Lw!OB-f?v&%Gn`cC5K7QoH>BF-0z;W7%HNhvTBE~e3ffS zXlE*#e^wmT1%d)u2x;XG4AsEbu@?Y`#`T=R#23UN`Tl!KnGsVN3-{#L%d-SoD`{bM zPXdQvapL(+sQU_%5tA+F42B$pb|@79z{`L3)QL+78^zW;xEE3t$amG4W!xL)AAd@i zan5^aeQy108at4+o2SHI@EOt46mBb){f6(~aBbiE?dJr?g}e*y2TcV18l(a~)2X6I zaD$osmQYLJo9f#B5HaT1>jwaJ_i#QlUQ9=ObF%--cVcf%I=`wK`BCJy%loVZnzuR+$Vwc4Ojp_h)MUY;q2e%VpF9<#f*kj2Lzrqe zkhR(u@Ogrvn9V%4Opr5W99u#Y6Igb=8d2}@y{_M0MDc4`V`{E&=qmos=}fezQEj8Z z^L+FDE6m9Egl78Z+a}vVZ*q{J35&w)69Rt#OF4(^Pu``diTRWo85T8}JwoL2Ihek+ zhqF3LuOC`c`9>RCJGnMO%v{&sY#G;?JC^?ipyshao==HW1O2b*sGCGw{VK<(ZJoJ!Bj!}w=bL9l z2qz1`rRhPXdPf+h+2h-l~P|&8ZOyE&#_;u_}Z|%}~1jN8iM8hv!wYH;s$vY;4`-*H82C ztf_KK=^hC*%VA%KK5C#qc2<1EvFP$%fRuy~Fr}1T=ICg?;oXO7?YLZ_!Clp|wC1Zn zCb>X3_T}D1aYjxjhRCy<=)t#Kd>Z6@*FIoMd3yKOd700i8Nxl|F;ZWwdrxP^d-nYa z+vj}AdU=^dcep$m2%CWFcGG_CKp`LFIAadnP1Ie~4JA(jU^$E5j7n#{MI3XEg+!I9o)v@8%^v5 zflxR&1rB4TUKghv=SCo#!LPn2Oz$@Amx{2cJ@&u2k7&xjx3@|@FD$Y#!vk|)S$Pdf zhtA(YfFdly(%&ocwjC!d;)KwnO4?@Kv#)=Uw$hM<0mfJ{K{UhA4_rZy%_5~~CwsPx z&u4sPcMu0cRat{Nt~?b$jUL-K_BZ#jChc;N&g-oJ>?qN@!Wf{LvmmZ88L19RY@zD{ zHpeX9y;vS)o(OGoM*e4|(wFpZO)wZ$pkA+r!Z_~j6t=rf<{uLV>R1`sR3RF_81<=$ z&bOA#fZDMZ?)v$=_479nl(bz5b)UzvC2L6_neF{hIIXd3r_l`apQR>Ls?HQ+OAxw1 zIZiX@-^sAT0uJ1)W&9i3w1a=_?av9=g=#Yxf7{uKpLf*?#X8uEi6{p(QOzQHu$^Z2 zoD>jR$wlO+9U`v37J#t<000@33Xnz%`^PXqyBkh{_y=AdV2QBNVqXJwkdpn#dq{xD zO0fXADZGUsdZHbP)$E1As}9Re_`#Ac5JfH4a}zynIBX+GCBrt~<C*IUJ%_t zSt@#TLwSVL>+YfMTG-tJu%;n_5cA=?vH8pf7~S%t2*W{!Eb}X{h;#zm5&LMKpcH)4 zQILUOX#vTwFV6*41AAy$7jpsNQ=$>P4)*s30MN?95aJ{v8g9xCCrtsnK3t*zLLLB0 zU@s=HTc#4Aa>=Oe0jhv?_=PqR?i9{if%`ZD(h)$A3Tu=gL^exWz++hLPTLA;3eYr& zn<#+lX9$1q!(qq)`z_%tHJ|{+0zv`X0R$xxrZHf*stjxegU755ds9C=aTSzr#Hr{nHgO%T^l zf1i%g7iY*RSmZh0F70F6QI5e<^BL)Sq-<)Vc{N_gj9W4FM!{HzhglZ;E{2f zjYRaoPJUL+djQU(o&l>-u{hQz*0hLj8XRYR4if*M{3iUdKVD?2M`t*{trW7Ap9T6uu$RucnA!H|6{5wRQUfz$}ELYA$HG}y&)|p SYb{y5o;_`Ts^BC(;{OB1k!|h( From d0b02494a0619621021107e01c3ec0d7c5fc129f Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 13:17:11 +0200 Subject: [PATCH 03/18] Add validation and mitigation plan for high-priority audit findings Independently re-verifies the seven "Hoch" findings (P01-P07) from the 2026-09-29 repository analysis against current source, confirms all seven, and lays out a phased mitigation plan with effort estimates. Co-Authored-By: Claude Sonnet 5 --- ...findings-validation-and-mitigation-plan.md | 70 +++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 audits/2026-09-29-high-findings-validation-and-mitigation-plan.md diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md new file mode 100644 index 0000000..053027b --- /dev/null +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -0,0 +1,70 @@ +# Validation and Mitigation Plan: High-Priority Findings from the 2026-09-29 Repository Analysis + +Source audit: [2026-09-29-repository-analysis.md](2026-09-29-repository-analysis.md) (untracked in the working copy at the time of this writing; not present on this branch โ€” refer to the copy in the main checkout). + +This document verifies the seven findings marked "Hoch" (High) in that audit โ€” P01 through P07 โ€” directly against the current source in this repository, assesses whether "High" is justified, and lays out a phased mitigation plan with effort estimates. + +## 1. Verification method + +Each finding was independently re-derived by reading the cited source files at their current line numbers (which had drifted slightly since the audit), not merely by trusting the audit's prose. P02 was additionally verified empirically by parsing the exact reproduction input through the actual `goccy/go-yaml` parser used by this codebase. Two follow-up checks (the `filter.nebel.required` git setting, and smudge behavior for untagged plaintext in a protected field) were done afterward because they materially change the mitigation plan's phasing. + +## 2. Verdict summary + +| ID | Verdict | Notes | +|---|---|---| +| P01 | **Confirmed** | Common-path operational bug, not attacker-driven. Re-running `init` unconditionally deletes and restores managed files from HEAD with no dirty check. | +| P02 | **Confirmed (empirically)** | Quote-unaware comment truncation in YAML span computation leaks a plaintext suffix of a quoted secret into the git blob. | +| P03 | **Confirmed** | Dotted key collisions (`"a.b"` vs. nested `a: {b: ...}`) silently resolve to the wrong field with no error. | +| P04 | **Confirmed, worse than stated** | Duplicate JSON keys leave the second occurrence in plaintext โ€” and standard `encoding/json` map-unmarshal takes the *last* duplicate, meaning most consumers would actually use the plaintext value, not the encrypted one. | +| P05 | **Confirmed, narrower in practice** | Type metadata is genuinely outside the AEAD's authenticated data, so `type:str โ†’ type:bool` tampering passes authentication. However, smudge already passes through *any* untagged plaintext in a protected field with no error at all (`filterop.go:210`, intentional for migration, AC-6.7) โ€” so an attacker with blob write access doesn't need the type-confusion trick; they can just substitute plaintext directly. P05's real distinguishing value is stealth (a type-flipped field still displays as `ENC[...]` in review) rather than reach. | +| P06 | **Confirmed** | The derived key is base64-encoded and passed as a literal `git config` subprocess argument โ€” inconsistent with this codebase's own established threat model, which already refuses password arguments on its own CLI for the identical reason (argv is readable via `/proc//cmdline`). | +| P07 | **Confirmed, all 3 sub-issues** | (1) `*.env`-style root-only vs. recursive `.gitattributes` glob semantics diverge silently; (2) unescaped filenames with spaces break `.gitattributes` field parsing; (3) `doublestar.Match`'s error is discarded in `MatchRule`, so a malformed hand-edited glob silently never matches. | + +**All seven High findings stand.** None should be downgraded; P04 arguably deserves more weight than the audit gave it, and P05 should be read together with the smudge-passthrough gap noted above rather than in isolation. + +## 3. A structural fact that changes the plan + +`filter.nebel.required` is set to `true` at registration (`cmd/nebel/init.go:356`). This means git already treats a *failing* clean/smudge filter invocation as a hard error that blocks the operation (e.g. blocks `git add`/commit). Several of the cheapest mitigations below are "detect the bad case and return an error" rather than "detect and gracefully recover" โ€” and because of `required=true`, those errors will actually be enforced by git, not just logged. This makes P03, P04, and P07(1)/(3) considerably cheaper to fix well than a full silent-recovery design would be. + +## 4. Phased mitigation plan + +### Phase 0 โ€” Immediate, no code change (do now, in parallel with everything else) + +- **For any real installation already using nebel to protect live secrets:** scan the raw stored blobs of protected paths, including history (`git cat-file -p :` bypasses the smudge filter and shows exactly what's stored), for plaintext remnants matching the P02/P03/P04/P07/P08 patterns. Any secret found must be rotated at its source โ€” nebel's own key rotation does not un-expose an already-leaked plaintext. This is the natural first justification for the audit's separately-noted missing `nebel status` command. +- Unrelated to the audit, but found while validating this plan: `git remote -v` in this repository currently resolves to a URL with a **live GitHub PAT embedded in plaintext**. Recommend rotating that token and switching to a credential helper immediately. + +### Phase 1 โ€” Quick, non-breaking, fail-fast hardening (~3โ€“4 developer-days total, incl. tests) + +| Item | Fix | Effort | +|---|---|---| +| P01 | Add a dirty-check (`git status --porcelain` / `git diff --quiet HEAD --` over managed files) before `gitutil.CheckoutAll`'s remove+checkout; abort with a clear error if any managed file has uncommitted changes. Single function (`gitutil.go`), reuse existing e2e test infra. Must not block a legitimate first `init` on a clean clone โ€” needs a test for that path specifically. | 3โ€“5h | +| P04 | Detect a second key matching the target path within the same JSON object in `descendObject`/`cleanValues`; hard-error instead of silently encrypting only the first. Small, contained change. | 2โ€“4h | +| P07 (1)+(3) | Single high-leverage fix: make `Clean` (`filterop.go:57-61`) return an error when git invokes it for a path that matches no configured rule, instead of silently passing plaintext through. Because `required=true`, this blocks the commit. Also stop discarding `doublestar.Match`'s error in `MatchRule` and surface it as a hard error. This neutralizes both sub-issues without needing to reconcile nebel's glob semantics with `.gitattributes` semantics (that reconciliation becomes a pure usability improvement afterward, not a security fix). | 3โ€“5h combined | +| P06 | Stop passing the derived key via `git config` subprocess argv. Either write directly to `.git/config` (resolve the real location via `git rev-parse --git-common-dir` to handle linked worktrees, respect `config.lock`), or โ€” simpler and also addresses the audit's separate "harden local key storage" note โ€” use a dedicated key file with `0600` permissions, with a fallback read path for the old config-based storage. | 4โ€“8h | +| P05 (stopgap only) | On smudge, reject a decrypted value whose literal text isn't syntactically valid for its claimed type before rendering it unquoted (e.g. refuse to render `"not-a-bool"` as `type:bool`). Narrows the injection tail risk; does not close the underlying authentication gap. | 2โ€“4h | + +### Phase 2 โ€” Medium, non-breaking format-preserving fixes (~2โ€“3 developer-days) + +| Item | Fix | Effort | +|---|---|---| +| P02 | Make `scalarText`/`yamlSpan` quote-aware: only truncate at an unquoted `#`/` #`; leave quoted, literal, and folded scalar spans untouched. Needs new tests for quoted strings containing `#`, block scalars, and CRLF combinations. Touches every YAML span computation โ€” moderate regression risk, needs solid coverage before merge. | 1โ€“2 days | +| P03 | Add path-collision detection: hard-error when a flattened dotted path is ambiguous with a nested path in the same document, rather than silently resolving to one of them. (Full escaping syntax for literal dots in key names is a larger, separate feature โ€” recommend deferring unless real users actually hit this, ~2โ€“3 additional days if needed later.) | 4โ€“8h | +| P07 (2) | Validate/reject or escape pattern/filename characters (spaces, etc.) before writing an `.gitattributes` line at `add file` time. | 2โ€“3h | + +### Phase 3 โ€” Breaking format change, needs versioning and migration (~3โ€“5 developer-days) + +| Item | Fix | Effort | +|---|---|---| +| P05 (proper fix) | Bind `type` into the AEAD's authenticated data (or into the authenticated plaintext itself) so tampering the type metadata fails authentication. This changes the ciphertext/tag format: every previously-committed tag was authenticated without type, so this needs a new tag/format version, backward-compatible decryption of old tags, and a migration path analogous to the existing key-rotation mechanism (spec 11). | 3โ€“5 days incl. migration tooling and docs | + +### Design question to resolve with stakeholders, not purely a bug fix + +Smudge currently passes through *any* untagged plaintext in a protected field with no error at all, intentionally, to support gradual migration (AC-6.7). This is the more foundational relative of P05 and is a known limitation shared by filter-driven transparent-encryption tools generally (nebel, like git-crypt or unsigned sops usage, does not by itself defend against a git committer with write access substituting content โ€” that requires signed commits / branch protection, outside this tool's scope). Worth an explicit "strict mode" option that fails smudge/status on an untagged protected field, opt-in so existing migration workflows keep working. This is a scope/product decision, not included in the effort estimates above. + +## 5. Total effort estimate + +- Phase 1: ~3โ€“4 developer-days +- Phase 2: ~2โ€“3 developer-days +- Phase 3: ~3โ€“5 developer-days + +**Total: roughly 8โ€“12 developer-days (1.5โ€“2.5 weeks) for one engineer**, before touching the audit's medium-priority items (P08โ€“P12), which were out of scope for this validation pass. From be6b2cb4bb1f21c68c257fa2ee3b2b921f69bf1a Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 13:27:36 +0200 Subject: [PATCH 04/18] Add priority order and bundling recommendations to mitigation plan Ranks the seven confirmed High findings into tiers by real-world impact (silent total plaintext exposure > partial leak > data loss > conditional local exposure > integrity-only), and groups them into six work packages (A-F) that share code paths or defensive patterns, with a recommended shipping order. Co-Authored-By: Claude Sonnet 5 --- ...findings-validation-and-mitigation-plan.md | 45 +++++++++++++++++-- 1 file changed, 42 insertions(+), 3 deletions(-) diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md index 053027b..d394b17 100644 --- a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -22,11 +22,50 @@ Each finding was independently re-derived by reading the cited source files at t **All seven High findings stand.** None should be downgraded; P04 arguably deserves more weight than the audit gave it, and P05 should be read together with the smudge-passthrough gap noted above rather than in isolation. -## 3. A structural fact that changes the plan +## 3. Priority order โ€” what to fix first, and what to bundle together + +Ranked by importance to the tool's core promise (protecting secrets), not by implementation effort. The distinguishing question at each tier: does this bug leak the secret itself, or something weaker (the key, or integrity of already-protected data)? Within "leaks the secret" bugs, does it leak silently while reporting success (worst โ€” false sense of security), and how easily does a normal user trigger it without doing anything unusual? + +**Tier 1 โ€” Silent, complete plaintext exposure while the tool reports success.** These are the worst class of bug for an encryption tool: nothing looks wrong, but the secret is fully unprotected in the git blob. + +1. **P07(1)** โ€” root-only vs. recursive glob mismatch. Highest priority of all: triggered by the single most natural pattern a user would write (`*.env`-style, exactly like `.gitignore` habits) combined with the equally common case of the file living in a subdirectory. `add file` reports success; git invokes the filter; nebel's own matcher silently disagrees and lets plaintext through. +2. **P04** โ€” duplicate JSON keys. Full exposure of exactly the value most JSON consumers will actually use (last-write-wins on unmarshal), while the encrypted first copy is decoration. +3. **P03** โ€” dotted path collision. Full exposure of the intended field; requires a specific naming collision, so somewhat less likely to occur than P07(1)/P04, but total when it does. +4. **P07(3)** โ€” discarded glob-match errors. A malformed hand-edited rule silently protects nothing; requires manual `.gitattributes`/config editing to trigger, so lower likelihood than the above, same total impact. +5. **P07(2)** โ€” unescaped filenames with spaces. Narrower trigger condition (spaces in filenames), same silent-total-bypass outcome. + +**Tier 2 โ€” Large partial plaintext exposure.** + +6. **P02** โ€” YAML quoted-string comment truncation. Not silent-total like Tier 1, but close in practice: in the audit's own example, only the first 4 characters end up encrypted and nearly the entire rest of the secret is left as plaintext. Triggers on any secret value containing a literal `" #"`, which is plausible for real passwords/tokens/connection strings. + +**Tier 3 โ€” Data loss, not a leak.** Different axis entirely (destroys the user's own work, doesn't expose a secret to a third party), but ranked here because it's trivially easy to trigger with completely ordinary use โ€” no attacker, no unusual input required. + +7. **P01** โ€” re-running `init` destroys uncommitted/staged changes to managed files. + +**Tier 4 โ€” Conditional local exposure, requires an additional attacker capability.** + +8. **P06** โ€” derived key visible via process argument list. Only exploitable by a co-located observer who can already read another user's/process's argv (shared host, container escape, etc.) โ€” a real gap and inconsistent with the tool's own stated threat model, but requires more attacker capability than "can read the git repo," which is all Tiers 1โ€“3 require. + +**Tier 5 โ€” Integrity-only, and largely redundant with an accepted design gap.** + +9. **P05** โ€” type metadata not authenticated. Real, but as noted in ยง2, an attacker with the blob-write access this requires can already substitute plaintext directly via the pre-existing, intentional smudge passthrough โ€” so this doesn't expand what such an attacker can already do, it only makes one specific form of tampering (type-flip) harder to spot in review. + +### What to fix together + +- **Package A โ€” "filter/rule matching correctness" (P07(1), P07(2), P07(3)):** same files (`config.go`'s `Validate`/`MatchRule`, `add.go`'s `addGitattributesPattern`, `filterop.go`'s `Clean`), same underlying defect class (a registered rule doesn't actually guarantee git and nebel agree on what's matched), same test setup. Do this as one PR โ€” it's also the single highest-priority fix, so it should be first regardless of grouping. +- **Package B โ€” "fail-closed field resolution" (P03, P04):** different files (`path.go`/`json.go` vs. the same), but the identical defensive pattern (detect an ambiguous/duplicate field target and hard-error via `required=true` instead of silently protecting only one candidate). Natural to design and review together even though the code changes are in different functions. +- **Package C โ€” P02 alone**, but worth opening the YAML renderer "under the hood" only once: if this work is scheduled, consider folding in the audit's medium-priority P10 (control characters not escaped) and P11 (multi-document YAML only partially handled) at the same time, since they touch the exact same rendering/parsing code path and the same test harness โ€” doing them separately means paying the review/regression-risk cost of touching `yaml.go`'s scalar handling three times instead of once. (P10/P11 are not part of this High-severity validation pass; flagged here purely as an efficiency note.) +- **Package D โ€” P01 alone.** Self-contained (`gitutil.go`/`init.go`), no shared code with the others โ€” can be done in parallel by a different engineer with no coordination cost. +- **Package E โ€” P06, and worth bundling with the audit's separate (non-defect) "harden local key storage" suggestion.** A single fix โ€” a dedicated `0600` key file instead of `git config` โ€” addresses both the argv-exposure bug and that hardening suggestion at once. +- **Package F โ€” P05, standalone, last.** Breaking ciphertext-format change with its own migration path; do not bundle with anything else, since it needs its own versioned release and rollout communication independent of all other fixes. + +Recommended shipping order: **Package A โ†’ Package B โ†’ Package C โ†’ Package D and Package E in parallel โ†’ Package F** as a separate, later release. + +## 4. A structural fact that changes the plan `filter.nebel.required` is set to `true` at registration (`cmd/nebel/init.go:356`). This means git already treats a *failing* clean/smudge filter invocation as a hard error that blocks the operation (e.g. blocks `git add`/commit). Several of the cheapest mitigations below are "detect the bad case and return an error" rather than "detect and gracefully recover" โ€” and because of `required=true`, those errors will actually be enforced by git, not just logged. This makes P03, P04, and P07(1)/(3) considerably cheaper to fix well than a full silent-recovery design would be. -## 4. Phased mitigation plan +## 5. Phased mitigation plan ### Phase 0 โ€” Immediate, no code change (do now, in parallel with everything else) @@ -61,7 +100,7 @@ Each finding was independently re-derived by reading the cited source files at t Smudge currently passes through *any* untagged plaintext in a protected field with no error at all, intentionally, to support gradual migration (AC-6.7). This is the more foundational relative of P05 and is a known limitation shared by filter-driven transparent-encryption tools generally (nebel, like git-crypt or unsigned sops usage, does not by itself defend against a git committer with write access substituting content โ€” that requires signed commits / branch protection, outside this tool's scope). Worth an explicit "strict mode" option that fails smudge/status on an untagged protected field, opt-in so existing migration workflows keep working. This is a scope/product decision, not included in the effort estimates above. -## 5. Total effort estimate +## 6. Total effort estimate - Phase 1: ~3โ€“4 developer-days - Phase 2: ~2โ€“3 developer-days From 7acffc9d4b609f81e4feead7dc619fb18e736ae9 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 13:40:08 +0200 Subject: [PATCH 05/18] Fix Package A: filter/rule matching correctness (P07 sub-issues 1-3) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Three independent fixes for the same underlying defect class from the 2026-09-29 audit's P07 finding โ€” a registered rule doesn't guarantee git and nebel agree on what's matched: - Clean and Smudge now return ErrNoMatchingRule instead of silently passing content through when git invokes the filter for a path no rule matches. Git only calls this filter for a path .gitattributes marks filter=nebel, so a non-match here means .gitattributes and .nebel.yaml disagree โ€” most commonly because a bare pattern like "*.env" matches recursively in .gitattributes but only at its own depth under doublestar. Before this fix, that mismatch let a subdirectory file's plaintext reach the git object database undetected; filter.nebel.required=true now turns the mismatch into a blocked `git add`/commit instead. Verified against a real git repo, including confirming the new e2e test fails against the pre-fix code. - Config.Validate rejects a syntactically invalid glob pattern (via doublestar.ValidatePattern) at config-load time, since MatchRule's bool-only signature has no room to propagate doublestar.Match's own error โ€” an invalid pattern would otherwise silently behave as "never matches" instead of surfacing the typo. - addGitattributesPattern now escapes characters .gitattributes' line syntax gives special meaning to (a leading '#' or '!', embedded spaces) before writing a pattern, so a filename with a space no longer silently gets no effective filter assignment while the add command reports success. Co-Authored-By: Claude Sonnet 5 --- cmd/nebel/add.go | 24 +++++++++- cmd/nebel/add_test.go | 33 ++++++++++++++ cmd/nebel/filtermatch_e2e_test.go | 73 ++++++++++++++++++++++++++++++ internal/config/config.go | 11 +++++ internal/config/config_test.go | 18 ++++++++ internal/filterop/filterop.go | 29 +++++++++--- internal/filterop/filterop_test.go | 29 ++++++------ 7 files changed, 196 insertions(+), 21 deletions(-) create mode 100644 cmd/nebel/add_test.go create mode 100644 cmd/nebel/filtermatch_e2e_test.go diff --git a/cmd/nebel/add.go b/cmd/nebel/add.go index c4289c3..3ad8a7b 100644 --- a/cmd/nebel/add.go +++ b/cmd/nebel/add.go @@ -218,7 +218,7 @@ func ensureGitattributes(root string) error { // glob to the nebel filter, unless that exact line is already present. func addGitattributesPattern(root, glob string) error { path := filepath.Join(root, gitattributesName) - line := fmt.Sprintf("%s filter=nebel", glob) + line := fmt.Sprintf("%s filter=nebel", escapeGitattributesPattern(glob)) existing, err := os.ReadFile(path) if err != nil && !os.IsNotExist(err) { @@ -241,3 +241,25 @@ func addGitattributesPattern(root, glob string) error { } return nil } + +// escapeGitattributesPattern escapes the characters gitattributes' line +// syntax gives special meaning to, so a glob written verbatim into a +// pattern/attribute line still means what the caller intended: +// - a leading '#' starts a comment, and a leading '!' negates a +// pattern โ€” either would silently turn the whole line into something +// other than a filter assignment for glob; +// - the line's fields are split on whitespace, so an embedded space +// would attach the rest of glob to the "filter=nebel" attribute +// instead of the pattern, leaving the intended file unmatched even +// though the command reports success. +// +// This does not touch glob metacharacters (*, ?, [, ], \) themselves โ€” +// Rule.Files is intentionally a doublestar glob (see its doc comment), +// and escaping those would change what the pattern matches instead of +// merely how the line is parsed. +func escapeGitattributesPattern(glob string) string { + if strings.HasPrefix(glob, "#") || strings.HasPrefix(glob, "!") { + glob = `\` + glob + } + return strings.ReplaceAll(glob, " ", `\ `) +} diff --git a/cmd/nebel/add_test.go b/cmd/nebel/add_test.go new file mode 100644 index 0000000..bda6c39 --- /dev/null +++ b/cmd/nebel/add_test.go @@ -0,0 +1,33 @@ +// Copyright (C) 2026 Marwin Moellers +// SPDX-License-Identifier: GPL-3.0-or-later + +package main + +import "testing" + +// Regression test for the 2026-09-29 audit's P07 sub-issue 2: a glob +// written unescaped into a .gitattributes line breaks on the characters +// that syntax gives special meaning to, leaving the intended file with no +// effective filter assignment even though the add command reports success. +func TestEscapeGitattributesPattern(t *testing.T) { + tests := []struct { + name string + glob string + want string + }{ + {"no special characters", "secrets/*.pem", "secrets/*.pem"}, + {"embedded space", "My File.env", `My\ File.env`}, + {"multiple spaces", "a b c.env", `a\ b\ c.env`}, + {"leading hash", "#backup.env", `\#backup.env`}, + {"leading bang", "!important.env", `\!important.env`}, + {"glob metacharacters untouched", "**/*.env", "**/*.env"}, + {"bracket class untouched", "secrets/[ab].pem", "secrets/[ab].pem"}, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + if got := escapeGitattributesPattern(tt.glob); got != tt.want { + t.Errorf("escapeGitattributesPattern(%q) = %q, want %q", tt.glob, got, tt.want) + } + }) + } +} diff --git a/cmd/nebel/filtermatch_e2e_test.go b/cmd/nebel/filtermatch_e2e_test.go new file mode 100644 index 0000000..4fabdee --- /dev/null +++ b/cmd/nebel/filtermatch_e2e_test.go @@ -0,0 +1,73 @@ +// Copyright (C) 2026 Marwin Moellers +// SPDX-License-Identifier: GPL-3.0-or-later + +package main + +import ( + "os" + "path/filepath" + "strings" + "testing" +) + +// Regression test for the 2026-09-29 audit's P07(1): a bare glob like +// "*.env" (no leading "**/") matches recursively in .gitattributes syntax +// but, per doublestar's semantics, only at the depth it's written at (see +// config.Rule.Files's doc comment). `nebel add file` writes such a pattern +// unchanged into both files, so a file living in a subdirectory is one +// git invokes the filter for but that config.MatchRule does not recognize. +// +// Before the fix, Clean silently returned this content unchanged and +// `git commit` succeeded with the secret stored as plaintext. The filter +// must instead fail the commit outright (filterop.ErrNoMatchingRule), +// since filter.nebel.required is set to true. +func TestAddFileBareGlobDoesNotSilentlyCommitPlaintextInSubdirectory(t *testing.T) { + pathEnv := pathEnvWithBin(t) + repo := newTestRepo(t, pathEnv) + + initWithPassword(t, repo, pathEnv, "test-password-123") + runIn(t, repo, pathEnv, "nebel", "add", "file", "*.env") + + configDir := filepath.Join(repo, "config") + if err := os.MkdirAll(configDir, 0o755); err != nil { + t.Fatal(err) + } + plaintext := "DB_PASSWORD=super-secret\n" + envPath := filepath.Join(configDir, "prod.env") + if err := os.WriteFile(envPath, []byte(plaintext), 0o644); err != nil { + t.Fatal(err) + } + + out, err := runInExpectingError(t, repo, pathEnv, "git", "add", "--", "config/prod.env") + if err == nil { + t.Fatalf("git add config/prod.env: want an error (glob/attribute mismatch), got success:\n%s", out) + } + if !strings.Contains(out, "no rule") && !strings.Contains(out, "ErrNoMatchingRule") && !strings.Contains(out, "filterop:") { + t.Errorf("git add error output = %q, want it to mention the rule mismatch", out) + } + + // Confirm the secret was never staged at all, plaintext or otherwise โ€” + // a failed clean must not leave a partial index entry behind. + lsFiles := runIn(t, repo, pathEnv, "git", "status", "--porcelain") + if strings.Contains(lsFiles, "A config/prod.env") { + t.Errorf("git status shows config/prod.env staged despite the filter error:\n%s", lsFiles) + } + + // The root-level case (matching depth) must still work exactly as + // before โ€” this is a mismatch fix, not a semantics change. + rootPlaintext := "DB_PASSWORD=another-secret\n" + rootEnvPath := filepath.Join(repo, "root.env") + if err := os.WriteFile(rootEnvPath, []byte(rootPlaintext), 0o644); err != nil { + t.Fatal(err) + } + runIn(t, repo, pathEnv, "git", "add", "--", "root.env") + runIn(t, repo, pathEnv, "git", "commit", "-q", "-m", "add root-level env file") + + stored := runIn(t, repo, pathEnv, "git", "show", "HEAD:root.env") + if stored == rootPlaintext { + t.Error("root-level file matching the same bare glob was committed as plaintext") + } + if !strings.HasPrefix(stored, "ENC[") { + t.Errorf("root-level file's committed blob is not ciphertext: %q", stored) + } +} diff --git a/internal/config/config.go b/internal/config/config.go index 3553eae..84fee8e 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -85,6 +85,14 @@ var ( // encrypt list, which it would ignore โ€” a sign the author expected // per-value behaviour and would not get it. ErrFieldsOnFileRule = errors.New("config: mode: file rule must not list fields") + + // ErrInvalidPattern is returned when a rule's Files glob is not valid + // doublestar syntax. Rejecting it here, rather than at match time, + // matters because MatchRule discards doublestar.Match's error (its + // bool-only signature has no room for one) โ€” an invalid pattern that + // slipped past this check would silently behave as "never matches" + // instead of surfacing the typo. + ErrInvalidPattern = errors.New("config: invalid glob pattern") ) // SaltBytes decodes Salt from base64. @@ -114,6 +122,9 @@ func (c *Config) CurrentVersion() int { // the one machine that happens to stage that file. func (c *Config) Validate() error { for _, r := range c.Rules { + if !doublestar.ValidatePattern(r.Files) { + return fmt.Errorf("%w: rule %q", ErrInvalidPattern, r.Files) + } switch r.Mode { case ModeFile: if len(r.Encrypt) > 0 { diff --git a/internal/config/config_test.go b/internal/config/config_test.go index eaf3459..2b4c7a8 100644 --- a/internal/config/config_test.go +++ b/internal/config/config_test.go @@ -162,6 +162,24 @@ rules:`+tt.rule+` } } +// A malformed glob pattern is caught when the repository is opened, not +// silently treated by MatchRule as "never matches" โ€” MatchRule's bool-only +// signature discards doublestar.Match's error, so an invalid pattern that +// slipped past this check would be a silent, permanent bypass for that +// rule (audit 2026-09-29, P07 sub-issue 3). +func TestLoadRejectsInvalidGlobPattern(t *testing.T) { + path := writeTempConfig(t, ` +salt: c3RydWNyeXB0LXRlc3Qtc2FsdC0xNg== +canary: "ENC[AES256_SIV,data:aGVsbG8=]" +rules: + - files: "secrets/[.pem" + mode: file +`) + if _, err := Load(path); !errors.Is(err, ErrInvalidPattern) { + t.Errorf("Load() error = %v, want %v", err, ErrInvalidPattern) + } +} + // A malformed field path is caught when the repository is opened, not // silently on whichever machine first stages a matching file. func TestLoadRejectsBadFieldPath(t *testing.T) { diff --git a/internal/filterop/filterop.go b/internal/filterop/filterop.go index 1613abc..556f597 100644 --- a/internal/filterop/filterop.go +++ b/internal/filterop/filterop.go @@ -30,9 +30,24 @@ type Keyring map[int][]byte // this machine's keyring does not hold. var ErrKeyVersionMissing = errors.New("filterop: key version not registered locally") -// Clean encrypts input if filePath matches a mode: file rule; otherwise (no -// matching rule, or the value is already encrypted) it returns input -// unchanged. +// ErrNoMatchingRule is returned when Clean or Smudge is invoked for a path +// that no rule in .nebel.yaml matches. Git only calls this filter for a +// path .gitattributes marks filter=nebel, so reaching this case means +// .gitattributes and .nebel.yaml disagree about that path โ€” most often +// because a bare pattern like "*.env" matches recursively in +// .gitattributes but, per doublestar's semantics (see config.Rule.Files), +// only at the depth it's written at. Passing content through unchanged +// here, as earlier versions did, would either commit it as plaintext +// (Clean) or leave the mismatch invisible (Smudge); erroring instead +// blocks the git operation, since filter.nebel.required is set to true. +var ErrNoMatchingRule = errors.New("filterop: path has git attribute filter=nebel but no rule in .nebel.yaml matches it โ€” check .gitattributes and .nebel.yaml for a pattern mismatch") + +// Clean encrypts input if filePath matches a mode: file rule; if the value +// is already encrypted it returns input unchanged. A filePath that matches +// no rule at all is ErrNoMatchingRule: git only invokes this filter for a +// path .gitattributes marks filter=nebel, so a non-match here means +// .gitattributes and .nebel.yaml disagree about that path, not that the +// path is legitimately unmanaged. // // filePath must be the file's path relative to the repository root โ€” it is // both the rule-matching key and part of the AAD binding the ciphertext to @@ -57,7 +72,7 @@ var ErrKeyVersionMissing = errors.New("filterop: key version not registered loca func Clean(cfg *config.Config, keyring Keyring, filePath string, input []byte) ([]byte, error) { rule, ok := cfg.MatchRule(filePath) if !ok { - return input, nil + return nil, fmt.Errorf("%w: %s", ErrNoMatchingRule, filePath) } version := cfg.CurrentVersion() key, haveKey := keyring[version] @@ -102,7 +117,9 @@ type Skipped struct { // at all passes through unchanged (AC-6.7 โ€” e.g. a file not yet migrated). // A value that *is* tagged but fails to parse or authenticate is a genuine // corruption or tampering signal and is reported as an error rather than -// smudged into a wrong-but-plausible plaintext (AC-6.9). +// smudged into a wrong-but-plausible plaintext (AC-6.9). A filePath that +// matches no rule at all is ErrNoMatchingRule, for the same reason as in +// Clean: git would not have invoked this filter for it otherwise. // // Unlike Clean, Smudge selects its key by the value's own tag-declared // version (AC-6.13), not the config's current version. A well-formed tag @@ -116,7 +133,7 @@ type Skipped struct { func Smudge(cfg *config.Config, keyring Keyring, filePath string, input []byte) ([]byte, []Skipped, error) { rule, ok := cfg.MatchRule(filePath) if !ok { - return input, nil, nil + return nil, nil, fmt.Errorf("%w: %s", ErrNoMatchingRule, filePath) } if rule.Mode == config.ModeValue { return smudgeValues(rule, keyring, filePath, input) diff --git a/internal/filterop/filterop_test.go b/internal/filterop/filterop_test.go index ca443ee..4247b4e 100644 --- a/internal/filterop/filterop_test.go +++ b/internal/filterop/filterop_test.go @@ -5,6 +5,7 @@ package filterop import ( "bytes" + "errors" "testing" "github.com/MuffinUser/nebel/internal/config" @@ -101,23 +102,23 @@ func TestRoundTrip(t *testing.T) { } } -// A file that matches no rule passes through unchanged on both operations. -func TestUnmatchedFilePassesThrough(t *testing.T) { +// A path git invokes the filter for (it always names one filePath argument +// per invocation) but that no rule matches is a .gitattributes/.nebel.yaml +// mismatch, not a legitimately unmanaged file โ€” git would not have called +// clean/smudge for it otherwise. Passing content through here would either +// commit it as plaintext (Clean) or hide the mismatch (Smudge), so both +// report ErrNoMatchingRule instead. +func TestUnmatchedFileErrors(t *testing.T) { input := []byte("plain content") - cleaned, err := Clean(testConfig(), testKeyring, "README.md", input) - if err != nil { - t.Fatalf("Clean: %v", err) - } - if !bytes.Equal(cleaned, input) { - t.Errorf("Clean() on an unmatched file changed the content: %q", cleaned) - } - smudged, _, err := Smudge(testConfig(), testKeyring, "README.md", input) - if err != nil { - t.Fatalf("Smudge: %v", err) + _, err := Clean(testConfig(), testKeyring, "README.md", input) + if !errors.Is(err, ErrNoMatchingRule) { + t.Errorf("Clean() error = %v, want %v", err, ErrNoMatchingRule) } - if !bytes.Equal(smudged, input) { - t.Errorf("Smudge() on an unmatched file changed the content: %q", smudged) + + _, _, err = Smudge(testConfig(), testKeyring, "README.md", input) + if !errors.Is(err, ErrNoMatchingRule) { + t.Errorf("Smudge() error = %v, want %v", err, ErrNoMatchingRule) } } From b4ea81ba1f442487cd51450d3e6f86a3ab99a9ad Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 13:40:27 +0200 Subject: [PATCH 06/18] Mark Package A as done in the mitigation plan Co-Authored-By: Claude Sonnet 5 --- .../2026-09-29-high-findings-validation-and-mitigation-plan.md | 1 + 1 file changed, 1 insertion(+) diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md index d394b17..9b2315d 100644 --- a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -53,6 +53,7 @@ Ranked by importance to the tool's core promise (protecting secrets), not by imp ### What to fix together - **Package A โ€” "filter/rule matching correctness" (P07(1), P07(2), P07(3)):** same files (`config.go`'s `Validate`/`MatchRule`, `add.go`'s `addGitattributesPattern`, `filterop.go`'s `Clean`), same underlying defect class (a registered rule doesn't actually guarantee git and nebel agree on what's matched), same test setup. Do this as one PR โ€” it's also the single highest-priority fix, so it should be first regardless of grouping. + - **Status: done** (commit `7acffc9` on branch `worktree-audit-mitigation-plan`). `Clean`/`Smudge` now return `filterop.ErrNoMatchingRule` instead of silently passing content through when no rule matches a path git invoked the filter for; `Config.Validate` rejects a syntactically invalid glob via `doublestar.ValidatePattern`; `addGitattributesPattern` escapes leading `#`/`!` and embedded spaces. A new e2e test reproduces the exact P07(1) scenario (bare `*.env` glob, file in a subdirectory) against a real git repository and was confirmed to fail against the pre-fix code before passing against the fix. Full existing test suite (`go test ./...`) passes unchanged. - **Package B โ€” "fail-closed field resolution" (P03, P04):** different files (`path.go`/`json.go` vs. the same), but the identical defensive pattern (detect an ambiguous/duplicate field target and hard-error via `required=true` instead of silently protecting only one candidate). Natural to design and review together even though the code changes are in different functions. - **Package C โ€” P02 alone**, but worth opening the YAML renderer "under the hood" only once: if this work is scheduled, consider folding in the audit's medium-priority P10 (control characters not escaped) and P11 (multi-document YAML only partially handled) at the same time, since they touch the exact same rendering/parsing code path and the same test harness โ€” doing them separately means paying the review/regression-risk cost of touching `yaml.go`'s scalar handling three times instead of once. (P10/P11 are not part of this High-severity validation pass; flagged here purely as an efficiency note.) - **Package D โ€” P01 alone.** Self-contained (`gitutil.go`/`init.go`), no shared code with the others โ€” can be done in parallel by a different engineer with no coordination cost. From 081f639208e7633a496f34516c128ced0e47da5e Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 13:49:47 +0200 Subject: [PATCH 07/18] Fix Package B: fail-closed field resolution (P03, P04) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A configured dot-notation path can silently resolve to more than one distinct location in the same document, and Locate's targeted descent can only ever return one of them: - P03: a literal key containing a dot ("a.b") collides with the equivalent nested path ("a" containing "b") โ€” dot notation can't tell them apart, and a dot inside a key can't be escaped (see ParsePath's doc comment). Before this fix, Locate always resolved to whichever candidate its traversal order reached first, silently leaving the other value's secret unencrypted while reporting success. - P04: encoding/json's streaming decoder does not reject a duplicate object key the way go-yaml's parser does (confirmed empirically: go-yaml's parser.ParseBytes already errors "mapping key ... already defined" on a duplicate YAML key, so only JSON needed this part of the fix). descendObject returned the first occurrence's span, leaving the second โ€” which, per encoding/json's own map-unmarshal semantics, most real consumers would treat as the effective value โ€” in plaintext. Both are the same underlying problem: a path string that maps to more than one leaf. Locate now calls the existing Leaves() walk (which, unlike a targeted descent, visits every literal key and so surfaces a collision a single-path lookup never would) and refuses with the new ErrAmbiguousPath if more than one leaf shares the configured path, before ever resolving to one of them. Verified against the pre-fix code directly: Locate("a.b") on {"a.b":"secret","a":{"b":"decoy"}} silently returned "decoy" with no error, and Locate("password") on a duplicate-keyed JSON document silently returned only "eins" โ€” exactly the silent misresolution the audit described. Full existing test suite passes unchanged. Co-Authored-By: Claude Sonnet 5 --- internal/format/format.go | 35 +++++++++++++++++++++++ internal/format/format_test.go | 51 ++++++++++++++++++++++++++++++++++ internal/format/json.go | 5 +++- internal/format/yaml.go | 5 +++- 4 files changed, 94 insertions(+), 2 deletions(-) diff --git a/internal/format/format.go b/internal/format/format.go index f637dab..50e17ea 100644 --- a/internal/format/format.go +++ b/internal/format/format.go @@ -25,8 +25,43 @@ var ( // ErrNotScalar is returned when a path resolves to a mapping or // sequence rather than a single value. ErrNotScalar = errors.New("format: path does not resolve to a scalar") + + // ErrAmbiguousPath is returned when a configured path selects more + // than one distinct location in the same document. Two ways this + // happens: a literal key containing a dot collides with the + // equivalent nested path โ€” dot notation can't tell "a.b" the flat key + // from "a" containing "b" apart, and a dot inside a key can't be + // escaped (ParsePath's doc comment) โ€” or an outright duplicate key at + // the same nesting level (JSON's streaming decoder does not reject + // these the way go-yaml's parser does). Locate's traversal can only + // ever resolve to one of them; picking one silently, as earlier + // versions did, could protect the wrong (or only one) of several + // values while reporting success โ€” the same silent-failure concern + // ErrNotFound already guards for a path that resolves to nothing. + ErrAmbiguousPath = errors.New("format: path is ambiguous") ) +// checkUnambiguous reports ErrAmbiguousPath if path selects more than one +// leaf in src (see ErrAmbiguousPath), by cross-checking against h.Leaves, +// which โ€” unlike a targeted descent โ€” visits every literal key in the +// document and so surfaces a collision a single-path lookup never would. +func checkUnambiguous(h Handler, src []byte, path string) error { + leaves, err := h.Leaves(src) + if err != nil { + return err + } + matches := 0 + for _, leaf := range leaves { + if leaf.Path == path { + matches++ + } + } + if matches > 1 { + return fmt.Errorf("%w: %q matches %d different values", ErrAmbiguousPath, path, matches) + } + return nil +} + // Span is one located scalar: where it sits in the source, and what it is. type Span struct { // Start and End bound the scalar as written, including any quotes, so diff --git a/internal/format/format_test.go b/internal/format/format_test.go index 08d8543..00aef32 100644 --- a/internal/format/format_test.go +++ b/internal/format/format_test.go @@ -322,6 +322,57 @@ func TestLocateRejectsNonScalar(t *testing.T) { } } +// Regression tests for the 2026-09-29 audit's P03 and P04: a configured +// path that resolves to more than one distinct value in the same document +// must be refused, not silently resolved to whichever candidate a +// targeted descent happens to reach first. +func TestLocateRejectsAmbiguousPath(t *testing.T) { + for _, tt := range []struct { + name, file, src, path string + }{ + // P03: a literal key containing a dot ("a.b") collides with the + // equivalent nested path ("a" containing "b") โ€” dot notation + // can't tell them apart. Before the fix, Locate always resolved + // to the nested value ("decoy"), silently leaving the flat key's + // "secret" unencrypted while reporting success. + {"json dotted key collides with nested path", "c.json", `{"a.b":"secret","a":{"b":"decoy"}}`, "a.b"}, + {"yaml dotted key collides with nested path", "c.yaml", "\"a.b\": secret\na:\n b: decoy\n", "a.b"}, + + // P04: encoding/json's streaming decoder does not reject a + // duplicate object key the way go-yaml's parser does (see + // TestYAMLParserRejectsDuplicateKeys) โ€” before the fix, + // descendObject returned the first occurrence's span, leaving + // the second occurrence (which, per encoding/json's own + // map-unmarshal semantics, most consumers would treat as the + // effective value) in plaintext. + {"json duplicate key", "c.json", `{"password":"eins","password":"zwei"}`, "password"}, + } { + t.Run(tt.name, func(t *testing.T) { + h, err := For(tt.file) + if err != nil { + t.Fatal(err) + } + if _, err := h.Locate([]byte(tt.src), tt.path); !errors.Is(err, ErrAmbiguousPath) { + t.Errorf("Locate(%q) error = %v, want %v", tt.path, err, ErrAmbiguousPath) + } + }) + } +} + +// Documents, rather than fixes, existing behavior: go-yaml's parser +// already rejects an outright duplicate mapping key at parse time, unlike +// encoding/json's streaming decoder (see TestLocateRejectsAmbiguousPath's +// "json duplicate key" case) โ€” so YAML needed no equivalent fix for P04. +func TestYAMLParserRejectsDuplicateKeys(t *testing.T) { + h, err := For("c.yaml") + if err != nil { + t.Fatal(err) + } + if _, err := h.Locate([]byte("password: eins\npassword: zwei\n"), "password"); err == nil { + t.Error("Locate() on a YAML document with a duplicate key: want an error, got nil") + } +} + // Render is the decryption side: a restored value must come back with its // original type, not as a quoted string (AC-3.2). func TestRender(t *testing.T) { diff --git a/internal/format/json.go b/internal/format/json.go index f605808..be7a310 100644 --- a/internal/format/json.go +++ b/internal/format/json.go @@ -21,11 +21,14 @@ type jsonHandler struct{} // possible: json.Unmarshal would discard the offsets, and re-marshalling // would normalize key order, indentation and number formatting across the // whole document. -func (jsonHandler) Locate(src []byte, path string) (Span, error) { +func (h jsonHandler) Locate(src []byte, path string) (Span, error) { steps, err := ParsePath(path) if err != nil { return Span{}, err } + if err := checkUnambiguous(h, src, path); err != nil { + return Span{}, err + } dec := json.NewDecoder(bytes.NewReader(src)) dec.UseNumber() diff --git a/internal/format/yaml.go b/internal/format/yaml.go index 01f45de..22de9ba 100644 --- a/internal/format/yaml.go +++ b/internal/format/yaml.go @@ -28,11 +28,14 @@ type yamlHandler struct{} // resulting span back to real offsets in src, so Locate still splices // over the actual bytes on disk. When src has no "\r\n" at all, the map // is the identity and this is exactly the original behavior. -func (yamlHandler) Locate(src []byte, path string) (Span, error) { +func (h yamlHandler) Locate(src []byte, path string) (Span, error) { steps, err := ParsePath(path) if err != nil { return Span{}, err } + if err := checkUnambiguous(h, src, path); err != nil { + return Span{}, err + } m := newCRLFMap(src) From b8c59024f0f5aa6ac7bdb875d5ac6b8273b017f8 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 13:50:05 +0200 Subject: [PATCH 08/18] Mark Package B as done in the mitigation plan Co-Authored-By: Claude Sonnet 5 --- .../2026-09-29-high-findings-validation-and-mitigation-plan.md | 1 + 1 file changed, 1 insertion(+) diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md index 9b2315d..9b4aa47 100644 --- a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -55,6 +55,7 @@ Ranked by importance to the tool's core promise (protecting secrets), not by imp - **Package A โ€” "filter/rule matching correctness" (P07(1), P07(2), P07(3)):** same files (`config.go`'s `Validate`/`MatchRule`, `add.go`'s `addGitattributesPattern`, `filterop.go`'s `Clean`), same underlying defect class (a registered rule doesn't actually guarantee git and nebel agree on what's matched), same test setup. Do this as one PR โ€” it's also the single highest-priority fix, so it should be first regardless of grouping. - **Status: done** (commit `7acffc9` on branch `worktree-audit-mitigation-plan`). `Clean`/`Smudge` now return `filterop.ErrNoMatchingRule` instead of silently passing content through when no rule matches a path git invoked the filter for; `Config.Validate` rejects a syntactically invalid glob via `doublestar.ValidatePattern`; `addGitattributesPattern` escapes leading `#`/`!` and embedded spaces. A new e2e test reproduces the exact P07(1) scenario (bare `*.env` glob, file in a subdirectory) against a real git repository and was confirmed to fail against the pre-fix code before passing against the fix. Full existing test suite (`go test ./...`) passes unchanged. - **Package B โ€” "fail-closed field resolution" (P03, P04):** different files (`path.go`/`json.go` vs. the same), but the identical defensive pattern (detect an ambiguous/duplicate field target and hard-error via `required=true` instead of silently protecting only one candidate). Natural to design and review together even though the code changes are in different functions. + - **Status: done** (commit `081f639` on branch `worktree-audit-mitigation-plan`). Both turned out to be one fix: `Locate` now cross-checks the configured path against the existing `Leaves()` walk and refuses with a new `ErrAmbiguousPath` if more than one leaf shares that path string, before resolving to any of them. This catches P03's literal-dot-vs-nested collision for both formats, and P04's JSON duplicate-key case for free (go-yaml's parser already rejects a literal duplicate YAML key on its own, confirmed empirically โ€” only JSON needed this part). Verified directly against the pre-fix code: it silently returned the wrong/first value with no error in both repro cases. Full existing test suite passes unchanged. - **Package C โ€” P02 alone**, but worth opening the YAML renderer "under the hood" only once: if this work is scheduled, consider folding in the audit's medium-priority P10 (control characters not escaped) and P11 (multi-document YAML only partially handled) at the same time, since they touch the exact same rendering/parsing code path and the same test harness โ€” doing them separately means paying the review/regression-risk cost of touching `yaml.go`'s scalar handling three times instead of once. (P10/P11 are not part of this High-severity validation pass; flagged here purely as an efficiency note.) - **Package D โ€” P01 alone.** Self-contained (`gitutil.go`/`init.go`), no shared code with the others โ€” can be done in parallel by a different engineer with no coordination cost. - **Package E โ€” P06, and worth bundling with the audit's separate (non-defect) "harden local key storage" suggestion.** A single fix โ€” a dedicated `0600` key file instead of `git config` โ€” addresses both the argv-exposure bug and that hardening suggestion at once. From 7d63b6f14cd5150eba52ea2d35896be0e1ad8efe Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:00:40 +0200 Subject: [PATCH 09/18] Fix Package C: quote-aware YAML comment truncation (P02) scalarText truncated a scalar token's Origin at the first " #" with no awareness of quoting, so a quoted value like password: "abc # geheim" was truncated to "abc, leaving the untruncated remainder (# geheim") as literal plaintext in the git blob right next to the encrypted tag, since the full value was still what got encrypted into the tag. Verified empirically against goccy/go-yaml (not just by reading the code) that a quoted scalar's Origin is, in every case tested - with or without a following real comment, with or without trailing whitespace, at end of file or followed by more document - always exactly the quoted literal verbatim, with no trailing trivia ever folded in. So the fix does not need to parse or search quoted content at all: scalarText now returns a quoted scalar's trimmed Origin as-is, and only applies the " #" search to plain (unquoted) scalars, where it was originally aimed and remains correct (a plain scalar's Origin can never contain " #" as its own content in the first place - the lexer itself treats that sequence as the start of a comment while still scanning the scalar, whatever the author intended). Verified directly against the pre-fix code: Locate on password: "abc # geheim" returned span [10:14) = "abc (4 bytes) while span.Value was already the full, correctly-parsed "abc # geheim" - the exact partial-plaintext-leak mechanism the audit described. Found and fixed along the way, not part of the audited P02 itself: ast.LiteralNode (go-yaml's AST type for both | literal and > folded block scalars) wraps a header token (just the indicator character) separate from its actual content token, and its GetToken() - which Locate and Leaves used unconditionally - returns only the header. Confirmed directly against the pre-fix code that Locate on a block scalar field returned span [10:11) = "|" with no error: a mode: value rule naming such a field would splice a ciphertext tag over the single header character, destroying the document instead of protecting the secret beneath it. Locate now refuses this with a new ErrBlockScalarUnsupported instead, and Leaves no longer offers such a field to nebel add field's picker. There is no existing format support to fall back on for these styles; refusing outright is the safe behavior pending proper support. Full existing test suite passes unchanged. Co-Authored-By: Claude Sonnet 5 --- internal/format/format_test.go | 109 +++++++++++++++++++++++++++++++++ internal/format/yaml.go | 55 ++++++++++++++++- 2 files changed, 162 insertions(+), 2 deletions(-) diff --git a/internal/format/format_test.go b/internal/format/format_test.go index 00aef32..e914ebe 100644 --- a/internal/format/format_test.go +++ b/internal/format/format_test.go @@ -132,6 +132,115 @@ func TestLocate(t *testing.T) { } } +// Regression test for the 2026-09-29 audit's P02: a quoted YAML scalar +// containing a literal " #" (space-hash) inside the quotes must locate as +// its full quoted literal, not be truncated at the in-quote "#" as if it +// were a trailing comment. Splicing over a truncated span, as the pre-fix +// code did, would leave the untruncated remainder as literal plaintext in +// the git blob right next to the encrypted tag โ€” confirmed directly +// against the pre-fix code (see the commit message). +func TestLocateQuotedScalarWithHash(t *testing.T) { + for _, tt := range []struct { + name string + src string + wantRaw string + wantValue string + }{ + {"double-quoted, hash inside, no trailing comment", + `password: "abc # geheim"` + "\n", + `"abc # geheim"`, "abc # geheim"}, + {"single-quoted, hash inside, no trailing comment", + `password: 'abc # geheim'` + "\n", + `'abc # geheim'`, "abc # geheim"}, + {"double-quoted, hash inside, plus a real trailing comment", + `password: "abc # geheim" # a real comment` + "\n", + `"abc # geheim"`, "abc # geheim"}, + {"double-quoted, hash inside, no trailing newline", + `password: "abc # geheim"`, + `"abc # geheim"`, "abc # geheim"}, + } { + t.Run(tt.name, func(t *testing.T) { + h, err := For("c.yaml") + if err != nil { + t.Fatal(err) + } + span, err := h.Locate([]byte(tt.src), "password") + if err != nil { + t.Fatalf("Locate: %v", err) + } + if got := tt.src[span.Start:span.End]; got != tt.wantRaw { + t.Errorf("span covers %q, want %q", got, tt.wantRaw) + } + if span.Value != tt.wantValue { + t.Errorf("Value = %q, want %q", span.Value, tt.wantValue) + } + + // The real-world consequence: splicing an encrypted tag over + // this span must leave nothing of the secret in the result. + const tagText = `"ENC[AES256_SIV,data:AAAA,type:str]"` + out, err := Splice([]byte(tt.src), []Edit{{Span: span, Text: tagText}}) + if err != nil { + t.Fatalf("Splice: %v", err) + } + if strings.Contains(string(out), "geheim") { + t.Errorf("spliced output still contains plaintext: %q", out) + } + }) + } +} + +// A plain (unquoted) scalar's own trailing comment must still be stripped +// exactly as before โ€” this fix must not regress the case scalarText was +// originally written for. +func TestLocatePlainScalarWithTrailingComment(t *testing.T) { + h, err := For("c.yaml") + if err != nil { + t.Fatal(err) + } + src := "password: abc # a real comment\n" + span, err := h.Locate([]byte(src), "password") + if err != nil { + t.Fatalf("Locate: %v", err) + } + if got := src[span.Start:span.End]; got != "abc" { + t.Errorf("span covers %q, want %q", got, "abc") + } +} + +// Regression test for a corruption bug found while fixing P02: go-yaml's +// AST represents a literal (|) or folded (>) block scalar with a header +// token (just the "|"/">" indicator) separate from its actual content +// token, and *ast.LiteralNode.GetToken() โ€” which Locate used +// unconditionally โ€” returns only the header. Before this guard, Locate +// would splice a ciphertext tag over the single header character, +// destroying the document instead of protecting the secret beneath it. +func TestLocateRejectsBlockScalars(t *testing.T) { + for _, tt := range []struct{ name, src string }{ + {"literal block", "password: |\n line one\n line two\n"}, + {"folded block", "password: >\n line one\n line two\n"}, + } { + t.Run(tt.name, func(t *testing.T) { + h, err := For("c.yaml") + if err != nil { + t.Fatal(err) + } + if _, err := h.Locate([]byte(tt.src), "password"); !errors.Is(err, ErrBlockScalarUnsupported) { + t.Errorf("Locate() error = %v, want %v", err, ErrBlockScalarUnsupported) + } + + leaves, err := h.Leaves([]byte(tt.src)) + if err != nil { + t.Fatalf("Leaves: %v", err) + } + for _, leaf := range leaves { + if leaf.Path == "password" { + t.Errorf("Leaves() offered a block scalar field: %+v", leaf) + } + } + }) + } +} + // The CRLF regression: go-yaml's own Line/Column tracking miscounts // against raw "\r\n" โ€” a real-world case, not a hypothetical one, since // Windows checking out a repo with core.autocrlf on reintroduces "\r" diff --git a/internal/format/yaml.go b/internal/format/yaml.go index 22de9ba..75b567b 100644 --- a/internal/format/yaml.go +++ b/internal/format/yaml.go @@ -5,6 +5,7 @@ package format import ( "bytes" + "errors" "fmt" "strings" @@ -61,6 +62,9 @@ func (h yamlHandler) Locate(src []byte, path string) (Span, error) { } } + if _, isBlock := node.(*ast.LiteralNode); isBlock { + return Span{}, fmt.Errorf("%w: %q", ErrBlockScalarUnsupported, path) + } scalar, ok := node.(ast.ScalarNode) if !ok { return Span{}, fmt.Errorf("%w: %q is a %s", ErrNotScalar, path, node.Type()) @@ -68,6 +72,22 @@ func (h yamlHandler) Locate(src []byte, path string) (Span, error) { return yamlSpan(src, m, scalar.GetToken(), path) } +// ErrBlockScalarUnsupported is returned when a configured path resolves to +// a literal (|) or folded (>) block scalar. +// +// *ast.LiteralNode (go-yaml's AST type for both styles) wraps two tokens: +// a header token holding just the "|" or ">" indicator itself, and a +// separate Value token holding the actual decoded multi-line text. +// *ast.LiteralNode satisfies ast.ScalarNode, and its GetToken() returns +// only the header โ€” so treating it as an ordinary scalar, as this handler +// did before this check existed, would locate and splice a ciphertext tag +// over the single header character, corrupting the document instead of +// protecting the secret underneath it. This was found while fixing P02, +// not part of the audit that motivated it; there is no format-side +// handling for these styles to fall back on, so refusing them outright is +// the safe behavior until they're properly supported. +var ErrBlockScalarUnsupported = errors.New("format: literal (|) and folded (>) block scalars are not supported as mode: value fields") + // crlfMap translates byte offsets computed against a CRLF-normalized copy // of a source buffer (every "\r\n" replaced by "\n") back to offsets in // the original buffer. @@ -182,10 +202,36 @@ func yamlSpan(src []byte, m crlfMap, tk *token.Token, path string) (Span, error) } // scalarText strips the trivia the lexer folds into a token's Origin: the -// surrounding whitespace, and any comment that follows the value on the -// same line. +// surrounding whitespace, and โ€” for a plain (unquoted) scalar only โ€” any +// comment that follows the value on the same line. +// +// A quoted scalar's Origin is, verified empirically against goccy/go-yaml, +// always exactly the quoted literal verbatim (opening quote through +// closing quote), with no trailing trivia of any kind ever folded in โ€” +// not a following comment, not trailing whitespace, regardless of what +// follows it in the source. Searching it for " #" would instead find one +// *inside* the quotes, wrongly truncating a value like `"abc # geheim"` +// to `"abc` and leaving the rest (`# geheim"`) as literal plaintext next +// to the encrypted tag (audit 2026-09-29, P02) โ€” so a quoted scalar's +// trimmed Origin is returned as-is, unsearched. +// +// A plain scalar's Origin can never legitimately contain " #" as its own +// content in the first place: the YAML lexer itself treats " #" as the +// start of a comment and stops accumulating a plain scalar's Origin right +// there, whatever the author intended. The search below is therefore a +// no-op in practice for a well-formed plain scalar token; it is kept as +// the one non-quoted path through this function, rather than special- +// cased away, so a lexer that ever did fold trailing trivia in for some +// plain-scalar edge case would still be handled instead of silently +// trusted. func scalarText(origin string) string { text := strings.TrimSpace(origin) + if text == "" { + return text + } + if text[0] == '"' || text[0] == '\'' { + return text + } if hash := strings.Index(text, " #"); hash >= 0 { text = strings.TrimRight(text[:hash], " \t") } @@ -302,6 +348,11 @@ func (yamlHandler) Leaves(src []byte) ([]Leaf, error) { for i, item := range n.Values { walk(item, indexPath(path, i)) } + case *ast.LiteralNode: + // A block scalar (|, >) is never offered: see + // ErrBlockScalarUnsupported. This case must come before the + // ast.ScalarNode one below, which *ast.LiteralNode also + // satisfies but would report the wrong token. case ast.ScalarNode: // A scalar at the document root has no path to address it by. if path != "" { From dffd561a2e8c486d30497f8e3d66d0d1d9598067 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:01:10 +0200 Subject: [PATCH 10/18] Mark Package C as done in the mitigation plan, note the block-scalar bonus finding Co-Authored-By: Claude Sonnet 5 --- .../2026-09-29-high-findings-validation-and-mitigation-plan.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md index 9b4aa47..3c6313b 100644 --- a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -57,6 +57,8 @@ Ranked by importance to the tool's core promise (protecting secrets), not by imp - **Package B โ€” "fail-closed field resolution" (P03, P04):** different files (`path.go`/`json.go` vs. the same), but the identical defensive pattern (detect an ambiguous/duplicate field target and hard-error via `required=true` instead of silently protecting only one candidate). Natural to design and review together even though the code changes are in different functions. - **Status: done** (commit `081f639` on branch `worktree-audit-mitigation-plan`). Both turned out to be one fix: `Locate` now cross-checks the configured path against the existing `Leaves()` walk and refuses with a new `ErrAmbiguousPath` if more than one leaf shares that path string, before resolving to any of them. This catches P03's literal-dot-vs-nested collision for both formats, and P04's JSON duplicate-key case for free (go-yaml's parser already rejects a literal duplicate YAML key on its own, confirmed empirically โ€” only JSON needed this part). Verified directly against the pre-fix code: it silently returned the wrong/first value with no error in both repro cases. Full existing test suite passes unchanged. - **Package C โ€” P02 alone**, but worth opening the YAML renderer "under the hood" only once: if this work is scheduled, consider folding in the audit's medium-priority P10 (control characters not escaped) and P11 (multi-document YAML only partially handled) at the same time, since they touch the exact same rendering/parsing code path and the same test harness โ€” doing them separately means paying the review/regression-risk cost of touching `yaml.go`'s scalar handling three times instead of once. (P10/P11 are not part of this High-severity validation pass; flagged here purely as an efficiency note.) + - **Status: done** (commit `7d63b6f` on branch `worktree-audit-mitigation-plan`; P10/P11 were not folded in โ€” still open). `scalarText` no longer searches a quoted scalar's Origin for a trailing comment at all: verified empirically that a quoted scalar's Origin is always exactly the quoted literal verbatim with no trailing trivia ever folded in, so the search โ€” which was finding a false match *inside* the quotes โ€” is simply skipped for quoted scalars, and kept only for plain scalars, where it's a no-op in practice (the lexer itself can never let " #" survive into a plain scalar's own Origin). Verified directly against the pre-fix code: `Locate` on a quoted value containing " #" returned a 4-byte span while `span.Value` was already the full, correct value โ€” the exact partial-plaintext-leak mechanism. + - **Bonus finding, not in the original audit:** while fixing this, discovered that literal (`|`) and folded (`>`) block scalars are already silently corrupted by the pre-fix code โ€” `ast.LiteralNode.GetToken()` returns only the block's header token, not its content, so `Locate` would splice a ciphertext tag over the single `|`/`>` character. Confirmed directly against the pre-fix code. Added a new `ErrBlockScalarUnsupported` so this now fails loudly instead; proper block-scalar support remains unimplemented and out of scope here. - **Package D โ€” P01 alone.** Self-contained (`gitutil.go`/`init.go`), no shared code with the others โ€” can be done in parallel by a different engineer with no coordination cost. - **Package E โ€” P06, and worth bundling with the audit's separate (non-defect) "harden local key storage" suggestion.** A single fix โ€” a dedicated `0600` key file instead of `git config` โ€” addresses both the argv-exposure bug and that hardening suggestion at once. - **Package F โ€” P05, standalone, last.** Breaking ciphertext-format change with its own migration path; do not bundle with anything else, since it needs its own versioned release and rollout communication independent of all other fixes. From ad0ceb78525b8a69898b991b5973cda40ee56049 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:10:19 +0200 Subject: [PATCH 11/18] Fix Package D: refuse to discard local work on re-init (P01) CheckoutAll's os.Remove-then-checkout had no backup step at all: it unconditionally deletes every managed file, then restores each from `git checkout HEAD -- `, which overwrites the working tree from HEAD regardless of what's in the index or in an unstaged edit. Both `nebel init` (repeated) and `nebel init --version N` call this, so an ordinary re-init could silently destroy uncommitted work with no warning. Added DirtyFiles, which runs `git diff --name-only HEAD -- ` - this single command covers staged and unstaged changes alike, since it compares the working tree directly against HEAD regardless of the index. CheckoutAll now calls it before touching anything and refuses with a new ErrDirtyManagedFiles, naming every dirty path, if any managed file differs from HEAD. Verified directly against the pre-fix code with a standalone probe: an unstaged edit to a managed file was silently destroyed by CheckoutAll - it returned decrypted=1, failures=nil, err=nil, and the file's content reverted to what was committed, with the local edit gone. With the fix, the same scenario (both unstaged and staged variants) is refused outright via ErrDirtyManagedFiles, with the local edit left completely untouched; a clean repo (the ordinary post-init case) still succeeds normally. go build, go vet, and go test all pass on internal/gitutil. Co-Authored-By: Claude Sonnet 5 --- internal/gitutil/gitutil.go | 49 ++++++++++++++++++ internal/gitutil/gitutil_test.go | 89 ++++++++++++++++++++++++++++++++ 2 files changed, 138 insertions(+) diff --git a/internal/gitutil/gitutil.go b/internal/gitutil/gitutil.go index 9752837..635086f 100644 --- a/internal/gitutil/gitutil.go +++ b/internal/gitutil/gitutil.go @@ -184,6 +184,40 @@ func IsShallow(repoRoot string) (bool, error) { return strings.TrimSpace(string(out)) == "true", nil } +// ErrDirtyManagedFiles is returned when CheckoutAll is asked to re-smudge +// a managed file that has staged or unstaged local changes. Removing and +// re-checking-out such a file, as CheckoutAll otherwise unconditionally +// does, would silently discard that work: `git checkout HEAD -- ` +// overwrites the working tree from HEAD regardless of the index or of any +// unstaged edit, and CheckoutAll's own preceding os.Remove has no backup +// step of its own either (audit 2026-09-29, P01). +var ErrDirtyManagedFiles = errors.New("gitutil: managed file(s) have local changes CheckoutAll would discard") + +// DirtyFiles returns the subset of files (repo-relative paths) whose +// working tree content differs from HEAD โ€” staged and unstaged changes +// alike, since `git diff HEAD --` compares the working tree directly +// against HEAD regardless of what's in the index. That is exactly what +// matters to a caller about to overwrite the working tree from HEAD: an +// edit only staged, not committed, is just as much at risk as one that +// was never staged at all. +func DirtyFiles(repoRoot string, files []string) ([]string, error) { + if len(files) == 0 { + return nil, nil + } + args := append([]string{"diff", "--name-only", "HEAD", "--"}, files...) + cmd := exec.Command("git", args...) + cmd.Dir = repoRoot + out, err := cmd.Output() + if err != nil { + return nil, fmt.Errorf("gitutil: git diff HEAD: %w", wrapExitErr(err)) + } + trimmed := strings.TrimSpace(string(out)) + if trimmed == "" { + return nil, nil + } + return strings.Split(trimmed, "\n"), nil +} + // CheckoutFailure records why one managed file couldn't be re-smudged โ€” // git's own trimmed error output, which already carries nebel's specific // message (AC-6.9's tamper error, say) rather than a cause CheckoutAll's @@ -223,6 +257,16 @@ type CheckoutFailure struct { // // decrypted+len(failures) == total managed files; total == 0 means no // managed files exist at all (e.g. .gitattributes was never committed). +// +// Before touching anything, every managed file is checked against HEAD +// (DirtyFiles): CheckoutAll's own os.Remove-then-checkout has no backup +// step, and `git checkout HEAD -- ` restores from HEAD regardless +// of the index, so a staged or unstaged local edit would otherwise be +// silently discarded (audit 2026-09-29, P01) โ€” this is reachable through +// an ordinary repeated `nebel init` or `nebel init --version N`, not only +// through unusual input, so refusing outright rather than proceeding is +// the safe default; the caller decides how to advise the user from there +// (commit or stash first, typically). func CheckoutAll(repoRoot string) (decrypted int, failures []CheckoutFailure, err error) { files, err := ManagedFiles(repoRoot) if err != nil { @@ -231,6 +275,11 @@ func CheckoutAll(repoRoot string) (decrypted int, failures []CheckoutFailure, er if len(files) == 0 { return 0, nil, nil } + if dirty, dirtyErr := DirtyFiles(repoRoot, files); dirtyErr != nil { + return 0, nil, dirtyErr + } else if len(dirty) > 0 { + return 0, nil, fmt.Errorf("%w: %s", ErrDirtyManagedFiles, strings.Join(dirty, ", ")) + } for _, f := range files { if err := os.Remove(filepath.Join(repoRoot, f)); err != nil && !os.IsNotExist(err) { diff --git a/internal/gitutil/gitutil_test.go b/internal/gitutil/gitutil_test.go index adb5253..5a6557d 100644 --- a/internal/gitutil/gitutil_test.go +++ b/internal/gitutil/gitutil_test.go @@ -4,6 +4,7 @@ package gitutil import ( + "errors" "os" "os/exec" "path/filepath" @@ -276,3 +277,91 @@ func TestCheckoutAllIsolatesPerFileSmudgeFailures(t *testing.T) { t.Errorf("bad.txt = %q, want the raw committed blob %q", bad, "bad-plaintext\n") } } + +// registerCatFilter wires the nebel filter to a no-op "cat" for both +// directions, enough for CheckoutAll's dirty-check to be exercised +// without needing a real clean/smudge transform. +func registerCatFilter(t *testing.T, dir string) { + t.Helper() + run := func(args ...string) { + cmd := exec.Command("git", args...) + cmd.Dir = dir + if out, err := cmd.CombinedOutput(); err != nil { + t.Fatalf("git %v: %v\n%s", args, err, out) + } + } + run("config", "filter.nebel.clean", "cat") + run("config", "filter.nebel.smudge", "cat") + run("config", "filter.nebel.required", "true") +} + +// Regression test for the 2026-09-29 audit's P01: CheckoutAll's +// os.Remove-then-checkout has no backup step, and `git checkout HEAD --` +// restores from HEAD regardless of the index โ€” so before this fix, a +// repeated `nebel init` (which calls CheckoutAll) silently discarded any +// local edit to a managed file, staged or not. Both must now be refused +// outright, with the local edit left completely untouched. +func TestCheckoutAllRefusesDirtyManagedFiles(t *testing.T) { + for _, tt := range []struct { + name string + stage bool + }{ + {"unstaged edit", false}, + {"staged edit", true}, + } { + t.Run(tt.name, func(t *testing.T) { + dir := newTempRepo(t) + if err := os.WriteFile(filepath.Join(dir, ".gitattributes"), []byte("*.txt filter=nebel\n"), 0o644); err != nil { + t.Fatal(err) + } + writeAndCommit(t, dir, "secret.txt", "original\n") + registerCatFilter(t, dir) + + const edited = "locally edited, not yet committed\n" + path := filepath.Join(dir, "secret.txt") + if err := os.WriteFile(path, []byte(edited), 0o644); err != nil { + t.Fatal(err) + } + if tt.stage { + cmd := exec.Command("git", "add", "--", "secret.txt") + cmd.Dir = dir + if out, err := cmd.CombinedOutput(); err != nil { + t.Fatalf("git add: %v\n%s", err, out) + } + } + + _, _, err := CheckoutAll(dir) + if !errors.Is(err, ErrDirtyManagedFiles) { + t.Fatalf("CheckoutAll() error = %v, want %v", err, ErrDirtyManagedFiles) + } + + got, err := os.ReadFile(path) + if err != nil { + t.Fatalf("secret.txt was removed despite CheckoutAll refusing: %v", err) + } + if string(got) != edited { + t.Errorf("secret.txt = %q, want the local edit left untouched: %q", got, edited) + } + }) + } +} + +// The ordinary case CheckoutAll exists for โ€” no local changes at all, as +// right after `nebel init` on a fresh clone โ€” must not be blocked by the +// new dirty check. +func TestCheckoutAllSucceedsWhenNothingIsDirty(t *testing.T) { + dir := newTempRepo(t) + if err := os.WriteFile(filepath.Join(dir, ".gitattributes"), []byte("*.txt filter=nebel\n"), 0o644); err != nil { + t.Fatal(err) + } + writeAndCommit(t, dir, "secret.txt", "original\n") + registerCatFilter(t, dir) + + decrypted, failures, err := CheckoutAll(dir) + if err != nil { + t.Fatalf("CheckoutAll: %v", err) + } + if decrypted != 1 || len(failures) != 0 { + t.Errorf("CheckoutAll() = decrypted=%d failures=%v, want decrypted=1, no failures", decrypted, failures) + } +} From db2834d320a7e7a2b88c4ca5e89fec4e9c2fb692 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:10:58 +0200 Subject: [PATCH 12/18] Mark Package D as done in the mitigation plan Co-Authored-By: Claude Sonnet 5 --- .../2026-09-29-high-findings-validation-and-mitigation-plan.md | 1 + 1 file changed, 1 insertion(+) diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md index 3c6313b..19e9577 100644 --- a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -60,6 +60,7 @@ Ranked by importance to the tool's core promise (protecting secrets), not by imp - **Status: done** (commit `7d63b6f` on branch `worktree-audit-mitigation-plan`; P10/P11 were not folded in โ€” still open). `scalarText` no longer searches a quoted scalar's Origin for a trailing comment at all: verified empirically that a quoted scalar's Origin is always exactly the quoted literal verbatim with no trailing trivia ever folded in, so the search โ€” which was finding a false match *inside* the quotes โ€” is simply skipped for quoted scalars, and kept only for plain scalars, where it's a no-op in practice (the lexer itself can never let " #" survive into a plain scalar's own Origin). Verified directly against the pre-fix code: `Locate` on a quoted value containing " #" returned a 4-byte span while `span.Value` was already the full, correct value โ€” the exact partial-plaintext-leak mechanism. - **Bonus finding, not in the original audit:** while fixing this, discovered that literal (`|`) and folded (`>`) block scalars are already silently corrupted by the pre-fix code โ€” `ast.LiteralNode.GetToken()` returns only the block's header token, not its content, so `Locate` would splice a ciphertext tag over the single `|`/`>` character. Confirmed directly against the pre-fix code. Added a new `ErrBlockScalarUnsupported` so this now fails loudly instead; proper block-scalar support remains unimplemented and out of scope here. - **Package D โ€” P01 alone.** Self-contained (`gitutil.go`/`init.go`), no shared code with the others โ€” can be done in parallel by a different engineer with no coordination cost. + - **Status: done** (commit `ad0ceb7` on branch `worktree-audit-mitigation-plan`). Added `gitutil.DirtyFiles`, which runs a single `git diff --name-only HEAD -- ` to catch staged and unstaged changes alike; `CheckoutAll` now calls it before touching anything and refuses with a new `ErrDirtyManagedFiles` naming every dirty path. Verified directly against the pre-fix code with a standalone probe: an unstaged edit to a managed file was silently destroyed (`CheckoutAll` returned `decrypted=1, failures=nil, err=nil`, and the file's content reverted to HEAD with the edit gone). A clean repo (the ordinary post-`init` case) is confirmed to still succeed normally. - **Package E โ€” P06, and worth bundling with the audit's separate (non-defect) "harden local key storage" suggestion.** A single fix โ€” a dedicated `0600` key file instead of `git config` โ€” addresses both the argv-exposure bug and that hardening suggestion at once. - **Package F โ€” P05, standalone, last.** Breaking ciphertext-format change with its own migration path; do not bundle with anything else, since it needs its own versioned release and rollout communication independent of all other fixes. From 8b830ea9b2b5e6d6d9694f6c5aea957678441871 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:15:49 +0200 Subject: [PATCH 13/18] Fix Package E: stop passing the derived key as a subprocess argument (P06) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit localkey.Set base64-encoded the full derived key and passed it to gitutil.ConfigSet, which runs `git config --local ` with the key as a literal subprocess argument. During that subprocess's (brief) runtime, the ready-to-use decryption key sat in its argument list, readable by any other local user or process with sufficient privilege via /proc//cmdline. This is the same class of exposure cmd/nebel/password.go's ErrPasswordArgument already refuses for the shared password itself; the derived key wasn't getting the same protection. Set now writes keys to a new dedicated file (internal/localkey's keyFileName, "nebel-keys") inside the git directory shared across every worktree of a clone (resolved via `git rev-parse --git-common-dir`, run directly rather than through gitutil, to keep this fix self-contained), with 0600 permissions โ€” owner read/write only, tighter than .git/config's ambient permissions, which also answers a related "harden local key storage" suggestion from the same audit. This never puts the key on any process's argument list. Backward compatibility: Get and All still fall back to the legacy git-config location for any version registered there before this fix shipped, so an existing clone keeps working without needing to re-run `nebel init`. New registrations always go to the key file; nothing already in git config is migrated or removed. Several cmd/nebel e2e tests asserted directly on the old storage mechanism (`git config --local --get filter.nebel.key...`) as their way of checking whether a key was or wasn't registered; three of them failed outright once Set stopped writing there, and two others (which only checked for the key's *absence*) would have kept passing but vacuously, no longer proving what they claimed. Added a shared registeredKeyValue test helper that checks the actual current storage (the key file, falling back to legacy git config, mirroring internal/localkey.Get's own precedence) and updated all five call sites to use it. Verified directly against the pre-fix code: calling Set left the raw base64 key sitting in plain `.git/config` file content under `[filter "nebel"] key = ...` โ€” written by exactly the `git config --local` subprocess call whose argument list this fix removes the key from. The audit's actual concern, the key's brief appearance in that subprocess's own argv, isn't itself observable from within a Go test (the subprocess exits before a test could inspect it); proving the key no longer ends up as a plain git-config value at all is the most direct available proxy, since getting it there is exactly what required passing it as that argument in the first place. Full existing test suite passes unchanged, including cmd/nebel's e2e suite (which exercises the full init/rotate/checkout flow depending on localkey end-to-end). Co-Authored-By: Claude Sonnet 5 --- cmd/nebel/e2e_test.go | 36 +++- cmd/nebel/init_version_e2e_test.go | 6 +- cmd/nebel/password_e2e_test.go | 4 +- cmd/nebel/rotate_e2e_test.go | 8 +- internal/localkey/localkey.go | 263 ++++++++++++++++++++++++----- internal/localkey/localkey_test.go | 88 ++++++++-- 6 files changed, 345 insertions(+), 60 deletions(-) diff --git a/cmd/nebel/e2e_test.go b/cmd/nebel/e2e_test.go index 41d90c5..5c889ac 100644 --- a/cmd/nebel/e2e_test.go +++ b/cmd/nebel/e2e_test.go @@ -10,6 +10,7 @@ import ( "os/exec" "path/filepath" "runtime" + "strings" "sync" "testing" ) @@ -92,6 +93,37 @@ func runInExpectingError(t *testing.T, dir, pathEnv, name string, args ...string return string(out), err } +// registeredKeyValue returns the raw stored value (a base64-encoded key) +// for version in dir's local key storage, treating nebel as a black box +// rather than assuming which of its two storage locations actually holds +// it: the key file it writes to as of the 2026-09-29 audit's P06 fix +// (internal/localkey's keyFileName), checked first, falling back to the +// legacy git-config location a version could still be registered under โ€” +// mirroring internal/localkey.Get's own precedence, so these tests keep +// working regardless of which one a given key landed in. +func registeredKeyValue(t *testing.T, dir, pathEnv string, version int) (string, bool) { + t.Helper() + commonDir := strings.TrimSpace(runIn(t, dir, pathEnv, "git", "rev-parse", "--git-common-dir")) + if data, err := os.ReadFile(filepath.Join(dir, commonDir, "nebel-keys")); err == nil { + prefix := fmt.Sprintf("%d=", version) + for _, line := range strings.Split(string(data), "\n") { + if val, ok := strings.CutPrefix(line, prefix); ok { + return val, true + } + } + } + + name := "filter.nebel.key" + if version != 1 { + name = fmt.Sprintf("filter.nebel.key%d", version) + } + val, ok, err := getLocalConfig(t, dir, pathEnv, name) + if err != nil { + return "", false + } + return val, ok +} + // initWithPassword runs `nebel init`, supplying the password through // the environment โ€” the command line no longer accepts one. func initWithPassword(t *testing.T, dir, pathEnv, password string) { @@ -233,14 +265,14 @@ func TestJoinWithWrongPasswordFails(t *testing.T) { repo := newTestRepo(t, pathEnv) initWithPassword(t, repo, pathEnv, "correct-password") - keyBefore := runIn(t, repo, pathEnv, "git", "config", "--local", "--get", "filter.nebel.key") + keyBefore, _ := registeredKeyValue(t, repo, pathEnv, 1) out, err := runInitWith(t, repo, pathEnv, []string{passwordEnv + "=wrong-password"}, "") if err == nil { t.Fatalf("nebel init with wrong password: want an error, got success: %s", out) } - keyAfter := runIn(t, repo, pathEnv, "git", "config", "--local", "--get", "filter.nebel.key") + keyAfter, _ := registeredKeyValue(t, repo, pathEnv, 1) if keyBefore != keyAfter { t.Error("wrong password changed the registered local key") } diff --git a/cmd/nebel/init_version_e2e_test.go b/cmd/nebel/init_version_e2e_test.go index 054ab8e..c6881c1 100644 --- a/cmd/nebel/init_version_e2e_test.go +++ b/cmd/nebel/init_version_e2e_test.go @@ -87,8 +87,8 @@ func TestInitVersionRecoversContentFromBeforeRotation(t *testing.T) { } // The v2 key registered earlier must still be there. - if _, err := runInExpectingError(t, clone, pathEnv, "git", "config", "--local", "--get", "filter.nebel.key2"); err != nil { - t.Errorf("init --version 1 disturbed the already-registered v2 key: %v", err) + if _, ok := registeredKeyValue(t, clone, pathEnv, 2); !ok { + t.Error("init --version 1 disturbed the already-registered v2 key") } } @@ -104,7 +104,7 @@ func TestInitVersionUnknownFails(t *testing.T) { if err == nil { t.Fatalf("nebel init --version 99: want an error, got success:\n%s", out) } - if _, ok, kerr := getLocalConfig(t, clone, pathEnv, "filter.nebel.key99"); kerr == nil && ok { + if _, ok := registeredKeyValue(t, clone, pathEnv, 99); ok { t.Error("init --version 99 registered a key for a version that doesn't exist") } } diff --git a/cmd/nebel/password_e2e_test.go b/cmd/nebel/password_e2e_test.go index 692f081..3d6a9a8 100644 --- a/cmd/nebel/password_e2e_test.go +++ b/cmd/nebel/password_e2e_test.go @@ -114,7 +114,7 @@ func TestInitRejectsPasswordArgument(t *testing.T) { if !strings.Contains(out, "process list") { t.Errorf("error does not explain the exposure:\n%s", out) } - if _, err := runInExpectingError(t, clone, pathEnv, "git", "config", "--local", "--get", "filter.nebel.key"); err == nil { + if _, ok := registeredKeyValue(t, clone, pathEnv, 1); ok { t.Error("a refused init registered a local key") } } @@ -138,7 +138,7 @@ func TestInitWithoutAnyPasswordSourceFails(t *testing.T) { if _, err := os.Stat(filepath.Join(clone, "secrets", "prod.pem")); err != nil { t.Fatal(err) } - if _, err := runInExpectingError(t, clone, pathEnv, "git", "config", "--local", "--get", "filter.nebel.key"); err == nil { + if _, ok := registeredKeyValue(t, clone, pathEnv, 1); ok { t.Error("a failed init registered a local key") } } diff --git a/cmd/nebel/rotate_e2e_test.go b/cmd/nebel/rotate_e2e_test.go index 5405e6a..4e3c291 100644 --- a/cmd/nebel/rotate_e2e_test.go +++ b/cmd/nebel/rotate_e2e_test.go @@ -176,19 +176,19 @@ func TestRotateKeepsOldKeyRegistered(t *testing.T) { pathEnv := pathEnvWithBin(t) origin, plaintext := setupEncryptedOrigin(t, pathEnv, "origin-password") - keyV1Before := runIn(t, origin, pathEnv, "git", "config", "--local", "--get", "filter.nebel.key") + keyV1Before, _ := registeredKeyValue(t, origin, pathEnv, 1) out, err := runRotateWith(t, origin, pathEnv, []string{passwordEnv + "=rotated-password"}, "") if err != nil { t.Fatalf("nebel rotate: %v\n%s", err, out) } - keyV1After := runIn(t, origin, pathEnv, "git", "config", "--local", "--get", "filter.nebel.key") + keyV1After, _ := registeredKeyValue(t, origin, pathEnv, 1) if keyV1Before != keyV1After { t.Error("rotate disturbed the existing version's registered key") } - if _, err := runInExpectingError(t, origin, pathEnv, "git", "config", "--local", "--get", "filter.nebel.key2"); err != nil { - t.Errorf("rotate did not register the new version's key: %v", err) + if _, ok := registeredKeyValue(t, origin, pathEnv, 2); !ok { + t.Error("rotate did not register the new version's key") } // The pre-rotation content, still tagged version 1, must still decrypt. diff --git a/internal/localkey/localkey.go b/internal/localkey/localkey.go index 9cc8c18..4288c3d 100644 --- a/internal/localkey/localkey.go +++ b/internal/localkey/localkey.go @@ -1,9 +1,9 @@ // Copyright (C) 2026 Marwin Moellers // SPDX-License-Identifier: GPL-3.0-or-later -// Package localkey stores derived AES-256-SIV keys in local (per-clone, not -// committed) git config, so their presence or absence is exactly the "has -// this machine run `nebel init`" signal the clean/smudge filter needs for +// Package localkey stores derived AES-256-SIV keys locally (per-clone, not +// committed), so their presence or absence is exactly the "has this +// machine run `nebel init`" signal the clean/smudge filter needs for // no-key passthrough (spec 06 AC-6.6). // // A machine may hold more than one key version at once (spec 11): every @@ -11,31 +11,60 @@ // cached, so it keeps being able to read content tagged with an older // version after the project rotates. // -// Keys sit in plaintext in .git/config on disk. That file is never -// committed or pushed, which is the same trust boundary git-crypt and -// transcrypt rely on for the same purpose. +// Keys sit in plaintext in a dedicated file inside the git directory (see +// keyFileName), never committed or pushed โ€” the same trust boundary +// git-crypt and transcrypt rely on for the same purpose. A version +// registered before this file existed may still be found in the legacy +// location, local (not committed) git config (see readLegacyEntries); Get +// and All both still fall back to it, so an existing clone keeps working +// without needing to re-run `nebel init`. Set only ever writes to the new +// file. package localkey import ( "encoding/base64" "fmt" + "os" + "os/exec" + "path/filepath" + "sort" "strconv" "strings" "github.com/MuffinUser/nebel/internal/gitutil" ) -// configKeyPrefix is the local git config variable every version's key is -// stored under. Git config variable names may not contain "." themselves -// (only section/subsection separators may), so later versions suffix the -// number directly onto the name (key2, key3, ...) rather than adding -// another dot-separated segment. +// configKeyPrefix is the local git config variable a version's key was +// stored under before this file existed (see readLegacyEntries) โ€” still +// read, for backward compatibility, but no longer written. Git config +// variable names may not contain "." themselves (only section/subsection +// separators may), so later versions suffixed the number directly onto +// the name (key2, key3, ...) rather than adding another dot-separated +// segment; version 1 kept the unsuffixed name every clone created before +// key rotation existed already wrote and read. const configKeyPrefix = "filter.nebel.key" -// configKeyFor returns the git config key a given version's derived key is -// stored under. Version 1 keeps the unsuffixed name every clone created -// before key rotation existed already writes and reads โ€” so an upgraded -// binary keeps recognizing a key an older binary registered. +// keyFileName is the file, inside the git directory shared by every +// worktree of a clone (see gitCommonDir), that Set registers a key to. +// +// It replaces `git config --local ` as of the 2026-09-29 +// audit's P06 finding: that is a subprocess invocation, and its only way +// to set a value is to pass it as a literal argument โ€” putting a +// ready-to-use derived decryption key directly into that process's +// argument list, readable by any other local user or process with +// sufficient privilege via /proc//cmdline for as long as the +// subprocess runs. This is the same class of exposure +// cmd/nebel/password.go's ErrPasswordArgument already refuses for the +// shared password itself; the derived key is at least as sensitive, and +// wasn't getting the same protection. Writing this file directly with +// Go's os package instead never puts the key on any process's argument +// list. Its 0o600 permissions (see writeKeyFile) are also a direct answer +// to a related, separate suggestion in the same audit to harden local key +// storage beyond .git/config's ambient permissions. +const keyFileName = "nebel-keys" + +// configKeyFor returns the legacy git config key a given version's key +// used to be stored under. func configKeyFor(version int) string { if version == 1 { return configKeyPrefix @@ -43,39 +72,114 @@ func configKeyFor(version int) string { return fmt.Sprintf("%s%d", configKeyPrefix, version) } -// Get returns the locally registered key for version. ok is false, with a -// nil error, when that version is not registered yet. -func Get(version int) (key []byte, ok bool, err error) { - encoded, ok, err := gitutil.ConfigGet(configKeyFor(version)) - if err != nil || !ok { - return nil, ok, err +// gitCommonDir returns the git directory shared across every worktree of +// this clone, as opposed to a linked worktree's own private git dir. +// Local git config is shared there by default (splitting it per-worktree +// requires the rare extensions.worktreeConfig) โ€” storing the key file +// alongside it keeps it visible to every worktree exactly like the config +// entries it replaces were. +func gitCommonDir() (string, error) { + out, err := exec.Command("git", "rev-parse", "--git-common-dir").Output() + if err != nil { + return "", fmt.Errorf("localkey: git rev-parse --git-common-dir: %w", err) } - key, err = base64.StdEncoding.DecodeString(encoded) + dir := strings.TrimSpace(string(out)) + if !filepath.IsAbs(dir) { + // git commonly reports this relative to the caller's working + // directory (typically ".git") rather than as an absolute path. + abs, err := filepath.Abs(dir) + if err != nil { + return "", fmt.Errorf("localkey: resolving git common dir %q: %w", dir, err) + } + dir = abs + } + return dir, nil +} + +func keyFilePath() (string, error) { + dir, err := gitCommonDir() if err != nil { - return nil, false, fmt.Errorf("localkey: decoding stored key for version %d: %w", version, err) + return "", err } - return key, true, nil + return filepath.Join(dir, keyFileName), nil } -// Set registers key locally as version's key. Existing versions are left -// untouched (spec 11 AC-11.5): a machine that rotates, or fetches an older -// version via `nebel init --version N`, keeps reading everything it could -// read before. -func Set(version int, key []byte) error { - return gitutil.ConfigSet(configKeyFor(version), base64.StdEncoding.EncodeToString(key)) +// readKeyFile parses the key file into version -> base64-encoded key. A +// missing file is not an error: it means Set has never been called on +// this clone, or every key it holds still lives only in the legacy +// git-config location (see readLegacyEntries). +func readKeyFile() (map[int]string, error) { + path, err := keyFilePath() + if err != nil { + return nil, err + } + data, err := os.ReadFile(path) + if err != nil { + if os.IsNotExist(err) { + return map[int]string{}, nil + } + return nil, fmt.Errorf("localkey: reading %s: %w", path, err) + } + + entries := map[int]string{} + for _, line := range strings.Split(string(data), "\n") { + line = strings.TrimSpace(line) + if line == "" { + continue + } + versionStr, encoded, ok := strings.Cut(line, "=") + if !ok { + return nil, fmt.Errorf("localkey: malformed line in %s: %q", path, line) + } + version, err := strconv.Atoi(versionStr) + if err != nil { + return nil, fmt.Errorf("localkey: malformed version in %s: %q", path, line) + } + entries[version] = encoded + } + return entries, nil } -// All returns every version currently registered locally, keyed by version -// number. An empty, non-nil map means no `nebel init` has ever run on this -// clone (spec 06 AC-6.6's no-key passthrough state). -func All() (map[int][]byte, error) { - entries, err := gitutil.ConfigGetRegexp(`^filter\.nebel\.key[0-9]*$`) +// writeKeyFile serializes entries, one "version=base64key" line each in +// ascending version order (so the file diffs sensibly if ever inspected, +// though it is never committed), and writes them to the key file with +// 0o600 permissions โ€” owner read/write only. +func writeKeyFile(entries map[int]string) error { + path, err := keyFilePath() + if err != nil { + return err + } + + versions := make([]int, 0, len(entries)) + for v := range entries { + versions = append(versions, v) + } + sort.Ints(versions) + + var b strings.Builder + for _, v := range versions { + fmt.Fprintf(&b, "%d=%s\n", v, entries[v]) + } + + if err := os.WriteFile(path, []byte(b.String()), 0o600); err != nil { + return fmt.Errorf("localkey: writing %s: %w", path, err) + } + return nil +} + +// readLegacyEntries reads every key still sitting in the pre-P06-fix +// storage location: local (not committed) git config, keyed by the same +// version numbers readKeyFile would use. A clone that registered a +// version before this file existed keeps it there โ€” Set never migrates +// or deletes it โ€” so Get and All both consult this as a fallback. +func readLegacyEntries() (map[int]string, error) { + raw, err := gitutil.ConfigGetRegexp(`^filter\.nebel\.key[0-9]*$`) if err != nil { return nil, fmt.Errorf("localkey: listing registered keys: %w", err) } - keyring := map[int][]byte{} - for name, encoded := range entries { + entries := map[int]string{} + for name, encoded := range raw { version := 1 if suffix, ok := strings.CutPrefix(name, configKeyPrefix); ok && suffix != "" { version, err = strconv.Atoi(suffix) @@ -83,9 +187,90 @@ func All() (map[int][]byte, error) { return nil, fmt.Errorf("localkey: unexpected local config key %q", name) } } - key, err := base64.StdEncoding.DecodeString(encoded) + entries[version] = encoded + } + return entries, nil +} + +func decodeKey(encoded string, version int) ([]byte, error) { + key, err := base64.StdEncoding.DecodeString(encoded) + if err != nil { + return nil, fmt.Errorf("localkey: decoding stored key for version %d: %w", version, err) + } + return key, nil +} + +// Get returns the locally registered key for version. ok is false, with a +// nil error, when that version is not registered yet. +func Get(version int) (key []byte, ok bool, err error) { + entries, err := readKeyFile() + if err != nil { + return nil, false, err + } + if encoded, found := entries[version]; found { + key, err := decodeKey(encoded, version) + return key, true, err + } + + legacy, err := readLegacyEntries() + if err != nil { + return nil, false, err + } + if encoded, found := legacy[version]; found { + key, err := decodeKey(encoded, version) + return key, true, err + } + return nil, false, nil +} + +// Set registers key locally as version's key, writing it to the key file +// (see keyFileName's doc comment for why, in place of git config). Existing +// versions are left untouched (spec 11 AC-11.5): a machine that rotates, +// or fetches an older version via `nebel init --version N`, keeps reading +// everything it could read before โ€” including anything still sitting in +// the legacy git-config location (see readLegacyEntries), which this +// never migrates or removes. +func Set(version int, key []byte) error { + entries, err := readKeyFile() + if err != nil { + return err + } + entries[version] = base64.StdEncoding.EncodeToString(key) + return writeKeyFile(entries) +} + +// All returns every version currently registered locally, keyed by version +// number โ€” merging the key file with anything still left in the legacy +// git-config location (a version present in both, which Set can no longer +// produce going forward, resolves to the key file's copy). An empty, +// non-nil map means no `nebel init` has ever run on this clone (spec 06 +// AC-6.6's no-key passthrough state). +func All() (map[int][]byte, error) { + keyring := map[int][]byte{} + + fileEntries, err := readKeyFile() + if err != nil { + return nil, err + } + for version, encoded := range fileEntries { + key, err := decodeKey(encoded, version) + if err != nil { + return nil, err + } + keyring[version] = key + } + + legacy, err := readLegacyEntries() + if err != nil { + return nil, err + } + for version, encoded := range legacy { + if _, already := keyring[version]; already { + continue + } + key, err := decodeKey(encoded, version) if err != nil { - return nil, fmt.Errorf("localkey: decoding stored key for version %d: %w", version, err) + return nil, err } keyring[version] = key } diff --git a/internal/localkey/localkey_test.go b/internal/localkey/localkey_test.go index c47b221..38c0941 100644 --- a/internal/localkey/localkey_test.go +++ b/internal/localkey/localkey_test.go @@ -5,8 +5,11 @@ package localkey import ( "bytes" + "encoding/base64" "os" "os/exec" + "path/filepath" + "strings" "testing" ) @@ -65,11 +68,21 @@ func TestSetGetRoundTrip(t *testing.T) { } } -// version 1 is stored under the unsuffixed "filter.nebel.key" name โ€” the -// same one every clone created before key rotation existed already reads -// and writes โ€” so an upgraded binary keeps recognizing a key an older -// binary registered. -func TestVersion1UsesLegacyConfigName(t *testing.T) { +// Regression test for the 2026-09-29 audit's P06: Set must never put the +// key anywhere `git config` can reach, since writing it there is exactly +// what required exposing it as a subprocess argument in the first place. +// This directly proves the exposure path is closed: the base64 key must +// not appear anywhere in .git/config's raw file content after Set. +// +// The audit's actual concern โ€” the key briefly appearing in a process's +// argument list, visible to another local user via /proc//cmdline โ€” +// isn't itself observable from a Go test, since the git subprocess that +// used to receive it exits before a test could inspect its argv. Proving +// the key no longer ends up as a plain git-config value at all is the +// most direct available proxy: getting it there is exactly what forced +// passing it as a `git config` argument to begin with, so its absence +// here means that argument was never made. +func TestSetNeverWritesToGitConfig(t *testing.T) { dir := newTempRepo(t) chdir(t, dir) @@ -78,14 +91,69 @@ func TestVersion1UsesLegacyConfigName(t *testing.T) { t.Fatalf("Set: %v", err) } - cmd := exec.Command("git", "config", "--local", "--get", "filter.nebel.key") + configPath := filepath.Join(dir, ".git", "config") + raw, err := os.ReadFile(configPath) + if err != nil { + t.Fatalf("reading .git/config: %v", err) + } + encoded := base64.StdEncoding.EncodeToString(key) + if strings.Contains(string(raw), encoded) { + t.Errorf(".git/config contains the key after Set:\n%s", raw) + } + if strings.Contains(string(raw), "filter.nebel.key") { + t.Errorf(".git/config contains a filter.nebel.key entry after Set:\n%s", raw) + } +} + +// The key file Set writes to must be readable only by its owner โ€” +// tighter than .git/config's ambient permissions, and a direct answer to +// a related "harden local key storage" suggestion from the same audit. +func TestKeyFileHasOwnerOnlyPermissions(t *testing.T) { + dir := newTempRepo(t) + chdir(t, dir) + + if err := Set(1, bytes.Repeat([]byte{0x11}, 64)); err != nil { + t.Fatalf("Set: %v", err) + } + + info, err := os.Stat(filepath.Join(dir, ".git", keyFileName)) + if err != nil { + t.Fatalf("stat key file: %v", err) + } + if perm := info.Mode().Perm(); perm != 0o600 { + t.Errorf("key file permissions = %o, want 0600", perm) + } +} + +// Backward compatibility: a version registered the old way, directly in +// local git config (as every clone did before this fix), must still be +// found by Get and All โ€” an existing clone must keep working without +// needing to re-run `nebel init` just because this shipped. +func TestGetAndAllFallBackToLegacyGitConfig(t *testing.T) { + dir := newTempRepo(t) + chdir(t, dir) + + key := bytes.Repeat([]byte{0x22}, 64) + cmd := exec.Command("git", "config", "--local", "filter.nebel.key", base64.StdEncoding.EncodeToString(key)) cmd.Dir = dir - out, err := cmd.Output() + if out, err := cmd.CombinedOutput(); err != nil { + t.Fatalf("git config: %v\n%s", err, out) + } + + got, ok, err := Get(1) + if err != nil || !ok { + t.Fatalf("Get(1) for a legacy-registered key: ok=%v err=%v", ok, err) + } + if !bytes.Equal(got, key) { + t.Errorf("Get(1) = %x, want %x", got, key) + } + + all, err := All() if err != nil { - t.Fatalf("git config --get filter.nebel.key: %v", err) + t.Fatalf("All: %v", err) } - if len(out) == 0 { - t.Error("version 1's key was not stored under filter.nebel.key") + if !bytes.Equal(all[1], key) { + t.Errorf("All()[1] = %x, want %x", all[1], key) } } From 03738b34d533a24301a555d385c507b6c3fc8fc2 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:16:12 +0200 Subject: [PATCH 14/18] Mark Package E as done in the mitigation plan Co-Authored-By: Claude Sonnet 5 --- .../2026-09-29-high-findings-validation-and-mitigation-plan.md | 1 + 1 file changed, 1 insertion(+) diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md index 19e9577..8ee1a64 100644 --- a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -62,6 +62,7 @@ Ranked by importance to the tool's core promise (protecting secrets), not by imp - **Package D โ€” P01 alone.** Self-contained (`gitutil.go`/`init.go`), no shared code with the others โ€” can be done in parallel by a different engineer with no coordination cost. - **Status: done** (commit `ad0ceb7` on branch `worktree-audit-mitigation-plan`). Added `gitutil.DirtyFiles`, which runs a single `git diff --name-only HEAD -- ` to catch staged and unstaged changes alike; `CheckoutAll` now calls it before touching anything and refuses with a new `ErrDirtyManagedFiles` naming every dirty path. Verified directly against the pre-fix code with a standalone probe: an unstaged edit to a managed file was silently destroyed (`CheckoutAll` returned `decrypted=1, failures=nil, err=nil`, and the file's content reverted to HEAD with the edit gone). A clean repo (the ordinary post-`init` case) is confirmed to still succeed normally. - **Package E โ€” P06, and worth bundling with the audit's separate (non-defect) "harden local key storage" suggestion.** A single fix โ€” a dedicated `0600` key file instead of `git config` โ€” addresses both the argv-exposure bug and that hardening suggestion at once. + - **Status: done** (commit `8b830ea` on branch `worktree-audit-mitigation-plan`). `localkey.Set` now writes to a new `nebel-keys` file (0600) inside the shared git-common-dir instead of via `git config --local ` โ€” closing the subprocess-argv exposure. `Get`/`All` still fall back to the legacy git-config location so an existing clone doesn't need to re-run `nebel init`. Several `cmd/nebel` e2e tests asserted directly on the old git-config storage as their way of checking key registration; updated them (via a new shared `registeredKeyValue` helper) to check the actual current location instead of silently becoming vacuous checks. Verified directly against the pre-fix code: `Set` left the raw base64 key sitting in plain `.git/config` content under `[filter "nebel"] key = ...` โ€” written by exactly the subprocess call this fix removes the key's argument from. Full test suite passes unchanged. - **Package F โ€” P05, standalone, last.** Breaking ciphertext-format change with its own migration path; do not bundle with anything else, since it needs its own versioned release and rollout communication independent of all other fixes. Recommended shipping order: **Package A โ†’ Package B โ†’ Package C โ†’ Package D and Package E in parallel โ†’ Package F** as a separate, later release. From ba8e9aa737644093b4279a9eb33c8d20d47472c2 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:38:39 +0200 Subject: [PATCH 15/18] Fix Package F: authenticate a value's type field (P05) A value tag's type field (type:str, type:bool, ...) sat next to its ciphertext as plaintext metadata, not inside anything SIV authenticated - so changing type:str to type:bool needed no key at all, only write access to the file the tag is stored in. Before this fix, that silently changed how a decrypted string rendered (unquoted, as a boolean or number, instead of a quoted string) without tripping authentication at all. Confirmed live against the pre-fix code: a type:str -> type:bool edit on an untouched ciphertext succeeded with err=nil, and password: "s3cr3t" smudged back as the unquoted password: s3cr3t. This is a breaking ciphertext-tag format change, exactly as flagged in the mitigation plan: every previously-committed value tag was authenticated without its type, so simply adding type to the AAD everywhere would fail every one of them, not just tampered ones. Fixed via the same mechanism spec 03 AC-3.8 already uses to reject an unsupported ALGO: value tags now come in two forms, distinguished by that field. - internal/siv: AAD gained a variadic extra parameter, appended as more length-prefixed components after the existing three - existing 3-argument call sites are unaffected. - internal/tag: a new AlgoAES256SIVTypeBound ("AES256_SIV_TB") identifies a value tag whose type is bound into the AAD. EncodeValue now always produces this form. Parse accepts either this or the legacy AlgoAES256SIV, exposing which one via a new Tag.TypeBound field - false for every whole-file tag (nothing to bind there) and for a legacy value tag, true only for the new form. A type-bound algo naming with no type field at all (nothing to bind) is rejected as malformed rather than silently accepted. - internal/filterop: cleanValues now always encrypts with type included in the AAD (matching what EncodeValue just wrote); smudgeValues reconstructs the AAD Tag.TypeBound calls for - with type for a type-bound tag, without it for a legacy one - so each authenticates against whatever it was actually encrypted under. No separate migration tooling exists or is needed: cleanValues already unconditionally re-encrypts any plaintext field it finds via EncodeValue, so a legacy value converges onto the type-bound form the next time anything re-encrypts it - an ordinary edit, nebel rotate, or git add --renormalize - the same way a value converges onto a new key version today. A legacy tag's type remains unauthenticated until that happens; this is documented as an explicit, understood limitation (TestSmudgeValuesLegacyTagTypeStillUnauthenticated), not an oversight, since re-authenticating it retroactively is exactly what would break every already-committed legacy tag. Verified directly against the pre-fix code (reverting internal/siv/siv.go, internal/tag/tag.go, internal/filterop/filterop.go to HEAD and re-running the new test): flipping type:str to type:bool on a freshly-cleaned tag produced no authentication error and rendered the value unquoted, exactly the vulnerability described above. Restored the fix afterward; full test suite (go build, go vet, go test ./...) passes including cmd/nebel's e2e suite. Also updates specs/03-value-encoding.md with AC-3.10 describing the two tag forms and the authentication guarantee. Co-Authored-By: Claude Sonnet 5 --- internal/filterop/filterop.go | 19 +++++++- internal/filterop/value_test.go | 83 ++++++++++++++++++++++++++++++++- internal/siv/siv.go | 16 +++++-- internal/tag/tag.go | 70 ++++++++++++++++++++++++--- internal/tag/tag_test.go | 51 ++++++++++++++++++++ specs/03-value-encoding.md | 20 ++++++++ 6 files changed, 245 insertions(+), 14 deletions(-) diff --git a/internal/filterop/filterop.go b/internal/filterop/filterop.go index 556f597..00e3a71 100644 --- a/internal/filterop/filterop.go +++ b/internal/filterop/filterop.go @@ -189,7 +189,12 @@ func cleanValues(rule config.Rule, version int, key []byte, haveKey bool, filePa return nil, fmt.Errorf("%w: current version %d โ€” run `nebel init`", ErrKeyVersionMissing, version) } - ciphertext, err := siv.Encrypt(key, []byte(span.Value), siv.AAD(siv.ModeValue, filePath, field)) + // The type travels in the tag as plaintext metadata, not inside + // the ciphertext โ€” so it's bound into the AAD instead, exactly + // like the file/field path components, otherwise it could be + // swapped (type:str -> type:bool) without needing the key at all + // (audit 2026-09-29, P05; spec 03 AC-3.10). + ciphertext, err := siv.Encrypt(key, []byte(span.Value), siv.AAD(siv.ModeValue, filePath, field, string(span.Type))) if err != nil { return nil, fmt.Errorf("filterop: clean %s at %s: %w", filePath, field, err) } @@ -243,7 +248,17 @@ func smudgeValues(rule config.Rule, keyring Keyring, filePath string, input []by continue } - plaintext, err := siv.Decrypt(key, parsed.Ciphertext, siv.AAD(siv.ModeValue, filePath, field)) + // A legacy (pre-P05-fix) tag's ciphertext was never authenticated + // with its type in the AAD to begin with โ€” reconstructing it with + // the type included here would fail authentication against a + // perfectly legitimate, untampered legacy tag, exactly as it + // would against a tampered one. Only a tag using + // AlgoAES256SIVTypeBound (Tag.TypeBound) was encrypted that way. + aad := siv.AAD(siv.ModeValue, filePath, field) + if parsed.TypeBound { + aad = siv.AAD(siv.ModeValue, filePath, field, string(parsed.Type)) + } + plaintext, err := siv.Decrypt(key, parsed.Ciphertext, aad) if err != nil { return nil, nil, fmt.Errorf("filterop: smudge %s at %s: %w", filePath, field, err) } diff --git a/internal/filterop/value_test.go b/internal/filterop/value_test.go index 9dc7314..15a698a 100644 --- a/internal/filterop/value_test.go +++ b/internal/filterop/value_test.go @@ -5,11 +5,14 @@ package filterop import ( "bytes" + "encoding/base64" "errors" + "fmt" "strings" "testing" "github.com/MuffinUser/nebel/internal/config" + "github.com/MuffinUser/nebel/internal/siv" "github.com/MuffinUser/nebel/internal/tag" ) @@ -48,8 +51,8 @@ func TestCleanValuesEncryptsOnlyConfiguredFields(t *testing.T) { t.Errorf("clean disturbed content it should not touch (%q):\n%s", kept, got) } } - if !strings.Contains(string(got), `password: "ENC[AES256_SIV,`) { - t.Errorf("encrypted field is not a quoted ENC[...] tag:\n%s", got) + if !strings.Contains(string(got), `password: "ENC[AES256_SIV_TB,`) { + t.Errorf("encrypted field is not a quoted, type-bound ENC[...] tag:\n%s", got) } } @@ -326,3 +329,79 @@ func TestSmudgeValuesRejectsUntypedTag(t *testing.T) { t.Error("Smudge on an untyped tag: want an error, got nil") } } + +// Regression test for the 2026-09-29 audit's P05: a value's type field +// sits next to its ciphertext as plaintext metadata, not inside it, so +// changing type:str to type:bool needs no key at all. Before this fix, +// that silently changed how a decrypted string rendered (a boolean or +// number, unquoted, instead of a quoted string) without tripping SIV's +// own authentication, since the AAD never covered the type field. Now +// that EncodeValue's tag binds Type into the AAD, the same edit must fail +// authentication instead. +func TestSmudgeValuesRejectsTypeTampering(t *testing.T) { + cleaned, err := Clean(valueConfig(), testKeyring, "config/staging.yaml", []byte(valueDoc)) + if err != nil { + t.Fatalf("Clean: %v", err) + } + if !bytes.Contains(cleaned, []byte(",type:str]")) { + t.Fatalf("expected a type:str tag, got:\n%s", cleaned) + } + tampered := bytes.Replace(cleaned, []byte(",type:str]"), []byte(",type:bool]"), 1) + + if _, _, err := Smudge(valueConfig(), testKeyring, "config/staging.yaml", tampered); !errors.Is(err, siv.ErrAuth) { + t.Errorf("Smudge() on a type-tampered tag: error = %v, want %v", err, siv.ErrAuth) + } +} + +// Backward compatibility: a value tag committed before this fix +// (AlgoAES256SIV, encrypted with the pre-P05 AAD that never included the +// type) has no in-tool migration and must keep decrypting exactly as it +// always did โ€” see the tag package's doc comment. This hand-builds one +// the way a pre-fix EncodeValue would have, rather than relying on the +// current (now type-bound) EncodeValue. +func TestSmudgeValuesAcceptsLegacyPreTypeBoundTag(t *testing.T) { + const legacyPassword = "old-secret" + legacyAAD := siv.AAD(siv.ModeValue, "config/staging.yaml", "database.password") + ciphertext, err := siv.Encrypt(testKey, []byte(legacyPassword), legacyAAD) + if err != nil { + t.Fatalf("siv.Encrypt: %v", err) + } + legacyTag := fmt.Sprintf("ENC[%s,key:1,data:%s,type:str]", tag.AlgoAES256SIV, base64.StdEncoding.EncodeToString(ciphertext)) + + doc := strings.Replace(valueDoc, `password: "s3cr3t"`, `password: "`+legacyTag+`"`, 1) + got, _, err := Smudge(valueConfig(), testKeyring, "config/staging.yaml", []byte(doc)) + if err != nil { + t.Fatalf("Smudge on a legacy pre-type-bound tag: %v", err) + } + if !bytes.Contains(got, []byte("password: \""+legacyPassword+"\"")) { + t.Errorf("Smudge() = %q, want it to decrypt the legacy tag back to %q", got, legacyPassword) + } +} + +// Documents, rather than asserts as desirable, the residual limitation +// backward compatibility with TestSmudgeValuesAcceptsLegacyPreTypeBoundTag +// requires: a *legacy* tag's type field is not authenticated, exactly as +// it always was, since re-authenticating it under the new AAD formula +// would break every such tag already committed before this fix. A legacy +// value converges onto the safer, type-bound form the next time anything +// re-encrypts it (an ordinary edit, `nebel rotate`, or `git add +// --renormalize`) โ€” see the tag package's doc comment. +func TestSmudgeValuesLegacyTagTypeStillUnauthenticated(t *testing.T) { + const legacyValue = "false" + legacyAAD := siv.AAD(siv.ModeValue, "config/staging.yaml", "database.password") + ciphertext, err := siv.Encrypt(testKey, []byte(legacyValue), legacyAAD) + if err != nil { + t.Fatalf("siv.Encrypt: %v", err) + } + legacyTag := fmt.Sprintf("ENC[%s,key:1,data:%s,type:str]", tag.AlgoAES256SIV, base64.StdEncoding.EncodeToString(ciphertext)) + tamperedTag := strings.Replace(legacyTag, ",type:str]", ",type:bool]", 1) + + doc := strings.Replace(valueDoc, `password: "s3cr3t"`, `password: "`+tamperedTag+`"`, 1) + got, _, err := Smudge(valueConfig(), testKeyring, "config/staging.yaml", []byte(doc)) + if err != nil { + t.Fatalf("Smudge on a type-tampered legacy tag: want no error (known limitation), got %v", err) + } + if !bytes.Contains(got, []byte("password: "+legacyValue)) { + t.Errorf("Smudge() = %q, want the unquoted rendering %q the type-flip produces", got, "password: "+legacyValue) + } +} diff --git a/internal/siv/siv.go b/internal/siv/siv.go index 78f9a95..408ca3f 100644 --- a/internal/siv/siv.go +++ b/internal/siv/siv.go @@ -42,17 +42,25 @@ var ( ErrAuth = errors.New("siv: authentication failed") ) -// AAD builds the associated data binding a ciphertext to one location. +// AAD builds the associated data binding a ciphertext to one location, plus +// any extra components a caller passes (spec 03 AC-3.10 binds a value's +// native type this way, so tampering with a tag's separately-stored type +// field โ€” not itself ciphertext โ€” fails authentication instead of silently +// changing how the decrypted value is rendered). // // Without this binding, two fields holding the same secret would encrypt to // identical ciphertext, and a ciphertext could be copy-pasted between fields // and still decrypt. Components are length-prefixed, so no two distinct -// (mode, filePath, fieldPath) triples can produce the same bytes. +// (mode, filePath, fieldPath, extra...) tuples can produce the same bytes โ€” +// including between calls with a different number of extra components, +// since each one is prefixed by its own length rather than only separated +// from its neighbors. // // filePath is repo-relative. fieldPath is empty for ModeFile. -func AAD(mode Mode, filePath, fieldPath string) []byte { +func AAD(mode Mode, filePath, fieldPath string, extra ...string) []byte { var aad []byte - for _, part := range []string{string(mode), filePath, fieldPath} { + parts := append([]string{string(mode), filePath, fieldPath}, extra...) + for _, part := range parts { aad = binary.AppendUvarint(aad, uint64(len(part))) aad = append(aad, part...) } diff --git a/internal/tag/tag.go b/internal/tag/tag.go index b273fa2..e617fdd 100644 --- a/internal/tag/tag.go +++ b/internal/tag/tag.go @@ -4,10 +4,11 @@ // Package tag encodes and decodes the inline ENC[...] marker used to store // an encrypted value in place. // -// Two forms share one parser: +// Three forms share one parser: // -// ENC[AES256_SIV,key:,data:] whole file (spec 06) -// ENC[AES256_SIV,key:,data:,type:str] one value (spec 03) +// ENC[AES256_SIV,key:,data:] whole file (spec 06) +// ENC[AES256_SIV,key:,data:,type:str] one value, legacy (spec 03) +// ENC[AES256_SIV_TB,key:,data:,type:str] one value, type-bound (spec 03 AC-3.10) // // key records which project key version (spec 04, spec 11) produced the // ciphertext, so smudge can select the matching key from the local keyring @@ -18,6 +19,24 @@ // since that is the form already committed in every repository created // before per-value mode existed. // +// The two value forms differ in whether the type field is itself +// authenticated. AES256_SIV_TB folds it into the ciphertext's AAD (see +// internal/siv.AAD and internal/filterop's use of it), so changing +// type:str to type:bool on an unmodified ciphertext โ€” which needs no key, +// since the type field sits next to the ciphertext as plaintext metadata, +// not inside it โ€” fails authentication instead of silently changing how +// the decrypted value renders (audit 2026-09-29, P05). AES256_SIV plays +// that same role for a value tag only because it predates this fix: every +// tag EncodeValue produces now uses AES256_SIV_TB, but a legacy +// AES256_SIV value tag already committed before this change remains +// parseable and must keep authenticating exactly as it always did, so +// Parse still accepts it โ€” TypeBound distinguishes the two for a caller +// deciding which AAD to reconstruct. There is no separate migration step +// beyond that: a value converges to the new form the next time anything +// re-encrypts it (an ordinary edit, or the eager re-encryption `nebel +// rotate` and `git add --renormalize` already perform for spec 11), the +// same way a value converges onto a new key version. +// // key is mandatory (AC-3.6): this is a breaking format change from the // pre-rotation tag (no key field at all), landing alongside spec 11. // There is no in-tool migration: the config's own canary is checked @@ -38,9 +57,17 @@ import ( "strings" ) -// AlgoAES256SIV is the only algorithm identifier this build understands. +// AlgoAES256SIV is the algorithm identifier for a whole-file tag, and for +// a legacy value tag produced before AlgoAES256SIVTypeBound existed (see +// Tag.TypeBound). const AlgoAES256SIV = "AES256_SIV" +// AlgoAES256SIVTypeBound is the algorithm identifier EncodeValue now +// always produces: a value tag whose type field is bound into the +// ciphertext's AAD, so tampering with it fails authentication (spec 03 +// AC-3.10, audit 2026-09-29 P05). See Tag.TypeBound. +const AlgoAES256SIVTypeBound = "AES256_SIV_TB" + // Type is the native type of an encrypted scalar, recorded so decryption // can restore it. TypeNone marks a whole-file tag, which has none. type Type string @@ -73,6 +100,18 @@ type Tag struct { // Type is the original scalar type, or TypeNone for a whole-file tag. Type Type + + // TypeBound reports whether Type is itself part of what this tag's + // ciphertext authenticates (AlgoAES256SIVTypeBound), as opposed to + // separate, unauthenticated plaintext metadata sitting next to the + // ciphertext (the legacy AlgoAES256SIV value form). Always false for + // a whole-file tag, which carries no type field to bind in the first + // place. A caller reconstructing the AAD a value's ciphertext was + // encrypted under must include Type in it when this is true, and + // must not when it's false โ€” using the wrong one either way fails + // authentication, since AAD mismatches are indistinguishable from a + // wrong key or tampered ciphertext. + TypeBound bool } const ( @@ -117,8 +156,14 @@ func Encode(ciphertext []byte, version int) string { // EncodeValue wraps ciphertext for a single scalar, recording the key // version that produced it (spec 11) and the type the plaintext had so // Decrypt can restore it (spec 03 AC-3.1, AC-3.2). +// +// Always uses AlgoAES256SIVTypeBound (spec 03 AC-3.10): every value tag +// this build produces binds its type field into the ciphertext's AAD. +// The caller must construct that AAD to match โ€” see internal/siv.AAD and +// Tag.TypeBound's doc comment โ€” or the ciphertext it just produced won't +// authenticate against its own tag. func EncodeValue(ciphertext []byte, version int, t Type) string { - return fmt.Sprintf("%s%s,key:%d,data:%s,type:%s%s", prefix, AlgoAES256SIV, version, base64.StdEncoding.EncodeToString(ciphertext), t, suffix) + return fmt.Sprintf("%s%s,key:%d,data:%s,type:%s%s", prefix, AlgoAES256SIVTypeBound, version, base64.StdEncoding.EncodeToString(ciphertext), t, suffix) } // Decode parses a tag and returns just the ciphertext, ignoring its @@ -154,7 +199,13 @@ func Parse(raw string) (Tag, error) { return Tag{}, fmt.Errorf("%w: expected \"ALGO,key:,data:\"", ErrMalformed) } algo := fields[0] - if algo != AlgoAES256SIV { + var typeBound bool + switch algo { + case AlgoAES256SIV: + typeBound = false + case AlgoAES256SIVTypeBound: + typeBound = true + default: return Tag{}, fmt.Errorf("%w: %q", ErrUnsupportedAlgo, algo) } rest := fields[1:] @@ -194,7 +245,14 @@ func Parse(raw string) (Tag, error) { if parsed.Type = Type(value); !parsed.Type.Valid() { return Tag{}, fmt.Errorf("%w: %q", ErrUnsupportedType, value) } + parsed.TypeBound = typeBound rest = rest2 + } else if typeBound { + // AlgoAES256SIVTypeBound exists specifically to bind a type + // field; a whole-file-shaped tag naming it anyway has nothing to + // bind and is malformed, not something to quietly accept as if + // it were the plain AlgoAES256SIV whole-file form. + return Tag{}, fmt.Errorf("%w: %q requires a \"type:\" field", ErrMalformed, AlgoAES256SIVTypeBound) } if len(rest) > 0 { return Tag{}, fmt.Errorf("%w: unexpected trailing field %q", ErrMalformed, rest[0]) diff --git a/internal/tag/tag_test.go b/internal/tag/tag_test.go index fd3fdb8..155efce 100644 --- a/internal/tag/tag_test.go +++ b/internal/tag/tag_test.go @@ -7,6 +7,7 @@ import ( "bytes" "encoding/base64" "errors" + "strings" "testing" ) @@ -171,6 +172,56 @@ func TestParseWholeFileTagHasNoType(t *testing.T) { if parsed.Type != TypeNone { t.Errorf("Type = %q, want TypeNone", parsed.Type) } + if parsed.TypeBound { + t.Error("TypeBound = true for a whole-file tag, want false") + } +} + +// Regression test for the 2026-09-29 audit's P05: EncodeValue must always +// produce a type-bound tag (AlgoAES256SIVTypeBound), so a caller +// reconstructing the AAD for it knows to include the type โ€” otherwise +// Type sits next to the ciphertext as unauthenticated plaintext metadata, +// changeable without the key. +func TestEncodeValueUsesTypeBoundAlgo(t *testing.T) { + encoded := EncodeValue([]byte("ciphertext"), 1, TypeStr) + if !strings.HasPrefix(encoded, "ENC["+AlgoAES256SIVTypeBound+",") { + t.Errorf("EncodeValue() = %q, want it to start with \"ENC[%s,\"", encoded, AlgoAES256SIVTypeBound) + } + parsed, err := Parse(encoded) + if err != nil { + t.Fatalf("Parse: %v", err) + } + if !parsed.TypeBound { + t.Error("TypeBound = false, want true") + } +} + +// A value tag from before this fix โ€” AlgoAES256SIV, not +// AlgoAES256SIVTypeBound โ€” must still parse: there is no in-tool +// migration, so every already-committed tag of this form must keep +// working (see the package doc comment). TypeBound must come back false +// for it, so a caller reconstructs the AAD it was actually encrypted +// under (without the type), not the new formula. +func TestParseLegacyValueTagIsNotTypeBound(t *testing.T) { + parsed, err := Parse("ENC[AES256_SIV,key:1,data:AAAA,type:str]") + if err != nil { + t.Fatalf("Parse: %v", err) + } + if parsed.Type != TypeStr { + t.Errorf("Type = %q, want %q", parsed.Type, TypeStr) + } + if parsed.TypeBound { + t.Error("TypeBound = true for a legacy AES256_SIV value tag, want false") + } +} + +// AlgoAES256SIVTypeBound exists to bind a type field; naming it on a +// whole-file-shaped tag (no type field) has nothing to bind and is +// malformed, not silently equivalent to plain AlgoAES256SIV. +func TestParseRejectsTypeBoundWithoutType(t *testing.T) { + if _, err := Parse("ENC[AES256_SIV_TB,key:1,data:AAAA]"); !errors.Is(err, ErrMalformed) { + t.Errorf("Parse() error = %v, want %v", err, ErrMalformed) + } } // AC-3.8, extended to the type field: a tag naming a type this build can't diff --git a/specs/03-value-encoding.md b/specs/03-value-encoding.md index a62ab14..7f7626f 100644 --- a/specs/03-value-encoding.md +++ b/specs/03-value-encoding.md @@ -6,6 +6,15 @@ project key version (spec 04, spec 11) produced this ciphertext โ€” see REQUIREMENTS.md ยง Key rotation for why one project can have values under several versions at once. +`ALGO` is `AES256_SIV_TB` for every value tag this build produces +(`AES256_SIV` remains the whole-file form, spec 06) โ€” `type`'s value is +bound into the ciphertext's AAD (spec 02), so changing it needs the key, +not just write access to the file it's stored in (AC-3.10). A value tag +using plain `AES256_SIV` is the pre-AC-3.10 form: still accepted, since +there is no in-tool migration (see spec 11 and this repo's +`internal/tag` package doc comment), but its `type` field is not +authenticated the same way. + ## Acceptance criteria - **AC-3.1 Encode string**: encoding a string value under key version `V` @@ -37,3 +46,14 @@ several versions at once. needs to know which version is "current" โ€” the tag names its own version explicitly, and the caller (spec 06) is responsible for finding the matching key in the local keyring. +- **AC-3.10 Type is authenticated**: a value tag's `type` field is bound + into its ciphertext's AAD (`ALGO` = `AES256_SIV_TB`), so changing + `type:str` to `type:bool` (or any other type) on an otherwise-untouched + tag fails authentication instead of silently changing how the decrypted + value renders โ€” closing the gap where `type` sat next to the + ciphertext as unauthenticated plaintext metadata, changeable by anyone + with write access to the file, without the key (2026-09-29 audit, P05). + A value tag from before this fix (`ALGO` = `AES256_SIV`) has no `type` + binding and keeps decrypting exactly as it always did โ€” there is no + in-tool migration for already-committed tags; a value converges onto + the bound form the next time anything re-encrypts it. From 0154704ac701c87593bce9f5e70866c931a66dac Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:39:02 +0200 Subject: [PATCH 16/18] Mark Package F as done in the mitigation plan Co-Authored-By: Claude Sonnet 5 --- .../2026-09-29-high-findings-validation-and-mitigation-plan.md | 1 + 1 file changed, 1 insertion(+) diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md index 8ee1a64..5341974 100644 --- a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -64,6 +64,7 @@ Ranked by importance to the tool's core promise (protecting secrets), not by imp - **Package E โ€” P06, and worth bundling with the audit's separate (non-defect) "harden local key storage" suggestion.** A single fix โ€” a dedicated `0600` key file instead of `git config` โ€” addresses both the argv-exposure bug and that hardening suggestion at once. - **Status: done** (commit `8b830ea` on branch `worktree-audit-mitigation-plan`). `localkey.Set` now writes to a new `nebel-keys` file (0600) inside the shared git-common-dir instead of via `git config --local ` โ€” closing the subprocess-argv exposure. `Get`/`All` still fall back to the legacy git-config location so an existing clone doesn't need to re-run `nebel init`. Several `cmd/nebel` e2e tests asserted directly on the old git-config storage as their way of checking key registration; updated them (via a new shared `registeredKeyValue` helper) to check the actual current location instead of silently becoming vacuous checks. Verified directly against the pre-fix code: `Set` left the raw base64 key sitting in plain `.git/config` content under `[filter "nebel"] key = ...` โ€” written by exactly the subprocess call this fix removes the key's argument from. Full test suite passes unchanged. - **Package F โ€” P05, standalone, last.** Breaking ciphertext-format change with its own migration path; do not bundle with anything else, since it needs its own versioned release and rollout communication independent of all other fixes. + - **Status: done** (commit `ba8e9aa` on branch `worktree-audit-mitigation-plan`). Reused the existing ALGO-field mechanism (spec 03 AC-3.8) rather than inventing a new one: a new `AES256_SIV_TB` identifies a value tag whose type is bound into the AAD; `EncodeValue` always produces this form now, while `Parse` still accepts the legacy `AES256_SIV` form and exposes which one via a new `Tag.TypeBound` field, so `smudgeValues` reconstructs the exact AAD each form was actually encrypted under. No separate migration tooling was needed in the end: `cleanValues` already unconditionally re-encrypts any plaintext field via `EncodeValue`, so a legacy value converges onto the type-bound form the next time anything re-encrypts it (an edit, `nebel rotate`, or `git add --renormalize`) โ€” the same mechanism already used for key-version convergence. A legacy tag's type remains genuinely unauthenticated until that happens; this residual limitation is deliberately documented and tested (`TestSmudgeValuesLegacyTagTypeStillUnauthenticated`), not an oversight. Verified directly against the pre-fix code: a `type:str`โ†’`type:bool` edit on an untouched ciphertext produced no authentication error and rendered the secret unquoted. Full test suite passes unchanged. Also updates `specs/03-value-encoding.md` (new AC-3.10). Recommended shipping order: **Package A โ†’ Package B โ†’ Package C โ†’ Package D and Package E in parallel โ†’ Package F** as a separate, later release. From e26e65cde4d480f33321d4029499712a88d63231 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:52:55 +0200 Subject: [PATCH 17/18] Strengthen and correct Package F (P05) after independent review Three follow-ups to ba8e9aa, found by a second review pass rather than by the original audit: 1. Restores a stopgap the mitigation plan called for and Package F dropped: a legacy (non-type-bound) tag's type field is still unauthenticated, so a successful flip could previously render arbitrary decrypted text unquoted for TypeInt/TypeFloat/TypeBool - a potential structural-injection vector for a crafted plaintext, not just type confusion. smudgeValues now rejects a decrypted value that isn't a genuine literal for its claimed type (validTypeLiteral, using strconv's parsers) before rendering it. A type-bound tag can never reach this in practice - its type can't change without failing decryption first - so this only ever narrows what a legacy tag's still-possible type flip can do, without weakening the new protection at all. 2. Corrects an overstated claim in ba8e9aa's tag.go/specs/03 comments: "a value converges onto the type-bound form the next time anything re-encrypts it" is true, but only protects the *current* committed tag going forward. An attacker with write access can still resurrect an old legacy ciphertext from git history (or a stale branch or clone) with its type re-flipped, and it authenticates exactly as it did when first committed, since spec 11 AC-11.5 keeps every key version registered indefinitely - upgrading the current commit doesn't revoke it. Fully closing that needs actively revoking the old key version, which rotation does not do; out of scope here. Documented plainly rather than left implied. 3. Fixes a real interaction between Package D and Package F, confirmed with a new e2e test rather than left as a hypothesis: DirtyFiles (gitutil, P01's dirty-check) compares by running the clean filter, which is unavoidable for a filtered path - `git diff HEAD` has to clean the working tree to compare it against HEAD's (also filtered) blob. A legacy value tag re-encrypts to different bytes the moment anything cleans it again, since the AAD it's produced under changed - so a repeated `nebel init` on a repo with an existing legacy tag, and no actual local edits, now refuses with ErrDirtyManagedFiles. The new e2e test (cmd/nebel/legacytag_e2e_test.go) reproduces this against a real repo with a real derived key and confirms the fix: `git add --renormalize` alone is not enough, since it only updates the index, and DirtyFiles compares against HEAD regardless - the renormalized tag must also be committed. ErrDirtyManagedFiles' error text and doc comment now say so explicitly. Full test suite (go build, go vet, go test ./...) passes. Co-Authored-By: Claude Sonnet 5 --- cmd/nebel/legacytag_e2e_test.go | 124 ++++++++++++++++++++++++++++++++ internal/filterop/filterop.go | 42 +++++++++++ internal/filterop/value_test.go | 31 +++++++- internal/gitutil/gitutil.go | 14 +++- internal/tag/tag.go | 17 +++++ specs/03-value-encoding.md | 11 ++- 6 files changed, 236 insertions(+), 3 deletions(-) create mode 100644 cmd/nebel/legacytag_e2e_test.go diff --git a/cmd/nebel/legacytag_e2e_test.go b/cmd/nebel/legacytag_e2e_test.go new file mode 100644 index 0000000..3e07c76 --- /dev/null +++ b/cmd/nebel/legacytag_e2e_test.go @@ -0,0 +1,124 @@ +// Copyright (C) 2026 Marwin Moellers +// SPDX-License-Identifier: GPL-3.0-or-later + +package main + +import ( + "encoding/base64" + "fmt" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/MuffinUser/nebel/internal/siv" + "github.com/MuffinUser/nebel/internal/tag" +) + +// Regression test for an interaction between Package D (P01's dirty-check +// in gitutil.CheckoutAll) and Package F (P05's type-authenticated value +// tags), found during review rather than by the original audit: +// DirtyFiles compares by running the clean filter (that's what `git diff +// HEAD` against a filtered path does), and a legacy (pre-AC-3.10) value +// tag re-encrypts to different bytes the moment anything cleans it again +// โ€” the AAD it's produced under changed โ€” even when the secret itself was +// never touched. That makes a repeated `nebel init` refuse with +// ErrDirtyManagedFiles for a file the user never edited, until the legacy +// tag is upgraded and *committed* (renormalizing alone updates the index, +// not HEAD, so `git diff HEAD` still sees the old committed form either +// way โ€” confirmed here, not merely asserted). +func TestInitRefusesOnLegacyValueTagUntilRenormalizedAndCommitted(t *testing.T) { + pathEnv := pathEnvWithBin(t) + repo := setupValueRepo(t, pathEnv) + runIn(t, repo, pathEnv, "nebel", "add", "field", "config/staging.yaml", "database.password") + runIn(t, repo, pathEnv, "git", "add", ".") + runIn(t, repo, pathEnv, "git", "commit", "-q", "-m", "encrypt database.password") + + committed := runIn(t, repo, pathEnv, "git", "show", "HEAD:config/staging.yaml") + if !strings.Contains(committed, "AES256_SIV_TB,") { + t.Fatalf("test setup did not produce a type-bound tag:\n%s", committed) + } + + // Downgrade the committed tag to the legacy (pre-AC-3.10) form, + // re-encrypting the real secret under the legacy (type-unbound) AAD + // with this repo's actual registered key โ€” reproducing exactly what a + // pre-Package-F build would have committed, not a synthetic stand-in. + keyB64, ok := registeredKeyValue(t, repo, pathEnv, 1) + if !ok { + t.Fatal("no key registered for version 1") + } + key, err := base64.StdEncoding.DecodeString(keyB64) + if err != nil { + t.Fatalf("decoding registered key: %v", err) + } + legacyAAD := siv.AAD(siv.ModeValue, "config/staging.yaml", "database.password") + ciphertext, err := siv.Encrypt(key, []byte("s3cr3t"), legacyAAD) + if err != nil { + t.Fatalf("siv.Encrypt: %v", err) + } + legacyTag := fmt.Sprintf("ENC[%s,key:1,data:%s,type:str]", tag.AlgoAES256SIV, base64.StdEncoding.EncodeToString(ciphertext)) + legacyBlob := strings.Replace(stagingYAML, `password: "s3cr3t"`, `password: "`+legacyTag+`"`, 1) + + cfgPath := filepath.Join(repo, "config", "staging.yaml") + if err := os.WriteFile(cfgPath, []byte(legacyBlob), 0o644); err != nil { + t.Fatal(err) + } + // -c filter.nebel.clean=cat: commit the legacy blob's bytes exactly as + // written, the same technique TestPreRotationRepoMigration uses to + // simulate a commit predating a tag-format fix. + runIn(t, repo, pathEnv, "git", "-c", "filter.nebel.clean=cat", "add", "-A") + runIn(t, repo, pathEnv, "git", "-c", "filter.nebel.clean=cat", "commit", "-q", "-m", "simulate a pre-AC-3.10 commit") + + // First init after the simulated legacy commit: the working tree + // currently holds that same legacy-tagged text verbatim (nothing + // cleaned it yet), so it's not "dirty" relative to HEAD โ€” this must + // still succeed, and it's what actually decrypts the field into the + // working tree for the first time. + initWithPassword(t, repo, pathEnv, "value-mode-password") + onDisk, err := os.ReadFile(cfgPath) + if err != nil { + t.Fatal(err) + } + if !strings.Contains(string(onDisk), `password: "s3cr3t"`) { + t.Fatalf("first init did not decrypt the legacy tag:\n%s", onDisk) + } + + // Second init, simulating "run nebel init again" with no edits in + // between: the working tree is now plaintext, and re-cleaning it + // produces a fresh type-bound tag that differs from HEAD's still-legacy + // one โ€” DirtyFiles sees that as a real difference and refuses, exactly + // the interaction this test is about. + out, err := runInitWithExpectingError(t, repo, pathEnv, "value-mode-password") + if err == nil { + t.Fatalf("second init: want ErrDirtyManagedFiles (legacy tag re-encrypts differently), got success:\n%s", out) + } + if !strings.Contains(out, "renormalize") { + t.Errorf("init error does not point at the documented fix:\n%s", out) + } + + // The fix as actually documented: renormalize AND commit. Renormalize + // alone only updates the index, not HEAD โ€” `git diff HEAD` (what + // DirtyFiles runs) would still see the old committed form either way, + // which this confirms rather than assumes. + runIn(t, repo, pathEnv, "git", "add", "--renormalize", "--", "config/staging.yaml") + if _, err := runInitWithExpectingError(t, repo, pathEnv, "value-mode-password"); err == nil { + t.Fatal("init after renormalizing but before committing: want it to still refuse, got success") + } + runIn(t, repo, pathEnv, "git", "commit", "-q", "-m", "upgrade database.password to a type-bound tag") + + initWithPassword(t, repo, pathEnv, "value-mode-password") + afterUpgrade, err := os.ReadFile(cfgPath) + if err != nil { + t.Fatal(err) + } + if !strings.Contains(string(afterUpgrade), `password: "s3cr3t"`) { + t.Errorf("init after the documented fix did not leave the field decrypted:\n%s", afterUpgrade) + } +} + +// runInitWithExpectingError runs `nebel init` with password, expecting it +// to fail, and returns its combined output for inspecting the error text. +func runInitWithExpectingError(t *testing.T, dir, pathEnv, password string) (string, error) { + t.Helper() + return runInitWith(t, dir, pathEnv, []string{passwordEnv + "=" + password}, "") +} diff --git a/internal/filterop/filterop.go b/internal/filterop/filterop.go index 00e3a71..4824475 100644 --- a/internal/filterop/filterop.go +++ b/internal/filterop/filterop.go @@ -12,6 +12,7 @@ package filterop import ( "errors" "fmt" + "strconv" "github.com/MuffinUser/nebel/internal/config" "github.com/MuffinUser/nebel/internal/format" @@ -262,12 +263,53 @@ func smudgeValues(rule config.Rule, keyring Keyring, filePath string, input []by if err != nil { return nil, nil, fmt.Errorf("filterop: smudge %s at %s: %w", filePath, field, err) } + // Stopgap for a legacy tag's still-unauthenticated type field + // (parsed.TypeBound == false, see the AAD selection above): a type + // flip there needs no key, and Render writes TypeInt/TypeFloat/ + // TypeBool out unquoted with no validation of its own. Refusing a + // plaintext that isn't a valid literal for its claimed type won't + // catch every flip (e.g. a string that happens to read "false" + // stays ambiguous either way โ€” see + // TestSmudgeValuesLegacyTagTypeStillUnauthenticated), but it keeps + // a successful flip from unquoting arbitrary attacker-controlled + // text, which for a crafted value could otherwise inject + // structure into the surrounding document. A type-bound tag can't + // reach this in practice (its type can't change without failing + // the Decrypt above), so this never rejects legitimate content. + if err := validTypeLiteral(string(plaintext), parsed.Type); err != nil { + return nil, nil, fmt.Errorf("filterop: smudge %s at %s: %w", filePath, field, err) + } edits = append(edits, format.Edit{Span: span, Text: handler.Render(string(plaintext), parsed.Type)}) } out, err := splice(input, edits, "smudge", filePath) return out, skipped, err } +// ErrInvalidTypeLiteral is returned when a decrypted value isn't a +// syntactically valid literal for its tag's claimed non-string type โ€” see +// validTypeLiteral. +var ErrInvalidTypeLiteral = errors.New("filterop: decrypted value is not a valid literal for its claimed type") + +// validTypeLiteral rejects a plaintext that doesn't look like a genuine +// int/float/bool literal before it gets rendered unquoted. TypeStr always +// passes: Render quotes it, so whatever bytes it contains stay inert data +// rather than becoming unquoted source syntax. +func validTypeLiteral(value string, t tag.Type) error { + var err error + switch t { + case tag.TypeBool: + _, err = strconv.ParseBool(value) + case tag.TypeInt: + _, err = strconv.ParseInt(value, 10, 64) + case tag.TypeFloat: + _, err = strconv.ParseFloat(value, 64) + } + if err != nil { + return fmt.Errorf("%w: %q is not a valid %s", ErrInvalidTypeLiteral, value, t) + } + return nil +} + func splice(input []byte, edits []format.Edit, op, filePath string) ([]byte, error) { out, err := format.Splice(input, edits) if err != nil { diff --git a/internal/filterop/value_test.go b/internal/filterop/value_test.go index 15a698a..db92bf4 100644 --- a/internal/filterop/value_test.go +++ b/internal/filterop/value_test.go @@ -385,7 +385,13 @@ func TestSmudgeValuesAcceptsLegacyPreTypeBoundTag(t *testing.T) { // would break every such tag already committed before this fix. A legacy // value converges onto the safer, type-bound form the next time anything // re-encrypts it (an ordinary edit, `nebel rotate`, or `git add -// --renormalize`) โ€” see the tag package's doc comment. +// --renormalize`) โ€” see the tag package's doc comment. What remains is +// narrower than the original P05 finding, though, not the same gap: +// validTypeLiteral (see TestSmudgeValuesRejectsNonLiteralAfterLegacyTypeFlip) +// refuses a plaintext that isn't a genuine literal for the type it's been +// flipped to, so a flip only "succeeds" โ€” as here โ€” when the underlying +// plaintext happens to also be a valid literal of the new type, same as +// the string "false" is also a valid bool literal. func TestSmudgeValuesLegacyTagTypeStillUnauthenticated(t *testing.T) { const legacyValue = "false" legacyAAD := siv.AAD(siv.ModeValue, "config/staging.yaml", "database.password") @@ -405,3 +411,26 @@ func TestSmudgeValuesLegacyTagTypeStillUnauthenticated(t *testing.T) { t.Errorf("Smudge() = %q, want the unquoted rendering %q the type-flip produces", got, "password: "+legacyValue) } } + +// The stopgap validTypeLiteral adds: a legacy tag's type field still +// isn't authenticated (see TestSmudgeValuesLegacyTagTypeStillUnauthenticated), +// but flipping type:str to type:bool on a plaintext that isn't itself a +// valid bool literal โ€” ordinary secret text, not crafted to also read as +// one โ€” must now be refused rather than rendered unquoted. Unquoted +// arbitrary text is exactly how a crafted plaintext could inject +// structure into the surrounding document. +func TestSmudgeValuesRejectsNonLiteralAfterLegacyTypeFlip(t *testing.T) { + const legacyValue = "s3cr3t" + legacyAAD := siv.AAD(siv.ModeValue, "config/staging.yaml", "database.password") + ciphertext, err := siv.Encrypt(testKey, []byte(legacyValue), legacyAAD) + if err != nil { + t.Fatalf("siv.Encrypt: %v", err) + } + legacyTag := fmt.Sprintf("ENC[%s,key:1,data:%s,type:str]", tag.AlgoAES256SIV, base64.StdEncoding.EncodeToString(ciphertext)) + tamperedTag := strings.Replace(legacyTag, ",type:str]", ",type:bool]", 1) + + doc := strings.Replace(valueDoc, `password: "s3cr3t"`, `password: "`+tamperedTag+`"`, 1) + if _, _, err := Smudge(valueConfig(), testKeyring, "config/staging.yaml", []byte(doc)); !errors.Is(err, ErrInvalidTypeLiteral) { + t.Errorf("Smudge() error = %v, want %v", err, ErrInvalidTypeLiteral) + } +} diff --git a/internal/gitutil/gitutil.go b/internal/gitutil/gitutil.go index 635086f..3a6e25c 100644 --- a/internal/gitutil/gitutil.go +++ b/internal/gitutil/gitutil.go @@ -191,6 +191,18 @@ func IsShallow(repoRoot string) (bool, error) { // overwrites the working tree from HEAD regardless of the index or of any // unstaged edit, and CheckoutAll's own preceding os.Remove has no backup // step of its own either (audit 2026-09-29, P01). +// +// DirtyFiles compares by running the clean filter (that's what `git diff +// HEAD` against a filtered path does), which can itself be the reason a +// file not actually edited shows up here: a mode: value field's tag from +// before spec 03 AC-3.10 authenticated its type re-encrypts to different +// bytes than what's committed the moment anything cleans it again, since +// the AAD it's produced under changed. That's a real difference the +// filter would otherwise stage silently, so still refusing here is the +// right default โ€” the error message points at the fix (`git add +// --renormalize`, committed, upgrades the tag; renormalizing without +// committing only updates the index, and this check compares against +// HEAD regardless) rather than assuming it's always an actual edit. var ErrDirtyManagedFiles = errors.New("gitutil: managed file(s) have local changes CheckoutAll would discard") // DirtyFiles returns the subset of files (repo-relative paths) whose @@ -278,7 +290,7 @@ func CheckoutAll(repoRoot string) (decrypted int, failures []CheckoutFailure, er if dirty, dirtyErr := DirtyFiles(repoRoot, files); dirtyErr != nil { return 0, nil, dirtyErr } else if len(dirty) > 0 { - return 0, nil, fmt.Errorf("%w: %s", ErrDirtyManagedFiles, strings.Join(dirty, ", ")) + return 0, nil, fmt.Errorf("%w: %s (if these have not actually been edited, a mode: value field's tag may still be in the pre-authenticated-type form โ€” run `git add --renormalize -- `, commit the result, then retry; renormalizing alone updates the index, not HEAD, which this check compares against)", ErrDirtyManagedFiles, strings.Join(dirty, ", ")) } for _, f := range files { diff --git a/internal/tag/tag.go b/internal/tag/tag.go index e617fdd..42ec595 100644 --- a/internal/tag/tag.go +++ b/internal/tag/tag.go @@ -37,6 +37,23 @@ // rotate` and `git add --renormalize` already perform for spec 11), the // same way a value converges onto a new key version. // +// That convergence closes P05 only for the current, committed tag โ€” +// not for the field's history. A legacy ciphertext, once committed, +// stays a valid AES256_SIV tag forever: nothing about upgrading the +// current commit changes it, or the key version it names (spec 11 +// AC-11.5 keeps every version's key registered indefinitely). An +// attacker with write access can resurrect that old blob from git +// history โ€” or a stale branch, or another clone's reflog โ€” with its +// type field re-flipped, and it authenticates exactly as it did the +// day it was committed, since Smudge picks the (unbound) legacy AAD +// for anything naming AES256_SIV. Reaching that ciphertext at all +// already requires the write access P05 assumes; validTypeLiteral +// (internal/filterop) additionally limits what a successful flip can +// render to a genuine literal of the new type, narrowing rather than +// closing the gap. Fully closing it would mean actively revoking the +// old key version โ€” not merely superseding it โ€” which spec 11's +// rotation does not do and is out of scope here. +// // key is mandatory (AC-3.6): this is a breaking format change from the // pre-rotation tag (no key field at all), landing alongside spec 11. // There is no in-tool migration: the config's own canary is checked diff --git a/specs/03-value-encoding.md b/specs/03-value-encoding.md index 7f7626f..897324b 100644 --- a/specs/03-value-encoding.md +++ b/specs/03-value-encoding.md @@ -56,4 +56,13 @@ authenticated the same way. A value tag from before this fix (`ALGO` = `AES256_SIV`) has no `type` binding and keeps decrypting exactly as it always did โ€” there is no in-tool migration for already-committed tags; a value converges onto - the bound form the next time anything re-encrypts it. + the bound form the next time anything re-encrypts it. That + convergence only protects the current, committed tag: an attacker + with write access can still resurrect an old `AES256_SIV` blob from + git history (or a stale branch or clone) with its `type` re-flipped, + and it authenticates exactly as it did when first committed, since + its key version stays registered indefinitely (spec 11 AC-11.5). + Closing that fully would mean actively revoking the old key version, + which rotation does not do. `internal/filterop`'s `validTypeLiteral` + narrows what a successful flip against a legacy tag can render to a + genuine literal of the new type, but does not authenticate it. From 367221f8dde44d46aae71d8099ed4b8377b24e25 Mon Sep 17 00:00:00 2001 From: Marwin Moellers Date: Tue, 29 Sep 2026 14:53:19 +0200 Subject: [PATCH 18/18] Update Package F status with the correction round's details Co-Authored-By: Claude Sonnet 5 --- ...26-09-29-high-findings-validation-and-mitigation-plan.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md index 5341974..bfb20fd 100644 --- a/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md +++ b/audits/2026-09-29-high-findings-validation-and-mitigation-plan.md @@ -64,7 +64,11 @@ Ranked by importance to the tool's core promise (protecting secrets), not by imp - **Package E โ€” P06, and worth bundling with the audit's separate (non-defect) "harden local key storage" suggestion.** A single fix โ€” a dedicated `0600` key file instead of `git config` โ€” addresses both the argv-exposure bug and that hardening suggestion at once. - **Status: done** (commit `8b830ea` on branch `worktree-audit-mitigation-plan`). `localkey.Set` now writes to a new `nebel-keys` file (0600) inside the shared git-common-dir instead of via `git config --local ` โ€” closing the subprocess-argv exposure. `Get`/`All` still fall back to the legacy git-config location so an existing clone doesn't need to re-run `nebel init`. Several `cmd/nebel` e2e tests asserted directly on the old git-config storage as their way of checking key registration; updated them (via a new shared `registeredKeyValue` helper) to check the actual current location instead of silently becoming vacuous checks. Verified directly against the pre-fix code: `Set` left the raw base64 key sitting in plain `.git/config` content under `[filter "nebel"] key = ...` โ€” written by exactly the subprocess call this fix removes the key's argument from. Full test suite passes unchanged. - **Package F โ€” P05, standalone, last.** Breaking ciphertext-format change with its own migration path; do not bundle with anything else, since it needs its own versioned release and rollout communication independent of all other fixes. - - **Status: done** (commit `ba8e9aa` on branch `worktree-audit-mitigation-plan`). Reused the existing ALGO-field mechanism (spec 03 AC-3.8) rather than inventing a new one: a new `AES256_SIV_TB` identifies a value tag whose type is bound into the AAD; `EncodeValue` always produces this form now, while `Parse` still accepts the legacy `AES256_SIV` form and exposes which one via a new `Tag.TypeBound` field, so `smudgeValues` reconstructs the exact AAD each form was actually encrypted under. No separate migration tooling was needed in the end: `cleanValues` already unconditionally re-encrypts any plaintext field via `EncodeValue`, so a legacy value converges onto the type-bound form the next time anything re-encrypts it (an edit, `nebel rotate`, or `git add --renormalize`) โ€” the same mechanism already used for key-version convergence. A legacy tag's type remains genuinely unauthenticated until that happens; this residual limitation is deliberately documented and tested (`TestSmudgeValuesLegacyTagTypeStillUnauthenticated`), not an oversight. Verified directly against the pre-fix code: a `type:str`โ†’`type:bool` edit on an untouched ciphertext produced no authentication error and rendered the secret unquoted. Full test suite passes unchanged. Also updates `specs/03-value-encoding.md` (new AC-3.10). + - **Status: done** (commits `ba8e9aa` and `e26e65c` on branch `worktree-audit-mitigation-plan`; the second commit corrects and strengthens the first after an independent review pass). Reused the existing ALGO-field mechanism (spec 03 AC-3.8) rather than inventing a new one: a new `AES256_SIV_TB` identifies a value tag whose type is bound into the AAD; `EncodeValue` always produces this form now, while `Parse` still accepts the legacy `AES256_SIV` form and exposes which one via a new `Tag.TypeBound` field, so `smudgeValues` reconstructs the exact AAD each form was actually encrypted under. Verified directly against the pre-fix code: a `type:str`โ†’`type:bool` edit on an untouched ciphertext produced no authentication error and rendered the secret unquoted. + - **Stopgap restored:** the plan's Phase 1 stopgap for P05 (reject a decrypted value that isn't a valid literal for its claimed type before rendering it unquoted) was initially dropped and has been added back (`filterop.validTypeLiteral`) โ€” it closes the structural-injection tail risk a legacy tag's still-possible type flip could otherwise reach. + - **Corrected scope claim:** "a legacy value converges onto the type-bound form the next time anything re-encrypts it" is true but incomplete โ€” it only protects the *current committed* tag. An attacker with write access can still resurrect an old legacy ciphertext from git history with its type re-flipped, since old key versions stay registered indefinitely (spec 11 AC-11.5); fully closing that would require actively revoking a key version, which is out of scope here. This is now stated plainly in `internal/tag`'s doc comment and specs/03, not left implied. + - **Real interaction found and fixed:** a legacy value tag re-encrypts to different bytes the moment anything cleans it again (the AAD changed), and `git diff HEAD` โ€” what Package D's `DirtyFiles` runs โ€” must clean a filtered path to compare it at all. That made a repeated `nebel init` on a repo with an existing legacy tag, with zero real local edits, refuse via `ErrDirtyManagedFiles`. Confirmed with a new e2e test using a real repo and a real derived key (`cmd/nebel/legacytag_e2e_test.go`), which also caught that `git add --renormalize` alone doesn't fix it (it only updates the index; the check compares against HEAD) โ€” committing the renormalized result is required too. The error text and doc comments now say so. + - Full test suite passes. Also updates `specs/03-value-encoding.md` (new AC-3.10). Recommended shipping order: **Package A โ†’ Package B โ†’ Package C โ†’ Package D and Package E in parallel โ†’ Package F** as a separate, later release.