From df9a8464e5c11d769d99d0f6305193eccb8d9c7d Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Fri, 17 Apr 2026 07:52:46 +0000 Subject: [PATCH 01/47] docs: update audit extracts for PR1301 v02 report Update existing findings with status, team responses, and mitigation reviews from the v02 audit report. Add 17 new findings (M-4, M-5, L-6 through L-11, R-5 through R-13) and the v02 PDF. --- .../audits/PR1301/Graph_PR1301_v02.pdf | Bin 0 -> 589789 bytes packages/issuance/audits/PR1301/README.md | 62 +++++++++++------- packages/issuance/audits/PR1301/TRST-H-1.md | 8 ++- packages/issuance/audits/PR1301/TRST-H-2.md | 8 ++- packages/issuance/audits/PR1301/TRST-H-3.md | 8 ++- packages/issuance/audits/PR1301/TRST-H-4.md | 8 ++- packages/issuance/audits/PR1301/TRST-L-1.md | 8 ++- packages/issuance/audits/PR1301/TRST-L-10.md | 22 +++++++ packages/issuance/audits/PR1301/TRST-L-11.md | 26 ++++++++ packages/issuance/audits/PR1301/TRST-L-2.md | 8 ++- packages/issuance/audits/PR1301/TRST-L-3.md | 8 ++- packages/issuance/audits/PR1301/TRST-L-4.md | 4 +- packages/issuance/audits/PR1301/TRST-L-5.md | 8 ++- packages/issuance/audits/PR1301/TRST-L-6.md | 24 +++++++ packages/issuance/audits/PR1301/TRST-L-7.md | 22 +++++++ packages/issuance/audits/PR1301/TRST-L-8.md | 22 +++++++ packages/issuance/audits/PR1301/TRST-L-9.md | 22 +++++++ packages/issuance/audits/PR1301/TRST-M-1.md | 6 +- packages/issuance/audits/PR1301/TRST-M-2.md | 8 ++- packages/issuance/audits/PR1301/TRST-M-3.md | 4 +- packages/issuance/audits/PR1301/TRST-M-4.md | 24 +++++++ packages/issuance/audits/PR1301/TRST-M-5.md | 24 +++++++ packages/issuance/audits/PR1301/TRST-R-10.md | 7 ++ packages/issuance/audits/PR1301/TRST-R-11.md | 7 ++ packages/issuance/audits/PR1301/TRST-R-12.md | 7 ++ packages/issuance/audits/PR1301/TRST-R-13.md | 7 ++ packages/issuance/audits/PR1301/TRST-R-5.md | 7 ++ packages/issuance/audits/PR1301/TRST-R-6.md | 7 ++ packages/issuance/audits/PR1301/TRST-R-7.md | 7 ++ packages/issuance/audits/PR1301/TRST-R-8.md | 7 ++ packages/issuance/audits/PR1301/TRST-R-9.md | 7 ++ .../indexing-agreement/cancel.t.sol | 4 +- 32 files changed, 353 insertions(+), 48 deletions(-) create mode 100644 packages/issuance/audits/PR1301/Graph_PR1301_v02.pdf create mode 100644 packages/issuance/audits/PR1301/TRST-L-10.md create mode 100644 packages/issuance/audits/PR1301/TRST-L-11.md create mode 100644 packages/issuance/audits/PR1301/TRST-L-6.md create mode 100644 packages/issuance/audits/PR1301/TRST-L-7.md create mode 100644 packages/issuance/audits/PR1301/TRST-L-8.md create mode 100644 packages/issuance/audits/PR1301/TRST-L-9.md create mode 100644 packages/issuance/audits/PR1301/TRST-M-4.md create mode 100644 packages/issuance/audits/PR1301/TRST-M-5.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-10.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-11.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-12.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-13.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-5.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-6.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-7.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-8.md create mode 100644 packages/issuance/audits/PR1301/TRST-R-9.md diff --git a/packages/issuance/audits/PR1301/Graph_PR1301_v02.pdf b/packages/issuance/audits/PR1301/Graph_PR1301_v02.pdf new file mode 100644 index 0000000000000000000000000000000000000000..e9512ec7ee7fb2da516b299461a93a06fed9299d GIT binary patch literal 589789 zcmeFa1z45cwl+*CC=JrN1nKUQZjkO~(cRJ|-5}j9-5?;Pba!`3hjin=fcHJecb~oY zIs5wd_g~k!K9>uhXZD!)j4>Ja97-%BC`?UH!wL^WoLSW|1rI|HpaWRxn!>}peM>9- z-rn5A(!dTt&&fDTKpCFi)9*V8W_k~S=j^V z*_a-)D47^I8raI%8W4Y;{!-vKR+$P6sWX(bKpf%>5A4-!3A&dm)EV_>QODDi_3e~SKC@uO_C0#@%W z?E#Dov=S!zcItq~jsTw82QWQ!R}R3$`t)FXd@w)u2Efez7-D(K@&o{YZNKf|^O;7h!hMw-J zO?vu2;u-$P$M94&{U3dyXMAdrp7F7qCg4|W9t8a_*wD%VK?7p{$LPr!*jc@|1q}}f zejz7&5qW!{y#eT5M4lP&*b?ZCo&^BuP?o3Z|AeU>fbLiLA1eM6eqj@H5N@=><{)?l4fL$^4QSsPSQ^3O(ki%erp4q@@C_h5gI-R>Y|MssVvbw+h_p<{qJ|HRJey)*dNq_DyFQ>|Nk z&GYAZV?g>3Es*w>LCZio6P9WrU09BcbDbHT^5s;aL`wgG&e~|hHTSC5yD1b3+al1F zkzZd`MI{)^GCmW)Wbbn009T!^lzJuZ@maB(?>>VuL+=}s4jsBM>)O4sC|o=bAMf(c z!gJm{*QNAZ311GYn`q=}|LC!Zg>%B9UNvHcmsJ@*3P~}`UQY8Ks#ozP!tn)ey_v2O zpqB33?jeH}qM;PBUNCpF*&B6KfH> z!KNg(39XQ-!2)*~we;;}Ntj0AUS}Bm7|E#Ui$oE{%BpWif2Xc%YRDu7f$Gwm#gHlW zO3u75;b6%LYTK4q?sH`;x+tr3bjM4b>Fjg^)$p-Rjd8M&ZE^qAfD{>G7uY0ig=6k! z3JW2G)ahPgXUI=GsJPExP>@P5X`oq#EI?2dIzoZFp@(qgeisKm<4j*jzda@aO(mRc$nyf&y%EO*m9D-%Sv?z#LTj-iCelZ`4=r+q7Lc(B%H);BaWIkYD(d4glpW@{dS`aw%-;a;@qXwDxY_}S6i^*iFKy; z3rXLXA4_`oT}Q53vWO=k7y8HX(e6cCQpfd`=>5VRhj7D-?`g7RYlJ(bCV0gkSn~J6 zbxNV~xV=yC&qC9GuKNseo z3g=;0{Bu=5ZWjNsZPM~f(n^8!B+#5z52UPq-3lIduRjY3zqi!0H?gvOC=6hv6|}Md znpi&UQS_i)NyzeHZ%_w3Y^=ZhfKvED8tp-q(a|u0M4);6VFtzjSsf_pNu@j~jwgLY z|EM+osudn`{aslY{zeu7`iIsS7#NvBiiC!Noes36(=f8pF|t2wpL7q2%#5H9=*hy$ z#0(ObhV>x~N|pL+_a8+17n=M>wf;+OJ^=9lcbkuJ|Jxe<2gv^owvRga&o=*1&yQ1! zfmYrasBdCv1k!2(R_0c=^435-ga6cFe@2MDc|FQ`QxxaEB{{C{^2P2 zct)UAHqi%ZLwY7=W?E4L6C-1L06Qz=-xr+U#NJNEz*fM@!rIF6;Vi>OD+W^Lw$@e; z>J?xJG`BOLm6rtCnE~h@&Omas|5*Jp(X%lARsZg_fP;g9fq6yVmmR!-0loeH{6^q6 z0>2UXjlgdNek1Vz6aro|K9CQG0WiSNDPbAK-=E(I{6^q60>2UXjlgdN{$E4D1Q9{> z;Vkg%&T}C`=J8nY5d7t%@^X|M4E*n!4Id2=|2{K_h%L|=#Fv4{m@k>X4zy3zxHv+#A_>I872LUf1@MNujq&a@& zksl4{52X2jSkDzew!$2&a(^OL3i;eH6+ zBgym^WB-3)$NpORV_T1c{*7=TV%*5?p(QcUwGb0MK1(BW0{|T@pPk-=eV>(?4#ZnL zy;C!Q0s=tmKS+XyBt8eDC-#7ufgYq3o&KN_SeY0f+f#m`6PW1eXjT3w^-zbry@7=i zfSKVj5C7vm0cvJCMiAA(4C3AxnCKpweIPeL@PM?Y0q9}^GuI6{5m?ss0Q{pZ z``3H>f5+Mlx-d@n7ZbPe-!pNG>4VJ1Cic$MqJP+p^?@KGF36Az@>+a!iJ(=mQnWOA z@U?ib>i%(U{THvohfI(5S#bdEC_AIOc;02Cqr-rCySz~aH$ z{ud{<$7cSl=|9HfKjrv~MgQ0S|F5;^KRO-$mmdEkzJ>8GlTqY9CnNQ{2PcOAG3)Z= z*9o%8|9#el;XhfIC!e0bjP}36y8KrW|6L=2kFz-=6Z8Ku1;+45 zUH%gajDeN@(Sz@ogZaXho#J;qXr0%uL--0OCkx4g`4wf5FG^OuIAlaB)L2n%_;Sae z3n7;fs(q_p_HR(yB_o7kq2TOAkK^UHJ>=S4|G6!xx7}gdm6+zLZ8vz*?|2N^qkrr? zlz74T@*?db!{@JR@^|R}3<1%B@;Dz6yqn#7cHkvFky^w-dW#RV;^4jKVfwMM(qQ*W z$&JxZ$D2%coA!#O#OQFI^YvHZH-n*A?{5o8!*2&extz!Eu~@I$@7YgcqWkR5O|tv! z7Ps?Ghn}xVQ4R?ig;Ni87)9WC4r09;5Z&u~cN@*6>4mD6Cc(Z=G*UfV_UkFC9U0@sYU5(J(S%NF0h*oN=-MWTk4QHylQU`Jv^^(#DcQr+}$;|ZXk4c zv6+lz=BsE=g$F$w>z7xCS)YFct2sSl&t$c2M#HEVSV91U)EZyFa^cJyns3MrXvP48 zYBVF2{J~?^(!u2+2`MTvUO{x4n`R}(uyR|)zw{go%jUjL{;m>TW_$$y8Xc@VX7pS# zv-bR!!*MTRc!~fZ@A1BUD4GqSsbN#rZOr@I={BF7o4f3 z`MXuJQ<`+zx%-N@rv}j7#fVzYG^Z@-q+;`<^QhNJkorn(k=Ji1{1Dp6=;-%{n`EQfIQ>_XoS4`!zR$eUV>ujV9Z1C0UP1VY@$HyLcCKDqZa< z?k-R9rh_2iI8VIecuKHuwkgA1H`XliPdwkQBnfDM!wH=m-U<%ZV93mc^;xTM-^&<>b zVn5qa3lZ;y*X_=1HAjbBh=T>}Lx{p*PqbnjC87%&kWxoFptlf3R#;XBoBGl#MSPX4 zLvB|xNm!jIdrZ}+kK+P12RfMZ>2RpY zHjCQKrd1QtV|XyCqaa?*X7_ry0<1f`G)y~J%T(4#cDDa%yS2Cl)BRR?OIpnwRw^@Cqpm>{8I33HJk{k$?B}T6$pv|ZHfg1APHuiF9O0} z@MEV8^JLY{m`qfp<6WTlAU9nA(7rO$M00w&TqPC=DeR1OmU&bHLiFyDKQQ$!30h z8k2((3`_X|M&cfJJ&}Mx7~VK|3--FgfI)@&pXUXcYY>qJAO%p^l01HGalchEYy;k1 z$?iC>kt|F}S>uVvK?9~*qu)ZrO!?VK+i0r}On+vuOlh+Cu|I{u9J6LBra`rZ;4)k` znRyPMCg)r`w_XX5LIJ8=)(SyzncOcp`bxp^8cyt;-QHt&wKRg27 zopfW_P;efmgzl=y17_lSA2f@{VW(3hl$i}G++j88OaA%I%ZGyG`wLjP<1Vfu)%bWE zTwsY&sAeu(?>?!rYQB01jwX+vf(AciW8h^fzSmxUSrP1nv4Q%WlCKsRSmoM|L>DyG zXSuHPVOTI;hhira*>7?ZFbkO&U|xHdh6W{wsq7i!S;jvy_%f%!yh68TDu{Io&Pc@C zB40m71YS(sf@a>G<*naiSTu{wykOw#X6djQ7%w^#D>D?keXbl(PkqY(3;^q4H~#|w z8qQ#c+5jymu*&6wZ6Ijs#KZ(=#)ErNsZ=hH45v<#o-%+%KJT!=;m1%**T(ly*@^|z z`4)110HbN_UYg8Ae<}_}w~WS8gEr}*rg0)>GH`s{Y?xDPypdkz1-N&(}BCS?CqqC65kLkCa-B9PG=AxK z9|ZS}eQB_&=U6S}I%;lmAJa@5%xR$9-WG>hKwM;}2DSa~`tZ`+zM>Np^8CAZ%^wf9 zfB6mepP9Y?yOZ_*1*9)|k+TuV1qs=qQy zeT@nb&L(vfQ7nhq&jSp{|WsM4>l{%+}-PgsCR4)U<@yUuS`7+4E8u-h|E zlcvTr8qo&AZ#X&X-%0q~AkVkzytfDstT>wa6a`KaVfgenvcm2A=5=4l{1j3b%V<&i z@sjUTV|s?`AW;jW_^N2_0A9FlZ#o+4L`58CP{BGRlMH1bmD8?KB?(8PhKh=@XrLAW zE-o%ADrP=o_Jk>O5*QuY8|=G!GinMEam~ZLJnS+dgW}f<++wZmMfvYoLOW5AgyMx* z_iExMNODRqs>CM%3@1d}=;AV3E%PV1BY1Yj1`98?ch7D=*&-$Oyj~E7?j_&$x(TtI z(WTxM5(Qdq*3~1o+syTGPwT$k^=3~)Td*5Y>x8QOG@O4PMAEsX81gwghTL7yN&1Dd zl3&c=V(5nU1VmRjF6~YP#j(4rQfK@U0jKMgu+rc{qjwgePi9WLF>%NZmyGooeitDW z09qL}HV(Tnm#0t%)*>$iTfPofDkk=HQ@qlKY|9L{14HQ3r>Ukl;pXlm)QO)emf_vV ze_lXX50T+wUt@}Bz&(>c*q(x}k+vAIxZO;&ES9L3s&7)FINH(gp)R*J#_U22W3S9+E*1KS#aNHjN)JCQm9E@a9PNlo9!esZuehHjIWgD=q6s zON~$%3!ic8u0x8KHAg{7`xNoVQssFuRm|Acp+VW?h%BFJp|N0Lu^mEzd`?A2xk&=F zEK8J7rA95D<+yjW>15W`BLnbAFtrKAB6Eb87e}^VJ1FA~QBdn<);nK?Wj9o^1@p}i zV(zP;W_F2rn;}okmo=AV(bWf)a>-yH^E>LGigUK1v3 zNcE;h-cAdu`}8KX+(Or~L*fm6KQHxR3zyr70CEyPvCSz;)CR9}V0=7nZ$jUZB|(0Iq(wNXef>Sf>!!9~Q!Y&gMTAYuiQv1Rfez9JPkU=q1BPG95}NNv zvAb9d(7<>Wh8$DU@TZ0tvZ`iy(@`vh^GD$}Ig5o%#I0+SIhlMx49mF&t>Ev>Z)&5cr$Vk>+@KsnxckDj}*N4qMx{@YRCef@C&%zjI+!&zm|6Rr1Zr2{SfMgfc3d zRNIw@+4RCLW1Ht#R^lx@B2mB@R82~&|LSU%_ibYX`_F}D=d;l(M$(8|>mSL|JonbS zx$stHgDTg(jWc7U5qMm>(~&KZ*STD?*}ITbL;#4L(T#ke z&XzV&NtX;uL?Qr~%W)ofQ~w-WRtJ{maBTqi5&{EC)37O9Ysbs|VOCH$*-(K<-W)yL z>tjwVObPH?-dMA&K;gPrGMjO+uo)(H{>sAa;tMp`rF*9;hpuWqqE4w428-){_7g1+ zgCjGE_^)4d&t_{Uo0{%Z9hc_Hfor+c>Pt)KDc-Slu7(j#Rr9@}7QAl)w=G2uLuH%n=3um{% z`+nWOr7f@t_6BY^AjFhXjh442JH%@%6)W{Po<#N5&toeufrUTRo5Y z%s_SO>wFA6)2GDb;3qX})al?wPEHc)ccc@6Dj>UMHO6#~gc1>CZ}?27N)^j2r?c6X zpCnjD%oMuFN0gr}&>^g-)Nw`mnvQ2sL7u}6e}e^uotfB_goVja=o9Tbw2VRBN1r}L zIMK9Et~I|h^a%H-{`?%xbwK!;J-|7*7l!xbnWZ2}Tf66((2sO9iUIZ;f??J3UJ6Qp zyLl1VP;HT)cTz99PCO(r1r_~;w2lZ}M&Hk6-;r`Uil)S9Z5iXtj0^zJp_b)AD(BCI z-bS1K-i{L^>2wa8z1nny!=Kkx5!}<2+Y4t_C4(yWvsuq+o9J9SbBsjbJxz6fl3t%D z_D$GH0AiO;@;4F^cq-6W1t#*Q(Wp511%r7hz6Q1IzdM3ME{Ag|Oz(ssVCVM}-IFaX z{x~~u@=9mU;G>nDJ@59H8vJYwan1hN_i|0n9^loqGM+gXo~8ka(g`vQz_FMFowRm#pF+(DvHAotmn-%UfKBN(k$L_|n91{M*11R5Ip z`Sa&$!>S`{BPz(^PT&gTUyAdom2La9u>92HfWgCLK+)rlXhYYVvC?v1V z7$pf~V0Lq#7W2jjEtf|l z2c!k^264}$jO>ZVH~IPHL=b0gI4YJNijIEMUL_i?7(u8bNQooS(swEi15Anc&4F@= zHp?bdYTu%QJiLWNbNj>&LRwGl7^VHQk~qnXPcPL+YhS)E4@_XKFh0T(3?Uc^f}teP zZfTn_>}e9eZ`y=+pdm{;LDKRuwm}F%hxy2@zv!i>-)>d_VWXo?rS=wbWEBdX8dX=K z_F7R~BdjuoJ6>#8D9Qy1I%}4fR@yZXeMY5P2I{MgEgmas7FH*vYDBs2n*vB1ooZ!c z8;lV2UX_6YrV%A1aC}>>2?JfIIAy${X*I<_^u=);o2Bd4T4wIe%&u46%@Xi|kVgqn z=ULLrJoN@WQSZ;9q%bh`N!Zv_tVl46(M!l19q^QMTb(hRA*fvQ>rDVoI-8^mTGjT> zE}gy1R%M<>ZJ@1eajC}rri;_Tz4>OY=>`G+`aU4t<8FVeV(n}CTj!l2Mx!CkI{WXl zXUU1RRrd|i(XJO-S{@#JKv`K?n~D}4vI?DQ9STT74Va@1uJV+gi1=?U4#R6NiMHm8 zYk{@Si2YN*idbb7gbIu_w8P;qs#a|@p{2H;?l~6_aXLE3aLBvO_6!1{amwuc?vtrs zvgCEPiY6`cpD`~-6NHpBqD;f_q|q`j!4i$o4CiXd;-jlO6PMSb9KOg7W$#let|*^u zO`0fDD(&tTm6q17**haHqfxs&zICP@bYJmfuQD7+xw<{w9?O+VWpEyCf4P>1chbKl zOBBGvW#7Hb2bsRNRA!Z4z1ZY(=63o~#O2f}UwsOiU~9fW@5bSx)?}exu_%sOjY&e% zVm8NSO&A_$yv$L1f#bdD)H|_)v=ogJ)7bX*-q^J@O2trW0zCK){)1TeB9oT;GmP@- zUdj(8m?5oMKcIL%w(IUrJDE;pMF7|4Q%3o%py2%()>&!|Gj2gkp|)ckbH9eBOr zxbyA)7NrLFvgs6}=QeOt=Gk=iL=np@EGd|uK>S6tQs|qhbv(=np_kLa)>PtThGjY7 z%A!R=F^b0s?RIsv`bgE!LQsN7*2T9})|X~}x^%miv!WCC_E8=YpcBVr57>_*57h=v zMNu8Lbg0CLMk=@NvecS3*No9g#74Kc2a-7>-unx^ED$<|nADSPB{mJ_mL!Q(3Sf)0 zvUp2WMZF%&8<|VM)pNu9MiVDY&!@hY=<5VhU+Ik3>to=0Ngs^BYBUProuis|JDM|w z?g)5PB2)+hT*NfZAwLz~c>qTYCxF}E9A%A8s2=6-Tmh8ob=!MO-~2g#I6n~)I>(gd@_|g!)7*{ zDpCFlTTe^n~fOBNvTw#_St11>9bXdW|hPK&V-rLY5TBw z{iXb5Kmfh*au|-l{f{NTiG!oSV)hU^KOzwf(qr{5>M=i(;Nl z0JlIFH>>M;ifWbNkc-Fl31hBQ3Z3O1XyW?AdsJ$tS8GMsdzRaEom3=VkE<&DALbP0d5|GQ@mI1ep$bD+RLPZP-)@J; zcAS2c^kRao6SR_yObtWDmTA#`eqY-a5SpHTf6%p*UQe|t65aQ5s!s2yzZr2fAT}g4 zs3b;)xWHxqx}^Rsi_YccrnXl7b<;kyv{rY24=n>`=HZY724 zbkG9Y1dTM!%Lmin`RgsT=mYl6;40n15K3<@#9!}GK|xf1(p_|ZRiTr{zw2Y2`* z32kc1lnI&gif2NbeEzl~4F}?;IA-#Hq zhlggO8i|gNkB*IYHeQdC$f zibD6i2|YJ(I!MM-l(mY;lF3Aq7r?*BS3pX19CoG1SPFiph0409{8?9N6zPh_S*{m+ zn|O$(E}QMNC26nDt;_=TS^j9v2m0B{nzt^aDGaI-xm*5`w6|q$O{l1J(cnlY}4PfR1p zQk0zBRaXWpQF`1^t+RaYLVW;x9`;5bu6#$AY^Fx!maCm!#8tEowAOQRI2wbIAEK}? zw)}cNy%BYsHQje<$sg%BmMU|_)vz5asA>y`F|C)CU!3L$&^S^iznrf9;oDpKrpMMO zOsaB@p}Duf`EvdB;C1$l1EDl;t8Sw4@R;wWCCq`$GVYk&o1gF~J&UhN(-Q^1JaHc6hShD%Gqhg@$;m^asnj3~^By?j)ql4@sN z6McD$MFMT6%xT~#aT(9I<)2j>NLNQyK96chQ8UJ_Yqi0(^~q6yBrfBm;j_aO`|9il z;n5^NH;N~CGW3Z;ah!9hu!lcxQWO?BUcBQ#?Kq8`Z+zHbY2SKcl2 zOOB~?#xL_}B{bY#p=xj9>&;FyYVf?>z7})S>KNoNfI|H4@oN1uRFfp}rmzc+f|JOl z1}wB6&zyMuhbW0Oj*bh=z@eh)k10t58=#DV&v4Gd`&3Nu@{fWus8T5@(0wNvN=5Jb z3$>sJfC}d4`4wb0{b?8Ik~r7aMKN`B?no+SuU$NyyVVp3S<`OmwGDzsj5SXT)z4UX zt5RHt$@AM1i-Cil9SgRuZR$Lrk?oLwm<8PU{XOd7M1HvNE0DnXf5t5Z&*=0Uyd zLCPF-O&8gD69^N2YWUbn)b45F2Z5rB^1eC-fhN0 zx&=d-xDq)^wc1;f5VRWZr&e?8cEb`qJg3*5j=wOhM20iQ-fXZx|@0 z0+uH872fJRsUt2>Ock742DxQcyK&bYOCOqZrN zNv_fL)XgNkl-E~vf-2=Bd}5=M5nN$vF`Ov`$doj$*ykYh3v$9J317J3Z4j&d9G{M|9xey>+MqM# zpRFVOHvBEUCZdY&M^J5Cj#40~+j7)B2Gq}>cKVHx2{hLU=OZ`q_{4;yB&jx63*iP1 zg=MI2d_#rx#DX&G>dFB>7Z+0Y<`So9?p!z4t$6ls3@v zaIze|tjHFD!x^V7*(6$Ma5xyQdEd8DAc@VIubihOZaYEo^2i2Fudho`$TvV0VWBdm z9lEnz-gk>pQ+}l>@4Cj;2Q#vn|>E_89xVORqq!m{XRH5aB+=Ec&5x7#_ z7cYQ7-`FX^PH3EU)HIUifm2d5B~QJ)?n@n`S9=L+1fWhwX($R~jx^$^_^U_6oQ#0> z5%+qFF6A49yX%`Co}b*F+p}T)#e1AzE{;!NVM2mK;E9Qe4NUM*@r-v`vnDsg@uJgM7r8z%5-wG66?fcDLRx(Qz8=* zRG7aAm(-tOvsg@4p55(pICzxr3Lx^#QkE>qw+V+Pg4zB|dC(Jv(*{*f6fJq8N^{FUe4D zLJye}hHFZ-E*WSjQI-d~#MpZ-E&*8^bb%;o8y8i=O|ckepg>+SZUMlEq-niSh$#7wQiDz;a!b;EiMr3 z&DRK-`f!jdW{KUji5w-<$#qZV;H@T?(^cw0n>?)RG7tNRwj9mXka9ZPWh9gIO8^t? zwqyKSPU@=baAQmN)#`eAiG zB9dHGJaIspZM`QQ`rzxqwu6#I7v!WqVu$+tAjvZOU>H)EOz>BK+0XnQOy3j~ zIu2?Rm*d~{aH283qg&J|+*Q>)SZibyoRPjV!t~Qd*K{7V41w~b8j(c2&i=uvYZ3lY zwWX}BO0AQ2DJ+Ri!?bqcr;tqA{`t>o73lZkf##$zEz!oU1g_boC>V1F1gg)1s}}YI zvfc>BM6xO4$=9Rs?1dGIX_-$cQ$73cIKLZl{7GNqeGx_ax1TOVCGFr9hJ&-3ofjfs z4sJa?I&#};VbKq(noJ{XvniGyR*dBldJ9_X7xkM6+h(5nT^HQv-s)ldbzhT@KT3=V zt0IGT);Bn~?Ez9!4LYeb_W31N^%kDQO9bB=+}e@4PgIQOl2BrLV*B5JCedy=bjcoB zp0aUk@wj&h7%Ri@Avo697p$zid4`k1Bs3Ytk3o5ibz8~`QE=iP8{3Fj>N&bHOS~LU zIMrNnI7;HTboN8;lBp=(}CWVaEjkmG(u zIlz!OSnLDED*v6y$?_&DTQ& z^GhcDIH$|KIcaPmxTcEXm$5rsW;6WE?qZ<1B8o6_es5j+?)Y_`U^6~@JMc8-^ByUh zrdSl;3%6CDK&`wMAE|3i(@ZxZhCoswBh@|+rH3Xi7evF2GvWE`Dj`f@zuajg6Blj- zf8Jv@!QzfcKNlYJV=-=zb^qQj7*T6A^<}rMY4rMh_hS7UA0#vnv;Fi~n@A`w^G>2s zXDAL2u+=x{73gx&+xN4fSVKc8>~@oT7#ntHiN0&kGUt=kV9(x)p$5AW&Fl-c(pp*X z@e}9^KR4m`JE0`~LZ~KBBa18Csf5SjxW8ECNMJ|G;IvhaoZa~@<^J|$o=wMuPgS|4 zjE29KAt2p~-5^=yDx8uI@M^^Xw8cchZ`69sLpqx>_wjxRFvIf`oL0azztR|czgmU) zHAu?eksdWq?}!jjxTVHuA)S0B^W#{^C68>HqkU(tZvh!;+1|FeZU-`Y;hHUlhj@c1;B`~zY~qX;D%zbWCMggV;QXxQ<-WNxDLEE`*^8~r@cPm>K~;3(kvkMJ zhw}-qGZCK~^>SpF?kv9XucC|E`7jc(30H$5D{6xZnilLo>!r#$Mf3BcVB#bjDWfV< z{i}FW4{iHtF)X}#A8{=9LZc^8{S<7funjB^n{;1m;4?_mQ>2Mc8sn1T`+Y1 z%4*|d?X2ug=8$}Bd6{Ak=A?tWU``v9hrfDzv_p*xZ(HDpP?((55`3W?i(L`HZwo6$ z<#eq9Y1LH|K7PpD-eR2UT=@&AxtMMOihK|G{NQm|Os6wEnr?Q+3stjSY~?-|1_i~g zQFe4F1qOu&hX#^iprfOp;G*W+_1lCF+!kiFO(6ug{1=>pK3j{Oa*!cpAl)E zkiivp{Gn>YhGY`#r!7H@8X(Ie%!mNVV6u4k8dUO>K#DUQl3xOFv%nOq)d-}bX1?bp zgo)5~%3uq%1TwEP@|u1ypPjAoKD}cvsI!+R2yWXV(ULf3C($1@-YpAa?pM^)dxgw2 z-4qgLmLSQF-#uXKz*pQ>V>Jdyfhl~^0rb7g!MJxCDH@gEU6D&}#?YITB?bxEHyy@~ zEP5|-JOv>}O$wZp#REmcUY4*w59EGxG-pm~Do1}RX@hwu@GT|UYcB#9Uh`bEFYslA zxtRnJAa$T`>f4@rXbK5Xs+mVk@28K&>b@Nv;cyIXg15Q|^S1*{^OQHbLz`Zwst(_k z`K}z)#a>)mQ)U98!CykJt&m~)950!zG4UBfP;V|8Gl63xF}7ZZ1z5fUUB1qu1D}CvL#taBPp%a4c~!7DW>S z9)_IFJ8qF~R&p?Zh+R?KUX@)Y-%&0M@pa;2Jd6WUbzxP7@R2|XAz6;jN0cUDb!?7m z-nsJN3+df5#TKM+*g{Qc(0j7VbT#o4s`hXA7K&|B)5fnQWD7(|nm zo)IwK^##Xy6XtBbL(1w-#BfVf7E4xw^IVLh4i`QN<`$Qu7My>*u7Bq2S8dW^eC6?T z$*C{B0>hb064mVxI)xaNbX3!_a?`88i29=0Tq#Nk?s;^10|rLBa7F5oe@>Ep$|a`X zR4wLFvjV-gn6XJPQ3)D$saSOwOry2A(}(Q1>h%cG&O;q44MGbQ^1?al?q(cGH6ndn zqE&+la_QO9DC6swB=nMcCMp$B!)TlreuoU9)vBqPVz+=fT=Cpnt^snGEU!u|{v;Lg z+5Af5YPEX)ZgI06r4X6Qkl`+4(b@gL0+HDa5AnB>ha%c??!`rpCyXYW*{jO5xU|Pa zQB`8lUYiM0xfN-FOe;K5KN?@+Ug)wPcF34>9T9`LF{yLUT1G342DhW7D$mrn*C#8G zOKwL!HSoJiCH=hsm}u$x24oJJd`do(9Q2p%SZ%)Ufi z4sCM^aIx_Yy+~a~v$!8w@!-cm&-&E%)n4uDZC-Q_rOZ`d&pIYax14#hP9)yqwIxYz zZL+QdMXpg_NCPvj)&N<$<^9`wVuew;{7B-Ckt3B7iBALw5k>XuOumly&M&nL$5?ke zY7>(@(vBb{bs$MzsKrvOuaf$j9i2{>_zx;ZK{pn87sx5SZbV$3jp#u9A!d~4)@$S< z{sWe)8L!Y~c#(>Ud{?Jolg%qcmFw=q;2WknCROPfQO0mo7md>*m4bFigv+&6yeSMM zqAdZauWPFx%#U{NLb4Ll-PPxH4BdaOF7$c#duq)W2X7y5oTeL9*=$E+m{03@$IpKT zOCp4U5I4PyQB*8e7BJ#TVrjl!LJ4T;SlHN!FtBljZdp(`LK`Oz0f#z+of9dippduf(8$D8noYrrP z_rOUOsxcv(qIV#+wTNA-$?R_C7!gjVj~U69MX(zYGB1Tt8P4mlu5^v7kR63P044>$ zfv?q_V!4@0^CQW(e6MaCG3|%+RA^I0pa;)Xg&PZ_cAjA7) z(M-UKB=F3?@ibFgxzKPT$+W)7#9yJO-hU6JIBq~4MN`C2(>H=IbJGTD#m{v*DUNAjX~*lN(q1SDY>FJu6m&)Y=c3n*PF?Tz1udg^ZeJf- zPN>0BY``pd6=`!B<)$R@Hal)2tlKeUukwcj&>ljW&!Aa#RS;HIe#&oSUa7)%@ z5V)%=CJv@##L8@aC+imRESCQqQz(1;A|@w-nqU?S&Zec^4&OC1_mh$UQp2l^VK}m` za3=6zN`&dTI{4O19AzwvK5vt8F=FTC7{w^O`i!SLEpg3pu3XibYeXgvKxF^o3CL3npF> zNk}QiP!ThI2{-!$ijYMkmQbSLi(4(cm8@_l;`i}}Sd1v)O@QjqcN@b=d;uTa182|E zh!x9Js~-Z6Y>Yjm%i9(O2`9Qw2XFXA$$6V%N=3%$06Iy;N5!}_?Gu%l57eBDj;KyO+gGpQxrn9!LS<&| zn}s=78gu7qT;X>9s&iaTF=15W4>0su6~=MM`-ikRDR`zNL@->J19EZtf*)9(Q3|ZB zz!A;P8H6jcO}`UHP1*!aFNQ2$9Pd!$w<$oun=e$Yfq+zGtTH&&k4^?;S-Fh#L=1{p zrf2OG0#b_A3^Bvwa?XVEv6;f4fc__x*vvW#M|q7UOu$<_@Lr#{ECTJMioI(Jtmfh( z0N*h&-Wbw4YiMJyw$BVPj)&Vw+UM5v&A1|F2D-);TiI`03e@YsN2fn#HqJ5oJJm)9 zpB#{Bh>$?UlQMS$1kN&us6*G()~Xb7t}5f@{l#gz7{tX-<-77R`jQ7+j-IF6-#_n1 zuWehFJ5I(z8(Tfs&E2mIJv+XXxbUKHEiST>8{8SxD`pG73aYxZ!vDIdSf2v14ZOjA zKSXJ-`pE|EHMW6gi%Is~xlO(geDOAW9ns6~SL$)g*k=7&QOo*q$Y1YWF7}qMclA_q z0Lm322C|w!eosMkdN=#aI;zq2kE-oK6hR&e=r7Nwsl1tv>!?r^Vot$)`VHS*uoung z`4Nb)DkVrJW|z1JbyCwBPK*{U^$7h{QYzdNRM!F>aoL zS=Z5#lyfLJ3npaR#oDXq$0TG^;{W`ycpmB*kQ~Qdf>E1%hUeDcB|A(25dhTVT~lmc ztLf8I0s3$k22$eLdXLTmm~)Y~PSgF#Tk zETt;IjBs*VNk5}}IWmhu64#mtlFh%^uFJ99D><8rtC=!5-qEG6iZcVsFnytOaKZ=D zjfz1~x)nNd404`u1OA5$ABl*vi`PXckM`1nr8kkwn*vRK-Xhv(32gFVwN;2EG`sHhdD6nm5sv>=^gg9%&V{O z1X(l|?+5ng*K533%44^AUzwhGeX`(LU3-Oqn#r#oUV56bhb4Wh&e;!3{lbm@ zurfiwSMO4&C6Sw}pVjckC-TpoTml_QL*%;Ny6Fp0 zaGQ5)y+($325-f(yUr@!AZxQbqVy`ql=bn7Oy|eTksj(1~b6?5SZCS}ujeb89 z(R}?|atx_Zg?Z>O$8PeeS5PS+2gp(cu>aMj(@&$%4H{ zPm$jQ0UyJ=Qkq4)h#icColxDRG%=bp$bWKW2nl+0ZVoU17Zy%J;^j zv|BJfk(UxSVT_<&!jQnz{m_M^ol63O-(?5Zu_szKy}{hHs}>^t;_O*Y^fOZ4Tw}r6 zs3E5?+d|vgPG+by)q-Q{NJSf0nDi%q;B2@hq4TO#wAZQsb2OHp4ix-#BErORk#~YH zuzpH&_d=p1OF_!LMXec1b4FLNro^qJuYm8<+P6P(eRp>jo8J@;m9?N@gOsA~Nh0(Kuq%(eh#y%OvXM~!K3Za9u4_g+?$*1EYD%>NGWz!E28;o-h@TkRayb0J|WQUV;Ui!E6 zo;LaE|N2emAyxf9-*o;;O#g2R8vjF?h=(qq|0wnEQceW;#Q(FNF_13)KThTbvd;f~ zlSh7W!T*|XvMLivqeL=zgexMz75gzdNri^OstP4oqqZ&>6bQB@BQs?o`33q(BmLgM zl7Ip$P&UmqBCL2PeaHLk_sdzIHTv!sJ(2ilZRIc<57GH<-}|wZ)v>d$obtPfdHQa@ zi@}D2yW3^_xA+&=gY71Ef5P*Urso1sDLIIsi9B+5cRwVB65nztxCH+|xXLeFO|Ty5 zX3}5|J-tF`Fg?r7IhDopub!rECGF-5>a#)hPn{NQwe&Yf3R&Bx3|)y_6Y@2_-%3c1 zR>t!I+uA`@ea!d6xm+1~82XR_cI_m{JCB{%p6Bd|1HIkoG zReE*y^R+&YqRWgL{lNCAQQvh6#T0rIpSey7IYpLo;j!3=S(!F1JK&a#Ds5pE?c)@1 zPH#9CW5bZTm90jXqB|5pZcREAkZJFMeje4TijN7az$AXT)xOemEWbTMEYzKI?c4wKb+il#6(e zQ_)O>zB>k3_(n23OU6PNm8ly1a&od{ zoUeT_>P#HAzrAb#7k=FvPisVrkgx~NFK7{0WyJ3Bd*$ZvfpVXYt;a5U|W_0Z+G2ZVMZH65sH(R5Z(|Ecj#H@NAPrC2&^sQ-70$%Z1n% zex7xwhYWo}?QT$VqlF<}kwQPmA@fyk+_m6q*=nfVxW{I=yTd1b6zkF$Z%cqBNoP!_yV@;OZ6%gV))eC zDz^uYYV$mwa#sLqo5HV0Nh%G+gSxf%J}~Hz(tUuFOTee1QfU4I05F&n+YCyq+%1!G zvCoZM0o9~>^^+=HdbH3N3p#)or5%ZaZBcS@wA=}%s__yTQGQ$;5(0H{mha--(O z0mlviV$L+!;MgZG>L;_>x5H`F?Z)LX#544U>l8|pWvsFU z=oVD1*Mn z(t*MJUKMgH({wg^$A7Y@#utAc&2AL`i)TKiagIg^xpm`jD%5eYm%=eRf2+8%JIB6- z&TPA#F)5w=VG&i)ZD;W6SY~vN<%B|NE(q`uEvNfW!-g2ECKi}QS4!qP`*FkzV-lx^ zVy;10E`sdhrU(jA%Y+Tss%#j;;8|PIsaouwd(uuk&9qYqF?3kQtLF^X*T}kcNG+~R z4CwTUeIj0%z)1>#N!GgwU@GzSABYxHwq*_lJo{%K)Sw-3Ig2F4@#zTyg3V_DeJC#E z;}CrZLlrcEW?Ff%ku_W>++H3qGNH{pzl;y`pf6JgM)l8Gp~}o#I;k}J+6artcraB0 zTR0#fPXvEMssLqT3m4L1As=FlNgfji7*pz*28-CrvLa}v-y2b6Jrlo2$;sZ#{?|_; z|J3;6fAUQ6zmUet&nGPKP|@c9)QDMK#dh!G!$H#mVytg|cWE2K>2j&Qf;sSEZoPq9z-1dL^@G$4W7 z2KKpZQF19L`LdfqbnF3{RXNvu&t=z2-JAW-SJ}}(T6-3^e{!@@f`ncM{d&@^HW!&z ziUHCRGs(x@Hm@)CRT7-Ml^UC)nkR7+U46n$AiL~{8#!mc`)H|m!XlSjJ&FQe8Fzs~ znE(q?y8@fVBbAA6`wQZ-o?+mQPh(C_p7Ws##S1-dOt9hCiUzm!DNn|?Q9q`Vqr%w@ zNDd2zvDr(NzD?wk<@Zoa#4WX4r3}0>d2W+ys#1^Azs<(4mBx}D1Z$ME)WS)kDD_@U z4>n4peN^ha$oMWJl@_(sdNJ_bQVQ+k(nU!$oYGmjUL;`&W#!x_Ozc`X4!P)KcsMV3 zfj=tI+oTkoa!0OH@Z8+H zj{|vJn58EbrU-+^qhbl&jNGDgXYvbBvv6@f<|gHDpk|TKa%{J38_0z#3_h0Nk}#Uo zo;nJ`GiC9T!yqQ$x4S<`p=?|x{~-598|9$rJyqj8d5fH6RVH;~5)*XNcFzXG?-b2r zQfaRk<5rUpv>g!nM@|m+lve>cHy0h&9YrDwj8d7f;`LEFikT#Y zwi{50VB4XL4hU00^|RbY&9C+E5@lLck&Y?pZ-OvFX>g^st+z=Yk=nhJ!wAOZC^bOA zDxdluxcdo>IWS{iIt;042@#Ft(2_>==&J{Jx^U^Gi;QmkTygJc9x*kEUXfp=HJI&b zDYO;|#eE(JEoL$r1$P<;S(wJ@kt|qvRjxqTPwqA~-T0l8P^YX-22ZXAxP%aHFhlm$ zb6YJ&j{zsf5tT}G0ip!LRM{w(dqt&>(L2-fIKJmYDv342ix^I1Bu9ue9IB=o$wkmH zu=$Qch=`%?I+38Nn^WRV;yDulUo%iUE?zaxlMn=vDH%~IZ z1&|t~P8*{iC zvs_j$4f-k$F#~lDSidP$ys#+`^^9hEDPC@t27U1+@U1UiMVKpZri^RSfH;moObDnG z+LC6^5)w|s1^+ow-#EHH@0k{G*CBO#yMeJKlQd@$4Z&Cwcb$ z&q~KIn`FQ}-nctCHRkYwvGrr=a2JqHB6v<%SHJ}?sW_q1FIU!FfhGAiz}L6F?YD>is$(wV7ygppA{;{pM3E17PK}QCrhQFbFmk_<9#9? zRwgsq>v(5Wstn7rc%e{JT~cT%o$|Mup?5SkBS`s7w0LRsS4ztIcmyMi;oK;#bti8z zpax(Me;vbJ*Vd>h@-9q7D2+&RRt_=T+^4%U&bNRJV#j+I4>nu8JZkBQr!jIp%A%)( z*8bc8-$;tnBPJ^oW!nO}#J_93#w=J{p7QjEuN#cFk*eTf2)B`5?kfCtDw@30ilZTd zJ3eV2GPe$wu4D{9xjg9e3Sy^7PvdELtWV!k!m{WR`-Gc3K8}I$ zq8u6HUHE*@^0o0+Un%2pFCSe#rh|TVT$VALde9ncohb`#iI%TGPo%LZ7e-dW<2UY? zg_eeIreY-0~Dx%R-4@rvlfI%1_~7yf-y`@w0ON-_;@jD1HJ|%_&rr4fe895^FtVfzi@xwwo z?e}GWT=JSprIz*qhW2iKN`A7q{K|3!i`a9pp7lQ6D(=v-xTOD#|XdVE9!r znl@KUV8?=lu5;JG&p(!S9Pz6y|}c)wLV5Os{aI<{zxd^lJ&Wuyb<1mhudpJEf&>o(u4 zgX|6z8aqBNf*pDDt;8*njC{~oKV6)fjH7yyzCi<2#kPYmS||cs4t}50TLA_Qz zKW#m#0@Wq1Pr;!!_?a>dPbulR_s?m*TikGv;>CHS3Ib}Lv-TB~ZH@vC355O)s$R$% z%?lsIt^%bM;Ku<3DkXY4z&o08ekoJC1H+G&UZ;~w1)SbBuJ6~U`mFs5Bxer2@|rL_ zGZr@hb_nYP2v0}~W_KW$B1I;>a_B{9I(LzGe?fmCE&YC4Y~^q}uPI!&K9%y#gCa|g zm0e0VuMR*Z2Mryr^aXqP9G$|t-o##7C-X~ma?I#_mYAHi({WvXNVH5yBDT(e$p|pT z7*5EDL5uuzG^6Df&PwZZ*Zykj&@F+28f(1CB@xo>5w+S>aaqS@w_k75iS3+&ACJH? znnsa~mXmu^&XW5I!skSaYAXjp&9S}KejX&LXTFZf%9D9$doaKfkWF0;Ay=*{! zhCW`Tbv4On!jR}S?Vf4;uK zuQJgj6QG=2N+FS!?vejVWn^qZCcx@ym{ZMV^*FDoy)dC{1FO;FT1dcMDsYZR)IKS^ zY(pF}r=P93Zuv=#Hgs}{b@&rax&*+iQov#7JZ*<-B>D34P4tXA0ZR`W^4T=}i6(lZ zN0Csq>-95MJLfZ@`b`7mDq3NCQZN-Z@P+CZsz<6uu2QE`mvc-jd1E=Ejc=4GWE4F2 zB&ImGsWT40a0(SNcai+(S-M$&`~ZyW+mgzJf6@SY<;v2UOrqjjuH~g;Q3DlA)j3~M zes`?CU!JO|Z4@$=a_Usn4H}LmJm$)l}1P37C*d+sRXKTJcBE`%3;`#>(+ zA*@?j`Zb{rV|3*8kqovtsh9rbrP3A^9r)%+Ws`@8(zQ_Aeg7-F{YH=T>e#fi5gG$K zXY&5uz=VwKh}f#zKV|HZ)XUL=(|gE)z3c*fc%qpE2X^e|mRQ@PaH97nbDLB( z9#K;07wnR@^F&r3VHa!yOdh3DvegIQHwm z{S5zM{pPumv1nvRH-6g6oStDr2)lqui0rhr-`yi4>wIOBb-Khk9$&H_M){Z*@r}*- zE`(#hm_9PtJCiPMqhkU0Dfz{TKo%DAjjf%ZDAAGekub-GpfDm5<4pFT$5UhU`Iy|m zZ4K{EHY%421#IzZR7iI~g=JL-;2lCLcx2%^6mWpeyL zy}=N);yeG>54-lBA@4x$n-K} zhxpzk__C^_W%NDsLQyRqA|(X9BjDeZgrOtJKlf(L$1s0VXzZUb+2BeO2AA>Z~JX2^T|WyCFk+;nmG3V%o5vFH00@3DYaT?&l**=a55 zm&Y|ucDMR4Yi0$18Xrg5I6svF{W45aQcdXgSIz?7<}1tBXrH6hzjF5RG@k>oY3K1DP_J9G zPKn4QXB;HKvh%q1nz^s@_`|`3pA^?K-|OHGvJRN_5GjYJ)R*#}&ic{w`R^%cdWENT zpJ?=&atArzy4-6IeuH+vK$tY9Ag z@Aa#1C5?xUYNI2QQaNfM{?qk8Q?O@W(E3ERzQBGfKd~^Z5GH!+OB+JWD~~@v7?|N* z(^2!Yhx2!-_|dSju;gGVa*%G#jo!)66te&u$BL! zscPYeqXE)%m`q-Rd*kjEgy6* zx(6Yn|l#2u4=XvvlfE;UL7?H=%A?Jhu z(YRaE%PwAxZS5BCwWFM=0=|MEEb4} zyn8LgQy1Y8CH55Bu0TV2>G*SVVD49d4FT*ana6$3le`iObK58{4k&Oiy!Ww@madoi z<4J|DKzE~`9nR$W368M1{p~_Xu0VIkS#--3caM}hS#Sn*D-&lwo*eZ}u)U90-(J5G z`!(g8u>Ne!D}l{sAWG`~0A+?=Da*tGfZM-DlY6_^w8ATLDET1>g}AV&jyojM28Ho7 z2b-vl{VAseR+;UjNpSO<)q+JPY?zRd)#7Vg*3%E%$)|RW@O(OTGQ%rl7c7t+$QqQv zRbQ(VtdM%&{7OE~NR>;k!NaoR=S3M7$cgrCsF6Iru~KMy9aDvW?$^01d|`)T>G~R9 zSX2>{WmZNJ)7~go)qShpm_|aL-k4efZrnSj)6vi`FkxneW~omj$_co<83|0wbj>#T z@M7|@X9-oBaOTtR^NpQ$WYVz?{*`%mOvYwHw+bFoQ93>e2fP{QOzm_G&$o9pcf6*O z$rmra>dz{K@d%G8oJ)rbftM8cCfb^Es3v z5zZ4nf6wJW6@`E)^X4h|N2obqaUX-%){ju!MVtT7RaOE;B1%#xdDdz-#q2o~`IVga zWT53`SMco3kTXT?gi3LZ^2q2>2iTm<+t{RRrq=OTdOHq*;|dOrM43Sql>}sQ4T(s^ zw`FZG>hK%=&mFc68FY(Ve*vm+dQH`yVUj&nJc;#_Fic0R7By&}W zG_}*jEF$Zl)lwMF%!{OXh5i&uXO7-F`?TX+|B(Xp8;5kLVx~%WUZ;x7m?AmHz1}TS zt1z{(6-~KFJ-p6_If}+vq#C|%Q{dvXI+%(3l*mG)P&s<>J(HXb%G~{e=dPxU%UEF) zY6cd0giw;nJ<5ILBDfZA9-vFlppU>2N#Yd9?=Ose)~Ox9sKeqFSV_=L2@9+|Bp2US z+!fweP;8u{wjkB5lhrejiPfo>HFYH``zhcf2eBx(@a=tBn3@G_#!t91tw;O8hiw;S zLJ|43Sw^od>MP|2@vh*^na#O6^eR!^Pr;#cSP#CX+8qC}%SzWVfn@S+n(Uc{CkpSP ze7T6Om&Hm+v-0iU2JXv6Eb>+yWjrxees_v!T;O)qL}D^{&g-SDEdGD5$ONc z3Rp;xU;H0$iU+Hp3YJ02u=Q~gb^>-o>*r+7b|mSzWF4G~f!h0C!GuPQ3lulZH_Xul zQ3laRIc~!=ssoTSYpbju5vNHgJvTI*KHyj%W6leP`*AKqL+{ zV4m$BMD5nct6srd$vB`Y*MRv&N^$^dFq|vfm5@SQ=a^319G>iX(to@8Ga@SZTgLx- zE8q?v;IJPo>(5olS^lAG{kY zKGbP)N={sU#$*4qe_$s{y)~36?S*D~kptoG?Vvp1+HUbXy(ry;K)Tk#IIG#+rK{b? z3OpPi4J*{GG3DP%r%{N+8IH9gUT$ZOzAiANm?#_BagI|MTyAa<=z~9YhhDi zhS9?;PsSe&u?{6!_3YZ4%JGP2vy|v}x>UkhuM@3CrE~QViOb^OP_{Z}#aQDZL_SuvlAgdE#-{n-^<=7g#o z)072~aY2U)#C6axWICDBR^Y#$+PTW{v?i>+JX{SIon5Qm3W97{UGS&&ptT|tJ@n;3 z@enBUb$KpY6a*@HT^uBHbJKQ}d9oj0v9X{1sUirGNS!{Wg9bR?@Y>gWL4&6?%Wnf4 zo2(V#;URTwQ5{q*n4s!nwf3iXKj=Y&i&-fkv%JVpAwEL*K>I|yH$ z#fA&ixFoTqG<<=Vi8s<23oLKW2jie5uBFPt?&D&R8OkSz#e zi`Afk(W;S9CZh zRLH?+Z9dE*AsqNJN1^t$z`g;aO2bvz>f-vHGCP~#7;v>m{Z3HQvibqITCsko_Jd)` zI|#ScOafWMIC86zvhVx#9(BO_Y+t1*qyDNBm4(=}1UaJogE|<;CJPTbJ6v4SF1QyR zU!nKIn0ua2<8f;_i$8JS_uG#63SR(alSKt39WQ1K3-`_jAPwIN>-TRw;4cN~bGq6@4p2B=2Z&xwPj~FHlB?w^E5BtIv zGHd2%6$%+5?f{n(c;L5AKM@<$!c=+(!6N=>*>WL`iFp3uI}MnT1{GTL{BZZW9shNC z_cl99s}5_6lehpK29#CBHFh1$3YM#8;UD}AhPzAsr0^nv(y9UISAfUve5u@0Xsxj< zUNMt2mTGW!mLBVhtBUBS@s6HBBdPLYT!^JCc)fKjzW`#1e1uGoalY$WD)&4lMmR*$ zVo@Fydhp&Fn-Jb4oXU;LI6r65Ob`Oe1PC-x=SXYpH*nH8YwS!0eW_G#ryxiVs?4WN zLdq8T>Q|7Gnu#R$|sZlzOXdqxCz=apd8k*oHZ!b*4yT^(^?ySZbdmr%rnuBsOjw;hKtAlj(2 z2(TFES1U6%<%HgYs~z3s3qv9EzPGDs5{yLh)sA{wA+euov7jamZBDnqdO2&x`wsueJfYZDgsf)YfY`>F$OjoJ#H;t2pb`wGiIE(>I;>McdTER zr-PsEY~?JtGGZWr(G$3JU#MFANEmiHLmDo*0DlWa1OgxY4porudwDC|t3nB>p0y9d zCHD|)fmF=kQ1k5DxVEYZ#>XXW3XI9>DW;AHp%_vc^332^SzER0l~86Y2Qx==rP-s` z3sgdiDdD&e+!5vv+%91$dvO8RF@K}+NHdD|4L7x|A0IlA{fY9<0GaJP*%ErK(@S_eLHvxarL8O0v;+5zegwiI_O1w z6a5jcqMyI&(qHY}K}TG?_Ld74ZGQX4{jvt~0h zIq|7)GV+uv@}z==!1!ni-stvW6%&yc3OLH+3}f*Sc1=XNBF5Nc+FIV@lk4(po0hAl zs*`UGSJ;7f6nTK9m+yu8yeD*)I1=L54zOQHCP*}$8{%skt#xn!%N;G9z>?zY!q zzkcO2CD<4kC)`HBH_=H12<^ir%%m%T!Y%RGP1{|RZH0l6r+yJ>kW%Hfu}N`(r_-K- zZn4pAZYwyn?s+`4GK$}X=-hYO0h{hSEtFIg`8>a6Jg$50U$**M5g7ugjDZ4)P7yG@ zl$<-vIjs1oRHJ5WQizUw(oqoNCs7*62%P~ST8a#N2GLIcGsN!aNi`I-?RrW@8>%i1 z%+{S_{$m>|yFk;-ymWM<+z}hQ;y^NhoME4f*5(wJkRIkt{&><%FnUzTsa@+GPiCGo zxe>!Oj^+i0_cD)=e8AY`nb%(@Z2_vh5nc+T+ZbO2z4dktW%c-jNZ4J*`Ywu>FgQ7{ z+h)5F`+)D2pxaWYz$o?2ct+mL-&C-Ih2#j^B`%70Be;-KI^eRhS%|v6?V#-g zWj5e7)4D)`rsh%D01kGwctlCQ@eL} zU9ap^4rLb?2n=`XDbZhp#ZTn*fXg7EfA7aAw)jpHrBTNua>eh@f+BrGKSI&HF4oo4 z##~K1m@L8in+b8Ind>ByCvAV?1?mY~%im1fi1m+maGAoDYQ|h2o26WQ1vY+f*oYZ+ zXryPvO26W!r?Ud-`yqg5#0HCohXq|+M$Q@Dbm`CM( z*2*16^DJZi=Ayfq^_m#c0TFu!1-=zM*xKZtBJqJ;nd^<#_3Pq~lvN8UvppHQS&oG_ z$p=l9)h_`1nj$>0o$(pJ083rmzZbCWcYar}(W@Vhhe6+mL{H+Ba3|qz5@1p00ah(} zlfW#9+rc~AFx8+z)7X@RNV$x45}t5!PrQU!0BkIxS@LDX3LXW-JoD9lCWO5C3z;#> zj0LO;91uL`uJ{LBqL+B%Wv^V@jm|N3#M%S=Cd?sB_s@9V79y!jc@*xU`h?yAN zZp?K_EdA4EFQKAi*i7nBhhw-{?>hh~kS@CN*#)?6RDWdh&co_5ksjuGV%-wB8odbE z&*b$tr%$l)`Zfq(8!sM9TW9p(vk`<4t@%>Y0jX0WeXKX~(pPsud9zMbE)?UIoXnzq z_9IQ-qB6r5;NKstN+HO9;C#bL`%(jxNPWYEatTB-@sDe;*?Yn6m*}s1^cITZ&~GC#Tz2?|RIXF_VYh)b|b>e-h_4%bnFD|8;Gl zKI(PySOWVnFfQV^b-0=0dxJ?F{XX7(MM22e+~s;dA%(wnV@>u-TGd4XPj(#c7~e-) zf66zqf;cugW>0^>?ZS>m{heXb@3< zge~$UW4&vig0cL4!8-qOyWlnO+JsF?sL8*dmdG~LMVQa(L?hG}y!Z*NAtdIVjhEDQ z^Q+X_UsE_q2xW!F5cg=C4^OXe+HPQ3--zZ|Gt7HO?+ZNipQ#!I*oE0Q_+Z!6E2>O!8Qx>I!#{`>byCtIGf+uENGmAJ|CRR>)qmth-H}Tsx%SKkQxK-Z~4g` zh^`u_R4i=HV|Y@)l9dFVM21Kkm^tHAJGj|eEx0%%Y!>{X>;v`4c44+EOA$;X!?~2% z?3X0%MmARo@ydci@vonbOubE9rqwiTRy*dl#hAj;%rLC;mi%ZbdA(p z8p<#qQSl0Y%AV1%qvV`%e}@{{7H+fPMb;1HwenQRTvG^cZ|2gx4rz`vj>2Mf?l(6pVX;Ozf^Q{2pF}{d_8KKyUW=pNr!-9y zE#kr116KvZ5Lype3+W1KrJl zO5vcg1|G-;DzGh{k^b@Q%wTjw2v%N}*?&gy`(x7?iI4c+uJ{+Z@p71&X2t9o#kaR} z^Be58a-eKz>db~v0{N`2-)3de;AU|{Io+o|UlmXagDoZK8?!ezD23S;7o=pnXeg&y zG-N1?@3>o;SHia$GOyd}VX?PP#@R*(tqa;Ka}s?Wct*f0x%R%CO}6eA>a6afsdPk{ z(t=Uf`_k}$?0cr%?BD|g_0cIRp_#aT9odv20HUCKSDE5)XNcLP1`{~QhiXb#{Oh$FRNBX{AKkn(ry5Bti-gM&_$^9~ulOd-1BKq@LNKcD_%ev=!N#-XM09^>x2BzagCkf00z32JFkDL=<^P-ZvVDsAPzHzi(WzER5~DY0 zZe}sC_T3rF9+{D*PkJ03pqWRn*??*zdDE`3%gGi1-z3 zLC#5bXGlE#Q#L<4D2Db6dNQ3kMjcX7Nkj0$J0M=>sLGlHaqGX|ow9&hnzQ*CKq*;$ znDN;I50tptw-iXzGmGNUk9N!lYmp1s_L?vX+4fqy&Z2v^%l0YsoIqecz|AmH-ZE%bY}1{;t)wStkZX*Opw{v`mP6SUf+tUtq9 zgbgHD**-(r9`bPvYvin>d)6+nht$Z~Kqvb*peeiUEPC=2XA^)}z*3v~RMEg}kpEiW zR*A33?hI2hkYm>a>#w7*2eNUbj;1w6t-^BkFy5;u_OrsOr*#(r+C(%^3Q?um>KmoBauc@60()F-8raEp{q zFCU=;i5{o9#y!*q!&!jb0m|^e@;Smw_6DVNdSH+oNc1`BHSXaw7|sA*tRnTN9sDQ$ zP`h!Dq)%yz=X@HZ)u_7Qc#*5Nr*i*tC+pH9%i_vq0Gs|8GF+4er+uA1t^6}&&^cnbLJ>*#jyyxTANH?Si`^hFmN=(eEW{dErE z(%K&ak4MIhGHWS*668fW50}LGMOmVz?OEIgYXFqjNG2xhGl_FMfVstQ|Jijz(nN2r zRQqhTdgW~T6Q^fqr2jRhWH95EM^QC-u1VS6%SZkpw7qy^KGWUGH~XP>`af-Jf(~^T zIYwn0IgfVm?Dc=lbjscof>s$1h9&*^9uAM;_>$p-ZM@3?Np3g5j(CroX|XP+zuUw!)t;ijf5c-tb=u= z8;{PnkWl9z0TGkc_!iQRB+aR7G%puK?wFL@r8!~_Ht>Hm?giT!m)3^fD6oU;md;dY zz*9?S3IyQWS5aP=w{7fauOunnLa0^LYeH%7IPm1hV5iO}Ny|^5x{brlmnawtCUY-N z`n5-C&W0~dvGG>4Upv0exLlOOAOX8b+AHdIJAVLbuYQYbFJ4+2d+{4T zMY-b4hV{(fJ8Xl!TTJ@H{ooynb+4JozkXtUXm9)vNxc8AGq&(QbjDWsyB_B9ubr&^ zKesR!;`@&@+<)D|T;_yt4+|5XR`hwc74 z|1j;pPqzN=%Ss9Hi;4W>pRi*l&aamhiSArJ-e=i%{V%TwB7B{AES8T6CJ#o6J#ShU%fFIQQ|)^6V{<^cBCV(&CR*$)mpOw?`9436_$FW;9AV zVob`&%WoC-RVCl_Gf7HcU35S5_dV@fJ(}9V;3#aQHCqAE(DzKm#xrTNx%v^Z<{fsiezI!6n)nvN|ZVVvD%ci#)Rt(NEP8-kMG$z!UB%`kiwn8HghD2bVNop#KP0~Em zmkfhzu- z*<)s_obU78Aot3a776knrykiqUm4bn^R8iUo$6-9g{Ew><-EptEtr!XU#)Es_?oTd z(b<{2So2o<8}@87p6wqppRaH-0!nJnh`!wxS1yJ&JLlAV-Q)D~F7E2Qye)d9 z7L_=g|73A!vqY5V>56Hxn#D5K`zWIJbT@I9-<(e@)8K_GV}*l^L!Y%*gl8?&5a&9_ zY1oJ2XUi$CWIQ7-L4WYN*=eOQXcdK(oV)%|cC~$8G#BBdxSow`jEgJ4^F1$7dhuZ+?`C8a#a!3d)+76g=*Ps70x(3zPcMR}ok5 zhuP$+SfdOpPuqH)6qt^NHQ%tuP$5sG2ctVYM$XM70H9GVA1n^C1aZ*WBCH zxf}H!V*x#2PcsTK!KZx$XCIrNMrM0ja*j!3C5*lMY$G~Xt1u?&Bv9TuV#VgDpg-~a* zbE0_q7Ih^`hh-m*>Gu}>h!kg@PyK35^kU5tS3JTOIB(#HQvZX57WF z8v`u|Z+DcD;S%SCu{eL=8Rn5)GXo^nrLvmQ@4YFGGY83;jX+fjZ01j4si^IvrB_J} zWM8P?UDX+>*6YscZ#SZ7Xc9~)eNg`>XJ8bKB^^0I8hb?%OQbJ1>69Z(!+K0f^ap{X z1ekRYu}z=B|GGXk&N5f?ZuA3Bh`?>h2-1s_6o;HyUWWb_j=jD?nH;|>6LK-$o^Hlu zaldSdl8vPVB@=dqGjZ&!XClnVnI9AEfdG!#s;tdr@LC$fBw25fTxp26f6Fx-%_=#W zFhY>Y8lHAymXAKW!+K0xdx|ytSlv?aN$n8jYmo)37u)Ydznv1zdw67y(f6#Q)B8q? ze~DmkV4JjK-|>lwe%#0-{n-ph`b7J-!B-7a4yBqv=ZJxRaHyeDU;<$n$S8e;W8Tzrz4Xxf;o zVC#P=QIUjhu+-$jS2- zEnHLUcv<#NIhpg(`Xx;i{rlo~@vP4*#C=hIe|`l23{wtYq@SZlQIpSA{|s4iKpL+= zzH%#z7bP`}_<;L8a~#Q95N%k?0KaO+-N=Zx;#*%u#D}u(bQd(5Ktt_}PMbo4w)HRX ze>if!iL<^IKUD1W%! z=3-=?V)IKZcKyf~?Zqcf{QBEvu|`EG2R%V)l{8k*><*xoWw0rqUj0We$}m^`}FJZnOjzGxew+F;k)wB#$f~>JV&c5evGj@Sb8c^;N#_5h|=B# z$3Hf;N^zOBk1$8#Ris3)^*)t(lgH_p?Y?@Z(=qv};O^@JHuLtfa3V3A>oJSYw$P1* zLc#_SK|)!|M3kj*b7bf%d8X!XpzbpbZw}cVf)+$&;XY#r3eNK{5EX3?1)_G4;=;#H z*q2;lRgQ0M$vVOZoux&8c%O4@OA;dYzOTqmRF+hGk6pZi}v-c*X8wrE%?k))dL8L)IP(ehxI}AFcL>i=|L6A^DLPF#&z+j&v z=P>T)z2_g}ALBTbb=G1%>+Si>Ip29pzdumE*_xOmG;?wiGw}L^HjzB?F+{20l`kVDNxNU|qi$d8X@-iJzvXHjP(p z>kVyTHJLW_1ZbYI5ad0>J-f%S^SQxqLf5Ei(!YJY^y%z|o^OWQ*4<9dX%$mU?CWco zW1^LqyP^$&yl*mMF3ZB6so zp{-B;#?3ZT{!U8cya~saEz7$b3uCcC{Nqc{cV5R?FOoZ08C@HR;Ru&~2Qj^+Avn72 zA5q9=N*_{A|71Ok|E@CQUR-Y4tg`&1bzP)W`$g5>vwJH}d$jJw zpOz#IEBi*CHuR8c8n>;ZCpo@1MNKuS``E6?yE=k(bKNEaj?Q+@!pIKSz(z=>9c7TJ z?lKyi>zAtV*BkO)jq`KqC^pF^{5EGGq=6)P(!p3S2&nTSleR*9y#ks|lVxSkrpt3@ zqu_b+yr6M%SwMko2yO22;IW~pJ@HdEk1tF2W81D|Yj>y;man^pA)A{Uh20mEe8$Hm zwEhOa$Cqm#!r458aJ9lrT*g3HimEEp?8Z}Tlu~5tRzo`pbKElVwrlyMWy89kTpAlc z(7`39fFob2JA1PdN@n!M2GZV6WSy&_))>BtEma=1s*D%%#LATz?bHK&lM!8lmGfvx z6%SC)F&Qq9iM64X3iZl{;)(63YoaF^+vmOPF_RgA_dI=(Y_JurG`tNE%iy-Urmv;3ebr0({@qUA zO9l0}=NpBqCFn*nK4*+nGhl6z$PB-FirWBm({(W=OX)XoBrea4FE+dN1<#ZF&JbJD zMS5g79#_=P!%WNZ+GOJU@WKeMuou?4)0ViKSO#zIug}Td3Rt2ZpNh-%)?l0?+XPYcJ7DCU9i%FGeL7BAB`#0$`>uae+SXZ{6c`_;7E#9j;Hdp2#S$*s|2{zp zKc0Mps)wm9U3TfswLZf1TPWFt=b9AjS83lgV9k=P!wrj>Z?;D$eZ2Uv%$LGEFZdLH zyZ_r9Ytg&dMm9YWn|oy{F;Q2@wEf*WV(*iu8nRw?t5JK`d<*vx?ec6~BA_MWuUd5h zg@zt!gH)53(Y}^anJZ^!sfSE>e+U`3p>Ib2W^8UbKGr|Uyv!Ae>%=GM|E<08QA{iFaj5=y&#Ei?2` z90g!u(YR*o1(xgz5OvFjVN3t!aGn9v1)DtxX*ydWfPc>a!o`SBb$F)8Nk8Rm^=(9j@b z^OYA|ye#PkUJ35}V#RgH7QU`8G1VW8^=j~pCi_2vahbDzQwB{MLn&Ul#bI?)JPOPD zW>ZOY4tw+^vxpvAM=d9A;2j(HtLfB&39SRZ2I!FRJ3@;Sa)i%1Xr+Ka?EI~>!#?0+_^iJp z{6mBm&|6PV&qc+|(9x6{%nkgs4?^XT`r`aOp#?!Cw7}m9Elv)e-w|5-TNe-st)rX# zjyDxB90Z5_G!@vs;T&fw(8C=H|70pq1j+wxvi_Q$i4pq`t2&@4Zx}h)IN2K*IRK`) zFOvPgz|`RHZ3H3I0FQUjP>_=v^8Ff&n)BcqV8uV%Ap%cHD!`}@jYLub45tSEJCFza zHG3Na1tUid_G@Ai?21M%j_lG_01A=AzeErJlGdUIex00=p_!hDjf)2GCWsh;0+D{xP7Yd2D_xajgu|#=7Y|R2S2bYuq)c@Sv%P7`;CDsyQl)- zWH-$WjBZGZ0KZ>RPu~H!<*08tP{R-C#Gl@^|7kzS*JG6i=K+JDz~_GV?*kQ{P-$QQ z`(OPVc2sEqXL=F@`!R*<2ZBR9Cqn?^2DJ271PC&Kflq{h69R(%LU4fRI0Udmh5eJ^ z9yF!=p#|89qAVN`KZNI}3=Z&|3;~=I@QlC8;9$e+PXtG!?6GzLEYn;6#wY(U^1)?Ed#K{@(@f@3G(y1#bkGfuAUJLZMtoGVY<`j?)!< zKNQ|z|DmhjS_?wTJ$T?p{`f<>Vwd>uQ|>`T{!=NJ3n9t?)z1kM9u&+8;s*cl@k1RR ztF`^~@h@6K$hp82?rJ@Wcm-i@etsj@kTC$ z&<#IP3gzVH1_5_|PoaleKA~QJS4x2qDjE2{Vg`OR ziT>Z^UX`i04=chxzHdW5RiUQ_w&VE$e7C@jqJDuL}6r80Y`oc>8@Y_=nsTp-|;I zS|1&o${{dr5C`{9%R12Vv3fm>E&mvB5smw3HSs^{^`A55QCl{&>@crj6V*Qe4JW=A@IKqZ6OGjb@0F+Dv$o(s1+!sfa!#Tu^=!z@?Xsu z91QUPn2HfbSKKEnmG()}pZwr~!v7Z)BO2M!Qt9~M0p8wiKfqQKcxAb@%Q0pS49u@Lq%-9K|U5CrmXe_G>b$@)LWuU}E=Xsr5S z{{NvF9}49UWgtZH9jz?>NAdj-6uZRl224jq`b*INp-}(i2%Q^YcnnPF|FX&7xW!?) z2Il4fL4H!3hfZ=rxArRt zERL4~3?O)a#-~F-$3fuPPpdzJ!*8dNI1xsZ2M_$AEcnZ2k6Q9S+x&lM-G7oK;6~6Z z&%ewQf46R6Eeya^eGmHJ11%q`*Zo}jQ?Jl{a{OX{z>kD z8_`)#R8N2*Tp(aBZ(pxGoWS(PzLt;GD+2oi-ycZ*O|J-pOn|WbV|x9?{`|9#9wq($ zJG~w-s(-3d4J>^54&e~caS*^92xSIrpOXF?283bI;S+zT&iEC#j#eE1 z9K-&@xOJGi|B!JZ1Pw69(L&?+t-+k!TnEoNINBTOS>fThJgJNWwgz((dsSmL-=;3m zSwu|=NYeIB0=DI^mksFOl0N-K&$;lL<2%@%8U~i+=5_AVpt1J+h4&X``w3(`zNJ24&$6$~$X?BEYa_?s z6@8>o>9(W%b@N-?=F*(>*}Kc^9h^)e5v0-yG!ab@Mw-IzbcVg{*bMoro)rT8JbUG& zH!$>A^GwniY;Q8AFt(y6sTzut-z|Mv#Wm|uaizWj{OGiUJ6+Gl`=*}AF^T>u!TR;9 z=?oWI>GoXR>_g~jg}=VUW-NX1Vkl(ldhzM0Vi(6$hS&$LrDtVe>VlM&bdU()C-~3A zD7CZ|4TT?XMW%PtT(g%NUC)K9-;=nY^4|W*J?p0V8hWvZ^z{&e?u%sA*h;6X`ETa8 zjpK-fjhR!X3g0Jqy`!&qi^-Ei@cpK2XfHQ~@3KFi=jHC<1=D-Q9E=z{9{41xA;Db) z_D`a%4IUL=Uu!X@#O7z){mdw35JvLt<>!0ZxUaD0NIaV!n6#5!5U3`Z{A#YIY-_Un z^;6F+qNjVB$`0V}w}bgAQ~e_X4;b&zc(}j9qD!KyJ-2r%}XAQ=dpyWzo8Hccyhp+-S4(p^>kA#&_1Db_cb zSv7be1)Of-qtt}F>KVt~knV9BLaKCVwJMA5BSx=c?<<-%4`oR`Va`;g( zY&=%g`V#?(1Do6z(wCT>=`6h4G%3XNbxjc~otV%MNSje-mLD4PPn5frhMr>>iz9PJ z8g2cH~NkTS_ZsJImM66P&A7OZiMB5Od|2V2& zHa!Vhh9u@}sL)e07w6)vHN{~*>N-L$j!rO66vM0{)%5BBTL}3(Mu!zj(YO$E9#o& zP|m6cENC?KuLZ(=_41I;#Id(tbbQv#Y)bIz8P#~bPV2ku+}r3WV)3W&2uj57-%B!m zGhRxuoZPHmyHP{d)@jp;o~`nJxVGtj(+Vl8{ONYr@=>kM*V9NP%6EaIl5()lXi_zy z6;E|*Ibn`NCfjIJ)Tj&v?93iC`N?EML7Hy!#t@BvgHf%1kQZnMkOK%Zab9m6LP zi~Lc}SS>CFgJyT;PK7ZR;~I*_XaRfm-JR}TGk$d1=XNH?Q_U}3i?_y=Df~`Hl98#@ zle+o|(tCLLGg2h=8|O4*Y2?*+p(oQCToC&CLQ^he1tHztc;X&MG`vzUPr{Gukj zAPp4u&*7H0qnO&GSE*VqBN+v~-u!qiEr|Ma5Cr(hDBvR#TY--RmYHMw4up$%e6^@b zobJb{+eKN`abvir6qt|1WH=~+ixsD&pBE80cD3$0wH5r8L4XwBnNiy}nM`S|cOWM8 zK3D98DGit}UWj(RO8AJk1`QM96TlRB)^?#agWJ92|ODGINk0e1og+lX2Ps24bPyy#TNZ_eZ1xi~GI@8u*^ z=$3lB0cYs_)LN#&YcKtvjqD7p-f>ljS_+4kV|@iGu_|d~anKk;?-C5Pk@GNhc9J*S=pg(7SPicViMg=1uPSCx zNgdAh&t~cR#q~wEg{GJSR%=9?r82rjk9amBZY#~_`( z!$11u&NIFI8Y&ZcJ%ab=_kR|-pKiOi8o&=IbP-UfUI(DiTQ|+nT{CY#Co99NH7;(< zB?@U%&Od#7j_I6nm#K+dnq_ud=jD${c8^ND0$LV#QiVR2B{@fXRZ^H-hFOw87ZVyE z_4(e3kQBGXyGE={E<>c=)0sMv%sEVNp!^~`keT%X$@{bpA4`oY`{)f#^i{i4G9(yl zpM=`(a(U=k4SegBg|Ue+zlLS_DApHJoQ}ziV6<@ys9U@|**R7%9{l{VMVAnin#z0U>6dJQ%~(91IX1@&onPvI+$eTd@~_P_J^E{k|%YPc`ehicqLR|ROFAAhaOOy`w$ z(l)^Q(WWYx9@D16IKOdNpK129E9VAwx{7q(a_}xg_lox*6@SeK9zNRkjCsBs=Xuk z^0Y-wobfeR(1$6xF;$8UoHe^Nn~iIu$RA`}d$^>Z)be*;+FnE%>@+#kPcWG@f zm1sLj7>?x=Di;_QrtKP<6m_+nWE2R6Z(e*THRcrj z!7+A@DPHjtHQD*aswkFz0|7!4(RqhKg1cP(27v6BWq2I;0ofC7f@j^LaP0G!0VnW@ z2b|z5-~{6)k0h2A#+=7qV~FBf>)HCNCJo~^o_8ATof!_gDQW)Ysz~wGjnlLr+3h7U zE`Cj8d%);KP|7H%&`zCET=X?6^a#e9g{khg70K zcvgs0i@W2=a1m^g?1_n-bt%gdVLPWQ$;Uo=>1fPMH@n*eC4tX<8%pjk=Eb($wmS3B z%H(D&7TBk9i$GNjq>QIAi>%UvYNM zdZWSF+vWUnt-|)~=R`s?D#GSQsaS5okhQnh^;5LeX+4EA*w%4EN|PKuV3}X5ODaF_n0>RDjybUQ3ptK4 zod<^nrk(RHRX8WVYeJ1`wZavhjhxsjUOzEUAM=`9t;{_`ME=sP&oVBtQ**!*c+Oya zHb(dJ|KxdUx)o$pM^r|tszDt^~3I^b2;70#pyDsI#Vz((2zvq6pj}RSnB3 zrdkChj`JFESSF0Gn+=roDcRR20WvNUJ>- z^(CpJ(Q8eHDlZBXxs?l07iEx1G{XY(@FYCn1tDj7-^d4qFMIv!Ifi8p z{3g%R5XVMF)0s_lOH^TIM^mtgm}7e7ljNr_h6R=N!d>yu2GJo_0X7flmp9~-KLkx| zzeBlLpS^Hs#EawrJ14MX4KB z0IOXejjtQTCQ%ZYEoD1&ER_s<<8Z72Ip}56ksXz zXU4%z8M&xVx5o<`Ge&?ku^esCo5o()zZs%MeP-FR`zun1ilD~$U<1<%wu9lzu10wy zqw+C0C~qzv+e>@4&DhyM>dM=|Ol@<>;P@FUT^U?v=lFhC*A+FWlS<8+)6M`Y@9z7- z7P1hae^T&8veKG+JZG)Wr|i7C2Rr)_NQ1fzqNAoI%!Y(pDI;D&^h0W?u8DCkJc&PI z)Hh7Jy_M{5X9&B=lPn&OXzC1lPIDqzGu)uvBJJa8~37JPb{K&aO$W z`Xg=3z00xXT|HT4P#w_)@8yYy_zBSD7buJqr= z*MAR|wPi|b>PWKj8DxfS-&}aL<-}7x1eM`e6P>!L9k*BXn4G<(WaXoV>APYo%2#|H zPd92pCTO7i0rzLe>L?tP);G4tu1fej1yH_P_DmaH;;-sJihDh0g1spfA~3c`FOnBzn&G#4ii2$)~`0pbAC@q7*f z4GjfY&cA_xBFu1rf!({mcn6_YCMG4d((#O4v^}oa;c*$E)^muI-=JTtN{S zc`&e=>;D7Q{$dV~>^u2CLZ64W|A$Dzzr>3Z@xO3jy9wvdsf9!Bo>ZT|n{0<7(BNP| z$iMXY8>2d$-+%)fPJV`qLqsRU@Y~J1P(-#ASZ{R_48V>PAkKe}SqF$thyl94Lm9Xi zVL1>KVU7j7zcuG)$U0sQP;L;gZ084t14JhT@!L6nD8hsQ7<{4(0tdDu0NYc3fH;73 zEQs&>;{VaZ5yQ;E6Mtw%;8*be<;=fA_J0_r59i?ij9c>{te^pdPn3b-z~+NrhIF9O z6Y3DY@3MchX2j5P(97V54v)8H4jvHa #YL?^@m<^Ijg66`N>_?L8b7+GLEa1em@ zhcO=@Iw1&7pq;?q1OY=VhrmbE)vPjMgEnze>wPn=+=kj%pY=VL`&K)d;dK_ z>^BqmwK?=qr6*J(jPrMvgqW=%C(2SVDCdvup}=t95Yh=jaPF`F2JS^jl`zC~z2Ao6 z1d`wc)(HL_=Nv*hAqWVt73A+A5cBmxZm->^dws;WZ;(mGhQ+&VC;bDe=0y8;-7 zSnlj6krRO60ybX%tilf=oe%^R28a;27ty5<^EKo|X$lGl3cnv&3VML(gcu$g%vInijet7l&=ukgW(|_kX z2YYG$6dAySn9dJm`-dd;e`=Nfee2L4O6Q1~6zJ3SkJkP@_5h0sf9*>=wEdHs`|n~8 z95Da_#rH`-0Luw~ZK8u7Ksq4^=n;JcdK!=6f=S?eDSu8wSL(X21OUDTn_t_WUY_ zk8TeAKOiFQTm2u4NPm&v(L{P6Kg2eVK;KCYgx-!aKyOE3dow*tImKUH9iMxoU4{ zWN&6|!uaD=Ow>U0P7^Z+M|)RBVW7#T5pY4l$=24=$ZEg)CSqPcc+rpV{i&B?BIRh`&a@#%&z+VI2YjT z6?R!8JwxC_sW~};aA9PnObvw|+%9s^W04Jb8fa+=I2QzvGc^~48*u4;xdJOJjey3F z`$xC{27)NaqjCQDm6$+>#)GH`i1f!wO!YCFcW^>auJJu@A)OSI#LZY5LNtr}dG88P zv?i?x#4qqkN}tLpGGWmwuJ)813^I~Qp_Q?tqI|pjWKZZBG9zVxX1wRa>t ztHI;=>773~K-E~Q#Uf{oh&>()wDy?6byB)M_UOdyen>ZTdz1qLb-rIG+cx2&i5{rt z?jt3l4XuBYsCv!vtUBFPSG>)2UMem5#^eu@L5vMz39olu40ExQn!Qlz!{IoQXXUEy zjQDE=QuU3K^G~ZNTCod;NXGj}Z=%b2o(miGc{A3Se34O#b%SZTS)<~u0^=PgzdBB$ zVfx~9GR=0;7N12|TYAMCtWm+(v?XD{KC=rKBbTkqr zJCWKn|F~x@LI;jQVyPp9GtX*5G|K@>JqLGcop5tA((u<$b~i^miZLjyDd*Y z)}5ksHax?DBe(45N9-3zpoY09MUE=np}ec__keri&V|!91FBvUoeDu?1unY5qqi$W z7|XQe6*SZYwRhb^rPdap9zw$RpYD26P^k#;=&uuzP_BN&(q%*;veh3~Y6PqE_j2`@KX4 zKC*m90~x&fEoZaWM+~+l^|>GmrED*Qmu1oC_&h%Fd{laBN6sqQLQ@ZtHdaKxaqKQ^)yaFR$E-cA zi8_}Pjk`&0n>qkKZID~uAkVAc-|{FOYI_gQ8E<0f%6q5`v-d(UGhJHQt?`%L(aVq= zv!Gb}`rJ^Kjty;2*-$Ra*KWp<*02|sznCXS6R+dyEM)gUBh$E=|;W7Z2cky z(pAg5{gSwmG}N(XZ)`pq=kkrld9N4RD4c3CQLtSZq--f7RE`;v4z>7O;_=X>Bt;`MbGrlUX2X(3kb41gr9g6TP<)kzj z&WN^=jJzN4Q+)2G{v}x0Di-C!AWYeNN6&>(!pe?&uoWG42DF8 zeZBq6|H@wmv?#b8>JVjJA)&b`1@ica6mRvAsaZ+o72z>E#Iu)ZN`yKwgOX_bAgSR|T6;U3oaHHo!HSA8j@~aTSe;EwWq?dxLLlA5RI#>C85%deMAo?Ol|GlIxSW; z<+nJ4-{?`MY^hz>YbozM%=IF^y`xH%YeQ#o=Ju?KU`QH59s6koVpF4H?ZU!T zCFNEs=>=XnIQpv&UFD#)SQ_3ZD{_yQHty!Y)ourT$p0j&&H{n_|>A z4Y;F%=RG&Gx>-^C19`vjOQ0LyH1ue)LVuUWhWU^?BIK!TSfOX4t@~CG&e)RM?q?KB zwA*r1{Y!2f4|kW}&>2iEI6X-=*?s?cRdVLu?R%>{#og{}JI_2G@2o|e&PK0Mb}S-2 zr-{Lh6kAsDy~r|Sbv55KEPgdhRgMdrck@i4a~PynOY(CM)2+r`_`T0m+-_2*YE5rz zunu97ppwkkH=WsOFCHM2n&?K2)_1Tzmx01TSI~;8bfD^j|d-CP*N3wf=;yT9QJ<@uKKc&Fhqg+h)RZ>f+l@ zK3A`B)IBhmd8sy_sk&CGcz(g~v0?w?+|Gbk3nr%K`dPe`6Br4kv*Ic7cy0emiJs_lk*mJh^)g~{ zZZ-8!&Vm%@B?H^E+HO*6Hk^YHvd;9xrf}PdPzjFZ!Ur0=>CJ+$&NAt*o(h}Lj%;17pgL`fJfKRvfIGyXWd!ES z)=jphtW0L^cS3nv7<#ESkt>I1jchaAMkEGaXUGnU!DaZYflY#g8hU$aCol3XuSeqL z(exl6s2h92JeFUU_f>KZ-^uhRC1a?1dKxc3`3ap<7(YM#)Vji9gxY;iZs-n`Y4DKg z6ct9?#}YihH+j4MbiXUMj!xtC#7wlNclDvV^=D7_OA1*D=eQWFog>#0GsLY1+5ov*wWr*kPu z!q_xeJ_PW2fnx4yCyH3O9@!J{(U5l`fvZMhh% z`C2PW1sl>AfywhbyEvfRp6>+pu20+AoRugcR}blY8?o>#sQy~C+RN^VT9OvZM?RTI zzL-jq2^Y?C7JS*v3e?ET!sl!5s%$6+Z$erM+G9UA>!YRzduK)Fl-RsGcZbPSyx2-K zCWr=xrTZdr(f$<83TqLYev3ksZFz!?4Y?)7l*y~(>xa=9N-hn;LId8k|xO9m!2 z@_>LBxEx9}VZj-PUYf?=2 zV14Wat*4ei(0qq2e)Ut{ER`p1^fee|r0Wdqxc2YXiMuD7!E<7L~rTE zL=sGq&8^4Fko~x@8@>A~h@5AvfBP;Mf$gjN-(F+W$o4vg7uQuVe1LU^drwzoY2&in z*Kj#r^P3MLSJ}JNM$5lW5xVi%#F1k1LHE$>_sZqI%6bmo%uoCZ_}zWYDL=JZvevLR zZkc8g`d`)5i^YyK?5j3r@m30(5-U-1-Nqs&z%It2+)Mc&wnoJD?7HzJ{T!1RS^Bj; z$zez8f``#vxbguK?DW}qMir8Zgb{ssr&SBq#9*FgTJMqrWF?9UB@>kl$(ZNgkl$2) zHQ(H%An1CjiL$O{U5r3LF+H%UCewo*=|xHY4Y^bW%bmgu^-a@y@8CF*bn2b}GA7of z5M5OqePY!Wv?>kbv-PaqnVF9BwU<|+7hk)1Icna$uHQtz)1eU*etKT@>Y0Y;e5yCZ z9uDi@B(|dhL*IN%LyM-*xK5EJpcJ-ADC)}k{$UhqDDEkgNc8u--U|td9C-KGv$@JX zlq!VNQk`)*Wu}KKpt;_uka#J1w}Oq3@S1Ztwxoxa%bRc(#Y9mILkE)L$(sB$GzuR= zX-f>~NAb&amO}}7=#n*slT^+zbdP0rFBDwh7VfMPh1Y$=<^D1q{QeY@Vhy_}Qg`i$ z#WW#Vi}wSs*(~DX(fac^knmZ>=WmGw>{+sHrE(i5or}@PCD_5GVh_ca*;bIC|41;QCn(>MAqorij6rj}SB0@vL zZGs&ZNfTy}?sxa?HYym(_=#H;wmqnqk@!5!_m!d-Uc$@|zUF@_>C9EeCzkV6e%MCV z^8)_4;g4dawd6Zm?&G{|OL~t4GYzmoHgK}tI;-+llKw;I7Vf8vNb@sEVQX#3A--DH zc`o2a$QfMHn%=&vAb3Dg+TimPu-FKVNaNFrU<3JtFv_>cgM=5|?e3edMTBsRMF$lK zzQEOCx{aHhLOXERvl5-FRw@W%olc#3#CE?EMBdHvq^M7n%r)pqD{s1(LKHh|kTYck z&z+)8mLh2oPaU&**GKq74{|nsr-KmtzQPoD>gD?xE$ZE`imueAj+t5bMLrxlM%yK96<&4oO|m`W}w?1T#$JH4|H*!CfcG)Apu? zaTBZOVWuBd*Bl>Kg4;B3?O9~*3cSvxvMK9!8EL)A6!B`?EvAt?PmcUTl2);q^tcPD{!z@ZL@U`#O zERUWqYAP&z;q$0C<~c?MF5au)y_zxI^f0^T4Y^vSV07*1XRo86lY<@vn!|a{kf)5u_3?YXM#Ux6(P?rzy8MQ3?=-w8PiJFn zObVO|^>dWFY$Yre&0(}jTCgkqFr@RM9>4Ju7)Djy`S3ze%~O0#kwTt}qNo%MZ!qX- zCU%p>s5Y?(-UaeDj^PiF*ZCB*ZC(%^tT_+Tl$LBE8GkEzC0OA!pIW2hK(&mpSMWD) zY8UweZUzN6+4T7uJl5gh`2KJ5)mY|AHuCSLT8uOOq}$07}KY+6`| zlDGO)@SvhOgN-krnwm~kbdyCb0XS>#8-`edS%x=->}GfuFK+0m=cCRh%~qrCU&AQ^ z)=1rZm8m}N??Ta4@|G&BV8b>q9kRrGOgElqTj5bt*`_bhR~j7cc|ms@nJD5$qnJ;6 zMAAi!y@7w&c4c1biyBcAC(L>F2YGd)b)q|ACY*Q{ z$Tn?6duBqB-Q{dI>V|a4- zCuIS4Qo+?q-{!>hByhgQU+Kw%`TD;QQa`C~fSv@JI0KI$(31z3e$aJC=}81YKXCsE zesZ6;y>Y;!{UQYcXoqC$0YAAfyT5$JQL^`c`9V;IUqS`vPE8qXmu$+6E#0_VrkrVD}jb11Of zWPj~7(D|Q}>+e%j!at7w5jJo%v#|ya_EEYaz5j>N)X~w_ftQ`##LUsuNgrfjW5sS_ zuV-s&Yj5LdV_;*+ZUC^{_Id`64ov&U4k1pZA+BdQIIZGG{5YNz0gUxvn&1d2qVmrA z9XFu|*Z6Jf&NJpj3Q3?SG&JPylD4z~q>-Uu56119ff6>whgw1MkE@qjrEZo5`m(7H zB2xzU+Pci#G+xwES7}}EEnIcj>*nFtdVFqY`f6Wn$G2%agRcZ`*A<7z7FsUYEKyqT znys}C1mkXOw~_7eQlin+RI|#^;i}$eputf)EfeA2`gme|Oi&d@S@HA~=C{kQQ%Hqd z=~pL^Qc>yE@Nw#*Q%i}38|hiX%c&SFultxkPk5mC@v|HEWrg-IVE$1q1G1I@0w7IwcB;1*^!H1Pe=JzVw#`UYK9 zUEUq-&u90#G|lune{4tSVP$2de(MDrN8h;hjrkco+^^M+&vb_slW#X_?|tNy7Tbm- zEIq$A)5jL7C7hLCdA%-|XVnmCCiL@@GkLp>p2}PuI?S5ki>Q2lxfwn!iEYN2Z@MGP z8!)2PU$N@VGrYCVjAJk=e++^(D=w=E?Vy!X>KLALPT(BjC)s;LJx+e>)2S5PZe#^) z)7P7%Z%MG+G5w}5UuI^UGbJH~l8nVUVN z-l4gwNFwfx!F^0GZ86NS*>uGlhKp*teAEhhTtZ`G&z5n{7`gklK>a=th1C+7d?^&A z)7X^78wt#lJWo)Kh23woFdfBS9&+0i(;n~K9yp; zg_DY5h6~U0+hn7Cz^ICho5xAHF81gp#je!G)s*g<*v0Xf7Gwt4yl{qdW1z^B=*yJc zymcOd&6iP?UwD8LGs53??$q>T&E48*)_v2t-t{;pNHnK+cKH(_Dl99=Gx0qh^N?^& z)EO(@=?cvy`Y`r^M(Rs7a7sKBH@QI}ypBj$3)-yQ;Bx~uIWaI%G^kzhW94$Dr^Lnr zO(E!+I2h+*?D$cwzA)-r=304+N=kEClh?W#G?(VRY|6=NAoBF}%2@n7LRTlWv+?a> zv(-kvv;5oXS5xS4S@CTY3UNCFQ!0+PB{gPr79x_~@bPapz4RQYY#8`gHV0)JGeQ%v zxrLyK36+g0W#=v~Ex#w=F}xmF+BDw7Xii1=Drc{YCMa>)&>s~ayy=`^ztr;k`V8R! zt>eQM1ai1)=}6d8m$7*#MO;O(eA`qPG_5OF7*Fd>EuWo7xA zrAL^r+B3UskW^*{-}LYmvGdCv)M zgYuqU2x^%9YFzpH&HByam+sr@lc~2!x3UH*J>^ELZcBc1_B<^K{+4PcA}wo3f2m!H z*)$4V#M0jJZIxy4Nql7`ub{@)IN~eGs^QrStDI5yu<6b*>fWJ^37U-39Pt@$l99Hi z5{8v_nJ6lyU+C!ghLu+*`1-A2M~8q{%UDOpj2HE#F24jem5rNM6S1gdh_wU8i&OQLs(}A5s1+6-+jd(X%!KCygeiY|#Uw-}7R14LcsYOU*0VfEBOyFws0?zN<@~x2{e$RDW*6!wza|sAhjP)xyAFIbc9plywd%L@fNQqv0}3Pt>Bd zU!G@|=+|AQY7J2sOJdz^cBy+Z`jKP&f_2-ff={Py@Kae^6yJ?u_o}%*n&si{f9!ib-kkoSOBXPd)dWJ$p4-@l%@!jAEVA*~R)k=nG-=`1Qx7e#>-{ zWjFG;xcK|y%(;{zY=@l6@1;YoL=Lf@t-tNrkL|xeKW9(iZBlUWr3Kc~^Dke-T@vr$ z6;u?(TgpR0q`~)5M_y#S5Ve_*71TZBdFsI(VK{N-mM~U-wR~9^ZU*p&QOOGX2?L** zd4R#t8ShL*mM(=%I`8($7!~RFSF`Iki|LSsl4V^U$P#Aq-Dr>-8Uuvcd#&KA%;IFuC3wA-kxcbcPrn?Mw1(mcp2=hIk;aE||7vH|*3y7f%AT zU1X*OtrY_;eX~zCTvw4qk;SiI*2ppz&(Cg2Tz@ib&5f#5r{43X?n19&iqxj!+fqNg z(*b@LR*+_rqn2^+zOsKj1AApEpuav~4SvpIf_$z?th^+=Rv^R2%-*smQmZ#O*QpD+ z@Y!H>k#W%j!RLcgWUHA)HJmDVGQ{pLk#|?EgDqC8(esoR@lrFfs>le=%G@fehspIM zVA+jfKQav$^gAdaqS4)Ln^qz~$H5w(CQ%#&E zeCmt09H94gnea{CEg`3|SD57Fn(hh8lhddIbg*j3m0|aq^m_dMO|`MC%3;dZZvt7S zfvOo)M7Z^ry4lvEBm*rK6U4BbXA<%%x1d&+$nZ9VN_fIX7gC@17E_$HML|2u@ciji zLHk;*TXueV%kFg-Q<3Wx{w6KYho0p>Z4j2#ja*K+Z}V}GW||=1LV;iIoz%!!IVUkC z#cAeRo)+SFtsk^use7-&=rGE>=Izo~S-*`BN-QzPS?c2S30y$BH{8g}zhSq7yIIOwd7M>7Qk`rWDJuA>lCzmWAK{ts{vAKr%DAy7 zcg;9-@ndSji2G5g=AdTLubqn>y}J1P=f1jFI>vZj??o!fQX@{Yp&ItrC&*=0cEOC6 zeyD8OKzTbip4o<|sx<3$;+-bF{x3ZeLS%h?jaZ-YhI*!`HBQaIYO24TBOzmU8vEL? z`0y;nbH(yA7&xU5>^(Nm`{yvoJJQ?-St#PnUI8X{bBM6+t%XZ?ylXnQFdG+Dcw@pi z#F`9Go~_coE4S`m&&z>s@rCgjsSRSXw-z{RIocP48(Df2LvMgJ;bdVEQ2nYQNcY9h zEEE%BU~wI;nJx`kSXk=o>TtI;KdVRVqE}d20_f5|*!ao|i;^{M4@+|Ta)&?z7+}WlM%{nT8nB<-Ju3}-iCaJrlljgMDP?jho&NqVzPkP$LA&A8)NUK zSQb)^XjDJTx&9)WiiKH19B0@{qYLKod^GxA&PQRhE_=+_)!9zbK6$aY5A4ZhBbR%Y zyU`R-Tbw^slZ|)2h=UrFN4FQ9d9nZ-^nvINa;lKLrxuDcvhhf!rL9XgBfEy=GSrsc z>T#iP$if!Fl3g#C%Xfu*nB;*=^8-m~*lz1)pV^gOcyV$$8KdROaRigb%aHoak7&ii(*$0i>pP1P5b!il;6nCe6{R-CkSq@}Yn-eqZ}LYPvh={(vd{aJxEzR>%X(a1x$A{1}iFAm}zX`AKj!%cxB1_rl;Rk zf2vhtQ!kmT49r*tOY`_oZ|yOCo*{#NY?}*Vy0!i7>!Qk@`R7>Y_5Rgj=gw)MP|^$_ zM7LK#n;+azv8M0NH@AU2_?FK1F3MJ2HhOtMa`t{f0QwC)=}DfYFb3Xh+wZqYn6c3) z=9lK-m~0Mv9x-_gE!A-WB;w=zG*YKA&7~T~{6*gM=T(!}klkhH&bpsX9pt~ggRXdM z&I46&(2&_3+~pa7*;+}-?0Fq3a~|XMxUlcBX3qZ8)|UNt*wx6{ z(yJ3Io}to2SUc#;Ox?JN5on$gc8d>ItFj-hg$k0riPh)Hm%s7xsp2Wppqbgy8~k1F z@$eW_E2=xxXBP$i#Nu^_UvqF$(Pmxcco1&BS0OJ*y80UW*@mCPL&-Bt8{UL#bbV^& z(zj)=fmS4}Ljc#7L!{Rort10(vd%cq~rL#=Ec|+lSJE6ba)K;(N5F^0=3u$UbG4FRapHvzzhu@qW#?yF=4}I>QoR zQ}0`MO|mZ00ER<^zJg6sRrh@ zja#FEFB_4=Pmgt;MfUSDE!Ui?-hD}LUT?9Kl!66lEaP6V!Oq18Sku@=rBpnrC>|)u z31-owirgfZsuDB2E8E{BL$f?l8gAI9D($hNLaw@%x(ZQI&u z+qP}nwljCywr$(SPJ5?LzEuZb)u}rFf3aqah!u0qaW!Jir?=L-@BWDJi-2G7H5Vwv za?^c`m;;S^*qAlg(JSQqhfCt?TZ|X%5YgOU@t7CG{$VJQJmb_{F$a`7W4Q+W2P!LT z*#Q0(4rz|>a~PY2h3*EDUniUd3yc$v^;C`owD9jLtjXm2ynl`f4dTxTJ-%}YAFODf&AuOoJ~K=81+!r!ZYL}&dq^dn529}t z0m5QESeCw7V+X85hFO!*r*~`67{sD*1mOkIcKQOaMOlIHV!%|Gg=nLf1ewYrogwqQ zog6`>ZwMe@bu(d~VRB|Jx{Al^i+r=?ipq2|e;=SLbtglbI)VM2v~B?VDqTmP5)Ka! zNRb)q=}0T7H)Miyk7Ln~K`H2=TZEC}O)0cs_zXlt)Xz<(C{Fg(Jb)RW{tRQ%sU?>V z`W}K#Ut)Qd7fRMpw3i@d)Zj9>^;oaA0Ot3qCsKR|wKg!(ef>j!=F*h#jHEI*B=a;! z?S!~ErK~C&Ba6AIi9z0Ilm|xDCo^9)w+X7mbi0|2(_vA zvslGIY-s`S&DR2OWhu=ae?xPKlcC{T&y^NIy{B4 zaK|K>q;uY}WHfieZd=V$!(T0hPnEah2!uwDfH`sOG&JYLcycA@5kIZ9w4ft9z&h}6 zoP;AxBfU+9B&lU?L=pJs^GO zFyIocq7lGFu=)i9NtJ^>QQf%37wZ$rq7w!$>0&y)=y1AChh@k82yvCs1EnyEU4DPq)lF_xqz2ZRw$EO z6q2l}>fItmQa*pNzbATP0ft*H z8EqPrY4+Z08m3OuIVkMLT$GDBt7)YBTBWt{N2X3M%KD-G&l5;WqN2g1-g25RuLhY1 zfzAe2!kbzr4dLkJ`6-{Q?OOO?io(Ny34Ir4rvNd}8~GC{ zAGv|4Y>PygcqsE4D%hm0rIru? zL{0mF|A3;L@(sly!I*#zy@xP>G8KliYEE9@>NihN6g7H6Faca$G<8|~ZQ+KfSF;eL z#@q_v-%&__(*`nNU3do%*xJKKU|hsmdj`Q$W!1Oi4?1twiDg2J7-C;L3pql8UdL=& zaYPr3jaj0os5Et%S!lqJBR38e&5a;>v5CO!1R?WeSImqsK9eF$Y&|j3q(m00{RCMHnVFv%2BeO7= zpGW^ejit-hX%(yJc_Qn>oyKlRdNbUSRGD`=f|_6zANbn@4TAm{9Ul20!= zTWRpX{6iNd10yO1e|aY){e#a`xGqM^ns zWvb30qJNH6_WI)`=B{Oj#Bk+F7N%w|QJet+bVoxOrOqZt9kecvV=vPYGDo~}QFK#Y zA$GsfUd?a}yxG4!D0DjRAh!^qmA!YXj9p2nobN?BEm@{I-tvz-ahANbp@l(Gw`tiV zS3Zk(QcC1UB#lf9WkUaQTuCGz=ZcQfxq#s20E>yRn|I)*##?w#ElbSr)V$wh{Tkc* z?-m+2#fqgihMC%w+e=H(aD>NL!5j6?$=cJ>B2D!oi%7GwubdU&sEC&jI;1n?>2&$s zWjav5KLAbfZDoAZ?qtWNxXW+6CC1M(nJ`dTpew`9T|)qN*5*U%VEv7Rd@`*;+wKRP ze@!+T15L#^2e49Y3g_SZ>$&M*%*RhskFc8AedHlt|Ncc(FkcJQz5BPow z8+I+LZ=hkRvA;0H<;S#Q%C;x%kwmPt^%VdXCS3=CQOh^Pj7DLNc0tP3j5KX zWB7TQdzQn2N_PfItR^?1O?O^fDY;`Ds+I!Q$0?LWZJYv=1(0{qZeEK&+j459XxMI} z36p{JB3qG!m(F!{SxpV;oX%IPgeI{qs~(e*s>}EmopGsp&s1qO)l98jAt2-}Owgb7 zfOwV*@I!IdM8b$aS+cYaG{YJ8 z$l=;KX~r&Mc>Zp>W*CrXz&u#OiZ_s*bljsvL&z1}D;%BU9_&dXL=-ENipI=54fqOI zHqS@O!n8^MHEaeNLZ(#h)(~uOnL$1yq0JE(CFz>RGxhrWWZ#BoXHJx;p1owS>353` zQ~ALa5E{$;1{en$*2XLM?;TrVczb zPd@%?(*;^a@kb+RE1vFfJ3CTUl%gAlBj-l4MEL(^5xM zE93H(7G~pq(IT+ghKAxy73G$L*b(b7E=rVyw3fz=TNVLOr)?ipu9jY0!-m@zgzGvg zAxUUv9&a|AMy1bSo%vV@7SKZX9-5lO=I8+-gQSbVbw~}LQOsT>yMHdXRq2kjsup3Y zm4J3^S%MWTK@64>?>exlg9+{BK^ zi>9n`^GtsUe^HXYTP#ZP$1-UXWGnOHO-%h>{xK~MY>1mI*Rfvj0U$>|;@V+FZNv;S z*Zx;T;X-iv)U|$p4AO|{CUpC|50dG5uik)>@~NTOF5na+?K{}=pGHESf?+&BC20d7 z&-`~IltV+UeL`tbp0&7BJ|r)$^l1Qc`OIwczCSx8i&#s%ZKG+X!L_;;aSBCI(=K7R zAzGR*r0?w&Z0Q808WvYq%@QrN-5PhSy@ZPTk-rElG7m2Zu?D)Bq}bwdA+34YX(NH6GQ^pC&B{$qmu0~q|Xru|0?6E?8_pOV-=UkSRJ{oC#cSegDs zEo0>5_;*+A{|RoeGX2};{-;mI{=+-`^8faQ{^{Jv28_772nr zMfRTv=APZm!}s}f`fdG~KbSc96ntj-&j*awd#t_Ut3OOOM+^_YgDqbEHvDRVlU{#m zj#md#LeIzkPX_a1`k3YPF#FK>ay#yqlebPl_!yW*B0t;F>&OhXRpBaj*w;Nno`pmg zl^}2XX`O?F2t^;>LE%vKLcX{bb+CFVCt6-AqUOi`fYU~^jXz<{8@cr+{zM{(B@Q8S zAgV+2HKXQmJMvrxsGa*A*@!hZ2Ax#%(~>JXUL*jgEd?e=LhlbEHYkM$QkZK ze}(fxN~dp@+_4+305MoXI9kJ#03%iSOR87IQ{greddJq!)dP@8sH^0*aTCAEWyjC^ zk|S;P(mEpZ>2MSN2Iu>})Y{{w?alGy=5pTRLWxrdixUk@x9Zm(Bqi={Qa-bf9BG8o zPS&;WLWOdBUX20k<6^m&Gh_je3zvq`=F(7K$>R9iJQHU=tUT41N*gh9@b~zUIJm$g zpmpJ~Q42*$aU*f-Mm~{Vts1HJ5`l9i{3KVHDygJF9p{~zts4nbbQcMa3(0M19Der4 z#ZE^n@no^6K47-Arry380XR(XtFxoz*r%_v6D(zU= z#yysD9oX>sfKyjW?rd5MrBrtt_!)WXxC9XWRlsu<9^@|RCwpsjO&_>lW!QGJz?j)0 z(4VD*a0#1Q9Q%auwPi!V4qQ=M9Yg6crneZ@O2x<2Z@>GS+*J*g^_Ex?QE1uU=g?>w zJirG1%;M7ZBm%&h-HHYb`t)=AqvKipzhyM@X<6sN;DE$LqMM$UK9jT--6o3y`O9>V%USYvTY7<%j@2swGGLM+|+y>!Ng%EKAt5zUd;Pn}d4)UY2 z<;wOL5s^6k~_f0c9L zZq3*2u`ROUv~m9>wh!73q{AaKWT;_4sSxyYTeyPBpv zbd3wc9J+(5A#m~q9{va(P}&jdbx8-6ozqqLwjZqy@=XqGj05C6H|6{ob?HjVanMx6 zjbjo$$KGLg=?)nxSsHAM%enmVl zpC&&}hVN!)20~lqTRjbC@2&#&q$Gj5vSEasqXAZUzQE=&{=q<1Cexkj3Tq8u-E();-sqQKlR4E$ z5VK-=R=-@I+#AeTq48yKVa$`UEc~^6nf^A&x@XdCE;AI!=?Ac0FBq(kTZ4caIk62q zya`aM^~G1cSS8|-DQjZ4ffE2L6Wh5yh86)JrCa3)w^ko+-z^%f@pR(zWN9lgmbQd` z1^Y1))_l&dS7I&eJ+qm^Z-yYfeAWoqz+algTlbC;dqK7X`5KH%#T(M`QOE*Rw;0HD zsN3Y=^(7hkwIKsO-+6IkjGod}v-kn!Z-KU39ZEPb&tv%NY(;x<$*;V=1yz94cmC4o zNJf@=Ot^?ann+f5C{?rB91;rajN&EWIDReZ%~QVu&rSJ;*-;q7)|rUhHTB|&hMQ!; z-+&>UDZ2%npV<3ejl=5$V!r^womwnWri6!S@(_>m9E0u0TQ59Hs__+TZUvCiZ&|Yq z7cf}63(QhWoJQ=JVJsx#hnsL1&lGstg@YWj<8E(;6~+Ty-Nb&C#6U_V39HqSpo+UxKMGEnX;O##Yn>zbpJ_ds zfHc5A*LdC0ik2=kNjF1P|$i?n$kq)Ls5%Xs49C$jvy(nSA5 z5az+~o@^I0G5BvLQ_gNr_<)v^*CjLiy`2jy32 zJ*hU{mfs;MEGz3#vp;R~9m^)8ZI^b5IQ0p?1j+DPHkUwYrF2<|mJy0t88$>{FQGLl z&tqds?7StQo8p?8NL3_GW(5?R_q%~;uCu_ar@3VPOUW+9fo+O&KqqdurbOC|gcIf-t zV=@LYq4EW0>Dba!c*5gNP`09ta)Cb%c4%ODfQi^50!gFA}9@n zl7kQ91DT}m7lI6fLKD=gA0GO^JO^e^Fwhv{i&8<=eH9yl2>%fQfTq2^h(mV-DCDoS zSbA{9RloqoJsmeQr5MBOk3It1^vC>4Av9{_GDEf~dxAf)LAU{@r2=R966@sS2(G%z zMdL)AQjJRWMW^_5k5#bP^IAs3J_=wB5PWT~f<_8>13=`-fM7D49`wY_6H^3_XrZ)k zK_oOK0uv~PVbI*1$EWH}{5Ye^iXWfD*r3!bQzwc?g?KkM0}MU0`vs~!h*_wLu!O8v%LDBOb1Tq(=cZBccN#*uT7kT7?DKlEQ| z_~r}n@d&Ir^d&+tQ|aHmf{;;edsJfLJ!A>q zrsNuil~#ykfP-T0Wsud&+e~=rwNPxF2}4_+868Ao{pZH*ynFIB1DJ^Se&!bVE6(x` zU8*#Ly7Cn*tDnH+JsT~{f{F*YuNd9~630-}5;4kz;b*cbRu{ag++(Oq;az8`tOtWi zA1ccS4(Bw7%1Z24k3bbfT6?Q z^#@nuFDlmFd&hys>61$ZaIIV73U!4!v00kOMJN*hf$Iv)gi$f zxK~ugz}wJ2y9LOUV!l7hh-_R8^`k&SalZVvUcqUnSx*t_IAV|9?eFNgF|5;Pqnsxd2bS8uulC znvJu7d~k7Gqp)ORW!YP0(^MJ3t1!&J!8_j{hI9ogTUxfI{Jz4C!aT1^#PH}!q`?(F z_)Npyh9i0SB@k~+v-K3A`t1mV2JWWy#rZoKLi8Ave9`=UE1_?cSjnA3{f@eJl zC%a|T70qT6993%SDO)pETh(jokg=pOMrawByABi&$o&G& z+M=jszYoot*|v-I&Y&ITxlY2D*o#b#joD+3eCw)}Q1gW1q>57|Hj1^a+u6v%gv z*x=`W2zMvHT3<^saNJsZ%aNZyw}u9Lw`~kZ7`-PMm}H)@28(_Db_L$_TWKup)25Nc zzmF5y{`%r{qojO9XuT|=@_n^!kIizkalA+j3%RJ;M@Cf!CI%m#W(zmd8TS(^S**?} z(9b94=!^994=++2xJ5LprUt zs*9s{Q84K#AgWXO(-iQ|E*mM;H1Gl#`d=vPcs*G*E>uY&&La<28H;j8Ga=T|ba3J6 zQzM>P*Ew+g#Wr+L7Q8s4Kji&`{MSsqZ3~^f*2y&);5m4`_jdUC)isWmZ%)g30#!Vc zoR4KcR+5WJM_x#jgpaKbc+`YMb3s1>zKnLf>_AjgFg1C#`G`lGCT4Aust z!rohNUZI#CglO)SZWNdR>N9$A<{7#rs2Dq~t*ENH6O(#hby6C={s9IpB}DTt@Z}P^ zF2&2(hHZfNi05*;sUxqV*Re~}e1xTLkoYPERo_D5Wd1E7ux&mppdyI7wbv+xZz(LG zcRV=I9q;nKEDKn$W1g)}_0kpo&)HN-HxT;zLa`L^r4IARJ2ccr47^p*&};A%+f9IFBz(Dngz{KYi;o@Hq&CAd)Ujk|p~X2$yWqWH@~ z@7z+b6Ju^})G5&b7q-y~bO$1771%tU4E!&)y%*qA@7j%g8gC*LbP#%0&VczZ#?bKq z;urG{U0a&)4Mo!r>(HdECbcfFwr$M1OHX?>ZG0d7tN~HsydA?0iYvC_har3>3tP#D z{Y~W^B}T?|pqP4|EWR5v!126ye8@LE*Z(F~`&Xst{}Iys49NV?Aa|; z>Py2+8OxjP&c()#8M4NYmG{p_&-TBEkAE#v^1f2HQKPEpQll0tpJZave8(F%yS%@5 z-p>!gZ)y*V7$ENaB#@ZtAC)V9NEwj^f@9qbeEiRwyq$yBv(n4MqD8qWBN~X`ZoIsF z1Es=o9+X}FQuMM#1kzoXUhdbY)W_Q@x0W}tJ@sSWpKq^cZr`4dVQ!y4zwG3G>=zps zN+1Y&&k4!WfLW^@SFE?ZV@~r~>D@rLZ^dXhP@4x<8cc~cHYOIq{_4&X6GY+Lc_)$# z7PvmrnS0!4a{aAsTB&d}D|R4&7*r2!vOiuM_8x~u3+owg0snJ%{LwoCxiv0QdgIf18= zkxDJfEx5nlfxs(PHp$uN#+)%hHfR-rAgC8jHbDv~fal>)R8lguCBg9Th47 z-a_A{9s*8?x4{k(8qesXrt^0#F#=-GvVGkOjRuF>eI61@(q0Sno40YD_=R^4CpHAB276CVaBvmJa*QKLLbv=61YclF80)5!Dd=9f(QSJ~-#4{hm*!TqU( zNOsB5UVEU}8(`Cg#UfyXURa}TGUvn;MOeXF_iupCED|Hc+lYefY_0$;2ZF*+FsT3r9a07YnPGt+ z>sl-La7d+RxpOHBq?@JtQYd&1s}=gIROeq7e_J9Hfbg}7qYYq#b_+Qqwa&wQz&LI| z`503;(7TmqrB(Pbiu{nO5#Xi8FY5O2r-jLxW)s~ELU^h&zB#9yid8|sBC|d`AgPe* z_HXF6&qHzOFb%=%1FII@UXNOSV1Vndzi$zO;f9(dJyBhf)q9 zM#}pTvGT{;w_|W`%uxqn*x++FEk}X6x1o>F)O*(@KCRZqNpzP2z_tB_-O@|!6>=hk z&Z=LQrL6Yg81Dw0;6#X^1KLrfj(|%%Qv(5+W{B|a#zmIyfW`?z^t((yWr#KS6r?G) z%>CzVwSe~2k}nm;L{qOt;ep=br<|(EhISWlKYkj8jV9z^tXkWTLZsa!|FDEtj55U@ z=uSEmjM+zSD_G+capN0DZgtCX$c3JD#Ud}l>cXFSn4nggNwNfLsRKMoFfL}i8RwgN zADq12`3im#xMC9VBHSbsWD_X+Vf4gvgcEDzuUdtY6ZmttY557plBQyS&UE4zXiwgQ z!fH4l+9D1F`%>=5MyJW}@V`;u57yW!_X*k56#9Z~c+ek!DN3vlw=t4{tO~_@x&12) z`qr^$*pKON-4^u#DYY~)9L*<#co zJPva;f(q{a4OChtq)errXJI?_Z_%mG0^24bX{dNf5UNCF2<>6ke#?)J4+8cKU#VM6U< zFmTCHO}^cL2Rh(*iIStZ3kgr}a_c;hnP|B%((9&b=NvR;kKmWfQg=C#xJ=77h{MG3eenSNqZ zKT0su>qcFF~>7S9ojO0=}n5ZsNllrs*4;%V&NUJkiK9OmT7S;VT` zQ6nG}i&Q~%`$4r*6Jb3fWEB$jy(LPrCt4^b&pyN%g<__~>- zN}@V_GGI;ywt74BTq*51>|Z!oy$oGgtxm8sQ_LEYkJY6Tsv0iRaeqOEca0h)F&W)3 zW%0i9pbD5TRv;t&<$dlm@YtpBN9?z=BpSP8OWUwaaKfHg0Zi|dLVmi<$lwoAqL@rR z>0UhNSVW!GcXunB)fZgdfLI^qM6$*8D>A64E^2*ioSUPbmreQCgDA#%vBsavT8XrZ z{BFA=E&j71IVk}tX6zKWk0uc?3u|on7`GbaofN=%4yUAKqyh$UD0}j9^Vb z7Qs7zHaRV;j$C?*-bS{S?c(%1*`#i!-@Ga9RS9-@dyD;$I?2`R_>(8AqACTy#MzdN z+i@Thq!;<50w$`;E*b>BlMQV|srmH8Fq&ay;G*i5IV9Nj$Q&ROY!k6+Mj+3@j^L*y z$OAGl2jiNdJW^@7=iQj5K!+)-lm#s}ZaE~lY>JpILn*N6CEk@Z?7KA=t;qI9MIYsV z*V=)g-tnsR^hMVupsG#DDd$lwZoNs0p~9*x)NyVHW*ZG;8?A3#iYg(dszK~BOQuid zg{}^3-wKqpK>jI+ItJ)ygU4pej^S7-wn27}v(^oN+ zC%+acI=XeVL>d^r0vONV5l|nB?@e82S>`B)ag{f_Cd&~$a803;{!}%7%r?Q;|b&JiJbem!Mj@ zp7go!nc1V-XyJsRMh5_F{m@aD2@rkiUwNu&ooAS6_BfkhP5|h-ME_@-z$&SBM?p7&T*taYTWU^dT zl{1ZWf}o6u{*l*d@vd0b%nC)a)(g?{t$P#`^Hg5jF3ZYiW!8204HPn1xlKb8Dlx9T znAGm$mt;5{?{~OzWwH%1ckI71&0UMl;$z)gUbis^~o~A^d8E#3_odhs%>uxd^;noavp+O9#d@aTX{dhI{M=Q-} zR9B5ntHpW0HdK1ZL(?_}O%;W?P$Xy@P6iBIw0uaI@?}WakY4t5{;b5H5nXF7$zhbd zt*k(Il(|LTjwPAA^1dc=q*9W3UF6W6k$guvU_^wG82~3G^PVjl$IS7<(d+KL6}Ues zc7mfTwJwCH1Ut5R&ly*a1M#zIROcM{tN${iuKpYPOMwOwICsPR1G({o6IBo+j%Zj( zAx;gJXhvGJ2$^75P!C|Baqgt=AqqlJW5g;U0Z#H%$q{-2u#oB#Re=UZ@qHjaret4>x@AjM79OxnMj`RXz#)beSSw^p z@-Z9cp~c-al?1XRfKN4fA@b$jV)UXN~f0#S$=fp}U%U^owFh zO6LiUNFT>bT|7^qpJ<}{vCi(YR8U^9p9d(kxB7QBZU+W(fIF{7*f6kXSp=izgQcS{ zW;za?Lj8wL+aR*F%blfTaaiiXhZ@4~#-O0q&LvTX13)V`^`Vxq?6dsl$=v%A9v5@5 z{d2@8&j~W&q#_8Lu1tlffVV+m$5~yOx#_+mf2W~?)g)#;*&euQ!i0|;5{UXfLZl{^ zQWnNAjumpKE^HBcIp7DGU>qg%TJ)!a@ra-^06}uw&t|$h(;k2!CI%O#;oG}i(Xn74 zEpLFv)Yf)c52){gu`Z|N+F1g}URWuz7PD~pwM<}PuyG2qZ%fAmjL(Q$e=#ezf#9L0 z*-FSw@G*FY4chZ4mEdG0kwJv3ragD`P>1`k_aRsXo6P5tdytmSbMhHMuJpUH8JKTj z?3Bry)MUGG7mM?_vmvfCI)q9BV>Zj0e)^Jmwd%ty(2lw05^F0J8W)|Dy=K_NLx=p& z)DkuGP>Luoi9+F)OXeHuIpO5=Zjw2lCeGy3o&B23Ii}&{rVn}db%>^gW2*W@!f)>ROdZ2I*x z?7z`vWR`EABLljTR1=>KQV*lifYD9ZUq9NdXoNwx|8{NkNG=GPQumt@el~q^3Mwxx z?34KnQ~E5+`3L<;0Z1~zmTkQ^NT{il%CJ4c0i=?~L6KJ+mgOge%iJSDS-HfA+jJh~ zSO(#fCoZ^Vfr1uZn^9MmZBr^OFCW5%&T?+8@RpUKio*T?FCuk^2yHHH5?E5GcoH=J zlwEn+@b6UiY+`yN<(iNJEm{M&N~L!`Kb*TLS})!^C-vd2OP*Ozn-+xrxZx`uTME~(dThwgXsxM_dBdBt$$oWH zW~7H=o7#9EZWjT@_nChF1yCX^qKoP_eMfM?h`^{sXR@pXdu5`&g=`Q2Pl+BFhKi^;e9ImOb%?=A5z>oc@lT8+jsXF@NJZ(iCbjh>`o;=?k z^Em$A0-3>Caix$qUNcPM>vauw>1(~Aa$AN@hF6=_EXQAqvn8+Ifmvy`apD@onb+*P zV?GuJMBVm1IhGt^G%<`5$#*X9L*qOM{z3NfFw1doV9@Dn0Re1!SO>k2oSxSZjh@ua z@VyGB?FIrQ>wR|~PURXFK1JGSUUe?#Y2;o$yWW;GBoBISJ3Y+l0yw9V{?=hLSwJe3 zW}rw4R-W0BvufH-(-a0*awBxeQw%BaQ$xqL4)4!Ui*Td7SS{EF&*jtg_W=Wp`L)GHvct9xlfn-QG9H@AujG-_mQM zm~0|-JRCjTmiK;e9_JLbT0L&N-5f4I9K6@uxbFiFq}ZD?5w8GeL((o0E)`$*+q_=x zxEaGyFC2UcfuPp~BP2^>Ms0`Fa-l8Gi#jdc!=IW!)BQ;Oc^+xmh`9l! zf*2&T`!{1G4}(X?2T+3p&;hnx$0Xpi;{%_RosNCOL$F=(KpaBBh&5;%8sB5^1W(?l z3c)s>Z%{Xt@wvr%o1VD74ZZA}eYLjHej@v#kT`ThPp*Mi(cc=PJ!$HzK7rtC4oSl= z1Iu;RnvPBJKPi#OKPi#AXMtxwF#nbJ;!jEx>@IQ4e&s#4%K2`8!9kwZY7vq8GK1yFN2XD^{VtRaL~yC~w!7Dm~h;{|czN6&YFxYzrLI`}3)9%}*Zb06ChvEQNl z0$%%b_IPJtTqIaz+r_YMMT1VjD1{|kC+x3*3awA<4O95Y@8VuW^>fkjbWt`>jIh`8&ysNV%h@~Wm!eC= z#p&0GOUke3sHoOJNTRNIb~%1Q{uR#$2mr`BMV-q~Gt+8#9!CAjA3`^F#{YXLy<+_| zO}ANAH7?-JR8Lb@7B*yaib#RkKeIuR4wxwx;nP7Mj!cRC`_5Z1&n5@op_AEnP5%~L zGlC!qXjuvI`__dcw~8LGoAoV}iWV|UeI-m_o`547ye~D-FJMg@{OV*VVg z%#6$hA+Qtq>YZ~l&|ci%HDv%0tZY7nomVoMv1&(XGO0Q4O~Fu?p9-Y%naI362OefQ zd^lfx?Wk1tm60nVmGdPI*YZ`PiLwJq(3;rT(-b;|0H}Un@cQ&xPumy|Kk+e_&(7Y zW`FfD)*D|Ggv}YhJwnQDti?uCjdyT3UeF4`G%3%%dD~>|{DG#YOL;?SqapL0*R0%- zUYcfcx{eFhTvEM+`Cy31SIY&CGXQL>rfGb>0MMIW!25^mhmwYVQJ17X%ofQpKH)%X zrvr^*zM=o?+wpRl_bNN73bL`tnKlH}B>mjx4^8`3{F)9)7+%b8VZRMFCp0vp*uP7DkmPW)RUI>D_wX3`YaEjq+@3nzT6sqQD)_#zk8Ky{GK#0% z=D|Q$7_k=6n8T!JB7{rl_LID>|VMg`c2ePw^w|WZ{fwzHvz60 z{Z}d!V8T!wle#3e|tAkhje1~!$Jr?ZfS+#SYZ_ob2f%7WJ z09Bnfm|qiWOU&BZ#Idxn&b6D6HP|!1Nb4o6BQU^aZo&ev{zP1kQ8#f*Copn5)uZO` zrc3tp%s|Q(VWR#dAz^@g1psw|_yR0AQGQKuCil!9!?R2cu0t>|VpknHiiQp{=}hGE zXBl4Uy#-Q_WdisMRZW8~(}VUvqf?-6H+9%q3n`evNPHzcrRQg0#lehsd~dC+K>)rL zYokT7=T#I+;QMRsBc!SzQla&#Mlo~e1u%p~CKW=3#^HmIMSyKJkW(-q$&o2@L%%nd zg58*sxC5>S`{>IMtaEg_9BctE4e}x*?f-g-J-}Ki z>2VpN3LXZHK(E>VWuXK=AtwrF+ir{FmU_x(BFps6 zCMi{eFW(>KL*`QQUM9A)ZeYkwZG;QXrR!QL@dP#*l<(VJjUiHs)l?ww&UA z$^0X5i((K%(VV@;a7I78s{Fd4(o!yP9X#d+0H1`)1R&XxB6Bo>oR`Cwf0ya z{`fLG4ELRZn>{I0EKIU-D;yjp?KCqlI4JEJNp}3I2e@#jy1b2N`UNEhJO1Id13Sw4 zSN1mU1YV{)6i+fO!(MP*GGiOR6;?qXIJ*C2F&a@ZS!L;2K79;4M#6dn#c-pl;55rx;>#hVF##sLS_{ z>z0uOU0a&OkpyeT!>V-18Aih5s9YihCm{;egMS5t;`UUvUBEUt2M-M=h)>Gk(C;Q4 zDOERrBvIaL+!-vl&xDpHLVto zDjHW<$>mE!k%h?9Ihx~NVRk~8iB0%1Hka_B^vCs#=Q(#7Jc?C-l?*QWK)+3aD zLe)6DTQqss{YggAaZL%|1p9we;1rtU0;S(|yh78n9N38hhK}B3jCB;;bYfnBgbdJ+ z(ZE>s+5$=<473J>(YUOu^?i4Ss`VkF@7YY}1<1%+cD6G0FC=`{frz!S0!+e&S~Sf5 zTB>lPG1sKq;GkvQIPN>%vAoqyacjPn(>o@R)}Lsnpz;%rC5`}lo0)@V#*4)^JqB(orT8 z2oFV@ea@A6Ua+68HeOqJxW9LnmbUt`^Wv1167zvmJl4md;+WgXr@)FRJayoOM2>jq8<=@TNy-kokWgxJG$Yh_Ul+hmG+Y9AS03QWPbbURb>N%_EXqHJP3 zgP7tcE?^{StUfY`Z&P}QlE;3elS3#^R{_MuX~9Lw0Yx}ixgJESvG9i^x0Q!$Oe2!2NEdnEy3g@Xsi*{~xc6EF6qX{|PS8wu#&1Nc_Sh_!jK* z<#?N`P8GkfVMHcK%E-wXG_j*QANEbBL5rl>>}b2vmB^93sqOWQ{ArLCg;zw&=IVd0 zz62dLY`CmMf3&<=Qi(3Q?y>9R_SAA2>8LW@y<1b$+UnQa;oDYS<4c?RRC0E4b#igI zeF`VzR}<;6+~sljd3(rxlUJ)3A{hSNKoiq77xlmqKQO6`ax`F7v0D4}oVRoGREb}s z*W2+|=}1%of$GNd?k{RCT=&@IIk1q2MJ|ZJiO%kv6Te?{w~18VbE-Eg>B;@+YOU`> zt(o6T&G+R~W!_oR_xs;v6q2C;PideR>%UglrW1DDcCO_gaVj3Gb0)k|#k;)HvJxo2 z0wk@I-IHF(?^(nb(k|u5JP3%j{8lR?+h{)WvJPBRUn?_sl0X=R0wWs;>g!)SakXiQQ!^l`JrhmuCN;HImZ>x1tK|0j>CfNRTE_0g=AYKyo1s(kh2*x;NM>fO zEfh`=oyS{4-pI~IJP*R`_;cK?DA}e}Fm?=yBr-`Vqrf-di3lOgf)r36?8fHFY4T&t zk$%GCOW5Ux^}wA)5@C*=Cb@93vQpNcza4eurQ;-k9l$u2oWznmc!t7=f?N}!k`9qI z47o^TmiE_P4H=s{Ae?;jX-_r~MCHoKvNLkFLo7VL9aTkYpuD}DY8(Pr1d~+E%mGi9 zkBnw}%D~lM!@N~MXfwRqUbKJ` zl(%NFV&XRy5k9kW|K|U-c-2x3x!|^nOpTZl9N^h<@jH)@PyOq}@1B3Uge*q?5>wT{ z@J&g>6Rgzt0eT>*Sb?l$VlRhe7PvgOGmuc9RI5y8ys!;S(^qPt&6*&hE$-W{Zh>8i z+Va3Em(LAEmXx7zw8$*U6$v60*?;e+eLtG1fV%`4A|*%oSFpwNiJOHI@?2`%yqG$N zG)+@ZyTC#Hmx$qM$Tu94UcA2BvZEBy?v$c?z`{4NL>GHEJKk@Q&7YzHKRatQK!(zV z4YNCo8sX+gY(~ z+rH~P=fmCm-m|ODxBk*KyQ-_Y=lqQ^p64zCm4$-3-iTTbN|RzHd4H%LEpGl;A#(KN zqYOWKwRfRSNGM;}370EJHyTx_VM6S0mRDIijR@of=Fmkwo zNlb}tR1KeQPkcbChla)faf$-dXwL9`&45wyCFvYJB+3;)7=gL~F5NUJ;2rR-T5nJj zVE^7UjLd_3g@Ks>u1yA_$4Hcmh?hfd;zJ>kEg+LPNMIv66N=MlCLWnGc(tQ#gQixT zuOe(6G8OEC zk(5GN#nJA9eV5uJIo5o>@m+4$|lNkUInA7sDu~i1 zPJKUN$md*@$C$Poq7Rjmen&s2B@UWhAaZ>bh(d|q;%q!4;|ntN7&|ZCU#*_d_ROf4 z&6SM`$_n8@Ml>ON>$16b_0o+!r2Rq45D_04C6;7*6~rYOypAli_SLAV6C%b6wt+ueVhW4vf`kB@^pgx7`||UY^#GkUC54=%>wj;UJ?#q@H9*qv*w^v#QX=k?4c|xteYcU>m^}0bAg25J<7h8B#l@7K(00l|ia()S~x@ zTyn$&T~@VKa_|ZWtKC`9>^jzJfy6sYR0Pr2Hi|eI5-8{8r-fKJ^Em% zxAZN*OwVR>O%U0@6=4=L(8EL-{fdEgOtL@4)o{F71N|k7&U-%vh3FJ;4Y?oo%ud28 zlEz?3E~|LA@@_|RIL7Ew7F6JNF^z&OVjh*rthWTX&36od$`1iARWGDwVHF2yhe-hn z+uquMcQ;a%7nxlFcrs1E>>aQ3Ha<$ay3c0|H+!>NGt)1Y@TbwOfU1 zpZ(1_)oL4(BF(=9L^o4Aj%^~x$drKts``U*ZIVoG&qz-Oq5d712h7H2rxv-#To--S z3EQ@{G@>*6H*B%3J+Pr{0-=!EdW8O!7HGaZ3AnlF1}-(!_fNB6uYK>p1QOUV|BQ3$ zhgB}$@{F_Spe=$F`E26lfR9sk_nk*oMMq_noSDoc=8QPV=%Xl3YzDgOk_@VoKCn{o zcJZU})Z@k$NNjk=s+6%odZ_`)3IRe3@C)96XaXsMLB18z6pp6~%1H5A7+byWKPN)J z!mxFX7nk~9&$UbaK0_=fZRsC7+U&t4wRaor55nz&w=Y|zgdMm zckm43tF`N^_ChNM4lmL&jP^CT_vVIxsfoX={94oe(+oT|kXWjK<(}1WEG>^G^#;8G zV5JNZ%XOi+AoxIy=mubEzn82?EejjoX2iuP>h64mPTze{>OZiHstX^y3T~2yg)$$! znCo|nb3jkX&q^K8k}eJYoC<%NmQA*`5Iasruu(kF$m(Mb&$5XH;~C@p{H}d-1vxwy zKOB|Hj`JC(%QTDIWJV=ywK-dO(w>pQ0mi^S3yvcrnG^{tQG`!%Wb_(oUa*_G{}j~` zs!YnRq;2SPC%cZtOvU^wsxurqG+8j1f7G6ldxtKafV{E|77VLw>!tLwodv&PPf#er z<}KS;aLfh*8CPr_`sjRa(A_XfabD_o$M5Q9q3~$#`IcFu1^ZIjOMKZrN5T-)wsf7g-CUAp11!~O@2(Mf_g)Rfl;|&EQ))!ZUAxNG zc|%O5v|@#d8slJ;MwG?c+5x|X0|{i;MnfuKXFxG8o?P5~wXR4TTfCRCb7`l))EO); zG>#>FQkrIj^E$g~(EnF8|2qp)GT3?5E|-f{F#e$9_vtkLk7bsOfd{1I(*v0FlteQQu*|XtY@&)+35R_XDxv+e1#^dZ%+Oiif(sQE}G&UJK& zXGlMwL#aa7iJv}~5vR=P{a4o49EGPQ0E0_7AdZ7l>O5yIUq*Xse=Dmeid0~R(WVaq zRK@LzG&02RCMPtSN1_=Zop20*++6kb2IZ+;_|z9^E`!cZVQ-hDRFE?fOd z`D}MAnGs3dU5p4C+L_h8&M zN49JD0&*#%YXm}eZ2mKay}R@+q{_-uf# zwBKa`J(s`#Zxz2|wv9q;{Fvxpr~?3a1bTi(HF)8k6i<97mMEJ+(ptp52VS^B-q~?b zC9bsKm<8@HI5Cgd$kw}mOcB0Wc|@zDnG+jm{9#iT!K+sQ`qbrp6sQOmEm7K?u6#eE zvUNB&2vkV)DBYzCVIO2)rvbAK8$ePlt+?$HtINMuEF96Zll=KemShimAV%2ao zbWJ$>kiwLMBl{?N05q!B;2hos8>Aglq5%kdk+R6+Ux6;55xpoy)4zVpUV`(^F;0?S7UB z=xD89c#NJODczC+&hGJ_Q|ufVPsNu{Ul5!^z4213MfdYsf53Z>I#`aG8Jwzy{VGRl)pOt=jDz;|Sm{?RR!0?`mnlr<7l9Yl&_+ zMpRhrXJmL6O5hc$tZ}1jt4GbRiu}^5{FX_Hj5?Mus)-J3UXBeuAN|^T@siQk|E#`j zO>8>J)#t?tk|d{5rwej$c<0T1OXO~IzXpAk@ zM_!Q`c+uU&NL*=%DYmV+Mp6lfShQ*7U7#gmj2GU}WwqXo5E=4Ujq|v}YjH17r`WJs z&z?+IKsjtXTWoq{Mc{hh;i~)8r%H#Sdk4T$bn8L3G;J-hqn8f2Ki~9`JqUx9G9DWh zAEbe9bbjbbFaB=rRoQt5Eqv7;aUp~#Yv0#*gd!RwiluMj62Mae*^72tVfTiBzFcaN zmu&6CiTIje>+m*&bYTwetOkjsQX3HBQW5LbHrMFdsM&+RIN(30UnClQp2|1lQ#$fC zE%R(*#U8V6YUGrlEcxbtO;4)#;q|$FuPxMA=)P*teJw(v%;TTZ3zr9hY#2B4KIiS) zSpywbB&lf~;h@6g6Q=_j5~BidP+>}?P%VbGQ`_i#(k{JF;aS`zBJxlDI$Zy2K((w; zCk2@98qV+QS=-6gk5&2RKczu5{U3s{|LRKlpL;3T*tq_`!I+NCe|jnYL#P!LxCwej znj|S-DZnIhnO_zRIz}OUCuV@rsC+taV5}iCyYTa46;`4(8=oGa#aThD*;d6%7|bxs z!DczB&8*2mH#zyb9ek^-p`Gwxf8xv5tG@XL^m?{c{@uZBeX2M;e>(p>_>v7v^DU3G zSnBdV`+9vJ__%l^gA@8>oK!jv(ajnS*ww|TCpytp&d&M#mbY{9ygyhv8-M#>Q#Yjl z__UsZ|KZa*x&y~`vB?KAJ=CP$Zq5)I-L!(ap$4U>j&yLod;1rz!7 zyhz4D`>n5ZrfEwQ| zYI)t{Tk*U9GqZAVq4uN~{bSTxdvhgTYBY064HC8bzHrIu+a-SN)JwwU%I0Rhe?}Na z8+#@{O}fX6%mDUA|GkJFAl&|(h1Zx30-lR*54Sy!6T+KFbkAis%(U9>+s_q4my5Th z^Gkk0%7e}s0K)thuucGUwJqjtYY+IpM&R8UkQnP^R=)_;0^PkQ^1q=U&{2n?oM=lp z{^Cc!Zh(1|e0>FPcKKd|!?)YZ?nae6vL+D~W_J4EJ;gakSMbYO_HwR6bHlf;zZ)~M z$bEm;P~NjnWWIlVkv-sEt~{mT^cY0$%VQ<2Y&V_WOI>=sO&za?A#~(K*WS>neTq_)vAs@$y-~pM+I%J^P+p(!s2M{i&)lGDr9rc;_~l9KSOQT+!f*P zgbfy|W;+037f|hPF6(X)*on!2A`J)nC$ulMqBhkbIprCgG8D^36J1Lhmoiq)brK_Z z#G9H1bTu;RZ+6n~zcG#w0@)}4H<)^t(vGG31t8XDmgETa=FK2YbWI*CiO`%b|3QbX z6@7Sbr$7vzkh;0!_9oz!pW8!wDG3^@0rLW*Shf1)iP$j};-)Vqd&%nj&4qT*6^#~Nfd>80CD7*P-SB=y(kYb9N4cZ`*Tpl?(jwt62$u87GE4~J%C>(w&U-#hkCZlFDjK5jGdnh=4-xtKgj0wCc9REY&^l}vOLLCQ^xKZ+fwn;8wj{bOl0%R+mQ)}$j@-b&`mes>^S0Y`7%(be= z;nn#`7O%2akt6Kf%Jzn|AAL9qiBj|uP3iXzVT@|b`yczm1^Ru7(7G-=9I&D>fjpAl z4)A8%3YfsJ;--amjqQ+f8v8y`U=i+JgfL~}@57AVOii*z@e ztmviFT-+i!G-9Y4c{-%2d^8HKIMNddxNpEnK*)c^D*|EKq5WK zsQx_#qKb5(ib>N)Pu%d^1CLSzFZGT{&SoEw-lP$^J2AiA+)IRmcjk~v#<%jD0GdEs zo+)=?esM>^78)VUn|oUT9x`a*kVGSb)X#%zpzk-XSK z4S!4ea}6g(voMFOtdynOA3Z`)yroCm2*PFZXa|M*hUNmP5I)k)QvoL58M2G3B2G$1 z_yk%eda$%{Gk1&jMQ`HPI=(lwQ*?#+rgtc9uhk_TDc-FM8u6?3_F$5>!~UwbJ1o8J zYD9iONFDR2g^@QFlf9KPkdC7@ETbsiNo;Za$iZ}8dluM~#b?AWM6W2-?(0x5K}v!Q zO6&vCEr!?WC6go|x0nsx8aD zHe2NMH(W3e+n9;H#D%^6-1JS zbm?bp6$eO@m=-*J(C$1#30fgtvvIPJql=HOAA6u=|EC~Et>P_Q#byg4|EK9Pfd09$ zBE+kVa>N5pTB6Acax_nXw6I+oZXOZ`(0!39o`mDi_O)!0WnI-?r*M{Rq^u4x64_Sh@9YAlmhY-D;bYYqiBJw*|&8Rl^4Ow>Yup3bY5lR z`pZZP8JB=$)&~KvJmJ7l$`cf5QnADM&_$?iMvtqI<~bcOn+= zZ4m4S$LWxErzlL8+h{xSY!wKq%ia5uiAHG1Pr0s5dRv1kL-_&&Gx~gnKThlkOGZP) zIuA-T5GWQgj41K~_el&9hsFJM%;p4-c@NmLH zd>4UPDG2w?zs+N_R>WFU`lC%->|Ps1l(!~4HIDhFBfLj-SgGZR*92 z*1CZFE`jKv>I%)}ra{beAWL6|J%Qir%HsbNa)+)?BZ&xs)w@h^`9F~KFG;077u^j; zz@mb|@{?Fx?vDXoS#Y=0gvT{Z9o}tUoS%o0s~gcxSnuQ!gIG}+n5dD`D3@YlO;#8CS-cq#{wuK0=w%p(mBksRF>%8(QM$Mm@AL& z(apeM!o*QcQ3nP4@I#KjygNtBo98vZ5&rQKk#J?SwUD)@N z7}L{VZB+=gnwOy94Zx+NLv>?bJspB~pn24bA>|ZpNVIQlZ!EG5*3&Pig@T(ctSs^- z%3ECOjVD9#o=i~nrI&Wrt9$tcmHVGF!dX-MvG{(|Nd*OOfMEe_K(;FpvRuWQWZt{3 zxeb74Yz(>6-=Y2Kt-P|M2|Q3Lo=EX=toCWHlck!SbL|cUc&NReaEz0+>CPtt(=|eV zT$#pDu%QhlPML6`^%WWq-yqnfl<1i1nmDbNJ&~5|_qg*4la{?Ge9(+y&o`XYHN9!m z(1~Xu=`A}w>u;$(@#~PHr-oqT&P8Bpu+GYzWyAMaA1T}$QWXY8yGDfO1s^!)8&-2- zoenzljy7rhL3hwi)OT&I5hsW0RWXvXbq@5;sOa~bye)}Kx!n8kAx~U7-ciEp9!Q!Sg+sv3UKE83=dkpTkZC&-gVAC770M|U14AN&=|_$vsY?~+ zmd*?`ZvBqNMSrB!LWlyVKVx)jA^|SUOLnA|{yBJuF6(kS8s-1Up_#snS}AsV2_-xT zQAU=78DWD4o0A!&s(8u?Zj^T!JQ>oh~ z8{lc!<6h0VKvZk{NYJ`Vz4mzeEs~gZeS=?ox@j6A`H-5ug9Cy7ofd7`w z(@HD~XmHlUy;sM@nb>$?K{L*mu%#Q(2en$Lgi9xxXjz26Rt1V9EixMP{&}`Yiw4K= z7VT6ox7FIG3C)*krjh*fQ5{(4X7LxHYge2r$^rtvkuO0g+vs&sa2s;l(;)T^Iextjp+llVeKTGP^d>w((#1C#Lc8p$&; zKKICeJ+CqfCo?PELxL7HObGj&P080Wm3=n6EI|sV_s#=GnMB#8=vd5LzOLSq!2 zrP_`naL^&k?Gg%SBIAX^x5o)|V z-(Fsu#FmQMGM^7$^G-)4z>dhp(lfVAadsE>4D((A;oJe2GM&?ZYW7n@%;Xc~l**{h zd3|1&OB|(}zyN-V09=M;0YgdJ0y!lvv2#g^sa>>~(?={AWM#SwA`7g*Hnj6|?yKZNOFPf8#H=RY7}r*xgRHEr)wW;_@#I{+`uc_hUF*FndI6zOm@?#1WE)~e z^9k#{H1~&uop-h&9q}J?+wb^TY@?VPzHFfa6Y)B?rpgyxYe{6tYHqV`wPj7t z?;3D8uJ9?6E8;D{$oneq`|$h}TOW$Mn54X<5(jO{YVr9YU!%_z0#K4o0DWMx#}Z^q z2%MvId;Z)Y#zGUX>tda8#r<=_t=?Wq4mTL-butdIyON|d@bnWKP(bF@Js)@`M46OG zoCYPQbc&Mc#mwj*L6V-1Wc{tH(0E0>{RZ+V1%y?BTaoAIB0jjXRb6-{;`O*cWbo~S z+zfOkf897Wtn1W4AqvY&cz;WB7XflHoZGW`Dcs2ZhV29hTKsCyph2(d<0ZQ`*(8yq z89zOUdUtE8co(=^_r$PZnH2O1n7Y#R+~o{TsU;@_g@IP*e~Q~+?faa8w5OA87~9>? zr44`feu#;5Fs|uqdu}HLtT(IRjf^@+KY z{^4Wz%JFG*`07AP?=w-Zk*B)B#MhzmTWPP*@6@>}>g6W;riKsTmy`24HTrK#WWU5($;;*F5We^kG~gvEfcbKm{YsnyfjWKBFlM4;chObM^7@!p%<9l~<0ZGDEWKl0dPcA%RrY%LVyb zDYs*)dvBTN$a`<8bqiVxBQIk#MTK45NN^xj4ft5uQK+LjB{^w?^o2>v5Don%EE5pz z$qLlO)CA?wA?jY2KGkuNg(3|jrjA_zr&U}y1Do>Q->Hp(zgi{lb(`tM+2A z?qXMJ18})f|98lj5>%s+$|dc=lbZ2?EB$rahG$UnZPf!dygl`l-t+>1+p*06N7|AZRLxVT!^Zq#7ae%dMl;iM4b}-pfUYfs+N@%5R_eP|FfvT9cfIbw_{ct2Dch z%ZDMBS}VPv+zt6#k--qFV$l0UHw>k}p{6TGp&!UT;sBmQ!!)1YUSNhpf(X!V9~E?V zW6<64_&SmD5%}r~`d2q^+#IFq_ThSzIP?fb3W=|Cyzh+?Iw;pT?Rs}%hxjcyXBGIe z=q4;73~@-bBZb4FKzD}n&08mcxps)`8kG?QaIVydJW>*vwJ$$2IP~oik@k*p9Y*+* zKT%TLO}m21#Fu29OdRDDjEOG0=GDAH;Pg36oL(c)Nb*7(iGWHidFc!6InM=yhHe+U z3#CUULU5Mfo?S(sh@-rfC^jWQKLy`2kK6eJaGiS|FrddFYPK*f(b9Iy(J)R`#kR!n z9_#julnq@_Yb5{MA(kR+`ko~*y8!aVsB7A8MuPspN}3E@B$=+mreVikkb|wN#N!TuJNalIE$B?grRYe6n+Ngt52-vEx+S%MtTE9!NQW1jEnd)hx#?zFIHV7LuKneHbFC4N)QJDl-oRD9}sGh>nZfd9S3uT zn(1bb^2@*A8wh24k4F1(MwK9h?pP-{TcdmE@tkTHR4Wk{(lrItoB$Czxn)6VFMu*w z?w?2~wFnGW#K1yvuowRJQmSx8n7zntsJ+5307y4g=N+ zN$D4B<`4PwP#rMZIg_^HM|%gh@!>Pm?>e$Q0J6H9nDBEDQ9nn%{P)fF z5&}myH8bmE$g$U+f!~J(qr@$bGQ}{`t$zP6KK-3J(V3?TeH82F`b1XLN7b=H5Evwo z2k?-jB&H82+YHz$_)7D3WSwScw;efdo+4F0&eY`dItB{GU}!K62+${nM5iv}AzeKF zmqP-|2W2xjzSzWe-0f{<&G38&q4!G&+AkeKSdaCfGN=*-osHL4@v((>ET%MEDaJtH zLt-!}WN>-JppXWoH>xRw{m@g7L%MTqJGKR~{Mw_|QQQs=G^AG;ErwsIJL16P9&eOD zKvf&SAmI=|K!RENBsbHC1>QW?R~K9-w+s<|7%{$XJMeCQgTmj!ytYQ+`3spSzKniD z6Vye8{sQ_mnzB7@2!8N{1PMDZN1DubJ7ET+j)iPF3k5_eAQ7Kg z7d3&k8-*IF9A90|-p(M&e!TAO zNE=5Rnolldc^Ehao`5}^!;w;@mi{SYT%%uo0`8K`E;*zncw+i1J@T(hgQ-bNG^6Xm zu0V#V<%8)w+^DlC5ZI>j6CC=7!!NiKmQ_ojn?e+fNd^Lf73tOME3${eny1j)8scMS z?qw}~N0wVk8pv~;YDo?#AJ5XHwGFnaJr-Lj5Hk|@=2-wUdVP=Om<4?=^$W2 zIBgncPzFPzkm|uK{Hy6=m!YMpz4`SF*c4+fiX02JrY<0fwsYgN-&5PmZJ01a??2lR zUVVveQ3qeSu|!4dYNMXj*ao~DIj&SDpsh$EVG}L2EFR!6ghBVpBAaB?v!T<9j#%Of z4gPpyssNP~&rAjYCrtoMDh72)A}u_31!Oo?eF)LMPN$dTpc*0k$ILBn_}j+omnUys zQh)vgusbXJv=f8(!4=KctKxn6adhb-;9OkGEtLONsFbB5Npr*`6}2I$Xk-bebkVG3 zttkLT)>md`-mAhe-6N)E1FRh0aEyF=j5ixtG0fX*1E$h%PH3^Kf$%`pQl&>ZzT9(>;F zx^@}_LdcN30V*x#e(eh&s?)HyhoA|JJMXm+LH zg!*9=E2m(`%8mwzSSa#HAHiok5K%Ov@gAdGM&VuG3`|9g2be%>Oc@2XD@R@-M-TqTolicwT2_vC13ykgRU9 zg8Oe!?~CtU^4|rjE>?Y1m9q#BV;CrvIQMo}Hv-4Xfi8E5%KI%l!Z1O*xkIzB&YY?v zUdqd*+t@go8vI{HiF(WYEk5K*NGv7HD*8Bfn5(r0a|d}P(%}%sMu3L;aKqNfkmZcE z@yx|kot|ynVXX&e%We`LW)mI&jJz^zx7o7QwQzDZ!d&5%{QFOH#2wRskQ}6kFqSP3<#RYaQ_dg;^UR`jxwK3n+aZyxmt?fT@gGT0=~w6* z%^48MfqWQ*JdSK5`+}gMX$lC~%Iu+9lul?!^6v)vNESaPTVY=9U#WYNzH4x}Wu&4I zlDGhK#zt#gdVlJxkW@jX8JBa$1+(oAK#<+& zDr#lZ&sS5fzlUTiDvNe5=H*(;fIn*Dm|A|;)M0g$jm{U|D13&pB(Cm4omyA~4%f1Q z8O61fBqy`$2^7_JmM!jxh2TELXcBb}yTOoO?hNLgMiXGG?(os(W3=w`lTA0!|``0@}dHEW9DTV-jZJsUVu)K(3jAv%a! zmpP{OmtZl|APS?L>->wG2NztXt`BDqq5BDhmG1}vHN&ZodeOLUu^pe-=t+);#0rrJ3{M$oCV*8C*qVV4IKb$gI|F2G&Y;1u4AGA}; zX=5zK*Dd7-wBjDgell?ObcCKggGS@oy%Af!3q$!IJLxD;KtUve1RE%^>g&m?X8}H* zWe!FSj4cBa+d6NqR6h3u+{sgw{fK80_aux^ZYGmr5_5R!?a8@g`}4s0y^dOr-$d<* z#%ki}{Bi%ep?}s7W38&p_jAtU<9hS$?*Wo+G!nFk@>@w30l`hUbE)pgO`P;_sFWk!wSeI56T!kPJj2n9%84dmD#O+TeDMR^kWRaMw{5>2jzXGg-L$8eDM9>u65QdU9+s~8;WJ}pMQR+ zzB)8kfacBz!QlI<90+Cbo8Lh=D+Uo3h8^EgDfYc;7N$+;h)T~HKBd78qqrVIa#AaJb z5LWRnK}WdyH%Rw0Exs#1h%3YNvZ>Y)ZOQ<0WzRKf^R^*2-4*Jlm%8Y`_> zG_f0AgxFyDk1C!-YfpDUco}Lwu4p-tHPf$X?QrP|R6-7&GV8iH(H#iDH(=;7x@p5{gV-te{(<_sE5x-D!!V!5&`9NSs z$*-wWW+<=CwfC>XYmwX^*HGK)dubO6_NVF@;l=Y z_JL3H5SffB#2i27qGl2+@gycOdXKHf9Ij#yr!ik9jbDKr(%ng#fSAO1 zxa)6TU=z5Z3&5>dgT4(lbms)q(q2JDlBYqlM{hxt%g3ZiV2$aBG7#5183p0Fbm}Gj z^U2Mx0KYeI^<@p0aTuMsX<~Q{jM^MUKkx#;H5o>eeY7%+;6=Vqtn9BF{N1hpvMLOq zumR^x*IMCCQ+*OA4#67XI+LDGs>IvbX~iAkuoxl1lD~qb>gPj}?8BC`!abhEK(Fc# z6ae{(0e%_5Xy%2`(H~z_q?272KG3ej*8%z9Wt4a`HtpMk<(H66&VD~R;&ac7=Vz4l z1Jk!qsvT4{;IiyY_kAv7y>X4>1mCOQwK9&UgOE`PxPlSAeWvuR=KSoIYYkQlZknl^ z&<1*y0K=0aZ9|Dr1_p-|fP-oJY@^{}Y@uZPFY1E66)OD0#{Zjbj~5#&dNp1NZFzE) z!S_Khintbl&@}`xAi1`~f#^vSDA zCa>;7@!waj1op;xJBBk59t-@k?xpYzGceOYATf+tC@rcA`=3j|Vt?G3pX}Ke2JiFf zfe{tC{l>qf@eI4b(61lacc5r~>n!$k#ec8gunk0*2%-Y3~@O#mlO3gxW$yA^f;}8BVt`|$}~u5MPxJK;7WOFlxEGA*;2Iml6^+cR^&_u zv`0`BPS44O#>1WmO+4}x?Ia)HKqk)zVbxcP|C=)eK~SE@54M_~%ez*G+2Ql&=Yv*3 z533yUPe$J8G~(5C)ZSIxD&&j?5Mlpz1nH_;>QhhNuB?ST*-*(>%VSK~r?{~7^Vlq9 zGwhp|MO=y`k=+FfQcI`rpkcBd77LDaUfJryinkH#oqRJnfjy@1j z=6*YG&Y?!Ace|meq`Idh^SY%s>x@|iycdfv$d05)aXt)jhPATxYR$BDxLU0!Fd0xi zr|}0LPU7f43#Y0d4_cppT;W1Eu}DV-v&WJnDb8wq0?|hY`Q9-0dVn44=EE%Ru{2(7 z*qDC`u9mFzA8Hktzup1N32GJ6Vjq@v{pdfBS_k(coexh}@DTwB znebq+W#WX}ttfpKj#jHMdwq|0do!hV4Euc910j`m1F32@Ja8b=8M_Uddbl&FY53=1 zh)_gQG}d*bkqoU|^A4YWj)6)RLHb}nxu5H^9ot>|N|3Vcmm=Xh^ic;y6_fw=Yiy1< z{3!MAEWOX}1vfcIOqL!LtkPRKB?*u==ipJ7N9r{foX4sqYSkG;H2@4I|Cw769xjn^ zvhBE-I%FPGF;TF5OwAQSV#BIIgO;xrIs5gBd}*DBUSXsx7}B(2VuK;lzvP&_0tH-a zCZ&?Q%v>;tc>e%!l`FmKQf)hKgj1x-HqCX^7X6yvy8@QCqnbxrfZ5%6THaYo6Q!DH$g z7$z*4jI6?)Beayrb+Q#K&DFnPobOX1EyYyDi@9AFN$i@%uIN!~Vt=N%u8p_NKGPDD zeXagMw+A=2p>ZWrs}TwPk|a;b>uq?mc~{QABbN}VVdh!5KdqpcE#WiP50cUuCNdSd z3-HSepi+o-2Cbr#D=WytqdcJRhticziq>hyCQbWIJCe9M-Yc6o2@(+WZ@~UIwJ#dN zJ(F?KK+Eb*vq@Q!R6C2uap2XnA9r%xO9iKAaYzm0CDpr6G7y7D?SW?{p5oT!og%$) zh{)cdny^SwFUDVU0gG;{o@{N}lf{Cb*FB=^9q2(mj+n5@N~)>pT-mJs#qUX`xJ6|| z;iy9tJVgqbm3I&(dXIf~syCp{Xe7rRwgF_~^-c{{M{FCV=CM`aOEFBTN5^kSB{;MS zaCd3LBAunSJoU`bh66UIPv>hpHs52O{wlw4Z-z)?L~T^Xxe_`A;mtD8Os9w=Zg@de z{*gvS$*?Q@;W2V!H?L$U#2ek|H{aA}4u!F$o}{F-CiF|Iez3Q4drC-sBUs;WM=o>^zb^w`H zHr^YVV|Iipw=hI$!}He(hj%`S#-E5Mr1vO>#g^m1i^kB=UYNDdR)MDx5w(?5)r|%Q z#P6Hnps4_?4B~^L8I(5b0A@?jk_Lnr0nm#9>;||4j+@g>1K71hGCgY%3XQ+5ZNmX4 zh8$fs;p+@_IzI>q^(LX_h8_ceWarm8-(dF&(3bVpPG&xwjqm}L4m*nKFEfb9J*x^y zrm-Q2ed00Pg2`j*0kX;76ZKNN9r&BVBt^O^T7tkRVjQuYfsotWwG#4BbIkhYMu?8r zm!0a#&o%v+1(R=U`;jx2pVt1^YnFdIB;xa%EqR4AGA7t-w24%_-(;g;=bt%O>$J;n zCIJFkGgK z@4lXNxE8i9@;`bwVmzd9{VonBHlORt#?HAyM-Y&Sg`IJD=io7iibitR;3z{+FFguy zYcN~xGWXuoK5Q}@J`COzQZD~m4<=v_FvzCrUEB`r0@I@B%^&3jofgLvOGV@qY%_81 z7lH^I>*bK_=*AxT_^ANU&SmIvPbahP1AnbI~ zSxAIJ=4dm@#(bj32t=H4GD4F2i4_vIAw&20bz|P>w)8Q(zT6v}UXuqW=-4fGzJA1i zrCv>9#3KkUkJY&DR_3@)oB_HOg@~_bdyDF8A2`S|)3mYS9X>3qgmzLWBFDhFd7cTx z)la-@E00bH9&V8_6kY@~in}oHx6ab!2~Mt|tRe+<6{UvxvFw zIL3nk&r3H(aIp>P-OQ}t)-Ly@VFPzftv51=adC)7qJi9p#L9|BJ_+48e#jVcj3USKAmw2z|i&^bBTz0YQQ%-8-^ad zujzwM|3qivs_m%Sg_jBsn~12#{%i{A$~}9+e6F z%0rc=7Te@CaHvq8tcZD+j=2wkerI&?X|;5F0KM9a^R6cRPQ8c*Dj^s5-0UWygCZWF z`{iMj*P&-`qUZ)<>OL6kGf2$IKs2!1rh`N>@Aj;alhCE)pA4s;-tTtVJ(pgaG~~?K zdj*4(P{N|8PkSR{;CSlRfKXQBflwwbd7Vu%(2AY5Rv)v!&v!8mI|)v>p<$H;n_m1MEO9wYTgdLbp~ z3Zp(tJjo7Ij1U4>LnoP2gz-pBf*K0(iic4ZvjSJi@uwJA=ipUgb8IE4j zNUwic2Enkh7}Ar^0GVaE!F8B^^ShEEbI*j2mqs^s0R6Igtc8H@2$%Pq8&M+Q;m0I@ zzMzY%L-CFJjq*isoujfD-O!HU33AA`#~(hiAjKax=B6d(_xmrvN{1W61F@jN5#Y54ME}-i+qP}nwr!lYZQG}9+qP}nwrzL6=iZq~ z?%d=*nQxVyRPEG6M*LY}5!? z{x9Z_-OZwmDdviDY3%V&>*{E5)^d`*6m0RjWjhaf|UaNECqo{i&Fc^dl`_7=Bkljhz zoIW4kHVG2`oqJEN+39`d`+A%I{C=Y_Cj60J4ED+|Wf~SaDo$vmd7$#~e%kHz$UH2B zfBZ+w$!#0ugf3?9{ik1Ag=4)iWe_Ck#|_a+cD!M4eR>pj3PQ`fLAUSMc6|BxK8AC_ zdp#fhaPfTtDSv&uS-_zGjtirOHx#RHgD%u!)2B)P3Zc89ZlwUC`#v&ok?S~+8KIN! zoIMrL7&tt*K8a*8_Uk^KNW&_{e9fx*Vh{Z=A=DZZV(AM$Bn{Ic_Ckvi?Z$RnD$t?z z?AJ_Cm{PgSe?k@TzWVy_@}xoPfkfaRfa2%Ia`-6Qq)3i2op#92`*#yO`t1b-nk*(D z^M52-M;&=qy-E|KO|rARIh;pRL*F5O(PrQaIuaXJN-vsTmJU=z5uI4HhtLi#i-y2g zt+*%0KSZUD#i@Qy-#LDZAKv{e*N5=W1Z*2nhovh)iVZ_!Yil3vNN(2(Yhiq@)KRCc zoPGiVxt9RE5Od9Z;}JW9Ptpe`jHs_H^P!S@2H)uM;#21RHeRgeRnnI=kSAvQx`Ah# zLbpc$ts~;y8a=%rf*ORn7oop7pjyEm8(=E3hMN_}U5NX{F|QJxL9HoIOqAu6JJMhe zFms0%aiR&X{nj|GEsJB<0^q5yZg0Z6y@U&)>G0O@wYn0+-X0*Q)}^d6v3#yV;$^|W zB`whcZs$UHR*TE}RO_xcgzIkLy`WAJhC1CJa)4;X5#xh`)jpzerA%As5I=DKXQf53 zg}MP=F^6?-UGy_JYHtH*sE)$>rQV@*d;8?VOPVI!UN-tbH5C@3X>DY4p~_bO{e`n} z%ii~4v}~x2RJsfsm%yvwEH&Ny4C~u@MO{qZkpM^*01}}MuBk(m7+%BpL_9iPdPZ7c zP2=?S^vRXwxZ=yz`=ZdfAOMA09iHS7GYO~pypws=m>C3m-^E>rNGM~)!WJ;fuPLI= z&{tROOcR3hLR|AhoYX*In`=fOg*H=p>~DPFS59f__;X9(9Xgb#p^FCs-(D;C12@7~4$UbRoC2DVpnp7GX z^%XiGkCIbe9b$<&ISU;y4dN?D(XjwAfG>z1H_34Rl;oP!GNh-0iwaOO5jT1|@8-ZU z%f65rfeXczc;Y34zsM#%8GYOamg((BY1(wZ;y1033bc-Uj^ObSFFruxB+3H>gI6+f z`X!K)I7@$VvY4!Q$Inz$%OEs+=ZRF)+FI6xsg-uR06G%a&0#DwA6W1!GrKG&rUQ{O zFvaIWQv?CE24v*`!YiC*+u@?R1KhTf&6jFxNnu9-avEgXIBwo=(yfVs#0Ntv+XI~U zaQbA>s`>4-!jazn$VUU!yEPK}Ha6hZ?ZXsBo`N7~+VJ>+%7X8wnq@)**|Ywf0in;e z3ps<419yt@!6GX`goAQ<-?cFt%%ypBFSKrS70apsKYb&J>^tWZh8`*M=x!G#iDE-4 zM-7aHpprz{l=l*gNmIiF6Jie-Twe#QlI`{676Y}Lcrl5#3&DUxBK0i58kNZ!RV8TA z2GGM7(!T4^jB_7t>NQ~s^ z$lVvJ`H82)0g)nndNC!|r(3!Z$!TK!1{m;*nGiI#`kUyO^c6-9Lo&G2ApCNk;coE0 zS!4zWTwt<;jn%DV8HEcS#=Z)ax)8n{DgUAIYKzF6PMZmYM@b{Xc_v8kr-#qXcSb82hXw&A!~ime z!vSpn-X@vK84j$pZaI#W&M}D?1$7-3gS?o4=n_=v z1hq(b@V7aa^juZZY0LYtS3)xY{%a( z7|`EglyOAOtCV9XQbQmhE-USJt6p<#;9{4T$eIEpOX#$WLeJoql114hbj(nIxR6gw9 zbJPrNZwZD1U)zaWag>s_mnj;Mx$V>7mfWn6LOpa})NH}wcx=HkyyZ0;uIm;MipH9T zzrWG|1lE1FkoYCK_H(vaz_61vKpBVPLTC&0nZT%gYW`XL%!GIs7qyW;4t&2O7M_6C z8LP8!h3!9DB!y8(X{K~^S-kgHM99*027>S~?BHk3)6~fupdOFbVvlxM1 zupne%f&MU{IZ6Y#+A0=LSboh#izBy3MxujAFbes5lf5hJzzs(^^@%bohiTSsg3P{w zORm24wu1SoY2~40iXgzwE@|CwuHtTB(BOtG3AxmL19?nX0ESKNMV7w2aoWAKYx5^w zTGBfEoh`@`t@v#o<-Pe9kN2^|wp8w6y0L9sm7>JDtV<(Me0MeQ<=*kh0n-_z$S7DN zNRFYnji2V}eWos96-m_5o$c8L7Q~A5?h%;Hs%yf|y-Z}~*Dzd(*2Z+rmf0sTyf3N4 zvgRYAvm`|Z3ZJIooP<7B)sAhMMwct(5uDq>=2LKF*F87-iC~rp)^>2fqjqp z(1SvI9!uF?GQ7X~KwOlxF3(T#KSE%^JnUZLB6FAcO?iFQ;>9)pS$^^lDt{q}xs%vY zX3n>50y(vY)f6WJkseK#>d<_rQgT$}K%ePn&DsDog$7a1ZPzL8?g~A+PuBb zIcMM)gRL}t4@p&0 zlt}PVR@q189+T3;ZDmD&`oRQ_t9M+jcqYk$vq%9mG6*B5Q0-5c-hS3>MluzE&J~Yi z@P6s&&1V=B;tY;|2;N1JLL;g3#D@EF6&BnQN#6kn{f%l;^a9saR+bS2zERF^{wr4` z40Ym6DyL{c#h?^65Ou{oaYj%jQgP`vgu9YM<^B*gUTP8BGpba)<1W!vNvj-DV&fjs zQn$t3DI9XF%>~cclPyxzI{4L-x0P2yyBkh}C#2-Gc*cC3)@%kBft%IP4!Z#rjXPHe z?8{?8tb`s(AE(P>Q!XYT#8g-Q2+tp*2Lj?YnT?`H@YmQ-k>ZE^l>#?_asNKt2@9lsLGKFy;!ME@~JN^6|It3hh6TJ=xg*hp7C|Lgk;F z;`o0Hm1$jVyG;%>U;4OT0{uTlq6OhaWs^h@aV6Q4h8<}(Ole`Jie(KrR+np-lD1sG zzO$S~IOJr!p`yjKb3-X6_r$Z`LMKlJ=NA@=t~=}N=c22q$5k2b_;R(WufM$AKbJjR z-_>o^=%VWM=%wnF^0gC+_UEmVb;sefif`4EU?3-L9_Z&iS%W zy};zh%|j~tALkFN`nKmUONWO~Rr|De6ud)&91L{XzYMBQ{^LV`Kw`)DOQ)D>+gWve z<5T?fx16Ihk^B2T*9c{>AwP6WiCbSiM}Pf+ibuUhgdLEP6<=N z;(Hx`k8KB@KN z4Cq$T=te{+;KE!Euw^p7>1C0`voz%X^$<^ zq#6v@?9*8t8*?i|uOxWwZW&00_FrDX^&Vkdi}DF)?k7T?Kot7sfLvSxvge`)m_UjCbSDT=QrxaawSZ>?b-6g7#@B30d@R<|Qn~6 zJHk&Bz{!13avJHcS5?V(QfId*E+zlJFigGLN?B-dhtFeUjvix9*lV$*9fnrAK8L#? zH{Un`HyyD3^?#^j2>OLsp42`J6b#{-3bWE;o(;*r^MYY76A^<8Aa7Z zd&F7+iui+AZv>HCMwinUnMpuWpgSAaW*;<$3K$O?TIxR4{7ErYO;bTYjbGaX8qB&- zaki%}GZC{^afZU?&MCM9D$NhI@+XTZz-8%FL(y8mAq#?*3|XK;%?4z~FffF%RS>hk z7Ez<131*cV3E{CuQO+HDX-|r{A&Ww_j}-4+`G`hzF03FO1P09lD3`&eG$|(yRwg-J zRis2E*afMfHRBM28n6ma8{GlM20(3|ORu;Y8l|X(g56q0V#&QbJ{tha@!`Z}>}r36+ELz0EmokYggjAx9L=rgzW+Bt{vu_{fGnx`%6 zw|ltsa{<;#%x*kaz_i3I7l`#+j$dWnyWLlhb|vA?Ir(f8Y-r|Kun6%X%w#%gyoll} zecISjr4Td7DaVvegIFVvV_3hBDTmEZV!GhVyD9=41ao<4j74mL2VB`lG#`i`%$JR# zeHiC`p-=)Kpdz$3%#$x{ULjCYr?Oe3@5Yi=4}wb!sJ*|o(~D?6XV-%_O&fqq&-)pIW|SycT6{*`Y!wa@+d zG@!oJV27z-Zky@Whv+SyyRhhpuwfl=Oy^1LS_n)q&|unEhiKh7sw;n=K|k7h9W3ty zwBuM-b(``8@Q;`HGKP};7;Cbp=|G=OS6D3l&Nj$sVOk>zO1q7xt5XXiP|Q))s6*&X z2k1J6Pydpt9cJyIgp`Nv<=PG>qvxN&4C+leSk^Or)#8bp0HBKb*BUw&Jp+VS?h`=D z4B=wsZqXYnY3Fp6QNW98@H~vV4S~Pu87G{vjJ3w0erS-C`{xH=B4lQWoyLfX=y$)e zLmI)gv&ZQlJpHqclTIW1>|T+%xn_4vKES)fyW{N~i@Sk#J$H931+l~hcUK;|Xyy7#EzU$;H8FIHhF zMFZDewL2?$k~dq@z~%?xoBGiNK1zm#;U+vv5uihI5gSItjeJ%1c0}d%3xR{()C-Z` zC0V2ho)j@>g#D)dnlPYd2ptW=K_kTrZx52l{pViA6sc)iiXh+L(Rr{!?!m zXn+;`8Z>C?bWJh(t%8PuS`DYv3{zBLS&j=HQA>%PSkdW*4=Lh65dypV?;}S9(OkLD zxPS{$pynbGub~1X@j`sOjB%&e*sOM)s7iT?GfXtO2 z+C*FqWhp>3S_|cnYjL1Ad!c59t8k)^MFBCqK6H-!9sRIeI&TQWPI)WA4!^`XvI0NO z;AD_4EiQn7-OgaA9p#t%mlxqdmbF+w+b6Vl+e{-kkIVsj22p9U?RJzaXChL`6|($Y zk{mql54G%@WL*tS0XBd)q?WcS$~`rFV+V*5`G<|B`F?nPFZg9KXo+V1Kpjq(g)2Jz zB#O({<9j@MVZxBC@^i9s^71wkldfpbrB^ap_acy+yh>=h?d5TYxB|IOQnpn|t;H?tL1EM5LBujJ*RF(bBc(Vh?$B}q?lQbcTz*9dDfKkz zpm6ErMqt?$OczEF1I#AVWs`O+t-BEFsO5Q_a)XldE|??0p}Glce*#ZnRic6W#)$l5MK1(g1RQ4aU zo-mR@DVGbK5Z?l%#2_$vAx}e$>uMq)Yr>%7VpI#zdLODj(Qa)jtj{*RQu1;wp)nyHMlpV6p)Z>h(l`BARF4fdLxIMUIzk=@OvkR zbNX?$0YNxI!Mp@mO_R6VJ1;LqDyR?^t-h`e2xPT^J2Kv?ci+`tcU^jQ0hF^L8~b<6 z1a+-#HisP%lrh+tx^!hyWi_8q1yGm#B@G4FK__??w3Bu_e_BRM;$eZKYwPqHS6)uk zTCrHmR00UnZe^2fr|}L=uP$&(U1(#3ayCw?JG-$(ejIJAqQVl^38MG3>oKrPX%Bg6 zr-Cc&Q zBQ*eaEWx|8)s-7o4%_9UzA&I;7?psSq8vBfhY*yLw{>0tqRGbB7|26lC)urpM0InE z=*5u$*|3|#Ja}lQGZ5sdj+-jwqEqf7{8W*&T{s6=yG*J|!;v z%`l<1cTr*3s~{G!ff~%TU^ii1Kyoiv)+%)JCuOt4sT^t0GQAE}sPuQNFkgF8_3uCo zGLQIb0wb$WxV`B&ih8pHl@wbXi*L$?8x`?1^kznqLLO?KLJXF*j7)S-^2cZ(UNyPU zv8&x2=*G$d$}E-XLzF3!h~FM*`d=dwB6W8<-T#Ukv~+(z;Ns$REh>Y| zY3#-{nsUE_tJEbS2Bq)cG{(`rNZjr*q+lcp2{6a_^MwSL(z8B?L|qG!T~7Ea+)Ocsyo@XuL-J)1Z6OGJ3=amJ zDgl#fz*s+gb?5rtSK2;PjDq>(Wey6T}W4zA?KCuW#KQzX*{ZkGq5E15_1sPDGm5?B7%!#S5hZ&02QCae z*{8j)TRik`|E-wyVST4Z8#@2WBFrJE-1C-Id$c!$;|0I$0LKo{3oZOJ3o#Sz@-Ltl z&D4Kt2H^PrH;!Rr{@<04I97IBBln#Ezu-Xc3Jq}-H$k-n40&S?8AMXLnu2^of`ZCC zxciIeQc5XXdb{cCx_HN%s-U>))qtC$r!c3yjm%!&3$WJ(6=8eN|KcbHWfvw+m|wo$ z4vp`JZwHqpoW6Rx&6k$ub}OU!w*0W}7qzl3>&|vNAiKT1us_ci1QEzz$|#)B2?Vr@ z8h3edG;|(wthI2ypH6kYE_dIr*rgkgF+1Egu#=p@g~LuwFt0~6X5=&j*8K(fc1k-AL*jgFY1 zJW3lV==fg_r}#G)BFA^rn_95_zlrEa6-Sy`Xmswk0Zpg74`v07iRbexwR;X^dJ6leA?)bVW&qCT<(on_=7NGO)dr& zf&}VWW~9)&V)rXVUGrk4p-ucbF!F?az6ox*ts9l#4r3bL}msq8EnQl{pvB&Kt1Ev%+LiFwowfCLynikf8+(oVo zKW9I{?%H_c0GbsoZ~Su00hL_weyrR`I*djetZ@=&roYiL(sp+{dzgD>Qiy zwcg#y20)c8nm4$Cnk`UgCpl(y!}HaO_rXz;z?!?nl7;%U#LFJ?PRs6YGjCAr+68sB z35nIEV5gCVE9nlM8pZF=IP~HYnf8rCukLQN>Jl)$sl1s0H|S zi(7HKDCvKwg>L0+C5`p3B-4TL9xdxDx!(k;SI2=2aTsG^b@g;F7IHb8A_f|h-YF< z>}hPSH z*!P*W3?NCQ@7+>W`5|DE4#Lf5??pOFdz8I~uDm4(LNzy_HagW< zo8#=1c=<$wwk4<#L6qq_>}E6mO(MbyN-db|l;~iqkOk6xAZ7;<_+2nwoR(PSOb5v| z>5jUd(NiHs`%7K8vwyCaHJ({oYEE3grDeKtbQWe{c;TKF9!X(;ivK>5OXL>iw>^J} zlwGsT*E(}UA?Jb+8Py{TVl>PhqR|BDv>X^GBXXH`E`QZ}cSDYcC^dY5k)PXy$Y=!5 zFJn2T*gdi_UfgRS#_|Z3 zGAF#M!f3)_WT441_$8w_7=IS^}|Mc-!MAW|u(sgph)s!*&-Ut~j zsVb8-^h?as#bCpqD-@x)t&o8)QXn$(;vK+QJPUQI^ED}CrI7PX`gy`7*;--WE(V%& zDBOT>S~L{yRbX1!JcJldxS-DqsBbCNR^vw5nvtkCx-(XIZ&?4dBZx3CD#GFG`Fzg!i<{_r$vbeL_fZWpyZDVf0x&_=s za`8LxK1r1dwb+GS++RnnuylZ}ClxVVrs}IWOUa$~!`{-tetN4~y9Dh_S!1vq zK1`Ki!NehS@AAl}hq*UE(L$26uu(WnW5CqdJz$PQ za&$b+H6{)hB%j~6GidX5|X`cio{IRN35p8QdpZ)v_CqUr$)H>GorBgU!i@Q}+ zbUh$M38AUlpsBR%kv&0LGtD=1lx36rFB$V#;TWDmeU}3n>`roDc*cjd-mc20Q$ggAOLg`(NuI$uKen$SeaU0GpL3p6U|~o-;mEMeaie>(A&h2 zp)|h^%`5?Z1JpjB#iV1EY?km>-YmXiZtHhp%cynvd@Zlg>(CJ%x;-m`LsA#w^Q<=E z3>x?D<9Pb|A_3}=QoS%q<;>RLi&B1{c@vTha}Oo zJ>zb`!k4vyMT89zoclM%A!vNX;@k%k4$5E2HZq7+LW&xKyTb@NKAMdV+%rTO0Z!#+ zL>e14vf=3Shv9}{a8ItYjA1Eyg#$=ji$l@&e6cU%qIg+kmsTooVr2O3D+g)C8$8aQI`VMKWV0)e^kR|#Y*I_%z~=U zAw)n5?DOA1HcWh#nQ7oO(mvpzt6z-|tX!I5=S!S@edI=V6N^v*z?|gZc>^Dd9f!I*5 z;U<2{=V;-BV4nq*0B3})hss+w0zUWUo@)j)vS45hHz->9&dD!7-W^b?`r^I8V;)EC z0-3WqT>2_4KsUr;$Svjv0awH;)B3P7E}2J}s$MvX>1;sofD`g`|c18*i=Uvx%M zhna7njS_zTC}&Gc$TZY2_My)7jT>6V6qeBBBj>ai1v z8KiRUYfiNx{<{Qd8#Sj&9Q}9iR2&d{AOxMUk)4(IVYniwrq|{Lo4U>w+gL^2XTeNs z**oSYdQ?Usg?|@hdLHsV4YFbXWFADb--ltCDog!J{wyeSlBg=AF@?mFQG)F>9T{F#xis|Yol*f}B0ERKp_0bE zrqn5ZvqjZC(kF2PqS>-Sn-7Ekd7f^RWb|1OTuPoW<+Om)R)XBEm3XaFZ>EQwpb!-V zd`fCoYi_H1rb@mHR#T$|e25mXJy&*&1T@i=#0R9diSF26e44K0u%iUXo^2*B`90{L zJ5+PQH2~+BGYG$J0L~1$8DV-NiLGD1c-;i9lE!l{4X=cD8pr>pY}`cS0=;TF1p?1B z*&{-C2`+H%YR+*%`#o}gXWvKkJMa*wa;9upcEN2f99FT4b7?X7nq!V#%0DB$A3b_7AZWd9Ac{$;u+M(8dbviy z^6&hWdtQsNz?)4q;p_AS46Es37mDuuX3QCJU(9|u0&AV~lGDqrgqzZyi&odABwn5J z4)VKZ{CXB{i;FqfRy4L@Ij!Q89LD z?_`tu;MGv@BV)hoFK(kG92YMZeV;=#%Pyup^^_X7WhCyKUv*BGcFSA6rxEThcf+2R zQ@ixtV* z3WoB+WwcaiZAoTlHMP!k(e_D6;)H2ecr+1A!m2K-dj}hP2CQPn-_VS*QTJfc$;asQ zA0=*>3q;ilDj*|_7v0YhP8WbwuC;EcBz4N@2CNl(x#0@so_6uUMarL8ZGm#(D*!$0!;Iv z_!qCLi=AXfqZb8YUd(wIUO4ea2y;oDrJWcz(NVjDRS_*?N< zo-alcIaQ_fm$vriwBhc6`b)u1rC=!KjV7Dtb+y{9D_Tob8Hby{fr~b)&3=nf%JxnhXkhQ8ErJXZRMML$n zjdaI50D*ubG-x_Bg+~4XMq;}Y`VT>p|H>=;Khcc;56=%H$NwHO>Dbt9iv2fNBp}R} z<6OVCeM`3or5(T`qlA}5fX+1@-bImt#pa$ynlGUxIc9+FwS6VW9e=WJ$xsM7#XvWs9;6$SV0~gJUrhotp*OBx0|cG{X-B; z5lTMX%)iyU8-_SRF#2%kIOBSV#l0)A8!tc0z)G+`xH|Lfn47h?@bJFbS+ai6Gd~XQ zcW{5+X9t5A2{7{63FpRKyFP3y$Yrr*VxNziXl^Xuv}B7jn)JlQiK0=sTnQn?@aZRz z5XtG;bN({t7g=>RYC@{SklkK>xnjwiDmRk{n*#)s?s{VpC!`|e+48sx*~GeO1vqr|hp0^pdYwMw^!N=IyEc(0*^g;a(IzZ~ z976+8(5IT0TZyRj=n`dkX!iA8x&)?tHOPphw2e%nGaN^D zPoEPY6M?>{aEXTs(r+SR=#vFKy$X1d_QM#{i+h1~$z^wmHPAbJ>}^OOw1~dq@=9Tr zLvn0`O6{}y#FDkP*^iylT;s}Sw(6Hl3GN;rG4K2n!n6%HbV;x8NUK^7y0kSVO!sYH z{eu#P)$J{f4V3di#1bse+;6=#XnQs~vd!H;=AoWS09R?Y*?Kave&}CHsjp40=*n#i z58H3<-NEb&@~C`@E3iLc4Qhv;6 zmn_GplcJjh&9QGgIC_R}K9$d@eN*>rc#GJ}CL~K}^Q{r3u+xDGND(ef`6_sEi3Y%{y3H+@`$(wF`b+9|_6WBj7ZMzYWu>yfVrq;)z;(D~rAwBsTNMH1Y=i|`lm7|M%No1IwG7KZ`cP&gM$5umtH zwKnViHcM?gGvtJOcl&*$^$ZWk8hHsS=H!#=jgEjv;IhoZ)3DHD0nh+j8C?8OI{5y=DOlGgL&y~BSL1tbOzNz% z%^X z22OpLdUM7^Ar7#o%o9lh?#UeDB@~Gy4Pcm_rB47>dsq=zsB^gA z^>mx&X01fkOm;5mV<0`bABHa^y0+$$N3|X~b{aUupJtY;2A2Cwp%2x+DZE7ix5EGI z3$>fy;krZwg~Yn|8L$h9BA|E<@{0DHc~6y8bF96LKqOkk8^*$4(#X@jZlVtu)|}UlkmOSjkrZUNV>arm*$p%{ zlrsF%P|rYk+=Zjy9{R^budQaXGlVE$ z!R&~J3+JAb`;4}VW)hb927JZ(p@`R^u*5T#8W9q&*>}r}yr)rS!ZKU~uaI|VVg{0q zXL=wpRm*l$YQ@s)>9Y`d#|rHP#x?4FC~g!izSrmp)Z_YXsXEoG1{9!fEH^PrLjfI@ zsR!Vd{pc-eJ7p?0CNCA@9O>YIdVrRh*9h5(8z6UCKUieW6dabJ#5955P%f5|I42r{ z!;#`~qL5=qe239Lhv-uwC=^uDg0|@vBrK$W5G65sQ!lnq(1X?eHg4|8@a6)gyH%fP z3Xzr~U3xUQMu&#Ulk}IF4SReXvoC;%wEtmQihv=@%z+gLKfCaqs`UJ&Ew!;93BP(@ z+o+#6#*pH}hEs$5pw}zsQHhbEK@}rno)vG+rEi4=hiTdXmW#+aUn2o(#=9lG zBp#HU5AkHfnSv&Dy|rro<$Gb{n=8KCYP{Etf+1(~f_zK(yJ+F(uA;*Q66OxC!|h(O z4v}NQg<=yz*{(|vzDf63$sn_^`iq>2Q>ev=4O5QFX%MvclJwj^$NYDDD6Q+-=2bH>DcIXC|sdq&U=^i3av?A?OBx(gvW-g4rq1t)=x5RIJ18LAW_R_!sq zS*eECSjXN+9MLIPLdOs|oAsLH9VAIx#UZH@NA-yZ~3zUfq>gIKda9< z8}o}~R$0{c_o4lci8wm`>PXjLf|WEDSdAofob9-pRjXT#9(aa%gUn+$^%;=JoMhaK zJMM-%_}_yS>Ibe6{J5d?p)g>^wI#Pv+#>{=C^zT1GSi!~LxngCK0D9|QWdPR?)1jV zAMIr*yiRwH);GI#%fy}BY0i`k^iM2z99;;#WSpFho^(yDRPa=f#d97f3Sq&!NR}hU zJMV9iHr?ygAQmG*m*xanM|nn<#-%%lo0?@GF0o(2o#>Cd##c~XFqIl+Cw$0Fhw9)> z?gQy{#ZvK~wyR1mu^VVht2b7pJx|yAESrf~#$QmNcbl;-Db91d;$_7$^gj@Q-_K1C zi{o{QC zr-*T#^7$J0wFWogS^9m!A6r+yr(k*i~?`EBR`u>FcgK)2+c@EhqI>h7#}M*>9) zw%Ni6jC~ej3w(;LSt=&f%3E;TKd7FGpR0{+B=V(fK%4`e5Yoac znjMgcEZ4!AE-yLFVok8>ZZF@otlerT&vLHoWvZ3m5rAOwN!2P)7!Iy~_4B?NDz|9# z<|?bG&V0JY>>o{soaO%LG&hFzlej&{x%oSoJ_D?t7rk9GL>FN`T;U0++OW+q&*Rjc zpop+9aZRyj%V&V%K8)!72KN5qGH)~Di@Eag9*nYgO0LGZoyixSVFZi{tS#ZBFKk8?2E8FnX;=2U!ZB!Xaua*s;uFl8N{$@Wn-Hqlm zplp8Pc4H$QiB5hptZD4p^ntyrP9I;43$rJMwUHt-IS_1-a$po1pFl2*2gg);)iXC4 zSKUQi>w}=Cj)1Lv;kiL!S#BRjXKPcdb4s(aBh!^ZM!8_Pfoox&uJqi)Dij$V6&V4s zVO!{okI`90O5YAMw?bKmFwvdiZ9$XHXFEi(D@{J>8*T?A#d)$nE2O6L-<#}!>7p?<;?rzV9gxX z*x`|5>((oKIfq;eK+)NR7I4!|@=-Q#yZty9THwwXh)Hl=1C2>W%aj-@MVPO-|dE zdB>44wfVMJfxvGcfY*89#w7t_B<;H%VGBD`qun2Fc6*{4yUFgWP2L8$oq1q6x`jzE z`30gC`9F-kV{>R-pmiDBwr$(CZQCcdZQCcdZQHi(Wr{|YjwT#!XcTxcT!7oIvSTDB$8KISN) zL`!fB8WJZSNZvkpPvaAF7>_+^sm=h9C5TAzazA2v+H5wQa?z_Fm(|hJY_rh+Ih}lZ zI)2=}ZVq2h7InRn>LvgzTOsch)m#6D7hBNj>;A(wbM9#+Lm>S;$=5bD>c?nu-*B$7( zwI?#K50vMI?l7+J`TBl3QvbK|G2Q-kdOqHIH}030yY`EL8eAoqoAB&5yAHXjaOrxS z>rNQ%2-sXO9!DZh$EE+nZ>$HhSwc%r$BzUfT_JAWoBZMU8VY3Z#@pEjfZM;L^tP@G zf5Nq^r_cGT$1v6_GVShpzsDwTd!?*JkEOnR{MmAUnKnmx8>bW8B%}YPxCDjZwpd|t z!H#oOr*mR4VxFr_(Wy2dk=zEq<#9UYs4{CQjy4pifl`^62KGLJ#50}h4q|_#3hQP4 zq~}3vTTrjnU17KeJ(8*=S3jOIPUtLAzcbwOLqsn!&FfN`{W+R!z<=GFG2~NzOta#b z6!OX!=fK59MRDrV+c$ZpiebmYx0Zb=z~4dWJOj@TNY%XDCa5xn?Jx%%``P2#GjQfg)HQYz8$|?@hjE}W|_vkwz2lE5Y5G9%c6qGI$5ArJ>?K>0>jI5V4^}Ofk(WT1r5niU9cw z0Pkyux8GrI=N|EdbkLXve)LDPRhBa4XhtG2r(+e7R>tAsO(*dtpSwfofhC4UD^u!% zW`$^PYPBrJteZ>Y_|JN`ERd-_$^gsDI>G{6eo1^z#FLC#QSKkTbJ z2+em32cpS6h;%m|mO~vBU=~8L&LWU2-|YF#5Xu8z7NIlSA_$#R#D;Hf4MGNv$x#>T z`T1_K&J=z>bvE~Uq1`K}YQ>Z^|H;3mdmcz{l-zjloEifzx&&qE$BS~z?@Ma^C_GO| zh)Va0fl+f5Zm>y?5Jv4&fWLjbhG?Y(GhZg4zw)X5<4Sok0H=72YT6@;V@!E*3e?P# zd;XB&v0-40$+J{X_>)?J?1tFd_Z0SpO|Y^@=Hiw5Z7?ENTWGyn=v@fj%8Uc?yX#=& zkB5kQ=uXR@1?pO<3CkWc2D?Rf6vOuDIDl=?(uLC4aCrbu2xb^pp>HV1}(t# z+D}l4PuuzfXxjd?%>5;zgAkh%&6YB4_wE?zH>e${>F_qk2fxcGgF+=y{X)3b-#yG; zAGi%fW}bn|gsEX<6;5eVbfr0D2>i+N<3xr!XUV@2$;1dKoU(XQaHZ{`*zuu4q~Osg zDX#i548tr1m8r|^eA0oZOD#}y4M-rh;o$eQB3wM;))Aa29pJsLQYMvpJFKb%gBQ$@ z6DL7Z1R4_B6zbG@4X>CwB|ffEkA{17pPKfDSV_P*5ody98JZN?$s5H?BhXV0S97+= zEU(vXm@Vf|zB;^nuPkFgyY1zm5+mn3Jh1&&xVI0?OVYyu3t}*(ee&@D4EBeCp}$=e zkUk050xz&D$<1g~_wZ^rT1yarrOXX^C%77fVpVei|KpPlHFr`3vKQix`BsUaa%dPV zk=Exu6sY>;83>j@80ggrRM6uqs%e)m@xC*qXX<*?Z|W)L0X9F-^0$qV;q!dRl4Tpu zF#sHZ$kGxC#Mv2i!`q3Xsy79~83aSKgMDBeoDjzV#%D0|uIxy6ExVcU|6xg-CDpC{ zn5fNVq{mLlz3$aB*!W1&JdUJmv%(=H+NW3vuU9Qhfe63w$$#TSweKy?McO3Vf{gUv zb6cgOe>C^MF{dG-=VBFl7h%;WsR#nd`zCDd1o2InhE)SCOUTc^foA2BGt7FUCjDlz zH^BOiM0)g0$3Dtdbh?B7XgVNzUf)wgt+wk(g>w>Rx7bBEkxGaj-a7^)t?bzk+Oe37 zEj*kGsh1{;WK8-oD@H=xqkgwm`Woab7r`-vHH9w+_~Eb6t5%3u8qqL*k~LwJOndf? zQ83801W?+&7YZgWx1!PniTlS01D;AVwHlF+XD$g6+d0L%kT^6?gI;Y9GLQw#(;3khlju!BU-W35qWV6D>{y2L zrW}*Whj|i12G-El(^4B|9v6kL<7MNRZ zh7IrpsO$&q6DfQV{_LX9`JUx{UE^ZCTRW$$o(W0A!G_8Ciu`Od0^YEk{7W-7^z5cf zU4jRt>vLq@rQFv4zL6v)s1E)F@7ym;YXYuIY{;EjI^Xv~&DWc1XIypV_8CC~v(4ocRq_WXQ1;U=aSE zjgSyYz2Xll7lt?`6!1f%h9CPP##S)=b`!7;EsyQE=*9OQCHMg(cR}-1uBFL->x5bn zvON~3_8<$FYI`BPGaep%Mn7^sWMZsNKp-`Lg$%IF$%ZM3c|OG^x(goi>RBB9idcj_kSLk#6t?YG+$?U2?|q3OcfL$2c0_|A0CVU)0nU z@5%={J{crURUMvy!S=EWA5sjghx$C_O}*l%;{Ix%L^fXei_DLN%BD~tNd|6<1LxC^ zCAVm^1RGq~Rva4Q82$Omnr9f=&BN5HxuC7OXjwYy5>D=luHm~)y7T{sJ6yX3Zrabr znKP3EKBj@wGo#R-bREbW+bi|Gnx420m*OCnR$jPyokEr4TOj$*ie~{3w>^GAd4FEy z+_Op-%m{+HcJbMuhRMuK`J1qK{o+1v&a>IN{5JzRAc>^$}BrN26^T2Bgvx&8_3r>$TYm= znYocgKRY7C6F3-QI#B_>fsmg;w`15?*aGyPrhEf`QRE>b)^WgdeAfK4>f7oMaRQE9 z5sb1-H%woJ?BYcjVkM||oC`6tJh$P!>kINtnFV1|!%P#IZMwa8aLrhZm6 zdU#0nwmvqm3$DmZbA0>l;V1AQqxAS`Zy>vtClWER`P*(OTk zpoEn`SY$SYk0nYe-M{&MO&e2=qp8oY>*&IrY3lH~{ysa*oIV@Q&&3qnw;#9id9J#O za+T1xaf^+^53`GnS*9-UC2duwzu1kF(p$AtT(~bKRCLwHLHM1x**p(FUSE_D#BcgZ zrF~Jo?9qZmy%N!M>DqEU{`W8YozMFs{8>DHt}jVQn#15(Kx+6@}IZYc?^P~f*x3)X`2&k zwSbq+8ECntpBgH4Se=ys1z$I2E)pWN0y&#__o7+yM;4id!|BpQ9+d&M-Ss9Q8tI?Y z5)H5je%K{o!FXT-i-eE}*x_Aqs%8G@ZYzSCUwUqhRYtI*S=KFV{!8^g*w0=Fx#Zga z$Qxl8_^~A1RIHc(kvBTz?*Y67Z~TY@F;Zov<$OHk8N`fuLqANJWS$V=KieK-qM-K> z57MXXx8C+NZ-?z?d2XM!8`6tRzOL6NPya)2F!nxuTKPVF>pJk?m-7&UGooEGuu?;W zB{pUM`aXJ9kh36X>H`pIze7K7C zL=nVrLXT(}%vdwBut~Fk5XA@P&`1yjh%8%I{>sP!?1XSlPhM<%hU7#j=Z0Aw)g)5jIZ7C4z7MU-Nn7JdgH0#H?>Bl6rsIa_U$BJ~X0 zj{xE0x26uX{P5)*CRTbh94Y0Sx3ULF3Pz=b-Bdmqj{V%ED*4O)4Aiq0P0vqyW<=FY ziwr=dJ6CtI^b=hvGJRL|6Oam*KIQNXje!9`PjnGG*Mv34ROzw0 zh0rgLwFOL)KwZ*wKTK?}1~xiEBarFNn*oxw?UydfSteu3G!+b*+)GSxmN5$an_^N0 zhC+SL0ooO}JBsCmRa4Mnl&IcDf6;sbTBn4T%689%}uy#5h&cDaBSP z+USU}1F-k@wtl);Z{c%h&_%15V%i4u)VR@rPeL?0q%)9DAQqvCh|GeDC@&zq)|XG% z3)hQJI%WLfBfl4E8uD)Zd&->0!}!EqFsu4UrBQ-S2df{66sEm{aEel(NCDBo2!(OdEMOE#o+5W8ahb18b^`m8_Kt@gH8$xL(Bqrd8jz|FZe_ zONWgLM6aKBU#Jk%d!!v=@zYNMKYNV1pwC;;*X57}G(27%-fDUN1qwBsB&(_PNaA2sz4rzMWCPbW0r2FBY zC94~W0x5>Jnt+-FxOIR$Um850T{!YO)P%2h7p+1aXoAb6dHxQIUXV9hBUD7n{`#D= z>#Id_)lyMufUME2cT4`=bt(B>Au}XmPz9Zv>`ZPywsIq}na}3L(ndPY(Wbvk^OFMo z3JSAHi*QW+!h%%G5jdT*TK>JH(pg|SpOf4jJeP#o(x|Ua+0yM4l|&_*S4EA)YJdcdG0IEMVb#xSH{P72T`Xpx4MRk~`q( zz9D-or{-4aNQ`<#h*K-+c2~roXd~>qR?%I>Db5VCf+<@7&b?a89`hdUr3r4;B%I*C zeidoFi;+xULmC_2M*t0}>7tb=d56<@nB|TxztZPl3QRc1WT;t~;`;Z~R zI!PaO+rf;2vLfe)eF=pU3vj@05@zEV85SRNp}AqY0RkWl9YN5cDrQ+o@?_x5O_E3M z%>?)fH-r0!fmP!?6L=%r4`s>2EcQPJYXi4gy#qz;^~6b zB9UD9N0JwbcB5DabAd3R%@^K3Pb|;mB(1HVn;hYhQl?Xy^YCnNu|{BM5e@yEzUkA! z*R+qQq&Y)Yl7P{XwoG$R?r$i?8V(qcblfXxZ-sW7sOMqU9JzqUrC{!Z?gTk>fYjS9Y#j;JHe$xIR)mY(*n(5)PwRA21koT-0DyJ6wg zbk3Eltat?8GuhBx0T(-u!)e3|0(cdhQs zy(C5~PJKi>gr3#FFiovf&1cd^a}J;25o3G7 zL$6$66uWW@wp4xb$W~X!c~kk`qG(d>v*U#y%wRq3QWof()vEb$8X zz$Fgx#=n;0Y+9a;IGzdDRkyzVe9L6-gaC)E9$W*P`^MnOuHk2xzelRc^!>T-t&AjD zlSb3q`1$imj4Umq)Zl;Jw~Ju?bgFf-nTS@D#H8`78M~cLJ9yFT6(zTFh>Nf76>0d> zC{HCViGgdKr;=LKZIoe;TK6z$*U9Hq1g5q$y5LwvVCv{9oGTgKJsfz<|0y~f?_S5) z5yl8`nkXEAG-LZGK7n#x&@kg=5;KDWcO8mPON%U>u^!f7YC@{%#~JB~Q3YpB1IfU> zsWOoUWKM^Sdd8@4KgLb|Y!lP3>V03FqE6~o&BqQNRDC_SuhxLTCCRIv(e*}5DTXhd zMEt?2Xp;cjsSo8uM5iIG4&VVSr8<4rz5DoR=!rDf3~=Ii_Lh%6!Gw<;;WDXXfIF&3 z?O%pbDBND-zDaiVNFK@5uj1tFFG5qZ27tk9DlC3>(n6C@!2X=}_VLGiZ6>L10cbo^>82<<<_{X$dv?8d-~5Kr--OpLoIJ}Ix%gu7NQGLk zF&(H~x=O^W>!A%oDuW5_8hZ`=O@#5)asRa)Bw5Da5Y4@k}*dH{VxuIzd3fu1@`;#}d956E52w$eJ5|@RGm}v*_Cd z|8X$M_12ZznB?lp*f*$;)5Lf1@vGNUO{4GaJyQ**MLr1Ss4Xi#deN)ZI3czZ5_aGu zz74#T+jB9}kU{5P6$iv>kjUN|X;9!l>Pt;Sz;gr>PS<`3OhSJ*LhV(BY>DXz=+}R8 z=fx`Rl(CHe?7`LLNz5kgyF0QVqut7cpn6iaC%*n#a`F*9A>gdUb?@qIf9;vzW?uB) z{&5|uUdRC#hksEtM+sY}Gv2*)W2@htUk{rZSOSX&wnK$JP(uT$8ti$jxG5Rxv`FI! zK()B)I;cXdrC`*q)^c42B?q=80&n|+Vq-zk6uufG&Iq>QRa;DxDyy|>qh|9~D@#Fn zD?QDfU1C{Yan?^c9YiQ>W0a-gsDuV6t~LpUT%0`wa0u~Xh#vaF z!2aylhi85;x2emE7ArN06auO{Xz>x^mD3aB%gDx%ngrRdZ%vMKXL4{~g{EG4ePZFYOB$3ApBKoPh`bW+T)tF ztbBdrxOu0kE*9mg0q3vO%+Ux+YY#QdBZCv+jvQ(IMr3O#F6%StHl)YIZ zZmGqOplBTn)sUpz(_Md1KFbe#p5e0FK>IL18XRLeqa zdxWoKM)z$CoV*X|Oz7)7u>`g!!%2FqO(KI$qZxi^q9l|S`A048sy%MiGE@>VI+aK+ zg&>X0V>~)$^+-bI1ohca|E^K>HC(wl$WeShzQYPV9}wf+veO%Y);c`Bam}BhDxA*3 zA#oon46*IyB1E;^l>@CBjp%VwSuC7BN5C>?BnLf6|viC z_JVLbm>+0w!_o;IMnxcBl>Gg>TQd`otlcEN@+|x5U!Ut`>}iRlDT{TcW{aivjozKm z>FcA629AD|>-U0^>oMz!muJDlRieam!-~En5!FGjWZesmM`asY-OSUEG-H_U1G}P? zn9uF~dlH5wf66BAoRKfO!-JO|>}E8r9nxQEK`iV$Z&nIvsO7qqwM{d0=xJ@$!V83a zO|-Q~0$ga#_yL4Qvk^OVxC!#^!q>h)W+6z7BjLD}Qzh7ItyczeJct8g!Jj~tqlW6+ zohMEC*g>ggJ>xi8aWbo!vD?=vcKZJ1>b*d{Z{$h-jDY)?$SonszGH%};+TAB#>`U!Jbr8sDz2Uu`tAd`GRzJoc5tpI25c ziwEWS6W%&2wfbJW-R*bZ9DGn3{{K}zy8EIU!XxISNzFCSmXGh}dw=$)l-AmDL7Is{uydR}_0Pfy*y@*&!Uop)DsbS`Q%dFG4L-E+VUj(6-rN?W1fa?K>R9=#ozhZuW|cu3O&o+sde(_sfu6!^K}Gz#&_bh zHCKN|-me{N-7QaXC{Z_nPOLORpT6I?fN}cN0RYdJMEK`$_$^%e2mM`Mzb2pZ!sdqi&=cJ)v z>v1P2&H*)=gtz6c2c+OTlS~}2IVBMq<}QAn);%VOu#-lh^Th+6jVGr)c5(*NEG|YH zHxGA>!nZA_)V>tTyN6=(nbrLWTOK;aym_QUp6dYaKzWHgugYj7h*JMNE#CY?b%)pK3#=qSd|cKTpMPF~ z_8~5?0VcxJab6S3#2ZH2!&EaS3@CPiL4xJOuHd?L=64*bRMiNo!hzGfz$Nk!q%>SA z0qpycAJ#g2XhZzpj0k~`kw{~lG1Za5;pk-V8`q zB*7cFRRpcke@PK~wyfzRBR$Gc1gVJh7MZ2 zQ5jy3i3l(Z!SkB?d9!m6L1t;sIOyza#(M+2 z2~2~+P9Ef*9Zr0NU$xL(Dhrx-Epb?OW$XmKdg@~rfo6aroW!*`hexk+)UT~1CX&Uh z&<)PcTXKlr9VjB%4E4m|L+!^h^Lo<(+1f@-M28-3B2%INRIA9?fW!3?T9Gdxn~`#V z4e+GM5dlxsNAI9W-`~IuZx3!uXYdl^$J|{nVDNq*Z(W0e_P8J_gwVvmE_4U%5#z=C z=MS2TMFL2fNHpct2W?22b5)>~2sthR5gcY25n@eqVuvwD>*A?A12Rj}k`fQW8G3j& z^4puJk&<{+OS7&}LWFH{1C~xW#V}B!+%2R_nn4seKw+Gk{>rrRPQ~BbDHfO;_=>K^ z9~>ejXM`{)>+tN(3+oKKfOi^gu26 zilQTyL=FJEl46CU2n;P7COdC;*3^l^8`>O4fHe@?O+}N%&ggOlG;9JG0QXl2R2jv= z1yvaFLiPHD@CNl0O7wiVonL+x8UjA*`P;LVVb^oR?EuzaCJl17%1HoOxpFh|spF8s zPkH*VZUYdqFG=H){Z=F2$6gA5|AY(x#u`JQR@UXpu`JVyfRyjnSf!|^glFyXO}rdE zz6l*VV|XdYKIu}q0rcLW=iPf4!+*~mj~Die5s$hj$C)pGdYpKKaWjo+r1Ru(gKLBi z1)560wxBHQjmX>xl&TBH7uWuf+m?fFG!Sm|3G88E6i)*R92(l3ghaZjeE+x>G~$6! z_L6=z+#Dq$)F%d{-!iI(G8)XQLF*8?XU|eiX#u;dD!4HfH4P0u&V4!5P>j4@GK|BN z%baNBfa2fvfmblMDhh6v&IS!}E}ibb)pW3Mj09ai;T`CRW8sEr=rP4VCM<{ySJYG{ zNC_MA9R)7fHDa31L(wFZ9ib4P$&NCAY{0r^lY>uKDg@aii@ubz$K@65uvx);EP2Iq zgkA9R;Fr5)6$$FNC}vQ1gT>huAATiXM7>zc@}$U^fj4+5AmWHGD)wn6UMswm*hJ18 zD0tXO%0a8~e>o|qA2JQqtqUv=PC4Q5O@a)3SmcL5CEODGA2ishAR2NmWVk$Cn*f$$ z$wR0gzfeBvDusII?Ar5G+#6aJmPEfxWoaybroLSRZxuA8PiA+(l}@*641?3@=S4bn#~|qD0gG!chHp@Yew3MZ*EuJ#Gll=1<5zWKj2hRPf!>#vE0K&L5l`-X|~8s zgfby}mAJ(p1#>GMdS|I(UuNGlv82*$v$E+rn#yo8&1F9%#SytFR=_Hg$v7L#OPo0^ zYlLMeEuSnIF0QIsU;WyzI;qf7>J?(@<4Kn`ryc^qAa8aFw&t`xhl!zKdkqD&PXQE_ zd<0P;9Z{?BrB!Pp)zW|oA*=St$WCbXNXzw5Iw=dIRO)D$rf>4~vPNiFD+Ws7f(z4- zw8&6W8lsJ9M-;SYx`c|vaMy^`LIA}{1u+55)?7qnp`FP#0*h_}LX=@$rcus}oyk_p zFm}OIW34dVN#O*}+peS+V|)b?W>JYvk}u46l?Sj`@Uc6keE!so(wBS39L5J=H%of< ziP0vC?M8b7%dbY^?7gqpzFha9qyw-q)cZfDl`5Vr0_o2Q>_wj%MriXJ23Oq7YM^Xl&YMtno<5u5; zp%I-qg+8RK{O+g;O*6PbNg5fs^qj zMPr{T`)=}$nj#p#ydcE(%AE5gf>4K@JI;YXQDl~aOL;J`IqAqJX;5s)GVAs5>jyQ< z=8>y_qtRL{s~6*N1+Z+F20*}K!x8s(fJdj!PI#=|V*_&xJ^R)onXKi?RRbnls_svN z4Oo}TtfC9BzQ34xORchkqN^+>?{&iw$1K@y#VE+>=@K+a0&aQIL9~fk-8gv{hPwES z)G$PjEfAVCmlQ{R&)t*ziaH3}uzM4CU{pSCau{x_#r&gk7i$BAWhyw!RYgLG8DQ6j zWqFFX+HNe!Ep}%Y9I?o*z42yC$G&O*O%Sj#mRX65_WKSoA)1uvM7h>j{LN@4WrjEe zNCaEVdn8q7RM;6O%0HD!J%cx9HPT>}1BXos2d_h=%-^#o2=9Wg{dOck{0lQFpK;lr z{%nUv^`eB5Rq4*0!Q`82%xzl+KkJ=v_F-Ogp||IC28gy1XRy)*J0BQlb4Mb+B8yDD&v$dQ)PI3#OeM z+oDf5r8F#AaBrV0W*Zhg#o{6AR5=pMJX(q1>8Ou z!!F;f&YFFtzWC_57WcrEmT9t;g1_AI2x+>nsi1_I2}yYPl3=DSq`frWbtR*OZjUem zuO7GTVNLmSR}+330=(l^4nE3HsvYqF*#ziILTkWs^S#5uK2s`YZ*>rZKL zz@Gf;Qm0o4!%P>-PI|18C2_xrl>Snm_Y?tSrGrb-&pmvDciWMF6;vro1)Q3x^g|Ft zvZI9}*?>FotC3dY018~qU!!LxGb6DWn>kp5F1QlGI&hWPIQlw9#yz-lKheF_aD zf!80AU(uX_J#-=G#n?$>L3Fe1y3`q{lTL@DM=ov9ouUHYfdlrYeZo@wM#UDa;v2~H zwXh?dlBAY8$#YV*nmXe(35QHG0$9(B2lE|A0NrA zQ4z1Ze2F?p;NSb7Z98q?^)QAdG4*3SRCwjsjIQnL7HOr%lFbFOq?$qtzsu_U5^7*l z(Vb>QrN6;W@0U+-L}jQa{FCw+8zJAu+KB-OPpnBI;Qy3)TQayD+6e*rC>ZB&`>>2R zO-(Z4TakDxplYL4>SJW81EqD>6-+CMuDw+4D)Hi)`oI_TbwlFZ-V(iyNq9f>IQiN_ z0t4#5M+Pk06i;1I>Iu*G%Oi+i8sWD$`oC;|cMHe3ojrvxi*4;GxXpHoRys7~Bm>LS z4G&!18cKaVV#Cf_olCjeY9wf@tpaNIi@7jM2utij$DI*_1(L~N7RyEE{G^r*HzEU$S!zp?>y?m{^<|8c7vw=;yHr{54#}L5`=LN}JUsGuS zzYOKUax&LnRFeme2xFKXd5PrZ3g49;2kWUgv#TvN91-p*JAC!B;DOAg_&Ya32e@b_ zPnT3{S9!W<;nX<$XxY@Ze)Q&YCwhJ7jYW%TyV#|0gIxK_?h#=2$n48{&8FVTk#^?% zj+>FJoc6Lyko@ zv+YVW=zclH%XbVv4ICSSLRSBufeh$kYCe5wT7 zY(qTaTHBy<&|WsQVs9g`xkA}!)$*8fKPvo);ucqWte9M{&}8hOPtax-xy}`r))iFvHLZ5#gIwI-jX+bHArfY!_uES)-`CZ z_mA);gQ#%TJ3XKhBG>;VrC|PFr4+0TjQ@k0vHV|UXYBsJ$`0C>!a2hHZ)Hc+)Boxy zv8jiw*~d0W&u|XO6j_l3Uy}Uv`+a7Lj#6sFCB%KT4XkeZ-^|R^j2D~uVn;RFa22dx z4^L)`En_F;X@74l-Ad~ZUq@RnZ5$uU>T-oe<@3ea=S{`1wEd)!-pZ~YK29$eq_4*} z4b=Z*%7HEd&HFm+GJ`GeEGn=v(FZd0<*9CqwPupE-qTN)&4RaSzj*vPW3!ToRSX^ zUOnQ)R`xg%JrgBWnBZuay~#~1bPY~38|MbSzzLmH=GX096lsLZNotKiP@E|~R{l5x z*>4_Kc|Ed0o@T(afE;&}hc!06`oQ&B{ObAW;=RN$p*6|+P(y41C+K7WrDSFT;6xBf zM^OGqB;yfr{*V0Nc!IRY(xTva$+7C>-q4KQ{o+eb20|tTG_itp~yj|{T51nS`{gw6zDO!=}<7|{XR{V+OIkU(+G z&d3~p7WluBAX+?-YkoM)?k(Qs-QOMtQKGZrYG?QU9YgA*=N_cVIX;ZKv+(v?{(xG# zzk%K6Ev6ODyJf|Z0YnUi87|@d6~7zq_o?^ly&?DxG-@3JJX5;dSpo!|srp19;vo_W z(o)<)=MF5$xcAwp0VubPVAcm@nsYJIiLNLiW;gdw)N#bm1&%(h5ah3eQ2)u3OHu@6k<;e{8fiI@2te{pPo=^(j7sSzd*WIxLQ~%-hIg;m zP)I<>I*1a5hEHMLD>EhFb#r;C4S;=o@z5hgCRUBuB;lii1W|y|?Hl&zYmW~qp20~m z#$T2P1|67)X0RX%<f0&&Xr@p#D%$6%`NfR zF!c)X#kH#Wb`@!^*ctHt4w?l?BR0D>F8O4{tGN4~swzZJ$u%zdS*YBq>pO#wqjZyU z-ToM;H$OL@UVM;I&cQ`aUOwdqnw|Np?0evC7^TPY{^rOe5=)wTGGfgWqagjcXzCe@ zz+kgPhpwYMAZPN9FX>y&CUJzUT79ZHLbrLjLz!=w31gIzcDFDcH$R#dj2U#W$2)8nV+7f)D=YTFDd{U`)!q5mX7l$2?qRTs~SUvP!r zCXmFlI)-;BScv(Mn|lP61odW7PMoP%me!QoSBqjhzX{jq+YyY_#22(YM(Ol0rUOe4oS-X4 zjQbl}_gGHX4R({A_EHwLmvb6mI&E9BAX52*-@6`!e&83 zL23XleN2z;fZjZYoa2el13?4BI&a8wtTTgaQit?oq1uL_a<{`{xzQ{IA6-I`9-z!G zK2c6{MD2C^hhG&>#;1QWLL*Z8=W!hPh&0+iA=6Ogm0)1BMk*&o(StK>uw`dLoRUMQ zChl(SwUOFLmQ~{Y;ePygP6783ZU}IUm_|Urs#?~OXkvK)4M`ecd`lg%mR3h5%~_b4 z#wpZ#O78qhlmKe)uKoxjae0;UNd&WTQkV(Oz@ioKT_yn1(u zys`uOYB(ord46Pas2?ZB&Ud^*svpDi_jRwD-wX@WAjmT@6Y#%knAd#jN z$l&KgLx4-21=zRd9Cv#ExRHcPt#^@@+P_Z-f5WPEz;@-04s8X&RIU~~WSgFiT?x(a zs5E^_nXKqTM>1AYiKX;XX8KmQ!*4Z`4E9BXHUX=sUP-FDa7Z68NdLpE%q9$!xb(hx ziac=o>wRbMKSOw2D~L@l^<%JrHS^RN*BCYxF$qJ<0KEpj$9!K2YD6g$oclXh zHBkX}FjhyD;g}7p0JyH^OOBlY*x65)&Mw|gbLjw%rT8m^6HAF2zmoTaA)97ja=M?y zjv~6^#*WWH(jpI!#*9lB>$TbnE(gACL6_l1&T*odep{p;7C=sgCIcFOVgg^lDAzKu zTY&~d2Um2;v=Sb8Ni`i;kpB*CDnS(!Y>f&TEKb82Wydju)2+3eY{Fo$4^+a1aQuT= z`Q-2EjGPvnMA&K(M=uA)asfbkZ~zmJd&YrHJD(4*AErqA-cdScGDRZx=i5&x3C-V! zqaJen_f#M4vGfO`{bR7Gj&xH6>}NpCg9}tdWnw-O^lVE4lLA4FnP6tU zSNpoed&J0PJ~E}Q@Xrxp7}6Um=J}*R1zhJE~4Y1gR!l|40C3} zp&`Kc>7J-BOI{hSkzWkgdr>C^teCGL!V8GrV4^Y!-kxhiG3zV|2SHE87&r#>>sWU8pX5-74XP$H1M0?@H`Jk?7_6ORlTU$C`)cq7>5&7Aj>*i#{II@lPPsV zVA~ZQk_n9>IXnJ$6r=BeJQ}F#(%!Jw_Fpmq8$Rt_g%_?}ca#b}SbRaCMD19`1N8J% z@nTOag`h=D%K9bpbDhk8vHHm^qEh%ABPBCVT;MJ->x ze!yl#9k|%pDj*W+#rC|Hx`RBdMMIhHD76&yYR8pjRS{S5NBO8u>hwgl$o(99DX|u% zZ8cC@^Ji9TQfE9Qgn^Jx!54sp9 ze16eM4}?67&I9%3qd+s5%Tcp8R!|$x_2I~o!xs3CD=){Pgzc=(UCy&RkkFc*1Ub<- zM?@g+2wtU@>DR;2aHjU?_d{W8n-JOJFKlt*SKCIlI$oD6( zzAK~m4X<%c_S4_bH4>4mkZ2Oz%{37z(TFrerx76+Z_j|?_?;uUr@}AXIRtJ4WE+NK zIRg$C?mKb8JQEL$R9JM;-M&9W8PE{96no~YRp=9_+QS%~IIs=#3fE8o$aO}{S<|z@ z+ktuTlRDHDi}hAcmNNnuO55C5V_}!=TZ_gx?0!@|pb-!b_kby%XY?SFsQJ*Lt{g$L z74ml=#b5YOUItF|zmWwn0o{Gb_!U$Pqb}fUbDG*E#xhRWW=tQ`s&Xdk|8wZ&;tS)w ztax7Zxom(iHVayiuWYI_8a7|-kU+9wY+5j`M)LDFlZ9XKKbdi%*S%y)SlfCwDUO$v zO0D+bk;-Fj9SfzEpwD{-3Cy4hq`W@$MUS8$Zye<)wzAbG-iM`b)G9K067sa^3|EF$ z!L#9CrnJYCtL-2Cw}=@+q_HV!gPoyuJ4q+=qB3@>X)_ucW@D0S%vtNv=GzG#(8E*9sa}{*_b#kDtm9|EC)`deQU57IPLz3Bpq1dsDB2-eOASz|d6w-N-692i!SG1}w z-@@ME22OV0$!|-B(vI%b&QuVCJTGg+^0Z_PPHFc={POR!pz6-2y?hHGv8J;{(nV))m5e(Zxl5ZFI*#qkmbF9n!9_S9kHwR^KK-Ot5fS! zp;|oit56!B%IXQ#>#K+!<+%g#8|6dmWa@YUG@zx*Uk~^|X%!<+K-)~DX>UK2zK5V&jxPg6GSuPD$zZV^@?WDMG(zn756DJWs#~m;?()d0)GP;9n5j<}?gzQl zLLp;rz>G%d8w|2h=dr_Ur#X!cV?srLH~yXU2DITg-Ap8*QPN0P40Fu=&f_M(_ zxGIHZamrySG`c)VsM?gPcxbtb*~IF1U_P%`fRXz%g4b2J^TrRtEa@#Rp$x131@6aj z*XnY&JI?!u3zVU`T6@4tO;S%D>9FC-*Nz7_mczUEX)j(4Y84?6GWNoF%r0|Cwyz!DuC;@rk@ zI5&hM6*TYqv4f)s&B0ZZZ-nc{a&fmMDNWRxm*J{)B^4gb#}8<;bJNDxsjY~Jl7Jrc z#A$c;%3){SlxVDL>$!{ktn8Jmn%+t|bj$YKGh_XQzOMU>pC8pY@dahU(w87y!$0y6#!n@y{|gD7%p z$+{i;6!IcSbQ^a=kGWZ=aqH$sCA6CMb+lruxMOPoMKz@ci4UhQ*x(IZ7R7%Y2$T#_ z05RJYnNGX(W2$B*p=S38a#B&p9G8g$prb(#pi+9T8Cw|dvI;3Hx_C*@Y{YFhu zxSj)ErbN-ElF(4zuxH~g@=!ng5Fil+^gAoMJx|(VP^%&Mix15)ktTcH_itqY-w8n4 z$eeCF%l`<*xFBz)coG?l7Nhinqy1TLejwvtm$>kMl_8x%i1S4g(tIphgQ85F?ANfY zFSk=MUY?~lJ}%jJz14p<3_aDF5Wh?xY@whBC2@}Ug`~!C%A6r|{QWmBds|m6kto=V zNRZBYubA>6CWaia#4zvq!brXjHt~l28NUq=6DX_(%>{s(0f0Wd?@bWvzT{aFTt`zQ zVll)nzh{D~glVqTqrx_`!o!AT&sp_TWmo}D2<)&(@|fY8kz$>0ULF#OtKz^tf~b-O z32o+lC!sOi5ZxlHfmzDL@GH;jKjF-%+WSGrBc`9TB<-~~>2^}}?s6f_U!E%?Nxnx& ziu)X4YuX&}P!rO6|Lh@2Gf4I?vL}zTEEJP#BVD@Tj(?rbdTw5oRbIL_#Vm#EyK?E_ zJ7Ot48ZKN!VK$m2>Bx>LSbmEtS8&FiC3M^gqcp0yeAr&NiqJ1_XcP!rmJS|41t%U0 z4L;`o zt-+`0r0?ivYeXkyW^F;IU}WI<51)yJgO-s4pOt}$mWc_UnT?s2o*kc+k&Tv}Q460= zP?4LPP8I)Gu16<|&rB!qTPgkL0s;n(W;WJzigd~f;{VymO&uL=9XRReOw1fjo%Cr9 zY^>;v98Hbvjhw7#Y-}CPtjrv&=>ES0eM=jCIwNK_J$-gI7DfhrV@3mG4th3bb_OFB zLqlUGqu;w?WoFi6V$f${q_fpCu+TFxa-cJ?v39iAGjMdE(Kj-*w=uAwbFep{bFwyb zHnMlnv!oNUw{dU~wz1MPvz9h;a4@nqF|wz1u(2ePVqjpS!2f*+MMrxl14lVMdn0Q{ ze0H|~5U-4^4gX8B$iT+(zrCsd-awd%iT=ONb8xgb(zAkrbj_Ul4`GWP@f#QaN1)d` z4i<(eK3^MF#Lsg6>Z#UaLsD}y#My3kJe;Vv&LMu@+V|s*jj7O*4Ap@*gSnbtAtHZh z&zAjRl1XWrZoRvWrh?b?8-?mnR>iiop#y=*XO40 zjLwOpYQyEmAFqZsz$Ytvkb2n1E&C21Rw*wPSs>e1B{a86R`&a@MAy#!{^0QO@RJPJ zc6y&Ubu&9#_lA8}000hNJQjr_;z8FQ?u&P`RCl?rAOJ(_Zc)>lo#zcvCV$6&Oh;CB zdw}T2+kIaUcqsmaaCX$V^O-@SzZx#Tfw;4*Vg!{oBXpwH$DS5KHIt-FI==VKHGfns z9mj?{4OQwl1TUcjvyr+V&gu=mXitk64p|^FH1;;Lh!v$L$|$+hfyaWL78TD<87Yo2 zX=C^UxV-B(7i))`Ga)aso_-i^vkTkITggJEJ{4uzE$09fHlOg*PYkkHT5(#it^_?= zGv>~_P1nqR5a!02yQTdPUSG`Fe^SG}0$zGFLHpjOgxY#X-zSbnD)4!K+B7HqYqc}I zy2Ca@WQ)|AyK)ooYBono*-bV%_o14i%KSZ4f)b^!iBfFwQ=nVXQ7CEEj3XoM2>eqa zd|4P0+;AHk>Xt16oDE&QfM74^R~tysPD+cqhBzH)q(RNsbux2sB8Y%NE`QLjz=P~B zX<$S6YjnXfj}(IO0J>?%A^UxT01$SmKWRTW_s3?7E`G!3Z91}28esd2+6rx!ZcD!r z2r0E_Ztcylf4-6JcpbBsbO*nNDu+h&=|0#A0_48teN zI{h_!E2DLW>izX!XpgmOtu)fv0)UM@>___LsvBiW!w$tDekVU#`#9+Op{S7UBU3$?EZr_Gb}eksW4H0nJBht_FXC<38)NR>BVhezt)Dfu=feP|soa4tt*R%NOW~VsF-a z#M8@wn?y=p_$5X%C8IUpVJZkkG1=HmKu(ZQ!jvFqTJMp5uIT-PLx||5cYQ_ zpcuVJzks7P@5+1#`aqj+P@t9#5iTEJ<}zF(mX1VM9a{!3s(&01wW}856ku3Ttv1F* z(o8Ml!ao)U;R<=#jYuksWc+ff*`k!~S~Aj_5dcQsR+y>mhn@i8-QerRV(^v_f^5f$ zx4a7U`n(o$Ch$~k-Y>?uX@_g;sCmd)nE0i=Ju+&2br)z26XG9Bi?lKr^NN0X;p9m8p1csh zf?@@}tZ>Lyqhd!c2+2o2qX55x3n$?|n-^;g6@q zVPT2G&DCiM=mv_E7~(bz4y2yQI}#!Zk{tlL^9wPWWNr*!JjOeQpzVq}u-tBsbE*3tGN~hnI#UN|_kdaaCZK%AO=tICGylQ6#J={s zuOUyqi2A(gGwL(>;qVK;o4veCHnFwi#t8^XT|hV%S~1M5l_20U1;yO~iYc-`%%DNk z(i9!ZWdNoX(nIps+g((9tk0YgApA2@nhwpR?BAG9L+H4`vxs6O)^2t6z1M#zMxS6Z z{UfzEXF6J3pLbx4OlmHnkZ#0IepN^uDDvo4fFhU3UuHMsBZ#L-7A7VacrTw-uU5+Gwlb{y!L!smS6Q236+3H z_Z_(2%^C}ifk*d73Fv)L_tBL-%=-B|m<#|-KnvJ$Y{iv#u4{7H9yc=~@@SqF%ut#~ z!MaVKkZaq0ER&pV!Zo7^XgpXcpCa-d3)J5^w7C{lNNJWCyAGO4Mfk%>_8Obx+7&CT zktNQ3{LrFpJyNxk+>t_fJXy-0ySyP-q*tPSphZTE;LdE9nYu^c*aJ3c!L?~goQz*hCxk~ z7txbVeQ|D)$5J+}-Zc<^dpuu*FgkSC+>Q$L%XS=2r%;^>qR3h*2NF0`I+y%9rf&I6j+dU1IOiMq*@VAXPMdWsd#k`98x!XU{I zb{3$=`tc}j6n}nox0qV-+D&&E=eTah8+LZp!dS2%HLC^u+}T0Qk>i7*AwA8<{MR=M z1x>Tav(|G>#K2AsHg$q}c-f*#Zgs^T_r=#2|1Y345X>?Aiqj{v#(Z`tPqXCg-Gbh6 z@_CgS4FONorX^#z@O&?3Mjc-;ZVLyBwlkvJEZB{uYorN^{t$Pzl=AWBgrd zQiIN2=>Z-IL#Dw1xO49TrAS&iXoD&Iz(x=Q{1H)DYkyra6IX=fRc_8-1{5J@b^?!z&7&!h<*B2}c*+bELF2tWch3-|dVmrQ1&Z^ka zYtpp^k+HhNYoU0!;cEb$;IyzSzuTLd^7bo+$SDE?A{7mTmxA{8^7eLZ2Y2n|A;u~5 zlYx+hhjy6;tSqjcY;Ei2o*Zpn%crxMGp9P43;hP(ulA1ex-+n><92Q?hwiV(xwnVc zQ4`+ph=WkBZX{xWg#IuTlQ3HeFVDxE9*&EH0vo!R7@3{}*po@s>7)BsaIp_q7sNmK ziAW>_4+baqsKZ`AEVk8Df37qa(BQ64UPi=v+Ecb~rjPidV|ao7BXN=T6YO0yKsGh% z&~AH3{I?X{B6qEtbtUmi%}u-Yu4gah+M5O$LjRkwD@%+3RnYQJHW(to)3j>>3q}d` z`o*aIN$_Pjp+;EXF*nzBvY!Ca=hmojx_Fxf9PMEzwn8G1Iy7YY1LLp9o+ps(HBBK^ z*XYw-kZgfFW0az;sP`Z+{XH;R(O6U zfMw)a8`&AMDzxR%`0F9n*@T*gX4u<(O-2sfs-eYIVgBN~Q%$MJ=s){|HzAya`kvgZ zH4S92b#d`ws<-D(FJf?<0Be{Aa~vT+&Mg%7C6A~CrD{jVudCIpaI3ZzdzV#F3w7$8 zrFj;$(R8(Myfk$jHM1(;os`vmSbNvXb(GwW65fFH%=lBb>yRbzz7=5g)n&2?vOwY4 z-Od=i7dYr*kJ5hx$o4!$RtAa(P28(Wiu8A(7>CL9&2!w7m@2&RZZQg;mpWa8*>)qZr5+_s@Oz* zH1GN+P!6)`wQ8dZn;UYi)oK!3H|49dc=hi@Az;ypFkx*or#1;JNaZFoZ{I|go!f`Z zWmj$|rMqb|AMnK;3-=X+&gSIuV&%15xcXi`KAH#04N-Fxs+QSZj87>n?mG#P=N)G5 zwj6-;OUtL9!rbk+lULZ975;@;mHuO|nwHfM&)HGSl68R%YlM!ja_Sg0;$%gJ)oROm zMFmKM5ZpcR5eaA<2vH4w!U~*g>y#(qR<3I59keKAp(On1rBmtK1TfBvZ5eP_4x+IX z$v;0!hn(54;mc=Rv5(DEOBw0S(3l#*q`*J|%MK(6ew}zAzGIbE@9yixi5oIyefKS< z|F0~txjdSt{AZ$ir2rlVYXOKIqb)67tY;TC1Ug=SP{%6UVaV+a{Phi zLPhGv$7ynW#}E5X5Gg9(yQp!xf0{5Y4qYM`{7Fx`(KNbI!O)Rv8o|=IFJXG8@N+kI z7I6p}V07tmXSqZBLU6W4XA1M9z0cN+e&kAwT!-!_k437k<-LhOj(6;-aVl(a6wU^4 zzFp|2h{jChM{0G#uvh0GpfdC|en`X!iUrg)wxS_ip~RA}9S*Hx1uQWGJeXN-*w-#X zIQFe#228B+U!DKY(A=pfK$Ck137fOS%KPAOhqUVYE2-^+)u_d`I#{NC&VseDFoVX5 z;#`yLfCy8?Hoo3B`4ZMlWGb|JEHrx;c4YR^bb2Mm+7LmP>f+hI3HzXwa~>8yfq(mx z#C4=M?XIYRscku_7F+&iUh25q^{!=1HZ*h4Rm_*>{3R?wS{l2~!}a_g5~`>L zRHuFFO<&tUjRz}MLQKF{9X;XYZ zKVI*X?t^E?XJV%y`5BYM?VB+O3`xFlp035Hzg<*b5p#;O0qFEyXYAg~B*udm8uEUV zzj6C@Q?psC%RRZ!szXnhd=GTmv+gwSHTqH6^KVW_n~TKzE%=r_Z9Q&Gh6o&rpFv9J zM?0EfWuo=_zIMD4^~HasdC1hiQm4q(zo0M~+O{_HzL&h>fiN9$_x1oH-k>1nCi2q; zHYkzN)3E~9kO8g<*d)gS?cT08E9Xq74veEjO>o&Rw&X&7>(x>9-~H+2e@4N!Dp`t< zq{nS7m_nM0bJ5(@UYiGf8DWcvjq6-SCl@<&FNsn+Smnj_^ngP!+Y+{fGuGG=Ob;6e zV<`<8(<0fr%-!E zo&bEFjm1MW}>4|0Afe`C9#>406Xwk!7es>Uz2f1ZPuDiHFHgV)YvSZbk~?qVuS&X~Ir*)pJM@ z4DlvtpTj!Mg~ZmF86EX$YP(I?o%ARgYokH3=O*Da5 zUSL%oNgA%7Sbj_44g?p7astwgDo0)7bc(86VA4>QI4asvU4ge_-Fo@$cNr%LX!Wc5 z`zT<iH6w8y7dN?f zbQ_s0Ewc(*N)xOrq(l(}5@D{mu^Rj(m)OBpX;-Myd*A)DPppIGTGr7mLY9%;I>G7& zH%vT?@RTgfP*hj76D0)qrIZP!6#DFx-k4rwK4dAqL-Hxcn=9rwEiRoG!TbTlYaqE* z;!ML9RPOIGA!t`tZWo#X6bJ$ajN)-3vkf(-?)vu$Dr+x!)}4038sfI0m2L6v=hwdA7Wo$B73T^_WEAGVo^>s0T+QUw4@Ey<^wSb!WEFs4#pwG+@+*9}U_CgHTKAl}CMdQHoF*WO zLcj-$QZ}^1*eG8$z8BMjaQf9!-vnYH?|^~g$dXFeN|AbusOtmg5>|OKnt=1a0{Sff zB!Vf02Hpt;EnPKLz1sv(I;yF1(wu3GP00c|TPYQE2|;^FHx|jK0vU~%DaSpw=*5vG zNiJ{|D7?QaUI9RM4(_JEt@Ln%ay>~)L6xQAb=vae5B~hI!IO0UZy*fY{|Le`bNpWr zM$5|KfHnS`SNQ?2wF57@9diMg|JI03Jn2BHzM*Mta$Uws%c!|nH$1*Ij+{<>&CdJF ziH%>P89YXk&@;QdZU_w^O0+;H+q$>J#OdF((zd&fmy`Q)Go=o);!Vmz#nV)eOwF}T z_(F`iwn{n8%F@}&BU(%88|3!TL1A!nJ zusXb7BN!*V6Uk!^UybkCryk{sJ-WEOBc^*5^g{MJMoQL?mM{o+2ZWXLUjdTQ@${pW z2fRZdm(q+svX+E;tIUUkCt&fv0g?>sbVmZ%UAz8xEj@N_0G$3^h4)x3e6A}VKL>3m zS=!sBkTe%DCwSct{R=&1=GSi`PWKN-hx88=+{0iTqy_j4MBwNr+UT~mX?pncixnqA zE_9I;DBnXQmB9y==eSytVf@%K%VVpH#J$A>V{PbZ*szo0I&dzoh_wS{ak_N|KhVHt zPFmA!7t%t}3Q>HJw}~2Ztyt~l+)8aN=4}+c&$A-xZVsQ)blFoE*G%6!DEKMLA4rYd z87M68AghueV?WFoDL{nc;&9mG{$lC+rcVtBDnE*pO#M4L3VK3;cMRZAIl0iwxUGL; zC^815Q0Wg6WE8?7p!CM|y7lVGA}=;f=r>+>M=|go8<`Lc!=k$HqF{gwh^oGpM7YGi zU~G%3>DSq-eK-s+1Hl!HFYs2OFD!)OU@8R)^Q4=49OI3?F_Q_WBLdCDd)0aaJUnlL zm&CO}B0=|C_NP)-V zqi+Kq)#MT|;NJ)@fE|?G1tA~s>h?|r?(H&x)z4RD#e%JMCnVR%AE=COs3`ZEIuk<( z?e_!2&992~%kB&~di{I@rrp0m9-sU0b%&^beY&)M;o5vVc$&Z*QzNkYW3z{3&bi}U z*9cRMs2$77$4!kxg7l>BOXI$m+c8maqX;CfnL>`72ta1nC7s+n;_D4g_WVoapw4LR zAoVO{Kr>(4C8;8IsMxAzpoKLKg`A(ueGy7=Vi>w}-FmVVg)Tj7+Gn#5##Bfb zb!PNwUXDgSa9nGkzB|DI6fvNs{2D)7U+A^nT;Nyekb105j*e}Y@-|roa6rG<| zafAqxEBZEs#gaDBNlv!aPfZn{G73UX8h00N}St8ESqqvH+v;)xyJxE_@1*%}O53Gaqq+CR0 z%g+FM4?w*0G@GjG{`3KeMDm5u9mT7m;|>jUQ-6|m_dx$)?>iq~!t!fxHj15S0NMjj z9UZ>O(89pI*rjsQoS}W2MUS|!oyF3!_}|3)^60owgoB#0A6EfY1OGM5SLP&9Ti+2f zamfNN*=~D2ajYt;OL&OLRsqkkZTE!eoCgV)H>)|ccMj)E0PC`{xOyC+Ts);?CQnJWXa{~; z9qnd!39%ORGU!z4>S{6sj9;rSQysHS_)RT^Hz#^;Ii%pjW!?w?q1ZIrh@+uQzJWFzLTdX|{aE#2F_;W`^`dhZ5S8wAzOMDh9dNCA$$ZRAae;3Ko0Zpr^Z>Cg4+`;<$}0#M5vs* zwIi^2C{-Z=`M)_qIEB2CLt!cDrtO?ioqf0Ss*(g-u3yP3!Cj597BT)RMh6;n2H7sdtZ{;kQY8rJlMDddkAwR(KCU#D!y$w|A+y4h zH)hpY;7kkv+mLdW6IVs->_6URWv|kF1E`|AZ#pyl^^(<5b(7g4h!k<*T=Mm&fL6?{6;xIRhLU`69WznqeE#u)KOk=BYHs)fw;}nY6ML z3h0D+ioMl8OaPcloZ8Kk3O6GMkY=z&j07AHJ1cD&$pa@VPf7^Q|E#~iRtU9Vj`kNn z!j37W$l*krB;hmc8t3q)P&kWgbE|rVfw$lQxuG$+T4&bnkbwREH@|m!09sO(=Ibhv z#8fuIQG1!|$*xlsfk;GWSkpy0;})~Ki5>*b&K$Gag8H01J)^sG-)@;VTAF%gSqsAj z+l7Ahw9FktzpOb3t*H(oe*Y%NxIrAvDo1x|_*5QPxMSJP&bQ83>EF}i`T?xuDk1Eo ziOw!(G9~*7Hxfnv6skYAX&3pRZ{Pe*QyJ~VN(TxQ%n*lkMY0IL-ZV#jaWzzUcCv9* zXjZFbnB>$Zo|e}=F=T5aj2^wg(4qDCII*~Z7Ppjon_^>VD)_T~19g33X2ah1JxL!x zxjA|NHFR{CG1R;Ct#}@l=7+nJXM^9Hb10FpZhXI2yz+MPFS#bWB!+4WIzCtObWgu6 zSoU$chD5>uubdD2Z27OFH0>7gVe4N&ib^3O-=`leogwDGnX9IsIo@F}L+=3#w!ia- zcfl{yA^chGZfrb|F<0oi*~Q7?XBb2rae4kJf{aXfICvjG;>`}fbcS8Gjt)&K1%@^P z)wnbjw0$;lz_$kVm}~5LBHa667{ZkB&VprS9$KgO%#f5w3=2Pe{FV0gl3+Ipjm3@J zXL&=!wIl^bBu0||&P~3_NxU0b+bq~1TXwF!y4es*Y=rqeR!WsxR)4d?lx{o|VOgbl zsD1+<2?8-be71>XYi_J+$NKNh35iDGmj4>oq)WMGigWk~NoL&YSY4B=Oyu^oplq{w z5be@*im@rshP0MrQbTa9*cm(6&_JswlG(x58_=L#u77LFdcyVx4qjsPTuYPOX@3rM zUH$C5PEEZggxw@V_`5zk(ESR{5e7=8Nh9mcUYe?kw3%j{0R)a?np!xq2DuaNx&wyZ zrpej1Kqf^3{$%9dbvb6L)24Z`i*$lGpw%^v zEfGcO{DpraF$RH?0~5nP!nyQlA4fUN!Ot{o4B#(pJSY6y(f~S8uz2DtiWsaWGf12EX@)vW8HGH9&r=F( zt^4=G(CtpQDtkvKZx(ON&ECLK!L4MAMKQz#%0p-xNX7e8olJoazUT=^;Es5r0^tu}%F;nm(dU_I_JcsV?7C!5CyBJ{WPWLmn@&=k!8l6T=)4I6T1tc(-e z5-yzL4K3RCsUuTjpFv%aq4m#fmz$-74siqys^q*@+X+G7Yw9oQj$6(hUEpODKuXF+ zN@-yOXD+}T@b*3+uBl)i37FK}iZzbjJgrja6T~e#krQp+)tV9MI4b5TXKokE29-DP zj;HMS?NsIg1Mg2e&l~0l{ueba%fC?7b5ItJZse5PMaOQ1>R@q(mo*ZAd6={9r*(0o zY*D;QA^vu|dI9A2UEL3)jE|}kk`1#XL{;u3HBJgGXiQYHK$P*{v#P8}lVx(-_sx?K zhKz2+szx)ea;C;4x3F!k^b}x*>pNyLavYw*-*JcMUxNL8xZ~vUg`2@)4)T_=Cn)Og zL@2e(VAj5nSxJtl($Yg`UvpGqHsNmidimY!JL%Q*X0ta(B!<$1-Jp}2h7ltEZgx-% ziFIjJacG=XcHN?_7V3wNhmqR(*8c9rRU`CTu$5p1lx7=+tF7FS`P%}5qr_I8Un zLH0Zh^rqhx-hLXyH5-NTn8I=~)fuk(%8(qpK{90hURx}#$BoEf6r*NDC^%>d9p$m& zw~q&V*L90*(awzNG}a~bPw-!PN_Oo!)8)9zW!4ttjm|?A?Wr_Rb8J^K6_88>jNbTI zZ#7Z8GyvOjJe<*Jj?37ts;31aoGA}7eD1!ZBkNBJPFCPu1-M$`NG3uihw-Z=K&Yh~ z5p__iM}vJ?)KM!^^VUm7>9Q+Bf_tG(qE1%kt)<6qY;Uu>6l%o|_tK|R#lOGakr<$a zjj?_l{5eOk9MzL~2OuyCEhBN-S-B%g>Q`E7z~Q)3so7jt`wmZ)<1J zy&?RESg!3l%K(m2}Y)7z!WYC@?mr)eC*_WEyE$;jF0U|jdHMu^CAYu z`ZR3Iyj*z-Hh}QQ$2)pmWB8|}x4KkR9vtdrC9iB{pfAlJGr7GqtcrEE82d?@`<<|Xn?@Kh=Kbgmrgn2FY&&~`hVIxWScLas(z8ACdGj6%&xQP>-E#5r?VATc164iepG; z<%=Qgshqf^$u7a4rx>Wo-v=l)2Mq`ZAt|BYHnI0GApZGmSUEaXS@1iy9+#%8@AetY zi%yE) zaZd+s7oFojRJ4&(LQGCK@6M-e#O4?+(j~F6EC{4l5ibGEI26|ji2@Ejdmfz&G!l(F zEim{vgap-JjOGRF)|v$v2x~j}gFL}5D3Xle^ba|9vpuyUi~|G%Wd-pO1*U@QXnu(B z$kj9;Bf>I%|I( zP2gjZ%DF;`G$-6{^I-l3;ph}EfRqe)d$unXfZg%~DBUF9nrRpz9)#R8qEnY(JHYDa5T1_1_ z=YmgeFG}*qoaeHx!7A6_RKkOvo?o=J;5MmDDOuy~tP2i^DI*d@3iQP<*?bn~)?a8Cx9|bX0UV{1Y&^@&&aY6i@d}A$00DjgA1wXj~JF)bW zjw*$(OoGhse&z2ym<2YEEC=uRdS*Rkh}F^`n3`fm3e=LEK>sGrulKQjbTQIEbZjq1jR%iV3nZfj-V|2->fB3v^d(HowRv!ER ztd+;i%KHDe-TZ%9+}gSSVR5s6%#!DClLJJ6%rm#F2(_P)n88IjBb3%-LtU(Lh+DUO zT-an2P)yXN!C+IQfV9^UOJKu>44B};y16Q`95GK|os8hY#iWx?m<$cRIl8uWeqG(( ze^}YQ@^;XosVmZ=g`ic?!B~GajFO5xEyzw^u#HUn=ycy|!u^nhAxEDGn;n97Cj|CO zdzDaXcfZc;WDQNA)zIm5vww!z2HJMbwqYj zd1CUmtCilcHRwy-?D}`>XvZw2KvnaiCp9h929(qsl8-vgoRG(}9Y()uOq7$Zw(I&8 zU$bNPYt2giY3Y=7n)W+^oWC&oHgoL6?iDJjZgj#-R7pWn(D9R*8z=Dst-KCS@)tb% z_1Ji!)jR}%TPwWi!Ha}g!0L1MS~mtX!qpj*2`^Vzmv3IA#vsFfEo^Gi+Ul=#^fOmx zqxVuS{rBBGIzh3f!8~pk0?kAeQ0Nj~?!8pjjF})_;S$c5>+R{Soo}ek`f%fl97EcA z{M$==_6R^wpvL5(lyl({_T2I+XIo-7AebmR(^fX$BE~IN9%iH047q^lhYRajLSm8J zON5E?2@z%b1T)mg$AFbC+T5-uy+y?UiR&hvPPy4UrJyQOR|a{@Hry(9cM?h|v}^G} z%L%m3T*q`2^Xu4bMqjn^$h#Q%06%`gSK9^mNl~)fZwpHf@65e%t(Ij-JpmQpS6b<~ z&c2wXM$gibyWyi1-H4YA?S*+pyU4XMBQ7)Zv77cl9U(g+o)P2fb{zVi2am~u_T0q+ zCFk(2wua1wxM#c_Iy6dt$k(a!5+Gu5XVrKd8&+uRVdn^7x`zi5B2&=Q+B9V5Mw1?! zF~48&^l7hD(iQH3lG61_WbtMrX+z^4tKREsgXazQX=gk4-oSp}HlRKMkYPe!&KR)^ ze06}c!G)z(LvNj9ZRE_B*FkKD!|*{)ofDx134mf*;VTa)&;nLP)Dvt5e*{f-4pcu3 zh3{J$dd0`h+TDH|X>mM2cXqQE>6xC9kp=w&b@;bPx*1@UK4yQWR|W3{ifH`Xg8&?f zE&Nv$#*&kj4H%V;jkMc6xXQ=XL)d^We5bc75KX4&i5^rfW%<<9niwLKSSjGKv!yFa z1`@E%%E?2wDj(ogJ*uvHnxrrUie78)I4B=*zj3}J-A6FQ1#J=Cy|iPYSbXj?315%u zR|NrN%L<-Z^>p?p@=hrId^gZtQADyeNxB4F5P2`xrVg_$A_6OWcQFIzLkO-@)VN=a zG8&#+i2YT0D)cJlL=Bz19-{jP2UGQ>$Ch1P&c`f6qRAnMm^X-L$nfjVx|T!E77b|@ z;;6X;phn2`qS*+&@rDCF9+@48?J$9%T+OLCL<~FqRde{We4eO66r|p@AiF?Bl&db$T{ba{RGe*`_b(4T7@lsEYc$s7c$rWUngNV>ek443s5yR0 zfMEEB#7m*(em?j^Sw^gsUAn}DainMfob!B4gB(`@9lOarBX0UAebsJk_|W>Y zLBf%vKxbyBrsn9$X5dDdzUTS+#EsGZ zDZiKd@C0h_k}gBi&1zaxBBiG=^W|iBp55QpoalUy`9yq%cfjjX@B4e9-%0T&c26G_%< z!q?x4x|E2W1)!^LmZVW-hF@G|57F`j-sm5fzs~o8P01gbrQH8Rc}GNAMuURumFt(A z%wD}a#@Fcs6zf#hDRRRbcgv`mSae4!JtoFefcLlAujbawCI1tPj zSOX1gKS}NH`}h=u?WNXByiz-c1|d7px)7iCrh6%e9$ei+qZM*hUaUSn8Xvd?8c&%N zhgZTM-L6}VQRlncE>R`uLHR@=i}@^$vifcrok`9Ruob`QI^WT9hCP-O=vh^S%lOguXrUz^><7~Kh!1z{zRxFkev(m|vO!As+L4n1r^;@+@z8E&s>;eY~-zFBO$M`ehsZa zkk9#D%V)xPW}7eKqOY7=!;&^0saRcFb!5`f^C}by4B^AXGz4U#22E_cMj4fvK&qa& zefPXEA2FOfJ1~kFwt)daHeHZa1a#JAm-vS&m3!jk;PiCLm^8OVOwS3h1D8ZEe%sG% zy}CaFnvlUm^SK@?5WAr4`!pc+0w{mMFEqFJHl;O>BOF)$R&PwHX|uh6q;M^K-u4pn z-c^g`1iNSJB{HqknLb|<7`^Zc-TP~W#T>GDm?#1?SE4YonA%G@G=XkaLlZ=h8CJ)A zoqj<3y}azj%LP4Z^@F0ygQ-!*Bf!ONJ*8Pyew9p17IyPi3OPTI0Fbhlarc}68yLslqJ|uB|2s( zm;Tus_v^X)djhUsf-rUlo4$26p}Rtw#YRc;YCTVEku4mxzNpw9T9gjr+@MGfe}=8~ z8O`O4HsWGx&dTnjr&Tz$Q6Z^Z9!Vza>tP62o+CZyeQ6=E@*X`+QV-7fr&ns;1Jjy*Blfhn zBo=>jTc%T6yxjHFtmGsy-1wCGe^K_%agub)x^UaJZQHhO+n%;HZQHgnZQHiZX`9nu zzx&|s_ndRTv+u9|sLH6!dMYATtjvsz6%RJYI3JYx9AU@1{H|o5l2)(}j(f;V59F+jBC`Y%@u`uvSarhf@V(u`Q|9qiSTN0z%%<>fHy$zI;AE)HjXV# z4Lwj1FAqDK+h4Kf_*bl-^#wIoqGKh^FdKwnhX(oH6I7-`yAEz-HeWL} zuQtH~#7%8n>_@4ms&siPd=CxNVhZ!o23H{q4f2d%_BUL!Q5~)qqBFe%R4tiI59I`ICCV z(TgDkP6#jE?^h!FGbB>!JQ*ig+wtK2zPp^AQ8`cvbV5shzORVi6a~1=$R3Qef5MC~ z!jWJSK!`>#t^syu5ukyp9H0GMxzry???m_jyu*VGBHUKTn2?tE!uXev{ZSO@Rj(ba z%BY{zEs7heeBuDQ=;A+U?0F=?p>P^3lPw^)CczDw7FV{2F$xmZ%z(+=$cNfie_*Ev zWEw{l;fJKkH#tXq< z-TMV?SdMxHFJ6@7m#ZU40e5hVI_F!;ahkVEI7}Z?uB9CGc+HFdh_#Oa(0wh_aXrn^ zvPKLzOJ%Ryk*h*Qc1V~*n1I?&I=bh{v2YcwmPi|eco|N%(bfgj&BrGu%DpRqohZ@V zIMEouiK9E8>zT&6GKod?svO^9z>H%UNQ@`j`%+tIQaOkC?#%ObQN0xq_j%4$S&8lOJh480IE#o-KBIAbYX@3bej2tY{D|YT z0nD$wnq=jf)EllWOqoI^weZ2Hkih7Y1@tQ$y;8H=H7vwtp+UCrC)j-m;77IEX^KQUs@u$NRq2o%Ug-+sWnWDpvb(GRKUIAVlsC5umMhxzv)_ zYo}$+1bcB$)Kh&{mj$t7cilvcnC}p10TEu@#Y-QZP2t=A^g-d`&A7Ndq$=2Tu}1&< z!VGCm9r;TDLJvMzfJBaEacHN_7stEyy;8Cj=NVF*^@fOCCS=`9T$j7CJHN+>>Cx5? zX@kxe;*+D`P_mdaOqU$@;|iIgj#cu~evqVS=2$+))}91LwnSXBXYfbCE+nd+y_e^E zpiQv5)In(rZ~F?D*ZpRL+_ZfIso667jGw1r8+mQxQGY|^(S!a;qT@oTJ>-mJ;kF#K z4|&Rt06ww?T^Ct#k70twW5M-BRL`A9z0L0`s;?{=Vs2~lh1rs^ZKAHSiDP8vBF?g% zcY;U~M1hrdv#e^!m%Sedtb2q7x^UL?B-887jMhcLpdTZ*OW@25!AaphpJAG9(MS zB0s{`F=Nlvn6r9+1Om5PXsTgi)-~s8%DBms1|Sz7nE4FoHA}k>yRQXk z>L}t282^^n3#a&HE(#ZVlEPA0BYg_?sWtm0kB;#Uq}JM6av-F2$bJ*wK$<=3pswh* zfm0%Fs9%R2B1aI?+XE8Z(j!Ck4ijd^FRZphG{*TZkY-L&WUrrlCJ+7=Ooj(!O7JN$ z9U>9BF5Jy%?T!HaPAq0WMErx(kRQ#Qu>@nPp})&Ez>#c3cne{klO%G3+P99*(w+Am zuV?9=TIqGB>XP+M^9$XT2}|*!DRXBGQYqaWz<$f*nWbWd<&Y#q4e}kOmuIO38FAG^ zI)_}^;nwXl96iD#m>kO{uO#dK)WmoFmVUCg?v$t43EEpZu zZQvd?)ZwO0Gen&MRn>S)5Is-G)Rz@8-&WVm){K?JSagbLhBYxOT7O_DiAP&Xuxca0 zw5BrvB0)`Y_I`WW4rmW0;d<#ylU}ZT3A(pG7XBpo&?ZFw?Wgajh}IpBmG@Hs-Ly=a z(BZ{UVzh&RE+T9+16h8?a7ZUIR@d>Th~GWoPbT51>-?{J!_U(C8#m^DFAV>|I>1wK zvuU7*mX;RC*_!^qoSS(<9Zm;>i0V=E^1Rw15VBAZ57Hmv)T)$LuItLU~cS#?ADZ%05RYF&F#mLUCOaD9zlE`I*3(4X4CiNrj=w*6jht+wVLT%F0^`lq&tShy7wW z^0D0BO2gSEdQCGr6>1JPrsE8;PTeiivo(dykE*ajy2;XQsaGvgdVMIXj;W35v8R?V zG60(kq`-p~&ui!8DKo6peh{C4YBZ0cYNpN4=cQ6+UNUNFZ@ah-gL?w_tM@T4A z6)%dFMLc7C6DWReV_=h0@40OI;ZoWqIM;*ThYbZaek34qN7WU9dBYjqGsD9deo z6Hn7&mB5#V)X<`g ziq|-6*ZG^qKK7O9q_iTX%7vtw6;mxzIphu&w0we;RZvO)g*Zv5tL%CJdPvMNH zVx#unYp7pEPuz5$>x$S9i%5mx2jyin7e0Or6jE>W~O95KQn@)M9_Md zyx!;-r>d>yE|G!6qxo`tu5oS{S((=4yt4r#yAL2;yBk&yvjuI<&D6_f2^J&Pv~ati zla=suuq5a!?+8qIwnBci$T|JoE<+RX5H0JF#J65Xtm%lXb_xC|W&dMNtRy?LoG=_j{8{k{ zwfeibl7%hxd_M(!)9>?%97;@RqXCv`Up>u`$S%t7(wz8f6g-0aWHSzu%WXhqIZko) zqqw?v9JER*6Atj@x#FvCVs;@M0=o=L2VWe{GeF_B!^d;EALyVYdVc_QovSh7+7QMp z&;zShitWycL>cz|$2{>#_YAycE5f@Jc)L$#%NA zfopFbjF_TZ+Cs=ySp&QIAVcFYMxhswZy??_ykh6G6fk+^psLOSSX!oF8?j9 zS_iI`?DEgGO&lY*fOlkU@FuC!V_1@|ZWbWuW)5o08ob8vo0jWNB!mH&m}le&iL(Z0 z<@-<+1BJ!_e)(J^?J1SxgKLzq6to^<(j~(YFstccSzMDskj8Ie?M5V8aT=9v0a_zU z+s&+N#VrO(j14+9+=qV}4hQG0jP77DV9+s-fin=-;uhEYxD8FR3>Ge|%Hq{GeHF!0 zn1Bqc$E)VfM0#d7^Qxi833e)?ghol*W@?*&4kS?oQ>qnRUMMK#2@y>&nyNc^88 zEH;#zP7t{^<$DnRx|31J_Xg;XRM7ZW6+tv6EKq-d|tYI z6j>q^^EOozpg9#RUA6eHqQU1=5p+bGm{Yitt31Ux?}5YFDW3KpB@Ax(Yb>BZ)%#Wu z-ccmM4k~zEU*a21QmORFm4R>5=~p#nh{y8EZ37>nVqBs#s9cke@OY2=v)VS>RC-wg zGA>ep*Uwq3n2G9oNE|XLQlFE|yS?+EEM7!ZUi@fNz0dhEB>M-9705J?e>|j)J}%Ik z%lPD{aNRSbYY2MFi-cNCgG-2d%L6boxklF%FInE1TQx{U<7afs5UW~mrw}T3L~(9G zP%Dchcm{up=qxL7(J@ua9h$($CW;2FWQ}}0zILdR8(R6A%SpIS&Gm)?y56Tqt{dR{ zorb!-fE}$h@R5Uq(C24xrTTevHLIf0X+*r&*lAh2FQL`rK1$IY?z7+6QI;hFUsPGk zD-~dgX+lIt!xVS?+CIj?ng{Kf*j@&cAh{)2VDoZfifz>sc?ig>Ez{G*T-9$yn0nyvGL1m9?H0+RM*i?|2&THIt7#WFVUqd>%| z`-n_>QL}sgZ+E@gj)bG!<}Qjo$fNA7dqsnp^tEzNgw%3oDKo=xmAmMbiSQ27j#hYU zFgECE{A$jU76)|ta~WE&I2%EBQ#FhU*qp>#B^bY}lIEnng7&)nV2`W9PHka{tQZ#w z*z@o9Cz+UWp$xNaTTvis@Jov?7Vn0!x5tXA!;&Dljc(*tcSjMc!{an<46spEs0n+l zXE6o^9yU93VGRj}PQ!7U*aan7aj&#WLlsSN_Ygk)(Cq=n3#DQmR`46Rg?_d^{;KGo zx=t9`g*|N`(y#BC)@g8MW$!)TYYqx0GSC4jmgZ(|pm;LI5&=ctWllq^l^{yGdNxh- z-3sA#Gtr;=fOd*A=evmlS1dHlAoPg$Fv#6~Shq+Z^$Pc1+V>D*ZY`XZ$LmJc0gYX1 zu;sktPLn2vLi!rImh#N@wId$3-IFprlxsqft}HmDUAwg<-^NT|YW&_sk$#CpftRPR z?f=9pODfzmnXpkDT|&xmyOYj(@vmQ$9Rnu!`BkK?Y=vWABv~@wT}>eAbMyFs5*Dxz z@TzCS=EXd&597hQW|7v;=^h{3g(x;4C{g+}sg2ug(P^&E4^Iu`BD>f%-MBYZCW>=W z@1aG{gewwGPe^>p4S3Gh{REi!x) z5Sg1LLrNgRs!**tc3KW<#1>Hn%}$XxmfmAGSo-?)W#>e@-EvKNl%>z4W$>ROqtWnY ztWBD9w@IlBicl6}Cn2)&fo^o8$k_loi;m=YS|$BX+*wUwrKE|7J+-D6QATm!ybiOn zC!|)&CoNn7YlB$&KInF^^`LzN$F{{xm2>FSAN)p(_32EM0Fm)1#h{*wWFD~bI$YsT z-sGq8r^QkR4R4?kYpLyh3e&OI>lMglDmqjJUtJp0kzPyG%!{W4yQ*W>ps&uIYgkU* zni4)!Ht$nVqPvgrhuVHaT$-^#w$+SHoZ|x58Q8K;>GP$l8_G@K`px$9d*MWCMY~JD9jQ?Mc`mPHUgYCCi`B>*dBEcIWbE>_BFht5#ns-eeSI&X)Ozy#u~2H z>MKpyl(1H4#y+}sF&;CyWHWS;vKzmb6@=U?sEm18|?F z@e>M(JO8Tr=oP;e8K2nTjpxakbSxjYGEF-4v?J6nAnW`cXzh0%p#>5awD%)47|0-m(gb;OZVC{Wke`y;y4eD z7M}+N68pY6^93ZCBn9w4Cu2Am{-tCLBO?RH-)m{QG`8$F*bw~KcfSGz^hXU#L~ezV z5I`gn*)HpxbuSFzZSgVEn}2dPkk47)?>xsS=~UI%86;bwjn=vVfee?*;P|*IW?0iBg#)R z1qul{+nNqJfwJ#Dc+rmM?VemITAbeeK=DBffzZ8b)P@m{&_xDhY%fqGo`s!fdh`PC zw5BwJ2D>$bW+0Ja>)_G-Az*ryoax<^#}icj4<8;ZVc_xk4iU&SZja{(iY<>JvS?|| z>e7t{6Jfa@h7M9bsCtP!5)(%ciF})+{D^!;mh{|+eY2CnQLx^M>jaE0<7*HR3Al&? z(Lu?~pn1K_((A02u*2<3u%2r89@p=KXFM4%X}#WB17t~3Y0D^R#!ehEZcCO*mSd0F zZA3B#Lrx#UG_a4kh<qq1MNLW>(l=GV} z`~*f>ZC*4yth)Dxh7kSpCXSJn=Mwb*0)chPWBzwpe+_gN_%fRez!4w)>y3rjFhdHD z@~tqfI8NIUK%AWXTq*wRPz3q$?5sjdwK${}+YS6XPLl6r^wkkq;xTtBo~(2k9^c&49MKX|M2^?kGC*`anK2on#KuEk9q3RCcrAu)`8Z4txfD4%b& z&uq>kB2?^R{tb@VmO)n^N@q{~ZWI0WCc68L#n;5{v4U_qgF>u|AV~+1ljFhRR7?s8Q^}cu=1|hW{Qm!ZemkEmT zUz(s;SULY|%T}BXyA83YE&uQN315oVCgaBeCCC$q2;QaT8dB?)}J1RSUN^e5Yo$BME$j|8=8cz&I(iV6~46XuiW%CqC!*vhke zW7kJQkI@y$Wcy|HmW_8P`%h+RGtJwB*lBrtJ#N43+}E7guL25_nCmhPk3jBt6TQi7 zB5wZoOZ@4#kBic?*R`dYNyEweV&?4J+&zmOLpd1y-Fe7^-g{#6_CUvLyX1R?{?csl zcB6ncZ#Unk4({xaJsCevelO_UkLTAl1Of{At3Uzf%-4uZk#^G~8Mx zl`U+oqf6#-K}}h@-F!!B+y+O|^ZnQteGjCoj$Sjs=ha(-Ys6CMJsW^vzZhvz z6T)lr47%1Afv8zX6lGRwuc#lrnBXUnH!Hh8uCJnR%Y(gsKwI6ioSXyD4F{9Qfd6)~ zun-bhsNdyCWoQFnlM}SD0}F`)W*6OoD*$<3yq#sZ*#~+~wXUmKNc3qH-c@mca;OZ* zheUbB83}AmHzjZtE~J3sbq(C)g@ciU(IVi%%L3wUnJV>m!ff}aE4PPHr$nTh2jhaCBN(11#w6~(IpsMoOO>drsoq>E*=OZ_Vzyj z;jvwA>>MYL8mJ8*OdL-n58GCE*EKS+p9Oc1xdl6FbpSOy73~8w=%H<3#XOd#+q4Q` z8JdJnypl~R80h&~DjHw-MzYu;x0m}LV_B+r5S!t$*wQ2VKDpwbiJ!%>Jp7Cd!Gy^Vg$T_>xnp@y)A3t>O)Pv zXQ^dF7Vr+zdzwkzy6%sgz2}VXiT5ED4y}c~f6BaM6~U0OFnq@D3~#|p9yPn^L2SPK#hF?dRCt8MQpBJxX68ZwEs8vEKz-qY1`n+ zLWBb7%8=-9ULXiZDTYI40WCFvCA{=KU?#Tm7*GVBoZorLYm#&>Pgq!Nq=M7DVe9ArZe;_w6@Injr` z?_v@fB1_RL`P>&nI&u^M%5dfF5mNx2t+e-5R4XZiQBxuF?cd#eFZNzS6;A0@6*61&vQFtV|XqbX*74{K))h zbgqnsD90z=(zec4vTa9!%JFc$hx*NYT@9BUXa%VSU0_8$)f)UKFi?vGL)C=2-As&> z@*d15@GP>;;{cawbt-rjQ3~w)96N^5&|<*Q0@XgjGE2NkEzUBpBA|TO zRO9LZUyCr%R(S^xEsiGmz~Q*~)eP+KO9>|CdykOgs&W3k0aIg=Eh0&6EsX0)>wB%Z zz5-0ivV`SQY$q*D3S5!~e85#3-uxpE$%?+l zBDueMBbWa9Ghd#T`-bAeM8%-8;A1Wmz!W9&1`=yJYf zta(vE^zsz%yOOKwWvv`_*M_1S0tT?8KLp>z&ZI~Gfb8q<@APk>D{GB!9n;zRIm z$y zG#^5JFM31pBC{#g$bz_@s%GfDTbvnA1J?+-KsG zNA#We^bKfF>kj79;9v~2Enl2Ro(hlZi&N2l?lr)9-LQ*M9F`{ppQnXFBHxvfUD+AA z+a6>kKPK5qsqq(AGWjvwrX*IGKbkA;-+%T7-mXhC2y(m$nOObKVi~;rm7to27 z5>Ls0Q?zxx?q^?+9v?Dk3a_?yO27DL(GU!42(n#)xrRL~)tlRY=@ zaQP-AD2OO_zdPA-#?drOy~aPwR84Pjwy>qY?OlXLGX`P10f8BwcQ$&r(qSh^oj)>q z-VBVQI5)u-xl^}X(aZ6;SbM? znfkD+8zZ?Ux8V9_3e$n`Nsj_2n>Y@Nt$IT!`xq@k2 z^fjh(1)6yLF%Qbd_76)Y&h=(RkQ|zN0f2ch_z*Yk;3&qoGtC=yls`+YKm90$F3h-q z>I??|sEier4zjQ0da`I7Je1-=PD4MG`Z9+V{8=o_--D}=sj4#y_S96@kcU@;Cxj)o zk>kc%T&OY-H>Mz<`#!Ua-X$d-`C_!I!|||uf$+d?`HTU_=Jp!8BwBT+!$wn*8nzz@ zVz*YtRlbnOpsr_vcmIhlkr1#=D$+K@VEfo{wmNacm~eVkqN`j=nGCt!{Wpm z{$8jiqEX0&m38Uq00OGg#En(3&=4598@y?Jd%IhuHY)f0io|=5{LF$6KrUD-F5bbS ze^eK8;5kne)3qC^i=^u>N(_t^VgcdFrYLQOJwd=#K(SHeAbsOSv>_l(T%VU?F#2LL zAbbuvTiqeMJoj*Az&?m8noaoA^d4s?zev()$4b4xe)n>uggswUG^gLBqSR2Ro-eC& z1k6n1(T`F0`NY0V`K|>p(qKz&5l*Aq& zcU3MKFT$|Z#(?3l!5I#xWKBwMyF=ZzFx^OF+{;pCTwzvb+q!(Qs|0|%zH$K*<9Zi0 zy-d%Mg&i!;9bivmanqcKFzcbezauoFz?L*b3~;uS-r6=N2_M_W8k{T|h=wuVc9mFbN4dF6`(;Kj zOR=YSW&EtL!$=~$7~?IUfW1v_UroHqVtbDEkJ7=K0MIUnIhe}G7WX#u$(xkz>DgbB z_;wWiitV)%Pi%X*aVxZ1xCLo;LEt?MvSok-Q{f2@;d5L7o^fn=@!qdTz&Ih9F(bY! zl*Ef4lR(>ZkM<%zM)*LQCPBwFB2u)bWOXt9$dBnYf(jatY`D03D@&t|tJO2bUh}pQ zEh=6DHh17apS9ptCo6mqoZdbaNKDEUe3HyqFsXHA^v|X?9`mgu9eMZkV~IKay@j-!7Oz62b=0<%kl%!CnN|A*}KEd znQ#@4C55%GP}p$O86&b9tmd@DV*SP?%^l?~bk&7Wl11jfg0|vxYEA^ZGHWB`lmvOP zUhi7iVpH{U;dtA9#8n?oah>BXK!H~Me8fvFA(5+x9=uQv65c`sVSj)(bfx+wedV=b z^=moB6WITH0P9dlKDEcM-mN+4_?Jh7bkk5strO7JZ~$SEGYm%fL) ziT0cOsO+;d2^|-R9-D@A@3rZ$nE7EaD%J$4Zqs__GOOGM=Ud%c!JlRqS5Uak+k6(< zsI|C?B@*r9Mj7N%S55JKYBWXRQ9dI(y{@lqhcUYueN`52`_7CNJ$ka?jS|;dCGsvC zSBX(Ioy}eMpWCHZgDu)@dxlK8=Iv*AwS{I2O)AxTlYu1)Q+WD9s>|NT1pL+Y`pfH0 zRp$(SIc|i9SAh5ofBY^lK`wiJXqm>{; z*XHu3L->La7J<0&vN}PK!S=9*E}yk|)XY!SNGWe;hwVWPbza?9XXkbaqLW8Fd!ghh)2;}-3Z^GDnuHVzo44kwoXVFlGjx+BQj`4x&qwL+&8{Qv#T0(N7SH2F z9da3pk;6(;tVi3P4Hz2$1IsA1UG4}y#vw{6+W#_k@7DjnWRRHtr3?}?6BFm(Q`}S7 zy7pNTcUuWx!1H_{a+osgTd-LL@i-^OZZ30IYkZf&o$zUA>4JF1_`4=2zMrb9>@ZIP zY7O9Bop*Rr&m&kpIsf%82+s znpg8Ngfj9Y{G)lbIXK)8Bn^LPa;YTz!RaH~$#-|cY*kQcZfYw=(@gx>SiX+b?cC|3 z+7a<B*Ime#3S4`#P3Uaiq}fScwDw0=XNfeEZUx~uj>7Aa z#8LIRiA(f~LHM;<-&AYZ@BGmSQ`d7+$5TJB;4Uu#1lqe5#E^X;1JZrHJnY~RIK6vi zAhrIm@cSoR8LyjfV9#XcPrFl5JAZf^Zw{4@f<>BwUU{$?pFo%k_waY*dlHk%GL3wl`8}$nC4g6?1^^a(Q$3*BR~tvyOT`C zF&Sc@T|V$%>Ur-{v5xGzy@@p!4qbBAv5cu1IM3mm+9oYtv5+0|T0}J1FO5GHxsgS^ z+t0eK32G)jus~1%vs)BYYdbQlScNRKPfBz3RLhcVy}|`jw3LWfsGKo(lf*XK)V`m}0-xnt@4Wb`Mfq@t0jcJ>x8br)^UIL8r znflF&m+cAR^UFINn;CL3^}y=4wr8f@I==qc#HxG(Aq$V77k+JBxCbbW|0yYmOrt)5 zcg@q&d-Z4>k7{s{4PHv|@b4nEk0gt7_JB$mN4T_e2~MfDFJU>Fv;O$T;`M599mACI z`M?xHyCe~m*$$BjG;lN%%RQqWp&9yAG#U+NAT+#ezWu?IJp?VYgX>fWeKO&9)`DuL z&}r!2nSdgMhjo+unO6h^_a#pc_47vViLcR*kmuS>YJ2CbQGa6ihrokLpj^ijruQfi zRzzhAfq`8B zC$-z#0pKu6p$5yuoPsF{flSy`x7EmYMy7qWpeisx?nq#EQc{U=@g1UTRMzrE3Rgh) zIR<2!>MtRIJ1E1N`~GuzZZ*@>^CU5i3D;YjQb;@+GAkvNL|qY*_dyn1q+gwY#Gt{D zEqyHTMqH#7#KZzNI2C8Sz97#F$xOvoYvNOJTZq`P#523nHM~V=^ong0?Rf zNI=EtEXY^Chz60|!`zVKa72i8o9kW1k?h}dCd1SeT>*TfE~fewAf<^22C1ac+t(sf zf~{M*HMkyLi>6e|dShR^<;Pdw{Ye2o!0s_aUA@ujPPcUW4lpxE>-23kmp9C)AXm$_<6_;gda~9W!0sIt;3X!!IUQA3b2HXVTFkWnIoTJ7Q;lyQ3B1@k%mYq;2oDGUM$2gEc9!>$I zqC+bEQp}2n%y>u8<{QCYT(rz{K=QjaK=ssRRt#R_0|`=#L_X{?D-#Ezy-@I7iX97v zstC_UTugbxJa0z;T3Ru%P)8X$UThrLr>zQ+gQWg0Xd89oLYa_m4uIi!N$7j93xG@Y z(#HVFY@fJ&fa)oH(X`O|ha*6$>ly*AiaRJ&{c2e{7}%eVeJJ@{gD)R&+In&qCc*vi z1t%PsRz|%BB2ONNC}mN>UUG(K7x^@qvovqj<|xzKqWZ~GV{Cxy6wW;{wHNxnMH%gntkq*Scb+nfT)(XPOgE8o`2J zU@3n!*uaPERX?@5+1~cak_)mfB@ZTrZB4wgw&j1ehc@pDv&HLg^a`K;$^$~_qwuy6 zhoA;cPEWHzb#<*Ruz}VtvIz>43C3`#V%dw_K0~*DP%;H2m#d_pfkp4MtR09+Q%a$s zmF@ho=XE(tdNlk?*S_pUSZ<04>TubY#x~V<3IW#>@C0pBc1pfG7~jwe2H-xn4&+Zh z1Pm$hk{KrH-h&Xm-hwnNC-Boik?uYvZBKC8j5D*Kq*YkI7XZ3)Qm<5! zH1NBs!C-+5(4@qy>MoeTfn+j#UJaF!d|Cr2j%G{z^|^p8u@|y9)B+qZf-)fnRo3Q! zHx)qqfy)wd5{*In(}b?d0Ld=N*ryGGlsZB>b)0amAt$|^DE+KYx1f)q6CAf8*g9JA z1FhQ9#pxF16~ltS8XZ;W`@Sd%CXBKnpD6k?Fq%lAfTT4Mq<2=HQzW%B1bEB`?y)^f z^((ay#_LAaVAy*=I_cLkJceVB|MOh4WUJ$qSuxlxg7O||SrQ6Ybt|b-MV*i!JDFI{ z9K$23s;~OTLeU0>lwPH;L43wTK5N7-tCE-jX7!$}7$)BfWz-q#SsOJ{?V5tuq&_QY6$m*5L;j$rf`6wK!>UKsnV%x0a>%@MFhqZ2kb|-XrcN~^n1gr|>A~As^Q3kbU;@Yq)XH)oCANi`o zWrE<9cC?oABs;q>s^TEH`&sYSd0FK~$xFg1o00p0K(o)s=K0t|goX<6Ese^s=;7_3 zClmLPw>`x|`W#Xr{+K! zS{t-O%T>VXIZ~G3A3%e2?eh>4TU!{1qYvwTl2xslf{Qw6n-aSlPbSV)+Lo8{_{3$@tGTQvVAi<6q?pe~0{s=--uO;^3fT zB4FY8i+lG!5ZO6c{;QIV|GFcY82_6i|4sBCh@4DxY@7tF3`}&a|7O>3CD}Py=vY|) zW>?04rg-|_l>EyF|3%6Fbj!D0nHcGq*}fqe=-3(mQ%g2RI?lf%{_{G({{@lhFBkkB z@gJi9P?G6;)DWwkCTKSckI$jLy!_H9HC4ub#u^v_Vt z{||w|{NDrP-$ehR947-E<9A>%Gky=9?{Db-iV{}Fzr+3Owq*XtaQ>Su|4sDoaEy$M zbgbV9-*4>SLzSKBd!&4CG0}1UEf5)5+5VYK`7g?70(yBPD`jU}0(vha(xYbPx3Y zi$AWHFDe?agelNb7Y6I5`10z~QM(Ri5=e}H)G4~!Qv17PQt-X>3E4bllBcvN;jTpM z`a+mnQx($$1b)nbp)94@GIJM;az1!-@gn0C8(r5{2OCSh;FCD|x!PA(=s=i}h>h>K zO2o>$9+8w?X(+5fq%PMg@kdm2rEQ|LcG8V(jiO&gJ!N%EZUWM9>2XPGo{+U=gnc%W zYIs?~Ml^*P9!d>@IQwS**5%~$;r0+a-69e&XnUL zCFfn;%C?kx8S4?BC`n~<;j1d>&Pno8D({j_$cdH(-$hKQdzDC^W5gyU^w#LjEBm2Zz+vc(OG6#>iPjtZK+P z!ixGVv&p$XN~i|r*5diI#xhrt1@CrIzA4WkTk;n05GlKq97ZP*+5TJoCJy-E8C_> zRBZGJ8;@I_RO%9@Tu5#YMMh7amzU$3Ozuz$iE58n53;PTfPs`#FDj{3VUseIP>KBI zmQ3~i4~x+DE5}Bw70Cv?6|@o+vlPh+%g}~+v?|uC<)$c>f?w17(Jr}<&==*BsKh8^ zN;uJBekeXGNvYFvF)y`f1#@KUQ&e#4rYNbdP)9V^)U#4y7ym|TVqyihzg8_&$!-4- zn-XwDew0g95tZ^NO!%x|N{CRV!cdJ?!lYb>Sp?FN;*wJ#mNI>pGo{F9R^^l`M-!D1 zQ^ZDP#9T5nK$KQ3_Efx9miiP}RLu^7d#A%HRwFvDTq_7nt2G-KS-x;$=f7XVStJ_t zX3c~Rf3;%6M!H|hk^w)i_h- z^pj@eX82N7cU?KXvqi- zf3KJ+RDxSNmuqmAdHu3l=x+kneregOa9;cX$`Mhd$H`YsMMAmg*|M z@v5=1lAW59Pql`OWH!!bh{UWnVv_8%6|GV4zm|=p(ap67v?qJk4Z8EJ700V2KUZ3^ z|4e3XOe4{9{gPBvY*C`hgjG$9w*}i;Rt@}iZ3b^BL`0C{9 z8}#PtBc&UULrbOyYPH{m#q=AEkHvqU^yzp0xcImhFUID|?bHs*=(ydh!}4L@u=8h9 zbo{NI zyTX@$8;R|y%CV)hk(;4Wdx*-xEF)0G{#ZtXJs$rv^tSbSb}(gck0mW>6zzwwalD0J z@n!lb;^B&=Fmnm^jAi*YR;}mv*|}W1U8^2TN5`g~YR^(N_-9IAtyX?VuSQO7rX`a; z*F{fWPECHrkDFh+$McUyk8c-mSL=t(=5+UycRRYRl-nY`*SUUPKk%=V41v!{iW@vF zXy5c@A$xvV3HK+V%+>v~n?WzeUCi6T*0fuiPi8~!J9i_U{?=ee$OEK9v#1G-)LY-- zcgzpyZEE*g17A=ls28+u_&=z>%iVhd{XoAWo~=KRn^D&NY8W+L<9gZ*Eqk?2V`=l| zK9WU9;w1slrdTC8kZ`UzHXS)wOw)Ig;n2Td;#Hq1 zYzcS#ePT3ig{&&l8!4D$hI<=?{WM`aJAB@$4`1ce%TGmL%3H_9?NfW$r%yx2Tgs~2 zL8V`Y=5@<(5T0DAAMeXwHMV}wvn|?hnk7BhxXLxnG_e8*%w`EhWRL_k4jb57D(H?Gv2eCGz3p&*Ob|$ONrFfTm zJbcYxIrRDKPX+h9+s^0jp0of;{-2IrZ)<;E|Lku)f;UdLWbUZ_f1JGqcpEy>E*xg& zG|bG*%*@a*HO$PMhM5@}<}}RA%*@a*x8duah40+`_P=NMe{9QRStDs=Sf zVG;3c-tEjrVI6BuK+l`ETQk?2vr%geGh5Bss{i<6@kw7k`Go(?qv7r0!tCzs^vBWp zI7PPV&&k8EhvzXfk48@i&!)|dU#|y2?_T?N^LO*HnLjzYIG^0#5enMfyp;95y7}I| zd%C{AkGpPW_MSqPEWM2u@waiR7-&%BDloJ)>bVx?CFFK{x3MnQ3MZ~Mo|UtUKV1S@ zCOL=66$-n3WuKTuTEBFjkFVw_a5nLqI+6T=0E>s+ z7S&BsX#2C1G+W->OQ}s4+}fzk@M5HVReM@v+E2){tIZGGdb=$MTolWPfl&T50i>Re z&jg%Qy*$)^LyDsjuWXJ{e{%)os3HOI(hg6nfyns!bee+6B(-@@?5e!^=xSmKSW=y$ z(`u;Mjk-R~r=^^6aS?khkk|zKvMEH*)YzgS1H3Yk@6@aT<+v;dydPS!81?xWC?+&S z?E1Xf{N&P##uQej(Di80U5m`+*JS3k$PU^+)u1YCOSb8+5LLLzGcDh<7ZpIExpTLpuhTTE*zp zvS+LHw!^rDNUKJow}-!L8h*-<){xztnxkVU<&pawpI=xd|5a=~JcBDMyDU9UOKqZ8 zp_2Znr=cRsuvOOv&O=!PF9=WDM|NcRR%If;BHj=|HyLg?uv#8sq)Hj%x@&O^1ckXG zC1j(f$@PKKdt0r@kw71tLtdbYVf&mP-|fLBa*$$q_EMbn<9+{Gg`gN2&cCkWUPlxH z$TsBcJ=`Gpe#v+gf9OYiwdYCzWJZo5Afiw?#am*4|9($u9r2FW0Y3h6>=6weDCjG}C?^qWn!Wf@=I*t}7i+p4Mv5$97G7S^r7ZJMtS}Y*&_vTT8F9`L zPH?j<5GM$N43?eguh`hO>9AW8K%<=SDcM@EIgBE>iZGK{&y;k-YAu416tb?zpLQe~ zAhy7dlR!3L*^BpjAzc;y{ea)WpDCRQP6`DH0K|+$K8-K|__}eKGu^e2ER}r~h!=hB zv2rhB$u7uCb?p_*n_6Y_99`X3grHj8WrT}HWxLTP`dM}DN5q4M0tckPz&VUpMQsBN z4VC}gW{hiKJ-`=cm~?Q9jkT)nYQ##Cj6ng7)Vq@IC}bpO52ADPyOQ&kOhh@&KzZeHOiP^NZKzM+FnE#Z@8z5%0=NQZ<033m}m$%+aIn}I@{Ms$M90!o$yvL~F%M|N%;8R7#bX{&$kGB(OeK=Egd8gKIMo$#0mp@L zM7w5({dKpynostX-Y4eFq#KnXoJ+#ERzxw4NMs}F_B?$TP|cACxTC+x$;1ZTPYHw~ zzw<~oV*dD&Beq96j>W-kU=!I^q6Kf)HF*7>#Esw%6bB2~Fj}w2-X*eZb_uZiCx42K z9D9~R`y6|(zDd$Prbv5P65KneVU+}9@!d3K&LgxKsSw@F1i~+Sm(b0KCRihkafZK} zgyy(I86Ft$08q^o8~pKx!~m(=_py2(z?M;U6zuu3*HBHT=L>7HuuysRN7IRxS&r{y zpLu_0Dz_5!A8<%fFCGJofQ4gq|I0!=p<5S#o=2&OX><0s@V;PYB zZcvyoSP&{;X5Y2MD1R85PaaS%Hc@mc>U(?QcYyk{SXh<}Fz_M;w4z#H>yb?JSzxl2 z#x5zU3lu5mJ@SE};04Wrgh7$^=m&Jawj;R_T?TA*^1MQNy5+e65(9TcxT}EoE*dPb zXRkalaBbBc@~#RJFx$NVb_{dl|4C?tDSNS*ZNY}3ds>jOI6(FxU@-yXy)T|O3-QS& zZ?=9Y9}IgA0rY}#20`meF;LhdEWmXnAqZ^wfQy?i3yx!(Mv>uBRbK_1MZ~f7tfHLK>Q_qgtFN zl|;y)+7)h6cfZ-@q_w*r{li!&hyF}1_7iY>ww_2yFDLtpL1B|fK~^u<%_-$D5=Zs> zk=9=V`ql%OP+`Jc5URjYanyP~T;G~CvJekRn>inl-;v~Z*-L^nFzuYA!yKiXxfZ?B z%LE3R4&#J&}_&s-gB>*b1&%|@j~G5<*1#5ZY@2(Ua6}{ z+MB7XFkqIa9bl8&e-6U=G$`jh;YYDQvy!)5VkdxL>&Tnpv07t8&;Yo5_JZEty|$ZW z#9^jl7r7QHoP+rCy|T9vm3M+fHY%BlO^R31C?gJwf~+`RiRX}itK)^6Hp$dI9VzF_ z!ld91xqH%&!Jkvi%uVw2{L@n2+_bZ?GH|xaMqIKA9Z2w~f{^L6^TASKj9h2j6b_;a z9>RMj^_U0|%)Vwb?(}$%p=${ES7cfU>9(All;V1R+t3kA=TQcDa$;y}>4_=11pl14Oe#5I zv#?!K;>hCIMB>JEzY88cluC5!XL8ot3!Xfb%5>_la{`dFhf;-3{Q+)zd!nUdiTPvE z1La)(CYUOQ#;9{ZNeABP8A{pg6U_0B$*zuUKiVEy0hb4cm=bHy&L>C3udvcM7}-%L zYQ^F}%Qv7<6o{oyc)r>%u`txhOJ+@_4S`HV85T^8N0R7a-XuV2i1c?@@z|uf5W6pq z?wI-|aiYjohagnc$`90VV|TwwvZg08^gT2ld9+@*P9`4Dfp#`!&qepq`jN;DmShE_~jZhU%xlj0Mfe6z!*F; zbydIj5eE8R?Fz#pk=2?8#l&czK_giE8kcRoL* zqJ2%J+h^Xh9~Y<*#0B?7{v|ft-P*%B%o)>i{woX%3-XotI{tVZV zz(0P~kKC5bNB%_QuVhqIFf_J((VE#1EhZ^1M&qXlr zbpaQSAoGBcg0MFK8CUDZsLn!A?#}2g-+tEu7UZ>N}Cl z{=g3$_b>JmHmb_diu*{ZVxZLCZiAb4nCJ10fGMwl=$jH0NF1A=Aj1$x=s2 z>v!jct|Rfic|NdIU^zM@Z~N!o4^#1M%Bag~=3ye^MVs1kc0?`g5Nl?uEgsQkK;;(n zQ3EAjP>-M)+JwJ$?t?z861kOrmNvK`ZtTaPaepC_DLk%k>$pTtiCJ6Tko0Z~+nMV8 zfLu0usQLG2J%CdSfJ*!ioh{(#<^Q36ZtBi#yhB}Y#Wq8UdMgH;c#TFU5y#RD3{D|1WA zYYW#SpR3<#KU1Mkx1m4euB$ust2C{#_OZgggz%mAXkfpl z{XAVe>T(9*cg==NF`lAw8(_-?+G*OK*A^KQ&>CBJsJv4|3J1}Fmiw(oj_R{(WN7Qr zlFv*NZD=~C`_lPUPXqOl-p(pDAq?;5urHjGx{Mbv(}lkX?Z^z7ssjBNuI0f&p>Z46 zngGrQZ8E(&+G=pPXf#x6-ZRZ}pJvW_^7gY+nur-~=y(zZ?XD|9rrm4Og4o@gc0t`Q zA?_ijNnUuadC^X)?AU;7112*dc#YrKcuEhdQuc!C7hys(RpGJ-0<5cbLG^4PoM)?G zS}bZS_wwQ@%AbL9;5p#~m$L~%j$^*DzUqWoRbTV+5@yXDyqdes z-4tBj18;t-!N=rB|GCC%Ui92Um#?-C??12OC8EQA_YwJxHRxDx1CjUVo0~hn!9r_F zl205H*1Oj#saKSdd;*W&xlRAvE}T{3Y27S(&?e2^%BU?~0PRdiui(HjY_%A&x=l~R zo&bDhxQ8{I`y~SRPOBS1&)u~Pi7XqL-!P;75F^FppkE)pL&3mL9pqfQt?wxvc4VFB zWf8!8!h|_(Aw8)P&kEO-P&mC_fOt>?6&V2ec#I^xUmkomuX&M@1GNHWKFW-M48cFo z)Mhgx!Qp~<%|ti_;h8QH)k01_A)gD~U89{?@;mf8%hf9PdKDuC@R>9A14b#sD@)5w z@x*dd2$|`t^9OX!F#X7ir|<#HBVo(E(3a;-Fo=F9C*}RgqEKDDr;Fmrn$J9JljwGG zFaG%+Qkt}eBo)*~HK4i`_z#p|gDZIk;$pYpTm!^MV3V)i(FaI9IHUU@yfNoU*KBbN zj3?`q@(hoJQT`!(?Bz9R)Ck-6fyr?C9Dz`v!F7c8VS(Dn(=Pb^fmjoxb;ySNpWbN_ zly7|~SHie1M1|+GxJ9o+48eGUiN!&s+nu6nVZkzyM;m^5?U5i#JOpPfO5`X-x?_1s z)8X%>vDDN4x<;Dzh~+w$ipmnU9?Q}to-V?IC*T^AFX0NMpl2HPU%=uL|B0S%e82mS zYy1nYjp9<(2P`U(NqkU3vyo6fp9e&B2ajY0x&UcIV_Uz6^4$aFTq$ZoqK9&-!1;sy zYmFOcs4y{hjNz(Vf$@1fCoX7y!&CcLPsFiZtbPubU(+Mi*HIqE2NeSuEVou$UBC7Y z(WPqkXr3m=hf`w(-maex*FWCxe;n>lf4ooY`@Z)J2)vygo)PeW{L1Y1eZF|SU38O_ z-nL_?5g^8C8%@=Jf7Zand^+7*N9_LC|7f-E|Ni-0UxT+qFDpDUwdUjTiNJ{=M2|W* zT0zTwGu!*uW^R|q)AeyT3E2e@%ZYbv5JymIO&njLy2R0t(WIe)6l(EQ0GR-tR(G72 zhZBw`hE-?5MsxW0*}k zMq`}n(iT@#k|Ghs)H19-T;Sy!1?p1_^(cK2@M!KeWFwUo|dLoVo}Q=1L7!YNfN`faX^@ z-YGH5$c$e4N+C=;;!UWt9??@#<3dJ=1Z((B4Q^WaD@+6YwL`+ z*3xTgCkO*|BC~Wcu~n+z1==8&1^3UbRtu(*yUc<*xECdq{n{5y2?rLQ4P~uY*r8W~ zX(a!9JTVT3L3@1u=+CW4+T8tAxS+fOSYL3d?AI~DnU(OK6!gMi*t?tpb;zUVf>(E- z7TGiyAOT%pN|lT%%g5!nzB^H7Q(;wd(N2gy>dh_5C5;4&mZeL&KYHTJ3si|(4AP^J zN-&gU<`&^S{v`n$wSb9ejSY$N+hD{SKZA&^p0@9=bK7vAyjF>-7*+<$WX@|zRPE`2 z;rT}CFI#7B@?fr>#3vIO*|T$HZn4==^fl9YUM-9S|4UfzyR8-{;*%1Jz^TgBCtzH- zU}PTT`$IKNM9d?RKZI=@`-iaFri@q7JQRTrp2S!a89`c3I-o?Z#3$nw3CQ#lPSQ#Z zpe|f=<;fCx}oqq_?7G<&u8h{zsak@2a-J>TnXgt z+k}Sv2y5a|_|e8OuV7-_Ex5uE=M5ja@?+=rDN{Hs@;*yu;XJh6qu3LwO>QJYP~dZn zq@ic~JVczMt1uEfYVZXR)v`feREA%j9r$AZ_ZwHlo!rNbkj>3!~Q1o`~$2Pq+^L2 zVM!;b;g#SD57Hw7=?V|l_%oSrNUqFpk(*2P@dK8iwUAFr&M+Sl59B`tKCt+oxzs%LJKw_y&xxSCpoo)h zX3}fFS#!NPzPUvDXgA=Du9v;ovW1<&{OnF?=jHlx_%a4`G+9Z>62|0&b>R+A*#Uu8 zs9%UzlNh`#HTR==KE@5RuN@Zqp2vJRsQx;SHprKuu9Hf^WDGT3Pu}F+ttgd3#?SOe zP3jzh!dl&s>QdTRx74gK4+hJak+{}`c|M-N*D=I`+n~~9*NKj?iHeDiHS=M*>W#fI zy6R}xD6(%cW4=ks3Z{1=tFMZuWeX}E^VJ;|8h=n#6&*`ze^9NZ9r&t$P>J6uDb(Ugyv!k~$-NE~$+-;oK?-96YEgnKflLF`!40BgB4p#BCYu`t09H zQ7sl74>FH!3(}tHhubS87*tsv$L^m$x~MVZhnAZMn>K9$L81>p97zzbH}2#{<psJJMKGu%Tn_yyNUaToAa<#- zW5zQ%G#11jr#~v}jPTs#wNM16ytNh+$nlO}?y&8YrB_o|F=An{YlO)n$y3H;4)I<` z1wKI^SxX$?K9MNsbqEH>c=Y9q^a%T3M}&9%e{gxbX>qdN4AFfV^Os$O;5VPa&{s00@W86bg=~ z3@EcQvLceIRFK{*gor7)5&}FBpTY}MW-$C_xwNDbJB7yBA=H$bx`&zO6Q`6(U@zQw z!Eit(Wgy8H*HO$ylCPqQX?$SnL@j9O@ZQ-dNY#uP3HXqu-=dB*#yXrf*wH>S{^&L=Z^d^BQ1&RiuEZ5)pa^zY@;v6IOf$ zg3h=88sECEZ+aK>0aZa5!#6{igkN||1O_EZBV4MvF9yX}h)-xTEHw@8m*sLt$v5Rm zf1W9$P8SLk1)V;OLn{bBsQUnhB&h&2Uho2rL@NpT4fMv-H7UosHt(MF1Yo)DuegXE zI0P~*K4)0*m1aeT-7+z%p2WMT)HEq4>4HXcDS`O>Gy5+kPY{1Xz$B3L*VLTt;YQB# zS0vpLfrqz*MJWSIxD$%+FC(mz&f_9z7!t&0^+-+d@*^_m?2HqTGFurzq*)+=Ljto%OvPJOqU( zHi))$w)D2%pWo*XH?O++0p#QM$JL3BkvG&9FfGc=L9^Ot)KV7(uT_ z`R!q<-)p~_u$BkM&EN`g%6{axr?R)Rns4+spj44b5yNX}ei_O3dQq z$XU(%&C%_1zrv@^Ns)0ktbpqx`zMU%TD2+?=Q*zX`uzhO#Ywypdv3Fi!uFbT>)c`{ z)P}ta%ko4QXQg1Lj#+HR&_P8|!I{ zdJ~UtRf4H+w*1@|_Sd1H!Aer{HCK4QsnB`?tpv#55xBf1?|GRcNq2UT`i4$(Vk+%K4-*TqT z^GUL+k8i|k#WbXu?hjaJrTx7(QVeDuE4&1Gk$-2vi}|DfC0=nxmFk|lPyOu2=>wHm z6d3yhM(K*4QC_Gl?eMJLsfKsn{?)$+=BQ(%ifzG_(h*87WFjVYvouem@0iSdtY$pY!(rET*WdI*9F6J>|-HSK*_&(Is zKS$r{_w4!Ng|xQaYi+0C#Y7^I88pK`wWT+GsWBd0%Lysfski;u42Ji6RIF4M@L~oz z@-lc*8u*|tXqq&ZHq$~@af2Tn9v|hsyY*NM9S{;cJNZKn9fAjbPkoz+wqb`q`frUW zJiAiK6X3Vv>%kbF-ib$;d6hW%lZyWFxor7t-d)l6Z@({~4S+Wu@M7RTpb0VKhD)$_ z!}bft>3rC&nsU5a*e*F`x7HZ=@9H|a7b1bva+5vF zassTNrZr%JH5V+~O#293a%j2D*K+0;y_p#Lja}=$j}6C>he}PnV<{5s-Nn|cmZ%!k zL-2!L%^tXF^A$rx>~}<&PjQpprFzSm`poU@jfC~Dx*{AKIp-L$D{~R3RmByoN}fO8 z`-g|kAXZ=@sF&b;V&3K}UpF~oul&qujxnVb(w~c~3`f3*@CtP261dqdHN$_mSq!kn z?oC$UJ_r!`#6^3Iiy>f7NfOprc#k$;^M2QVWs~dLO&2th#2Dk)N}ep%KGUO~We^A1 zW)TcLiR-)R$|+gFEK9@x!#+;kG)>)+p7&8ZusozKhA_p!9ifKZ*13YfhQGt${d25M zi{&TxD3Mqj@fowMzE(?O=9}$*e|bv*Jbi(RB6pYBTMNJxyzg z$BahT0X-HZ?CkhPcoPmLoVdj3mT()s&pbx`n)MFUtDMOLYcM#k@zJOJA0KVD&C~4U zMmVT-(cvq;2xE^D@Sn(-+6N5KPyFiNtzQa z%RYIEs$f>~ba{f^YrV6H~#o#Gc8XlUT*zX?}BAC%Qdj$S6v!@ae z&r;nNDQqJy-WHGC4jqC1Z3M^^U*c4A#0F z=4J39A$S^&*ptH_$7BrNljO=vh`U@|o4_{#uskJ|s9)C?UuA1x9cp5R+Pe(TW8Biu z+jJwQ@7vmam0~|2C-YBV{w@6F{J(;B{zveai}7D9%KsYvaxwo|!Tg`K!uDrZ>;H@e zUlPCS1hK+7B+^~f8GE9(ELA5|Njcjv;Gs!vvP6$mA!Jd_IL~_2SNu! z?MI%#$--waI8dti= zV5XI5rM2K9SU@I-$_@o*0|wN+LKS`Th=c)s6lGlT7@rLs)2AiD6?09{{2r+)vef42 zSY|MKB%DN_gF=}68zm<$MGMqa5@R`bs14f|L?ux4zLO9-c-Ldu7JsgwoM*@IEV!dS z-Oy!6IRMe*z?{}f6zEq^s0LOs39<}hROh}zBUy_ALtv^=%ZCI5mPV*4C>0+2DKRt_ z34!2+Twk5_LVpwNen!2h?p9adsBr z?x`&n{<1$KCT9U4Ch~PTGBVjn%cqdU_`z`40rmylCupc~aWp7cBZ-|x?K0SKb($v*kaw&Y1WIe#bCnHDclg7eWQH7cS z3yxy6fMtbc$!9HqAwi^mL>kC})!9hP=u12Dy<{2?5Dv3l!5-b9mM=Dn1xt{Xn5h_H zs3cfpxscDAHz)Hj$3+gw?ThbwTY)!5LbK)YQ5}hTO~`m+O4G6jeIj9!uQL_&Gf)FKlhG%gBeO&C+gufv-W4$q8QdHh_!!3c`d+^Q^b^sahZ z`u)2SWMmWTsez{q$=xMl%c2Tik!<){oc-3zNQuFt;r_gMxUDeO4pC=VvWPGYtg~15 zdZ2Y6sW%K>>CS5uH_T7{5uHy0BuNG!7Ej-pE1{8NP)?rTfp+JQ zb^oGse^6LZdc)wr3yKkwc(7CLCeKcF)|>N@u|u!F$ga?%g zdjjwz5Zc6k>z%37TXh3{*0J%g>L05wX0!zjag<2ltz=w*L7bLDIgjo;=6gGh)&ICW zTM(4XP}D*#jIs{j*Ny!Wmp#h5@{mT(-%48F8!yo{N|VRj@OakMn96Ky52w;z?Z1}M zXi+>?9RVse@9FHBQV!)I;E|o{WmB0K+>4F~pO3ra zS@7jxt<;Zt^E+#!(JkuiQfg#`8Cv7{4;k zu!3TghKmaKI`rCxQur0Sh5Z>Ru=Xau(h){+dLb- zTsS=&ojd-TNQ@F?iC3aVigoB|`EdBk@_jgbQM}W)H(j0KP(^c$0<30$UGoqd`|9KM z*9#5^P|UKa!gj0N74LI|(0ykPX*7^eH^sBI$oD(iH8u>NZHl$<6zAI$JTjWxM`W?> zm+;3QqQBE#Kq{rwN%qMtbynl(SrgO<98E*e0z64W&=g!%L(m4ClqToWfe|+1 zjdO6`Q3G<>X?=l0sMYl{ai;OIS|=}2t-wcz*R zR_oGjwLmx0+f#@t-TGSi;q*(4(zq`j&EadEcn=I^wf`IpWsUzBOex@B3L~j5IDP0{ zmj0#SS@%W-V2w`jNRW!pR93gan$n0zx0aJ!eE0o<>X}{e-p2oA9cZ>0xIou$w)*2e zQ33sxYCuJ@Bu*heOPDX@3%*isZty$lJ&k~u=gp8Vq(xfZqto}*3X1W87 zqB-)$w>Alg;RD=gmX#uwyV}WAPG(N>67!s1^6Yd8o35d@UM4P)GdOk+F++%rS`0q0 zTf0*chNjqMFCPI5+41y(&$W2u7JK(Hz)YNG%T>NH+dC7HG6K_I)VryiAjZ%8OijK` zFzASDPhE6j?E8{hGx%uqU;A2afyj-&jCy==I~Q6|R(|5pdhk2Xh(GCbTS zKLVyqjI94P%4TBxzw9{v!*)3TteF1Kc$ogx!Skc9@C6##WS>uxz;dan61jl&rRHV zUxEhhX9bQdS*byPX3z#A@WI7A5Wp=O1#0rgd#T>LA0F?e9&aG%-cK9$T(b?zOJgYus$m z{=5}CXAk3)9K)_F&{V5q3lYs|`({>0E7BM|&;-*MiWZGj|6Ph)y&{Yh>2Qx&eb$Z) znX17vg|t}5rHR}r$vi8WOPVEkLW!7;2s0pwOJ9dH!v!7fgI?-T~sgTquwaIvqYOv-Qu5OY}a)B@t z70zU*qHv|S#6pT+XF2sy8NjYMxK4MoiSzW z$``66VloueLW!o5Z8p_>rU(40e zW!S=sDl=$nwf9kqp>0nE@r3I@j@#1GHA1Y}mAJ(I-NJoEYI~S3yhEK?# zk1vU&6tLhlMViKs_1~LgC(NBFJqRXiVTk8S>O7cKFc^-Qu*>seMyj4RYecF_mjV*< z)5&_8@s-RaNazR8X4wp&Qr5__$|VrAc~)KY*?NjwThNH`W_|;=WY zZY~TCoua9&+%9U^5t#7IPrftQ5p45!yge-E3UvFt9s)KG!wi1UH+S9JU2kaaPoLdi zu7gyIW1gSSw%?CXB8nAxLn2g4lRLN%u&Q4cBR+oJ{S@eQ%KvH!+65n3z|Z$q6_yvK zgda+|(NBnlH32>3WFInXa36-eOVOubf@P1j%SaprHI1A@!aLk`w4=RNTfI2?z;VO4 z3cBEC=QpEM<%d66E-@@YeEmI(!>ZY-QerCXSb*SVoi6OSxPNlnkM|ZetVQ7cIJX<0 zXx@3JrqW@9F&8o?jFaJ-8SfWOYbVgH$BxU_I}kfi1pK+qX@B!{;b`eIEH>&Y<0O#{ z;4z{LphJ5be@AzAL9TnOyy8+Jm5m)_ju>#XQiO$)2h0;~C1~bcMPumGoV-lzb+J%? zGfJr;*Z5tEeudv}jQxha=ioW8JUpY+S5(ipIY`2u@-5b?1>NK_eqVAUC+SIYGM(w! zSqD6f`sV|>>9dZDb0G1Gs4=oNGfF%5r>;0{?1y2#W*5*5SvOagZyn@#0T)fJd}%t930_T&JV4Y7gr({~w# z6zynUwh+RSA{&CeSCC!Cf&0Y>!HftFpy0VsugSG~KsO12xjPUrT@rfA*Is|`WC@8I z+AH~3{y7_Xcetabt6Z<{LLJ8ZSL_Pz#?uOwpbTf#FA5Z-cBYCnJiQMayr9ktqlQ-y zC+M(TxcFgRfV~WdRgS!{+n6D!bMj(YIBb5mt)U)RkP4qyrZ54)S&4KM;CU>4-WoSH1jBoO)>*Gflz`OA7Dri!Gda3`ZuF1p6cFwAL_=&hrl94$Iq_EFDM;d>yI8}Ri zII%(fFjbM>)CU6Xi=YKW(icHf2-PowHbBpz)0`?zSw!{_d@h~k-dKbX8GXSy-1$7R zCuOKX1}6e28E3&q-1)8Y=GCbGmQ(@Z1&)~l%hwS3!G&dbK$Rmf?^Z%~RbZ_^cB}9z zI?YRL)v>AM8WRq2JpEShX2`Mexfi-W?cD{?+9x z&i4adgq)myyMUAIp$+b^Z4tmseZ}=fJdAtX<9fv(+g)u;d6ip0V>6Gy;oS=*$s=*B zglS{{5xbg9h->brvbGW3NmKf(L(Tcrqj{avc5cUf8o`f4@Td2A*%jygvdwIyf%EsD ztgphuTl3ovCp9n4n7szuMhb(&d|o-!OgYqb5>=G~UJmLaSGo4zL|c@Jb*PZ5lb|%D zgK5b6l2LZ0!vWdgQS|evL@ z>`Lh00!)LY!eg@q6ek$K#1H{Y58P*YPFxNbKn}GPASbt+A%mJRqnzrdz^$J5O1VXxr@2)nL}rys4@ z9abx0oEo}Y$-9Rm`e!2!^NXk$0?WdaP>t ztkku4Z~ORT`B#m(M;uDuyOgi!Uql8wt&qejLAyHECR<7kHWU~yDX@N`%B~2`l$&)x zPMN1Lw`E0DQx*D*nCr1@-I%hTVCh_Py6oy zIagj=_%nwb51+k+6$J8t51l=ATyS0CvG5_<4;wY;+f7e4YEa1A2O(UG?$mtWXnzur zAp5ZT_uB_%Kme5g8q%`;|A4{&{aFAL3*&ze>sgrpdsxo`2psa?jsXiGfXiR-$lKWh z0*3rC?0=ZQGqG{}S)TtVtp6X)J{$Az044v=NF)GL_*j4`{BJv*83A*tqAs9*K{zn` zdWeo|0IVmHk0K1;2bjWNcO#CTF3)eO(7IS4He^xrB_#ZkL}#Na!7!5KdQdEX7Z8@F z6;3JXER7RBDiTIObFnTK92~OWSy7`5uu{(tO;A;^&1c2g5Se6m4_ubt4PKRTHAGCwC}45+*7sSTYeanOzX4B32Vw zAZ%b2MJ+=}4z2v6R0%gqcE;ksi}@KwYfxvgQAfr@3v5N zvr=z~`W7aMqIb0}KS=YHRC8%5?1;#A2S&}P1XkF|#+R5^c})t_GKjIX824!|`&ONC?Gj^>0%t6!wAoU8%}+kA@ZaBeSh_E0S8dZYXSGv$<>>1Cpd$!op$nZ$% ziYjHn8O{Qd>|Mo1c9}?$QISQe%vSY$YUrdW8S1N~$;zc!=rp2Ll{8Y!Z*3lAa8)i| zG#O`%mFBkW`ecCE@ndsa4^=bY5i)CTS;Z6UB`3F(5U2t9uc21yjJ}T&f{|vfo8G95EEEc<& z&<6!Fvl#d7EM5JUTgF$tz&1z$(RRbefvYy9HLsH&#jGaoZakczdnBJ5?Ll3i8>@qxR`8?Rxq zd?q?{io$3(m6Xkplqw{&wJN1zG9w9p#&nq%tE9G+Cep>0indhaAjV)R{zL|SqJoEB z!Btv^QgQL2Xf+8UNW#p%PLXZ$i&hob;cRVM7U`Psb@jC9rg&Dw3T$gCjp`NAYE~&pS`9%9h&~w$+RI?( zH+1NtRb-83WWjVS*g-2OhP3QU|HyG=um5&z*L_LU9wsaJZir}h42NBt%_4fe5M?|(jCRbG zv&XO6=Pu&AA@+?-RZn;pB_dVP6k07+QU1G}qI?nH<&Rra{HksEmsA<&OjK{fHW{L3myTi(>O|T5?*lm*u36!8Xvd}n9jCukNI5N= z)Nb)gsHU8OiEgZb!;IT@en0&m$ksamT{z zG0)P&)}{w7Ft9(nQg2SngJV|{^DP$=GBn@s*dJ2udRmen7afRR;mz<-axuLIp2a5j zDm7Hi2b>|`UHaRaxp3Y9^2jFc@^IU8It#8LoOSgJH1+;?(tmau)z1lqx&3k6{dzAS zLU;f>E$$7444E66v4q46KUlEKI9JOBPZ1D`vL)2^H_&buB(w+|1FuOi!;<%U5kHmx`sJ->Kkio7iw$oYiA@}T(^JFPQV^4cfC&cbZNPCX0J(~2xW@6?Hp}`Fbg2V}?N@!oy z&Xi&r@U$SZVsP(C?I4eyvR1LRYwvOjTbv8hgxw zu!Ex47JcMgBOpp{y7@$A>+-DW=rb-?`bjuJbVh$Y+nrZ(7H9T&U_39F2Hy3 z!?3na|*Ai)|B+^+zqPHp)RA~JHoIayYy0MS+oE+SQw<{br)62V> zRysw@1$lyPJ)X6m+{?dee<9X#FemWVV!WAXwzvK?ZFn^=-r`BVe8vhXf2oP#?FWOc zF z37o_kRSH%~XkB4pw`^`@a!>nUcAor6dGm((5t)#0UT3a4n!GCx<1c8xR|^{>mr>2n z!VlP%6;tcc6Ta`}&HnC`k_s?oo0bJCxH%vTi!4usSWY_~EIw;b6!adRW*Q&>2dK#_ zu(?k}b4kck6gQtJ=9177VeApuO+#2(sTjz~cF<_O9DbfIPqmKrYI~ZW?20GZBTKhH zk?91_T@X9#w2mCpy>$D!ZmgycbNSB zAXKiB0UJlA^qxOUA-i5do~}wvG9z^4hUtaW`V+~pABD@(2CHnA)8k|Fz1_ntw%@l` zB`Y3*k22`}rGQz}FB`Iqmqb`Uk)phyhWNnt@dF(Yd$D0yP_VUIqcCXqBLZhPOz%0c z-O!_4uUcP|6}B{{48ow#asNC*WDA;^D|7*!yYGkuP}gz)9UHvszQNO=FSJYi-2m&*uz5{0bx8IeM+-qE>T5eM;C6O5n&7ghxk zHg(xAELMYzX|(!>*dqXrnKi7_HqBI(z3c>@3K<+xbC&H}kDH`(1it33wkToMcAY$k znA@CnZo}0IlHpBO#p%D+vrd_$f;`;#6fVDCAd1xMMBIPT4FY++3FX;20LKwpcc!ykvy76e)~&>3zEWuD7f3R#f6<-QdRZs z+p4Ogdya@RpU|e2#Dm9nJ>$jUnQiI-BLiS^WD=fx?sOw8 zX6fM=HhW0_-+LGz=l{I2`Ok!i{Qr)bc>i-9^1pEdE=n#wE&+jm(#!uNKjLXOVt}sP ziiEhwbbI>5|Ska&|ZTHMMzZ= zP5?b+@_TWEDZk?gR`DANXAlwX;kmMC*e8A&(Qk4uN7YSgsEaZIqCqe4g!jhKS76Nit?dB>Fi$9G9~E>YgB=@?0r(oxeP8 zF|NK4?09vH@D_zx{D8Qv_-)Eme;7qW*8Q=P#X5NXoChlS>943~QcRS)%2LyXZ z|7P^bD<#n0DDi$w<6mVA0pr7iW`v!zt^3FozRbX z;AwTw%yO^2FmSM>4+e6GJn?OlFT5$QOv8Ne)+ijxtiLAh?s1~3irHmag9MNBIw5Sm zk3q0w9Cea%3?;qMBR3*yr20WZRpfZV=xnd055)GS&>cTa!wl8DRU1%R#x|kN{K&3< z#dmCKE<7ur_t!`5Pip4e$GcuRG8$TExft139rLS6#O{RyfgA?Y`j+UTpxSM zg{1AIB>YkTn|@6Fwv$I;%yFS`$G}3<8SE+SBXONjbz`wdzzfHX~pf-*HA0H>2mCzG!Sk+KwNvZdDZkwJ@`aetyv_x8;8}cS1x7YV!ur7KeeAXHdsu$YK0G6J14Yt?B#c;p zbZ~t&3Yq$-%6+8lNaTDe?yG?!Dn?--+4uHtV4I%K$uwB^$4(EQxFPwrFQ_eU5{t{$9A zm}IvL8R4NwJXa^!Tf?CMs7ze`&xx?s2{S1O7~i z`rqCjC;rI5f4}+gf&F6~4P2lD?-Pyg3;|N9vJJqZ#<6MxNj?*EUX?OswiC``q&-mu{# zs_(<5pLUXnss0cs_T~3S+T%)bbG2f?Yr<#6XU&>76FJGX7QH~oZ~w^`#flQ;v8vaW zFKC}vURMUl=MNv;>b~f`@IUzl5WH}xf4i#SWPJaPx3D8aRnY`(Z-A0KkO(H?Vkq?Iml3RR(k=D3#MUuZw&-e_OWhafQe zUY`(2p}3_*F+MtkmT6te?#MFChi)QxlESO^Jh7=zC2EcrY>|XoYh5~oT5DdaN;Wb5 ztK%UQg1seyXb9-X@z;>=PuZ+uE&nto!o;9~gcGW#@rgtxC^8939=R|EJNiAv)IAH1 zvR6l+tslA~NwR0^$E#MqW#y(eZDNp0s^p4@DvX^)F5F!05w_wNYba~LLk3;wUN&3k zZM7846MmNv_814vWGV#N7F3VMsm|PrA!(@)M0A2?*F~Ux!uZZ?DbkQEnGPi!BB1C6 zU5{!@08ihmv8);j_GK^aYbt$#=CoUNM^OoqI>$v(nNut6vpl8U(v<|);nczf!9sL# zeOVxjxQ{Re4p0TCkJ6PAPytMkJKRUV0ushc@q%(_ewbjW!=vWSN1}pkM$RW=$Q16- zN^uQt(PFPI%v?J|OxQOH0yL`;hQ0r)752#-0qmUx%C+KFC$ ztyy7FcWVmQQkzc{q0Z2KM!05cfi_xO524P8w~`%bhjJlt!<#lz?-NXLka7?KlO?3A zI2vYp z(BUej?4iB8CWL<1WHXh+)$P2pz?9j<((E|C7{$OWGpFo2frZ~J5nLWY{YTw9R+Vl$G9|c_yaW8B+qn zHgN9V6zM$D9`fJa&5P?uQ*Ept?ZbLDHuVt$-`YxhkROc~`>jncu#)nruB8=$hm<=H zGRUU!76vVK1g%f@eh%tierwO`q2JxvEu@5{bSz{NRjAiM>%khi7`l21(%7IUUFAz~b1YKO4@cr=UNrt`^`-#1I~5`!$7E``7d{XF+2JSfZuP z*kQ*h4*S)l_-THL(y0>YEX!)1(4U{zQzcP6M)@ru7IBTZdBJko{;*dJv!Jpv>yQr@ zj$L(RcYJz&_p4n*N}@AR)j8OuglK4q)bZG!z8IJHzN{Cs^(M{-S6OQF$HWwON*;?A zsE2-fN+4x649=9T3$A*6I}Gc)GB6pdhWUZ-tAP2REp{!8f%qy!>VWYQraf%+ShcL3 zdx00bM*>xMWvArQTV{m?tB8m~{@IsT%XwSpxdKm9RsFkYgdbHp^n4msXM1OR(X1sT zGRSm9(@dw>`7k^LbAlD}D%8b?mv=>fddkf7>xGbnaWmItpXDvtez>gXm>CBurwFbj zr%jUK6)(lv{UmtW=8khskwkPDbmsqQ9?(cg5vwM2ey!szq`0y;KmRA{5w~dkT%47= zQHg;6VH!mM(LX&RJZNru5-3hL_k8e6HLTqb^)LJ9RdP6+u3zQd!LBdKc|D3HHeRZ$ zjanH5V*Qo5V*Ns@`_2tl=&E1Vv&XupDlnF&YQm}nbruPR4wfF|E}uLMv&gAYe?NI- zo0I;fZ_(v@pc`x{iwf9si>V}4qKl#3p~2G9hLr`G2R+DaWjYbmp_qpeUL1}ps%SUz z0)?N2vaCx4P+|mPLkL!9IUp=pXEF-cqnKnwM)R4dfQ>ytDuH%hBTmgBK=MwHf5OYWt*DtTgi&Klk|q@K8|(^ zeh&3(H-m5fTzjUA*jeSr*Uy}6qBO^1*O61gB6-t5HfV-ZygH8$CxgaQhTP7T>mXV= zwHm@JJ9Nh>qaCBzpn80Q@m$SgolW_WPEuw^)tj8`rBNo{4Xz%!|= zM`fA0QXNLDqlKPWtj8+zmjw41%Gd!jmX$XAXnA98m6Tq<$#8>pTHk^r3!C*UHOe-( z@l(5|w?~3d1_Log#>p}021!$D6_P`rweydQ^D`4gsW39l2X0$SAv@uCj5K4yvq7WN z4nVLRK(#<8eU`>fJ;x?4SFHU|)mR|?$k0U}w@hjfThyM(ZvxC^unO@f@#ljSL69^7 z@RGu=cFcCDulb0obO!mfiwh6M-?xs;gq4bivv6J8_0zdq$n*pZO<4d0PA2> zjc-g|GCC@ITEb&hP$0&f3YQ+@MjeFmJ2##|>S5}$O#BGE2xTfLg{Y{b-3KrJ6eGyq zpCYywu!^rNeWOZT>I31#XEbFl;S8~EWd((FbU6p)J|Y!xkvN=Z2AwLwcm0LOjy<(48rn}ak%-67V{q*(h$)!894is*b^{jI$!W3=$YTgh=Q*H8bu zf-dq6O!&2=T!~2cs?EzvR-n^X*3L71?w=kx0gCnf`=m3Laq2yJ(GHSm zs}ap9vufnlz4Y8`AJ0?NC9{Cva;Rf^dn2+J*E$UJY^@mIvG_1W%aX zu(fbwloz|MXWkW9G!#D5CaJLM;a6+@8BIhU_!hr-{;G^PT1@JVIDVb99&t3EBmxTM za*+^u5L@tbT8mly=CVe&(BrYjv(V$VhPNmJ3Z-(Db6N{oq;Xj@S#%K14`-;2cyd}J zTdWYxk7Nu34TduGMp!K;VMdxc%QCrCftfQI-+*?OlSU(xUsYf&j){1(xta)hQn+{s zd2+eDfSDs1mB7q_3^1_LN(J4biijtMOBa|qmVso!Or+hPfed7_Q6aJb5NQu&n2+Fc zS&Ler5NY>i1dQx)(Wi3>0m0TP_!itmDg7Co79(8rxm;Jo7UY(b;v=V4ljQ#fJU^OYG9ucS@j~Q5VR3FX={&MFn6b(E_uq9mLxji!(Zbng zvX1D6Wn^t6;|q}os)e)lq$;pIiA#X7-o^I7#$&m7kog*q;Hq#$jFcH^` zEM@tqXiA7<$sR9&AL4Lg=SW89V7HT%QI0ZZ575(WOtvQK z0F-=K8;BJN;=Q!yq`=sK6(+l4OD?)N+jc$TFN$CofFYw@SxHRt6KJxyBq_NaG+9^@ zn(PO#*5-~&&IC;sSPIj5fmGt!%V9DBU{HoXaUvMBFtX+)X>WdhBw59jDXWCn&7YJO zr=g`Zp{v0in(Us{1WeX4?21S>2gEWGsVh;{{0vDBFjOX|YX|K?#v7TyMf==L-~w6| zupnTLNvW7NRgbKQHu86-ic(@SRLzQdOhVd?R0Xnx?$=L98*BKuCpA04qFl7rO%4105 zzXB2!FDdEVxKPOp8Z1DhrF#l~XNbfvdC9?A*JN~?BcvXo0XQC$(ASv6FCuiN+Shp9 z_jK`rQeZ5Ac=^)1JlKZ!styzY05gCBRGI>0Ehy%e5qa+k02tcW;@$V;bQg0&K8)Y8 zlUo_TrC5IpA9+^+pEN`~NxtJMXCUtJ0WfBVB($!X>4FRP@Ur%;047B-z2$py0F#2f zZ&~|7fFK2&{L(!lKwjA%C0%c+P<~MZ1Cx*>80U6n7bGf=Ls7bi1t2fmqXInJO~3Kp zQ_{UK{!s?!WpraJvRa!$l_Vsa0LTmWf&k~mdnN#HZFluajCQvRM6SR&J%ftocNGm_<+=WCj+ zP?-!QMb@ROoy!F5i!8;R&PDx-+B$WauiJ`egtm%9*@S3pi@`#$wp}1+R zr{K7Att*Qy4JT28pz{D0+KibhI1U!So&LG>@0$>v(VsRjnYc~Ph+23&OE8&=N)gEb z0JFLE=gliPVwQx=tWc1q7BLUjB4c5Rpmi2n38S?=47a$oJ+zi$9iB!q1&COF;j8{x?y9*R!3KxM5s+ zGOgjXj1o1SGr$NWXfdKk`6I&(D={L&jq8&L9Y5eF=rbeNJPf^IpCS%A=#Xhvv#3;v zkGDLFzKT&(tEfO$&12kFEtLKmdCp=#7Aryh_JQP!_b72Vu%Qpd z0c#R=(i_!G;KkC#0reqzIRpJ6vd*+&<2BJebC~um|2Nwmc|>DxDA2g=z^yNm~pS^DN zreXg&>uR4?>+A>eJ{Kq-*mIaQ_9LF7c^t8ZQaf_yTqp*0qTl z2$uMNhmdL%am}WWktlt!rk5^GB+=h*qd9+AH*JUCJNKe+y|E6TIN6y)R}-~M!>M!6 zJL(z&laO+Vv_;d175`4WbRY0XHl;^OQ({91|BlXI7hnA}_uYq@{Do6~87V?vIQmIL*SpLi*&;Aim)n)dyn} z1$haF9&z^Q!gW7rIKqWD$Y-Tcj!dh(@7D~&N2<4pS@@cGjbycjD*21Rla*qH`TmL$ zN4bM11pO05UMGV)5<^*62-xT;I@i6kQ1ejQ(ArQb&@Cavl6+>^1t^?YpP+SMn4xf> z_CvTOnF`=E&=_HWh`2B)P){MElI)a-iRfc6mN483{6a7a;BBGoLr@Cf7@^!l&?r?% zBlOAppgExm)zIt&F$keZVM+hbD0V5fl^=2ewF%P${R(^O)3+2-2W1M=14RlQfbmGO z#nbnn0SxUC>GD5=7xV?}25c9qFXAQt*1ybLAp%gr|8^B0aklvSsQM_N>tNoYeBm#- zx9IvVpgCYnphPi!F)l^=nnG-#)L}7Tf>3=?E@`)*wvhXFLq?$zV923G(R`60n9G>H zpXxE|3F;9){kNzDb&j}(*hWxK;)=N?5Yh?l1APv+2Hi$>>CjgP)e7wlzXsDr3a&fff9i}D4LF0 z<(dpeyP+6-9p(J^e`wahhoJYF!E!D`q47h7|9@%zS1&v$2G>S8AGjt1(f%*yhx+RF z$A00H#CpibK6K3&fdMX>{svzx>DX+nSkqAX?|%+)n=zcCdUI_FI$*>?H>8yz7+bY6 ztwkcUE*czu*kVy83LoKALEjzW=dNFpNDV#_zq(y2zN$&~sz^}pqeL6PZMu#ZxLwBW z&hm*o`?eD5cccScMPob;pj|#G2h_9)y-U8G>&EubL$~AzD{|q)of7SzToy0Ivh+rWcK9iz`xx=@Z5E)T#7zg zD$br|E8y8%(M@!Z8%wHAD6)ZwdrJ60i7}2h!j{O>4eZUajl1%VnW5ggjz;5aKRJ;m z|K>jwIr@^YFh5WAc8W!(ma?blejbw3j4zB)l2$XSw4-$hyC3B*YoQ}h1a->oDU@xBf*$m^-W@zeI$%e3*#Bc( zYsjz0ht3(R4+ZOoCXXb472H7^3FkNpwFGyCge&3q1B&9&_r*b6Z>Gi~2G8V7V*H@% zPkw}AFvQn_!cb{{nI0{e5~Nmew2q~?;z#nOdm{zGauzcMHvQ6K2_}*pMd`EipZt{q z-pGbbr0R+!ik2EM+9V2k2Tq{;qk($&%201jC^3@A>U4#dM zai6QQ$~Qp|mr`>A!Gl!T3ydz1*yTBvhtfS(&fE014<<=(5LhQUH~0~_nbozQvaL zKH58RtH6LfTdaS5-58k)er>U*V;I|iQ^GiC~l+86_^UX~YpH9b;IR>2kr)2yUIga1pj1dO!e5-7h#CF(!nc zLtIh^DyrA<9!HT=k7BP2aGhT`E>UVw(uec4k95NRahOrL;!VIefN<-jK5NKde=Kay zLoaNUV)I*d>ec9p6V4qXlj6{>!>!@MNCFDQSkdnZCGCz_ZO(ChUfHTCQrtF)lSH&0 z2;iK5rYM@fEw8T`#U&#MbGI4M9p=qGL8?eNDX3L}WlsIU7HJ=dwO*42ORTmFc%v84 zPhus1T_U)(P|Y`IuM*W_n$Ez^S@-*l`)#9;(`pP2DP1E^g|dZ3;4Yg{=PRw(X*}@> zUP;<#+^WzRZ6wCoQEgY#~u$4ldn5di4_CQwiV@P$ImEq}D$@i=2Or{j|n&6|+#xf*7HRRR|0Wkd!Z3 zX;!ktVk%f!mAF`yunrGoV*(HK@k>4Fapa znFU~wQT6@NF&dE|gNwO)B6}0`S6^^JzS{+MYfj`y7g8jw;;`xLCo*VgG9rhG5Ykf~ z+b>Qie8y;3ZKNFao0Yn^(e1O1> zpL|V!&yHD{Puo2EfnIm;2$6=<7XreQehz+B{^w_=o1Uu;i1;f3yK8=N6OO9Q6G*s;oUp~e_}PyL zOcXax8(3U560gNKj5OR~xj|;SPV^zIQw{2r=&lSh?XU9p7KgO%=e5wS-T6>-7l$%K zUQL7j)~^E(R79++mfvY@QEqcKVZ>%6A5wxI+O_D!lv4dtneUi&k9DgSsuzN$aWyMh z#p5uA4~|F2qn-VcD3G@Gr3G=5MZhV7#(~U<;!lt@2jeFEj$AfF&SGA~nEQw!6kbh; zpa^EEmzpM8ho4X-C4MTVdgpMQAszgVT86Jw?~!2ICUu3^cqmJ>S(|gI8dFNYve6F< zK)pj4%3~&}-toeKWz*`<5^1fhb-kw55@3E2H@)E`doguhHE%n3vcu<6A&7m91@G+B zerdhpb>shxkgoe9QATia2>DsV=bY=HoL>wY7qoHV&B-{0XdjW-00x^J6JxYESRjfx}-0YxIkK z3MjeK^x*{CLDXoNxBmTG1OrFh6jibpkf)>!Ti3*=ZOWTLsnb@O8amS3MJZ32s655t zo&`nwFUJ7>_CCALm| z*hWD^_Tt~UNM&JwD22`-xDGDlzf^c}gM# z$x2@OtX+KlF&tOhFBfme<0rwVPCoGS#?VTzk$<*kEsGPtil;S`!%{W0CjWtw2ty_0 zmSo=+OEYYoWIoG1-v7c-qum&BRtPo!XI~opYjfW1BSx4dO_*<@@B~PKpK9rV4k5!_ zH0FW@!*#X|-pzHe+HZ<<-*xXk5n(G;MwJIt`_Hr?u(46d8D`wA>;{m!73nu-vLD|n z-jz*+qt6ktOzIiFVWiJgkuJmLq*S!c5xWY$>Cp+u==g0JaegjXHKfz$y2Ra$6d)3~ zq+zh>qIFt>oBLJhO?~#3irj=vuDF#%>q?7Essy8u-1pDCxVR;jkjaH+B78EKGp;uNowJ<98A%7zZ5yi>do<$_l zN!Sv#3@v4@R;RDIH3NOmI@!Q+tgm=>+sLbs`}--~i|EVmsDmFlX9z=1gRZ9HDnCsY z6F-CSAdHrznANRwM3dJD?g8>EN^vMl)5{yl)!Z4)hAH!oQ8gj`j+|DD>U%EqV)Qq_ zKU)`ttxvX{ws9)$Lx+2x-lphtOxfap7#{ch7qV0kYuH-)>-alJfP+DPbYHThvL zmFeZE4Sw#)^Z9J_5y{;9epb)lW7ai{qzs44W%+96y5*NHXE<{r$L;KW8=?%U6MBJP9Hk$ohXn0Iht(T4W!=aYn zq3%DAP)+M_Q;A6ApROBztqz1c`esXB*qf*O&U+!&H=( zFoHgs?@qT~GDki?lz(^3t&RS@@u83Ru-Cy)P&L&31y-?z>Cj%|Dj`PGQ#z&QQ`BLY ztBYQ)NnWlgT25IoF!&~W`V9m2TPX0GJli&R%sahm{q1~i#7;tmP=D!c9KC+ zNF?8J@OBi>Rgo@3rIPXMGyIwNsuEn*5W`-S{9$>$s*T4{tWjlu0b9?c09VqkVCnFQ ztMAk}ntnLL;tAKb*34s<5h6kzWXEeI(0bp}p~#@}YOmD&BHfWK+x@QD;)5_N@u38M z0r_YnbQ90Bxy5>BMJ&#r^nPmVb6Dk$#^@H-wst0kiam2j%z0vsth`=PmR@6JeX?rg zqSSB(h31n6#tKH~39ZtjQt~u|5{7p29w(jBfVv;tF9-WQxQ8)L2F1U%jvI$lawibd za~?sthfz)ieBAQJ|0o-dP9b%3;WFo-4-h_!^{MN6Z9%OrH-0)#O($K^ZQ}6iZ>iQd z?GzMSaGzS?TjBuh*7h8I-rRZe3GzAdk`S-=-5~pToEjfx&k=ekQb?;6bKM5Er;9S5 zH}`o5jPyemn_jZ_;pqg2wu#{!GIlkFTuwtrS^rrt0{7qlGb~8! zy1zmPq%u*6gJpfH^~CxPck~A*+4m@dw%@#UH%!Bxap=CDxSdZ3yx(dc5&vs4w%zI^ z!|1EJ1334v>Wcsm-{+S4A^pTmYvVfo5yUDR5tbW{&d!eFan$daqHuT_Ics50sr{h> z-}lh{35n`h@>=cZhDw_NHP5b3lWUKNVDk61qX`_`>qpPvKaTYwDToP|WSsitJG>q4 zYNW58b^X!h>YyPZP3#+4@VhE#NVp+?B0A!R8lNREj{sVoS%^bO{lq)5(Yf)pEnfZ_ zMsCgWa1GO=-4cCe7oV&F);|ZkMeDgBv~6wWr-Capb6C7OV-eR=tgEJM@$kIr-kYWU z0A6OS%DsD|RL)^q=}g1mLfT((v?VN@KVPE;Yes0~i(UuC+cHfE`BCHy_RxDZaUA2N zUy99Zj!IVEG#gBaDt*UvB#-KK?&@bh$qNO*%V2C>MG3q2Sj>&A8Zy*onWhy$+o)B} zIrX^t#|v}{u@pQ)eEJO@_9IVN!2`IYeLBLcQDwPc}i_kv)h|TOQa`yKgF!?wL9QqiMbpi`FMh^0a3{YrdjhshE2$fzuCSJ>}wzAio(N*Q|7Y5&!~jYI24-76j!kUvNT}CMVhjtPH~92 zWxDLw{~5shcfs*Ji53QL?#w5pzLt4v)+4 zFX~2Cd2XZ1=FKXWB5)Swe#rtk6$Cq`9un7n`W-X*Nw!@5^E}?JZ^~! zRnWUsE&xzOe?zRE)I`%WmF^hCNXl)t6JevUU8~5-sd6?xEo6wImtm1it&tW%e=n7!%y` zX%hf{Mn%aL4$|CyZcOHrd*p2~k&^#|5tN1X{8so0h9ybfzh@>Xu?qd@S%_4VE+QbY z7P<1JoqPE_LQ8a4tC!)x(D<)aqt#qHq0q0PX~)sR!TQ83Wup-vMwxpNdB#H3H*sMj zd0|wVgOp+&s>M3Ow?y?%6xUZS%)S<57wQenPfu5h;RU~F8T`Wh)MC<64HfK@c@8-p zK(Bh|&|S@IYR!hVx@1q;0A-+5QGBprvHoR7djD~kSS|hLyFW?StKp^6%u|P4z8L5O zX_N;2+WlT^Ps&6>0Q$Mwt@NGl-|oeALj%vpm*KgjnNB?u^;Es47A^~ z|K<9cceFY$5?V~?{qi~YqW=m0#{L>cJ|Vw%{Q_CXM@6NEeQJSaRMmc92~m0e^on6E zbN{NtRX2?$s8h^H$}?zqOaB#v3K6eJI|kPr1GF-uE4yI$GV7>b8g&Er+(4Am;(YFJ z>a50|o;{m@`hq(FmNGoSx`H=4k=b+m6HfjzTQN$Duc4s2-oExQYXlFbh?5T8%>%^? zyS!I2SiNGDR-4&7X!3en|09@Pi@z!f77>>POV8=@wy}WbHlHe%NZ=4rB(~N zTJn2k4=%F0hM&m|{2fQ2&O`rfEY&v~FhDQr+ z|De{B3PE659)pk0Lm6KlLHFt0dF~WZ&O;G_k6H+uJ~$C8j6? zMv6kv#|REXcL8J!QJgApYZ4_M1{focrg2UG18A{nwh<0&a2AU-LI0C;XahOxZ9UVbS@ zdv{;h;|VNX*UP{R6q+c-qPCE+LHn$Dt;kU1hR_=y3lC6=>7JcCC)J|IpE8&piS^Z& zxT9ncJT*_bp>7Wo#&@*8G9ANZ?oSj69KQV~b_Op;MzCPhQXVut@`>Zu3y}WfwEbpo zCg8lNvWY#=`KF{LUQUlMIBD2P$4^UizuaiCYwx%;(wjsrY@0@=>e6?YOfO;Jw9&TA z^mek0$F##UZR(`Ox3mFXK>|)(CQk5|6x-8Uuyo`1fKFTh;Zmv!TEuY#ovbMLL@`a5 zjZr#(=1LMydVKJ~6Y@vL976F)6Z4MJ4pVV{j`|CkTE1?~M^XLr&@k^;MdFzuWulpn zK*br6OI2XHU-U^q6hDad2^qrE(x7~b3S>J9A$$QVP%E)N0}n z*29eGT-&g2mv18r!#ZqyC|Nb2u(>0}Sji6A{u6=Fl>W}oZ!G_as=R*jzcbA088UGV z!>2(;_}d$V_M(g7#*lII=ICGCV=ZS>lg$JN64R<7-BsV4s716q$gs#7%e~-v%ZAwJ z6U8AoI=f5XqME?WENY;nOf_EnB^ z8zKk)#Y^{LA zVt@b0xU_Ys^b)+b(Ix|{)eP;}=c5j|Wa2m!D7Z;95-=jSb-sgURKktF06FNQUaKe3In69NMH zw`daJ5m4GT>Eb=?0-&w)d&01oWai~w_5@Nc$`x_lpRZ60VqhCU2QZ2-)c<0yqdwNOT9f^Q+4OL=|Hh zUFQ290a?Aiy6DZUYWBSgd)>KXr_ zgI}Ab!cBe$Jn6i~SZoPDJBot(7g@%u^i1Vmc?lb|CBwzGYGz7$I$p8r$?0tagwQgX z?!IKIWMAjjXm>j9Z42JuTUOTh4fJsBcUENVAN&{uht`_!F|h{&q(I?mVCPE=&9W=?v<$`8pvL_fc7g6ltnJD1Cy zEwm?jjNp?BQN?wH!@^1CDT$}ChceA@q-VwH>I9NzhCRRdBj68%(AzT}{xb;++tW#= zUD(KS^@Wq&U{d1YN=X5AOx9+)KaKP{2sp{rGr?aEei4|_&iLQwC}pcVDNSeDrj)yS zsp{8;Xm$tO4>%O<>sHq#%HPQoE(Tnd2v<7kc>L;aAE~bl2?*D!Q1L`TkNG-3YGs8? zx0xiQP=mc1N;Xa7U!N=yGZ8LiWc@6NA{0osDOcLXATgva2Bvz4II}{_a+@oRY*sXv z(ssP@^GVDk=I}I_G0nrc5*Rxju#a8gs?B)Wls(2z*$*H5%IO%>CD5Oo^f1IV1Nx?# z+&s7~{;7TZNmb+9e}TNno~w9oFCQ<#kbJM7p5ia?ncREi!pA!0qBCFk5#9&wwiqK< zW?ySK^C1#N8r~1{X@Ic=QM)v*0>B(}sgfMo*&mQierw>)ngf5@p_bFP^A}B)rl(vJ z7yAzJ88Fn?VXM@(6IJnfO?q6}B?!`R6qraJM}hVM>b>Mp8)~<(S|^wRn~HWrDiYmD zAE&b>SMIMTkK{I7os=CW_T1o6TUCgbIGOZ0O!S#_j&O*twP}cc0Ksf=hV(XD3w9?q zRvGIt^6|6Q&3-?b)gcz@9H^!0V`@a{rt{)ljRA%ov**0FDj3D^_de_i6KTm8$oiJ0 zW&64u)ZXG)x79GW6Hx%U>`*w3axw34vj{%#gih^l72##^$GiDG(J!tksQ$$}soOV> zPwEsl`h>SvgUn5vN7sg_SA&i$LxF&itYDVm;M3DW&CN32e&;bKEyhFtb7w3cEUJ22 ztd5&oH~jh$@97S8vSV)V_9#_1I-cQ|F?jc%qK=WlM-AK`!x5~TMS_{vh zbr|x9{!vwOIUeA#1CHTH93!diRl~|B*i%H!-Jj|5&}YM`u5@faAa}bzzN@=aGLr|? z;4UCjxtQh1unf5*qJFo`7qHd66ik3kkhDVg6%EQQP%Lse`0emie&(F}=zU?)dWE_u zeDs;HxTv3EAH~*RNLWU6R>!Kkr9zZJA$uvIH@0G;1sTH_z*&KQ>v10qE@V32$5(~Q`5=RN+)oZm`>{=Uoe;KKxFMwX}w(zxw%Wura|`CC9jeGlNm5{>1WP> zht+^{sw{y7CrsY>Uai6q3M8f2RKhXt8<+sW#6XH(romUmhines#?7Lqp|F+7!LKMa zazQXS$t_v6w}8)EiFeehgeKXa+QOV4cG&D2+P&m$=_(Bt9z_ z)mpT2UTM(A{T$L8YRqn<(wpQr*c03q?)QH3o>GOvVAZ7?Y&NH5AU8lftA&F{_)7kH z(Wm%MoZmh}mA5Lpir1(T3ba~0qkudmEFcdE3ykE+RzW}hXGD)uQw<1f5qXY?N~LGv zrP6zYN~L4|QuZ{gw4YN(tfqvgQGv05D?3ntQ2{O}$eK8=AH&ptC4d6~!Sh+xv&ex1*$9NA`$!kBjg1ZKeAVIhiJfg(Dok{6fjelTrk6QBcqo+fI&=_)24< z+vU}lT~O+Lp@Nl-llz(^pSRsV$gY=!Vr=X>=N#9#_y~$!Od*_h3S1WqR$Ls%jXc>tKvt zldVDH&;<0L__P76soFnYdZ;p9ddMWB*2)Z+{Nf(+ao*@K~J?povY5@7peGsLA71|p$k=)GCPl5chIr{zMVU_=$A zMP;NcsPzoG*n+eZN=B@>skRfBUTVGBPDo+0+eJ6>wfv4tTfX-h7gpLV~kU|z&m5vfV7-ZH78smO^x+3?6YwWd&M`bs4|tyId2*`{vb zqx9mSapsQR4K-(XPB4$F%8Oq&XMTCdX5wA6fQ)_obEpvgPV{{e#rI;+M_KPnkFY-7 zOCDXF4{ElMicM=DW~T4GVv4C;o8PYh1} z;Tk!0I_0At82C7u!dYI|l-+)HSK-7p*ENUhs|y_}IcL@xQp+1lH=gN_w3e65s|;(& zI|+Yfa+-9`6puNwdC!J(pV(ApbOjuGi^H7i^{4sw-#>pxQ#d&sR9ZY#s`9sFr=tz% zkhp7Gy14!n@+I*(MfE7LAOEl?HFdG|5&Q#Eg2%3jxE6~|oRJ3?qI?y@389eWRL9}1yp9(KY6W+gq+E_ z6`O06;<1lKsRwNUg7$&8$-4r`2dOy2j78PSO^pK=vJ~M}j`NP6l3qC@M{jbOQoTvZ zUOL7>ag1$7r&;SvNffo=oX1WtQ7958WmK)5n=4aj^g3x~$@hT{Y(#I0Ixuf$q?zb| zHx#k2f1FE2T}TTWU`O3t^ug73_?xMIgsTVFJ{MHNJF`n8J9Vn-$fC)W>9f+goU%w6 zmtK}$Ha_c9|C}jc;^h0L&M-}vO&7PhBlVzC+WQ}tK4)b7I`4hs2$e_?YhL6!5?wUe zknTaMr&u{%p`3Ii3bzu^_dql9M(YQ$5ktcYKAbeB^XC`HiSPWzK6;9aZznTa-vNsQ_6XTJ~1`VJ-H*2w9#M|R64~* zXJ%D;T2+=aDMuya%vxPa@sROghJNI-0LnAV7UuW5tHV{R8nUwHoz=KVVRBiLeet9< zi&bisOz$u!1#~)%BBgHK68xht+2S%Orj^exawq21jw`Ou)0>?mRfjGS){%<|s7|q* z_@r&H7T+jafkLPRJu3R7-pVqpahDKJw1m80t%SUnvV{0BCB&sEAxj8C*>t7OmKNx2 zX@Sm`ywhxHfzBpw4{T;?H6^KTK|hW-ERJd5)(U&{GekRbM09#8kNadM^?D*|R?tC8 z?u|O8=}FnWQL!*N1`(Z}QD^!iJxiGB!-ot*HbNZPBK}5&DbY$k!9MxA1sxa7Ps>|! z+2UC{A_}XQcs{B-CvB~+1V0D-o{9bmk=j%zb8|M%m^Wib-;(u@oHMy*5~pGBOdqHL z4`<1iNcGuW;PFh#1?jeebgu)CKa2{{XQFh+Wsk2MziK>hAwHtTM?Su2@n?{Cs%8-B z(vM|}zCU;xKkTax-yY`32Z;9(AF@D@93(;VgT%N-q}2Hrh`jy&jAyqCmkQhg0ly+( zK}gJgJ2cJlS(|>fp3|#7OPnDc!3}>tl)9SlgsDR$el}YifPj$kZ1gm-j!^d7;CJdB zpGA@0sOJp4K2h~qG?98j;wQ&Qxz?el+&?*kAf7s2918`1U8-{+mQ=gCKGHcgTdUB> zc@AvX_<3t0{~v4b0T{C~!cQw{cV=ha z%zW*A-}~C3Pake-nR|TuzK6EPKSf@DZR_SXA3+dd@4$8I6God+rnTxcdRDEnTJ&u< zEZlJPOSg1)9r?(F{??O;!JV)bHWplbowyUshAr6LXeG$RK?M^jmUc;xw-@zyyQJXT zCBn7Cit1Gr!G*=|WOXnjFR0Ad_u4}Fs+?z#%b^Ld2I@bt3#r#c9Wn*OOtO5vGB1E5 zt3r7}Iu=c3HJQtN0jUD%J=ss zn(|$_+QC4M8$4QW)F40=ZJP@zq%Wpkt`VJeFv#G%INA&v&L+U|`dxVejM&wb7m8!j zN0(bW2&7jtdKl)NLE0?o0aq}Rm?j_~ppn!ak?Ww~;AND8QKYJ>&21wI{!8Li@THZA zsn~Gml&vupHET&+#(Qk=yJ&x|FTCyE4Ux~Api$M@-W~2d(bYE5xSCN#eVrr$@~pLE z4OhhG)~P$!MJbs~rj#qy%D1w>5WeNd=<6{Z_Bi%Ogzu9l4?Pa?eD=haE&Y?*;ip6T zLz$QgDhG;wPyZqCI)N<^j;y=x&YMp>o_j3+zMk3bC-QgZt{L1rIGO7n%&3$xs!9vd z)HFncxARrNl3t{U8qu?yk~Bu7Af(ZMF_1DklWu|*)`0Df&xNE?{NYNwQF{RB&Vro0X5Euap3d4y}t1Pl)nkJ z36h_CtxxCEVd+#tp5NFzo*T|*di;k*FPPABt1>3qu)ePoLBR}oSF5SG15yQya(;N1Z5t065 z3-76=OJ;`Xa4THx1ZbrrT6Ukc-znhID>D0XnQS^;%(}-?cg;VgKL#e_YFs9 zPv-8+-`ulf!)*SB+`hr7!J(YlmL3caRsqzUxApTqy?MGQyrCQ5N}~I6!Rc*ZS4q{5o4dlSOQ4gdhV|`WSXl^Lq((9?r*RyneE;MLG%>Uv=E?=aPmur6Z+KVs0 z04c&Wnrj)#3*h+r%Dlj4i)TPCf6;a^RFoj*tuvw`z zhn=plNuj$67JBz~nJNQzB|{Ma6}&Cz=x!opHY@dQM+lA(ayWukg~A$qqxx#_6lYJl zLaE{`yvHGv%Yb~gTSSP`uOWz@z)mAR9T|yV2jMthIaMhDwd&A0WhHo}-B8q?*c?am zUT16ix*SW>ok#QAdpGAM@_jvVPdeY3OAQu*U7GiRV7*ubd2to)1;m%4$j$n}P+2h6 z_M>?Lj@CDk7vOlE>AX-HaoJ1=PPAQo+c>!jdZ<P2n%H{msos#}nWrg^J@iot={@l=^sIAKCJbc(U-I#FHPy zzK(eE)?24Pum$qpejmWqA%LqgoukuYe|g)e!4?I9kJxgW4itwnB@m7FG#CnhvOc9Y3 zNEsjn*6g)8<1Y3caJMu;uB3?Xtd8Y32XjS2VRbAd6h_7XN~t49-Z86-x)%L1(2);` z6+7m;x{__Vui$^j)?!8?gfUnEXj{qsN!bD+oa2+=wbs8tjAb3x>4~+C`5nEvwfX7X zn!&bQ#UK+?_Qml|#^;*r#Wn{9WF)x5&rq||$%LlS7jZ|E1TCFHf z$*RTwA>ElAg=m6)4U5le@tL4s<4gFgS}E5f?+MEk?kFOYkjqq6bycRf)}ZUck_JuB z!M$&OZxw%rVpYe%u0MEb8U>TIgZ}q-a!XwSW{4 zsa31H*xuEu#WGm{2x+B$zAB}P6h=M)WX1@#2gwY#+ux&vbIgd<52qDFI+Yyg(dRS0 zesMv=nxl(~T}g+2u_OVE13ejiUI0fI7ckKAmXe{o%tn54e2J0* zL}~jAz?;{KRco?}@$ssp+pR)yJG(WRY&n3|C9d641p(>o$+jE@fZWx)CATR**i+?i z$@k>y2g@M3#C#>Nii;8exV)q#dk**P0sw}i3~tH`aGai&yihihWjU9<6M(;azM_9o zWFAsv9^*gAJOE*lGNab||ByRYSws|9D*ixy9{Cs^MEY>HA1*_vcl!NU?arO*o{1C& zC9R25uYnqmam!FPm&!FYnc{gzZ$GBan{o_t7}kjDa3&+pmH>|zAR2YW1k6)g&;T}} zG=d|Z7vLBsbzVTDSR@3B!^Duh-QW{seQ7OHL7cKvOT z#VRxhG&b-G--K1i!q?}7+>s;IyYlOL*W_~fhMwE(+Hk%)=N&W*-UY1}Suv=sX30d& zh$}~BQ301P9R;M3*X_y+aO?&!(V@|+!+Aj*Uv?L=Y-FX#x0)rBwV2gNy+aFiH5|V) z)HAu|V7vjX z<9?0k!vN@mp*EEx^y<7iwkok~n4Y?8LsYAkc7qep?(J8mAy}iJ4%oN%kl)1Gur=5g z+=L{wQ5WxpaRR+^HTdV@^!Q+JDzmWoH|SW+ND%_y{g>z9R~gwb_?XqOI(%^0PO(*F zN+yH;Yz}#0pUrB(hj>b6x64v-3VLp{wa|4t0WUG(;lODV6~U|uya(AT8QIwXWA*rN zjmE8wfsyKNi$Rw~YSI z6SXLAzh+=(o1HxBcLz2k*IYMV=``sQE`Neh65iIy=C;{&)xqp!t+%Z)Wwj1gwr&jt zr#gmiSQ}T!y@l5{@AfqIMJ9K-8*-PXn=*vl8jnVd?VZl5HWXI^=;JZ+-?3Jp`P_xP z?=`LwC`~Y}7VCjg3Yv%$8*A*VX&Z4-{&v^~Hr@|xUGl7d(DEuRqD}M|BHQ`p3rI$w z=pjwnnQ?gPyb$mA!;`ZL!9Pe_UKMBwDWd;Rw2y8*NO z>(0TQ(R6?vy6wqrN1nc|mk%~a4=BWh9Yx`JOt}6BYbUDOMeJRUr4y`FMYzr{vH9 z98{`HD+VT~#gf9-IP&8tgwo-nGOBwEcg@NLee&^TE9xh@#5qwfD@G#s-q*MB>h6^C z@Z+L~guw1td>tR9lb8|nVxJZ(3j2rshy0{TilARsT}zMNf4QOxmsoY{8Db7|V8$zz zbCtku1fV>pbi=7 zvP+j;5fCd$0nCPUk3=>vfVcIoHUK9i4Ult61*F0D zHkZGvZ_7A@+T>88FTGM4yi@~>BGiIoNg%xVGAEWkQI!T5f+L(0;1K@wszTwpnpkn5 zw~`B&rL8qA0iz5jblGR}y|sHjwx@b}xY{fu2#QuRifH$auFU3Em#@30KQwu5ud6tt z8)6+vd%CqNTvP!seG}lZBG%koL3F|Ya7z>#yn$!61}$#~Lc@%N#hyl zmBIEakjR4&bul$29amOrN~HZ#%_)ddrPYenBp@Fo06xw{+hWkbUY*t9L)8n5-$CfAmcj|EAwJdU z9fcECKSP8uAEuVDdga>oVA8Oe;&BWjS)4pfJ{2A5bM%y!ywEb&1u$JCITR;X^UI>_ zg9X^ikG4pMzwM$KQjzZyOG`|*uar*sTDcT=tw}ur7loFlj@1`(in0?x)QF9i z>e3%Vb?H|xySBs=NXGUQW$aQN`kr?uXqWC)yes-UK+hV%T?o&19jwQWdZvU><-jm1 z8#p_L_gvl|L#(b^)<@%&lAhplnPBZ>SB+T78`bni<-C!)09UZikHDIhBW;(rDG`Ug ztewd-_}_rS!r{#6f&KuB@^0^M>xnn^#Rsir)KXqbIW5)01(u;ypAKprsOz@<)BsdG z=7oX&b~Kt+SUy~loTO?HS5rln4Fw!@PmDglU-F@d~~2Uu;H3M_mb}7Pp{BjF5j~>pI*Ce*p_UMRCiVAfl@PA z)c*k1Yp?}`bymbW{3oe`D=~Y84k<8c&86bFqDF`sRFw6m!2fn$QVNllr;PVkSOa}U zbU~|XsapZJ3`6!)qGG5L%FYp86mN--<>0@vYFGmFBSUYY8ZHAS0OD4t8NxiYp93hu zsw2-MI65*>Jfg#+Jghq!QsW^x9+Ke|sAT0T^}&C+YJG5M+_;iTTv=9l+_Sv!_|t?E z)+0X8Vnee4oz?{$Kh5_07jQy~nuWP(5?GU^a^h3PAF=ESJ}02T69xa?CzYm}XGbK+IGbO$Ct8{)4<=|2a2xx{F#Ux3TE{WLO*Yu@-(B;sxAk(qT7RLfD7C5I6-~SAE83#Q!P}oa)_u#47Co@-3LhSy zXxVWB+0Q4D{S2XdUX<(rylzztvT01IE+&{FaU6p=85LMcB*e0=ZLdgO+lt-Xie1~3 zS*0=9r)rJ4DJ}uwW9x5(IT_p#R9{xl$tb2|6wk9IQ0%R(pKC-Z8R*<)DH%(pAKt!= zt$>{FHpogL(ly)f-xBHR?yZ1*1`Vs3)P?yXWbup9w4W{JW-Pa&|12hFh#{{fE1LK; z%EuPtPG{@z5G#@GQhOwcd|8RESxCORvZBq9jxigc>R?t8>kqL;PoHrRlcqAH`oxy( zm(jv`LE3yMtlZS{f8RF9fqmawZ&VbQcRoCQSDGh_|O=+jb8*r*A5+}Er zT)aY|kQ)+%4VRv}Tpr$5-xX#_xl*an!g^ezi+SP&0FyqP6ZOXAKxSZg;HH5m2k5f0 z?0=EUu_Hojhv~ce73JDdnRfiAS+`i59aUwAWGj_shbb0NGTNWU|AN|sD4`0e&Z?v$ zwIMKGM*XCkP$z!YpnR1d;kWX$JSmo7{|T&<-f#M?C=g1;*QL_yQ?TH5S?TpMYdafk zNc>FTm9GjI&+#6f)RI#9^`D^H>;1Ipw?$D=D!dMJTi#9Wb>fB8^sQ^EHgs2+loYJ3 z9?Pt6tmvw-hqEK=Mzi7Q*zvJIt|@AiktB+T@YVMvE3#2zBs;clJR8Qf-2$Kzv(*rA z>w%JQ_t3?Ru8gx9_BeZo!6*=iK>Y zJ&l|9^$ff^HZrz#Y<7%Hj3vf4q@EA$>)-I(o}oL~yft?Zw0acctW}==$H4{HG;+4R zctIzwwCcnVf9~h7{FPW-qxN|2m^&|s7aAJ?m>J{7JYxVe=vw<5lrnmNR;V<$wABLCMta2=dmrjFTuAG}9eo7)vhHacFc|3gVIz09M-h195=*0@j4x zgXCuv<&--&uP2QZVUUC`bFG9hYk}?4=UO=h& zVCcL6jx}e^n!I4n$*Rj;KrtJ4F|(|8?`1BYD`1T{Am=>Mgt=!&)_J3dv-cEDuHQh9 zH-L6SuQ}i_$Y}+=+}$F=`YMhR1S9GV`Z{a}b`t4GW9{uVJ5uoBt!o^i8mz_#UYdzD zJ95+0Oe(Y{Kap#I-b-a}sB+MeGv%3HN$G)pH0a&}khvgv&n`+C4#;iBN<&Pn$qN%X zaTJXp4#Sx80@GX6fS|h!js#`eaz~dm9bdtBef2cjB9O@@f9^n^uM_5?Avb5N3VE@f z7k!)mUYxE9u`;k;83*L~rBpTKw$iDtkl0r4iCod7cGFx>DZbH6sN4|&^W*gtBbA0*5ulA&CQ-%RgTC_Xk+=hoDMQ- zaAAT{$m$;xn#7dl|q9QpUO>tAiZ>YH`61Ws2*xzp3vndG083k`POl)gR?=D zg+jN6Mmy?4CR3=cW0c1BOdmgZ{NNsC{_fseaz}HWVcT?m53B@2ot_wiVZ>)!hDv#_ zBK~SbuMof-lt|+IUgpv-V$y~NzFV0WN<;6N&I@~T6TJwP6GJU<{BweI0kQ5wOmyjI zr1H{lCv$dn)_L0uRfhhO_g}V^q7{tHi2U$wwv>CT^NODR$}()qcyD+W>X38Zx1KoWD<8M?URt8%Ba~ zU(G)4zNx8wTGGA-MqzbS!*$NnLHjtIcg#D6a)WKT>Rc@5X{>4_8iz4^KA5AR2rx>j zq9gz^;#?0UC!!%lJgA%O4m6ZYSQ-m!^Z=8P1Q0>+{yxFiEgQ9bV* z`)@-a<2%by%)753ahFg`bUMu_f(zFAPL`3)l29QNSBTQN8WOK8(aXbp03J`mIuGQ( zmR1binOa;GhE`b^T4iC_aVLxx6T%!?#Kr%9PPA{`k|yVtG&%78H)IjR4`)!LdC5d} zOLm_dWt-{aePI=C?F%g6^ir{h@>ZWEGfiAsP)H|e188Aksl>yIO4_9g4=Y@A^-G>P z@-dmtX*4@|X6RwGG+1=EnUlGyw&UG0gBv>A6r~lzYuBx5*?rG8!dLR6{qOLW&fvs4 z;@FZ`6Ll;ij{_)H;u@)H_~PHPX1KuaM*Vt%Zrmk)aN#Bi8b;~eu(a%s-gTuOaf^S< zHoyjRJRailFo#EI+!p~mT77uHhkN12j291haSz(-!2=#V%;ML0aW5=Spx});uLs!6 zUf2go0hDYntSbSxAilhCd^K#+8tL<@Y<;T1rJgU~2a8RimBpC&i+baT*nu5`V)nC` z7w2enAr-h#X$-M0U<|OEB%EcXMw?|TJ;e%$E`mIc6C_c%h-yW;B33O`c!8o}$49f% zuUAk7ihP4m>b-Wei!kgoGOC`>EjQ9{I1p&bKtP+qv=K&*dth5`xqeeO`+|9Q4q2nOfGu$wDh`WiS zxU9~U<5GRWzNY&s@k;nzC0yCy^rqbI%4;i$Zm`!pi1f$rLzqup$Yd@8n2VTMYFH(< ztP+0^O0v%OK9+NH@KTgoyiOKfXrvM+(M5FNBB9FqN`e5SN{N>N82dgfloQ(muLShZ z=_zrQjwzw8SjSQ<`nd`g%RbV#Q*`04q{bX^xht${^2-GAB&o4QUG6a0D*PSDHlUw6 zd_eL15kY)|Q0M^9xpi{l2L%2Sq0oD67AM5C%)l<;nRvfKap}ks)>(s0p#n&kX#mm{ z3V?JN90$AcT8dkQTnQ*33OI8BP(TuULZpCd00kaapn;Mt0cBcq0=EEOI0vgMT5z)@ zy-dYjCR_nIr2_iy;5jWA-ss2cRk+Fn-6IgsDphq=v=6q7>f=i;5V6BpveaD+GLFbQ zu#0i|;mb;g77JgKs}>F|D;wG=*N5FMzfnc~@CTI2=yN!OJg&ekg}=&iec0pl81ft_kq2DUH_ z;O0rQT9@0Es#%lk9lZj$4pB(SnDx^;#mVz-@4uuE~a58zES&xVz7))b}X| zs9|hCa^u0?V=+;jK(PW#>y;lQIp-iKyrc+;20d)*9I7pq*VT(@Xa*UPx{j%?v3Yoc zIicXl!dK;7z~%B86f};Le`9!`#}VL}!dZ@|)dnq|rgTbjv(ciZNja;zlptQxt7teU zLP;@+VZ;x}^H@x*ZT=;U15av#z2ict-)9mWQ>*Aw5Q-qbfD>n|IW~;kG6SU|qf-~B zV2^71>7W%Ja#jGx&|%RHGw=>8jJgQo2aH@Rzx0yP4k;dgf8i!h54$-Nl!{l&;J(5! z{8MsZ5A?vIq7JW5Ycg3mVxKn%3pO)a6YtSl%r@@Q!!pi}5m*=Tbs|gKu{hR*y$|VZ zGGo&MzJ4Bqk=6_NWY) z=v~kgd`JK%Cye(CSb|IZF+r+HaDK%8kPw+uHasYxF(f~LRQ+?Q_l@t0l|Ppj*UAfj z5?Q;;YYR>_RSwjua*a;gyrZ>iDs8)SEYcj()l^ny0>po-)hbO@ zFlwsIR3y6NCcnMHq0t$6ze8_uS)BDl$(z+Ck0~4ugaNDs0IQEOdMt!BV4D%Fl4Gn~y}uyJ(FWGcI{(e?q2yCx9qNk)33 z{u(z&{uP zu_|m#>Z}!908h*+jgL5eA7baoM=K+b$&QL0=~10_v5i*Nn5jP!NZ)+9C)f57#_&6 zIO)dLKnyQuCie{DcdP?*gcZmlq>She2fuxix``hkaf=GIh1 zdZz37o&j^D)&*sHfcO^vG~>YPvGr&jTBpObrUiT=%U6Va@`tMq`W`VoQgO&}M0*IW zU*yHak=JT2hzSRVD*3}g)xiqiBSM7<{E0`Rg@|&OdTDLcv|1ij{ZcLg{xm@`Boi}3 zYwws^t5IFcXzd0gK=v9HkWXvO)%`W*YNLWC=>OE}l!QiYuW&Y698OCi15i&v{NrD< zI31SyhOs)ETp`yOFcPc4|4QrxJllc|Vwp!Jpa;EJ}s4eeetKTvZq+;^JP>qJX@WnP72@x#?g}kX5_#n z)au;*0=mjC(N*fR_Y3ekfTTRQhAg{~1sM`j1vzl3828*%EM2O_bM+Yd`pZJ-!Jq8% z5PF7@wuqe?#eh!hZChXGZqz9?AQs5 z+|*!?+BHqJj+kAOs7v1Ew+wW}n*1#F6RSxdvm|mgHjP?o=5!W*n22AMsI@WIn~WD8DsGq0KNXQc+jtsCsu{qi z1pNkz#LkM;Yr=mF9u5PK2#br@=B?Z;daj=@b@+h+(zbJgHH*Fik7IiQ(uMxAdv7R< z{QNV`+Kk0JHriNPanrI;zItG-3vpzwKPeIcs>7z6Q!qbe|W*8x2)1K+RYPWu3FM;ZcD`bS>TPlJmG; z^ext}e&aZ%i|6W12@|+Km7GzqMm`vjv35Ot7_~2%^!gJ?FY$cUntB%_ld1Kb!%Wg- zJWbSI_B0|j%>Zhu#U|miw5zac{JpTd834EmJlI*FB`Wa+*y9XFV$M1a@I|_k$V%*T zhT^Nsk0^`PEU7l+D&*9#6ssxIn@q%vOy@9}9K3@5-b$L9r<6Jy3a3$MpZJzaUPfH; z!hfzpSiT=IN`{0_EH~($D!i&=#V5x82Rw0Eg!_hhC3gTlRWZW-fcONfQqljcysxGE zSh}{vspKnQ-tEB-B2KOMgUR-EqJ@Wq;=p>q%xh3;Pqoi^PNnBs>Z3KY(Ie(E=t^;p z$(PgM7XsMa4*0fxF6}ubEI(mIB;!@Mc;z;vC^3xARLbpr1w0s{rrJ7BXM|yGdZV3{ z)ztYqN^EZR`^`1e)qU$M_Ea)yXG$b7%t18es)+kZpaR9AK zsYh0TUy^HD%%OcMJQpx~W{Ut4BMYHaL!i-ywND9UN0h}8UIiLUPY)&9afnboc+~nv ze{ZA+1gqa`t=XDt9;;p^&HCUYoxJRk(8B;p)(v#7Pk^V<1FcKy&1%5!f&I#WmZ?x$ zA7PwEPqZ?$u7r!rZJo?? ztF5vkVlEOOtu=8zTWY3d$=1omBR!Eo3felobHg!(-f1XYqG1;+2Ix_F$esX2)m6#i z{m9md)qXjifVK{>3c&NtLWx~O*Cf;im%>%Di1?*mE9wod@;rPt zjD==_+NQh^p7XIr*R1i#QoP!07sQI~ny~VMu=M@gh*A^TO>B*ge-{{cv|I(IFBWK1 zrgF(*sR;S?TCYh4tdZ~W7OjkCXq6@6EPQ4;zxBE!W;rEiw6NDt2k~`051t|;*7E%l zmd4kf^;CK))z$@kUDk=IEAIbg^&hK=>iP$)X*xKky#HDLJ3PUg9-xnwcO08q-f}D( ztgg6U5SvE_>mLx%xxDgz6d(qqB~P0kkSJU%a*P^}O|2deR$o_J+N73Qy#ONlKxVSe z)0}Xt8IqP!N@t`#7;md+>&rwv>CqZjDr{5H;2WAT1(NO>V0!dtD#&YN9dV0_Wz}Y* zMz5wh9qS7_yk>JGTNiGLnG|Y`5`4p}X$_}|+FX8%DTq2}`vJV3q(6bxh&Is~%c?a0CY65L$ks!va=J;CcIxkMrX~l zo~KGCeyKfy*#1g7K<#;|%(yS9Gs|uJGAEO1nU9IM(dyTkHFVX^RP$)Hi2?eu!OAfW zX>TrCoN7wOd<~j9@IgjoUZ(KP-o9iU7mC~9ncT#;fpurV!cyNdofjy+chBp+axc&< zHfB{akJqcQ&1#Ndv*HwqTaz{mwAxF3%Szvi6QooE2q<60RedrPTE3`HxD9qzPEt>k zN`ueg@EeunGc>K>90rp^$B+*Y*b$hy);K3R5a+3vzD+XiMt=43pRqQM>Tr^Oyw-fZ1A+uz(k4R;d^8 z_syGBNtJQ|KM!m}k6#s?^{Z&-EMHQh5E#E+MkFPh9clFC$Co)LaFaBFhh?H~qP9UF z4oP4$ODergMvTxn=doE_dO303dq@S)>}?*7`NAg|ob}kOPF_wPJwnP^yV2%m3FhO( zs|vM@A^svs~p|EURU65_p*RAm9qSQtF%bN z-NNxo_LaY*HlT9Wpplu37A4DaDtypp*Me=G*{XLK3iGta0Ch-=Jdd)dRhSx!6#IJ5 z%`*xT)?fblMbWgHSCCm$PuceKi%Tp1qG5}V7L$|I5y?M2k1MNk9{o~ zd&i2gcU)oYfy#7aMJ(MIE1ac+4Y6oLBN+PvM&QcDzu-Tmr-7;)#eygTlMdR4I9PV= zXRs{kIXaj{+i+pwXD^g1aAc^IQo3A4$G;4$SfkOQlkvFR=y%xtM!8mDjkw)Wi$Y(n#@#N``lZ_KVz*<)UB+^SMp;}Ej>#XSBbwFTW_qsZ+hVh85I zj70jJimL$kyB7mD%Uvj166fH~tR42)w88z$jPTkk-Sk5;z=;^Ty-cAn z1)PqMS)nk89L|7Af!D!qBqaDpEUGyrO{-Y-n;vJ_qEcDHPG`ibR9Yi|rYj0R$B$sY z#O#<8%~dM11LIzVH8akrvfwk2*0zh13rr>xWp9JNbSp=IPRHLvYxGte9V$z} zW(}BCA9U9y;?@@+`#>izuD{vtftI)jYVn0%;O{3N0ybAtgwv^j;Td8WX!RIz{H)R) ztD;#fc@f+Of)lKbc^2*jqS2DH!TqaPTm0%b_QwcFz>G8$kd;HQ6dW3Jwl`;wmIKK1<;2EA-{Hyc~VXQ{%`)XJqj-OY$ z{MJF51)Ov-a}k9@K{UgCSr)Mq*nNe&Uxwq$?tA6-<@X!$iaP*F+SF=W9ANhmaF+)G zc2!tZyhmnX@!4}~d$R_BDuVMV1^yHzze1FR|mnWLrxD{vGH|Cc42Nl!F!I zG5iR99iSPzL^Hi$EQw@#i{s$$kYebNJC%%EUXZC#Tz~@C-(>UX7)IxTQEe6E_rNv3 zPcY;rYzo{1Uib~Eq`v}q&5WLmqcIdb4L?{=n4wv^w3K8l`wXQqIE_}Xj$()@N~3of ztsWgkzoud3luV=7Fvm5l0$kXD`fs@xYl$<|_us+z&yp%IzQw~+B>qP*WjMgKc#{4c zYzoUjy?z+AhXoP@j^B;X6A7Xf1GBx@$4REjQy6sKKtRq@s=NR@FP6M9B1Vv#IiceV z(>m~j|C3w;tjE8HUG7lG#qc%&r*5JPjC+xgk%xg6eIJGcshOt;;zn?#kl006ruq`@ zz?Lp{ic&4$j#F2<9!2Q&Z)Ws5ou2%ff&~_OeaP<*1^o)%zPPyf7h)2O{tCd$QA_|= z`+MO*3R|>b8mtn@XiTR39R(BV#cO3%n37WxW>T4@h7qL{!;Z?XX`(QWf3ua>>3H(r zIKJ?b-{bQ8d}vkuj>4z$|DoTD`9-eF8c7%sLc#!5dXuLsV$pmTf0|4b($=*LQ#Tv$?sS{^)zVDTW~#CDIaZ0C)HsaED&3Q=9>HV$_&U%BO(u zXW^adV6#LRu!7l?;vL6oq+5nNq+5nuRE#UB*VWY$CH>8$!++yw9IYqSdYjJX)Zp~y z>FH^T;2dV7gO?M#j}g|npZ)N=yJ$H>&?;X2@A#*G@Dl#%=M|h1+$}?0EDVGDU0?VL z(M8{k4U7F{vzkoC`AxlEUi*_!|4-zAN|It5^j73y(`Pbz=QjoLeW>;)LP*~K6G0B? zCMmW*Z!HD*N=6q93n;?5zP_&L*Qt?`c4WvAXFwg%jc6eSenoUq3N@p%>pR!i=y-oa z7^<64CiM5|Q|mhPRvpkSDN3P{M=d_1ii>vD)^QnW&&;BESj^)-43OQ^>X4V+0U!>QEB_8fu+LCQ4}G;~z}8vRFi)+e2y}Uh`oJd( zpLz0B;a~n)$t!7ScdY&VlV>(h%|G=oYiU3(v=Uauy8+zY)9CJML~eBB?>TK`v1bS! zro(8k!P=DQ_Q1_?;{AagmgHM7pNqtwHdl635-Olc*jyT%>hH@9QY7m%1KU$hRCFXP z_{*EmJo$NWGl2cTJwAc2KlLO&@kxbNNs|<~-G6y%9!Tsv7AYXnehVb%jo1{}z5#6i z25sMjw%0G(0e}7sY~PBukAdx-X!|xa6Ml?%jNCxq4RomnM4?(rqWWh}=iRelJ1 zU`r$GW5pL1^bN8S85zTb!+H~(`5W{yCKL{Z8XCgzsq4*VG6Z!28QD;80epMo$7CdKV>q);XJHw$(g1J3puh`vE!$TWT6stCQ=xkKJ`T($6oxJS zo_5py*jj84b^?13CLk;;`;OGQuCs2Gu?Jyor8Ps*D4T|DJ-dc>{2#Wb7!iWfztOx~ zI(`j2;kh zdZTayD!EY%4I_)m;RzBPfD5kd?!HJm$W=@|uxH|yb+ORe+opUY8#YxMJQlT#b6ZVr zgF^4EcEvlBZlzME0(_+Q*bG(Kb?J(!y+=ATb6W@NoOqaZ$K8F~TkOU}Pjy{i(sb0{ zwW~9_rZ;P^-Mw`(SkoER6<)^IHEf^SP+31Q*zIqd+mH(NY;SGews})cbaLZ{h`oDg zBpOhHX@!un8f&AldpZ)Ra;XWq#cFl2O1akGlJGS}&8BGE@HUdLH@5b~qTShSz*!fy z*yAmiBDL!?e%={1$7i<9Bs`f+mb^p4AGJu`f(>9>usQ5-vCc=wo&z+cY;7I2Iuca< z;8%zSOo|DS# zr+fESFW_~jTK9_CST90+1N=c>HcGa_I z`U9?>!|OUewAmG)d8ftfHpuJa<1>1o!Z0{NsRL$xv~{v8v}NDn#+e7V)!=?;yLWA< z*0H{HMYOHLc-Y-M**tiAs&>n|;b6SkqbYnJkHyD^2SdJ&)&^^bFjNs}pQwus4-Q59 z?&t~cZSVu-oF?R2wQKx+nbvAtVX^3~oI;^exEhk4+MuC&-BIEejX&P#^EOt+O}3=Z zV2adVI$xQqchy89Ljyw*drfsU@l6TmvIS-lVEcCLVeAp?H8BH!*UiT_P;2+D9k`Y~ zvOpxy&pbdY+o*vLK10N?y+9tt&fKwa2C(ECSv5Pe_YRi5WA6+#V1EXG1&d>~xIAky z9He(WKps5aro5Tj5C*S}_x|bNBcs>;E3UvcV(qvZhzY2ZKth1)P7rzKG$#f(h?!l0 z8qyL?z>j>9Fish27r-T)g5h9x-aLFDS20+Lma0KEi=b6 zmAeidYi`(-32gep>mR@2>mQ!$^Be6Zjlp6uFe<&@YpvdT-~acg`@f1;y*L-?-_<(t zc-9`a>*df>g#(4s8LM-Se)s6USFi0nzISblx1wh{mFV4NNyl+Q$g-MpW@x@Q{U9+KH3EkJg ztWc+CZe8b&^2?D4XmfiJE7H5GNr6gyJ0-qGqqc&+3?Y8duu0;-geJT zv*AMvclPsoUdEbvt&UYI4F>JR6TkjI?Ol(4{6lx`Y#P4rKc3BYMcc>LkGlIucz-%f zjzNkjTw?C0{n#|N4cm_W2hw@A_4Z6}#TM`rSxwJOu5azut>Y~|A8f?A^o)2*8osoWW0v_zFHR@w z2dhlkJHB)OUC-Y?)nGEG#&39HfA_J;G{iHoYZ$I=<~^NXDg6D3K4;IhXW#hr6F7cq zI=bopeg23^PGt&rW=Mwj+FV`@LE~XkV~KhKF`Jq^LEMK&-uO3M-L~y`+im~(&`9Ue zM?Zgleg8ez&U6PkJtxyzc#Tf0Q5p2wZD0K32X_7F+h^|?p8R6r(q|^V_}&eaOr!k7 zXBj0!F={)q(EU?bJPVzUw{LK_>c_Y1LP%tq(b7S8x1azuv z(=UV-=UU26j-hj5b@rm(>?g%&V)&`JFz79PDkXF3i;if0G1AE^eS(e<6Ad=O6Dc&Z z+agCV82!rUa25x)?v25ttdJ|Ex$8*J*(HVcSms>t z(PRo=DgW%=TA0TNp`GCbIQU;Ggbf2m`T@kjIos$+JC(IB;NLnQ3?-5cRIqUY|MvN; zhNcFo0WI8bv5t**P?k>cIU65H1+$g`g<`;x4W<~ZqG#t|L;J5rlGI3o9{rUqq_K^F zm#2BBXODi*l~9N$i`m`D;{0F!4`CP%JktIv0gY@M{gtp{=&N9uDIyqrC@%aqcuSv3 zSS@~N5F;pMGH+3k%ZljzUmbhWcL&7S!)~16A!>CD?kfBSY;jI;%Y7%S)3J~E?uCba z*yT-{9RT5O-0CFUNwbrqaL4Ve?$U>SxXnxa+~+9#(c$%ZUoYbD^`%cQ{a0=pR&cr%?A!1r&rz#CQ9a{QSaZ#{oa1AM<_;hKiifx+v>hmH(K0)y9%4;>wj z5c&h(_|V3&2fuMlfbS1{rlze<4V5_+hhwZ9FhEB65S zwqZxbbs7_~_gpFnURZj8xP4yb@uUH_q_c`f-b6Bq%^c8^n@%xPD47e!wDZX7S@O2d zgEJE76qQgshk+-Z7Qk63xeLap^T@W5GQ6Zh?!hHPMM4i#vUp^0O`N=kRu%qav~?Ysc$KJ@vr0Orv+IBk=&~3+ zR=whtmaQY*-f%Wy^MpM>f|;}?PQwL!mhj-Ap4x4Duj%=!LhR}~S}2g$1NdyjJ}AN` zMf7DgBkLj~9g&fdNC&BPE)aXqV_JQyzSRO`i6yHXSeIDz`RIYomId5;ik=ZmY$fw) zPAu$%!l%SkeO(&C>>N6K0G+N8*7*{P0vdpZBLLE!k?LtBV^T$}E7e?v&|At4Tbh+G zho{j+lGisM{@kJNBO4mkGMa==ZB^~qq3(|DUB1fk>j!U8vkHoqv#QySy?tR@-AG;Y zw*DG03(F{ik{g@X9ms6Fdt=Zduoi8b+BL(p$dtUcD#x_7KmP0%%C2Ladn7L`;DklPhl zLW(y`c)10FnGaJG7GEIf^QIW*-ITD07jW}gZc4e8n!=>^G_cG%AV=r|gj{uAJdlG& zo)e@)EmHp(sl+;vo26ukx)L=OtK{;~A?L@vRE=KuZ8=PX_v&Sr7F0S70~@2^f1?fF zxZ7Xt(tevY74{H?IR5=!U+^WFT29k)wd^H0MH<`=2S>ImpestwD&BmbpA5cP5G#yf zHIU8P(?UUEahS;Z?QHIVzd-}8mt>0P6B1|EG0lmZGb`mayRz(~1g%)ovaOj`*rq1sFPfU-0?ql!W-J;Oyc&ANgtb#j8hlidp+g@AZmdg+j3M@%VHh*NK=hx% z%rw7%x16zURBc6Ff20I8NGGRh8~kowKwqL}KFf*_AhlfN1d$BL8%bKh6sj4m#c%h9 zIGn+Md+8zQmo(^zKWL3AhI~oqwAr+8T!dmn1{0m=QIsSL5{71RCYi>f4wdPhE<`g(mWvUbHJOY(cIhd;G%`^V>6qeBOJ zTBfqz>Yb17+V;VzgtvXVxp#IT^5Y}>_8+mQH?;0N81r}U?#^t@xbM2-raSS$b+>Jd zM@O$4Zr!zhz~}BB*<9ZV49?`}fwuZBYjbXY|GF*2%-Wf4>%yI_X;gT;9NLc@cCr*kO3;;RAW3PE0+pV z&M~5YU$y`y6d4o=fc`5t%PffgWiu=3pIRvr8kQFxT@hPPE*PrEkAH49I?`3GR|3OG zu86da*Uh|dW1O(H53a8|aB^d~R`}GB>mT11dD7Q8lWm`Faafx+bqu~A|MvLjKmNX5 zElN(WciLeF1+c*eZv50{)@jl-?Rwwn`p2&A+4xWYee~uhg=E$6&f4ag&LE2S$pK3G z#!8*A8|j4INGCLlI-z-0ozPs=3C-_FCnUd7Eqvj|TRyuZT6N$HH{Sf&ozbT(t$RoN z_q01LE$H1v=mbe8Jn$UU3BP&c#3P3?P5U04klq2uei5+3$Ehfo*G5H-jS{vj%e#0L zcwrX3&c7)NIMYznuzm*A!(y>I_z36qx-2+^fyXQS)ee=g|c1ri)s0gpT@ zfJ2$OWvXL&7yIRUW2j8cp;oAkkI_IU>SsAHh)wrd9V>LIky>$@E*U^o6q84a9D^ z0Kj0Ps4Z3#{aMYL@z9!VXw8~XmehhdeIL*koB3wmRFAa9zVXUMkB9EtYt?19o@F z?Q2_?s-Ij^6n)vrhG?$d?E{J;Yd7&`omv|R*q0PVS?%b4C<{Db2K+BcQ=DGX6wQ*R zi2oUAic0UMuss1epMv@ymxtxl8FUZG^fIJ=LK}$ z<#tE8y|$Xs;bX3-G(OyO^C_W4SX;-z1O>TDrmX1Qo9mn%O@v2JtZ$tNA*HbuT4@Gd z!Rha-I`pYS>C<~Yai~dWwP-ZFjn~rSnZ!+{nb3IT>`@4ZsnwidIr`w$PC)a)a`sGR~ zt5a!My%wpZyms*B&q`|PJzJZ$bOfMUddnC0#;Znm0-$XNJozM`ROfQ7)CjcF-DfZ( zt%F*rWmT=zqC;A#<*Hg~DMXHZ5-Ft#nl%S(z7S6^_$!wl)a!vt`ll(@fDWoJe z2B_s}q>naWy|`5Ks2&z#@Q2gGASd zR~3(`DwcRF--BAkR4oAQ*J_BMD7pwLASZqHfNvuUge7Z(x-kGZY<>X$K`prv9n%P_ ziW!~wP$N1~+6hl=e46OQu*Db8K(bvT<7dwpq<2nw7dx*!I}ZcmI$-@KB^;xp3Jls& zyy=eOO?OB)-2s`0SHdbr%DPrM4pj8+Wh%NBPykFk?f8OUW25aZeow;}BoHOTqr`$RH*KUdA^R7-xl z|4|O#8w_3p07$7;r|CTUxoz%P_1KBtfsY<&g<;h#pK1ksAB(OViPsD@1r;V2vg%{d zH-EAm;g@5CUyc#J`jloAAiVk{Gk!6`R|CQyMF?LF`gHvLBmAFKPCqia?=z{=s;Nh& z(C-sDZ9`Sf$tGX8ZKxXkQkG-ixwE_By7MQFedmtu#C6}kXZGW}a;o;+w+()CtM}Z8 zT#;OOhx~~sOn8Z^%&f2ev=`6%Hk@`O8MI8W@C~H)5EoA=(WGy~nH0W*blx{EG3P6s z1VH{oZtz&lZlmUEi{#S3DfDK$&f;bz7Ad!lTT1UbCZ|+RGizp*qK`^s+$U2| zzioii^F_r(4KXR;^ufg$-{ZoJZ~UnelQ=Sprh7|IipRL=-pWf)_r?>l6juUG_Lc%- zALA!`D_5TEEx-I^uL&wCRY@0aQX5rbMy^wRuX$66!CcrBDe14zm!ZSgD3O#cTRT`f zaCL94tzmZS=gFVw*jCo2lZgQ{8eLYi>ZRt%E!|#Ub%Dk1vq@NoL1kc7T9?yU&^1yS zADOv%sN`)e?aeHmm<{Fo$dAxNR4eUg6l{6LK zSnt#4HAYJ|wG^U*@DV|^9UpG+SOJFFqK!Fu zEfK3&Z8f0vd0VU{*HfNrvH5I_+N#$WwJMFvVemH%)fI1ODwNYqUgKuy)u9XT($|Xu z08nH6tZvM!IY(YN6J{79dX9WJp)rN+vA0EqUaeN{P0DxUkE)}(N`%*!fc1nHkb3Ox zR904tkQV^Euq<|YwCW;L~5p_X&UDjt+*tyIs#&k<%HyzqP40!XNlm=eCZ zelUaCt2oSFagNj`lm&Ia0--1vv1G~9CEz+PpiOz|ewD&S7|RklTGaO|AobA2)4Qlo zviu37mX?_Z24VwEg(|TK>kE0fvZthRSHgYb23wBbtu-5LHuASpybD|@OYc{iZBE^` zJBLfjfsNO1iz--yT*2D(Xv;EdVm%e>3U_Ux8QS6|zu>S-@kD}Nmi{eClVtw7DUgYY z3%{dxgElG#yO`qUdBGeSgn3>=LQg2mUXMidjN6?EysaNi{DoKfyvzAzQ@!R$+3P7j zyFT!CN*&A8{tald=-?6P@e_xef%jUO^-?7uxP?fKhQewGO?k#G} zTRYk2r;O!Io#9PKd&7?mjyY?q<3?Bc`gnY8v4!mKzHVo^w|>ji4V`VbAD`-rNfa8b z)q*~GmMi5|gGZW`CRQHpo$c8+CSy(N;p^A?eAR1_97Qj@L#vk}>INQB*CIsCg2p{< z8By$B0a2rSfT+>Ul@N7&DWX;*hXd(3k=o?9dc!P3es1AymepygJJH7%^pA87t6BN( z;|lyqjaEUAhXMh#mV;(^yMUMDz)OUvyNEe%hBro0c!rnCn&GW@mNJ4dZ=_6sAuAed zOJg}=CjS-dXxl41bA@9gmQV8+fyUQUIJ?C5c1p66#t<#n7)z&rvk)TZ(5qV= zZW{m4NZ#7Iuv#ppL=rh83stU(b?xg6Ql^T=j^O5N`oghYckXJP?5hc~54$RRisNhI z)}f@UwkA$h*57#T+@?~cR;!R}bSk4wEmEH!+90~(<{U}1cCjpBQRrdp zn|R8f%w^x=@fO+}FprHM+8&@!_)(68JOz2g>{}Uxm9nnga%#Uzlz4tHI{y#q;9G=2vhw zzY5#@NZl`eJ|;3^dF#Dwex!=C`M$berf?C)^49yd`75pIVx!N`&lOhhdtk6;XKS7U z9TX}8qwlNP+EBHnozIF{?;Kn>^$>F#7-qSi4S^{vAc-_e>#q807mdvikVc*pvBS_31Nc zHV&*lkx4qel3&5LfB?TK{69bxOx z4ZVS2%^GCocR(*`Sh|{<;8%0&_|@Ff)3z0@yp6N+w#!=itkv8GXbh8{VN_t|ePOMb z{OrOXfwLl3O?_C!$}@)kQH4^%8+y6kuH#HSO{@q0tpWb|i6Wvwu=IK41wuyzfO~R> z%I(lWkQP5n(V&uRC_2GPi)+fGc>ysUe#Jam|0?|+mR`th4!@EzkJ9z8rs!psUc92A z7hir&cg;7xviZcWVt3v4y0V^9d;Z27wr#nlH@s(G-Hv+qH@EEAzSS7%DjOK^*eeFA zOS_9KdnWhpA&qx_*xNYL6kFd`YqwN3bQe?)x95eLx0McDA9K_+uO)v|zh+IsRT9lN zhlbKde`RsZW{wtD`?}Wm@V2Usm-hi~_6NjVcS=pvB57BL8-L~VNh)417`41E$rkos zyj;mky07t9cnP=S^;E&A#PYgez~BGkt!Vk;ZJjo^W$!&hxgFIZt&9>Y(1yUSqV?15 ze$o)H@66kIbd9%g`|X3BQ~l*W^+R@`SH;>QqdwYI(K<<0Hr{%CcA!|M)~c*dgH;1k zqN*CarUil6NdHW0$1&UwCa)_R2Fo3+S({VXQR46md-@nJf`vpUCp$(e3S#1>qNfPC z?HnmTrRfX6&q-#0x8L)>;P$s@(A_gBO&{9%AwQLZ440bUFQjx%k_;iea$aX%ZOw@Xh zf>yfBI=r0^##bbAeJAYZ1IpGBR|#`FTNmecu6bI)R#bA+I}tp+(}$*aa!!i-v!{2K zug5;k6+)9d5q^@V4^Q&soJv8->`9)L7H9SEV^bemovjcy^}VxcyqtBwsHtjKdsGf> zW+<_Yts0o9+i~0Wh^g(meJ@f`v_RXbbLeFft;=L^nawIvzU}TShVt{*RQY^iuatEf z)n-<$4F+tb+pcV>JACI8`(Ksmcn_WQA)r#$DsB9t*`6&~tF#KdO8aLtYtv_fOI|GB z?<%c=Tc!Oop7!ZOtF(%Y;Qpg$ehyXce{_Gt)W%9y%FrscBHlC6Ds1RGB&^a-W;XN< zc9y94nIC=W#>s}QH!p7JBloPoWvtrZ@~Bk?m&tE;FW=9nk@ymu%F%v4U#=G&NTxFD zG&*m<9_^oPs~ulosi2tRer`YCJ0cNd!1!-;5&x+K{P*|MCcHumgywNwuYAKLA>e6l zl~$2Zq_T3agaWg?5M6RtpU9wlL2AIOwbF&xGrRg;U<}@f%U|SHzo6HnU42{0&y&Y; z-07boJ1IhEt9a3tXuaEEXQ{WODjB!2?}uLM)rBrz%Jwj7z<~#Zxu5wA4lK^h{S+i* zk-9%4P`BQ)RJ1Mu1#uZAK*2v_D7YT2)h?B%4~z!Ii!(rYhhP1kbx}3?lpC~)Jf|ty zc9}hXtlJZ`pk03CXZC((vQld{E0lVNL2K1Y%?^vNX-{X}j#{?}Z}ii6Ju)3$v%Qa^ zNV0V3CKxO5JN+mz{T#u2qM?rf-Lg>71|9{KA`}E;pu*F(^@1FOz+T#LTCvQ>dx;J;0CzK_f@%2^o}#%Gb#$0(*XfE4h|iB7F|8>JxH8URYq~Fi0>9gCHL@ zc>NN&rqTX_bMd5Ibd8*!b)JNG0Y%AmAbcPBP#i{dO{7BLh|vxur3axtKdTF!>@?a(U2~0Z`tZEW8}!`>^^t9yUD*PJb|6A;A&aCy$|9t8iZHc{5VecI;3VV-7Ou7E z$u$Y&8!iM{LdX$W1}RFlf**EV(vC{n`R)KPvhXZ+g@rZ{ok7|~&5OO7?@4OJZapwh zU7di->I8P7R88V;!FLaCN5%&Lqu7BK_JQ_tX72^YrVzpKR8U#yNbPD;L4Q!Fy6Cg+ z|C2q1lvt{-+Ax{O-cv|UZ@y!++~{5}zT%LozKFPtG3eg9= zdXSVz{~V82C8a%RuSN_I$oDz4O5)Q=5>?3YT_G7RAOm4C5F&#PGGr(HSbYX9WYA28 zOk~JNh72UY2oRD0Lk2`-zMaInRLAMkLX!m|CZu9bycnS0r-Az>Mcj4WH6LM%# zw@2r-z#rr{4;eu%I&Mq*EX5LGLd0oO5g0Jk?M2wZ9^4j*V$sXPXx`6SKJOVEedqlm z{$1?(%l`Yvf^GWyXltZ_b6>siA4;u?L1$``-(&Qy0++YQrM;Uqra#4j?I~|4{RhFl zBni;NWznNGeOiZ(Qepsczxxe8_3sN+-0sLX==%UQ))DV=IyGEQhRYDn2+>%lKE(DX2ic!VescGxC#zViMXh9QIu>ovblN=4 zW0?(_i(sGMpb2=H-=PV3`2~#ihoPrEiLw5lIGxObj+L`svYXX%7~wa(62x$WA!tZVbN`IT+Rutc$ALK_Szs5a8pBo|b7%~@o@5~F4AvxKMl$8gOq!~=2 zO0b5`D~rg=qK=~RB09f_1hWWZRzj`z5NH7(D>812;ThBus*&x3qSXk`=}_^xYO<`l zwR*Ig4pfuX=cxRIIvON{i9dNflCn4R(4a`l4~qC%PrPXsx&@Gs-#1&F-8Z0jBs3lv zDxn>3Flx%f!zF2ExOCYm(aUXlD-(9S<*#ojFv!r3H$_fuZ^`@E@z!;MdZz!ePu#k@ zTA|hH+%}U<&1iHQ^gW9^Ry}&6@1p%~rPV{t!9v8Vc50sb5%X(GB4Pj;eiTyt)Om7_ z`8P-r^C?}_OVk+7BjHmTpwwoZBIQ$p)OqSG^D{`1@hL5kr=R%|q{#V{t&s8nE~Vg8 zilNjloJW~?*F1GU&ZFW}njz&noTBDa*3)WuP8+0X_>_(G5$cfWHArFklwDLOIV_%n z6dj+k2~xJ<6g^786h^XavJ*qIfeXyd`)x6|25|DMSeiOmeL$z{9jAK zEn#RCym)A}Wcru-QMmW&felyngmTuS-*w>+*`mz_#VvVyd#pLXxH(_<#clWOsVp74 zcjuOS_f(aQ-J9&2Y;uO%cQ?SVBh0N;j8X15MJ_$GkEg%9H~F;xPrNg z|Eimt0Or5y)}Kk?TbZxAnal0)o0ID7=y-q0y=t8ttx8Isp%s8^4OW%toCF<%A(ly~ z*&YccN1xEDMx-kFM~Z8G z@B^3Mqy zq3+B}m~8ENPkz_+a~I`uF|n^U95Ox63luiS`IRf|*RyxJ@}5i)F0G3)(NL@*_SICw zA;$E4M&Nk6TNzv7+nTcFFt{vh=T!y+ixC8-Hs`OKX^nQ5d(bSbTq*VxH|2KsT8i3Z z?dSw#bQ(fS-=><{Kz)%HhMg46C=06FLv`D0oom7g8 za%a?|6{}$+WKfD5t0QH4v)w# z-0X3*HgAc1l}CS9$gjHG+Pp;@`D!XF>oTDD{=T81OQ^F-)d8s%cLH(xadh4;#Yn`Y z6F3{NI&!Sa0}6Heb?TjW%{IqJ1RoF|5kdPjR--{qJ}s6&ngon!j)(kc8qbBafYkI; z^?(t#318406L#Z~FC{dD+V^Gjo%Ih24_dyuC?d<;o#?B4Uq;_o7nc1XRd|rGd^KAn z@?#(D8yVi857l4TH`D5GC=Dq^A{zO}l2~)=qv3{##gN}t5{lb&8oh~}0jw-itI|K# zM=Y(oTYN={p(ejn&C2C4j0OxK(dg6~Us;YP=2lB}CUTA0AXS^yPR|*NbXRXcIAAN# z-~s445hB6O#Gee8pCkYIjND?8N6(Q@Cd`DKh->52AL3;EiM%|<_Z)ku<||p$*uH<+ z8hl>-i4+2lLqm{}DwQT9Yg92( zsU+C2vB=;IBsSOjO8t6^p=C>%*%T}R$tZ?CunQ!^&3V;B9tQrz?XM%>1gvAEbw98j zR9v-u#yKIQZMq+%@U6@3t>aN0wTq^uqV&&cbO^S?qoK)2`Zkr47R$xt?*Z8{lt^vV z=@bhemdeDS^i@)7*6jebFJ)9_yuU7&x*vGwCJKle;wWb=L*(Oxmhg~|C*(GT)24+W zEqsjE6K;?keg+6yMGuP z-L;`1AXcd5a-~M$GbxnvU}B(H#;TJ{PKVsxtV z5qzrhHRx1j^3l^qx8gdYetz*-{ox~ir^L@F#sjZq_` z{H1u7*XAkW7jq}Uw7yE#303uK~hN?e$>^k6N z#f3joN$S2uG@sBJ2$x)IC9O|tj=DhuJ;@x04hBjGI@ecU{wj~=pG;|vGX5u1aP$3s ztwSY!t$W)$b~n1c&3il6?M>KDXuV}Yf849pLpyRx+$yqd&5_N;k&RdPbR6CiFWY)$ zN5#e}r=y~;qIqkn(N*0C6fL^&4tXtgH=y|n0nI;|kYhOiuHz_kYzdZ6$Pt)-H-&Fp z_I#!clD}5U+KtHVJVNp!5CC`e*>8Q$rNOw z<4>j_PX^NmKM1C`spRQlr3M}Otx#MaEOx2NBEHhF4aT1g&8Wkr4St}koz3ki-$^>v zs#1p)Fuh)5)M;c_`s0xTYq(geN3fJN7_#c8EQ`mzseIdw>7TUU=xJ$tF zrxU97HG%f3Kzn#Y1xevKD8iU)-G#zytNW-JNcwx*L z)xNPG{ufr!mwk}~Picxhl5*!hloFo67#ndvTDO1#B+Zov53oc7T= zUwu5N5zAy!M_x^yzsRl8h3g6$C34PTUqf4GywVxZb&5qW5Flwr9w=)HRrHqI_5Ko9 zPHnE~3x%C=r%cUitv0((!>YAbFKZ6iRE*M~*60dbL8Ml*;w2%9>vr zbQb42r6OAn-dAq8@D5c=-G;IL$RgIiLBRS)6FO7a?v9X=M|cc>M1E`$?(bi5FYY6$ zti10N@9VShK8^5xty0m&J4}|O{}0+?L5d{e-_mNc-{J^cev7>zvK8AMIB` z4!`z`Ks#woI<1`CBa(0~9n-UBvL*dJ0%N*AQhMq}qJrB&{{^CmJbE@z5GYXE&w*rF z2qo$>pNGMn7UbiJ+^gLt()371Js||Je;M+3#Xp~d{JGI5Qn^<%rbjaR>au4lg_Zz+ z(-PdT&+QsdXr5Xci)3X+*(|#*ST4U`5UdQ+&RR}!_p+)X1f?x?6*vU;M zIWYTCpn)89qz7|y7_Eo&d>&ME1zGX%N;Jrzpq$u)Dafz!d>-lSiia;jgUk%uifBKS z4fYFtjXP_achx#w9anBOgeJj&p5AO?i6Ky|%Enx5RvFw8q`w(6|a6&V0N2 zmBPOIV1CbR$C~ShDjA7F!D_VzrAQ(XyW%Y&oxxq&SyWo7*A#a~%{os$k_aD2zXl{? z@hckg`#j2jHK8Poj8;eLp0Hf4Kq3#qz69wr7Tpsmd~XTT7f#X4{)h%%LP?poX@wr0 z6QZR=B$NK8LZwoWXJsl0P4%e^tWKU*BK0qlDW&8Eo6}{X6-L1LLEu?2@C@y&Z4!Lf z<&oDB1|mRShrXfla^KJtKTAG}cGi-QC3Nz_az+~_!=JMrbvKX=4`wm&61W};Si_%7 zS&uRe4`y+&av1|JiR{tY&r3d^DWi%#jU&yCg9(o@RN;5Ud^&sej;4mK6}I-8mcEZg zYO0D#YYaiVmeu-7eC8ZCD{~a*G?qS=(^Bj(YIIcDIgonbr9q<$j=;2Pl>YQqGNNt@-E3$IcK+B~gl` z-0XG3aOXjXgF(XnPzW1}hn5R@Hqv)gJ(z;*q1Z#I5EzArmdp4>uE>|qD_`V;*yC=$ zVv{4D=TO3kRA%u}%Ln-?X#VaYF0Pci8fr8ih5-laR_(FM6>^a5u+HEtZO@Bv!e3e588xt;e49PjsbbMwas_n-m1LZhM1-8q-3Tc~ z)G_i}#tJD$KBb1bk+R`DCO)MQN@;P5nNKlL$EaGy04Wwer5N()84!7ql~0L5N+B*~ z<5PT4N`v#*`II2!DaLsme2O1ZJUGRPQV8-w*M*P2YnKBWKX+ zXG*HG>vfO@F_nx#a|3W!X9xM;K~~Tor#tZIsgCn$1%oHW7fCrGB3SslbO?pLPRY-p zK@^L2H@)9+6#a3tWZQ;PQd3&Zv?5$3Hp3!u8r7Ee^?X(UF*fC zpPMySVBL$@!`&IUNHEx^+{?V@GjS+P^3a(q!$%cMNYX{aBjg&zyT6qy(NrGInps++ zQZ5{(u2E^E^rx+E6(uHbXF>t3L#Lw16ADYz=`$+C>940>kSL6PyfRGepwEfCFyiHE zqH}1)nVP^wLcCZLZt^CB;z<(ezp^runFQ5$P9&C#-~GKpi+ok671Z?$N1+y=!L%Wh#h5ZeM7^K?C(z zAHn7*=82clkwzLrJ7NBo?}t9hhY#Q|wEH52_SO9DFa8w%fmQnHJo<_iI~q1CL|_^y znlF{m_}o6q$Yd3?K*^muw%efa&h5C7AtH>tb(YsrxM4`M<2HvQR9Sf$QJ#@s=FIi! z-`*w>GkQRsI<=U(699*1VM?slS+%U55le0(4cGr2ZAk}_R7$AFuO?+DBwB-&)v`1r zUf8d)npnGbVZWH6A<1gcKndB^Xmhp^Isl<1Mu{z=t)jJrgwPOX;87U)(;@1KHewyI zk=RL$5tGD0;wagTX*JQaJJp}6xZ-fl;hd@2f?3b5k-&(wy<6E$B$`Fd+F0BWPaU2e z=|+yJx<_UYrzDO|+boXG=>uyIG+ue6^+@raiLwdXmL0Agy50fP0992du9N3Q)R6;6 zCUy+eMIvjybTc}F?Zx8D{~=Kc-3KXwm{{>&t6w67CHDhX z5sSIsR~j!V4)ecy{@2X^3il<;u9yEVzb`Q@y$&vWzVJT!&dU9h19>e@`+g(qV1;^F{V6pt5?-$Xal+tA;)QSN(CjJ~fJ4LgcT z(m#}a1yEhhvnPb$!6mr6%SA5kB)A24cXtUEEV#S71$UR=65QS0-S(32|LxniRa^D8 zI0t%Wx_i2R-FOEt z>9X0+CizWQ)CXnfqwceTv{hstVkk`kn-m+}*>bZkP4}ucXgBDeaxV`(;AXXJ>d4w( z?iT|Wc*>>9qZZKXUsFtF<6USD=pv!w)pMn?^PYHR@_Q|fCB^t^9rkmJB{FqRSY0*M zLuSz|*QV@`5Ln`sNmNoe)muegP^LD`gc?_WRE+B_E+f`j=)NM*q3&s=$rJ0$Nce{_ zFis*56f(>L*E&g>6FK9@Aw6c&a-_W$@PK;A~qy zMt-iPiNE!u#rsh7C8E-Pm$>k0kD_8K@w;^STxoGd6M{_96(;DbI_fLvqAONUTP|+1f-F7dMIbPiqBZ%x~axI%9vbz;(O>I$l*CO$IWPu7RFjxIAwh z_m8Fb?(jE^wdoJ|n%?2#-WgneX7^5>Z79ExHjZp`Q|kR%zcF_}4|8>8=i%5-EeObG zeKFz|Urmxjp^*+L=+$(q?(5qo$!5(oG;X37k59Hy;$$STS^r9$#@ldd_><8#fjLu( zx#s!0|1wfR$dwCi5bqWkzoQf7@Dt`4c{?ig!DT|}o3?m$vvG@XdF+I7fON5KkipoY zvqMoYfoTQeN8EUOw0x_?KL*Eu`hoUeOSEFU-XJC+?gw;WIB6= zoSKBXdkc7Ao5%GO8>emF z^|6&|=o#nmnO@TbdisG>ZjWjrlowlj<5>3f!HO$ zGJ($f40|mNKrdkSB7u-wd=$r$zh+TymX|ZmJ1_wHzNw!!k+#EIn_5L+yw-eYGtxUP zx`bY=L5Er~z0in)wiemys;1DJJUY}&%!)Y*cL34<+wVW90e}|{1qyH`20xYqlg9e? zFVaF9ZN2JY3tcR2fy?d%94!d z)y933=Z^}VIavYBKp-?+klcC!x)PT3%NmI6UeL%js;}Pt_;}i z(2&CXEa`uRqjVMHc5uB}09RYM8J@TX7C)wchsmX3XUZpv9!r7q)70;ZT4}$m_T%yL zwJ0vlc^|!C1tb5)sEr7POb1pzU-sSSxmpZQS%bRb@j9D|n<6WqvaD#tPAH9sulJUW zY=kt%1muvtGojti)AjYBfR^1r!K6kJqsH}Z%&($cvb72UZpHzL-0_^}`myxH*BH{Z z;)j66ToZRTt*ooK%fri@XRN3LOD;g2-rB>IJwZf0m;<@ng79Bvq86=HGO^nXR3=VtOQc6N8rVV007FP|He$BTHh0})HAfJV~Na&TG;Kt^_z%KsxVP4qTEIQM9ET+ zh#<%tg3JVKTs_K^UHCgaXGzbn0(iz<0Tyvg+hu%XD;)J-u#PAara>CcQbNu_z z+_NaiPbsb6Or^|W=h#E~%4U)PF*aY~G3#b?Fgq9~QkXZpF>%G9@AI;z5QF;cBbM!d z4onbj=ZCR^HW@#=65Y9q9{|JI&8veL|DDW#r%vz>!CR zc(&+wiGZk6IedDW63}_BpxepGO`UnF;t#c`aS*V=p{&`gj5kX;^XdTr1gqsQl?;6PBxM0_>wt@8C(RzQ6R zc*@ldq&8T)z_y@q{3Mb>)<oYNtCgf`#C7IL2%=+&4qcQL)tQB@`Ll{GjYNzpBhzf6FaFT)FM^nQTWHEfG9L| zxw}R)vOrE9WYnxfNprgC@LIZx34LD7HH5RRDngV^uQAf1j)$^t?uv9h9|4%(G4fK~ zg|$8#4@y7O-QL2{EYA0kvzs(8w2~mnoex6@}Bl zUX{ot2ArXnS2#-UNQhZi1{^B{%1eyuaRfCn69im*;qb0cc~-M$jiUO5cRf_+-22rk z@MgfU-B-n~-PR6qb>R=mj8HaH(}&amBRs6cKe|QhFEpv61b>(hI#`!?=|hwZI0UAW z8h%Uo_gL0biz@v75W)lf<`Pgh$+u8$unHZ&*WS&8L@UV!SDhvLxy# z>cXC3ze?0%ewq2A`KVmeUxMKs`r0mHQhUg?#D!W zLu^N)8>(iUNz+HTFWkpL(NG?COIo!}Wav8R(uW)@SWZ72okK;hV%W1NC(`iuaYEHM z^=Usj=L%j>hxZs8fg_t)iqTIBp5>5^k(Dh8t!`T~1XqlIwK2*IUQq~iAJs=MEq}b0 zMBHx-AeXkjWEM0ACplhbd?w8iy6AuaGqrB^%gSre?!9=FXnTHt@;bje zV$0QX3$TdUsWaGjK{vqW86(3JVHmIQ!MY(zu=PWUN3+z`rh`J$6m}vzRlxl>QJj7I$t zAK@0*BAe~mCT>aKam&temk~otzV&(bd{%BQvuax;E88%!};6Yds0h_!AxQ!V(HHB`isAxjS85GB`S*rc!^U)j=Nlr{0$) zAHb1Xl_E!`y)ko#E99676N;E$8&jN-wxMdCs@ks3L_JEUFbPet80m;VPK{VKQ)2OL zxz7i-GDtw>?1!5z@pC2yGr=2+C^Uko1<&q}-WVbSD5rlIv=XIg4B+psh?C$IH^N-n;tM@)yEI7wHf!W)O0tUZg@P|%-d-GM^#%2qN!dA6&4s`JWif@T5m9FTzn%P2*HW(aGr}7T{tXSz`17fV{VO?$3G*>L3~XS{}_Gv!4Cj zfPe}`wgDh5{Y;7PhtRhTn~5q9x2N4vW`m>EC;G$l z4Q~z~p;_YHGG_hCRK2&?xJc;IN^?hpN%e29_^PbztUTg8W(+{Ljhu8_<5g~K9Y%2^ z!r9}#q4e+7$deW4+I}5?ZI;u~M25gbr(kcneRWs~a(<_0@_5mRvwGLJAAK0q5eZo- zh6$iUIXtKo#-v*}wdj=sB%-b3EvA1`X0V&>3|%Rt&R8_dW|IV!L;24b=Q*D!<18EJ zZo`C$Y{P#ObG3*n%WD>a1|M#bwJ^&hQ0x-_Y}|o|AX&ZEZn%ZnjLC%EU>AC*P&}oq zT*2;HU(1$wa(p?5`Cud#qMo2QlQ30Tx@twWFzJr#R+lcNb}ZH~T=ArNAfQp#Ry}OW z)@`at&5Xm=K6LtgzDVzpY8|K^_=RzXIE8{MI7LyE4YDz2ln?ir;+nb^4CChHTKW+y zGqQMs3CcHsQE!O&TdGdTG-NVD5G$d~kLPaZNu&Pwb9z=-LL^1}0551Rhb0<6RA6rG zql7xV%cqlM(CK#SqO#hOA;L$r2mv^f9~1&Usi$hpWO)3JpY?mxooHsEG%B7?fhoF% z3YlJ~n%21HMX<8CVGmtJXSiE{^MZ<<$*W10wl5ycBEbE`5f7CYH=r@;XE-B@so<4k zSD8gXV!K$N=qfj5M7?OHKt)C|2<$C1on@z*tZY=w|(J4>i&7Lz3vkSUrf&R2TX3_BY{WojXpJsXS_>d$7TI{H|?a%9Lw+cc|7NAn0N z`e4rS0ipcQ8gy329)$S_FE&Fr8&VMVY`Dc3OT47V>tu>U3mWS%Vd6^yXytKzMX5K5 z-nV86cM5KcSt=#eWFbqq1gJxfZ}a<|?R^R9@w3?MO6fXHqc$I`rSiwP|r5^gtxKSj!X_ZWD{G1`Ro*(2X(E*4g!ERA6 zg8eytE{^j}gqGR9P&l%e#iS_Fp^(i?bp2qQ>W3PQe?T0rP)@QoQIk_NYN9$nN^?<| z8OcS5*#e$kXF=pO4LXY`eSmmVL|e!>KA;B@vQ~h^(1J((*k{p*4@r(iqfD{!nL^ zs`u<<2bRw`4`o`K6P8pzE-Gl@QlQpDv|c&=l}^vM8%HR{?IMTXnDl z=T-)Km9vgO#vY$wfZfzqY+l>)2cz@~s^n^vVEPx==2xa(k4oMvAKoq8+-z=K5X$!p?OFZyi5VNnyLrkb((?6yf^A`g$bHCft4F78Lt99U=uUq$+X9MVY zCrTB^t+;i_kjwLsvE!yS_bB`x4=)=7TU@t+fJ^_Kg?5G+k~bNk$TiJ4i=vY=a?M8~ z^kdwVsz#;1ZAP-qSwalM_A|Opz%#1hnqMI3ShtaaYwbF*u2oIB1I4-7CJFmA1?94+ zd;OVJ&?5d)_KuoEFg1%ur;J%+2UBYX%Tj6mW79x}A#rCof@$4eH9a!aF7iUcfa ziXn7M?2@Z*;#xkjY^dVjzuBHVO8bwpgiEacY5uxHb>299wNZecvKKkyDlRrReP>OH zB-T8X28RGItipO}u&S!OlEsW&D;-}DC0xpS2%t#UrkSnz8GeMrQA~Y65j75Dmq1e( zRD}Rfj2n2}H{}QG5%>sBEcjg1(TXu;qEUrfvOH~5zYu;vNIQ*spp&0r8_}@lnDM-F zHVBcOns489Z5-Zns1VywgaH=uIM8!&R0*xLi83T$L#i)wZP*)#Awbss(H{5{I*Z}6 zq9>%JvzoASn8+NmCH^l2mAwV55LNoBA2i(-4Yvr*l5{wAGQ#ZG;RpO!`U%1+F)nd7 zMb3jt5-Ag@yb^WQ#VzfEIm|Icn@w)xa$EOLB>NlM`x{LncQeC3@AV}cHz_|I0L2iB(?Y0i;c9{9S>8=vtkxJ&Iv?}JiW^l zlPunT@{Nyqs^HU{$*5?JRnOWkwL3xI6%pQEURn^LuPAeS%ou(O51Np<$T1IUbXp&L zC8EPon$XT|i07)b4c#u6$D;fm0B?Ax;9HW@-hj35r|+q^VX2yul@}q2CDWZthgCZSGWAE!*6ZWA8)j8DiWbbe@O=Fm<82z zn=w>oV05FTbD>3S+8V3f!@;@Z|L`DgZN~b<{fS@mQ{ScJ4_PdJz02f`ZNDZCTF;+I zpOxVfP7*i*ba|~`nvgA5G%H&eu-lIs&6znXoL7$9$GtKO1K_nM;5JCxTb?T*31A3d zyjYg)>;}wQIkyiTZrmUr`ut}7bnLUwJ-7MLa|-px;j>LUkbjbME<4M+w%j37~qwsmJTakBOF?_bD9t^>tF6|C0Tc7`sN%|y7d_0X!3OrUQ1Mq z!%4Em=J+*|t$*&>?qs%3M~$QL^zFL#hUb!>KwE=R8=-WA5Sg6;mh#~|v(3Vtf5C$w zfDg*=usXZmMu);P?`+D8@#aMi=7ojN@_;{}J1`Jo4fh;TYRh(~(+?GJ zZ7_&1_*twWqN%^Yg`Xz_>#gu&?W9TH=5=+vKtl1Ydc6ItDP%RIpOQW{V=!&dJLRV| zZ;MXLTlT^JHU1QTa&p>e^2@d6g67IHuLB|XI`4U@zpQrE-k%9t4xMkd-=0f!G;hv= zGWnjDH*D}E;8i3mj4SE|&vmqHoepLibY5ymdBtDt9nU5>el=~T zT=fS=wAr=db%pqyL4ddRfp6BC2TR$I!SFGJX;l8<}xy3$H zyhul+`f-R_({vpCyu;Vt=^oX_6SMig+15j!U%Ju3z3l$X+e6>5>LujSZQt#n|JWN( z8Ijqz)4M`Rz zz1sG&!fow$-oxEO)atG>uEnu(liM=4>U9@1LfA~$ea3g);_-O)u+)Zs$7iqeYOeaf zrImZ$4&|C~lzaYG}WTXr}?jt#l$|E}o2v?3v=sJu_{h6^Ex91w>DBoPiOl7sS0fD4xm z`nE-j^W?4^I(BZC0u!9Ex0O@I^GOe-ZLI&d+5zgO57lUYz6gOsTI4WH5Rlb@Yee=`| zzxwkrgoj!Y(>Nj0!EtvJFTIIV+=PK)XsBl*ITWM{$mL)cF{YW8%ldh5f8_Unnwt6b zt`X;;0VFhnoTT8c4u#-y;=T|){gfm!5n7gMt=opX7YskXpb?nH3g*a!+6X1eJ2=H zp2$NoTXDbvHb3e;-|H1lD})JfC!uNV{v8S?t5UlMvax8g+b(XDeDQM~Bpp)X3h2Ud z-S!A!t&fNd^$;tW0qSAGgVd_@<8B?%9NuVSgRN)U`Vw1+ z8TStdhFQ)Q(O`3xb$iXyyKbkCcWai`ffrM^8IdNAfZ7+;s zU|VX}i+1qp(u|eokPY>KIwlXOX>rmzaV#lj!d*|3IBAgB zU4Zl*dW^ZmraMf-)tXkwv_9V813;L^iUfdrpurLEt{?r>%`ZV!#zQHvMhF z>63PKe%dhtLo|(yh18{Yld|0fa9M|wp54!Cm9xUPaW5;4+LD@qJ~yo|a~)W7@0cAF zW^37rZGbY1dB$YtMtyMj9u}DGbZSHdbUQsToHWP zx+nXB5M-#(TCNs%I=mn#NW*9akFw{^!fQeS-(dT^n@2R*5jwSv#(y_iMgE=TS`rUYiE&|PQT<8=BAhA1eh&1N2nO7T5ibk>v?;oI9-Gf=%fLQ20x=k>8zK_ zNopQHES*{FZ0*o5R#kI!>Lk8FkUyAWgh|;qxRS|<6 zYa1V-Mg+-cY_T>b=CL>-Ki(*)xxXom)}L$A*3geCBx~pO3QF~Ry@~R{&FUhOGDNTp zmf?i0ckHK!Ixau}18Xe%kBzRG3m?R7;Xj6|)QN;5b)!*M^{HW}%Ibnn&P_h9O4FrO zo}`wP9M#q8x-bv6xf^14IY-4yAFKTiC3*1iJJ(z&0|EJ)3b{a~&4~zndrO3AKxw!x zy@#Cybe@|)=xuj8c%ymXwDA{M;RwFh?^q7zr1iolQ8p0ucFU~p8)xc`t6@%>v>RP> z`z7#~6#*vM)%3j-&k>le>V#tpp_y$^3N0HA0pmdu0Kp-sMzIU_GRUU8@&JY9FS-5= zA)3-p#4E988p0-pG$2&k&YzuMts!_?Ao!7H2-`X^`sa)f7l!6)!KYw&v3YA? z&8NdFVbHHrZ>ty?)WtH$v@?qO_N5@`+@Ezanm;l<08$_^r&Q zi&ML`NH~7Nz#{#)`y>PUJSylH=gswh z>QfBjf$leP@i5*EG*cHubUE*9%w<1jUd zJ?@CA&ddjYhLu5mK5~rvaR?DfMi38Ufg>>mKhsZKX5>UtMtCfFo9=sOn2EVN>b;r=t7L*qL3C-v)2k8b?72>~ej+2|XNdtmZde2^ zpA^78IMnghYCx}v>)kp)i4KT=ARRH94^_w-^NqZ<8E#Pc04xfoDvM4*v;D_)&6Gds zpqKxYhdeivBx^Mg3O!S3uqXD;*e~6dm1ciLvi6mmDgbdN!ve)(PeN4kf5XLcyV0poe;N`G4AUmu5 zTl#}sOlFRWS{*(0IoUY;nyciV24Rsi(k?WA6&e}^QEL9G*X;jr0WF`DoK8TvYpCQ3 zjw!vNHk0%LxOI-XPw}NgDt8RP;$}<22IQ=cbN9z97MRZhcFLnCr>1}S%@iXtD&po$ zsi-JP4L1bWn>-wW#S+mnc6yO*SL7g)e;7m)DU*Zvqhutuxsw&Z3E`BUHb8~s3kz(e zBcmjN?!SwWB?tZIEotnOfxII|KpM9jTP*zXZ++huNcWK;cRO;gTV6hKj-d-LkzL-{ zKNKQ3``XlhoRXF$*(gbNP*;i-ZiseA)?YuKK%tUlqr(8@jPp8Kxe(luZ*cZg4gMI5 z7-V7CqW|=u2oiXcCd&Dwzd}E-@MHs7@@IWyWc&P{C?+y`Q16dET8)3&PkdQ$Bl|yS ziM6v+{j_Iidz(1nx{!kxdcQqYZ*sQj>}c12Bg|+wrsF^ZcUHqQ*hZ5XT_H|IiUJ_N zv_(edtdUU+OydDejX6#$&-b%|({3iOYtH2b4Ix;;%9|tUTg&chUFoSc+^P5*bt?4@ zW)bvS#ezAZDPV6t9SGyM_0q^nn?4_7ay5A_S|83m@w9Vni%~`Hp?uE@IqUXhTX+n; zkIb!IlSZU#47q?8H_os3QejmHd~0i6$<*M>BUq(_iAYmVJ;J`cGt58Vj1zIrtQamz zj~<2{YyHo5g)NhL)?6fU_axN5FRt}r*zu-2p3cZ;-Az2d`sgoigb*Z7IKT$K%rd(z z1%}&8ZJOEM3gKAqYr3V4(=LA5KgNRLNMq5HtS2|Bzm}0wMA1QvXrny(@+b%|Oi?gv zKx!;ayN@0Ejd5SZ2TF2c{R8Ca&^j+ zD$_;U`cVmvB&Y4=G{vud6FjzT>Y z$otr1RLnDumn4m-7QBXwt*ny<{xy7ewt+q9l(9R*9dXF8~S|qc2+Ugp8m3V1u@TCp^X4% zWNql+Xm6xv^_R5KH%EYDW@F+cVj}uWYY;JM5V0|FXb};yY7nuouoJOy06`6A4p27$ zK*Yw%3Tm+cG>F)l+1@Em4I%(1=R5m5#Reo|XJrPp0Ph?u@4NtzBnul0h++eAurj}E zV}GB7h3TDQ0ZIKsfkrvm*ofEx?4W)QHjq5~yAd1X?V!0p6f+a3 z6TtaC%*^yYC*WO%nHeO`#?C>+34EV~nT7dX2k<|PEboQ@{<_7&@jk-B2D0I=Uz{Lw zKuwSg3nx2>3Ha_A3lK!IGQIb*vcC6nynDzB0FnRjvI2l0A6eh0Vr2&@WMO?bjg|ec zm4C(9-$D3?fdhmq2N3wLDCb`T{^AV;jr>O;@ZElpSs=|IO@MbNS%H6XWqv1F-<1Mb z-;w!iECBEqd=?^(zd-@8z0b_b3c~1b1m59h1-{F00zeM3vb-bA$@U&#HYOq#cFuq9 zzd_<;d-sLy-4{-dcfUFRGQR`E%JdKUuKX`BAawtW1og5qvA*B$qQJkg27uxX05yT{ zR{tXdWCo3}urPz1VkTnee2*581!M^)@Gm192#$XkL6HTi1f}Bt{WbDklnL|$GWM_G|MBu)m47h= zLGzyE?`Zu`%>B#rFYf;_?XNzjcO2eJ?%!g2FSGXo`?s{-i|U`5K=&TKKmJ{`&Lo6G;BAcc5zcn{S{p_~$RE7nJeuss6VO%H8*@ z2I*vb&*Og+7&Hb74=7LnldJDZ`ktMC+W-(ApnUu{5#KZLJsm)E{!NPi6ME)%OaAlx zd58WV)BgR<0;-nx`=9nZ)F2h_uKv$*};T*fF6?U?4a9%03}FA)#&=8q z1@;}l_b|PK^4<&h>&rXud;7f-K)nFwzZ3@uzV}`>Q13r~L7swaUv zp#fk9B?U;1^}TTZ8<_7J|ANWG!zg8BZQ^JOVgjeB9lLbcS7FA|E5`4U2d zUaU7Xheb5n?A?B_{4F`+ z;lXE)A21k}+!XA1Y1MJ?hLu`yOS2eWphKE^jK;g!`AiHw_0PK2Fd~$DZdFhgi5CG? zdL^%kb+SZ&3oao)tJK1JDXEu-v0RvwapB;*zUkAd;^y(SW{hl7m2B{4>8CsOqt|(_ z57|ppKL%JeobeW)w`Glxh#jFdx61!S3`*mkHvPF06)Ah97BV_JU1nn5eHlGs4R&2e z_yM<~80&G{r*DdfQt<}WfV9zmkwTx@ZnVXZFkJc;HuB-eR4P9ocfgen;OzKeeXfQd z6@S|skv$;T(4|L>2VJ-qav~q;`-`uDV^o`r1dEwn_`}_PMHCpm2zpwf0ADTkqNnd2 zlqE`VfkTLAFA?|^HU(JX$fo__)BZ+u?uJToYn7)xyJ;Xb-%G0!!#ZPHEc#>w2=1vjXndXQ->KQ9+518igsMrQ}2u)49O!$(YErk?( z#`CbG z^B|EQx1Y=A_opbP4Lz5u`E;To*XQR!Ajr6U{jw@1lL0lOt@8Gv1VXzb;@32oxmKkY zc;1S*lq2HfhdRh`hPp_ko7N7|+>xi{@0`xQo>{Ms4tJ#D(LpYhmoVCb1do8Yv!97p z0}iZvSC2NQjnlo)pH8zoUJ35iuaS0-?n$<@wZ+3j$90zHTvtA$8f|`X-|kri>-W?v zc0W9YoKw5RGTr;EaOR?=ahX`KP~G2O5%46Mq2sDGk#D~F|?ZBqIJE^TL;Cu1?D7mI_P?(B)fzqu~_i3=<0erGw)|a z5&RCTHHY~J%?c}lJF=Pm?$vKge1a6rMaLzbh5;H#F9S1sX+q!)I)Fdr-v;;Su3rv+F)xHI@Xxa|wL4?dVMm_=7#5?Le> zL>;_UUVV<xS!n~l4wrL9 zLFysal$p?txGOSN;_1^c&FS+9=URCtkq5#JQ<2^624ImspB|wHG6SE-kAZ?wU$Li& z9n&U%S3E!{fjKQ?)`lO%$^3s@*KbtxEknHT@%VpUW(OiN+4eqyKDKzrVC7(SU`}8d zjn5&cRoHA`VPMzb*B@NL-NDqsyTPOzTdx-!be_rXWZs?opI+*Gqbt|mGkJu|=QvVYJPV%~bfa8NB_A3&UUOmE33EVLeNN9l z^)-(>N}B|_dVq33-5{3{uVGvNBlX@LU)J8dH<3SUITiHSbysqD5d=baGVUMe+Ytx& zv1JQh^ESdU5nBr8I}_7!i4ttXQQTuE%Q$Qkhtz?Nd?6)znx@0og}%&}XA{cr&L6Tf zS8f>DV1BBK6O&1u?M~u^$5J{2%F^;vZcOU8c{9?~3^4yz^c~ zUa*V7Ag~7lmZ=Ec19vAp)dk?qQ0NQDYvU472)ZR} zk#|J6H&NcY>M!^)-*WLRV=ufjN%?;)E+<w+OqX9wTKnXCeCM5`>w{Fs!Ikrd zX*77XmTM;vmb)Y7e2mI?>5!QYcbU5IHtU&geF#NOoytA)9@vkq6hZ7;T8fh(!)(A? zzc2}h*oDD`Mt_Zrutc1X4r(I)9LX~P&)I2!C*^(sRbrLxVh>|2o?-YyfzGe!MXj!Nu(X<$=?Z1)q(gR_^YC~frx(uoOU$hC&X^- z9#Ge99j`M~?iGH!!d~EoGEET+dcWq|fG@ghZ^=4XriIlem?Z8IIyAZ|0&VRCoK@Cp z5Z}DaeKq40Ln|Hs#A;(ULC!(ZK-jDDSA9WqNp((ZS#9qg{lK^# z5dYRPR4`X*AYVUPu5*tWAc{)Wu|R-RCDS5SV3yccR|jUZ#3ArIFz#ox8Ld(PCIPDz zz8+Ey0}l&~xV5&UVH7t@5>JerYN@=FV0+zyb$a`>VMDu6*#Y*C%NOa}nc0I<%cfZR zDF$a@I9$*&Fg+{wFb=iC5EP3mN7J|a;@xP9Mr|cJ^IDFG5V%WuC9=RAEQu-LZ824} zqGTl`OJNg>1c@*DnsbUhyA4+Q=_$6QHOrD^=>pgEfVM@-9OtM>h0)5-rLfaFu`3;Z zr!`u*TDx9S?7B#6RSr&RE1y^y`O!j|72fh|slCP20tckGWiTy*)UgH*HdznQA+Wcr z+X%sCeZ`d;vM<_48l@m7g*``qElg7y*R({IpIV2kYScgQ00zXX3e zo`cnyw@EM1B*o4u^?(sXfrwghMwd>scy;E zfdwYoh|^%8J_jRW$CinMx58tE%^dl`+qxbx#cHZ+#;1MewySC;Ny7QJ<0-c-H?D{H zE#3Z7PA(esR>oEOha)1h0%Zep!2q_8{I`MT^VwkbRjEli2s5*S-C?LfU0R#s>yv&* zolrZLmcLu5Jk1SC7wQ-L@^Jx!cs6KTX_$GMlHeGF>~?o*^=8WxjeS`*}8W`r?`D= zl54ko9v zp2weDz?0B^BHU*l$5^$sX)3|$GlCIG<*n^PEYRGa4piBVu;IZ#fRdGFiwslQw3zS7 zEj;!Dt(dMiYx5T$4Z0{-DoQs!v!NP*?wUfbL!PaG7hCr-U+srqB3Wxa7phCMMEqcb2?byg5Umgb<83n2tyGGE z$bf1rM4CXY-=JL!Rl%X7FxELyIK{tu-k>s(!H@;%z;}{$mV+T72kc=1-2={{GKm0Z zV!L$w;bUsA57Al)-jCUHm$`(Nb=8;qG0lJQL17GmlZ9cV*I$OmCGS$Cq7v?;S_r_ zzG+S;4e03+JlgMK|ImrUU<0$k!^yEl3)hBc)zFHLU)_qeVhH@aVw@a7Q0YnT-m(+0 zuRdG@^2CHBh+bCww1&rxed@BQ1|wlS!)yLBnH3^|_3nYbFxUg?G>0dFyBKr$#3B-D z`F8ojS7VLjBr8rG^l%Q6b)hut@pflySE%| z`s4JmR*Q%3xI+uHUyHc2>Z-I1;;}k6km+W5yOS)k($Zhd%4&gy>2*25ca%OC z!eBfcu?#C6kDQ~<5^w$w3kxzH@oe44r@2pMUe=?XKiOg}2EN%24JEw#`tChKKdQS! zxn~|>?{5Uq(W*B?HB%Ml*W`O;Z8hEc)+fyRo;#F7l;`zNPNL$#pb&(TYJiTO$E6D< z`8aLy(O3}5^-6I1%*;E0e{PA7eqWngIxWrlc4JLy22HPvf zPm8#4(sJ5CXvAJCYjTT_k(=R8Q={kfbZw`J2(@sD$3V(yc=O1c@!L#xle^<&p=Y+Y z)UKYRDHTlMVi}FmgD2#rxBbTB_Ed5?fESUb(JGDyn{MUCW8S@SQ2RNyk$3D4XZDJ} zUrMf`mjJ31i@AD%Fgr3Qc>v7ZOf{pM=re0<&YInWkFZBAiFRS6h z%h=E3zuQrtKD4MvC8EfJ5j=KQl|dI)6F#zo$*eltUfK=lgQbDqTvb3qTM{$_jHc0(s=>Bfm8U0y>ZFkb`^X!{+Tc# ziS0{hM#|H$rttAq&01Dk+{d&&4KSqsY^3siuiEH|tP`o%WpCsKhco7!rnSk2u{Lq^ zu@~@=BGPH&sK@mr`9vQ-^vzs2+oL7Fh!1>fZoj_Xwzk9ak?DB}3ZUhQ3dr4}63iGV z1s<7xc=&#KE4$jR1f8YyO$oU@^LhKEv~l~2`d9ZJW#UV~kI4cV5Z_`=z_p?m%i(cZ;2RJ;Ns#Hr^SQrNM-{o^fC zgnaYijUe|0Ie2Cs_G6B=#Vr*6%2Av;IeDBUnK`&lc}z3T> zZZNQ#hI}^7qge#7yoAAf0&|EK z6Ryp$DYSItkBmyGQ_l^P#ZPW?^+6v9Gq(ziTSxJh{5ox%KU9XP_|lshytXqmL-KPo zBqyS2k;(bIl1 z>f2lZt^CTdh6*$C&xVS2NO~u8!&Y>^t6Dp#&a&(o!{{VMTMskXuU9i&2>o1$-bbsq zr?TF62}2=HdaRig)TZHde_TLIIFdtBF0C?GrX5U;lG7-4i_EGdDC9jZtD#6byq_Hi zJ&nF3rrRV8%%CPKGYrrVA$T7?xvV)~WGGXyDBu^ITM*sccB{$}!wP1_Jnxn=8# z%^GCrJ<6}lG?)H3JJe7C?`llGwNwc~ZCrpl+4?M;dLpr`>27nT_;!1pHngLF^3&w| zZSpT}8br^VR~wzyD~lkDf&R?b3dUam?tN(dUAFP(!)UFwR-50@Yo+{dkOoMnGAF(* zd!#mUHujmHOUlh@QB#aH88Ym|7Pm4s?84=~-DeReHdZP3l0?@oDX918PZVe><=y@f zg7v<=YBbsg(;>++1Gm&6Zzo+J@>8Ww?n;C?P$(Ab+fyG*G&52Nk0UHym(0#fI5(~k z46!;}eo}(2okN&bzM9#~Po|=c<2D0pO`qO}zcIa-XzItxiq#BU5| zX1*A2#J604g;38247mO|WU0S}w)A%l6Cv%-U$D6l;YsP^*D=BUWQCjR5lLXcB9Bjl zU~FhOfUp;>@hWEbhbcB)Yojz>PlOf2D+PN^B1~>woP0?xf!Z#0OIoWlINwMj%wVL* z5<2U|5$OKWS}gJNA(1r0h@U9Xo=xB?lY7Hf6a-FZdE zvCh*7;~4@zJ_2^YwR5oy!@$MPC!Wg{FBi?`4*De-o^-t!vwY8tk)oe!pB69+<++}p z&j@&4bf$2nWFjXz^)eYC%>EYuML@d0wX@G8iSWxrY4%+*D^ccJ zOyCx4k>ac9yhzc@wh%^CYO@jzAj%Rq;mh?3d|S=+H^5vdockT|Ex2k9G6$vTe5TCa zEBuDqFvG-!4RGJpBsqBr#lmW!`I~*qSi8ByT%2zc^B52`BEG=nEV4OEvX!{gxD`Zk z>%o;ikz6Se$uu&#M$9PHN>%aNHtJkzYw#EjL2FD%7ZhpFBcZ%k8y~hXVy`Y3t4XY5 zz7Jt0nZ2TNC9q8V4v)%mnMRIB;@1;5`C#At=;JXk`l?ZTFh}b5>wP|v*I+Q6cN9t_ zqVvd6+9NjTr9MNUmuJc8u?!?QqD}?6B*5`RT%RZ_YJ36E9;t+|6P(6y6ZQq8l+_+Y z0P7L9`8viM-yT z^C+vlSLBtuX(N_CJdXYK6)8RSC3?tp%;j?1bsFsw-OHl%0ax)njp+4arB-Ov*en)x ztUSBfLJ;#(smNe88Rf)~t*X4t%!RpHNsug#?POrW-#XCJNH zzGXDf|J8o-JuZ})7996I>SmV(@kky{QwyE&hH?1>Me zBWwTqPoFvSm#>Vh`Qqt}2qk-o9AE(zHaTlp8kCm^4ZItj_n-A2ASIcV{TN1{6T}rrpkE(WfZ-k zsKu-Mmy=gjG@eEQVNwQMiv##FMO;x~n1Z z)IU5w-j1&nEH^{PsHAO+K>J0H4pkGHT70fJ^J|AW+?#1_|>AfuChw4Vtz=w zDKBMTJeGC(EQ;$VrB~~8RI$tLawW(EH#WiuR*2|BT7T0>&{KcjQRFC+nBPE>HoLjn`}H!>jM7?0 zlqt)Uy6Ty*uD;&P78C1No*XXHTWxxaUa6BY_FTKIc5P+#%KDO$+P zuud}_nbxwl-0GDLB_%a|c&-sCffKNwmW@n73F4hMD0!-x%=o}7B77HSFC`7Ec_p7< zXI95t!uDS5SVE=6jtRur?h^~BW2`mE+EpLyNs{V*K2(7H$LDOS8IVfrK(~3YZEQV{ zbmv8`UPZ4tj`X@z+jyZ}p;@eO>2-}qrYAOi;ZP$_u47rsxBAxZo?8cfNqzg{{jVIW zuRZkQJ}N)aplkoS;h_zMzL5t;C`*c6f&H=;XqN*lAq_Hu1~f{H`twqwrPsiyI4eU1 zYQX3-U=C3H1b$#xudj(;r^5~qLD4(`kG_&{kv_Pe-UEW1!Y&e~TsctgyR4U~}V ze30Y~ofyWm*lri+_S(hD%wFZZ*N0mi@EM@JY?Fa=;RkawG#*;XXrm^|R08e!8HaPe4EOu!aEqORVSf%;>zt z*=y#hdU**l_+~5E9^v>vl2zv04pK-TC@n2hCy9~8nM874>^?pzHff-}0{UASWf`QY zG~*&A0Ds?*B_a7lET&7a1@Rm5S8|nzZE0+x;&5%%!7AdhM0>GhRYPlEr0u{pIjA9M zHR#1>0hm=n8TO})TK%sRbU&L>A>o*_ygH)*sc2}2yDL@JY7u2V>aJaT~i8{*!Cv&|#;vG+Mn z(#WYFCwNWB?3n!pqR=$hng?lcx?n_>qvD|16}T+6T-IvE`B#wG3ap=TA)%w`>pVx$1=PHfR;TFegZliMjy1Kh@5ya8IiXy;x67@x7u)mN%WZ$7 zE9`81^wFNw zmxv)OaKx62AyBvSjm2%l8LjHS#j-d*x1y5baheD&~4rIL&01r z1NP{rwI-uIOWS(t+qWKj^Zs^Kro(75NYzrF)n%=m{QQ>9PwlL*x@|m}2J;i9#*cs+ ziP*svWV$RgT$GKPFEU$}jU5CQ#tx_-HQjms-d|w!zJGG&Snyc>(5H8Q;hCKej`+#U z6W=-6%ptP%#A^o!Pfyle`%3YS2w)8EO~&Bf@yNktp;c{FBcbUcjvQQ+j=C@MwtSMv z0bCrrbJtk1UrSi3u}L?e>`-eUWB5;dmq^xXU8 zyU<=cNNg>myqqBxn^A_Dxu{g?>5JA;{rJMzfiKRiyc-1%bmY4-S!@$=cd|`~a3~Nf z6KM4>Wism5CPVBbZVcP3N+3MQ3L%gBdyCP;^4)vXKhpUq2!4erD@$&;jB?~xO6(Vn z41D~eH!C-5-t=#cBa%fS%Yh&QmJb*t^{)=pAdk=aR0&Rn+wlan%-25AvF@R<(&}vw ztt{Q+jr|uJV1pl`TWOI>ZCyRRt|RA9ggQ=rb6?#=Uzu7+JtP5DZE;x|_CC3O>t9V) zm`p@N0^$11*iNO1ug=tpyY9QN|H$_qT%ohtRQfpPsh2?N#iIt7^$zi6q|Y03ym_6Z z`xsFJ>Lu{el-TE+{r3d!S%r?H1}cWFk@M6E#1n7FvXeyk3&WL|ST`}9D03|)a-qd+ z)Zns6F~+uVxu`*I;`2Yc`6 za;D5aW_Xj?%6acM5k@$qD;%gd6u8VFsY!|v@Pyh7x7p?~h@kIkH5h(`xqEY49$zdI zi$Rfsr_7TnWU8F{M)D5}`%G z7mF^V?2^#}otVmWjb@H3;z*ni6R0X`u$5)NVUbkl3CBYc7S|2pAv!Hn1Xxrk^?_ec7Wtb!F2)#uqj*hHj`RF4A8`gNN2Wb>r~cxCOvy?NFc_65bEh`n^Fao zSZh&V`vs*l*t9~UCC(!k0FzZHC#bQhE@jaEODLmsOq{330+ia4${mSe%)^R@3w&s} z5a!~JVC&0E&7+^XkfmxiTII2C=da2qATd&{g6l|^(x8+H2$Of%OR{@pTBTAaVahGW zj11D>^<&Icu~IDevuo4R~LI2%f&owwTE8Xci<~~%WDt6w13z0`>T&TdhQq=zO&b5@3~`S zT?c&{P0&)SWUUuj5_k22fA8L{_U~g!ENiD{#HFN zi|knUv6ne-t^kTlbO`uW(cUY3U_IH&Hj1o;r;c;2J*5>+r1fH zr%k?A#Q$H0lD^QhPc^M9GqYot5=cew=Z8zOVkN2c$_Z_%3=A|D$|d%q`kX%+_2jSJ z4SsX%-pt|<7vp#j?4W$qj$=CwmtDoKVp-;8B=f&nQTt|QBjedD`i`2@K-lDk?y*+y zb#V;d&Bigvcgr{4-Bq-%Js{&TB*_yAMERkS>Y{;KdwzImWGI~PU%96#XGMdb+YcHn zr>3vi6Dl+pgoic^g$sy`mdTD>wK+p3k|-sBAz`K?)8K3LcpC#bd4Z-4byb^Mauj-_ zOe9lDWIDOPY%v@1Ds2AdKwfTP<2u~$44|+FC~Re88T4hHoK{>kkBY_@#xi)zhcZ0C zY*(;M1*OV^QrzSt|CufQ+GM)6K1qnrvxX6EUDKo`j;B zeQbQP-Q{ebTu<&x(fUrn$_%tCn~h`WL2KzndhKPgK66aR#OY-%;QpTbFQb5ckKXmcf$3Aw$*}8 z{UNli8g&I-K9K}f`~8xl%heLSLF%;ICE1q^lCrV9F~40*rP`68SCb7k`mn2PP;g~c z1s9!+H=nXo$&M5+>=^SP)bOlLVE=j?dOQN=nsZ%Yqn~3C4ZvIlS9JPKv6hctzg|sBo zz(zn~V(}cJg>oYf=g>l;F7`bkDbLia4RQhfXSwt}3WsxGA0>!=FA>h+5vR4<*j8RV z5JLPL@ea2~$cx=>Fc8P^fZ>T%k{Eu}564Ja*%%3q=v#JDO5T+r8AjWDI-xy zvcw97Mt<#ACL9?UpZgtUqt3JXY{Sc^%fC=g7UGp7B_e5Sj=Ee;iqs}GDUcgrTc|IN zBDWhGc$Mdr^?A=`+cP8HlBab#Z(B`7(n)t<5n0C?`+s65fi4WO?lBA{&-x*}=7Ux1 zF6dy2UJsPSb$PsoW~CROQwuums!}$oR;4sZYaU+Fva2hvcK1^oA2gJ%tgRkt^@*@h z^TwL?$u?(K{#&|UH5G*lx`x6X7$08%e7wf&MtP_Ptq2AVRozoX9`fGfC7B#;4mmC)7)nc# z0+FpWs`Z>hT2X01qqRH{QD{=cu7_q}ATs+UaS(x4n5| zZ3gl4y|3OLQo1U0_i?g9#AlikN@(`G1vO4Z$L%ld>-f~pMvXUI8r#2iL*tH- zLbA@X!a^2W3N87Lh`KHR86k^`_(TUg)4{UD`XR7IS$tf-zJ|xy1H1*1F$+oaO*I{Z zzV)Bp7^vI%aDPE>bE#3tkV=s(H@LR$_WNBen}gNsnhL~NKs+u{%fzOfEOp&2FYdeZ z8wV?t84jaVp_XRq9UjNU*M=V$_PM++zMP$@hCcHyFbB~-v@+=5GTgH*>M!d-8Bw=; zSQ8aAoE!E;CR-})b&;acwhl+jGiy3g29@0*>o7*BHkQ;_gwFoFE&#y!0NCa$diyPQ ziVLI;CumaL8Mcf3`3jdSZUWIuV?etAPddHJ6~`E*rPsAR(!Tm|yNz|>^fJa&(p}no zsuMO@E|IvE4a2pWIfX2`B(9plnnmbZj9i0XuT^>1e`>^5>CF;T_TJ9w%_m1@f1F%R zVeH@9p1W~)_CRtf=6#aPuI}-+t}2nrHIhud&239XvurUz1cJ!qL)zNxvnuWvpsBztZ&J+dn2~Kwkk*I zGvQ8U2ZLo#k`8roZz2&2Q_L3qT#+QnQbCAMK!f?X1?Uj)QF*69kEk^!9LHO=h!C#8 zJRy!h@DT_>9OEmsMy1NA5J=^*)5JqkAvcYQXF*kWSTZ47)IVqE(!ahp)gr%0ZV zFH*~6Uy51fia3Rs7nuok3=Id1(SfZisAy~13Yj4qs0plq&jF2V&A9`;_EnL#BW!2 zrI3P-hdts7GO0msnttRett!87UpTz0Bjj)H#gXo!tfb1Gn~X;Yrm}qjC1VTXu*fB2Yn6y-^|& z@g3o*5z=Bb;^6(N#tk)@ma;By-P+2VBp>Lk?I5>r1KPO2%RUg4l;vo2sAGT8i6XK9 zRQZcK)LDQRe^zTz=l=W?`DBhl3kPg55kjp|O9~Z61t}1lE26UEJOhn<=hT(9khsEa zre%2%LtAk~*2!?1{VE%Z!iy916-mA38S=n48H-BQ>@ZH|y^-VyV`)+bEtYEJ3aymi z`uN(7r&i?@ZG3RJ_hdstza415w*zZ4tlb<>VXp3NbJcB7pXT8tJ_ zu$jM~PpZ|n{By`dc#7$Bwvzm(X*$CPx*a$>Cxcr*zq6uh=M%%59~|=BLY=y^ zX-kWXBKZz;|H%!-IAYSq)>=Gxt7u z1f*#-stdXUR)M5dr%-@D>qitaNB#0VBCpO#I7N}t7LzOD4_iAFVK!P(gf-aEg`vPK zzy&bc7R(!@4#s5Qaef4Hvj*f53I>osXDi6ct8~cU=8Ir#N#6!{hYh`-l!2`(=AX=N z9&gSL+Cb7U7MW5+!-z0f4K-}%#>lmACx}W_a06q@@QHqxR4!I%fvO(R7Dnjb7&?g7 z1&j0Yv<_diLbPrw+N0H0Y(9sYYAZy$rqnHx-(6E;PxDPi>`*uvhtxgkHO!WvvC78vXW8GQ}J-z}mQ z>ADeRH-1E3xt?!E@YNLp8V0LWuY-}j@AwEOmFQ{Uj}53JnA_5l-RFpUCAw&TwklhN zDgs_XWKBz7ctxZxWY_s372({Dj1CDam*N!1!s$Zb0;YI?oivD#(RpltB2wArtLbTx zSfIz)YkZpcd;`6*y>0`&$90)etI zO>|9GR--sNQBW4`Y-t=*8x@i9w&9RF($`Yf80iexbQFY*aT|GF>R}uCQhaxN?qjd*av@XaU=g zf^F4s^5mvRMx#@GeYKsdqMIJwR2;39)NX>$lqYIAym#u6@Pm=#q0v=Sk;CC_9YYG(nch%mhhaoAyAXR&hxjRniPy9*9lqxnPmI{;1j@TsswkE|<* zHr7-e49gj&ac^W(%ewGjBpfQRRzw=ZfsO>ylCm9y&!q(F5^notb|fr#EG$w;O1ISPhWKi8S8J1&K$#uG6 zDJpS#;$@)HB-#)xX=?J-wnqE4FYz2v-*zAWWu*^3{q~oP>j(SGBcm;?{gL(Iu8!Jp zUI))1$-=rfl$at&ItNKP#Y(B!qN_<6wQvOo7YWfW5oq~1N`$Jz(jJFEG$y6esKg$%9qsS;*4mMzy_Un24$STe-&(RE6k8vI`a zH6BC9gDrQx{J`*V)%NOWtH+~r`l3}ksvdsnPH|LsNLK})R?$nSx1;q=F>@+>EM$r7 zZrL8*5*Z9t`&uKt;f9Wq4rf@I)aS`DR96?*>GR42NVHI$_?B6P^RX4i(nBjnSuJ7; z{;wBOjU8PnRJ&=7v1q(;S}H+Q_Dtfafa4g2K!Q2uA*pETpxMW=aF-Z{3$)de92MsT z>M(FZH!2TiSuFODDB5kbM=Jup_K-SK*J9_)Ut^d_h{&W?c`H8LoS)n%qYmGA$Sh@j zC9um{Uz$&7WW^=a3vAqXZLp}X&+oHX#DIwrpRamC96d1XkA{NPy8$ViTZY4HBOM{X zy*d&Kmv*FJXP*0$DB{dnK$KGTk&yNAnVfkcfiQ|grtTARGT_>sVsG6fu0JlTa$NZy z{U94vSrN<&wnfM6c2qnzCJ7A&P*kUobVY_cgW*89vQk$N$!KXql87$MV*`Vj0D$Sb zI!;9Z4K833s1j>qZ-~~^2vY*F9~${3T9%3^IT|wnlPLixyMmZWuxldBTh)~e^YY~x zt~?D6^HQD5#GK?(jJnhi)!T`ww725{-Jfhp1a!3~xm3tF!c!e&fWs&|xAY*|9}L#k zn!3zU_quh`9kQrth3U{8QR#%#1RwXUsLrwBZXmG zho^lPJF}8#s;ktyh8vxtn3a2@%6-DSU^cF9Kuj-si?p4h**co%8iH=vW~FSmdS3O z+W57Hjj@NRBh-0Ri@MM-nh74wEvYCWC50Js;NNSBv_z^mVq-wgLB^szZ$6paO({eu*;1>k=W-~uffZu48IlN1%dz z{{_3agNsa-JSPj^T1U zWmJ5NI--(2kY_7gbELgyr$u85SN^$nqSs%z<*CVSj}ChjwnA&b@6XP(7Og(g=5Ed; z#7g>4lWE;jAjT-sA?8s5Gp_FoRKS@h^#{kuY0)U6ph&scfq!M^-#qoz39RZNP= ztg4lj)jRtNo%MqOdu@5K+0>R-JM40;sp~k@Um)b0V*j>fucNltJG#eF(=)rNAw&r? zihKq7whmiq2>UYIfrhsM4QoIj*9NnTvbv*4CPSffIhm-pJX}=UokiR0BL!{k5qqa0 z!fo0O8x^6Npv&be^@V&C@+o|zpv6OkRD?KMl&6ViH6oB{E6V&U%f3-;Am1w?~y-kZ;3~Y!P)&;{HUTKidYp zZR2oBWKmz^o)L(O;2ATwNhi_)fMYsZfXXB-5;ICf!YCO(d^L*96>N zN0hokE)rNiq>g4~6^Wvj?iJl6>L$8t-O(aNq`l1%sc)+d6_keyI*chOjxPzXcxz|~ zKZA3%f|a=OdBPiwi{%E2HojslP6;N;jTafCFKiFg-PXy4R%MKV-Aoxi+`{*+`s!lvBf7LOW6SVvM?06vRQeK42utNo-v z=fhHiDpiG4WFBBn9L4Yc%fjL!&*(_TqOr1KIZ?skXZ_7c4DE+YjChwH`!I>Ipj)iK zAlX$=7oj(JrT@BMaI5o>liY0EZzDIG_nXPB`a^p1ZWVD_N$`{>l%zmPoD>j3{ylt> zPZ0vmIs6{TtaG9qV?^F&e}veF ziZ;-1uR(wCinegjyS3_26**W%Z1o<(i`oc=B5b9i>lU+x6)Too%(ieX+Y*(k%0QKfRYN!})bu_njdD`!3Z{Ad!N&Ir}%i ziWFGHo@id+oVL~(7T0(zw89%PwUtK{omkB;Sn;sLI=&L+&8zmrU|mv^E96UQ^4Rl9 zb@J{_D{po*l4sc!oz9@zC65k6ok{eJr_CkTTEp576c z$?$nXgVm)s7gyA|7LPS|Lv=-#G}~>F&|tev%C%CyP$bj``fFxCd;Ms8pd#d!Q3A1$ zFJ_;)9GLqZ`E_V>7;O&L-rah-l{C2sv5U}>1Wgk4(+)>bk;ELuhf3PKkuuRU%8|0E zGO}A4f6GDyzha?H7w1^$-=bxQoU$wOU0uk&H~o$U^6UQ9N7{Y;O+K9ncSW36x2nS1 zQEthp?_1SZpW|rX*PY#1mZRlU>^l|&*5X#5uf?m+Y3N_o-vGm`eoL!Mt~Y72jQIUk z8MX{fPF-GJrN?H^tM0Gzt!>3dn?fv6N+fC-UuV+ka!RfF)%n@kxs^R}95H>&1bPS^ z2{x5akFAT=PemQM>RaxL%8l}g`mwQkwOp>Qr#f##owtN7k$s`^b=yMi&-8lXvnuek zYg^l@NT~BJdBhmLClX(sS;Q{NQpQ8NoZf<=enG{$3`IT_H?NN0PZ3`eo>C<`L? zaHce(4;RLx1y?WOLB4+I0;ZyGC~%csck6L3wS4YIBp}z$JM?#R1h{*FE3T9->xy%T zyMYtU_Lu$@gWqS_7tHUiuP+)6M7uIv(IQlo4Ik-X*JybCdS1ZQ6&VbdML;liWQ27Q zUQ1jz;g|@Hh7dk(Z2-rwT&x?U+rk(|TrMvY{JZfI!vv0~Dtq&mW@~+RB6Q&^W&;!{ zO9i+YBS8vQmPa9VZhmnS8+y=4mRSn5Or&Wsj_2kuPN~-!3+W=h2rR`Xoh1IN2kEPb zn45d4wLwmGdy3<{M!f*MR*#=$^VKV&o~$g7JW7>#>ca|8q^cyWi8woj-0HteAS?(U zJ3EK{U3St(r~Nnxyj!nG#)Tv|i6p(|+Wj9H74bgOFVg>j#!!FI>#LVVJzaxQX@fKa zKB&agkGjJ3;i@WYtG|_O9h7+@C1DkGdR<}^VgAC;F<`&r0uE}X@Yv!Qo9?=We@pd$ z{+V>;Qsa$&k*DC|l2ztdRtkCuiYGTamqrlrF82gG9+GU(`TeT-<*YCyWl~WbM=7Wi zOJ!1tWI5y!`~<#Z|F!hE2Kri3Hyip47%VYH{LA68^JmLMQsZgJd*d~E42I56t0u}VIC zZR9ee;3fx0Dt+gppPcmI8CmJ^5+^XDk z8yeasqs(2=hC&o|n)@Q7ovj_U;li-TV=ecWljSRrIpPe{5pCQ6i4QJz?tq*8XNk_e z6OWxd_~`mVddtZX(w+>({cHa=>~xd!;VS~=&b?2qgTCaWRl!oL zLZWQVvl90xh{FmZM?sw65&L+An@1>YmU9;Eq?Xj$csBbvw8BQ%a>6#TDJ2?b?};7N4~ok#jt`jD+onBo`lO+Po*g=BiO>z(ahJkqYJ!Nq$Elm@S=0D__RUW0lY6u)1(7 zj$<$IQ4ZkPhc*UFPxt@>#7RA&)f3t042~%G8Z*6Ea!x1qA-i2HI)~)qVKFJr4deHj zC6`ddpMvE$3FFSdJ_?(BVK|4nl&4{-rJjXNc@owlAY_?3tx+zd|MW*%s4!~qo2!LH zUhL-rLY@VCWCHq^zoi9Iy#~M2Oc;CDEm4XY_958Au@hJnFk+>I_!{v%)N@ameva74 zzPd!Dl*U%!-si?1rq)C69jG_x-)cN$B#CoYAt4mXkjWf%m_#PSIiKuS87Y&ShE1fv zWCaeJtUV+-MC=ciM*oRYNw4>uj0Y-T_ zX|$BJoR_#8E)E1E}|4jBSHxOhm!hB^VEtwk_@-$k9t&pE^2yZAkB?91qqcu$EB@i^qOognpaN87rp zJ5J<jDFL81Hh8gc&dBDafsKC}r8@p4{FN%sLp) zt^Oi!*LYQE*NVK{9HNTm(-Z|ivDJZqqq5DF+gauCRpDNAK`++B$Z#SrDi3CQ>9b~~ z((F2m%rs4%@p=upXRN!_XJo=NhB)rI=V-wTNI0DFw{9dKuhMB3&}9DMDssJ17Q0hj z&|2cCEwYIOe7U>8>o+{`psQtbed9fPVO) z=E=_7oaUioX;+^qztYA^TJj3<5-$^#VhX5KNTxfR=gJnG@$bw&qdSu~nXyMU$@(x? zxfL+8MHl85ttLYbx~0};mCmoeAYOt7QH6%+51>j3xFr~|D< z>wuEk)=z)*ZTyvI>I?tN>&pPST6_YtVXSA)Sy{C4r?R48okY;5Q`)NgiyT3X zSnjbu?gw!ZOb>5RjX}zu^skolCk6)bDhczC+3TNvNN7t z*%SIb%$~%wc*VlkFmWQ#b>k^y2q1kOT$vtq163O|=EKC82Tu0Zr8 z(&35fsf-C_0&Q`uy%m3VTvCTnOQ5W5euA2>*6GL)=eNj&^wq_9`wlIVYvl^9j3&>#bIv%?OJrn+aPzptuc~%*6fk1796LW1)vop=18OodRDpHg_I`b4vCpfo==5ur zXTrtXq*){ui&~4lm4#V3Cb6TYr#!(GFdB{z~}XWY9Sdh1l8xAEy>ZnpRa z{haR?9!2Ac9@W<6^b{mEG#MsMV7RcdXWVcgN09$BvNA*|w{_Wm}7VLYdcG>a6ULf{iS}gr@-C5 zqq$*ccYbdB_Et}4Wwy1v%UjS{VI60!F_7x_L0hmjRv0u}{Gzj3u*S656chP<7Md|n zDfTA~GVCH=UBVz+G?tQhyWSwHTVG@Hdh!ejHo!)`SywzaM>eR7w(n(Wi;R@eHGqSpc6SCOWNw7iLn&RN7nnONHxu7s{Q!GVnQcPyvnJ7J{ttU^0v=a! z<%{2?Z!h=uzOU-ryVPp6mX=y-tu3|oeX%6Vk{2zl#nxsm-Y~{E!G=Hr7z1(!nGhf> zAt3||flMX~WH1EmER)O<$RqRqnLK8Om&r^r$s@S^s_NcuwPe{ic{B5U^Zn&xbywHD zx9ZfXQ|J6@xmCXXPK7RGUbnb51AF;3^>t=oIW^|CX~y3K{b7Mvsx)YncBjvn-WE;S zKDS2UG>8Sb;2o)2Dg>5FYRPdV9$K%*9gZw;k66f{w?pcQH}UrXkLVPd$STVQ0#ef| zCiOp^-#miLA-B0)O?;EPZ| zTLD}PHDpIyqS+bYwp?4j#|S#QK*mC?BgmHIp)2H4W>vtzD3kyP(MpC=YLuBdcDKpk zt15Cwvh)(EjMgdvl%`}#S+33HGwa;tXlxRc?osOVSON6Rn9J^4)hHPIoNvX%tZ3%4 z5yFR4WN6j+YnNYpHx1)&1ZL~N8wC3>4u4cA)>$&-L+uDcRIScqEaQIq)kAVf0xK=USs>&rHv*r!+>>9*R z?QF6Mz)u^-)2|!FBlc;nay2c;kLN?gkU|yJ-tJ(M?H^lf1MupDyTPd)_En8T>~O7$91fXzUbcwMbJiMeuJ-QQZgB7&A>f~rgH53S zv3{(HFat(}1o=8CRvI-LvrxN8G}2+v5tIwZmu?G)uC0FX~m+73T@S@NE@Edt#Xe4O;P};_#_^w^5v>-XB(8`1)`3xaam^E6nN{ru(6N`jcWzuL( zpt#R~&Z11q755H;IDreL5dVV~^J#)Oj*H}6;U$b@t?>Ar43k)16NN-7Stp8AJ*Ixa z8VrCMEJgeN*GFB>b4K@SYP9T}p2=nCbC`?Cns+gjZC;gfzepYPJmLmfe+~frE*}Qs0lkK z7So1RhhC!Bo}=~Fd7VTtFIglHU{zP|Rfr54KjKwPriQyT$^GrLB0NB_tWqz<1?}%q z4B9bSL_R^BMQ7@03;@!}XbEKGJi$s86112x(M;gygD0%j60gpV8~!ZNyTv|5(I zq?qbO?7UDy!k6%W_BNjTL26WrTM>)rC0D>EzAw1QFL+J70DUQ)1Fohpz?1T|8|Ug61lQ2?$|$*6t1-%j zGLg!*_V%ewCBn@@uJsB@1Fet}a*gs+b}fnMQ>eyK9y9T6~~1Ec`a6fpuiLwbcmFB1s0AQe<4I zBW@GC&87V|gT0+f``t~_K0~7PbTR>n|4JZHfZmQlN(vsLr6Pi26f_luA&@Bz({9Eu z5Sc^(Q(*EJFcI^Z07FLr@FP8(j-Y|sOrIeMfZJsN&iT-$(_5{2N~*bX1+=Pu zkjmEy5xIb2*xeX@<-^2%8XVYyN%C*PDQ6R(@i zMzh%p_uD^{_#*xebvx#QyTF>C#gxwq$*=0{%xzc|DEj4}Ai?57fGE|5)Vx5DL`{?v z1^&13J)?UBxJ0XxY7{gX?uppgvYrsI={l7{!{F4!TZwHy`f;M~l0+sE5CCG1egAKM zwtxT6{`QCC06KtLM04J9KCl1i#kYQg{>!@cH_GfiwnqvhpqWlT3aH8b2L|9!^ zNcfW0SFgq|*&^LxP&FEjn(GBL96-A_OJ!qCw9uRPrYI>-_2+3pEPVoB_ z_T5B>p!VV1a%R zsJu+cpaUA=^dj6-nmqLcP0|LXOe3eMza#_%P6F%%IG8~v)&#Li*dNkg3V8rwksmND z8?n4mqSBMX;E*!%hLGF16^?_dBDtIF-pao$1q|YbeNBb@0t7-tp>3iM0c$R~TnDF` zAY*t=$7r#}T-+0>o@y^(D1hPs_*ItnPFHmt>knFD3;l`T61`%;c37&Fi-iC>DGX}4 z5XWNs23p;4(#MtUf_R=$%NV7{ZSpnG)D?~GJJ|S+SdMm=9!Mm}aZtt`SYy-^y42a5 z*;$j>*_l~G%59f0xu!x>VJvy0r8juN>7-hQjBfx-{{cF1BckLMiJ}f5w?G3Rrw^|2 z&J)_XJT-5XjM+>Sx(t#WkIXzWS-aR@0uQ)^&W2mcfI-Wb|VF z{?2S$q`$N>-daGz&31v!)RlIRmkxZQ&+mxtEU((%o4?$3$5_O`+G$2DI-iFbNoX&EmC)-0w^(tDakZQb6L*BNewD>M4C+Izb35crLyXg2jcsR*J5;+5nzmUihC`}H%!EKbitJEb<5|@8RFoa!0kRZUa z9NV^S+qP}nwr$(CZF|R_*|BZo?LYk6i+B-@OGTZ!qocC3GDF2KyC+}1=(tSO$`zN6 zAU%#k00Iu;#b}R?#OH#$ZaRY!dx5a$Pao>h`g0-46=;=Ijm-qj0+*d2lbg_`q$}^R z196`~Q}NVXtQJXIBfVd=zU_1dva=#|xO2d7B4!88n%LdmA{Qn!#0$lO)b_lLlCK*} z`+)4{$lW%B@xnK4TCyR5E}F!0A-J)b(D8C-ey94x&7x4bipT6qR+thOtX$gh&MNb3 zTp=g|Cu99hTBDD&G6Q8}peK?NlN-WrLhP*-*yiWz$HR&jDmRB)-ItT@&zzpxC@2AX zlX&d)IO1Wv9V0RNE)!H8C9T+`g#`d$2ca?k(QxS~3%Ai(idiM6!A%;hPr<)3eYR(o zKGfMjzUW3T^nS_Xo0PJAZ-bYj+VFSN7*FJ-pA*z9+j^7MUZ^=w&LZMp*FB(p7 zI3wj!5i`|ih#gy{BCeI&C1)z{fkrWl;ZR8 zAXU*#c;YyU#r^n-%QNAr6XS!kzQa=kmKSO`-4CMAOxt}F4P;CWr4IpvNgq+r`EBr5 zE8wVM`2$U(=jTr{?C|u_;YZNTaQyXSt5~oVq>e4&i>ga_86M6oacwJZaA7AiaGt?e z;%F%URUx@MXAEI2&N zjmOh(_wlSfJ`_6qOjz|xs~P&hy|%*e?pM43$`QNsE1&Pv34P4R{_6sL%zM1{1>E%o z_wp4(@h#eTECH0q<~=ZgB8Z^AcDAcxY9SCV7OL5Dh3-Ag3g}LJKXikr)y5kbKAw|J z5c7PJ?gJnpEvjA~I#WwRl7wi7FYj3bHKqs0cz?7BQk6hm;1VAeCl6{g%_fYm4-3VC zoIeMgM<4P;14>?MS%1nUPzdUGz``k%to>Vfim2q6r-Kc@0M58TWSj6vqJL%Y_!i!CTf2902@VILXJ(a5DSZFJGIGa2lgd)U zPrMM$K0l%Z4t3to*Up)bf2EE{B9oZXcE3h`2=;g=lNbp|hOs}Aok~pWak1_RAWm|c z%Zv)?zL<@_{LO-`du;j{^OcjBp@P|2Zsx3YAgp_vHbE#ZJ}9wkca61yu*Nzs@Mb); z#)Z2_O(HsLnKA4p<5@EZJp{oz02}vHxiIVlZtRER&4g6u-9s~k6~rh?A$o;J#XUs; z*6s*0(%0)hpCbWU;VrkQVJt;%0BitbhX5sG5QyR@pp%hN07Wpj8p0{vyHfd(f;G9A zPO>x?sCr0NxfQ(cMU(fZwgjL(!S&t3=4^89-votUWlu$M*vF{qu6zo7Q3Po z1K4{3h_ygFA;k!kkh@RlyJkS1oOb~-z=pBhf#Kx##E>_FKy!87B(2&-A^@%|Df**h zMLhs^tEIg$u!h8!v@@^~!XCttd!BfXsU-yQHk=4^Sm*6-Y6!-01&fm>w>d}WV~_zH zT$~e&KC}}9jLM)s#$`rWmv>1QF4TA~7Xa5Yif8OGYysR#Mf``!KLX)e&bSkUSTbxb zC!~;Ghy6tTF$m&}s{y|3AC=q}bF2KS@_9AB1uxL8CcdirsP`tEer-7Yy*T!CTZ&>n zgb};=BXef_sj@8HZXFRu)OF2XH6a60*-x5YL92&`pgRPY>4>C8+a$9{$T1l7VbLMI zAcBY;9QL>sl$|3$n#(#x*t$_g>{L`0H~@ARi`BXO7v85}A;~{!cU}JY;J!)Cw(7?D z^yLlmYfRz3Zh}|M#CvtP#|`ie7N+6$l7;!C0e%;{@H_rl zR*gdyoT2_a^Ab9D;(@>j@5vYu+#qR}2KwmWwb{3*I-sO#2nd_mD{83A5e4pPCaP|y zzyvAsVzaU&h6R%v|gmu2MSP6O=oLWimF_vwM|l5zDMY%%pc z-F`lzF3)dM(?+B?6lxJa0Od%Kff^Cfqg1VFf#KuUBHMRS5j~eJAqG!SnNn1UJaD?w zPO}amEK;=u0ja~A^0D<_2(k4#5a*$T_bm&l6XP*;DEj6uq9EXItw4<`KJS8Bg9<>6 zG7oZF8kK`MRkJYm2=9#o`qVT_F_N3V~n*J8ltw0>Ii1xmtvyXG2Ct;ZD%xMQ) z2H|}DVjfjMAHK$;z_FePPs=aK6xel8aVZ@-v|ritQlv;BIONjp=-w`YW($c5KMNKr zfW%}7l)$vZoV3!ld2SrE9&$e>b`skg02+V`DJtU$KPZX^ z%GfK~F`w)vm~f;>Z6TI(E@uafhS-?NohuMExT770X+(L0mJ-?5 zN1K3k%N?{d$P0w-M&2bsf_~%m7%_N<&8h&#?+=WoKH_SPB8zi;tZF%X$WW*vOr!S) zwR%X^FGh~FZaAo5ZGyW_=|QXrX~n@{E?ap}6)=A+zVA_wuN25VZKothYJC6fcJ8Wf z#w29#m;RLEhQ@kj>%i-pJ2I?=%3ZY?@FxI*g{Sg2s^7L~yaeNCMjG<|;Oiu&P_-mQ z0+7N?RjFXB;9Urum&rj%0OS7YSfByYP_0soK;9jd#DRC26`*!InyR0qn>T|F_ycD8 zhw2bap3Z3TF4RClc;i~}74(k>%lXn9?Q7Ds$l@Bep8w29H{5^=XxPm*>eiOxfl5{L z<=8DogG#CiwI~PhJ<*#p(Ut{3L{UjuQAIs6gsI7wsu(bbJ_#1Ypt; z%Lo;-4eGP*n>ehmn1AK8qEdqWWWGeix9VspW?a;wQg=1exXqmS6lFr z=^o^i4zLuASsXx+!v2s(^wKowD#y8#L&_j)q6nc=Tq64tD z%z)%i7$Ugdfqv`BdKFi;{)PG6`KTU+i|j$E4q)VOgAaWWZfSxW3fyKrNMKB9N|E+iDiP-H!KkzwWP)b$-_^Y*xlK2p7)8jPkP{#f9=J6#{_IOHi0ZX9f9&Z*H5+ z>IQe)*-dg3!P{0}aV1*UV^l@Jpys%alN_$NzS{OZtcZb*q% z@9JY`boUh7UofnedJ0@UDX^)H`N#w-IukN zE2lUaI?!?Ns@PTJd#9d=ja`IpgHr@w_2rtJzmd73aF7J-LIaqEYDbB|vAIwBw4W8X zcXzMmZT6d6?CQ-Oo%2wPi5e`?`y}eSk}Dor)YWa5dpilL7rKDC2LzC*gqGXct!t*R z^uG0?{>a7gIysdI?k4mMh2oOllv$bSKNV-$C__VBHQ!s++8?!Wl8(xIlU~WU)7bMO zcthr^{C6e!7gb!3tLf`XspRTTS{y#$_HZyz+gnWDtvd*Ke9%2Un#1j5ZSLya_rX2i zf3JP6$o^zTe;0G>XCU3#W8K^WI_{lz;?=3#_3mr#` z|LdQ^j{~yw><@6IiczUz_K#|x`-iTWDpDZsvbq6yt2m~oXa{X?@W*}e-P%pDT@#Q1 zlUIR|@xQKDHNMp(dcZPe0GzC*67MRPyXClmx|@+Jeneacl4g-A<%m$G`9G^vsYu%# z@9X5{j}IT!zI8O|5><&zRGljOZrQ`a;l`=#e?L=4cO&O5z5wn54+~OsxKRy$`OAjc~=~`arHmX=~W^?NCZ!JZKGq>@Z;)nt)V6kyP$jCD(}2Y zs^`tWZyIaY#-v>^;W>(Dscgl}msyARUs{ljQiTdlcGe$9{ z-LVGZ9ZnbZ#h*`qq02%dpMLha+`KeG)Xr1AQySJbozB+#&ZIav$zi0Z1e+Rz7xgM< zhBHU@_7U?HEwuj?AJLtrBeK(OLxgSf!){#j7?J2H8IvEZWp!+X$xpybLDCQIwmxvM z{{v_gMbJ_|1k1LeejWhoK_fq9Ov=8#-RXGclYFl#m<5fTunTkZxkx)5Kjs|dz5nVl z>j;{y-`?x-RK``@>{(fER>B7%u#8*o|F})zqW}7X=Id|ylxWONZNts~neJVP|JW{v z*U8Iy3B#j_&^H`n>PtRsHxlaxW}ZT&Q>y4cypmh$lj%;>P~P%r>#}pO_4}?o2Xt%J zcMI>mzs$`481uE;X31b}5rV(C=U*ki-Pwltgujo;E~g+ZmQKz3 z@({RK)tClEiDM3CyQt7(+mrDalb`W!UiA2pmzZ6eMrEp0yJWg~hWQFC%NxdXXuDub z{)vA^p7wbU?AuWR&%f?jl}uqb%3Iq}pt>bhgL2@GF^2^S9QluHSN->F0QOyx#)FA*Dv%C=fLV0#I<{A?J~Wp1cK7QeH@2g6i@yzXzRJaZG_414?>Z2J z_q$3^z}3M^d-0Vm4i*?6+nB+$_e&{r&jk6^s?`=vM90qk7G&4>-+|eXzo?#2Z#n;T z4>unSMv+nJRTES|e+=G{kLgpB-J9NW&At*a(UCmv+fSL}&5^dx80WL7K2R-w^&wM$ z#&b@$4|Ck1=1bnqZa6s&VO}}D4Gte#_$_~WB;>vkA5Y&dMo!I$v63ap0{^=D0rfs} zA)gJvKQRAW`XU{hNAQ#6iGE{j*)pbX*PLoK4WiN{>(2c&fpeC_nFk5<{m3wmKGDYh zi2Ow9?0?_Nw7i=@;>~H!5{7Vk@HF6b&AqylOU7w&b zCz_5a<82{F_sujF-A(_bbj#tweQ9kj4(eK?K8?#7h9xs+1jbF#w1U_s+)&@r^#o$h zu=f9MUjC+3M#AQb86OJY57SryukH;s(;>au* zx4NSLTl13eg3ON%!?mMQ)+{)Ai)N4bj=_nO;VWJ`6^RA=%a%n6diUUsE9WItxN+oM z5Rot}dZ83)kVp=R!^aiqXxEoi1_sD8gwbB5m^b}!!qK2GoHVRCGrTm^e3BT$e;Ws! z7=eBWHn~5W-agp5f22Sq4I&coC-Bel{h}BB63TSVlxg5Bq+}sgbIGbUqlR7b@e|ul zOgzKG+yxDg7G#IY#7KM!3`?3el(nl^t^(9{hN9{6Bra*~M%_nWWmhoT(+Nw(AGHBr z?kn}AOEL3`%L%=<;jG(uR^X**5F$v1hc63R8SP|8AP`Xml$Hf7Cjbaj zn}5?Z^-~I|u4vsSmZ=g!07P0vi`Pb|a6;``70S|vUV*ZW3!Q2utC<&}DmAR;Cu$45 z{GD~=654{WSdz2Fd1RN%p5xUOe?3%hnZf2B_&yPQms&r@*}F_)J+cyW5sGpTN>vV= z9g=nD^Goi4l&YGoT-`7kkTs7oX0QqyVS<(1MJPj2*XPX^VzczA$$DX=AmC-Bjy(tl%17|xksI|@vL4c5) z=-J+@AHSaotNH4Q5B@M$9%0e;fve@nq`g_Y=2bdYttO)5);UTYQEAbvOpri{RV-7e z?o8pxuUDc}yL!k}BTBBsthz-G;2!gyT?N@3;1y&F(m?&|!s8Rij&-@=jG@!H|D-(C zT-kr9o*sR#WLa{4=D98-J|5xy=b$2ct*nZsDQ5WT5=?hyj>%~AMwCp>UtCnb9>o2x z__?BFzE$^{0xrCk>+PSyuehsh66U`A-cQ`>h9Y};Qt1*D2U|vAzz1TaowdTDTW#90 z@UJYVQMPAn8Jm_R_8_x(Zap-sVu!(!Hja}_y$P`xw<4v#e#J%>si;>}z3v3}DMMiFH4l}{07@-`gr z^YT_~!LlG>w|hr z=r_{8^p-IHg&go4jTwT<{<)vxHVY(a=ZNkA2!+W|{-7)AXn_Jm-r#BmIh<`~A7tG0c>C7b(ZtX7N2 zJG<^-YtxctYCU$DHBL>-Y-KO%W|pa5J5BWpI<4c>(|3Jx{l3vV?uBK)iAaUTv#7$Q za@?S96VC!C9#ePbW(NYlE1z@XIE5La?6ay}p}pidWmdha#9`VmQI|aY2Ma%)iUcSp zh(lC{8uLsBg)*lI2PM%cHAa!zB0w1eha3cDgp!c}$e{3(G;Are zeF928d3+5Rb++;sQ6e;DG18RLr!W&K`t}Z;`}mm9-LXvaUsX?<;QcUt6?z?NmfBzG zf%7_@0l)w?P(8^4m3h`tPorW0okGznWsqV*)hbkNw70+$XQ3;;6M%W4I+*G|><{~P zI|Nqb$!U(YwH;e}GbZLvNy(Z!SRyK_=~-@UYpYp)J73u7N-1hR%%2~m$ew8;Ugu%+K^?UuSJ{rH!uP=uzcMok}-MZBbIXU%uzD zx&C}cJW1muB4B~a#414kzIaPip_+8D{&9tm`;8vAVLx0|^exe!ko7ARbY1VB&hMoP) z`B>Akcr@?d0a%1* zmakuVKwcCK_l%(g^t4`6GvgitdcScujdzTidw8r}<5S~r0x=My>jp4k`j|Zr%1x7RPTjfpmYJF+x`J26f@;5cOU}!jb-jraqM+o?7 z2}Gzm9W+1^;Yhkn8JHIS0MtO=yYW;H#4gz?Av`Gv(vel8?v_kb7sNTAThMIR#w5b zqq1KCBo+C_Vlz>&V$FflP4i04E~=$WS&Y>pCTO)r8Iv|_nzYnN$#Nv6mYp{#K8Z)} z5kjBFgTw8@9hB@SOecDM@5|QpmCGI_1hg>i(FYAJbA&;#Q`#}kTMAJ+CBbjJwUf(O zrb0!G_wQVRJJ-t09hps@-)x5De)KnFd@U3EQ_c21xrL}^2jEVP8avq?m_&JW2i_x( z%k+Z&r2J6pBR!`kVa;j}HuF#v(~U)ayq7f|k@__=_IjY$JnmHy3N8C0>>a7Li?L@( z;}U0)|A?ZJYNFsD7j%%r4$3}%}2N0~`Qef48+i@u@D4nE8jF`$+qDIAn zsaTwD>v*Y^N0n+N$rjIpz_JH-JC}WaHG@YB!jkv}zcNx3ZjG$=C;?u^W-Vu`kq)E2 zNeg-u9#sqo{ z=275wSy6ItCOW^)f)$Ji^o!t+tb=cJtZ1r*dKKu#L$XktGga#63A~*M|FHGJHp17h zS&-+tQVc2%$kK5@Meqq5VKD{m{*fq^Ik4`~gm)O^-?Ifnnm*xJz=FxzHNjSi^cV5@ z3ZMY@$=Kgif+Rz&G19UE9bk7F^-zj*>p$cSFz3GKelIBI1Hh-U3}(CcZl&bDhlL!Lh=>jVrU+y^kUbE-@HZUQuw(%qzN*$LR;)_R zo2Jtugh(_Mt$&SDd$3cl^+;C=Qn-&3O67v4l$Gz0C5txbJ~jbfN48zhRH`TETaNsD z{9WqmT&o#4yJ4kYeyK`8l#`f^N%j?4mDubpJ!Q_{P5n>sG64;;vJ|I)s`D>&W7=pO zP3y(&H(2dh!ds(^e5Nfa@+-`hkAb~NA^V~bEd8HX0q!>Az6vs9RSSf3b<_{k#E8ZU zc|;fl^9rgF@9v=fpsh=z9FQeZNKSVW;1O?yq)6mDzYAH^=JlpG?Z?xU);Emb7$>g zOfJaMRqbUYF(K_oUlF#MTzhQ8gm$DQam#lqvLgA(_Y;7%iCSx52@Oz@^@I*-LouK! z#sm?#`6uZL8gC9uh!%nI?*cWKA62PVtEU{3P$(s9-b!5)w8+ucYw*so*|jL>YuVF( z+Da`KfiFtPiy?{<{`Ew_-->Ys|2Jg8JDp^yuWSj0X4*wB3RwQVk`(-oIpH^6uhG4lJXVVp?92sXwE@rpn1sBp4nQu> z(JiFlG8Xksl4CYG#}2ZuQRm%8#yw*)UyD@My#B;KRH&w@LZ=}d9vBIf&^T6=yWZj> zd24V{kLAAStD0<&(E=>Z+eNlaf{qx$=4K$tM0~I$z~n{?`lf1>tm7a5n426W8*47= zXT$BlFX^0_}&aCEZ` z)TQusFD8iewzaCIzgo=bd!?nAVeeyna9BTIVip4XHTv`8(n)vc|Q)!TjWJY zf6PGOJF`{GL+@1i+*GJZH!V@~%Jzh3`msiz6>E3rfS#>=ep#85FmC*z3&q%h;kYS&bOHN_XP1=w0HHHQesyfIf=?Qweg}};@-qZ&7-}hm`(u}qg=I`#jKXr z)J@V~eFw8uU#mjVB87WT4VS#+#4|XKm;w@msXtkz7KR8}62H;oK zU@KK4PEu}C-9&qBLvmTGM-7Db$@B9cS)m^c^Uf8meudoNC+ywk9#}ru6ZC&t&AhV8 zu*&0_c9%(hlu=%UXaMh+@98OSb1LALF4V5w8r7WR3|mf=wUqp#bYyUKKnEBr znuB!g>~;KXHlTm>UGwJU0bW)#RRLsnG{voft$I}?zCQ9H3YQC3uq={@{3y|pQ$(JK z`0j&5!N`s2=@Hx^Nl^gBSpn5K1FFjb)cI=oE?R26c<~y~a^}d}a+IxEj35PGjjB~` zP^WW0ltXwR;r4!d3Fq?#eNKQxq3;1_X=`yqK-|4_$6F$n5#%j_wTg8_{JybEH0+k& zR;Kj7R4Qiy9gQBo9!n&u*4|pD`aknWyrDW;`SeoW@JP`RpqTN-!2$Zf9V7Giihz$eSfw5y zmUj`L!lR=VgyQitTqY|2{Oapf?Ri;5r4sHwG_A%e01zJ)h-te?f zomRPalBJFsxMNcH+=?_DP@WiZGw!o9;OIw9JaEl`cTx0Wapu7ClfCvCJ%>aaON~nI zmjRvMC5*2fLTmfm`BknHU!T#{x=lw$|DK{1-TnahrTt?tf5w(ez2H>;I=?|a+j8g0 zVt{}*z|6emEZ@QQ;58e-Ok|B<&#${!{7p;0gQao#08@8kA(OmI7R~v>n zw^ybr74%IH8S8Gvid8EoyU|XvlHn>nQw9o*=&KR!4rkvN9HQ<3ogS~zS54~b2hi*i ztbDw4;=81ht5x=__cz5BBaye+0~>~xbVKjNNyG`)AT6LYub4tT zr(~;k;;yzE4S#xbixo6oyhNQ-jd@<)yxNxm4jA+6j4ONsORer9=5DrL6FTgTkf+{9 z#u>(HoH@Oq(I1x1ckisgnXm&jP)}EryqH+fG5#0?!oDhBOWj8E8GbNVK>_B93k%pf zM&@(>7Ma1N{imudMS^60GztV9Z2ajp0!6uWP(9mBu@02pOtedh5)BeFudH#t&R+V8 zy3rnsa8ZQIif5oM+Ok=qd@lPD81}+fDp<~BrtVP#s)tKKQGo|b%YudS_T-?ZTPQ6O zby`5yB{0_^+W^Bd5Z9TH%uvumpSi5o`-q-$S+ zUV`I!hs^Xq6U_Ah)xbiuL))TJ^e`;iRM7pnXUJxr8ZxX9Hhp(^SGqxg z8_N+o;R8l3q*H&aM&RuIJ!if*0QQ=zQ2)5Gjuo!gPU!Ecbym!WwUaFnAt^E@@JeT3 zSc0j?s;Utvgh1S@^@z-Y_@~z9;2fu#>58lOScT{+m`5o_{Jr_#2bvBWDItXQnHNf9n}3ElrdUYT|9Dr4YKFYEWb z&9T3T!u)dF)WJ9J@e=)mFXH}R~ zyr+L|W^a0+(rc=@|9w=GX0#!5L(lR5^`n0Cd70xwwaJetkS}odZg>O{jVt$2lAa=G zCG|}@HTFRojX-*ZER8vv!&7D^n)D2ms#Et>lKIsrRj5#b8fwZ`v{ZGn;`gEae5eBI zyAJ9Vv6#T5f%hbVtzjjf;37|DJWb@m=1F?hf|HcDupnb3PhME;hOX+3(ty>;Bv1n? zzL}skAHF6`W|~*>!>~6v>sPiq(rOj+lCR)avw>NugtaPHp+&P;cGA{czOJy`(sWY* z-ZEx?LD_S{vL0y4uXY83{tg-yItK59?4SYP7Q$6_YDETuDMrkSca_ZcE>Xx5U*xb3 ztIjzVMAO1boJdnnZLM{G)yUSUt9MsF%Gl4r(Z*^4rY0!}o&93^T(6kbHMqnWLT}0* z#*9%CjYJjLv&yZaR9YceYQRz#3?rl#u3fN3vFcQkv0QG#y^c!?P?dlH4}1Y_tVb9% z!SN(Mbv}VnSVfnlzQdTuYz;_TPGL)q5>wLQ`k5cD_C>@bihAx|;p$~_Oe~}%tSh5Q zd-(ftyN9nkmcGGk1OPfW0ic(7FefpRB|_`xeSm-kKbA+*azr=(2uiyNqvc{pcYHc8 z1$`TtRd*XXwB{fJI)P}(>q>mwH-*FOA|fQLCMx%Ownw6Ek~Xd4)FVb)hWuMV#~|*m zx_Kv`{*=0D!6}d^RV!MS#A;t%jXv4hp;hQa)v`-$6FLvY8l+|oT+0Sc9n5nIl*fxV zHTGVBW}?J?%ITT68QVdS&B>&p%dAlHk4Fx7#2P*7Af|ZIyhryDd%w*30lP)kyY*Q#r(=J^J6#Zd6#wwv z!jci?H66tzJOtkQBsX?_W?iu*kJ+55x~dy%v(>eIn~2Nx)or}SYwI7;OtfZvC%*d0 zXosJJN=rF1Rp*XEzRhmlhKnt(E9mI)5tjANXBH#i0$n9Qf4BwwvSw3pJ;DmkS$pMR zlfDidoS|w>LIaH1pKuoGf)Yf1O;dkHvG|jSyRaTd;UrZPM^q12%Q{$>gVqCVr4>b~KL*ir zRIOC06Iw`@Q3uhA#nDOh)~7<_W{SQF;IH>ob-8=~$4cNYA{NwBQ5rz;UYt0*s{&qvI) z7Gb#ljkCXVIX}trK_?z!i@Yh`lT6YCv5+Tw4w<*3Njw;^_lLEJWvxI_AU&j(=X(V! z(uD`sUTUs3ah;gY3$@pqHi<}l8V#HEDG;9B2U!`)>9H0f2?2ecij!& zUth1Za{lftn3#R?F@J`?mUWFP8arKCHSqe;Hiwv>Oh2K-pV3!#5^-|of>A#_l62%n ziPdLI)<^@$4_#TskEC#zwS{iwZ+W-NWSC`^paF7DOzia zpz`EW`tnMc%B!Ik1vYP7Po=*IAGV$yUz1T5qn%Q!$Hb}q6$T9)*;}lUpb@A2Q4vJ`L}ew25iu z+I~w~%O57%rdz|;VQ$`^7N31DuUueUv+iiFeY>pl&(n4KuH9YD-M>Ab-hchqzWrWr zy+wFG@Z{wUwYy)OfmNVDWK$O(RZE3``gk$HzvAceh(axBbs?_M7f< zd$wg9*9bno6PZ4OAL;Mk8mPtcMQf+U?)-X}v`bahQ>P`D6?niO}McHS)Ni!$2?I6fzJm{0R>w z@T12^GX#&2e=uY`As_Y82x?5pf?partpMViF%TE!KN?n=p|?97X6jV%iGZJ8;N>_# z9k%>tt9Szi#LUgl}8XfwBXmHk48u;X5VP|Xoj3WHh!9c z)G+=VL##U%=D)nDWrBP(qb_C5J{n|1vic{(4=vs)85GYoP{lC*W8o_i>`24=kbEJD zZwc_uu7jbSU3)`1x(Fv`hbFU^EI#u4xm#^}ra zD_gLBG69;NE*KA8*;EVchxE=I^fPr#2vYu?AU$=19}qCCzGpi}6j@CKqs>GwI$GcZ`RDXKsd2 z76+V>xq@E!V0|z_OUQ*K;t?0n&=Li^oPQxt*}y3Xz2rZbQN@gIPE+MTQ6)*U@9&_O zjZiBaoKe9J9Wf+*k;|cvu52NbbCZ^cR&&HAM)_KU*y;P52_17qC_N#ilg?~V24)I% z`Uz3e5f(VZxTgwQ9W1Ho+&y1x3zXFqN&Q9wbzN#4(NDQTWV({q++@sjX!WUPpNkpvCRMNgQbY(6a zao0Z&X%W=0YAMd_Snvf(UX8ZbU}AWP14R2NpQr{P8cI`#hcnd?y|*Bbb%cU zt`E{Dxig-ay81G_of%X1%--D*B&_j^hnr3hoEpl&6|xSk&KQ!Z*1OV_*{MC;l+%iO zyM-n|6{N$TC!Skrbz6@SpPG7QI#iB7uMG9$jw;Z~6(Kn8#1Zi&Y&I?2(qG6qesnsh z%z0G8dtp6TYe{1XGU;z<)9+Yxy8=}Cv7~z}w**N`6jtWhlUD@#inm8qFlw?^M!DfEq}3G&!NN z|LjUqTJeNmtk5=U_pQ@XmU{PHwMJWCIDe9$>;wQby{&ee(XP^1BxUo18UH0HGpxn_ zCsKQn$AQ?0Bo&?#Km+UojzQPkv*MW0_poS@SEMqmr&=#i3zS;a6(j_5jfsu+k zWgFH0Z0w_rdwf4hbHIxGE=yS75#f@2dcWxkJ;ZytKvi*F!-5%GT3Ge;;xK$}Xf46u z`FgTS+c4NgYTAE)ZW&Ti#+Jf8xuzv=RJ&5+S!99>)<9AeI>GwRomWQq2+{1MVZiif z*hwdzK<}WZTuW}nw2OBCf+4;BUUXTiOqqvd>)A`U%dxV|+oLY!JkP9Gu3qwhAn9-> zUn5@9z99wyojlV63*7h&`J|I9y>~Befn~SR1=o8<^M_F-sAQa4*L*ZwFv@x2z-Gri zN0g7~+;oxAc2VBOOnH^RHNpl|U7gscll`@Gc&%a~ROK8!F>SVJxl_%>)qY=oC7{IL zdgNk$1+E6~>jHeI344?!kONI)!Oo!+{;LYKv6Wy9{N`-G{!>BrnV5eW;^tD6FHX7` z+ovsf7kFZ9#hB&;*1t92b4yU`ZiCB)d#V_&WHtEaO3bo7a9!>Jd8dZf<~ch97W87p!Ll+?@$6l_h+V9xgqz#-`en^*<>U z*--_{0+m7-E5Q!fFV+&1wOBq*y{;uCZTfCM7vF2TI-ivkq3=fl77aOo2WxB~E>6(|NXhBj^XHsP(qWh0xB?&U;cewsr>oc7`4nR(5QY>hki9 zo65+^QqeZ6GFd)>x}q0J8m9)bM0{WIa>P0C1+&i;;XamuYJ%r z80e*0=tjLaRUCuv@bXjgjj{cWh0XoT#j zakJ5n!W)#*|CkbGFzL=WeXoSM!hk*u|pdl zGZH>FG<@UoPK|#d99;~o@X!$t7}4~w^0M?`%0&O6?HhwMiGnTLwr$&XPg~QrZQFK# zZJX1!ZQI?`wr%aa_x8ox{k6X~Dk>r?vnp<7{ivI_D$hAorpAMd%A~N$M8v;iu3v}l zA8$qUeGHKWP!KTC9#);_o(`u2S`FPS4L#@tSi9-~Ik+dUQqXQjhIXC=;((dyDa2X% zVa(v_$)b$GXw3ld7DGcjJ6|PM=X}}xKZA|Y`9!eF2bZt6Q%jGA&$~+tWSwn%4Q%-4 z!kLZ6%8jT(47)2OuW%ktZg3{`Ot7!;4RSJ<9zGtHp2R(43`2oLWvN00MbW@+j%HXY z*Qd99P=gX?sby)U$HIw?ldN~(4kt!F(BySvGmKNfDFGm$k__UJJ-?ZmyjJk7VxO%fHjH@F;4s7(lF5;PY-WF4Cs20 zvURjF_35UkbK(#gry$G|RguBi<8kw*HT9-+dH4i5>zVijJ-OU{?A)kNep>A5d2K-z zUFKcC4c!7vLVY`N5}~n|>x=4@GgXh)!r#9<d)p)}MJ%H!NH1XSH64iP#k{;XGCasq8Y^#Q zFP`I33c6-Ghuv#wX#^!^q>0^=JAN$W+@1}Q_WM}JqY8r--Vpg=aZ?8dFOulVW9n1TBTTq zz9VI&ek`^?DQoqDG?5?QS8Sm>PyW1{5>M7FcXIW(%SIR85XjG3osTWNA-rMpIQL1a zp6H(3?dL!?Jx!Q9w|<|ZCo+u=Ij^?WNZ)Q+>SDKbqZ1B0k?fk05|k^?`TND9vU=-q zmRTyg0a3q`*{SYS%wbUp(to%jWJct`k-Eue>lMWRfOR&RwYm5!1&kG4gp+!PDC zEpNbvC^#bsvmQw}=EX38pF+T(zmWUI_adqmsk`A$Zs163eA093xIhqntqUn4M*nr7 zT|@~rZ!&bW)Tf^@v>SaOs$sO_wB~rguAgx9g)G%j$WnHINKM0QOlep_z1D<`ZzLrK zDn0|oFn4z-b`Gb%TZoGmjGeavDsIjTJ@Q1OH0Yxaeg0^0@L-;a3kw3$Kj4aq>(x6L z^d%gA@OJkHkD%=w9yG)-fC&yM40r%wB>;yU7Y@bGGe~5JMFtlf;%^rpuV`^vO?BZl3^O}33lS61f7;qa>|7lG4*vgd|1r-0 zYpnl@|Ib^7oa4?En+PIiH zF^bz5x|selHMTb~{oiqBB6e0*P7VQq|9)T|*;n1r2Fc6qOg=LoJ&g*9QY`Cf872)t zN#H1MniRCemr?;_Bot)8W+stRNKJ(a9dpTrVv5q$C05n07Y6f60uv<@S0y@4KB*P0 zY1ZA_E3?~qUgb|(AtuNExz01Z4>KmnRbLx7A7feOGk&>Gd?(x|IY0#=@mR0FC4b&) zo@W{Y(_Vz9xdX~C3P{Q)_y9`joPLN$Y0w#O7NaB2*SZ+1z#?YsNF?|go85K?-j;x76qXZGk$r;m>$7va-u@3= z5sV$!tDh}LnLOt&-6sX)hD#YHiK7nq)|#u=<{K(vctPT!hl#Lh{3~tstq*e%g07_a z?1QWgPB%?=pQhCKv}2USgvIXmR>oJ`1+lRVj$#0icB$+8=Y#oo*Y!x7=8qhmc#xp| z&;Cv)(-+{mlMxOBzGFX+<3E}#SKx}^a6#meBK_-56-Hjm-u~PITv?y%zrw00#20?; z8)U~OCw_&D^`ZOxE~N5%2bxDNq*d1oCjRiG=@#cH*(7d0l?#w1nQ$Kq*`+;PoFww6 zoY~S))EACRN;imKH1J92*%Y^6!UFTUcj?5^=NVRb2af6$`a@7;8x#NvL^~3o3#0~Y z_1%XFG-gfNH(02H=pcCqxf9Uj1h+&CFZsDNP%5nUD~He~CKRkhxdO^9Sl^5y(8m@Y`*j>6P%g+C(LGHKIm`>X ztwpdTd9bZ0_baMmPa?ZN$}Xv#XSie@Hn2EOuecDpLU0NtB16I?X7*| zI|vz62R=aFl^?mQ3l)0J@Puwr6>~`zI>GGkaQJJHyhc4QUekB;^A$=Yp0u@e6ks=0 zdYeUVHRw)7_}bzO@(PZbkdjl}wn%Hcr4I>S(*xRr>{JmqT<0t1_3P)J=!079fM-GR zz=;ZD9@t@hE1ql553uL$lk#C77SVg$`6+HItc8Y4-Z87IiTDv=@oa+xAC0weM|wD; znzYC40Arj`K3ZBTSvj|`2bPKqY6Bm>Whj=sh_D-r$#q*1-B`w<^8wS<*P7=& zIW-}^E&78W2*SMY{SrWrK%HWnbaH}uyKFMhGFxg}UIbe?f1=Rn@_K!E^k$P*VtKL~xj zLfyFAz8A)R&6=0ARoJ*OKPEEsm<~nlt}qXES}n-VsFy%Y~=lFGKXt&T?vzt8cSuw8kQd>c!dYPXh;fldaWHZxexIUCSj^*SaBA zxnEVs{6v*JK5BOy8G=8jsqhX_HhRzxKC}j>)(R8(+z4QN9R5yTLjMqez>3eDmRj9Rusr|LT|99IdyGq(C~}&j$R|u zO+%bPCqPVDjy+3WS&yL%@YnW66&nV;C(b}HEG9_czkzr4U)OPGCp^B%SAnMhK?1-P z{L8Rya(yy5uLVF|n6DK9H&9f_4z&Ti;C(zsFDg(!V0G$!{2&}r&2yFI*2{eYz!@Oo zos{TTmo@gKyU;h$J_FD3lwC3dooROPJ3vdob$CFB!dbw_zyWxcC1dK*pF4jDg$bKv z`>YZ;fQ1OVMhj+P+hBoi>LEhtKRf5BC$Mg|DM5UEL;P@uy7VK@Ur+Jr2EEWq!2B880!jvDa>HI}b zf6x_ksV?_TL$@aDpXK}At51V39?^id*L$Fk1oTQhBtG$qsXD`f1b)AMM9BktAo9x# znUnqQYV;O>dj!@SJvVpUQodDmfd|^)+}19!0y_Cc_&|9J+Xlge5dK6&ulnhPs{d2P zXP4|10ZmrNd=?*2(pBpfSDJ%|wFBjm$C>poxeJaEgCUkgqv#5BD9AkrGJ^;W#WlDY zTh=g2N{FDrdR&HfIh%!s8tqn^Xzyvt@z3d6EjZ}8oSE}JM6VZ zaX;^o3M0rN^{9N)Sx+yw=9m}1Dj*Np&Gh$r%^Ss5)7Rcv!ovs5psQK()>&vyjn1L+ zM&eGOUH?(yjhp=f>MrmqaR;hX9@Xg-tz4oHMNV^aQy&WDRh^tao3MH|;$ZnpHER_J zms8}6iAY2cRy;$03O&=FE|<;8&`%<(7ex!q;D?r=s0a4P9XP@{OVT`6i6Zk|GxKp0 zs5a_x3hHP!AKVrgmn9DEux>?Jn;A}Fi|cJS@9ihHDZnpSW&Pn%%nP5J!HEnQIkv&(#|_)=wnxqqL6A3WDB-+P?6*$LV= zK9KDE%PiUhy(-B|RO6g}?XCM8(!V8r*VJ=Z89G50Xtzt{z>A*iPX|kvrO(SsvrA>75_Xi~8?~(q-kyG=An2 zu&EozT+5)wGe1UCG_P15>>eAK2WI3+eC>Vm9yhfO)QnRBmiEy4LK126EbOMb^8CoY zjGTUlrr{20MBJ9}?SKwDECa!rGWy0&1Hl_>(XIClbHW4esTLjY}~x^#oz(h6fP+~Woi1M6clp@DmthreWeWv3$HAqRNgR=U(k zN(AA^_2}-s{DL|d>d6Fm@dauV0O4LI`Zoot1D^w2FgE(i z%t^V4V80RJQEtuxZuz!-7Y~TM;}wuh8-bL-5dARWb`iT6;6CGWfwv_N2&^z3mSDeI zqR{R-f#pFzp?AIUZuz9$t%05uVZ2GcaQY?-?TGV&cXc}zh4}5&cQ)&Iw}At2+rAcB z>j~!~+=+&VSUecl#oR1^3PUjNARm+(m#S8*ABw*I_!fS|sri>&`H#=0?0;*2|5|)q zEw-f7A>I4ZK0T}refb&A>pj|t9=X$WUG=NEhWuiiQ0&p}`LLR-01(>hT^9L{4IUb{ zuy%>)_j4B`mLM*B3eF^o;nER)0dEB$hd5 zl@8JC9(-p@FsmH;B}bQPYGh^_+68+AJp|3oI!+!sBq#lk3O-FGUW{pyWo;Ox1N3iwFlQ8q5LvX}81#gLz1SF7cI^1vpwWKn_;NV>mJW9Wfc~tAkVGge=nh z4Q22rv?)0l_~+e=0#X#exRDF%fH-HmA4-YHnG1_J4pNF0=p1@10rcD=0q7GqMjUtt z!~!M2zq39n*pR#!AA~55G6!#My)+s$+PfQ%YGHFQFsIs!dyY|bV>Hl6rz;e6EFoT- zdyY`Zix+Z{GJd@y%$MioHD(_68~6`+%Zp!imzu(H5K26VFZ`SZ;Nn%0etX8Ez~B67;VB3l&@ znueg~B+4oo(_#*H*yfZ?PahsEI6bsogO@Htk^-sg za?%h?(9u}mjQ#s9hc_!zKlzW!vf8>66XHfDB5&l*pcQ%5urwW4y%5IlxvA*Hgr`}q zOX6?8m5MqTwQC>-4g8x&W5lYYxIvWKM#o>^5l~uW7K$Fx5?9qiISH#z58DU7>`9x} z>W)S|Aot8;KOu|3GVjt|35rG!>!q1dPC+X5LNZBTZ*YF!i_*pxU_%$Ic*@yWhBGDJvi<@lMCHt>6f=BK$UYx{GY-?VlGll9bK zHm5f&+_AO=Q5q}8-8%wpcJ;!>VZ74y~e1-B$dXJ9M1L9onUnc8r%r~wBA zI2B$*ujHWTI5#@=lfDi@B)OXNbByT-oRff^#qD_rek&~vbB)N~ng>?yZb8X`y74+i zunpDKT&3mBo_!l<=PrRE{JDW{2E2po^NGxJ3;kpW2Z3x#I>oTwlzZ7^IuCF7)_b6- z!T;#4;H>Sk0)* zE>1!6>xZB%7fUGU zvAKOT0c?LYDmGaHV51Sjx3qaqiU|Z>4aftDd~2S=E@iyEfIT(_>D{tZ_r|0`zT@8P zTwBv3N|S;#pZw!^)FgySoi~mG2Dxnn@8<#+!2WI@uv|I`Ae6*%n85<7bp_?pDakh$ z!?l5x&uUy5SJ^^HjS)!)lwhPsxU(G@OJL3V!G7XyLE1ANhFh=Qm~r0Nm^6Zz!cTvf zSYd*GgicM{^(M36<0N=)0DX%ZMv3g5-Jb+|@EfRNb8VcZWoCwYt-Zc+v5Bf;5kjy} zUG2A|7cE%tJvtS8JzJahmiqKE6QW(I2S9Aw2)PZ219=i<0ur#>|4j&>G-VcsF-?&{ zi95p{`+B-60O;8P%ZLm*95IP;soOHAq5>*G(jjjdi5Or zAS0?1FU26CC3bw&BSImuZxTceI{a9w5P zMg~z!Lki{HopTJeDM5S3@Qv2}OtwFXY(|?xe-uYcHz#b1gnYL5IpVmi`aDd>Vnnk1 zP_0GnRSfWOQ>M^WW|vhN?=mjh^Ztyo^D_n1TyyY=S6GI4p>)`1dg<<8q|x4|zU7 ziJ=t-U7|sq8r(i%Uq0{({z8F@BLscw{vimHH#h(tYoLM7AZBYzGqIiD5i)J(T1C^^ zY$Fw2uh=X%y;*=k{sd@CdZjMz2*L}2L&F~oHy-fp6!B>F^nk6;5ZY&FEnnSo5EZK zK7$?}+&gQtS0f!HN04vXch)p4x){I;jDYj)o$eu)6}{ZgP{WAS9Uts%;CSyR*{zDB zF$X2mhnnH(6^5)cu>Q!TAxLL^G-@Fl)L+m_2(7&~sMz%gy}96{wJ8h^SfocH zltX9%4$s;959^?~t!3fS)rz1vU3B45by@-!I28zd{qjrq%SSN$m+3pM>zs$ogIsRm z(XDtt&+FhgeCOb}PBRGnFIIi$zueA|2XX7dqt6#XahvAg`1+a1E`K@bPupC*=IU*& z=IUK18soG}!SJ;yAn|>Vge7i@T_k3Um*cW1!ST0Dzv8A%XL&eMv0QA@Uo#I% zBl!{ZrFsXoQCzARJy+^$*iJRH-!qFUxlT{%q}^T6x{o!K(OjA^pLjQ-%((36a85L? z5P0mcc5XD-1y0-iK4By-UdQ87p@k(LzyQWaZU0_nhI92@M5h)Lh&(tCL2+SS=y9g) ztO1=R?ZTspf3g2n$ikzAm-)s8tfv~gP(0_2dd^d`Fg)iCE8NGXGj2=&vRziK#8*ZC zikpA|7++^Ajb3Jy#A&WRan)pq#FBZ%`r2`-B8hatSIhQxF4Q8@!spq^5{60k5@V=C*g5ZLxex9UmnHTRFd+N zpN>f*@USF3#l@UiimjH-$Uf`j#kHeNk(a1a{5V_hABG&=CD~4*YT3{;Csj|nCZ!y$ zV3d&CiC;QRnmjlSntVC&WY7U@nOje_C8I4H9NYOcwd`yXv}_LJFYiuI4c`NL$Gdmy zh}Y`+>~*}l^R6FHIQJ>DeLvrG{2IER-j9QmukG4Tto2DXQ(!+4**JQsP{%~L=v3*g z1^$e6YSTn!wQbpv5VVd}=BYeHnBlyWk(9(MPZnmlqYJ7OBd3tE#jG%@y2q`#c5+d9 z4#`X2cEJRW_aoNlrj6qsVjg1gnU5=a7>)ge%;E+IH$`5O)Czs8I)!yfRm~yzrQ;E6 z=hxmkyvUuYNPYcBb}BFsO4TVC`=KLNP!mFECQf+TFW7TA~f3?m`fO+R`A3&_sgU#o9=`r<6S-3 z_a4l*+b_0f{GZIpU_}1|%C}*r$UC$mMNqMc5fKK8L<1kv!kZCVjsmk{`KV+J|B&u6 z1FdUX2c^6ffDtg8k(iVWS`Js*Q(TgG^iy)$0(yFeHMs5#Ghf&CNdRC78>(Hb|G8e<3am`T)CW!MwwMi z(5ZN*n4o2;vxpPUHgX=&Bs`g5J}5iXy{*W`bE{U!df zD^>pPYdO6;S5QzSS)@WwkB8@V>8m#|x!W0ZlH#)ktR$q9i{_lm4l(1QNllTMel3&i z9nmi#%Rg0ts$?dct&*hun~R>iz02l2c|0@}99)?~fu2!Do*50T&FM+%`7k;8@Q|!i zkEZJ>t@T~C zA5>q@V!)dU2$Ndle%NlhA7AwWWeMKUVC7%w!iWx5zRnT%{5zRrz8Lh2An`f$O1 z=l$nVv|MR?#`fjP_lh#*E9I<`5MGLm$;0vc@953X$X*#DAt0JN(SU;Imi(7y)dyFT z9jjyy<$CI6biF4vO7RVIKMn`Va0~}R>6II6`ybjiyr*bdE_E!Nf5^>7(T~%`+4+_J zEv5PCM)jI(e)D0Nx8VLI(p%DxIJ^RDjpgihTE`S-oa8R59bw>BYzJ+&wn_0myhyod z@Dp*|D@f?kcn_|e(j=pQn5X)3>YgDLU%>nyvZ0YTqiO!A;WDhY{Yk~Yrhh?b5AVV1 zddV=8IF1Ntkz;wp8m28J^Pv?49>u2%KdzxYictd{XJcWj%B(LR$#f+j;(F#=pZ(!o z@wf{Q!Drw!v4xZQU~pPN`9sN8lWb-Hk<-(Wvm7YiVY7AyGV3f8N({T!+>GYM%~d{ujc(UtYytmM9oIzdA4xRn+ocw>cTtjcrG5TiV%CWsHwwI!!lW z0hx5+vG42b-Is9)`2Z3x|9|`zB!Y|>WMZSi6$@P!`?}c{6lDk2y!fe zs9dJfo@@WO#qONW33qrtN@`PFS4&p5Ss%k219jfoz7E?(XaCL{Gvn85kr(~te+B9W zcO^^W4|s8#>xHi~>zk03lDaQR_pW+Y;pRv!rq)_IHCj&5WCEYFOe2j?OdPUkyX_{- z(e3THNiA=-^wyK%>ZGjusrt&(ON>KM)!(_>eF%Kvc+3Em5Rml?!;r!ZujuELh2=`Q z2n@s8 zJHb3OB)W1G^_#PL*#ek-3_vVy&_f~SdM4T7UEx2^oJe)N67k>i68AG96WtUM0&wed%3*k@P!X|Kb%F|E3M{lGwVx; zqNci@^5R>m!B235BKjs-&2qL~nSDa(AxdNy!Pro?qY~BogG!5adCMJyTfIlH%kPtN z{FSOF^1_#dUu0Rd6o)XG!{@Ex7+pi7{Wx_2JxP3O) zgliR~3qzG3Cg9uOf59U^x`+-onC4U#tM6=dtsg+!;QT4MCtWyC6GT8>S-BfKY^Y|3 z#R1@d&K#$m$ep&;2yeLfkG2?BGS(t~sNkQKChjXfhx%BNWE?tf#4I71FUzEQIL8zs zHIApnpC-9Nn~{fk7!!!E?`{Nv4?&kL{y|u>8_O$Y4d{XkeWSjg>igJoIhz|)m@nCa z4{Y%AYGZx5`Wu;aw&z7N@4X44aJ3<(y_t9;;9Hp5gX^$z&Etq;Q$eXw{`&YN1b8Bs z_HiL>O-ZQ>@jC2k3_gj&j=^Ny&((nCKY_c^1m!o~*==uhBDlbTTR=SoTATOm4(zrO z1Y^%=P~9%uEJ4GugOwk>fyS~6hQhFYYHd*EnKnWfsEnPBG81Cl5Udk*{`oEF2kBYH zHm^a+$+}tZO=mVNF|CJpPn0n!2Z@(0Z=D}JF`zID121&}z{{wiA;C&cg_y;)SwcWt zZm7+~fotA1CHhXz3ObpV@Pz$ffhvAo*1k040xcK8gqYQ4q{-mxAwftyk!mUXxQyf< z(a2-2ha9Aj3gHI}S@%133;$y*oEA2KC%0V(e899-0}%X8El^NX!Y&a9Rt4n#i;mgs z$A!`p)qqp%=MQ!-DUkLD{5Tw#;CU zyitw1QEj}jycl{2B>Ctg*=ffD|0&&pI!2dYzs>U7HNofwVUYz8JR!c)v{DkQR;$&Q z_rp4ofj|Iwt_d==9Cl!&J&E1*M6XK%C3m5F^^DKeaJzF$ISO#VH%Gsm!+>U5A=0ao+1Ub@1s!CGj@*TP)r_t7MFGX zU8gCiS^>P5$8^Zcn&9#e3v*x&TA~w69vvxXyjX5zlFZchu_Jj;m}4aW%=_!o1&uLl z>1z74r*kS@{mIb>#;n{#k~f(HpLiD>R5ctQY4Y6`txfFECOCIJnVFHN1 z;1dbV&&OvQKg1JhqD}TaiJYGrR4^vfAj}IwuD>5c88v`T#mphga3LS%E{76<|F#G8 zqU_G(W~ip8CR)uhjJcEX>SBAINx88O-J9))){S=QdrxF4%`oEV#4Dog+a@N8N?`S$DU$d_i8zn%!fspIO2~t|hUCHNz)*Kh?`74* z1g$pdtinQ|^xSWy$pNcA$x;G{cu$w#g4WQVlznxbariLQ0=r_2=ZpnVhdcbm`@^}B zJZ$q9wqN?7a|*P<>(-~W?)@j^Jx%i~%GM`WdoAs$?wdKHXD$uRn}vKmpHtJP)R%v^ z2_8+vg%EH2DN6lEQsI<@JvS$%vviKyCJS=4u!|NSpH6v3M`z5alXF(l8RW{JHlLUM zl_2_|&lnA;6fywhcH%Jpb^?4VtqNLgME00|MA_y>huCKV=7{effspZP9Rcn9ixKSm zencwzz1T`aBAyw&dA=zHp(un$bc|mHgnrrz?ag?5od8|6xn%&SZcKfUmb zuaa9(ENKnLHJilg*5{Ou=vgFb7*>sgPrx9G={Fb?UFW3*PA18;9)U-UW@?n>DV-oH z&}zzr_q&%b@CQrHc30k2m&ZF7Gal|c4}W@-UT`(Y7B0wj{Eltnx992d(PQu=Ba_Qt zQG9NvH(ft1#dt(xJBwqk{YNql!~66E4@2C<)GWM1$#OmJbgEh{?6$lj4`;9uE{-M3 z5=#ICu2(mRLL$Gwd=^@7EhT~qHK>*p<|NvCBa2)U6yFilU+y5mq1w$kvfh6P2+!mD z0yuK-_D83p$N4<}YI5+5W1GqtRwpzko$Oe;I7XaB;Ail6 zkd5sAME1o{V~i=uGO#JdvW{Ds8j^|~nBcwp{{1bKB9JTb63>}Za(S3^Bb7?tO}v2m zK9C##(O*4)c-_BA@rL!{d+Z#jeOs$3g*%lxZ8mwg)+|ApBXE9-CcsX;9-MMtUm$zd zy3vR|bDy5SRpEryc>y&9DlVJrGt2l)(&dTbw8tzI;Q8&59l4c zvtWmApV&^pOJu(|vPUZEJ_49A@V>#v^TYdi=6QOn(kWl@TMh<^Ruk|7)SLLEAO8%zpt_NY3&f4mRH&}Z%+jG&#OL%_vZ`U6e)5&60PN{aK z*$&UIhm-1@(#39r1{b^@>+Lx3H&&P{z_5t|bycVNHou_mj#E-(m(ai7Fy~N(G~!*RkB-V>BfIe{sj{ za;*%UN|uZH2~7S>aH+QtEmOd-3?%prwIO&Ih{&{3`6r4%dl!vd*eZxMtJvJ%C4WpV zP`PC>h6lBC)7_gThDWTFq};|KI(hGiPd>mIDEP^thzcEhJSlzRc?wAG#F z%X3UXUWh}-7EV>Zg0BwN!S2mWOb9?yN$nPO5NUIe*y)8VE|Qq9HyJ&b*GexUm?7SH z#O|m`$%5_Sp>lr8h>BE>e6$KPG+fmkGp5|!6K`Z`2`!6r#=wEggqwTVTv|pZ?q%fs zX?;C08IGWhFPHzC1;HwJ6q$Q~=oG5FKz!Tj4%&0_h;_>P;<@o~u}p)+({T}+PF?p+ zk{bgbRKd4TIdEQQv`GJ(QX%}5;=p;}hEyUWSECzv=T#B|DNj?Wh`?Rb(_|vk!k;9|<9Jb}h=~aBSDo zuS;BjfV?+m9aPb$VBV|(4gpy*rIk63c|`u?%6`P9;o0LKJsNWH#D^8{YpKj3@St(W zR}9Xr9Gw^Ed&D^Im3hCR^_R_XvX2K9!ENQ zd0hf#pVtg<7#GW860HnIqtP6$+)~BRDOYM6Ql`f7?BpwUBCZ&AuNDG6#;=O5G55)6 zg@?yb=O((q)Ernk0dx(#8E4%emQui^&TZsAKzoZQn&A^dZPCAa>&GjRnu(&Wr??a()E_Wqt(D% zrHh|Q8yp|CL&xUulYB1OXV=J$ZnELuFmJqmRQxL-LM3va2-Ih(BzZ(VurJj@&u7qrL8?z#F?^c!k-j`^l_b=zFVm~JjQ<#9+(U728Mp-R z^W`p>=)=J~XEyXfeAeu*BJ6kM9cT0*j8@@;t7yKAdPnuJ`Yt*Yb9uIH)u}B&MCOf> z3Uqdq<30mAz42OBT;0R)L*T)P_v1gX_eheF(oIHk>b0!P(fU42wOJ7_H}_-~-HR+! z%U*X>xddv3NBCBH=hj)v;x4=1fjcUR4YTZG7bwBq2cFH~*K}F!WOz7VN5*uEE^p;= z++%lKUrAv5LaV|&clfG{TFnIB8!tg%qxeOhAcUY7u>&4iz~|nVG_~eU zxsw7FHNN1CI*%Sx5Hlt{^%FY!hjdg|wpjUL0)e%BHa#yb^OnVwLRc*5VSL#{poQnr ziOCu(%1{>QH+p=+n?lsF&J*cBnH-Sn3b2{pb>B_{UkjlI83{&SmmlT|D1_Qh;wWEg z>>_z7FYD9EvezhHGrs9(1w-&U|L5pt54e^6vpqKu{#UJ-`&lpil(yn23_@ma&&MbT z^pv~cG%*4j{VKtm>%ih?1VP9_V`~FdVwc}mb{EcxF)*g#Em9_AXXk)1) zsenG{+gwceU!x}V0e+n5Gnpi2JHE2Nk{a$BzU1;Hn(>>zF-t4=AwwxbTb9gmLS(KE z%eqoQo@TbPwsJ?Vixcq`-VDwL^HoUxLZyjKkUaR~VgNIUo2*}+84fw}sLnd9Bk zv3Y8&dt4qSF$G1aLCGDzV=eb~(##E8bDYOohN80-o79nt0)sA4CEf2*2>C{tD3tO` zG~ZLaw)noOJ`q1rQc{B3p5D|iK6zZLW80jlrahnFl8 zONLk-8Vr-juMh^cxA*wFV-xt-dco5~hMr2Lr-b9ur?=LyZ2|VjcLxyid*}Dkdim>7 z`|Jc8g)V`aG+Cc_ld|=Tsk;(x%?Q#O1e$>tFovG95OmvB%>7j#znw07Lr3ND$9v_k zPReFBjFpVK}@~;i>=Zxvv{6` zUzw4kta}|^J6yNH?LAQ?J&_M;I%Tree>eczD!E2uR5TM*x#!W0&m-oq`=-}o`{v0( z@gdoTHQaqP5Ahqt9_oA_`>BESzf-W!$?lgdp`njV7ZV56YpIX!7`l7nZCQ z{9g(`j#KG-?CysymxkGnICow>Pn>DS$7gAun|Eu5WveFu)4N@y`wIh#1X@3`Ols|FQR(*Tt^Zz*pl{{Aoi{(=sI z-DiZ~d(}cWtCf`$XbctE`n<{icxzUIa6u(NPZkhL=0CnauL=G9FOCDOAF4;~wm$#1 zUT-Uo97;iVEoYN8(w^wIE<}Te>9v=-?K(5kHpThqYqD{ zg1ms~2W_hVK9!;CtMw!MRrNGN-GWCf(lU@_m<8|2Nzq021eE2H=+&1a*KX-1_HukB zqt*N4V!gSj(8SPF)Y)p)AJ=|5lPq_RkL25%`K*G*HK9AqaBD8*CV6tqTlV?yKaH3( z|1V1#ezT#M6J^O7N^0)SH1mgyXdlz4+Ntccs$#jj(t2--Cjs4}J1WlN_Jf6Uf-!}w zoh_$D74^Z#%#p|g_tyzdby>am=1-Mb{AjflS$iEe&+8Bq3EkBJP3_WTI>M8Z(LNt@ zZj{C2>5L8!ANdYz+6`w%r;*pc_f1`%sIaVyf3>w0k9Uo821Zjovi~^}Pma)LmsYhX zlCTuynrGDx9#mfU`31DQX3e5+>u?eptqC0(aT1D1;TLaUDxo~pnhRd?!?#!n`7ZmO zNWIo9H;?H&yLt@m*&phbKndJB0Nxr$5*3Aq5~FT)sKS6#14^!uSzMjU?)9XgT1e}Z zmmyol!cn?|YA+GMkbS?|Z6`5)ZjyiicXEDX+L_?@Qb$s+CUiE-)%;)9y=u{(Q9GFi z?}Magt-DW{GOLPcL-h^HHCK+@!B^bO2z45gF2^he-+V;K~#H_mrd_GkJ`b;o;IPlLWw!Uv@*opOsFZD| zdqL=<8*`uB8*h_GxPlqvoKj^DemSVD+mpN*o@e&gGkO@lhCwiwwKx(0RtEL9`ohEA!#v2AwFZcFT86FJ|M;V%M$(HfFa6n-~Zob@Hv)*8FTLHp6>;4)H zJ-ApxQE=^|+=RDrH?3lcQfZ?;PwhWB>=dBoyr*0-eCrea)A<k8hVd0n; zFukzH1wsO7Z=!eRFX5XxUZM|B9Q`QkD9H)$j+}Rp1CMIXAZ6*^U1o&WtYgP@=@_rjB**Nz7)y@4q2U}9{=M=F=g?(D%yH8%`0?c@7nx{yT<_jZ4o$VqU9;DY6 z={n-3P}tGJ5|>ksD}?-_EMZ7r9DJfs?s4i!=qQue*oXCL3Vo%jbzH=~S~<0@-JM4z zx&?KNcX?bWzDIu4_;x({6WjaU5=6xnf0P0It~NOtqg~>7rX21>4fF=wVlNSQ_lO=4 zg(&1xkcI#nkv*(kaCh1>)yyHx9>q6^>IK^vptJe{_H3xL`glEXqhnxTZFfm+I|Yb8 zFzlu+Lo|QLe=8No4Y@8me65-81QOrILW0c3lps7lW~%lbolx&H{u~|VRN;vso;1T9ocmU+6185m37=z~Ol9YY_19OucHA)V z98pf+_(vAKmTOCO55>Af9Cf!%B#bbh(UisKTijN)(M0Jupp$E0`FZ|MZ4Gj~~ zDW>*NTaC;LXYst>we)N_T`Ba3O>bxj8H<6n(Ex-o(}5 z@DQSbqC1amlZjW=#<-|jN-FU*7J3@t%9}Y|9wgQuzzs#hB-ZU;7+5Vne~P##xGsbW zjMefA!-<3Y;sI$yU^jm?4gpl(#WZ3o(><>ZrH8y8l8G@dat&JupP-;d6HxM~;8V;% zaW6O}fsq_0uO9&*jE?{zO=0ipmxtklm@LGcAxeqg`BAbmtlyx)d%nV#+AF_0XN@Eu zGxw8>lZ*^fCLx9~&1LSeBd2Lm^K7sTcPhrH!P@0u$K_NT%5Uy-K|9uD2=RY&_v~5l3s#E(`R!o{UgC+N*~xeg|E5Go6Hbu`yw!c=59Rn?*Ag}8^bGkws&LfIN6!l z#>AZ1wryi#JK531nAn`y)?{ManAo;&e&^hC|M$84P+eW!)o-m@wYv8%y$kGD!Fp_r z2zQ`=F0+fD3x3i@HDkgBGq9%H%;clTpXMVbCuYMxrWlrg21~CkM4$E*W>PqEnEbQP zrJ0buGd?mQ^XbG*!DV%9VdnOc5b_EK(Hssg%5Fi_(I5W}!1&hCUQsc3X8ygA?V{$g zfzn{ly8{ol%cto3HAMeybD*p?+X4dLI*XV8U-Nrp-dpj>-uLN6C#M37n6CoNi`j_@ zcCyX#nY&qs@{^ZxsInRHRx+ta+oT4bwbi-?`E<}fE|aBRuW>(2r@xxUf%OKMhH7S+ zgl_@#4=M>;+~=^oQZ{DV1!T}y9=t|~n+)FLIv1V0*ylh7ER+<5ptW27vzuOnt5)D! z&+)6kk<}FMCL-TK*O0`>&oA!;0w|#DhkPP#otp;V^MkE&uZ`||UGFNs#cZ3&#)B2- zv)0dK*VMtx=1l?lAJ$mD^~=oN*oiM**RHItYW`RCs*CKW%SA7t=Q!)oZ?_#Ogfz)bbkA~1qC_8YmT({Xw6f-KAKYO%Oy2-_o8uBvg$O=5s%v!S zlKzMeS@apGaaEEgw&tOeaAvtn1SjN4lc_P2xiOQOF%#rbs9pT**|Id&P|evYj3-TF z`M2t1y$#os7we|Gy9UNSU6Vy|#!)tx%GJ8OPT0}p3{IDc3!BZqXO>GHwZ0fn{G~Nf zvQVi|tzvyL-y~6%Wxc=`68KBYgLF}j%yZ5ZcR*{Die-taaY&b3Qjl|%WG8u*Damcb zXF(gyJr-2A6+w=jOy7BuIxdF~PD9kGk{l5i?rNWE-N*|0b}36maBIx?PI%B=Pc%Id zrb_P516;_GRs*FO3yPpxG7x#?gV#iVcE_+m+}(jKA{EFNRi--DA@6VW9OC@=F_cY* z{m?0_JYlqimzNSdJ|$`oE!{q(PPv|8C<~nt7+W6lC5cJ83FUd5yy)^aa@zOLz)!dh zi3AnKL?zC#eKT!GVLsy{lXP1n78jP`O~BEYVj%|4Dw0Od1v_))^FTsLF)W%OC#sXh zadHQ`a-k=(Z2Q9_OcS0ydcFL$iT!i)>lL`pXHC2q?LUW#?A?KmAqA>!kKy{ociBel zHX^)0y?9L5dMB!=qW~wgM671Rm}cq_s&q)k**SH}668mGEpr{{lBIUYmgU~lVrS9i zom3=xPUPpsE=fwf`2m}c{&J|rg(+)ga2sKh{d4O6H(?t;a%9!hKSyoyCXhq$ z2Su@4DxL5Xlb&ZG>6KA80nVq=K>P7GM zvL?S77M4t5$}*O*lVq4aG0`2exDD+Phux{o@H|4_&*Bh_bkc!6lQC=pJ#MlyJ%#d# zeV5e!bNAcqbCpwLyjv4lRHMEcj{!!)$QL7u_}2-O`URmAT%-7P+i@=(K0e!+#=Lof zHTBR@Ljt_^?D5j)5#=Th(l;TRn`>(WrI~c2l7^NpK}%$`_TToP3L(yUDkXZx(2?cAt~+H5OZT8EI^bkzITh z{dm``HcQfHkxM*Y{m7*RmFEW5L=D+nm6^2jLDiwF`sPIZ)UK93@|)P@soscZw1Pi& zzA#02cJ?zZlwT3%$VFfrx7sy_bxdlT^Z1eoL}5>tY<2Z7X5qg4tyuHFW65rb)$iTy zh)MSFk1?8NIua9S>J;{0aa|qVMct6&(krcOBspO;>G1cf(5Py*JYImysUtDS|^z+(aHYqWqG9l0)FD zkW+eMvJs>6<+x6xKn^o!1iZvJx<g_er2BpJGUnZx6A3vpGXHjA$+C}_++T>e@uq#ukGp3Lmfa6aNF;{YI5b~WL zky=N!D4CFzxp2TAg_xWZl8iEG#5@0LJ4dqeW=Sl^rL&Jra4&Qd_;jL1eWtJSn|H%Y zo#(p4L`#nG#>$6r-%qmf@@t+)^39OOh4_L*G$cpuW0!?0#q|zokK$Q&hwBoBaPwAH|ksNRW4N^nS zx1F+h7@^E!D_fS>jW=N?zb@rDSE`2j2F97PRodfAsci1%^1K3Ss{g*NfI_N5SpBZ| z-o^JM?nIicPrXzQlh%IUYbJj={Gf?>LM4=YK|%o zarPXbyNU0*s3KTnu@YM6W!)(Mq5hlx7pNxG26Qlq^*qgiphr(l7o8*>Ah}iClpZUm9EfBO0C zij;zG48BzpAw0^$nh|2_JhqMhhCK|Uig<&K#V$*Tpmiah+Ya+Qi8Aj{o-tWbDJ>Z{ zIb4}xQ5Jo8* z)7Gu9hM7EiGTZ&}1@dmAGq4}$5Kp77GwEWQoxW-?)yb%|D*nmr0**b|SRiL|0&$IV zG~^A62;_C;B>Qsn0htus=l_4>>0$d1iH#013kwG^>u30f?}nX;^ItI&G3zIl&p&~U zo9pum3;Vy09Gt{#tpCpSPtN~S_zwmP=Rb)5JpG^W4?YLeC&v!QCm#+AH!;U25*yd& zefEFOIX?q4G0SHOte-JE+h<8Eti)WLY{VS@-2X&lXZ?pn@4{gmooIG^Qnva$b5@_#T`x&P4`8z=k!!W8t69RDIi z`Y)y+Hcl39_Wu`C5HkxW7c0~MOciw63G1WV-zdQEe6g-)_kE@KOm9ZIovyOY)T*-0 zx~c4Is}w_>9P<~37DE#i+a5vUxhbSTK?o?VpLT)p^MR<+9uXqw=n(L`6sSp47&VR0 zS*`Wu#-js)9schZH*7P@7gXDqTd_$z^hNRU* zg1`Rr(||aH9rd9?tF2W)#Ed@31H6yGc~zv<-Cr{u{K^ycLa)>O&;CmG6CSZ2YF@nt zqd|Rx|9m-*-;b$Qju3Jyx)+Vg)`Pc^Ftj$XV^o`$#k)H!tt#%IsTlE)Te4BcrN5;f z9Vd_>_MtvonB^1eb=N7Oc8J36ywOve_Pp+A*F{7IZc_o5Y6NhY))P8y#f+q_&t4%p zdJ&3`jqi;ooKb1h_8|gWt6`FxA?){zgx-$!v2~}crqV*>`0po8De&*V_B%pNzDMoL z%qVN;R$w#xaAZ=5I)2W1-xGT8jIJlJb!AKazGaePHV8ZyqHVybb;t&Q6d9Qkreg&W z$$r`xW(z_jk+!Iz2GZIAmlvmY5T%8pl>2J%2U*tIsk!dyuXW+(Bc;~I&yZmo@CkM- z@kHI3`45M%hfQ+6P(S(=IYmY+{LKlx^b1BjG(cSAa6!@t-Iq_Hip#g599$Mqh|Zy{ zK`F3-qEz))_N|M!!C6e3?@xInbVzAvOv(Pkknyf-gkPn@>YM$Se$J_Qai?01TM5Pe z3f|`tzAW_||K6EA!)e^uv=ZGLBbVhg{n$|n^Q~+v(@7Gd7eGR`OQns{ zQ_>?<>A7q*yS_VFTlkrH?a{U9s*-F{kg+iIcvxMu$^>R!C~GT>Gc*f)ju>Svc3O)D z6+yLFF)O!$$K}|F9Cr!M>5CkdLGT>KltN*|PhyP2uBW~mg;N{Sv;1A=ci3+S$BJiXGg>Rt=mQVkR;Q^vWM#S@9SzOiR{`W<(WDw04x z9BNFm7e*0BBIff69vSFmCk5WyKb1KR_jHBd22IAl6y8e21;5eEW!jveQD)8|e#DJhGb_oePTZV`~RA&u}Mr;>IuvBD6T?oni^*P0l0uyo_ZVq}5J_%+HVJ?0sr+)`#uAeuE{#1W%p%_Ium=DHsKmfH$&2PuAo?8u_+QcEp@x)VQ{c@J9X3Ddi?pYXR?O<(XOFb z0BJ27h8ye?ZDz?~Ei=~w%nDw(Vn>cy#BLJL9k>>a#>*YBQ{0(XBn!g5TC$ib8Vz6x z$TqBOD5&^c$r)h)GU6xHnOLaXqyDH)QFx7h-1L0NTHi&nZFh+zaRZ#c9~7#Oa_e zJ7-2Y_^;A<7@Tte9p>O4yDqAVc4te7g7Z+x}i4lqvNZgL{MNTWoRN2`$OnF8YGBB;}`c+_xcudx*8X08U~(3qHuKaDevBZ3E&Cqlqs-_w9*_CwcDA!nRo&1%Wuz^_yrxuBarxK~jdOUHyue>zHD{6{!tak2A)H!ZKs~i%J@_ci)q;sz z&=9=_yr|z+bVq#0H=)8!cKAB5d5C!C9mq(E@P=l7p~7e+cv3qnSw$^j=XCT%s%`)? zm1A@(Jn5b`y6DR0PvUC?l{0v4h`IP&Ou;O8?W{N??(cl4TN<3GPZY7Br10@z$3Bc& zU#5HyQV!ICFAAwcjyO|JTa`1K@jYz!$*+Df;oi7nOT=Q#77w&`uCcvZ;Jr^S=wGM&%d60ZUE`M@QiNtYd8Y?PR#roQpV0D)ziC#sl8;5m44$}Vr#*tBaxX4Y`# z)vWirJZV|_M&Ac?c{C(X3U^(7z{_hl);q~2bI-F^%2xw92dhm&cUSg39f?K323+KP z84TabWh`W&r=rfOhCW=R^M zOjP|NgC~!V9&B#HZoVw5wN(AFEg{J1kZ&?bu(?vfkL)ovhezNHY`(MYq%zu<#(*D(vxd zcICSo01c+Qa!;5s(}=#c!QhOk-l@A?+z9F~njnYd`_PIgOOZx!NrueL!Ndc*I-Y8& zg?XNIV-)`GjD|69&nhQaVSgnuw@jx^8xX{mn9cXWg(oK8u{LB*UBw*)kY?Mhmp|OP zCH@B85=%c0LN4jWz+k&S@sGioL87}G>;=r}NzKqndO^!!CAgqb!z`E>BG*cJd#xLm z2vDLLgA5A5 z0Go1{!YR^Ca&=01uya9mJ}ZP*17tZ0u^f{52IK;c2lE>G!f78l(jme)?~|0EtC9m5 zl777;UT)A5oK=1d8Jn7@7XxHh{l=$0VApgq6NTM=X2>FoGRNcSwo)H&I2-r&^a{GE zk3{@(;`f})20quM9py{wQ#}cWOe!tSu@{{0dGFLk~d@ z6#~tbfszV~4ekQj29_0otVs%`$$~yfl5X5asf$()HG z0VNOjDM}cRuz`2UEtFt&q@LAab&MXJ;04s43z`n8Eq9=w%#RKslkU7r8$fsdD>Kz5@=U=LLEn`^?=O}sv_TB*fWVhfz2h_YWTQ~p( z6_3b;Cvp(cbRQKpe(@z2XpkCFg-djc7z7Cnr9LfTk~G@PrNA-_=q(8T3D<){!z;XH z1VB-G{GCey`}YM%Sa`rExaAEzFL59OT`0GtWc#6jI)UfK4p<-_nl+*FuB=|W+glwP zpRnGqK>K0`4899-0H~igM9Gwb(V3w( ze~%|{L6Iw^mm4@y?C=FN4^&sul*)_k1pr2A=nHC+gc(7E02ylf;+pVYVE_WP3racw zyp4LSgeg{-3WN+e1FleiE}YL}O6kQ1j04lD*_17F6%|Ot^J0X*f^Y%zz%pu8AWCeZjcsmggQx?I!}?;k{*USUr{nIK$suI3qS+30-dNsJPogMnc-?t#`GO$Utt%?e@zPy)mOFaR&W zH!qN?7xY)TIYmVkMI}XLMa4LkIHfq{I7QUiZz|N`mici(0T2>_MLmi=KvWcuDB;Xr zYS0caM(Hu37Yq0|~1b6DW7fxWB2&$I!}Fn9A{-6fZlpiQJ>8!$hf(rRdr;NI`l zuj%S}@~D|6eCGgD?zc!{y{h(*n-Q2nqY zXx|9|V5t$O5zhXx zN}|qFFpvbzYn=KU94L&2S9A*&*dl%t1L1OA zNDr^4Gq{bqhp%BsUwhYHdzV3bS3cbx_NymP^t!mrhV&NCZHNx_8gHo$cuPdK9~lUb zT2~?C)=vBSoA&jmsp8HxLg z#g)~AbHEvIPx{#r@}-sQnfh9@mlq{`lp84s4>AUb0Rc2X#i5co2@>H?p9WI5Y+=Hw zL7_qEL6JcTK|w)2s39y-X23!qIj|3?OdSrhCpy=ADBRNx9u4LTcB_&55V!&9*ady- zoy!^M2YaiN%NgJYY5c@KRUMEG^^7)!As7}&2-}7s>Igf8dEF>W5%9VGhWk z))h1&1JMGKlThkuL}^qNsY{rCxM@j{BnSQMF`*x2308XXRj5OxKgV`~3O7Tu8wCMZ ze$A~~j%w31D5lC7A%n~TazI=fHpS8s)B;6`yr05IAZq{vKz_yJe|x!BXhM;ijAg{|JT&Zo>v5gCT*R!M0_6l5!XEZpa(qf$CxA{{puD z`4%-*6i!JPL4)>yKb174^HPLSKor0)Dw?83Bp_&D8;y%ns)7+ANFG1{6b1$*%`XG% zsG+D$m4|ZUkyZZF02fmTK=;8pjG8`a~Ba_ZkoS7hJj;VG5{HnF}Gj(sA%iDQr+!9Ydx! z(>z=db0879@UR`#9n=nv!_-}?5UUP9htI@He8u_!=AI5(2Q!A>EfgFa4-&$@xHAA4 z4s{==g5+O1T|){+XfQsqnieQ_^ryXhH=QR*qk-9ye%|W5@|2{jfQ&Lg61KhmCEFP4ylpz!Y*d1mKfm+kf{Nrx{lI9{ClUd~;(QEr~JNPD5qUuJqh z>z(AU5ku1|k^HFCuM(L z$&;y>gZAOkhR)R4jF08s9w%nR2dB|LB}yu_6pH1Yfe?e$#5hXxvs0##jg(37+YX5 zr7+DnMWq?!HO+7f^n&e-<)@6rGDKT2LYNTzXhQ8)t$`U{E{R9QLB)M>I_-RX7~Ft7 z$xTgig6u=g{7z~n%gW(oto<7L=Rhodi}M!J%>ko?c9qpauk^ThEo+p|uOr^Ov?SdSPAB zRT7-Jc++x+<}L`&$ZeSGq4u!+8xiNi?o`*3uMCgvX_FM(5BV2)7X@M9-9OGn9tvQm zf>A%f9X^b1MI;Mo*xum^PsJVtj~|GWlSr*%dpE&W!eFNT*q~Snu1syQ`J$2YMFL_2 z*-#3oredcOi3dxB>L#zP$SH6HT&13$@V^E5MP*Ac=H}#L39;%6GZtt}l^al! z(2(EbJ~Q4rPc;@CrX0H7(%s_S>fCzYe(}P4Lu)t>PQ3OP>vA{fryENXrVhRW1fyDH~JCU(c0im+R%lMLl0kDfyN|7m zSDwMIo|7?)-+n8t{4tQPvq_MA{WpI(DMk4L`{#_2Uv9#q|UN1G^GqdG{q z9X^Qb;3R%0)C@xjn1%Wnk=d?3oZK1om*0)e?au2in0%Z>nU*kA;1|jfesz|7LN%r; z$xgjSd3>RIhVX?)=Zz7k>K9iS!Vz;B}h)@w=w;17WzTJ z`;*KxJon5M{+$$eoz-=pPb7?uBkht5B*!+JElj&rKZot0{AqfU1@5GyU<{sj4QG7G z!6aLBj!hVPsFWG21NQeIh3f_jxEN;#!ihmp3$}6{NjAb2`Vhj6W`y<>iwncE@+H>3 zS*ZYK#Yk7RO(V2`;I{_%(;SoJD{qM$LzHdgR~84+zyU$!gDvV6I?bR7wA)zU7(Ejr z_~QZozg_q*UscPZWK|$0uFMPcwB+hUDA~N!1)Y4TQt!}T zXB1ssrJD|=!dZp_4TNckyLbw;W8yQ$G0%Or=55Q{x`bWWX9H=){Xh0^F0Uesxo!c- zo!r;Y;nugFu8x+whmu^d%qzX6Mei^YXCZW(KMj?{P=>(ED55Da2N0A%K$ZZ91*uTd-c%H)4=)hTau z`0ShINEgYPN2zBtSJ|?HS3 zSt~a%9$V7r=w#zZoSH(Lv}FULb@wc6Sg8KO{{v;Kag;ah8#tZ%Ff(V_lr(o9$?UkD z%1I$T-Mmc>kuRjn6>dli#FR81AeYp|BB9xBKNQkRIZHlrXnc^~AY?5jvG~adx=Vmc zVi!mLb``SxzEpEQ-GaQ9x2`KT@>{OI6hElNP^)D!j<@`a89z1n63xYVesV|stDlcpF&Z`W+; z1fB=m*Pq?IB1A+?VYK4iLsbYR{nf0d8u2Bg2QhESiSTPo#npvtcn!HdiDL+ofl(eb zPNW9;Dg1TN1$GCaS3x3AMqTAbbrKkulVo}XNcaT5h>3ct3vvzjsk-)`dT73v1tGuk z$_as&#wey>@0i}6DBB?#p(@eH4*)2hBSCoO?wx+lGK+fO&uKNMwd{VvY02lK(gol7 zHje9js~5guw5`(9B1(`krCCEuTrFhw$b4?P@bkKO!+vuJ95`mRq38ecl~ryZxrL6y z@B3XF?8LZxF^_T-`1Ks$bX|$iDBDoXf-(aisA25P&}cUGBpw?F!72RZ~ zqbIWS>fgf+@iN3p_wJ8%F?YLE-`BSM8zQJ*BC$*5c@kQOVGRPJm1!ph(zOeDu7a^M zQBIbMD?2rzVBmyFJLWkGmeST85#O6S<|jE<6`CgUduecqh&w?fD)@k3;dV?!ubgv| zYQfxAsI6JY7|40f=tUm45WP6&&6*@=aDpV;t&dK%3HWsVS6?3wc0Dk$eQC@R`gWTG zk5UF=C6SnL9uX5Bk(3K^q7rNdx=d3byI&6#gA7Q|n4C>i8JkHn)RL`y!eF;F%h}<>1~)cPC_;QJFk7U!qOg#~^eQPgl7vw(-Vji;36!vI5Py_? z_|C_iOq=pk9E_7wS8Za|4hQ~_k)n04{`!ad$0ikX@v7~S z)l7?ASpoob`FlNSFD0ENP~*H%0Lw6MMJxZ%?f8O;UE-3ym@;rR>LrqoPwd@f(3EE|-n9zNSq~Ik)79^$nz%!gc zNvF8CSY3+YaT=Ikxr#{j1Q#Kfyy_S>0$V>FdeCci=^2mK=Nor<4t^$O`_2Yccy3Ix z{Ssxq0#BBrn;t*cb5(yo%Xu>ty6C}bc01Klv-|1Dz95^}mw1%cc@)^yxM`q~kRDlI z_qks^ShcLVBqnC1ZkGO6!uf^2)9QM`%TMe~ewmPCx@Jh;7*sC`ZmQ7ICJzkl9jRQl zzyv7L9umRkC|(bfOG)q^0w&WYPmeASY1CUA)WzkKTVKd>b zn>kSmR^RK)9w|NR`0jOQvLn=Gb#bZ&Vtjj2x2%sW-wVr;v@p*(u9);aC2iO!DdYH4 zStyGYYlsWcf(?{xg~LEngJ};ngR8@-S_7JLiga{ROY&9tUg$zHiOv?Ot!TWE@XnA- zv;Dl?0(3G|gy#A&wE2<;-<_pZ_c`W6Ab=PY(qx~%8-UhAccmkjqJgKgo2M(bMv z*I&YD173U@42@W(V+gK0T)bmeK-OGKNy&rn z1-jV&bzLGKv{R;l=mBf=bXYKPD$2S0_=Pn5#umpMN7k{KeEwuCAY$0!p?goEpTD{f?*Z7)D7`rA;v zkQo2o?JU?mCv`(f^9s-4AhQ-z+!YEPXie7|a}EvjNfB!jAVzu&=knaseMhP?kb{@F z2S+bk<2^DqSS{-iatJdiwe_TIvvdNlV=DV9EpLL-u4~jD8ofCtX-6X2ER9e{gsdJ) zz+$^wBV#{FeSOaQB9|Cid$-h{3#bU74&Phi**U_J03@AnkL?uDPtadcV>+li`5+>& zS$l^@owZ;K)sSv*09$!ySIK> zj~8sCc`q#L>v71O!@q3_wo2%|wej)9Av|;RC0;N2O;1-3#aERpRW}4S8``TAKT6NA zq>tO)WaW|<5+efdu0~DXy!W#6F6iwo<8|h4ok|!XO^G_x^OL32?36E1>aUpg<>tWK zgX+H4<)+;wjZiT>qYD~hhg)-eRpf9F##qLHzrY_1N>6|k-Dvwo;!kD>l~KKmb+1t( zdwZykvrvJx8T^l)>5h8$BZ{x`60;LUP-z(#5f?hV4;zd`Z8u9j3EU6wJAX%DImW9t zpVvVa{{GHlwySTZ(Gc2wy_!wAh%QRK5_fPY!4Ya?bT_i9QFHoT@io0Dr&s{9^R26X z0c1om*UGxW)uDE7Q62Q`mu?sRy3uotHyQiuUQlJ%t_07d+*n9mrb{MkJndM&aTwtEJ+Win(FJxG|`Lg=B|{_>xgd*g7b%ND;Fec zidiJwV{z35Us#$^%vDRD!oq{gOlQ?%j{YNpGu8Qm=CK z9A@DCVw+s%7dVV!ps5$Hn{Bj7N_ZrrNd6Unir|Lj3e?h7E`l2PsU4cdEf?R=;+C1w zZ2H8luFd4Ha&zkZZKN^scKi8n>g0G;xSJJJ?_={g_k77#b<@&LtBAGYmQIApe=oz%gDy)LWt<9au`MLb>c@kk-1w?Ry{>r&`rt?w$a9N- zh|a?)ar^ai^?oOU`rvDnj}o$vEJ@@%f68p>BsQ(KZ`%zUEnjd?E|%ifB&Q|)YIE{O z?&+t)P2K!x`X6?@i*sZKYZ?Vi_;3sIJ(9I>{x??K4h6 z_hW3oSl6wF=pW3~cA#GJUc1cFv4aXAb^?>Q3|`*}L#QGDo-WZh77H74Suu z#9;keYj3oylVzq7|MK#^&lM&{i1e( zZqIP^uff^n&0mO4fr3Pr=$}mJ=ku?$Ue3yidNoeWq$soK$xujnxoGckQ9kv;jLE27 zzv9`B-DFr-)|49?<@n6dOaNlSR^p1V`ecz$XUx`lf_o)A!45XYB3T5R3ORi>jtoW< z)$zD=k;2e!pudT+Ab_`#o4#Y2><@(P?>4)k*V~GDA`CtUawHXg_0BT4%C4_xd*`y9 zaTw*Mk62f>Y0_ixcWL&YEYV&NxngmI7ddyi zZ+Xe=s=Yy3#M7u|Di5evGCIY);&RpuC9R{M+tN!s`?q`GMe;<>jc)wNde1+;3PKWg@uy4alK`M)T*e zT3T94JfLs-e9(OOxdQ5D01;525>{cfH){{a9Uhi}}3Aj~cR|8YY5b2)zpvDAx zTsz4!w{|>m60MAHFFtA}icM3Ef6@of+k5Tkvu~+9l7p|_a}6Q7XZ&5wiUNOMl%?_X z-2=n3eZccNQ0_wP8a67mcwK9SuC91~bzo z2b;}i4dCI-55Byg${MeZ(bY^H2ce4DGFjyaswo?_0;&mlgKB0n#;x+8!9o3tn3ExHR(}}LWc;_Hyclv~B74;2GSxQ(wJ1V8-d=z5a~%(brDmS_O4xhaT6T1u z)b1;Zc9U@p{!Wr9eGSuic;#Ih76mCCN6!me4KH5qriCZ{ZW&T z+5o&jq*H;biu*w1k3LQ}xI<*L_j&~0!*U3yU@{?;g~DOT@e-{Yd$EwZ51&fCun%QN zhD54n?v!29GNa!sr~i~$asveEoUXwbGuRKa5p)3~APrIJUNFQDUIB5=YZ@;-K4knQ zfc8|Q9BGYd;?vuJ5wS_yrcpl6WnM@&LP^slRCQKz>D-mK13Q}>F|nMtu=(g+U^7YZ zfX*E4ecG#`uJL8Ml*&$uq$M-_OUPuRoc1F7J-@}yh$3+QqIr3U@Cg)5t@lJ;k2Ti< zVG{?|TKkv_|E0RPCd4Nz*VOEoiD4CspYHdr<7C>YclmJFgA32>(>XkBY{evq^xI9$ zg1(%Z_o^d+8e^GzXkQl3pD<`K*og=}vO*2gdK#M=fuh?deVQ z)KDcm#_gMeK&}o$i<1tSwz}PGPV#RG+UXKh^6mo%sU4)P`V=u|o=4j<{(ipo3&wKe z@{*ug=iRS5o-afEH}Y+hJ_o2QruW04SLvloJKVnq zb}8_DG_ECTBI{&IjioN#x62a;Pjdz@aLxvF5(guicKD{;2xbxpmU+U+%lNyJQ|Wbz zmoL^K390?9T9b8G_#K7r`D!yQLv(pLLZcKfkb+=wh@MGE8GUYXp4|PT-;lZyG-M9C zu~0PXY1e!QjMlmpddk7p&-mWt8T=OYz5T+9m=5D2xHPLJRr+v){}?(Qk-s)kRnT9p zZ6F+kg(!n`vyYiPf~|~ysgl+o0GUy!GE(v7x`P*hd50!L6&Hl$V*CQ>RPK-Kz&jqe$7lYh7~{Rj1e3mhdRv>>Yo!S!U`O&Ml!d77#|ylAO}f zSo&k9bJ1J&;dT&?1q{j_TeFA=(OzQ+UaTC*1Y|cWQBYr8V9o zZ99`1pVc)r%F*ff)~);`Eh8<^BxWS`P z9~oQn0TNAO!vp^Pf@PCfEHXh|67>Z_?Wde;I!@lXeIMZhHo_q1m=D#;kRl0yj>D_P z&aYq`Em{r7=R>q&uKK>pu@T9b=jEPxW#HPuT--&Tb_)|2byQKVLb?^Pd8!_}mQliv z-XYB9@MHqgfU4K`v%U>f1?C}nZLkUCNBuE4n++FnyHul^rPL!Qvy48WO&eVAbp2PA z@5#Zx5eJM_ibn~UB6wKqe9|7DR=!U*%?}*gI+{CK^l95z`%JH$n4JG?`hw#3%@YI1 z{8+wbtGy>Qu~ST7Sdu)!rpPJz`K&XVusZ>Z<9iLz0udMgOzND*WqDZ z%*aAd=gDjhF4zT&D@d!~fF#SCoV;yQ5iTR^10#$sh&vV`5K@xP^d^T_z98hfA31Wjs0t&gEfX4?T@ zo-a>fCGS)~itu4fp1YHP1FJ2DKV$hYmL9NH2?8sP#O|8RB$1V43A> zZ(E$dtfg2>?*667B(hLlZ@IT5(~w@-(bX|Ky>!*pEx~!Uxhj!>g*inm&79Q|c1Ap! zjH=G=&dLm2I%oU*kjiA$D0OzdJ>4j=xXdbhmc^Chccw?`mRB}xXvtLQOe%%JWlD3V zrWn!;DvMw53j19C+`6T}5i{sQFX(~;+4mt19EAOPC8rw3h5OAbB)q~Vx4ej_Hc7hf zDH~e7YSkE-eEm6A`B;jaNJO5(GAS~cAf748KK|UelxESV0Lc@4ez^W+Ft*ddVg-|t%=_po*zkofvkeddW_U2)>DKHbJtdikbD*R6SE(=3@a*Gq0S+KT4}gUy8&sV(fw z2wA0g@5bBDEs3nW?PBKazLtJbFy#D6Rm=n8Yf1y(8d1@jM1 zZq3We&ef(!1FBRB%Sv?`_B-y3RPv;r^7sd=T&0zAB3*`??l}p2pnYX%-jv;@_Nlu~ zcShAlSz%vhAKfyVaQnvhnohOV^snzFwF{K)@<>^&S0Q+iyOLi!iZc`BsUHIkb=Cz!$|J7-WydR zna?N7?(@mC_CD=oFN*9TO}m9OX`{$5n%F90C-`BQ*hgX6XH3{q5y&ZWD1^gO$&f%{ z&G%%NTNwjR`H0_H2^HAoq6ZYxy#j?LCo58%Dph~n7xt)yoLDW#O%_Xhzf2|JglcyH zAHnx|GPHEV=vOuy_9!%vlbYd*_dw63(DUc`-IWm8D>`pbE=waX4DlEdSo5e@X74i! zHGRUQo`(31qBr@6fv4LPnxv+QX~!auAJNKF%L;>qcDdjM_9=nf8VMAX=wuqaJAUi9 zgTIQI?MVkwr6^_b3&1f~rm%ukUQ^3qmD>uICIjU^hE&W)2OX*KhkWE6NfHN`oZ|ha z6%yYtE}@I=T;BAIB$l_6R=33J6k_M(CxNINOO}hR;BBUi_WCn8S*jY}7+<5)k~{Xy zWh$de#7R?C@eTN(TGL0KKMwc7H}7O4G(D^wzpN>Nu@>8(FEHfMdKry#Q;Gu7gc!h$ovTox50ounY&$qB;AJ3QfG+!&Sn z8qBq-regk{Niq4BdQ{Myyk|n5pEMLF{5m3vgI}|XNjG2ox|1h6YHpLxtVpfb^Uf^F zTXyZj>^XHc9;qqQX3sE5WY)0P8@9?^)zz`|<$LC*$B(Hqt0Jawq`;QHG(V?0I~9Mh z>B-$OwXY;&DSro3qLd2U$=m&Ltt)I-%-y|zWAWK-ISN-ndi>Ybb-67oVI;@Ei*mBB zqx|IE;6V%WKgn$1pJ%os`}i~O9`Y@GZ3Fi>j-eb-MX3}w=VbA{&mv#tkBXZUPfG>H zA8bC7n|QGK8&x#r3FoB$C8X|`aLOK|lNE@JB@Od~tL{Fxuxj&t%hH>x^7Uc?o2pX# z@?yEmR;NXpBYBNQKDihc_XBBeqtf6^Q$@EAZP@+X&T@s(rdJx>rjih--7VM0&TH`6 zeRheNzfT985^;jfXd_y`e^pQG*~D~&3tN$8nCaQ?_xGee$@HKU@I*JD9u&aVsB~>z z-akt!KFM7X>pTpdZ9;XpHY!=rj4Z6HNkJZlXx_&*@GcRVtVWNHR7A)JUH1^@JoooU z`CI8=+o?I9yq4qpFPcd3`4a9ZH$8iFQ<$hX_P_FmK={a$0F1C zihMas3zAW>MVeP1)LXm~A)BgJxpHfA61;54_W&3i&((Gwe z1~#uvnig=TxeZFa)5uF}*N-+A3k0TU*6j83as(2YMolFo903V!LYM5HHz(RnBxLtR z^&6f9d(ekuARj$i$s9b`uZO=mlEcg)a8YxZ4F~7+Nd@QBrwtRSEva+=Gb8wkvprT# zq*jUwaP5KmW_6RGiMSOLQX)c2NQy2YMswd)jSFnL9h+|;p%b6R6OKr&k@WODr$!im z{RA9J)VA|s4}CzuOq7C$MJHR zhObJhbZO(ij%TM@sr&@53(iLup>0EG(^+%bVP?@#tZ=RZT=kx)G%_nP7ydS-`W6f` z8={g;P5)?{|8c{%*cu|I6{rW-?qAm&f%TnzzhYL*Lf$iy-CQ+{E&Ebx`Tc~72zVk% z0rH!`yy*A`>r~H!y+5KRLv5Vx;EW`APF73$Nn+xX3n$;yN%4$ji;tTOd8=<*wc`4o z;Io9UsoLj)rKt|1MkJJ^a8k7+SZr%LFXmdIO(iT}uJsms-9>(#!6OzhsVbE#T%B`* zJ)3O(qG#^{;j#x!v$JNO-yRMvxNP1Wi6Pxu7>b|2xLza{iF6)IR#>f&iF|W6ufzvJ zh1PU~Brm%rORx7Ay94DOrGZ$&anVvs=$vdbL9|6eG7mR`clEMh4f4U7`-a3kA~hEu zX2?$igqU?viPl*wE%uu^MP_mq1sA41DmFHZe+{U9D5_|NK}H|Epi?MaD^iC@{57kX z{9NN?PX-3q_+-qE4^3WRh3v}`V}{L%;`fjn5i1K*r%mNttqXFbOe|IZ-D&4^QROj8Tj%Q1Vo0gmA~ zOK6xrx=%3bfHI+XeGSIXkwT?l)T}~ml;LKv5ekUEh*}b}Yv3sOd?N|>Z}Is{76(R_ zEGBzFZzjGF5EcJ_dTHKS61ttI95N917w}RNu?I6eqkk}$E}mVvqCTty!^SdPio9gO zhRRL*HoF=_puT&Tf>awkmZ{PIP zuG-3tdzU!Q-r||n9s(<58vBy@4$LBD==_9C^eSW~lYBVSD}gCue?eWEZ+PNsTK0p{ zaLm!9iX|Un%Ox}Tk;v$g$PxbON6DF;bK>_TCflBgotkljL+?c~-{Ddu;02gm2D3j+ z_FXY=O1>+zq{;nnF@}huI!D6u~C&L3%u&1gfmcESo=o!_yrkvbDdja_9HCfa7=-h6h zFh#^_yk!}u6h-rbD;H*SBC%K|7K61uy+co>mGY!uE7G97=Y9sc5OvKI?VJ&#SM;zweYtM4KuqA=I`FQZEx%j5ZKVwwf)Pt5s9gH$1Z3(tEoFy z(^Mgq1h}w*taM761w_8#25)UU6yIm6<0U!5%dmoqG?(7^i6q=3evU1skFfJ=Tq@cV z1c6T>Fx|hb0?t!v1ATaOe2UhIhSeE~#Z=z1{4faW*sKg*vV~bjIfqlsIqBo8uVq)w zPoKO#v)dB7;!EdsMR}7%Ar8Gu0-Ct|S6Bkci;ENg_C5 z;7%)oMql&B)HQ9v#2b=4v`m`n$tO|!#H}ur{iREmsE36{pP|_Tm)s!7GB^DtQHj^wtUWw2< zIE2Ui-0eN}BJpcm&cymtSkJRHY?ErdWQkaqaH$fnMK)t{b}Iisd)1Aa=07y}i77KAFju-?TiBw}<7j^5yW?A0YCu zZ{5&;W9&Mj<2!3t%-zs>YHna`%Pbh9t7=l24vVY(OKE%t?%97&KJ#$soygXl&?HV%11e#^5=_s`Ay7Z&$NtAekv!S~~LB5y#3Mg&7$|PPyD! zl#x;BkZVsfr!;MttItliNksxisuC)77F~WAf9dmaKlMiJa=AU?_2fDf3P=T}r$ERU8H_bG1vJ8Zca%W*?Mxj%oa294{7CJ!&iBS+A`U;(|@g-E=agAGZxV))LWrAY2KMef^-hbg*j*~x?rffI#eDb`;{F?$Mhm0 z@_-c#of8rbGY1c=nU-{Q6p>M|qAu3K`-4kjbDGLynN32E%+@5UN43dY zZHYN)lC|S)-DvK}xTTx!Tcx^bw#mN69L26Da|xD^uc3Nj#2&>00lk-Bb(Nl5dc$Fm++|2gW-R>{eJT9KBp|M+47D}IE|UuO z)L%s2&21f8S9eZq6*=gtEepkn0A+2l%BK7#Z%jSzN{kP>ii(6gF)>|%_@+)+r+OIe zYtKp355QSy#5_OVEozqJDYt2gX$-}mJ!JdUdG9Suh$@y?vZKGPkehA~Z1yv2%?e1C$aUokw zZlWf|kx*l;mJHa6I`_C!Zi)$#)^&WYI+_@i-f!#~vLBv)U`^u!P7EyG1$2FbVM92T z@bH91Fm^Vf^P=MR_Hf8~z#Ml^T8}+k+d1}qS#K5mT1cXK7u9rkC@%%gV99;0pE8BmgB2Tky<)!lh ztSiY5QqR6<1Mv=IeQr0(>+6%%c0~}eYkHMz&M>ZvN_v{3u}G|>M4wG0W2tLEGP0wu zj|rPlLLR{QiV8Z{fJlxIiD;6~pr4k@lXusWeE!N!e*A-zcGH?JX!SR`6)7y)d=sio zP6PQ$J8q+EBdaXAqn}-t*wGgWq*_;~z(RKPnNLr#-$rNh$=h=;NL1w2GAhXniM{*9 z^%Hyd8l_a|o4dIUzeqVO@`3(ehprkbFHf68HY^YL7cG*Xs~~<_+T64)mlD3~v2$bV*XOJxobIff6N4$jdZ4iOQnSKO_9$~=&Zg9+%RwyrM2XEh{!IZ1 z53Pc(Z6@7BIdO3_{_T)6cgv;|(Z41+k&p1Y(9#IJjz4=PGh!aHCpvix6*qdD zE@<=B`iXc&QV_4vske}fHmQ}?HCenSHGjiq>tuPHe$+&Xtm&wkB&;mALYiq6XzctYR0w z9Cgg)pK9n?vbbVo@nTrn@(+oS=S3j8_;numhaJq(&dC>+HsG(m_Qa*jDqpT-xJs-% z-Q|}|G+@g07bl;#08L2xls>-@9D2PW@m=xcYN3$a-76?e-s967z|qHfzVYW*$ak@P ze!qfE#MpcFsO`BQ+B^w^yxbB`+A+Vix>US@zpL1bnwnUs2|03363KZL`=NdB$N9SdS8G+XA zu&HwM489P52M#phW%gHS7Wf4{gSobrVP?q?QYcU@xs4=Gx1zS9`rPss8|R))erqAS zp>Y`3L?!Mf$>*tBkCxF6kG*|Jql;;cUkK)s?|B8zA4%@$sw0uf&n9`Ndpb6M%6DWK z!}u6I`PSO(Ek8WB^sM%LHMwmgl!;_nvA(L3jsmlH_Usye@@`vtU2QBwYD%};GmMgx z?zaW{@952vYEtDYgI#Cy=|mcXMxWbSJkOPDSI*fruyo@Sm({5}C7C_R;TQjXbzM&D zioBw;TXU7J0{%T^7lAMJb3s4KMdu{Hohb!xDmOC~{Du9tOw;7I7c@u3(d-6KEx!rJ zzdnV3VF7)9n!F(7jEYZv%h8EjJL3-rC3b<>pC|2?)-z=nCW(o?n$v8bO@0n2xg*A) zbH={J*9hhy9de?o3Z+`zTxu?@B6NTKo^b^&LJ__ROlaUE>>3vTt&Q8-#@hW1T8-I;`@ir zd(!L!uAXVLR9*SgaOE?zU6zt?-Y!f5e+!r!KXp7B6-2K}Rl)=pLk9XSJ^ajCik{MJ zm!)5bo02c|sm5LwAEL_=ak}Q;K#%nw=T8MWB+evsNbCyekh}+C&>^`{ea7sPU)YJL z(-qENhqcwL2CLKoh5-x>lo((n5R|P&&ANK3bE!7#63YZ9&ByC^FWj>0;!7|)u-X_X zIn-Gr*w<=Z8z3x)P|#*eRh^nPKdR(QVO)b$O${t;>?Aq_m#1T4TTismA00F{5`MM` zO;Oy9i<*i;=KWi~>jPx>V#2JemEzX%yj)>H8;Gn7@6LLo6FD)^3dzK~a-P`4jEK{w zpxqJD(+lqz$uD1!;sZki1O63P4LD}ViSyBU!hZgpS+3tQGNKQ+c*AXeP0NiM zmHkOqe`<7dRbuedVjcNqHHq=D zD0QU3Oe}4u<20cpXjBu!pdOK6yhNA63w^B4(XShzwehsR%Ia8Ar`U5{cuQcRB z!XZ+J!cR+NN?N8h+SIyG6pF|^(QvmF3Kpf!VPHrJP7HWrCK~x4o|eeD*UlG?-Kh>A zOGxFkLRaln`WyT$IQM?+SF^p1Vl%ysx=YY{N@5`Pi##+U^so4Q32A`5BaaheMLFHlFKh0yI+fyOd)5&r6oC6*01%p4vh}AdQ+=!TO3+cifCjKf{-d?a$j*E z;Yv9;U)!S5MQuJ{8$2-VXY~eMG-7q@q(+-bWeS*VVTZ*PDXnZT?HCLx)H;^c+4W|Z zR;n}TR3^999&%WmkEfEZ9r&+ef^UBARw*=uK@Jjdf`!%eli@^z#gYFj_3ix*Gg^C_ykvax>%zj zyX|wEH+*Vs{6gUXi%X|e%>)GM#g*MrLFdakq6JeXc!Bk6z4YpLZR_)r5^a~SblF&} zv7&P}Bmg-;Km9xWF3B;h3A?*0rBCy`vN?#kQC4nBuZ-5!aukKt+2s+wDZbt-IQmz7N7c%oUpafJ<-_k{)b3g=XGgUXcKiG&3@V#N zWM?Sysz_WjkLZ_(pNO;~9ppi5BeweFSVu={V_KAsVT&(?rCjhwxqNtI-|E#=+Bb|Q zw!AM7Cw8iDC^Bg26Hv~d>aE4aP-G0n#2}^4)Z$@hYZWgj_cb??Rdb0i5+=TMp>dsD zMBY1e#h9M&2vC8VGc8Y7#HZ*8GWaDW&`(6@raH$V-qL zo1RAWm2{KCxDR|4!YC>36)WyVx=Rv}M?0|gsdxv6B9vj9EzF{_3nClt=;OkOv6{1e zT1fBX-XXad`)xn_ChCP+Em1|SIZ;xvv4iG^C*FUCoHLQZ-3SJa#HPyc}_wpzKsy;18A!FUE%ZI{NzhnwP84+^4dAY9vG6 zp^4e>tH@+$Q)1xt42pTr6t9c4m=kRk&a0xm5FI`sluF7NjXRb%qp)@5h6XYbq?B{T zE=(wJ-K>O)If}+G_*IdZR;8%Xs)2+Sr@$&z7bD_3_2yLXTtwqZKMSS!F6_3c^#{5T zeOKS$M@-duc_(K=gx33R^o@3AeS+Z2c8-$R*439CzU=T;RL)zXKh}Fg-+{g^ziBlh z{MNo+MEK=Ha2a|}whW0?x>X6UM!(x@on(-tSB+dl@Vmy9A5_PCVMhJX?CU)Lr9}E! z6s<;KY{6Vr1GP%v8kg^CSOr?+xzMW8YVQZGDYyrz9dDnXl@lLSOWY_T5n)C|KBVN# zF8XYCq^eV>Z;CqQL{+Dd$+}LV9)nW09osTxZ(AfLnYO34tF}*0ZdVcJVZ;`lNtA1v z@|wp{s!6qRsBf^XFWFZpgco6EwD{gW2@*G54c%0QO-waa3sJ=N78g1$=9)hGa(xJW z1-{&N?|pzDVxq;#9x5x@$~5LCPOOyFZARuoSkf<`Xgg z>edfCTm)7V?e{aJvA@>E9+k|^*`-nKUILwFF^8b~5TCx#j*fXv1akS=y&d024xuw> zpcg(cHgV06QzRR7ip0XUb@}?94p(DLVC%;><1;rZvK}#jfR8pr5QXV?iQ{nAk(n-+ zoYP*$Z$6=OQcianpDZz0$rE@P;)w@GwrtnsA5T{POi2L)O@0t{zI~aZ{+>`;;y!QOL=z8@Dqc{%|IetuC8^MH zgkS4WQ7GR_%6Y}Py+$McNd+$_B{U1?<(__*{1Kej0_?sTezaKCu}FjqmGQ0;W914e zPC_&_aV=#$TvC<@uA@KQ&m|bPucT!6Dz-vi`UNmup-rKJqln>UMT86{nIUO;@ z)&%uF1=T))<`Rp(@&bQcYiLSI>-`JroA=SnSy!NeQVlQ3A5pU3lbo|PnQU`&lKXJ{ zb_wfgOQu@kyWh!4$QIr}%EA!GaQsn1X^MNjF*8F<5%^;`ir9JMW}0}IaoA=liQDAz zbN@a|SF4kuQAIY5$f{5vvLYh0^tqi(?VUuSu~%lOB(FBg z)H8}QzOE!5aYYDB9CN!-*UXb86;@(`{ip$EKR+8vYv3+KRs;8Qw9Q7OZ@smz`NDrE zHqNXCUWgh!^BUp;Z8Hht78$TKC8BvdD|zG*iOQM@MKT5;f9Dr+U@9gfS(}P{=nI6x z6!k~4dceG%fviUoawQE~D=*SYIYFuf9y|>mR2x+kK`H6Vk3mSLfEZR~)K+$g{bMWl z5+@*SJlKX>hj$>Ct1y$fjCY>!m}rxsjPEb8C6&qEZ=^N-^nhd$Hc$`N&g&$Lj!i=o zS6uM3aOO^;szLG^bPj?q)6h2od6xtFgyRlEpOjD76PaX;3n5;;(fo=7J za}2e`8Z^i~!I;`=w(z(lkwtxDD9)lwYV8&ackY}_KzogH_;dIs(uPH$|JpVs)issD zlP54#D^dnelr*fvVb&-naf8O* z1^6akIO=w;XpIdwIRlHXSd^s=AxEG!YNyo#*R`Y6x241W&8#bFR|Z^;q!IsDl~Td_ zTme1w?UOxGompqs(P|x^25|3%@v?}tXYp-#aYJd7Dd7$Q4Rx?d+*5@>{5oW&GtMaY17CzTiqoep~XKA9@ zmPteePXe9mM+-iS)hozCOVS-Hi^iAbdauQj_SmvEv)8~7Z};sVi!g%QkcCQK#z+Z{ zqA7xazbe0SI}>9&dThC{(GkAi<1vOZkfRIuH*gba!4g<@%7A&x;8aOP>%Q;`>LU7O zb}#V=v;{AqymBP)HR%B{uRN!JsMs5IW-%H9YE*Sa#7W^Mf|R+I7w`O3bYxGLCgk@D zOtsCDOzB8k3vDee?wn5{mrDSVRU3ImXZg%sBUcRhps8jVUawYJ3@l|*4~>ir=$%Tv z17$#);97i+VxX4EVyP*)F^kp$!=m6siR10NjB+CIbzyJn2}J{sHS9;NZDRRwJ4zvA zea;m(*tOE=x|Z(AqRClW+a4SAq6VB+pCJF1EoV0e42)dwx0nlV{6DJH&qWi-(VZ=D zO~Otm&`GOHA+0R*_)MXk*_IEPUE%s%ZiiCi#bQ{;u^7a#M^Bh}-s~%bub1?gS*4Oo z?mX&y!H4^NhTuJpz48YP2WA_Oih@&js%w2bXZB$Vx;aZUy9*P)-E6LWm30?_!H%>O zs&?A!%k@Mbeke4uf8oL%-HzvobjBPosc_;QyUiN0v2q2icYCZVxNdhp(0BPrIMBPU zs4ujt?I9E7B@6y-@DgRha#;L?T8*iMGB{S^Lq3=6i;2rzj|h*1c3bwVc8ku~o7M8K zbEz}4<=`_x72!g)i@DhTNo*Lz!?nLV!82xRVt%-GwLR60B_-!lP0VM8^l&& z2Rj&S6np{;U}|s#>ih-ZlUNdK1xHG>G@O)5lVQR;1eaJ*I+<485>AY;ij9Ciuns17UKtGh zzx4bv7>cUB!!K7cEsWeFqKpk``C1UfUXr_h-x$W&eyjpwwAew@;xnS2hX)kmxL&QBSM&2rsO}zl}c(wQ2&3 z9}B3F7+Wv~vJQ(`_<&w@EWFpXOTVAoU#)?i)u(e>kohiMh=D&0Wz}kd91;kdvUX_C ztrnj^&#KdS^H^HI|6_(b;)R^YRry-|eWN0Exjb!4ib!r3L5>eY9fYbd9M3_V_g`@6 z7&!VgZT~MLw?`cE>*uvWoEcocvBbhA*Hu{9J{=#tr?8Ylm5J}GY}8Np+<1`M=9bM2Rv^7`l%GGMIy=LP7Q z{(-mw9R3S!wcJ;E-=we330UBqs&yk!9n#z`aoiw&K~e(C{Bg`uZT49;YDsvgYkRQL zv78%;Z>)u{GF=aNs-&e=$2#^pjurQ|e>J@qN8MGaLe3b@2%XD5dw?IF~k z+TyE9nhh#uOLZo3cVa`XWjv*yGlM)F@mJ3qu{c&7D?+>Y92~0#T1MA%m=>Hu*?fpm zX?O@tBa06Wk6$_L3632eUv$N=|L++~%x#a`SjHT4H+K+k z_v{~w1qS!@_v{;u1O|5xx|<_LeYnNvYYyoLk;JbAZ{w%oh!6tIPuUYRBA`x0fLcsP zC*pPqi9n!v4|jPZ2-IH~1kPdO85*7s0^8TL8bdzllhpV^rm^c2?)b*m(yD?<1cBz9 z%a( zVJwu1lEOs)KmT4AtF!IV?Z;}&58~&}sEc#Mqv!KMwc$T_9Vcn2lveUerNLz58#!9= zdtGXkRVyWc2UZ6*4LuN7uy$i|QL{AOL z+9Ws`Sg^L}YD?M`aI`W?ZVTnz?ufr-L36-UT9LCCB34LZN=8!VK-%hahFbetgT&!@ zZ^Fo^ScTQ5F{ntER~amNlTIJ($VED%dKsf+EOw1vDN%3=i`HP$34sm~Nj(Q%A|Jw1 zSmZe7w)@eFa2l4e@Af}pWFFD%4nHQXa{gIyXTzCuXMWxQ#I>d0e@BgAz$#gz_R*#amNY% z5`G69u^&rLsh##Rm^z_x%AC+5JPGlg)2TG=QSQg~RP`W=Ni>B0&{nv{D3;GRH*$ps z;c#dP^)Nc`I}*;?l*GeQlF|EZHt01IJ0+4W1TA<;EiRRF2B8u`y(N*~4PFxr9F$jr zQphX!Ivik!TtN{i-h{tIyaz|yg)Mp7;Y$VNhPG&FzV| zY6){-k9mK60@e1}Gp$805VM;q;$R&v*Fr1j*2?j%IKCWb^fej?h6WngmCDM$%~C|KpQVUGQKg9J zM%`V1C(`HJ_{YSvYsR0$T;SIz5{K->Y$Oi+=7hk+8M+MKfVR%f1oyZZ(z=JAv2`Ma zzCF9l4RJS6kFNQp_2`=4S0jqPhK;0B{6-2FqCR)nK;uhR5$K#Ke@wus2kxYRF5+{C z3^Xw|h8EuL4eJ1TGyYo!I(9fImp%0qC5N+;DH))8mu96BoRUkw@DL>@;Y}6u7nC0X zf5PvCGjw7t2ob$?TqdLSkOfXS1-YOtgQrUhTCnWV$=N;feZ&=5LolsABT?}d0r`j3-fgx*IPLXm#g{8 z834La;FM&|0+Ou^{xVL9=SL@=!8q{tDVrAlV6HOmFEMf_|7GKD*8K>%4=U#u;Qtz< zUtmt$N;7-NFtjX)LB)6i1*Ke8IiS|z(89fVLdi=g2ru{Rc$$6wyU>P^gidGSWhRqD zsZpyLz`DKgy;NiIn4P-HpD50PY&k}}Al6Vbm;%$H>g4B7P;vq_z&&G><&*A2gk*1cBkz(Z*GTK|nEr9>8oPgi+ z%jrMj7`YXlxQp4LH-VQi2d2aCI>nG)^ALx&>i+x(b*NL9&e?M9x!4E%8=#G0yCY!=M)}^NV8O+*u0k+WbhE5m^mJaC z{tfsi$z|f$kf(!xQ5@SBPcd8wj&2(UhsK?mkHd&rZ9Z>w-=y_Hhcl#?o8*>kIGnc1 z6}GhBSKUeN^QUbJuvxA|$r|WEyr$B?p(!+~_cPw=9&4{JgRTg@=qo=1j{+xV#&pLx ztc>4vT+Qe$821{Y{Y%vvbLouO&J5sDncAYeRmvM&CaZ@7 zt7N38f3#n4g#@Wo2tg`5JpCu|Eb)|BV`@HzY0G%|Y1-yC4w5Y7nzQX^#XRHrK=i!n zKdV9uk#i~()vId$dqM~mJS^)egu+c8j`K8~>kAdpjbbR&jIPZ{&aQ#uc@zX7=gFt! z#2_3(_4t4pW_z?_@#0d)lJU}!$x{3B)undyS9s-z#8UDVxR%D};2I9WKgaOlDVifO zloc045SkjnYUSk~Nugi?X=F5OjEA27+AvVrAV=ep=b^5~t^62$XI8(Lerl@1CFj<7?YU znUs*K1UQ~`a6D=_9w+8Ox@rHET1TFS!(uTzc<;E*L{|p{ha;X=CT1_I{j@XroI0Dq zXDpqd#?_|mq8!1R1D0S^pvIRiT|yGZsMj7aF~ruLxM}ZC|M5p#5k!>1A)Nsa{q!f` zp%;~c3Jyj_{zGLPj_320C-F}5Hq4Hhr!bwdj7Lt<#$U3gUrI3KSwqqwC`*det}mf; zrUFBxOD8lrFY^|yLZP+rAd8MlQuFuUkFNin3eZ}IK&5mJom{SSnbQ7uKPeMji0_wG zo&*)~$(Cm@J02~`Ik}emrIGz5ReSUqkumEQNX$6QJ?0)%l<<+2@9}C@y%s{M)S~fhfa7^X9FH4OLYUIA*lBzRrp8EIH^rLhs+fK- zOV|kThBn+8C6p#OqL@H+c6WDCq#^3H`3(#n>4Z4vkMQYFE{AvqO0mFw0gRqJ3C2DT zt&Qj|Eq~(ZaX6w+O`CCzw%;S8(I_n_C~izj`OrE;y)U~p)qPCu%o z+fjKRYK1p(intb=gzwkE_iFL|b>jQaPcu*|egWTKFTP(k%|Kp7?{B~+(P=XHHN&L!xpgn<9aE}Q8eR5ELCmD_u3im+!?W+7vWe+ zN>P5lUO+Y?pO;eTXp?;2@5|+LIlUfUQ5;#C&k1?~UWrv&=>G+{?*zz5Q&WTte1{F# zthna)zt`YaYmlA2&-rauLi;B1xHOSU8I=#crxOI-dk-m1sboSrF@f%yR1dwU)$6tI zJ)|;=cM+~QL~O)=LS9+NJP^=9Tj9j1Q$f<~>*abO<~f@ZS@A-!Vm4;!s|HZ;7m>`H zp@U&im?I8H#7tLq%C&Bj*`<>KJwP`*lEhszhb2B=w*r-px%YHBu^O8uo+RJK)?n8? zk1fML4c%J`d>`Ym4ERAw(H7&{`uf_qn8e^M) zQ`RB);~Fai^66z>vb~rdb(KMIif5oTJez*A{cL*PK_=nJ*J?R|T2i1UgLM>>kCAhu z7GgPdz8<8N+N9?laPnm9o-eG`0jb7mbod1+t_u&gMfJ3VW@%+=c=y2N`;uc@c5WF< zrdEG^nHGM|VX_AWN^5D$MR+-h6Ea$=O!coRW){YT)cCet+s0Dh<4bSf*dqI}Od%sF zM$NoTY4iqtG~$XF0KKBiYN~7a>qg!te=%gl_ zN$W}3;-#1`lpoy>d4CL2{b}-TKoMV&V@N*NO}}s)(sW%JU4eL=VzHrcIE)e4;502^ z;Tnx%6WA8){%7DituN7m;^5Hw4J1{d%HWj}%|*v1+%BHtVrB4ZNl^%Jh0e|b7myex z(P^fbq3txlv0k`bo~Nz7@MpsyTrW`KCb9MIp^3mU8Cgt6$6OoAz;_%j++ql|P%~n< zbo!!r5>>+?H1(C^^~Kt+i?5$vQ&sTk8832n@%#i-uV^DPIw&`T-nS7Fw&#{_9tz^L z&TF-K)g&Ga40OZ|3_55}FsMX6`?Sk)U&Q)5Jc4eQmie%w8;i;U3Fwb4*!w7b{gJK2@bAmIARYO8Linu zgDZuWC3^=J-nyyz|4HG(Lq#k50mZ8|Dpv2*+k84``Hiy5Q>M;k`|#UioD^tPwuq~8zC3-9G)YCYTobGfM1N-Ot)o1Usci{$?%m+QnDwdv{XXLIp&Kbr_nM> z!DYxLj5cFi&fs_2)!Iz&no`G(MM>G0RZ3LO_5kfRI9*1oN01pUM%LodnLHMgN@?-L zT85yEEP}Lt4AL6O$R_MABqOd89U?cZ9~x|?nxKq43T1@%cqhi<6qhKY6=(`^O`V-h zTu5SqGLnZYAe4cuP+3-8K2wVR~(U8s;jr^== zkTaqoohKU7T#k6G>9Q|u(&JK%%WUYNr<~Z{LM>>{=O^5qv_2LY!-l& zcNkrM4GwfYtBf)U4nHHM{h4;Bd*G_&iAp%o+ zM8+#WPq1pOiq%?mR-az3F&QafR402kENI;|o+dskr72V^rnsMRYdDQXFuSxePN$>J zX)}Fmz}q-y^$I$t*}zn8(|PPhX zF>=jEI$v#N*UjI);r4GGE_B^;M!Z)3Xl-3xYMy9!+NxIvZa8@MzQtpo`rei3I(pA{ zZ(4Hm%6N3yb>mBJS`~{dzpmCx@6ytihZ@TS^Pl&V(+D=$UiEg+Dr(P#I^j8Z4^@lY)iA>GeVeAs7l>pAH$ z2}J+`+7CF2MG!TA4N|BL>w5+h@OMt7z3>Msp2q(NLWdw|J??N6&1G<~Bros+LB%Gx zVi{a{jG7b=vO!GAi|4+bcbrYF!31Qtd1s_hwfbJjg5n8VU!xeFKIah}8ac(9G`}q_ z4D%X)bD(KuXGAGg(hz6MHO-TU`_~*2;CP2q2rSy)pIEzjU)LuT#vnQ=tujqK2xq(!+xiTa#(!Q?jw}g` zbOuI70-XdpG41UsOeH@J4nnT!1y`PG)xaM^p$smc8dw4ip7x~6MGj0D%HWD)6z5*}p8WlB0|XBV`f;n>upi zO;&I3*6tmw2E})I<<6#+Ee;{v70a&bO)(Ti(l{yCwN4!DTYY4G%G$iF*uG;pa%A-G z%Q|#ctBSKmA%am;7Kg>0S`ZHRrpz+I2hE&LYDp~!xmqGdhu0z1`Rsb9z-zs3V`Ti` zQ1j+RMHNmZ7VSVXW}8+@IwcV-1mRq9D(2+M`0f*ai3E$5aqrVYm~*a*nf;JjC%H*_ ztz;6b^^p>LMVuAeN7avMoXOy2XV|CS5CC~4zzv*|PC@;+!j|x%%{=FR#~C>(snDvx zLzE@a9WV9=*~d9UC4pBy3HEPIXTMvAq2HAnA|6L77BS=BXE;VeDb&jMf1Jd>cJ5HF8*5iT>QLU(gIMR1>d3V#c@q$1jWWo5_*K`#oN^Vo@hJI@*64F_X zb{9S-M{rtO>9zISwmrNf|IHnb?rUas1|gd?`wX<+qBmtn3(18jog=`#K#oG;|@w&R5Y=_!NuDb0$` zGU%wQ$k}nOC{LvZeIkzQyI zve*J__&F?w@5Z!P0N-7rZLC|2tkb#E_~Xz}l<=>gpwrD{xC}H?#uZ&hIS(Ml3O&g?yY{l|}P@~8J5zYbmlm3K7Jp<-qrA*f@6@R}5G z;o$f0g;w(Ag9p!k8d=L5SKPEb5?pfqQg{sqmLMznX=tC0O43lbB%Z;7_!A|TxA6@8 z!3-L;dsUD}+*vb5KZgdhzT0rV9ZIJ!U_8b67jcwgRPu8<$bS?GU;Xh_y_KhMnM#2S zsljje#SO9_p>2d4E!D#vEmjnb*|eV_`H;_G7g*^DC~K$!Q}+JTj6v+BvmB25IY`qc ztOMEA|2`FW!yhdBP0_CUpmni9;vPID#Hr8(mu)nuD7pSY2Gw`onPao|^f?k0AsYmT zR!(t7?OV-IDGm%5SM?;6G8IiJO??}$Dy_eJZNk)Z<>X25Hq9%jdA2k$)KRoHEwH#O zXsf(0Wb!zKz|fwIol{&T-rL1z(`m&3m)= z)qXzvdOd5c@76=8%{#ZHt210vVd)NHn(=vVZ{kZ&a&rHE_imz{`-;XdRYkWi=(SmB zRDB{lTWrS>@25D4_*ZAnkuSK}zf+3^EPq&isSz^YX^~FKLpajhT!=MiCqy8}9Go5P zog{o68W+0^w6BSa0YZt0wJYmQ4Op4eSDJqc1pbBdB%nsyo<^;(Yr4He)|Q&8R=S)> z?5Eq`n-7})5Y#rq(8JZP+A>jgK+b+WMBlQOdXi23HsQTYUNYn0hE9F?`%IELi3x>i|Fz254>pCUhS}1>}t&(C~!*#LE4Dps3 zNp`%Uh@hUs8h;33d)E>%CD40CT;X4K#y19+*tk~T?@6USM0dXa)Tk)Ixa(cBAkV+I zrtDLiajnRVzYKOS|HE@SzXM!H2$cD^Hog=Ql#KMd6~sShV1N1`}?H)s}HTE>}^LF7l%B1qnBF zib(W3P~KPrELD+p@tK&Flr~E;z8j#DF?6rECgV66Y3raM?1qmveW zQV%WAqXF!WKT?W6KXCdhUf{=8^%#qlDJ#Kp@2Beg&Sx3$+OLOZg5+%fq7B1l&2(>* zt`3gPT_RqXmzJMxI5Z9_NZ58?&UsK=ijMw>RbX)KSQ}D0bf|2V9vM3(4Q*LiF86y2 zQ88zG6WV)#p77n(GI`ofoL!_ahO26f-gXb1YEF#tfncR*a~On3@Ko$MJyNWNK~yA& z@z?>YQ7qTrf<6EWZh`Ci3Ce&iB9sve(u1jTKjTEFV* zZ?)|QJUV!R2d096S7YaE_FnF{=?rs8C;BEVe-R$%pAC}NfIONFx=a<~pCcnk|{<$9n#8;;@R>bL$Jrku0Zrl5TIBTPZG-IBc+Zcw{0eTx-pyJdu^Q+GuR9 z7y7;!FOljka9DcME<$N6XgB6LGBGY38PSG3c1?Js;sH5bvGbfZYcqeBmL}SDmt%B+ zVJt+MzCkAeEV{9}u{R@R$GZuB!tMvGipG=agqYIsUrCcFZ2ObmEO9##?E^yIciL0n zt~_9YR9PX+k`sh6#JL+h`}+!dGo!G6ETX5U{11n0a_2a|^RdV{u`ca&0nyJTvL$;B z&6CpIo|1D@=K5m;?T+08?$o~|D9SmVKkoN=WXP5o<1&?flra4vUI&+>Vb!?FYT2Rb z3_GTZ=G$3Z&6W!Dn~1Ykt4o}>s)*3ljGOSNV#X^P;dsp&Ep>IX+LMfl9H50lWTNt; zJxaENp7^50>Y$dGQ|uc|z1QIcq>OHvU!L~^x3j4ryG3ORod6at=LhBEC7eMVCB)GG@VFHq7)zM#-%o; zS6n`4@0USt@4Msb{TP7`VK&c+v<^0Bqu5KO5m|6RIEX-4_&X)S(0vc|B^L(4=!q&! ztLX!Pz!QbCBGh(CJn3C}hOwhC=FoB1tU{sMwIa4vhb*0t3OCieu|;?xI}^(5)oe)G zG#_u5#3L8@lr3W>E;h`{UBvu9Zg#c7iRsxpX0`-0I8ASI6Iy~`sJQ$jXA>OZ9r@Ws zb+*>M^#)FOJylnq*MVCCn9z&!_35Ea>oPgaJ0+}HGNyS|w6lQH>o|PqGMkc&-XCr) z7u|k`D{L4x#IXoZm%jFu9W4}nqe`R1`|_zDL`l``c~Z^J9;v!LQzzyU;TEt9M9cK zWI^eOUsfOAfWE@s)FrAr!SO9dyVaLhT`?6yEhi(xvE=oq)tIbnEesZN*m*gbEV`6! z2Es><*M;m_GX9nF<=}UxQDnwS1Q#(DJ|SYww`U|+;7k@AB7-@{dE>uK{Bdl4e2bZn z*S|1l9tVdDO2AJ_0GIY(5~vM^>e3dYMsWy!AU`2I{84xiPR0B2UA(w9X^bNFYTR3% zFEM(5fPNhHe=L%6w^?1L@$GeLDLSmgb!^?Y2x&YrkBO^IzYBR+U5U*U|0q9b+#m84-+%R39w-!J= zfZj-EPohP&VHTrNye}5F`~iL=>?Pw}`XqnA(6e1$0O~zFazODFN&bHrid;S4Q1mZ~ zgMB{;?~No?BHdl^yMBhT5@T+EEAq0ia(^;7v>w4VtMc_;vMHc`AX;dhK$qmDB7HNO zuU2rlYmQf|0TPK7`ubGaE1@VtJnI5Djboin=MaR?Ks5P|7<#W5211+}?%Cqiz4`c_ zIu&s*mr8NKVLV`lnA|1SaqNI#aiYIfW4BTd`~F)}zARPH!#P=j?>}}kk;|@^4oW`) z_-EhmB7I|meEl-iN80b%$McYaih{uE*HFId_wG)Rsg0dxfDS4(eKFDN?a_h3QbAbW zV&ae2#oxfy(05Zcf?t({|C#W~#8yrFV@26%XQ@}PA)4K2Ml*ntm&@6{Qc0S+0TH4` z&VjjtSXP2GOCz1p`(L}`vjB#&QIxs5>fyf05rbc8sFo{(iv7Y_1>D3@Lc@q<6>Dlr zI3*}ERZg3=Z5`Tw4yx)N=aY<=tIS=gQ@Wu$_*?pyH4v$a&^cW~bdJWHp}95KG90GW zqOgDBKYb*);dGW4%j@PX#w8=HbY5T(IOW7fba6bk_*|q0RXQ?L3{x%q2KCn_%^?yI zZKPxHCfw34zeVa*OChjTj$&GcWP-rVy6~pfVkqj7i?l>u&}CyhZU!mV3YxSRZX{B< zkrwGgK|AX*opg(dabCihyM7`)ZJ#Xz#cZ@LLW9z}+%@g5VcYsn*Qwb|JnGSpzoW|^ z-D-9Hj>mQeGB3=hbY4~5>@-l0Es#N=GsV>uj^iT<2^jH!?|YQ>j%JkLP@Jap5bJlr zDz9UMzsrsJrXQJQ-^6G3bG7-7d=1UJ~|ZSYP>Iij8t|!^|b06?<@T7G1yN&)j4kDNHdJ} zyg^*I3MmJkIZFSfGC9K0MDWw*klnVB6Kx{O6kbuo@5T5~ou06DJXT#m2}y(P3038| z1Y=tE!^CUcb!gQdJQrv*9AfHIsS_pH6c{td5+-2{mkq|m!nJ?MMMy9yo>fs2e^)!v zO`MTk_HNuwl?m4*ir7UhHOc9<8O(nYBn<^^1z+`SoYr-sh)Cn=Sbpo7CQkq+Bn_0i?8k!E1r-??#l9BOZYBHm$M;xXqR0eLjDbaR{yHvF~ zqju%fU8LuMs%~SNjJ#xCJz`pK$^H}*zJuGP=19+&fpjPL<37CA*uDsC&Zrr497q0y zaTS~?@gjG!#|O72d<`x6SD(4O#m079$v*n3#MZ98rQ#Qwx9M=9mo}%6V#ARC=EXdVXX92f9xXY{0A|r@Tqy)q ztfkec+SY&rn6lNC=#R40kOAsFXvD5s)1#etJ3~!ATIgc2ppbgIWit0!02Cv9)AZhR zUyoNcspc^!lHF{2+nV5t4oZR$MMGt7Ip|@cLz=Lqen0^8*Mg@SfxTxi$dQe(yWm>mGjE@^zG0Nyp!C zx8ZXWKg$m$tbJTo8VeF624fZgvy2z?;ysM_EQTVfGr;>^aL5YS9iOkw4d(EGDy^j+ z-82?Tg+v@p5pu79!m_WHvBv_0P3K7E@?=TYWFQ(FiO%XULqU@K_&I+={@{;t>q4c> z6|o4J^xbmGW3(&#CQl)9$}`K}^-PxBU1@q9?-Lj+n&LxcIsqEeq44-WFQCU*j#Srt*y zizQQ}6@$eQA~JF$#TU*`UIIaw`?Nz5+*Oa&5x-0PsM~e}?J|$Wz;yH!F=39;70_2C zI&(v4@A~s53QZbogI-4;y4&fc=hlu3fhd{RA~5dyQ-_`w4m3nm zuM*{%twg7H*X7w}%94&<-U=C@G_`0Q=>}csa|&}ZL*U9DM(S)Y3F6P1rMAb<9md5I zVATvkZnzlv&6M-Xa2tj1_+l*A4w}P_4+S>`S4Ngp^H+utSB*n73W6%?4F9iL6>X@o zl@Oz3n}&K<0RCu2_P(x|#eH8?3X0GuNgRr6Dr8!40xbuc$b8TW56_AE*epN*=EHEO z5ljH~gJwr15CKt&a5T)S~S=?0#{a|r02 zi%%L`068@P^7Mk>Q7_(3GRC2Y?8?dF#;(wsY1Dq=-H!4$Yno4K68jrwjT}q#tEXy| zG6T}YHCB2ujTF9O$TW9wIvkJ7fvDncMKwq?hOWnfhM9&j=uyE6@s|xEQnW8aw4!n= ze3If4D=%cq8FLBTp&%8CB^lb|@%Bw}+uPlq{YB9Hs)yba+T7~S_&V|Gdf(ZjHGOVO zWG~_>TKE9-@8s#6LBpPuolzS2%ELy|v$ve^KFbW1m#_E5=a!5rVs!Mi0k2&m z+AkY>fmg;GWVMd@(4J_0GGB2(hl;-+NTZXia?@ddd#Fd^i=~sScJnkacU7(%=6VLi z19>x*w5QJm;-SBpN_Lmf`bMmW6QC1vdszdLc0$#ZG6cCTfOxuYrbusNVKxJpx4AC| zzk}n#J%sD;M{5VBD0_r~3OObyZMo#Nw$4Lc_x_pAIgGL2)SVYcSVz{7JOPAl$QtH^+zo0@PpOQay8w4Uiqz;TS)!qQGs|2yEmZ_oi*YO20(fL z_uG&ej22-9LSB^uF@+D5)S!c1fUlzS;Hb<2Z11NdDan%%=g2uGx%}*1tw_s&ZBzSV zBE};!lDl>iqQ+V@K3P+hwgcS1u#R*AQVo6* z@{?vw%MSLZ04(yqR%tX1HIa%%Ul%hgVb;c$o1my9s1JM!ZKhioEa>5pt&3Q^!-#Y~ zjHYpF{4*SzDr3%#uJZNr$XeVJNYaqEv-q$B>)%21Mmx67IEjYUj3rCurhwAbvju$U zB|XB34xDJavnyeu3j}-MbKfeWu}pp~*q5gA(}R~Md`=FrLVzOPxVy?|U^(FDWNOn; zxAopR5rT-HSz`iG*nxz{F5CcAV~8XRkvxM|SaOyfh7%HAE?$r%saN>*WDWNQ1_2f4 zp)%YQRnd}pR7;l(kvUQeGrV(Wfw11$xs*xvV7P8ckwc)W=$iOGkbsBK2QuKQb@ZQ( z0%9Vh)vzQK?+_cTG*ardQdR6!o5|3mA-WId3}}4yfRv#{+Hx^$H^{}$hfAe58OueD!?}4m;BkS8UAVnEs@E^9xS=PZH#qp-lcG%s^S5M z4}nf;I_LHSM0*K`nSH?>TIr49eSD3iw~geY-W8zQQRUe(SOn#kw{JHqz9Bt|vZVUe zjW2S$*KzA=E-;kad$%*?`Gx#ZBWhexA`#n4?7GX)1fov85?MyCU3?}L`|^H}epSKm zUp}vlzA)kJe6FqGn>$qAds^L$I1Gd3)%EB}Ox!8Uh*?0jMs91=L%ODZ>7vJ`uVf1J znq}8hS9?W~6J2gA9!{gS0qmqubA<$QSTy~~QLdBz*Sx|cETLSn6y)+psH7gj@H?ip ztyPD29(C$NYGj?MD%dpc_1@I}49e!e8HWYa#KDt^!hF=zHyXdP!%8+Ac7e=|yrrq} z`BMg5xuIOdxQk0YpStxCP3C=#Sp0cIo;9C|kppqJ3G{13i^(V!pcSCXPvN}lk4A4E zD=Zy$Pr_)E&BY@YhmWKL$oCbRQkz^r)K!$e_hd9+yduOI6CDCos-#DaV@gkUFU*p`%he)m9u$~ z8r|jf+7pCk%_|;$e>HU1HE#P2pj3?hO!(t!RTK))D)}w>=XYh2LkXUyRe;=RKcp`6vxGDy9%pzOb z6JA#I;8_XG*H!9Wq`U9ZFKC!Gwz0yw$3eQVlW$ny47VvWWG`_(V8@9E{#<{4qHpQ; z5$yf7o0fRFtna6yu`I`-vn&*U6S`vDffIWa&xw!1Eq}}4@Xg8@@T3sb5!?8?otv;J zpxqW|#-T{&v)&r;hI%aB;UI2>Lujj)81OAcZrL)pGcyAIfpaxjlU38xO>}rH8LCG3 za&Obp*@a@Lkxd>Edv4nbS0nEI)^nqMJ3Ublg7FK$sdSm-3Vb)b8$#KpM1r5Kz6yDl zNWD03Zhd=>t6AB$@RTzAkscFoqZ;p4#m|TIhNIiUoC0uo{QH*;<8)&{4dGq{P6+4c z2#7xN?ri|9DADar_lDwwc!2;dKg3K1p3jdDQt{-A`z{o4;(J$6|BmUeffR8o^PfF8{G4G*7x2O8Uy904NFHyQygoiTzlFh-g!7X7FjuWnW$fW}vRZo( z5FkijsCmXMnRv{Gqx|ZE3SA9al605(YJJ3_tOUp!2FM%Iyq>FbFxjroq#pe0vo1oE zf)CJZTx=Nv{t#J(lf4=3!+HjGh4=%8W*nXBs7>P1Q)o2!SLA7n_mlve#m$QUqKNAz z@g`6tRKFM4(XD{iE%!A|vf%}Nq;!h1nuj*gK48hkOHVG2gU2LV+OSci zJRg%LbcqYfPjKu^P*idK1ALgB@JBtkiIuQ@H%9z>LI@G}kz88uEk+Z`jQy;9@&@iF zBV2szyZKJY-%9Xbs3dXRdiFc99jpKRT%F2)5uTUKBHg_k_-F5Lpna9RcddePFao|N zZGw1kIJ2W{SMwA?FW}*X=9DuGP_+6diKiBR+G;1VbRQs|8heT#&ybScE0mks)ch?N z4-2#1R3tY=EJXX)7GOUTJe`3m<<8ME9q2cB~dM&zbp zp-3U@a2M#l|0_iBhr^3iI3$Pxr~;kb@8$vfg!piI_FS%u*TQwC*nwkxeZIbQcrudq z=6fI~`dQCvHOCAO)wsakg>J(s85TSIrt(L(mDVyE)+c-JC~Ex!D3wGycO*m4sy+O@ ze&(1ir&k@l44<;BS(v9X!`&rSyikdUb9cA@g7s2eMC3UE82Q!G%cJ)Jb3-u)b$w## zhW=vXp7w&5?>db1U7^rfSi8A_`gEJ^huxm56KQCVVp${Gw5^Mnurr zDAO5)AF&x4aJuqvKCnEhTD_0P8Ny8*pyI?sd{~J}qJgBF?`nnKHiTZs{mI*lnwwHt zy=MhSuU6M2I&`Wz>X+|CZ5 zLF}_}2p7^2Wc@OH+jxu$N<=UMp$!pgwhOL2WofFDMU5&L;S%L+FYxICq&x*r5zBv? zh3RS2sGSMLj%7*@MS2}o*_d{UTQQ9ldW-=JyKr`*3CR#Uf6%QvA-YCwv%RVfl$o#I zwkUF$r!^`G_S7L1A9vy_=H18+YLhfNA0Z>qD`S2Js(hj1hwSLyhw5#Z z+#2!#c*T=bQU~u8f-*!Hq0c|o#U?2xxJgEIC1HiP#tw9GAmgr;U)FfdFzbPrLp1|6 z{k}Tw)+XmugFFbZwYF{Cb;p7S{>GQ$)8bm&c}A$TE;8+HqT*Sr9*+SrL7N$}&pShq z8rR8yR0Ui*glAnQZ?R*wozy)JQt*=c1QiPjd5zi921wneJpzd<2yfL zHqDnYQlv~AKVg!%!*lYJ7USfZ=VU%tyf*y(AHAJ&KE+SAH0c{++y8wxs`z9bxnF;W zpxpgQ=cl)e-LHgRA`psN(am7(Z0@Ji?}Uh697Pt~o9q4Sgq|VlRR<<~4^%&_Z|t*u zG9Kz2M-Z+bnqPu90D{%+kI07hj5>z`#(1swScmvGu_{N*8e*P|g?!xFlR#UhPk zI?t(+6_k2iM#|eTGSh2u^3LE|T?TIeD(%~QXy-{~%x1Q=_uTYJD%!tTLiAYYgjkX zG__@##qi(FqjZ31ikGP1NbmD+yK9-e_0}mTv;V;A8KJ^Mz=V*6Pd*e%C;7!AM8z+~!g)lsD0xEgrY4&*yJF#Qz{MfjCqjp$BQ2 zDmVk&n<3{o4qfthn4eNQeyq#i9j#xQvHeOqemcAiE{3tWsOQnTPsU{eQVFj;6S8}+ zJ&6R@{2SkPj*lAlpB8lW#C6FQb;)R!FZn~$uxz<3__L8U6WnN`wA{cgRy0y~j|1G;DJo*(S@?60XY_TNcELz~<8gI>FVC=gCEytCd}yV%<%RpYbEM=3HgMNK-TW$+KJG<@o&_45)d7 ziW8yA%j=SRB8z{$;8aDm6E|}=Nk=-)#LfCiQJ3ROwj*=;9s5=cxDy{J27bV9L#EKV zz1{lQ31J`DmL6?#++YnD6;E%BQ;l1$Vk<;kr2PYZZ5_g`u+8};j&@$wa90Kz@-rHy z0H6yQlC(f+e^|NOM1L(?QTSEYr>3X8Xwa>Ac9U)nIs3`wy=#qr3c6u{{I3+e7`p{7 zGlXpN%EfI`_Bs{-syHX_R1cLMEI~9fNoqFLh9-|w2qP?1c*@rHV4Et%teSPcjgk5s z!G}<7AtWAPn1DYQ-%wPex#bzmx$9b1i~sdJD~Vf`yVSXeM;!Hfu|~tK@zo7?J7mpj zTGFg|CW$(s6tbnA&#=iuU#`5OS&Nb@+q8vrM-tbsfTE!`Bc9PG<6S#EjvaQIFrre=7!Ys9^;UBypx_*$XnjJP_HSN->6jObq z9ck4A=#~s5U|-$Awi};zi%+8PhgNnf%0g^*qKESH7Z2B{#VsnDmtW|cGG7;`vRrw{ zA7N1k>p-gf0H(7F;&OM@@_^0KCEI|-6mu=xk@KLSB|x>j*{%74<&e$uk|%>@mm0pD z6xLiQoGgNs$VXKMj8RatnYIwc3v{K3J!Nf6ruRb-{}{$~&ID9fB8MaPVrSz%Y}UPM z1iOX?BztLU*Ud57P;z61z}si`qSTa8rOHVYk4oB%t+xt{AIO;^J}cP zVW5nb6L}RQuXV!^9U+m?jrC=TGN-Xkr@1!!wIBIg@BoJhGR9`Jw|%$#s{G3E=r+I# zDBsbge8*MllVO+Jm`eN&ns(B+KVEF!NqWqKB#rV9)*1`qAAaM3=X$9`p}NEYg#(5M z(G%ACrW@ePM4qerb7hnF7;&_@G2CkP1j&6a2Pgw=h!nKBV`Eucp6Fe7~bL7 z;ydl4Tyd|3(` zswL%qil%G>v;dCH_}c3W!KNX*E@U3)(_2_#5~c1u9=EG$ce)C)fo$EebhNzm zpI5PDuoWB{t1z1}o=H*)|JIc!q23b4w+g_EGr3I=uMeMI*hmdUC45lHpPS4Ylx%gX zsk-i=GwI=}q~asx>W!`Xw}}1a&5V=s0V~voz`w8fOPhRV)zUjpzFpN&)Z!ASHjJeQ z9OD#@Tq=gb#1*8Z6ye5WOx{xYY^5kgv3(&>do)y-o4PKE zx#u!6kItV{Q75{0`0dC0Qv&mV2l*4>bC{JBEki@W9_bXt3LRP6&dAtT@Z3h!cQIVg?JTzshB~!y9cOtbS&5}6P$=*q7j(zQJc*E~dEndLG z1hlQ0Ht?X*PWTW-eOgB-Q>fMFxTfjQs4TlmoAZ5OkR#F(j!C%WfUM%pABQ{(3!Bx& z@D^P=azG@jV^ltR%_lHP)zxynb62|4`$E(4s}%aTB239nv-if`QT#CW%UWu4wPY3~ zYdJJZ+Lknxo!G@wAJxks$592W6D3Iam~7&W*M|J21rm=zuy0piS&h7~_Wy1Qs;X8z zjE`%W3wP@4hzp}n)|!YXf)b6N7kbDirLI?(-8#tC`Ck52wC~_$Rpu8?!fp+>W?KF| z%@Or%dw@=rgsHwP6CXj8#u+@rTwF{=$26Rs{Ku+WQKnyJv8*L}$1NPXhn8xdDs3du z^7#?it3dy7fv(E0Le^Kr;HJ@WEY-%bvPR+s)u3OU*45omKUdIs&rrO&%P_sv28A%E z<2he8drt8t^BsMT(rUSY-C{#2ysfQgthU?=^(}O+Q~|W~%@fz!at`Q*9sB*313Uis zn5y166|bC{ZR?~_9L&b4ZsmUq7@J6&)fv^~yUbx%Dv9ozdKDt+13?>=(6=T=xW!>zNYWo zZKRE%;?+8Z@U;>fEO)>U$A|&b52Pw=h-S+v( z*<*9c30R3l1UbFJ2d0jH|B@QY^+kwk$&bIPwZg7R0$AGa#CQ$>_By zQwJ9M*$arVWf%6i`ME@azq*tUZaRL!ecr!apW}6HEqKq$^RA0F#rcf}t3%Ybbl-T^ z!5v0GY=_o0T9JuM4p%}naT?$8b}Ad$+H16rCr_k<7WD(t9aiK543S{__uQSBr+irQLAO^+$lTPT695u$0F?1QUTg>K1N6m#%tQoeqW4Sx)C1+}Q2 z=qMm_h*`^uGt*=xci?~BsE5m?<)Bw-6mjH^k($cS z=!t#%z?=&4wnV7nEBD#`Ps{OXsl6T^r>D7N=vRBZcCaqg!AnFhd{oKr9ra486(&}; za;tyE?rHxl*A1>_pI34acX~}SKlm3dLq>x5x8V}Mp;3@m%&v{c_%;g-q8{R9k8j#6 zvnn6vKomoYs~1BA1qkRC5?(2=OC=mzf6J%;h_T!z2C9Xt=a{Mqq2GE}#ZGDFGs;9n$+pHD-*t`+mBl&&MkW#9>; zu+5FS@yJB`*36-|hw!s!r%5?~?lODH^6_lDZP7&4LZIBWjbOq8l-eCY&uC_4jV>l? z{KyHcz!Hl9xSS>vX+8ZDYb+9pOCeMjKLHWD4(W*@qbaIn$>e>*E zUZS>PP{cB2)&)-^Ok?lYZbI`DgIVJ+sfOhO42aVG@1|4Hu+|#qYF07NqUW1i=tazz z{QG5+j!)kDkM|#LV#Vqf3~Cz9Kdm34rx_l%{WXjWonr=I-|$L!&0vX+(-UAVElnQd zz#}#VtMDqz`JREXSK~PJeUzv<__tbO)$euw^fQR((7Aq@*KR+}|B&XEB|A#^XfM7T zT+}nTSd>>#vM#P^U_EeS(WEHXInn5b`zpU6lEqtSI;VOpJr zv~ny8*qB106^h>PV-qyYlCbs{+NOcm4y)vInF97O&Qh5I9`7kUy&$9Za*reue|~fo zHC?O6$d|UMRk*EvY+}EuS1VD_vs^CloKU*eh|lqhc2I!kl)_K0B;wHuIu2NW8FoCQ zJ@JeHI{n>NA3Ffoy-8$SIousO`KmNnhgT&P_T=6vjjQS<_jC7vAib9R+NIxC$BRJ> zQcn8T8-(LDtvC3iw_`xpFyInapw8<6bE3NB>rpMovR zw3WinX%L&2(A}L`wvIl!BQzbpe3q+DTs6ad4GSFOF8{U^-43>NE5-gU!Qy|)%G{cx z-zJ-u3ev&kTq~CGAk-RQn*KV{*DE=@O;&43E=Q?E0?Cw(4`Pp>Xe%k_B1c< zt#&)O&j8pRn~0uTFY8)t^R-67cM7ual!eCb>(o|PG_}V$e_{wLBgDdS-NHK2{?@pH z0}{RadBEBL2PvIhC6PDY5>Pg{L7cuPLjg>x{}`U-4lp{^lWPIDIk5o& zTfPybJ{W1ZnzzeDKVxfn0Kzd{GA>^fo+H~!S1cVXV{?%KK%UQheAgzfmBmoH_9#!q zJ+l{YIwY`NNK_d}lJ8zO9GTB4$k~M3{Y`c=KWAs}@^#Ownu6Zd?PxvN&&0Wruo_#- z?zbbn-OrKU^LDzd(*6^yi)X6GWYPWslBl)oWlOraz6)1rqs1mQB za`EcbSCMM*(yzbtwkb!hYM{y*Yu)NsoYGb0UDo+y5!25@_Cd9}D`h=TIDruJY)^6J z!73Hs0T9|BW5X?R_q2o7n#r)4Ks)yxm|cfZ;U6igDcAO%jlHhME`_?AYr8icmyX4N zVvb>9V1j&DzHb4o)N)GCrfK;j4BbzI^-to$QZc)^b`p&2jUDy5CT_ zNacwv_(14AJ=-|Xtf+P#5JPOPUZO6bQb7Bx{k(I-;o46vD$sz}<#uMUrn(s=!PzJO?~H2NIROkm3w2OX2xp4GUK1!ffZ>nZB}iW)k$M}V@Zw0U|HiWy9@ZRc^UP&I4RLkxE0bi zYMTb2;aFQ`{*TIS+qp18mv45_kmfSyfna#1G;wo5f2Y+rq;(!DLB-<9v$7Iz*jN}0 zB9+83vVgHm_@LVcu_CF6$>ZE?!RS?gG-s&C0?85MjMsa+ z=c&pvP^YuRXI9&%mBrDUiI7+4GGeBfxMzCb)@6;`t^4${-0^{xmG%9`=X#4cbv57* zeQ^g^y;1lavn{+Bf)mdy@0*~;+qF1Q`La7z;hFCVvT;j`o`Yj4o%-$4%fyeGEg6a$ zshG1;NMm%i|8a+oshP>{1WB#ut7gk!CJhRhGdtwS^H%-1eth^WJ%mY5!ZE0IAX(RK zQZcz`oVd>LH(Y?>I3F{>B*M=xCgjO-3J+^c{7m?Nf0N${YV?p7-FH zCKhMs^)o+vz&%Rv(Vp0{(Ld{H@R_Yt%)EH*z|?(LdS>#BnBlKB)SJ~)FAh=;A%EcQ zvX?!0zA6MK^h*?P^y1Ju{7uVy|3aukYFC|8MhG`|e5{!p`L#4Z7QBR~Oxl@5_8BkC~ovU^yo~U3Oj9 zw4a$@D*m-ZxSThouv@t4xb7DJ@wz|nWPLBF7@wX#vlj5pF9)%`dqr0I9 z2z)Gk;X1(Yh+h%Co|fT|v3c4)|Hm3|Tik_f>3V|`_6LQJ1rLIk<8>q1$ zZ`3^_gF6m?(@lMdfZoeuLN%Ekv4@ib!p(zPWF^0M)7QyQ-RkzWA9aunI!=qA%i*Ee z@mK+`4<7$zuy6a1wBhe-^sXWRGrby^B{WnjcN$FEm%-`k`C5$^4S?YD!Vz!B6WJ+m;vBXt~p0_KgN#YTIJXY%lrqy4`Ozlh(U5#5DyAy4pDu?qAdU%O zj!`Inx#iQ9%8y11YYDN9e2G%gQmcRA=`e9QZQ%dg7E$Mg}_s-#t_`e90R zC1MPq2AE3yFwIQVR)8~wqX2c$CF6}*dI6|psADd*g|%P~mxCSQlKp-qAF9?~YW$m= zLH}=L5#r&bu$I{L(UGzW>=ME<^mNR@5>l2vE*k`&+AIzMG$11YvIy zE)Awh17TCSfKNESgAaR6_`nZc>#(7MknaBvY3aCt-8AtxoG_Y2!Db&_My~H<{lBN* zIc(s?YO+WOe$*$8NXL=)bzJRPhLJzFpO4d$=twj%c3(q1Px4}X?+I~<7Nsd1 zf8stM)+_*?cxu8QQ~W;;-lO2@TeOfK7tSC>$(M*dE={3r-so`g7-0d{CH95pyyQX8 z5iq}TMR|kFIZfW@ zSpY&oz6uw;SbYo$istrU8m^C#pcLlxPmCj!3yfkJ+SZZo{hv?&GiGj6UNf zK{1a)2WgY5!7JL)v`nN=g;cx!iNc@kQ0vsu_XO#0MX35CRN0Dg@Jzsdw1{Cs^s`hZ zq5}GhMJsjAAWf~ehSU^7lx{aHHc9meKS6X)ZTjcJhRAuV;;Ml0t}Nvo-U zspCGG0{9f7(Y;LLrbsi&WB2N@jxN2wXW@{pHJU^8MAc!d;3Q zwjc-uvr+X%EJdO#PdCOWVx8R3C9+PixG0)&Hci#YEsKIR`mm_&jQmKI=wk0l7)42# zkqeUmS`f0%iZzCyOIU~ZmL>}GNMA^55u$2{u{kj+|Iq5ZO zc+G59hvhYtjyY@q^jQm!kT$#~6}tO*x^0%$oE5mwA5_g6Awj9<{5tje3Gh$f{#}O3 z&n*%oWP{dV3e^&v9}_}_A3!FN#|~dzII|Z*?9}JLxU}$VN(5uZ4*ZytSsY5QG~X9< zxRoh#&_$I8>a*04&e=A+9ex@uaQ4W4`UkNWJb-eSkNiQzELw0JVnNA+P(p}#n>Aa^ z72lAQ5?%T@A2{jInpN>%j#7~|yd@g0pD-sklyTUtd$=#_H!g$1@d+UY6;U6vFj*m! zgnxmQjz~4a4L`!?(ancQx|#4L>yaU1EQX$NIs~he;7-be$Q{=&LLqM9hkxRc4w50B ztbyg-9YMgeRvuxD0J6lfLuh&civ&}tlcp!B(4X*iDV=dAF;=#~HX&s(X55fF%#WC3 z6P(`K;8e+8^A6LN@VH|yw6Dk7~LujT>NE4E;+ zoN=uY+-5!DE_0wsYzBn%h__@*NK?4_WOq=(|w)asYe{BLGH1fX)$*ZvIgXtJ8AR0 znPg)%r3QlOl$jHMsVsa$bR%l+BWzrwrfcdmCJ(IxjpwP;(-dkTlxEn*tNSxXIe(A< z59Tt!2&Ninbyzzxj+m`8AsJriCeX%TRwg_#$qAxt1@V9l-5Dcy1pk>hIss)wrV-Ny zAx&0doZ%k=%0gx_A{MYaVERm7A7jkv#_y!qqfC&Jd#V2#qaR6E*NuPB5U0x~AKH%e zjebZm{DrsnWV!HUZJQio7b*|7CGRHx!9@hE_m5aDl^j*mm_=ZYkL!R1VE(W;$&mvW zDMgi0!p5wVKN3E|(2gnz_>X~TBttchlaeP}dLYi+yTCGvDQE_;qxjL1SKN9P2MFt&JZqmdKT@ z0&}GV%l<+<88-A*2ZXNiv0q~>e6`FPAwRvcBR@o--UbVU(5L#lhYfY{coHjIN9Ji> z(JIP;0DWtNFrR6FMxw}(6f;!|7PwKhaLIB@W*4De} z9oR;6J~RM@f0;ZPGc1{e3eKWWA&C1XAAX`X%M%7xUk3$ivRpgRKRb~%>cLW`P>Z}< z3xzpjPw807?v89;BTnt$o}S1VLuesAxU6aUiRUhCTbm&Z%!G?im>W17X~Fda$ovy< zbcGqsH*GX>K}3$PBb&1ieQ(d4B0?`@2w-SsszcqAH-#&XFtJTL5rx5&DLiA*U?l(H z{7H%5kp4QfLm_gtHMRD2phPwtaJsZMJ{EUpWgYhnJI=p;s*BqD7m*R-f$k|BT5=Ls z&th~r`>60N@9w!c5?Y-Z6MTHUngNNEo0$U}mQM%x&D_R_or`Z4w%2)vCH`V?D~##v z8!CbVEfgZ;WM2DM-q;wpTxei#?Dj)}fCoJ{Pt+*3FJI{LQr?&sP|wJPYG8&z+`!^Q zlv1G>P$%;Lq0jGvcoMqx@W zCN#^53p^egN+D!St#4`UNC`MH5(_H{9Ts}6#KI&C?0{ONlMS{#?US~RV`KvK7YOp?Bby*14X>>U#|Jzn^rlMBh zUG;bniU;lOV3zs=I>TiIb}xfq)nAL8j?)0OS4Kc za;)cN-kaWiw&-}Kj9GYaMryygUUZ3WjTC1Nm%6_9w%_xEBc{HpWuBk~9o?bw(|h`Z2iJ94J>j#0@PZq@Sgv8- z$KQ98BEi13!LzCB=A^mmx}v_p+tkEwM21=Yrmr0w!`-f4U(+oLZO}-sb5>@BhySd! z+-FjDw0+p#%kB+MO^H(B2dKd`MJF597_|RQp{YD8j8lM&I|l>1!ja?>MX`P#-*YqMaD$RDGr~)@=(e=ao1DfsHYc9#r{G zUlI7ns09*Q8P9axsV#Fwo%lCFV=>eN>C+D(QtI>!K`V?8H6E^DF|2Cf2IO9^oA1q$ z!MF3{*4Muh9`9eROZ@H*{3Y4r>W_Z}Xmw@ww5rl*TX@XRPKPv}9~g?X)kUAckbTSk z@|SmS;x6{C<17ZRHQs;w;y-`2@!4nS377JkXCR9c27vy*7JXr$^F5+z{}KB?8~FcI z1inDhVDMSP{X_`V0>#qC)mG`>q0;il*T2LCG@R|QCM5L8ghs}LQyRPCmkSGxMj4(W zWvhH1puMdO`A4oOWTdndaDNay`jl7?H7LLD*rJe{FI)6FbhI%LfjwxgdpUjXNColI zeAuu(>(zyf?Y{W(-`ucdP<4#0`h2UZ@ape=>9qMUVx>qq+|?i*8b>emXi{pEme$%M z(a^j`ZNSY)e*IZvCDkT{===~N!98HWo)Zg(dEKS`8n+_$i;3$w)KIOk>u2LV-elos z2C#D0Zp`hNwLCpLyJ_&aZ8bZIiM>DD*l5umiz?~JxTMt0%PSTw9iAK+oBd6OZi_a; zGOowEQsPu$Nl9G7e1FH0*f|9cF2Mn$w}&0a>mx>S%79STb^pXXQ?{Nhz7qA z=E0F!H68qm;TiJ^+~79@x|?^wCcD3gJQPMrUr~?)I8|2uc}JqTd)Y^239+Gi&-UwM zUxN8ScdGY_{@r~kilR9=4a5pjtDM8sKDu~iNZG%<#*MB~G)`iuq}?=iB@=U!Ge-A?f?P2h2c6EoIV8kOaXnPI ztBym(??a7Dzn;N_`FULtPE?!w-{WB3ZbfkuSVW=90|zNNJ>3;0 zI*Jo`i(ja==1<_M;|&;1W~l7>VJ=j6+??}25920Q>5^3{=KE;QKTZh=N&DiS|B~wh zgU8v)J|_Q3DN>X=6hd{%`IYZM3_Ckt?Dbv8otf9#i}RO2PykCO<_s&?qmX2q^*dmnRP`OFi~Chy2ym73iO6 zHQT3JtiK;Nq@nlw1J?9M;*VH)D@358kyiTcbP=r5k?!aW7C=Eap(JiHAe*8b>x?$>?f7&N}^AH}x(q)zVQ@!et|K}`zXX*iVwGnA0?x~Y|{ zf?ezqM*)F=ji)E$2nNu;T0xQiH3oQxrCO(eVPG6dVg=g1pIyon(YyymNRFf2+&>B8 zx=ZfxFj?R)*Z2eq>5Ru-Gx7PlfBz=er)q{kp52zGA5MOLH|N{B(&M;947&>)=VWZ= z=fnXEg&cSWib7+9f9cwQ(KOIoFKEQNvL#v8e-C``A0Iml5vgz?vdp@7L&O&ibL-<| zuWQIIKhEY<@XZdV<_DSVb$2U-f|h&vlfczrHaDJ)wZV6Xip%sm`8w#4YT#AUPJvOO zZ@o{&$y%8_j!aFI2v3gJKL&+|mZSHTj8>53tSk!Ec+=KPD5(^|3hqH)3y>k1SI-}F z&rF$z_PnjB@n{d6O^HX7W&+u6{1@}5CYrrx!wsJ)x_Y+NCqZDnd3cCcDlKy@f_u*}!?gs? zMhx7v<92hnF=xm2Rbqwyltr3vefp6I!zip2F1PFUGQf-j(6MU~VnzX=yJa0{K*}XQ z6r{)ix*e1-<+!!KH8Ka~WIA$4!!U-o$&DBZSPI5LSPc<@pc}% zjT%B5@cZn?3-x>TYS>#+0}lPZzt2zPSbKkpngXQb?o{#s- zfWo3@xm~^ca4Lo6^StIA*x_9r^*-y@4i_l?!sjjS7a+PI9~c6a%E5h8JWANvMEmJZvuTSH2rH?;VS z-Vbv;usiOLt$P=7+h(ulYcZi=GtD^Nj?WLF41A}|0C&A4gMfdP7cAOAdkflmdy4@{ z)p9vJXYKF3P%AnovaPffm=h7xCu%q)1MQxQJR8Qxr!^hdl0JEr3>!w(R7}K?ver_p#6ZWW<(zMKz1ai3yLG?_s6GT^j$4+@dI2{m* zI3wiKPH}+xIxj~;m&9FFnjtmFSpD(C0`~#W@F>2D&rr@{NaK6)q8~|l{H-(djP2s!43`(vdZ*}~AdRo8SPMwJ*HNCFlI53}6 z#7rSQF^g z@)+2{2l`nsTd}eE9r-;tw-(O0xe)S*WOG!DLEy8xn0W$3w|!fuG`nGDvr@J5U^He5 zs8a*uUb7&lQm43YNZgPF{DPDLyif$IJ)yaxzRnQ0?v&VsW=os+z_jj$ zpp^`yyUDlkK;kCmsQO@0YP&B1cpbIWcc^U}H&=e3j2~Ygn&zKp?LDl*APT@!De!m) zZ`f2>D%azkcrEQLzX%#(ec+`;8^BSAve>HFdr3CM%3=l4)_i|F<@L-$r8Vbw<(4x07og4YgalG;6Dt(5%m^l;)&YUs?A{%2J&iQk!fw z=R$8t%N^lBH|c80C)UUxrlFcYS&mM-eMwYz*Xy{RkLzgPO$(`#Je*LI(IideE?kUH zEtk*9nY(Dx)9`V$$QRSnj#iv)`#s4f1l^JnMCR#wh!H`^T?vCMw|AD1cMT=l&{I)$ zC^wODaJ(azTW%yN{h4VC2N294xLL?W3S?=_5n(ZQYeIzTFNThX$w5aWi9v3Z0i-Tja^fN*AW}{x1}MXvag9)pxK_e|Ghy5QabX6B=YQf4h!m#>^B>6i<+i zG(0_^h-DwyRhNsNRGTvc^2vZsbgw=ii@p4E^b``lr!%75G;WyjK9W|Ab|Co}mj-PC zpC4FSe*@l|3mU&47sM#KQO~?zI;#4_`Y!&axE)RrdhwjstEM~0G?AszJkYMi#H3WM zr70Y#+8H^(x6}=H%+=gYeE#Y1FvIXqBO;RupV-(~dDAR-RrArQOyUq?w`hC=*f*(_ z?Bvr=s?<+BR1(YS<P;XV9wbcmx-Lm+>oPSkATa~G*Wpy0AvR*`@Wsg$2f`Q?LMHE4^Xc7YU z=8fjYue8B#zk$03&>W==pDXCl&f;i-OXoq$)yw(y8Xbokj2B!WXWN#bHT=wPNy@fcP{2;mr^P>P~ked ziaKAOB4ak@(pyz9n6ap#OZ&^gr&-_er0^8)jpz-^C9%N&@KBugbR{)~_$dT|fN#yY z`it)jusUuAq-PuXq*-uz+KR22?JSa|zF%sS@1U#DEt*z(`Mm(L0P}vHSxV5lSK8h;ER1k&A_uM>IO95!+WK6fO5&(&{dAf+utnHYu>Lk?+z~j|H2g*FJH$bGV zhfIO5qsXLSAz@h0&Lx)X&(u2>6IXz)oK9$M@K~9j3&zA(xMA@ckXwI<=fy~Fi=m?jHYnN++42r zbir!b-B>%=q@JK3onRb|f5v!WU+|PSo{wL_Jxy0#*3=uU{5|}XnL0N3hJVK+$-1~m z$75a%!`)1!(9$gDc3oLSxGJl^B+QkoXJDS0kWwIF)@({Kq5QVicuuprDVtoei9Fx0 z@a=iC?vwf07NrKialv{3Oi&q@YsYlU8<{`@qbmH@yy6G6zkKiJA zG(jy5!7{%1;b|fREWKO$t%!Li@#O5DX!0K5!JA!V@-GtDL_x$tL!>}aLtQ~t zQ=!P1e8}C2Z))jy^pGoalO_hIJgT8SvVz09Y|g~w%#!eJ;%7_)C^y7hs9TQFdxBjU zj?LMFRDnRbEpmNsG`GlRsEX<)lPV@6p$kBdsG4w|-ekZeP5Q{Yd<#{_lBwLkDLH*y zeN&}#i>G~C%0N+U>?JHr5+qfWp)`F0vP@16p~_V<*wkLSvLkPnCMK*dv3Y{;Lrmq* zQ!c2RVihZmN)Ow>JkA4g+jyn4bmi5nRp|X3;QlW6`bch)P4b27YE|nzIJ~THs zvtmSwXA<{>D*E6-e;@iPXs`e_{W!W95R{kTVPR>%@qB8%J!b^~#q=yaMg&qu+w`fNiR(TSha#6PyynzC#kItq#?pT~3KRBEXqUe_lSjiPVwzqU$4 zOB0u==Z-pOOYDP{+RE1^R>=qhUX7MWiL<~puG%5h{nOwzz5@U3`8q58?h5D91LH(+ zeDc;2cD#&Q{7$dzzHV{MULl*6I4l^XWGwwKWtuHyV7!CZlN6KI30#xnHXXf`Efte8 z7mLW*{z}OFf2tBBJQw|3*A%BG1j*JA7JoZIxJLX2!wor|&+OXZ-ylBq49yvqc}g2N z!F)Wb0CjpSc(~3M*mxpeTwm$h66aZu35#Vpu5I33y27uW5>n+jiG-tY0>woeW zt-KJpy2L41k80c)V~1=Pc6`B4w^yTRk&pQ6US9bR-w(kxn#(b{;wP^d8o!@lZ;E-? z7Z#8jkqu`{Fg!0VMWfi;F5po8yJTs z(4z*2CZL!%j3O90tUvTEKs21}UKg`G)UZT1pDJ28#A1mX4%1jRx+xe3i6C^Kh* z;vHCI4F}-oyMo%4&A>i^iEhp2g(3;MD9KeeC7hrj(GDp~B8&cB)SVl6sAU(Wl1M)) z&K=-?QCdfI^p_pv0cxk0_UQ< z4!D*XUbmGUhT9y!mFmP|JZvRA4m{$O)|{Xy^|Ba!a6xh1--u<<ch!qczWI!*&59(=`<`~j+uzR%iyb*nJ-IM@!3zi-Vc%WE}uJp zP@#)4R)JtDW>ltu4fLQBth39u90c8wn4iS~yo`wY0`u`0NNSdINZ_1xSAaTZMsGjv z*QObm+`Tr+qN%QFy5?m;YH)~;*#2q0LKYD8*aqp7efIqmR2{T@mWSSu#q!`8{=q}0 zFe~+}2o+KL0Lo%iXR1MdaG7$hS+=L63J5Wiq|M$-{Hd4j3*i)XB9$*uLxk!F{geDB z$l|^*_l-y1o#HEJ7+A-v4zG+^wPm&i(%rg3du+=aMQA~*Bpw_?zC(R_0%6)6^Zy?oMq)aKXF&U@e%lKLBjzQ=n zAel|&Zn1c~l3dBzQx`&*M#3ZXLLPv#ObQE3)1082G|4G81mK6-60EAoQAIl9&n;A# z=C2`OX$EYb%l3t05|xkiBR$RGDKa77m=Uk?iM;ld#3E{L^w|& zn?-d$LjIEl82#bNn2dsMqGM?(RDQ4BRmzQ$JM9PoJkL>rmW6b>E+``~;ViG@1lI=6 z%&f8{XEefk)W{24#O_G1p+abn~Bqi_uM^p$?i@72i*}77-q_AEOUEIQMvAKP5B| zE+H3q&)|B0z;YtX>$9LK1|YUZ&Lv6r_`v6c0Gob5{hzR}>oeWRmpSUu37k-s4+?`Y zd-D6tSP;BYI_-*-AW2jG96`ckY@c25Ukim zzXe_ToKTNr6#nV_JbE?^EQ9cdJ+!QqL5SCASI1{azSd}><1wEWb~b;f8>nDB3GgkM zF8Tew#RZ#!`sT&NE2S8Oth_8vja9f=1I&3+5fklFqd3!Hz&EkU8fW2cJcdI?^(ol7E#f2ih%F`6jbyf(wbMT( zGo^JW--{A8NWucOi4q|~!sJGb2$kia#u%Oxpy5Xxo73IOz<%7c9IW5<1*HA14G z=l-F-7zVL5LOccvFKP;ce;FYhH#CYZ?atA(i+#Up+Ar(Ics}xZT}!dg1-!V0WnjH}@buBeJ^Z_R5#?nVK*S<`-SR$*umH1F z9LSkKJ$=i5jKCBFhVbwZ0X-I1(%a~n9Pwdq2i%7M5)i2Py@)J(z+vdF=cYpMSfV_0 zI;3!b2`AS5kiO|=T0ZPPCw3ISBw`rQi#{WB+^0S#ygybhD15L(;42Vo5ZUfA<0vpo zDM&*y69eTQPp1D+010oy>GnD&eA~cCEd`Xv(1i>DJ(P1~Q(uY}kwW09O$ZYg!qESK zR(?O=fblmHP|$I>ge@!=;=T!znAgWOCgpKd#%F{u>$X81sL!?fDlW2+K`5lU_ujDa zW+Eqg%;fNN>q=0s4Z z*geuB^*~YEhLseVQm5B+$Q3rrtsD{X$J22w4%IL6darOGU0o3?Pkk z@^g3Cu@(XbrW%jjut%nYFW39Jn-$J{b!QI;03ayV0xT`$o5D!l60=E1D%RDZZ%IFx`5!cI7d>vt+1B^C#FB($OJ`~ z>5CQw${7U-My6;M+;nt73=df*P{4t2tG3sZTY}v#8!?0y2!>AIeN*h*j1+r!Vhc{? zhyxIQ$Pu$^Q9jtohuj_!V~j&;WFS8*hUHEozgtEh=93$ou3zB+J9Yy%8?(|^+Umv4 zd@{iqKac>r#_U}T2f2|xgK9u|O)=!T-eP*v&H@{Qbaw|zs`N`RnHSym_*ebTn~l5m zAa8fggvCHC6W|2xLYmUqPcJKPF)0M=~f_LUUB?x1>40gvJ+j(3nmZtWJ0fRgK~zaApik$n)0zoMUp64#zxNMgi}xC3JyhBx3!AzlZ!7CN#A zzy-%{z6ycIzqrB1E&9{0o!^yozQV%Hedhf56nF5I(5H)o*kO~eq4ts=g8?S`1nbHb zD&5**RaP-0suuGLgCd9AyrpJGRD!Su#@BNgk7QslIyYg@fx=lvzt{=T<(y|UY1*$N zJA&yDzQqN68Np*P1Ze_%5o!a#*thH?CuR(J)G=yS(ebp=3F@_qrk&2Vo=)oKjPK@r z{q0TT<8b@s|fcSsdvYOMGRB)3XarkyZ_fHCw|FG9lpM+mt zNeAC%K}R&TJvAWT2m{{bUH>c13+MlkwfrxoEI)D>7G7RB=>Jp6q7&a|Ilu@TdgBX? zw;@!wp(CX44C|=Qk$MG$t2G82WsQ0g-;#G30#9Bm@bxYCk=pGlhZh3-7E^e^G=MqE zLhoP_#<+_ro&)!~d%wN3F~v?rXWv7IbrL&VmI?mY5iWHM2Oq}^@2>oo^4l>V3O;W| z_sv)449BbpR=T!!sZU zKzQwTcr5gojV2fvtFU`RTmJ|X{E8UxJeIvV8jyI0_3M43u9TXx@d&wdS@~gEfn02X z@Q5+&_-f|FJQe=3BDmQ)!_(dVnZ$P6q5bE-_O5u;{MhE8=w=HT>yxew`Ow1$n*aRH^BP7UhA4*I>gwdh)s5V8o{}k@z1p6Wz$} zj6v`80O7u>`ERc8@!PX@;y!}_zO04`7}r=s7pk8xlv*;zzl&rRfMN8$o)V8Ly*-ke zUUI@_>^Op4NmPwEd26*BTuY$Jr*5YQZnO=+i+$KJZw%>DZ~8dXJwS%$!B#-Z5@9_$ zMG$RCTLPdP%Xw5p#0h2SL%xH3u}f7Hx-^Su!_5deypid9f@k6iy6Q9qH5HeY%FWE! z6N#rZnU8>x;lmsv>Q&+#+mIKbr5c^tLr&#(6<;AB%WwL&{NThsf8n-{wg&k{{Tm`& z^v!m71X_J*N$11+F|*Jm@ysHwR#Q2XOCt%k3A5K81Y=Is*X(IYDVxw+PlZFHg=cw%4nR+ndT~wRsG!1x2OABxIC*j3JH567`=vC{c5k zi_{AFppKid>$X(MTX@I~co!=*`YvG@IGqpJ?Lx@xOZ09dOR*@%@2l*M9rlK0CD zaD#(sTUr+2SDl1y8?R1bs2U1|y`Kx50}$Ho-$Gv!be)xuc4vBzeL0$sxaK9LcB9 zHR_V;$iWyfPe8iYc;OwK!IxU5EmIj|ab3(2iTu~)|YkfyecTW3|=N~XBYbpcxPGUcL21}KT;Yr@Xo&t*)~4_xW7TM$ z(itM&MCA11$@Ox2`5eb-&iw(7GZfWk0G(C9eA54x3HAhbiA4@-tUg)tbfra3?hNxb zyLbq7kqk_Szs_@|=mN>UH$B;(cXm6rMC&mxNUyBHCdB`ql$CrAJje?6tgpY^MqG-H zw>2nSB~+esntLl7HsXbwxW?oV?VIN7X1KbA$CQ0`dzZB!*wo@KuLe?NEfO2_BrW|Y z6Br+|&^k{J1tD2(_Z*y=gD+M#a#qX3?L#?XjD>l5wY3DPP?qT&kHaC`J{n`A#T}P% zXWdrUhZG?=E)|pbTx;#paT*3caU`bkmZbXjf7#Q=Ui`Z`WY1;z0 zQwGO^WR^$fh`j-zz@9f6QtErtNcqxAyh_|`an$U9<@GnPY6zd@f(zb#|JP0O0IBLa zk4`(XT834O6WoU8FsYZ6Wz5OU&$5Kjhf97h7;wA$=%`)3NZ0HIt0ISY^Z zh$P&MJmQ>pP!E~nF_df`@3O(o43+Scs#Y5PJd&!_ zm*n#3-6mHBcoqc$aZcz%6UMo{T{^?;?pOq!vBkCk*X595udY$zTn?8mcO))qu?ZwyhsxjSOfURf@k-F+@iS7zv4dH;MFxj~Rw@=6)N8xpGr< zuxdEbeNgNsCp2YK_Xr1T5>sM-1@+RKg_Bne%aQ{uw)$tlv?)sfDyn$pDP)&RHnAfs?7B$d&^iq3ee{ZTM-388dkt%$ zWDU5IjoQ2=yH?rhXn$wtSbH67^)qt@ML62_F%OWMy)gtsx3t`}s1yD*S0`@@+*;ay-f>q0L1RpP~%WAMA*u#cN; zZ8AkF7!@}wkT^Y<)E!R=Gs)kZe6LbsHrfKGM2l%FNMh`&)9LBnAV!bFF>WH06Rk>Kh=w{b)u!UuMk+>sP!Bz#@s|ZX zw^AAvSz%Pz*c;PHP%a<>v9_;E5IC4oL7=L!HMn&kV=d$*8&Q}L7!9&}$a*gcID=Ue zn#P4yS}%;Vc5daAt1T>-2iJ{(I&ZEJ2aQ#W9vK|{ zw-T7O=kTv%k4@&+TkT=vmR5#bUJxSrbE+S_nJ+x4G+lZ-6P%GE$s<5;W`MI~gK;a0 zDj2E?)`^8Yf;ZrdN_s|!mmH%6U0U;P5>=K(CNFoqx?Y8Ro?!k)0NL_`^^=z&?@!#r zy~GL&$Stn!TL+Noj}Bi`kGdBqEr)vYte9%H6I>CLyhND8^}7^jy61^$&$0Jok?v& z8jJ2|@f7lQh^EH>GU4_xk=LkE_xJh5`=hct9-V2E37Z4=mVfA2c4P;76*C$)1nzcmBU&Z zwqOB8O1{rSGySJY8s%WFCC1Np1Cl9)=?6Wcdfa|yBk6Ims5k491fsMSw@!^Rib13! zJV8<%FH>Ku4JV+h2c=3!6V)f#6Kk@U+yoMqQBv<@Jt9Gii3 zODAa*Jl+rGSn5Cun#C5i5LKRwQntNi`G^MIB8#>nr^NUf&ssKNyTMW^uM<|Nh7uo( zOOy#F!om6*7K=*l_8S&_1X7CYYVqoDEi0<3sy6ZEs>A8F_|9Lt+Gy)~JIh>6_W=;- zY94|ixbR^})d-(3@2F1E9|@g%)m)-qz0h(eOa^rS3OiDoV63bFxo;NpeRurCe*6H| z96oyhUG6+A0;x@Vv|DL(TF3zsLlRmz1`3D`L4}B%Twy42)!Jzq;+)9xO6dV z-EoJnmtu~uJ7MD<^ZVa<-k= zF9jR6^_3}c$T+c$XO|bZx1#Oj&@l5dC1gW*WmR_5&>&^_jovp?aiwX8em1XXdh7fc zCFpNK%C7F5KVs%;ywG?fQD{6gf%vG5;@PB_1qHQN&VkwxJ(&CD;CM|G6f9(`BKH!x$G`3ga02a+ z+3l8v?P1~qx&AE==-8!h#k1`Va)fE#1g*kUS@q?SfFcM0aE6N=32?@=X6;#W!bgyD zeQ33UKSRyzm-*-i!zLGl0pDWHBjN{D-TraMOXdfG?PJ73a0}(b`SO0<*{!gbe)W9? zoD!jVGUdYel)Tm4GRS{b-Ga4(=#u8ed4OtjPH-B2(M0#=2&RemZw%ZJLb$F50m5e? zOUES6h0l52Lr9YlUN_HuS zEne9_qA`{2g1_lLz>E0d7YhJlyJ3e#j80$c8PJRA&`pi7l64fnzTtO*%)*1b!@!ln zRSL$7+lfDL2ZeyF1#NEz5_*X27Alx@NdWZAp%sMaPxo9UHm?Zo5k-lBd1>xbX6$@7 z7?S)UEEvY;0D>ot25X{j$}wiLp+@#2jR(?p_4arM!xJS*#d$?? zDSAqloN+#pKU3^G+-~92-OmBMo&iZ4p}`yJ0)o> zc)Fsy>0u!|g6*PIFgFJC-E+=8m!{6u%(%^Dr#?<5H}?8(pK6h=_B0Q_VC*?0U14)W z^9;R_d_|On~V(0g3|_-?<|<2J?WLN)V2z_ zi{9GLJIXm0!KX@ZyKfi0^tgIHK44fFoen0yGX7?e?4=O`tsuq`diST0yy!;r*mu1Y z4*iCmK?XUePobr-k^r$Z#aR<@O_)$f$|HA6ta02XAl?zA`wZ@k1>pQmdB~Pho2Oon zzEeCe?6|dj@$d}hmD@pL4b)|Xg6elP$eAU34OTFysnvsol7s3&^(E^h>kMO}Jr~YO zCo+wab;xOz!9}@2*F(}%uu=K_*HfcP=|)+vCRg zu8-t)>Yrbc*fit{wCx_!D=i(e(yhXyP~(ZsECs7#qq1lCrZ}HO?5y(V36P z90EPUTouKCXh0r#wL(>u3BR&wL!`}p2RgOJ*#$Es@;dN%qeqUa+(LW9xeYNd#e24K z2YmRy4MDYs;{s7{&-lXejFARXH$?)PZ)v`@bGa(^y0K!Cgbzg%#YM7=XP6 z;q0g zm5Uh&en2$}h`grW#?7^-{R!&=@w~nFLNE4)GgD{C4*rut&W%-#7OJp~VPN#yT^n<% zPY8gVx}|$97X{OeL0RDx_6@$*h2mYu#z*sJ@m(CKDg%4Icp91g-Xy(7u0i<*ZrRP< ziTgU%-Q+;noi^~w^9c}BD>L+as|qM5NzPWWDmlZe7Rg7RfzDqDH-joNUn*}$j5ckcXVbp?U2ONZBXPHo4U$C4+4Y&KORAR>z7FR4G_;E)Zf#s|pmJr) zPb((PDnj{L^9h%d^gB%KpcP!Tz&T~y2VkT@M@el_DJBV~%XWs0x@%)>wmdi26sI9( z)0s3QQCf%MVp_CAlv0){6T&~D5Y%klb;dxGrHPVlzeYRc2Ol<|u!7s?SFBCIsq_lu z?b6d|ma3gDb%!q-0<+AXbXTZ}WP)mx(7NSBTqGSWnN==az;hHR%21FGP%y}#&smAa zWcLl3q?R?WNEOWL4nE_g5(H)whajclkRzpbEA97zQ8g|@BqAgt z9H8!4Q@QIeLnc7pKg3r@;qp=}46T~ba1_Lr&Tcdj^fL#XDIW-8SQ#l^C4@H#}bm?Ih z$fQ_qKI4zu!OJ9YxNJ(90o6#h&+@x-=m+xEoH#I}=(ZQHhO+cqY)I?l=W z*=O(lyysl|`~z>UUe#S)Yt^di)%`aIYbNEP3)tDt5HHLx4MF}dOebt+p%D`*GcF0CW-yOi#54jW%9wd`rxAn8s*D;%7tPmf7|!W9z1XUB1+n#W`P)AQp*i?mosS)E z3PX>l#cBGO-Ew&&^@k9+cV|thq(CSfn*#{f&>x)!E#D_#qow+c^fL>wx8jvHN^KMV zbONUJ#xP`S8A0DD+!pt5E!;CCrRlT!)KA(^R%i}_Mq8#r`;~56>{*NLGFUxs=3!b! z%E^X@jI(gEJdYpGURcn2FLMWY;Fw-tPZr9!^Lc)EcNSna`I|TnFVup0TuHOMAl%CJh|+)0aB^)|qOVg_ z9CEoxfJ3>DEr}4PoB-c8px0yk=kK>oahefXDYcL$@r67_Y`7_h(#Wotp{WY%r`W4a z&W7E%%SxoFcFG)F?qIJw{`G{BX#T1luX&uJC}P{Pat({O)eIK;!SRWNLyS!0+>gUf zXf>}m;6RA%sBgA&J382rlGKAY5q;>Aq15G_F5)$6wvFpik46Q*-zqsk zYV}!FS;Z`$D;7UF-sI2x>8TILR!p8VE?uUpcV=glB#c({Bl@9Ds!}L%_$08Gw@+yX zVpEYFlHAx{32i?e`#Z{3SbLF3n$;(i@-Jc;f*6Mw1IELDk48L+iQ4U7i7lds-=xI6 zs!Tzz!1<IPMYCZSFBjJ%S>BsuquMigX_PS8~g3avj_jhRklg-K( zhQ&|XjoGW#W#sk7dhm1DomW)hy0+Mxm4?}2?P@bMxrKCplic6#e3RCB9hK@lak&Km zHt%0|%f}0AQnd27=bFkF%_pON2ot+6!DvP;YGZo+a`{=Y0TgyjV0Er?Tx>GVfP!fr zUYc-CS&?SiR>|Bs(VFp4;z8eWy|EbAc&NmyeK!`LgxZ1i;Wm4zsIBcWh|);BYB4!~ z(|KA$s$cN!E`{9IFm5wcEYkaxTMB<$`QU6L0hIH?h(|EZcg$;pnTK9m#IwK z;JcRZuW8ae#1}@i6uq1nV#4tVIO_c1?!2EboW8OkVLvSGVHc3R>=$LEe{!i91(AWHT~EamuQpW2`GSFrYtd!h+)LxEmj&sxhidUHE%D zh`_Ew6(!QlxvGaAF-NhK#pb8KZd+@MdmcPCpPayQK%JaXb0M83GBj9;YmCtR(qXcs=m#MJtJZ~d1{Jrrc&#urKbPX=t<4! z@bGH7@3$VR^xd46|I>86IKH0xu>CO@D0fH%Xa)~VnJCyj24a^B2W9B4#M8o1r^5O0 z@T9gHR#Ry)9sLjMSt6dA;%H2rKy}q~PREI;Atx?pEx>zw-(i7u`1$)u4kazG%iBg% z`%8j*FkMYe>|m#&(zq zygatS%%F)uco-GE2zp29=!1`dST=c|XK(&yAb;!|XtneSLkqP0l z&@EkWSo|JF8?Y=|i)(@`&Wwt0nMWG1# zCErV-WE~rLtdu8HefDyr?ma-9R9R7~Zg1+*n(S$_^j!OrSYCF7!~TJFLg#^{lNB^v z_t-1>&La2Bq5b3)W#(z1Abc}EJi_jv^^o9XXF?L$E>er5FjzeM{*3l(l@n0hZf^kL zF`b-rc;J(=m+xd1{y-Q$)4Mj*a66dH+l$87?zK)8MK8!}@ssvv+Es+PzIQdWBp#eZ zHqhdZh8v@W-#PprZW|bntp!fH<=M^7hTEGmBVLtzAY$a@;WY3 zM#dt|qk5FXp|pvS#X^`iQ4zOi^RmiL{a-uNkox!`JzwfnBd{^@TL*dtQ7|#IOgL4Uh`+HONy=>mqUBh* zZ6jAk7D@kD0XS81phU5GCM@(ObTX!0C!Lb%V>kUtQ;*+kNwZob)V_p}Fp*^YypAl# zq(V+9Stc$%mU;3a3^N@&Yn97MH*9ZTzG9)yeCv5IO@u3~LDIwB+6pW6{Vp(Wd5hht zdk>yv-G)lF`N^KNu`3AtK{k{{#b{;SC-I~wu%L47!(qPz{D5$KB(h5Kn#2~>F8!Nf zW%vS^LLSLNd~k|U-0xfxMFjyA6JqLxlXP`0U&O+Izh}*SC9RV?p!ug*Nv1JcKw;=- z53#wu4GzQx>$ZQmgcyQ74-!&Tj5UY0)@@%3CVM++?=lgcCtj@%&c>^ZwVT^awljNj zfRktxH(N@%_KCj3wl?Afle+JT8*`O}kzU){s^!AdLfY=aJky>WTXC;cl485<4x&cR zBo`&UrvuopL+G=N2tViwc^bS0PxKQOC!d$Tg zK(yNdChHUz5s%P35e<*DulacpNJGuKeV6j=d!JDx<;s6 z=xq^|hcqO;n#2<;A*VJtDEMK#8nQM5B0^lS7EjvwF5Kih+bJS4CS<2ay86onHjVey zJ0&frH@TYqoTbVp6Cwd|*&;hNqmgZrQd7~bA~@oJFQ>SosE$468b?{Y%eT!p@2LG2 zs5~24qEdtpHzihYu~$JR5rcn<*In_G9-yQwa-QE@j5Fh%Rvz%8Nwe(-_7U}ISUBMx9=t6kO zOW)xtgvuNh%4#+^QP7dQHpp_3*DUgCuxBIN`e@lLg>AHCxf0}MG|Ez|u-7*ZeNBfp zAVj$VTqRw|)W;+w)j#2nxa9xZIq;DcSrsPLe|T$Uj<1I*5+xSZQ{2a(J0n|OH!qNc zsahw33X(0UXSH7sx!35l089Dy0Uy@fxgdI?BU#@r z7nWKO1J$WqAoH|AhvI)$u?!AsZ0%KB;e5Carp=A(^|e2!f^ibVrlDI;dce{OuuZlk z_FdmzAvT9Iq_b6V2Si!!d?sv{ENpSXiL}H?AGtR4q&d983sSL3K2_w5@;+~GfxcaZ z`KfjR{sR&pcTU28RqvaJDvQ9kK)Q%tZL|aG1yxM`S>QM?paTwk&GwAVZ`{{pLqbmIek7M{>Hc2J3-ps4hT4d zt>H7SSt`JjoWIx!7E$G* z*f;(4dxv|0%~nfS*F2Fsei>|}a}Kyu!~uB_mHlge%e{A>nuo8wUG=;Ces2_^UvYp$ zB)KF~Oz)VhKFaiv@oz4j!GhBd)kS-JqZMDZlusYT6Z*!LNHz4)i-uoU*?KJ7@05a# zQufE}gs6FD-h6QS+vRFYWKnU&N8R%C%ek&qf>|^18UH%|Jh;Y?SGbpOA+jdm`~J|B zvB@qs@N#cG`o8&GFSV&Z;PDB^tj|Nnsjv=+EMTEI_p-@`1b}wKFkTS<_x$iR^5*{5 z23yjD_2Mr_f+HPATjfuSMU?Huf%++z8{7A1w$19=cXp2~xNFxy_NAL;?SN3(5_k4< zJ(?bwevH4K7D{l3gteKdl@rAb0*&!8fQGxN(P&1Ethxw*xpDH+i;WcRqCFC)-iv%D ztFcoi6mhhQ1>BM%?G`)g+zO7c0`Hchp9et5={ca)*Z_>Z9_c!Xx_Ti@G0F9@xizB; zk>G*7*OFJ?`sZ3#GDytI*3?p}D@!*~j3N5pTVanqh%IjSmbYr}F~)xGKmagtg5^|O zcjd@0h6v_+vS4<>#xp}IZ;Od;!{v23<9S7fx5+Z;I)0nP}PX2 ztQ5adS9;?OT&G0g@*BS?#zs5pI!;oyOC!9hCJRs=!^-pZ#GrV`sU3zWvcvE*_hjQM zySK4ZtQv!r%0Of|nyK!|?@yZOsSQZ9;~9sj&vhR@4ap19Nn<#2lj*@9M|;!;#h9*9 z;~Ta_UZpS;EOku1d*D^n)%F%WA(3Sr7MYRHkK~Na-Bay4gK#-R9aULTVY)i&ZGSbl zHwaq0Y?$U!&twnBuy@Qa8kw8S4`gzOF%E3JakuO4rWQSKsr;X)T?2f@EHC^MS}u0l zALHZ9ES#thUl3ejZsU>RZnPNK#sq)s(AF13RW3Y{wp0CmjWf!To-);kTiTn9YKe@Q z`?CQSgf#JZU^_iz&vKZq?Sv~vno@4dQ1BgZ9h_mw&NOUBy7cw7&&j&PTN2oBfW zY;HG=iU(GWxTrN;C9xZ8+|4N;9CRzdG|a0Ff9ThfzezqySRNcsyY;X2PqC$lP##FD z0&H+qpb)C+)VX(A@u^uBVKO{mSryFpk}J}k2pd^+kCm^MgUu{f{2jrn_O#_PtA2=% zR0VMSm5OJ#9C9*M?hVjfxJD;TXV$MkKCV)6ql|IFE*g3?zFo3wHcgyT515mvBos-R zDHn;vaEWNJ>a7L6UVVH`&@@U}BcTzbei*B5W(T)8&=giik2)?AJk~Sse>CrABmG6Z z)Z;cek^Wv5Tro4x6^Hc3!@~0L7NN%MSnwfOig>n5Td8&m$*pi(ZC#uZVS04|6CNSq=X3t9UBXJ&?(82CgZA`FK%Rz7%&t)8Y~#YG zeu;eobEh3xfe8dGIQv}FiI-O5*^L_yb~two7cTbeJ(J(N%2`gqNGScA33Qk%v=j)F`}i;dF{2@4Yk=Pu9T%_rwGxf&u`oRb?s!hr0MY>v!4Q3P1wGI)yf zWGv?SwMTE>E^;6HBrZ_&b$Km}jEAa&-*lO^c8-@Lbl>g4&QipIB^0~(IR;{S%4k@R zccL;g+9+j@SiMtMzi0zPb-zcI*O_4;Le_%0E~fi#(EWgV<=w`d0yam9NwFBb0&tq6F6vC zu;w3RrIRsk?fm=9bWG-xF~X`GbQ~O-iAjf;qZ@l&HNV6{56a(`mM7ER^bLU1U|GKB<1{8on@vrZO1yf`7zz@4q z(H4179;^n>{;<^J&mk1GG0wfegLM&Y%o~>)DyGzw$D#psvk`@*FK}sL4Ow0hP4cDR zhXDg_womrF19cm6+6{I2D}9M8G(lyEgepeaKz^~mVwj%CgL?~p!=Z^JySj&qtvhi$ zPAy8$I_R12J{{#mF*RWlF${}ryqy*-o=kWSefRXDcDx6Pjw9&f3+&NHaGXis=;~K4 zUxN@&2L}rGJS|8F+PD~+NHbd6zGExlI!BgzAa#ZgarO$2zQTfri7sH|k^XrT(+16< zVNjJblfJIKQ~2Q4;UQ*~6pO93tZtL_X33xTC`B|TfT1z8l$q^`>+!zdIZq+DTGH9qRt<0(1h$CEBY+$8NZ4j$hFe|aJ ztSZ}_ms_D|urRYUwX)y4V-{;HsVr$kHnwGLO~5GzQ?BVV`F zzC4g-(;7+(@2ZqQY4KuIS{hZ zjMFIWRidU={VAk(FKv0ju5GrS03%iw0h1Y(9tKGL=1o`w7=`x^yX)50??)YiE&oXD zN+fu*9DON_>JoqU=L`_vS?m2FHRQk7%ZlSdwKEmT&Sx<^k3z}&(l2%;Cp|=NTA>y(q-ZarQO^KYOVSn ziaa*}RHLm)>IHPG(EpHoXaI0n(SeDEXD9mx$U5`n?EOGN%flb`cIIpcdFT`F{Q$MX zkemA-0!tX^{xh&d1CLGvkCmBD3lER+6QN~g)581zGPDfz|K0Ro)&FkPGBEsS<)=~m z{|e?|`F{oT*rtv-LHNut4C`&EHiFw&5HnKM%BKr%dex$GBzJ>7eehmuJkM%z-u$@3 z1Ya}ooryEh>>WkX>mG^YP}y#mc2}|DOe?PMerqI3=fv3wDAX$+Q2dVj?n1PhX6 zLRp#iFD=PeH_0qe57>V{=41|k7_)KWhUw*kgAH~B^FpqhFFxuS{MK^fdKXR&r@Udegl;tw}c3| z^oK71jRh*mKu>1SVwe-qNQ9OwGPURU9_U-qa(V172^3^^l=6P~vDpFGa0US0KP3Kq z z-`dB4(6a1|cZa(k`qmt6-@QZoA@W27nH1gFGPT8PV|d=i^~VKf6Ydc>)O)Vyavr$f z2IO6dkfK)i{2;86&=q=frH zfL-I*(&vKC#CXF$H}A7)BmEG)TcKp6Q%>Elzj;Oi)RBQQ^i~7N4@$u2PLx5Ve;0<}@ zfT!kis%xYeonkd9Y|H=p%0WRZqs<7n_W1PI^V#t}3Ey7}Xt_EH7+6G%EzQ|!Lv3lL zd&M9IqFe2jD)BLK(Tj;!f<;5+tyJQKG_XOLv#upZxd%Qd}`tjIDjE;*m0xQr}G{kOPhi&|pu@7q8te{1W+^H{gQ zo>Md`BnBd!pLOUeV$|ptM&iWW3Sq5o%iN2zbKy56`VrE0ar)(CK|c(rd}|;|j%&Sr z^Q#D;w`VoXNZIK6^M08nuCM1BjZVyiB+#1JHqSr6Y*0_E7}a&;Y7$G!w5Wi#$V*ch zP)+yG7q^o9nwl5GIe}d#k&e&8T0>>wx0Y2)mvmxpbSi7_lW`&|i3d`qd&T+pePkC_S9PMt<>^aG-StxeH6{%@Z6tG;!ac`1% z$d(9k6X*ziE*hqepRLnUFxVGa;cn~zw~u2k6c{RgvQbVvciDFwHj5c-Z8fY@&!S$# zo`51%&@DH(6DyP+P3KjV=h2f01#=?6mj~Y6Jp>vZ$MQqt3{dAZB9JT=zA;q&S-KxT z9czW|sm{-72pZ0=f`_T?6bjIwfw7u>|vYyz)3DQJZw}@8%IeKOzedP})GJcmXd)h*@>X8iQ3D8#k11HjY39b2%*PJ)C=YjT z$HOr9W^{9+&Cgf4Sd7wHgD~4|1xVakrIv>`Cnq+Bq#t3Mn#x}2M4JmUMP7t>CLM8; zu8w{ySp`bahv-jBRO`aogRvxdV!<70St#p*1akI)piR(86K+G>%cq9ST$LstNmz;P zgjOTl1#AJpQ`Chxlx|8pX!-gStZwDc}2ti4YHT88EzWrj7iY=6`!u5B6RJr zCSfgpaT;ZG(CGun$vs)`a9n6%-L)KWN3$JOxib;3tQuzBZd-8Gioc@E zK!mmnE#lXc%?JTD`7JQsX5Uc*-IK5ANXlXQM?ET<#jc6$mT8R_yZ-jJogC^_g{HYN zq3JJKj+_P+1>U3hzW(44`z9uiQa%!}<$7tY=n4IC18~EE&&}R!NkqZFs~~ik^-cRfX5KsF=ST%|%NF z@dfNO3PJ)iP*XO=i!k>Oek`xdE^yb(6*A#k zRWsKQM;g7@nhQ>m#GrGhG7m?7vXRP^n`&`TqSWlf_WLE_NNlP|)yDi{Fi3B&;Z9(`4j&Slnu9 zXMg>K!9B%=SSiFDAN4ZeH6t1Z-c_(oR(6HZxE~u&)-tMHIX)QqIp0Z?7Tils6O>r> zGqOd^B{5!rGd;W=NapB3Bpc{h$Isw#;DOU*@KO-AcDMmg_`=Uq4uZAUPmb`naAdE# z%ThFiX*66zKRAcjz-7hDh`9}VeQtQdBZnI$NcGmAJGc?ZbbMWZO8J)z8(J=?53sHv zsdy6~MIl+9@K^ZMY(&fDA45CN`gtyxRDY`aoOkeEA>PAOhx_*7Ub6^932BAjF;x=y zkg5Err^C)Muc-H5XkIBvZ?__U3p^{`m~#|JDS09 z{*Z2KDafwx8{Ux8WUdWlz^~m~J~t*K#&w03hj{$q*zFEq)c($SW%=w@e-GOXrQ!wU z*zxC_N-EayH?f*94I%cv`M%K&_Dz>2I)DN|pVduz^S3?Ya;NI=);=#oaNKDTtW*br zX_RI}P5&Ikp4uOI^FW$qNH2(92u-NA>DIU9L3+2K>Jqdm#O2JOtzM1g%|Pd!s7GPy z+$a%+&I(cz#m496?yPgDy{GicK>|MV& zIOzr%%Mc_HWf3>RCegu~jxc&{|4k%;pU-oVYK{W9%8|HhD%BDCXAjw;&OL8voERNN zc+j#22|Phho`E=`Y--`OAJ)XoH8hLK+MR@+bArg6M+RMx-1_*hORc#YMqG*jXXDXn2}< z#NnvdF-d3UGDHU|x=l*=U3BV0lfXSBM5-Gw!r9(^xvRa~+M;@av_kzFj-&^60ulV8 z2mkJiauA(mKQ@Bg9%nK5cuwN^8_FY2XPCEN2bMO(FF($jl;#KtwwrYKb{l@ExsQu9 z@;Yvx@B+SBkGIL-Mz>!EAv=z1oZA=K9($fYBpS4+8Docyd|RR!@p(ubP5Ic-14hSO zOz2E6^WALTRE)^`8~6vwMHZ`#wWCeccFGltt8^DmMcRHAU*@SUva1Wl57-1OI_swBoqBwU%T?W%yAM@VOH8j_Fca(Q%@IoF0?I7b86+OaC44FpzcVBmF z5ZP4es~@OQFC~amKY25y-yTg@qP8Zv7N;cE2r@Q9w%l^J_j`&FGq|P<2aZ5VeWV0O zLc?oW=2}`E;~Xsu;Z7D)NKUgmt!g7Te7PDVD92j)Hw zcYYx*e?K*~bQF|9r`choc3|PrwNxiMH}00{uCUiiE3cuJe;=GhN+p_OHN{b=NEp=G`Ir#jEBq=)jMw9M9dLJXQrbi2Z%K#Gy*(8)IguS?XhOZN zPqq2sDz3~m1~5*M7xhjjl=0=Yk>Zk)C}~H>$I7Bnk^la+y&(|Hw1`D5I2eg-FQ$`) z747t*!Y)?`9591H%$i8djET+6j0t22o1KG~lI;7YK39RR;09_ePU>MKqE2BkboK!QBzY512fkBcV4T|L%Ai1{FiebJUP%mw-R7Wg=+1;w^Mvaq|F zbD7e>Wy;6Lk`Vj)Ey85WSfWSG*c-w8kWfjU4Z;8tm#9X{VUJGcVHMRVMwP{`Tbd_E zKI+Z~>*#a)DRY)gQgU4vQg11Yg{`ebD7kkS%BTUt0W;Wq-qk(le@x_a(u*Xe#U*9) zn1Zch439Y^G&Ca;@xgzfYFsQkEH!1VY^wf>PKnoV}Gw|nN0eCqD5=<9pY&U}7TTezKSb5xtc z<#gID0yuc(F=PoFnK5UkQ(WBXyNoNh4=2X8j(%HVf6~~!XJ06(5fCtKt!F*Yy@11XXcsi$l zfN6?zb^-`H*(J=_wPs9GjhlL<@UN-f(V~3Q8Oq=H_p~iR3XX#tZ8{$IE@79EtSn54 zv}LOst{Z!tI4ccvy=7Oe86- zjT4N_x3FkIZxz%l3tzUJgdT!7RAN0SKgaM+zaBRcT)k?ao+dgrFyeq~OEO5rU_@+; zaem)NYM6r@LCvb3UM!rS4E>}`s^BEoq!<=|1g?3R*uXFb#9>(MShPC8hJ44ae!)cg z@$_k6U`<^{v`G0O>YA^2F)p(W4XK)Wdw}}w9ZVyVVR`@Xlb(NnbcELaV`JyRL_%)= zsHldOYqN^wMxw#ly=_rQNx^6gD|>;(mUVsk+XmFnx}aJwaw3rZ=Cgx6rkA$QYb9BI zC1T(OG))8*w=mBFVzH?n-@9nHAzVHDVz*A~#U>)7_v(@{+OLNUeenKP)KXQ&hc3CMf7h8_LZvvCdk$)k>?W~vD=Da@X#K6V6i&l5 zzl3Y^xRGZs9y*U@6Yc``QgH9-iQ|x0Y9uV3w1yb}?BRz$5|Yu!h!)?<1uP+FrYMpR zyY0)`D`?l z!UGg|4?}+rgee73r;Jo0Vcq2UNGP=l*S-W!x5=AAaKldghLm;&LlT9^ySxE;(;hNm zx1YhiGI7m^&F%9drrZ7zAg6grcDop6ikn|+LqMhn!JHjsMpi`lHfL_oTAeZcRZ}~uxZI*lN~(!Rkx>gp)@1v* zkm57}t>Uihp-a5HxhN%iHcAFXKlpvnaGQ#j{8+r5a^%KKL9-08R=dH!qjk#)(0VyV z5-dXH5#iuUt^M?dyIgsaf!JY#pg9BH-o4x*eKdYVbiqCJ?&by4YTk^Ze6iUK$pZnu zzUYNBgsc)2S5g<-i_H!hd8pg;ae&*4j@})(NAXWZ-?$DSX3i#}jl>o^9$LVMV36vO z=ik&j(?T6C6P6X7In>UdS!f8S{bOGES2@RVEC(S+U-O*b9GDHUzYVS+o(|@X&cDnw zpCzNojl8l_2;IJ+T=0_SjuJy2cNDTZ%87M1Yp|f&MZWXrJX5eak!sY#9sLWEkt0lb zciP}gAHmGf?*Mo^vuM8x7={v@dKo<%%t%5iJ04}I`7q{U$(}~Pio!+LWj9)lpB0Ed z=y5Ca-xYB%?(GVf`gReg_hsz?3^-=A6~6fS9P$U#?dgH4Tu4|OQkDI$1bP62_~MR#qex1bcO5*{Gb@eZ&Hem)%^3DZHOG{B-W+&hUq{86+-Xv1 zdM;5dzjtcjNKQ}HUoTR3d%P&60WTC9q{eUjQa>C{=gN6-#m>~0w+UB`jWnUn)W&2K zTNoyhQPFlxfi_Fzs#@=R>-?N9k<;0dg6g%7s%$}6t|qtp+FEbYsEYpa?W9&8R{#gR zE?l2~nPm!N4Ei#u%uhL6W$)L4NsG;;!dB3-Y>_s~Q%mPu`KnrZZVTpst=O3D5rI1e zh9ha29e5dx`U}nAp|NovS)P>fOjLU2?Zch}SRVRA-7|*nJYo^dnO(zF@vQfX>tzI?}DMz=`-p1K+#m5fZI1}#e6 z&k04iwHNLAJ$)~2st1RNB>sV69pAiO3UZ93F!89>D`5jp%8gIuIgeB|*wE^sy(JlZ zZk4v){BJr&cBYW$4|>nJDJBZuld`akV!yNBjvl2&GpqLFWu-@^$8*msw{arO{W4AP zaaH5L?bRdG&T&7C7mEY9t-%|{$0f2h@o}g}>%EFQI;du6*1fJbc({$Zt8R<|k7t;X ze%Dfa*43;yhMSnt442qJ8J@iaIT9wwix5e=I)3Z0;jj^$4dvfIiL|r)vd5#UZ$BB| zs&Y`ZKfsexTPgmhEBH+Rc?JJp6DKTm|4f|FGkngWFtL2D{vT5(%>Ui^|DHPeuiStC zo!;-u_WH8DzHF~A+w05r`m(*gY_Bid>&y1~vc0}+uP@u{%l7)Ry}oR(FWc+O_WH8D zzHF~A+w05r`m(*gY_Bid>&y1~vc0}+uP@u{%l7)Ry}oR(FWc+O_WH8DzHF~A+w05r z`m(*gY_Bid>&y1~vc0}+uP@u{%l7)Ry}oR(FWc+O_WJ*W?Zx_UQ6~)lM49~igOQFA z@1NzLZ4AtGpX)52um3P!%yg{(bDjhU4lkC}-HkNFbuclhmhwGBegtgF{z7Nzz%f4$={H+OksDY z#d#yiPvUEJx9NKb^J-{%#f$^mWNgyBxZbrrQm6+q?{5_{Cuy-kIg3fFc($Qdl! zE)-8|da&*UY@Rsyb8HETX>7XhH~|!2yk3F*7un%=q0M{Sz+l(!)0Td&#zz#d2VNC! z;yh(!$P%2qb3;7Eu{>BDZ9O<`6$C%;a6=R%SZ~%_zW9S_1r)<=^`8qiTgRF$`5^kJ z(8?uw_?H9q?i};#yiyEqsaR`zm~9^8jzA0Gq=> z`CWg~Ucn%XXl=Hb@q6+@NtE1$Si}N$ZQ)&g^A6|QKq5e)Tsoqd?RRI?kDH5 zFy@jyuu3Ma137>@@@aM_$@SCO&-{?mn zWAE>Rx{eK*y)B__xq2NPcocW)eap9r8fConajoe}8{N~2cFGP-X;0om+~W4@0!|p( zoySzXt_x5_UyOX6&msw>4{68cGd$cSG!^|jcj+vmab|Mea)G<`5EAtx7v*`yr868@ zxlIiS5b@~oyk;VaHN~4veHQuHUI!`@)p!+Q61I(lT^<@3(|O!Ag>gyZ(zO)PvX2q#B7`4M6lZmvrRAXhf?HXj)Bk<%4= zQJ|dTz7lYx{j9=g&9{=31Le~x-T{70<-m^2FWc9EdPF$`NOqoyIu4tmc&2b5)UtVJ z+4=a(_x8B8;oCxodeEzh=hKPE?YU^aaWr{sYNo%tIAV@v_NdZme#5gShdtfBQpuPl zT^>r=_5D1XRqFKwng_o=23GpjRK3MKd!6$`EG_xz=<-9X!&_L_nt$vVH|H1h8B}tY zRQrgNRQuqo#V)D^&MK;kOn?9%>bDlPh5jHu(m#WE9W<4i#I1iiaUAKB2*~STj+3qN z6VZi44#ey2+}ICrlwjt+=YOvSM$cX5%JV$U_FRg4z$eD!GdnOAOD^yXD_jj~=R?68 z8h@b2aR`4#>yUuUqdXd#F4&gTl;QQS%=ZrSVoUQlTAGnRLBGS8CMlNW*8=9|x~6zr z?jO6WBJmR9WwHf2F*B;-yhfjARGgCH65k4_pBE(yv&wh`*5bX!Y}MO6beQP3K2Cgm zqlxE)_$zXx%p|ttM};}f&)oUgE7oesQ>mzB~Z~_B)ZSY z5Fv|lMGnGaD9^LDf!YT54Hv|tI3y~&Lh?^$4;AVAA6|6Mez)UGMrJAWRNk1EL&Uj{ z2+QE|NKNDx$eiJXu7NFUlox8Rx)zBuV{8u=!q+vdu}ML%{WP++Ys(a{gEA@bx`gB3 zsMQO2YSgp%P!fDz+nNy=GYZ?ykoP(Kp@sADfwl576nxBzW5o&c>J(CzxlVGZ3hpK5 zC8x!}^V0K6#X}{BC8)(o#kg`+wM=8xRQD)jH3*5upvt48s_e-548`iDf6RmsPOSAc z-cinHl(ONm-%#Gmw+5mpL-e^*Mt?uhCk2x|z+BOequs*Z(%jezi6{2@9po1isbcb$YcwrFrpqk)ZfoeW!W;hwSeaVFNQ9((-0Vq7m?!Zx!;r z2FobKuNe~$WcS}4g?_9BLqX`Red8cQ2rz8GC`R2qF~P*|Rza_ma#!0lG*f<#^9ZQ2;t&!=-a}0P4Bp$S zWD^N~;+!9eM7YbEBo*S{!ZP*um;J^F@gob!HJRt!=L4bE1L!jC6V!|IyHDi6+npM+S=DRjD$nzMGH-Ol`xak`JxaZZF zy&IU1l@IG~8bE;$d+}WwIRp|&!Jq7?uZRiXLXg)GLLT(dIR`>MBB!#fa=p{?G;t!0 z#R{TIr^(4?g74!5O1VO_#zRfTSkzs^T+)7SR~QNt^W@abytIsh62*UXOhPg=3=-<* z_Q3cP!UTQoB(lyO)1Nk*muQiqxI&0DG=VJmG^=3_1|KXjGJrU1@D8%O1z%BiTx z=Wc)(_qE3nK(}|Py}=n=Q{+9Y@k@Arag!aZ)K{#Sbam;ZPc22Rvj~%;1|=+~z@BZc z&2@RZ0uL0gFJeg7Qlm(fSlx12jy=59J+C2FdZGAy-<5#{?%jp$Y z)0-GgYEY{UXP|Tf9oc6JuE|axJ(Z>oxI6pq4O0MgP%EE@*5>3p4VQ%Wgw3di4QG^# zXbsAprO2_W-n#uJX)~uO=Ujj&6vI06)lLPO4-^I(4Sk4ceQy7T_=-!7p5?AbUoVq3#&EI)V#}0Tnux?6SV42yOIaZ^T_icG zrEdJ%*?E2qRW55F1`y6<>oV~mI3wzfi7uhhj(mM{kbGU++}h>&jW29KDyQvMb@{-x zrNu2vBh@LAC}%10xh=U}$DjPb7;u^)1P9_HUFm5YOl5j4%0kjOM@E{ZAsTnvw!pw= zSi-@eUn^e82!xt{9ku$TduT4NPO_K$)>1N^RQVuf-JOZY7cl6YH&bzFU80!cD0$^O%I3&;X_cS;GtIm7wr*eb~%i7<|O_XexCAH@4*o3s^ z8q06dw7n}$FR^mSTWi~LPi+u1Pr1Ofe~FD3*wRe)|6rBTm8pn^@4tC4!1sR$Q&FQA zlmbL5h>auayCR)n7l>yDt`F00l7U2i>MN3!{`v)K!-!&=UJ4xW)YRR`Fr7C@z5yU1 zsN!tl)qeyTXo&pt@j)x{`SaP#LF_VpYZV}|<>e$sz0h15Ls#3H&Rf#oL477_i!sco-jF;IVtFUV}8e`z2lk% z$=pmtWX4r|`^03V^5glQ9WKAV^+S@Lq&4l(b+C~U5bw(Qp)SI%2K~^)0wakW+E@yZ zDenQX%BJ;mft&teVaPAJxDwQt z9alr(LbWbv711;t#@j#Ikld>0LP82c#&d+3N%P{qkx|A!;iD%Fkeh&al5uy>1q$0V zbupleBp!!=oCibuUjS1;tiR#z4DWAtcXzqF!6~I$Iz1jc%tJu;0C=e09=r%Nlm0X> z6P=WvA*|d8e3UNxFb_-8Ku^Ed18c`Hwmn4pxQ%Rd!XW$5kauWUoUt`f7})z^!qsDd zzs*5!Pd|2^2e9wlFV?Mr=8Dq6-0am}n8p2&Ey@xE2S#r-{^%XTuKCLDAV@+xq#JS< z4uSDq3F`*y?_JUjixggq+~QF8*dYZ%sK==;U_=T^eYhY|e%zW3!NV(g-&BtHw<$;p z3nEu&S!?HTbF7FslW=59aF{k1z(w47s&!ds%tA5vay^JQ1X^XswcW#XduMcb#QOEP zsy#Mfq#ERit4DNZO|CPs6=;PWWO~;8!%}9H-aXIl>ls3A~IplZZk4^TN`Zvdzuuz)~l#NG%{PM~bWz7U|4 zKna0j0!0Mc2ow^Y1qAX5vpfRx3Ctrra|z^-df5cB2xJn-AdpU&rIG4EQZJQUOCb;- zkW5PY3HV5bBm!PiFOih=5O5Q45pWW4jMx?fBoMHV*qQ)r1gr!s$oONqtJ-6oF3&d`#f)1pYQ+X#@C(z=tE2c7VSU_<+Fs1l}V>-X-u3$s8l_7Xp7K z@F!B_e+c|Hfj^RKe<1LC0>2{=Aw~X+z}qDAEdswK@Fs!ZjF^`I{F=b8M$AhAeo5dL zB=hG4env9iAn>0AP7?SJQsk#3^%IhMoxp1(^Tz~E5O|fqj|jX%O1@0sha~d{1YRQW zeFDcvOkkI&?~Rzs0bV5V!iZ@(!1Dy2Bk(MN?-F>1z|#btBK3|D7$uoc5_p2Z;{=Wp zI6`2Az+qBvn6%|PB=v0qkC7tZB5;VnHwipS;1N>qVN&5ClKBk+4-$BQ!2Ja7BXBQ) zdkEY;Vq6Vy7lE&j7<&Qk95MC*d~L+o4{*nbaRA_U0$(L?8-ZI1+(O_Wfv=1hdjM`G zJZ~aAZzMc#AaFfleSlQBj=&Hpc`Ye&&4{rB;A+C`D#Gka0#}fdmlH0Rk?NNc*iYaR z0{aN;C2%o;Jp^`-7{Mk}yT~0bBCK~3xRBgo2WiW80^7*_wvy^w2y7;>iNHnz8wi96 ztS4PrNA9Il@1=wRKXYDkf4l37KdaztAT zP%)y#lXAg`wi6&UqU{1GAJHxYC?ilhqQ%-;LZFyH5rM)HZ4jVfM4JYXKcX!J$RjX+ zM2l}UkK8DiK+cF3OE8;2)`%7hGLt|CX-hhRG}5FXX;LbI6w;&sfn?GMKLHS+k538)At zNf8A}$wxFR0c0bZRRGcv%>@7g0iJ+_07pu)q$EQ!X#x}h6q*2>fO6x2r-42L`V{CC zc5zvR~)vmt+eW31jy|3@LHd7y{u}6z zK!1Sz-vj*);t|0A0(u+Dy#?vt0=)_J8=zkU{R-%psx_`(s0Lj>2l^S%8$kaFc_#t? z1L&tfKY{e?fUg1l80ZAht3W>jdIjiZpdTvNyMCYyyIxYJy1oy1T$$$j9^}0U@fVaE zT%n2QmFry3Dc8E5RSvqo3s;^|X1ksSdJ5>6VvB23vDNjYVw>v;#dg=@Ku3X&Kzao5 zFq9bv`VP>yfgS_;7SJJ}Zvs6k-{*QnzT5S%e3$DXz;DPec0DNH>v{n4?+3aM=w6_E zfbIsm3+U@WcLIG)p6=yut|uCL0z;kpg*R-jve4g!5eHt4!pcA4uY*`2N%Wp}x5 zklo|D9`X+WUCH=dS1<*x%c%m_WgYuFEk z_J(v4*~J~ZJN6vf-Lb1sch+SIXeU_-|`XyDp{H64S8)^rRM^mX(f>g!PVW%kj%1*d?xL6$Q&WmLFQypbhI97>1Zlg+_4z)7Zo&i zEIicM(NIv=QGckeqqd-?qZ;IZ5;O_!1V)3~vN!=6h3r&CmOW&D%l@97MfPF)^L9q3 zwz+I{irPw5Hd(1n)=R86S{b$FH47cGq@>lT&99k%Ykt?v>O2P~nFxWWCPqa1;3(d=iscVLPZTK_PvTRs#%`oa%w!HH&McvRP9y|^k@X4{5zViC( z51Xh8YlF!$c;sOV}O-jCyYC!h1|bVrzcL)qqd6pf5!!`zqrFkwgD!^nF8JIn#`d90K=PMP;$@RK zm2)||66gx}yb4{7u0huV;?MZJ_|y=(4jq8;yaC-f8NYGXTpYg%-3oLw`U;HtEfBvQ z#{O&QPV{v#_aM3reN{}|gYJjxx5bsk*QUzfh3uzOWuQ?LEi

!X+V&j8UPQ+r{v!GGdEM5*5Mz0ZhUM9*Zc5Nq=yc$O1vT1dO#Bqx8!lh%prppWW3HN9!kM!{1 zWX@E-<7<&}(`6Pf!LNxq@mFU`c6$82vtD@seFNx0_{8HdGZl+H0y7-bH_;*VEr^lN zsdOy%82UE)4%mXj=m>foJ%OG?qm${Qkea$aBId-(%%1-gdRo+i=g{-w_54F{Udl%*@ON7fThZ0Hs4v+){3X3eoae*hAiBTwYj#ga<*AWO> z%FD}jg_-DrRV#z$LY=uV*S2UZN1ID!9?vPXX6EMRYW7}z{J56N)c|B?Q9*mi^N+L5 z&g!y<5}>}qHx{18V5(}YZ$ZL=R1QK_7;%y<|T1LNz@%cscjnt3nfVUrj} zA4oL0wE~rO`uC4=O0&=IOj1eY^!>cX7I1h{tTOsWYW#lc`BIZz#WK7?N)?a)P^J_Z zPGvW-BXX6%FoIfs{pmfRC*hv`gx9o!j7%iuN;5W&#_ac-mALOo-}1QmOjz;y{3T$uH*~% z{AStvty>lbSY7Fc6*XodwS39E`RjYy$`U<3_OfJ`C$wsXXP(bEzH(m6>eK(#wtT!G zbI}0oWVTJb$L`{sr~rNaOgSHMIFM$P?sy`dwXrs%6ra`1Ycq~gX-7hVC6m(8Vgo{D zjvX(=X5{g6m&HP8tg+H^&5$6r#3; z#rnwZQkj)1f2e<9`_QKL{Di>5jWvt6wB%{!GKS>@sj;$WSJl9S+sXrrcij2n_WDbf z1=t~DS&}d4D_?)$j<44=?_HAS4SF>iuo5=2-jM9ImhL>f?Shw|edLmQPfjwJ*iO*S z?}K()P%=6=n{FaHKP0ufT^hAUEfo)U^eygDD(Of_I$fh;Y6v1b^7#d^xQ;>*JuY)J ztZ$KurNYuPR4uAx63{L%&1b3?%YI*%T-LSYw$V$+-&UG667COtrjyd%di?SQPo#8S zyXEN1BfB5m*I8g=N)}vy{WW_A7pC$Wy8)|E`9+WIZMe8A_cLvA|5dl#3A%$Np#n*y zqd(1JA2m{=Nidm&K(b9~Q=()TX)2@(1d{{9MhY3)ew@Q?^VDh+?O5}## zaUq>2$>a_oqsI8Wk@10e?9fgBg=V*UsCOiGvw$-=lY zR7n!+gvC13mK#yDXOk^nZYHH_V&0)R0T$}<}uG3Z4Vm3+%U(U3wx->J+T+Ml?8!G}T5Vml@?q#&Vk0 z=-LWvBFx#`9C6V&^P0FeOwXUzOSp_z(pZ1U>d8}xlA97OHa9f=V@hfASS)V6gtqde zsXY7ZSd6q+avVm#2#w9s-ikDjL79=EPe(GN!JRIXY1}uaQ(5VhI-Qa;>FGt83XRD< zuO%a0sYf!CJ6&Nkq-A=FRCYfMh-T7#z%AA0mQ$Iz!Q)g8c1B=OSFY3s3oV&iFfibf zXmjBYKCl=Z=gm=+&gU1O?u0~ZO&6M%!fSv(nej5yM^~twzVw8xYKxX*r$oQz(_2+awF3Of z+b8oLHaPWCr7e)~Sr_xLJ=w03>K#Tz#)flnT2xG3J~2EwxgJ$p@5Dl4rny4 zkinVPs@9|j(gLFs?;UX_)nN=-WX3v;22vUg#8fz@!m(hqkcf~@i>5J#5+Os5i^_3P zgOie{1y!1Wt2kR>O>D7tNZO;Wp}8>bR8AYrB|~jH0iNDT80ZUD=DZ~Oi}ok~kF-uy z8@t$;v{~!Md9GMzrnH7Qt$u&9S0dr3+Y+KPCX+cgFK==(vT2OYY*Q|%h6J6UaAbPvk%of} zt@pQ_R!!QQZw3-&wiNg2>IIiov<|n@-xcHn3rm84zqGVppr-QZ7HKv%8?L1iP8!uiD^D|tnnEjpR zPVw{NJT8{gB~)y<_t!UU{noZ3XZ5E0etuxfp>0K@?wakbgLiFfOxL^WwzaMK`qqUR zdS=Cw?U{=%zU$uG@@u!XrZ?`s^Pby41~7Zr z09ZB`$l$57c~lCwJ|IYw;h#Yt7^Rpe4Q9Pm5LC(Fbw3_5x2UGCMA60UM06peESji* z0_Rgv6qkT+0;^ZFv{@`37K?x0>gA2sGn3iL@bmo1et*mX3t02oF1%xKWF;*#d#q-+ zo(Ij!@l50_O3GVW;(nquWGV98Kkz{9>V{mmnt5~n_D#JDgX8Jg2;m(sdnk~|3yPfj z?uBJtI-WiKiF;m6<02H5qaWm$jmpsfoGHgA%qBs>1z^wA9#ZB63LVY@_?Hsk3b7}o zN=Z`$oF=JR;2jQc0rd9CP+E((LmM^YL_TILpTc;_p4JwgJRz=%hrc*0Eb9@@A=cA` z<0__!HN(-G)8~0GT77C$1#=nZGk6WrooWUXKN2%`S*$;~X=l^?3f+8$lbMneY;G-2 z=L)bq6>Zx@%S?$@vq#6%?+IBB%DUpZRhds&a@z`zbl%>zx5>v$R9`&UV%6{N8~-o8 zM=4dpY?i5&RMz|@<=)djpB$*~B)gKT`&T3urJBYUW;OM}I>AniF?YahZ=iH%j?Xhl zOXs3;lt&kal(usChkV++K$WZhX$l|xBvB}&N<+McrxgsJ#;0W~@FVf6HrRLuj)Yt@ zHd)vk(~N1xw7MYPYY-0_(s+yZWw8}Eaw0Rn9zVAZrzMS2=*h6irV8^p8m?+{iJZc& z+4go|@-~LMOKWm;0{boS4Xt{G&0+JE zHwV)y^0IOY8+$?>w{BWsba`x6iOFU)D&0PJa^fG1dBnc7Yw4m?3yw*r;o$B`^Je}%?UhjX1gxV48bK{3A<+6o#RvP za!k!V;>jC}J!N(q_LN}*a?9Ja=p17Y^R4mQR5Awg)iUM^rHuWv#AvY_l%L)`xl*mx zX?UZ}VpL-P_#muIHt>&w=$=`6W)32c+h~%@{H@3>Ga2Qug#xeF4r|Pj5I3naup*a> zKJ&?_->g1&d2z|t#Fyj5f?+ORg>Y#shZ$})BO%H%wY2ZD4Bqz4#_fmJxUF}C%k2Sy z=sEf>t-5T(!p2K_tF@48#NMG^LQy~4J-WNBeD70x7*k9#pZ%rtiq5o*uFKn}^1$Lw zJPA9p1FT;>BfJtzDWpt97PC*G#0P>&%BN`_R(2U(8qy)N-}k=U>%eDj{klPJ5PGtQ zzIf`)O;>pQ^ovyHNtj#K%v>E_Rp3uoh^40UD}3*V&rv)0;`GD1WDh^vVI6ZV!|41T zSE7caQpZF4Ii?(FK%{g5Sg<6ScUS(=VS94WPg44}B=yBNR zEpE*z9)B)S);PY{nVqN`f6!afge}P0iT9Xi*(_9y?!eMJ;&vnbC|wnjX6OU+Q;Of^ zeWO(66Am8!SrquCqWJ?B{H|8Y+IXQ6a~dLIF8v2+Z=D2XB@vtrumC3^DM(kWJ+G)&TTHO*s!D`Xmpn>$t&$DPgTnWPNvk) zU)(*f^SagZ-J$MFA6V_HDl14-F{2WL&2CgBcoTBlHtpJ-SKhrK(e6%ADrH`uN1tHR zW%t~C!Quz+8d_T-g`@%dItvkE4WM@>RqScTKqaz}*K1F72&OH_-PteEqho`imths}`$6?&=%X753ElKYJ&mY3+9W9d-QW ze`W{tC=KluXOUZKFbYPa;P)vk3JdZ{-}9&V3bY&_Mrd!IrLq{`=8R zvHwo7|AO1-aw`w_XV#td z_-Xdjr&Tm7#hu={fZAYWIPfim@tZru_0{6mO6V6PDJJSO8FW`LS@ysh8hZ_32e&QXr0p@%NJ%sx@l8^%H+xsDDYHAA45Cc#elFd(eCpF9OFUcw& zrHYR5Jf8miNC}?)@{z1Frhg_(e7q2hk-2X!)V!?~R}Y0h;hiwy#A8;Ehk;iKW_C1O zGLVJY9SLWhVF5COgkNx00{|Q6=%YR?99VNDQ_uOxS$qS{f_ug*(`pB+7GE;hoSzVA z*ibufFuiC@rjW>Wa%#23Bxz+$+Qx5nYLJx+AXb7Ja% z^eFIChz!l)FTgQ)Jnm@A!_0JHJbL2gLiA!aBLEG09@_=p>Yxm-Bet=Bby)i(+x+uM!fIjIXBdj>U=0sAoZDMpQ4#OpT0kncOHt zET`#@Z$CKz%@I%jx zYr#5B3{SjA>!6hZ)Frl3g#u26Bj9vE8@&DEg2=_s2(hupPmtEiVkJ4U-f{8TPFhX; zNOt;uW9q1OhbpaVb(PVV=(5XU@=N6snckXcaRl8a;j7R+*vosgJVkM3{S5&IjDtoc zG1~2BwL+!Pc#Bf$4{#sxIZ__?6%rGdY%T=K}wwLN+uKee(=PP`lweFMb`3TU!dj+e0)V8`GVPv)r+YLh~`fz?}W zMwPgBy&7xzXP0WB#WfSBxHn)8D?)dQEuN2LMRG;9GAlbP!;)#X`fN$QB#T)t%j+{M zZAmhenPs&oSr4Q3mgU4cZ!o+@2611(gB`4@4x3kns8n-XqHE4AS zQXIF4i7+Z-TVJ`mc+R6MMB)Vmm6xZqb^y?14MdnUKM3QVHjD0D2*CpgdrMc-U zgDZ{qE1i5nztg~@^faZ*pIa)oCiYne*)_Awj?CjZ+Fa0wRe`10tl}n(d|g0<-X>&7QcUS)1t)F&rX+*%RQdtZ)s`qC%3e= zrc&dR<{LcWZtx{q*c|Z$S+tG#%y@x#X1qW=GZsel11b262mB0|A$D#o9t{ge!}_saonszNO z^=awvR^D^Zt=nocS6;iU?!o&HZmG=a9vaMFu^_3Wd(YmT!Gh%r5{oXlXx~oUJ8UWM zff?mO>1bEX&o2+zr=JGD6Fbp;*W9N%n`ijajI-d7K?uAvb-Md*cxK%%dbCS3_ZZS@ z2d-UuTRn}B7|i&H;RQ*m`)`RAj*Nx*j**-!eTM$#=4%!Ymf0CkTK9_9(xma5d2v}# zh~q5bWr4DmP*#5=Qp7&{QVNe zKncJR51KxF$73%WjGa7vTzr|peiSMwaE+s3#Q-W1BQq*ZzD>YQ8*`($duAus3Kc`m z&;n{Ke*CQk%PLaq3w>&dQY)7)Skj$tEeKUo*UhFDx;TC4s<`W(TZ&S$9V)d}=TFp| zvKw-hdKFJUpT8U{%I|9 zM)mG{l2j{2H(%J2I-*Z0&$_kxvf9<94yLqdO~(R*s;4!gv&(rID4tX)|7&Vhrfs}w zQV)ORaX1P)T5M@<-T1ftWsC8TU{1WlXg~++$q5fWskVWj^I?}_wUxm?ehp2M40+fb9ASia?s zPi*7BBgv;Y2K1zS5ZgblEVCf8<%?P%Cq$>^D1oiOj^0gZn9?-dlIu# z{ejGq#kozFuAHZ}+Vxts#AvY?6bYUL*SsoUdilJZs+HB1J3Hqo3|0f)3+@NaJp`JY zNX{`rawG@_sor7`PmTE}^-`57q-|=@?ND%!F=CjS3yiJe0DF*tdJ^s@x@E%$wL#TB+H>ECFoXh)N+(b3LiMB zK1&HI$;tM5z?qR-^7~W!k<6^j@@6N=6(yD&U#3Sh>joFbMBFRmJ@Uzy$j*fLtD>*^ z#TZQ&!IZB$Lm2U5VK;DUTdK>QVwF+(^!P)Z){z3{*dnF+XjYfxb|h-p#WZyVCpY<> zc88iPr>PrRxzU^8^e8wPkr=O%(;uEzDpUe3O7CT(RlzcXQuf)SG_ypi6z~Q``q{%Y z(-C`z74K1h2{ZX4@$_L2v65c82w9PwE(<9sl%%k*lokG&efY6JCQ{OlkP@FqD0EH` zfMn)Tfv79LA+KkHIAXR@@p(1ye9)VsFH0sf)Z`-o20rtMV?U)ry{`&}l*9zLUSRGW ze?g)&`Rv{ljZ{M&{2px30$xX=j;FsyrAxq{ad=YHQVs1GcNwi}j^UL8b<22Iz?!7C z8mZq=$MMqwSU`mFYpI=5yopoUu!da)Qh5ucl7xCh4YOGgQc!Y*+|@6q6v(1XGTWpQ zUB6`JIRf_IvEoD@ft<5A?)#*1o7UglsSXQ`G&XPI)1QSu;VE58BJ5pw`fiF^#6kBH zJOLGS|JLzI8%OPYJaTOQ%+t3Vr(b|SO7twCzxb(-wovo7=51`%xh!1o@i0_0%S9U) zS2g$o{KXsz*rZU?-$jhRZ=X+1*?HK-?`9+%7y_kEdHQzhltPZ*O;ib|w<)x8j^S9E zv)btJc#2ZVaJ)h-r8mmeQkMBtVzyd%L8UXRPUmVBoY87EDe*h=tkGqfv&Dga`db}V6bag>OV3!ROKzL%yy~euDoFWrtSuvRjUH6lYY~^ zFqB%bVtZ-94YwTFR9RQPT%%$H1^<`o>fHAATQ{b8s|&rQ;jeUpq)S24uX9^qe^h~f zex{^DI=R;2bh*9x1%(NP3A#e94q+K5WN2lD1&J)5`$=*`f=(-ERpuJi!jg|e{G!;? zSaDj7iLyR97CTp09VbCYi4wP+KNs=}ASs`m`$>3u4Zh^#FjScmesod?qepY1Tjx&} z&zSu&!;g36yclJp`%xGQ6JGvV=5^RHtiNvQvi&(aIysP;+uYr#^<;*t=CxPlc(n8tB{v_uZvBF)P^VUrfmaAt$m{kO2yXE+u1#R;DH(^0cBb?9%3d+6t%eCD@=SLqchXLe&zsJA}Lsa)2z zVC8~TjUZ*EN=r%8itPLDG3G4ZdRtGRVZnR{&n(vYJtjwzbACs7;~M{(b?y|mTBY!K zoz^6W{=xf8Z$3D*KBP2xY&t~bDES3<5jsF2arLkwie@CK!L$Qu2lDrpSLdho=55wH zbk0sJPtE51qR0WAQ}4)2qQ?gjpi|mEr8<$zrb#j?DrE1NARmpYvK9;3v<|$j={48;X`4%jjmsI6F{o~kM zlXRMGfyI&KHI!|*rDJ?cESvo)O=s102GXlcyhZ_A6|-LM@H)=WGC@n!?53|=v$mY) z_2~(T&CLykUQUp4oQ#j@+^<3BEz&FtbYF9)bxle zo1f^@`zb{`c^tomKjl1&|HM>b^!O^6x-&fzo_@3L#izn?w_8{BW_ZR8kLQqmQ}hY{ zlx|T|nst`v0bhbn?WFD%3^p(JzXYvyd>5sZ34+mUvwI9OcKoegP^CoioSFXnm!?Xz zm)eE*JNU_q!e$;nJYKA`^5DaBu%Jq*55|?E2I1GAzFZCBxlQN>@*d_fR0A61mTPag z;&OC(dv{M;PaEpFyehru8f|*I_8R8$qD`AR6R`^Uict3zksC~@rc|H(P1S<-8|rXT zcF~%TcP)}c7S;Gp&{N@$Lo3-MzEUE$;-an1A-(6sIw zu84%iTP?7^8J>2tU28rL?^*=+3ook4_nivo$FIymaak@u4%#H%lAJDJLlmzgv#%aA zbtD?Ws>kO>9at|Tk<3yl>eWs@dCq0Gb4-0jS;u^f#VC>RN`pe_NIwrf$TkGR!fF2ij;=&1Q%nEY$MC^yTe8zA#kCZ?;7-jn7qk}GX_jLKb}D3?La)4tm6=nu z4WX>Mc7J-Mkyk6Uez);FR3#}lsimnd-?RT>^E^kp34de9q?L`!jPta)nNpclu2#C7 z79O^r5=-u)JcYyUR#B&vdX>*@B0e=+$ZbGrsC+h`IwbR?mnXtSX<|NBC7UrZjY+P7 zOsRk*s;o~E8j5E6!+03U=`iREe!i_Di<$MjtCH`Q#uZP<`XrptpemZxp^jEN!>67+ zp)*fDa*a9F|xBJN3B1PTB6h~`I2YD(W0q2KMAKc zI2FGQJ7>(*Xq8Ea&U^Nm6@9WJPGVj>ZN4jX&BT!w`AwnSGVtIOnkJtVL{)beC@#6>pQ&k@2fX1PW6=8`_}1AdZj{^;IK&*X1yZN zc5(ZHTfcJEKv`-r3iF^~Irjlc_#b%%W69WO1#tBvR~3($&@FMM6nUF@YTyk4o{QE@BJC?=Xq)$dUb` z{@hiGs23|DVJKNw5($&CNqLbl6rL{XBXw0y}^%OW|cj9J6n=(py< zdNSGI<_aoeDccVt!|RFSzOyhf6+{HX@)E{KGo3EKxFVQ572>PUEcGrTu_9QH0UUj0dU zW>ca@4J!a1{pg1Ej2)_R`W6;DRFmIm{>L?tzs9z|=60cH(SK0l8-+)1X*k%3t;ia5kox`69qu$&`qR`YREJ#D z@1MNw+eco0g?&u+H1!$MqQ|IDL-QV3*}P=U_Q7pTc*hO9LBjcU^|xLY^xT%D(>?&& zoL_g@ZAsb(9?&M;c3E9MXtfM2c@ArJK9ari@)4Fl{>f;=BQ=d{((8=62l!@NeB`zx8C9=ie4GXS*%)k;$uGEs}mhNP~Ou(Q_4P5&7&4geEkRh@b}+DirP4H z%+yV@cvYlrqsKo9$F=TGTO@pE?d}_34&WBzSs=EN%!8cDNEo-1KXK+UjcEFggYH91 zC+EVf$2Om@^6?t)Ischpj5D^LsSD|VPBLZR zO=+b;mt0NVYSEVU-h?Mrri5YX*mUM-d|V|?=Z%HL>v>FY@rvu$(R?v?;q z1!S<2SoE=#qzTW%fH)6fvY%zfr=2lBsR`HkL2frmMCV^{-gU z!*niP>MCL@6p`y{_eIv#loUHVBUfIb>#J*xR5ZmSmUbZoB8u2-@g zzAEEYIsR0*CVS|MsC#kyrt0W*t^li*PAQzX&VFyjl^p?%l2yrA9loNo&1)%OiqEaF zd)oHIt`N^tVg!%oAi7;VVe}=anISgO{K<_Cm()~V5ZKMuWkt5uR&+=5!gb3cbxny2 zrE!~@X+B7K^qkusN+(=yG=CDF;Yb%7?Gd7sZ+nEx4#`d?V7X`xx*$&s_D6PsaV>}ll4xrvb)qesp&S8LEfFkY}) zf3ETRvR3QTzWCMJW|>;8qv~6DzUuo=FV}H;{RNlnc#Ri*XSN+Qei_<`#9y>{GF@wG zkA!O1jZ(ECZFiAIoe^1vis}LpQ&YUwVbuoB*8Dp5+eP+}94d#}BjHeOw^-jC?k);x z)I}MQFy>(jM8Y$5>5sJ3RzpV|yC?OIi}xUBWPM{pYMmt_X^QiSqQ;2~V$48^&m1p1 z7zt1DZ0V1LTWYhaBH^r>dql>T@I9#^%sSN>35(1nmPlAKao znQ>uOrHSVruM*UEzAWod3|z2=NI05ev6m%)4Kk$`r8*Q^nzw72Z%^5=yT;dlj>TfC zIW5*ApN`@rT6?O~;RAj8r_8_%-7@QyG2OCT;z6l`J1dCac6krlg5KAh$_OMsW%dCs@*2?u!XnPhup6E z(nuKi`13ys`Zw#UF? z_2Ff5L8>ykZSLIU1o@*e^OBLzOBvB^Cc1@3c~~7oBI=ih&FjIABw>F3HFQ1Ad zt@V@^bs?vu;=aiBwfiICny1CFIy_KP>~<}SJbd+419k1<4s6zOpUvusZ}i02UVmRC ze0^;gIEQNvi@cM-BL9kZyw~!>Uh6CxF{|-8PtBmeT$krus>EFks;*z)Aa+SZQlENL4`|nG?v~E*mWm9vceDN%L zaOM^+st*M-xIO|J@ks5}cSgb@=Sz1)!XodLnS_(sZ1wZ!ju$EoH2@`eD6UN2{oJj^F$#@pQf)x(9_uO;-C*Dp;hJo??>X-8Tq;@vHILBDmY#z)K zZk^3n&m)U4d7db83S26S=>Oeh)+iBt`fm75k_W~*NB=Wdi z+x_YOZr_GZ=3&KvcJ|(ZTW0t5cjdg(vv=NM+&Q>rc3`4qHauRvNasiwxJq@4Gu;c; z>E3~Tx6J0H*>+CP=B4=t*39MyCc-UX!N$+cWv-Gam%L*CeX@hRm54|ye2ypQVsV$h zr*t@-Toff?YANyml4Z#*R9$&J2eoG(Id0Ni3}5U-+cJ0RfB!A znF;k-cXfIg%+;2q$mzo&Fv-+Dpn~8ut43z?WfNukX7iZ|xB6_}U7h%~FqzCq zV6w&X*bAm?{mon>@g?ydPO_Ye`R(O|B9gWS?RuJFAjN2RG-+sB-eko{62H7~@B^ht z!~+h<7!tyz1gqB+X^+`?4SHu3<#cX2BQg40HH+VOX&GCWDm!RS<^jM!N}7@7&&xpT z5CjnZFB^(zm1+ReAH~YxI-LpsgM~1=r?U)5i_njBM`tb)2 z4Q`oTI?+3u8LzxCv-#rmhjz^77r$UBFvXWn zWO@OQjMwCm=)%`T<*$+D&3}Pc{{DjJ0=z{vz)Vv${cl@HGExV5OG*OdDB1;ht9i1? z26=01;lTeVzGY~7>El5MsVFigEm}PAb6|P_#*}Lrppc6ER?S>8WBzw|lw}KyD)KV4 zz$lusp2N!+(p|VustIaCmZEr#{6%G^zOAi&=@PrG-PS%JB~)`^#8%&i*a)&|$hovV zL-=ywl#sNelrzXNsZYFu^%&B4?kQU7p5xVEUJfoBg z7Ootg%Ds~Z69~+o^I!_!=-Iq)j5Pi#PgXiTp{PWnr3A=Dr^7ky+}L=jMMieb!0rb( zPTm$)b10y{hT(l}Yq}a&b%j~2hm+C;Mz(j_iWv^og-0uU(oVJ7-4KxSBNIywPlVh? zR#Ynt29wC?Ee1oZH@WVx+dtA7Os~4CujQWm?%35`UW$~S%J>nrHb4?L$zcbN*fYIdUJ;B}W{p_Omx(_JQSRy_|{bswYVCom_UxQJ7RzX8%6ySPU|E^jj_M*9AVUGg(La(&L`1@J zkD*GMp9nj34rB(~oa0!h!=ZDA37=U#gARO^%=w1Q#q{mh#?ELZV!!;eGsV*E7cO$I zL|~?P6AABnAz!?$jI?0KXv=$PEd*7n4?g&JQfrGi>;VBI6@uh96tTiz7fE;=mAdsq zA`?HVa^k&Lw-BDVnUZNm$-Ia@jDLNxj~P6{fzwN;F$`65K*d20=e?yyAG6<9JfY+= z15apPd>)!(aGc?21V;h@wWp+&3L=M*Z^(5Z4s26StvkFc-@QB3eR%iuijB*q)zYym zx*L`s7?LlAy6N~@FC=nKX(rbWZU5`&X#20@RpPJnHDDoXJFn`?5Ft(wbPcRw^8;k0^| za~OSIK`&a`E+66D!Gy&<*cR~T)-<^Kd|0xy;&ZQ9vNlJZUu?@iuo}I6fe{dFzO`^4 zhDn^zikzsiXLYI8I=}^+ay(n-Or><~t#yrU(lRk*<52W$&b$CfUOOYVdV?p0y}G!0 zFKvvxhl}^he87WE+&E;8p3R#p89>^}(x}>-`CJrUTF>_tT5A|Am<}Zs8hgm$0Gqt< z@9NZOemLADqhgk)C>CfvcYV;teN*y18(p;)<=wxGA6*gWAuI)e6<|&b#Y7lM`1-=e z2R0I*FZwLl`9WlzwDUzS6h!Pcd(dM;LY^VxS+a8HXij}kD7JysNYyUt(ygTNY&C9^ zZw5p#UhuVle@QRsx#;VlNC(iV$AM0*uT?pmix46yAUJ_XBLEA4A7@U8IwGPnHKcP0 zWYig^%)WlfpS++V<^DRSEOOgQIT=2^*g#Hy(a{p))V{4+uU^bajaE60@#E!%fHs$| zJRAYcZj@WprBBE)1e3{quCunfm~T;yR>S}#E%6_Kx_ab_8r0PQosnY^R?h*A&|icZ zlD4oEAqjWxhw`~UW!KNEM$mKBNI6z8pNj$HCnnznR?|A<%^FXf?TyD1S);+@9`~$6 z)`7=BMVxK+aFfH@&^x)I;pPND^@t(PdDe~hW>uMvq0Fdl0YMcZl+@r9K(FZyQ(CF) z^c4697NAND;{Kp>NfhybQA443@)sCZ&O9*x+CEjOHTl>_pN#+8GISudes@`j8Tm z2CLkHJX>Rx19cXQH9)9vM2+fjwaTx5C)YUax2gz>x-LMwqC+m2{8tW&;f@E(Dfd5= z*U@nCQF4!fM*Tba8aJMUp=%`)UT|^n=V)plVE7V#rpWsCYV=$||K1Jz+9B1kmjRv1 zljxi+hW3#Q5;@!hyJL*cpTS=ObcNj!uQ`{pu$!PW#~>z+2@`RX4>}z<-u`ECI6Pa{ z!s1M^*@y(F*mFOY$fgwSf6j};RCu^Kva7FpaBAait0UHyRnl*3B45(i zO*FS{9?SX#L*00D`zH7sc3}A7yRX~OlvsVk(&2~ix_(1ba`g>s(@UBh(V@+I4mGEj zG&`choA(|B*yC*Be*CB4{Ub;x^5a@Q7k5J=uWV2@n3P77+!!Qk`k-OU*`z5a%$dt`xAFs%L6{>*%(e?OCEq+wN0om-9F+;Y$TcjUVSSJYBi zQWDU_?=&jd8|Vw}k*-Mns;efVgY~wy{C%sQ>hDW0zheJhShow-0Q$Y+NDg_W#u^xW ziFmG)=h#FXVOb=hNdR6rp& zvPP0{Eq<@y)C})V^(11w2~)$8sfmWBZTGHCPWGgfG=(XobEZ8_%i5bJ>do~N>n9rO zr*Byr7-)-e9G++0E`w;&nWIgPP(vi#I@#HOWL2HYVC88o51UL1oYiTy#@pPHhG--^ znd{y+ncxKj#}?O!JW1|BK7*|465ciFOoy*KEPe*~)(L;RQup^z;4 z(_H5rjWO!3J3e;s$i^6T$H$Ir+<4?;cTh3KkZ$Rr*<}Z>=)Iw%@A|>jXRjFh@N7r_ zUEg`|krxp^pBdJ^V|Bg8my>SpXHv@?_>UA~Dg_%CYOYH)ir~LRuPpTOE%c*+%Ur+o z`a`q%g|EG0_1XLtV;vu!&3E)ac-MFG4`v>DF)w|+Rr^lf%DZ06^VO>-g`0}ur&5Sg zTFQ$p-(sf{?7!NEqN%d?MR|}3?YI<1u*5n?S0;s+z;N}K-@oyW2T4-%hSZgUQ`2u= zMv&n&>`DQHovXU!(DAFn#>vvC3mP-x{ADredW?v zDzUV;-Y=4r5HhPVyJ@D2>1tx4(NvSM$%v%72b;Ru=ok!gHV&%K=G+T70v^hpJ}tFMJT3J} ztZa26mH1!6Xt~B;y0I}wH^!uJXX9Xv=q6;Vv_*3|Tk4xnqVl?hI5dfVkT|rwB9#$kWMAPv@)`0la#OM1&9i&=c7FEgz@fo| zgDs8?v#nE;%}(F;!LGBDW0_gsgfLj0nzE2hP;8M5sT={b9OY;8rFph*n9Y}Fn(R88 zpB(dLV8evU*@_gEBgMu3$d^+<#6I|{p+7fE)sFgPSjRTdI*Iw~g%X#S7XCw|FVIsG0CY)Q@L z<)OKjLBDu5Up+e7iCE;}(NmfqMJrD``JgLyZl3+k63mg#-T71@`GM90o8Gx-1nJ}0zt>mK0ENt;M0Q-4?Z+Fy`d%R_|WXsO|2V= z!yg^odiLqr~&*&4{)!!#t&~%*AEA#85LHLs`MDhwYCrx2A7uPZmat z87W#^T&mp)1t(>6Y#b3L1OM|Bsjmb;RQHi`oF24Co&zaYwuq8^6ni-7701>v9Cck2>LFuM%S zfSy5b0Zbz}Ef$!6pC?;4FCPiwoZf3OIkXi16szZUz5eRYw{Sd#5wwcMS8!TNDRs|R zGIJJQvF4d$r>>L&ZzKaLargYY${=NlNDJNFiqz7ae}sI@aP{ZaF^+R6*np#@Un)si zI%T(d{-gdZwrF5~;BSZMKk^p9TaL-4+XUf%X&V3W60JMj#_- zbeK%6UpeN22me`2P7R4a#Tn@ea%1<;?SZY?CDN~AvFng={YM+ z4}ST@A8aZu1Ummyz>$xDbx0zgspZY{0(!$U3*6_NS)h{6Eb!)3Ib&o99zif9j4DbL z%@+AIS>wEdS~pA7ulT5f@(V{9ln!(+Kgpm(^TodY@ly)i5OmsHf&%||;SGh-}2W3071A4%Qd$m-ccBxvNHxLa$B?pTsnPSv~07agzzQgoMNr6GL8FXCKmy zs3xk2bqcnaF0~QjYu+c*sr;i_bdni#fkt8lYi5eP6oSQXwt5AO z`_ls$MgdJ_b!sW}5Y}3!C?1Ame;vg^M4%I|J0e3}NDgyeN9G>h-ybrdIY zn~I(DtUB=z-`E6o7Cfn2n(rvRO!6ZNeVM?H-R2*V56}!C-w~SWr3Y`qs5H zO}bdr<8~YIXRICJM0Z3-2~M*k*P7(8S)NyN)4G`7ns2pIz|f)-(XRd>YUNSHRrHHspT!%tzMl$kaF3z>lDf%%G3wtO(msA90aX@@fA* z!6qFbuuFBI`6=pP*(+AWD9;p6f0LqOa){DVoW!4eI$u5w)%;YxVxkM4L$DB!0X$VR z=!oIC%9-k0n{8ga+8Xq?y#QPo(zgo(@!!OKu(wcG}_z1Nzc{6#GOzwJ)H1 zIv=PcO|&%VLZ<~(^m~>9C65uTieYt*xF^sOv1#e1hEQY3%uyt+U??_F*XrE0OX;c~ zzO2hy7j^=kI=E&f%jmvshcmB_Hg-PNnm zA_1hS*oA_pl880fWJ3bBrX<{AR~8q)yO*1__!3D1askTl}$>6`R88`cU_( zB(xPji+vaS4UkB2q!qbO?%cs^8Bz2gipB(U51`< zN}Fd;p|FSd@t?9+GL&5JAnCUx+=6GM4wdlyJJ})t^Mva@nO8JEl$R#3^PkGwE7=RS zEr$JzYqc)ENategH_XUw#i`+zF$NYYAn)PNVc^I(HkA zkMr3*p%Y;={Fv>^a>5}~QMt(gG9^SM|IA|Z;_BFjRhl&0Nq;5}rpzWE&x1*A;m7h7 zQR6whRNEcS^=&9%>h?Q4XVRuNI)MH7dIQ|GjD;O1XWSR?R$LhQpN`X@> z%{YuE4^U#$V>C@LDt27S1+pVat;?pz37q_k!fe&68rvEeo^e>jg0Eqs-ojD}R$;N} z7$q=<(U&Z%)GqQHD4Gp(gZ9~><3u5ht8{5Z+ zvKcEvkd1pC-NP+u(%b$-a$ksjM5{IQJ?%YUc$B=dQtq8oG<53Bsr1j%S|ppj_ExfZ zxJRUF(q#J+c`&V(eIySi_VzuU_Z}b(kLJlry4NWBSxA?z@Tk=;`YF@EMQQLbmmJyI z=W4I>0#ef|hBgITBHpHug`~6;R3)BtZ&XxCA_8b-j&Qi$Cj7IqRu+A6S9eQ{#lDjs zYp_zhiXxPh&8p+oywVo72U|r$#I18S4n<{&0o63mv!4R8V&%qQsxjCFWd#bf^bfKB zP{3?vxr0V99MKz$A!Ep8L|A7l7jk)7#A)DK6BMa^CbQ4G%V;@3RtUrwJByWva*=QE!Uc0 zW2h@E!t=g9jkGgH3seeWCOp>^b zWubU9_S6<8CUA%w||E5HjOoSGQezxN0KX8rA`PW_ROW9>Ang)oD4L0sSeBKIiCQ-0boW zD7`gz-kZvh=)zl}A^7mpPG5L<)^@X0ve~`K4?C6sFsa(+2kbM<2Fx1G7CJgd62g0r!C!B6e2Qb%SMNA2nxtqZ3 zUUNrFij9?)9?PS4uUn6bT&%U<7i{v0xGL7t=Zm!mw7@VflZ(7tXcH25dF)+Ko0Rwt zP>xm`1(|kj1A%yZP^%ypc@Q1cx>%3j-?h5_UrN_7EBviUA5*Bwp^xc{)(rvZqD95DPGlm8@W)^pC0c*&nYmhf9Zm%WhF{ms-2R;KHAvTIGQpv<{C%q48(A3-Kw!>&+f~+ZreAwduL;7 z{nAbGrq+ffo1hlF5CV*i%8W82=OBaEut$x2eI|;y6;$Hsz`kNi z@Lu6i(*>;jTA9es(lmhtFkZ_hqM9zj&Icm0Y-?5K76&R)i%Hqax2A$_WgW_BZ9si0 z3G_i=@@w=wiHgvC3#5CZy1V=_dpBSW-r62^rUN#ShGzci$y|Wbnp9^=C?4U~cnkL7 zrWKOs1VFO-WTRx|`@)t)wzC8B0idG>&=LAdWQ&b&YvnmM!iEtxQV+qf&BU^ZH%yR$ zy{h`Qh=&y8PdN8AJuMz251r4<1$M4BQvt>tRdYDwPvo8Z#HOe7)$`QM2)+omT}%kR z66_#5(6wL(1xS&Bh|8Pojp?C}X>BV&vpf#atO0{QCRaLW)iRNws|Vs)b%|;(*t-n6 zu*YC;7>+Nxnt+UX6i_|c*3o9HPsXA5lB&XKZgCE2dSDLdO4~Ix-*c*)2L6UtqyU+1x=v)4u`Z0gxljiabvv`Jkv}We6 z70yO>Je()9?8Eu&KELD9yx$!8WWHjS^X1(tD${Pua9mZ=?RK2zD8}T9+S1J)U{rd1 zy<0lnEeR(@6YvwWw?5F4^Q7A{9(Tw3R!cHurzzss6gYCjkv7$j88r`y>4x32X;Rtl@wW!_B-uPd)9~YA zGeE&sz0Ra2%(nw{_gBUS%=Z7QGBP%YT1y)ZBB@fT-F0rYUqp?Znzow7YXP7l2=IT` z!nnYT*gxSqQU`ST5jh8nGc_X#x7lMd$4xB4nLP1Cv)jy)nZ35Xp=UG)$tpKo(K43= zJfN9;B(%ADqy_-0>amNcuqcGegT*D(yWm%9DkTg+eXcfX!DhonF5Wumk9Gt_is;6i zAxT1YV}#A;=x&VzixCh<2A7KnXp154HyVSDE`8L9j>vnl@HLHHj>gNugbBy@Lnfp-pf@AmEvjgnpe-rQFi7$ zcNMX}0$Yp%*DuD07NV8d?+7e;`(}k&Zx^j@QGqVU2({H{fM~GG+gcYhpsdzrfP4VV zAuV%r;k|V?}V6Sc2opTh_91kIAN?!e1gdz1wVY zi4@v_5h|O>U;%yX3+1R(7FX};3WEllxcA!r!^Q5EzL*wx*;Ik z&tF;fN}YnF(UPU}UgRyNyzq#{V5}S=0u*Sf2*#FTvDhC8QlIWxk$sGbhK&v&sz0$6 z!xUP;7?3K%-j-BI3xK4<;IomaLd!H=dHwApFL6rP7;Xk&1vN#3-G)&dRk$K`*|r^x z5Cg#q=WDT-u$xI05|wj(VbqmHtcVjmn{$#@hk+GBF2W1Mychf+284D#8QSAuo)Y($ zEBDGn>9c?fAQ65gGlH59IiJjfQ6lqHzG7U(iS#hgTJkTK0;Gs6&!ii2TQ6vr`Aqd}wphhf3);m~OnOT0^}G-`#~swy1kdCF$fD|u3_Q4zdR zK*yodv5JzH7$IEfJLD~hi0F_WnF1`f9V|MDP8?V3E(1?{6uU-x+Sg!RCroTslQZbV z^Lcfy;$zE?qh%+#$%27IYoBOd=KFtfPLJ?wW zD~IJAaNzU#>XA`PX=r6#o~-K1QGv7`QcH)=!BR23!J;OxFXFt(XR&%j0)Jh>sX0~5 zYw?N{$!b_l#BKKh`F5yOe20HcDR3mo3;cV#RKcK^RjYuoQ!4`@Kd0dsjS0};lk;aV z4>2v#U`ozDN6>E^XIZcQB-V~_2*A6?ypRa%PB?aGww5gbAcCaeVBHWPz;XGN*MV2A zx(~earN8Ty7$aI?78rruhO!2a#o`f3^aYYrGOCEv>=Gyit)juN2A7USn~6liq1b!cnxht{uMDIU6P*Tkr{0Kn2Hj=fi6W% zNT{?(nm?TeFZMn7PE^h$eY$h;)2QV%Om2hTx{?qPOT9N5Gs)x1h+iYdBQA((2MENTmp6;qd%l(TMa!?L}V!wjbdU5nXYND$lto?F34k zL025lS9~TV?^l&CqY;u-n_?cDPe+rS+87Sly*lb4RUqUs@w8~wYJvf`QOSxH_!NWa z2`md1TaVPir+6OWgjss=8{jFZr@^;BPYbj8^6LvGQ(0~XmPHjbr)3LMN*;F81LENc z6^GdrI-^m?3j!$`O(G}E&m&v0UThV18Zg3sfF?c$)@MWEK78lA2|Pze%7+Ed@j5+G zNe1{JU!{fD^A#V|dJ=pm{C*Yte!G&zfU%)w@oy{n!k-nQ-XLDYF@5=r<~51!t3HxK$gGr=VJs=! z09Y6cR@AUM>~p(5F&(3ndKHeU9A>Rq%V7R^c;lxI5lX$wXtb%x%}*6h7Jg88^`?eH zR~^dmT8_j3^gn>&AHNYbpb@n5vjExQ3RVNC_P@c?8)`oNkEN%74?O)X>au0)ta$p$ zkHFL8jTTsYhb=$@gP_;3#WaCHy>sE=F{Q&Sn6)(KPlPu;dWe)CURC(%lV~5>jC$b1 zAFSuJJU|AtVt--o!5a&|FT7lM@pB64;nk4$cF(J^wZsYV^gX4ge^h?@UrJB^e~$y& zFA9?+B>ii}hd);Ni9~s<*!j&+R#Vv6D3mbtiZ$1c`$+Ii7^bqD1&fA4T|W23jT;G0 zbQukH6-wOm;lf`EZ(R}FxM@R_1)2>bD01p&*X(%XPbhIaSOpyDK^R;9-MkuorSi!? zRsQ6E`an-kH41W*vqiGQV#fueK(qSV32*ViA=x!F>h!xOZki@Iozr9h`0U3YM%j7! zxg+Jz{hL1(-n$L@DoI*}fPMFoc>?4bwP#&_(kwP^9F>2= zK0o={M?P|Swrkhj<89X*-oJH4o2PrvN7u!sCo+kNokwo!jBl7oCnk0rxe4x|4fF3} zM~E=uL^ewphCx`T9!NW$n?Z+iEQ>gC(z1@+Q1;MLMayYuu@_U*j`KN-bUT+n-~C0k zS6U@fAtOeADQx#8RB7-SfKsOM&lcWv7=YcNMwgLFtyz%T=UC+a=sb%rxnHd?DWPJ1 z5hrjIr&%f9q(urw(R+OW#m1NeFimuwcbQ0*9$E( zsO19VyQElEZRphH2JD0@?PGPgky6|ULH-u;m7k88`iE#8X{i3BjCnxjfr>IO$trGZ3y?Q zjQ1Tqe0BFXbwC2WRw&>{0mW7$Uo7>nTbffMlR=~tY|~&TuB@NImK+;b_QDs}hMa9^ zTT@|ZGWmwrOAW1OXHfU^I`cfWsf+}2xp?wSRwH{5r326<>s?#Kd0%OhrW5jQLrsPJ zq&N9SUYbq^=L6)`QRex4#hh~ecQRT|*>iezN#tGV6)atl9I;-{Ipo$maJ<>lwEW=5 zr!N0Qqnbwv1*>G}#K^X8*ap|$dD+128ZDt>K<{c?K8#^oKpxQDT*6?(HpuXF?)nI)H{!+rI3L8SBsy}-uDx3>*U z`odndmUX*rH0Sr3ef^s|29Iv+0rq5S0G>ua|C4zZ|1A+f5=dIk-_E7dIx#6mX(qxj zVkBATOu3vEmnb5ZWGaH|Tq^&%s54z)M3rtzwXuR5CChy-eG2>|*KA~yS-FBbS)FNQ zE}Kl3F67TUU9>b^X&tAc;$GB^{}uGy9l z;+i=MaPlwa5&Xl13mK5Rew=7ebi`dVSUjgg;t2#v#PJ5T|Gh+AN4%$pYM()E$LiMd zGpO@?4wxY{kS-*H3?qA_ywi@Dwd*7%0%M~d3+Ds` zvGUnBl1VD~Tm72e_p8+)ln7<+7D!56GW$jz4A2LEo7bNL*v^1dXE-E+ONNI+jy*T`a|QvYd`VK6Zh}!(WzLyK_jJS{_ zAevI`O0xcfb$xw-J%?Up(Ohts)nCY4*R%D7JbMn2N&(G9TbL-hxh0|~C>1H=h{mQ4 z5`U8sUCGXH&sPrZxO2IO0)KQzZG&rebZ)5aMVC(0Su6;r*Ug}VF95+KzE>e`=1xie0VuSx z3w?Nw>vMj1KfoDa1TDT-rGHNqeFgpsTMmE?MW7OHNU~`XhXy7yw~o^gFx8($RreL% z)aZEvmV}^_Brli*vr~(s$A72dE?4LbMqu~}z!WtIJoc;mf&5Z&wA>KyH&YYa14M0Y;O8MJ&>&j1@dGo@f*tmq~Tn?G@fp&0Z3kyYl1HVNQ&1g5edEo1Aqenk_IKP9|;IZt{B|bg!P9)Kw@R4*RF}{qh7r;;K5LW zQS(Z>%>=Zd#{w})@70Ho_IwjsMSlXA2SZk)j;jxAC5 zgSUm4qyz297DiUoz2Wy$BkOsHNooo8i(rxtX*wa_F_JChSNQAR$V<~f(e6I4Xg>#& z)Ryd*4oa4o8?w`4lI zeX@;XI6zO9%T4X?m^d^MOf1{q*E7{(`EqL8#uYigQg7EVW=#>8_?`7jx73CDGY+jt zOTZ*CzP(ifCK?UxaJyK}?=}1Tx3u?Ny{T7?Q*{8CVDqN|E_tMgOFnfGT#`xxDB)k{ zS_^TB$Xo!IbY2vel+6WU$$4js7H6x4N+jZ+3rZe@)jb;S-U!a>J;g&n=6~VK|{Xg7D0(1GDe%-W?}K+MNlH*{G8Oe_6$HJUjeA3 zOXlSh*+@&+0a1w=2}ckl62|M4;Yd7S_Wss^wBYUSWEMh`_*#I39S~WQwV;VH3sk6f zF>ibkoe0uo?cU$!i_^uk5=4owh1l8wu{8;>HCYRy04X8ODpT-0{gj|KITxhJ8W`Wy z`_Z4@6Q3OEFsYRoNddvYMtU}NP2ag8Vd>a5HgH*>1W?-4FcJ-+Sw%+mlzOEeslNJNpUCD6n`k}fF_wO0gw>&t#>IlFk`uK3hKQ`R! zP;r~qH>~c@09=AK9ldhrvQ)zcfJ?4<=$R)T*jL0QqQM|=Du7F_dup9C5gXaM)DLlq z(JA!pjUV0N&dRuC8sL&SAZ4vc6SA{}OWF||62{tJP}YTQ9)fnxpwuzr)&%^A-cja{ zKU1o^lJLn3^4&&w`-!}9D-8z#HB>$#T9$Z)mE)8WkpkzylsQ}D(#GCrcdoy6ZA@wQ z)wOzuk8N6h%T)TgD>kOK);a2eHi0pw#~T|j3p=GhuwPF;`@}s>Jp=KT*N(RwIsVla^McaaHL^4|zPsNQnY!bh8^WluvoGTCJ8_B+%U*S!@ zlGky6%9rM(%x~wZ%B>^M8jV5$T_$)g!T)hyT0^X%(8UM0-?nP<<_rw90Hi^&-j>y! z13P*>`lhLYE7kBSt7fj~+cD(hJ#DF`)jd&;hfAO~cML9#FW-|hyK_@*^`mJMy27_~ z$xxHq?V?3sHyDjt-fS}kJI4aH`mj->CPlqL%ez~arG=2&V0BxyB4>Bm7>!lWg*%r7 z8n;Yjd5j7-_d%&n%)g88Abdy+Nfk4-lL<%Cp3;eNF-$WdCKPAvCPy6n8AnValZZP) z3YGWrRMH-PTSu$Pci^k1=Dv06R0(NFJ>-OJInL0cMeS*W5*B$sM=56IKqr>0w^^d#q50ZbjEq zIw;5gmF8fwJxBkmTFnK*5dmAysfv~VR|!~n?%(15*8@)OlYAeaE%$wN=8TKJk9eXk z60!P!(ILA(m}7O90c6Vor2L;1+_vEUfcz`e!WbHPsviF@@*PDd2y-G|cNs*=oQ#zJ zvx)Slsrk3?j{;enLHdzfCA`rRv$mha7=#6Q0{~WlH&~A+ z*!0WxmKdH)lEJsdt=)eltJSB3;sjVZS%E#QU}&=Gm-*sgG5B^~+)8%;F;7-&QwgvM zi?x$wv4isg5lP1`_D#W;r*}Pj_2j`p4`T{t8=;Py`ymmY>d9XjQ^XM(t?O&M&oT{L;Dnfu~ zkFh-4vg!IBv(MMLaxW`ua^iA8$38&E1AvZpfIl{s@P`#~AW=X>jk+%C z@DZ&0ZS&T|f3W9=9yw9I(d>RZZ{Er#{v*$x4|Nb1L>-1A=s3XY-N}w%^Sv7<4h;KP zgFD$CXnkNEAd>s@6JyC?uPx!TXql0vi6Or=?zaHY@vpvZ2d_S~J=okHUvb^i;P!(@ z4{i;%W>c%L9os$a@mW`I+q-?Wb>|kh&$?>c-W{vqj$Hv>_H}?dVnu(5DJ+H@I#Fjb zAza8y>vi7C!{S?&s`*sstEZ*%?V>}Zv>m1Ub6@~1zE!1%PXU2-TCU!%@P}m1!5~t~ z((3?#0`W5UHAaa8$*-bc|M>d=jxd564J%YSiv&louYQwfHW7jznD<%%hQhTRcIGCY zF|i)6lYRmQWH1Fyy?;OlV}%-kO$NX^EAXFE@NX-SRh>ZVD)5&WxSw=D(vJeW5=#2V zFm|{adwVebLn|XLmy@T=H~x`d`TxXGyk7LOv-8 z`BquTzjYoVe<_~s^V^VSAv&<@fz8p;t_B@2!X*cY!rrv1Ywf{)t60CTzhk-Epe5Im zP7{Xn97ZsliYu&dGI#nm-ZUcNlXFk$R>=+SrEj*`~8u&SGt=z zlSDdAMcy)O9rz`6iGtk*#-`g|$(KeOB5&mlTd9FxR)f82$xc)WtqWP1WzwC%TQ#BX zEw`^-y1(B|39d|Es`G_wO_{owR^XxKz|#tQx;Hj)_1acV^4e8HJNn#DX@hOC{;Lx# zs|&S<>X&5w1_u31Xyc}}eUZenLxZN3yRN!% zj%%^&YB<7AfLo35USMTTGVt!>`HI`iz2Q*U7rQ?@h@ug`KpbMf+LamFa_z$#mK{goFHr@TLYbOq`%DPow5!34jyLPVZsrMOJA+v61=?z=@6MFn`$2}ka#2trMXT0sp zrY}!Ve(wkWc<&l-`{eZ2=7t^1GKpn7ufFlKI=Pt7E??yy?;toUrKG){vN)kvFAZT}CDAGL~bqS_4kUCp9fI zXy6#VyzF7ijLV;uJF_L@GFmh)W8h6oQ@{Xw0N9r0lbqMKL@!`l5|V9+cgmjAxn{GD z;LJL7^vc@?^y)xwL-V%DEXVK!t>n1e`hD%w*A6*2Pse5VT=otY)GBu<3^3))Aad?N zNI*SXpT23c$JCs1dBR?u$T(b1miPNCjY~I0!z(vjarEvLFPq@%E9cMPUjUR_y=Y;s zIw!im0!G(Qq9oFWG@(R}9hyx30Y<|o*^_7!qC?Cmaf~Ww@^WAH`GV`@aTr^l0rM$g zeEknne0>u70Gp1(@H+V9c)nuRDsT2BTbLJeW^c1Jt~mI>)Yb=^R7wn|qzL=)ww`5j zguVZEjTTq1yq4WPd~|Jk=~Q<6WDC!53PwfqT^sho2zwYt*n8HuSkOl^+cz%n@WvKG z>?)_<2}A7AlPw680fysZ$^@U>sHcu;Qf}~Z<`~PCVzCE`b@*)j*@p)1OY{V~@+lb9M zE}l>$NP`+$hchVhLZU8?$Tni+Slv?oB$`AFU}x80!UgD{EowX1ZoOzFo{%g=Fkg<% z7iWZqVgwk9OCg3x9)}R3HXAOW2yKN9{Gg`dHb?8)qo0~iEFEYusZSEX>iT*spZ!A&x~9+Q zC&8{oD`{LZ#H)~mCYk+1J|_96&*b%!6dYJh#iF_WKRk9m1}Mk?`RPQmrSoUyH!Ss( zY@PpBj!|P{NGqzwk*{GX#5MnKC%^?)dr(pCwok1tJrk zDq_ts(j*riQI|r&&1CQZRJ|I#vEMIMS0vKx!wM=AMpV_kH)UQ?^7TDNV;t>v*n&C z@W-PM-kNcy-9r7Adp2BubvPKh^0s?!-Q$J72Cus9o)7OW#o_@bNg&^@Mbi|ZsR`0F z1;|kf(<2rx;-_Jte)zb5SyTiY`*;rMW%*#1Q=N0NWqRuLVx(TCDl1QO(Xl1Ueihy- zMfiuG&x5;Z>GmoJ0Au{M%-V~G`FXVz^J7ufcM5N6bV`zhU}!0+6wF#F%>V1(skp5Q zy%Feoofe+qC@AqC-%pbY4bQpV4*HuoK|o-nc<*kp80G%~;LslAH??TlSK`k;K!hA% z$x;S@Wd^(KShF&55=|jK#0hbeMeM}s%%qTmm}ikbwK0=K+~=ifKfoL%B7en~m_bv= z^S+Ez23)0abncP>*MiYYRw6Fq9K^M(h`1V*0!!k&Nso?=?;A^4Xtlq$KD&K+mScH< zJsFPTy4LS)+j!lOo%eQLe)pDlv5;0J;VwZ+Yh+!4pn&>%uiCcky$4hj&$c&8P7;)y zljJx#ARx@ZfMk#)QF0Cv1VKQuB0-c45(OknmJ9+)PLh)#NRASf^v3_W=bm%JdFy`f zt@W+slVtUQtSFiQ^ z{YIH3KjPwk1BjM`(|F>zwbbk}m>N{n2h{g>e8Ifdg2}x4J>05yhkW5nN@!*T+XKxL z;v{x}V8I90YPbE4*mqlJ;`B-x!GjUP#4U#|Z+*>>StuvTgz(tV)*Dak3S*1OFLh5h zFFAQZD&wOy@?HF@Oif8+{_Cx~MD9z=SuyJQ6Dl4Lo|%L`iG#dhog1$_7w9wp_;i6X zDy_41o2A)W)n}ckm8?Xvz2^b>CRLTX5tKbreP?$&J!q)RdGj;fTYnRm2_-vnz9N%# z5p|1KZKhAneT4}Eq)SpBdq>!j`x#E3VgIciyrAAwCZ~dP;YXa=Lhu?>Ztzr->Xe)C zS2nwdrd0%bL}%5*!04W7w$_U)_1l|w1bj^%NoHk*c-*o|REWZ8o&IB4!&k?OI4< zt~S6y_P}D8=i#~TbBi}Ozl?Vy9zRlu2NaLOsU(^sbLoj)ixM1wYQKA0+Rty;tEKdc ztA1W(;0tz!;l#e7mMd)_kxR&rvX5ej%1`??^Ejr`uiZ0ap4L!$)=sM%$wJPuF*OQ4 z8ZHQ_bKjg?NO(xfRjYh2w=qF@lDMhla*oO=GTX*&V*4B9=63=b^>wr9u&GSYjA%(} zDThF=6OM<-b1jsh%ol=KqlzLShoy!oJux3R%#D{_TIuBXd-^ApCpq5vzW*N2QhtB3ELYfLzbE_y$9LDvC&YR16xgq(ad3PK#^=xlV!u&rw9IX16zG@KO` zRe%mZDJ@lxak4dl(QleIIoDY{ed6)(s6PH?=i18sHK)m&9|B>D&1BW{>mkOYqi$|w z@L(Zzeabfq!qawf(66r~?4Ifjs070AW|TEIFmi)+^Yi24eg~LGKAd8!a_ z72)?{dDJIrpt!?EAglvOh&KE6D0*T~w^FT~_zRGhUjWa#^}@FKRuQrAaEKA#S?k6y z$1-Dl#G@cRb80YS;*w|NKFi|mp5LpqdU^@(mG|x$zV3Q`!s~dBVV^B}AAp?>g^Q>V zyT~R?WW!|>7k;^tb>y#c;C^2qGYe*3fjq7Bw9|^5ICHlX&wof7k^52mOJ;++Rq*iC zTaFg?ZL{@@$hlHI2SjH3se)GT?`fyzxPeT3zR*tdOvG&&zT`CFa%+3vGu?vEyJyd6 zZZBN$|L~uHxn$RZQo-CwFllFN zLdvZxHE~sxa-qX3YSET{kg%B?CjGky?Z0SiNH^s_DYDkxp9TiLpW^JeJ^h@UF|$=& z&VeLlX;3IT7H21~DyX%A>VWPJ>i8~GW&VnZBq0kp;b`yHQ1QC&$b%W#%9{bO0KrN* zQ%RldL&7)mI72-TQx$dlSs!Od+P*PFA#a#!VgD#mT$9#vI7)Sr1&6Dd3ZB#Gp8me0 zS~Zs!py&Ij4lplLXnN+@}Ctpj_%-01`<}VV2Nq{e8^lWjg zj)U1!!&DDX0BoRDz0IH z={*nj$RVGWqzQJeJI$_U%%YDq8f+ug?X5#7&JyN6_&*gY_%6Af7_bHU_DsGvli(hh zY3JDG~vf%Nh%wEl=d9itmUSpoy9`vq+LT;loNq4c$N zc!mg}mc@K!@qSX(=>u5Nd4-?I1Zzx`!1jEgqUl%f9OL!F<4UQLI~)DA&Xd~p1)oaa zcyB7h^_JJ)9d3sDqTk@_41A9DIk8-eXf6zjYNzN=RjxTbn^q~I*ioH1ce0h#^}DP+ ztPE-}+jC>8@xLAUWhk%4;Ixb3h0~Xg32RS0Z=U1Q`BmOqvUS$wW4a^#;vYo4Ep;C*!G-zya9p89(lP@a(_+EQW`>|oEw=QRPJ3NMJ}A z|A_N0k?*-@)MxoRfx30tix4`IXw)l_TReeg^k*6}29#+)pu8o{$!<<8wD6 ziumLnlqupz7~w;l*z|TZWtG4Q`Svwvv(k|){@w8d*o|B8%J+jLfe&uiZgIHZBUhoC zYZlddPp5pJ?`D|n!N;;DIdL$sj*xz~5?r_Z`7ro~-Lb*9^;r;K1 zdz~IPeBT%mt&Z1?pUNC(sy3+pWZh4fS`tkW^@Pr^2@RbYDrMwIyCS>*DmsPKXKWEp z{?xayunQefI7?q+73nX_6lQ-Um;qw!6HBb3QJGdr%`mVVDd25$9e%fD6{ddb==dbk z$+39tP^yixUWna{q9il(a>SrdxJ5e>U?Ehx`LVdrIoyy} zp@qArFE`4HP}Ryhswk@%oprMt(legLR*}X{d|xj%Cc5Lkt>y2ELIZ`8Zw}QyHM9)B zjp|$6oQegj9isTk4MfXlRP2KdmfnBZJWx@pHn6W|G;oNMn^uaNPRL;pKD4(}v$F^+ zdV+tO#(=Ch%jH+HvM&p2Rfc65<6NhD#Fboe}@E}or^{&y(kcJTE__xZ`*ra5}&9YmMiV!x=g@xbqS`TM6cf4!; zL%zkMK6??B^}>4i{*bm@A?>YxJJTq7n|HJeqzwW+f4- z&7&jy&e{w8!ofYaDXX)gv-tkY6wVJ{bKE?H-alQp$ZsC1vTB_FxqFo8mC$-WRE2zy zh0?dwAZPqzW-ch1FFed&F9&02FwgzLJ7s_4rzuJC!qk|y@PoT2N`A>Dq}%u2XWC~L z1rdW&x$m}Ak#z55Rq(|Scj(J8NI6P`dC7P?IssviURbqE85|tElxz;y4^eg$@=1cS z(YW|H>fru#$1tH$&hO3CcDK@@LVe6MBg&yt!gJxIVYw8(#7&(n7gmINA;G*zLhLII`Lu+2 zt&22;;+M}PW--CJjdhJ*Np8(eZn^8i((kJKnYiljNtL5H>5|_s1+j3gS}nX+aSTmk z6|=#(<}4T(@g??7-KZ|@Kw690@Q>C%a13I-kx26l#NW}H-_`SD76(bSXaI}DPua?4 z3FRR1-B$y*dm9J8=+UFE?zZEy%D3Dr$Wgjq`ORk7-_=s?_v@xLTG6NR)td&Mpu=GC zqTVFFFF7My6j^(mqaU{nyu)$cUgje5H8*)SSl=$_F(2U!Xr+IBul3+?iTX{aqc)RD z4=S-!jz2fg=%uDpmnQv35pRYvJp0YnKR!3+~ge=l@=Zp1=?rT7s%QNO)GEbWRFUE zMjkIEaWJKrDNKEC*K?{bgd`mDBn#(7B%P!NTJy&1gb$|+X(q>Fc+8Gb8L67qvj=_ z!_#@{otZAb)H;{TW{;_(pSwR!a_gohI(zpHwn+!IC&qQZ1xx!c7447FW{qkEGh9mT z78UH1h7GSGS$b}!DaK2kpgc<^4CN+9$H#{P0-eRSF&Qngxx2E0i++2W6ne_vPJY>6 zl8UXJaRH-07?W}wX806s3>?X9%x`QM;I`8lyheRD)u?VMDJd-pA?S$7JFp2QT{PA5 z9HL?Ue8BBon`IK~6(M~B`r#nWJ5;s8NV^eMmV#ZC?#7L`9J~?rW)r&PsM%B33V%+;86O*;fWCu+ z4}URlB&wSHy#26%)+HlKFPg+(P{@N}6Q&eZp49M11yh1};UbN!hA(x9$ubI67?(@;$pEY#cs`~>I7soms~XL zpM=MVlBZrfXqZSn{c+Q)xyJkm-EtS%c9lR1nhLnAO;f?MboO8R9A+M>TLej^+oqtP zrH(extXx}j))Rvz`F3QQ0ka71aUpa%}Qsy*T1{I^Zc9L_e%@>t?s(|-m%i`%p-a@2?@FkZ~ z04l3_cP7Y%)GK1}ldU7|i648+uxEtydA+7}fb84UB5B^!*`gmmPK9eJ4cUY~ zcOX2qDjx~^x_fyS&lYP-jFvtX{zbSQ2?#?OV;r&3ITp?NaN0xZ8#LBQg!e&kH1v{yht{nYEOi-(I<8+0$N;# zgjk8PT3SmKH(DBoWUTT%@Mi>9ofD8z0y_m%Y7(u4hKGUeM`rwI$1AHwND*}mPm{x73ZA+X`{iGm)bYMn>acn7N{1qeHN z`Zm!Ycl>HLM3^U=C<#;O_#bF5>o|1Y8;|JcvZ$~N!Z>>R`FNMG(U_sI&&AHlv2|^OyW5-mi8NuFZ{n2?4h?c@rVKS6 zXc_Ff96Gs(QVV(rB@3$CS2L^Xeoe>=Dy*moy9`T-?I%PUMBVcJ;)}YS5XP*$>cH7# zp+C(`)?Y5mnlOs)Ln_Y6q!WJ23?mpAuRk3qnh8yP>_q*7Qf-?|t1x&YSf0MJN#ALH z$>rOWZ@&V~#R133G1Q~{CH6;!o7_5+7L3d7nm70{v?YUSVIfp+Cp3PbztDLPW7=m! z2r1@-;KZNH4OV^Ue&g&)iFN#5XwUKa#r+*im`%v zt@~HwjFulVhBmz+CNDPw?mzdBlza48Fm9r{!0}*9ie}KmxrBY1;cnMdhzOraCVQ4i zo-_|^kvMho*!J>hfW_H+x%AH4lfr^KQ|-j`^lBaEf%wEpn@0S2qNdCYY7p2?^2hVv z?Ox&)zo<@TLEat@^8*@l4`S{zuLo=_4M>|#9A-Dn)C=rH*U z`>+s};ys_QGoEE@$42Xyd)(yRZ>>8c4aLSa=S$2 zzrO_bZu>;33Hz`#J&oGjRZ2eh6MXZnCFPg6pHuG9_t@N19Q|F{oxb>ubGCuEchJQ7 zX=YI9*oMpcZpPZ0tzCg-O#|QK(|iWQ0}Cl%;&9@WN~bsQZm_CqzTa;h(OWV7UZ)lh zZ6&F_4wQ1vAT`InVR=QoOeHz{e=ej*x(a`I{4GtW7ezOSiv3jeNcZQ~4{86{`2Y%Rc~}We-lDtlc1c ztN^Roajd$ROKc|}-5Z(s0MntRV?uZzeq&yer*)TRb(5#}EL;8Cc8JrFC;dRn%bCaH z^q#coXOyOT3+2@hSjR&1L@Q4sMcGucR8Hj5R(rx)-A%KbgFU}p@Q0gXe~vS-sV3?3 z)%XVgG5chDg?Rt{@SrxS#O*9fWWVuBZ+%z~%-Po4dB3@|ow(HW{7sYBAuF3CVnO7m z^Fgh@(WuSZbh*Gzp4R79U#Rp3Rr05qk8hBw^(j^H&)ys`bSWzB_&UeRtIj^U;7%P= z)ZF|cVvlLWXKiM=BUw&6ziB8`aei4j)7jY>QjHg(?5*GOM5uwL`~gVf*1Ua+Bgl@t zFSy)1H6k$jK=PNTtp`XTZq;@CG`XJcV3*V|dwT45ta3%A@|uyk!)GKT*AMYI(P`2I z1NEakL`^2C^_=~tBihKgSD*Kt~*?3--r@=q`&$9CxHfiTBrt^e+%4O87 z!2=7fEV<(J?h_HW1&Qo}EbIVH2CRUa+VeOzNjm6mZ7;U^5okv(e~G z@$b2fn1YU6i013PR`#n_bN7=ld4~y2M_{+2Vhv&gd`R-B_Bo29MuNLMQXrh03;4+q zmpiT>|D~gQt!F#8!?u!nqXEqBc?fxhd_ud^Vm2F4k=y7t|Hp3}Z^jz~J2EKU8o4WC zoc+T|PQNepG|@9s%1iX8bEnFQ$n>VtQYR1hEGNJd?`Z1>d}0{k+KJ7@zss$9ZoB?$ zZMVb6a<`L+dCIr$tES^kk*1Kt$H3TN7A`>^^S7w?gFu!sYQde0$3GtUd%5`dZ@p;% zd=|K{?LkMBxYboB9o)KiyN1$@xlsHoOw5)>ILb`)zP>Z@@sGzJ3XiY$3a`XsGcF-^4Ni_F2zdZ=_5n@&1l0 z{bpA0;vEh%Uea{M2M%FVe!+UtzO6DL+|_Y2YWjRIo#U~W{vT%hM}VgYPmUu`F(UCu zRwPKvcN=QBS&9ra|FBszQ^S!y58SG^YB6;rTb?DAvJ5y08h2 zS+^_j_KT~OIq<9XK)Bhm#4%s{KH)q=+2?_^-sn!ct0~Glqlv5PEG8xe0+w(M^3Pn# zEa5X*=Q&kxFU*3EQfhb{S4AIL?eUe*kg3-KH|{y!j{<|+_M_OK2xQ)*$f=e;L3_5G;m za9m$X__w3U4;Oc#!893O;5&iJ*cFR)#h(ktU1X)ECF1-}#^yM`iZMT#eEf?1-S?s& zs%@?a704u|3+85Ia}YZSRp>L_c2NaA34`V;;9YU`c~|H#s};P07C=VeVpdOERi78W zLuuA@F5*8=FicY{?5X)UmTt1!;q>MCj~6v)6{dIG%f-t(J0)~c>C?w;C8N4x&$WNe z8K-hRCGVl1scioeu@2n%VnI`AJ{K9(!3l~vwvzq+{X2eBPmD++HDQ9ksE}|i==b2- zkCuxB6XAqH%j~ZXzdkHG?=2FFNuXJ!yFqFO z&~P;AH`QY@DRWihZyRgm-%hx}gDBfb$QZsYUYsxpnKtorvs;H}yA`+m0AupCg$}9r zYz~TwNwdE-=S&o@L(flBz5DqWppQ2ADnK8{zJVa4TE4CU3Uj3w%?M5K$j>f?EdL=F zuUT~U8=GxM+K6h{{Ecx3Oi*k2G@EXMf=GWU-&)joW4M<&r! z&&crGkVZ?PSe++!{b{v#%97)+nSYXr{z#RgjE`=v4$@6AngtTw9nX$(iD&*5gXX?h z2QTZ0y^VHR732l!$?G_`+oIEDIO)mI%H3lZ8hJd^y`g4tDr%CuepL!-B-!83>X@IX zIhUH0zw0UpEmbakC0xDnG+$n5On{f(G@z*`%ff^CckS#!SrujDq1i@}zPpp&V~%xX zg@Y@nWJQC`!lEcuwWNoR-fF*Itw*7VQiE|_a^b`<@6m}U`);}+xre7qIk~9x(_E#B zN}HL5@xb#K```QLuDx~~j}6rF^TC*fDK59ES=Yt=Gy18exxhMk`rF@-Rb6?*6UzY| zD12`d##)U<)%Db70;pI<)Nk_JKKsUWcu1s_vWUP{xh~~S@o3K_uK<1G1SdtWmD^CN z_UC6|EDFq9`t4gIj??!8er8CvGBo>>!rJb5{wCcUQ8-?kaB=p#WtIQ4`^>k5KL1me z_Qt^vP($0|D@~u(uat~a4t@CqaK8sM3^wexb10J{8Tw`U)Qz7@E{?)vp$B%yCpw*Z zvC8w0L>@hA5j$w%R1B5Q(ia$7Y3Ib)8vb^T5o!529*6!Wpv$tw_p+Unrq6%<43*5K z$2+p7-kdp{G#6AWLxLBmQqt(Z&K5!aQ#kLvQIGtS_bgpoXxxkCB2)?X6(efHF}2Kn zPwJ^lhAxfPeVwPbb$>|N$k8UIX?N;1<~^ru%}UuL-(srhg+JLeUaPtL1!Zh8?=Dh! zky5zKld6;9YZm)GMt1dc*g5xYj}7aRh7TGMUWsb?RicJX{mt9mCA*UcJa9!N6?Jwq zmlEvDY0C4f%4HnpXJ1dcetfE&tl3y#m8Wq>W8&8IM#UY%7-WBrZ_=leZMtgZZvr!W zE(t$<-nlqK>8x=4V)j;5?;h6=7k=n2;U9bMG;^;TRD*OL9`LZ=yhk7JqiTMqTPdMD zar%RJC-up^Ro2Z)Y6nB_bid)PI1_O}(A|~0AQR7*mHsnfZ_9^=LuG5%JeH4Wq{i{u za@5?-723>B;&o$Y zaVhp~MYW?N_YWCN^LWTOcdg74&Tzmsw^&>FZ~)uXy&H z_JT^}up9gs&(yRU)f6$r&lyW`hk_D?Yl~%+?s?R84qX{yidCDs( zd3?~kd6ezs(`9e3@^D{XXMi*1X(CCe9iOWtU?eT$xeA`mqhxtTLm#7*-G@I3h%N9M z8b-Mr<+o}es}hU9tT~#7wT&yrtP{xw3UAiVy9b0F>))(OJ0ohoteE41Pe&C zA(Nq;oxW2TlESsSlJId^TbcmI4sof z&$z(jYSq&jn~shRk2+I@Q$8E^I+7_qVg6#+Q=&9{BD~}t`(irPU(Cnb7<$K+eMb>3t-qHWGNMfQi-j0<&S1b489qyA?AZ6m& zAPwoN>cV%?Z$xNelj;>kwCdq_ho3Zlw*^wotpip)J}O7=Og#{O7%@vZ^k(Mq;HP+a zG8s%iY~#0(M4^cJSzfPjk$s}H=6aM*+oswk-Pv|1-}*?)s!lEb-Pshi=bmGuI^L>9 zvVqt&%e-YEJsmMk;|TwY(dSZ%L4hcx95tQ^ftK0P`olzh9v4Laogl&=90t9ct>Se$ zZ{wnvTm1{(@lXe23KMM86$XwfxD88e&F0Q_fA47?l_~Y5tWN1D>3Dx_=oL%7QYhnN z8s6{TWu=jr&4mr`yD*O07NG-`%BTZWU)zA+-U;*DRLapM)3X&vJLd}OFCdVF^{r|@ zn6xogm#IOi0-{}0KZ6jlW1_Jcj|N}4?$gJs_cZaZlYU_cfQSt`_Ywn^8UW z-FGb|!%Una8ZNgosmch0l-f++$*%Ep8f<^-{=rFa0y&Rgwy}HlS(iAOv^|ETtK|(* zCx&vqiB^NMnDnmRTpDf*ccxk~-rcd;-ryRt_Hz&-dNF@GW1|%B)P(s^fqa@AQBRZx zPlL}p*)J`u+I2B4E*KWcI$P~9vG@7*Uj-BQs^RHwr|fyvcU7GiKg^4%4^PgHsjvgOq@VD*# zqT4(13^2ViYky18Vt1;#1ZEt_&stCHkFoxQS!Lc^{7eOxYN(5ErAIRx_Yym(3Jo9{w*`eiIrc+&WF&{ru7!BacF!-1pZGxo`qxns5~&kL!GD@g!sk1BX; zp$M&K!q?>Z?StFtvf^SFTme7lF2{|?%`Y5D0QK3c032!kaL?1N4}LE6Ph(ms`NLXy zTifrX4+L@CoSdpZD5pJlo_I{Ix0Oj1*uAX1;fwK$Z-|>q3nF*AE@!qjZ@DZ7 z$h+{~ba?LPx@UP_-Qn3CS|>|cGf22{JjlCJn$qCEb4>m*U}wKhoDKUvTh`xG=iuU^=|q&|PVyuCZWzw)-FZqp3U>)XXI zfgoRY!|*}8lMS35;?ps|udI@?3zy%|I2y0oh;5(k;kTTk&KS~7!acEw|BL;qHZc1= zMGziYNuk13-hTeg-8%(sdZ@?;v{%1 z>#8D!@*zeBYQRq%*vaUHeQiUf4WZa)%0=(phBd`X#ueoPI&z^O$yH+mq}y*8rR2Q} z<8ZaZ9IGQ*_BnPD%DwMd+l#P-*HvO3*%3;` z*(=|30ycH!>S#x=izMnQhax54G8_PP+VTZM@680-oh+w2)foo(+!Mr&kdg@viw%=D3XZj6aVx!LH(gWvD&2 zppozecd|ss@D!1_l#p3~QTU^7ob!IX8bKooJU!B`mkYiGXhz$I3*tCGK0PzTEnVS? z4;j};Mz$t}oZmF!DqPJxrk#z!ks?u!YflNGt~5%0Pk?WPd6fD-o*=KB!Tk;e@_8?^ zi)xYiQChos;Tu*C*^f(YNj8rtUjm6_lz1{+tmyYX=vxD$dq|f1zUz{zb=ZJ{@kY(b z4^TVr2oLWf|#@EVX=$cXlE=lV8NRC(x`o z7PG%CSAmKYRdN*#Oq;ywI8-qcmak${Tn|s2u}`mysr;p12&u3)r?@4+@#*o8aBA5? z+TI589u>2vb03|t%Prz@_B!Pi;^>QXBaZi{=t^|moU~;NNcP~wUWJ?ixHFs5eG25R zVlq3B1XXIK@}vo#Wx`6!*4qAB$?#o%EhtUFvF_5{z$Y|@ZH0vjN#?P$O8+<^v zM$8M5yXS?4~SoI-`CH(CuR`)US;~|-SmS2-2M6|BKe%r zz@l!)^d;JOO7l6@-0v4|Q#lem)bXe%mZ4oE{K&fEu(w051r@3mtG@VQFIVps*FDrV zG9HkXh!D$nun42zR3j08=e6kDPZT&Mwztq=_xjnSIh5civng#vkt@y%&6WOnRnt zx7$)k7Y=DVPrld{Z4(*^OJ#XHFd|vhhs5}10>-6B>~Vg+3OSY~y)>ZKHC&)6DR4DY#@+PP0*#+!Egg;VDU*WsJ_d}4bwbHiYh=yLJ) z#nnfE=s4(ZxMVi}yuG5!=kGw7JWr}6nEB*w-w$luO+=4e+6=8Y#vc$Q${eRDMvcE( z3DZh{)3w&{y!i!P$j2H*o)}l3lZWZUa~c>^^zUK6wDc!;_#V?O{Z<%3(Z+nmOH!ZL z!b>y$jJT6_*}lQen}xH&)-BrC`CD*6FL-uRB*;!RZy6jVl`^R!sJ=8^A9_f_5ZaC4 zA($5HeKoB8`8nt-hZr+QJUih*u3n6Dy47%0;>FKt5q9~o#QpxSbc4*_XxK-jZk3^_ zI%8Ib-@k34w9;23kD2J!f5?{;&a16%Zh$gUhbE3#S&MK<6n}@Lx0-y)vt785m`M;b zDNL4zb0@zEli-6No$NWrOUYJ~1hV^z1OW%H{<<3qNR zoql+Rb_5puCRIQ0t!s%s+x_PAUhS#ZtBs%{(lycWM{45Bz?<^nivtKFPZ?+8GS6`qP@Z=Rwm(LxwZejwDJ^C% zUTuc&s+F=94pSm6T%$(j5M-~9i899pR%#MAX-IQ(UJbrO^yL*Y)OOt;r_yVG))L+@ zL-f%XC@pu_zU4+fv6jc@m^4?#6gf-Z)0;_~PwHZI%^p9xE>6NgvXqM$gwUBCr70HrJf>$R|Un zJ1z&8{^^-TTAp4H;k_n`UV>rhYx^gneG93k=8a?X5_xx7BNb?d*Ll9OM}5iOmjSUx zX@i_Zddb62`gv&jTm^1LaFD6$fVOdAl1xl;n zKU`_=X5s_FlP%FIk`fHbWD3W;NdmO0Vb)pJmJy_wrC1F~&F(|K$ha-+636c3LjE?o{q$Pq#;I?~Z79vh1gq@gmyvwp&bEOsvrwY+>OyEhHlCcaV9l$*a z*;yv9;z+Uij=R9iPE?a+{xBi=WtKJ0l62R-kQkYLOIk*W5PdShLEx!~-HmP}g628C zS(dkz(s94w@Ui*j7gSCPbdsLH@o+zzU2(ULwt&R>i@lo(m^ zSXTkf^^6+{MATM&+RxXc6>_?hEkOykrG@6`K<{^M31tSP&_Yx!h5L)bWt2$0IQ#Q{ z5p7k4+uan7h}dE>YBCKc?I&W4ikYdT+TwHm=3?{~?OB3Eb48YqJtgKOvB8J%ua}USgA+!`38-`T8LF5phNT8o@e8>AcclUEJ&@KX0#0)1=4; zUrtDHxrU_&7rps;AYo>jS_iz`lS(bq7Jt2njb@ETZ z*L@8VUy9Q;=>?{4MoU8G&v77rcm55mR7$Gy4J0 zi(oM@o3$(`m&Ag;wvQwU(D7=>G|?;~&oz_BN57htvQ6Ml`>bSI9oNRM8ArygxT+}E z&U=mF^dD%rD5V7Y!t;l{NN(`Jh{<`aKeXd*bR(A=N#nX7khMnXu(8TaE2XvJ zu1t9N`m8i$776-9P6=+hKwr+Qb#1cQp2T<_QhI<5v*ueD1eSIQ)d}9^1e4ppLXXWL zgI*nZQP!TcTFs1`1njO+Qhgn}Bk|1jG42S=`n{8PRjps&H&`Ee6a^JUvd?b+i@ zuS^FshIZ=9b=1CKsF#4cWX?mw$N!>DmLa@~Q0bs9K3GY9TDB>#O!g3H~3 zUt_#x?AyH*yu9fPr=|<`yquDjk_MUyW&)A+kBka)a_am8LC4bz0cWellCEo(uDcYpY``AFQ;qZ%T8>DMukP?qzBnG|pPKmlo~Uqe^x}By z#bXnR%{SYB+po6yX4>GPw4Rp}dp23lnYzDDT5yl19-L5+Svgy}d$?JdIsKJ%F}J56 z146+7P5|d$X-P?OIXib(N3$n#E*9E$9*$O=9&Vmi($fE2918lU;;LpIZg$>=KpMu5cNKu$PZ3=BgU zi)%k|wG!7?H@CO4@DRW6Y3}jo8sp;T^w;4}E+HW&X8}QR6&DLL54*pTs3#s)T4v5RR#D`yXPNiYBb z0)SoA|9|#5lFkk?-4E7lq;LkGv zAPfos10a9pLjl+%0QKKe1pY-41i?O!trrAA{dESSAhLfR`a>Oi7k~r+Fc_qq91_Y zfXILESO2A*fq&W=07d{2a(}uC_KXC8uty-anP6yHG!lluHaG+-55hJ)wjZIfjUx*N z$%8O33%p zjzYkI5D-cpfrbHPAqb=_91a9xFmM$2V%bOhb5{0FXErfj% zAt#SDUPv@p76k&!!@vkA9Ep&X2f*YI*m|&1fWQy{1}KYyA+fAsuuq^cvKWvY5`q5H z(m)UlAP>UQkO!b305lSVM$5^f(NK9P5()xgDPxdmIW!aq#z3H0jlp&wEC+woQ^9f(ymSuh#~N6LeM5Uh!Vppbt|00b@v1Io+G%EEvs02~a&S|=Vg4II+1Z(k-2st@%T5C)Dyqp;*q zNGK2mhoC`VFt(YnEg>%}ht+f-HV-C`bwpTofMevbnu$SR^$r1)1<4}ikw`EMDF?)M zJ~$c;g3Dn|g)9P!mdE-56bgwo-ttgclq?d4L}IDPVo>r}JB+mwSgRlh!1^+fECvIT z#VS5X9)j)dXaod;MnF-r7;L8o$-(4daIBlbDy%FLh{j<1p{zVg77oMe-}QElz%>Hb z2wWp@jleYm*9crAaE-t<0@ny!BXEttH3HWNTqAIez%>Hb2wWp@jleYm*9iQ700HU0 zMK|2Hvk_M_bFvc9cJp-i5ENGxkdwg9dcm+$XV}SXFcJ(G27vhi0Di&$6mJ3f50MP+ zE}m`{R_>hGSdD*+m-v&!IAP-!pnrvCXo+L=^?}$c*q=ZREoo_Sd2bJe`ySXBjK50i z%m0=6Cs+fUiOv3dyapKf_dtgKHvt>}Axc9VfP=bmTgn|x=y@w%@XW zMs#o@{tg)kJC7@_Xk}+(>%j>G!vOyse*bM`%RMJE8*Et3KjK-o+km(@I5?j&FAHoa zs4}t1>+KqWYXq(lxJKX_folY=5%_lmp6TH;3{*+}tDz0@pN2MCR{t0+{$rpA_+Jjf z{l`e32bZ_MnUnO(tT|mT|NB=1{Ri9);6|w_U;~@ zkG;H~_ymW9hJ`Tzo=eQgTXm&b!>a{PzWg6_r)hHMJk>>OZx2bbkKQ)!j4l zbridT>EzV(;`gQHA1kYC>l^z&4-SuxPfmaR{v#JI4*uW7!XE!7*?*D?3j!`40RcV% z@gKQx@w~8K{96QsTtFgfSxsWIM>O1^KoVM1Y*u+2>20vq9-X<{Fd01$WRZ9Ok7$2M z_CFIW=>L&q|1Q`+hS%Qk+8bVb z!)tH&zuz0;y7~#=O#4ybuow;v;a2@-#!=x=`rpsS{~tR)F^|h_LV1xdnfN?I#PWIG z_?;5XUmbFc9i3x@emVTA5x_6|dP%r>f&<;&ew(?Inat>q<|x7OI5x$tdfx@FuO7Y3 z=F$JMnS!$>Dou4NG5Vv}`s3Zh>BpBznG`Pra8A`mgXsgUVlPflu5cuWh~oS?hO;;t zMjUA_W;{4Xp79&QI;FSc>o2%9F9dK`21X-UY!$C?Tr~)sa_t6BibV}K$uibu=yLbQ zLlNA@Eb32x&+wmW5E)(JP(I~)^!7K!d;YU$`9Haz0i7>zoMIN|E z?#KDR*n9JMsMq&@{53`<#3Ul?RD_DOXtm5}Lvn^xDwTF5NyzRsagcRFQ92p4&>|I5 zStffahay6jv9Fn7VvJdS_h>nt_Zgk)bl#u$_wo4s!{c6F_j=veb=}YFy03B0YK8_b zEV*0Lv98YM*Tt-SOc`OdgJBCP#9^s}>9t$UmNGI!;svPnzUv^2d)y9s@-3+^F_BT<(NZ5Xz*^Ei-#%TmReH zm9}>*J-JZxy2vp(XxPV%k`|&ZR-ymf@DuV-eZy!d(IUdIRUH|hs(;=^=fLP$8<_W633@h#WPyRix)o&4Bfi(08ak|tiE7kh$TKjS z!d6>L*l^vBYPD$bCbbv7snr~9#5Mk#{O6rlXd<`Z#ofbqG~2xlCbF`AJr+Hz2rE>g z&bbp?PF=Cf^AYKBJfJW(gQ9|2SIIet=on=>yo+_IsU1nT+MK&(>jHQebn9Ds`g6bk zwUlJT&OLj}=4NKa*r7Lsi%K#?pzZ-*c}5-;sTAOn0Jxl)G8d}6hm$O)rk9+!-ud#- zeooPu(jg(j;^kj@Cc`U1K%nWtisv+M_z`$|Zi6VcI$dql!HzH8X zchKXqOdnB`+EmjA$%n;W_++Imr0W?{a7qTPX{U#Z^STP%l#ae1SLqVtLWtu*G*&nA z=^%Z)e9^#wW9qf6%i^*sTdtZ-Ir@LUaDU~(S=W1FALr6fZI>R}z1!$SioYsBFTDU3 zygd-5lO|DiT(xgx$EB%xFB*E4ryfuM|#Ur69|V78uR;TjP%t{vYEtdtcH+%iXs5 z|8n=tGpA(^W;&kH-BTbRYztYiha+Aktv>T`uG9E<)N1E$J(+sKnvl=OKwx30`|*MH ztcSt#0yiw^ZkrR7D1{iVD5?l7r`)jG_UbihQ)J$u-hFEKxR6aH2V;g_{(p6O7H`Y9 zo|fq-y=M1QvG_~z#}z%`Q52lE31W&C`bxfJEj*%0e{L3LIH-F3P;@Vxya{Uf;h~C) zmXJhUNKy+Mt)|?oCh8y6dOn8>9fQp)Y6$u;4IQ}LTD19+=`VFx99zzwj6!eI>qaVl z2Qw4-yaC@$wcq%Geh35G^8TfZ#O+2y&SmdMntuIPr`-t zWm)RTD`0WwWM}wsURjx>#OzSr5)rm)b|tDTZw>W!o&-&!Mose=7s|;x%Y|krkWJ#UYNy{mV5#NdGWgnz(RXrQUcB9nrdSrKL=C&ge2@ z?K>wclxG+-J7QP#w-H)}vDPHDx$N6?D z;?)eh*}LuB(n!ClPv;VJ?OSCEW}Y><<$hE%?YYT;T=We*M{S6nfS%!E+Zb7W>qh>T z#RdsN|8-gt8VP8rnC^aFmY%y}XVTvL3Uh6$oSsx<0;XATjh4nnaG{|CSk3~%be1YD zg$rF+4bB{m3(>YhRn+7Xf6l&gE(BlULaix?Ac|X9?44k(mTou|+UP6i{sev@-bF2C zR3g!ZL>c1P={+1#+%zoOdsnWD=wQKITY+UQS~DXa3ng+PUwM`~BKb+ve9W*`FP1T_ znSvA37on}{OE_xHn8t-DIEk!Zb&Yae6pi49TU;mr@>I(wiXWBs)qIpwtv!CpHSqPX zM{FYr)=ci3KzU{u@cJj$8yTJ|tyy~(t&TirpGt?C`L7AF+%{zAQ+O$l8rhQEBOg_g2 zK`ZXa-nF;lcpF+O>{l=U5XkSpDoBt?RHA>T)~urk>YuH6@~iBfS>E@Ey*@yFSVAF+ z^u$Y6Nmt;{2%I>4F{onxdo`w+P~$%*>4~-SAQ#~SrJLqOn3|ZZ_up~7*h zmmzPOo1N2sH_g;)t!cC+mfOHa`{Cobd@2j%~;F7ww5$KS5o z8nU3f92Y9tbv9!5fqQ3&`YjPso@k2!9A z1M(9kMnh2=lSBK<%O4sox2+vL*(PAXuHgh_Lf&;LcB8xY&}%I3>aLvrpw@8K?8^V< zjc(9a(RJDx1&(4B7!2BO0Gq@BJv% zJBJHp+;(OzPC%=D+GBL0?^N5g{S>duo3<^eeHDK3UGQ0Sr`1pb+6+|DUrRe&*5saT z`OxBg)X;W|{vDMrV-3nnOTs@rv?_#>u37qssbi#~XQu5kO@<>G?3#_}fmi#z2!HHcmLf1<{c3x^& zczMl;z0Sj3@@ID3x-xCLtw8R7XJJr2)ILgiY3QQjjuv;93zxcl11;FEIoApLXVcTO z?q-C%dLbqx?5F7^EibIF>XR`EUj=a&gsW)>>)11+6HN{v@W}G zPRF?cupK1T8N;cgujpLp*+gw?hV_~Xw!m#H5Y<3+5mB-RktgxWv1fAi~uED5|UNBy_OtYXOY@6iqv$=ihC zArsPX%Jy4ul&V$cDO?Q;kJ7af!!DK29G4X?)joM;=Ar$5S6zh&vVY&+-|?V7Usw2~ z6uD3#DQKmV#$&67*SrJSdHnN%%*fy!$eNlz4kT}e9u-BzU^B)6RFzBZPFFjb=xQ9= znNypPfWCZuk!tqCsMgl)F?O@kvww?Gd!&t+`4_&DaDJabzCsAZBvP_Ms*3ez2DG1W zOvMGZ*hJwdWC>;`0hl1vk%6?Jf&uwr=iF|a^lI4?N6rY`@!9Fc-l&dznrZFdq)~O% zac+%HcaWi6t_8eH#m2xL=S=Tm=M_WF*FqJdj7Jj$|Cqhz&ZCy~E(KN#9}ToC z%FP!cy&~x3qT5ymyWGFw`SR%Eh@|~NrQ?NQBlS!Q$uiz6??{DoZm+sy6&{OfSF2qP=%APAxa_&^5SP$hkD5vr`4rcMhJ;g=~F+l88?H zV{G5H!r#rzkd?j)tW~69HxnQ4H1SAD@AAqQJe{Tz^|I!{-5vGC_VzP22yU9GY(Pjb z6RZY=bctomh?NQ4=d;YjHF~>K;Qprsr7m`w0S=>s*UhrX8Gic8L|NMHU{uklDnXgw z1i*#ECUg;N&Ye;pp}o>$YC*b2q_!R$W=l7-I41jAVT#?butSHepeyR3@;xbp=NJ4O zNumXXYUC&<8T*{fzrJt#ROc5&juH^E+h4otq}ptKSgmzv>F!@T8i_+pvngvP)xaj@ zz&}Fi!VUwS*^eTcrq&x@+jk~p>5h1U8LEmb&JsiW)At?O=JQJn(n)O(xgWhBfFS+d zU)iK*%V0 z3V0OX4U7ES@6(Z$c?#YuNyU~6Vc#_AXvveFvS&CmN8W2A=nkp3rMKU+vRWT$Fe707 zXVQ&hZQ_wG#b@EB$V0Dp?|*wz6A06~TmU*%NSbQC7}S2H9hEI@b1=&IovpxR)Pqc> zIz}wVqO8YaQakG(DY>ST&X=ap0klWA4q!PZG48+73wUZpSUU1b!H68>^zH*xI&px- zu_aiE3`gO$w2WJ>DF-_;!ylp8S6IsL6VSiq7`N^*DPD7{xp&#|g9WoG2dy_KokI}+ zW(W9)zV8EhY1xhpv7Yk62menfo@)DCS>{-;rXd~ zNEoG@3V9m(`Dz~Bi&;{4^x9ws<%vqCQP8-`d!!wh;`9S%X;Pfa&~QYc-C#B%&=_WvDybUl{*^@9UNwCn6_!Agpk1L zdcr)wIdv;qt&5(rbfn^biJtrH=BmP{tEJnxPzb>AhhJ0~J1r|;mj1LoeVIZO-WfNI zAFKU18v&z5st+z6@v{tBzuIzRKB^C=S^H@mD(6vxcx!1} zUiboHmYv(#mGJx+17<5hn^;mI{Oj*p&*(!NVfq57jLaCmw(+VR)3kcv&5OQS>}5Cw zX)?{ZsJ>o%$uDs}*(bKV*?(sAU`0m=L{Y3aT-3ia_?b$39ON+RuJa+PAAk-%x1u;& zFer$T>VxgG!?@6qop9^Ycny#ex3ZmCeTi(h)L`FMf+o6^D59jxc?^bB($SM9G%-20$iY5FW%La_~Kd?|kj> zxf^`U169tQ)GP(}RbW=_dUQC-WADyA@rLs*UTBZ*`zkH}dk6Gu=ezQywpXgxjt5m5 zRW4Nz&AU-2eF&Wd{kzn6{&tj9@dlIh-6|%-D^{O+SK5b@%a~;MkcT4YhF^_*En#rv z$SO#@lc0-gwJw%j9vi#y<-9{xryDe$=ab%eY7Hl#7kuS7e_jGn&m+kmSDK4`_Uq(3 zNt8V%4M*ZI#w;u&z^+YxiD1LN*9WYd3gZ=E48=^{B1+vn$=Nf~qe##B6KF>7mB0%Lw|uF_v-L zV=QglRv$SSWeP3*LTmiIUf(^$pZWnhF%Rv&*tQ-!(%8QvFW0(JNTF25vFJVX06|ZG zvf-{>d*jG#XsPi4P6&Bj3R3z#pQ__8X_D@y5E*F81Z# zotvp|*Ed8~w)o>PCf<59c2=0n;DQ5@NAGG4CMhbwJ`?ofFgd-{DH|WOZ8z&~0Z@(~ z+8l?`WNoDSGfax^ZVh_6*i&n)C4Y&FzaFmiC(2o$ zFSz}#p`gTVr;Q)D5AX~DB!|{uT%xVkUJnl1VX>6E4ccWVXDj)$(>eerC$&d*L|%;y z)lo>71eEh%!;ik5xWsEIvA?22ayG|%N+#DIu=20Vm84-4fTqh#*(Qw@t2@+H>CL;gg17mkhfP=Bj3kK1Pe#t_$n%WTl=U>nK-J7`m}5ap8&+O9UDfUB zyA?5%aW7|S&X)O>Yqy;X~zg~-ashHpF#dIM*&@^T?v;l`_{ z+zz}bRf+!Jq#2ZmCILtN%vfvp7D{57DpO{&u+Ys~Kxq;e)Q`|6# zQikZ_LQ=Y?@}yt+79XC?dHr~cBxdND4!O393zQ1X3Z0CI-}`r7Xpi#vd+q1XO2%<_ ze9>sUWbOWH2jKKc8hppnakmQ>VgBRVD%z@Ih5@3|v+S_8s4$%r`g+I6cf{pzusN@Dqn zLF4+#ECM=_61dQP%dCStTEo{SsXs9Tmqr8~5Kc7f7eF{$o+sHl3+2teJu2cJ#6Hi3 z?3=S{6HuqKGa~l9Nni3zWylushdlgte(-PCL{@R8F)YTdtsRbZ>elzPOFgAr)59(z zpND+JCX)$=7}3@l)ZYV~Z|+_BYzFH_{GM!eaBnPI)0yekDt4f4OK!Ax)e3x4#1k*z zd{jM&hBWC0dCC-2D3GSv3lxm3W5=F)qK}ur;<(T+K!pUgi<7rD+ z76}Hej^camoFUz6b_1rxsf_eHLEktxBd%b?OXu8t-9-mo_0Fu)Mtl!#{F$=mx{q+?dYur#Su%;NJRoh}3^&Fb~GkFgFyOKTZ8!Nytp|jRL1D5jZp;6W!2Ow_-$cu#29^zT*+wTRYH9 z@-_?hphZJpC9*&^bjcBwXmBH)F)8Q#MqTmet8F~C1q_RRO|qP7ntbo@b%zYvxu-2< zp1$kUfN481Ws;Ghbs1T0Xog{q4x41Jsx_Ez;9q74Br_dDyasvKd#s-9(0_djxmS9# zb}6Mg+}H_#q!Yb9J_aLt>c~DVar*~NDwPhdCKf}R$xFM=9q;uGBrKnVToa~Q&+J~} z9$UEb@ovKL^ULHhln;!>=%Js9)kTNSwNXXIig+`Fd?|$DPoNo8viCBEjoO*RrdF2W z(I)H8g;9@B1t6vmxOxjqndggan4#g66tMM!5`*jpsxO8?qOIQFf0}Lj^?b3|5KqjQ-zbCsUvWH%^IMQTYuR&3XqRhKsvRf%NvxmyRoX_Yp@MqOjs9 z3Qlo3|3%&4>MVBtYOSUCj9F&c_qrijz*S6XL1#K?_~7H2^Nl6a9RkqQjcd@uz^fuhRw6@abMd^HJm!NmdnnKPjZ0&Eq!HxGt=E|94>iKvbE9Ph7-BS5QTB^RRhl&ee@<rFL3 zfkVY`p|_4@1hgg>df0p(lE;jvj+r6uksregpcN}e@f|qfkBKZ^La2t*!%Bhbn}R?S zc61=Rmct^ITdOFT)YCcCwL7fHMHmZMo+Nea<9Gc;XOh`?M$BMe%S;6<+Ejf~7G)5)r)z(Rx6_`GC zc9?&)*%a5R{uc+J8xbIpW+_DA^ zfV8{imh@eH1Gg*%i8<7FXFR)^9$YBv(8OmfqwfgvU}&gcLCeR;gCU?5%cdDzC_#+G9)e4N2eU2}@XQNh z$?YH|=d0)rZXz#4YPpaS7m|bQ7>+H&Txjt^c)W+qE0=R$1nvkZGc= zB=cH%J*M1@3oXMbsT!-PMNh_Q|7!lwucU-q~q)ml)r9ILu4H1IvT$$?2IP zC1s*UGRMqH?j_K9o@M;cC884}mt)MnNJ*ie!N|xA47Uu;-Algs1YoXRasR}-0HvI9 z{La-ti?hIXiLrD?7ac6(NTlZ-5u#X@JyeR)vS3hQIjG0>M7$4;%@q7-GqD}r zg~Q;0m4Gjo$1L ziEOqMM5g}6u;TcSU`7GgIh=3*bWC*krh6 zEf)%hFw{8rgB*XRBS$ceQOWzN|@ICHk8JCVP&@@UWC+)Kc~| zIUCLtz+n)ez1TpwdtVinIv-m?kl{#Trh&)J6HNIkuf8>7v+i;(WWZj=g#@Bmwh&rgKBjO>g@A

xZoWVie7?p)9|sU0A;?IueRGpCuYku`mILTzB#T63=D@lK@3sL z{2oFvFwL?XdM&8bTfn0!uY0pPUWFtlC=l0_>;J760s#;hYPl4h2ww7TXlyR%=N(SU zmRix4BzbK!povZl^S*i9&0)W4N3CX4M6jHgng^E&?*I%tUT+z+xCdm??WzFD!05!r zrDvqlf*9vI`b-vwSnh%0WxEd0xBKVY3&XX<9*{%5ee0>!ihUN1YTL-3?6iKSa~=1} zy6wKzU;mn-GXJWQuP{42zC|Y@FR?nS$*?OnnTzF`&5m&t{w4j$bSB&}6Khg`$i7=2zembY?fwCY{2$+MEc)dfnlsB~zeV)*WCIjXxR|NiK^ zb1~wYBJ$2Sc562AKsN1!p`fd$fB^NT^Q$`5rYop46<3)!|zdNt3`{%Eu8|jBc z@X-7c+;U^BYN|L&(asbkjxMKnvn3hONWQ-rD|{+st;(@dynVMrFVmh=xKe7Yj~s#8 zHU>2gxyeVmJ!h7QPas-A@bZvwjUd2zklOFtOqSh;0phg#8-?aVd^}I1?FF84{jn}k z!S>@k#B0FiaVG2rL6CD8KwBxJqY-xJx0KKlM>Ip0mw$qTLJz11em-&FePs_Q0p8EJ z`B<-)waRQZ(MZ1*`dDT~-@X^b4v(@qn>h9t_@O8J)Oq7+kqJNlF%aiDrV{D`twyl8 z5xAu`=fj;VH^Q`~?zg%mYr^fzI7{z2xxGhy!>iG8Yzk zMmX-*7j%%UW0>+5208=9TayNy!n;7yIItT&)NnnZep)&p+5nTJOhhoN16vf;PiCs^ zzW_E%j%b_p%#R|KmkL6GfO6_E|8Pj9Z6l?kn(hG!u;G4o!Skd6wm^OzvT>N5GjW*+ zFzZ>V_1sW1}r-+eVpiO@YGa*_~tPZh~ zR0v%lz9_@6#}UVKl(%*#4?Lbht9LL)t635|C#Euxu9=jWq?i(yYP{WA^ev&{()EQ;MR=hAN2@06UF&cEEy`xeM`~-fC zq+!$)AwUa58k{nViS~^XS1X9G&QwaWwiPv#}&T9*n zPr;6?9nb3P=4(p8wBoX-gJuEO?p{GgY4R40iSk5Oi^+ozjnR&*-Q4xH3sog+UNktw z^XU~Li6%5SgIA5JEK(l5W#Eib*?>m~P)3cK;*&wZwM=O`2UiUv99b_uqc#YgT6=vB z^L9!atd1f?YGZlRHa#fEzPypa<;hCrMtFFb6!R8M_a>bKjdVJ-L0FT@nn2>}4I2FH zrp5tAC;r=!2Jt7lTA_8qqJF6J^edcqJk3}+PZ7JXy@VYc+uMYT^_Gg@}qrQ z-uwXkkP=nyqi}9U0UCLGYJ->EVNLT^Jmy#tz{^aR(3%6k9^TyPR>}?rm>y|-Xe%Wl zJuE7`_zH%zj1zy#0}N*jw0r(O(7FnC71XabUeal!{lXG?+v60n4-ujIGfP zZLrcRn%O&3o<}1Oo(oG*3XX1kY9ziS$wFUGa|Mm%}&m+TUkI4O~}l9ft}lmePt{ZdBrXG88=`0$Wdb>8XBq!6+3s_M*y zx8jYHQa^{&RSFdvOa9;peDK;C*eIaTomD0k!JUJ@^w`7CJ)3l@8}Y);!Kfi%Fmods zT)$#Ac|x6tjpL$7qE1aG8;45bLs(rmmNGTa1o#AR3A|88HGZmT(>0aJC^;vaG_|3s zc^7^$_&2tDCwxC0M?Q!NXYg}tLgUHG{?Dx%rkm%CZZ=lbu0UQ&k;dP<1zh}eP)=T> zN;L4Uwb5y%V3s7FRbiakASzvJ&)Td-K74o%QPdIk@0hg#3CPAm3r zXIWTffm3nhpUbQUnVIsKe?w!kyf)JX3K_GwHe=l7&zAqeog*4Wl8{|qGNX^9ndvYG|uej1~21=s(%vj64Nn9l(A<2ko$};T z@(Pp}bbSKesIe`D3{t7l%RDfTY)frs&lDiD&r-K z|0uSus)tc;Hf5dDr@jKs&~#X>@kp7Aj$ItOMcJ*WqBE@th<{Sn!)AY%$`#0Y+ncEKMI|&t&*Rf(C7i0q zHj;=7IrZM%PI&;Wd+_t^T=N%BTVDpwTD-ZrW^4IzgA4K+)CR-Yb?frv=$7-gGuFNL z#|CDEFGxQMnk~7anGt$D(1kxSnYg}h{w_Uf)Kgs(#OWy#=bAPz)GhrV`9OkP;-xSOvbljbAnIHM77BM24YaGGBHF zsRxWufx&^gX0H~6+X46ht+P8hRegr`p%ITe@c;umw2tn|3)2)A&7h|fSq!wFGE2O` z1w$$qLinL|X*lz@QG;ev3zNbO7WGdDhZhSm&_fpE5Tk^S6}lJc*&EMK0uOsKWl?#fH!euw836V7=-XaNPVuN_5cd1PeuHw!`n_mo?FR`WzGRw8G%hTn!R}m3jtT5_4qUST!ddU=evys>O z^M$;28&YZmt#Vs}7(9rrBl&gA-RggZ-1tH$OTfkl~*t*c6@R|RqBB076l{I@4%RW#|6ztYAn zsID#>u$(JdakYsixl-@)JIouEU2BQTfg7f zsu3jnqPynu#~JdMFC+mo-W_-G{*_#-a;S}$dh$w%{L-X!z^n!C-1}$m^u`2NwMBrR z__6UyJ#D#t7N-}rbj9`VnG{ChoHVGsXlt}nA^S^T?OhI%cy*=%_ZUx;*{nGQv(XI` z8sEeyV^t$9XXcO5k1nSPZj5L&lvx8;?S4Mc-LGwAaJB1!ist1s-t#Xjy=RIqzvWEm zFI$;P4~(DW+12q}D~{t}G0@=i*r^m;r2eL_w!oNf3}fZE7#sa!E(;i5q&>pv@eY*k z6BE$G(MS%(?>%qCl=s@jNl~LDY9$i31=&@J{OYLZQ{SfbMbNd?m$OSF*^x3&=XLvr zwQtdzZj4CgIOg2JhtQ%MLtd?n_NpK6UFR#xgVF5fjdgE05*BSLpuZh`A;dl7C{rQI zSE=>BP+;8TKDFzv*<;m@%S!Sl-EDVXW(miQikh)>Wjlyf<%T<56xRP1+`!O)idWV8=Xf_@p`Jd8>t>2;a0(j<*RFN%P_QVhZ)y>~`1_0xJn3@uIfj48`27Dc$G{7L z{dG-Ts=wYqb_=cPQ;_9hm{?R4|Tva1> zu`#LMY)>Cw1vdCue%L}cGPsPJ=2Vxj6<=5KL4B9rT&vo#Abmzdf=}l?TSgV9ZDk$3 zg^c_oDy!nNNnHcU!B@&EYHcm3Jq&qlC!|ry+i>t?uMlVG`LzpZm znJUq^vclq*fsK*TQCXMb<@lUp+oLnH!0`&SOr^jNVageGOb?~^LD@@$fL=!y$Cm#JLJmRWu&0;A&1q>YsJeYEpgT6akXEaK0$ z^()6~27zO9L7~@j+zZV{;{m>6z5P%1fhH>Q25GcuKY!o)I7TVO9vliLKK` za9aCTIf@rypK1o)s{oJq)3(P>1(uVjsPfA*FiDq_yt+C5ji^giS+FKG5qzHz zd)W~j!3>@IHmD*coI&-qskb@98335O_{)CQvLh=(nc64aw)7L@&kA|L&dCQTEC~tA zqspEJj;@hsXq|NXq+zHFQdhhewzbZ=!>-jhq~J$d8Q_nHLIRLJO;I#Mg)^l zh!5rUoX*}I!QJ>^;7Bl&(Rm+Kclo%~4cZ#caChG)Gq$oL{!@*ksuPh)yQJpwi;wN6 z0R)ay%`XOS6b#%f$Z1vD=1PmlcN=-+SOK=FuL3X(eOW07zq{`;ZGJQLQb2M}r_%kW zJtu|k;c&}i0{>a$O+(UQoZl~(f|n()PMgS%fZ`r&QeDjyb}T)!7^^MJfoCAc z6;CCUO@%2xlMo$})7pEl?WO8W``Y$>V6mrro`Voe4 z;_d3rqnZHsIfY>&zvw}4!>R5jO!yGE5*?PBJR7uAC>MB7iz6>D0KAU}fb&zt14n3Z zrQ|KIJj!P>GH)`nxJiq5BQ@t7p1DPSX%-5oJQh#}Ds91$j@yY^#+U)dW^99t56jOi z8Y&lZlsX%M%3=#%7jn=p>S~5@K-{=Epz+a=l&G8l+7n^nIjs@st*s}8NU4bBM_Z%A znT+xzO^k2S;zR`HxZs%^&l`qZH!-@IiXG{nbLpAWDGJR_SUd-CF$E7?;9|_e81W-f zxD7gT{PDQJ(F+)_I3aFlP?zIJZgTkPbn?e917Z+`?f^V9{Qsgja|S1q@O%B0cvXD+ z#{h=*K(lCkA|@X=qLF9K-xB}Lg0Z+n#-P}4xJPVC+$)tP?ncXPxj+9(>t4x!<7Mm z2`5zszuzuWNxqW5*< zt2N_25r5UJ{PLCt_`1cU=4_6fl|ZX94p)Z;j@ilDD9(h@lMiN9bsCEl7SF`L(vC=N zj-@rrFOAVWZe7)?WGtr@F9=k>38ZZ%dA>vDMyS(S_8jG1tW$~e$Z@Nx&R!!0;Dm-k zg*&HGC!SX5y2&T1$-NIb?#{#6revffp=q^9G9<3V)~IBJXX@ zdgH?q@wu)XgG74H1Rta8g$l%)k`**U0jPd)vLlp>C?slT<_;P6I29dYP%9>I-vy6{d+dEVkzi{^+N6&y$b)04Vy3VK*=Jr-9>sfiA z=?K;KmbY@6>RI4OU#jZR&XVNF@W*p1TAklM<`cN&#R4~?SzK_xTWI`VeA7?^_%fhu z_R5{9C!GTv+h05r2BiB*iMKzcD%Z&i0ADtFlE0Mhw>vm zf{qhHekaD_ld}^)t1G~JA=>zCL84&a?w1{!mWtiDN1!N&DT4;Gd#a+IINvCotd+nd?U{Trt!Sx48TKSvGfO&WyR*k-dEx(I!Q); zs6I8BWqc#37FCp@x+-f)%p(|t_3liIgmd&hHAdG_>QKS69|g{JDVF$?2Qs^1In#@Q z66)Uah!LG#q!=Oz%vlo&*<@H;6v5nLurYeelPk_)Cicw8Ck}S)nZGvIHgz1W3ENe~ zTR~;=IBg4IH{0y<<_Ke~!da)t+%mAMpY|QDd=~za zS>DK8+Iwstov>}Hy0h{*6loij*zzF^Z@<`HKeZ?9=5mD@bik`?<<%UTZ9#Ho>+m)i*#au1*M*jA%J0tR&vu3$w2v(-E^UDJ6J6Ki;#R2X^txFF>Y?xF`F)nr8yZa&=oA7A5 zYF!!3?Io;KEXT|2xznfQsf!oGQ#UwoJ<9D=+QGMDAFNLcOx<*?(OK&CQ>!5ahY!1@ zu@62@qu_*P+LJ$-7cjhUtfNy4vm3K z#t4Vc4D91&SNQ3?Q|{PbNHyptA5?*Ame|(`)N68-Jw0=(Y^wKT*XXIYUy93jc9^Lz zhT4EQLsy^7HXVPtCHgFQb7$Os)cq9K=u{rdgPF$qGdBgCwGx9PK9-(&rS!h^s*mTV zbl>u6U={iHV9aV{isRB_lqaWB(;7y(W;jU6myeU>Ma?iT?#iZonddT{k<(2IUm=Zr zpOCI}(Pv@u%QwR>Vkv35H|2M|JdLG-`mi6Wi+5DkY?hr`yN|w*j$Zr3t0W~fVNmqT zwNQ=UHN(sHowgYS-wOSm`Qw< zinPx0EC0sORtDorywaJVD8?!5$|WyGg=<~AW(HQ%Lb@!mU!LuxO+{X#qY3;-VmEJB zjKZ>#!uoERuAKeZ1J1k8R|LU9>WP?1pEb)a~r}SG_eTGw$}h>iBv6 z!MD22PV))1F?QS(5=?s0G``^#RPLK2U7!6P>|S#n6+3aw;OX0s=tFGO%1?t$7~sFc9d$8D18*S#>#ODi;4J|vh41| z=sI+HnJ03=5Blr|MP8Oos3_Hm`1uXgi#RUG*e7kGb`ObRpQ=MUB?CKeU$;dh`nYXV zr^em+#M=qor^%1Ld{v&noKD%Lbid|q|4o@8sO#EzKmofyy1b^jz`|7uMvW zdZZqg@{~LbuTq{(O~bsAq4J_x#J1bf^UI|Lv*|SG+?k?lNy!D_*P<0P!=1NO_yVPf z$pTSMtG=RU}%JXX!zU=-p_#2g9uJCbj4a z{#ve?_P9Ma(wk_PYKIldEE7j?o}$b$*mSxXnk!U9Y`w<2V%!40==sAVepE5<|)CKL`t=Zg$;>%9Iu;<)ci;MY*GC_=c|fDRW#Sx z=`z{Z(V8}!QLJLM@)fCMaMcO8h6L4cUdJGRuNzwCuKz-`fTKh6k zeUpzY=IycN<)_E9h*rp`JG_*=GAW=2?5!A-Mi=6US~Fu>lchw4#%1{=!}Xb$6z>oL zVh&xhHNP_Ptw+xWWo3p0N9Wpy+DGmmv>&OT6dA^LJ^pM_el^owlX2ptrRc3_E+b_F~+B^kagvUk88QfM&q_L-@*c{Rx*YFcPYgp-6Fgc!xMJl*3DB@ruof)(E z4NOp6UdZe3316l3X|Q?4wet>rZTNDOb(DTl0``C!nOX#o#)<66#lSG_5L^+K_ayT# zj(6PF=ZwIee?p}fzGme}x2=oC?-hJ&gz8gBq4sgCXIGBhbUvph-j2gtbX?S5g9l}~ z1lEbM`LT9tyO4Q&M;||(>n&jlPR27bW&A5wgA(yxCHEXNb4KZ0)gWYJLEAA!DSmCy zNax?#wVcJEz}{G{aVr*AMJIf^Kx_InX)pxUJDi8FEUKH8hwp|-do@_hU$&_i zr3~vfQKnfto)fxY<1k2<(;UP7e)ze|D7HQn#}u%Z2I{6R3Z^0A*D%EZodOjT?_Wu8&{&fCW;ajN>{ z4PP{6=`zHCZ^9y*v6&i&vDZZJQSVw4BuSm)^A8LKW-YF{YCac+IU_SjxirrfcgkRR^ z0*GvgC@A_VvMoWRp;1mOaF92PcB_+xax1vK6c z@{Ym6_BURELnFuZu^vSWP9(|p`B?QnxXpYFrdX`qiVP|IK&&Zrz z8+&>oKt%1N+^6OV7h9g_c%hZ+&Dft|&GcxpmEydymqHl>Iv&Vq%w%ip())jc8r;}$ z6yWALNppq0-IPE)f}Yuk17@3K*?PnCnIcJo>_Ce_3|Hhbkxcr1(etB_O_qjNHfaXN zU*23^tTHy@LSbCji=mXsXd%q_bP-n+R<`}(i@G9=@ZzkP7BEEw5@t~moQvBn)Mv}hfr_Jk(Z;Rue`qa z@#EvwmP{M5&AHxLvf-Q_X%9|{qs~%or5wd#i^{DW7SnCH|60Lq?7@(FJKeP4C9Oxn z;!WCVA~R)Cw>qfqRO{d;zb6~H6hh9KQ1TJmEzs1pldY11ivAcW^)YMulat(r$1^Hy z{8UTbkFhdQI|Qz1A7gd5oIjSf(f8y9!}a^P|{wF*h5Gwbl}QHdCT|kKNfr-$6X(&FTAIyShN3kpjFeny78F>P|uy8?A2V zI~PQu3T=Y^HWzMv&{b*ebW%Lk%MxDUny;)~J)h)L$X#y38Wo;oyaFw`nVeu@?B}Yl z-NrkXl^lOu#ma4`yFpLxhISvjmf&meot zH(`fqdD|wC$ZF(TJBy$AvjRoRP5~wIS*#OQX}Z!ZsFUXJ9I;(RxNIJ$NZsJ*LMwX= z3%KX5#qc?4BJt9K@b%}8-l=+Fx5MKfD_cDbu)&~Sb4ZA;=5O>W0*=+ZGQ!o#cE4d` z<$tL?H(n;#Mi1|S4BWO(niepNYT;|X@>ML5@5_kJzMO8l@dbC&XUv44MDr2N4UbLk zDpbKM?|M`TA~^lHH!nRSpGj^~6*XguBlUww+c-_Bat7Yux4EAKO2%H+y1LYf@=DF} zA*vU~_9=&fwh|hnI%tFWtN;h5A2$}wOSa{FbXAmefShGlfSirz(~`{T=gvwNi6skK zZi0bS)Xu`h4~z$?w4QnO&R&0c-=BZ9MK!N| zM5jle`6|k_PkBANkVw}h-HiLZl7*&&naVXOZvo2|AE`JK)*)H*EkM!k)g#$2zOe}q zGv-`O)Wx!>i2M9TRhLz>a)>s@FYprh)ytLBF2ghzyJb%~xdd)%`-_3JTG6dsadv@j zdsQ4SgRu*A8-{P?V+*`p%{UIK&a=KY@hPlE-aX#fXUwBTspnQbM;R+*E~{+{KQz>< zov_3kdDUbG(hbH&*J$uU4@dhHE+c?3uB_U^2O>*1^xEmmcp|IP&>2$}`}JjJ%zGQ_ zz=&qyM7eTXpt1}Zw)23w2`$in?<{6tYhw1P;L5BtSWCKGI*~1Tz7ovqvS{T15xn2h z67uExy<8K&yT&hGJ#KE{KECacd_yoM;mM@1;qxT>B{Q|%I09IFPl+eNZUq;eVZp{N ziL(lZy`54oVwwCX(k3!Xqp^Fnt`?4=q^Mbb#!q4N?j9qWvkr2uC{*f9%>c5IU5t_f zl{{x}FIZWeoOwQQ((R^jc`lRZHRthB;Zq7ul&5creF`(WgG$|e%c*6$q1O}T8cGcNA}2BHS}wCXo?@LgsA-K zIZ?7zZ7@-*ZpO#%L{_b6OVD$EC1!~jWW!-Yo;|QE_mT_Ra~C>{gRiFnNQViWr+(PeX5WX87d$df9e@9 z$;Cfk&fXL5jyv>?z&VU|<@Y%a=z*C!HCJPos}5$|3YK=(+^S|KE;{u5FfJH`9tP&& z0`t*Bcwk&Sz$Yk_ix;d%&n>AYEX=Jz&m$_zEd%^~!Z|Z%pamcNimKe2TG~Kk___2v zz^Q63POc^{%0^CRb}saY^oW_ADPo2Ye6Z**V&A!py`2m9K9);Pu4ag%N=CM3+%gbu zNh4=7#2J!O=VYa&*`i zI=I+7(SzYd#8kOuES;QPq%4e_==pfL6^wqq*RV8ov2dmbLHOWFA657Q@gIPHsXvB% zZEpBS1lr#sl(8`~cZT0i)&)RrB4KB4V@A)zE#Yhe?;03{2i}i}_nf@I2Pq?m3uf>~ zLwqISW{yBc4*_bKDH?g~eE{(TpWt`Z*gKPthlgA9dn@=g)LhJLF9S^w=SWK0d+5+} zLO>vT_zmbmd^`g1YXc;~F9GDW%y{9?ji3?fxqm5i0zdySqM%4b$pJ)3I9VFmC|)`; zMF6&=QG}>mfJ70ZDboBi9O_T{ktjNd?eEDE;DH<<2ZTfpFF*GWa=>8FPjYynP{=`Y zz<(h}!ORFQu=IR<-+2PcDZtTw=Lu*H@C4$a=jGwyp@;GE|CJ|%ARpuja&Uv+z8d|i z(jX`ol=p{9L*NR2m`X$T_E7wtN+Sw#?`sI+e5CGIHZnKk-q(Hvt*U0u_O4DQX3l^K zfj=(%1w;=5?{N-D;P*m%eDu8EkAdlVzdtLtw1>-iH5VfnGoaOZH3&UIM}c=BC_V6p z&{u9{Cwmh$GZ!6h<#RIJm&`m|xMght6q0){QhP75dh~$tQZzHQG(xBaT;w1E5H3Dm zdVVm7OMn;X5-9*3pqdC{fIxTN$==lgxHG~mAwF=cabI#WvU7HT+c%S|+)`>ks|y0x zzhq?W44iV%20GJ2AxNabA9BCT4kZmL0OA4zkNe#YBPcu~X&_(|4shy04D`qd4raIi z(GJ6q)LZ_59hS7WF+IAD?>UQqHp6=bLXdh4-gLjme&9Vs$A1C%_lkaGE6fM|spudW zKj@&M!~UY^->op;LG6YBV!mgEd7*s2vBF^Z)+uDucF@N z`S`1#AlAzK(C&l&?{EZsyj*~5|1PRf1fD|??CJX7*%#PB>Y)cq)f|oh&=OvO9|#b5 zj)nlr2R!0m`+y$_!I5k%grAoS(7XLUK;StV0tnWbK=w$B1!yMK!Rp?v^>K)D2d z7>qqUM?(PS`Ar{yfKcyeAOuM4Q6TVvxL`j7VGq#JAn*zRM)9vSfDmPXe)PhT%qD~f z@OAq%KoEG2h5!WjrN1CR3SR;De1uK_^8<$aM*xk$a~J}6!2C0QhC+br|AK%IiH2Vc z;lKB`fYbVqd@Mq!RJs3^RiWfkAv+{Gfdu-{bHw)?j-Bi@$R>Af(U;(Eusb_!F!F z127O=yWzu7z)OG-UJZD^&n9q`4>*c22mhfy?jig$%)*fT2RzdF5y2hGEFV8V7a(5W zo#-CVM`ZSQF)s)ymVy0)7Zu=#r$6{$5H9eZ0|5xz19UV9Q1}giQ<1`M5K=G$JCYaW zgYq5-X7&L68wf~-5q8jv{s^TH8`<+Ch5iaZL;oX3{Xmx@r2Ze1FM!MZOZbauilmBv zGqOL3?GFX~yaz`1AQ*TrnE#%3`RmC3w`mt1zWsn7NL&1xb^#*{=|T4nJLukjqb1)( z6fAHc)ZCMnL*)bR2md}p2SPHzK=}4kQU93N`ai_}?Ya0rWdD$YSJ=T|;BaR7AY4Eo z{N4WXA$UF-v%K)k$zP2RFR}^#2j}`-xOjOFgz$U_K!-u#M{=&ba1H(i0#Yv^8X#%( z|99v5JJ-oA^D~9?dy)GOo$KDf_YVmd(zpZ&hJNboZ-i?vvCk_21iL?E3qkXt#3F3* z-^RMU$OsPl)_-X={+`(Xj==Aszi#?0S%Ma!Pa&O;_E<#I=s299|yZ*)CArlLae)bLC;Rs+LF5VxRn>{>-LO_fW z_Ei%C%oF?y0l5oCwT!9)(#5KNpZ(+m|f_ z&xbOLlwg4V)}bRqI2cp>OJ;u>-G5^9e`BbM7)kvxW|78;{6~tDc)?(F9;NMX|NXUUNeAR6pjjekk(Khyb>`k(6kAF3>3Q1pj#f-t1fx4_ZDBzVsFNBR~) z^S>b$8NtCY={N4+d!PoSupvJpHC_asLm?a?QbQX53;f?4YW&gs7IL>9DbxT7@Noh2 zP5bTu!SfNB{cWs)G;#;#evaUgK>R#hyg!nsdw`Ax0R&Ii1E(V8xA>5Tm;wi5jo--k zUcd!{0!xd2jB@t?9SQ*{e*s^<@+$_e*37`N?FeK@&D!3Q6F0rW5ABE|P0U{&rM`4W=^YFfQSV;3tM7kT{Nac7YKziqH$%7k^f*XD z-Mo@7h;}G(Z!bjhF$z4CXL7omNj?IOH|x30aH^Mjel^spGSO@>&SQ0M$GEaH7j~9> zs+VQ<)0fqbCe_q$Nj>D!54B@kHeYOcq9^R;m+7k8Pu)s?Sx@{;M8uJnd{;htg!lp0 zU|&?-h2zg;y;brDV|>5qk>s(6DJos;{q`FBne&9W!j(K0hezzfQSUJ~{BI1lI}(Gc z2ETaM;Iz~XMUpvt%}V!lMdq@(8=$$Wr<~+;!0c@d=)#7Sv?v|3~=_(lJyvTgBZXry z<|jGcbo$zhXX5LKO0bqnvXLV6qR2i5YW~b#TjCHHZ0S?Ph+;F;a)Ky z<9Cv;1lw-C*u_yl)XIx2oTTQ-0~}igJ+WiU%``q|y<2OC3wVPm|||uPf9La95k)RCiiri~qClZAQT>05+8Eno&|In$tM9#hj6Z{-@$owlY6wp^9$y~;aoa~Lqf=gZ zMs{NU+yVOB4a0<2J`rztUi#DylrmjfYSoBsG%X3?E*IwVx|0KX-F118(BO*ENn!r}JFT?rIQX(-FcOpeqt3S)*7i*dB(55N?Il_2(P6w8`PjN_s?V5M9?V|OHsZtH z%{gz-(5EIMtZk1~-_4_uL(abyGgtQxRgl@e03}tnnA|U-quo~gQO+AjiMOk*jamGT z#>p9cohGQMDpcg}I3VHT<|Jf(1neLjJv-x9?&6iqz{cAfB2H@5zNA^RBsE=D#^atG z9l<&e8f2vx!lzw~RT{$C-^_=*MRV7!VPW!ZUK$uAxJ~Qb&!W)t2DLJS59siBUd+yq z(I>N_&tuTWT%Ekm)i{O{n$35@R4P@AhJ3*W5@Bc_Po|npAW@0k)H58bu4AoWB*$%| z=J~FHY}zNLK$9JXs7A7z)OdA%k*;O+3SUhyNz1j@;XWOL=^c=mt=^LIm@UKG9SK$- z3ssxQ02KnxJB73H0Xo`rlz}y)5v*&e4QH`>j*p64khP&p>Vz{ACgn&+UPr34jg1e5>1m5UsOc$EbncUTuL)Xi>uFkx7?v0$d*OvTzWav}-bCX`H4Wj4kTG?q@ z^wjI!(~s|&7dW01DX$3hdexQ`E6G8mPWkFV?(;&-d@a1Dby|Vy?VDO?r^Y;|U{O!0 zL6c`ZUVmFC#ADsXKHgGU-LVvvyKw{O6fW)yF%1feW_FRg0nzMu(PttS7axl{nDz!F zl3YWfxkJnV^f7q^iZgTbYGy6jYYVb=jPvFET>N8JG*A0EIGO4 zw~GtOeDhPngniG*xdc9?SxYh&UJDs#ea*C0ed{ynB~IZ`0ezp4JG0}CHR{taX-1Xu zib6DDJY1RkD+T^J%c?r58H$RL!I8ZV#nXj_R8NT6v85lr%yyuI6sLtqHN4@LWHTHP z$n`9N7y>0ZNQ6>~P@I>{GxZy7vkc%DpQrDhZ>v5S2x^7&<2vq;aoe(X<4&fmWB(ZcuC$SQMU*sTvwMVB&} z?5|tubTKxi!Jd*Z6QSjBG`{4xjraMAqi)Hg7yQ?2wWyxHBu;qp^aX~QA16*Bmpvr^ z60vEHtD)X2^WhS2nc2H9M@ntyXJ3cpl?@qbN!Vh~;et`%l2lXO6=U1eLmEtBWV0m!S-BM4Y(&km|f2 zSe{XQD|KiYJyRZ)U?XT8%Qy8{^|Ho=iJ9OeX8nxM5vLm_Ayo}0*MqC*uiGdTLhEha zA@`Xt#(j9f!yvT1ST@&rX`TShQRB7WC~3J>52L_dZkY z`j=x|S;p7YPJhT`dP}5>>GIMVL&$lkK{2KM{b_r$_J{4s&9B9A)_4LO*X%aX4KN}q zhLtJZfn+uifxYX zxz?)%A7Y-KVd!36n&E$P{>QDgYox|U*ohz)ouo}a$X|*a@}g_t^nh0IntHdB+1>^%x~(YACLDKHSJX3v z7UPppe|SGpv?o(wojmpVsZ>srx$tpE=%3?zhbGX`+@W_adv}8Y|+Y%k3+T@ zEbL>%Q>0IExJ{jNZr%{Lb}u2MXC$U4^4`VYN=q-0dhEjdJg6=vSC95NrmGac)y0el z&Vh8n)eK>?O3&9n)@WpK8R1-m0ly6q#*nb8yMgIGmt`Jsr#N@Zide{7;vNfS<4IVM z=XFB-mMN=Ye?}q7#=515bqdmP+R=dpfLihsG<{c#DMxF@QLc*%=D(1h;J7`1LNjat zjq5dC#9j7aCf!E&NGnxK%uFg_=5 z@wc_XS8Adb#H*ETARH!S?b3WPU?Fh%i{9WXR~+j${8$W>#<3v53H70*X!lLVK*gBk zG6f0uwZ+c}kq_RoN@g|Ii(Ck!Z!6rJh6trQ@cbtj0vO{IteGVs!i8p9yLT5%PRQ zz;Y++Me9m!mu!7Vd}0540054X=MvA{Bl{gPD@vA#@nXEUF*ZJx4-%}ZkIz2TPyMDk zI~Fh?Sm%AB`fJ~H1_kG5llIr?8uJU1>0?fP!?j;CnH}%&{VWr*GX5cWb7)*-){9cS zjVg}s%g1jhswX8_f4gTK1T3TbIqp3)y#oXC!9Wh?djj$AH;sefOSOMyhrz(gmtP0p zNRtnHE&h0R_-AGgSkrLG0{#6=-+z}KMyw6{Q!5?#k<(^C5Bx2;d)Z+akctHsMeLJ{ zp!(3v3TSVRbw4rtyOIEVzwW+2tpnr&4}kcWiP?jc9!SCd?~=Qh#{NTTGvst6f{8z* zH2Z3Ba31vFK9-;T{vRsJp5*UcLv%z8zg;E*MxGAj{fCLsy`?HpU@I0dh5B8ip>RZpVgM!|4umzoUFHWy zcE5-gNSg8geLKWY3;oj;|FqWsp;bmG!XH}C$B!HqBC3V#_ut`i1O~EAKUP=oF?vK2 zq3~IsUxXRi&BDXie_lQT1vb(ECSzZa5Ri@t0t}A;e*uB)pWxo(2q1t>A3r++f#`@B z_<#Zvzhd|c8wcIf;cV~-aPj?^rh~!}9T5WvSXuN71_<(67DUyUf0PJ_0F(_Ivd1hCBKpIqhMH2RN0BBI5LKL^#@4?^5(%x7f0^&cg_Z)&C^>7;ZeEZ*x z^&!X+52DiCK8Qa?;{nt7qqf3-MXdxnrU*o3U<9JWF~FV6k5&5+c#Wc8F#JU#4!Wa% zX?qUp(NFFAAJC{jnW7g!PC_9n6YoniqW_RHxZT$d3OIbp{=DotMI#69eZ<`7H0Xi-CqQvs*>h@F zoq;^7tlbrR00MmQ1(e4EF7vaIXp{9I;(=GBtAoO6{`l--?YM zsB&#?39QS#$|?a=qc#H$sJS{g*qGVEYcV7HRK$(;pZ5nZKcOIy?U#K%*av@~sQy2r zrZCXCK=1EA{ozZUfr4fTYXEfV_odFY+IsfmP!ez0t8e0l+^YV{(|PCUv4+mrJ~TqF zZXTz*CF&6oO`&Of@p83ky-z|kX;<`x{^)4oGo`Ms&t5ZJwRPyu7E| z9Ld~t(K>5PiA6AjfYDWEY|&>Q6AG?A)GfZA+*Z%~^~J@G9jNTH-oDLQ^euBiY{z@P z)BLAd&q-o;v)&STdh0Iuj?%7I$mPL~O&dXM(Ua$}@CA}46jI1qs?*2#M1hTK%ne&i2U+ z-vY0}I;KHEk@D$0+}G$*v5C-}Esd|sv}K)bQMcxV~)df+UVjujrI@_Q{aPy41>M zV6lu#Xu~{I6N4QL?9(diECv(8GKy_4sNzplW5`m21m)U@Z^hX#GRGay^t9MIe^ zJcrBC`rA3rg4y>zhL2!cC-L2J4d>~3u1%&TfP6Dw_OBkpfnm2ZN*7ww84*PoZv+Sw z8xB!5;NdxRn(4{NIe1{t>Vw1Ss(qj6F7z5e1ik5bGUbXbaT_47&yJ~3&9Dk82^sbE zvL)p3@&uFeL0+rs%nHj>HR4GJwb0*;Adl$43Ms@XsCJ3LnABChL)~!t*3GiccpGxh zz8v}5++M>O$%^e8@hbdbIC&hfw5$qTeYcFa%WU*D@!t!V6} zw_mR#g&MStOwFmZ<+<%0=MM^YLnmEF${-q#I9D%B>Em{LDFl0RU%%NOer-C6hr3p> z#*R@`rs#3gjcaAx;g6q+PBpTPG@_5GOKybB+aGs`^HO68pPNXKJu`O4W&0Cd>0p9- z2=}$X$CcFUB!CffU1-z19{P|?>xr}FOf-`;k7MPDyyOhf1C*rG0JSvoph-E-v& zWf;_2Np*!uEn04Lj0rSS$aH>mOwuwmWC^vK&MK6xYQ*?GU8f|CK+ z+ZcX+bx}F+bIAQK(HcqZZq60x5E4wzvX8N3OQXp%Wq#3PuTfYV{zk=FNe;okTWvkI zl*hAz{b<9|adIwi8&^gQ!jkV1%O;!ip3rVpO+KQmvZ|X*$h*qUO-=rSZ1YLgFRG_Q zuf8!Q%EhEr>ZqQKW%V{_Qo7TxbZt7$XRKiX`aJ6mugGObxgpzp$X4HLhCCi3a(Z30 z^2`j~SIU(ZpQoo9`|Gz)j!;}9#3a}F?`~=HivurMTX(PpQ#&zd*S8Z zTdZ=xz341Njzdp=t83ULK*N6=b4!!Vz!OcvPk0O*LiX;1T|eq|pW9}mmuD(zWqaMe zZ6{O8mAP{Yh$hSV+eqI!9ny4l2l#=_dbays@!6!;)~$AO??<~tDURl?OnR=q-B@yr z3HOzs+dP~9Y2C`}N$RDMb?116^67Q!&!4{veV*Ow{NlC4eM_>}E7#dH|Q z(asCBUdqpiJbA@igeXLx(5HSq_LN7Nebp0b3#wa$OO#@5Q4xgbMiCdDmJtVTK>@wnM(EGtRHnNmmI)N4Q9xe-$9=>?r^LF!zp8 zvTfqs)KK-(N0ve;!18 zi>o*u7?sUjHeLMqkYJpdpd;Z{muwj#8t_OV4(j3zQ)9S1>B!;s(o!C9Zf)|N1$(Vx#(#&9q2OS-~TTBU>wd}fb~65b;`cUuEp-ivEb+82+T+)lP1xbFH3F7 znC9=r${=gGHBM9}F1Xxjq+l-5OoC5nvaVSh$Gz2cI~lQ}alN`J8G-Gn(TXvaE58Rl zH*S&;->P`?u^^8~9!OR3B#7H_A8}8EW;yd#h2+`d8daM*2b5Xxbs=b2k|g67Ym0VNE?;>9!KN)Q+*l23a10;dxuMQR5^TpB4iia!*%3`>c+}#|A0tHvP6y&Pa-%F3R~tHGJLWS zGjY>_gK`64E)BT{J&(`40ePWZCdUr;j5+(MKVKJ#G@gUKhz*A6G0f&Gg{D6mCV9{s z?l02|!uPrjz2%x#$+i-B@f1S|J4;TNeF746;wy_uAINi>4~!My3^wc)P?G@mm<^k- zn|K*Kb83r-wu)a#)wrkS?lmpA4)Bl~o}Gm;nMR_vN}{P9!rV58Oc3TW)l2kx3aW?j znpDPEKT7g~DkM6ax-aRJ2jRZlXn(8D-vWyC?zaRITpHn;%S)PLxJ48gTXYwSI73o4 zQ;k^(eExic-TPbLxa6(2iacz~x5-&9g@=x3~QQ&)(n5yAJ3gPQNrFX758!ok#oSn$@31 zcXyCRxw8Cg020BC!IujAR^hRow(4snm05bgTUwKsG5y)F^1gCiT@k}+(rLlUbXr+A zt!*Jl7g;76p-d^m7V$$i0_(;YLi+2D8pX&}Gc5QR*py@S zw1YzYoK@qtYIh12Q@KVD8s#|=m?jKle!j}S_I08hBn!x&XX!J-j!IY-7?5U~X2R2i zZ0$QZ2rwBnLE`8W2Rh1Ou)oEaL||4Nnh2{~0a@mY&VAmim21*u0(>h*D#%sTtLQfx znx{ZUD~?A&_L9orEWwh?XkB`x_)J5A@%mUbLuSRz?ooK%3t%8Ub01bW{6J#HG8^W1 z=_)gU!uYw3?@lflD3W3M5o;4y2v#98))@UOw&jWVeb1t3tC!sV-A5u_xSHD|Fbw;A zLTk-O-S2ir2>~|iskeemYA)4tV-d)fR|aWD=DY@h5_iEG#|5N@?4+?8ksoL7T;>F9 z{`}&;KkyV3e5PVAWl72Ra^Sjde;J}j1>$#{mxGGpt0w6A-d1c~7%jlh#kIO$6X*Qa zY&p+9(m`wrz#wXvzLs#xL-O*>`N#9Cx6XLlOo0jLf=LGWf#P0dX19aP zan@-&o=67h%>;_6jhK+o4SW;;T(5zU=Cp-=*Us z=SLWza=LS~L{lT{#nFtNTgAWO2_IsQT7g`O-ozsE%nc#e{WA6 z{Qi>>dbGt^ltI7T=`@P4XqZYVW=sO=dtI#kHt5@1WV!6iWtUoiZrh%7g#4n zJZ8+Wer7!l0z%uUJY}6*`G9YD2P6W&8e-MW^}`R4K1TTXX>ro44aTAIDZ;cx5<-)! zO)hI(Q>Jbjk%*FpOzG9G3xrsqxs|%i64K>sJ#q8$J0^E{=*ZBV=TU1*vRY&o3(2L2 z1tJ%N52OtdaaB=q-_$xMepR7v=V`eVu%YAyC`FoD)e(L!+AH+hUKEe!TBwrzqD-PP z*_2M4KoE)(Y#lj6*geQZR(#-_9~nn|zPcx?i68-D`YR5R;tv+yX8wgCq+n4fy7tLG zESilzef+1P`Yvz~U6B2dT<*Yp$l!=JGb-jwN^F{xL6TH4gYpQ5CWf>( z@1i>U9_!64vd5lTK^lRFstV*Amv>l_V8~ZQ#Mnxzs2K<=D-#!Fyh;}iCt;WQ_S5#H zQ)7%cu05j_Tkk2E7-Yj@2+?KAv9GWW=psqDvVj_WC!lMJFNCF_lPtY5N238J-wZ8T zZVMhOYNn)WStB~U1kdDwdtVWo#pzKa%(XfxKri!B%LXv1JpNH9oWL^S%GM*O^*A`Z zT<2;(`VCqO7T*tmYHBhThDtn>D1jmnh0GH`68t-M0rC#1(-}_pHxY$lGu#=aRD}Wg z^SyYBu1ux0Ut>TX_!?a(?t!tenq1jV+M!UuBb2j3;_|7kZGO5!rfz{j?>$UnetXP( zGHDtzr7{#HUoo>+$B%>QJNX6IB0|$K##sXWI!*2qo=AbnBFVRN_v8I2Eq1Dby0I)3te+- z??N!!Sfa)Fn0~*S%UKK34bjc+OOTJXnGR-w^ktg>WHwfs4s;h?nwSoQE!~O~^AURc zO0o{ZRQ40N;?Q0ASS$b4qyY?0N2u5A98JyfL7W?$T$fq{)(!{T7w+A=Wmg5{G2H9A z^SVhutvzoUPhrmSbh<*9#55|LTe>o?aCG8&ErhL)X2Ae zg!GV=PcW!AU5Ha|ZIamu{Z^@B{1YBv1llu0{s5|(=Y-7OeP8ddAHb6rP#HAiPhgh) zw$OjGB>ywe{wMGHFJUq}0A=={&o z{+s#v^XUHf>G}U7DgHZ@|Lf8J2Yu344gHTy1?I2H;Fl~$;r-nVJ4pZTk~^P!s=Z)puk7fZs zmy0R^6b7_WG=O}>j60rlW?h~uR&Wp#gZ#XBX`RZ;q*Apv z8%HL4Fjby77D+i$^qjltnMrryYVpBe=}b~lS@yjDG5UK(S0ZVY%Tpq=%Y(mDii`m2 znrw7_*5hjMzvS~MWqcc^8XGZucm3mW}tjcGPcWwlpFrWHa1!SmY-}HfB087$O zU4U-E!B(#f7+3KpZ!Dud+Doi{+K*Vs1(t|cy$_Gk(?6NX6t2$5zn zyb+IVGg~AXT!z@UL3FI7t?EX2&~UFj3NT}E*O9VEI*3%=3!}h-v-j{OI&t<-O%+Q4 zWtP`RM)Xb{e%uk<*4rBqOlp+a>@lCN}No6;ZG5%ZJbt` z6_Au^CecZbkW}mdf`>BTMPxb*kTi2=Cl7*oRelL4G}N*X6&Cq=B79vC>XWZZocA-^ z>2-eB<wXOhCIvL z#3GIx2NN$JMa+T~mM-4;yjwIVBB~1(7C5(4{fh@=zIC3jr7WPnJj@8tBT{>(R3_`8 z?=<^Us~?i_FNV_Wkps30#mkF85Ph(H-YUPV7-#$VQtMaf=%fcK9 z=>{elWFqR16TjiXGRGiQn~aU%Sc3@B5fQ$}|m}lS-3w zPrQLul`{AsFz&DhPi=(}PTXylQtfo>sY@l-+~`?rXy|6IXjWMuju70iu4nl*XD#eDj9cZ!9>(8Ljv01Eqh zX=i;MS_s5R`9SoQO33xLv_mp2W_FaMYp#Cm0U zjcdUCPA&e4Fp{?Hc@9h_nE^@uor?pJ6hk@@?px|QE*)cOZI&sWG%^a0qiPchd#WfN z+rD6V?wVS9h|i@UK8f-=@QyNJ?cM#Jzlz<6=?zJGIY{E>@f(KLYv3DW$AXsJ0n_Mj zD1=b^HJj0|iHXNgfY((c!b394&o{*Sib6 zOL4|m)s|KQ`G(e~M`I7I4#a@V$7FK+$YVgcq#|NK9MHE>F0!;VPt~p?f{zcSO`05! zc{znH)%^Z}YRbz@JVOi`JXwb(pH+UShSLjZ$TTiYYcl-T^l?%<2Q!_UfSaDwTwh;# zH!(ll#6xEJfC7vOgOe@ssLq2;eCAllH3dVRr2eYBs%gQ#h8%s1cg15R~CH-U}FmyB0>>i4qiXWR^r_gxl?rfav9GrzW$j zV~IW?T8?|lGU&2HgWs2;mW+BseQbbP%L*mRnn7+rpp^Qm zSGBJe8qX!$d$Zi$`lG40A#5UrOE%AT0eEmWbJAYAj;qv1>sXSS5^p!$U~16-F-F3` z*`ANbz*Bn@IE^h7Bnkimcm!44vGB6Wo|Ev=HuE*iaAxWawF}*ZqB@Q}h3%*UwD(7E z7Ka_x#tEh6TZN?OH5R`W)^Z+S$h^-1|1jhx{hc{7a{6-pAb+)_+wOeQnLe+LR#Y2EZi_nBPQJoUw3CKK87 zH6_^{+)M-S=WGYti4`DZ=n7k2ZiyAXfvuOgLLf~P%D$BmrnSK%9qX`h zr$E~Wj@a`kh6N*!Fz%OjiOxfiw;=D%m|0vLED=q*aV^!}yyu(Yufz@qgCaa^7olTP z4%xG?qavxN2xwZ|P-*CT6KHZ@**6Hw%0M>(X%+T@vY3Z-*NRRwg|@U7oaB0TtEYaJ z0MZBAID^SmPN(C7sT&ek0lwcujmsC0d!C{xV*U2$%2{lpml7+MI_kS**W)%nGUsc> zmZwN3^F#-?7s_U0z#sor^E)M@jsic>W!+qt|kc{?7HA<1PWT> zU_><+8x;69;slYaguN6_KochqYt^qS3-*g2comFYu6KHFlG;67{Gi6>hL#wogJUh> zHibbDzGhnK-FiygE(K97;ni+1CeSx(S{yd68gS<~e%$ivoT4{I&tQ!TiUI?gUR8uC4FPT`>G>)M{; z^WoCr!0V@NM7EIX!U!)nMPn9NRmTaeQn;)?i`2ns)29Ws9dA-wt)Qhw96SY;9Uodr zBy?$h81tOY{+HN`yRd{~+RT#*BaTri8O(cXpH zTpYYK&bQD)Zou*vsXx2jzyFfi5FoRPQHBo*}ZTY zRVIG>Woc?>SQ$AK6%#2stVM;y%qC-D>-Eqe0Q(HqpgL&v_QS7}vpto*u==SLKiHG2 z?GtJrxpzq5cvtB=wyy55{&)AiPjFudd*Oex4Ei(H`}Y^SOdNlA(f!xO?u3@L?d~AL zhfVjVFCT9Jr3~|9pcW$pY_k?^GBP)Q!^VRkExFmRxX^f#!2C0&u#d;daaxMe-<+lO z%$WG5ofojCSzi!$pskd`RDIKJ%hUC`(!BPqviaVtqgkiIyRF$v0}ZXq=++^XW#8h5 zeM5`+)vT8w8miyM{)#mH_8#T1R8=W}vtpJ@w9-kduEVWpRD$1eh=UZLV*K+3L zhe>Gm zm{+Psfpf>(>X&^*kD0Fa4UJ z)CfD^!NhmA$i>?&c%1IzIPPqFj%OCR{8(E-LtW}ipn zGYFx(){aMjn{x@Nr5AP=6S=)8a%4#neNLtcd1-THYg1hbD6_h~1$??~i;n{!9Lc4_ zhP~Tv6F~hwda`Brc{k9~>JL2=``of4z}Yc~p=3U?ACsH(HOKZ)(%VkTnX1&mTvC2Y zR`m&)^H}C?MF$??%`7jmv_O9OE*gIuZ|K0+b_vs=Xvb8GAl1^zA(HwC|+B;Xa~d zcB3qD%_07KARp;An64wfheqyP9Q!Xe4MHQpz`(ua@4<|Hzz0L{zeB>&{jt9VN3D3O4p%5DUcIB;gE77AwR&IasE1f(<27YA00ML!9Tanm08iQj9 zI-ZMbM2gcSWiO$KLnj!a&!*M`@l_Z56i%vo7|G1B!@(ZA7>NrKvG1%=L_FfnWIv^S z(LCuYi3?H<;ECXEOAfzb(qd?A44Lfq2Xzm)5Ls+^wK=^nHtF8aTV}D}?{_A}aZTQ0 zT4#REIqOtG6h71Xzhx32IhgUH&&RK}@)9QjUZfdx0h=l5mu20~HThBxd7cNlK?1B& zFm1!~hEkSByzhBUiU{289uh!fYp;LTqno<%VC46*>ayss)1j&>Wfr`GeIGAP&;?Y~_TKS67{ z;D`y~D*@)KsKU&AbJmeX3-6VAUn&?N91YzZD1shUr?0W7Ws`dJQR3K)h_QdU>g0+fr&# zWmz0ONTsf91)yQ^Kp}}^QxplYoJ(Gn6?blZ$TKpX?)k#SU_`=+FraZL4~{8PXdb$* zIm2yJI+eXeFFQIW0F z`U9o@k6`cZ5i*Y#th?OmoN+tQwdj!Bl>B5j;jZWda-wEmfZuDYu-t^2wI`_Pf|B%P zy3o4WLEXaoCS)EmkppYSCLJwwjknYz-9`()zlDa83$DPXasx=KhoaS{xj50fm{EOi zgUo`KXB@<%e|8(|oh2CBO-;!(s|+r0$Zj5Ee0R&jk~ougZ+Iqt+kd@1CKbzR&SIIT zh$A4rr310O;00PtND{3eOr!^p*N5v^P0Q&U!kiyzqJc&cyux=GUx8``w2epX))%)Y z*etcJ&NGI-g$TmH287a$h*rq470@w^iV`<^Lww6-fF@Q&C(sbX?BVkxji|UyeEcp^ z-3-1jN1awqF%vg!5FdpBS4#=0bmvzB5(utG1ZW9f#qlFhM0S*Ic;32j7wO_ zIyC{2ut0QT06>wdJlKO9Po5I&B=~^E3A~svNUmfemtkvV=MpBIH1E)`aKbLsF>;$* zX^Q30nK{m8W~f(KF6MwcEL!=?fg`K`1M8L(2zkh6aDHT2f@`~6X#g7ue1Rr4>KA*F z0WeZE&D>-V!+Q&*#Wj$gJ7L%{VctO4yAJ5j*DI-?fKK{lLal4c9KmR2nGq(eY_gU% z=uSI=K{xvPA}VR2KL@d^`g4Ubszs{uRlN8dql&Z(vhUwx{o?EJrXgrpPtf?MBfpoz@l6Av3}CugkHG0Q-cmFWJK zH|q@{+{%t)jqihq9@L5mHnKB+?xaim!Pg5-R2fIei*s3B&lK5_5OZRXU0Lsw1mB!( z2m-I{gZU%+qE56rKTf?%fQ)vUrC-^tVlPnd+si3xuE;RfHT{hMOzzuQgML<~B$Lx>;?{5}GDuEEt_|P8W;0{Ry1Oaf>uXv|J@o7fQ`Vu7 zPeNZ~4Jef0y$(?u3ACr*oi**$_z|UPaX?0Di)8UxzQSWB`Biq#J7 z(M8+WaBznqBVXAq?^Hl*?wfb)!p(vDSjh?Su*`Nw7Db&ZV^#yj1gxmIhk^Ro=J(KI z;xJkJuEx<_*aNa@8xX$x;lL6|AT>Ul?X1qn8+qPRrneSzC9A_eUIO zm}&Kp#2P?DR_duMwl}gEuyphM_OX;8xdW=$MBd;tW(k^zgJdw+2P%Zs0RM@6iyYWo z@^r7#ffCA&%P1=?JTi}|9f@OUbQ5Y#P9s&RO6R-)k`QPcuMn#nUpT^s;%+w)Z&M(O zciL&~oXu{L6U-R`pKBdWtb)tNil%z1+fuv1E>xPP#C`hVmC^a*P5D z;pU7}g64#COf5rHp*`16gq>nkB_XR}7iDr;eA@1g;<5mR7l3#;SI&;HC)U$&su| z-0MAC^w@xH2g;hvZ-jt~e*>xY`20iXa7#WTrz6QJ!kb&EV?GF|lp8F^vQ1;`LHn_S zf=kM-D?ac{5d9<{aCK4+)(!0y@~O|EvGk@lg(fHy{!KbE4xcx0@1|23>9Iq!NdrTs z^-NV;DM5GPIkMJP?V3Zo@klClag6|Turuq&r|*y3pJ&4{2QY)Ht(sG*4wp>! zzBr<&2Ms9b5*YyeRVYWI1VgzYfu(GDsVJ37F=wAr{9dYZEHe5>iSjG@0R?)D{oFXH zm+mSSI|IcEMQw0lNqaG=s7eD`o)o37nXY2%Q7mXVEfE;U|C4URN=feJdc0!BHHGcjbQ*k30w z4uB^p`Q2jJ6kjawOd})#aCHi-d#X%J#M?K0-ZCI-wh0i#``5vJws< znP!#R@s`qI1D$xu?-LKQuF;*zVHAgJU!giW7EW2JF^rQ4B4C! z5a&@nZsA8v|vy{+JjTRv6j694fj4GM2Jcs^wc;#IM52?8kO0N?T4$4;r?1kQRWkg?RZX zrit=?g<#a!Dh#?li7^{flV=>y?v9s@_BqQ28N~G?5N>TV@FFD$0rHZgRPybTj5hsP zHs&sU{5pvV_Bcg`@nndOA4zm)`xq1Uuj-`QgE)Ecaiq)2<^&EA zTXu$OZH?om^rfm~np`$%!5TRscd~89CSAvRgznVEwLLg`gSgDrbX_vxa?1-OP2ZYf z8g3)yZbFU^qpA0B5M^7I>z@6-_b9OFl~*-P%zE{5lY~*?6f)NNf;R6kj*a>>4goX_%up+Ll|mVQG0w-L=XkaQhW$qFG8Ec z&;zB+xC2S&KC;q)Y7>0~P=qeqLUn-C&yRn1rlWUo(>tJR40g%-3o5s8_=++sqEie zy8lxM^N*_d-%ND>P_`)jHx&fapH&dT{9h^vL47N80|#>&ai^~hLpoubFZbV!Bl+u~liKdb(9*leILkK(`{;GXBe< zp}lowoz3mEh%gOxA&qU)b*szy-GATh>ak6g#$r44BlT%*rZFOI$ z<>KM(>;!xVV&~b{@%wk)zQs>yJ@hVj8)YeF z#O`J?Y>ugY5;KJGOo4&c|uuHoU?h_uN08YlD#*h zRBVhGg?Ei+A|zSjqIe=4fSI540!dkQ!W<+t7%lf;%7^Y9rQ5lw`8MxfE6CHO0&SoX zTyM(DIHAx)bl+rgzP%mqg5Pefe}A+wNUbNodW#pwqI`wk6VgG?l94e^O<#We4Y-G2 ziAf(oC+KRP$~X-#kuI|`Ps=e1u4n-eQA?Tzp^qgk5ymf7OAVF~!5y0^BLh=Q;Zo-e z=w8z}Q7Y#C+en2Y*$!_)Jw`rqpQTt2CTuS7a9_opM|Y)=`u;ay_7qKgJcte_z_~gT zLZ{@5tqq2@Zx(bdH7dljm4;siCjvvsc_Oe5B0`%6HD6O+ae*XsuNrArgNgFV^USxs zE#9iS)<$a_-!$Y5nK?9S#vfq4ex~>lGgv;rs~w05K?IH4LnCRQlIivQ=@eJKv_N+A zQtNy$C@C-T^1MvzP3Yjm0PoV*)j%n#J};*2k8s^>hFiDD_7FF<(Z8~C9#J%y;Lz8` zn6%s`tpHm!TV?wIYz!imdgG5{74?BaF|m56mt+L(=vnNP=gMONEx;i}|R#vNTODdTf5 zNX{a(OIVes0k=aE(XHp5z9XjWNYN5etVat+;csR)=%dEzSs%vtTdN#J`$b>}I2jud z;?qR_Gn~frbsm*u4xZ$9McB3V8MJR`l%aa6}`Sl#!o%vvVi+`;14Jh4n=% z#^nqWc73hIwqKpYiDDcy{OsAtKo!-G%ndJ#=s7arkvpdqufnl;#97(po6S%I+ zD&f*_x~7O%gPCQwC$)HfVw-Hc$Q{f`n}E(CjDz(#9d|uXuEzni_Tff0lj$4C;VQ6h z7Z{8un{IYnd~9QIFe9KQtMjK;-Uft2UFL94HHQx-Mw%0S1Wk-j!mILW4$U^Ko?AFr zt*Q7c%3Rwwm`Xx=mNbiRkw=rJPehtl+onCc-n{<0*({+jexj@R>tPn5+x|Aa+1d>A z`I~#g1K2T;T!ZzJ(vKtJR%WC}mN|A??}xw+5x7XF;Zxo72K;On>lCnHKlk9M*W|B6 zDc^9ryO#gmk@$B4mTm@s5t+eArFPM0&X9$8RwBKT7x@R6WX4O;=wC z_95YjeZT4UQIJN?Ok=s5m~)!GvG&Czfv8K3ee>tBtj!o)m<(uw%iaq5Il|P>y8E4& zJ_2k%#<>35DD_xnS6+FE^Pw;?df)N!CJ*wLp)54>qp;$eWW1niH8F~qbHyG1xTywJ zh>zwmz7M*Fl`%*y+(V^1_k|emVBp-`7W%Fv_riA`1@P|cG!zSeVUC?Z1y**nRUQ8! z%v1qg%!BIQ25C6;x*S&EeK}VNlYvyV_dpXF%Va%SOlW^z6z*9U;0mE;kKaj>gJOd2 zxOj2QqUWm#XT+fl*q<)PerTDP&7wLfOa%!3mQEOeOm@VuBNZGQ!Co;3G7CjkG)<*m zAQMCk(OZHy2s(D0m1x)^K-?MEv0D#l{h3``Tj%W{i9qD0R&!ae&7_hKz6KI{56GAc z3EvDg6HPKttamKGH4Qb^SH~@K{=CL;FVcjSPMnE6z#;~x?&lrp?{i5j%r_n>6UoOk zxI-05D>ioIry|*?nYoLkGxvR{Q7O!)9C^bKFKujB^%1TadYv@skn%B>)}}VW)e*Xo zJ_JoMnqeD17$Y7~VxtegxZp${ZshPjK{%uo1qRlddx<>{BVKXH4BC9j7q7h+uipsY za8lF(26o-7>TZcl?Zbe~=9{8rO;P3wi7`fAk1)&xe*3*i9l-@m$QtT<4jq7y^6I7z zP1QoL0Yo`SxrK`>n*cpN=&9 zSv7zpwI{qoP#8cX3me7@GD_Vi{4ER$l~2BIaOf5N43r~LU#*`fObJ;JMPdp{aOH)@6Hq^(tWdn2+}ZnH{IJH$nOkcT+F5#CS^w#gOSw|k~MZv<5O=F?AmKO z*M)D_w*J&#a9HEgTpqs1s=@5o)ps`f5IqsBQ`NSHA6E?vJs@kWkQhNN0=_3c6yI@? zt33JIoY*x7Q; z2wLacbid1MoIVc!reuK4V;h^zfYi#$k9T?E#tG|pg=o(R6x27&aWTFIwT3VbIWWSi zjWla(1tjB&@q8QSkO`9{&jzB4h6H0z@=?K+u!EFP&pMihgM(+qtq)%PZIm=Dcl!g?KLB4%~Fmd7WmEfF8X#;YX1THYu zXrE^t<(PVRy$mRc+Pb>wkrMKzMFo86*q~`c-NA|LZ>zoq{^|9WB?JRXx{&&ven>wp zq#K1=a69pPOxv@xX0s#FQrrHalx9}Q7Pti665^XTPZ~aFA+49^r)DZ(jbooKoQN2C z4pej`gm7?5SK2k#^JFveZ6o5BVVLxo_^%d1J<9Ys5X>fWpJ#yVqq#IqBAVsGq;85luVlA zD~4e^AK8pPvwlEs86<-S`@Yw%dg3x|RQVy7bxCn3G(xje#}aroot4RXpMprH9fIZ{ zy5@w^lEp7Ln+C+Cc!`L&bU$*SvioIG1D@%X+(VzEkFOOM@Dd9d8O^RYwc{iQ_7c@p z8K@IF)zEMnL8E&bs$ET~&0!Q~O1y}11^rO5c!#5(g5#>8qi-fnNsp&cH+-mjLD10V z-oWca$09icmkW&L>`U;>&NGLl#L=2*mj(10bZF??i1!Q_0HQK=ALb5Y@`(kf!Dev_QDRa?m*z#yQa3CNUiv@^gEZIykLVif84b-x$!b+6io!vnf!2+E?`9wF^ z2#^?7m1%`{;d{S&4X|nzj|6M5fXJfUSb11B$eQPeeqIt!QRh+Z15Kg=l`bXISQ74T zM{kx@E@W_aE>!CR7lf|nZq1%PFl4ni0qfOlI_mV8}yZkYy43lC;d(pzC?MV1^<~TS;f5VB;(+BWF7aGCG}u zsCbYEOGK!K0Ns&#Z-@tbP--J2hVAk3q{#Gc`Wmvx6nn^?2wem=E?jO0*;9JR^e)B; zx=sW(0BS!CHm}vXNd=pNCAt3mv2U+ncu#h{1+VJ*I{3WNYqP5-RgMzJqBagmM~f(d z7+dl%qSRR*YBE*gH7M#O6xAkb<{1@JHa^n zrR}%jG(GXzE|;j_Q)E6t1pcJF8g}~eEinQ4Er4?VcpZddji#zTJTqo%;a1^ZtH;=N zu|N+w2ATObFDH(z-l%xy}AG0SQ}-s0MVvn z+)4cVl%Bd~aXD|bjOR|^>o3nXf*Xu7Rl{E+_d@3=Ycq{xr9Lo(+BL-hl9IGxy}{7U zv5nwj2;1@(+<8y_jo?=`xDfrWN{MNf&=C7P8!Z|oYrGyqLm|d+`i5^vC?|a0)L=ol z<_7CofSbyzynrky=6c7+-%E2A+r0&R^Cu88vHKU|; z@Q-6UGcWA->cBi*6h7<6oEoyZVa!f8zEC66;_xQYtY*>As(Oz** z2*nii^{)(0717Vh2kANN0Pv)j#;n2QRhJ{OChQ#IFTx%XU0*?5wBato$_n7DG@8wh z=dffn3pN5>GM@xVC!{HOJ<=pREl5cLe8!n=AF~BT>z$J6%joO%6L8Z*nX~)p@M_TrXvKn5B6#(3X0t$db$2wq$7W zF2mw=Z_*r6*}fDn4mF(?SBtX3UfN2RTi~B>cMMOvSNKr|Z*N*0ZoDZ4yej}_tbJiB(bf9o~)@wOE{ z^7I0^Csr#xNd>PV>?_qNbge9{hK;&(8VXsItx-i95gh%*oMNQUM0aIRpOL>~;ZWW? z0Ms=&78KMxNZ{ahi~2y_QInbCn?}@(rIll1@jw)hO{iF!8_|-a*8RrP%`WUi8Q{pG z&*=exPA4Zy3s{Ve>cPhO3V|US>d?c&(*{XFnAv<#mgZ2y2MIi30wvhU2|!)%)KM08 zT|hlWnApn4iR;bNlQ%wcuBc@?)+z;b$vO;ZgfnBk3esKr==NQ=9Pqm^GiMB?2=K-E zQ!WbNRiNA0b92iFb?2oyY*1tE`Jb}_(BDJ{iAuD(-*x7PPv$HF6WrMQq~&Pkc`|eI#{tVPbp`7k zy1v{2s`PJ+Xl6X~Em6&O6H7iIV$}Q^9f6n?_yrK-tN55PuKW(n!~KS*46*t0XM1aw zdKmM@b+yVSByq*pzwg*f5DEO$o{YaiTie}Z6cDEZ9bmFkGR2{$KmvI1MU-rk;-|-P zZ%bbRjD^z-;~fml0&LYI9=-LgY*`|I*ijg<1A~U#K;TjCfg^ZPb$_GR0Nmnpq|n_< z`d$bs*ULq2`8L)UC{IG^!Csp;F1fyXK;y2lx6}}5xB!!$hhh*cF#qtYl#$Q3(BhB~ zL}skD{}syuDs~HYgywP+;oC_q0nAqP7Qlz9kbo@nv>qqfT9mT9tUVf_sSl_~JF$8Z zLP{V;g^UJTw>93LTa~#T11Ltykcii>LwfvF`uxTTFKdXQ*=)cjNBym{rj`g8+LL?e z7~VdNQFC?b$XE%wtW59zo?)nnNF1px?p@&8U(si5LZheRk2Z4^m1?X7HC+#f9|ZDS zxwu@KHIeQCE{gyz05y23PymRLd}@|00@OYU!OCtiH&VADmS{@5O!#x#F!`0wg)I#4 za^yYkrW`g?!Z<5G)lqd4kj$IdI*5B6b1$8=mCy6Ao?h((*G)X|6WpXvQI*+cAYnx? z4UEJBdFET?^1tgAviK+y#Q5($@L7zER2+q&|#m zwppQO#daF#nGhy|W%mFTd5XI>iAN%>K@m8=T)R zp5slWsV@O1x7L^Sow3zcJ|T|w{F&?8tcsjt4?8dVgaD{Jr60b{aMm;&I}DYvYes-( zJAA2ofV&UHR1l&qJ^q~r9+MI*$8eThwBB&nwR#~{kszTM! zQ%XE>r|`v>b-X6wn? z>X3lEp>u$<;oyxVhlrWhVsS#}uuKf~Y?3!MWIO;UHaqjoxFScW{u{&I|A($~iq0(R zwry*%aDdUuD7$SofAi-VDqovaoAbtazzq&g+7^;;av;{sMTscuKI5_*B|FmWR zl#Vmwd~(?F7)jj0eNksVpd|RR5`?Wl_J*51qj5MHXiyXT?77c`K$U!gKdraoRFWiR zJGLMc-mykpFZ^j(Tv%EKF|j@(JK=crG#U%asdo1yw<=jS`Oo zKXmEkD~KXQ2SJx|ika$o8E3Edi^0Nt&Utpkn8rzX-Y>Sg{q1 z-#~cpjuU*?>pGKaU2KbgoT2jG97IQ{=MDX&~ z0%vO1$f?ie>4s(jxn5C6Fi1!f&=uimq|(G0ZO4t*7t;FwW{<)ZVs^_`X>^1Xp=W1uT1p-dpP#*8yh3{bi_W~zYDS&ls`rrzB;O` zAE6|}*J;xz$P+c$i>MURQ(To(PVZc78Y+bWUaF59iq3O0*8#QE= z65%5VwUQ)3nrXt~VxT+|>A0EYoutJdWVB<{1=FUIjP3v0s2i?27H)XOix+;^3T^()rNM1QwPVBc z;;E^Fl2|mC=7pw5DBvMC#hs?&dK<3JV>4#gHD3iQjGeg1aYA7&ox%}ZW-tptgP(g*0>Kh{tO5`wNEO?j3xo|nF{~C+JHjg9lalZzTR8aGck%{tz z>Z%YZakeV$f*1LYAO@?8uq~;0#A5kv(&mxZg|-XpzX3}qSMTdDD(0AdkFr&h#>1tc z-VAobeM!Yo%}{ve)f9~ltXkU9ERDiyYSVkoZpswxTq4BjhwzyE+~wQ~_7B0Vfs#E- z?aehn!uGA$^!A>&m^ppV4|JId`MRiw_N#4um%3Kbp`M*7)m#}0c}t%+NvZ7RoDjQ} zR+)~gowL4MPMmE~XodO)6hyJk*a&4-d(7o=ziQ8EFyo>5PE$F_LcatYqM@9#)p%eK zzK-D4N;3vE?m|-|A;GVFVq`+~>*IMWw`ha~RgsuPwco$^!FaY%NtH~LFb zJ}C6R*XxT&$Ok+?<)f^hGz+X{c461K+OSd~Czt}eU%&s_^be;;3|;iEGY~TZ$p+nJ zss}$Tj_o=`ifeo`ukKk6Evy8SfG(kx@`KX&u5$Zy!smoxzx>(qW7+_Ac+_i}B#dei zaJ3QHdqaNm8Y?jlE*x9;U@J%^IS3y;{L_u|r!t`*_$7j@7Sg;v(+?L{nD~pv5osOd z!(nbBcX5bzzn)7ONhkm5o|Ac7WQxi2&P$CDH=A_9oAI~dMVxD->I0buEr~D%3mnmp zYPt;N+^{#1wX1G=Q7P2TBoC+P_d5vf%Ve8@k$;#8B0g`!I1x6&x0gdA*jHqFW_1i~ zdVKn;C!0Yh)_q~NJ8pFPaI%`n^q0N554z$u}l(V?Je1i`? zNG&)P;GCwhiX9p5U8Y*Lj&(J?l7Ba*X?Q_##^LdDZi(XRm$W7B5doOAQ=buL{jjUC~_^%BBtL?=rMmn3LUqEf9S~CuDg=wrW;DYAIe$Y!;gM>ls`do_;#E z8uJ<1Q}0>+wWXiI)K~870}hw;HUxX|@_{P?;WoJpyAw3K&AuN{QEGu-qo7T17Aj@c zf*T7#`D0^UIkKV&=aT9W)CAkWbJC2(N$sSa<#)zCrC{31)z(s({TROsl9$sS@Z}3= zQG|@hW5p+a6eMn>;cf=|im$nW zC(Ul$(DMMnQ!G@(on>7R+^xa~(5?R$QP6~9=|tA6Vf1#~3g}B0^L%9^-hNvCByl6# zjd5$Qe5@AVoGnAK(_-sWzOCcjM6|g0`vtG{XSIjp7fZy!)l7_r8LjpicyzqDgzUHt z6dwEj-mbDa%H%(Q_4)Y4Q4M0#7*RlPzn&ztWGBF)&1EWXq5aFrv=cW|s(k*!O%p~M zPp>SzXDB;!7hZmaoq7=6m<%iD&-qM6%9HJeCsJMG{OPduclw=2-%zd_`haXoR`A5> zu9Y)LueF$2oDJlXeSJXMj2}&sPx34Q3baaVVz|0@%kcPoQMQ-WkdQ zYUJAd<|8-=j}QFWAL{3bx#v_eZ0pWsJx!U+MfUGiMm5Ejt%S>DFW_{oDWfg66UI*i z08=?maFNVnwRNKf20g#QXavo9*t~)-gYUnHb`lZOQ&r0EUk8KmW)plObLFr|u+nVW zCjVM*A4oivKWn78c{u$ra`5HGW!HIO2NbVf6l-|0XTDsBef1W0-cn2fFriHZ<;||4 zGpj79;ax(!2lKXrpS`M$s~bUda}@tZd@V#a`u}%99RJfK^`E;SmVZL1|F;Y3#sX$woHErv>!tNb|7%tpOiKbZ}>UyY>n036f!&4S+>&S2_ zrDyBPm^#!S}x%A0N)bR6NTGa4^vD+P!=8>q<$;SS^ zo4dO4io0gR)C7lpw)+i3&W@Zs&&r^`A{xx7vrCn({_g}7JK7v(Zr-=qo$UR`!>xbc z{>=dLz*BN#8$WOVd@e~g7DoI8^g-VfvH2a)f3rr-Rr?oa09wS1(}<-M{IeJj`q{($ za`H6>Y1mpw{ z``nvTa`-_k{hhv<`Ig4qL*dKP^FCPo31&$7PWhpIiZ<-Pug3 z$#k75Ng$62o;uUh_nHusJVZ@ZWhVnHw|=9!JpExDm71FsYv>4VK5+qdz(;@LoVt(u zEtRHldDx+8smwGZYYpH)Wc)Y!0vIJah9-48dO znI!MPF0w^Lg&Ih*uCFKhVq)2V?)ImQOgctB{mdssK23b%O& zY5aH$o^x3P(%9-~rcca_M68e=i!kZoUjl#6fzAQBjJy4twTNjYq)JNa!4W>TbcE1c5F{+nq%rF}%H}jD&I~h$Wbo7l#?yFj zCA`kpJIFtF$3?Yua{W7rUE8lYiFM3+0kbBW4tJuG&ne3iODfEvfgO&#PG)cw;TrZ* zWI)8SOP|q9+0=Z~E`^YN^%b;SgggmkUK!=f;kS-_DyDa%7{5X>*%|rd_nZPN2AXeWXlFsaTh6Eni?p4TW&n-Cx_mFtElwLj4(rG{bj#M)8<#y0y z|91E%B~vvadVrcYx^;OVB*03*SmDz0QJbO*Dn|r%>cBc2#Sg_2P!mMBhJ>B>kHu+$ zps|~O6VQ@+Q;$`xagvaB>Yal&WR4Oib|HvsyE=_wC;k3bOT?N2Hb^1cI02=YSG}&r zX4kM_nu2IwgN(tuWtXt&f}B>Qm1j82;-!jWvoI8)pgCB|uwB z&rAr4_}UJKhXc3?$kv<+hfvlzIf|F@@pKL-N%3T}8g9|P;V{;3eR(a5R)J@UEM}_? z^$ho<78PVJy#MzAM7$7OS8m!E0TmoibgBwi89GW+x9LgsKqvT=RwEtJfUofUO@W;< zekf73g9nCYLY?8wpSW)F1I)FH$^63AIi1DEghfhkz9en}!ugB7;M$p26C;fAl>Yp) zDQmOHYT&=%!u6`@pdL;Eg0zMT3&`f29VcA^X@*LB|$*dooU(TvFByE z%tW{z3o)@rcupd2^6oQG#V#P)91aI#VS$k|c(E{L6B?W6LFgH3L--JoAcWG2QTHexXqJ6U z6w@(=#Km{f-}gwp>JL#af3_%_4i81~u1xFdXclypB!*0U&>kZae!v+1qK+Egnab}g zeNfe|VC69+mD+jDTnt=Qje*c@IAGT#(^;A@c8YViFqU{P1GUw15u%He*OL+JuzH?D zS~-wjlh7#MFp7y?$%v{ke);&)Cf?kzFqbOEz!+QFyaV&)_Zb8;8O%G-`q>js9GW*I z?i3eYMPOk?ueX#I4PEBiOhiWutvnijhY`#df_O?OoP|^Z()Pe&1Hrqw@kT0KEHUy! z;>yFzwY&P22GTv!J~z@u`~0ZaMhgYUi_}Vo@2~ zn9<)=&ij|os5tEMZxChhlwX}WuL{(qNAx{d_ z4SVc!b)W<96kP{^?&NSkhz3d7{o3GGGL8nK-9r-)mOrM)7=`8v#gN~%b@^W)UKN%p zc>u$a`Xv#suww!`O_Xz>Ln+K$3iS%s1b2^7Vi{*Z?7wlQayKX_X_yt4%6j!xRXPKG zC3l(z=Y;%^7)VIJ(6iDm%S_(Ck_l$Ka1wp|tTm+WPMe|NUwCW_?gw#x{ zvDZg}s96S7y)Tqkv2c>N)d=4g`#=9N@Iw_e`xR6zy@=-TZv7B%pi6^uk+?6WZzS1XW-Pf&Kl zx|M%&Xu9Z2c#K@Em8jK4YQ=fUgk{1scMZ?e08ecS4B15B(c}KM!9O6@^77WaH04{b z8ldzVhYf6>0#1b{&2$RdNu=u4Ej65hzgxI|xkUd`g#|GD(PgYJzI>yEMnL}XMj(9) zX8nDFD;C!T03zAMxMlbw%}FQ!mcZd+z(3c@t^e38pq-*J9&R(DrZVX&fAD}Q;Y4P0 z+7l2v-}HGDtfo3DbP&+nM&M))LU_oNFNhj4A`=wejf9e6@YW)`tH5QZt)6i^>sTcQ zcGaOOR{!4B%s5iZ97aR<$_}Cf@|Z=qqYrut?ttQn#K9lr`$}V3bEDX+cmjzffq0V{ zevLo#c~d(l?>FjxN~x#2ALSog3nGL_qe$DC@#m5HkqOl}&|SeR3OzAN%+MEn6)%cv zUzA$c-pYFt-xJuj+@9ZS4&(Oh0LHMQR>C@Mhd$F&HOD}&DKGR8lPj&jA)>$$3TWT= z8-i*OtfT)X3;G-^bN~^F4$Qj84p?R`#QtBbWH#3a{;{{-1{T)|XhFX= z2->eWwlR$^CK)w^j&`tSq+P)(k>t-)tXyXG^HhG;aLJR)p^DL>GW{F0Vad!>;1<6WcnzU%5t_ToPI@GiHo|1gz>mE=` zD+v-45+#uLU>IL4%M`pgRw$=lIi%VZoe2eGA?rMkQRqNDHo`LOL7D z?HEZ>%C3~mJ6wo>Rs>rW^D*nFYtKA3lr+Hw3YITVyK64Z8~J0QQ+NcW$m7bfd@vb4 z8!a^DM1!nw$3nD#JMsoIFj&2NBx($fskq{W9z5Cw3d<7As^}y%Q$=FMeXvGE4^d_s z6aVrXB`n3|5?0%u-he(wX}YPH6N|v)1iNcO2s~UU;a8U6yTfcpQPKQ7k=h(BbA&_{ z?Qmp_z~-C`%+H`9KJuuOgY$Pq<2te`dnrY}y#EzlRI4K&7ly3(;IFg=oA)2W;r~Q; z{^xMW%E9%&!r`=zw*7`g!+$Sq2<-CUSsAjJaMVU+0A);>n%8SiNp`JuwMomkjS5{W`bg=4oTYi`+s&&6ibJT7>`f666x4&Fe zR$fi_>gn=sF4g)`rA?PyW?daGhi}O9hJ7ogJ#_eft$$p9v~J%p=!XbK{M_?IbRe?G`>A0I{C)adniJQ*K~Dk6<+FYh10>fn1NsLz3lT$+mFgtWW6 z%C3Ap{<=%W=UvynS4=)1%+u?6UGB~Nn(TbPn8f6tBl)>GilWkx2zq6LmC;F3M@S@<2n`Lj7s?o}rSLyX4znTEh2lyPG*Ug$muR}_{>jL-q7NPuW6ji+ z(w|}0-xa@?*+;E*vvqJnF1l0yM-5xZQp2!Bj;N&sNRH1pZzJApdu>-DavVX_TyAaT z^}Ya70caBhOSXSS+^@o(F@b+&9k#E~%NE|e(d{fZ zeIHL>GQZf@)?@K_q`kw!>GO8Ve72n3eE|RLZWgRftsUrKe4Dvtyh&%D&1B*(dPDyT zV)T6W=FQ+;j21zi8e<|$ed}x2t(5VJjAR`iQ%R2RgYbkAWJU!um+<5ErQW#dcBaYt<=X%NWnpIKT+FjUCS7e?+cr;JrXK{Z?{ zA)Z{^UvV>He;|d5`XMMk@{AXsH80Ie&k+LCeD-luJE8@Ac0Od^0jmq4sGF|_9xYuS z21?}4B2>C6C$*Ehx0^I$*8dd$T8m_HoC2;ziM@xL-;$X|h`fgTs({w1d#%Z;0VT>e z@Ryx|JiwChA(K0sWpZh}%GBI@QAfp1;Do1w^1rs8n?*vb@_XWcCp1@XOm!T4)q$3; z@^{S5`Bkp}m3T|4nH<@^;6XtL5Ez-&?N_J+@Gg}Ysp^2z_5QNeX_*tr9{pL-ILj)B zXB%%G%l&|mV`D6sEHrO)LxDqL~7|ThM_B{k4Z;_IAN!1-_IPki zI_j;0kZA40w_Z+?QaFj@ku2s5%W`by2$9Hr8%Jb&w-5x?y`taEn$Wm*_{0Sl-f%sR@ zq}#;R-(1w-MC%9p+x@{~6!8H&Xv@%3s|RAhNR=C(lS^RbPb`ovM8k2>cqQS!tS@6H zP3JNgm5pH}BawT50$tJLpC)b?$r9VJU$wGVWWhPJ*WO%Afbl}dAUyQ0wp&09^?b>c z?JW)%pvhQ8LA1dY;&hqc#pq&aoJ_8*d8d==_Rsafmt4wX$zqhtAXm?DvAs_sMlg9? z>X;iePN;W`3_?xMCa$)t|DpmhAW1VuETNckY#vTA4+o4;YokC)9!v0vd0~rYvwKkW8(gyPY0@ zMDO|D5o83Z=l>Y*?Lu@QjQ@q&V(7B!ECKJW0S4cdRl>363KzBRtw4_T$(N?kkI#Tw z7#KMm%@Ch@YUP;HV(fknEpk&kFKug;bW#-G)XpR_wsW`NM|(MDq$u9Zij*$Bo|aJ{ zGouOBph~pYu-*PAmpN}_`-|H}NY}m@DUAvOt-!&|v>>e**Dz=OTUCwNo62(m27YEcVyPGK$O%W)kUtnOv5GMjb!af7`<>8RmXU8kyYwOOR_OKOOq-|L8KyO?f` zvmx+4+!_V!-i{q|*G#kh#RZ{7j5~UG%LcbQrP^3Pdh;!7_XY~FU_rmo4O%Ok-Xmu4ZHn^-*T@>bYpIq-^T zyCIXIAY>d~+Q;imKUcq~5T;uEFepA+7e$!Ye+%#tm}7}Q(S^h4(?AqsHP9F*-yb+r zt`!_gxoa85k4#+EZj~-Qy2%$cYTF;ol8ZS9qk`=(+Tblott!d}_$BPuB`>$9{dF+G zTe~q%!IFvZ?yUR~R~Iqd;*`WwGr*rhe6>~=4I3%s?bPi`hP2=umG`lgDgVN-5EyUi zci$&xkC z!?E1SnE7Z2tex&P0d}v@$IS^HwLC>!3s2TX%}_eYTI+W?Yh{t}_Zse*Gj^Zkvhiz3 z7j_ylCQ%G`8L?Bx7Eal-KFo1q2&=j=6A$Ae1q0c4nh`lU z17*BLe0DK@}dYJJ0_g;@`g)RR_l>`)d;8G@|%Wq(m0>?5juY1k;>)LtSBpr~2z zWRwuND&vnk5V@C_SWK12U+4}shP3AuqZ<}X2WTJ|L}$My0yLG(#pH#1pVt5AbLtzL zLJjQanN^H^o0jQSTE90OaYA>X|#fNkg*V1X5Z_#89pGW68cC&@sC}Bv6X?bx0_t1#iqTw^F*!*3A#=$T>xN3EF zpA-g$D~Lt`<__Xxev4ya)*S@BFLgspASV#?apYmB)p)!Q%}<{PmjlXv0fwQ*7r0Sa zoxpSrUR7)QBtQdvf|f_4{dQwKf+qo?+xVCVY7<)W_@MAsQtm_HuIUs^3O2BT9bWHk zkjM0NHreHECqm$Sj;unyhuubOAsxRx`>e6dwJsX4x*&6$QQ;zq2et)aCl?`wgNSsI z*G{iQg@ajvggt8^7>YAPnZu~#O-IEi1w%}9#i0jH%Aab7t2<7@R>2DCs6eKwE2^$` zZYDaEkWvYa#&Rap^=JxdBdS8=BR$E_IJk)u84>n{IX)l4D9#!J{xSOy)4*j9D(v?7 zqvA_33%Te}2__#Xz8i86CO#F5l1{v@0l1pG6q){rTeLC`j+Neq5VcWEDl=q|y;cU0 zlI;_?V)BLLaE^Bkmgww%vYs`m0Qi7ICZ(RgIo0e@Yk~tL3_)XJGyNBaH0d#$Ld$EY z@SHl;R+6BJ%qE>9Z)`>lHoDx`aM>}fc) zNe?4G;Iq0Qg_#S|+bp>K8J7&%62S06*k(vL6>grpP>*R4V78POVD;+B@V z&MfWyZYYiHAdw8^M4s^j!O%+^(^oY%Vlp^5{lTwrDm@?!nQ%j2LEKh%+Pssy4HJ4JpQ(*0uLRhGfJ+Xbo9Z@sVwo{W%#ST>@6Rh*IepI z{lUumc9o<5rvE5L!vPgH#>X&=po^8WLw3sw62zgCtWdy)prlbeDUIc&Y_uW#FM!S=Zy_j^ibt;m*>B+>3@(;Ar`jG!Q*gq7VXh=5h=!l$cf0**JmlBptz z_rd6DQqwqX;&+7_&*OI!6B=y*Xom4<>?0sI)0DlzMd~NM6)VB6QIJu6M!GR{GTEmG zZ)a*YD{ka(%2!jlkvyUapMP#!mqbBKl~R5r#&4f>-mJw}8nAUo=;x>NY&ItS7RHs{ z2ww{XzLqjnyiScbxWMd%;fihuFSKnqwXbFnd{}e=LpHUr;UrhIxC=W5Sy?e?i4I^= zkY{EfIXESHKq(V+?#+-g-E!~<;1KwvJhrd!OKW+UofF{@q=?2}MtsUa|88=w75b5L zac-X1`K?TgI39e-cO&&vg(IxreyhNZoo3x?<+pEz>^z4R4_}xH{2bnxvIq&_!cI|5 z_#r^l^Va#Jzt$5`p)^FNDd-z{GZl@^HZxGjH61MKJld(Tob=0Gr-o^t;o}PUie_IJ zqX7aG@)GEqsAk8m@7U1*kbf!4=_;NOt0cVozVyMZ2&XLWBh<^NR;eC;&t=G)lq1Azn1vDr(cfc?z zlxk;X_^Xa?kjw^9D{Q-U5I(s^C_OcR!zL6PrKm0YgFvM!K)ASLn%h5rktoi7Kdx^UQB6}R74HBPsDYg^ZJ z#nHQhU_T?nCrKjlkL=oS^i7qhmQ@vSt;)S5YBr9kgkhbtQ>*Hr2oH}N`<^XSkl_6f zt5vauoF8CY<8QL0Q@#4G=wK9^5ki`lxk?oZ^QR2V4Y2M|aWy5h`;6c(0Hi5fzQX+) zo5Tab2$ud?6XQeEY(hwonE1fOdVHk~F~@@*{J%8JuxY!6D7%pVb9HTgSaHT7o#58c zCDnIT4hXL7PGtC1>69k4?YNd-5Pe#>j_YHjEm9O5UeRIO$qRBMv|OR>yU9=7w#!(q zQ;CaLjybnvXi_TBh`_4Q>apq05cX=NE=tHA6Mf|Em-Oz%o_fvTg5c?TolE|Z22WOT zaNKH`6r$PTr#{2{^L_L5b=yt(O?l`g0nEB-%g6;5Zx~OCv5iNBKo#gPb@-mzD*)o( zj6X5IRl{%8OB3@?N+-AswP%+lAd@{hFu)}#(Thfz)DrRCV~@FtlP_{;Dv<&gB2m)%oFPB`QR z@*|H^c&PjDD##J>u>@E^dZ04VB-V`5NjciVmX&vBZl#iLcJvpA1eAeEZ(R#4)&v`z z4Q;mCR-%Hz>?NT*qdC zGEITR76vvbHbsVP-P-j3Ey9Q@ms{AcTGZ)AlO8VQeMOb3i$vr0FnIfhI@A+r|8`g8 z^iQvAF-*Ll7lo-CHi=k_88A}Lk{ zEiNxoc>G2XQCNUPK|eIb7#4N#lAQgzr-GkpeLUOEo)s~Z^Z$2d<<{lyX7_Pxk)rl2 z>F48d9FMXn;hg|H%x2e>0~X!x!@#j5w1^p#y#MkxkvXp6 z^KQ4CGpY!7^GsAYDLbUsW%-F1mI32l04|XVZh>_I1rmnAD5LUV4Kin*3{!$IDSMpK zHSqy5b3LvJm*Ork9SFq{B)M2v`vSA+=0w`j)!S1M5;!@EzAg}L43oRFe;AEC@d z!|BED@%2p#mFwS8!;WNnBfs4Pvwz}W$$lcZY7_hYX35msMa-9Y!*CLouIAiR;=l1A ziqm5LIE!N=n?l?b0%gh3<`?Pf(1;|Ze+ao>*IP!UVfUsIwoG=lTsf>LB`@{ODxEKM z8ii{X|1R1QAHH%dgnR+1_IzDnVpnk|F`z2WoF}5u@Pe-dbj~pQiYqChqjATvLZ_#9 zf24%i$Kx-?@rwHe&gV`vJjPv;rI+xr_@&*-IWbVuqjhSyL^t~qE{g1yzEW9B7h?$h zh$(bxUE7Mp%yz8D@BG141pVHXp0_EAXIc*Hj<_L>1UsX9TM?51gIJk7MygcooMI<< zW$Ry0>UGRj3l+1GhLIl!iyS_!DeAtGqC0-v7)O>+WFWaG#0vB6I&XuJMaTx;EK#_? z#S0JbE{&#bOyZhO9sfW#Ju=JLAHC}qm2~y#lttjW5Dj@GQcfwUbGv@EXJcXotU|3> zn;Z6S2aF&s#fK&QqxK*o8YWgk@zs#wi?hHPd2fW1ze^blHa_~ka=Z2kYk+N)C_3DO zWM=lA04qy9o&6~Z=&bgdjxj890#$G~~dX=S~eqxr7J#qBuEfc{*4U730*VWK9_(#nm(6(jM zaKjn}lexWNDs+-JmGZ8V*DN%>0N)n)MD*34l}$FB*O{$1?iW?zQfUAD=dJ`BB{OE% zcY$>arU97O0e!PwhP7!6$WFrX0Ns`4Un7nO8aYV<^nuVqNKx65gk*Y;jVx)LbMMrz z-XHvA0iP@P<4B4Nz(0*CBTfVDCv>B7*xhFZ3SG7f%EV_9aWMd}30}Kpl&z_;tj`WQ z*{j=l+!j*4Oj{UAma>Sk;+gnJzmV1mF}e{}>Qw2z?(~QEYf3Dy)P~hFsYf$a+)3;8 z?~`nJit3)Z)@x7*lUTi{bg;IejuB5y+;qz?!>u3Ihykna9DQv`i6zs4z~=BPK|H`z zw55aY1EJny<`cwU?#GFGY9)8sVoXozzo4=cja#6fmloxtW=vN^f4xpCGgK+kx2wbe zm}3Yn5Z)UclUp&{)C8%nnwduNUr#B^Sy-bFp*Rn1ErYSo;#O4FncmT@g*i)hGnQ?0 zg%X6?9LvXHaxs{J^h{^XDTe)kz)wou{hcjbK=N|WEc2#&_!a^I){PapRly-XG`e`29=|gjgAebIu6xo(t+&1REnCET-y=*_~IfGWh>VRw*)-L2x z@x<>QzIp$}M~w(fFhzni1|!9uXi=#jOp1D>+B2S!w|WH^27gzd#i_ebnq=PKiu7CMv`p&a{6sE!OG)~~S5U6C_-fT3(X!!KL4JhW| zv3eT|#oXKyJN^N+>R#%wTir$j17~ia6cv>^;$Qp!z8KJxilP+HNOF!sV1L3iA=qoC zU1AZYqA4(5^x%_A^P2_NHijoS?JK;owg98LPbdaY{uKtRj7Fg#3m%Tf>#BZUp+Tq! zz^-=OW7|0T{S4q#w;RxDg5Fkf8QH7-2HZ^Bktf6SSVF!NT>fbY(A*C=G3M4jE}1CX z3?F-L{~NI2L}9VAqoFEgBjf+=(gJd6k5d}>70GjXr>@z;;jg13!tB1cM}m+iE_xos zQDkO7)x>J{^v)>BQ$0^Yl6W5ZHlPN)DZQda zk+)@B2y;lp6(2Gc<6#T9y}_VBv?CeAKar_#AK*eY3v*j&Gutt5y-R>p5TW+$k}Zhf zl*Z(2x$kL6wBkgID6(uKTrQ1FmGY|JG+*11^t-yP;te^zFLT*v?A6zokc&zW38xLw zFso9aJ!x$LnJm3$#E(;{-9VV))>$<*NIe_|Xc~{6;?FiT}@*E|$%qs&O2^vxr z`(b49A!H!4gq^ALM`Y!HL6$atB_rT5*i|<3HzqPA{3?)Y zz#FSl$G0(>o(M847O*@J*tI|99Zj%QmaFixY({;hFN zEo+xNI|8IRr@H&nZwzw_4?mO{6qORLx%p=HC)pK2now!zrq6qyz(3|et(1Gysy@DiWya;n+>5HQ$BZ@lI{iC8?Puw_Le7Ej_+dTbl(%mr%Z zcSNAE=|a{tvj{Au94@jPf%*m{Awoe?Ux7|FxMN`jGflu+{_jVsZj>bWrh;%9> z!w>FRH-SP?N3l)U?qh<;)#CBA)yY>X?WSC7=#bhY`R)FB$A34msq@-<^`wPX(l|8F z@QhREMZPA@jNJhp)}2XA*RWo1TGt7sLZ3^NByqr9#Y>!kfy?r##vG#8de_Z)CwQWMp#4_0LSBqWA~FZ zqH?QxsvS%<1A&zPE+J`f2}3E!Zb?zi<3*z##UpV3^UM#%YeZJr9`Y#$+&BaLm}sC+ zN-yH0f@FdegW$mro=vx~#X1$(RD{Q=zCw$#m#}f1y;ez_JjYr&E{9njqC65f zYY*4LE{iue5ejcX%4J$okREs4u z0xhN+92I{OCubopJnWf6ry8_7F2ug=oRh0-KG);tHwNDHM{uK52_2^bL~TCHz+7cO zay5NhjaExXJTW#LTbPI0Tt6p?)v1rb@3TK6zhG6cghR)ufM;thKur^mhTxybia%N+lD< zs|1gV+7^;=SW)6%3jdfjvPtZSc5qLXK>VgVjO-=V$@IcQl4=70g~2(5)Jk^`>fI-r zmy>kmz+Tn^G33&}X#PxZv_mKiu4>g5`!rcrlSpHPRMeoe;0E zyY~by@!3}kN=#`=Ed&!fiirr+z1u#RWJ^9`7}_GxVBc9X7tFlJ>|}5qas(fqI<$sK zmXlZ4>2ouSAA{e-b3r~Ue-dWgXTVA59{Y>1tPb?dar{dF93 zpoh5eExcCWHNyt{AiMOm<0LV%+@gJrwb^uV6W8y*Ow1woiwMT7(G>6JNty*DlVRWZ z*&#$r=mgV42&x5LoEaKMwN+A%P7O~3UW9w$wdk9cA6Ml7UwI!Mmz{$$4Axu4r~tkS z|Mob@tX>j^5Cir*+TG}R0E?L0)6K}QF!NXGN0Ulbc*5t*hzy9*(J|c;NcU{QwPK~@ zK`x|QqE3ZJihn;J(e^p)gRf7rHRhw-vDkbyudF1nO;iU#`$k6SnK`1kZu{y$ZQE8asozcpd;AKi z)`mRr+v3Mg*u!!jc$|MM8Jb+zeU5tGNbk9)(;X$MesknggONiFRxRPy+p(*TUM0(1 z3MJo4xW`Px1VU&#Wc?MCZ`Lhx0n+8?0$il02L4`2j_OI9zGuLx_vx{&ttDwW4gBr1l1*aYpxxlrv6aZq zAo{BG5&_(IH20mt-(Fu=ebN6-06MK5nCLB&A*mC;L-zVQrV)X*-H5G1o#?B4gX zw`PJn1U#GgQI>!RRdk>aKA*9~_kN~w|$sQ)T#186LK%X(HR#x{S52<|3!uM$fY`}ie|i$PhuGB9OY=`_fy{lac4a4IKv%Zb#BNFWxQgTUpARop5G^y$N*$ysH13%MLal4R7Y>!pvg>oeLT9izxay_*}br5O?S5l&TJs`*_YfU6{UfjoRyr!VZW4`lYls; z1Uf$hv6po~S3sOLE-5P|g(xz6E@Te=af(!$)Z$>k)?fC4CMTd#PcYH4zUfee#H|B| zoGAG#di&xB`*);!M|qi@QM*mc)tgbDXeQ;H)e6DW0&|M%j-K;-P#v9J7&*U?yZF@| z3-$b7$vl3e{(mucPO+VZ>)Wnv+n(CyueNP-YTLGLyHneCr?#!B`R{kQlW!;cU?uBh zoxNFkb3ONSUy%}5Sunr7=rFiAvnuzVdz5m(w^i}p$&L!JO&*B)Iua5U=rBcEC9w!? zrdZNg`)eImoU``tIufTa(xw!MLTImzqpg%aWq!6xbM zLA)0GnX6tT@Ps_rgoo6RdwR_$#sbo}WBuskS~2RFEPshh39P@5jmge=^SVWkcIFXN zOIW}_IwLZL76O30aW-qz_SySO1J;YYKD@@1hUz@pDZHgBKLvURwf`G*W%=Lgq8VA3 z|8q5MTIb?tH4WvPfap8O|K0wc*btz!RHQ*0e_ga{xHNLWPOCi|mjVU9Vtv z*7rTEmGj5U_5bRk`JOq=g-*9(XJ>EE`VRD92$2df%aCDFZd?&&KW{ZXl2G`sWKW~T zpB}>gHSK(E^b>Ah$)A|t>?VD43tR+(4G)x&&5gNs8L>fqHr_*|6?|(Vs)J`AgVKMV zYo8?B4{KtzQ{8bB$`><5?Wf@~z>!es4sQKK%QRmE(AGYQ?#no@W{Gg zOz?WHy%&&m9O2g>lSs#tm2>=nmwoTQmOslQOg7o52z8|N5sdVA13Zs+@oQYI?NRy* zZ^2hIS`S<%qo_>x!8Pa4>~E`|ua9F+bbWeeF-|A!wm)8$VQcwKq9RT%hL7s;6h$#1Fy*=cQrobgHwR57x~RYbNODxnl(0~r&$C21%`Ojer}Zkm25>g)Z!QE-KO zj59zS?<|JkX1Npfn8eSZh}D_F1v>=tIQl&F7;;}V0jnjgiixU^lkm7aGO7}J6OQ4- zQa?W)171zf_Q6m(uy~XUrwIBjY`1JIKhG(MScF@dj7JQGobh=$|{0e z0w&s!Ed6VhaKLNiLtT`8sI}^vDO3=&L??-JfGd=bM;yCA)Cjs4hb`9 zB^KrYZ2B(pM~dV=dQwYO9_?o8SJ^Dl*J7fum$O4G*4>(kuB)tUG<2|elG7p+7m3+E zm}AFrES!dCAcExWq7DGa0H_y>H;Jxt@p6Md!C@ls;T4bzQSvk{DV#boOIe18F)0*? z)uG%7M&&t_C%@eFBV(JFM_zX&~pr8(nr+2R`f}WP9ZaJ0gIm3OPo*f=>3g$Rstm}-(u>_5V54=-IZ*OX? zMkj%kT@I)x+GZ#RbGUzFh=}SWs;yZMiiRhFbl@8*@+aM#y4_(N=iw6)Q5RGZZdi81 z%6B7Fywhm#?<{`>DpIBjfiCt=SDY~7Es7R<))WEG1|D+ACR=wVJJSv*dU=J(eyZuK z8G0=5yE^cxb(%?kE9w}TYeT9U*s``KV}v{-IzcUQ4XrBdTL_Sp4gPurL+hNwxjp-k zKGce0)K#fRu<8m_Ut(d)byFhcF21i>dMv-c zI!KsM$3B(*d)WED@CY<$1&O~RGBxX?ODojA!oo)a&ksM@nq@h>{~~eRdM-Mv%1myI zaZP!!bMC0IK}N%GkdeZi<7{?rl4C7LmF}GQ)2rx7A3}{_=-VN_Hk-aZTXj~UN=mPt zrYx+{;&XcBF7t>Keg>nXX;4k-1Xy7O5ZCu%q>t2Gd-L|-I_DL`6M^i~qj*_(?E;5h z#@@|w{H4B{DIq3<%i$NnQQ6M85PiJ(gjymOfrN=w*?A;J!p6~mRRT#UFse`nCh&*u z7#rO&=t-B7AgSgz03`yls`j2AUj25Cp?Dp^_`YqRKDSj{Z_4R_HHwMkUsFB;fCIxm z7l?sRpug)Yx~FSOqS73hG)-YtgoP*HioF&0!Id4Pgs74#PY+R^cM#?(Q2W@PgL$=e`uCgf9sa~shp(b*hrbeRPw z7W0r%Ro<7i*vpH|yQNcGkr=MPR;oRbB{C}7`X*ELtAXm8z|X=~pGS=mnx*0^tpdfM zAcPuGqk=OG>tt}&n+tgF#I1K1C@l<(@j&jKqf0o|@ zS%(oUQ!01O+D%ACt3Z^_*Y-L&r#5Y?)y;J4{&eJ8E4_KUJC=0 zv)QYOp5Q)H1RmoO_&5ZKp@ja;^K=`=K|jp8%WJ@j>-w0g^9B^U2(8m8Hp|-DV%3RM zf=UFVCs?&|6!rG|%e|D2Ma{^qqNQ(8W6jBGn+ey!#tUbw2!Y&QxXdW`Nsxx(4S(_F z*+0L`h1q~%CE13xCYR#}ZkzBwVa!RP6CFDst%$?om^V0e?WrUM_oVLR*qyEOD5D?i z;tk#m_$O|Dpn?G%+aiJt@e%nmN-~u^8#(qvG1^C;=nf3ChT6NmbbeR%x*#+vzGM8x zW!*N;nL3D_BRil<<&fcmjs8{4zydY&P17TUMnjn8jd6~?B0zQ*DA*jNMnpyPx4bCw z1R8f;Ms0m9ICp4!C>=0K+N-P5Q$+|O8eZ=X)$jYCPb3?+JI`jb`4pA%u$OHP4H%iB zYxaVwuv5+NPOTCuD>g4-QY3-RDs}awC@IdXAy#pf{hcdTxSmeF8*z2Up%JK$z-(i& zBN!zUh63YN2!KU@-#BLaNEPDcYXeJZ1a!E&Yfb8R!X|2{J4LUAO-3eJlVu7hz^P3V{E^yOBsG;&s}lDK8{^-U_cIGA4gHPUkHr&m z4vV~n$`=%mxQ|fFX9EfcPUGZiH^MEB z5$ede-Ya*A%VSTm|I`x6 z&r$^ho%R>A%)e_;TJ_!Zj-XI} zI!qhm3@s=>|3G3@a=KbvHB;@KvpK*A3L$cIr@j&BFjAM>xuV;VR64}sL!Oq$6i(Pi z1?5NY_epm9J#$L@_O9Cv!z*|_?cvLyyBps&_GJDlY z*I0^@H1y>{Kwi0lf^7X|E%Kx#w!1G39;m|E)qaNLsNi?j$Gi;l2yspS{WLk6h3QFm z359LQGymnPaKE601@=uAI#RXKz?_?9^lmn3Vfy*-6Ccv-wdv$5CNkNyIm?S-2fb8F zJ$2MrBnN;tGT~`z0~&O-g)gQqM>CgF@q2P{hqaq*jJip5n1`<35GTF9O75Rf16Dho#FgeKE5c(p_i4JQjl3nAUcJJFR!KHke3X z>M2pgYfKC6VC@&H#6*QuTb^HTjx$dn16Bn8rH~a$ud!fweqsz7`d95(J>u#omgTor z1E>&ix09_=)h^wW419gCy$=(VMQSYwdfFc?{RU27(EBzzJpl z*eqc{zj^JY%c9hDj%`YY|pU zXmWkaY(A4c={A#{(e$sQrqpAe`$yI7y4~X8pe>iJKU<6W+?%5-u$g9l^DoOPxAm`) zuWK`2tHqmjhWy0aFzm_EGv-WhT%7mpXfLa5@Bxn^h6l6#f`Yr|?$XiSJcFO>@u)aM zU0mFZ9;`UjEMm^Z*&TB36aJpbLjaL;BJI=1QhQI)$+nK@jI2nWtKCal_~R_csCaM3 zO3_aCMK3;KccJ{(!OIu~bONSbQXk*N*ZC2ZbJj9;PUy9&Cav|GW=yd22INI@xP-f* zP2o_(wthUhUbc7lm$1N7aYg6FMq)Z%+wb!aU$o9vQV$|Dn#NUZu8UrGr+s!))w?%>`qTA(*bV;or7eH2!=|I}+rPi39$!-2B&SE} zXr2+Nj`Cmu2VTHj)H_L*=Sv(uHEHW^lF#>6X!xf?uBRx%KUvl2!jUwhjpi0X12*|#Y+g=S1m=g~@wW_mb0 zd=T^QTjYtNVbB(yiq`l}yb&N>pZ2TxCicAK4S}35>=%uMdLM$L(BtAC?wM!+f|3Lj_=zqsTKS*5Kzw-;U59B}>6-pbC2r=aRkVNs;4lB2 z_iAf~A(oe=O@6d3*#&XX3(SJT9QpwW>ok#d*z3mErPV;}!LMn#bn;wAY8|#R2ZVf( zoYaF9-LWZ2NR;m=a8@_90p1o&E;2)i4F4I7JRF&6qBr7&r6?3s7tppT8HM=Y=W$m! z%f$v5G^fzJ1{F9)3$PW;*AFKEbGzFCTj(!1MmHQpobnJly0WMayprqX4^>zVjd=cO zSy&$i=6idfA`GdPg3nKMny}(hVQR%F=nmakouKxK8>qpH&@&~{&p;b^N6*Wb&bUKb zU=$Q0br2$tFAJbc~ zi*NVqI2n{e^^8oQE^L!+exAntkzd1~j7su!{k*rL0xr!!PMgfl?BUaN8sm*e&SyZ5ZEFeqF^6)f z39=n|g=?x4uZ$kCAAK4MJF0tyW&to^1mq#(ZdG`*G#z)LRHRUxW;f>l(&8ukvRoCY0pOIz1ZHS9ben(*$Awm%fPXIr@2|Y)@`7dtR&`QDe?DxgygdRw|W) zr0JaGc0QpOIXwEyd!w7cR)uNSzWKTfLnC7}0(;0<&CJ*y6w#Ml?uTTfAvs@F3?QgZ_2kXiJ>lm zu-N{&u8yI<;>`&3TTU=u+dV##3vM&k;{qs;ZLg)B9;SqTWckn550)B&3+ZSd~k`vXTLMW4GdGNzVN!b@4=XvjH(Vv*sqkvXToYkA$ak z6fH)yGdj%Wn#;NpHCdSWBmoOV%h`ADJy|HDk2ckw?|0;1vuZFQ3>HWSdveuPtcy0N zdHJJzZSoD^;CHjGZ~hb;Qv<)RB3?1!>kR#;i|A=mbTk=IL9ZVN>cSqM|2prBURPA4 zU;WELIQdw-={u@`ImtT0&j>(gduF7KCt&mFRVR{*(4M3UMqLam6Uf`|ka+Wk!F0?8 z(?Aql3cq+5t%=+@`z>bv zB1k@TL?UMIrY#LBrVpdSxE<4MG&Q<2xf?&g^m*;O z2JB3z*1^LL!JmN84#CMECXp6PByMd&1?>{6s{oJ+5H{w%fv}BJ5LjYbVFR0H;A2$V zKSKp?m9Ro+>99%d97c3rfufEN4^k+Fh7N<>4FuAzHxDPoqbI{=+-KO5H)a9`OkmK9 z%c02WyT1b5dS3XuX@pVS>M-AJjEw!u3=BT;xEz&iAQLDBW z#d`b$kF?jcSN$@d@SyzU!|zo&eBg0r%2^-XrUoS&oVz;NF~RY$G&+~B$^GT#H+UU} z2kwEL^7S_m%T2KK&Yhz6cU7n+H&HCyK^vmDRlK9JI>3RehA7v<={#FU8{TVen_0%q zQ9Q-pWz1IES@3P6i*Z0p+bWP|D%%Q3T6PIpkBpZeK zztlKGaOrml`s7tX1A}?~r)e>VJ5*CG zmgTRG4$YKZwXM!4X-g1+MTut{f&f9Eb9#}RH7Shf!~J4uapm2#i!Qct zuK|o?Emgts5bRdaYFkqc2Mz_Rom%iQXK7`>xD|8&if!%bLS3oWXw3A8vc5_OY?=+m zN)j)<17{(174bI#`p2fJ5Lt5yva0=pd1;0;*1kjhw|D-7GYYpy!=k#<*S zQ)IXF2X%Dd28^mvAh39n9p=xM4o}9Lh4_mue_^=9pW7I|M+%XvwCTxTPed>OpfscD zB%&sujwaSYP5R{$7A$OX!hZ9jZME&Y zZ?x|pqb+uZXz!>wy1E7%>sl`DcX7y+8K6w{!W7g`0}s%2s6|^4`HfOBeV|nX*utTb zt=FgCBS`nynmvFl8Q~e}&HW)Ku7)^x#SQT03&MVWjgb+(RLZ`Bq1-RsRnHof7MRPe zGprb4nn;V-_$4v0Wh@tXsk(LR?5DgGl; z7Y{|{8fh9dyw^gt)mN-AtJpA&T8&@r!WCdN5)m&bPb%ZQ^2WOxoKz8f2Um4x97uF00IHjaIp#oH@5}J5 z#lce5^~{5sMb(-j=#q(7^>^*e;auXn@kzcHmHGe$x`{I< z609umWms`SG0Ls|+RJ5ze-V|2?|!+F1xJ*9niPC4WUXNy5nmn1cYruh6KN5Cl99Qc zM(N#V;LivZp~BCaaq8vsp6z&L!e6GLUur^dDxf?*g?44~%c|2Wpv7At!jP6GSk zcE-OpP-iG5$YRwzOaC=Ax=merzeV8AykfoKUUVHg7tHJ^U{6Nb$>(kJ6=%V!>bG~F z$)`AqH+YrG--Pd{`yhqsKG@uh0?K>Ms881XI^_Mqfd|K$J3*R#EYa9XYu$n5ZQBcj zKQ+-P4`r=VKH7!%rU^TcE*ba>C+DI4C^aef+n2%VL^N#iJkYVqJpCg#lV|B!B2#A^ zD%u4MsE2DYj~bV9085Qj6K4LTl;y3fOJ|JlkD?Z*c3M?`j8CMTUy7eu6PNQAqr1uH zeXEN3wJ(OWL@273s8UCvOzFZR?#4k&7MOQrN_}@LmCM#95;=~YwQsw(?c zuXgbRC3Po9A!({zbveDYP!b_${-`-vauhAv&72#l&g|>-6jFB|cl^1n=wS6^5{l40 z{-V74xm;3Y6FNLD>=`lB3YNy56F_Qwk`9t6qaHkkTZ7^r!ONStBSBwH9P#i+{2O=S zt3IeC<*^4!h56tPb6=H9*W1a1!V_GSzv8#~;|NH~h*?#}xv`sn1s>hi;E3@J)D`O1 zeqx&NR zEc@)@s{*bEBh1fuG++@$42H(TM3wBX_pA)viN@wCn56~F05LR4hcK2Vmf5b$x68(} zb4x|n?bp{e(-rii>P&aS8N1Zy-n^|35B;1^rOoB2!m6~Wri;HP2=bpA=t-6BZMS;e zJ@;Rn{E-7t-;<5W9to6A*f7_oOt4PZY=7_Oe}6wlItaDwp%u*{Gqj9|{_a|bB55RV!-k_cP=)ED_T-*o%6 z5wf8YH^EN?D(^)RJ#rC@1qAVAUajw%@XG9CW*gg$I!#8AA-=*k4xHKB*F7I^rJUsG z?qI??o8Hv=dR~c|3t&cR&(>j-_3A+mex%%DA^sa0W2PQZ=@uDlT#edg;`;d2G-Yik zYreCn{nZ6m{O#W}B+`nK-8fd)x8O4z5dbN>Re=0~`rWTx`bff=@>Q(2*#ZeY^uSCD zDLK~9@K45sf{78*XtkuB`i;Gv3lt?Z$?GCBn{4XP-Z7GWtk0Y5%Xy886yB^o-BlIzr0#ag zksonRY1B7DpNZXZN(nh2hHn>NYUR*hn1E<65bLQO3QL*xeLqv*K5r@vmD5dD4(}ec znyymq4xQ5aB2&>4FA@~3%27rR1AnL-;}7+tWhOl#NS|Wt8an8CJfz0{;NCimV`4nv zZdpfRm5vkCoVquVr1a=v-;{Kia+5IrIYnP-gmDMagEXRlh*zKH9*7w(i;`lf0bPKg zA*^|xxMHU62f1wn?7B=lUU0MjX7nF?3pk@id)|gdkOp8NaK?3Am(C$ZdI_db)UV#Y zY_IDd&G7`I5r&bSmC6y%pJ>(icRlUBJ&-Z03xrw+I1Xb%64~2vz!6k~Z+5Vy6|p@x zgMT{Y3CTXR0eVB8Sh|X8EMH8c`z@=~NUj*gx>&Z@$X@Mu)*$OZu~$&0WCJXPm<36D zo;dWH84KHu1CHTDZv`lupWWU+s|Wx{r72_g1VUg4`NC?jdtu4JAW?~CljhjMXRyga zuCvXwoFka@pb8JJcJq%EyL{vLPNKaNM5SE2;*gL~whCBO0sKNwIDQE^{K~p!WXf+{WXB~`{It2HdVwYto zd#meOeh&f=*A20Pb9P0$fF_tliN5gA9;x2BysJvus+OGEV-uKDHGr+{nnI1goGE|T zh-KrRi<}F3<_A1;H(_ZJGtH!uU&q2d6?J39O6xh#UHpv8V{)!)b2!G<%1SeP1Febn zrs7RVv9oLe)FVi4KNx^_x^19Lb+HmkzznAoG{BdEmM^j2F0ac;#H{3Q!nh=2YSNF`JySkXP`k>7x9;&m%*(@D;JcFfl;Z-;0o2G z8yHU67DoeF{(ML`_$UTe>b^n+wjIdY#vDpZDT!_$DgK3qE)D%qU_k*4N+G)ovq&$s z7QPnH&fMey^pHD=&p_-I#ub}~l7H5a5@EawVjn)hp4+$zE?3+_#j&X@vEbgEkPQTF zbtK2`oK;$w8Du~BjTH0;--Gc*i_U_gniWrR3xJ!+xUiHAB$mD@=Z=I!vXWP)>zqqH zTb-=9!NZyJ-P~06z5uT-rVlNZ&%D?=8{qjVC!o^q)&8YNx6HCfop!nc5t%a!nIKk9 zh>=U}CrSLm5;lHVPQU`8lWWG_C}uC{5b5A=%6s*xkSY3l1b{^ZW3G%!u#7JBkdt|Y zr$qP1dTH&?(4JCc;DZ5)SICZT|5lhiVZ@m+$gEXeG}Lto^iO6^%!#a&Bj1u^?<2jC zhPfcf|D|K*Q87sKa(u@;wfwWhx4Q>D*`0MC)SKNw$SpaT-o0BjfG0;+_hx8o+rQ2V zUm4WsLb(k}1DA>0XbrS@v21pjdX??hUm>wYr8uxzi}6rk97)cp*-Ep8W+m>5=W21?~LkJlW<422BG>(vQpIJ>Z@iZIg)9nhIOuONSpe$-@B13Dxdc3^0 zA^pOIt{!y=HP{kfgCd|S;dh;M#}`wAX|Fl(JQ+B3fsd-)Fx)DG09I4293sHV$7yhL zsd$75YSU)|mzc-H$vKC&($^+2QKEyiXeAId%C~})no4dz<{e2+%=q{xAptFqiCMh4WE`}Yy7&RiWcdXUm9XoZ29Q$~OA_Z>?+(#f0p?ZshD$FDeg ztPO8~Z$+rVZ+eYC9>n|SYs?+tmQ;LjA9+%r8FS?B!SQvcYweza7r~WdWU_)yQ#X;n zi4MOXVp?{%lZpP?p7`9gKu9~D__F(x$F{{(Bb((VuTmRf$H^E0Hz*gXHIG#z{@U!6 zIIsRQw?`29pv)gxZ)giEK5I|1;&aVCV$g6ZxQpgIti%-^5$kV+&a-80tUz=a@*39% z&=(VDQI@2A<5EMK^Q#G}gtQ`8A*HK74??syhmxQIL%lPmS?p#AoWl)-hGpP4^u-p^ zY&BgbsD0N95bpivWKsh}8PPt3ps7%8f3jC$(708t@>f;NRQB@6#8SPK{d;sL_RS`z zF!<|RalGA zZmpDmx-CIdi!#+;(IhSM6-Glnf#xF5XBbsh`j-kC%SF$2nQu9ZcArZ15o515`oBlf zpb!(%&I$`%R0UOO_C@@s1M%HH9kke0~p3Y>zMnCU+n zV$1FelXZnHeV509lUJl*eNn2bBB4M98TzfNtVq5N4b{?!&H;XOuzXxbHrM@1mI0P( z)r_==dSxBbVWw6S&?u3LlKZ6f35BGqnx+)V=-6&(1C+@d>QsK^u3jhmN*x1c^WzzXl;E?=vq8ioMzEcp zf2uyjf?1~iwEs+CV;U?cnYYC>od>%gsUDEa_>aR~e45@uPsK<-Tve4E3JUGZOI)cA zjZH7RELg3*^9ah85=rHEO4X5nd^c39_t6 z&zXYk|0=6?d#t>9$>ZC4$1>kI8(4^7t-q)!KAm73vWo=i-L| zI#R?x*`-;lhhzoLuM@&5Z~7~6J}d3{D0#$&xun`o zqk;4ksDX)#D21Bi;a)n@i3C*A9SavqUXskO>fC=T`-uJGVz@m!5_{hIk^2yUGq2%1 z?6Y~cj>;+dsD%U@w{%7Z8-ttwl9iBZ8@bS}Sx|9$?u#1!^U^Oo%Ksz&n&`&wegTOu z=qFStQ9shSzJ9ZcnV24Rj?NDZLa!SqPM98I3zHv&=?Zlt${eb z>dH)PB|zk78eqcU9vOokV{Gi;ZXU5PLt= zSeZINot;d&>yc`JnrHgrgLPn(^GKhwub6II=jSbsdwdNzHz>eqp2>TZWwLH|>Xil? zyat$&x)F+XXcTve3~JgfV!Mc|f<&hNKaVFEzaq$v$o`t(0weboZNi zk25|2ZiQr}E8$PhnSzyqmaQmMF4+n}wg8izS|*%2)rz*17_?mucQQ^Tmr3PuJm`IO z=UP8D(;$7eV*1Ho&9U&`2a7AynpEC{Qa18EEBr-na!w4$SMwDwxe+G%RD7wJgK38Y zPQ*b3wQ{Xuv(MYs5%7asWCBGY>ku%U zhm?F?2KV}ZH&xv}@1Ea;LGBFx`u1>V1c#9%BPRPj0G395CkUtgh?B&rU)C2qLpe|38Fk;MWMG>pTr5DG8g!BL?L57sc;zq-1<|uq&R_3 z)fFL1u_O02Po3=;@E~-k0*Fw~767tj2o#V-WWz*u0yf=iNRMF5a`;H-LV5wL*TT!q z6shzS#>&F}*3v2#9nw!gO9~9~3c8t{4ct9+RIZ&*$;tbCp%0h$rCEtGP^*jcYlka) zRyPoD)OG!8LrC(0rnHGAHd9RP%-^0lF`&J`&|NwMLF)?Xb@2&W{-YNrGxMg;zT&S5 z-TL@Aify$wYVY~QOfWtaQUd8=WH1Gb*%jBM8gwaGmw0I4yIaJyny=&YiJUuQ#^;g4 znq?awY+a1P*9^oFhq8_wj%LYz*we!2U2np5}I)f+{tH7_7$no`H5v; zACw;Pa}A~kxDCb}m)DD>TNBeExwLLniP|58-X6`>B~n*)Y=4c8@f@OrAj3_3AjYJv zbZ(DR(p>-6NO|9h;LpM;h&$lY=)LY7Yy85ApxmMXzw!;1t|JT=+mL7-YBtuNg}sjGSy@@l0ACg#KDmi>@et+O8{GOt zYHu3vN1t?Dz0_R`lp@c#3~BoEp0Kb|^V)f#T(MU>g@W{V(nd2`58T^o@yU5AT^Tgo zI=CDDmCU=Xhj!ge@h*E}9N>yZFvom|EA8Au#S?=K)*MBzWs99%BjD9V*|q8}gcR+- zF8o}`D8~!&pnDRd2v|2Iq@|s#e<&XppjsOZNg#`@%!f~hr2vSQ8OhBvHh{n6UIwgQ zyD$pULA<5KZO5@z7>Q;98!3a?DLO%B?eAq+rPu@BuzFLUC_v_RG+F*KtsAiquaB;1 z6$K!~2r`>|^9@Umpf zDAQupBXuf-nhkX3yI&J2F!IF0ymI4W&SP^OpMhNf3^S8oChYIQo=Pch`1oboRgG_z zc35(!yk#Oq3spPLwz1EOP?^)~xM17Vrw~Hkg2Ye)S}wKKMESr16*E<>DTiEto5;V! z6%lu1>?&iILiE$%#T=WtL8Qxa?}md}Th^FU8Y3J=%=odn@_n^w=jJ&y4*G|wasK_I zTh#Iv-BK(S>P3&?Cd%yq9{&-S-0O~t+dKM3xixFwj%jq2gmtEg4BSKgp`*rg zfa=Xxc1I<90dnKphv}&jBcPPZe;~EC#Zy2+`Q}Zi7~F0>TxBnKijg`dc0}GBVG3yo zcTrlY^gm5U`90oOlt_CJRF%t*e8vxu-a5AiJS%EuU{V+cPuglP0#il!|2wKIJOo|g zLb_h>yGq4sMfk0wt85F2Od|lQZ_O~?Vm~)4UODa1(2o!+j5hv<(9;59pOoB=N&`7F z`(M0M+ydDyG>_*f+##eWL36Z1fzw@eNw9uI%zRMc>VEHe7JTSeOhmS(jz2$0Q?qR@ zudf;S$k)?vk7R!s^RI}!B@$2bmsz?J`iybmN8^p9(0dicjPkKU4Nm?ck#xEPDrvmk zIi2cje}o*f_hr|8LMQd2ZiMC#BLB^C&^npwq7uV432@XrT}1-P{nlF1h&f_9#9*XsE`r zRaY)~qsO&gI|)#7V>VuJ4alHbBcQIxEYoTce{q)U*9F|{A~l!D`~Tm)LIKc5(0ySj7C@Vwy}1|> zA8idhg^Y4d&5bg$Fr@hDd2e6Y)7+Stl`Z9 zz^InVH>J<(zAJr3i3opo610@LMGF>6OuCVP6G17m$S1f9b7mW_NJ3}rgD2rgl}FWO zW*K9vQRv+#KAa~I+l>-cdMw-^9C2jgCA{zqtmrP^96Rww%N{(i&I0X zRhG*sTv#DN{jPmSs>D&3vk3rHa!S~NEv99zGRvukEt#vRX7{`$oM5GKLFETGoVT_a zZuQzo&Opf`W+c(pdo2gdvnWwA37tOxkjSG3Fw%9FQlPQz>}2|)$)KT8Ww8R()*Rh;h!;1&Wq1?^bN;8t*sGK%*XJ<4fV z5d~HdS8ZL`Sx-;5+olGE>CHic3?T>j->S&ogdw}^JiJ;vN(a0L{#FuyL^?z$c6c4` zsy$Fe)FwTf%14c^I9Gn4#i}#(JC~vv*ZDZ(DT@BRv!yG2q+Z>#M#P|tjr@2_ry?H} z(}V0%gvdOFs0_ZM1@)W|G@WR8eTbVUODJwjzY(k zh+gb=0{TLsE=iMVtk}VEXyMO}L7C-fs?hG|tvI&-)YUbXLGwzXuB>b&QT<7Vk=GB} z(>4!j~J55!|1*SW21%<{$88G#n3q*5B}259ztGUB?Ys02*~DMv z^lz+Bil*)xRYl$Z0h5uYRsD9jIp(Tr3Je$dxhFwJNHfb78Oi`ehoLIeu0s?WX0o{} zv>LI-=b|p1RFf#sU4xz+x0O>F#8Nm7tJ30<)VKwFIz|F=shtepq8~`^vTOU%e|GTe zWPX7`U~vR!eKJiy0sU%)Rx)8`Q$!}+MjV=u5?v7Ley zl~f=kV|}zN{%K;%!514C;O4Z?>GMIsIar_#*%hgl?=xhdh{1};`_A`^4TeOWy7*NyL(Ei%4_7Wk~W{zAkCqmv?m>@qv6@-ef=H z*E)-z*nqSNv{W)^)}mDNx{H^csL>7|$zTFH|zA$^}B7OOzGdut8 zA;A@5A;+s6lKVPaP$oc6mg0@tS2MWP);%F=x@x?I+o1T1X}K8R>dg{!UgQ-k89NaI zmz*n1GsEh-pu#Yu_YIePUJ93-Atnn!@_5?tUc#hl}!01YW(vHu9Th?w^rC^(qDCUEfuF>8toccGHH?Y_rFZ z4&g&aK%}?u<~HVW28U2J`71}^E610OE8XE5Y*QmLoHWRmjk|PSr`fZ)W{8) zoLSpKNKPo;@ViEI5tOU_QsW{b=-T1j>@kCg9Jl=6o#|MYIgpJ-K0PsRL z@cO@vI6;_9UMjlP7T){rT`MSCimJmD^Fy}nwdR8}L|d2zDaRQ#I2Wao99gi0>F1eh zAL_|J|K_?7(=WT;<9T+-|9I-ta$z}M2Y>sBT9^{ z|I^{owz1o6L;R1!BPhzRqP5ygk?6@;3^-4c*0~Q<+yMV(&xwPgd7;|9?LxZdbzOHe z8K3OdUD&yW8pBO+k|GiTA2#T505h}AqQgr&PUrq~ekuDOiKhd`m$Or2``gp?&R#3W zhpP5mbZ%+l-`d;O?;!Q1fSRWI@a}T^;$|1*hmS8xGw{<$b0mmTuFZ%Do^ePM7gWl{ z_kO>k@8JFT5_M42bmP&-8D(tG$jdjdtk@TX!-p_IFold}(*F;(`NO_8unLV2S9=as ze)1^nph#~ZYOJpRAAfAz_8|F>hc^ot$iG7}kn^?2l}%aWRoDJQmCzGakCi?X-aVpA zyx$mcR5KI%o-N|*7q>LCTi8cHxe6{u_QMCn;O=BA2 z-OtKq>vu3uG^Y6(Sd8(P+Z?;==amg&dfF}uw6ZbI&d(cN#Ec&`s*0c*?bnKyAO25W z^?aH>{sw**Vao@1ognsBzGdYJ0ezGy+zNc#s2p4{QRre)Jk6B0Mh~FBWrxVpDna4- z71G>f71DPc+mJ|z-XLV$KwZ+EW|TBoI_@k_J(IjkQx4||)>zNbUJzq{z#7^!mMjNe6hieTQu}RY?ZGV? zIvl1)ip89(DEN4#q4U%r{VL8C;veG{)cX(b2&kAlk6m1hCfziDxfWqANsy<()Tx z_zNFj)GqJ?5{#I)%GfI(FeaDEM0Ut>Ral^eBuP>&H2UxXt5pyMAFG`uR1&A(OG<4M zAWIx5O5feYUF+YD51RYg)kUlPoMnALb@UJeunS2ZP0DtfuL0yOJ*ghc8br5%UYuZ` z@lGwa!^&8?S!zLL8Ijsv*%&*1@14Z2MEM??l6A=n0f`BB*eI#dBBs7NqW1lSqe|SO zjlPY#v1e6Vr&06OO0)IIg*&D~qwkV~U^QyKLa;@7hbC5FA*JUfh>|jZ(ClFs%Y!!6 zpr#k^yt20eBCWhOS4pw}9GCx}ZlTqPip0cM25Y&8< zj--(1N$8^{z;%GZm5||nGGJMGC($OEmvQ75{GfQ7tc%&72DooEtk`RZzAr?pU&2p?Q=h^L~|}0dU|G! z1_*-(rjt$Ir)LKxno4(;d$Uxd_5UQWFr{cW_`Uv4XisLIkbgDH3M!`rsib3^KUa@C zwYtvLIg~~2N#|2R#_;doGk`g(CO4D}zQ1rL){{v!xI#@cY0ye>Ef$s~s9KrY9|9!v z{6(lwR7gSr7D74-=l~v70 z%JF;6GpJ>JRyNGPE+siD*icX`>nBGPyK)JtHT+h#IHiQ41db_1Tc`eQz*oh3 zBWjSWEEPKkrh_-AiO`x;!18y&W2;MFaL$Uk9+4x$$j=E(K)J9neM-ggJPjF$C#e@| zzjd}6F^QeK*8(F$^nPRB3g$dVb-QL(J8Dy({S*L;Oj$~7cM zV6(;P=8f#xd19f+BQ#Rq9E%aCVp-3j#K0^r{HQKYuel3s93>h({4KWDESw#QUW0^C z0lT1xm2P72G5t2glgeap8Xi+^_WR)jEWd}`yQUs-1}Sf&#gU@E2o*gsFyd6D^IvHGoU!KL>(rH^^!BLty0OUea&sIr*8gg-lE{F%mW`ozU;f6z$ zn%@3$c@ukK92=!i2H9FACv1Uc zr`xq_)fG}q>Hf&udnbGUD~L90R-A*u7I7nJh3Cq1*e?}(ZFz~Usv-sDRL1rGfcv7y z$EJuB-3&R-fnB3Dud2RAHX02oCaJHbsN0k0_H_jYn;nXMU>apIDvsirnC;{IV1A?+ zL!V)MB;bmJ;oaP6hrL&L&20p9$seh24x=5#0Iq}M$g>!%>axOuDW#c&8_uHE-z%+r zr{V7G{zPo3C6#5ZzH-AoE>fP)WaggQBv6h)WbutX63uOhzL~f$3O30zcr$SR*4UoI zZ}3*%)xF7qP5jt*nSGSQv6I^DXxH7fJ+{=9Ulk2s%ckfs~2Mvv1pMY(0+9zYiG^DIFBbt zQF1UJOC8pvV02iMI+^lveWGZvm*gpu2audv^eh%gqQ$XMwy2qf-1c}B#?5mV!JhCf z)(&lI84c-)f004M#?~ZO6%QSJLgbfD4gIc33q09u(pj^uihuR#GKE$O7MEofUN$0w z<7L-^xb+6_WE(W}ary*P91A7*Cndqwv+bFz6$dD4RQOoc;x;!9?X#G+PZ6W__+_|p z;1@eX2}lVr*y$aAd`pf0R(6~=){RRUA?;q>*$GYMCaKoa7{Ic@w0bbRfn zcbTbWhlG#2r=&nBEG(C0GGWO~b4(LV{i+8CU|>r1-T^JDumi}8kiVQW#v^P64p{j+ z<)GDZURY`EwUZ;xA4=;}WS2_3Nnp#f3N~$?L^;7N4aoM09mmJn&V=kGBU+beOA7ub zV=mUznVI+FW7k25*EsABWW1+%@C@?!moeY%J%AD@_-je`vT~NO1t&NDHDbl{yhYD} z5_fZ0W}@i{*sDIxWh$n-TDgvXK9|wsx+uU1cmiX!M`2Fs6#I;rWY6U2a}V-m5VS)4 z@p9Cc!ho^gjMPzcfA4Fo;YR3eNB@g09^IMmIoshdyg#(G(`%nQ+NYXuY2_}DTy*1^ zOE9*_Tp=qGXtF^ktbB$eY{NP=7fbs{r8V)yLL+{zk~cf&IVv}f64efULRTAeQXIo^ zAakA4+&?n9?hcnR9_pAxU%j`uatSwVAnBG+PL)-epPUmpF24k(mwUg*qGv7smiI6a zPC}K(fLdCmsWbhKwaWLxOx7T=mK?RsgiTd_3d;>Y46ebwDapgqRL@erc!X{o5kT5l z=w#{4M+<3EP5k6gEcyFVy>ZNo>{rmne!mN;(_k#OeC#I_3=bCyEZCo{j>zA%N=u9v z$h`h2EH0PZdT?o6GW*s*;GGs|BlvZ8vZ_(k_SSmF{go~`UQMCLjnXi_ z4g`5Np8WfY$*-McJoES&76YmetDoJW|4{*`BA1)7ov{^#lp@$%3*$fbfs7;YKCEG{ zm{22cz|C+kdMJ*!krIB_7LbXOIASi@0owRT64$O0-RbWEF%h(q!3C+<`UlKvZgD2} z_xo#HH@$V$cwSXF<2=(tR;#$<0m0*itc#~M++5qA<9Rg|YDxd67q6~5^-&nRw>w38 zvGc9u)-*ERR(nNw0q`~Xj##@Oai?XD<-}8Ho3F9fQK@8uV@33L@J~GQmJ(=#?IWu- zx^qWn&nGh954KoG5)%L>BrSBN6m2A_ z4QMZI%CkyU-z6aF#8e|+vv4H93#g3rFHj8L! z+fm}Spr=p;+Oxdr=z&F?2d8$$184nx9g+2o2R|9af_Kj&nD+u-+WX&&6N>z0r_DvZ zv=MQr)m8)FhYc_uw=7-}j^Evm=AKCA{TeXd~nS3bl zFYNbk2i_Ox56KQ_OveE?H~`z>*!LCXc@|OyOfBJU*2C4hNrZvCC2xpQT(q*3+>xAl z^xV9~S5y+^zA*8|YwlF7bO>_{p$eKy=HGW@MLWgqYA6eITs`y|=k;IZhxI$)fS(Yo zLCpSecwU$_P@M6M_Bf*0t|?@Tqo#;&ghx&f^FCgi7<^Wf+>P<1XN-j1ULvHH;${yC zV}QU1Of3+q@WJ^{*`N62(?f~!tO4snFU;$1~#_eS~3Z(M5Ck!EbkJO-qDT4s$9 z3qQ_LzlT`#t_ae^D?n^o+gOorg_Cx*KgZ~TWNab3|H-1Y_bM+V3Nn*m{X&1I^zr^* zSOmv^#Uhy5|6jXh!}fsfnOERju#ZpWoGen}{0|Cn@fq$^3-_2I{_omow3%2%O-VDC z#IN@RN2-yTOs7s16jvW8qHt)?sdo-NO;&6Aq0pu0^M1e4=3!rVI$Mw479Y>Av(3jN z8NK%~s&RVbzM!W~bLTI|WA~(4qsPni+xZ3c$;?7hAN;LeCfOupHbsEy>XnIjtYYjaaR zH=0}PPEPLU`L<^-XDfeht~YSr=gV0HECLa~H!M)iX3a`<_pHv}SU0>5_C^hMdo53y zwyP)?35}so1~$Qc4ZS$C2z+w8R$Yvt9tK)BFM7bS&9B-q{O;B6mmvv=Hn>2Fdm~$b zy$J!5J?@LFScB2#LllYF5PZzFH*|q3uM_-db=i;^nJA_k?Y04F?O61=gea}VXSu!N z&A37KWX8^mwSS`7Z=bM=1}>cG7v4@jM;z$vaULiOb{I*u)}x}S>6&n(5DA}lvP6S)D7{_JwTR*&9AIF-r3u47=FN-`5CB_S&5+P5e#lk(U|uTshl!gIC* zuiD-`kiU-ONX}iML&n5mwFk3W+!F87)_GrOAUIr_O$LX^*ViV&nF?|Z@E#ge8)YfdcIHImGCXGy zXyj~fzO-WQ)7aX09$Dh3)Y3$*C~idiW2;56CPCcl`}WHnvVcZFM>3ZNB_;OZYZH3*pLdxtG4XXm;(+oPGCR9M~WS@upLE0rVCT}KN{_goR* z@z^k5xKw)`bO@@_C9X0|AImCzD7^PEh>BN=eo^z}&d@b_kOu8z|GQNkO|c3IW`4|o z`QIlpu9y*%nBX<6Ziz067aaYKpqQiy0wyEi!owO;;H#STqp^bA4z{uWSJV|T&&HCF zhdZTUj~Tw&PV4)Z&YkeJ)G(N^w+U7*v|>$Bo7E2^In~7YDVKTmg@Q-wZUa;tpjOPk zsg`QPlviRFo*ONHz*iuE@1bFrM?<`9%JBwoKY0M_kXMliAGLweT`yYDPgzuVqC0K0Gcc zfl~x#zZxALj|?OkmF6R;rNalMF&Le9pUmthNR=`hbdvEAM@_K~uQY}KY+bJUbk{gz zKf7G2v&ybO2n}caIhU_YDOxH4h~9~Wfn*sP8m&DtRFrQwcC%P|piUJ4Y?WYNb-K!r zVe>*!iR@&vgZ%SdL%YuFm2=gojTN*S~kUpbD#b!fv?%x#%>Z4+(Y;tTr*2667 zi*ytQl0sn0vV#h1!_c^SlnIUzMxG|6z0JWp&(qQa_d(C0JDXUOHWxkA%*dtwFouCU zTE|yrHQ8a%g+DOAEp~~(jI}1A5zwBBNbf`&0hdm$jtiB&^7RDDAhYxu1WRdg6je1UQ21Y% zGPAW^t2TAz8~$9UsrcH)N$|N}a>&z+&J6w>f@V<=vsKL1Fa0&;*O9KXfYJ7Q!}^56 zOE4u208CEHyjC})+pccLf=(<+Go(6oVefYAM!IZNlHA_ieTOgPP2;FK_Dg(1A_HX_ zl*6GBYD5H;z=6jnDg$4ET+-H2_Vg4$Lc2N>U6Xl$9eEAOU8hSBXUI!|3FUl1IA6lH zFHoOES=iOE3fzK%ycp+a93eF)b;+;Ny#W@l)KZTZ2BGmzVw3|jR|}C*i)O<$RDZS} zV{i|nZD)H3CsT+pqxxrnrPPEsz`N&Cc|}Jueo2rF%ExYSH)e$h$ZOB1Lx=r#fwRFC!x>#|D2%uK7?#rg!85xk;#W~kw6Caa5m6V8(xfQVhT-}vzO+- zdU1=?ZOn)*r#<#~O4SzPL7YXNv6 zOMLJ;WDA=+pO*eboFCG0Fu=Nsh!?;i36w51|HHzw8V*z6bQR%cP8#$qh7^mu1fN) z#!Ss)!^m?UR2|W5kV^ks7kMt|q7vYdB>Up% zmA7&#Du;#~s>n0|Xo;Xlb`qAEd399UoXIZn$--ws&);ogx=Wz7J< z-mlofFx)~t=!uX%TM^G`(%gbXv3l6biNch_1oakBi(Bd|5)UxQe29&7Odyt{z&0Ab z<)c@2)+oTiQe?!pIOMksi^>^dSeKmou95b4ppzEtChtY!>^g->k22v)!oSem7?RRG zgpak5yKhmJ)CJ|rp8<8iBM@*}4p9a-L7=*;HpqsXtlmpu`)iNlq=KILKx+x+g}^{! zuYeFYVK9nj9ZG-w8<(pm*;Ni{8fuIQAlDQ*n-vH;4{Bi>-hs>}+j#Xiq-0&BbOmh7 zlgJ3e^*oMVTp-viU%5c#RSLFZ(15x^j;Eh>j#C}VcO!mKdwfAi|24U)MT=8UU21%H zPbaVD--gOq6IV?U*y*U&0y78`e&n7sd1wOC-N{HL|3CGXH{6f`GaYg!nK8&yb8c8% zEBBh0xoKe)Mkg+h6$Kg^btsHa05fDHqKGg1R-j~b9fnvX6tF|HhCSP51AAn?#|1e1 zzqga5=oKH`WjNvFmtoh&&(*?czE#%T&ik^&W>)E9X4LAB0o#KIgbVIKEQ0g>)C%@T z;wcvXV_i;|W0(}<&!RcwL#&~~(Sx~&{(r8#s2)c);a%r?aXV5*wRKzw*VObcI+T+d z^Hc9tx4Yu8GkrWiS+~=H9kp||$HzsJ+_KcR=awnkAd~fv!y+su!YBl>b4a)^;1~+7ENPtGik%5sG~$W%Tg_6{xoyybvPI`dlS_ zGz*+MZ#`pp1szxg(-!JKZ$Mo~uWD)wca=k2-V74QD|b)9F?O>G?^E=xf(^RM8oR|) zM&@aq{%N`j6q*|imP(;Sko12O1D`@Om0Y3yu53NC&fPJ>Rt08o*9qZ}=buXr zb+BMZIX`*(1UNMQ;ge^|Gb1~lAv5=t5T3NcM)O7v5bzU7CrBqMz}FYrso!oZIxKwz za$ioml&{)%j}}|2$8%)v=%M;~_ajLhv`99HJd*>iK1a6^@S%_ukNBoz84!?WGd7k; z=o()NNje#G4=h`7{Tszqp+nRrteWHd=hQ*jLPKy80wV2vM65inM){$~37Su51#y0q zf2FNKtTubZ`!5wY_WDmVq^A4_>=9*46-G;0^KY7Sb|7hCUmO!Mgt9ZUqR&h{o(XZL zw>j(3Wn$yNE*4_Q;0xHmTlE!te%%dSiTb(1uv!72$3tA zp&qLFnpO8|wG8+jiaGA$)YB)%UED`+4eFiK3kYnJ@0X9qotB)@G8xh_80PX96?syNJI3%QVaRUrnO2AE6DN8h4-VqkqMaL4YkOW6HoRQ5xqmY|2nzB3V?Vw2K6_?q)?#)rFl@)4E3A z#fqtqWWOnL>8bX7{OF>k?&PRC&i8fi-eo7PNz?`T>)_tf&0#E+yFO^;8^9X)X@8=`g`^p45W7J(Q&x|{YxMTtYWudl%T6lSlZqMt7pZL@S zx?j8J+y1>7p2M^us?L;NPhaOjxHxE+Ksg1q657e!67J^9L>WoP)$Y<9E$-bS&iDQO zKYlXx1wS$MpNIQ@TJA?bJ>Gl3A;A?oC=iVSE45{o^G|b+Lb80SO)k)3PstOKKc~3J zx%Q<>=wu0Q?uDZonK|&ek;-H`yR~Sj2%0j!784&9T$(aR5g6f&Fp0q>0|5i@4U>y; z+x%Q1%5?FB;n`BD9BXgD@y|w&dfx@di4N!reBJTLoKs{#ek3y>*OKco17o1lOPD5; z^gO-I63}GR5>R!!yW6K%b#{fP_X|F2`IH||Q=NH*ulIH)PS~=Q$NLXu6@Ffzo+KY} z6P%$KFaGJ#Z5aQgpvYj=qM;H0$@o7-XG}hncjIz@%wecm1w(pTg@)*7OPjJ;WemH=tDzoi$(m? zhsl*>!aTU+?)YYMZz6?v?7bxe?Ss2@ZN4N&KR*V$y%^{|zo4_^?4sva^&!rst7c!4 z?a22Q`r?AfcYil^G2@O;Gq&V|bN z_*qVmcT!B_K7Q}Kqa5AzIr0;p{TQ&BjveKRsyag9NPgdg6-2JY&PZk#A0nk++tZb*Fh+)PPLPtH^c;Z$>yf^K84SU}u z7q?x`2qziL^oB)V+%S%KjT?G$`(QN0$PS#x@TLa@@0`*vETTlg8`d`pIW8|D=LeQf z$K@aosNGo8mE_-uJK;+ov{875ISVK^?KALKUZt(6i(HJ~<^ff~=K|t+@i2c4N_#$B za%{dTB3oX3B~VaZS@@TaB5N{uHv&~|^6`xqhbo`i=ss<3BB+V<#I$y=*ptM1gWfJ> z!VS+KR(64djsSjJ7m+}90{wiqqj$-0j6cvV0iCwDImGT9de0tCkB=b_l;~nf*pFU0 zAFAH-iX?`ctwjFY^&n}G$RFq3#W!v7nY?pY`#)}|zIs1!ihQ!M;;iB0n#V#E{sU4R zlr-RgkA}cAtg2h|vz?0Dg`&J6i6YDzoEp2< z^FTW!&YSxYDs?_AgXl=*n3&&3NL4bg9F1P$c0p$0u;V@A3^pUTD5{WhL=iX>x@L^2 zpg1fUDZ3s7hE0}`6h`&eKB|crRSG8uK-6GFc+7Yt**m*cRj!hJ8j=^`lu#;ECUxrJ zvEy}ZJmp@-Qk8-QT;NeF+X1uA?{qbJXn)AdgE?TrA?+$`C-4H32ec{Xw25~#VHJPy zMUpbPn~lQ#cT<1Kc2`jl@YKz*%3{rZ@q z+zV6m86^L$pYajFM|rl)dhq6sj&<2qXxAJ;&P<}Ao~_ok3E`L|S<}kL>jWqZMxg(R z$O0eNx}V-vQtel_RNj2_JD){+Z5?5XmE0ZXhxZX~9*bMXY27}fCXAPWLI?U@Q69&r z(uZ@${-{z1R;wz=+cX#Lc8}0Csv#n5foNorIvo9glVO|?=LFWydvSV%J5F)Al%L>= ziSm=Vcds>3$}kLhI1nUQ7gzcAD?DW?-X#Y$(_|#V%p&k7?Ctsu+3{oM_*t)Hqh?Tf zpYPHhh?zLWx=L1qLZmU2&&~9EMiiA2lF%$7kq%GT%Y7cl=RD}b69wO9UeJ?30gL_wH! zund&Rb;L$a6tkMzx~O>m8RN7TPS1=U8+cmF6Ob!Uy!!?=e0p|6xq-LagZ3S4;@?Z_ z7KZu++kA`iYl2mWWnjx!n3OC8Aj=<} zdvfV38kg2z%A-iV5nk?B7Tt4o8I&<4lO(6mmXhgsV!d??V}!bcbgb>^ADU-t7HeRu zCDO*hfx?Zz3>c=E;)C04<;+k1%386XF~fbdNDy0_tH6Uo9rF?#X|A4oMwt5M;a%E{ z4zm@NnqZY{z9IaL0+dPMMu3@v)L_W%+?^6MDjt%~(VZ3Zf-AF35dN$-Bzx@ZEUIhsZM(BgO)E}czV#4Ic#t8I?Gz60WWd0&1% z6AncV>Z|aT|H-O>ede#*y=GNCRPmoAS4&jgd)EkEjCESTm^4a~uw^7G_C_Kq8C-6g zr8Mgv5^d1bPb%N_S>g1@R)+)lQ*lF`jU%F^mkibBFOc@JnAg6|rnUl}eb zdBk0fNk!^^Up86O`r3ZCYl!bd*0;eOy3IRDKsXV6_49uw;*S$oJ{Q+&_y?=x#?&9j15 z%FWTtTn->XM*<7t4!WZkT)Dn56W&N!%3Clr;jtO!(_{PMDLVVSRx3nA75g7o2 z*!XLjoYk0Zp zLeVasF(Mtpt0VY;~Do1$7(L$bge z!;W0d4CHbXaM910!uEtt=#e7`GZV+@z(c~eSkUWSQr3#I)iqx+cc_W!Su94T@D+Eh zSLd~LPin9??>Je3Oz4e(m*O;xV~76Y*F|>|3d{YJ23nA6KdXm~K@wNqdT~vV*^9ZY zL3bi~)AfC7lnAk*EzCEzengljC&VGa4Ac$-8x>R_5iTZh21}TjddG{O$Nu8J^sJex zq({9@o!kKMk?!{j%W9w$6VS_FR~HMjZv?V?=Xb`?9wbOpUw;w`_#Y*~R(@*J+-} z-L#1P7A5SvtBp8Y5Dp>Nd1b_wxE9tx9fa)joyOEumANt26iJEPq9*(`fMhI?6P!~1 zO#Jwu$)o8>yG@{^vSxa$@P}mNqT*D3Xxj;mDF4ELC1P%rNt)*Ne@0BX0Qg3`&vBoy6Lcn)_ByuPpV_3FQvzS;pEf8TC zGt8h%y#(ZM33; zqP^hUhF>(u)qXIYPlM5G7YB)io^r@HBs#MZh0}~=1_E!V!;0Ci)~10#mPaz*2go== z?GEqp!kV`!{39y_G-YTv$m}1I9b8LoQ3IX{W?4NcOqq)U`lfqMQf)zwMFB&kmbdny zOv{>XBJ}a?XI6%?u*Ns(*b;2F$e2yDo;w+4DM{CT=Gof9>4Q04$qCTTL}p%B;IYOS zt|tL3%~dU}aB`C#P#z4kzsz!`oa_}2&rsPbwDYHpiWndSf^#pL;wx}p4G`wQ1C#x& zO(w^1jcLl!<+VoNI(q>H!`xgT{Tup+tbbY_`_^G)2)L^;!@bX=3%;gi64lW1(EA<% z++kLy+*I$8H!z=!uEW@}eVw}a9sD|US;WU9X2M=6a`$3>lr}d?w*TNbkt}mw~1lRz_Hro^5 zmImdj!fBSmKdcCanhBj}yf}S&(Lf!uo!v7r#DY>o?WnW@@N%JE%Vt&EB(yC0T5jWN zuoUc{dg)z2x}#bx_XZ^5tTYGqSPf1k%tWBkhJs7=pS3&O?;~MR%O- zSnM2ICe2;JGC&;j%SQ#XPxk=f-#aMV!zc3|ekf4gGi`aME%dfEAC)b~ZYrHy9jEm3 z1U|ei_T`+m(dTmYSoy7NY8*F59EGu|7CzCCJPHSBK%C!{hQ0H>y!Q1LXyz;D!)|=> zD`@@rpJ|;A!0>MRUND&5ljGb1!y3`Fw`an^!{&(S9O`3$^Umu}SDwoke!@Zz9X}4v zm}qu58o?NT>hXejVP--X_boY=%G}nxe|=(pXMQjRLyh4Sy6Vc(B3x&dX0cVDxJ8_2 z=M#+@JBQ2swM%H=9mB0z?lI2Y@ymIr{0^m%?-vJX9x5kYF@X+~ShIi3DFJaF!L@U* zJdzn>72e`WcX?5&>HV)W|Hvk_KW{?VJZZk28pe2xgq43!WYPB_D@J8qa=<6{VFa2Le zWV+o59v;?X%Znu=-rd@(%RJGFrkSVHk|(?&7?AMNbx6c(Cn*+QSF7CPOP>DlC6#nr ze{v7a7p;OCpExy^11xOSKQm-$-|=8=sY2`224OGtjbyY6gYONRSCok%>bYI%X4~^e<;wNRTBh&bGdT+ULKl3bzu{R=`hhu$`!h0qG z%4v0aUkCKl?@v{Ebh^Es5A1sodv66!4eno1MLyyjnB4>rIV4fM{4R91=9`@lqwTh* zOVg}=$PM4`*H2YDn^9{w)BpUseO-j=KJ!-UN&yJ(2W$}BO?mZv_@TE-T};CYymZlC zSbb_tg*vVV599xD3rpZohIbEvbQgz5``dq7SS&iCOe7`XHr-r&*`v0OWcZK+^uS>8o7 z5!|-7&h55l18&%5|JWt^-_eY2&X7Z?+tb^x)I9@tPBwpmUh0&dg<)8{y<@a`mr05X zOA(^1OLwW}L+WChv$W?Xr8y0MPbu}(7p#6Rx4QcR@UhqN^MvAFR(vVz9vwMHBv4zs z75&!4+9MIwug_~Ih_HZM;lMY{d(#anoqg<_N92$=#L|O&MRi*1; zJWv+_d1}GGg=_;IXOR6C>R)@-iZ39z>ZA@Dn;6o?SctDMEjALa3!+b159l_E%Ya;znkCS&1ml%{$!vp=il#~OR zwqMYTWKTojWGZp@;Z^DqZwJV`8jJ*dZt_~>5_t~tGz#fO(_j}=v_~x*qDZCp1G+ng z@`oAGtO9@f$z8#=eVBtF-X5u;aF%`+MtRxuaj6>p*1LC9z3OVDH0^_MEmVvIZAcH& zsEk4##2pw@~R?=Z=vOz)g>rK=6Qq7 zDIt$l*(vP-m^FG5$=_m%B_hduGJjoQp3`UcB|@tqMNmDeFc=EJRo{gALG(Hu9KAp5EQ1xQWH3!-H9gBVZcyaF7I4V?L6`T<8rxPyEa{pM(?(!X zdjdiN)?0TjR81;ncleQT7GzEUm;nt2agU#Ar;tkhL9_U!;xp7Gh=`+4CoQIo4b2)6 zObf?4F4xF!($q37pYAN_ZqdI8Bm?wy-7EZ4He=e_FpauLNQ{Zmc?7n;r4wWHaE?}T zT_AmzznMXApESavhdNbd*V6Dj0DjhEkmd5329@n0x zTdI9`$5Gq(+LXPEXLT!G0fDw=;$k|&f||5~ko#&*5hJdAEVX9nJ=D~e&g@b;GDZbH z&|2#YglNIBN~2Mw3X4E;E%A|tHi=i@%cSRtM#sEfu4nh|LfM!znQQl>yYdfjU!y8| zitZrJct5VE^OrD9E4M0pw+*^`089RCC}oCw=^B{vP^V%o_Nr?&gMaiB-MCyB_-IIEZR=tG<2;RIw*Uq}OMIk+54|+Zf=(hR^NmJ!v9P#-TMqcRIq{{+UnnUc zvkSWL`R7;)X~k7lA!`u^l0Z*~5|L^D;3qbQ{=;lA0VzDjgfn8I1blZ%u1LU>*%y$C zsSGXicqmkSG%2Dl8!}m=SwrdC)x$M`x zD^2a?o=}GcZN}R#i1XeLxn(=?Bh^5HqfXH%Dx)5aUl264zy6|Jxg{x%8I% zyy%-X3QK}uAlv3p>7nphnBkl0!A?>0J^wcV@{D{-c@>&iNP)R=nq=oDV{EN@At7W- z8AN65UtI&3NR;<4C>d0Ig&h!GL*WHNJT=X}1?Z)KR+Fb3DP5#SMJ2vUC2O?GaujF{Q+mf|P9(nQpSdb?Wmr6m=DB9<_;V$j!YKX2 zpoGtBdZ~$d;!9}z;m)JJ6|z0+v53F`QYB=u(l~JEE@UbBNS{cZV`xZ za0BN)8Z{`2^UW}b;Fws`x6exEr&z0nw1}~oJRj{ya*1tGJ;rrnP+STyL(m%-6AN0M z0r;L4ra;e-%bMmZ>#%#OVjoW%G`%ilN1+$kRwj=`+a->&If7O6JTn{Ez=|T6n>@hb z@_jnSD~+&YG}vp4#KBoAZRVa0giNc1p&7Knc))w4rDxM|{MkA2o8Qj9@3E;L)QW>+ zTF{B}F9VmLY1xwIK!e^boL%HD+E$JYh#&~q^ev|Z;rer!#~b5A{Yu;l$NbCi zDk^%FPpnYAkAIWk#XCCScd+1?^s|-BVf9Xw6iqIo6xJIzNNEI!@ygUMm}2w+GjCVd zu86LeyOF_hqqGguYrSRzJ)S!)+wT3aQ9spV8;jey`LMlt_T5v{urI1AN0;+#*b8@PLz|6~k^j#l1miyG9G0jp%fjg;-K_km$nM6vUq%GAU|J_}YW{lK{;!BY$??sn`EmOcv2= z$q43ea~hNUH2muAgIPWh?&$xai;4@IsSWZ0gepWI3M7fvLofSaQz3_NRteJWD`4II z2J1cDqv0fr-d%dAVxsx;jZJ|)(0zTu2uAYEjesTb!hfasD^su8=0jJAc>WFN%u3gj zxAT1C`(r9j{$oRq?HH*Zwa+Vk=?m9S5bic!X{{Jv`jxm}A-@2b^+qP}< zZClf}-P5*hYue_tZQHhuw{7Fj|9rSPCpRa#A9hmvOQrV8N~-F&p1q#F2cx(bK&%{+ z#*IDsN)GPv`yh=3rq#+3G7vZR#)aElgWaz@ugW$gLl0qC(ya>%0Fs`+J;0=&+Y94j z>b2!8=9h3fUS43Jky75+OpvdO%g{Z(*=4K8Zc$;%fZ{ptM|^@;OFVn3SswBP?@B?) zp{@lFoS+L;@)qvuFJll-@j+I}zw;?a;dY#vSTcH>LhHtqpkSg`xr#)>Xo03L*9ods z>}%SwI&oqg^P`k_{mJfrfc~EKz3Te@D^Xx&P$^Z;iTeP};7rY_`e>qk*H=HR8CYD9 z38|}=g1d5FqJ%CZydFbJgn$~0e$p3IMdB=y65>qjPdTc&8* zDAUf;!+mi-EXjhmtl5PzTObuB1>@8FqY$s!hY}F_)$y-5A1en#7wv79lM=lWHOZbE z$e&H5qq;g3hViAyLdSquFx9HskOFs-j_6`<;|`!Bwzx5%pV2#Zv(Pj*cn;_E5U%|W`Yrfv1*m)i{muem zpX)y|XnUpu(YFerzsmI_5-)*-U8%t5-Xnp3TthF1NKFemOM^9jC# zgW|X0MWeI3R&R%e+EHC0^CK3mE}7vCCA*ly)m4wW+Lc;TLi?-5pgSc2cJAARJd2Qo z1oY7?bFNagN$T9kmGtgjVc%)URC5iu}NN7v-TN2jpvQst(Wk*&8Btzduve!hF z$P!L}yoN5J;#wU#Br?9!}oe9I{} z->(@8y5W0H@9p29bF5EY?+UruuT>1AdOMC&X%iz7H*!k`ZZ*@gM_ydF=gn8szGT{6 z^sn)%IBv@O(Wx+9a5NLU+rHGQ3e`DGetNH$1lxI>hpb==%JME5heaE=^O4C%VrlMP z1z(Um3iE{D{Psy%-0ZILoT9WvBUtt`MPG_1SYk>LI)9xWS3MYOR9ln^WG8z7-+W>s z2qcr@hKffV%s^o-h3h+@OtEN2K7=tIGKZ%gh$!iBX~l$Uw}aoBbtMiSR;0ztgIq%b zTmGkIG>;hSU12oLA7;nDp9@?ri7DG7TrOxlQI$M^9S=;s4s|V|a#ql}7NZDlV_Px~ z|N8{~h5hd8Fl;#&13G!+-Z7C&SvR>Qf|mK4lape6aUd^7j$}@&LLnKO*v?!b7{h)7 zDnzdIZj$p8pZIR!tR~sb?Q2@^1|B=uvu^Gm`thf|BAne9T&OqPTskg(2&IU^nVisD zMWb50d&G~JK2HA&n>DoT)v`rRufJ>L$h|ukcuz$A{x-7?@i~EX69GO6CZu6ZpUxHg z0vw)m5w;`?ow---)nY=9?n4po)>>X!13sF%K#GTbCnq3^#|G4L1XAC!!;3W<;N|Zt zR<7-@DkdKdv}Ed-cl!w&8f?R_l=m97S(&|JiBi*ZgbKwJ4h)IAgpV zHo#UBL)ql{YY7O_+;gXft@ICWgl)*yB_Tlmsg^HSPy(j+oeq|>3%QQ8MU$-BAQ!9; zotb{>P(2;Mjt5lr$$b`TH8*Es2LgVLa|SSPr=phFArxtfw=W%n$ksQ zVnpN7&lpmmYv9w#H|hGz^j<01IONTZ&ojC^eQ4m_@!5AvsFF2QxS|xO>}!a#tNvry zA?i+^_;czut=R&3%JqHua=Oo_O8(yFNVG*>?$CSwm`pn0K=#!n1Q=(vU)lNdDmD;` z1}|S&MbzX`;Y~DIG}k^R2vwqS?|SDOtbZ;T?QY6V6s6V8mUseZ4@wbqlcT;p{e-gQ zRRwnq-YDixLZrRZk_dt_{sjGDvg8e6V{`i~WnB=iSaCLLN$Hym5{g3quWj@?1M-CX zWb(P6mDS^{`UaQxFvPbr2qd3^eBCN5Y`4Fl|LTwQkX9rqsnS`E3O<*&A(bhQMR7|;hP zOIshFG8W2kTu;q4cDM&w$>mC;D*GNL8THmm`F;PUn6gdXekbCDkW2fEzN4<3zb42(-Y! zseZAuqn|N67`c?}`>XtyLXdjP3pRqD@M(_Io{8U`*3c3S;^(Sdm#OA?d-2rSMYDP7 zq2cAd*+Qa6Wtn7nm(pcs_209SxKaL_QNdiEC0Bt(NILw}H``)zl?uJ>4Fs{C^(sOe z9<22Ardjd(S%IjtOd1dp=^bl`ZzK%qc^7z!ZWCSwf*_mi1&l62x`va=Xu1HPpFXC5 zq;$I>-jT%M0NDJGYW|KKvBU45sY|j_{|mBZ{{KU^%*<^66WK25YCHW)BVV^a-=Hni z1CI3=Vm~^s%#_I|?o1CZLhdeb7FAE4F+L&nSPIE(d(7PPYRTauoBhG+I=V*Gh(Vv<=dQw!A54HVg{nmO%;=jSz(&5G7zBb;GOT_;9`!pyJfa z0YSzhV2o(Fdq@|%pTErCG+EK1Hj0dzOTF1;d?FBU)#U+mmYi^uNkS<6``DST-Ifjs zhXMa&XRCi-sOn(U_SRCLy357J%lmrtziC*!Y!96Cl*q_vrWONWNaGKe}j9 z@P!BG1xRmo*jfuEl6wwg{+bKFt%!9|VX`7Wb8cu}=}&T0L)(yCFrExqv7;vFrwn$6 z_OTDYJs(WD+hV;*cIZ|A0Gq;pUqKX+b4J9T=Un8l@+Hzh@Eu+(y*5ktyMbN3LdJOd zO2%*up9pGs0A4zwKthJO-+8@FQyU(j!xQ2u_&u4T1;29jZWE}9@cOWPFCpUH;FAaa zT8($9rN9%s5AVO~ak^l%!=JWWL(@7CYE@j24pH|x51&H-Mr zQq6W|Y7S;yk-zEbPHW5Qw05-jZfCjh9A|}v_=(wpQ^ERnU|(3eIEJhurOF0cXDVXK zf!e#vY1n8#M(H+8H&a3(dUqYd^5E;&mKXG6Qv>F6RoAj-u`1BL%_w(V6IeQMv_qW| zNgZeYz=sG_bFTFCDV&xwq?&Hs=4sfVyF1>(uatspTuHrM=Keqi995l!y z|E#ey`|yx6Hh;ljI1>=}cP6_+LGTemk|-=hcj`BC`ky zwKymTwSJg+kB!&OlamS64aH$JG8;sT{weyA++!Tqo2G{TnXW$AX52@DZT-6q>{~Y3 zuFXW&7O$rOzg@U${92w%Z)D#7P&2$HeDD;{wu-SAcN8S5Q z8tLpB{Dx_zn+2kjF5@c=d|?Ap3PZFXVjY2n#*wU$C#(22t^c(<3si{C7T^XVw$Pfw z^Rg49rn$!uu_p?f6WA@Je%x^m)Kp0WkEjjk0tFbidsH9EVKyU1&h{5=!QBJ0JB->Yu8jbPK@&P&l6N$kLyVXvny)y8gt zbOh6&zjMW1XbB{S^V7K(&#wuT1vE<1if)!K93XJHdy4%2C`;H)E&i)Xn|EB-Z!PJX#YbT_@!IBTB56+KrPZhFeTXSy1dqj1;Tx|+7~f(> z3Lb6bNZCV$bB8y~=-Ea8>1EJ1N^OwuPY(!dV;K=db3o8D`{@9=S#0~yq}gn?r>Y=U z(#6q6`Y>SBnw9tFN*cMS8ORX=^XU;gA%a(Q-Q*K|exM8|h@4s!-UHwva`edOw`u!! z%hC)nR}dj7j<4swlt-N zj;wU;+-JDFR7~?Qe4i1?VqeMI8dEYkd4nM9t(n0u&A;#Fq6ogO3_Y=r6_iwkv zKd{w8ej}67)xO?SXRo>m9``Yt(9hdu5fF6xz*gOJ3)n+Nri2!7D?P|j8lZTG-<%9Y zhfD$nm4q|P+9kgFSu+PYqg6aJbfB*6K61vXvRX`2Sq5r#K zsNgi>Rldkk*Y}gc*cHs{!OjzaiIN|u@L9nfqMsMCyl!iTBa{Q336@>rHJZ^qCwP1* zTha80TL{OgF5_vTIh7BVdj9llq%f}^<6fZ#2`NbVeBi=vp~Kb$@376rr-LgJKg`OQ zndSiU(QmJBbmE1tPV*^*9qlr>rwUAO!E$99gGHBuGMO(VY!>8t`(ZvfnJ|6hI1|(0 zLk{S|Va4wws7d3>#kU;^oTF==8o`bFV^!K4ID>P)A{X^X)T+ek4@(bOq4H^((__N4 zag)*eeP|micHb~aEGHXwO@9Z@tZESuM#*@LxiMp5(!~5O6<+FS5R0@r`i)8$Cg%(?|Mr z_Aarp=g7eOIJ`mZ_U`31-VG-@l;Oa_16%p1JvsgiOD-8jvN7o!BE(vTnfgK|ILuzj z3-Su$bs_o=4^V{hiD8Uc?CvtLY8U`}h*8Fl8<$isK9H5{n(?64pJ&I->zod!(%Hm? zL!uci;XD7uSZP~Z@I$QhGk+4p&?%;p=t8yN^o zMiCO7@P4nxTZn7z=0h6i(66(WDxPS$kXgx$w&Odd7-*~~**bjagQO@j2q>fFa~E_O zuT9pX?Fu;7&rCQkxB{0CP8mE(G}A^Z7@G>!fmgnO~I@n zTIX1;TaMdx!6U0`L~v27&VQ*8TDpeEn$sLVdiaTu)N3B#jJeW}CS~!w_ba59@>=*w z36e}*{Gi=-HI(BR5jVN{upQy?B@{i#k(s}*jLW#04dI#rj8klWho88K>M%O>(*64I)>Mi3^8Qmu z55`6dUc3*vi%~1Z`DgbzP{hL|PuM>$sC}Y@TV7j5Gg{dmvz~LbFgBg|Fkc?^XW=MI zRq!7kqJttwFm%fZ_-a6IJws+_$ijm>c*NqtB18b_D`P*A+A=zBXV6HIn@4mMe7t3} z2^1{X_Z7V(rk)wPw8ltE8~%$^KNe4_X?GifT$;$N#r0IXeec@XS);I`I_3|-Q&Cb( zNr~NMX+K%twjDTA%3pPAu$T8htU&RE>9F$GvXHS~8L6AE(KQiS-rVUL$fV5u6t!UB&9 zXJat{7nWv(D>|j|agJErQq(1O5q7@+O8a|iIK|Ptiy{nucHZZi=Ewpf7dZ^44?n#T z(U*|eboY&MfrMxI^tgM78uU-ARugt?C~FCpLG`a;th$8criVtQCvFLq#NCn~{O2G| zJffgtMxqj`bdqJw$Haa~7BNl0Z#3lIty(JcV-EdXR9bqML)5F#QGHB8^%o2_>wA3p z1GTRaqu4Nj$9j+uqUaa47d=g9lFAtC(|Vs!?8)zgT`^%*PJXjiGX4o2*~o4xb;N>N zU6UEK*Bv7rx0$pC7%IaJUDtlL_p7-4OtJybN=T$4B&o!hq-WRDr@ghd{Yuu5w2wR+)|B~01(2EY2tvmnGvvU3{kO5RrUPC$odFU ztvz?>z%P7)i7<~&apw3kB00Cg7b<41*x)gfM#)#PwMpJ)WuOw~Iz_F2`R^Czu3cf6 zxcb0G*m^vPJTk}V<{$566JR1NL8D_-=>RW`(8N)?AF_njNHp*ymgx-O;6=LP5avFB z1?mElozqldO!Rb6rM#jv&@|{|;sjd?Hc;KX@~6(qi3&jS_0(dOiL5PQ@doc4Cx_DY z=~*5JI*#fDzxeC#nNY|uDPKMV`&r6S@0Evik)d`=zEHcRtf1{>NvQ}~hU`K?|K!4^ zUEH$do2e0sH*LXGG{CochDKFu zJwFjFNAKKM=Tsb?%46ZZuP&O~W|VFonp5X)(Ce;mNR7zr57>U84LHlP(z(NdE94aU zNyN-d_LE{eEExXP+16+&_v zTW~=uJnwdwd10!<;361QjNAuo98226J!lq)W|MFBD=t(9QLPG#XB%5hCk@@)d%0hL zN{ctgH>wrShZpI`|wpQM*Evv7Vz@$1sk^g7b^AHGGRlCAadxm!+KZ$!a6dHsS>N zgpK84`XaORZ&r=#QV&gB`m?vA@u2x&oCWv;eT+Ftn}N(8ENHnDq!hMOxtUk zbRX4s2<7}{RZA~byEs0>Bb%|>OW@fnFSdKV!fb6WCNa6w7zZ30C!Z_N ze{waFtdgBi`2M|CClCWoXBDs;|1(YN;>jh(QSyN0V6Sd!p#}NcOarHcib%QH8 zS?;PDCTg^ZQ@D0!_Esb%7)NWK?r~m~Ym;{#)7;EZxuL@pqZN<9y_MR5f+ruX`QRZL z0uO!zTg@WD zcTf%8H@Ejx^M$KXkX2!e*(b2N3~bA@&~GR29F}%+M!iOH=*T zUBkeohzI=QQ>E>88ke$TBP`kse^u{#1TOC)TA%d!Tgm+Ig?}DM(MN=MOdHow*VNSG zq_H2(OIx9UIuqr=!q=6{l%dWG@svlglfO4+qLcC}OxU3TN*GkS4_!(^iP|Mzmqq^? zDaN(%^d-FC0!fUMW~a~mOC=uwEn+s&7*!sH_b%!+baSWULXYCZ0uUT9<}RU<6epJZ zdDhKKAdTMBaJhLC?G|h5reLs~XAF&Ny}4m7OdDNGxN)KP)oY6nu`yT_<&AWXlXbU# zB0mKE{}+tN^4~C`vWtK1OvSCIEm@oQRE4=-->leS*d>LvLsAY-wZZWW)G>2S(O*MvSIxoQ6hRoa`*jMrJI= zX537iY+THy>?S5=tfv1~#lgmA$jWTQ&cbMKX#CsI+|-HD*v{73(a_l0iQdT6#L>?9 zH=~oIF{6vErK_oysgskbt+}ZqgOi;#sVp-yCpFQ(k5G1Y zbTM}RW$0*X>rBMO{vU8^YHMO=WCahy%*FcOA|-BV?QH7EC~j@&Y$|GMY-jQ>X#eJO zw)ht!R?hzkT&Hw>>^4T{z6AukK?6V#|B{rnb$HVwK)#r8o^Z4s*5RXtIUzH#*`Owv z{wYd&>$~6M?O7`()7DvOYCXfx!`m@;b#>h~@A8{b(t=KQH^8J{52il)~9z0h3B{Tydb} zU34fy3|%FjpJ#S{56AzMvd&L$OJBJml%h!D+iOSX>h3%b!Kn+7CWplyD8cD&t|BvC z{4re>DS%7e+jPlE;KoXg@BIvg-}Cg>-P;nf&z+xs4-RMuS2#gIZ#;bGu`SB0&57I- z$#)~oH4aY|rSR+4=V@BF2AHDJz#uMu&g24-lpExK@z&mKU3F0tV2@4Y5ZP@FrIifa zArgcG9@%_gKVrUgA)y4Jvv8_4kuDOqqL8)eNu209>NVnl$dn3^wcwD6!mCx{8w%tt zY(QM&dQ9(_NxUepj`2Z1ZYqWp!6<&Bk&698rQ3t=na6u+lo5jJldq@uX~_F^3tDRKBX;Xou3n^UX5hrl$5c~EaJ#ZkDJKv+TpG0l0sTM z^aqISbhi`j1Yal{Y%?JeYYTybPbB^!s0Z&z@INF|H&`_a^ku|0NSg0hU-C7E!X&vOsd!pgS7q7FFnx+PKX=)Cckv$MNh19>Z!p~_1dF?& z7P8Nm-O?`u7eu?SxAf|JOh3T>_ovH49~E`bEJxa{dPkxnQVE8AYJ(98$-a*kLXzaE z=20Q|)KMjsWxa8k`AZ^#WmPX<-g^TMqc7+dO~L((6M+=^AxA7-08)xYPabGSN4g#` z7$b$J#(aNuj@>!~B7Jl1LCliCBq9cGh3qukrzaM%1rv${c3w`V|7J{0aA{T;am^bW z;>~0322R1woUMly$Meu_&}#vtlc&(HTb8I_3d+Z3=JS5+C4&`B2xa5ODX(noS6t-{ zjN}3L?*<#2hrY3R7SpodnK9ZR8?I@IkgP29Oy~`agT$T;S+XICQt_Gzu%jW!9@~K%2$rKwU0U=DxiM8U}s0Sl&J7eLH z0QWB*FFTb6b@L>icr~aqC6y7{8k}!Qd`T{A4UI@T7y-$Iatzznvk0XJ%=8+7=97_BHP${q#6E2CBv)XY=tM!ybm399kl^;Pn)r*L^SCb{sV5JM6L2rR4(C3xTfP!+Af20D!Wa zY-EWN6o@GBZSq5CnOq2o#^A(3#;89)HD6P8BSv`*qvgv$aubgj3E-(VBW@F0hlUS$ zjk>9W1WAlZ{ufvWjhED!dc#{}PK{yW;tw@9B*$l>9#*+{QDnGh;-t^t{5=H;g26?H zPJIN5QdgMX#ET+5orB>SRtU11Y^7%jF-mGvo1Jf6X2wUJH?VIuW6dn6U$O9<_frKn z4%0Z$GzSR)D^SpV1Nrj7Je^)cGOx(Aj2-Phs;D;Q&y2rF;zP#e)8(`|%WvWm4i@pc zAp>jtTxabD?QJYpAwk>Hkn#u+05zr|89EbPcSjbZW4T&J5CNf^h&rB5G~G zN?q(1U+hOTqqS?9Kkf(b9d6y0u#2IlYmY_Sf>j~U3_q!vmEiR%a|3HMz%#Uez% z_oLH6sT&SV-okL00U{*~`)~qkd_I=ua{rKVAgRqB2Yhli#w)$d`5(oo5O$*UCKWxj ztc}8+gn^{;o5!o1DCnax?N&_y+K4hUZSF}uePLn_Vj3fpCsW-pFf%3O>i+H{n zj3aKhrYNN2J*+TeWI+gZy~fWqX-ipOL`P7Ol78NP`g0`X^II`m&`RlT@Y}a@V`v~@ zPC3vH;?Y4)eu|q7kXu;_flmn7SM2f@aVHcd8Ue<;1i1^;3FmrVi-W(G+7y}xZ~HK& zCtJ@+;Del%-T51*0ke|bGaj?-7p+T3arsNVm<;{Jb#V2Yq4_~BNFzdI);DJ|hy*{W zt7xgn6(k^Bkczwtg9urnB8nrRrk1VL2Q-4w_bHbI9F!UW=VxC+3LBYC+*>M^V4=}| zvDMx#NXlcZ8q%Z->jhd$BUX&#Am}~6E=^;Xwux*JmbRHXXQE0nwvAkpp5e+=9Nq0< z%y~FGkc?*T&R-n$BH;jE(@?~wSchfsdie`)g`lecphf@>mI)d}KMW#sL2-sv2X*!x zv4nhiq6tbpLjxn(8nOts?g9<=Yy~fAsFDNGANXx8lW=mT(3*r}t<>lb8db4!xKLP=-N}#6l1Z zYgBT->OFTSm3v*~*u!cr3&@0zq4X}JArerasVuvpqQ=+tH1 z7E6j>a?Zu&f;pBcQ`~?8IXT~0OW!eV;b?4jSD9+oQwC6w z)UzB$L;NCC@ggIKDxXGi})oQBOjCV31fqB z{$!rfRtVHr973&G5}z$w#OMJms^UX(K~Iq%qra>oDwz&PNq|JRg9po~H^I?UX< zu531K;k3O(We03zIK|2yaA_5HJjrU=7;b)-oDM*Q3!xB{iR_PXD}ms06sWW4=uZE0 zOC5pgBV>Zo|J$AKT@P&4`1vyu&~FGkk?LN{DCK}W9FMI#ZX@Cu+vukAuT_`v->*v& z!a?ikdUUZ|Y|$t*5!+dq;AA~4$%NS+nu*S1tJAZHGAqTeG3u#%S9o1qcOm7n)WRlR zkJTR>)SEGwh4;25&Sa(8zMP8*%vQ&G(Xm+A_$=4=sm7?WF>=l5=hl=@oO2N(jj{hM z!i*DN?hDA+d+Ax+VybB>qj4rw^cUW5a0-sAsx|v83xDrPHf=d5LT67ocp6^$wS|$| z%2)qlTfx^!x8nZXmjl-?;Jv7E5#!%rP-_z^ry^zr7AF@BAnnll-M3WhZ~yahEPiks zP*O~Rn8U!+i$|Ys;HOa&uPfsV61vGXetdnpt2at{A8hM@WqKHuVHPKUhGljhHy}y) zTjj%in`1m3tt7>BdU!?`KW-9ltD!YB2@;_=UJ$C4YPcGIMKC-qM3@|rthFnb`ZMDU z<`WBk%z|U-`*3gz_3!nh&1mPj%n{d5El0xe5qh)v@9u1SLhF)bY)7`4%m^V0>@x3> z>HeaC#MI^M@B|q53p&2=Y!M8CP`7mnjBBpax>9F1!e|HyS=s&sSt?i_$_uPiH@Tq5 zbU?>9*NWA?wOp?ydUiB!ZXaqu+S>iGWqgRZ^x_6KpP9#vFa#mBs-5|b&;=gL3lpE& zP4(<@JrK@eXsu|x%Kc;QXJ^_}w4wW>05@)nE}cjGX1Y<|cO?-2kZ+_7y;#k41;;E* zRr`shdKujGF9)f|fVpim9#Vp+<8Q+pNOi9&LC(5ldvNj#QeY&SKmq&1Er&+w;+CtgUpIrG$C(ATP#4WGfYVQob}J z4v&I3z&upz!S(5^(3g1s-u7CjxMFl=KKORH&0)|xSA6U*wcT6*0YMgi3}BxtIotvP z;jJR^cD$g>3QZC_Q0N59#a`S&`hNoV0wqWBD#?^)u9# z2kh);+%1SHl0_rU;d>yd%Ew+G8Ee##P;O7JnHa_kL$l1-FLQ%{(kNf}K7p*-;0_JB z0E~olO^cjV-vaHcBU+v8Eg!YJ+CIjk^g2 z(ycR&=&ATe9$d0yQxs!ukT~(!MF}!eGEqb`S~qMYtlr>^`+hnz!OH|FM0NW?jb)8* zjmH@VYW;FFybF~)(caCz=TMh^hIM+C$aq7h*SVsRb^*v1A({fFNo~2#GGi(D5~TM1 zda92AdY(fD26+(0bhKTpp)6m$V)~3hp2?3KcVMCLs4&uwZR~Ld5QEU>uJD$P!k+emxt!+KWC`44W5!xKB&u(LpCwyc8S(Q8>_!nPE zeTj7j&P>_=dRq`P!?wXk{CHE!%qzi;u{Mf_z*R%{0h(l47MAF$nD+ER>uN{%@G#pV z#~cRC?nKogx(C?QPX?WjuUz0MS8*WpVybW0V7ElolIm{KS72vKbPTr|6*FPii-t8T zm+k3z6m?2DiI|?fO=xy)jvn&j+uIyZcI?qRtcPaGwE4dGalne(JQ3%Vrw34c^!-5$ z3eOe-<)LTE%tO=aol(@>wnG{&ZdxjEGOU+i=J0Qv1#)A&V~M3GOcE&}f`;x>!z`?{ zS8rE>bLe7S(Tr^W#V}b7I8ilq*-!d|=y&xScS&fd$3Lr<2v`up68LNz0IBR7d#SY= z8y9U!FfRpK2bIDT-Dv7Sw6HamI?gq3 z7SNKzY(PmB>wMV1Soyq;0Z%7RdwQB#*2LL|M8AR`;goO)8Y-#mKsEDF98RaFu1+!o z*(`+W(Jq`agCQP4zrnTQg>w4Evi@LyKe{y0&iTZnq06uRsuDanU!yy5nwBBQ*GZ7n z9Wb8mhRdt^)O$J>>LuHhF%-5@euSaSTCZi7(ArdSv#4W`xgh5hoS9V}W%nrJNxLTT zxLgev_GBLhsuCBm)y?eIlLlYwoEyGI5qP~gVGpn?odVNyCGPu4Kvd?5hGdH`nNBAx zyCuw$3285!noTy)nzt4h9c6+ATHmW}o;1g5Xwn6HF6m~{g-d8OlRNUH3$naFFiE~N9(y?}?u`>4X@3e3IDx3v}!3H)BBI8*FY3rS-I))`>I)RjH z+{m+?jK0N~x%|NROOf4`eGtH91>^+A>S4&81y~fAkDvFuqo|{H-S${UIyIgLCgUaG z67;@kOUh(OrEB*B>u{3@2AOhZ9XBMGOJuIUV|*>j@EQ-Ompt)9uFx)0c>MWI*C6@K z<8&Hbgr8CCoBx$(vicm=*p@i{cOy6#1psx?bocW1ko-!hoA$o4hIqw`Us0P(G`SuiqkOOZ z_RO%(i5B}isb#g-P+>yFA8_sJVS^vw?>6T@@i>mxz^3eTDEDTJGQwQ z!lW#<(Vn!M5W8tfTKhb{rfi7IygSr&P_Bw6AOkVA_ai-F=TJA3O!Ryuy>U4X&?%VBI-#r^Vm8LS5+>8tKc<&j(&?LSq z6OBUXeKI8&E-vi@n8Y+bcM z5-gD4!Yl3frjwB?eruPvSNUcn zMjUz8j&#DzQX;X0i{DV2|0NteP$ZGyGq&Ap8xl*D_@^7>0*9P|Sg@N8+&y$uu2f9+ zadQ2l30LT5SmqScsE(^)pu9Rlze#wo=bc$Webo8qdESTAKqY1UYiEZs)f9f@+zPbc z@@I5|e~*m^{=P#;PHU>N6vpi)M|L5!v461fpI|#iiniC)?G#iD0aR|s@N%QH=z6*1 z2e`a2bN?(LZ`uUh(96RguX%`5=~aroJ*qM~>B^|D9~=5jIRDJ7OkibtBt+c>{TN71 zv!#Miy6FAsHs-lez+^~G$wi(eG5Nm0I!C0$rDfX02Pf$J4jA})W7t221~iu|;+EbZ z!0NiyH-C7ZK_3`uf@E*^#W-$V>IEI}@~+`icy4~$x?aF{6GI>@c*o)u2a8!-$Y5S+ zM(q~m!7KEB=CI_GnCaRtV9;AjVS}HXo1YgBWbvabGFac(#p}dpH z^-Jxo`HFG=yL9H)fqg6_XIbMU zc{3d5J_ALYok%yBFmgoK^6y%RZ(w)r1`p$xgQ6N1Dt-j3p)jP1%DK!=y_S|+X8uSK z<&>;l`dRf?-@`#UGwuk#6CTUzP$>6EF=u1>0W3^Jn#L)w$Tu=-gk^s$KfkIC$|{1U zv+!Q)ck^@+#_H(i_1>|k5kwAUM_9?I3PHpq$IwhK{&U4HB{uH5O3`HEG#1k#TcwbZ zIZ<6)ME|eN-|}!KVUw-5{h^u&!-BS%`H;xaI0WV#?(WXN=be2Ai`AdQ@l@P0&21_o?uaWrU%U;V|3>mnC1{$AY4X8azAyP&f=$ zripn{oq>2n05FRLmomUiG%CkLLptyk7s^xUOR=} zyYzYmD(WqpPxI~QTcCUwwZ7HBt6F9-Hbywana?lws>UT+6t5RP`Y=g<@kt|QFAkNr zjfe!mu-IE_fLf%t`a2@$oB3=fmNyQ!&5aX+R&l$nXw~L3theq68;~1NXq8+Am|(>P zqvt4C4vPt|Pg&5Sb6av^6j%fXPR8PH9y{tTFY%rJ!I#^OS@swen)T<=s2=A|*Uet2 zDzW2JyZq-5b#n_4B-V&8G)G3OfZ5SyGri}1HcV#|`h2^u!MP~86Acz zG=jFU3=6%)bjUK(|GL;LifX$JX#06vG0DP7Xaol*Nz2fGU4of@*gV3u*C!Mw@HVc){@z&iKTdleyOV&0Vp>OL^NYBv6g8Hp^rw zHe5@t{xCOfBB&jPYq7Jm&MT<@;RnIou`sY0&t2bwQ?;`vJuez8BYi-nPBn_dKRU4E zxq22Y3cUI74h|KhR#WqyOo%toHaAJx`e|(WC24h473MC5Gls0rz*XybKCbxH4hen2 z)fD)!hj@&vU~|JzVt4a5N58Ro-}3y?-o&o%k7+Hy4Tq|Jx>M5z^-F6v3*%x3kxEd@JDiN1$mVG?ciQ>$UVQji-U zh=*XKP;(RE41pH_Q40TEG+etak`&2Z4EGZ(LooQ-{!d#09J3!L_V~7=#-9nv1*Fdl z(%_Mox3lpyaK0M5mK^FjDbCFDRaeqC}*?qkk)Ck_5ENfy%*YnSqt2v&K?$%b4+^yC=h2Ls0sdt zk)1M3f$xN#rDk5ZvS{I8&I)}pzBOGZk))~Q>a|~I^#zT|=tk9Z@#jhtCNG;I9|XWP zxoaHT@{$(*J!b#w?Qbz58dwniczv3=yq4aLBn~~J0h;5yUs}B#=GQdC>(DEwO|9?A z`szg>$_(b;g|sZU=aG0hnF8uX;M?7_cN;+cTcnvlXqgyLr9t9*q^NMxv5#GY*-t30 znUFsOovno2arNGvHpe>o_+|ks9fau!^FRv?8D2OM0a@ojiC2HECL|1r!)rl=xqFI- zkvqUt)a9|q9(?5MSoR2ERC(16{Tp%~ZLOkob|zRs8NGd=Nk#G;qlhRhyNRZ*bBgjc z<0CTYOfh_STv|sj4*Q1ZT#DdjT%wm~g0=d;Ucjz7pEMLGlN-sr|kJuBR zc<@Hj41|`zaBsXTr?@64W?95SNSb$__y5htqxmyRfo00B*Z)3Q-X^`sE0+qg$bZQw zKtiZK!;!a0{*C#sAVoILvxD{&KbcKB@q_IAP} zY4t4YXQt9^%oy%Iu4fG-TLLqGSq$d}si75I$6Pf|EQKFs4YTFuuJn@3=2k@Mq6+}e zze+>6iKT2aTjJQNz?^>3-9&aFB_P;5O9%D5a9~9O!?}=T4I|sYw_U;`gp&8Y%7Fnc zW3N}Ny~--cbf^w9W#F}7hGGv3r@G68VV@6}cx%Ic)vhyeXMYIpyytL7>ThornUlx} zSp*>pvR0CIyzGfh8&CJ7UjFVz7yhe1bx>acV3=M9e;)~rjL*H{+HB#4)0%O(x08*i ze6efbnMZz5MXV{=g>@d#xPv`e!lYxOv-gxO-*af7NDL(v6rR5S3GEG_HpNjc_hoA@ z=#I%+k+4uK!491jK->{&mN;H}>fJ>64fo^oJ6wTq7<^*Z+&bWTzaavPN?}4;WUjzf=YB-ra$Kenc%$Z6oR7&c?gCN} zgDYr`Ud3$D?x`M6FWMuzHpV@QoE|-R!Ht`nX4B z!C<5%>V^NGt0SjCm@C7h-Xukc=w`?CL^!NaHz}MK>(I*Q-_`@7!3YI255rOoMan3m z0=rSrKV4wXJsx^PR8TZI_lelU66d`+cH-^H2J>aUc|I^^KV3r?-F-QHzK=h6$rK!~ zJq#oxdZY0sbi4;?QP=Mc-SvGCq5KrM4V)?d*^AwpsI;L^v|-Nr*=8lI*JuW_eP}CX~T%udO+^ zfDCjsFi(}GSX?d5SwugE_gq{P zP02_4)R{tdKB1%Y>n%?!+@H-p`W%gImr$M$QE~HVq5C%4$ZVKWL|LHGW z20!?pW(wr$(CZQJH*uC{I4wr#Gqxtgc<{&3ED zBA$r%&y3132eM|&sH%~b_mypYs@TZHzAPAK7R+&BSa318Gs&Pk#Mz)U0fipQ=-maW zrjw+a`6ZbVYq2hw5lDn;qeXZL_{*x&j)D#Tp+!s8bV#Db&Kb|s+q&@-d`4JQ?~ia$ zGvTqkiwq%frZ`F&0Wh^(uDTUdw?Rt~nIkU0^0dtkT-%GRguSAtxYX)o9Y;GppG?%L z?O@*-Z|GZpgX0prlkMyL1-d+%3d4b)(4%93od=S4C)}LYDe(e0cd+3)Z?;d^pzz16 zy=5n8tFiD^Gmg(C&*i{gh;wTY-#)=TQcPU~xN)Cg8ovj0{X_m@xBe@;{@iwSn=NF? zsF%q%a4*OU$i*_H%%+J870WY7>2v>OAN_csMF`&0O=k}tM`Q03SsCkeNC`%7e2@-@ zOtgb^X{7|5hX~3aCtn;-71DZWt+btfTOmO?taew#@~o^ zOu@9y;;-TGYw=A9{wps2JncxVDSPV5^X66}OK33uQrWI(eC9WiTo0AbBSYk8dkD*- zeSUD#;O*T*5LW}}Jt()=Fs9;Pb`>?Z(ORp^ZM{q7ddycnj-Q3^k_VS*wu!lo_H=LW z{!yOeIMydQGckS=vq|0dfb9#W5XIp*R#T7CNZ1DWe-itg5TLvM+A_{p>qYvrYEh!{ zz*ctB{UomkkZ%{=A>O|?;3{|1xnJAqp1pcm#n#)k-mD(U)%xL;!$bLf{G~F}ZkmtT z0w-gZ!NRdMucwsD@^eZ!nk-|4oefr2HZ;zdSEFX6UX>bspPoFto(pvY;hF? zrd{aNXAXkKgf&6z1P9lTu-!uw6Yswj3^fX$3aakpoZIft1YeSsg(+a_E=G`FZXmiE z5q7M}t7_S|^pBIc|7fIKs~qI?j0WI#B9TWRtPdWh;~{Xz9J`S?LYIpu&wQj#O^yuzrl;%fym`E{q8ubX*k~}#L!7kT(9{^ z{ssirx5t>1^{w6Y_EwyS_2b=YVyNj^j?T@VSDbq}d+DtVGf7&XYxub_xW?!O99n>$j!AP z14XWsH9SE1a9H^Lv8{=Z@9XaAJl{a#Hy2+95XkhBF@lA8r+)iGvi5RZtHSjv z&vweKmWNKq(+~X6VLBZujKGm>SAK{PdceLl_a2xmyrr{i9B_Q#Q-@5O-oc*duM~s` zK8RMM08GH`%J8M*{9|n6hq%FSgH`1QQ<%h3wz*F14M zzIoeLAaW!ch27gY+0NajHV7lK9zrUzZMYFGe1D&xSA_bl<5;Te@i)Cb4j+sDWEa+> z)2q??Jzj^8DK2dWj&spWw3-$(eI7+P_^FZm>f#B?dN0j-bCk1DCSpJ3g3mQM;Q zBB6TBYB1MY0Ekydk%HjTWf|{9SLmSkZVce2hrW@PB}|Kr!a47WxB#&eLUb({+iY=j z*WoJItAth_J9?G~9Ur9dQv-nt@%p&hA0oF()ai;d)Gs@j zO$W-1_1om&zg3xLT2_*WpEGF{bnX}pW-tvoAaYPthX4Y&eE2px4qZ&G{jAlu+T zzLNQo1!C%|H;i&@(Rqm7u2H#g5TyYrr-)`b6^t z5MA`^Xa``yl3~<0fn@TPfCz{G@{1RThTY`x*pCqbr$ocI>79@yKbGiKW8KFkl;Y$j z@jAIDRre_GGXk-=V@pd=V@VixH~zbO4!Y291D1|MiFOev+}#(m@Q|U%1(%Lxx(mwO z@x+x(^T&Rs8XtCr$L`a@;g93RE{xmQj~$yf{PQ{UZ);D0O80hRV^_O1ul=DgdF7S| zS>6lVQRYomraa}eB|OmpgzZK7?FRY&K)PscTspthqZl(V8E^@FN{VAOXBy9BHminm zLlm%AP1$0r+cA{uIWKDGl-tXk`2Qx45){H5;slomIO zC^l?oMsZR`5ck!A+em|eHB~K*i27V`qt$zl{#=}XE9^8v)Abis#h+$qYip_*6GThG zG=B_l_VzoZ>H(Cgceb?zeNt4ch`;i=9Dv?xRKPU}3+An?s zpC}Nt8|lEoSivU_fDP(&v1eO~AajR=y>8k0%(azX0%Y~!CoKI&`W(CL)Q?)D*tmti zuE@gEk)!s3n|{vz4`ySkPAnq&Va0ktGb!Iz8q^Ch4~kW+qF|SrE9c<0Vk_snbGPGH zf8a&$rg6m71N&4yFvdzCir_i5q()*U*-tED!L0Gbtywr8 zIJE4+xQ{Gi!^CC|ep=1{Z9TQ9rnI$GO482EuX2v^%8w6~mxiG@RFFzV^Zq?0GYvK2 z6x45xT!4Z$a;!k)-cV-2`fi34n}vp{1S&I9vRJ5Gf~xOS@0Myf=9M3-iS6 z>#-%Iq{xH+HO-aL&ora(mr@ zvRmxQLxd>`lOslf!~)AGve9$tj4YBy2TZnMa?pf(Z|mH)aoL0!iX07CeQyt;$XwSFQdkY?c^Xl41SGu9k}W422L5mVZJ22KiSKbwsDiCDBl_xPbM}C5$UTyf73AB z7I}*uBZ^r{o-)S7Ura1#%4#_FpBGheNxC%r$J+RCXgHr`!Z67DR{-k+~s5mR&XwtIiLG(bRO0L0uv=L_q&XA5=|14wzPpyarGFld*<}?8a19J zIK`nIyD4`Itnh(oc10$nk<4j(Nf!1e87x8+`n&NHkM7<>?$Rt(6S0}#;up?02 zxCeQ+;dn&5%Rs>}tdOY&kdyA1EfF%J^P-M)U6sERp)tSOw@v@$HQZRgUgOA*Ltl?? zJ|isApN@sjl1_xkh?3D4kB-&;5+;OP*q=ep!ibgSDTMsK@S^KYRe}P1Z6nhXP{ca1xj3v&%AdEnV`6 z5W>tc%Gd4*{J!1aAN{eTRubfz`ek_jT4vRxp+((7N!V=1)P>tN&S1N365LP3$hyY9 z0y)xLQKF~nkeRNBx?;{N_Z7~&vu$Te#Q11WlzIVh!G z!777?1CaG<4GizP+Io7lXzadTa?_tS#9`D!swQJ$bK!nCC(Ms}0)#f;n@x6QRLnCGmdd`cww9k4oP^ir-nDVtxhx80zyRbhp5@CV3n9I!g7+qv{6^yn4# zaeow$5)ZQaq~S6ZfZw{qSkcwUBTGBAp&s3UfMF#8&H-Kl+m)j-{(GEfcK<^j2!eyC zF)K~o&9Se1eS}e);u%g13AsG;l0#>GqUJ0*tnksI!bO zyCI;o@70x1MDj)|NlwH)TyQgY7MVm}U?8nN0rExDAHbQLpB$&J-<@f0rz)qn&Ya}t z<}_DNoeU5CJ$|%m{(5>mx6{q)`Q6x%Xxm;PN6)@WoAXxlE2-e?Uizf6b~gLF#}D-t z@Jo6zgfkG?G=aV?DQs%CO&R@1i}Jx<`XfxKtX!>?>otTk_Cw%OUtF!dz3wxV1B2ho zPco^;FPd3Kx_*CVax#PE*+`#9jDFg0{TX?n=h@4p{_XL3PRnzzU#lN0D0CG5BAJ)) zOe$-B^icC)bo?O}9ju;SW>9w;+JMQu zxB7S^db^!Gt|$Or5kb^%3YNqNFM{O5>G5~mezK(mw#+|e>xcjH);$mWoqR1U889yq zOm`>J*(aqNg`W=${!yef4@kD-htIZ+jNsbq=nbXM<|d#P!hyeV+4u6hXDv=PSIs5+ z`hQ(plXHBQR++_VtB~{SdWEl3?=$d?)lxhn(;o93ZbACMiBa8(W^g^(oL+{u=nizZ zJr)qhuHos%KrU5=C%Q7Ru|iUI36Hm9q~pL%N$SJ7djv(@D_9ZLCDeO^1vPcinP)DS z5Y85jd_y_NYSBBhyQpxM+1MW$DF@7y1~)jFy=L0+WG-);e`ul+{8oJ@=JDjBwQ3sT zkb3X`+>4zAOeiV>gEQ?1mSt>uTZgFpW(>tVxZzha6b`v#gg}m00JDbY84FLIHXwse zbF58D9xw)!;hbWZX&G(f@&#**MUTt66I^9O_DfAW#ok?EsAElV?CP-SUfKpwKZn|W zKOBJ%x5-BEn~*sK&NTG3rAQ87jbLe_oB^O&q;XcSLvhq2N=pTa0o7?6d|zo&3w;N( zGX`|8EG)Q-S~C~&hd#R|Hac&3+9{(fh>sTBRpf#4HvIokYY^Z zOkOrtVj3ExFLO%*ud}|Ej`9No9+F`JJ$xXT_CZS@@h;Ru+DU6~eP9YVMRp$rkzjcf zpu^%RN-2_W-eesKH7nSn`4wHw=eh20uIP21gQTV>6yG#aNwpF;0}CQra*a$4ti!W_ntr4k+%2Fv3=(v1ygp`a=`8shNYCD<;LXR zp%jO5=(5&G<7ke1Bz&Wza{luIk2Vm3k-578WG3mRB%AHS@U(e9x#{K>m%MN`2x00Z zGP3B-TsNRQf`}M;PDU;+EHuo6p6HrUIUT)tm3FFu$P<$GR_ag_ObNdYT|E!)x}ENDaj`s#1m}Ld_f@Eqk0zG3 z%m%E~!v3k+_w$cllwkrJ89E|X7Rz1+`j~*s64OF zY#_1kG|VvKIwb6|WIZn~?%6eeU_ph4V4HEcp8;BrM5Nc_2o=z&J~4ZW@#35X==Akk ztfa(SF)WXmlXP^w2{Bi;gAoZg+F;mU z4Aq*(3Vti?hwWV_PSk$h1!oWtv_4D1U<6Ht=+e;t`GB0cLNLr9MiEXnwRqOkirP15 zxGcheBO8^A+8=fZSAqdoMplm6w+2CCWF#O@PMuX$t|AL{!V2Zy9K(uL`K|F9v1)%* zkcCj7krk*_P4+uYNaJZeGIwlG#v~dXjR~63!&Y443>nSWL>*hy^3>Tef-Q;`8B9?> z>k{!XLT=8JeB*>)a6fm6j$ zNFHLTbAX&WJvM~p%URYP11y3$tu1`6wl4%pnNUl2%qI@WKX%5~k%#9i%?tt=1oCB$ zD~~e7Bls(K!RrV1FCxaWj5N%g`_7U}=z00_G+ zRKU##MeUQ5u6GVoL@7SNxFf`2E!#2!bU#7F&zNWk=xG|lk2PYgwH^*JbqEQgY3ARPpn-|LN3 zB~ll_scxuLe0Z3|P;f6I*^F)&AJ=cG5?%7SW_AIEs&X(?SQy zNsQAf{Zo^C;XdCAeBd;078>Twh6qgmEddkRE{E8mnXjkBLLtr(2t+f6WLtUih}9S~s_p=<*g&*B5`pFeLR9_Lu(62P=uCm* zX>JuYP%e8;+;+_4N8wsrD)<*WSr5X4TSXhV=JiSs@j$r+th#tJ-AU`M3({8TmcO$#0O~P9d3PkhzIU88t$~+{-d@24?P(7 zf9#A9hF<6@6ula|w;)5%H`QsgNV$}OH?_1KbSPcRQ)|;>388lC&P)GoZBS4P(`G@)}aLm*ktdUJhX@wlL zv#u)l^FxnXA~GajOy_M?+W}jTRULGmp>jV5U1LS@`KtH(sBq19j+J^HZFkcx$E|*Y z!qW3XfM5z>dMjIGqNrZ~EV*vF4Zi-0*!e<;2)Eb=BS7QnvX=9^=26eJWSmK1|w0Tos`tsB%rR2{HCVz^F&5OYY)>6V@kVY`96Xc0aaK~ zb=*JNvh^T8WG|&Mpw%87+#4H%4%z{THhbPRa?L-so`vVTo^N$?vcQlPL3nUz)UP5h zK2(Yr?-HM1nRd1!FJqzEJ~-%m=1_-~h&^xLVd{*~NaSQ#-#fLpJ!<|ASaxSr+4d+K zA^M7N)Owod5@0H0SI<>m8~zTwi6PA{AD8Wr35-+J@Ma$z2utKRbt}K2ODe$7MWLBh zWPDW3C-y^Y|GaUJKTjt59ri$ah#agql@ww21T2ob2*o|~qola$-fsAIQPW#FDex(G zih7i$vWmh}3*31rHoHpJpx{x48E42Zbkww%So4eXKk}uwXygpFsm|*pagvr*+eC}D z@{^&Eke~)yLvs~6Y4=u3UY(F)6>WR1vzBn1)=>T2m7r!6E{oQ*E+-4z8s}1~wep4A zABrh6`rMS!b@!{tE(O_UgsvEB=1ExZu0QbhI1~i7q^~4zKH}mfmHqkz@?qVX`UZps zJ-R0vNQW3l3C`gQF@N>iQOcL^@Dw(Cg0E&ZSV>();z*z7jSeZ1%nOu1jpc|FhWUo= z(}tug9)PFcxsI-HnK;NAKeoXT--tgG0J|}{z;M_d1!Nb1nfcgrs%DmqlLWH4|7nXy zQ8{xJluC^GrBln>O^j51cFGl0x)yh8iGw-xLF3Mauy(e`z~U662412PY2bK++MTB| z-fyxlnSvt|m#s1$y$@F`1y@3L#a%};p(#3HOv^62FQdl!Q>K;})hbh5-SH%G@kDHC zXWBZwu<}9j-O>T*fza7gxkdqBG)$E5AbvTkS^Q;X4YB9piAeZ zXlpx8_0bDPb)L?}ZsT>2mk&QBiT&^`728JxKp^*^M-pAn3_C`UYiK|sRJ9cD!s&Kg zANhb?op8xcop?DQt}81yEY3!|jXT`@cjA)8{f-}RO|;Jbyv?ZVsQC&LzG3T*@d9>| zmB&~-fBa338R3xW2q3mnFty7dmMUIUhI_sT9@UB<1!m`DqCy$i5?zN4$-Qi0#<>Cu z9M2DdutvQ#4juGbiOLeKf_I_e3w=a(h_TvncwNBjrzxaxaoNGNZzAx44|Hrb3=J?|4WQ;ay3K{1wH z091DBQglhl!DG+U#C)a^o@QEE?Q?61v<%jxwzRP{PB-7JqG-?S=;_Jp@374SrVf*M~~a8j*<8!V}*?> z?Q(35TeP%g3#|%2%9bCv^k%8@l__nnC{SEQiMulDmaVW~%_x(W2o=2M*c|0zEz<&C z|KjC|17EU+>!N;~7fPA(ETr2GKKhYDk9Vwu>?}mI6h$)UUfraU*UN*`D72y*qt{ME z26J0tmEJAbEt^KkuMX=RU{@xeORYL6PCwW^=l9cTcsbn5p3anD;3FV2K8TumeV2l` zrm~+l(D()+GfAvtaJ$F`U`Q9}?e-7|T>d=T0T_WN8UG~PGj0+7*j7wHLwrWBq!8$v zP0p&*N?&oFJ%#TTmxxoqahbXBMQef**gdJ=M)?4m=*W0eQ-?AWe4H_Z2;oV=&3g&= z`^zzQ*aFEZ&VhG$`5BoVoz+!lCnmXQ6Z?-W*X7VzILp;+%Ix+OKXtKs1YI{#qABxB zFnB?(pSc@4gdd2T9U`k8aKQzy>S>_L2&XidIV_-PZtM*mZ$s!NgOg+H`;QqX2yC`$ z%{Z};SRa3l%`xKQAuTOq+WrQ2Ja=QJh|KUI2yre@F4%17f|D7D5VachyV-nH4Chqh z56Y5y$|^y24S6%eKtb`XgurfACy^;*1(YT7<+Q%3sr`(CCoG}DA>(4vAUI&anXw@alh z$sGBHd|>Mn*f5DyH|w|na%dWqI-G2~QB*aEJR zXHL|Z-c!zsPjBwho`Fa{b3o`xgCJS@C0iK*s|zDC-tBh`)D@sdly244&4rQsqqPdl zw3eEgY>uXLuW_PEzg@MwIQ{5^{CS*`F><#d1k&<19jbg84WN69TFULYwX^KC>NtX@ zM&IbK2s~xUZd_V7q8!QCeJ&|xGgoRc0 zap@GQv&%2p$dr}P+>36&iXt?^P4`WhVk=UGpU zz;}oAqL063>?nw|llymW`+`}zurTHoi$Oz7BL!d9g%#$snsih8*Th1}Ku%0rAwz` zLrj-IHJ|(`#j;PKhnM$1z5H~sbS_S)1#nZO>M6=^niH3|huQs@(fWY7O-RH z{Lkb9ou7am8`2jZ!M9+aFUNbGqDVJ11yq})9eub>l5~SNMTcnKm=jHw@d=4%>!!Z{ z1B|5R50su`K@ZBtSP_L2Cvngm56+W^>cS||todmWezdSduF;aO#gDf~m*>;X=lzP3 zzefr`%2NwH`tRNJeUI1z|Gi7rZ~iZfPZuwv&zIZ2dfX56(S$l2Y6+lC=jt_dw*xIx zKabm+Ud@NW;9NU+__%L68bX`VRy*==@Ubh60jV;8)z$)%rtGy2-y)wId!UQ_f`V#r zKcsvwAAgVAi#@m3OxO3>!C+>pd;M^5-3WxWuMP;E#)?`UxKBYsUX5y zzBR%=_-OP8KDWJ#gk%ZTyMoi{dY~hReu7nPb+3!Q_2v42N;w9eC$K#Rtj-6-b5&R2 zdJT-+59!@5Zhm)ygUu|5IOvv?R;Q@bNqy1Fos6+F_e8 z`K*3mS~^oM{3wS2RPk38iB$MQK~+tCMV2ZfzTd~Ii#`&&dw~=5cwr4kS(PtfqNd9> zO6AEgnC;i=Fq#b+Qvm$bn#WOU$24<8WQ<-6GDI!eb44A<6qSndsxjr9oXJI4(pL{{ ze_5d;Wrnlvd0gns_W%&mjxP1+y(H$*ciem{;Cah4>6h$1HKne`daBX8lOeFFH6BhvT?e81BRx4U?77&tlk9vhaDg4w3%+;0} z?LAQ8Mm+v}tRo$sAriCYu39A*T$_z`RJ@zmPdLsBp+RqVGp$xg^4Lx!BQyBET|lxo z9oj;x)}yE?F8VZCxEb;Zmw;v%&YzE5(NYD`2dW{QS=(&;ABxFqP(C$GjiU`!*Z24o zi7&KmcMr$FoaVt)WzV_){7e^O*KP8uTK=4oFa*O5vFl((&&brCo0D9L%ZIUk3Oh_IuL zwO^MI2+L#I_iO*;o^kYCP7SOjt!m0B)t$P9+JX$sUM!j}ww`1|KP#pmNi!lVAEvx+ z0$({J=b>ZI9d+GWE|*3l|ATuJ=-FFw-(B~YXMg4+;7TTQKEsD{x1#H&*{-V|vy+|y zOSfOOCkB|?eJR~FUH?Z8=)*ecPEeNexwOzG-(frsb%z8||DI6IQ|-BdKl>xLaBp z2-mO#wjnAeB2il>CSGVTbCIq;S7``x%w!|?o2##<;|j0_fv{C_wRh7o=MkJ&$y=K~ zhN9apbPoQepaBk=!o%?}=-lZ#B;d97)aT>{Hx^nq#m)=P*xfeD4R{EYv9d2L-SHX1 z5cS-SEBopC8Cf54rjyQzO_^YCs!5gfqZFYpu*{kTgHf&EhV9=QM)ThXz$L8SgZDSV zGs{03?uN81zE`FvS+k}l-V+SAre3Wr1eYa(RFnHdf}xy1hN<~gSO&0d?xeHM?X6vR-IIF4V9k5&$B z&X~#1=t>BXueGq{X+qfXvVsIN@rn}>eaZ?hx3QoVS8}N~5AoHa>r5fF2AO$om1G|6oa%LG0_Zi#5dv#{Si9LykHEK)# zPT|;x9ihNRM2fCmK~*i7H2#4KrlQ9jm3e1x!KM_m+WkB=Z)andPw+hWlgB;2FJnru zs&wbVWIC){wmJth8%A%Fp<$XqkxwHF&PuB>Eh2?gDQ3Fxp1b;YZDc9I-tdEnm1AVj zya@)OD-pS*ln)Z30A!OnWF4#gv0<)FG9me6#wb+Ydkw|;ih(6Eh1sDO&sRe+-?;kH z6^#m)DYh(?owZ%Jjw|qOoyo<^j8Bq@#+HE4-GS7ZBI2MNzU7ss#QT(5t1DxiDi&g7 zFs*%~BFxY*xB|JEp*=~=Hv|BFk}n9fw@Eb+yM@gewo&ynS|$F9mA&JeVf9XoTUzsmHWne)$~jl5 z>$~F}>F-JQ^aCY8WG!O+Tr+_n*i29#e*JqeOpla$6DtqG{-7F*^zj(m7vW|q3%l(2 zJ+S05_uy1c!3`lh7g%3O(B(Fr_=9Das&*1QF?kEJfJc7oz(5NwM~mm=KhOBN_qmb8{&EQqOuwyLO(qBq~U^ z>5Z>Ebgl(bBav&-xS+U>FuzDJ{(BpDY=sZX`MeR;TitL~kwK|6k!wQ@Kt1u2w=P(%DVc_E8D0-hZ#kl>*Tt9DVX$Ll$sv@B z+3kl+mP?^Rsa@Av@ZCF`!XN#imL26{dTSGpepa^IEbSXz5V;$aA+8~7lU<{q7QOI0 z%=9-T@7E-5Y-lCo-Uz)(<&0kVncHYwTb|lC{PZdtT}1uix6DH=JwNR7-pOYeUK0TX z4k?)C+j0<%R`HO6X@0mM@nRYTImEp)-u@_CDC#v)n%k}y~O=Gu?=Xy#xv$*4MgR9oK^G^543 z$wvBf5f!DL%h)El+4b3hV~nbIqG)~#CMAU$>Y(dwGU;pcWz%>}+tZkzxUcmd1>ryB zA?Jy*EE-mGE1c(fjmaZwg+2&BCTw5u?vWe89s+T=JgntWGF3%+*_GJ03$N7^K;u!7 zdm?LNV95@eg{tC6X?l#e|Av-fVFnsbz0cyjF%{bLNCPx9U<3NXCZ}vFD_lv;DCj3s|x)dbE01)8olF{$7WCu z$y-A-g&VT|B_Ry|Pie5b9iyi~^cz|^exJL{dANsRZ)xJKlR}*Iv*1BIfG}jFZXr6* zK@VQIR?7o2ky^cjEdcwA8ja)e0?0#UwDSmdMn@50e~!$+=G4E7;Wvo)C*BeMJKFK| z^@P0P4&Fx>px##tk#t6Fxk)j5t_`riXSg-6x^-*Ft78+&l|YP+n&UKt1Y&}$N)1de zn$iH(eDDm8eDU0FT)1kk$jSC0z`SRy;I#<#NXF*~MAWM0BIzOM=}lm0_lj9v4$*oq ziS7e?+*a!hUifr?f`;ev%-takz}EI_mDi%SN~ZX&!+!6^HOTnC3~7#R8>f55h_XWD2Z!WAg#Ew#T)aIxEgs?Rs~LWI8Ba`OlhE|h zKu&a}C0;4lMU}~G@^mkOHYb1LIRM&jhP5WFttrI+tM2EwEh+&?6Wae9&z$WfUW2-M z23~zD>h;U9;;8}Thp$FtzrFO#61vT?6N*-hsYx6^wx94G*2Ph+)p*oY4!4240dm}^ zT2|`7UMD>U7QfpTEJ-J&3 zA}Mbf3AI;?({5d>5o~lCvO;F>Y$W&K(L9 z2sJ-^Q^$Hc;1J9f@kj}?bVfz;V9Gnh+Y^oi-Pi|7q=|LcsTi zY^P2#be2tV64Jx;Z%V>&heRSzkaUu95{)wdJ03GNB*Z1dPGT>s>?`8`L<4R!x(ovy zkT~nhaIA*_9EK5cwU6K9Cdkf{8F0((d=6)XL9ecMJSTt=-&m^%7o-d|V4d$si9^&n^sF<&Jd|T3w zE^Z6V>%dHd=q#L!>=gNS|BA-4IG$+cJuGo^PU8lp z4In01PwJd~FE{x7gIvpKzkyP(t&W7ni{X`NL{B~^7aprnh(UrZYALAcZ=dah;10S# z$Tfi82#0V1E!!&S?4$=iHgwp6ty5?fG4wT#PGFwiju4|6 z?>#jl5iLxTvwb$W(P2VdVc$fMYLd-ycdlDjxWGQu(YH3PmtQzkJ5ljwY+i_0oW^}v`%b^m!ASmaCGzYlq15(30 zQeGS|n=eLrpsJ*?UM&I3`(p+fDfuuYW-Le5tl3gO4#`a)RI&o$ghH?fS*Q;&w%PAn z-+On$q*q!=4B{ym(V!n^TUpuegyo-Y0Qmv}F0Ezl3=ZVmhu#T zgkuJ=XvZ!h@$Oz$-uf2mL2Ea+5ShGEhDThyqo}9|RSxcl|{VnW)X z6s=cBm$?(|eamMYQ7n9s_n%w0wbOlj&ER(wVw0nayVb>~h2^I~N z3NBs*nj3#|pAAj^+f}*dzJM?uU!E?LjNa}tu`8X%t@Va1dbZW=o=N|=>P~W}6%)UY zg~Nq-CcW+F5v1pvjno%Lyb;==eg;|AkcfGPq@dEUCYgloXyNK^k`<3v2Sz*@zrz4$ zG^%FR2(b@0S(eEyuuuXCGmYH15%djju64uCpnOuZwxhESAAbDKoakd5jUQHg%^tZw zcD#_loXjV3P?ArwIzEx;3v47EO7`Y~!eB#8Tha8%oRKR+PFgQe>tktjia5P0zpdz{jH7ikb&QXM~lcC+4eP96Dp>;=m$3ywIkHz zw&^_17noZEL0EGcT@%e(EQXEN3c6~<+vq7AswwINCJD7aRt)|ArfqZuLX>7x-3!Ip zJwHLrCIxm8A$!2h^9!NyLZfPsu0oXY9PZKI1Vb5+#U{!_g*dIQ&Y%c>!*bgg`>PQo zmD&f0HaL9MU2I>t$CU_)vb_M#=7UMD48eVsq<)kMo7GNU>Z&C=Jb{X~9kfa=TWA}{ z=3w0kS_^u?BaGK5t7k`4bM{3$?5giw2A9P(5;-u4d4zIYZ?OJ}c8K>MqdJ*>x5&>^*7!8(0x-{iYv9h26 z)1V93X12Ru4{ooVinT`kG}Yr#QkEZZ5^ltnOxCf?RhL)YJ}^T) ziVPW_CpG#3Ye!1JHMoWWyFf}N)1hm1hnuMkBS3nDioxtLVpspvDFkeL4UHCVTP!LY zG|m|!>%xc*Voqj${(_zdTm&_nE#TH-AC?!&b0}~Luu2b@^Kk2}f!W$`={;d>c!6P| zy{Ay{fJ(40y^}zsIO7kBCmG=POB0&D`gogM}pTk?uZV!h>>h7F+}l2wIj@KSof zI}@LUo7Q^e(v)}0tUTvj2m@D(TdF#|g7K8NfR6o+AQVHRMBCsSX>GZzSz!h<+v3C= zjPuh-+3Z0_0{WAE<9-s2Qcr*DEfeU(cAd-^-HNIypEhezYUln{g9c zM`tcLY!bG_-F|QQWb96BA$UV zhPI~kVvH>GLWa(!|8@})78Mc|r4}}{u{3hBq!qHaF_ConF^uU&?S5G8mUia!>Xvqb zcFvan*Zyamh^e!&lcj@;y%PZ=C&SO;O7vouPR=gE7KTm)%uMt$hX3!ex}}MWg);#o zE9*ZXEv0{M8UL3Q|L@p;q4EERhyVYdo&F#5U$6hWqd#PMbLW2+{a=m?+L_y!63{X- z(hE8p{{yFIXJw%O$KQXBX_K5;{~x*Jf1LmStTZVL%YT+8o&G6Jx;cXCw;J;WZ1#pwM=YeVH9u}5R*%Y#$1O+6 z>Knm~hXF*ngi;Rh3-x&Q#m5|-gcOJl`m*9VSXSp{@3KADeznwGRe7edtG?&+`LW8f z;iIFi;YUWPv-{=d_18f=>nn?PLUkqiV)<-%dlannOV31I^l96D<%M2fqZc2)JuaGG z5(#>;d4R>mXI2VmzbHo)byWQOt+JVm@9pdU_4EyH@nMjW%QiZ(xa7izc`Uncx_y~Uo$;ry6SM(p_GhX9P zu~lSBdamS+HV5M!_VzNGbTPAroD23aU1e@OygU($<6dH_=D2XSt+RW54K+*ATi2m# zF0Z2T^|h|gGHsgcE{#|}Plip>dhcoXIW3pQ8|K`N{=&vd08JLJ7CpMBk*GDFa&aHl z`Y2XqP-&<7%atT#vnE+uB)K>@YnX^=oSsJ>JRA>!f5`|nHz^9 zSHFlvxIf`2>=Ew?*F+l}?_H6JJK@&j$jYk9A=%J85@(rl$hc-nLiUhj2okMyN>2c^ zhPpTE;7kFL;|Wr3w{sd(8X6qetj&mYDBh@ceVBOR8O1fcTJ0E@#9&a4kZ zXLiYB!~EYn1Tr}GB07!&EEm{u4Y~#963Mt}#ne&8A~xB_L|333{mmIUgyy1gW9M-y zbrn(+gr8b-z2?vmnt;ywTXT+tvftVu#_LgXCT*2vJ>{bbI4-2ihNmC}@ki0=Nydr10?70P43D2?NN=9N;xlt5#{6^0! zJk09IaA}Tc&Qa?$zuQ_V8D>%T%dmyG!kHYLr{UE|Woym(_gcODWLu7zGgF{^R=z{4 znM9J0u6`#t5tUCdBiL`7!LwAdvmBFzsX+>3^uejQBO|VP3KP;vJKV8B#DZ=&^m^J^u>(f* zQ%YX_)TE!aSd#t~ijPkhk@$egcZUAB0Io8)+=vKeuR zu1-2b+3C`2fw}}oS;)M<@H11wsEy&~SYn*{jX+N18k5}m8vkn1Dz-2ATc``2-sbnA|j>9}(kcV3Y#jzd#X2}m{G0vD{&RGcge;E4)AW@oR z>pQk>+xFbCZQHhO+qP|c?%1|HbH~R0=i9e$|J{e!7adViU5(S3m7Nt`T_>}{PmA@` zT@cDfT|*t-n9-gEA*n;<@;Jh{9siZ)=YA~-ag&wO`c{Qt3LR9}9x#JMUAVkip71Yv zniQJ^6-0B19iokW!kD7seIeZv+9T7V$xXgaVT4`(969x-uTjD$)5V%!%J``@HfS?sQ{r9-c*okV+8P%>WPdF>yC)Rf}7>J*V&$`p)}SFC;0 zcgI0=4)GRiaosUR-J}Z^_FHm2`S{-Ldyt9Lv>IB6`3Kp6hMthEr?S-AMlPWYy^6F_ zD6UH8)KOX^aA5K!#a;Ix;~#C2rlw^$pf%aG=D*#x^<0xUppViUN`BVspA?QXrJB~yqkwGqmP>8DunJ#v@XhOuuGa zRER++CYW~iWAk8H8#1s6luT1a&S669H6Lxjr{0>yd+V~UtXu`%YAv7BQ0gEtDpYCS z;YDj1LSjBbq$klTUXsovTpqOHhTn>4XsDC+dm;kAY@q9%zjDd{h~Y6I*--FG!gJ{M z9pg9u3fD#7c%*StI6Uf_Jc4g+pn$g)h?7IPLxFJYD4VS1CTKQoPond{Hs@*^77QHc z+uRk!W^-yx*pd?B4Q2{)IIvh$HM-}xz<>S`CG8joDpMz$IgZ=_a`9QiR{6fUmi&m2 zA|&Ioz$p%1#lm%Pybh6>gklm?y79#}5iN9)_yXnRCC@0{>eE_=^T`7E@TWy}Ais63`d}Y{7@cDlvaj;Mgs?&})p;^c84m z63c}ICq{P>DMiI*pm;TNV&dEP5R=6M;vDZISN@~SiC(_L-jC2hh&w>EQbhlUeA&WO z6S-bq4p^hBq_DV#Ui8Xa72ObX%OEBu8eFiF_ z07@jnejzBJq9|R!zVP$v+c=z5>#<&FRvGfK)l1s=Jx{zaO9fgZlk1FW%_S`?Gg^~F3W?&M6Bx)BV5u$k3pMn2@nSQIZ;V3Zw#;7?dZAqe_@ zo+2EBQfM~GPxiioGJq|T8K=gkZzr==oO7!KpoF*<4KT!hmO}LQ>xu!be(2e15+s~v zHVK-JOfYv9&jcFMBM`6#Aaai}rz_M1xuuY~<+>IlJ0!>nvvUk-@+tQLAy}&ag>wA- z-d*1MyoKx>P$H}q@+i)}*4i`DN`-PnhtX!Fa=&y`H=y)OO9K(HP6K zUDzvcIpXc%z@XA)7E}G6{gUVl-q5fu`3g)wHJ4*(HOn7V5LSGM}3z#H<{=?CB*B#o%++cEM8c1j$${KszZJ=KBnrFfK`>-TKx+ zcdM@-i)O(eX9;Y#R*!ah%N(8<4q5vb%(f>liu*`-NH@;GxIqI!E(@860cpxYrc0(!O3KvxQd}-4r%;=*KJ>YqPYUVmL*m;_GZ* z;Z`9waRex?oyxO6z)xG|EX1?CBRJPci#uAy)@;`O4lNvaPzP?_MBjQO)zV8bJ)zPp z)iKN>fp9Q!$n~-tY_0af5rtLz(xLOECdL!LK9(XC@h6|}{7~3jO88&cTepR4fbC|8 z(VmSHTLl^e*?u+NO8~|Wz_xEx;nyf5^8w(_He%u4=2+Sv{j`)jB)%Mt@RGu~~T zio?CFEjGo%pGmw!U3FriH075;6e{@`7{-l)0T|G8Q2-HG0t<4mZ(%8}I0DW!24x~X z8l4l4tuGQ&5RLkmIa>x|j-32D5FW@=7DG-%V4Kt=IYumr0tC-?6|Ifx?LKc6-fGQH z-v;3H?Ez{XrF0E+eEUF~@fZ3OEN(L0;@Pjsl9D9%!j3wSQ1{=7kXq77>@;6-po_go zWUTUe?D?VX)v|!;u}h0DR`2>Fphn!4n}e++QYUTWDO)zdIc8?by7IEwS-mYx{7L z3O(C^sopz7D>2Z^Azzzy0B36LNm*!$0A-Nrn#NmWP*_{TrD2SJ~^GFzbYNU}m zM*;7Ooy~O-7A?P>ZJy3w&i3)`+u7#pd^=m`L_sI$QW3T`XwS~*v`VP0!=XZa*n}&=IV$G3sVpQ!xd+s5p1-+BE>8I@z+jyH;~HZ8rRfiUzo-j}U@~1P)PBLyR7Q zpQqVSk|hvGTMOt_G!fLWJ!df|UDDN3Y$teG=q`6=)7G!Ax~fTSRZq$#?3@RV;(r^M zkAe(Ao-(P+PDxm0h2BwEXp^q*^q>K9%uV^1XuqxH6^v-&X0H@swOfV#W**c)_YLNxWV^^DetHpe*=<1KuZ@x%_FOsilCN#ybKkV8I=9^3IbxVd;WU zf1Zc3R-vu4^Ca}9S9^mKkBFQ0)&QC@kl6fT-FY(C1L#zxQtQYi%xd4jF)@7LJl&-^ z8xo@2N$^x#aGmY&EiV1xU)psy&Y`U{0ApGxy}_qh`xIvYIqR zfx8Ms`bn@SI(B-nj_|Z)kBt0YJ;7cqFyYOpjAbCD4A5-Nzs;FUQ>qhx;;wAu+{saDgN6z|ACJq*BHNW}#YFmt4GvWy z0fQ`ih_GF`{YqR_=o60@*YfaxoLHiVTmb*;~Djh=UJ7c@;xYudYrYi(-A zb_V$ekUl2vrQ(841sqAlb0BrZ=G*pmXYj;%u)8u~!4B90!21)Eq)r9_re(tLL9Fl< z6Hr3PIMQqMx37c}g`qSPg-;PeB5FoI2c=ARvZ6av$GXv^buK&7S!SK zFcLIes~RWTaI(@KT-2;jB;7qIR-1o8)v3Xde?~O)Q@E#?XI#?iJs=_3LHV+B( zbDkldPm^S^KA^?8(f@WPXe_J7zf1qU4kRjs#4#;CxPI2VF%Xrn!Um}qf(HEshD{{V zrY>dgj)m2#o2_Ug3Sv#4c@=WU?);~|^a2iG%au&K6TPHUV~bRu3Cgl4>@p;0c^(En zWz#QKPc}b8pK}%A+Qat=f0XmrBei)C;8rTM-3?60=#ndkgE?2b0_wKVKKsGjb22(x zYmliBFW^Ujk@nmnGy=xps_Hi>yzCz{H(jTLo>+LYR5{uAUh6l67lVrEV0ai1d-S=5 zS&qdcoz{Y8LG1h>`vb^ECy-fDB6>cS@|7Db4IjexXo zr!k7@d+N0qw;Yv>WuVb|>2L^LLi<-C$do}x_GCjdsuJinN_aXacn_wI0YimOV%#J7nv-l| z{g2tfn(ud&?|?Y5U%jv^*bd}KpmzvO%eU?nB-hQqfoI6lLrxa#xp!6(W4}~`?IZZx zPak0G@VWJx^PW{*wViUp(n#stzBZfI5}%x`U+N8HC6dg6X=}FjD&O$su<&p{_Ah^hpq;8wiEchR8k3Gm2>cs&H&HcSw$%e+dRUF@T}q)dT#gI(e?KEkUNZzZh1(b!SyU(>s-OsZ_Hruy_ zwMy5UG2h&7Oh90iQEPZJ6E5BMbg|xw?y=wp+dC`80b>UJf!bWK&>#v_u`RH0wihq% za6p{yO)thp|IY4L_CGyRcx3CoX<QE89CExh$vv7nw=Yv_W*F@iVufoDO&XMO&0vXRSQDEV`VT>dJqg4cY z^$!9sQh#<$PcQ3irLq{^xiv_tbFf$`;@EY+y(C#|~TxAEUZ^uPvgxy5;5@&r3ZG4xdlCHvpXY)H0TCf zrGtBofW8Mo^ZE2+9@YX&{Bq98AMEunHCE4i^3#33d4A+kyJwssV^EWu?Rl-pshj=d z*N|AF#}`p}hiJQB>L*EG;wD6*RPsoCdk=Y{=u@9TZ$0t>e7&os>>Z3G9a#(^gb1}k zDOG))}CIkjrwd2#!(?Xxk9s-M?z}J$& zrVj)=0e>M#qXN@PcMX}f&@}mql?HWGUQRt>)a;FLn3f}n2umOA4 z?E;7aY$jKTdsZBeo9NJz5M!vqwuhPoR+QOK9E{luP#AwugpIvf8RPs%G4?M3DtN;= zX=3Uy&$B0lJqds$)5A{^e)QLC^7jOSd#vYYicvj;3y?Yt1(mnQ>R3UMyh_M=z*`3= z=LT|OnNG4u-vr+j>nH?*$HF4tgDOQ6sZ@df#+e#jL;l0Sg?t6Mr)@KSCF^9I)OlSw zIXDUtl-H=5bY=1J9{yatV*{HVw^(Qwo?lvEV0=^+^O#^~P@Qw!`D&gYz%DQXOB&Bs(G0v*(CEnDq*ei8 zN88kK{tY4oaLYDKQ|L)SNh&_?h)Sjgb1nF$;HaYI?H`SM@yY2kj!h=cw-|V|8dztk z=F9Q}Zl>F6D+!k+>9!aTwe7E%!)Mv65v0b3<471iuQoCMk6az6?(k zZ`ih<<7?rUv`ABk+V-{2K4C4hpIF7037e~u;(_N1mn#FIj#Wo_NA2(3{edE}iS#@c zXA_U1pf|M!A5(Uk1K5kzC8o}QyEgv8&yzDmmeeETMV9JB_k(Uk{ z=8>G9v4VB?%nquGS;)Qew2jNGwLeL4=xk z-^qVxhAF{|c;Caxx&a`Oi0^ngrz6H|(=YB>;jd*0z*%|D^6eM^jAK$;Hjg!M=Vr%R z;3tQ$t>Sjc!hvKsGZKp%xR;Lq>FX==6uLpqo>IV)k58{S&Q)#J`nyDiinhGdQZpui0odM?K(nktrIprAh~H`<*#cUb0t;vRHQSFcI_u#XXSoDwe<*(umNnP82{cRL+oF zX4YW;3D(b0wyiqhZhjw%uzDRR698pMIJ|CFS+UXD@!{z&4+zR3a@!PG zZUD*hvMVq`gm^bdb=?ur#)$MWIm(B8I=8+Hp1Wkp1>48kZt0u>L(_ys_U5?I&Eedn6IIqKn$gL z8H9UU9YU-{;cwOeHqvQLPSLd^!zsm%iU?0E8}~DdWiL`9-koSFblWUotbjr)p_CSJ zF~LO{Ds|S^0AxC8#PkLr*Z01B3Vmy1zt@5P_0rW=2~ewrLj1vgz*y%3|^qI&7BVQ!XLaBm?!|Wa?=n-`oqX z(2c^IFj*Ypq#|9t^6xqvi2dPojL?EQ396fTf*nZ^{O+C5jxMS zC@U}x!Rz>?0pWy8Hpfk(cJUj59VvOpF#<2xJ>+@rld+_F)s$(AmI~qA(cYsC&KPm` z5%)!&xAUp1_>D3d^X*B5NQTdI+H9$97WDIA?XWsp$l$l8?$Z7Y+2tK;fQ6feed`0Xre^rW|$Hf!iVn!_{yD%n7mSKIGgbvr}8h z*QhcTG?Wle`|UOhYC~~I$pN8Qd`sG|v(hf!1H0)r2IK=c2sfoF9`!X~zN$et`wk#W zOE3g8r6(XE6^#vZ@V#))fLb00X4-^>J%AbIDkkK#scM&(9RW_wft!7Tq+vn3o^R%3 z2xrK%Pki>`c8+#Rm7{8|EvHE=f$!S%cMo8ln^9i@I1K+xj`5h5Du$3KvhfD84Tz8I zWrwLb@$!NqG)AtLn-~p1iEZl?=lV2`RY+TL8B;->mCi0#60`UL5C@BX% zXLx3_HLFO)if3Ios1|TCd5M~B$O@O`gGxxJyAg3spdF~q6|L1XF-?f$WldTN@4|71 z!Lao8s|GOLpY#@f-GpByl{Zj`tRRB|J#~iI8%V$$xzrdyuxoVSnn;4t8=```3^8$SZrAm?#3-pQYZwkVapj;f;U5Qr$!%%bQ8ubb@!%qo1tO%OGkg zlXl*tofRNp+8ZMi%kLr?0Si1#u?@UMWo|L;xL6XLu*T-H2E!DM5Vn@LI@wTR z$4^veM5Vc#b?|d_Qkv283VC07D7Sl?FB5;A7H+jjOh7ITdNig*rynB;U^9lhB2g70 z*dV2&G|`?fZz4L-WUdoQR4P)+z={_N)%O<A@MsGIeA+)K5`YUS6+Us;F!)FUzHyH(mVsq*G`jwK7*hnvG$e=%CZF%t6fiwB8OXUBa@Q z7Rpx1U}Jr*o_*F%N-$N1yK_ba4ZnGN7$`5*1vRU=Vp?ZSjPh8GHoZwvZ>`5qm(@C$ zu}`D(8=a}k_=&Medj7pL+%C!d!l7E)4eZc4P$iVy#ACOgZc@SG$0%e0vA01JtRHSs zv}lnW=$zyO_xh_FBCf+%*=xGFPu|JS_;HH=Z1k+Tv9z#gEow_$RIlPY+9ba^7eWgS z&hGL;OZ{}Eb#9l<6VN(iPfBNI{;tjlP$ow=oPtd6^+Xai%6aT~45_7Y#hGNIb0+Tx z+##n0yj@9tHFk_}m>7tMui)WKWh=*Pat&;-B>xzYscd;^j5dPUa*23;LT1Fp`T z{jA;Y#{-{^LL)2!c3!!~Y-c>s(-@!5zVYRHrnD$=@>-|7N7BL_;>%mUC%XjnwPVDaIw-mYqi_TMA`IzAGFOx_~O{CIYkbtN1;ruhG z0IcKCIxdtBmgj7377=U7Mu5KN4LQ3VbQtsCnTKP4W>}l}LgFxwat483gUQ>|=$uzA zjlegJUk2Re_QRcuiPN+W>pt^)s0iz#wh~)9OQ?=ew+UNlt0KBZi7Y2FLStB|{pn@eZq#{JOS_TH z#y@Cji%Yt^QQ}iOZq%*iAvP+bx4G{YzFlfQ?5fGSr_Y&tQgVS?d*CwBtdwmsnNT8k zg{mu{yzOH`$8TMy%d*~FkxAd5?Lu()bc;*><-7F>yfx}g?I3g)2L^nI&TntPP;2|E zwk(q5V0rjvX#a%{<*omoFqAX@9$$?cwx@f!)i58k^!|$7OegR5N|PVyu^R^}st?#d zHk3jcMLo)iWx3syT4mMLg}SIQ9}W*Vx-TZAq^!@4KTibVeG4>p0i#1wT!Opm7KLl^~BwJ*~I(sbV#FP)MTXcv&D%EeR%4wOWxu}lE4I%~wMSP|) z+Y{VD;ThnXF~nUfk7A%()CzP=vY`y8rjQ|ilXs0|)+dP}f# zQdZIB^7DnQiP)G7^&@IMvXg(+Fr0nJ;Ok)&?Y5G1{rKH4&(F7g=>?A zmTXo|zOL2!K9AowwnpAJM#4=RQb!rs)^q+GT#Fy+LPp)KPc5R1YHDo@cE_tNZmrQb zx0R+T(Yil)U9P5D@PT|*}yrT2*fO4#ELu4Tp!lb~<52(2B`J0Uwxn}S+csbO`Ai98|lNbD42rpuDS4h!& zxnVkT!-D~=R8&fsSEvL7B|G{R&p!*rC)!#&rX(2+xwO7+C&FldCdZpkG98|-FZ8@T zK|F{#c&ACos|$MIivIkNjplc$)%Djf%zAb0mwH2C1-`%c6K*LTN>>)afrs<%A&!)qC=37%&?gB1=Bya>#G&oV)E;x^oe>GX3iJ& z7#BhhlN(GCto+(oOwgY1i)LyR=+o?^>DD;ezgTtgV6AbI3OnCjmnUy^rC@D$xjb}K zbV3z8O?g@6-rhA=I2xD1^-DIuV7nzKR})lurLu!%ZIB!5R4agi-WK z38JCFTTK}>Hc{h^VnM+cQZ#)J`zAWxG3oA4WP;k9f1#0Nvo2iG0By1<360=9c{oL$ zYj6!QEcIAx|FBO`4jw8jjT#dG0&ezC=2J}up_H|k8wK2PCvct0b&Jlk0^ql-@3DUd zZ;$ZM3mk&mqOqfL@+dpe7ukpEJ@-Sl|CBi%K@{UucqCJp04Ol+PY5(iyd1e6ptn?5 zihS^r-e{S)#7Q7F?492@OjzLg9h3%ori zLH0T4-tvZ}lWp-mM!MVMv0a3WMu5h#ifBQqvxA|`3j*BqP+OJwEnmzK35`>jk*1qS z2M|5PTovN5m56X!9-S*7W#4l)!=~kM@jud5H;RuCQ%L*5oO5WTp(0a)4BNQWxgLc5 zujI?f7e#YUFT(1d5hRITqK}zit-Ueo54W`X4@fdER(@#qiDC1L5|-nIm?G+WGodvN zaCezu8Q$_6LM#G``qT#COFK)(}3a%)g%leeGesbJR=a zbfFB}UTLt$p1o54t{b9}Lz4HS@GSar;=cto75NC%Rvh+Q11m_4yR*CSE46cL!8(l1 zTW5^{5NLGyZG0CL6o$LNivktOAK~PFJ68oM= zj_lz#7FI8wk4g?)QqkME{h*{l_A4{BR4gygq*F6+f0MIj1CS>#lhuu!Tn%5Ex#t9O z1f|01N4u?^)@xHtB_LkGh>47=nEbjaCTb>NHc7SD8wiy68(Jqb#`sSwFU4dx2TinO z^D9Dp#ej5BAhlzzCckBDT%kC6`|l_dKv}EaK-7pq3`UJ`Rvx`8dZsMHn8)!ueD>wq zq1ZJz&`zlO?z;$mF?!B+MYkjT8m^j?q(p5}2lV2e-GWWBmC5B@nb6Ypjc!O`eo_ME zq4cky81M_@eo}7ahmP=(qI}TYp4*Yi&;+%EkY1+0g$Yc@1%oTQEw)xXj~c)RdOJX$ zIBBBog3t^Bl~x<)IBCEy`bqn#PD~2|Z^ej_L5NpWi41?8(eBa-k^|(Q-`9sTgplM^ z$UR@tiu{7r3Vi@JnHdog4ZeI`HIj}ITF)w(imeamV-^466ao~^$;pFYgiN+=z?ObH zi8lx7xe*`Dc41ozltFAjilMc{wDb7&JxtD#d9x}!j-C?Rlgs4E*R$-ZB~Q7qF=h)D z4ZHyBXv9Rp9;9h{uyTTabUFu5Q)oZa)@#Q~Gg5pX#TGT8nZ&9?s?tqlAtQB;k)KEK z$n-@qrfq^gf*`%F5z?uM#Dvi`w4#N^3AUe$3g#Ss{Q%X~k-;_!V~TI9{PewVYjop59qo z-3~rvPvXJ@Fg+aA%QXi<`Su^TNECqFE+ir3wTWLhlTmEWz`cQU;K< zccA$D)e{j3cp(En@IkVOwg#ngR3n;y{V2h!m-RnT=y)r&Iy6$Hu!ro~WPp?w{_q4K zj8pv4r>(ClQPn8Rc9;uvwUQrd^x+&h(8Tf-K>3&{J$H1NFTSGTT<@YPw<-)l)hMfw zENu<)YfHj-1Ms^3E&%vmzZX-ovjIA7N9Q9Cy7n0&&4~|FG1Y`%+yDZMZ)vf&q9c0m zN~LwHv*u~{p5Mo!f@m%<<#Vxjg@%A+%;&um!ER#y^u@UHp-Zp>RWxO+bmFe0+$s zvhMzdyrQN?c>FhP{4gLLj-}v3f$Li{X15Yocld%uM{)?zw#&$#h!u%sj`CB7BL?W! zY=DB{uWB}>cY;z>gyQ$AP2RN(B92MKCmhG0jX#GWeGD`WekAz{k$}S;j5;tnSm!9h zPE$|ap>!`cFv;l_Z6V6KzjkJja^cLW(0tRM(yd46VC4YA>G>jW&FPYax|x5}g5se% zBg%;cln0Riz?6;f@^f-d2dS^t=!=(jz17Y&v);4B1U< z3K#`S4fWFjYzY!#NbK&V2cwy)Y?9?PU$ssvk826aOV?^nXEkY1C*8kUn8rI&n8nlQ zd7Mj%S*{_nVy_1n!W@)JDNTl<_}LF-v`nrcL=6y+jC^w+@}S?J#y9XeQ|jXL7ofS1$O=p4hIbx*Y8&syj*FlpyhJq5;7r}GrG@?U@;3mxdfGJ}h%%fs5Q zaGBPIW$xLp{=%3Iq07$h&drA_{U{Sd&l(-k;fHP+e27xjIUG#(FdSAH_{i0b_5eOQxn z>x=9v%LW9|QJ=ZJ@D#U92y%48G%Y&Lesd8sIqV!t>W^z4QNZj}u=B06^68!n$MUAj zy=%WqsHG9Z!Po2wzY=@B`mXZcgI49z30VmDsR!y^aD=73Of6d7FFp53Tww{iTu$vb z1kRp<%H%jX;c+wIL_4e{S<88h(zo2~*R$1q+pD3GIE1R+`kS^X6$&3+_uTEBdA?dD z(IG8)gC<{^vl$Ku76fm4a)0PVq)(=9;GLkK!SxNws_}xPNU!M&bAQOa+y*PT1f#$g zsi!IODne8(=3}-c86WYh}GUlnSrDngl zwK$OH;Ik80aZE;gML>CBCZJ z@?(rf2yEJ&{$&l`7N~Yc*pvV80ie)KDpJdd(6t_*aQ?i}w%VFrK%40ekQpw(B zXE}?bWZI5;N?Hj%bgX}k%%-z=6iB8T+-_Y3lo5e*ZU}bA)N%t4)3ZIewuP|}{LaO?YroWNOH1V03 zIcS;iS(%w=nHaz6S{$?-EZ@v5R$3-DZT!E1|Lr_RhJU6!{~JVxzsPp~iukvt|3qY= zWng5%XJY@xz-M9kMr6llr)Q#NW&9UJ#(!ph{ToEazm_KbE8^dp{uA+AIz}dZ7S?aE znEwXJ%J4rz{_}_8zk~d5Ts6jTq3H4d4#~*QPRoeT%+5y3{;k$;A-@sX*qQ&EkpCRR z@82Q*)dl}W$ba;TCO#tvBP}ZjJ_|h~Ez5uC^)E;cW?E*Jf6?nV^X~6Y`OPT&H;_z! z^})YF{;lah^~%UV%f$K(Nl(kh@DC|j8E85F74e@JYy3OJ|3-mi{O+>F+Xr6EIo7mB`MH|Bu=~LoqS@-_^hx>=)(8On8V4(eG zTz)?SE!(%LvN3*J%J&{4EyusShzuUPb+;VVjwyZHPucMQLvA#77q+8aMmUS$)sLl2a zz#WBep1&762H2(($^{EMdL4P=(xZ|*fkexxzbjf!v~xzt3w{I}sz4O!Q5jBE`DdWbWp7E8oGQj# zC(tn7gB(D!rB+E2cO9tSWuvc3(eu9D<1V!5#A`3YEO@!my381BFCd7)z7*nNby%H=In_5rBrEg&xe(sJ2NMahP@YK5m#%j8HU`g7wX% zl!CX6lvu_pMeBYSQJ2w-7;6s(w0VD3g#SD)89}F2I+kfj(NStr z3~Fr+hBI}S`Lf?upm`6M86}Ow%VQK^s#KsCGZLS27Qu-q7b=AaX@{n1O8g~t(FHwm zmeEp8+MtArb){Hw#Cj6@fvV^G)QfU6lzgN^KRudi)O>Szj4S_}RxlwO<6moK4StMn#SY%pM5ihX;W5X1mlt{gD#29@PaavSCnm9d%a<%TF zqW16XPg0RJ&PmmK`k(hpRt$WTs*P*aX|*Pr(cc9FPFn48-p;TWiztksiSaj-REUfu zMPj}HXC$%2TEwKPqr7z3s|9UH`>RC_E71MYyyy4R*qhKDR}P$o$KSZ7wzmyXwJi7gW_NK3@ zcn#e>MqW{`&vj9$VPDs_dVx9zqZu(^sZ>8Db43Q7nRP}7?U`{!<@HUQFv-{)y=|iOadON#&JEC04^}%%Og=dx6*7rI4Yo^Ed z_2@WL*ET0>J8R3z`5{r!REMSK?U30ezUZ~#Ag)xk^M2uKDspN;G?s0qwRbzpsu%Ys zZVcYeXP0|dXA=ic%L@aehZSF-63nftvOIvJ@t?t`rQx-ePF-Cm)-$z(+(ijVJKu`0 zlPSR?4l_P`T+mp|vtN%^Ilf-KOSw9>Y`WSyzin!Cou;d{a=vfs^K|Fo*x~Nb{C=Zz z@_6HPZ}uJ=d4JVNrh73nQ#(ytyMxtwA4`E4!4|vJcjwK5z0U~~YTvBw^aA}d`GQS0SB#tMM(6GY$;&`1>}BAEnYwHoHG!VW zKr6^=w@mH$LG9M-XA7_c*aLE{+@;#zy8jvRO!cCA(^`ZOL`FbN7%sHm+S)Vw$Cv)+ z#3-ZmTms1Y`t|Ba8||{yP(L@IEOpAh##2N@fs$S|OXG zI6iCEh2^xDZC+`b-Uoj#5h?EkivB5a*ElaMF;j2cejC~TlYjl^Civ|4Qt18FQsAGr z>qI;mTA69t8W|U|mA9Q885^0e`y#H_%6V0?+N3+O?yr-cRqoz4_s(X78QJYDtH&`U z?}N+3Zl8+|-??j9*_^Z9KOXxsLZU--th(N9?v0%uHw((oHwQ--kr!7>Xqlm^8;zM; zpTxO7=!nf=-BxdHw-8#iE~!WpPM>(57%3d526EG8HZ!#?8>XFGQ^#w+ubx61p9M)o znqibKZ{-r}b9;OlkPVYQ+B+XVM4KD0Tk)J7-|r@TzsQ)Vj!I{(*?zA7+|lZJdl)=%U{%H?CXBKu;_@vzKEPhoh>lz4%1B-sp8FrvU;(cMrgUm(qp8 zde*Eip&CxBc0p0FeV#^?f}Ui)Q0(&?{c?w(Wvnh@6_ zk{kl9ypkLjWC5EUZ+Xs|vPCZKZX)C{Oig4jk7KlMcwQC65~q%2++}&RBCpW^cu7v9 zdFGT=RG<^@TaHS_$TQVT)xiH*CRSNZIO`eJ$Vr@%8!AD(UEhIw*OcENx>EN>u#HjS zskSe-BPhV4^r9Cc7!7y!DtAY zK1GM0TUUX1wR-MTKXOgU*1-s>1{%}ox^aQ_UMm}#&<=92AiMWlh5gU*)zcPw>7KS) z%g9>4VFoU}CwhS><^>NA`n2dzQO0xq)EpT&%NsEvo;x`zMBBQAX%v^a=XJgF+$U&`21h zGAxOXq^2fL-lQi|)9G1E9HxxaMs1>{3Hl_0B>~oVp&KIsDIyJ52eU)5S)bKSbmH+ zHaO#p$9-dq{e@kcF`5p}Nq8ETM-&hP&RKF@6Q@rwC=e114TXWqXf%HP1g_#x!;OCP zqc2JSbUFYYF+EiJpT-n1Ig8dNFt74@5xC` zHuUkkXyf@lS4(!2$NqU}3(56wmA@T(P?SyLk$)0eLo&`C3$=UyG>^9P9Jo5G%YnT( zs}tx7aue_MMHaug5d}_{=O|G+SLT5b4ahocpKQdAtyp#=<)0Rc3soZnmI2S2)ei=T zEUc%;yzjaQno|R>fd|a-&7OS>sv&dY$-fXMG|fp4o>N1Q4yK3DPw4U$QV$XbPlPAU zXM)U@KaI+r-uX*nMmZ>;W_mfOPbXhFxQ7M4O(1)?As+Z=zRl;*_wT(u*dQ+W-+XP) z&VGF~Ty_(%n+<^*OovMC#@A4w{`vUy$iN{1e1ee7Mc+kJF5f%E--|x*K93-%hLb@I z$ZuOnALGk=tq;iu=2-XuoT8&I0uDh=;Yz|63`y#XLqrz`B!Zy&ONUeJv){*KixE0m z0RoQE%zXSa1y)tv&`AJWAN#C%>=eN_kqM=#=9~U13J7T;j?hS+1{vzb79yCd|0-xw zth9>Eg)>x&2!t^asW>F!;9w}`;|O6WVnUoQCZl*{W+r7zVJB2To>k_(wqT@eqaD#( zYuUGPrWrD?S!5gh=|UupSP|gh)V*7dF>u!JV@%z6T|;x_j!GLp#+f*0j){tXy5^dP zqfCc)1auacPO0KB20}=~InQEPAB8hi!OBAN%8fH?IKv(}45e}Mm~3ZM6)h`lIbMM+~pQnXA4&1}YJC~OL&66#1et>lJ3u#I2(0B6bXJw9$3QM;l z&5=y-M+g`RZipN3-KYY$!lm~T+gACnn7Qxl^yx!W&-ZQK7bPP0a+X9H(M;9+Gc!6p z+1o$jq4!VSxW>TWN6n(A&iZqWNr||y9;`foJxw1~gu0n7;+_IZ-ILPm-DRZbXBQHN zR%gVrw(N)5M6QzGAAc{6nCIKoq-_ioW~#C|IAgzIaeoZ#4^FD3Yj;tLdoj~6Oo>G` zA`ZrT2>6LH@r`ulm0~2~zOtF(q!Pr12=6vvx&kXy?oU`*%K82Hp^8rC2!Qu?0wNSzL1#8MMjfhzJ zX7c+{6Tj&eCv*9(Epgk*0t|3GndWDzyC*Y3ADGruvZX6Sdo#2VImBz_K4J&SQ9wjSovmF^LKKQzo%f+oWER1gF>&5Cb z#cA_AovqqIopv>#{VGA-P_p6%Su__oK2qA28fG7biW|v+%VfKp5YkaQvR2knKH^c< zQ5b$BTpsByjEqAgpu0n*I3yXBj7y#Uf1G^ z(6~D^+PJ&ByTki??(V(wcIWNgdFT99WE~=-A~LJ;d=V8HfhBA4OybzLu!W^Eq=A;?9Am#$Pn_PGc3o+3)wrH zFls-+q?k!|bi`Q-L0w_adD4p|vU9l?G`&~70Y0DJ1r z=idbC&L#NSAdovh$A>1st%Heva-ti0P)So>AcOg@Q{8*tfb^j@eSq{K zH_1#J-ZbWncF2 zNPBa=pIuTu2)1&aU*bb-Z$!ieb$|=MLi7$W28t$Pp$}wmFk#8^acx`zy@c&%0O|sI z1pzc-_}m*emjcW|vuxd5*F2aq#@yH!mki9kGS^&OCrK{*Os}KiUG7Jgs3nSZ1+Mrn zBYOq7x_SK#PzSu;@j&*0UyU~TfjYYxK)Rq_i7z9&8ERKs>1$v2POtC2a_Go?;a9tk ziIMXqPNI)Yw5%Cr!gJF`n#TT4k!&Ulsrb#m1#?DeJrjveMy|GFy?0p%(lc^~MxTLQ zuEbKyh98^$oU{`@xj?MBxl8WcVALU)T-T#=edIS?`8Tv5=qJz6e3h5SAvz48Av!va zZHBJNGO=XcNJH4rKbb$bfG>8&G*obPxz6V9W5*rg2lfROsYBT{-!q%U`4uHE$Nuz% zWZrKCmNyESx^8NfO)Mqc3Y15(KxCjVvL6ouK@21l*I zbjS#{mK#8goA(0X&5D721sJ-w-$TdG{$r z&{F+-po?~9e87sKzghaB=dG3svzH_lm%f_448{`ZuS$$VDagL7Ry{cyaE!y$m-RVcK8v*7w9vtqC2oCMZJie>gyoivtm%P6qZE2(e)&&Kz-=powU?>pS%osPKa z@wr8A)8jy5Mjd6yCXESGaBw#Vir0G0>Wd<6ZPGdDl9gHxjq1u%k3pH2?PL{} z&&{PxEj-j)wNZZmgDii$%l4bEV)Oif1}|gs{)`+x5o^p7z$XFTnVqdq@f#GY+!4TE^ZUk5=SoYwn2M*;IF@B1egDKa-mc=$N@l*Zkt zbqNLh7U?Ee1h5cx5e6~=z4TGDa0L0rn>D}zKSAZ<2fthcze5!f5(=Yk(LiURMWP^4 z&%bJ1o{9n^fg({s3*e1G`pg6oVn9_uBST-ZlDvW`TMkfz>mWo2e3dH(?Bomy5czCf zGDhud3%#K<|U3v?p?<%dZf7&6%R zx~LW?c4!kfJMMd0BQ?PiH3PEy9JN^ZM)n&%YA9)^yMpI|kX8KEB6*2_LWb;Bl!}W z-_dsyWf+k=f-A%mD9zX%8O>F_YqlR#e za#TpnE9_QXe^Q?$-|=^2O7+rVCSH6tt`PW*wCJfhI$UE_0$@-sbT25KPb7y`Py|Rp zYQA@Kqcq5wTPja$qc6!10w0f8doLevuUmU>3?EMy27XU{UHq>vdv_GOwQs@p)fZjw z&kJ37iR*RG_k%G4Z~OKHzHJ@eH=yiy*-aC^{4JNe9$&8B+BQC}U@;hP5!u%l1%}+^ zJ01t$w)a-L{9X@MBPS!TExqr97uJT`Hr|fflHL5CAg_lI7{A&X?n}=e59#Vva3QRc z%YyswX$?zv0;+n@VL85pn+)AyFeEBK2V9%%}$A6=AO3PD++;`6Ug%3=RQUua{ql*+< z!FVbXYVs?s;bvISf{I+rKuZ0>R|?@*1AuXh2eTKLCIvv6gB2b^E#r0Ta)sFw z-%g&m3MOlIvoTlrAT_(rIGYMmYqu^^$bC&XvTnmfG|2;aSoHzsW}g zC)HXz;wtFKU@`WK{-C|y0p8^QgZ3#`*3$DpG^dyX#8g<7T(kp1_*8V#lq@v__9pAM zs?T|^?m*45DKJ0+dcK${X_Z#@3vZq0qRhs^tmLA`gp1T`>ylR7+LcE-a$XJkP^)a`FVI_QEDxe{ZJYMTbZ-sJvsWd6|BrgGaBgJOY)+Io0g z9&Ej?#huDqo!^)uu%=9nvjfVBtFUA#pfzJ3>zL?}nTQ7D&8CAm`Q@_Xdqce3^ipZJ zmnlXnLIBM)$RwbEGTSOoQ{<0aIVqSet}N1 z$t}VNE)7Vr3Pez8Bz!(01Brm;I^+HCJE>T`ULo>w-~?)uFJ0> zmUHQ9G=F^mG5Xy}z0*GG^ZG;tlN+W}=u~uaK<}vF(d~-mpbXhoVLaS3Ui}Vy$R&gb z#G5|#PNL7Nef+?)%5{S}q>8y&! zMpe7L#viSg^7d7=KUzOa+DTRaXk{0+$0-9^GwvQn?eC1omVlNtM^@c8PwYEZe8_K* z-1%AJeBTZbc7}UOij@>-ZbwJvO7fK?@}t#{KD3txTvwScXs^ZGCz7P%xk4*d76of( zPLh08I@jdiRRpY3PchviMUf?4vm>4usxOi>?Zd5=@^=KXv}w8E%2BdFB=@Whnx=SifBMt_UHa)Z`xtI4Q9oBY)1>%7TWI_ z*6P#Jbu;Vp=Etmn*V!&B2Oszxr3|nmaWNu)R&Ue8lsa~3f7q}`7Ww*-N%muX8mhj;N(f_8NP$wAaRorl$>r8oH`lO|$P9F^oJT@ZC!gprtQ&c5Z89h6u zGE36UoeNmzY{2u5Jj1l{Obi}Ay!K@4PNwWUonbBJlhS_5oZ&ZcD?f-uJPRQ4I5Phw z`sLvKF99@`PRQQkP*D5U>VzyF}4~l&-@La{l{DhXM*roQpwW;)!*S#!AKNcRUj^$+sQKQ zG4P%w9G_UOoF``5&l89=u_?+)-S5;v`(@{`Zo?v2N>KY+8FWv2j3D9!9^5~vi{+W3 zd#{C9H!4H|`jMWW2du{hVgsT{2Xz` zYOe0)aPbR`9+nlBkz7=_3Q9~kY`;uM`BSIbBWv|=2Sx&aVhe=2X`TBkf0 zc(Q5{_6U84>#x`9p9K+!~Ypb3w$#+@gNnJ~TVeTF%sbSh9HQ7dp4lWfY=a^@hPerY5 zjmZ()-%3QGWe;g2+LsdNsa(5`kj9aQgkGx$+C%!nmaByd_DC+=8n9o+0Vb|2#z85f z&j-j`%D5I*4t%_YOP$ag(p{r6+(x*p z!R3w_kdb&+zr_WF@xjB3Vw8n!!!>=?5Z9cAC^u8W$%~3yjxF<3!%@ow-6XP5o6SLd zHlHk;>D%(%HKY($qrXLc~4Q?cyInY$pn!-EbS_I0+cF=dLrWYch zm$LQe^Z6y{>IGq@_&lfK_8@6IaC3FG*4F0M<@@OUaQX5h#_huQ<>KT0X=Q_-@7>Yu zgCt_abrX&HcERA|3Xxolq;!FR|KqXPkMDhHt-~{h`Mu*M??6gSIPiiRfBp6Df*@5Rlo<&=UNX4k+eLP00iecn%h2bb zg)c#eTbRihj<%Bq9d{qmVxwCJkfLI6?a-Uo!sy+XD?=VSwu!D8ak2yWuF7A6kH@Pu zoW5if^6t=T$;qmt%#a~_qCKRs9DQlru!nAKr*;Xd(#x}BlKsuP3B^00&PI*SDZ38W zEW@-se96kFQ&jlJw*HsK1M?YI-4J>8!sy8cnOXRdNP9sx4qf>N!lg3pVbF1t0j-)e z%?fh#$e`)+=7o%4dUF@7*5=>rXTGj}{zFgiR!A!KIm%lu8q<-~xqc(I8ck9~0COjF zuZ%>)8*l&U-`rh1V{zbQK+C}UioK9(%fvgXUVYP{>9*6SDBXRe)J0CG9hNU$TdRqOHA4t|Ch63PD%%BAlVM{x}P z<_KT3qHOpx0`Ux2n5G zmoEsle$m#;`uGxzmC|^*C%1$gm`VR3y~_`)XX=89C1(WXa?7hm2px)SbXE!@yY1u*j!$aA*CG`a{OUm|3W8} ztnrWOq6;Yno(tTn;|uG=TID*K5aRr`PuLz)*VGj8;`v+rA$|eN-vWhI00gp5F2RA* z*zmWqYtA|o;?z`&d;{cyUBV5@pA+?x>1IDTXy$|*?$FQfyXMRrP%9;IK0|hi+*fV5}tzFvm>fZ@#RAp4wt6M!Pq4LB%Vb4pE$!#*k zVW(7l2Lcp-BVVUsC!Tkkq<2fNTdqs!=+7CktjE!f*=_fX z8afs?Y|#fz98FyM_W5L!yVBdoP#4W$Y*@g}cqWRH&wTGoQz3~N(Qu7^s!qbYZG6078O?GYE67zZ70VhUG+fn&Vo%m; z{<^-JiwOEe4B++*Jbd8y4&tuP6CJ zzHAqZ{ROBn&tl7Xh?x-sas@eCy)L}&;V6bem93n)+Dm}OAyg7kXW2J7hHulr{bv=v zEn0JYe3nR+1 zx+MkB$)#7nJ@`l723T}GCi{g-5E7AOKrA}}bKCxy#6;&M6FYz4cPb?dBrxiH8-8=B z;U2#j;BG7fYH*7xXS`*f6#^lr{2AypG7&^)@B^qHNSyEeS2M#wK#vfEwJXB@uykHf zw~V25qP+H8c0^NP;+XN(PV2(^kGXuPq1~TJb5UJG_OTa3b1Pk9L^e~j1NO-e;SfIu zboJA5gXJWGE>Jp*eTk1q*`G5(7wj0eO7lW%nDNI3r3QtAR&TS#I zsT6j~oj^;Y@u`}W)o10zD6LSlK!1)Zjp?;uZ6cG%P7f8##=+eBG!-&9?4+y>BEbnx zXKxvUNX|eu4LM$j`&1&dnE``}&JCegI?WW&D@_m0mGlG!6Aaof8L!Gut>YROLk)(V z*l4Oyv=xKPxCZiU8iXIX@p(oF3JC}Uqeoj&1@~xW5$kmJ)BFY!NGs zhTK4KWOY)B5&mbu@%D~7@3+92pCpojoJsyzs3w}wy%H`oHJ3^v(eC`n&e(`lQz zE_%lZ8zV|klNsibEbP8B0pUB#bUkJI@Tpo}q#RXtr6v4ku+k<`j*jj)%hQ5~3Bm#RPD@Y{d2wLCb zI<7HBV&asnhxhe75P}y+LT2j|x)5GOQ!=8&w)WV?C4r0O=v0AK0&w%k8ZZQ&mwQS;D)tF7&eYP#SsqiCm;Hd7=iBc*MWxq z8I%yzZQ!pBNF~!>mS9Z?L@5#D1UL(jMZtE`?d=Gfg+KSaZrxwqZ{6=)bosXUyqj8m4eI#Sr=JM-UcYOAscwu-0S7{YXO~A+}%kM(>q#UnHd*D#LUJ%UpMyLDyny~Ju(;jy-zT7J=jt! z)sd@C^_P$s^t#W_NY%2WLeyn#laeQkvO5cs z!95__F!_f0M4Fxy%nPN0U~HsI)09gR4Y9RB$B3Bw{PSVlfMhW_@#iEHt?_z^F-n3` zl-YZd&@}#ynKo^?9yp-)j~)#BW|z~2RUWFL;JI}=u2%jqw{XA zX}+VZqWDqDv)9rECU=N+0f*HPCR$WR=9hBnrZUHJgl090)z24J?fb&8 zuHHjdNHmd5pppoH9fIr|UImQHuV~+K{zs!X(z0xO#Lih7T15pwE(gy$2y5F_1{U;7uG)E7svus3Wc27m`Cv=}q+2&kh<5s)LtQkV6zI4oa-T(goToex<|r2PBgdUe$c!GbSf0t& zCYo!K`S?W6YeW%O#4dzM*Dk0wcKb(rI^v=i(rgb?5|B0y&hW-7ynN2(J36aqL!zZV zL5nv;&rl;rIr7~-*S_Dmv}f3B>f_u!qnUelBq$hCWj`7Um3>vp`t|sDa^Tkm*iQaM z&-KOEsr6ur24c#KZ+HZ#V*{mQ9*NHbosSK@;{t^*9Gx!{t>fW)#q%w$((Ss!ZHD~s zGp;P)T(%6zI?@)UpSt42Gl-_B3tWh%s1KZorl<$pfEHWfKOVd&iZ$93h5F){b5PG` zaL1{4%c*xBGqXXNc%4^okXL2-8K4N|2E{4fxVPUqAZ5cHnHD^r$F@uMs~hLci7&*j zj?M&B5s7s7HH8A6jH5ec_NPMUZH>r5L(h$s2Cslt2~}9GR8S2 zfF@x36XnkGWBO*Zz_EoY`HoZj)?HonyB zsjFUS4-8sGCTi6*tLw|&wECiaDrrLHtLwh2! z>Rl8cf>w2v{t8K3_^#P^=bN<-D!1^G`n>6}^u44I>_!F)-3*KUb!10smS_K+02ncW z>@U$b6XUxa4yQBc z^Z;e0HY%Zl85vX5Rr~m>JP6fipRR0=WuZf6cZXel)O=l8@|4BCwRG6LDm@|IzN1x| zi#xA$@5Yv|V41G7Dodx%8r$S}=||}SJ$m+fe8FOr^QDcq;^^acjWZdX>0o1QD(=c$ zS#)A73XXc7_FA5@?{3B^KRoY&9g_@9i^)fMv{FBBWVDhkPCmVj-P8aQUj7q;l|>6q zi)3*c8GGGq9VSuYmt4-VL?f$kgV6yC=JKFk)Uh%vTc|xRVv-_y6{$vS?l728TeyxE zlSuuKVC8rs$-%>^A4iyLnBoP-HZ`%H=wEDL=Ni>3@u@vj3$%%igK7=bOrr?r)a4o_ z3Q$W*vDNLXmV!j6=hA*wm(6K=<6~=AP8m&+RW)#`4_fTLJ4fy7%T}+kN=gkLjvoa#!vLvVCD+VQ#RpNWhz#MV7doTs$b(nU6o?FSXJk?<&#~Y8tITO*l15 z@~rAqFI!gsCRbo$`^|<`&DMGiFly)drB>;pH^pVP;{q$~_&yuXJ+0D9v~qklv_xc{ z3RCl9YAcx!1*%6&4vuz?$$KoZp~KbqL4iwB-I)^ zyb54Ww&RZHrEdXO$UZKKuSSuT=>&7viK=rj8eIcI>{X>!Vuj}F^Fb{{v@Wjc>1FB> zg_6@c{VcepR)tT$(gDFP`_i(XvRjm;`_0dxsh?-{cBT%_ExMDq+bv;u*_`Zh5cNc#!aPCEsB~8o6na&FP2)})8 zr;ezb+K7Joz1Ak5yluMuvkkJe8TShvi36>?L#qa=sSNuJ$Hp{GTVvUt#yzyUOtlWa z1%KLTQC)hcD1T7PRH>#9F=BtWEWgQvS30N-)HT62#wq+?-a(?r+n zgP*|bb!fKl>%!R!gLd6Jwq5pn=}2`OpxkUzmj|qipTndM!q&TU&6dE&Ym=X!gJIY) zhc`i9ZYS@n?F4~aes>8Yb`*lhxwteVkb)pt4zk_&Cy1WzLo8qBSCgQ)EygC>=J8Ho~Zp|_*^woU9NgBbN`eEJKWa5*U-i9YkecSX;K*TH}; z^ZBS%#?{xiViEz{h?h6N_p6gnwG5E&vgdK>j`+>8U-G-D=q281d*jl5@wxEItq^fT zIt%Eukum5>Bh9Y4#m9DCqPWQ~;9O)^v5r&hQBYInfuCzThHYu7CHKHf+X*F5!`cWF zlObV9D+JYYsO_pGnb5S$DM`_Msb5)xrZ%g43`H>Evvjmd3EoEXuKqwLV9vTQBVY}Q zfy#r0IlSzkG6pmBxx760$@e$yx4qxu(p|HXk5M_KWo+3lF<=l^XWjALv$w?qMjbaN zq;bGw$rCq4d>?^u)dR^ar{Wteq;y$T7ChdXL%8?P+wOL-k5lX}=3}f&FH;CvW}|Qh zJBAH%#|U9N?&D2o z3`ojuC+p8|AQPhj0y9pif`H)U-y?iNdmC6x%ttZrg)KtMZ-N7H>Ry22sYD*5J6E$;C#@IYO{>ha-T$qvflaXm0N z___uf`olZ_ln3#xg*KWvrTylLGSm+oL4;s$!{cz`&I`4t!0w7N^1yOyn=Je)zCS0i z(N7()XMW2)z@c4`Q$HtgFf(uvg0&QS&9rwIG}l({a03|u7YY&~$O)qNUvz}H43pDW zy$ehFochfW(lj~kAk;KD03(p;C&K~7|6C8&`p%hQy_PuTXVkXRoU^dLro~JO~zYeuJ%vQGTWHVmUZ$+HMRHM zmXN#1Czev5>kAmuq)zL#hdQ-$b`;>FEQdBN0#G~`g8G1jRWc^=$TMJ&#(|*Bfr91* za_}TwOIB4Y_tHxEq{Qvk~!8Xf9J%zg(T`0 zUg{zc;JJ?xnwS}d6_BtaH@F)@<#@qA^4w+M#%}(^9g`7lS`8^bI(0Xh4K5JzSzRi| zrQ!EA+4xL+yM>eiE6U;@?_SYG+mHPP#d@Cu-qm|A^sa9LJssJ>r=2~fxS%ZZeptm_ zQ8Nb7C4`4+EWp8bRQY4W7U|5-p;6~-J6;Cjq0v(VX7x2#wl?B8>Hpc3uUBk5k94T9 z(-SSkI_4Zb!1^`AJM-wJHP8cslH|PM?t6E-(UD!0u^>nAoO-J=ipzNf_M`t@b|N=> zSfb7rA%pd+hLIoo^yGvW_&pqFc{N6hg0*lyTj7+dRWaRuc{T92jS3SDL(uIGtx?zN z570KC7nZ*^5|{xwQvNQeW@h{Q;GG$eYUc0WhvokR@U#5=uK`RftbaRDhlz##?~eh? z|COxdFAWQMdpkfLl0T;E55oZPG2qX#{f~hEU(r2mtX%&d@Q;nt002M6A(JKdQcyFT@8KScDYBXo--dD7mQ!9! z=LSrolWb)7E#wX;w_7wCZsUZoYu?=!iLDSkBI}RsOkNUx9kECcFe zyMSrcYSTr`m1|Q;nqbSIOwcW*xZ8~l^gB(o({VqTjV5!2oY{Qm8rUy{j7U!=npYH! z35d5%2@+qDF9sOiv!OYB20xaCg$d+emdD&!C$T3=G59iyWH^B zYPz;=XNgaHkilW&XQ2XEZKd22WHWJv9)biC#zQS7@jXlX%A~Ih}XSXr)*p_C1>vPRjMCGMWs6D(%%O zYlqa+vTb&7bpwaq4^m~kG%nK8)jUUWW>H!`q4;mMR7=IQNm&fTyL9F_Uq(_O7%wXCIOZ4KGaz!)l65b5n9_VD^yS#Ivf+dbL=)3VnNH*cQDpo ztUdJPX&>kf^`Z2OG8u^)3_T<%~}Kw8ZCJScjf?wh9B*$UJDw#O*w#wOM`ais6?HL3aRYLlbbxwXyl^_xu?va z(bQ-pyWcaTqE04}kgZ`JwUVWxjod}Jc#<@E#C+Vju?VF`y=qpKTgzJccuCxaJwJvj zbr$|Ehg5-lDnpHdWTiyfbym(~EF+^r*OFQ~vCdo#t$|gtK%K(nb2)C&gw3@+QkM z58(d=#M)mpF?1ycKIpl>Tz)SKSY}FVaq^`k>7`j z@f8J*_m{io?5U9|COpI|<7)yGC;}{QM3x?$JN>2ZW($Zu@Q>e++U!S4$MWe$aH!mK zU>5#fAN^WSr{|08!$6?tv7o^vJ*-5xtPb1+?@IdC&%12A&=-_1Z>*0`TL;A+EReqM z*YOknfUXZP5bEoqw+QHJV zPq}^#Z(;o!-T)k}fTJ03e8;j$BZ;1rt20q)o%SiDQM`x2`*9aWwMWg0uyanje#a7x zm7Jm5Ddw3lDlgoH{ML!<;oCUIJ!u(=(O;n5%-H?mV+MfRVXQMAtX}2jJ+K1o{*$z4vfbH&{V}}sLgf#H^;M;x+ zKX1i#A)TJ^6mmqeqA9dmvZ5{YoO#JXFRxj(T(Z}_OACn__cfsCBkn_1<%vrLyj$tX zb80(up~MIuA)l?JJTXAPEVHWY@LIA^)ZgNTVl#;PQ9xH^YsooVxJEkX8<6N|8|!H2 zugpsX*GG@0szfm&G})u5UAE`OP^$<^Zo!V8=gFd}HmoAF6p923iMw~>aCBmHJh!1pQnd!bJg#^U~$y0MU# z=bJ9?oBKP&kA$6Nu+yy?#Dy8JBi89O7-!rv7`jbmj z`|BPXW@S$i^tQKcdQn&hz9RMcNr3*Ct~1DSyxUkR5BqW9xM6rJ2L8fCMK^c2ccimS z!uRptn#Kb(4R9&>0?^bA>RS5NOX%TscPUvu)VfLX!FuJ7xdBYibsDj;PNS7q>8mG3 zqb)a)8x%M?yi13AJLYG|=jNaR##|oh!wM8o0M5<*DSw!c@_ZO{&z0*Vf0%~Sy06OU z)pL5djMPdO6v92%UjEA9+u*&C&SF3}k!u0{lVz4X$(b-I=-VpW#s%*3+!d3;MQ!&T z%hV7vq$g|T?`O9B#5^z77U9Pu$kqrSDSfR8c?-ts!}TH0akL-65+^VE&XG^uB@%>`hRlWlJfAF$5{y1yUlwRVuK z9WFd3%|j(GKqX_GOlSj-Sff!Y$V^^Y51yIwZ3PPXg*Y)OW==NFZ>;FT@kTYW0gQyR z2w^4Rm9)vmBK%~1@Nu?t^AfqIGCy!Jw5!IIAB=7YXB^Ul1#K$=3ljzXQ@Dp;q8E%e zvg;3uY<#bhQ+NJ=%2X7mNSJ~)br#0@SCi{pC-z5~!qxrRQMyJ} zPjpv!hVT_~Sp{7Mz1)0~qEE;&tM}uAT2Q*&+uH6o-!r^r2F4hdOL`$af$utHOpvV? zaxtpjT#tOox&n3hX??*uzu!-y>4Z54=zQ}T0|H-MdGTF^t@%_+_V`JllrS&E1oIk&9;_&=;b7PD}$ZnF! ztlm4d3W3Pvu!PwT2$KUS3I}Ka9%$!akizt2^`{YFm|RX!f3F|5hAx)1jX}qVB_E(z zqYu}AZ2+*c|Cc0z|NSe$e*>kgod4EC{@?nrG5;CJ{=*&p=j?m`>8)mC{4W)HeG+71 z(ixEkFT7z0+z@Flc_iZsX_2Tx`Dbku)DXckXqAm)MG&6u8_X?SMaW{Io`XMl`DC?E zM>0>u<9#1|>Y7NnT&wQxrwx3JhkLTPlNqI!tFR~nH}-WArLdzOnno=qc-&6E-=!4@ z^p1`m+V5J<+(W)(6l{1~`y9yc9+}r5ws#@)5qLG)k!l&iS)MU*J}V;{oYav~rF5Jw zUv}cyGxY3>T)E=V8g`?8w|t)04{5FGbfrkIsB^%oT@M*0oo}dn_&&GwNOT~CkKY?> zurM6DiBBd$~QJ_dAMw-S%D29Pjh!s?XI;vsAq$JIh(~DFu94`pRlaCskfooMTY!|Fb zEYzZEcvYq;uPP&{YHY0b6kC!;QC5sJNzpnI;2fe#D70V^9c~pJ6mCU(sYX1!Hw)t+ z1RHTY*k^V#3zGp2Kj#!qwCH%J8~7=iCS%@GRP&Cr(i=T;l#`w|0lcPOa9a|_(j&el zL}VXZfeQC}`k?2=5~AF+7!4Qrhl9WS{if=#OuL#I++3@<0l#c9x!p{F` z^8Cd^#YD)&#=^?X`sWOfrybDVs$%mTx-J)IJ_a)~+#O_@LF1jVK|ux3QkuO}ph$w8FNt!rWO!D%cU9Q^fT%8j2Izyq*51M;KJ}V~ zQT(u2spmeqRmAHb6kg?Ua&=voQ^5Fs;zYFG>iqLrPJmV)BluASiq2rUGtc&}%AUdF zQ?3QF@bN{fI)hft8($|>?l<*jOZU6w@i{kqoqI6h169F0f%@#u^@q!20W{*<6QdxL z7`pJRDVO=qiwUvA0DGk9if>g`_Fnh*Z1yCtrWnFv`-!$R+~r2F`Xag(D8gJmDhGXEuhi!bjQIKjZ}{W4`3crSq7HTYMYu>t#1Du}vSMFB`x&=`89Pyj zW0hSqX$i_?^Ah~f&bDKbzd&FOegT<)CdjJ@C|0^gzj{Y1nz(;b1j{uBvHiMjMh}LE zMY!+?%G|NYP@Y3z1@8+Ealwu%`eBBYHsvFXX2rADFfrxRxAR&|vLk@@_%h|gOqb@T z>@yfT;?&DfF7vAmhpPYDvL0^3@woPyW3$s(-baodzTso~CHw&fZjOXCi!k(Msz4=i zOF%s2(*s%2bg~LhCTX5E{BQF+WUauWhot2+uENHuKcE9W;=azlCT9^tn z@chwpkCt=t__O3mbpf?pvF=q5sAz%6{v_-LPlT>(7k?Eyfw&95kkUYcsuzFLKK7A0 z;aX;7RN=$)Nz;e4OBehh#r>LZh;8doF^w3$@G?|!OUfm4QiJM@dtgT(u<|1n$fN&N z7@3>EkNuJxIQ*t5rsSYiB{9)0=Okp~qM#8q+w+$%bC)W{5ynIBkf(=08IKy)5-7<` z3uLUHXeI$kSGA$ZGSvmVhY9+w#%!Q(*VE0D6u!klqCj#C_&Ygj>|G{r$g6n5_(mWI zMPYG%QFd8m8=~45f?P@tk%I3n{H)Ld!SOBDlbGi}C?i&saP*ljDZ(VKgi+Dy?p;5Hl5rgHXk4oTM?5*UFnMzFfd_&eK z2<&E@>Su}{4SD%}JJo~OePmzX6vSg3nVrWjZ?|r{kRQQ7j!db6ecg*jd}Sp5fN`e(%+iF<2W_!GF60D^(+tH8S)H05;Rz(;OHJU1yXHM| zk0&t-ymLk5Ok@y7pI{4Q0CayF;Rm7&Y?|=C0W}$IA`Fgl4W*GMwi-z}J?HKur9F|EK^-`z$WIdY9& z=|=XBm9RL#O#>0MTCgcqLLHlpP&fC5^k#C;4bpzN<=lVx>(6E&8Bk7<1N|bJeG>RW zkm9HDp)kvWE#BwH45jeqWlm5Gv)V)%_X4K(YgCEFAd-In99S3ZiaKmU0%NBQh=CaE zfxkdRR}*-F-G6Nr$a*|`@~06VM~=rTf+}dE&}L<~pTDj!+hW9<;zKaWguHm4#XlxB zWQq}Rmw#NmesIL{6-f%@zKAtWpgv_UnMZiAPafo%bWxqN75b1b8NU}lv;LDj>d$=v z7ndKN-2zWZFMq-LU!)(Y-Id~If}aS%kw8d+r-9`CaXyp1`kmnGmEcw*F{%io=O8G8 zr+|eaz0Vdxozufg-;{WG=9*-C=hx}T>{~-QwL;~U^Onrwz#|XrH zYN-~@u?pIilH44+Fq_MPiYMZ7;6@eQvp}~JzL_Gf$6Jdym++eE<4mTxHgT`zZOQtQ z#jH@Mu*dRT!C(Aiq-nWnY2mDG(a+5j& zTlw<%k^9v!X4!8pTz~UU_{b0#@$2y$_WS8K_L2Dk`2qhyClHfOqY8}@Wc3b#368={ z0x1m^UXTZu@NFQMIo1)aOuWGY-%1=-2~s;^KKJeru0B;DvMYWgip!>3{Ipk!6Mmw1 ztQnl4PpKWozPotG_7TLJs1wQ{;>Y02mC!4yFSnTw+r@~?%gVNTOO%DxEXo7WeRlEl3= z?SYy4>MI|LYK3<>1ef&ZV12-+zR4nf{D3grCLBd9j8{r*?%A+FnWiMme;Pd*)XTql z54!wVZ(oRbzM&}n(f6_3{8%239G3J*illd|a;XvkLFs;NjUxo}V8bS;o{Ab#ET0xVyVk+}&E- zp}1Teio3g0;9?hdcP%ajE>PUv-Q8{aW|H~Oe3)b=nMr;hp6r~QoDVBI*=IfbSz|Ic zqwboR#DO*ld$pU1Mm!+ud!GiFnRo`w?>?n+tig z=jF)*xE)$xZsZYNs9hllshMHNQvOy$qc0~K%?LoVjl@Ygfx6mT?8H?? zA7%WQF(az46Em4eG%_E6JNAb-gIbXd8mT39S2gB1kf*<5E?0z5Sm}v{N_zcT+Dm=T zg{T15hBAare%slW+v0^VkPi9{X`mSN6`~yu;wAWN@(Xfr8kB)@P%V6W5Y#2S9P^3H z78=yLlzB)L%aTISh(nxx{?;U1drEMGd)`m%H>JE)h5@%dEd;afHD!tuN8~!Zr^_G_ zg}zU$i$o^Ky+IsRr?k&mPUV+J?F#6LzEV5UZU%@7-QiaVt!LRv^AvGLFTuqy=R ze-7~>Hms2BGB~n74{9Rn6IpM#UA(y2E>;;fJ4@d+?T@Ci9-o~3=(I8!4SpV1j6-p; zSX>;>;0L@kt(2?NDp!=(Wc=W#P*WA@u5#6vb(&uKb5=DL+oU4r%(mtBLs2F~sZfgn z$2q;%1>al)-d6YDP`?FI3hXQ){-lABp9xbu%=yhj@Uq-gw|7svgLd7C{8R~zr=eLG z8Jrv-EFwSiGG@+xZIZkDw;INy)BbU{xZcYeM4o5wU(s)_iFgvGQt%i(WO7dxB=VKM z!mab#>*_8qGZ!ZdjAgajg*o_HOXU+|VqG>Ub%a~qGr^TUPP+WK1gzEG`d=fG1)Nt& zMT*<23oW$_0B$L(mkyY-Q&ROcq|XDSVL#Fw2&_5Vrxr7v>Rt;(sC3r|7u;b4S8%x= zu70YNW!7F?h|~^YU&x|q-4{80OhFo4oQ-_Z(tHdJQPKJNzJ=l#&pe2K=N1r?cimT* z8?RuUq_)QZcEB)^#e*M&StN+h`#B|Xl)I_C;%s6B!xH{|@>jbI;bZ>b1%9+yM5cGE zmh(P&hp8>OwtF2@$e><`KZnMA^~~pNnt-=E^MkoX;N9RS!xdT0tM`-2>CQuOXp5UW zd}T%1+5y*tR7GG^ldNC$#rR10+t2E$D03-fw>aVDzIovVW14XY1Q8CnQ48K^=^|6% zg(%^&W&_6gBm)EKmHo;K`|1J|YB$(ZLNb|W=*vgkr!}8jRY)7k^P_s@P;mrJ4_9UhJ401+PhX{DA(Z!I(ryKkt6x?kt5n6PF(fL_Rcg zk5UdwN3#Am(2O=w)%D4HirENI$GLy)zY~=Lm zAlE|3n`63kYgAqcw+Szi7Q2XSESd~muA>)X2Ql^e$;HJH>}FP3LkC_=tldtSqA+K_ zVqebSc3y51CugB{RMQ84HI_-uLSP%xLKAG?dF`?NDbZ4WYX>jpv7y0wyDRZn%*9sn zuZyiSFvsturx)%=eR<)oBy>^-mBUnB$vDuY4f;MG?)%-LjSl)?v*UnK;` zaS}Umlv@P99}({4LicgW6=i4Lr`D|1>}mAbflTq_KfWh;CWaeI!4RvCQvQu(EZBD? zj!dQ=B;UsvuKZ*5FHxeagFE&qQ} z7LvkNR`zR^(keYq2>gt)5G=0Duq46vMJtQqcMi6*GZzcAross%t~ejNq{PhMg!Su) zb(t3*%0jYJgfon3WNXQfakvbWW^nSJmwuVlMNOaEqXbig6U;`gfhM?fG>%V+@IkXj zpV_ZgNn{5zP+~5Cct+%yOlEV&y-cYo#E~R#_om;8?s?%dYFddL#a##oG?nNL3dgGA zD2(NB!>UxN6t^gd%^@|-u+q4|KG!p=6KlkzOdeKS%)`ohctzA-r->0(*$wDzs_yE) z`9XAqWT4ZNBGQHGk7W&c5>LvWin#Us4cOA^SU)@Q1(p9oJn}qPVWv-aT-Gu85QKh zi@|Gs)ORRrBtre7%z@|Rm1NVRd;TE1-x=-73P%yv23aMeSk+rLq z$iI+)X!Tdr!CLr5eb$gCXu98M$A7sS?V75%m(`Utca&tdmYx3uE)@yhS0TrjVIIK3 z?FU7F_waTfyJ_Zm*6rgSbc^%vA+n%SF~WN)@8fB}9xHfHpJ#4o{JAbQh~deoctHxw ztYGjnTU@k?TzCLV^*D(Kai&T9;^M;CBc9K}mYh?AEZCYi4E?D`fY|Pon$;EWI!|!0 zfqP0{RiKE+!wvnwnT|T90j4kLSWiJ@r6Ve2V}=k;7Sukz-VL;8>tm_&{*wRDR$Zr& zh%-Wm>h^CwFnK5g^#TmebZiASFi{C|CIe@C16TU5O7v5JCdfi7x>;iMgviIDo_WWY zaxB9UElmX(PxjEs&xNW{U8qe6c7O=7+Bs>ao77&ZkW0w)nW3mG69u0I?w`$va=f;0 zKD=5IX^ng~SK(6g8q30^XFo@JaClUhZrVeY{Snt@YXjy5Zc0@4E?&$C-W&gjEU+8y z?olik<^^VIC`crn(3t3nhY?~7@+w3hehanNBoH|pj@zUt=muY>tyC2!54w)jkwy&8 zD>u;AL+syulvbCAa$--$*h3|7);OpUzcGZ}lEXp}(86xP1ZZKi-~>zj1LC>+)77ADZLITcsb{B%#UJ!q5`Z&lNJjZT<3$Wm@fCH3pS`Y$k2sl&N z)$uvg*^}_q`$0Bf4R#Ak03!is5IY7~gRLZseV0HT3{nHf0u&Gc(FE!Pp!!$_GX+S% z4MEZnNFTh%Mw`j56FXw200;OJOVAH;1sAc?rm$0hi`Zz>*~P&y_`8;|@$80RYIblx zNDACauxlEd#EuH4W&=;)69KAX>)F6#_*j70SavpW|CR;NZ89c`f9nDE9S7Co z-_iiOjmK2Mz7wDx_5)7vTMBzF#{m}DcMKGde@g)nF&;C*cL`;`fAz-CF$lH-5?Ol&&lfPc#c$T1xg2MdjW=Fm7h2QuKbUeGCl3kjgce2hD`E#se+`alk>-v=5ca3KJ&nvc=Mwt?6?2wX4#tY!+l z09NC%=UD!D_6~d(Rsd)n%MMUL=iQPBTa+Jr&>9WO!9{|3(;!#{UUhXcUBU0a+( zKs&LClKMtd+1cQ4h=trlq!%s3GWM+kOhY1YmSI_}wz{<5 zExD>V%GNYTj=YjVM|wmq!yJ}IRZb~}MhjX;X@o;ARjnZuSo6aaCqaquG_NQdIGEg| zIwLniDTh1b%)-?Y2z*ZFQlF8MrJ}i|PnVa4rg5Q9SCkc|aZ4U6Fr%g6q)%5G;gYjq zNGEhrhU5qXj<7#!kSEcXN441oX$-B+25P8sBm(8Ue?qa~w!_Mnrc)UKW#vR1TBDNqr}}%>u$nZ6~tL0!lV-Knd$-@(=5RFicJwTJQ1i zQ9-mP4AZIw#fx0YWelp*wsLaV$-{sN9WgU@OA_=T%p6*0u5bo%%0B4ifkEchT<|Y- z=U5=waWk3KnUCCu?1)FQFOka_50T=0?g=uPMm}^yTI27MVXuhi6P||#zVxCmL(aU%urkPZ` zL8ghIe?}R9=86-R9ub$zDO$|Q+jGiz!l#K>yZJ(cratq{g*2}|f__9UsYad@Ar$+70|naa7V zJ7bJ{QN+2aJ44bOsyma?beOjAkRO8WVuG?HMK~Yr1eQRsmSJ4b&K{vV=;B1 zOjhGywVHCuNh67FN)5z_u9v_GVI){Qp;hr$Apo{#_tUqCV;h%7?P>MdGuRK~G zxCeTmd=Z|Y9ICI&Cj|tYh7Khu-4e3aCZ$F@o)c@+7GFM4d65slMv| z@`ltaiuUH6U3le}4>_Zyo|D@#U4l;ak7wZ|D3<5T z(~cJXE#c=rE!#|;MgrSSpxd0)>!8T zvxyjN`TQos;Y>o@`d?7qc!{oZP+D!ECzb>GoBCS&eg`eqIQ&?xv!7gnYjR&$A+hyY zKr9xv-834_Z~n2)>*#o?>!F4+HSA^U2F~C{sU+08)S0hqu$At2w%Tggp+S*;=FI;wz8)cpxKG{m)j^;*Y zCY2y+ihd8A!haF@>i4K^5839k2EX39ymiyw>KcNjoOL`M-;x7K}VKg>WU@a-4f^_U}admD0&_3~One;*!`a}|4(;`MC@GUymsD(ShY#x$$5QpUV(sQ6)dUe48>OI*J=Z(L!ll_I*wMMfQ@|um@cPw?>Z)_fxV8 z!GV05O_t_!u{wh9`L}p%;Z>xVTvDCA=M0?gVSyX^LgT>w_UAn0XDQKDkLc8*H!ZT` zVIHbI-PXTUuRxMOPRLcrRR}#uJ%~(5O9&oF9w;SvJBTXyD(EW6D!3}BDwrw=DacaD zROnR5RH#&l_J55UR53wg_B@m+#2+v}zF0vrLyW<5L1#e31$qUx1;X_b_u7dG=b^G8 zv0<@6vyrf&s33t5K~NxM5KI}Q26P1k7Gz2wLg1G?C>2zEGayf9>gTHKawZv74sHBFGa5dgfesv6fuktf+y4!-xhmsVc<6iH0T!ycnCDe2j~aL z2Po4(Lou{1@m}b_SI9@m2Z#&UH$q3WE&E=BKtV_k2z&T9L`R}6tzMSEOh{fxdzdwd zR#HcjE!|%3z)DDM$Ql@Z$W~%Uf-SXPn!p&y4oEymRv1@kR){P#KD0U{N7fTi9d!TO z5ZfpFSOD@Z+5efm)`eJtK<0r6LFqMyX8V6C|HoH6vXA*8yO8y-4YB>N^8K@kT z>7DSOL3HZ&2<1)`f5&oIi<~6@Vk8kZKZp$e7x)tDZse|CttJp8eT7ntj1S+HUi zZ-tP(8}espK<2>ZwY|9BG|#b1A*cbT#twHk6Jm8bosGjXzft;^YDNQAcF07Ssvuf+ zJnK_hJrZ1-y(>lg7x1&G>xlAA$F~92uzwDee5q>E=8<-aI1Z?_DwqJ*4Zg z_K?{Wi#5T?dQ!ji{g8!Y9tz>7LXId@Q_sn{88K+nSXIL-#o_ewBLpLwL4O@~^O{;D zH)S{5i*xLQ?;0ag_zZwlBW+mDGrC873A!!W zK=Hunjq(oJ739|YPWp}`@;Y7FfR>o!yQul_W%ya9N#*V1@Ux!Wg@UNvZR<5C4tn!8 zNfj>#`eWCRP40C{y3W#wKN-s>QTGX{p}-G%^BO6z{n2o>0W-sL#D&s+6&GGRRP+f?Lj-Flg9+ zJ#I@F{PG*N8m^PG(3V zC8qyu1zAyi-6Yvp#3}NX!l{mQj9ynQ8&Jh??;`f+7kqQZuRu85<1tCvr2bQJh>ch& zgg?B4s4fY(y}kY0_9s|{E$?ukDY#yG-`C#|b4X7|j{n;ZDB#?aQ?$`&;wPHc*mxRE z8?simKA1*eEZv*|ynL(vw?PQekmAr>PFh#hJda10#8cknX6cNyQO){c=_hGY!ROEP zkD;E?yCGV{X@K_4%?vEg$Xl}w4c+j*pDgMjNbNJZ4K7A?>PIYXhnfkG^=t+1-DLv} zPyq8MkFNHoE4roQ);E)mv1lmz&7m9l**bfOn+i(>v*J3g|l*A z-eE!&Y3Z=GB5J{o;=yDUQ>cYx2cZnhzmwyA+ql-(Xc6m))MaX!H;S&F+5M+ZbA9BgQ< z9Z;T23GFku_3jVuo8{Y`XNTU`E5vHVG;pr=u|}}MWeXB}oZ-l=T!@9oC+^h2D>^3I zksBsrq3NA6UDcjDmVPTN((N=$c7#i94Xrb`R{NM8A zxRI=XQV7b&ip$Ya^ol+iZMO-}8S34pR=hwU(f_wL(~Re_5JIJ0xp!J# z?L=nMw?&*g6UACn)CxXbiU|;A*1EG4w%5isoB1&Emo$|e1@dMl-up~?4HIg&vlzlt z?4r~k*cCxh>J+&26fWQjyx={eWa<_%t zTTtlT9SpHLH! zP~qra!3&r;IM#8Y#mSrxyJzCh60T-r-@s(fUjDpj1#>ub^3|8+yh(?)1l7V+Gb5bE zS=m0&7R=O957tpj=jCECK)nZlXJ?jWe}hRw(^?2>Oe70)lo{jD^Tdu952J^-ystP2 zzUKE$hOkt3BKY+DLcMV6akqWerP@O?7s2@;&C-YzCL(0v(4>+gnIk5hPyOXW1r%6T zsri-6f`5-^1c*)qXry(L(v@<9Wua5orHW}$SpL|dnYA=}f8~rx<6Ue`;V@LONq*@} zx3!p9Usu&w@;`n%K0QH1Mr_U!HFgEvFWhN7W(jt8AGhqHvDW>olzZH?6#zk98+QYFtsP>*dV4u8_jg?BIe}OjM|c! zG3hR@f{<5Y9=jj=6xinB@235Rq*|?Z@qAa({tjDtv3_rSx!|*y>bSV+ayH>zA$Dv3 zdDm|KI+^ahrqR92Fok`@--F|w6GTe>e&JRu=M7}MXVg5=teC6RDAz9c%VH={)A7Y6 zbDfxvNWobDg)V~sr#9S?p4tOQ=hWV=LEd%K*S6ST!Qv{Y*JLbXjf#1W5QSq^kmux1 zDtDSyfbZ(&tR~LPNS5IqgWK{QaUh%PI@o^}fw@OhxqZ$rc-7(fe%A88Bwvn-Rhplh^sKZP+=h*wj zb>D9q{$~O^A5MknM+yT;&zpZ_-H2qh@TweA$AmNiEy*}ikdvar%+|@mIw65xMjB%% z^1WNpermbP!DB^#CWAhhcG%buj|zvsC2Qr5V$?B;Q*xW0P{>odx;OkeYSCGv)%^U1 zm@PpYg0>AwiHvsV^U;gAH`%^!UX0Ns2L6SD@0RPvuR3ox3*OTS!dDiB-shxUyNu7Lxb>*rR@2f1vc=%k5@8OUt zjB!y1t%Eo>FvKgVuifo8FJwL|`hBk2Vl!eUxSm|gM*t4YS4L+i6{aZd|G<#1r6y5L zZOB3Z8VEH*A>jWn>g@;{!fEp&QE)dR!+h}-Jqe?G-IB#fmHS{N$bxMV04F9+W0Cl% zHrJK9RV2r!y&9srK_;5Q3gJ>}C;1GUI~#%}hVrA|5^*iM9$?76WgX$zmBa`L>vtXB z7>96y5gU`WdiwVp8DAfv4yhSyn&60)dNfBA@lr_n@Q`tjTC_$|9!1AJw^_jVpTi>r zUuB7SgPVSq#eIJjlm0Un3XkPUjX*35^$pmYNbUGf3PZIR2|Hdv3@iSu!V80zAmDiN z8I(G@j{McYx-GMSkusjUMZEErPb>&U-7_tO#x)sQ>T}oUJzvO& zrej?G_asG@Nf^Jl@1Xq=?v$lMB zmJ5+!sQ;we6|S)}h&VUVeWu_K_pArkVFfa6^}-(4stJ=Z8gE#R{c5E4u){R6rxbp|*TsVQPEr|A2N@+*ZE&u`=$$dp9B1urJkOYL3lml)L}- zyU5d2LYPGP6LtlI*CtP;eo+1TL_lpF+*%)U2W5_Lf&UKP9vG%)bia|__29|wtwA>N zJ1$e3>Uj2I060&WbY`}+6){DNVwha~Q0|EAsAt1Gap6`sA@1J});}yGZIUGQUr-t8 zN-#=xRii}|!xCA3+FR|R+&ep4J2H^A!JtjZH0;g&X{b06O->M5>d+pcEm$~dDKif8 z3%uW6`pKwHNuun9zc9yf_svNtu6n<6l;1!}Ny5EFV07E@{$1i*46>z~bB$Id?SrD? zS!Tu(FL%9zO#zur!Bt&jBwy46U3~Q{AExW_uQld2-s*|f-ZAYk0(b3aa)=huK;cxU z1kRM$$%#oipWnDkHn|O`Ln<^>wC?Ch)dY4kj*bIrEEhA5BGdS)2{&~!CvLP)EOM+l zleTuGl`JC_+dD~YOYEi4bJYD^b7@IuD%)`!o$|Xk;aN<`_A&0mBFy~m#S+z9uvd{L zM1JeWF9rZ$a}C$ywbz@0EFg<8We||0m2%F3MHqj9>497h7ov&T@f`(oKI)E%(!G+} zy^{Wc+D%J~6vHQ{UrdA?kfSQkHw^sNfUm0N)Fm*Qz{nRxCh4k>jDc}0t2Qw~x61a8 z086ZfK&#Fu2l5y1Sa(MZqP<3V&Nq2suv=W#Z>Q9@VY7<)daw9>k59?^T7cNFk)vPp zQuf|k!86O!&aehLMBD0G;9R898OS|dHRpMw*7hjhlA_e@eR3UutTgO13w09e>hS4+ zw4$fiV0n=~A`JOz;mF*l;Z)|gRd!WAhDOVcvo7T^tVK!1q^iiYtnp){X!CgN9Tb>5qCOI46}$pK zEJ)GnI{#TSU6TFP`WwFm4@)H5d(cPQ@Z%*+Q@z&r@~=GVWz9yez~{<*WvxLnsZF=V zdB!PTiIeuGYp2I_XGeF(eLESMKG)+!z?=8}F5U#lWx7y)fwa@{B}<+Z%R|?=BR8Zi zCvs+*r2sygIjx=XKa~8|&)9G-uXHYuLZC&%$cy+g1(-Xz;zHwRze;d`AXi6py4`bT zaaC?y)G8%8&{fAF>OM?JT6--_SeLoEjERO-x~mDHYoGg5_Y?0^-)#3ivqnYdP092S z+*|ua}ke`(Q*tG}-26r?%q2RSpWlC921Un@fXwC0Q z`6t$ZF?TSRTG&Sd^J{hj^^Y@meRMgLuq9G0s^7G9ZEsp}bsCL~3 zU9=Um>dX%KDn;~psCYlb8zMwKRvKW!gha-T1dy1wih>G#1;^$Y_~L4^u;4`2E!lRg zv8bJt5(b3C8v?MX>y?gnIViU~BL|~P_oaK2k+c5hIaSSyjyB%Kindbdrqsutwz}rR^2$|EY^79B95IyP ziNsoKxLbAyt<0=NYzx>>3Z6N(4tmagPYxJ{=bc58l*y-$>AWK1?pvUDC1+g7P^u6{ z$2m<&jD}Z)O-7a1L?b{k3GLTrJA%mZETcMHrL*s>Hvd!MRg6IBc#!<^rej-z`&&U_ zqSC0v+1k(lxMB1l^ic6@<1p;6G+XS9vx-zFfF(}rjm1}^HeYuUk)I!f=U(ncy@@-` zK4Z~hx@_fETK?0qGiz@*{I(Vg+5Eh-TX(u#v=M_@R;n~`!Z}%glj}ME-rNjL8cO

zzHO_%8yY%eEpb*r?N_-XBA^$W5ND(8<_V&G-<&2D*F#8Q4z{^myxogY~BaqQgu)x{?EKp zWhI_D4R0iLjuWbi5dRBUEdM-aeg9aIhA3`bLqZ z+EwV#Z!Nr9c@z~cozCvlpS*(NW}<52zogRX@zO8II6CQRMMY)?6!>^NFi=btm)8kVPGqoWh|6U#WM=IR>}{e;}GrS^)Q4 z`AG7y9l9hfN(4n+WWz>ckMAhDzOk^h78ld3VY-vyj~$@jVn{N!M?+mZfPax3kRL3c zJHvX2O$n+CyZ7`LXYmbANLSSZnSN-wOy_S`M)8S&I9^XILF#4ms(nEOX0(Ka0V+B<) zsmv)?8St@YlRCGhy3ju}UK1BPX8b;4rJ%`rw0|j5m}(nJsA*oR8A(fB zmik9o#Ff>iBF!nfqC6dFg+E_+mt*lBs9Phq?lJ%op-zO*%h7~fLpeBd^Sz^YH82S# zs6SFK2VBw#Gy-NCoxE{T`5oyYOIMr-{~X_o$Bn2v5VlN@jZ+XpKt6!_zoKmdP(_ye zJg@pD*i?}p$Zp9_%nt4Xzb=|73Qrda>mdQZH}m^2nPAH> z2cKlg)Oo2QL61HaXVFWN+8N=pp=C~t{IJ`_E_Z4m6aPB>>{b96J`UPH%_kD!>k7oin%g(Stw~<)X3&6!Y_fN z_8y&x_6&1PLH3y%%p3mpfn5pA#fzUqvXOT#pes8}_Ds)nE28BOL2Z;7ao8mtkpFuo zRk^P_KiyN_G=NXN@?^>74IA%8P&FaAV{@Y&mo*@CTj7YqBj}#@+4dd6D7ui)LvU}B6V#=Q_st<9CO6TctRQ%2K_Ea$4B;^IbR%2 zYE23FzuWRN`Ul$jfrMCnh5@3u_n-l&ld^KAv{#XgO7drbD!t>Mqy~(`anbvt*v)cR z90hBJXz)Z;dK18b%V%RwEe)~d6H&3OfJUvchLy_a0?e>`7^gftlEU$!8^5`)+@#RH z_1rk=eY{f+mg-?T;_Xn7b8uFh23G3f8m%YhVk-bMF-N-Ntood$pl(8|vbuYWx8;T< z*(L~8%ZWvg1lL4|Q|qef{7}RzJ>JmgJ%-mrrOf4J?72fq{eKOT<<7jXt`7~EaJh*# zH&)P9Z+9MuR!vBB?)d$yqZDmzwf`$c~RbX)ll90JSQ0LoNZ1YsuXDHO4J0%41QDI{N_gD3<|q3k$ZL!a+*Ox zjO+Zw`WG`^HAUYGvckUB>Xgc-n4ApiLES{zs8)fU(VF_8kF{@HwpIZfso@*oCe4;b zZkDqN4CbJ`4g0|gBNgbFPMXoqaJm%8?8-#hFQd__2Rn`}Cf2#`0jL*PLS!E#v2UJ2 z0jlhaktj89M#91kE=B~%*PK^2ZK;mSKP9 z78Ye|-h6!$_Mdq;>cxA*lOT=Gn=dd*Og3{&sBJ3bk|fh6R>gzsar?Vv^ee-+)ImQD z=Rne7g2Os=cxj3N8W$)u6J?dv=TK-G^}iU|Jv{xOZ!>H?=m~-`%%Ea`PI*V zbf6hUT8ld%aqy>xx0;aoXswN|?>$hW1BI^dDv?6dv-8@$@|%gf4%aNJxBG4SS0jPh zgL~c1nWf-DGN{~q9pcrzRNqTc3LVLhc5FHP*>nZu(32t>DIt#0LaI&=g;JjMmBgg9 zxPZfFgwOC9xWdy$#vR!mhQiz|<>xtVm3N@8bz>EseQOtp9$(pO8yc3Fdn+(f@w(k z@V(3%heT4HltX8(EOM1e*unD_lY!%p+k`xfD#VzGn;~X7O zd2&wr?5)h%b-(Ko?CCz5Tdc&~=5B%e4K@395=qM2{&j4ZX9b`M)lEySRmhGIDy~mE zsg})BaOnPCDbNYmlGp6@cpE~>vw-WCF0^!mCkFOlvYETzspEdo@GkkGYWEfdSGP0z z^KQ`pivx~;vV&D7txbRF(a7Oaxt4f?D!QT8teMW_x^{C)QL9y#=gIQHD%vszm{T;0 z<)4N!)Li1E)>&ejRk>zE$;L^C(MZNq?Ui~G_H|iv4RkH+<+~@XJG*iGp#Pv*sM@t; zP_P$3ZBVLf9<*wEvg7VgO-E#8M^}Y)T|OBb6AQ{1P@q>?O0-_Q%2A21ELSCr>}xy| zavAZwiH06iPV#idWzPa-3zP9(A49m@eGbk-b|@~C*F9loi8Kbs7}3Mb+C^F5koEjh z2l*+LE>?ZvFW5ltkqn!K%_?w;`8Xo;#&Cojth|0hjd2xTSlDLa>`#G9DU-9)VLL)zL5M-7&w{l97Dv2yM4d zK0F?UfEq7rNO0x#o>lVjVjWc8tPcIIjC@%+v&9BZI<>DvA=Je){x-ETVBt3u%MLeyUM+(*QpAGKs@ zrPbAHdqK3;a0pc$hgYr$S&`wkTurk@&O{tGQbA0KR?4Sfw|i-A;>zC>>$ZzA?4Ekr>Zi3-b)vSDof`r#r5LDKjM^F750MhaRh(S@ zGMuk3!uc6ASi^?nW!HyNGao0;&X=&GeFG`Vp`$*v5%cKug+BBRG-t&W1 zf;J>SjIn1z%4eiCX!b=tY5)E)Fz!}FduHaxoq%#Tpi?q-a)B$r*tEtDlX?%@z^t!g z)x~7}q+rDTop3WViYCC*g*FYimfX(0!TT7D;`8WiI^9`*jw!(*#Nqe_y{VI=Gpm)# zUp-7zV{LDp!&PG3w=e=Yp*uJkJY@`H^z-%ex1sJ&WH0wJxh+D@5^#GTLv9qDE@NMb z)r!~LNANy7F3!KZUSB#5&6kD zyX%mouIXTTB79~2V}d`!U$e9`-g5>5b^eX15#36`rNj}YODi&+a~6FVZ3@StE)wzo zDymmVRW2}pEu4&ZXYc$Wh%57gn4l%HBG$~6&LqQ{49<@fm`u+-3=a6N`~l3AWFke+ zNLau_wB{6))Q$N)%dwX2VR2~LL7WFsfSPQk?lAM+;B^~T$xC6Zl<`TO7+ViB9Q7M} zKxz&VIG$jXg6GbEO0&NirGAa zkVR86+dfPNl6NO>a4&D#P>NVvW3Zehe?0{*%6^U@<9FV1TJ}oX^zv(_iUniQI{4;l znS6l-s@XAa^F5*{1R9%?OMji+s@w_Tfp<8xn3+{s`n$KKokG|~j-O?QtC6_r2D1uM zdOSj-qFQ`Nm_+h)HD6vSBtfx*=oOYCNJ)lzlc{O zb6uvGcf_HNu9ao&@@+3$E$ol+d@+$7Pie6zub5CJEcCZ$#1Gi%(kG>?O%ciB-y9vl z#WGC9CS9SfKp`4ta}7u#xkG!@);toe6=($Jq)Fu0jC3uqnK2L-V1d3+0+Cl6?MhZx3u(_SxAP?P9UT zZK=c4K@G!eN&bErdl9m2W$!9mzE$)B8{lW54<(SQg(62LE9H2;^_z(p!dE%Fn> zw&Ec^g|s3zg|s0yrATR~U~cGP`;y9D57eoT{gCM3m7t28bl783__U9vM50QO>1~&9 zln|6jBg0ic%Yi~{dBSxK!+?~ly{fzqvsmm&bD5IgOt0D6@SXa3;hUL3p zzS&ZArj4N2aq&Xtc_=n*hk+}V(WFC96OB-D39Y8J`)XB`1^=0c$*sLs$-GidR?E{L zFKe_V!~+@M{lt^GifXJ;qL{3wB$W6ZbpT?Vyis{kX^NZ<`|8|%K(Zk**Tm9tWB$w8 zuj>Q$6tC-3i%BNiO^MDJi-h|408*TS&FF6Bf+touzvTPwyDz7+etXmN4Bdp+gTu8_ z$i6Z?jD6OW?RLTof}+}!jSBmpsq!0~D#x@*-=J>{=UsRF!sDaKLcTVT z0S#56t-2SeYx6gfF@ZU z#1SO~rB1qrRb7QUv-ESD%o}1vB%RQg*kOo|==Y#CYW+mzO>fB4X$g;8*Fge*M~c7N z?8)eevP#{KHrJ~%$UtEVY+!iIZ-h)*1GUx8VxByX{*Mt`P3k>`zbu<-)!6ZV%yNoT zZ2pGzg8b^lOa^kY22osEC^&$Dddh!kd4kHs%ir&I2wITkgSmg7zL+1+1E2-`?aq_0 z4e*-odn7jy$&HG3kZ19c8r%AY8^O#ho=V)D$AoX%_R1pIW(YQ%kn)uxc@ zAC`4;W%555_TbQ@iv=SycN2A0#3zxJ+zMVc@n5iv2-7aLf4tj!Oy#EyP4b((K`%@0 z_H0)L0N$KJ{+uE6Wo>O8qg;QxVyxEn_4}oLr15m=v>qj(vX<~}G##{ixidR2fHTR& z#aP{sA3&XB+MwE%Ak3f_)-vm`cOglXHog~Ss=%5d+x__Ud9bPZD$B$KiImCvA36v7j{RK|CLyi>xKRl*{k8qiP=KNe_>h$g9sX z&`8e8T1)h#7hBko_o&eNm^?8ODnEh=0jP7}jA1 zTZXfddl{sXxWeLmJrHghLllHu&`M7YUN&cU`2I|)xSzFxlImYx26D7nW zS3+sI^Y+1~Z$=G+=4uKonc90wW0eHz`e~)Sf)SOd29#C(cvvdgru^5kdM5u3MnJj0 zExu8<0)7pGuDmpzCCww!LdOZ;}E9f94_eC93 z^`z{+s92aBgNRPgh%^1+o+Zrmp+km28zGKt5r3n?lxQX2V4rl|{Pv6HrR6QYY|+e} z5rx%DJRj9v6Sq}WfS&_?&jkPYNKLAfxj7rB&z-)rck%j1&zV#`k<+j@)BCHz!&$sF zQgwDGcsvtxLAos<-Rr>P52FI~nJC>c*<&llt{Tf*h>vLTk*_aW{2Am;)eItC`n7D) z_Xkhohy7LIJHj0K0`Y$0Lly{Jl-Rylz9i>3z4*Ueiv1ypbIB#KE%2Y2U4S4($t9mC za1j z+S7gbBa_D4P9%qR!V=k7XyJ9@E-)LmVE3SvAc2PpCQ>XNvL5d!>hBI&!FR}n>wp>6 zt13eC3*X5a;EueIDqr7c59h0L-XT7RCcre*f8rNvUXygl8W?7h)z_=?B4}9^&Wmze zG?k^>FY}R?i>Q)AYEdpp9&+L?3Wycf?2b7?wO-wG3bm3paL>VoF)NsuZk7zvn*+H6 z1A)#UTpZwx79FirE3GwSP1_{N@#d?=35GOF;$nK!-D_i7PGfXHDG&mBLlc11PV9Oq zdUdX%!W>LNtudq8I0MTNjhW4vU2tYlW8G~T)$Ghhirx>c5!2RzwY~2AKwq*c-<_)+ z3g-BsBjrX70#wnqxln`j#hRDXlCus58Jv@P+lsogi?F`|cU}ZNb~ok4VxRPprPdAt z>D7!LhIwa@w#a(G6^taN2?z*iB=tlU1}Hf6ETv?WHC5G?w$Y^iOVU*ErR9jJSa;X7 zy|E@{(UCZ-_uAoiv4LEFWZQk~qMsL_QPtYf6X`nM-8R{{l2Ju{lOzH1Y_;PJSH$L) z>ATj%D3)ba3YA9nRu&k-x8f*$17^TJj{Ong`^1SuABT88bA0pWfvN5A(;?%b_P81< z2g(8Oz#;H+9GfScSx?JU9E~!RXT{KrePW! z&Q$@Edm?Y^LxdnpdWj;^l4rR_))+d|Xy7!Ux(W@*;R7q7r$2kjN!1M;I(aEM6jjWoEMZ9n+NWisU72!zig2X7<@4 z>cd^gp0>YH4@t!VNJY?5$gvD4C5k8onBO&s_ImmvtPvXMi1t)~_5?tChA#u5KoW0|C&M7~gS0g_Y=a*E4z3-`XeY6+nuOg!UAuRhAFH=uLz#u|moAM@V_MQoiqlgHy+be737t{O?w@ON$9I z-V|BDI}b^#K6Cfnv;D*lD7|MUCfbJA!5Mt}L)&YS6mQeCZ3jOyaky6L^4xf2=0xs8 z`CEE-teeT-nAwee>cvfgTjk*4HXr4VtuA{Ld(5^=dB zg3@pmEcET|7Ak`d6+;mK6?%Kf+0#U@b{qA)GYoqOJDnk$QfUjlQGGRdO0%azsZ#S+ zz1PVqSRkJrRtci?YY3vpu~UdoM@JLaLpaV=PFIRRtvYm8RSAAF9w=&$Z%m+hud6k4 zeU78)t|R&FeH(L=`TpL7Hu)amh>wZnR%~+c>!jdZ-oV#LIC;zoxX5q=+|;qDBYpJH{?VHIKajgGf2?=&`2PG+jy{^( zIW##m2w;7#aU_|mShRO!SqK?aM%~4tW(u)arkdFYEuYe}~iXqnThLta8*-Ki;de+LI4dGGC>TLjzi1i>T2vLa?NEVO+ zXYtux2{-o+xLckems7-dR>tz1L%AZMa0U(%3d1shQtHUjcg*UNu0_8LbmT))#*Vq} z?o?auYxv)>)tH$GV+b3OCWn{9WF)xB{Hm%N!mv>}c?5Vigv{F)>l2wcU zL%K6L2GIol8dkr}>KCA2<4gFAMx`(!?+M2g?kpmcP_XK%x+>wVHR!sCtU=SW@ami2 zTfv{9T+wmz&Q)nydv*dD@G$lxDbnOlLOk=q&6}I|w?G{_7mo`ev+t!hnNdQSNuZsvAS=7t%)zHNTNYSj)=>RDn(x_K< zvAwHRizTuE5Ylq}d__u?D2#jp$c#~J50V)kPoP%?=a^Aj08T5WOigOA*O+hb3rGtZ zwj5nl>`FTHizNwQ9_(#5=0(uDxPXD$TT6!W5*zv5n#AN2{{ZJA+t>CF@Fm(5AW7R_ z0N%V#%370EPE1s#JRUWI+nFt?RLcRhE^*!FDhNndZ?@$c0LWc^n{ylTL%mgjmV9rn zey9whi_BL7tF$NqfUB3aWbZY-y8wV;FGCyhBJ8KPB`=osWL?T-?*!oQp0DU%6q$#V zn8*ANG7mslw9Kfr{XgW66&4Ytm5M)5pGQ812a!IU9e~Ranw^0FR=abjrgyRigOXO@ zHLIY;W8OTR&DG?ZnuJ8&**Ab`@$M9y2fnDKp=IcfS141{{!8kQs(1+6eapH7XJ z!yi__s1vV2@oSiJ#K8TgJ|~2nW)?J}l)O8Z68d&zU1ahKZX5~x7wV@<>z%uCNy|>6`_-`!u$qs*@v*_k$h@vv#)}_uQQR28?~YiTB!CB`wh247OT)6 z(AvRIj^stDfA(%<*|4R^xAdaPTHMu0y+aFiB^Hn&U3YhRMwknx&}&}C}@R0vbU=)pz)VjTRB7ylsD3-zlR z__3%lnXB--)pM#?Bv!jRW2dKN7to#f{MIQlKmUt&&p`5J*wu4o4VZi3t`t zA6L;(Yk)B;^$o?y6~O{5G`u!k3VwxY7s8QHdyU+!0cU#pmQ@Yg9R^EB{i|Iw zZwmHZn0Z(vUYSr}!dG~0<8E(be{^b>ry+M~Q&T&kuq9$qb4Qn}stv`J0Qz{G{CBJsXg+r%?|a%k z3Z)6A(_y_ZN9$cf73hFvU=stt)+NsbhODpB651q>A+nuczJO!|iXPII z-I;*5&WVYE0K7S?6az!F^;MCUks|s3B>OnDlHFUkWJ5Y(DY5wF@gfc4C&cRQ6ZIwq zT+4t9z5RQ;vs*j8v4Ot6NHK&Y*4NV)D|(183nB>}cyvpp+F;glyh#K7ct)Gi-nw&W zXDk!shHrmz+u<+Y-lq>W#||i^4Li!hUr|^|d(UkOroEO!8p`rv%lWavd~0z_sfSS#Vw8Uv1)HehcPc6Cu)6}ecg`gSg1se&4&b0t zURo(IIU}VMwk41sM=6$?OUkI>E!;KB7xc-GFIiDP-Yw0EMz$D<-1njW^;dVNl!qS| zJtPEn=fdmw7@fk*m=F83luwGI{tE57A`64)_GzUb7JNzrE`_R zZU&${tMb5#3$XI^oQ>~CFnlQ=m*Z^Y7$+(HybU%wBTB6R=)M)NT4__h5vqq!QUDQw zw=IW_v9h@-4u4C~A@3;W@5QT{Dq-!D9f?*RA-VpZ6aC{}nR4Xdo6aC&h36Qu1>F{})h zUx7p(f~bpYFu7e>sws)~OF5??N>w%+mQF%GNCJGEj(Yk{P%V^@3AjPRB8r`oI0Ev+ z9JnW%L@WVrpiM~6lkxVgxP&iyNfJb1>0ZJmj56lV?&$L-tV#+eStZK^EWVUmSJcOh zMM!fyj;)R>R9d}33ri2srbMov{MXAF2*VNF#sCKerJa!{HSkr>f;SB>c|DmzVcsG1 z)zTMv8?W&eL%;fnpYz=x~n7rukgRV{}TRzrMh&=G|b zR-Y##m><)~SiN#?doXF(g+u~_NR}oK!LO#H{m$Ofk{4R$x&Wq&6p!NM(!VUqKA3>5 zytP$s{=zHItpj{lRG%ET#K+hV*-3ZSP1I)*cYNmuy=D-L_8#ptL z_g-EfL&~mNR!8HNlAhpp3o!SwJ1u4MMmfDvI&Y*dz!j`>qcCUXXxrswN~CTtD`#>Z z{~J(Pc$_&kI1ofp-W>yNy@|&D#E`9wTFO%?XXJdiz%rEc(?P8RRo!-+9E6I;oH#hp zfqK)4OS>zQlbj9WYO2VUbQ80@%TXpc`a6<}0;G0jcQSJrMTo#P8KJT(nK@F@SYSE~ z!Ns#fAM9_O>aOAwV}pIcb=UTL7Il|EW|{7C`IW`_^tv@8_Ebl-y1T*%l$xQU{s*w0 z#^w>$ISK3VkE{wV$LtjDH6hpOGc8}zucuRaN1^<;*!xEq$8GZ}Za0xI05Vt_h5bi_!Ie;R}I`SNX zqq9ARM-6yP5A%+OHF#KohgrM=rL0^bKlm?K%nuHY8+S^DtI86OdzU62|1zP1`H0VP z*zgQMr)?g`PjLf*d7O}=X5rp68LX*NI`Qe^KPl}AJ|}VmFzpFZii&+ZX-~+XHy!@M zHHZG?V14HB=MRHp!xtTG`$m8%<8!p{8_DhK_TvA2@Jn|McHT614LA;fOv$S7w z#a)v9{Kyq|NnU-EB)IdfHc75Pc30jc`M{=VcSkl@Mt>%=!@$OdhQ|^xp7)F98nj8W zH`0A$SKCyB9sk|6U%9=H_typrZAGa~{jO-*-B8gMGY{SI=p()kuU`R<-RFxoTUnnp?4In<}d^ zhx*m6aSz2OA$;rujc`u}KMd8EmG@*6w`3IWvnNsPt$l!RL|Zb@y-T)aET(>V`!==` za=ORFmO`Y{+wb2T?d|ESfOQ5ttZH9D=*#T9DvdZ{Cm@|9(%|n zjH8Asaj~UUo~4%U4p>PZBEn>dPZNw%p|H4uW?NNVQ((C?40SYRTv}hyrJ+ci+$Om7 zN~Ka^N)9z#dg^j{czbQxcb^LnqI)RA)f^`D^J>jSj#+oGr_C0>VnTi#9Xb>fAZO}DM8TGvx0s3@3Q zJ>I^yv7$Teh-63CjAbLS@nhq`TvN=hZ_h*0$7b?XT1r%)EvZc$mLZunERMl`~Qo_4+GXR$~%2=>zm3 z>;de5q^w$v_)oE&*hT>J4r~Vh>m-j=%;T0Kf>)+*or$HN8J405); zc)=j8v>K!kfBxq%{gsqlqxM+ts3$K<4;mi?m>K8Cz2g8g=vn(}o)f{-de{9{1kbZ^ zdC`_r-iwSWr99^?-3J)gOFCcqrtB4W`w`3WWxgtY%l3?3VfmjvKv1m46Gh${_c6`@ zbI0FkOLoShT~+pgO9AaTrN3^V9LZNFk;Lf!He1{vSgJPOzIy!l>WW{(O!P$uk?a7_ z3wpJhE4l#6cLP@U#2uB%HmcXmb4q zdb|O&8~Q9kr%6F8>80)#3D#F}lpq*UZ_w9cJFpW-M;h64Wn=tqO@EdZGdviIzwyu$&x%{aM>$yIrA zGAH$-6{T(%Aulq0MGXkL%V1AXrY&`J$92?+n7I^Sh5Q4ZBEtA*Fbrdf z5b;m2s5H9%Q$W!jQnbdYR0j{O_qf{~=b)6-kah8n93Rg&*X7`f&gsywQrg6N5y(C~ zg+g!PswBdQ7BsDk=f&o1T`puoN)l?1lq3}KjAFFP>nOc_D1XK+6gQ_AQg0KI4*Q#r zymNTTRQz4)hhXaXlnfUgfXk`)s!0^5tnJh~!4Fm!UyZHGb>y0xy}7C!k(<=T^L04` zWYo~`#xe$nw0vP&atB|4uKUs+aT#1tr6&a>pa@Y z+ab!r;oHJvopoVB2-kIv(b%3%#||DlxJQ-0r|;I>kz7~AzA3*4W&)v3O%B5_;xjG7 zrG2jw{?d|H2w)CMBx!yxbLkf`X-6I3qsoh=uJ>%pi+ggDeF&A4!!5A?v!eU}DepsE za_P6r>80P!&e@e&=WR1o8Tw1!e|8H+D;d^|{O}&GwD;EFlRW#CW!Pl(zQ_vHq2PUQ zNgMc!Fd`t-;n%+P?%gXe?c3z#a^gW^6}kOoiO5VKi8v=oM4Bi{M5Y69{yu3P`IM(^ z1PQ`@>3zC=)6@HOq+=C~!s@Js>zt=TjtMyLSauBOhT3w~xp>^$Sk*{0j$n>_C`UmN zV3t)ySpc+4b3K%th=vgHplY%^P*-kou`jHVZv^6?F*JgO9Ch**?xLf+*#swJ~X8CAZTy{rCL#amG z!XL8@u)v%i59{#=k4I_T9|ad${dmxi`{2iRA0G7KUUb!q2fcWN!>{$>KA4_BsW<0* zUSKc#U>zhSP_lh6uLL}U`0~O2HLyr)wBM(;_p65%YrcSgSbQ3-EXJk(s5Xv-9au3a z?l^<_aGpjFQiBJT`jGMh#sRy@!kH}<+ALe?DP}-)6XY?RAc?|7lq=F5wdttB3lt42 zK3ZG>qmn96I~5Asr50<~sUOI|%l6euO{7 z-^^2d)*$5gn*LCK(}ybYO88wRT-o4_LT-2Eb(KU9xM~?f`s4Q@%%?B3w_gM>moT$f zuu3XfCH+Gv$+|lFIo`v=M^PH-Ia&0e(Mp^|4>5p;ge&VS2?CHRB|QdU?E5fLPJAc|wU(&cQ(@DPUnPhqNv%ER_C&y0;qO4U z0sYkJ2a4y92;vz+X#hOuF(`;15co@k(&)2WT@cf(iCe@o@qVT9(&0s{b0$`)21sYM z0O?94KspSLgVlJg#WO;o0u&GfoH+<6AcZ|4Q9w0-f*xj|fs!o=WmXygyJOuS3*vyfWA9;PYZ@O2Jm_{uJ%Ir2*k5mU0oIHhb5!>^(7aGRADStsxAf@ zN8%k=#kjorlGLHa#Mk7Ci9^fMhIT285sy1yR#QLx0i`zkovx4`SK`*fUlq79;&lZ~ zD(d2QD3#vhaD@znvhepxol!%RFvsT3!bf0wUs_|-;pgyA>x^28WK?Y7BtF8xO0{Ye zSJ(vQTHyqF9C@|n+ENYxi8?5g9C*xuTai1_iidUeIwGRP?Qof{$&T9^Ay{p=r{AVB z_NxY|5o}O)v&u>w=;l{b=|a}X3hQi4Q-5f*h0*Ot=j8l`P$CYGqVo~cgT zy?TN(&hWAuKnGpJ_@XLvoWG3oFOWl)hD%~l;vDmd+>B=M3_ zO~W}6N{T5ABYr@h!{SnI^DkjMcvAt^jtirDpDEC$R@tp2lp*~*PMo&oxCnB~43?6N zPG6jcHL4w_LN?gsj0oD$5y=fR_zp9Sx(VV3j6$cl^pe>DDIR}+;bz_lt2q;tTCZW@ zwZc*SQwm@Y^unZ~PM=>V2sWPB=L^Av&5Taadv#Weoxk)j%R4Xv>n6TQWN8PMz?!i4 zA)SpiH_hW~=P(#)J&#XiU0moPuh(I|-`F;^g^2t9YNev0^k2)R_qqC}p2SwC}><5sue=gR(@n13X=i=g8 zdE!qZ>u~$*q3Nc|!Fo@0Q0!W*_0)tzEeW?mYtS|CXziZP*zX#THir%A%F6a2@n0H^ zT3Z#036<>?$)1D|a8x+82D3ikG@9I2SN(A67LDK)B9UMOz)A$L`Y2<>!dL^g5y493 zsXC9ZgDye*zN{WIdQ`f~r~I?F1G>XCC+QybjV9s0j(z;4E3g> zeX&5=!;^pQogIyl+Utd>y{0!fKm_lbmqWY-N@*H z9IKOZ2cJ^f>dxbnz?4bg_hxy$=YUN~MxPR9(;v~4(RxP8VqU~1Y$QaV5`|e!`Xi#I zoS_C6FR)y)coNHTHmaR{4oi?mh4bTFGOMo$`xOsY9rQmUJW_GUd02M{ ztzYD&jU%t6FGw2>OjU}9#j1l9{zt?L0sKlW(LzMIOTDxz8^ShVzm_~YV|X_f#SHj3n9_RiiF4I)@Dp;h z&f^oOSZo*yGY7UBUz?4Fs1un((XkU*^Qf6H=kDi{ELjiK8jZ%Ay}y3eyAEG>f7Xk8 zVZvO6I_JF>YmZOoXC)c|#(Dmw>3l{``TF8dVP;P$)#uA7V|cbYL!A)81I%M5M9j>C zM`$#;`$hDWU!tefXYUu`a{x(saV=T)AS*H?Fp$EV0 zwk^+^!CHWyI+X*ae%vZC#BsWj?D` zf3>N>5p!spYMpV1Hd&XtJ768`jyDB3>L)hA7`G;KX}eaVvhW5g!4T$fqd(eJ>k`6s z-e`wgo3aO*EkY)q%GEd++WN7o2E8j{s;cE(!NNYbo1h#KA>ie#UR1x0_%?A9n2}_; zd@^c)7<6K4K+YWI)JHA4lkr*q0n1_fa4|4DQ(jI6w213YilsKiXza`qhdhMN)uOS9 zn}9N5GJ*-Gp)rt)(bDY06lbC2`l_a}v_Sl-M6HdvzEq;{Q1QHc{;7xt+a@wVQf&o% zO3-hhNbIacy#oGY@NyVgujlH2P z^7Ah=XEzr|Y_@Z>)?bzM`IA+?#W53BM!^sS_;aqp?T%G=+!(R&L;SC}28_`Ur0Jk+ zCm2eJIFs4kLUSjX#z01(GQr@m$radN;$e8YAztkTjXd z5Ve=RjYLgb0X5ZPQ}A6n)L1qCURd1>09*hsb_QsPDtsQ+ID?UxGtLA0B3;R3B~>{? z@zv!m%3?K3stvgUIW;WCYO+Q_Ahxmwryw}>O8R@tX=;vA8SE&WMyY$^+iFD_aU}}> zxdLJNf5fO5627s*WO%CZs)3W<82caa#$^%i>*iGa0rXbI2=@ch8>~o0|Fe8ti{n^) zw#=#ID`4L3#SS7)tq*|7_EfS(4++JI^@5q#q|%-2nDw5_%(m3W(lfEcmNMwdagM2% zGvGf2u%!d=ZO3fJds19_!?H-mt8nr1b4XEA7@bhs+xrT5F+@$Zb>6Nh!`Y2y2gj!C z{GBB>w*>;0^rq_mHC9JWDrIe2Rc*R5t1mw%tQzpIvnJV)a)xc{VC#6JOo_(;v?}Eq zSwa1xT+?Ar-BXd-pv5~=1dtS22&EbVjV_{lN-S$p7Dsp$Xe_=xlxW8wLXF^6>l*`o z(IOCR0iP|srKWkjdWkgahp%+vvR6Vc10-1w(78SV-o^;DF1a?V3BMQCD+5}lQe}IX zn+<$evKGo}vvRhFfznI|K3p^p-a1^bp7=y;bOus)ebad6g!T!+uxln7eqBUxQ z$5m^{zjn=xCn7@!`nnE{RmKJn^hf*Z+|Js*%8K4v*Csex5&s+UQ7~F)_@gC52gY&b%MBetvT_!imfJe8b@>}D53MWV;&NN3eN(Hw zvLb3J5+JP;c)z`7Ys;dolS@Q-5cz#Fa*usc?ygRje4GN97@V0u)tOrAGE6 zTPI%o)kG57I>0Ib?|-BG{>bV-!wVIUOSSu36rt+Tq?kBF$PWE-?E4J<5f245ERCYagf#(^Yg01HmmWv3eLzK$(z zwnSyp$#8<+XOqkWpH2l(2MqY`0W@6 z%>s>Gbs;kA=gjUI^WnvKwbw348QZlH)dg|!`?nFLCb64T8XNyEFz#rD8cbgt(58fP z$zrVt2aGzOzyfRJdwQ#mr5Rdnjk*e-S;}vHo~T7ZDHt8B_0vgw6VHRUXqR&NehJIq ztIv2Vy_Fi~k&kw-+EF>6#mA{q~|@keD79|hVJ z^RyxJZn^cd#6p6`KD>rM$*2UkkK3|(m0GRV3^TIr`(ALSey_K}9%d+pCP-ee0;PxA zxCswK>*qbRf~F|&=RL?a`h9hpqtpgO)88a+qD??YlPWYT0}?yC;B2A~D9PB2Wybqd z$;2;}Cy>ft$qh8#r^<}`k~*{0wl8xs2}^uT#7(wcEE>iFujAvwi)k1TGfO!8>_~=Ye%+!Xk3rGJ_8&zW2--eF`7YEY@e$ ztk>t$+Gn(fu^DNK#BC|N6lPZ(n z=?s`v?cQqP*|XHu;u(h;3; z94@|@RMxdr!VHxyE7mZB^~?|sm)}=j-*x#*N3Q(-Wgp3#073DSsXc`Uv35fs{Okr9rpF!@80&QsxfME(dENK^hd=9f>K`>h@lUDG9S=5?&{C#tR zI;B?4+RBbbj7uPQYx zMF4jG_P2qULt)vtrl8P*iwsMD^=lMd<6^bSHy}6Qe6OMz%cymX@x>%naA%v z;}g6}!8DJ*H>*(z&Ka|kn^9gvUMnk(OUwC5QeIWo%35+g$i;sf8puV@OIgLXRb;%v z;^J^>_@^wcbK9-JZlO*PcM*)x!w=dw3@5F-j8V zU;g<;$+VhNl3A2b+5Yp3i!1(;VT+FyHz^mMq%O)^DhnrJ-;@_0r0-nX_jRc69n1RO zafQAID>IE1@l0d9aE1;w#A6MOpzjM9fvXn&7yl`}38=a;EQBI3>5yZXhiTV-2Gf$B zr9)YC4i^@F_CmP=M}|vVN|&nW_*a1yYc@L#tR7dG15QW4tk5ZKQI98PRVuA9k0)wV z;zx_S638!W3>umN;_{7*FYZvQ9dVy8VN<$?7+O3naG?~ z^A%vcdoeIr{zB1`I14Xk9k9lx9bR8zgx6ka&=0YI69os);CjXwbUOS-R;d(%E@#-H zR9eDLS5Q#mb+8%<3H}fZ8eT=yYEJW}*A=m<)z*m16}72UwkV+Kio(zF!`Lq|2j)U^ zmD=LO_!nW$jMM5Y_za}A{i5swV_8Y|HW*7oISh0<{k^o-Xfx_9DxA7gZ4KIOL5uo> zp4w!>_5x%d=;XzXw>Z4e68AzazVHkD{p3Ty=1NI$IvF&bCq{r)j}gbts66p1n!{2T z!7vbHm=80qHRPKOnh~@w% zU2MOI!l59V;k7J>*a=*|!swUa__A>?KfipuQJ-`HkfdFsu_pj_9|5C02(YWhV$v9y z`Gu#?YVcvekwX|9VEh{p)ygb6ga#)U7%#Eo!BksI68;|OOC@{2FO-87W; z3X0VlwahUsrvwi+q54~%g<9e?_5F9y|I?%z^l$a*DH8u9m@=H;S$dNG94rdUK)rqh zm4^iq1oV&JS9p*J(T{=tZ3u=u+^z*5fIeB7sCA zo-J(}2jlO-=ZGZHiUDmxsuRVk^ArZ1Ll9AOlsYfM%8n&(kA!jL#!edag-r(V5C3O{ z7Fef$kGMVIu$$4_0UmmYZqV;Vf+ep3TKb1D97yFnMG!ZECxxXdy{!66xD#7^*hxw~ zk2_CZ>3I}kG``txG#HHJHKzLU3;#<@f!<#Mct3)P;JqHg^UP<7 zn=x(q(_G7+=DNbu1m?3A?)403H5=$>^k$+y=Jm#a5f3TsAz}*j{3>|TweU#`e=j^p zVGCC9q)If~V65tQ6if*qJtwQiRJ@9?kg6;-f@r=NKvn)c3gh)}w(1QAJ^63EzVK4O z>kjz+$Uksr;nVp4(C@_plKjY;Nf_Ef!mU&!3Sc139`&7oD1a0}0Yr{d@LVPhhA^89 zmQvZ;B#9IUi4^faY@Xh{fyQ+%o560>koDt@PETgM1_#D~U~%#Uz3sWe)Js1otpBz~ zucm>bOYi#b4}Ug0`_mtNZ#Ts-B%?z5&W&J%zX2okVO`Q(Zjj>N4D!wpcsv6~YJg=Q zVdxEJS4ks|r{y8T3yaju79(Wp4Ry6dNfQ+e_-~wzWA&uQXgAnhTAbdvY11Z(;GGt; zQ?DR)A0=$FKl|Z#chL%lpw)WKzvG|&!Atn3pHuQGFj|JXSQr80{d(bP!a-k$c_iKA zjO|&@{tTpyR32%Lob6eWqwLQ}v{6PKMHcgwVv&(s+rjA;FpXePs||t%#~8JO;&h+< zBs>=0^f{nkg^9yZ4u-erz0TKL7|w!f_Z6PT&z6mYf7Zr5!z_-&#y>0C815O7DUAbV zkSIm7F2=Q@1OjK(28(7v$HAiCpZuhBT+mny>eo#Uo^|;27LK7WIK6rc&#-!j5sqPP z;cG-UeG4`sRSnK++uL2w8jXtDpM(c~qCjIo#qC>>-_+RNZgf2>g73q%KM})6#deQQY?$)+?6_9)U^eSKZgTbGu%VzJ1*YC?7H&1iWHenoUsN)2Oh7`xV{4f;Ss z1R4=g(hu|-Yu0ocZ3bX5P?S=uh*|w+H6QD)t?iESDznd0q0}jVf{<ZDbCkvl>@?_y( z|3#%&(a@S){rM+PZ=9Zc>R(sWfLv%5%yoDp7~PlA=+cs8^5E||W#+K+gaI>PG&tex zDl|MWI9?hbxL{4ag&=a1_?In}ot1AliBEn~sZ-G;1%~^tPtAc5KDFS*|C{<0(2?q-c}frL-RI9Lg!5|K zS0$MQU?(losno)GQBB#tS|*ra79zAL2N&dudptany1cZ;?_hKS&slWL8#_=nnB8C;kD+nY%khBt^I1St2F-bkx-^grlH*@x(VQ18 zlzOFsz;Wmo!@YoEia+Kz{kK}HRo{L)+`UMFKmTp=f70u6x_u7naR%|Gj&Y#b_09zf z%yz#8v+GURG&sKzoc{)$-;B<`zTg6~`$cem3p!uF-~uufp5Kbj*Dg4KJo_0qzYU!q z1?M}_`Rzy_{3qgZavgmSuqYZ3N9){CPb6hwIi69e1CUe=7Rdp%>hJq1RrqO1A?0RE%_5tE%@v%ABQV&C&}A_R(sIOQ^btXq9I|CdeFzEpF*)hY6T;4 z4-m^hxzsAbm|BT9$bX{_U=5N7@GDpf7#SF5#1CdQ&UD)MCtby#X+Z!Qb4`lRznD*_ zN}e+=o!0sOBeH3Wtl7&O_MGJ?{@=GinX?>yS@x%Qr zXEhjXI@SUOwbf@<;^bYWqz36M?i^on36ZU?%E!C>VWi^>ECU{d0RyO&(63NIfK{8Xr3dW{DfAcbKIzo$L)0Ja+2 zgB{1-gNcZ@RQ-o*-PhaJv)nEk>iE)DuWkF123;Z#XBS zJGwJcw!!XUZpZ%>x!zJBS~0PQQJyu6#*d^=SlY3E?C$<(Cd5}vKd@)=);00)>f5LNqw6+Qn!HvG%X@5s$D}m+s@;jM zlt-m9sDZTCcRfn)^CUd|+glvwWN&p{e@ZwK=-$;8Th*6! z)b8Fg6-sx-4275RH4WRR*HzX}4)p}uX4ln(d$+eXZ`-&b9h+LeF6!tR9*qT6K=~n9 zPHSrvcW;UYtK1qwVYS)ZoJye!v?TpaF^dpu8`(w@j>gvBc&sOz4Z7-LR!5@cQnYq$ zdqD4sSrS{fZB2UH+q2}IGXAIq>Q-zJ+lxb1F`F|<)en7*XuwpM zi4d^0SOuQXs=TVTUhi5JS-)kTXv&(fP^h(YPttk7Mvp1_HvBJl&5oV(xb{@v-s*Y0 z?qus;X(#B55Z?fQFpdUo0OL_=0KFwsqn9Z`Ske=>;eSQYS0C(bPVC#;3cEWcw(ga8 zf?kMA9bSPJ1i@0$JrON1EObLlq(Ci_0x0|UcmS>&cCV{8aQ;k1 ztgXU)ji-64dFYOs+RbZ5LWyRtw(xyCo){k)3i~@-8*H88a7D0VvMxR{G#u-{vp2H0 zA)wMKXhNaWxF_D%-dc?-tyZIrS1Q#?cSFis8!}a|IYQj34I~=FR3YSsCZ-JhK3>eFye1_6YWxl>KAZEyvbTtM{%RypB6OPo&Om zeSlWAQG*{mPsFjkKpw?U-?@G(V97VK8gA>}J2~#oy<4e4$9en}EP>VHimcUiklytG zdGJ`9>K1BU1pKVO?@tFG8N2Q)xDs2Bb>JExCZIY22?4HoL*!X9ycAd^?J5P-kdbKu ze$*EU#cNkM@$viK}JUy9I@ zB}FZPeDsu@B?3|fBqFLNO$i2>ik9vvhJlGiUvR_X&KZ0O(Uc-PU@#6&n_9LWYp>jO z=xB4phW6lwFTDP-8^8J3Y=6M)5VQbpK#{*DtJTD)jRBvnddr9Y&!6u9I$rhSY;<5( z>*U9?j)=pkfL?MOm_4p|oonp7NA|sXUDvU_t6O{(y_;&X1JMol?_PiNc<9nhY~=93 z=tuinuRpvm8Ei|~@&C_Q(N$fSOPHE!YNq?*Z#+i%`VLJF1kyXUPKE34`Imn?^e;I6 z-o=oa8J{r?-XAA+RZ;b|9D$fBg4=XFe;69 zy%MIT8}91Q39;6ZZH*m!*Y$hW{8LBU(G87>;T@NBP}syPW79kK)LGNb-NfzQOoiQ3 zll7*L^|~@`IXnvUhGGj^=6X7b&0x0!N<@<9^z7}{&^&%1Tbl*7Ctatm7 zmpxHW^-aImumAn%=pd`PJvj@w&jWrowfXRg2)8yuCI3L z$nE#uJQF!If7gKCsAoBgUT5GmDw9b!`NXe3PWYsWkT zqxwK5LXJaLTXX%Zw``ec@%v#B*#9`y zQq_MRe*v4o^!UZBr)t}OZtm-|@>BTKj>unJF6%1nFC9Cqe~s@@{iR|1HVlvlkN(3N z0(t(zG{9m88d*Po8F`#xVF+6ad7x8(NDMNW^lkf35%!Bs;VN=!hb!_I5%%5Df&E47 z*b%q>RgCXwQ2j-OkFWwF;pP7*Jva;`fsc_&^q?d&ge-2Tm8f7*?nqu)AG=&hX9J`U zr<3(VRYLa8@7#a)bN5d-2$q_O8=u(Ub95>L@eHhQhHu;Yp02MI{{BS2tM|GyZ+!X* z96z}!w&DJLfvBLM+6#BJlZ@VHcl)#ijYmkWHRcV*?Hckp@gY3=#=qg3wr$7SZvW4R zM!SwY`uTHf2kyOYYfp$b@~qCP*BW$MwaKX4_QgMbVAqeHKXdQM)E5hvJ~R2n_pYN@ zt?Cn>WmF8sXp9_@S3#pdsZ(w)+(-@ps|;JX9`O95z$*I)wjb!Y!G+h!AJ8Uj3fO2j zpn1qOI=;5G{}=1)nDw>nhF`cV^zQZGC)hO}Tw_@y`?}%Y@fuieOFp!tjSTS4_5HsP z(XH+czYv$*Yc0Duj_!q(A&Po)fRuJJz)wY|gs=3ewBTke+PcPKl%-Gp1f8$~4Nk!u zDYfkF(IcFZQE1saD{zK)0*epW85M!XIeZA(87_c>KT~0B1TfMMAP&yj$3{D-tYaSk_PJ0vnQEXyjq~{P z=dxOw8lnbu@VeDDKG8{8yTIpcVz4HZwGJwkgVt=QhQTU&cMdgl{Ax5sjV9@_U)jT2 z`zZMFHt+QAG48n%3h`7ivqY*m|Cj$k7=|5>cKk|2J=@2AB`)jwDi~&p2nHXDPNxQ6 z=~D@-#Saa#Ey?~adHC%s zlEi)G6)lI3zRiU{;yl3M=7l^}N7W!-V@_I)GZDQoMiu;3VK!Vi#cd4C8m>F)Z9tX(Isv9j=pBb^EZcy(axZ{y z8+JrmBNK?dXKO;>2g}S8cg(51-VETDOjg;b7f2?#kq3Hm(@AC;Z6t;JY4phIS&a0U z19v3REo!lN4+C#HC4#%q#!|R9MvrV8d3UK?L?X0ksL1GHN)`_b9Teofw2D(+%4h|h zf>Lr?+}sCdaclKpP1}xvDmC;@khDVIyzZLLHFs=C*}D%jp_@{g5JLvR>@2!_5Z$g7*Z7kQBI$eEI{)PffMvPQz&3bu0Gn^x_7)$L(u8*gMjP(3o0rNa0O)E6)OK^%bd7Mt3>`+2CxPnu@`Mv-ddb1#9H^j(& zloxQIC{b7g{)02obTqAT%oBa5FpYN}$4)mj(e?9q^Qp@9!Xi=0TOP{-floHU)@MY} zyb`vb6D!x#LOBr?_c?}E&J$SL$E=rK)Noeu$s4N3eLe5_!tTtju{x8AhKc?{ojV8G z_m3p}gV(S1q#{A1)9P^%Zlz95n~a4PUoLp)pZC_B+5gEyjhxwPiuib7+gqI$Z};B* z_USe^NmKR^!F#<5qth6S79OI=`mOiCnfs=NJo#hVi>0w%Y&VjgvDSH_dro7wYij0+ zo^zNcxzN~12f^!}GEQ~QhqnVs+5(z>}bptX1mw|sG5qIz_vlrcm_-UMjJgLTVMdBmR63}eyH69cC) z3$35WTTa{8tGA$vWAf%$NGGRgJN#}=L|>vpVoMUBAhlfL1c?mDn@C#86sj4WHQ?}t zd7Qz2d+8w#OLS*7s+wjxe#th~b*Y40DFj-wS2LMn z6etH8+Txc)+Z5e(sSL51Wz+rTi>f5raf3XO_4USDWbH~DyvgsiUh}Da+dnqj8XG>) z+cKT?RquRs*R~H%Cw(28n)_x3qdz{pZ~tLOW?k#fgYiJm?wUCEtfu#9L%=) zyse%6m0S1i101js$c1?@^HgD-*iOU&u4>2uu-Hg5;DED{Y{Bnm>mdVF!l}l5k}a1C za=rsZ|Nd+NOeicA34s19H?mel|LoS~^iM4p2@Ok=9xvP1L(ZG3Cysq?CN|n#ZBzln zNTH0jP1J3D-}(e$?-*KJb>PJMNUiv(!#8|Bk zq-U1vggr_IxAMbZf^E9!)nqE2XeM>-+-Ottuhn{NH=j#$-!FWhv?XLrV)vbOFW z8`#s~vbLb3n=pv7PI%y3P$zu$rpZSRwKwg1a8f=3j{PEFg^y7&Ft3eC92+C-Sx)cP ztHBRuH5vjNVt_MEMGfm`Ks_ub%7m|Q&S=PjCJbz|s8HE|c5%5fRpVPhT|}`RJq`P5ORWNxQ4R*bfcoiv;7QI!kW}Yr8k#8PX z>g`Y#T?5|iae$R3X?GUXB=?_91;7thH&5I!rxsES0DtCm#YVoaOox%jVIe(Uzu?SpA8tya=1 zp?&?~_NhCkDsA0I*5`>@p!Fetvk+#@BQMust()}BSx2-Lr zyZh@UZE?a|xgeqrmQM6n(iZFArLy=y+mX-h@0guz;uH+2(<~?cHlgk`* zc)}k4|Igl=z{gQs`Qv>|&wX^yecy*PBaKFy8QsU|K5fgEEZ>K0OTNaZWE*qX7z_k+ z*bpEI34vUM+wlbogg_F7Y;c?n2_fYAg)AGA&4!#15`xCRSJmC4kt`e7Uv~eW{rpW~ zO?7ouch##`?|rN4b-l*L$;xHZK+&IBR#n_p>G1FG2VZbYXH%posIKljJRDvV2ZZjL8p;6X}05 z>hF{reCY5z#ngAu?g=_GnS4`X^p<*j36Jhh)|`8Q%+-_MoP`tJ7Ngs4)zE!1H9k8^ z{@%@boHzpd;2w+`R6kh9W`%l4;kCjM2(LrfC-W|?U@E9VYCe;(?-_0oDLS1`4kzm3+ z0BySffW}t69E+`5^-Fx>8OEYGR)LO`0+pPoJ)ec*hOh`p+dcp!m3|ON`Yb5iT??;X z*$`s&@df)H+#c%7lxShnM#@wQRk(6q5_u}7?alLs$~PZd7JkA~381v69YAT*>ZZ)< zMi=?H#rN-@2}*T(l}2aKVpz&)`>uUhfTcIDtzFX+M6mSG6PrsD3rB!x>tReD2Tpa( zM5QJ`r5jHXCPt4?sdY|NYSm*@YP}>X&705C$1y04GdfGq?hkX6l>F_~M-2vmq<_8$ zBrOVtF(9RhMZhgjV?0_#bdth(YnA8_NRI5QM5jR_^Um~ykdhWtQesL^LQQ zMoR)7+9FoEMXYp-Q0W#lcsM0GK~0%%U`hd^x6gp+!kL&a^M^1N_%XmgY=PGkG#-eU z@E-tqc$}>i1Nrt33*^PmR4+vGPuK5yaO;LoZ?7%t-QHfm5|I3QjO0tu0acwldLys8 zst3~99f0NQN3v0W`^L7WH4UB{4qtmc**AFo@_2O774rlvzi?$`+rFiM<+nE_R}Xf3 zF_vEwZA;h?ny;_%qz+7dHs0IZ;PW(MG>>)z7J>AB5Tp4vex+?Dnr}TFLgE`_K}HeH z03MJ<3n6`h@ScYCNOnhY5p~v^K^OoE%|!MEl6y{YKjY(W$pw)2L1SX!RSyHYZz(g% z0Uyeh(WZsv!?!Fgq0)D)&3<%Qq+-kGcQ3qVWhTNM_qVKVYF=6Aw80cN+|$}XerNDe z9^V^{J|h4~Ijh(89Q?vcPoi$)t&4^}xwiwRRYyM40r);qwqQf5eqC!wWp*R2z7fXe z&t@b1Dva=}Fv8cK)Qtj!*PdWDUx@Ivfbd5V!qm)o!_GCHxlGZMg@z zK|22~`7=p`@Da87RbRs?A71rsKII%?&^E!;3rOstUOcHri@wdLv-l2@c`saK%~w2y zg#4M(=(SorCi%a!CN)D#l=8o;3>Jsp>fvNoIsXZXoL+lKNoiab&cdlBpOh*1&o!Zb zD*>m+Bo#zGu|ve^!_zCi*NH2>sV9?WX?zqd_oh!sH}cE9H5Xs*O=T2Wz64tAO#@=z zC@l8Y%)QuKb?L=kGgMNpkxzX@Ytl#=rC#&>wxvm0-B6R- zFn05j&qmOBiokCnjN7jlaeMUzxIL3Gi@^Qw0NP(in0wUxcb)?;jo33b0kZ!c!S&ZM zTpwl3e;3(vCRQi^pRszVHhb@I)#~nY9jJY^N)>Hc)lj>v-tBGM+_4)?>?BH!Jeyk5 zvADHVNi)%wWiYD4=ij4mkOTps zCWKYpgikj?osM;wWFB&9x4gBg5`xWQq!MoS)1|PdZWE4;9)IByPf=<9Dl2zR^)bREOwWE<+1f? za%jm7E6Y@zQK{nW24q;znK^Iug3`6iX@<6X$S*q`a=egWP~?6`(j*yMuoHM<`}yC~ zn?M>>fL_e<>%5>2jp915F=HUqm2br32FByb1m7`?X8tOOd=6VR%wFoX#4F#(3fT?8 zcd~|2CiB<477)sO;KknX3}C&fV*SyT-Ma>A11uNo*nD)2ySX;T$|$0?oR5fquDGIf(t&jJ2WjwZ;Om9i``kq**Wo31&r=`y6tnXMr{=R9RDU|ZKD@sai zr7Lo5xVk)HcU7fQPH%OQ#aV(+!(0TE>;p=shz{O|%Lxz6N)4w8mL;0dsL&UiO!nHh z<1KFlgR=Oj{T+PAa8mN&9EyUhMhRyLQ!kj$1CGnao05F+nPuumIl z-TcuF(fN%LtyD@$WJ*R6u9=tU-PRML%+)R3p=H+&L=tO{t?k$`P#@wRcGvV*q~@h; z>qguS^(m^R>89)VEKRFfR;ASGH72`OqTw`EYp?Cpz)*-U8t>@3Ze5M1e#x$nRIa;e zQ6Nw^KelRAsWStO`hi9ZfJVrMyixq(yb{>TOPMkXwc{ObH1xMw@Gzt19PebgQ6}`a zIgp{`qR4PTbmd)J+P4ojgt_7scWvEt$MWLG?Uf5FoBGT2j`YH+riF2i(qHxBu>~-N z-v7~|tG|70LC-BO9vORJeY`Py_Y(LmZOGmYBl$KMC?$Xnus!z`s;NHQs=R7W}S-p94(>I zA$_v<#z5JfKTnK6t5VPxQu=!e^u^0Mz*BL+Q&RdR1>)ygkYCvg_j5^cmG1Lc^T*$j z#6FnjkAvoq{Xb}aew{9B&>d13d={(6Aj>tWSag!9LP}mO)w@eP=nINN8dGk9%6*Ys zK}LPPmjnwV*-MPhX*Ig6W;L}=#qp|eYO|N>o%$jE>gW%2X`#-q1DzjDMN>%USMxf* z7VG?YIm{xCmo?`vdFzx%PCi(ihg}O6#`WJ6yk}BdS7& z6iYzq`|DRU*RE;_x?4uOJmtj!r1q^8@+FPGvCgfuw-v2EwkAOi4&AV#OlveM)STU@ zGizit{31am$bO($z=T z_Uv3#?bET5)=kHTL+w>zwUi-&IbV#8Rej#i8%ujC+sC4g%7y8w z`Q>JE5IL6(G_BZmeRu1T>vu0s%GElRQe#jX>^iARqpDeVZI>-tws^ch-kowrZ0l}Z z6b#kRLt1_{jFRS=ySW)*H@8vP%}t-O&#C3@yq33LQp*?Y<~BoPnA{kn0X6TBuu}5# zQ-6YV;WAGSM-mn)G|TQD-8}kuj*-HA@tuo=)V9_PBe>}K1!Y^^h6MPPwCWn zoO%fIif1SqL~=bvXE=F9eN|aBD5WDmw2U^rLcfou7js)8Kg?Q2>84k*^ejy;om0_E zFTJNb?}g`<-MY5I)3~a!vOn#JExB>!@@p4Gwrp!$-Q@Y!^3|(WnBu*aLqlFi^-x{9 zuiUz2$JQ;R>Db47EgM=B3p*Pe)|%$NlDhR>(QwK)l zYXnaBxBLok;a0zqEg6+r-w+k}2j9Gv%-+0hWQ*Ik-nFi{yDrQsD5(k=1ooCM+}#x* zjj5)d=$eD`e5I>yAMV*XSmoC~XX79&7 z#TP=0JaJ)>X8xD?p(gYMF* z_+8q+;ANiyv`eeXGwwfoar3l6AGu}Wk&Sgmw^yq%y3GNHXSO|`PUg=ntwQ#E{$d|G3{hjz>-4^$ zqik@zvtjeX8WqJ<4D$AT?@A<$5#ztnY5b=V@!vmAneh%S5L&=>i~IDWvW-;vMr1jaNu5X?PoHN11s`tKP4GOyzwsx z)Gf5mWUY%pL0m=+Q1CAp3NA!@wKMtYL!&|I^a>ER@N3$#piGMn8~~}JENUI;yo8M( z=kbQD$jXoW+}6+Ss9`M@mD=DmvNl$3aa#SYTY4H-H+Ur2&`;;{D)e~I_8y8N$@IF9 zz+6GF^rNKo^Mv39i#`B!D?mYu1r(G)Vmxu z?LWS&X3;@LXaiAUa2mp4w1o(D7i`*~?q4SeY_s({dIBU1ve{b9e~XW{b>1q;{2A%) z0q82l3E9jZM%rDEx8dK)`ZIsVN`3%s<0wvMWpj1v|DcT)_4L4F58S%3Ud5X9F1yLW zO0kXB7gw@QWTSP{qGwDamAMv6{^_Q2^s9F(c~dzS0W^t(L|-QT<0vwf6D;L0N_$Z_ zfv1v;xyfP|^5>VC5KUGxq#2C{Gv3oTd$E@{sx%Mh_#UZwnmS0RcoM3R_db;l5&eV0 zJhU}0AU$y_9{cJ0?+1OeO!EG*WOI$)neIMqg5uCM~jULo!$_j)x{N6OEU#% zby-yr`ud~@8x^7tcn!cQ@xeU;T9u{yk*!7o5XcXBv`XUBNiwy_>1HVzDItRqG8iU9 zPBQEu16X{9tYpYShRtNyM23wdzzATHAVUTvWXwTgS*qt{X{p%?5i=68W`PaR?^DqG zW@kLkPMm))j-Qk|?`0 zj23)6#*%{Cs^F66@bC17AGBAgMXu}poE7pYZ(+^j+tO)3~xRZjy=i=dN=AhigM!6NN~iX9aPE9eRr>IfI= z2p1mQE;P7ZPg6;PfTswk;S4gY$`~N_6f%|K&3FKzm(;%H^^?e)au%>(#pAvh$-W|t z&dF6T^8=Od2GkFE%gmAtm-W}al_mTzPVv(&0Q~4g|M$iG?{A-3srxYYndAeTKD(oq zvstxj&aUT>fu_suZQGbP(3}SQf`KOBWx+xd@bZfo>#v8Ab{u2WZJXl#S9x6 zrB=b4Hcrn>bP8c+QUp^ogF={@2-b~2>F*Hyj^dm2gTl<@*LZ{&isNLIA&ar+;Aof( zE6Fw_th|UMZJ-i0qBeA0Sx(lJcb9K2r(@+Ls708w5?Za7KpXg2kntvlr_o5LL%I)& z)*(EnN5%Klk(G5Fb)$83u#T*opkf(qS%?f}{_OS2D&LBtNs(Nb6bY-I*k~4p1&~m% zo2@7u8!$RDIxkF>ki{F!nxc5RB+pNmF1aLnDU-KK(c&$(u(`yjKo)PRqJ~Au4`A`u zdn@(y;A8jSvZ+qR>h&JG*{)@DdL8;LMd$)Amy0%a$>Z>kllKKhrYf2_z z02zJ~QUcUjau4(GkRlaQda0MFjW~}?NNI*r%W#TZNC{DAsWZ$kAVndhv_qaj<|mM% z6jD||%DuRhN=T`IQfqM@b^cwG)W>lijgZm?DTi^2R!CV$YvDPakfIY(me2>N{gPK9 zg%eWNQa$8)=}t(|3n@z>WhG8ApcFh$ET(=!^gE@Kg|E5|r?dE0{;O{0QWk!D33N!io13XrYQ zrjbm@&@mWNg^U{Smr+Xe39UxS>>wo+iOyhz8up&Aq&5OgEBV#+F9Sv2I#cQ^^%2Pl zswJaTSY9pKuTFh~zLNg{M_ld2wAB<@Ud_U7I`xe#WZ>sa!dZwjZTBwv!Ht>PsMhA9 zDr7Js*C;Oys;Ub#derKS34T~|@lnnsT%zNC8#IbW?i>T*leW{x!*IMqFg z`I$;Pz+^@MQx0^|Pt$Dxs>jFbzWgM%S!(PwPD7Fo-?5?$!@b#xj+`@qurhG0{<52l?I&8SQ2y26dC8eH?|6}6|Frs}2jUNy(b zR62{^?9>~%`YKnMmqmwRYK>}XOI^IuU@=%-8ofrLwiva}RA;Pf1544a@(hf?(D?*) zhH9I&H%~q)uFYPD_U5heuLTYxc@nJP4$@ z$I)5b6eE+8F6h~y%~@nq?^S7YZ&2^PXR$j!A^M;Bgaq2Bvzd%a@+qlIiVq0Q6?w@| z=I~lbJ8;b))dU!ErT7KSA<-I-d?}+NwEnN6@2r1Ry3hKxX%?B~YRORR|0?>vy0r2~ z+0uQC^=pMJ5leiyZ)5~tV$@*iz*tA1IUQC@BsB8PC$kkdl|`E4R%5I)8BW>tI)j-U z1FS63YH~j{#H}5h+WqC3b*%xpmQyNW8VwjgrqgS6{>mb6!lRYz&E!0bQLeRUUEb3a z>8V?caKH+n!M!kY;zWjDi9ZpknjpV)T4}W^%O=R<84IB#Qf!L)V~R{Y5sfnb=ehm$ z&lON()vj54@X^#0S;)xwpU-mpnfm80LJv_)NZx-Bp1L>KlkFPZo^hz%sRcWGEoD)! zT8?C%+!jo@suv`!q<48;$C`TkQLQ%>E}iE#1gk=kv|ksmTGLrnwf-ahiIL&O%^^mv zR+~+nNyEtHvQYDqa-%DlS=QiB2MktY`|?VQIg|v>sDLrB7C6Jhd-O!!P5#W=*O6}l z)-logAKCY*uA05#oKetr{g1Nv)}?Ig1XM?@rD?e&_Zp23;CFg;G#Ss`rcu*UrIh>w zAUlSVXia*(YU*Qhg%pIoMox`;oFMk)jK+fP>x!w5L*IFb5~7|s$ZN|m`8dH6Uh?sb z(ynsZSqSpdXUG$vLaWFV8K*o}K@$NsK>aa51|Bo**VTGzsq?jD?PE0R(^b3Bzl(lV z4TVjC$FipVbnRnVI^VD2=WzUD`mF7Dv$=5lea7xP_3`^}Z`s;gv}|dpDs1$(ZER~> z-{kJ=UcBm&#->c8&Q}o{w;3W0MWM8x?Vi`yO>W(W+zfZFFXoENs(mHBX}7(+J=!!J zEFLCX<0Xk=bHM9nt8>rVA_2d_;0;DBsq!+!>1{x*!$2*BcsGb&TmYvd8@f7(WXus= z#*?AWXUNPG=tJt~OZHozlg(uG0xLR$Kl23t5%u%glKnF4b6MF1d@h-_95Q=lK28@p zMLewbr22RCx~t+o0Q8hfEwvR_hpHB)>@*uLO}aXU>m8x)?Pws_k5R@@Iv7d^bXs33 z9P9gWVs!1|=AcxiRVvjwmEWvVD?^!~3I(T;2bz~8tJZcFSFis_ZS(SKn>mtn`ceUd z1@B6YQTLLM0T1zK(l{j(lhNmDQv( z=@e8T9pLoAl#i5aES%n^rm3g)zI)yE|JaXKJSYhxX*_V~`nI;ihYmJT=-4y43Tn3$ zYPS;CE+wA*eE^^R4MG5&{eA5zon6US4;}uE(eg=@!q+b}efoC_on4;_7oPsTQXfeB zX@$E-}X*1;8bSFIsk zT20z%159twne;lvm4Q^e#1^Sw4G5NUMk8y~s~r_>#lEK2d8Pdr)0YD8u+Y|p#2q50 zKb6sR%?ozb2D`d~wKVdP`NNEtP^Z(yY=TTY(&{NDiy!jnbViSdX+7vMlEy~`_QII6 zjD2$#{4egJ&-x+^RlX%nX+<@`fqOQ?K ze^V-?lPVN)XS6;VDEH{}k;al1nUZ%F+T7Wbs&S=?T~Y~51W1}u1}j^`)r+behCtF? z)KF~xa%oS>rOEl~ok1l@mIlgLgHED0XjMA3TxsAmwpc^R zRZ;AcOYBA1uH1P3U8;e)4P*Tc(^&sT5$hk!=*4!sX0sAH z`%$2Q5)GsWi;5W5OM1TuBD$Kaet0e#6o>A1(y@ zrT&&R^=)e#T<-2GR~Tbqml~NPq1kbg#snZp6Xn$Bb z&=iXGk9W_zVOi$XHL4{tnbe(X59^JdbWeG@#-OX{DYNLkF~kvm;C>x&#PnA* z5=1>YuP)qe3hX%svC@Ggkc*S$uB>(iczBEc}QDUP8&4cW9LXofE=R z5|YV%3ptA*&nPr9ni|j;IlVHcM&e(hP|L~lc9+{qt4x6LL(pdx&}Yc9wpH|-86^)B zMj}WaM&Ho*_-|+`o*^GambK(#8NIT!ieV#Uy04?%d!5X-%{k^6wZpGmh@vq?G;XQEE9DmqG49&iNsz0ri9BHs|}>)yF80XNg!Gr z@RZt=CYvMoqQPyqYt>eVN6)z}+8A(o04U}Kiba9T`5CP(HbFjinoz5WG~#lL&jZt) z2c1p^G5bSdtSBCu&E$nh-&y-$7P5yE4`suk6dsz*`%RP~e@Id9DFD0XQ$w3b{=T|td7E=ndr4li$llyd42c|Bu; z6qArrPu)b>aUQdfQVOM5oMI7DjMO2jfiXggRY<9TJO&0>USbnc5|C1gOWB1KKa|qp zJPsix1bHfO9;c8JfD|uIaiJ7~Jl}i%XY_U^O_)RsW;p*mK6bz$oJ(MkqkT4(oF~Vw z=ty+>d2EJ5x|wGQBfqD9Mr(8$%?=eUrw=n)lfz_ksA;)ep^(vXPJnb<+o( zN746LbW>`b*~n3E>5YYPnlAEqih_QBZV7O0QONIyS}h~a)1RaF0Y%sF=hd7^5M9<4 z3!WiWL?baos!q37c?>eNlNpX_zYM7!sAlqKZ&t9cRJ{2!w9GR3bL1iD8hd5ktQPTR^j5ZT^62?tSjlpHl|n z>4reGy*6E0?e`^%y=sNUq*eOkm5|z2hf=*MG4(^_CGS*P0s#l7cY2(9o7>7->`KMV z6tkTi5i@z6oXurJnUv;0(81~*UNI9|*(6rcACrVZv-$8@^A?>A2Ff|?%k(r{WEku{ z^ku=vr8FENg^3DTi4TUBk))f3M<{iw_kO2TqlHtNvv9Obqn^5&x>lo;)1S3@G?bLQ zoe2k7r(Q#mx2mjVF26}7&3!ZXqD*B9;C*;vH9aBmL2vRk(K}gbz9w*ykxtiyUnXZ-tw2(!i^npWupAlf=vD04bfZi?Dp# z|6@Pp$H$!*yZmv2eI>T)+|S`3V1S=bqHl(=wbdGS+D0SdM0-Q@b=aGv{EZc1al;l59pD zlu%rQOyNx+ZU~kbC6-H8NahnVLPuDjk0Qut6wyR<5(|hWFj6-XJBWS6L9!3iYJ2~t z>|nO~imU6dF4{R>GVWcwA-F-_)u-+wGHsGJHjy%>vR999=tIux`ZkPTos~J4uCzLP zcJH0Px8=$M9S175Y_HsIU%uMCTEA$>JVeztN*k5YxHi7`!1mQcjq!Nn(CY06_R7Me z>-=G0ld^N1cu+Pv@a|m2rT>tqg#N>nK%H3qU#njxj5+s1RuQv#z@JVfDHsv{1&>ITZ#U@gL2=6V)Q)~Xp&c+%>5{tEdK>ukROA{5PI5G z@P~Z1qAWet1+lvmi4^4(GUa3t`3)-e<5VIQhX|koCv}c`nfVV&DnCUa9CJJMJ?ehu z-{JZUwiH=TeUo~U`6H3!XEG-VYj}b@l3_Iq%GZ?tqMUY=JIafFlllqj##6#z0g9C1~Zh19G`p;FU> zUYA;Cv2e)^A6>KVli3=7KoDhPt-2-*Tfu!^)IuGf#_`s6Sy^JVl7tOY!vt zrp@g@yJqI!LH}dl>?at_1i37uHYx}sGpW&Vl1b|Xb;Aj63{7i<4XsIb3e!ZbVJ5SX z$10i3in-7PCy#W|WK}#|o--CsWT|E)m;2LsR-<9hyCY!$=Hv!W$voupyk_>f{JB@P z27{LRhR5haKJBPU>gUWKq0UbWZ8%4r!~Ok?cuiXI^;hsUL%m2g;Ol3F``@7^nBT(n zSMxMz#@EjY*Z)fY0{PUFKaa0(gXjMSUw;i>FQ@*6b}+w(>u(78&r%044Zn%6m%#OY zeEkBZX$SCIE%OJ^tlN1^T2C%L6D$vwYwQ!`O&JZL(Is_BOU;RTJ5!99&T@ho=MB7S z@?Qk;K3lNkQ$Blf&55i~;0$9qk!8k(#irSx0EO}5G2%Jw;j6&sC|<2aj41LUzt7^P zsoH4wNL~FZr&h0^Eh@WO<%uL*bzPQl(h=;c3x-;jS31)1ph_t>t1T*HV`*jD5~*+o zdul`UshVXC9tS#d*vz$ZG8wB=)}`zbw_VMJ)4i3c{z|7@X8`PBY|}C-S2}DDdu(v8 z5_!Im0PPlG+I>r)~6ujQl^*)27`$8$#2Sh#TK_-MZY7Ls{LN0Ri~i8{S8{Cvs)Z4 z6(gg5YfvLo1nN1X6?yp6D5p+Sy#U5(T5UBEc;<3eQpWrm>ilh7XD8J86Hwvz4Q{J*b{6Y&J4Jz!Z<|M08ppkM#1jsCzps?3yl#^naNfqU z#CnNBXEk{JYPnKEl)0=4o+rgWw44lVl#SXF8?%ilKL(~s@zs9pjt^w?u~j1=5ki6 zM@2HEl2ULEliAHFsln0jQh(L53W{W8(o-jp=Vn^YX{eve0L)SnrS#t1zY?^l;|Mnq zBdUojFzxL`IQdm_2?6sV@@AM3mw=Mf5-NLm@_Q9zMTI;xsY5kSPRe&ro3J1YmN#F1 z6GS?Por&n}72(M&Q9+t%D548ZW>KLt@+9cF-4~dz;5pK4f0TV?R9sE7E`(qqxC9$q zgWKTl5-bGQ;O_1&L4&)yyF0-pxH|-Q_dApKd(S!d$6f2(#q@M{bys!OQ&oFl_NKdZ z%he4MUC}n^fXcCxSYBaW?b0)StRj71eRgAZ>4(MIAqnX5q{yFLKiSquS}7`!m9Z?j zHXxN|v5Gzv_z_3iNU8)T-Y%Y*xS+JuC3HK~cKmlYw%J`yW|Fy{Gf7 zkC&7PJ<;cyRH4wxd%|LQ{aEQs&vD@bJult$lC&fP-NgFbwle$rS`>HN&YKL89nuMmCdHch zEarwD%LZHsr7TAV41=@Ebmp^C>(SL%;Z0TjL5q-li3f4h#kI20BXVe>Tmfw})IkdB zlrOKK&lp5SpZ=kmi{~{?r$D$W>F2I5u*olTpod~A6=aPRd|3?phb$KFuX|EDe)~1s z+?0I=P*vqH!rR|Ie_*+>H%S&btvskK(MrAuPEk>6IXa1=j%WSIqewn$nxCTUsO68B z{`Fh!MPzNgY;WGCcYvZ4_XPHEBAn7`@1UrU824Apl!jYwU|?y; zrGL54m=C72)?kr6*%kicxKUwBc!E^>-2VV1wSbwT8jce4)0Cxx$Liy?!VM)JPyF@1 z=rJ7kha+iutvRb!)PZyF)B9ubfCt`tbhtwX?%c~SHToY>;IdU~KE|F)VllQwhsl?2 z(6LZg!FM7OB3%W+W38>~J=VoJZq6V5&=?sL<@+H*KW(Cvrg^|>_5~N`Doi!8_$+~; z>|!w9Ow6<{7+@EqFhYll9M#N35cnXGY4bDv62}fFn(7_z{?{6$nOKXCqnKe2^s{8o zhaP-C^Fq^-z+P0lNGmM%FrpF~Ur+GEcy3J0y?e8ka8huWiCB?~FuOTu!bR$XDiQW}t% zQAj6cU+(0=`~aFPajq~+@Z=H;MqgYakouVF1?DGiC`<{ZVB3zII;9Jj0k3k4nWFj9 zh|;}2D>LvND42R*iUo9 zgY}UxX0MijX%9wo--P3-wE*5NU^wyjtb>L z0G(Dhg33igv<0Qy1>2bRGc|gx{UXlzXJ!=U1{At-HRIK#Oc+b$!76_Da`A&-Z6|*I zh_$-c<&XU{^e6&0ipQhFCmNZcKEKDuKun6EM>fKBMfcOA(o^5g^)kYfh=g&xVzY%1 zFL9=X?kkxdNeqM+%(xuXK2&=794S8pS*iT2cQSB1r3l9R)?q9T)Vj)p`tNv&|D-Sp zi@&h7Mv(<#?+FyyYdvLYnzIvcTJI6qlBIBuSTweN&;Rq_xtXWKkZh*8PB8RBJmFTk z6pm)u)Itf6Qa5bAlgY-YncmtP6d|7!^LVfC=Yp;Pt-GOAT^lM4H+UG%{sj$R(uQ_# zS9|+)kO|+|H0_#1wia$BB<45$dv!tdj^_d&H7(l;c#O^Pnh&^A?s$~7)4SDs6xvLu zVVDH>pL`!KpdAFJjVGNOpwF~(sB0k%?m%}Rd5`Q&@_40w&>WVD9ZtT-u-hka{B$(j zGF+}%#HD);+QJqI`pS<#$7z}C)5CB(*Wo7~?$5h&+~|m~VI#pSM?R<+=}0A{rpL>{r3RixQ+7%h8vCYMri!|3DlR7*-VtEFTG& z{6-{{k(G1h>vYNYO4qcyFyA}j=U+)&`;y%Sr3J`$ z;(M>#v>ei?`_D1FILn!vMkyKvMFF`Lxp8iZzqWjToJmTgFB{oIGPWl2NlDfdk(YB( z-%vjiq)ax`IVA?=6|-YV8ITqzMK|M<_ZO>7?)>~oW$<-9r(|+*d>=ig*jn*s5R;zH zxL&~b;O#u|4e8l-oX%Dy;KeQ^1&ucZENB0WtM>85dCg>t_;bn9>Kp8N`QzmeJCQ+$$Axp1FFTQshvk_| zEtk69Sso_V17ZFz-Iv*(MU5qcQYGp?p>GU1%d0s|Fm+IIRq}FZL(P7!hl_~g-M)ICL0dBZZ0Y15i!?#=XOEWLq@x2w z);L%UiezO4rDe65wuT{n8TzxPh_-$~qjIF!0l;r>V%{0Gy`lrQMH$9rr4bp5^v(hX ztmIA)^P@5O5ypeu7V_3mtDIK@S5No~gVc4TP8?w@&~_IO^Y_m8IGvfr^GssZ2s%A+ z!Z|=?|2}9nxZtbI;sB_ei_@}Ry?}(|Uvl-ur&GS|yuZ?CiIaa$j=T&-PR$-Q9OKB_ zmX+`?WjNHlI&iG~{5bsWgNdcBrOE}S%92!y&@RGft+;wOQHmlaY(u-;+8JH8Yj)>x z_Jwj7`@CUmh8w&wVC|X}6V0wsuG6+n9vdL;E1FIX;G!gzHXnv8RnXrpbc4E8dsp;} zih*gOTK>;uL-eA|;Sb^C65DmAHNQ;_GQR4rJQhJ}bT04K>}9AN?0irpMHZL-@np%L zZ$~DWEX^M!9id zQXx#3Xq_^@fA5sJN@QFHD(g{f*L_hnKG^8Ua8a2ejUO?P3S?PRZ*Y4WbSYZPHU8pu z36o04u2=5pXnlsHFqAME87);B%cx9gJZIYyNb`tAbq%!Zm{ih!l@7aPr-j5_(rrWT zc8P*Cqvb=T9$YG%UNUzy`>;?@7!8vDZScDPr} z${Z+VhLrCQI=<_~!A3*+DFt^K`%}e_*|LvGg6eTV%!A^Tl$-YIr7z;2C>tYbE#Z$0 z?U0g%sdhsHHI7EJ<&8}Bi|EaqG_VXb(oRLt4-sK;@?pr2;1Kk1l;Z}gO1)^cm+UU*qNUAeS3L>37A z>19U#dqNNcm6{|)VF4pXLK2>CDyjm-P^@Dwb|EEf=K)2P5x--G9c>d12oNt2qB(0m z`qRp8p$gnFUtO5&s2F0avvBA=;l29fY`YosbGb}rn zynU8HMO0kj$b^+os6v8`O<6rRJBv7$TY6p;AcyoshmZu}jxmhZNmb zk;e2=P0pNErN-=BP03t`0%6%lQ5s%c&#KQDrPoDNV}8OkG{Xr1TvZ#uW4o2wdIFZS z!u;b>$Jo9zfNLz)CFSQNY1TA8Dwz~Rqwt4*@ksOQ3TwwH|1S^m8*i`Bf7rbK>4dFT=UVv2`% zRJ@fBmOavXhs*lqAprP+s=A$#ic-kgbI@{mQrX!fmR#A^#P z`-VaKC{8Kjm`;;J)0gaNs#NX-vovyTxo;n>hO=FLMcS=<_uC3YO9wqK)}#`p2D)cv z{o48)mFC!vM#UQH`|+J>++wwj=kRtEp$gS&vJ8t8elkG6hNBx7eRkuW)6>iAjb3q) zQqq(A%1>fY#GgW64%+ZhomTQ&GAx}_F!kNncx8&W)D=AHOT?6kpPg?|&Fmhvn#FPJ zW%f%e>X#wP&>JQ`ZCuXSPpRYt+2PkxB!Y42ANZ(oz8-_5OGwNoHM;ggC! zi_A~YiWbZW0L|wwbAK+rg(^2IQm8P(IFF{EhH6OMg_Wc{z)vr=RMhY#@+skb%=hHF z9Ix>W(*15?ZTzR-@}x|uWLq~ZKN_>1j%MC{C4O}%h`zPMP%VB|Jx%E4w`5u#&$U^P zgsR+B+M$}JJ^jQ77EEkKot)dt!JXzS#a8Z|_*l(TVqN0PtFi>y2Cw! zM%So(F}@d=FeQs2M2BbL@6?hoF(=C;*szMk&}{`j?-o1xUZ%`xv4r~=n^m0q(m3nz zGP(pqJ=PlOEx8SB`FbKI7xX`#^7fxXYmKG1uL5@d#2*D=vD3q|8w-E2ZDmtGTA#z$ zmT{9-EdII0W&Qas)9?$VoV{92OW4`nz}1VkQ;z~$c~!^f{ZbWIPe8fe)i(!gL``$BWeGi^L`Gup3;7-d?udWht+WW2X(N+QdJnGq<6V+f}p7ia{Guy7{7bdFn-%8HZhNexj0~`STH3nlRy;V3R)AAnZ=_ zK~|ILX%_3oIWwWsdJ57Z7jYYp%5U1KHgcE~<&#Qd*wv*UK|0k(2tCw%Hfx+cknKQ1 zq%9jaWfvr9e}bM>6zycB{@H#)IoPkWqCGDKPh(zJwtT8sm;n=To6nlvEyIrq*cS7P z+UWl6QOHPlqP=%%Dqmpd*-le=?_5qV8m_u2lSw^#yu~+WH`=q?H(^OuKLzC^AP84y zFQCwcCQETiY3~UiEZ*}{#ih%5Xnovm?UN_&-E2VUnWyQY(@Jci2lVQlITWpY zGfYF39Rrlif2%BIn)66Ou4k7CZkhHdI@=J2n%`(4;#qOYI#?@!H4Yw)`7_1YyRNZ@ zDSSk^RQF(0#aNfRbY_uxxG;awIBqe2SaIgi+G@Q&enaN2eN1=uB9Ym4R?x9N-fFd$ z`KL1JZN+aB`fYA~@on(U#lJ%+t6~^x{Ql+!yu^yRl&ckWUcwW2nHnDeT)4Ghi>a_d@mVKYy z0+(3K3h!ZJGC!Ap@qY5l<(JHbHnXe5hG(}U-*Wzu1cS_#2G`|IOTuO1)oKfItG(*< zw`Oyb`9rPTR<8#4r_;`;F+z8JkLCMj-do9J?xAjPccec85`7?}hs{WLwf}naoa4z! zuwpPl2ffp3>^x0{_lC{!IRV_nN>-cR17e|7o>kjc!TuLykG{K@VE)Uf)HALv4m2J` zx4cV<>6i*qgeY46npcV2!3KJ`Ffct6WHNaUL zDY19ghEo$%y)pD=p59NV&kNk2inE}Mug!YRvpK&Ut(H5lJ48KZEEBbPO&k#(y)K;b zuialf@o%={(+7`if&$=gb*}^1`Y&Psk;zYe{L&ZdPJTzwara9uh~IU9Qs-Xj`s-br zoXZK{yl3l~`}Q<>X2-#_ciX!6+s)k@QXs4n2Zq*vtMwmA|5oS3LSuj1Z+K9GDEV=O z&7Q)+Me<@E2_GWlf@imAaNXzTq+}6nQ{bdJ==;c_U9o#Uy9$R$BTO0gX-mq6jD%9z zr=zH#XfKuvX-e`&PgIgrB=A!7&59^#ll8Hw7kk8@%y04Z95CcfwJC+f28`CohI|be zbyEzP4w!v3B&Mex>_ss+!s`RM5+_6|k|T)D1n zGsZpA3RwvM?MBQU@)GsAa`DT!gnl4_e49c^6}O<6LvIZQ^kF~ak@pjqV}5T9O}{^5 z%(Dnua3Vo+P6?%b&rl6F1w>2TSi|nX^<76DZ2$CX)y2t%(z0O&$csdIA~J;Jv3;Mx zB5^#x#4rgfw~joq=D(g2xFDv9$MC!i>3S=ycEP*m(T*;H<{6XGSwbRZ0|?rL=O(WF zw8s7MOmIR~&I0rDwriF`Le%+A05EWAi5qY|)&yAmF=vc1-6LJsb;H%LX#Wq=VFIkuz~G$8Up&yb=y=I^>DokZ2v+e1fCym7KPFD z9fo*3ls^t?zZUH}Nh}7f5A)l9{A$($vme22t8srpJe5%Cj%AOy74YTVUXHq@e_QYQ ztF1>p;I4jfo@ea7@%*Jp%VZu&X4#Qr&mjUqBcR9$ntq_sjYf0e;-2n!49;r__#E(( zgybF&qb^|`^VEQl7QQrbH)1u4ND>vf(IJ-B%Ce5z5s4Sbqi^Gwe|~Li0=+Kme$~zz z?)pB$$C71{oi<4werRVEs0cFj!>46Jw zc3oK!>&28a|AQFU?6MWA^P6!GtG;HBDC^*7(j@2CLW2slw^mx`x5mL$zM>(w9Jr|Z z@0%To`+aTIQ1ce}?|!P+i{Nl|;zZ@FCiyMXZ{##}xf?c#<)0rjg+y(8t^0C1V&Bbp zNdSJa;RS1|$+X)_Xz=S>gq&fmx52IxjwIrbbXwDU5%lVRr}QF_qp8L}d@^kEb}6nS zyn~hNyx@@wX%@w)(T={7Ac@nJ%J$%fUZajX;I=(!M5qby9uBeLr5!v&rS$}EV_nv3 z1RoJ!_8fZwK1rQxHaz*oO?u!-@kP&UunoejY&I|2bZ(CPA|2nrRa;3}> z48MT7>5Xd90?+pHNpMk% zd16bYZ6-c$-@^#?eXq^mJdTlPm8K8ZRjWhJjT&pZQ>a7|#?ARHHb}figPzfBln_9N zC3aRB)zy_bBZqobLihTO}j4Q2=*cj%5B^f`Vp0#q_izjsT@C?f#E=17fW4*$@aZHqJ#}c(J=_?{PqZncT z2?nQOQd0lB+TBHOVVxan*6`)X{RXw@8@zz(7VWOxWm_!-wj-l5%mGI04~}gv>p~v7 z6u3TX^z>PiL4J!On=bcV6Ql*k0^d)Y^EHNO4=AR*oDOI+1T8XVt*W)BB`n=$WXwsb zk)`2mDT0kGwr(UKgOB^{*$5CUKL4)rD4*YK35QEDlj~qWFoa(ZHWZ4A+En;CHZO=j z&*FOE|FvGe_o|$BhLy$DEd}j~5zzSZ=}BP*#+`9%i<(7I-XHOv!EKLKt3e?02D(N6 z8SOGD@fptsK_o(jTR0547u{Jml!YC*9_biRWcXpvE+->Nx?q%+EyxghUF9giX`a?FnT|3VVhZ) zV#{bWUwo*Z7r4`6a#dtU!H!?50~Zsj@4feWZ?$;w>o?ww&vF zr(tZyMei4{i0YBOmIFPCL}>D8gUm6``V^zR*FC6yO|Z5=rw`6MpiH$tV2zi3WB1Bc zt#!4jhs#(eU$G1_cHZ90e$2gd-nf7E;N=cT0qWysQ|1~s2t_=eV@hd#?0ku~hUo0X zX-uv>@c`X-Xqsru2h2mXbJEwvPXzC?kgW)M1{}`A>a~0uOM=mA0#09>2d;Y+ak_a? zt^oRQzeC1Z^wI&kX3RgC1gS3vR~Bgex>KUDLd^M`BZ$}cX5Fe>yWD^p0Cj!r9%XNa z?-LV-Vd;A>bNAT|sZ;YC-uEHoGJwAG+1a{e;PckzSs!WQL!o>`sP|`&@_QhzS@IJP z=zqP|SePypt0!D82BT>v)=*wD(!0f-P$bU>>UqNrC(IrtqTbUyJ+)>}dH)Jjh~lNd zpWm9i3Z~6v_s;&5*?IrdO3ActmPQ=ilFKsSYYRYOg*C3!@q~7FO6p2knUsq=bvQpp zW0-3Zt5tSN=Gft^Xwv+fVsUG_9^m_Orng|`#lSr3Zq9*ON?60pE?$~f=}|&~r{UsP z1sdtG?DTk`Lv}*MXHj8)@j(*~@>2J&Qd>TaJrak@Qn+^Yd8u_-$)63)ci9c{$(q%M zOMYUqZN_~zmCogo{ryywhh9>h8)`B$MRiMTlB9b1gNn%Be z0qb*#Q$!Zg;SNlSB{YN#O$0#U(1bkjD5B1QtVSM*PYN$)6^=+F3~61>aGG7#k#X@B z&y>hC{|biIQ7o4LpRSBOVoedzM$(c?flHB&vmZA`5Sp{$JYS_w$=sTQ!|qZX*6>Cw z(nR8_I6uO~S?QL_EF^W)9I^&=@E6rch*WiUhdz5%Q-A0;e!&$}vg?GeXaVmm{1^)4 z)DZl;@^E(TR@r-an2&bXZlwS8CRReACT^5Y{-}(~au!pvBOS#X?@hdpNi`>0yRa>e z@hZ&&j6GgzE*KY)XyKJ>ooE{CL=Hq?6aXx5OGr(^4WHT?^&5|_mqIGmB2-!&C-4kc zn?9me0cq~?t2|8A&eFY?owahi$UE>R{ZApcBHgNnnYPPz`{x5ueg z5>R69F^bAq@pkb?>74l{d4+umit@%@N5XhTyaSa1+nMb5yWzN9ibe(Ap@=I z7lqe84!meJ_13CM+P5oh3COSsM7>OCjXw(;PL;502tTs1@@NJX;6#Idl{0UDkceD? zX*Wd;zlQl7QGKZIN+;b&xxh`}{~UiAamOsLNqeK=dX8jOznuVorG;pTpTw-Wn4*I! z?K;!EMWoPsS`L+rA$5Jv{D=*)Vm%#zwfN1Ja1TBop=GRA<-pKRQf?bMBU8*F6Kndo zf=FWLqRl1iIBe?y$}@4CfmEuab1e3kUrpLn>atqO25q{Wk#pj~a|(SH`^0&P++--D zx{rtoU43>*zT_>Y4hdt^3zW%k>Z6N)FvI&D@b*Nxnp1yquCDDiE|T~@NhhTj zUX|i&|4cQ|-k{?dz#*?Z7x-bylj^E+0mzx~^oTvaC6=o!g#J>yXz17b<9*DpPqk!C zLW;3!X=@@5IO~1$q4UGKz-6jgF}KoUwd zJ`D|J7jMisVIxF(C6>i5=Z6`T68ZTZs#k{w+1dAInJpX(I@Jex7YC;$%rqzHH;Cow zijDPU%mA$mQ=Rj-l}`bO=}s_(>D{KrHcL3qt|^(fFaz%Xyj+E=-KNeqOMvG+C)oWl zxt_Pzx0h*3ety@93Bspt@mjYM92!Kd930^3;1(Mv5s-xm z)MEwDUBE2#O; zTozVNkc}+hrC5L4CMHy{B;rs8`u^$uq_ zHUG-_XB`k0;H>;NAHkUj&cT1P51e=ZtOSa9P?mx7>)*@*=M*@bK)Ql5=`RN;dB9oo zZ@T=OC!iT%XZ`#B&&r^r`5Ts?Z26}K*#=4sa7O&?gF+k}{2;k(;Bfyp&Ou`!H-W8Uyt~V<35;*k%R(t0Q=wf8hng2zD448ZedhuPxxY z;66CCKvY(yzb$qUh+rxki26?rvJ|8P3&^1?pey=c39KM(L1?ftfx-jC#{y2H{|iiJ zki@@W^6)Uo7+M)Sn1Cj60$CWuOf4J??HI%?^c)OD4E3!I4F5CE1iHMkaqQf;W6R$6O zx;{UW*(=9Z-1i!i?|k3_qA|Qob_fZV8A~3P&}p*&3_#>>%M*_bJ+lYEVOnrg0P)jm z;t&j~v_34)VS0At)b<)q^Z@yc4LrV|b+2PaD)-*1pe_+Fu~zGqye8Jm5wTuy3He#3 z7BE;z`|9~FdzmU=kVV4@f9ZKg z&JdZ{0akOn{CDKg7rfKv-&dj{WslTChG(ZMj7)!C#*SD*Ts9B`K7dYya=-2WZi0_m z`3BR7yxDP)LYLWLxXq6^Qu-D?`YvEPm7kA0@JfgE?D%10zLp;iu;Yyc3=A=F?p5Q# z5blGX%t!Wm@fC20ZkLr}Hnoj-xZAIch5(3Qq!kMA)!{68_};--poSFKhkEo8L0;id zKqQWC*&ROZzlW!cu?r)UOd&bQBt2Vk-DwJJ=g%AGE5%$tg-S7pdb7_%;9?HGQ`p1C zS!O__6J8TB525jCT~p_m+!a1th4Qbi z)Z36m*{e!wdyh@+U5@v9j!B>CmrRbQwiC+M`L!ZVM>$O){y0A;J5)WyKeWu#w2=d( zG#@;Dq5r}SdZ1&5J?5x)ys#s1hTXk#hqF^?dd7Lum;7uwwBQrIyUpfp&HS;z^!3_N zrDW82rrh&%L?!f7ekk)nq|V)s70#V?I#2p5diQnmyGi7np;S|M5`_u7`D}iFiej1{ z=km25Pc-EF{oDxz8CI@e*2H8pU}m*d-rki!X?I3e%s`lFRe3_@t%}PyAU(dThmN4H zk3zm_>lDo$eOmG2aPsxYdUdeBBNdMccBZ_9(-tInWQ{uuOSBxcXW6@Yv_5T`>3jZo zn%((IaIb!i{O9PNWG7o&JmSZM&dR*Y>L)bAt#@uay-N@S9(u)Yho{ic=%wJ91>&TJ3(!@FS$r9k4Z#;o^Ys%p(rA z#6g_w|Hte4jf$>ym>2Ai|L4o}Ktwj%&PUM42LBkM9HJh=5dyR6IrOv|hYcbe;u`Y$ zoeQKJggRso#FwVF>qUE=XRb3W5-dC>t>9;BoD0v8^Q_#1-482%! zMH9mGLLo!KthQ)Qailc(<~~0$40AP=d_K$bnhDcPnz4pA_K_T`e0Nf_>J0-M+^;vsa*hW) zp%)8Rj1w(1{wF6s9a7j#?8eRn2d1)*5kn2|#yfPbnfY{Zl)>&tLA`dC z`EqQ$d1&Ck(jvla?*ZOn|A82Jf9rXLS7qVjLE1$@HL^Ybjz}gt%C_s3VZ;atE_{Rz zA7%C82@=JeXnhzmf#LYA)^flO=8^;D{_TYV!b!-La3>ZYMVvTu%clwUQVT+WaBIzl z5F!MYczp!&f@9~2gGf8bgTD)ssuSr!u%fcBk%)g3l4dL;4C+tp9;dGB27cEM`B#LU zN;`oU%CxW8u=};&27NJH`bst+GR-ZwAf)k*FkmrE5NYZrKUik11>-*&@%Fz8lhv#Z zLtY^53_xa8vO+z)KxFzcpC?_p<1^ZHBBQ_tz}opi^&oH#K_*xd%HyN#-g`@M5-s_6 zS9klqcC2NbVrr!WPAoU)66Ec_>I-{TRWuZ|l+@(3mDTm_(G5=6asqBGehB6&4d#E3 zk?-1LViiTB>Rcqit(I*SD=WmkF2uVwa@QVZ;n-&P>B2vWxz+1cdWk8P@N*LDy?O#6$gG~`}z z1h-FAyj!b`gxiAll%8=mNlw3`eW~JC5c>@@A-a}dXizixw!3AMqXTdtXK$8@Y zJ!0FVcY)gdD|&F_YxjXJI))$KmZxRpqo>Vt5bA!Pa(GZiw`r!QnYzC929nPQnu6}R z4#C^Fd(-KZepA*OYOlGv%4Yb+ktGkayijwZj)ZpO^KTeQ?v&~lY@OH;qD{Ds`s(v= zBDQRqxcI9)mN-mN@4T%VkWwtCyJvkmW^cQzXOpCyemR_S+i>H#i{H}jFX!Z zrN28OGA&TnHxmqGd(VFxWVVnEVOO1+l!G`sC)g8?7Tm41CB8A`chm*5Yhm%LmCD0R zzjU!-sXrf&bqL=YeLD>+Pg5Eaa|mdAr`BM)GT9{9Jol%%AP$DUi3;6X_t{LkF}ANM zWF31PMc1x@!bw3EyIEem$8h1ZjHtgOuA>I*iT>@Z(?+)L9nmRXKb!RWEuXvlM2cX- zk}ds#PSvjy2D#H8i3LMqx?Rx&X<5{*t36hf>>8g=kSLur!ZgOT#H3-{1jZ%+J>7FCFWw4&oty1mAxybJlNjBIY6Ev#;dyMCS`7w=1 zLwZYHGnBo|1xly*6Y%}<#UB-aIDqlplm&Ea`vK;=YDYg2fG=n>WIM+&5dgd+tI8*X zBb#?0aQY!TiOf^WbCZDL%2AoPY7ydCQ;>j7X&Lleb=EIS=DF{OVr70D>myEocZaH| z?7eZ+`WWg*B}(u8f>J`L0Z4| zpCD8rVWTlOI8ZsnB|UD?7|Gzsf^`tO$hyiQkWm8nusPiV&tWo&SkJ`%(DFx&tGzzN zXeD?*X3t;d5?a(hpEZuFdx7?N9N~Y>8ohiOp%{rD*-ns7)T#0~yR`lB%*>?MEF++N zlm4SoW3A04b9ecZG~GJay5Ym}m45=lUND_?+PcNVp9lDnqrE7N->$!0k6g`q+}6A^ z`b5#@qrc5v^{tOK(Y~1%OkFO?RPN%jpeIyL99Oq-*$3~&CkrQ>;%vn?&+DXddbo#- z4LI99bm7ul!)@|#uy50RXveo~Y{LN5v|+CraDG}fN{%F`@*sC>-3{DVAE^adVoVZD zCntVd%i{{1zHF|=Oqj^k3wF#UAgepm?r>m z+^$SQt}FC7*PZU~Oj1T^b8;TdeuuH=E(%gjZkRy+_zbbvGEd%p;ur%|Kcj z^%j^Gs>1x*e9x@y=3C!}ggM`H`*NuAyn(4HG+a1Tf*+(B2Gz!Rv>_z#XUyLl3BtHs z3C^6EdI$2)FZ0puYjb}|OLMy2T-TjQF)pLBhw$(&}S-ixjC*?4>dF0LbWh%GD-FdRuJJ(lg+rZwO3L$W@ zg3jR16Z+EEapQh_D!mfOi}bn4GL8p_cJ;=6!L4aX`#H9Wcl-`_?uvgvM!vF-0Hze1 zsb-NdJ1SPa%XKL#118aIVt|W3Bk4s#Midnp^vKf6lf8=m#JjehK}E9#r>SIl^tX`* z&drt1UR1LN*>Qp!0>00;A7*`Aj+?g@t%XlA^)h48dKw%mFdE(@)*?n$aGocAb)Y@H zYgLg+M3sXecE;`vD26xA&Lg252 z@gcal0A6_0I3bL!AU_>Lq`9)Yp`?pVWV27AaQLHdIIQ}~W_Joz`j$2#R5-)7AgBAj z2wxoWAU|L`IaR5aCzbPDRh2YpD$0y1oLZOC^N7E@A?BRE zK3sVJ@fX}Zr(s0HpRtI=vvUKt{9&TKiyfGFMFyx-k2mD-V}HBHTjWTEmctuC?hA6r z%siaO9BuPk7{KaLoH{vqoHUskq)z$I7Tmc}0!dBcjP0y1<10_sxLw9TyKG}^heh}& z8v9P@leGOZGz8=Ij3zLHVxSqK)N!^1<>w9hw~*v-Q}TV^rL z0@$9ykiCJ~Bm&puw|D!ipXgB_7Z5p#yark72)c^5e;*WB#D(|dGy4hGWmp$lIPgbB zr_`(GhRXqx+g*Gx2E)xPgW@(&y`?2*jPi%eu)e=%zPrH(;Mv)Kh2_ma$Sr5hTCCfKUVa#pN#f4A4sFHdaR+s zgc8a(?y0d6|*9s;M|<(=C(&wo)}>mZg|F;XxcSfPi#&xb+)B6 z;OtOC1+u#-`PM=u6s>6y=4AVmaO#QFil&?O+1Iz*>$KrrMbt23uiNAb?$1abH?P(@ zZCB>O=7R&7uayiHtlaysfIn;#&xbKu>uuJ*VAo6eU7_`nPi0ShTlYw<<*n^9Kb4f5 z(V(RmY0_udiY;wtY}!W1f4k2jPHd`H?jwn*TUJ!>{XSWssg!s7TL|9!_NvKn2SSG= z%M{W=hrEMyW7toXI=MR$?m)3vtbb2^DACkVF(QtzbVE8jFX7y%QZUr=Y~@J_wr(DA zM)_)XFF%=zCYC=}8PAnvkymWA?V{k3o{GjsIP_>K9{Vgb;VYmif{E#3q6uKJ2oI&6 z&pPPx`;fWe7S_VwAzXxXAb-*NLWC!!pI^rq@1rGNs(TcHKC=SgGoq1!!64#ZjK-^& z?Qh1|bgj+ObUhIkOwSaYb*XUq4RP{i`2=d))a@@?T_O2~QsMfeMHaAGCk`KurmnHa zK3$O+9-XSz?&Xu-SUR`0wLg5Vude)zfnDF{DHNed#-PPg(|vbdnQ^T1G|F&>2mm1B z1YSE8%hC^C?0)3AT=jI;Z0V$1mgPy;`)Qi*kuh2nruK0Wt5AXK`T2~1=S624PewLs zvP&xzX_QQ{Jr4@U983e~r63{k{ zIB}m*GHZj;@8xEqDbd(c-fs=n*G`ayo{xx_-fA(^DEv{E*}yW7*(%*{lb9T7KoL_i zt3^X38b)K^9J%@6p)q#D-la*E_5`?~YcfM(hRxsiC>UL%c@A1)?ClFgv{|1e<8+1p z)nk_Rkm@<2+S=T!nP!cCg^j{W($Td;Tf-?`6W=u5gehWs)E&f z`Xd=fjx2NwS=WV#W+oMlnFr)=g5rQG^t65(^jqlMxLE=bh$Ga72c96x`BDrY5@s=9 z7zJrV++v>)LlpT+80gU^B}6fm0xwXzS)gpzEy@Q7?*ku#>Eet5L-D+f~ z{79o}p!7>O8!nCoE~N6nMaJ|I4s?m2Z`LARqWQRSXxm!O6;)}Q%1(T%DQN;9PvpxD zCN=L3x!a)Q=&s$eBkl>>>PXHtq{;-#D#!9}WwIJljS0(FIt*EVzs-7G^8PNz*k>k~ z6XxFY64x=J)s1RZP?oQ7g)(d>9%dRJd^)Dp(H9LcoaND{q@z$q&8L!kv>PdWz4J%b zZZ4(2?n37GeA{h3vc9tj!{@pmP4HWZh|xgeZ{^JNI1WY5AvJ${l*{D2N~{bod)PYT z@7x;`hgIfxvbB42Cd5;HN@lM%daw3IYoh@(ELxGZ)XiNv>H$Ta&cc(?$CrB&lPB@i zSn>I1&sv9S&op()PqzjmXM?j(drXq&tCpz^buHHB*lSy!hHkpfD)cvfDFaSQ191o< zZ5>u89T~5ln3szq8IdRW{V>VP5c*b1fzN{eg9XDN^Dx@8OBzD+pjjUID7Ap3zlz+C z(5#F_73Wm$5t3c-R@;;`0=_9c(*~&qC^SXM_r;bawUiQ{&xpLMrDRy0F0-58aXdL2 z{09GhT`PPC9y;9A{H8?8od|lmkejf@KB}=}HeWt@Fq1*d9sjKJU0Y%fMcELBwqeCS zqSCFHRr;kzkO~v}$3t@?3*N{31tV&R{`=XS#)=xL^6y>}t<(&LIy?!EkF;S&l=&)0 z4ocM{CwAn6Q0%}SIOULiVRi3miS1BVsh3F|W3%N&GiTN^n%a1b9TOzU2Yw5U_(i4L z8JVX@tW>1skc9$@&(d@3d!rpGQv5*)%19QKh>?y7rMnOHyrR{ejj2V`p6=oATg#m+4R3}YfBszRC?3Cs@_hJ^D@qqvY^Ycz%K}KAt7%v{j7KCV zXY+KaK&AFYugXk_kP(F6N@u5XElD1|@1h~`_+-RDj#%bOo~diBJfPWgt9`60l>aLd zzHi|a9id3SjBRk~8{x6!&qFUhC7+jpJ&O{YXsIKCM%OA!3*IP)J<$qn(Mrz9>lUSD zmu#(UwKAIn#|ZHPN}%VaJgHp8{{cNf!oOo#%D4K~?w(r*eMx=$g}#voMkq^)U4i|w7HF3PEFldtf(A57jQaCZqovots5mP_1!}=rd&Bt?z^m|)*5tVzhQ8k_v(FK1ALI=4V@Uq zv)FDI=l0sg%FJHnyw`_Y9Pk;Sy=;?#bKwVbGc+Dr$>Wq5tEOG9(lP?{S!pTPm1Iu{ z>UAM0%hc;l3Lzc47(3616wvkz2`MBF#vT;cl zkR>7cL@cIDum$lO@>g<|h;3FYd4&;``Il2)ha>x26InvONKvG2)kHaVeOySK}&v=`g++RJT!qbuxeeDz{& zOM$N5QnNPvcmGk=R$(LZ{5_3DcBRomJ#R5Onm5+Enku~tL4MO3;yHJ)zz};pE6^CL zEo={%V}}g>5ay!;bAP06rSnh;at74~y~1ZrIq=espzF(a>$(^+Um2DFgQCr?n=d zJxkkq>f5&-d-MKwRi?veGDy`@p4DZooc#Qj%}?#Du)1wLnFjL{rpAwe8j0A!6=b?B zG+dO8nlCb2mW>?*7RC;!A2r>1{@!0;^uB*`=2-Ap{?Mm)f8m*(503cB%oE=^*~}rb z^~7rj2TxDdUHeM$jtF23?oGzv-tox6WuaAVRU@J4B90tfl#aSD^0s`E$N^j&yK~oA zvR_MBsgkKtQT_PB*nuz3th^fq4|L?aGFfaBad)y!hj1tmD-&q-FJ&_7 z*Cs>kByJ4btV$p}$O<8k`g@Df#PZ#H)IZYsCB2w9MB&(XsBKvC`^o53MZSU&NIfJ0Rc&!u8umW9e(PUNR+vmgLjvLY z%-Bw)iLcJoio5Q+u>Z*S9$cZb+En^D=BbxJ>cyi5m-PP4ohWlHCUT+0Y}DYgNHNB? zaJi^KZsN9loWpI^*WUmySd_w5Yna`n3%!64;*l;XyF_p9J>n4DD+hb;=yImaK4y56 z*~)qEHxWiSq$?b#Hx#(cAgM`;5%7fC47b_lF^Hh=YBd;sgt>cjTOMC56N^ESf~U-r zDP*dg`bP2(3;RrMgm#ppqM#}8{cQ1No&Ea-1v=69kuGN}Tdd3&Qzj|JIk>DypDjwk zikn!1R`KvJE9MDsbE%Dt)S%LsRbnRAznEmiV?3!62h*iIk^$5FcH#-_r?ZYbR!^j5 z_NPnGFPHcsu3$|_fe0+l)w6SqP$)!kN%bA*nE_*1eHrnkW15TfmelwNZ;9{-`5hSA zMRHrRWq0w#e5%-F0#Wl1i5p)Vf)T)Bk0}D_QjY3_wtQ`Y+i*Es>Jt?dWEYDrqwJE= z0-c!3bd6??E8<9;4-=>=YOs}Mz+sV8=LyF{5*F7D;vqUMQv_I4DD{A{*eI>fkf|kn zGIoIENx^jj2Cykx^){1QKn&2th)8F)Y3o$hc_ux3ZAc)-fe`BHYnxI9lvry~U;726 zGuX63qb1HG7XXu0C?}|~sV-&E{!1vMbWEJ5#{!hvlFA*4Va&sdhYNgYxDe*zj$rG{ zOU)=79#CoO_S9f&9f$573~RD=6!V$aqn{ z*?y55gI5=O7|X>xY_*48+IQe9d&_GNzqEhX^ZTohJ9_RI9=@~JW$(FTWaQ312bpo} zrB8RYp8WQ$N51=DSIgZOPOkghzQ)kO&kYVgwZEbD@Kac$1BQdZN10$>fko@$T~=mY zK}z>UhLJcgYDXpGHxu*Vd~E&#$2#a=cgN6kN$sS(W({VQ^jBGLYY*uQwO@R>wi}Gw zUw7Uz=mQ;=f;=8yQrxkzse7l2p<^w!>RuLWyXh|j)|{vUu^#@9J|7fc)@RR9H>9*o->zod>#FPX6t&;K6O{oc>llFN^G0_vC)S z``J~)f3?4{_0W@Xyzc?L2S5{pRV%twsPHI@uehqfQ1B=(R#oXMSQ~*GyQv`$=+_TY zC7^qWh)2@K)$4J*W8U=I!;_iR;ARM@wF-A>d(HlN>*4+N#|HAUO542|UZ+jIR>c2b zhLXO}vrjdxEHkrXml8-t@8^e0vSKBv^vVfsstgP?7Rn{|qWYXa8ujF_-3@+o?B2}c z5EtWk5A2|P)Q)324VPWTu3}l{WhC>zSyB6DW+UU-Ec%X`(?Hndh3>Id?{#qu-p$4_ z$al*(-rZHSu00^*F(kT6=zYXk;jy?_as6DQ884pW6=_ET^Wg*b^!= z7lem44227bjF!ocT(vnvCXy&6fFWU~Bh%n(^mrQsIeCGm4RuwUT5=S6qf8`INn|>? zz-%!a@+xfp=0IL?kL7sfJp%ZD;Nz-(8rOa-ON zgHqh&BmbE#{n})@wmwOS&$EURs9LNZ;O;Mgop%`|Cl|-KjC7Ypt}(@!IWA>BN*sf_ zT)p+tH7g(9UXGbX4N~9LzO}A)yv@nTbV|KW$`GgbKDwneu<7ArDA@G&|w_rvx&pD1pMH)|eF{ zDs~q`icET)5o|G{ha{RQzTBwM8blPMOU&a^Z*#7vkaz6>b$7z`gtpa!PW>UYtr~R& zT|SWnRr~#tqRZ71y+P`<+a=kT4U)34yfMFBOr_e9pjVR(Hu|uuY*27zRRtHFj5nXM zQ^}4LFYE|gN`?dIFHsV026Ra&q+;|{N~APvv{}&V*tZ#}S*OJl5rl#y5U5;(Mg{ta zB$VVek}orAwR#ar&v!O-ZDw)DMf__=s5^1TStK0h$}AE93w1!D?SO>xHx=)4)bRVq)_xjeJ>Ht;Sr~`+SpcJJP<26S0s88h%yW4!U3i|C~ABk^0X z;1t-Pj6Ely#AdzL4DyyRkc0|zqgH1UgI#(ywm<12oFZ3oaU5u%koZq_xUdl%0za-o zNkNL_qP(D1amA{E4{}`*Srr$JqaqjQb{DY%NwUNWg+_ku zS0)@87@zwcWuwls`fS6?r^~-kP8Q;oBPAkfYmT~HO^VbeH7SrAU|Xm!jv}`k8+euH zl=XSfX4^9(-jb(vI&WJ|MAAujU=dlz8vB1@CxI>uvFn`YEie3+t z#C3VRhGwM~pHmAu?5a{WsaB;lNNXNm(Xy*6uXguS8y_^3uB@#dY4wS)P~{neeIx#% z<14ZcJkz?P)xK#>%Pq|sk(gn`qOpcnXY90DQd0>_&O02CWDN4prS#MIQ3r<0Y9KZ4NmuBp6CdkphveG^+KS zLt0U3iH&Cb5m%czr0A%KFrBQJ2FiyS> zHhp@1UQ1I8_>LO6Tq|X;qpAW~?&)d^yEopuD(9%7a-`MX+}i1Bzqh@4V{HcU^S!U$ z9#Xn0bN6wwLd0j95=vOd|&pVMvZFcT=o^VoPg;_zK5r0ukip6FznE@;=K<;z0QYuntj9C1I!9udmvcf_Z zS_&=sj)=M~{}~~RiugnaJJZ3k#QGtyMOl1YzrKdY*#o=zWG0SU@~3QOm@poGf+SEidl7^BV^%lo<}A zRH2q;>Kz`(#n*-(81}imF20dhxdW`CSqO=0Zc+Mc^{ zc=kYYD&~EX%&zY7wyr9X$~BTqz0GY)MYC)%K?H)#kf&jHzn|s{CE^4XP6HJVpiRND zm0iKrQHv|6+xyO#B&yr|@{|rfU80vz;km9cF|$2vimY$RwRz4ld+wj*t$j^Sr^cLod* zSxq=2Qqb8L5rkM-P!|B5#}SEj_PFJPc=dzgTOcbhDDi+vq85~19Ix0>(xs4sj)y(s z3NoodZkm4NDy=HNZ(lgPt0U)qzF0sjWbapZ8r)er0gkToBu0nV*tEXde49)`3&i}} zGKyL}o|YnWcG*W5Nz^%v+nwD7`2)B1Z{bPRQloM9y<2vOBqC5jQoT_k5%C@2sS(m* zG~(d>s>Tg9nU=CHZ{6C;n;5kp&X zMApf0n*Aypio%N%^c6|H<{9$9HyMjc)$A}%=Dm^R2xDnd1}&Cq6 zs&0@_6>NYtW!fagVB_&V8b0(NV&UwUSPpmVQ_;YkJn$!GJUOsCO!azEb95P@KhL$!6>3<~&sesO`9;#aw=iArc z+2^8pe4aock_bM;dSt00=me^$&{OD+VA~^)Og=RgJu*Dpwt7=^QaxGc5l7psZIkdh zg3gtkIDX`*@Mk0Ug{C$giJS=U@7UV0I^5h*Cl+~VzbsPO$wd5Z&QM>(*uv5(E_^tm z6>$;yKwQ7G3M9V#ob@+2;w{27u^dUXADPOwWeLtLSxPD(E&uzAt@958o>eE-nKA8_ zFy^l__fwcbbD0}VmlHNctSMpjCD_8=ytyGisKOdtC>9v(1sQz}#NREV73sPWWjB6A zUb&ucM)1`Y0vZOZRIh`Pz3=!4Cza@F;ExTcBbeLLlHKQsdL_DOf3_-Hg(?DGL1ax! zUwB2NE@apFA{F7>j*JcoE0^LF$HM7C-~y(2fSojmkI{K-e7 z8-Q=8;C#_gToUKsa6ql6UL}xV2^Yu0$Hw0F`8vd5lKClMasu@R3j%?%F->$$R#u}p zI#Ey-?QCfrQyUeL@wVZRJJQ!u))?sw*K`zwjd2@!Ug}{R`BH$3O=Fa@s?52(pYri# zU)%>`eu~kk)XN#;LN{eek++Dqmk@c__c_#V)7-!}`M7e9b9>_07H9$6kAiL0aPs7) zM@FMleSNi^tD>78-BcW{mDFy6&y*)>IlOo3k?@0&p=G#<0YqmmPnH{cqd;+q@DoZatj*r1?gOf;(EzFnTAR_!B1?3j#~Lm5=l6s= zBh@X|{79+%ubI-YtHa0+EH>B^rzV(&vu|C!eEoDFbrU355DC%Z)fv=%d}WqipQYmS zRXA7jRX0!qO`Ga;d3GaqNdTd$%sfk1kd$eZ^d-GTEfA5NIqP_-}+6Zd~w% zLXlJ@(dqa?0f;cY3USzBUT3j$1dRpDy1NSwTBG?x`8xnj`S7W*M31a1h&I+#91P1D zrg3j%Q_H&WU?dzWuvSDG!-0+j(vq?rgwLe}>Jo1IWp*Sic;w}Vc)S5h=_N${^>}7p z=kS}rvx>zti``h`hjFlZkp^f4GI+9q3^XQ#Is?d14`fi?G#Qp-R>^g`VJRwcdg5iE z(j?jtENN=;)wV|awJ-4;QQvkS|7E2QKK=HWjOz#c%Oj&Lt^JYp;jWI_a9#(`A<4qJ zH~7f}-VzxM zRr^{az2SzAk`8BBnbhaWF;rI<*Xi@h1W2?{o%ohnh4Zl$#?nJ8MOiIk3jVJbQjHy5 zDO9^@jj?FFaat-tRQ62bsDR@bg+PKi<{_zQ>7d!ivT&Ceh6}XSk{lK11nMwwLN_W8 zW?3xukSN-1v_~rfzV?thQrBYV%wJ=eNr=d#R(UHv+?=1>D5DPFc*rbeeI>BVT3?z^ zXk^7D)C+9fcWtn!ug~wZSj2#d5udMmLL5CX?2m?m)w=;Hn_Gs%Ya<;Yzr8vV3YT`I zU}v8DlPKcMSwNIh^^uVE@tK@?A%QT8L#FN%ax&oBonmj@B(6U$t8!fV9{nI2Rap_t z3${ha>~>TgsxUy1L5Xoq1Lz0Lt%wq$Cm;iw3x;jop01Yl+ z5~vbuV{eGo)Cf}ou^$@wC0dq>C^;H40Fx;JD7%7~Nw8}o%v;r!4D<5k8Lm7H4)ao- z%fy`IQjEIP5Y^j>skFD_0o|W$Nd$DYCb?9|IKopMWPrmcJGb;8+8+$o)|$G^QTMua z(jBs>X@%*~9Z~6o)C3>*t*FrBJ`~;&-m|B0b7Y{UE8H3>3*BLsxg&*PTZg9O?g&3I ztynZ~F4b{H_+~RdP=Mcmga)H|&JnqvPnEYt zBz+OBcBGt&REP7d4UzJ;wGr!z_~P$6?t$?iuwhNb+eKF|4C#SGfJdN$eg6f!xPyyW zv#(;{0@wD0!RB)Fz%th9nKaSyYJ7rXSi#no` zJ& z=`J?y+FaUGY#QFaCiY(ruUYiyUH!X4S=6l=I?q^n=fS@GY@?<)+f_`8$gHZBmDM}@ z3Z3Q*E_n$QPVTKsUbuOGm3l#`nC>R zX$bo=+ku9+0S#+FAJ+!6i?X_-NG3y}b2*u)w>(@_+nq(*>mvni?GbyYA;NHI=E9N6 zK!EUFy^vVs;9P3OTgifD^`t&IdidAPi1^2z*pWZnSEdzE1k3vc?c17~$6Fl9*e;$V zNd}7*8Yy$#G>L8d>5+V~N-L8|rF^+g&es?<8I8LJb{5p)_#QWJqI6cx$M>#r^CpQX zA!fBNfQ51wvl|tmnxM<&EA@qZ6!Iy2q@cw^gj9q$T9l`WX5|?bfEPz78CnAF;}$z& z_FB)*@GlpjSRBis?phE`IMtC*sEa}lHwgBmu5w7kZ%FjW-1~%|u^=t7;ivF*FK1|@ zBFkSJ6`TR_c4Fb~^$YgZSmk4$2WBU-7Pm*0U660XkZcikPvZVWp+DOOylvxfNn}x9 zn7!CYM-QTR@_B&xH&Y$_n|TKt!caEwl$P3Xl$ zwwTEYXM~de0_Y1E@V>X$xvL>|ZropphHh?YK4-&ItCz6h6D_`3t9zbY%Ua4T?x2?m z+=V_S?&fb5zbX@j5#Nmt1iM>030G%nCy6>0og~w&Z6@7KWlbcnN!JA2UPqL=LM{?m zKBSIjWfh5{mhKhZB?5iZ;GtElvq0%8eHpqc3a^)ZNy}g;r&Zf!$0QKHS3huKSuRRyXp zRAe4tP8`MW{>#GRBG2eZ#-g#ZVmVR4;b;BLNDS?VON@AzANw$gv7lS5z#!RGP#2*$ zc%}ckU~sGRkdxeO+ixQ`oA;Z^t@=ZH@@^GzT1oJfCzPZ>N}LoBLjFB`l1~u=%{lxY z$gFds9AiY@W`Bm8Y2;prFmyGs5Nv3{aYI+mqW%$|j$k-1g+Q(qmbn z{ewOG+Z~CVcz4HFPqa54JvX)Et9P|E96fiq^SAHVgZRO_s@QOCjZ?8dr z@QSu@(7UzjP!%~?MQrsR!i(Anh9YdGqU#p3g%vB7TgZO)GD9 zG?Hi86`jtY+9i(;L!C+VjHk^d*IL8c4ipzpgzv%-9(Ad6{7a2CmYO{BEXnYBLW9+% zHy2mbxfYK#cSChWmNeUKk_0tYVQIW(P#fM7Typb}|Gs=;&sWP%#8Gp+{ z1ixaTO&8}_=-;Achn%u2@?BlXzBm1j1@i0u)koTW{Y^fd2zN!CSGTId+fi=Gsqb6W zSD)i(-`AbpSeB#ZQ|vny1lHnKpRdKM&uQpi)!zWatbR+YORhI*vW)osRT;JnO-@~2 zUZuxo&#UgQ@~v&fMw>z`QA#9g8DD48>2gY~`PKQ^*}0WHaU3yy%mjJ}9SJs-PmisO z)=xzpx$0Z)ipq`hiTbgzdbM1xuBSS0L!GyTEs=ep@^#xn?a%aj;j=36v};@2sz|8w zE_uWlz9$l2oms>#%2LKdx}4sEp?*Qdx(r1=6*sSr-%k-=6P{SovgGP3axvnxH$-&G zI=W@NNv4mWdE!hb=ceDqt;V`5BhcdUv<5PAviM73`^L1&?bu$Q;n!$%1^oxY;i=A? zrTj^;LM9T)5+3EE)md!=8Cv5KWU9C^kxSM!x%qrko4awcXTg%N6rYkn?z#8Kwe*)z zB^n5pixg5tt4CBNY8O#bQKpEr7ew_)s*sXWsWLYg$(0smopObe7AOlM_Hd>&q7N6w zqXkzl;X%HB=mMsqZzyn;U3cqoF138_MkFBD&O7vXa|F11fh(?*F6)YOh`WIk&Gwi6 z6@%Yr*%!?3t**UDuR&pox^8#%G?ch>I#)?U4}-?n-?H4{W#CRZPFs4n8d2!Lcfpt-McptVdacN$> zX%0=HP%;S052l18?TW=K8)3AktRGfnIhG(GUv6>ShIy%Ud}JoxA| zy9v2OG~SfpnI{a{q*EqEyJP{e6Qh;t{1~XeDZvKVej2axroIMVc3sddQks-xuA)Lg zvQOp+#BSEXwnWthVYiquh8^>(wz=o*vHuzOV6I!Mz33s*(z5wg+qW??odQ3o*!3vu zOee4rU-84p7R?1>KYGi_5z?Lv#rNIq{mWcUgD!08bC z#A)2OW>+rrlW&Pk@zDr<;x)t6I)WgH*ejGoWmGCnDhUN;ir`6g3Y|#~-n^M42^}er z8#M~8grT0K_&h#!?E!&^hu3QJsa?3l7cuPCwcjudrNeF+$rHw($7BYfkIm?z;Mxj> zMA2%h$g3bd*rLnv5JnHtnn9Fi5H1zbDkE}bL z=_!!?KE<$tG%E;2J)VTiS5SIqSl=P+NPU!bXvn~NI`Jo1hZ4`Ta<73(1RgvXJ-j4# zC^vup@z$g{o_w}*K@oaH#{QKQt1|I(tzz=;N%8_IfubfuEh1yT0iP83MQeiL@;j3J zCz8*-S%OFYh9v$SKjx}YXuv~!l93AL5lMbWAeb$kM=M{(%wv_$=dikPD~@9?@KFxn z*oQU-OHcR!1H?%^q16-F=M0W0_Zl<3SaMD$_944nEINne;$bl<&JE-DnI)G{#GiuY zI0@s1 z;oj%Q9;Vhq?;WT&=-+BQWF(1mRv{r2%8}!k| zKP1bJ9GcKE$_$O#C}CpHi{MQW3Ri;DcOIA^uAYl?ZiOpnv&JCAhG1cZ6wAJVdK_d&o2Y9Bo|0eaMrv_{}X0 ze#!JNR7RkLhyq^@+`vB=x62X(_U{5lurUJd&;#NUdAZ#s1wG!J z3Wt*VOY_uF zx^>Lz)p`Oah?`Nc?rr7>V?LVv#8*#(lTKbQaNXIyNb?8lB|?a_46!rvrl9J z_l#?dQk8`9Z>+9gQ*N>bhwB0Zc^L0;VN>yQ5L&XUC>(Ms4cRI z1bn%>!0R_W@Sv+@bA97TO~zKbt23u6M@Q0(L0b?iG=jCI&>D3ziGY6iq2|fX+??j2 zVrf^ODZkRjN?P&?@e(f+m0}90R7j>fo9D_Fobm6>KBGI6H<__VHp%)hSGg51vqcx? z7p*2k4!Wh*W|hvbz93$L22qUPWOnKVcZj7D(OtAyqX4#N`bCiX_1+er&aW0QB=fdd zCLk4ZOQEesqt$6*xtQrOMTj42;69b*J;es0Kp<8i3KbLYlj{KY)u;olMeBlrp3ml} zKI>^dTj+t0(_C|wk2=qq`_DS*(-o6BJ!iD7r{!KgRVtBKgQrV(tvYSppLjzbSQ=M< zaJ3@-sPkJtPWf96_8ki!x{jdqx@80a{OgtxaHq1OV4XzJr&HRh`->bwjacrnKkf+^ zXW2sA+d`Y_GCet2wrqn|XRGcjG8bsiiA2vd)LMKNc|*0;Z;_YQls=woUe#6DkfWr3 zp;hRMGrg@vCb>*xR%y*7kJLCyvt12=Oz>5$x%C#A*XXF!>&tSztpPKS(R{wFR&C2S zlvS&3d9fY#Y?86$8*`n?3@7G`edHB#I}b~d+@Ll`bv8qM7G)@N^s+OaUD*@*Jb#*ztURt72;Gvihh5jLbWp|;D{CSe}wcXvt#j#U~ z?NlM?^*Cz!%JE3tMqWX`W&V(y4}UTPofTOgH!7ys)+Xn})z`JFEM-3YUw|`}iPk7J zVp^Kva+))oF7teQNHe%cBndxXbr_8ffCSD$fU{z(Lkd5aEk3KWf386EB+}uD>Zyzg zWddz+ti2U~cU)43P)ne!Y<_~8uh!|v5a+kZg!I+Lc>4}5l56D(t&As-yz&m1pYsST zi@mu7@(l0bZQKvOT>4tVoy_JPoIVQ2Arl&l?730wFeEjb$4kb5|WM|yF9D3_iqPOwsVs5th2K}7x7am39 zi5}I~<@6LJHZ&O~O<=gNvS;B4>gg#7#7T;7UI9zM;=6lVIL?tz9IBUnHklHI) zYe$;s1EB+JGH&p&<|fyrrx%zzEH@M1Vf_GmP?>E)^0Ow@1Va638R-{+T>xhL_1qGRY&j{i^ETZnb3DIC(Skee?b0V|7>8y|?PrsZ;0t zYPnUu{Z550V_vtoHUoS4HT897U^zABwrR%S1pQ%wSgJH=ly;}jnBEpm**>>M;WUT^ zxZoYBS}FvVN@~e*BpzC?#~qF=aF1BXptnQni8t~00FUStn#d~41_DykDkk+mm>+)7 z6rnu(=?7JMq&^$>cjG2fubx8N?ESW4&%$UpWTh%BS` z_-mJ6dp8Z^Zvp5|FM3oi7*33 zgar9IDOMUa8naSDya^Nna0?tcMLa{@EL|s4;>QkXSbvr3HLj1!B5SY^^^O`y2XfX<>! z%N6$yf;fQ-r4avv7V~L>IF5_tT;U~*WUcV{oeYy$UK52xDp@CrR6VAC!5R#J8Z1To z{?|uc&T~fhYHGCXoSw;L=yRBh$(naDlx<#>a=%C_-(9QIv=K5qd7PV1l-yxnLne=iMYIkxFZn3Sa(;5SN;?8ogXZp1h3|Nwq4CQHE1rCjLoG zi%4iNe)>~^kb)xq%Pq1f_Cdp{NNvCl=F&Rfk@p z*Pf&G)_I*oF)vvp4`5YS?^TEl8b9JyOs0mrG|Bz#v?4q}u&h!q#Rcu}Q4HEKSwucT zoJD8qXbb?-$!G~=yqcCd|_fep)NMIQGRkT``!K9e#MeMv# zLc*8ufA%(>`$1|{idzwj=OtIbCcZDY$S-(Jya0VUCa{527S^RQcCA!gfov!IOMIVl z;4kquNCnTh@_+CP)OLWdvoKSX(Z9&*o@XeJrB#XLR=s<1Bh(_-*6pqbU-(lL zzqN*pQkZpGvqGpAX&olBLjyVs4ztMtYIh(xJwg5mjW;n$=^t{e9=$}O_gJl7okXJZ zf|4b!{0d(Y^dp`uQK|litnLz{^aHM@Fu;@YwHxQ^7zEeQ^vWo?S*tP1g)))Kw)Xa^ zO(nw3Lay}+Ndv8r2q=l1{zz+NAvdhip5_ zFWDm9VNf+1sah)`1j8f4W561~zMYIB#*Yxj{XhGg?~g%{E&$BDjX(3_AK}luC6WQ{ z1Dt#>(FQrW_lgXEM(`w%322SVw}j@mF!Cah3DSle63J6tZ5?eSF43u^YB@~=YJvt+ zZp@EU5Y1{BQgFu?5|2OgY~sl$#4<6m@7+&7`@+!B`L8_P13Jh+Bn;r=B;ey=#0O}B z_P2Bj?4p`_OJSyyD*tf;$sqBE4LPxFLLyg7)jA15wzsx)kp!cKxJZa+#d1yf-wwU- z?9<)Q=Li5ZU%&^ReFh)=f`|bk0j%^q{gv}@ul_Sv#6VAeK?uoX*iP{K6!?7!{k{d; z3Ew^-Cx`<8LqmH3G)eaY<9H#9vUuy2@a5{a3-~5_wYk_3qt_98VBbWpW+;P1Wl?J^ zDpBJ8bx}S$d28y7nZHe)G~rtxCzJ6zV+kCB;8pvX5B>4`nMV$sKYH_5m%{M-=<`eA z9{(zQ7H%97xH) zT*OpT=1nWNukhu+MBButulc8hLT&)D*uxK8;O|S6dbwP$lqCK)8eoBb5U9LN$)E!o z;q)ThQ<^;W1WnQgrA#BIslOxy1Wp3%1UQ&MC)Nb9O4uLLUkZ5uVUZs&EE}=BQKHh5 z!r+iH@`jMxxD}3rsv^0Y?B2@1ECmeWhJ8(i`~n0*M4@e>4*_c~xm*XQnjm9%PRD4m z#$4PJsh(;tU?_m%0Qgmw_D)xI9P1BSVhjC=-x9rIz;;-wm5YS{Iw=flxe&)<`vzLw zaMH(>?SgooQOg*m$8GX8&(sx-?K{}`j#!R%mmWwY$Z=4{9av-36S~ydo7q{D+1Z&{ zL&|NJFuA5eQ(-K5qop@^!Re%0hKz3jOaB2na3iAR7Kx$`Ah$pRAg2$m@y-+4xjZ#* zm5kX;6uJzO9FNRAGFiLWUjh%fgwBpG?ptbToNo5y?KshOf|kL9z-07d{r=8uTcp3V zGTvH1!_9Vq&D524kCzU7qR;P$?kum`-X;1<`By?rDymh-v%7^Q{ z5L?5A7~Y1_ik!}JrzhJ(N%bmPsgP>CPD9?d#aQLOo)Vg%LfhtHEAd>B2>b#U<_Ep9 z{HQ7DP+s&21X#``eYVmu7_|5=u^fr3?IC-Q&YUH~pT{V)czx22Z zcL@9%^}Fc!I(RtALlQXyjlYn{5-3d$y}@miy{ptEP7;@YM=*s(>$}PJ{4P3VR;N+Z zgaClzk47!zz*qVw3H$ zrM?1h&nI@;gC2+4Y_yvR0_w6xod`P{G8Z15%>T;1M`nr@I-|yJq}4K!(Q0(J9_Xo` ztaS(|fys@3WVMUrTA6`Oj0?z;k(027?u2h^P&Uxdug8X?(W%vzUz=xaY<@6OG7{a4Z#Z-T#+O$DWTjKG@~_1%LinzYv%|2nS9*L z)B0C71pF?=>t2i%ZFub=^%h6ov09Uw%p$A~E05ZPm$aFeG88V<2cpB5 zu;?W^R7PcAFpb96Dk5zc*VL}$=^m+=!xt%Y0#66?@>_oz!eMwmn2&!UHB5f1Z0>X8 zyFWWq7U*7TsveCwgS$_U?!03l;Hn*qwjJ!u`pSs|hmYH2A+js%fAF)GcCL1ivnXS3SS5e883*Sx&2_> zT7cxR)cO`!y#CFT4a3XiwPqK<@mo;C-~5k26y!H^_db2}<}Zx;;rG!mjQNjS>JIJd zJJjqjqwf~SjUWnm+VKMbQ3OF>Tbp%Jm7xM18Wm>Ls9o_a)dk*g*zltoGS!8eWTVGr+BTdJ=?k2{mlLn=hj zBhWKiq?(o?Ub3|tF#G)!-A%iJCZpaULap|NT`ZcA44 zRJ3G#-=QW1IdE)0Kpe+FiMB(;k$m}7quZd8o5<)dBZ0UVQ- zbj(yG;YMtKPwvreca4|mGwgCkVNho1ote&Sfem-ITOfrU9|a?IyR2(qLs-~71KN)Z zSn79ptdSQrreh7-G3c`dF9;ym05&`Hr$Y_$9gX@??#N1+@ba?=Y6!&?p%@TE_Lpw~`} zxh9r$3a<$@PSqa$(q#GcwvYngLD=7+vzupH8jkD;1$NvqRMqQ*eN(XL(6;QtUbb!9 zwr$(CZQHhO+qSuvZ5wZ&bL-XnxmB-{G3Tsgq`#6%Wu!;9sQl2F5KKx{iTQp-$AK9s zZf=D6v?vA5lK6fXr)k&5O82%BpUQ1=O&BJ!0yoer8xQ!^)+2xgvSG}+a00R<=6nW7mHOnd>3A)putH$sdt@zcwjz>O*U#qd30s< za%+rXKCS{+O+uh^I&eFFb1{W^`cetco^NLG>)|NDewGb` z(_vsP45mc#SiQjJwyPl551 zHAsrsI4Qi|kc|5&E-wq2HzkvaCW%?lo;z}=?>xJks;v9m_kb$9uC zi#R{OO->n-V3Vtc{{WOBLIkLXM~zUnqy~hISqX37MTU1@HV5lJL1su&B5=d%NIA~h z|6!J_!S_!Y+LVi_`+|?D(*{2e8Mtp=NEsiCu0_@}a~Amn=Gp?(pzQrFpgAB9)FAyJ zyQN++fNcqb^0HHNjeZO|tzw5=W+2d&u;37T*>l^eS`Rg9WPh#j&9t6JEp(S`qdK(z``W(@$)BsT_a zI&LQOLBt^qbwnwQj$ETwakg}DFQSgc!6)&sfUXDKj)@#a_xgeQVS@`xxx)?$`0HeV7WjN;t_;AmR;la<}tHo9D=bW}tkRdj_e|9-_RyAP| zu=PoON^(JAzOuICcFr9c)IjE}TKD_m1Hr&i`We=3n>Sp7@-ZO}dVTPA5Rt1`kRSp` zVx%aSvzGHL1k6ikBgcbs{j@Jo1F5T2Dug5Lj!0m`InVM_xgJf{P0-GpLix{tn#@oh zg38evF5ZRc%L{E>E4+ftxHF$Gz0tfTP6;oraq0R^4|l=#JA;JYY@=*#DI6$QHeHV1 zqSq^@7*mP-!NxRxGz!=evcXlYvW^q3F5vElrT}-D%Oi|4dv+ z{}nMrlHDdT2L12h3l^2T#qG7C-%{XG)mqTAp1k@#lAl}1r8a8st7OG>;_kHTE$$kx zrn{)i#kyCg62sC8je1Uf;Bl!jG6Bsl4`=)EZV?iB=aFHlE@|%MfZtq6zmBz~gKQqA zWU@wi)_D_y@e%c_m{L%Tx0}cl5C2vf3BibsTvY6;VjQ!c6T2J(^H+ZGSB7lxtR}Z? zK+_pcmaM)oOqDgG?SZfE*mI2vJUoFajES)&@`l&-LMMUYwdYDbn&?@%pS!weP4P0e z#}y|>4gWh*_=I%=uSyfr*WRIoY@82XMH<-7$4JtPk zmRrij!P`_F5llgkyFs2D>yh~artdJ_zOttMShgF^w~>s&P@&V0ce{CBRsTRvfJkt| z+;YxK!%)c(42+nMnI{C4a8g~N7tcd`NpmFi0hls&at0ZlUh@2reyyeD-=82LXXgEe z+4hWL6UsjfJAtR^#{;6!WIcNt2gV~75VPpX09N53dIaJ?VWuIJ7MiKFXh z<_3sPmbXKo4qhQMdyL|;LX*z&?0-%)L+mcmmm?AY74t7#k)) zvL|$59IpW1^(5W$D;vLpJgz(x_ku;Xz!ZB>vbQq#f|<~l1grzD?U(T#FxS-U+PT7o zMw7izZI!Oe%F!&w92qE_*g$D8XJO7SwL1_C#p!Uw>($ok1uxg*J)Q47^l^nVXF|F5zYmZR7Z9>oFxuz7KEU}t2*?`a9Cul`;+wro|4%~oX0%t+OEgd_Zx16Ggc}8l(0&w6p5my zSLckNcONJikiRCe*jrEELK;7tyvjv*i6dFDE4%)$5?EDqq?Li9StWNxfA)=EV_=tNOdPyq$JG9hzRiU`!ehSyU<|!LBmiz~SQR?p^4gwwy zwYxOLK6O~5Rk~z#w*kRfocR0CVV70C&x*Sh1>9!V&7IY4!w3IlX^UR%yUYwIQ0rX0 zZ4Gaq+8gY(HrCV0iY(hp9q|o0oWITlvO5lS&7N~B=UYP|t17BXS>&6m25xIMa{Inx z<7*0Qfq!*`^!$p7n(23wd9vcofXs}T&``yCwn9VQtFVq-Xs9ZiLTD!&BBOdU*K%YP zCPMn#?_Cr+3w`d?60ooe(X6ox;VQpelJYh(R^$&7ft{%VGf`|Q(AhWlNuKsIWB2av zRlQ7qbBbKNxT3NjiZD=u#Cx7Zd{%PAA__aZY;$fWKy*VEF!q1|G89pBI=XaB<(J;K zUeq2r*GW;fEEgGb$i7MxNDqH#@7f#Ypcy7`vcy}7QUj%MQ zeU$#LB>kd@>2fxHT`3k{-AReT`QIK61Za7Q%DHw00*?*2#YM5Zeyq)1o%=kv<@xQk z%@x|6OzZ7pZ2k0ye1Ew)zT_2>?~=fQ~>fU~To57r`v;UUsa(-ZV@Uv#&2Q)Jr+#LwuN zFKG0y>s6I^HIWXmR0#k(v$5E#()n&V*1z^<_=*n!$DX)JxKb%RgmHdml`;i!oBe&A ztnBgOqsph2I!(MXfswL9dEYf_NGQxGh3)TW%E)fSy!jWvUBF>}vbNmwiVM$*TGGGZ zmwQH8SGr#48>ATabCh$zh8vBJ^A{ML{1NWm+{~j7qQwq11|;6 z6=UtfqsibMYYbvg*)By3NShnuFVp2aJ zBSdz#?$2E_?zT4x0H9};Jq-ZA`m)e5(Srsok;)f&t2jd+} z0Pf*bVQ<{|)EAlz1k&keuk+1I19;6mR$r`!HTPlh?&49off^Qv2I#za++;+(pf0Ned%GDx z!$|z*xskl+6K(GB*_gM#! zEWNfK_oq_Mq9%`uGSgySaQCx5E-Gs-zRxtT0=&mIS=TlJ?n9de8?sNl zGqTjrdtjgTayY(qkIE!++Yz3c_I#Bs$!g>SH}pA72;hi+T)V2jXZN6+3#`_M)g7`)8fPBmTr+c{h zpg)3yLZ=e14DzG@j&w|ylH}I-mSg%AkAa5he&2S=6laFGea0}KN%?_d{;LO(3^bN~ zx_y}K2035+ZhFJPVF3Ng{;hxb(9CD?(=9IhjqrH-b}@WvN`#ptK^pMa#TTgOnG@-( zAMSza-_RT3&@_yfC`b4kZNr*AdAsIVqoE&}Dp7mxs{x$79L6+&ujfmOe)NetIwSlO zslESwE8YBV41qhRF-s84;m%!;-A=>5nDM5urbHX)uzw)O!FNeaEQ`dScyxV&!jxb# zs)W0R6xBQ3Sa>(}liVeX1N)`9xj3L>h4M5eV-T9elpYW}N!{|tCjN%%mbN)Nw&cBk0i^()>>8{wLfA|mrJ)uk6h#*S8~Qgr_f3&QwN1+lPYv30E9NFTVOj1|OAhW@YXh!%ZQtXqvUfaoP;JL)E=QJ3 zgV!D<*B+a7aNBKd&Gf#%xz}bdsVF12d1qYn!za$uqMxwLfwvg8r@h?X!RAM%K{!?A zecu|F1Q(>ftmrQ76*8tlNn6x=M0fO#9Q0ptQYnbcSYI~Gicq@;Z=BgLAwmtq=K=@> zp-~GZhy#SOi0s}jKu5biB+}489>END%0)bBhvN?V1z{wiO&MV&A!ZXq=ziPSU_|hA zgD^>bS#)+mPJP4q%BkQHfIk5<$M=h#bW6xn)srRxvk(#mlugB}S`6y8NyksDJJE6U z4|5mPK$;Nk%HzXv$%M&;xH5;`by%n87s81)%b)2w9FkCB`kYT>2cRrts^oa?1od_rUuJ@3YkMF~-(u9OIsukON9sp1HerWZ^#TRQd4$|bkLp>j0=4X4&Y@`zHCdS#p#QnY-TTxDkx zTW-Aqxyr>|x(Y#JC3@90q95m&=jq)4M#Ms_WdWtsm99w zL)FyCdj<27(=+#VDbevT&p!thnQJ8#R1HysPv;=oGcybZ>o>wAGQOh1y7fS=e;+?r z6il~jo|C`@*Rnl*lX&HK6^%k%m*4vdTV0T(FHg#y0%D-c$nh zlSQt#m5DkmOsq|a@$9GAs@}5MI{clg&S6q&JUim_0*WOjArPFK6P^olVo5E4@xfH=U!SoGD%ZXq?bK_^F3=cNU%>UTqMhFPM** zPFka1mVUYrSsUu+Y^N*6qGCQj2;DTvc(9mEIRtR+=T+4W)+!FW> z_bt7}&ws&-))u;9>PdN(A=ns|tl56Z8mXy>sBloIQU#{ETlM;Y{sP#pmEF1*Fd2Gmqmgw12c z)H&EOlMV=69DmS1!JOMMw_0wC&d`@WD(W2$s z6q5`V;rSfA9S@lkAXDH|#^tob5FSQS{fa)pn<=s%L#H}~vgW96A8^X#ycwz1An?qt zyW3bdXPQ`zUS^I_(J)!siMX0(sMSnSzJg3?J9hV8pIpCh^o)68+HE3GVsbAkb1EO# zt69e}!-_@Mp1Ioof!meKK5>}D2v+i5)hgFoa+ox&T2*8>=@YL_8k)hxOQR$P$_``~ zk*2~plSZb>u%gFH;ZfRFr-eHU#a+Oo+6Uv{Kl@JSN7l+iX0 zDVH?128=RW@rxiHlDrsU!r)zyff#jrhsJe$OyK5FD)H~Do+RGuVd^U6I>a=kufiSs zbt)Zz9mL`1`*%*e(@qwKoBYj(q~Vb_N2+Lh8ZDz(mTzVwv{ z454D2r4|O-F3|AL8b$?p9opa~JBa+2UYC_?%BIxgU&aDq>Q>XVPk~DX%Wswe^bpd) z5oHx8wc$rrq_Y{ zpC#^G4$<9@u>%Yl%v=H;<8XThX)kC~-H%Om z=hI?|>L=m;3zWu|{&M$4+p59MRH<{Z?{ZXVp2?0z@`i#P{D!?J6fri20(2`Z2p+! ze^$kyno&NKfP3h{Fj)OXS1peqnC_fM4mz znni;I#3bh_QZ)E$E%DXZ^YDfW6~ca_SA9r@_V-kiQL+an=jJ&^I7X6ho6l1(SP+WN zd#m83I?L-KH1orptn`SDMxMn83p`Vq1V&DTFJ_B?Cp^YX%ZG<9GavYL#TQw`Xmv)jn zwvJZ1Vp?s!?PpZ5x+1Jw9{;w+&ryR+60o*AZftM*$L_gA)Sy$=VTPx_T5N;7M0Xf!pXOZTbPaKyPRrP19lcW$7H79DC!B1|M11hYr=l=zdUYOracg zwx84KKa#T$g?c3!GRGmxpRXk}2b|a{YqV4CO-;+&>;aU!sm1|C#m@Dj0IfNK$4iYT zMA2@i1`-crE|}gM zomJ96w#p|5mO>SuopPE*GhX94ud1D`a%W5wGv%gm>zYfy-QB+2!oF@jZK)vGJQT4YK+ZO=Dwe8Duje z^W{%mo@XRF9SI}a6d=_&uh`_QQo@+YP$g`PT4R_#Va=*RLxq?mOI%{nag*$waO4&) z_-QmS)F#wU!G_FuqTBnvY*kmW>|Tsd1Kk#NP~SX95C}7=745VoAE{j&^u|*&v5aXV zSjcey&KaK%rlTmK`#jSI7{PF>rTAyhQrIs$B!let>V!1{87Xgna=MI&;?;OF6<%*!#<$ z9Lzg?e^U{H6s6iw(-Neg&2hwCF~YU)ki*}M>z?a9zlawAkJ5(IkYEz9))&fcLDA$6g6kdzVn{qZ${(0Kfb~G;KM!@WbrC!;k3O-?WLKX(;S43q(lb6(_8DAIGKf%j*REUZa?0m|OzfcXSBeB#i z7q{P_HKXxw4bpNMHY7-|&{y92cESa0i-It8Gq3zytwz1&q(&;{@aJkMA1Ddo4drqO z(C}vEl*3+Kfqj8nmxkGYmP8;p+=zjPz2p-kknWIv_Q&?f?qTDJdwK4O6VE;oGgFCo z`lI$=O@PP1Uh4eeFiO1@Iw_O02^G7JD%Xx5>*!gMa^w=EAWHP{cZRp*C9D-X99Cx4 zu6UvW-I^6|HzGbc|6WMp~}HI!0&LBB8EjPXB2u zHD3h0C?YKeD~OjN`ZI382p^0AC2bfIBk_&FxT@MIjeTuQ+l>bgPO+NPWIN+^apNOM z4G$xwg~|8ySS*^b)9MjF@Sx_LJEpJY#g+d8ehBWAleSadX&zO1{!(mKu;wT~dOvi{ zlr4iXoIQW+f$m+d2VhB0bcv78;(t*9Kb z*S2j%57$+jV*Ld6v7zhI%3c}v^Brip28pK_h=09*$;8C59e~WYYuAFlG-bIbRTu1x zA@?s4eO55%Azi8(w{5Zg&0_2Lep{(Jetg+(I;HE)Y&+fIsms=5O^IV>iBVOLHX)jk zF-kEV7_S9;72WwbnFm%%VAHG8IGdn3%c-l@xtcgujS=X`0b;QR&<2=*xUTX?D$3R= zAm=m^@kx|rGCs!&w5wL**+#-SV>DZfP|~>m#5$C(qOL@vCK&1;4iHyAR*}8l;w65o zcUFtxy63H&Xp7baEXmzPvPgsqAI9RMC(b~4u)xRQLJj<;Y>=qs8~d1>7$F^PD(v7f z3L$nEbQ0moeU+)CtPnChsgeHq_9ts*A&ka0K$cKbCiJwF%H6 z_i-!2kMOdwtf9MFOz(ZAA)jXJWq7b(KVM=J1pPIf`El-`y>s-zZONubjr!;Ft|Iip z5oWwX=JY8ZHiXX`h9O903q=q8PL-O3i5s6!b4fIjTS!p&)$tI-A`f~m7QZe0qOCWo z&;Om#qUo-Cs&sB5*r=15pmAk$!aem^t;d47yK_Lt+BUze#6gfU*I{Mq1$Pf6k0Yr0 zl-M(0CDon&#Qvus{mOFJM4lzt2ca3*N;V~%5XsNqOi_5@>*RAg-0>}&M;~rH`jlQ{ zRgzvjL^axA(ud1OwPLv@gV%Rv1}uwujcAd^;A6J?yd2bKMrs*sla%U9hJ-gkU6=_` z%s|QaF*b20VFyv~de+dYxL-^uSu#68>82)5#8b?R=%{I=#{|RC-+Y9#Mx%(u!iuU< z>Z|u)w(@ILFiN-}L7q~GzeGs{cw=Ov_W)L&m#TcoO91DBfwi)qexOphA{nxnDl_Ro zq?brL{-JcR#nPeV<&x;eBpoh){TE{+kTf)a_xr(?cw4L)vg6z%FTi{v$KwgMQwryv4VG3+#lg%gi0q8*7|yrp44VvlQ#T zPpp>K%X4>`_(uu(MUWcsj_IC`{5HEBcIiU(+OPGe+AP#ki~44T1z2P>cmojl;jH3_y*yn)jl)#*+uP;VgTOtTkK7irEl?|JATc#TsQQ z=R+x&8v=Ikr-xuZPr&;GNCfI0aF(V9C-{$>r_NY&_%ghl1+Zq3wy^IvRW?V zJ7)vX-5BgS(7YtieFl#~k%kh(;`?Pl zr+0CqYx|IzzBWGP>x9>5G}SJX;gP?msD-yb0KTdJ7|fqBWs)!0RliPe5YIMTxiaW~ z!0Mr=-?EqQV7hUe^r6Qyhq30@oz4HIrrp6%JAZ(xxiXVVprbn+l*^BX+5wP41mmXY3QC0a^zmYgX81%&rji*$vt?F$T2wS!EJRqLrFcJ={ibP7~F z-Z}DKQp(mSdDQutV2KjTS?_@kLC~GyJWU=qdzX~cN>#X`bzmo8hpCg~Q<#-cqMTE( zRylH2*^Y!gy}8B+m@HnR%&9~_FK=G$O9T6l`gX(?Jb|WEbrW$lS*-~k_Jqq(?IU3i zVKz*kUQp`|N#(h9lw*(Eg6ONIsY+aoFK8Qm3;pr0uD0z^c;qySURYhZ6aR>N^2tAr9h7Q6Fsk_e!k9D@`|$2 z76X4#h{J-buO`yGS*&y}^AQmG!doIx#%QYMUJas)Lrz|f3q!+qR?YMi;dY%d*v;Zb;cW76tUY-ln z0V@6jS~a*sZ?u~K?EO7^zQ-TtnzKOfxS^H>w#QcR@2OR0^oNzB4G;kd5(e-}M?h%2 ziTkRGAqY5s?5owV^nuu>pw_i|OAdK;mZklavLsM>m{5hng=3arj}KxB!maXUMgI`m)tSF z1)4;9pa#JLwLo4e^H0U)z1e6OQEwIx)3$hOPnpmQ$Bal&$FBy7q>@2#e0VMd z(1%F?#3=opv}tMI-d#D)f_`Rx{gH9Rl0Tq6lbbJdDZ&n$=ewIQbU_6JMnCZR^awx0 zHDPgBK`k7AX->xZO)TuzzdH1NY7J_8J4$qqV~u?#tD%5p1e|23B=uV}XUQ$vK`%*?7bdt!%Jhvd|=kJJ-f{{VVcHuY*+@0f%^6z2|O@ z{zVYtljX7^8y57E5AsQ{Pw*0m8;9jd0`(|Goepenw_uuU-p3~$G@<;9(Pc8L%&6=& z^>Z_O(+!zcUB&h9M>R=$D-svf9N%AGsyFYKIbIa&yzqRvd?&B^$3G&mW!{QXlVmI; zK8dGB-iRaNh_4VO(PwkGN=$?k9s!cIYCek6zv?CO<;swQjadp7Dvp+X-V~n?l|a4M zfjz?J;~3O%9>g%!EM()HWGM`%3EWuRiLaWl5_0C|qzq(93yWP)l|7N_FxnaTsz60I z<1}VN*91w7^NPOccKT<1N|r~OEux-s{g*w z*~bE?nwSaWsY)p=HEyr!S?aZQZfZyA``Or9n9aac#Q7n!UyPsY<+D2am*|6Njafq& z(TXAwDExbtIh7QOEBH(Gm}&x{1XMyb3s%UM9g5Nx%Z)hKv5EdF;^1HbFCYzd@FT|9 z9z>^3C(!b%XcAO+=<^sY{;A8!tVxlgirSn%^FviW2pEKs&s{5=J&Xm+Fv6-BO1%*^aWM9wrh_#GUr<5JLMQKWre)DPR#oSaj z@8r^+QZ~&w_!A^+L`oA`?5e8JCR*Ax3mhq%cZsY+<{?=ERjq()SfQwbxKDv{d2lC3 z-}6z871>TXJaRW<+VQhE7}a%{z7r8Xa9f^F)n3%TUB3ha^1 zP;Hv5{+0Xp6V~2x0%j@Ybbkv**C)=?C8?7oR2&n8uk6-!$|v=svYa;R<;<3r;nK9I zIY!`p4CWA39pyS-C04&!dg4^brN5v`Sk^5NY-O@dhcUmP94Ry^=qKs?bVyUBB5Z30 zDZqBhP{k)9h)qVh^L=~hB%(JqY}qpI(Y!_9FEf8YZ;^Cwy%)`B+1_wZ7laWGFYDZgbbZp+nV{?3T8m@6$`-U|VtQg*ju71+n z;N~DxlaEZ)xFV5mvzoSHV~T3?+q=DmWW4g2MDaO6R`JmuZUMinSe0FlFoUw!UfEft zt^)?9DO(az0i*ZForF6f1yEj7)t-^fXA*E0)?*2M&}5rZMCub!W)b}q$o6Y_TIfLI zWS7g23`MW%b}tJhG25PfWyMZk=BPsMo!Ml&D z6f3kt3TV@7!CNrdI|$!;m8o6rur`y}yab2N#4APsr>w1e}ONlFH)L;dz9)P#M4)tq6^g5Egrm$mnF#KUG47Wt(Smm)35V4V>cvSqN9jQE!>p5bWd zVETMuKILBVcqDz%u`4E*E*RwYc3}X@|MDj)JFd(k^Nb;ISDs)#C6e;R_!fQF-thkQ z@k}k_>&k?V-X|ONqyKAB+n}tz)0tTfrx#^?i1Eqz6GHSEb!96aD{CeY`NJ(iOIDar zb+%-6GzxE0wh+f%a(VWcm9z$W*0i&0f5g=xnjz-?p%&YSJNYpw`oQ&#*3_5lV?hKW z3;N^1G`WGITzYo1XP1=R<%83co0jB8c#HPl@*aokjLNNZ7YFi-ZV872``udKaK{w# ztIMqXbX-s4jsK;}p!HRPXf$CwG4*@=Bs-Bpvsw7-7Rg*w#N>zQL-s%?LAjEwxuyUj zM<%H!r--4n8e*Pr{l@uJ@(cfA3yH&9vcN|9(l6kXokY zyQI1NVXS4cHFO>7>h)><+57U!3CcO^hU(J0%QF8wRjcRH)!Eeb+x_YF*Kh6H_x09G znCAmmPR>BCx-6?~Ah#jc%=5=XYpOM>hogte=b(4B*Y5T7v3dEo<$C?)>}3un80-e? z?Qd)XP8@6}C?C&T|K3oL94s%}+vHwVkR8mA`<+=(A9kbNf}fM;`=NOm#C$-G-rx7z zF2OEUw{LH@1};c*$5*zOvwxKu59f4DUiPmkgsJiVaU-I*m`Jg%HuI>~|L=bGo929b zwq+FC05-N0kv5DM;pf-w{RfQ8FF7%-fWjd-gEHY8`lEe)TR1MyDli;3_Z4Jl63*`5wDcF22&!%Z#lupgid zS$s3_MjJ5>`TRo_4xPIzS$fR}p2xwOe!os>{U?_}tq*(*7n{J9#k2-SAf%&nZ%|vu-aufJ=RZ>|Z9Bahns#~>6z%j12-?X-Ak_cOV(dupiG`b5x=}EE zSZ<<>SEP7B9yJ6}$9=WxpLFbAlZs?8H=5+Fw&`6$QZ0C%e z%u2o!xVr+1)BtshA(&{u_eC6OF_7^mBhR6D+NMsl!SLjby$LsB!j~gIXLy=;z$Uph zQTQUPT%+ihY6M-I1gxV2q%G}FisFY0>aFwH*?Nls_Gn$1vFZjOQL(n>e+M$>Hxy6VOO<8`{hR>?Zi5&yDRdk1xQw;P8zN;-1v4$z3T65bkn)X30&($vNy>U?XK^UlP;La z4r^#8uNyW{7lhv&d|`ob#0fOGM9wDbSHNA`fBJ_`;$N9j*_3upL-{~KIZ>nc?|`SZ zU<)g(Vg3#+5d>YK^P#tnOaY@)qo%NCQ}`x&*;>8m>HC{8EmL_29RY=-_H1A}Mlw~} z31Q+9CK&yghcap{42j9yJ#S1iq~#=W-9|iBZAvWRPnmo~nxg02MD$ch)u~3Wwl)=> zfLpCYwk{!gi_jTI?eb^;?VgJ2OqgPp00p+Fqxy-KQ)hS5CdZW32hd^)NpC8e5+}Bp z%gjS+I2Fv;;U7P^=0vf#t-&gFQjZ=T5S}j zTuPz6&~D7N#L;-^v^UhLcTCz{e#*QUl0D{I{KO@4OS7zrD}230iX*zx1T%5ZhM2~% zIr|z0r0u+xSy;PV&at69$}MNAISt{|HVdip6VbJe)EE-=CSt62N~tA4b;Mfg>=2oM zb|uLzxI!RU5_llt=;+n_B$!k_F04vkIfALEVYOwwZ zmXr=`DsFb84Ldw1FJsOY$~~%^%XHO+EhTDt*i?gB)iSL(qAtO+sqJQ?4!?J^OYu&v zc>$z&1dPc`L{GmbLiFY)c}}0NaL3WMW1qmQVu&6~TTarqhN`e_HvI;7ic6TIr{GN5 zM7BK}d28Vu-%n5L48J!`WbdaX??8PoH?>0E&cui~kFenEWk5TEEjf4qAI*lJ#@3>`) z@DiSzEHcmTZ5>n5qWp8y><+(l`n)SpQ9zD&K53rs5-mY?aQtB7yDTa zU(Bz-R^xtMfbBG5jW7qWqpC01+Lyq6Rf06M;E#gcobA_r%F8?x@hyYjT#E3)!o^xVaQ~S1V$4+HNgkTn@U_*0_KNqd&#hQ@!CO&*S}p ztR@=QqsnhlR3XA(CbV5WLId8-@pnr11#a(z@d$^#Gp3=mfJ@ZHp<`0tRDH7gC#51Y zB5#qeTmWq;&<^v(Qf#~y!^@%DxumE?*X8T%b4^?8z4B!SEl~^nePBrx>T4t90#XP1 z)_Em*yq<2ww>Zq{tj0p=ASWqwk?`WUP1ce$RYVknM9Zh%cHT|glG!7RwXZ0ldwXp4 zVcEf7p+=O!-|MN!p+{vh&zffl^#B>U-deE`(lOF;Pr}ODM$gwq-_6XzhGkq;R>S61cYNL&-70h9im91%9wzPzir=@RIDq315 z8dj#kD`r23J)W$St)+_|(-glSGz8_~>fuV=+fOSqy3tx{V|}@7?(NE;J4!oxXzguE z%*%?3XH?dq{x5~Slb!_*D*ORGiVj9jh7MGTkle&*Xi13(N(rApKKkZu_~GeJP|w={ zffo@L75Q<^Y5w_W#=p(L)xyA?nwP1&J}w9A^i2Z7)zHA!16MR|c4iuGPId$>sAj4t zV<<|)AEed5z}D7Bk;y4vI=_6VDJmZyO6l3#gd6BrQox714$4nrz$w;XQ ziJx|Fwd4)j-O&}=xPcz(4W>~>>dM{Q-NJ*Qcbs-O0KY7iAGat9(AB{dUHRthjvIVP z%rvzut@K17v1y9w9>o6C&>MoJeted08ZgBl2)IH{ZVtzoOkiMxLOyzd#MLrYC(scf zJ3!1o-Aq6?Kb=SkiQIs;sN}7H&A}*Z}pcA36;U`RVNF4oIK67d~5CGgFUx zW+o>Vj&2&%EKvpF4@*2&-i(Isv<@dXA6o-GH=hT)o42hi#p!RW9SxTau!8e~%a4Jp zzj2697iJ;^#!5p`gHoo-@p>pU4DJ*hp>LD7Y)R$m?0S4Na!ZtCjd3tIQ*K9`(;Sbk z_WF4zhn$YLa~5rzh2qjs<_*tUlkJpanEP`TOgxzJ1 z$e!{L6u6Y35<(4A6P+vRMC^hTwlX=_B7=QMo{f?qNn`e6G1Hc}8ZHs!F;K&{17&zC z@yXt^|jo4l8G(sK9;vYg~1+J5t)pl<;KEycZ`2zj3=;CVU}t7cMF&eN)p0EN zqjr!);EZXbH5B0lWpEwGplk>u{gB85PA05y1A%;E)p4)fZ(meodBru-6^MHxCW@zG zbHuVXPcUQIi35dJ>Wk#B`)Sc+jS5E>_xo%Vflc20thI%h!dtvsX7>y4q?*Z|sl5SK z1e3Fb`3tL$X&QW!sNjnl8};;^=H+e{8&_(9&{Og5SqVOwik$6lM&-3T`}53Fp-s?+ z-OMgE$6{9VDxiU*Ren=^d)Cw~ZX3@)o=5bfxn`U0w%CJ-(d|<(x}!nnWky*Gm$lJY zioZpkQieSfahz-%;?0DwF2IZy$!F&+cbEXnc1{C@_NaOeBnYKv`;?~a1@7>58tg{g>P@eV>7LTw+LQ<))XLJdslCYSNdv=rGA8yDwDxr1_d984 z!sszVqOe>_io(X$1k1*;Bz^I{(QCL_6YTg|Oz6kf6DrhXRC!db+7%|~5bb$`*7!jg zfoKiz0@1Gq{ye0-`U8a=uRfQNb?`ln_cDXWniEqV(BW3R-i2K*M%gZQfIp5uxma%y$P#N4AP(ctkJkOsMX z!!h%i13mogRDW2wD#2stJy9Y~)k_0E>robthlUOp=-JUh!TkKM>Dk}Bf`DJcV21AY zez9@eFJOR!4gBe$;X?rj<1Bfh5n{u@c{qpg4bX|9gM$5R^) zSzXmj$m|2K8IarC<|3m-AVq;jE+!(b|Ddw{2lYQZ{`cp9xUzDweqZ^G#>DyGJsTs-w_fbu82?kx z%=%v`Ilp!MKH_BhM*MEg#_~U{zwN-rM#RF!Ma1$g(SLEid2_I`{a5P$V6brg$6~A; zY&t~$hk;qYYyWFtUS0-S6I(N9^KWHYI5`=_Ev%hQ92vx|4V+CxO^ob}P5u|1iHM1r zi=Bm?pZ|aNmwV=UC$#>r!A1dIr>jjJ8@sjQ3!ORXcACmIV~ff*%ce5ARw?>AIVKGH z7X3gfc6}mbk6~mOGQn7rRg6?ce3-nT6izZ?;@BQfSO{`KKZtd0Z?ntuvXwff*r&rc zU*9O_M>n&}iH$U;sZ1`Gr%Rn66k*5b9mVl~T}3oOIzK~*51#}f%ZY`2Ms8(-YM}PA z*nM^y)8dHU}{zIMb3yB!JJAY>(%rs-56tLwqr}WAC@^a zS6E}GW&N4a!9{+3w>z%V>ADv?s}c^f)BK~Dchpg2^-2!b#{;;Cu0kU}V|= zw_C7S=pA}5r)i{T)^f2$V6u8Vk{BS#dB1E^jrx9-euop?$(GI_C1c^=VK{JIl9z}) zh{8|1>U3UN&`xII#g`CpsuXY7g}ND{YR+Pqmk9_~WMGV+jS++=O}5g{76wZsY0*LU zr?vsEa?B*aOAAFR57gidGjF_6az66j{(@Nym)e}XK!k38WFdoGr=v%G+aDa?PLJESF`LhO{3*@V^7qWHtVLfQ=Ua zs>jlC8d~NFy3eNsWF~guaJ4$mR8&*zg^-zfRNgR)nPa{Iv>7j2uliupfh%XlLkj3C z^bHa1a4uP@+dAJ&7f;Uu?uKsm>roFO8{nP1UhDd>emxbPPCMA;O|e*bGS?KKJ=kxd zJ=b8U$^ASMHqLgOl$bp<^WdW=Obc!=iQ^0LI=7Pam}{&OIaJyE5_I_w<2Kw`F>8)+ zIXC$R{6SGFN($APyVzz2X)P2>&IBt)4U&ZG-^QpBabcd`b2r+?+zGdR;AY8o(rKnO zR~$KB2+Apf0&x`D0kXMoM`+_YE6bv5Vxvay3eHm+ji9%`SarDH&Zr(_GbG%p+RSes z5_{ppC?|=z0kBqhrAKR;lO@vI= zkP~v%yPwr+m(MFHDr@d2+|cHyVK1q+4N&GU8iz&-yCMpsPN!+p{qxBJ(feZ0pe{@?#BlA{Qj*ot!b7h*y3mU<7^&C@J8Z!5^@gD|m4*usYsAkUG!}We9h` zN5jRxgX$HbbO)vT|Lc;|G8F&_X)(;l^i4ofHlzGatye;o0sT`kUj#B0pI@70YB z=fhX|@(Oxi;XUW@@b&ocZM0_rD*I_A+_!fsc7V?4#Mn zaT<;^WhzXTq(fGeE>7Hj?X2vr9JY+z;9r#ww=jKTR_D?~FC-zlKq{e7i_|OOE;ItO z0+()F5TcjSo5XXgZbfx)@iOq&@ie%r{M(Qhf`|D-*!2(-nP%D8Z*UnWN{q%=wVUt` zzaGNFx>3G7uezHf-ihzGrk-58M6%oRx*^ozfctM9Aap{V?{?+q;%>RnUGW(lxc+%!G8$% zEHbM`mnk7wir&4jR|uBRdNhFA2>oOVOwtUVuR$o;$LIiI7&_i-bSLcsu^ZOdwYq+I zM(iLIh{)+@*h{%C$Lp`f8;M1;7nUC=vNx3PlX3uocEG3ai;@iO-dTSi4C@Yra-g`$ zu$a)e&qzM-gpYNX4|~L~NqF~I2*dMZ&4$hm2!fNc;pJnP3EM~|v*F}VksnecR*?cD)uaqT=sLE94mcbq-~F^v~i*c;ct=xd`PO=0}V{!#1$vdenCk4cNBdT zMTh(-^2AU!5c->eIF8Th{DJilvN-H=)X;Zr+~4i)E&(Gyk1SD*rA9I$VfBPBYejL- z(13d`{-~`!Mgb!a8K|N@QI*){@_RT=Xri}`WT6eMbV6{b9TW`^rKCbMe%xpcIOe+f z8y-Y`1-3-D<#>FFp>+Gcn?_W%7JlP?$^Es=N|?y<;O7NFHhwfz1|&IZiS{yk9)hV2 z7qrp?^tauvu86fUez1L3pvxfsVgtCK%gTKR%gV1*C^Ufm)E{1Q`ACA#9z6(&*Z6+8 zRJ$L3m>@O*`(~gV^IdzGpv}r8>R7bk3LR`)2}Jn`fr4*4*Lr>miiV?hN{3`Huhx_K ziC`}kLefvLup6KI`3C_B*RI9JpzbB+2HQS zeh&Tqh@N^yWPVnJB8m1O$SQp^IY#j0hQ~3riS{TjeR5jG5qSX_pscGn_=&5N(kRa>p=e%`e)=fBy%haS>RY~MgU?K6w z^%K?ht1evNpFN;Cb9gYuDIA`ZB{jLJ^4xkrr5aW4;5j{BtfT*O6~sCn!g3X`nmP0S zQ0E#`)N)NO7`ni6uUxyp8iLbq-+5lMbZa)!4-&9Fis2$8j1w6+4ML5^+5cxb407qR z0KcGHW@Yl_51T!ZJ)l&}3Q-2h#C2{*RVzFM=b)XGl> z5bRpd*6yaql#2*&+)@tB+|*?kME`_f+*)o01!h}XQET%K<}SFS){5UQATi_qG$Ns* zl1!l-q`P<=iWg5GT@O3;BL<}bK^x}7iCgMt6+v{q2{QJ|?3&m<=G^jT^%%DbnyVc+r zsAu(W$dhAfiIi0?=?5ICVPP~dy6y)G*`MZlBlMgT4bi7)NEPm>gq+|E~^~# zk2SJu#6sCJ8A#ZDoBU-ilX-L7xmFyU9I@=@@ zphfC2Dl*z#|E}jbE?nwz^EMf+UUtr&Tz;l+Es_@^x_yLiUOrYavurOlRb3oa9w_51 zgyQm0*Vp$vs$RP6)BJoAze&1)Ys*%QZe39@{*wN?a2>X+3C3J#*^d*XNpHu-&&wsq zgSgdJfB3ej5WloOA`$)fS&CcWx7%?L?E|=BsZeGqsN=$|Nhr5)-XRe#@^>r%Xi+Fv zXC!Cn5wZ5Ee@Ba2Y<`B9sK`8(Dm$c@0GF$!7N?h5SP`MU&Hz8GwLfd^=Hb}+_O-TS zWO4A?T^k4`$xqyV>v-B*h-LCNe+Oh$UVF$KyZE!ojs~Pe+Xg*~97p{)VbJ>oxRRkp zV}b5so0|h*6nTyZxr zrcfghbI2K}Tv9>2j7ihJ{DCP`a>gE0M2uCwX~BEYTw)^Eb1g~dH>;c-B--e;)$vtk z)q&)E`6h@OtQwdaDxcsu^d@g;Z#b0Ywaqqwkp?zTkg| zsLXnZYZZ?MM|y!xAUy)mHd-KhiqDySX7?Kc=I1Ja9L49eRsg@f@|7fGxID3m1ib7ukb!%fP%7nKp$gpAP`Y;MZqAnj~@^Sd_>fC1cjpH zmDw;g0$w>AD!EC^(B74N(da6t@1GZo_pt|x&K}|rPBVe48wrEBsFQg9@5J5$o zUlZF02G|TN7WShD+)+&w%t+-03iAZB11f>qloLgaA;K)d6o4oo4&{PMs8VTxqD?aOauaf2S8(BA&?9>&@crAkfc)<66N+N=~FQR z86gM22?~%)7^QbPgN=aE%FpqA-IVVM-L#(pS16yE6h7j+gh2kHYuMlzs`sqEZOTZ+ z=g>YqDlf@haDZ>#wV6lf7xqFs=x0XXTcC#`<2ymH0K&frkWb0oO(Ade9-hEgOFscc z_l&+P=m$2CZrp`sunw`^W}uHq`6pX2hlNRZeiDA(wG5y;H|YbD?g=V5N5ws>&kCqp zbPb?;V$psW2l`0kexU|qo<8_6msUe?%EEOBGTigpJUBJfnNjhI>{im!peBEalI zH36Y=f?_qoLN&tNnw&o5&YAxX%DHhwMfc3U81uy#CHKU>@1ZZb3mwQ^)Be0Gv}x@Z zLh0qJxD0>2lWU9E10LAc3bOsZask~CD2)Kykf=Y;)4D9uy8PZ2A7AEkT@}{ym`|-! zZHU8dNbe>K>A>|&HayD#Z42$eZRXr8rp~^}sY^iG?HBO8!#65@i8z!vBMXclGv%{bQ>PstMRiUffNt3k#NcVU% z^@7uq$E)9tpkN3fe2Dj?xx;=0kRA{xA%X%R9#|*DxmVzPF!vxcPkxusZAj)wGo6A@ zlIrVMAZ_?3?72VvZ9&_xPbhM6{cS;B>1Q7H79Y?2y1=Km#mGg9LV1~ev}-2#!KwglFohc0ad`0yB;HBp zniiuO1EOTH20Bb-^Acsd0y?Xr8DRtZU@l-f6|0hY;f!Ej_ICh6{9tVW8?cP3g_6@^ zA0K!Qv<6lHX@L{KIm%Q@EDH_<;QcHQsDytsI6gQx;GP`jSx@i_;uY+~DRJ#++~_OZ0Vu^6{AAG0zD{c^J-H2 zNC0qDw7D~Kc@ceHfICWO<&#|GeB{E4sp42MVnN~rVW?ndfDeElpi7O51jzvj3K_4jja$(&0IKG+nxm;ctnq!^@J;*9?8n=-T;LDZ znx_(UWgL&I=SvpLmV%eXmTQlPms}qO>YAJ`*BY%DbUm-u%$5N3x}KZbM-H5Z`BsCs zYj=iL+}m1#vnmr<%AkDXkqCA1jUlO=eJ5A4yxf1LL7_4cA~|VV%A6iZ%egh6G@Kv# z>hkBi@(m&Dd0Q%+ENYtTf3&nXjgm(2U_xR#(|Z{Um3Rvcf)(?uEOHS_Pr9+m?m_w5;bW#eI$ z?e+*shb=Go$FXo###OjgV4Ap0b*08%WqeHSndqw#P1QP_^z1Om5}re|(i%=Ms0~@J z8q0}mqb7#lo2gy2L60=LS{K_P%&#$}`(s$?H)At9_0zKzjj@vnAM>LwcJ!DRcB5}f zq*Q7tg#5b>FNNvQ09NgaKT{ty2s>mUYmm#M_Tz9WuNILYmR<}uSX6(0ZPSo{VsbF} z^BAZd&r4(zJr=SqmmfDK?fF{7ja%E3VR4xeQId7t-A&fAZbU^=6!_9(m5}Q+ft88d zeh;D}UexWd(Lw4)SyRw7>hqVd=GUUu=M&hcg6{j*rJrC@m~M4WMW`sY zpu#e)XEG648+6`tlsU;SFkiPki5Z`JG7rQL_z%<%a2Z90wXkfVt30IHl7kyC+CFaU z-h}Mh*Ct}0G<}5l`e_nkW+GNs=kvg4q#=Hgv)t4~N74cKOgj=2Sr&FjL+$sWXZv@T zJmBBwI_e{I$q%fUNPH7&Nv{gOfi#*CCcQnQS-zX${U><~c>(PZ_Wa5By8z7mixU!O zrZ)HsVU1jxS+$;sh}~yPXM{EkZ)ly6Dv50|j$GVXxf4@oxHk07KeiHXxjg0BtAUq+3s)l4 zqhfOeA>E)2mJg$2YI0!=#tbj7OkmS?BCXVY>bOJY}WPr7Fq1ec?8_3}7ot7q+IuVx5m zcusWgf6TPS$a8<;j@)1z{N{-}i-|q!o`sHef^eMkVx7KvsrTKr;si6<7Q5O9-gBAG zFtI{Oht&*d40Q|`LDgY5I$!Q1Ek zc;E%)p5xx_p6ly{=@sI9RA9yo`3p>$|IfALXcB0Dc^x$Ug7xQ>Yp`T$;KyqNe4CV=`>;=+u^*(&jOR1a?x=7o2LI|a zAgqMW*I=I)qp#QC^VC|+am_ztLuWb|Aw5z|oxa2u-_*H|7^Eh0fQQ^rJd-In{@LM# zKHl~E6&gWIj=R^2%;4{2KtQ7er~PM2Oaju^KsWeRrMK+-qgegtwMe0e=g=pcI(E13 zJ=G(~WluGj1kfCw%;o!U5xxNO6Fi}>70ea3$FN-6bJEL`6$wtWa~3j#ry3dqy!SXO z;q@L^(VK_!s~*F8$)Ip0mh?dGY+*+)j?@R#_c28m7wM)Gi%{kfe?1{8qOSG=?dZ6S zN%TvvT{i3Twk~03gn55z@vrO0i0hm5V$ORU#7@53qfpCxF&78(gAqwi=<+PfY-RLF zNitxYju6H66-}t9<9OOTZ_av={&Pde_tcy{-pXiY!C0D0WH0q&^QP5$vNU9MkJe@y zWyfz>f4R7@#x-LD*MSl@V-xb!0*qd41fVSX86fR;Tnx2*hFY*~_<&39rw+GsatAgz zs{k2pbl3XNNP)?h>XP~irg@|&QZUoetxfKDw06QWk>(IAcs14(rKl7=eqv>Ac747B zDr{g!uHIcrXKPk@C)D7a@+p7_y)_o8Q|{NnRMn4IvvUR!WpZ0bq?iwKOL7U_v<;g? zQa<$)Z{@Ica-mGz@=bmQT7iP5Qs8LKpQO=u^_X>=gpr4l3+8avC3d-zTr_MNYHHR$ zdn7KR2$2_Bb)50+@ey))`*{Mi+3`h6U)>8jADU?JK% zJ@}H+a$LfJ73+t0=s-hi%D|CH?$%D`ye`Tg%GL=Ecl#DLnH%YZFh@lIlV|R{F&zS` z%7^mc>HR?W3uc94`JQk!$B8KF24#8k5of3M1#YTw>4!B;iES{Q4h-TdkcPQGV5Kmd zSqGI_tq#8FswD{|j(1Gsn8eNdg%&=V{#W0rw}1aZ`*`drF9r5ehM+n9klDJjOfpYM3eSVWyVg-SZwkWXRI%hEu0026T*9k!vJf@8LA zPN!^f-HWBUR-?P@c9(xQFmr7}TekMNerGnSp;l~Zq2T*0W%?yxbsROgxcW-{b2MN@ zM*))^W9{aU?c;82zVVaR)+Je>)8(f`X(zV=`Dm6WyU(y*c3uopst9_4p6PP%{N6Hd zUHM4DzSHpM*eHZ8*1U$&C4#o%j>Qpqp`dsNkSmU1R)%mjV7AGr-@Ui@opF1SakU^U z{5Y;E8Y((cH5O@S8AXxtPG!4>*M2OcEEilrK}8XyjC6r~h!gvxO%+!JOH?&Hp;kDo z%W!w-UzXk0+?>nwIuD$>vw8-(aB>3Wz?iv0gN0VG@lRSlTYwbz z?fD*|_lx;Ex~@n%!P`Oa@0%EKJ`TIp-;1prbkhcxSa_TBl1X_FTS(o_C)o(~F?xE= zpZ!EGCn%l>_mprSp^qV@Y)&GoR7>0qh$l+vN{9&3o~TR6L_Oe+8|Qbha#B$oH%=qf1(Ki~9@6&Z0; z_s~?t|@)p*0^XPkULUw+>&)f<)(xraM`yS1pM_A z&}FDUe)UGlz-wtqEOdNYXO66U21hk&n@rB8h*~eC{;LQ>xG|~a^Op+ET}|MT*sY`| zkb1_Bs`^ojR+{v;5BN(`Nb0&0fs*f>BWZ(IPUdjT(uDI#_`q}DLux5oc_vB7V9V4C_a8yWwdtB~ zu+2f>$)Sgazoo9Gs>qwOekyxBPQuk4{T5g*L>(M>Q=_O9Gl-(#^0;@g%8=nupAfb$W6r}oGr7)G8-O7)4#Y< z8-vC2iw=J>$GMTXyl<0&V2B3EGHPf5Vh&nmXaESn2x2w7rm2%VsbM_jyd!vY=fSRb zx{M}on!}5s6&tA`X%)3@D9V_`HVxiLKfXI$J9KwhZXCZG03`h~urF#AHvRjHSi@u7 zX@w5e(u5p#eKbi#fyCUx@e-be!{3a^z!t)^Efw?0#N>3Kf1+GT40!r(BOf-lQJk*m zXP7T)VXWCNO`LL1Pn|`-%-QYDFOV(Hhw4*GuSVIYS$#ZK^cWDiI!K}9H7>>Nm`Ax7 zccw61Kh9eGy!p)Bxx%0(6O3Bwa(IHjFMb6{m6Ymy-yEq>m24kNt>pQBGjq}l&muk1 zfIsubs+yBnfJlKzg-WyT++po}z`itK93oPEqr!7^8A> zhVnvIQlu@o!vd9g?^?il^ytID zM(YlrU+JgUSgA7DZ)Q~f2{TtY7jP~Sm}C$FkIQu)zs?fg;W_CuUua;>_sCxgMneQJ zQnwOq7m}G4O|)6n-lOB0eX@=PIX36EN08I)VO)tt_Pr zycR0BXOhD{6-tp6i#ArybHuU}fa!uudkQ?rwo+Dm76OG!*#nXNHHenXSy((l@cyVq z!6l0g*FROcd?s&Ny)=YF(k1n84555N*QT2XRgz;crzsH&D>@-Pkid;mPC3=5l7XSW zfUgRv@QpRq#3VU)7@buL16zMh(VfOIZ4h!@#%P%>iav41fpWJBG5Da#%Xfp&+|Ev_ zy0h}nXm_NKVRiO3|KXNLBZXx8C&4#anNjCJ?CR7fpar(6|W^a#`8}4aYDm-s* zhsFC73oYZQilnyImUm7=Buc9G<;%|F&o6fw(j9z`&zq&AXNl+|{7xAL8wc)mS6cFs z4M#n%tG(7ILhpl1BXF6cjjw5N8p1W!cAv8+jO>rVN%UG9q;>b%bmq<$kGG{;O{M6756A z_O>s$vg>}BXG(4&s4mkv6U}P-X0sZ$MapuyMI1wk^(5$wFYzWy74MKxpw&i;%k>Al z7;xAoq$wr>#NPZ%>lb4i$VM-($G=EPJMJ`OlfSl0%DzuuyvG8ql`ssB;dwG>LjM$$FH^EjoGSU6m8a@bAYI#o32e-WnXPU+RB{e1FtvQ%*EDR$LnG*x6fQg z4Qs<<>7F%h&|>NLT?MFz51+jb)Y&AGP`OSiA5(H1@>0fIq-7q(C=^2XM!kGw_b)td z-d7x@xp|XxO*r}IIjOe+PZYx2@%@reB%xpV&nl>GUdc7f36Lyq-E942JnYO>lGYd(`J&>KcOHxP!@S7tX}gxQ=w zr(zwZPupF;{+s@5TC`uqc`u2?e)Kj&ijW1=CR~Z@ctSoEZ1#fe?4uT(`yyl0MD3J)wB*idudb9#EPhXTK9&$9B@<`d(lFN;FmGzM9@7TV@IpHEVcDI%ED>4=j zwRA9lBDq;eDJNN6UY)%r6oI&tsxrm5zqD@i&m$aD+i1&taV>+NraxEcOcYigD^pL> zsZ@VeP_dUqUk|4nT9OuwsU+iFv8)JjWZaJoc~(c6qj?U7k@i9N@(AmgniRHB=#V~h zIcetJXrLzxiemZ7Or(aB<_Sjxc_aA_j9x&l?i#iSyhZ+wNz%L(*5dL||7FrZ4GC7X zIC6yVyQr^rGrXad4d3aP^siw!>)ftEywxuOS0$#TzFPzP0L-6%hn&|bV59s+?f$5c zqFw*cP?VsUoEjEKScvqU82iOESeKgEONG>8;Ud|zp|!};D#K%pWC$1@G#8nR*dY$Q zTQ^z|_8(Kw2(Y&@6v@KhR>&EsaiBMts*b~<2^WTR4c;Nl0iZwjopiUa=e}KaTKs+{>9e z4kGhi~ij9>F0@1wdtnh88w`)UBM(a zbqG2H3l;bJMq&PtVDt(5J(U6a5oZa!IS!~?A|SQ z=$_q4c{%8pJrfE0}Vm1U=VWi5v+N7>9F>H-xY3pJaFaUzxRn19rPJ|g-t_I#v+`2~TT;DJq%WR;WZk$En8BU2Q8=GAc zbd%qTv$DygyVerEZGVTr*u*onL7e(tV2<|pmZ8TPWY%dk0Mx!$VB}AGcM=$w32A9t zpu0MK^V_2{S@u5yKUQ>@s_k@azQfeS8T40rZ|f-K$}l_zX-n(e{9x8M;)e8CPhzTGexu3|&*5Fn%pG?9{n- zk6KF4njuG#*J7gnU|0t-Y1U&Dmn<9lu8-Utx77 zo|ZMDTf+WEs8-}`hQwiwQ5{e5g|Ry#W-;&Yd9#jK2$!w5Fh?ef*7UJqY{n-qGk#%*ikK6m8&y(kHF< zmT(H!Yg%E__}xevBJ&Vna}6cNO}_};ahc6K#3~JQ#*v1|p{mnZ*?j&6nI_aIyzs6T zy66}YI2Ze6B`JL8HHo6Bfr5?2jX+A(zp(_!j4Z=Ss~02g*LCjJ zqskIIWsY_=r=NQ&G_zz~W!qnmy#AuhXSsUbYS1D|1}w&L9ka39o=qW4um3WuW+g-g zO%cK&=~z5kINikGl&N$3_;-{X&Ewl%Z!sPqY|l+!`-ULu-w)^7FxB2bBSY^ilYduO z^xJvQ*~}|?lqUX6ZExjLgTD0~lY`ZYZfW5>NR^XMVkFzSG13t}m-{+N6()DEooT0&G%x31R>-4~*qvOS188DbklFN@doi`Qq` z9CIt3_uFgx>QB>IZ1VZY79W|?!%gLY@hbDA&z0@9;ET+7<-y!z7+f7;=%Fa-!Cozs zagc`{kayyFCPu#$4m&5#w|aSH`})nk(fQN!#-8na0cD0a^x+BF0hrm`n!h^Od%9>m zcGCm|BBq4~K7_N1RWNbFQ>4iE*?IPjp-x|P+WSaSs*N1}MGWLfrAU@0XZDmwxihZ| z8=bxPG?zmO=l9>3VE9v4{~#7uk_KmxMPlMg#23$KCw3^AvvnL_M(6#{;pOIM%loBG zD2!8pQpt8{uok2d?)WFculD;$-Vkk|?*o}saRlpQ4FlgaJ#>s1!51=S@rWqxv1^(57?AJ1CCvfyl ze+T{QP+h62d&o_QbCQDgE=`>Ur`crYXw{?zs%rcJ9jaHAFU$DorXSVFBcLDvvxgr& zZ$&YgejSM-mxtPQR3!e~T7!U-puD%h`LKFqNk*&OF4(1!x>tEC>nJ3s*d4=xEXtT6 zsbxE%nHOzq*!gGnLN8Ra^bdC-OGHm^gNUH8uXvg=d*h#p*6+*kg|A-3^<*cWygWD! z<38h^q|MOM?=dg+6snxZ&(jOinjVEUki)+G+1#mdMULntF$AXJEHWEo6_E#}IS9Y# z#CkjB5nc$&g5kjZ`ZNKrg=tWRe^%8J&?&gKf^Dy}-f36$Ws9Dcb{)f3TqdK1=?APHmhW2vO$KU>CsH>+=9@6~7RTra+bXsPx zGpBAp@3!qYh`M4=(R=)dPsfAt2hOu;(OI{PQFWz0&>e+Q7b(D1s~2-(^$d+5fT@fk z3Rl!Jwc_v%0xT^h*EZOC4#M4dW1QzVZp^tVEQOsyEws$Eul>jBdugPmi4ftGwB4<0 zRrJe#&H+SYT5&yx_}EUJaRvF8Nt3i#g3mGn~MISFQC_id_K@rln)mU>#f zkjG-w%r4q-qCJkNN#~vShB*{IH|}n}=XWiJR=98&3y0-oP3Kyl+u9WqG|4qQY@f}l zb_CdjYDR>0X}MBSr4O*Gqt@$J<9CNt6$e=WNfiE|Q71Q4d;P}2YcpEHp}CJGY9ali zxE3ANUexxxA9f{jJR+I4(6sel7x)o(DUCp@(ammPnkYuu8QoK|G0q$fPaC&sNlH~) zF*#>7y9POG4P!}YQChur-&CkXg3{vZrdFE2%&~P2p>kRUPSI3Va|tdvMv9inbX|+% z`_#SU=Iz)Y1iCapmQ)dAi>$@e0#GDf$mHfs#~^1s=VvpJ(-2DM1X9PI=uLOPKd?rj z`are6#XjeEaFE8zK{Dpe0)^BvpNUAhMkNkuLbbp!HK9x#TG)t+CWROj+JKYT>aZSG z${g)0kmz^7G}3Z6-jFM|W(CM?EMJAqJHb-)2dZ99*)%Ux1&uu3QptL%G{g4&a~oTX zO*(n~k;iDI_|KaS{hHPplEz?fY~pg@)vEh(D|uX!+poUNtV{-RLdz>k)}L_4tjyl~ zXw1`uQ(zZPd6`1Seys)WBPOv}&ixZjrJ|NKkEf8Z$7HR9Y_;FnK^BkTx~F`^a-EYT zOc!5O1D+KM!E_AdTY9JuyNo|aM=O78t+uWKEd-OO4YdBs_ir6dNs=r4ql)nz7*o@x z`Y~tHa+;k`1HJbBMv~mBjb%>Ty0e?AO(OcE$>S_t0c^9KSM{mtPdPnbhQB(w&M6XO zmYsm!{_{Yvq#x-idWULodwQX(4e=f4p;~?X)9;B1X-?p~!WoI4Y1oEE$&%_A4o?;- zCdI0zlP50Poz~J%i(~r*6HG2;iTj1xiIV7AD&9aNET~!g;Ka;KC=VrC_KGL z{R8}faelMDUV=qxCX}PrG_Ei7A z&Ue*F&>aj|a@p2t?!6gP!~Rfh2Y+Vt=}E{d!WHjsTCI`D^Jn>sUFD8+{|mt9>%Xl7 z8`qhC2X$D-dfSH_gW}H?6K?XzU!XYuL-wCV=r*NChA)^mcG_Q2;rRl^F%{6Qb_!BauJK`}*{ay`^L5;!~j z`0e!#Z>B_-9~H%P!r>vLnHi#y(ZYKbT>ZMva$9O?`QYN2VG@0NM4SUXrWrngCr4Q< zl|#Z}Y2V~hK`)eJISuunk&35+I#Wb!kucmW(AU(dy+OW+m*GM%=0@@$U;RioDszm|A>lP?kun)#B6S}cDBNJ1Kn7TaGw)5}T6?7sQ zN97;&{pjNvB-EdOk!3F88;i^~H!>ckx3um6vM%T^n?mivC85d@Cl-(2%en=NB9oPA8!<63R?&S4Mbn_6W@`>OnK^J1nw@0xBHga?G^U0 z#z55)r5&8)F}B}mZ`D3aTexl-RQ2C`kNR7~pfkGF#8k5F{XBViU?QEsiW5B5SOWnx8klb$VqFu-pzpQzX5MkgT5PQT-FIu7MsP`0?;0y zau|B$)ra|%Tgwf0A5Bvx;`eWkG>vh-^KP422r*MPN#6Yn^oYh5^d=Vh?xjQxel%9pZ<|sZo$;(9Ib1r4y?4I#7IfZK>eD~3kMtS~e^4MnlLij``f$x5;TXyVLvM*# zzuS|^|92(*su2PF0D;6a}wLZpv2G_)cAav(AkYA zwSBM*+u@_1k|zTtH$kMzR%Cp9(|=Khwt0nQO}B$mld~V#27(6jRm~8;C^Mx|1i}NE z)6kMH22|qqIrdL~gj2Kpd!xwb_Q7LFv3M>klulv)%y4%tOBz$SF5dBSMp1;uhelAC2uQ~hWh=82NHF|PDDie*2q7Qti1JGGA|6RB2GyL92++l z=8#d)x7y#zWdWx(o1R-nW1C;2)o5%_VEGlE)62YxHPinwT8auw0e-0Q1PnG6-x*e+ zuc`Lk9%|dwF6$gDWAhqXU6-AQ){sG7@hNZ!_2)!lpe*77J`D&d5Z<6+V@22G8! zqlx|`BfGOFb=Rl{ED;e_wA#r|kSaUf5dV3H5DeAAOft`EoHOiBQ!%D6Q?fVsS72z= z|Gez?FC;(Q6wCO&7mho4u93tgbYQzCd~}*k{?S<9FG^wP{CVa8QhlV0n#ptp@07w~ zvNA$lcRhmV2XF_yUv*3$7N{#NgK79J}aj!UgQPR|H4bx)XzSc`K?C)^1Vlau!# z*?VeZiUcptc^ZEzLp>p#bUXJwEA2<{S^J6E!fk;MxA}f7|rGa8qV#a%JNpUSwP=+6=w>gV8M`GIF zyC4{zaPo*(&=75xw!NhO9cvjSm*4*n07XE$zp>=}{zaVN9B`3`mNv|*wGoCj)CEhR z&rxx8EU(EEQ#EY>e|ays%f$7m;FpJFHG=jLQ0i8mulpIzow+(hm3%`$7w6sD%n-?_wGUKB7YSS&W> zWO!f-_Egox(w9*mJ)=6;l#^R%F909CCTlt$o!cc8rifULw=Cn7qG(=l)xvB}Bo@oW zVzAbycj&3KQl1uUMH;jR-8*#CO>6fMDed3Z)6>wsoE)vyuB`}2hne1}xWUn|7XG%O zVP@xn{9QY??TOt50vo!fwtx9HA~E%@*ab~zHFd{onkuA{02fw}l}<^sfXFx8;H_8CFn{=F%HKk%W81&#}ey5q5r!OGSHvAn+*!ru*6|;5?-^(1%CIr)ZsM zSe=nrOyw=h4}+kN&C1{wWeUfA76zsW zW9{FVnY{R*euXie@>N(57IY0-F%*du_N5ZLxxi+tk`e~5$u0yq&|Fv5r!}cyRXDV| zp{LeQEN6RNVHFvNlIGZ~rtFw0u?U&4nPds_T7=%gAw1^iZttlViQm|ACf1+AdY-Le zn^fZ^OT@w?m#M)F7^WD^6I6dXgIRe+{i1EnF4t)mhTqgk(lsZd{7<xTZDV%HNL-%-0_em{|ea%=4D zro~OoF+*B$lb7rSH4mjVsB7zp85AVVAla8al@UDI1WwQB(=7D=ZKlu3d_J9}n|(z+ zzZYN))4c$1u`j$VKe-D9f)=~8PHpXS&tRx=%IU1znd}k#8_XO(N0M)UY(-ksiCXs7 zphL`)NP_Gz7CT!VL^le;S*@{VG6Ku$99bawp@OgyD~Iug2LuH%Uz3R+hDSygt45MC z2G1E*m9L+CyP7=%$xPYO(vioGI9Bc`%*ZHm%H__YjEq8uTzi^1rD?-leRjG{DiSbK zl~Ad(=<>t(sL#j!%p0-G<@Sizlj~3@9J$BxPRB1g>7+=c3cWim?B|36Fo8}F<(ROM z=h!xM=}=2c_GZGTp{&JO=YsR_)B#Br{1x*rM&Gt5o6HyDs#(RGV+pS969}p{kdd^! zZc(g@9MsolJBrD)Q5B0cB^f$CZII2c#Ywg%H&|Zh$Bt&QPk34$pN8GsG}Fk*G7vV( zorRehg-(USS(uSo=mZ%gMnQb&D|Eibmr!|=Gqsq^E+8UZ$Uh+>YidClAM^RoSVX5# zZ-wHdd1o34(m5y>=AgCcf}!f_PyJA4=#z#X)2FpHVHj4Ta&CF)h2JXCFZ0_){eJzqq!sFmTtOlmFlM1 zCi@0+6uX|xC0IhfhU)bJKhOHNoHcE z67&-bb^McQ_N`=61^DtOZjgQbDJwBcZGka%3%dIWw39io|GJ)@(sRm)J&FYadN04~ zDm}OK#zP>v%aN4KSo$scQuvEWKwME7YHNyJE*0#qzlgk>+d8za?wr^va?n*<7K#x8 z%GzR;P5DjUn0nlm7$0;M6$y7@V!8tHO`Wh#^)T8uo|C2@iWAe}3Hp+Limor-b!CBrzzx-`X=|KR*4yn#Kj37+Aau==v7JhHxt3;R%ai>}*2kMaAvy;gH=fr99~k zh04~DSqJ<)S9ow zz;8SRghk`7mqaY_{5$jyy=X zMG&!TdX;R>Fs_SAdYYrLNUWqppG_oVscS$ovZJq$37b$t9>DmD3Od(-NDdQ;Xp+yM zpO(v$ch{19{>n{${KJ!W)0!@5^*6c|DJt1P*rpIw&N(H9A% zT34vRLU#0-&rY%5MrZQL+jB2TROHn%D#=TUz5B)W6MOd>rBvvfySWX&OgSv_f&O2Q zt{y5cPn$zFEcg2tEs~$BAbwif+_Wv15x(o>YvgJ0=f4=`1pHfK=f>8r&sj-0-B~v$ z22+G}e_`!qW`&>ZQRc*)O{q;+fLQj55}S4Wn*tIZS_NI(OuC73;^Jof+aYJ}mQ5$3 zuO~T?kMO$C(g?hcKYr@*LH0y5Vji+5I(Z8fH+q{cX!F(jiFid)5UR*PE;hES;TmSuLHS_Ke`%<&u9 z``KTjax@3^V3hc#;#_4|#1^?5A`LGzu=WPr@W+>B*eJuYm)o(e9UI$m`zNpIutA5B zPNid%I$duO`(;@y(~(vAR3(Edaph}84a$XB#V&j`>X^$v)zGtKamC2u#jvvF9}*$Y zi$HYon>_FjJD8)LlP@f7z+ZjsiA$GNzFNs}l~{SY%P*N|z?ADRPCjh`nvnDGEeHnj#yHaxy@-F>SFU2o(g}nT5-)Y|CtRVzXKo|8Yybx5%q$sq+Buy0ZEoNy}J8x9(0Ip=I?59kzfkKXEKQdn=*lCsK;^Kw1W?tEuiVXnb2H&nXR z?_O3v=fcixi8w3%Wvs;%D7IJ6HD(r$&dUxn0`4y4_#dk4a#~m96`kFht8^9c?CcnL)IVz53H+X9KO*sDbDf|ly==0O$1tDjYed=3|PTblV ze>f$C_|P-YAPc`D zlps64aDUXKs;7;AGi_wzZ5}6`n)c02TH@1?u}1E8Z#}Wy+VYOh(pjAyW#cVpw}PV! z?Swvrn@Wo6n@WqRg#I7i-UBd>>dqgZH?y;4W_M?1%WUtx7io+7s90UHin}HEUT_85 z7%e8VTpGy*@ap&8?5?zuWdq6G zA7PL7S=xQ?TR-pn{l4!5R}ybj&JV3RNr|6(@$*9$eA4s>Ts75Zsl@p+kn^?EU6xXC z-EK??|K>3de)>c##*4cuwSe(%nhf?>JGm)diaVw0E=#`<4<*m_Q`NmJK0}u!;!Jse z19z#^pt*I-n7K+}MxfC>Y& z1cI_vs99HMX)UE@U1FKwxaCA;bncd27iYor#L9D!Dxl38!k#L3ZGf;GLP5JdUE0(% z2T&zn8e^-pYND^Vx|8StWKU~vb7w5y6YDos6Mni0O`Uie7c~`y!u!{}*Qe<2#gtiJ zF2$|jd4iF2`8%6{Rm;Ctp0TPmi|bq0{733!3W|WX<5c-7nwL+jdRiirwG5xwrM2!gXysM&hCQJG$UA z78=}v>Sc@fN-(&_>UvpMma5dt9==q)Y!5sCudSE;l((p^mz{(C7ps?rU|~g|wW-lL zB?qREn3oOo4UQ(nT>M8|s6A~;p?cX>wW)bgJ@{bXt2cEsj<};ZHq{mDor+Lw4mO2! z12;|VtJ^%1Vo+B0C+$7y;SD8?!Ow_wB-#?PSCkrFdAl!Ho8go>b0O$?2CM1oO) z5+c2RM(^y=_m|o?h$6od)!Ljb>k9R$KR&B8WG>|psUyYDNaQL?t~1#+`fv=Y$Sl?H zH0SeHmECEiNeNE$dE;gZ?LWMY(erO#s2n@et$v1(DJZ4B)T#76{C9BeJ=nX`y^Z2i zy^T5q=shKI5dTFEIuYt!E+-%hkaOm6LhMMyG=fIdLCqp|CHe*GNYo3r{VLFp@qm@^ zzpF?D>R?%FOEfMX&ssSiVNt4Od`8P7!TG=YVShmZ=Eo9-MW&J_T7<3rVWmdTFnWi<;?~LZM!nkX(K*6St1BujE%Ataklcmc zjotSumdE4RdTb2uz*@1Lc>76jNPFf{$1z5VFp!ho4RjB@c@Mw4-f;2HPdJ4P}eUpR`&K; zsLzQ6I&f2}u6zeshw{-6>BWmD@!1sBUy=h=C9)R@29OWpQaR&}qtHv2XR}66(u`u0 zHc;pD)Q5PJRYAyU#D@NAHe8yCnT6YOIyYl7W;TCi!`i!7CFTkTSlxP+dMY4LDX#2@ z@p^yO8Oxh%Lv!%2>C)V9-`wpZCAxOMaM?(_x}tMBBmgDAF!?L|PRVhs9y?mn(ib>R z)eyowC@VK%P{k@{IflY&o^G3}GN3~IHFT#?;jADlX$Q2-=R~Jgb3T1G%~g5@$Nqx% zD0%q{D`zjoKKxEv<0;2-ww5Ykx6F>hpt4y+c3Mha8BJ(s5&aVJ6OmS=liZK3!&aOc zX>Cofs}Z$h(CSZPX*c{*Eg4+by<&y5#y^M_wxl};7k0XPAlh&3=26aH+EtE=p~x7D zi9t%8Eyu&ol`CFQ?rUZwtGp$?NSOH2g~k)eOQ{qWsSvCVLSBO0*yJRlucU(<#Qoq&2%}`UPpr5X=`Kk^ z8EwT{CK9bIicm)E_6UQ@E{IH|wVRC~!D`5K>ma>P_y!bW?6>9I2dEcnsYDgE=0r)w z>JFNpop}Edc1=YFcT^FG(s(aQAg}wAC+8+ZOn-4Ql%z~9`B!L)$Kh&GJa!^7xCBWW zuWD0S;TM*PEWif4Tf4iv8U>N+spA))UWJP}sV7T@{%KQpURDa}x?2n$}P;M^POHzcL!vsg-3~Rguu@ z;u)3tVnqB?r8(7~E@JUyUxr$ICwBA1n!W9azALT^Afalzyp1&@LL2NP_6_nOZoOHE>K$UTwJ9z zzE9;TxCfaXUw42}5T8~{T&*Heeo93?qvlLAeL6c*vMJJ6M4NK5WK+mg#imG~hFZ1- z+c@E9o-ZbuwxqYHw~UW(Q4^LyBo=Kclxv#sSw>N+Nxg2MyT7?R)t%2r=3^Gbd|$T& zshhrxZc54~rkYBHC?dZ_MkmBv)8}W`XRue`v1*GwmCLv|PjDgZp0;MQl1?Q)H(KXHn=Gg3)@!bDrY*})iHrh zw{F0v28!}dF@S&%S49x{$&ZK=aMjVNE|;v!QNV9Jsdq_To&r8D(3s!~_PA(s58XfA z<e zN8e6w1*#}j^)2}$sr=U@>uO4+nmw%KJ{-SI!g!lg=_dH#ltz6ofD$?IhJ z4cin$1Hq&bm+e#O$>KScu`UrwTh+3^Ctj0kqq#_(MP58>;$^In0}-i7P1JgPdO4vq z8O}e0uQqdXIqx&UmCeI2{MW>5SOj~d9CfD{A7B{ugw!OeSHBucM?OjA_efQpkMF$0afoR$%+l#&tz{Hyq`$CVt}+G)>5OwP#tUau)! z3ne;_e-k&8RxF8SCXAS`08R^PO8?NCsEg=h%r4?_=nGy$dF5#EDcN2zuRNoFsMs5I ziWyY_HED?>;-YXfLCW1r>h8EZHng){8xHt*y3}S#u5zYq`R2w(Pu8zgC?tT$XiOZf zw|?o)p(_Ub&{Z=uXV9pvMn-DZ3=9qR8C)uZ6JFawZ!{u-yF_b?76VT9jUD4 zHmEf|ERMAvk3$T5?4*U`EdB!chG4)fYPCXg$1(qFe%$XjhVF6hQaoVXJKcCxRGiAD zy4=Te>KrDopTVN(Q<(T|7EAF-#*+_)T5DX;v{M#;wlns~!{MPly}esIoG%kKwU(e+ zjT3)z*lkfeqfk-?kJqM#d^`F;_vJ&8VAtw8L%vDl2%DiSS@CayH>74PizQBKG?0Q`$^Paq=~tNkvj}jm?m-heNL7Mj4IbEwl_g z;0lH9@$6{cCX-W~1$7fPg5TknlV+?D>&KR3`&(&j7<>T>Vj6G++WdLoE-ZyLfg=JX zi=vjZ(@6~r7W#Td-drbM75?3mn!qM!m#Ydc1OmPfC zp%32qpsuCd$+WaBVZ{im*a+xT>tM1Ml)=D1vJ1;#q|)*${BkwjNGm+TSl$p;%PE`r z=FI$zIXHOvVE@*6&RD==^Vv;yU)xyDR>QwctKW+T^>!T<4d@*@%Hj8{F>|$Pci2ox zzUy%)Elj*SZIa979L;bzi5o+W-cV=8ruS!DzIL-RWpy_hbWQO@Ppw5Nb$rPaROxMu z$FI~|itBhDNc2|LWS}$#gcp|K-@+e(RyBzwjt4bJjjb3BMTfzxT+pCC9@*vIZrDTa zDb>JE+tV2>$o!Ws#K0ecx@xmR2?<8b83**|Hmjefrp;-hVWft~|9wh268WsxU3{wY zy4sMs-QMPfbx3dLLy3<-8-%JboG(M1_g`@87&!I<<@hfXyHlLlk-y~<536Caey5iTKqvtJ_?mongdrH(+tDfE6T63IZ&ly+3u?+cmJQ}XFa zB;Co?neIhKQ!0@*H4dlr7njl5uW`K^{+Cb2(_y3AKzo};>dMmcFkF8WiyilJ)7qxS ztmBS*Udl>bnw)#t&W`~B^T3SiMlU$o^98DW$tRM$x z{Nx2Q7Uzm%brUR!@HXmXX1!a1e+2wh(gt9KyXjC>M4G*Ddbiska z(S3v7(8$5j`Bw}E{*JcBJ&uH(p)GMwLo4xN=bn*xuzzPy=kDQXuzyFtry*)GL>m46 zhOnU@Y5X$qA$|tV2qD1Sgd<5I0_sHssKfMBGU1Sr2n1SovX@tbK*QW1aE2I9(eOeL z*s`+86!ybCNm(xBT8AO&NvvxUmgmhP2()C~_6(#n0)ahyhNBA3%>4$XvQTj>{;mwF z0i^naM2NT}Wmoddf)FF2Tv*yj6AX=9EJTXDgQ~?BSfp6Ad)Z zYY2LUrCCQlYJ((}%1NmuSYz|M!cE;xA>v@7D`}$DjM8S;8r3Ajsf|{HS#JonW}|H} zgPc~;R)^N0k|Lv!*`HT|@ysm1R0XO^s2q)fH{>d#+ppcYN>HoR>K3G^$o}k7!4IDn-lG%iO0Oq|rZ&B&x!G=qOxu6wB|Q8M(qka5|Jk`Utx3I~vK@Rm3AQk~ReFcDQRM zwn-!#35xfTI$Wk;jeIeRdP|~xH+Y*jvQS?MsZvqA*XaaX6-p_A;!XG)#K&;9?byN> zoURm~Na$h+Uehj}ra>o{H8ts45C-LBy6nzGla8Ktgg=n9DDedV??=6~1HptvNgR<$C_}*J2pARkI1X0h3LW%v9-RW; zgyTza+EAteZ>*w$L!~PI>oi3ShG~i@l_iRZ+o+?JS0a7Bh2J9HT{HSJ<_7!s|ec%o$&`15Au#qB0MiAp2zK9->H{!pf;l>Up74qkw zmnz_@BSJ*KJ0X`-1}Fk2UA%(V z6~GIElH#p9^$KREVmEOGRuxREtVlF_8 zho|j2_=UL(ctD^PF77eY4#x91xf>ei*Wmxv(JwF~Zl#^RWEgrDB%oqEK?=28UfiqE z2(Q_2@>UW?IAqlb1D^#otR=EAr(S z@tRmeO=C(-hpLlbJtG%1e z_&)0{@;(O}hKA}Jhlc8khsju1K06QoDV~Jy^M5CQi(}*_bmK1OfV&C2fH^Tee&=bL z^jQX2bX51}Kd3;Rigr$yYtO_!;9mh{ia4BM69vplM<$4F3?Nmmtauh(Je!_%slbz! z>N(XZ;W`h)c*LE~o0IQ>f0SG%&JFE!@UMw;``T%m4a3=O z#^BW0v$Js+F>TFf&F&S-5OTW028CH+%|s$KHign&6Y!T#Qu_lnb|u)LP@!ZE+(Epp z*21YNwdzl5eWf$jK7TEGBJ^S?{tP?;T$lyZA7`-we&-1dZLnhO+lcmWlxoanQ))Xk zfhXh|tNtb#XLOrwUKWs7vhG@+C+%Vi!Pfem?KMg*Cq?_Cd&nK;Wimbtsqo0;@4-vN z^J0yub)%Mtv}x#u0sQL;cx?bHXuE_8qVhl5QLJam{1V?a0;dC1Ez%SiPi-Rgw}XTKtnLrurr*7 zZwr1SQClPMBTNK&7THJ{V_?Y5s9TN{eun|Dvv?0aPCfxYL4$4>j-Q}ebnGQ@k?kQq zPFrIhcg#w|r`rRc#cx(prqWlYirT^CpNscM@W}y8g)yfv8TFwAzA1`Sm7{7U!a`#t z!L|G+y#}q;K%C~a#oweO;dDBRsw}q_AI7cZ5zK?RU&YMeBM5|8@Mlbl5%}H{dIx=2 zoaOl+fAC|`8pF+r#=z^!&8*{uX!c4Z!3_%*Egq5bv7j|*VTkNd#%#&X&)`a9$mxw6 z33AEn#nnIgX>sivtbvsyP`2qu|M1gYJAe8QZ*L~$GD4>2;e1xZ`DoyLT$mTxracoH zJ$VLBi@_Y=;}d!_Rhkf-j(A&{n7u6Z)2_{BHJMs`%G2>0Tw~76&k~F!Xbr`9>FDA` z3rWHh^ErZMn%J}rH}CrCKm2GDf{1cBrL*ASpZ)|q{JM%)!^z0Wzb}r$`D~xmfImpS z2kGN_6=QK8QpSuMAe9Jw>jb2aC?SwMZF?0siY2mHFdqq7xy*0|pqG&6XtHLBA` zTBDFWLAx(zlt}LTYVo;Kr;5iOW_jpQWeVw%=Z>8i8#{6A*(DIc6Ec+!X~SALpZCT2 zcwWRDI6t9hurv5pOoNfQeu6PmC6WDf^4JORzAn-hBUENMqc|^Z>*#2glE#?N9x&2) zv<>?F-@;FSZVB}5P@;MEAuxRE6d3s`w7lZhVac<{PE1Zh3Hk&|&4(cbhE`Y#No8sM8s>P{nNuoyTl(>*c@z&|qtdxO3{_yjLq0q1ZZe zOs^L!b1C9E@cPE<@zHolz^3lG7V|CPbvLA}guH|xAH>NK@j1a@1CdAsBe4ESO2R-M4P#^2M(q92Twmch@7{}4gmYA{m48XB2$S&^-wl4U!wjc5f2<$kv#xpP$Tr4N+ zYGNbqwFTfm0U5Udx?R+m7P8JzC*Dd_bs^=>Nhk|{r2_uazT~oX3mUeWFUcW5au)lDX56E=^ zhuy1_fS|oTP74yuz9ab=^( zl?(Oh)3iw@BBzQnP5GQ$IWi}^@QOr(og{i{SKTzs0lCI*wEJ~Zz`EPAex;1Wl^h*x z9dFq@u1yTocWmtoL`SdaVSzJl59nopZC!4W<0vvshgufp0yz(>2?_DgP-kPr2o?_R zTbPzVC!=H%se+}yMzUHRt>WFrY|>;mHD`?hmqVkg?OG|cZk?Z!Kc-fp(xwL}kJ05e z*}S~mWHm8Xuiosnn$;?+H{Lh^b!0xI_0y2nNJrLVcOo5e3sjg~yJn!jL0S)W31}?4LTffjfk~6(! zbwkSgX^)oGT6v3GCuj9~>3Lmk_e$^~&f0vu-eob;#hdkBhe`EEiFh~E;N*LfWs;`p zyS9#tXW5R4cWt#zFk_wqXg^M_{9Jc!Eo;B=Ti4z8w+Hj>htG=7;%{wDD};uz7MH#B zbmGSS=k8lDa`$)lq37^D-??Gojmr|T#fL^0-mp9#U2>@0Ww&0Egs9SS+&~xbXHQ_9 zk}iO2Pgs|eE1;)7e@?v7ton>Egd3%NWzJXjPI!I!T0-?(yp5BgPzT^i#^iSd;wG63 z;eAw>Ldf>eQZC{*dkn1XxI{_-0{Ra)i}?^WJ_RY%jCH>V_oRP1UE_maSlt=?&k#C< zK+_4Qv(8cg`vpaw;|XbejIAqxeaEHa;-w}?C^_*CunVp>DK{H{;x_BP3~9O66N;dC z+tO1~nxoEpd8bw(Wz5=N*7Zg>ZJ;4ozpO2)lBp<&GZor~@q;}pkE}_VJ1$>#9Q+z# ziY+#XndQca*OT;Gnb+g}LY>8y^5`s13%a~bXX9DU>EeU)_w*!JZP?xZ1*Iv3Zp|uA z5)Z-^FT*yyh}Gaf7gR$FgF|h>p`lG=7 z-@W3dYLsnFYIoN znw&nTOz(FXTs)`qc}&sK{R0gf=GUolX>$Hnq+|9;m84A)#ljHI)lI}*YysbKG9Zy) zu>$UUfse4R<#9^@QtK2uPOXxRW96PgV&8ysVk@D_m3>p$oXnK?R1Sx8XfN&oE=e1& zc}8hZ`q9CT^S@$Etc+CZ)Zk&MHQAA<>j^Q>u*PB%FWv?AY^uq8rvgL2BQr+5&U8F# z!M{(lv_z`Zs6P2|3V-VSEl3L{G2)2C54B+4i&zf#o(iUe;)%YWO<+oA0ct^gJ((?l z0~66@P&5u;9Q2$e_KO!GRIb6RWJY{*pV^u!yqdmE4(^D{33lR0_l<=e^_xfYJcW=2 z?QdDxo*xrD=BBkhHn=m^+e{8OKB7QyT376{_t-Z-vNiY0)+cs1FnS}ONm=|x%3w8^ zGsF2*FN!S?)&O1`@F>j@M?rp-6^s;xRzcEiyf`Jq}Pr7@|u z+_A{xX&Q#UdjPKeccc&cgA6tg8+;jy<2x`N7Q}Z5l%4U2QC2E@27d-R3IYGdNvfuS zj1+)&!nCx#0QA#@sJi%K>PoF@*O4nD(TWnI%dY+98xaiIEV}Nx(qbh`{I2D|@!gxB z+SlsoSkqE7(%{JNczoNI2iK(?^&_=SYdXBepDrC88RKJ}$-YG{Yknjf?@5}rY+Sts zEFZgVJP{hbW?^piXphS(3@p#~Uptg*m}fp@g`4|F)QskkY;@%)6Z zDU-ICYO+n9!I5F{W+;sK8MKH=tPN{8Zc9Ni5F4j7oWY-kgc6`QxZScW5{D?Vd#%T1 ztE@iT2=^x9KbMwayD^pr%drj#LJQEtKh0lz2$p)L1} zhnn{v-*e+L>w?8Uo6>#hRCmJ2N9QFQw}PJzKJ&G^FB6m+ULWu}!$t+CWt%qL+@m(@ zl-YH6EnV~Yf%auz``1<5?t zk85|Gxc1g#>jO2rPaJ~JVDV4d*g#!vUy|3v`{6Uie8TZy9Wy6ql=&2sju64u8TZ{}DPux6WF+*wAW2 z(UHePouvdA|&4T936N9P!_$6CU`5WnK|+gdciS zJ0$M@(|kf29%D1r5CSEZKMg?mFSu`O8b7>Dq5@na@6;)ztV#E~2IvI(2J4o0CRI?N zq$+dwx+{e>M^`1yo%_a5fe$H8DV>EKk^`-Ew)%Niw-p@|_lM11Cm$Tx*;TW4^X}F% zZdeF$!)ds}CD@u5u@wH#f@*NoKPdPI2mJz}hQ8vD5I4+&c=AL;1D{23p=UIT;DXah z_Kb;uVy4%af(?mFA%^T<2pCTH-dNb)ws&a*2LS`iQmOt8t+@paHqX4xT{~48B}vkp za##JbCI}Zg;Y94ZhW=rwzkwv-PY3OYZ@K)EI4Dg}5{Vve@QYr7-bJ&duq z883bbY?%oaO!1&I5%6g6|5T_H5;XS7nOW(m2F&sA~ z)-%t)`OzKqFK>Q)cOz#osx>CR*$Q>qWHXv;hagy}wJ2=?yk;6I5O`|koe146fVT22 zh!twFZtUMGJr8;(UweVU2e4icX(`~(oK#w^%FIjnbr^>3+(Z9@ZX#C#hEUd5>h9|i zsz@eDf4QMb^<5w>fp{Dh^m0FCss0GhWN_ddO2*-dMjeQG8$c<}lC{(-hQBS%p_=+FGwp5*Y(PAA~& z+6SX+ZeJQM7B#`Pgf&~6)Eg6BiTJ#@5gc3d^#k*&A&o+&uN4%grSnAULHnkkLA^2%LM&U zO&${`y;*?{g2-q&vbn?17%Y@DVvWc*@%V41qdC8aC@c)Nm!mm5PS^0#_y!cp*?L^M zv4X??x=;=eKN?*DQx@OPN08b|r&e?aS$rj(W2x;^0hn6GUikolVbbU3Oi#Z&Oq4>g|U{uFAoc z4otpJbi$P`!7fK=?C}fG*gqmPb_Qs$2226+f|9$d;o%0nfotFpIMWC$L}$NbonVI( zAb_@kFM#CKrRa(AT~iUA@i{{};I9T~ogD`rTUo!RHwAq-!K$f1)1taWSK4f@Tim=s z#g(o{+7|0hn;Cc3pBxpU3RH}WlN6U5-6jlOyCh~#cgIk;5#$zJJsMK$O`OIYv_>3y zvtH+^b+|HKtyJf=TRa-6-j{JeqH0Zcqg3m*>Fqqn+HE>_`}&U5NNYk#NF%}msAJyA zk0H8=U{Ppe8Yhx2rhsog86Zh4Q2_sTf)7}d1;7cEB<6yc(zTu{-N6j4KEh_zC=Gl% zO0(l4OgpAyuA^;94?2Nd>|%6kDT?%hd9*FwmZ+T<=B|^e6w=~4y!a0Ag63566{>V4 zJN1gx81q|#ZZ{8#8Z#p!p@y7)Kw7p}Nwo|DHyJHe`s(Iqas#!-%XU~|A)m&qGdpm*LXGNn)QaL&O5R{%#_!pX163z+G1fB+ykxL359?-NI%o}{72 zn0Gt`9mQppSkLweObJy%{X#shB^?gITLA2Yc7sp=s)`XU_xS$2F`x1=nkj^Iv~kD% z%SNsqYxc5isC&nQn><~OQC5M9^=MB@2(*qj*?~6I*zR3??ZWUUy?uNl7Ge$IW`CeQ zparXzd|_3Mr*-+R8+%)ByK(=r4BWtSZm%Q2%jJ|j(ziB8>lg*xY>f8|NL4H~w57#p ziZ?@CR1a7G09-x7MSUpRlf*ZRFlbXX3_61!gpQ;QKPYfizO5;f3`)t!`=$+D@0ZCS zrvCquXiqu4RfQzV6nUU=*JB&keRX@CIls6e*_$?JH-CBEhI>}Vjj8^c`bG8D;xBuL z1ND9l>u*i;w;8mNo@@#_RDHNTR@)ikfVF4$V8{jca>4$2EfzyY=!>^)9SHk6*R+Is zTJi=9fCBf#X2FTaAcrh zoWxibYeCt!lN74BV^SBiph<@}Lb*JNES%XZ!57}z3M&9NqLf4@x0 zq4nqB`ZvM#qne2T>HzyyC=5>gT1<&qKzf4P;46Ui+^9lw(P+@7#JYzr8`!tB+0P}` zeRap4uZ#zZpJ@Db0aO^M_0{{sbuKl|U;l$6{hrp43v`*hF(aUJ`s7)P_oJ>yLvYRuAWfyjTa)PZD5P<}`1*(9ZK<)zkBEciI6z}54zQ&h z2LL}qUM3D{4!um|f56L>VgUzr>?)Nt<@F}5ba8{4S4mO#Igp?&(e~P!d11{eHD9~| zFa91dAd*TxL!qYV&jctBqAq4MHhW5&Di$eLQPbivK5YE&96%^JN{ zlUpO>^croTF$B?vP9l+*T;M0r#Tb!`G11?{@xb8ah?n!q`hz@7)A2|H0t_f106okC z=wYBwRiB8*;kF#8OWs9UQKnDvEHgLXGtc!*=~;f$7sp4gUfSSRsr>V{e`Tw`yDq4d zN#N3z3c0(sJ=nIq-hz9toWJ0}p!c_&C+|xya_NJ}eE2nB!{RTj%X(YKcHPj^e9Phe z%d>J7ODi>IjWeK^Q8X3nUzg>*(b0XY{B=H^SqD9f*&J_zo+S@gy#cP;gQc)mMwd{ z#<#o;!}6x-@Mv>oq+{83e4VJL8MahU+lBlJNmLm5ST!}rt%QiX#MgG;)FeUYwqt-7 zW-$1}(%$u!|I2fuB=C+9E$}TA=ZEQg(TDHfDbK9V&>t;?(|pU(eyZ3h|Aiw88rJJ` zKwFDD){6W6ysxFl8&Chevfj{DU?ZCJi-^#?%j&&9F&jG43sYv# z+rq2ee0sEfjXrYYS1G3=h_T1F^g(pmcY}rk7N@qjfM`cR?af2BgL$)(gyLZlF5u&o z{P(r}x46&j4g=%uPhc`Yv6Fg9DS+Z%%nRYpIX#&hAwSw{A@TgWjm4igIX$TghiklNsa#AmKYHX;U>~#odq-{swJql&eEpogOB6tUO%0QB{%nv zuRVAQ*1BahrbS2Lr31-Vp7&knYYomr7giA&*V>>K5}vNbF^f+=r|J93POX~ui!&QN z!81T*HHJ65I|A(|BxSYufnJ~f*vIXKSm*jSVjYLf%1cr7R3uO&Mg<0_mx8E?g@pO*w8<;Vy=aC*XvQeCz^hjsYS|;9o1`lV4sm^9=uz${OIS;vdr%##c z3}yO%ac8jDq4$=7(r_tOP<)B65;@`UnUb%2k&?LrN+aOVa*_lb;V6CY$Tf&if85@H z=6WFrB)mPRnI*M0F2vO~DNE0xYz16E?>v>&^5=^>0`2@o_vHEB#Ft#~o>f!w*m8^E4NtnYwvzzMqV;euZ$Si#zo-C>1mCq3L= z-|ZNsr#OGe@0kD6Qk>xMDMV_A)=`l8?@^vI6c){?iNsE#O|O}J{^S~t=;i%97KxWB zP7x9hpRbk1{GPGVZa7AI_>DG*|Cpdgs(NOklQ2J6MdMW^8iigg8X{h5rMP=n;l#xO zZcDv($J71d4|a0Q_7FleB&+LaQ~cRk5}`p@na`OA6!I{ho(Z!E1rQO7b`0T+sKE3h zJFWJ_DY69w0ky&HAD>eP^qzZ4KH&B`XO;_e6psc-hT;}GWw-5L+hGebb;@e^KR-i% z4~>#{5T`q_!3?qZ=C!cRqt~06KA&s7ovnxO&AuP^()iKx-bkmpPV-xSaI1+O?#Cli%6ViOpZS6 zG?677S&QJrgeJ&sd3rrF8le@8QSnAblF8!07i!z{`Fh`O`Sy+guuihMOk7Ax#tH2Bu2(b+b zM35{1{ZG`KMDuUI7Lv#|rF(cg)Oum{udpQm=|2hTG-_!ufsl&8#D z6#>Fh4pp4X8oGP{aJAi5!lLF4jT};AVN?_}r$Szo-)|Qvrh}*^3?f8aCVkSHrOi|M z4}HHLi=4ZyC&P9wnEHGTdL%nmv+W`E5)iyqst;AIhOCTdx^n9RL`} z0U;cq7ZpSuK_0jlYKoE6fh_M0SgI>KV_4@sW01F3palPjYM!V}tOTD474(`cCZR<{ z#!aL(j5U8D&aBU{u9fV;x1{pygGq^KPx^IR^Hb~Zb5OCydlJ0TYs^U=?XqtdxKAS1 zwe`212LCt>0W-6-WetFWF6HbklCSDiZIm~~nUN3Xy-L()N5pAeA;3ykK5JwXqblV4 z8-!3m0uqb}D?$P#h59_B4F~i9r+jXNIsZ?jT!sZbJsdlKHwWqHIKQ|9l)LrAK_?bw zPynS`S-zsGktqbxv?gY4uyP5uW5h53Bxu9kd0yP26rzm$*A8F2-bDxV${zg9}W+#L$wur{U* zrle0QjPIA&r`-wvQ*&plut?P+cy|o}y^_^Z47TlgvuFeMHQmXL+t$6j=S70zHy?90 zqnF6e9{qkV`44c~ABk|e>kwkLPpv)Q`@H?|CZ2_8KlonFPfQID5_mtWG!7#AIQLt- z{aw-@$XJRA;;UOT*Lb@@#0s7TaPeGZzbLvmmVpFF2N4y#@qq;JAw-v>*6^oSK}f9q z31Z+jfSMFtFmaZn1Ue2!0i5|lL<%FBB)-p=*Ld|50#|iUwadCky7Rh69H+hq91j&2 ziZOO*u}M?Wz}sDMwB0u6&rn2sZ#oT!!MdL?PrK?xtpj71o#;WW1H<0-d#S94U&Jf6 zp2JV7_x7>ZDqKzZ0j+#L*y{1V6KI2S%Q#6J{>`v<`jzMus4fZxBitkQh3~z7JC+~} zNJ83QF@P89*Zeg*6aF%_#I|HbZ(!Rwgk=L$793AV+tVD$?^)n9GVB;>TigTg4J1xXpxNLXv_PwNb5bVq7b3ZA%d)KHCIU zOWLT>hp-8zNMHk!~^D>woV<$THtU+r; zZArkrsLDCKJ2PFajf+|2OQk@%^y-W*i^!OQX6G{`z4IH`-`Jfw*1Y)~BX_?tj_Gvo z+2_U1va$&GiO z%*53ZUV}8V8^GBK1<7K(MwM4FuGRB0O7YdH}asB9a`}^B`h6N3f?l)0bJayg|J` zZld{qTu>FdW0%@&z~YvxfLe>JTIK_O3K0OPqx{q&_ug)C-Ju_^i|7qG?Zrzp0X`-3 z8C<>&#JA$w9N4+ouxro6jCepwbW{BSc)khFx;stu?Ln>WJG9 z_48VJ(dGY;a#&`PGKc>10z}JAdOQH?6{(Dx%k1ec(fKQ&|L9;Zx7u7ju0ma$yd6@h zmLE=O=7c0sVWun~HDvCw>6J42FQe(!xZEc6J++nCM!36CX}>wiw;ZJVo5X@Ug4(~6 zn6M~9E={NQ|J@)TFj)8^am&9OZ(z;J=`3fmLRSVoJ(=3xn-vXpb*Wn0H7KlZF8T5*RfwtUKW!w0UWqPH#?ou#;)T{d*ZHX5xF=*gLgf)XU1X+PtktR(!j<-P^-0uzKj{Ov0gh=cSm@Bs3u^{CQ3@JQ`sP3DDim>pGKUbn=M3>tZb7YLugx+VH0 zwku1qwrB5%zz$iYag$~4>9d(E8>?#K;5GpT+(h_obDA)okn*}O|- znk$HjWN7IUm&?{4YD)2Gp5APg32oZRi_BFw(DT(@q#0-NrflBdgU@P9nLmNM1Mq=_ z(jgiQ#ENPex$g}k4<^K+9k~7?)9sR4yX9acThVH-f~m9>8qJZwy$9*%HvtPL&hI>Q zYIi!li)U_~+JC=cY;kLbf6AANfgUd#y8?KwM%bH|^mMc^CM&10}UrXU%gc9TbTG&lCukOt4_zt>+X+k2w zg|nkM_pjq1m>r0wE$&dd?g5Z1fWz6JK#oYKlm=IBaL&F`aRA|}b=x?*)Wv_6$ zmxU!Q4g8QG#f(}yTcQGdLw|UFz^>|U20DI|OjEpk?;j81UyFT^XOl#%2(NAfv?rv0 z(tnbDN-d_J7Kca3rgq5U-SY_P{;YS(3Mn}xmATE%4Q%78y3OY9mw0VV*-^v@MnO`A zVOfSx+vN+)ehN=6oRz3OJ?ZeOCgFBAu(QV>K1K9cKYU`CNjwWuy^-+)#r=E9mu-YV z?k1st-D+kLII9;vbUAuldlh{!QmQ*uXeT_a3nQRexRr#AU${3y(mY^U@77c#R~j4I zvD^dq2_d)N8AZ76ub?~y%q$3exn-}I zK)p=s)P$c89L-XVBHAXanDY%lSr1qUOp&e^lfFtkRJq7VFg92r?c8qT{`D3^Jd_V$ja5M;f)yoAw&G+8j|I!TSx&Tec70Di}2KLgiPKi6%?E=M0DxIM?% zvvBSC&eDDdeFPC>tbBjXHuZ>TZ-XJu7vf~p@rY!iRIpnEGb9V{R)BdqH(y69^HK`D z|fCm*ApSyWJxkz=`})@u*H^*a2>cmVgN#tVOe4SWDaQIW^@kVT7#Wy zOTd{`LoyfLabt&PXsUcKTHnObIqWb_c6zWN_6zh*h``1)aT=m_hu!)A~CARUra_P1811P-W+ z$@UhjgK`nmcty>%E%ey0R3lNeywbn!@@U$3s;O;!*N|a`Y1px!tK^FVoe?G|Ec~N& z)u$D*kPx&mAGI5~hrlc&u)P=SRwyX}@THtfzpvJm{}?uM)khCds=($2t?u7~?RWT> zFt=QLZ+Fk(rU)K`rsVyMvJuwR+h6`bpu!4s#ua$<}AmXfWqjJV8ZG$Am54k z7x;;P&uY-N!$|Q3Ar6D{vW(Ifk%Tg<6mLNe3NQBMghUdD2i=3_O)UWubjWyOCA;O3 z%=u{fJke6C-Vp}Qlh1p*@y}{MePWCmHg;RdE!&d zloSo`&RRP&y_aXa-VvRP`k`#B*)H1c?X1n5YR-ZW@g8Fugj$0sF3pI(;t^Z<0%B{{ zedN2`CehzUs0<`R{>p|Aw-be@~K)5jVX`N4^N!{%j}~>7ugA?AlqHI1&VrTMis?cg;6=^G?}@BYT0H&zlNX9W zB(dXG3|_Fwo{mUTdun^^32@qE^MXWMFyh{?E_(_KFyfC#2_(MEJ9OVLdU$tzyXR=) zFh_`Jy>Pp+@9C1!M+qpO8Lmj0RuSbqNTI|=|Lig*iCsAwba3iZ#cAw~1#s#M5MiW8 z$ae{Q1WPA<9{Vho#No4Z*Tw180)^HUF)&&0k|~;2@~2VvATnPYgp81T)8r9S6_GeA z%}9PiY^72gyRhzjQ82>E!)bqNyX^q&E~t>Z;Kx0C^HOQfG*e0WNiTOBMbG0S2SZ>hc#27- z&ni9XC8aBuoYJbl4#%9jjKm{L&ZY8Qf`nSLHGHhZyJmi?M+lX52vMO1B4vb6tWPzm zQ}*6dEC=h7I{2BypuOjyfCr(;l}ifj6hAsEgHIfiwy!$+AyL{qfzafjMSKMU2RaCe z{DnZSs^k&DofmRO6dnSpkK>T0L8LUyX$x_0;pS}5PM2-M>n%Shtyr#NpWLe3(?o!e zn-Gt<_7&{qn)_=fy_Kwkab;(HiLW!ZlZ=p}<2I+=!tG=IseTiY6hw|4OOln8`W1E= z*0is2K(pLZX`I$HQu~O{ox#J>IeD|o>P6vkpFY;japN2Wah|(i&yDPeozU|YAfjfz zJB=!lfjUz=k+rf@J9j=zYDgwOk*5L=^hdB=3>?DcLGSpMc;w+$~ffX5ae;#86qV^RH*w8S`t-&&et?G7wi6s!U)> zH|IXCH_3vfVb?>5b~!quOQi(Wx2xq-)-0uy>cyu-vY@!fqMi#;lzHi(N%0j+-Z`M? z)@#YGzLf6Xr2%!7e%}-I3FPgMwjagrkA}7%$E*Q=4gWwMItSxu+`Y>NkvHaf93suP z-CPmI&%xW>_2^e`Ms2VE#qI!-6|fX0xYQZ3Cw|qJq5QW;HQF@AQ|UfIrUI2p$A11V z=D*puV3EiDJK@G zU6V=y8>6yQ+HU1zBBwd!dQMu-oJ^Ta)v|=tQKo#yM(tur(x`k(Lu=nMcYyQSYl)I3 zguGrkk${yl^}e-Und2wWL*s%oNrjLQg8Gf&?Ik$)ufMTb$c2+xIMNkpyfEZF{->Cg zYsYfLt|455{;rPA+B=u4EDhQHl24O}-uP0dRB$iqnDnx2>n;)cXO#S@g`;Z55X+Zn zWCF!dlQccc@2@kKLKOKctgxhZREiV?^23CvHTwdBoql~|@60cn1K9D)wENg{_i?*9 zBIiQ=>4M6X1kmfWMbRy>BbUFMkawPnbs^291WH@gq9c+k2$5hIq;pzro~hseIX~nV zg0;Z$A*Alg&7ZvEwlf>|o*lj7rPCsrl>I#yW)V`qFrjQg`3C$lW`Wz(X%OT007lEM zn#{P&CFu)a&5%qr@8rv9G5v*vCX_6oU`bL-{1J@?DpT-Mp+{)ZvTZoV3$$hFzu6g} zg+Bk~5=hc}?=Nr85Ke=n0Mm%NdKIvGX*5{l>g(_JxPn$Mwo;Iv>)>C}Tad?je zz7Ps04Q&vVh|`c+tb3?p4qDs?K`qKS@Mj5NcoaVa`t)AJprvYS>;Zu%tLmr;|vSiIWDRMFQbO z&1Qry?cZ9p-u?)qD9m{&R?UVk43g+p?!x7AeNU}fEngVlC4|+axp7TxM(Motmd=gK zm!zZQ*n!gvm^5uB!d-t-wXA6dg4L@kh=6+ja46T&>=GLl{Kp2!&7umDS9&tnN~HKa zw{~Bm+wp<jz4_#~8$+vV!y=TMPg$jhtJ>QJ zl2TEZM#*BiM8bH0ZaFu)&g;_r%JWj$$*A4X1H!(bt7<{2nlrw+&n{&BE6PDNZL5}3 zoCOS4$k;-c^GN~rwQSS+9ZqnL;GQ?^!*$Cd8Kk|Jm2h>BTCA&&Z;oMc;>Vk?2d1@4)YL%s06|9)Zs+lhg zA4PrzOO}bP8wt>N<1?WLFm>1reM5mBiDZNYZ)s}p4F0e{Yf*{{&9{JcK*X@EXkhDI zS4~0f-~vfVZ1d??p1jqB3aCWRwC4EfBIg<6*Wz}M4q-hV14Ic@$!2xJL{1kpYQvD8 zUJpHTC87kV;^@wCN+bxA6k3$>K)>u@gHU1jh}1C9j))$NJ)CcwSI7H1y zSOC;?aKeG>a!=X#v>m0i)(#TYUt&i7*FDO{#?tnA=pAwH3#z^|JYmoFd(zMpn9NPY z=6FmJ*+7NJ$;lW}ih)A4=3e_5bvng)rZ~_K4BElhKEjlSfAOdhqa;C;O^lp8Qm*97CoPq|6>AhG zhDkKmmrjdOVZIUBJ(NpRCx=Hgm9E1TD^(QHap3B68BcsIoYiS9yH&5^6CjIyoPPqc z{uI5;7ts`u=>f5(kEhKZj6#A|ZFm{%L z3^`Ez6S3s`C&-k2VZcOYpDh?QREX2olrCHPrgq)SyK8)L<=kO?rj=%y#f{g(;lt(o zy~nkm-;Fj-xjR|~HgEyMM#_Nub(-H58Aqos*55;b*cdFWL)$a=a~(7AFQ?r1LB_o& z>%CRXyo%qx!t!E8nsSq53AA=YU2e5ebDUpJgeg!Oc5XXPm9R%)Un}9IwMKY-@qq?l zX7+p*PnW#mUx#%aPe@*K%i9z})9hoj%jRh0Z7T5E``jjW0~zPKn5h~i@^x)o&vPUV|j~&0Z|$O z>;l#u_aJ87Jl$F4(Oe};dBOoFg0!DS-j+GHvUwL1X$i-#9Nv zqfBq0la!iv-Xi2fxAv`pY9fMBc(*jnBUIlsY019Gf*M&>L2%6+Gzv9{EbC=0bjUHU zc`CwJkswGS_>Nv=;~#Wu;KsoX@wDB_a{Y+Me0hr}E^1)76#X}b>K1TqcR}X_Bo=ng zEe7`PHx63n_ABX>KVo@Z5op*{n0n3rr8~-J#!UiXjs9^*s>xg#@u_D^OD83ojLsGNHby@uq6(MIFV?t2gr(hqwe+PSwO?urPToUTeP0 z9q!K@xU;Rusmkll$u?3d7$aAV7}MN7#lXtx>QO13m)Haw!Q#RZjFX{BkyLh6^HF=c zKi}D26{nOs>DP(YE}}-vnv}w&s;($&uAZD)llH0Jfx}hzXy2wwI%R1PPT-yN3}6YR znH6SJBo1UO#JM8yz)IxYe#zgq2tZ9b0;(eu!WygntV4R`nBfgNO!cUOojdK+A}-x= zbW5Rqc|d9x`5VuxQ`oS?K=D29_vh>KB)Rl}tzD6_S0=w9!-tUABTI-H_0*-^lKM^E zmOt?sZ$VTA>YcE#vnMthq5Gv84RW(NsBTwmN7aS23n@*?hqipEiiUDnNYYb{@m3a1a7!3?A*5U-lW! zI5+7LAL!CH#QIy9bubk9i6M3WG)}3)Kkqz72NZfD)kF+%T0K-H@GC;o)NOz z{_!A7E5zKZ3Q5@Lohw&pJFyLHO&%RJ6nDUkYb9hrN9m2@yBz2h}Ee;{rgP zFNB$H&M3>$4HC57+xvVwY09Jt6CtJcS{ja1=J+XX9rK2M<$13*BRd-7SF4K3qAfEe zkj|~3C3^4r)9(PwYH906WeifsKhtvoVCo=E)1h2OLAmmmgWoa4r4=I$I>4@vlV1M- zC&WkDodWSu=0G|7;a!)$W*h@&Tc{V1bc>a-v*_t5n}<56<|^|mF>LTx4m zYLm_SC=;qp?6_4*QS}OIURN#DjvfA3GGk0ygWV7K_cSii^uQg*B~s7sci)AElT(6s z3%w$&YW9r)>}b9g-)pPcmIemeP3(c$CjAOe$j2^dOPk1N+0oTDk6~q2^QDQBB>Yhc zJr$5@8?LCqvz19yDY0wDqUQBI_(&(q)4HfpJ5x3tF-|C-l=9I@kv7}i86nNLW_RE> z0gZ7+ZZ6}do>}~^)u93P=pqJXY$Dq zDlsp&GGEb>aw!lnk*`*&v@wkmQR#8BTg?_D$PnB;CBiGzJRQ_VtLyY{1-B>@B@@=j zhu$jr&@l@@GfFF3fQ43_tCA=4Y7o&lcW6>``Ex`cKl`1|vlE{(VZ2Z!V9VA9?CBV% zO2FRZV`WX+Zu3_}2_k%{h-wd$Zi(%!;_BmbDuwI0Q zjoYWCzy2Gua<^DTHSxorjb~`mTG+y0`Wb#*L zNb9VOqN2$cLo`qJc7v)e!Ll%98pxLp`jrscSrBdQapxr&G_#z_?B#oI4R)HVzPyxw z0oxp@@{lP*-sVaD!n5M3_&|W5`;<~xHH9pT`V^sq$efrtUv{X!3HbbDe znZc8RLT%K&I#z>gVWVm>Sj=Zb(AkYuWGm_*7V@7gt}#GF{{ba^Sv9;9AcT4#Okb3) zQw)s$Rwh97=0WexN|M#hF77ohpYNr6mz%xyr*a+V8pb8uD@u+JZU1xZitGIvtoRGA z`Nj$5?j{mnlO0K0>lQ8N$|XX^3ek*<>xb}lTk-4hfo zfg5N+7sOpnnEV_akSLEZvQ_u#amSvVW{Jo#7lxc0&nI)xgeo1=k}3woeYIDxAH94U z2qY&VAFcQpSa{6^sNky6$69aIPL$pU?tYc)_?o&>7Su=Z$_PL3V#LvloV*6`jkcG^ zCg_~^Di6rh%`73t*fk#bxJ5PwgOk05sGFF#CrBtyQX6Pi13K~Ns2#{X33NFCcW=_t z4UaE;zjAYr2nZI`9%gSxW-isrj^5vI4bwRWL$)#Bj@lm?$J>pZK^-RVsNbBq^#0Zc zP1>v$^w{E|maX71@W}R}!v(jO7_wik25hsid(pukkx?$yZ@1l>RXJK4T02!z@5lpf ztJOmjQ5m#S>)}=y&ytMM`=P^C2Ljp!Hw)qPa4(Ez z$uIxgu0>e*&tOphN1)y=T+Aqz-Zo@rjh*Vr{vvGy&!-Jx(}ZT@Z(i9Pd=1w<|E%9x zT5r+W&pWqrC2h+viZc7bQ4fA3f z#2xC#!Nhg{vEA62w-NOHW$tYKsProhLmMYGihRJI=WhS6f1LiNdZ)AJMW~JLb3plK z>EKuUX?99_*4vhhU5lwQTW0p#R}X6MWtFt1(|tRo{ov#3gTL;l8kh)RIY0}J2^_!U z`&#$~kIzwf5Y`5u8__`oxn6{dXh%ZHSj`whpNT2VfX|U7F@}dpZiasLhmi~2$JGF1 zFG3wURQa-B-PXbQ?s<5ZCP(vq@P6Wca*}>@^`LfmmxG9-ki(GYABUn#F<$L_R726O!e8Q51^^XmzgEYa ziS=TNa!Fr`H$}wXmq~9YjijwZucqU$@B%#hrj4I z^=LL@^3AE0^kw*;heRoa{>KvFb|TZt#^(xs^mCNY@p5(4x0|oU_kFg{YSd>`4#&@< z$oJqmW)eG1E;_pneb9~ZGw;7*|DSGd>Gq!f>%L!v077t_W8oD6L=$2L92E@_Nbc$5|CwUDGQ7mM$wubZ)1b=@DDG2d9jasT= z-t<8tB6|eh(S&26*j9fE>IBjqk(%m1K9bTDf|3ysH8RMAGYqv-h=4bb8fj#*ht{?R z|M)DwzLXI8Z%8$|fcx6EhH!KCp8)D8$RNhS6w=@hmcEpdLu0(O=rxs%>6D}3f?tLN z)$r4WI0qBbYhh%P4cKTVX#S}b4bDar)fwxI6lN{cqp8&Y`z5L*^Pt}3#G4d|Fbe|U ztJUu=6Op`7BvS$r^HqzaVQvMygrz<*4$(Y9nDWo-zBGISfPOeb6D{JTJzbC$<7>3w zjgh@}A1^AvpnO)?3PwE~Ei!{4%t!_qn|%bKn870~h8L`njDQ8C(qNw+)VpTv3B0>P7Y5_g4JF!1_3?gZ)qmP@g4W{P&I%_^-(uoDu#zA`A5bK%7 zP=kKB?%&x#%q6V;#I*@xZrR9#S8kvJs*3)Kx(oumACR=P`F@G|W z9F88k2$Rj&+PHl@Mnh10qCfO|#DfY$FDCY0U>B@#O}AKEhrl_rK&TFFOu&k#gIhz4 z>e!)*2hgYnJh(G)}2ee>DSo5c~3m zn@Lt!?N+O%)M={ll5q4WX*NB!oRa=-p!tq##9Hi&SR{wHf$~Pu+zjyY3IQ#$=Vm01wg9`kKSuW>SGJy)is3B z^Sz4%BtnefAKiYqg)7>q-9>aUgFb;8rZ!^joM#yXgM}k&eSF-1)!KY%NRI-w$cik^ zcj>ZqKb^m}53Rpj_OLgYu0SQu@rPcW?NY-@-RUu+{ge#-Q^+TgR5tjjJf2}5LTHIW zDW!q-C(^)H0FUp>O&LMbZl8$!%)VMSi1cP~1)I>QdO>Mff>>DsYoarpXqcl8C`k)x zIYryub9hK!y?vAZo{+}dm3_|c=c|t#H8L623v=cVdm0q0fUSa8^{Y0Mem=#4CwbG!?|B^_BN)|QUj4@VirX;_*z;&Rtot68OS1GO?atJFk$ z;BntoSkiBt07|t;oz$(OZ*=eW;MwHVFS_MQRYLLFmSxg9;fOKvlh&U-C>nBIFS1&j zQWhPmN44E}n<;8!=~7!q^F-w4)^GdF9nOrh9dF#^T$`%cJhP;)0~~^!gy!DdJFw*9 zchcx<=Z+|nIn2y%XhB~$RIy%?a1c+WZs`jB3W+g<=71k*hZu?t@+7k_ZEJ~XK;$2{ zFm-a?5&j3-m}qiY=^#7f%LAWxT-+7@fXgksU(&T)(XGymsI5!z`nLXT-nNZg(J~x@ z5i5G(E`~I^A+8xCfSovp^td;>>|lhqgJw|4d9xjjmemNEo9UJ`xMMJ*KhYAyI1$&s zcE92cvZ2mJ(#cpQESbW>X8~AoeODbeN1KKj$=m)HGNQ%Jku*2BnG-@_idSO3bDv>V1<_l;x)7 zd|=Z1bq=DdGSqrEz1YmDwE37hEj@HGCv{uN-4uCnQ4a*IF?_-9N>`^HZ=g|e!brGQ)ID`_K)P|cl%2Fb_NeV1?`g~|h?VES zkQA9ZUmp-3aYm*cCjf6ga4W$l%Y91h8*~aV?{1?-DQ1cGl8rRL_9 zr(Q{V-BSf@6iQX?0cV%{WNVC-C3D6puU|EDsHjob`Dx;XL zac<_2b4zj=Vq{E-4Xl|Vntv+iDxhBc);-)e*bgCX^uZaUf zGBa9SsZz$0Vd|MwiJH=x1Y54;dq%EEAmnITY9l5Y&g9U-s3EkkSOG@tbeYk`)Q}|& zXLmi8kr**{c{5Ft1nqEMnp4nhI({F_0%XDnjy4wpp6NdVTL(ZPb9_=2b$r!1W&@vn9dkzWn>Eo$v64S~t~O9%z7<;wkQy1f0Kl0s zP0k%Nv4$xl+IUTg5hfWfFx@|mKE!GFj44SF66}~NAxxcyhSaeUHG{Fk4M`eUUgmll zJc7ZhQl)%&5!&cniQ<(E69hVBJ&hQVMrodL1pmUQAQc#4Y_ot9<2DTaq3U2u@r;-Gw`tM01*kfvRdE7KVRFO~(Jo^S#(W zVQ__ML^0(1prW8Nh+7OEsjvzjMjN|q_EA6dJyE~=`fg^Moy`GN8) z$FKPtMe1Xf(Q!FqX-SEzp|kT>OPaK?M}#M-I;sIBzjA)qYF+{?XDa`K?apjPRSnsp zj@)@>cB*7WARc=POI;OhoxxJMD5=? z4Gep40OnCO3JJtZ#qznFpnZ6{Q}0b%Hxh)=3f#Bw!Kh(9RVw5vE&gwcye z?CfZOX|E6?ED3#SJo0a$OTjDSO#;kZhV%h2SWO7k47$G9kJp!_2TLnl{ImQ~5w~Jl zaCT7pZ#meLVPjuSK|;I ziJ~mn2ih$xQFy~{WT8ZEmaH>i8&-)ETs-;4IiX1`WQIPR&G&3PMC|HP08(1*nUTBxuw3 zU@aD-`k&Aam+m%I5#q;6qlTa!92pZtX$D5#*-l0)ifu|6Cdp*SMp``Vihbr-1+&Ke z>HqQzy@fov0SWxD@$^f{z{*~pg2B@hC{3Ao7`Yet=VskKOY^Vqm_Ecx!^llbF;5Y% zG4pbb$iOmk?>J3o$J~3c{630L`&6Z?JRD@Gy0;ADDuO7Z1#*1TmVzGA<$I;vT1?pMx{T zGj0!umH_f^!VE^mN5BXDP4unxy|I|?IGPxN8|4j3L%qbr87p!z^ZBCBF0#_Iq2pj+ z<(LPNe+w^jYuo_IPmi&1b$|WKd**W!80i;xnOB%u{A)A)6$aX{#kYI*0k=S2J@@=} zAIF9`42$dxy}4ji=*zymHuz}FPw|7Or) z1l_4Clt^DsY6_?Y#Z)x2%x z|1;`%Gtu*Kt$kekq{?1D^Z$G7@ozl<-^yfusq|@?{u3U8`}wAS)#E>gg)*@3k?lW59v*sW6I(N9a{>+yCQf=W3u|W+ zM|v@917{Nv6C*oglmBgIBw+jX!obJ(pGfZ6S3c0{TB{j*?JwuUQWE|M@S9u&xndF+ z3~XzR{|E!77J=6FSK)+^BwBRmfvwqPwdF3_NOFvOS~i^(%g$JA7VcJ6Ib=rfq)nCB z8wr<3`UIXZl#P5i%K5TQ)Hgs#nRd((d43g(z09Og4lttsB0%j5{0#gT;~@x_dK z%un*RaRto3Y31|RnA7@l>|%1oPG@L>*TBt!MooQH|9XNHboPYG&+O|D9bDII^@h(0 z!3k~pV!DQTAOGAx%gX?@$rF6B=d>n7($hkMy{Deb2Niv_m1j z&Rdxk9llv9l&6q{;Xr`LX)Mpb!Mm>>t9a1I7?g(c1< zjA9uJGzIWby%Uy97(d5EP9#qGoV-WVZ;$YE+4?yhx=CN62G?#cS-uV_G=#nTw9$xt*$cK5gGTh(;fG zbJ52)WZSmC1n}-l+{4;)oI~fc#{G{i{tKX;-#$Z6q>Rrz14)7)0ObEU^@o8h^ophZ zm+$`$@c%OfzCci;^IOCIdI;14!PLglRvFl()bhvEzr^8bJlkbSNa&Rbjf@AQFm}bO z5D^}WGCW1hR{1(WeP12+k6cyANNFwL`ow?qDYYJMRQ}ktMJ6#{vFLN?Y^Ns#ebCzQ za{Ahp3gV;wv|)YLs}C99d+`;xxna(r>>OY7`B7Ej)8G5nY4>5kOp$W9t3^CCj$Z85 zq|hcQtFuR>rhbjugq@ZAE?j3J(Ix@!`V=L`IiSay7Y~Mh-J|)Qup;t{iR(SoP_48Z zVC6gBV&-DvVd1FToZmHTeR_6w)8Ka7ZgCP9|9G~s(V{&TQ__)fNvU6uS1evWJUKEp zD^G@Mk2b(pIE;d>vLJ`&R9U$X%9{G_q1*#DyJ9fNcUqBY&!wrzLsw*9qj z+qP}nwz=E3ZQHiJo3qc%nR`!6#F-m6;{8!o8I@JBBBL@g>sjkvx;Fehu(HmDu2DQe zVyL9uJbf(_bCXf`oT{cQt%!Y5(4`oeo1FMC0944_fkB^{tI>8F2reVXdgK|S`$|Es zn2m!@Yu^$Q;-$C|s@z@AuHyHpMyB6DZ^HDlp$I3c&$cHGqp$d28G}UM6~pgwxL~)c zxCJbtQ0;+(l$@UKiV_{g0ldvGR99OVc;* zJaG*#p!yClEt@DA^z_?YU=rXVI4^QVbR!lOMfPsqS z;T5T;ftHXzy1D`blWk@PluHc{BZky;euZGog%X8g6>SiKibh)LcQeJXO2@imvseHH z-Gm0&zz^~mlpYCWvLbSoAMo(XeB^VgI-6~42c~*$jp_juYfg5FLNHM4u&jD73RrVO z?ItPWjcybeoB@| zifG=$VkE~gE-nFUlAh9gJWOWzt93qsB3k3|w@iG#9v&WYeaaRH6UfB4$= zwI2HwV%UA)1P4P4KL-w2DCFP^P!t*~{A>3njHZF!MnMzSwJpht{zu@)z{L1@h)AUi zk!99{8zR1Fm|H&wTYY18#Yr}Yf^T*>6+g&SpSxQT6tvuHVFG8P+5AK{)+XOQDlX&O z)Z36ps)1K&2L(o@zV!hm2TN7*1Tqy-B0M?Xz&I2hT8`d#GFm~Bv$7~u(`|bnp`=m- z3%Cbe9YBU;K|O!mJu_til0R7Tb5F0lneB?KzTIh|mw{En6`d-SV*nw^FuGGdlJ!Q@ zSY5=HYV+(;_87Ahsyk_p+oL0JE+rmKnh|8D>2FM7Z8Tf&rW-zEbj@6wPlCWk%g8W| zR9fbG1lPV{hHELDjTpFT=iSywQ_imKo5U*J8M8Fs#>^8DhEZ4Re%{gpmWb6 z#Eb$!d&e@^h?GlyBuJ3~bT=en%6?~mXJih_!FcAzKp<;(!nOp8Ayxldn_}M+gl>I; zdCEqvyxA30vSpxH71L6LF91fDB^^C@pKH7+`_z$Er+o@tKNZ0ZL>sB?CiK$Rbkf6v zx1%q;8i7%y*V}pcE@~KU(C=#iFVyeNt8st%U$woThX;+p-Cjec&#M%h&^&EA<}UYj zJNNwuH(0(N?}d233@9u*=DW4~Pp2|iKF=H8!Cl@}(>J-aP&hv)i-EhVl1(_iE*7J= z{*w6p3@Hk@v&0kRo}rMtl2R!e0S!R|w>_yTzbXKPIXn#>VZ+|HusYWh``@G|$4{BBCRJM(V0&_BA1|jx^Ql|5o&3(<3-ShLLCg)Vvo^IuAYZ;pZLJB}} zED@Z#E)YMvLBs%-Jm8-~v#PR- zoAj`avx*zA#XQGxg>zaCE$9JS-D?M0z3K5yJJjy2%(G#5dS2IYE$x?A$*^HiO~phU zEpIEsN(^)yn}(QkAM67=j&vd{!RCoKoGGpt9oz0O^OJNS57GWWkfvdpB9P0a4{BhP zog}*UJ8{Yr!s&!i#2F=@af$;p)O$G+x+LzYQV**^#_CTT6}S(2hDY&LeuZ+BKpH=Y z7l&cB#ot*Y-i3lYWJ};jQY03lav?x^6O>>u!=1@zF9?VSZVBHXW&GwW_EyI~pri52 z?b4ZCR@3V)i39UFL(CM?6O%>lEqMkWJC%oT4M#0Urk#zL(qvnG*m z`pitJO8Eg}hNh&=oAFGV((LJTApz6La(cE4kmU7OcG8%e)v^fs*1F;WJyrWnp!H8?z%TeafES8jtv57R)Ylo}?t{dcz!Px< z0ouC9_1r?G_%v0D2((d2##>&D%SJd`~ zrcsr0WAe&Iiw(x=LRZ9br0@h?>WiNH>U2!^$Lv*EMF+X&@o5tYeyOD^=LwA?WcbhECOd}6KqQ5vfGv*p-~+qXnbPlJx@#e|Ob{fv+* z$>S*%8FkWR?&3eckd=ygIdd0HI%+=lR{0Vdnz73B9lvMUgrGZ8g2+5w4>2MLxocsN zm5#1b^6ue88#+qLPUU7YcJ>eC3d_wTrNY_9WNSuhSQjtY8sN085H29-r|XSW*^!3_ z#l{v9A={0YO&VI-jnq=w<-&1IlA;qx)k(}|3*zS$a@E-;hCSlI3sgsuo*sUsLe;uS z+)71^lRr@p%2N;E;AbKF4PB-AolT}j36Y!>X1OyfX|_vT4UsIIB9Yc1(xSGndYm*M ztqzVQ(k}!xTM4BYA@qd}lNw~R zf4Yxn$ITQ@6;F|kG(0_^h-IJHR9A|hRa-Ix^2vZsb+5mkO1%7X^b`_)W-_AOG;W#j zK9kmrb|Lu~mWONsU!Pc7e*!*Q3YvbN7R4xfP|v+zJFEM}`Y->axE)OsdU0PgsHQu| zG?S%KKhmtn#H3WOrzsq(+8H^(x7Lqz&ez^geie3lm|^&*5s^uSPi}6mzH1h|srl$s zC9w;!Sv0)^?3>j}ck}6{R2n89tBB?F@@Z8kshhsuBO3(K4ig!b)`ySLI%a^i%g2as zrWEbXc6rJth-6QCzH2CCe8%N7i8-Ysxwu!tWKg=H;PHL>`}^A zF)*C4h$5($OhUlkz0utGl{VSzH*wbinqxHK^97ySS?tYl>Fnv1)DH;8)IS}@m+4t>9|_#w06@h)iXEe<_^!+7g-nS#F+~XxA z)IVcBlK6tG@-`>c?VA^ok@I`nkLRW>_X88RxxYn)?mjUtW$~~xnRD3cU9j<_(`k(w zoJ+Xaq?9TQR5*{Xqb^pa$(W2e_0|*&W-V%I)BdpYX*P5|D?G=0BYJ~!N-Xj}K9;0C zUrS9RehEP!;9GO7{o*?ZtWB5!>Dfj;YZhFcwP9;!JBwtgAC%eTJLoF(h^CcY{Vakk z!hBq0mJzgVdz5O)TEZERe)e?-wVdnVNOG0FS9*SgNsCNagN;%)q?CnHK*;&HaeXgQ zb{54|Bf4!Y?}I39_cOl)@Wno%X5iTr_W)WR;Js2iK{@4ZXsgEcy70_R)_2XovT00Yi6TyZ ze*iAk&g9WHBBfP*RL@r$%m10(B2rBsT;S966#ebr0>!{Mn3ruKTZ%BP=sM^Y%eTR~ zq^Fvu9!p`DxxL!x?S|E|yR~+(Nj*hBKE*hm_=@quzT~cGx|q0zd!DJjs%{d4ps zGks$41OI_Xl685Rj>ohXhP#zYp`}^D<+{3ra9!STMVKqsK+iNgDWyQdq}iNe^83eH z<0Z}NwtQ;UCi3E-(zo~Bx?kpVN0bWu)&=VkFiB}#p&ipBZ&Y4In{bS75nd{S!-ks7 zwxo)7qIR*boYI}D6<--oecXN=gEpxLl*3ubp_QAHl*FT`fZ(JYiK`ftAw&I>=JC(K z>C}gZs`&)fkKi(QEI};|!7{$&@p&=>EWLa%B9=zmt(a*y@$~$GXzBsr!JA!d@;4IL zL_x$tL!>}aLtQ~tQ=!-Ep^52*S z{N5CEp=v!r?+tdLKQU(uQUwC#vdHzh)!ZhVr7W(WN~)ZUgf0L*rfkM}ewP80H0dYr z_AOE!Po{ML`OV?u>YFN^TQcL@S`Lb0V=rN0k|3#~45jH4kY#du1XZDu!K(J!ogI0* zJUMA~h0PuO5MnBSk#b4Z9IIGmRCd%3=5Y~-+s-Scr7N#qqeAEB0QYC5&qs2LY>F>j zSF1)xYBC5zAI*^@&03NTJRLoSh=i#>cRl3lxApZIjUV#sUP~awGxw9qnS@6-?&Yx~ z&q-!ut};9C`j);|S4(B(dCTZ#R+~&5H8r)COI(_zCc&(YU}|dR6KY)(4Xc%K@H^f` z-moE(F2_(--D68j3kyc1cqVagsG<)Z^v{v6f(A2S%a6UA9zl5-9u}772hXQY4ECA7 zOH-O)>NS|L4bC2>xY3)vojI)X0^IGVykdpd)5TdS$mlGs4QNDN@YS*CW?%-q)>q)K zJzrOq-+j@1dSILgj!)hO!mgK5tKZqR-S-`i*&Aew61xSxl#Hbxrc8^442*a1Mv`LE z27zl*+?J!4vZZ2D=29^^>pwT_|6hj$2`|O}?rV;BwQzchv9;p$!BtH z^lucOeu3r)%RHkAoMbu~Q-HcewFjF+fN4XXuFpfaN86bC0}6mK@CfiXYm6Jq0s}y7 z|M8aSbDB3@uJb?rgH}-lTvO^4tVcOvjIm3$2RpIor`xAdyu?TR{UEPg$Val*5Y6eB zThsN(G*q34+_KgLkMx=9Z_OD-yCpAz&78dO|(j9J7<&(evDY4FZ8W=!sJjGY6 zZyC#pMLa{dQpE8~2w0cjjkz}xC0f_7pYa|yy7 z7z~PqbaE4#MNnqS1jReF$QlX2&vym2E1!jZ1{2+$%L_#kbWxJ4YEC#sL82K}mP8ii zS<;;!e5_*=rIbiNF3BC_e^uH*bo7@U;s)xVllJKhs(GEq;zb3{7+Tcz91Rpb(3U=T zz+U}zMl5Q-49}GNix#+!30}924Tj4czm4+LVj^rcJP!O{dayY`aq3kG`p}}{hQAT> zkjeG?Nc8h1=cBKa5`BF3qaqH}Ey+?Iv(=}Q&B)AxFS0e7S<+cpz8n(~f49MR9}{1e zuHuWIc7q=x%Y8mq{*Xd9L#zV9bj+AcBP-}(7g$%fZ3PIrBQZa-19&+R)g|WB36Rtr z$FRT!%boyL%&gu)+^;P&Fu4b9lqFML({#tjzN^AsIF9l{NQrsT(fLXM->oaMoF9f*Z4Cp-B-eC zszgd(qQ(f-Pr7IMFOa1JVXj+`ynDqrjxey!HyvIXvl`263#9uEg^t+PcgUydRpn;Q z30h%J+#+9b=uXbXT|?K<5b3yiZ3#$)*fOUzF{79e$sw)5OAhKOB9(`>J{};|JETl0 zv2huv;H&sK?9L(RV<4F=5K8HUvQ6 zQZZOnk-eI9)SpYJD9v9(z|suZJeTzw#Uv^*$r+HVizPSNsoNc+Bqu`2=Sv@TDPBx| zp1W7%6z!R^yBpy=jcgXx^91=<7GPA!oiP;!-Av2eTBQ6@x2KdFC3n^t0(hDK4O$-3 z<+`Yhz=*T5niE_XI6J$>nw-%DSNiH)anC(2<&%l%O5?Y3=O|;rc}cs+Y?u2!F7&$o z?9E26j-7uh5}yluK-seMY7EzlbE)t9mC5DpbJGRida*f0HLE5}v(y9{lWitrqhZ%? zNv2V|8XJvEn0nW8ho%a6H9EJvE_tSszD)fHO?_xT)lE|Qw2gyw+o8gjTlgBtYtZd@ z1sQ-Eefy>uj>#kfjYz~av z_~gA+zrD`^w^JWAl0OPyFKztGF!#n0p)siTlz&Ipl)26BC5O`ZFmh{2>R5E1gEH%W zcyc&x79bZttoBfc=!VkFN!}$CaXa>@!9+czF=fPCTR5-@Mo%QTtFpBu%c!(v{;cET z!{bF@nD7#xwITb7j%eAfwpNM1|3xb8GVT2cGpEET>!dVyKT;3oZGF8-CEUq7D7F*b zS~2x?m;1M1nO(r)<+(D;LdONgr`OjdzDELVWu5k-`CY=$Wwk0-*br7m+`EX(uEuaT zErCekeP*H;=8aiaUH8(WB1(?qPvW_{=?XG$C_2%BLx)tL1>TTPH(T0Hry8@I`_9Bv zlBtbst*2q`JEL=y1FBpQsn6j7&*9`;pVY1JNrfK#AgtWTdP187&k1#JnkHecJDycV z8xDu4`EdKU*(d`K$&eEHV~#3-qDD<=r6zJwvwzf5v+m>FtmXq8DW;@4ZjlB~>E@HJ z<7IK6+SK2@=a~ct4^P1L>^f+1L4p!K-=Mru7IPh@TQ~m&xCGra8tSl_Me*Z|a|z*5 z`ziX+gJYi;_De$Z@CtH~_Z+V8(_l|zWn&IB#Q?0U!8+5MVO^XebQ(zB$*8 ze4VEno5TrK`J^xivnPMZj0M3fqt&iV36ex*#R<$sd3%K^(&^h2_>1%v;mti9w&=M5 zCev9S2Wd9Y2*H9~%p>U1?}U01qwrVf-=}BOz%mGL#6!zk8H9M9W^H1YW3E-uZ&^{vg)cNHCEwv9W)Qg3c|u}nTl7DX9@d2 zSIRYwu^2C*4E0WH7>Sx=HU7g`G#l7iKJ;%tSIbd#G-1fTq3+AX`^2E zf;TgQjjJ+B6OcNC$UUvA>&3|JfklFqdG{c0&Fq5Ih`nnZcc(q%kcN0}^(EM~BjO|Y zge@i2gJiarwL35^Gp%(m--i-4M8XWUg%Tk`!stef2$kia#t@zppy5Xxo72-q&vyEl z>7c9IYsYnxHA*wJEV~MPGk1U2A@zLS&{45*_L)%*VqgcHD1T5XW zCL=SW1mom*o&@>)E_Ypj3(764- z`~z`^*1Q21bn zz&9Y4AhNv^hB08~GLXh(M*83T+?oEv0VKSQXFD4l@a==6bret@!H_FjW$gS!LVQIWG>U0Klm6%eHF`xoJOUxoz( zgn`#&2#RbG7tyZ#^Fsl6WPxt(#310`ZZBBNT7e6PJe*l`-Pf560#t^ zfF|iSl!;uE7(g27PB$I9VUZGplI4bj0lZtnfz1=cyIkcFmcaO-NogqA z7!y}^#=JQ&9lTaO|7{pU55S)Y^P_GhMf_HVs*OvRIC=BwKhum8JPsT>C`|mylyZ_YPXlhpB%>| z?hRSg19$d=@v4JKz~|m)-buqo68{mblQQi$JutdM6Glxv9AiNpWN?VgLU&}G-RVRV zCUOJd--B+E@^v90EG5|wOs{V8BLbAfIBM$Akn)8B>;PvH>?JmL*X;CP2g zVR(bC6yo)8>!G9j09)h z4Yk+&7z{AcXINLxQ0cZ-tMbZOQMH&~7!*0==B>56q7sC)FutB6cqD^E(YXox4iwHZ z`Xx?)Zs$CsDboQR*-=b~@NG`us|ap`VMr6;%TOBt#(`xQIWa@Xla5h~ijJp^PEem! zG|f!5^-NL^M|=;*8;>`&kHg)!k3-+jAo%%YP~2%6g!fZ1J>vhP6*Z@Gso-Wk;_#h> z9`X49skbqogkN4shd*XP$JBMbwIDwTgWeV0{~hzf{$H?`{}yHWhr=-Q^1?y?za)!J ze81%&18nH6FErk!Q2nNkkiIjlqdI%)H4v`WIBb+P>S=sy-c<-Zd7Z%bkKAW!kE_~Yg_)}-N)CnAX951}P z@_P!8V?Gpo-m31qugp1)Suw0=Gp#$W$y}5SJ2%N$WDXa-=h&u1I^XDMDk5Do-%qH+ z{9$61Pzy_eWwbKPbfa=*{3oAJS?IivM$HX`1CA5pa(6FAjrT47MD5s_t$f(z!75*a6mvyF$+gj$c06I!ya9FS~SdeMqps#w@jZ&YOY zv*>#jq*!UCTvV^@^q^{0wR{z|@KshzzWAB;*gf($>Hc)LUf=dIXJjxlo6Tf9olIq9 zAVBi}>I=_+90cLD+vT>(u%4<+xy>d(sp zIKbiMc)qy(mFWls>(SjQRstc{^`_xZtMluk;5x|bBd1zTH?%kpG`toY_Q{ja?G__G zjgiFvu!ZPWc6S_lw-*TaP0fF6W1ruir3?231n_M&Lcp-j61rIPa;emsG4WF@vj_~M z_x+rBT;=VN)cl$gHfzTo1*-zx8GZCLp1DOwhC&$QnF$x_(R2=gE{_F9L%l4-zv6?ZW{4 zTA`yDot*ZJ`oVrrsMAI9dFfIA+C6vc_x2$~?{_fZH_pe0_`JpUM3LO!x9kT5+(1?F zT_G+-%+EWi+EeSd9k@~2D|veewtoosp|{d;ndnp0pP(}sP>>Upc72Cnef#?C>|%Sf zwzRXQd|sjc5%IukQc@|UijIMX{*S?_8FQf1YjKuvRV^hMq+4IW&{|YfN=!mVIlvg! zm?~8-5~z)uw_Ku9$Om=YiruiKOy0&rZp6D>t<`r4!@%i!#O@G6W?QBkf|A(AmC+18 z7o7TrVbEbJwL(uyFLC^>mq5~vr+DTZBa}(5#pX)6spg91Pc|@00oX<+E zRG=&t!<~FkZh#vcOw-y*ztm8_sFP&c>ZN)VEbdZUL;)IG5kEezke?}sqNoKY1K8#Zm=aL~nCP)t2TKC6=8uI+LP_vp144CU6K zXSf^@fm1x!jl+HVx}kA%PY8!A)o9sCVd-$8B_Hu@gFGYp>cJ&sOdw0iD3Pw*;LRJB z)$Dv5FUS~6HQF~6Ypb2P6oJ@u(=1m~+7TNv%U_|DX@2XxCWK}IAJ;mR;7C z;af}L!95}ls--aM1B78^H@Wmlb#5F2MUxD?g`vD(w0#aYKQz|&RJ0c~k9qz9Q?jNq za33W0W9P86dNb0(N-Q$xGu#48sb>LmVbs&CK z@Cdu>gbS4CLTO*h=~J*d`z0sVxy0I#=LiW;<6tMA`MB6ys2rq4qnV%d$&koRKm(%0 zXS{9Rmfr43`EFZ@lB1k6bw{fXy8(1o0n_Qgd*;71sw*sVP-FF} z(&uX}a&l*w_qnAbsLNzvTKo;}Yeg4Gw*8r@fxPp(@nss11wlGx4OSukkEE>R3*aFZ zuor#(m3HDXbiC~$;cB6ZoU`0J*|1SB+{AT8hiKn4UpK?GZ9K;8^Sk@3MZxA)cX>6C zVr!Aupl506Cz-(bkj1tIawrJN3cHu!%p82N^3n4;ZZ4nS|B4D>UR`f5Ln@SKI>+O% z%XW;#*l2OZW!zi0*LOQbB5Q8z9A``o^~@L{5H487)`iP=a@u ztcf<|Fl20V*l07xDU>A!d71>a%RES z_$gH@jR9^+)tW1EdGsEW>jFHB0)aRu^x;Y4+`ev|5jJ-$g09#STY&3I$cR_>7;!GU zOEYY{RyLezQbfBBO=j zREL>#qg?H*Enf@EsFNR%7cW3<-RYRVP`7(>cg)vHnEp{ckh+!`#HK2UT?UAYi$;$d zhI8cp7>BuXQFO9sIMIGm>?J2OXH)eG2Wt}l#{LfKqcaO9uO5*l2Uu(m%z|nEE(NHl z;#I7MsHTjF9@1H=#lm@b7m%dj;yrnCWS-mG;HwE zE72V@NHG0piUB2Sz?p2+?k(B9#zsrSlbvJjb)q%E#1Rw$Jz1I^WiuK~HgNEVm2I_Y zj{`SN-n>Gas7`Mtb<_#!@mFaWV@@CG02>kB=5)GVkOl7IV7jcnCpZf4B7<2sa_O&9 zFNPcgo&m#tF0%Eh6scfT+^j(2^k7nVJSEH|e{b^rDv7yh3!G9d#_b@9>3emlUyH2& z(L>N{TX6B8Sq!3E2_^Q&gS*&%LEYzxpQ(x}J^W5UMXm`;Ln0TGCG{oR7V!3+ul)lF@|ZG#!>A+Onp!i2zR zkUhiJ`$@nVOq$TtE-cb|VH|byt7n|;VY%G6R+L?3jv!xXfar5j@_=vXL#ZdSw$NMy zuF)>wMV|k7N9@JR^ra`*5e&v2e!X8PUt~uH6@5)`|Em!%DfAoJiTMkx^XNXiA1(d& z7ubpEyA$f=X?oV#EaE%X7goc|m9m7zJ|jHGBWho2$u9{DXv8#i4jDg|=QI;@h4r=t zbA>o)tUC0_;OIY9z%0E-e;j*lGQZ#Jj+(Z$GUW1t5XoOs{ou`f;Yp=w(>oa9j1)

Gdo|8DU>k?>U1R4lVX2A-Vk9 z>kPAl$^n0{7TKg*4HXwrSd1!W(ZhuCLnxa3)0OVDbbaA^s=!v^v#2|<;p7c9T-PZO z2d?nXbFD8XcKjezHB!IUXGw+{uH<$D5hojJ+t7(pO%QHG!%fzGxDgFCUQ%r!>uEaM z@rb5M&$oA{v<;~(dZNWs$U7jKoBmV69bqDGQDg2O3ri2j<@MY;GbWQZhwiO^(Xs5v z4)w?nd6|4!v3gUZ(~|C`#@mvjwZ`4Ku-p>v#l|g_hdCVZG~{Vr$dc|U#@>RA0pcT# zBKv!sW}lnydVAIdsN^jlpV+T(0^sd?&AJEOwap5Z{BZ?XJfXt)Lcrux)C@L*&dC49%s~3m zzb(k<-3cd@6OVMN|F{fSy2|*6le^Za5K&&;JDqtXeMSk>ZiIAUl)+TLNvYGSe%;bF za}}mlGlDXQr7UdG0*aLU;9s4X!e(id!}-=2Ki^GA#uUb<#wXR2j&mDHkIN;!IhQ05 zrS-TCDwHt{A|2sLl9G6thB|FH0bM;PRa)w(e#zcgll|mokg$x>1}E!L2^t)ir5B7# zjm>|4D5(8v)o~lX#4=IF6E8;Af8P~0omR4}`NpzV3@2L~%An9k$znaHIyPSRP;j3$ zuiBg@Tv@4OH+U^{%sQtgxV;@mO9ZOgrCV06Xj`7eYezPWoWK%J6tqH~6}8%JVZ z5vOqPK`dD0{OfnJJN3-Go=~E$_kMC zZn4mR&rj^f4`9jRvj@=TF2Ev?+H^#_l|`q893s&tp@n0hfN0>-Q7Ce%C zx?2IlR+~}NXwolB*V`kt=me`mkf=?as;S$>-JmXYM^C5>oKouASK3$Z+x@dVrA~{{ zD*(${#}5q4mvh#g_xO4#=J>jkHtsPze=nL2-Ca0AJoTDkVXL9-xpw~{}+q+o% z75v}l9$Mbz!FYWsSh20IO^HJ$h;2N(y|}y;ZKsAum{xv6HilPKXEzTI{SLp?`(Z4p zGVRpQ=JiZ(TNwWh$|Lx@yC&awT7sKdAby&>b(C9|X3a0Smz`ln>|I z`)zlx(q8(__YH7HgyzYZ3*TG%UVBF`|6P3t)&`+(r03fy(c2vyZ^u3V*y_62!+ypCGPx0#q zemBT0Jjgo?Tp3)YV4|dh_!IY^x23h9?d@PfFOl71C8I70fNmwUk`Vp*fwR=+4Z%I) zU%lW3X|6LS?0h#ElKf#T7>1Vsf@hy!e|r5}+>^1-76;UZYNKu|FlMu%Mh_y52h;ZS z_PK|`6D3K-c|~$5dP|p`alVkhQtUh3d*4W6FiLt*T?fqeF7MbPNGiug9igxY)e>;V zPRH<$SUf_zB&jX9yQ6#PU?Dq$?V?mLH;3}wb1poWr!UmZxXfgyKToGN_XqBt>yWPZ zHIKew?AawhVdWZ4p^8FgiNg?gmn6F$a~vX8MIs2{WdtKY&q zCGM6=tTKa@sGahhXOKG@c4cn!WsJN+KL}q@@ubFkT5cusbnd~w99@F!aYn>~(}tAq zEf}Lc>6EY4wu`um-#ackE7+I7r_1ho?v}jtID0=oVVD`54yV2|{$!Bsrx60JBE}JV z52TR1>PB1$V^) zaQ>t`W=p9pP;ErtD_#_J-dVnScn0&z?IN)R>M}q<4LBO)%#pnXD;U()=|MutLG_~g zl68@Fg)!1x2xp}enMTPvsKr`1Gx%qyN~onLyN3*r|=}ybZRq4!J^ot>>0i#&L9w04)N6+go(*A~-jnW&^@P$aJSHl)x zd46dLB8~KYIXmtL`L|HX9od(>OPu9E;H|x!MB)gyTh3g7`mLo+bs5TapUz!;O@tRJ zPM+QWM(3K=d{pKL=n3Y!IQ~-u^3bads=8eGja3^WZT=_FsV&Yfm_Cu$f!iBBa!ln8 z+8fSom}xoQvz;s8)Bk-Ksv{g1h-zon7mj{6PSEeJFd%1QoZvYcOd$9+$k2ChQ z_(W8o;4QQ)32qPJja(C^vu|ZkTcPxcv)BcvEI1!~%zCEMQYgnA+4;fo z9w1qOq?I`Dh&@NgRuI;PatQQYphh$-bjP#>9X8gJL2ZCZP{udhy`5iCB3EfSNPPzSMQKy?fl)(m z$sI*Hc+0>WoYGt&W+3^wv`sbEZ!SfSkUgeX9@!(~Ut{c zDmGuPXjFbf&s2xy%GMTl&D^Ep)7vrjZS1=D=2RxM_C;t6^zIzC9Up+Td%Mde&Gw!x z33L-cmTTz6MHH0Tilj(~Hq`es&ues2oaVb#l9yQw`}cpNT@yozJhgHXa-7@in?^bN zM@D3$IOWyUh#st2_NN$8sZ^6Tbi6$r0DOb-Cd}!dPpmUAsu^~7Xa+9MVmNw8a4r5ytYDuX9oj)Z(pN$9jXSXfr-KZ zH5om+-?0VL?;*t3siNC%9;c7<#ovP^0|p&ollftO228kvMSo|*m>VKh7Wer&nHtj2 zE|$;NT}spMF|mVIan%Cnm2n?|k%k;4wMC^EB^a+d=rihX zjImks++0(fhM7!f(~LxE97;-P(2h{bn5Rt$3q>KQSbOS?fu_n5CEI_Eb;=JtZbHk| zzM1r&d+#$ycpk=N>`riMMRYnWx8|dgt4n95qta( zqqS%Eb*MY<&nQzKML}nOngaM-^kigwbcZ0+P}%>ySoL~%d2o5*6Y$U44xll^&{}uH zTcur^;3amilyOSZK##^G(z}nJPcq#s0p0I34TgqNtU^uXtsdwNJ|dSooe~B&D_$ zE0!f`{Xtnc!n6gky7rW>z!C9H$Omi;X(L9s1LD zq|)}r2&_{X#ydLemONZ*UbhTupLvw#>1$Z&0o?xO&98A|8SAe2sJ zf803|RZ`HUgIOe#V!r)~Kj{E3m%x!*Y&x(Vd=9-WqJnb?%hsg1TNeHnrsBeiK>6}gO;?*{q7`q3N~{K0a;VHp`Stv2tT5@`wdFO^#| zDt~3p(vpl$@Q*4^(c)#y$eKE{R@qJ4JqNa1HvRyfIzvff(_--+k`OExzlYno^FwLm z`J4pZAggB~U##IMGS9(+1&uT)l}lR)$tKpD>xj+wG<>}Dps8VQDc)|f@^*zoihs}R zoWUfvTmv)M7nSGA(WA9jj+6{z-k|11*Tp*BN!UdDY~+ygW4jZ3xnmBy_rnrg`*_vw zu~D-;{5+rYx2q2}%z@j&VO|85&(DkHN}gg~aRSeFNk ze8$f$1uqNh*zP5c7<~x~YXc|<0*!!bYRQzcrLh{iwPleGz#IC|Gt-Y+%5hN(DZ5Xeijd8C))}SOlIZ z?I7W>PM?|25BDX=`Cv&&4RCLLxF7?!&)(ZRspV9ePxomuISr#5_s4VLR!LXadj!3OY{PnH>0#($ z>3zvy(}qokZkpwUJas;0#Pfn}Wn@)@{gNwsGlsrWPr^H_3(JZeO0a6jI*_GO*9b@_ zP-Tvy2<3wrGsB=DfsAA-27$IXysrr9gF8?TGz!Yb34R&X*J(vo1__{M8b?K>hk zg`QTj$z+RUL)V>an|RBX%3*4P?wVK6z}#4FWW;#diVMTt{WLW~Q*YXsxqSRMg3PH# z6DQiny<?MS0)Atn_*Wt$QFn`JwyD#VGbd&$eRh_4zDDP)y?*G@^sk2L>FM3v zps@jl%+sPy@ZY&62_gf{F{g8IFrJ7QupC~vN-^+fY?NMiF6zhw$-m2^J&M<3V>7xM zxUCiC42)2A3#7dD^H|+@ zI)Uo3p`o49xEIjV9%Fbh{OpCQ`?9&l?0r3C<&#`s3RLHztIEJtuv(X4pi_mZC=5_3 z+a-pcD;LSuU41-g`VEt%)l^q#I$3ykr2E*fzBhcNR#l$ibN=97FnHtY<%Nwkz70ry zv&p}6>HhVNv-B}i6nU5$8|QS^c}a0~G$)Vk5^ca&94TM;e#cbV;C?Odax#MSo=ZTpv4`{CUFK$3TiEGoetf7@O+$#In?Appv{tv9TWJ&K--S`7Yy?m+GnZ+f zHKCu5W=)T;l)`n2iF&?URo3(vs_f6jwhgVoSI}u~1~48j(4PO%s#&WynT(|l{)W}L zdf3{!iuN7z+IP0tIX9DSyfo3(&HbCPc(P~?4Vh!Q_c?Sgo~xbd_xn)K|C85yiNA{^ z=nLF%dg5 zGS51D{m3{c^F-#_>s*sdw1|C=Phgy_YWd@%@2>w9^iU3aEP9BVHAY7}*_CN*i;0eg zZp3I-n2*#KC=3B1T%UMwq^J(oVT1AXF8DGK6oi-RmHjYbW&E-R_u>Kx{l+jhv^p*u z76zl!5A#9-iXX9@m=bG?d04^KMUX?ce}t(h&Yw0zbo~SOac=j0R|}l>nGOb4?ZXme zHAHDjfZ^P3;hdVt6J~feV}ac%K5(96xK&9ZeKuBLW5h@oZUt2^DXdI5O@)lVu^vsz zV+7E0qSCgJDA@3W*;tr_N6LQ0xM zv3*fTm19;Rr<5WSpAg49`52CyfuFs~<)Rn9w=Z9@P-nUII+!lP72Y7}Mk+QKX1nN;Xj78OCW!*pNv?sWra_!4$zXR%!bbBPKO7e!n z9@8NM#JDnI0a784Vj&?k)g<01mqJlN0K<%&X5lnLLpuPqFzDdCnXjaEat9*+3@_O{ zRvR=N`}{F3x3|HG+;H9Ak4uO#)cY_oRn=5$Xlvd6tzfdZlkPqX)pg?C=J0&H%2cPh z&1^fXCkHH{FF8nLq>4^>ZN+l(} z$L=6z)J#f&!cf_~$O16zTsd~3@PUGZ;u5vQjHN^Rq8s4)`cSZ*hN_?2g z4r#7f;!}*rAuj6_7a5PxJQ*#IwB*ByIN3pl-JPdlulCi$@3u)wj3=?ii-UUz;U`|c z-|^S`Cr%ZivPMN}g{fa5si}I*n&f4A4X2E84eEdXdM+d*5oVvyn;DQ%q8fzt(<3k2 z2V`i5$%Wk&{q&NCVNjQNVI}3%fr5ZKN>E4FK|w`{57p*Lzt}~b{A4>rMaPBd^vck9 zyTqsUz5b-8veK3S=$=uQy|bs&IKTv1fl5qFKFEWr(A z^TRiKzXdkWPL`|`<;z2f)mQ9YkV(YwAK`OfJo6RZUv3sL=-aK9b7K}TgBAH-<5@oU z@zm@+ByvggZ_?gSG()dw#Mu^R7wT^g&wnHO2i@M*4^Ter4_7&#bQDgimnEq1{~g6nd9sE8HEvt=`HSW*q!-D zUN0}0f~i_J@+S;ia?fhNK6YLJ}d2K8+47R9NGL6L2(fa-K1)$43Wu^$J4stDYLtc4N4j*XBbq ztLSo3{M-Key`#P0W}Bt!8=k10z)UvEIVZv?@}N9GW&c{>a_{|LH;({Ehw4xH{oZKO zz~Uf@sPB?!vAtvN1{l*rrbb-4g9T?_YKxA;fE=1RQ z`nEqbWoov|4Yu4{kG*d>*Gpp#e0qK%u;}xWaVe|=r3zYT&b?}~qjXsblFTEy619H^giyS4v(W!tQ-{bcvbM!azkW?#Bp)(Hxe zE%9W((5LN@>Bl+nwo*boBCXBBtehxj6lhF{eQLO$8jbm-nOzt8WNDhR^kyeTx9Et* zssARQ#cJx31xp^IYK6F@NVmm~Ik!R}tiZda80hsR#2SvNg4o=FZYh7Hf=sa3}1w2iW5FZ27469sAYK9sC4F zo@hPQ)?K=vNhs%_{sY^D$4u=;C}M5cLgbiU>hOwZT*SDFJHLD!?_n6>hFXJQr*mfN z>AJYK@w^g+o&5F1hG1Voq`rN+)bV-LjeWgnx#x|0HHcIH`_sA9B;#=3@g70yggy3? zCQoOnj+G(KY7|y%Cs)v6BW(LVqw&+Ed-!(wAj$f>>ts&!@e}zO1QQMkQ~p5RVmsK{ zzH^vbWOR0F;HW!;=?0-ol5qKL;MA{12bwxgO13K#qN*k<2p;3gi}j?C1m~$8#%QXe zh;z>r(`$#1u`|3H!V|m%g++=wulRJ!aXy;3~U3WjV=zaGS_(J0z6d-1O z2~2Fc+-ZMKh_|qEp*ea(afiQ4Ku5gQW@H-^G}5K3FNm&Oc%f|ndGH=@k|RB3Zh*M7 zHyPa$6+7p*0U3fe@qB1MJ>`hl&U%n?p;=58kR-)OfLjh13wPLuPm8Qum6?D)h4n`Ni7AG5ekJ z^cM0~b`|pEX6r=(i!UlA8jBOb$51Kq*)DPQlc%#F^NzSP z;LQRH=N**%WQXpLaXPK<4T#VAgWYm^PFK~kr3evlP$KPlpWSkmO6+V@4X;gz5s(Ec zy3?$+YfH)0*pX-6+@zh{3U}4E#hH=j*O%}SkrILa7oR#Mtn}@!z{psvmv@ry>FDI_ z3T3W#ZhRV7_^0sqI>8mVpkRWtuQi=S=_TIXgb9#Gb0>%qV#=Rc{JvGLatbCw86Yx0 zAixYsJ9vJ+iaxoCdd)7&W!nnj7(2{2NWy>WY{^YGiNL&i#o3xhS5-|dQNoW_C}h(u zbM6wFfZnpddgbYS>Crbi^hcxa!0DJf^{*YRo#3}f!QA^+yO2a0-wvy6J=XAFh1S>4 zY;mIKmD8MEM}n^~k+-~1vnv?B{Uon!PD8#T_?mVpY3U+tiB}P;@F)0+ncu&{2f%p* zvMYqUI`wazJxN&W&>G79pwiZ6;|xT@!zCcN&vW|l&zaF0LB)!9@pzIjq&lLSqq0mA z0aLgNo#H$li+z3X(VusS+Q&bQ4;Fo2UJIw<`Psp5zRX%X$IB76@A2qhE#kxyhF|;| z3z(iV8P+FXdilxON9x~MvpIwJdj%$HLf?=C^^cw>q+G3g#zl|#hhRsbq4#(-$vRXp zNh*)17k?pZqm(0R^-f*=q8Q(toVFSSBdBHvjcyBW- znHc*{5#bOZo1v*nCu2R@`S+RWnJgz`h1EFdIXJYEl8DVTw^Ve81dZG0w>2A-sdS<>oF(YP3vL_1pAzGE-pK1Y>yD0PkvIDbdNUSYw)#TGE} z%J?f{+Mqo$4ykfwGSG8$i5T2EI>N1zVzIZC)oZfdEb;q{w#J@BTr=u(Ov-hFfNG~w zj<)TYe3(Ra0!kC&2^$(jVX{`W&+tlpv+AmFm9(B{xJakg+)&U?pPyY_msj1Zj7?H% z)b|#Ts&A?E_P#50fo9O4PG99#aI8>T*^fOvOS5nwb2XJLYpam9ut_|{(Zo4jUshRC z+NdrmtTfM53ffCcySXmu%M2A-ODAW^5h$J97z|}@)ht^wY^W`*%&FXnCtX-a z5UW?PD6z7xD%+fwTlvvoWnpb@+}#q)^elu;bQjnFc^oGMWrRSZnPA#i3=S@c|%TpDTQ=FiAAN-@lJk1 ztROM(`?|Hx)uA+-F8QZY(-Jc)14C(g`l@D4TA)H>;}pV%*3#i*><`Ve)f52>&Gc9< zMan3%Lm@k@c+J9IB^nwvWFh?rY3oaN9gFouc(Jlb_^jxR@TW8oU(%YVQ6%5+`)(bB ze#{|+@~@<>B$5y7(YM0rF7a0&XOQ^LS}(NJ5OA-T72{oe`fEO$N4Tp&^q=wd(bX{K ztAq2g`8oB{p{>(#%=+~20o&nz-}csfb%}f-)YT#S&-e=T_RM|?c)0yVqTu_x%gh^A zr@0ftR_!wkeQp4>Mn{X%2lP&%|1tN-@X2XK7d{4woeJbB``nwe_X`6nk9gSEm9riE zu}`@73&I9RZtlM;EMfmwVTmRYy(SSWGrcwu(XYQIw5)8}ME|P|Eff8Jbp0p%pFL`s z82%IZUkz-T82<(Shk-2v11tOg-NBZPh5o-d*h1@R4$ORYK9P+j{nWkj=F#La)a2Rg zml4|+jLLi#v!bp6BTFJ@$EYFCA;korg*9UvQ~$#!aq`VSH#C6*NXjRH2$+s@NXp}b zMbnCMsP|X$(c^{aX$C+v(;x10U0=bXozQdmdugc)UYs&CJ*KaA+il7J`AKZ45AM|71t`pRpzj^f|$|IGQfL*bWBobOb^KUn^A^FK%} zP+bp_t^NOU{FCVa>mb&{*=Ys)m%4CD8b>HW9 z+*};!taN$5w964w7=th(#ENbeXv;GLJEj-nWhmnCg_g+3IIqD*D)I z8@alb5bqnVJIdTT3VC7MgeZmz2nJDI`Ds$hVE}rn@M`2ZNt>p@bo^W>o;Q-x5Rqls z$(FyM${^M%YdP;rKI#%Yd>Z8In@ZK`#mS{cOKzQ^ds|IKL%~Y5)d{pD1}ihI#&Y!^ z30-x04K1Z&>S0M)8L7}Ei+P5bQmO)hZFU9y`3A)B&t3hlT(zYcdGR%lUx0Ds0R1jN z?&FH#`z}2$#Uz2bUu>SE2##GoF;|=1z|m@@qQdjZFi zPNmcLp&wo)HRg1(xeZS0U2;ZDnjd8` zAV;bg+W6}|@h z$knAHAgGCuXIgVPSzVpB1q<{M#8rYbF|QizSWu?lA6RM2i+2z(RQz7FbmFj%y9&d-9A=X@`z zKuR#!tK>f`=Cx%TgLz^9fnaj*1~0hXNxbpLI#fhFd7IAjThf>*b**}J6MLRu;K`)2 z@XRhzHaXmknLnRZ2%`2F%CVTAT@6K~*%*p_%os_IesvgAz@o{Cf3V#ADt{X|M?(WC zwJ#OniK5hKoRtE`OCG5cxgU`gYUSPU!W}aUxm2_I24O5V$r1%dxmg!4PWMw-bNv)# z>An@@QRzgkXDXFCti!o9#v|S3 z7>{(lN!j~?uEjk~0tk)Cra`@*pzR8`!59uEJ+3k5{>)&T#@Hz0d*DqUf$^ zQ`!kih@y4)Hmurh>Xa0r7j5J5J(;9!k2r8`T7x?^6s3Yo<{JfPgj#U}Ru{PIu??BD zi9#w4)KD5fsJAc8SIYJ#)jO8DGv~T&?0iAj&yL{WAl;&D@olhIH38m%Z#&`!dJ0(* zB{3{QtAEm7{~%8cnqIIX)y6;kNbzf+iO18gJ&uVWO%f+Ch9<^FWP})nlM;arNZ^5_ z4L)0>(lB?EA;ei@<`P206c3W?MLarklKh>$M6)q=BVXgwFuAz9bgWVAg`G$z=#G|H zM#RvpgpeV4m9O2$(Og8711XLXQbHw{xNAhuMxWx#W@$l1sBl5H?Hu@-;?Vq-C`_%l z?l9U%q;t7t&Y;K{Y92GGjP9%vOk^zxqc2v(3(3?khNCCMnJzeoOrcK1g2cz-OZj(P zhrA0OIL+|CAxR#A^PWsI^DoO6)uzxYG1pUztBy@l;6XUgte_cmv&`~_#{D$wH4r=| zQ~s%DGsB;3tOjmN9a=!BfPbanj3HrVNB$$sI$}Xxfih*)A ztwA``r1{;x6Oyb|IA>($K5ANw10hFA*p&d*2Qv(kB9M2%dMx_SC=9+g+jKvf`Wtc0 z$aG~3=-2OqMD!WQ0u74I25Jq@cj)6PGixkSRAD zC~}~yk?oMT1-c=-A^aZvoc%buLA$;9VpGIg_+)n}UcYDfc~5J=)e7VU!-3qDtI#!U zLa4+T>AM9XV$L|3_&6gdd8=H)5Lqh1?rM=`CU^31p!Z_>mhb@ zz5GB=xuXq$YtFR{5Def-bS|1A^i1A+0qEje4za@(0MWN4YQyM`wzDK^L)bn7G!d;w zR733)^0~lwM*?{J+Zm4eL}J2*hXKc{8LmAxmbBwmC& zFu*Zn+CKMW60HC`hTbP6T7hPy9Z)529vNQ59W9_XU`v<{iZUb84x`r*M#z5g8J96ZL8UnE@2QZ$KX) z4{!lchU9_lfz*oJiljnP&UY+y%%>JL9i=B^CTJ#X#&0G%~kOoBh z-;4MO17MMHkT8hmN#}{@N#==^ejzpUwGwD3Q_Yhqkth)*kdBK|2~r7D@l%OV!Q|6G zQVC5%%$f=OT{owJ+{#mt>=W;k>=PN08W9_j7!l=@<`d_WV@^6SMfUnE3pQdBIXLeF5)Xi-cIGS;Ow3Q$P#n?F3sk1!%O@?PQ>ST zgWEwYK7V4nk_U?ZH63S*xJK#?WV>=Ler*DD@$dOYUV~IVmGN1?b`xjV@zOdGYIxKA z;0(1x?EO3Dh}VDHf$ShCbr34c=AP>2o~|ML_*Wxhw!#zpRbwVUkgkVaJ1Tj@_D%pi zk!%E-8Dc=6XrJo%Bz|?vBKx3-oj^X@6BR&h2lGkLbw`7K_Xb&lQh)>D?I&)tA9iNj z*T8dtfBXOu)rqVqv)fMuYz;xH5@`{LsYBRd%XFdbpa8>X@~?J=!|nEi0GQwkDqtDW zq*H=ynEI+j?nv8h{`?5MXj zZwA|0_c(5KLN7+z5TA9n1G}Hh7WX0io zh3x$HEZV&U_J!oedhOi3R62B93EGMB{MM}sqKn{#eO=I<45AD7&b=LOFnCJ~-U;&T zwSDK8ZulJioM!|-vd0UKN9w+w>hFHfmW3>qTXG;ck| zWcbwrs@Y=ra-egN^^to8fRI24zyrV;(BSWuR>TZg0Eh#A1E2vn0DHhH2)J=vxbQSl zF|q+tF0#@$8hGb~9ii?nFxhWi-`+W{xBPSi?RXI1@viH-eL;O7pUt<6hy@QaD0 zi0XF{0ld0nT>Caa5xdrJ_K~WIkm?VZfIbl(gc^-F`sf050*C^v0+_uLKy*MR03R@h zyowwFum(T?Ud-AArQ!9A01Bl<^!e!+si%Wfn3 zZ9(}U{(VmS@+ob7^TB;a-|hnaf_OIGPWICU|NJHNM1L*VjR^XM@Z8kh_3e}S8mzku zln304_nPdQj(E2T>1J00TMA)Ergn-TfK|mnD5_yp*1ql+V6zTr>R00SCbO62pi~$7za=-vU7%N=> z9RJ@Zb(WYxGXXt-3;z8F+oSz9FDT(RAGl}4?k*@Fv}fe)ke-=0|1MIr18>dgBk%CJ zBkwxHq7z(Cm$b?AWql6ADTH{Fp6Z6>DarX`6Trw>xLm z=3>o2z4H`Cya_C3TT7oQ&UMGR=Mp8^8>E*?_L6JK6#$^b`uzBU@B$p!<`;~!o!NcN z>q2x{A$pz~Rp=-57dwqR`<`D8B>&gsFhs{xB ztrc72J5v+;n^aR1os{qWeNfSa*zVYvCR)k%mcfi!%0M;M*-5g^#O7bIRWeLuJZaAY zxdCLCGW&aU5nZ&Oi*7lrK7#M*H$83x6*ub@_D}uXD3teu)}fAr&^Pw=G*~K>SiASk z7dNY1)`===3I*DQ7Yi_$7VLp4x@$Jm7)kYX;TMq`NYq-GW7r1aW2;+APz&w+@c6ca z;D*n7aH8Nc`)s}BAb=U90>|oi;m6(JlyOl&H2)xP+<o5CzI`CY3rgi=Qx*R`W$cl^$c#C}LiOx4O=NRi}yW$t& zAyp7(IsAzQ56-xGqK7muzlR`hKM=&Yd0+SW1lVvG1GCV6;km~&r{t?>tK(AeQ9PhVHla|F`| z%>nof43s#UI4PMM)AQN@J$3+3R*@Qb$X|fhr{a*6}-5fBkD60 z|0@P7I@c&&-i02R^_}S)NBT|D>FSAQQB}HeRCx36Xe;uyVHXFS75+&g(>UAMy5W_5 zyj$(-fmAu(& z1btvrZ;0GO@hA}EMR`=Gs(MjYJrdrt-oH6q0A5JlGr0J(NTyv*b#A-ulHU17J~yC2mmXbSuS2Qp`c1Ual{*jSHTUs~xE;wN^Sr~pP~X9MAbOg%i;A|x85Sp( zM6GmsBOm5IooM}t&JcXd3VyV-<81$yRrt&i-hZ~AX!n6$;v4p!*)G0mm~9)|w8QfP z<&L>}6}V4h=B>q{diyQGH_kUU52+`5xF&S5hMjw8n5iFYla4J5b@*P&T4YqM=X(oP z^IUEVmdwO}g9dF>ct{iaLI#0!Gv$pTcg@gAxPBa&4M8&8lQB;6q_Km#o$aArixxrh z6uQv8G0;=!c*Z_RD|SA4)WigMbl4MGA6jFq#oPqJGse!X3h{tbnWfoHvya2C0DYlh z#>%hD+=o#c77=6bp!D+N3+Y%kSkw6GsG}i~H5RRw^La{d?EYcs63ylavN@!i)Se6w z>tF|2tJ#uerO+C1OBDsVwQUh_h0;*1i528{Z7Ph(j;{kcQZMQTX=CMI zEJk`l!ELlHlY3CvKATQKSlBH3@e2g` z0KBtvgX9au!$4~QTh_=aE(R_7sfD9EF*}+1=o||r*PVQo9+%3n?U?SmZr=WA`0VYW zuqdp1%W5tMgO71jWe$^KNoW*G!c1vgFh-{NSXe;F!U_2bJNb!4cZOBB;nVlMsLs5I zH@k}5i$2a5Ra~fK3=!)&3pZn_d**_c??KEfl;!h-mWlT2=BX>C$Ng*%?+AA_)W5=K z=TGZ%$InSh%Z{-=ZlB(_XNnbjTqTE5?;%#0%%;uC%H~Q-=U?yd$Hg~WtEwqjRNxbJ z<9dS^uxrxp!L-O3ki4%eyrDTd%S;%bllb!+>cL-22BzvuPjS4JbWTpW6ywCrNlwQ6 z;%0G9G=&b8tgSB?D^G`&tPQk5Kg6uKa!M;{YbskQ&M?2q!j+cb(1QYEiuZQGHK=!- ze(URVN9xjM4=&gvF=)J}l$<(D{|_)#gC{bIRzrAd_osX9x8 zRapFNtPOG3pA>6i!gH0yGxto|Sd+Y5^9N(!cC*)(_1apk%9DUT%<>c;-mX5*cJsME zZEY!Z&F3?=w6s4lXlZGgy!JY;8g21QxlJn7+E8zI%D3eYKJ-RNW^1ZQ3Tnx`;|Ll1 z(ag%`6B8jGVxSCzg%qm0HBw8F9l|Qu4WSK38Ax964b#ATq%5qYiejy;$}4}vfn=ra zLF(yjaAEk(qaA#tm7nJBo?0>Uexw-8FxD_~>ZJGtK$+XyD<^5_dRZ3mXJfu4?7Ca) zxGRp(kfXbwHe&^mP{`2Cd)>G7y9qm4)lXl~km{TNDJRMKQ**ye+-dIku&Nun$YkE8XeTVi zEI?%u&DU^qQFFTPz40=-ZP_b$y{HBEbU^NQ z36@qq2*%aE82@9_T5f90c8Mv;==<)WETry6(eIDv8ve2@85G~TVumn%hx-B1p6dx!=ku9;hD$A6yru$Pk&jS;`D<`w`=6c4O#xA ze)X7Yov1yytmBYT8}AWc5E3>=nIAe`jeCn>|rT_ zv^*jI>_>E84}QizLaVW|kb(H5n7(W})u$hcMp=~1uoIku08AB((_agvX37RTabbp{^EVa+C_KP9L1t5HNBj0aVe&(T;~^2| zyI1>F!CMh9BcKYnp(AQ`es_YEN)B&u(7)YLu^9wTCQ6DHH&M>ex$JlfkH7sMhNNXb ztsAP-C-!ybSN71UEuC%8zt|rf_v*W5^j4LZvanZ?v9}oaZh?1KFE~j{sgFA^7v}gZ zXa*Oq7g>-~|GQDGmv~4~6&G)|qA%d4L1Xkn?+0^HD-e zejM7CN{sj}1YZfx0hrk?_|j0Fupw(IL7iSt^%A`FXw$ZrvCSOr~;oE ztWOhrQyCn2c(X);6UKvwG*mPdQ*%EWUf_+5VTCJHwA54xpOU8H-xswZW->w$u?h(9bO zms|T=7B?zns8R2ZiUy1Zjp(T8s>Xi*o~WSyUO6^rad#RfdFo);GJ{1UEoBYo`}fVC zg2735nfIEj!9Xhme5=he;8tstuD+F}ZUVL^^@<|Hj~wOM&?%ar)5)qK=x}Pm26Ovp z^$EnGwZpk+Pehy5fQ8+MqLT#SP^BDIgB*_XO)?y0e` z^3wB~S)5DG&^f(TaU0OL%wcZLqizhxT1B&lUU(RJ*emj^(6)Yfu+~<&I@v2d?}?wS zQ*CB_va(t65qZOIC}P9GOFdgWs+2v|jBgFL)xc>`;?^ZB+VToE{75VC_?Trr!#A~3 zL643?LyIr%Qw~9$!zqi|ZaBBQDDt&)5}ED#7098bTK%W9vQenl9i>nl>r{2Zd}^TO zqjY}dBA5MD@C;hC^z5vRu7HqmeqnwAZFcouz)ilqqoA^|FzPBVdx){b?@Pt)ye3<9 zX=xF|f%)NqdA-W~=wAH(4vgbfK?9XGB-+AEnpa*`^^S|Fnfgy{umvYPPjj0^83x{& z->UJ#!b3Y1e3}aXfilNM$?K^Hw^9IqZKAK3{2#B>=-jUh_;nS9^aNC}_E2O7S`J=b z=2MU-xO)n_sdq+ZU35A#iEV9f4tm*XsayWq@=6kWfZKuxCnjE3Cq1T{bk}cQg}9oHsW$5=Z<0Y5PLY4nyxQqn6Gg)?seGmm9KN@ z_KWtL?vC*9M3%g8T^ue{^Xv|*gkMH56`#+2^R!-!F>^k@_@KQW!bm<8M=4r{54!Tt zqkoPTSIIGq2-ALTkX!5>(aN+83)4EphHLHLrjA}6kYN7%_5btqHj$cc^l$PD2gYl* z%H92yYfYElAZ6Xx7@Ggblb?OL@EO-{6)u_uh+Nh4_*0m;%I8caRe=xT5(0>aJOyoG z7V7wX52n4u-(z2J0od%|Trv?5J0?9*By4cgz=Hg@d5`v*YF<+=?#iA%l z=cwXY7D?wUs@ZIqj{(lOq)$I3)tKe`ElFqc`Rv3~c{yL{(z4;*`=`Iu;^Gft4_I+A z@-zzz>!sHkIJHcDL<@%E5`)+Z+GQw=w6Ul5RuOz`!f;s0m0Y5wdD%5lK7$;u*k{M4 z<^TPK<=*VTwATGyq!3v{K91YBH%~_w17e$9GJ%S;`IC)>Oaho3ae*e zxZFG3@P6x)j|`u`A0rrbL-Qe4@4rSuB__sE>z+bAGG=9j8^aJiXso)35pDfjY$$Ge zsHpEU0JjVjXB3%ws1H$@6OQy-v?h1fR=`N9?zH(imB;TA7(s(!QkVMn4S_T{fXVZ~ zN6#J@&hdLcOpO(rb1TZnYo76LRC+L){*ROuoLn?pPP2TC3HqqhRmch&xw~36H$7ic zIYLvGmQ=c9pNs1j`CBxLhg$BPG=xS{*t+>1m78id=i1_k0N`PMwEJ}5{c672@=De; zCP5N9!L&t^Lz2ii`G{bdlwX$pAz`vn0T>yomGb=?DHOPe{Uu(-#&d>sYW{)T&y!`C)5s8$T|qgdx}TDy{ibFD<=5 zdY?RF9bOKlp21?LKvOitPlmb&n%URay>$g?!Zk|nOc^uH5uERq0_s~JI2JouDcqfm zT%YlETVvUEM5_8@le%0herl|&ZWYQ&cF_NBB zpoN~bQpX(9B=yZOZswZc2hUuEzbrcSU5ToP$Bz1-Gj;FT_{O)*Ud@#3pXc-VQ>L2v znX4=Ac&3zePLksf+?j#0g$h`@EYwrcRruD=?VXWa!p|;55>u{p;Tgt@jxLu7CRwG9 z7aDl6U`~|Hm|kmujk3$@^zcOPHvIEO2H#y7hNtnmS{PgSqWj-%y{*xinC%1Q=j>+5 zHbnD+qEU5}1C&Qpo6iW}8Go$`QuY(vs4xyrmTKSDWp#ugis=v-PjPw)Lc6=WsHj#C zr>Jj82wa&u+V-_j<~U7u=oz}sU_6Q#n9dZ*GY3X^nEkDfe^3_ZU>$GKAIqQPbkrPg zmj;%t4`e^fLt118rINX6sBS+ITP6u|`K_eK2N+D`2wm zWc%OX265}UDJp_kTLi;AA=c_NJw$>w`L8=H^3aat2n=;v@?9ykdPX+aCakh^q!{8; zUHx00Rxpvmt3$@EuI6oBPAZ!uOczKx$~aRhVr5l0J%4zp*+{VXI9TOu^1fMv9#4hV2ZQo@ z5%r0IX|YDa*gxRo+vn2?&w(*y>tTAax0>5VGA&ji!LM>r!yntg!P*Og(O!ZzG| zZ9frnyv!LG6x4ciZ}v6_`woJXpe}PKi7BCaCy;#uw~)GuQzPo&pJ%};gvVDg9_jq9 zlyjmNMQ2TQ9kBHG4~F^k>h5nH8xuv~k1pcT?~N z;H$JkKJO*w>4V83s)eer+kxyXoavoNO=GKz|FU&cb0)!2v8t7GtF}zjilr;Zy}{jc z^Rnp{+u=i~H%s(H$BM~9xQ2Czb-(o*$z!Wkl)p7?`m*un;l2BS{gFtUa6Oy$+PYJe zn6v8A?*TLnmA}<|_Dd#a4HDfk4>|BilxkDzX)~KW`WeX%`E^~2>EY+-a>b%$UY?-6iMAuzfgVi(a0tD2C&aeG2n!J_pm}QrTntp4Z zZ!*m6;od~82{oZEHgK{8$kWeTru(HLP_uPkRJU+@)Xe=gbsN{oUOPnIU|9~@fVEWP zLeDkrh0AJ4(UvPxr109)X@gbb@Iqx_jksTKm+}{NYRN=Gw4gB~By_bw9_nt%_3kxp zbQ5k9yjRc-G^U4mJoanI$lDF|CRL1pb+^{+pkL`6Da0(WPIBvqt}{$GyWy9cu{q^| zVq38e?r6RsIF(O#7r1XZX8dDMD#rDALBDz_4Xl8O1}qQ*VgNa29~maZn(8`ULekf z(sJxFoE|D>R8yYfuo>*xZ85k`b#j+bn{H%lT>QYnL*&$~wzczzH{p*9G%ZKpEyleR z@UYnSvH@}{5(ZWg<x1%MKmQ$xb+w2E{n;HsY z9DR3n(mzUP&JRHPn&t@^+`s8k(_$*7wX!m&LW~2Y z`hflRHn7Q4Q|GCyT7+zr$z7pc*f^PWU;sOQb`mt?O_?Di$1zPk3qh`&Ip|YbzP7xy z`fcJcX|i(CKL_ToJ@TKBQ!A)~iQUq}PX9?2MODY_=F$14(xxrISd;&1)@0TrkJ`Yp z^*Od5r9I-X&>oIi=m-9UwzgG?398!G(7EM>HuL;aOS>W8`SFFtuYl?SKoWD46Sn>L zWhF~hM^o3J<;C@l_VryX&rdL1Uu=J?0w7ddNY7Z=#afhG{=wYEfD z&eo<~H3C+bXXix-=2vGB5A&JydCA}X-MK~P1+-}g)^|~$Q2Tc`^6LNUlG{S)bhU3bAE*&uo>IM8}rY2 z9`*JGF;(pT`azT;^R;*|bn^8rt-(a@zmc^w{rZ>U{I8V#f0Ls#{R{k0a`ay;j12#` z%@kOFF|+(vIl5ND(8uRE?U+Ly(NoylE{p*mUq2Xg>o74@0BD&Wim^WCvJrc2n;DaZ z)n#0sc{-DHe4%)Be#Ku?4)$?xrVd9Y(R7`b)%&QE)Oz-WuU~iGA=C_AEM29PKrk($2L=1@dH5hk;+{Xg{%(b~($lb*^I^|aYCMNbddY%_?+=> zFZMge!Qie48A*|V&RDwkldkBR4qm>ys;5ghOV_A(GiXCrp23uZtk3StPQrP@N`v!5 zhCu~g7`P`7p0{~Z69$(dB*U@U5U#+^*5eXc#>dfbgFm7o;6i%$TwI9vq7Dqaq{e9) zH}%UnO&6o)m8)vk*(iE9y0+dzw{;g07dl=BYrt;khJL^F|B4?MsZevtxCueEal4CT zwF&iAZ~R5Rze%ESj#&pbKB&T<-hFURGB|5_*b&8MdYFRZ15sDaHpZMZVCH~O^YV5s zfEsRCs1!b86vmKlpkrXXhgjooI`)ao(rAg}$e{8Ji0tv`C;^~iW4a%5{`~HsgU#?g zK5r+w?(0hM{MUKXlPBC44e{WRjaS#u^%QV<*>}QiLX=m{y2DErvGw2+-TjxT*As!k4?Cski%yMD5N@=dFayNrf3WtJL3IUP zyC4!EcsLMTg1fsDoP)c&yGw9~gS+b?xVys%8eD@0cXthPnVI{2_1>Dg_s>k#`q91C z?&_}Ey;t?_TF>*~QHCev4cbYA!hja8%aZ%%-#x_qo3RZaf49ACR3_APGv>zkB9UBi zd+<*YT)e(YNF4|VG^{H=uS%M5)p8q7m^_WK-Ir#*)2F`#v>gUqvc00aZmX{R(+uqh zC}ElMN$-+*t=w-M36+>*#WEIcjapx78H()Ogs(+D;rNYgX$icl$2SQtp`}%SJ~d z9q=CTxvo(vB$Mg2?_$L2X9L%#1y38DQ*Ry^79EDgepwYSPX43uIB z<0|F4r|aL$l`_oB+n!N1LAI}DBOSz|9uM^`#v2O9F!6_jGhs+4bgm~BCqv-!RM9gP zyr*$ZO?Q)!TO&JwPE9_-=0#AO6u)z@4AQE2c6hZt5K-6_iEpXHT1Ynxdlc=#X2o%T zxJCPX|2UN6?rzo^HyK%p*0(ovpc7CACfpNT%Lp~hFm|>4`Ii?k;#5-%BRxHU|G3I; z{-;@?R=?q-VJJ-HKWoy;~IGyfVhf%0fPMaBovex^_9S%g@L!u(d9IZ*o zRCA_*5s56siQg3UQM@{#_OpDsLYC>6KEIpGRmbI*bZRcbJr2SrR{8d9PC9>@>cm{9 zt1|Q((JRy=_J8HrpjD=gs;N z`=qru3SAC*Y=0a}z3OW~@vsG*)9H&EUbW2T`7snMv|2 z<@2d7Q|#r=CRt44V$k}U+Z!Om09(X^G@Bm^aupF|nb{l6vZX;BM>v)X)I z;Lq)IBa(4f((`HRH9np8xBCEk@mPlKG()4@bGtdk9T!YuRnN4R_=^4e+q$j!zy{WlAKkBwk&`O$JMy zNp&JQr76I*xJz!!Ub-}5)kw9w!>mag;P6hLVC)#3D=07OEX}Wmxt8OLCzePH=tM5+ zih$s?rE<8{jt32Hc#6f@^oE0Kq%}c@O>-NRQzrxlRVkAQ zmV$+sWZ$oF32ZNZV)26ytDCzhYHQ(toTap>;$sIXdtKogH1)1Ojftxo*Lu+h z4u&WHldr_71s*($m81bi^sbk@sn@@ih(hbRjq?b>Wwpwt^d)f17<%-H`T|L>veIJX zmo+MI7fqWoOcURZW`aOgAy7;qVdicT5Vg?SK?B}3Vnid$3NjOkCf134y)7(~hHJhc z2Zq^!ddU574Q9l?NbSOM$V41GLB}xu(7@N`#iDHa3tBccwrZIi60wvrDoUJ8J#J)vo(A*BD=An>t$o)tMDsD|voYjQE#enub zsrCvWJmlmAgQVMZJJ?^x6Okd2D@~|GJ^mM5et4^tobpAQLs!KBflRXOSv@&CIR{7! z2Ok`K6$buB1kIZDD@m+W8<|>lchL#)Yg}@*iJ5(FqI^Z9fTC!QHh|TfS*j#Mz;Sh< z{3S)(jQdv?(%HN#NmPMwtdmMSm}!K9A*hg6!&6N zc8~otmF^^AiQ~}=gRa9fqHDH4ia-1dd2YbxH|R&}OVv&4Uy6Yj2pb4J9|$(rM%+0? z?XT0&8Pq8_j{=t*M#h!}l#>AE{6>^Hu`0An7~@SKB)H*$^y0=Uk$uALt@?`BS8(A* zfO1lOTMS63v`t8PPhYPH>IUXi4-iv&&^xCAI#ZU)2g(4(l%l|#@_|S|KM;kMwM<+D z#Gb;VkJt-<1>Vxnl!huI)&jbLw=`SIU|kRq&`xukgHl0#8;i1qcBWXo6rh{B1P;{& zp;4}+TB({e0s3Hsfok;idLVNkgSrU_pbliv0IPr`fNC_#HR727ks?0kQySl>0P^wF7pPr@&p>#7glvz%tN`HnChh9MG5|tw|=2m<=cg z{-jB)5>EnvfD|+swcIe;m;D|Sl%iUGxx$9jOU$~GRQf7t+fikA+kG{s8=M4j^31Bj=; z$^gXET}1*mRJS{UzEU7Z`YT4tp7H_i6fZ5%$5Iji=yX?sfCqZ#e82;pb3DM4-Z>rM zN#`sM;!kPQ2d$>Gse}4~;;B48#l=Cjv{&ksJ>UUGAfej!7|>S+#7yVh2;io@f}<3w z9XLpNtO9V;Ifnr9mAAbqg{lYKfqIn#r73NaAVoUoWd@;Kd%v$|IjrbNNUc7_0|H~I^LcB{|x;1qE^u~TZw8M`1RI2+B(jh z+*h}bTl)XlM^vt&)e15UV9Y(u@KzGFu}dA81y2?)MSxv30@0LC3Bj*3yfOuTSgW#b zTroZk+?q? z8tf15IXvY{h&M3+8-R()(3QDo(7FPUOXGb zh0zRX{$fvIL$xB(BxK_V!->Hud3N&sBoZHdk6Q3t){Unor6${yc5PFZ7j1?5M_1mB zZHA7nJ;@4Ay_QNxp()0Sb_QTm6=lWRtRmACSr&{>Pfb_kjSK>UfRPGhIwERv9Qj#H zWOP5d4lsB@`zmvA;`o1Dzf6#hQfJAVQIAINHwU_aT);o73+%uQz;TMvf&p#uBXR2# zOLAcG02bH`Off1;0sIzK+QmaguWZNRiTN8av4#>w%BBhindC&uZ10E&nC0$p(2NW*lgWkk%rAGh34jPd10dLv%Uh@t;Qyz7} z8(&_t4mH(w)3JO&CcOnqQy>Eh@1W~EYVSBeKIJpsj3UTiRKj1bo&-Y>b7CFo*_guz z`4B-|QFU8YToEAn{nn4}nrFr|<&kEFT>Rtc#q{+FZKjp>N>_Y?;u(IXU)-=X30?X0 zI~XDIytM0IP!7t1o%ZA z;)4}c!YXO+5y6#_H9x!JRq08{pK12=zu#hj$3RTv9VtKq(Rx-eI;Osy8^%o7j2!x5 zu$2Y+p)dFboatBK3KGJaa0@{bXWxo>;++{UE_fCHSN3dB;mI|VXH|mJlwFZ8(G+b( zJwv0MK_f1YQ2v}LPChekFwMfrB~FO|f)Tg;lB=*=>J2OY%F!THaZY}%GV&jrlH+L3 z%B&QSE1JA6DetK)l`F1m-KJYc&fPrweO_T+vWYiq3&uXmB9d6A2+zc)Rh)ei);`99 z;S;B7BC7aF5ndb4B~=tBpt@)v+-k^Q$&X`)Oi7<(hfv9$V+YF0o}(LDO>CD;N34l2 zEAD|`IMbvOY^`6ADozi!HnCO1WQ;GVhGmQ{aSu+DoNEb6Q!@BEvu&kATb2Z5iYftt z)WzopmKi=a@-cFGgbEm7b4me*o7ZBU@dcBC`>e9+W(CNon|ae$7z&0sYzDt`L>%v7 zPEa*q?qTdn+Ls2ofLqQAPRr~OXrgJ7X+o^9mHE`Ai;%d0a+E+)AQcdt1X5!Q0_=dc zBdf&g)n-L0O=)K2%*eLI$2s#>cE0fBt(@?r9lLkIy;5DmU-Heq#WnRp*Fx9A1V}s^ z1`3m3C`P_xJi=ZgIbj_!!}dz8UwnCIyd>CMgw(1$6ZOjBIdy${fqCS;B%3vW5=Iw5 z5Qu)9f(XO;!@S@=DqrKpStjA|`hR}=?gF`Tb4lEx-IO_`PLd_uKp;jS7JDm__M!MO zeIC65DauvJlKipsT&%Np4%jLIC`~ax@2iOPb2ddnoHfq|# zHh$XOHhS9AHcTFvzd^UFL8}R#^w((Qj7WqqWROLGCx1^?+wfKDKzE!j;DHy7>fF;8 z?-6h*v1zeMwTTQuCdx+$Kzn33{``?i{vXXsCt2a(Rbr^d@E+o8+!&x|vyEfRVi;~;bogn1FYe~iWw`wu_8gr^ zU{h$gd#d|=Q^<2$D6eg*$FaYs@qy^?!<=8u?NVs>x!`#t`nmIk$AwG2yHolX-?9gv7WO9r#j zlmEgAro!Gulo}%8A#9qmhU#QOqFTkDbVKiyLPP6}c!pmqH4S{*dp!>dc|GshGibdi zSj;_Ue8}=ne`pgN>s;ec%imx3zvOr*A8Tz_cHQ&yw=e*xE6dHJI39Xjqc!7Yq);sz_)a0(AxD&ADzE$xn+69u2DXw*qjS~ z@YL5nY|T92*PE0NN~6>%`qIQv`Hwh(x!`#{gVn6D2-m5RSLqsF&Vwt$WO~c*)?zmI zJIhm+@1*<|Y4kqdwPD8^%&oQeLyT6Yv!`$2Ql`|&pg?_)vJ0z zET%-mNcSsc3`UIdZF($8J%J*&Nni<_vTo?~{7+>YSEva1qKCH4D#&@)FhMw z!V3gy8vPbp2!ebIBN&Kq2=4*48Z;NE8l)O%FM>0TXb0B<AU#rE0xpp^4)wBG#4P@9OG{~$XMQ%Dhn9P$u&0kZ+!gX)X?NOg(2X}oy? z5rc$4U?Hy%KS(!35V8i*hvY&qHqkacHn}!6Hd(&Fp+RG8+CnsgYN1-85Q3Ot4Pkmd z|3&%x$rt+LZ-;lY5fTeQg;)lj1S!HULNCJP!_+_vA?p1{y4fs(e1%8_js=Yc$_B{> zvTpW61|brVFbLeZu4~}Vi)&6m+|88p8}Fp>@Y4a$JK;h8|K3UbX%m*m7wQA_bO}u; z6xfg8^azDU0@?ci=KSx;{}Ec|@0_~k_{B9&Ip6b63JotG@O(JmU+?=#E~oGO(Klg< zwP-l@OsGUB|B?y}Dy)@l%+>DKWd{n{U*8h}CXZteZ{d!eP)cYeGm8;SI6w8B- zKh~WcegDE7b{u^y=NF7!0_w=pm+R-N<%lJ;lwi+9?}m960_b3dami%`0rF{5L8|M? zlq=;H(wiHh=88{M?Y#r!V}Pbb~1_#QgdCf$E)+`r|?` zHTCFV_kM!3~jzQJvVVM zeU_UNeQsB^Ih{YF0p>*{%_CKZSeb92$m#|0CgkN{4Avywct% z{-Gy?oF^lwjuDXRCsCspN@Sw!k+Bw)+LgQZEAIEL=a^6FZNIm-8`++M2Tmse|E|zI zl)!|Tm)dBzbf=-BpH_+T3+cW4fCO!nU$P%E@p0#=&nd=7IS{-_{K%9e`Muvgg-?`V ze{x}-QSaaZ>%HHYEJN5I7K?UdkDfUD;TvX@G=a1c2i*66k2P1l*#z1o7m(L0?5f%7 zQx)GSAr9>%el5}QDQ);p_ZQBa^382i;d&Ip_tQs`3^)UJGk<`=G5wk z%G`%KGd-1tB_#h<`%HItXXNUKEf^CM{2CVLm>V5Un;6=sxUMeFN&d6}0}BOPzCN7w zjv;S6rUTnJLC@3rYttzr`C2C7(Xo8Lt9Bgw0B?rs4&SS2#oo5EzVp%FvOVO16|y;= zpVBf+nUOQ*79yW(9wGSYBi`CjvAb2YBR*BT_18(mz-c*|K`>LEMgmo0qDg}eyGgF= zn4IiB4x@fon@h8`jC!K0LzGO3I-`Ee%7-UzB&SeCBU?NtJKxtfyZ!E?MzGg)B5g2@ z_eVM2NImx4Y0hm}C6fJFDOL^LSZh{wy@hN}v)A%UI|0m{Yk-OT*wpx_Vtlmh)YRy> zVk7ata>~6}VO^E=s#wIXAH}>Ld*!zKnZlW0ETcfNf^5{(4?k1khj3H(Z<6H;O!g)aW+P;4>z zE)EWnIPH=3?K7_BWF+V6L=XBB3HIGZCd$T07FE|)D`1*qg6PMN@QWynm(tfzFw zi~D;TtnFN~6FmXSe8S6gWdq0$FJ85wFmg*}n=>|}TYbH8*?wX|?qy+}QcmH|u*pwN z!AUo3)~b?mW_@)uu$HgOGOa?a*8kr6zgAc8XYc2vWaA3c3uEd&OAd`Y zZk^>%654T|y=p(gXVnX+hSLiP9o%8nzPif_>$qXlhYT1_V=nzdB8-V>>K1;0GsTx@K3SieWL8ffo!>bwwN#_l+3`QmQ4cy!>dRTpO>9~=;F?bJNB zkL)2L<4jfqztnSZd4fERHNd>Rzq5sn2GtwXLj#-rT_@Ey$w}k&SM~edj(%Qbce<{e^+v-LavOQBDh6OK%@-z) zQ{x`Ad#!Q3ae4+9YFQTZ^^V^fNg9-I-I6n-P2^hb^UIXhy*lk|ozI*T+10vY-al;^ zO!nrO`>=&mWHSvK*v>SeQ|2oSkq^zoXn$^$=b1!5-Hd(Q)k}V{&7pmnA$0Zd&`A3+ z>SBnKuFbP*kdSG#p2SxRE~zkd*a(i{sR}T7fGbtoWwtgjGt|;DIsw-8I>Y?SFE6);$P=8j=A`{i^F-lsAgYY+eC@2))p0zoo?$r*u z&y#DfqcJh(XDKxj7iAm3;wuM*##HO@&m0PWuGGe!K z6~&#>N?%>YCv;(XPgKR%bYUCV7~Ezf}9<*S#MW0mtfsbmfIbJ@g;9vA~d6sF8c0#NDb@py?<5_>f zlycx?hR6*3^XgRLKz2#uDBpawuePRKO1u@|SATUBmLk1%Go=Cp1Uqiiq|HEJ+J`nRTozm>OR^sZ=XVI7+hbHEnok^vcLRv z!{$n#R^>EQoQxAIpP!qX>ez_AP*pam$dr+uk7c^QpI60eeRXx^jAuSE7ALU{*fBA= zG!_zOVkORIV?FOGcE3@ba7IMDqV+g!lbqw0^D&uQ5@-pv$J77~9Wb?Ldzz>+?vi*c z&k}~TU+r&8FJz`JQiV;B`o*h_3Br_85X~@X(^T>Re)F-HU#|o*lwCyFw3D>GwY*2P z^v{}?2)4snYnRvW<*C~$mQT*vcvNZ6YuL$8jQ#%IIB1~PRpVulO3rDmU_R4T!Zs%> zGs5a5z_}Ma`oUL*FIr70A<;Dsz%k_-9?*_!O;5E}Z=U>tDvJb6`y4>X;ukM$T;CX0 z^?m&D@~=R+`uZ_&RMyMuEz?z%{UF9HoJ#Xn5xsOwn`%nYi-#ri9ldHtWlPigtLYqkGH#c*BwvTf2g#$E1wJq&6*__5v>PjhT)@)E|JY%sB0&@SB7jz2x{r zN^)r3q;d`s4kk`^(uACV@eAi0`05+c$AmrVV3n(#xN$lVUe3W zKf6(u^o(e?#;L3yy&a2m=iH5R)z$(`bG)nP<1woIfs@43 zs-C90`r;|-1*(>%XI>V&kDrs}*krTMJ@;v?fS=Wo(t698YfEXX{m6=mPCcK8d!LLs ztvUY#y8T8&N0r@O+L_otPo3yz?|tn0YpF33`LP!KhIf|!9pH+JZQ#{a z>tHlCa~Addm3iuCL+viB857m)M}ahIfZTz6is1d9sEX0iAHK@!f5_e#6Mwv@T|IFt zKLZQL^C41jCd2vKU0yRck(ZUEEs+b8LkPXC4Zb7wl4X^2bQN-028V55x4FS9@s)HH zqu+*xm-kABC#H1$O{2aBB*N!u#5bl^>7EXXA-fLtmb++Bd^VY+l#;{wtC5y#m8Z%u zpQEJn8<6FFB&cJ}Pp9!up=CE0sL*|(K-j_2_+}rq%zI+LxTYO#S?;JhKBa5lp4oUx zyRdQnIA5ivs{s^v$2-u_MN?6&cD3L%vu$r#y2!|HD6!lxsa4EK#d3TOgKI_m%g;cy zSno6bxG+bENdWtL2f8KMHwS~7Oar(mOAm^NbdqM1N?-q!Qy3$5z8oG`1f~vMH24pw z8T)!SN~ftL3`S0<%iw)vkl4d-}n5hOLV_)dDL&5@#QD^UjBFf!uyqP z|MGE%12$bJIt3i@;;&vj1=3>Y^0MDU@)l!rYxvk zebIu8d7o5&SdP}zn3uJ8*8McajeZr+Rd3Pxlwz#CBhE7GPDP(O!y$tv|M$I)@G*X5+rNyS)W3ujetJ1rQHecJznnV!i5Y zwVnB7V@I56rZ&GD(Ue^~Z->HWHq|I~!=LuS4h56UcE1jVmMqt)1@|ZhQwsqq;*hcW zP(&B&yo34W#7R|udi_S!KTZkYuc+K(Zo zN#}`s`H;EsN5XalzKQwoa${%#d|NRcVFD2Y=^FcuzVtk(`Z=TIse*Aq?`MV$jfcL=zLD_~{($(-}{ zb7BoA2ZUMC(Ldw`IYhJKrS1!lPR^vF z!RqLvpq39xePlX@#qTeBJ;aBBgsMs_qT`w`<`Dlim3bSjNzgN468mu~IZ;w~=q?}U zi29LOl+>GfM?p>zRpvq;^MQEF=MjAj(Mn>!si?06Gjr<9Ay(Ai&e*~6E}v;b8Z>R# zDHu6eMHXj>oMVPbLk~1-+=j#ClSVY1WC5l_ngZy-i7Xjvj?0E z_N(Nw3UOY?F`<7ZlkTh*EWa60Oj9a! zEUzxr;*+a>3sJ2T-qAg-^OJ^A8gyIq3SD#k4T`mYLEvC-IjgYs(Y-CZ0}#uCG>KG!w}r|uyBR>exe zCiGopqMLg#XeXQzZ6XRr8*?W~-H(Lv0M){J9OW2;sBy_4awC8Y<%oAM@R5VHQwz+E?Hfa$UMiEFiZYMyz@R3uMekJ4hrV7{UNdnKcR|=%2!00& zRQj(?nqN<@73yk_e_xYKNiDrNR%vG=F7K9G8?^B5&!jH&3OBrzF>I1u7kY8I8?5k7 zpkkPh2hi2(Il2y`pm&N0cPFo#T<;f1-b{7%zy0zI=kk#xn5aNy3^3u2?roPl`RReW zW(M=zY2o78yXvEKHj3GcJUD8f#lu@j`+%+ExB@5C&3wHp_S}&^%8PL4nbHw5O;llM zXxSWZZ5Vs#Nq%gswLT;0l4n!uwX~~mR3iKjr)n@XOu*&5&%u9f(dVvlrE+5|VpprQ zNBi}<8aK&Dm1GCBh~44$Y!6l0Z4?#TrP`C7;Z6Lub-%RhDN=FE@6$Sqw=TczZ*dm* zg4QQ&x^APF%-uYq%Kk*9VyiVe@9DD5&-L{|ewmc~+K00P8Aa|#|7@Ahu9oj}wvC$! zW9c(Mr{BeIQ0zM86V*_`s`>-0Hgu;*we`3uuqhCr|8q)7LbhTP5eHuDL(Z2Zln=MCvooRVW^`NmlJ z!vOzN%2BiEtmd@N-QkV@foILZCwlyx3_t1fS<+>`TySeZ`ip^Qpm#54gLmfYDE^n# zs8;iAIcw1@c;=Px9LC5$q|IowH_BlBseEQln@V4FPH>KH&rVq^mv76rbxJ=y*f}%3 z0j>gH1-5l#CMi(^H-=*#IV;GTnW4G-pyvF&A-f>#wtUVS2$&D3>TvjPXnN5a_ zUYL?hD~1t&(VoJsBqsQH=RB;tz1J*ES|-@Ic-#CAdZqlqrMq+#N3LMiH z__hg-mjt)xvIILLr22J?+BP;S@6h5;(W3aWtU68VH7KmK%NO<$V^FMO^9t9u*4Yy} z{Jo5%Z3*wf#TAKQ-x9DhRundzlypxn5FdR6q2(_y%)@8OvGIvf@1HqXH}&%h6bXo~ zpM!P0Af@(p$J1G_-93c~j>Xv5PaGRY@lz*vKboP6Z43;{xDQD%FjM@z{EXv;ztC0Q zeR>i6-h0?zgo;-5{dNZrsW7#mSMlTq3P zLVCUd!+njHMWhK3(M$ygtY*Bwv2@821UhrRZ$_4KS3N~E)zxuIhSO#2e0jz{pYwis zZ7@EjIpwF18GU2-HO~^7cp|l*W^d9xAsPhFwuL=~8|@Y#xFSA_^?`+^3b^>lI=)B0 zN+Ui!6nJ^zVy@7Z?9S9dh0Lcf33bEfeS_aePHTR8mV(XO9GKK8>@Xm`?@wZ6Nz@81 zHcuTZ$rK{I_3{hJ+r%>=c9EgJw-9C!B1`g#V0|U+Wma1dSkXO2WQ5S!oCNpxZv{Dd zQ8aXT2_f)~Z1 zlmm0rBZRoBikasSJz_?0%7It8SWo-%z#AbEbZ3Cw5pvT_n}9rhBPk6^CA=UYiKE} zEr$DSzK4e@3(R^}`rXG*iK6_*L_&Rd7BmU)ityPQ4DTa$seglFP-W1`;nJUtpdl!{gx% zhKj;oL%>IQ%FbS5WXcf!ISpHTJjve)^*R2>O|HIARI7vrvgtK>6oVrxlNb$U!cG4omyT0&$#hp`_ zX%vOs{yMXh?cpM*N`;TL7SXpP=g%-RFm||x@@-Prw0mKFWxBq(q}ssNW|6D8*}=M^ zvUYBNv58!$S8a7=erD(OKb7V9oAdG?rD8hUP7krcOG;Ns+VcT2TF zl_z2ZPr!5N6xml;pIBA6f7DD`XaBX&)>%E7@gvHzx3;mi5@Wt2IML<1#CG_erO^wA zQQci%(yr~HzB6>Vy8CFO%kAFGS#5hdjjx-1a-7)KLQGz%y{f0EZ>-Wh!6{E5+uV^A z%XxBaUaiqIOBH=ow7R0joIGua+GE3?rK3B*VWX?dxAKK?kYSaNs=~qErk44S%}Ulv z*mwLDotZ8cYMZ7}Nu}E2JROXZg_7#eQITz(-Tp2N?suFMR+ai{c{*(j%a7VYSB=2| zeJw*%NN?`K^ac4}351y+jo!KfHKrajgRarGs!U%_A&<)+ z<3irs@`*O>vW^Vj;}7bPH;w{6y#)ySM^pUoz*?ODg~$2;YyDpWB>#)B2-klF{}Zgm z&hvlN4&nTWa|j8!y1AGe+oK|R<(zdR>t$;`@x0|c__=NYKBvfj6IuV##~2hU!mOkN z_=bf9H&h(vP!;+GsPm0Oq;qmY!_u?RHJgw7Kyy)HZP300s&m?bFK5lI!{JZ4t802i z?xbw+}0A;p7?b)Q`yxJGh*ZWyrh-CWgn*?H@iii#+Or5RNK0R_kdf3bkaxoU`4zSZN^aE=% zprhy|{Y-a$5gsBuZb9v#m)S+d1TXKLtFCU-Z>W^e28A=fvfUu+^bq?fo_FpX)My%3 zbbZcNMj^4PnV#Y|j>candS6BVlODc_{QXV_N#^DADFP>~lh(?X4b-yZws8M9nBJtn zpV*W}g_!9jk|fJ_(fgs&rOgPb56pvOcEXaC2y;TlK6pS(50}))$rxuIV@{u+_*5#U zlcml?f`5IB>(O2q*afDgC!<(zD|O%~Ts1pEy~zfXVK%($H^Bw21XvIrE8W%ZQv%3H z|HFddT@)`51F|B}3CvdBi4DmA@8DZ;WTP(qYK{J*U)faS6<1>?CTn7%HI z^V<1K0nVySfn;RhL%;kqx<3y?YqT z;Z#h+P2~HK9~mBqb3K7F^CpyP*qIWg-%$u_IU^g*P9*fT-p#5Dby0FG?&PcdF)J(U zY8H2(X3FuZzQX?0bb~+kKv&@Nu}%D|Cg&DgIE1Nh7G8dcTQy|Fm|%mOOICh@Sm{(g z8AXehLT5&o;85lcKa0|w5(4Gu*6|EmjpNR1+wASknAF4BMwl@P0R+%!$viTihqiNnHZz?w1scde8u-ZAXpv zO64APE`F_ac5?D!WKchjJLB1(xvowE>rXtU`WI$I3ci9Bb@loK?QO7Y`p_;=)L7+& zYE&|O@xNq9yZHx1QVLgCc-o6_aH#y)pzM9_=8lf;$$up$oMTb*cc46rq%KUKRZL_6 zgGXAr*{wZT?SCjH{s88FD|e@35>f-HGgf-=uNHAM~`<}wg(!kF`5J&hiJ@KS9bOVk1n1Z zT@&Xti;-}_{9`^&S|Pi&F8$@e>WaWE_41<@L#_ma=#C%)i8R4eIB9GKGVxU zrK$!G0zC}H9&Cr8N`Pr+;T5=AAMDz|{d09F&YZD4U_#WeO!6n1nwJO*xC9@?%G+MI zlLjilY=|#pZdEs47xf29RoT&YvtFy(PLlw6*uBpPjQPr8RB_X%qMYS`_bO2k{P;KV zD&#Vslj1IZo!a+=5Q`AYLmCYRG~^MiG8RV1TKxrsA%jzjcogJzJ=5WZklKlj5b zD(VvylQpx8pSE0Wy;I*RP?Mz|nR;wp=9dW!-j+9KLRLi9?$&4qzLnFk5m-&_n!RIP z4#m|3>hnuznY&N?Iv0s9U;T2(j&~c*gs#A*4qg8ow~k-stR!guZP9?koO-dv@r(~V zbhEhWD|7kr-xaNQnSYua*x2*DorD(1&=9! z5sNvlBt&pbhNYQ9nJN2sTxpY!MuPXLu^qHA5V6IuZxY>@zFtb+Ck`eLAHrA65*8cB zvw%EP}aoQ=c@LSq<3S@6fqiJ)Tspmv-NfpO0?i@h}^<9a6k;-!T#|W`D(SOtxPtUM@ zoEsCOJDiH5pz+eSq4MtFan`<7Cka#^R@OPmx9n&^!VVYUu@39u^@w5D)}cGE7Lw$A- z--?k-FXL${6Uu6*KB6owT@1~V&XCK&8l#?R@NrT_YCoUoZVQrV)}n4G_OPxG16mbS zJ5W%NO5)Ly#aRls2N}<)#rL&+HWn624y`g%Th7F>LM@_MLf7!fgwZ?3KmFNsTPxyaksWP8w=2?~wz(U`?{sO?P;bg`vm)U}XWD zL=($T&4WaowB0h3u{#XZD75d)*r(_HuHGPX#^yS=qE2 zX^v(gB*W|%@7n>pLg|E1ba8n`>f94t3we_%pJ4wz>f6EJ*8~Kl2D~&O3$IEW%v5#j5-bb%q0Gg9D~#7FBC86`h$qzAV%)>Mviit&wC2 z()v|E#~m&@jz+d_dvZ2eXDk)BK(*J@vUYl9SIyu+ea%qkngpk)NBS=ZNCWLK&NU*{ zT2HJwjxj=*teU0()~m7y)_MLg1eW}Mx8PsGK~M4-Xmi-T2zOe6diui`8Iy~JiT3%l zt*aHpdk9K@Jp7HQ80S28Oz7#d@X6Ag3)%9vy|rpBsp!%~1=)`>RX|$&M9y6VLcyRA zig8z#RO5<4ip%pO!sv6F4U~Rh-SE-9^S?*GKA}vbYD!T24VRTVOqLm$;ipufmsV?a zQk9U?l5^mNY5b;8N(;KD9LeZhL>5oKqgdN-!zgQlV{-yFciLBY{&8qs8#(Gae}F7r z%Qglx@zpj4e*CmoD9nCS=~q?ek{P91-$H7E@a_CU!HnxVZnQ#Ynmw8EscHO@*d-NX z*)YbhCb^rFWDz#w5^~iUUhw=NP|xiY)2+7HYj?(O)jLW*;=}Th)_K)h4!5QV4BW00 zbbEQ=5`85hmk*Z(2n0fKu=6fBx+*!y`uGZZO8n$sj+Zz8jyH|in3}gFrlHH17O!dy z^Dnrdf3sX=5e_}#loL2)X*H_o+wG@tLN}@ryRi7B7FG^7$0f%`c*WUa$+{T!O!M;P zq=<86it*$?Is9KKJy4f0dph2}-|aJIeAC77+dsS(HJ`v=uo?MgmuX+#jNuoJiHZ9g zS?4|NQ1|%c)H7O)@dqhF4jvf~JzJHYGfr4yO}wF!A&!G>VH+wouIOo3cE6KUC)Q~5but>BU|3u= zC9FUos=$t@fE0?_loud;O&@pRofx^$S|4|56qKob&NjHi={{EU{)2N@q3`{NPmm}* zXjOEOvR)v3e-}H=(dCMPn%(JHs|H(*W-#;8#gbx2GeKz`cv%~A0nXO=fU(0 zg0tSxQQ<`RHuN!eEr;Q2rZNgihF&)PC)TKUbHeu@b^(YDsaWr5R^~fsiSY36CRTrO zN+$exPTu9RAGWLV5!kcu7OZb*L;WpQe2K90^SIEBop+iN+1gAy8k7#Czpau+6ty|9 zxTGYPOvl_w|M)zHI%{;$lo?l1j5(f^Wi5t?{Uc>;I1*ZC*{#DG7LyGVB}N<`7k5sF zrGYJOfPG&*VFI|d7d6$=$l>tggndQmw%2RRn}4B zK9y++x-wpC43~0O+#gSxnCsxZsRHm5b5FVKlCELV@dmaL{?K{|{Ly)C3%}q~3hm=u zj;@Y<^fp|l?wO6TI@b}ONm677VF7mGb#_jixXY(L9396re(F3+<;fJ((KNn18O7+b zNaGm)TS`BYSzM)+IOKTEDnmV$c3iBrJW7CHfQer({T5qK>g{XdYLo#o#Ze#BbEKB_yZC?f$AFWcid} zG^?Ws5vjm0V?l~G);|V=6g@nXhafow`2PkVt7kMa96}c6;Wns0Pitn?C~FjHYAd@% z76?Y=qraQ#;B#dD3DU)1?JW5pguP>oF2T1iy!Y5Mdu-db?b&17wr$(Cwa2z?+n#4^ z+&RfPx&QYj_rA$Wr>d*FI;rjtU2FZIy6tIe;_TWxeBOt@j0KE!S}HEqs+~2X?iqwt zEaJNI$AP0|Voh}K@NWGYlzH@6^bahhxxkzWerACHYr4Lf49t&r=7u^~ayAVCj{qh) z;`$sCjCqGJ6?iGXMs*`UGcB|OdNnp}WI?{Z_~3pjVk9WyOxVx}5K)Rid`Xn3Fas9F z_@V_7p)`hS!}U9A2drp#wheu~dsI>8l+Y-lYWDDUCK)s-XsJfbcq9Ts%o~xE<@k_DJKN}Gg?O~eV3gUvJ#DSo@-O_uw4anWU^b#Q?pn4eUSN0&>2_R8 zXAR64nh#qxDU>iOqLg2iU7=6|hs?%)PMpGU7SigvmeThLy2_+#f4UtxCTG<;=pIEU zhf?B|B}wcKjx^*>95)-k*FPKYqTut**sJm0e2b;h*ZD0@NoM5petSZK)0M+A4t z>d1R2PVS}g{{R8Q(bf5R$@mEPDENp{!yPI&X>F6A$Hk7`kJ!fGCkky6c8YdA3`Gr} zMsCj08HOHZw>oi6J3rbZ8LNE)5Bo4eWXe(o0g^g5l`WL48!Y@dr`9z)p(u_KzTNw6{ z=5a4^0~wG6>V9DzFk>-ABO$3kG-cm1Btn`MY@l30%F7tN(txGjXBJTM8v-#(g#<-LR@5?ph3_go~jqYox&(=%Z`NKU{+q-aTnGd2Dq`8Z5 z*o&b6B-e|bBj>t@QiEa>0(*na{mcGesu$jpd2i+d&*_(wTgH+AWqhCY4WSm0j~kBc zzEH;>9g=YI5y--qUTXL+uzS%~RyUBkf_$)UII%GVb8zV83l64=eh4z?{ zp=Go^=LDpz0FSCqD8w6#I(Xh-Isnd1*RJ{@Gx*!CjRWW_>^6qyUfy3)X)xD*4L1lM zY0SE2$ft21%twT64_;7R(sCo(7mb^h8<|cbx48L{J&i**%;Q#rZc!I>;n85{Ss2>O zPl!%&l{mz0+(~E^a9g3%tsB$nL7pM1ICv!HUe*`lP5<>5$gF-USs3+jww8DLFTW3g zC&k0+Kcu@3tFc)-!G?fPqN1QAyK*@oseDV@ z-{{U3d>5{H-mpq$*amdp00mNnKgDW784_4)vNpsmaq4%3?(vC^9^9|K6W}j^dphV! zqk2711j?rCzlJ#JqqueMX)oUI(KXs>L7e~^hvSMXC?@?p2bZ*>|6 zL-#1$z;yIFztZi5Lr`l8z#74rYBW&R{Mbst>ch2y>W~gl>ro0LAL0d~-ba1z>>W^E zL0*YpsUvfR)~<sQC?|YnLyenTl_8e*6D3d zywJrs_*$@3Pi<^MxcWbXbo;R8w%T8`Kde7iUddkYZhev1`>54|B=sBqX}3zc$-emC zDDG*e%N{4ej@zX25Uh+(9A@9)+|7*P#q|*IRmM?i+#>n}?~6s`&4+EDbCEv_O?*9;|kP0zG!uI!&{r= zk*#;nt_r~OyC4w1KJc0D8vE1`C&k&c74N>GxPv%3u)Hab5P0g0qt+tv1O@=;_(6Yk zRt|CwYxirRe1Iv9S`t@`S{(U)$+M4D`>oii>JDs01m+xdZVH?tjvE02&>p{(*Nn>m zkDE9hYfmUu?ec9)Y}h$ zJpieU7Ilq^pJM#dOB(z1#aQf%*=Y%Pf);Ihql0Oy>=(l;qz?)2iEJuXsq2l288Fp@-A*XfCRVNCWk6*g znAjXxEhyD9M=N1#?nB|uPS95(uvctA@L*nxw8-|;o_l=1aUtDiNJDqv*SF{CBi0z6 z9{eAB(O+=l4c`Km5_46Emb>*a;K-6C=V^k0C_t8;P#=U+{1DAh({ z_aPrKwU9fx%82IZ(Xj<*-qAP9aM99nYF-p>k(`99AhpFWGIG^ehi5@dVbGIH`O4)a|E+6s#d-MVg!%{Lxii3^ zwJzvWf3mUb01^2D_0CP0WMAbamBGL6`5K@w)WxTydb5rj*^IZV1=}21aq5<=kctK6 zbKPXMG1{l!G2x3#7FY5WC_&^Z!W3?^O3DNpf)ox?FkaW=^~%M~Nr%Lsa*k~TnS!Hw zHmRM%2KEp{LvUgYr1jZ!TIo7Vi;HCp*-e}gEM%l%h2SkAx`V%@+)ra>f085?uP63}%`Eq7rPGy_whPz7U$|@{o zuLu^oM9ZTi%ybr(WHy1{&C7x!7HuZR>ynnq)kCadwJlp2UFHYN60Ne1y&hPb7N3-x z#ynQgt2q+h8ce319FHPXkQ--UA3Tq>Duz7f;?)gSBwOW~G+YXFQl66c zMUP||xoWyAoi@>tE9Qj{YX!2IH8Zq7d+5itEZNFMtVK@ii0!-;^ZSPorD#$taYVCu zzan$yhRubiM-{0ACu^J`30fhm|d|%1_?Ae6|XyD89^0uOhnx?WugUYa^@(GrVActtqI_#v3 zyT!HL@KA*b#cGM8L1J&(i1N(5$c1&o@Zo;3;$piz>4~%>U;S82$%DgTAYMvLO(vmN zc}WZ95+%*#@(M}vpt_DtjecGXBCf~pyFO1O{D z^YX_e_dy3AlG^>{q2S122e^IgGMF4B;~H#UAmKFKtI!i3o+FJ*Q^o~#T;Y*@wu7-3 z_i-IEF*pMgNrs@J!Qk3%=2Ot1aE)S=b{&voNc8LvWzZ?8ET3pFs_=sjpNak14!N1p zIb2EX9ObEuy~a@l5j|QSsv#YG!u&z5HceKO{tvWfew(WF$f9GT54LNii{!MMrPQE2 z{_qVqP6k7U#ASL{x>gA-*w|pvV1?4%G_pW-iXvR183oksZJJ}F7&6TeC`>3M86atb zW@wQvEhbaVe*t&osCe?>0lStn`a<~;YPyyODCH-O76NOGdLB_JGi2PALKQ@1l-Tbx z0i41S*>AIEyVskbkY;tB5JxSjM#0bg{}o|LK3nzVz`IDYocI7UZXctnJyGHw}R z`6SUX(s=g3;R~Om$-FzvaU~Xyq%g5$o6Re=4OC8Ew|v=DdXfQRoWr21jvpY=ORcMq zERjD+4J7_ee^VDLFoOwm`d1(AR27NCp&lOZQzljs9DPEJR|;Q2M!#bVS!+d?phUxr<-kO)%JVi~e38~;Z( zO)E6z8{gXS=nCANP322ZF7K&Es(?!nO$?IYp^7Jj0Fk9uLc$ZdB>>F99(=Ir@b&KL z=+^xeN`|`Dui^l;v323x(a|jAC?7}9BY3^=ZB>!Rn9B(s-)>}X$2cd?tC77Ehr zaFl}S62#;qX{3iwd_(Q^D$oghcAThDu9S)z0^^-3idU^71`i;>Rq9w+z2QwrHoU>E z*_qui;;Z#{6?&{$uz+fG{?M2V*{E2@dUOH_r%m0x2?0kjEsnS%JZ}w8q+oohj<`8< z1UiM3#UnFo^+;H!ii$WmF0OFlOt@aRQ{s?cDe||yEH}aU;C4WVXqv>+dY=4O&v-znEF7~|e$;dRN>g46&J<8;oO8P2B z4mHl&;&>SjMVYEhz79$@<$XIrCXtMxr|L@T5qdK*87Z2&YFWj~Oy+t0LV+=*P&+MM z2Jt;S_q$azhix)b`R@E{NC~&KtgLLrdfcq!X6TCX;7Jq^Brb`l1H3z~ZEA+?uMs|= zpxnNW$tVm1*UAsI^p^Dajp=*O+QeSFLGyBe4+_RJ0Ql zc)z2igQJuKvX}+K6@$7mIc!xtIr5Q;H}+~;8JJkLB8AVYAYa@&&l`DQi4dzdO$+yY z2az&q*yKH*A@{5MiTigHiiwTk`_s^q179N=s)lXphMts^q?E(i^$!cIklN&wq$CGx zX1-L}-z{yq7I#4h9kCJAtTdXZ7h))F&e9>OWe(B~Lf-arj%)e19|EYOk5D z;8GK!h!kylWv5q;5~+^F!AdHOAd!g~HFQqZD56CKv!US9B11tdsu+_d9Tgd2L_w^7j+4-i5)?{k=aT z#&`mz0FBd&aYk2OlE=tYt*4O5u4rS>NkB!AZRUtrz{JET$!u;eD1k~=ezMwT*c_yQ zSsC*=>LTs^v|494IPW-3YCig8B^Rrqpk;p6rW#wGdzK%A<|$bvpT&#O6sS5+9rG$% z!3W&e3PWh_L`5M2Q0l2*R3w;CYcc7rH!{w^pOm{eDFt=T+2Zt_I&adz$kkDw?y;Mm z{2YzbcRbF0H`a-!AtDp&Y0vlDaCnmEJ=pX%b`i3Yl{LAwph44KQ_j)Pb4e8Jc@I9D zfy}KZ(^eIz8NlM8WGx*{Qc^M^Eaq6$qrQ-ojNsJ~c0r5ZCfp|{6lr$8NU)+5F_%qX zzuTAWStqIqp)W@@VAacAEtO1zp#&V3d$hZ?bs&G0o#{ z3z$j!w%UvcLa9?PNkF*=EmnR@GxJu)Xw%(vlFwxDEne=lNG6GiTNF%Wxz}ELKc&MUqA$wlaT#fJ#G_AZuAf=I;hU-9j~dSe@Y zEgm)a9e69bR$X8I)BHcMkXg;9enZb+kXS^)bQB#1$#7-I|Rf^U_y1AZOf*W>Kt6^0&?GR_@;lL_d(;LI88oe8& zsv4um#46n2D3klO{PrTDa@w=M6;hl@=lzJ-5}^v(^Z81tPUK4@IFio))kR57vJY7* zOufMqa%Y09!tDT&?IC1dP8vM77|)~#T~gKKnKLqcEFyUslNK${sRzj!9+u=bThl_E znj~RwCwasU*%>|$uG*eB7pdYEycj3>ph}%Y=>WmSN;#^;4}h(r4xjxUxU26QKQQ7m z;eh?rPae3aHxcWc(SdMnj6Sq_;71Te*hmod6?4oURhI%T1#bWt?#$J%pkFqugwMxa z4U9t-^#(bCommK4d?vhtEFvP*#+!c#z`C%hiZ#gf)yK8>_oPayx8;UvQ3*`H-8I+= zW(s@ssEVb>v{}XI-wLZ12%6u9JhZnGD1m$GC^3u*d_FMsI};4DuzJ>q4{lE*O_?B{ zyA38rS))c;y)e0(U;Z_}9ccIo!|1Q}DeXwuKX5VU$1Q*5w$}QmWTVNdGgRMA5B;Pl zB7GQPD$l(pWPUANvU1$icP&?cvNl&Yg zYDTAE6YNs7c>8?|7j8mPFZHGA0;yg7yxzYrxx{F>8u&s~hSZ({jNV1i7D3;{h5;tG*`#JNek_q==)>9V7@EGeNAIO?2Tv&W{y zFn;Y_r$kW#`~dm_a~O5)lCThi^~lsYH~W^E&WEmlAH|4KRCkS#Og};^>X}r% zO>Yq0z{^?nRVugU2)db9UzlQy+KWu{%Ms z`9#A+d4Bpi*g=A_T-JNmY!pe}#+B}pH5_iJ=<7PrO6hK$C_h=f2zQ%cJ1*sOl1*Xe z81}3!ZOfs*6eL+cOrquVcZz0HdUaIf(z}q$jZUn~m+Yu%PWHI^Z`3H<VnKI*(W5>f*r1Nno%@n)RR+u4shP$J#;2nVucjaLX%qmj&UFo zmnp1Ra9vE`f~O-zF23>_sI8I#zBzNrmfEWvhEg`r^Bz(vyO2{&*=u*=W?NIzCcdXx z@m}zcFtjDU=Gg--)N4y-r=o;YyFwN7ZH)DL6trsGGc(Vo-yuzEvvHAQvX95GuWw(o zI?hCod$YLeod;o;!dOsi(mrV;&$^m`dhht9${NZT_p3K-f}bgkf`;PO zw?WCR*M^;Lf@DjB{Tj57B=eXWf>gZ2E@QJm@O$1}n<>1VDyca)2}x3N8Aq&LW#K&1 zu>;?SoFQ_+9$46r=EDs^fj%h<9B7aAzzmyG(=oU3HzNrr08_*uxy}eX&*2)sMzePbS)d2pJVH;qAcJ!qIgWQQY`;y|FG5o=8=17|W!u8~?b%>g{&9y#M&fD6T5OMk>KJnn&V zoe5-dq{WgLi`4_MS?W-OT@2R7yP+pA61rIjt(g+@;oeEqv!Z}G9qq+cAY;!>9m_&% z{v6dp9uz3Sl>~YWPZfMw{Ie37ruc+i-RP4IL&a8~AhtGLcMNe7Ew(nO7AY@EuF#+V zTdjbzXyA=h0t?-4Y1lR>wSj0c;oK7ZNM|5%$06tryPySaDN!jupn+pmZC1->+U*Oz?m4$JjpG;(B2K0)17hqs-V zwAFo-`$q@Q=TL#9GT`jq^C^s`Fee_4vt+Dkg^ht0?zP!-t6+nzeMN30EUB|eX|j08 zqG9zI6B7sdLYv4Y*ON?;?F~$9@Gbm{fm3lL&s7>*L(;VO1g)~mTS%wHQXFO~jGZ@2 z3Hx5=Web-YZ1}nL1J~Z5Xy*WJq#PR-#~^X#3IpT53T1>FcaCZE=Z$8a zc?u^;)t%fqbbj|v+6tJ${YKCBaJH9#6cV!v*<9}~H}vOJw5;A~8sVzfw!%Q?-yR~Y z^WJ1(JY0*Ee(5S>X=q)$z!m$Gq4ni6Guo=Apktw#CV`!aj)QYoa0uKTe``>;!A1br z@f3kn7HD5#4TU=5U9bVLkM^82=yA0|R_%kwL&??Ln23KN9v7#@_5^KlbrJpS{(^jNRWEW0GMsXfb^`*0wVKXe;A-`+;btvz z?c-*gmWrYsZ?iErs!l$mieI#Y;81uWv?O5swSMCqV3-Yae4u&ZjuIm)yXp6 zWRg~00}QFZdwYt8c-4FztvgCo2;K|Xd$FS&BOMf)4S(WNk`7@!z(muoklR$pcM&+X ztgOj_s5$oox9Od3QnijHZyq3N1Ef6@od2{YuBT5RtLrI%T7ckl?c zGNret0vs#Gjk&aoEs7(VhFyM-M^oPHmRoxjyFBd`=fSiM4}00vMy`wX%mE=|#Fk4etPqv1$bw?NxJaTTI8o{kLOnFoxl` zj0z)D5YI8Oobr{tbBwuGnuP!IW&6P39JQjQLa@~~&hd%=cIsK;8hT1;kD-ZSEnS_Z zZEkL|`oW|xN4UqhSe>K~(ZJ$7(q!Wh8vMx4at!rwiZYtgiUsxerI}SN+XU!UF8(Z6yk7^*4 zcCr}`S=9lUSr{mCaK^v04(rNDS-NTtguKDkbr+W}hxb~LIUJYSI7lky|7DSh36U|W zTdo_c>l+ho!cS%mLEX2J>Pqyt;|2d(bYgB~R%Ecy$lzN4XD&*y!HF7TV{Yb}AtI(J z#HB2*tqGk_dOrAvCJG|P(nV6KtYXNRDuBFkYwcR=uz2~*Oi<&>=|!pGF+W6sRi~Bn0^-6ZEeSXp`W>mbquu%V-nWP=pXE8tz69Vvo!r2hA&zNw5@SkHG)!$NU2Dh^!VWO^= z&l1}9sYl~X>jiuL=DXE=o7d*LgM7dO-!KfAOElE#A4k>i9ZTd?-R+d|RJGyCENkrj zY$nd)!VI*)oCOflhO@DAx6$v)pQ*Zx=8&>`>3E#Ivkcp2#Umt zQb3^&r|DlO-`ic!TdvQ~U*D2`zxcUbfRx%%LNB&NKP8JgL!KGg5E1bX>3-vng`L2& z*E~6za{}*AAfzt4YE)juex~ndBJ3RELTFoeCwao(j{ItkbL`!t`xbpAhDwcVZkyTR zvopTx;P!Ka-G+Ywj__UR11tg$ngHDhoY;v|dhZ?Z{DOS9(>Z;Pc@mf$a3(_Y;|_Gj`e)Lf8}SH>@SI&V1Sk1nJ8lf0wIDkQDl z*Lv&M0<>>-tMBjTJwmk7C10o;Cwz6c3q2FXxOAIo5qp7;4^B!tSsf<$jhELW?>Fbi zRDvLFpw)k|z`&y7?3u1ETk0!oy=#W?5WVX6)G041%RbC}lB}AlpA}N)D$C1NYTZs_ z`{xysmBj^}RgFchW&iMXr57pVj*Y6x9;K?9OXikg?Mb7Ajk$Y;G2qj883sB-5GMw=O=x zZqZDwnKX12XpzXswyA=)$;(h1QqK-9mbH^A&n$}Lp2KaD$|U7tZ=kUX*vhGANx5(| zyHs`#$T|}z=Wm;^d}b_QG>}8d*_?M9Ut6*AEhp^7lXJ4VL>BS3=6haOr9ZiFjrTTb z^_}O`EtPrTiPkkK3R-XCdbUVDmxg9!>TEq{xw;MNT5OhJ<==v5g$h?mHWXYnb@^Xf}RfVmJ7$OG^1p8$k=_SNnaJ&Np4k&KyzG`@s7*Zh1_)dhdg|DkZtRxVTaHK_*SH(H>m|4&A)9w4n&8d-+O^75zxWTOCKRtLyFxF&mZ1_`cD-}JE5Uv3b z^eK87qFoqA`Hb+nn~JnkNgMIKh<_*!!MjA}qs`He7wWn*9#mHx7y6bqHfasmK5=kI zp^lPvqb)<-@yVLXNm-hz!naNvlC~1p7qKQk#+1+b1?QVx&P#1<`_@CA==S5P4`vcI zwWDmi9c!+U|FGxh|HUOF!Zg#nUzA5vFi*wVaMjJRE?&-FkUP5UlAj5~J_Khz9oMF+qS${|ZU6J9O5>@a8W)m3EqiY(zu1 z+BcKiF|YICFxcI7_=|Q^tz~ISWUeg7nct+Uz;~K7Fc=n&awJ+n+9GJFY8cX9P{mRe z>r^%|p`q;ko^lN-__PsU;o$kBAhD&7m|w)R_5i~J7bN_&nNuC@!c_#jV!B9HD_Nnw zR1wUytH5e zCFF2%DB3HtCgXAOJVXTr;666%yN0w^swR+Hi8bA~{wrNMD=8F`j~$n6ut>}-4iCvj zOW&3##X3BOTwR-A;;CCGVaBuh$I>_&WAbiqM%0B={C-m2;jFP`PfpT>CJB?MLs_3> zVYT7=C;I)&32Uh}*J4wS&lv2P$Y{1tw;UT(=c$Km0S^Ju$kOy}v$5Mz37eI@!_9L>&vZ8urEp6EG(hl2b{s5%yHJOm+!~STAP&Bq zb!?|fQW(lxk&74|xR1IPD2ZC_OrN@2N|GQ~R#YdD?CG&+9?+R?pyA8V6PMXAKnSjW zv>A)N*siF9DLItIH&j!p!$8x(hj4sAS(HV(}N1+-;Un{ z{1{XgfnE@m{ClQl9~UHvj%U}2SP?3lJzR&$eyb~p&J&pU+sYF9{vZ! zSESnLz#;rcE}<9^oyZrKYBE0xbs)`bmRab2tLlol~KJz1WzoP;$=fie%p0?kR5?(#T$n3zGf`BF^_4EWaOXM z3EC4kG20zY|7&GHrxmBG6&%-(Y*$-BZu8Lij*K>EV<;P8huH`k5zn@8g#Tr0Gy543Za-xalVg0T^ax(F>1&Y|U@$q#0*M+@Vb@|hvGm+bDS zGaIm1d$e=N#~7A)Q3@yBg=ikD6M@b9Fn!buacsgr*=?R3V}oaYNF8C^a$K27Or2kO;&hQT0Ax5*G z=D?!$Q44%!=CuuhZMu9D#5I6x>Jwf=eWK+?;H&b3;EUs{^ke3AM{iD-mK`LPo_Ld@ ztiLv>p`Sxv5=4I3CrgWfN9rCnz55kW5c%_Cwk%+kQ}|n_Zjs*Tk++On>&A z)52kVV0XrK`)v1W_k}*RKej&jZlCYrZ}h*2zYBUHn*=)$5Nwc#gF}PJf^s2x5Ok2J zhLZQuS(Ujdd5OBKrIw8^QcgLY^}D9&E!;-vLB)2-=zojNd}|SUhKEb{K96yA_5${G z_S@Uku94ShKBAEI!OkJV-t`f_0#J|RavdkeP&yN>hF`8oy^Wx~5_L!U26f@+!UKyE zZOLd)k>PsD_V0HQMp_5B$zpC34~ec3TJ`x_4Da*?WfAidxhHu7P#kd<1;XP%OItDb z*eP};Tan&IB+ymPoV{RmEyaZ|^>e-~7R|+peSd*}lV0bt+1WbV#qOrxu)53i;8tfI z=JMxU=%Ki~Q9{B+xYUGFAL5c)lG$c`$bD^(0uv{CBIz-j*ZW)cM{J$a(n*;Y=DOq`SeJtlVS z`IRgFF(zk4=mnEtm*6vZ5DsO#?~VzM@$UmY?gi9i@^6~fw~&N($KgOe&3xwMK`FwaMAYj3y=~HEJeoK~D~(>22rAK{ub7W(SapT`H6f z0gOR#-E`}6>(VKUj^(0%pZEiVXg04X2=K@VWZerS^&z@5g=k@n9e1uFF$Ci53A%xS z6Cv0n`mvzgI>ODqSsS#YFMq3v(2+ACR0Xw19j8$i}Q1fDsG1JXNJ}10=-1N@y z#e1^RD_?H~EiM!%S=tDn+Y225`05)=%^}PSlx6*kDHQ^F9puE+R4Tgh$%)E1G?b$w z`#VCR9IFJh;^VP|&N6yAII(UYYMd&CkRc0Lq}-{LocM&CocIvN$oT~XX{mu<8Vl7J z3Lc=Q5@cQ`q8gN@G?Y<&Xgn9Sc}!iDJUmkMO2|i&bR>u|Pz)J}OjMORjBMCLXl1M_ zoN6qMJ{n2KEp-9gV3?8Zoa?14vr1%3#B=z>OOw!35727LByIE32@3NIsC2R{blO_~ z<_S3JiTzCFq28*^>x^G8Spe-zCSMWYHpp$bo22>#3AFNUOOtMsWxkq z&8_YpoW=Uujqq`Je&HYm4V5DP+lPHo{^qt4NQf6BlK}AkvTP>O(`P$^R0NVT5NAEd zQe0GIMSz=8TxJiMi__Cuz?=y#TQxb6iZn226)9KA8aHmi(F_)dj7Iuq82Ky-Kr>N^ zd~vaitp0~;Qd8!>qjhfLui<*UiLr2)zF^HP{kP{@`ZJxWq`jROwcr6$1ua-4cn*i( z_g~+YpP77qR;iSXgp^z%bC^xM@foM2rdD(c0XQU@=Jl%6N=xqAwwiKWN>Ursjzxp* z#@8Yj4vr##=Y7>vmFF|^z1v-PXL_T`UHzk(@Rf=ywHa1dqmHt6KF!V1;f+)3wYRr= zVBlRR=j~H{>3*ieS$zhN%Vodx*~zDnF;~RIf+Z)5^7_HRZBnIkG$pZp{MQ=CtLFYA z$5MHnprCnsBimUZx=&Wzq=9~C>oh{5IwC0~(!2eEVRRNpbWMhA;rA)$Jx@69FPXyT zI}wrLr2c>(%wa!hFsS_yD1v1YQV~!+IcP`0>IaYktA1)`mf|lpnxd*nrIGXF5Ukz$ z8hK5J_5RELhk&Z6EUutn^K{p|WDpK=0PMuAR(xumhenNv@=X7DX_5IHmC@rPU0bMv z^YB)Ou9u@*Bp`;3l{tm3a(&Bv>wpV)4YO)moA+T4SJU2+&vjtNru{bm0*~EccPNUu z{z%340vf#M&9cS&OmS|9%D1m;oDZ%}j~9;HeLe-DFto}|+eGUlcj}>&+>*=MAblhv z*KyUpHiy&hxm?i|k9~+mctnxBQp0lKW_qVE-t#+U7{yogeJ^!>`(wl+&7WlRW)e`X z`P<~nS`0h_%<*M$t+0_8FXdRY&+dyKEFkKu*YOE@rEI6&9J zj#??v5fd9cvP}>+hK$b61y=S~WSo$%D%y=z0DFFNAK@n&i9U3ob5wU=pNA-({y+b| z7J7CtlHglwaww!QBpl31fq)kp*yDU5t=hhRY}`MLgJjHV;H0-?m{xv*w|va(V3fi*Hg9|X|F`lGB2*+*}ZHPI!Z(=V%tTzfxQ<$dVAwK6;_yt$fRx{CB1nC5{!js z4=|x8wQ~bY{Uh*qnz|@TV+>Cq1Pc^h&2fT)Go{*LZgQmNdW|hE+AUezK@g@>0^&wdDVlBu^ ziH)RP1FdPEJ%z}UJCCSl1V zri;N5KO0#hfMAsFlNZ?5ztlz>trU?Hn>*1dnpB~7qMoycu>^T2xB-lRS5xTAE+?p@y4P4#k#QV=MESDbCd7>v&bA~ zNvsz8^uX|rY~l=C)tfmyH$XTyVib(vU=bHs4a-=L+bFAVhZRFa?ZB%7y%@<-Ce_y* zSY5L0zUo1z`KKBQk^!%#=t~h7^U49|OPQGov4N-EhClJl2vthjvgi11aNiXew4jRqB8DKiV73 zn$_aDrq`eg4@_I3S7t5fRw^=bisZYFm^`MR z@io+msAXlFHR(_r{!A&tZ@lX)9vJxOP(L|ErwR;>>IM|{Q&M22MoPr4--sA;QEjm_ zgcg#ig&EsCb+)B}FRarwS{`L#=H&=`Lo#?T%rH~(omWO?mjzxLIeS%<&aFF6R#u#v zpDnzt-6x8&49d13B-TzEIcmgYUg3S4E|&%K*n&4rPD~4XMZraLHC6rQ z0J^*^s(d-E{q=|Gvo;@1=NmjVqn+~qmci%vpA5bxKD{PBEB%jf8$JW$Pm`JTr}_U? zabuzX-xo8ovHu@~4F5Cu9};hjY#i+WuVMfTJqI(}e-;C-yrI34hMHc|U%S1H@Yc5C zTvIMv)`+=T4`B%iNHRyj1apW9jN-*v$3mz>tVT)kEm)TKiPkMVX+$oR&26dHD>D6< z^*r;FEj5$RtCzRCku|HDKMR}rDyt=*d`-G-@A(^bzPnnk06k3U=}b(f(^-zklj-U3 z5d6P-!_pxJfO&0qxXg7K4JYX6t1){+S__2neuWQs9LoZZ1|;5Le0$$0tE8r^-GgtP zSDFmFfG@Uyxy0ypd^ED79}9n3;sLhKaCEly*x`2Dq5S5*_O7^8eOcxp|2nhy@iKGo zWAU;-o&$bmIQ)ij@9GdM2AAu6QTLv7X`uX94W52uHU&;iMpJoOunT3Uzg$H(+5FqeY z3>bwLZAE|j|GzP?LmRf^|JB0=KZgMOZRNlD`h1N4-;eq7g=N6nwe*$p*rx(~KdYdD zEj@3?5`BHt#zuyih5b*w*n$d3s2t%n?gX#|jh?IlhV21de*@K1R(w^6 zOA+$(PN;O(`fdfRm-I*i4nX$~VBd9@+bYV;H?19k50}u*Q<-$ zn@VRDYVYB9EXKu^QYxruD5!@gM>V7Nw7Shs5-utwL<9eeuXm2_Bp@~mu1|6m%OSJfuLI(=HIO0}Zr4y$p;WRQWHW#AzRICtjsLXvk;t<>Y8bpJ3 zTyTl213xTEkv3A-5*I*EV0$~*sO*{ZVzfoJjVPSV*#pEGA`~fSFuCNMX5Y`W1G@Br z99AObTov&s?u5M(1DwD>n&xKug}T~#op_UGPt|W-d*|wWa**h<*wInNoHTi4CAAP1 zFRan&0>AXa(TsTHW|{Qd;&t;A#|QUjmtc_UkVymky$;sg0_rKU>0fbf+Rn$Y_nz~C zkgj!lhKpfg*ab74*xbi}HI1uV0$3dBdW&{)3;Q!Ig|J6!q$x3gJD2cpd^t)+$rP13 zFTRlUMyGE)IAb)`aL+)rjdt2X7(&BUqkLgeTXfL0K$%vW*|pP(FseCRO!E*ICOmSb zCwy^BK|&BOwFB8CnnrDWEg2{S#xZc$Dj%G^6WC(<mIlG>)?w0%56|kQ^5-#k@t* zi)z2fwS`Fk4j~8CLJ0L9{Gf`fe9E{wH#WYKaVqZIK=u#X9{Z~=8mn6>+B2H_>_2`J zawf8{Z^U*Zr!cg7Q!*mTQI_F6Rfms>)DAB4${|K8GzQ-UaA*sa%gRY1XU*%YK-)Z* z{&*FEL+mbN&X68+MLmhf4}oUv=bV_Qk}CrqL&UuG{q4ABqvFrO@(||rroJ*q1EN=c zbqJF0u{PNodfP`O+bxC44)RXaZI!lq3h{4h(@&HNW{S?mv0|v9MUWlnQ4Z%cOyy2k zLWXFcC9R48S<42q#Eu||MnXq`2Pfd<;wgs1jO!f?doZHa04hC~>A3GT4fGN80+S5n zxB5iU)kE-WvC%k~0L`?$ktI_UX;&B8~f;5S@w!tFXXZe0ste z&;SeQlfM2^D^W2T?&g3A$gn5Q-&IEYNS|aMSHqP}T*i#ko7?nxp~hx6 z1vTITE79nHM;Vz1S^wCe`Ib2{NN}k#+o!;^Og!TYQ zxcdp3s1x=BzpeM{tw%V8)5Rf<<3YDs$a{-uGeeev=8icHRcd>9Xqgy&;q8Y9F1+gN z=LN{m)@Oh;ifx?JY;>Ckz=A`G8z${rGbPc_>@FIO@`*`uo5czw)lI)=Ndg16BylTR zj?+|!WH>y5C-*iB!X^#X+OW!^CwHR?PAe5YHS=<8#EO^$8<>n}KFEWf3)=yoD7hx% z%kGI>%}+QBU*6n(F02w+YXgsZ<#Q!>fX!Hg^y zo6H;;IXxsjIUC1@cW5sXUfZ|C`-M_=hymwHkwNg6pTuuGByI_gTgdw~i6{zI_cyt~ zCi)7v2~|stK5i-1stYm&v@YYzTwL>9!5Bxh!SUZ&J)Js3Y;KtN9npn0JT6N?L!O-@ zL|N?4op4qwe_)kNV=4q)6y$5tm8;Q17-^}QgMu@lCGzA6PV!|5{=LMPvJvfi(p5CHd&by!oJq~eD8o{Sca~)S9lNQhi(XJ znL^Bwk>QvLj~J@b5)r>##B#MqqdqfVIJtRWm@H4zx$wP=`CT|%GFX_~glq;-utc0A zp@v{rh8TAuUu>-`UW&-7lkJfe%t3D4=$JfFw|a25%~ngAl&bDYU&{7lQRPN2@<>RC zMUEPVa%6q|4sqckZ)eePqLq3(!5oJo&i4Wyg_XM$0ymsIBp8!ZiQMy8eLkyalQM?e_Vcu_`#^>83*-(D#z z+j7GW2TrnrS(!Frjowt!up{LCkD?I9%pQ_HHbUI>$rQZ+bDa796ghnlFl4@Y2GdTY zq8~+`44DSJeTKbUq^lE&(t#*A>Hb71fh2CY${6u~yvTMdBxfScv5T}AHv=RmZ`GxL z%(MQB5CCWiEGV5uC%l$aX20LNiS8BBeH>e?)ameWs~4xkW*;+_&5Tqf%SS~SpKSf* z&`Kgsw_gV}tWnC0mQ^8xf}}Vi^4kl;QApk|456mCQwS)KK~b=>p(U`TKXo+-kbxjV z0E7zBHE6XP50uKJ2}SM9BBK|=Q8T-I!r2;<#f@W0*-`8O{DI07c?v@2_X)Kx{Xp6h zoMpf@+yOMt`)`a`^XDlG4=_XMj9mhHKaf924-CqB8esoZi5nmMiR8%q0os0Wo6(D! zLh%85Wb*2Wa(*5!OhF z_<=`gx}T$HonbSAG7z#7#*vvUjL+|sQf6A1j|{yCO-A!|0!5BlHalyqs_qxr9RA$3 zAd+p%C33^iO< z$r1W4@J_R=&c?QU!BsVqK31oR2kI{5xBU^u>#AGO2$PKAuf#%)SG~Cr3^ksTtRZS? z+FNl6CyGutwsm;40B@)Tnz#AL>+eF$zM4ux@+}`FE?hZ?8xpk(D$F29>nqSZ` zZAtg_$oBb|d{{BNlOmJjZ>2|D;v=<2-MBDa<8H-AEmQ_M>~S>|Xq`#pZ^=iV1Ag;J z4Aqaip?2Xy%PPOA=pfQ>bZ}^ovf(CWt4C}Ni(Hl{a<6sZdiOz2WDlVnv7!@6 zVlp{MaZxkF(O1Www;Bii+~AAZ?HRVi#0x-Y3~LdH$;IRi7Qqt+BAcLQ_~x-g`u=D7 zQWiop{UW!=9FdRQQ>gwG!xk+wmU41e8|5J=sC%U_52Z{gW7rOn%ndV`=r<_0Th^{x zxTGyZH*1DbX0jBA%$q}!knM3(PvterAn(sMNBR1!Log;XKGZ*`9<`lXOSzvf=*>9C z11qn_tWhD4pcCqdj1w2e%GT9r!wTx^L8{VHNAyZ{M;q@ZGy;dD7S%ag4NKBsJ1;z; zpKGk!R?egJs#V6U`4GuQ{2qHUvU+({Tz6bbx8fg3UosqTt}BK_8zznRnD~~U+(E{9 z)VyeM9CKl%j$Y$4*D-CM7~}SG7%mj7Xq9PNx}a@(l&BtBGjartJ5tmNdQ{SCjcoiI z#c44vj+VjHf|IIaav0AwS9=(0eOM$*I{&*TF@LrCbb-ZE)f|eI6RUlwNTWh>e!z0S z!Nj^^DQD5VQL|BXL5bFEzqsF2TkeUHL3h%ZzC`nP>xcofG3T4bh&KML(#nrqQ6b(+ z+j64E-1ts~ZQ`IU3r87bT)uaeXexhl>V;;tAXV=3V%FUyg|K?Q0`t}a$G@@D9yP2Y zwgbh|p2sYZ^+n$17s%s`1Os)~%;pu^ZP(0r@Fe6{RT5R9T9%ZRm8}v>l?PL;u^m5j zwNcmfwwE{?@BF~g)ZB%FaNt4^tKdJN-%uPQ-{U%Vt2o6zd!Xcx84YM(^4k*|p)DElsD(UE~QaOkPYg7?D$cV)qt zH(BFTQ*p>8{RxI4$t3UXvqpq6DrlnPIpE~&GRTpJG3Cr?#cMSYNjJw7C8*Rn!xIY} z5~4X1ct8(}G!oLEWq?xqYsWZ-m=SUIF$e5@7Iw-VxJGwbv$iTPm{ptmFZ&m8+uQ*H zOzm;f@tt^wZ>lb?^4CA8Z{^PHpDlzsqp{2#CYK_dY>hW9aaiMP7B{yzTfe0@Q#JQB z_g&m9c|w*OQIcs=&Wl!C!?oyyDuNKHO&lw!TP0i}&vl27s05f~wMe)9zHSD`NbAosjlmE6;35rZnUk)EbO{{=! zMmrBT-lj^dIw)UWnU9VamP*D^Ez|a^r`^L=R?klWp!yn6f{O;?a}GU<)vgZF*wAuL;+DBT2YzNI5Ey2sPUc7w z6-^nN7ok{~Aifu?FG5=HM>)<}UaKgVR6gI@SkI)YPI@3nx|MlftL=9PMFU++gL0>B zzsly9v|`vm%GOymRHV4PLZregw`ecXn^4vUuQXsK0S3|SfBH*x>bbwV&PR1_J9j=q z6{&~NE%td=kmKhzsqIcl$SwxXPnXg%zxExf7F?U200-!%4UkHVUn@S`l92d*JRG6o zhk_hYE$O=!9B^SIobOsKU{8?KdnMlbfiMY$pg=d6a|n0=l{a~AxCsKlFue?z@UFr9 z*q>g{+dJiUGS5EGJST*x9*kLV-9@j}H}ndhl{cU*z`7*aG43GR9OE2@pVW~(nL^1D zee3<#1mG?!0X(5I5XGaCXCh~OZb2mR<$)FjcZqfsUQo3aGoZkB4O#`%jZw0@lfVpV~lm#B~|^bOz+`Uik0+ zy%2pwRYc?s8Knl~*y5-eb!GX4yJXfqQ@K>z%;ze2Z98i(V_yK9EWYWwS@6{3?0$cTW@d2QpZH8IO(ot5TE5>J&x&Ezo*up2;7NY$K z?1<*UE=|18kXDiPx1oFvmBeMAGGC)H1IT&QlkUj@08dTTlK|snw zcBA-^c93?2Fw&ffq^A&?M9A4^w#ecjU!&M2_P;w|;is8qgI(W}l<{rYJuVaZCH z7L`UfS(%ofcHFROmKoDad^7ptTOd9Ku?%Iii}*}Ki==#`_#oVHY&}EHqST<`5xOD4 zFBv@}vv_#M>I7@<&pu$a@VNhg_ll-N%<|V`4vgE(PevA(p6`!n>oZ0Ma(7VO2Lh#D z6A3~44C3ec^r$byOP;bDk`Gyj1k0Y_b888)Eitx%^ndy6xxLWB zM}FNvdBM64GA+h>v~u~q|9KsRYzxKtNwqcY1Is;1;!lOgC)*aty;wb;-G{+Ld$t3* zi#_r&|3H|l=q0=;1!f2Sy*m}6vukNkU8ekwxC#e!`iJHg#-q7BP-r&#koDwOQ=U9` zc>5d2tDjUZqSoJ82do)7w%m{wrg>RTPph8BvQmG9v@Qe8eJ2!L63gyc!`l(MqJ}9m8 z-_Wb*Ex02{`mY)I0uvj{#0`YrAsYlmpObE4X4{hULOOvxZtgtM3cX-W)#)<=^HRyU zFso356}Qk0jGnt{qE7S)cpxTkXrIf(Ky{;#mpMdy0`GJo`PQ)TP`#La7WykoK%dSZ zhiASvNUo5ok-vbNce1u)K96)a*x`4k3_P>F{lwKu41HfK{mO_FGJaVWo#IxB<{(W& z<;;hgLKc`Umes2~qot|CaAjyqxTI}U@#}5<_Nni<_2N_^u=0Vg_xEZav>EM#v3vV}D@X*G7}0|^%6%0eC>LqcCiPnkAdgWdLJ-QIIlWq5g2V67;h~#lQ+!#!>U1{f43eAr3f5X^TlSN-|!w z(Wlm4{l;R=c6CW~9Aq+?PBs#wu`ev7K|Me&W}Y-A$P)vnV(qH^{d1!DuT<-gk#>cF z`*kS!>SyELQ?FeHNss-g)a@}&t+00c#pWCoGIg1>6qG8CQL(bdrNPq#g$T|~khKCS zM>jASeFD0ZKLt1ViiVv)-9eXPdk(8yf9nb{3>`6}oRlMfvl&$}r!vSN(a!I(>wpCa zc2bfpHm%^4FUun@$HCQ4nI-(Z5bi-;H%Nl`svD)~aeA&Kj)VZmzy;ajG-R;bxg?In zV=yMh3~ZZQwlW5z)XP<{O-ZI+ta7~29lEIZPd9zkU8W+G4X9Q|?UEODmU6IQ`gQIM zmZ?Zyf{e6}j7|!5#zHtMw`a&Gy`*_bqG(#X{{gqyh11_yKy8gQF)uV5CphzW5JCnP zDO`G|!fp=;MdKn!GE6ee9`cqYiL34+s9Z|5Qd1+NlVshXJN^CeT&wCS5-h#ydE?ZZ zIlkb*QIFP+-N(M>v^TX_Wf&Qa{b7Q~`>ZQ9^{q1qzKY83>&dd)-P4`R6Axct+NKYc z8JgCr6V5XE+!$90B)Zl(wZMuQ7ufolHaUw@8r!mAM%IbzeGL&T$GhuDbBsV3=Ug=v zMhFI>ENXVxpDp<8!J^2!Gu2!>28(~J=D|ee(Kedm{O)+9t%JN;8m|n%GHsWf$z$$w zlp3GZQlL~EuT_dXcYu3UXHL?o+bKEe=yyys{flQ=F68UP;ah!_BRH*+G3qd>|5AL| z5qAF%ZCes;ca-2Nm0_%t{UBLZDGX4oIScxRI{CvZnP5)!?bv_lWb1+wYjm!ko(SQq7 za%g*0^6-}a!da=5mW4Lzy3BbHR+RL*Sw;9FZjLL&8|zzRNZ=dG8HYu9)TG+1TVl8c zte8=kR7B3wjD-a$olvPNcK-Z%)X<7LvsUp{%Pj|%YX)8)t~x{E--h{u9YkRmE&+Gf zQ>VM4@Y5Mdx_(xVJpO3IVIx}%V>*6Hv8mHSpl_7aCocCWhy z*w)bsijiT{Y`kpm)8~sfHjKXOyg@#AmiPCw#d6*PzTZ7vh1ku3X3isvb)c|o7@zmQ zE25q6&~q5yHxxb1t)e>@IHL3=&8-X|!SOZxDygLsix)Zvu9t}Ls1IXVo5!we0dQJZv{@9YF8hmDDkvJMFSiS4BfL9ztYF}QVW%aR^$;LP|F`0Obm1Uau zb=(D`;S&!W43QJ_!+w5O4>wwxcIYmuA5%JpqRW6+AFK}mmqXU|@O*@IW&uf!Y0W&)-+0*~b?aCEeIoBI`#3yK zI=oYf>F7>rURJ;qEH&-lKPQ^fql6o$~YR4?;V*C7ZL#*5ciZ~^*xl}tXF`HmQ z!?uhpOT4A7OgC?@V(pr2%X}*JV(h%#T#9cxR^iuu7*9w>@5K4?n7dZi)%6-eYa(5< znp(IUxLbH#Fj%){lck$vIU-A%O&sz#V_OJPFV~aw3hBVKB!d*H*s}6x zDc3dnspJ1^hCCnnjTs}=AUBSbcp?g(wji`8AMuUbUmhd^(%KPj5yi)GNlq4#N6jRJ za@@*iNN55rxp1Ay2GN?XGt1`hHCqygi7}c>b}a*QeTk6~<8d<%G0cO-Z)p9mRfZ>LHojv|#==efPBHIydN@n#bN3Of(eI8i_qIDXS zY`xe_0dp72=tL9iX(TW#{{#!zm9f%`Wa?kt4W{Xab{EdfsEL&6Y3A7~os-tufpe1= z4U^;Jo0V2@bH-ELge;d@dqi^E+? zmm?!nx*9mmWhD%ZkhXIqe6=O9*m}X5>X+QklQF|CJgz!`&yN1%Lfgp8&$C==dVaT$ z&E}4`M9)x$+ScaU27NwVGDQ zZ-a`8xJI)>W=4?_G>l>h4I;L`EJLxJ7^Q9Jk*tFoLTU0alR^PCB2KnpCtH6-|LBZP zik63O>-)kH_A=XnWz$>T5-sB;2hp;JBD&^n_^ns~*N2J3n?Et-9#$1n+H97#YEkO_ z@L}e)yz+1a(PKkJJ*IKXrKdea_hk6m30C)EbBWsdxJ%C=KEn{K%tlj{g)L*XDn>`6 z3i+kjN2Ox>H~3T~U#{lj?M~BokTkifvP{#_+^a3c+iv-_?k%aJ`~;8l3+If%3r8SinBNMK9x?qU%F@uc21c3y zUMdG@X;;gG*(%@?;SaAJtk?D;H^a)@R#)TwUAby9d<@;>>D9QEy6wzTi-^EBv?^si z4>>b)vGz#=+VODum(=;Ac{3=8Op~4Wfm?|z?KEGCeZ4>L zd|nFz9mD}2xHqIytrC>+2~2a-I>O==%^^DznRR6 z3K04OL_tAC8xjwXl{J7nZO{Pk!Y_kCK{%;i*^iS}#xLtIFD_t^Z{NtFwF&v~a46jY zs23t2+{l&0lsH@Tqe`A`yj=Q&V{~On!L(U|8!GIl`Mvi&Z4kO=dMIf156d5GAu7{C zj2Cu`7t{ovP$P30i=0mJ0SjCsZ7NFXb8$kOqrdfFR*{91!plX|R7nJz8c<|BMj={H zRogf7Vj$hg4 zbm`egVB4^xQEz#1ByZ{t0e_MYXHzp--SA5~>kTffTK{r7=mb9^-WiRqmcAvkM|a5h zVO$lt2&R-zwwMr_Y7+lDk4#xf2+fR?cJVAjQ^y~t0DLTd}$~>Bic+s^dKC_GEMtAjOBP?h@xo zBm!bRjV&M`QOFrMX6sQsj2#`TBPOrjb}`M8#Qv`om7$$@Ut%#%nV7$kqyHK7!X(N{WG+} z6~ga}X}n~i7&W9`*onDy!9l@~6EskDk&uz%Lv{GlFZbZ5J~_^jQL&-AyfQT3u5jsm zZ$7E%xqT@$9OtdowpfsfNXwTvX_-yzlU16F@0G!k2mQGvmBsZOvDdlE6Wo4mefY*4 zv_j|G$&-{JeR-&``%1hEvxph}GoOc&*{_&^3bV)|-yZecTQmPzjHv(Ho)z<+&dlCJ zqL#(K8|{Cq(e{Z)o^PXfBZqN${&%2%;r6$wfCMl zul+}=k*adlsB1Xj#X(0O+Mz1M-m@udz+O%48)D_Rm3A;v6iQK7FsRFHBHll^47Huw zfshpj@m2Jp(w>u1)c-_2<5T`u)3Md4XP~#bI+g!t72D8|*7kml4c?c>Q2P9YL4U`SIv6)8Tso%hlouSm5XV$& zQvdD!4RT8)QwB#hZ%~Z&t{qmkbWy7tUbHn{#^|lFH{J0KL5P}N%DFOkjPGSfE6n{G zETYC0I3yGy{=8J+n!yh*bvB_N!3BNTdeCbr&3d zC_&wOgHz#)%@lyW4DryT`gyM^{zY$+iJUjYan!{8pMR8Hj0MDmn?L3rgz5V_A>fU+ zM=p5gXaFw?feKGnl^_lr@VW&Iku6A5=Y#GTQMxTMy_x+ov z-VHSDAMXdZ*eu`N@MVJg}Vaqcsl%Jip*s^n1y<6x9P!1TD7YT{qj20Wj{ECJGY{FOT1&?;h{% zaHYN2uMW8qof){=s}QZ0&~}yv8>Zdv>_1;Qwrc7=IlZ#sZ{34Am+!tsR>S2>JvlE8 z=z8S_unxVgRN#+^>$1?RCQF!vniApwjStgfvCLZ8^-%yz)0E{mI~n>VM-*;@H^nS= zQ4Yfzi15g2C!%55@j&0>UdvioyOTV^*h z(GzE%HNT-P;(B)qNZji7^m3XzTMtQ`G3MdDsMkKkHm_&vM~&||^8jx!0GKq>v|g!9jxx(}d4V{Z=G$eZ)fSghA%$nr}kPxSIDHGlBCs0(VQTiMQJ|I}NxgscX8Z zLgFNSeX+qiP!enCm??979&_W|C|>D(<6R5lHlPGt$V@Sf^q=hGrB2#o0<`$L%5<%a zu-2k6;<|W(j+&r54w#GqQ|=Kv6+=WD@2*q1F(&}hb5Is6B9?-|`lSxw^#kW{^{ANa z)PON}M$=7vmn6}OyMSrtCI{MjZgP%m6N2hyD^Nb;s>_X}kOb%HU8Wd{7J>dFWQ)CjVSaJnaAj_^j#j;4(dC_1S<$c0l*}zX(;a$4@VUdC)!8u-`g$AfhuS-v zL~Y%6Ec0m>^2g)2yOvi?tj(53a(N?IM|QsWJM|CKOWyZ1fiJY~LH-ifSAmJGSGyh0 z3Go(IF0{vQNba!r38?UQI!qkn!oT(C8w$Tgc3#LkXb#`wO>$+Y%?;s~_orf7qvPiP zY=VWLOg*8ytRPDAy-@Zp#z8pe*iepyYeS}k{J+@@MjOX?>l{Yo$`%Nk=y!v@L^>1QeHqvIKmf%SoDj#M$~BUyET z9ljbgQgyv1?;blLE!z@orWYK$lI4C%WrhoJ6Py02>di{1h1F`HGg$S$u0mEdr1)rc z5Z9qh0;lz`i@9oFkoMv&CUFLoe<|(SFa25zQ0}VE+ zu9ZB=?&g`|*11<~_n(|J8eLMP)kkTTN38CwW$u-k)u`u_ic58g8+$~oT{YB zE!Imy7OjtC8{!qpS^4gG&wa1 zm{I56yu@9+O7}IkC7Ds?H&?KcQBnbZm!G<&>8PZfO69J0ZUUOu zxM#2ry1|v$K)}LtueDtS>80L1_z7Ug^QZ8U62CsP1bwSr6_iXwGJeQWfdU&5ck1b1E6V(U4ZPq#<78ea*O(wszyU#;ZzH`r&=WE*xCrLcn+ga4JQ(It^@} z1Ej2V>5LSpD0Flk$-uG@XLxE9`ai{9NG&9#0O|Voq$~xFxS~5Hr&zBL<|) zFErf!#C~11TeCP}t5DIC21Z24Ir^Sp3U%%om%Wl7!kqy|-V-%M8{olU04eE@@q@eVY8POefc{eschK_3j2?4PG)gs0o@v`-3R*1ApT2-(^^`F!i6o!@z;H zKvI-V#d&lH9s&g@LacL(dA7hVg?sre{U!322Isy}~->cKYGd5EOcf%wn zr;Eli4vlDg73*4sd`R?~>0?YYv0g*u$jGpEZFUK6cx!J$1DKQ#{Wq;xnra3i9nQsD z6+!uM8oj@n#!tVeP~6Tm@9_c7O}r_8LT0#xT3Zo^4%EX=9FDQjt(84&WmP=cpYZ?| z47kNH#rpx&W7uUc-0e{I8ee3R#ux=%g1V9N>R{D4BcBid9{i3=8%2I?A0JnL@_vF= zoRNLVyTEfM#)WEn(kyBO4%KugJybG<_!8#f>zj)!i?PW)phB@0 zDS-hV6#jKam>9HaDLjd8tgK_#Udnx*BJD`#0u$om9RYKd4Felf$iyq-`w-J6-LY{< zwJVFEzT-bGuH$3uY8f_rTY3Fv+pW?+pE1^$Q}FA*`yG?=oIt@lD1OD*_D(%cAv*=i z;^T-K8AhYCS9i?v%lx$Ju5^{Qo@~5Kr`Fn3(n(*KTiZ}n+pmgCQfV^qmW*y_t@8H1 zFLHro)TB;d<5hC3R9QWUJ3CLaa3FCtl`e0ul(n!)Jj2q$I@?%LT~^twDJ`lp&r}K8 zPfNSKDecb;6AP_ihsvaT-Q zT2NS}YP7PjHn(xye_)kpDy=GQLN&E#Z%bcuv{$u?-@sLmTU%0NW4S4%VkZPtW^|t& zp~+irwmn|Xy&eT)v9qbR#?_CNfi?4>LjBrQ&{$3(UQ}UIt#Z6qoRla`%%|M2*1bNG z<+tgk@nu?>+I$ui>vd~J8<54D$Hailr(~j3F z>QkYmRYw#tc$Bri;?%X+NQ9LrkAlsL$%p`?{qQBO1&ks1Mm+TB8V;Zj!&Q7Gbte&h zSdYCG#dJ%)266{U?ymPi$_xkY_pzhBOU`^PWb=u3H;Vt4eSLH{j{E9jeQbSBzjW&8 zcAl^U{+B^_x<9nP^<7^fUW#;givO2=1$cXA1N~Gz5gp`V*c)jne#gq>wmqob29#S z9rOS4VgBxmnS+ynnfX8MSXkHy*#C`{`Fjj3>;%l5tp67>=iltu8d|_Y{cmIrDrvhmnbciIwI5gyvjyf_rHXHuCc|Uv{p0F0)m-G|rWctI}IO8ftAOZNyd>uIjpC z8)0M53#Om}`yp`U4iLr}12Z9L;vhl5kxa)p0of{VNfT)j{0u1kO66|@ZJC_A)-msIDP3%VoH3l+8;N+crclCO;@^go2%qoYO%xa%Nhy9zK zt4hbftycwN{Xx{RGC;{^Wy&LeWRpT(4{`*5;@9FymKUIRko6^_&zIqL7qMiZp)!pl zWNF&D6oWQ&yB&j;sm7hANb8BI=?m5kt!Pan_hC%Mr}gK2O+AAy9Ruy9OXh6Gc5(|Y z3}msUU18E{d4*d6@Y2AGmV!Rox$>sSen0%&#B`|m#!xSZzJ~8QO+CAH-?fd=_G?cB zJ~Qs?Y=A!1TYuE#s5;Y)|4J8b!J!L~rdpg}9)rKHzGFEfG+J&(2;ghwi|4yi_m+L5x4yv-ZX4V*ZNCs zeeoLG?b(Q=I})3XGCjD?aLa53#hf0I_iKEn@%!X_CHu%e!Snd(ArZM9f|skC@(i&D zKi@3^P$-}MSO^aL%IyxnDpbw&Tn#$WeN_{%6;ylhapFW3l<#juKcSul zq`1z;oJP!2y;3<5>)3s=?S35!d^~S&`nNKmAN6Sy_;n%kdM{aSo=lyZTNv&wjauSZ zJgYTX-tny~;Lh}{RxxMGR)kY`|Gdm$mw7*f;UjE_gOhzX*KD=S+2H@%cUVRfW5V* zpS=AS0`kBg5KkKPp*%j(Ss|?M*qtc6gBUZ8Uu8{GLI3$qDbS7vbQAwFpS*$&pmz|{ zMDU&v?j*^=@9hZmf>n--5s7iyZdY|J6Te?FM@Zv{k`*`;(bcY8mEAkeH#&~{w4c>L zJBrZ|pB6EU-p)>qr<$tK#{0K4E8yQO?QMCRtF!)B7vKNI|L*TQ^V|%67VYZ_{r@TV zCE2m1Vi1r#NJc49BNPqWJ~fGjA+*6YEEV4of`uZ4lO!k-38Mft&f!r3Yke%ibk2dE zv2mjJfWZ|UF0ta;jyoE$`^|mC9gag94Qf-WwZC=IHRGN52DV+EU5AXkmzg*c1w;XB zoU7FEp0_6!afJ- z6z#XxsbELtGT`-zr@zr_76~+H=Ln&t1blY1qp)U`c3Pkwa|OeT77~K%6y>M{Se3_1 z5*IY7WUTXC6wsACOD#*!OMn+-7nVzgOOH#@OOi|Q6{_o4#%pLE(Z*|$l1xEW$Hvq- zQ45$#G|T>2h#;NW8ftx_UCyfHAmDzWeO7D_#!!bD@}`dcequ}xrFeq9p`XCGhr6e{ z$Ghjd?|nEk>>eCx=-Q9Pq(z7a4wu}UAY&jH_Z8tgK3VPNW;j-Zi8*>Pf@lUJrS(r?;0ov;c^9;b&$0<4g(Ttd91GFJ0@$OuJ8(1>@lOALZ^7i;AJ#NB?4E4;78C!O3Q@NkIFd(nv zK)wLdz>?-40N~ztQ_db>0d@hLhZz7BA>7qZS=2BnAf-Txlm22BLMvf@V+cjiXV+W^ z#i-n>@~Vw4>+__^bT%7^YQ1I`yGensGicRH?OHDlHB)gA&D zReL6AF3mySo|kv%Tag)ZW zIuk$Y9$1{z$wEqS4EujxAN8x`L?RJ8<+PnJM1hcYT{7&KU!7vx*ql~W)p_#h7~++o zxWh_Qg}BEhd(zr4w@rC-T)yN2=VLXrahIIjKRs5Q;Fx&i%poZAvN%1~uyJJURbt7l zesDuOwfb^QYW?EHc>t;(S{lVx=+BVfcZT;4%(>mF?H)LO5OE~on-qumUJ#NGf-D=^ zgIEWk34QV4Z6uwG37fH!1Ou9#{x)D&HpS#9nABLNTn(vZ#pp1)>`=cMsgaetdh)uJ zl(pykqQhwh1FBt$i~Sx3`SIU-odFE{*SeeBp|!=nBU-;i50MNUCNfZbZ_`h8`5CA+cfvn7_H3F1U_#miymYpv zKIwR*bSLe`wCuQJ+{A0q9<0Sq)eSZrx5!(#&AI1;#G#osSZ{VKDg2 zFYo-}g3`F{w`(c}Z>_EF*_vq1QN+2+NH6Uv9XkIM1jm8X4I?>`p6JWY;9;vW>QEPv z$2&9AEf3Rq+P4RPlU)-Jh5TCeNkJmkK6KXUm+hsyzB$WT4p>jka#0t6lJ|5aomj+T zaNSD7qj!sC73Tdu^PvWh3l|j3rsfKd*4u$`w*-K7U+0p(Fx=PT2CTX6d!8#0FRtkR ztT0otUy;_Cci<4wnQyAN$I$hyGQY;jrEIHf&pWq6(mv+_)BPneQD{#$H2}#jr!Q9- zi!gBaWJDPF6rrZUC@cerR+5-NHgrch!!4A|3f>r@-=YAC{$^j1t_n0P)EGgQ*z!^0 zLZGGXL51zQL-7v+2}76Uh^+Y|%tS{LSU?C`Ss+-zVF}`p4y^_M8%QUJ-y-EMDc4|43ye02BG`EAGu)uH8R$59|J~s)eeVm8 z8J}^UeogHx?%9(+VKC-=*ab?eC5*`_US^8f^+QHYjI+BwUF8qWB~BXHzP+IrtQ>9H zBAbya+^y~PfOS7EE_$ zK!m9YjC*$4l{T--Iu*bkF=^2JcKJIG&zAiNh#;vKrzhH=9U@m73ogX$LHM-O&hoQ{ zJKk?^lh_|zSeym2vz@HL(LBf|8#4oqh0`t@w)X2T&n;~^fliSfr?7a`1t~&i*E|^L zKQt(;?gCe3SJH#y-11j9{)sKFQ1fTA%yoEaVY>wbvUq zw<SZ5%MN=;6)fAZbCPbWv)TC831|AvZs?RCx1nBTA|?qJ9pR4l+JYj?{`?5StwO z05|v7~_>{+#$)A~%{1VVkJtkqG{QvBs1(12-~q5DLB%>@2!B&&|wo!AU;@ zS%AVMf{UD|XC6?*mbse|Lp13G1k?f;#_ko&wXKV*YioNiWuYb)FCO=VumIqPTget) z2Lwy}Cks7tWtjn9FPnY=)}}BSrG1TkEQp1C6k0L-aQ(}sJV6sZI-|af{`XfQ^uYpL{rEfG@x`yD=hmYAS;p@KNSdMb^bl|A2rcEYlz~YJv*WK zNcymTKY>0#ULhX-LX}Gf;Q?(Ptbu~4Mva>9D{;sUAuh>|qM3K08&0X>48K`bDZ5Gu&#SPbaGD{vax{wN`+`5yphK$yRP zKxo9?2vAO-Y{b40pp-xffnowh1lkA`5}pMF@(Hs%0`m#XBRq2nU>OoR3m0U|95Fn6DO8N=-NQEQ!21N= zBSqdN@D9lwBk&gje1){)@odB=ao-za{V{f!~an zmjL{lz^_KkO96gK;1?wG=LCL6GT$KZp9D@4_zzO#rzG_gl6sxMYb5i>1WpimmB5b( zyh2L8OyGwk^9KZ8BJh0z$45+Hm#FWJn92cOB=EwBX*t021fC=CEP?M5c!t2!1fC-G zju99onNJdUg23YhjuJRRV1&S7Qg4{F;USXw z4FV4mc!0qD1nwhnFM)dq+&yAk4R9BMua6je0qz_z_5plt#MlpT$B1zN;C2FEC2$*o zTM67k;2?poj2L?WZYDf$B0O&-JZ~UyJz;%-RJe}75Gi>rDRRw-u>;_0!t5%->`DSx zkdl`ZE|-z&mlD`d;1UA+2<#RSkGCa{UXMgkiMgbA!CU0Fx&x0b-*h%paf4S|6X!({;dBL=LyeItfT0D4CZxZY}# z*)w7Y0d$kh3rOaw5yL)!l_Q4B0alC{t^`;KM_(`cAbIXd}=%qK9RkY8lbP!cH|4Xd2PsRxcjW)c`Cau#jXn5@;Zq^#tk&)Q;$2 z-K1(rk!q4zMWAv-TMJMzqQ#SP!HBjKAT*-w0w^ERE(0hdP&%T;+FC-Om_QMM!Vzr{ zpkPFs29Q6ZEdggZ#0kGD3?Iah!#sQn?Tlx77H?yKn7_`I)OCOq#$WhDuEQz zqyT|r(g;5RAAuwSUQ!{El=P4$xk)2j=BKuhXr2&f6D2q;Mr1xd+AG%EpQBbrqJ(hE8mq3G^GFUjzLL=$EQBu3xAI zT|Wo<8PFR*{|R{~0sjN&r$9e}^y`4H0sR>01kkHMKLUCM=w+ZED%ZPypbWcSQl`4T z4|rUe=K3Dwy$JCalp9>3iRYE;T+b=jx}H@Iy1olno>6AIo(6gf=$K-QYgDn-^`v5( z>j}kn*W*A(fsR0W1n@AF83y_e(6@me1Ns)wA)s#pJu2VldPKh4^{{-G>mk5z$S-z1 zDBtUP0P^n#x)11HpnHJs2D%IA>p*t`eNCS3x&!ET*~6}{%D&;c4e(Z=TYwG%eML6t zx>n7Qqt{Y`{xo(i%o1+L4f0@r07`#UZ@w7=t$j=dfG4(;ub z@1^8>?Ry*d?%8{2@2~cTbQ0Oc9lJaB9NOKnt7B)!MTd5FJVjrN2Iy--B^?(Y+R?%8 zFzndAgZXd=b!Z1wwS&sqLD6W3W`}zRquAcDwPV|%tsQ7<^Va=ahqtoD!&~3lN~5im zY;@xJBU|mx8o+JZG5gNN313>5Tr^dIW$Q1@l_ z(Y*z$J9-MbJ1!_#*|F--%8nHU%Q}`HTGpXnmbr{pbQN@VEQP8|3fen54z+i*6|{7; z9%|`mDp=gH81fetGw&lsZG{PtT$R2wdFMn9kQgP)u_#{nSX13*Uaie z=9G*YWYU=2CdP=nXR7hC^Dsr- z&?O!`4jb^vv6#N{`s)vys0!q$XdHI5b&fFi-s`C7Y8>8==#ER%TbsV-$&)PwlUa$?q_E_fj;Qv1Z_3v)L|M6hCU=>3A z-3X1x|5rB6XdT*y_QSuc(DmpbdJg>xtwxta><)AfbqNm-8dP)an@WM zzX{z6bTj%2jQTAQza7T@Yv@k&busrKx($6*Ox=U-hwHb+mBrVl%HM_VhEn&U`=I0l zpgj-ID2q$pgPuX(1)X{cJqz0Q9K>Ek#~}V9`Yn13{SN&R{Wtm_DoEu~wde!%A$kp@ zKLAq4GT$tIu7%GvlM>$vvW-c0A4n`-4i`qR5qVxF$|-hjCzQMzM&q(+b%w-oit)mw zW4xxz3-<~4Xey8N@Ze<5RKMeEk#f^z7B9iCi8=9CXG(T@{JyhZc>sL_=t20z<1jN7 zi#-A}9Md<^A@nVXk7$UEx;`T2#LCQ`{}g&! z)Pm>G^Wyk_4;>fto`cx2=+)<d z9u$tkl-8pa z$)KWnULx@(X3+Whd3m|HIc49mC2LYvz^Oj1WW%4{!eq}|)0)TKE)!^0B6-Gc_7&H7tUBr+^D-H)(8#0~i%F2mBnr*x0z^-|GI5Gc<_sti`O#-s z-cQkc>3yg(h@H8P&QOs>qo)@66v`x}(&U%RyfSa1B`HZpnUcJI-&jZvNyZ^lQYJQl z6qJckD0GfiT?f|@2wKX^%XNjB=z>)%gXTh=xiHtZXe>vYOJyF(9%l$nctZFXdsA7)BpRG`Y0`m38{}k8(=0&+bf8N#ykXyv7!Acv7q~`bKK}e(L#B zlU>C!yh2J9kN;4n6c|orH?bpfmB289T7LcMJ)q_7_&=WleRrZD%0sW5Df?q6jm|$J zlNr${T@cc^vVA5a=N~hNaly3(FB zWjB^S(e}Njfd#JQ3-|nH+54?q76w>d>4p_GW+AnF$-MdNd)mqpJwEobWS1wjYK3Q> z&p5tvUd!s!|JAm9ydZPY0PJM8O}xkM;+&`eef>;1A8|O4W|Z!DBAvCdHlq}u)y!)% zj#6nyLV+cd($QiALS>E}FT`f#@pG5OQhY)zHV>CO8lKk{5KD%kWSsQG;-ch;5djOs z8Vybw3n(|o1dVKb2O}Pk&30l(lb;os$>$-E-=k!su#M7szgJBFnHFgq;I!$z?^(lBsSUYNX$M^wJJ*p$dwSj~BbRyNMJQb!aDh85%*+4$mBG$T{e;+4~1 zksH+#?vH$yneI2UW1P`qGb+c|f#Mmh7QJ#jTceejELNj}*V^@1{2=eviBk;TUnHY9 zW|6l_l(%5=xRpxehTd@@ohQlU4j`k(_`H$vfq3lDP5qTKq&>-gA zoatiz2lz}%mha`G>Uo8nCW!@M zN^VTFT0J@m{T`NQwMxqVMPjhpOv>>(ty(aeZ3gA(-wO(!1KA7gx079ZB2DTPtnWrN zIEysZMkJRR<`Oir z>6AL1k~8V)MVShX$vv+nBVDOSGLt)9VKk&=dWuwbKMaUw(tW@!)#jE{nYqE^R1S7V zU{F`C)CLPJnOZO~;F4%_;SWBr7#!!#QIyW-7oYBgL~BhKnwP?BfIpe>GSlQJx*_^p zDjMav|Da_CkJaMVarE2t=_VmHkdjFK4B{kP%h6-3&SF>fxq}W3`!q*asGYv_gsp0e zmSd+xzvk0hRZ6u2{K?xV^By)h^-`rRknmX-^RPYHu9E52k zkWP!HF@_Q$Lyn8eaZ!VllBWe#nt-b~TVYLXv35w>qpqR3Fz!@N8_Xp`Z94&;-bonf z3s&a5B>Ic?C;yMMPE;Ga*qF3g>&AJmSZAiRhB&Q$f3jC1;iuaYqBACwIX5qFax$`M zjLvLRF0dupjf%fov(2>9skx1o8$D*TOT*Fc2)VW zP_>2xouF`Jdg+mdgAJ|sx13f@+M90%5@og&_vz{dmsPY5x6o#syQ^Wr=%meVCvY`FK=H*EdZwjyWsru%+=V9TLxMWgPT?X81% zZEH-|yXv;Jt@--ag&BHg#iD1AAG@)$aLYp*mb~=+C$4WR-uCG3njP(#i!Q$F-rMqP zx3#7>?!NP$+du{|d)NS2HW$d?sk3=h3b#HWNR#28K_3{Um?sTpy;KlX$>4QA9x}J6 zrmsZN#q30MA)_pssDJ|JQ&AL`fNuh;SG2TQEFKn%f8Ofljn^}i*~#$p{KCy$gfm z>DUP29WQ$*kjM*)ocivCWnDU+J^hJ$UQOd76qTbN4?HRD7+W-On=c*&mD7M?sI zu8N1hI4dmc5zZmj(}d$HrinGf(VElec`#aiYEuPs8Rj#14bh!y1`|ILGj>_5Ke=gV z)BFnEe1?;mk`ruhEl=kPusjuQ+eFJuiB_{m$J6f#Sq{p&;<{CtPg!!?3XgQ&-nF;M z$4pdTJlJB@@9rD_FTF=8Rl;nRsg+dL{3Yey(?6dasP81ZlB)YxBo?Kb#usKa^}#y9 zPK+^kz-(`zbZ3swGe}G4qH>f+7lxF!a`=aQ+PpxOtNv*UAN?dzD5Oe5yoRS044=lQ zWh?L_@v1i1cm|GyTr)OV*c;P~X~wj=Al_>b4;s>Vi}q!)6*qDsGrk@_w+^QzjZ)~z zu*jwg^En!>YIBL4!mio&c3|>FPSdOpK1BkHBZ-bC6SGFqQzi*MNP;xW+yTC{Oex5d zOWX5HSCqMu%Ujx8%ady^ePVOz+V&zFBjM#rsV1v-bw$m_#(=-9rLDOvxoqqGeOXIu za&!XwE$|JkdWFql^OZLT(<<_^ata%JLLIkmT3~c}Y*vZMW;H6^K6i5EvfT8_ybOGK zLDSG+iNG8_{0L-~lFR(9$SpG&<*$=Ae}dZ}7c>MH>ROU&TTh`269bQ%7PgjVgrt>R&?}yJ(JNV-C z!@6V-Kigp)b1lQ@{2o`LhNDu)L;E?U#h2jpDtHAQkf?0|mp9ESqi&?f|4a>*m~1MR z<>kWIpQYgaa;gL)^L@FBXBa`H*gr1AU#6{xkB3<|a-tNJM>HiQOUlajW@j6{rqrkD z3jA9bbSUI>8M&l4T*$;&jj1vwpvj`LvUJ{GTKlr!(XE-*o#<|T3pv5Wi_OW?C&x0u zuZwL;LryL$>5cFtFW_VK{xWRs(`COCj^h=KEfwZ-9l-e~&)=qw;vRO)t4;Hk2Cdet z`qg_H#vgY$gkzF4E9F?cZBg=(`sUH{?-n%YS`y6}m1!rd-!AMbb}`L4T@8g=iDzDA zYDQOcRZfD_%{=IF*yk;7%_$y#E>PAuzSxqt0`*$mqpZ<=Quze%R~i!Adj!%AdIUg6GdF0I(Gq#|f^ zmn_LE?J7@I%LPuR)X!hsJ+Je+)$`qIXcP8XR7ht(zFA=7h+2K?v z%_^nf_(0p|{6IKEvkHm#BKm_NEiS2bd=S?53C<6~!Wp_VwJ>?6Zyu(fs2OafJ=cHt zhVfH!gNoyh@qvW*FaO5If?;<}xck7}2L>+ftxh-4_cwg~wyXM!B`T{Ht3&SU8`c%} z)c8MpC!=ZYcKjW6{N;aU2lOZn?GZSZwCm;WYU4oCf6ujD^ z!Q#+B|7*dPu7dvi(N3}dPO<-j+vsvD6v!q0!0k1<3_S2_TG%LlO-noFN6R1 zS1?)3dd2urH*YkXp}Xxo+41qrD;|d$`nrDN9kv1Hd+`#O@40_)rRA!%xA3eOM& zP#TiWPk1La%kMAADj%haj_^F5{`^P@p8oQYtTU#6CQN+15R8$zZ!Xlltrb@fg+Jk) zFyX{wR*#2)R|#fzG+Z)}h1nemXPsdIGJ}L)a8?5V8|UbwJ}ewqb0t&H`N&y(1I>ba z#w*im2dfreGT5A-5NOy?J8v+(XiTP%$aQjRwZ$Z9Wlh?~Z*^>XbZc?)!p%1y-q7)t z<#Ogb5`)>IQ#!ql)Q0};`$N_1YJCP1tH?3L=TEOWb!JMiSW;2PLj)fnaC$Ir}ig#p~E4QJkytGVI4@OG_z-2R>h^` z`03-|#Na(nbjx#M>VWhp@KcBk&EYS=F?c-gXv@RQbYVPt;^jj0Vp@S!%n2^s@^SZa ztZ){5yhXi&ofaJBsW$4ZcBwJRV)5uCl$n?Fc-`iym&S`?aptcQ5|fOtrtXf#iOi^H zL1so&FUm}fjB=UWC_^l#>5p$eIRMQOPyXa*Edm|OpV6HU@Se(I#fNXx8f`waZ4(nn zJ8_DZaaYoQ^lgNYg!XH}I!+8vyhrPxl>yWxwo-)xPK6`jbU+)t{o;bi#m@+_vByu4 z*2-cfIkMhy@!C#WP5el9`hH{TsCI`ct!j0Z(U<75%VF|MYY#Jm_I~O({|3( z8JZaN9-+O0S~lKBX$6U(PfD{&vR96mu@_*+ z;1*BjsS#?ELb`#~TWv;_xOTl7Yx!rFYN5q76Q{U0U=1rmcZw~Zk7Px1MYb|4J1fJI zX}0=oNxmeDSuV@#Gb?RLGL)HRwJ78n*}fu;E70c}Ji}r{hgl4<5uS>PNAO>aSNw@O ziA_IJpFAFo9;usnPC-eHAOL*Md6+)^YesHxnv8axKpmwI(^7-SVs*mAeo+#%t+gd5 z=p?tZ)Jqz-FWoh0bqQ0GeCKCZa8ejsi6CJv{_NVx{2wH`WtJ4z>G|~Q4!=d_PDDhK zY$J?)DS6i=W$PuOiXyNTTJw=C&5Ue{s{I#M94C zmygRmp5$+7Y4Inww6>;Fg8fIH;g)6Ul;=-O=`*LkX5Zm5+TW`)$Tha0b zt$UW2CTZ+ND=M0HEid(H>F-wFbI+~YYBE<|yR7cP`wwoZ%;_E)%wMq}sib?)-krgM zJNvivAi4~5Fh53$=oGg8Y{^sUu77v!$ z8BbdGiq_Jk@tb*ZSx|`MEa7E=vX)R*m4f5OH)JndC64a};`pYb3UbDD)a2(9v`@q6 z22nn};3(%ep)CCU62(9Xz!49cK77YxFB^=VJbheznZSM&DkyM`qhZAWDiI?yDowsk zz)c%-qquu!C)WxUL(R|vYAk;Itp&>}QtJzSYKc-SmoHe-oo+1%RZ`c@rWU$5edwyV z>z-SRQnDQ?wN~d()SI#!a+P`&Pd}f(94pH1eHR7`mJvm{FsdiFgP!2C?}tT;p^F`G zn+20X!J&YVGYXpHLR{f51FyrhFiTC&fP(j?q~TNQchma3gW7n5IVSqQ_`%f5AU=o~ z%gl@}w9_7uhn$?F@R#9uc4-CghG$_Ij4_Nmxi(K*f0NH~a?RZCspu(B%hLpCRxtY= zHkXE{d=hh@G^2khEi*>-?t79{D@8Y7*pfP;Pbts3wfeH!)uj%mv}jGo0)wijHKMc2 zc^N34R4M;!YE`CfylGMof8=pE3OibCX>Q&4xBX>{@sD6myu)Zf2kXfR4?d~3fuQqY zmtwV*!9V2J=2yDveh~=q%{f@SydKvp`Ho`b*Vh|JD7L}n)sku|hL0?wQ~DX%sw zy1q_wRdQ9qNP?I|XeJ`(aK&F7OlNvZVeL7l6}*1lTTE@k(^2s}74bxa!g8NFhyp z9nLB)OJ_Rmv!DK&;yiceq@m-|2fOFdN7sf=~ zE8{)#$(P8^g!rqXulmIpO&7tGuR22*@nT^&aB5qs%bjACQTg=vL!8!;0_NBvrTS=A zm*jRNYS_gzbpnSU0xe4KWusNWGJ;a} z*`qYGM5+|<21WYW!!*+odxsV8QGW?D`6Kc4VGpsAUb+Zbk(@3IDJhhsu&|UB{+WIF zu|OtL(vFZ4pGPQkP7r`(=23yDE59MHXM;Fmwo&nUHSm1Uo1!mECNtFJBLD_I^N3?V zr9!>03Wk)#1h-yb?j3(YqBQyJ-V}{gLmm7cY|sK;N1~3Wzec4?z@Kq=Qq)on?HG3% zt!j?pl>&9kcv!%iq_!HV-%-c$(*jsPgz;;sol?AsQ`xYFT?JBk3#5{SdPEJgSrAfC za)sR0FQ*j9qD(T|q!L}fWac>n_TRDML?3~ivpDYiq;Z?p-`uGV3ym~3Z{pLRg+Jjb zT}mSCU3mI#idw`$_Y*t;6?FgB@ktv;?W3C}JC;qoChl3)R&l)F$3LqImU}+hN5)%D zuSFi@qt}GAoF^g6l)|Y~;2&&YIUioYvidx7Z2rvCw;ZQmfImv~ETF&msgJf$^S0(~ zY}L6eT<`HPR5Z&)8yHtL_yYXJ90}N@P}AQqc{FJV0Osh`*y@;(l!7BLHB?`gz#`eXQ&rQeL< zH4s1j5I1<|QBi!pXq_r(OZ_BlYf$BV92U#Q8j807QwIgHZ#xkEBHo0_9Q{56&%-8Q z+M|(tCXG!>HP|%3URkwrYjN}1GP5zWaovHgu1j+CtUq9|Ygp<(GB;G^Ev?LUspYP` zVE(4=2Ax%_0Mm+I==_Vrsgrg^Iiy`|x= zbb_QyLDH{tTVQ`wfqs6bq(eHn*5P!yz4--&355x|Lah#A87E|DWrYQaET8*Hazlbn zD`!>a8r8y*k3;;T*wa{XT8)XaJ~BOYUWgGwM0|Ba$`Zsk`kXmcueNV&&b={-Kh0shO6eaSLJxL^c5vHAG~h; zf~rubR;5vM1%d*f;)5O7Xe-Fi)_EJtQ{D5c>T1*MH6Zf)yACV zsponLU$m+yels`k?_n-e_P20mgVp`Fu+?Wc752pmp7_&Ivodw)Z;E^9=bwD$w}e;e z6)IezlWu;0>Nz;n#`|dI3EZ%xsPoQDJdbG1$PlTKp}DUup)|PB&or) z18E2H_m)@Zr}gG-);o00PApH&=KP|_0i9Ft$V=n1uc#dyrL-YWK-2B+rn{F{oLacB zW%;QMi?SDTL78P?%bPoQ`ah91OzZquZswS{kdg-~8nREp&!Ka$y~#O|qj~+M+&A7h zc_MBuhznHy6-ANow3~N}cTWm;FJD-3Dh#*Yu>4eb^5#2R-VE>DDf534j%z?LH#0~Y zAU=W792YH6Fo!t0eAMAF#J$fL`|8zHo@kDsn2BsH*;z-CCNBuYY?(hcq%>6G*_ZJY z;WU*iHWi1K720@VGc28Mm_AwwwTTlH2|?HVjWA!D@q4uvt4qt#e^a<+Z5v>LhozR0 zz`7z;Ix}hurqm)71hwDxd%ZMdald`m2w{V7dn)pZ8at4zE`0b3QbUheQZ z&d@SJOVsS9uUxaXoagoF35m_k4TWA#ka3)hkLld6LFX<(|4mMuHdC*KTsZ|BmJ}>0 z=uK5SH4ZgWQOJp$m$)u*rKV7hlt!$6{@&E|h%4n1CTVAFd0Tl~)#6j#i;@;XNsWV( zSQb{jIe(p`e%ffC%psef=+pZtMLT&MzlA^LJd6LtRAKb^Dww)6JrbUNv+l*G!g04- zSM_Fi#to0>kbP713ICLCQB#_AmgfOqf==zE?iCC+FZRC#t#y1CrIZPR(QC7N3^I27 ztzJ;2MDd)N{`;4vO0<{Sh4(x7$&12f9zQ%@th4gq!*j5pN~sUVm7)gW*Pp&z4dS^? z=mzp0<}p+Q8swI1Z@A)eba{JsPg_qL>bblsz33Wkdb;)+=JKLVn>rJ*3i*mq_Z5*F zOsS?+pZ!hMg7zEga8Y*AnvZual0+8O_)g_dx7K6g!+#jjCRfVfI%j++bd zV*_2`%1A3g^eK%t3KkEk?=}` zLg`394?W4y8g%~BrQ7OnxLv|&{{W7zL@HBD|JcXy!E9Ty(Ry)I|o;;y5Pd;*uIo0Gmhe>CWQjInZN4rIzx_D`^&&Zpy8rNOd8C+O4 z&p1HI46s1CbR0eY2DsMqJF2qXnu_}Aj`bs+#_|-`yz2S}SJ6#3U$?$O@5!)I~WRb}|{L1U-AE)SpPr$(OK5I!dcTQm#_v{3NwO@!ODd(X^Lo@x;s=!>+aXS^(@}%%VrFKaX0X z)GhgvXT#B=sX0Fhr#3hhzYRNQ%++X>Nr%pR_L&uZvLjAnUOa8SD|F4tTh{Sh@21c| zW0q7ZWd)_6C~fb{>AI>b&6>Al=hs)a?`TYXw7FqH-=ci&z}o9Oy!7v@H!e=~l-c{% z=}mg2LYCmLNflO%F!p?Z_4K2*%2R7GTQt+OOj>`Kzr)#XJ(Nlh_<9T$&E z@uMzc3&rm+iSNjf{i6QdRf(tKJWx0}-NaZU2l|$O1_Knr)g*?mR z$Eh-&SE`Mg)Y70s@!)=$_{BJ-Y@bzA(y^)1l$GL=NF-c7t2LSp3PCE^^4klSskL&8 z*{G3y_O13kEy*egr;xFFT!3L1C{WDgD0Q#|nsoBLt$Ui2IjKUz=@5;_Ns(84{WcBD-rF1|wzL>sCjan^G5MCi|~Hpph7F`q;bZ>Q9Uf zT+MV#5;Z`8`0X6BM;*h*WK)mIWB$1YgZRBQ&D07QQ-J)b2J9|~grN!B2P0uxTE;3&INqA;cqDBoX03QA5hV_gcs&V=j7CTgv-)R2FG=!SD;~fV3=dp`l zM`~s9<7Z9HiVa1@u)oD-a^bq`mUdm5t6`G^2D_T0KBT1*J|S2VSg@qPBiD|~mH4P% zC5)c0a+UYpu-a5!k|kjn>Q_=nK}J5_4kTu5tjg`EgzYo8NKi?++4jp$vahZ#U#eA$ zuKV{HmY4DWm|n^yEPL9Aci^QPZi()|w{9VtDs1La(=4gCeB~Is!g~aQ5OmO69 zf?oskEh~)YTdqeFJFcoO7mushmtay6W50ZIQoXkP$|V7{QqXgH6RgJ^FR{&QEnqTc zoo#vTB~!C)bKCBg09gfOu##Bxv6Z9=&%=N?4`H&OWyYtSF+ZsZ*Z4thJC@DwXeqiJW@kTH@=u{6aminFRYhwPQ@6CUZ^gQ#`B^Dk|Gwg)E4N;!xXQG2 zMSs!Ot4yY=wiflTSjxk6E?w#>Vk;Dp>uUE!*4300J3Av+UZLx&YmHPi&5tB4p0Rz3 zpJi0$wCP1A7XC1cpSsy*RFK^7I`9y#t6jG*5*F{-*BJ?mcdclRge#ho=7YPic*ZU& ze%74ZZTS2dV*26}gj-K>9M(dE!)FPWr8*VbSLC4ZGPzQC$CldMdWAGj;e$^3 z1LNx-(v@^X(ar>s~=yk3DtCdbEoVU(?Z^e}z0gaMX z$ygn}qO;9wDPW4vt+9LB_Qb9b&r@OqkLDn{T|8m*C8(JpHqrdajSZL7R9+C+&DLc_ zw$@g3NAkjT%OZ76i3_E1o0@4pNO|;}+a5|MTy8Xf5}x9-H7gPZPT}rI7 z+=yvr^c?4X|D-E%hMlA(MxNh7$&4Pe75oWiBgZT3LHGO(VZ$v#1lBVPx!S+ zks6~%&NEkQ&_FO=uv&kv@%pk>>(ajX)!Js6TCJn%TX??e`%f>|aeDm)m+N?q7ky{8 z9W;I!+K9wow0JUIYif^#YS)cYwIOYHkw%>nS%!-00ufVFyw+jW2F=#|I`-Q|_K+MZ zhuS0IP;IwZ-yH5P3Tf0u8IdsNVG2aTGr3^J1--RtUY+_~Bm6Cs_%BTS13DLbTPXTc z`%mp!_S;hi?e6o{4cJ?^Z>%z>CD}NRrCCmpOL(2tV@fGbft@;iIj2cTbvS)mnv-Y} zQk>2t9nCzMVE*jZ*myI>a}Q#4osvm7jf@coQNoJ`ZaIZd1!OX_KOwrf0_u!cxDnqsk+C4dbwr52?+6k3|M zYng9P*|EFE*ME-1VyZbU)*_#d;v`yos?*^Eefp=&zzp3o>yu(52`rmuP8(YkQL zH0uJo15!TI!Wf(OEJ*`JWLPE78_gD-f)hAHMnfJ`NmNBCk?B|%#@PODnx^b-+tWI` ztw}Ibb!WFWhwv|-iX*M{looX%r=;S($n~}RBjK8-#j!d(P*Uu6EsH#S^;H9P?cxq> z)^VTB>WFXj#MoYcUnG2eZ5TL*YYvONlfs7wLYVsic+w*Oigvu$^21*1EE+MZ@i|Y; zpub#~=Ul49T@0$UQB);{162~HRLSp0UU^ylg*8P> zTwB=kNX6cf`9g+L* zOTV;kQ)FdRbEJInEP8O}7A~p}1v9ul0vhp1?bUZi!XoEOcSOP>@0FV(;gwD0&7dJ? z@}F(%_Rnd`zi`hM)hwYss#$_`nr2P;I3F_8_G)t7r~+%2LdB0hIQz+J(D~(^tXj3D zy*Kt6L#3HKJ*Ac$^?>+BN|N|S%1pJy?|8?l<^S@Ds)A=`XtF|>(qy(1Y*;@!Kz=Ks zyC%^26NNUC6p}K56)A1C-USi!qPpTpN)t14dj@n(j$Gu_xylNuw-{M!{CFT3NCs%NZNvfQ=Kz#s-{81|!LM7Quo+uuBl& z_kq3ep6!Lfco&fI?jy)ydcJ$Bx@Wput>A_IzTYx{W~%Gnt~&SJbN(mZPDzG=@%-wS z^8BQBHorK>Sl4VG%o1*$%~#JOi!gbfC~^v1DvRj<-DK7%5ssK)ZSjATRI+H*Qsbjj ze=mVk)Gzk}Df1-qxLn))>HcothEC>T#ejD9-ho?Y_w{$>ywkIH-eKH1xMp@>qGdKb zUcE@?NEf(Db&E6I3)bo0fql2k=B3$oPS570`3Ba^<_9LiEnvaM&&_47k|>wFV*h=z zgS?f9NGp7fC+A{um%pcUIG-m6CXM|6u<rmbyvF{3OWf!yz!q)IOks;54g7X7gneW%_3G znF+W0Y~Ed+__Z*Z%t&Ce#q!t-rfmJqTqE%%@g7dHoQnDF<%A-Vwg&BbnqeTtXm>Pe zXj$_JK3JDVA=!3h#CoH|uxg$3bKzjn}1~B=-spV z;`E1h%;p!rU@0)gmri7Q0gsH=$;QfmiTSzie z2YE|M0^}$e7@vdIQ{Yir@a|0lj>XnN`6K?kWQGA1orJn(a1dI83iYZ;)Biu_j1 zTry++cX*U#3ydoAGPJ-bnzEk5%NWvKxKFAHYD1Qyc#Zr;Wv0HZt$pbdyRF^UJ|HDj zb790*--g%-vT4YH)i}*j$FvtlKRF0L?fpr!ccA|dFsrm zVjhqd%@h&3=f6ColnWNF9G=R(lLr$B%%AgM3g772yl;#&{whyaIz6GNM53hx$VI2a zIqclnc&SB3cFn-<2RBaM7FKg8pudLUeQj&H8dr6NS*?eY(gjAgciM^>4%LN6D|^yT zwc6bfkn$rFOAb$j+(uSZD+~sc$muNxL##Ks?y%cG(iu#zx~i|`p8M|D)m>hSl%CA* z+Y^rtW*qJL`&J(Wc@-pI#xX5BN$ZSMfr#S zisVK0?OH>8^FzC`8_fX=V+uKbI-2iy>r!L8@0;Fu`L%8}5Z z9ksBk!cWxxjzq_rtW5~EN3&~M9l61YH^Yr?)wV+`4-Pu;Pw*bMQRr}W-nw_lsdu#L zRYrkFDcqYK4tU1L2O8YYrm;ldM{>G$zbVty;xhL5gR56fwEGxZ^*d8KWUd=o9kgeH zhDiVVxq(m?r)`>#8S6@ts_D z*lT7HUqays_d7<((S_FEQd3|l`vSIXDVBj-E_s~XCS1NfE54II=l*izx~#5jp%qSz z80a}Ed~)4Qom>Y4t;ao5SlrpLXS$*erc`O>)Gkz-^%l!$Xv%z%Kww#!*^cTW7$8Fd z#nC^KNkl}#a*v@(nx6mCX5u%*FKW*T&9hC1St) zvopog>=!O_uS8&`coPZldLduDt&Fr_$7suYX)Od*st-Q+cT#JMIP3udBNc+=Hx#kL zUl&Pu9F@BDLn0GDs&eAJSGN$JxS5h^MajH~K8$~Tv5y%%!GY6Dr!fpwazMpF4(Gk4 zMjx}^Ry?8PG6PR&UVI*!V{n||Xaq+B0JW#2l?oz*#3vuj5tXuk$rvA!_A9 z=~Jg(m6sCsNtN{7LY0T6a#m^Wa$??0=GG34ZvSh3bTr=n>wLUQ{DFlBwxYJG$3oFF zU2AQFf%>ANl9W>izM#b#%UUxi7PQv_EBsz!1&6ok*BuT ztskkU7?Kh>)}Nd1?c6j}r@?4eNoji5?QHCw%9?3v58R_BSPFpdF7DCYn})@43C^2q za+R%`%UX9oG#%lzdX{q-eO^H?TG}oj;oZT6#XZ;-@aNVvxcYopvb5rJuUN7+N1b16 z%RjIhy?ucZ5Ny7+a36+AoY0D#sIg~tsn$Bc1)Fj_TjxxrbnUHmjcw90F=XRV^lZ+& z07zatBe!~kCxyMbxOp#ajJ$`7_sV?0gH7BxWR9NAn=2VW+R4(W+MD@Y6kb}-_Z3=e z7%Z3$B^4Tb$l(B+yzuYp)M$P<+$5u7mZvBdXgzm*(8hgJ@;w_}wHD>wzl^6JQV?#ooA>&!Ha_4AHeNQO1 zfz?RWF6z>)r15MuZj)~YL@-|PwSRv}FX*}G>!3&n(5c6PPOYz1Ih>0SA}Js^fkz_% z3xFSIPKY`pqB1q4a|mSA8K%s>e#xJ_pd#h|I;Sjh+e$eZKE2pLPJhwS664gqty-^M z%t?(_IgRn-<%NJYm##b<0nBccThygb$T0+y$$hS~wz`;aQH@r_039 z)c~E5V-Z%*0gcdKgc*{yuoNK)ckYMsxj$vs&#OkzbJa*WRxqE70puqp-vn0EI^@k7 zPn_+I#}iqj!Q&qHtV7m;$3R7#ZT4`J!`je0xuN0a1VHtOA7x)N3wYv87&W*$6`HOofGToNBLcUm9k>^oHwCnU%HGz86ed~8+ z+g3JNa9#iUd~?s*W>W=%v)5a4qwPEITUpq>c+t^fZXc?=h~Gj%-#ysiU-XRTBJS)& z(mUE233RWn_xAdb5|Re1+=4t?W0eDS7K=4NsBlD$>TtEnuYV`kIPABo2#dNdK)a$t zE|~mR4vOK92g@n(QW_}YFWIuIuX=E5 z<87-W)|OS$Z)+l7($`Hiw{0HF`UOMXcys$E_#1X$_~E;++t8F)eZ$h>hwr+6LsN3~ z4Qta&njF!g&3g_trXv8{7nydM7Y!RGM6bU>y=BvX{~r1Sl5CZoBje&<>ysRB%w(FUQ9GgHN2KMi{NBvNRvzW2z}iV-1*=hP(PF;jIpkvAird|F@8sRX`qr~~X+(`;-U@q9ECc@M zabL-G3fLRcfoxJ3u6wb*Wnf#EQ=c5Z;?A|z4y)!hJt>EBpjUEN6;6~E0PT~kWY0)P zD6#UYp{Bd1diVY-f?GDpJ}ODlV*d$NBU3u@w6caeq}AF58-S1e z3~I`0a`9oorVZJH3L`+03p!txu*p*kDC!>&{vx+ar%J`;S@Tu5RU(FSD@f0$>kQyc zz-uaLS~NOzo;526v=fy^bWxJJjh(|wgIce{s8HaK5Jrc~Do`xdy8W)n!k%*l=#$~m ztcRo+g#uEHnLmU59#E{m76SP?P)T#Zu&KvXxu~HP{2*R+ea_nVlaPx{kvS44*`MTw zUGIdDh$e#ZcqI8+&RV-eO^r^FzQ1KI*((HRAp3p-EFJbI`P^{C^-exwO}>`5*64b( z*hR9`y8ycF7F(WHqW`i+l5j14ui(@S?@sk3V!a7d!;-0qhNf-zu1!w%q?9y;DWr3z zJx$BnnwT8Bs-bw-Zz=x1p~(x*N8kx?m<3-sw5jobN!)%HyrF+x~zBEvV*-h z=#YN|s}w{0maIIJcJRo?7>7m(W2e0V8 zp`-8m!PRH482j*SNB>>ldGL`J5kH?9*1ltPy~dZ5ZtiDN%N+QR6k;j`8y9M>OErq% zzeTSs^zkk9qkzj?zx4V;v-yRuy<+v*{1syzAD+#3^gnplck&Nr9(ge@eZ5utPTtD9 zUd!{U3viC)KkO}R$6h^SbI!9L~g_yu_^_Snj z@s0;cQuBt?m4Z{#Z(c@_;WX?@0fU{eD}_6pG&WB*TXEQx;xNaNyr?>?R^Y>3Z7Z70 z8Vx0Ps8_m*yoi0}(pW07w71?bl9UiN_TI3$?Z48eVp3|2kr-GJ2sUXH28B*<&~h?g zLq6R%|3~b*#Ir~r@|_yeH{2MDHbuK>rijt#S|QJ>(Se=@(kWEl*kqoIE0ka(C zXY-|bwr`ltmu8ymI-8#y^JQSegv!~96qO^z#s0{bR0dg*i~9k|Uta(Cj9j~+(A)jS zSbNmLYrkJgOZ)yaQi)@Fm}f{v#VrPTpDM&Y_^P2lH%rxy`efvS?HGy)vW!@fAp1cV z8ir&SdN#m4N8Cv!kzr&5a<%M-UW*RobW2+J)T}b;?+I@*a?)SqpB{LRTfQtrng6`VUHVs|6jdPB@k%9vLS71-S~jTRzEP z)25JXcWO7bdtE$6FP&WyO)y0N!R_1D4c4FSA3IM1k5Nk5(3}F$M&58>8fk)cOK0kY1RTWR`dfpo35gfrc5}~oRk)%#e~HST#$D z7MCcOpBJM4-MohWte7@-X`-Cce;`r*x3Fiq*q7zL;y-}gzXti3e9qWc4-e)CcMjeO zrMUg3>ADopt(Z+NSEh;K{g+P{_y@dMX0oA3*i|EnHGdO#!*Kcm53iYy9g-8}iv2$lSx3kUH29-e)!;oXJ;b_O_)N zvT4XM6g!*KjFF3-;flvFWzwghnI|7XXS{?lG6=7_Q4>3x*PO#VrLN4yWxT{tGaf@( z!LEnxk1)5UZ)#5#MvECKT3lSJ-3kRKWpr#D5hmo5%H#+?Pf1~=&v{02A%EAJ26vwq zt1r1r=KhzZ+3u+G>DpoJ_pZ`qNY!iR-^HH*RIQUwHLUhNyU|;Z35L)~%!wd~3w-9=$^kI%8jBPhUtrd z>IntmpW1ip5=t<;49d&`u zJcSXoip5uOT1qK(&sQ>Y7GAODnPaD}lmc%g11WL${JZ400VPI|FV~_(9R2(Whes4r zumMvG(u&@4LTC{@-6t_MAWaON%LzHpz)-_bqD{oj!J*0^Wr;`&-Q9}R(wu*Ue9Un5 z=hZQeb12w=qorReNm)8&x16fvw@Ey(Zr62#l-}ymTfBOvr|=S~u>@_lkeQzb1Qy*E z3v_|@6X*(p6&yw&BWQG(Osroy=7IDlG&$|5Lz`kAQVZBA=<{&GQ0!!!rxq=bTxflFlsf z=2SUjWC$KXFeHpBN)*i&`7~MMyn2phWYr^ht1?z!fZ2cn)0x{=o@WQ~?gw7w(t#atgVtMvp?TP7I&KG=Nz>=-hFW z3ATiU#1a!jURq}#(v7Gls)%(8wwNxp5#np!C)26?qgr&58FYb0Vg+kvitK2>pCCy0 z`1U(C7UmR!#c#HH1&sUC0~kgDO=WdzDfAH5aoO?#C&uZ0*0=+Ik~6aFzWd7WZY+G7 z2AYKAbt*KA@8NY6CvlsKo%5_Z@ekkF1a%fXv5!O$T*O}h((Zv;yv1N6h#hd)aL!EH zO+iu_1V4xgp}l`e40@Qqoj^7bt^KN772INrPRX6&QojsAZu= z{(0=XxR$gc9;87&0rCZp7oi%g-slYaSkA0fAXK!$Yqfb8+_^XKglS*uY5pL70KCzS z*iB`Q7`Yu>X5lOuTg5?t-j}h0> z(bmCWeP38mIqLe>wKPq-Sk&Wo8}VnX9pOZGL`Mluvm@7< zt(nXP!@)GCRC15{W34MU1x24-@a5Jt0J?k{&;?h(+{QNKe)-Ht*6zsEH`u_BppDF+ zkLRoi+fW~IkyP?&|31Mc9U!nvb)fkv>R{O`R>UaJ6iRX#_Ug2Uer^l_wKaJ8_i%zttNi;zTG#AbG`kDp; zs=E|gr^VjYlHho2Yb4$k(G!#Y)oYgJ0+C<_k_)#fD8PNdl9+XL8FgW=KGfPDQTrTv ze{OXq=Z!Qi-vm$e!M=w*Mw*dE`5Y$stO4{hIU%e~19u0Qd z;t2!#(ts5EL_W1IpnEzWs3c9aH0VO71yuBVmI5V@5v+<~b&j|v&=Rp}>86HIW5~== zB(7j6Hc;2<+_g*Tsvo|r%UTz8aSZVi@3e|qz1E&+YirgwHi||;#nNW0fnxP)_VO+M zRjZeE256PYu*KcgtI#3=q^a12f~S&*HP~cB0=A|k++tR+#cTlrckcq1lN8BEz$Q!A z+GJ(X)ly`&6jyar&0&g2`z>8_zmT8#P4!L|XnZ#AS&(18XCngl3- zCJI~pv6dB^!s+@@_o^hc6+er87yAv6NO7bUxliug!D|^&^dO4H1alHS0%TPJy(-5c zS}kAq$#COCA;rx6w{l9GXHcQAhxhTHvR5*cT<;+1wpq!R zG(MD{MIeIi>S|M*oW4p|BzS$mb-gHD;5EmIQAwazsV)Nqa*oIY_G}}pk zCJ&~}CLhm(Np0cB@)c8-+6_pPE$mc4tA$7xR_*Ai=p~4iS5{$nNSoASNu@ac2tz9v z6?0^o3uedayctS?Q!LFmj3y6IV$)+ZO)x5UT*(EpBT22xrpF1K{ENbD)vFrY8W^5& zSj2*_VWQr`QVLdKvFR8kFow~WIVEkiioJmDW}F137YBLt8T3!M0C+Tu3?nnLcCZZ% zw^(gM)@%!6?S>oM$A_{RD?*TsdmY`wEosu*{zP(LhHS|60Jz#j0ys}d6ol`V) z>ddM1&(c~Xo4xi{vUs>hq-xS+`xALEt(JWx4<`2ZJ)QR+APtY^$x6D{DEe7Qm#*-r z)h_xe)4)Y(@GzGg+1cl6uk!*@(<+8G1zRHCrjUiCv=me&o^)?iR7oNNXl0IYxZNiF zv$9qeeQ{TJON_<7lOAiZQoM>Hl$6b?l^_m zpqT^yD_39e&y&8r=8E@xtyry*{MqSJ&Ms3N0JFGxsS=}V%=s!YDl$n76#4^F2@mad zr~%+r>0L&XQ;k0%Arze%y!Kej5Wn$I>MY*lj*(TC(V@`@wL!>r-?EsiUEE}gt|9d2gc2U;4c{48>gBh8hVeFyHFz?>Y=%dYD_EsY z2qgG@D6O%HfD|Nl4h7zyPmMO(ISQvK-0CnA1d(XQ>LD$Fy#P;%{0!J9zXAIsjoc!w zb_nKf6L>Tv>VtZH(CLT@4lxwP6MOXzfebnoO3yCy0cFKHO5jtARF#v=oJyZcCyOuO0WfZx#aBVlKZJ#(AAKA6*Mr^$c`oq@-_#;t{W$u zZc7I+*J4FX36{B=!0cXgM@x#0m6jgMqjs-bkBVHZwci(P@`<=A*3##TwFk7oFfNme zyj$h*dpg!Ozp{8u>r}fv71uBe&@bFZL(FFqJqfEJ?lYP~4NiU3P~1KL7pz5d@dS8x z6s!Qkn%vEt_L5JA40qCMd+;Y9k*TG(T3=t3uFpib1V4?JnsrT6*uQG>Ahk(m&QE-=9|5#qV zkFq~rZSO{fvXhicc#x_u2O>D3@n^@k=B_^yTzTvCbw@th*wr|iGBoBIN9zp4aBSVG zv1ZTi%e!vdH@JIeV{84=P4TAIh9#Sz7Q7NYi<98_BS?EO14Zf1)bq-WG9%|8gV(S} zjeLD3intY2;_1M?VoLB{;ZV~Bto&M;$j;I32Rpu54DpHF{ z*~+)3f^KCU%4lsseJTm`L16N0^gM}*(0mJ|d!o9#{4sksU=7~d9(JY!Hj##A{_4qG zfYX{(XGtg?;nsKy_Ti=#lIH|KvifABWaaz9mPEF*1M&f&qXy6s`buPrjc;q^IX1$E z5jIi}!LZH5vWPcKkb%9b`nHIN6yr}g_cc8&9wZN)&&&mOt~OHv#vE01IO9*`o%_V5 zr}NeG)XWIJ2)12J2)+{RAUn{tU+q@(r_ihI_PT=B^daMs_@$C$sFs`RqQwdVIZGI^8V^Cq)zR6SKEI(310{+cF+^$NE-FGGwPI;@1>B%3R4q zUNOO2V#AG2Mx~)>6=kuA8bO^17#-k~bTHIkZwGKtLUbnq4JXLQz>fQvZ21U65Xr{D zGkUTLsu}zwJi+Xq=0qm0@IFp?Eb%?cCoR=}5tvXV=PaH|rYp{6JFS&HZzg$;oFeW8 z;u%h3Q9hZsRC`CV(NpEAh}dE>Ph-(RB3nRGV6@tn*GqYb6C|T%Z*Ra!v(xE@-Lq*@ z+3xYT2J|G^JVMj(<6$#E!B)M_q$bR_19bOS#sC;F;W|R_^z|0Bz#3Hb167oHOXQV;Y_BBv9)J;y|y;vAXbHCuiQv zRSK2jY4Vy^&&W}B<~(;5vA+Uai~`p$#)lT7mDukHEP4B8g<5YHt!`0)F2@M9)o6fd zu*=(87c-!&)@Fcw0L&pRb93RngA_|)@LYNHZCb6McnXSPMPYgU=B<0WWT+3{@yFPY zh$Y}12jqS8l}H%AqNTZM2HkL6rB=me(8D>l(V}W>R9SE&bP~M^aUdP&r*m4QXK&r! zNV6K(dx1=4&c$k-l5!Ht+8n#T+3Ze z;DXy?fO}^3Qv@rx%tpHsqu$t0pjxNJ05%x5;t?FcD1*tV!f5=R!e1CAFe6Ed_|cC@ zio^);C(4~=R5XE+3i2QS5vK`wthrPRaX0!`?2popIw0*R8ewM8@1D@Q1#RFY`h=8e zaU`cT7!WPZNB6oRAl%PiS@lYtf~3)srSo3oEvCHih{a&693cV}XsQUtmSVBk9|=;Q z?pl$3jERPg4j`&Ou@%D zMT6ajQ5;pcB6Zoe9gPqJ!3yVVv6rx$Nfi>6bA4gdl|`(G6Fr-Al2(U-6+$k;3&gw^ z{2&H|c0L)}<6xc=_m?a8%0ub1fD0fIekC)4nhrUi%!5%P^HjcKT*Zm>Fwk1^FP8$X z@Id;KCUOHZ+>GJ`s!*v4KmRks5R8h0VO12zF;b&JqyL9t!S3PEX%$PnOR6+#h1#kr z9Orq;X45NqQms)Dyiq{Mq0+I6l9w1ETk$nZok5qKaExgx zPL-Scu~t6K3#>vBVrnagdH}pv>sARhtI)MF}=Z}Ca^E! zyvb*=dPD+$UBRh2Rm^MgiWJFeSWU!j_W}8Ks8oE1e@!WHB*_c>d%IM@pqEvvfUr|5 z10g@B;TVkx(BPBvXD|;jEzw{~&OS%bZyaY?ul^*~j&KOTyT`nc2y;QIT45F#f!&6(29L$!5lQp~l2bCOh|}y6Chk}OZZ-^saLPFkg6w15dcUI+M<2Jec_KTvoLZAAVRF(O@( zp5u`jZ2Xvt62E~iMNCMjv`Csiodz%VJ@`&k&Ln-hbMe!tIRJ_va(kMu!2xZ~${9nLFDi|C)WN5C9^r&pdhr|JDX6Exw?9t{v-$Gt3no)pZU&Y` z6*Q-13sXuScGCmm;RzLo*%UgXQO64cDH=^8C(O?yTd`hj6?Pgh!hV1zJ_gojL*YJr z=e!9#M@Gtr1<&z1JyA&p_#j`Uh1c^HAJlphd?);V75jd>lEr|rp=R-KEBV5o6{6lC za-vEBJLz#Ec>hC%XRznUI}kt8C+`3q`r%_NX*-FY27<|mzI%dnt8Xd$Iv6p1`Hbc@ ziS4UCl0wL=l$BvDDck^97zyFM`;qm+6Tj;b7Hty#-p{&;xfrw$QHy~}8{ zsmaYx6;2j@PM)8ma6SbK*pKm&uI*RjPkfk3@;;o&i*!z`G!H0Do)H$8fY zlpkJI`00~qAKHw1;KLuR=d?UP2DD;-VeY{j3%@VCTzK(w3hCk1koR`atFg7j3Gnni zrKf*Xe)?ZZPyc_91KKYNlO!blYsH5@R{4oUd92v^%}`cT*w`qPF!YKw*N*#0@Jtw{ zvYQ2qhC*FF_r#4G2~Knw4R#eu-1FhWUkYzs5!<+FLzD%Y4I?OW>Sx#Nc;infaXVNA z9Oyw9TmId=8hxem$v;*81*1T-`q~L^@xdY4H8kqt|8!e77;OZj^To&**BmWDA#YVo0W6kddFPydeRPhR1`qln?B=6_a#(m@ECwnrt!}f-gFp%-JnL7kxH#uklN>1 zgM=~_|sweVZ-jjr5b4*?yO~c{G^A+Qx z>0+I7Nu|0=-~_w`|sBYRZU=eEBxn`xn61dW+L$~*D>v5}noyqpC zOPWhSy6Ct!HOY_wzdQJhiEe1ai4}@=R7Edl01q&?W0# zTf})^X_KZC@@+#+h5V#9`9@xvP6y`$dUZ+UUFa1oU635H zUe7t?);n;#+0wN9;K!#f|3ssjM+pV1Waz}mwrp#s|^aj1a#>cm}4NUsNUbU8WyKOY*_nCeDn>z-NZtMZ}WNHAOMnC_Pc^3aI5kL}1 zTF&3jrP4YvDMo1~!Z2baS?5f-oEDcTB9>$-g6mu=|GKC%U0_6&Zc4SWf*U2veJ*_p z{3F+FWRqFBf;w59X=E;&OqVX?&pTbTG+k*OyrmFIQ#r3MlnCNp)Q$fZ2e?{8|1btC zG0bwm?YXZ4K#r4~UX4AiFnNa!-NYNkh^}IXis#+T{Bobr$gci1WCm42DSga zL|sR`r-y2vL2bwC*77r`^Lc~yT=s=ILok_Y;aGXiLdJr!$NyfwI87a#=S044tpUyi z7}r2qYcOuKI9s`xuf@7Dt4dDGh4f{-nD5YJZ(VoIqZ{MP`df@@B?`c(ieY_i>-*N; zwmxBO+cx3MM1!JLq<1I+cFdtt;edAmhHe{Fc|9)Grn}a~P^$B~16zh8jK;vzdV$cJ z%zBl{CJb>XS8Xmm@>b~oM?n{s^B!dhid!)S6 zj+nLUBqjo5qaF+A1O&12**B6&D)?Ldn%?)T)gY7zW$qS8N?kJhMji~%2Y;K_uc3P1 zKSwXZEq{(~G*ox_E;@M^glo~)OW?0qnkEn4zkclv%lxb*KD6zQ=l6H-3K+G3e2kLj zyp6+k8y?sMq9`a8DdUL7rVbK+lM!9X&T!9H4(+&exrYLObVqH2Yj$*QzjL|oIYVlqrFVPC znetoIl)i4FrEh!4k@A_f6!v}3)b>63%OX8P+07psaj)67ch8Qfy)K|{-hA`w#+B`^ zM98^x-SnCXTf?eWcPi*yvUYmSIMmG3Kr>GQgpokDNit0p(M3g} z!6Uv`A#UbQN&W#Sw6Y6*c#i9Het18?8DIo0zE`DxPZfOy{t8dP6bD2z3${}4^r4Q`R}DF%>pr%na0Uz5cN7l>1Bit6heAMN zWv17ziR+_Yy))p!P=ZnOO1sSjw4lcVF-h;$hmZDr6Iw-o0+{4JK)JOgOyZI-$%-)2 z6-JP77p`uc!6uF^QTKzlg_xuR?Z_5JR@A-W_fsS5d5B4B3H6I$k`8G)A>T2QE#z1D z>)yyq(?QYhKCfs$2b0v6?3WHomY5rsAAE2_dfiyJRRv%P#qbQB8rj~x;_4+q2uto% zYoTb@u=_@?SyQ)UI=g+cjbk`KPnOF~?eCa4G!aZJ+uzqS)nfT_YTL#YIloeG*Dz*H z5t#U$^-H(Zh59oNtw>A2Br(3dRRSg&4efBdSkCV?`}?=F_g%fISB+D30GMF&rvWZ` zq=-vCbrD>WN&+b1U*}p2af!%W0GD)L6qc0D1!2i~XNwkRtA$D=;-3pj9)#6B8t&c* z&gwnILqO(!s8<8}a!ML|Kw^K zBI5j<)VcNyKqX%RsH98gy+V0JYe?z)`7I(?d@b1LX-Gf zfP@_oS(CM(i7^XQsCF@Ld=Z@p(q!%4-{yRf;Anza_6#C!v=s$u6gL0Cmz^W#3iD^AaE*x zORjrroih;|*}BvZaf#6>^zDrw-Qmv4xMUjOk~tt{tw4>! zcFv&GG2_+*{DVh_bF{Z~G8!rnxr9ZG=Pd@v^ zJxx6W@s-z(w;VdK`?6KukZ6}O#*193(W z>4LtGF3I=Nd2ERi0E5)XaevB}=A_JT=c&rABhMO*LIGVScrL;Jab8+OtfA1w2e;q0 zYVzg`4732GL9yPJ)tv)7dOiB4sevoi@G7fjuISq_Q*HI5X%o7_w{*!+liTg0MPN4=jauGpGX*=x0=D|FQKKeBy+O;nTb8ATklSE& zTeTu*ci9+?RnLVxmjoKOOk{bC3ODybsZPwli|-(ONDN68GqsZmN7A0siE%MZGa)7v zXY3|N9Q+waOd^wrJ3Wt>Jk9Zh!>(-73}JVVT{Qgx4RQo z4!!ANUio{hP={_s*Hbzu$N!b)V6r_&|EpTf1;P;lTh6J9mH$@>Sa|N=;r`bHPVSR@ zAD=DveRSrGi@uL|qAn7#`hU?OyFZv?b(aBT%K@bPpB3D;;QoO8E7Zam8hNT7|1a_# zMJEVzB42kIM9Q3ul>f7egG)}3s66N2;0HnV$&p?6PWgLV(ju>f$M$g~tn8>?b*SGi z)UWM##(hqWQA@2RT_*HxC5w|RtELOPn|OoCE^fMU%!%F>o?1WI8K40CptKssVAN|l ztwEa_or>G*dsqzRqpL@E4|qPmbj85cahBGFT0^~?yPfFc%U@KtzqYF6!_Rtov>A*2I6X=Z79SQNGdaemig8$|n9J&z=u;5En!ph9c-V z!0O$}j$re>8z&A7`&ffJ*&b+pU>zWm`|}fH$ziW8;j?I&k)??tzcuc+0MPNTzHJAu zKD0g9+#X+X-O}LpgGUc;4Yp=etFIl~J?-&XS8v<9eYJJx7Prs3YTMo&tKp7a0bcfX zfI4DDe~2k8h8#LkXEGsN$V=;W-pj+{Ta~K$ROhRwrSk2fL!`7FrTcSW04=^%rH4-e zfpuE0-mdV6WX{1LQp(cn0DuDVGWRt`i37>6qF?{``v8tGf*K7gR62_UN3gGclV>&& zf*zRnS^wwKnG)m8h}j(z&b1NpHlE|E09&4KBTxvXI7ZiB7&_VGGu7EzKzc5Bm z!sSlbIPB&dlJ8kY*t|uXhVvXoFr11jtZy=R`ZnG;;YM%wuUWscCq%0SR-sWVL=!L< zbtZko_*BH24j4IuEZS9s&ScT63U6UptbZ-w!zDl-9R+;ah>Xb|yW^cnNB2og0qn>o zjLKOM#KHUhk+xU5n>v$3I!#61GHf0AC3T5{-3G>{+g{0+MjIk;wTJ4LWc>yP{Y+@%rnP;M#Ii$!rj@&{z2;D=a{>qliqb0K z8IyvNQ*zl&*Y}ydu8!3sj+966STd8obbm}|Pqyb;i#Gax(k;pQ%S*C84P<=`OP|m< zVvKhN#g7>$>)=1kNj%4buI#Dz8CW5+ZfNNZTly1v z{BXxTAOFN1hgWC3?aQVwPfvdD2mg5Q8gKjL^w#Ev9m_I_Wjn9F@#yYI)AnVlk!wEv zxu>9<|0u97KSvsCSeK(Y)(PA2Tb7Y4%HH5S*5xR$F3)%SMZ@YCUks~bzbL%v(i5Dp z=-Jkgn3<8yONMB>U&9-K6n8P-0w4&5xU(2le*vssyWHOtM%5E9Xf$5Li$Lpgt!!OJ zCF?SlW3pNUPRA!TEi-7~7`?pgVatrmpOrhaCF3$$G%jP{O-ob20DAz~mgSS2*S172 zU|SNBZHafvp3}KzvyR}*I&}2P+XnRNKyO3yw#h8V@C2>oxZL`E?bFu|IXF+pW%pe6 z4i?lZcPI=n<;);*?m$RDJzJl?X|u=FoN{@>UY*D|Tuzqv`z(!1H$}rMH(YV_?iDYa z;OZ;q&){DGlv}-MVXitSy1oKN*H5A((uOplM2;PrO#T5z!zbC3XcMAC%qVe;DrfR? zU-tQe>*R45Tb}{*DPes54^n)668Zp}j>GUe_~dxLV%92e_9a`G7jkBAvox+a_`uZG z2b)w%45y?B`|!4&WpaeQ|8|WQSFpU6-93DCZF=cccKc)t&u|JxMe|)7_QD8z7)IE8 z*0)&DM>E?uF7NQh7DDVQr{4)f?9h`f2$TVa<6`66+Xt3;!(O$9bGhvl@Aq2#y<4OZ zyBeeF`d0yIqy~uNEU7~xNTQhUqSR8+Siq*>-OCd3Af%0;;8&DrgFsLrBLFDKRpmD; z;N8#X1ppe#?uVG63NkE|<<~M2QHU7MDpY#)4_bkVD4%GAw$8nwR}-90jcuolo;sH| z>EN)(f22|t-o@sAfj)+QhWEORh1V##bs>d%1d;WHV*)l$D`|qHRm}VUV!*yVw;b{! z4S4Z+QUz?pFPGbh%{eZfP$Ni#8d`@lDDpz0E{@1HV&queQvM{GL=0eO*I>d0=%6iX zJJ@c$XeFMIEJQG0j?EWmgoa`S7>Y|FhDaWV5TZ64E}#f)g%13nrs6h7>)NBAnocYo zXfdf&60~JFZ`)Mg+K;SHnp(Cmairq`omHT&Q26bbL#@OVEDV{q52-yKmwMAj*T>L5 zcV2h!vf(hJF(@gWNa)OFy~=1cwo4)NxJ3?`tKBZ0hBBHhI^|->yfR{bq|7sI0*C^^ z>T>G(dMls(Lkzm6&*&$?u0<52M6#vxXXQ66^^|O#|5lDsV`E4ws>YG8VJXBl|8FP21y_6qOPx@=;;aNMtdl7S z7IN&$vV)%`SP=yx6P_w!%`ws>7amcULcz^ztS7*2RvCy`Ct2yvJbOMMQZp=HZFmA0 zYYw$cWLlruyWzttL*S3r@r-k5#m2_z53dM*d3t;6bSTu3a_QNP+uEjs!OoOh&)|>7 zuD|b7AOA?YZ7{Rto+q7`pPddv4w1g}(-`y6v71?=8jR z0VYWx->yZ|6riaI(liCgQ3}%|7B1qaVW58axPMtx1RMK!4(Mh1V3t#zbFyW6>hxly zUZyH5Pjk_+CCYvk-YP}-ho8@byJ_k6DhL2${I$&5i--AnwG{JXQPp<}Z)$W(l7wJr zDXA39S}Dx`>))xktqQ#n=z5(Np5Z7c@gLt$lL`&bx!n%>n>ay0V5E5OZm}5U{{i68 z9^^N*XxUfd&ptqe9AL>(27qM-yX;uAGI0`3AwI+jag#;t#OchWkb{_Kkv_FClSJI- zrD;FF93>)u#g~{tQ^)hZj8g_&rEzrbk^t9&(Mwh$F5(=-wXBG^8k7P{;=DNzqdZSeR-B+d4N3`j^eu3?`_+7-H@I4c3yt>mUpp`RwdysK}u_6U4fv0`g*V0 zwra4|Xlg2AFIqGhbRxz1Jm$t_8v**72Iy<~%VwzYyg=i92dvFnG*WAA)|b|1J>2#) z5;CjIF<5?Vi5lp?Mxg)t(ZE+b4B*F_g`kQZSyA@~m>w`GsjwWia`D8Gr0n}I7D}Ik z&x$Jtzw~dNdto`DLTx;jhmnQA3wdd(k*o~A>#> zbK~Tpk58x9Omta*UWIv-G?N_N*0cO5%wo8F;0}$P#lY%CAIB0R4RjpuYr?MzLCaQ4jbc1^J>LEKy~OL()~}bXr_Va4or*eYq^^ zOhaNbIhZr4T0w*LN_Ijp1h!sz?q$&%B@4)kJO@-3mRjjMKhV4-9>^)nhUw&S`O>(B z1(%1HXK^2LBi?F_mt69sx{|l6 zI_d7Dy85m9J&mV#yG6p#`4ny&{`&Qq=ujBVJ3-)Bgu8MV zlB}H#_t*xX0k_<3R2}|JE9EgR99W$5wMCYvxw4=(my6Zi6hkPY78xl(X9~?KL|4`K z7J^+=frazR)ebA-J}8R9nbCU4S|0NTT~%f^0VTi=$dxusS(r+21TCBVZ{p-(HDth1!S`_6blbuf$<}>8Xl8WOK|3>{+`#D^EVgVd}S*CP(L|K?8I__5Z?*UX;bACoWGA0-f335k+Z8!huFc*s^h@D*@m{; z3oPtnG%G~3t-bCy#+96b+tRk$(_DUZbeTx#OLetEtevGcJNkt|mwlVbpWm*APwmNw zL#M|or*^A|wf^jq-Ox?jXF+<4i_Xr_9D&pdn(&DdH0xGLYzuMRR)5r{W&Jq>a%;Lf zFo{{zOG=WG-u;ZD3|GPh9|~4@?UfE1BYeUS7rmmVD+etoLk5|^M2y~?VpeX|8|3RC zMwn13D1ps;zbw0vDj;a)f^^A0de7$w4l$D>oB}kAky$WP58R^eaP~;X-%n6AG*U`s zZl!b*MiXAhY(K^EH!Dj0{-r}XXk{TBgi=-tID}Gn-yER_OHK)X?e9Vx1!5nw{%LTt zQjS{raIs=2F@%Z$w5pEeb-0)X&aGt=^x$6^oqa`ZRcqLA<_)|`C{Mhv+jS>R=Yfz1 z4;klik_eKgXVKJ|TYG<~mkr;1{6!(z{h~PXUHSQ|IcxB%i0fKRyAyKXu8-^QP*1K3 zywgFxX`Wxrk+S(}cB0aF`=u)LDdMwN5VnzbAzDQ;Des-?E-l$)T-9wMjV!4 z(aS0~Os{s1xl=S<_$`}WTgRYbI0;Arar788--Y!0uKXksLfCp zV*Qf1Z7SaXuSa*bQXevd!L ze*6gHqBz|tvHD`zxm9B(OSJArroheiN?69CmPgr{8^xQn!N|~rrj#nJWSgx;+XavA zMa0qQ@g(g~4fuS54WK1QFg5S8@<*d7=nLnQXg2lSaAil5LKN1T$>LTr?w-;54GHM5 zr)f$h>df#Zd!QlQEMI~emOy6Dfp{6B?ME!SF~Lz)6mtqBvmSSYP@qipaE>C@eaE(* z+}LDY28;M-uflZLL~~+|M01qux32h6vtB)EEBHh_-Ht}sbnc2BmQf1U=0R{DDOW;}x0X=z+I&FM9lL5@xn6y>nsUWzr99-8al*@?mZfi> zT`QH*O>LEM9Em5f_+ep=0f8WvlG)w;QfdHdZej8Lc9V`bIh{lU<6&>zK55Y=Vnt)Y z9wqb?0`4HuW>ieoT`{)7mu293yIOaq9xQ9C8rcY5s7{n96}drfEer20=UvrjrmiC^ z8`(5a)<@ZuKCcqI$X-vA?LVG)p*xc{q+qi!na`0tw|W868KqOm(vf2{ zwXRUsq1UFF)CT1Kg-)5Rb-HVa*s1@9)9l$Kh9IRQbmJeIg zZ$D?V2;H%i_bnK2v1G$~8?Nxo$j~LZL-UG1JK42&UGUOn%O1W{K!WNO&UfN-=F&l6nNBJH>kg0*UlP~T4Uf7~C4EP$P^VW%J~Ux} zcVYh~=k3^&c9+4ar?Cx3O2arNonHhlxqJc{gk7POTZjsC`TG(0<2f?T{Be@};$t4? z=JJMfJ$M>S=mQ$o4~b9bV&+Gfk+>Bhw!Qze^umev+^dsK!i@AWAqBcDo@AYDO8qr-I5Iq1ll_}Hw`mrus z1$QmC@o8tttM2pN^4Jj2VRY+^)$B_WH8NY=to=HQ5pFj!xMJ=G>`D4uy?sK4B-CbJ zx1aJ7msZN+@ zA?)~W&JuKEn*>;Bd6|BXh(x6(mAoq_b% zB5AoKaFK$QMcC@5Q!Yi5Q6WbR5qfB?=@MmNVQK?|LxV4qrBARz%jw!C_XEr|J2_~C zHB$o$okORJ<|gdiJND1#>6((&lh^W=v6{4-`pu`%GOJ?XqJN|LbcwKS%vNI(Wc`4B zF-h75wdY=ft=?;zm{k(va_u`edOzdZ>PpLf*UW<#Lr&*Ty*v}sDtIaU^{IBcX-0k1iM6?_cNic zzG$s1w-41JljtEHp9DmkfytSfM_1%misU1Xv5qh2$dke+f`CE*+i4qY17qh$XW+#AC%T!JjhBnX>;=n0%)htFiLy%$dV{Nw-bHxo4o#8Oc!p9AaBo#0d~|xQt}Ut3XbHSX`=nPvT}hSZ zS?5&*K(J&I3-mNXj$P;1lgB~~YKmg;*>Z6WoTM@TxvfI_CaIgQ)_FHZ{>a%+W$v4cMA>yz@67`KiUN1LfF%0PXfuf z1mFY{KziTFvkZ9Z1%{7npf`t&>LS z6Z46!__nEyNX|EESJ%$kPoP}B?IK4wgfrK?8^UG z~L>=M^zJi`nc+?`l=}Tj#fz30ViM%Ul%}Eb_WV zJs+eIU}YFdtPKxn*tM6lraY3S(-cP(oAUW4=UQJOx}BEW$TeN6jZyhY*x7~pQU6Ax zX>!=Ht9uzjfWuw)I<#C-y7`v$8Ekfmb%{0d``nwvrlbjwHAF zvyFVcG3t}q=J4I^y7qK`bMyjeTU!~LxP7>Sno(U@R^JKa_dTe%TSCoWR1U=W=DVpV zyMqduJK@3^N6eB;=6ex#t6I?!U0GaSp7ry$r@s=Zz)#t_lJjj4gh!2!`4-P$#dXe|J9D3rHGZlM{@1X^BNUSTWZV0nDQ zK2Md?zb7#)Lv_fF)`)@hrJ{DlI9>?Jkzm+Bwq&^9c})(~usSs1VOMzKI8~!AD_gC5 ztIm%P)RSLovF~_+>B`or*)*T4K*RPItZe{HG+7OHd<0Ok+i`Lk=;Mzoox5KZK%r5-iBRzSX_mm# z*Ai?L_4)oBA$oK-8$XHk2ypfNq(CvR`F*!!$pV|&`yLF37ze9Yux6rN!NH*-$7m}x zoSxci(6gs`502W_YWC`Pno3594roPBD>aM?Yc)8>lL7vbe|4F2;TZIJ8~LXW3Ul>^ zu}ahoI{!@P3jCDFySyT!(-8sY#+hL z)n(PJC=zKV4&c@3v!&Zaf9Mz)&Y)+Q%S`6ZmnHd^V@#`-^n0agf!D#K9vtlX?r9{RT(6krji`4|!ev@R}dk z>W8}~Xc-cs*OXnQ+E8@n0`D<^Z)A*c5c^!+O4+z{lbRDU@WY9I8K;#PdLP{pk5BVC zE%s^`JXi)Ag_i1}n$3{Za>NvoNxkJ02&B4zKhRp_u2Q}zRq`SFa_c7@nH-)R8JV8H zxr>O2Ud(#f@+gh&k`9g6*Y)wUc}s_jb7IL#77fY{Lxa|%c470Hj-r;b_Km}%odX>* zl`C~Rm4bB>ww(GxN^wAWeSOGxNJjh=7?*Z5lJ|(WFiA=Xw#vY9NaHhK*ayY#F6|{1B;CY}JdPA3{-S&aQ&YJg>1j^R~ z!OJt7YhC2OO@$Z4YO5xghXYD56ym5=Gg%=)2-z!&M@n?YdWY)(@Wm!f_* zpCh!w8q@Uke`{ykN0F2MOj_>+#hAQD#C0)8rMpahDiED=I9mCDEQeB3Jcz2RCjL3l zl&~NerY`9DA}8qH9*4XY7=!htQ)y8+ZniB?2?GW86!$nvpEJHNiWjFzmUasc?y$(@ zh;g8vjz3oac-djDJJ8ORS5=OfPAd5kAxxFLLd%ri7{<|)-g|JCFfkK3jIetT7?%un zsNA}khcPf%QwgiqM;Ay&^q6DcF>dTTR32PjHDtqqj@+a>lGT$?XmMH4%k4Q5)UlWd z(vQ6GQwj5p5_NK?N?K_uvwgVaLz!{4ufku)5Exwxq9xbQ!_U_*<|k#}gUDQcw)}pY z#XJx-mZ~c59@L;HaLwMO__H;EY z@#_RU#0p@a`JEq3^Bb%@7IbX1Q(pJSq%fnro`4Ma$JgH2853B}_eO@WdKq(D$mfP^ z<6AflH|)I+Ac(MNT}6G~NnA?$ov08rl+wLC5?@@S2a*YSuUe?E2jNuSdM#|Y)to-- zo_*gE!;WQ}NzjC%imyn^=o#5%KH`iN;I*llMTut3B_4aRYaG%vJ@To4rR-*pu9lMu zD~+!X1`s)ouM*4QP_P@DY&8F*T=7&_F+s{mPv909K$#+IY<<^4tiSrT|81#r7kaCa%1qxx5TOtm4R(nfV=QuVB|h(JbV#vN9vJ*Zg$og&*V+bpT_THkD*1;SNll*1zjDxNXcAF+y}7Nzi2LiHCxIt^w@` zHZ{dQ3%^c-?WNs>eF84R*1ai=zY(v4Vyfq$-ewC`)iEBMIhNpzp12rO zwh>o8aJvL=4oF7WbiH;05qxEq$`z)HN*DL=^anBhm5n^TYB2xbyp8SR2zIIc6mJF;_-6s(%#!YwD{^STAZ%eQC=4-5BGYr z@t-54_iwZ&a>=!4G$#K|e83o$l)m=1j~A2MbowIBT#{6}7@@Tm?*zf^#^K?uL*2g6 zp|1b@ZrB(a8VYIxj*#)x?D2Oqq1z zxcr*lj`nZ^rBkrJ^d2u$-yn0UYiu*jg-LY8utm2Hm7=Zi6xWrn!v>~SeQuo^P|gva z^aNJ|s?lh@vA&s1hVv)z$oHe5xZ?tK>ubH3+N(}b-kfE6*B%`9POqlr+!oEkr7T7) znA-X>va;A4rF^5@lw+*o@R2wYaTg1I%WAWy$b##ZRl(X`Ry-@u)*aWBj$vIrII^L!efQB=1CEX>MQG(G$NL^j#4vh~M9T8z|2uoUy zcyVbaZxJsDM4he%dUd&Ros&4=TW0xvHa+t`3@EO`5o*FMBI}<;$C9j-`6v_F5E?OSkysjC>kM&|4D#ZTOt5C^ zA$**05Vw4n&^9F=T(qo0?BsI2&c!MvGrhTy(Z^y;9>YGMQ@m^tz^asR+l&9xYwYq8 zB4)FqWXm)rDcQ_<&hiN9)Dk94(9BI-7eyILOvKc0`-?bf3MA6jrNwQ4*yc*wxKo?m zDl7=LUMyw6Zm$53Ns?HXgraqaAaS|Ve=rx`xs$j)*4{T1@^$}UybB!@UW|Jxhd5J| zR&XK{6*+xw{4j+hl}A<6uODNc=sF$%B0wznX?gbd^k&e@^kxVgd(FFTLCF@8wkzn- zohd#Lhlq;QI9s@Mh6!g0nd{YcB#!@eknDWbVTqL5(xveSf0ZEFa8QvMY zoMC~T-V%i-+K5g?(;nja$i24w`RBI$he7R`K)yy7ff-sGH;=q*V~pjQu(io#B!=4B z{_f<6nm2k2iy^t<;)_j( z!;oIzbZV;*GdKf}Z5DipSY|ekiT41;`g9^@2<>MLzD;-Krzsx`O9B)pR1tQVNCqc#Bmc9oG5gCX@F}C2)b@nV$?TTA zZUb7Oh3Q<%RwbH+rSC2pU%_CgIpXf$O45`NyNzLXR@tEdRYX|mHI>|ve=A8}p4&T~ zX|+2{>W8TK|0c#Gc&%!F$LR!jSKQXLfPaFsy@;gKMNhUvM3wS{&{|NV4UY9fnsmm^ zneuMWpP@`yad+hu1$EyRPDoE^UKl+`KB6!uR?S*FVVQzY%mY`cOPX*m7B7@j}p9+ zEtVH+R7D$@QD+E>rVXd;JHD$sZhUuLay#t5+t(Qu`D#0Qe*We@%@C~n4WVslJ z-tX#-LRTA9F;Lj)83Vmlir-^-`BeD2+{PHnUmR1H38v*x0dflnAZ)1XHL*w>(#L3%i`F|Sm!zD&HnVtg_RcxD>V=8frO>#WJ#8fH@7b3=-&+5jf5SA zH;c$(6%ij+9$sHpp+)DcKlfEFs?&$5zHRAc68(W4N8e}|7>PJzx*jn>DL3AV3K%40 zj(s*0+TY&?=^BrvO+^Mv@uj1tX<>e!IX&w6O3|lDDK{-xuz9OJw7=a0qvsaE<@a>N z4?Z=#+H3#)J2qN-r4>>VtfT3usKV_hSrC;MHPtmv3NpY0|L&{lmo{~F9 z!cdtq!@92T<7{=tQQ%zJbHpNEqDuXUd~5MgQ3+MB(_OeydB*nnn&~-3vCHOkPF~O4 zy0pX0x~S~!=qIsN{ngE>#4>+BDv|Fy>)^4;pkr$%PxZ=LvuBII{U!7~I)#n>76$iZ zk_-%8q>LX9X0n&$MTI@JjMZY8$Rn6)prNa?GppEBPT%JCk3TJ6B*VL$fPD{5ca+Ho zpB&TO6ri4=yU7GDuv`%Bkc|BnD?%*Q#!)jEPa@)QLPf@`A*NtdMi)%TpbcbGB zdily6+0zRh{!NY!tgD+t9V{LHAAodygT=<~vj1nS_50nY`=K<7n~R%Awz&Fo>rwol^gAqx*PR|3Fc%k} z3@znPojUw=<>L4^86|q^3L)Htne%L>>hRwX90}}8&4J5#+jSMc`&`~$jBZ~j_C6lB zcc|NWiRaT52YVkRvy%I<5AQ1UlKy!#2dn27wV~p8nQbRpC#N3zhaN)7VE%kf%Gu)qLUBu-cgI-T zp4R0gksV5PoJ;b^0Ya2X-?IgYV7H zxP`sMs-NKaeW7>SEHEOhXR_@=TmF?%en^_Bmg{X4zaJ}fG922w7HCA=A`asGdDJ`pjZ{$$*&zz>Nq_IxWW_vSX)v@)DOuABMnOU(SkKzi_ z`guJMSS;66p?6yU%N1Ia%ns$otwYMaSCNA~8=4uAPwef9oWOJYTzTzS6~$7R-GUu515c12mSw3O|vW<>sj?dg>l0E|!v%s+cv%Xto zgYQO2cHP`uuu#jX>){g$-!gDtp}dO`hPRen$%yN9N7Y`YBJQEOkJ6ATvW``C(AbRH zF*TJ)_ak8b<*`xUA+=L0?3AO^%s|hs7kmwnT1lmT24JXDtWvxukEHH4=ja?-*ONFl;Oh0oJ!MDDJU)F+BP)% zT|r-_ZrMmAgmp0P=^pt?#>@Ns(0%b#VCOYzZ7pkfC#E({nDHkSGT4gTk(Y5kD>qCQ z*up7Y3{%HTH{-_e9u&d^xT9l{xKr%1ne~Kw@6DW`Yfe?Ke#tx)db%93W!uFs)#EG%u4a9%VpvVcO&2Y4eE9=*-nNX(*E>V_0Xx7FzN*_K41SmGs;T&4EjN z_^%bZJp}>#*itl~?2wP{2C$6nBG1qHa zG=>qI@Uw{!Q^N2Jtt}{ zAOf2i@?maEi)x;76+-_1m}MTnyN9SMJ*$(LFD9e3EZI+zb7=*^Q!q3va5U8oo|<1K z+ZOca71C*PO!D=G-lW{0GA6vKSh%2ZGO4s*I|3e5HIn__(i$|6fuK~=Xsw~H;=DPQ znjy37TU1;#i&j5}1~;p=qdVAL)tgc?2cJMjbcd_qW+k4w#FU6(au9HOPK)2^K8bJRv?8(uL~K8kP(q z_5do)T~02r_FnlTELCx{@63QqO1jat`vA`PCA#=rr3jx4ggNGnQ{`e%Up4Yssr#hve~|Epb$!?H=JlD+t4|j%te5DA0auC|l~t(HYb( zrw;j}J*qVpiy8_yMLkt>ScJ5S4oGo1q6jnK@(jO4f7FtAStj zu^%O1*I_x^!LvBBIJWJq4|Y$iMzQvGbt;7H&91TVC%vbB0wE^kfz_`vZata{twwpw zesoG8cWprL4`}?)ocUBe^G=8M1!%0O*{Xx;>yj0>HMTYGDo-Ml@5gUYN{h==5j{)( znD8z>KPXc4-M*pSzPR}r{1^>n!}VCb${ny^PM74LrB20~_luuk-|h_~aPW1sCHJC> zU~3mcHKrh1nyi0Yk=cGl!h4rEpuLVP<Og{KJVCF>pF$(aryKwMpGf2c$Kv|n+D)ws-P1Il`v`MXus(c}4c%$LBYaE-V9 z!2+y-+qrK5!XXc@kORlhy)@aUAtHNPbvAQl^4ulh5)>Fa5PzG0JNLExwZn;cuuID` z`n_>^f#h)LC+0wgXcOk+cx(FEH0U-K+$IFyJOg(8JVSO|ozdZY{S4dccYW8!fcMYO z7WaMalO?n(w5ORd=NAK>5^g&8{de+`hVMuDMfI|Q&-p1n{4-uOo*t*y=P8}U4cGf9 zpr0utaFzSh&)#eI!JGov!$>UN&&vTpcAmVf;p#+RH_9B!14YcQP0#E@ z?kTsni(2^q(CrV5?#!m+ypm`F0at;_x=Y#=T9Gm<=$=yj2!(?w|{s1 z|Dm52|AJDu0AT2C?S=;c=QIM=K;VjP#wh9%R$Xm*rhbBd$>`lXRUPSb>iEAh6{XH|O7vCBlA?Zt0Jc_Gxp+VR z0T|tk;-U}&N2_0COm2?h4%BYcY&Fdw?>0-b6bnn9bC5wyvu8|pL$^f?9GOr^^WtN}F|x$6xof@x{E%K&uL z|JUeO^)XR$(6VAWS8rO-C!#J<`AOb0>SinuAEZpuKt>R9gKlOiD2T4OQ)X#0XmK5e z3lAJu*aX)o!XCC$)_`$&A})bY>p@?dg%f-v6S$x>X|97A`faVIIaACyV!LT zs;o-Z7*fKzk#4M`4^Xv+bpxnL<`5=&E$%Vrmc=-ZRn#p(|0BtFxc>es_AG}L(pknY z+&WZ_pkW`~bWmNqy;=%?n1Xx}Dmt**Xi!2A_DF{9oIpV-pcaC|^%~uw>r9Qh^=;U% zSeF!(W7|sn>^fOC+KL9Eis^OzxWPwRBO0+rJjt`r)D7#Lw%CR@&2rXyYhyShN`ij( zqflg_a@2_q*l}5-KU=N#|8R@IgcEkfl6={3#xSp<=lvMQKHVc4{@D#jewXD(}D;mR?#e$qSuZum0f=-TGyKXb=Urz zwuCT-sbb7F=KwVs-grw6u>a+}R>)0?oGkp?G?=O{zb> zrhe6z0k!*xI`lGPRdEHTOT(A%s-+9Lr^y=YoyWM$KW`0m9~bm21of?t7V5$v+9jK1 zmi1CxDAxY6TZT25MxyBbs|2&xzmj8IDs$)#&WJ3FB;0Ojp6D@gy9B~o-dHD4Kcg+ zaF*UMCr{S*z&SBlKF~4V7~SO1JJqyC;N~iAfR$YFAxku0#;Pop!ohlb@FOHf@E9j4 z=sNvG+??ug81n)FJvKoyKG*|5Bi260Y%V(W>wcXUUo0f`ZfXH-273nuf1VGiMg(Cf z_IR!|y9eG(QxZ0IWlYnMyfBnZRl!(WSXY59b>7UJmWaD@pEajfzrWaW_ltWYgX#yM+MEX|17fVyVQxR} zEuX%NIw}ItFl7v~#O11g|S=|Y|484j5c#X|R{Id$Cx?I8}61jCW8 zeW8{YL9au-@-{KA4%TN>p zHR+DsNskk~MY(vy#UT3l{$Xnb$>7J5Ugwa0G9*U6b4WI8zSlVZUy`ld(rMK(cE* zs8Fh;aa|cWbH;qA>s*4e4bN^>#X0sQH6zkn^@4ipbW30dXQ3pzBHA*a@7G~-`9(ma z`TAj!Rje@%Ce;Nu0XoN)VEvnJayQe!xN~WnyI24>N&;o>jC27%dZge^kQp~xmD!GV z0ygwziWFtikrF9_09sCs`RW%tFBSsJ9w>^Td7(Uyw8S%68YQY+hLjB)D;$xSILNswpQpC5cNzK4+3_Py(h0d8F*N3o; z1Q{0lzjn#+!JG4q4O7x1^UZ+{_(!FJVg>I^Q8BrLG@%(E{9kFUV8*yOQNlos@;%L@ zpQotio{hgpggATQRSeGTcCT#-J?d5Cq9BTe8~k5?4I&iKRZaR3zG05TiwnWVJ5nm0 z<-(+ZBb!aChMmPo6pp2vGN)Kpmm7=tdlosT)M!Jol?%tixrCP=3e&bT;D=4os>(@_ zjKSG*##cfkLo3>;{-(#2%*%vQW!UmHrbjm!$fp9|sxWmIJrPWUnbai)4FbNS#2KT6 z)K&=LomAySG68`RU8(cLyavyggzN^%+f)3*{%<`+`xw|Hr6e(`Q0p$ZCCfBLu@X#9 z@;(qsdIk(R->5QzkRC$$00&TcW-b(j1v6!4sQ5rUArD9JWljk{_Ae4@xKyV6wXs=M zai?BKB5Nn7LvTana8q7f(&llFzj8?J;p587>!bDobK^%*uK)!?J3WFBJ;jyP|R-6Q`pz zg{H%j{#~{V3TyUY1q3NiqYKB6zuo#f(z2q#tBN0dl+UW6C2d|%kWC17touTNp zC`9mll#`()a~_Z|r0fu|WahO4z~^IJhn-MKV_Hy-nqW~B!jxVTCPv7%E2PPsysT1L zA&IQy#=hj--oNnUaVCdI1Z5#f(jtUChZ-*tz!E$C0aut&e$-KTHR)-dhRj}+L2ZLk zEb*4eZLr}FM$^&Z0LK<&mePteShL^ugn@IM*8K6HCeVQq%GvY5pnpHBN)oZKF0r#M zajs3hB+~Nt`tG)4rs0c=>_Dq!cqc_~EN6CCDM83WHo(O_7z6cWH+tdCb#4ShL(ew( zSvR?u`(fc(y1qodx8+AK@GM_q-5%jxS#Z+NHn;-fo;=`N zUV6(2mUy`TI=cUwXE!gk^K5MKncQKYgpGznfQxYze!%-S-KvkPQg=;LVUib>Dcdvt4A zelB_=SrTf6bB!kie1?q=`Y4&DXo5)M?*)<#3WLm+2tc9?s2&mLUTAc6ZGQW;0$HA= z)vDaZ-`36F_DyBl@vjWc)YaJSd4hWW;h|U!e_p0oTlpWQN<2J;KVOEs>vLZuUj3JT zuE;m~ID%2#zE^H7^6m4~-(GrtJ*{cIz(JeYo4U9$4yI=R9cLnB zW9Hyw=I8&POL=BpWkdYYSz5cD>C%{}C;QFtTURHij`p|NDpVcs;cB=EPjm9B(O^C4 z2Cxn?HddSEuZ6z#2Vixxzd{8_t{lZN0)7 zMvd>|U?TfzijQc$YEZF3SJ#u!xJFfuKS(A*PStl=c_<`l%xxu(In^lZ-gCJJ{_5uo zM1HDcYC>tzn(RmsY5WywJZAnR$doCh*I<-#sf%b_)xHCTb3uXuaZNDULtH<}A$v|K zWR1#wfNb%xSq)f&|GjB(xcOtFWlWXwA3Dob_%u7LXSj4pRQb-X|D%&|i+4Y~LMK8yr2HTH zdXRGGzXeU?KqcQTIP5!Il|6ckupm>a}&$Y?Il16FIr-1M0`}r?*(3&pZ-{d;Bl?je#V}<=Yn>g}E)^V?Ce^5tIgU>;v<6H#zw{^5#aQOG?Bu-$e`6}nZKrLMN30P&y0F(QA|#D&U$yw znXF8d`VXNSr7p4&he?kGJs}Nyb(P#`Un>&GS8hZ}E3C4y$z)exaScFQ~{Pya2JjJE5H&qMA{XrCvzY!8_ zT(O09t;J$!w}gQTThBhi6z!_qQD z-$WUKB0$_Isg}it@+dJ5Y6=1+)Dr+qJ@HaZYl=y|cVz=!OP^r$MOv3e13vJHc-2NT zpJ-mlw?V?!un-Chwy3sDbT%_wH+lPPR5uT~Y~dHNhwvC_ly7Re$|P>(amCo!T(I>H z(VwDDsd<@Dy}YGnj_E)EOt!fQYXjbI9>|boZ8`jFmQb0X^#gnr)k>T5AMGv#cfPWA zZC&~Zxr!%5TS>4z#b~M*Uzz7&{+e6KPlc|GBv3WR(F=wXFxYO=%Y{5mFwaB8FERMb zM`)E9@)(B|wiUcA6*heDKGm=TxS1pqtbGax4@;I!1HEGKmp%imvV&0IDmX#NvDs`q z;% zQnqylBO;`*Oz@~+X$hNbH%sg&;qSb4Xli0fa~yjJ7WMh`vt+6wECt58r)CJ75`%e! z(L4z}rf!H3$Y316;_tb*-PC7C`An_#)cdbvJ1Xh-lf_y;sOA15pmq|pZZPB8Dq#XA znu;33r#0)3&g&S-mR1on&83z=diywZQsOK^MQx>dqo3`BLvGFtJI4;J^-FLjCEE?7 z+>AB;PLr0Q`T+|(Y@2^$J$DultPjYO`TDlx22P!x&_*&MrY<+caK6WU3=znt3Zf#2 z=!_91w5ybpwRy2$o?))2{;)W`xQCZPQlHi9!Q`Vr1B62H85jSyQZ9VmeZcJ>Gpxo@3$|1?l> zq(il81RX;+ydD{2!n$iws#IIpsZ$&;hNUmyHZW^gOS=HNxTlavP79EWY%q4rjAn zCj#L51Z_-}W|6Vn#G{bC6Ubg%Ia0Vwl{04m%?i9#FsB2@jlCs`$(XE!zzx@oWt26i z1w$oP7Pm=ny2bEgMeyHMwj-5*Kx$v21<1~tgJ&pBAfxfOyb z3QM?5v`p+y_>O3UC?M`iG%fl_*p5_zlnomIZ$pDrfp|t6_R1OrF&8N*Rz#S9Bo!ta z1fMTvi3kkvGsqL^4tW3fpi7tq(o3GW2g$YY|6=bg;Huizz2QX&0>T0*=~OyaumU6& z9nvTu0@4lA9ZH9!pmazXh)7CGgQ%pWbci60bbM3y+57Bscbt9Bd+)jL`~6tJnl2%09+i4vp{y252&s7xfqHnM1h2#c zHbv6bFji@r911XL42x|G>B*%HmKmIu!>|U{38~u1JtAZA8HSdzuu4(~)(MH)Xb<8I z?iscgo-lDXgSNfrErl>vZc-xB`7o$7SI#9PiSL@We_kl$4!vZs8Y{)6CjZtjAMghM zj6m3Nm^-Nh%Y=08U5`s_n=C-5a-@f(U}Me`#to5{V~^WPFA?F{mt;SM?VX#^Xt^B5 z#L6gfl!l2lS@&gfwHuA@coypqh#;Ht^}Ry4clXC zaVHg*;FaQ)?|w0kOszQe~_+NpT%n+omoU z)6&V6xRGwq%xJb?wM>%vOC8Zpo_A-qmpdXX@rHi$4iLm?AZB=(c(<$c)5GDk)9?z> zQ^jt7GbBcc>5JoHI)%j%Q2{$F|OZ%~p5FTV2N&NBO91?L`(7c0--OIX`H! z29Ba(_%J&8n)011fyyo9ji zV((o`x#tpPEYHIR71Akt?peytu{r^60>MfYhbE{`n}L#k`J3imCCJE_iRWDoV3Irm zZ63y+67Gw3tVx~_c^t`f2uS!bZaT+i1|P|FbO-Eag!tgkjj>GPd4lIM10M2Y%UyGP zm{sB*cIUBC8|mXPvLK>qX%uPmc@g9DC8X-1=1+h26HP&d(ubGG6oar?3WnKSi1ZVb zww6~Zs^xj+{5qQ6>G$Z^+m1C8c7Czb{6w6<^+fQ?K_`XiZR(lN30!z@T*GY0hO%a~ z+5AGP2sboaz@(FM-%Vw9L$c*u7;%`1+Ua95IhJVY=W-WV@kp0RZO9PP;yK{nNS(k% zj0+o}(LE7AsWh&76sP1R(%>*`cv)D7Tn8!kJ-IvQjnR}jE_j>pxxiTQz$30X9MUBJ z&?98WnuH(Sre5r1&=KC;5K9Bz^gj2THuEXXW^*jly;|^QU@TL>k#|Q!ppW?6A@d}W zC*h_5OOQjb578Xgs_b@$0O>tBQ15!0^4{sNtZ$nR-(Uig8-XgN(5S*ORP~do2CzK6Ca$x z5>+9O*gBOHoX>olyxGuSKkoMS#Y#oOSmlVyX!(1p2D>j6*T;hP?7ZHDkGa`-yQLc2 z91>KJyQkkyNRRcxE}rPC@2v0~x}tY+-gdygc!@(6sE^i#a{BJz2Hf zF3y$?@{dwpcg54+d{t)Wy;w_{NqBsfz)^UVH)N*VuF!RvFfO3bSYbTq%SuX z4K1ogQ|2R5uj@PjuW7~O`}=r~ZB29~w1VdkoIDLzm0qvS6V|8gI_)KVOXEMB z`|4bJj=^VrFD^0D)qapt7ir$<`ka}4FTRpvt3G!{!RLDX7Ui)gzC zuga$P6pdwhYa<^gj2F(@4@^Aq)!}imL0Z<`#1sTqx8_q`<%tY5J{BcUCSP9Cqp z*|gZC^33!hEYRu9b41_T*WNFnHRMyyknJd^dfki#El zA!NOg2_vxl^a+n`HQxNxevnS}4R=g;$wJrM^~G$r$H%Ir8TgM94NY(OojWizG01w{ zQ?Gj0KQm3=NTB18@!fS=5!{y!D?SXGSr}ySwBRj^X_?Aj5vv!0ZI9MS2 zpD{ze&1dG-<7a;sttuA7?XFikAL0q*Nah^GEKu?Ri%`UPKo?{k=bwY+Tgus5?ULA5j#(Gi0D*L5F!TnhR@@xO!hXCkvV-xfdffdy{nxuv27GY7Fe~z3^I+W!Dtr@N!`BI|_b8Fnc|63v zKX}LHW}=U{mCs4==NP}~ecv~}Y5V)fs;jD3_vTLK4!lZVKTT2MmN!OU@8U@$49@Op z5iqE=RJXHx@8oBc9*(52W_if_TU@EV zP&bX=K+_;r|4~jFf1C}tR$$1lT4nIy%Zg+ltG0HLapaYZhwV>ZaP@q?&i7u4?}KvR zBK&3%ltWzZ$+f{J#B$Hk9-gsE{dsZ{JrBBF9FGty)?S5=LY>DpK)5vmc;J@VEee9L=fDn(R4;PWOWS%?Vq@n(# zhlt>{P;1`x5ycbrlPNxe!M1#_)zBl8+AEdSxw+hWmus)6b_sME1DW;|bH!Mhao>1xpxsb}i*eM|?J(OZi#pzDv#DhZ12C0@|dg0DK{ z`W1hEw>vm^wVtUq^JyXt;Uj~oR%|s{6@7bwF1%w>VoZpU`NHfO4l8}271^ELN55;tHR{h>_W0=Giw8{YR-12B^KCD? zQ;O@e_1_(mHmL{^Nj&8O>*rn0=e>Mt^D(DS-;DV3mrb&}%c?xZR!@&)bd7G+-=yP6 zXtnw%`ON~{W~Bv9R(yPs%5UdR8bXCX6m0bBQz4&iA<9EwQm4L3&4#z&)TzR0Az+`k z#l+C54*i0TBRanliHv%R>pLE)b+^U$1^LUAk$ z5?x3!%6+ianU+YbdFzyqYQ;Lc^f_y32_!Y-YLF82{=u>L^80e3u@5~O&ldSc{cZiO zf4l8Cch58=q466>^X;Zo_0GfxZ+y9wl#~k)w|J{eBV#%Q-fL}o>2Do`hj@*VnI$j1 z8+{R8im#~6TckMp#%AkTWaRr1Za=To#){le)m68Oi*!w|KK*>&4s#P)N77BH&CB

RUdg&lwsVZ9Ehk;Y)#{kq;jris)#cF5arUb0?BgMUSB6#=Uil zPh_bJx`KJUTwF+W=-k5M#ZB^e1ovd+AI%_iF7hSvBsj;vbyA|F31*-v6uvIvEk1JR zUGJU29a)lxeqe>YO`6*rZp9QcT~ai@t{QAyaWr2f?_EpGQVNezQt4LVzBOKf$_^cx zAEKa4{l@JVKeWWNxvA8j=%Zpj8}Y$dzg|o^oAiY?)%B0G(-qo-BhiLpE7zA7m7i!5 zjSUEUO}Q*NbB|IlbW%7voonfj*&hog+pAG0(7k4xgqxSVs6_oaHa@L&fooMaQcMBk zq-ZMHhzn0m+zdL0G-Wh&Hjz|2|At17>vYujosVAsd2M6fMC6X~bg*hs#NMz=muv_B|%uyoWk+LW7i z^iDVd)7kL+0fY-SVF+2_vdJ?sFStCaLQt6+fSwfhj&ABwR(+mvOTRC^Rl#?Bad~)gYRx>*{(% zsI;m1(b!J2aqF!|6~$CwD0Na+nD&bgPdk*fxaX%zyUb7Cp579Z?F&ohEziwwEufqE z7P1Z1l`-(4RqwhuPpSFoI`VUoiY-qhE~@a(dUkHq0s8_Q?5Uu@dQh{!qi4#{yw+Ug z{1@&MIUkMboW571w-VQ1DJDEs(6#1qJ2cpo{_tSe}z~p zG4oT}XBGPJ`hKt&uHz1>_8IxEznRbra`?fy{X4g{j;IXuUcSsNyTTFOpr5UvQGnp( zgquG}+~_2D^3Cj=Y+VXnWV17QyEwHRrJ{V)p>3djW& zUAmUG<)Wbd;Ta*?M>3y9&oGwt^Gy%C7YepdA1HHd5YWi*%mglY$+`NBU*mxlRNBYZH*pI-CBXP2w)fu8&05ZuYk&Ty1}@Zx7`& z^p5(Rd;e{G+;r1L;|Yri{AufGpGbvI+FSEX^yzU&G4HZ0hSjQGzNpC8GLC4u5FY0@ zUwh#5VNE-~yNJ45PyAKpy2o{W{f{!+vk9Y1qf4weQw(n5dHHnxhHd zUGBc;bfX)m{;liR+avq3tS(bbWc6n}dG-{BF)|PN^hTW1TknLhIP0{I>{FUXy4IV+ zrr1L0B`8nCl!I(;jvyBo4_Y%(o}x1u&rCzz=ti(CXIJvY1CD-pQ!#F;i=Tptot+6^ zO{nz~9>z&+skMQ*1GabN<)v$p6jX=n+C-SA-F}c(jcSbw15W){J5~1lTEg+G{lD7SU-LT8 zl6dv_q4A!`JGo&FK4#}zVE{&Xt=U!b?lQ*N`B6G@pm1au#UPBiX5%f(%R{=rD zp%S0}W3t)bi1c0MSfRl%(dI!e=JX~FwAy(H?-HeSi5 zCbKD;m2J67vkT=CZc6UZeI9SY9JMH6$I8i*j^50g;}F}i3Z+6mxY~j%s%%Qn7`H7s z#z_-c4|?`Gfd5h*nOM55DbYLnQ1#}XrI6~>`(;uY0Uy(B%kZtSEVo{Y-D)I;hQ+Q3 zejw(ty*qk^^PCY<_zEr$UiSDoA#T_6<|5gXIGa7!Yx|yJEya$KfT@Xmzh0W;c*Rw%uNg~Jwqg_4hQ@+tv{7-Gal{OJkj4VBrJ&)JWp-~R z!bU?hQ2k;LgYPx!GLM!CPLc8O6D13>ZMjsINalo|PT(;q?@!O$S(C1Q(q%|g zx$EEtzwaCc21mJ<$S((xk!ZACRU`pN%sj-aU2{>97qfsSa+{39w=W{w+MIknlxak}uo+CdM;E&$DV>9nVSHiYXX8ic!hR zfqlopyYN+;v~i1iJP#5iLo@@#y+umF7zzLkP}Rgb)7d{h^lD6JDHTde(R z2URn<__XkKW*u9htD2t=Q+e|{BPyHq33BHJ;K?Xmsdwr37fiB=k14`weH!kUI-Kk6 z9q-y%FCicKFcW+5v2lVbuJBf;&w>$~B)p{xE70lx`W7{3pdD6bkvr?~RXUig{bS-h!(@Sn{vwOcSMws4z+uK)<@MV^@N&t&SJSKwpo~kr7gcM+5T8WdmJLi_jnTSY;q8L z837SdIZE)0swI~EN=JROjq>u{1m8YU@W{N*rRgv)cie_Kv9{F7PIy@D2JOP988@BY zF8eg8`m1w}amRj7roQT3IiT~K6LqW-FNR*_aX%+^o)c;|%{gKc}5>9g!XqUB1ZI^~yc_++r|wlLwNx3~QrNwPzZ1Ws;skbCjhO%VwFJN)7|o&UTg2-$rswXK5{Oy!Wt#niU; zR)gI|9YN-uYHa>f*@yk?6~pc0&3=`OBw=ojP0KF(qQ-Al3Bm;5h_Xfxb9|cBYf)aE zdUWYLF@C##&LrI?YCNMiU@vbESlhGrH<)W9%d)=`sId)gnm~ zV|0M}g=@nY+|Y4+Ghs7UIHSwqZ3R`!ruon~EbUl6QlM5|;JnIw$jA2fy3`g(>@647 zy|2+(i#uVMr|0GIG+P`i@pm?(!%D4nccs~$9 z;T_f>!u>=RXWRov1$)It)HbU0AE&>ZqK4hV}bnm0A71e#mX%+hIhO_}Vo`1q&o35f^;MGG-&)u3@-T7Due}Tz2s0TVAz=5dEo7Jqce53c9|G z&(Z9TraKo|$Z2A>?+Q<;-#mZLH=7xi{8XVm>UEp1Gaq3){R~~GW@y!jF0C`T24kKe z+Ye@q@%R#+!>W{zh-lscbu4|$vJyG4NLRbkdaui5bWZHUiZgoLEn!I9I$sDD^{FSE zt*fz)mvv7r7o3I2*bSSW(Q_RHAC@Y3QJ=O{ZE&wDV~ zi`)kn3}FqWaCF!kI<|5kBw%MucYe4_qXfaW7Mi2VSHHBI0f5CczH$Xb3&04ba|Xu#P72_ z-pCX?7I)vTT&0ePz-O#zkz&(LAtJFC19Ra6%r7b6Y2 z?GzYkKB;184)U59EiyKA*E_AwH+VMO%dxZVR=i?aUJ;R}?5idq6tOIPFjixC%o??5 zx3t7WQ8U(({{rK9T~7O%dKt;~_RYhCmQ{li6IWG>P|8u^>YKuLMGX2pE#{AgK8_2x zxxG;ck~yrAsm?Cb3N4S}uNWO2>m&J?zYzT)`ULZMc(8X;X2>>BCbcCaf8r#XO3y;G zc-Ull<;!Ym(@xP#TWvXQJ%O*r`gSWzp+ip8W#NP6YGj9_slp;7H|y zV~w&jv0rIhS8)~jVRH?p*pEHvA#9}ka~Ra*rozF!Kt?lmH)Q0=;MV-WXH zs4+9?Bzl$qsjQN_w!eVZ{VX$w)2{=r48AuW4-bs>$`SVsjuCfhIyXhxSDb&h{Az}K zU|@zm<_+o1%5S>h&OU3qrJ(YI#ks}CE6QIBzLsRZI>o8DfBfLsa97h!sH-Hi%wNR6 zFM1;KxJ-1Xe`i>A%tYKS(?7M{Z$@mFW0h>V#czr6@QL@=g4M~Y%PljH}Y2%-O^UhcWjM3r5#MPtXyo(m|dJ)&BVlhT>y?m|EjsNk&Ba+ zhaLpjCCL2aTmP4$aOm$VS})Ne~0r2e4)M%^P`L%s8rW5GjevY=j0N& z=3rvvV)bKH($mFE!^qyk3?N7df)W%07ElBf4hM*WqlJLN_g{U!lk~R=cOz3{GyXd^ zCeBEHQ!^JM6H7DGpIOD2IsnJi)ReASxtIw^IoP|H*}FJjg$bgdf-nq35a1MwK_TEM z6ham$C@lyPL<&MNKaQfIKea;12ttAV5Ew*I7A6R^0nR}Pem_SLf)Emf3BrFI7ZLW`QU|c9%^2ZV)3CDat>3i?MUO}{=psXxfS{jXzLCQ#>P#6g2=kfjv zjSyg*AL9wh!XOX`&`K5<7bYYG&>|@)C5RG&BcVtkBn$}`f+2(uu-~-8{C+Dz8K5tz zU;2Up>%h|oKlcTLK#>5sLchZ!S`c{V0D?mP(iSfG_jRZ=@&^?FMNkA9*pG(FAW=v( z65tOa0|9V{L198L2=EOs0W5)0U@+hhE`<4U^!xfxN8$f?6ejrpJ_0BR`WLLLjoTNCX@KhfAZ;5Qr39P#S`gf=WsOv`GV-l0ff3Bj8Mww2Tl;5G@76 zNJ3#U2pCETiAG^$1QF6GU>tx8C=4zr3&BVt&;V(&z!{RV7+I(^8YT5z(hw*@PzDP0 zAtNXW7nDNFN=Zp$q@;vogwR4zDA2PkT1r|<2m+IZ3jr1bs1HEFcQg5c;NR>IumgxR zU=eWO=eu>m(ZJ#-yZsHmKkVoSzTXiAhDD$R0UV%kX(T`%28EJ=!4N1RjI1DFj)G`7 zfTo}j3XPB!LO}stghOD`C>cozQV1g?gn~&T0m`K?2uY}nw5%Wi5I`?f2!q5R0Yicz z5D;l8DOm_o3JLfdK=YAWTWi$O-{z0uq5h0iB(F&JZ|5;0%E?1kMmRL*NX7GX%~M zI78qJfinco5I95N41qHQ&JZ|5;0%E?1kMmRL*NX7{~Hhx`>DD?)5=0X#mLT#Q_IQK z*@a6$nNwOAxa)-gZo0xCz&&dynnw`EAt=bf^^YYNsPB~(f3IY4c5rnvF>_`H${PMw zFY$d<)()t^0B(N*O*I5$b#x%W7V5{An3#Z!hl`x13-DsTA1!rcejG%7Zz=|Seks|2 z!G11e`1M=-{*9WAUl(fB-G5KmBuE;xCf0ftlX{)PX$Oo8rp(6LV1_(MZ0phax-4Qh ziAi!;5G=ih-<(iR!BZ0y#)oKQ#UJp1S$4#w-Kpu%m^;@9f}kGP2JQ4NBW*QPU$ymE zeCv1{l5@4HE^B{%eo2l-wsY~3N@~JEhcSHkvR34hL*$3ftNS=}x)MLtul)S>LExQ- zKd=Pg`Q=520De*qwhm63cZ^KT1fju@Qm=0)d*c zPM%m0gR_9uv(FgWw+4*y7c$_#`WFTxZEF3bd(-sgDK<7EEAD^FvkA;ncdkzo(JOLpQ(4d?Y zgpGxRgN=)G?i?;I(ApO`4#Fincaa5x!6R2U!e@1)fZmPEKF=mu(nzV%yUq?XcDhGE zNJV{#hW7Fm4o)s^xDWz~LJLa)wN`TS3W}Oq*KcU+=-xCjH8Z!cw6b<~admU|@bn4{ z3JwVk3y+9Tc#xR%@KJI~&g0y?{DQ(KPhXXml~+_&y{>L*ZfR|6@92En*FW%aaAr= zIAplzSRi;8G3xk6j^wP+yXPq+y*Y$y@XWk@afAN-&y;?*>@GKghMZ>dbcoq%MqTyLIJd1{B(eOVX4YBU{ za)L&Ei9vLFJv~@u2ehDTOp5<`GXDRl{P^q+Z0BTn+p}=kd+=rQJ#bou>-%jU>)YDL zaPQmfS8(DK_n(|w-USJ*tfXhHW+h+plVU0Yx$GEXl@)d%tIG#Ya@cj+ms3ECd}81| z;eq+*=2ha`qi!dUvWO%7L3=6#fmCr`or&IMg7~|Me z!@G3~BJp8yOg|tlq#ud}{Y>$4n9i$z+#(Dph7 zO-jY>(}K2q-KUEq;KbcxX61cTu-`o?S1)aH?f58Y4WlRLi ze(b4TeP1spJBK7(k~t`u2@thtZopp29zisCnfv8WjLjRi#&E2+g1kZ!rjI!!17z~8 z*7f)W6*=Dd6%CxgvGRUj$p0vL`iX`qRT7W;I+Iqt;W0;*LAD874F2>z_zyf{rraJ| z)%y~DaWJOezc|g#B-L~B0Be5tz;5-S%iz#Xsou3Z4J~f}o1kZZWu$)`_dm8pKBlX0 z@Rqf_GRX=obDxNOj}WxD;zzevzmCHg?2-j|IW@LZP)~^jIqXHAKhi=V-I?0$L`K$}0|NAkMxB={;baO+rJ27wMY6Ju-nbpNUUFSoWbCM~gTeYuktK z`BzpPit;McNod$La@EdR|L+6$TQ6Lh|K(wI-L~5es?A%siPP2;WWgayo(;q`0O+ zXz&714P-~W>x1>tU#xlgV-$)c)H7Wd{iW6<7#U{4p())#>`+yvQC@{6eQ7bn$KYu= zR!7etIOP9?mE3&UUo525QdUwCKjV(ly6>b6@52)dX zc(hNQJjvdF=%rvM+2W)Ho@f(o_b)su#Cb2zEzf*UI8cJ%|1w`=(7PS^-u-%@%FD1$ zN0^>P?q!bCjHdEP76u)WAajTNlqHvyFxq${nbL zZ*>r7q-NMNc>3?+`xh&M4v3ol$a{}?%=xyv)S~3puGpI9&Xo+rh*=ACv7CZz{nfh%1H}9{z#&40M3bq?DkF~_redAq!Pi9>aTxyvXGZvo z0RCmI{fj4vMeK=Bed~20dp<6AlJ4{RTC_>z%OkH7Evzpt-;*vHugb7(I|8J&S7Kcy z4dL1rQ%BRUGj+=KtNUU>a^J=q5DAP1lADX6wG_7rrHF*9t@?*Z2P z-z0ng^SoH_X%XryeA!nYQoZ^Bv$wFzMy+ zsz0~PR+k{e2OOXxo%qCo(hVhk+Zb_2V^a_&xH=tUQnL zWNB{TGsoNnxq>_=+r&v;6i@9m+=n?AARnElf7E?JJPuI7g{A*-Gy1QF+TT+~EZ5?d z=0Ox5qR+kvetg`Y8DIz=*%6Q}gN}^H*_A35N9FyT|M(O%Q-~Eh?H={;MYzD!qJI%c){oZXjsH86&+F}b zJviXz80wh)yZR?Y5*Nh5J~!)Jh}N1|EwN!!0+i9!c-f~QKe{7Mtb#WaTufU6OX7PM zCZ{Ec#RxZ0%URZjdlybY(-LHrL09GLTo~m2$DW;nf9tLk(nA*#Z+vNE@s06+24{v%)fEg)9XTz(Yqq{`ld z{gZRU+V*cOCRKRuA@jVzso!dC9$WPa?Cr^|m^W(pkJWIg2TLY(ZrxOb(Qm+QMZ+3T zT(CA;=WA{nblcB@DWZbB10z89{-c2eCucn-uw3Ahwee^t;!P0Ei%UKwF-yKc`T&`Z zA^eg--cQx78iswxEIG8B>l?>`8s7N-xk~@Q%Cn(GHH2#7azXh7h?21NUQ8{v2N@n4Pce{u>Jr*_YMed%-S(7mO_tHRfmw>o<| z{Hq%VcCx^^wzhUwPRrZP=s%&o0OG`M{R2#}roo^ z5_8Xg@``TFkHJT{YQt{0rUp!sK<=~F^Y#~w_`0%vh$`Y^`MXAV{b6hZWAAMkZ|o(g z){pwUF7l~81(iK_J`l_TbNno0aJJuh%VMKx?{vlM+(Ui$lUKuI!3%nuSztAwiJ0Vu z+1m+^8tp30#Q4n{nqPH#@I?RnB=FBJ16>X9*JakC%GD`ux0;dR&HT^}4PQ>2FXK#d zB|T*wF2`c$A|_Y@@HM>Sy%Qv;3;$xu`q#`GCu}cx{a~z(3eN*u>X~Fi^}{U31s+)9SI?o@!O~S-bD>Koo41`yQQ&6iKPH4M7se6Cfz?@`^nuDcVMy|*yP;XD%$PaJ_U9DXl=M>DBOLF{ahRf)j;ru!v*d?JctQ{ zA1W>LhqiIde{@zI_3srdY%QY@E5dxPl(C(iuq z?Dz?b5L45*OV4;Nkjhzu%)W~T|N4~SIRlSoU3vAJBA3E!!Z(_VvvvVtE-8t~^YUhw zRYb|*a*~m{fo`keZeu0S@TtQMNtS36V#T^~gg@7q%rk|zf_(hhlG!adfKUQL{Onr) znmYaax=9k+ctTdc;rA-(MpiCQNQRS`&d|{EA}7ugACXka`f376dO-_Y2&8lMa}D{Y z6j0yK*8PVLxqYBkJIjiO`k*e2S2+6t)hVc64vy7jaAdxI{~2Yp_p=<4W`agwZ;8aE zQXj8AtxPt#TF2qqh=y4S%9!>s+l?%Ry-zVGR|4oWnQX(47lKhtUq9iTf?oCDB^I=c zlPI^oPd~yR;I0DFj$W%%5P2<2;R@L@ne^v9dy4jhxR}8J;YgbZ8~ga(AQ$X^G03vA?*=(I_;-W+&Y@>_OH8=h zo-uyE%aE?C6?MXZ1lajxC@Tw`ZqI+ErYe4B=0=j$rP7+TB#zf`EXv>bm8`_um`3^t z&_T>}Wki3g7-jI>9fu-`kSU9JiRlKigM|R#76d0w$VO<>3SFyn-J(V50L>lqFzgq; zy57gKoH!ljhJh2j{kaaTgCdKea`!OZQ+F(J5KJKkko2Y(;efIys_!RAFcgQ1;pr=I zE6)(Mgs^m0R*Iw@QZ0&K=)o_wx~Uu;X~YnnZkx38rB}^$m*e$r7Eu{sWzjx&HY8gu z9HzTG#XY&mZ%u8h?`j>ZiU(wYiT|ly{?mNnubCQ-DyFB{NA5W$e^{>GO4Z=4NXa%3 z&GOd^g1`D)&XFq^DdgMDe-x9Vy{fuRf%W=N)r98eP&hmWthYa!cZ8UwA#CTJl%Y=n zZNB%Pef7k$j6uZRNOWjh{a6{~`J!~T`{Ht5@M@8GlK=bzliwt*p^~9^!S};1tD75{s84#qXQgZ{f5Ap>? z#KMjK7kc*};?Hr69Qb);k!&!q%Xp0FUNVKI-TS8#2>1y;x_fRyN}g9Sxy>i37Z(=T znU){;lb(Vs{eUD9oc(v&{u;vnvNOZ!@uNRNWwyF2`T7)-#F6{F?|JtX6&MFeTT78;&7H9RZA=kBc!9Od_gRD>ZAk zI{K8@sN7BBTXwGmu>Bqbzy*gzB>xf1i*{c;1FC(F(5v#9vtJ~bG!_q9lWOvs3$3;Y z?B;23UGb~fN+__re&x?`GB-jad288n6nvc;^Kaic@BA+2gb@g`H$J+G6j^9h4G5S* zZ>h|W$7~*`ofH1U4D1g*@V}$!1a>P6HLs&5&W|eO-42U@>SP3{;rBO?91(*9w{M$Y z_f?s~apcf%_zE@xCPBU~{)v$Co-Wh+g`4iCBz|)15!gU4f5q4E4F-8sMv5WEZzc2j zps7c4zU(}a)o&PQp#CPV2-@`S8Y_~VUlrhI&#*vS#6^XQs*R_{bU+-0i=sy68{%KmB|Ge=o5$a;m@0wX$%`iJgmUK_ z9BbRI=sDGm50eYgQ4LeD8`w7yk+#si4O>-BXz)}Q#ZLX-@7$< zA3VN>%EBaGVbv1*kF*D;VBH~FNF3jAKdES8^fjYvX=Y-3;WjX}w`~}F7g5bC)4(^TmX111q~6DKQkAduWBd*)hbGGBiGHU9DABeri@;IvwW8GWTz z;b)UeFng0G=4lf{8O8@#G5^dI{A9Lb-e(&FsQXKA( zvZh(>nYpK(leMkhqlTyao8b9#_aFj%wjz+1+&w=&YXc_8h;`mt+4LLs1^LiJ_HT^s zz&w{<@3$gxgZ{ol<<|;ReoLO3i*hCs)PH7GA*+2vhv*{y9NpW=gz{0S+m<-<#Y`T; z{`fX)4k6xLuXg$}mKS~76+!cse`1{fj&JytquCY@Wg`B(q5O7<_FnDHYj&NB7HoUk zW8YnE#bA%_n4F#6MVSkVlw^3=cSi#*1D^A0_l#jn$B_s{ib?`&=TlU32bya36cho> z;cva`S8#;Ahn05BmBQ%bRh=a+{GO}*8#mbU{8uWH&F^VPNTao78}XMV7z49?%r^KR zJfobIDQv3sJ2KihSwDH5MKaSqTYsNBrqaqi7U|EGggKZAfXB3T69jz_=-l3v_21?O zy=~ar%9G8tI#3>18Gg5X=@=$KPt~yD+%h@}hp43Z*4)t;HVWG{>7I`OO*4$j@qg6~ z?_{4#0onbb)PF~*{*9@FUwUEKZCb-+qFDB~sfjuTnd`o^a_*D;nmM}y*jZlUbqekP ziVGlNED54NGA=ej8Qzw2IP4ks0vJ?~Y`yLBYA94a;n@WGq4Z?brI|DS z(0)0*^GX2SANBM%`?TA$X}wtxEJWs>|3O=PnblqcvnT`dWt-||u*!gzOxicm4Y#iq z=^S;fiptf2T;YGhzViumy}UBARveKjNF=zwGSBvCvgCjYY0& zT26B~0#x)*2>W;ahnGOJe@MSa&a^9o3?tta!~spmSJ66UkT12J9dTZn+s+2NT3fa{ z>1|GiV2~0(gl9}kLwL!a9~b;StBkLD2>SykzINbx6}YYX`L$WRr-811hTP@kM{^0w zf2zy>a|Zfn_TAG9_b&3*sp#kJcj>QEU&MFv4Oj>ed%3ZcZ7fFkm^2&Nk(t1*~)>Tu2zWxQm7?;i4fmN;vx_t81*+`GuD>sosSp$ zLI)n%C0(DB5XC<bIv2hc=YYm4lUmfi~~f){)k*j$tUK_AgIEM1S8Id(u}4JxkC2h7Fj{|*wwfG zLvh3Yr9eHzTg$)5BJZ%_xYfg61Kn%upQOj)dZq#;n3Q}(H;yZ#T-LaaINDv4H%jk zapB7`_**At#=zs^dBBrr&c)5g<;F#d(3g?}n)4rzm>TT|IJI{-QOeF#ec!7 ziBfJn@yuCLv!;TSho7gVUM4m7wSa*Z_*6GT;s(QbM+{X3F|5EBPpcye0%6Ir(eb=5y~)d;Mqa=eJ76eoty%Z>(~~jxuN2DW;o$);pnm-w@ZmA@t_v)=JCl zcza#G?pE4*lgGU(IKQC@sj)artSo+3p}aMfHYUBX_x`wPSp&$d;tE6DhoJ=UR}Jxd z&Pd*NKsbl^CwIPfU+2iXvhTWSo=-&;Y%**KeB>DBaR1z z6Dj-&2xm>vB}Z48?D02yqe~ zGJyO9DkM;&h16K7;p01pGo**&X|sfD8H?*(6m9poBF1H+DpK9SXY^nFO)augVsd(p zEIKpUc!s^Z$?^GyxbLBj-%|F!lyJ>-1yi-B^^+qvyuOT4&ZWdQSud|6ME>fu46VSK^Ma=yJQOV2cs)_v%XCSm5M_2d{QTVF=R+19 z|8owAgCieh^LWzhyu+M0ubtbEUryAilS2fhkHuP{IpVSRN=FiBsk%KUhnN+SngRBm zH-x;>!|VE+I`Na(X7$@V-)^zEX!JDXDsdF~usEO!&aM9mk@}Y<_(W#D1kRCy+A4L2 z9tGZmtQ5O<_q29~mbNg90AOiZHzX-)$#a=G1Bm_W?Of?h&!CQ8*E+XTio|;IS;TA7 z5NvbE#)hCOZ_#Db+1z$D@~>=u9@@rzV-mJ3xlzyS(^`=JVO6YLC9$9!Gthj${mCbqQh9#%- z@-?Yeiyy1tG=Bii5E6Xm@E!Dy@3OSn7#_LG>`WME|8M{?ec|XWt783FZrP}52QLM# z`=rF+n?Us?@#);9n@^-nm)X8waYKFcAicD<9I+w#aIXRwS?}nsX&j>N0m%g|k;GHY$!9YxVF>6QTxO z#gZF*yn#zSu|IXPh0;CeKq6=PLSh%VuP8`vLn1Hv_MuiB$0@(|?LyYe8CUWzaz!;% zSp%2igbx(b64g+cS>LY2FrtBjQ-_gIw3mi!jbjM;7AP}#EzZZ;uE0h zExUbTNr}Vr!pW{~!R>POf9Z1-_5 zpKw>+U7o*f#T0WZM|?{$!oTRVo@L`yzN6<_;n_pkCl`se3EbZ~7qPSTJdcP+k%m=Y z*^|*w=6i{>_1b$sZ8Gq;haZ@|8l4P$5!ycQ1BDPZfV^{g=1-hHfZVS=i)fJgllrW1 zcbFOI6vSv=FZBaO_H!W}E69|Kn}yeq%9>zkVh;~Qmj*SCfhUxdNNpEb;R2c|GJj;% z@TI0|Lc_?swYo_+mOqWx-Zc`~P8<1cH#rb=Ldkqb4dXjYbxTrY#eQoVnu*l)YlSZm zPvAHfPYsbX-zzEq=nnY3-SLNh^VQ(k=K@Q$9l7wA#1q}BwZ+zBS!klr5&uf^R7p*} zaqec4ZpOtNGdVR)+IBE+_(aqvdAp4AJl(tQ483;6;mKl^ar#1V+bH|K)Zr~!e32;<*l`%c#4o_dh(6V&pT}fThPx%r@4lT%?#V}U{6{vc?`Tcf zg4V(@Mhyatf; zorA9lwYSK&UTUu8%h6dB*#TtuuSW+EiX}KQ;nsrNE}5mu89+n`uU0sW3f&n%e%Y8? zDBixsK`aHq!crtzJ{YH-6IKr(kCtK$?%@On6$>9377L}Z`lgB;a9cW$V!yA$ey8%y zjAx<^xT^!mV22F(dO3~a?dl$4d@|n(Pd%DB4SwALUc<`}Lq0JlSiIec+}rN20bL{f z0xj=jc7#AH8*4@lAPfb%s1q#!4`yQy@XT`x3Gbn#?x*PqCz0oJ6$6OY0HTiU;k(pz z4Ine8qW#TG?00p~`S80UvH#Y19 zs4h$9D}Am$TnN=6=0Hgg9H^-|L>W?F@CwstqSz354M8FwBDQXN(Ru2C!#Kmg}w>-nrfEaM!N1@SK`NiVDhkU11BT?;+E$e}pxe{I7K z{ULRAt>_u4w>Iy&O^a>V6?R0*i;Thc%zLRJ1<&MHsP3~WxWnLKo@J8vC9Z*_o@pUE z&$`AtPEu9<*j3j#(Uy7s5n!&3F@MFofS{eS|JIeDwWq*#N!sX1%(KrEE8WZ9EyLRQ z?7r4%gSC7Ps*W@}{#l9ipWl;x^b{aKVA1B!yHYfz(8x0nGR%6j)>9J_8AMe*Jzf9* zEm{9t*4u4&G=o%SZ0>&J$%B*6reCA>*3#Y+8!03TSP3L@dD2uLbFM6x6xOldy4NPB zW~tT%)iAN19!TY%{@PH9Yx$Gv$!!COlI7*q{9__lEvnSA=Dsi*SS5}Pbu<}y>bgaf zj3fRGN!e%I)`XsSi;q55PzfM#w;*SHmU2SfDx6WxTmg7*<`HG-eYDLG=57ugvX(>l zTq_PJx9hD2&rQ8-u+THQqeVi7wALa{A~2 zc>w7Z4i=qRC=_e?Bf)V{egKh84je$5$O&lOk^v+fA#q|n?Zp8C7xA!UehK!v1B(Xr znfy_7HiaP6^&2~Y#06LalRbkmJThwzr%*IP-9ao390mvNMF*ix+e^uu$>aimRk1Q@ z1Ozt^GUY2+eLMbYSyMQ@B7$4( zU~_o!C^``>@xaFOxqmBtz?F9Ki_i73{w07$z#CVJ4i1UPUupbp1!z#Ogxs_MlQL^i zYyu;jNIZ?NwJlPJ0tJ{pmBH!LsU(PGK*C`|fp7cb#R1+fU#HF#1mf2(gFw{B1R}xk zQ*~)Ay%M6Ot0lRI2Tf_2bIJ9zN}p?uqsT9 z*W)mVXP&|#Hs-HpcbN9Z_C>I1t8bim9tG%^HGkPm|Q?t}JK8M>Q zm&%G|TKhy6T~%qUekY;#J`nn|6i3%H0shK zL~-nchg;9J?bzcb=JuI)VO#RDq|bClu;&zR73XkYhn?)-e&6L@QSsRQIH95f;%hO~;vKRZ#iM^jk(Pr~ z+E1(WFY#R)DcJ3Ax^XD+ErA|?3v$RNCCzZr-IT;Qy+`BH^7s=%X~f-#EHB*Q7kBw( zd^pwXt-WY$07ae7iO<}2&m+=_-rfhfmtJJ?H?uWHPZJoQzSbdsGq`h&C32|Z@Vvvy zWA}fIKeqVwq$OAUWc;W8b)e{P+vNnNQ0`TBG3&-hi{KaTrupPH#sD$~fCukX$r1_X zzMI}=hijQL)j7(o-x%FkCq56jf=}{~$k~K@@=@bP;)FBrl`8#BA9AkVn%g12C*#zD zJ#lLWkdBiY-7@}0lJ^`ga%uEPixB~nC!XEWGW;=vcrrDV@T&Vp6=AHCSIr#$D1E83 zl1DW3fdpn9H$63_H(IHxYAHmdR~`>NUHHa|aM#nUE|!Poy13gI;h^jaii%4U2*d7b zgQca0HV0)c*h}BsZr|&OBd^8M>I~XNrDEf+Gz+pG1X$la)}Sq%&6qFn_EW*Vk2T;= z($I;HRXcU#q~$-7PNCKILK?8HSso4tceqbVdIvF;7n3z^4F~_>AHXUl&)#3-djx=M z?{Rd`iz4g7CzgcGOy5irHT2QC7>Xg1dAspic6oBw9`A+oC>67bLU%OMiV*Tcb_uS7 zE|p44X_{BLDs4--^%T6QqE!HaGA6qv_XL7B>1>(vB05*9W!ctAl{)Nq5dne#%D8`z z7#T{9__{Z#yLKJCR+H|6*dR|Lp%PWHpUG0hFo{hpI zC4__Dus2-3C&W67=wZ{;H=UgTj$rRzgh4#muB@znE5h^Mw2kWSZRH*Z4cF%6YmPlM zoFT{iAJh_XadDfB5|iI-y7u(`eaI#^8={hfj^DX-DQrp@u4$4}bh3EVqBr+k56D#pkq$0OFB?D%z+bu=V?+e< zP0!j~Z~1fG3R{MM(ENGHw!*R*2l*v3hIXnx8q+TP6hHAuCXrTRMOYi(8e^MEyl}O) zs#?GG!+jlJb8DyP^Wfrm^!lJ7yfCWnRSlnp5K-@_G25mWRKUjz6@d z*ve9jHOQW@dCrUtZ*5&a9z6=dh$KtNn_qg{a;~9hc6$%?fs6bzzYtl-CdPeH*5T@5 z*f}oq3K+hi?t5H@xc64o*M6)9%^=2Jw#btx+xI8pluCpB-H$ zI5t~fYKvq-=o&!6qGY;Q!p`d-l6G781uUY911Y4r-`fw|4OZ5K?hd6ldrr`KC(dp< zS@cef8Q34Dr-!_%oa#AJ$9nuy>k?$9^q`Zj=f=F`kZ9#<%S%nl=aSfybTh()ue4ay z9UZmJ6fMg0U-QqMrmg{}6{*)jm%ZYv<6nnAPwR?%mbq`S3XZ3m>vG~m{Q<))t1I4@ zlAo{x|Dl+9*kv!m1E@?&zG{U_o5Q{P6i%_m@|GjVW;){EYr3wETwY<|*6b%rd7*4@2UQgcqelX+40K&O091T$XQV1LFL?I~$nsb9=C&DR< z2M`M^j2K`YxqFXM-mot)G(k9p3F9kK`iw)9paoTEVf~jD=$z}B|N6iOd$0o%eSG>X znYETbRqPMgij>Y^Kj48UJQzUwW(|VZvhdaD$9BBoU(jsqK_qnJE4+<8puqz<7vbuLprXXK9$F{sN>sL6r+3el4bMd^D1 z=U*GE2=ghme_CkDSifko|WhRi9oaI~y<#IMb*mCq!zl6FsD z^Ym6_{rJbmZ*kVA7T4*wSt5s1KpH4>sd+A}TA81=`=)OUZsU&hvNC^;8Z$?TEnL4^CWc(2FIF7~`BoVUAz%k+ zs0|+@Rb2RL^^K$MQmgpvJwO4D_~P%UV~OPYBOeM>>vo+Ac-*^jsZWLKQa?EcI@=Ln zCb^^dLb1tS4Z|!ws)9Ie)Al0y>|5pm-ovMukb%{T$9{>GdgT8@h-n|)fzvW8xD5) z2XY|;tze2|nIQKkiO9H>ZF)*TJErh_)q}R(n|~r__^lN_#`0bXzO*QqS{D@ClPwq3 zTt-XXde0!^8om$0lV?Cj`bydEO%J%wsuBkfn$tS7?gcKQb5=jX$K(eux&C{IneWf( z$tli>S$2QyTZfT_*)L;|a>=?T@vNy%jYh}ug?Ycc*J+r*qo@k32vdKU*5DS4WQ%|0 z)`Tx`zR`1bx#^2eI#`u9!7h}Y&G={Zg8-z&{${ZXLg(Di+y&VGa3)8K zJSYQHiD6)t(I$!Ug#$<)Cd=x$bkVTOAj=%Vk{pAWanS-gPlYO!p?wh&S!}96F8T8t zcxryJI;k%dJ~&uGh8}7=m)r%`o2PI%9Bjb8AXsd#Cl;DxUx4~{P(KWu0jSUeb-&4; zPr!1$*Dl8pq!+S-f03;WF4j*65Cq%<6v(55+tG#vt^&-`&yT1FrFB+Sa(@fFIFWxJ zUi9t~_cLTj$4#e`yGYr>Nrp%%yLL2Kvsy^KBFr@I<53TznIi*#jw*mTI=IkuGP!Fe zBDcnI|sW87+Ajuejg zVo`z1T%8p@+)S$&uBCSBa$?iEFc6DV`Hhb&{6<#jq`U9FcPc9F!nlP3UvqEdLlefs z=VmTo_1BJSwc3+r9p$CbueLHKb-l&EY+ZKuaPb_K;$2ObJEi<*4YvJf8OY!9-lWv97ak+b zZrrzfUP5?#yI{hx`Db=mFM;%Cn6u%(AMBP-SQl9WxhV<+Sx+;|4fb0+jq&giSs3E} zqSf`AFU7pFclH|5T0UF5i@_pH;xca>%b=!e&BBrTak86|n|5{d^9%{tlohqC?+ zt0=O9S(tX%`JM7!e$2ecJrzB@QSEEMW~3DSvmyj_9%N-5uFZ>)zM8mi`P)-2R(@<+ zCi5sm0gih3MO#XE1IWncyPNiIXf-6ZzNTI?2}eAmk7p0xn|3-gV_fqQmwz0;vi-C{ zx-qG=nKI5*Xw2Q`a=U5Xl>y|Qnl>by%Zd}KbBz+FTxcr&DP634{^-6V`W@Z*$dTY* zgc|XlOCD9dS-xc>{>6QiIYAr%$zIjryTAGw@b9=$6^x=?bPe2*wMb_KswDLGbHjBF z9{Pu1ZxVUl-~UiOTP?kRV~F83a%23vRei9FZtF{;Eqy%M_I|%!aO%{sx_qap0lYPi zcy`)?pM9HtTv!D@3-NWX3oTCPYcIcVVtIYC;94bm7I7JZs)B{S>G?IGuC3!D#7jxw zus&C^;23%m2@K&3ZliEwM%>+OS5dTEE{aa>pD$*@p+c~HvVDwBl-|bhN4s_{7^d}$ zI^z3{N+Ux);bXCb<*c=BxtJmqWziU9S;@SP4#+gWrhjDHD8W*bv6MIDlloG9d?z+?fqDDZL7tlM9z|`Q zSgpeFk!5?N7u>*bdJMiRAK5k1+&bio)*^W^C9d%IJXDNi3H@AXDa!_sgcNc_F+{H3 zbd=Zt{yabUfO9sfbq)TQ^E0$|sR6{po%x~N61cFW-)8XLcP88%WuYoIrgk$FTO{j; z#z)vK4y#^X;l(T#5W#pRFM*BzhrSV)^HJ{d)|?N9A6J-^pP@d(73GRMt^s7nFudsW zQ^mfhF3X1}>&LVQN3@w+`KA0buxf#Us?hAE&m?)ByP+3^K2dj!Y{(x;EbyWAX{@J> zZtQSvAx2pdAaO60RUOT#)BDJEV zsw6onz28zOzD?_)EfY~+`I{VB&WR0REWdHJIf`?80Er6p0GE!VT8{X=@VVi`wuglv z4eqtUVs)<6yh`4i%jcONGVw(Rd=D)Y1F)vSMIV3MXl7wxcy(d;>CW{VM=^Re#g`$f zVD9+D@nK4DzNF`rsLubzhqwx%0qq4p{4&i#jj3Y~uEZ^SC6hWUd&WC2lA=qYmn~>i zg^vMz?7}?ktbP>#B`p@pWpw#W@N%iqxQohIivg)xDS5q&quH;NS=H0~r@th{(1Gl} z$%G_fEx(bs-_oK%^TL|=xN7-}Mx9Q3%ss2rdbHz6TM*t0RralfeK)j{6LLKXGAn3N zjjd&V$NU$`Q^Uoo7jdyuTMxIZ&wS(u864C2PwTq3hTe!WJ%*1#3d{T!HI*c)`(5xj zR2>#?Pr7P}9DrPu`5nqmD@z_v+0*l}plV-`b~TM0rH?;$+Wc(Mll=21SIq*S;!4T0 z{%wChk4z^$J*uUCk*D^aNfE~`=|BD18%H6n@L9-rc49eg>gZrwq=^FS*PE$^6u@&e`BgM z+&iC%+iFJ{*6x@*fIM-gkbW9MAYBmdk9P2Xi84LmXs?M8XXBJVJWYRq4oq_ERNmez zXB3;C;PPhzLARwyBxf9;R+`GD3Mnq_HOb;*Ww@@_Ka%i=mZ#X(I^yuyP9||VcW#^4 zg2}sYEQjY(e3H(-8p^wF`YXv5UCk*;`+$!;LXB8{mElg;!K3^=n9sM4Cq{R$!9L$am zu@!bwQh99U8+`@uP}}aAn2h?^Ox@D0jfs2sHuOQ0K{ndL=)ssX<3jbAYZ3ESll(7|u3n4opzt~f2s+{{XPd57mB&O(l)N?vX+ zdZ9s|5@H`nQr)`Gs9G;u9<15n8%a9|)TzaT-{y{}r{p9DT9>^-N>F0^t8}Ii* zN{9EuwY4LF8Wwx)Q4pQ!@zB?jEh+eH9B~=t_==C_ZLHk-;6-NqI(oe=L#!?1Kl_?Q zjpi>uRP3nhE6npHS5NvxIF>^YPK3{qeU33J1@AyS7cN6Q;p{4LzyGO+S~obF-1@A= zpR*9cc`y&wnqem&MHSA7@JP z1cm0gRKHjlgIIIA@)N|{=P`TRO7Kk9Hct#Ek?9iiF|XFZgBXS~b1JjH0s1wX84B=^ zw0j?fYw$N@&je53(Z%oe!P#_+XRg@agPbtvY%5n>K<44^3n4o?=Bj&#djhGOki;?EEGUmnz84}cs#r*mg=5`Ff7nTIB%k+66LdCWosIF&4k zuk`gnC_Ip}6AlMlDr9izW&m7CCyR#xe3L)uqs#!T3$F}djy7f)0vk%;Vm4VIlkiOy zI#vak-J|25yRx%JTM`9lQZ>5B!mB95G z9Crx_Fqu zr{ANwsIb2Zt?eEh)b#p}KDHA~b~&u4N_r@>@oX|!j4=P~cpn?MNADxKgAY!?DhZ+J z0|%&=k9C1O20dI1cDKO~MsgkEqeW0^9W=qM%BS-_Kt-mY3}JE1^U<0+U_!zOSD!zj zKDnIxF zTw9)?kHAUaI7YI9{BHu|dwJ|fKV{S66AL#!IEB79f@~?01uMQV+mytQa?BOS6bYmJ zjWO(Aa?S7kJ~rf4d`;cjanIbc|8Z>(!JPk4@B6ygw|B5LCi*qs*^1V> zP_%5m=tNo*+V4i1!_hph35GJ6&)rYTRd+A+Z13?K0eDzj3a;)4 z3ZHLPNWx~$E9%sGt+2NRyQ}(+k&_VLwO@MpZ9OoanQ%F1UivaJuiWl^3XbLWrv%?` z+x%Mcp7+>{MoP}Q38`pJY5y(7==bT2sLlVtYVI(s(%fA+5gf{@$9-77!t9COn{kj- zx~}Z=@Nq3nsgw$OUT?*vTA#u(IE)V z_^(jY?`@YRV+Dgq_C=*G8t+YT!y_v~d5Xjp!o4SJ6$&kQLA=<-0^lnlKXRj(DAy$m z&wylUt+a#a@D)Rx)s)!D$4mGV+kdUGTyX2fvpFAjy-mT>%wmua!G%R5d@9GWo9C1J zr-M{it+@yi)`r$E1iKQEZ|ChH!tEz_01uUea2(%eCQtgoCr1NJaP~rAO39c;5F!9C z;o)WA=oB0Jw=d85{4y2VLPaIF2$25kz;o6r(PHZ+B$8HX=Nk$8Ce z=c2M$^#e_WB!EOdit&Ej03zR6B=%p6)=>rp47~mpx+3EulqG?HA#s?_4~L@pE{EUeMKTc zX9&h5oGg64r&b);N9If&K<;28=aF~@OtCcDGx#zC)HYvG1mV})gTIn_2I<(Zm^F@h z3Hz1#>BnL4X%R^z{{j>TJ5eCk^GIrbaRLes^%1VK9s|%IYWGqJD>{an0>mgs&hb=`y?r{qGiT1<;2 zvwT|Zcygd~7Y?e0Fp!0fA}QXND-AxC@u0Lm9sC{YJ2819N|_ztY6G_q5evhQq+I}| z$YAjL1S(vgaQL6sC&U!7Z>3a}Os@{~PoJ%S=Fbub zRp8j26kMZkE#>9y3w2z5(nPJ8uMgg+Pk)am{)OM<1#q<3U6In)MVnDSPk2rp=~std zNNCac0{fXmZj8NPn^Ir$0J6p3_>Tj}e?S-zm+|%IaB;-=6y_5v!Yj#o0IrUtrAMs4 zXgbpCWT_t4UaW%qU?`FO{~Zr;yx<(-=vxn1fu#k5#$+Wjic4q7deh?jP znp@(lk52&l8lU;_Sk5!2htW!pzosgn)jRLC8_7S}zb<-w@q{S}kfoXS2y%4&O%sK$ z|M~P~#kivk;@vg})h)iMkD8~gWOI>{VLVBT;1ygrzt?lh>jC6}H}kp);?pHr5BsV! zNu~rzO+!t>RiOe64R1u-H#1wF>EoM*5c_=z>}g_;yj5oj6ZLa2YYd|@rCW8^0O1@quFw@(@FH{DtMLc?Qi$G_&E z^$ac`YhLNkoO5-x+UR>;6JupHl{qbr_yWh@SM>hCCLE#)?lG9*57s@5^QyZzX1nW! z6=kAz&g5$h1&IK?aWC80)FrpshSYLP8*Knx+XuTz=DXJM_hyxF1N>u5^~&h|X`aGr zG{@gWAem#CTJZy2dzfGq-2YCxXuN4rA&;RrWR!;lmM4)9e$T@upGj=ZRgVSdGVc18 zWDhHE^V>{dGQk23zMmRR;u)#LUGrC+nltHUup+(QBp-1*^My<*K4%tQzWH1o4sQ8f z#Fejav(BFp$x2Lr@^-V!#!G@Zq-o z7qsXezb%9$m=8&L2C^$2M%&)Qi>{6rU-BRSfPbN`b=RcS`*xa_H@Lzf=fhmu$qdVk zyL*gORSzBZIv!3=gp5O8b|CWIAx-f!DQ3edYox!!P`$FU2BGNy57Sw*Ul`oGgaCMkWvbsWpW7Wi1#cx;r z&r-|R_j>L853nuDbqi}^<`$PIgX#N?#P;*K?wr!h2{)=EX*0@K`>uEdm(KW{_>nB^ z_t@Ki|2M5<4jlZSa_5R7_D#=Et25cW30>ldua!t1LG3tq2a|`sZ|!%Im&~G&)TwGA z^((55-CWEV-t^<>$uyKdVgE$VwA1YKx85~2sh}$n-gQZPd_FPEqoIh^{e16%iZxfr zK^`QC<}k%9fnV2M;v)Zl`%p2R6%{ACz$I9m`p2}>eR^UUIBCwIkk);>o&G6o2~VlXxrc6_ndmXz`r~~zk1=AUq^bOK6Glul9kV6WE_jO-US`=IVtt|D=fR7y{+$+# zTkF#UQ;Wyg>`C)pJ)FC=L+57a^{_fz1(Y$Xb(#k)R0Kei78jwP+XMWE@d13P_hKXSVDiRcSju#8 zbB1qy{;dz-4Xnuy5n(z^L(yRJ7)A%$w7>;&lG%KMLI_7bwb}`;%W9SBk3@$Hezgf* zROD11?%_2>?x8o^*a5c0%+vFNHk@3#(|!J~9mk0A|L2M9r)_$d6&vT`u9llSF@wHD z(GlNv#O7Sbw7QJr4GS)B9yu8QxK|QmG2O*y?&_f)kG`cUe<0$SNhgC;rjD?F7z>sj z7XhYz&%Gs^JndJd%BMd|4PVh)IftVDRh^d18-KW{^`hr7gARHIsm*oPol9H4I6CaW z3<7p3N)x{E{LiOlZ6{lwUOH*>rtQZTS>b=!@c*2s!?#caE0cTDb43f@rd#Y+c-TMM z7-c_n#NUx5JMlSwCU4qa^KNkFN6COi@R1F<-vsgcVaGZgYIe`r%=Y#@>qwIvbJ`7X z-}>2q^pd0gGSbNOA9r>fa>dnDke%KoxQJGYY($Gb^3KG(ks?2suLA$vR99$d>8Ca~ zeBvZaOPQS~mP$SwTGY|J_AKV2I1PoX?yH~vBuLW++}xqsx^ zmpW*s^mDW3&h#$0N5v#fk{(1f;D4}hwuxp!&IMw+ zaB1mc(lqG=GH0}o-+i!{I{v#-0H>DhiB5+cwFqS{X&kzhu}AE+PL$sa>{km#)7KNhxzHxnYq9KMR=pG`cFV_`|JTD!`AQ za#0asKXVoU-M@MMmU+#dNRcU>2|%Z0Z5;Q4!+zW77U`(;q@ROh}%HoxItt2 zTn`Z;ncR^982YBz86X9^J0L?FWj{+zo_spWjc;(-YgrM2n?Ah3T%Z2f^Gz{`5LFz~$L!!`y3V z9cW_V$ONuYhIi{cP*FYy25FZUZ?o-(;gJSAH=&#=%y&UM`mwp|5o0RIs@hL;CCa)1 zLtE1&h9smgcF{vHEc}F(U?!x{{d<|bQJ@boUw~YuS8V~>ITv0l5@T|?-(f8*L3qVr zX_&a8jM+579hL{gGLD>@O6mhl60?qAZ&qd;g)rhOT0b9tOX&a?h)%Xx3={cL19T+= zS6K4h{>mSF>0RCPL_Lm3zk97vSTuOEJ2kBuEzV>1zGV#S-&HK^jT8$Eai|4X>&B&) zk+yGZp5I+kbu4-k^_n(ZlfkP!CfsGu*3{h3n7HWLBh@i|4Mt){k0I_=3D}}-xQkdZ ztr1U?9A8S8o!RZU?%@1x(nl17)PzkhA8IFVTzl-w_5jL%?aJ4$`&U}7@Dlx*zv`zf z#)@OQ=B@aLXpFy(jeJ^vS}Ez0I&#*{*D|}E?&cRUk8d^X2J7Pu!4A>wQro+U=Tw06tCDxUS^1J z?GJlzdG2@I5yxItrV$_hRIn7FMlHi_)){*$9Gd09Q*1@HR=Hh!^Sl?lbXSqS)GiMF zIK92e`vefC1E&9;_ff77YG&*u^A&4Zlu<++KPkf#b1P#iKq)wT#{L-T4z`v)j?F3z zh1|6JK~o?>G#hBzcG8{!OSwCvD=+>Mb!z&(89VWfIwuKa8jGS;B?*WioDJSq;sI3?m7UxcNF?3)m_vua!0qpS9cY+?7U(27SGWlxDf4fS2JPyyr}uapj9_@GHODHtG3LeO3}L6WpEFWIE!K| zeKsQG_LN6;5NY*aymDc#n}OoqY@O^eG21Q|>v5HG7~S?Ia!3zTK{)EwK6{JQr?CQd z;tAOmX9V8ZHO7v{MAnggUfzoI!d}J(u@^(0>$uPuue8T#)&TNwe*oN;d**Hmt=(n` zv%NqXS*gAFrHZdKvIzf5(!TnvK+46$pDS~_P&AREIx=%BukR?S+~3qCltm2tfLxq4 zlGL$vIk{&qlERes*;@T`irr1Nz-m}ChnzpXH@>vAb(T1kqMZDQu0+rBy-Mo`(-^n} ztT4s57T!uoAo7*5vp8;wQ2KRo4IJ)E7JzU0cs>C{+?dq8rV**gN;-0jR$H-yv_e*# zf}1VGkqhf_d^p?ntb^BZ!Td}LNL)C6?xKt`cr=wL6y*9Tv(_wiHj_|6Vk~ zTI49Tn4`L){7vq3YjV$P z6wb=0d`5B3wNx~=&cu$&(2Pxv_DzrARx)Po)G}4@G)9Y3p9p_=R98Q^5uG zVG9!BN8(#}JC3mn+3l}O9p<^sv?G|;AtbB?ezKku9jtma5T?={!i#0igWN_pUuw=3 zS7VvA*_4;jS0lHZMq#1G+{=5MN-gh^R;UW~rIwXWQ*D1!MZB^KtfNyZtCFjaP2er2 z5S18BA!IpZD{=AA_hb&iG(jy?IBghZbaLs&>NPCG%4@l4~O zP|;@7R`FQ4Tac?4*iDsdv2;kJSan;do;l^6$QU8uPTM+&HxJIK(JvKlz8o(K?RvGzqVJN6nb@QWzaPlGlNv%A5p?x#YsR?owz!P? zYJ%XU=mV*yr=z#pPK>=eFCcQ?dg89u!T`J|wUeccL2+ruA8xmV;5haWU?ab}AkJL8CJEumE15xk%c3s2mH^u4Z_W1g=^G;XMp3g;G z7bZWpQ`t26h}}KA@r@&&1_>{a;*kRz1z)IAF=qfT7SO=#xaG~$k!a#Gw_7K1$elb`wV8|2@W zxv{p>IjPa1ZVTM{Z;ux9=GbHR<9df6eKwn4&EQSn!nVu~yTUOl*QCX16(%88lJJXv zrQbh9a0`jU`46o)LATPQoHKME#Yp*WRxRllKxPm$H+y2Kka}g=wdT(D@cV9LZ=?1r z-X$^+6oX@(mbqa^Dg!Z*szv-+Eyb(HcLzAR+%{` zzFp?3)THTU7uN#po>QyoGd|IC5DTN zm7I(OyH4+q+Ffu&zrFAcXzcfLZ8h(5vQNmI-^rXZBJ&ql?OuC|I`7|?^Y_O;v#(vR#x`A@}{KO9aN#^PjLh%pmi6$u^a|c={+P44WrcB~dlLzE! zp(0`&gP6cm@XO7MS-s`tMSahI9Af5$S8qCOh)Vz>@l4M*2wL<@r8tmaob~!T@kJRr z3$6w^5fKpZJ0wK7CDi4+#Y9j?I*n{k-7tVGKUz3SNof8CVuU-8?c3dcvpMkjrc;GR zOGE6G9B)hG8y==Fe$?$wdhTb4t55mfh0}DzHxqx!9-&1lS)SlARz0vY=)LPW-z8!b zDhra$VeU~sa7KT8V^XtkByK~D2#y3)x!`UEbw zKJ}Xk{8Mb@tN3otRAn!M^pksY8s43szH|Imo5kwMzHMw?ADv5@`fCMG-}EQjme+*pZg;KN%c+QG{t)wvd+Dj2ORY~<+0vXl zaYSF_ZSmMbI}YR;7i84bOkL%eR2Oa^G->$p%Yk_R!32hohxYm#$DVNaYt{MAQr%t} zYCT#BkkmG|#crJOqCJyO{#x1IMdPBm)s>PsvbmA8~W$VzptAxD>8S(1wVtM_Y zMb*Ca-N+%wso)?(-FH#UVUmK+9DteTg-wq;J8z4PSj;ZD);wojGaV385j)9v5wua>{UJ)@JGm<`dB5>*<`EKK9^mYcYV#{RHW4@S92M!rvFc zr3~tR8lI2P=W?x`Do81(F+UeV(&)YUkPpv<3kR`t3LPSWA(9J$Y{Wi)I{>eOFo43W zjy#&y7u^l{gj_fb89Ltc8v6WeAROGSlaIf3^h+S!O#ZyQ8x<5l2uEY4z_C7h^^;oT zTFk`NSXf>->!Q0~Pq?3HS_d3Ra#^CC?yr)~MYpkbHHjNE-Kqe?+h+qc6U@sBx0yDf zRk~Ogc9a?v+AJt6pF>eFQngP?sqKBt7-r<5os>!Meaeuzu%~d-R`ii2VwgX^B@E;l z70hZwUXAtnIxOKe+)Riz{9Tvx{6@$A+|EYG z5pZ52B0u!ZnV#g&V->g2WKqY}=N^>VJb!;k8!p1~A|GcE&3_oZC~3qjtveG25dRQlM@riMG%o4791_-?Hog4WJJHW}K;0Lo z{$#RmI#qOMu%Noq#I0yf_ffzK$GRzu?S8e7D0&E2UEzsADY|e|R^j0B9Y1FS{|L)@ zH*toqR?S4ywx}l)cMKpt-9lH2mNdH`}d%Q5cI9c?ffXprDk$?4{-}1Wz-D<4B z4y~1GIkt5A^sp=Pp@%$ow3rNM5U=vWZHu;+PAD_%D|hl*zF2c{`|!49h%IB-t`YH@ zq=r8xWFdzR`OM<%yJwtqY1xA}ck)ikP#FqGDG1-b?j=O8&S!S80lHa-bnrJ|*)*{L zgDMQeHxN#>BhdPe+5kJD0%p$SBne5tpr)cPz=T2MZx9oq_Go6qCkuyM?PG9ukV*%0 z|L2eZ7l051I2*C^w=cW==H>J+FIRp0GLD!_C6M}#E(W|Ej6!&nwb|1U;%*g5gYFvZ z5x0f5(Yr2hGPh57blb-K;+;f2wFM?#EsjzjKtJzFD4>lrO{lMJ%R_n2CQG(!jre63 zt&sh?t|9#L zr%dwU$w`&3#Px5pd242quFYo*{|@4ma+LQO){L)zyfi55c~~hX_wlj2tlKfLp-?MBfCk6fLk~eXXKaOwT`y$waM~cC7NJUwsi?#n zZmzQ-uWUNn(TOp>`Fjr&;y>OItb|{Ps%gRTWqQry83g%rL<``Q+4;zPOQq&1Xzdbz z)#qXG9kCnou%bV=i-AATJ?Lg2)$nO?RL|Rs^KZyk)y>_HHd7e0u+?cJdaaXBR)e zuEDtGSLP;lz^X(2;5xxEJG#>&F_$t~LcWVM9d0)(kj2)>lOJD~3x;0s%3{vOV)9sA z^5X=t{g*ZLhLW(r&i5sQ}QCS;5_}Bhgcz=Y78RHc(Hp= zhf>Q%%6m&!ZCd^b#t4bw4MQj(O+IpS*jXdc(l$H6NCq+K@7;BO2)-Jkr@!r4UkCd- zyI_Mu`BRiPk3pRAMLEJ7Vi#CRy~i%G`f?rBg)$)J{Vr?!N^lRDndm}fUV1OBks{M0 z<_eo|9-j)mSOMuG^%r(Aq`P*K3TiJR26Ql~L?!o?NP&xGUmN(>y<|xD?|RZ~Oo#sn z@~v^N8tnSpN~FS<^V}YuLm$0>O%~(dd<4upr~=|aQuNc=%6G8tpAkPTve`qSt9??K zrHCbh?2MW&2NhmtdW`9ucKbA39(TERluAd^JYB|6QuwVHYd+c)Vjs+Vts1#*>R7 zg}>$t5IuqH>D$~4hVS+Gkd{FyBK3dlOm2ZJfv0|I(CPiIyPg$kkF-5#ZlG0B57LF6 z5L*2mGVG5_yT75PkBIvY&A0g(ZGM6_Ia9PYewVuBZJtX#G23%5%P`Bb(o%Ohi>51e zgyv$+7g0<@f*ji?Sj0u_3|ThfWWt1_O^X?X66qtY8qO=9*(`dp1~dw%0`_* ze4$4zFD)_|<9S@0O90Oed6NGjFGg*vqjvl4B^Klp#(wJ{AVrO18pv7!=Fe?T=bz+m zUFor+mgbVHf_n+xC;&;i6cSZ#_Kp#cON*Q;+jZ*z8cLcXMjE*QdY}28WhGd0dd21< zWpQ?7-zOIQU)4KRzNfF>^vsh`Nb6Gv(J1I52{fz-X9j2Gx2>7#Ux`^fZpE){2SzWq zU??(I@@?v?*RL;K?c`a^-FlnG!yvO)W*pMCT{6zAsAf&^aG2V~7o?(Q%v07! zTj#V}wN3XH)Ekj=d}&RN_?m^kSs>g~es4iqw&Kee%V&aL9)&u(mJJ}D{lJS4wYMK> zeR`{X=N`TDMGx=1k1Y3}@I?^*AyK;!4YntbG_(`+L6)nGPukrddhrj*=-*20|3}@M z$3wk;@#8ZF6JkcipYQMc`=du*?|Cn;<-E>0ud_VQZ)@RDEKs`Two>1t%q`%M zV}pA4O+Ftcg+a_x)XTY>v}uavEllCt)cm*pw91<(kG??9>DO3$`1F_Mi|^bW?U1r| zG-*H*@Qgq3UhL8)61qcHAta5XxDa+vw>yK3`c$>0|bR}bV zk41067}osFxNycS3#Q`0Jd4tVAU*4o4r0+~(Zn%j00E6W{c3xKZq?#Nd_c#t*L`Gw zjCa&DRO?y03hML5CNw*o%Jd-|Vudi;nloMZzbn+N-VpbWxM`eZuWqD+oL>M1^n7oG^?ZPFk zM=|QQtxGFaZh2I07g67|#P1%_xJ#?!yA|jFP1Q6VFEO|Dm7=n_vQ{wN;)!(XsuEB) z$j0CnjPBZM5*Kb(wKK;7b0RSG5pguvNAZ*O9E)ux1xsxUXgX8<`ql8JTwaAY+l$Bc zl9g!dQ6n`b6@BcLw_n8AEQv3B?j8}Wfzl8}75^0F3!=IR03ndSvXtE2YK7_g8J+o? z75~4uWe8*zM0LuU1#*s1IKnZQf|##$Kujq?f=wXIOH)4SjIp(3ZO2N+bb)z=>dRHUse5>qAKm9o0xregHNnu$gEJ`s5wD$pGJ?mgd9 z{{<8ML{^HS;?cr&H=l8CBqkZ%C|Qs2?TNxD&j#jndQsld-lCo}sR+f>HVGhn`)i8l z?>m~R=+RVnP>WDvM|!4u!$HawN=RL2^aZN+O|&-d9Ce;4dc>9JzLwh$(63+BZD`lr z-B_fND`je0H$(3n_IWa<4Nkbm5LTevT|IR;(B;TL4QohWwEIoqe%Z(pe!K4-Sf$+6 zjwjgTYDY%R1}chc=Z%o~CJSJWmP{KXu{zMJZ*f==O-2tk@z&I| z#3{D7-rTCPD^VDE0nsP7GFYSH!U`<;2wqt0TtLS@_)ye28fS+$M z3Ckf$*lfJOeeJQgSl|HfE^j$%VF{lp={Q#@{+w=jPtED-t@XsYMJRXWqg*wCTPMr1 zPtEo?$yY1q%LVg_@rV)jVTR_mMY9>YkJijOrnBl)`Y^xG>_|cP#4y`9YgedqxVxwQ zj}uy2c~82v@pIk6{&>P@IIcAC^rVSIW+Gv95X+Q|ocOIItKdp_>Z@C}PXs>y_F=)O*;l|6(M1X*Or~T;NCvN%Bs6wvPVxaqfeu<=e-X+B zrjO5-^GDf+$7gy+n>0M!a!uAvhbg^iOOjEIU1y>=H`BD%q3wCS2{kf99`ZD&vW8>& zURWjG^x{2%YuA?9>dTB>`Fi$t7s-8P`wn7M8t`o^@KB0%!;&=)Ao+r38>lUa+Pesf zpyELcA0kfGl!}N^F=N46)2r@dTTeSG&JvLISkg{?j(_Q+ z^$t|N{^AhXrR0enu@)9{>(&lTx{FiMsY{EFWCK=9TigD_3$riC&yE;CokLC^vIz{= zyvbEv^XM-|^h|b2n~D>=TDW~6)FFJ#qYjR9&19K)J`X(^_t_(*X~ils8Tp&oc>oTO z74z)^X!+A!v-=)O#>+U`4_E{wCOdKOmu`QLaxEDebw&*vt(=CP0je;fBz1}ZMb{^Z zdgE)|h(`TA{x5F4Y)CnK8#ubdGY$^yB169%qE70rX!&Yx?U0|rLe#yT6R9GGh7VL#a}>EZ~(w*>HF2UdU=$8qy79`D5d z<~gh}qn*26Jmfu!1ZJeTuh{3eYwCK3YA}TrhJ`WFL4-5ypybWZcs6vkREloeWT%x z81j$_Dq1<+ZtCM!o21*^cd_u1!vq0_S(0CTO^B|Nd24i7q4l(7L+O(F!;m0}z!?!t zSy6Y=Vw*X-7v^fXj;Z6cuiz`?nUNyuu)kok1QgrORJYA*+Vf~_#`!>_l~71z!1g_= zM_(ip^zwnr&gYsR?&J4SHo~efafVW1J_*MsSg)BZ|9Q9M76arE3du{G%XUX>K0C7nebFwuc>|ApcU_ zfu6>Ni*gmtJBk4{kH&)dVN=O{{j$&#m*o5j2;Ngh;tYu z@q3-IR8%|~VI+Sqs{q6$%LscNwl);5>NnikF&a#{7#Ki#kby6X!Q@!|R)T_U8cok* zpHr0JrtzV?c6>PJePJH?yZ!V3;4RpEf?DE*vfR<~jgXI*@VvpuKnL{k&k7tNfw5TA zo3C_g?)0~(sp(LxqCyNS{Kk=?FgFZX}dMkic%JFCl-cFey~f3qM{ z`_!EW)rJOgOfwPic&)v9On zI!5}&d#@sfq7Dy$Mjh(u`OMfhs>;7#{LEI_TBOcRR>#*A^PgKk#SV`sXXB4Y%w>>| zhre22EAi+&?}c9G!`aR=uBPvuL|z}aa82D?M=Il)CJ-bc#g#K^&z&EN?E|1r!^!00 zTUP--0({!RQFS;sclKfC zy?QO*v5Q*SAFoV={He|+!;t|%7%4+ydf=|_eSk=JcRS1VQtcZXXkc%V?eGAf&#-{#*%a5V^e)JoPkv7@~2cMY5uODW`Yscg9W^Xz^29E2HC?Y{mTfS@OS@wKBcly*Rj8APT98H)IB z7%${Q_xF4r?^5WwIWUheUKK;me8(iR$3Bi%RTwy+21-(R4u?eHDoDpP=c?w}5Zc$t}cuy}X!P>)#si?_J3qPcD`KOf!#94~+l2=c8k27qIMHCved@ltyZfKLg#%zY z-KEas_dm{|)q|sxhUd5|`4t+n%)FJjoG>otJ!-HcMTpQu&g^2kvIibREQSMD)r^no zK%_(Y60U~{xpDdRj)h}L$D(ra{q@i@bdH1&0sIT&7nq>&`E;+zEPg`HYzO#$b~R+l ztCu?L7>14$PY~PNz@vh$2pQp{9)bZEHRDG{A?76A<$Cvn@q5&uXlE~S&xMeC8J4w% ztet6#VP#){=4;6Kbd&rE8dBNwiz|3I7qxToUtW?3C3eijaWOhvF|)(tgQ7zcE$?;s z8bsZ)!j+zmkL!?ICD+dZdbyCq*4IG3iB$Te4NP4LwL%|4lm+rIGCXo_!+^LUn-7i} zK{s8h7LFbFR${$A=O3%A>0k%@`;Aq~TXC=FWV#LO1=k%7aLB*OC*B*%)&OkAG& zy_@zHcCqXG4d`MMDsQtD3^=@HdQP1ht1m2AF8AbY;U$YLr``cOHIQ3 z#o6HtNB6zkKTl_(deq_Fy$YDtK5;kVCdSDd6_pRgkDhI*RT!Bqn^#%wv!V+k>P&5| z`;;cvSIb|p7J0pT=NYd6l-E>77QLN4t0H=1`FVp_^=5n0OfNz-4Gf{7h{8;=4>|%7`?ilKZY(VFJIJ?f)#Lczo2Uf%tbu@uX3f7(-p2B`4HsfbNFN!Vr44Jep%uYga*fnhhNmn_6*>QAri9Yu}0V) zy(wo5-M@D>`pja!?)Q(iFt=I2M(2#17a_4@>%Z)FtO;r)x~VdNOvf`f)tTlc!hv~- z&PhO8$)!;NX=U@^wmDYdsGkG-@p}aL8!t+k@P|4y2|Jc;NSJoU6;a`Da8XlOn{@T5 zrq=5F(n4?4SXab|Pj|~y7#t)9wH@mf*s=Yo?(Tm$WMhjUw(zC*j70+pApj?R^)Hiw z)oY|mnz1xYOrJQ-iN9!id`Z@Q)=7v0pq4IuikoEZU?b(+w0-uc1c%TsrT`nn-oc_s zKYT$ilCmrCHcc*JkgKpG)Jz{ulOG{MK~(Zho3L=DX#Q&!V3-yM98n>}2= zu;OO9z3DW_l)zt5eana1^Otddb}=^OOkFJ-wf~rKRC{>InW1B=pWz-Z85^Wj{i53 zlFp-eE{d4Xc$Ra~cNUSy*zw6yOI2>_G0oie9%Wq?ovAkZoOJG#2c^5hM{78fHdPfb zdVQ7Vi|7W~iAxfvQpOZZxXV@1bvzSzrTuF^EHwJ+UE6ANf186#HLC2QFrhvDY9%hf z+}y|~y_M^1RbE6}{h_Bfw;(kyXpSuPEv3Ro^X?e~!*M(F4>2G4N6(VW?lq@8j?k4q z(YsFWz$7co8}=M#$}-&^O+C@A(n8O-`G0a%-R%s2dHHTl&_H*UQj}KHA%{U3on~!` z7({H(dXnt-ia)%~iXL>t^0c2XgxB_yrh4vwrFz4|OH6oeU*y@-ld1Q&vWe;_Mv)V# z918I+?TvQqU+-=iVBCS-tv&7B_m)!M*4n|#NhSe81YgPAmbN`(_#hHz#<-t861_Tw zDU;!ANZjY+2S@R_9Ymm@&V+iFY2uJbZ3+iuTxEii)e6@ zWb28+9b$`!zL6qw*?0j@mAKf{WesnJ-cCw20FG-kyFcytK+h~)tI!=bN=wE2^ zKdVr}4Oo_=y%_64*@okjPS)IVV2hsI&fSS~oOiD!e?X^V>xBnZ)vIjnB~MBk%~Fs= z39gy5$L1fjYY=vrw&GAw%G!YexzWy}j`VzI3SarC%S_Lcon7)r+_6~o)#|I;-N_A# zr?q9gqVtHNnb!^~E>t2`D-;;EH~`+uZGx69AKCRr)$PGO?V~09A~%`joNB*Eb6O4` zuZxQkBriD&QbOX0murkcS^drznsKjN9kU?`V9!yxQyint9qkMxt{DK2ocf<}DCjde(oD@wYagv`jFp>sO!lY|)|YL-vfzZY z*}5;>+u71)g`GRugEB;hb zh?#e~AgA2hi;UhpP;#;RcIWwj(~i*nq+Ifdf-8P7QyH+AHAjC;Mfh5D{#tA5=Er=- zXAB^0=9af4Yc5f+L(j=cl3V`Ns7ysV_t_t03Jt)LQs9IcaWi(i)zGnStebh8{SrdaV(pnVE06FLN0V05>doRH==N|m_QU{g z@(JtkqmFtfE|OYKk<$%HnLcX3==t@;oH7{&!OWEN`*xp72j4rv9Lb8HD^E@}x;@7C za$llFl`AQR`0C%1`2I2pzv4^>oX%w|qZ(3P(*p4Sx;Pw7P9M966=qS&JzgISdK0m7 zqtW;ErJv&g-{<$}ayF6i)GapWaK*tJ)oVR#&UQ+65oNK>o1dOl%6n}UA~k=8;GIRN zxAWJF{~M8D+Gr=<5Ji>9-A75I!l)x$fJ?xDHy-^7y6qz29BS975jyyv8SM}4fq&8q zMEdEFSeea33GRm-aL&dX=48H0@l7A>uoL&4okZoC|1yu`_ZdwN>la=e@O zPA>RpEPjeVs8a%oRGYB*%HG>=vub6nqjxWL z_N2sihDj}pbBQ)ndK1^8ko7R5ODo1EL&ACE|BP*+79Uc;bW#J%!L)kRK1;yCLAIv5 zan3nWzYz91?qR4Os0c&%BZPFnS0`y5mx7wa9omyL5&;K8xh zu!)e#ss$!$^c1!N3cf?iLh7cKkr|@k@`W2xksB00-T-i#QyIe?RD3a;7qGf`;eNv` zz}r)|%d@%YB8G+e&wfP-S&bz3bO&sgqxAm$EwESiBMqHnl|n-76vCd zsAw1Y5p%CNB-#tnH&tpsV9$co{zkkY-1vsv0Dm*U6KKiZwTujj^1MWxCZt+ntVaL{ ziJuxsm_+R70i$OgWa1*&0GjYU!G`hbTl~~x5hBEXj6Zjb42Ak8u~it>@HJ`D@H<0j zPvK4t^e1)*NN_l35vV{IOMn@Y61E7^0{R9JKr=P&R710tj$to&kJ3uOkB!m*Ep8@DhHgK?DyQ{zA&GHi47DtL|KM$M14NOJ zKTbME(JRs=*R1~7HVo7t0X_mh0yU?~o&X=V(=ld)IXftlAMZ0NVQ0W5H{j{o!bEhu zd39VL=UqI!RYJEXww~M|1S93?G)oAfjSV4}r)=nnGb1Zj4>GIz-Mb+!U&lm34RSI-xe9!(}V@GBXJ90LQpw1 z*}`xujdK+qM4Q*oB(j9S%3OjmOrKJdEyqlN8g?BpF%z$*YExN)WLR8l7N0{62@KTe zVx$=GL?Y_mnC*jcM*#FvWGpcWCf_?8-j43lO85ZNP6Y&aLUmCzhf$6SY@8cgv;8sT zNdg!I&oY+KU4Sl#-R1o>56~5KSPqS@4D(B_QwvWOxjHB)&R*TT3$M^3(i($F07e8+ zKa?glCjNx|ToL{FiMx`fHO{|c$y@5Q8{doDge`R4mdG`7! z=CQVntV|l?tlK?2L91ff#c)q4ih5(*JrAK61ji-TU<<`-N1|F zus$83Cv35B6suxY$~O6ARn%u~f7G^d#EH@N;_#u_=akDFxXFDGV#${SDkh{Uv7L78s+eI?egJk0FJN0{y_ny; zDH2ID^bhH_s7Na}F29xi^s3j)|Fu==7j#SEGfOY1h2|P(Y=tm#Y`*!D5`32V{IoJ% zf{CulWODG50*KCB^l@`KJH$V_YjyMLag@l75^SaHq|%eVbVW7&-9a;t9-;P8FVQwy zVGjC;UYvhH9yReSMDEyzQLCkft{u5DGK`aN%P!&jnYr&G$dG?J-$BH78v}bRp+|pE z*wCQASLTlk{bu~wN2d+mMr;OmaDZ_mb(9Axr|KbY*+Z@185E4lAP(?CO?8k)!Pn^p z{@kgCe&mh`G?u6`u--LQj@QWa%`ADY4{&2LSo@n|+IANN-p}mgyRR>zoVx?pZ=;lT zeliZ^y?OZ5q$W5Jm?%ldobuFQ_?-~uDQ0dcb*MVT@}kcK=`MsH8&G(%-IYCqFa_VQ z+zC0lEyjl)&=|gMhTH%Sk;_(Qjko>WHgN-b5XGmG4G$3Myo_j$(5NdHb04{ZoGC;n zjY=ROrXFib@Kda?t{p6M+C`_=YJQpvv#?p!mUJ8c(M?ab zGjJixE{GGx!#B2%jsnS1)X#ck*oSb35&LJf#_q6Q^qg4qMlZ z8ap_`v7aq1H)k83y<#!sg|1QkP1I7~?W%pt#)3;{fEll5~_|1{F&k zaZSOmE0Pc)sRTAA9W`A248IQY3Cnw>)Am|6h8-=|DaXDV*GFil97j%5ee1>Lxday= z2RqQ6j$h}le9^XqD`t6&+}^(t-0MLQzO)g!75)%Z&LZ`XfkKiEw4gvcwPSb^TaeMf zhOd){tI15Uork@0slEi6o*0`CY6*DNn{nxYkWfA-%8EupqjsE5O1Bf^)S0lnw%`W9 z51)(o3EyV7zmLm_lj6Hr#=sf$+yg!2JZK)OQ>l(i7=kYnpDiD)p&+3QuX@*dqgK{r z8xRsL-lIaIwBw&%P__4Ec2>W>+Vk>m(xR0!PG5VcLc`8*(R43MG3C2lJJ@x`??=uc z1Y6cKCsnej{gyc{JjkW4>1}5)ME`k_$5cF$?Gv0mzY; zod;Cw4-54HhM&YTNZm|q`wY}C!TlQNAD)O{v#8Y6UDWtqzw<0U;?vA63{twGSn=HY9fZfI1Ylweg}%x>>$8SitMRu zLyGR~Lx92#w+{flAU{Q@;QOTkLkt0LkY_z77dn#1TFFRjo?9Wg@F3LLfiPAP{8Y{T z#I~jK98md@vOwZVp;&gVDVLpx#Lr;@bEs0dkrVhaCLW<8L4qQygj`5^kD8(L@%IKP za>-_Lqb3=YVP&>rA2f~03|Zobw?S+;uzalX!NG0vVZjUQoaM|R+4s=$teQ=)b6hJs5j}8E21}%qF`+ztE`w*c5Wt|W>?t^k=D-+?#;>64F5%?E8{@G55M;d^_P-WxLOHs}DAsp%jsP#1a z@e>t|?%_t^dO|6wA%NN5f_%hYlw5oap7$goA3-LlAsat{gLecXq5)Rk(-w}fA`qMu z_W44?fbduC@w&W#^V5 zX5AlAP*>)7LN=7ySEAz=)R{lEbo9IE>>yyt$4y>XY8({w-br46;Nsv4lQnLs6!VS}BYJ~}ir1&R+Wx^uFn*rI#%$C%|0XfsfgDcy-F3-w5z(*|Hk=KP%D`@hVA zy_-h%MmJLSkbC&v+|a~*`0T)A_%O&x+Fo6^%ENl<>r_A8{n{PfCH{bHuoOaNUb_3tss zxvo>2d!qf_@<@^4ETW*N2K~)sdb90VLW|xZ^cKQ3cW;Q!=t86q;$cctG_%;LFZ)Wr z;sS5q492@*b_yi4wf)oy47g7>cfAM*W6}a`{5Dv~ub1`LTb?fWYB`TdwB(nbHG!U- z?cui%ZdkUYYyHvm)uie9kLrg2O(e9bJI-()Erp)@gz zv%OYvs(_yW>A(_wVN?6{A^yl)(A`vlv{`d6E~Y^>@Y>%^6WJsS&5F;>U*yx>2yj%EoN6=luN{vSlBeNDuFZ4KhlY=}XLqUcu~4Ks0P-&SbT)ro!rl5fxmo6@OXarxekxQa_h zrWWd?sL55GjD#8xoDVcPsjl91yQx-AUG||r{1s=P5W{7cU@5GcW=)$jRc@9G+goib zBr%+H@})@JlyK{VbC29QedB!o{=+L~kDk?@_!TYvGf5z8*~tYJGGDutIGzdL^_#Yv z0_HN4)A*1fo}kiq0Mwc^26b%d^4<-J1OqMWZ*APza=bwF6t>!{+_x7CW4vf?c_X6w zXJt-S{N(`jtE>t80xEVGc*}K>hl;@jZUVZ+zt7Bn+7^GMhotDPuu=WzPs)1R5-&Qt zUAfIc@P?_OX|o@0(W~mYUqTiOdI%`F>2N(Ji8Zo+vsd)0OVep#%kA6vQ0vt4o~_t6 zET#A&Y0Qa_d(3A=-KOSS$&Po!y+Y$IYE64AhbyMM^3fdI&Xj$4zo@M%{OGX!gTo`+ zI@EFCyy^Jq!D6CWu1MNAoLk4!#(&#%iC~*$x~kcl$;Sti!c(#) zBXN;jzMV%RM4ugfNHC+%u#8loHCjJAz2LC>`B^`7{`%`8e6ymsFz*G@Y@OHSdP9Uq zocPJT^UeGI${hc-1OMfL4?B0|Z{NB3X`1!3+*~(2E-qHgKPy{sgZ#FzTyd(B8BxjynoxEg@}bm;Z}$ z`#&oP|0~T(b_%n%2fzK59fqeg{bg2}(=Kv{>gbdq%8c*GPTA88gU)NrhBK1BTJgba z-J9FE=PC-rm~tJ}f6?E6XhFV~eJ7JcQH$6!7`r>8bqQyYLW!1*?fw*Y@=LR0}R=TPX!5yP4LpNpJo2lYy{{~u=xSW9^ZFDxi{jDKSh(wlUn>We&*Pp$Wicey z^~Bau?%HZkwD$>jWpumBbx$Bx_{b4acgJkYaB&aD&zgaaQ)%{-)`2T33d}}`*GgrG zDdfG33XUnTC`HuI#D_+|M_Fo%CZ$iK1(Hs1?2dzFt!E4soALX~o2B#nPYm+;+skp?y)}w?^ z>URn1pB4>YJOBt%q<2QnhQAp>YUF;iVs$Nh<&#j;SraTya2(FEyCR;Sf2uipBk~&# zt$zR5Fv)`D8cZ|D~lk;4f zGGzMN3e#q0yPC$}-d3Wu_K6b|qw&5Rfz67nAw_K?|IJ5byD)l(+g_-NBtr zB|9r?9=Tf}vaQD;atuT1+%jvAlgqbZS!j>7PnSu(K3~<%+c|?hVX1NLrMF&`itjA+ z|8{;b7n%3{?rQG4dC`(*!Sjq|!zjnVlF|DKD9^lm9ox7vulJQDNN#Xi>prx*3ZiJboGqY|Fs8%$2;CFXy1LJj8wOzAUXV0E1>eP_FgSH&8%?S~=I0BpLvVAHK^YUrybH~1p&zYiAOVm-q#1`_4-rL`Bjd0&EDY>NDZ#^q8Z zPG=8AajO(j?)F)fAP2WQ#J3#%sKBi&PgBlY%0{}6eE?#Rt~|k>w!2wIp{5osQ@-n> z5~>w%X*QifOh7$tQ^yI|5#-lnK7($KIO(-Z9gJLcuYNl;*{i`B%O{5Uk0$Se7YcmIvS2Oh|-z*cdV;J?z*SiHux^b zXKQhEng>t=>R@5K%nb8)hT?dgYpYvVyDA9yHR8gTaC9L5{bB+KW5lSBQ@R?HX>lHh zWtn*(l(DbmSC8nwB2&uabv$mhinH@UyN-EO3Zk zF|fmQG!C`LhA5;-ik|2C%6zX(&zrp*baAJ)^!c3lp)>K@CgqC-A2Ke#jrWb55c5%4 zfJE3!Z+k706VG2q2rKXdVfBG0P_&V`hLTTY9%v=irt{Y)EQJhA`Hf{*4j^!ntV}SJ9fi z-unVj%i0^K@Xf6>-+C}p&l6Xu5-DQ3jkTgFPQ^rb*RfHRmv&S|@L65K7x*kUjn%t6 zuUaT(_OUI?_nuyV8jyC5eaj7gRcwsd}9Fj@V5d92!6u zeM96@CbGV_-9n7@WEQ_^yOh#=owCtG5H)Nsz@Gj}^{8H`rBrCUS>W+g9AXF)a`9g6 z@|$k8RdSZ@b>o25Mv-2Cx-`xc7Y|ZJI%Q`hE$X^3sdnP7CCY`gwE%O&G?ZdbfBNc- z9tR!quGD*f(!qTzdpLARH90?N^Qo1*F8rVBC=0|LjDD1IvaNb+u+_!I>e5r?o&kJ2 zqq#{{c0q!v(9re-x3JSC23V%@N7A+e()P&V;tT`tjw@D?L@BSZB&J?(EP}liZ;aXc*-JI4%(ytQ};! z*Kh@2pK9v6Mo%U=RZHtV3erkizsFd9jMP3Tqb_(6a?3R<>fk#782lXVHoh=l3gaIg z`G+}Tk||+#XO+HPyKHhl{yvIq;w3Pq6Z9SHA@bTmoNv-CoMf#DGqLG)VABL*$!o&Eyf2nI|5#UNA?yL;ZFuA-crzgEK033ReB$t~6-#NeU1>807k!%KT1 zmo<`+7ZBedXuWP?!tUmbFaF6x-2-=z~TQ$w@1- z{hy+{ySv%xnll&8MyE`)#$O(hAF;(Qm40cxu$aLI-t&}F0ImDZzLYi10`YB z5AriiMcNd$y8ezz(rbF%zUkzs%&eg8WH^%V^}gk!^%jLf?Go|(;$7%_A+r{%A6qL4 z87Mk8QJy2rP4p55yM4#2>%=#Y)%xV{?=mRd0Md43UgnV}|(@(Sa zGt~U&+I;Q-UW@JY%$iNIv(2sXFdlg*&z?6h$8*EGuJ0SxWWq9E6hCCIesy{IWR2Bc z!}CaOHenn0rC64K=V1H`ZUfh7$h$Be?^ zA>xy|$6FERR8_ae#dblC=7wo9B7@w%QXSfSVuMe%~cGm7SOM#3U5;+jYR|11NJ zF0^k`gMc+x`IX5_<{t&giwv+uQ`|X-{LgAK6z-B0e|@8Da6<5-cV}=9pPPr?lm=y=ZQVC{v$BBEA^i4<<+Z(6lc9!J|=MK3iqfH+M3zD zaR;_W)nlDp@65xiz~3etM5hGR%QBbTOxaN38k+9cjBx;P{1kk9kG9NJ7^wMZLBqy} z5e2;}b5c8uO8^&^V8|o~?q?(g9gNR+G@kBkKn}&tCl|Y;GQV1}za8Y?FwZZP2B^XO zV_7nP^Qtd-G$e+_9T_S<9)77ubbBD1Pn&qphWdxa)8#4OkLwU7O{^CtW{;ZHNH0_~ ze(vq-3t=EHEZz!!|Ms6`yO@?@S*PYACoXL^*BSlt6a9^ENpuH(f~ICl!-?i6m()zF zlq24Bn6h-*i|N|<^>E{)I{XL8@`>m6nHhF?;Sx}$u)-_wLGF{g z>#=Fa=UOI_;{WhyJwm()=amaM{y#}P{8evLX77U79p>|zc0KPnv>BiXbRb5_mMm_f zc)oi!sMP(+D;MFj)411tG`fJ2u{jY_%2Lg4B%FV@XXV+6T?DJkFpRJiXHMaizVO~lDe%!k*!a8R5aOg8 zCD*xGuWr5}&);u-u3u2rha68{31wucb=5jb5T}qoyCocD2XgIB&i2J;CUmSpd5|;j z2W_m^mk1n84k>6*jLV7uvx)|S3Tn?-JHOl4VPLr8dGmE-P|KPj@ zQE%hadz1%Wm_C2G(QV@vLLnN=Ws>qPjzu#AzEA`{3!9&kRp>_VIV{7bP>UR?Ti5KT zKJja6ZJ{`)Prkv-LG2}GP$cf_dF&rGpp}>K3Ny&Lwq^P!I7%?dfRHNA(raD=5u^m~ zvw29|9XM~{(6W<*XP zWy;Prd=}ZYs@vv0impAiA*;HOOkV$tbax^VDlkN6$VlmHWNk}wos_z%w$?7|p2%xy z@4Hr*vJOZqnZT-S>a;8m%R2mMYLX8&x!QZ|^eNl}{OzGg+{fY;m=f=)ZZAn9EI$pQ zAj2WM?xQa9$7>nV?(TT|n<%e&AljFf?p?bU6+3Z~M=*-jXZlF};8XHma%(_V-iV4A z`j0<1S;Sv9*-A0=Kp@17ByttwO&3%k%Ke|plWRG^&|pJS7wl`Qn`}D$hOq)~#`m_2`CzQ(tR#i7>71Pux6ww_ZWy! zAH-3#+!H;>oB+--L+(o-F;BEP7t)yo#?zT-bZwabRYK%OdBlqZUNk{|{HP?vnxe^L z>R{S5S_Yv^ix3ACk_)B4;XQ=}E%<~7C?~*fTU9fnofNAb=-F(@k(%xlS{^FhMiwCAPdSil7 zFF&v;G^2pA;q2<1y=y1l6`24=za+*nNc0lG1*rCHXf6z&*=8};e2lX)QaA;b&P?zr zXHU6na{7$j)k;q5^uR7alRUFX_uo0*KZx8frK=pk`1~hU^hwErf(V(_JBl6K1;p&+ z@Vl01YvE3`?djK$Z7K6OJ9Y2k@7tG95C&F3#PuN|+9s+oPKj^!5I2t)z8kkM&iO6p z^Y2Z>h)_fXiU0@#? zd^*G+`|t;u;>Op_*716*vwhD}gJ~OY`4Co+2SW$H%)Hvvm|?*fn)D|9$tmSBN_RMF zKnmqIBCaQNv8FeE1Fi%T@uuZ-AEw3snXUDuZuEHs|9J6Jj@@c-51eL){;u-}zeMOk z@yZOT+IxoxIrDL`^NdGNgJ3z}dFsgQSCZ%cW|pw8NPK-8+tWoeam99;$Fs`h4{@E} zsB}?Q{T}1wC({1n^Z2=}Vf`>YX6}9aSyP1%y^~K-sl~NeeLA3^nQLDap1yuz|1PA~ zl2^dB9m_7$IqEsw!DsOfYUK+2KB_RixYL?uhn3l+*t&TI`K~iJ^*m|vQL*}pPCt`T z#I$jp3CO6AJB5{V!@Q$`Nqiz6#yGKJ!uq1#C(?KuR0S!de&WHD%l9j=NLIlq&mH3l z!MTLQcSxozooNbj3Knu)q|#^hxOb?WLE`X-{q@3GE;}E&199{~vdn;#;TM3tdS70^ zvK5v2$t4HBMD*2x8>Umfcm;y!3l}(_zxo-{cO%j*a%M5Zo`anQE~1a^mtVDMjK`_d zf$Kk~_0=LNy!b!cH4p-iyx{W#5S9O-+iDrK0qH<4hxQ3)cu7VBa)E`^x`MOOcm?Ga z;&9f-Hxx2lIao+CNy9^FbV$x%X>k1^n-&KZ-%G4hu3mV!TV{xQ=yA=utB;fp9XjMb z7K}>LMsUsSo3;g*W^xxqERR}X;po}zRE2p>#^kkr4(ky)x$MH4P_f4<>6qK9=)wDb z1Doi56RfLkPv}XTf>820*+k@VU>WfbqAcC~T6VZOZAzBsS+E07T%(F+HcLMwd@NP) zQ_9k3QvJfOBnQU8*YTf!`9X&B9pXnSnM*2(;{w(07)*S$+P}6JJ1PYMZ;M}j8}Rm# zCE}b|0&a29HWjO{=FeJBI68@Z>edk06^7=2->°GINE2IhJR>AhCEtF+Mm#D!P! z8=l`;Iip$bwDu(2$%tuvmbWQmd#P+Q&`q2eH1=qh1@{eTAQF&IBkc)xZ^CF8l2D@r z2{jUd0f6ud>*BrXQw~T2oix%4R(>Se3W6*_3#p?Uj?}*~$6MOho94H##W^3uwdizf%O-(}x(keO7YNFw=9vsThyGQI@Tzv* z1A}7de&wK4xmdT2oVbMPhbI{Jwi};2Uj&izmQ9YIANIIzO8^%-m(Tb!+ z-PHqg)eOU{U+2vjIxO=n0Og?tMu!YfQiX&bLna&jP_g^2phoiw`w|N#;Cpm@#WDX; zY<+tt#QPk)&BU%&Iz%XsBDDJ=d!+og?2#kHyi1vGP8<9+^Bqm`aQx^lGhJ-n!T5WM zM|U;w9LzRXNK3Hbrj(x^oJhQ7lL8@df61uRM+4cIchTgQxLNLlU>=HXPUVjz_P>`PD04(0;VWRuBrMwexyk0vtIv z%f^#eqYJ{+>xye`n6DP~d)Qt(Xb<((HY!B<%?_Tuy;*yz@me0=DnXPNtb9|0w5QQi zMfM82xu&x`uE}$!IK^-kib+hQsys_RxT{{{ zxC~So6+x4m)~B5}#gz#oqRmWZWDGoh{(9*U)NC0e6Ei z%5n`uPJ73axl!JooYHvjC#vWwD_I^!`>{8BAC#Rf#=on#c=jH}5XDQl&fmxzs&y?twM5`!8?%ydSVf z*&fNlcdfT(Jle?bsI|C?d)^Fu6{j};EkFX+fpN0?ZG)(Dqk*{bY|93PDvrbE#J$f- z2YS}6{O^783}|{x74K^2Qs=-pLs1rA(}Z&*z-mo)Yh7A2N7b}bXDIagp2c~WEM$nH zWo%H43%=R{D;lP`C6;AMNryc?Z(TJtDNyq{q$+BZU<;}*Tyu)GQIi;UoTeo2*qfKE zir$JW-?!}K2QF%zrAuVbP7r0;Z@sv1b<-nkC8LJ1rJLSNPO^;ndms(S13$PXI#kvAh256a5Qm}qC8L{y7FUh7egC}p zbIOY+xygbm)|JPNXdS1LeMVnD&le)peRc8Z^cO3_ryt+GSp5n>O?EV(Jq;c(SF5}s zrI>W3@4B{p$Fs_YY9FmH4tZ@*H{_~(#?ZcdHz(IGZdUKGMloFg^ zNh_b7uc;%&sj4gy{1N-)-%=D5h`{n1VIR0*n#Q*0iJxy$J2GSE!fjV~V58hA-ZZE# zKc@G>c5H8Qe8h@Ihx2EaO~f^gy91Cn@@Vs(^#MY@Qf%bMsDUSd7?f;+48ZWsPNaq*s7anh}JvfzUmC(A3E&ZH2E{I*2Y&pXw+ zS37;wZ;9?+P{qEch@Wm@^CD)hV9vco?(8CQCVa2r;+?`1)3(QAPOStx{AoJ*gnNB( z5P)Zw$8Gc3dq6kp%~S4*NSyI2ZzVUwO=k+t&r2;%MLiiuF-fZ_`j~uhOkE)>m31*3LfLtB+dsUzcaPIxcwdzOZ4N zwd=b~ffqVgqP#XUzziBsrYxR+$5wrPa-ZU3a4Y8-LiOYwwoGcK8tTYdGgIoi8IV%0 zkJ4Am#bZ||n|9tL1RZRs1i!8gRaUj*e3;&==&NH(vv~2R5Lm!|`^lc`nDRkeu044= zrWNawlr$nn@os0TqMy5bX@dDR_PmTOeVA3ehBz=L!9Avc>Av%eZ2n70fB{#q-JQCG zp*YvWkhpFgzG_fjwKZ9#Dq1)4?|O`e5~qm_t-R_~-1VX-50{<3J-hvs3TNI6M~jEF zzklq@&wjzFzL^W$Ntef0J&XxSi^&~peH6Y={yfKamw;JQxX}F}`zKQ~|LNPm@3%_E z;{(k7r|QEX>7iqf40r*dA4D9G(-w>Q zTS@UVL;Z#|JIa?E9{Do?G~SJ!Sh zeO!lFKLcM9ZguH^=fi*89hiCoPiX;{o;rb8&r5!rV7PaEUBuJ>o?L+~tfpl4 zNfzI()0aJ&BWt;jVB;t-+ci?KfpJIE8nQGYn4DHRj@v-aybUEv(3iRIQ7|Xt;C!@c zlo7vt)_Q8QwlGnMy_eV~pvD=XA+3q2dx&jVVjDCjcuOJ3AtKFy9D+d5*)@ZiZqb7K z&jH>rP*xe=&+`<_SOB9(ZwLuwr`r?z>Ht)Zz_bGY7vC^vR22p2g@9$^V}l>2(=vS~ zv2ZyS+9nt|XN zlW~?oenpzmnGrK(oV8YyYhuAnf?C9~G&4_G${MYqv5YXdz=Ug+>)-%H69%LZYL!%a z_f0_9yMWj#txE=tEA^r0G(`kKFsjSq9u@L9ye}g!U0;qhT>!l}P=r$Ltc;4gk;O$> zp@l=My6u!X3@bFvA{qZK({QY%gvTo!A{7>rxFf2lh}Bu#9mG~`fmU6jFKs@`5DYyj z3IqnSHiN3&|Yj^^ACjSodNr<;~=H>2$Ak&>J7P_}Ftb(J>%N7Pdu1nJbj zQ=4D-HxTeY>lhLPOF}&ii39z3?okEITbth?hH$E^2CpG9Z_WX%n%aDU;(ffZNJ}5j z>7`u#P6G26-E*%@w~dRKSsu5pNzaTmI3KL0!Ap^Y-?P8hxxRS(FM8oG>sot!CgRqk z^rK3Q&=1KeL}W>cPiW^+@@GZ6rN|Ale5C9mwRQu7P5K&?>Kl`Y#1iV=JwB4oHB%}I zYB_sIfC#F-^@@9y$p>2=P~9ultV)A;pgJL-y1+HBC}xWRN=6xo)gT}$B4ta^dsGqx zi^H9ap)rnEzpl8ro^zhFJ@>iKIrq8OQ1bRJ+*H7B54Nkq%10pDe$c&i3!@;7fGRy2h3e^%3nJJ?_7RiDlu3S(KirAw2tj-$F8I^uJi||3Q4+$E-lu(By@bV?L%%k| z{}<5k+vxw)!KLBvguQA00^`e~kKLK<*Xgi99V#EBLk#rn+1lrQl;3)rBc(HSzY{5U zDc0}z=jK0pluKgtwp5>8gxnYciYF`(((gnfTv4A41LbkPSA1h6a*y|})maso0Gu3{ zG$v2-TmSJCHuW;HNBXp&Yd{QL4crqn%?Srv^9!YKZ99`0;P z-3%{2Ae3%0ze4Zv#6ktlUe}M<)Wfj|k-#!hfY~cBlZub&UJrcX&)LlN(X5?-TEg0t zr;CuODQ|EBvC{lap_qVmQfn=RC<~Mw9*}{131kX5K5qh#Q|#gRfdwp?=_tftG8{;q z)&uuRbOf+T;Crw{8ETj`jfX@#41u>T0+5v*K#`efdkDVA-49L;174g$KZ9)pye(f1 zm=h-D6Z~IXd$olDqE;L@=lYUvprzr!KyFEzS3Yr{%mu_^@#N#8Uxi$jPw~^-(79e( z1$LrEH~5nDI>;>`)%gH&2edvjI> z)exL9h=Jv%S2IF?x^^?E1~@p)S}5Pej$dHoJJ;HzI4ZVO55Afl;R_JIMxw zw$}}1fn?qqIuy`-Nj?qFQjeAHNt&IbMbUV9SZP9MAl%1@a zL5+X@G!ZxBJ-WG;dNF@0oxPB$3%VERhW*`M82V9Mof3o?p9@XJV%;z6f{QO3o$If) z-~5O7W}41W+hMjxf#ZxrT+;FbfySM|ySb@JG{#ED-#kf#f}4RK?3nRINWTy`1*|Q> zyyyRu^G>JE9%U|&jE;OKtd)$WIge^gTSpbC?OkL4TF!ryoHloy){_Seix5Yk6Fk%c z^z@EBy!w_HvG>w}7J-c#FtYLNkw8F6z=;h{+q&6W+u!ta6$f4Nf6}W%jc7T@r10B= zWt4dxDx0ICnsXFC*_YYX$!>Pl5qh4J?oJvj`EZ|*W(fl&lVQGbwM#y|-;L+{^sm~i z=G$9g#txkPW`>#ZUcX!Fs(gFhS3xxA%2qyy`Q^h;@I%)YA<7VvoRZGML57=ulZ`B^)X_y&DPZe}VVh(> z!iLXP;@~Lx+t^bBB7)bLb`m=AZHK@F{?0zSLil~x3NbT*+0ZOCL0cd>>3ulx*{2mG zLrj65z8b%$^}2EEdRt)?<|jbsvOE} zJX%Ez-y>oB32U_D4NvI2gN*@Dc{%xO%%JiJd@4b^^h`)-dqN#oPFA@LVROJUG_;H_X-%X1UZJ%d~ z!w3qd)(d_2v&sLesyIgoopTe7@DbCjI__n!5B3(6t$OWk}dRegx1>)Qglpmz8`jxW2B=LxXRSVGw^RZDZdg?~cr) z1v`)4l#27?g5W=OcMUSU9)zT?LvHf3sH`s8_4aVy)*KnSDedlzg*Y1KMXD$PBRxB7 zWvXgkX-51PlNiBYj9AsB2U{uEdLm%#{$|(X^^YInU)Ui}FG31|HBh&~W?5q$mME!B zx?o0!e>#R3WURmqd&5wJeRhXx{`+BX*4Ow-lvmQ)TMC&H{=0C0B0@^NbGF7({#joA~5`*GvGcY zu7qRa%eqoUCD)fs2``_Hee_s77hBZAqAzg5Jy`HB!R69tP zm<&DrUSG`QtdWUMh0=Q~K*bjZg6KYb0momdfyYm+wr0yN3#-tSHO$2i7|wT)*+D({ zND1Fugb(K4s3r$*Q`*xAJ9ZCe2Knz$jNvxmtLRQTMG4&V2&v^7cQ?a(99u}Nh6JP5 zAv!9~R79QCy=uUDWIG=uovD#V8Ja#UFD!&~SwDrSs=TA89cAdU?5wUbAbd5y^jax7 ze$bh|i#9Q+i=;_Bg7MD_CF9Rxl$DX4(y%8;!1_XoNWWm?p}3SI79o$_0vM+ zne=taKjH7s;qjX(I^&+>K9aKfXx>PwEjSM0>~Z{qS#Utfa4o!JbrJfeocJEtqD^K9k{5|i-6lIEi%9fa33{# zU%tS=z8q2@^JQi7mH@7>Qe@BV=aSQxpoR6qA(jdkN0Xl^&PR@|W{uU6I1qNG;ybMU z^K<&8BweECs<2;*r3>Kj(b$og}e97E4VOaBCC>x^XXpDkamNSMBu z@mc%UgSJ)^l8`ZEJ1~G*TD>SfrU;y8HOp=TLw^xBzEF)!9eg1fAHu*Npj|cD|;O5 z6JAv%0#1Y73qdLLu|s@oWC8JG+M8G2Gh`q2@mPzvMy1v+bSTXtG9Exw(=V{f!Z&jI z<_xR6+hp;&h*PoUC6#y6S;4)Cp#cPrH}@g1JSHPP&Y>7hU|vm&koDB^laQcyzb3N& zU=!XBXgmiDld=S0NoV;1E13=IT)(0K{zcyJUu}BLm|{`VBIFJ}84`r{1kyji4=cl` zLiASj^?wfaXxsCib+0=PBx(ui?UX|MD8k};L)A_bT_$(JH>zJeoGn;;>srq@^xFdt z4@CmhkFl*Lz|Ua^W7ZnV%YF~NIZHkuRq($^W^BVp8#PBXrO|j@tC4i~%i3?G%>yAU z2aw6p&5X5QNd*er$mKM>idM(LW)vB4s{r!EmaQfx;YyoPl>0Q5b3r5n*)S^-H@mPO z58lq@G992kYm}wzVvv6`wAKEG`oK&*#2Mf=zrf_9>V&Q5OXXYy%$l@|Em7T~$wt$> zR3YFC)p2P931{PJ-$vHQt*7uAu-P z4+@6Dzb(gK63Ksl&i?I^>$@(Szrqh)0>VGyD|e?vO5ciI3jg_~mcWx)l)CMdZk+Lv zx?w;d15$!xqOI5Xu*h-Q$A&ubhhjZ)0EO%e9Sw+rOh^41{Ok!q*kf~L@^2iy_9%F5 zZ%DUe8U)(aUjWU<3JFHP-#X9|#GKK&+Y6Y{twH6zHU-yB+KLJqnk=ib^y`u2#Mjo} zQd$Tzo!_3$F1G@$2#8NQ`(2z+8v9TdHPsFA@I#!>N|bAA2@6eAIQOClXtG!B!|C!A`luNef#-wxo<8Ns~)b zq{8YeMc)aPimOA;A(uVsfe%@`6rBXnvZ7>~q{Wwbo9h1-Pe`N@Fobm~oo=ax3yTA4Woz+Tz}););}ZLt zu8|0@RNxnz6uEz5Z};vaQ_qxz?X#)jG`A5_m3*ZeDmR{tlViE13}IZp*gzG?m~yTV zRX@&ti;n9y@!iOUO%VUqulV>UCKH4O2|nHvF%`7qx*DRSjw7B3S)zgdcqRQ+y5b+K zM}H+Z?UTzVACgMi0&_ZhY=ell zc02^^VR|Qm1hV{)`$!@Q866aTISjeyR7P7*Nbua z+9y=arLXx`@lWlv57EU9ny!Sm3Ma$7TB@5 z5Rd;HJ?Y*Ojd~9~?yOwP!}q3kioi@v+#}y-yTIyy8035dKJVqq2Swxj`u@9 z*D+3UlRTS&PZfV;6jko%mV`Z+tD3Gy+}C~b7GrmRv5*!3`J656e;p%o%-8;$qmuAn z+42}}Pe5bcgSO^Go*EK&tmv#@H=y(YoEf6X7!|&e9mIZeGS9tX{cME%IDXl~&M*Myt*+dVuFhhUZ;qd z1*uW>Ez^Isr+>YkH&uA@MnsSE+M}jX+iDJVBQNTbcLg8V&hS*lZE}~%q`hj6QbDs! z)tb(7(m;80CdA|3zdoja5GB69(66QlS+wB9`b(SL`-@ZYk?aP8dYY=SkU-OuAqr+) zf|h$s>#SuI{ZApi{c zIY@ze(5X##fn))Q3bsH{qZHtH=na&(F%9$q90aj}d%H#;JDC|ZNpquqA{q!G(rdsV zkME$hT%mK#t&4IutFLVor0LRp`v@$+9a(;xYvEu57D*g)W=Lu+Qy?CDDLph{MR=yn zS7s67lm^&~BZrCAz1G$iV&+24=_+=F@jgml!-puy`)wC3BQ4CY`wQEjb5atfIMXHl z|BC8MC`G55JJS_&&2ry`^fNf;rMOiYMa0CuwI=NsN1NFfFcH)vjUbR~19v32r@MD< z3|#+!d{><#KB`+5I>m#n0Y>kDiEBf&Zu=5wvha>f*t#zzJoRj?o?D`;i>B`rp)C|SaW z2jJ0B6lrFu0Ide920y(ekxI#;)u3hU0~uRWzRS?6(WBaX;|a_(z4l(;7!1*JgJrO}br3`!z_Vq_&Xyx8XavO1%K zA4s(=r%*&QDp)w_GX%=?l8R+KSWye?)?h6egJ$lQ+JI(88c1WI9MsM5=<-2TAbAU3 z0su!fVH!#^14#k}@05Zn8YBXV=nVQhLM*0+&k^RP8$ld_CzDPTCZK^ezKrH15OP2Y zv`ScB1>;eG7j&crIZmQ!bTSWoOMTNRM7KxqMqmn)z+zE((CT9U;5rTg(8Re=kTRpSLIIZuS$rSAz;YPCV3sxvWU&t| ziC<2kM(Zu9VZLcg5sKMIADdFcOqUZJBo|w~NIre$#L+~;eyi98cjZBd|!AoG$ zNk_>51E(oQPk`xj2E%OV1Uj`K5nMJ!4FSknekzn>v<*Ksr9hc=hLGIa$mACQD=tD% z_d&^qs`9ya=?tT$(5Y^)X@hDv@bjahlxa{@n=sW1Fd;*oc>vT;Jlp;Q1V2FVYvqd{o8yno z@yE{aV`uoq&an87l?CnY;EnS_+qx}1V(pHyvLNIXm0(h^rDqitxFOmb>*HmQ_J)Ck z8OrV`+8#%H)HO3hz(84fP}Y!^lBT5;Xel){xQ-uA&j@FWLoXNASt=^`<)tpx{Yw+N zOZn2v`Jmcm6 zNG1hdc?ADaOXf>?v93OSkjx;d9@vD zeP7;ADjNw$7HLh$g~e~+e^DP&-*aHY-I>8x8Ec8B^Eun9+iDRW4R?npaXwCXIP+8e zh_21L2j? zvd+mOdzF3V0OtJ3+c6mF?4ny&B?g8vZTD`9^wZERBtCyTzHVa`Cl~YSONPUSoKw=` z&C;mYk#qfF&WH`u`FEpV@1Icg&ppqXvAaU*3L3vRGTIP%EF}2V?@YTA0)Y1Gw11fi z8EHACW$5aoakdV&INP7VYo@>d8+28Wejc{=E@&Lg4()_-R}~z8R4xd^IH(Gm%IQn# zduXAZF}nl2&_)3VjO_zl?3Ek@k!mV_%6@JhZlGb9pPQ?@x3ZtApsfSe4y_EHY1wc= z*isRki>jcEBtk+#3L&V*qT=P?sBEaM`=t^{sR}yda30EVxUa9Tq_2!5*2@WwP*PHY zOG(3}r6oWK32%RQoUNaPySLES7PQgc_Ffnd90uzSqqS&jhxNg!3JSu$wCnL*yYAkS zO9PX%$GXA63pl_(IISV@tbEW5>)>OL_EOWw*n45Uv5vTkJeVog%K;`WC5=#_mH$>o z1y1YhyS~4C&v!Y$IT{E1pFYyV$IEr;6CLc~Xjilw+8yT&2837|kb}K44uf+=t1UrE z!xgvu;EJJrm9nd?yOXM*pM(S2(bmTmC#YuZjE3oX*?Ks`dP5Uo2Mu9D2r%W#gLK8H zEk7)^0{_-Bc(Mn31`g}B+_(|i^J_0^C@+|nzq=F08}0RrR+dW9TKTCicy{d^FIxX;j6ZAfF9I82y==`(*`m-e9`XOFu#&eq)?{a0H1uI_JqJnTRC zVfhdGfc@xXMNs|$t{>o95d>CL_y>0V0N08ju%g00uxn-DT0Zu{H31N@KixCbzTH#6 z%~w^>7u-UA?>40P-ED|=zl6cT<<|)327@1fDanERsh2knrX(Zv_0oz^RFMC2YlVG( zZT)sh^1FQB+zr*Ydm}aEH6?;tB%_QN%L_rqo~d|wjiw&ff7Q zjpyI`#3GOw_w=0kc5@l%(`#;L z6_1>LcKqc?qVyXCok++2UWNmH`gRPjgZdH1T<5no7N3dKP^*42;vq<+kQ4efR^YBCyJ8?70A+9|N3 zMsTlib$XmSzkj&0=0`-!h8>Sp8MkH&^Wc@@vh|!Aoh%|Sar}+k+}cT-`PHxTzh(sP z{?|52lnTKSm-#pD(QPjMz@5Im;nBEf!()5h>s}tR(T|4hVUnjLh3f?3A4NUi6X3~| z;W*++xc1a6m~576OU2~8o*KTUe7gp(D%)B;Jc%h-@PE^3N{}=uGi-gwXTp@LtU?|@ z7Ma<6lDyayT$dfqNXOvj$={2Zd{}4W1(&IF%XzX z=3&erJBv+an1=YS(;pb`20=&Geu~AvjX|EX{8=u_imV1}s-0@)ab+yxl1Mk|xqEap#N@%vw z^vZJz+?Tmu#iEmZKYGil4r;-+sBI4@MYSPz&u3*jXH!}&Wd+8HRp&VN6uh(*7Ulp$*Aaj7q~_)e>1MF(VmXbw>I=E} zc~^Md(2)K?@iQ$Qm(vfz^6!L<@ERs0243Xggkl~RD?Pmv7Tz7!p}+MIw$T#%=talu z=FTxK^`Rd9q9*4qUEW7EeY%*4#?qghaTD@=8X$KC*)l7Tc$5bzKVFK9)u=Wo% z#E~!WO6@l1t=b!I=6~M)W9`eJ<`-8KUZ)4Yo9$#NA|_-7T55D2U7cDrn`*sQ{phOe zy5IgCF^jFzVC~lz@2G8m{K)-`H1hN&#=E_+L+#Zi=ezkDh96}Xv`*f;&?OGt!517X(rS>@{Ru3ZNR zIxhaIb!Vc>PC0zqxq-BM&2e}QQFgYh8h4k~Z}8m17TXdBK2PT6(wFEY`1zW5?)Q#U zSTBs)eX>}TU(5^czW2D&GlF2(=eYlE8C&9h>KYxz*IepTFGuZmj>L3t>|{&##c6eO zgsXmTaGgAnJ121=QueHY$OXOgTEmtmCv3GS(GneZU<)s8ghf~#Vg_U$CQkHUp0_hc zG|pYSZ>!>7a)&tZ!p*g5RwvHOf}7I2@q$+}k(YY#N>*rIv16@HiEr#aW!D=zlU|s` z(l@47scDx!^m{Jcu}~>WyWRfrIA71mttZ;KGcKoQ|48TVkp67(Ro8 z{^EVVgT*th?~Kc@_#6p35am9S#d9nl+x32ML?y2$(EP z+8Vyc-2qKwCL`pfq^#jam;m(B<8K|{@MZS%L0d03Z@~E0!n*pnxqHJD;0L|X4j6mD z27@7_zcH^7(n?ZrLo5~tqw!M>K~IiY7(!`@`3>KrZK;Bg)sfQF)?MRm_^ z9ocaWixkP{Np!>cy3(q`Q*B2Z{ivqFr@a<)^0Tj89XVm5&@Hk{aBAR<*1$YN2KOdv zE2mRGUY%FE{>5kM%@x&CA-URBR#{qZ`66tNBqOj$?nuWB&y*eX-PAMpZGkeL z#;=2m`(wDCm#6jaK)DEXJd>FnK#ZuQPgU_?$9x#jLFZIy>sM29CB5^p{`xJf!mSt@eoC$oT`FJRy7Fsop%eJR*OVTFlg> z>;_rt<$m0)OJ!D{+6+))H==!xTxCwoML$@JAAZ?$I9j%7(R!?UP2}XvwFAOrX~)CI z_`-vzLfq>qO=O{HsT7iGHu0U6Z@)0PVo^41GhQI?1NHj)g?ehwVFzZsTu1@2Sl|*V zv7tw=5I?Bmm1kzdkz6|7(TEv(w7GbDo1Dq>Hj?mRx$*I*#-Cy~r4&FS>eF7lAMsOv z7!tvjzgezRMF6LW8*IE<`CMmUzNfLLUl31djC86doeKJND6iJm&S9}!(mK+Rig&Sr z$B8D{oU9itr*o?#A)5X36iZ(_kW{fE9RsfAbJGRE`4%XZlG}~jaSBHwyi_L#)m~na zv6`b8y;rJSc$m$^J{3|j<+1zWmD^3&RlZRn)_!=akgnObV6c0LzQW5(nzG9@3xW?V^bW1q*ZMu;%Qo=ZY*h9R<()F89Xt!lfWl-kARFl}WuU+!z z8RLg+?7a`nBDfCTvOpQPs*lD23KSh{iy)rPBW)>EaG#7|S-QlM>$gBO>OEq#3 z{v=ov&lI=4Z3_S1Az-m)RMN*x3p5(uw)6-qonhIxf|Ph*!!6> zAr_mMD(0`xR1Giwn0rIn;%ZJum)n+jyX%7@p7?qW@iRqf4VCnrtG9CyE-5$e9ic}j z1=Q)M#Sf6IcsB*#uPggFb6V|GM)FOmYLSN(&L63#w*s+m%KJEo@}guDZw%zj+j}vH&Ks b7tYTM?a0a^FQX(cEyv0tBBF!RWo7vv`E@j7 literal 0 HcmV?d00001 diff --git a/packages/issuance/audits/PR1301/README.md b/packages/issuance/audits/PR1301/README.md index c8c0000c1..5afd2aecc 100644 --- a/packages/issuance/audits/PR1301/README.md +++ b/packages/issuance/audits/PR1301/README.md @@ -1,10 +1,11 @@ -# Trust Security Audit - PR #1301 / #1312 +# Trust Security Audit - PR #1301 / #1312 / #1325 **Auditor:** Trust Security **Period:** 2026-03-03 to 2026-03-19 **Commit:** 7405c9d5f73bce04734efb3f609b76d95ffb520e **Fix review commit:** 0bbb476f37f85d042927e84d8764fa58eb020ccf -**Report:** [Graph_PR1301_v02.pdf](Graph_PR1301_v02.pdf) +**2nd fix review commit:** f44fc5a4c74fa5190fd2892ae15a083b79f715f3 +**Report:** [Graph_PR1325_v03.pdf](Graph_PR1325_v03.pdf) ## Findings Summary @@ -14,22 +15,20 @@ | [TRST-H-2](TRST-H-2.md) | Invalid supportsInterface() returndata escapes try/catch | High | Fixed | | [TRST-H-3](TRST-H-3.md) | Stale escrow snapshot causes perpetual revert loop | High | Fixed | | [TRST-H-4](TRST-H-4.md) | EOA payer can block collection via EIP-7702 | High | Fixed | -| [TRST-M-1](TRST-M-1.md) | Micro-thaw griefing via permissionless depositTo() | Medium | Open | +| [TRST-M-1](TRST-M-1.md) | Micro-thaw griefing via permissionless depositTo() | Medium | Fixed | | [TRST-M-2](TRST-M-2.md) | tempJit fallback in beforeCollection() unreachable | Medium | Fixed | | [TRST-M-3](TRST-M-3.md) | Instant escrow mode degradation via agreement offer | Medium | Acknowledged | -| [TRST-M-4](TRST-M-4.md) | Returndata bombing via payer callbacks | Medium | Open | -| [TRST-M-5](TRST-M-5.md) | Perpetual thaw griefing via micro deposits | Medium | Open | +| [TRST-M-4](TRST-M-4.md) | Returndata bombing via payer callbacks | Medium | Fixed | | [TRST-L-1](TRST-L-1.md) | Insufficient gas for afterCollection callback | Low | Fixed | | [TRST-L-2](TRST-L-2.md) | Pending update over-reserves escrow | Low | Fixed | | [TRST-L-3](TRST-L-3.md) | Unsafe approveAgreement behavior during pause | Low | Fixed | | [TRST-L-4](TRST-L-4.md) | Pair tracking removal blocked by 1 wei donation | Low | Acknowledged | | [TRST-L-5](TRST-L-5.md) | \_computeMaxFirstClaim overestimates near deadline | Low | Fixed | -| [TRST-L-6](TRST-L-6.md) | Update offer cleanup bypassed via planted offer | Low | Open | -| [TRST-L-7](TRST-L-7.md) | cancel() order sensitivity leaves RCAU offer unreachable | Low | Open | -| [TRST-L-8](TRST-L-8.md) | EOA payer signatures cannot be revoked before deadline | Low | Open | -| [TRST-L-9](TRST-L-9.md) | Callback gas precheck does not account for overhead | Low | Open | -| [TRST-L-10](TRST-L-10.md) | EIP-7702 payer code change enables callback gas griefing | Low | Open | -| [TRST-L-11](TRST-L-11.md) | Inaccurate state flags in getAgreementDetails() | Low | Open | +| [TRST-L-6](TRST-L-6.md) | cancel() order sensitivity leaves RCAU offer unreachable | Low | Fixed | +| [TRST-L-7](TRST-L-7.md) | EOA payer signatures cannot be revoked before deadline | Low | Fixed | +| [TRST-L-8](TRST-L-8.md) | Callback gas precheck does not account for overhead | Low | Fixed | +| [TRST-L-9](TRST-L-9.md) | EIP-7702 payer code change enables callback gas griefing | Low | Fixed | +| [TRST-L-10](TRST-L-10.md) | Inaccurate state flags in getAgreementDetails() | Low | Fixed | ## Recommendations @@ -48,6 +47,7 @@ | [TRST-R-11](TRST-R-11.md) | Remove or implement unused state flags in IAgreementCollector | | [TRST-R-12](TRST-R-12.md) | Document ACCEPTED state returned for cancelled agreements | | [TRST-R-13](TRST-R-13.md) | Document reclaim reason change for stale allocation force-close | +| [TRST-R-14](TRST-R-14.md) | Avoid magic numbers in production code | ## Centralization Risks @@ -65,3 +65,8 @@ | [TRST-SR-2](TRST-SR-2.md) | Escrow thawing period creates prolonged fund immobility | | [TRST-SR-3](TRST-SR-3.md) | Issuance distribution dependency for RAM solvency | | [TRST-SR-4](TRST-SR-4.md) | Try/catch callback pattern silently degrades state consistency | + +## Notes on findings dropped between v02 and v03 + +- v02 **TRST-M-5** (Perpetual thaw griefing via micro deposits) was withdrawn in v03; the underlying concern is treated as a sub-vector of TRST-M-1, addressed by `minResidualEscrowFactor`. +- v02 **TRST-L-6** (Update offer cleanup bypassed via planted offer) was withdrawn in v03; the agreement.payer / per-version persistence refactor done for v03 TRST-L-6 / TRST-L-10 supersedes the original cleanup concern. diff --git a/packages/issuance/audits/PR1301/TRST-L-10.md b/packages/issuance/audits/PR1301/TRST-L-10.md index b4366cb71..73be05ec4 100644 --- a/packages/issuance/audits/PR1301/TRST-L-10.md +++ b/packages/issuance/audits/PR1301/TRST-L-10.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Logical flaws - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -21,13 +21,9 @@ In `_offerUpdate()`, OR the `ACCEPTED` bit into state when the underlying agreem ## Team Response -TBD - ---- - `getAgreementDetails()` previously ignored the `index` parameter and returned only `ACCEPTED` for any agreement past `NotAccepted`, regardless of whether a pending RCAU also existed. It now honors `index` as a generic version selector with two named aliases: -- `VERSION_CURRENT = 0` — the active version. For an accepted agreement, returns agreement fields + `activeTermsHash` with `REGISTERED | ACCEPTED`, plus `UPDATE` when the active terms came from an update. Pre-acceptance, returns the stored RCA offer with `REGISTERED`. Identity (`payer`, `dataService`, `serviceProvider`) is read from agreement storage in both cases; these fields are now persisted in `offer()` (see TRST-L-7). +- `VERSION_CURRENT = 0` — the active version. For an accepted agreement, returns agreement fields + `activeTermsHash` with `REGISTERED | ACCEPTED`, plus `UPDATE` when the active terms came from an update. Pre-acceptance, returns the stored RCA offer with `REGISTERED`. Identity (`payer`, `dataService`, `serviceProvider`) is read from agreement storage in both cases; these fields are now persisted in `offer()`. - `VERSION_NEXT = 1` — the next queued version: a pending RCAU awaiting acceptance. Returns `REGISTERED | UPDATE` when present; empty once accepted (at which point it has moved to `VERSION_CURRENT`). `getAgreementOfferAt()` mirrors the same per-version semantics: `VERSION_CURRENT` returns the offer that produced `activeTermsHash` (RCA pre-update or RCAU post-update); `VERSION_NEXT` returns the pending RCAU when distinct from the active hash. @@ -35,3 +31,9 @@ TBD `offer()` and `getAgreementDetails()` share a state composer keyed by version index, so both surfaces report identical flags. Flags split into per-version (`REGISTERED`, `ACCEPTED`, `UPDATE`, `SETTLED`) and per-agreement (`NOTICE_GIVEN`, `BY_PAYER`, `BY_PROVIDER`) groups. `ACCEPTED` is set only when the queried version equals `activeTermsHash`; `SETTLED` is scoped to the version's own claim (active or pending) so a non-zero claim on one version does not suppress `SETTLED` on the other. After `update()` promotes an RCAU to active, those bytes live in the RCAU slot. A subsequent `offer(OFFER_TYPE_UPDATE)` with a different hash overwrites that slot and the active RCAU's bytes, therefore they cannot be returned by `getAgreementOfferAt(id, VERSION_CURRENT)`. Resolving this without a hash-keyed terms store would require a third storage slot or a flexible-type slot, both judged disproportionate to the observability concern. + +## Mitigation Review + +The latest changes implement a more consistent viewing interface for the contracts, addressing the issues identified. + +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-6.md b/packages/issuance/audits/PR1301/TRST-L-6.md index efd132305..7ce2cd7ed 100644 --- a/packages/issuance/audits/PR1301/TRST-L-6.md +++ b/packages/issuance/audits/PR1301/TRST-L-6.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Time-sensitivity issues - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -17,15 +17,10 @@ Extend `_requirePayer()` to also check `rcauOffers` for a payer match when neith ## Team Response -TBD +Resolved by persisting `agreement.payer` from the first `offer()` instead of waiting until `accept()`. `_requirePayer` is replaced by an inline `agreement.payer` check at the `cancel()` call site, reading the persisted address directly without falling back through `rcaOffers`. `_offerUpdate` likewise reads `agreement.payer` instead of decoding the stored RCA bytes on every update offer. As a consequence, cancelling a pre-acceptance RCA offer and cancelling a pending RCAU offer are fully independent operations that may be performed in either order — neither path leaves the other unreachable, because the persistent `agreement.payer` continues to authorize the surviving offer. ---- +## Mitigation Review + +The restructuring of agreement data ensures no offer is orphaned and unreachable. -Resolved by persisting `agreement.payer` from the first `offer()` instead of waiting until -`accept()`. `_requirePayer` is replaced by an inline `agreement.payer` check at the -`cancel()` call site, reading the persisted address directly without falling back through -`rcaOffers`. `_offerUpdate` likewise reads `agreement.payer` instead of decoding the -stored RCA bytes on every update offer. As a consequence, cancelling a pre-acceptance -RCA offer and cancelling a pending RCAU offer are fully independent operations that may -be performed in either order — neither path leaves the other unreachable, because the -persistent `agreement.payer` continues to authorize the surviving offer. +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-7.md b/packages/issuance/audits/PR1301/TRST-L-7.md index 442dcd974..945864ff8 100644 --- a/packages/issuance/audits/PR1301/TRST-L-7.md +++ b/packages/issuance/audits/PR1301/TRST-L-7.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Functionality flaws - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -17,8 +17,10 @@ Expose a `cancelSignature(bytes32 hash)` entry point that records the hash as in ## Team Response -TBD +Added `SCOPE_SIGNED` flag to `cancel()`, giving EOA signers an on-chain revocation path like contract payers already have via `SCOPE_PENDING`. The signer calls `cancel(agreementId, termsHash, SCOPE_SIGNED)` which records `cancelledOffers[msg.sender][termsHash] = agreementId`. When `accept()` or `update()` later processes a signature, `_requireAuthorization` recovers the signer via ECDSA and rejects if the stored agreementId matches. Self-authenticating (keyed by signer address), idempotent, reversible (calling again with `bytes16(0)` undoes the cancellation), and combinable with other scopes. Also made `cancel` no-op when nothing exists on-chain instead of reverting. ---- +## Mitigation Review -Added `SCOPE_SIGNED` flag to `cancel()`, giving EOA signers an on-chain revocation path like contract payers already have via `SCOPE_PENDING`. The signer calls `cancel(agreementId, termsHash, SCOPE_SIGNED)` which records `cancelledOffers[msg.sender][termsHash] = agreementId`. When `accept()` or `update()` later processes a signature, `_requireAuthorization` recovers the signer via ECDSA and rejects if the stored agreementId matches. Self-authenticating (keyed by signer address), idempotent, reversible (calling again with `bytes16(0)` undoes the cancellation), and combinable with other scopes. Also made `cancel` no-op when nothing exists on-chain instead of reverting. +The introduced alternative cancel path is sufficient. It should be clarified that whenever a payer is represented by a signer, `cancel()` should be called by the signer, not payer. + +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-8.md b/packages/issuance/audits/PR1301/TRST-L-8.md index 2f8c4b56e..45160e043 100644 --- a/packages/issuance/audits/PR1301/TRST-L-8.md +++ b/packages/issuance/audits/PR1301/TRST-L-8.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Gas-related issues - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -17,10 +17,6 @@ Add explicit buffer constants to the precheck so that the comparison accounts fo ## Team Response -TBD - ---- - Added `CALLBACK_GAS_OVERHEAD = 3_000` constant. All three prechecks now use: ```solidity @@ -31,3 +27,9 @@ if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) Sized to cover the worst-case pre-opcode cost. The eligibility STATICCALL is the first access to the payer account on the collect path, so the EIP-2929 cold-account access cost (2_600) dominates; the remaining headroom covers `abi.encodeCall` and stack/memory setup. Subsequent `beforeCollection` / `afterCollection` calls hit the payer warm (100 gas access), so the buffer is generous there. Follows the Optimism buffer-constant pattern as suggested. + +## Mitigation Review + +Issue has been addressed as suggested. Worst-case scenario tests should be introduced to ensure the defined overhead constant is sufficient in future builds. + +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-9.md b/packages/issuance/audits/PR1301/TRST-L-9.md index 415690905..3e3ed2fee 100644 --- a/packages/issuance/audits/PR1301/TRST-L-9.md +++ b/packages/issuance/audits/PR1301/TRST-L-9.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Type confusion - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -17,13 +17,15 @@ Use the introduced `CONDITION_ELIGIBILITY_CHECK` flag in place of the live `code ## Team Response -TBD - ---- - Reusing `CONDITION_ELIGIBILITY_CHECK` for callback dispatch avoided because the eligibility checking is a different concern with different trust assumptions. An agreement can legitimately have one without the other. Introduced `CONDITION_AGREEMENT_OWNER` flag that mirrors the eligibility pattern: - `_requirePayerInterfaceSupport` validates `IERC165(payer).supportsInterface(type(IAgreementOwner).interfaceId)` if the flag is set, alongside the existing eligibility check. - `_preCollectCallbacks` and `_postCollectCallback` dispatch on `agreement.conditions & CONDITION_AGREEMENT_OWNER`, replacing the `payer.code.length` check. + +## Mitigation Review + +The root cause has been addressed. It is recommended to document that turning `CONDITION_ELIGIBILITY_CHECK` on an EOA is considered fully trusting it as it can upgrade to a contract that reverts the eligibility check. + +--- diff --git a/packages/issuance/audits/PR1301/TRST-M-1.md b/packages/issuance/audits/PR1301/TRST-M-1.md index 72927231d..bff9801e3 100644 --- a/packages/issuance/audits/PR1301/TRST-M-1.md +++ b/packages/issuance/audits/PR1301/TRST-M-1.md @@ -1,9 +1,11 @@ + + # TRST-M-1: Micro-thaw griefing via permissionless depositTo() and reconcileAgreement() - **Severity:** Medium - **Category:** Griefing attacks - **Source:** RecurringAgreementManager.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -29,8 +31,12 @@ Fixed. The griefing path remains reachable. Before any agreement is offered, a 1 wei donation to the (collector, provider) escrow account, followed by a permissionless call to `_reconcilePairTracking()` reaches `_updateEscrow()` with min and max at zero, and the thaw threshold is also at zero. Any positive excess passes the `thawThreshold <= excess` check, causing an `adjustThaw(thawTarget = 1)`. The same sequence also occurs after the final collection of an agreement, when `sumMaxNextClaim` transitions to zero via `afterCollection()` -> `_reconcileAndUpdateEscrow()` -> `_reconcileAgreement()`. There should be a nominal, non-negligible minimum thaw amount on top of the fraction check, applied in both `_reconcileProviderEscrow()` and `_withdrawAndRebalance()`. When `escrowBasis` is JustInTime, override the nominal skip so that dust can still be thawed out for solvency. ---- - -Added configurable `minThawFraction` (uint8, default 16 = 6.25% of `sumMaxNextClaim`) that skips thaws below threshold. +## Team Response The zero-threshold path when `sumMaxNextClaim = 0` is acknowledged. Timer resets do not occur (`evenIfTimerReset=false` rejects increases), so the vector is limited to postponing pair tracking cleanup via repeated dust deposits. Added `minResidualEscrowFactor` (uint8, default 50, threshold = 2^value ≈ 0.001 GRT for default): pairs with no agreements and escrow below threshold are dropped from tracking. Untracked pairs can still have escrow drained via blind thaw/withdraw on `reconcileProvider`. + +## Mitigation Review + +The main finding is considered acknowledged. Introduction of `minResidualEscrowFactor` is used only in maintaining of view-related bookkeeping. No new concerns have been introduced. + +--- diff --git a/packages/issuance/audits/PR1301/TRST-M-4.md b/packages/issuance/audits/PR1301/TRST-M-4.md index ad06eac0e..128055ad9 100644 --- a/packages/issuance/audits/PR1301/TRST-M-4.md +++ b/packages/issuance/audits/PR1301/TRST-M-4.md @@ -3,7 +3,7 @@ - **Severity:** Medium - **Category:** Gas-related issues - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -19,15 +19,15 @@ Replace the affected high-level call sites with inline assembly that performs th ## Team Response -TBD - ---- - -## Fix - Replaced all three call sites with inline assembly that bounds returndata copy: - **Eligibility staticcall**: copies at most 32 bytes into scratch space (0x00), reads the `uint256` result from there. - **beforeCollection / afterCollection**: copy 0 bytes (`retSize=0`), only the `bool success` from the CALL opcode is used. This prevents a malicious payer from forcing RETURNDATACOPY of ~850 KB per callback. + +## Mitigation Review + +Issue has been addressed as suggested. + +--- diff --git a/packages/issuance/audits/PR1301/TRST-R-14.md b/packages/issuance/audits/PR1301/TRST-R-14.md new file mode 100644 index 000000000..acf6f65c5 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-14.md @@ -0,0 +1,9 @@ +# TRST-R-14: Avoid magic numbers in production code + +- **Severity:** Recommendation + +## Description + +In the RecurringAgreementManager, `_getAgreementProvider()` calls `getAgreementDetails()` passing `0` as `index`. While in previous this was not used on the RecurringCollector, it is now handled as `VERSION_CURRENT` for correct logic of the collector. Consider using the constant from `IAgreementCollector` for futureproofing of the contract and clarifying the intention. + +--- From 9b30707b0237c15a67b20be1718712480c14b0c4 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 4 May 2026 16:13:11 +0000 Subject: [PATCH 43/47] docs(collector): clarify cancel() signer-vs-payer caller for SCOPE_SIGNED (TRST-L-7) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v03 mitigation review on TRST-L-7 asks for it to be clarified that when a payer is represented by a separate signer (Authorizable), the signer — not the payer — must call cancel() with SCOPE_SIGNED for the revocation to take effect against subsequent accept/update. Updated the IAgreementCollector NatSpec on cancel() to spell out the per-scope caller requirement, including that combining SCOPE_SIGNED with SCOPE_PENDING / SCOPE_ACTIVE only makes sense when msg.sender is both payer and signer. Mirrored the clarification in the RecurringCollector implementation comment so the dev-doc and inline comment agree. --- .../payments/collectors/RecurringCollector.sol | 8 ++------ .../contracts/horizon/IAgreementCollector.sol | 11 +++++++++-- packages/issuance/audits/PR1301/TRST-L-7.md | 2 ++ 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index ba4d2ff6a..1b0d15685 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -563,12 +563,8 @@ contract RecurringCollector is } /// @inheritdoc IAgreementCollector - /// @dev This implementation targets only the payer side of the agreement. - /// SCOPE_PENDING and SCOPE_ACTIVE enforce `msg.sender == agreement.payer`. - /// SCOPE_SIGNED has no caller check in this function; the entry it writes is - /// self-keyed by msg.sender and is consulted only later, during payer - /// authorization of a signed accept or update. Extending cancel to data-service - /// or service-provider callers is left for a future revision. + /// @dev Targets the payer side only; extending cancel to data-service or + /// service-provider callers is left for a future revision. function cancel(bytes16 agreementId, bytes32 termsHash, uint16 options) external whenNotPaused { RecurringCollectorStorage storage $ = _getStorage(); AgreementData storage agreement = $.agreements[agreementId]; diff --git a/packages/interfaces/contracts/horizon/IAgreementCollector.sol b/packages/interfaces/contracts/horizon/IAgreementCollector.sol index 5595466c7..41b39eba8 100644 --- a/packages/interfaces/contracts/horizon/IAgreementCollector.sol +++ b/packages/interfaces/contracts/horizon/IAgreementCollector.sol @@ -134,8 +134,15 @@ interface IAgreementCollector is IPaymentsCollector { /** * @notice Cancel an agreement, revoke a pending offer, or invalidate a signed offer. - * @dev Scopes can be combined. SCOPE_SIGNED is self-authenticating (keyed by msg.sender); - * SCOPE_PENDING and SCOPE_ACTIVE require payer authorization and no-op if nothing exists on-chain. + * @dev Scopes can be combined but the required caller differs by scope: + * - SCOPE_SIGNED is self-authenticating (keyed by msg.sender), so when the payer is represented + * by a separate signer via Authorizable the signer must call this function — calling as the + * payer writes against the wrong key and does not block the signature. + * - SCOPE_PENDING and SCOPE_ACTIVE require payer authorization and no-op if nothing exists + * on-chain. The payer (not the signer) must call. + * Combining SCOPE_SIGNED with SCOPE_PENDING / SCOPE_ACTIVE in a single call is therefore only + * useful when msg.sender is both the payer and the signer, which in this implementation only + * happens when an EOA signs for itself as payer. * @param agreementId The agreement's ID. For SCOPE_SIGNED, only blocks accept/update when * the agreementId matches; passing bytes16(0) undoes a previous cancellation. * @param termsHash EIP-712 hash identifying which terms to cancel. diff --git a/packages/issuance/audits/PR1301/TRST-L-7.md b/packages/issuance/audits/PR1301/TRST-L-7.md index 945864ff8..4b66346bf 100644 --- a/packages/issuance/audits/PR1301/TRST-L-7.md +++ b/packages/issuance/audits/PR1301/TRST-L-7.md @@ -24,3 +24,5 @@ Added `SCOPE_SIGNED` flag to `cancel()`, giving EOA signers an on-chain revocati The introduced alternative cancel path is sufficient. It should be clarified that whenever a payer is represented by a signer, `cancel()` should be called by the signer, not payer. --- + +Clarified in the `IAgreementCollector.cancel()` NatSpec: each scope's required caller is named explicitly (`SCOPE_SIGNED` → the ECDSA signer, `SCOPE_PENDING` / `SCOPE_ACTIVE` → the payer), and the combined-call case is noted as only useful when an EOA signs for itself as payer. Implementation `@dev` kept brief; per-scope caller behavior pulled in via `@inheritdoc`. From c21d7f88f65fea5ccd1d78aac375370f5d716b32 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 4 May 2026 16:20:12 +0000 Subject: [PATCH 44/47] test(collector): assert callbacks receive MAX_PAYER_CALLBACK_GAS with safety margin (TRST-L-8) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v03 mitigation review on TRST-L-8 asks for tests that ensure the defined CALLBACK_GAS_OVERHEAD constant stays sufficient as the code evolves. Existing tests cover the lower bound (precheck reverts under tight gas) but do not assert the upper bound — that when the precheck passes, the EIP-150 cap still forwards at least MAX_PAYER_CALLBACK_GAS to the callee. Added recordedBeforeCollectionGasleft / recordedAfterCollectionGasleft to MockAgreementOwner, sampled at the first opcode of each callback, and a regression test asserting both stay within 500 gas of MAX. The current overhead constant lands the recorded value ~300 below MAX (function dispatch overhead), leaving ~200 gas of headroom against the 500 tolerance — so an edit that adds pre-CALL Solidity overhead trips the alarm before CALLBACK_GAS_OVERHEAD becomes outright insufficient. --- .../contracts/mocks/CallbackGasProbe.sol | 57 +++++++++++ .../mocks/GasReportingEligibilityMock.sol | 33 +++++++ .../RecurringCollectorCallbackGas.test.ts | 97 +++++++++++++++++++ .../MockAgreementOwner.t.sol | 6 ++ .../recurring-collector/afterCollection.t.sol | 85 ++++++++++++++-- packages/issuance/audits/PR1301/TRST-L-8.md | 2 + 6 files changed, 274 insertions(+), 6 deletions(-) create mode 100644 packages/horizon/contracts/mocks/CallbackGasProbe.sol create mode 100644 packages/horizon/contracts/mocks/GasReportingEligibilityMock.sol create mode 100644 packages/horizon/test/deployment/RecurringCollectorCallbackGas.test.ts diff --git a/packages/horizon/contracts/mocks/CallbackGasProbe.sol b/packages/horizon/contracts/mocks/CallbackGasProbe.sol new file mode 100644 index 000000000..3bf76a5e6 --- /dev/null +++ b/packages/horizon/contracts/mocks/CallbackGasProbe.sol @@ -0,0 +1,57 @@ +// SPDX-License-Identifier: GPL-3.0-or-later + +pragma solidity ^0.8.27; + +import { IProviderEligibility } from "@graphprotocol/interfaces/contracts/issuance/eligibility/IProviderEligibility.sol"; + +/** + * @title CallbackGasProbe + * @author Edge & Node + * @notice Test-only contract that replicates the precheck + STATICCALL pattern used by + * `RecurringCollector._preCollectCallbacks` for the eligibility path. Exists so that + * Hardhat-side tests can verify, on a real EIP-2929-applying EVM (foundry's REVM in this + * project does not differentiate cold/warm in `gasleft()`-derived measurements), that + * `CALLBACK_GAS_OVERHEAD` covers the cold-account access cost on the staticcall. + * + * @dev MUST be kept in sync with the equivalent block in `RecurringCollector.sol`. If the + * production constants (`MAX_PAYER_CALLBACK_GAS`, `CALLBACK_GAS_OVERHEAD`) or the precheck / + * staticcall sequence change, mirror the change here. This probe is not deployed to any + * production network. + */ +contract CallbackGasProbe { + uint256 internal constant MAX_PAYER_CALLBACK_GAS = 1_500_000; + uint256 internal constant CALLBACK_GAS_OVERHEAD = 3_000; + + error CallbackGasProbeInsufficientCallbackGas(); + error CallbackGasProbeNotEligible(); + + /** + * @notice Re-runs the eligibility precheck + STATICCALL exactly as + * `RecurringCollector._preCollectCallbacks` does, against `payer`. Reverts with + * `CallbackGasProbeInsufficientCallbackGas` if the precheck blocks, or + * `CallbackGasProbeNotEligible` if the staticcall returned an explicit `false` (i.e. + * the forwarded gas was below whatever the payer mock requires). Used by the + * boundary test to discriminate "precheck is the gate" (overhead healthy) from + * "precheck passed but forwarded < threshold" (overhead insufficient for cold δ). + * @param payer The contract to staticcall for eligibility. + * @param provider The provider address passed through to `isEligible`. + */ + function probeEligibility(address payer, address provider) external view { + if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) { + revert CallbackGasProbeInsufficientCallbackGas(); + } + bytes memory cd = abi.encodeCall(IProviderEligibility.isEligible, (provider)); + bool success; + uint256 returnLen; + uint256 result; + // solhint-disable-next-line no-inline-assembly + assembly { + success := staticcall(MAX_PAYER_CALLBACK_GAS, payer, add(cd, 0x20), mload(cd), 0x00, 0x20) + returnLen := returndatasize() + result := mload(0x00) + } + if (success && !(returnLen < 32) && result == 0) { + revert CallbackGasProbeNotEligible(); + } + } +} diff --git a/packages/horizon/contracts/mocks/GasReportingEligibilityMock.sol b/packages/horizon/contracts/mocks/GasReportingEligibilityMock.sol new file mode 100644 index 000000000..21feb723b --- /dev/null +++ b/packages/horizon/contracts/mocks/GasReportingEligibilityMock.sol @@ -0,0 +1,33 @@ +// SPDX-License-Identifier: GPL-3.0-or-later + +pragma solidity ^0.8.27; + +import { IProviderEligibility } from "@graphprotocol/interfaces/contracts/issuance/eligibility/IProviderEligibility.sol"; +import { IERC165 } from "@openzeppelin/contracts/utils/introspection/IERC165.sol"; + +/** + * @title GasReportingEligibilityMock + * @author Edge & Node + * @notice Test-only mock that returns `gasleft() >= MIN_REQUIRED_GASLEFT` from `isEligible`. + * Encoding the budget check into the return value is the only signal a STATICCALL + * callee can give (no state writes, no logs), so the boundary discriminator at the + * caller side is "precheck reverted" vs "got false return → eligibility revert". + */ +contract GasReportingEligibilityMock is IProviderEligibility, IERC165 { + /// @notice Minimum forwarded `gasleft()` required for `isEligible` to return true. + uint256 public immutable MIN_REQUIRED_GASLEFT; + + constructor(uint256 minRequiredGasleft_) { + MIN_REQUIRED_GASLEFT = minRequiredGasleft_; + } + + /// @inheritdoc IProviderEligibility + function isEligible(address) external view override returns (bool) { + return !(gasleft() < MIN_REQUIRED_GASLEFT); + } + + /// @inheritdoc IERC165 + function supportsInterface(bytes4 interfaceId) external pure override returns (bool) { + return interfaceId == type(IProviderEligibility).interfaceId || interfaceId == type(IERC165).interfaceId; + } +} diff --git a/packages/horizon/test/deployment/RecurringCollectorCallbackGas.test.ts b/packages/horizon/test/deployment/RecurringCollectorCallbackGas.test.ts new file mode 100644 index 000000000..9fb6b51ba --- /dev/null +++ b/packages/horizon/test/deployment/RecurringCollectorCallbackGas.test.ts @@ -0,0 +1,97 @@ +import { expect } from 'chai' +import hre from 'hardhat' +import { ethers } from 'hardhat' + +/** + * Cold-path boundary check for `CALLBACK_GAS_OVERHEAD` in `RecurringCollector`. + * + * Foundry/REVM in this project does not differentiate cold/warm account access in + * `gasleft()`-derived measurements (verified empirically: `vm.cool` produces no gas + * differential, and a fresh-deployed contract's first staticcall costs the same as a + * subsequent one). The Foundry warm-path test + * (`test_Collect_Callbacks_ReceiveMaxPayerCallbackGas` in `afterCollection.t.sol`) bounds + * the warm δ; this Hardhat-side test exercises the cold δ that `CALLBACK_GAS_OVERHEAD` + * was actually sized for (EIP-2929 cold-account access ≈ 2_600 gas). + * + * Each `await probe.probeEligibility(...)` is a fresh ethers transaction, so each one + * starts with an empty access list — the first access to `payer` inside the call genuinely + * incurs the cold-access cost on Hardhat Network's EVM (which does apply EIP-2929). + * + * Discriminator at the boundary: + * - `CallbackGasProbeInsufficientCallbackGas` at `hi - 1` → precheck is the gate, OVERHEAD + * covers cold δ. + * - `CallbackGasProbeNotEligible` at `hi - 1` → precheck passed but forwarded gas was + * below `MAX − tolerance`, i.e. OVERHEAD < cold δ. + * + * **If this test fails with `NotEligible`**, `CALLBACK_GAS_OVERHEAD` no longer covers the + * cold-access cost. Action: bump it in `RecurringCollector.sol` (and mirror in + * `CallbackGasProbe.sol`); do not raise `tolerance` here. + */ +describe('RecurringCollector callback gas overhead (cold path)', () => { + const MAX_PAYER_CALLBACK_GAS = 1_500_000n + const TOLERANCE = 500n + + it('CALLBACK_GAS_OVERHEAD covers cold-access cost on the eligibility staticcall', async () => { + // Deploy the probe and a gasleft-reporting eligibility mock. The mock returns + // false from isEligible() if forwarded gas dropped below MAX_PAYER_CALLBACK_GAS - TOLERANCE. + const ProbeFactory = await ethers.getContractFactory('CallbackGasProbe') + const probe = await ProbeFactory.deploy() + await probe.waitForDeployment() + + const MockFactory = await ethers.getContractFactory('GasReportingEligibilityMock') + const mock = await MockFactory.deploy(MAX_PAYER_CALLBACK_GAS - TOLERANCE) + await mock.waitForDeployment() + + const provider = ethers.Wallet.createRandom().address + + const callBoundary = async (gasLimit: bigint): Promise<{ ok: boolean; reason: string }> => { + try { + // staticCall lets us probe a view function without sending a real transaction — + // but we still need a fresh-tx access list so the payer is cold. Hardhat treats + // each staticCall as its own eth_call invocation with a fresh access list. + await probe.probeEligibility.staticCall(await mock.getAddress(), provider, { gasLimit }) + return { ok: true, reason: 'success' } + } catch (e: any) { + // ethers v6 throws errors with `data` (revert payload) and a parsed `errorName`. + const data: string = e?.data ?? e?.info?.error?.data ?? '' + if (typeof data === 'string' && data.startsWith('0x')) { + const insufficientCallbackGasSel = probe.interface.getError( + 'CallbackGasProbeInsufficientCallbackGas', + )!.selector + const notEligibleSel = probe.interface.getError('CallbackGasProbeNotEligible')!.selector + if (data.startsWith(insufficientCallbackGasSel)) return { ok: false, reason: 'InsufficientCallbackGas' } + if (data.startsWith(notEligibleSel)) return { ok: false, reason: 'NotEligible' } + } + // Out-of-gas at the EVM-level (rather than a logic revert) shows up here too — + // treat as "below precheck threshold". + return { ok: false, reason: 'oog-or-other' } + } + } + + // Binary search the lowest gas at which probe succeeds. + let lo = 1_500_000n + let hi = 2_000_000n + while (hi - lo > 1n) { + const mid = (lo + hi) / 2n + const { ok } = await callBoundary(mid) + if (ok) hi = mid + else lo = mid + } + + // Sanity: succeeds at hi. + const success = await callBoundary(hi) + expect(success.ok, 'binary search settled on a gas value where probe should succeed').to.be.true + + // Discriminator: at hi - 1 the revert reason must be InsufficientCallbackGas (precheck + // is the gate), not NotEligible (forwarded gas dropped below MAX - tolerance). + const failure = await callBoundary(hi - 1n) + expect(failure.ok, 'expected revert at hi - 1').to.be.false + expect( + failure.reason, + `boundary revert at hi-1 was ${failure.reason}, expected InsufficientCallbackGas — CALLBACK_GAS_OVERHEAD does not cover cold delta`, + ).to.equal('InsufficientCallbackGas') + }) +}) + +// Suppress lint about unused hre import; some hardhat plugins require it for side effects. +void hre diff --git a/packages/horizon/test/unit/payments/recurring-collector/MockAgreementOwner.t.sol b/packages/horizon/test/unit/payments/recurring-collector/MockAgreementOwner.t.sol index 4ce043a29..0a63f011a 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/MockAgreementOwner.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/MockAgreementOwner.t.sol @@ -22,6 +22,8 @@ contract MockAgreementOwner is IAgreementOwner, IProviderEligibility, IERC165 { bytes16 public lastBeforeCollectionAgreementId; uint256 public lastBeforeCollectionTokens; + /// @notice gasleft() observed at the start of beforeCollection, for callback-budget assertions. + uint256 public recordedBeforeCollectionGasleft; bool public shouldRevertOnBeforeCollection; function setShouldRevertOnBeforeCollection(bool _shouldRevert) external { @@ -29,6 +31,7 @@ contract MockAgreementOwner is IAgreementOwner, IProviderEligibility, IERC165 { } function beforeCollection(bytes16 agreementId, uint256 tokensToCollect) external override { + recordedBeforeCollectionGasleft = gasleft(); if (shouldRevertOnBeforeCollection) { revert("MockAgreementOwner: forced revert on beforeCollection"); } @@ -38,6 +41,8 @@ contract MockAgreementOwner is IAgreementOwner, IProviderEligibility, IERC165 { bytes16 public lastCollectedAgreementId; uint256 public lastCollectedTokens; + /// @notice gasleft() observed at the start of afterCollection, for callback-budget assertions. + uint256 public recordedAfterCollectionGasleft; bool public shouldRevertOnCollected; function setShouldRevertOnCollected(bool _shouldRevert) external { @@ -45,6 +50,7 @@ contract MockAgreementOwner is IAgreementOwner, IProviderEligibility, IERC165 { } function afterCollection(bytes16 agreementId, uint256 tokensCollected) external override { + recordedAfterCollectionGasleft = gasleft(); if (shouldRevertOnCollected) { revert("MockAgreementOwner: forced revert on afterCollection"); } diff --git a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol index 61a5ac87d..3ae8ba938 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol @@ -194,7 +194,7 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { // Core logic + escrow call + beforeCollection + events uses ~200k gas. bool triggered; for (uint256 gasLimit = 1_700_000; gasLimit > 1_500_000; gasLimit -= 10_000) { - uint256 snap = vm.snapshot(); + uint256 snap = vm.snapshotState(); vm.prank(rca.dataService); (bool success, bytes memory returnData) = address(_recurringCollector).call{ gas: gasLimit }(callData); if (!success && returnData.length >= 4) { @@ -204,11 +204,11 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { } if (selector == IRecurringCollector.RecurringCollectorInsufficientCallbackGas.selector) { triggered = true; - assertTrue(vm.revertTo(snap)); + assertTrue(vm.revertToState(snap)); break; } } - assertTrue(vm.revertTo(snap)); + assertTrue(vm.revertToState(snap)); } assertTrue(triggered, "Should have triggered InsufficientCallbackGas at some gas limit"); } @@ -255,7 +255,7 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { // confirms at least one (the first, eligibility) trips InsufficientCallbackGas. bool triggered; for (uint256 gasLimit = 1_700_000; gasLimit > 1_500_000; gasLimit -= 10_000) { - uint256 snap = vm.snapshot(); + uint256 snap = vm.snapshotState(); vm.prank(rca.dataService); (bool success, bytes memory returnData) = address(_recurringCollector).call{ gas: gasLimit }(callData); if (!success && returnData.length >= 4) { @@ -266,15 +266,88 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { } if (selector == IRecurringCollector.RecurringCollectorInsufficientCallbackGas.selector) { triggered = true; - assertTrue(vm.revertTo(snap)); + assertTrue(vm.revertToState(snap)); break; } } - assertTrue(vm.revertTo(snap)); + assertTrue(vm.revertToState(snap)); } assertTrue(triggered, "eligibility precheck must trip InsufficientCallbackGas under tight gas"); } + /// @notice Boundary regression check on CALLBACK_GAS_OVERHEAD: at the lowest gas at which + /// `collect` succeeds, the after-callback precheck is just barely satisfied, so the EIP-150 + /// `gasleft * 63/64` cap is at its tightest. Asserting the callback's recorded gasleft stays + /// within `tolerance` of MAX_PAYER_CALLBACK_GAS verifies that `OVERHEAD ≥ δ` (the actual + /// pre-CALL Solidity overhead) at this collector configuration. Existing + /// `test_Collect_Revert_WhenInsufficientCallbackGas*` tests bracket the other side + /// (`gasleft < threshold` reverts with `InsufficientCallbackGas`). + /// + /// **If this test fails** look at *what changed*: + /// - You added pre-CALL Solidity overhead (extra arg encoding, an SLOAD before the assembly + /// block, or any code between the gasleft() precheck and the CALL opcode). + /// Action: bump `CALLBACK_GAS_OVERHEAD` in `RecurringCollector.sol` to cover the new δ, + /// or trim the new overhead. **Don't just raise `tolerance` here** — that silences the + /// alarm without restoring the production margin. + /// - You changed `MAX_PAYER_CALLBACK_GAS`. Update `expectedMin` to follow. + /// - You changed `MockAgreementOwner.afterCollection`'s prologue (added SLOADs, etc.) so the + /// `gasleft()` sample lands deeper into dispatch. Recorded baseline shifts. Adjust + /// `tolerance` only if you understand and accept the new overhead path. + /// + /// Numbers at the time of writing (CALLBACK_GAS_OVERHEAD = 3_000, MAX = 1_500_000, warm-call + /// δ ≈ 500, mock dispatch ≈ 300): recorded ≈ 1_499_700. tolerance 500 → assertion floor + /// 1_499_500, leaves ~200 gas of headroom. Reducing `OVERHEAD` to ~100 (sabotage check) + /// drops recorded to ~1_499_220 → fails. + function test_Collect_Callbacks_ReceiveMaxPayerCallbackGas() public { + uint256 expectedMin = 1_500_000; // mirrors MAX_PAYER_CALLBACK_GAS + uint256 tolerance = 500; + + MockAgreementOwner approver = _newApprover(); + (IRecurringCollector.RecurringCollectionAgreement memory rca, bytes16 agreementId) = _acceptUnsignedAgreement( + approver + ); + + skip(rca.minSecondsPerCollection); + bytes memory data = _generateCollectData( + _generateCollectParams(rca, agreementId, bytes32("col-budget"), 1 ether, 0) + ); + bytes memory callData = abi.encodeCall( + _recurringCollector.collect, + (IGraphPayments.PaymentTypes.IndexingFee, data) + ); + + // Binary-search the lowest external gas at which `collect` succeeds. With both + // CONDITION_AGREEMENT_OWNER callbacks live, the after-callback precheck is the + // bottleneck — at the lowest passing gas its precheck is just satisfied, so any + // shortfall in CALLBACK_GAS_OVERHEAD shows up in the after-callback's recorded gasleft. + uint256 lo = 1_500_000; // below threshold — collect reverts with InsufficientCallbackGas + uint256 hi = 2_000_000; // ample + while (hi - lo > 100) { + uint256 mid = (lo + hi) / 2; + uint256 snap = vm.snapshotState(); + vm.prank(rca.dataService); + (bool ok, ) = address(_recurringCollector).call{ gas: mid }(callData); + assertTrue(vm.revertToState(snap)); + if (ok) hi = mid; + else lo = mid; + } + + // Re-run at the lowest passing gas; this run's state we keep so the mock's recorded + // values are readable. + vm.prank(rca.dataService); + (bool finalOk, ) = address(_recurringCollector).call{ gas: hi }(callData); + assertTrue(finalOk, "collect failed at the gas value the binary search settled on"); + + // before-callback (cold first access) runs with plenty of remaining gas, so EIP-150 + // doesn't bite there even at the boundary. after-callback (warm) is where the cap + // tightens — that's the meaningful assertion. + assertGe( + approver.recordedAfterCollectionGasleft(), + expectedMin - tolerance, + "afterCollection received < MAX_PAYER_CALLBACK_GAS at boundary gas: CALLBACK_GAS_OVERHEAD margin eroded" + ); + } + function test_AfterCollection_NotCalledForEOAPayer(FuzzyTestCollect calldata fuzzy) public { // Use standard ECDSA-signed path (EOA payer, no contract) (IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, , , ) = _sensibleAuthorizeAndAccept( diff --git a/packages/issuance/audits/PR1301/TRST-L-8.md b/packages/issuance/audits/PR1301/TRST-L-8.md index 45160e043..d2d5e62e8 100644 --- a/packages/issuance/audits/PR1301/TRST-L-8.md +++ b/packages/issuance/audits/PR1301/TRST-L-8.md @@ -33,3 +33,5 @@ Follows the Optimism buffer-constant pattern as suggested. Issue has been addressed as suggested. Worst-case scenario tests should be introduced to ensure the defined overhead constant is sufficient in future builds. --- + +Boundary regression tests added on both sides of the precheck: warm path in Foundry, cold path in Hardhat (foundry/REVM does not apply EIP-2929 cold-access cost in this config, so a separate Hardhat test exercises real cold access). Sabotage-verified. From 75cae7ceb0ed02571e6d5491b70fb6447667e83e Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 4 May 2026 16:21:09 +0000 Subject: [PATCH 45/47] docs(collector): document EIP-7702 trust assumption for CONDITION_ELIGIBILITY_CHECK (TRST-L-9) The v03 mitigation review on TRST-L-9 asks for it to be documented that turning CONDITION_ELIGIBILITY_CHECK on against an EOA payer is considered fully trusting that payer, since EIP-7702 lets the EOA attach a contract that returns false from isEligible() to block collections at any time. The existing comment treated the flag as a plain opt-in feature without naming the EOA-via-7702 caveat. Expanded the NatSpec on the constant declaration so the trust boundary is visible at the same site readers consult when deciding whether to opt into the flag for a given payer. --- .../contracts/payments/collectors/RecurringCollector.sol | 6 +++++- packages/issuance/audits/PR1301/TRST-L-9.md | 2 ++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 1b0d15685..d56d6580b 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -65,7 +65,11 @@ contract RecurringCollector is /// @notice The minimum number of seconds that must be between two collections uint32 internal constant MIN_SECONDS_COLLECTION_WINDOW = 600; - /// @notice Condition flag: agreement requires eligibility checks before collection + /// @notice Condition flag: agreement requires eligibility checks before collection. + /// Setting this flag trusts the payer to apply correct eligibility logic in + /// isEligible(). The acceptance-time interface check excludes a pure EOA, but a + /// payer that did pass (contract, or EOA with a 7702 delegation at that moment) can + /// later answer dishonestly and block collection. uint16 internal constant CONDITION_ELIGIBILITY_CHECK = 1 << 0; /// @notice Condition flag: agreement uses the IAgreementOwner callbacks diff --git a/packages/issuance/audits/PR1301/TRST-L-9.md b/packages/issuance/audits/PR1301/TRST-L-9.md index 3e3ed2fee..1b9ba60d5 100644 --- a/packages/issuance/audits/PR1301/TRST-L-9.md +++ b/packages/issuance/audits/PR1301/TRST-L-9.md @@ -29,3 +29,5 @@ Introduced `CONDITION_AGREEMENT_OWNER` flag that mirrors the eligibility pattern The root cause has been addressed. It is recommended to document that turning `CONDITION_ELIGIBILITY_CHECK` on an EOA is considered fully trusting it as it can upgrade to a contract that reverts the eligibility check. --- + +Expanded the NatSpec on `CONDITION_ELIGIBILITY_CHECK` in `RecurringCollector.sol`: the flag trusts the payer to apply correct eligibility logic in `isEligible()`. The acceptance-time interface check excludes a pure EOA, but a payer that did pass (contract, or EOA with a 7702 delegation at that moment) can later answer dishonestly and block collection. From c8a5c21501f700a1fd7bc83d0fea169f969134ba Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 4 May 2026 17:16:50 +0000 Subject: [PATCH 46/47] refactor(ram): use VERSION_CURRENT instead of magic 0 in getAgreementDetails (TRST-R-14) The v03 report's TRST-R-14 flags _getAgreementProvider passing 0 as the index argument to IAgreementCollector.getAgreementDetails: that 0 is no longer a placeholder, it now selects VERSION_CURRENT at the collector, and the named constant communicates intent and survives any future remapping of version indices. Imports VERSION_CURRENT from the interface and substitutes it at the single call site. --- packages/issuance/audits/PR1301/TRST-R-14.md | 2 ++ .../contracts/agreement/RecurringAgreementManager.sol | 7 +++++-- 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/packages/issuance/audits/PR1301/TRST-R-14.md b/packages/issuance/audits/PR1301/TRST-R-14.md index acf6f65c5..ef6db21c2 100644 --- a/packages/issuance/audits/PR1301/TRST-R-14.md +++ b/packages/issuance/audits/PR1301/TRST-R-14.md @@ -7,3 +7,5 @@ In the RecurringAgreementManager, `_getAgreementProvider()` calls `getAgreementDetails()` passing `0` as `index`. While in previous this was not used on the RecurringCollector, it is now handled as `VERSION_CURRENT` for correct logic of the collector. Consider using the constant from `IAgreementCollector` for futureproofing of the contract and clarifying the intention. --- + +Imported `VERSION_CURRENT` from `IAgreementCollector` and substituted it for the literal `0` at the single call site in `_getAgreementProvider`. diff --git a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol index 4993ba3fe..750275800 100644 --- a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol +++ b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol @@ -15,7 +15,10 @@ import { IRecurringEscrowManagement } from "@graphprotocol/interfaces/contracts/ import { IProviderEligibilityManagement } from "@graphprotocol/interfaces/contracts/issuance/eligibility/IProviderEligibilityManagement.sol"; import { IRecurringAgreements } from "@graphprotocol/interfaces/contracts/issuance/agreement/IRecurringAgreements.sol"; import { IPaymentsEscrow } from "@graphprotocol/interfaces/contracts/horizon/IPaymentsEscrow.sol"; -import { IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; +import { + IAgreementCollector, + VERSION_CURRENT +} from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { IProviderEligibility } from "@graphprotocol/interfaces/contracts/issuance/eligibility/IProviderEligibility.sol"; import { IEmergencyRoleControl } from "@graphprotocol/interfaces/contracts/issuance/common/IEmergencyRoleControl.sol"; @@ -641,7 +644,7 @@ contract RecurringAgreementManager is } IAgreementCollector.AgreementDetails memory details = IAgreementCollector(collector).getAgreementDetails( agreementId, - 0 + VERSION_CURRENT ); provider = details.serviceProvider; if (provider == address(0)) { From a3c73f87e055e24ffbf70a84d6e83de2e8abc5e2 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Wed, 6 May 2026 09:17:26 +0000 Subject: [PATCH 47/47] chore(ci): fix flaky CI tests and silence block-timestamp lint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - subgraph-service: ScopedCancelActive integration test leaked the payer prank into post-cancel view-reads via resetPrank (startPrank). When fuzz picked rca.payer == SubgraphService's auto-deployed proxy admin (0x8816d8...), the verification reads on subgraphService reverted with ProxyDeniedAdminAccess. Switched to single-shot vm.prank for the cancel call and added a deterministic regression test using the failing seed. - horizon: TRST-L-8's MAX_PAYER_CALLBACK_GAS margin test asserts the production gas overhead, but `forge coverage` disables the optimizer, legitimately growing the dispatch δ past tolerance. Skip under FOUNDRY_COVERAGE=1 (set by the package's coverage scripts); direct `forge coverage` invocations still fail loudly. - foundry.toml (all 4 packages): exclude block-timestamp lint — pure noise across this codebase. --- packages/horizon/foundry.toml | 2 +- packages/horizon/package.json | 4 +- .../recurring-collector/afterCollection.t.sol | 10 +++ packages/issuance/foundry.toml | 2 +- packages/subgraph-service/foundry.toml | 2 +- .../indexing-agreement/integration.t.sol | 65 ++++++++++++++++++- packages/testing/foundry.toml | 2 +- 7 files changed, 79 insertions(+), 8 deletions(-) diff --git a/packages/horizon/foundry.toml b/packages/horizon/foundry.toml index ecc629b51..c13f2ebe0 100644 --- a/packages/horizon/foundry.toml +++ b/packages/horizon/foundry.toml @@ -14,4 +14,4 @@ no_match_coverage = "(^test/|/mocks/)" # Lint configuration [lint] ignore = ["contracts/mocks/imports.sol"] -exclude_lints = ["mixed-case-function", "mixed-case-variable"] +exclude_lints = ["mixed-case-function", "mixed-case-variable", "block-timestamp"] diff --git a/packages/horizon/package.json b/packages/horizon/package.json index 7662a48a3..121bc51ad 100644 --- a/packages/horizon/package.json +++ b/packages/horizon/package.json @@ -34,8 +34,8 @@ "test:self": "forge test", "test:deployment": "SECURE_ACCOUNTS_DISABLE_PROVIDER=true hardhat test test/deployment/*.ts", "test:integration": "./scripts/integration", - "test:coverage": "forge coverage", - "test:coverage:self": "mkdir -p coverage && forge coverage --report lcov --report-file coverage/lcov.info", + "test:coverage": "FOUNDRY_COVERAGE=1 forge coverage", + "test:coverage:self": "mkdir -p coverage && FOUNDRY_COVERAGE=1 forge coverage --report lcov --report-file coverage/lcov.info", "prepublishOnly": "pnpm run build" }, "devDependencies": { diff --git a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol index 3ae8ba938..63d72d809 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol @@ -299,6 +299,16 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { /// 1_499_500, leaves ~200 gas of headroom. Reducing `OVERHEAD` to ~100 (sabotage check) /// drops recorded to ~1_499_220 → fails. function test_Collect_Callbacks_ReceiveMaxPayerCallbackGas() public { + // Skip under `forge coverage`: the optimizer is disabled there, so dispatch δ + // is materially larger than under production settings (optimizer + via_ir). The + // whole point of this test is asserting the production margin — measuring against + // unoptimized bytecode answers a different question. The package's coverage + // scripts set FOUNDRY_COVERAGE=1; running `forge coverage` directly without it + // will fail this test loudly, which is the correct outcome. + if (vm.envOr("FOUNDRY_COVERAGE", false)) { + vm.skip(true); + } + uint256 expectedMin = 1_500_000; // mirrors MAX_PAYER_CALLBACK_GAS uint256 tolerance = 500; diff --git a/packages/issuance/foundry.toml b/packages/issuance/foundry.toml index c30c68e03..6de5f7434 100644 --- a/packages/issuance/foundry.toml +++ b/packages/issuance/foundry.toml @@ -24,5 +24,5 @@ no_match_coverage = "(^test/|^contracts/test/|/mocks/)" via_ir = false [lint] -exclude_lints = ["mixed-case-function", "mixed-case-variable"] +exclude_lints = ["mixed-case-function", "mixed-case-variable", "block-timestamp"] ignore = ["node_modules/**", "test/node_modules/**"] diff --git a/packages/subgraph-service/foundry.toml b/packages/subgraph-service/foundry.toml index 6dc1fcf17..8208c8baf 100644 --- a/packages/subgraph-service/foundry.toml +++ b/packages/subgraph-service/foundry.toml @@ -15,4 +15,4 @@ no_match_coverage = "(^test/|/mocks/)" # Lint configuration [lint] -exclude_lints = ["mixed-case-function", "mixed-case-variable"] +exclude_lints = ["mixed-case-function", "mixed-case-variable", "block-timestamp"] diff --git a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/integration.t.sol b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/integration.t.sol index 45f31e527..677086d3c 100644 --- a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/integration.t.sol +++ b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/integration.t.sol @@ -142,8 +142,13 @@ contract SubgraphServiceIndexingAgreementIntegrationTest is SubgraphServiceIndex IRecurringCollector.CancelAgreementBy.Payer ); - // Payer calls RC's scoped cancel — triggers the full callback chain - resetPrank(acceptedRca.payer); + // Payer calls RC's scoped cancel — triggers the full callback chain. + // Single-shot vm.prank (not resetPrank/startPrank) so the prank ends with this + // call. Otherwise the post-cancel view-reads below would inherit the prank, and + // when the fuzzer happens to pick the SubgraphService proxy's admin address as + // rca.payer, the proxy would reject those reads with ProxyDeniedAdminAccess. + vm.stopPrank(); + vm.prank(acceptedRca.payer); recurringCollector.cancel(agreementId, activeTermsHash, SCOPE_ACTIVE); // Verify agreement is canceled in RecurringCollector @@ -164,6 +169,62 @@ contract SubgraphServiceIndexingAgreementIntegrationTest is SubgraphServiceIndex ); } + /// @notice Regression: rca.payer collides with SubgraphService's auto-deployed + /// TransparentUpgradeableProxy admin (0x8816d8...). Without the post-cancel prank + /// release, the verification reads from subgraphService inherit msg.sender = payer + /// = proxyAdmin and revert with ProxyDeniedAdminAccess. Seed lifted from the + /// failing fuzz counterexample on CI run 25387077283. + function test_SubgraphService_ScopedCancelActive_PayerEqualsProxyAdmin_Regression() public { + Seed memory seed; + seed.indexer0 = IndexerSeed({ + addr: 0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38, + label: "indexer0", + unboundedProvisionTokens: 34685, + unboundedAllocationPrivateKey: 0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103, + subgraphDeploymentId: bytes32(uint256(0x46dd)) + }); + seed.indexer1 = IndexerSeed({ + addr: address(uint160(0x2a59)), + label: "indexer1", + unboundedProvisionTokens: 10000, + unboundedAllocationPrivateKey: 0x114a, + subgraphDeploymentId: 0xd8d69c1da829f8277e4e80945a974b3ca009835eb268c14bf9321952f1cf169e + }); + seed.rca = IRecurringCollector.RecurringCollectionAgreement({ + deadline: 11450, + endsAt: 1000000000000000000, + payer: 0x8816d87403E337Ff1349af38d49Ee0747079C55D, + dataService: 0x1804c8AB1F12E6bbf3894d4083f33e07309d1f38, + serviceProvider: address(uint160(0x3e57)), + maxInitialTokens: 3783, + maxOngoingTokensPerSecond: 16028, + minSecondsPerCollection: 208, + maxSecondsPerCollection: 876, + conditions: 1561, + nonce: 0xb59b65b7215c7fb95ac34d2ad5aed7c775c8bc77ad936b1b43e17b95efc8e400, + metadata: hex"0000000000000000000000000000000000000000000000000000000000000ad0" + }); + seed.rcau = IRecurringCollector.RecurringCollectionAgreementUpdate({ + agreementId: bytes16(0), + deadline: 962, + endsAt: 19984, + maxInitialTokens: 432000, + maxOngoingTokensPerSecond: 1928028033, + minSecondsPerCollection: 247, + maxSecondsPerCollection: 766814522, + conditions: 32, + nonce: 2123, + metadata: hex"676f7665726e6f72" + }); + seed.termsV1 = IndexingAgreement.IndexingAgreementTermsV1({ + tokensPerSecond: 16465, + tokensPerEntityPerSecond: 1 + }); + seed.payer = PayerSeed({ unboundedSignerPrivateKey: 10000 }); + + test_SubgraphService_ScopedCancelActive_ViaRecurringCollector_Integration(seed); + } + function test_SubgraphService_CollectIndexingRewards_ResizesToZeroWhenOverAllocated_Integration( Seed memory seed ) public { diff --git a/packages/testing/foundry.toml b/packages/testing/foundry.toml index 7cae558c3..8b632102a 100644 --- a/packages/testing/foundry.toml +++ b/packages/testing/foundry.toml @@ -23,5 +23,5 @@ solc_version = '0.8.34' evm_version = 'cancun' [lint] -exclude_lints = ["mixed-case-function", "mixed-case-variable"] +exclude_lints = ["mixed-case-function", "mixed-case-variable", "block-timestamp"] ignore = ["node_modules/**", "**/node_modules/**"]

?v_DjzqNG-dHgz_|j?h6wY4lKKqVpt}10{bv^~gVb?(K z_%l6ZEF&llF3@YaHJ<5^{xp8Qes)6`2dPF)K%aXCF0pa{G`fSvo4w`9N2Ny}^l!IS z**QI;2*e+#tzUFQJTs}T*G!`0ZP9&1w^6$AVKrZGqG^=~VC@#dr$Vy&8PFl-pOTOCuM?(`EI{#%1f*IuDC@O_p1s$Gj)MZR zQjqZwT5D2K-y}_<98SV1fBs%i+R@&Z89mD#jy}hq@g9}b zI7nNSfWDiW+Ln?+ z-I1CQWhbAs@merz3go&1E6UpMn|S5rwQ#&g-9h#&f1DhNdM#&9x?8k8>D?HJy;Ppd z*x4pOQ-i4+l`<%LJ7{Q&DRi>-)XGzmvyKm3^D}roZ|zlIA;Q9c4ix=sryNCQiM-0I zpxhcT4k~xmFUIyKa3N^`Ja}gEmq=jk-;?^S5xvV6I>fk)>%x{ToQnWg@J{;~F`E!i z2jp+vm~*aOqMo3iO}&0+`JkxXHLWC9k&m1Cpee87OY5w!)p5Na) zH9r9zkr|45_5M}^YL>l6(=x^kb%FEzXEgbR1gttjGc#i}R-&O{J$R8`e{G8%bxNs5o{5VfemLYkifrm6On=gHvwrJ2+~Kz*_La>P*;01>&z= z?P2CV@;ATl*Qv}}ny`xL=_`e3kJn<%lUIq2mpywc!t}S)vvA`<77?(nC2lrO`(5Xy zz6Eb8FQ>`hnF{=ee*&xIzk2_S@1X!(n@&}|$c}CapIaHWIBO?{-8n`aP7n{_&)an^ z+G^5tQkn{F>?BQeUr0z8ssI$% ziUOXtJjYJmsaez;-TO*wP*r&@cEpn9Rf%%?g1sS%-N9RDHYrR)ZpZmKz!B_ic^G&P zb~rb8+zj<%^nsJruk5UYx|X_C5MIW?nc{z}uVG_jl+ zI&adQPl(h9Vw`lcs=1IB@Rx4nF(MT9wtI7-r|5~h5r?h&J6Qfc{+giq3 zUgOd)*XDZVpox`cD2r=-aeFh-m##NAG^+P?JXG;9GzawpCR#bmvZJ1C+>sWn(N;v= zzsQf6a~bJlh))DBpQrw?Jp8kC{HZDNK8kp}R^FVQ%NA{~+v_}V`ZRcqh%x1V_^0gI zNYiF7eK&%CI{U zly&itb;{}l^gV|=GkR;}&qN$NKeL+Yw^UtV7k@$+=0agHLcDb_vtF;v)7wfLW`$NIO)1u z7Nv#6N;aA%bxU4IZJVe1IE?j5iGtrh*xZ9t!oB#t_(BwZ3vgNycpZ4f<67gj*WoW7 z3@4W595awY&}9l8gM(X7Xy=+;^-M~8+7|Gec+M%uqYxcHWdfoNMvnb9=?`(#3i*w_ zUVe*hk?o4ko1-_@YPt0IvNOt+d``G)BS>Gcu>TQ;gu3S~c&{;~ceLF}!FVcmP=Ul2 zBIy0jpZl*Ohtv~C+zK1lq0mkb08(*U3C4l<2EF|E`TJ!jvez+i4QV8~kiB$mL%h^t z>}zpUPYBf4&6jluTu;7U-^+Ai`t<~<_@u#QN2K1>(<1Vf`(3&>!8l@cFuXbfmU z2DGs4Qwt>O&7A+t@aARg2Z265bc>}}FcxwM09z4InHUGia0eM&Xl%&@cr6Tijm@{F zPyK{u^D?5rFh0ZEybL195OHKp{eUF}Y-k}fr;s^Cge!-P1_0h$)Yl!4{=9ES(Tc$SEOo-G?1j>iySG< zLci?u$+8UUr%m@TGkgJSb%MA#0>-QLY(Ef8eA$qf=$qpMS8clj3a{K~mjGdY+%0$G zB^XCbw`~@R!#1gNWE4QW)daB+UGqYHwHVlZ-6|) zf8e^tzx^Iqa5?%uquykTuhlIZ>*5oIAObCO0e_hw@`FUA+t;RlmPzyzdtvgZ|H#f? zu#bH$SoyrTSIkc>G8eW4#*gHQ#Pn1XGk2$JJx)Q6f#=DKz(B^T+FZLI(aIWba3P}o z)^+b!JF+jB{R|(IpS_PMM2z#hqLNzrkCcujDu?U>ze5E`YKKGgJ;$h z{o1b5IfssuVVa>9{xq$@B_7J-{7!2MU+r*fW2Ym06Z9hobP=1r@(T3)Ve?$NH1tV<8qrMaIt>Ig&^P_Acmd6 z+6Q;8c4qP{{fx*~ptLS&NE`13AI@bw1Rr`1bH)>dFlY2NvBQ`=);w*fs;zk@ux9mQ zM%g^mxVKv?n9VXF@aMD`Fh>WK>d(gxF9w0SfVsU5#O+!^Gw5p-GXeU6HL%+xm-wpc zxw3gl5-(ZIQPFc9_#+uVSI@N^%;ZDmV!5%t)T1a)6YtZYqFpchZtW$FA8&5MDGnB( zrS>F;OP4W6?5^YlU$I`X_Q|TTAnQa-IOM~76}Z9KL9FBUgW9P|vS+W{=-wIz#Nt9m zSAMPU^jeiH*CXj?V;)>mSi|%&^n^OPc|3f1&T7hd^Nc<-y9eem9`c>XPJ}iR0m^wh zBYbJ|##fpy4d!PY+9cBQ)n(iZu~6H&6{nkjrfOF*DrdCdv(ykV_IL$N=wY?a>(br{hGJ+ z>rRkPZMDR#U51;%|LmeFxR7FtaBH?Oq0%v{3L4u`%|-iu1FjJB&C8I5_j1=x%v zf)0p-N1aZT+*8d(aZ|3}IJU9wtfQH48!?A`IzbFv^^iKdD(PHkde8kGN4NKBqx)Xt zQ}n_i_t-OeQ;$A~%6Y8NX$5z>c!K?ywnHZ7eih_zp~`7xvzcF@MhyKOJw;&m^_E$4}!hQfqsAY z)neRp!HcbkbyU@Ig)E?Fa_Rp1AZ+!ru7uynjDaE>AXV+%iNv1>1G)t;rZT zMR(Qt(Uv+AyZ7O^T2SV~u$E%`h5qy{w#c>zs}J~e|GZ}v$Xv+Bp(V5;i=n*np`Pi@ z`OK7h_&nq|2~`ELe6ot0LY?~*B01|Zz+rtkf59>NBBByli)dY}xsMa?=Q*=uT?%1% z{`e{m8C)uu8|NR4Q;AWt41aR?@M=M&U*#a5FH{;KY_PZSeu{(Ao{b!wK$zhytafiG^A)i;(Td)7r+45f63)*0SSnD#xie)5VAbaO}i6EmULvHm%RDe7K(W-!<5 z&BDFGMyLynG3?u*OXRzEoanNwbe!x;j%=;=6VrFm9^e-kqNI_-#n9pDhUOukv=;uG z$#;jpCsRC{!t!+_W^CX>$r;$l3h;9Ewk_WVkQW(2CmixHeOr)z4rOrjdM)rC?%You z7SoY3rS37q^-%Kd8OAakUHtn5@m~J=p{`e3uZ_vetMoVnCK?#eMES7MzZn~PBLk*w z>?`Qd9x&3YIfpMpJTK%7rU1w;LHn}(FSW;FhE200TBY9wMfMw-`DXm_uxhoI3~Sv> z?|Gss_d_qSykqXIu)+>tD8Pr-yQ`Hrv)5Ony1X-S5w2C;^4Bm=1ltxV&VLqsgbk`# zD!T06`mmwZ1vkT@Y>_oN%G52r@0D|CQmOV5?Yl}jcZnm!4Q%`?f}Yn#YP^5K##`5W zVyJhyP)vXuaOpU$WQ#lsx|=GvFDwM=bZrje$k7B=*3;iyxk&EFK|Vj>b8-y_0BiCz zIDf!$ow1ho^)=y9L)$E8B#bI@u7Fns%V*!19VYSSQ+Q6k>ij>i zvdTf=O5A&tKdDpl7QOYrh&z^g>;)QCX+8iShj|`$WG+Ui=X&{2#yaJ z&syH^4!sql?}vvWdGgHaRis^0DaaXpR7wMOz{_KD!0*5j3 zUc+#(r`Ycp9Bebr^pH`BUoXpp_wVNai=oaCZ@uU4X`Z3oynj9ydg_3~{4$9^y2LsjYeRSm zlik79UXe$fT?@W>nZAJz^a@*~>e6cxDhz{ZjKzSU`!o2GGXkJiijw+b8IJFo(l~zA zh~d{ilkg{(r@W)(Ws`3$bYmlJdB4Z%`A2TAIc3A~rzN260HalocX!z5@ot_`l0l5y zzMEG-pgxMLb(oT5)nVJVhw<-g{YPwvuq$R`3JA;QF#0H^-o}ShO7u?6negwpQ|awW zsgSr|n%rxCv4V9swjF+=L=Lo_h>i~4R#=BMp|)AH`siz%l%`4f;@N2MlNIy7S0(sX z?to}wDRQAG;z2I78!Y!rKo*<%vli5OZ?{;-02c;1*Msy-9{9F*eZ~~{9G7pPgFjc% zgIg4?+ONskNlATqkM79Hg}gHPZ?^}jRBKEEK&xrMlvTNlpnvN7rQamH>CZ#@OG=>T z(&0tdZq&aiSf*KYOOANb35VHd=jko?ORRlz!<{z{tvhO|inaoc(AMhr@_Up`AChy= z8afKdoYDu*cbFxNhSK`j(7^_maPj!?@k@tw5xq^<39Es+&GR`3+PL6J`}7kVATM+w zDO9r9Nu1a^|Hauy!eVWti|Bn_4@W^rhxVz;%8`H?3_R?_*yl#v)RlxQOFkM$9B0_R zV!%a~^}8RH=Um%LYTcW_Q5GUBP2sE2{NqgV!IrVoA|Gtyybpw9Itk%KdV3wSjoZY0 z3&eBj2FM-UUHP8(AIem^MOCD=<{DsgkHChzAm$_+tJ~G47x3;1Mc&>^-uT_&@m=?f z%pO4toloPGq;xT@7QnJ0h6hgytS2010~wb%0qjp{LqFCpaHlmOHY%`p@IaaAL@BtE zd;@M-#tR0n#hT3l7=%{u$6(>WJ$9;A2)Wz38m7vA`~W`_d;pO679D_mfDe2Z0<;(g zF7Z!J@o*CJ7K}7zjBpe)N+A~z6!bCfK%sddFwSAcLFUxq;$+UgmE_U>N+g-G$DN0h z2n}->Jg?ROCmx2fcp-Vb6O3ynITXM@Q(VWua}CD!yv4xNcV0RUq7RO_+xCJ*NC4Ame)BQ>>o$F$sU$3eo4Y?|Y~_5+V0_AG;$;AG z_!!QeOugZ42h2P~77@dHuOP~^&;XoD7{ieGoDm8#M66j;0WK9XG4*u-xSEp25d`o} z@q~|Z0>HYEk^sz6=2?b-4JE*!4a*ct{-O$rR|PP;Cucqm#iEHfd>8m*M<~|(W?8sW zU+as0blS9-sA8a60^E(~shjM5m<#Dk0M}>WxU0pQPo4#Sjp-bgF&&(7-pK7su)|#_ zjv(-C<}L3-T^9-nbi=5YFG?6-2)~h9^tAp=Cr1b_3(^q#1Bs2L>itoQU$!6Xgq@v z!tlwU6kOq>!{KCs$gdNVTM4#(csLnuu9>I-Q#QJjIKCiMFteFu3WlOimV_&sE`cVk zc>p7iL}#{IkFl!Y!9EbWUmMILDaV)#VIMoPSulVM!7TA$GrGosGc_6PEkG^7q6O1r zSX`)wJPH;Ld;}Mqp`qD=+RYOWV!#g$dP`74w@?8kq-L7_(pqM#nSa>mVz5>ivMeGf z4jSPB7^S{C_EGC>lDi{U3mmYyAl`D~%5Wn%8Pu{5%8d9q1f7@K7vP{!<>bMI6532@TajpMH%|3zSYFOMDY zmDH~YUSs*_EZn{VL`&f>Sdpc9`WQxxZ6PP_IV*;s%fs&Z*Zki8c~drFD5^Fql#!a# z&-&i9MRwo(d2LU^oWE)GW5aEC_qWN<_3gR08*X;QDOr8eiIgr=R}4^SS4Ub{(e;a! z-%d9KSM$VfFqQcX+Hp*woNKB3yAj`M01xZWK(zcs;q#>miP}khgY}G^?>nAk4A-yvNmApHP-DJ2#U)O3BEtK`8nmeGJhQrla_lMgre0a{+5^ZT`Dj9R% z{oZ7{`c8S-vW~-b8A#%~IH)72^!YUJdWE*0RoHP&Ak}4>E&~Z`MI2`VyAqmV?dirw z9LEj<9x4K!J2oV4;A;HIhqvNbdUw*vkw6mJ7f@xqLQo?|d{B}B>uLDC7a%2f(fPleJ$qv|Vq!vez*BJPEAejvTar`9m)7K-l90D)} zwHWa}=S^iCNK>3Jma4+@njnGi$=wJw&J^^A!8`zCg`$DZ5X6&k!l3(+W=_Bumb#D& z-Q&%ij-hLjIaA<~iH{S2+U5fkK~Q>kq7+Nl%Hoysta0QdUMcxQp&;m*jbV$H1I59b z9l#rTG$)|#V@i#s1!QufI~b@X7urA3F$1p5daGH3YO%jqMh-2hGayrq^@@ z6j@o1GpfNV=DpWq3e>~RB@=W9C@X;tJw;A#VYeF$9|?)BgjP>QrBem(&Yem>#U zA3vWE_q^>+Ms1~LV*nv*srtF3Rr?-wVOH)oL*7FJy=~AGB5s{5qC${M0)R z?SAexMpwaaqb;4KG*ufhY*>U1%JP-0R_d%%+M~Mt#g@|~Eo?y(huw_~nBedC4jy#A zvA5X9Mzq{%;gt0TAi9{3NsE?n@~^rpXGS~NKSEzT*_It&_{JqcJPD`@RO<+43Tby0 zz35n|?dAwQ*$Rd_@J4<1HJdR;d^tBA~Q!~^n{(1nS1*4>fZoRBO-6Nt(jdqYD zh3L@c%l`k3Oawis06p{0BT7J(P4vpg?!tZ^w%{otM-htvhM`cPPZ&BmiZy2EJIyee z=5K%H&N}p3b>wqhL+ZNCa$lTd&lx&`xkrArfuey=-5a9Nn6~D4jNsP4`b!!hj-XHWRHdeo|(nlSc4Crfi zPPSh`nSFMwME>Vc1;kc|qt??I5#w89XIIQwkPMUH{TTAzKebT@g<_oq)dI zZzHqIC-X^<#-=tJR4GX3w+S9WrK?8W7rf>|k37jY^&szI{(9JForyms@M{{>L|tcz z5#jJI_}xx&Z<#u>dlIofmfWVnaVs)8kD9A~0H6Gv)Q3~}u^zt_%lp%S?HM*jmhm#R zv#a|XI>RWH@hTRt0bj773{Ky{xMUc#)%#9aTl%)3BB1>$)uIPQkA)KTNA|IIHom#RJJz6eH?{mInRL$P%fK5pd;|tL1 zj<)IQI~Mj>VS4Wp9VAX_)hmWv&V3@2+K-WiH}1U9f&jnrt3wlQ?Kdx86ivC2 z^|WrMqh%8F*U?c{t}U{#?&6#D89RQ9^7>b8V)U+pg%z2sHTQORBzVllj=pqkFCgf| z@skv*z|G&xgA0kfx|VE8!nOn2?6}FV;`c1&m)oO9Y*7$w?pvuCqh2+v!UZpdM;GvG zUtal4o6W%hGh_W~1noiciR16BvZGEOzSxWf&+xYWcduVD^_^a;UwPTZ%bIoUndOHD zzl71VSBX)V+H>=4@7+=mwB1qd&;@1$x>X%nNpBA0NabylnX!B4>R#0|cUd3^W;Uis zOV}toc5gb8eSJ13i7@*S<5ElC;dz-4trf3qcLtZ7j^)IN$EJ_(+pUn1IeE(COgQ!i zh&be79h^6t;a{v$>fze4E4nxXv%pucq7B?aQvNN5F|n~|FNT;`r#ozMU+uziX#=3v z?uPr%A^Ns{qVX>g=>zU1%>#QyYZ6PGZRTUlt`fnuYHqyvm%IL>)bjbeQES49Hsc!A z(x$lO6_t{}^!u)-R9KAHo*(G;eYGI4aCFbl>6|ZnMn? z9=6dFrfuT4ls~p$=o|XdyF#slc9|iCHrSzCOPL2Iei-Yow4mG9niY^)A#G*%z;p9d z+WJA2+e0_QS`f9sbi3TzFJ4n`d%16V2;>fs?<=qS4cQN{6r4B)nX?7%co2^rxWT)| zo?ytf!ee7qLF`ONjw(SBkpvxy%+?rv=1P?-Z89m^l8V4@6>-qq|F$19Q z;35qWeHdgkgEaX=num{|)8I<{FQ60Br%up!z~%UlEMRO{kqz98^>l`LfIXUFR^P=I z1eap~ZG7m%9=H@&aiNu;y7)^Prq2ZB0LA$DeFb~Uv5DUYoWTDV-2<)LW5C^-XIzt7 z1nzzYURs}%sT0ZZ4qzDreLqfP3jx=O!5H3FfeFVYf04#g)*glFvOG|L_nW@(hhzpw z%JII9i)9NrUHgC79YK}reW5eB!c$49Ec&L+GE zp;-PXN(4pOAlexZ#qcKsG^8<$%{&TL+5l`)DilDI44%Uu+XMJdLI?1rKFXV!8=0=a!%{SXn=|O^W7!yh zH+W4BvQe5~8J#}Tp))V%rlHaXDb)MVTgu8hx z5Xtsz)3pIdVsX^U!0i$154o;7yx$Lf?f*QGy~d8Wx$%jPuCj%Nb03q|irXUly{s+_ zYP38))4BS}&gm2HACK~5Ec%BTHPT=>XgV?YWi%`5DMd?O% zT|5vaym!8N)cSclckJ`iF+={e>HnChL-yhW>eEKD3fZgcvW$<5WslF)h1;@ik@xt? zPGo_v-kbi{^jp+bF+#v1_{0i3t_OMiv}+v#UYG8$ZtvZ6^Ju*SL*gyqzIA{wbM0w@ z&=g4X=iMDA-Emnd=#Xb6BC-!B9NDW5z11`9!ii4At3bZcS7m9N`pPa3pF7XgROnFf z#wkxQ<14|By2Q7KQzEZKimdrJ1Tk)_~}7tEk?(|E{1+h|Ds(@-2y%{&vm^Q#bNY*+A&c~F1UowVy&+-z-UZK z#!_dh_&x*{Q`^5P1>n|_H`o58trDu*arXJ7hleHB_MTX`q{Q%{EEdEJ>C|;@1x$UJ z_%+5`GNV%P77bN=tI9f$by$_4f|1DCjqTKNW8?y+u0fIkEdEsAuoU3O&uB0kb)38e z0NsDefBGSR@Foxmhup~=|19g#*8oV@fG0j4F`z{Akce&#Bl+Q71P|0 zV}POWh+hPx!23ZEp^axl2xx6)qJb%(xoW~lfGQ@_F?m2LTnE6pG%6I^jfDY>9u9g? zYXWld|D*29!gH)sZ_L}MUDQV{3J;1fy^CvQH$;b4^s0gNC)~OIR_Bjn0PMM zNsS}?@%f}YC7yXiI8We1n(p>y5X@b~504`QT$@R5TN+Pp0!=IgHG`>J6OsYKF1qXN0Zkx6>eScnrQZ>;o1G)YEOpGHi%b* zG8wGKlbnO*E%Ne5qh_v%&ytoJY180E4XLAFmVqzYgt>wq(H&NtXi+XudH#^aHoIkm z_+Bz%QsZ=#KUPfGx%FhsULW26S;^Nw_OF0&;dSa$Z|M&x#^O=~ntH!;rMzdEh@_6C zR^YG8qAoak>Sy**9lgRd*@pbL=)IP_zH@GkdNPQ;raM!v)2%9~<*LR|yIy5o_Pso-UN6aQv1*;V(Gp-ZBIu zS;VKq0+r2DN7)ekyu}hbEYPcux+&tLqOd`hrFsX5Yt&Ip^W$#D&%91spj$RpPKymG z9$gKlMg?_Kqjbya!<`}!DW;dHP(|wN)O^lLbKolT9b`~XQ~NsH0)Q|NBl_=UkIBt` zol#aqws<35cM=ZGPE2<}!pdl3(DKhzJsKg<-=d(5ZlMFe*_IBEyaHA;kOp{0$Hu+&)e9`*RB4^+!Ne?OVhXYw1ZuRs8`L2+fdq^AIC1?J_q z_SHuPQaB>^Ql;aSl9{^F6EpU(Mo!?Xya~2JbX@RT)YU~3@%?+&5{Il%$ut3vJ@xyO zNw-@@4f#76#C(!xqr$xK?DcLIQl!8`-g6B2 zT}%o6{;Ylub}R6c?Tm1L=^MT%dk|JD^2fF{(~`RtpQ^^L)$NiyPMF>lY!cTOeNnz1K}?H z!wI^EgX^WwpK(iw68+|}@Mr8zn8UdWb1Jpx-ztpXwf^L?vrC2#m^DGZxqnWBas_91 zbSyV$;N`CMBiC(L@pL*cM}gem83f`*{chavPM4c*hE8v;$BveB-{KpF`UktvP0wO? z-Qt@7h4X~I#aDm5qK>X&Ps?)VEv{U6+27zah0q#`9WUmvbtPj6YPv05;8@}mIHN>! zheKE4qbRWr-#SnK%*6d6xqt4o_~*w(pOAA$$pMZD>fE&wvo;fU@RVyG%%) zF%nqMzc)1MJG^JccPrFVHeN`(n;g-0s3UBKIY1S-$9ha*t{L@DA6pt2S+V{iCmggh z$GaYUrcrg)?as$8)_EO_M;|4i=j0A~di1f*)>57=MLB3CWs@X#&2=X|AWd(dSnS8S zf{#TV+c|2}7j9oQTy@T5(~~XR<^i;(!UsRBR8&-aa)5aIxm#hUKxRU{F9&g^&8}CWlqLSg^>~-+r7BCsxJ5rRIEJB7B~Q7gP?(4^{FeRV&-D9U1gC|Yz z^082HELoO#UH-VZNnKQic(cYqqC?)5bgc{6J)=?HV|se| z7X5X7h-T1O!x8mDL~GbW$G(RC9E|@51u`G@lb)ga$n(V(AXd3 zn#td1WCjRcK0uo%nsLfOaoAi}mi6^={{8s>S_J(Y&ncKQ{j+_H%W0`SEzbwfw&_M+ zp4rb1rEMz1mj1$?$m4x7_K};orbl~sW#CTeJR&X#;^MAF;o?|gUb%S@n~X!RD!cq{ zPsl9sRLx8hU{&ljuxB!s=gnZtIB2s4;y zJ+Uuk$9vS;6NQr`IO|?Rj&MI}?_S3*HU}o3FrTBbI*=q`aaRD-_Bd^2)}RyqnU^}c zIr&EyPTm63i93}ks(>$B8|N$|>-)~H)j`hlH=d3G9l++0@Tgxnqrd)Te2Z@->_8>R zOouX+@2c}CBIKO;&BaXtc8Bf8x*a-V-qB7JL2>IdUrgXnv6Vl>cV~ul%L;&>w909# zyR33x`W};Wxk)U=dq5Y-I`+AF#@n<)uP!_*gl+au4};?01bb!_c(wd;LzTDZ7~$$6knfj!#C(UZR(Ih9Dv$Jc9G zta9ywrm+c+*HRYWL7aR-7r(_Dg%bU-xBXwD)MKP68M8G5IO-I0bhu&i8TAcMb{mM& zia?WZrZR4Om_xkn`uC`%A53~XycXgIFb}yOnoAb>nQ-?zNmK=+JwF#x(x}7v zfQP5UgoD^6v3~BTIw}_u*>EG?Brsn2AqI+7O~fgbk?=vl6S8GQ2~sgG@#JTJB*H;$ zoqWul6Q2_47P2+-ZdL1og>VYu3Y76sYM$MFt!ovp9!bj!p7Mc<|$hC8jF6^sND>PYNShYk~Ohei{F}ZO# zJBnY!Surt#I$Rtjc*U}C*B)|~K1w}*dRH*WGXrp|{bgyakL9p9@#uw+ZTPol224C- zT}V>Kw3`9f=9ny>AT8C(XsL7qTmfuFy6OY-q|ReqS{^yOX5#}Rn?myp0ZNtsz+M2L z5N5|RN_y6sl2`e2WjKf;`D*k&rEfH}akIAq@!J%uFwB_0#>7*6c$X9R?X%1cleA{O zBQJ)ChQXVVJTW=nY|aD54PTAeFsM;n)^0JD`>q`@0xo~kBLCMjM+jwW(o1_NLS&0gmmXD` zJZrUAghE)Z#M4o@b-$1^{&f%jV4gpB3#LeM+28gP116Hm7A#5Bm5GDffs#ZQDcqa! z9_1Z~+LxSqG?j_JDU1s4OjW6RTF2c_0_wgxf3waJ6$9?Q@rLvU9mkR-gD1dNDB~z5 zGx+idj{6u&U14y3$#bAmR^j;Z9kXNy+nsK62&d|)&@hwGbFpaVzV|4PL5_p2f5AsT{Ibm(luLz;v?>)z996plKor2DOL{UyU=Lgr$s}FadUA05)?PBawp# z1~s4j99$SU_6{Bn?w&$x`{3aaZp?;Y2fj3L_kTEYVX zA4cPH4Y2r;6Dz^q4o)EqnZDaa9rA9)@#End+fj~MX5j~;cdavz%erf_?&`e+rK!tx zT)Qmz-hzHU5LZB%NQi50?8zguY;=Cxs~~#nAmtt27v-AxL4?X1AzheOe;xd zLxoGJaaid3C*VL^rH=j>|Hof-dF;RnuOTJ{z(HPY>e&NGUErTazaxg2@8Z}bUiU0_ zhh(bNUDgDC!-6UJv~;Ysue^^uJSJ;nkvI)&-dgjKOzr ztkMH(_be9Tlc~QS6ZX5erx?l*Kba%zW*tUuOdx`NHOy-kTPNK*6+94k$Bn=Kbj1p@ zWDaOF!YCIeq*9b}3UAZE&+5i*&q=Hx-Q^tO^H$Kdrh~g}iQpATgqjbmg5H7`jf~)3 zhUR*t+1x0u5Ha+hW)e;zq7S+G!>^twR`nm{mS&ex^sP68S2PAup_Ac}qVFhVSqkQID&~atER?#|Fp44EWkU zEUs{R=vB*`ul3D6`SfiU_d4zaCf5xcfIN|)P|qf?pHFaQC729vHNQZtwEc5Q9+_02Qj66$l|~g8tnyo zlU8S+Z)$p{%;yGLR2wl!OQJl(!D;54TK7iQ>Cz+ACy>*4$a|U92f3+bi?XmyVwY}C znP5EY%*I7M60Sr#oTp#0P=+X%sZltJ_DZLreu=J~x~=*Sij@3-DA8}GH~fVH(%~Vz zq~(byxuSL=w0qmC4?;%h~U zSbZu-b)^zW`KayIkuvlnS_WAQrI|KNY1b7T;xRcLXy*@&VWfc?z>gIULK+jEJu1EzOFnnY<4S<7;Ke2JX(95z{m zcc(kJcgSKWXS}%AtUc_*Mq{e63(j>qiw*S64%X+=xq!|nZ)+#^D#Kao-GaMC*TTwL z7wY7r*6U75>QQmpIQ4eYzV(T1rgwsu&GaT5Vf!-Pb>~RmXs*+)*_Jq#VD}W?mqw$x zq3H2H$_AH=SNT$fQeHS0_LMs!Aqrz_!rr4?ZI!OdDBaY=zEcDX+a8$9<@nQPqLczH zAwQi2vTb;(LwCKwJ!IpI`0;YOH$A!dVhHQkJg26kg#RX6XmWS=gPV$Mj)zsf< zRIZ*n3zU1Bn8$=n+)HDVsKlG5s6&cW75C}HQh@N6e-5I@w?)O&QEh^i^V`&P-4gs* z@4KWfKnXmvxoy_)57l}Wr(`KQQyf97GO(j^Tp+dj2V~gyOS^yJP7f}#j+}3@pWInQ z?y%8S*!e^1lH0mmgMh^@R&@0z`ZfA<*3v0+_}nSBMr^JwA<)mFZ^rs-VFv=&h=#_^ zIMJ~(3R@=N-aXA`!&8$LMO#3lur6qs4#w!TW_<2r>V$@Aw+sg?7pL{Lc9{d$?tn5b zKjm3+R1jg#ij-pN+=zL!X#SDQSms(6#ZiRf_gOoL_1@mOMAR%QcgWyZo1NWz?_2r`6JsX_$8Y#B9lIU`XMgfzgZ6Qwb_OKLB zF7@1ep@BQc$U*pdJXAXqjNa#eWLdHLjA7n7?qpu(xseYn_`CRNpA2z?W{U)@FYfmeV`r94mcK2nOD>%nKB6Ipva7imkkIjN z#5lw^|JKl?f}O-ogHgg?&hw`hx|=5CHRDD^F}>H!CiPBZ$Ajg~8pIq=N{0oeLFr|*EJ(&duJ_gc?YdC&MH2)|3z zYLWfTi4)aHqa%QFmHt7y`>qGSOGbYwv42?$hhl@$t+<2w9%W_@ha4-^yRY*3FzF0p zuFA&z+i6=TAHIQk){{}(<3p>CMY;F;drZ5=-Y=l9Q7pA*Uz}a~+R-$Y4B#1m;Jw(T z%_MY(f^tA+?V$wwbJhq10KE*;2OMP4;iA7U8WbF40wu+}s!TfHAD)t8w9s z*yc~pS=g`D4H2?vP3VXS$O7HdJg#tjw3fH~mfsA+8Hr8ykbQad< zzm?KrcP7W1aEu+qXlu!FKJ@OHcFm^5cf_sZRQz?OuQl5}*ElXN|hI!=9d>Q#?{XqG6SXZt*(N)m?>$5u?*PmXiqkv5|-T*j(0P&dd%;1-PQ+F_g+ zVfuPcz8xmmKjc1fw7^^Cll2^nZ6O89?(}UwTl4DW@YVu;Kb zoRtYB@m5QcD~jAA16QC{2%}1Wi1LL|T?Bv-C|+4k?tW{5>G~0!`KuNGA8r`}nGI2$ zil+WtR|;1w9`iK*OC1nXPLSph2y-*F{Gx)@Zyj%S9H5Rx*Fr>8sGm$PU2k8Ad4S}+ z>%jt;yWmB|B4ASH-Ht-K!OSUhExN$fW|!acEk0`lC98 zG8@tp^%y%@XDA_cozd^F-Y;rt)H&)nL&DXW=(d(O0MM^r)NN?j-q-YeMS-k|N&WPV z=dnePFl}(cHG;4LweFfJ!~RaLtXlSvzC`yM|3eB*kJ_bZOxWymgkWWA}Rs-*(HqJmtl*#aRs|`1s}cr`}rKq>#)hS65!PO{{%r;e&?C z9QTw8NZ6>NN9p8)-bff#US+1XrO{kjMEul89Fm|^sH58>XRvQI+juJAlY{0T0zB~x zMZ-tqpyJ@Hvw3IND?R##@caj6jEQH1A!0Tb5LuEgMB#3IwRrzS^8JUdenD0vV=XjJ zNGg7?jmQGrviV=^Z$4g7tU+S8Mug4XXK9o872b4t`2aeW?e$KLbSaAUjW;)5+mtB} zn%7Z5T@+yf#KKjV+U9~Q^vehC-CdJexzi6#bC!6IvIvcP4e;}=#^L!yX{#+4d9U0L zlnNc;-|MAFeO4x5LORV;O+K#|(OVlhO{(AP3wbIsae@`25@?ta8BgJFX)VhMPs z-%U6u8Z*(A-#JPE_;{~Mf8y+vbl*8Ax6flfEZV1w*YsG+b|Rii5_=nwk-q8qe?*Dc zCjy_Ba9lWg*6(17=py+OCQ))CWdfH^6d5}+`_U15p$?k=z;l!nOrL-?_qU2o5607 zIKjNN^3|+ePBI584j#oUYQ(oK$3rRBO-t6;f#eIAwOMn1^nry?1Qicr_!x1Dwru2V z#z2F~TJhKeu`SabW;z|NDe_IDpmC)^_Olg1n1Lvm#lj^T_E#A%)>wIO%oQTzbjKM&mtl zCQ`(%R$e~{bqF7GuZQDY3t2u{z%kpyoGPM@>!r!P2{2c&wZ0Ny zzih;f-17PZCZh0gb?T^1@Nn9e2~8(N9xG%SVoM^IF~J-cymaT;brwD5`&D|g>FW{( zm8!g#8zZWd_!zx9Z)1{hm&BU}y?33HQssq8&l@n+2IZj+r(SHR%a&cgYahLK;e6{v zHwj%FFfhVS_PHoE{|p;<+etQQmqr*T$^b8xwH&-S_S=5)cqjQ6&tZ)i?Ys?ALGMu{ zFe4>?!9KrUiyz_4f7(62^ksZgRa9=+zpKqxln74ev(uf@TJD%YuClyn%VPSL+#G7Pa)Q)pmJgM-03t2Kpa3bxg_q_Ft>g<=?UU4+9I~^1y-6;py`c03B zZ4-BL-?V~-AfE4cs-X4^rTUY7#9=V;PPE{Qp<+BBJ?eP-7K500@{lnqPA$u3%7eF7 zX$ib{x8Nhk2|^6hw3ErTL3*lYZ{xzBSx(g$%91G_h6G6j&WK>bj=q_BtA(p~an1_o zF)f_#@AzsZW|X)V>@S!sA(ghXHEna7_upTeeZk*wB@_~2S-(g1>Wk-qUe3DWc)sP{ zK|yadL+m0Z&OkQYJLU9*Vm;B4L4zw0s`*s?TMO*2nbR21uw8-U=7T6Kb^O?8G|N9b(Qc3==y~?Aipr@-L!~>p zPeEL=4YAi@YeV6x0fRjqqk)u5{=SsE+4$%2n0$+0N>H#(QUDpV_^G=%9BWzr!4Yl<%|c zm@~Tz+(O=77);EVv}WQ(q7rf83vqjc_z!_Y%NheRr;#VIHJX(tJJsJCTRq)rKUR^+ z&s!FS3)h>cr^pY``?C>c8zs0IxQ`CwR_=Wla`rLqHH|$Dnl-cd?W0a4d#xgdppLUZ zqYm-#cw%H7{n}?h>g*1MI;74`ZpW7t^Ix}qh#k7B<>609&S8*GN4%VGEq(t2|HVG$ zy;+XauVx*XNZydRU`>6GJ(cl98wiq+?#vyv<;@Gh_5)C-!6b6&jjI430Y2@(=z5%s z8|OH4Qt&jfMNgjDLi$sApMQoLRIHf@a%ROwAXs}c)6xA}|Aa<)&g!)SewTFeK3)-p z{He}ngAo=Wj8q^oJ#g2zK0u_qxt!y9s`rnv8adk)I^4l8Em8phDV>0#2|z2&@nt#? zyYruSL4jcl1qL~X#Z=;qS~d=M(%3hRu^IS}!-@Df983d_ZRRx_pjS*+@VJouJ7w(& zqyt1q0xrGt#}IXgeR$H;0CIaZcNpo7-IX2A^K|^s zOIhS|863F#kJ}#iBDD8k4Gl)zJG8CzOFkZ-q9_amJyi1|y zX23i?dsRF+=N*&C8T&Y1busXK`@RKmn&D6Hk@e@OslnbT%|yOtf-K+4F6bqaicJ`G z=8hn1%=Zii;u6hsf%m+Hc~cizM5Md0Kf55diYHA8B)5nD@fO`m1GX7qF4QB|`s^(( z>^Pna%+H6n0LSyC1A_cp7z4nuz?v<{`*^864nnqk#^-f+01TCuPp$)c=!a#7+m-_6 zt8);cYpSR#gMj_@T%jtUe-SK-gp=f6xa?iz}JK2Zp4A^@z7sJYyfaYt! z_;iy}Fb%2f`PmgboQv9d_|Gp%hY&kv;CPsIJW12zmrvLjR#>7>?VhnOa8GD zWUv^if1v|lUV4dicgM0HC67>#Xq|L5SE4Mmr&U7I0P7$~v&+q5f~9#83q}vVJ2ZEl zs8;mxeSON9xBXHs#I20bn5yb~Qm4+f)+vw7QYfsh@m}5q5p^ckmi?-e8fug-T8h6~ zz2~f_FUoTYBbVOJnOPOLrSih&TUsr)q#2%sI2ss2LlA|TQc!Pm#ACM9rH}yI*s1s) zHKoB?UA*=uyZ2w~oamQqEJ;C*dBJxeb-LPHeO}8k19~;Y!rpr2qkM4s$;A`;#}g!7 z;_^y;9X2|sKB9MsUMaQ?S}o^Of5v$j-->d1R;F(=e~q?*Tu}DTJra=K?ucSvKWizq zEbQv*rg=zdwAVa2&Kzp*!fu6`{v{z3T#nRvJadGz5hTub>W$9XWRnU{FF!gZ@>GkKDn>U#tHkmQzYuwoS{8R zsapZM8!i_^=-qyQwpFQ3g7V)TpGQhs>`E!RtYpdv)W3f6#i%FM)@`(Qn3AWuW!ELG zgl(}4rijbR#FEG8zZ&T7~`&Pnf;5XUu2d?2?$q|8H= z#$0f3^`+pcjcsRmN^$f+R3j|(r>e1%QiqgK=mu}XE_OgOmA!$pQ>Sv1{_n&`Y4{#- z;0DD};+wy%!F^QZKK=)|d23o$SF5in?*nBl!1t_xY2oFW^0-PzqA$vAJ2DM|W{LFY z)AsDKaJ)le_)>_3tbMQ|eE-JDXARuGbvF8g z#eCWC?`vTa*uX|-kDC`Ev17+S>~^d%Y9y|?+LuhnGq={86sE#~dC9s^Kw2rFQ2}XX z+u+XG7T~C#4g2w11o#Ut${GuX*fopUS8Pg|de#|H;bVBH$?UCq`cxB3t%I2%F}0Re z@lw-Va+C)Li2-eXeL}l;J=WXzH-~KObBHZ`;Wd3BD7CE{DUo?tD;$}7IRB+7qMlH@wSWC-H z1$|0^WCTf7cRpu%`Ap3~^+w@N1JC#kSpIbriQ0)B*g?d_#J-g`+_0c3w$j#QDr8FF zFRJ$lp!WZ1+#fkVpYMWWXr&r&^zgQ&Yad_Htpw*$ z(qSYT>*=G4{sq*7uWpy6#hl&-@B`mD&M!I82T$m4;0bLt#J)=YCz6sYqQ zf5~X*(tDKq(ZUCzjjLWp94N-m(-*xspuISH*6Dl%E=b9Kjuw&5pK+&jS9$9U=g_98<0Y=I(k_W>R1jT~ zI)yT(QpQ`Rj;`mMz%S=h_hF&YS8rR_nE6;8UAp46O*AH?cR;hu37DG;In+z7-g;3< zoW*Y&H_myQQ5Y~=f!af<^47k6cC*2_o%y?%kJ9}ok1Fo8q(6w%Qwr`|uXtpl1?CNB zHZxsAuUC7c#11);qMbgUTvfL_BVJs&T^qpaeytj<(|pWsP<~yDu5>&iwr4(kbn>NO zM4JUY!1Zw0$rBJ>J3yM^apiKUirM|VLou`9*3WNy0luwYeK5K9{3TMhl${LAVoz9fcK4CyS=zS87 z;&VEPP^tS?rvi?_I~AzTomZnt8nGw_kfZ+SbGp+UQHJ~uwb@P*fz2{+g9mp@E+n3a z5?9Q_3wbO`yp^HR_-0rs=3EsOJsWL3$ zY5E~f`NQ^fOglBWL6Y~hy5ND0f{N`662>>2O(W2@Sf#B_l&38G2b%n^RVcAWEZg2z zl6|pa)9Hz!wKwcI5}~_zdvNx1@3a=P)>ZAec=vV9Dr;MrP#MFS$}%Y7HM93y{f%}F z!Vc3`8UjjLJ1`&@+69zr?>DCKrMH&+v_gehWxpl*-O^gEwYuGn+^7HKyh zY1YjZn{O#~t+l{x_tJ2=t15KgylXEK)h@7t7SymP{kLc%Jv5wK7seAKm*~pfh)(Q^ z$cQ|2jqG6GaKFd|fAz1@_r=7d*F32n+~wFyn7rWK@95X!tx&!iTcIGt5C<6S*^6$L z#%u9LJN=1kSm2S<`cE7R`fR=&Q+w;$`)iwSDT?|joHE3o;B01_bA#Hf-4-0^Y;Ci^ z&Y9#+86v|v=zn7!{)WDPoRp{Ko8f)(c=G8l+p-p`?zbnjP}0d-map|q@w3g|JdbNM zIBXA&=d~e~Lwk>{5!*F6eR|Bouej*Ves0*){7NrR zGI|@U>{53^=Y@aLj?e?70`iEmGk!2f4X~HBN54-+_)>KKTx-g<2LeWCH$&LW4KEq? z9HMZ?Mh6EOUgcxMibZk-Pktj)XaJU!4kygW*ju|ShWxsX9{bfuaJFbH>CpkMDULN{ z*VBX63!AKQb*8lFF{ z3w}eCP$hStB8`fnTzLSOfB|nj`V(~9CBk{s-cdtz;NLUa@7e=@rx%D1(AE5RnlXRh z^5RP3?VY{i6PnI=8I3eSDQ?1L*qFctf7_0XL0imyU5B26sMTFkO&U3I~6*>tc@H)Kk4^gV4VR#(Lc zvT=2L6tsKDLhn)5jkM}`>@8r?a+>)R+?_{FR|1TdIGFRorWP*4yLj#4fse-ghxmgQ z#h*BC4nSg6Q~zllkoj9O_(Y-Bto%-LNy;ggPM7e?Av-&T+U};==Os=CapqTq z;s~t9{pNN3b0xn`rJt!(lB&r%Ge;eC8p03SEs|Nh@#vjAoV_w1j=hFMgiKZ)Fj1o? zbCgl=9a1h*H?4xqkN}r2+>n9Xpz`qsfYY4980MmqOF8_2)x{6@8{`7sp4MR=A0+?s z;U}<<43?>vas=R4K`Pee0Jx(to4`!C4LNYK<}#IS^~$&rTN89;k7Z;HPUu|r6j z%RPrc1;SW-O_7wag^(7|&q4srG6j zP)`glyA(?Z(lN)WT%h`lrfz)jXmhz&z1g=tHL&ji5J{26n(TwQYQL9lyUpyQhSeTnTiu0hIC z_=n#yocZrjIw|CV}a~Qyr(cBsQlVIF}Rh+y$TPa z%^GG9*&<+NF2fjPO|H#TWTrq3yAGHb(W@D{RJJe~7T1z3U{^~512wu7DF!S`MBN#) zzB}#+fL@A^rKZ8;dqu$8(Oo(zA7I+4fZ$H3c^=1QRHFQw=G>~?^#JlD0StmqgDr9! zpbKv8^?FXGw} zI$VQE(bi>MEAV*^`q$RfPpu66g-ZP&GbqWIhpsFW9Sx@!`tHnWkUTkevUJ*X{bPEq zi{#XrmfgsEeARQtzin0e3Efic?9z*xAq7U+J0Of4TWq$Z44-Q@FSA0AV6106i5$4( zDMV*3{J1$C?UL``wurrY8YLc6hOJhZSRQ(UuA-^GFJQ(gS86}?GHr_m=BT&CrFj>X zP@?A`a>qKHS|dAj&Gq+@VVqK1UYWp;%zYO@p8Ui44&v538CbuRUj0EagUthd^1odi zFcrk!58K=mxeeUGzD7;dQ9h`gx)E{99(xO(LE-3ZB8wkts)IBNyiR}W!<%AolH4(Y z#+Fb6*1P7l{WUUu8(WFz4cwRv*8b-BwtY|ilXCh6lJv#Z3U=cLtWad(vlsbQi&ov6LU~a^_4YOvVqWbwZAAtI@H$ zG{y-R1D-FJ$m6K7$J-}ew(@*?5yhvP0}l}C{ERrR$fz?9lZ4zr&Jm%LMx_xDQxYTg z*j;)PSwuWip@PVmO3b;MlS`wEFlbzn8WN%zZF#s`1kj&IzJPsh_7W^spj-v{o}n^) z*(CS~3=>hm9`43+W_U@%zIBJ$$pY~ztSa@J=1J`Zx!ByA!*na3(X9`6F>pZ|7o`YV zk=2`1Pd3QVgJqg@Z%&)4EzT($6*~GtA#CLr=Xk+(pW6!t4WunEN;5C3+)>(9ziLX6 zwv$}N>Z0LdFLCx_Jt_6O5p(1ZYz$xE^=OvY`8_s#9&!wO(P=CEhb?PIjqL1U+J)V- zX#;dk1ctr**xQL5c?S3=!sixpGnPt=8{x8Ppt!^qasl#PRW8~fn~J55IH%*+KbICK zE%I+lJ7uu?34T4~6IS-gWga-(6n?67T_yJAxIRKVV?Po`J<%Yg#3MKXIoN>ibox4P zWl7r-p5$Raa{Is*aIXhI_|g{SR`^3$EtfPf1`0_Y(1J4U%T>`AHD$Z9kJ8q zP(P2GC@XNOf`QxIdk6H83!r(ZPodf`VF;I`K3O(eOF=>zUiPi^LanUL+e}C`e~$`^ z)=hqVQQh_gv$N*a)!rAk(-y9r9(L{BA{utOleSw$x{1J*y1}lqC%@+mLa=5(aZo2q z*lwTg#JB9B7^O)Pou?Y@Mm^rQkL92{N$l`evk2d!(G38xORB=^Z()#Y4;AZ7ubA^g8R-N)Y>WyxjR$W7X0 zP=?hwD*ezjA~O_-AKnJB;lKjsP}#Wg=V4|=dk z!VN(Mq=EM+X&$B!bpPlUJOpfv;yGA2VF}=;dI0?q&ybt6AnJIT#~}z4;hG>}BEV_k z^QuU>htm8s9wrfKQIM89X^fE!(Yxs$rl9mgA)>4(0l52BbK^*-C8)Fl$elE)_fU_O z$3ZG-A9s0BRl?(t2RqQYEw+J$){_C@j6BK$$P8LOsqQXu2=*aD1!_1+c)vWb&@@D4 z7A7qJEZhg>%uyr4lclLw;3M!aaQw5K5Rb%y!cZ0C&`Z%RNe~WI0%|?YcKk#|qr1CM zcpgwnY6xJqw<901l^~b;!SfzOZ^rkCbf zYFpa5TRYo`rQ`|UpIKn=;!$>YhaDt)M}hfCPCBm?jgz(vayl@@$z(gh%w=HbogC!U zW#&z=Nl%G<+P2X;-fU|0{yU)yR|3emI)we9m0+>li8&O%0g+1{Yi?&5O>R#uKxY^AF^}H6LXVBl(p2j z9*_-X`i1ED33cW_S~~h&TwVaMWGY zKE8i!MmiK9Sa>tEwbZy+gVk-DN(2Y_JqUWnQ>k$*PeKtk4R% zql(I@TYbEU2ptc#z&snod580DaqP94L%CnKb{i${Fl49fOl1otsQdI9=U-n}R}kF( zZdsK0a4u2UV+H-qBzlYWSW4^0W9aRKYi?c;ozaCzAH>6ysbXrrM_=Kke$_?({^^W& z!<=+TXlwhS6BuxxZr%oQ5XPkWy7-;2kY6tA&$m3B?$mJ~kZ6xyc+~oPaCb!{9Nna` zq-(>MON|%GEAo`t8roWN$n&zLR{iemV{!8rST&7FM68)<^@}W}Ba~)lX`bgQ?rY#D zKsvBQpV`!Yeu&@m7IZgND0AkVi^X&G+dB|v=$mnt+&IsGbt7%^@tuU_=ld>{CaCM=Xw5k9 z_vJJxFPn}Wc|@-s^_X&9FOJw@G?zfvCC1086o(eo#rzs;KN75#OFcar{*uT={|gan zUlQ@3TZ4Es2Vzj7Df(5X!j0WH3CeAH>*5}Q%S0!?KJVCXJ}R?XU@t!o7!VwAmbMm28e>wpD zENjA+K*f&DUW#4hp;9n`8-s4~&olF1ZHqtCLt0!{_^5u-!-~GP)Ju*ozb9}JykTlc z=B#_$H@@yoDkDn<+yj){EVv$@#vVDe%`og z`FSs|-`aBHk^Sum&yd7RI#VAg;z}tmy|u@7F%|A5J#XuZI5n(v_xQ-p4lNuwZ#sT> zu$VZuGm!vn^VR$Q z%pCu*1OLqfA9n7_U%qpTGqoFLx;SroP+F=|d`{tM47sPWD(^{oljGOcKFk|0bX}P9 z?V7%2iwdXjVP-256A7od(RJV9$oej!>ygIX)ZVO-$Qy;TmWZyL)BjLz|JMq_zol6z zOlJ1=;&;8Y!SI!5y~wR_*h}tEADuiznf?vgsSw84+x znU{iElqt;CW0{n*F2Uh=t=9xLSQ|?8Kl6i;eGNFNl~8{fIqS=K39|RF(kr3hvH@=< zGzDBNSWlptjQpx-dqM$EbT+D7_v#Edi;~e(*|_V+U#a<5&gGp)((NV9vDX6uL=%qw@l@0Ed41{o; zwDlhCDkxCdko{U*GJGm{LM<@QQ#@ym{Z@ISVsP5=lWmHATT9D)>fFl&WPg>Q{$bJZ z*#m$eMS5rGXz+^>q(+ijRBGxtD<6iK%$#5z%(Xkm>5446@K}2^Ch98=t(D|AOfqMm zh%Wy9=tBu`=aSS0Zw4&x@Z9-tMvZ)nHP}aLGF1G7lbg>9`0UVNuFaJJ+FIn-hcOpE?n`kj>dSNz6a>b)RO-mX&Y zpR?l|4p!`p+ys_-RkJ&OU&l@`Ugy@>w0L&*?my4ny^@!#le0or@=vF~pXe3XBou_2 z`vVEei`)kOJCy@6ifkn4;qrn&hiSqf}+6&!Gk|vj$AU~mT1r+J9yrF2`YZa86 zZ7wCi&gCYthpQj$zhh+><-%cwD7Uc>Kn!x#!JMi4TI7{$>(KI*doQV?-r}weDpaBe zq-aqjw(a)t&6WEWJ@xnDsIEY;Y7hNF8_~~D!^a3##9}q`yS>|=^AF)_#-2TIw0DHt zST2!BJ*fNk*h+1M09aT7J&-{ijed<1bf*4I%bK9uZW-2%Czj#!bhztUSSXej zSQxJ`!+ji~I9})4nzyT+m4!|=;UboB*FpaKr4%m4kkOE+dNn@B`~nWkHg!iR<6zm( z9?^frbD#0VqF;w~h6!U|b*!R_r?^g}M=Yf<4sR!3Q*U{+`1Q#CZ<{Bu|A`@gW2<>wV@_yq7JLNcudgfj{97j?S!0s_pr_@K zWxCVz;y&}>GlV$6Hcc;Wst)S&UTm`R2#zy&l{~bkOyCVckbO;hzFpjM)^3y0MAUvO zqKGyrZm#o7vjg(IZw_$LrJcHR7xI&b&L;1iSS%TM%&0N}eJ~NEdLLL)eoLPi6-Xuo1LRR3yd>17Ii3L*#1bJp6Qq}cvRe>Kta5MvoGd~NvzN@ zZ(uni(Y9TXyXcYMjK^6iOnntwF(?zL=l^yeRL5N$**qSC`Xk3>m0g|H=~r`VU)MZ$ zSmLO6<{ns9GG1nixZL1w@7qz6k6RYGDXsMpgt5l@G)X@dE6Bt+OVl3lI_QhiXm6S< zFsIsV$I+aP9=Ko>aSg$-2&d{)2XpL#DdxwY}i+!~SiS$^A> z9SGYH21q-8Uvq;W)vG=wWf8wGDeL=a2;D}T*00c*Es+(ozpZmhrneMt@7C3s{x8md zeXd73tn>K)wD%_PP;dYL_zaaLOra#p*oqQk-@=eBiLsR}lwFpQCA+ayqAXFmZAKAk z7a^3LQlf~mO-OcTtb>{HJ41`^t^28a@8|RX{vVH9k9y2`zt1`Ev%JnZuk%`-ulGCz ziQ$c_yg0X-V1X$(c9&UIu*yHPe}Pl=Bys{djGdmDg4X|m$TwT^Mq~$^GScIbdiU`{ zQSY?`<6uU}ESiDD^;+hbUYzshxPI&ClZj;HDFX1tdwnpH%Vqy2f!)`Pj%ymGg#y&2 zr9Dw<8p|@s%U2*Vl(Mda>7X>?MX5G`xgnr7lemgsC+U%)sS~floC-W0)kn$Qz}4j3 zI@3h;Reoze$5CduU>9|oL1(`Z0P zKzt%?7eLy<)f5<&v>#q?J9Y&saR550jccaHevGcN;b~Tuyrq{lw4VKp!M@tgGs~n6 zO8qQp(>8_B;Zw$|72xaxwPo&W%YU##7hCT8Vf{Ifk@9wP!K;rwlZS0mbTtdsD2 z5R7Fg!-7uCcch2ZYNufl1(~o-9hQXro;T4w^vK3HVlfz2)#Kk`WPhz0OTADvAOKJd z)mG&2=py6_#K-qrCLH>(8^dfHaLe+PL5_{p1tH{7*)ibDnuf1Eo`+*})pg9Of|g0W z(5V*_XGCY34k;g5XQ(Xm-} zqU`-P)aTt}e8_?%Ro5+L6m{8ym5(H)sK&}^8C}B=b zrR0_v=8ErSi}*^NVcgBih+DdVIyd0j$qQ=h$r=1yuOBf zmn%Om2%jiVpwwXuQqMyBroN2KUt$!#k|OYT54HL{dcQ)=U+3ma3*agwpU18wTMxII z_F$vA9AVP7sVyOUCx*T+SmQZg@w_32r1|=i0_#rA(AjOa9}k~5b}Vvk{?5htFZ7r0 z*%MVo!Wfk=Km%~P%iruN(5G=iu_xC`b3=B5D2fT)tx>%oR=1$;I*iMKh%L`&=^l{j z0Nm%%Z@b9@#1{>xY}VPb1e~<7)XA?{5D#YoQyPQ0F%K>esh`=sRW0Xz-gavFxrtUQ z@8#rSVLYP--yNbzjH5dxwy|zHNz7);-1)TMU_G_~{+S0Tx}Xs~I0jb=;V!mheU z5(aejY(Zq|`Cr+CVjkk%_$H%inm+cyL=vo6VCG<`2rcgl()rbV9fKbNFOOBVCJJ%6)U-@9429p59PEU<%?TLUR~!xbXy3RVj>U(bi>gacDZI zz5V?;Pj_ju}E-3B$$~bnP<1x`Jc;M>T-HjW?z{ zA*PF$Abq`PZ;O9iS!6Hm5de-~1n(bJ6=*!Rax3nao18{m}$f?dc}WwY#tZKOw|oEO`Yl-}nyt!MRNn~n;X2jd!&(8pu48Zyv%PWR zv*7GbgW8fLpjypqm9=8fOt~1>3?mQpZ3iOTDGX!C;pUModZD3VooJ1vqn|hwyzapG}*3lX@5DI$;u>v!!2#*P39qyuga&oJ4fo!}zMy=7sut>@s=0WVVkMW6$0l-w{IEyd0a3jvmT5}_^uuX;kc7QS-` zP%>S0DqB;Db;iSU6L#v!Ohc+Jmzsl@xsEQ*<`B_ax`%FPMJmRtgXr^Bn;|v-nbv4K z!&bROipd+cWS~-=Hxk&$ubziFB-DkgP`B}khEvFO8I9K{m9MYA!)$kQJv+(B8;;4t zsDm&v*v>W`abTzLOz6W!hzB^=ZdRL1CD9LPL4q+A_hO8@^f{uZADybhiQTD81!9#W z2^f2T3i$v`6R$3zLEY-g<_4=cWUxDBZwAYaPNX0(Ff^o#{ARj;b%*>fodNs-cSmdk z3icP#iHdcchUM7D0xOrJlE1fd`Lxn_INJrV8v35wMAJv^D2*bfo?AVAX&hj@PxS>9 zh|4w!`+3*%A78-;d^v1>>8ygj58FaS^~Bj%Z_d1m-cT6X)Au34w~RG|Pz`ZFmM3uB z(+hT*Hz;jxT*ZvX)VMY2pC*fgK?Vq^8;N?oTEK!-H7vQ7YPYuvfiJBwntrtvIraei z!G)%nw3FZ->dVzc8F5&IY==aYF!!7r?k4Nu^D+1|dfN(KA=KlvA&ud~i;!-$4YRyogR{hgI&1^(+wOgcI|D(|wq;SRg)LfbR|+)C()tv!Rz&F3qR zKG;wYPWPxSY~f5I>^?kuCJpu}xCL!v*oJ_Ywk*WRooi!IGakdo{De<-;JJf>;OOg+ z&~4yomwn}+tqr-wv@SRnLL9expyXMMalrH)udJPuWQXqhy2w(0x5(7lp;OVoW+a~? zmS-i}LS^p1GEe@^0EUL{REel#PbaGtSB8IAR!e6B1#btE=nY@@dcvkYeavI0({qTkBoL{WkVX;`{j1JLfDt#vLeu= zr}rx+9#sgW*pGvP z2SUFB{0ZRb#Q-}lGrG6;#YO&)_6xly$m(g#MUXPW!|-Mj+ilA;Ngh{P$$ebWLjX-O zNn-bZ-tqqA$X$853IZ6PzqJ*8X0kv)go-wc2Je0bb`L@LL1{G=*y)dUlRJ4oGzBMb zaFF`Gd;7ajJ>7rOXYV{C9Rp(>c_{l6-N?KXO0+-ayQ)tv-+N?-{iTWY{t5 z%^Mt26D|oBE%gB3XLom#mwG)UG^)G3pcLP7-k<+PvZa9 z{Maa}!bOrDun#VuFDOug_UjjCuBA8~q{dnbJ$}_f?ou~dshTqVIPZvj zv&foo88E!CGs@OS5hUANo!jc3`SY8M7WRZox_m>YU&ttxbBSjHWHe4;BUWeF4B!aJ z!j0$grxoe<)Q=T%!w*ARY)^GDc@|x|*Fs12Do6~mSaJxiQO%#AddhYatbm<@ye z>9cA{JJgJ~C9gUE`v=Js(lcrfs-g!t%S>%XtpM!RTls*FB!*anY4lu)=&J)Va3!p$ zf{N%19+1C$^$Vo0F|}EkiUvHIOeX+TM4!?xze$(kb4$3uuK%=jyo2h(3;&vK2PW{; z3ceHoR{6`#mM<@z;*O?}OF!cbOPAxQ4~W!QSKw~66hZj|a<=kQ4KMKiWIEtv@&pb- zqXXv*;!a8w@TP@i=iuRIX<^70B=h=mlWQE|=CJ!Z$PDk!3< z3hAQu-XX(2Z)x9PXlwhvnDwy4%cW?=vFA#b(Pqm)r|(5hnRJiSySBNV*5kGUhf-*K z50d5x(QwT)#5o}HgGGRk$s=JJQ42UyO9o2l<<3$46sq8tn58eIx=&1Z{mY5CCv}nQ{Dj%gai1~aEAc7x9a?PszZ%9aH!#kJ`NCG!Muc-eD(ps zb=%JM0VzM#*$Nn00xqPp8#UMe6(P^NrrMhOVC2sAYU`Jd=%9NQ2xxuw;UfW2hR5#2<$6Y#W9}sS3ckf4 zfh;Z@979qeMz_SHyW@0>ogn43?6W=<2`_-Kmf>x2ZgP@=ZrYl^cGL&Amfi7ieswR; z8Qo>|tX~`E>k0dyGpxp209e$6KnRzjig;yHf%iBvsUZQE@fe<(W`|B9VoC&W1sId> zJmfk`j~eSYI-3|21vD3o;I#A>+}*uiPf~&E4$AuuU)+7Hr9fi1ZECAL>SEiQTE3a1 zJdcknUfp*+O4g+mX|Qw7Zt8@|oBvsV$_Xiot69s}R(n16a~{V^x7_wmdo&}oW$ zsWzvp_D4|HNb^6kMgozw7b*gL_C_f`^R|M6>&I}Dm6Xi@{>Ky#9m3IgR@sO=d1y~5 zYCbc~gv>l#1We#C|Ac5495x4hdU*~4%KT6|zdnu0@*7hf;E{DARfu;p;auLNYP(fJ zhe7aa&uF{?5t7Xi0pQ35IKPj-l2vzJsk5Oy z!$xy`WKMs_G#bQLGZsmY6p9rx?^WAiq)ij?mJt#PX1)i<9b#B4MpE?HY9$bSnHSq> zI}Bnn#QZfP22nHv;8h9TX!f?lid&iHd~Q%g8f*#FsPaVN*rBeSCwV}WQ5I^HQPAlm zK%|iqb*+Z^Zf?&5mS9J3Zi1IJ($QsyY{FlkiW6e+b3nOlsiW*=hB#~C1=TF1x2A^; zl3(S870N*0y71EA`%k=cxZjlA0H5fxf4m5x2@2bk#zL(az>kfeqHMDcu14DBC;Mfl zGVM|C#u5_-=(^Q-{r`?c7h3v00?R!RMZwyEdk>gHkH1sfm-Rq*j1>Hc`L^r+@(0Fi zyj7&$QqEZeT}7hl4*?SBj^N{mM{w(X-y3W+5^~0gyd@to&3AbGYHCzh{qMIaY#1-k|GGY(?^Elv2Q0az{8fIiv!EizVvIx}(C?4)Wh*z+LQH<18iT=&fqP{eTt z4RrPSLr-Mk)PgiKHIOIaUIcq0-ftPx8m9UNFQh z$eO%kEpSf#F^~rE1NYR*ij#4D?y;}r)RCDk>3NeFskieVzkgr+HRdG*(_@ciAF8FK z_AOC~qv5yZSD#utd_`)W>$&1Zu9N0cN|yoDNOI3V- zzU`+$H1&}r*=L9kt%)_k??n{BJ}b5^aQSf=r4N^`tPrI@CoX@dn~R$;bAtz%l53( zq3omZx|^D{*)M)fT&ofl;{!Ta8SnGOH@Ea86{*%o?n~|3me}W@RyH3gz1sn>V&784 zFQ@2gQ~4DMTQf0(L$+l4??qg^`QkLE`7PQ+bs&d7(~UVD)D;^8z_Xk0n1wsI?@oVL zOi@gO8NCh@4?vmhW9?Eon|1TRRa(kCCp)y+ikP5TWY~CkhLx7wehe6H!{v%ItnLmz z)Dx+_)xigVa$gQ%*-Hek-*PswxdmfF8ubP2*S`>qxiFR0w|D=3&_PYCNL$UvX^ ztrWrhwe4As#C??5poN@T;Gmokp&h>Y7q|J9Cjl)`1$*4=d^mH*|0r-=cfF`FEiBXb zNb+sg?zA7Z7z#q1=Hpdr+e%>9>I-w^&SVSqCrXmHJ@>ZHDgAM=m7iU)Q~hBqVDWyr zSAvaH3#2du+TkMKCx4m~hZ=!clletZ4(S(NGym+{|J=J)e6BmeDY5H3aC#W93s-&e zqtX1?VWBpyp0K*twTrv?o~dKn!z8Ww<3c7@v6h0pEsA!bgFmp1{IqY=4q~Ft^I|HW zJHFg&qRTnck8HWLRmEWb?;m1tu3`8D7Z7LMi$P8asuNpIQEy)4- zkwKn3RZ2}UmDnLa(jh;B1bx_MDsl)*FF+2VLeP2i0x_M0=)I=^-Y}XM0iUEP24XA# zqt}f)6-_EbBgZ=dsGKUn1?az4&ywe5AOO7(V3~v;hR=4FR)nu3!m8~lj%3gZXgd&o zWtDYp2f#x^NFocaTa7+seNP0apIHyQ#!_FGhY9oeE+uV2G8(AHczk)NZ>h^d8rr`K`?#D{w@~yafDr>R=TH|&Po)t!o40MGuWDbC!>-Aae*?&y&d*Iknt|i zQu{~ni3-%hhen#vi@;K0hb?7J29l~-NwGlosWJ5JMn;rwhoFFx;5NHK+Yps67@^FY`#Ijn}-nop>wG*qP1s6n+g%>MuZ|2dDr zF(n-rj6zOL!YRi@Xh#nJ1IG|dhKLKD!K|uwr<0f8&d}hv3QUr0?v}BHE8lToUeUau z)-ty{sr=1%bbIuyiPPJG)HGI>dhvVwW1ee8@!#=N?1Fwg3@SY5(P* zx0cJYJV14?Whz?@@&MJX1ymQU^*X^?3P8yq0I?bzPfsn{7qbW{0LJ1VCw?Y2XmBGP zr85~&B(j^UF@aQ`H~tAolxaZtZcG;D{dVBU$B!?FZm@>wgI1U>m&8V+NM(7rPkBKM z8UR81DFt6mJUES~TmlMDYRt+e0MZ4YJHHItm9|DcoFvleyB1c#M@481?iOCfv!)5F zMU~@5lXepWk91qjK6!BZNrE)#v{XnE=6LDVG?xF)4!(4#tZkF5DL9B3>_L+04e8!a z{pE@L%54B>r-|8FOO=zu7q*}qVZ-|x&l7mJ{OL{%#f9(`xnWMG9Em!fswjwFc#r+K zdWnj!5B|{&|Gz+nUt9lE2bX%FGx~~&tavlQ!h<+=Hf9_8Y$I-9G{EJ88|f#C@wWZ?&q2!H9DwEd;={;B?_#qLD( ztkqf-oCH7)_BEa(@LK=*6ut^z>AR!se{J`j(_Pxf7Nl1L_k&kbs=0q(Uq^REmylJ_ z*dT=BP2=2@O|F~f#sq~!3HK^=9^>aLsQ$VE#8=&Hix4q19T~X20yn9I(_QNT7XGa5 zY%kT@3793UJzu^EnVj?iClE6gZwf^Ryp!J4l8G|F*rAXF;3bgf!SQ(mAWp%eF#Ypr z65U~l5g`g_oz?;PBq$DS5}0l@QJNAdMU^2@4?}>qg#)@W0~Cplx`$x8Jp&MwNPyxL zJ^{83@V0a{5KinX#q)lG_G*m;OzjQ;&h;tXKusfngWQrfuN41~!~xV|38V<&&q^+< za?I2w_-qfg0E}qa1$vTJ2R1w4rhE}tS6Dt_`rU(6>VwxH#|3H*WVb75ag;9TwF6Lf zxPUf(`+%zZxc!237`ppwi zt20ra5_JTF%U=HKQu56AlK>j6iy1WXgY7K1IW9HQiCP*k{J4TojdThC+B)h3*k`@w zbE-NIh`OojJZcNhzaO7x0aF?R_z)P?;7?w*!DOj>-p6i_gJK!0`{1 zfkldXJLVZ+j{wA)P81mTogQ=Y%Vpse@F^aUxpw)j{4wN!iW`9ATAIWiw)B|Bpw?;X z&X4T23(%oNwO}t$Q?^9&u=SuL(^(%eROD)No8=UFYB{;$rBFTrcLIS-u2|54njs6E4oMn@Nte(c86h=}F?ihdeA22m^l98asCpa_65MRhslX&%3Aho&B)B8ALyWbw^j_wb~_Uw`^IP%~xfd z1DrZlU<R8}@gA{coNmf}u?S2mAE+ zBIJW0I0dY&z`Wo4C+8ii28*@eKj#?pPDtaNBNaTV5z9o`Qrkms|5`S1gRJJJc#X0` z+C_*Hun8V)26lQ!A6>BCU;WD?CRc;@~5PGk7cEHT9I>CQqhu+6BlWckgcNNi+uhY&ou6Dae z6Oj2#PyedzYMwn6<}d*Adp**eJ0qvWUFjCnXGJvoudRGGi_11;n89m{5GBZhtfJPu zA?=O7DaN1?%}(ih?fP4{ecWZN+8UQNA&$}<7dkE{>DJ5NV&9ior}5`&U>@DQp}mu& z{D7tXGz$TCkOgx`k&UhBZ&ObVhzMR|)`9E5wC)EJ_=A1)7sqc!EyU|d494bHk~I0x zoqZn#F#9w@q>1O@C$A>xzR56sv+j_PGD8`#xh%Z`333D~)Z`u{%i93#Zs7GS*b!H! zu<)wDiFXP*F@8!}6w@tsXasGtt%Wmu&cW6Qn7kbSBk@2xh|=9B?)BV1Z;ZL>T17Sc z3dGEsm9_%Cm1hLLsZtfLCHZ#Co3de*Mi!qDC0Lmu-GQ4ou9`yVKxJZ}2^z+)WFFfI zZcIOf_Rg@M&56`$1l9o`Q@0ZNvpR1zq#cmW=+tCmeT6+3L=6^ZdjQ}|bhm%Zdn3ln zptDP-uCf_yc56UqevRl@+qtcQJOchQT($n>M|R{$ELErcYjvy`_$B7whoV%tfQazR z_TR7w(e!(&FeFKKt@U=ynb`LqO%-Qx;jsMpw$dITkebaHD%f{o`WHb35e8MMy622I?}} zC}XO{7%Qxv765jQ7CZBOmKGhXyuG zQPEyPnt=2v=`I)QYMMCpKU&u*nbnn_LhnE&LPa3e-}^3aDV}xYZqChjGfAC}fWx(d zFQ}Nk6CULq{ZmHjKQ9P5+i4VK5FCmC7qNE&Ge3ZP8UD$D{cmpK-xmK&VXvMZlX`G@ zoz4+8xMqk9@f`f*dwtP;XH52KRVcnc0J!+vU=ZDB50LmPHgE>0*4Av^X?Y<0JUv4} zA?YpszG}pNP=p7PM%PH?49y;u=H@~=t;-=Q%I|2XN15Z3?5xfw zK>2EM>9yjygaH?tPU^(0W_H%eZS~Eb8YUh~+*>GElv))84(#p3f=YQC_SXI;Pw%=c zUt{~2byI?*=`<##FZBEEczibnHSLZ7Ha8EZW;!$53T}&F)YUe+d^hLMKcu-sx#W1$ z>QwN8`Q1ZIT+h#Gi0f!X?K;Y)J7&boihnTp19&s#~ZBaP*iyxcwj0) zWUI)!8)Xmfn#VyUhLv~#c;eBjo=aknRs7BSnl!$@g1L29K4~p%n3`XPB!>?KVsLi& zY!mR2q87p8?W`Mdi88K^&1K$nIOu#HTL7bL)k|tmH3_o_ne=7c;h+IZjK= zATqIH1=arioPNp)O+K;;JBIB8rr!s^&9xafj_p@l|BHgGpWEbUyDwS=Cb?LrpWF1! z^5ux((-$>8WBfDdf8mQ*1f&&Ao{>G}&PGSER85K+_2 z%+SK}xsT8G>Q#FzI^$^~y26z?YDzavGw%xAK~f%dc4EQhv2021!1#s*~xUlHl z^}y@<8}1dg}x!!bT4Nq(F~t=Y%t{b~`ij#7FY z67uekOxB-l!Xkjjb8w|o5(6UXtN`F8vtEtk4;;XMQTF>+tEL}Q$UnOXxsN#q32{6E zw0}Sz_5^bUqVr3=|2fj5ZqK?*uiFihH3W6GOE~%|@WuCptDYpf5w;^()h^m(3)J4c z*8P?Ibiv`FfP)9DX{`wgaM-pci=O=AgO|>%6%WuV1YRVqX~mo}X^MV@rOLWiBcTtU zv}I!FfD)Ds=;WZ&V{NHdfB`phIZdOi(Qep;A^~X?AfC7iQ&h7|t!rIy5bJ^#wq z6WZ~n2kV9agA7;+HhgQ3sm+!Mna9Rj3H#%`ZUYY4A3hos3z>@jQ4jB!VC#@e9zV29Kw*^vD+KC(b1#szBU8bP3npY86-TZvI^)H zXUEjm-&CBBG@BDigUSAaRRqK@4VL38h=mPiQLfklf%NJnvi!e0xu06L&X(K!0CxAK zIqC(-#t}0c2U*GI{ql+V=LHz}K-|dJ0YWZ)aZ!TV<*WRGmnEvwHpVF6;;JTD9rJ0I zR>s;0FS;X?R^UnbM=w29eZuIeL5fn#K`(93R4ou8G`@R&y&8AlXO2G93jguV2nFu) zYB#+->_XJQ3-d4_>N5g!900GqhU^w>qC4W+K%QxaerW!aW8?QrizN>_BOLuQME*K< z-uKiZM2#Jq{$JXOfB)&fwNvbCj+ZIU9Ry700N@N{!>ob(+Sy;|_pg2&DkQDvA*Ih0 z$9+RX^eUL(HQ_tOcJ`E>ni@E5Z#>z2`D6EnhL74VG(_T?9)rp2FlixT)2gG;6|FgPaVBfwZ+ zb?Pv$;p2itZtY_AT?)NJut7DRQ6Ng`#d0YNZh2u8kn~cjp7rG2$ar8@wicrS+|5rk zE{U(9jYLGHJg+EW%fn-Px^^F&e5xd5pG}FP!bV6`@|3KvWIY})%Xm`>vS#^W1D7Yc zmU4ut1h9XwY|pSw=t9nKfCRqzOpiY?nIJ4kXhe7PWXQG*Rmq|{wge(%i3j@gmGoEn zihr;iP3j%&h}($Yf--iVAq^JSV4}wGzgrVLW|iaYa7Ne0xF7MCr6_t_wbmx0;>0Ro*xH#$0KHuef{*V}R@l)MRZ zb^>}l4D4Y#$3pnC0+4zOTaw1l;hnBT*Yi`N8V%{x!FZ?#`ZFItJL}KFx=GNLC*j~4 zeMm^u-Jv8m%h9pxh^|K$GHTO=Bh)yjeq~wGy}_`^ZfGunX6(7WR)_xhMi8N*ztvDKi zmGkeNV>XJO zDuo#kSt%5pFfqIm_M8ro;@D4YD*vBnp%W!=S?R;d=1=#PrMT3WXgqT6o#I4-``e8` znO~vwrEU4|6kySD>9pQ-Yui)431&#}`AXcWGY51wCimzb^I_Uy7WaxwI}gVIMPY=6 zHEsHu{hX_~BSoNJsgZ@YhokBelCkZXqurqD-Cij4X*4-=c8VQ38QR%A+iKi-pzd|O zD2Km&Qq^o4{nvs&wbP0XUW|KrCcAxTW4v*&KT90I*ct*_?|_u1>Y!Dd&t*gIx61^6 zl;=?gF}*}+J^zj@%mzj8O{t-kG2`=yk2cjD$@ z=sOUv|2cU=-x5uF_CM~nzF#fhb~~C>Y@ka^Zh8Z5*TF1NgoH}Vn>THC&wG>)AC3h;Iq>w)Npm-VurNVZ`gD1@8i)`V29QZ!`CTGUK0$xwLjtm ze4=j6OX90%k<+1~fBBmNv<4kr_abI9uGww0=5FdYrI~F!YO3 z`kx}&f2PjOV`tKpPj6s%yburJ&4YF$*(f5+yY;RPn80($?WfKmhcWMLXF?aqO5uSU zeu1C*2Wg8{NBRDJmki%SjoH-@Tif-+F2!bMPmBhH4}lOpdGqI{TS*}{D8#}98)<+h zTL{2O{3^fvsQ|PU+)mmOqR<%s3sZAk(pHl17w&7W< zr{^U`)izK4)i3?m%lS}*2$|8{E^7~)#cr+H--W!WP1+f1AVOQN>_OPMk6^EITk%1Y zbQOI^=|X>L({+ef-haJK{~$@MywI;E3tBe&ihd|*^88S61rq}^8qnFL5(f!3J02!) z-YH-e5X55tgAk?|k3r-V+k;OjZ2LtW^6DL>cz)o( z&$bY(1E1WG12hXjRj?U?8YKhZp%yri6$`!r0D@S+y|X%y{)4l4aNHR;urxO*}Ycx+<_!Ck~rov9`7pwGeDdQ?|p6_mX=X`eGsPw_dc0v9!nt6tYioRum$;K+pdF zmDHC=3aWBvy7TlkE4>S8iM}pNajVkviOIcd_qAOdZGz3aMpF(pftNl49p^+E&|myG@t6`p$-fN!vvR%6OrBS z0Zo)BVG0TOS5z$_s@T_Hr#R7{BD8|}Tx+}hU=mK1BLhSgG>FLxY8ih)jnOJh60_w5 zbaWWCFujz4S^`yrncAF8A!kubP#@@l2VCb@JkY4oq1gLia12zt_8$M!C{iu35`AI@ z%pC!qiZW1{skbLQTe3W~2$KYz7;P8?S+V#BB|y`q-i~boIg!9HvXT;2VEfy$Iio`W zNVP7fP(*VISU73ZIP%nziDd#X54o5K-sdb;&fYL%)efnoR#aHwGgigPt)Rgu;PYd7l0m+EpQh!+J7 zD@9XQfp9@I@bzvwckhLQwG0Dm88=D>MyxOP&jR%!97u_f1rIUvj5c5lW~j|T7Wh$< znB^2|wBCvm>5pBCPz)P=Y(|MRTTZYoxB*v$v^X4@LhT>rT{9RuL4Odf{1V9pLU~I~ z@&oHeY7&ZkIE|PCo-$y5>Z#kw;UOdt_xpgiR!eVXVRMv6;N>0g659qUnOrymUILd+ zC^;Q8oN5@22h-;Qn%U3+Y-&Lw^vNV83=nJSiEy^jR?Ot2JbA_ivf$B5B0UFGaS?)g z2y!-5mCn9Pqa8JaPj-P#8x+gL%#8|@r$AOs+~gZT3F&GK{h)-3?PS`j$qZn#9S64l zz<5ktsS-rK0LXl|_71r~Izm7H(}!>+WT(*zw}dlc!Qla(KLgB-!~8|?TOY!ynz{6R z@27XaASVAG@|XV%m-=rl|JU!F|B}?d>+gRd+xVBx{-v{j=}hF`A^3L){%Cyh@8yPaY29W$e&r-P5Lx8os?rJrcK!_175vT{;<5`0U)m6Z|3jy`BVZ+k}{ zK9Dd+*&TMY_oe>SHaC~#la!TJ1bL0ADJhVWlc1(lRS{YNzB(qphkPBEvuZ76RrvH$ z8}0e23hkxmvdhmwvAvF-&b}^uQgX5gZC7_+M{k6-JE%m{(H`yKh}g9Y9biTMf`XK| zydu!=()}+}?&*|6eK1MmDI&4K;U44ja1loY$Z!Tv!c)9$T z&JKTlGnTPikH(9;itVKX%*u-myYF|5w4R<}UuP9JrmU2Z;I-$Fb%-DL+S$|l60&aX zTqxGXkDeXLH{6lYvfD&mDe8{S!OEwrxtJGD44-rBG(6fV?>Pc>JLOfs%2mv}XOpk@ zXs}7IEX_8t)5eld=Np)0wI1H2B|yE*#u**QA9da4MF7ncg~xjLu_ zn91r(=zD26y14ER@^&-{GBC9daT(g+NM0z{S_sO9_GS_xBg~mlj8R zJ0m0&6%`Q@QV1z2F_1&dC(zUPP=J`HkKpGTG#!2Hy8bPfH{8lpbMmzY~J9?|?yV`rBeb7$66?gf}(B2Mw zQW8><%GCT{^C%;z-&*nQPyJc(aCYFF$Yhr7k+yBOKiwJsdrKeL#aGmm1_? zujK3M>+Yz!G)n63zRN${U8%iNazEthtRfH~=HTdb$j{wZK-JX6kx$3_ke3TzPk1t) zp)sGJq_l)20{ky2wcJ#9SJmYoOLZZ>)(?K!gH6L1?Y;a76UQT;zom-u=F_+P}2%n;QS(kOSKMGUne9K)@j{Fy0bN z;|($?X)F(eDH`qmBO3U9Hsvo595un-rV1!UPE0~ZOj6ENQb9>tQAtWlR6<%wLP8nw zyPQiU_0bNlPJ!PqDJ?H5A@!x?ik!=1wSv%olJr0W^!5LIBs@Gm4~D+Jk|x^Tk4luf znyP+&t`17l+Ol$zlF|xdin3DDVls+a(qamV67phN>KdBznwk>wyJVNU`E6NhN5K0TBEQfLg%%jR;5@~1<*P7@fcPDMtIiq~@ zJ{~oHlD@Fc7`}I(rlw>Yf4Sw=)0u$>6JuP?^+DYZJusQtkXabs=0VfTEI_v_O7jFQ zPq_(v;N-=1q*F24>Zab!{l`*b6X`T(9`WUE=Ui`?rh596`r0ziJNCOWR{0uX*SDpl z?|0FO*H9?uAEJF`!$$K=^_9qOmiT!!Z_|@ByW`orAxUhyEbDx?F>tD}Os^3=y`7UK zF-sM3x@EwMK3qVXgGv5+C_i+M0&LCc>wTy1-%Yv3r5-IU!>Dv%m-Z^2h#n@Bz4Rim zz0zlVH5=E{N~-Bxd#kZ~Z){noXT9nQ=3(nkU@l{qAzr z`==k@-|x$VlB$;+&A;u6zq7+}gBO!>lp*wn)rNy9j^MAge*6ZnBxn==^!75}THo3| zJkO7aDrVE9t`5o!&J1=6bXuLtZ618Em-f1TG&||0iyzLWq+MQcy~5XO zpnM@Ati>qQzg>P-Go8VyVD##hw+_K0o(mtxJY>qp^HmoR9Mz4!ecx%Ji#z z1HWdO;65#5O)2TfN$PvHe$^Cw@|`H>Zpl9W54(1&#?h%h)P9+Aqv$fSzBtTiK(1vB z&aMq6gd}Ed@v?gB#8oA4&Qm4Hy>+&#@>`E86Bs0N%BuP#az1=eTCF4d=+UHC*Y5T} z1q}T8QM*T;@pA@syM*_TRPE{HHn}G~Y3Wl1Gs)`Qq&7ndUkF|^v~JLbt}xzL)h^y+jD=r;|90QYll!Z{Y@by>$dL1 zvNyfz$uGHC`S9`cmqEerYVGFbLwG`>F}>uGku~Q1lkZqnT~3Y>z2+s!>a)5}M7-9- zaXfz}(Lni)xj+4x`{mF}FM@Kb9i|^IhLmcWyt3J68E2a0BUVRu;^~^;gZ(>fRgoJo zb>xxEP2z;x>@Y%&;X);SzrOtker49Yyy&*yibq5(_dB^AjpyhRwZ?5tKa#WK+_Y2f zoK$hg&IN0|(d+wcw37D{^@m`_VQ(A65%KZy3AvNd6WfQaqpZzD-tAX)Haj1jE;8<; zxPwJo@;n{>;1gsaJZ>an?>5ANlGej#$I&O8BmzY?npGp^C!<4-c9wF>L=S{a;5xLL+sw}0fmS&!aL4{lTn!rH)*PabHtX?W zC1;X50~8Y|6|Ngb1>E%(Taad|_u6f`4SVI=3whZd+^Y~_v!!vV!VlgK>fSHe7r4ih zL40S~PEur-V3e{q!hPo0ZT~G7PAVkg$+WEcoUE4*-og*aPIKwyJE@lyAj@dJ5WH2vE}^=Do;DK7^J_-MGtXpIA$kqT+?c zU{Mxs61R#3t8Hqx+eX*d)<-WQ!**=#h3nyWIg6D1CRQD>Uv>DL!d9(acPFB+Wwza} zt2uQDUns)+qz4LpaS<6iKId!XV0%|oqEKB6H`%|<^xmnPxwF}}SCgNQ9HvYqq9Tqk zq%!$jebB^98n*p-s`Q}Oeo{lyvn)iz^FfFGJ03L6Ngsoj%)u(}2_*gKyj>}EUOsQl zjUAm3W>%7XGJI0j2whJHN2>f+QdVBt8e!rZH>$lJpQ$f`Ba?tUJg zK78^BLvKe1S9>71;**s6DsPsQl2JeyqtU*6)HB~0e8~yTC#fL4oY1sVmR67i!fk17 zDQQJnEom7=st{wP3`12}LQXU5S=3aN> z?c2-YaoToF43V2Q#J<*M$~gw#b#+r*j8Sa9fJ`iVcS62^hf9OJG`gYlp-TJlE{Nws zt?+pLC3##yZm@Ll1!;bY!1^Y>49*kVULYXq_9fRWuKq@h67aOY+gIrPPTaY;!x3$` zcdf`)jt3ag+$+7#BJm-Sy+ehevIVGvo(_x3W{Z~j4bsCGGJ8(a#hCWreOE<~cQ`Q- z-FCSbW_9B?-^hh4MobRd<3AEiZWHovl~lXAh}2mXFs-*3r@LJ6dZY7TIDLMx<_ zcdBmqa)0bS(<9Q+g6dVWs?n)8aJ&Vvqxo-dp)o_y5PG3pfKR^o-E zgiUO^t1x-y?evB2h(S3$yY@wkgbilZ2ZUTtZ||Mq=p$*~P&xClHf?dO(IS!{u_O3N zllD1jOdhsc@$Srav&FEU#XkSq=mkP?jpV(AE3J2sH)kC^OXDBC+lN6QarLp~T#92G zoRO75VYkCbm$_tLDz8CC$6!TSuo((N!JfGClClQGFlYVr^@+*E)M`rl2*Po}YOJ(g z(GxG|iMcXYScH5nw=MVs;<9{(ODOMY#g~BrBtz9nz4*o0$x){#b<>Y)M}7K2TdjOq zbSLI-BovmPIXnR3!|29;a6dLck>yf)#ou1J9n;;qd-^i&+Ec4oIi0R8h1&C%ytW4+ zlS<#SOC4W)A42j>K$yqx7{nbZtO_{hjl}r!Oh|$ zOf2t)Q!S!sMvFpb^d)UK1U#3t^~t$?udveD$Rptrfu}BScy_Q!lzGwTSr!Vb8XA;V z8b+K7bTkSX_u_W@Fw4T0v#XdFOW=Q8nomAfTpjFI!yfYS`r@Ez$Cmj74;^yi&~)nt zEJ2{N6~n7_rSP84Uag#?Dp8H0;wPtf`R@_tZMy3$QB)bAJJfaRT-)@4*r3$%rU$95 z_{^g!gd6_SW9O&E%d<3;43aI;#+laY!}_ZjYIcycih>0e&Rh$9BAyv9#hvU|62Uzh zv?hHaRAx^njNi66)m-V43w*1uL3-!~PZbUGEY7N(*IsrR?09px_7p|&#@YGVG|+Iw z{By$D=F*L5w^k4$+=)(V;euNl7Y-)bv{msf3rJbf!MPU zi*@A@(D8l=Y2m->&lPqyh~wbRnPGXz<7{CswE+)oxJBFa)O7^yLt|U6v8C??2AB=u zB8*3a>;^;BpKwg)nc1u!*RmP9cbyz@qx83#wMEk;IA_Cj^v9iUN=j8BSY>a9myfDV zW-DFJ6v-cYa8$*Nt9trQ=JW}sT&pYnq^O1*VIjh!`u+>EB6n@ekKVF-1j1+;fQu8#boo&RO7KiV~=zk=qSb4KTziv}6t z9}ZZ`SF2{OZhvIplK$EUI~qhMRg90xn+qAqsC*EAH){BP8Lyc+Y5_eV-=Vv30zyTLOv0%5MVZ-BR>6EmZ%f`XK+95dsVEm|mTX2$;q=oIh9 literal 0 HcmV?d00001 diff --git a/packages/issuance/audits/PR1301/README.md b/packages/issuance/audits/PR1301/README.md index 46695b14a..c8c0000c1 100644 --- a/packages/issuance/audits/PR1301/README.md +++ b/packages/issuance/audits/PR1301/README.md @@ -1,35 +1,53 @@ -# Trust Security Audit - PR #1301 +# Trust Security Audit - PR #1301 / #1312 **Auditor:** Trust Security **Period:** 2026-03-03 to 2026-03-19 **Commit:** 7405c9d5f73bce04734efb3f609b76d95ffb520e -**Report:** [Graph_PR1301_v01.pdf](Graph_PR1301_v01.pdf) +**Fix review commit:** 0bbb476f37f85d042927e84d8764fa58eb020ccf +**Report:** [Graph_PR1301_v02.pdf](Graph_PR1301_v02.pdf) ## Findings Summary -| ID | Title | Severity | -| ----------------------- | -------------------------------------------------------- | -------- | -| [TRST-H-1](TRST-H-1.md) | Malicious payer gas siphoning via 63/64 rule | High | -| [TRST-H-2](TRST-H-2.md) | Invalid supportsInterface() returndata escapes try/catch | High | -| [TRST-H-3](TRST-H-3.md) | Stale escrow snapshot causes perpetual revert loop | High | -| [TRST-H-4](TRST-H-4.md) | EOA payer can block collection via EIP-7702 | High | -| [TRST-M-1](TRST-M-1.md) | Micro-thaw griefing via permissionless depositTo() | Medium | -| [TRST-M-2](TRST-M-2.md) | tempJit fallback in beforeCollection() unreachable | Medium | -| [TRST-M-3](TRST-M-3.md) | Instant escrow mode degradation via agreement offer | Medium | -| [TRST-L-1](TRST-L-1.md) | Insufficient gas for afterCollection callback | Low | -| [TRST-L-2](TRST-L-2.md) | Pending update over-reserves escrow | Low | -| [TRST-L-3](TRST-L-3.md) | Unsafe approveAgreement behavior during pause | Low | -| [TRST-L-4](TRST-L-4.md) | Pair tracking removal blocked by 1 wei donation | Low | -| [TRST-L-5](TRST-L-5.md) | \_computeMaxFirstClaim overestimates near deadline | Low | +| ID | Title | Severity | Status | +| ------------------------- | -------------------------------------------------------- | -------- | ------------ | +| [TRST-H-1](TRST-H-1.md) | Malicious payer gas siphoning via 63/64 rule | High | Fixed | +| [TRST-H-2](TRST-H-2.md) | Invalid supportsInterface() returndata escapes try/catch | High | Fixed | +| [TRST-H-3](TRST-H-3.md) | Stale escrow snapshot causes perpetual revert loop | High | Fixed | +| [TRST-H-4](TRST-H-4.md) | EOA payer can block collection via EIP-7702 | High | Fixed | +| [TRST-M-1](TRST-M-1.md) | Micro-thaw griefing via permissionless depositTo() | Medium | Open | +| [TRST-M-2](TRST-M-2.md) | tempJit fallback in beforeCollection() unreachable | Medium | Fixed | +| [TRST-M-3](TRST-M-3.md) | Instant escrow mode degradation via agreement offer | Medium | Acknowledged | +| [TRST-M-4](TRST-M-4.md) | Returndata bombing via payer callbacks | Medium | Open | +| [TRST-M-5](TRST-M-5.md) | Perpetual thaw griefing via micro deposits | Medium | Open | +| [TRST-L-1](TRST-L-1.md) | Insufficient gas for afterCollection callback | Low | Fixed | +| [TRST-L-2](TRST-L-2.md) | Pending update over-reserves escrow | Low | Fixed | +| [TRST-L-3](TRST-L-3.md) | Unsafe approveAgreement behavior during pause | Low | Fixed | +| [TRST-L-4](TRST-L-4.md) | Pair tracking removal blocked by 1 wei donation | Low | Acknowledged | +| [TRST-L-5](TRST-L-5.md) | \_computeMaxFirstClaim overestimates near deadline | Low | Fixed | +| [TRST-L-6](TRST-L-6.md) | Update offer cleanup bypassed via planted offer | Low | Open | +| [TRST-L-7](TRST-L-7.md) | cancel() order sensitivity leaves RCAU offer unreachable | Low | Open | +| [TRST-L-8](TRST-L-8.md) | EOA payer signatures cannot be revoked before deadline | Low | Open | +| [TRST-L-9](TRST-L-9.md) | Callback gas precheck does not account for overhead | Low | Open | +| [TRST-L-10](TRST-L-10.md) | EIP-7702 payer code change enables callback gas griefing | Low | Open | +| [TRST-L-11](TRST-L-11.md) | Inaccurate state flags in getAgreementDetails() | Low | Open | ## Recommendations -| ID | Title | -| ----------------------- | ---------------------------------------------- | -| [TRST-R-1](TRST-R-1.md) | Avoid redeployment of RewardsEligibilityOracle | -| [TRST-R-2](TRST-R-2.md) | Improve stale documentation | -| [TRST-R-3](TRST-R-3.md) | Incorporate defensive coding best practices | -| [TRST-R-4](TRST-R-4.md) | Document critical assumptions in the RAM | +| ID | Title | +| ------------------------- | --------------------------------------------------------------- | +| [TRST-R-1](TRST-R-1.md) | Avoid redeployment of RewardsEligibilityOracle | +| [TRST-R-2](TRST-R-2.md) | Improve stale documentation | +| [TRST-R-3](TRST-R-3.md) | Incorporate defensive coding best practices | +| [TRST-R-4](TRST-R-4.md) | Document critical assumptions in the RAM | +| [TRST-R-5](TRST-R-5.md) | Ambiguous return value in getAgreementOfferAt() | +| [TRST-R-6](TRST-R-6.md) | Dead code guard in \_validateAndStoreUpdate() | +| [TRST-R-7](TRST-R-7.md) | Remove consumed offers in accept() and update() | +| [TRST-R-8](TRST-R-8.md) | Align pause documentation with callback behavior in the RAM | +| [TRST-R-9](TRST-R-9.md) | \_isAuthorized() override trusts itself for any authorizer | +| [TRST-R-10](TRST-R-10.md) | Document role-change semantics for existing agreements | +| [TRST-R-11](TRST-R-11.md) | Remove or implement unused state flags in IAgreementCollector | +| [TRST-R-12](TRST-R-12.md) | Document ACCEPTED state returned for cancelled agreements | +| [TRST-R-13](TRST-R-13.md) | Document reclaim reason change for stale allocation force-close | ## Centralization Risks diff --git a/packages/issuance/audits/PR1301/TRST-H-1.md b/packages/issuance/audits/PR1301/TRST-H-1.md index f250ee55c..7c15cd250 100644 --- a/packages/issuance/audits/PR1301/TRST-H-1.md +++ b/packages/issuance/audits/PR1301/TRST-H-1.md @@ -3,7 +3,7 @@ - **Severity:** High - **Category:** Gas-related issues - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -19,7 +19,11 @@ Enforce a minimum gas reservation before each callback. Before calling `beforeCo ## Team Response -TBD +Fixed. + +## Mitigation Review + +Issue has been fixed as suggested. --- diff --git a/packages/issuance/audits/PR1301/TRST-H-2.md b/packages/issuance/audits/PR1301/TRST-H-2.md index 0f2acbffa..3f8eea841 100644 --- a/packages/issuance/audits/PR1301/TRST-H-2.md +++ b/packages/issuance/audits/PR1301/TRST-H-2.md @@ -3,7 +3,7 @@ - **Severity:** High - **Category:** Logical flaws - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -19,7 +19,11 @@ Avoid receiving and decoding values from untrusted contract calls. This can be d ## Team Response -TBD +Fixed. + +## Mitigation Review + +Fixed. The affected code has been refactored, addressing the issue. --- diff --git a/packages/issuance/audits/PR1301/TRST-H-3.md b/packages/issuance/audits/PR1301/TRST-H-3.md index 5fac18493..66bddea4d 100644 --- a/packages/issuance/audits/PR1301/TRST-H-3.md +++ b/packages/issuance/audits/PR1301/TRST-H-3.md @@ -3,7 +3,7 @@ - **Severity:** High - **Category:** Logical flaws - **Source:** RecurringAgreementManager.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -21,7 +21,11 @@ Read the fresh escrow balance inside `_escrowMinMax()` when computing the defici ## Team Response -TBD +Fixed. + +## Mitigation Review + +The new code has a `_setEscrowSnap()` call before `_escrowMinMax()`, ensuring the snapshot is updated and fixing the root cause. --- diff --git a/packages/issuance/audits/PR1301/TRST-H-4.md b/packages/issuance/audits/PR1301/TRST-H-4.md index 80b4c4195..dda0b4f17 100644 --- a/packages/issuance/audits/PR1301/TRST-H-4.md +++ b/packages/issuance/audits/PR1301/TRST-H-4.md @@ -3,7 +3,7 @@ - **Severity:** High - **Category:** Type confusion - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -21,7 +21,11 @@ Record whether the payer had code at agreement acceptance time by adding a bool ## Team Response -TBD +Fixed. + +## Mitigation Review + +Fixed under the assumption that a provider setting `CONDITION_ELIGIBILITY_CHECK` to true must trust the payer contract. The statement in the fix comment that "An EOA cannot pass this check, so an EOA cannot create an agreement with eligibility gating enabled" is inaccurate, because an EOA can always change its code back and forth via EIP-7702 to pass interface checks. The correct security boundary is that the provider trusts the payer contract when opting into eligibility, not that the payer cannot be an EOA. --- diff --git a/packages/issuance/audits/PR1301/TRST-L-1.md b/packages/issuance/audits/PR1301/TRST-L-1.md index 512e00e98..ed4cd9f11 100644 --- a/packages/issuance/audits/PR1301/TRST-L-1.md +++ b/packages/issuance/audits/PR1301/TRST-L-1.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Time sensitivity flaw - **Source:** RecurringCollector.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -19,7 +19,11 @@ Enforce a minimum gas forwarding requirement for the `afterCollection()` callbac ## Team Response -TBD +Fixed. + +## Mitigation Review + +Fixed as suggested. --- diff --git a/packages/issuance/audits/PR1301/TRST-L-10.md b/packages/issuance/audits/PR1301/TRST-L-10.md new file mode 100644 index 000000000..385b4ee0c --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-L-10.md @@ -0,0 +1,22 @@ +# TRST-L-10: EIP-7702 payer code change enables callback gas griefing after acceptance + +- **Severity:** Low +- **Category:** Type confusion +- **Source:** RecurringCollector.sol +- **Status:** Open + +## Description + +Under EIP-7702, which is live on Ethereum mainnet and Arbitrum, an EOA can install arbitrary code via a delegation transaction. `_preCollectCallbacks()` and `_postCollectCallback()` dispatch the `beforeCollection()` and `afterCollection()` callbacks only when `payer.code.length != 0`. A payer who accepted an agreement as an EOA can later acquire code, and have the callbacks dispatched against delegated code that the service provider never considered at acceptance time. + +The callbacks are low level calls with a `MAX_PAYER_CALLBACK_GAS` budget, and they are vulnerable to the returndata bombing vector described in TRST-M-4, on top of the baseline call costs. Service providers estimate gas for `collect()` under the assumption that the payer is an EOA with no callbacks. If the payer is a contract at collection time, the provider's gas estimate may be insufficient and the transaction will revert with griefed gas. This is a distinct attack surface from TRST-H-4, which targeted the eligibility gate rather than the callback path. + +## Recommended Mitigation + +Use the introduced `CONDITION_ELIGIBILITY_CHECK` flag in place of the live `code.length` check in `_preCollectCallbacks()` and `_postCollectCallback()`. This freezes the contract-versus-EOA determination to the state the service provider observed at acceptance. + +## Team Response + +TBD + +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-11.md b/packages/issuance/audits/PR1301/TRST-L-11.md new file mode 100644 index 000000000..ad0771c7e --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-L-11.md @@ -0,0 +1,26 @@ +# TRST-L-11: Inaccurate state flags returned by getAgreementDetails() and \_offerUpdate() + +- **Severity:** Low +- **Category:** Logical flaws +- **Source:** RecurringCollector.sol +- **Status:** Open + +## Description + +The `IAgreementCollector` interface defines state bit flags including `ACCEPTED` and `UPDATE`, with the documented convention that `UPDATE` is ORed into the state returned by `getAgreementDetails()` for pending versions (index 1). Two deviations from the specification were observed. + +First, in `_offerUpdate()` (lines 417 to 455), when an update is offered against an already accepted agreement, the returned `AgreementDetails` sets state to `REGISTERED | UPDATE` without ORing `ACCEPTED`. Callers that inspect the returned state to determine whether the agreement is already live will misread the underlying agreement as not accepted. + +Second, in `getAgreementDetails()` (lines 500 to 528), the `UPDATE` bit is never ORed into the returned state for the pending version path. The interface documentation promises this behavior for pending versions, but the implementation returns `REGISTERED` or `ACCEPTED` without regard to whether an RCAU offer is pending. + +Neither deviation changes on-chain accounting, but integrators relying on the declared state semantics will receive misleading data. + +## Recommended Mitigation + +In `_offerUpdate()`, OR the `ACCEPTED` bit into state when the underlying agreement is in the Accepted state. In `getAgreementDetails()`, OR the `UPDATE` bit into the returned state when a pending RCAU offer exists for the agreement. + +## Team Response + +TBD + +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-2.md b/packages/issuance/audits/PR1301/TRST-L-2.md index 3fd0d45e4..f3eee05c5 100644 --- a/packages/issuance/audits/PR1301/TRST-L-2.md +++ b/packages/issuance/audits/PR1301/TRST-L-2.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Arithmetic issues - **Source:** RecurringAgreementManager.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -19,7 +19,11 @@ The `pendingMaxNextClaim` should be computed as stated above, then reduced by th ## Team Response -TBD +Fixed. + +## Mitigation Review + +Refactored so that at any point, the accurate worst-case collection is reflected. --- diff --git a/packages/issuance/audits/PR1301/TRST-L-3.md b/packages/issuance/audits/PR1301/TRST-L-3.md index ff8edd1a8..92a21e7e4 100644 --- a/packages/issuance/audits/PR1301/TRST-L-3.md +++ b/packages/issuance/audits/PR1301/TRST-L-3.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Access control issues - **Source:** RecurringAgreementManager.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -19,7 +19,11 @@ Add a pause check to `approveAgreement()` that returns `bytes4(0)` when the cont ## Team Response -TBD +Fixed. + +## Mitigation Review + +Fixed. Underlying code has been refactored, addressing the issue. --- diff --git a/packages/issuance/audits/PR1301/TRST-L-4.md b/packages/issuance/audits/PR1301/TRST-L-4.md index 71ea33109..4df8bbef9 100644 --- a/packages/issuance/audits/PR1301/TRST-L-4.md +++ b/packages/issuance/audits/PR1301/TRST-L-4.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Donation attacks - **Source:** RecurringAgreementManager.sol -- **Status:** Open +- **Status:** Acknowledged ## Description @@ -19,7 +19,7 @@ In `_reconcilePairTracking()`, base the removal decision on `pairAgreementCount` ## Team Response -TBD +Accepted limitation. Orphaned tracking entries do not affect correctness or funds safety. --- diff --git a/packages/issuance/audits/PR1301/TRST-L-5.md b/packages/issuance/audits/PR1301/TRST-L-5.md index 812ac5c35..2533503e0 100644 --- a/packages/issuance/audits/PR1301/TRST-L-5.md +++ b/packages/issuance/audits/PR1301/TRST-L-5.md @@ -3,7 +3,7 @@ - **Severity:** Low - **Category:** Logical flaw - **Source:** RecurringAgreementManager.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -19,7 +19,11 @@ Align `_computeMaxFirstClaim()` with the RecurringCollector's `getMaxNextClaim() ## Team Response -TBD +Fixed. + +## Mitigation Review + +Fixed. The RecurringCollector now calculates the effective window correctly. --- diff --git a/packages/issuance/audits/PR1301/TRST-L-6.md b/packages/issuance/audits/PR1301/TRST-L-6.md new file mode 100644 index 000000000..c0792c908 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-L-6.md @@ -0,0 +1,24 @@ +# TRST-L-6: Update offer cleanup bypassed via planted offer matching active terms + +- **Severity:** Low +- **Category:** Logical flaws +- **Source:** RecurringCollector.sol +- **Status:** Open + +## Description + +In `_validateAndStoreUpdate()` (lines 854-858), cleanup of stored offers after an update uses an if / else if chain keyed on the prior `activeTermsHash`. The first branch deletes a matching entry from `rcaOffers`; the second deletes a matching entry from `rcauOffers`. + +A payer who observes a pending update can call `offer()` with `OFFER_TYPE_NEW` and parameters that reproduce the agreement's currently active RCA terms. The resulting entry in `rcaOffers` hashes to the same `oldHash` value. When `update()` later reaches the cleanup block, the first branch matches and deletes the planted entry, and the else if branch that would have cleaned up the corresponding `rcauOffers` entry is skipped. The pending update offer is then orphaned in storage. + +The `updateNonce` check elsewhere in `_validateAndStoreUpdate()` prevents the orphaned RCAU from being re-accepted, so the issue does not translate to a direct economic exploit. However, it introduces a divergence between the documented invariant that replaced offers are cleaned up and the actual storage state, which could surface as a correctness issue in future features that rely on offer presence. + +## Recommended Mitigation + +Delete both `rcaOffers[agreementId]` and `rcauOffers[agreementId]` unconditionally at the end of `_validateAndStoreUpdate()`. After a successful update the agreement's active terms have changed and any pre-existing offer entries for the same `agreementId` are stale by definition. + +## Team Response + +TBD + +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-7.md b/packages/issuance/audits/PR1301/TRST-L-7.md new file mode 100644 index 000000000..1eee39005 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-L-7.md @@ -0,0 +1,22 @@ +# TRST-L-7: The cancel() function order sensitivity leaves RCAU offer unreachable + +- **Severity:** Low +- **Category:** Time-sensitivity issues +- **Source:** RecurringCollector.sol +- **Status:** Open + +## Description + +When a payer has both a pending RCA offer and a pending RCAU offer for the same `agreementId` and neither has been accepted, the order of cancellations matters. The `cancel()` overload that takes a terms hash delegates authorization to `_requirePayer()` (lines 480-497), which first checks the accepted agreement's payer and then the stored `rcaOffers` entry's payer. It does not fall back to `rcauOffers`. + +If the payer first cancels the RCA offer under `SCOPE_PENDING`, the entry in `rcaOffers` is deleted. A subsequent attempt to cancel the RCAU offer then fails: `_requirePayer()` finds no accepted agreement and no RCA offer, and reverts with `RecurringCollectorAgreementNotFound`. The orphaned RCAU offer remains in storage and unreachable by the payer. If the same parameters are later re-used to offer a new RCA, the orphaned RCAU is associated with it. The `updateNonce` check prevents immediate acceptance of the stale RCAU, but the payer has lost the ability to clean up state they own. + +## Recommended Mitigation + +Extend `_requirePayer()` to also check `rcauOffers` for a payer match when neither an accepted agreement nor an RCA offer is present. Alternatively, enforce symmetric cleanup so that deleting an RCA offer under `SCOPE_PENDING` also deletes any `rcauOffers` entry with the same `agreementId`. + +## Team Response + +TBD + +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-8.md b/packages/issuance/audits/PR1301/TRST-L-8.md new file mode 100644 index 000000000..90911d2d3 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-L-8.md @@ -0,0 +1,22 @@ +# TRST-L-8: EOA payer signatures cannot be revoked before deadline + +- **Severity:** Low +- **Category:** Functionality flaws +- **Source:** RecurringCollector.sol +- **Status:** Open + +## Description + +Payers approve agreements through two paths: an ECDSA signature consumed by `accept()` or `update()`, and a stored offer placed by a contract payer via `offer()` and consumed against the stored hash. Contract payers can revoke a pending offer by calling `cancel()` with `SCOPE_PENDING`, which deletes the matching entry from `rcaOffers` or `rcauOffers`. + +EOA payers have no equivalent revocation path. Once an RCA or RCAU has been signed, the signature is accepted by the collector at any time before the `deadline` field expires. A payer that wishes to cancel a signature-based offer before the deadline (for example, to renegotiate terms) has no mechanism to do so. The only remaining option to ensure no duplicate agreement risk is to wait out the deadline (and hope their unintended offer is not matched), or to revoke the signer via the Authorizable thawing and revocation flow, which affects all agreements authorized by that signer rather than an individual offer. + +## Recommended Mitigation + +Expose a `cancelSignature(bytes32 hash)` entry point that records the hash as invalidated on-chain, and have `_requireAuthorization()` reject any hash that has been invalidated. Alternatively, use a per-signer nonce that the payer can bump to invalidate all outstanding signatures for that signer. + +## Team Response + +TBD + +--- diff --git a/packages/issuance/audits/PR1301/TRST-L-9.md b/packages/issuance/audits/PR1301/TRST-L-9.md new file mode 100644 index 000000000..d53f195b7 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-L-9.md @@ -0,0 +1,22 @@ +# TRST-L-9: Callback gas precheck does not account for intermediate overhead + +- **Severity:** Low +- **Category:** Gas-related issues +- **Source:** RecurringCollector.sol +- **Status:** Open + +## Description + +Both `_preCollectCallbacks()` and `_postCollectCallback()` guard each payer callback with a precheck of the form `if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63) revert`. The intent is to ensure that `MAX_PAYER_CALLBACK_GAS` remains available to the callee after applying the EIP-150 63/64 rule. + +However, the precheck is performed before the CALL or STATICCALL opcode itself, and additional gas is consumed between the comparison and the opcode: local Solidity operations, stack and memory setup, calldata encoding, and the fixed cost of the CALL or STATICCALL instruction. The actual gas forwarded to the callee can fall below `MAX_PAYER_CALLBACK_GAS`. An honest callee may perform incorrect logic under the assumption of available gas. One can refer to Optimism's CrossDomainMessenger, which adds explicit buffer constants (`RELAY_GAS_CHECK_BUFFER` and `RELAY_CALL_OVERHEAD`) for this exact reason. + +## Recommended Mitigation + +Add explicit buffer constants to the precheck so that the comparison accounts for the CALL/STATICCALL cost and the intervening Solidity overhead. Size the buffer so that at least `MAX_PAYER_CALLBACK_GAS` is forwarded to the callee when the check passes. + +## Team Response + +TBD + +--- diff --git a/packages/issuance/audits/PR1301/TRST-M-1.md b/packages/issuance/audits/PR1301/TRST-M-1.md index 6ff77952f..6b10edb96 100644 --- a/packages/issuance/audits/PR1301/TRST-M-1.md +++ b/packages/issuance/audits/PR1301/TRST-M-1.md @@ -23,7 +23,11 @@ Add a minimum thaw threshold in `_updateEscrow()`. Amounts below the threshold s ## Team Response -TBD +Fixed. + +## Mitigation Review + +The griefing path remains reachable. Before any agreement is offered, a 1 wei donation to the (collector, provider) escrow account, followed by a permissionless call to `_reconcilePairTracking()` reaches `_updateEscrow()` with min and max at zero, and the thaw threshold is also at zero. Any positive excess passes the `thawThreshold <= excess` check, causing an `adjustThaw(thawTarget = 1)`. The same sequence also occurs after the final collection of an agreement, when `sumMaxNextClaim` transitions to zero via `afterCollection()` -> `_reconcileAndUpdateEscrow()` -> `_reconcileAgreement()`. There should be a nominal, non-negligible minimum thaw amount on top of the fraction check, applied in both `_reconcileProviderEscrow()` and `_withdrawAndRebalance()`. When `escrowBasis` is JustInTime, override the nominal skip so that dust can still be thawed out for solvency. --- diff --git a/packages/issuance/audits/PR1301/TRST-M-2.md b/packages/issuance/audits/PR1301/TRST-M-2.md index 9fc633fa5..df5ca47c6 100644 --- a/packages/issuance/audits/PR1301/TRST-M-2.md +++ b/packages/issuance/audits/PR1301/TRST-M-2.md @@ -3,7 +3,7 @@ - **Severity:** Medium - **Category:** Logical flaw - **Source:** RecurringAgreementManager.sol -- **Status:** Open +- **Status:** Fixed ## Description @@ -19,7 +19,11 @@ The original intention cannot be truly fulfilled without major redesign of multi ## Team Response -TBD +Fixed. + +## Mitigation Review + +The new setup is schematically sound. Admin intervention to trigger JustInTime may still be required to satisfy requests when the system is in OnDemand but insufficient liquidity is being thawed or minted into the contract. --- diff --git a/packages/issuance/audits/PR1301/TRST-M-3.md b/packages/issuance/audits/PR1301/TRST-M-3.md index ea3c6f7da..7654bbe6c 100644 --- a/packages/issuance/audits/PR1301/TRST-M-3.md +++ b/packages/issuance/audits/PR1301/TRST-M-3.md @@ -3,7 +3,7 @@ - **Severity:** Medium - **Category:** Logical flaw - **Source:** RecurringAgreementManager.sol -- **Status:** Open +- **Status:** Acknowledged ## Description @@ -19,7 +19,7 @@ Add a separate configuration flag (e.g., `allowModeDegradation`) that must be ex ## Team Response -TBD +Acknowledged. The risk is documented, including the operator caution about pre-offer headroom checks. --- diff --git a/packages/issuance/audits/PR1301/TRST-M-4.md b/packages/issuance/audits/PR1301/TRST-M-4.md new file mode 100644 index 000000000..4da7a926a --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-M-4.md @@ -0,0 +1,24 @@ +# TRST-M-4: Returndata bombing via payer callbacks in \_preCollectCallbacks and \_postCollectCallback + +- **Severity:** Medium +- **Category:** Gas-related issues +- **Source:** RecurringCollector.sol +- **Status:** Open + +## Description + +All three payer callbacks reachable from `_collect()` (the eligibility staticcall in `_preCollectCallbacks()` at line 633, the `beforeCollection()` call in the same function at line 646, and the `afterCollection()` call in `_postCollectCallback()` at line 666) use Solidity's default low-level call pattern, which copies the full returndata buffer into the caller's memory. Note that RETURNDATACOPY is emitted even when the returned bytes are discarded via the `(bool ok, )` tuple pattern. + +With a forwarded budget of `MAX_PAYER_CALLBACK_GAS` (1,500,000) per callback, a malicious payer can expand callee memory and return roughly 850 KB of data. The caller's RETURNDATACOPY and the associated memory expansion then consume approximately 1,500,000 gas in the `_collect()` frame for each callback. Across the three callbacks, a single `collect()` call can be forced to burn about 4,500,000 gas beyond the nominal callback budget. + +The impact is an inflated collection cost that is not reflected in off-chain gas estimates. This is gas griefing rather than a collection block, and gas costs remain manageable. + +## Recommended Mitigation + +Replace the affected high-level call sites with inline assembly that performs the call and bounds the amount of returndata copied. For the eligibility check, copy at most 32 bytes into scratch memory and read the result. For `beforeCollection()` and `afterCollection()`, copy zero bytes since the return value is unused. + +## Team Response + +TBD + +--- diff --git a/packages/issuance/audits/PR1301/TRST-M-5.md b/packages/issuance/audits/PR1301/TRST-M-5.md new file mode 100644 index 000000000..34890fba2 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-M-5.md @@ -0,0 +1,24 @@ +# TRST-M-5: Perpetual thaw griefing via micro deposits in \_reconcileProviderEscrow + +- **Severity:** Medium +- **Category:** Griefing attacks +- **Source:** RecurringAgreementManager.sol +- **Status:** Open + +## Description + +The `_reconcileProviderEscrow()` and symmetrically `_withdrawAndRebalance()` functions compare the escrow excess against a fraction-based threshold derived from `sumMaxNextClaim`. The check is structured as `thawThreshold <= excess`, which permits a thaw whenever the cumulative excess is at least the threshold. Because the threshold is keyed on `sumMaxNextClaim` and not on the amount being added to `thawingTarget` in the current round, the check behaves like a one-time gate rather than a per-round qualifier. + +An attacker can grief the RAM in two phases. First, they make a single non-negligible donation via the permissionless `PaymentsEscrow.depositTo()` that pushes the escrow balance for a (collector, provider) pair above `initial_excess > thawThreshold`. This bootstrap round costs the attacker an amount on the order of the threshold and triggers the initial `adjustThaw()` call, starting the thaw timer with `thawingTarget = initial_excess`. Second, the attacker repeatedly donates 1 wei and triggers reconciliation. The bootstrap excess is still present, so `excess > thawThreshold` continues to hold. Each round passes the check, calls `adjustThaw()` with `thawingTarget` incremented by 1 wei, and resets the thaw timer. Legitimate larger thaws issued by the RAM while the griefing is active are blocked for the duration of the thawing period because the timer keeps resetting. + +The per-round cost to the attacker after the bootstrap is 1 wei plus gas. The griefing causes spurious thaws, consumes gas on every reconciliation, and interacts with `PaymentsEscrow.adjustThaw()` timer semantics to indefinitely delay legitimate thaws for the targeted pair. + +## Recommended Mitigation + +Gate the check on the incremental amount being added to `thawingTarget` in the current round rather than on the cumulative excess over the maximum. A round should only pass the threshold check when the new delta to `thawingTarget` is non-trivial. Combine this with an absolute nominal minimum thaw amount applied in both `_reconcileProviderEscrow()` and `_withdrawAndRebalance()` so that sub-nominal dust increments cannot reset the thaw timer even after the bootstrap. + +## Team Response + +TBD + +--- diff --git a/packages/issuance/audits/PR1301/TRST-R-10.md b/packages/issuance/audits/PR1301/TRST-R-10.md new file mode 100644 index 000000000..219698e5f --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-10.md @@ -0,0 +1,7 @@ +# TRST-R-10: Document role-change semantics for existing agreements + +- **Severity:** Recommendation + +## Description + +Changes to `DATA_SERVICE_ROLE` and `COLLECTOR_ROLE` on the RecurringAgreementManager do not affect agreements that have already been offered or accepted through the previously authorized addresses. This is by design (revoking a role should not invalidate settled obligations), but the behavior is not documented. Record this invariant in the RAM documentation so that operators and integrators understand the effect of role changes. diff --git a/packages/issuance/audits/PR1301/TRST-R-11.md b/packages/issuance/audits/PR1301/TRST-R-11.md new file mode 100644 index 000000000..014f20625 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-11.md @@ -0,0 +1,7 @@ +# TRST-R-11: Remove or implement unused state flags in IAgreementCollector + +- **Severity:** Recommendation + +## Description + +`IAgreementCollector` defines state flag constants that are not currently used in the RecurringCollector implementation, including `NOTICE_GIVEN`, `SETTLED`, `BY_PAYER`, `BY_PROVIDER`, `BY_DATA_SERVICE`, `AUTO_UPDATE`, and `AUTO_UPDATED`. Unused public interface constants are a source of confusion for integrators, who may code against documented semantics that the implementation does not honor. Either remove the unused flags from the interface, or implement the behaviors they describe in the collector. diff --git a/packages/issuance/audits/PR1301/TRST-R-12.md b/packages/issuance/audits/PR1301/TRST-R-12.md new file mode 100644 index 000000000..a73ed9648 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-12.md @@ -0,0 +1,7 @@ +# TRST-R-12: Document ACCEPTED state returned for cancelled agreements + +- **Severity:** Recommendation + +## Description + +In `getAgreementDetails()`, any agreement whose state is not `AgreementState.NotAccepted` is reported with state flag `ACCEPTED`. This includes agreements that have been cancelled (`CanceledByPayer` or `CanceledByServiceProvider`). Integrators inspecting the returned state cannot distinguish cancelled agreements from live ones without reading separate storage. Document this behavior in the interface, or extend the state bitmask with a `CANCELED` flag and return it for the non-active terminal states. diff --git a/packages/issuance/audits/PR1301/TRST-R-13.md b/packages/issuance/audits/PR1301/TRST-R-13.md new file mode 100644 index 000000000..6b9b090c0 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-13.md @@ -0,0 +1,7 @@ +# TRST-R-13: Document reclaim reason change for stale allocation force-close + +- **Severity:** Recommendation + +## Description + +Before the PR's refactor, `forceCloseStaleAllocation()` closed the allocation via `_closeAllocation()` and caused a reclaim with reason `CLOSE_ALLOCATION`. Post refactor, the force close path goes through `_resizeAllocation(allocationId, 0, ...)`, which triggers a reclaim with reason `STALE_POI` instead. The reclaim still occurs, but the reason code exposed to reclaim address configuration changes. Document this change so that operators are able to prepare accordingly and have funding paths line up with intention. diff --git a/packages/issuance/audits/PR1301/TRST-R-5.md b/packages/issuance/audits/PR1301/TRST-R-5.md new file mode 100644 index 000000000..f3d5ac72e --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-5.md @@ -0,0 +1,7 @@ +# TRST-R-5: Ambiguous return value in getAgreementOfferAt() + +- **Severity:** Recommendation + +## Description + +`getAgreementOfferAt()` returns `(uint8 offerType, bytes memory offerData)`. The offer type constant `OFFER_TYPE_NEW` is defined as 0, which is also the default Solidity return value when no stored offer exists for the given `agreementId` and index. A caller receiving `offerType == 0` cannot distinguish between a stored new-type offer existing and no offer existing. Consider redefining offer type constants with 1-indexed values, or adding an explicit `bool found` return parameter. diff --git a/packages/issuance/audits/PR1301/TRST-R-6.md b/packages/issuance/audits/PR1301/TRST-R-6.md new file mode 100644 index 000000000..9fa653c5f --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-6.md @@ -0,0 +1,7 @@ +# TRST-R-6: Dead code guard in \_validateAndStoreUpdate() + +- **Severity:** Recommendation + +## Description + +In `_validateAndStoreUpdate()` (line 855), the guard `if (oldHash != bytes32(0))` is unreachable as a false branch. Only agreements in the Accepted state may be updated, and every accepted agreement has a non-zero `activeTermsHash` written during `accept()` or a prior `update()`. The guard can be removed or converted into an invariant comment documenting this assumption. diff --git a/packages/issuance/audits/PR1301/TRST-R-7.md b/packages/issuance/audits/PR1301/TRST-R-7.md new file mode 100644 index 000000000..903eaaea7 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-7.md @@ -0,0 +1,7 @@ +# TRST-R-7: Remove consumed offers in accept() and update() + +- **Severity:** Recommendation + +## Description + +After `accept()` or `update()` consumes a stored offer, the corresponding entry in `rcaOffers` or `rcauOffers` becomes stale. Currently only `_validateAndStoreUpdate()` cleans up the previously active offer by looking up the old `activeTermsHash`; the offer whose terms were just accepted is not deleted. This is a storage hygiene concern: stale offer entries remain in storage indefinitely until explicitly replaced or matched by a future update. Consider deleting the consumed offer entry inside `accept()` and `update()` after it has been applied. diff --git a/packages/issuance/audits/PR1301/TRST-R-8.md b/packages/issuance/audits/PR1301/TRST-R-8.md new file mode 100644 index 000000000..dd2ea9619 --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-8.md @@ -0,0 +1,7 @@ +# TRST-R-8: Align pause documentation with callback behavior in the RAM + +- **Severity:** Recommendation + +## Description + +The RecurringAgreementManager documentation header states that pausing the contract "stops all permissionless escrow management". In practice, the `whenNotPaused` modifier also applies to `beforeCollection()` and `afterCollection()`, so pause also halts the callback path used during `collect()`. Update the documentation to reflect that callbacks are affected, or narrow the modifier application so that behavior matches the prose. diff --git a/packages/issuance/audits/PR1301/TRST-R-9.md b/packages/issuance/audits/PR1301/TRST-R-9.md new file mode 100644 index 000000000..b78e271fe --- /dev/null +++ b/packages/issuance/audits/PR1301/TRST-R-9.md @@ -0,0 +1,7 @@ +# TRST-R-9: \_isAuthorized() override in RecurringCollector trusts itself for any authorizer + +- **Severity:** Recommendation + +## Description + +The `_isAuthorized(address authorizer, address signer)` override in RecurringCollector returns true whenever `signer == address(this)`, regardless of `authorizer`. This enables RecurringCollector to call `dataService.cancelIndexingAgreementByPayer()` on the payer's behalf. The semantics are safe in the current integration with SubgraphService, but they widen the trust surface: any future consumer that relies on `RecurringCollector.isAuthorized()` for access control will grant access when the signer is the collector itself. Consider tightening the override to scope trust to specific callers, or explicitly document the integration contract so it is not misapplied by future consumers. diff --git a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/cancel.t.sol b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/cancel.t.sol index 0b5463cd4..3a8d0340f 100644 --- a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/cancel.t.sol +++ b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/cancel.t.sol @@ -250,9 +250,7 @@ contract SubgraphServiceIndexingAgreementCancelTest is SubgraphServiceIndexingAg // solhint-disable-next-line graph/func-name-mixedcase /// @notice An indexer whose provision drops below minimum should still be able /// to cancel their indexing agreement. Cancel is an exit path. - function test_SubgraphService_CancelIndexingAgreement_OK_WhenProvisionBelowMinimum( - Seed memory seed - ) public { + function test_SubgraphService_CancelIndexingAgreement_OK_WhenProvisionBelowMinimum(Seed memory seed) public { Context storage ctx = _newCtx(seed); IndexerState memory indexerState = _withIndexer(ctx); ( From cb6c45c1a843f601d34081020b6428e15f886d67 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Fri, 17 Apr 2026 09:15:16 +0000 Subject: [PATCH 02/47] fix(collector): add gas overhead buffer to callback prechecks (TRST-L-9) The gasleft() prechecks only accounted for EIP-150's 63/64 rule but not the gas consumed between the check and the CALL opcode. Add a CALLBACK_GAS_OVERHEAD constant (3,000 gas) to all three prechecks so at least MAX_PAYER_CALLBACK_GAS is forwarded to the callee. --- .../collectors/RecurringCollector.sol | 15 +- .../recurring-collector/afterCollection.t.sol | 64 +++++- .../recurring-collector/coverageGaps.t.sol | 191 ++++++++++++++++++ packages/issuance/audits/PR1301/TRST-L-9.md | 11 + 4 files changed, 277 insertions(+), 4 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 171e6e8f0..c51d79d44 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -58,6 +58,12 @@ contract RecurringCollector is /// that could starve the core collect() call of gas. uint256 private constant MAX_PAYER_CALLBACK_GAS = 1_500_000; + /// @notice Gas overhead between the gasleft() precheck and the actual CALL/STATICCALL opcode. + /// Covers ABI encoding, stack/memory setup, and the CALL base cost so that at least + /// MAX_PAYER_CALLBACK_GAS is forwarded to the callee. Sized to cover the cold-account + /// EIP-2929 access cost (2_600) plus Solidity framing. + uint256 private constant CALLBACK_GAS_OVERHEAD = 3_000; + /* solhint-disable gas-small-strings */ /// @notice The EIP712 typehash for the RecurringCollectionAgreement struct bytes32 public constant EIP712_RCA_TYPEHASH = @@ -730,7 +736,8 @@ contract RecurringCollector is if ((agreement.conditions & CONDITION_ELIGIBILITY_CHECK) != 0) { // 64/63 accounts for EIP-150 63/64 gas forwarding rule. - if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63) revert RecurringCollectorInsufficientCallbackGas(); + if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) + revert RecurringCollectorInsufficientCallbackGas(); // Eligibility gate (opt-in via conditions bitmask): low-level staticcall avoids // caller-side ABI decode reverts. Only an explicit return of 0 blocks collection; @@ -747,7 +754,8 @@ contract RecurringCollector is } if (payer.code.length != 0 && payer != msg.sender) { - if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63) revert RecurringCollectorInsufficientCallbackGas(); + if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) + revert RecurringCollectorInsufficientCallbackGas(); // solhint-disable-next-line avoid-low-level-calls (bool beforeOk, ) = payer.call{ gas: MAX_PAYER_CALLBACK_GAS }( @@ -768,7 +776,8 @@ contract RecurringCollector is // Notify contract payers so they can reconcile escrow in the same transaction. if (payer != msg.sender && payer.code.length != 0) { // 64/63 accounts for EIP-150 63/64 gas forwarding rule. - if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63) revert RecurringCollectorInsufficientCallbackGas(); + if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) + revert RecurringCollectorInsufficientCallbackGas(); // solhint-disable-next-line avoid-low-level-calls (bool afterOk, ) = payer.call{ gas: MAX_PAYER_CALLBACK_GAS }( abi.encodeCall(IAgreementOwner.afterCollection, (agreementId, tokensToCollect)) diff --git a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol index 3e7396178..90ae638e7 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol @@ -143,7 +143,7 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { ); // Binary-search for a gas limit that passes core collect logic but trips the - // callback gas guard (gasleft < MAX_PAYER_CALLBACK_GAS * 64/63 ≈ 1_523_810). + // callback gas guard (gasleft < MAX_PAYER_CALLBACK_GAS * 64/63 + CALLBACK_GAS_OVERHEAD ≈ 1_526_810). // Core logic + escrow call + beforeCollection + events uses ~200k gas. bool triggered; for (uint256 gasLimit = 1_700_000; gasLimit > 1_500_000; gasLimit -= 10_000) { @@ -166,6 +166,68 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { assertTrue(triggered, "Should have triggered InsufficientCallbackGas at some gas limit"); } + /// @notice TRST-L-9: the CALLBACK_GAS_OVERHEAD precheck also guards the eligibility staticcall + /// (first of three callback prechecks). Binary-search for a gas limit that reaches the + /// eligibility precheck and trips it, confirming the buffer logic applies there too. + function test_Collect_Revert_WhenInsufficientCallbackGas_EligibilityPrecheck() public { + MockAgreementOwner approver = _newApprover(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + rca.conditions = 1; // CONDITION_ELIGIBILITY_CHECK — activates the eligibility precheck first + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + skip(rca.minSecondsPerCollection); + uint256 tokens = 1 ether; + bytes memory data = _generateCollectData(_generateCollectParams(rca, agreementId, bytes32("col1"), tokens, 0)); + bytes memory callData = abi.encodeCall( + _recurringCollector.collect, + (IGraphPayments.PaymentTypes.IndexingFee, data) + ); + + // With eligibility enabled, three sequential callbacks each need the buffer. The test + // confirms at least one (the first, eligibility) trips InsufficientCallbackGas. + bool triggered; + for (uint256 gasLimit = 1_700_000; gasLimit > 1_500_000; gasLimit -= 10_000) { + uint256 snap = vm.snapshot(); + vm.prank(rca.dataService); + (bool success, bytes memory returnData) = address(_recurringCollector).call{ gas: gasLimit }(callData); + if (!success && returnData.length >= 4) { + bytes4 selector; + // solhint-disable-next-line no-inline-assembly + assembly { + selector := mload(add(returnData, 32)) + } + if (selector == IRecurringCollector.RecurringCollectorInsufficientCallbackGas.selector) { + triggered = true; + assertTrue(vm.revertTo(snap)); + break; + } + } + assertTrue(vm.revertTo(snap)); + } + assertTrue(triggered, "eligibility precheck must trip InsufficientCallbackGas under tight gas"); + } + function test_AfterCollection_NotCalledForEOAPayer(FuzzyTestCollect calldata fuzzy) public { // Use standard ECDSA-signed path (EOA payer, no contract) (IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, , , ) = _sensibleAuthorizeAndAccept( diff --git a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol index 696f97584..f81187662 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol @@ -995,6 +995,197 @@ contract RecurringCollectorCoverageGapsTest is RecurringCollectorSharedTest { assertEq(dataServiceMock.canceledAgreementId(), agreementId, "Agreement ID should match"); } + // ══════════════════════════════════════════════════════════════════════ + // Gap 20 — _offerNew deadline guard (L481): offer with deadline already past + // ══════════════════════════════════════════════════════════════════════ + + /// @notice Offering an RCA whose deadline is already past must revert. The deadline guard + /// at the entry of {_offerNew} is independent from the collection-window check in + /// {_requireValidTerms}; this exercises the deadline-elapsed branch directly. + function test_OfferNew_Revert_WhenDeadlineAlreadyPast() public { + MockAgreementOwner approver = new MockAgreementOwner(); + uint64 deadline = uint64(block.timestamp + 100); + IRecurringCollector.RecurringCollectionAgreement memory rca = IRecurringCollector.RecurringCollectionAgreement({ + deadline: deadline, + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }); + + // Warp past the deadline before the offer call so the entry-time guard fires. + skip(101); + + vm.expectRevert( + abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorAgreementDeadlineElapsed.selector, + block.timestamp, + deadline + ) + ); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + } + + // ══════════════════════════════════════════════════════════════════════ + // Gap 21 — _requirePayerToSupportEligibilityCheck (L788): contract payer + // sets CONDITION_ELIGIBILITY_CHECK but does not implement IProviderEligibility + // ══════════════════════════════════════════════════════════════════════ + + /// @notice When an RCA enables CONDITION_ELIGIBILITY_CHECK, the payer must support + /// IProviderEligibility via ERC-165. BareAgreementOwner implements IAgreementOwner but + /// not IERC165, so ERC165Checker.supportsInterface returns false and the require fires + /// at offer time. + function test_OfferNew_Revert_WhenEligibilityConditionAndPayerLacksInterface() public { + BareAgreementOwner bare = new BareAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(bare), + dataService: makeAddr("ds-elig-bare"), + serviceProvider: makeAddr("sp-elig-bare"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 1, // CONDITION_ELIGIBILITY_CHECK + nonce: 1, + metadata: "" + }); + + vm.expectRevert( + abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorPayerDoesNotSupportEligibilityInterface.selector, + address(bare) + ) + ); + vm.prank(address(bare)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + } + + // ══════════════════════════════════════════════════════════════════════ + // Gap 22 / 23 — Callback-gas prechecks (deterministic single-call) + // + // afterCollection.t.sol uses vm.revertTo in a binary-search loop, which + // discards forge coverage traces. Direct calls track them. + // ══════════════════════════════════════════════════════════════════════ + + /// @notice Eligibility-precheck gas guard reverts under tight gas. Direct call + /// so coverage tracks the revert. + function test_Collect_Revert_LowGas_EligibilityPrecheck_Direct() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds-elig-low-gas"), + serviceProvider: makeAddr("sp-elig-low-gas"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + rca.conditions = 1; // CONDITION_ELIGIBILITY_CHECK + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + skip(rca.minSecondsPerCollection); + bytes memory data = _generateCollectData( + _generateCollectParams(rca, agreementId, bytes32("col-elig-low"), 1 ether, 0) + ); + bytes memory callData = abi.encodeCall( + _recurringCollector.collect, + (IGraphPayments.PaymentTypes.IndexingFee, data) + ); + + // Outer gas just below the 64/63 + overhead threshold (~1.527M) — gasleft() at the + // first precheck must fall under threshold and trigger the revert. + vm.prank(rca.dataService); + (bool ok, bytes memory ret) = address(_recurringCollector).call{ gas: 1_500_000 }(callData); + assertFalse(ok, "expected revert"); + assertTrue(ret.length >= 4, "expected revert reason"); + bytes4 selector; + // solhint-disable-next-line no-inline-assembly + assembly { + selector := mload(add(ret, 32)) + } + assertEq( + selector, + IRecurringCollector.RecurringCollectorInsufficientCallbackGas.selector, + "expected InsufficientCallbackGas at eligibility precheck" + ); + } + + /// @notice beforeCollection-precheck gas guard reverts under tight gas. With no + /// eligibility flag the first precheck is skipped, so this hits the second guard. + function test_Collect_Revert_LowGas_BeforeCollection_Direct() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds-before-low-gas"), + serviceProvider: makeAddr("sp-before-low-gas"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, // no eligibility — skip first precheck + nonce: 1, + metadata: "" + }) + ); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + skip(rca.minSecondsPerCollection); + bytes memory data = _generateCollectData( + _generateCollectParams(rca, agreementId, bytes32("col-before-low"), 1 ether, 0) + ); + bytes memory callData = abi.encodeCall( + _recurringCollector.collect, + (IGraphPayments.PaymentTypes.IndexingFee, data) + ); + + vm.prank(rca.dataService); + (bool ok, bytes memory ret) = address(_recurringCollector).call{ gas: 1_500_000 }(callData); + assertFalse(ok, "expected revert"); + assertTrue(ret.length >= 4, "expected revert reason"); + bytes4 selector; + // solhint-disable-next-line no-inline-assembly + assembly { + selector := mload(add(ret, 32)) + } + assertEq( + selector, + IRecurringCollector.RecurringCollectorInsufficientCallbackGas.selector, + "expected InsufficientCallbackGas at beforeCollection precheck" + ); + } + /* solhint-enable graph/func-name-mixedcase */ } diff --git a/packages/issuance/audits/PR1301/TRST-L-9.md b/packages/issuance/audits/PR1301/TRST-L-9.md index d53f195b7..e98f66046 100644 --- a/packages/issuance/audits/PR1301/TRST-L-9.md +++ b/packages/issuance/audits/PR1301/TRST-L-9.md @@ -20,3 +20,14 @@ Add explicit buffer constants to the precheck so that the comparison accounts fo TBD --- + +Added `CALLBACK_GAS_OVERHEAD = 3_000` constant. All three prechecks now use: + +```solidity +if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) + revert RecurringCollectorInsufficientCallbackGas(); +``` + +Sized to cover the worst-case pre-opcode cost. The eligibility STATICCALL is the first access to the payer account on the collect path, so the EIP-2929 cold-account access cost (2_600) dominates; the remaining headroom covers `abi.encodeCall` and stack/memory setup. Subsequent `beforeCollection` / `afterCollection` calls hit the payer warm (100 gas access), so the buffer is generous there. + +Follows the Optimism buffer-constant pattern as suggested. From 3ce58131594a74cb2f681e7a2a3a4246bd9315a4 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Fri, 17 Apr 2026 09:34:45 +0000 Subject: [PATCH 03/47] fix(collector): cap returndata copy in payer callbacks (TRST-M-4) Replace Solidity low-level calls with inline assembly to bound returndata copy: eligibility staticcall copies at most 32 bytes, beforeCollection/afterCollection copy zero bytes. Prevents a malicious payer from forcing ~4.5M gas overhead via returndata bombing. --- .../collectors/RecurringCollector.sol | 54 +++++---- .../recurring-collector/returndataBomb.t.sol | 108 ++++++++++++++++++ packages/issuance/audits/PR1301/TRST-M-4.md | 9 ++ 3 files changed, 149 insertions(+), 22 deletions(-) create mode 100644 packages/horizon/test/unit/payments/recurring-collector/returndataBomb.t.sol diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index c51d79d44..2cfb38767 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -731,36 +731,40 @@ contract RecurringCollector is ) private { address payer = agreement.payer; address provider = agreement.serviceProvider; - // Payer callbacks use gas-capped low-level calls to prevent gas siphoning and - // caller-side ABI decode reverts. Failures emit events but do not block collection. + // Eligibility gate (opt-in via conditions bitmask). Assembly staticcall caps returndata + // copy to 32 bytes, preventing returndata bombing. Only an explicit return of 0 blocks + // collection; reverts, short returndata, and malformed responses are treated as "no + // opinion" (collection proceeds). if ((agreement.conditions & CONDITION_ELIGIBILITY_CHECK) != 0) { - // 64/63 accounts for EIP-150 63/64 gas forwarding rule. if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) revert RecurringCollectorInsufficientCallbackGas(); - - // Eligibility gate (opt-in via conditions bitmask): low-level staticcall avoids - // caller-side ABI decode reverts. Only an explicit return of 0 blocks collection; - // reverts, short returndata, and malformed responses are treated as "no opinion" - // (collection proceeds). - // solhint-disable-next-line avoid-low-level-calls - (bool success, bytes memory result) = payer.staticcall{ gas: MAX_PAYER_CALLBACK_GAS }( - abi.encodeCall(IProviderEligibility.isEligible, (provider)) - ); - if (success && !(result.length < 32) && abi.decode(result, (uint256)) == 0) + bytes memory cd = abi.encodeCall(IProviderEligibility.isEligible, (provider)); + bool success; + uint256 returnLen; + uint256 result; + // solhint-disable-next-line no-inline-assembly + assembly { + success := staticcall(MAX_PAYER_CALLBACK_GAS, payer, add(cd, 0x20), mload(cd), 0x00, 0x20) + returnLen := returndatasize() + result := mload(0x00) + } + if (success && !(returnLen < 32) && result == 0) revert RecurringCollectorCollectionNotEligible(agreementId, provider); - if (!success || result.length < 32) + if (!success || returnLen < 32) emit PayerCallbackFailed(agreementId, payer, PayerCallbackStage.EligibilityCheck); } + // Assembly call copies 0 bytes of returndata, preventing returndata bombing. if (payer.code.length != 0 && payer != msg.sender) { if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) revert RecurringCollectorInsufficientCallbackGas(); - - // solhint-disable-next-line avoid-low-level-calls - (bool beforeOk, ) = payer.call{ gas: MAX_PAYER_CALLBACK_GAS }( - abi.encodeCall(IAgreementOwner.beforeCollection, (agreementId, tokensToCollect)) - ); + bytes memory cd = abi.encodeCall(IAgreementOwner.beforeCollection, (agreementId, tokensToCollect)); + bool beforeOk; + // solhint-disable-next-line no-inline-assembly + assembly { + beforeOk := call(MAX_PAYER_CALLBACK_GAS, payer, 0, add(cd, 0x20), mload(cd), 0, 0) + } if (!beforeOk) emit PayerCallbackFailed(agreementId, payer, PayerCallbackStage.BeforeCollection); } } @@ -778,10 +782,16 @@ contract RecurringCollector is // 64/63 accounts for EIP-150 63/64 gas forwarding rule. if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) revert RecurringCollectorInsufficientCallbackGas(); - // solhint-disable-next-line avoid-low-level-calls - (bool afterOk, ) = payer.call{ gas: MAX_PAYER_CALLBACK_GAS }( - abi.encodeCall(IAgreementOwner.afterCollection, (agreementId, tokensToCollect)) + // Assembly call copies 0 bytes of returndata, preventing returndata bombing. + bytes memory afterCallData = abi.encodeCall( + IAgreementOwner.afterCollection, + (agreementId, tokensToCollect) ); + bool afterOk; + // solhint-disable-next-line no-inline-assembly + assembly { + afterOk := call(MAX_PAYER_CALLBACK_GAS, payer, 0, add(afterCallData, 0x20), mload(afterCallData), 0, 0) + } if (!afterOk) emit PayerCallbackFailed(agreementId, payer, PayerCallbackStage.AfterCollection); } } diff --git a/packages/horizon/test/unit/payments/recurring-collector/returndataBomb.t.sol b/packages/horizon/test/unit/payments/recurring-collector/returndataBomb.t.sol new file mode 100644 index 000000000..3ef69f430 --- /dev/null +++ b/packages/horizon/test/unit/payments/recurring-collector/returndataBomb.t.sol @@ -0,0 +1,108 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.27; + +import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; +import { IGraphPayments } from "@graphprotocol/interfaces/contracts/horizon/IGraphPayments.sol"; +import { IAgreementOwner } from "@graphprotocol/interfaces/contracts/horizon/IAgreementOwner.sol"; +import { IProviderEligibility } from "@graphprotocol/interfaces/contracts/issuance/eligibility/IProviderEligibility.sol"; +import { OFFER_TYPE_NEW } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; +import { IERC165 } from "@openzeppelin/contracts/utils/introspection/IERC165.sol"; + +import { RecurringCollectorSharedTest } from "./shared.t.sol"; + +/// @notice Payer that returns a configurable-size buffer from every callback. +/// Used to verify the collector caps returndata copy into its outer frame. +contract HugeReturnPayer is IAgreementOwner, IERC165 { + uint256 public returnBytes = 500_000; + + function setReturnBytes(uint256 size) external { + returnBytes = size; + } + + function supportsInterface(bytes4 interfaceId) external pure override returns (bool) { + return interfaceId == type(IERC165).interfaceId || interfaceId == type(IProviderEligibility).interfaceId; + } + + function beforeCollection(bytes16, uint256) external { + uint256 size = returnBytes; + // solhint-disable-next-line no-inline-assembly + assembly { + return(0, size) + } + } + + function afterCollection(bytes16, uint256) external { + uint256 size = returnBytes; + // solhint-disable-next-line no-inline-assembly + assembly { + return(0, size) + } + } + + /// @notice isEligible — first 32 bytes = 1 (eligible), remainder is memory-expansion padding. + fallback() external { + uint256 size = returnBytes; + // solhint-disable-next-line no-inline-assembly + assembly { + mstore(0, 1) + return(0, size) + } + } +} + +contract RecurringCollectorReturndataBombTest is RecurringCollectorSharedTest { + /* solhint-disable graph/func-name-mixedcase */ + + /// @notice All three payer callbacks return 500KB. With bounded retSize at each call site + /// the outer frame does not copy the returndata, so gas usage stays proportional to the + /// callbacks' own internal work. Without the bound, the outer frame incurs memory expansion + /// + RETURNDATACOPY for each 500KB payload, roughly doubling gas consumption. + function test_Collect_BoundsReturndataCopy_WhenPayerReturnsHuge() public { + HugeReturnPayer attacker = new HugeReturnPayer(); + attacker.setReturnBytes(500_000); + + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(attacker), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + rca.conditions = 1; // CONDITION_ELIGIBILITY_CHECK — exercise the eligibility staticcall path + + vm.prank(address(attacker)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + skip(rca.minSecondsPerCollection); + uint256 tokens = 1 ether; + bytes memory data = _generateCollectData(_generateCollectParams(rca, agreementId, bytes32("col1"), tokens, 0)); + + uint256 gasBefore = gasleft(); + vm.prank(rca.dataService); + uint256 collected = _recurringCollector.collect(IGraphPayments.PaymentTypes.IndexingFee, data); + uint256 gasUsed = gasBefore - gasleft(); + + assertEq(collected, tokens, "collect should succeed despite huge returndata"); + + // Bounded frame: base collect (~200k) plus three callbacks' internal 500KB expansion + // (~520k each) totals roughly 1.8M. Without the bound each callback additionally causes + // ~520k of outer-frame memory expansion plus the RETURNDATACOPY itself, pushing the + // total above 3.3M. A 2.5M ceiling cleanly separates the two cases. + assertLt(gasUsed, 2_500_000, "outer frame consumed unbounded payer returndata"); + } + + /* solhint-enable graph/func-name-mixedcase */ +} diff --git a/packages/issuance/audits/PR1301/TRST-M-4.md b/packages/issuance/audits/PR1301/TRST-M-4.md index 4da7a926a..ad06eac0e 100644 --- a/packages/issuance/audits/PR1301/TRST-M-4.md +++ b/packages/issuance/audits/PR1301/TRST-M-4.md @@ -22,3 +22,12 @@ Replace the affected high-level call sites with inline assembly that performs th TBD --- + +## Fix + +Replaced all three call sites with inline assembly that bounds returndata copy: + +- **Eligibility staticcall**: copies at most 32 bytes into scratch space (0x00), reads the `uint256` result from there. +- **beforeCollection / afterCollection**: copy 0 bytes (`retSize=0`), only the `bool success` from the CALL opcode is used. + +This prevents a malicious payer from forcing RETURNDATACOPY of ~850 KB per callback. From 8e50abda2dbd3e189aed2c5fa71565776aaf12f4 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Fri, 17 Apr 2026 09:50:52 +0000 Subject: [PATCH 04/47] docs: add response to TRST-L-10 EIP-7702 callback dispatch (won't fix) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CONDITION_ELIGIBILITY_CHECK is an agreement term, not a proxy for payer type — contract payers can legitimately offer agreements without it, and gating callback dispatch on the flag would deny beforeCollection / afterCollection to those payers. With the M-4 returndata-bombing fix in place, the gas impact of an EIP-7702 EOA acquiring callbacks is bounded and predictable, and the callbacks themselves are non-reverting and non-blocking. --- packages/issuance/audits/PR1301/TRST-L-10.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/issuance/audits/PR1301/TRST-L-10.md b/packages/issuance/audits/PR1301/TRST-L-10.md index 385b4ee0c..919cda91d 100644 --- a/packages/issuance/audits/PR1301/TRST-L-10.md +++ b/packages/issuance/audits/PR1301/TRST-L-10.md @@ -20,3 +20,7 @@ Use the introduced `CONDITION_ELIGIBILITY_CHECK` flag in place of the live `code TBD --- + +Using `CONDITION_ELIGIBILITY_CHECK` for callback dispatch does not seem appropriate. The eligibility check is an agreement term, not a proxy for payer type and contract payers can legitimately offer agreements without this condition. The provider agreeing to the check requires greater trust in the payer. Gating callbacks on this flag would deny `beforeCollection`/`afterCollection` to contract payers for agreements without eligibility gating. + +With the returndata bombing fix (TRST-M-4), the gas impact of an EIP-7702 EOA gaining callbacks is bounded and predictable. We do not believe this as a significant attack vector. The `beforeCollection`/`afterCollection` callbacks are non-reverting and non-blocking. A payer adding code via EIP-7702 to better handle escrow reconciliation could be a valid use case and in the best interests of all parties. From 6a0ac799db1fd81ae0f08a9ba4270b59332708a5 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Fri, 17 Apr 2026 12:13:24 +0000 Subject: [PATCH 05/47] feat(RAM): drop pair tracking below residual escrow threshold (TRST-M-1, TRST-M-5) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add minResidualEscrowFactor (uint8, default 50 → threshold 2^50 wei ≈ 0.001 GRT) to RecurringAgreementManager. When a (collector, provider) pair has no remaining agreements and the escrow balance is below the threshold, tracking is dropped — the residual is not worth the gas cost of further thaw/withdraw cycles. For untracked pairs, reconcileProvider performs a blind drain (withdraw matured thaw, thaw remainder) without re-creating tracking state. New agreements for the same pair re-add tracking naturally via _offerAgreement. --- .../payments/recurring-collector/cancel.t.sol | 2 + .../agreement/IRecurringAgreements.sol | 7 + .../agreement/IRecurringEscrowManagement.sol | 23 ++ packages/issuance/audits/PR1301/TRST-M-1.md | 4 +- packages/issuance/audits/PR1301/TRST-M-5.md | 4 + .../agreement/RecurringAgreementManager.sol | 84 +++++- .../agreement-manager/cascadeCleanup.t.sol | 11 + .../escrowSnapStaleness.t.sol | 6 +- .../agreement-manager/residualEscrow.t.sol | 280 ++++++++++++++++++ 9 files changed, 408 insertions(+), 13 deletions(-) create mode 100644 packages/issuance/test/unit/agreement-manager/residualEscrow.t.sol diff --git a/packages/horizon/test/unit/payments/recurring-collector/cancel.t.sol b/packages/horizon/test/unit/payments/recurring-collector/cancel.t.sol index cf1da6743..1b19a2fc8 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/cancel.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/cancel.t.sol @@ -27,6 +27,8 @@ contract RecurringCollectorCancelTest is RecurringCollectorSharedTest { IRecurringCollector.RecurringCollectionAgreement memory fuzzyRCA, uint8 unboundedCanceler ) public { + vm.assume(fuzzyRCA.dataService != _proxyAdmin); + // Generate deterministic agreement ID bytes16 agreementId = _recurringCollector.generateAgreementId( fuzzyRCA.payer, diff --git a/packages/interfaces/contracts/issuance/agreement/IRecurringAgreements.sol b/packages/interfaces/contracts/issuance/agreement/IRecurringAgreements.sol index debbff6c0..4c01aba27 100644 --- a/packages/interfaces/contracts/issuance/agreement/IRecurringAgreements.sol +++ b/packages/interfaces/contracts/issuance/agreement/IRecurringAgreements.sol @@ -68,6 +68,13 @@ interface IRecurringAgreements { */ function getMinThawFraction() external view returns (uint8 fraction); + /** + * @notice Minimum residual escrow factor for cleanup. + * @dev Pairs with no agreements and escrow below 2^value are dropped from tracking. + * @return value The exponent (threshold = 2^value) + */ + function getMinResidualEscrowFactor() external view returns (uint8 value); + /** * @notice Get the sum of maxNextClaim across all (collector, provider) pairs * @dev Populated lazily through normal operations. diff --git a/packages/interfaces/contracts/issuance/agreement/IRecurringEscrowManagement.sol b/packages/interfaces/contracts/issuance/agreement/IRecurringEscrowManagement.sol index f19bc108b..76bca5f62 100644 --- a/packages/interfaces/contracts/issuance/agreement/IRecurringEscrowManagement.sol +++ b/packages/interfaces/contracts/issuance/agreement/IRecurringEscrowManagement.sol @@ -76,6 +76,13 @@ interface IRecurringEscrowManagement { */ event MinThawFractionSet(uint8 oldFraction, uint8 newFraction); + /** + * @notice Emitted when the minimum residual escrow is changed + * @param oldValue The previous value + * @param newValue The new value + */ + event MinResidualEscrowFactorSet(uint8 oldValue, uint8 newValue); + // solhint-enable gas-indexed-events // -- Functions -- @@ -124,4 +131,20 @@ interface IRecurringEscrowManagement { * @param fraction The numerator over 256 for the dust threshold */ function setMinThawFraction(uint8 fraction) external; + + /** + * @notice Set the minimum residual escrow factor for pair tracking cleanup. + * @dev Requires OPERATOR_ROLE. When a (collector, provider) pair has no remaining agreements + * and the escrow balance is below 2^value, tracking is dropped because the residual is not worth + * the gas cost of further thaw/withdraw cycles. Funds remain in PaymentsEscrow but are no + * longer actively managed by RAM. Higher values drop tracking more aggressively. + * + * - 0: 2^0 = 1 wei (drop only at zero balance — effectively never drop) + * - 50: 2^50 ≈ 10^15 (0.001 GRT, default) + * - 60: 2^60 ≈ 10^18 (1 GRT) + * - 255: 2^255 (always drop when no agreements remain — effectively disables residual tracking) + * + * @param value The exponent (threshold = 2^value) + */ + function setMinResidualEscrowFactor(uint8 value) external; } diff --git a/packages/issuance/audits/PR1301/TRST-M-1.md b/packages/issuance/audits/PR1301/TRST-M-1.md index 6b10edb96..72927231d 100644 --- a/packages/issuance/audits/PR1301/TRST-M-1.md +++ b/packages/issuance/audits/PR1301/TRST-M-1.md @@ -31,4 +31,6 @@ The griefing path remains reachable. Before any agreement is offered, a 1 wei do --- -Added configurable `minThawFraction` (uint8, proportion of 256, default 16 = 6.25%) that skips thaws when the excess above max is below `sumMaxNextClaim * fraction / 256` for the (collector, provider) pair. An attacker must now donate a meaningful fraction per griefing round, making such an attack both economically unattractive and less effective. +Added configurable `minThawFraction` (uint8, default 16 = 6.25% of `sumMaxNextClaim`) that skips thaws below threshold. + +The zero-threshold path when `sumMaxNextClaim = 0` is acknowledged. Timer resets do not occur (`evenIfTimerReset=false` rejects increases), so the vector is limited to postponing pair tracking cleanup via repeated dust deposits. Added `minResidualEscrowFactor` (uint8, default 50, threshold = 2^value ≈ 0.001 GRT for default): pairs with no agreements and escrow below threshold are dropped from tracking. Untracked pairs can still have escrow drained via blind thaw/withdraw on `reconcileProvider`. diff --git a/packages/issuance/audits/PR1301/TRST-M-5.md b/packages/issuance/audits/PR1301/TRST-M-5.md index 34890fba2..155efa2be 100644 --- a/packages/issuance/audits/PR1301/TRST-M-5.md +++ b/packages/issuance/audits/PR1301/TRST-M-5.md @@ -22,3 +22,7 @@ Gate the check on the incremental amount being added to `thawingTarget` in the c TBD --- + +RAM always calls `adjustThaw(..., evenIfTimerReset=false)`. When a thaw is already active, any increase to `thawingTarget` that would change `thawEndTimestamp` is silently rejected by PaymentsEscrow so the timer is never reset. The "bootstrap + repeated 1 wei" attack does not work as described? + +The actual vector is narrower: indefinite postponement of pair tracking cleanup when `sumMaxNextClaim = 0`. Addressed by `minResidualEscrowFactor` in the fix for TRST-M-1. diff --git a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol index 881208eed..6edf82117 100644 --- a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol +++ b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol @@ -143,7 +143,11 @@ contract RecurringAgreementManager is /** * @notice Per-(collector, provider) pair tracking data * @param sumMaxNextClaim Sum of maxNextClaim for all agreements in this pair - * @param escrowSnap Last known escrow balance (for snapshot diff) + * @param escrowSnap Snapshot of escrow balance at the last _setEscrowSnap call. + * Input to totalEscrowDeficit accounting, not a guarantee of the live balance — it can + * drift between reconciliations (e.g. after beforeCollection's JIT deposit) until the + * next _reconcileProviderEscrow resyncs it. Read the live balance via _fetchEscrowAccount + * when actual solvency matters. * @param agreements Set of agreement IDs for this pair (stored as bytes32 for EnumerableSet) */ struct CollectorProviderData { @@ -176,8 +180,9 @@ contract RecurringAgreementManager is /// @notice Total unfunded escrow: sum of max(0, sumMaxNextClaim[c][p] - escrowSnap[c][p]) uint256 totalEscrowDeficit; /// @notice The issuance allocator that mints GRT to this contract (20 bytes) - /// @dev Packed slot (28/32 bytes): issuanceAllocator (20) + ensuredIncomingDistributedToBlock (4) + - /// escrowBasis (1) + minOnDemandBasisThreshold (1) + minFullBasisMargin (1) + minThawFraction (1). + /// @dev Packed slot (29/32 bytes): issuanceAllocator (20) + ensuredIncomingDistributedToBlock (4) + + /// escrowBasis (1) + minOnDemandBasisThreshold (1) + minFullBasisMargin (1) + minThawFraction (1) + + /// minResidualEscrowFactor (1). /// All read together in _reconcileProviderEscrow / beforeCollection. IIssuanceAllocationDistribution issuanceAllocator; /// @notice Block number when _ensureIncomingDistributionToCurrentBlock last ran @@ -194,6 +199,13 @@ contract RecurringAgreementManager is /// per (collector, provider) pair is skipped as operationally insignificant. /// Governance-configured. uint8 minThawFraction; + /// @notice Minimum residual escrow factor: when a (collector, provider) pair has no agreements + /// and the escrow balance is below 2^value, tracking is dropped; the residual is not worth + /// the gas cost of further thaw/withdraw cycles. Funds remain in PaymentsEscrow but are no + /// longer actively managed by RAM. Higher values drop more aggressively: + /// 0 = drop only at zero balance (effectively never drop); 255 = always drop when no + /// agreements remain. Governance-configured. Default 50 ≈ 0.001 GRT. + uint8 minResidualEscrowFactor; /// @notice Optional oracle for checking payment eligibility of service providers (20/32 bytes in slot) IProviderEligibility providerEligibilityOracle; } @@ -231,6 +243,7 @@ contract RecurringAgreementManager is $.minOnDemandBasisThreshold = 128; $.minFullBasisMargin = 16; $.minThawFraction = 16; + $.minResidualEscrowFactor = 50; // 2^50 ≈ 10^15 ≈ 0.001 GRT } // -- ERC165 -- @@ -435,6 +448,16 @@ contract RecurringAgreementManager is emit MinThawFractionSet(oldFraction, fraction); } + /// @inheritdoc IRecurringEscrowManagement + function setMinResidualEscrowFactor(uint8 value) external onlyRole(OPERATOR_ROLE) { + RecurringAgreementManagerStorage storage $ = _getStorage(); + if ($.minResidualEscrowFactor == value) return; + + uint8 oldValue = $.minResidualEscrowFactor; + $.minResidualEscrowFactor = value; + emit MinResidualEscrowFactorSet(oldValue, value); + } + // -- IProviderEligibilityManagement -- /// @inheritdoc IProviderEligibilityManagement @@ -542,6 +565,11 @@ contract RecurringAgreementManager is return _getStorage().minThawFraction; } + /// @inheritdoc IRecurringAgreements + function getMinResidualEscrowFactor() external view returns (uint8) { + return _getStorage().minResidualEscrowFactor; + } + /// @inheritdoc IRecurringAgreements function getCollectorCount() external view returns (uint256) { return _getStorage().collectorSet.length(); @@ -683,9 +711,17 @@ contract RecurringAgreementManager is } /** - * @notice Reconcile escrow then remove (collector, provider) tracking if fully drained. - * @dev Calls {_reconcileProviderEscrow} to withdraw completed thaws, then removes the pair from - * tracking only when both agreement count and escrowSnap are zero. + * @notice Reconcile escrow then remove (collector, provider) tracking if below residual threshold. + * @dev For tracked pairs (in providerSet): runs {_reconcileProviderEscrow}, then drops tracking + * when no agreements remain and escrow balance is strictly below the residual threshold. + * For untracked pairs: performs a blind drain (withdraw matured thaw, thaw remainder) without + * re-creating tracking state. + * + * The residual threshold = 2^minResidualEscrowFactor. Below this, the residual is not worth + * the gas cost of further thaw/withdraw cycles, so tracking is dropped. Funds remain in + * PaymentsEscrow, just no longer actively managed by RAM. A subsequent {_offerAgreement} + * for the same pair will re-add tracking naturally. + * * Cascades to remove the collector when it has no remaining providers. * @param $ The storage reference * @param collector The collector contract address @@ -698,11 +734,22 @@ contract RecurringAgreementManager is address collector, address provider ) private returns (bool tracked) { + if (!$.collectors[collector].providerSet.contains(provider)) { + // Not tracked — blind drain without re-creating tracking state. + _drainUntracked(collector, provider); + return false; + } + _reconcileProviderEscrow($, collector, provider); CollectorProviderData storage cpd = $.collectors[collector].providers[provider]; - if (cpd.agreements.length() != 0 || cpd.escrowSnap != 0) tracked = true; - else if ($.collectors[collector].providerSet.remove(provider)) { + // Drop tracking when no agreements and escrow is below residual threshold. + // Funds remain in PaymentsEscrow; deficit contribution is already 0 (sumMaxNextClaim == 0). + // Read real balance (escrowSnap is already cleared when sumMaxNextClaim == 0). + tracked = + cpd.agreements.length() != 0 || + ((uint256(1) << $.minResidualEscrowFactor) <= _fetchEscrowAccount(collector, provider).balance); + if (!tracked && $.collectors[collector].providerSet.remove(provider)) { emit ProviderRemoved(collector, provider); if ($.collectors[collector].providerSet.length() == 0) { // Provider agreement count will already be zero at this point. @@ -712,6 +759,24 @@ contract RecurringAgreementManager is } } + /** + * @notice Blind drain for an untracked (collector, provider) escrow pair. + * @dev Withdraws matured thaw if any, then starts a new thaw for remaining balance. + * Does not read or write any RAM tracking state. Only acts when no thaw is active + * (after withdraw or if none was started), so thaw() is safe — no timer to reset. + * @param collector The collector contract address + * @param provider Service provider address + */ + function _drainUntracked(address collector, address provider) private { + IPaymentsEscrow.EscrowAccount memory account = _fetchEscrowAccount(collector, provider); + if (0 < account.tokensThawing && account.thawEndTimestamp < block.timestamp) { + PAYMENTS_ESCROW.withdraw(collector, provider); + account = _fetchEscrowAccount(collector, provider); + } + if (account.tokensThawing == 0 && 0 < account.balance) + PAYMENTS_ESCROW.thaw(collector, provider, account.balance); + } + /** * @notice The sole mutation point for agreement.maxNextClaim and all derived totals. * @dev ALL writes to agreement.maxNextClaim, sumMaxNextClaim, sumMaxNextClaimAll, and @@ -928,7 +993,8 @@ contract RecurringAgreementManager is address provider ) private { uint256 oldEscrow = cpd.escrowSnap; - uint256 newEscrow = _fetchEscrowAccount(collector, provider).balance; + // No need to track escrow when no claims remain (deficit is 0 regardless). + uint256 newEscrow = cpd.sumMaxNextClaim != 0 ? _fetchEscrowAccount(collector, provider).balance : 0; if (oldEscrow == newEscrow) return; uint256 oldDeficit = _providerEscrowDeficit(cpd); diff --git a/packages/issuance/test/unit/agreement-manager/cascadeCleanup.t.sol b/packages/issuance/test/unit/agreement-manager/cascadeCleanup.t.sol index eeffa61e1..b9d058c6c 100644 --- a/packages/issuance/test/unit/agreement-manager/cascadeCleanup.t.sol +++ b/packages/issuance/test/unit/agreement-manager/cascadeCleanup.t.sol @@ -193,6 +193,12 @@ contract RecurringAgreementManagerCascadeCleanupTest is RecurringAgreementManage assertEq(agreementManager.getCollectorCount(), 0); assertEq(agreementManager.getProviderCount(IAgreementCollector(address(recurringCollector))), 0); + // Storage fully released: escrowSnap cleared when sumMaxNextClaim reached 0 + assertEq( + agreementManager.getEscrowSnap(IAgreementCollector(address(recurringCollector)), indexer), + 0, + "escrowSnap should be cleared after pair drop" + ); } function test_Cascade_ReconcileLastProvider_CollectorCleanedUp_OtherCollectorRemains() public { @@ -271,6 +277,11 @@ contract RecurringAgreementManagerCascadeCleanupTest is RecurringAgreementManage vm.warp(block.timestamp + paymentsEscrow.THAWING_PERIOD() + 1); agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); assertEq(agreementManager.getCollectorCount(), 0); + assertEq( + agreementManager.getEscrowSnap(IAgreementCollector(address(recurringCollector)), indexer), + 0, + "escrowSnap clean before re-add" + ); // Re-add — sets repopulate (IRecurringCollector.RecurringCollectionAgreement memory rca2, ) = _makeRCAForCollector(recurringCollector, 2); diff --git a/packages/issuance/test/unit/agreement-manager/escrowSnapStaleness.t.sol b/packages/issuance/test/unit/agreement-manager/escrowSnapStaleness.t.sol index 65cc44245..8bf7c5844 100644 --- a/packages/issuance/test/unit/agreement-manager/escrowSnapStaleness.t.sol +++ b/packages/issuance/test/unit/agreement-manager/escrowSnapStaleness.t.sol @@ -9,9 +9,9 @@ import { IRecurringEscrowManagement } from "@graphprotocol/interfaces/contracts/ import { RecurringAgreementManagerSharedTest } from "./shared.t.sol"; /// @notice Tests for escrow snapshot staleness correction and threshold boundary behavior. -/// Covers gaps: -/// - Stale escrow snap self-correction via _setEscrowSnap (TRST-H-3) -/// - Threshold-based basis degradation boundary conditions (TRST-M-2, M-3) +/// Covers: +/// - Stale escrow snap self-correction via _setEscrowSnap +/// - Threshold-based basis degradation boundary conditions /// - Deficit tracking accuracy after external escrow mutations contract RecurringAgreementManagerEscrowSnapStalenessTest is RecurringAgreementManagerSharedTest { /* solhint-disable graph/func-name-mixedcase */ diff --git a/packages/issuance/test/unit/agreement-manager/residualEscrow.t.sol b/packages/issuance/test/unit/agreement-manager/residualEscrow.t.sol new file mode 100644 index 000000000..c96003e67 --- /dev/null +++ b/packages/issuance/test/unit/agreement-manager/residualEscrow.t.sol @@ -0,0 +1,280 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.27; + +import { IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; +import { IPaymentsEscrow } from "@graphprotocol/interfaces/contracts/horizon/IPaymentsEscrow.sol"; +import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; +import { IRecurringAgreementManagement } from "@graphprotocol/interfaces/contracts/issuance/agreement/IRecurringAgreementManagement.sol"; +import { IRecurringEscrowManagement } from "@graphprotocol/interfaces/contracts/issuance/agreement/IRecurringEscrowManagement.sol"; + +import { RecurringAgreementManagerSharedTest } from "./shared.t.sol"; + +/// @notice Tests for minResidualEscrowFactor — residual escrow threshold for pair cleanup. +contract RecurringAgreementManagerResidualEscrowTest is RecurringAgreementManagerSharedTest { + /* solhint-disable graph/func-name-mixedcase */ + + // -- Helpers -- + + /// @notice Create an agreement, cancel it, and advance past the thaw period so escrow is withdrawable. + function _createAndCancelAgreement() + private + returns (bytes16 agreementId, IRecurringCollector.RecurringCollectionAgreement memory rca) + { + (rca, ) = _makeRCAWithId(100 ether, 1 ether, 3600, uint64(block.timestamp + 365 days)); + agreementId = _offerAgreement(rca); + + _setAgreementCanceledBySP(agreementId, rca); + agreementManager.reconcileAgreement(IAgreementCollector(address(recurringCollector)), agreementId); + } + + /// @notice Inject dust directly into escrow (simulates external depositTo by attacker). + function _injectDust(uint256 amount) private { + (uint256 bal, uint256 thawing, uint256 thawEnd) = paymentsEscrow.escrowAccounts( + address(agreementManager), + address(recurringCollector), + indexer + ); + // Mint backing tokens to the escrow so withdraw can transfer them + token.mint(address(paymentsEscrow), amount); + paymentsEscrow.setAccount( + address(agreementManager), + address(recurringCollector), + indexer, + bal + amount, + thawing, + thawEnd + ); + } + + // -- Tests: residual threshold drops tracking -- + + function test_ResidualEscrow_DropsTrackingBelowThreshold() public { + // Default factor = 50, threshold = 2^50 ≈ 1.1e15 + _createAndCancelAgreement(); + + // Advance past thaw period so escrow can be withdrawn + vm.warp(block.timestamp + 1 days + 1); + + // reconcileProvider: withdraws full balance, dust is zero, pair is dropped + bool tracked = agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + assertFalse(tracked, "pair should be dropped when escrow is zero"); + assertEq( + agreementManager.getProviderCount(IAgreementCollector(address(recurringCollector))), + 0, + "provider should be removed from set" + ); + assertEq(agreementManager.getCollectorCount(), 0, "collector should be removed from set"); + } + + function test_ResidualEscrow_KeepsTrackingAboveThreshold() public { + _createAndCancelAgreement(); + + // Inject balance well above threshold (2^50 ≈ 1.1e15) + vm.warp(block.timestamp + 1 days + 1); + _injectDust(1 ether); + + bool tracked = agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + assertTrue(tracked, "pair should remain tracked when escrow exceeds threshold"); + } + + function test_ResidualEscrow_DustGriefingDropsTracking() public { + _createAndCancelAgreement(); + + // Advance past thaw, then inject 1 wei (simulates attacker depositTo) + vm.warp(block.timestamp + 1 days + 1); + _injectDust(1); + + // reconcileProvider: withdraws matured thaw, 1 wei remains, + // 1 wei < 2^50 threshold → pair is dropped + bool tracked = agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + assertFalse(tracked, "dust should not prevent cleanup"); + } + + // -- Tests: blind drain for untracked pairs -- + + function test_ResidualEscrow_BlindDrainUntrackedPair() public { + _createAndCancelAgreement(); + + // Drop tracking first + vm.warp(block.timestamp + 1 days + 1); + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + assertEq(agreementManager.getProviderCount(IAgreementCollector(address(recurringCollector))), 0); + + // Inject dust into the now-untracked escrow + _injectDust(100); + + // reconcileProvider on untracked pair: blind drain starts thaw + bool tracked = agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + assertFalse(tracked, "untracked pair should stay untracked"); + + // Escrow should now be thawing + (uint256 bal, uint256 thawing, ) = paymentsEscrow.escrowAccounts( + address(agreementManager), + address(recurringCollector), + indexer + ); + assertEq(thawing, bal, "full balance should be thawing"); + } + + function test_ResidualEscrow_BlindDrainWithdrawsMaturedThaw() public { + _createAndCancelAgreement(); + + // Drop tracking + vm.warp(block.timestamp + 1 days + 1); + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + + // Inject dust, start thaw via blind drain + _injectDust(100); + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + + // Read the thaw end timestamp and advance past it + (, , uint256 thawEnd) = paymentsEscrow.escrowAccounts( + address(agreementManager), + address(recurringCollector), + indexer + ); + vm.warp(thawEnd + 1); + + uint256 balBefore = token.balanceOf(address(agreementManager)); + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + uint256 balAfter = token.balanceOf(address(agreementManager)); + + assertEq(balAfter - balBefore, 100, "dust should be withdrawn to agreement manager"); + } + + function test_ResidualEscrow_BlindDrainNoopMidThaw() public { + _createAndCancelAgreement(); + + // Drop tracking + vm.warp(block.timestamp + 1 days + 1); + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + + // Inject dust, start thaw + _injectDust(100); + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + + // Inject more dust mid-thaw — blind drain should NOT reset the timer + _injectDust(50); + + (, , uint256 thawEndBefore) = paymentsEscrow.escrowAccounts( + address(agreementManager), + address(recurringCollector), + indexer + ); + + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + + (, uint256 thawingAfter, uint256 thawEndAfter) = paymentsEscrow.escrowAccounts( + address(agreementManager), + address(recurringCollector), + indexer + ); + + // Timer should not have reset (evenIfTimerReset=false) + assertEq(thawEndAfter, thawEndBefore, "thaw timer should not reset on blind drain mid-thaw"); + // Only the original 100 should be thawing, not 150 + assertEq(thawingAfter, 100, "thaw amount should not increase mid-thaw"); + } + + // -- Tests: re-entry after drop restores tracking -- + + function test_ResidualEscrow_ReentryRestoresTracking() public { + _createAndCancelAgreement(); + + // Drop tracking + vm.warp(block.timestamp + 1 days + 1); + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + assertEq(agreementManager.getCollectorCount(), 0, "collector should be removed"); + + // New agreement for the same (collector, provider) pair + IRecurringCollector.RecurringCollectionAgreement memory rca2 = _makeRCA( + 50 ether, + 0.5 ether, + 60, + 3600, + uint64(block.timestamp + 365 days) + ); + rca2.nonce = 2; + _offerAgreement(rca2); + + // Tracking should be restored + assertEq( + agreementManager.getProviderCount(IAgreementCollector(address(recurringCollector))), + 1, + "provider should be re-tracked" + ); + assertEq(agreementManager.getCollectorCount(), 1, "collector should be re-tracked"); + } + + function test_ResidualEscrow_ReentryWithStaleSnapCorrects() public { + _createAndCancelAgreement(); + + // Inject extra balance, then drop tracking — snap records the inflated balance + _injectDust(500); + vm.warp(block.timestamp + 1 days + 1); + agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + + // Escrow still has some balance (the dust that was below threshold or leftover) + // Now create new agreement — snap should be corrected from real balance + IRecurringCollector.RecurringCollectionAgreement memory rca2 = _makeRCA( + 50 ether, + 0.5 ether, + 60, + 3600, + uint64(block.timestamp + 365 days) + ); + rca2.nonce = 2; + _offerAgreement(rca2); + + // The system should work normally — no stale snap causing issues + // Verify escrow is funded correctly for the new agreement + (uint256 bal, , ) = paymentsEscrow.escrowAccounts( + address(agreementManager), + address(recurringCollector), + indexer + ); + uint256 expectedMaxClaim = 0.5 ether * 3600 + 50 ether; + assertEq(bal, expectedMaxClaim, "escrow should be funded for new agreement (snap corrected)"); + } + + // -- Tests: setter -- + + function test_ResidualEscrow_SetFactor() public { + assertEq(agreementManager.getMinResidualEscrowFactor(), 50, "default should be 50"); + + vm.prank(operator); + agreementManager.setMinResidualEscrowFactor(60); + assertEq(agreementManager.getMinResidualEscrowFactor(), 60); + } + + function test_ResidualEscrow_SetFactor_SameValueNoop() public { + vm.prank(operator); + // Should not emit event + vm.recordLogs(); + agreementManager.setMinResidualEscrowFactor(50); + assertEq(vm.getRecordedLogs().length, 0, "no event on same value"); + } + + function test_ResidualEscrow_SetFactor_EmitsEvent() public { + vm.expectEmit(address(agreementManager)); + emit IRecurringEscrowManagement.MinResidualEscrowFactorSet(50, 100); + + vm.prank(operator); + agreementManager.setMinResidualEscrowFactor(100); + } + + function test_ResidualEscrow_SetFactor_ZeroDisables() public { + _createAndCancelAgreement(); + + vm.prank(operator); + agreementManager.setMinResidualEscrowFactor(0); + + // With factor=0, threshold = 2^0 = 1, only drops at zero balance + // Inject 1 wei — should keep tracking + vm.warp(block.timestamp + 1 days + 1); + _injectDust(1); + + bool tracked = agreementManager.reconcileProvider(IAgreementCollector(address(recurringCollector)), indexer); + assertTrue(tracked, "factor=0 means threshold=1, 1 wei should keep tracking"); + } +} From f96a7316c360a8f0b6b72ae56b71d9c8f35df298 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 19:03:14 +0000 Subject: [PATCH 06/47] docs: add responses to TRST-L-6, TRST-R-7 (both won't fix) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit TRST-L-6: planted-offer-matching-active-terms cleanup bypass — rejected because cross-type EIP-712 collisions are computationally infeasible and same-type 'collisions' require the payer to reproduce their own terms, which is not an attack. TRST-R-7: eagerly delete consumed offers — rejected because offer data (metadata, nonce, deadline) is intentionally kept accessible via getAgreementOfferAt() until obsolete. --- packages/issuance/audits/PR1301/TRST-L-6.md | 4 ++++ packages/issuance/audits/PR1301/TRST-R-7.md | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/packages/issuance/audits/PR1301/TRST-L-6.md b/packages/issuance/audits/PR1301/TRST-L-6.md index c0792c908..50b3bf72f 100644 --- a/packages/issuance/audits/PR1301/TRST-L-6.md +++ b/packages/issuance/audits/PR1301/TRST-L-6.md @@ -22,3 +22,7 @@ Delete both `rcaOffers[agreementId]` and `rcauOffers[agreementId]` unconditional TBD --- + +The described attack requires planting an RCA offer whose EIP-712 hash collides with the active `activeTermsHash`. Because `_hashRCA` and `_hashRCAU` use distinct type hashes (`EIP712_RCA_TYPEHASH` vs `EIP712_RCAU_TYPEHASH`), cross-type collisions require a keccak256 preimage collision? Same-type collisions require the payer to reproduce the exact RCA terms, which is not an attack (the payer authored those terms). + +(Cleanup handling will be improved in combination with the response to TRST-L-11.) diff --git a/packages/issuance/audits/PR1301/TRST-R-7.md b/packages/issuance/audits/PR1301/TRST-R-7.md index 903eaaea7..65f7ae98c 100644 --- a/packages/issuance/audits/PR1301/TRST-R-7.md +++ b/packages/issuance/audits/PR1301/TRST-R-7.md @@ -5,3 +5,9 @@ ## Description After `accept()` or `update()` consumes a stored offer, the corresponding entry in `rcaOffers` or `rcauOffers` becomes stale. Currently only `_validateAndStoreUpdate()` cleans up the previously active offer by looking up the old `activeTermsHash`; the offer whose terms were just accepted is not deleted. This is a storage hygiene concern: stale offer entries remain in storage indefinitely until explicitly replaced or matched by a future update. Consider deleting the consumed offer entry inside `accept()` and `update()` after it has been applied. + +--- + +Keeping consumed offers in storage is by design — offer data (including metadata, nonce, deadline) remains accessible on-chain via `getAgreementOfferAt()` until the terms are obsolete. Stale entries are cleaned up by `_validateAndStoreUpdate()` on the next update, overwritten by a new `offer()`, or removed by `cancel()`. Eagerly deleting on consumption would lose data that callers may still want to inspect. + +(Cleanup handling will be improved in combination with the response to TRST-L-11.) From 35447e70395b3f4efea0656549df6a31b5940674 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 20 Apr 2026 13:21:01 +0000 Subject: [PATCH 07/47] docs(audit): acknowledge TRST-R-3 cancelAgreement defensive check The RAM's cancelAgreement is now a pass-through to collector.cancel(), which requires agreement.state == AgreementState.Accepted. The defensive guard the recommendation asks for already lives in the single authoritative location for agreement state; no further change required. --- packages/issuance/audits/PR1301/TRST-R-3.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/issuance/audits/PR1301/TRST-R-3.md b/packages/issuance/audits/PR1301/TRST-R-3.md index d3fa90130..0e012a072 100644 --- a/packages/issuance/audits/PR1301/TRST-R-3.md +++ b/packages/issuance/audits/PR1301/TRST-R-3.md @@ -5,3 +5,7 @@ ## Description In the RAM's `cancelAgreement()` function, the agreement state is required to not be not accepted. However, the logic could be more specific and require the agreement to be Accepted - rejecting previously cancelled agreements. There is no impact because corresponding checks in the RecurringCollector would deny such cancels, but it remains as a best practice. + +--- + +Fixed. The RAM's `cancelAgreement()` was refactored into a pass-through to `collector.cancel()`, which requires `agreement.state == AgreementState.Accepted` before proceeding. The defensive guard now lives in the single authoritative location for agreement state. From 2dd23720fb6ef3a132ce2c567e1aa05aee1cb87d Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 20 Apr 2026 13:21:01 +0000 Subject: [PATCH 08/47] fix(collector): remove dead oldHash guard (TRST-R-6) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _validateAndStoreUpdate's `if (oldHash != bytes32(0))` branch was unreachable — every Accepted agreement has a non-zero activeTermsHash written during accept() or a prior update(). Dropped the guard; the offer cleanup is now unconditional with an inline comment noting the invariant. --- .../contracts/payments/collectors/RecurringCollector.sol | 9 ++++----- packages/issuance/audits/PR1301/TRST-R-6.md | 4 ++++ 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 2cfb38767..fa404a14a 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -1040,11 +1040,10 @@ contract RecurringCollector is // Reverts on overflow — rejecting excessive terms that could prevent collection _rcau.maxOngoingTokensPerSecond * _rcau.maxSecondsPerCollection * 1024; - // Clean up stored replaced offer - bytes32 oldHash = _agreement.activeTermsHash; - if (oldHash != bytes32(0)) - if ($.rcaOffers[_rcau.agreementId].offerHash == oldHash) delete $.rcaOffers[_rcau.agreementId]; - else if ($.rcauOffers[_rcau.agreementId].offerHash == oldHash) delete $.rcauOffers[_rcau.agreementId]; + // Clean up stored replaced offer. oldHash is always non-zero for accepted agreements + // and can only ever survive in rcaOffers. + if ($.rcaOffers[_rcau.agreementId].offerHash == _agreement.activeTermsHash) + delete $.rcaOffers[_rcau.agreementId]; // update the agreement _agreement.endsAt = _rcau.endsAt; diff --git a/packages/issuance/audits/PR1301/TRST-R-6.md b/packages/issuance/audits/PR1301/TRST-R-6.md index 9fa653c5f..46215cc6b 100644 --- a/packages/issuance/audits/PR1301/TRST-R-6.md +++ b/packages/issuance/audits/PR1301/TRST-R-6.md @@ -5,3 +5,7 @@ ## Description In `_validateAndStoreUpdate()` (line 855), the guard `if (oldHash != bytes32(0))` is unreachable as a false branch. Only agreements in the Accepted state may be updated, and every accepted agreement has a non-zero `activeTermsHash` written during `accept()` or a prior `update()`. The guard can be removed or converted into an invariant comment documenting this assumption. + +--- + +Fixed. Removed the dead `if (oldHash != bytes32(0))` guard. Also dropped the unreachable `else if` for `rcauOffers` cleanup — `oldHash` can only survive in `rcaOffers` (from `accept()`), since `update()` always overwrites `rcauOffers` with the new RCAU hash before this point. From c1ef1cb685314c69eb753470af685f2d380f2c2d Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 16:07:23 +0000 Subject: [PATCH 09/47] fix(collector): non-zero offer types, reserve OFFER_TYPE_NONE=0 sentinel (TRST-R-5) getAgreementOfferAt callers could not distinguish a stored OFFER_TYPE_NEW (value 0) from the zero default returned when no offer exists. Make the offer type flags non-zero (NEW=1, UPDATE=2), reserve 0 as the named OFFER_TYPE_NONE sentinel, and use it at the no-offer return site. --- .../offerStorageLifecycle.t.sol | 355 ++++++++++++++++++ .../contracts/horizon/IAgreementCollector.sol | 11 +- packages/issuance/audits/PR1301/TRST-R-5.md | 4 + 3 files changed, 366 insertions(+), 4 deletions(-) create mode 100644 packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol diff --git a/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol b/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol new file mode 100644 index 000000000..0aece90ae --- /dev/null +++ b/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol @@ -0,0 +1,355 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.27; + +import { Vm } from "forge-std/Vm.sol"; + +import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; +import { + IAgreementCollector, + OFFER_TYPE_NONE, + OFFER_TYPE_NEW, + OFFER_TYPE_UPDATE, + SCOPE_PENDING, + VERSION_CURRENT, + VERSION_NEXT +} from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; + +import { RecurringCollectorSharedTest } from "./shared.t.sol"; +import { MockAgreementOwner } from "./MockAgreementOwner.t.sol"; + +/// @notice Targeted coverage for the hash-keyed offer storage refactor. +contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorSharedTest { + /* solhint-disable graph/func-name-mixedcase */ + + function _makeRca(address payer) internal returns (IRecurringCollector.RecurringCollectionAgreement memory) { + return + _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: payer, + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + } + + function _makeRcau( + bytes16 agreementId, + IRecurringCollector.RecurringCollectionAgreement memory rca, + uint32 nonce + ) internal view returns (IRecurringCollector.RecurringCollectionAgreementUpdate memory) { + return + IRecurringCollector.RecurringCollectionAgreementUpdate({ + agreementId: agreementId, + deadline: uint64(block.timestamp + 1 hours), + endsAt: rca.endsAt + 30 days, + maxInitialTokens: rca.maxInitialTokens, + maxOngoingTokensPerSecond: rca.maxOngoingTokensPerSecond * 2, + minSecondsPerCollection: rca.minSecondsPerCollection, + maxSecondsPerCollection: rca.maxSecondsPerCollection, + conditions: 0, + nonce: nonce, + metadata: "" + }); + } + + // ────────────────────────────────────────────────────────────────────── + // Hash-keyed offer storage lifecycle + // ────────────────────────────────────────────────────────────────────── + + /// @notice offer(RCA) creates a storage entry at the EIP-712 hash and emits OfferStored. + function test_OfferNew_StoresEntryAtHash_EmitsEvent() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, rcaHash); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + + (uint8 offerType, bytes memory offerData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(offerType, OFFER_TYPE_NEW, "stored entry at rcaHash"); + assertTrue(offerData.length > 0, "stored data non-empty"); + + IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); + assertEq(agreement.activeTermsHash, rcaHash, "agreement.activeTermsHash points at offer hash"); + assertEq(agreement.pendingTermsHash, bytes32(0), "no pending before update"); + } + + /// @notice Re-offering the identical RCA is idempotent — no second OfferStored event, storage unchanged. + function test_OfferNew_Idempotent_WhenResubmittedSameHash() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + + // Second call with the same RCA must not emit OfferStored again + vm.recordLogs(); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + Vm.Log[] memory logs = vm.getRecordedLogs(); + bytes32 offerStoredSig = keccak256("OfferStored(bytes16,address,uint8,bytes32)"); + for (uint256 i = 0; i < logs.length; i++) { + if (logs[i].topics.length > 0) { + assertFalse(logs[i].topics[0] == offerStoredSig, "no duplicate OfferStored on re-offer"); + } + } + } + + /// @notice Accepting a stored offer preserves the offer entry — getAgreementOfferAt still returns it. + function test_OfferNew_EntryPersistsAcrossAccept() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + (uint8 offerType, bytes memory offerData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(offerType, OFFER_TYPE_NEW, "accept does not delete the RCA offer entry"); + assertTrue(offerData.length > 0, "accept preserves stored data"); + } + + /// @notice A successful update deletes the prior active offer from storage; the new RCAU terms + /// become VERSION_CURRENT (OFFER_TYPE_UPDATE) and the pending slot clears. + function test_Update_DeletesPriorActiveOffer_PromotesRcauToCurrent() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau(agreementId, rca, 1); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + bytes32 rcauHash = _recurringCollector.hashRCAU(rcau); + + vm.prank(rca.dataService); + _recurringCollector.update(rcau, ""); + + // Prior active (RCA) offer deleted from storage — since activeTermsHash now points at rcauHash, + // a fresh agreementId derived with mismatched hash should return empty at the rcaHash slot. + // We assert via getAgreementDetails: rcaHash is no longer a current version. + IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); + assertEq(agreement.activeTermsHash, rcauHash, "activeTermsHash = rcauHash after update"); + assertEq(agreement.pendingTermsHash, bytes32(0), "pendingTermsHash cleared after update"); + + (uint8 currentType, ) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_CURRENT); + assertEq(currentType, OFFER_TYPE_UPDATE, "current offer type now OFFER_TYPE_UPDATE"); + + (uint8 nextType, bytes memory nextData) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_NEXT); + assertEq(nextType, OFFER_TYPE_NONE, "no pending offer after update"); + assertEq(nextData.length, 0, "pending data empty after update"); + + // Old RCA hash is no longer referenced; since getAgreementOfferAt only resolves via version + // indices, confirm indirectly that no version maps to rcaHash. + bytes32 currentHash = _recurringCollector.getAgreementDetails(agreementId, VERSION_CURRENT).versionHash; + assertTrue(currentHash != rcaHash, "no version maps to old rcaHash"); + } + + /// @notice Offering a different pending update replaces the prior pending RCAU — the replaced + /// entry is deleted from storage. + function test_OfferUpdate_ReplacesPriorPending_DeletesReplaced() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcauA = _makeRcau(agreementId, rca, 1); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcauA), 0); + bytes32 rcauAHash = _recurringCollector.hashRCAU(rcauA); + + // Second update with different terms (different maxInitialTokens) replaces the pending RCAU + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcauB = rcauA; + rcauB.maxInitialTokens = rcauA.maxInitialTokens + 1; + bytes32 rcauBHash = _recurringCollector.hashRCAU(rcauB); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcauB), 0); + + IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); + assertEq(agreement.pendingTermsHash, rcauBHash, "pending now points to rcauB"); + + // Replaced rcauA entry no longer referenced by any version — VERSION_NEXT is now rcauB. + bytes32 pendingHash = _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash; + assertEq(pendingHash, rcauBHash, "VERSION_NEXT resolves to rcauB"); + assertTrue(pendingHash != rcauAHash, "old rcauA no longer reachable via version index"); + } + + // ────────────────────────────────────────────────────────────────────── + // Pre-acceptance cancel cascades deletion of any pending RCAU + // ────────────────────────────────────────────────────────────────────── + + /// @notice Pre-acceptance cancel of the RCA under SCOPE_PENDING deletes BOTH the RCA offer + /// and any pending RCAU offer. After cascade, both slots are empty. + function test_CancelPreAcceptanceRca_CascadesDeleteRcau() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory rcaDetails = _recurringCollector.offer( + OFFER_TYPE_NEW, + abi.encode(rca), + 0 + ); + bytes16 agreementId = rcaDetails.agreementId; + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau(agreementId, rca, 1); + bytes32 rcauHash = _recurringCollector.hashRCAU(rcau); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + + // Sanity: both slots populated before the cancel + (uint8 preCurrentType, ) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_CURRENT); + (uint8 preNextType, ) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_NEXT); + assertEq(preCurrentType, OFFER_TYPE_NEW, "RCA stored before cancel"); + assertEq(preNextType, OFFER_TYPE_UPDATE, "RCAU stored before cancel"); + + // Cancel the pre-acceptance RCA — one OfferCancelled event, both slots cleared + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferCancelled(address(approver), agreementId, rcaHash); + vm.prank(address(approver)); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_PENDING); + + IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); + assertEq(agreement.activeTermsHash, bytes32(0), "activeTermsHash cleared"); + assertEq(agreement.pendingTermsHash, bytes32(0), "pendingTermsHash cascade-cleared"); + + (uint8 currentType, bytes memory currentData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(currentType, OFFER_TYPE_NONE, "RCA offer deleted"); + assertEq(currentData.length, 0, "RCA data empty"); + + (uint8 nextType, bytes memory nextData) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_NEXT); + assertEq(nextType, OFFER_TYPE_NONE, "RCAU offer cascade-deleted"); + assertEq(nextData.length, 0, "RCAU data empty"); + + // The original rcauHash stored-offer entry is no longer referenced. No version hash + // resolves to it — confirmed above — so the cleanup is complete for view purposes. + rcauHash; // silence unused warning; kept for clarity in the narrative + } + + /// @notice After a pre-acceptance cascade delete, a follow-up cancel targeting the orphan RCAU + /// hash must NOT revert: _requirePayerIfExists short-circuits because agreement.payer was + /// zeroed when activeTermsHash was cleared — but the agreement struct still exists. The cancel + /// is therefore a no-op targeting already-empty state. + function test_CancelPreAcceptanceRca_SubsequentRcauCancel_DoesNotRevert() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory rcaDetails = _recurringCollector.offer( + OFFER_TYPE_NEW, + abi.encode(rca), + 0 + ); + bytes16 agreementId = rcaDetails.agreementId; + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau(agreementId, rca, 1); + bytes32 rcauHash = _recurringCollector.hashRCAU(rcau); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + + // Cancel the RCA — cascades the RCAU + vm.prank(address(approver)); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_PENDING); + + // The approver can still cancel(rcauHash) without reverting — the payer slot on the + // agreement is still set (clearing is by *termsHash*, not payer field), so the call + // enters the pending-hash branch, observes pendingTermsHash == 0, and exits silently. + vm.prank(address(approver)); + _recurringCollector.cancel(agreementId, rcauHash, SCOPE_PENDING); + } + + /// @notice Pre-acceptance cancel with no pending RCAU still deletes the RCA offer and + /// emits a single OfferCancelled. + function test_CancelPreAcceptanceRca_NoPending_OnlyDeletesRca() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory details = _recurringCollector.offer( + OFFER_TYPE_NEW, + abi.encode(rca), + 0 + ); + bytes16 agreementId = details.agreementId; + + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferCancelled(address(approver), agreementId, rcaHash); + vm.prank(address(approver)); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_PENDING); + + (uint8 currentType, ) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_CURRENT); + assertEq(currentType, OFFER_TYPE_NONE, "RCA offer deleted"); + assertEq(_recurringCollector.getAgreement(agreementId).activeTermsHash, bytes32(0), "activeTermsHash cleared"); + } + + // ────────────────────────────────────────────────────────────────────── + // OFFER_TYPE_NONE sentinel + // ────────────────────────────────────────────────────────────────────── + + /// @notice The offer-type sentinel values: OFFER_TYPE_NONE must be 0 so callers can distinguish + /// "no offer stored" (default mapping value) from OFFER_TYPE_NEW / OFFER_TYPE_UPDATE. + function test_OfferTypeConstants_NoneIsZero_OthersNonZero() public pure { + assertEq(OFFER_TYPE_NONE, uint8(0), "OFFER_TYPE_NONE must be 0"); + assertTrue(OFFER_TYPE_NEW != OFFER_TYPE_NONE, "OFFER_TYPE_NEW distinct from NONE"); + assertTrue(OFFER_TYPE_UPDATE != OFFER_TYPE_NONE, "OFFER_TYPE_UPDATE distinct from NONE"); + assertTrue(OFFER_TYPE_NEW != OFFER_TYPE_UPDATE, "NEW and UPDATE distinct"); + } + + /// @notice offer() rejects OFFER_TYPE_NONE as an offer type — the sentinel cannot be used to + /// create a stored offer, so getAgreementOfferAt's OFFER_TYPE_NONE return unambiguously means + /// "no offer stored". + function test_Offer_Revert_WhenOfferTypeIsNone() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes memory data = abi.encode(rca); + + vm.expectRevert( + abi.encodeWithSelector(IRecurringCollector.RecurringCollectorInvalidCollectData.selector, data) + ); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NONE, data, 0); + } + + /* solhint-enable graph/func-name-mixedcase */ +} diff --git a/packages/interfaces/contracts/horizon/IAgreementCollector.sol b/packages/interfaces/contracts/horizon/IAgreementCollector.sol index ee8bad086..ee3a5bd80 100644 --- a/packages/interfaces/contracts/horizon/IAgreementCollector.sol +++ b/packages/interfaces/contracts/horizon/IAgreementCollector.sol @@ -44,10 +44,13 @@ uint16 constant AUTO_UPDATED = 512; // -- Offer type constants -- +/// @dev No stored offer — sentinel returned by {IAgreementCollector.getAgreementOfferAt} +/// when the requested version has no offer data. +uint8 constant OFFER_TYPE_NONE = 0; /// @dev Create a new agreement -uint8 constant OFFER_TYPE_NEW = 0; +uint8 constant OFFER_TYPE_NEW = 1; /// @dev Update an existing agreement -uint8 constant OFFER_TYPE_UPDATE = 1; +uint8 constant OFFER_TYPE_UPDATE = 2; // -- Cancel scope constants -- @@ -154,8 +157,8 @@ interface IAgreementCollector is IPaymentsCollector { * original struct. Callers can decode and hash to verify the stored version hash. * @param agreementId The ID of the agreement * @param index The zero-based version index - * @return offerType OFFER_TYPE_NEW (0) or OFFER_TYPE_UPDATE (1) - * @return offerData ABI-encoded original offer struct + * @return offerType OFFER_TYPE_NEW, OFFER_TYPE_UPDATE, or OFFER_TYPE_NONE when no offer is stored + * @return offerData ABI-encoded original offer struct, or empty when offerType is OFFER_TYPE_NONE */ function getAgreementOfferAt( bytes16 agreementId, diff --git a/packages/issuance/audits/PR1301/TRST-R-5.md b/packages/issuance/audits/PR1301/TRST-R-5.md index f3d5ac72e..0db3ff607 100644 --- a/packages/issuance/audits/PR1301/TRST-R-5.md +++ b/packages/issuance/audits/PR1301/TRST-R-5.md @@ -5,3 +5,7 @@ ## Description `getAgreementOfferAt()` returns `(uint8 offerType, bytes memory offerData)`. The offer type constant `OFFER_TYPE_NEW` is defined as 0, which is also the default Solidity return value when no stored offer exists for the given `agreementId` and index. A caller receiving `offerType == 0` cannot distinguish between a stored new-type offer existing and no offer existing. Consider redefining offer type constants with 1-indexed values, or adding an explicit `bool found` return parameter. + +--- + +Using non-zero offer type constants as suggested: `OFFER_TYPE_NEW = 1`, `OFFER_TYPE_UPDATE = 2`. The zero value is declared explicitly as `OFFER_TYPE_NONE` so the "no stored offer" sentinel is part of the interface rather than a NatSpec-only convention. From 36217930d2a79e3e0df68e992ffaad83fe4d26c0 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 18:46:34 +0000 Subject: [PATCH 10/47] refactor(interfaces): drop unused state and offer-option flags, tighten flag NatSpec (TRST-R-11) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remove AUTO_UPDATE, AUTO_UPDATED, and BY_DATA_SERVICE from IAgreementCollector: none had an implementation path or in-tree consumer (RecurringCollector's cancel vocabulary is Payer / ServiceProvider only; there is no auto-update feature). Remaining flags' NatSpec tightened to describe the semantics they now carry after R-12. Also drop WITH_NOTICE and IF_NOT_ACCEPTED: declared on the unsigned offer path but never referenced — offer() ignores its options parameter. Parameter NatSpec now describes the bitmask as reserved for implementation-specific use. --- .../contracts/horizon/IAgreementCollector.sol | 36 +++++-------------- packages/issuance/audits/PR1301/TRST-R-11.md | 6 ++++ 2 files changed, 15 insertions(+), 27 deletions(-) diff --git a/packages/interfaces/contracts/horizon/IAgreementCollector.sol b/packages/interfaces/contracts/horizon/IAgreementCollector.sol index ee3a5bd80..0d83cf904 100644 --- a/packages/interfaces/contracts/horizon/IAgreementCollector.sol +++ b/packages/interfaces/contracts/horizon/IAgreementCollector.sol @@ -4,26 +4,24 @@ pragma solidity ^0.8.22; import { IPaymentsCollector } from "./IPaymentsCollector.sol"; // -- Agreement state flags -- -// REGISTERED, ACCEPTED are monotonic (once set, never cleared). -// All other flags are clearable — cleared when pending terms are accepted. /// @dev Offer exists in storage uint16 constant REGISTERED = 1; /// @dev Provider accepted terms uint16 constant ACCEPTED = 2; -/// @dev collectableUntil has been reduced, collection capped (clearable) +/// @dev The agreement's collection window has been truncated (e.g. by cancellation). +/// Paired with a BY_* flag identifying the origin. uint16 constant NOTICE_GIVEN = 4; -/// @dev Nothing to collect in current state (clearable — cleared on new terms promotion) +/// @dev Nothing to collect under this version's terms (per-version: scoped to active claim +/// for VERSION_CURRENT, pending claim for VERSION_NEXT). uint16 constant SETTLED = 8; -// -- Who-initiated flags (clearable, meaningful when NOTICE_GIVEN is set) -- +// -- Who-initiated flags (meaningful when NOTICE_GIVEN is set) -- -/// @dev Notice given by payer +/// @dev NOTICE_GIVEN originated from the payer. uint16 constant BY_PAYER = 16; -/// @dev Notice given by provider (forfeit — immediate SETTLED) +/// @dev NOTICE_GIVEN originated from the service provider. uint16 constant BY_PROVIDER = 32; -/// @dev Notice given by data service -uint16 constant BY_DATA_SERVICE = 64; // -- Update-origin flag -- @@ -32,16 +30,6 @@ uint16 constant BY_DATA_SERVICE = 64; /// ORed into returned state by getAgreementDetails for pending versions (index 1). uint16 constant UPDATE = 128; -// -- Togglable option flags (set via accept options parameter) -- - -/// @dev Provider opts in to automatic update on final collect -uint16 constant AUTO_UPDATE = 256; - -// -- Lifecycle flags (set by the collector during auto-update, clearable) -- - -/// @dev Active terms were promoted via auto-update (not explicit provider accept) -uint16 constant AUTO_UPDATED = 512; - // -- Offer type constants -- /// @dev No stored offer — sentinel returned by {IAgreementCollector.getAgreementOfferAt} @@ -59,13 +47,6 @@ uint8 constant SCOPE_ACTIVE = 1; /// @dev Cancel targets pending offers uint8 constant SCOPE_PENDING = 2; -// -- Offer option constants (for unsigned offer path) -- - -/// @dev Reduce collectableUntil and set NOTICE_GIVEN | BY_PAYER on the agreement -uint16 constant WITH_NOTICE = 1; -/// @dev Revert if the targeted version has already been accepted -uint16 constant IF_NOT_ACCEPTED = 2; - /** * @title Base interface for agreement-based payment collectors * @notice Base interface for agreement-based payment collectors. @@ -115,7 +96,8 @@ interface IAgreementCollector is IPaymentsCollector { * @notice Offer a new agreement or update an existing one. * @param offerType The type of offer (OFFER_TYPE_NEW or OFFER_TYPE_UPDATE) * @param data ABI-encoded offer data - * @param options Bitmask of offer options + * @param options Bitmask reserved for implementation-specific options; pass 0 when none apply. + * No flags are defined at the interface level. * @return Agreement details including participants and version hash */ function offer(uint8 offerType, bytes calldata data, uint16 options) external returns (AgreementDetails memory); diff --git a/packages/issuance/audits/PR1301/TRST-R-11.md b/packages/issuance/audits/PR1301/TRST-R-11.md index 014f20625..0bc206182 100644 --- a/packages/issuance/audits/PR1301/TRST-R-11.md +++ b/packages/issuance/audits/PR1301/TRST-R-11.md @@ -5,3 +5,9 @@ ## Description `IAgreementCollector` defines state flag constants that are not currently used in the RecurringCollector implementation, including `NOTICE_GIVEN`, `SETTLED`, `BY_PAYER`, `BY_PROVIDER`, `BY_DATA_SERVICE`, `AUTO_UPDATE`, and `AUTO_UPDATED`. Unused public interface constants are a source of confusion for integrators, who may code against documented semantics that the implementation does not honor. Either remove the unused flags from the interface, or implement the behaviors they describe in the collector. + +--- + +Removed unused flags: `AUTO_UPDATE`, `AUTO_UPDATED`, `BY_DATA_SERVICE`, `WITH_NOTICE` and `IF_NOT_ACCEPTED` are dropped from the interface. + +NatSpec updated for remaining flags with new semantics. From f32e55024279ea2350b19c9fa21e6926721fddc9 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 17:26:20 +0000 Subject: [PATCH 11/47] docs(audit): acknowledge trust-boundary correction in TRST-H-4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The v02 mitigation review corrected the security-boundary framing in our fix comment: an EIP-7702 EOA can toggle code on and off across calls, so "an EOA cannot pass the interface check" is not a durable guarantee. The correct boundary is that a provider opting into CONDITION_ELIGIBILITY_CHECK is trusting the payer contract. Recorded the acknowledgement in the team response — no code change required, since the gate already depends on the provider's opt-in. --- packages/issuance/audits/PR1301/TRST-H-4.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/issuance/audits/PR1301/TRST-H-4.md b/packages/issuance/audits/PR1301/TRST-H-4.md index dda0b4f17..d9fa550bc 100644 --- a/packages/issuance/audits/PR1301/TRST-H-4.md +++ b/packages/issuance/audits/PR1301/TRST-H-4.md @@ -29,4 +29,4 @@ Fixed under the assumption that a provider setting `CONDITION_ELIGIBILITY_CHECK` --- -Eligibility checks are now opt-in via the `CONDITION_ELIGIBILITY_CHECK` flag, set explicitly in the agreement terms. Providers agree to eligibility gating by accepting an agreement that includes this condition. When the flag is set, the payer must pass an ERC-165 `supportsInterface` check for `IProviderEligibility` at offer time. An EOA cannot pass this check, so an EOA cannot create an agreement with eligibility gating enabled. +Agreed; the security boundary is that a provider opts into `CONDITION_ELIGIBILITY_CHECK` to trust the payer contract. From d2fd36444840d25f48021fa119893d7ffa7f689d Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 17:51:35 +0000 Subject: [PATCH 12/47] docs(audit): acknowledge reclaim-reason change in TRST-R-13 STALE_POI is the correct reason for the resize-based stale-allocation path (allocation stays open as stakeless, not closed). The previous CLOSE_ALLOCATION behavior never shipped to production, so there is no operator configuration to migrate. --- packages/issuance/audits/PR1301/TRST-R-13.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/issuance/audits/PR1301/TRST-R-13.md b/packages/issuance/audits/PR1301/TRST-R-13.md index 6b9b090c0..cefb73ec0 100644 --- a/packages/issuance/audits/PR1301/TRST-R-13.md +++ b/packages/issuance/audits/PR1301/TRST-R-13.md @@ -5,3 +5,7 @@ ## Description Before the PR's refactor, `forceCloseStaleAllocation()` closed the allocation via `_closeAllocation()` and caused a reclaim with reason `CLOSE_ALLOCATION`. Post refactor, the force close path goes through `_resizeAllocation(allocationId, 0, ...)`, which triggers a reclaim with reason `STALE_POI` instead. The reclaim still occurs, but the reason code exposed to reclaim address configuration changes. Document this change so that operators are able to prepare accordingly and have funding paths line up with intention. + +--- + +Noted. The previous `CLOSE_ALLOCATION` reclaim behavior for this path has not shipped to production, so there is no live operator configuration to migrate. `STALE_POI` is the correct reason for the post-refactor semantics (the allocation is stale; it stays open as stakeless rather than closing). From b61d4415f92d5557883aa2d3fd4e1c0f2187f6de Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 17:55:40 +0000 Subject: [PATCH 13/47] docs(ram): document collector replay-protection assumption (TRST-R-4) RAM trusts collectors to enforce agreement uniqueness and state transitions. Future collectors must implement their own replay protection on acceptance. --- packages/issuance/audits/PR1301/TRST-R-4.md | 4 ++++ .../contracts/agreement/RecurringAgreementManager.sol | 3 +++ 2 files changed, 7 insertions(+) diff --git a/packages/issuance/audits/PR1301/TRST-R-4.md b/packages/issuance/audits/PR1301/TRST-R-4.md index 6e40e6682..7947adbdc 100644 --- a/packages/issuance/audits/PR1301/TRST-R-4.md +++ b/packages/issuance/audits/PR1301/TRST-R-4.md @@ -5,3 +5,7 @@ ## Description The `approveAgreement()` view checks if the agreement hash is valid, however it offers no replay protection for repeated agreement approvals. This attack vector is only stopped at the RecurringCollector as it checks the agreement does not exist and maintains unidirectional transitions from the agreement Accepted state. For future collectors this may not be the case, necessitating clear documentation of the assumption. + +--- + +Documented in the `RecurringAgreementManager` contract header (collector-trust section): collectors own agreement uniqueness, replay protection, and state transitions; RAM does not re-check them. diff --git a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol index 6edf82117..141d58dcb 100644 --- a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol +++ b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol @@ -57,6 +57,9 @@ import { ReentrancyGuardTransient } from "@openzeppelin/contracts/utils/Reentran * {forceRemoveAgreement} as an operator escape hatch. Once tracked, reconciliation proceeds * even if COLLECTOR_ROLE is later revoked, ensuring orderly settlement. * + * Collectors own agreement uniqueness, replay protection, and state transitions; this + * contract does not re-check them. + * * {offerAgreement} and {cancelAgreement} forward to the collector then reconcile locally. * The collector does not callback to `msg.sender`, so these methods own the full call * sequence and hold the reentrancy lock for the entire operation. From 02710154df5d7221e7dd2c51bb1ebaa858c7faf2 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 17:55:59 +0000 Subject: [PATCH 14/47] docs(ram): document non-retroactive role-change semantics (TRST-R-10) Revoking COLLECTOR_ROLE or DATA_SERVICE_ROLE does not invalidate tracked agreements; reconciliation proceeds to orderly settlement. Role checks gate only new offerAgreement calls and discovery inside _reconcileAgreement. --- packages/issuance/audits/PR1301/TRST-R-10.md | 4 ++++ .../contracts/agreement/RecurringAgreementManager.sol | 8 ++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/packages/issuance/audits/PR1301/TRST-R-10.md b/packages/issuance/audits/PR1301/TRST-R-10.md index 219698e5f..e1d200ba7 100644 --- a/packages/issuance/audits/PR1301/TRST-R-10.md +++ b/packages/issuance/audits/PR1301/TRST-R-10.md @@ -5,3 +5,7 @@ ## Description Changes to `DATA_SERVICE_ROLE` and `COLLECTOR_ROLE` on the RecurringAgreementManager do not affect agreements that have already been offered or accepted through the previously authorized addresses. This is by design (revoking a role should not invalidate settled obligations), but the behavior is not documented. Record this invariant in the RAM documentation so that operators and integrators understand the effect of role changes. + +--- + +Documented in the `RecurringAgreementManager` contract header: role changes are not retroactive — revoking `COLLECTOR_ROLE` or `DATA_SERVICE_ROLE` does not invalidate tracked agreements, which continue to reconcile to orderly settlement. Role checks gate only new `offerAgreement` calls and discovery inside `_reconcileAgreement`. diff --git a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol index 141d58dcb..ab0dbd8f0 100644 --- a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol +++ b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol @@ -54,12 +54,16 @@ import { ReentrancyGuardTransient } from "@openzeppelin/contracts/utils/Reentran * and {cancelAgreement} call collectors directly. Discovery calls `getAgreementDetails`; * reconciliation calls `getMaxNextClaim` — these return values drive escrow accounting. * A broken or malicious collector can cause reconciliation to revert; use - * {forceRemoveAgreement} as an operator escape hatch. Once tracked, reconciliation proceeds - * even if COLLECTOR_ROLE is later revoked, ensuring orderly settlement. + * {forceRemoveAgreement} as an operator escape hatch. * * Collectors own agreement uniqueness, replay protection, and state transitions; this * contract does not re-check them. * + * Role changes are not retroactive. Revoking COLLECTOR_ROLE or DATA_SERVICE_ROLE does not + * invalidate agreements that were offered or accepted while the roles were held. Once + * tracked, reconciliation proceeds to orderly settlement. Role changes only gate *new* + * {offerAgreement} calls and discovery inside {_reconcileAgreement}. + * * {offerAgreement} and {cancelAgreement} forward to the collector then reconcile locally. * The collector does not callback to `msg.sender`, so these methods own the full call * sequence and hold the reentrancy lock for the entire operation. From 1ee49f232f7120c6788c0067488dc65ffadc7570 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 17:56:16 +0000 Subject: [PATCH 15/47] docs(ram): align pause-escalation prose with whenNotPaused scope (TRST-R-8) Escalation ladder item 3 now refers to the existing cross-contract note so the prose matches the whenNotPaused scope on beforeCollection and afterCollection. --- packages/issuance/audits/PR1301/TRST-R-8.md | 4 ++++ .../contracts/agreement/RecurringAgreementManager.sol | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/packages/issuance/audits/PR1301/TRST-R-8.md b/packages/issuance/audits/PR1301/TRST-R-8.md index dd2ea9619..821e84823 100644 --- a/packages/issuance/audits/PR1301/TRST-R-8.md +++ b/packages/issuance/audits/PR1301/TRST-R-8.md @@ -5,3 +5,7 @@ ## Description The RecurringAgreementManager documentation header states that pausing the contract "stops all permissionless escrow management". In practice, the `whenNotPaused` modifier also applies to `beforeCollection()` and `afterCollection()`, so pause also halts the callback path used during `collect()`. Update the documentation to reflect that callbacks are affected, or narrow the modifier application so that behavior matches the prose. + +--- + +Updated in the `RecurringAgreementManager` contract header: pause is described as blocking permissionless state changes "including collection callbacks and reconciliation", with a cross-reference to the existing cross-contract note describing the resulting escrow-accounting drift. diff --git a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol index ab0dbd8f0..a5f3c40b0 100644 --- a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol +++ b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol @@ -84,7 +84,8 @@ import { ReentrancyGuardTransient } from "@openzeppelin/contracts/utils/Reentran * Escalation ladder (targeted → full stop): * 1. {emergencyRevokeRole} — disable a specific actor (operator, collector, guardian) * 2. {emergencyClearEligibilityOracle} — fail-open if oracle blocks collections - * 3. Pause this contract — stops all permissionless escrow management + * 3. Pause this contract — blocks permissionless state changes, including collection + * callbacks and reconciliation (see cross-contract note above) * 4. Pause RecurringCollector — stops all collections and state changes * 5. Pause both — full halt * From 9396dbd12250ea31b5644e41c2dae7d3570fb3fe Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 17:56:22 +0000 Subject: [PATCH 16/47] docs(collector): note self-authorization auth-check obligation (TRST-R-9) RC overrides _isAuthorized to return true when signer == address(this), so RC itself must perform the appropriate authorization check before any external call it initiates. --- .../contracts/payments/collectors/RecurringCollector.sol | 5 +++++ packages/horizon/test/unit/utilities/Authorizable.t.sol | 6 +++++- packages/issuance/audits/PR1301/TRST-R-9.md | 4 ++++ 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index fa404a14a..52ea3aaa9 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -34,6 +34,11 @@ import { PPMMath } from "../../libraries/PPMMath.sol"; * @author Edge & Node * @dev Implements the {IRecurringCollector} interface. * @notice A payments collector contract that can be used to collect payments using a RCA (Recurring Collection Agreement). + * + * @custom:security Self-authorization: RC overrides {_isAuthorized} to return true whenever + * `signer == address(this)`, so RC itself must perform the appropriate authorization check + * before any external call. + * * @custom:security-contact Please email security+contracts@thegraph.com if you find any * bugs. We may have an active bug bounty program. */ diff --git a/packages/horizon/test/unit/utilities/Authorizable.t.sol b/packages/horizon/test/unit/utilities/Authorizable.t.sol index 18ed8df54..c9f47fcba 100644 --- a/packages/horizon/test/unit/utilities/Authorizable.t.sol +++ b/packages/horizon/test/unit/utilities/Authorizable.t.sol @@ -326,7 +326,11 @@ contract AuthorizableTest is Test, Bounder { authorizable.revokeAuthorizedSigner(signer); } - function test_IsAuthorized_Revert_WhenZero(address signer) public view { + function test_IsAuthorized_Revert_WhenZero(address signer) public { + // Subclasses (e.g. RecurringCollector) may treat specific addresses — notably + // the contract itself — as authorized regardless of the authorizer, so rely on + // assumeValidFuzzAddress to exclude those. + assumeValidFuzzAddress(signer); authHelper.assertNotAuthorized(address(0), signer); } } diff --git a/packages/issuance/audits/PR1301/TRST-R-9.md b/packages/issuance/audits/PR1301/TRST-R-9.md index b78e271fe..efa601a43 100644 --- a/packages/issuance/audits/PR1301/TRST-R-9.md +++ b/packages/issuance/audits/PR1301/TRST-R-9.md @@ -5,3 +5,7 @@ ## Description The `_isAuthorized(address authorizer, address signer)` override in RecurringCollector returns true whenever `signer == address(this)`, regardless of `authorizer`. This enables RecurringCollector to call `dataService.cancelIndexingAgreementByPayer()` on the payer's behalf. The semantics are safe in the current integration with SubgraphService, but they widen the trust surface: any future consumer that relies on `RecurringCollector.isAuthorized()` for access control will grant access when the signer is the collector itself. Consider tightening the override to scope trust to specific callers, or explicitly document the integration contract so it is not misapplied by future consumers. + +--- + +Added a `@custom:security` note at the `RecurringCollector` contract header: self-authorization requires the collector itself to perform the appropriate authorization check before any external call. From 1e5a6b33a1ca84c3c1c9784afb454efb301e5ad7 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Tue, 21 Apr 2026 14:09:24 +0000 Subject: [PATCH 17/47] fix(subgraph-service): validate update terms against RCAU rate, not stale agreement rate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit IndexingAgreement.update() validated new indexing terms against wrapper.collectorAgreement.maxOngoingTokensPerSecond (the current agreement's rate) instead of rcau.maxOngoingTokensPerSecond (the update's rate). If the RCAU decreased the rate, indexing terms exceeding the new cap would be accepted. accept() already validates against rca.maxOngoingTokensPerSecond — this makes update() consistent. --- .../contracts/libraries/IndexingAgreement.sol | 2 +- .../subgraphService/indexing-agreement/shared.t.sol | 10 +++------- .../subgraphService/indexing-agreement/update.t.sol | 6 +++--- 3 files changed, 7 insertions(+), 11 deletions(-) diff --git a/packages/subgraph-service/contracts/libraries/IndexingAgreement.sol b/packages/subgraph-service/contracts/libraries/IndexingAgreement.sol index 1aa2b9677..347eed37e 100644 --- a/packages/subgraph-service/contracts/libraries/IndexingAgreement.sol +++ b/packages/subgraph-service/contracts/libraries/IndexingAgreement.sol @@ -396,7 +396,7 @@ library IndexingAgreement { metadata.version == IIndexingAgreement.IndexingAgreementVersion.V1, IndexingAgreementInvalidVersion(metadata.version) ); - _setTermsV1(self, rcau.agreementId, metadata.terms, wrapper.collectorAgreement.maxOngoingTokensPerSecond); + _setTermsV1(self, rcau.agreementId, metadata.terms, rcau.maxOngoingTokensPerSecond); emit IndexingAgreementUpdated({ indexer: wrapper.collectorAgreement.serviceProvider, diff --git a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/shared.t.sol b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/shared.t.sol index cd35f4aa0..c4d84d705 100644 --- a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/shared.t.sol +++ b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/shared.t.sol @@ -294,13 +294,14 @@ contract SubgraphServiceIndexingAgreementSharedTest is SubgraphServiceTest, Boun _rca.deadline, _rca.nonce ); + rcau = _recurringCollectorHelper.sensibleRCAU(rcau); rcau.metadata = _encodeUpdateIndexingAgreementMetadataV1( _newUpdateIndexingAgreementMetadataV1( - bound(_ctx.ctxInternal.seed.termsV1.tokensPerSecond, 0, _rca.maxOngoingTokensPerSecond), + bound(_ctx.ctxInternal.seed.termsV1.tokensPerSecond, 0, rcau.maxOngoingTokensPerSecond), _ctx.ctxInternal.seed.termsV1.tokensPerEntityPerSecond ) ); - return _recurringCollectorHelper.sensibleRCAU(rcau); + return rcau; } function _requireIndexer(Context storage _ctx, address _indexer) internal view returns (IndexerState memory) { @@ -448,10 +449,5 @@ contract SubgraphServiceIndexingAgreementSharedTest is SubgraphServiceTest, Boun assertEq(_expected.dataService, _actual.collectorAgreement.dataService); assertEq(_expected.payer, _actual.collectorAgreement.payer); assertEq(_expected.serviceProvider, _actual.collectorAgreement.serviceProvider); - assertEq(_expected.endsAt, _actual.collectorAgreement.endsAt); - assertEq(_expected.maxInitialTokens, _actual.collectorAgreement.maxInitialTokens); - assertEq(_expected.maxOngoingTokensPerSecond, _actual.collectorAgreement.maxOngoingTokensPerSecond); - assertEq(_expected.minSecondsPerCollection, _actual.collectorAgreement.minSecondsPerCollection); - assertEq(_expected.maxSecondsPerCollection, _actual.collectorAgreement.maxSecondsPerCollection); } } diff --git a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/update.t.sol b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/update.t.sol index 321c26df0..9f1abc180 100644 --- a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/update.t.sol +++ b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/update.t.sol @@ -166,10 +166,10 @@ contract SubgraphServiceIndexingAgreementUpgradeTest is SubgraphServiceIndexingA indexerState ); - // Create update with tokensPerSecond exceeding the RCA's maxOngoingTokensPerSecond - uint256 excessiveTokensPerSecond = acceptedRca.maxOngoingTokensPerSecond + 1; + // Create update with tokensPerSecond exceeding the RCAU's maxOngoingTokensPerSecond IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _generateAcceptableRecurringCollectionAgreementUpdate(ctx, acceptedRca); + uint256 excessiveTokensPerSecond = rcau.maxOngoingTokensPerSecond + 1; rcau.metadata = _encodeUpdateIndexingAgreementMetadataV1( IndexingAgreement.UpdateIndexingAgreementMetadata({ version: IIndexingAgreement.IndexingAgreementVersion.V1, @@ -190,7 +190,7 @@ contract SubgraphServiceIndexingAgreementUpgradeTest is SubgraphServiceIndexingA bytes memory expectedErr = abi.encodeWithSelector( IndexingAgreement.IndexingAgreementInvalidTerms.selector, excessiveTokensPerSecond, - acceptedRca.maxOngoingTokensPerSecond + rcau.maxOngoingTokensPerSecond ); vm.expectRevert(expectedErr); resetPrank(indexerState.addr); From 8be1aa0c8cbc02b7785d35c7f69bb5b8021fc01d Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Wed, 22 Apr 2026 08:03:24 +0000 Subject: [PATCH 18/47] refactor(collector): preparatory helpers, signatures, and version constants Assorted small refactors and interface tweaks that prepare for follow-on changes without changing behavior: - extract _rcaIdAndHash helper (agreement ID + RCA hash used together) - default _getMaxNextClaimScoped scope to both (active | pending) on 0 - drop redundant isSigned param from _requireAuthorization - drop redundant timestamp from agreement lifecycle events - single-line AgreementCanceled emit - add VERSION_CURRENT/VERSION_NEXT constants and clarify state flag NatSpec in IAgreementCollector --- .../collectors/RecurringCollector.sol | 98 +++++++++---------- .../recurring-collector/acceptUnsigned.t.sol | 1 - .../recurring-collector/mixedPath.t.sol | 2 - .../payments/recurring-collector/shared.t.sol | 2 - .../payments/recurring-collector/update.t.sol | 1 - .../recurring-collector/updateUnsigned.t.sol | 1 - .../contracts/horizon/IAgreementCollector.sol | 66 ++++++++++--- .../contracts/horizon/IRecurringCollector.sol | 6 -- .../indexing-agreement/integration.t.sol | 1 - 9 files changed, 95 insertions(+), 83 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 52ea3aaa9..6360fc7d7 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -210,7 +210,7 @@ contract RecurringCollector is function accept( RecurringCollectionAgreement calldata rca, bytes calldata signature - ) external whenNotPaused returns (bytes16) { + ) external whenNotPaused returns (bytes16 agreementId) { /* solhint-disable gas-strict-inequalities */ require( rca.deadline >= block.timestamp, @@ -218,17 +218,10 @@ contract RecurringCollector is ); /* solhint-enable gas-strict-inequalities */ - bool isSigned = 0 < signature.length; - bytes32 rcaHash = _hashRCA(rca); - bytes16 agreementId = _generateAgreementId( - rca.payer, - rca.dataService, - rca.serviceProvider, - rca.deadline, - rca.nonce - ); + bytes32 rcaHash; + (agreementId, rcaHash) = _rcaIdAndHash(rca); - _requireAuthorization(rca.payer, rcaHash, signature, isSigned, agreementId, OFFER_TYPE_NEW); + _requireAuthorization(rca.payer, rcaHash, signature, agreementId, OFFER_TYPE_NEW); return _validateAndStoreAgreement(rca, agreementId, rcaHash); } @@ -285,7 +278,6 @@ contract RecurringCollector is agreement.payer, agreement.serviceProvider, agreementId, - agreement.acceptedAt, agreement.endsAt, agreement.maxInitialTokens, agreement.maxOngoingTokensPerSecond, @@ -320,14 +312,7 @@ contract RecurringCollector is agreement.state = AgreementState.CanceledByServiceProvider; } - emit AgreementCanceled( - agreement.dataService, - agreement.payer, - agreement.serviceProvider, - agreementId, - agreement.canceledAt, - by - ); + emit AgreementCanceled(agreement.dataService, agreement.payer, agreement.serviceProvider, agreementId, by); } /** @@ -347,10 +332,9 @@ contract RecurringCollector is ); /* solhint-enable gas-strict-inequalities */ - bool isSigned = 0 < signature.length; bytes32 rcauHash = _hashRCAU(rcau); - _requireAuthorization(agreement.payer, rcauHash, signature, isSigned, rcau.agreementId, OFFER_TYPE_UPDATE); + _requireAuthorization(agreement.payer, rcauHash, signature, rcau.agreementId, OFFER_TYPE_UPDATE); _validateAndStoreUpdate(agreement, rcau, rcauHash); } @@ -395,7 +379,7 @@ contract RecurringCollector is /// @inheritdoc IAgreementCollector function getMaxNextClaim(bytes16 agreementId) external view returns (uint256) { - return _getMaxNextClaimScoped(agreementId, SCOPE_ACTIVE | SCOPE_PENDING); + return _getMaxNextClaimScoped(agreementId, 0); } /// @inheritdoc IRecurringCollector @@ -430,28 +414,22 @@ contract RecurringCollector is function _offerNew(bytes calldata _data) private returns (AgreementDetails memory details) { RecurringCollectorStorage storage $ = _getStorage(); RecurringCollectionAgreement memory rca = abi.decode(_data, (RecurringCollectionAgreement)); + + (bytes16 agreementId, bytes32 rcaHash) = _rcaIdAndHash(rca); + require(msg.sender == rca.payer, RecurringCollectorUnauthorizedCaller(msg.sender, rca.payer)); _requirePayerToSupportEligibilityCheck(rca.payer, rca.conditions); - bytes16 agreementId = _generateAgreementId( - rca.payer, - rca.dataService, - rca.serviceProvider, - rca.deadline, - rca.nonce - ); - bytes32 offerHash = _hashRCA(rca); - - $.rcaOffers[agreementId] = StoredOffer({ offerHash: offerHash, data: _data }); + $.rcaOffers[agreementId] = StoredOffer({ offerHash: rcaHash, data: _data }); details.agreementId = agreementId; details.payer = rca.payer; details.dataService = rca.dataService; details.serviceProvider = rca.serviceProvider; - details.versionHash = offerHash; + details.versionHash = rcaHash; details.state = REGISTERED; - emit OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, offerHash); + emit OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, rcaHash); } /** @@ -974,8 +952,7 @@ contract RecurringCollector is * @notice Verifies authorization for an EIP712 hash using the given basis. * @param _payer The payer address (signer owner for ECDSA, contract for approval) * @param _hash The EIP712 typed data hash - * @param _signature The ECDSA signature (only used when basis is Signature) - * @param _isSigned True if ECDSA-signed, false if pre-approved via stored offer + * @param _signature The ECDSA signature bytes, zero length for no signature (pre-approved via stored offer) * @param _agreementId The agreement ID (used to look up stored offer when not signed) * @param _offerType OFFER_TYPE_NEW or OFFER_TYPE_UPDATE (selects which stored offer to check) */ @@ -983,13 +960,12 @@ contract RecurringCollector is address _payer, bytes32 _hash, bytes memory _signature, - bool _isSigned, bytes16 _agreementId, uint8 _offerType ) private view { RecurringCollectorStorage storage $ = _getStorage(); - if (_isSigned) + if (0 < _signature.length) require(_isAuthorized(_payer, ECDSA.recover(_hash, _signature)), RecurringCollectorInvalidSigner()); else // Check stored offer hash instead of callback @@ -1065,7 +1041,6 @@ contract RecurringCollector is _agreement.payer, _agreement.serviceProvider, _rcau.agreementId, - uint64(block.timestamp), _agreement.endsAt, _agreement.maxInitialTokens, _agreement.maxOngoingTokensPerSecond, @@ -1161,8 +1136,7 @@ contract RecurringCollector is // Only Accepted and CanceledByPayer are collectable if (_a.state != AgreementState.Accepted && _a.state != AgreementState.CanceledByPayer) return 0; - // Collection starts from last collection (or acceptance if never collected) - uint256 collectionStart = 0 < _a.lastCollectionAt ? _a.lastCollectionAt : _a.acceptedAt; + uint256 collectionStart = _agreementCollectionStartAt(_a); // Determine the latest possible collection end uint256 collectionEnd; @@ -1194,12 +1168,11 @@ contract RecurringCollector is * @return maxClaim The maximum tokens claimable under the requested scope */ function _getMaxNextClaimScoped(bytes16 agreementId, uint8 agreementScope) private view returns (uint256 maxClaim) { + if (agreementScope == 0) agreementScope = SCOPE_ACTIVE | SCOPE_PENDING; + RecurringCollectorStorage storage $ = _getStorage(); AgreementData storage _a = $.agreements[agreementId]; - uint256 maxActiveClaim = 0; - uint256 maxPendingClaim = 0; - if (agreementScope & SCOPE_ACTIVE != 0) { if (_a.state == AgreementState.NotAccepted) { // Not yet accepted — check stored RCA offer @@ -1207,19 +1180,16 @@ contract RecurringCollector is if (rcaOffer.offerHash != bytes32(0)) { RecurringCollectionAgreement memory rca = abi.decode(rcaOffer.data, (RecurringCollectionAgreement)); // Use block.timestamp as proxy for acceptedAt, deadline as expiry - if (block.timestamp < rca.deadline) { - maxActiveClaim = _maxClaim( + if (block.timestamp < rca.deadline) + maxClaim = _maxClaim( block.timestamp, rca.endsAt, rca.maxSecondsPerCollection, rca.maxOngoingTokensPerSecond, rca.maxInitialTokens ); - } } - } else { - maxActiveClaim = _getMaxNextClaim(_a); - } + } else maxClaim = _getMaxNextClaim(_a); } if (agreementScope & SCOPE_PENDING != 0) { @@ -1230,17 +1200,17 @@ contract RecurringCollector is (RecurringCollectionAgreementUpdate) ); // Ongoing claim: time-capped from now to rcau.endsAt - maxPendingClaim = _maxClaim( + uint256 maxPendingClaim = _maxClaim( block.timestamp, rcau.endsAt, rcau.maxSecondsPerCollection, rcau.maxOngoingTokensPerSecond, _a.lastCollectionAt == 0 ? rcau.maxInitialTokens : 0 ); + + if (maxClaim < maxPendingClaim) maxClaim = maxPendingClaim; } } - - maxClaim = maxActiveClaim < maxPendingClaim ? maxPendingClaim : maxActiveClaim; } /** @@ -1300,4 +1270,24 @@ contract RecurringCollector is ) private pure returns (bytes16) { return bytes16(keccak256(abi.encode(payer, dataService, serviceProvider, deadline, nonce))); } + + /** + * @notice Compute the agreement ID and EIP-712 hash for an RCA. + * @dev These are always used together when accepting or offering an RCA. + * @param _rca The Recurring Collection Agreement + * @return agreementId The deterministic agreement ID + * @return rcaHash The EIP-712 hash of the RCA + */ + function _rcaIdAndHash( + RecurringCollectionAgreement memory _rca + ) private view returns (bytes16 agreementId, bytes32 rcaHash) { + agreementId = _generateAgreementId( + _rca.payer, + _rca.dataService, + _rca.serviceProvider, + _rca.deadline, + _rca.nonce + ); + rcaHash = _hashRCA(_rca); + } } diff --git a/packages/horizon/test/unit/payments/recurring-collector/acceptUnsigned.t.sol b/packages/horizon/test/unit/payments/recurring-collector/acceptUnsigned.t.sol index 7feca10c9..fb26e3d99 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/acceptUnsigned.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/acceptUnsigned.t.sol @@ -60,7 +60,6 @@ contract RecurringCollectorAcceptUnsignedTest is RecurringCollectorSharedTest { rca.payer, rca.serviceProvider, expectedId, - uint64(block.timestamp), rca.endsAt, rca.maxInitialTokens, rca.maxOngoingTokensPerSecond, diff --git a/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol b/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol index f81aa0f04..120214815 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol @@ -64,7 +64,6 @@ contract RecurringCollectorMixedPathTest is RecurringCollectorSharedTest { address(approver), rca.serviceProvider, agreementId, - uint64(block.timestamp), rcau.endsAt, rcau.maxInitialTokens, rcau.maxOngoingTokensPerSecond, @@ -185,7 +184,6 @@ contract RecurringCollectorMixedPathTest is RecurringCollectorSharedTest { payer, rca.serviceProvider, agreementId, - uint64(block.timestamp), rcau.endsAt, rcau.maxInitialTokens, rcau.maxOngoingTokensPerSecond, diff --git a/packages/horizon/test/unit/payments/recurring-collector/shared.t.sol b/packages/horizon/test/unit/payments/recurring-collector/shared.t.sol index 3e88525e9..2d90e7142 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/shared.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/shared.t.sol @@ -120,7 +120,6 @@ contract RecurringCollectorSharedTest is Test, Bounder { _rca.payer, _rca.serviceProvider, expectedAgreementId, - uint64(block.timestamp), _rca.endsAt, _rca.maxInitialTokens, _rca.maxOngoingTokensPerSecond, @@ -165,7 +164,6 @@ contract RecurringCollectorSharedTest is Test, Bounder { _rca.payer, _rca.serviceProvider, _agreementId, - uint64(block.timestamp), _by ); vm.prank(_rca.dataService); diff --git a/packages/horizon/test/unit/payments/recurring-collector/update.t.sol b/packages/horizon/test/unit/payments/recurring-collector/update.t.sol index be84dde2f..57e8f0ad3 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/update.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/update.t.sol @@ -143,7 +143,6 @@ contract RecurringCollectorUpdateTest is RecurringCollectorSharedTest { acceptedRca.payer, acceptedRca.serviceProvider, rcau.agreementId, - uint64(block.timestamp), rcau.endsAt, rcau.maxInitialTokens, rcau.maxOngoingTokensPerSecond, diff --git a/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol b/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol index 45d05c55b..84eab9b75 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol @@ -87,7 +87,6 @@ contract RecurringCollectorUpdateUnsignedTest is RecurringCollectorSharedTest { rca.payer, rca.serviceProvider, agreementId, - uint64(block.timestamp), rcau.endsAt, rcau.maxInitialTokens, rcau.maxOngoingTokensPerSecond, diff --git a/packages/interfaces/contracts/horizon/IAgreementCollector.sol b/packages/interfaces/contracts/horizon/IAgreementCollector.sol index 0d83cf904..3e2d694fc 100644 --- a/packages/interfaces/contracts/horizon/IAgreementCollector.sol +++ b/packages/interfaces/contracts/horizon/IAgreementCollector.sol @@ -3,11 +3,13 @@ pragma solidity ^0.8.22; import { IPaymentsCollector } from "./IPaymentsCollector.sol"; -// -- Agreement state flags -- +// -- State flags for AgreementDetails -- +// Describe the queried version in context of its agreement; returned by both +// offer() and getAgreementDetails(). See AgreementDetails.state NatSpec. -/// @dev Offer exists in storage +/// @dev Offer exists in storage. Implied by ACCEPTED. uint16 constant REGISTERED = 1; -/// @dev Provider accepted terms +/// @dev Provider accepted terms. Always returned with REGISTERED set (accepted terms were stored). uint16 constant ACCEPTED = 2; /// @dev The agreement's collection window has been truncated (e.g. by cancellation). /// Paired with a BY_* flag identifying the origin. @@ -25,9 +27,8 @@ uint16 constant BY_PROVIDER = 32; // -- Update-origin flag -- -/// @dev Terms originated from an RCAU (update), not the initial RCA. -/// Set on agreement state when active terms come from an accepted or pre-acceptance update. -/// ORed into returned state by getAgreementDetails for pending versions (index 1). +/// @dev This version's terms originated from an update, not the initial agreement offer. +/// Describes the version's provenance; set wherever the update-derived version is returned. uint16 constant UPDATE = 128; // -- Offer type constants -- @@ -47,6 +48,19 @@ uint8 constant SCOPE_ACTIVE = 1; /// @dev Cancel targets pending offers uint8 constant SCOPE_PENDING = 2; +// -- Version indices (shared by getAgreementDetails and getAgreementOfferAt) -- +// +// Versions are enumerated starting at 0. Implementations may expose any number of versions; +// callers iterate until an empty result signals no further versions. These named aliases +// cover the two versions every collector is expected to expose. + +/// @dev The currently-active version: the accepted terms if the agreement is accepted, +/// otherwise the pre-acceptance offer (if any). Empty when no agreement or offer exists. +uint256 constant VERSION_CURRENT = 0; +/// @dev The next queued version: a pending update offer waiting to be accepted. +/// Empty when no queued update exists. +uint256 constant VERSION_NEXT = 1; + /** * @title Base interface for agreement-based payment collectors * @notice Base interface for agreement-based payment collectors. @@ -64,12 +78,21 @@ interface IAgreementCollector is IPaymentsCollector { /** * @notice Agreement details: participants, version hash, and state flags. * Returned by {offer} and {getAgreementDetails}. + * + * The `state` field describes the version identified by `versionHash` in the + * context of its agreement. Version-specific flags (REGISTERED, ACCEPTED, + * UPDATE, SETTLED) are set only when they apply to that specific version; + * agreement-wide flags (NOTICE_GIVEN, BY_PAYER, BY_PROVIDER) reflect the + * current agreement state. Identical semantics whether returned by {offer} + * or {getAgreementDetails} — the returned flags always describe the queried + * version. + * * @param agreementId The agreement ID * @param payer The address of the payer * @param dataService The address of the data service * @param serviceProvider The address of the service provider * @param versionHash The EIP-712 hash of the terms at the requested version - * @param state Agreement state flags, with UPDATE set when applicable + * @param state State flags describing the queried version in context of its agreement */ // solhint-disable-next-line gas-struct-packing struct AgreementDetails { @@ -94,6 +117,11 @@ interface IAgreementCollector is IPaymentsCollector { /** * @notice Offer a new agreement or update an existing one. + * @dev Returns {AgreementDetails} for the just-stored offer. The `state` field + * describes that version in context of its agreement (see {AgreementDetails}): + * version-specific flags (REGISTERED, ACCEPTED, UPDATE, SETTLED) are set when + * they apply to the offered version; agreement-wide flags (NOTICE_GIVEN, BY_*) + * reflect current agreement state. * @param offerType The type of offer (OFFER_TYPE_NEW or OFFER_TYPE_UPDATE) * @param data ABI-encoded offer data * @param options Bitmask reserved for implementation-specific options; pass 0 when none apply. @@ -103,17 +131,23 @@ interface IAgreementCollector is IPaymentsCollector { function offer(uint8 offerType, bytes calldata data, uint16 options) external returns (AgreementDetails memory); /** - * @notice Cancel an agreement or revoke a pending update, determined by termsHash. + * @notice Cancel an agreement or revoke a pending offer. + * @dev Scopes can be combined. SCOPE_PENDING and SCOPE_ACTIVE require payer authorization + * and no-op if nothing exists on-chain. * @param agreementId The agreement's ID. - * @param termsHash EIP-712 hash identifying which terms to cancel (active or pending). - * @param options Bitmask — SCOPE_ACTIVE (1) targets active terms, SCOPE_PENDING (2) targets pending offers. + * @param termsHash EIP-712 hash identifying which terms to cancel. + * @param options Bitmask — SCOPE_ACTIVE (1) active terms, SCOPE_PENDING (2) pending offers. */ function cancel(bytes16 agreementId, bytes32 termsHash, uint16 options) external; /** * @notice Get agreement details at a given version index. + * @dev Versions are enumerated from 0. VERSION_CURRENT is the active version (or + * pre-acceptance offer); VERSION_NEXT is the queued pending update, if any. Empty + * details are returned when no version exists at the requested index — callers can + * iterate versions until reaching an empty result. * @param agreementId The ID of the agreement - * @param index The zero-based version index + * @param index Version index (VERSION_CURRENT, VERSION_NEXT, or higher if the implementation supports more) * @return Agreement details including participants, version hash, and state flags */ function getAgreementDetails(bytes16 agreementId, uint256 index) external view returns (AgreementDetails memory); @@ -134,11 +168,13 @@ interface IAgreementCollector is IPaymentsCollector { function getMaxNextClaim(bytes16 agreementId) external view returns (uint256); /** - * @notice Original offer for a given version, enabling independent access and hash verification. - * @dev Returns the offer type (OFFER_TYPE_NEW or OFFER_TYPE_UPDATE) and the ABI-encoded - * original struct. Callers can decode and hash to verify the stored version hash. + * @notice Original offer data for a given version index, enabling independent access and hash verification. + * @dev Returns the offer type and the ABI-encoded original struct so callers can decode + * and rehash to verify the version hash returned by getAgreementDetails. Version semantics + * mirror getAgreementDetails, but empty data is returned when the version's offer was not + * stored (e.g. signed acceptance without a prior offer(), or overwritten by a later update). * @param agreementId The ID of the agreement - * @param index The zero-based version index + * @param index Version index (VERSION_CURRENT, VERSION_NEXT, or higher if supported) * @return offerType OFFER_TYPE_NEW, OFFER_TYPE_UPDATE, or OFFER_TYPE_NONE when no offer is stored * @return offerData ABI-encoded original offer struct, or empty when offerType is OFFER_TYPE_NONE */ diff --git a/packages/interfaces/contracts/horizon/IRecurringCollector.sol b/packages/interfaces/contracts/horizon/IRecurringCollector.sol index 33501f940..6315033e2 100644 --- a/packages/interfaces/contracts/horizon/IRecurringCollector.sol +++ b/packages/interfaces/contracts/horizon/IRecurringCollector.sol @@ -164,7 +164,6 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { * @param payer The address of the payer * @param serviceProvider The address of the service provider * @param agreementId The agreement ID - * @param acceptedAt The timestamp when the agreement was accepted * @param endsAt The timestamp when the agreement ends * @param maxInitialTokens The maximum amount of tokens that can be collected in the first collection * @param maxOngoingTokensPerSecond The maximum amount of tokens that can be collected per second @@ -176,7 +175,6 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { address indexed payer, address indexed serviceProvider, bytes16 agreementId, - uint64 acceptedAt, uint64 endsAt, uint256 maxInitialTokens, uint256 maxOngoingTokensPerSecond, @@ -190,7 +188,6 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { * @param payer The address of the payer * @param serviceProvider The address of the service provider * @param agreementId The agreement ID - * @param canceledAt The timestamp when the agreement was canceled * @param canceledBy The party that canceled the agreement */ event AgreementCanceled( @@ -198,7 +195,6 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { address indexed payer, address indexed serviceProvider, bytes16 agreementId, - uint64 canceledAt, CancelAgreementBy canceledBy ); @@ -208,7 +204,6 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { * @param payer The address of the payer * @param serviceProvider The address of the service provider * @param agreementId The agreement ID - * @param updatedAt The timestamp when the agreement was updated * @param endsAt The timestamp when the agreement ends * @param maxInitialTokens The maximum amount of tokens that can be collected in the first collection * @param maxOngoingTokensPerSecond The maximum amount of tokens that can be collected per second @@ -220,7 +215,6 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { address indexed payer, address indexed serviceProvider, bytes16 agreementId, - uint64 updatedAt, uint64 endsAt, uint256 maxInitialTokens, uint256 maxOngoingTokensPerSecond, diff --git a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/integration.t.sol b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/integration.t.sol index 609a91b46..45f31e527 100644 --- a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/integration.t.sol +++ b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/integration.t.sol @@ -139,7 +139,6 @@ contract SubgraphServiceIndexingAgreementIntegrationTest is SubgraphServiceIndex acceptedRca.payer, acceptedRca.serviceProvider, agreementId, - uint64(block.timestamp), IRecurringCollector.CancelAgreementBy.Payer ); From cfaf39b210637de8dbc30c15294bcd61a6323876 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Tue, 21 Apr 2026 14:18:30 +0000 Subject: [PATCH 19/47] refactor(collector): drop unreachable agreementId-zero check --- .../horizon/contracts/payments/collectors/RecurringCollector.sol | 1 - 1 file changed, 1 deletion(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 6360fc7d7..24c33c550 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -237,7 +237,6 @@ contract RecurringCollector is bytes16 agreementId, bytes32 _rcaHash ) private returns (bytes16) { - require(agreementId != bytes16(0), RecurringCollectorAgreementIdZero()); require(msg.sender == _rca.dataService, RecurringCollectorUnauthorizedCaller(msg.sender, _rca.dataService)); require( From 35748ff47830c428ed67c9a12b12c44f3215869e Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Tue, 21 Apr 2026 14:29:24 +0000 Subject: [PATCH 20/47] refactor(collector): extract _requireValidTerms from duplicated validation The (window params + eligibility + overflow) triple was duplicated in _validateAndStoreAgreement and _validateAndStoreUpdate. Extract into _requireValidTerms. No behaviour change. --- .../collectors/RecurringCollector.sol | 42 ++++++++++++++----- 1 file changed, 32 insertions(+), 10 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 24c33c550..64d72f2f9 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -244,9 +244,6 @@ contract RecurringCollector is RecurringCollectorAgreementAddressNotSet() ); - _requireValidCollectionWindowParams(_rca.endsAt, _rca.minSecondsPerCollection, _rca.maxSecondsPerCollection); - _requirePayerToSupportEligibilityCheck(_rca.payer, _rca.conditions); - AgreementData storage agreement = _getAgreementStorage(agreementId); // check that the agreement is not already accepted require( @@ -254,8 +251,10 @@ contract RecurringCollector is RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) ); - // Reverts on overflow — rejecting excessive terms that could prevent collection - _rca.maxOngoingTokensPerSecond * _rca.maxSecondsPerCollection * 1024; + _requireValidTerms( + _rca.endsAt, _rca.minSecondsPerCollection, _rca.maxSecondsPerCollection, + _rca.payer, _rca.conditions, _rca.maxOngoingTokensPerSecond + ); // accept the agreement agreement.acceptedAt = uint64(block.timestamp); @@ -816,6 +815,30 @@ contract RecurringCollector is ); } + /** + * @notice Validates offer terms: collection window, eligibility support, and overflow. + * @dev Called by _validateAndStoreAgreement and _validateAndStoreUpdate. + * @param _endsAt The end time of the agreement + * @param _minSecondsPerCollection The minimum seconds per collection + * @param _maxSecondsPerCollection The maximum seconds per collection + * @param _payer The payer address (for eligibility validation) + * @param _conditions The conditions bitmask + * @param _maxOngoingTokensPerSecond The maximum ongoing tokens per second + */ + function _requireValidTerms( + uint64 _endsAt, + uint32 _minSecondsPerCollection, + uint32 _maxSecondsPerCollection, + address _payer, + uint16 _conditions, + uint256 _maxOngoingTokensPerSecond + ) private view { + _requireValidCollectionWindowParams(_endsAt, _minSecondsPerCollection, _maxSecondsPerCollection); + _requirePayerToSupportEligibilityCheck(_payer, _conditions); + // Reverts on overflow — rejecting excessive terms that could prevent collection + _maxOngoingTokensPerSecond * _maxSecondsPerCollection * 1024; + } + /** * @notice Validates temporal constraints and caps the requested token amount. * @dev Enforces `minSecondsPerCollection` (unless canceled/elapsed) and returns the lesser of @@ -1014,11 +1037,10 @@ contract RecurringCollector is RecurringCollectorInvalidUpdateNonce(_rcau.agreementId, expectedNonce, _rcau.nonce) ); - _requireValidCollectionWindowParams(_rcau.endsAt, _rcau.minSecondsPerCollection, _rcau.maxSecondsPerCollection); - _requirePayerToSupportEligibilityCheck(_agreement.payer, _rcau.conditions); - - // Reverts on overflow — rejecting excessive terms that could prevent collection - _rcau.maxOngoingTokensPerSecond * _rcau.maxSecondsPerCollection * 1024; + _requireValidTerms( + _rcau.endsAt, _rcau.minSecondsPerCollection, _rcau.maxSecondsPerCollection, + _agreement.payer, _rcau.conditions, _rcau.maxOngoingTokensPerSecond + ); // Clean up stored replaced offer. oldHash is always non-zero for accepted agreements // and can only ever survive in rcaOffers. From 0ad0be4fd68546fd5f874b038194156fdd2bc9fc Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Tue, 21 Apr 2026 14:42:54 +0000 Subject: [PATCH 21/47] refactor(collector): split accept logic out of _validateAndStoreAgreement Move the state flip (acceptedAt, state=Accepted) and AgreementAccepted event from _validateAndStoreAgreement into accept() inline. Use rca.* for the event instead of re-reading from storage. The function now only validates and registers (identity + terms). --- .../collectors/RecurringCollector.sol | 50 ++++++++++--------- 1 file changed, 26 insertions(+), 24 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 64d72f2f9..d2e0ceab0 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -223,20 +223,41 @@ contract RecurringCollector is _requireAuthorization(rca.payer, rcaHash, signature, agreementId, OFFER_TYPE_NEW); - return _validateAndStoreAgreement(rca, agreementId, rcaHash); + _validateAndStoreAgreement(rca, agreementId, rcaHash); + + AgreementData storage agreement = _getStorage().agreements[agreementId]; + require( + agreement.state == AgreementState.NotAccepted, + RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) + ); + agreement.acceptedAt = uint64(block.timestamp); + agreement.state = AgreementState.Accepted; + + emit AgreementAccepted( + rca.dataService, + rca.payer, + rca.serviceProvider, + agreementId, + rca.endsAt, + rca.maxInitialTokens, + rca.maxOngoingTokensPerSecond, + rca.minSecondsPerCollection, + rca.maxSecondsPerCollection + ); } /** - * @notice Validates RCA fields and stores the agreement. + * @notice Validates RCA fields and registers the agreement (identity + terms). + * Does not flip state to Accepted — caller handles the accept step. * @param _rca The Recurring Collection Agreement to validate and store - * @return agreementId The deterministically generated agreement ID + * @param agreementId The deterministic agreement ID + * @param _rcaHash The EIP-712 hash of the RCA */ - /* solhint-disable function-max-lines */ function _validateAndStoreAgreement( RecurringCollectionAgreement memory _rca, bytes16 agreementId, bytes32 _rcaHash - ) private returns (bytes16) { + ) private { require(msg.sender == _rca.dataService, RecurringCollectorUnauthorizedCaller(msg.sender, _rca.dataService)); require( @@ -245,7 +266,6 @@ contract RecurringCollector is ); AgreementData storage agreement = _getAgreementStorage(agreementId); - // check that the agreement is not already accepted require( agreement.state == AgreementState.NotAccepted, RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) @@ -256,9 +276,6 @@ contract RecurringCollector is _rca.payer, _rca.conditions, _rca.maxOngoingTokensPerSecond ); - // accept the agreement - agreement.acceptedAt = uint64(block.timestamp); - agreement.state = AgreementState.Accepted; agreement.dataService = _rca.dataService; agreement.payer = _rca.payer; agreement.serviceProvider = _rca.serviceProvider; @@ -270,22 +287,7 @@ contract RecurringCollector is agreement.conditions = _rca.conditions; agreement.activeTermsHash = _rcaHash; agreement.updateNonce = 0; - - emit AgreementAccepted( - agreement.dataService, - agreement.payer, - agreement.serviceProvider, - agreementId, - agreement.endsAt, - agreement.maxInitialTokens, - agreement.maxOngoingTokensPerSecond, - agreement.minSecondsPerCollection, - agreement.maxSecondsPerCollection - ); - - return agreementId; } - /* solhint-enable function-max-lines */ /** * @inheritdoc IRecurringCollector From bfe77547df11d8c1b86a86181f96086fc908c819 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Tue, 21 Apr 2026 14:44:13 +0000 Subject: [PATCH 22/47] refactor(collector): split update apply out of _validateAndStoreUpdate Move nonce check, nonce write, and AgreementUpdated event from _validateAndStoreUpdate into update() inline. Use rcau.* for event fields. The function now only validates terms and writes them to storage; update() handles lifecycle (nonce, event). --- .../collectors/RecurringCollector.sol | 41 +++++++++---------- 1 file changed, 20 insertions(+), 21 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index d2e0ceab0..526d1abd6 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -336,7 +336,26 @@ contract RecurringCollector is _requireAuthorization(agreement.payer, rcauHash, signature, rcau.agreementId, OFFER_TYPE_UPDATE); + uint32 expectedNonce = agreement.updateNonce + 1; + require( + rcau.nonce == expectedNonce, + RecurringCollectorInvalidUpdateNonce(rcau.agreementId, expectedNonce, rcau.nonce) + ); + _validateAndStoreUpdate(agreement, rcau, rcauHash); + agreement.updateNonce = rcau.nonce; + + emit AgreementUpdated( + agreement.dataService, + agreement.payer, + agreement.serviceProvider, + rcau.agreementId, + rcau.endsAt, + rcau.maxInitialTokens, + rcau.maxOngoingTokensPerSecond, + rcau.minSecondsPerCollection, + rcau.maxSecondsPerCollection + ); } /// @inheritdoc IRecurringCollector @@ -1032,13 +1051,6 @@ contract RecurringCollector is ) private { RecurringCollectorStorage storage $ = _getStorage(); - // validate nonce to prevent replay attacks - uint32 expectedNonce = _agreement.updateNonce + 1; - require( - _rcau.nonce == expectedNonce, - RecurringCollectorInvalidUpdateNonce(_rcau.agreementId, expectedNonce, _rcau.nonce) - ); - _requireValidTerms( _rcau.endsAt, _rcau.minSecondsPerCollection, _rcau.maxSecondsPerCollection, _agreement.payer, _rcau.conditions, _rcau.maxOngoingTokensPerSecond @@ -1049,7 +1061,7 @@ contract RecurringCollector is if ($.rcaOffers[_rcau.agreementId].offerHash == _agreement.activeTermsHash) delete $.rcaOffers[_rcau.agreementId]; - // update the agreement + // update the agreement terms _agreement.endsAt = _rcau.endsAt; _agreement.maxInitialTokens = _rcau.maxInitialTokens; _agreement.maxOngoingTokensPerSecond = _rcau.maxOngoingTokensPerSecond; @@ -1057,19 +1069,6 @@ contract RecurringCollector is _agreement.maxSecondsPerCollection = _rcau.maxSecondsPerCollection; _agreement.conditions = _rcau.conditions; _agreement.activeTermsHash = _rcauHash; - _agreement.updateNonce = _rcau.nonce; - - emit AgreementUpdated( - _agreement.dataService, - _agreement.payer, - _agreement.serviceProvider, - _rcau.agreementId, - _agreement.endsAt, - _agreement.maxInitialTokens, - _agreement.maxOngoingTokensPerSecond, - _agreement.minSecondsPerCollection, - _agreement.maxSecondsPerCollection - ); } /** From 594d19b074a057822cf625e7c137448f382d6f33 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 27 Apr 2026 09:44:04 +0000 Subject: [PATCH 23/47] feat(subgraph-service): idempotent accept/update with allocation rebinding Defer state authority to the collector and align SS-side semantics for duplicate calls and re-acceptance with a different allocation: - update(): _isValid replaces _isActive; an activeTermsHash match short-circuits the SS-side event and terms re-write. - accept(): same-allocation re-accept is an idempotent no-op at the SS layer; different-allocation re-accept rebinds the agreement by clearing the old allocationToActiveAgreementId link and establishing the new one. Enables moving an active agreement to a new allocation when the original is closed. --- .../contracts/libraries/IndexingAgreement.sol | 90 ++++++++------- .../indexing-agreement/accept.t.sol | 105 ++++++++++++++++-- .../indexing-agreement/update.t.sol | 24 ++++ 3 files changed, 169 insertions(+), 50 deletions(-) diff --git a/packages/subgraph-service/contracts/libraries/IndexingAgreement.sol b/packages/subgraph-service/contracts/libraries/IndexingAgreement.sol index 347eed37e..8516334f4 100644 --- a/packages/subgraph-service/contracts/libraries/IndexingAgreement.sol +++ b/packages/subgraph-service/contracts/libraries/IndexingAgreement.sol @@ -218,12 +218,6 @@ library IndexingAgreement { bytes32 allocationDeploymentId ); - /** - * @notice Thrown when the agreement is already accepted - * @param agreementId The agreement ID - */ - error IndexingAgreementAlreadyAccepted(bytes16 agreementId); - /** * @notice Thrown when an allocation already has an active agreement * @param allocationId The allocation ID @@ -310,42 +304,48 @@ library IndexingAgreement { IIndexingAgreement.State storage agreement = self.agreements[agreementId]; - require(agreement.allocationId == address(0), IndexingAgreementAlreadyAccepted(agreementId)); - - require( - allocation.subgraphDeploymentId == metadata.subgraphDeploymentId, - IndexingAgreementDeploymentIdMismatch( - metadata.subgraphDeploymentId, + // Accept is idempotent for the same allocation, and supports moving + // the agreement to a different allocation. The collector's accept handles state + // validity (reverts if the agreement is cancelled, no-ops if already accepted). + if (agreement.allocationId != allocationId) { + require( + allocation.subgraphDeploymentId == metadata.subgraphDeploymentId, + IndexingAgreementDeploymentIdMismatch( + metadata.subgraphDeploymentId, + allocationId, + allocation.subgraphDeploymentId + ) + ); + + // Ensure that an allocation can only have one active indexing agreement + require( + self.allocationToActiveAgreementId[allocationId] == bytes16(0), + AllocationAlreadyHasIndexingAgreement(allocationId) + ); + + if (agreement.allocationId != address(0)) delete self.allocationToActiveAgreementId[agreement.allocationId]; + agreement.allocationId = allocationId; + + self.allocationToActiveAgreementId[allocationId] = agreementId; + + agreement.version = metadata.version; + + require( + metadata.version == IIndexingAgreement.IndexingAgreementVersion.V1, + IndexingAgreementInvalidVersion(metadata.version) + ); + _setTermsV1(self, agreementId, metadata.terms, rca.maxOngoingTokensPerSecond); + + emit IndexingAgreementAccepted( + rca.serviceProvider, + rca.payer, + agreementId, allocationId, - allocation.subgraphDeploymentId - ) - ); - - // Ensure that an allocation can only have one active indexing agreement - require( - self.allocationToActiveAgreementId[allocationId] == bytes16(0), - AllocationAlreadyHasIndexingAgreement(allocationId) - ); - self.allocationToActiveAgreementId[allocationId] = agreementId; - - agreement.version = metadata.version; - agreement.allocationId = allocationId; - - require( - metadata.version == IIndexingAgreement.IndexingAgreementVersion.V1, - IndexingAgreementInvalidVersion(metadata.version) - ); - _setTermsV1(self, agreementId, metadata.terms, rca.maxOngoingTokensPerSecond); - - emit IndexingAgreementAccepted( - rca.serviceProvider, - rca.payer, - agreementId, - allocationId, - metadata.subgraphDeploymentId, - metadata.version, - metadata.terms - ); + metadata.subgraphDeploymentId, + metadata.version, + metadata.terms + ); + } require( _directory().recurringCollector().accept(rca, authData) == agreementId, @@ -380,12 +380,18 @@ library IndexingAgreement { bytes calldata authData ) external { IIndexingAgreement.AgreementWrapper memory wrapper = _get(self, rcau.agreementId); - require(_isActive(wrapper), IndexingAgreementNotActive(rcau.agreementId)); + // SS gate: only checks that this is an SS-managed, tracked agreement. Collector is the + // state authority — it reverts if the agreement cannot actually accept an update. + require(_isValid(wrapper), IndexingAgreementNotActive(rcau.agreementId)); require( wrapper.collectorAgreement.serviceProvider == indexer, IndexingAgreementNotAuthorized(rcau.agreementId, indexer) ); + // Idempotent: this RCAU is already the active version — both SS terms and collector state + // are in sync because both are written together on the original update. + if (wrapper.collectorAgreement.activeTermsHash == _directory().recurringCollector().hashRCAU(rcau)) return; + UpdateIndexingAgreementMetadata memory metadata = IndexingAgreementDecoder.decodeRCAUMetadata(rcau.metadata); require( diff --git a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/accept.t.sol b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/accept.t.sol index 1d2e2b9fb..b2853949d 100644 --- a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/accept.t.sol +++ b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/accept.t.sol @@ -5,6 +5,7 @@ import { PausableUpgradeable } from "@openzeppelin/contracts-upgradeable/utils/P import { ProvisionManager } from "@graphprotocol/horizon/contracts/data-service/utilities/ProvisionManager.sol"; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; import { IAllocation } from "@graphprotocol/interfaces/contracts/subgraph-service/internal/IAllocation.sol"; +import { IIndexingAgreement } from "@graphprotocol/interfaces/contracts/subgraph-service/internal/IIndexingAgreement.sol"; import { IndexingAgreement } from "../../../../contracts/libraries/IndexingAgreement.sol"; import { IndexingAgreementDecoder } from "../../../../contracts/libraries/IndexingAgreementDecoder.sol"; @@ -231,7 +232,9 @@ contract SubgraphServiceIndexingAgreementAcceptTest is SubgraphServiceIndexingAg subgraphService.acceptIndexingAgreement(indexerState.allocationId, unacceptableRca, signature); } - function test_SubgraphService_AcceptIndexingAgreement_Revert_WhenAgreementAlreadyAccepted(Seed memory seed) public { + function test_SubgraphService_AcceptIndexingAgreement_Idempotent_WhenAlreadyAcceptedSameAllocation( + Seed memory seed + ) public { Context storage ctx = _newCtx(seed); IndexerState memory indexerState = _withIndexer(ctx); ( @@ -239,19 +242,20 @@ contract SubgraphServiceIndexingAgreementAcceptTest is SubgraphServiceIndexingAg bytes16 agreementId ) = _withAcceptedIndexingAgreement(ctx, indexerState); - // Re-sign for the re-accept attempt (the original signature was consumed) + // Re-sign for the re-accept (the original signature was consumed) (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCA( acceptedRca, ctx.payer.signerPrivateKey ); - bytes memory expectedErr = abi.encodeWithSelector( - IndexingAgreement.IndexingAgreementAlreadyAccepted.selector, - agreementId - ); - vm.expectRevert(expectedErr); + // Re-accepting the same RCA on the same allocation is a no-op. resetPrank(ctx.indexers[0].addr); - subgraphService.acceptIndexingAgreement(ctx.indexers[0].allocationId, acceptedRca, signature); + bytes16 returnedId = subgraphService.acceptIndexingAgreement( + ctx.indexers[0].allocationId, + acceptedRca, + signature + ); + assertEq(returnedId, agreementId); } function test_SubgraphService_AcceptIndexingAgreement_Revert_WhenAgreementAlreadyAllocated( @@ -384,5 +388,90 @@ contract SubgraphServiceIndexingAgreementAcceptTest is SubgraphServiceIndexingAg resetPrank(indexerState.addr); subgraphService.acceptIndexingAgreement(indexerState.allocationId, acceptableRca, signature); } + + function test_SubgraphService_AcceptIndexingAgreement_Rebinds_WhenDifferentAllocation( + Seed memory seed, + uint256 secondAllocationKey + ) public { + Context storage ctx = _newCtx(seed); + IndexerState memory indexerState = _withIndexer(ctx); + ( + IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, + bytes16 agreementId + ) = _withAcceptedIndexingAgreement(ctx, indexerState); + + // Agreement is now bound to the first allocation. + IIndexingAgreement.AgreementWrapper memory before = subgraphService.getIndexingAgreement(agreementId); + assertEq(before.agreement.allocationId, indexerState.allocationId, "starts bound to first allocation"); + + // Derive a second allocation for the same indexer + same subgraph deployment. The first + // allocation already consumed the indexer's provision, so top up first. + uint256 extraTokens = 10_000_000 ether; + deal({ token: address(token), to: indexerState.addr, give: extraTokens }); + resetPrank(indexerState.addr); + _addToProvision(indexerState.addr, extraTokens); + + secondAllocationKey = boundKey(secondAllocationKey); + address secondAllocationId = vm.addr(secondAllocationKey); + vm.assume(secondAllocationId != indexerState.allocationId); + vm.assume(ctx.allocations[secondAllocationId] == address(0)); + ctx.allocations[secondAllocationId] = indexerState.addr; + + bytes memory allocData = _createSubgraphAllocationData( + indexerState.addr, + indexerState.subgraphDeploymentId, + secondAllocationKey, + extraTokens + ); + _startService(indexerState.addr, allocData); + + // Re-sign the same RCA (original signature was consumed on first accept). + (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCA( + acceptedRca, + ctx.payer.signerPrivateKey + ); + + // Re-accepting the same agreement on the new allocation rebinds it: + // event is re-emitted, agreement.allocationId updates, old allocation's active-agreement + // mapping is cleared. Collector's accept() is a no-op (already Accepted). + IndexingAgreement.AcceptIndexingAgreementMetadata memory metadata = abi.decode( + acceptedRca.metadata, + (IndexingAgreement.AcceptIndexingAgreementMetadata) + ); + vm.expectEmit(address(subgraphService)); + emit IndexingAgreement.IndexingAgreementAccepted( + acceptedRca.serviceProvider, + acceptedRca.payer, + agreementId, + secondAllocationId, + metadata.subgraphDeploymentId, + metadata.version, + metadata.terms + ); + resetPrank(indexerState.addr); + bytes16 returnedId = subgraphService.acceptIndexingAgreement(secondAllocationId, acceptedRca, signature); + assertEq(returnedId, agreementId, "rebind returns same agreementId"); + + IIndexingAgreement.AgreementWrapper memory rebound = subgraphService.getIndexingAgreement(agreementId); + assertEq(rebound.agreement.allocationId, secondAllocationId, "rebound to second allocation"); + assertEq( + uint8(rebound.collectorAgreement.state), + uint8(IRecurringCollector.AgreementState.Accepted), + "collector state still Accepted after rebind" + ); + + // Closing the OLD allocation must not cancel the agreement — the agreement no longer + // points to it. onCloseAllocation's allocationToActiveAgreementId lookup should return 0. + resetPrank(indexerState.addr); + subgraphService.stopService(indexerState.addr, abi.encode(indexerState.allocationId)); + + IIndexingAgreement.AgreementWrapper memory afterOldClose = subgraphService.getIndexingAgreement(agreementId); + assertEq( + uint8(afterOldClose.collectorAgreement.state), + uint8(IRecurringCollector.AgreementState.Accepted), + "closing old allocation leaves agreement intact" + ); + assertEq(afterOldClose.agreement.allocationId, secondAllocationId, "still bound to second allocation"); + } /* solhint-enable graph/func-name-mixedcase */ } diff --git a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/update.t.sol b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/update.t.sol index 9f1abc180..dcd6bf32f 100644 --- a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/update.t.sol +++ b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/update.t.sol @@ -227,5 +227,29 @@ contract SubgraphServiceIndexingAgreementUpgradeTest is SubgraphServiceIndexingA resetPrank(indexerState.addr); subgraphService.updateIndexingAgreement(indexerState.addr, acceptableRcau, authData); } + + function test_SubgraphService_UpdateIndexingAgreement_Idempotent_WhenAlreadyAtActiveHash(Seed memory seed) public { + Context storage ctx = _newCtx(seed); + IndexerState memory indexerState = _withIndexer(ctx); + (IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, ) = _withAcceptedIndexingAgreement( + ctx, + indexerState + ); + ( + IRecurringCollector.RecurringCollectionAgreementUpdate memory acceptableRcau, + bytes memory authData + ) = _generateAcceptableSignedRCAU(ctx, acceptedRca); + + // First update sets activeTermsHash = hash(rcau) on the collector and applies SS terms. + resetPrank(indexerState.addr); + subgraphService.updateIndexingAgreement(indexerState.addr, acceptableRcau, authData); + + // Re-submitting the same RCAU is a no-op at the SS layer: + // the hash match short-circuits before re-emitting or re-writing terms. + vm.recordLogs(); + resetPrank(indexerState.addr); + subgraphService.updateIndexingAgreement(indexerState.addr, acceptableRcau, authData); + assertEq(vm.getRecordedLogs().length, 0, "no event emitted on idempotent re-update"); + } /* solhint-enable graph/func-name-mixedcase */ } From 885555e91defed01af61cb5a663e9ee7dbfed645 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 27 Apr 2026 09:56:31 +0000 Subject: [PATCH 24/47] refactor(collector): hoist solhint-disable, idiomatic deadline comparisons Preparatory cleanup: - Hoist `solhint-disable gas-strict-inequalities` to file level; drop per-block/per-line fences and flip `deadline >= block.timestamp` callsites to the idiomatic `block.timestamp <= deadline`. --- .../payments/collectors/RecurringCollector.sol | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 526d1abd6..81fbe4fa0 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -1,6 +1,8 @@ // SPDX-License-Identifier: GPL-3.0-or-later pragma solidity ^0.8.27; +// solhint-disable gas-strict-inequalities + import { EIP712Upgradeable } from "@openzeppelin/contracts-upgradeable/utils/cryptography/EIP712Upgradeable.sol"; import { Initializable } from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol"; import { PausableUpgradeable } from "@openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol"; @@ -211,12 +213,10 @@ contract RecurringCollector is RecurringCollectionAgreement calldata rca, bytes calldata signature ) external whenNotPaused returns (bytes16 agreementId) { - /* solhint-disable gas-strict-inequalities */ require( - rca.deadline >= block.timestamp, + block.timestamp <= rca.deadline, RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rca.deadline) ); - /* solhint-enable gas-strict-inequalities */ bytes32 rcaHash; (agreementId, rcaHash) = _rcaIdAndHash(rca); @@ -325,12 +325,10 @@ contract RecurringCollector is function update(RecurringCollectionAgreementUpdate calldata rcau, bytes calldata signature) external whenNotPaused { AgreementData storage agreement = _requireValidUpdateTarget(rcau.agreementId); - /* solhint-disable gas-strict-inequalities */ require( - rcau.deadline >= block.timestamp, + block.timestamp <= rcau.deadline, RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rcau.deadline) ); - /* solhint-enable gas-strict-inequalities */ bytes32 rcauHash = _hashRCAU(rcau); @@ -658,12 +656,10 @@ contract RecurringCollector is if (_params.tokens != 0) { uint256 slippage = _params.tokens - tokensToCollect; - /* solhint-disable gas-strict-inequalities */ require( slippage <= _params.maxSlippage, RecurringCollectorExcessiveSlippage(_params.tokens, tokensToCollect, _params.maxSlippage) ); - /* solhint-enable gas-strict-inequalities */ } agreement.lastCollectionAt = uint64(block.timestamp); @@ -816,7 +812,6 @@ contract RecurringCollector is // Collection window needs to be at least MIN_SECONDS_COLLECTION_WINDOW require( _maxSecondsPerCollection > _minSecondsPerCollection && - // solhint-disable-next-line gas-strict-inequalities (_maxSecondsPerCollection - _minSecondsPerCollection >= MIN_SECONDS_COLLECTION_WINDOW), RecurringCollectorAgreementInvalidCollectionWindow( MIN_SECONDS_COLLECTION_WINDOW, @@ -827,7 +822,6 @@ contract RecurringCollector is // Agreement needs to last at least one min collection window require( - // solhint-disable-next-line gas-strict-inequalities _endsAt - block.timestamp >= _minSecondsPerCollection + MIN_SECONDS_COLLECTION_WINDOW, RecurringCollectorAgreementInvalidDuration( _minSecondsPerCollection + MIN_SECONDS_COLLECTION_WINDOW, @@ -881,7 +875,6 @@ contract RecurringCollector is block.timestamp > _agreement.endsAt; if (!canceledOrElapsed) { require( - // solhint-disable-next-line gas-strict-inequalities _collectionSeconds >= _agreement.minSecondsPerCollection, RecurringCollectorCollectionTooSoon( _agreementId, @@ -1253,7 +1246,6 @@ contract RecurringCollector is uint256 maxOngoingTokensPerSecond, uint256 maxInitialTokens ) private pure returns (uint256) { - // solhint-disable-next-line gas-strict-inequalities if (windowEnd <= windowStart) return 0; uint256 windowSeconds = windowEnd - windowStart; uint256 effectiveSeconds = windowSeconds < maxSecondsPerCollection ? windowSeconds : maxSecondsPerCollection; From 572853b01e5fe4262ed558568d4106748dac61fc Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Wed, 22 Apr 2026 14:50:51 +0000 Subject: [PATCH 25/47] fix(collector): validate offer terms against deadline, not block.timestamp Collection-window and duration checks now use the offer's acceptance deadline as the reference point instead of `block.timestamp`, making validation time-independent: if terms pass here they remain valid for any acceptance on or before `deadline`. Callers still enforce `block.timestamp <= deadline` at the acceptance entry point. - `_requireValidCollectionWindowParams` takes a `_deadline` parameter and becomes `pure`. `_endsAt > block.timestamp` becomes `_deadline < _endsAt`; `_endsAt - block.timestamp >= min + WINDOW` becomes `min + WINDOW <= _endsAt - _deadline`. - `_requireValidTerms` propagates `_deadline` to the window check. - Accept/update call sites pass the RCA/RCAU deadline. - Interface: replace `RecurringCollectorAgreementElapsedEndsAt` with `RecurringCollectorAgreementEndsBeforeDeadline(deadline, endsAt)`. Prerequisite for hash-keyed terms storage, where a single stored hash must remain validatable without re-checking against wall clock on every read. --- .../collectors/RecurringCollector.sol | 44 +++-- .../payments/recurring-collector/accept.t.sol | 167 ++++++++++++++++ .../acceptValidation.t.sol | 16 +- .../recurring-collector/afterCollection.t.sol | 2 +- .../recurring-collector/coverageGaps.t.sol | 73 +++++++ .../recurring-collector/getMaxNextClaim.t.sol | 184 ++++++++++++++++++ .../recurring-collector/hashRoundTrip.t.sol | 4 +- .../recurring-collector/mixedPath.t.sol | 83 +++++++- .../offerStorageLifecycle.t.sol | 35 ++-- .../recurring-collector/updateUnsigned.t.sol | 6 +- .../recurring-collector/upgradeScenario.t.sol | 2 +- .../recurring-collector/viewFunctions.t.sol | 17 +- .../contracts/horizon/IRecurringCollector.sol | 6 +- .../indexing-agreement/accept.t.sol | 58 ++++++ .../AgreementLifecycleAdvanced.t.sol | 82 ++++++++ 15 files changed, 711 insertions(+), 68 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 81fbe4fa0..79c8b4491 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -272,8 +272,13 @@ contract RecurringCollector is ); _requireValidTerms( - _rca.endsAt, _rca.minSecondsPerCollection, _rca.maxSecondsPerCollection, - _rca.payer, _rca.conditions, _rca.maxOngoingTokensPerSecond + _rca.deadline, + _rca.endsAt, + _rca.minSecondsPerCollection, + _rca.maxSecondsPerCollection, + _rca.payer, + _rca.conditions, + _rca.maxOngoingTokensPerSecond ); agreement.dataService = _rca.dataService; @@ -796,18 +801,23 @@ contract RecurringCollector is /** * @notice Requires that the collection window parameters are valid. - * + * @dev Validated against `_deadline` (the offer's acceptance deadline) rather than + * `block.timestamp`, making this check time-independent: if terms pass here they remain + * valid for any acceptance that happens on or before `_deadline`. Callers must enforce + * `block.timestamp <= _deadline` at the acceptance entry point. + * @param _deadline The offer's acceptance deadline * @param _endsAt The end time of the agreement * @param _minSecondsPerCollection The minimum seconds per collection * @param _maxSecondsPerCollection The maximum seconds per collection */ function _requireValidCollectionWindowParams( + uint64 _deadline, uint64 _endsAt, uint32 _minSecondsPerCollection, uint32 _maxSecondsPerCollection - ) private view { - // Agreement needs to end in the future - require(_endsAt > block.timestamp, RecurringCollectorAgreementElapsedEndsAt(block.timestamp, _endsAt)); + ) private pure { + // Agreement must end after the deadline + require(_deadline < _endsAt, RecurringCollectorAgreementEndsBeforeDeadline(_deadline, _endsAt)); // Collection window needs to be at least MIN_SECONDS_COLLECTION_WINDOW require( @@ -820,19 +830,21 @@ contract RecurringCollector is ) ); - // Agreement needs to last at least one min collection window + // Even if accepted at the deadline at least one min collection window must remain require( - _endsAt - block.timestamp >= _minSecondsPerCollection + MIN_SECONDS_COLLECTION_WINDOW, + _minSecondsPerCollection + MIN_SECONDS_COLLECTION_WINDOW <= _endsAt - _deadline, RecurringCollectorAgreementInvalidDuration( _minSecondsPerCollection + MIN_SECONDS_COLLECTION_WINDOW, - _endsAt - block.timestamp + _endsAt - _deadline ) ); } /** * @notice Validates offer terms: collection window, eligibility support, and overflow. - * @dev Called by _validateAndStoreAgreement and _validateAndStoreUpdate. + * @dev Called by _validateAndStoreAgreement and _validateAndStoreUpdate. Time-independent — + * validates against the offer's deadline so the check is stable across the offer's lifetime. + * @param _deadline The offer's acceptance deadline * @param _endsAt The end time of the agreement * @param _minSecondsPerCollection The minimum seconds per collection * @param _maxSecondsPerCollection The maximum seconds per collection @@ -841,6 +853,7 @@ contract RecurringCollector is * @param _maxOngoingTokensPerSecond The maximum ongoing tokens per second */ function _requireValidTerms( + uint64 _deadline, uint64 _endsAt, uint32 _minSecondsPerCollection, uint32 _maxSecondsPerCollection, @@ -848,7 +861,7 @@ contract RecurringCollector is uint16 _conditions, uint256 _maxOngoingTokensPerSecond ) private view { - _requireValidCollectionWindowParams(_endsAt, _minSecondsPerCollection, _maxSecondsPerCollection); + _requireValidCollectionWindowParams(_deadline, _endsAt, _minSecondsPerCollection, _maxSecondsPerCollection); _requirePayerToSupportEligibilityCheck(_payer, _conditions); // Reverts on overflow — rejecting excessive terms that could prevent collection _maxOngoingTokensPerSecond * _maxSecondsPerCollection * 1024; @@ -1045,8 +1058,13 @@ contract RecurringCollector is RecurringCollectorStorage storage $ = _getStorage(); _requireValidTerms( - _rcau.endsAt, _rcau.minSecondsPerCollection, _rcau.maxSecondsPerCollection, - _agreement.payer, _rcau.conditions, _rcau.maxOngoingTokensPerSecond + _rcau.deadline, + _rcau.endsAt, + _rcau.minSecondsPerCollection, + _rcau.maxSecondsPerCollection, + _agreement.payer, + _rcau.conditions, + _rcau.maxOngoingTokensPerSecond ); // Clean up stored replaced offer. oldHash is always non-zero for accepted agreements diff --git a/packages/horizon/test/unit/payments/recurring-collector/accept.t.sol b/packages/horizon/test/unit/payments/recurring-collector/accept.t.sol index d1742b690..f36eb50e0 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/accept.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/accept.t.sol @@ -2,6 +2,7 @@ pragma solidity ^0.8.27; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; +import { OFFER_TYPE_NEW } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { RecurringCollectorSharedTest } from "./shared.t.sol"; @@ -65,5 +66,171 @@ contract RecurringCollectorAcceptTest is RecurringCollectorSharedTest { _recurringCollector.accept(acceptedRca, signature); } + /// @notice Re-accepting an already-accepted RCA at the same hash must still succeed after + /// the RCA's acceptance deadline has elapsed. The idempotent short-circuit runs before the + /// deadline check so signature lifetime is not consumed — this is the path the SubgraphService + /// relies on to rebind an agreement to a new allocation after the original acceptance window + /// has closed. + function test_Accept_Idempotent_AfterDeadline_SameHash(FuzzyTestAccept calldata fuzzyTestAccept) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, + bytes memory signature, + , + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestAccept); + + // Warp past the RCA's deadline — a fresh accept would now revert with + // RecurringCollectorAgreementDeadlineElapsed. + vm.warp(uint256(acceptedRca.deadline) + 1); + + vm.recordLogs(); + vm.prank(acceptedRca.dataService); + bytes16 returnedId = _recurringCollector.accept(acceptedRca, signature); + assertEq(returnedId, agreementId, "returns the same agreementId"); + assertEq(vm.getRecordedLogs().length, 0, "no event emitted on idempotent re-accept after deadline"); + + // Sanity: the collector-side agreement is still in Accepted state, unchanged by the no-op. + IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); + assertEq(uint8(agreement.state), uint8(IRecurringCollector.AgreementState.Accepted)); + } + + /// @notice A fresh accept (no prior offer()) stores terms via _validateAndStoreTerms, which must + /// emit OfferStored. AgreementAccepted follows. Both events observable in order. + function test_Accept_EmitsOfferStored_WhenFreshTerms(FuzzyTestAccept calldata fuzzyTestAccept) public { + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept.rca + ); + uint256 signerKey = boundKey(fuzzyTestAccept.unboundedSignerKey); + _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, signerKey); + (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCA(rca, signerKey); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + // OfferStored fires from _validateAndStoreTerms before _storeAgreement; AgreementAccepted + // follows the state transition at the end of accept(). + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, rcaHash); + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.AgreementAccepted( + rca.dataService, + rca.payer, + rca.serviceProvider, + agreementId, + rca.endsAt, + rca.maxInitialTokens, + rca.maxOngoingTokensPerSecond, + rca.minSecondsPerCollection, + rca.maxSecondsPerCollection + ); + vm.prank(rca.dataService); + _recurringCollector.accept(rca, signature); + } + + /// @notice A second RCA sharing the same agreementId seed (payer, dataService, serviceProvider, + /// deadline, nonce) but with different other fields — so different rcaHash — must not be + /// accepted against an already-Accepted agreement. The idempotent short-circuit only fires on + /// exact hash match; everything else must fall through to the state guard and revert. Proves + /// the short-circuit can't be abused as an overwrite path even in an imagined 128-bit + /// agreementId collision. + function test_Accept_Revert_WhenDifferentHashSameAgreementId(FuzzyTestAccept calldata fuzzyTestAccept) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, + , + uint256 signerKey, + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestAccept); + + // Snapshot the original hash before constructing the variant. `variant = acceptedRca` in + // Solidity memory is a reference copy, so rebuild explicitly to vary one pricing field + // while keeping the 5 agreementId-seed fields (payer, dataService, serviceProvider, + // deadline, nonce) verbatim. + bytes32 originalHash = _recurringCollector.hashRCA(acceptedRca); + IRecurringCollector.RecurringCollectionAgreement memory variant = IRecurringCollector + .RecurringCollectionAgreement({ + deadline: acceptedRca.deadline, + endsAt: acceptedRca.endsAt, + payer: acceptedRca.payer, + dataService: acceptedRca.dataService, + serviceProvider: acceptedRca.serviceProvider, + maxInitialTokens: acceptedRca.maxInitialTokens + 1, // <-- vary + maxOngoingTokensPerSecond: acceptedRca.maxOngoingTokensPerSecond, + minSecondsPerCollection: acceptedRca.minSecondsPerCollection, + maxSecondsPerCollection: acceptedRca.maxSecondsPerCollection, + conditions: acceptedRca.conditions, + nonce: acceptedRca.nonce, + metadata: acceptedRca.metadata + }); + + bytes32 variantHash = _recurringCollector.hashRCA(variant); + assertTrue(originalHash != variantHash, "hashes must differ when any field differs"); + assertEq( + _recurringCollector.generateAgreementId( + variant.payer, + variant.dataService, + variant.serviceProvider, + variant.deadline, + variant.nonce + ), + agreementId, + "same agreementId seed yields same id" + ); + + (, bytes memory variantSig) = _recurringCollectorHelper.generateSignedRCA(variant, signerKey); + + // Short-circuit doesn't fire (hash differs); falls through to _storeAgreement's state guard. + vm.expectRevert( + abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorAgreementIncorrectState.selector, + agreementId, + IRecurringCollector.AgreementState.Accepted + ) + ); + vm.prank(acceptedRca.dataService); + _recurringCollector.accept(variant, variantSig); + + // Post-revert sanity: storage reflects the original, not the variant. + IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); + assertEq(agreement.activeTermsHash, originalHash, "activeTermsHash unchanged"); + } + + /// @notice After a cancellation, re-accepting the same RCA at the same hash must revert — the + /// short-circuit only fires when state == Accepted, so a cancelled agreement falls through to + /// the NotAccepted state guard. Proves cancelled is terminal and the short-circuit cannot + /// resurrect it. + function test_Accept_Revert_AfterCancellation_SameHash(FuzzyTestAccept calldata fuzzyTestAccept) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, + bytes memory signature, + , + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestAccept); + + vm.prank(acceptedRca.dataService); + _recurringCollector.cancel(agreementId, IRecurringCollector.CancelAgreementBy.ServiceProvider); + + assertEq( + uint8(_recurringCollector.getAgreement(agreementId).state), + uint8(IRecurringCollector.AgreementState.CanceledByServiceProvider), + "precondition: cancelled" + ); + + vm.expectRevert( + abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorAgreementIncorrectState.selector, + agreementId, + IRecurringCollector.AgreementState.CanceledByServiceProvider + ) + ); + vm.prank(acceptedRca.dataService); + _recurringCollector.accept(acceptedRca, signature); + } + /* solhint-enable graph/func-name-mixedcase */ } diff --git a/packages/horizon/test/unit/payments/recurring-collector/acceptValidation.t.sol b/packages/horizon/test/unit/payments/recurring-collector/acceptValidation.t.sol index 5e47e2fb4..91e3e0bdd 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/acceptValidation.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/acceptValidation.t.sol @@ -69,11 +69,11 @@ contract RecurringCollectorAcceptValidationTest is RecurringCollectorSharedTest _recurringCollector.accept(rca, signature); } - // ==================== endsAt validation (L545) ==================== + // ==================== endsAt validation ==================== - function test_Accept_Revert_WhenEndsAtInPast() public { + function test_Accept_Revert_WhenEndsAtNotAfterDeadline() public { IRecurringCollector.RecurringCollectionAgreement memory rca = _makeValidRCA(); - rca.endsAt = uint64(block.timestamp); // endsAt == now, fails "endsAt > block.timestamp" + rca.endsAt = rca.deadline; // endsAt == deadline, fails "endsAt > deadline" _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, SIGNER_KEY); (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCA(rca, SIGNER_KEY); @@ -81,8 +81,8 @@ contract RecurringCollectorAcceptValidationTest is RecurringCollectorSharedTest vm.expectRevert( abi.encodeWithSelector( - IRecurringCollector.RecurringCollectorAgreementElapsedEndsAt.selector, - block.timestamp, + IRecurringCollector.RecurringCollectorAgreementEndsBeforeDeadline.selector, + rca.deadline, rca.endsAt ) ); @@ -142,12 +142,12 @@ contract RecurringCollectorAcceptValidationTest is RecurringCollectorSharedTest function test_Accept_Revert_WhenDurationTooShort() public { IRecurringCollector.RecurringCollectionAgreement memory rca = _makeValidRCA(); - // Need: endsAt - now >= minSecondsPerCollection + MIN_SECONDS_COLLECTION_WINDOW + // Need: endsAt - deadline >= minSecondsPerCollection + MIN_SECONDS_COLLECTION_WINDOW // Set duration just under the minimum uint32 minWindow = _recurringCollector.MIN_SECONDS_COLLECTION_WINDOW(); rca.minSecondsPerCollection = 600; rca.maxSecondsPerCollection = 600 + minWindow; // valid window - rca.endsAt = uint64(block.timestamp + rca.minSecondsPerCollection + minWindow - 1); // 1 second too short + rca.endsAt = rca.deadline + rca.minSecondsPerCollection + minWindow - 1; // 1 second too short _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, SIGNER_KEY); (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCA(rca, SIGNER_KEY); @@ -157,7 +157,7 @@ contract RecurringCollectorAcceptValidationTest is RecurringCollectorSharedTest abi.encodeWithSelector( IRecurringCollector.RecurringCollectorAgreementInvalidDuration.selector, rca.minSecondsPerCollection + minWindow, - rca.endsAt - block.timestamp + uint256(rca.endsAt - rca.deadline) ) ); vm.prank(rca.dataService); diff --git a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol index 90ae638e7..5af9b3b0f 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol @@ -166,7 +166,7 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { assertTrue(triggered, "Should have triggered InsufficientCallbackGas at some gas limit"); } - /// @notice TRST-L-9: the CALLBACK_GAS_OVERHEAD precheck also guards the eligibility staticcall + /// @notice The CALLBACK_GAS_OVERHEAD precheck also guards the eligibility staticcall /// (first of three callback prechecks). Binary-search for a gas limit that reaches the /// eligibility precheck and trips it, confirming the buffer logic applies there too. function test_Collect_Revert_WhenInsufficientCallbackGas_EligibilityPrecheck() public { diff --git a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol index f81187662..977e08c34 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol @@ -849,6 +849,79 @@ contract RecurringCollectorCoverageGapsTest is RecurringCollectorSharedTest { assertEq(dataAfter.length, 0, "Offer data should be empty after cancel"); } + function test_Cancel_PendingRcaAndRcau_IndependentOrder() public { + MockAgreementOwner approver = new MockAgreementOwner(); + + IRecurringCollector.RecurringCollectionAgreement memory rca = IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }); + + // Offer RCA (not yet accepted) + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory details = _recurringCollector.offer( + OFFER_TYPE_NEW, + abi.encode(rca), + 0 + ); + bytes16 agreementId = details.agreementId; + bytes32 rcaHash = details.versionHash; + + // Offer RCAU on top of the pending RCA + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = IRecurringCollector + .RecurringCollectionAgreementUpdate({ + agreementId: agreementId, + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + maxInitialTokens: 200 ether, + maxOngoingTokensPerSecond: 2 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }); + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory updateDetails = _recurringCollector.offer( + OFFER_TYPE_UPDATE, + abi.encode(rcau), + 0 + ); + bytes32 rcauHash = updateDetails.versionHash; + + // Cancel the RCA offer first — pending RCAU survives independently + vm.expectEmit(true, true, false, true); + emit IRecurringCollector.OfferCancelled(address(approver), agreementId, rcaHash); + vm.prank(address(approver)); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_PENDING); + + IRecurringCollector.AgreementData memory after1 = _recurringCollector.getAgreement(agreementId); + assertEq(after1.activeTermsHash, bytes32(0), "active should be cleared"); + assertEq(after1.pendingTermsHash, rcauHash, "pending RCAU should survive RCA cancel"); + assertEq(after1.payer, address(approver), "agreement.payer persists for subsequent auth"); + + // Now cancel the pending RCAU — payer auth still works via persistent agreement.payer + vm.expectEmit(true, true, false, true); + emit IRecurringCollector.OfferCancelled(address(approver), agreementId, rcauHash); + vm.prank(address(approver)); + _recurringCollector.cancel(agreementId, rcauHash, SCOPE_PENDING); + + (uint8 activeType, ) = _recurringCollector.getAgreementOfferAt(agreementId, 0); + assertEq(activeType, 0, "Active offer should be gone"); + (uint8 pendingType, ) = _recurringCollector.getAgreementOfferAt(agreementId, 1); + assertEq(pendingType, 0, "Pending offer should be gone"); + } + // ══════════════════════════════════════════════════════════════════════ // Gap 16 — _requirePayer: agreement not found (L528) // ══════════════════════════════════════════════════════════════════════ diff --git a/packages/horizon/test/unit/payments/recurring-collector/getMaxNextClaim.t.sol b/packages/horizon/test/unit/payments/recurring-collector/getMaxNextClaim.t.sol index 58aa6961d..fb46ba2dc 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/getMaxNextClaim.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/getMaxNextClaim.t.sol @@ -505,5 +505,189 @@ contract RecurringCollectorGetMaxNextClaimTest is RecurringCollectorSharedTest { assertLt(windowSeconds, maxSecondsPerCollection, "Window should be smaller than maxSecondsPerCollection"); } + /// @notice Symmetry of the pending-deadline fix for the pre-acceptance active branch. + /// An agreement that has been offered but not yet accepted (state == NotAccepted, but + /// activeTermsHash set) is admissible for acceptance at exactly `terms.deadline` because + /// accept() gates on `block.timestamp <= rca.deadline`. RAM's reservation envelope must + /// therefore still cover the potential claim window at that block. One second past, accept() + /// would revert and the agreement is unreachable, so max-claim drops to zero. + function test_GetMaxNextClaim_PreAcceptanceActiveAtExactDeadline_StillCounts() public { + MockAgreementOwner approver = new MockAgreementOwner(); + + // Build RCA manually so we control the exact deadline. + uint64 rcaDeadline = uint64(block.timestamp + 1 hours); + IRecurringCollector.RecurringCollectionAgreement memory rca = IRecurringCollector.RecurringCollectionAgreement({ + deadline: rcaDeadline, + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + // Agreement is in NotAccepted state — activeTermsHash is set (by offer) but no accept() yet. + assertEq( + uint8(_recurringCollector.getAgreement(agreementId).state), + uint8(IRecurringCollector.AgreementState.NotAccepted), + "precondition: NotAccepted" + ); + + // One second before the deadline: pre-acceptance active counts. + vm.warp(uint256(rcaDeadline) - 1); + assertGt(_recurringCollector.getMaxNextClaim(agreementId, 1), 0, "active counts before deadline"); + + // At the exact deadline: accept() is still admissible (<=), so the pre-acceptance window + // must still count in the reservation envelope. + vm.warp(uint256(rcaDeadline)); + assertGt(_recurringCollector.getMaxNextClaim(agreementId, 1), 0, "active should still count at exact deadline"); + + // One second past the deadline: accept() would revert, so max-claim drops to zero. + vm.warp(uint256(rcaDeadline) + 1); + assertEq(_recurringCollector.getMaxNextClaim(agreementId, 1), 0, "active zero one second past deadline"); + } + + /// @notice Boundary: the guard uses `block.timestamp <= terms.deadline` (inclusive) to match + /// {update}'s admissibility — at the exact deadline block, update() can still promote the + /// pending to active, so RAM must keep reserving for it. One second past the deadline, the + /// pending is no longer admissible and drops to zero. + function test_GetMaxNextClaim_PendingAtExactDeadline_StillCounts() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + // Build RCAU manually (not via sensibleRCAU, which overrides deadline to a tight window) + // so we can pick a deadline we control and warp exactly to its boundary. + uint64 pendingDeadline = uint64(block.timestamp + 1 hours); + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = IRecurringCollector + .RecurringCollectionAgreementUpdate({ + agreementId: agreementId, + deadline: pendingDeadline, + endsAt: uint64(block.timestamp + 730 days), + maxInitialTokens: 200 ether, + maxOngoingTokensPerSecond: 10 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 7200, + conditions: 0, + nonce: 1, + metadata: "" + }); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + + // One second before the deadline: pending counts. + vm.warp(uint256(pendingDeadline) - 1); + assertGt(_recurringCollector.getMaxNextClaim(agreementId, 2), 0, "pending counts before deadline"); + + // At the exact deadline: guard is inclusive `<=`, matching update()'s admissibility. + // update() can still promote the pending to active on this block, so RAM must keep it + // in the reservation envelope. + vm.warp(uint256(pendingDeadline)); + assertGt(_recurringCollector.getMaxNextClaim(agreementId, 2), 0, "pending counts at exact deadline"); + + // One second past the deadline: update() would revert, so pending drops to zero. + vm.warp(uint256(pendingDeadline) + 1); + assertEq(_recurringCollector.getMaxNextClaim(agreementId, 2), 0, "pending zero one second past deadline"); + } + + /// @notice An expired pending offer (deadline in the past, endsAt still in the future) must not + /// contribute to max-claim. {update} rejects past-deadline RCAUs so the pending can never be + /// promoted to active; counting it would over-reserve escrow in RAM. + function test_GetMaxNextClaim_PendingIgnored_AfterDeadline() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + // Pending RCAU with higher rate + short acceptance deadline but long endsAt. Build manually + // so we control the deadline exactly (sensibleRCAU would override it to a bounded window). + uint64 pendingDeadline = uint64(block.timestamp + 1 hours); + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = IRecurringCollector + .RecurringCollectionAgreementUpdate({ + agreementId: agreementId, + deadline: pendingDeadline, + endsAt: uint64(block.timestamp + 730 days), + maxInitialTokens: 200 ether, + maxOngoingTokensPerSecond: 10 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 7200, + conditions: 0, + nonce: 1, + metadata: "" + }); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + + uint256 activeClaim = _recurringCollector.getMaxNextClaim(agreementId, 1); // SCOPE_ACTIVE + + // Before deadline: higher-rate pending dominates the combined claim. + uint256 beforeDeadline = _recurringCollector.getMaxNextClaim(agreementId); + assertGt(beforeDeadline, activeClaim, "live pending dominates before its deadline"); + + // Warp one second past the pending's deadline. endsAt is still well in the future, so + // _maxClaimForTerms would still return a large number — but the pending can no longer + // be accepted via update(), so it must not contribute. + vm.warp(uint256(pendingDeadline) + 1); + + uint256 pendingScopeAfter = _recurringCollector.getMaxNextClaim(agreementId, 2); // SCOPE_PENDING + assertEq(pendingScopeAfter, 0, "expired pending returns 0 under SCOPE_PENDING"); + + uint256 combinedAfter = _recurringCollector.getMaxNextClaim(agreementId); + uint256 activeAfter = _recurringCollector.getMaxNextClaim(agreementId, 1); + assertEq(combinedAfter, activeAfter, "combined scope falls back to active-only after pending expires"); + } + /* solhint-enable graph/func-name-mixedcase */ } diff --git a/packages/horizon/test/unit/payments/recurring-collector/hashRoundTrip.t.sol b/packages/horizon/test/unit/payments/recurring-collector/hashRoundTrip.t.sol index 7c5c73cbe..cc75e78d9 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/hashRoundTrip.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/hashRoundTrip.t.sol @@ -177,8 +177,8 @@ contract RecurringCollectorHashRoundTripTest is RecurringCollectorSharedTest { IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); assertEq(agreement.activeTermsHash, rcauHash, "activeTermsHash should be RCAU hash after update"); - // Stored update offer persists after update - _verifyOfferRoundTrip(agreementId, 1, rcauHash); + // After update, RCAU becomes the active version (VERSION_CURRENT = 0) + _verifyOfferRoundTrip(agreementId, 0, rcauHash); } // ==================== Cancel pending, active stays ==================== diff --git a/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol b/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol index 120214815..659979dee 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol @@ -76,8 +76,7 @@ contract RecurringCollectorMixedPathTest is RecurringCollectorSharedTest { // Verify updated terms IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); - assertEq(agreement.maxOngoingTokensPerSecond, rcau.maxOngoingTokensPerSecond); - assertEq(agreement.maxSecondsPerCollection, rcau.maxSecondsPerCollection); + assertEq(agreement.activeTermsHash, _recurringCollector.hashRCAU(rcau)); assertEq(agreement.updateNonce, 1); } @@ -195,9 +194,87 @@ contract RecurringCollectorMixedPathTest is RecurringCollectorSharedTest { _recurringCollector.update(rcau, updateSig); IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); - assertEq(agreement.maxOngoingTokensPerSecond, rcau.maxOngoingTokensPerSecond); + assertEq(agreement.activeTermsHash, _recurringCollector.hashRCAU(rcau)); assertEq(agreement.updateNonce, 1); } + /// @notice Replacing the active offer preserves an independent pending RCAU. The update is + /// still a valid signed offer against the same agreementId; the payer may cancel it + /// explicitly if they don't want it. The contract shouldn't silently invalidate it. + function test_MixedPath_OfferNew_PreservesPendingRcau() public { + MockAgreementOwner approver = new MockAgreementOwner(); + + IRecurringCollector.RecurringCollectionAgreement memory rca1 = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: 0, + endsAt: 0, + payer: address(approver), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + // Derive the deterministic agreement ID from rca1's post-sensible fields. + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca1.payer, + rca1.dataService, + rca1.serviceProvider, + rca1.deadline, + rca1.nonce + ); + + // Step 1: offer RCA → active = hashRCA(rca1) + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca1), 0); + bytes32 rca1Hash = _recurringCollector.hashRCA(rca1); + + // Step 2: offer RCAU → pending = hashRCAU(rcau) + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _recurringCollectorHelper.sensibleRCAU( + IRecurringCollector.RecurringCollectionAgreementUpdate({ + agreementId: agreementId, + deadline: 0, + endsAt: 0, + maxInitialTokens: 200 ether, + maxOngoingTokensPerSecond: 2 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 7200, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + bytes32 rcauHash = _recurringCollector.hashRCAU(rcau); + + // Pre-check: pending is set + IRecurringCollector.AgreementData memory before = _recurringCollector.getAgreement(agreementId); + assertEq(before.activeTermsHash, rca1Hash, "active should be rca1Hash after offer"); + assertEq(before.pendingTermsHash, rcauHash, "pending should be rcauHash after offer UPDATE"); + + // Step 3: offer different RCA with same primary fields (same agreementId, different terms) + IRecurringCollector.RecurringCollectionAgreement memory rca2 = rca1; + rca2.maxInitialTokens = 999 ether; // different terms → different hash, same agreementId + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca2), 0); + bytes32 rca2Hash = _recurringCollector.hashRCA(rca2); + + // Post-check: active replaced, pending preserved (still the original RCAU) + IRecurringCollector.AgreementData memory afterOffer = _recurringCollector.getAgreement(agreementId); + assertEq(afterOffer.activeTermsHash, rca2Hash, "active should be rca2Hash"); + assertEq(afterOffer.pendingTermsHash, rcauHash, "pending RCAU should still be queued"); + + // The pending offer's $.terms entry must still be retrievable — payer can still accept it + (uint8 pendingType, bytes memory pendingData) = _recurringCollector.getAgreementOfferAt(agreementId, 1); + assertEq(pendingType, OFFER_TYPE_UPDATE, "pending slot should still hold update offer"); + assertEq(keccak256(pendingData), keccak256(abi.encode(rcau)), "pending data should be the original RCAU"); + } + /* solhint-enable graph/func-name-mixedcase */ } diff --git a/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol b/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol index 0aece90ae..a4988b4b0 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol @@ -215,7 +215,7 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared /// @notice Pre-acceptance cancel of the RCA under SCOPE_PENDING deletes BOTH the RCA offer /// and any pending RCAU offer. After cascade, both slots are empty. - function test_CancelPreAcceptanceRca_CascadesDeleteRcau() public { + function test_CancelPreAcceptanceRca_PreservesPendingRcau() public { MockAgreementOwner approver = new MockAgreementOwner(); IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); bytes32 rcaHash = _recurringCollector.hashRCA(rca); @@ -239,7 +239,7 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared assertEq(preCurrentType, OFFER_TYPE_NEW, "RCA stored before cancel"); assertEq(preNextType, OFFER_TYPE_UPDATE, "RCAU stored before cancel"); - // Cancel the pre-acceptance RCA — one OfferCancelled event, both slots cleared + // Cancel the pre-acceptance RCA — one OfferCancelled event; pending RCAU survives vm.expectEmit(address(_recurringCollector)); emit IRecurringCollector.OfferCancelled(address(approver), agreementId, rcaHash); vm.prank(address(approver)); @@ -247,7 +247,7 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); assertEq(agreement.activeTermsHash, bytes32(0), "activeTermsHash cleared"); - assertEq(agreement.pendingTermsHash, bytes32(0), "pendingTermsHash cascade-cleared"); + assertEq(agreement.pendingTermsHash, rcauHash, "pendingTermsHash survives RCA cancel"); (uint8 currentType, bytes memory currentData) = _recurringCollector.getAgreementOfferAt( agreementId, @@ -257,19 +257,14 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared assertEq(currentData.length, 0, "RCA data empty"); (uint8 nextType, bytes memory nextData) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_NEXT); - assertEq(nextType, OFFER_TYPE_NONE, "RCAU offer cascade-deleted"); - assertEq(nextData.length, 0, "RCAU data empty"); - - // The original rcauHash stored-offer entry is no longer referenced. No version hash - // resolves to it — confirmed above — so the cleanup is complete for view purposes. - rcauHash; // silence unused warning; kept for clarity in the narrative + assertEq(nextType, OFFER_TYPE_UPDATE, "RCAU offer still retrievable"); + assertEq(keccak256(nextData), keccak256(abi.encode(rcau)), "RCAU data intact"); } - /// @notice After a pre-acceptance cascade delete, a follow-up cancel targeting the orphan RCAU - /// hash must NOT revert: _requirePayerIfExists short-circuits because agreement.payer was - /// zeroed when activeTermsHash was cleared — but the agreement struct still exists. The cancel - /// is therefore a no-op targeting already-empty state. - function test_CancelPreAcceptanceRca_SubsequentRcauCancel_DoesNotRevert() public { + /// @notice Pre-acceptance RCA and pending RCAU can be cancelled in either order — + /// agreement.payer is a persistent field, so cancelling one doesn't un-authorize cancelling + /// the other. + function test_CancelPreAcceptance_EitherOrder() public { MockAgreementOwner approver = new MockAgreementOwner(); IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); bytes32 rcaHash = _recurringCollector.hashRCA(rca); @@ -287,15 +282,19 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared vm.prank(address(approver)); _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); - // Cancel the RCA — cascades the RCAU + // Cancel the RCA first vm.prank(address(approver)); _recurringCollector.cancel(agreementId, rcaHash, SCOPE_PENDING); - // The approver can still cancel(rcauHash) without reverting — the payer slot on the - // agreement is still set (clearing is by *termsHash*, not payer field), so the call - // enters the pending-hash branch, observes pendingTermsHash == 0, and exits silently. + // Then cancel the pending RCAU — must succeed because agreement.payer is persistent + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferCancelled(address(approver), agreementId, rcauHash); vm.prank(address(approver)); _recurringCollector.cancel(agreementId, rcauHash, SCOPE_PENDING); + + IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); + assertEq(agreement.activeTermsHash, bytes32(0), "active cleared"); + assertEq(agreement.pendingTermsHash, bytes32(0), "pending cleared"); } /// @notice Pre-acceptance cancel with no pending RCAU still deletes the RCA offer and diff --git a/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol b/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol index 84eab9b75..38652d81a 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol @@ -98,11 +98,7 @@ contract RecurringCollectorUpdateUnsignedTest is RecurringCollectorSharedTest { _recurringCollector.update(rcau, ""); IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); - assertEq(rcau.endsAt, agreement.endsAt); - assertEq(rcau.maxInitialTokens, agreement.maxInitialTokens); - assertEq(rcau.maxOngoingTokensPerSecond, agreement.maxOngoingTokensPerSecond); - assertEq(rcau.minSecondsPerCollection, agreement.minSecondsPerCollection); - assertEq(rcau.maxSecondsPerCollection, agreement.maxSecondsPerCollection); + assertEq(agreement.activeTermsHash, _recurringCollector.hashRCAU(rcau)); assertEq(rcau.nonce, agreement.updateNonce); } diff --git a/packages/horizon/test/unit/payments/recurring-collector/upgradeScenario.t.sol b/packages/horizon/test/unit/payments/recurring-collector/upgradeScenario.t.sol index f65fe9464..82d2a1468 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/upgradeScenario.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/upgradeScenario.t.sol @@ -129,7 +129,7 @@ contract RecurringCollectorUpgradeScenarioTest is Test, Bounder { assertEq(v2Agreement.payer, payer, "payer lost"); assertEq(v2Agreement.serviceProvider, rca.serviceProvider, "serviceProvider lost"); assertEq(v2Agreement.dataService, rca.dataService, "dataService lost"); - assertEq(v2Agreement.maxOngoingTokensPerSecond, rca.maxOngoingTokensPerSecond, "terms lost"); + assertEq(v2Agreement.activeTermsHash, _recurringCollector.hashRCA(rca), "terms hash lost"); assertTrue(_recurringCollector.pauseGuardians(makeAddr("guardian")), "pause guardian lost"); } diff --git a/packages/horizon/test/unit/payments/recurring-collector/viewFunctions.t.sol b/packages/horizon/test/unit/payments/recurring-collector/viewFunctions.t.sol index 839cd146e..80445920b 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/viewFunctions.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/viewFunctions.t.sol @@ -15,10 +15,8 @@ contract RecurringCollectorViewFunctionsTest is RecurringCollectorSharedTest { function test_GetCollectionInfo_Accepted_AfterTime(FuzzyTestAccept calldata fuzzy) public { (, , , bytes16 agreementId) = _sensibleAuthorizeAndAccept(fuzzy); - IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); - - // Skip some time - skip(agreement.minSecondsPerCollection); + // Skip past the minimum collection window so collection is possible + skip(_recurringCollector.MIN_SECONDS_COLLECTION_WINDOW()); // Re-read agreement (timestamps don't change but view computes based on block.timestamp) (bool isCollectable, uint256 collectionSeconds, ) = _recurringCollector.getCollectionInfo(agreementId); @@ -129,22 +127,13 @@ contract RecurringCollectorViewFunctionsTest is RecurringCollectorSharedTest { assertEq(agreement.payer, rca.payer, "payer should match"); assertEq(agreement.dataService, rca.dataService, "dataService should match"); assertEq(agreement.serviceProvider, rca.serviceProvider, "serviceProvider should match"); - assertEq(agreement.endsAt, rca.endsAt, "endsAt should match"); - assertEq(agreement.minSecondsPerCollection, rca.minSecondsPerCollection, "minSeconds should match"); - assertEq(agreement.maxSecondsPerCollection, rca.maxSecondsPerCollection, "maxSeconds should match"); - assertEq(agreement.maxInitialTokens, rca.maxInitialTokens, "maxInitialTokens should match"); - assertEq( - agreement.maxOngoingTokensPerSecond, - rca.maxOngoingTokensPerSecond, - "maxOngoingTokensPerSecond should match" - ); assertEq( uint8(agreement.state), uint8(IRecurringCollector.AgreementState.Accepted), "state should be Accepted" ); assertTrue(agreement.acceptedAt > 0, "acceptedAt should be set"); - assertTrue(agreement.activeTermsHash != bytes32(0), "activeTermsHash should be set"); + assertEq(agreement.activeTermsHash, _recurringCollector.hashRCA(rca), "activeTermsHash should match RCA hash"); } /* solhint-enable graph/func-name-mixedcase */ diff --git a/packages/interfaces/contracts/horizon/IRecurringCollector.sol b/packages/interfaces/contracts/horizon/IRecurringCollector.sol index 6315033e2..74ccde753 100644 --- a/packages/interfaces/contracts/horizon/IRecurringCollector.sol +++ b/packages/interfaces/contracts/horizon/IRecurringCollector.sol @@ -316,11 +316,11 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { error RecurringCollectorAgreementAddressNotSet(); /** - * @notice Thrown when accepting or upgrading an agreement with an elapsed endsAt - * @param currentTimestamp The current timestamp + * @notice Thrown when an agreement's endsAt is not strictly after its acceptance deadline. + * @param deadline The offer acceptance deadline * @param endsAt The agreement end timestamp */ - error RecurringCollectorAgreementElapsedEndsAt(uint256 currentTimestamp, uint64 endsAt); + error RecurringCollectorAgreementEndsBeforeDeadline(uint64 deadline, uint64 endsAt); /** * @notice Thrown when accepting or upgrading an agreement with an elapsed endsAt diff --git a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/accept.t.sol b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/accept.t.sol index b2853949d..77be7c67d 100644 --- a/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/accept.t.sol +++ b/packages/subgraph-service/test/unit/subgraphService/indexing-agreement/accept.t.sol @@ -473,5 +473,63 @@ contract SubgraphServiceIndexingAgreementAcceptTest is SubgraphServiceIndexingAg ); assertEq(afterOldClose.agreement.allocationId, secondAllocationId, "still bound to second allocation"); } + + /// @notice Rebinding an already-accepted agreement to a new allocation must still succeed after + /// the original RCA's acceptance deadline has elapsed. The collector's idempotent short-circuit + /// runs before the deadline check — same-hash re-accept is a no-op and does not consume the + /// signature's lifetime. Without this, indexers could not move agreements across allocations + /// after the typically-short RCA acceptance window closes. + function test_SubgraphService_AcceptIndexingAgreement_Rebinds_AfterRcaDeadline( + Seed memory seed, + uint256 secondAllocationKey + ) public { + Context storage ctx = _newCtx(seed); + IndexerState memory indexerState = _withIndexer(ctx); + ( + IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, + bytes16 agreementId + ) = _withAcceptedIndexingAgreement(ctx, indexerState); + + // Top up provision and allocate a second allocation on the same subgraph deployment. + uint256 extraTokens = 10_000_000 ether; + deal({ token: address(token), to: indexerState.addr, give: extraTokens }); + resetPrank(indexerState.addr); + _addToProvision(indexerState.addr, extraTokens); + + secondAllocationKey = boundKey(secondAllocationKey); + address secondAllocationId = vm.addr(secondAllocationKey); + vm.assume(secondAllocationId != indexerState.allocationId); + vm.assume(ctx.allocations[secondAllocationId] == address(0)); + ctx.allocations[secondAllocationId] = indexerState.addr; + + bytes memory allocData = _createSubgraphAllocationData( + indexerState.addr, + indexerState.subgraphDeploymentId, + secondAllocationKey, + extraTokens + ); + _startService(indexerState.addr, allocData); + + // Warp past the RCA's acceptance deadline. A fresh accept would now revert with + // RecurringCollectorAgreementDeadlineElapsed — the rebind must take the idempotent path. + vm.warp(uint256(acceptedRca.deadline) + 1); + + (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCA( + acceptedRca, + ctx.payer.signerPrivateKey + ); + + resetPrank(indexerState.addr); + bytes16 returnedId = subgraphService.acceptIndexingAgreement(secondAllocationId, acceptedRca, signature); + assertEq(returnedId, agreementId, "rebind after deadline returns same agreementId"); + + IIndexingAgreement.AgreementWrapper memory rebound = subgraphService.getIndexingAgreement(agreementId); + assertEq(rebound.agreement.allocationId, secondAllocationId, "rebound to second allocation after deadline"); + assertEq( + uint8(rebound.collectorAgreement.state), + uint8(IRecurringCollector.AgreementState.Accepted), + "collector state still Accepted after post-deadline rebind" + ); + } /* solhint-enable graph/func-name-mixedcase */ } diff --git a/packages/testing/test/integration/AgreementLifecycleAdvanced.t.sol b/packages/testing/test/integration/AgreementLifecycleAdvanced.t.sol index d20a8e347..95f91f1a0 100644 --- a/packages/testing/test/integration/AgreementLifecycleAdvanced.t.sol +++ b/packages/testing/test/integration/AgreementLifecycleAdvanced.t.sol @@ -600,11 +600,93 @@ contract AgreementLifecycleAdvancedTest is FullStackHarness { ); } + // ═══════════════════════════════════════════════════════════════════ + // Scenario 15: Rebind after cancellation — collector state authority + // ═══════════════════════════════════════════════════════════════════ + + /// @notice Cancellation is terminal at the collector. The SubgraphService rebind path must + /// defer to that authority: an attempt to rebind a cancelled agreement onto a fresh allocation + /// must revert, leaving both the collector state and SS state untouched. Exercises the full + /// offer → accept → cancel → open-second-allocation → rebind-attempt flow end-to-end with the + /// real contract stack. + function test_Scenario15_RebindAfterCancellation_Reverts() public { + IndexingAgreement.IndexingAgreementTermsV1 memory terms = IndexingAgreement.IndexingAgreementTermsV1({ + tokensPerSecond: 0.5 ether, + tokensPerEntityPerSecond: 0 + }); + IRecurringCollector.RecurringCollectionAgreement memory rca = _buildRCA(indexer, 0, 1 ether, 3600, terms); + bytes16 agreementId = _offerAndAccept(indexer, rca); + + // Cancel via the indexer path — CanceledByServiceProvider. + vm.prank(indexer.addr); + subgraphService.cancelIndexingAgreement(indexer.addr, agreementId); + assertEq( + uint8(recurringCollector.getAgreement(agreementId).state), + uint8(IRecurringCollector.AgreementState.CanceledByServiceProvider), + "precondition: cancelled at collector" + ); + + // Open a second allocation on the same subgraph deployment. + (address secondAllocationId, address cancelRebindTarget) = _openSecondAllocationForIndexer( + indexer, + "cancel-rebind-alloc" + ); + assertEq(cancelRebindTarget, indexer.addr, "indexer owns the new allocation"); + + // Attempt rebind to the new allocation. SS would stage the bookkeeping, but collector + // rejects (state != NotAccepted), reverting the whole tx. Both layers stay clean. + vm.prank(indexer.addr); + vm.expectRevert( + abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorAgreementIncorrectState.selector, + agreementId, + IRecurringCollector.AgreementState.CanceledByServiceProvider + ) + ); + subgraphService.acceptIndexingAgreement(secondAllocationId, rca, ""); + + // Post-revert: agreement still cancelled at collector, still bound to old allocation in SS. + assertEq( + uint8(recurringCollector.getAgreement(agreementId).state), + uint8(IRecurringCollector.AgreementState.CanceledByServiceProvider), + "collector state unchanged" + ); + IIndexingAgreement.AgreementWrapper memory wrapper = subgraphService.getIndexingAgreement(agreementId); + assertEq(wrapper.agreement.allocationId, indexer.allocationId, "SS still bound to original allocation"); + } + // ── Helpers ── function _getHardcodedPoiMetadata() internal view returns (bytes memory) { return abi.encode(block.number, bytes32("PUBLIC_POI1"), uint8(0), uint8(0), uint256(0)); } + + /// @notice Top up the indexer's provision and open a second allocation on the same + /// subgraph deployment. Returns the new allocation's id plus the indexer that owns it + /// (both for readability and to let callers assert ownership in a single expression). + function _openSecondAllocationForIndexer( + IndexerSetup memory _indexer, + string memory _label + ) internal returns (address allocationId, address owner) { + uint256 extraTokens = MINIMUM_PROVISION_TOKENS; + _addProvisionTokens(_indexer, extraTokens); + + uint256 allocationKey; + (allocationId, allocationKey) = makeAddrAndKey(_label); + + bytes32 digest = subgraphService.encodeAllocationProof(_indexer.addr, allocationId); + (uint8 v, bytes32 r, bytes32 s) = vm.sign(allocationKey, digest); + bytes memory allocationData = abi.encode( + _indexer.subgraphDeploymentId, + extraTokens, + allocationId, + abi.encodePacked(r, s, v) + ); + vm.prank(_indexer.addr); + subgraphService.startService(_indexer.addr, allocationData); + + owner = _indexer.addr; + } } /// @notice Mock eligibility oracle for testing From b6adbf16ba8fa165d29b11c20e1e449cc8dd31e0 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 27 Apr 2026 11:42:40 +0000 Subject: [PATCH 26/47] refactor(collector): extract _getAgreementDetails/_versionHashAt helpers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Preparatory step for TRST-L-11 (per-version semantics) and TRST-L-8 (SCOPE_SIGNED cancel) — minimizes thrash in those commits. Not the final correct implementation: index is passed through but only VERSION_CURRENT and VERSION_NEXT are distinguished, getAgreementOfferAt still uses OFFER_TYPE_* indexing, and _versionHashAt still keys VERSION_CURRENT off agreement.state because activeTermsHash is not yet persisted pre-acceptance (lands in TRST-L-7). - offer() routes through _getAgreementDetails(id, versionHash, index) using tuple-returning _offerNew/_offerUpdate (id, versionHash, index). The offer path supplies the hash it just produced; the helper avoids re-reading storage to recompute it. - _versionHashAt resolves the offer hash for the requested version: pre-acceptance CURRENT reads rcaOffers; post-acceptance CURRENT reads agreement.activeTermsHash; NEXT reads rcauOffers but skips when the stored RCAU is already the active version. - getAgreementDetails(id, index) looks up the hash via _versionHashAt and forwards to _getAgreementDetails. The helper returns empty when versionHash is zero, treating "no version exists" uniformly across both call sites. State semantics preserved: REGISTERED for pre-acceptance current, ACCEPTED for post-acceptance current, REGISTERED|UPDATE for any pending RCAU. --- .../collectors/RecurringCollector.sol | 108 ++++++++++++------ 1 file changed, 73 insertions(+), 35 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 79c8b4491..40dc65ba1 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -21,9 +21,10 @@ import { OFFER_TYPE_UPDATE, ACCEPTED, REGISTERED, - UPDATE, SCOPE_ACTIVE, - SCOPE_PENDING + SCOPE_PENDING, + VERSION_CURRENT, + VERSION_NEXT } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; import { IGraphPayments } from "@graphprotocol/interfaces/contracts/horizon/IGraphPayments.sol"; @@ -423,46 +424,51 @@ contract RecurringCollector is bytes calldata data, uint16 /* options */ ) external whenNotPaused returns (AgreementDetails memory details) { - if (offerType == OFFER_TYPE_NEW) details = _offerNew(data); - else if (offerType == OFFER_TYPE_UPDATE) details = _offerUpdate(data); + bytes16 agreementId; + bytes32 versionHash; + uint256 index; + if (offerType == OFFER_TYPE_NEW) (agreementId, versionHash, index) = _offerNew(data); + else if (offerType == OFFER_TYPE_UPDATE) (agreementId, versionHash, index) = _offerUpdate(data); else revert RecurringCollectorInvalidCollectData(data); + + details = _getAgreementDetails(agreementId, versionHash, index); } /** * @notice Process a new offer (OFFER_TYPE_NEW). * @param _data The ABI-encoded RecurringCollectionAgreement - * @return details The agreement details + * @return agreementId The deterministic agreement ID + * @return versionHash The EIP-712 hash of the stored offer + * @return index The version index for the offered terms (always VERSION_CURRENT for NEW) */ - function _offerNew(bytes calldata _data) private returns (AgreementDetails memory details) { + function _offerNew(bytes calldata _data) private returns (bytes16 agreementId, bytes32 versionHash, uint256 index) { RecurringCollectorStorage storage $ = _getStorage(); RecurringCollectionAgreement memory rca = abi.decode(_data, (RecurringCollectionAgreement)); - (bytes16 agreementId, bytes32 rcaHash) = _rcaIdAndHash(rca); + (agreementId, versionHash) = _rcaIdAndHash(rca); require(msg.sender == rca.payer, RecurringCollectorUnauthorizedCaller(msg.sender, rca.payer)); _requirePayerToSupportEligibilityCheck(rca.payer, rca.conditions); - $.rcaOffers[agreementId] = StoredOffer({ offerHash: rcaHash, data: _data }); - - details.agreementId = agreementId; - details.payer = rca.payer; - details.dataService = rca.dataService; - details.serviceProvider = rca.serviceProvider; - details.versionHash = rcaHash; - details.state = REGISTERED; + $.rcaOffers[agreementId] = StoredOffer({ offerHash: versionHash, data: _data }); + emit OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, versionHash); - emit OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, rcaHash); + index = VERSION_CURRENT; } /** * @notice Process an update offer (OFFER_TYPE_UPDATE). * @param _data The ABI-encoded RecurringCollectionAgreementUpdate - * @return details The agreement details + * @return agreementId The agreement ID being updated + * @return versionHash The EIP-712 hash of the stored RCAU + * @return index VERSION_NEXT — the queued pending update */ - function _offerUpdate(bytes calldata _data) private returns (AgreementDetails memory details) { + function _offerUpdate( + bytes calldata _data + ) private returns (bytes16 agreementId, bytes32 versionHash, uint256 index) { RecurringCollectorStorage storage $ = _getStorage(); RecurringCollectionAgreementUpdate memory rcau = abi.decode(_data, (RecurringCollectionAgreementUpdate)); - bytes16 agreementId = rcau.agreementId; + agreementId = rcau.agreementId; // Payer check: look up the existing agreement or the stored RCA offer AgreementData storage agreement = $.agreements[agreementId]; @@ -478,25 +484,16 @@ contract RecurringCollector is (RecurringCollectionAgreement) ); payer = rca.payer; - details.dataService = rca.dataService; - details.serviceProvider = rca.serviceProvider; - } else { - details.dataService = agreement.dataService; - details.serviceProvider = agreement.serviceProvider; } require(msg.sender == payer, RecurringCollectorUnauthorizedCaller(msg.sender, payer)); _requirePayerToSupportEligibilityCheck(payer, rcau.conditions); - bytes32 offerHash = _hashRCAU(rcau); - - $.rcauOffers[agreementId] = StoredOffer({ offerHash: offerHash, data: _data }); + versionHash = _hashRCAU(rcau); - details.agreementId = agreementId; - details.payer = payer; - details.versionHash = offerHash; - details.state = REGISTERED | UPDATE; + $.rcauOffers[agreementId] = StoredOffer({ offerHash: versionHash, data: _data }); + emit OfferStored(agreementId, payer, OFFER_TYPE_UPDATE, versionHash); - emit OfferStored(agreementId, payer, OFFER_TYPE_UPDATE, offerHash); + index = VERSION_NEXT; } /// @inheritdoc IAgreementCollector @@ -542,10 +539,29 @@ contract RecurringCollector is } /// @inheritdoc IAgreementCollector - function getAgreementDetails( + function getAgreementDetails(bytes16 agreementId, uint256 index) external view returns (AgreementDetails memory) { + return _getAgreementDetails(agreementId, _versionHashAt(agreementId, index), index); + } + + /** + * @notice Builds AgreementDetails for the requested version. Shared by {offer} and + * {getAgreementDetails}. + * @dev Caller supplies the version hash. {offer} passes the hash returned by _offerNew / + * _offerUpdate (already known from the just-stored offer); {getAgreementDetails} resolves + * it via _versionHashAt. Returns empty details when versionHash is zero. The `index` + * parameter is plumbed through for TRST-L-11 (per-version flag composition) and is unused + * at this stage. + * @param agreementId The agreement ID + * @param versionHash The EIP-712 hash of the queried version, or bytes32(0) if none + * @return details AgreementDetails for the queried version, or empty when no version exists + */ + function _getAgreementDetails( bytes16 agreementId, + bytes32 versionHash, uint256 /* index */ - ) external view returns (AgreementDetails memory details) { + ) private view returns (AgreementDetails memory details) { + if (versionHash == bytes32(0)) return details; + RecurringCollectorStorage storage $ = _getStorage(); AgreementData storage agreement = $.agreements[agreementId]; @@ -554,7 +570,7 @@ contract RecurringCollector is details.payer = agreement.payer; details.dataService = agreement.dataService; details.serviceProvider = agreement.serviceProvider; - details.versionHash = agreement.activeTermsHash; + details.versionHash = versionHash; details.state = ACCEPTED; return details; } @@ -572,6 +588,28 @@ contract RecurringCollector is } } + /** + * @notice Resolve the offer hash representing a given version (VERSION_CURRENT or VERSION_NEXT). + * @dev Returns bytes32(0) when no version exists at that index. + * @param agreementId The agreement ID + * @param index The version index (VERSION_CURRENT or VERSION_NEXT) + * @return hash The EIP-712 hash of the offer at that version, or bytes32(0) if none + */ + function _versionHashAt(bytes16 agreementId, uint256 index) private view returns (bytes32 hash) { + RecurringCollectorStorage storage $ = _getStorage(); + AgreementData storage agreement = $.agreements[agreementId]; + + if (index == VERSION_CURRENT) + hash = (agreement.state == AgreementState.NotAccepted) + ? $.rcaOffers[agreementId].offerHash + : agreement.activeTermsHash; + else if (index == VERSION_NEXT) { + bytes32 rcauHash = $.rcauOffers[agreementId].offerHash; + // Skip when rcauOffers still holds an applied RCAU — that's the current version, not next. + if (rcauHash != agreement.activeTermsHash) hash = rcauHash; + } + } + /// @inheritdoc IAgreementCollector function getMaxNextClaim(bytes16 agreementId, uint8 agreementScope) external view returns (uint256) { return _getMaxNextClaimScoped(agreementId, agreementScope); From 8b48437be1336e7bb8e218a91eaec4c8caee3a71 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 27 Apr 2026 11:47:10 +0000 Subject: [PATCH 27/47] fix(collector): persistent agreement.payer for independent cancellation (TRST-L-7) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Persist agreement.payer (and dataService/serviceProvider) at offer time rather than waiting until accept(). _requirePayer is replaced by an inline payer check at the cancel() call site now that agreement.payer is the reliable authority — no more fallback decoding of stored RCA data on every cancel. Persistent agreement.payer makes cancelling a pre-acceptance RCA offer and cancelling a pending RCAU offer independent operations that may be performed in either order. Neither path leaves the other unreachable. _offerUpdate also simplifies: it reads agreement.payer/dataService/ serviceProvider directly (set by _offerNew) rather than decoding the stored RCA on every update offer. State guard relaxes to accept {NotAccepted, Accepted} so update offers work post-acceptance. cancel(by) clears any pending RCAU offer at cancellation time — pendingHash != activeTermsHash means the pending offer is now stale and can be reaped. offer() hoists the msg.sender == details.payer authorization out of both _offerNew and _offerUpdate now that details.payer is reliably populated by either path. accept() now stores the RCA offer idempotently (when not already present) so accept-without-prior-offer paths leave the same on-chain trail. update() does the same for RCAU storage. --- .../collectors/RecurringCollector.sol | 117 +++++++++--------- packages/issuance/audits/PR1301/TRST-L-7.md | 9 ++ 2 files changed, 70 insertions(+), 56 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 40dc65ba1..38e815a41 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -214,19 +214,26 @@ contract RecurringCollector is RecurringCollectionAgreement calldata rca, bytes calldata signature ) external whenNotPaused returns (bytes16 agreementId) { + bytes32 rcaHash; + (agreementId, rcaHash) = _rcaIdAndHash(rca); + + RecurringCollectorStorage storage $ = _getStorage(); + AgreementData storage agreement = $.agreements[agreementId]; + require( block.timestamp <= rca.deadline, RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rca.deadline) ); - bytes32 rcaHash; - (agreementId, rcaHash) = _rcaIdAndHash(rca); - _requireAuthorization(rca.payer, rcaHash, signature, agreementId, OFFER_TYPE_NEW); + if ($.rcaOffers[agreementId].offerHash != rcaHash) { + $.rcaOffers[agreementId] = StoredOffer({ offerHash: rcaHash, data: abi.encode(rca) }); + emit OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, rcaHash); + } + _validateAndStoreAgreement(rca, agreementId, rcaHash); - AgreementData storage agreement = _getStorage().agreements[agreementId]; require( agreement.state == AgreementState.NotAccepted, RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) @@ -302,7 +309,8 @@ contract RecurringCollector is * @dev Caller must be the data service for the agreement. */ function cancel(bytes16 agreementId, CancelAgreementBy by) external whenNotPaused { - AgreementData storage agreement = _getAgreementStorage(agreementId); + RecurringCollectorStorage storage $ = _getStorage(); + AgreementData storage agreement = $.agreements[agreementId]; require( agreement.state == AgreementState.Accepted, RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) @@ -318,6 +326,9 @@ contract RecurringCollector is agreement.state = AgreementState.CanceledByServiceProvider; } + bytes32 pendingHash = $.rcauOffers[agreementId].offerHash; + if (pendingHash != bytes32(0) && pendingHash != agreement.activeTermsHash) delete $.rcauOffers[agreementId]; + emit AgreementCanceled(agreement.dataService, agreement.payer, agreement.serviceProvider, agreementId, by); } @@ -346,6 +357,12 @@ contract RecurringCollector is RecurringCollectorInvalidUpdateNonce(rcau.agreementId, expectedNonce, rcau.nonce) ); + RecurringCollectorStorage storage $ = _getStorage(); + if ($.rcauOffers[rcau.agreementId].offerHash != rcauHash) { + $.rcauOffers[rcau.agreementId] = StoredOffer({ offerHash: rcauHash, data: abi.encode(rcau) }); + emit OfferStored(rcau.agreementId, agreement.payer, OFFER_TYPE_UPDATE, rcauHash); + } + _validateAndStoreUpdate(agreement, rcau, rcauHash); agreement.updateNonce = rcau.nonce; @@ -432,6 +449,7 @@ contract RecurringCollector is else revert RecurringCollectorInvalidCollectData(data); details = _getAgreementDetails(agreementId, versionHash, index); + require(msg.sender == details.payer, RecurringCollectorUnauthorizedCaller(msg.sender, details.payer)); } /** @@ -447,11 +465,26 @@ contract RecurringCollector is (agreementId, versionHash) = _rcaIdAndHash(rca); - require(msg.sender == rca.payer, RecurringCollectorUnauthorizedCaller(msg.sender, rca.payer)); - _requirePayerToSupportEligibilityCheck(rca.payer, rca.conditions); + if ($.rcaOffers[agreementId].offerHash != versionHash) { + AgreementData storage agreement = $.agreements[agreementId]; + require( + agreement.state == AgreementState.NotAccepted, + RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) + ); + require( + block.timestamp <= rca.deadline, + RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rca.deadline) + ); + _requirePayerToSupportEligibilityCheck(rca.payer, rca.conditions); + + agreement.payer = rca.payer; + agreement.dataService = rca.dataService; + agreement.serviceProvider = rca.serviceProvider; + agreement.activeTermsHash = versionHash; - $.rcaOffers[agreementId] = StoredOffer({ offerHash: versionHash, data: _data }); - emit OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, versionHash); + $.rcaOffers[agreementId] = StoredOffer({ offerHash: versionHash, data: _data }); + emit OfferStored(agreementId, rca.payer, OFFER_TYPE_NEW, versionHash); + } index = VERSION_CURRENT; } @@ -468,30 +501,25 @@ contract RecurringCollector is ) private returns (bytes16 agreementId, bytes32 versionHash, uint256 index) { RecurringCollectorStorage storage $ = _getStorage(); RecurringCollectionAgreementUpdate memory rcau = abi.decode(_data, (RecurringCollectionAgreementUpdate)); + versionHash = _hashRCAU(rcau); agreementId = rcau.agreementId; - - // Payer check: look up the existing agreement or the stored RCA offer AgreementData storage agreement = $.agreements[agreementId]; - address payer = agreement.payer; - if (payer == address(0)) { - // Not yet accepted — check stored RCA offer payer + + if ($.rcauOffers[agreementId].offerHash != versionHash) { require( - $.rcaOffers[agreementId].offerHash != bytes32(0), - RecurringCollectorAgreementIncorrectState(agreementId, AgreementState.NotAccepted) + block.timestamp <= rcau.deadline, + RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rcau.deadline) ); - RecurringCollectionAgreement memory rca = abi.decode( - $.rcaOffers[agreementId].data, - (RecurringCollectionAgreement) + require( + agreement.payer != address(0) && + (agreement.state == AgreementState.NotAccepted || agreement.state == AgreementState.Accepted), + RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) ); - payer = rca.payer; - } - require(msg.sender == payer, RecurringCollectorUnauthorizedCaller(msg.sender, payer)); - _requirePayerToSupportEligibilityCheck(payer, rcau.conditions); - - versionHash = _hashRCAU(rcau); + _requirePayerToSupportEligibilityCheck(agreement.payer, rcau.conditions); - $.rcauOffers[agreementId] = StoredOffer({ offerHash: versionHash, data: _data }); - emit OfferStored(agreementId, payer, OFFER_TYPE_UPDATE, versionHash); + $.rcauOffers[agreementId] = StoredOffer({ offerHash: versionHash, data: _data }); + emit OfferStored(agreementId, payer, OFFER_TYPE_UPDATE, versionHash); + } index = VERSION_NEXT; } @@ -500,44 +528,21 @@ contract RecurringCollector is function cancel(bytes16 agreementId, bytes32 termsHash, uint16 options) external whenNotPaused { RecurringCollectorStorage storage $ = _getStorage(); AgreementData storage agreement = $.agreements[agreementId]; - _requirePayer($, agreement, agreementId); + address payer = agreement.payer; + require(payer != address(0), RecurringCollectorAgreementNotFound(agreementId)); + require(msg.sender == payer, RecurringCollectorUnauthorizedCaller(msg.sender, payer)); - if (agreement.activeTermsHash != termsHash) { - if (options & SCOPE_PENDING != 0) + if (agreement.activeTermsHash != termsHash || agreement.state == AgreementState.NotAccepted) { + if (options & SCOPE_PENDING != 0) { // Pending scope: delete stored offer if hash matches and terms are not currently active if ($.rcaOffers[agreementId].offerHash == termsHash) delete $.rcaOffers[agreementId]; else if ($.rcauOffers[agreementId].offerHash == termsHash) delete $.rcauOffers[agreementId]; + } } else if (options & SCOPE_ACTIVE != 0 && agreement.state == AgreementState.Accepted) // Active scope and hash matches: cancel accepted agreement IDataServiceAgreements(agreement.dataService).cancelIndexingAgreementByPayer(agreementId); } - /** - * @notice Requires that msg.sender is the payer for an agreement. - * @dev Checks the on-chain agreement first, then falls back to stored RCA offer. - * @param agreement The agreement data - * @param agreementId The agreement ID - */ - // solhint-disable-next-line use-natspec - function _requirePayer( - RecurringCollectorStorage storage $, - AgreementData storage agreement, - bytes16 agreementId - ) private view { - if (agreement.payer == msg.sender) return; - - // Not payer on accepted agreement — check stored RCA offer - StoredOffer storage rcaOffer = $.rcaOffers[agreementId]; - if (rcaOffer.offerHash != bytes32(0)) { - RecurringCollectionAgreement memory rca = abi.decode(rcaOffer.data, (RecurringCollectionAgreement)); - require(msg.sender == rca.payer, RecurringCollectorUnauthorizedCaller(msg.sender, rca.payer)); - return; - } - if (agreement.payer == address(0)) revert RecurringCollectorAgreementNotFound(agreementId); - - revert RecurringCollectorUnauthorizedCaller(msg.sender, agreement.payer); - } - /// @inheritdoc IAgreementCollector function getAgreementDetails(bytes16 agreementId, uint256 index) external view returns (AgreementDetails memory) { return _getAgreementDetails(agreementId, _versionHashAt(agreementId, index), index); diff --git a/packages/issuance/audits/PR1301/TRST-L-7.md b/packages/issuance/audits/PR1301/TRST-L-7.md index 1eee39005..187e23e61 100644 --- a/packages/issuance/audits/PR1301/TRST-L-7.md +++ b/packages/issuance/audits/PR1301/TRST-L-7.md @@ -20,3 +20,12 @@ Extend `_requirePayer()` to also check `rcauOffers` for a payer match when neith TBD --- + +Resolved by persisting `agreement.payer` from the first `offer()` instead of waiting until +`accept()`. `_requirePayer` is replaced by an inline `agreement.payer` check at the +`cancel()` call site, reading the persisted address directly without falling back through +`rcaOffers`. `_offerUpdate` likewise reads `agreement.payer` instead of decoding the +stored RCA bytes on every update offer. As a consequence, cancelling a pre-acceptance +RCA offer and cancelling a pending RCAU offer are fully independent operations that may +be performed in either order — neither path leaves the other unreachable, because the +persistent `agreement.payer` continues to authorize the surviving offer. From 769b252e531af047b008a7d47e5e0ce62afcd88a Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 27 Apr 2026 10:08:12 +0000 Subject: [PATCH 28/47] feat(collector): idempotent accept/update/cancel-on-nothing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Align re-accept, re-update, and cancel-on-nothing semantics so duplicate calls with the same signed terms are no-ops rather than reverts, and cancel against a nonexistent agreement is a silent no-op. - accept(): short-circuits when state == Accepted and the stored activeTermsHash already equals the incoming RCA hash. Re-accepting the same signed RCA is a no-op (skips deadline + auth). Cancelled agreements still revert — re-accept of a cancelled agreement is never valid. The state == NotAccepted require is dropped: the short-circuit handles re-accept-same, and _requireAuthorization handles re-accept-different (signature won't match a different hash). - update(): short-circuits when activeTermsHash already equals the RCAU hash, skipping deadline and authorization checks on the idempotent path. - cancel(): when no agreement or stored offer exists (agreement.payer == 0) the call returns silently instead of reverting with RecurringCollectorAgreementNotFound. Cancel against nothing is a no-op — same idempotent spirit. Built on top of TRST-L-7's persistent agreement.payer. --- .../collectors/RecurringCollector.sol | 17 ++-- .../payments/recurring-collector/accept.t.sol | 16 ++-- .../recurring-collector/acceptUnsigned.t.sol | 14 +-- .../recurring-collector/coverageGaps.t.sol | 8 +- .../payments/recurring-collector/update.t.sol | 86 +++++++++++++++++-- 5 files changed, 106 insertions(+), 35 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 38e815a41..d23276be0 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -220,6 +220,9 @@ contract RecurringCollector is RecurringCollectorStorage storage $ = _getStorage(); AgreementData storage agreement = $.agreements[agreementId]; + // Idempotent: already accepted with the same hash → no-op (skip deadline + auth). + if (agreement.state == AgreementState.Accepted && agreement.activeTermsHash == rcaHash) return agreementId; + require( block.timestamp <= rca.deadline, RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rca.deadline) @@ -234,10 +237,6 @@ contract RecurringCollector is _validateAndStoreAgreement(rca, agreementId, rcaHash); - require( - agreement.state == AgreementState.NotAccepted, - RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) - ); agreement.acceptedAt = uint64(block.timestamp); agreement.state = AgreementState.Accepted; @@ -342,13 +341,17 @@ contract RecurringCollector is function update(RecurringCollectionAgreementUpdate calldata rcau, bytes calldata signature) external whenNotPaused { AgreementData storage agreement = _requireValidUpdateTarget(rcau.agreementId); + bytes32 rcauHash = _hashRCAU(rcau); + + // Idempotent: already at this version (state is Accepted per _requireValidUpdateTarget). + // Skip deadline + auth since no state change happens. + if (agreement.activeTermsHash == rcauHash) return; + require( block.timestamp <= rcau.deadline, RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rcau.deadline) ); - bytes32 rcauHash = _hashRCAU(rcau); - _requireAuthorization(agreement.payer, rcauHash, signature, rcau.agreementId, OFFER_TYPE_UPDATE); uint32 expectedNonce = agreement.updateNonce + 1; @@ -529,7 +532,7 @@ contract RecurringCollector is RecurringCollectorStorage storage $ = _getStorage(); AgreementData storage agreement = $.agreements[agreementId]; address payer = agreement.payer; - require(payer != address(0), RecurringCollectorAgreementNotFound(agreementId)); + if (payer == address(0)) return; require(msg.sender == payer, RecurringCollectorUnauthorizedCaller(msg.sender, payer)); if (agreement.activeTermsHash != termsHash || agreement.state == AgreementState.NotAccepted) { diff --git a/packages/horizon/test/unit/payments/recurring-collector/accept.t.sol b/packages/horizon/test/unit/payments/recurring-collector/accept.t.sol index f36eb50e0..fb7c06cb1 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/accept.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/accept.t.sol @@ -26,6 +26,8 @@ contract RecurringCollectorAcceptTest is RecurringCollectorSharedTest { ) public { // Ensure non-empty signature so the signed path is taken (which checks deadline first) vm.assume(fuzzySignature.length > 0); + // Pranking as the proxy admin hits ProxyDeniedAdminAccess before the deadline check. + vm.assume(fuzzyRCA.dataService != _proxyAdmin); // Generate deterministic agreement ID for validation bytes16 agreementId = _recurringCollector.generateAgreementId( fuzzyRCA.payer, @@ -48,7 +50,7 @@ contract RecurringCollectorAcceptTest is RecurringCollectorSharedTest { _recurringCollector.accept(fuzzyRCA, fuzzySignature); } - function test_Accept_Revert_WhenAlreadyAccepted(FuzzyTestAccept calldata fuzzyTestAccept) public { + function test_Accept_Idempotent_WhenAlreadyAccepted(FuzzyTestAccept calldata fuzzyTestAccept) public { ( IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, bytes memory signature, @@ -56,14 +58,12 @@ contract RecurringCollectorAcceptTest is RecurringCollectorSharedTest { bytes16 agreementId ) = _sensibleAuthorizeAndAccept(fuzzyTestAccept); - bytes memory expectedErr = abi.encodeWithSelector( - IRecurringCollector.RecurringCollectorAgreementIncorrectState.selector, - agreementId, - IRecurringCollector.AgreementState.Accepted - ); - vm.expectRevert(expectedErr); + // Re-accepting the same RCA is a no-op — succeeds without reverting or re-emitting. + vm.recordLogs(); vm.prank(acceptedRca.dataService); - _recurringCollector.accept(acceptedRca, signature); + bytes16 returnedId = _recurringCollector.accept(acceptedRca, signature); + assertEq(returnedId, agreementId); + assertEq(vm.getRecordedLogs().length, 0, "no event emitted on idempotent re-accept"); } /// @notice Re-accepting an already-accepted RCA at the same hash must still succeed after diff --git a/packages/horizon/test/unit/payments/recurring-collector/acceptUnsigned.t.sol b/packages/horizon/test/unit/payments/recurring-collector/acceptUnsigned.t.sol index fb26e3d99..e535cd130 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/acceptUnsigned.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/acceptUnsigned.t.sol @@ -128,7 +128,7 @@ contract RecurringCollectorAcceptUnsignedTest is RecurringCollectorSharedTest { _recurringCollector.accept(rca, ""); } - function test_AcceptUnsigned_Revert_WhenAlreadyAccepted(FuzzyTestAccept calldata fuzzyTestAccept) public { + function test_AcceptUnsigned_Idempotent_WhenAlreadyAccepted(FuzzyTestAccept calldata fuzzyTestAccept) public { MockAgreementOwner approver = _newApprover(); IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( fuzzyTestAccept.rca @@ -143,16 +143,10 @@ contract RecurringCollectorAcceptUnsignedTest is RecurringCollectorSharedTest { vm.prank(rca.dataService); bytes16 agreementId = _recurringCollector.accept(rca, ""); - // Stored offer persists, so authorization passes but state check fails - vm.expectRevert( - abi.encodeWithSelector( - IRecurringCollector.RecurringCollectorAgreementIncorrectState.selector, - agreementId, - IRecurringCollector.AgreementState.Accepted - ) - ); + // Re-accepting the same RCA is a no-op — succeeds without reverting. vm.prank(rca.dataService); - _recurringCollector.accept(rca, ""); + bytes16 returnedId = _recurringCollector.accept(rca, ""); + assertEq(returnedId, agreementId); } function test_AcceptUnsigned_Revert_WhenDeadlineElapsed() public { diff --git a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol index 977e08c34..8c724f30d 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol @@ -923,16 +923,14 @@ contract RecurringCollectorCoverageGapsTest is RecurringCollectorSharedTest { } // ══════════════════════════════════════════════════════════════════════ - // Gap 16 — _requirePayer: agreement not found (L528) + // Gap 16 — cancel: silent no-op when agreement not found // ══════════════════════════════════════════════════════════════════════ - function test_Cancel_Revert_WhenAgreementNotFound() public { + function test_Cancel_NoOp_WhenAgreementNotFound() public { bytes16 fakeId = bytes16(keccak256("nonexistent")); address caller = makeAddr("randomCaller"); - vm.expectRevert( - abi.encodeWithSelector(IRecurringCollector.RecurringCollectorAgreementNotFound.selector, fakeId) - ); + // Should not revert — nothing exists on-chain, so cancel is a no-op vm.prank(caller); _recurringCollector.cancel(fakeId, bytes32(0), SCOPE_ACTIVE); } diff --git a/packages/horizon/test/unit/payments/recurring-collector/update.t.sol b/packages/horizon/test/unit/payments/recurring-collector/update.t.sol index 57e8f0ad3..158157554 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/update.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/update.t.sol @@ -2,6 +2,7 @@ pragma solidity ^0.8.27; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; +import { OFFER_TYPE_UPDATE } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { RecurringCollectorSharedTest } from "./shared.t.sol"; @@ -153,11 +154,7 @@ contract RecurringCollectorUpdateTest is RecurringCollectorSharedTest { _recurringCollector.update(rcau, signature); IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); - assertEq(rcau.endsAt, agreement.endsAt); - assertEq(rcau.maxInitialTokens, agreement.maxInitialTokens); - assertEq(rcau.maxOngoingTokensPerSecond, agreement.maxOngoingTokensPerSecond); - assertEq(rcau.minSecondsPerCollection, agreement.minSecondsPerCollection); - assertEq(rcau.maxSecondsPerCollection, agreement.maxSecondsPerCollection); + assertEq(agreement.activeTermsHash, _recurringCollector.hashRCAU(rcau)); assertEq(rcau.nonce, agreement.updateNonce); } @@ -313,5 +310,84 @@ contract RecurringCollectorUpdateTest is RecurringCollectorSharedTest { assertEq(updatedAgreement2.updateNonce, 2); } + function test_Update_Idempotent_WhenAlreadyAtActiveHash(FuzzyTestUpdate calldata fuzzyTestUpdate) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, + , + uint256 signerKey, + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestUpdate.fuzzyTestAccept); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _recurringCollectorHelper.sensibleRCAU( + fuzzyTestUpdate.rcau + ); + rcau.agreementId = agreementId; + rcau.nonce = 1; + (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCAU(rcau, signerKey); + + // First update consumes nonce 1 and sets activeTermsHash = hash(rcau). + vm.prank(acceptedRca.dataService); + _recurringCollector.update(rcau, signature); + + IRecurringCollector.AgreementData memory afterFirst = _recurringCollector.getAgreement(agreementId); + assertEq(afterFirst.updateNonce, 1, "nonce advanced to 1 after first update"); + + // Re-submitting the same RCAU is a no-op — nonce does NOT advance, no event, no revert. + vm.recordLogs(); + vm.prank(acceptedRca.dataService); + _recurringCollector.update(rcau, signature); + assertEq(vm.getRecordedLogs().length, 0, "no event emitted on idempotent re-update"); + + IRecurringCollector.AgreementData memory afterSecond = _recurringCollector.getAgreement(agreementId); + assertEq(afterSecond.updateNonce, 1, "nonce unchanged on idempotent re-update"); + assertEq(afterSecond.activeTermsHash, afterFirst.activeTermsHash, "activeTermsHash unchanged"); + } + + /// @notice Direct-apply update (no prior offer(UPDATE) that staged the RCAU as pending) writes + /// new terms via _validateAndStoreTerms, which must emit OfferStored. AgreementUpdated follows. + function test_Update_EmitsOfferStored_WhenDirectApplyFreshTerms(FuzzyTestUpdate calldata fuzzyTestUpdate) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory acceptedRca, + , + uint256 signerKey, + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestUpdate.fuzzyTestAccept); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _recurringCollectorHelper.sensibleRCAU( + fuzzyTestUpdate.rcau + ); + rcau.agreementId = agreementId; + + ( + IRecurringCollector.RecurringCollectionAgreementUpdate memory signedRcau, + bytes memory signature + ) = _recurringCollectorHelper.generateSignedRCAUForAgreement(agreementId, rcau, signerKey); + bytes32 rcauHash = _recurringCollector.hashRCAU(signedRcau); + + // Pre-condition: no pending offer staged, so update() takes the direct-apply branch. + assertEq( + _recurringCollector.getAgreement(agreementId).pendingTermsHash, + bytes32(0), + "no pending before direct-apply" + ); + + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferStored(agreementId, acceptedRca.payer, OFFER_TYPE_UPDATE, rcauHash); + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.AgreementUpdated( + acceptedRca.dataService, + acceptedRca.payer, + acceptedRca.serviceProvider, + agreementId, + signedRcau.endsAt, + signedRcau.maxInitialTokens, + signedRcau.maxOngoingTokensPerSecond, + signedRcau.minSecondsPerCollection, + signedRcau.maxSecondsPerCollection + ); + vm.prank(acceptedRca.dataService); + _recurringCollector.update(signedRcau, signature); + } + /* solhint-enable graph/func-name-mixedcase */ } From f96b4ea6574c2e706861c420597391c8f1c025c9 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sat, 25 Apr 2026 18:06:21 +0000 Subject: [PATCH 29/47] feat(collector): add OfferCancelled event for SCOPE_PENDING cancellations Emit OfferCancelled when cancel() with SCOPE_PENDING deletes a stored RCA or RCAU offer entry. Provides off-chain observability of offer cancellations symmetric to OfferStored. The same event is also emitted by SCOPE_SIGNED cancellations (added in the TRST-L-8 commit on top of this one). --- .../contracts/payments/collectors/RecurringCollector.sol | 9 +++++++-- .../interfaces/contracts/horizon/IRecurringCollector.sol | 9 +++++++++ 2 files changed, 16 insertions(+), 2 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index d23276be0..2acad9862 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -538,8 +538,13 @@ contract RecurringCollector is if (agreement.activeTermsHash != termsHash || agreement.state == AgreementState.NotAccepted) { if (options & SCOPE_PENDING != 0) { // Pending scope: delete stored offer if hash matches and terms are not currently active - if ($.rcaOffers[agreementId].offerHash == termsHash) delete $.rcaOffers[agreementId]; - else if ($.rcauOffers[agreementId].offerHash == termsHash) delete $.rcauOffers[agreementId]; + if ($.rcaOffers[agreementId].offerHash == termsHash) { + delete $.rcaOffers[agreementId]; + emit OfferCancelled(msg.sender, agreementId, termsHash); + } else if ($.rcauOffers[agreementId].offerHash == termsHash) { + delete $.rcauOffers[agreementId]; + emit OfferCancelled(msg.sender, agreementId, termsHash); + } } } else if (options & SCOPE_ACTIVE != 0 && agreement.state == AgreementState.Accepted) // Active scope and hash matches: cancel accepted agreement diff --git a/packages/interfaces/contracts/horizon/IRecurringCollector.sol b/packages/interfaces/contracts/horizon/IRecurringCollector.sol index 74ccde753..c296ddb68 100644 --- a/packages/interfaces/contracts/horizon/IRecurringCollector.sol +++ b/packages/interfaces/contracts/horizon/IRecurringCollector.sol @@ -444,6 +444,15 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { */ event OfferStored(bytes16 indexed agreementId, address indexed payer, uint8 indexed offerType, bytes32 offerHash); + /** + * @notice Emitted when a stored offer is cancelled via {IAgreementCollector.cancel}. + * @dev Fired for SCOPE_PENDING cancellations that delete a stored RCA or RCAU offer entry. + * @param caller The msg.sender of the cancel call (the payer for SCOPE_PENDING) + * @param agreementId The agreement ID + * @param hash The EIP-712 hash of the cancelled offer + */ + event OfferCancelled(address indexed caller, bytes16 indexed agreementId, bytes32 indexed hash); + /** * @notice Pauses the collector, blocking accept, update, collect, and cancel. * @dev Only callable by a pause guardian. Uses OpenZeppelin Pausable. From c1dfc34afa36147d15bcdc822a339b2aa77bdb22 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 27 Apr 2026 11:54:33 +0000 Subject: [PATCH 30/47] feat(collector): per-version semantics in getAgreementDetails (TRST-L-11) Honor the index parameter in getAgreementDetails (previously ignored) and in getAgreementOfferAt (previously used OFFER_TYPE_* values). Per-version flag composition (the queried version, not the underlying agreement): - VERSION_CURRENT: REGISTERED for pre-acceptance offer; REGISTERED | ACCEPTED for accepted active terms; UPDATE additionally set when active terms came from update() (proxy: agreement.updateNonce > 0). Pre-acceptance reads identity from agreement storage (persistent payer from TRST-L-7). - VERSION_NEXT: REGISTERED | UPDATE when a pending RCAU exists, else empty. - index >= 2: empty struct. getAgreementOfferAt mirrored: VERSION_CURRENT returns the active offer (matched by activeTermsHash, RCA pre-update or RCAU post-update); VERSION_NEXT returns the pending RCAU when distinct from the active hash. _offerUpdate's pending result still returns REGISTERED | UPDATE without ACCEPTED. The queried version is the just-stored RCAU, which is not itself accepted (per-version semantics). The auditor's recommendation to OR ACCEPTED is rejected on this point and noted in the audit response. --- .../collectors/RecurringCollector.sol | 71 +++++++++---------- packages/issuance/audits/PR1301/TRST-L-11.md | 11 +++ 2 files changed, 43 insertions(+), 39 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 2acad9862..a44a75525 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -17,10 +17,12 @@ import { IPaymentsCollector } from "@graphprotocol/interfaces/contracts/horizon/ import { IAgreementOwner } from "@graphprotocol/interfaces/contracts/horizon/IAgreementOwner.sol"; import { IAgreementCollector, + OFFER_TYPE_NONE, OFFER_TYPE_NEW, OFFER_TYPE_UPDATE, ACCEPTED, REGISTERED, + UPDATE, SCOPE_ACTIVE, SCOPE_PENDING, VERSION_CURRENT, @@ -497,7 +499,7 @@ contract RecurringCollector is * @param _data The ABI-encoded RecurringCollectionAgreementUpdate * @return agreementId The agreement ID being updated * @return versionHash The EIP-712 hash of the stored RCAU - * @return index VERSION_NEXT — the queued pending update + * @return index VERSION_NEXT, or VERSION_CURRENT if the RCAU has already been applied */ function _offerUpdate( bytes calldata _data @@ -524,7 +526,9 @@ contract RecurringCollector is emit OfferStored(agreementId, payer, OFFER_TYPE_UPDATE, versionHash); } - index = VERSION_NEXT; + // If the offered RCAU has already been applied, its hash matches activeTermsHash and the + // version is now CURRENT, not NEXT (_versionHashAt(NEXT) would return 0 in that case). + index = versionHash == agreement.activeTermsHash ? VERSION_CURRENT : VERSION_NEXT; } /// @inheritdoc IAgreementCollector @@ -540,6 +544,7 @@ contract RecurringCollector is // Pending scope: delete stored offer if hash matches and terms are not currently active if ($.rcaOffers[agreementId].offerHash == termsHash) { delete $.rcaOffers[agreementId]; + if (agreement.activeTermsHash == termsHash) agreement.activeTermsHash = bytes32(0); emit OfferCancelled(msg.sender, agreementId, termsHash); } else if ($.rcauOffers[agreementId].offerHash == termsHash) { delete $.rcauOffers[agreementId]; @@ -566,44 +571,35 @@ contract RecurringCollector is * at this stage. * @param agreementId The agreement ID * @param versionHash The EIP-712 hash of the queried version, or bytes32(0) if none + * @param index Version index (VERSION_CURRENT or VERSION_NEXT) — determines per-version flags * @return details AgreementDetails for the queried version, or empty when no version exists */ function _getAgreementDetails( bytes16 agreementId, bytes32 versionHash, - uint256 /* index */ + uint256 index ) private view returns (AgreementDetails memory details) { if (versionHash == bytes32(0)) return details; + details.versionHash = versionHash; - RecurringCollectorStorage storage $ = _getStorage(); - AgreementData storage agreement = $.agreements[agreementId]; + AgreementData storage agreement = _getStorage().agreements[agreementId]; - if (agreement.state != AgreementState.NotAccepted) { - details.agreementId = agreementId; - details.payer = agreement.payer; - details.dataService = agreement.dataService; - details.serviceProvider = agreement.serviceProvider; - details.versionHash = versionHash; - details.state = ACCEPTED; - return details; - } + if (index == VERSION_CURRENT) { + if (agreement.state != AgreementState.NotAccepted) + details.state = (0 < agreement.updateNonce) ? ACCEPTED | UPDATE : ACCEPTED; + } else details.state = UPDATE; - // Not yet accepted — check stored RCA offer - StoredOffer storage rcaOffer = $.rcaOffers[agreementId]; - if (rcaOffer.offerHash != bytes32(0)) { - RecurringCollectionAgreement memory rca = abi.decode(rcaOffer.data, (RecurringCollectionAgreement)); - details.agreementId = agreementId; - details.payer = rca.payer; - details.dataService = rca.dataService; - details.serviceProvider = rca.serviceProvider; - details.versionHash = rcaOffer.offerHash; - details.state = REGISTERED; - } + details.state |= REGISTERED; + details.agreementId = agreementId; + details.payer = agreement.payer; + details.dataService = agreement.dataService; + details.serviceProvider = agreement.serviceProvider; } /** * @notice Resolve the offer hash representing a given version (VERSION_CURRENT or VERSION_NEXT). - * @dev Returns bytes32(0) when no version exists at that index. + * @dev Returns bytes32(0) when no version exists at that index. Pre-acceptance, activeTermsHash + * mirrors rcaOffers.offerHash, so VERSION_CURRENT works uniformly across pre- and post-acceptance. * @param agreementId The agreement ID * @param index The version index (VERSION_CURRENT or VERSION_NEXT) * @return hash The EIP-712 hash of the offer at that version, or bytes32(0) if none @@ -612,14 +608,10 @@ contract RecurringCollector is RecurringCollectorStorage storage $ = _getStorage(); AgreementData storage agreement = $.agreements[agreementId]; - if (index == VERSION_CURRENT) - hash = (agreement.state == AgreementState.NotAccepted) - ? $.rcaOffers[agreementId].offerHash - : agreement.activeTermsHash; + if (index == VERSION_CURRENT) hash = agreement.activeTermsHash; else if (index == VERSION_NEXT) { bytes32 rcauHash = $.rcauOffers[agreementId].offerHash; - // Skip when rcauOffers still holds an applied RCAU — that's the current version, not next. - if (rcauHash != agreement.activeTermsHash) hash = rcauHash; + if (rcauHash != bytes32(0) && rcauHash != agreement.activeTermsHash) hash = rcauHash; } } @@ -633,14 +625,15 @@ contract RecurringCollector is bytes16 agreementId, uint256 index ) external view returns (uint8 offerType, bytes memory offerData) { + bytes32 hash = _versionHashAt(agreementId, index); + if (hash == bytes32(0)) return (OFFER_TYPE_NONE, ""); + RecurringCollectorStorage storage $ = _getStorage(); - if (index == OFFER_TYPE_NEW) { - StoredOffer storage rca = $.rcaOffers[agreementId]; - if (rca.offerHash != bytes32(0)) return (OFFER_TYPE_NEW, rca.data); - } else if (index == OFFER_TYPE_UPDATE) { - StoredOffer storage rcau = $.rcauOffers[agreementId]; - if (rcau.offerHash != bytes32(0)) return (OFFER_TYPE_UPDATE, rcau.data); - } + StoredOffer storage rca = $.rcaOffers[agreementId]; + if (rca.offerHash == hash) return (OFFER_TYPE_NEW, rca.data); + + StoredOffer storage rcau = $.rcauOffers[agreementId]; + if (rcau.offerHash == hash) return (OFFER_TYPE_UPDATE, rcau.data); } /** diff --git a/packages/issuance/audits/PR1301/TRST-L-11.md b/packages/issuance/audits/PR1301/TRST-L-11.md index ad0771c7e..c36a68d1a 100644 --- a/packages/issuance/audits/PR1301/TRST-L-11.md +++ b/packages/issuance/audits/PR1301/TRST-L-11.md @@ -24,3 +24,14 @@ In `_offerUpdate()`, OR the `ACCEPTED` bit into state when the underlying agreem TBD --- + +`getAgreementDetails()` previously ignored the `index` parameter and returned only `ACCEPTED` for any agreement past `NotAccepted`, regardless of whether a pending RCAU also existed. It now honors `index` as a generic version selector with two named aliases: + +- `VERSION_CURRENT = 0` — the active version. For an accepted agreement, returns agreement fields + `activeTermsHash` with `REGISTERED | ACCEPTED`, plus `UPDATE` when the active terms came from an update. Pre-acceptance, returns the stored RCA offer with `REGISTERED`. Identity (`payer`, `dataService`, `serviceProvider`) is read from agreement storage in both cases; these fields are now persisted in `offer()` (see TRST-L-7). +- `VERSION_NEXT = 1` — the next queued version: a pending RCAU awaiting acceptance. Returns `REGISTERED | UPDATE` when present; empty once accepted (at which point it has moved to `VERSION_CURRENT`). + +`getAgreementOfferAt()` mirrors the same per-version semantics: `VERSION_CURRENT` returns the offer that produced `activeTermsHash` (RCA pre-update or RCAU post-update); `VERSION_NEXT` returns the pending RCAU when distinct from the active hash. + +`offer()` and `getAgreementDetails()` share a state composer keyed by version index, so both surfaces report identical flags. Flags split into per-version (`REGISTERED`, `ACCEPTED`, `UPDATE`, `SETTLED`) and per-agreement (`NOTICE_GIVEN`, `BY_PAYER`, `BY_PROVIDER`) groups. `ACCEPTED` is set only when the queried version equals `activeTermsHash`; `SETTLED` is scoped to the version's own claim (active or pending) so a non-zero claim on one version does not suppress `SETTLED` on the other. + +After `update()` promotes an RCAU to active, those bytes live in the RCAU slot. A subsequent `offer(OFFER_TYPE_UPDATE)` with a different hash overwrites that slot and the active RCAU's bytes, therefore they cannot be returned by `getAgreementOfferAt(id, VERSION_CURRENT)`. Resolving this without a hash-keyed terms store would require a third storage slot or a flexible-type slot, both judged disproportionate to the observability concern. From 33d2cede22d4ce5f77fdb3bbe791325d2c6ebce8 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 19:56:31 +0000 Subject: [PATCH 31/47] feat(collector): compose cancel/settled flags in getAgreementDetails (TRST-R-12) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Populate state flags beyond REGISTERED/ACCEPTED/UPDATE so agreement-scoped views distinguish cancelled from live and signal when nothing is currently claimable: - NOTICE_GIVEN + BY_PAYER / BY_PROVIDER — cancelled agreement, origin identified by the BY_* flag. - SETTLED — _getMaxNextClaimScoped(agreementId, 0) returns zero, meaning no tokens are claimable under either active or pending scope. Covers provider-cancelled agreements (immediately non-collectable), fully-collected agreements, and payer-cancelled agreements past their canceledAt window. --- .../collectors/RecurringCollector.sol | 18 +- .../agreementDetailsState.t.sol | 268 ++++++++++++++++++ .../getAgreementDetails.t.sol | 87 +++++- packages/issuance/audits/PR1301/TRST-R-11.md | 2 + packages/issuance/audits/PR1301/TRST-R-12.md | 10 + 5 files changed, 380 insertions(+), 5 deletions(-) create mode 100644 packages/horizon/test/unit/payments/recurring-collector/agreementDetailsState.t.sol diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index a44a75525..ded386dfa 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -22,6 +22,10 @@ import { OFFER_TYPE_UPDATE, ACCEPTED, REGISTERED, + NOTICE_GIVEN, + SETTLED, + BY_PAYER, + BY_PROVIDER, UPDATE, SCOPE_ACTIVE, SCOPE_PENDING, @@ -566,9 +570,7 @@ contract RecurringCollector is * {getAgreementDetails}. * @dev Caller supplies the version hash. {offer} passes the hash returned by _offerNew / * _offerUpdate (already known from the just-stored offer); {getAgreementDetails} resolves - * it via _versionHashAt. Returns empty details when versionHash is zero. The `index` - * parameter is plumbed through for TRST-L-11 (per-version flag composition) and is unused - * at this stage. + * it via _versionHashAt. Returns empty details when versionHash is zero. * @param agreementId The agreement ID * @param versionHash The EIP-712 hash of the queried version, or bytes32(0) if none * @param index Version index (VERSION_CURRENT or VERSION_NEXT) — determines per-version flags @@ -583,9 +585,10 @@ contract RecurringCollector is details.versionHash = versionHash; AgreementData storage agreement = _getStorage().agreements[agreementId]; + AgreementState agreementState = agreement.state; if (index == VERSION_CURRENT) { - if (agreement.state != AgreementState.NotAccepted) + if (agreementState != AgreementState.NotAccepted) details.state = (0 < agreement.updateNonce) ? ACCEPTED | UPDATE : ACCEPTED; } else details.state = UPDATE; @@ -594,6 +597,13 @@ contract RecurringCollector is details.payer = agreement.payer; details.dataService = agreement.dataService; details.serviceProvider = agreement.serviceProvider; + + if (agreementState == AgreementState.CanceledByPayer) details.state |= NOTICE_GIVEN | BY_PAYER; + else if (agreementState == AgreementState.CanceledByServiceProvider) + details.state |= NOTICE_GIVEN | BY_PROVIDER; + + if (_getMaxNextClaimScoped(agreementId, index == VERSION_CURRENT ? SCOPE_ACTIVE : SCOPE_PENDING) == 0) + details.state |= SETTLED; } /** diff --git a/packages/horizon/test/unit/payments/recurring-collector/agreementDetailsState.t.sol b/packages/horizon/test/unit/payments/recurring-collector/agreementDetailsState.t.sol new file mode 100644 index 000000000..0d3d03c98 --- /dev/null +++ b/packages/horizon/test/unit/payments/recurring-collector/agreementDetailsState.t.sol @@ -0,0 +1,268 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.27; + +import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; +import { + IAgreementCollector, + OFFER_TYPE_NEW, + OFFER_TYPE_UPDATE, + REGISTERED, + ACCEPTED, + NOTICE_GIVEN, + SETTLED, + BY_PROVIDER, + UPDATE, + VERSION_CURRENT, + VERSION_NEXT +} from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; + +import { RecurringCollectorSharedTest } from "./shared.t.sol"; +import { MockAgreementOwner } from "./MockAgreementOwner.t.sol"; + +/// @notice State-flag semantics for AgreementDetails returned by offer() and getAgreementDetails(). +/// Pins down two properties: +/// 1. offer() reports the same lifecycle state as getAgreementDetails() for the queried version +/// (REGISTERED, ACCEPTED, UPDATE, NOTICE_GIVEN, BY_*, SETTLED) — not just the version-specific +/// bits. +/// 2. SETTLED is per-version: VERSION_CURRENT scopes to active terms, VERSION_NEXT to pending — +/// a non-zero claim on one version must not suppress SETTLED on the other. +contract RecurringCollectorAgreementDetailsStateTest is RecurringCollectorSharedTest { + /* solhint-disable graph/func-name-mixedcase */ + + function _makeRca(address payer) internal returns (IRecurringCollector.RecurringCollectionAgreement memory) { + return + _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: payer, + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + } + + function _makeRcau( + bytes16 agreementId, + IRecurringCollector.RecurringCollectionAgreement memory rca, + uint64 deadline + ) internal pure returns (IRecurringCollector.RecurringCollectionAgreementUpdate memory) { + return + IRecurringCollector.RecurringCollectionAgreementUpdate({ + agreementId: agreementId, + deadline: deadline, + endsAt: rca.endsAt + 30 days, + maxInitialTokens: rca.maxInitialTokens, + maxOngoingTokensPerSecond: rca.maxOngoingTokensPerSecond * 2, + minSecondsPerCollection: rca.minSecondsPerCollection, + maxSecondsPerCollection: rca.maxSecondsPerCollection, + conditions: 0, + nonce: 1, + metadata: "" + }); + } + + function _acceptUnsigned( + MockAgreementOwner approver, + IRecurringCollector.RecurringCollectionAgreement memory rca + ) internal returns (bytes16) { + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + vm.prank(rca.dataService); + return _recurringCollector.accept(rca, ""); + } + + // ────────────────────────────────────────────────────────────────────── + // offer() return state mirrors getAgreementDetails() + // ────────────────────────────────────────────────────────────────────── + + /// @notice Fresh offer(NEW) on a never-seen agreement returns REGISTERED only. + function test_OfferNew_FreshOffer_State_Registered() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory details = _recurringCollector.offer( + OFFER_TYPE_NEW, + abi.encode(rca), + 0 + ); + + assertEq(details.state, REGISTERED, "fresh offer(NEW): REGISTERED only"); + } + + /// @notice Fresh offer(UPDATE) on an accepted agreement returns REGISTERED|UPDATE only. + function test_OfferUpdate_FreshOffer_State_RegisteredUpdate() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes16 agreementId = _acceptUnsigned(approver, rca); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau( + agreementId, + rca, + uint64(block.timestamp + 1 hours) + ); + + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory details = _recurringCollector.offer( + OFFER_TYPE_UPDATE, + abi.encode(rcau), + 0 + ); + + assertEq(details.state, REGISTERED | UPDATE, "fresh offer(UPDATE): REGISTERED|UPDATE"); + } + + /// @notice Re-offering an already-accepted RCA hits the idempotent path and must report + /// ACCEPTED — the offered version is the active accepted terms. + function test_OfferNew_AfterAccept_State_RegisteredAccepted() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _acceptUnsigned(approver, rca); + + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory details = _recurringCollector.offer( + OFFER_TYPE_NEW, + abi.encode(rca), + 0 + ); + + assertEq(details.state, REGISTERED | ACCEPTED, "re-offer(NEW) after accept: REGISTERED|ACCEPTED"); + } + + /// @notice Re-offering an already-applied RCAU hits the idempotent path; since the RCAU is + /// now the active terms, the queried version is CURRENT, so state is REGISTERED|ACCEPTED|UPDATE. + function test_OfferUpdate_AfterApply_State_RegisteredAcceptedUpdate() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes16 agreementId = _acceptUnsigned(approver, rca); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau( + agreementId, + rca, + uint64(block.timestamp + 1 hours) + ); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + vm.prank(rca.dataService); + _recurringCollector.update(rcau, ""); + + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory details = _recurringCollector.offer( + OFFER_TYPE_UPDATE, + abi.encode(rcau), + 0 + ); + + assertEq( + details.state, + REGISTERED | ACCEPTED | UPDATE, + "re-offer(UPDATE) after apply: REGISTERED|ACCEPTED|UPDATE" + ); + } + + /// @notice Re-offering an RCA after the agreement was canceled by the service provider must + /// surface NOTICE_GIVEN|BY_PROVIDER (and SETTLED, since active claim is zero in this state). + function test_OfferNew_AfterProviderCancel_State_FullyDecorated() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes16 agreementId = _acceptUnsigned(approver, rca); + + vm.prank(rca.dataService); + _recurringCollector.cancel(agreementId, IRecurringCollector.CancelAgreementBy.ServiceProvider); + + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory details = _recurringCollector.offer( + OFFER_TYPE_NEW, + abi.encode(rca), + 0 + ); + + assertEq( + details.state, + REGISTERED | ACCEPTED | NOTICE_GIVEN | BY_PROVIDER | SETTLED, + "re-offer(NEW) after provider cancel: REGISTERED|ACCEPTED|NOTICE_GIVEN|BY_PROVIDER|SETTLED" + ); + } + + // ────────────────────────────────────────────────────────────────────── + // SETTLED is per-version (active vs pending scoping) + // ────────────────────────────────────────────────────────────────────── + + /// @notice Pending RCAU past its deadline contributes 0 to claim. With per-version SETTLED + /// scoping, VERSION_NEXT reports SETTLED even though the active terms still have claim. + /// Pre-fix (unscoped getMaxNextClaim) would have suppressed SETTLED here. + function test_GetAgreementDetails_VersionNext_SettledIndependentOfActive() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + bytes16 agreementId = _acceptUnsigned(approver, rca); + + uint64 rcauDeadline = uint64(block.timestamp + 1 hours); + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau(agreementId, rca, rcauDeadline); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + + // Past pending deadline — pending claim is 0, but active claim still grows. + vm.warp(rcauDeadline + 1); + + IAgreementCollector.AgreementDetails memory next = _recurringCollector.getAgreementDetails( + agreementId, + VERSION_NEXT + ); + IAgreementCollector.AgreementDetails memory current = _recurringCollector.getAgreementDetails( + agreementId, + VERSION_CURRENT + ); + + assertEq(next.state & SETTLED, SETTLED, "VERSION_NEXT: SETTLED set when pending claim is 0"); + assertEq(current.state & SETTLED, 0, "VERSION_CURRENT: SETTLED not set when active claim is non-zero"); + } + + /// @notice Active terms past their offer deadline (still NotAccepted) have 0 active claim. + /// With per-version scoping, VERSION_CURRENT reports SETTLED even though a fresh pending + /// update still has non-zero claim. Pre-fix, the pending claim would have masked SETTLED. + function test_GetAgreementDetails_VersionCurrent_SettledIndependentOfPending() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + vm.prank(address(approver)); + IAgreementCollector.AgreementDetails memory offered = _recurringCollector.offer( + OFFER_TYPE_NEW, + abi.encode(rca), + 0 + ); + bytes16 agreementId = offered.agreementId; + + // Pending update with a far-future deadline — its claim stays non-zero after the warp. + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau( + agreementId, + rca, + uint64(block.timestamp + 30 days) + ); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + + // Past the RCA's offer deadline — active claim drops to 0 (state still NotAccepted, no + // valid pre-acceptance offer). + vm.warp(rca.deadline + 1); + + IAgreementCollector.AgreementDetails memory current = _recurringCollector.getAgreementDetails( + agreementId, + VERSION_CURRENT + ); + IAgreementCollector.AgreementDetails memory next = _recurringCollector.getAgreementDetails( + agreementId, + VERSION_NEXT + ); + + assertEq(current.state & SETTLED, SETTLED, "VERSION_CURRENT: SETTLED set when active claim is 0"); + assertEq(next.state & SETTLED, 0, "VERSION_NEXT: SETTLED not set when pending claim is non-zero"); + } +} diff --git a/packages/horizon/test/unit/payments/recurring-collector/getAgreementDetails.t.sol b/packages/horizon/test/unit/payments/recurring-collector/getAgreementDetails.t.sol index 91d788020..42c847394 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/getAgreementDetails.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/getAgreementDetails.t.sol @@ -5,7 +5,13 @@ import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon import { IAgreementCollector, OFFER_TYPE_NEW, - REGISTERED + REGISTERED, + ACCEPTED, + NOTICE_GIVEN, + SETTLED, + BY_PAYER, + BY_PROVIDER, + VERSION_CURRENT } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { RecurringCollectorSharedTest } from "./shared.t.sol"; @@ -107,4 +113,83 @@ contract RecurringCollectorGetAgreementDetailsTest is RecurringCollectorSharedTe assertEq(details.serviceProvider, rca.serviceProvider); assertNotEq(details.versionHash, bytes32(0)); } + + // -- Cancel sets NOTICE_GIVEN + origin flag; provider cancel is always SETTLED -- + + function test_GetAgreementDetails_CanceledByServiceProvider_Flags(FuzzyTestAccept calldata fuzzyTestAccept) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory rca, + , + , + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestAccept); + + vm.prank(rca.dataService); + _recurringCollector.cancel(agreementId, IRecurringCollector.CancelAgreementBy.ServiceProvider); + + IAgreementCollector.AgreementDetails memory details = _recurringCollector.getAgreementDetails( + agreementId, + VERSION_CURRENT + ); + + assertEq( + details.state, + REGISTERED | ACCEPTED | NOTICE_GIVEN | BY_PROVIDER | SETTLED, + "provider cancel: REGISTERED|ACCEPTED|NOTICE_GIVEN|BY_PROVIDER|SETTLED" + ); + } + + function test_GetAgreementDetails_CanceledByPayer_Flags(FuzzyTestAccept calldata fuzzyTestAccept) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory rca, + , + , + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestAccept); + + vm.prank(rca.dataService); + _recurringCollector.cancel(agreementId, IRecurringCollector.CancelAgreementBy.Payer); + + IAgreementCollector.AgreementDetails memory details = _recurringCollector.getAgreementDetails( + agreementId, + VERSION_CURRENT + ); + + uint16 baseline = REGISTERED | ACCEPTED | NOTICE_GIVEN | BY_PAYER; + assertTrue( + details.state == baseline || details.state == (baseline | SETTLED), + "payer cancel: REGISTERED|ACCEPTED|NOTICE_GIVEN|BY_PAYER (+SETTLED if fully elapsed)" + ); + assertEq(details.state & NOTICE_GIVEN, NOTICE_GIVEN, "NOTICE_GIVEN set"); + assertEq(details.state & BY_PAYER, BY_PAYER, "BY_PAYER set"); + assertEq(details.state & BY_PROVIDER, 0, "BY_PROVIDER not set"); + } + + // -- Accepted agreement with nothing left to claim reports SETTLED -- + + function test_GetAgreementDetails_Accepted_ElapsedSetsSettled(FuzzyTestAccept calldata fuzzyTestAccept) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory rca, + , + , + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestAccept); + + // Jump past the agreement's end so no further collection is possible once lastCollectionAt + // catches up. Without any collections, _getMaxNextClaim still returns a non-zero value + // (late-collection semantics), so the clearest SETTLED case is via provider cancel — but + // we want to assert the non-cancel path here too. Simulate fully-collected state by + // advancing to endsAt + 1 and marking lastCollectionAt == endsAt via a well-formed path: + // easiest is a payer cancel far in the past (canceledAt in the past → window empty). + vm.prank(rca.dataService); + _recurringCollector.cancel(agreementId, IRecurringCollector.CancelAgreementBy.Payer); + vm.warp(rca.endsAt + 1); + + IAgreementCollector.AgreementDetails memory details = _recurringCollector.getAgreementDetails( + agreementId, + VERSION_CURRENT + ); + + assertEq(details.state & SETTLED, SETTLED, "SETTLED set when nothing left to claim"); + } } diff --git a/packages/issuance/audits/PR1301/TRST-R-11.md b/packages/issuance/audits/PR1301/TRST-R-11.md index 0bc206182..f8169c789 100644 --- a/packages/issuance/audits/PR1301/TRST-R-11.md +++ b/packages/issuance/audits/PR1301/TRST-R-11.md @@ -11,3 +11,5 @@ Removed unused flags: `AUTO_UPDATE`, `AUTO_UPDATED`, `BY_DATA_SERVICE`, `WITH_NOTICE` and `IF_NOT_ACCEPTED` are dropped from the interface. NatSpec updated for remaining flags with new semantics. + +In RecurringCollector `NOTICE_GIVEN`, `SETTLED`, `BY_PAYER`, `BY_PROVIDER` are now set by `getAgreementDetails` to describe cancel origin and collectability (see TRST-R-12 fix). diff --git a/packages/issuance/audits/PR1301/TRST-R-12.md b/packages/issuance/audits/PR1301/TRST-R-12.md index a73ed9648..834cb66e8 100644 --- a/packages/issuance/audits/PR1301/TRST-R-12.md +++ b/packages/issuance/audits/PR1301/TRST-R-12.md @@ -5,3 +5,13 @@ ## Description In `getAgreementDetails()`, any agreement whose state is not `AgreementState.NotAccepted` is reported with state flag `ACCEPTED`. This includes agreements that have been cancelled (`CanceledByPayer` or `CanceledByServiceProvider`). Integrators inspecting the returned state cannot distinguish cancelled agreements from live ones without reading separate storage. Document this behavior in the interface, or extend the state bitmask with a `CANCELED` flag and return it for the non-active terminal states. + +--- + +Reusing the existing interface flags instead of adding a `CANCELED` flag. `getAgreementDetails` now composes cancel and collectability information: + +- `NOTICE_GIVEN` — set on cancelled agreements (collection window truncated). +- `BY_PAYER` / `BY_PROVIDER` — paired with `NOTICE_GIVEN` to identify the cancel origin. +- `SETTLED` — per-version: set when nothing is claimable under the queried version's terms (active claim for `VERSION_CURRENT`, pending claim for `VERSION_NEXT`). + +`ACCEPTED` is also narrowed: it is now only set on the active-slot version (`VERSION_CURRENT`) of agreements past `NotAccepted`, so pending updates (`VERSION_NEXT`) no longer report `ACCEPTED`. Integrators distinguish cancelled-vs-live by `NOTICE_GIVEN`, and stop-collecting-now via `SETTLED`. See the TRST-R-11 fix for the accompanying flag cleanup. From fe13b1128c8a8452b74355d8f7b7dddf9b581096 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 19 Apr 2026 20:27:32 +0000 Subject: [PATCH 32/47] feat(collector): add SCOPE_SIGNED to cancel() for EOA offer revocation (TRST-L-8) Give EOA signers an on-chain revocation path via cancel(agreementId, termsHash, SCOPE_SIGNED). Records cancelledOffers[msg.sender][termsHash] = agreementId; _requireAuthorization rejects when the stored agreementId matches. Self-authenticating, idempotent, reversible (bytes16(0) undoes), and combinable with SCOPE_PENDING/SCOPE_ACTIVE. Builds on the version-indexed storage and idempotent cancel semantics from the preceding L-11 refactor: SCOPE_SIGNED is added as a new branch at the top of cancel() alongside the existing SCOPE_PENDING / SCOPE_ACTIVE handling, and the cancelledOffers lookup slots into _requireAuthorization's signed branch. --- .../collectors/RecurringCollector.sol | 34 ++- .../recurring-collector/cancelSignature.t.sol | 256 ++++++++++++++++++ .../contracts/horizon/IAgreementCollector.sol | 14 +- .../contracts/horizon/IRecurringCollector.sol | 7 + packages/issuance/audits/PR1301/TRST-L-8.md | 2 + 5 files changed, 304 insertions(+), 9 deletions(-) create mode 100644 packages/horizon/test/unit/payments/recurring-collector/cancelSignature.t.sol diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index ded386dfa..76f20062d 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -29,6 +29,7 @@ import { UPDATE, SCOPE_ACTIVE, SCOPE_PENDING, + SCOPE_SIGNED, VERSION_CURRENT, VERSION_NEXT } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; @@ -108,6 +109,9 @@ contract RecurringCollector is mapping(bytes16 agreementId => StoredOffer offer) rcaOffers; /// @notice Stored RCAU offers (pre-approval), keyed by agreement ID mapping(bytes16 agreementId => StoredOffer offer) rcauOffers; + /// @notice Cancelled offer hashes, keyed by signer then EIP-712 hash. + /// Stores the agreementId that is blocked; bytes16(0) means not cancelled. + mapping(address signer => mapping(bytes32 hash => bytes16 agreementId)) cancelledOffers; } /// @dev keccak256(abi.encode(uint256(keccak256("graphprotocol.storage.RecurringCollector")) - 1)) & ~bytes32(uint256(0xff)) @@ -536,11 +540,31 @@ contract RecurringCollector is } /// @inheritdoc IAgreementCollector + /// @dev This implementation targets only the payer side of the agreement. + /// SCOPE_PENDING and SCOPE_ACTIVE enforce `msg.sender == agreement.payer`. + /// SCOPE_SIGNED has no caller check in this function; the entry it writes is + /// self-keyed by msg.sender and is consulted only later, during payer + /// authorization of a signed accept or update. Extending cancel to data-service + /// or service-provider callers is left for a future revision. function cancel(bytes16 agreementId, bytes32 termsHash, uint16 options) external whenNotPaused { RecurringCollectorStorage storage $ = _getStorage(); AgreementData storage agreement = $.agreements[agreementId]; + + // Signed scope: record cancelledOffers[msg.sender][termsHash] = agreementId. + // Self-authenticating — only blocks when msg.sender matches the recovered ECDSA signer. + // The stored agreementId is checked in _requireAuthorization (!=); calling again + // with bytes16(0) undoes the cancellation, calling with a different agreementId + // redirects it. + if (options & SCOPE_SIGNED != 0) { + if ($.cancelledOffers[msg.sender][termsHash] != agreementId) { + $.cancelledOffers[msg.sender][termsHash] = agreementId; + emit OfferCancelled(msg.sender, agreementId, termsHash); + } + } + + // Pending / active scopes require payer authorization. No-op if nothing exists on-chain. address payer = agreement.payer; - if (payer == address(0)) return; + if (options & (SCOPE_PENDING | SCOPE_ACTIVE) == 0 || payer == address(0)) return; require(msg.sender == payer, RecurringCollectorUnauthorizedCaller(msg.sender, payer)); if (agreement.activeTermsHash != termsHash || agreement.state == AgreementState.NotAccepted) { @@ -1068,9 +1092,11 @@ contract RecurringCollector is ) private view { RecurringCollectorStorage storage $ = _getStorage(); - if (0 < _signature.length) - require(_isAuthorized(_payer, ECDSA.recover(_hash, _signature)), RecurringCollectorInvalidSigner()); - else + if (0 < _signature.length) { + address signer = ECDSA.recover(_hash, _signature); + require(_isAuthorized(_payer, signer), RecurringCollectorInvalidSigner()); + require($.cancelledOffers[signer][_hash] != _agreementId, RecurringCollectorOfferCancelled(signer, _hash)); + } else // Check stored offer hash instead of callback require( (_offerType == OFFER_TYPE_NEW ? $.rcaOffers[_agreementId] : $.rcauOffers[_agreementId]).offerHash == diff --git a/packages/horizon/test/unit/payments/recurring-collector/cancelSignature.t.sol b/packages/horizon/test/unit/payments/recurring-collector/cancelSignature.t.sol new file mode 100644 index 000000000..9dadf2f6a --- /dev/null +++ b/packages/horizon/test/unit/payments/recurring-collector/cancelSignature.t.sol @@ -0,0 +1,256 @@ +// SPDX-License-Identifier: MIT +pragma solidity ^0.8.27; + +import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; +import { + SCOPE_SIGNED, + SCOPE_ACTIVE, + SCOPE_PENDING +} from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; + +import { RecurringCollectorSharedTest } from "./shared.t.sol"; + +contract RecurringCollectorCancelSignedOfferTest is RecurringCollectorSharedTest { + /* + * TESTS + */ + + /* solhint-disable graph/func-name-mixedcase */ + + function test_CancelSigned_BlocksAccept(FuzzyTestAccept calldata fuzzyTestAccept) public { + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept.rca + ); + uint256 signerKey = boundKey(fuzzyTestAccept.unboundedSignerKey); + _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, signerKey); + + (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCA(rca, signerKey); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + address signer = vm.addr(signerKey); + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + + vm.prank(signer); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_SIGNED); + + // Accepting with the cancelled signature should revert + vm.expectRevert( + abi.encodeWithSelector(IRecurringCollector.RecurringCollectorOfferCancelled.selector, signer, rcaHash) + ); + vm.prank(rca.dataService); + _recurringCollector.accept(rca, signature); + } + + function test_CancelSigned_EmitsEvent(FuzzyTestAccept calldata fuzzyTestAccept) public { + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept.rca + ); + uint256 signerKey = boundKey(fuzzyTestAccept.unboundedSignerKey); + _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, signerKey); + + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + address signer = vm.addr(signerKey); + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferCancelled(signer, agreementId, rcaHash); + vm.prank(signer); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_SIGNED); + } + + function test_CancelSigned_BlocksUpdate(FuzzyTestUpdate calldata fuzzyTestUpdate) public { + ( + IRecurringCollector.RecurringCollectionAgreement memory rca, + , + uint256 signerKey, + bytes16 agreementId + ) = _sensibleAuthorizeAndAccept(fuzzyTestUpdate.fuzzyTestAccept); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _recurringCollectorHelper.sensibleRCAU( + fuzzyTestUpdate.rcau + ); + rcau.agreementId = agreementId; + + ( + IRecurringCollector.RecurringCollectionAgreementUpdate memory signedRcau, + bytes memory rcauSig + ) = _recurringCollectorHelper.generateSignedRCAUForAgreement(agreementId, rcau, signerKey); + bytes32 rcauHash = _recurringCollector.hashRCAU(signedRcau); + address signer = vm.addr(signerKey); + + vm.prank(signer); + _recurringCollector.cancel(agreementId, rcauHash, SCOPE_SIGNED); + + // Updating with the cancelled signature should revert + vm.expectRevert( + abi.encodeWithSelector(IRecurringCollector.RecurringCollectorOfferCancelled.selector, signer, rcauHash) + ); + vm.prank(rca.dataService); + _recurringCollector.update(signedRcau, rcauSig); + } + + function test_CancelSigned_Idempotent(FuzzyTestAccept calldata fuzzyTestAccept) public { + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept.rca + ); + uint256 signerKey = boundKey(fuzzyTestAccept.unboundedSignerKey); + _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, signerKey); + + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + address signer = vm.addr(signerKey); + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + + vm.prank(signer); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_SIGNED); + + // Second call succeeds silently — no revert, no event + vm.recordLogs(); + vm.prank(signer); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_SIGNED); + assertEq(vm.getRecordedLogs().length, 0); + } + + function test_CancelSigned_DoesNotAffectDifferentSigner( + FuzzyTestAccept calldata fuzzyTestAccept1, + FuzzyTestAccept calldata fuzzyTestAccept2 + ) public { + IRecurringCollector.RecurringCollectionAgreement memory rca1 = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept1.rca + ); + uint256 signerKey1 = boundKey(fuzzyTestAccept1.unboundedSignerKey); + + IRecurringCollector.RecurringCollectionAgreement memory rca2 = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept2.rca + ); + uint256 signerKey2 = boundKey(fuzzyTestAccept2.unboundedSignerKey); + + vm.assume(rca1.payer != rca2.payer); + vm.assume(vm.addr(signerKey1) != vm.addr(signerKey2)); + + _recurringCollectorHelper.authorizeSignerWithChecks(rca1.payer, signerKey1); + _recurringCollectorHelper.authorizeSignerWithChecks(rca2.payer, signerKey2); + + bytes32 rcaHash = _recurringCollector.hashRCA(rca1); + + // Signer1 cancels — should not affect signer2 + vm.prank(vm.addr(signerKey1)); + _recurringCollector.cancel(bytes16(0), rcaHash, SCOPE_SIGNED); + + // Signer2's signatures for the same hash are unaffected + // (signer-scoped, not hash-global) + } + + function test_CancelSigned_SelfAuthenticating(FuzzyTestAccept calldata fuzzyTestAccept, address anyAddress) public { + // Any address can call cancel with SCOPE_SIGNED — it only records for msg.sender + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept.rca + ); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + vm.assume(anyAddress != address(0)); + vm.assume(anyAddress != _proxyAdmin); + + // Should not revert — self-authenticating, no _requirePayer + vm.prank(anyAddress); + _recurringCollector.cancel(bytes16(0), rcaHash, SCOPE_SIGNED); + } + + function test_CancelSigned_CombinedWithActiveDoesNotRevert(FuzzyTestAccept calldata fuzzyTestAccept) public { + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept.rca + ); + uint256 signerKey = boundKey(fuzzyTestAccept.unboundedSignerKey); + _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, signerKey); + + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + address signer = vm.addr(signerKey); + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + + // SCOPE_SIGNED | SCOPE_ACTIVE with no accepted agreement — should not revert. + // The signed recording succeeds; the active scope is skipped because nothing on-chain. + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferCancelled(signer, agreementId, rcaHash); + vm.prank(signer); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_SIGNED | SCOPE_ACTIVE); + } + + function test_CancelSigned_CombinedWithPendingDoesNotRevert(FuzzyTestAccept calldata fuzzyTestAccept) public { + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept.rca + ); + uint256 signerKey = boundKey(fuzzyTestAccept.unboundedSignerKey); + _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, signerKey); + + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + address signer = vm.addr(signerKey); + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + + // SCOPE_SIGNED | SCOPE_PENDING with no agreement — should not revert. + vm.expectEmit(address(_recurringCollector)); + emit IRecurringCollector.OfferCancelled(signer, agreementId, rcaHash); + vm.prank(signer); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_SIGNED | SCOPE_PENDING); + } + + function test_CancelSigned_UndoWithZero(FuzzyTestAccept calldata fuzzyTestAccept) public { + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + fuzzyTestAccept.rca + ); + uint256 signerKey = boundKey(fuzzyTestAccept.unboundedSignerKey); + _recurringCollectorHelper.authorizeSignerWithChecks(rca.payer, signerKey); + + (, bytes memory signature) = _recurringCollectorHelper.generateSignedRCA(rca, signerKey); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + address signer = vm.addr(signerKey); + bytes16 agreementId = _recurringCollector.generateAgreementId( + rca.payer, + rca.dataService, + rca.serviceProvider, + rca.deadline, + rca.nonce + ); + + // Cancel + vm.prank(signer); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_SIGNED); + + // Undo by calling with bytes16(0) + vm.prank(signer); + _recurringCollector.cancel(bytes16(0), rcaHash, SCOPE_SIGNED); + + // Accept should now succeed + _setupValidProvision(rca.serviceProvider, rca.dataService); + vm.prank(rca.dataService); + _recurringCollector.accept(rca, signature); + } + + /* solhint-enable graph/func-name-mixedcase */ +} diff --git a/packages/interfaces/contracts/horizon/IAgreementCollector.sol b/packages/interfaces/contracts/horizon/IAgreementCollector.sol index 3e2d694fc..5595466c7 100644 --- a/packages/interfaces/contracts/horizon/IAgreementCollector.sol +++ b/packages/interfaces/contracts/horizon/IAgreementCollector.sol @@ -47,6 +47,8 @@ uint8 constant OFFER_TYPE_UPDATE = 2; uint8 constant SCOPE_ACTIVE = 1; /// @dev Cancel targets pending offers uint8 constant SCOPE_PENDING = 2; +/// @dev Cancel targets signed offers +uint8 constant SCOPE_SIGNED = 4; // -- Version indices (shared by getAgreementDetails and getAgreementOfferAt) -- // @@ -131,12 +133,14 @@ interface IAgreementCollector is IPaymentsCollector { function offer(uint8 offerType, bytes calldata data, uint16 options) external returns (AgreementDetails memory); /** - * @notice Cancel an agreement or revoke a pending offer. - * @dev Scopes can be combined. SCOPE_PENDING and SCOPE_ACTIVE require payer authorization - * and no-op if nothing exists on-chain. - * @param agreementId The agreement's ID. + * @notice Cancel an agreement, revoke a pending offer, or invalidate a signed offer. + * @dev Scopes can be combined. SCOPE_SIGNED is self-authenticating (keyed by msg.sender); + * SCOPE_PENDING and SCOPE_ACTIVE require payer authorization and no-op if nothing exists on-chain. + * @param agreementId The agreement's ID. For SCOPE_SIGNED, only blocks accept/update when + * the agreementId matches; passing bytes16(0) undoes a previous cancellation. * @param termsHash EIP-712 hash identifying which terms to cancel. - * @param options Bitmask — SCOPE_ACTIVE (1) active terms, SCOPE_PENDING (2) pending offers. + * @param options Bitmask — SCOPE_ACTIVE (1) active terms, SCOPE_PENDING (2) pending offers, + * SCOPE_SIGNED (4) signed offers. */ function cancel(bytes16 agreementId, bytes32 termsHash, uint16 options) external; diff --git a/packages/interfaces/contracts/horizon/IRecurringCollector.sol b/packages/interfaces/contracts/horizon/IRecurringCollector.sol index c296ddb68..747b38e44 100644 --- a/packages/interfaces/contracts/horizon/IRecurringCollector.sol +++ b/packages/interfaces/contracts/horizon/IRecurringCollector.sol @@ -417,6 +417,13 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { */ error RecurringCollectorPauseGuardianNoChange(address account, bool allowed); + /** + * @notice Thrown when accepting or updating with a hash that the signer cancelled via SCOPE_SIGNED + * @param signer The signer who cancelled the offer + * @param hash The cancelled EIP-712 hash + */ + error RecurringCollectorOfferCancelled(address signer, bytes32 hash); + /** * @notice Emitted when a pause guardian is set * @param account The address of the pause guardian diff --git a/packages/issuance/audits/PR1301/TRST-L-8.md b/packages/issuance/audits/PR1301/TRST-L-8.md index 90911d2d3..c85f413d0 100644 --- a/packages/issuance/audits/PR1301/TRST-L-8.md +++ b/packages/issuance/audits/PR1301/TRST-L-8.md @@ -20,3 +20,5 @@ Expose a `cancelSignature(bytes32 hash)` entry point that records the hash as in TBD --- + +Added `SCOPE_SIGNED` flag to `cancel()`, giving EOA signers an on-chain revocation path like contract payers already have via `SCOPE_PENDING`. The signer calls `cancel(agreementId, termsHash, SCOPE_SIGNED)` which records `cancelledOffers[msg.sender][termsHash] = agreementId`. When `accept()` or `update()` later processes a signature, `_requireAuthorization` recovers the signer via ECDSA and rejects if the stored agreementId matches. Self-authenticating (keyed by signer address), idempotent, reversible (calling again with `bytes16(0)` undoes the cancellation), and combinable with other scopes. Also made `cancel` no-op when nothing exists on-chain instead of reverting. From b13d9106cb5cca7b38220db8767ead5b552fc027 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Fri, 10 Apr 2026 09:24:57 +0000 Subject: [PATCH 33/47] feat(issuance): expose getIssuanceAllocator on IIssuanceTarget Every issuance target should expose its allocator. Add getIssuanceAllocator() returning IIssuanceAllocationDistribution to IIssuanceTarget. Implement in RecurringAgreementManager (reads from storage), DirectAllocation (stores and returns), and RewardsManager (existing impl, moved from IRewardsManager to IIssuanceTarget). Also change IIssuanceTarget.setIssuanceAllocator parameter from address to IIssuanceAllocationDistribution for compile-time type safety. --- .../unit/rewards/rewards-interface.test.ts | 4 +- .../contracts/rewards/RewardsManager.sol | 17 ++-- packages/deployment/lib/abis.ts | 10 +- .../test/interface-id-stability.test.ts | 34 +++++++ .../recurring-collector/coverageGaps.t.sol | 7 +- .../recurring-collector/mixedPath.t.sol | 33 +++++-- .../payments/recurring-collector/update.t.sol | 4 +- .../contracts/rewards/IRewardsManager.sol | 8 -- .../issuance/allocate/IIssuanceTarget.sol | 15 ++- .../agreement/RecurringAgreementManager.sol | 21 +++-- .../contracts/allocate/DirectAllocation.sol | 66 ++++++++++++- .../test/allocate/MockNotificationTracker.sol | 8 +- .../test/allocate/MockReentrantTarget.sol | 9 +- .../test/allocate/MockRevertingTarget.sol | 10 +- .../test/allocate/MockSimpleTarget.sol | 8 +- .../unit/agreement-manager/approver.t.sol | 5 +- .../agreement-manager/branchCoverage.t.sol | 77 ++++++++++++++- .../unit/agreement-manager/callbackGas.t.sol | 3 +- .../agreement-manager/ensureDistributed.t.sol | 21 +++-- .../test/unit/allocator/distribution.t.sol | 3 +- .../unit/allocator/interfaceIdStability.t.sol | 2 +- .../direct-allocation/DirectAllocation.t.sol | 93 ++++++++++++++++++- .../test/harness/FullStackHarness.t.sol | 3 +- .../test/harness/RealStackHarness.t.sol | 3 +- 24 files changed, 390 insertions(+), 74 deletions(-) create mode 100644 packages/deployment/test/interface-id-stability.test.ts diff --git a/packages/contracts-test/tests/unit/rewards/rewards-interface.test.ts b/packages/contracts-test/tests/unit/rewards/rewards-interface.test.ts index 63280f5e8..7bbfebe6b 100644 --- a/packages/contracts-test/tests/unit/rewards/rewards-interface.test.ts +++ b/packages/contracts-test/tests/unit/rewards/rewards-interface.test.ts @@ -54,11 +54,11 @@ describe('RewardsManager interfaces', () => { }) it('IIssuanceTarget should have stable interface ID', () => { - expect(IIssuanceTarget__factory.interfaceId).to.equal('0xaee4dc43') + expect(IIssuanceTarget__factory.interfaceId).to.equal('0x19f6601a') }) it('IRewardsManager should have stable interface ID', () => { - expect(IRewardsManager__factory.interfaceId).to.equal('0x337b092e') + expect(IRewardsManager__factory.interfaceId).to.equal('0x8469b577') }) }) diff --git a/packages/contracts/contracts/rewards/RewardsManager.sol b/packages/contracts/contracts/rewards/RewardsManager.sol index a0ca5ca20..f251dc5f8 100644 --- a/packages/contracts/contracts/rewards/RewardsManager.sol +++ b/packages/contracts/contracts/rewards/RewardsManager.sol @@ -173,24 +173,25 @@ contract RewardsManager is * Note that the IssuanceAllocator can be set to the zero address to disable use of an allocator, and * use the local `issuancePerBlock` variable instead to control issuance. */ - function setIssuanceAllocator(address newIssuanceAllocator) external override onlyGovernor { - if (address(issuanceAllocator) != newIssuanceAllocator) { + function setIssuanceAllocator(IIssuanceAllocationDistribution newIssuanceAllocator) external override onlyGovernor { + if (issuanceAllocator != newIssuanceAllocator) { // Update rewards calculation before changing the issuance allocator updateAccRewardsPerSignal(); // Check that the contract supports the IIssuanceAllocationDistribution interface // Allow zero address to disable the allocator - if (newIssuanceAllocator != address(0)) { + if (address(newIssuanceAllocator) != address(0)) { // solhint-disable-next-line gas-small-strings require( - IERC165(newIssuanceAllocator).supportsInterface(type(IIssuanceAllocationDistribution).interfaceId), + IERC165(address(newIssuanceAllocator)).supportsInterface( + type(IIssuanceAllocationDistribution).interfaceId + ), "Contract does not support IIssuanceAllocationDistribution interface" ); } - address oldIssuanceAllocator = address(issuanceAllocator); - issuanceAllocator = IIssuanceAllocationDistribution(newIssuanceAllocator); - emit IssuanceAllocatorSet(oldIssuanceAllocator, newIssuanceAllocator); + emit IssuanceAllocatorSet(issuanceAllocator, newIssuanceAllocator); + issuanceAllocator = newIssuanceAllocator; } } @@ -325,7 +326,7 @@ contract RewardsManager is } /** - * @inheritdoc IRewardsManager + * @inheritdoc IIssuanceTarget */ function getIssuanceAllocator() external view override returns (IIssuanceAllocationDistribution) { return issuanceAllocator; diff --git a/packages/deployment/lib/abis.ts b/packages/deployment/lib/abis.ts index e9894d213..b7b0868b2 100644 --- a/packages/deployment/lib/abis.ts +++ b/packages/deployment/lib/abis.ts @@ -17,12 +17,12 @@ function loadAbi(artifactPath: string): Abi { return artifact.abi as Abi } -// Interface IDs - these match the generated values from TypeChain factories -// Verified by tests: packages/issuance/testing/tests/allocate/InterfaceIdStability.test.ts -// and packages/contracts-test/tests/unit/rewards/rewards-interface.test.ts +// Interface IDs - these mirror the values the compiler derives from the +// corresponding ABI. Cross-checked by test/interface-id-stability.test.ts; +// update both together whenever an interface changes. export const IERC165_INTERFACE_ID = '0x01ffc9a7' as const -export const IISSUANCE_TARGET_INTERFACE_ID = '0xaee4dc43' as const -export const IREWARDS_MANAGER_INTERFACE_ID = '0xa0a2f219' as const +export const IISSUANCE_TARGET_INTERFACE_ID = '0x19f6601a' as const +export const IREWARDS_MANAGER_INTERFACE_ID = '0x8469b577' as const export const REWARDS_MANAGER_ABI = loadAbi( '@graphprotocol/interfaces/artifacts/contracts/contracts/rewards/IRewardsManager.sol/IRewardsManager.json', diff --git a/packages/deployment/test/interface-id-stability.test.ts b/packages/deployment/test/interface-id-stability.test.ts new file mode 100644 index 000000000..5d0ed1225 --- /dev/null +++ b/packages/deployment/test/interface-id-stability.test.ts @@ -0,0 +1,34 @@ +import { expect } from 'chai' +import type { Abi } from 'viem' +import { toFunctionSelector } from 'viem' + +import { + IERC165_ABI, + IERC165_INTERFACE_ID, + IISSUANCE_TARGET_INTERFACE_ID, + IREWARDS_MANAGER_INTERFACE_ID, + ISSUANCE_TARGET_ABI, + REWARDS_MANAGER_ABI, +} from '../lib/abis.js' + +function computeInterfaceId(abi: Abi): `0x${string}` { + const xor = abi + .filter((item): item is Extract<(typeof abi)[number], { type: 'function' }> => item.type === 'function') + .map((f) => Number.parseInt(toFunctionSelector(f).slice(2), 16) >>> 0) + .reduce((a, s) => (a ^ s) >>> 0, 0) + return `0x${xor.toString(16).padStart(8, '0')}` +} + +describe('Interface ID Stability', function () { + it('IERC165_INTERFACE_ID matches the IERC165 ABI', function () { + expect(IERC165_INTERFACE_ID).to.equal(computeInterfaceId(IERC165_ABI)) + }) + + it('IISSUANCE_TARGET_INTERFACE_ID matches the IIssuanceTarget ABI', function () { + expect(IISSUANCE_TARGET_INTERFACE_ID).to.equal(computeInterfaceId(ISSUANCE_TARGET_ABI)) + }) + + it('IREWARDS_MANAGER_INTERFACE_ID matches the IRewardsManager ABI', function () { + expect(IREWARDS_MANAGER_INTERFACE_ID).to.equal(computeInterfaceId(REWARDS_MANAGER_ABI)) + }) +}) diff --git a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol index 8c724f30d..6d9713cbf 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol @@ -9,6 +9,7 @@ import { OFFER_TYPE_UPDATE, SCOPE_ACTIVE, SCOPE_PENDING, + VERSION_NEXT, IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; @@ -907,7 +908,11 @@ contract RecurringCollectorCoverageGapsTest is RecurringCollectorSharedTest { IRecurringCollector.AgreementData memory after1 = _recurringCollector.getAgreement(agreementId); assertEq(after1.activeTermsHash, bytes32(0), "active should be cleared"); - assertEq(after1.pendingTermsHash, rcauHash, "pending RCAU should survive RCA cancel"); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, + rcauHash, + "pending RCAU should survive RCA cancel" + ); assertEq(after1.payer, address(approver), "agreement.payer persists for subsequent auth"); // Now cancel the pending RCAU — payer auth still works via persistent agreement.payer diff --git a/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol b/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol index 659979dee..9d4ed946a 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/mixedPath.t.sol @@ -2,7 +2,12 @@ pragma solidity ^0.8.27; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; -import { OFFER_TYPE_NEW, OFFER_TYPE_UPDATE } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; +import { + OFFER_TYPE_NEW, + OFFER_TYPE_UPDATE, + VERSION_CURRENT, + VERSION_NEXT +} from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { RecurringCollectorSharedTest } from "./shared.t.sol"; import { MockAgreementOwner } from "./MockAgreementOwner.t.sol"; @@ -254,9 +259,16 @@ contract RecurringCollectorMixedPathTest is RecurringCollectorSharedTest { bytes32 rcauHash = _recurringCollector.hashRCAU(rcau); // Pre-check: pending is set - IRecurringCollector.AgreementData memory before = _recurringCollector.getAgreement(agreementId); - assertEq(before.activeTermsHash, rca1Hash, "active should be rca1Hash after offer"); - assertEq(before.pendingTermsHash, rcauHash, "pending should be rcauHash after offer UPDATE"); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_CURRENT).versionHash, + rca1Hash, + "active should be rca1Hash after offer" + ); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, + rcauHash, + "pending should be rcauHash after offer UPDATE" + ); // Step 3: offer different RCA with same primary fields (same agreementId, different terms) IRecurringCollector.RecurringCollectionAgreement memory rca2 = rca1; @@ -266,9 +278,16 @@ contract RecurringCollectorMixedPathTest is RecurringCollectorSharedTest { bytes32 rca2Hash = _recurringCollector.hashRCA(rca2); // Post-check: active replaced, pending preserved (still the original RCAU) - IRecurringCollector.AgreementData memory afterOffer = _recurringCollector.getAgreement(agreementId); - assertEq(afterOffer.activeTermsHash, rca2Hash, "active should be rca2Hash"); - assertEq(afterOffer.pendingTermsHash, rcauHash, "pending RCAU should still be queued"); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_CURRENT).versionHash, + rca2Hash, + "active should be rca2Hash" + ); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, + rcauHash, + "pending RCAU should still be queued" + ); // The pending offer's $.terms entry must still be retrievable — payer can still accept it (uint8 pendingType, bytes memory pendingData) = _recurringCollector.getAgreementOfferAt(agreementId, 1); diff --git a/packages/horizon/test/unit/payments/recurring-collector/update.t.sol b/packages/horizon/test/unit/payments/recurring-collector/update.t.sol index 158157554..97716eca0 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/update.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/update.t.sol @@ -2,7 +2,7 @@ pragma solidity ^0.8.27; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; -import { OFFER_TYPE_UPDATE } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; +import { OFFER_TYPE_UPDATE, VERSION_NEXT } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { RecurringCollectorSharedTest } from "./shared.t.sol"; @@ -366,7 +366,7 @@ contract RecurringCollectorUpdateTest is RecurringCollectorSharedTest { // Pre-condition: no pending offer staged, so update() takes the direct-apply branch. assertEq( - _recurringCollector.getAgreement(agreementId).pendingTermsHash, + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, bytes32(0), "no pending before direct-apply" ); diff --git a/packages/interfaces/contracts/contracts/rewards/IRewardsManager.sol b/packages/interfaces/contracts/contracts/rewards/IRewardsManager.sol index 205bde73c..688c9469d 100644 --- a/packages/interfaces/contracts/contracts/rewards/IRewardsManager.sol +++ b/packages/interfaces/contracts/contracts/rewards/IRewardsManager.sol @@ -2,7 +2,6 @@ pragma solidity ^0.7.6 || ^0.8.0; -import { IIssuanceAllocationDistribution } from "../../issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IRewardsIssuer } from "./IRewardsIssuer.sol"; /** @@ -179,13 +178,6 @@ interface IRewardsManager { */ function subgraphService() external view returns (IRewardsIssuer); - /** - * @notice Get the issuance allocator address - * @dev When set, this allocator controls issuance distribution instead of issuancePerBlock - * @return The issuance allocator contract (zero address if not set) - */ - function getIssuanceAllocator() external view returns (IIssuanceAllocationDistribution); - /** * @notice Get the reclaim address for a specific reason * @param reason The reclaim reason identifier diff --git a/packages/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol b/packages/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol index 90a311556..ed9f60b8f 100644 --- a/packages/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol +++ b/packages/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol @@ -2,6 +2,8 @@ pragma solidity ^0.7.6 || ^0.8.0; +import { IIssuanceAllocationDistribution } from "./IIssuanceAllocationDistribution.sol"; + /** * @title IIssuanceTarget * @author Edge & Node @@ -13,7 +15,10 @@ interface IIssuanceTarget { * @param oldIssuanceAllocator Old issuance allocator address * @param newIssuanceAllocator New issuance allocator address */ - event IssuanceAllocatorSet(address indexed oldIssuanceAllocator, address indexed newIssuanceAllocator); + event IssuanceAllocatorSet( + IIssuanceAllocationDistribution indexed oldIssuanceAllocator, + IIssuanceAllocationDistribution indexed newIssuanceAllocator + ); /// @notice Emitted before the issuance allocation changes event BeforeIssuanceAllocationChange(); @@ -27,11 +32,17 @@ interface IIssuanceTarget { */ function beforeIssuanceAllocationChange() external; + /** + * @notice Returns the current issuance allocator + * @return The issuance allocator contract (zero address if not set) + */ + function getIssuanceAllocator() external view returns (IIssuanceAllocationDistribution); + /** * @notice Sets the issuance allocator for this target * @dev This function facilitates upgrades by providing a standard way for targets * to change their allocator. Implementations can define their own access control. * @param newIssuanceAllocator Address of the issuance allocator */ - function setIssuanceAllocator(address newIssuanceAllocator) external; + function setIssuanceAllocator(IIssuanceAllocationDistribution newIssuanceAllocator) external; } diff --git a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol index a5f3c40b0..4993ba3fe 100644 --- a/packages/issuance/contracts/agreement/RecurringAgreementManager.sol +++ b/packages/issuance/contracts/agreement/RecurringAgreementManager.sol @@ -275,6 +275,11 @@ contract RecurringAgreementManager is /// @inheritdoc IIssuanceTarget function beforeIssuanceAllocationChange() external virtual override {} + /// @inheritdoc IIssuanceTarget + function getIssuanceAllocator() external view virtual override returns (IIssuanceAllocationDistribution) { + return _getStorage().issuanceAllocator; + } + /// @inheritdoc IIssuanceTarget /// @dev The allocator is expected to call distributeIssuance() (bringing distribution up to /// the current block) before any configuration change. As a result, the same-block dedup in @@ -283,21 +288,23 @@ contract RecurringAgreementManager is /// in a standalone transaction to avoid interleaving with collection in the same block. /// Even if interleaved, the only effect is a one-block lag before the new allocator's /// distribution is picked up — corrected automatically on the next block. - function setIssuanceAllocator(address newIssuanceAllocator) external virtual override onlyRole(GOVERNOR_ROLE) { + function setIssuanceAllocator( + IIssuanceAllocationDistribution newIssuanceAllocator + ) external virtual override onlyRole(GOVERNOR_ROLE) { RecurringAgreementManagerStorage storage $ = _getStorage(); - if (address($.issuanceAllocator) == newIssuanceAllocator) return; + if (address($.issuanceAllocator) == address(newIssuanceAllocator)) return; - if (newIssuanceAllocator != address(0)) + if (address(newIssuanceAllocator) != address(0)) require( ERC165Checker.supportsInterface( - newIssuanceAllocator, + address(newIssuanceAllocator), type(IIssuanceAllocationDistribution).interfaceId ), - InvalidIssuanceAllocator(newIssuanceAllocator) + InvalidIssuanceAllocator(address(newIssuanceAllocator)) ); - emit IssuanceAllocatorSet(address($.issuanceAllocator), newIssuanceAllocator); - $.issuanceAllocator = IIssuanceAllocationDistribution(newIssuanceAllocator); + emit IssuanceAllocatorSet($.issuanceAllocator, newIssuanceAllocator); + $.issuanceAllocator = newIssuanceAllocator; } // -- IAgreementOwner -- diff --git a/packages/issuance/contracts/allocate/DirectAllocation.sol b/packages/issuance/contracts/allocate/DirectAllocation.sol index 91f153b5e..9df058eca 100644 --- a/packages/issuance/contracts/allocate/DirectAllocation.sol +++ b/packages/issuance/contracts/allocate/DirectAllocation.sol @@ -2,6 +2,9 @@ pragma solidity ^0.8.27; +import { ERC165Checker } from "@openzeppelin/contracts/utils/introspection/ERC165Checker.sol"; + +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; import { ISendTokens } from "@graphprotocol/interfaces/contracts/issuance/allocate/ISendTokens.sol"; import { BaseUpgradeable } from "../common/BaseUpgradeable.sol"; @@ -24,6 +27,36 @@ import { ERC165Upgradeable } from "@openzeppelin/contracts-upgradeable/utils/int * @custom:security-contact Please email security+contracts@thegraph.com if you find any bugs. We might have an active bug bounty program. */ contract DirectAllocation is BaseUpgradeable, IIssuanceTarget, ISendTokens { + // -- Namespaced Storage -- + + /// @notice ERC-7201 storage location for DirectAllocation + bytes32 private constant DIRECT_ALLOCATION_STORAGE_LOCATION = + // solhint-disable-next-line gas-small-strings + keccak256(abi.encode(uint256(keccak256("graphprotocol.storage.DirectAllocation")) - 1)) & + ~bytes32(uint256(0xff)); + + /// @notice Main storage structure for DirectAllocation using ERC-7201 namespaced storage + /// @param issuanceAllocator The issuance allocator that distributes tokens to this contract + /// @custom:storage-location erc7201:graphprotocol.storage.DirectAllocation + struct DirectAllocationData { + IIssuanceAllocationDistribution issuanceAllocator; + } + + /** + * @notice Returns the storage struct for DirectAllocation + * @return $ contract storage + */ + function _getDirectAllocationStorage() private pure returns (DirectAllocationData storage $) { + // solhint-disable-previous-line use-natspec + // Solhint does not support $ return variable in natspec + + bytes32 slot = DIRECT_ALLOCATION_STORAGE_LOCATION; + // solhint-disable-next-line no-inline-assembly + assembly { + $.slot := slot + } + } + // -- Custom Errors -- /// @notice Thrown when token transfer fails @@ -31,6 +64,10 @@ contract DirectAllocation is BaseUpgradeable, IIssuanceTarget, ISendTokens { /// @param amount The amount of tokens that failed to transfer error SendTokensFailed(address to, uint256 amount); + /// @notice Thrown when the issuance allocator does not support IIssuanceAllocationDistribution + /// @param allocator The rejected allocator address + error InvalidIssuanceAllocator(address allocator); + // -- Events -- /// @notice Emitted when tokens are sent @@ -89,9 +126,28 @@ contract DirectAllocation is BaseUpgradeable, IIssuanceTarget, ISendTokens { */ function beforeIssuanceAllocationChange() external virtual override {} - /** - * @dev No-op for DirectAllocation; issuanceAllocator is not stored. - * @inheritdoc IIssuanceTarget - */ - function setIssuanceAllocator(address issuanceAllocator) external virtual override onlyRole(GOVERNOR_ROLE) {} + /// @inheritdoc IIssuanceTarget + function getIssuanceAllocator() external view virtual override returns (IIssuanceAllocationDistribution) { + return _getDirectAllocationStorage().issuanceAllocator; + } + + /// @inheritdoc IIssuanceTarget + function setIssuanceAllocator( + IIssuanceAllocationDistribution newIssuanceAllocator + ) external virtual override onlyRole(GOVERNOR_ROLE) { + DirectAllocationData storage $ = _getDirectAllocationStorage(); + if (address(newIssuanceAllocator) == address($.issuanceAllocator)) return; + + if (address(newIssuanceAllocator) != address(0)) + require( + ERC165Checker.supportsInterface( + address(newIssuanceAllocator), + type(IIssuanceAllocationDistribution).interfaceId + ), + InvalidIssuanceAllocator(address(newIssuanceAllocator)) + ); + + emit IssuanceAllocatorSet($.issuanceAllocator, newIssuanceAllocator); + $.issuanceAllocator = newIssuanceAllocator; + } } diff --git a/packages/issuance/contracts/test/allocate/MockNotificationTracker.sol b/packages/issuance/contracts/test/allocate/MockNotificationTracker.sol index a33212282..2b5fb5aec 100644 --- a/packages/issuance/contracts/test/allocate/MockNotificationTracker.sol +++ b/packages/issuance/contracts/test/allocate/MockNotificationTracker.sol @@ -1,6 +1,7 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.24; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; import { ERC165 } from "@openzeppelin/contracts/utils/introspection/ERC165.sol"; @@ -30,7 +31,12 @@ contract MockNotificationTracker is IIssuanceTarget, ERC165 { } /// @inheritdoc IIssuanceTarget - function setIssuanceAllocator(address _issuanceAllocator) external pure override {} + function getIssuanceAllocator() external pure override returns (IIssuanceAllocationDistribution) { + return IIssuanceAllocationDistribution(address(0)); + } + + /// @inheritdoc IIssuanceTarget + function setIssuanceAllocator(IIssuanceAllocationDistribution _issuanceAllocator) external pure override {} /// @inheritdoc ERC165 function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) { diff --git a/packages/issuance/contracts/test/allocate/MockReentrantTarget.sol b/packages/issuance/contracts/test/allocate/MockReentrantTarget.sol index 484648805..ffa4e5aae 100644 --- a/packages/issuance/contracts/test/allocate/MockReentrantTarget.sol +++ b/packages/issuance/contracts/test/allocate/MockReentrantTarget.sol @@ -85,8 +85,13 @@ contract MockReentrantTarget is IIssuanceTarget, ERC165 { } /// @inheritdoc IIssuanceTarget - function setIssuanceAllocator(address _issuanceAllocator) external override { - issuanceAllocator = _issuanceAllocator; + function getIssuanceAllocator() external view override returns (IIssuanceAllocationDistribution) { + return IIssuanceAllocationDistribution(issuanceAllocator); + } + + /// @inheritdoc IIssuanceTarget + function setIssuanceAllocator(IIssuanceAllocationDistribution _issuanceAllocator) external override { + issuanceAllocator = address(_issuanceAllocator); } /// @inheritdoc ERC165 diff --git a/packages/issuance/contracts/test/allocate/MockRevertingTarget.sol b/packages/issuance/contracts/test/allocate/MockRevertingTarget.sol index 27522e5a4..eb0ec1734 100644 --- a/packages/issuance/contracts/test/allocate/MockRevertingTarget.sol +++ b/packages/issuance/contracts/test/allocate/MockRevertingTarget.sol @@ -1,6 +1,7 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.24; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; import { ERC165 } from "@openzeppelin/contracts/utils/introspection/ERC165.sol"; @@ -23,7 +24,14 @@ contract MockRevertingTarget is IIssuanceTarget, ERC165 { /** * @inheritdoc IIssuanceTarget */ - function setIssuanceAllocator(address _issuanceAllocator) external pure override { + function getIssuanceAllocator() external pure override returns (IIssuanceAllocationDistribution) { + return IIssuanceAllocationDistribution(address(0)); + } + + /** + * @inheritdoc IIssuanceTarget + */ + function setIssuanceAllocator(IIssuanceAllocationDistribution _issuanceAllocator) external pure override { // No-op } diff --git a/packages/issuance/contracts/test/allocate/MockSimpleTarget.sol b/packages/issuance/contracts/test/allocate/MockSimpleTarget.sol index 311e1f03c..fddaed78b 100644 --- a/packages/issuance/contracts/test/allocate/MockSimpleTarget.sol +++ b/packages/issuance/contracts/test/allocate/MockSimpleTarget.sol @@ -1,6 +1,7 @@ // SPDX-License-Identifier: MIT pragma solidity ^0.8.24; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; import { ERC165 } from "@openzeppelin/contracts/utils/introspection/ERC165.sol"; @@ -15,7 +16,12 @@ contract MockSimpleTarget is IIssuanceTarget, ERC165 { function beforeIssuanceAllocationChange() external pure override {} /// @inheritdoc IIssuanceTarget - function setIssuanceAllocator(address _issuanceAllocator) external pure override {} + function getIssuanceAllocator() external pure override returns (IIssuanceAllocationDistribution) { + return IIssuanceAllocationDistribution(address(0)); + } + + /// @inheritdoc IIssuanceTarget + function setIssuanceAllocator(IIssuanceAllocationDistribution _issuanceAllocator) external pure override {} /// @inheritdoc ERC165 function supportsInterface(bytes4 interfaceId) public view virtual override returns (bool) { diff --git a/packages/issuance/test/unit/agreement-manager/approver.t.sol b/packages/issuance/test/unit/agreement-manager/approver.t.sol index f38db6a7c..488b74729 100644 --- a/packages/issuance/test/unit/agreement-manager/approver.t.sol +++ b/packages/issuance/test/unit/agreement-manager/approver.t.sol @@ -8,6 +8,7 @@ import { IRecurringEscrowManagement } from "@graphprotocol/interfaces/contracts/ import { IProviderEligibilityManagement } from "@graphprotocol/interfaces/contracts/issuance/eligibility/IProviderEligibilityManagement.sol"; import { IRecurringAgreements } from "@graphprotocol/interfaces/contracts/issuance/agreement/IRecurringAgreements.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IAgreementCollector, OFFER_TYPE_NEW @@ -57,13 +58,13 @@ contract RecurringAgreementManagerApproverTest is RecurringAgreementManagerShare MockIssuanceAllocator alloc = new MockIssuanceAllocator(token, address(agreementManager)); vm.expectRevert(); vm.prank(nonGovernor); - agreementManager.setIssuanceAllocator(address(alloc)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(alloc))); } function test_SetIssuanceAllocator_Governor() public { MockIssuanceAllocator alloc = new MockIssuanceAllocator(token, address(agreementManager)); vm.prank(governor); - agreementManager.setIssuanceAllocator(address(alloc)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(alloc))); } // -- View Function Tests -- diff --git a/packages/issuance/test/unit/agreement-manager/branchCoverage.t.sol b/packages/issuance/test/unit/agreement-manager/branchCoverage.t.sol index 2b7db27a4..458e76347 100644 --- a/packages/issuance/test/unit/agreement-manager/branchCoverage.t.sol +++ b/packages/issuance/test/unit/agreement-manager/branchCoverage.t.sol @@ -7,6 +7,7 @@ import { IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; import { IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { IRecurringAgreementManagement } from "@graphprotocol/interfaces/contracts/issuance/agreement/IRecurringAgreementManagement.sol"; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; @@ -15,6 +16,7 @@ import { IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon import { RecurringAgreementManagerSharedTest } from "./shared.t.sol"; import { IAgreementCollector } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { MockRecurringCollector } from "./mocks/MockRecurringCollector.sol"; +import { MockIssuanceAllocator } from "./mocks/MockIssuanceAllocator.sol"; /// @notice Targeted tests for uncovered branches in RecurringAgreementManager. contract RecurringAgreementManagerBranchCoverageTest is RecurringAgreementManagerSharedTest { @@ -36,7 +38,7 @@ contract RecurringAgreementManagerBranchCoverageTest is RecurringAgreementManage address(recurringCollector) ) ); - agreementManager.setIssuanceAllocator(address(recurringCollector)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(recurringCollector))); } /// @notice Setting allocator to an EOA (no code) also fails ERC165 check. @@ -44,7 +46,7 @@ contract RecurringAgreementManagerBranchCoverageTest is RecurringAgreementManage address eoa = makeAddr("randomEOA"); vm.prank(governor); vm.expectRevert(abi.encodeWithSelector(RecurringAgreementManager.InvalidIssuanceAllocator.selector, eoa)); - agreementManager.setIssuanceAllocator(eoa); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(eoa)); } // ══════════════════════════════════════════════════════════════════════ @@ -219,6 +221,52 @@ contract RecurringAgreementManagerBranchCoverageTest is RecurringAgreementManage // _withdrawAndRebalance — deposit deficit branch (L854/857–862) // ══════════════════════════════════════════════════════════════════════ + // ══════════════════════════════════════════════════════════════════════ + // getIssuanceAllocator — view getter (L281-282) + // ══════════════════════════════════════════════════════════════════════ + + /// @notice getIssuanceAllocator returns the configured allocator and the + /// zero default prior to setIssuanceAllocator. + function test_GetIssuanceAllocator_ReturnsConfiguredValue() public { + assertEq(address(agreementManager.getIssuanceAllocator()), address(0), "Default allocator must be zero"); + + MockIssuanceAllocator allocator = new MockIssuanceAllocator(token, address(agreementManager)); + vm.prank(governor); + agreementManager.setIssuanceAllocator(allocator); + + assertEq( + address(agreementManager.getIssuanceAllocator()), + address(allocator), + "Configured allocator must be returned" + ); + } + + // ══════════════════════════════════════════════════════════════════════ + // offerAgreement — collector returns zero agreementId (L361) + // ══════════════════════════════════════════════════════════════════════ + + /// @notice A conformant collector must return a non-zero agreementId; RAM + /// enforces this invariant with AgreementIdZero. + function test_OfferAgreement_Revert_AgreementIdZero() public { + ZeroIdCollector rogue = new ZeroIdCollector(dataService, address(agreementManager), indexer); + vm.prank(governor); + agreementManager.grantRole(COLLECTOR_ROLE, address(rogue)); + + // Payload content is irrelevant — the mock returns a zero agreementId unconditionally. + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRCA( + 100 ether, + 1 ether, + 60, + 3600, + uint64(block.timestamp + 365 days) + ); + + token.mint(address(agreementManager), 1_000_000 ether); + vm.prank(operator); + vm.expectRevert(IRecurringAgreementManagement.AgreementIdZero.selector); + agreementManager.offerAgreement(IAgreementCollector(address(rogue)), OFFER_TYPE_NEW, abi.encode(rca)); + } + /// @notice When escrow balance drops below min (after collection), reconcile deposits the deficit. function test_WithdrawAndRebalance_DepositDeficit() public { // Offer agreement in Full mode — escrow gets fully funded @@ -268,3 +316,28 @@ contract RecurringAgreementManagerBranchCoverageTest is RecurringAgreementManage /* solhint-enable graph/func-name-mixedcase */ } + +/// @notice Minimal collector stub that returns a zero agreementId with valid +/// payer/dataService/serviceProvider, used to exercise RAM's AgreementIdZero guard. +contract ZeroIdCollector { + address private immutable _dataService; + address private immutable _payer; + address private immutable _serviceProvider; + + constructor(address dataService_, address payer_, address serviceProvider_) { + _dataService = dataService_; + _payer = payer_; + _serviceProvider = serviceProvider_; + } + + function offer( + uint8 /* offerType */, + bytes calldata /* data */, + uint16 /* options */ + ) external view returns (IAgreementCollector.AgreementDetails memory details) { + details.agreementId = bytes16(0); + details.payer = _payer; + details.dataService = _dataService; + details.serviceProvider = _serviceProvider; + } +} diff --git a/packages/issuance/test/unit/agreement-manager/callbackGas.t.sol b/packages/issuance/test/unit/agreement-manager/callbackGas.t.sol index e4870924f..efe2abce6 100644 --- a/packages/issuance/test/unit/agreement-manager/callbackGas.t.sol +++ b/packages/issuance/test/unit/agreement-manager/callbackGas.t.sol @@ -2,6 +2,7 @@ pragma solidity ^0.8.27; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { RecurringAgreementManagerSharedTest } from "./shared.t.sol"; import { MockIssuanceAllocator } from "./mocks/MockIssuanceAllocator.sol"; @@ -36,7 +37,7 @@ contract RecurringAgreementManagerCallbackGasTest is RecurringAgreementManagerSh vm.label(address(mockAllocator), "MockIssuanceAllocator"); vm.prank(governor); - agreementManager.setIssuanceAllocator(address(mockAllocator)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(mockAllocator))); } // ==================== beforeCollection gas ==================== diff --git a/packages/issuance/test/unit/agreement-manager/ensureDistributed.t.sol b/packages/issuance/test/unit/agreement-manager/ensureDistributed.t.sol index d84782d37..ec9542977 100644 --- a/packages/issuance/test/unit/agreement-manager/ensureDistributed.t.sol +++ b/packages/issuance/test/unit/agreement-manager/ensureDistributed.t.sol @@ -4,6 +4,7 @@ pragma solidity ^0.8.27; import { Vm } from "forge-std/Vm.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IRecurringCollector } from "@graphprotocol/interfaces/contracts/horizon/IRecurringCollector.sol"; import { RecurringAgreementManager } from "contracts/agreement/RecurringAgreementManager.sol"; @@ -23,7 +24,7 @@ contract RecurringAgreementManagerEnsureDistributedTest is RecurringAgreementMan vm.label(address(mockAllocator), "MockIssuanceAllocator"); vm.prank(governor); - agreementManager.setIssuanceAllocator(address(mockAllocator)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(mockAllocator))); } // ==================== setIssuanceAllocator ==================== @@ -33,26 +34,26 @@ contract RecurringAgreementManagerEnsureDistributedTest is RecurringAgreementMan vm.prank(governor); vm.expectEmit(address(agreementManager)); - emit IIssuanceTarget.IssuanceAllocatorSet(address(mockAllocator), address(newAllocator)); - agreementManager.setIssuanceAllocator(address(newAllocator)); + emit IIssuanceTarget.IssuanceAllocatorSet(IIssuanceAllocationDistribution(address(mockAllocator)), IIssuanceAllocationDistribution(address(newAllocator))); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(newAllocator))); } function test_SetIssuanceAllocator_Revert_WhenNotGovernor() public { vm.prank(operator); vm.expectRevert(); - agreementManager.setIssuanceAllocator(address(mockAllocator)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(mockAllocator))); } function test_SetIssuanceAllocator_CanSetToZero() public { vm.prank(governor); - agreementManager.setIssuanceAllocator(address(0)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(0))); // Should not revert — _ensureIncomingDistributionToCurrentBlock is a no-op with zero address } function test_SetIssuanceAllocator_NoopWhenUnchanged() public { vm.prank(governor); vm.recordLogs(); - agreementManager.setIssuanceAllocator(address(mockAllocator)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(mockAllocator))); Vm.Log[] memory logs = vm.getRecordedLogs(); assertEq(logs.length, 0, "should not emit when address unchanged"); } @@ -201,7 +202,7 @@ contract RecurringAgreementManagerEnsureDistributedTest is RecurringAgreementMan function test_EnsureDistributed_NoopWhenAllocatorNotSet() public { // Clear allocator vm.prank(governor); - agreementManager.setIssuanceAllocator(address(0)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(0))); (IRecurringCollector.RecurringCollectionAgreement memory rca, ) = _makeRCAWithId( 100 ether, @@ -309,14 +310,14 @@ contract RecurringAgreementManagerEnsureDistributedTest is RecurringAgreementMan vm.expectRevert( abi.encodeWithSelector(RecurringAgreementManager.InvalidIssuanceAllocator.selector, notAllocator) ); - agreementManager.setIssuanceAllocator(notAllocator); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(notAllocator)); } function test_SetIssuanceAllocator_Revert_WhenEOA() public { address eoa = makeAddr("eoa"); vm.prank(governor); vm.expectRevert(abi.encodeWithSelector(RecurringAgreementManager.InvalidIssuanceAllocator.selector, eoa)); - agreementManager.setIssuanceAllocator(eoa); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(eoa)); } // ==================== setIssuanceAllocator switches allocator ==================== @@ -334,7 +335,7 @@ contract RecurringAgreementManagerEnsureDistributedTest is RecurringAgreementMan // Switch allocator MockIssuanceAllocator newAllocator = new MockIssuanceAllocator(token, address(agreementManager)); vm.prank(governor); - agreementManager.setIssuanceAllocator(address(newAllocator)); + agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(newAllocator))); // Next block: new allocator should be called via _updateEscrow vm.roll(block.number + 1); diff --git a/packages/issuance/test/unit/allocator/distribution.t.sol b/packages/issuance/test/unit/allocator/distribution.t.sol index fb94737de..196317dcf 100644 --- a/packages/issuance/test/unit/allocator/distribution.t.sol +++ b/packages/issuance/test/unit/allocator/distribution.t.sol @@ -4,6 +4,7 @@ pragma solidity ^0.8.27; import { IERC165 } from "@openzeppelin/contracts/utils/introspection/IERC165.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { TargetIssuancePerBlock, DistributionState, @@ -487,7 +488,7 @@ contract IssuanceAllocatorDistributionTest is IssuanceAllocatorSharedTest { _setIssuanceRate(ISSUANCE_PER_BLOCK); // Set up reentrant target - reentrantTarget.setIssuanceAllocator(address(allocator)); + reentrantTarget.setIssuanceAllocator(IIssuanceAllocationDistribution(address(allocator))); reentrantTarget.setReentrantAction(MockReentrantTarget.ReentrantAction.SetTargetAllocation1Param); // Adding the target should fail due to reentrancy in notification callback diff --git a/packages/issuance/test/unit/allocator/interfaceIdStability.t.sol b/packages/issuance/test/unit/allocator/interfaceIdStability.t.sol index 463416bbd..aee42df80 100644 --- a/packages/issuance/test/unit/allocator/interfaceIdStability.t.sol +++ b/packages/issuance/test/unit/allocator/interfaceIdStability.t.sol @@ -40,7 +40,7 @@ contract AllocateInterfaceIdStabilityTest is Test { // -- DirectAllocation / shared interfaces -- function test_InterfaceId_IIssuanceTarget() public pure { - assertEq(type(IIssuanceTarget).interfaceId, bytes4(0xaee4dc43)); + assertEq(type(IIssuanceTarget).interfaceId, bytes4(0x19f6601a)); } function test_InterfaceId_ISendTokens() public pure { diff --git a/packages/issuance/test/unit/direct-allocation/DirectAllocation.t.sol b/packages/issuance/test/unit/direct-allocation/DirectAllocation.t.sol index 112126a38..d76204091 100644 --- a/packages/issuance/test/unit/direct-allocation/DirectAllocation.t.sol +++ b/packages/issuance/test/unit/direct-allocation/DirectAllocation.t.sol @@ -8,6 +8,7 @@ import { IAccessControl } from "@openzeppelin/contracts/access/IAccessControl.so import { Initializable } from "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol"; import { TransparentUpgradeableProxy } from "@openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol"; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; import { ISendTokens } from "@graphprotocol/interfaces/contracts/issuance/allocate/ISendTokens.sol"; @@ -15,6 +16,26 @@ import { BaseUpgradeable } from "../../../contracts/common/BaseUpgradeable.sol"; import { IGraphToken } from "../../../contracts/common/IGraphToken.sol"; import { DirectAllocation } from "../../../contracts/allocate/DirectAllocation.sol"; import { MockGraphToken } from "../mocks/MockGraphToken.sol"; +import { TargetIssuancePerBlock } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocatorTypes.sol"; + +/// @notice Minimal IIssuanceAllocationDistribution stub that advertises the interface via ERC-165. +/// Used to exercise DirectAllocation's ERC-165 acceptance path without pulling in heavier +/// allocator mocks from other test trees. +contract StubIssuanceAllocator is IIssuanceAllocationDistribution, IERC165 { + function distributeIssuance() external pure override returns (uint256) { + return 0; + } + + function getTargetIssuancePerBlock(address) external pure override returns (TargetIssuancePerBlock memory) { + return TargetIssuancePerBlock(0, 0, 0, 0); + } + + function supportsInterface(bytes4 interfaceId) external pure override returns (bool) { + return + interfaceId == type(IIssuanceAllocationDistribution).interfaceId || + interfaceId == type(IERC165).interfaceId; + } +} /// @notice Tests for DirectAllocation contract. contract DirectAllocationTest is Test { @@ -133,15 +154,81 @@ contract DirectAllocationTest is Test { directAlloc.beforeIssuanceAllocationChange(); } - function test_SetIssuanceAllocator_NoOp() public { + function test_GetIssuanceAllocator_InitiallyZero() public view { + assertEq(address(directAlloc.getIssuanceAllocator()), address(0)); + } + + function test_SetIssuanceAllocator_UpdatesGetter() public { + StubIssuanceAllocator allocator = new StubIssuanceAllocator(); + vm.prank(governor); + directAlloc.setIssuanceAllocator(allocator); + assertEq(address(directAlloc.getIssuanceAllocator()), address(allocator)); + } + + function test_SetIssuanceAllocator_EmitsEvent() public { + StubIssuanceAllocator allocator = new StubIssuanceAllocator(); + vm.prank(governor); + vm.expectEmit(address(directAlloc)); + emit IIssuanceTarget.IssuanceAllocatorSet(IIssuanceAllocationDistribution(address(0)), allocator); + directAlloc.setIssuanceAllocator(allocator); + } + + function test_SetIssuanceAllocator_EmitsEventWithOldValue() public { + StubIssuanceAllocator first = new StubIssuanceAllocator(); + StubIssuanceAllocator second = new StubIssuanceAllocator(); + vm.prank(governor); + directAlloc.setIssuanceAllocator(first); + + vm.prank(governor); + vm.expectEmit(address(directAlloc)); + emit IIssuanceTarget.IssuanceAllocatorSet(first, second); + directAlloc.setIssuanceAllocator(second); + } + + function test_SetIssuanceAllocator_SkipsWhenSameValue() public { + StubIssuanceAllocator allocator = new StubIssuanceAllocator(); + vm.prank(governor); + directAlloc.setIssuanceAllocator(allocator); + + vm.prank(governor); + vm.recordLogs(); + directAlloc.setIssuanceAllocator(allocator); + assertEq(vm.getRecordedLogs().length, 0); + } + + function test_SetIssuanceAllocator_AllowsZeroAddress() public { + // Zero-address bypasses the ERC165 check — clearing the allocator is always legal. + StubIssuanceAllocator allocator = new StubIssuanceAllocator(); + vm.prank(governor); + directAlloc.setIssuanceAllocator(allocator); + + vm.prank(governor); + directAlloc.setIssuanceAllocator(IIssuanceAllocationDistribution(address(0))); + assertEq(address(directAlloc.getIssuanceAllocator()), address(0)); + } + + /// @notice An EOA (no code) fails the ERC-165 interface probe and must be rejected. Prevents + /// governance from accidentally wiring up a non-contract as the allocator. + function test_Revert_SetIssuanceAllocator_WhenEOA() public { + address eoa = makeAddr("eoa"); + vm.prank(governor); + vm.expectRevert(abi.encodeWithSelector(DirectAllocation.InvalidIssuanceAllocator.selector, eoa)); + directAlloc.setIssuanceAllocator(IIssuanceAllocationDistribution(eoa)); + } + + /// @notice A contract that does not implement IIssuanceAllocationDistribution must be rejected. + /// Uses the MockGraphToken fixture — it has code but doesn't advertise the allocator interface. + function test_Revert_SetIssuanceAllocator_WhenWrongInterface() public { vm.prank(governor); - directAlloc.setIssuanceAllocator(makeAddr("allocator")); + vm.expectRevert(abi.encodeWithSelector(DirectAllocation.InvalidIssuanceAllocator.selector, address(token))); + directAlloc.setIssuanceAllocator(IIssuanceAllocationDistribution(address(token))); } function test_Revert_SetIssuanceAllocator_NonGovernor() public { + StubIssuanceAllocator allocator = new StubIssuanceAllocator(); vm.expectRevert(); vm.prank(unauthorized); - directAlloc.setIssuanceAllocator(makeAddr("allocator")); + directAlloc.setIssuanceAllocator(allocator); } // ==================== ERC-165 Interface Support ==================== diff --git a/packages/testing/test/harness/FullStackHarness.t.sol b/packages/testing/test/harness/FullStackHarness.t.sol index 842ebe1a1..d095804f0 100644 --- a/packages/testing/test/harness/FullStackHarness.t.sol +++ b/packages/testing/test/harness/FullStackHarness.t.sol @@ -27,6 +27,7 @@ import { OFFER_TYPE_NEW } from "@graphprotocol/interfaces/contracts/horizon/IAgreementCollector.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; import { IGraphToken as IssuanceIGraphToken } from "issuance/common/IGraphToken.sol"; import { IIndexingAgreement } from "@graphprotocol/interfaces/contracts/subgraph-service/internal/IIndexingAgreement.sol"; import { IERC20 } from "@openzeppelin/contracts/token/ERC20/IERC20.sol"; @@ -291,7 +292,7 @@ abstract contract FullStackHarness is Test { ram.grantRole(OPERATOR_ROLE, operator); ram.grantRole(DATA_SERVICE_ROLE, address(subgraphService)); ram.grantRole(COLLECTOR_ROLE, address(recurringCollector)); - ram.setIssuanceAllocator(address(issuanceAllocator)); + ram.setIssuanceAllocator(IIssuanceAllocationDistribution(address(issuanceAllocator))); issuanceAllocator.setIssuancePerBlock(1 ether); issuanceAllocator.setTargetAllocation(IIssuanceTarget(address(ram)), 1 ether); diff --git a/packages/testing/test/harness/RealStackHarness.t.sol b/packages/testing/test/harness/RealStackHarness.t.sol index db99ace6c..1d7cf6bcd 100644 --- a/packages/testing/test/harness/RealStackHarness.t.sol +++ b/packages/testing/test/harness/RealStackHarness.t.sol @@ -9,6 +9,7 @@ import { RecurringCollector } from "horizon/payments/collectors/RecurringCollect import { IssuanceAllocator } from "issuance/allocate/IssuanceAllocator.sol"; import { RecurringAgreementManager } from "issuance/agreement/RecurringAgreementManager.sol"; import { IIssuanceTarget } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceTarget.sol"; +import { IIssuanceAllocationDistribution } from "@graphprotocol/interfaces/contracts/issuance/allocate/IIssuanceAllocationDistribution.sol"; // Use the issuance IGraphToken for RAM/allocator (IERC20 + mint) import { IGraphToken as IssuanceIGraphToken } from "issuance/common/IGraphToken.sol"; @@ -123,7 +124,7 @@ abstract contract RealStackHarness is Test { ram.grantRole(OPERATOR_ROLE, operator); ram.grantRole(DATA_SERVICE_ROLE, dataService); ram.grantRole(COLLECTOR_ROLE, address(recurringCollector)); - ram.setIssuanceAllocator(address(issuanceAllocator)); + ram.setIssuanceAllocator(IIssuanceAllocationDistribution(address(issuanceAllocator))); // Configure allocator: set total issuance rate, then allocate to RAM issuanceAllocator.setIssuancePerBlock(1 ether); issuanceAllocator.setTargetAllocation(IIssuanceTarget(address(ram)), 1 ether); From e4cd9e026e2f270cc0f2799d4a3a863dcd44306a Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 26 Apr 2026 19:35:24 +0000 Subject: [PATCH 34/47] fix(collector): validate full terms at offer time MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace _requirePayerToSupportEligibilityCheck in _offerNew/_offerUpdate with _requireValidTerms, so deadline/endsAt/min-max collection seconds and ongoing-rate are validated when the offer is registered, not only when the offer is accepted. Pre-acceptance views (getMaxNextClaim, getAgreementDetails) read terms from the stored RCA bytes, so an offer with malformed terms could otherwise be advertised — and surface non-zero pending caps — until accept() rejected it. --- .../collectors/RecurringCollector.sol | 23 ++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 76f20062d..0a4b4daca 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -488,7 +488,15 @@ contract RecurringCollector is block.timestamp <= rca.deadline, RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rca.deadline) ); - _requirePayerToSupportEligibilityCheck(rca.payer, rca.conditions); + _requireValidTerms( + rca.deadline, + rca.endsAt, + rca.minSecondsPerCollection, + rca.maxSecondsPerCollection, + rca.payer, + rca.conditions, + rca.maxOngoingTokensPerSecond + ); agreement.payer = rca.payer; agreement.dataService = rca.dataService; @@ -523,12 +531,21 @@ contract RecurringCollector is block.timestamp <= rcau.deadline, RecurringCollectorAgreementDeadlineElapsed(block.timestamp, rcau.deadline) ); + address payer = agreement.payer; require( - agreement.payer != address(0) && + payer != address(0) && (agreement.state == AgreementState.NotAccepted || agreement.state == AgreementState.Accepted), RecurringCollectorAgreementIncorrectState(agreementId, agreement.state) ); - _requirePayerToSupportEligibilityCheck(agreement.payer, rcau.conditions); + _requireValidTerms( + rcau.deadline, + rcau.endsAt, + rcau.minSecondsPerCollection, + rcau.maxSecondsPerCollection, + payer, + rcau.conditions, + rcau.maxOngoingTokensPerSecond + ); $.rcauOffers[agreementId] = StoredOffer({ offerHash: versionHash, data: _data }); emit OfferStored(agreementId, payer, OFFER_TYPE_UPDATE, versionHash); From 6772545f18467db362022e274b4b9b39636d13b2 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Sun, 26 Apr 2026 19:01:13 +0000 Subject: [PATCH 35/47] fix(collector): respect deadlines in scoped claim cap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit _getMaxNextClaimScoped read offer deadlines incorrectly: - pre-acceptance used `block.timestamp < rca.deadline`, excluding the boundary; aligned with offer/accept which use `<=`. - SCOPE_PENDING had no deadline check at all — an expired pending RCAU still contributed to maxClaim. - SCOPE_PENDING also fired when the stored RCAU offer was already the active version (post-update), double-counting it against SCOPE_ACTIVE; skip when rcauOffer.offerHash == activeTermsHash. --- .../collectors/RecurringCollector.sol | 24 +++---- .../recurring-collector/coverageGaps.t.sol | 1 + .../recurring-collector/getMaxNextClaim.t.sol | 65 +++++++++++++++++++ 3 files changed, 78 insertions(+), 12 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 0a4b4daca..77ed57d0b 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -1309,8 +1309,7 @@ contract RecurringCollector is StoredOffer storage rcaOffer = $.rcaOffers[agreementId]; if (rcaOffer.offerHash != bytes32(0)) { RecurringCollectionAgreement memory rca = abi.decode(rcaOffer.data, (RecurringCollectionAgreement)); - // Use block.timestamp as proxy for acceptedAt, deadline as expiry - if (block.timestamp < rca.deadline) + if (block.timestamp <= rca.deadline) maxClaim = _maxClaim( block.timestamp, rca.endsAt, @@ -1324,21 +1323,22 @@ contract RecurringCollector is if (agreementScope & SCOPE_PENDING != 0) { StoredOffer storage rcauOffer = $.rcauOffers[agreementId]; - if (rcauOffer.offerHash != bytes32(0)) { + if (rcauOffer.offerHash != bytes32(0) && rcauOffer.offerHash != _a.activeTermsHash) { RecurringCollectionAgreementUpdate memory rcau = abi.decode( rcauOffer.data, (RecurringCollectionAgreementUpdate) ); - // Ongoing claim: time-capped from now to rcau.endsAt - uint256 maxPendingClaim = _maxClaim( - block.timestamp, - rcau.endsAt, - rcau.maxSecondsPerCollection, - rcau.maxOngoingTokensPerSecond, - _a.lastCollectionAt == 0 ? rcau.maxInitialTokens : 0 - ); - if (maxClaim < maxPendingClaim) maxClaim = maxPendingClaim; + if (block.timestamp <= rcau.deadline) { + uint256 maxPendingClaim = _maxClaim( + block.timestamp, + rcau.endsAt, + rcau.maxSecondsPerCollection, + rcau.maxOngoingTokensPerSecond, + _a.lastCollectionAt == 0 ? rcau.maxInitialTokens : 0 + ); + if (maxClaim < maxPendingClaim) maxClaim = maxPendingClaim; + } } } } diff --git a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol index 6d9713cbf..9dd76355f 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol @@ -20,6 +20,7 @@ import { IERC165 } from "@openzeppelin/contracts/utils/introspection/IERC165.sol import { RecurringCollectorSharedTest } from "./shared.t.sol"; import { MockAgreementOwner } from "./MockAgreementOwner.t.sol"; +import { BareAgreementOwner } from "./BareAgreementOwner.t.sol"; /// @notice A payer contract that supports ERC165 + IProviderEligibility at offer time, /// but returns malformed (< 32 bytes) data from isEligible at collection time. diff --git a/packages/horizon/test/unit/payments/recurring-collector/getMaxNextClaim.t.sol b/packages/horizon/test/unit/payments/recurring-collector/getMaxNextClaim.t.sol index fb46ba2dc..fe792c059 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/getMaxNextClaim.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/getMaxNextClaim.t.sol @@ -689,5 +689,70 @@ contract RecurringCollectorGetMaxNextClaimTest is RecurringCollectorSharedTest { assertEq(combinedAfter, activeAfter, "combined scope falls back to active-only after pending expires"); } + /// @notice After update() promotes an RCAU to active, the rcauOffers slot still holds that + /// RCAU's bytes - but its hash now equals activeTermsHash. SCOPE_PENDING must skip it (the + /// guard is `rcauOffer.offerHash != activeTermsHash`); otherwise the active version would be + /// counted twice in the combined-scope envelope. + function test_GetMaxNextClaim_PostUpdate_PendingDoesNotDoubleCountActive() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds"), + serviceProvider: makeAddr("sp"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _recurringCollectorHelper.sensibleRCAU( + IRecurringCollector.RecurringCollectionAgreementUpdate({ + agreementId: agreementId, + deadline: 0, + endsAt: uint64(block.timestamp + 730 days), + maxInitialTokens: 200 ether, + maxOngoingTokensPerSecond: 2 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 7200, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + vm.prank(rca.dataService); + _recurringCollector.update(rcau, ""); + + // Post-update invariant: rcauOffers slot holds the now-active RCAU, so offerHash == + // activeTermsHash. SCOPE_PENDING must report nothing claimable beyond the active version. + assertEq( + _recurringCollector.hashRCAU(rcau), + _recurringCollector.getAgreement(agreementId).activeTermsHash, + "precondition: RCAU promoted, rcauOffers.offerHash == activeTermsHash" + ); + + uint256 pendingScope = _recurringCollector.getMaxNextClaim(agreementId, 2); // SCOPE_PENDING + assertEq(pendingScope, 0, "post-update SCOPE_PENDING must be 0 (no stale double-count)"); + + uint256 activeScope = _recurringCollector.getMaxNextClaim(agreementId, 1); // SCOPE_ACTIVE + uint256 combined = _recurringCollector.getMaxNextClaim(agreementId); + assertEq(combined, activeScope, "combined scope equals active alone - pending contributes nothing"); + assertGt(activeScope, 0, "sanity: active scope claim is non-zero"); + } + /* solhint-enable graph/func-name-mixedcase */ } From 067168e4dbdc91c93e2014d69f24e0e7e0c12751 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 27 Apr 2026 09:11:07 +0000 Subject: [PATCH 36/47] refactor(collector): collapse redundant state guard in _getMaxNextClaim The CanceledByServiceProvider early-return at the top of _getMaxNextClaim is fully subsumed by the next check (state must be Accepted or CanceledByPayer). Drop the redundant first check; the comprehensive guard catches CanceledByServiceProvider and any future non-collectable state. --- .../contracts/payments/collectors/RecurringCollector.sol | 3 --- 1 file changed, 3 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index 77ed57d0b..eb06ce743 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -1261,9 +1261,6 @@ contract RecurringCollector is * @return The maximum tokens that could be collected */ function _getMaxNextClaim(AgreementData storage _a) private view returns (uint256) { - // CanceledByServiceProvider = immediately non-collectable - if (_a.state == AgreementState.CanceledByServiceProvider) return 0; - // Only Accepted and CanceledByPayer are collectable if (_a.state != AgreementState.Accepted && _a.state != AgreementState.CanceledByPayer) return 0; uint256 collectionStart = _agreementCollectionStartAt(_a); From 757da417446150e478ae6d567c3aadd4e5058e2c Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 27 Apr 2026 11:30:43 +0000 Subject: [PATCH 37/47] fix(collector): use dedicated error for invalid offer type in offer() --- .../collectors/RecurringCollector.sol | 2 +- .../offerStorageLifecycle.t.sol | 350 +++++++++++++++++- .../recurring-collector/updateUnsigned.t.sol | 9 +- .../contracts/horizon/IRecurringCollector.sol | 6 + .../agreement-manager/ensureDistributed.t.sol | 5 +- 5 files changed, 352 insertions(+), 20 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index eb06ce743..cca28c494 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -459,7 +459,7 @@ contract RecurringCollector is uint256 index; if (offerType == OFFER_TYPE_NEW) (agreementId, versionHash, index) = _offerNew(data); else if (offerType == OFFER_TYPE_UPDATE) (agreementId, versionHash, index) = _offerUpdate(data); - else revert RecurringCollectorInvalidCollectData(data); + else revert RecurringCollectorInvalidOfferType(offerType); details = _getAgreementDetails(agreementId, versionHash, index); require(msg.sender == details.payer, RecurringCollectorUnauthorizedCaller(msg.sender, details.payer)); diff --git a/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol b/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol index a4988b4b0..24c2c01cf 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/offerStorageLifecycle.t.sol @@ -90,9 +90,17 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared assertEq(offerType, OFFER_TYPE_NEW, "stored entry at rcaHash"); assertTrue(offerData.length > 0, "stored data non-empty"); - IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); - assertEq(agreement.activeTermsHash, rcaHash, "agreement.activeTermsHash points at offer hash"); - assertEq(agreement.pendingTermsHash, bytes32(0), "no pending before update"); + // Pre-acceptance, the offer's hash is reachable via the per-version view. + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_CURRENT).versionHash, + rcaHash, + "VERSION_CURRENT resolves to offer hash before acceptance" + ); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, + bytes32(0), + "no pending before update" + ); } /// @notice Re-offering the identical RCA is idempotent — no second OfferStored event, storage unchanged. @@ -135,6 +143,126 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared assertTrue(offerData.length > 0, "accept preserves stored data"); } + /// @notice offer(OFFER_TYPE_NEW) on an Accepted agreement with a different-hash RCA must + /// not corrupt the agreement. Same agreementId + different-hash means a new RCA crafted + /// with the same identity (payer/dataService/serviceProvider/deadline/nonce) but altered + /// non-identity terms. Without a guard, the call would overwrite agreement.activeTermsHash + /// and replace rcaOffers contents — but agreement business fields (endsAt, maxInitialTokens, + /// etc.) stay as the originally-accepted values, leaving the trio out of sync. + function test_OfferNew_PostAccept_DifferentHash_Reverts() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + + // Build a sibling RCA: same identity (same agreementId), different non-identity term. + // Reconstruct from rca's fields rather than `rcaB = rca;` — memory struct assignment + // is a reference, so a subsequent `rcaB.maxInitialTokens = …` would mutate rca. + IRecurringCollector.RecurringCollectionAgreement memory rcaB = IRecurringCollector + .RecurringCollectionAgreement({ + deadline: rca.deadline, + endsAt: rca.endsAt, + payer: rca.payer, + dataService: rca.dataService, + serviceProvider: rca.serviceProvider, + maxInitialTokens: rca.maxInitialTokens + 1, + maxOngoingTokensPerSecond: rca.maxOngoingTokensPerSecond, + minSecondsPerCollection: rca.minSecondsPerCollection, + maxSecondsPerCollection: rca.maxSecondsPerCollection, + conditions: rca.conditions, + nonce: rca.nonce, + metadata: rca.metadata + }); + bytes32 rcaBHash = _recurringCollector.hashRCA(rcaB); + assertTrue(rcaBHash != rcaHash, "sibling has different hash"); + + vm.expectRevert( + abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorAgreementIncorrectState.selector, + agreementId, + IRecurringCollector.AgreementState.Accepted + ) + ); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rcaB), 0); + + assertEq( + _recurringCollector.getAgreement(agreementId).activeTermsHash, + rcaHash, + "activeTermsHash unchanged after rejected offer" + ); + (uint8 currentType, bytes memory currentData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(currentType, OFFER_TYPE_NEW, "rcaOffers entry unchanged"); + assertEq(keccak256(currentData), keccak256(abi.encode(rca)), "rcaOffers bytes still original"); + } + + /// @notice cancel(SCOPE_PENDING, activeTermsHash) on an Accepted agreement is a no-op — + /// the active version's stored bytes must remain retrievable. SCOPE_PENDING addresses + /// non-active offers; deleting the active one would silently break hash round-trip. + function test_Cancel_ScopePending_OnAcceptedActiveHash_NoOp() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + bytes32 rcaHash = _recurringCollector.hashRCA(rca); + + // Try to cancel the active hash under SCOPE_PENDING — should be a no-op. + vm.prank(address(approver)); + _recurringCollector.cancel(agreementId, rcaHash, SCOPE_PENDING); + + // Active version's bytes must still be retrievable. + (uint8 offerType, bytes memory offerData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(offerType, OFFER_TYPE_NEW, "active offer entry preserved"); + assertTrue(offerData.length > 0, "active data preserved"); + assertEq(_recurringCollector.getAgreement(agreementId).activeTermsHash, rcaHash, "activeTermsHash unchanged"); + } + + /// @notice After update() promotes an RCAU to active, cancel(SCOPE_PENDING, activeTermsHash) + /// must remain a no-op. The active version's bytes (now in the RCAU slot) must be preserved. + function test_Cancel_ScopePending_OnPostUpdateActiveHash_NoOp() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau(agreementId, rca, 1); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + vm.prank(rca.dataService); + _recurringCollector.update(rcau, ""); + bytes32 rcauHash = _recurringCollector.hashRCAU(rcau); + + vm.prank(address(approver)); + _recurringCollector.cancel(agreementId, rcauHash, SCOPE_PENDING); + + (uint8 offerType, bytes memory offerData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(offerType, OFFER_TYPE_UPDATE, "active offer (post-update RCAU) preserved"); + assertTrue(offerData.length > 0, "active data preserved"); + assertEq(_recurringCollector.getAgreement(agreementId).activeTermsHash, rcauHash, "activeTermsHash unchanged"); + } + /// @notice A successful update deletes the prior active offer from storage; the new RCAU terms /// become VERSION_CURRENT (OFFER_TYPE_UPDATE) and the pending slot clears. function test_Update_DeletesPriorActiveOffer_PromotesRcauToCurrent() public { @@ -161,7 +289,11 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared // We assert via getAgreementDetails: rcaHash is no longer a current version. IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); assertEq(agreement.activeTermsHash, rcauHash, "activeTermsHash = rcauHash after update"); - assertEq(agreement.pendingTermsHash, bytes32(0), "pendingTermsHash cleared after update"); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, + bytes32(0), + "pending cleared after update" + ); (uint8 currentType, ) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_CURRENT); assertEq(currentType, OFFER_TYPE_UPDATE, "current offer type now OFFER_TYPE_UPDATE"); @@ -200,9 +332,6 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared vm.prank(address(approver)); _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcauB), 0); - IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); - assertEq(agreement.pendingTermsHash, rcauBHash, "pending now points to rcauB"); - // Replaced rcauA entry no longer referenced by any version — VERSION_NEXT is now rcauB. bytes32 pendingHash = _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash; assertEq(pendingHash, rcauBHash, "VERSION_NEXT resolves to rcauB"); @@ -245,9 +374,11 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared vm.prank(address(approver)); _recurringCollector.cancel(agreementId, rcaHash, SCOPE_PENDING); - IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); - assertEq(agreement.activeTermsHash, bytes32(0), "activeTermsHash cleared"); - assertEq(agreement.pendingTermsHash, rcauHash, "pendingTermsHash survives RCA cancel"); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, + rcauHash, + "pending RCAU survives RCA cancel" + ); (uint8 currentType, bytes memory currentData) = _recurringCollector.getAgreementOfferAt( agreementId, @@ -294,7 +425,11 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared IRecurringCollector.AgreementData memory agreement = _recurringCollector.getAgreement(agreementId); assertEq(agreement.activeTermsHash, bytes32(0), "active cleared"); - assertEq(agreement.pendingTermsHash, bytes32(0), "pending cleared"); + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, + bytes32(0), + "pending cleared" + ); } /// @notice Pre-acceptance cancel with no pending RCAU still deletes the RCA offer and @@ -344,11 +479,202 @@ contract RecurringCollectorOfferStorageLifecycleTest is RecurringCollectorShared bytes memory data = abi.encode(rca); vm.expectRevert( - abi.encodeWithSelector(IRecurringCollector.RecurringCollectorInvalidCollectData.selector, data) + abi.encodeWithSelector(IRecurringCollector.RecurringCollectorInvalidOfferType.selector, OFFER_TYPE_NONE) ); vm.prank(address(approver)); _recurringCollector.offer(OFFER_TYPE_NONE, data, 0); } + /// @notice After update() promotes an RCAU to active, offering a fresh pending RCAU should + /// not erase the active RCAU's stored bytes — getAgreementOfferAt(VERSION_CURRENT) should + /// still return them and round-trip via hashRCAU. + /// @dev Skipped: the current implementation stores the pending RCAU in the same slot as + /// the active RCAU (a single rcauOffers entry per agreement), so a subsequent pending + /// offer overwrites the active version's bytes. The active hash remains queryable via + /// agreement.activeTermsHash and inline terms (endsAt, maxInitialTokens, etc.) are + /// preserved on AgreementData, but the original signed bytes are unreachable. + function test_OfferUpdate_PostUpdate_PreservesActiveRcauBytes() public { + vm.skip(true); + + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + // Accept RCA, then offer + apply RCAU1 (now the active version). + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau1 = _makeRcau(agreementId, rca, 1); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau1), 0); + vm.prank(rca.dataService); + _recurringCollector.update(rcau1, ""); + + bytes32 rcau1Hash = _recurringCollector.hashRCAU(rcau1); + assertEq( + _recurringCollector.getAgreement(agreementId).activeTermsHash, + rcau1Hash, + "active is rcau1 after update" + ); + + // Offer rcau2 as pending — different terms, different hash. + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau2 = _makeRcau(agreementId, rca, 2); + rcau2.maxInitialTokens = rcau1.maxInitialTokens + 1; // ensure different hash + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau2), 0); + + // Active version's bytes should still be retrievable. + (uint8 currentType, bytes memory currentData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(currentType, OFFER_TYPE_UPDATE, "active offer type still UPDATE"); + assertTrue(currentData.length > 0, "active rcau bytes still retrievable"); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory decodedActive = abi.decode( + currentData, + (IRecurringCollector.RecurringCollectionAgreementUpdate) + ); + assertEq(_recurringCollector.hashRCAU(decodedActive), rcau1Hash, "active rcau bytes round-trip to rcau1Hash"); + } + + /// @notice After update() promotes an RCAU to active, offering a fresh pending RCAU should + /// leave the pending retrievable via VERSION_NEXT while the active RCAU stays at VERSION_CURRENT. + /// @dev Skipped: same root cause as test_OfferUpdate_PostUpdate_PreservesActiveRcauBytes — + /// the single rcauOffers slot can only hold one entry, so when pending is stored the active + /// version's bytes are overwritten. + function test_OfferUpdate_PostUpdate_BothVersionsRetrievable() public { + vm.skip(true); + + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau1 = _makeRcau(agreementId, rca, 1); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau1), 0); + vm.prank(rca.dataService); + _recurringCollector.update(rcau1, ""); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau2 = _makeRcau(agreementId, rca, 2); + rcau2.maxInitialTokens = rcau1.maxInitialTokens + 1; + bytes32 rcau2Hash = _recurringCollector.hashRCAU(rcau2); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau2), 0); + + // VERSION_CURRENT: still rcau1 (active) + (uint8 currentType, bytes memory currentData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(currentType, OFFER_TYPE_UPDATE, "active offer type UPDATE"); + assertTrue(currentData.length > 0, "active rcau bytes retrievable"); + + // VERSION_NEXT: rcau2 (pending) + (uint8 nextType, bytes memory nextData) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_NEXT); + assertEq(nextType, OFFER_TYPE_UPDATE, "pending offer type UPDATE"); + IRecurringCollector.RecurringCollectionAgreementUpdate memory decodedPending = abi.decode( + nextData, + (IRecurringCollector.RecurringCollectionAgreementUpdate) + ); + assertEq(_recurringCollector.hashRCAU(decodedPending), rcau2Hash, "pending rcau bytes round-trip"); + } + + /// @notice offer(OFFER_TYPE_UPDATE) on a cancelled agreement must revert. Persistent + /// agreement.payer leaves the payer authorization check satisfied, so a state guard is + /// required to keep stale pending offers from polluting view methods on a cancelled agreement. + function test_OfferUpdate_Revert_OnCancelledAgreement() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + vm.prank(rca.dataService); + _recurringCollector.cancel(agreementId, IRecurringCollector.CancelAgreementBy.Payer); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau(agreementId, rca, 1); + bytes memory expectedErr = abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorAgreementIncorrectState.selector, + agreementId, + IRecurringCollector.AgreementState.CanceledByPayer + ); + vm.expectRevert(expectedErr); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + } + + /// @notice A pending RCAU stored before cancel() must be cleared by cancel(by) so that + /// SCOPE_PENDING and VERSION_NEXT correctly report no pending update after cancellation. + function test_Cancel_ClearsStalePendingRcau() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau(agreementId, rca, 1); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + + // Cancel before update() is called — RCAU remains queued + vm.prank(rca.dataService); + _recurringCollector.cancel(agreementId, IRecurringCollector.CancelAgreementBy.Payer); + + assertEq( + _recurringCollector.getAgreementDetails(agreementId, VERSION_NEXT).versionHash, + bytes32(0), + "pending RCAU cleared on cancel" + ); + (uint8 nextType, bytes memory nextData) = _recurringCollector.getAgreementOfferAt(agreementId, VERSION_NEXT); + assertEq(nextType, OFFER_TYPE_NONE, "no pending offer after cancel"); + assertEq(nextData.length, 0, "pending data empty after cancel"); + } + + /// @notice cancel() must not erase the active RCAU's stored bytes when the active terms came + /// from a successful update() — the rcauOffers entry holds the active version, not a pending one. + function test_Cancel_PreservesActiveRcauBytes() public { + MockAgreementOwner approver = new MockAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _makeRca(address(approver)); + _setupValidProvision(rca.serviceProvider, rca.dataService); + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeRcau(agreementId, rca, 1); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + vm.prank(rca.dataService); + _recurringCollector.update(rcau, ""); + bytes32 rcauHash = _recurringCollector.hashRCAU(rcau); + + vm.prank(rca.dataService); + _recurringCollector.cancel(agreementId, IRecurringCollector.CancelAgreementBy.Payer); + + // Active terms (rcauHash) preserved — VERSION_CURRENT still resolves the bytes. + (uint8 currentType, bytes memory currentData) = _recurringCollector.getAgreementOfferAt( + agreementId, + VERSION_CURRENT + ); + assertEq(currentType, OFFER_TYPE_UPDATE, "active offer type preserved"); + assertTrue(currentData.length > 0, "active rcau bytes preserved"); + assertEq(_recurringCollector.getAgreement(agreementId).activeTermsHash, rcauHash, "activeTermsHash unchanged"); + } + /* solhint-enable graph/func-name-mixedcase */ } diff --git a/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol b/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol index 38652d81a..d91bb9a5c 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/updateUnsigned.t.sol @@ -213,20 +213,17 @@ contract RecurringCollectorUpdateUnsignedTest is RecurringCollectorSharedTest { IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = _makeSimpleRCAU(agreementId, 1); - // Set the update deadline in the past + // Set the update deadline in the past — offer() now rejects expired deadlines rcau.deadline = uint64(block.timestamp - 1); - vm.prank(address(approver)); - _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); - bytes memory expectedErr = abi.encodeWithSelector( IRecurringCollector.RecurringCollectorAgreementDeadlineElapsed.selector, block.timestamp, rcau.deadline ); vm.expectRevert(expectedErr); - vm.prank(rca.dataService); - _recurringCollector.update(rcau, ""); + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); } /* solhint-enable graph/func-name-mixedcase */ diff --git a/packages/interfaces/contracts/horizon/IRecurringCollector.sol b/packages/interfaces/contracts/horizon/IRecurringCollector.sol index 747b38e44..87d48d437 100644 --- a/packages/interfaces/contracts/horizon/IRecurringCollector.sol +++ b/packages/interfaces/contracts/horizon/IRecurringCollector.sol @@ -296,6 +296,12 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { */ error RecurringCollectorInvalidCollectData(bytes invalidData); + /** + * @notice Thrown when offer() is called with an unrecognized offer type + * @param offerType The unrecognized offer type + */ + error RecurringCollectorInvalidOfferType(uint8 offerType); + /** * @notice Thrown when interacting with an agreement that has an incorrect state * @param agreementId The agreement ID diff --git a/packages/issuance/test/unit/agreement-manager/ensureDistributed.t.sol b/packages/issuance/test/unit/agreement-manager/ensureDistributed.t.sol index ec9542977..d2b55efea 100644 --- a/packages/issuance/test/unit/agreement-manager/ensureDistributed.t.sol +++ b/packages/issuance/test/unit/agreement-manager/ensureDistributed.t.sol @@ -34,7 +34,10 @@ contract RecurringAgreementManagerEnsureDistributedTest is RecurringAgreementMan vm.prank(governor); vm.expectEmit(address(agreementManager)); - emit IIssuanceTarget.IssuanceAllocatorSet(IIssuanceAllocationDistribution(address(mockAllocator)), IIssuanceAllocationDistribution(address(newAllocator))); + emit IIssuanceTarget.IssuanceAllocatorSet( + IIssuanceAllocationDistribution(address(mockAllocator)), + IIssuanceAllocationDistribution(address(newAllocator)) + ); agreementManager.setIssuanceAllocator(IIssuanceAllocationDistribution(address(newAllocator))); } From 87ee8b6df59d44e39458111831c4e92ddd3a29f5 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Fri, 1 May 2026 10:43:00 +0000 Subject: [PATCH 38/47] chore(collector): make module-level constants internal to free EIP-170 headroom Drops the auto-generated public getters for MIN_SECONDS_COLLECTION_WINDOW, CONDITION_ELIGIBILITY_CHECK, EIP712_RCA_TYPEHASH, and EIP712_RCAU_TYPEHASH (~50 bytes each) so the contract stays under the EIP-170 24576-byte limit when later additions land. Tests that read these via the public ABI switch to the literal value with a naming comment. Mirrors the dropped constants and EIP-712 typestrings under @graphprotocol/toolshed/core/recurring-collector so off-chain agents constructing offers have a typed source of truth. --- .../collectors/RecurringCollector.sol | 8 ++-- .../RecurringCollectorHelper.t.sol | 8 ++-- .../acceptValidation.t.sol | 6 +-- .../recurring-collector/viewFunctions.t.sol | 2 +- .../AgreementLifecycleAdvanced.t.sol | 4 +- packages/toolshed/src/core/index.ts | 1 + .../toolshed/src/core/recurring-collector.ts | 37 +++++++++++++++++++ 7 files changed, 51 insertions(+), 15 deletions(-) create mode 100644 packages/toolshed/src/core/recurring-collector.ts diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index cca28c494..df06075cb 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -63,10 +63,10 @@ contract RecurringCollector is using PPMMath for uint256; /// @notice The minimum number of seconds that must be between two collections - uint32 public constant MIN_SECONDS_COLLECTION_WINDOW = 600; + uint32 internal constant MIN_SECONDS_COLLECTION_WINDOW = 600; /// @notice Condition flag: agreement requires eligibility checks before collection - uint16 public constant CONDITION_ELIGIBILITY_CHECK = 1; + uint16 internal constant CONDITION_ELIGIBILITY_CHECK = 1; /// @notice Maximum gas forwarded to payer contract callbacks (beforeCollection / afterCollection). /// Caps gas available to payer implementations, preventing 63/64-rule gas siphoning attacks @@ -81,13 +81,13 @@ contract RecurringCollector is /* solhint-disable gas-small-strings */ /// @notice The EIP712 typehash for the RecurringCollectionAgreement struct - bytes32 public constant EIP712_RCA_TYPEHASH = + bytes32 internal constant EIP712_RCA_TYPEHASH = keccak256( "RecurringCollectionAgreement(uint64 deadline,uint64 endsAt,address payer,address dataService,address serviceProvider,uint256 maxInitialTokens,uint256 maxOngoingTokensPerSecond,uint32 minSecondsPerCollection,uint32 maxSecondsPerCollection,uint16 conditions,uint256 nonce,bytes metadata)" ); /// @notice The EIP712 typehash for the RecurringCollectionAgreementUpdate struct - bytes32 public constant EIP712_RCAU_TYPEHASH = + bytes32 internal constant EIP712_RCAU_TYPEHASH = keccak256( "RecurringCollectionAgreementUpdate(bytes16 agreementId,uint64 deadline,uint64 endsAt,uint256 maxInitialTokens,uint256 maxOngoingTokensPerSecond,uint32 minSecondsPerCollection,uint32 maxSecondsPerCollection,uint16 conditions,uint32 nonce,bytes metadata)" ); diff --git a/packages/horizon/test/unit/payments/recurring-collector/RecurringCollectorHelper.t.sol b/packages/horizon/test/unit/payments/recurring-collector/RecurringCollectorHelper.t.sol index 5914b422d..a512d0321 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/RecurringCollectorHelper.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/RecurringCollectorHelper.t.sol @@ -158,11 +158,9 @@ contract RecurringCollectorHelper is AuthorizableHelper, Bounder { return rcau; } + /// @dev 600 == RecurringCollector.MIN_SECONDS_COLLECTION_WINDOW function _sensibleDeadline(uint256 _seed) internal view returns (uint64) { - return - uint64( - bound(_seed, block.timestamp + 1, block.timestamp + uint256(collector.MIN_SECONDS_COLLECTION_WINDOW())) - ); // between now and +MIN_SECONDS_COLLECTION_WINDOW + return uint64(bound(_seed, block.timestamp + 1, block.timestamp + 600)); } function _sensibleEndsAt(uint256 _seed, uint32 _maxSecondsPerCollection) internal view returns (uint64) { @@ -184,7 +182,7 @@ contract RecurringCollectorHelper is AuthorizableHelper, Bounder { uint32( bound( _seed, - _minSecondsPerCollection + uint256(collector.MIN_SECONDS_COLLECTION_WINDOW()), + _minSecondsPerCollection + 600, // 600 == MIN_SECONDS_COLLECTION_WINDOW 60 * 60 * 24 * 30 ) // between minSecondsPerCollection + 2h and 30 days ); diff --git a/packages/horizon/test/unit/payments/recurring-collector/acceptValidation.t.sol b/packages/horizon/test/unit/payments/recurring-collector/acceptValidation.t.sol index 91e3e0bdd..790869907 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/acceptValidation.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/acceptValidation.t.sol @@ -106,7 +106,7 @@ contract RecurringCollectorAcceptValidationTest is RecurringCollectorSharedTest vm.expectRevert( abi.encodeWithSelector( IRecurringCollector.RecurringCollectorAgreementInvalidCollectionWindow.selector, - _recurringCollector.MIN_SECONDS_COLLECTION_WINDOW(), + uint32(600), // MIN_SECONDS_COLLECTION_WINDOW rca.minSecondsPerCollection, rca.maxSecondsPerCollection ) @@ -129,7 +129,7 @@ contract RecurringCollectorAcceptValidationTest is RecurringCollectorSharedTest vm.expectRevert( abi.encodeWithSelector( IRecurringCollector.RecurringCollectorAgreementInvalidCollectionWindow.selector, - _recurringCollector.MIN_SECONDS_COLLECTION_WINDOW(), + uint32(600), // MIN_SECONDS_COLLECTION_WINDOW rca.minSecondsPerCollection, rca.maxSecondsPerCollection ) @@ -144,7 +144,7 @@ contract RecurringCollectorAcceptValidationTest is RecurringCollectorSharedTest IRecurringCollector.RecurringCollectionAgreement memory rca = _makeValidRCA(); // Need: endsAt - deadline >= minSecondsPerCollection + MIN_SECONDS_COLLECTION_WINDOW // Set duration just under the minimum - uint32 minWindow = _recurringCollector.MIN_SECONDS_COLLECTION_WINDOW(); + uint32 minWindow = 600; // MIN_SECONDS_COLLECTION_WINDOW rca.minSecondsPerCollection = 600; rca.maxSecondsPerCollection = 600 + minWindow; // valid window rca.endsAt = rca.deadline + rca.minSecondsPerCollection + minWindow - 1; // 1 second too short diff --git a/packages/horizon/test/unit/payments/recurring-collector/viewFunctions.t.sol b/packages/horizon/test/unit/payments/recurring-collector/viewFunctions.t.sol index 80445920b..902572a29 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/viewFunctions.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/viewFunctions.t.sol @@ -16,7 +16,7 @@ contract RecurringCollectorViewFunctionsTest is RecurringCollectorSharedTest { (, , , bytes16 agreementId) = _sensibleAuthorizeAndAccept(fuzzy); // Skip past the minimum collection window so collection is possible - skip(_recurringCollector.MIN_SECONDS_COLLECTION_WINDOW()); + skip(600); // MIN_SECONDS_COLLECTION_WINDOW // Re-read agreement (timestamps don't change but view computes based on block.timestamp) (bool isCollectable, uint256 collectionSeconds, ) = _recurringCollector.getCollectionInfo(agreementId); diff --git a/packages/testing/test/integration/AgreementLifecycleAdvanced.t.sol b/packages/testing/test/integration/AgreementLifecycleAdvanced.t.sol index 95f91f1a0..9ad69b1a9 100644 --- a/packages/testing/test/integration/AgreementLifecycleAdvanced.t.sol +++ b/packages/testing/test/integration/AgreementLifecycleAdvanced.t.sol @@ -406,7 +406,7 @@ contract AgreementLifecycleAdvancedTest is FullStackHarness { tokensPerEntityPerSecond: 0 }); - uint16 eligibilityCondition = recurringCollector.CONDITION_ELIGIBILITY_CHECK(); + uint16 eligibilityCondition = 1; // CONDITION_ELIGIBILITY_CHECK IRecurringCollector.RecurringCollectionAgreement memory rca = _buildRCAEx( indexer, 0, @@ -442,7 +442,7 @@ contract AgreementLifecycleAdvancedTest is FullStackHarness { tokensPerEntityPerSecond: 0 }); - uint16 eligibilityCondition = recurringCollector.CONDITION_ELIGIBILITY_CHECK(); + uint16 eligibilityCondition = 1; // CONDITION_ELIGIBILITY_CHECK IRecurringCollector.RecurringCollectionAgreement memory rca = _buildRCAEx( indexer, 0, diff --git a/packages/toolshed/src/core/index.ts b/packages/toolshed/src/core/index.ts index 3934ed378..7dbbb79ba 100644 --- a/packages/toolshed/src/core/index.ts +++ b/packages/toolshed/src/core/index.ts @@ -6,5 +6,6 @@ export * from './custom-errors' export * from './disputes' export * from './graph-tally' export * from './poi' +export * from './recurring-collector' export * from './subgraph-service' export * from './types' diff --git a/packages/toolshed/src/core/recurring-collector.ts b/packages/toolshed/src/core/recurring-collector.ts new file mode 100644 index 000000000..42c1bc7be --- /dev/null +++ b/packages/toolshed/src/core/recurring-collector.ts @@ -0,0 +1,37 @@ +/** + * Constants for constructing RCA / RCAU offers against `RecurringCollector`. + * + * Source of truth for off-chain agents — the on-chain values are declared as + * `internal constant` in RecurringCollector.sol (no ABI getters), so consumers + * import these instead of querying the contract. + * + * EIP-712 typehashes are derived: `keccak256(toUtf8Bytes(typestring))`. Typed-data + * signing helpers (e.g. ethers `signTypedData`) take the field tuples directly — + * derive those from the typestring at the call site. + */ + +/** Minimum seconds between collections enforced by the collector window check. */ +export const RC_MIN_SECONDS_COLLECTION_WINDOW = 600 + +/** Conditions bitmask: agreement requires payer eligibility check (IProviderEligibility). */ +export const RC_CONDITION_ELIGIBILITY_CHECK = 1 << 0 + +/** + * Conditions bitmask: agreement uses IAgreementOwner callbacks + * (beforeCollection / afterCollection). Validated via ERC-165 at acceptance, + * so callback dispatch is locked to acceptance time and unaffected by + * post-acceptance payer code changes (e.g. EIP-7702 delegation swaps). + * + * Off-chain agents constructing RCAs against a contract payer that relies on + * these callbacks (such as RecurringAgreementManager for JIT escrow top-up) + * must set this bit; otherwise the callbacks are skipped silently. + */ +export const RC_CONDITION_AGREEMENT_OWNER = 1 << 1 + +/** EIP-712 typestring for a RecurringCollectionAgreement (RCA). */ +export const RC_EIP712_RCA_TYPESTRING = + 'RecurringCollectionAgreement(uint64 deadline,uint64 endsAt,address payer,address dataService,address serviceProvider,uint256 maxInitialTokens,uint256 maxOngoingTokensPerSecond,uint32 minSecondsPerCollection,uint32 maxSecondsPerCollection,uint16 conditions,uint256 nonce,bytes metadata)' + +/** EIP-712 typestring for a RecurringCollectionAgreementUpdate (RCAU). */ +export const RC_EIP712_RCAU_TYPESTRING = + 'RecurringCollectionAgreementUpdate(bytes16 agreementId,uint64 deadline,uint64 endsAt,uint256 maxInitialTokens,uint256 maxOngoingTokensPerSecond,uint32 minSecondsPerCollection,uint32 maxSecondsPerCollection,uint16 conditions,uint32 nonce,bytes metadata)' From f44fc5a4c74fa5190fd2892ae15a083b79f715f3 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Fri, 1 May 2026 10:43:26 +0000 Subject: [PATCH 39/47] feat(collector): add CONDITION_AGREEMENT_OWNER for ERC-165-validated callback opt-in MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replaces the live `payer.code.length != 0` callback dispatch in _preCollectCallbacks/_postCollectCallback with a stored condition flag. An offer that sets CONDITION_AGREEMENT_OWNER is only acceptable when the payer declares ERC-165 support for IAgreementOwner; the flag is then read at collection time, so callback dispatch is frozen to acceptance and unaffected by post-acceptance code changes such as EIP-7702 delegation swaps. This closes the gas-estimator griefing vector where an EOA payer could attach delegation between estimation and execution and cause collect() to revert. Consolidates the two interface-support errors into a single RecurringCollectorPayerDoesNotSupportInterface(payer, interfaceId). Renames _requirePayerToSupportEligibilityCheck to _requirePayerInterfaceSupport and folds both ERC-165 checks into it. Test coverage: - offer(NEW) reverts when CONDITION_AGREEMENT_OWNER is set on a payer that does not declare IAgreementOwner via ERC-165. - offer(UPDATE) re-validates ERC-165 support when an RCAU adds the flag to an already-accepted agreement, and reverts if the payer doesn't declare it. - collect skips both beforeCollection and afterCollection when the flag is unset, even with a contract payer — proves dispatch gates on the stored flag, not live payer.code.length. Addresses TRST-L-10. --- .../collectors/RecurringCollector.sol | 54 ++++++++--- .../MockAgreementOwner.t.sol | 5 +- .../recurring-collector/afterCollection.t.sol | 47 +++++++++ .../recurring-collector/coverageGaps.t.sol | 97 ++++++++++++++++++- .../contracts/horizon/IAgreementOwner.sol | 8 +- .../contracts/horizon/IRecurringCollector.sol | 13 ++- packages/issuance/audits/PR1301/TRST-L-10.md | 7 +- .../test/harness/FullStackHarness.t.sol | 4 +- 8 files changed, 206 insertions(+), 29 deletions(-) diff --git a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol index df06075cb..ba4d2ff6a 100644 --- a/packages/horizon/contracts/payments/collectors/RecurringCollector.sol +++ b/packages/horizon/contracts/payments/collectors/RecurringCollector.sol @@ -66,7 +66,13 @@ contract RecurringCollector is uint32 internal constant MIN_SECONDS_COLLECTION_WINDOW = 600; /// @notice Condition flag: agreement requires eligibility checks before collection - uint16 internal constant CONDITION_ELIGIBILITY_CHECK = 1; + uint16 internal constant CONDITION_ELIGIBILITY_CHECK = 1 << 0; + + /// @notice Condition flag: agreement uses the IAgreementOwner callbacks + /// (beforeCollection / afterCollection). Validated via ERC-165 at acceptance, so the + /// callback dispatch decision is frozen to acceptance time and immune to post-acceptance + /// payer code changes (e.g. EIP-7702 delegation swaps). + uint16 internal constant CONDITION_AGREEMENT_OWNER = 1 << 1; /// @notice Maximum gas forwarded to payer contract callbacks (beforeCollection / afterCollection). /// Caps gas available to payer implementations, preventing 63/64-rule gas siphoning attacks @@ -763,12 +769,14 @@ contract RecurringCollector is } agreement.lastCollectionAt = uint64(block.timestamp); + address payer = agreement.payer; + if (0 < tokensToCollect) { _preCollectCallbacks(agreement, _params.agreementId, tokensToCollect); _graphPaymentsEscrow().collect( _paymentType, - agreement.payer, + payer, agreement.serviceProvider, tokensToCollect, agreement.dataService, @@ -780,7 +788,7 @@ contract RecurringCollector is emit PaymentCollected( _paymentType, _params.collectionId, - agreement.payer, + payer, agreement.serviceProvider, agreement.dataService, tokensToCollect @@ -788,7 +796,7 @@ contract RecurringCollector is emit RCACollected( agreement.dataService, - agreement.payer, + payer, agreement.serviceProvider, _params.agreementId, _params.collectionId, @@ -796,21 +804,30 @@ contract RecurringCollector is _params.dataServiceCut ); - if (0 < tokensToCollect) _postCollectCallback(agreement.payer, _params.agreementId, tokensToCollect); + if (0 < tokensToCollect) + _postCollectCallback(payer, agreement.conditions, _params.agreementId, tokensToCollect); return tokensToCollect; } /* solhint-enable function-max-lines */ /** - * @notice Validates that a contract payer supports IProviderEligibility via ERC-165. + * @notice Validates that the payer supports the interfaces required by the conditions bitmask. + * @dev Each set condition bit requires the payer to declare ERC-165 support for the matching + * interface. * @param payer The payer address to validate * @param conditions The conditions bitmask */ - function _requirePayerToSupportEligibilityCheck(address payer, uint16 conditions) private view { + function _requirePayerInterfaceSupport(address payer, uint16 conditions) private view { if (conditions & CONDITION_ELIGIBILITY_CHECK != 0) { require( ERC165Checker.supportsInterface(payer, type(IProviderEligibility).interfaceId), - RecurringCollectorPayerDoesNotSupportEligibilityInterface(payer) + RecurringCollectorPayerDoesNotSupportInterface(payer, type(IProviderEligibility).interfaceId) + ); + } + if (conditions & CONDITION_AGREEMENT_OWNER != 0) { + require( + ERC165Checker.supportsInterface(payer, type(IAgreementOwner).interfaceId), + RecurringCollectorPayerDoesNotSupportInterface(payer, type(IAgreementOwner).interfaceId) ); } } @@ -829,12 +846,13 @@ contract RecurringCollector is ) private { address payer = agreement.payer; address provider = agreement.serviceProvider; + uint16 conditions = agreement.conditions; // Eligibility gate (opt-in via conditions bitmask). Assembly staticcall caps returndata // copy to 32 bytes, preventing returndata bombing. Only an explicit return of 0 blocks // collection; reverts, short returndata, and malformed responses are treated as "no // opinion" (collection proceeds). - if ((agreement.conditions & CONDITION_ELIGIBILITY_CHECK) != 0) { + if ((conditions & CONDITION_ELIGIBILITY_CHECK) != 0) { if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) revert RecurringCollectorInsufficientCallbackGas(); bytes memory cd = abi.encodeCall(IProviderEligibility.isEligible, (provider)); @@ -854,7 +872,7 @@ contract RecurringCollector is } // Assembly call copies 0 bytes of returndata, preventing returndata bombing. - if (payer.code.length != 0 && payer != msg.sender) { + if ((conditions & CONDITION_AGREEMENT_OWNER) != 0 && payer != msg.sender) { if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) revert RecurringCollectorInsufficientCallbackGas(); bytes memory cd = abi.encodeCall(IAgreementOwner.beforeCollection, (agreementId, tokensToCollect)); @@ -871,12 +889,18 @@ contract RecurringCollector is * @notice Executes post-collection callback: afterCollection notification. * @dev Extracted from _collect to reduce stack depth for coverage builds. * @param payer The payer address + * @param conditions The agreement conditions bitmask * @param agreementId The agreement ID * @param tokensToCollect The amount of tokens collected */ - function _postCollectCallback(address payer, bytes16 agreementId, uint256 tokensToCollect) private { + function _postCollectCallback( + address payer, + uint16 conditions, + bytes16 agreementId, + uint256 tokensToCollect + ) private { // Notify contract payers so they can reconcile escrow in the same transaction. - if (payer != msg.sender && payer.code.length != 0) { + if (payer != msg.sender && (conditions & CONDITION_AGREEMENT_OWNER) != 0) { // 64/63 accounts for EIP-150 63/64 gas forwarding rule. if (gasleft() < (MAX_PAYER_CALLBACK_GAS * 64) / 63 + CALLBACK_GAS_OVERHEAD) revert RecurringCollectorInsufficientCallbackGas(); @@ -936,14 +960,14 @@ contract RecurringCollector is } /** - * @notice Validates offer terms: collection window, eligibility support, and overflow. + * @notice Validates offer terms: collection window, payer interface support, and overflow. * @dev Called by _validateAndStoreAgreement and _validateAndStoreUpdate. Time-independent — * validates against the offer's deadline so the check is stable across the offer's lifetime. * @param _deadline The offer's acceptance deadline * @param _endsAt The end time of the agreement * @param _minSecondsPerCollection The minimum seconds per collection * @param _maxSecondsPerCollection The maximum seconds per collection - * @param _payer The payer address (for eligibility validation) + * @param _payer The payer address (for interface validation) * @param _conditions The conditions bitmask * @param _maxOngoingTokensPerSecond The maximum ongoing tokens per second */ @@ -957,7 +981,7 @@ contract RecurringCollector is uint256 _maxOngoingTokensPerSecond ) private view { _requireValidCollectionWindowParams(_deadline, _endsAt, _minSecondsPerCollection, _maxSecondsPerCollection); - _requirePayerToSupportEligibilityCheck(_payer, _conditions); + _requirePayerInterfaceSupport(_payer, _conditions); // Reverts on overflow — rejecting excessive terms that could prevent collection _maxOngoingTokensPerSecond * _maxSecondsPerCollection * 1024; } diff --git a/packages/horizon/test/unit/payments/recurring-collector/MockAgreementOwner.t.sol b/packages/horizon/test/unit/payments/recurring-collector/MockAgreementOwner.t.sol index 3d8db160e..4ce043a29 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/MockAgreementOwner.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/MockAgreementOwner.t.sol @@ -66,6 +66,9 @@ contract MockAgreementOwner is IAgreementOwner, IProviderEligibility, IERC165 { // -- IERC165 -- function supportsInterface(bytes4 interfaceId) external pure override returns (bool) { - return interfaceId == type(IProviderEligibility).interfaceId || interfaceId == type(IERC165).interfaceId; + return + interfaceId == type(IAgreementOwner).interfaceId || + interfaceId == type(IProviderEligibility).interfaceId || + interfaceId == type(IERC165).interfaceId; } } diff --git a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol index 5af9b3b0f..61a5ac87d 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/afterCollection.t.sol @@ -33,6 +33,8 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { metadata: "" }) ); + // sensibleRCA zeroes conditions unconditionally; opt back in for callback dispatch. + rca.conditions = 2; // CONDITION_AGREEMENT_OWNER vm.prank(address(approver)); _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); @@ -103,6 +105,51 @@ contract RecurringCollectorAfterCollectionTest is RecurringCollectorSharedTest { assertEq(approver.lastCollectedTokens(), tokens); } + /// @notice With CONDITION_AGREEMENT_OWNER unset, callback dispatch is gated off + /// regardless of whether the payer happens to be a contract. Verifies the new + /// dispatch reads the stored flag rather than `payer.code.length`, closing the + /// EIP-7702 surprise-callback vector. + function test_AfterCollection_NoCallbacks_WhenAgreementOwnerConditionUnset() public { + MockAgreementOwner approver = _newApprover(); + IRecurringCollector.RecurringCollectionAgreement memory rca = _recurringCollectorHelper.sensibleRCA( + IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(approver), + dataService: makeAddr("ds-no-cb"), + serviceProvider: makeAddr("sp-no-cb"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, + nonce: 1, + metadata: "" + }) + ); + // sensibleRCA zeroes conditions; leave it zero to assert callbacks are skipped. + + vm.prank(address(approver)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + _setupValidProvision(rca.serviceProvider, rca.dataService); + vm.prank(rca.dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + skip(rca.minSecondsPerCollection); + uint256 tokens = 1 ether; + bytes memory data = _generateCollectData(_generateCollectParams(rca, agreementId, bytes32("col1"), tokens, 0)); + + vm.prank(rca.dataService); + uint256 collected = _recurringCollector.collect(IGraphPayments.PaymentTypes.IndexingFee, data); + assertEq(collected, tokens); + + // Neither callback fired — mock state is still default + assertEq(approver.lastBeforeCollectionAgreementId(), bytes16(0), "beforeCollection must be skipped"); + assertEq(approver.lastBeforeCollectionTokens(), 0, "beforeCollection must be skipped"); + assertEq(approver.lastCollectedAgreementId(), bytes16(0), "afterCollection must be skipped"); + assertEq(approver.lastCollectedTokens(), 0, "afterCollection must be skipped"); + } + function test_AfterCollection_CollectionSucceedsWhenCallbackReverts() public { MockAgreementOwner approver = _newApprover(); (IRecurringCollector.RecurringCollectionAgreement memory rca, bytes16 agreementId) = _acceptUnsignedAgreement( diff --git a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol index 9dd76355f..689cf5b48 100644 --- a/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol +++ b/packages/horizon/test/unit/payments/recurring-collector/coverageGaps.t.sol @@ -1139,14 +1139,102 @@ contract RecurringCollectorCoverageGapsTest is RecurringCollectorSharedTest { vm.expectRevert( abi.encodeWithSelector( - IRecurringCollector.RecurringCollectorPayerDoesNotSupportEligibilityInterface.selector, - address(bare) + IRecurringCollector.RecurringCollectorPayerDoesNotSupportInterface.selector, + address(bare), + type(IProviderEligibility).interfaceId ) ); vm.prank(address(bare)); _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); } + /// @notice When an RCA enables CONDITION_AGREEMENT_OWNER, the payer must support + /// IAgreementOwner via ERC-165. BareAgreementOwner implements IAgreementOwner + /// methods but not IERC165, so ERC165Checker.supportsInterface returns false and + /// the require fires at offer time. + function test_OfferNew_Revert_WhenAgreementOwnerConditionAndPayerLacksInterface() public { + BareAgreementOwner bare = new BareAgreementOwner(); + IRecurringCollector.RecurringCollectionAgreement memory rca = IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(bare), + dataService: makeAddr("ds-ao-bare"), + serviceProvider: makeAddr("sp-ao-bare"), + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 2, // CONDITION_AGREEMENT_OWNER + nonce: 1, + metadata: "" + }); + + vm.expectRevert( + abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorPayerDoesNotSupportInterface.selector, + address(bare), + type(IAgreementOwner).interfaceId + ) + ); + vm.prank(address(bare)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + } + + /// @notice An RCAU that adds CONDITION_AGREEMENT_OWNER to an accepted agreement + /// must re-validate ERC-165 support against the current payer. If the payer + /// does not declare IAgreementOwner via ERC-165, the update reverts at offer time. + function test_OfferUpdate_Revert_WhenAgreementOwnerConditionAddedAndPayerLacksInterface() public { + BareAgreementOwner bare = new BareAgreementOwner(); + address dataService = makeAddr("ds-ao-update"); + address serviceProvider = makeAddr("sp-ao-update"); + + IRecurringCollector.RecurringCollectionAgreement memory rca = IRecurringCollector.RecurringCollectionAgreement({ + deadline: uint64(block.timestamp + 1 hours), + endsAt: uint64(block.timestamp + 365 days), + payer: address(bare), + dataService: dataService, + serviceProvider: serviceProvider, + maxInitialTokens: 100 ether, + maxOngoingTokensPerSecond: 1 ether, + minSecondsPerCollection: 600, + maxSecondsPerCollection: 3600, + conditions: 0, // no flags — passes acceptance with no ERC-165 check + nonce: 1, + metadata: "" + }); + + vm.prank(address(bare)); + _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); + vm.prank(dataService); + bytes16 agreementId = _recurringCollector.accept(rca, ""); + + // Now submit RCAU adding CONDITION_AGREEMENT_OWNER — should revert because + // BareAgreementOwner does not declare IAgreementOwner via ERC-165. + IRecurringCollector.RecurringCollectionAgreementUpdate memory rcau = IRecurringCollector + .RecurringCollectionAgreementUpdate({ + agreementId: agreementId, + deadline: uint64(block.timestamp + 1 hours), + endsAt: rca.endsAt, + maxInitialTokens: rca.maxInitialTokens, + maxOngoingTokensPerSecond: rca.maxOngoingTokensPerSecond, + minSecondsPerCollection: rca.minSecondsPerCollection, + maxSecondsPerCollection: rca.maxSecondsPerCollection, + conditions: 2, // CONDITION_AGREEMENT_OWNER + nonce: 1, + metadata: "" + }); + + vm.expectRevert( + abi.encodeWithSelector( + IRecurringCollector.RecurringCollectorPayerDoesNotSupportInterface.selector, + address(bare), + type(IAgreementOwner).interfaceId + ) + ); + vm.prank(address(bare)); + _recurringCollector.offer(OFFER_TYPE_UPDATE, abi.encode(rcau), 0); + } + // ══════════════════════════════════════════════════════════════════════ // Gap 22 / 23 — Callback-gas prechecks (deterministic single-call) // @@ -1225,11 +1313,14 @@ contract RecurringCollectorCoverageGapsTest is RecurringCollectorSharedTest { maxOngoingTokensPerSecond: 1 ether, minSecondsPerCollection: 600, maxSecondsPerCollection: 3600, - conditions: 0, // no eligibility — skip first precheck + conditions: 0, nonce: 1, metadata: "" }) ); + // sensibleRCA zeroes conditions unconditionally; opt into agreement-owner callbacks + // (without eligibility) so the beforeCollection precheck is the first to fire. + rca.conditions = 2; // CONDITION_AGREEMENT_OWNER vm.prank(address(approver)); _recurringCollector.offer(OFFER_TYPE_NEW, abi.encode(rca), 0); diff --git a/packages/interfaces/contracts/horizon/IAgreementOwner.sol b/packages/interfaces/contracts/horizon/IAgreementOwner.sol index 03750789d..88d74b513 100644 --- a/packages/interfaces/contracts/horizon/IAgreementOwner.sol +++ b/packages/interfaces/contracts/horizon/IAgreementOwner.sol @@ -4,8 +4,12 @@ pragma solidity ^0.8.22; /** * @title Interface for contract payer callbacks from RecurringCollector * @author Edge & Node - * @notice Callbacks that RecurringCollector invokes on contract payers (payers with - * deployed code, as opposed to EOA payers that use ECDSA signatures). + * @notice Callbacks that RecurringCollector invokes on contract payers that opt in + * via the CONDITION_AGREEMENT_OWNER offer condition. + * + * @dev Opt-in is enforced at acceptance: an offer that sets CONDITION_AGREEMENT_OWNER + * is only acceptable if the payer reports support for this interface via ERC-165 + * (`supportsInterface(type(IAgreementOwner).interfaceId)` returns true). * * Collection callbacks: * - {beforeCollection}: called before PaymentsEscrow.collect() so the payer can top up diff --git a/packages/interfaces/contracts/horizon/IRecurringCollector.sol b/packages/interfaces/contracts/horizon/IRecurringCollector.sol index 87d48d437..18f89f00b 100644 --- a/packages/interfaces/contracts/horizon/IRecurringCollector.sol +++ b/packages/interfaces/contracts/horizon/IRecurringCollector.sol @@ -50,7 +50,8 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { * except for the first collection * @param minSecondsPerCollection The minimum amount of seconds that must pass between collections * @param maxSecondsPerCollection The maximum seconds of service that can be collected in a single collection - * @param conditions Bitmask of payer-declared conditions (e.g. CONDITION_ELIGIBILITY_CHECK) + * @param conditions Bitmask of payer-declared conditions + * (e.g. CONDITION_ELIGIBILITY_CHECK, CONDITION_AGREEMENT_OWNER) * @param nonce A unique nonce for preventing collisions (user-chosen) * @param metadata Arbitrary metadata to extend functionality if a data service requires it * @@ -82,7 +83,8 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { * except for the first collection * @param minSecondsPerCollection The minimum amount of seconds that must pass between collections * @param maxSecondsPerCollection The maximum seconds of service that can be collected in a single collection - * @param conditions Bitmask of payer-declared conditions (e.g. CONDITION_ELIGIBILITY_CHECK) + * @param conditions Bitmask of payer-declared conditions + * (e.g. CONDITION_ELIGIBILITY_CHECK, CONDITION_AGREEMENT_OWNER) * @param nonce The nonce for preventing replay attacks (must be current nonce + 1) * @param metadata Arbitrary metadata to extend functionality if a data service requires it */ @@ -392,11 +394,12 @@ interface IRecurringCollector is IAuthorizable, IAgreementCollector { error RecurringCollectorCollectionNotEligible(bytes16 agreementId, address serviceProvider); /** - * @notice Thrown when an offer sets CONDITION_ELIGIBILITY_CHECK but the payer - * does not support IProviderEligibility (via ERC-165) + * @notice Thrown when an offer sets a condition flag whose corresponding + * interface is not declared by the payer (via ERC-165) * @param payer The payer address + * @param interfaceId The ERC-165 interface id the payer must declare for the set condition */ - error RecurringCollectorPayerDoesNotSupportEligibilityInterface(address payer); + error RecurringCollectorPayerDoesNotSupportInterface(address payer, bytes4 interfaceId); /** * @notice Thrown when the caller does not provide enough gas for the payer callback diff --git a/packages/issuance/audits/PR1301/TRST-L-10.md b/packages/issuance/audits/PR1301/TRST-L-10.md index 919cda91d..0eda2ba7a 100644 --- a/packages/issuance/audits/PR1301/TRST-L-10.md +++ b/packages/issuance/audits/PR1301/TRST-L-10.md @@ -21,6 +21,9 @@ TBD --- -Using `CONDITION_ELIGIBILITY_CHECK` for callback dispatch does not seem appropriate. The eligibility check is an agreement term, not a proxy for payer type and contract payers can legitimately offer agreements without this condition. The provider agreeing to the check requires greater trust in the payer. Gating callbacks on this flag would deny `beforeCollection`/`afterCollection` to contract payers for agreements without eligibility gating. +Reusing `CONDITION_ELIGIBILITY_CHECK` for callback dispatch avoided because the eligibility checking is a different concern with different trust assumptions. An agreement can legitimately have one without the other. -With the returndata bombing fix (TRST-M-4), the gas impact of an EIP-7702 EOA gaining callbacks is bounded and predictable. We do not believe this as a significant attack vector. The `beforeCollection`/`afterCollection` callbacks are non-reverting and non-blocking. A payer adding code via EIP-7702 to better handle escrow reconciliation could be a valid use case and in the best interests of all parties. +Introduced `CONDITION_AGREEMENT_OWNER` flag that mirrors the eligibility pattern: + +- `_requirePayerInterfaceSupport` validates `IERC165(payer).supportsInterface(type(IAgreementOwner).interfaceId)` if the flag is set, alongside the existing eligibility check. +- `_preCollectCallbacks` and `_postCollectCallback` dispatch on `agreement.conditions & CONDITION_AGREEMENT_OWNER`, replacing the `payer.code.length` check. diff --git a/packages/testing/test/harness/FullStackHarness.t.sol b/packages/testing/test/harness/FullStackHarness.t.sol index d095804f0..b02735288 100644 --- a/packages/testing/test/harness/FullStackHarness.t.sol +++ b/packages/testing/test/harness/FullStackHarness.t.sol @@ -391,6 +391,8 @@ abstract contract FullStackHarness is Test { // ── RAM agreement helpers ────────────────────────────────────────── /// @notice Build an RCA with RAM as payer, targeting a specific indexer + SS + /// @dev Sets CONDITION_AGREEMENT_OWNER (=2) so RAM receives beforeCollection / + /// afterCollection — JIT escrow top-up and reconciliation depend on these callbacks. function _buildRCA( IndexerSetup memory indexer, uint256 maxInitialTokens, @@ -410,7 +412,7 @@ abstract contract FullStackHarness is Test { minSecondsPerCollection: 60, maxSecondsPerCollection: maxSecondsPerCollection, nonce: 1, - conditions: 0, + conditions: 2, // CONDITION_AGREEMENT_OWNER metadata: abi.encode( IndexingAgreement.AcceptIndexingAgreementMetadata({ subgraphDeploymentId: indexer.subgraphDeploymentId, From 5b07b583348bd1b37796a847d42d2f46a74224f3 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 4 May 2026 15:23:42 +0000 Subject: [PATCH 40/47] docs(audits): drop withdrawn TRST findings, retitle and park remaining lows for v03 v03 of the Trust Security report withdraws v02 TRST-M-5 (perpetual thaw griefing via micro deposits) and v02 TRST-L-6 (update offer cleanup bypassed via planted offer), and renumbers the remaining lows from L-7..L-11 down to L-6..L-10. This commit performs the content side and parks each renamed file under TRST-L-{old}-{new}.md so the next commit can move each file to its final v03 path with no cascade and no path conflicts: - delete v02 TRST-M-5.md and v02 TRST-L-6.md - update the title line of TRST-L-7..L-11 to the new v03 number - rename TRST-L-{old}.md -> TRST-L-{old}-{new}.md Each rename here is a self-contained delete+add pair, so git's default rename detection picks them up at >=96% similarity without -B. --- .../PR1301/{TRST-L-10.md => TRST-L-10-9.md} | 2 +- .../PR1301/{TRST-L-11.md => TRST-L-11-10.md} | 2 +- packages/issuance/audits/PR1301/TRST-L-6.md | 28 ------------------- .../PR1301/{TRST-L-7.md => TRST-L-7-6.md} | 2 +- .../PR1301/{TRST-L-8.md => TRST-L-8-7.md} | 2 +- .../PR1301/{TRST-L-9.md => TRST-L-9-8.md} | 2 +- packages/issuance/audits/PR1301/TRST-M-5.md | 28 ------------------- 7 files changed, 5 insertions(+), 61 deletions(-) rename packages/issuance/audits/PR1301/{TRST-L-10.md => TRST-L-10-9.md} (96%) rename packages/issuance/audits/PR1301/{TRST-L-11.md => TRST-L-11-10.md} (98%) delete mode 100644 packages/issuance/audits/PR1301/TRST-L-6.md rename packages/issuance/audits/PR1301/{TRST-L-7.md => TRST-L-7-6.md} (97%) rename packages/issuance/audits/PR1301/{TRST-L-8.md => TRST-L-8-7.md} (97%) rename packages/issuance/audits/PR1301/{TRST-L-9.md => TRST-L-9-8.md} (96%) delete mode 100644 packages/issuance/audits/PR1301/TRST-M-5.md diff --git a/packages/issuance/audits/PR1301/TRST-L-10.md b/packages/issuance/audits/PR1301/TRST-L-10-9.md similarity index 96% rename from packages/issuance/audits/PR1301/TRST-L-10.md rename to packages/issuance/audits/PR1301/TRST-L-10-9.md index 0eda2ba7a..415690905 100644 --- a/packages/issuance/audits/PR1301/TRST-L-10.md +++ b/packages/issuance/audits/PR1301/TRST-L-10-9.md @@ -1,4 +1,4 @@ -# TRST-L-10: EIP-7702 payer code change enables callback gas griefing after acceptance +# TRST-L-9: EIP-7702 payer code change enables callback gas griefing after acceptance - **Severity:** Low - **Category:** Type confusion diff --git a/packages/issuance/audits/PR1301/TRST-L-11.md b/packages/issuance/audits/PR1301/TRST-L-11-10.md similarity index 98% rename from packages/issuance/audits/PR1301/TRST-L-11.md rename to packages/issuance/audits/PR1301/TRST-L-11-10.md index c36a68d1a..b4366cb71 100644 --- a/packages/issuance/audits/PR1301/TRST-L-11.md +++ b/packages/issuance/audits/PR1301/TRST-L-11-10.md @@ -1,4 +1,4 @@ -# TRST-L-11: Inaccurate state flags returned by getAgreementDetails() and \_offerUpdate() +# TRST-L-10: Inaccurate state flags returned by getAgreementDetails() and \_offerUpdate() - **Severity:** Low - **Category:** Logical flaws diff --git a/packages/issuance/audits/PR1301/TRST-L-6.md b/packages/issuance/audits/PR1301/TRST-L-6.md deleted file mode 100644 index 50b3bf72f..000000000 --- a/packages/issuance/audits/PR1301/TRST-L-6.md +++ /dev/null @@ -1,28 +0,0 @@ -# TRST-L-6: Update offer cleanup bypassed via planted offer matching active terms - -- **Severity:** Low -- **Category:** Logical flaws -- **Source:** RecurringCollector.sol -- **Status:** Open - -## Description - -In `_validateAndStoreUpdate()` (lines 854-858), cleanup of stored offers after an update uses an if / else if chain keyed on the prior `activeTermsHash`. The first branch deletes a matching entry from `rcaOffers`; the second deletes a matching entry from `rcauOffers`. - -A payer who observes a pending update can call `offer()` with `OFFER_TYPE_NEW` and parameters that reproduce the agreement's currently active RCA terms. The resulting entry in `rcaOffers` hashes to the same `oldHash` value. When `update()` later reaches the cleanup block, the first branch matches and deletes the planted entry, and the else if branch that would have cleaned up the corresponding `rcauOffers` entry is skipped. The pending update offer is then orphaned in storage. - -The `updateNonce` check elsewhere in `_validateAndStoreUpdate()` prevents the orphaned RCAU from being re-accepted, so the issue does not translate to a direct economic exploit. However, it introduces a divergence between the documented invariant that replaced offers are cleaned up and the actual storage state, which could surface as a correctness issue in future features that rely on offer presence. - -## Recommended Mitigation - -Delete both `rcaOffers[agreementId]` and `rcauOffers[agreementId]` unconditionally at the end of `_validateAndStoreUpdate()`. After a successful update the agreement's active terms have changed and any pre-existing offer entries for the same `agreementId` are stale by definition. - -## Team Response - -TBD - ---- - -The described attack requires planting an RCA offer whose EIP-712 hash collides with the active `activeTermsHash`. Because `_hashRCA` and `_hashRCAU` use distinct type hashes (`EIP712_RCA_TYPEHASH` vs `EIP712_RCAU_TYPEHASH`), cross-type collisions require a keccak256 preimage collision? Same-type collisions require the payer to reproduce the exact RCA terms, which is not an attack (the payer authored those terms). - -(Cleanup handling will be improved in combination with the response to TRST-L-11.) diff --git a/packages/issuance/audits/PR1301/TRST-L-7.md b/packages/issuance/audits/PR1301/TRST-L-7-6.md similarity index 97% rename from packages/issuance/audits/PR1301/TRST-L-7.md rename to packages/issuance/audits/PR1301/TRST-L-7-6.md index 187e23e61..efd132305 100644 --- a/packages/issuance/audits/PR1301/TRST-L-7.md +++ b/packages/issuance/audits/PR1301/TRST-L-7-6.md @@ -1,4 +1,4 @@ -# TRST-L-7: The cancel() function order sensitivity leaves RCAU offer unreachable +# TRST-L-6: The cancel() function order sensitivity leaves RCAU offer unreachable - **Severity:** Low - **Category:** Time-sensitivity issues diff --git a/packages/issuance/audits/PR1301/TRST-L-8.md b/packages/issuance/audits/PR1301/TRST-L-8-7.md similarity index 97% rename from packages/issuance/audits/PR1301/TRST-L-8.md rename to packages/issuance/audits/PR1301/TRST-L-8-7.md index c85f413d0..442dcd974 100644 --- a/packages/issuance/audits/PR1301/TRST-L-8.md +++ b/packages/issuance/audits/PR1301/TRST-L-8-7.md @@ -1,4 +1,4 @@ -# TRST-L-8: EOA payer signatures cannot be revoked before deadline +# TRST-L-7: EOA payer signatures cannot be revoked before deadline - **Severity:** Low - **Category:** Functionality flaws diff --git a/packages/issuance/audits/PR1301/TRST-L-9.md b/packages/issuance/audits/PR1301/TRST-L-9-8.md similarity index 96% rename from packages/issuance/audits/PR1301/TRST-L-9.md rename to packages/issuance/audits/PR1301/TRST-L-9-8.md index e98f66046..2f8c4b56e 100644 --- a/packages/issuance/audits/PR1301/TRST-L-9.md +++ b/packages/issuance/audits/PR1301/TRST-L-9-8.md @@ -1,4 +1,4 @@ -# TRST-L-9: Callback gas precheck does not account for intermediate overhead +# TRST-L-8: Callback gas precheck does not account for intermediate overhead - **Severity:** Low - **Category:** Gas-related issues diff --git a/packages/issuance/audits/PR1301/TRST-M-5.md b/packages/issuance/audits/PR1301/TRST-M-5.md deleted file mode 100644 index 155efa2be..000000000 --- a/packages/issuance/audits/PR1301/TRST-M-5.md +++ /dev/null @@ -1,28 +0,0 @@ -# TRST-M-5: Perpetual thaw griefing via micro deposits in \_reconcileProviderEscrow - -- **Severity:** Medium -- **Category:** Griefing attacks -- **Source:** RecurringAgreementManager.sol -- **Status:** Open - -## Description - -The `_reconcileProviderEscrow()` and symmetrically `_withdrawAndRebalance()` functions compare the escrow excess against a fraction-based threshold derived from `sumMaxNextClaim`. The check is structured as `thawThreshold <= excess`, which permits a thaw whenever the cumulative excess is at least the threshold. Because the threshold is keyed on `sumMaxNextClaim` and not on the amount being added to `thawingTarget` in the current round, the check behaves like a one-time gate rather than a per-round qualifier. - -An attacker can grief the RAM in two phases. First, they make a single non-negligible donation via the permissionless `PaymentsEscrow.depositTo()` that pushes the escrow balance for a (collector, provider) pair above `initial_excess > thawThreshold`. This bootstrap round costs the attacker an amount on the order of the threshold and triggers the initial `adjustThaw()` call, starting the thaw timer with `thawingTarget = initial_excess`. Second, the attacker repeatedly donates 1 wei and triggers reconciliation. The bootstrap excess is still present, so `excess > thawThreshold` continues to hold. Each round passes the check, calls `adjustThaw()` with `thawingTarget` incremented by 1 wei, and resets the thaw timer. Legitimate larger thaws issued by the RAM while the griefing is active are blocked for the duration of the thawing period because the timer keeps resetting. - -The per-round cost to the attacker after the bootstrap is 1 wei plus gas. The griefing causes spurious thaws, consumes gas on every reconciliation, and interacts with `PaymentsEscrow.adjustThaw()` timer semantics to indefinitely delay legitimate thaws for the targeted pair. - -## Recommended Mitigation - -Gate the check on the incremental amount being added to `thawingTarget` in the current round rather than on the cumulative excess over the maximum. A round should only pass the threshold check when the new delta to `thawingTarget` is non-trivial. Combine this with an absolute nominal minimum thaw amount applied in both `_reconcileProviderEscrow()` and `_withdrawAndRebalance()` so that sub-nominal dust increments cannot reset the thaw timer even after the bootstrap. - -## Team Response - -TBD - ---- - -RAM always calls `adjustThaw(..., evenIfTimerReset=false)`. When a thaw is already active, any increase to `thawingTarget` that would change `thawEndTimestamp` is silently rejected by PaymentsEscrow so the timer is never reset. The "bootstrap + repeated 1 wei" attack does not work as described? - -The actual vector is narrower: indefinite postponement of pair tracking cleanup when `sumMaxNextClaim = 0`. Addressed by `minResidualEscrowFactor` in the fix for TRST-M-1. From 68cd77e5f3d0d5d34c67d64375852d28f95b5eca Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 4 May 2026 15:24:01 +0000 Subject: [PATCH 41/47] docs(audits): rename parked v03 lows from TRST-L-{old}-{new}.md to final paths Pure path rename of the five lows parked in the previous commit to their final TRST-L-{new}.md paths. Each file's content is byte- identical across the rename, so git's default detection sees all five at 100% similarity (no -B required, no cascade). --- packages/issuance/audits/PR1301/{TRST-L-11-10.md => TRST-L-10.md} | 0 packages/issuance/audits/PR1301/{TRST-L-7-6.md => TRST-L-6.md} | 0 packages/issuance/audits/PR1301/{TRST-L-8-7.md => TRST-L-7.md} | 0 packages/issuance/audits/PR1301/{TRST-L-9-8.md => TRST-L-8.md} | 0 packages/issuance/audits/PR1301/{TRST-L-10-9.md => TRST-L-9.md} | 0 5 files changed, 0 insertions(+), 0 deletions(-) rename packages/issuance/audits/PR1301/{TRST-L-11-10.md => TRST-L-10.md} (100%) rename packages/issuance/audits/PR1301/{TRST-L-7-6.md => TRST-L-6.md} (100%) rename packages/issuance/audits/PR1301/{TRST-L-8-7.md => TRST-L-7.md} (100%) rename packages/issuance/audits/PR1301/{TRST-L-9-8.md => TRST-L-8.md} (100%) rename packages/issuance/audits/PR1301/{TRST-L-10-9.md => TRST-L-9.md} (100%) diff --git a/packages/issuance/audits/PR1301/TRST-L-11-10.md b/packages/issuance/audits/PR1301/TRST-L-10.md similarity index 100% rename from packages/issuance/audits/PR1301/TRST-L-11-10.md rename to packages/issuance/audits/PR1301/TRST-L-10.md diff --git a/packages/issuance/audits/PR1301/TRST-L-7-6.md b/packages/issuance/audits/PR1301/TRST-L-6.md similarity index 100% rename from packages/issuance/audits/PR1301/TRST-L-7-6.md rename to packages/issuance/audits/PR1301/TRST-L-6.md diff --git a/packages/issuance/audits/PR1301/TRST-L-8-7.md b/packages/issuance/audits/PR1301/TRST-L-7.md similarity index 100% rename from packages/issuance/audits/PR1301/TRST-L-8-7.md rename to packages/issuance/audits/PR1301/TRST-L-7.md diff --git a/packages/issuance/audits/PR1301/TRST-L-9-8.md b/packages/issuance/audits/PR1301/TRST-L-8.md similarity index 100% rename from packages/issuance/audits/PR1301/TRST-L-9-8.md rename to packages/issuance/audits/PR1301/TRST-L-8.md diff --git a/packages/issuance/audits/PR1301/TRST-L-10-9.md b/packages/issuance/audits/PR1301/TRST-L-9.md similarity index 100% rename from packages/issuance/audits/PR1301/TRST-L-10-9.md rename to packages/issuance/audits/PR1301/TRST-L-9.md From f09c2e3ac6176bcb28b2652f9a89425df2a849d6 Mon Sep 17 00:00:00 2001 From: Rembrandt Kuipers <50174308+RembrandtK@users.noreply.github.com> Date: Mon, 4 May 2026 15:24:23 +0000 Subject: [PATCH 42/47] docs(audits): incorporate Trust Security PR1325 v03 fix-review Adds the v03 report PDF and aligns md responses with the auditor's text. - README: add 2nd fix-review commit, point at v03 PDF, refresh status column, drop M-5/L-6 rows (withdrawn) and add R-14 row, plus a footer noting the dropped findings and where their concerns were addressed. - TRST-M-1, M-4, L-6..L-10: status flipped to Fixed (M-1 main finding Acknowledged); v02 local response promoted into the auditor's "Team Response" section as the auditor incorporated it verbatim; new "Mitigation Review" section added with the v03 verdict. - TRST-R-14: new recommendation about avoiding magic numbers (`getAgreementDetails(0)` should use VERSION_CURRENT). No code changes; the contract fixes for these findings already landed in earlier commits. --- .../audits/PR1301/Graph_PR1325_v03.pdf | Bin 0 -> 641200 bytes packages/issuance/audits/PR1301/README.md | 27 +++++++++++------- packages/issuance/audits/PR1301/TRST-L-10.md | 14 +++++---- packages/issuance/audits/PR1301/TRST-L-6.md | 17 ++++------- packages/issuance/audits/PR1301/TRST-L-7.md | 10 ++++--- packages/issuance/audits/PR1301/TRST-L-8.md | 12 ++++---- packages/issuance/audits/PR1301/TRST-L-9.md | 12 ++++---- packages/issuance/audits/PR1301/TRST-M-1.md | 14 ++++++--- packages/issuance/audits/PR1301/TRST-M-4.md | 14 ++++----- packages/issuance/audits/PR1301/TRST-R-14.md | 9 ++++++ 10 files changed, 76 insertions(+), 53 deletions(-) create mode 100644 packages/issuance/audits/PR1301/Graph_PR1325_v03.pdf create mode 100644 packages/issuance/audits/PR1301/TRST-R-14.md diff --git a/packages/issuance/audits/PR1301/Graph_PR1325_v03.pdf b/packages/issuance/audits/PR1301/Graph_PR1325_v03.pdf new file mode 100644 index 0000000000000000000000000000000000000000..e210c6ce5fe30647963cb9ca0be3cadd583bc747 GIT binary patch literal 641200 zcmeEu1z1$w)-VVWWmAQ?HJ(!&v!iI`hVHGoiL8YNEYg7z3(Q(grS3>71Wef-VkOf zYx4vOMm2r@Zek2ZRcInC%=*C4#+1&)hMra4#KF)QmHix|b4XQ$h4HXWY>Y1;J_q6_ z=ob}Vz{V;8b+mB+b8@oYH#fG|26LVl19M)02Ik_r2ytJ)59a=!_Pu9dp6^+B_%5>W zULXL>djU6??|X>vdpW-E<@mlA;QL6RR=={6V$tmDmVB764Vg*yUZ*swr3nmA~)qCNsvH4|rt?@fq*e@J|P$ev>lHSvti4aK3(+Nh@4z}ygS78DeGTS&9CJ<4=144#RxoUr@W#XBO6lMyH?gy%#*Tt$mBm5xSP3yU#QV!gbD9Y z2vovbDQsojM5C3Qg2&dQq4Uuc*eB$CBI}<%x!YgfoW7)|r&}LylkO$N##TMg%bSdZ z6+|`cQy%iZuoa1e3$$U~#%RMq)`k#|dlyP?j6UvNb$1(Ibzg9Dj_0H|K31m0OWC`3 z+eMyD{F?LYTS{762at_sKed>UWNI7rZlv8&J<&sE{9;eD^lQNzODA_k zy*Avq&Zw|>3s&@2))dX zUZqyA!hSuX{NDAt=76Ouf_9NvpDt%%KimWfnyo)e$0BWMG-7plI0ebga_-8ylv_}R zu8=!%XO{?L*A z4|zmdhC>=WZOiOW6hEuy)T!4rt6wHs*WH$*@FmmE$I9Ra7e1zv(*A6Q`!3qtc~BtP z>e66f&w3@EsnE4|Ja5>`qLeD%bf>}&rwOXE@5%Z_O>@7YBp&4RBQS!>j4ome6DXv7VQ$0 zuK{~ZI#VN?U%RGC1jDY+dD~OFaou&Nuh@M+ImHnM&;^@SWAW#6`_W*#$lJM>SHev1 zm1J^$w8V>7@#W$bjrQx#j4~^rqbz+cmsX-gtb2DI-0- zps)|)3NjNoEi2u$RPB;8kdg-X$oY^zGe|3_X&D1{eWl_1dEfAx#{oRoc#hD4h(r@t zF`@FzY*pD+xUrMbEtM&fPWI@1Vr<7~Kt<2J_Ki{yaRFYoD);Arh`DvzZqi`%Ekp`?|S(A5Blt{iH?^cB737o)*+Y^DL=hE#paI z5uW&Js$DHRLQDjj9Y6XR<+8P>}{EZ0yO#YEs0t$tl&o3SbJIgue zzyo1p;e()_JS-?yhna(glZ}H1HMFSdj`|d|FZjfZ+b?qve8DvcqprWPh!=duPxvlA zm>;|dtE%H;hjV81g2`ajG&e?(Q+6(HZq|Dy=B8#2=cM(|0T(xSuvapHNkFY_p*H6% z6d$WBiW`90LeJ?l_=%yFy$P$TyrI1%nEjmfQepjT`pw18^LGS%r4Ah(4GqmZ~8#%dk=c`xe|b`-6zDkl8W(ciDXG4LA$zcKI|1OFZj zc>AJ9>-`nw_*D^oAwWOZy8oB-Tn%NfaS^LvXl;Vh#IuSU+M8VD5SNgYl9FPSFtjp% z3^V_(T0*GY@Nm|B^D*;vKw zjn3u!yxeRky~X!;W)4(9!qE1IlHfc^%*ph-_JEs%9YqwKf2b08xi~M{)BLVZ;9_HA zefXo)c^#?_Ce|8YZjOsQ;unSn%-n38C{+hHO83UW#dhB8xpD)A9u(CyL0L9%|FmQH zMZNK>YVTqk{!AYzA@)aw*oC#l|AZUh{HYY-J$C3YyYXe_zm}O4E)BxZw&m#z<)Rf zL@`{Ue>Sp%X(na+;tb zR2^+?txT-XrR{(4g1czuXHEY#9)E-54-)-f`~M#+(ZBFo{D&U@mA-}Z50g>mZI&PQL42 zI8i>i|EPQU?t}V=e*c5+<)5*496wbk9KR?~v{9ZT#wN}t#((pRLHS(?qCP^@C4F%T z|Cwn8`(JvTd|ym{x`%R{!~2uDLqq#h(~yf2f0%IptQ+iHY`i~v!o|b=OJ9C;;et#3 z2U`&Kf1>W;;Nao=6;2crIwtlunTPbUfldzg{h(T9KC+a8R#;F-@-y-dqB60Eu2UAh z*5nA*tFmP-Z=+nGoW9q32MY*DZQ;r>43S^FV-rcpUGx7JZ_$cSA#39YuM3~)SuHgA zp>AX0n}zR!g~$<=jN6YTSb6^Jw(i`YYR(@vgIE0(5%@3Nq@C1rQ%cnF_B7VV2I=DA zl4~V{iR0!_jNq_#Ay7MZN~tRs|BAWckVV1qM>A*^w`>21CDRP@!}x8t@bR($CxHQh z($V!zo~ML;0-y2&=^EX_Q=-Pp(<4p<8yPEkKWJKVwPra&AFK~MP_6ZwT&rH@;t#!4 zWo^9fNHic_?YS;RE44X}?buz;$T&7GccX4zziDJC`-(HUJYi2(O>v!`F6!C!KsP}% zzVor`{nTk{g!WR>i*dP3XWVVF9LaI*gi_fB^^r1wE1t4s?y#nh-i+C`zLEExhgHqn zY-b7VRY`Mf(C`ko!SNBc+|P2z)u&bR;<=ze)2&^xah{sJcim32iH=yC?~|OzEj|s# zc!s*PtW*~SfOB2SqNIANwuHTKzA;Fg&J=GoZ3)LTyu#Yls7QXj>T!I=xJR)5QA@wP zannYyp_Z9NUy!gc}T5p=hsd2x!R9X$P_Qa2X0_S;0$tG&*-%W*fBs`s6E z^WZt4uKlBqzZ2d^)I5lE~CSx?$@8zakr3*AVF z)H|uDHww^G+;s*dR>Zby$JdXX0mq-Ulm?CCR_jh-eW_$QX&XNk98VdfQkYj?8k?cO zk>S`*s}Mf$<3;Z1D?^JLq8AP;oQ>cvM}5w!<5aE_%N4b8$%9BS*Kkklos!Ub+*|k8 zA6ngg3ztP~VFHyR#&35=Rw1)#yK#NCgCZg^;)9n;-gkFs%f|t`zElp?y>p42zgEi6 z$GLu3WonwsgL(?CN&`&i)Z=p3KK9?L_C+E$<_A|PVxmjGIoLMqEzft2R`t)WO^#MA z!NFEEqzfl|6uHimrfpGq~Vo2h9;a!G5iFpK26p1y2&Sz%ZKbS zHAvXY<*kN^#?&%ik&OJL*+HOn2jbd9Z4{E_Juc$b-Y%x+7~B_R`^c3d{_WN_1I5Rw z&Fv2qOqyubx=J(FYFM{?Uuw*~~}Irk001%JI?8|dIz3<&d6bD0rYQ3tn~`{#a%67p}}GF-bkbB@Da-chsegtj~~YL z+K1dzDZm~FIhwnQGrJn(Y@mfxV|LyGjf|d( z+c`(j+?#hg4hh;)_o}uqbtt(>>!I7O(gW3^)DNF;j%sdwBLnarvoXlDbU5 zr)2z1&*HwWaT5ZyEZa<(J)UKJcRW(kiQN*|s$yy>lb3Z*3^rLg*;@bbQ6_PL%Z`0C zfA(I>@`U_)26sZZk6ZES&?+<1qD+%B;8FWrKTq&l_^O9_j%kJaj1g%%Et*eh5(Yfmdf(ta6?e<)(BTuD#uC1vb&EKtlou9wzYm1r%CA^1K zJPI?6wt1z>gDzFo&y{3$8CD&Ib67v9W4-ycrXyO*2Ft1=Wp4RmUjpH`u{OSXfl@dtSMKg3*j9}b z`Jg~4@6tHJe#C;g&#RA|5ZRVfg}jx<&|-vf|6R}E7ivA^I!K?^PDx4TnbA>s)EWN~ z`#5ZETs~m_x+{6BQ0o!*B^lZ#c>4#t*U&ovm*nR^3H1fF{(pU&a~MBEXIs15^5-1b zKgbC$_Gmx1aDQiF#q|f4|K8tN{(qg>|8Yc$`JbCuas9&VU-&Qof$9Cz4f0=X$bJRx z-^Au~^8CW)^YWqiO4Ppehlv&MpR@Vj&9Hu&SfS2``C($k!}(`y{>6bVzxMdT%R z@t>Jk85#a@<9cx-&VO49WtjDc?e4`U;}50&88807w52#dVgcpE{^P`%e`QN?QQ}|k z20J_3zj;f+&By-t#^kZ`IUm{V{m4;=6`4l8p zmf9+f1vV6xy=%88Ulkeg}}T-x%7EgAa6w-dK?Huwm{@1riZ_AGbGGl$rt}pfrVxg} z$VXx^onqI4Mm#tz4m{pq6vjNaB{=sxpx;L|}qqgFsBfPkigRX1s- zqGM?7%G$0r9O)=s16H>iwmz8&sp<|OnworE)claD^XYao#>mV}i zj<3IOOTc#Pg(WkXa<$clrNs~tJ&*t~=2Vfq!*`Dh{Y&wjuS^qPR4rW&5tSfAomk>! z3H!{g=ZZ~yf}PE$a?5~tIa_CZcgedfg>l=Nr2chQgqjsK8=0hlylaZVmLD(yuAci( zkrM2{jpKxzPwsTh=)3f}sApYb;=KRbVY|O7AJ?G1FyYL`vuIR2pTBR#@n#|>0A3Ad zJr7F256(+t47(p78z3OcNPXe3NksW#`dP=5#IUZZ4d@V4ST6*WlPeC&p(1#}0LX3= z%Yq>oYQ@~e-j6H){nzIa(%|(x@My}LMt&)1pVXhly-yXidH?Q&@(Cf}glUKXW_i{* zrc;CCL;)_1Ab|(*pes# zrra1%Sm&vs1DLGXQ9K=_ln4&pU$G5kru7%50(ko8UayV6#!GgOyDP}UvUi}XlUnIm zdoZ`FB-7*%i{(^njz! zI$Ojlt{Bp`Qd@bU?eGC_kiDa5&;wTcH;{t#nE+-Z#WW!j7zH9Bt{}k3fI`{{D268Y za|=3|gC#>(q6`;c*Qzkmm*I0A@3%VV?7KxCXgh)+{+xAGzBkVL9?xiWPHXba?b$JRwfeYxtWzHK(3=h8Y-*Lc@sa8c$YA|RqZ{NN{Pya=24y~o(6r~? z_23Q!+&1c~!keagke?{C)%!R$!f$3eIJY2lIqTJ+X9BZPEo9St27z2))t0!tn=1ni z=q25CK0&wVcC+VQAWWM?6vMPTW=}68=!Dvm5-8v0uS^=u4eJ53+r{qMMIDC| zLf>wYzP=MA(NZE*i(W|*IaJd94q&0ueuE)3Y~|~o?Zf4DB!X~ORDSwHj=mADf73D* zOefnK-!|&S5krLUmM3w9z4-nOred2GJ5d_p4j&iC*(M*Gff z8xBYTXKj5q7omAv;l6F1K9m?9T>f#cuZpg4R4$kG9%y!?J?8MAaCFaVsDzXSl*jE7 z%&{FVVF~afVFUxgM4$Nw_<&hrf-xEdTDguVC%est+7Ju{Iw80lD(UHsLPawaxRW)B_<2Lerj4 z;B2yhUGsv;*?5Z(Jwq!q3A`nb_^^0b+1R)fqt@?2-Y0r>iM^7p>4@ziu2Xmfe7)Gc z74k(H$i8T?EtKD*3Xn&4C0M>G+IuD08jE5B7G>oD*GRJ`MfgQ=F;CaN*OsXu#xCd^ zzUd<-BxPr2eIg71(6UF?COQVW4hJtrU*UY3H`HX9nex*1g{)@sx}vKB>3fXB%Q30J z>f%W~pa}i9JA7|^LqlH5_D!$bZmRQhZTi^~q?p9FB^Hi(#57#rmMOswz%m|vYx@SQ z(+JzgXv4R+y{?j@F1_H^bo^3f@>Y}We#2l8asy)oh@Zp>sREF=^1$jvvI}3LJ+tHT zYk-;x%&%vq+D9S$2!XJ;M^q2qIZCmCyr+2Vgsb>I#+pt|-cG3^O5A{-R$mcY0E1kw zKb+)+C-GrfM(7`Scw=bm8m{vTZp0k|Um8I^RwJiGZ>Z3NB95`i!S@Vq^GcZNe5k`M zu|ks)2KpYTKlOcI+84ULp2(*l7}L*Eesy6|)!ZeD1aM^eL}5G=WG2q=9AiJBJekrh zSfpT9kEX5Y*w_W=amjxtf@qL^Y9q?<6AR!?MCn;Odak<6;A!ZVU;xGl2H}CgV;%1V zcUON5So;0S+&#w6T8{1nsj!5rnYV$xRA9uZ7XffB8)jP##{*iWt1$xdZKGnyx@7hV z9cn!sl3u%?);Zb8gg*BL57Nnk7MMw=8MZO)7C=Dx*)6sbdjT>h?D)32(NqUZgl9?v zx^{rO!U{9TP=W2j1~{p=Xl=rXB9;sUI9|24YN|M42O`XF`Hz!;W14clP8#TMok|0H zQK4;0veyp5sb_3wfwLQ2B89f#tC<;G%v*bv=6L=RGLR6dmQT@V9yEX(bTTS59b)C6 z)Ba=Dx4y++?Ez010B=Jqbn$QA1kSP3F8L>%BvhqO15?#MgVfN0%H~?_b(nJe4E_?) z(Z1PlpEt~q0+3e;CR)*Vr^t}TkSI~vkNhWGArk95bJsfSPOC1V8j+o60?Zr{K_;K6 zF#rmaZUaJ%x~JF<_&;F+yoBg#>o8wXTe0#2YK8Ctj<0-aMXl@&#@rW;K&O)ZzL!9P z=;Hh}V!#ImO+JsZIXjdMe4ucg?tp0QG#gE89VXW7%l5?52AofFXQ`kE-l8=&_N4BywDuv7_#A-# zJ@bjzrV;k&^~iVcFi0Qp0BbF5o5`qwFeF;VfjDqg8ECmlS!_Q~^!2)@#*RJcV}sqI zY==*0lRK6F939{W*x+ofDhX5-+hP~B(yaojq9ii}T6!l?$&f2EJ9+?1q;%d#*rGtS z!hvCl6h?RWsB`$Y7y|E#zRFW|b@xCAjF{?Fyg$$JaC~;Mbdw$^w7|(Ce;<<9#G!ey4)@fZkwNMIc zAOl}1MB+eNXFvmJ?C+WNKTq+dkr5*Eu3%ZZKH*-fwoHASb3|@pt@sV@xTi zp=@f}l#dC${-J@e+oid76o#LL4Sz;a0b7|XjzmB!HzxlESfQgAj!LtTU zm>H)nINp}7JCTZ4N3hGVz20{QydydoRPzSo!M#p52ow5a>*c9DLN9>7Pwo{Y%nSh( z@o9*NTm%`2Tk!hd5&cL(G@npXCD=&Kq1$N}vhJghm%KjXJvza*alJvT3Q+NWUk>O2 z1n%QdH9=aZt_@HF-z-`LVVu%6Yr^ubX0|$Tw}=7S+UnfVHnMYP4Q{BsG1rRljj9t< zkMSj?H1v2S0jB{P0AJAmjA?Ea^Z zAsN;{UzQVWV4t5)zwN7R9llX=L;$b@2lU-KK= zlrQEH@vVk^O&*}T{;UmQ&OK208=Z+LC&7=C+Bk zNaZhn27!RW`qhim!oXpLE5MDJfaF{kG63rL#@`pM)0gqhGHjpwv?+y_29g)_(J7}j zvArSj{xsXZTp*0V5V)%ts0RFIK8)tyUkCOt+S}=xLCno>XsODhyJ;fXtTe>&zGhF< z*SRh51{&UkQ8EDhdo&M~fio6%!$li>9n`CpfF&+qa1$dDwvCb?V4qNSLr@oDrW@5@ zU))-f)>c<%x!?GA?N}qegJ6Ml?EF9jDa`w5|(DL+-yW)x@@B@~=?FSQV zBH$$4>#jdl7e?+{n;7xbB)kM)s>jmyE7wLZkH76p!_bC%45rA*_;h}DlGwD@NVff0 z+?DVoP(A%)I}_m6JJ5iL2Pi!56_V|6I4dL-ABG4hU*NJv=9xwN9z_Z#s4ZaK2EAVa z9lv%IXW$pQIk|yzdUh6$S`r`B>~hS?2VafrFhn>e^}?=!-lN7peZv>z@K|AXj-c!f z>5HUi7+ZVg__kP|?84$PZXkUm>0HC+*_^ej_kytGO-9Kp)s=wbq1|@@lg$SpV+Ejx z*`*{Ig-k4e77>5;(IsPGjYJ-uzpcd=m;t%Ku;;1IDTPX}Frg6PliOXh8w&R_aY3&d z7>qX>KwsZB?S{Sc#l2}IuBIlth1Dx*bXb3a=+_ugUlN`(;it*WSa0Ltge{T3F6cGL1wxE_?XRJDuedZjazbIleOdnLipBfZ*NsY zlq9h27bIwLuf3q$f2{Uo4t(NAB>)L&6S_O*uRy9hnNde#_yN=Z^T!LIh#oF~g(TEfd5p6_U^5;&meR%EtMGzTm8;67A zWMpQ8LvWz~$|dVSTP&eB8-%FU$WaP+fnXA+b9954o8V1rXCjV^3EzY0lTXDk?;Fu; zr_X)UTZGxP4RF;>_?)X;huqpIKr7E|Z&3*(`v_I&ryPi^n0IyhXvg3BlqQ5q2`M_; z2?ftoB-#hxQuNRo_{JS&(H2)aU0n;)d1oZjqu+v znwnfC#<4}n4;jHN+9@DvjT3Nl7BM%4HX=Y2B2wMAyJ)^Y@eQ=X zbTriIGxEN}2mW$PhToc2vB7H=309c&*1RJ`FLjEQ{!JEikIL8>k28o3Fqr=O#k2ck zbAA{B6b6YZ-VI7mF>0(Lsex+_1t8b5171$R<0xBE5|>JdpfdBd>B%@YCctwolR42K z{s;+U*WPw?Hz~LapX)x~vGJU!6B-gRKj|%yN{ibe*3%r}D;aHXzn~0Y@^3AQiNwex zo&}p5wWB-6#`-dJ`S?W&tF08JmuE|LkAjRteA{Y$cv^_B0_L9?YA0h@w05Gy>tRvX z`LH4}tQ9^O0J~r}l%7RXl|zbrfIRE)a!}NP=+W&;)J9au{G@^SBi z5UB;_;2A}30dll91l=;|z`SVMK_)Jzj2(!|W&YX0*-Kw+3&F%hpkeFar`#!n)K~pNVlhU&x)5a)bD=IdU!4{zC2yoP6K?hw?t9dnu9J6q4xRAA zq!vLNojMx!8GhRla+Re|D?Q>hDnnI!S7-8`l2$oN*}`3^t*h=iD!s;UpqW~fJ+2aR z3!~nlR*21YiQZF6*jyFNk8J3?eJQ`I=QX6YZHoD`Kb{`%TmplCsal))QZwkVZ7N&X zq~FO1xbk=;{RsATUl_Be6M~yxyxwj&BfwweB&H~w_4Sk4r!OoEpG}d~D@Km`z*~1t zlpstMtbli6=vAx$bx2jJN-sX|93oxEX(Gy()@`|`8X}l%IT0Z-J@#}2RjXjCYIO{4 zygD+W|BkNBc%*LzX#A~gWb_{L9G1hB_D(nZdu8pO+CU##ZoaW_jDvypw6(UxY|!{p zFAFcUUF^1Sn4>1J0Oou@RrkqQghafPi=8HLw$EUsg5KZh=#f%yLKGvFdW*>L@}T@h zU&EcxbJ$N89HxQl;|)x;!(hnd>){RB>l-24T`fY81-NSSGvd-&g2S|uTv>X3VR{Nm zm59*2Srkl>5e>IYATIZTD)#qWdDr|v1DY195uxzeya)a%CSUL%QM|G7vf0=!TkJz5 zoh@NcN@oz{Knc0RO1qFN61|&K&7ijtD3pZkTAX-5ZZlKabQsE6!1aOMDNcJxw!6iZ zto}t#rN|Jc;VM@DM%LcZh=#C%wGvRA`KnF3;R8#!HZWjyt&Mu8K^Kl>yHiq04#;PH zFdoqm@^vi@bX_wPRW`!i8C5K57!~n$WGqx-)6h;8XauX&hTRj^9t~^YtRAC)tQ^p7 zpzh{y31H>$SWrU{=|S%p-*J1F6MQC5bM*|p`o)&{pK6OPPQU+`h3njW|7BFp$@M4Z zI;i95|Fx4_z8`4I`O{A9uMVW=;AOu!ditl)(YZ0tfxSAC0$@N*9Vqr;VBiD&OL29j zYkS$#-uy~3`C7b$c4BE?E=yg@zNJ-LG3i&Su}pUhn}a`xfsj1P`I+cB7dImpAgxEFaPrM5a64{--5p>k`>ZapyCT-Ah*DE2H zFQ+$o4;xP*TVbK?_PgfE?e^n~>D%3xXA~H_rA&jEyPHgd$-TO6-slop?#1b%??#fu z@*YfY<(AFXGtwSAwKWEMc@5q1isG88_&*gwwQ~o`V$)@$74*Sd@Jtws6P*F8E zR_MeJupY$^oy!jHt~d#(T-UK(f0h2ETW7zPs=d&;>!a!1_|{6pUd_hBN+gwAg5Z5B zuZ{i#{OWJBRq)fz1-HPnT%oO|?JkM$b(5^(K`T1?0-gL#8uhghMvRKf@Fc8%e zT=(=kJdzDaR`KxAT{yaAAWFt%rZif}x-H%1RaG%Lh2Xthi&nDz4U)(Ut05w(keC3X zVd#AsyXh*B-aT5G=3hgCcBRUaR(?aovaU(UQy$}<%$Izc?X)mQw3~LP zWvV9y#7bX!C=ZFzTElvG)Kv<>^jDfrYCt=q+!Qd48t8gf_x?cY=Mn800(-ZVX`NytwW#FKxG z*D3!Rz{^|A#Y<(kpO`H};j+Rm6F$E`l}(EarQm+NFH0j6fi+OiN|u>UmNi zzkmuo_d5IvxGW{C7b7B+&w&taGl#btCGy3iAmhhFJ5c9!ww-WGRfWwEMLq{&ih8~l zansRyt+Csy8hjD9KG=9ocz-n+u7^*7<$b&~T*Tj`66j=&a~@)FTDh11<$7=n031_B z+i5iRmhMAtE>7%K?-;phx+axn`L_~UKp-kC$UmJY5z5uYn#ELX6m%@L@DOdbXWZOV+)vRghx7T3+ruiDQgp$x+F)et2M4A;N%m46Pje_(3I8%FXFH5FlE!z4BEn zRptImp~MFC5LP?5X}DZAZxA`T-?J`&XwYrtOxIK%E3^9x?r5`3h7Ca31H?NFU0#>R z3olR+s6{c83I)NC%btG_mZ+ZE4C0+!6JGp9fJv9@(}z@z;c6iVNwm$!n*HM`1FZB8 z7ip4iPHM$p1hc5T-)FWZastA%dQl$_{~fe)rPTQ?%?gWYs6;v@nB>Eu>#1kp+&Bp; zX$Y>@4~)&+o?2%02V#rvdQ{D3l7(rR&qpA{&|7O(t=lb?EbLI9O#+&+KKy77m3BQG zg#>Za%ix)54>we5wcY5KucZ8pXg4*_(Rk-G#7M@!3tKb-&l*zp!M{tb;%qlFapqEp z35o!GsEht`Xnnenjj%&+Er7sBb)uyi8B4q<_*u{%l^EC2a5EM=>zgi=p&1W#7QJ^4tOrX}#JwRCp8= z-X9?~I}2o=WV7`R+ba+~=&kRMY$`K%UuzJ%sf(bQyPXCMQ}EjxWJx6^qY5`c2cFRv z-@bZYkbZUSX4)55H<=W|r=^0GNtZT6PgQXrfLZoz0bNRqkVtC6b_duk1fD$;OX`Bz#FS z+ei>g97OYewJ?-_#~^d(u53dH^+m*sz5Zj=%sa6;etr?Ymqcfk+4*Tc2VsdOO3cN} zeFfr>rebKMy3wxOuiSEtxuwb$W5j#M; z&4CtjxyhPboJ1>LpVIT;LO7a1ZQ$-2wyv2+PBa($wj3JUBoR*u(SWCx&X%ls=jLXM zSNF^5;Z1j~hkK6<$J*)-)rH7~*M|@qU$>aVs*F`SLAysIU;ayY{lZue=gk!9SfN^sT1aqfa-kE2WZgaZwI?41XNL zjB5Meb&0YZ-(ZuJ^7?bm`X3w_{+ad7f5%y07{dR1&q#!Da{t}INUO0f1~;TgYNJ!E zT@g5P^vnqH^4YXeSRgn9OoWMvIeUFpS`?@(im4nj9IPsdRFk~?O&m#Bg(Q#^lU&PE zx{o8&m!khRRvsSO*>(3_tnA&bqd*0x`D&MS_DX@4Xm7MDzI6s{q`3d&L7CX|oSVF8 zGb>&pw$k(DIFrVWS8+w{Q95-tQG-90bwOH!+VvSl52J@n>A zasY3*Lp)!BvjtS1TFQHQHH19et#$GZdA-&|&=TI3vLo|+&PT9D+4MuGM)M%TV^)^n z(Y}8WCH=R!JY|xGd&@KT&7QcDNfHB>WJ??D)4uX9q4$y<0GV|U`Rs$tSr#Ll+p>aQ zlZk54Qc!BQ zsfdi-fV<5L>Vd_{Ve}r7&Wc!?8qdSJ#$V0p_g`uW0~6)-@PFg${+Dox~r0giQgAem|zjzU=Y_Pkty9o>Q@ zsEI@>HFdE1c94}v5A(a!{7F1_`m?=Dw%v3fvO`iC9b8P+wZ%a|iK2Cn_3`{Wn~(P^ z6e_AU7``nTe`e0JY2+=h)JyJx&&mKESSgoa++?|2x9E8-Y3+928cb7S5l4lYh@g8< zN)ss{vuH@LTfQ#(9tYhv`^~JE#EG2meLF4;I5|Z|eHIL3^95cQ+4X&l;I}oB5=c(4 zc0=qyQn|=rIN#E%d><9HIdTv5!zAKGQW=+(H&24~@|Qn7bDz!hg` zy++$)=YXjft@UNvkuQB4c*1jfBik8|9PVHo!Vy0KRMs*iZ-Q#ke6flIsXG%XmLX^? z7#v*IiUVSkhPEC&eQ2Vfzbqc^!yDGD{L!NGZL09ZoXF?abOMvl;`|jFi!9F#!_pO^ z!MDFDZ*yMz##NvmQ2LsMH7PD>qpn2iHIJBC{jyVxw=I8WcH`ikH#wT4vX4l^r@On9 zql1%tze@GJl$Kq(C6OVZ4p$kVB1*Ek{z{`tPh>LU0c$*+ZBb7r9szb~)JK_-Tcms6 zV4s>8BcEI+EE}3_zVSM_vViZU*w8J~)rW+MEwWE7ul0}S*5oF!RRrV+DUof8!wm@K z1R99=%F}5tX)wN|ac7*dUOy4Y4@jYkead`oF)pAi_4cbg>&G@t_iwXzh%&F&3Ay)3 zTzfBm$8P)j+c{B}7m=mt!GdSthd#bSB*^_V*)WCRs2;5|35swXg!uu%UDI3FBkoa3r zwTobuD|c+|u|nG1#^F&&sY#{0BlFv?<;S1K`2 zvuT%JQw)vg&}QAO*LMLd4FKtyQtKNsif+pJT%w%6OfVuM%B;2Uw%}6HrS| zK@`m9j!S!{6{4}jSF&rJok_zZWEkHj)9Sm4a9ixzCoGC=D&H5x!>94zxl$5S?>9Z2 z^z^u@5^^?HSPF&x&19gr6mu z>`uv0d2N0UiWLwUE4CaojrTZ3MpnYTPC9ufJS$r|YCMkisQ8>GYkf`tz?G3o_I<2I2=Utn--`~abMZ6({OO|;Ew^39i>Welpo<8Fq+2eqUNpQp`ExZIq zEydbp+sFz8n|Ouroo{Au4$fX>+Cndf6>~6cKXchM+%aY(Hqdk|mm?)is(97^&Gry3|zp z-6`jIu0y!*Sn$v*;CFjpl5br&_P#|Zs+cBLAa+}&V97l~m+EG;U0Dyr$iPtT<#ZN9 z-vF6W{-o5AI;J}3$6Ae#C#gC6*aY8FQ-hsZ8V6=-Zanb}@?$Q(Oyt%njp+b(dD(_7 zx`k;YdAFg_Ye#A$o`|6nazurAwA;qO2==hbLhCNgdj9l%8?iwo#vKMG_B}-d8McJ> zv&m;Yd29^T??UyJ%n}n4z#{8qd5=wf*ZWipAJZb!JI zO0|n8dJ(IVSIVB3g+IPxl+x0JoR2w6om)5w(7Q|c+a($T?#`|_sg$#A^)Yl!wgE2* z`i%B(1xXX#y{nz};<|5QSw>#%u{xZVajRL~mQ6HBl+NoRns&V(=GVPb|Cqt732WE8 z>8D+VX-6IOWdg)wRvZkc5=Ntt$Cq>Z#QYqq*ePi!1Jl}tF(66wZQsqdrn2a zr1t`JX50JPy`@(j^Ik;p=9_)HDH%xB6M)S~rC--D^yG83+-dbZo)ZgQ+!leJubCY% zkQn=ou<^LJk#VDC<|R7=Z6+;2jGpN$#LR?`@0T8`%jvu>h!KvIU6y+5N&rY27G+g* zdqF((ut@33Cp#DgFJaQnX2wUsd5>>rV%QlJX`0!Q1QNGB?9Alq(I7ylgz5F0JiZd4 zNzwgPOZ^4$_!n}!iNpF*ZsGaFmK&`#_wim}e2coWo1{1?QepD>t>eyH1rk!@yL@~P zp?66?5@*v_IZr)jrtnFDfoC;DA!;b~=PsN0^No~Ngnp|Y~F zU4ESbUA{q)0RzS@9qey&LU}QtgClF}oDeftX%_2$aC$VpGGrZiSn) zkvLZF2^^Xp7DSqkG9|IL%bmQ^>+4v_uORIjAM^7D>fiTgY2>uF-cwZ6FIm~SlgpyD zzj^G!+T}6z98&nCGv?rUd$BJ~A(q3XxAE#s9K}}0f-;T2h>%0;q!>p0%0wV*5#&S{<0bMU3w)8p$Up#AFYOP`Nl%qwAj zP43U)8OEVSdoB^V7pn2<_TVf9X|UAQuP<$x~!4Hzlc-?4ZpEPppd!=En%YAr}p$UGY^8j?mO^!Z5i zwl4W=Bj1Wrnos=%?Kwl<)SHI0+3na8)1lXIoxrv98;M*<9`~TXeRm}gh#UNsWnG+! zV%MMPm3yq%Cd-!w%Z-@j0*2AX#7hmFk7pa`fd0TuPL7*=Y6i|%jGL|nVI)zv<7ycy z`ApGo3hO)-!)WcWdf;sQ;Q80DFYUsoJJm`;LX=W1RCdU?EeEqTKN-$6%d19nLx(=d zN0(TSl&*ixw@(LDIIIpQn`%v*V))~_xi&7acL&9D?Ub8yKIweV2_HW`z#(RFH~E%z zU(d^9h`hb8uW!PgbHv8#B75HrMVz6>!NqTCS7iz=C#USg1c)6E-~B@iM^1CHc0j z#+hR;J`hDpoF|t(LEjMD*<)54njb4f*ri_>|1uNM~ckHl3XnM?!G4D$I_?w?Z19w zdgd`>qomaP05;Vw@v?VpjEPUgtroH~DVZ=eE|HyNyN=L{pGwf{J05HX4!mHhH^X>F zMN2)Z`9_FW@&w{}P)NC9#gLbd5l9nxpv?11t^0r}x*)gq7}2-nypi2TiZ)ACf4654 zaV0!gkG0sbw8j5beEjKJ%S3zy)4WV*`_;iRqi-EG_`Uw&fv*Cx!<6o1x~?8(R|xVL z?C;O(>s1_9uL2bHT01_oa*!sjcRP`g=IT}MQ%9ua(s)buE1vGk7PY^es=3iaIhuik ziwhj^f9B`+T&7t)Yb+0mAq2qnavE5+EL|I|KKnnkeRWh^!J216Ah^3*W#BH3O-P1m~3$WCpM>U?8Rs-Es-$xj$RLN#<5mGga`FUB)_z|o6% zB%zvN(~g>Wd<6>dz#dr(NsC`2s!SB@!Xtg$xeIh~y6lKY_pG>k;lb)9dgsyZHr=g| zVOoQi8~nzkUqToFVmhm>8HF5YCsYA+}4b;jHq)TZxEmqc0vtbVOOA9{-ADDj9akTaFDRe5lOQ z=B_P|J_)4o-y`g&p3TzwQcjymE1kLazD2F}gIxdlV3x9j_%6%G{JXk0P@QG`S8RbA z)5z!ab8J180OD>fH9fp2IX7e`cZ^E4D zCv+UGp?Z9S)TD{dw{KfE7XO%0=%EPOmDVx0^^T)!D&VesE4iH68`W#z{MO$ZqbIz2 z`EVu#i~8pFT#Qc}W#d*P=n zl*lp;twtV9iYeX}1h2jUU&E;xnxt))uoX_tzGta|X9~rZN$~PhW6=Dvm$0pftb>x; zsW%c-RUZa_@KENaOf-9|6|J>~@f8#7jS#8z531zp#~*xkHH~{nG=lvCBa6grK6N3D z2zL-N{1YJUxomUl(_J#vf2COcl}O)ZrnJ5{7Qv=fMQweNKTQ8pi|&50`6Bpt6=2xK zGDfj(g}viXA>(tnFERw?M- z49<-dua}GU+HmE($4L1BbEpR0V6N1VPzRIHmZfV&0P1ljatSI_|3FnOz%1g5C)4Te z3+4AqZDpER{CeUizoJ3|oIcPJmo(WvaC}^W@cP$j<-T6<*(J6W3gxiElt|aw%0poH z>V{|biWPhbi=4hMCYIqoiRtoOyS}jC;iHW2m;Q0l(vPUSewg6KkG~YC_9cA?)xD(d z^$}r1gjZx+zbDA$@b};0g-?_(0<$v4_8@}c(1bU!Bih!)C6|#u7_%AZaf0XBtE68> z%f7&l8LQjfmekTdjpp3pC=fn6l_!B%zoBVYll%C459z8?@Z>zR8Jb5-Ss7eg=-qIC zcEavVYRKmAxH5tGOc!vsf?)sdmiYIc`0`c-^^}1TN5+h^lFfG_8aamiW}_NvT|cH{ zKN_xxN7nd(r*MSWD~IPw9;on*;+8s#s}z2KLE-^HP0Akv8y0UNzh%NP^kuRn2G>t6 zeV2)53VA(p7S86KWS)u59C(Qv(#qiHV);B|ephogR=rbDyzBn_PqinWYHdM#Y1EoI z)2a&u*3TVKjj8P<8D9%5P0Qz`OVd>g_@z`;Rb5;V(%z)e76V*6$_Y6?Q%DtT9(UlQ zJ-@?PxX0kUlk6=d7)6yyRfz8Rjcq1lz$8XdLc5~blS^QMkkAsNXoXTBqKX^~CA{De4$%5?~B<;$Nx4exW^>?i1tP&&LjSCMTWi11Of zl>3+6*5`&|#Y-VbN`nABMrl9t)c~P>_m%8aoUdIRarXdD;n}PcN?-Y-WqlsI;zYrY z;manCr;o;IST@nsiX?>`%U@Y&)4+IaoZA_QV^uD4UtvTSXb?zU zWcj%8G>@zp(5XjSuXRa6WqCbCB*`R0xPYQiRS%)d6;pO#){ls}h7)a@t7RE48!1)sIQR%+TE+#ll*1QkcW3>@o z22pfPcI7t3)w5niG^Z45hC{Ng$~0`w1pV=7)C!%{08FtOzfUY8BcZ6kxW8S7GEomwfkp}|RkiD(1Wu2^~FEGD+-2*!cpFCOI;kJERZ+iIUUe2D<(YpB)*J8}e zVfwzdKnjU)mZfr^a;?qdY_iFHWUo|#fTu*OSX0(zjvoHf8QXMZP+TH7Ob2DHE~^!L z2&RTAv|H1D3UAJ#3Moaf2lj{eb>o5&ycX*!9s8$)STdU02Pnqq8j4TjAMN6Z6o>BM zjE#en7sLl(3Bg!7)SF{}Xlyn8O^b)_jVv)w(sW57nNHBxki?s6C)5tri%Ytmg0v&w zTI~n5o={#MpN56sKKUOm$Bb5-2(;W?T_YkyMMfc0QBj#&6Jrru1_wt#t=N9fQe&-@ zbUl-5MopWx;?%vC@>v2(=H(e1Z|#nXi$e}?l8}-b>`SUPD#}j>$tKhHYgJ{%r=@9g zwMbUB-Vkux&)40&obr44)f|hV3NJHMZm9K2MyJ1Xc}s^z1amt}aE_KuWli#?H#kdx zSFC^PAR>gu&my3I%YF!e64Z?iC35UL{Zu> ztrzastOgTW$WMu}IW{Q6H+*;RFH;^8{0a0e3i!J)#x`u0O*n~2=o%zGV@00R;Cy1tKAezwDJCCTGVdyZnS>IqX!bo4( zXVCDiNc@mOcyhmg%-Ek5*S^KTM+$jpS>j>Id9{DrC$;ynedyVzi6MTN4Om|zJy~s% zunFR))5w>3>Xo|8WK|tnC?wv_tYNJ)g|+_sTvz+K#q|~%Y)93wx@@9Z=iZZXvK)G* z?i6Nkf1Paa9y&N{%G*h*fa-xA%dBopi4l#p$}$KNv z-!1*|yiFfd;sp=q!k%@W9eQZm4}O?8L+#gF9jD&p8;?PYQI6~kRcRFU}o! z-%OPs7Qp6^XI(ccJJvBc+iB+zUs8Io#0xRRG4LLDi2CTyIHiF4Sa2a=Vjm0C>8|dr z*BxNlh{@p9w`pE`lTgk%y?tBMhIN+>x1&MmPPFPF{aR3kfxBW(sskNazjh*)4-ij^ z=hY%sYsC;gi7Au$Vz;2h2)*mMdK`E4(@fvJoIbbf&4;qG?|rSs__D#kom9)&v%g<| zQExLM&UyVWn>d#O`i;L&jKd{PH+D~p-cy`Qhj8n$4-rhDUd$<|GxG{4HzTQo4ry5d zghYK|ii&MU+01Swm5#0U{!|;JyKTOGXhYZ9Rx248NyEvb?v2!j-RC|9Q=1FUzTJMW zK4CM}xIv^>`lsS`peJa;EKZ5}1W{auEBxmw9;njm(B$NH)GGh!t!1jsREmX;+CQrX z<-z7$Aa>p6@u^ipjdBgjT2V7Av47rLD2 zm(!}UTpu4F{*{?JLACHPqLFHMFtY4-Z3>tAM51_J3lGNYiWxoK_(;d&1nKIAwJ71A z&EJJNyir6p8nO4uM?$tsqFmo(Aaz9=W$O0TsY?Ee93LT6<%3wu)rCd6d=wWemIuRu`lZ3Gr z4Y_8ZX`#?nV^$%O9MB}@_dH#%_at?tVfQ+yK`$7P&w72nUgb5i7SYk_u4Wc(W)I7C z$a~Fxs~@~=xJEvI53?l>5noitvwP5=ao?`T>x@tg^<={; zHoc@Emh5h_T+5}~$^*_s-3zPac)AS~1((v&RG%Emn)IXNl1t%@}Q(j_Gc2q_Bf3<%Vwy$tH8tdeVMHY?FV8c#q{@Ivjfgqp+Jon^7gSb48%DD;~Z2;J62DURHU^ zn@~%xsn#gOoA>x8UfBE5FI2BD(WA-db8qkq8X|w?LXZi$Z5Ds{{dzi@Ez>FRaZzn7i-<_xVd(GI43CJ7 zj1H&8#lgYAAi^qf9d(W#doIiGT|kNKEm7y+4`NJFu%s@iE$ma)SJ#gBXSq|<+`Ez6 zAJ2Kcj@yVMe%Kv6?_BBJKVCCDc?1`rHrZ)+^6%V)T<^={3pH?X`?o+1IA4DTS>ro> z+__G3Vf83ujGnyU{FLfV$rz2s7T-VzX?N(FUTB+?Fc95yf$mDX(>Tk9$ZG_wo z>vi7O1C=x11=WzJ#{sbY#z|2lp=(|djZQLu_-RoJi0mZ66Wp8fn^@BIs z!I%ro@!96P-STo%;GY-1QjnV(X=LvK^%uD-K5DaRtK;eju2BtBQ%rQu#a~e|wrL7{ zBtv5^9wHUJO^!2USqNot{l>vBg}AR?Q{~fY$6KnI9k{0RDpU|BM;2rF(4}AHt`?wV zm}rdWRfr)(#QRDhVqIB@0Vi=p$OgC4BjNCIcD8bqWZ7dQ z3tcCA(OJ~SiXFnbrf)&^+o!Iq6q89TX@PoDTwP}dc3A+EiT!{-Iv%@PA`c#VGH~}! z40*<|@8My0wrKH#t~P9UI7KX=nD*DLINuYXar8WFf86{%V1^}u01^2<+l?@@n{)(d zXHR8#N{G*=?cP#m_f`5`m}s7af$ZG8_uI;AIAzTIeCCA4VkUh&8N&b<8G(*BFlC)} zSz)|nf=@%%O@~jp#8Wi}l{|et6~P0op{%}E@=~mlg0|2Ii1Ev~A-Pbe7%ayyC+>yb zX{FlV@Ezo2TF@4EfuhqJ8nQxbNu8`F%WF6~K_;CGd!UCG-lAjAE}f|fP0H~y5}6W6 zQMfOUmOqq^>zkt`lc|a1zn;PrD|sFHNmi9fe3cw*cHn)^! z<$DgBMFnA9Hg#`3{Z{9|g6pu;OwdGvNvvtZ#qE=<&AtpR%y7%P#|v3##=GoLXET(s zvW}#z#3rbcX^25+ce3;PUXaoNj*}iZH)7PMu-B$5TVWdNAXLz$G$W$iHlL$YTCPg4 zdW5HDQ!usGuKhTPEpQid&K}*Mlbt8?OtwNKTl6e6Mu(6eP=_y?p)I>yQfJkm+bTLF zYkQ;_rCb*^IcO!ld>URVwfw_RR#4$w%24%NMY-oShxLBJwiXK!%N1opy$o!?ewt!Y zZB97nmTz){fSHg%e_Bzi32hC4}apnzdRM)5X>`u57Y=wLaUk!3keBJjS8<}TtY-e zMMg$uD?pvngX6};>a*Xe&&SNi7TZ5m{jXO4AcZbm`14~UX#DFXRe#Sm{^w?e|NQb- z4pt7%e}4q%nEr~xiZsSI+)aP78kT9JwWF_zpV7$f%;Fgn7Nfqw?TOejM0%RiP>v*K zKRi|*IeZbn2}wBUdQXw5UaRO{Tdt^4fB2Aivv+j8ZK5XV!|7kQ#K_#i$P%S=eeJm6 zpPBpi@Qu&EQ`=yTky~rSVb9X@ZGE$JVWfZ8<>lV_^3Oy4_FW=871mqwPh%J+^`GIJ z5_I^bUbSCx;(oL$+yef-$dJI!EBgMV*7Uk^k7wC;{Xz;e<_lf~4<*LJCesP z*HbpAI60>T)T zBdti-w$QO9KaqT!Bv9-pJMSIVMZ?Y>KksfNjp~ev(?#ep`C;clUu0rYMC7jm8yJUm z`e`dE%jyBs)K0(M`CA@CkAFUcWXOl5?fy1P2{z%U4v+}_*SnLk>%j31W(UoFH*eR+ ziTWjDUn&HW+f*#^dmTk>Iz$9n`g?VAoeHhIdeT!o!)M2c_fF2uEsv%;tLq}-`i3lI zQFKmT@Tdw%dG8g{%l;1|s7?jl@muy2l1BBQGUBTo;x5oR|+3!RF5xIBu^hVYi^ zsY`}8sA+Z`)eNPr4w~A^ohzas#=pgG{SQ8o2&H@?Cv4sR(EEKga&$sno=q?2_Ndsu&Y~=0cw+qzc)%Mm?v$ki`j5 zDpTLueTnz6)Y}_j*qj%*_b2{2|6wYh>N4K|Wu=ECvR;lu- zwRD_-#09N!kAF9*O0Y3hiY$NDhb*Ib{@2T{Yk?TCbY;sPZz-cvT!y)7_qaELZyv_KEVct)#A^oEqG_C-|C%v zx#s3#l5I-e-Hm@oM(bgxOK_;0ziz-tt3E~{~&O&=)2W+w#v!hj-)aY2; zlz3b0rWbKl(T-GztRO}!IYeF~N(XXE*1_hbOls7;2<=@Bc^COB9Q{tPGlSNM zHba$g1+;Z`>ZklE>6K1_%vUwkF%C-(piwRLZZQs@?bksMiz*h;uXXYR<=-+UXG(QT zWpAo0W7Xe|<^WF%(M3(;dGrgN+-0gS<(--DQBL7%JYs~zXYqmjKn`H3=XR4Dw8`ge z@Su1;*--$rO`v9|eI+<7vWS3QgY)Nk|4!NQ z7m+{iha?nb&GQV-KBZcTz}jcP{d*pk`M5Z9ta>C+u}W=@C!oMAYRiuejuk|nNN`Gz;wmni5=OA(m>TrIUxX-uGIL_px84{tN zSfillf-_*vfnd}ziXXr*bD&v54JA??OW^&4&K!yDGv1oEwILke;_|-L>XnJ6qCrk) zAko``{JK<*mU?u$Mv$G(8i$^ZRo_Dn7W2TObq+g%iSBWgiY189VV9?#ncLI$-We5! z3`a-soj+-*0cPcu@=Z_J=B*GE%vyrV=NyNfT#8T+EmUP?yq+I&RlMJ+QKU78pGkz! z^}-2@n6k6;2u0s$n>2P=xJQziP8L8vJv^mOr-mjOqUZyN4D}O4cN|<$;hE|uy(juL zcRtd|S&EQ<*z4>zSj}CCS{Zvp@oNjvUPKP2>}IQuZ~>h+X{AF4^s3LP1IJq<4BV_T zz~mISuV2yq-3n9qPqEdZ z9Bm=nPNsq94q6|rEeF#sY*z-6+bv#J4G712Ww+;u$)3jDlCLg?LX#-$hQ83DV?dkg z(K#PmtByEEyVsj&l_*F>+fy~#=TX0K%n!#Hq$^I#T9q+*ekt#?e`%sJC5*j42$gwo zGx<6F$;z%S#c@SFYSu`Ghp)6DQ`IO&9>YE@DO-rNsW}U7hXaSj&q&xBNtfc}6Mk8D zDM*slIJ)2%`Z*vJb)jJm{)>j!Hl+80G){ht+C0Ab<@$h;LmqG+po5$|w;8JD9UJiISbc{-Azm1_k1sL!{bgDqmx4 zS_fx=-e3jdqy^$EOj((295)2_sMZ z@;lG#zrT_bv=a_5BjF)^x?jnlrm6vf}m@}r^b z{dnzKZwXxNFg;$4^najjQ2Ry;GUz<1rlZHJn@?+p60?XL}CPW#Rs zlf>`xYnU&LsiC}vHrnjZu8F21kGZ$^>!<9R|9X`0e;k1OUv0c#XXF0oaiQ#xdmh9b z?HpayoQzG)|Mw*d|5sa@|9Kkjf3~HWjgOD}-w#esv)Ll`rO-l&?aZ`^`0#0DiSP=O zp@NiZYCmLm<#7-q!o!DsMa}MoWn=&N{enV!Q4Z7}G`KS+ujKBj;pu*Ncl{GV(|2}b z?s|Q6>+xvtyyFX>z9EyZgmnM&b1#qo+b!p~VW)5B)$49z+lm<3b8lC^!?AFn8)-xs zMpMe`<4iNHY(oC7ao>c*c>n0UKeID|Eh<~0wCYB0qDB5L_;Qn65yO$>EDH&lq=_Vp z=u?hR->~;|RG0t_`Y@A9G^UZ#Lw?Z(CKZD`r`0rY*1_B z^<@Wf>_%W8FgSGPGS%x3*_L|0ALT08{?ub*t?X9I`OJVS%1-`OCNIoc0#_K9gK&9B zbw}8P#D~N6@Ob`h1MJ4^b1yOhaY%DM;qrjPUdZkM%ueFXJ|^?*wb&;!P>^{4$7$b; zSHsWeo9U4m8U`WZKqtgQg%EIAvBu+-6N4G8110%V#c{D3s;6jZB7oZ?dtImj2ZQj~ z3=g$gv@Dmr1zbDsMdA=LOB^>U*@kqoWm9k_85DzqzusFJpI41-5AIN5yY>Ptm++FD zJD?H~Xs~C7>5*&LnT4nfH;`0umz}T^5g>B3gq6q8OG(*{qLAn=N-Gq9L}juwV=elK zO397WaoTT`1dGbDJY-aXCRkxgnYwEVxt#PB`Z7BTMoVpt{rHM{|^i zhe>i^_ZUqFnqL{~y!Ul#-#0!kOBcF?>QiA(7{F2{1c7AZ^V zAN{|eqY6+Rnp(Xtizh?>*fQMRdkIJH(Okc|6+hI;Jvclb z7*;^hxpC{H+}HaZxB=!Arrq9J9MZ7+3L(@24e6VNAcTvdh5gXf6))ZoSJ}HSBQ#!c z9=v}A0sjaEhlH=n{R_gw)X3kmeqO~;kc@|3{LpU6zH|}=!%7H33xHw!ZBC=ZTq)XD ztLDeOc$uz(C`bZ{uL%1QAY_i6Vu+|qRs#o#Vr-(vfY`<4xEEa9wnx)fdL+~>wx8KC zk`yF8f$iCsX!7Vy_5DG0UT_RO9!*{`FsQ~+7w;u*1c(HKi4#ayG&*~`#TLo+wcXC0 zF3@7pnHeJ~(NVYXwu0&+J$b$0XwW-+s@=na!kl6={>Jx9yde=Z5w9?{PZ*bI6maKG zzojThM2Uup6(6>v!_cH499{^AnWCkajwr$l4!4vQ5(Q|-i3>u*_W<$Sdc;`!-2mI< zaOmq)dod6yp9jRGNbH()pO|!y6@&vICyFSIv)Lgpr0|BLxjDra3|0qFvfUW73I-!V zz+v)x2ndE~brTG)FkIQgppv8hZ;*(3RZZG0HY9oVJHScrFK~v0v?8|uF%&odOZm63 z*!M4%s;lfP$4AY}y0RG%Qx>@bXcuN&qN&qXSO`L61LlZYCI`eO^UZAkhJQH?US6qh zIvgZ{6u9LNtEb2ikYMxap_0-IF49a3LTC1#iw^q{RhSXy=y-wV22{Vk{42$e|CbyK zhCf|vX5At$p)B27Lx*H15HZkncOOyn;*AVSHjUOGjVqv9Hd|lg z0xdzi60uMhR|f*OE2#7w48Y;xVKqMs%`VZdCYhE5Q#4>ui+ftlIJ7mf1&PugsWQ9k z$~L!Hp^u^L<+$UV#QS>voVDv@f@Sbz)31#U-Bju@j-lFlmJwf4PBh!wR(fTQV}l@P zP8FF2sa)k64D{~Jb9I8$Y883UE+#+JCo_`p8($^#_iE1He5rfi4?+C%Ds@NQVi8_R z748=oi~O=pe$;pI3GN9?f~zSf{pV0F(zsNaz*?a~v#-NOBq%j%NXm8ihs(XEl(Yt^ zC&7>lP=H}cCta5(TfJ?#cS$EimpjHa4x9UeGJ=(Yg=WLtbC6I5AW5QH2cV-TshW4^ zKcijR8@_f5INmm2g*o;RwiC|~-zKM$t8ks_B{42OVE*6*`UV}6aLT#nEj^5a{|3?J z=*tW%__QyxZG8-pOi{m$PoSbPJ%Zq1l|S)HgVG+d5IYf?V2ErV^Zs9(V-*lwXpFL; z6)u&r@1Fxe==s;(k^ke2`~OaN>Zv3$}l5WgZc<7S_D>ZQUL}(1Jx0bbWbz zZXI1l)nW5wRyW8wmVymta3)`pHBid*tiN^LP>4b7);#uEp4WN0R4VSjDP&p>+_82` z|Jm4~8qR6R02?bAlW$zxqEu1}ppz3nrZWUk75 zx}EBJ*i=v`r$&7|ohZ}RU}L!cv%Vgk8F>kB;r_`kiDAHf+bxDE{(Dv4pk0aW54#%M zM1`y>5eC9@f_ir3h4AE3&`13lS?0@R>y|>TqWwq}7xN6}VH0(C_#AeFRDGOA163V$ zPk3{c4XQ*5MCJ&_3@3QAsnBwNoJx?7H(f=GW3;Rs+hTqWuKw622;YONo3TyTsK@}B zb*0KD%~|Uv&SjXvj|Dz3et zfMIOFOteUBk z^2~M@YCWzv-ZG#;4D!roMA~rIkGQYe2|)*;;7V@t>*EC-TNxu&f#O?Ha3r_*wei9j z4F2&K!JvZ|!Qky|;rz}2(8&2)XH^ZTLl|xn1XX%m&gZ3{Gu!x9GPbkK0}Et`Z}k}K z2459cP3#%DeB*{qhEP6b1dZ%U8+@O=L7_+=0k#U39`l6TF-sjm#6BPSe48qA^;Xp) zbARC!%7w6@N*NRjtI}s16Cm&yzfTx<-0Lq}$bnUMLH@|4kXh*np|I*S;H4#g;BRUW z6WgN)2sx*|_7qaL*-RB@FV%b@wtCZ7GCiKZOjD7{ju||lt9lnj+C+I{h|7+dJs`!s zNZulA0=rEgo9(S-euC7NVPZKmMyyd};Z@*W5qg zHu*v3bjH+|MJm@F(FgkJB zH>`izj&c6IYx18TU;c4<;(y(a@%^u16({F^dsxNE_K#a5{_}4>>>Ql`@uaA1gE9jN zw2%pauPgL;SF?PNJcZ+U7dm)Mg%*PX1JG?LRVM-m9UR~!BH*!VH!*Q`bktdP=6Fd? z;W9iYQC+3`bmH1V#wl;;=lt+kKIISBP!sqeSGdjhX>2#_oOvZK7yb<`4;2)?tH$<* z@gz6H`2*qU-9Ah1{qe%cM&~z*XXH>fatQGR7gV>wq;x(l962_DrV!sr>ZiDP&ODqu zx>p=jG-^n^C1pG`t_$#IE7Tc_@2nPHIX|>Fhy4O1YFLWdk9@Ybk@ncxr|>_xoH2!&X7-9n)lLa4!4L#wI`BrsZV9!v0pu9OEA_N0p zuKK;|vxx%0=bUiJ_^&pDenbJ7l%zI~8|1?qFhD}~QLb+&UGbf~PCDSw3W4SLPN&og zAu}19djF5`GL*z^C;JmahE{SZP@QJ@s%gta5kJH((+P$}*#S2fhRA{m z&v+-5gw2x^E&V9snS4;9M5_#%jwjd=W|asE=j zC`N)?+F!D00(j+TnLb&8wzOzMp%^`6_q9zgT|)aOzd4JR67;QL@W;As81~57P|Qa= zvTE@dxHxHog5MvnWM{*jaED>)=09FRJO|0WA%Y>PgUp8@!UX75@$J7_`e9sf5oLJU zkDywj2+(5zEb*S5p`d(i=^kJq{;~m?CvX`J2zH-AG{fSe5dX;R8%xnhZbDvNP=ekq z{Y47m+*QPC&`qNzz-P?-&9Fs1*?)sjqDck z_)rS6;JXQpYa2m2cF-a24gfLXpdZZv;f}|ct#J5e@kNG!`yfm-;JmoaL?na;wvKdF zp;U|jo6}{+*iR%&pV9&CzRJh^Ln#dG)lh%hg2At@LCwPNlZI8oS;^?XWZwke}__q(nHeAU7xiAQe)Q0DyZ@$PlDQ$bc~VxC~W#Z z)$9Wy-i8z6q8=MC0x~I9`7!3DfXgxQsO-Tvkea{*0V`0bY332L4)3)FF>2$9b|tG~ zJtbna(I3cq=PrRI=(gmfW|~!SR1}RP!vtm^{+uX+TB48Xkq}FJ5LrWV0o*NH#}@u0@tCv_-(67c2d#+N6iP!r7k5T%Jca1v~I6dzuQal~yHR;7t& z6lcR*9Q3a%&DR>dY!Ex^O~d$$f>I2mwm~bQEE|!g z2&Jrn1Z*Icd#DRyZb30D)u+328l}_KoAH6$uO)j`=&n+DtGxP{EP%hjO8j~*JQCev zrxczeqXLrTI+vOagCt(g3wH@0PJ&Ku;riOpF*TBG!g7kOxPiPHVn*^YfeQKzp+vMd zpMt%Fykmu@;E+K~2`w~_B%bh<2IUcozI0LGtp^R!CZo-ivKt!j`$|p-`L8e0T`Hf;>w;3Zyu(BM#kXeaLkjBv1zCW=kX) z8z^`N%r$;VBB58WGbc=ynAiyaVrtwTxCpdi1O#Er-SQDdACx2zusvU2sR6fOh<}!# z_X4#)HHqVWnXCkt8cao+aryv^W3>MQeqff85(OT%6|6DQvXmfI8@DqC*V?burZaG)$N%bh%AXq;G)2lm{p6j z5sww;lpQ2sdyJ<VhOGcW;rO8r-xUCMxYfPQZ};Y+uH0W3-<&wSA=N1!oeGSAr^R`T%D4@aZM7QvDtqp zfOhNV1B2r*rpyiFvxR?$SG~kfKcjPcytO`~C%M0cKBLbz4DCHztDF8NrTScncP$k` zMtA#6r;Is5s;X`g19F5JumDHkEeVVYSTcU7} z)|k&L+?2vA9Gh1|M#OuA?|9CjJh^xZ6m)|?tT%f=o-Nw8p}pt=Szl+yg5=fe0!Aww zehvpXoLMxqIAcb9JkeiNi@Zk=|7mqOC6Ck~1iJbzp2v+Cs(n_F`s!s|I1h1a|3#?; z-T+S6kt-|)d|lleTos%>A?*8ttVhb_A3+4$9PwP%va;N9-oHk5wV(WkY=Foi?D&*T z<#MwU8C(^bJQw$k+KsECV%C={!PzNus4=75n4w};pUOo$aq@<>PQ|sM(cYi^fEEbm zso-&wu!}b&d6EHxG_Gf)p;R&_shmYdS2+`Y8TQb)sR*8w^5HjG;W{TuFH5WfTqZ^b z=bPSyVxq)JeCgf97W%us;5sJ^tub#G0EyE0@S0FMf7fqF#|rbxA57~;gxTzcRf=(3 zM+iQ>WS`Dt^OH{71FtaV^+g+5V zFb&CwF)lv?>0?F^mCwp^Ch&70_G<3t>sSGjEk0uCv{`)&t+e5|iKsB-yos=5RqJSM zWX!k{Z%R8 zDi*Ct>AtgWMJtXxUKE7TO0uF*MKdf8F&fp29`B2J>boC8BGjrTU5`{-v-vdy%)n_2 zkg?pYNM`zK#&?2YAvfh-&VdrT2!vOE=15$K1 zl>m02<(?dAFkBt^Wk!ruE~$1H6BRNTX20g=NVMys>dfc$8ZHb8WU#_E8{rg*K#iUK zGD$s5tT;W=j{H@NnUXGMskzl^9vg7dlT52Hg(~XcNXZ(nY1V#*@F4#Y@v7U78!7$;69Lg+DS{l zUZIe%);LjG$)wzPWRUW9SIF)`w@6Rm!+kKS(`OE?*2Or;m_+Y!%T~0ihJb1ZoofjfP=)E6PlNzKYf+z-{ zs>f>|Uyfp6WW<2FmIBA&1*1y_$NRhZtjfE#oc~%WZYwV`QZ;cs__Z!e^j{tttslFV<{gAxO8 zms9@mz}Bl0O_4l2n!2>9>e@xZT>^LMeC!?Zz0v&zH?LjIXy<7?SrX&u#7`W$+-p53 zS`dQGUOl5mYLGJp4_}CRbYi_FJ;8(t{tmb>U0h(5U_fTY`ZMQ%%uA_e!(Hxr^z-v^ zrlH?go~z4|T*=qRi8s?{)aXQ4a{?u;k~!Mhjn|v~&bKGw^DbUKxmcko>Q3qw$@(+f zeqKJu*dzY&{RNUvJQ^C=EitBH^Z{Nz(@0{Qdh-V?(=7E&_Ap)V5j>hks%F~)bJ9