From c05fa66096c6b4c2544688ed4633983e59bd497a Mon Sep 17 00:00:00 2001 From: Robin Beck Date: Wed, 22 Jun 2022 00:37:49 -0600 Subject: [PATCH] Hashiconf docs changes (#2178) Co-authored-by: Robin Beck Co-authored-by: XingLu Wang <95828202+xingluw@users.noreply.github.com> Co-authored-by: Loann Le <84412881+taoism4504@users.noreply.github.com> Co-authored-by: Jeff Mitchell Co-authored-by: irenarindos Co-authored-by: Irena Rindos Co-authored-by: Louis Ruch Co-authored-by: XingLu Wang Co-authored-by: XingLu Wang <95828202+xingluw@users.noreply.github.com> --- .../workflow-ssh-proxycommand.mdx | 4 +- .../domain-model/credential-stores.mdx | 8 + .../concepts/domain-model/credentials.mdx | 10 + website/content/docs/concepts/index.mdx | 24 +- .../concepts/security/connections-tls.mdx | 224 ++++++++-- .../concepts/security/data-encryption.mdx | 4 +- website/content/docs/configuration/index.mdx | 27 +- website/content/docs/configuration/worker.mdx | 120 ------ .../docs/configuration/worker/kms-worker.mdx | 108 +++++ .../docs/configuration/worker/overview.mdx | 64 +++ .../docs/configuration/worker/pki-worker.mdx | 59 +++ .../getting-started/connect-to-target.mdx | 88 ++-- .../docs/getting-started/deploy-and-login.mdx | 192 +++++++++ .../content/docs/getting-started/index.mdx | 34 +- .../getting-started/installing/production.mdx | 6 - website/content/docs/operations/index.mdx | 15 - .../docs/{ => oss}/developing/building.mdx | 0 .../docs/{ => oss}/developing/index.mdx | 0 .../content/docs/{ => oss}/developing/ui.mdx | 0 website/content/docs/oss/index.mdx | 27 ++ .../oss/installing/connect-to-dev-target.mdx | 207 +++++++++ .../content/docs/oss/installing/dev-mode.mdx | 68 +++ .../installing/high-availability.mdx | 0 .../docs/{ => oss}/installing/index.mdx | 2 +- .../{ => oss}/installing/no-gen-resources.mdx | 2 +- .../docs/{ => oss}/installing/postgres.mdx | 2 +- .../installing/reference-architectures.mdx | 0 .../installing}/run-and-login.mdx | 45 +- .../docs/{ => oss}/installing/systemd.mdx | 0 .../docs/{ => oss}/operations/health.mdx | 0 website/content/docs/oss/operations/index.mdx | 27 ++ .../docs/{ => oss}/operations/metrics.mdx | 0 website/content/docs/release-notes/v0_5_0.mdx | 2 +- website/content/docs/release-notes/v0_8_0.mdx | 6 +- website/content/docs/release-notes/v0_9_0.mdx | 42 ++ website/content/docs/what-is-boundary.mdx | 5 +- website/data/docs-nav-data.json | 393 ++++++++++-------- website/public/img/hcp-deploy-form.png | Bin 0 -> 144470 bytes website/public/img/how-boundary-works.png | Bin 0 -> 23938 bytes website/public/img/quick-start-targets.png | Bin 0 -> 64637 bytes website/public/img/setup-wizard-target.png | Bin 0 -> 71202 bytes website/public/img/setup-wizard.png | Bin 0 -> 48927 bytes website/redirects.js | 28 ++ 43 files changed, 1364 insertions(+), 479 deletions(-) delete mode 100644 website/content/docs/configuration/worker.mdx create mode 100644 website/content/docs/configuration/worker/kms-worker.mdx create mode 100644 website/content/docs/configuration/worker/overview.mdx create mode 100644 website/content/docs/configuration/worker/pki-worker.mdx create mode 100644 website/content/docs/getting-started/deploy-and-login.mdx delete mode 100644 website/content/docs/operations/index.mdx rename website/content/docs/{ => oss}/developing/building.mdx (100%) rename website/content/docs/{ => oss}/developing/index.mdx (100%) rename website/content/docs/{ => oss}/developing/ui.mdx (100%) create mode 100644 website/content/docs/oss/index.mdx create mode 100644 website/content/docs/oss/installing/connect-to-dev-target.mdx create mode 100644 website/content/docs/oss/installing/dev-mode.mdx rename website/content/docs/{ => oss}/installing/high-availability.mdx (100%) rename website/content/docs/{ => oss}/installing/index.mdx (80%) rename website/content/docs/{ => oss}/installing/no-gen-resources.mdx (98%) rename website/content/docs/{ => oss}/installing/postgres.mdx (94%) rename website/content/docs/{ => oss}/installing/reference-architectures.mdx (100%) rename website/content/docs/{getting-started => oss/installing}/run-and-login.mdx (52%) rename website/content/docs/{ => oss}/installing/systemd.mdx (100%) rename website/content/docs/{ => oss}/operations/health.mdx (100%) create mode 100644 website/content/docs/oss/operations/index.mdx rename website/content/docs/{ => oss}/operations/metrics.mdx (100%) create mode 100644 website/content/docs/release-notes/v0_9_0.mdx create mode 100644 website/public/img/hcp-deploy-form.png create mode 100644 website/public/img/how-boundary-works.png create mode 100644 website/public/img/quick-start-targets.png create mode 100644 website/public/img/setup-wizard-target.png create mode 100644 website/public/img/setup-wizard.png diff --git a/website/content/docs/common-workflows/workflow-ssh-proxycommand.mdx b/website/content/docs/common-workflows/workflow-ssh-proxycommand.mdx index 5e91f8537..061dbf4c2 100644 --- a/website/content/docs/common-workflows/workflow-ssh-proxycommand.mdx +++ b/website/content/docs/common-workflows/workflow-ssh-proxycommand.mdx @@ -41,7 +41,7 @@ $ boundary authenticate password -login-name=admin -password password -auth-meth ## SSH to Target -Running Boundary in [dev mode](https://www.boundaryproject.io/docs/getting-started#what-is-dev-mode) creates other +Running Boundary in [dev mode](/docs/oss/installing/dev-mode) creates other default resources such as a target and auth method. The default target (ttcp_1234567890) is already setup with a host at `localhost` and a default port of `22`. @@ -122,7 +122,7 @@ $ boundary authenticate password -login-name=admin -password password -auth-meth ## Authorize the Session -Running Boundary in [dev mode](https://www.boundaryproject.io/docs/getting-started#what-is-dev-mode) creates other +Running Boundary in [dev mode](/docs/oss/installing/dev-mode) creates other default resources such as a target and auth method. The default target (ttcp_1234567890) is already setup with a host at `localhost` and a default port of `22`. diff --git a/website/content/docs/concepts/domain-model/credential-stores.mdx b/website/content/docs/concepts/domain-model/credential-stores.mdx index 81287e81a..a857318e0 100644 --- a/website/content/docs/concepts/domain-model/credential-stores.mdx +++ b/website/content/docs/concepts/domain-model/credential-stores.mdx @@ -58,6 +58,10 @@ A Vault credential store has the following additional attributes: - `namespace` - (optional) A Vault [namespace][]. Requires Vault Enterprise. +### Static Credential Store Attributes + +A Static credential store has no additional attributes and only supports the optional attributes. + ## Referenced By - [Credential Library][] @@ -164,3 +168,7 @@ $ vault policy write boundary-controller boundary-controller-policy.hcl [renewable]: https://www.vaultproject.io/api-docs/auth/token#renewable-1 [periodic]: https://www.vaultproject.io/api-docs/auth/token#token_period [orphan]: https://www.vaultproject.io/api-docs/auth/token#orphan + +### Static Credential Store + +A Static credential store allows for a user-supplied credentials managed by Boundary. Credentials are encrypted and stored directly in Boundary. Currently, the static credential store can hold credentials of type `username_password`. diff --git a/website/content/docs/concepts/domain-model/credentials.mdx b/website/content/docs/concepts/domain-model/credentials.mdx index df1415246..7be5f5f45 100644 --- a/website/content/docs/concepts/domain-model/credentials.mdx +++ b/website/content/docs/concepts/domain-model/credentials.mdx @@ -13,6 +13,16 @@ on a [host][] for a [session][]. ## Attributes +## Credential types + +Optionally, credentials can be typed to indicate compliance with a specific +format. For example, Boundary allows for `username_password` credentials that +contain the following fields: + +- `username` - The username field assocaited with the credential. + +- `password` - The password field assocaited with the credential. + ## Referenced By - [Credential Store][] diff --git a/website/content/docs/concepts/index.mdx b/website/content/docs/concepts/index.mdx index 40847d6f4..87cc41eb8 100644 --- a/website/content/docs/concepts/index.mdx +++ b/website/content/docs/concepts/index.mdx @@ -49,14 +49,20 @@ supported for the specific inputs and examples with those inputs. # Next Steps -Be sure Boundary is able to run locally with the instructions at [Getting -Started](/docs/getting-started). Then, learn how to create targets and initiate -a session with [Connect to Your First -Target](/docs/getting-started/connect-to-target). +There are several options for deploying Boundary: -# Further Reading +1. HCP Boundary as a fully-managed service +2. Boundary OSS for self-managed deployments +3. Dev mode for testing and learning purposes -For more information see our general recommendations for [deployment -architecture](/docs/installing/high-availability), and see the [security -model](/docs/concepts/security) documentation for an explanation of the security -foundations of Boundary. +Boundary can be deployed easily as a managed service using the HashiCorp Cloud +Platform. Refer to the [Getting Started](/docs/getting-started) section to learn +more about HCP Boundary. + +To learn more about Boundary OSS and self-managed deployments, refer to the +[Boundary OSS](/docs/oss) docs. + +Boundary can be run locally in [Dev mode](/docs/oss/installing/dev-mode). Refer +to the [Connect to Your First +Target](/docs/oss/installing/connect-to-dev-target) section to learn about +creating targets and initiating a sessions in dev mode. diff --git a/website/content/docs/concepts/security/connections-tls.mdx b/website/content/docs/concepts/security/connections-tls.mdx index 95e77b871..0b8b35a29 100644 --- a/website/content/docs/concepts/security/connections-tls.mdx +++ b/website/content/docs/concepts/security/connections-tls.mdx @@ -29,45 +29,6 @@ provides broad compatibility with a wide array of clients. It is possible to require client certificates; see the configuration for `listener` blocks to see the available TLS parameters. -## Worker-to-Controller TLS - -The service exposed by the Controller to handle Worker requests takes -advantage of the [KMS](/docs/concepts/security/data-encryption) key designated -for `worker-auth` within Boundary's configuration file, which must point to the -same key on the KMS for both the Controller and the Worker. Security of the -connection relies on secure transmission of a single set of allowed TLS -parameters, which forms the entire allowable CA chain for the connection. - -TLS establishment is performed as follows: - -1. The Worker generates a TLS certificate acting as a self-contained chain, as - well as a nonce. The generated key type is currently Ed25519. The certificate is - valid for a total of 2.5 minutes: thirty seconds before the current time (to - allow for some minor clock drift) and two minutes after (to allow time to - establish the connection). - -2. The Worker marshals the TLS chain and nonce and encrypts the resulting bytes - via the shared KMS. This value is marshaled and split into chunks. - -3. The Worker establishes a TLS 1.3 connection to the Controller. The encrypted - value is transmitted to the Controller via the TLS ALPN field as numbered - chunks. - -4. The Controller reads the chunks and reassembles them into the original - encrypted value. - -5. The Controller decrypts this value via the shared KMS. If successful, the - Controller validates that the nonce is not known to ensure that this is not a - replay. The nonce value is checked against and stored into the database, - ensuring that nonce replay cannot occur across controllers. - -6. The Controller uses the decrypted parameters to configures its TLS stack with - the same certificate and key. - -7. The connection is mutually authenticated; on each end, only the single - self-signed CA certificate that was securely transmitted is configured as a - valid root CA for validation checking. - ## Client-to-Worker TLS Workers do not require any configuration for their client-facing listeners to @@ -131,3 +92,188 @@ In the future, to support other client paradigms, we may support user configuration of the Worker's client-facing TLS. In this model, the shared certificate/private key would instead act as credentials for the session, similar to a username/password. + + +## Worker-to-Upstream TLS + +Workers connect to upstreams (Controllers, or other Workers) via TLS +connections. In order to make these connections, Workers have to be +authenticated to the cluster. How this authentication and session establishment +takes place can happen in one of two ways: by a built-in X.509-based PKI system, +or by leveraging a KMS system to provide secure transport of authentication +information. + +The KMS-based mechanism provides zero-touch registration of Workers to a +cluster, while the PKI mechanism provides positive access control at +registration time. Currently, HCP Boundary deployments only support PKI +authentication for self-managed Workers. + +### PKI-Based Worker Authentication + +In the PKI-based authentication mechanisms, Workers are registered to the +cluster by informing the cluster of a Worker's public signing and encryption +keys. The cluster then returns to the Worker a set of signed certificates and a +Controller public encryption key. This process is arbited by the operator (or a +provisioning system) to provide security for transport of the initial public key +material. + +The PKI mechanism is set up via transport of a single value from the Worker to +any cluster Controller. Once established, certificates and encryption keys are +automatically rotated periodically, currently at a period of two weeks. + +There may be various permutations of this mechanism in the future; there is only +one mechanism now, referred to as _worker-led_ registration because the Worker +produces the initial key material. + +Note that the mechanisms described in this section omit detail for clarity. + +#### Worker-Led PKI-Based Registration + +Registration proceeds as follows: + +1. The Worker generates a signing public/private Ed25519 keypair and an + encryption public/private X25519 keypair, along with a registration nonce, + and provides these values in a bundle to the operator or orchestration + system. The bundle is signed with the Worker's private Ed25519 key (signing + ensures that a Meddler-in-the-Middle (MITM) that is able to snoop traffic + will be unable to masquerade as the Worker in requests sent to the + Controller, due to lacking the Worker's private signing key; as a result it + should never be properly registered or sent sessions to proxy). + +2. The operator or orchestration system submits this bundle to a Controller in + the cluster via an authenticated and authorized API call, requesting that a + Worker resource be created tied to the given key information. + +3. The Controller creates a Worker resource and associates it to the given key + material. The Controller also signs a _client-only_ certificate + authenticating the Worker's signing key and generates its own encryption + public/private keypair specific to that Worker. + +4. The Worker requests to its configured upstream(s) to fetch its issued + credentials. It provides its public keys and original registration nonce in + the request, which is signed via the Worker's private Ed25519 key. (Here + again this means that a MitM cannot masquerade as the Worker due to lacking + the signing key.) If the configured upstream is a Controller, it can respond + directly; otherwise the request is relayed up to the cluster Controllers. + +5. A Controller receiving the request validates that the provided nonce matches + the nonce in the bundle provided by the operator/orchestration system in step + 2, and that the keys also match. If so, the Controller uses its + Worker-specific encryption private key and the Worker's encryption public key + to derive a shared symmetric encryption key, and uses it to encrypt the + Worker certificate, its CA certifciate, and the nonce, and returns it to the + Worker along with its encryption public key. + +6. The Worker uses the given Controller encryption public key and its private + key to derive the shared symmetric key; confirms it can decrypt the returned + bundle; and validates the nonce, storing the issued certificate and CA + certificate. + +#### PKI-Based Session Establishment + +Using the stored credentials, a PKI-based worker establishes a session as +follows: + +1. The Worker initiates a TLS connection to an upstream, presenting its TLS + certificate along with a signed bundle containing a nonce. + +2. The upstream requests a just-in-time server certificate (remember, + certificates issued during registration are client-only), either directly (if + a Controller) or via a proxied request to a Controller (if another Worker). + The request conveys the Worker's nonce as well as the key ID from the client + certificate. + +3. A cluster Controller validates the key ID to ensure it is a registered + worker, then creates a certificate with a short validation period that embeds + the Worker's nonce, signed with the cluster's CA certificate. The Controller + issuing this certificate has now authenticated the incoming Worker to the + upstream, as the Controller has now vouched for the validity of the Worker + tied to the client certificate. (Technically client certificate verification + happens later in the TLS handshake, but conceptually this is when the + incoming Worker is authenticated to the upstream.) + +4. The upstream presents this server certificate to the Worker. The Worker + validates that its nonce is embedded in the certificate and that the + certificate chain can be validated to one of its saved CAs. This + authenticates the upstream to the incoming Worker, since the trusted root has + issued a new certificate containing the expected nonce and provided it to the + upstream. + +5. The TLS connection is now established, and the upstream can handle the Worker + protocol. + +#### PKI-Based Credential Rotation + +Periodically, a PKI-based Worker will trigger rotation of its credentials. The +mechanism is as follows: + +1. The Worker generates a new signing public/private Ed25519 keypair and a new + encryption X25519 public/private keypair. + +2. The Worker creates a request to fetch new credentials from the Controller, + providing its new public keys and an operation nonce in the request, + encrypted with the current shared symmetric encryption key via the current + X25519 parameters. As only the Controllers and the Worker can derive this + shared symmetric key, the Worker knows that for the request to be satisfied + it must be handled by an already-trusted Controller. + +3. The Controller decrypts the bundle and registers the new key information to + the Worker resource. It generates a new certificate and encryption + public/private keypair and returns the certificate, current CA, operation + nonce, and encryption public key to the worker. All but the encryption public + key are encrypted with the symmetric key derived from the new Controller + encryption private key/new Worker encryption public key. + +4. This information is itself encrypted with the existing symmetric encryption + key, and this value returned to the Worker. + +5. The Worker decrypts the outer bundle with its current information, uses that + to retrieve an authenticated new encryption public key from the Controller, + then uses that with its new encryption private key to derive the new shared + symmetric encryption key. That new key is used to decrypt the rest of the + parameters, and the nonce is checked to ensure that the response is for the + current operation started by the Worker in step 1. + +6. The Worker has validated that a trusted Controller provided the new + certificate information and encryption parameters and that those parameters + can be used to successfully derive a shared symmetric encryption key. The + Worker saves the new credentials and uses them going forwardl + +### KMS-Based Worker Authentication + +Workers can take advantage of the [KMS](/docs/concepts/security/data-encryption) +key designated for `worker-auth` within Boundary's configuration file, which +must point to the same key on the KMS for both the Controller and the Worker. +Security of the connection relies on secure transmission of a single set of +allowed TLS parameters, which forms the entire allowable CA chain for the +connection. + +TLS establishment is performed as follows: + +1. The Worker generates a TLS certificate acting as a self-contained chain, as + well as a nonce. The generated key type is currently Ed25519. The certificate is + valid for a total of 2.5 minutes: thirty seconds before the current time (to + allow for some minor clock drift) and two minutes after (to allow time to + establish the connection). + +2. The Worker marshals the TLS chain and nonce and encrypts the resulting bytes + via the shared KMS. This value is marshaled and split into chunks. + +3. The Worker establishes a TLS 1.3 connection to the Controller. The encrypted + value is transmitted to the Controller via the TLS ALPN field as numbered + chunks. + +4. The Controller reads the chunks and reassembles them into the original + encrypted value. + +5. The Controller decrypts this value via the shared KMS. If successful, the + Controller validates that the nonce is not known to ensure that this is not a + replay. The nonce value is checked against and stored into the database, + ensuring that nonce replay cannot occur across controllers. + +6. The Controller uses the decrypted parameters to configures its TLS stack with + the same certificate and key. + +7. The connection is mutually authenticated; on each end, only the single + self-signed CA certificate that was securely transmitted is configured as a + valid root CA for validation checking. diff --git a/website/content/docs/concepts/security/data-encryption.mdx b/website/content/docs/concepts/security/data-encryption.mdx index 4a5f6df0f..6ebd54786 100644 --- a/website/content/docs/concepts/security/data-encryption.mdx +++ b/website/content/docs/concepts/security/data-encryption.mdx @@ -9,8 +9,8 @@ description: |- Boundary has multiple mechanisms to ensure secure end-to-end behavior of the system. A key part of this is [support for various Key Management -Systems](/docs/configuration/kms) that protect the base encryption keys used for -various functions. This page describes the various KMS key purposes that +Systems](/docs/configuration/kms) that protect the base encryption keys used +for various functions. This page describes the various KMS key purposes that Boundary supports and how they are used within the system. ~> Boundary does not currently support rotation of its internal keys, but this diff --git a/website/content/docs/configuration/index.mdx b/website/content/docs/configuration/index.mdx index f55c9916a..5a43b7662 100644 --- a/website/content/docs/configuration/index.mdx +++ b/website/content/docs/configuration/index.mdx @@ -1,23 +1,24 @@ --- layout: docs -page_title: Server Configuration +page_title: Overview/Top-Level Parameters description: Boundary configuration reference. --- # Configuration [listener]: /docs/configuration/listener -[telemetry]: /docs/configuration/telemetry [controller]: /docs/configuration/controller [worker]: /docs/configuration/worker [kms]: /docs/configuration/kms [plugins]: /docs/configuration/plugins -Outside of development mode, Boundary controllers and workers are configured using a file. -The format of this file is [HCL](https://github.com/hashicorp/hcl). In this section you'll find +Outside of development mode, Boundary controllers and workers are configured +using a file. The format of this file is +[HCL](https://github.com/hashicorp/hcl). In this section you'll find configuration block examples for Boundary controllers and workers. -After the configuration is written, use the `-config` flag to specify a local path to the file. +After the configuration is written, use the `-config` flag to specify a local +path to the file. ## Parameters @@ -65,12 +66,18 @@ After the configuration is written, use the `-config` flag to specify a local pa LimitMEMLOCK=infinity ``` -- `log_level` `(string: "info")` – Specifies the log level to use; overridden by - CLI and env var parameters. Supported log levels: Trace, Debug, Error, Warn, Info. +- `log_level` `(string: "info")` – (Deprecated: this is being phased out in + favor of observability and is currently only used as a backup if eventing + fails.) Specifies the log level to use; overridden by CLI and env var + parameters. Supported log levels: Trace, Debug, Error, Warn, Info. -- `log_format` `(string: "")` – Specifies the log format to use; overridden by - CLI and env var parameters. Supported log formats: `"standard"`, `"json"`. +- `log_format` `(string: "")` – (Deprecated: this is being phased out in favor + of observability and is currently only used as a backup if eventing fails.) + Specifies the log format to use; overridden by CLI and env var parameters. + Supported log formats: `"standard"`, `"json"`. ## Example Configurations -For complete example configurations see the sections for [controller](/docs/configuration/controller) and [worker](/docs/configuration/worker). +For complete example configurations see the sections for +[controller](/docs/configuration/controller) and +[worker](/docs/configuration/worker). diff --git a/website/content/docs/configuration/worker.mdx b/website/content/docs/configuration/worker.mdx deleted file mode 100644 index 7a4a62c5c..000000000 --- a/website/content/docs/configuration/worker.mdx +++ /dev/null @@ -1,120 +0,0 @@ ---- -layout: docs -page_title: Worker - Configuration -description: |- - The worker stanza configures worker-specific parameters. ---- - -# `worker` Stanza - -The `worker` stanza configures Boundary worker-specific parameters. - -```hcl -worker { - name = "example-worker" - description = "An example worker" - public_addr = "5.1.23.198" -} -``` - -- `name` - Specifies a unique name of this worker within the Boundary - cluster. This value can be a direct name string, can refer to a file on disk - (file://) from which an name will be read; or an env var (env://) from which - the name will be read. - -- `description` - Specifies a friendly description of this worker. - This value can be a direct description string, can refer to a file on disk - (file://) from which a description will be read; or an env var (env://) from - which the description will be read. - -- `public_addr` - Specifies the public host or IP address (and optionally port) - at which the worker can be reached _by clients for proxying_. This defaults to - the address of the listener marked for `proxy` purpose. This is especially - useful for cloud environments that do not bind a publicly accessible IP to a NIC - on the host directly, such as an Amazon EIP. This value can be a direct address string, - can refer to a file on disk (file://) from which an address will be read; - an env var (env://) from which the address will be read; - or a [go-sockaddr template](https://godoc.org/github.com/hashicorp/go-sockaddr/template). - -- `initial_upstreams` - A list of hosts/IP addresses and optionally ports for reaching - controllers or workers. The port will default to :9201 if not specified. This value can be - a direct access string array with the addresses, or it can refer to a file on - disk (file://) from which the addresses will be read, or an env var (env://) from - which the addresses will be read. When using env or file, their contents - must formatted as a JSON array: `["127.0.0.1", "192.168.0.1", "10.0.0.1"]` - -- `tags` - A map of key-value pairs where values are an array of strings. Most - commonly used for [filtering](/docs/concepts/filtering) targets a worker can - proxy via [worker tags](/docs/concepts/filtering/worker-tags). On `SIGHUP`, the - tags set here will be re-parsed and new values used. It can also be a string - referring to a file on disk (file://) or an env var (env://). - -## KMS Configuration - -Workers require a KMS block designated for `worker-auth`. This is the KMS configuration for -authentication between the workers and controllers and must be present. Example (not safe for production!): - -```hcl - kms "aead" { - purpose = "worker-auth" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_worker-auth" -} -``` - -This configuration must be the same for the worker-auth configuration for the controller if you're -running the controller and worker as separate servers. - -And optionally, a KMS stanza for configuration encryption purpose: - -```hcl -# Configuration encryption block: decrypts sensitive values in the -# configuration file. See `boundary config [encrypt|decrypt] -h`. -kms "aead" { - purpose = "config"` - aead_type = "aes-gcm" - key = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs=" -} -``` - -Boundary supports many kinds of KMS integrations. For a complete guide to all available -KMS types, see our [KMS documentation](/docs/configuration/kms). - -# Complete Configuration Example - -```hcl -listener "tcp" { - purpose = "proxy" - tls_disable = true - address = "127.0.0.1" -} - -worker { - # Name attr must be unique across workers - name = "demo-worker-1" - description = "A default worker created demonstration" - - # Workers must be able to reach controllers on :9201 - controllers = [ - "10.0.0.1", - "10.0.0.2", - "10.0.0.3", - ] - - public_addr = "myhost.mycompany.com" - - tags { - type = ["prod", "webservers"] - region = ["us-east-1"] - } -} - -# must be same key as used on controller config -kms "aead" { - purpose = "worker-auth" - aead_type = "aes-gcm" - key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" - key_id = "global_worker-auth" -} -``` diff --git a/website/content/docs/configuration/worker/kms-worker.mdx b/website/content/docs/configuration/worker/kms-worker.mdx new file mode 100644 index 000000000..609a9fad2 --- /dev/null +++ b/website/content/docs/configuration/worker/kms-worker.mdx @@ -0,0 +1,108 @@ +--- +layout: docs +page_title: KMS Worker Configuration +description: |- + KMS worker-specific parameters. +--- + + +## KMS Worker Configuration + +KMS Workers require a `name` field. This specifies a unique name of this worker within the Boundary cluster. +The `name` value can be: +- a direct name string (must be all lowercase) +- a reference to a file on disk (`file://`) from which the name is read +- an env var (`env://`) from which the name is read. + +~> **Note:** Changing the `name` results in the creation of a new worker in the +cluster and assignment of a new worker ID. + +KMS Workers accept an optional `description` field. The `description` value can be: +- a direct description string +- a reference to a file on disk (`file://`) from which the name is read +- an env var (`env://`) from which the name is read. + +```hcl +worker { + name = "example-worker" + description = "An example worker" + public_addr = "5.1.23.198" +} +``` + +KMS Workers also require a KMS block designated for `worker-auth`. This is the KMS configuration for +authentication between the workers and controllers and must be present. Example (not safe for production!): + +```hcl + kms "aead" { + purpose = "worker-auth" + aead_type = "aes-gcm" + key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" + key_id = "global_worker-auth" +} +``` + +This configuration must be the same for the worker-auth configuration for the controller if you're +running the controller and worker as separate servers. + +Optionally, a KMS stanza for configuration encryption purpose can also be specified: + +```hcl +# Configuration encryption block: decrypts sensitive values in the +# configuration file. See `boundary config [encrypt|decrypt] -h`. +kms "aead" { + purpose = "config"` + aead_type = "aes-gcm" + key = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs=" +} +``` + +Boundary supports many kinds of KMS integrations. For a complete guide to all available +KMS types, see our [KMS documentation](/docs/configuration/kms). + +# Complete Configuration Example + +```hcl +listener "tcp" { + purpose = "proxy" + tls_disable = true + address = "127.0.0.1" +} + +worker { + # Name attr must be unique across workers + name = "demo-worker-1" + description = "A default worker created for demonstration" + + # Workers must be able to reach upstreams on :9201 + initial_upstreams = [ + "10.0.0.1", + "10.0.0.2", + "10.0.0.3", + ] + + public_addr = "myhost.mycompany.com" + + tags { + type = ["prod", "webservers"] + region = ["us-east-1"] + } +} + +# must be same key as used on controller config +kms "aead" { + purpose = "worker-auth" + aead_type = "aes-gcm" + key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ=" + key_id = "global_worker-auth" +} +``` + +[`initial_upstreams`](/docs/configuration/worker/overview#initial_upstreams) +are used to connect to upstream Boundary clusters. + +## Further Reading + +For more on how `tags{}` in the above configuration are used to facilitate +routing to the correct target, refer to the [Worker +Tags](/docs/concepts/filtering/worker-tags) page. diff --git a/website/content/docs/configuration/worker/overview.mdx b/website/content/docs/configuration/worker/overview.mdx new file mode 100644 index 000000000..3de6b062a --- /dev/null +++ b/website/content/docs/configuration/worker/overview.mdx @@ -0,0 +1,64 @@ +--- +layout: docs +page_title: Worker - Overview +description: |- + The worker stanza configures worker-specific parameters. +--- + +# `worker` Stanza + +The `worker` stanza configures Boundary worker-specific parameters. Boundary +supports two different types of workers, differentiated by their means of +authentication to Boundary: +- [KMS Workers][] use a shared KMS to authenticate with controllers +- [PKI Workers][] use certificates issued by Boundary to authenticate with controllers + +Different worker types have different configuration requirements, but share the common worker parameters listed below. + +## Common Worker Parameters +The following fields are supported for all worker types: + +```hcl +worker { + public_addr = "5.1.23.198" + + initial_upstreams = [ + "10.0.0.1", + "10.0.0.2", + ] + + tags { + type = ["prod", "webservers"] + region = ["us-east-1"] + } +} +``` + +- `public_addr` - Specifies the public host or IP address (and optionally port) + at which the worker can be reached _by clients for proxying_. This defaults to + the address of the listener marked for `proxy` purpose. This is especially + useful for cloud environments that do not bind a publicly accessible IP to a NIC + on the host directly, such as an Amazon EIP. + + This value can reference any of the following: + - a direct address string + - a file on disk (file://) from which an address will be read + - an env var (env://) from which the address will be read + - a [go-sockaddr template](https://godoc.org/github.com/hashicorp/go-sockaddr/template) + +- `initial_upstreams` - A list of hosts/IP addresses and optionally ports for + reaching the boundary cluster. The port will default to `:9201` if not + specified. This value can be a direct access string array with the addresses, + or it can refer to a file on disk (`file://`) from which the addresses will be + read, or an env var (`env://`) from which the addresses will be read. When using + env or file, their contents must formatted as a JSON array: `["127.0.0.1", + "192.168.0.1", "10.0.0.1"]` + +- `tags` - A map of key-value pairs where values are an array of strings. Most + commonly used for [filtering](/docs/concepts/filtering) targets a worker can + proxy via [worker tags](/docs/concepts/filtering/worker-tags). On `SIGHUP`, the + tags set here will be re-parsed and new values used. It can also be a string + referring to a file on disk (`file://`) or an env var (`env://`). + +[kms workers]: /docs/configuration/worker/kms-worker +[pki workers]: /docs/configuration/worker/pki-worker diff --git a/website/content/docs/configuration/worker/pki-worker.mdx b/website/content/docs/configuration/worker/pki-worker.mdx new file mode 100644 index 000000000..18e67ad8c --- /dev/null +++ b/website/content/docs/configuration/worker/pki-worker.mdx @@ -0,0 +1,59 @@ +--- +layout: docs +page_title: PKI Worker Configuration +description: |- + PKI worker-specific parameters. +--- + + +## PKI Worker Configuration +PKI Workers authenticate to Boundary using a certificate-based method, allowing +for worker deployment without using a shared KMS. + +PKI Workers require an accessible directory defined by `auth_storage_path` for +credential storage. + +Example (not safe for production!): + +```hcl +worker { + auth_storage_path="/boundary/demo-worker-1" + initial_upstreams = ["10.0.0.1"] +} +``` + +~> **Note:** `name` and `description` fields are not valid config fields for PKI +workers. These fields are only valid for [KMS Workers][]. `name` and +`description` can only be set for PKI workers through the API. + +# Complete Configuration Example + +```hcl +listener "tcp" { + purpose = "proxy" + tls_disable = true + address = "127.0.0.1" +} + +worker { + # Path for worker storage. Must be unique across workers + auth_storage_path="/boundary/demo-worker-1" + + # Workers typically need to reach upstreams on :9201 + initial_upstreams = [ + "10.0.0.1", + "10.0.0.2", + "10.0.0.3", + ] + + public_addr = "myhost.mycompany.com" + + tags { + type = ["prod", "webservers"] + region = ["us-east-1"] + } +} + + +``` +[kms workers]: /docs/configuration/worker/kms-worker diff --git a/website/content/docs/getting-started/connect-to-target.mdx b/website/content/docs/getting-started/connect-to-target.mdx index 9c8407d61..63ede0840 100644 --- a/website/content/docs/getting-started/connect-to-target.mdx +++ b/website/content/docs/getting-started/connect-to-target.mdx @@ -7,15 +7,36 @@ description: |- ## Connect to Your First Target -The default target is a `tcp` target with a default port of `22` (which -corresponds to the default SSH port using TCP). The host sets for this target -contain the default host, which has the address `127.0.0.1`. When `boundary -connect` is executed against this target, the single available host will be -selected and a local authenticated proxy to the host is established on the -target's default port (`127.0.0.1:22`). +The [Quick setup +wizard](/docs/getting-started/deploy-and-login#login-to-hcp-boundary) +is the fastest way to onboard a target to HCP Boundary. +![Setup Wizard](/img/setup-wizard-target.png) + +A `tcp` target with a default port of `22` (the default SSH port using TCP) is +recommended for an initial target. If using the Quick setup, a sample host set +called **QA Databases** will contain the **CRM Database** host, with the Address +provided during setup. When `boundary connect` is executed against the **CRM +Database target**, the single available host will be selected and a local +authenticated proxy to the host is established on the target's default port. + +![Setup Wizard](/img/quick-start-targets.png) + +To connect to the initial CRM Database target: + +1. Copy the **CRM Database target ID** (such as `ttcp_eTcZMueUYv`). + +1. Open a terminal session. Export the Boundary **Origin URL** as an environment + variable. + +```shell-session +$ export BOUNDARY_ADDR= ``` -$ boundary connect -target-id ttcp_1234567890 + +1. Connect to the target. + +```shell-session +$ boundary connect -target-id ttcp_eTcZMueUYv ``` The output displays the address and port that your SSH client must utilize. In @@ -43,16 +64,16 @@ filling in the local address and port. An expected host ID is set to avoid warnings on future connections when a different port is allocated automatically. A host key must still be accepted upon first connect. -``` -$ boundary connect ssh -target-id ttcp_1234567890 +```shell-session +$ boundary connect ssh -target-id ttcp_eTcZMueUYv ``` If you want to pass additional flags to the SSH client, add them to the command line separated by a double-dash; anything after the double dash will be passed to the executed client. For instance: -``` -$ boundary connect ssh -target-id ttcp_1234567890 -- -l some-other-user +```shell-session +$ boundary connect ssh -target-id ttcp_eTcZMueUYv -- -l some-other-user ``` There is also a `-style` flag to allow the command to format arguments in a @@ -83,7 +104,7 @@ can correctly identify the desired target. Here is an SSH example in dev-mode: -``` +```shell-session $ boundary connect ssh -target-name "Generated target" -target-scope-name "Generated project scope" ``` @@ -107,8 +128,8 @@ anything. Whether using `-exec` or one of the listed helpers, you can pass flags to the executed command by including them after a double-dash `--`: -``` -$ boundary connect ssh -target-id ttcp_1234567890 -- -l myuser -i ~/.ssh/identity +```shell-session +$ boundary connect ssh -target-id ttcp_eTcZMueUYv -- -l myuser -i ~/.ssh/identity ``` You also have access to some templated values that are substituted into the @@ -126,29 +147,29 @@ For example, if you wanted to use Boundary to create an authenticated firewall around 'curl', you could update the default TCP target from a default port of `:22` to `:443`: -``` -$ boundary targets update tcp -default-port 443 -id ttcp_1234567890 +```shell-session +$ boundary targets update tcp -default-port 443 -id ttcp_eTcZMueUYv Target information: - Created Time: Fri, 25 Sep 2020 18:35:47 PDT - Description: Provides an initial target in Boundary - ID: ttcp_1234567890 - Name: Generated target + Created Time: Fri, 17 June 2022 18:35:47 PDT + Description: Sample target created by quick setup + ID: ttcp_eTcZMueUYv + Name: CRM Database target Session Connection Limit: 1 Session Max Seconds: 28800 Type: tcp - Updated Time: Fri, 25 Sep 2020 18:36:18 PDT + Updated Time: Fri, 17 June 2022 19:15:17 PDT Version: 2 Scope: - ID: p_1234567890 - Name: Generated project scope - Parent Scope ID: o_1234567890 + ID: p_A4jfDjZ9jf + Name: Sample project created by quick setup + Parent Scope ID: o_B1xISmpJ5Y Type: project Host Sets: - Host Catalog ID: hcst_1234567890 - ID: hsst_1234567890 + Host Catalog ID: hcst_YgIU0sHxXp + ID: hsst_pp6f2hfRYB Attributes: Default Port: 443 @@ -159,8 +180,8 @@ In the output above the default port for the target has now changed to `:443`. Now, `curl` can be used as the executed client for the TCP target session to do an authenticated download of hashicorp.com: -``` -$ boundary connect -exec curl -target-id ttcp_1234567890 \ +```shell-session +$ boundary connect -exec curl -target-id ttcp_eTcZMueUYv \ -- -vvsL --output /dev/null hashicorp.com * Trying 76.76.21.21... @@ -178,8 +199,8 @@ example, if `putty.exe` is available on a Windows host but the command is being run from WSL, the following allows usage of the wrapper while specifying the correct available binary (as WSL must use `.exe` when invoking Windows binaries): -``` -$ boundary connect ssh -style putty -exec putty.exe -target-id ttcp_1234567890 +```shell-session +$ boundary connect ssh -style putty -exec putty.exe -target-id ttcp_eTcZMueUYv ``` ## Connect using Desktop Client @@ -192,7 +213,7 @@ proxy details. playsInline autoPlay loop - class="boundary-clickthrough-video boundary-clickthrough-desktop-video" + className="boundary-clickthrough-video boundary-clickthrough-desktop-video" > + + + +1. In the HCP Boundary portal, open the **Boundary Overview** page, and click +the **copy icon** in the **Copy this into Boundary Desktop** section. This +copies your environment’s Boundary **Origin URL**. + +1. Open a terminal session and set the `BOUNDARY_ADDR` environment variable to +the copied origin URL. + +```shell-session +$ export BOUNDARY_ADDR= +``` + +1. Log in with the administrator credentials you created when you deployed the +HCP Boundary instance. + +```shell-session +$ boundary authenticate password \ + -auth-method-id=COPIED_AUTH_ID \ + -login-name=ADMIN_USERNAME \ + -password=ADMIN_PASSWORD +``` + +You are now logged into your HCP Boundary instance's Global scope via the CLI. +This is the default scope for all new Boundary clusters. + +If you are on Windows or macOS, the system password store will be used to store +the new token. On any other operating system, you may get an error indicating +that the token could not be stored. Boundary defaults to using +[pass](https://www.passwordstore.org/) on these machines, which uses [GNU +Privacy Guard](https://gnupg.org/) to encrypt values. If it is not available, +the token will be displayed and can be stored in a system of your choice and +passed in via the `BOUNDARY_TOKEN` environment variable. + +It is recommended to make use of `pass` or another alternative (such as any +implementation of the freedesktop.org Secret Service feature). Installation and +configuration of `pass` or other alternatives is beyond the scope of this +article; consult the documentation for `pass` or your specific OS distribution +help pages. + + + + + +[Boundary Desktop](https://www.boundaryproject.io/downloads) can be used to +connect to HCP Boundary. + +To get started with Boundary Desktop: + +1. Install Boundary Desktop. +1. Enter your HCP Boundary instance’s origin URL. +1. Enter the login name and password. + +To authenticate using the Boundary desktop client, launch Boundary desktop +client and connect to boundary to using your environment's **Origin URL**. + +You can find your environment’s origin url In the HCP portal. Open the +**Boundary Overview** page and click the **copy icon** in the **Copy this into +Boundary Desktop** section. This copies your environment’s Boundary **Origin +URL**. + +The admin username and password from instance creation can be used for initial +setup. Once additional users have been created, they can also log in to HCP +Boundary using the Boundary Desktop app. + + + + + + + + +You can also use these overrides to configure the [Terraform provider for +Boundary](https://registry.terraform.io/providers/hashicorp/boundary/): + +```hcl +provider "boundary" { + base_url = "hcp-boundary-origin-url" + auth_method_id = "auth-method-id" + auth_method_username = "admin-username" + auth_method_password = "admin-password" +} +``` + +To find your environment’s `base_url`: + +1. In the HCP portal, open the **Boundary Overview** page. +1. Click the **copy icon** in the **Copy this into Boundary Desktop** section. This copies your environment’s Boundary **Origin URL**. + +To find your environment’s default `auth_method_id`: + +1. In your HCP Boundary portal, click the Admin UI button. +1. Log in to the Admin Console by entering the admin username and password you + created when you deployed the HCP Boundary instance, and click **Authenticate**. +1. Click **Auth Methods**. +1. Click the **copy icon** for the Password **Auth Method ID** + + + + + +## Next Steps + +See [connecting to your first target](/docs/getting-started/connect-to-target) +for how to use HCP Boundary to run your first SSH session. diff --git a/website/content/docs/getting-started/index.mdx b/website/content/docs/getting-started/index.mdx index c3ad7f31e..abf73f018 100644 --- a/website/content/docs/getting-started/index.mdx +++ b/website/content/docs/getting-started/index.mdx @@ -10,34 +10,12 @@ Before getting started with Boundary, it's important to understand a few key con ## Requirements -The examples in Getting Started all revolve around running in `dev mode`. There are a few requirements for running dev mode: +The Getting Started section uses HCP Boundary, a HashiCorp hosted and fully-managed version of the Boundary product. -1. [Docker](https://docs.docker.com/get-docker/) is installed -1. A route to download the [Postgres Docker image](https://hub.docker.com/_/postgres) is available or a local image cache is available -1. A [Boundary binary](https://www.boundaryproject.io/downloads) in your `$PATH` -1. Optionally, an [installation of Boundary Desktop](https://learn.hashicorp.com/tutorials/boundary/getting-started-desktop-app) if you want to use the desktop examples +To get started with HCP Boundary, users need: -## What is Dev Mode? +- A [HashiCorp Cloud Platform](https://portal.cloud.hashicorp.com/sign-up) account +- A [Boundary binary](https://www.boundaryproject.io/downloads) in your `$PATH` +- Optionally, an [installation of Boundary Desktop](https://learn.hashicorp.com/tutorials/boundary/getting-started-desktop-app) -Dev mode is an all-in-one installation method for getting started with Boundary quickly. As the name implies, -dev mode is not a production installation method, but instead a way to get Boundary running with a Postgres -database easily. Do not use dev mode in a production environment, see [Production Installation](/docs/installing/high-availability) section for -production ready deployment methods. - -Dev mode brings up a fully functioning instance of Boundary, including: - -1. A controller server -2. A worker server -3. A Postgres database - -These components should all be considered ephemeral - no data persistence occurs across dev mode restarts. Along with these external components, dev mode also creates several resources within Boundary to make it easier and faster to connect to your first target: - -1. A org [scope](/docs/concepts/domain-model/scopes) and a project scope with a default ID of `o_1234567890` and `p_1234567890` respectively. -1. An [auth method](/docs/concepts/domain-model/auth-methods) with a random login name and password with a default auth method ID of `ampw_1234567890`. -1. A static [host catalog](/docs/concepts/domain-model/host-catalogs) with a default ID of `hcst_1234567890`. -1. A static [host](/docs/concepts/domain-model/hosts) and [host set](/docs/concepts/domain-model/host-sets) with default ID's of `hst_1234567890` and `hsst_1234567890` respectively. -1. A TCP [target](/docs/concepts/domain-model/targets) with a default ID of `ttcp_1234567890`. - -The default ID suffixes are overridable or can be randomly generated, and there are many other dev mode controls. To see a complete list of these override flags, consult `boundary dev -h`. - -If you plan on provisioning a large number of resources in dev mode, it's strongly recommended that users leverage our [Terraform Provider for Boundary](https://github.com/hashicorp/terraform-provider-boundary) for managing configuration of Boundary. This will simplify starting up and shutting down your Boundary dev instance. +If you prefer to Get Started on your local machine, refer to [Run and Login in Dev Mode](/docs/oss/installing/run-and-login). For more information on Boundary OSS and self-managed installations, refer to [Boundary OSS](/docs/oss/index). \ No newline at end of file diff --git a/website/content/docs/getting-started/installing/production.mdx b/website/content/docs/getting-started/installing/production.mdx index a663ae015..9b895b643 100644 --- a/website/content/docs/getting-started/installing/production.mdx +++ b/website/content/docs/getting-started/installing/production.mdx @@ -50,12 +50,6 @@ Example controller configuration: # Disable memory lock: https://www.man7.org/linux/man-pages/man2/mlock.2.html disable_mlock = true -telemetry { - # prometheus is not currently implemented - prometheus_retention_time = "24h" - disable_hostname = true -} - # Controller configuration block controller { # This name attr must be unique! diff --git a/website/content/docs/operations/index.mdx b/website/content/docs/operations/index.mdx deleted file mode 100644 index 679f71f01..000000000 --- a/website/content/docs/operations/index.mdx +++ /dev/null @@ -1,15 +0,0 @@ ---- -layout: docs -page_title: Operating Boundary -description: |- - Operational tasks in Boundary. ---- - -# Maintaining and Operating Boundary - -Visibility into various components of Boundary plays an important role in ensuring the health of its controllers and workers. While additional monitoring components are planned for subsequent Boundary releases, metrics for controllers and workers can now be exported and then collected by Prometheus. Metrics provide insight into the current state of a Boundary deployment by enabling the diagnosis of deployed controllers and workers. Enabling metrics assists in the detection and mitigation of anomalies in a deployment. - -These docs describe the available metrics and the naming and labeling standards used. Additionally, the health of controllers can be monitored using the `/health` endpoint. The health endpoint is enabled by defining a listener in Boundary's configuration file, and a health response may be configured to add a shutdown grace period process. - -* Refer to the [Metrics](/docs/operations/metrics) documentation to learn more about Boundary metrics. -* Refer to the [Health Endpoint](/docs/operations/health) documentation to learn more about Boundary health endpoints. diff --git a/website/content/docs/developing/building.mdx b/website/content/docs/oss/developing/building.mdx similarity index 100% rename from website/content/docs/developing/building.mdx rename to website/content/docs/oss/developing/building.mdx diff --git a/website/content/docs/developing/index.mdx b/website/content/docs/oss/developing/index.mdx similarity index 100% rename from website/content/docs/developing/index.mdx rename to website/content/docs/oss/developing/index.mdx diff --git a/website/content/docs/developing/ui.mdx b/website/content/docs/oss/developing/ui.mdx similarity index 100% rename from website/content/docs/developing/ui.mdx rename to website/content/docs/oss/developing/ui.mdx diff --git a/website/content/docs/oss/index.mdx b/website/content/docs/oss/index.mdx new file mode 100644 index 000000000..403c86615 --- /dev/null +++ b/website/content/docs/oss/index.mdx @@ -0,0 +1,27 @@ +--- +layout: docs +page_title: OSS Boundary +description: An introduction to OSS Boundary +--- + +# Boundary OSS + +Boundary provides secure remote access to critical systems with fine-grained +authorizations based on trusted identities. While HCP Boundary provides a +managed solution, Boundary OSS is a self-managed distribution that organizations +can deploy on-premise to manage access to infrastructure endpoints. The source +code for Boundary OSS is freely available on GitHub. The following sections +contain information on the use case for Boundary and how to install and +configure self-managed Boundary environments. + +Traditional approaches like SSH bastion hosts or VPNs require distributing and +managing credentials, configuring network controls like firewalls, and exposing +the private network. Boundary OSS provides secure access to hosts and critical +systems without having to manage credentials or expose your network, and is +entirely open source. + +Boundary OSS is designed to be straightforward to understand, highly scalable, +and resilient. It can run in clouds, on-premise, or within secure enclaves. +Boundary does not require an agent to be installed on the end host. + +![How Boundary Works](/img/how-boundary-works.png) diff --git a/website/content/docs/oss/installing/connect-to-dev-target.mdx b/website/content/docs/oss/installing/connect-to-dev-target.mdx new file mode 100644 index 000000000..c6fe921af --- /dev/null +++ b/website/content/docs/oss/installing/connect-to-dev-target.mdx @@ -0,0 +1,207 @@ +--- +layout: docs +page_title: Connect to Dev Mode Target +description: |- + Connecting to your first target +--- + +## Connect to Your First Target + +The default target is a `tcp` target with a default port of `22` (which +corresponds to the default SSH port using TCP). The host sets for this target +contain the default host, which has the address `127.0.0.1`. When `boundary +connect` is executed against this target, the single available host will be +selected and a local authenticated proxy to the host is established on the +target's default port (`127.0.0.1:22`). + +```shell-session +$ boundary connect -target-id ttcp_1234567890 +``` + +The output displays the address and port that your SSH client must utilize. In +the next section the `ssh` connect helper is used to make it easier to connect +to the target with a client. + +The `boundary connect` command has a number of notable options, such as +`-listen-port` to choose the port on which the connect command will listen for +an incoming connection. This is convenient for allowing Boundary to work with +applications that allow you to select the connection address but not the port. +For many applications, there are still some extra hurdles that can exist, which +is why connect helpers can be useful. + +The dev-mode default target allows you to make as many connections as you want +within the authorized session. When you are finished making connections, simply +`Ctrl-C/Command-C` the `boundary connect` process to shut down the session. + +### Using Connect Helpers + +Boundary includes connect helpers that automatically accept host SSH key prompts +for you. These are written as `boundary connect `. + +In the following example, the helper will automatically execute `ssh` for you, +filling in the local address and port. An expected host ID is set to avoid +warnings on future connections when a different port is allocated automatically. +A host key must still be accepted upon first connect. + +```shell-session +$ boundary connect ssh -target-id ttcp_1234567890 +``` + +If you want to pass additional flags to the SSH client, add them to the command +line separated by a double-dash; anything after the double dash will be passed +to the executed client. For instance: + +```shell-session +$ boundary connect ssh -target-id ttcp_1234567890 -- -l some-other-user +``` + +There is also a `-style` flag to allow the command to format arguments in a +different style expected by different SSH clients. Besides the default `ssh`, +the `boundary connect ssh` command supports `-style putty` to support passing +connection information to PuTTY. + +One advantage to styles is that Boundary will provide information to the client +in the format that makes sense. For example, the `-username` flag is used to +specify a username other than your currently logged-in user. This ensures that +regardless of your `-style` choice, the username is properly passed to the +executed client, and you don't need to figure out the syntax yourself. + +## Selecting Targets + +When using `boundary connect` you must identify the target used for connecting. +Convention in this documentation is to use the target ID because it refers to a +single explicit value, however other flags are supported: + +- `target-name`: The name of the target +- `target-scope-id`: The ID of the scope in which the target lives +- `target-scope-name`: The name of the scope in which the target lives + +Note however that these are not uniquely identifying, as names can be re-used +across scopes. As a result, when not using the target ID, you must use the +target's name in conjunction with the scope name or scope ID so that Boundary +can correctly identify the desired target. + +Here is an SSH example in dev mode: + +```shell-session +$ boundary connect ssh -target-name "Generated target" -target-scope-name "Generated project scope" +``` + +## Built-In vs. Exec + +Boundary comes with built-in wrappers for popular layer 7 connection protocols, +such as: + +- `ssh`: defaults to the local SSH client (`ssh`) +- `postgres`: defaults to the official Postgres CLI client (`psql`) +- `rdp`: defaults to the built-in Windows RDP client (`mstsc`) +- `http`: defaults to `curl` +- `kube`: defaults to `kubectl` + +However, `boundary connect` can accommodate executing clients even when there is +no built-in support for a specific client using `-exec`. The `-exec` flag is a +very powerful tool, allowing you to wrap Boundary TCP sessions in your preferred +client. You can use this flag to create an authenticated proxy to almost +anything. + +Whether using `-exec` or one of the listed helpers, you can pass flags to the +executed command by including them after a double-dash `--`: + +```shell-session +$ boundary connect ssh -target-id ttcp_1234567890 -- -l myuser -i ~/.ssh/identity +``` + +You also have access to some templated values that are substituted into the +command arguments, and these values are additionally injected as environment +variables in the executed command: + +- `{{boundary.ip}}` (`BOUNDARY_PROXIED_IP`): The IP address of the listening + socket that `boundary connect` has opened. +- `{{boundary.port}}` (`BOUNDARY_PROXIED_PORT`): The port of the listening + socket that `boundary connect` has opened. +- `{{boundary.addr}}` (`BOUNDARY_PROXIED_ADDR`): The host:port format of the + address. This is essentially equivalent to `{{boundary.ip}}:{{boundary.port}}`. + +For example, if you wanted to use Boundary to create an authenticated firewall +around 'curl', you could update the default TCP target from a default port +of `:22` to `:443`: + +```shell-session +$ boundary targets update tcp -default-port 443 -id ttcp_1234567890 + +Target information: + Created Time: Fri, 25 Sep 2020 18:35:47 PDT + Description: Provides an initial target in Boundary + ID: ttcp_1234567890 + Name: Generated target + Session Connection Limit: 1 + Session Max Seconds: 28800 + Type: tcp + Updated Time: Fri, 25 Sep 2020 18:36:18 PDT + Version: 2 + + Scope: + ID: p_1234567890 + Name: Generated project scope + Parent Scope ID: o_1234567890 + Type: project + + Host Sets: + Host Catalog ID: hcst_1234567890 + ID: hsst_1234567890 + + Attributes: + Default Port: 443 +``` + +In the output above the default port for the target has now changed to `:443`. + +Now, `curl` can be used as the executed client for the TCP target session to do +an authenticated download of hashicorp.com: + +```shell-session +$ boundary connect -exec curl -target-id ttcp_1234567890 \ + -- -vvsL --output /dev/null hashicorp.com + +* Trying 76.76.21.21... +* TCP_NODELAY set +* Connected to hashicorp.com (76.76.21.21) port 80 (#0) +> GET / HTTP/1.1 +> Host: hashicorp.com +> User-Agent: curl/7.64.1 +> Accept: */* +...... +``` + +Note that `-exec` is available for subcommands that wrap clients as well. As an +example, if `putty.exe` is available on a Windows host but the command is being +run from WSL, the following allows usage of the wrapper while specifying the +correct available binary (as WSL must use `.exe` when invoking Windows binaries): + +```shell-session +$ boundary connect ssh -style putty -exec putty.exe -target-id ttcp_1234567890 +``` + +## Connect using Desktop Client + +While using the desktop client, choose the target and connect to retrieve local +proxy details. + + + +## Next Steps + +See our [basic administration +workflows](https://learn.hashicorp.com/collections/boundary/oss-administration) +for in depth discussion on managing scopes, targets, identities, and sessions. \ No newline at end of file diff --git a/website/content/docs/oss/installing/dev-mode.mdx b/website/content/docs/oss/installing/dev-mode.mdx new file mode 100644 index 000000000..da5493acd --- /dev/null +++ b/website/content/docs/oss/installing/dev-mode.mdx @@ -0,0 +1,68 @@ +--- +layout: docs +page_title: What is Dev Mode? +description: Getting started with Boundary OSS in Dev mode +--- + +# What is Dev Mode? + +Before getting started with Boundary OSS, it's important to understand a few key +concepts. Please consult our [Boundary concepts](/docs/concepts) page to +familiarize yourself with Boundary's architecture and terminology. + +Dev mode is a method for getting started with Boundary quickly for testing and +learning purposes. As the name implies, dev mode is not a production +installation method, and provides a way to get Boundary running with a Postgres +database easily. Do not use dev mode in a production environment, see the +[Production Installation](/docs/oss/installing/high-availability) section for +production-ready deployment methods. + +Dev mode brings up a fully-functioning instance of Boundary, including: + +- A controller server +- A worker server +- A Postgres database + +These components should all be considered ephemeral - no data persistence occurs +across dev mode restarts. Along with these external components, dev mode also +creates several resources within Boundary to make it easier and faster to +connect to your first target: + +1. An org [scope](/docs/concepts/domain-model/scopes) and a project scope with a + default ID of `o_1234567890` and `p_1234567890` respectively. +1. A password [auth method](/docs/concepts/domain-model/auth-methods) with a + default auth method ID of `ampw_1234567890`. +1. An OIDC [auth method](/docs/concepts/domain-model/auth-methods) with a + default auth method ID of `amoidc_1234567890`. +1. An admin user with login name `admin` and password `password`. +1. An unprivileged user with login name `user` and password `password`. +1. A static [host catalog](/docs/concepts/domain-model/host-catalogs) with a + default ID of `hcst_1234567890`. +1. A static [host](/docs/concepts/domain-model/hosts) and [host + set](/docs/concepts/domain-model/host-sets) with default ID's of + `hst_1234567890` and `hsst_1234567890` respectively. +1. A TCP [target](/docs/concepts/domain-model/targets) with a default ID of + `ttcp_1234567890`. + +The default ID suffixes can be overwritten or randomly generated, and there are +many other dev mode controls. To see a complete list of these override flags, +consult `boundary dev -h`. + +If you plan on provisioning a large number of resources in dev mode, it's +strongly recommended that users leverage our [Terraform Provider for +Boundary](https://github.com/hashicorp/terraform-provider-boundary) for managing +configuration of Boundary. This will simplify starting up and shutting down your +Boundary dev instance. + +## Requirements + +There are a few requirements for running dev mode: + +- [Docker](https://docs.docker.com/get-docker/) is installed +- A route to download the [Postgres Docker + image](https://hub.docker.com/_/postgres) is available or a local image cache + is available +- A [Boundary binary](https://www.boundaryproject.io/downloads) in your `$PATH` +- _Optionally_, an [installation of Boundary + Desktop](https://learn.hashicorp.com/tutorials/boundary/oss-getting-started-desktop-app) + if you want to use the desktop examples \ No newline at end of file diff --git a/website/content/docs/installing/high-availability.mdx b/website/content/docs/oss/installing/high-availability.mdx similarity index 100% rename from website/content/docs/installing/high-availability.mdx rename to website/content/docs/oss/installing/high-availability.mdx diff --git a/website/content/docs/installing/index.mdx b/website/content/docs/oss/installing/index.mdx similarity index 80% rename from website/content/docs/installing/index.mdx rename to website/content/docs/oss/installing/index.mdx index 9474e701f..29b99a9fa 100644 --- a/website/content/docs/installing/index.mdx +++ b/website/content/docs/oss/installing/index.mdx @@ -9,4 +9,4 @@ description: |- This section covers installing Boundary for different modes of operation and across different environments -For community-supported reference architectures, please see [Reference Architectures](/docs/installing/reference-architectures). +For community-supported reference architectures, please see [Reference Architectures](/docs/oss/installing/reference-architectures). diff --git a/website/content/docs/installing/no-gen-resources.mdx b/website/content/docs/oss/installing/no-gen-resources.mdx similarity index 98% rename from website/content/docs/installing/no-gen-resources.mdx rename to website/content/docs/oss/installing/no-gen-resources.mdx index f92f0b1f7..ebb6253a4 100644 --- a/website/content/docs/installing/no-gen-resources.mdx +++ b/website/content/docs/oss/installing/no-gen-resources.mdx @@ -47,7 +47,7 @@ kms "aead" { ``` In this example, we're using hardcoded AEAD keys, but in a real world non-dev deployment, you -should use your cloud provider's KMS such as [AWS KMS](https://www.boundaryproject.io/docs/configuration/kms/awskms) to manage the keys Boundary +should use your cloud provider's KMS such as [AWS KMS](/docs/configuration/kms/awskms) to manage the keys Boundary uses to encrypt sensitive information. The KMS block we're focused on is the `recovery` block. This block specifies the key used to "recover" Boundary diff --git a/website/content/docs/installing/postgres.mdx b/website/content/docs/oss/installing/postgres.mdx similarity index 94% rename from website/content/docs/installing/postgres.mdx rename to website/content/docs/oss/installing/postgres.mdx index 212572318..c93d94b9c 100644 --- a/website/content/docs/installing/postgres.mdx +++ b/website/content/docs/oss/installing/postgres.mdx @@ -17,7 +17,7 @@ Boundary has only been tested on Postgres 11 or greater. Boundary controllers must be able to reach Postgres. In non-HA configurations, this means Boundary servers; -if you're running in [high availability](/docs/installing/high-availability), +if you're running in [high availability](/docs/oss/installing/high-availability), then the controllers need access to the Postgres server infrastructure. Worker nodes never need access to the database. diff --git a/website/content/docs/installing/reference-architectures.mdx b/website/content/docs/oss/installing/reference-architectures.mdx similarity index 100% rename from website/content/docs/installing/reference-architectures.mdx rename to website/content/docs/oss/installing/reference-architectures.mdx diff --git a/website/content/docs/getting-started/run-and-login.mdx b/website/content/docs/oss/installing/run-and-login.mdx similarity index 52% rename from website/content/docs/getting-started/run-and-login.mdx rename to website/content/docs/oss/installing/run-and-login.mdx index b22ebec6f..fc1a39801 100644 --- a/website/content/docs/getting-started/run-and-login.mdx +++ b/website/content/docs/oss/installing/run-and-login.mdx @@ -30,35 +30,19 @@ $ boundary authenticate password \ -auth-method-id=ampw_1234567890 ``` -If you are on Unix-like operating system (other than macOS/Darwin), you may get -an error indicating that the token could not be stored, as the freedesktop.org -Secret Service implementation is not always available. On these systems, you can -work around this by installing `dbus-x11` and `gnome-keyring` using your package -manager, then creating and unlocking the default keyring with the following, -substituting in a password of your choice for "foobar" (but ending with `\n`). -You can also avoid putting the password on the command line by running the -`gnome-keyring-daemon` commands directly and entering in the password, followed -by a newline (return) and an EOF (`Ctrl+D`). +If you are on Windows or macOS, the system password store will be used to store +the new token. On any other operating system, you may get an error indicating +that the token could not be stored. Boundary defaults to using +[pass](https://www.passwordstore.org/) on these machines, which uses [GNU +Privacy Guard](https://gnupg.org/) to encrypt values. If it is not available, +the token will be displayed and can be stored in a system of your choice and +passed in via the `BOUNDARY_TOKEN` environment variable. -- `eval "$(printf 'foobar\n' | gnome-keyring-daemon --unlock)"` -- `eval "$(printf 'foobar\n' | gnome-keyring-daemon --start)"` - -This would have to be run in each shell. - -If you're unable to install these packages, or don't want to, you can tell the -Boundary authenticate command to not save the token to the operating system's -key manager by setting `-token-name=none` flag or `BOUNDARY_TOKEN_NAME=none` env -variable when running `boundary authenticate`. You'll be responsible for setting -the token in subsequent commands via `-token` flag or `BOUNDARY_TOKEN` env -variable. An easy way to do this would be to use the `-format=json` flag along -with `jq` to pull the token value out of the response and place it wherever you -wish, then create a command alias for `boundary` that sources that value into -the environment or the `-token` flag. - -~> Token storage on \*nix systems has been more problematic than we expected. -We're exploring alternatives. See the discussion on [this GitHub -issue](https://github.com/hashicorp/boundary/issues/697#issuecomment-709448942) -to track it and voice your thoughts. +It is recommended to make use of `pass` or another alternative (such as any +implementation of the freedesktop.org Secret Service feature). Installation and +configuration of `pass` or other alternatives is beyond the scope of this +article; consult the documentation for `pass` or your specific OS distribution +help pages. @@ -127,5 +111,6 @@ the Boundary server does not use TLS in development mode. ## Next Steps -See [connecting to your first target](/docs/getting-started/connect-to-target) for how -to use Boundary to run your first SSH session. +See [connecting to your first +target](/docs/oss/installing/connect-to-dev-target) for how to use Boundary to +run your first SSH session. diff --git a/website/content/docs/installing/systemd.mdx b/website/content/docs/oss/installing/systemd.mdx similarity index 100% rename from website/content/docs/installing/systemd.mdx rename to website/content/docs/oss/installing/systemd.mdx diff --git a/website/content/docs/operations/health.mdx b/website/content/docs/oss/operations/health.mdx similarity index 100% rename from website/content/docs/operations/health.mdx rename to website/content/docs/oss/operations/health.mdx diff --git a/website/content/docs/oss/operations/index.mdx b/website/content/docs/oss/operations/index.mdx new file mode 100644 index 000000000..f87b575b3 --- /dev/null +++ b/website/content/docs/oss/operations/index.mdx @@ -0,0 +1,27 @@ +--- +layout: docs +page_title: Operating Boundary +description: |- + Operational tasks in Boundary. +--- + +# Maintaining and Operating Boundary + +Visibility into various components of Boundary plays an important role in +ensuring the health of its controllers and workers. While additional monitoring +components are planned for subsequent Boundary releases, metrics for controllers +and workers can now be exported and then collected by Prometheus. Metrics +provide insight into the current state of a Boundary deployment by enabling the +diagnosis of deployed controllers and workers. Enabling metrics assists in the +detection and mitigation of anomalies in a deployment. + +These docs describe the available metrics and the naming and labeling standards +used. Additionally, the health of controllers can be monitored using the +`/health` endpoint. The health endpoint is enabled by defining a listener in +Boundary's configuration file, and a health response may be configured to add a +shutdown grace period process. + +* Refer to the [Metrics](/docs/oss/operations/metrics) documentation to learn + more about Boundary metrics. +* Refer to the [Health Endpoint](/docs/oss/operations/health) documentation to + learn more about Boundary health endpoints. diff --git a/website/content/docs/operations/metrics.mdx b/website/content/docs/oss/operations/metrics.mdx similarity index 100% rename from website/content/docs/operations/metrics.mdx rename to website/content/docs/oss/operations/metrics.mdx diff --git a/website/content/docs/release-notes/v0_5_0.mdx b/website/content/docs/release-notes/v0_5_0.mdx index f4dc1bceb..d5d5079d0 100644 --- a/website/content/docs/release-notes/v0_5_0.mdx +++ b/website/content/docs/release-notes/v0_5_0.mdx @@ -19,7 +19,7 @@ Lastly, for instructions on how to upgrade an existing Boundary deployment to v0 When enabled, event logs are the only type of logging Boundary performs, meaning standard system information and debug logs will no longer appear in stdout. The new structured event logs are filterable by event type and other expressions that users define. Legacy HCLog output is still supported through a user-configurable setting. -For more about event logging usage, see our [documentation](https://www.boundaryproject.io/docs/configuration/events/overview). +For more about event logging usage, see our [documentation](/docs/configuration/events/overview). **Credential CRUD operations for Administrative Console:** The 0.5.0 release enables administration to configure Vault credential libraries and Vault credential set resources through the administrative console. Vault credential resources allows users to create Boundary sessions with credentials brokered by a Vault deployment. diff --git a/website/content/docs/release-notes/v0_8_0.mdx b/website/content/docs/release-notes/v0_8_0.mdx index 697d3f475..1090bd86a 100644 --- a/website/content/docs/release-notes/v0_8_0.mdx +++ b/website/content/docs/release-notes/v0_8_0.mdx @@ -16,12 +16,12 @@ Lastly, for instructions on how to upgrade an existing Boundary deployment to v0 ## Boundary v0.8.0 Highlights **Metrics and Health Endpoint:** Boundary is adding [Prometheus metrics](https://www.boundaryproject.io/docs/operations/metrics) to monitor the operations of workers and controllers, -as well as a [health endpoint](https://www.boundaryproject.io/docs/operations/health) for controllers. +as well as a [health endpoint](/docs/oss/operations/health) for controllers. -**Audit Event Logs:** We are expanding the audit event logs by increasing the captured [audit events](https://www.boundaryproject.io/docs/configuration/events/overview), +**Audit Event Logs:** We are expanding the audit event logs by increasing the captured [audit events](/docs/configuration/events/overview), with support for sanitizing sensitive information from audit events. All of the events are now classified and events contain more usable data, with sensitive information redacted by default. -**UI Support for Worker Tags:** Users can now set and edit [worker tag](https://www.boundaryproject.io/docs/concepts/filtering/worker-tags) filters in the Boundary admin console. +**UI Support for Worker Tags:** Users can now set and edit [worker tag](/docs/concepts/filtering/worker-tags) filters in the Boundary admin console. **Performance Improvements:** We have implemented changes to improve performance on larger deployments; such as adding a refresh button in the admin console and desktop client, and improving response times listing sessions and targets. We plan to continue these efforts as Boundary users grow their deployments! diff --git a/website/content/docs/release-notes/v0_9_0.mdx b/website/content/docs/release-notes/v0_9_0.mdx new file mode 100644 index 000000000..1c3d0f870 --- /dev/null +++ b/website/content/docs/release-notes/v0_9_0.mdx @@ -0,0 +1,42 @@ +--- +layout: docs +page_title: v0.9.0 +description: |- + Boundary release notes for v0.9.0 +--- + +# [Boundary v0.9.0](https://www.boundaryproject.io/downloads) + +The release notes below contain information about new functionality available in the Boundary v0.9.0 release. +To see a granular record of when each item was merged into the Boundary project, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md). +To learn about what Boundary consists of, we highly recommend you start at the [Getting Started Page](/docs/getting-started). + +Lastly, for instructions on how to upgrade an existing Boundary deployment to v0.9.0, please review Boundary's [general upgrade guide](https://learn.hashicorp.com/tutorials/boundary/upgrade-version). + +## Boundary v0.9.0 Highlights + +**HCP Boundary Public Beta:** Boundary is coming to the HashiCorp Cloud Platform! HCP Boundary provides an easy way to securely access +critical systems with fine-grained authorizations based on trusted identities. Boundary on HashiCorp Cloud Platform provides a fully managed, +single workflow to securely connect to hosts and critical systems across Kubernetes clusters, cloud service catalogs, and on-premises infrastructure. +You can now [try HCP Boundary](https://learn.hashicorp.com/collections/boundary/hcp-getting-started) for free during our [Public Beta](https://cloud.hashicorp.com/products/boundary). + +**Self-Managed Workers:** With HCP Boundary, administrators have the option of setting up private, self-managed workers for infrastructure access. This provides the +security of having privately managed workers while providing the low overhead of a managed service. Learn more about setting up self-managed workers +[here](https://learn.hashicorp.com/tutorials/boundary/hcp-manage-workers). + +**Worker Registration Enhancements:** Administrators now have a second method of authenticating workers, and we call these PKI Workers (the original +authentication method is now called KMS Workers). PKI Workers authenticate to Boundary using a new certificate-based method, allowing for worker deployment +without using a shared KMS. + +**Static Credential Store:** In Boundary 0.9.0, we are introducing the static credential store, a basic +[credential store](https://www.boundaryproject.io/docs/concepts/domain-model/credential-stores) that is native to Boundary. These credentials +are encrypted and stored directly in Boundary. For users interested in integrated secrets management to Boundary targets, the new basic +credential store removes the dependency on HashiCorp Vault. Currently, the static credential store only supports username/password type credentials. Note: If you +wish to use the Desktop Client for credential brokering, version 1.4.4 and up is required. + +**Admin UI Quickstart:** Users can now access a quickstart tool on the Admin UI which sets up a target along with a host, project, and organization. + +## What's Changed + +For more detailed information of all changes since 0.8.0, please refer to the [Changelog](https://github.com/hashicorp/boundary/blob/main/CHANGELOG.md) + diff --git a/website/content/docs/what-is-boundary.mdx b/website/content/docs/what-is-boundary.mdx index c587b18bd..3d28c1c71 100644 --- a/website/content/docs/what-is-boundary.mdx +++ b/website/content/docs/what-is-boundary.mdx @@ -31,7 +31,10 @@ Boundary is an intelligent proxy that creates granular, identity-based access co With the many varying infrastructure services and tooling used in increasingly dynamic environments, organizations must have secure access to all targets within and beyond their perimeter. -Boundary provides a simple way for verified users to have secure access to cloud and self-managed infrastructures without exposing your network or the use of managing credentials. Boundary is an open source workflow that enables just-in-time, role-based access for dynamic infrastructure. +Boundary provides a simple way for verified users to have secure access to cloud +and self-managed infrastructures without exposing your network or the use of +managing credentials. Boundary is a workflow that enables just-in-time, +role-based access for dynamic infrastructure. ## Boundary Use-Cases diff --git a/website/data/docs-nav-data.json b/website/data/docs-nav-data.json index 4f601a9b8..8990412c2 100644 --- a/website/data/docs-nav-data.json +++ b/website/data/docs-nav-data.json @@ -25,8 +25,8 @@ ] }, { - "title": "Run and Login", - "path": "getting-started/run-and-login" + "title": "Deploy and Login", + "path": "getting-started/deploy-and-login" }, { "title": "Connect to Target", @@ -35,61 +35,111 @@ ] }, { - "title": "Installing", + "title": "Configuration", "routes": [ { - "title": "Overview", - "path": "installing" + "title": "Overview/Top-Level Parameters", + "path": "configuration" }, { - "title": "Non-Dev Environments", - "path": "installing/no-gen-resources" + "title": "worker", + "routes": [ + { + "title": "Overview", + "path": "configuration/worker/overview" + }, + { + "title": "KMS Workers", + "path": "configuration/worker/kms-worker" + }, + { + "title": "PKI Workers", + "path": "configuration/worker/pki-worker" + } + ] }, { - "title": "Systemd Install", - "path": "installing/systemd" + "title": "listener", + "routes": [ + { + "title": "Overview", + "path": "configuration/listener" + }, + { + "title": "TCP", + "path": "configuration/listener/tcp" + }, + { + "title": "Unix", + "path": "configuration/listener/unix" + } + ] }, { - "title": "Postgres Install", - "path": "installing/postgres" + "title": "KMS", + "routes": [ + { + "title": "Overview", + "path": "configuration/kms" + }, + { + "title": "AEAD", + "path": "configuration/kms/aead" + }, + { + "title": "AWS KMS", + "path": "configuration/kms/awskms" + }, + { + "title": "AliCloud KMS", + "path": "configuration/kms/alicloudkms" + }, + { + "title": "Azure Key Vault", + "path": "configuration/kms/azurekeyvault" + }, + { + "title": "GCP Cloud KMS", + "path": "configuration/kms/gcpckms" + }, + { + "title": "OCI KMS", + "path": "configuration/kms/ocikms" + }, + { + "title": "Vault Transit", + "path": "configuration/kms/transit" + } + ] }, { - "title": "High Availability Install", - "path": "installing/high-availability" + "title": "controller", + "path": "configuration/controller" }, { - "title": "Reference Architectures", - "path": "installing/reference-architectures" - } - ] - }, - { - "title": "API/Clients", - "routes": [ - { - "title": "Overview", - "path": "api-clients" + "title": "events", + "routes": [ + { + "title": "Overview", + "path": "configuration/events/overview" + }, + { + "title": "Common Sink Parameters", + "path": "configuration/events/common" + }, + { + "title": "File Sink", + "path": "configuration/events/file" + }, + { + "title": "Stderr Sink", + "path": "configuration/events/stderr" + } + ] }, { - "title": "API", - "path": "api-clients/api" - }, - { - "title": "CLI", - "path": "api-clients/cli" - }, - { - "title": "Go SDK", - "path": "api-clients/go-sdk" - }, - { - "title": "Desktop", - "hidden": true, - "path": "api-clients/desktop" - }, - { - "title": "Desktop", - "href": "https://learn.hashicorp.com/tutorials/boundary/getting-started-desktop-app" + "title": "plugins", + "path": "configuration/plugins" } ] }, @@ -242,139 +292,6 @@ } ] }, - { - "title": "Developing Boundary", - "routes": [ - { - "title": "Overview", - "path": "developing" - }, - { - "title": "Building", - "path": "developing/building" - }, - { - "title": "Developing the UI", - "path": "developing/ui" - } - ] - }, - { - "divider": true - }, - { - "title": "Configuration", - "routes": [ - { - "title": "Overview", - "path": "configuration" - }, - { - "title": "listener", - "routes": [ - { - "title": "Overview", - "path": "configuration/listener" - }, - { - "title": "TCP", - "path": "configuration/listener/tcp" - }, - { - "title": "Unix", - "path": "configuration/listener/unix" - } - ] - }, - { - "title": "KMS", - "routes": [ - { - "title": "Overview", - "path": "configuration/kms" - }, - { - "title": "AEAD", - "path": "configuration/kms/aead" - }, - { - "title": "AWS KMS", - "path": "configuration/kms/awskms" - }, - { - "title": "AliCloud KMS", - "path": "configuration/kms/alicloudkms" - }, - { - "title": "Azure Key Vault", - "path": "configuration/kms/azurekeyvault" - }, - { - "title": "GCP Cloud KMS", - "path": "configuration/kms/gcpckms" - }, - { - "title": "OCI KMS", - "path": "configuration/kms/ocikms" - }, - { - "title": "Vault Transit", - "path": "configuration/kms/transit" - } - ] - }, - { - "title": "controller", - "path": "configuration/controller" - }, - { - "title": "worker", - "path": "configuration/worker" - }, - { - "title": "events", - "routes": [ - { - "title": "Overview", - "path": "configuration/events/overview" - }, - { - "title": "Common Sink Parameters", - "path": "configuration/events/common" - }, - { - "title": "File Sink", - "path": "configuration/events/file" - }, - { - "title": "Stderr Sink", - "path": "configuration/events/stderr" - } - ] - }, - { - "title": "plugins", - "path": "configuration/plugins" - } - ] - }, - { - "title": "Operations", - "routes": [ - { - "title": "Overview", - "path": "operations" - }, - { - "title": "Metrics", - "path": "operations/metrics" - }, - { - "title": "Health Endpoint", - "path": "operations/health" - } - ] - }, { "title": "Common Workflows", "href": "https://learn.hashicorp.com/collections/boundary/basic-administration" @@ -413,12 +330,130 @@ } ] }, + { + "title": "API/Clients", + "routes": [ + { + "title": "Overview", + "path": "api-clients" + }, + { + "title": "API", + "path": "api-clients/api" + }, + { + "title": "CLI", + "path": "api-clients/cli" + }, + { + "title": "Go SDK", + "path": "api-clients/go-sdk" + }, + { + "title": "Desktop", + "hidden": true, + "path": "api-clients/desktop" + }, + { + "title": "Desktop", + "href": "https://learn.hashicorp.com/tutorials/boundary/getting-started-desktop-app" + } + ] + }, + { + "divider": true + }, + { + "title": "Boundary OSS", + "routes": [ + { + "title": "Overview", + "path": "oss" + }, + { + "title": "Installation", + "routes": [ + { + "title": "Overview", + "path": "oss/installing" + }, + { + "title": "Dev Mode", + "path": "oss/installing/dev-mode" + }, + { + "title": "Run and Login", + "path": "oss/installing/run-and-login" + }, + { + "title": "Connect to Dev Target", + "path": "oss/installing/connect-to-dev-target" + }, + { + "title": "Non-Dev Environments", + "path": "oss/installing/no-gen-resources" + }, + { + "title": "Systemd Install", + "path": "oss/installing/systemd" + }, + { + "title": "Postgres Install", + "path": "oss/installing/postgres" + }, + { + "title": "High Availability Install", + "path": "oss/installing/high-availability" + }, + { + "title": "Reference Architectures", + "path": "oss/installing/reference-architectures" + } + ] + }, + { + "title": "Operations", + "routes": [ + { + "title": "Overview", + "path": "oss/operations" + }, + { + "title": "Metrics", + "path": "oss/operations/metrics" + }, + { + "title": "Health Endpoint", + "path": "oss/operations/health" + } + ] + }, + { + "title": "Developing Boundary", + "routes": [ + { + "title": "Overview", + "path": "oss/developing" + }, + { + "title": "Building", + "path": "oss/developing/building" + }, + { + "title": "Developing the UI", + "path": "oss/developing/ui" + } + ] + } + ] + }, { "divider": true }, { "title": "Roadmap", - "path": "roadmap" + "path": "roadmap", + "hidden": true }, { "title": "Release Notes", @@ -427,6 +462,10 @@ "title": "Overview", "path": "release-notes" }, + { + "title": "v0.9.0", + "path": "release-notes/v0_9_0" + }, { "title": "v0.8.0", "path": "release-notes/v0_8_0" diff --git a/website/public/img/hcp-deploy-form.png b/website/public/img/hcp-deploy-form.png new file mode 100644 index 0000000000000000000000000000000000000000..30ae68416faaafd4148f8e0d8fec86b5054b8561 GIT binary patch literal 144470 zcmXtgdmvN)|9>I(T;`rzE+Y&{?xINUBsCMVnM-AEc^l=HTkZVY@MOCKXudz@|3!>z7STNw3LK>>c3a&OD!pL}O3XdwyWuwYa6 zh1*!n?Jl>jV16!_&qN1~4MhK*{k=BzeXQ0vV!3N#>Q4u{{OX^^8cI&Slkts-+l=yw zD{7n>2|iCG+l<+*;O-j+;QukdU{U3mE! ztV!gW=hC~H?}=xYUp+szg`eLK{=FI!k1x$Uv$x)ZCtQmdyW(chK$a_he&6g3QvQp_ zJPTTb%(kp=(ZCw=K`5ud*tT&>NZilTSur=y+ywocy6D*z{W^p;p4l+&EQO6rAw|Hu zewKgtePWN_=B?N$P%}X@zvdWyDfag;y`kNud!&%M-m(apY)dxTq9IHFgcf<;vOUHZ z*|FkPKiTnX#6AEq*>SL0KhNY84|(*g!=SDEsBsvP5fZZ`{cYn(NJvzVG@5=%*iFLg zKNo3NscD~2ZA&?UWto93n{Jf^I$y}toeh!%bvYnr(Q$rR^{rn<8(gB$%kZtAU9Uea z<>Q>u#>=izk+5>oF?(#3Zs9_s4&8Gg0LBIPT6BN%(+&|#LO}^;{vFyK9@>K z&EcPAFya5f%NY##q^=g-^uBh4FK--sO~@CYu-aK{8)Zt&8Hu6NA^IQdj4LHi0N+hg zd4epMDZ})F9Z0Z~2>vG*=(AQYIY^{v=zj|yaIfMwk|{$f#;B`oCf2aTd?umc8=Glh z5mjr>tCvf^6yAM-c-TaBF|=FTC_jo|hy9{#i_H_W%}YKVy(p-(<1c?fu}thGTg_}t z!QG!{T$}Q}_BjTEp)g)d+=u~ldC6h89u&`W10GhchUG{lfHc1NY>MEcmHu1zkmhoW2P<+Z~OZp>`9$R!RP5shOJw~UZDIe-tJkYM? zDhO1D3o1h;kr~1ms-k@*cEEd^;2#S$$5@@&kSf7>^og>Q&gx*xB~Ks%Og7QY&A|HA z3A1addllQUd0xa5236#-AbFTX3#bAG5(1tRhOUWn>1(~39J-dJWDg>Q92qC3IwUlo z2+d1_6gt|9{8>~s3&(+uqrsk&y@g)sa*)T$cP4wq`*LYSiX#gABhM;KA(u)nEIw6A zy6Q>rM`~bw_{gY-C{#DrgzS&Z^lF5MlIx^SyJLK1ps2;`6lSTzjPZq86c&6yd$*OU z-+lABez*TFJ9?%l`lGxs7uFqrk{&WskfI`ki<2Up6yK)_!x)tqFIbylRfeX0WpBGFHq2=VF3TMpbHAnwzEi$wG+;05#t$qS;VJPfk4dVXGt>mA1@MoO4=%P{jKHZ$g*`11 z6JQIJg{?U7U^2b7lsP7S^Xv0+b@WTyj*OFHl}}CfYGSo0?4^z~%EGxZ?Zxw@pX^H! zVDCZ)gaqXohkohBb))lYF#1LDfy(nmg4o`t?XWO5lgP>o-1c<4TaUBt&FS3ph zxJuKX{{ItcnVSGY3y`kW>WcwuS9x+Fagy|g1F_bcKJm$8knjdRSIQT`LzFD-prLaG z16LKjFX?h=C?uvRpna{>I?1b`grST}2}fNrW-(Y%7|#XTkjf57#J2v0jgR8D@_baF zb|;$#&)`Fw7K9kO*~k?>`MH&itHRb3!NZY|q6G27g|06r4EXHu*wY9``184_5x#oD zYfCTe@XUu>juEbt#Ih`C1^-Xhj#ZoybU{l_lw^Y-fkV z%mQ`?V7?Qy)8dFm#&O0?7&;vtj-|9CCfWl8#*MVGl-uFhDJg~{EM~|kgkJL9uq25z zESb5&G;(wJs){DjJuz{-nDB`4x;D(Ef13&I|0KD5b!K;L>o2U3`PZ{D?glkA<&m6)9(atw3S6E zyMd0RUl-Tte~@;y$L?)of5D3!_(`(ANCDwT`57Ne{g%+);IvCvcNbo?X{KfLW>_Vm z)Rhg9Se zKL4ImK9t85$5puMz=L1U=tbsWm8(;(2$m(Qm6{T4Ti`o?F#s&{RT~Yy?SA->bDq7e z3O+m;OtYaQ7|I*;#OuQ8hKmZ)MR_-#r5N{)&IFKp!~NMxv+cKLe8kYRJ_WLZG51JP z(Gu697T=^-w?$5i@n4fQ=@US0bDOlrG8w$U7$en?N-*vl?EW$FjNsnDIB`HE8{HIu zI&l4~Nqj9EDq6tt^n;U{4u&2}lfam*4EwkM+#|zR$bSTdrp5md+vs)Y&6GQ^%}R-9 zJzu;rMCTea*xcAYJ)1GcPKJyiloiKMf^yqoom_?c4(XrzQ#vxk(2e~*aIg}>pmc!~ zYC))b5#-cxVzDOz4%T_3xO11(OsoUDvhmde#cJI)RC8HD-Ms;(5B`E>+SN7o=eLmg z1!+dQSGW0Ux_ZeoQku!!I<>V}_lix;1Z#&z`>6DdCuZMoxN&Pt9!v-%ikXe|RiOZm zb%uG9ORibNl}19+QpV~W62R)jhMMn84COGl1B3!iNQhArSmB&t5cI3X`02d?0 z2uU(JA|8Te`Y%!19sUrF1u5MiD4T{B15Pr+NQSSG-FkN~dv|l_Q+mR&+Zj}Wr4yMX z7x)Hn9vPI&rOW%kkvqZJqQnknqWZ4Y>;Gj8aRCIYH<>Z%DSR=BR{Cn`Ax`WoiIH04 zR*jzsDQJB)1xl6(Uw^j@#@8lK$kuj?t-=e|e-7R#v3(Nc96_*I7|m6S$@Z|^eq+!Y znS285PRY2$v}>|_SfaaouImR--f2e9&MR-zd7wXv)qI4uh&DS}3C|Wm-V_*b*TqusK%r7-%lY{rt|VG6F{OL6 z47l`>w+_d$E|_;OOEZ`NChm*E_8*FUCguN>==@u(%mjdgIu(@ko^LjEJN3Aerfa&p`ZNUHpEO6*Nui=hvx^GU9a(|YKVm( zCi-Fs8)egzw3MUx@E9^KF40dyf2A=lF}rQFZ<3a%Bc}-LlO5g~fmo!euSnb;=s#fN z^-UI|DMHeQ;gsUc2+FNFJ_K00h?0xM&`Og0K0X`lHjc~k6LFjTdHOLVETZQc%GMx(u3v z$*?&+nun((37PbgWN=ATEHlHJhVuL|8FV=>-g5|-sYHUk6Gi4| z9vlk~?^Q-RNn2iD2++@IcI=XjW-b>oX+3I?$GwM9Xl8eY}y#Sq#YymGPhE z3uJPP(}r6g`CyJUV#%*{Ot|<0ToxdcI`>s!X4h9_Fb6!CgGWhX5~w9dPi%SijSWc{ zG8o`aKT5qSyu-2NOK{R>8I+2^a`C^jmXT0r^7hYhv!T?lP>rf`^wschW#N?elE9GI z6%Twk^-QbBN=J>X=U-;^MADGJZzHOFU8~be2H#eAzMW8Rr^vPfgGp>^<$1vZa5+aY zn=<&loXj5t|2%HPbW8ZoP_VcLqB~caLtG&4HCDrg7vt-r1*L;*rE_!@W$<|gLPZPD zzgNaUyLz2+nYNc1aBw3MBEPMBg_cc?M+0?CD%Z-JaFt7(fpra&Ld#0P!tzM>)~)!t z&q0#>Lf#vceT%2R<54a9(2}ksw@{YOE+dqbX1uHr>MMUBgJvJlI(I_kH*1I~*Rn&< zQcz#g#dHR^nSXUd>*^$H?;l#(J1)+EZ<^O3vJVGQru4}0a_8*Z7ME4fJIt~~Z5X4( z2qqa;CD2JX)_8j(0KS95+xHSCW(+ZitC% z@QoRFzVdI;PH_I3X;v{4ax&llMcMe@y@th- z4}@T%={8%6lN+I0STHg)Tq_UZ<;ztlB+PJ)2)V4RtF`9!>E|RV_QDGnRS3=}Ye=~U z3sT@o?>!F^^GW<&$%{$8V!@%2{$Baba!T&qYW5313LOpEYi1LMRLZ9MgOx-6%A$k< z3@5aqgtROTi^X^&EKwy5vd7b_l+AQljg zRmhRlAakP7sC$N>r8@%RoD({Aq^oGpC7T$+J?yD}L}WhgKGW!2R}PM4m?`G0fWg*O z#02~DV$8PM6~q}ni%o6_-9UpS57~bw`K(T81ZPVYHvFpg2h;6t!8IqN&ktV~xe}dZ z+UCMG;%fhuL)uOLUaN4=ulVZ}6`lm3E(S}i6t=+vOk9a|=M}Jd-Kd1dS6sn4SPs?p zgwOT8CrY<()+9S5_Nt)tH;!UnTish=Wg5G{G!~MklpLn@YpeiBpPPH_FfC6 z-vS@(yqNkajKbvWY^bTHDWQCknP(auG0h_S8juYssQ1RCLqWT(a%YcO#aQlV2hW?W zTaB5GDEbhiSWQX4IXc*UDa(t7p&BZ2-Z1bc*^CFQCTDk+BLbPYZ-^;(+2 z$+FL!21le?ub=7muN7?G%#odNn+9|#@OeE>Weu&FTCj%JTqE%u9DEhnP$>x!!dk<* z7~g#2Hm6ZuqtX0vuJM$3TEt?7S}xq`mcBuEMsJQLT_C11*^8%y&A=MwQ-pmXXK4HR zY6UWIhb{2lVF=z|($}h*K$n4n%1JkCK6#Z9?B*K7szZK5F$=o6zz08jCV-jrM}$+K zbxk;ASM|`e0hPJrqgy^QLQvX}C{kS9E!^s)*-GiU`@COzu)lIiYt3_tOm3TrGw0YiL z%d%%vb{J>c6@P()?*QcO7e?2LO}Nz+Yw#P*3riP);G=bshq{>lR@F8co38Lp*Gdkk z`OaQx=|%fbN>A^NeR0UmT6+IX=rDYO#ec2F%&=vL3K$_iMWKg7N*$lss#MBSRo+_s zf=7-qu!}IO{TRN&cJFgd96h>nVWRz?4Px{^N<;FGsrgHc;k&2Sqp9)ThlBR0W}o}HMh`rftOt)U zGnbq_0`5^dUwOz@{b~(&r&a$?oplrL@*yPF^Mo@qKNYi?e>TUEND-cJF0}e&a=s@g zbcAPx7{@y>Pq5=1YzlP|G%5JiZCBZRMUj1=?z}&*#tnB;$&U)#88&-bZkzBSHj{$0 z-8bu#d7NVe4l1!zO&MdsyQ4T49!T(ZU;?RobXAx2AiEj6J@<-WchCpp(ZI8!UfbMb z&sT^vUDRB>X=jrVC`HlE(E zB-@6P-1a%7mtt?0afo-Z)RMh7^!1$BYP?C}lwUOf4;t&E^kC^qnPNo%*NESES^=1g zj<6$InGt)E1Kxb{um3+)M47Rd8Y3A^DIXffgWPHy=f8Hp3yi&<6~GjV*t<0@wVzZp zhV***Kie+lFi#?%e}78mUiFmZSw=MQLYwacCfuv>b3Q&F}7v@>J>C9tzIa};>9}^!j$Qk zpd5nm+YO_r0T#sUm)-%l5ldsh2(!%(Nl==;rsD|HsRYOkCVXDfe&O9#1h)oDy*C%4 zPl?5b9o&-Z7o{1-8_DI&GL5*$pUKHkjpEZaVL=lBUG!1M`eaZie-^dzSCGJ6jsI6N zMcE}^Ntyhl!$1Bli_i~7&n0{yD+SGFkO>f)t-cNvm6(0?uSn@8-u?8R)Og<3=L^xK zl+a^yY4q?)V!YNk$%G%ZHT?staf2JBFPz;ANd_z0>kA*noF5HHPCi+h#wk95W!?<0 zv>~UNv_Wa*CApwY&O+=9LU;Y9ltl4HiI*+*&H}f6I2QDqVAt6QI{@*olNs&0&KAeJ zb#j%Yi>7XV;lZ=el%J8?n2wAV|J`?zX*b6Q&qShk?jzBS7D?fpcr5*|TFLO* z|Lm#9wIb6W5=NJ)9-0Ik2zHH@FYu*szYufjGF8M*#tM^J@31$f^A9VsqyQ6hko;?_ zlH0_eT6T)nT(dbdb-j=x**MO%e}U)(@9XRB{JV4jMIV!TaLC3?S#V=$`6{Ekc`D4Y zvmm=yiD@U-(4W_9NmRO#8)XyqMOhQ1+0TyQ&<4B$8;40jOaxE>@ss(Z{#I(M4;}1( zHMyQD7kdfcfglq7B6AKA>Xe=50Tyw}s*AW>MOdzK$mI}``;`y#HPDDkjv}-K!R%Ek zcN}KAi-;=S%F;!TT8zGw(1ull8nfE_o9+h%@dY<&4;;mGCV%egOdh(WbdOEr9w73A z;UulD#--VI$I@(e4R z$6))f|6aiMlXU@6N6Pr7Q+TM5lrf+VEJEnIPAJ|aCM0rt+GB0B>^Ez(KJLc!0dul~ zY4-D*^V;tV1z6qtbfqt{o$)yoUgO=qJ7ZV>Nt$tg!jUGvcpjm}vla_PV2vfB!x7&t?y^M`&xZdi1%$27?KO4uq379A$m&bc<_K8B}8xkhg zA9>NLX^ABJCIgOV*ZUq){g=Orw8FlrdUj8>YG)WX+bUu-!vi?G?dF>Ad%Ndayj?MW zmY~CFB4#ptEsQHLCKD*_G%4f`f6e^tvqBQ_t9f82Wzo(gTdWf(>T5)Xkfo)~*xcZb z(6z3ND={n5I76{UgaH8X08aSfdW9JlFyz^o!EW+xNoWkLA;pnTp4RkA)iqQGCPVG^ zU#|ZLGl4p13AaBXomVk#1JC2Wj*{wJOR+!iO}zcjmE-XhbNZ&={?0TbA-s`f6r5_X zyD9h5eBNkjb*j11Jo5WZ#`ou}z*NgxnTv>kGv^o&Nj>+e#ckk~v*>$#dE%yQuQV-B z^1S#Q_w@50yU?Qw1{}ru{7(&JrmwXwjV*Q1%w@(>eRof8-G&&(p6nY5X?i026Vy`b zocV^lTap6ZgokALAzM3U(OcNoCMgMS%a!A$vN8PHbuBH?Jq@o+m`7KvN_WqFn=cSa zAGo(UQA#45>%9wT*zd%tBb}rpt+B4QG)WDdBvLp1GA;W>vKO19N^Ty9q0`fVns0r@7+2_+7z!7M0iGv(rcSp7p1osetO|YUw%K8V%W_U*y$bGeI$SB)Uuzm zG;KnQHb_g1JXh02y188@C6B}u4@*Q*eZ0;tNkdT?1rRrEvY45)h|lTF2rnHnNIZMM zApsEo1e}SU*7G$TaX{bB6MvqY_osjX+;#l~vyF4c6OFyz0YZ&oey1Qx4Z19#7x`DCb)P+qOBT!TeOfy6Nu`#WZV700 zPn_+--RAo?I$}lLDIA3-k~G37T3uD!iK>|ON8e+>xBOU=`n|$sxWE?I%KM1e9BcF2 zj7aXeAbXd3_&eyE`jtBFgFm=AwC7vr~y&r32d)0x)Da_#&n9; zFr7$#+sZ9$E1m{i(u^B{xIqTW;iuRHHl{p@R39!5$=NPzmR_xk0A!3z41boDY^!H2 zc)Zta#n3GINmPigM_g3=W8-J$^RoVvN`mqXYV?Ote(H+>~hi#?h}EDgRoB<#=>X!byi=I-XMIusg`(U?+n=_tb$>rtO`7p zcE z57O~3QBpz2#w#hCnaJrk@m;@b>~yeRQlU>Z6@CWQC0qMwAadc(;1^g>H^DA#sdT{z z@UV~=oi{GIaKLBD`;TDv@D%Y99Bc==3QNyR_EYbtOW?6l4ao~S1y~L!=omc#y%cBn zFfl>~60bQmRFrk%NT#%5OHZBI+^esaZ?$i$ckiSUSv$Sf6Tp9k|qXLoCMAx*lm**0OsZhCz&xvX_;H(w&r_d*6tAR zO%YVt?@DqI?XOR)kpno%o#C<=TJf=;K$GLEYFWD1#^PR?8vRz5Uga0~rVgGCi}A%t z&HwYaXm9w7Z#Q~8nbcgSeQ$yIMWCIyjY12D?yOOYtr$1#xlIOSVqz|K&EA?a3pwqf zdh0`WJ9Zm1mS-QmD`!PM7ERpQ%(fZC%tE z|ESFRT{5`1{dp@fMGWT`5U(+g;2S2P@lRyNG(sbRGd{{uMe0nUjqFYJP>Ai=v1J1x z7HgM}pZ!_wZqSyGl&NpbdNk}l^S6Zhe$7+IW8)!$e}V+Hr|&GrOW$=d$L}{F`>@QJ zuqzW9ru${(mSHyf;>*rD5Bv!!t;y#Ur6oR3^8L7iQRYC~87|C74xr(SRlMXId0$(JqHp zSNPqzW!J)eIEEanq9cImRDcucX8BJz#SK`%*RE3i*e-ZOxY3y{Q+Ku4E_m~4ONv(% zY}1j)K1LsTp`z`GfOpLJHTs9PS0buf+#A*Ll`(v8dmnk9XAkQ$XwkJYU*@t%+U{SM z+9YCY1Ue~zO%hGA$a;#3Zq~*6NcFix;&_b7M=@Le6zwVgnhN+vjeH|)!kZ-rb@=vY zusz*t!jYm$5yAR|2|!~wpo2uG@=~H!JYwfi5s7#o7gdrZ=E_tDI>s#tz&ZgZew05s zs?pe$@vUpS?97yyA|?C}BmO3JTq@IKnU=++eqZ)hT~Vq*SYOMGTc<|9j2L6V%jAwr z6*a))*i_e=^PpzEtStINNU#)w0Y}~{#x;7plVZCm6j5k#-`!+s(&X6Wvm3)#&$Wz% z%71ykY%CC%z+=t)n)LC=ue$OMc|L^dvTLSsp>C?U#VD3~aFDij;1lheU;9$Fg(I#} zmnM@eyE_4jB(7cjK9VZtQa$PaN-uKQAHC`-j_%o_l)LH4d(IpcJzBiD!1CZng>Ytx z@Fa6wxg(3ef!U^fN~Aveu(*W zJ=jk1GHX0@Wr3(Q{aB4XaJVv?7e(`%ZbT_(7pg%@A9oNdeI*JVc~%}`Uud&w^vjuB zswSQJv-h*q%c4IUh@SWtZJ$aJGiTC^j|;cj`XxUQy3urBC^2A0IJJ^~DY|R#vv%u& zU(tz|v&llFKnpJE$2XGu91<2YVaT3UBn#~7skBa#)KQrn>V5sjtBrnbeo2PQy#g?4 zA#1u}a%j?3+8DzfZ?=n=yz=Y0AypKnugNQecSR~M-$S~cnKI_mfG#3P(#*?csa|2i zurM7i`_QB@Z=XQG;=WlgsjJ`Qjtbx%{vY1E#{V-5Jt_|ChC%GO^;(v08}}X)w1v{2 zzDEjkk+lP?&XlUH6+dl^&MngZ;XL9LFXtA6Zi-*~MH~CxxcnU*cCd?%e{BBneW5to z$#(BND`A)o~& zT_WRi{ly3B;wIZyPKLA)g5GtqnSs#s9rK}z&j*XK_olkU=E+I$s6@lVH(HB(_0Qc< zTRZt$E%wZ7-f0Dtrr6~&BlKeG(9`v*`4KWS_X~gG2%@95h9zZeazR49O_E>WE3hR* z*}d?^MQ3e6$|pcIZ67M^oRrzHc^o`sNs|KQSJ7e`whtco;qp9vxbO-i4&ZeJ5E%$Y zgRP~-7!qdozO*KrP-dy!IARhmp~ayH>tDE>;8#RDB#mAzRR?wAykNSQnHB0tNLLss zVBm7X(TW{ev@Y!6>H@cD0$6n6*7IlD6qE07U)qF!ES+oG3EU!Ic365e?_Y{tX*d7d zzTeIHJy|VKhO<3>DY9}K;_ERz3C8#uX1#GSh)6k^aIVhe6JFE6yI&`k6Ywd%{8AlINL>s6hGhK=;4xXcHbb2brcS+Xy{@N@kV6U?`ZXvM$2JvE3umfKK(seK(qDztN%*unBzpcc7E9n5&TqDJY>od1&@EuCf%sI9mvCcc%nJu zC_ZM`O!!r~WzN!KW~s$QH$Nx3;|W4NH9V-* zAv|Lk!sZ zRio#v+q!xLYO*P^i)BUMt+Cl>~H^YV+bci&Fs^$umq|b@MWJt(>rXa}Xc>o*(zpU}oNcCJ!d;?hna%r`g$8 zY}+kN%5LvxZk4>m8f^E}A9#DWE=6wX`itwCG|5UQj!^V#gP4CV1`LWO_VvIG#w|6s znn&vIjACd1L@b&DEmaTvo1WcAwyOwAY^>wOtBUB5i-k*%KL|zA`&Yrs%rDg~0nz-!9I^^@^WZ`>cr3Vm_?qoUQE^J6 zWs_TjI82c+2XDUeO!da}E1^W%7&N^$poaiDS9$)BEdy3DPJ;QFnj}|MpgdN#-FQ#HFT{&hg{xvkm(mMBWrrlRX?`8nuaY_G`HO{ zxr)~3$Yq0e5eWV%oUmA)nvUS#0EAmk9W7lvJ!LO5Ea(IKLs!=wU-Xjx8V}po0BHY& zAkg~^%*s$(I^zm2S7MVUBE$#0VJVISqqh~8<&e!0Kof-U(;Kj=GcpMo_AONu=f&{9 zKK#N5zvKR2&QqFP?E9$n$**lg(au|jl;gWGw{nfib6cqLgJMJL*8Tl+MV=+4xA86> zEmtY-M9PJZ=HcjPmEVM7qkc^bD+f)lsJ!~M(l();oE=uaANJ|NfxAc(uB2^TIvK)&{-@u`N% z_p^D;&S>0o>~Ci*V0r#p>g1qH=M!Q#L>T82)bRAeg#;zKy(vD`@U+-R>99p0Jfply z7d3d)mH-azWmXGePsIwZgoFODoOd^#$OGwFmQdl{0uoEc&+To781cOfq*Ocw%Vr`L zK3r)izj4?Z$Uvle!H|Fh6ilpZOCXhYmIEq*1G@J!+V1XAe6m@PxGI48;|`Ss&>mpP zo$kbB-#4PIcZ~n_(!QQL9`fE)-ul|-wlOXUQYEhs~6O(mni7{vSz%i z`Dgb;_RD!%$I+>4jb=}{P3?+rXw&ao(vP+sJhPcGkSFr=ZGCSp8ka7Rn-`Fg^>;3& zalhH^APvX3Ge6xAVxt~k;19Ikp7{Q2ZA~580_D1zZmhvEHW1Wz_mgFVR(oi!_M`k_ z-_B-PBv>ME+s2_XubN=zpnRSQ{BU*U8J5&olm*UfRNRgFt?nQ0cyNVlqbi&IE5t{( zn$D~fBu+dM6YI*B5Z=B-)avS~1B4sqg`-Ec$JJm;7LukFo zi?$#I^;pNbbTf)Nf4%ho=ul8P%k;0k&n@jr8@mJEIWKjv@~8Mp)18^C^|2SMvL?Tn zuQix0cypAj9D?VXo1K6g-|KeDVwqW2%D&Fkz`hu1jJt? z#$n0j#uCZ1ZL@siMsUh%(8)F^kRfp@waXw7>`%ON zR;jfUmubT-wGYFCZy*@IK05bJjJ+?6TB8`=y)Z3&xraUV47D=eCf`VN)#!BWU18;` z*wtWYwAwq?sX4i8zoYl&d&ui=rCXJcnupI#U;nQCB1a)-I_PpR+gI~x5B}Ck?U--o z3p+Y##<6L?rxk8$#V+twu>7z({DnCAx#^`%Nfch{e!#Ed2_zRo-2RmTbHVRrQ+I1a z2xUO>`pK4>zq!?Q*Oolq{sNL!*C%x)85>?mo^ht{G0F%_~`bG1dmV|%oPKkKe3N4TcHdJ`t5codZe zcIA1hPeKV=9KpP}q-b0)+HLH_#w`Kc1gtuBBtEo_CggoG=WRpz4!Q+&gv|#Q`<_X#~W)aO4;`DS69@ zbcN=pjn%2FqN`&KN6eXh+r=5#gk|ad7qdEMU*OpZgkwqDl!ro4IH?*o;FBIh4uX@c zRUYpgk!HA~%T<9mdDDr|n8(J{mZX)xk_~0Tc}mbMXS(@bz&Dg^26~Ip*TW)BDcMe~ zSiLbaV@w9ySMc|3iS2JLcB*@T88ah9ic~<^usd`BDuh-%f$=(Y=iT?ZgRLj!9SI+}b@q*99j#AgpZMdENMX&4noJiRM)s3B zdu@Ew6CU{5$(^#DxKW{$A3U|EiyX666Tr=1F=A zpABtyL40gMF%%eIb$=|Ctg9O`o@u|)r ziFI6nTSLB94Y9t3)6>j`4Ond6EEU%@rDU-UQKFr={Q^N1Qb)4zpV{DpGJB3`(r$m4BOy*Z#|MEl$&`54gW31aw|$H%@S+#o-t8GpUm z@*?68@9*Y)TYi(g zMhrlhZGk6u-_&tGIQQRr=wi)Pq0O%Tj+0hVhHnM+6EDc0U2WGFcnUu;ZfWu1KsXha$~G`V;&fg*SJ?e1d#VrH!Ur(4LAN2$z< z&X`idN5N_ILSkFRy%XdsQCvZMAXI|Hx+X_(4>N0=*ZvU+PHv<~BgAyR*OnN- z!@TUXT1L14@2N`;v3qz7=@vVllg$gcM%3!u9;}OX^%K+Bd9PBP*N8O<)|RV$FDY%> z_)o@{4tM3Tq7HJT1l=K}y&RslUo~A}{U}p>AOB+`^DwQrG{`o1Dr!w|txxxAFaFNv z(L>g_2)>j~Z#lDCS`KG=Ml2PaHEt2S);e>cu+H z8K-jlo`6pJRaxe@CCLAM)6SgSAo13#?VoSfrk?oon{jYODL^xU>q7dSsZ2-K($C)e zJMR>{hKoOZxJ4uWwYVIWyt57~OO|x&ROwZD06p4k@p6suc>^A73iPtdW*)b5Aj#fCgzH_pRX<}o+fPg-HbV3uzj!KZlKB28#iMxK9eb= z{n2f1R8{~w>=c*1Ot%>BY*x2FiEZgpG@@Ma3p`y3F;Pq$8>MAzHB?c@x+exv^#r<& z{LeEKZP%q+SwILO2}`%c>sobjLLDSS+%YREv6ywCH6Tv!T&^{u&r)uI!q&@ZSbIv&u6;-`!2zTBsj3f6O0}Olh+ zhMu~?m5lbW6gf3Ty_;Go%;q3}dY@}^o6#AWDbDBOM_N(wp-ueCwNh-Ri6_UtV9jeQ zA*xoxnd@^6?^8~Wpzg`rAAUJ;O5(eL%aQ9+zX!6RjFF;T`Say9y98CSX7gI2K9u$= z6ECOQUD?TC|Wo);GIYu-SNvR;3v{; zEeui$LK`%s@{@A_lT;lci0RBVY|J!Q?72Kr8;stNrgjgnInenvY{`!B=IPGrPXC?gU&d8wH$1471NyYh#gO9;8^!&Cb2XTKzaEVhS{E&N zYr2yZJ;2Laie?{L!{T;TC#)4SZ_4V5-X(pB(rdU8N%IVxJzu{5bWD%iAnE8d?$r%i zu*blDOd68aY_QuUd3{UVA}8}qYlr(x-j%f=s(-i=M?Q5H;GWke7C!t^lCyQ>r4XEgK?7!An$`IE6>$>SN7_moG zydqe^$MqEdfd2(p-a^mK8f8-~=$o30Iv{RBg{U9;xxv`re1I4SU79NG&gh6j3qJLw zIG63t9Cs2*dx&{rxd6BKm}KA&-ixwvg`NK+WXOHYQQI9ujnct%VCfgNTT;@-x%C_BE|dSgFdk~US3F)!;BGO_0qxv%k%|el!h$??3q`fZN z2X21yxXT0h&KGYs3)2TPc4sT|(g-Lk~I~fFFRN_UK^?~Z-&r@l*yqiZnwg(N-b4+ z%UJu%8D@&=i=n&&l@*4mN@asP=|8J!e4R1k)ul%dgrM7nYS^}{$#cEA{Hn|M{`RYZ zJfSRXbKM}*kFRiEA&209L?En33)2RS!CkuxzVy{2E?_s^kQl&L7N!r>U>-;q2YPug zQI%vQ?9C*m%|f6iJ#~K-Qz>Un(n3I1qhKcE|L|0lT^fiuY@GaTZMHRfCU_|0kr5K( zZWi3tP}iU*X?P-~TqmNc?3P`?WR|-z62D5%e`PuNP5ar@3~1#*@xw~Xd{0Jci7*}T zF!$Q;C=@nz^vu&_K9!_A82O%+IoA^WELEv!fm3=pq_9+bzv6{_P0s3;pCEqGI!$X8 zdqtjeH)&PwLkul^Xfgp`xyC=86BwKo`^_C@I?<+nO=|u&3pB-aWYK>1d!Wf##X9v&RGOs>XxwKVF2kwVs4*yje|S3b zIopaMj~>Q~xH4X@hF>li%~}27-ZdHNm~m%Y@i3#*xQedHlmf;p<6?+Tq(SvUFW8JP z?z~=XpVk`u?|a9TfFScH5iW9=Q9{!{qHt)@8^_x@pWfh4ACbpf64VbKM{= zOi%9uQESmI2GFk?i*NJPu=Jkxi_FZAknxBSNe#0GT2{!vK&~h|l9R6R&i`w1`Ewz( z1!3do*WQY#Gvx8D1V6a7x!9c|?+V)d=h~3iKoK~RvRr#P(Cd@=zw9_{i9vau^D(d0 zi_}wK@LFSeuujl~xvp~dG$Ii+%#nWXEG{H!w*D2w@i|TNKh*W-e+X`cdGEJ3Z$%5a zlzeS8JjrpKmh#d+65BP64u2_o8l~wyEkUBZWPd(17dPEOHhvO~*}a3_1(_Ktwpa)5 zZT^}1GraZ0eG@&|B=le5O8Kl<>@&B&MN>aD!Ny5hpZxsOnNs-qTZ%kKQ7Q=&4FtPj zQM4{G56NyHdT~MdLd-i+eI9}3go42#64`;1hOxP;YO4!*%q8mYo+i~MS%P^`w?A>Ql7@xIg%<8p!-e2B(KB#SZe(i7ga86gK|KX=zg9-8U zROK7$I|kR5O1}{7qS9o6+27M>FxoX8Mf=?NLP($K4{}d`xU>!F=EZM0i}hjrBm`ZL zPodchz8?SgzW@wP`&2)+vhLeF1x6Bg)6TI}U1=$PMfYQdfayd7R+?9$ zleoR75YW3l*L5uE5gT7shuvUFNk;W6X&{oh-)NwyhB+9Xt1jlnlLhcmBJ<%K&}UMZ z1JHapw)YJIw7P97c7IWK*a;=HP$tiSKhODJhVY+q)DI$4ipPb}6v-j7`w9`>A!QOM zYf?AAbs+K|r@fX|nqbo2Np6wV^5M>u$0OgbrHMw@-OGR;X#L7Ve1D(0b*nvuMhl;R zb!tu1TR?j&O7{EeoK*DqwfZTq*rUxe6Cr{s5)qnNkl)$fg45Z~C*P{$g0)#0`>Jc( z6ZO01LFMJA=3ZBu|BW;{OFd|_F;o1Oi}A~^4J`R(qowpM7v)Di0#ZrWgk*jC&kn{r z0*CL&(U^k|2q2(;(LX4sJhmRM32k-Wb(?dKq0<{x(o-C|0OTfSx5dBfJ+-8$3(4H4UaX!tC>%7z6A zEdMysz@wTQ=9H5E4v7Ep-v#FOJo_s@*(>V(_V|D7y?0PkTN^&AfOG{x1VoxNkq%1l zpmb1?CepifkkEVYNJmN(6i`|Ksi9Y?k={E%8en_JfID<{A?I@CSvISK_B_vLAFYG0XEadA0@Flu>G1Q!oEe5B%M#BkNzRTYCB9+GlcX5GcuMDn9)G9=;90upkC zy_BBBzU4Xp)gShT73BQZM4NP!hkPc!19WU)EE>+ex5@6FN(Ok@UteqC>7;Y+5WDD~1(3hl72fO(jA-Ft*ut{TJH&`J`2IXMD3jz(K*jGI z>I#ZD%l4`{=f>a|S*3VvHl4{R#_0QurHPg|gBg=`o+$=cgalS##g4xv`!vpQCFuUO zf|)do9-#8PEpSVj;Fkw7Gw43JI_X|dx+N9%}p zjsu_6=bEr|=(Rb3rWd}s#X9E2u7)+ADL~-`;4%}#DNW$~|oAFE{lsJxVWZMjb5dRcpK)`=uo1 zGL~ofj`tuNUB*nG%qbwO{_*l=@nRsR)_4w3=lEwz0&d6#E;RlXAijWFY`H&?WNHqX z+|&j!OdNVB%0Cq-{K&iY65#Y`CFUI;)4yx;0zlswt02`OnHx(@iXjt8sib@-qGqlP z;ErARdWS%RVKX zSwo}r95+CZUM+qvGM0_`d@`V~ZA|PK%n_gp%DrxMt>4&-G`>vRv?F7}_s&xd+tOOtL*bG8Xj0`)ieBcgkg| z{L`OG^1)?YFYoh`pGp7--3c(w$>gILo6Rlcqss6^*-J5Rhm3!SQTB&()Ck`@&5TS+ zEoF1$CuLA)blg%rZne`)1h6+`{7&IhI(U?+!Jsh9L<)QB;>-9O=_(nW+UI){@hZoT zWaamP;tL)2jK>S*Oo1+5C)6jYF7eH+B&{bqZlKjlO3k#M6!CzSKsa|^Uk81m_CTYJ z#kCtecx+GF885}2Si1!us^i~E5%ef4oB=X%AUAE^Wntob19UXahts3=svxkWxV3fUWw-*fBT>bI=wL^0=uJQhx;&`-DoCR*b~Fd|Le%HtKY{g-3z z%L;yD{>W|atgVFG_v0IL2)Aq~@h8J_*nV7GStMV>zL3ZiUL(Z(ep7#@KL#7+r~o8> zLD^`mkWw4eSDp5*zD15=+svXriWYRzU98>mj6Z99L||+GnMk?z5)0(aR8=(mns_*8g#sZSYOG=e4-IENJH%y)+dI~v=2{0g`jUCJZ5RT|vFZ38sGPQts1tv|m z?z{GH11@#``$of6TqU=AK~0KrtNrLHHJ6h2(z0+Zl)K{T=!xg)>FlY{``)jwzaj2T8QbY~s1AUT zwc&;H`qQ(i1~vIvj|*YQ7&@v@7?O{rNmI~8SUTfU*;rslG3d7Nm#J@YXS1ocjLb)-Vc|V zV01g@knn$uk=3qf%CrmTkg(zRXSP&mU~1m#S1`p?O1u|xldvp15i5D#h{OL8k}>^T zSyfdP)-`@C4nFg;>{~Itl{Xnqf&oSy$eH|rgifg>dq*K{)@z@0U%<;2lkyDm|y}8qJvc$oSf( z74U}oH~a!q_7wKnDcL&~81o=DimK%;Bv76LOigJqaw>hTaNC3YFh-1U!!|LsivN68VvnpTAR5Q``D*l@V-qI}NHT0bVgfAsu6P*-K;eR>_U2!R4UL$d+Q~o6rdz zZR>VjAf@NGAwMPqjNKL+b3xW`@j|uuF{5T z%aQ<~D2{@UYq*)lk)BPlJ&I^MgozVqGobFDH0=UKHfPwH5}N&G{xusNk(B$izvEjyk06t&sK-P!-7e z#IPLB(SSi!b=ACdsnkdrl1@$K^@!QTW^Hq8ylDVHP=Ta;(*DEiQY<2Y)^>o9{;e2i zFBRh~MDs5q3KcWSGLG;^GLmoGNN$vc3uHVNbGCE6wxxF?I5Dklt9EF{e&tYzU$TgZ^1X!}p zuN&cMl7PuR?cJ(USP0*XBm2ZSAp4H^W!OWV55bo66M{Sh?d6W6q%Xr5Vy^oK-cP8v zRYlP=!fj*XWbZa#k1>S5i)P{hws!?ihQYwbyK7wJrt#DYiT~>Fcq-kuPA)ji+3a7jaD#*8X0R{J~chYCiV7T;!b4 z*0i%yN7Wx4qrL2ygm#heZ$A>~Sh$H7gZ+<~Ac1s9hrm9` zXj8w6FjFDKnMAG%CSS%BN1_?-1jN(y?DDUe3WI`$s&<>oV6z!hu3v`;$ubm*jmooc zu|w$<0arAC?UG%?-Vl#8O}cHKPl^%iuHccoT4AbHLNxgiRx*)SS4WQ&xQYyRhyXHc$b>ejNn2@Hg^;%69qr>bH_a<61@LCq?TkP&E?G+L^Nl4TzO%zp z3UX3sNSa&WFP5pxNC4HU zJN(kMzkQuwe{jP5zlBN<^APAvaBRI{!%)Q)-G+$ie-%5*`x&Y9nfu-OU1k2~bAkQg zZ%tnyOOG5a=(pHqsfXNqCnsVEHPV5ZG3>dd8cW{Ic7ps0c7De^mw%2)F|F}Lj*nXU zyKOSiOpbD_{uc8e(6<3cbJP%^aw{4jT6z4hX4=qT(yu`%rbf*-9~$M&=}!k$q*e^Y z+`UWaZ{eol`*Sr2LI_VjCH)<8{Lx7p0c`2-13Tk494)HJdN{N_A!Vrr<*WT-G5O>_ z^_vYpps{WEm&{83)!s^cOcSY4HGSPDL~3?Wa&+;hwc%(T0;ks+mjfH-&k&<6WJXOV z(QWguMgzQIeUi8$TOs)-o==j$CXeSt{A!)e4a}pc%)W)1!oThO-)eT$#E`=%uWuY4 zmHF$-cL{+t@63Jp{8Srw;$PqU)jMRQzlLLIrcXzVXW4CLB(!KFqyY8UcjU6fU@Q^v zh>BSQgSq~)OTU!?K=PU9Ukb^g2JqMK?}N*RE(kR(MGNrN@WgSP$5M6yg2rY)@Ik?E zN~WJ~@$bQG0$CWc?-h!gSg>xUek;Ep__5rJ5^DWxoig)ri@V#Ft@Hk5dHiGeFN27y z7KTL`mXF7EdOG9Zj2eFeY-D@W4?f7Kg3Uoaz$*5iU%z|@Ou4%IQ|a*uQH!4EKgX7e z=V_I(ZJTQSzaKDlNs?G;QlfRa{Qg*Ne|On<{=GS!`93g`PhCxf3@$U57TYT7U+NWc z{A+lO4ZX29Sjn*A|;^ zy}0$?Q}<7g9pZQaX_1cwPvrZjpGbN%2I=U@j zr|h3<#c)2`{?&B-GFi#)?8S%J_F_~6x_7nTmLGQ7l5z|!LfOto8VHwou2|1b>v?s3 zO2{p)eQn`-x}x<)OV33^7ql}iY!H7}(VKVTrptc`jBA_b%6zBKIZJKc#TE=CN9%n! z*#498*cUZ(F<8G-QKGjqwG|DWLD9@SlcOG)Sw%M3m#d`w3IX{|FWWYlc@%?q<65(K zJX62x=u~ArR=jiF-bYu<t?+xteiQ1M~ebA-Zrv1*)oD>El1NFK9gNclCvMu0rSL z#Lnr7GTs~s_#hiy=gvo~5Q00{V~zTV>Q2$GP?*?mZ6~_V$MODAm$|dn@jrqI(3DY7 zj>ot3CuAKa%y6Oixdg;vVyhWD)6TGMJLjpXHv)~P9JO;NeM4t?7~5<5K=u1w;)aVu zHFPzycf!Jz_M{0(6o%sc$*&-pe6?I&AKAeN%_(-?w)4dk(J{CYvLud5gSmFj%%9a0 zgEGHDi9F^JRZERdXe}s_FYwd@{ll`Ik5qH{&n-t0)bTV86vSA#~Ig#gUlUL+6y<=T{NhGynZiu#@ToG;_H&n0=aJ~U*MXpMdnETwylK= z?6ksQcNQ^=05zT~HIC0-4A6>IAk%zLxu8qP+6L6Ny{qp$AU5#3`AHJ;yzrmH-cWqjXz4(ZMf)Gz7n z?lw5WnP!e+#B!k*h`DmlUIsO*&W0@w`?XmlI`+-Q2Kd6%wP3f#eG1`wvGsVS#^A&l zQE+iQ_jL@udQQ+VirSsKI5^&)nyaZpRt#NOOQbIw6*UN&7agV9`>G)jyQh+_&03AK zGj-%FGy}*tW6)_w_ciD&vKb8;Zrp7EEj*r~w)frK>0rr%c)>b+k#oM&dc#Qc)P)c6 zYTuo+qq#Ht8MuIGF>=M?yqBi4_-L`vwXSMn^&(tAxB0Jh;)~~L!Q3!biUn#=eT>(+ z!aK#l@iC&J#GraBrGOgJAJZwi*sMgq7K=WAJku%R4no8lh}yGm*$ijJdTr6xHlm?g z6_nCM?%z@A!2)1-{|<*mLpibw?B?Yaf*ed~7(}ft(N5I=II{RU)n?~- zkWdRg{mfE%a^>9yX;lQDDtvZ=uNN1Oi`c;1Co)PTd5t%$?qt5kU%i z4Y$(P-MS_LC$eybU2LYfx;AcRLRrKYO5guQk@s7CE3aVc?of(!(smTa9o##VDd^6fDD7`k+eccQB5JzvNG5>VFDFad52of);$sfGBWVK3aLMCPU> zN>*K{pRMv&)jmcXl^6^YJhb1M^%$KKSo@TsH@e|5Vm&wLo<;0$tTnf_iXJ$qjrBQK zpD_xh9i?`j$$>VyH7mX2?ntpYJr^>t37!2wUhpH4tr0oH%#Lc!lNdXJPrS(!nXc5} z8KFT%rYmuwehe;u5_3IvSF71;iJaObM{l!1bC7AWB1j+cD&MTPx;u%=V9^VE{n`49 zKw4XH@M4tT5sNQe0F^>50}hIA^gP{snb|qFhppGP;W>-=PzeJgeAkxxQgr8D6O*Ob z4?p=2quX@V%&@0#yk-s+YR|z{f4D&e92ao$WTfy;3v6cBF?J^ywUzEUhZLVd%pn@0 z+vG$S-_FEPi%b^jW_8L8Kl9lDi+@6%uSx($>SpX3y4C)ob0_cOv~f-UU_+}4aV~Ta z#aC+~v6;4g^tS$F|DbV?UjfQ`Xo+J zbGzt8*hOLA6^~OkgOSYrxX`bFsaaQZWdVCRAuuIQ0=KWGgU+y#%L$Cy1! zSg&kkBz;Q?~xi+Vjo+{`3}tpaCE|g3cK$% zRlg+?JOe}5ppRm<#eH|kp%+Kf64ovFQuDp8g!f|7sAGLj0?!WMD>LgCr@j?Bbe=D& zn+aOlTpK+{Xyl03kVBS;T685(doN9SFs@SLfdm@jIg{SMVX;jJzCPRN!gVIP^jTsC zS(k$xbYFF~3#{E4kaKB-Z-IAtYMJ97v0HLsZL2JRD&$pCeA+L3krhQ^A4M9V6-kTt&cfAvYU^3VFKc!F@Q!S#u`4qm&I-O$ z@rzSGDk3HXy9LfB9?_mR;ncEuly+{vu&anj6D)B%?U@ws3fT9}LLzNB9G|KRuYWW$ zfg@rs)-E^=NMrlOkwd6nu!u{n`<98PMDfTha!pQruz^*Nrh2@3g(H-4zDvzr5z)pX z_Idj#y2xo$cdk}svzPB3#Q6d#@m^&AWuOG@`8-Z7aQ4Kk%6lj1XjQ{e(M|vXr)BD2 z%c1|eYvWWV6meAkMjYwB*iYv$jnsFwZRw!4bKPW4Caju%HR$~XOrPVG2W~De>7D=! z<;{5T6{|`6D*Cc%ixQ68+<5F%LQI+nnDz5YpC<3!k9 zcJukRg~mO5v^!VsT>gYaZsYZ^{G5z838W%Kj3C`frWF0#p{|Hcd)U2=`xhteTvbP1 zsBPmmoE7A*Gvc&G6-MA6T`#m^lqdS$_uIuY+vFkW9AY8HvMdL&y^Q96;AK9UP-=ml zv@aHk^TNQXt4S_bZO0t}eMrCR&gEg{Iw8qMJl_r zDdZR1kx&EVk-;v_X};Xioc0al-bnq!7C3#+HnHP0sKWW}$C{(fIxgRu#%hT|&!YnU zk&D_fn2T#ePbTvC?#SHBy`!D$CBELIpscg6c}HE-F*^z1^R}{v$;&`PCfy%-oQ-MJ zStLWhH4QjumeI$A)K&axtn~hfDC+Ev*Aq3wueONbW=E+<`n29NIkmd8UWn5HN0uyy z)_#u1&tgP&&PpeO{Hn#)yV*i@o1_h0zkA#hZOoX{M2W!LmP*WloY1}qnbEj84Ln#wCsjEiOq2T?d6+Y0;NaQQ? zp}K`WdxP1SPh6d5MaQORd=7%qFzO@ovt?H_lD2ZHr1$l{SJsiD*D3Mt90IvB5R@5v z48u5k%~i+hY!UNV?^p5P-(eJxJ-X%IUURYa(Hi9F+r@;EkwJ#uyU>>y`eA_v`Q=O0D_3g?zAAVukf+C$9PF{p6}G^m6P)z8K*| zKaS|U|BNFlP+H8nlkk0y$CN-#m%?^saaF?#hswD7afx^ya-hB3Uz8|c5imbCMA&w& z>ADqZOhK8u$E)}GgzrrpM^OW3jG$89Y40_lYwr7)v36J7=6l}zyk>~nZphB6cCTf9 z^;?v^H!qcWeJDjbysW(O@fNGv`CGK+FoWl_Tx-5aX;F9vO}Uu(akyFq7WmtaQS%aS zZ{j&f0=mjpq-U^WpLB=33R7qF!ImeezdhyEq}{cHI!ag|y{X$y&&!qD1aCKFP+ZT& z3ai|gNbQGdGU`T4H@BAxDyPwvRrvDu1+twjq(~A=p@qrmv_+2{KI=n~6{G|H2k~?ZM1V^*j zBIo!ryYfS;WXU5}L_?=uN)?ybo5QVC6Qr&pSL1mLh-v_@lXk4W^dh*>v8KIG^>x+o z37&J~OS9xIx7@xH?Ws@%5h*iwb@Y1d#bOCGRP5wx=IT(PRxk5Do9e|90{s=L=Ifbi zfh2a?8JX)oP*?Mjo?5NIx$nDAD?XGtCNULa$;~OyIH5Aho+ELRup*Zwicf=3hs#PutykiPrk$$Ti;)C!-JrnV9N$w4Kf)rR9{U|cMqp2RM zzwO=FVRm~s1qOXD#?^Hdu{BksT(NpvOe%fRL+#*lAzP%*vk+s8Jn-r#^3( zCGex^MfIUI3#0N$b9bFfpe`22jj}&$b_!22Hh_db^Vnt@CTgxtP_oYWlLhg}pjM)j@OUUOt=Bgnd_+u8Nt>DtC7@?L9w zmu~|4&Lz6EnhaY80)g4_y%>1U%kEH#^AD8`YuN-yg6)~cutCu1WsZg5N6Kmg-$rU))&lW>bDD;8%Od$%oy6S=q#Ke3ks4ZQ zdTs(fd4s5NMh_Ib^n8x>eNlc2U?Jo6`;YAH0{l(U3KHn*5TGVUE!GoK9?Ift06vNB ziAC+@OtCYa-VYAW`^2kwtw$-!wcUg#|UfrxeoTaoekH6NrpLYkiN^ zRBd5Fr_DHC28dpRvoW~l>+R+)^PJRezACTxzG3jGxzh&b{=2S$n^oXY-*Xe%(JyJQ zV;c^lXjT$X&NiYwmi1H3+4fV-ITGsLi$d}eXVr3FkL%$a_Vz@2qj}az6*f^ze2b18 zHveoj{*1!}9SFAsPwfzsF6dM8yMjc_>_~-u;FK(y`tgH?`rDGPAag(XtJWI;J6>rp z@{YS^%zp0tN7Wiw&T)bUb~v%wjeiL(YnjXkl-RHHk7`1#_+NobPBV8Lo|J=8L+^!hv?_KrmX4WEq@rW?LM<1H0Uec#t zf81cep%@!D)QhcFV%JwF$`77Uf5oK;?T^^?LLf!>tn8dObwLsrU%?G`%w0N5&L@5C zU=Pn~^3cN@y2$0D7oO9#!6loBDmt|aSFzCCvo<7F`KCUiw%n%L?7P~mC*;unqN7o% z^Sg)7DEdEvS8rHTavhoVbZ;cmpi3B_%kG4l+ap0pKJaO;&Gf4#^2Tbh`2L!@;miF^ z?pS{leq!Ze*|t>Ovg{a-Z~}P3jP(Rhpe4gIoFC)p2`NwAafI_`nsG=%<>{$C0Z*^c z+@xBW8d+6*O=cfg{B{ZNNLDM6gx7J2W6_!L2+J%&G*4(n0=44|B{;J3(sznoYt%0c*L7|4awoX{{JyP?43PRT5t6B|@;h(v z-*BzW|KF5+?u9r{G+3)x@m^*?9%@|_JIwuh0$7{9gCqpJVWlHaor zG^mzr^Z)r|Ux4e&{i?DpTTciEXJ+K_250mJXFlA+*1nHH!hG*G*w7DOp6%W}I$Zg{ zAis#OZv+%qQOA_2F8yVBb`G$5(cN9wot^&P{$8{Nti}R-&@aL$iShSU8h9l*bDSrp z4xfbX>c1|3WE}8sq{DajuD^fr=ZpXE{#vqb+>!G4p!q+&=ddx%TJvT-e&*BgXLY6h z<*x0e)G}w(nTwFeVgAfawd0avrOm{a$qtt4{PzzsPMf0~$RKu|GWj~U^E<|v3peoM zuKd1&60S5p3nsm*#sJKR{~ihO+mKiF9wVFUj*D$?85QE)`eN}YIbME^BV*GX*Yn=4 z7&HAAM}O?7JfTzZI%zonS!)h7h07pWHk`!$BfLrAYM9qVxdr0>SFcm2&(A+a$lW25 z_rv=83SepatliAFM0q)}#Pk@gp+qUBUGeVTOe*hQ(Cysfe5EZ6+PZ)6qmML9>fwJc z5eJg@kR`?zlgrP;j4^(^xn-bYJ5#HXtDJW4Iu(B+#x?wJ9nn3^T0i9+OANHSRh@MFn&EZ}g> zkN6D7{Uwd)2e=P6%{g={Z-t50IIn_w%!-~iV9)3Cxk@@e-bS;cs*v-KL|(IQdDPiaeX;CU z`#Eu)a`WioCq>3b0J(sva zT&P>6T6863Q<{707VGoW_T5Rjr&iM`QbWh5J^yO?jP?1)ut^VHqw7nhuDklsvpV;KFG%!wsmaE>xY!d-uDZQ|Nnx@1H}22? z5fO|2jAw|vH2tENkB;=YhpN^7(L)1Lel4nRo?4_|uEP1yD?zC=VjlUS>!9sP_rxp_ z*W#A}R2Y#%n#HeJfn)ft%$rm4nm#4UZ;v2@vUzsJGwrYC#7?f?CxBgkmAPU$`Sr6k%5wKpihexy^*i6R47^w1#L)+nRrb3BpU@~|4r7suyQ-J_P}vgZeFX}fQgcGj7(-CSCV zl}NUmsh!cl#z;D-y{SFL3Q0U?G&&BM|{|fG<9l(gk)e-&Wnj=m3t|NqF~e zjs38T1?(2~u^Q~UGtD~5pqkR@iI3n48ah~oZJIJ+NPTy@Bg-9CV?~@XJsW6FxpOHg zzpkcwIzW050lZU}66NneVmVb=REIv>bj=jA9xa3p&M){$_RPvsXZVS-^F)Wb`C=0h zx>Z((3k#AH_3kZKJFP@CetC6pak@$i5ONe4fP*xe=evwOjGH`{K7`T?J|4aukTOJ^ zKe?XdAL^AyyeJAAg98l2OAj{Y@9q_8m1OPTa4ay{82&8&m^uUV!_|8&epfN4zl4=N zw9meAr)^jg*MV3+1DohxnEmXI2-X$f;|Yt*ycw4$t1t>JgX|ls(jt2pE#3>T`HJOR zE{8(!rOrlcb~@7*lU}R-%I`2hjD;iNssE_8>|jZG0ueypRlfR^AV-<{<N_wEd8~KIzk@e^;H`^0lTtc_+M`quA zcWPF>$Q=8ifQo-txvVLXdtK-{(Ltt&>#_E6y;2G%O*@?pwUARA!*(nXNJT2h*10@A zt(x=M90-|`0yNt-^+n}C3Y=ZCJfoLyr-rj#XWdte*CqO$84kw#)H@4lP4?Q!4N?_0 z?kwp1fMFP6U%i1SwVDq=jzz~xT*W;~RVV24IBJ-xzXE$SG=FpD76{PEmbVwg|C-?| zc(QE%akoGbw>aoa2t9POJc>&WcladF4t@2UmZPR6KLFMv2|uYo=`$}`w#$`q!OLHs zFwFm;oWEsucC@*=z~hgz(1<=$YFB7JWOrLjCFM?t~Q-J97W0Z zgHx(q%lljFa6Vvv+-_M9bk$+6{Bt|fY_xxL(EgtJ>2jtaR~dy z-8JQiL6d1xVu$&(1HdTEjf{p|rxG0`F7Hr@x=ISU$^gM{pgCU*~*~+nkQXL)2FPxG=;Iu%uPT{XM;M z%!^jQ&K73pao|1BW4^+heVrZ8^ZMfPak_m&DdJ$c%UP?J9LtdZdZ~eO z>({$j2{BVt7)zCe-`kj%Tcofm!QdNZ{T9ajmTBnqm*vawk{+I*sVKOunD%Q{b=#mz!W+uNaZM zZ;}oQX}q60-D{jyo=e534B#s@r-!U-o9juO?*&fRxvRH-Z$1(db0g-vpB<7a_mbkf zi&5>}Hi5#OPuG>d8U^#_3FXDp)81L}yt3Dh_+c(PCQJ{9=A$wFar8wflx#Aw)$SXFcuwg?QG3&fHqLq-sCeg# zCevw4VFd`~8P%xdm8<>u!`YO@^bbSXP+p@J_u0xPv8QW#XgB+0UtGJ%2`<6NmV(M2 zbpFxL=CUDBN%KVY+n~V@rFUP~KdK|LzOaOoFllBh`zU2hKz6j42&u)q0~sN*&&Ho5{&?Qm3V?2-U)I=eSR{4wV%QLet16;)Fa7@~#oSn~7YjD9$;^5mjw z?!>A?uHGvo4%Ue1O>ure&~3Dlz}4CBU(;%dk(I2`?|e3zUI8t%Hl&F=E;U z`t`MQ>JHKUXe%yiOWSl+RMY^ z&2CkZe6s6&l8QnJl$jmSmN}yCC}c7hG0Mk%{~_!+ZK)&ZTPevH&=eRNC+dE{21`$5 zRVS$P&p3X%knOawjF$KM;xNW?=}? zu{-_z(K3ASdBgKZR^O|GAGN7Z(6zBM{YKlsWm%mxM*(0rGgKGNIB2t+#Cf9nuefzJkSNo5~v!8mZAkuGIeE z(K0+QD*^D(3rxgRlu}lbFWrxO(oMFHKRB&K!E!_#t$O*N#L{fneiSf1NX?Eb(WWQ9 zMJzwIZ8Srv+rF-2a@=0C%N#|gU6wACVkT#hfq|9Vv4-O~?C;G!gIbEM%A45mVCWgb z;ISvRXtz?m+JCs^sLCg8Lvb!Ye@k_`&UyMI-Bu>U8J}WLv7Q{;o}ACEEWv*#(D|-Q z?d;+OYi`$q58w4!VT}UKq_0*(ihu+5NvlNP9Q1KJ$99@;l30>5%c(zAB_re$o+EIU z+b?8*Sn<*-b|s7D-72qh_BnNrc?3ph6l&MXw<|Rb7k*tIWaG*R8ci&?*?N&qMD$+3 zZZ>Y(ecFV0Yr5evF#(QJUTZnFdR|7ziQwnwd8G*hn$HVF>)Z?@$7DoXGP;w+i=q-xo%Ke{K)>+Rzv#8nsin&;c1xfA z*n?H3SMO2r(0a5t=RQqCrh4nS$^;LaAMRCqx*^gP#GHNPy1CF+I*+wO)cbB#=i*u{ zE&}C1-fK9@tOSgHCFOQiCfttrBE(u5>Y!dL1t5^CFZcq)fl8cgF>zL^&4lhhPJ|zG zESs2pd0Fw=XpDdL1gJc!3uJZI?$D#6@Ox~`wv%CH_@jp#t@;emxw(GsgApm@8Z9?8 zy8;AaghI5V36vn|KfJh7-Tz#sYkiJQc z6RKgjcmiKyyLwGp`CycK`LrRB@xvpt?sOwz%@)~ktXYB7=PTwo$GgwAlQ?ysg+Giv z_R@SkX3dzwsUOESnlc=bWG(-raN)~Y^@Ww>DM{n+f3LMvkzD*k6fmE0}_pdS2b zh2Nlp9|8ko*ZAo3Wrk$&Yhr;;!iP~ObgCscRtE?2vHa~z*@ca_*HR>4F+FyhwO0LZ(soMG=_`Q~o!uJ! z@0;bF@kxbGI5$A}T=K2>FLI68GpxP|qLiHmc7&$)21v?K2>~RJ8&-afTFCb zBlfO%zGh)S^+D$oS0kKKms-)|M7l8Et-m3NWvR0IC>4YSu-9?n z>i(B6zM4Kx)?bF*!|o@)C(*ghrSD~JR)mvixl~9>q)=rStYh$A%!C{OF|^tR!nPU& zr&f9JrgyPa?}|{c5!W4!>hfBCfB(MZTK0{_j_RUAOtm{cpYYf4=6?2ho8eBI=C=s-b!y8wz@ zLm@4Dr=m8dn?tp)hw~TWmqhTCl1+5nhUkiG@aWAcooSb%Qy-~vy#-<=f(}lKz`UUh zA?Gc1;)9Nw#fhC6=t#E_h~9d&944NS2W~(y5DYHx1UcnO$$9~yY~M$}kUKy>*+ z=ltnnMgy5VQ+4M9tzsMU;HUhKi?T=x1YcbTuC|hU0#+xPHqeF2+sd*#P;l%1@_* z*pJT7jn6Lo#{N=!B#U~k@>>8roBv)CP080GGwdjGm8f*L?jS}tITO1CKQG_J;%q|7 zZ`I>yQfR5x`xBGfmW@fx9`TFuJ&W=?&b`3>X?0A=MKC8a>BP>?7iBp;Yt=3gk_Jw z-%&T{W%yvFDfO4}k;GVFCa!H!t>y}6iNCZ4mZW~TORzoS@OAOMBjCvzNIcOaWntknxs!Nex~9(sKH9%)_gbn)0k){l+D*BA*4t)XmEJ;f*eF$cmKF2b>y zt0J+P{?#rG0s~K1o&UDPk{AODbZ_#EAG45EssQk8JeG0Ki$c$<Z)esu;(soU8w{HgO6!N|x%Fh(0xAVG>vks!}~#Q1T*eJBl3jJXM`6u+hd#`bo+61j7&vG7MXj zI{Nd+Ra$sw{*G-G3pCBVD+@dsjR5F}6vx$kkEfO{Xwex%{UA5-;M{q&-yMtH^~b@V zcua!d1vomV+|?%iCrCs03X6_=xhF-fzD2{oMKg*MXI^&;uzX0 z{Zon3%9vDw4u)G$OZ}UFfh>}R_W&5J^tGTn&!t#8_}=uZ3Qjk|zl}jAVgjj7GMhxH zTw&|3q0Fu514~FK)(=lln*9+LV<`b3C!|d~>v9B)S+833W&lWgdo^2otDq=1pb58X zvtL9(=|Cr0q<$$kH2G!X;1OhOvj@i$bbqzs3LbEm=7d0|j(wmF15be0IoG|v@t;rG zH-46^$F0l|u-7NE5ik|$i3w)(2jbWQx>4dcPAlDH+gI~tNJvB;|0QX}gIM>sf)4i} z&cL0Rui}d^U;hI${DmC);pQ2`Isd`o|8~4DqXY^?pg)Avf}meh`p2fiuib_FTYEJB zU-{``I~G<_!HbkFAt!|!o7Y4f48eE5>a%IFYjmE={59f#crCz?BN+SzA4en;iujz% z%Ik{+WgJsOPq(JNBq_1(oiMg3lZ1)=w0fSLAzIS^eT%n}bf#jU`A_Pfom`M46)7>Q z-`xT4a7bbLQfdDCYVv+eXBte+F>UxTSCytD*FZ=PJNpI}t=qAo(m$c;e@rhjTv8re zEu<=jU%A4G)Rx#lE^qZ)ni4sYNBSdc&Chf1{XZ%uJy>(jIScYSJ?QzSCZ0s2b{Msh zt1a=rS|CXX=r0-(+(bg>4w%2i4cWVVmb`-wggoDrwa89RhKf90*C&ghjEafhI9<*T zt=t#kodB%G0DAdmXSqL9S22Z?13>-bxH_U@`imj9|M(pLtTBJ$pU)t+&cI&4_D|$_ z+|xTYE8N^RxjtA?0EGIizyTv@q`gkv3AvE_{>P6h>6*FTB6{)6DjPOgotHxW?~B+8 zOZxe^V~#1lz{_4Kp-j8nnoRp#v12zP7eU7sto7m2z`DuC#)npiVUo+?v=R*@-cRYI z0!`EDx@J0kx<*r?<-x*W)}5#bsd3p%_B!jjAG^rauvb?%h%ieNL&_zI zJMQ0N)vv1--D|>hIvZwHND;5EJKXPi4ppU20t>smX2N=8KOnsb_zp%!M)87<#_kL4 z;tv{MSG*qlWGzroA5`YJgk9r)5R%BMtBFlSlf9q7q*Q!{A%zpd5%dYraGy=k^nb3b ze_k704y_Ont#B*X@aE~!hs50WesOh^DCSv5TJb^Vl+#L2!AC%&3zjcm?rM2W@J>`X z=g~E&#M~8H2KE)Z)ALGK2KWw;yCXuebMTV^vaK1Y*6XoC`ij>tv=(n*@Gx+y0$!KK z+rD%GC9WRlJloAtUbB5uohrK`@udI5VB!i~Lg~G9-@*z4PlQ$Z9)k^YjZg7Jn7WWdmUcJ7F!DyU2=H+`myvS{C5d5!2!Vskp)(y1Uavg}%He@&|| zk?M3bi$kl8G3=9uTC$C$^A@lA9}5jwdc-vU7jthJ7S;B~4J!;GIe?T%D$-p7BdsXi zDJ>u%ARwJX2r4B=3n)l8l1g_Y9nvX7cf-5J6aV8mJ|Ess&vRXK;egC$@3q&u*M0xu z-YC&u2pC|?_m2g^9n`Fk=!2r%G0}-WSg5Z#SP&Of#guS0D6^Y?5S4h>j*t%*F-QvzGHE&ezgqx-YP@b;SX9t zhs6j$&dStYpnfuLma*)JVGlat1CFBP*y6g z1RjLSK|NP2!(c_Iu-fLDAZbss<|FD*G9z=^2R*0MUbiuGAD3v^X;)j8c625P6tGpm z`ZJ4UgaLQ!nN*M{5rEa+tt+q?XPy+@LCn$?+n1a(XWAL1s>_C=o~!nV642Q7nvPw+ zk55%_iso!veSCa&+qCUtWR^$%SJb?469|2S*~s>o`zDUDI|WepCXL# ziWMBNEO;lh2p~aA_p>9r_Bfu5s{I3{u`iBq0My@P5Y_cRFzSEv8pNgqB>(g!#w|N) z3bD6k!*w4a$ufl-O{bVB6hdF|Nm)Hn(BVOn7vfQ+$8oXH#^}dtkK-Y&(ieWAR;^~8fBo2BLtcofG&*bj-{Af8CtUBq-y{=yzQ+IWQ~P6Bz(?=>Kl@R!uG>nv zT3kp%#tjHbZgsF517g1TX&>D_Ammlvl{yqKZwzFFbz2Xl%RBQ4TaWV!djpk$^CA!Y zXQusET4u}whOo%-iK`xnJ+zN#n453z`br0r(K;dql?#CEBSD+XUX+!!Ys2}g(|Qw= zM%;0^&17+>ec-Q$5k?-y)8Ew-9EK~xhe^%ltB+WRi?C(}hOTtsqNDKJ%E?NHjHWENOBAiR3(-} zGAikEOyoRf@63}uHF}aoZOgI3l8qW)K3eREqPLl-$d-$|BmV>l6tcUrR5R4{K;cr_ zEAE+j3GxPJ+$r{g>VtTh0Y_fT!G}xT3FgV4jhnHe!gjrmW-(lWegbWvO{oTOlRxDW zxl?g>?NWfeLw}#?{_E?$LSS*_eqLYSTNy|*X$|$|1}d7ER%-8wQjt?gOroObxf&=E z*CXcRUd+^8Rrj842pCe!Lkb|u>a`Pgb?VE-;3x}2f5`BBZnXYk z!LGh0CfsOsI4^q)0MN2kF5B-6cR)YC>=KykP8&e&U|;q}O~Tq^47{@XX)a<>g0-P^ z5|dvX>2=GVnH5(9->J7OP`jXc`i#6u5P!cim=y`^NMZdY7OLtCfYUENeU|juYJ}Yt zaGC1;pt@i~#lYkJyncQa6&-WODA{A@)gEG~vxmpo>tuz&;@by!+>_1Pqq#RbebUrp zt)q{UV3mXo+~z&3&|)DFL3V1-4|FXizm$IPKHgnEyemyTGhyI;u3og|oCkL3h)4#- zsb-w_b=YNQ-8bm{S5CU~T+hvf4v}Q*-!B?&%x@+P+>FI|$S@Fe8wIdX5nLuM55Y`b zyHR_BV5tPV9-&7`ChF`QxN*fsjp*&+w0_Lkijgl?`r83yqxOtauO3XN^nMzju0-Jx z5=QWF@N4uBgQ@Q6kP??H@?t8-oH?%M8BhCCP!!|9)-mcRQ6l896r4Y`S_YIu%=k%ipzb2I<#K#JIsPE@W>&s>d6+}( z<%N5qwXI#AZS{V%$JutP(|ERe&H~t3P&jB8EE@SF-uq!(hwza>ZVjG-@g8d+%lEGL zMLXfO`E?9bt~I?G9M>ZM8O+4|F%8F60j>E-I*dvNvv2BNARgro^d1f3CJ-FCo*KSk z($TVJF>3JN0b(V_Fp9~y0NBnFvU^;he{a##_ngxz zp%!^ezYNmucs{H2gHrQ8#8A$pL5rt>W!PJ%&n_@ZZpLM?)rdpLeH zDfbDZW_B_RYP~FV#u@^!7r~4q3F6n8;C=(71*<5waX=C!rjntMS3KhhRwZL8zH*lZ z)JxxUUp)#Zf3x~9Y5a1=4}UOr#t=}e2fUoYoj~fbzGA;wbDGa4lc5|%Gfk{FEAH^mSoB*=eoUF$|sHhxo z0owk3v3kAk7UmRBP@HP1rMftbEC?U!SVitnZ4EN!zOVM{<9wy~iZ`tRS~T)C+sh?; z2F>o8YH~@vi8RM){(S(`BLYQ8CAz_}qMUL1le{ln=`mM4ssj#jnr;UP11wf$+oR;0 zFSkvSNNjpKE>~#D3X}O={){iQ4~v(UTf6M{G+Yb$?utHMeWBRWutF@*LbO@HUhJO6#XYswFS>J*_ptWfpYgk9MNONx|3UyaKnJepOTd)Xqt6)~ziwSa6~yri;F z|4jFDbB4Fw31?EhLvL(o`3(T0Q35#Wcf@1k1Rc`jQy_hfyzAP2yp;arr!1QJ?*P2P zj8DXq$+P3j<+5iea~(%Dza)bo-I6w(s|i1MB7nH;MJ2fR3ib4pErKW5A(Oe2P`^oWwpQTb}dEvaVfIw3IKjZv;brUOWE z^sC(uqX8wHeWh*d0ld^=paqX`qRd)1>ZRzd2f^W>Q0M^XcrThL5Chkj%|viNhzw?4 zxF>+)i)Vbb9u?Eh#}Ftf)#%iK*m3Laypn4)O*{>y_b!g+32Xw1e@Q`o zDB$5FPUB^(tYgK?;eHqgSv8V_@H$j{s-JjSlN5>#mt~b6hA*~NqewcGRz$8lo==?{ zf?5S-z)0fKvXG&udI)OGwIZGCzIc*S@bX}bEw?^L#0&H9LX*MbekX>b4XYRfDP4=- z`U-&RB~$AzW1vvcle;I`eqy&M(e18nd(*U4#Fbxscm_v7djd3-2NqvgVeh+KB!Y@i z#UCZqkmymZEY=JpC=aVdCL!NFHO+M|Dp(>-ZYbBCjL)IFD8FnqJ`msA(0=8)ipY*Ja?L163_|A{tg0S#&W@lnN&IR z!&r9;OQJuhEX)Qjx>}9tvwn3y+M-3mJV?B(xm!Fgco>T}*;7R4nz)uVT7xW5ZY-|8 zirjcTqFUu*M}GHdVf@MdFoi9n@^V_tsZ3#04P=7z= zIj=Q6G{VR+oQ=9A&AzMSJ0NCNZsSInV3Y zjpFagQui~^)+BSugB4}gT(Z6Qq>t2LrcR`qBHubjA#rV{-3%?{hJbQl>Vr_Vt0A-< za;HnWeGNUsdAhf~;V3F;mc++yXLr>PhTwjmq}n66pZ)mmr2f6!Hl`w47_Ym6E@2eN5q6S)^%2zC>G7_%;!s8as4IQ4yC*&6$K1!0L&T`@lOUD)x%Zc zv~r!(WY3dVU5Nq){huD)vaQ)Ks}lN9dv4j3cS-Z3gmpczb+TE(y$ zly#-DQT=lU|L?tz016kK%g)Q`;f^1@58A$z=2YoPe@d?vIMb^%bnQ1R%?9LY2S{tI zZ7F$699r>+w~hcDqf%%nPLD9u8LrdB&{F-%{@s*zuMQidGrQ4pIGY|218>dU_X&eU zv=CL|elKMP$7;Q6_q>)Y)DW@sxi;#DBc!#Pr`&V@*x&D|YXQ zk67#lCE$EP(8!r?v~kZ-d_47cqWT}zhf|T@cU1KdDfizznW}QN zoF)}EaODaZ116(Ipe}#IG#L`%MJ4p&p~&T#1As~7#P+2RD&{X5-AB6tIzsDW;ZQT; z_@(kb`5?JI&*tUUFu|JZSLaQQWaauK(r3qQR9_9ho4XP|zs2cw=5l%&#xs3<*&esK z>H+{HZmVHdgZr^RZ>I>jd)u!9@2buZz88C6dX2b&wSNm(Tt4s8xlfq)Cgn}l+Klw&YV)l0 zr3PA_PEj=2As<~YPlZNwlOkiv?afX=y*gyBCIw;o zEMj~5_MX$!_^VedHir^&RiQz9x8(-pLfB1AsH|uI}S`bAKW`IPZSe4Qy&FRlEDhjwlbq4C0boOO{t;A#`xyhLI zyl0BzHdV1e!zS57WTleBKoM>a(4ugvA%!k!p8Bz+b4--#D^bvE_xkFzZ*l>LR=|q@Hgu*44g--9g$L-j&PI1u zGLmIZ57za*Kfm)};c@^}$n*;D@Afb^I(8j8RupdECJfq!{3s%t4-6+o-hNfgCtb11 z9WfjQ`pD8B;RNhA>m?v#7>n^`5&-c!8kmSc9ux8mpXy9P8x-JzE?Xa%k>;i>gW4Kq z%@1Or(nu{g=m*3O>(&j+(ZY|+_?v-4Ihx6;7A=5-6C{py8 zvPcH5ix<6aYyB4++q0OD~2I6=5~0_n}N+*}*`%uKF3Cf?G>u6_n2YlKtZAciv1x2Olu1MXIq(Ob4{<9sXaG90_yWBVOE^d^Kp@J zKw?PI6@hi@MXP5srCcsshV`*C?~y`!c94#a1e{M*yMNCG_s43va{UY#8g{_bx^s4Z zxaVl(K?V*=>YJ%eeC!&A6PA0U*>u&sx84-6Pp8XM0NNlYU&f;}tykKcwg!0hBwaO2 zpY};48f2-^*K2(tkF7dE8nPhsF2`W2G9Y1poSAL`UrCow zSTn1tPFAA%b~>2P8bldX3aVa`#{w;6wFg%CpJ}qU+oAZCnWXcf?u7U$;~pVV9Qr37 z&$xyNHa#bV<>Pq?-Z(B+8 zl^OZdGW-kAlRf2>A7Ff~xiIGNcHWba2hWh7^ayWeo>C?=08dxiBu=`F3C?qBjZCHb zc@f@A(PIjSuM$=mDIDW|E4_WTHODO%Hy>0l9l4y!9Uj!^7aGF#NG}fO_4{5P_5j<_ z0^pmJ4}Evtlx-UPuN}A-XyoZo>C0ZUsFXLdfrvi{JdH%99@@glioyR)9cb&o031Rp z_?Ip&a50pxzzpS9SV#H{^DaQn-vWOo^V>Ata+{sA-CmZW<~(KC`&25}6EA?9TI%4` zjLsWbfU=y~0)TbJ4$BIaDJ{aaMfj=z7gI@Ut8p5EB zk~qew8x-Yt6;3Wt7~cDBH%UGKXkgR_zXRmlZuJBPKxulsXeQMM&qW()%D$*>i6n(K?<>I}I#qb-xYVDhLN!;Aca4 z=I$2lJ95OZXe!hIOn6@`wD_p2VHsOWGPb}${px%#fQF++H9-xejxpu8)z!a=jj2%K zT}PIzypI@CJ)~}W7F*kU`;$PdHWca((U`&;&J?gt^s# zHo;DZ)O!pq7T9L{3VT;gVqbuVtr${E+?q0n7H%J(1I8e;7xQ^QVelc$-wN~bk+)B; zoE*{c((2{4j-$>)zJsUK$)d8+tZzpQy!AZI3~z2%qS(rNh&1k9GC3Nay~25L^brLo zfm3WW>ycQBN%gN4nn-Z!V1M}sP$1^OBI~fGQA;Wo zR(U4ZJwvE{x4h~um8z&^-!Xoil68|2m=cCYZPns!Qod`v#J{(AU4mRB=FN2`x@6CT zxZ4Wvwa&L7Z*iBbSkbdnD!aB0KC^)@u~|`Jk#!yP5C*(Me`vN@AjQJ8gs6yD$qjf=CKBTY{jKjpL$f|zxNc^4uX=&l5I4DG?G~ng)#w> zOfPzIlzQ^auP|u4)trG!1(nhYbM%Dgx-nBeHJIJLz4u@h^PlgITJUVq>}qI!@N9H+ z|4NE7>$huE!7yv&U!hqcZ3sOhXvJ3bq}7@KNS$0gehb|f>+a01@@3f8!KKvhZgeuQ zg-UWV9C~Nlw-B?41iffB19bIJ6`U1BZ@ia(sNRq$`nDc3xf04vllh~UXcFD)1)L1s zPnyWz{tW7K+Q(~PLe+MTN^sxZd^Ql%WlQYl;eOo4K~2l~>&t>Is-|T~K89%1jCaXJ zElST(tsnL4Ep2Q9(&S@CY+793I~(L=Q|?C}(MN)d4)#Tc4_~(jAaQGDB-0kw6GL8e_W#@$%2nFbLJ9^cuRZh#tQd!A#^ zVLfi1P4wm1JfgpzLZngKfQo)Hd%#)Hi~r({Q_06#7bQtft%`_wS$6#+W2+lp?RXla z+kE`cE<7l?{!a8BjX0{^9E8k1M3xsz3Q~EbL)M-*Ce(|REH$vE!B{EIy$q1 zRu54$_hj_%7;J=y-L0GorgwnFP8MHQ+Vrz#dAlZXJqnPH&!^UsL3_KEkPYmvU#IrL>M!)uFvD!Rr5Q z#WvSYL}b2%5pLr0Ozfd=j4mKAhnBBE!o{dM>}o7(5IZ9R%gbrn90#b2sl5a9=@|la zlvIpcobdWn4AzoNKi;5C&i8NZ0*+6-=U5CBS9YAHeK1<;&n{8nl5cKiZ_`{tI@>h& zZAS9$KiP#DnAk+`mf>&mT0@KWcsmV62eun=Ye;7k2uW~@KqIwCGTT{hvO zFwd=O)Jsx%jz=C;GoEO>hsgP269_07c;>B{<8?m7xKZ~Xm8Ce8vzlqoujc#87K+a@ zM#rtGD-g6@@mAMR?E)_{De|V$dOy)B*BNcp0t_;$>!n8b3&iBTjhbR4&wVrS9+%Aq z%=5xN)bpTnS#Mc!RY`4$1@WH6<8p+waW110)_h1QI1xvc@ZI1ji;ei?-S@(3dM~Bn zI{H9WNQfC~%NMr7)`B`R(e?h#HI|9#YH}(Us3wML{fy}o5$G&g3QoFOogda5^|*sO zv~OSd`%6s!K$F;lvc2P)4Q;)aiH20PrQ!S@o=%Lfwo`{@(|cM!?COR`JhPiQtEAtf zbKPHFg$2E_wlt$7^vAKkZK?4{A0@Yk70$M$Wh#yXS zl#(-2>jho}+vykdw7O5mWoRRMufF4()?D(;Slx~;C>Z(f>30zz(DudVdnIo4+g*>{ z(I+NeNwKDdn^s+krjw!FPI5K%Ug@`@shV7yL?pfC>lMna$^v*jb1w}NOtO0Gho`mT zO)G)S7g~xeUj9nwq{y$Hp}Y#zhrKYA!JjDGt_!u`JaXh9^IOJDe>ihh?Tye8ccyne zb~^jJA@&u}WHn;l!WRPt22H5FSaq8{zze(HG!GB*<31{-#P^5NLt}1n*PmTMp>n#-~M8MUhVjPhbZ{?;B?a7Ebf!Vp3G(ioc<99wYl*rw$? z60hyrD;DFZY8bahma`)pj$5Zk=W8TSg9KAGLz*tH2A3xZy-Y6^Tg;)DHT|?YxV$=V zSXMtFT0cn9X8vW&R_HsZE5FiCvjudtUV5ik!#Qmu**OA+=p-R!3;i zmrNu=P?l&n+yWz0yfg05Km%B=q@0gts4fgr0>|Kzi}dyJvyk9ys;hqugT7ZXctYln z3-JNOEX=Txk`jdw2Oc>)r^Pn9bweXo zz4-PPhJZ7SQ9`QT4=4Q|4es{K8ALuBglJv&t1;pmp4P3YSAWpGu8-*-wt;a=N$90Z%$SXxliQPS|)u4)X*+~!> z_~2(O0mew}Qe%rjeJ-n?tTB}4gZKHcu6az?ivg<^Iq3J+@s4W#4k|6MRQjCnknrAv2Wj!ZnjBxVSCU%SVIkFgON<+C7up5o!q&_)e~C5xd<`A_=xW~51%m5wKxE$Oy=X)+TK25BI&s|2STuIzA!u`7IY^5Tt*Ie~g zI}AG?nuggJS2^-Qc!T5DB@!H(@ENKm$!LB|k%~aj=>R3e)#Ryuf(VAiMGKZ`^>+XM zOf@DgMs3f$rn|@R-Ful}nq^{B30K_75F>A^JUN*;$I!qe#48|ZLiLM@$72q0;&ddO zvUaikC=c_P(|>tPVKo`b?6Hh*OgGB|W?fKK1@(5^$9o4|#YgY!szU%t zI3BMijNu(jZUl%O#qNv6LWG05pjq2>VZAgS3XQTD;-6;u0(<#A6ySpX*KN~}S5_UP z9hOdSxVy0V^1)=cYOfvAHepekpgYd%`;fgZa{An62;o0sg_B0=zs0g%vEn-H=AEQA zFv;)yk>^@dxf#8=$uoIe^OAvf<9^k1TZyVh&%E#30%k|z5El4sD|XX*!zF&u-idcm zL6LtUDlJJ0BVe0pEUz^&sg$UZY23x6_Zv|Ny;ZT0GaTLeI$l~`; zD00MHKH^aAR9BmSOR9ArTZ?oMjdkcForvi<#PL_pT|lM9IuvX%XbrF{BVE&KJjM2G zGS3xl+|#P6nk2eFV5QrFM@*uZz{SCz&Jz zsn~2_N~oqt*PlEMTny9jp%NxAZ@cj?GR2q_dEBeU16I=RYd5Rrqar7RYEk)7x8 zP`2pH&1%iUCSg}`aA^&`c-*4Rk|@<=se849lk}d+%V3#N*Cw5f&k@9n-qFM_2w2`D z|Ke|6G%3K%SmK)rn|@4-O$7`3>_>XA&zon6dPlK1y4|04^doufHZ4nsFv@3I&e8H| z52BSA^;$1fmTYf%CfmGc62IkIJ~(&#w2iV<#%-$+sEW zgJVg3cfB;nAEWIG1HvY)Au%e${dtA_8p24=#_9jb<3m6TP6v;@Yj506|7qcr(8(Eq z7P2OR>gUJp?~zM^)L!90K*!o!yXA}3;0)M%Vp|3P@pJD)Dykn}AGVLtI^hZ_{ghkA zYcY_?Tb{-lMkUOwWkcWuTATB0DjZUE}ogBE{R8XrC zSh>6KwnC$DAy@me%?&yr#-S@ZNT zM)dMXGLgTNFm!w}i(}O75Bu7GZ>by#Ed^|B?RJ%uz1BdX9CkrD9%2;8Uf&BlE3hq( ze=w3{(klFr?KaYrXg{e#U^UPZ5&?6yw;1|T3LE%ZUhQ$G>c!JPYOH^MMYidgGQs%p zUSF7Cd$?~VhE+e;DS_95c_@2C>2%stK+js(d4+Bh&s(wM9h=oPSo;DH#V}LCqvU~g zCe)KmKp|Mn;xI<|-v|CF6yQo03s%0>rS$w${0emk3$+I~~iNlqaV#KgsRq7gew8fqq(VtlGUCD>oPW%=8s6 zpfl70$BIp30JfpqFmN?7uWbD5vc@QzBh0m5ig<(pV6G}f#`Iyuus=iCUxNI@SJ?%-&!9o!BND6od7c`aO8`H|zH77C#hcp@FcLx` z(DejqMTCeU^-)*f858`QxvlWVY>Lg&>f^edk;|lAvj%jI#jQI_*IH<4KW^6%RRMqacTbTT(~`xcqITdd5-<9Y60lxtJ)Tb5f4W$GGdOQrxX&|y~_nE|2q7u3e7vH zL1V~kf@(u%vLuxmik}u!{W)xy)+k5GiX4;QsBRsELX5G2OtvZd?SdoVH<~a}KxZ(5 zs{gILq69H5Ev>a0F?~uRnw%^#?ULK09tG->A@y7j8g7u$c z@-KCk*li>Y^NLfO_|I(*$;SWVH6e?#4Z2$OiX|OJ-2F}mIuFFwVNi$RRj^|J`_|W; zKLk78;e6(9{J-RFf2>qvGc5UgV`oVZ)JfTh~k^$(!VcV5)T4PMHh?Dt8c!qUeD!0@1CJ~P1hPj(h#3}gTUytb>E|JWi%S{SKH1(a;gE^tg(FB_QyF{iK4 zH;$4pPnUr@q#MIxC_4(lu|xae!#e2GCcik}3wmLwB|Cbr1q%xU#eFzu6m%~ZtsH2^QNW~7I zW@qn(?FMJh0^P$qpp5STyZK^jm`DWJPdmWB%=4{bn#X`mkG$u8Fq$WRy*do3X3%XEvH7{Ev0{!7yj-nwlxXuk@)be$H;}KC0j$DczMk$iA!vvpvRA8F zcYJ%jA4b$S2!0Z1W2j}n+`|T19BPcf?U9;5V7qBY#fN?HPX#Utx;Rh{|J*(Q_}ce? zM!%%=rdXriS5aayrnkw<-NjTSp%As`02GFBcF#NQ;Y>MTdz6@K2@%2F0^%|-4z>1k zqeg;`J6bcObrH9rZ!nSiXPS*VnlCt%LTayAkz|yNE})=qgI2Vz<#h=Q-2&6^K)1~- zn74O4zqMs+ELe&oaB&U%CJ+$5gY1GM%M>;)#jD1iJU0g#2oz-ubXywC`%vkvN)!%okH#Nnt7W~gbH^?+19!vM8t59-PvUsY7rq1r&N^BY2Pu;PPR9xn+jpj;YW2 zE>J7#_9H@Xd7k87;!4VUu`1v-stRGW{h;-V+rEp?`RQ9}8uNUQ2tljRwj53rzS&uh z`>)jyfH|`ttF_gHSk7nNhVon+%vSH*xC=9Nt*O0^j7}@`zB(bh z%VgODUrr2IcGmt1cmML>0sVCdAXbzgW?wgyG=_qg*Q$t_x2(-rXmzC*dgP zHlv)t5559(l(;`=cR+Uj#bq0I&-uNf%gxnmb?#ES#ZTG?*{jA36>LdCkF>c7Q570JAUApUtmcdvQ_ey%)booXjs>D+;@R&*ju&4yq)|6nBB=X%$J#q@e)cR^0d;e!B9<4KU_eqaqKjrfcr; zi{NtkKqE0m{FwBAFf@@;zR*sFd7iu=#z3~Qix6}$i-JA7Ki@pcRKw2*1SdAH;i^c?jzYIz{Mil>Y7sJIEp+OX= zFDNw?$TwY9X?DY=FLjNYOABvt88tv6fLnZ@6OQp(>7;n-lijUj`z~{pas_MYg3U=< zV}yTkfZL@+9OWsA!!;VS9za;XBZF561-*#`b`fG!bhsCievQJfhxnqQTx|rR##G}e zv9qx%*UwlYHyP1_n1Dt|b0D|Sk{AJuW*ln+v@LZsLLb5NO5~J`K}bF`iLv`Go=XuV z9^0@ei`j6U$7PMCj;o2RX~T6juUrjkYF-U}+7e2cgL3CqD8AIq0ch%voPrva`hwLydnDnED*tC!oNc85*d)rM!GU4^vik!LjY4dHFkkv37)K)hG+ah1$xjC^X za9STuDe?u$tvcD|`Wy@@KIq38@=vQu3^%;(by?)qv(+Af=00g<529Py(__UyA-;X| z+bOIsHCl0WIX*)wvT|)qj<#lH)=(Hmfq+KsCf%B5o{svpdow#glXmM7rPUoRHthPh zv6dK<#H7)fGym^0o5lS#Ymh+@CF^mirG&w)aQSMf> zAf%DuyBvzww5HJ`*I4@T0`zB%ZKpcTJOuVsU|W2ksVLXfR&T!qoTara)FW5wsYfs+ ztEfs=^4P;(y8gAjvO~6N7h<9kZl`;D+g0-3L1x-yz(oO`cb*#97*cZSBW}MFn#t!r zd>FxFj>n>9E~q<74twe|n5Fk!Cxodo-mLJ+3O70Lk>k*mNthGpPlaIGUAkmN#i&m2 ze_3<>lF)Q!e>ai7i&gi_!!6D|kmhI)kY{HHR#FN($+Y%NKEsa@;SjMsN11vYq0_lU zCF0R^LO-$V#%cO&&pb6Z&2u*s<1JVr3gVBU1`|o%FOvi5>AMF-nC<$POZ1r%7WJB-k^Q*)?9otR{t% ze18hZ_buL!wY*@^Io7rK^}uJxRSognL^1i+(QS3AWI;D|j&l20Cv00<0fz(XBzO(N zKF9ALO@Wa$6eVO%FzIV*D!%^r!6JwEbGZF)h&l3l-n6MKKZ>~Xc2Gc7cL38;yLQG* zl@8Jb9j((mmCcD}Qybr&XUJ7o>6ab26B0!s;(wF1@r{9Vw?Sr681F)JDOGV{SYQ_L z&|!Pww#e{-Z1tV=4SuB*Y{cex8d3ab4Yw~((D1vT-HUZaXQw(GB4c^*z$OZxfcXva z?p!lzQY4?%Nc+LMaBi7OmeY8NO_o=CU^pZ!)p96X2B<=(6#-W*o2baZ!c1ghnM_;Hjn)MwV^@PbbzJNilSVMO# zE!%P`_tp4;*8y6V?j?ciPL@7`EJdzxxN2z=CnXh9ALFqGXo=1r~>S?mA(JDD+ru1IjiO#3vSfm{siR0x;`hr%&*6&zi z3YfVvTq944txu=zPr9^+U}d$|N0RHJr+cZX-b_mX-I#+{gyX6= zQB%f`;nL5r!)F|erl__QO~qp5WUwbtL-GMiPE!^oNlKky_z}v0Djm03)jdAr1%`4| z{$vr)2mF_%&8dijnj0DEhVqHr;!C{=Z1|#&r51%Va6Jx=$xdNi%jc^K_wsa0!(S73 zxvnt><{ET`EamDHA&29R(w)`u5NhSHDA^WtBsdh-xBRfN{#m&H5urme>l`wW%@U@tvVvFaGzUmaO&dKGCF-Fo3_ zbrN9_c}Fp7_CB@7K-bQqyOQb3DtBjq`DI=Gt)1b*OKsJ!bC05A7C-5&-r4Ejy|*|f zBB?e(IjH^Fjefs>UpRmx66D{mb)Wcb;jMp77C5U#SFzc zXV^5p^@4s%nLDm|M*`zWvy?OHI3iYX{d?)#OHY_g-hpqFaY+=TzFev6Nc=7zjut0YwBvGr4L-B)H2L0N_I3Up(5U?j<^7ih*BFaN%uTG=nQy6>ZsvgCRl8) zyzN+cLjzclqB6QG9WFD4H1qU1@QJ$^?on^vu4UD>K=bcmq<>BP)u`rw~xoKe^mZT!fi( za5zu1+ip7_v6kPdRENKSyAX{{{7lzf=6hqP28JF_n9nfw()Zu))$UK;`9>$1DXvLo?UppQP>z} zkGfeiz-LwFwWaLWd@V<5eLBY@Ys-1so#SX)oYs#IUp1}fc!@k%ZT1I2cu=# zwrnns-s>zK(CoEH*ZX{5f_$rTw`qpfh>ty5_7bSq{d~=a)T>REj0HcBnO-U!7t2g8 zQqrf6ic`6J6ei}M@plki3SnZAz2hI*tG;)$c9xQ^ph99`=5ghKf_0;y$JXe6A4l!R zm$eCzyRsXjHKi0MgV-Aby)BiFRlb>>J?j%-2SKbJhiQ@oWS%HOq{RO7qQQm>S&ut0 zn#hFTzIQcOT0_@S{cvc+ATTOD;$y6D6X7DL4b;b1+qYIi+f#uq-UgVxR@gDHNuniy z(9mAobx+99yO#H)NSwAQTi5$++kAX4lA(OUEHK=B$KzvbC%?|P?zQe0pUu?w*rbF8 z$+@VdusN#2b)Oa8_cLaA+_pn)r|+FMLEso|_=T4mTJdF*jo7lUX2^^<)arXZHb?d1 zxJ|i5_T@;~PEOU|_wSf!CeiUIwp`EJ+q=EC1&axVjzUXBFo9LC!SUkzPMf*&sC4bnCQlh;iPL z=yiw?YDV_-I96}Fc&%tUk>No|0KNL(*RqTobM%eO9f-*39?xNU@*U7~R`F|VGNXY8 zYT7#KKfcLmTAetnRuL_u=dWO~XbOcOUf*?{EC1_|R;9#~!qi@~ z7kexnkN&>DOSUMCjz{Y;$fJun5@{7SX$lu?oUokZKx&Rp91a0A^JOtUcLp(HV4MWH zZj6%*6ci4=Rbi0yTX~U3Q|J+Cdei$q7tKflM@tO|eI1qFAE$`({PU$fwb`FbYj|qTh@=L2T`{ zhebTz3BpNDl&LGdn%LXgos<3hY+@D5Vi~zG+$r>vF60BX`%XhXQ7MZ7QrO9k+k~>$~s89_g%+5x*18Nb*Y3bzM|n ze^>VR`v2D(2h4XR#;rOQi|QJVa=jhA_pzIM^-uSTXU1RudSm}wZ*|_jVviJ>Wu&QA zDTxx20wm0J3%1_g4}06E@$XxQTvRi)QXg&;3m*-?A{Mmsd!AJL%xG?_{rrpL>X!gg z{kyJ0j%Pr-EPP=J9@eyu7%!jh1Bgj4rPt_3z9et?VRhHv-n8psVvm@e3fpGGvNYqa z!=mm#-*8?2N-6xJjqH5VdD>3;rju67YIDsuyZ?{9uMCK?Th~_UM(Gk!X%GbI5)hR} zaulQyk?sa*rIn#uN~F8Hhi;_185#x{;9Kl{-glq9kLTz2@BABt@tJwndhT_{6Nrx6+8s03aNMH{s5GMFu>l=Wn}T4P zc;#xs`hMoDYR5VE@x0Q-K#QvOkeTCg?JeF(Cxd|RA6oYoW`}-eXu9pU%_z_~*yZF` z$JOjD2F-AFvk?tl1H#<&Mpn`$=$XEE+;u;#86Af_N|;NPr#fBy89j|ZRe`P2mcKhb zmsbO?w)iGRYCWfz42M^5Jvm)}L=aFICh~NG=fKF-W?gAK+t&CL9Kba*)jNwx&T!{f z=gDr!BGaOsa=PtD1Y+9^axwFv0w<7)0STNc(5`KwaoH2M0G+Xg>Z?D7q@Q)DpZxSO zjPN}XqZGT5{JbLF#DZo)^iwW=oy=K@q~EE;JZepc(!ZKc<-g}||B(sUhT`JIXRGlw z#l^)bh*$yBOw)-%J^r~=gI9d6C)-v@uP-fY2iYsb(KW$#=MbmpFFHUjK39 zj%eR0gQd!D^T(RJ^MTi}8g;4UGVm|{Ow$6;eJtV@xG=qRH&R_jE6~AUDKRr zd~G>mn#!{F{tykal}NO1ro|a5m_Ao#%Q)V4EpjzsK-WVTKuuYGGWYY_BS|3UxoeWu z>>yT9x-n3n7|)e4&4RJ@AU8lkZ~y+mwW7#jZjI}FT@&R8FEmn288X?6_=1KLm4x;wJwSs!?9WgyJMYpQ z5(d%R~5|Ni2WnAf|f;HY@Yoq^Rv z*1PR_g>@0cULF&_9r<`aP_5x2TV=y=)skB!Yy6$7x#Ot_iVqs0O4@7gXtsKUK3!+B z2W3+OMesMP<=5uc-e;sJ-xz21OG9FX`$F^~)4omiXBedj17f6$*mS$wVCD+r$i~zu3&v!l z1hdVauN+y-#GR*Jc$uPpHqoTVg?(SWgT=q_7m4!fb?mg~T%E_;{a4L0%D@8< zPbLuvr;XCAMN3vN%aiiXl;>{GWh=4qgceXI(C<#9`e=?QZk&S|tVHSWH~b1cN$<7M z4yX%QhiP*3iq1*bteV}{Xeu;1i`jZhbND}xa)@TR|LMT@ItzH7h{yX$o7aA` z^epS8RBl%wYyR>FByYIM6$lVwnOu2Zj zik5@342xd@|C!#X`ajQ$2~>*>BzdGztyaJi0mt24j%kqa+t6uakxX@Ft^Ln;{3D0l zAo{7MQY1s0CByXR)0*ei^T5P7gS>?QzEl78I^`!w=$Kg)=>M2aJ-GA#{q42-Sqg86 zRQ3Po%K!6UcqAKH9blgr7+3z64f0S)^-f%%nrecK+@E$Xct%1$6ASTlyc76i$o%sB z4aiwl{_pL73@`t8>;7-s{6{Vee*7Pg%&&k(ps@xd!WZ_q$( zz)yE>=P{og$*Wq8%lEv#id49sw(YkE$6J!-hghSVj*#|-9r2t0cD)okOs6)5#3AMo znSTV1>$`W7J`i2$75+^wf1IjBr z_P}eBdu7UcKmsHVw!7PKov%t6sOpaTk!Xtm$kFE12SbbhisR2;-q9{niQ5113kZH*y)FC%M5|w!J*r9s@uL1orrwBQ+Eqh#W|-oB~~gRT_=k zrv8lpGo!LI4Av~JOSS6nx<&Otp{`%r*^zGK=$O^<7M~Su{k1~bNFfk_wm4+3u+|B^ zn06O?uaol&t@s{^*O~7vo$?y{tyK@8BcU1+rD;*c+1b8}rDCx?2}DyjqqJQ%WC$8n zC_ZM55lsNc$r+H#ZY$XhFtV@$JgGIv^&2FMO2B>B;H7B$?-@K3-JNT!HiaMnTVRma zc+Kn}=r}d(em;l+KkOHMBBR1qIe#breMg_g$d|R5i9zLUVzgiP?s}a;8-a6Zg7UPI zlv~oCMwY@^=>$gua%iV?SOE^G;5ex8+QYt-i5n!@G=LPTsGdw15Omn(0}0eIps`{J z{}J@W2ImRn>h&w}Rt-C3{YZ`mhuqHOr<}Z6?-~!5`kkIQp6(E8fg$&!!B_Agj(RKB z{K_9wRxNn%fh@~=po${NdC(NN4thCdAL-m-SKU> ztZV-b8*0Rud_Z`4Qx1ad;_=!fglEiZBkec>7NOEB$o&lm%7glfuS3bQ{-~yPohwN0^vGZuRD`rXQ^D&*l7@9&Q6b zm4ojV(AN1G6uFz7m1HwQ_WMJ;xpxCi4Z7lFD6qA*pJ}JEq|U@xjKDYp>DBb3Fk$5; zzWy6O;dKnqOe~xNCFR@a~<@(Qp9ZB4A(wgio6E5PMx=7rz#4!^99rSZZYr<4OPx!zvYexM->G4d=?wq!uWGV0=t>{R)5jH;k=E&2X;vUDvkr+u-rV4PJZ2bq43m-z=<)tDoscZM^A3)rRP zH5E$AIfJM(HATQR`_Okuv2qd<9cO>z)4)Erk!tp^myIZA+ahem=?t579d4>*zG*9; zt(lsN#QZ`j3Lv#mGa`U~Etm0>UU}1dPQ0n*K}-`pN}1fS=N{e>kT&-FiL3jDG(7^` z_kl$Fv9}vfGWu3D?>|g%m^6VObaN0`$7cH4nC{ItWtUFqDVf3Yu*rU)K$#&g-^Ra) z_P*!6#Y>oV38aY$i5ac=Ge-xb)RTa^3#tQTqSf31#Md?B{b%`uQ{htGxz!Ph~- zUxz&&!z<5cbwHuh8u z2iZE~$jzxzKp2X`mZ9``5T5~IEb%Q)0X*koj#K6pey&sbWXd|3FJtH8!MVl7bk0Tt zH&JO$up5$w|H{e#HQ;eJtzms0m2bY#b13V}u_$sO`#Tdbu=;2WbEK2icHcfMPEZ~l6FJbYPqs`{yzw$Ik2!7Vb^Nxx*?Iv2Z z2On$@36;)unU}Zm>ODVcH(lZAic+dKD%vw6(=@XlcTd(9zkLiMZDp94TfYbo;u~T5 z#cbX5J=rH44ZvF4UZ?N4Zd1SGs2EtRRJI|bXD#a~*Eabe&59@&eIh3Vb=Jj`WVi2v z7!09o#rE~V7yS4n1Ha8EJj@8SU*K^zVnHi+WPyBP%b6hqfBa1U8pc|HYTSz}3Y5|* zb5Sazh;z|nt|E4eCq_bSI+`DhZMp*2FAVxunFl1w_e4-0>0dLW_vVQ)`z`(0ldxLth8O}Zj#Ji zKdhv$g}y5&L1L5xx0rq@ebBY`PHDe9hvjLlW-i{de<{`0HoKB&~N`@I%F!MUTx}*ffSMA@Kp?z0o>u z@M`$v4Eyj$0X`dqt;O_Oa;5#)RHJ#}AOqcW^OY`iXmTNMi9KE-B-=F8b0>OtdHkaU%EAVD1A4? z(v2mAz^AWq;2-DJw#Hc@=}zJ1VOGB{iri~S?cr=5YD))zXD`jn(W1gQ{YcJSyp@y zzjw?~h!8u)0%@*454AUss@5yGB&^%rx4EYk%HSYolXSFBDgLM zuf2}mPV{yOG+B&Tj z&CjE~xVPEKVrnH%Siz5ACqWs{#$S>mk9rjb|V`_d-G(JL*p(^^XKI3mkgXO824bJ#3q^4&%MG6QgAux ziJW7HLJ&os>4q*$xN;vEk+mtlx|?J&cTs7Tkb|qGby&mKxwI1kQ$IdFtea5&Nw{j7 zU-e-aK{0Ysw4W!29c1m>f=)jQxq_Y&Ga!5d(a;_T_cW-v^`0=-%rG8t}%!!Paq`u^+DjqHLmCneWfuzk2$ySygcH0q`QV+k5XLM(ca=A$EPn z%hqo!n&0oW=qZWY;t9RGX|lwDGUTromDjJkOag8AC}7`67|Rz7n9OI9vBUE$Ue@l( z{al&c;KnD)WFLM6}(cdAubPze?kl8EctLn z3KdMCzTO#Mcqe*Y2IK|V$19~-)@3>B=K-&EdfNS<^`Kx)%W!j?(lnBQl0S*Z^n=o7 zVZ+hTN+=nigZAhl;({e^3NNKe)bF7$D9k!^E^(Mee1;&4x9PF{?S?DZgag9>dR-Vd zE_Tu@;vIUpT*Dc>W>?uq4=35w6d%G)jdCF8>BY4PSa>SEBb|L;`D8E82+cT8)i6Z;$dEVHU zR?D%? zFFU2g_?qY>OCfff^sQYH_ITyqshDQ~*E6k2%^5^NG-M!!T1FUJy(Sl^&ulHVI2L z7qMYSrR(11H=8KbrRd~g`=H;3wnlE&&Sf%`j^Nx99oAH0Sy&#Yp860HzVy&%+Kpai z;uo|dHzXIg%Rnf3y4ZW{NzL|mhtEm4LCxLiKdu zfsC65hm{h_+^6^Z&gdLv~Wx`70gA)v)CYR;e- zr(}T_fr;4YphXR$Ku*^lHt;Ba!*C;ot;N7H9KsF~!Eb^vV#o8KCG;gqJ*XVnfVyKEv!$4FeH2RZ+`yPdla))n5V}xwjRGCD% zA7_6g$Y=66I;T&_ zo#g{{gZ;1TZ}$VK-N**V)!*BXVvCxxsLVk&UYs)>KK{D{e2C%YY3?igQsizkjhiDuW3z0n&0Hek^t(tujQm7ykG=>TUp}5m=?AUNMQ!~GKJ-y` zY(7cSv+fu29kj3v$uL1tCL8S|mFB`i=fkohcu>F9>~zo0psgogujXm1^6R&3vyHd; zY8sHy;_8i`##3$g61k7|19pm8<3&2E!o?&h(5J`d+!0qoUV}mPaPCXxhJR#E44>}= zWR%J8Ikp5!A|^TY1POi2h%&WSxbYa&U&JW;J0bH5o3Wdkn1>S(Ei5ewb>9hm9H5k| zvK@<>6hr0)IG71S+&rzm%nVU{nwdS2+47<9er4ur-3A-WHEotMwckfcG_>wQ&Di>> zHD5wpI0}f^5pRffbq*D z!JM?14(+hohL`n?@XYUVIEIxhI=xf1iBqXA9Zqa%?)1%o>-pRxTpQ0!FWNF&;(C*W z5cPVRW4zx1dppg?q$Y2+VI6AR6LU8Tn~}}j`vIXTi*+fIp;0=(N>-?5}w9!JR`IgPY zrdxT1ZNE>$Lc7!_awy?Bip7o&9pbx39BE(NK3ePdb;P0`eG!3}QxI~KLd8hkA`1hf^C-)<@@xFvsc)w}NC{~y*Ni=YOvB8IsJ;D|iy$jFW4S+DJ(S5iI~LyfruH;#aIqSXsyET`k}@+%5Jrt= zUdg3#T|Z0ckZH?wX=+0CBVc7*Af_~u;$?;kn55!{5LU=CA%jt{ z&N6Xe*T6a{O>@5mw%e70#h%Oq*>aP$buM}7b4X2Wira#yFAjFLQ$~*a3A2vX?FKPW zY~j7BR4n|_B#7IfIL5~;w!uYHGI0JQx2$}H;rv^hC5u)LO*{EvSc-MHHtYO4uiblv!toizAiNIo8_S)lZPo#f-&}YmZ zsyj?~lrTA!N;ZUWZ<&*%SE}MFSZl=>2w!ZM(7n&qC%2-t>7=ujqNhba6mdCvE&qtl zO_(VRW61gr8)L`{om>v?c9if~5nINQ8aLiRFTW#@fLLs#ffrkysq|6vvmfaO7JZ-{5icK}ez-MdQPaCm zc1i~}DUOka^*)-BN|J7H^Y?5yCV`JAY#-NKj=I3Mn*QO(Zr%mcDze?gzHLK2ufbGL zySUP|bQp!pYPmp*jf!quh+IpU=RgRC1l=Zv|y~Xy_~!zTEWO zF@k5-YgEU2WIXu_`t%z_jbV5`$vy-MVl>2P*gk`xZ6>T1JCTgTXr2;{J@07sK*$YY zH4b3w*eb%9EgCMFnK39@^*;$HpZ%2JM|Y9*$HhYVAj{Vm;B^7O3d(e$ev)rrxFD4D z8fkEbODp~L86$|_B~2`H&Gth*st<90FTzOUK-k=gDcNlCWr-HKA~%4MNvR66 z>42H}2b0W)QbJE{amccaF3QV(S_}8Jb&!q?EmbGByu)QJwi}KtY+axveaj$+=K`8V z%CZ$x&gItU`}Ka{aoC4c)0igMHOoLsHH!PwK0bH$?oWZll5Nz34%p{x`rPVPRmOx5xu>Ha(N|ox?Q!tk!Qi|N8Ym|BhbaIT%RSdZ`Nk zRh#@fQn2#{7)Z+*{uyWR991R(Oo`}cpR*+Wl_vlD{K@d)gEj>QE# z;Qi~x^RGkz>(@&4`rif_|GJKs92mBDy?D9yM=ZySl-8R`^desR;{P(KW&qes!-r{y ze=o?ty--@b8RhSzEARhny#L>ax(|o|R)p)@p!1);`9D@vc^m44lKr0x`d=3b|N2>D zd!)-w{(t%OVCiDOUqB8;+`%A(U!Ny`mRzs=hh7%O^i2 z&8_CYzc?|8NY7iSFbKdW$)|NhVx{6oYkN5R9sb65p|zD`@|0&Sv^h>QGaBRh!)pG- z_WG{6z5GilQIMzPh3jrws7+R~!>^i67^}oL-U%zo@q%kSfTxbO1EJC$SgF_nPZEkODZ#pkR`)rq=I6ozXDnQN-Pt^h6ZfF%HaYLZXjA3WY3oH-WVe0>T!0;-tN z!s`>(j1?{T=F?+SW)ZcjI~~T!w)vVa8yRb`tkCX;JjdS|noQR=-RyiCf`W8^hzy61 zycT;*;$9iXWZKT6kyQc_dOwp_fMJ~FdK{@Sot<@rMXwJVQybUX;+?Tm`3Jgi&hvUk z1UVoH&!n>askF%5C)k}j0@3wCo2~>iKMb0Q?n^)gg&%SE*$I`JELp72&50lyA2`}1 zi_-M~lsf!m&M{e)vV+<+VahexUCXk;9Sq4@&Quh|W`Ggd*i$1@;3@&nc#}3QMW#)d z|K6=DBi|@T-2%WZEo!3JX8@xY?yy;yMm5j=tx&nzwDDHO+|>n!-yk5^&r}&F?|{~( zkE%zx?QWy1R#=h<7(L1gK`FqT87I2OrIT3f(z3FN$6~s5r>X;P(O%F{ZJgvf3oP~& z;Q%S;(91W~Q+K=?pAQ5oEM|_!aQ16X*EbwC#(K+4W+sn!#^=lz&)!>IIp07PeYXfi z4u0O?B&WJrgO#X{*Q=tFKiNZmc7S2dQhONfZm2Ml^Ax~fHQ(4;nB>G;RE-`_*oFn` z)!0vs(ztcfSy1$U9Ls$Rk1R5nd25_>x0%4x+ORX(M+i<1X}m!Th#W5~IXXvWdsqwa{2^dJH^LmrlS_{aENRAOtp;@#^Kr$9 zGKqUDwP*9!eD@0)8lMd;qV@oGnUJ(lI8ERe63k&>t-3^DnRj5J1l{&*yq$lHFO>f4 zGgp@F+7t0NpMPK`bGAwrJ`kt#1$o}va1Zx_8!#d0A!EbRP4nwn5(HO9hN)#Rp@K}B zz&~;=X4P=x$Lj|(_%uTP+1gCZKn;ZEU_n^sJAj_DY`Eubm@(2J-ixt;yV5bY$ zh^5mM;)O~s~80%m-K8>Ki!9nV_T!|0K z_8U9A+Fg%|E{1s26&e6|O}Yycj(-`IJtMJbdsVYCHYFj#;OsXZsR7k=X&W#5(;?pW zSZOFQG2XInR0O%6mMxa6uiwP7^wiUR&i%x}6<%Lcb6Kw0vXWOZD`@sc@BvCK8ZPPM zjw8{@8P7R)__&S-*4j>k%6Y=JV5ue9&|*Sc$(GrhFEKVNGmb0@Cghm2AGg?~*nt&uc6&8bL#3YhYIb!9y#sd5mC)X&eo zA{COH&tt79w;mXtik#qTW(K;i4fivwCD}T3u2EYS*=1I6y7aR)gf}S)-_5i%3Njs6 zx;KcPm1raL5hd3tTur?T-run}Ren173Jt9r3{jWjc%~W^vdUi}OswUaYF1X`ead>l zBm-wbUiwvigL602aw}1&qp=hHfQq6hMd&!hwztr{ya}Cog#f>(V#cDz>I#4&Y?;!O z5W3l;|AOHzoc|MstCQ*Q4;bcoZyXvNKv*rAlH2|Ws0Utv(yR`^c43N>Cvf8pa)FzH zl$a2bn_zz;0RPr;Uoo$?v@?OEOxts3ln_a7iRN9h1T;`OLnyc>>yF1XvkeQ!$hlqY z`0w-Py8Rl|59+OZNVd@P&~X3R7gc5fDeSJ@Q?=wS#rI2>LRYX;){@vY5a~fJ0=c$Hp71KU z=tI%#lk2NB?ZbrA3ETep*XL1F76jIMN?$nHw-t0Op?u?~TV!lDiwM?!YhpfW=u=gOzC+*rL|B&326S_(xstg@ITB9rvf$dOMMV{~6{kila@)YClk zeOCF|jxT9ss~ys)S8us^7L17hW(3oYf8}=neC@T#aI<^U!h|0}mUO?h%%xoH7Br$< zbI8@an=3eP9ih%7Y4i4s5VB}shbYZUeh6Z(uw%QN0ge}{oGN2hi;iOSEb&M{8C)oS zi~1IlsYPS6p4#-T9V&{5`-;{^sIM-z-H$Y9h_5n?(zp`~Ni3X{W`qEvdaRAvv;a-# z(2Sls6pT!qBtc;7wJG7BSdD|6Qqy;AN8D+)er87X>?bV}>)VSS9?9>viJ5uzC)oGN zcUIX8^_%pu&p=TyttfUyeihT~|1h&J!PMGm3Pg`EpW^jS0a7tg4C1Sl6~ef>Q?im> zh7{>p*Dlr)Ha@oUokUe+#AeTI3wpTytBv=sYc5^gNsq5B%k~?udvBL$M#!|=OJjC17L*UL4Vx))cMB;q|%Vul=ZJ!4o1N- z3lf0wsjT5~dgVY!&Gcxb8>&I=2v^R3ytNB()+Z{x3PQ)k3K}v+lC=g%C|jl^JzBB= zCJcz}%(5aA?b|8f9+pLhf$TxU0~fcrC|2^U!!2syq_AfPZDcbTyA8Ctju6uO3W#w) zVVfYd0QeousOQvn2ldh68^a}vCOBS5&yM@ULd#w{j7$3Cr6hmaHV>3?NQ6GTu?9_e zw484!z`>|-J(#;6dktgOHCb|_2*$!1uti%dc8aY+^6&#c|LJx~Gn9qRPMcixVeaD5 z4SCUz^~bcwlsVlhK+e&WJI>ly)Z_z{Lx0_={}O;jaGKd(2BfWs6NoM+xt(tmE|QFi zwrD$v8az`smoRCydvwDW;qvcwSa2`cdoBnsjnI+bjw`(G>PYql2f$9tulKnRNi+-R z4at8yHe61lfi5pPLQq4>>W3T1q52|GhvDJ2{X%o^-8M4t8QU~;T=QDq9E;f!ixV-* z3IQK*sn*Iawg4mi6mv0+C8kI%dQ!ow6dq$ z{l`L)`T6_1udBD(gf(Ih)ab8)B2<-eQrGsK)XZ*`$ZAyvi~RD$=!Pj_fU_?qXbp2| zNZEJq3#>dnx1P-KFl*w!CGD8crA7P-^;6sp&jA3_>o>n$cD`THpjqq)kIaRLB7FpW z>}ouIIR^H$*x6h9SqUR)1S*|BXm9&)vIhbjpD+kcHye79wWzt2XN8d#Z z3tZ%K&&YCwV801F#=afJ_-fGm7+p{7kRv4EqOu4Y8L8MG*k9CNyvR@cfx_19P|K<5 zEIXqoLQjAJH#Ge&>>RKq{M|1K5-7)q){Gb6HIBN4+Tsg?KibL{?5;iBX+mR)Q1vOS zw4Xc8$7(sZt>|IdtHYX`4*A7+U`}`2Ps~mCi_Mdr7Wbi#j2n0%m@e1ur{_i;v{)Mp zOfG35eE4I$9nP#2@v9D7y%oOY&-cetB?AZvf~e1LH5bD>tr~i2BiH-{u(^jC?_sVG z$-I<)@qpp8gzuU}X2V+T9P7ER>5&L9J|-m|kGjiB?;h}>FA zrJp?Wc-l->qtM2r!iAUQ33)nY8$K#rbIyDao8;Vu7_~?GUVm=ARmk8MCSNNH2U^2r zjuhS3F$SU5-E1Xt2>C)=o~o6^Q{o2B_D5GUIA4?NsywoWW|F}Uvmbw?aTb_(?e3vR zO8Tkmu^PMLfg`7i=;5YYetF1+f_${KzYfIDkwr`7L9~{Qw9;w-%Jp38Y-GE~)zUMA z*YQuo;R${P+2+|5&hpkuqJDR8IFh~HnF@*OklcGXz0kN_q%KoL%R9I7c`XDeBNMg) zN{ZFQ-pH+D%IQY|iaaUi%CmB<@bXH_Bzl_ju~RU5oca9jcLm_MtY1 z#svIBZTp<|eMgI@qk@SWeV^k9wB~9lNr-p4}Bp~JfLTOKVi4#^jiyX z&4BBa&79Om^ZIlx9jCd>js+1kT?eT1eeM_;0Eoh&8^h%MF6yl(&@9Mi?uLfV66=Ql zESajH-uZ$IYaSG?JlNOf{LEr{0^sSKQ)^GBZ55rQ&*_V*A5a+AsQ>m}AWSmJ!;Q&d z4TD9QYj-SB1l&9G*!8@Drp1l7We+0Hs$G^s`1*KAD#9h~c4tM9eImTZXfGDqFYCig zF}uC7rp`u5&w9hiWSE{M{_^E;Nc^Q7C1*YU)|jS4g6O8NPP+B8O;P=?)<>Vl;<37n^mG{Jw+-?jlPB$8lGbLp2x47WGOWGTEL*a`*;cUkDAH};NO>zA5$LvIfQ-?`-C*CnMBC%bcEZX^}9ko*Oe zK;uWvB6Gmau;W>%;eArZId+|TW}IV@<#0(BH*1DufEr|6mb${t)MstvC)m99uFy4X zlmvRnPm)(<$mOz_Ih?6i64N^R*&s9y6M74iQL{xt_Wh5Uetrr25nKwezG0m79nG4~ zd?)JOTE_Ec=Hf9$1|9zVdviS(?y?FhEiV!a_O*6bFKeF8w4^7W%D;3e+KWsQeh*&XSg~3B}?44;IAsnbI5{$QqAJMWtZw?XFKS=X*7~ zOyv!XEmT-Kx%Rv01RKZXCdkb21J%gCITp_iH+)P}pM4nPb?frk@TI>RiqWg`W7a1_ zyTj6=mtExH1*0LQN}rX+FzVEvTne67RTy2>WVq`Jz(U(zT=)@n zdbWPKOE>$xK^J8u!~E>ryg$t!&^*aACBf8mN)Z=3 zM4-p@3(@G9l9*HR(@ zo#TLsG^Sj3PC}Y=PSbZKDTS7sCz_)VhrLv({Q?gS?Uc=X@t%~FVAohO`Nzi3u2kqu zBfmv`<>ck`n0c6qHacoyjgJaf9TE?BuY8Om%ToU?bv0G;{o_!7t^U?kne&sw{zX6j$9g!j-uyYnNM83k>peD_H#3z_s%TADV z%*0akW%Usmt%4J8TeIah-~@SRl)8VJ7x6BCXWd59a_GJ15W408o)~0am5rjtrPStx^$#y2SJuZIOds+mvw_y=Mp1lp8~Fx zEkzaB%$n}Uqb(i@7>uS}@LzM23DyI(Cd{}MqV|&=a0}&$2+iI(k0t*AI5)v-jdiv4bNF0;jFR9F- zf}xH`9NpLo59!1MfHuBFer8Bt(J@pRzr@jsrDgNwzgo%ZX~2wX8f#@Gh9QI8`O~$u z=?tS`$ZoCQlcojlS9K80Rp0~jm5Q@`p8E|Tr`^c$b1ML{mblU$jKG$lIup0#KM`GR zK8`VFnNOhEgp-hG50_SW{>JN2W7lCB6cCzK&gfxYrPf_OXS7c|Xc>L1nTS*!s5-|vy?cD*Qyu;y zpZ5s6%!*_1RBrv%zR0IDCqFN=>_Ym6Wm@xHjAXh5YuH%S8I#ZD)8D$S^7ZD+b3a~HPVWYIjSCQck$lQ}C z+0;JbMwme@cAYUu!m7?+{2H=#uo2PO=>H8TgUe5LwQ7p`olgo(MhWguzg$18)tT7U znRd*bIlK(%i>!$JYL2YeTdTVx2p#p@#>ztArPs-=UyRKSCw6BQgug^;eq&V-y%hMp zs?KXJ^?=F?&D|LK&)FiB{B}KIyzbL^4523HsziezOV)aR19|Uc!uk_~Jnxp?^!eP8 z1}0x-M#%1-A68bY+tZb90Z|&nkQ%Puub8hp5wxUCUp%{HW9JW#ahnY9C*L~@q{Yni zK9HL3X+8re$I&U@Y&lFFe=^Wj7osVTQ93+^azfZ!RkC~NJVEiVY>k*SBPCw$f}%~t z?PcJ3Z2-i{JH1&^=V5Ji^`HpzEu9z@(HP7CtXfaHKGKY4p8CQAwR;U5ZrN)&T*vI{ zXDo(MOP>qY_L^`L>)WBYVlkLSx-bo+5|@R?V|U$t_Z*E1_4Q2#npiT#j9lEdMz{o_ zNgJW6ctl9R`GSZn^MYf~iH2V=iREy|5t0VoE%`JrOsdNO!ETFUa1fmtJK)1%Y}U1I z(b$ym&6fP|*5L9>y~P?Ed+wA|{bN7gCL2^)&;g~)94Xqx@K4QK&v~sj_5CPU4xzuS z-F$Gzln>cL4MK>-KA>L75nEaK-NwzI#7k-W0KfmvP}8CxGqYU(QjXY_ z$-&*EImi!d&(>4%`pbvO06W2rnZu=y(`0bQmCcjzT=9qJIdzAavI z3fkZsE<_l(pnJ-R>orCbYuoG-eIAz8hQ|u}?)_+Ujvx9Ktg&vbI{9cX%yq5cd8{JW(&hoUho38`s)3M8&^!^H-6txKv;zh606O$XE8l96Jg)9sTL3Zy}AwQ67ZiG?z4=5t!9 zGe3vgbPr_<*B7ZY)Mnz36N%)QyI_B!k)W1;)vAk?gSBZED0@yYW+IKIlVDMQ@gbw} z5}tML`;lKiltiRzk~5aHx*m7- zP40tfj_E^)<6gq@eQwiQ{=8+;etq-?2v*9r%qg`(dzXDejt=oTwO(VW5g{oir0c2D z+V7rMx1pwpRAzs}YJ#B*bMvH)iYAX&Lv6hdp%)!cGTZ@ym$AvL4Tf=NM;PY>4Lqe7 z657b5c}w&@hR8Z&{iLdM-xZ@Nn6M7}6U`(F{-g3RF(&)(LHG8iNO3xj^3sV9sN|>J z4$6g{+MD9$?q5J!C5Y9&NnBt%uLMR|dWKHbve+w4U*mgKUnl}hOwr+wuMb;#BCH7mBNXZtI&y5<_OWL=x|lvp@pHBpaiEB0 zdZyOWiJ=qno4@?()uM{N$ScnpOQr*}&i};G+qKnYkQmlBA<8XY&i;pIx(VN-0SIw z{Y+in4irj1kZo10p|Q^BoGXl1Hc5GS+(s|YVt#ln>5_lLU`1J&5J2Gv!(m@$9)4)srhk1xS5u8&MV^SKQ~uz!(tw^h znyKx`C%wa&)lITU=gX$%IssnbNYOAgb?)NbWEh7)AMMUh$Te(}N z>gYrK{j1KhGdR5*$yd)Ok+a{(oQq);4U(DZA>EL5kq9JB&nV+!?F7fsSzK_K4Ym|s z12>Zl0#6aU-@~KZ$)Tw2yw786vCtuG`H)J!7Hq4dGyXOqd^cvshAIB|f+eQ#<<1Ayp;8ZM0N7~g&7i=|i0tQwJ151)Q-%)v&WA+eF$iJUz1<#eH}|z5)~Nfn zZ2Ly+iMndu^jI9Ckdp_v>ERP(;t8)R*RN$A`|{f~hhFM6;*fG!;W9WcaFlNTBD>i>ybg#K$h9u~xzNo($^!ZQ7>&prJ+0Q4n^2rN zoVxL8WjiC5&+W`8&d#*j^skC{pyYDK|Bt=*4vKOK-h~y(AfO}>5Cq9dL696oL~>Gs zM9DcvfnAaypnyclAX#$G86@YNktjK{WbUlzc=Q~t`l`Nr>(>3_S4B~~u=~FA&h+$j zKi&PbmSywcUF4f39z^J5ic<~Z=qA_CuHUz0C8LoX(aLkDa?7t{@ho=WUb636eSCtM zkj=N@QniTG#~7fUne{oGrQ6eW6%7|pY_J87bnu%0J>|qJjn;47@3~&{C-thCixotn z!f(G5`j9qJS%fAQ7^7&&oQL>C&9^n*<|8Lftz4shtKBRTqZq8mJ#BTQ1|vpqpRRUB z(Zk$`k}f!)S#3NQf+pAYlBsY<(V0A}*rn=O{ET}Zec|x}nZQLEzX^TH)a)5i@QO_U z>!5juL=ndEh z-(z7`3__lGv*?^EFBu1@H9wZcX-U`Ngx0HPjrXRwD)m)E9cb^$B7S;C!m9hs__Joo z8Dou^%>hcoMnMPjT~4RO`$^{^?Ys;&i7-h3WGltzSx<0`?6E6AOLkdPaMrXS26>MQ zu@UWKUD9!D3wbM*H*oY=2u#K379K^F9WR(UZD%dRZq+J>;x^yBNY?i4Ac^lO(R`+v zZ(GnTrsTa)t{bgdG43bGfncYMZ?ZaQG}iDf3ZAhSis){n@Fn62mv}yok0n)%4Z1Ak0z@!Sblx? ztCBmURf`Wu`coCN_Q$N4jFHB;r_$oy`8s7E6nXChqg1nee5yaalVjri>BWAMDNLLH z-1j0VLqIXLvxrUn30^2|6HZMXo3ilnZPnsM<3`)#5Pr2hNxun7^--6eMdOb4P_}NK z5gT*{%*_=^S1zz(`2<>#+m6QQFoOyM&*nCVj_MB?n$Hiof-Q*9(IPf4I`M0RX1vvm ztYVjWdNfb;xascIx}03QuqcD=9aqyY#N9Qmn5j2)rBHXpaH^r6-{Wa(i8k%g@9)`H z{V2&YGh;Zn7~&AaznG9U7T0KXZH>W%)X=XlBjPHIAD1zW8wt(VQwg8@> zIF>3`FCKbD@iAm<|Gt|+UK<`!8#LmIX0F`ks|=s!ap3k6X6cVArctcd3dUqaNv17G z@bT&}v|c_wefUn*{OzB9M932|lttXq@BKLiR7(Sl(Lh61 zDen9A?jeALyZlPPeBu}S64C~k(vr*pJ-{&%^Zh|MaRYP3HwqX?8OOU-XzMWpPzX5P z2!pXZ=+?IY>eRcc21qzeKRPc(8th`_y0MFrkG0HSu(E6}M`e~<-~2I4>CE84pA)L2 zFu=z=Bse>)YGD@-y>Oym1nr0#;bFLp`PEUeB`1(BSO!Ab*ZmPt|rlngn5 z%5k3V5oEFOc-HvWs~MYsX@c2!N6tPmOAHjv%h;DrTKh+X?g6X2uCS?PWXxMZ+|0H# z>ec8{NfnJF-mIxQLF@BY&-nb~&LA!He;Pdgq{?Wa@?} ziQIFBH2HKT=J4XgcPp#16DN)p+~0my`x$}MWyN%o()r0qzqU zco{tXdq5dnE{w(1lwH&>e)l@#TVPQKTAqVmQD}=_ZyRmpx7-QHphZO|?T-Y#gtV+c z))0zGGKk_-?##FN+&>c~au|K(BYOe550!%p(%HSQh_eE@5`cRFYo#&NmKE(?x(P_W z7k(Xz;vWHWgzl5rocq$mJrnV1_LM0!l;!;U(+!U7~I zN!|KQi3I&z3~9S0kxso|Cg^?i_4y=?*6VSjv~rN9$flNLAsg41B%1aKy4yyRh>e4N z7Yil~diufX5#>9X9#bDS39RQeJ_gm())Me`UjB2lR)9^wyQuu~88HSC?nyt$7`SuG zI`&BNeFexD7JgmSj6|rWRnK7BmIg??LB|FkZ0v)t5K%*$)qPN7m$EUR@m9sYfRF6$ z)APJkPo~9XF3Y^6d8tHx`2yUS)tFqztHoGEfKo z#jN)Ha1&19;wh(qzzfRmg;okcCZN}@0(JwOE9dU@(8shsT7tJ}Yo7_kh2tS~9|t;u z<C>vp}w;tLH@NkCJsHl;b9cFOO*;kLtz!hCM?^ET) z$(pCUhfoP!r8KDZxPL_e)GHz2rY>2Y1MWVXQ<^B=y?oKQyZxQdE7z+6~x!q~F*t^SXN2r(h?dCf0s> zz6$mussu3vXrhc0>zf?=FH9W9S3umwF504|yb>@ZOoFM2Y4?e>U0>k=0TSnr$Stl& z3ZXKz$Tu7lK2kC(jNst8(5mB{+-%PfAyBzD_~!J(3Ga5@wXcv*@dI~OQvag#`PQ2# z^y=x$qeq|kCkasxzFGi|pO2Y=K3AO1A~uc%ZBu6w?d8(N87aVeg|Xk%@5DK8uH*&W;67lc!K$wSJJ=n+cJ%G9wxg!pq!v5;PE2Eb$OY~+< z{L;W_^a%5<+#Ncyhf#bM+dFSXd> z2YJpx{NmAYCYls4c!N1rK!`O38qIhPUAGf*x81Hs@i|%$j_hxv&&;}sr>-Xa3SI$_ z=D`FuzYtyitOo}2o4H`Xm?BHj7Y^4f0903YOC(R~}9VcX`I#rS*@nQzY&p2sGhA)(5t57(D=CZE?bEogb<{8{XY# zrgpk!%}yuCk9ocLpYlX5zTo6qt_3QBmv&1wUAx+|zz}p&tT%oOd8geRnrv02y{SXh z{G4r96zxs(O?2ASf<^5{SE_$fKLNdP`;3=F*_q4OyhL%bK5Et?iqE-uSs&@^(XT3O zrdzJoIOZk-mV$<9$r-%MPB-A(r+{L=nKO%AtphL6t!+*9xSrU_e%}+-7j^I{0zkHO zwlf=S(HPN8>sk{k=^GN_>!Z;$*Q89vZvu}O9>(*WA;t)C`4Sb}m}4-(+A8%WurX=& z)oa3bDwpae^aM_|igVD`jv+=Gi`yygqled(HUpVm&Pe-CdM76S5?(_Z9UpmAlNeBl z(k!$*9@v4i_axE#-da;(kV)#pXBsjv%vgqjCf_nlHC8I@(-%gBbCi}^Q8)ek0e@KU zM(yRrS6;th-D$;mWnT{}U$kLUG2e2k+!UUY!-5iR{}e2Omw@6*=3}roYru-!q|FMR zQ95z}l9N5YJ0u+_TjtPh+^hOeeD` zw(5!GrE-3M$SZ?JGFscMt%xP`3aU6Q@_7D7&9Ebq(`~^UUUpansHlt78@8UiI0
x>>mX^>ym54HI2BwW5MD;a%FZyzPYd+iyIp;OWxENxdqmrHdJ~)9N=37}DZrzAN}lDVNaVX_ zI*=jFf4mU-2G{RiXu9&C7Soq~4x60!?6(v${itXaKiapt3RaipuJ9~Koaz;Bx2Iv2 z$6;4pyTAB>&h6|~b)&6h4E3^hh|C2#w&o*zHWza8oVl%dx3S%mDZ=( z&XAzy*2d$Pv@5j4?KeXSmS%kTg)j0b zYBygqpQzKfmhw?8Qqf4Z+w~7IH3vSXrWo!J`p!GZayGe@+VQeD>krM*v;R< zCtzAee7b64?nNdU1Njn(@3vSW?dX3w$ktP#yi?b)?1?Qf_vM`{Rr2Nf9!uE<1r%NM zB*J<3-j-ZaOIgkNN#z>?jk3oV_IWihaFTzRo}Zras(y>>UBS2A+i1Sup(70Oq6%o! zk-@ZQdG9n9w#-GpaJ(?kQ}*I4qFm~{V<+#%Vy5|afn?dd4Cez$s5Z1UM5Y{aZeht% zyK78KX|y?qq8^jB&JystZR+(YsZpA^%0-)5rsAR^*R`s>9@7GwwC=A+(=K+lyL;zs zZPF05CFKfd5siwKo7XlOdw?S9keZz594B;_r*UI@LDEn_!r5)T!`HaGL@R@%nA^~| zs$vj}f2KQ&Nsv})AA3Jbze$Vp5V!F-dGsLxvMuMO2$2^%syGtK)#z*UwlI|#vK8vR zck{Ej$W&Mae1q7TNXQXc9!>kiicQ+bmdIZ*dCf%V7+9`pB3CPOXo=lOle(3~(n=B)ubG{pyvl#G7~G8Q{^?ToVg4MRg!+V^j+!)KoK2Wf1Z^dH zWyxx=RO1|lA~)ytFE@Ru8efS{^r1*?yLyHZZallCP?OA1*eqrqvTlSM`gXfX02}l_ z@}9T!8XEYx`P8{zsq1dZVx)y;!FJoO$FHr~Xs%v@1BNMv=+>@gUi> z)GTND+JW$n#FQMxK$ldtJ(3sFi*HN_D?7RB~~i@nyHR=mzux13&ASa&ijkXbK)nL@k%Q% z=Q=`BIwy~VTO?wojvw#TE9HRVt;)#SE?bjRcXX!*LxvKX;T^eUtes=f<=E0j3>e67 zyOSl>&7b+nIwSw`)3?pDDo7`Qk6E($v6U!MH|NH~OFf4tW!}4)R`b;ETn8mp zWpAzD5q<+*<+04jD8AKRen&fd2oIj1dGwEyEK)Nx&xX`WY95te9!bzwhOFERBr=@G zra7z+!3wI=_zkox@PK` zO_+dsq+@pob1fRkz7ug|MWP|Q%Xc*Xutv?wua8+7Ex(C-Ag6Q8GKQt|n?>Xa{mzk8 zM`@?kcu9OfwbYPQOL$G|mZ{$6wGJB%^9&YfWE}R{^g!;q`dyV_Nz<~H6^ox7Y2%^^ zXKYqz;m&EXJa6Rrj%KfI=5uKtS9GgjMPQJgMVKvk%?H{{RoJ7cYKV7!rXI1AFagQt zR-o&^N;lu~deHRMYAj6EJ&fLo+%ML37pLVC%r&jocQvc!q>D_)=)LL#pIGF&t$uYC znA}o|a{@%R4aY|UHTt`cd0qi-G@Z(l9QA0@NluG9U9)&2v3T53SM~4^OueRCi zFw&0W^Y`!UcGK}}j!sAJrXTBfH4gf1+Th)%&9Fasw^_TT;eWGa@cNrUu4(jHoZ9{S zEEh7bYYEl4H`ckgsuW}?UL_7@sgw)&qJO|e(KoihQo)T-@WEV{J?f=yRPh*&uBEKT z;-$s^Vz05o|1{{@`RtXufz(n_6+P9LNOLquNJQFtVj3g)psesJBQ+}>DlHF8CRK=d zgvdqjHmwa`NRWXZO5yQB8##BzU?L;$R^Bam`Y+}V;5RIjo;2-5Rft8{GCf|VhgKBy z5v<^06A)0T)rgbM1!>$x5B^+)0Wry|(=KMus_mzp0Edr$(kLg65jc`5?q$InCGT}dddY97qyesS7I@1R!ibNp=z2}M|efMrBSGSx) zXJ(wCX*M#;lSAccJQ|vT&R;BCptUo5kM>VvdSIstXm^ZGck*ORj|}1~FRt94@Db+U zCZd>Et3{zVmdVvu4&*)ji1CHdT7@Y+6$%X27%<@2kUQu#o-DdvF^#`fXh+ImXZ~B-w?RO-|PcL_$PX!t-N8Nc64!uy> zWP6WgEycbc*f+hYFQnI-phQV?Fyoo_ndD;yvmA{!IRYxVn_vJst>Et2Ue5&RSQDGn zk!X#GBY5R1{FnPalC_>z+Oi0t&+v(FT3iWDoD2QFdaPu)rA(=;Z+KVYSEBbU_=iXP zFLI1LE)*|H`yVNxdyo*SJG#HO-Wb3?k|lo@I0}Kb`Y4uL>qWEb6B_BR!Js>ZIqzt*XBKENS`&>)KK1*nJ+xxED6$I3U7&njY*So>o^jJA^KZgM!9fV2if)a2Qh%CcMytJ(OtNsT=>uEEblyh_WinM4ksl3#ww1|jv! zRE}O_MUP5X5T06qS=J&Vi%8`Tu8U>Ntg4CxGQ3bo2Sr>{kh8BSJZEnk)df?NyCP%z zvuKlcR`&sTM$KQx>a=^$WFhLwF+?45Ih6{5#qu4=LN6H>n$U39Wkv*~dlfZZn{6G| zh7uch_@kF~V58c6?vJUy;c+S(RIlZKNsF_u*s9gH`|L3vr0&)GGKNGha1JwoEVBM$#6#Uq%lZQbJVa73l&f^2ca_;um8Q zEWEjGF3Wwp?-chP9S)|F(&iCkX+@(0Ui~U=aOuNCbXPkq+v}WTFiG|{2`IL#_edY3 zj3m;`RAhn;er~?lN&L|9VpiDwZ35fk_D(y+=dV$2%~6kBUb-rld|2w6A4|e#e?`CG zL4aPQTWYATbFhr7k`^VgB3Jm@)L5~-t905pt(@^5lJWlYf+yjkWW-ubfm~m_u`iqM zlx@{KVUE&UL~uXbE!$HQY@`2WFSrTv-)P-)k98>^+a1)Wb=+_Mn9u)gC}ZB2-&Gh4P*V@axRm$$$vK+ zII_UwDP$oOB#lY__6)61@C>^%{CfVseJ{Zc6=#%=oG0q{8@iv-2x`$>ZYY$X{x)Ig zZ^4B9f8UIp5aW6F%c0=lU{lZx-e|Z01b`q%AVeCi&#C#ZvAFLeqOK>WHFCmbq#mKI ztqo0s!e988NpP=X1jAw3;u|IfQ;}T$;T?t7 zhrpTj&rd19i*xo0F_(2RQX>H7U%?Hmv+eO>6L=LGL6pPS zhBw32&JGIpA6Csra$?~@pNAS_A}?8(wm=(>{ef@ipbJ3>KxEsXO0hkBFg3%tY}L|n zb%!avajc;XZaBkouOt7z_Rb-qpRNVR(s!9`6>|rnqiOT%1I0|)L=QO2d(Da>2uGQL zdg^?C=89GnZBS^iqLc{g;0^)qdL+QUw>q31ja_gCjFr^d1k>>%y4CGPP;<5_pO@me zGshpq2EA~}e32O*#-cg>C4hA8@?mTZ2!BkBWFGXNWT{sU10+-L{cUzusiap?wIHS4 zzVktgGHAq*t(2<)iDl0LEin#3d~pKw*I0+QWdOYrIF&`Ff0cQ1e+1oi-5c-Pz#rY8 zpuQu1)Xnm={sX)(2{5&FS!#|xy~x#=!mgbU;5n=GpuC+{7vRTg+u)Bt2dX09(_Kpk zvD`#C^zp2h#qA(AmD`&K0;LlmcVuHVGxu`*CnfY0=yg2alZ@w|0?0oe`l{g>i0PSua>g`l)a$n&(pHJ{Q~q**3lboq{xaGk z^Qm!`r(F?)Su3DV!>&})Amb{Cu;(}X6Q1sX7+9duIC*apX6$uh4lhNyF&+>-DQ$Rz zq56S>C*&cI-KuViL_`VbwXEWUMS8Xmr^NxiA0Wdi5`+^4dj1ESQxo01U~sNUXv4Xh zWS^DDq`6n_T~>n-3@rVg1V zj9-lpT`{fY+TFs3#JJxdN>?;Nw=Eb_62_pE8p(I0k)`}V;4I1{XUDZKeJdKYU~5NF zLdGKbc8!8i%~Hs4n%i#Gi=ScCX40x`v%W@?g1**fXJG_iy7%glTsxD`3^r`Ct__fSVnZ6m;{YL zYOsls!~nU^JdcthwX}W5x4tA-S<&;ubl-?5OF9fu*CpN3^es~S1Hyd}H~i?KYMgTb zV*jU@iR;51F2AaLt#F2D?G@_Occ)=0wG?YCI#5KY#i?#lv2e< zfW`yew5cd7YDbs(%$?$(9`Fqj!*dL>K}JChof1xOzb)RcO1iZ|FsF0$*m|9FAb0eu zh>VTX2;WOsGhrMIY{LZ{vi%H=?22q_soR4-O`rzuybSD&lW62~?z3G9mY0P~T`uw1 zpmz=6Z6!2A2U3)mh6oSv#UtB+3jGs^wMUILo}e5}n~(z20qD04kbKuAHr1k<*XS>L zA4!3DrwhmXC}X-1(M1rCKOlN=LW1b9ADXp&)6DVcK9V0GC1%wOL=a!~7Zr*m&%@JD z+U8Pz+WStjv2pErVdmFHpHmtOuyHy;we+gNP*UH)0tW?ANyk_B^g2ILT-o_Y3Szi>DQSSw(be z3#Q^vqN?hN-d4ezluPwzHTtB-LQO++$~_n%oyFa-*0FBDq|{Y8xWEu6VrT3O&IPyh z3EUn%Il^B?k0eB{q`!{14V$z}I|t2pF4mmMF!POvKC2AqOSx(-M;gT2Jwir#8By3> zq$d%9T=>Mb_Ml{9gA-aQ)ozBRnc}*gavP5>Z%rQr81g4Gdg!$|m97 z)Y>=a4ZDkoRe9$vGw}D)E~~(AW{YtPyI*GO`7vl$J#M`PwxO<2g3Ix4YVE#XRMP4= zVJ59AwIM&gNz^(fc2tAD!Sw!;9EZLhVQAXVi3d)u3u3{{4Plq?cylJ>;Dj3cZp*-l zAsyR;j(vl8$m%kkLdCnDRl1k=%tEpa@d4@Aune&+?PrH6wSCS@gv)1|Q@4Q5>CUNG zH5PClF`vrLTtm^ZfJq#1M?A1i=)jV{k#?}AC6!Due3+^tBzOed^RBy#A0vrvZ~hjf4fM2MRavRodqf@X+ zlZb;&Js&bFFH-Ago{lWuCpdx$ZfLaW3c2=r4062lHTCGXu1EWSAGTl(?r51)W>;kC z$2#eni9%BxgmU1zqu3+!?j(a;q~Xucvv0q)?vxQY51sde&5ZPDygtUyRLzZhPbyH) zBBR3l27|DBN3ZY-B2H^9Li^y|^bjbFMb-PStCzW5#LI-6m!Zbr5F}4Sw6@a%jk~xL zH>STuNlC?XbeY$zJQZLx=ewYM(#?BnloTw`=p0K%x;}ry}R3?nD`iJ0JmbWCjdbLmnKZv!nkiWFy+;;X%rb@dlD^+VnMYWMudY2qJ07CmxUjr_x#Hc-zVZ_Z~aqwD|tzCw%{)J0m)9yeMvk{A%$1 zea&(aa7ptq+$@yeCnrecDguuRqRvmC@1OgUmjXYijmg>L;GcQ^dEWwB;Cc9KNe28F z_fO@qKmaaTt|yas=MRtmiwXMAjsEgzz*2xqmad}>U;EF0z}wbOKnfT=9&r8P2~>fb zv=Gi$|N7?;{&}T>2WDF2KDFpCUen)KxAq5@{QtFhtwZjy==k)bVzJyR@Vv`T;3XXv z^oRx&)mv0W>U1P%|1K=#G>Co+Pf{vX4HnzOHWuBlfxNeN@6Y2UX3+@4CHqIqM1e=pp*DyXG`pI+y#)cf9hS zNBut8<W;wPIMeRJx;k zpZwR;lLAU!78{QRQ%OilrN_Cf8f8Ma>r>s{d-FM7x-z3aoXT057^#Sfy_ue|k{Zux zRKN#YXR{ZHXK;0m(rEMsIbnQj-U6^QjFQ&}#ysT%V)mEUuwP~lXKxIAZOjIQQp_O+ znjqsWgl~WLTB2zpFgeB=19^>KOjWY_0(v?2HLHu`61@%ro;|q{4{y52DG7Xs!OG`*RqB8R*#&9vZ5J%{=F;Kkb1 zntU{`Q^CyUhz6PIb>L#7D26ku8ynXgcwy{+JBPbY?}<5%R!S^p%o!BVOfr?S3oaG2 zP$P{-cNaUD+O7leFdci=Z~?-cm%No0Z{>}Bi>~hZrzdEYhZSq*Rp{u|yQ}1x8cE*R z{ASZtW6T>v9l1Ig@+oHzvjh2tyK843Gbm=2xn6>D#2VLVcC+D5(3Ox`AdV0qiysl1 z{Rr}l*Ek3|-y3B9b=1;oA)G*KE@otefb?6xBv;Zf(txapthtUYDgsEaa&NQpdRC3vEM7WV4 z&>dx>T4K)NNZdp4mvWP>L&O{GyF8_X>r!cqh4#8`6HnwZubugg{^{zCx0C_f=Nr#I zKX1F^xP7;>WQ!f{YHrCF=!%^>j?!EdBCyc=+8&?)AfO7pv*}L5LF{;c_R|=h18j_Iz}|C>ta_pjs}HqEwJXuBL9Y>b2|EZtg92?Zxr~;`JHx z@&k^w%WcZ9Av;9B@6k~vcQwLMBjDeylgl7|msqYO#ATIv;qdGBjr6 zxB}TM9|kdm68nvpr$0DERj`EpsBdUoFJ&6Vf%A%%F!eL7t)21D0?(%y|9+LFd6q?LEt znsPWlTm7g)^eA84dbe9k3a4!BYg|x@wbPcy;cA`xApqnrGL#}JYup+-D9=wP0D`v3 zqcW`1i*3|fCy=p5Jrc==^xJIWyp0g-PrM!|sZnC;RJH1F!q?u)wVvmFVI+?}_=MrL z@e3-#B9(7nP_BO5UKw2foag-Hc$i7G0i{y(1L58nj}fx|oCFb!b3a1Usd+GC_l4`p zDDa#olX`Ot3oBwaJRhamZsL6w34E$FYqT@h3_0mV1-PAH31T?QIh*R<1KfWdz(JZw zY6@A&YL#ZI!UmwOU?nFWfpImNQ&BF@K=g^M=zzH|E2ARm*Tx~ay~7Qj^#sq=(YJC* zOk;XG=?VtbnMO*EfEpyaE0*Vx3l1=+|0_Q3WoW?u65sn&Hl%!oe%0Qdurkj;#-zU} zBWyI&t1DWd#~X`CyU?Iz*;ft8ElBD&gxH-EbzwDC*=m&kGe9(4?g4wvrHF0pUpw`! zzhKT9FBh|_2-P1>g{wH^c?wtTS)<|p=D!cyV+CMWT}EPA=z9cy-WwBuxD!&==9M<(1! zksN?dj$Jwai1Vw6_Y(qZtp-~Mj;58Nn~oJwJ)Z&4q%oCvXdXC0I^irx(GQK}4N1uU zrDfbZ;g;&Vn*;FCSP>k7)N?7QL!K=9;xGz)OT12V^-BAL0c;Y^-rTfd z2cS(Lm9Gz07fTaCl#RoDvaFZa_lj>T}< zNJ@p{wMGg+Ylc3*=xC2%u>h4S2hffPmQrvy9Ib$+D<(8CmLAxnE}&|H!)aId6xceZ z08a#+T+@yZz5%!#R602vcCz&xEyw&BWnBeV7H1jMKI8+Gda7r%Ku?0qt^8y)a|1Mh-E)uo8|UsV zY9E%96$Q-8GsVDN90$$3vovcV{H?gUhec)+!_$uQ*H1wizy^o|6agM-JpG|T3V7lc+|gT=FcKbqU_bG%|# z_H&016e8=O8f&l7<4VxwoCfH1DV`~x;)l=lauD>=RuU)!l~s`HhwA_bN26W@QK6sv zWDf4J1$=z|20WFnh~OAod%qlqf0TTNQAmNt>PW5yU?e1FRe|;73>sCA-`M`Oo5>+y!siUc zq`)c&rXmem?PjSIo`vKM!rpsu(`3nDi=bp zw@teyO2o0c_mqegj<9c0E(45w#FYP8vh@3*i~_%twqp>ckd!L%coii|g}VRHsJ{tH z#%>&HHc`?Ay#r!kP>boRa%kY;&4(~~0bZfQ?%qVIm8f&GQH=ina^M6=u%Ty@VH-^?0G3OmgkEQc981WvYZ0I1QfBp=PD4 zghrWXqzjN7j3j-kFdj_*8ZDO*q7w%Elv4-0?yQ6lQ3l0^eGQK`+5k&&ImC#P6 z0hSjC-Wx+pP;gd<-C1sqiEEFsN=f1-h9?MFYuSZPZ^I&gR#l9_}B)ljzDB6tmVH zt8uNgC`qvbEBlTlc5w@QU~dgq_guHc1K@*4ivYI#?+nyQpGjrh0B+8+1ac&M>$gG1 zzgiRI@o2qx4DlPX94NnTiSL^OJpkYU9)-DMze7B&20#>d$FTHler}_`UnR_<_D1W~ zkBykpfw=oC_u7b@ycq&U`&b-{iAIx#xxepDo`&Q{z@%+wqL?p^65g>QA}0Vc8Z6<) z!Pyn9Jph|oA=FkTNS}{~Wk1>Zi4q?K;;G(KCD`~$+I`aSt*z2EE{ za7Y7O23J(_^B(}en{+@=eHdrN_-&Ep5e4J0YD%X6 zRa^XZ$buHO^4P!a2J#>+u=miA4Xpk!jw%2WH%SD){_o|0QHO{D zbijSie`VJEecw4MFb<92LC@d!-aTb7RUY*!B)^XXhXssdCph`eZ-a;D@cIl+^#U)a2k~1^<8$p4S%9>EWYEP;RNeNJ~$;)|k%E(s>531k=(5$>;w@maEkE6s3_)!AGvPyZdzd&?YD<(jmi%r=lEE64EM1u8-RqCu+FjSY4E|%xN>U;0<%ubxpS4JulR*)OO%R}z0S9v@K%&tlxB+VYG{{9X7|Z= ztM@OR5M+Ubj?ZEs_QvmM^XBf{)0?Ah{?701o?db1rAy$qL&s-|r5TA0`*|NhasiBc z<6f8Jg zJurG2&wcF5Qt0|q_?+YfFQt2;U2$;1wOfeS{*W`m363ffJg1 z#&R|9i~eelxSz4e-n+D*P=%wvcqHy*)6RnsTPVG#ZFT+aa)Ez&p$nSeCdUpl1$rQM zRfiawl9V9b;_P$6L}s;2bP+o%eU%4iRPCRsaYvwnXD1g|jwu7QuLnV(>N35jpKH69 zAXPwb9dV3jXMA&EfwV+tV)!Gpji=;PM9TI2PU(8fT=A&-s>K?4BRSt4u7X4_vq>ETS;DFXnv^)8v#QdejM5%fAKJN#+g+bW$ zOQxOWjw)ZWr9le&j7Kzwd(0SPT~}YWq!iYaNSRzrbVc2KTPu1I(a7rU334~bRbh!7qB@sqmSi0?YH@&9VsFwkZWV} zoieOP`*g8TDQmR=OEL3>xPJfUAmNr1KHgE;R(^@jDF=h1wPvQnnUj^O*OqYG)H_9i z)q4}UC-q}F4to`0CEC+HC0~#dtUqU|UZi!A!fL`YT|d4sv#!#Vtb)awBiK=@8eg{C zA4(Wm=+{D4fN%afueeIvZO9B7pjqR=f{U!C4?Vx%y+wANQLU(q)NaKy(Fj7emm>w) zK!I&mMk|rc&s?S)81#4ke7k)ALgE?S^po^NKE8toGYtgj-oIj|AuvV9l<}qf5mM!t5(* z+!p~3S-NA_gc}bRe3U2R`ikw^-if8!%*~Vws2o?k$E`ujALe0TxEZKJ!_d)TI35P= zJWK_n9>&@nWlL&vaCWK6>0;x5J*+u#+pf~8bi@}RpX4xLBe$KOzGa6i+vU)N;pL~n%^dm8V+EL1{^sbaZnl($b`ty2gxc3K}^q)4X)$=}ltRmaaDeK0l0Rj?- z{IwgpP{n4l$cOzLSEXQ)U)@r>`8|^Ut)C**4u7d$*ng zyQ4BD$y}u0p~y%B&+h zP7DprEbi!1!Fb56ACy=P2^=0@N*6M%DXE@LOy}*|-F}m*a(1p9eWXiPJKZvMYm)Az`SYs=Tnx(O}DjS06$ zOXbZn2XdlGU$-wpUY_^!Z}v&JK5cFnsXdAADk-hff1w^OB3twN#5h{uLCSIDFl-q+ zzNj$nvKt}ysk%iGnZPYAs`gOWsmK^TH?l|coIo0MCCXcU5rK)O5;F{CeLz*Zpx>O2 zo9`$iek(#o(|%ya5Oh)v&o~xBGjLrm?iss^@(7lhXEkIUJ$E>v**V)MRk-I-EPtILa`CMlDUU(x~$=s$(y9PUZBRIacfNUDt zc@fFhwUyQ`T4ED`U8XtgUq0_x?rPhWub8NT3nej0T`a6EWFe~}r`l_YrL3=!-kMbA zcm6CzI@x1;w!+DitT1j$NLtJ0&2LsHTC;>8D{%(N8M#n189b-1jpO!S$kiI$(wQl? z>mX2xUehdS>(Pwgbix~N-NrT-kbztvM?bo_28|gs8=2C@3$2C5ee-w}cw#qXH=Dp= zF!5DAhaCw?p!OV3U@ZK)$=S}pLe+%S>60#!V&=<=PGWq$36cqzN^Leokeg-qz1Ugx z4=w;D>ew6|YbCDay%c`7X9VbHv=f#-CJ@+09nVHj2IcvI-X*u__zm-F`bXT|J-F*A z>ZPf*2MJ~xg$>4J&f%mGMNQ(h84-J0kHub%Q6~y#S(-so4vEM zAD>f0F4xW!pC(6rmU_K(`_j`r>UMa>%N~?R9YfrpUC?FR^lJux+G-QiC_jptCzUk@ zwyw`CTr6GI#*a?RV5W-=nx?h4eMUb_S(MOky1ZlTfE*8h*{|(2*k@m{5>3qs`)cRK zVsV&WpJ)&v1~o&sX?0S$xy$FLcgg^?>&aDI+BY|#K}gR zOY&00wrmL(mZ7(EK0yoy3B96}Nk(T4RSR|9-#dMKtbktAUID$>@481V;G7-*^s;xT zD<6UKgUETpH)PqXZj{|M{8AvUf5-Bfjb;So!^rD&M*FK+=fY(%7`JF|Jv>_qIqOpN zJ*QU&xdoE~MYWcV+}(Mz*b@bm2O0m?R31!}&dD$uqBo)apm9&OfEeK5LmzGsL=QCXNn3)*r&>!*G-68xL1Qe zud(dx-MF!nj9)1t3sfI1vuKJ4P+L|L5&W6^jhwGfUpdo)Gcpi~UoX=Av$CLzuB6J<=F2m3QlNkdv>SvB?iHg|UmopWfGF<|V zYdOQ}9RpZGSac1I)wFPyoq+>>%zLT0!R0*ZML0nUhssf7*vGeY(VAgPNZs>Ojcm<)0|EuR7mMNFQs_ zKD^3Bh)NabeeHWdzmC7kx{~V6HHSK2-pNdD8%0 zJdNO6s->bWCg-U-)wcpytzbd|V?6vvwy;0P&X>=1emd^OhX$CI=%XIezttY)t?m`y zU^3d5-^&DG>-b!+vL+Dw6AV-7OrJ7!Ic=2}Krr^JQzEwe|+Z z_B9G`JeOiUhm<=buLyic``l7njnkwD!~#Pi@sgO^K>hn45cgQFQU4g64zJ(FYHKia zpu@+T2)99fzpfOug1#p3xfvLp{>VB!c_F^CPi3^JaF%$;{ejLTW*_r&pzPrqzk+~Y zdwyjU73CK~4*uxsu@rB46)<1K940sH@xzX&6()mPG6I{HT^*NvYkI5zruu5)v{dwvNGzVKhoEV za%`ZP_@gt3DU)~UmX)!r@Y$;(fMC0GBww~x(34aG^%9|fPeNQ;yH{+tx9YGNDQqSLSPX`CbH6=@Y=J7nwl~?h4HE%~`I?HyZ1b(}stdp=* zt)mOrlP6%-&JX&G{;5vGcv(XL59qW$q9qjg&AaGHhupypP{&FZez#eQD`S6;zO~sM zlLH0?v3>W!;qxs9mfK=i;KZE#VX`cFvBE^W=Xz6vL5rcuF)|KJRbcebn~fe{+pc&| zyg{Kt)+kWs+h#1TzN&rEZuSNJdmS|;S!J|4*rv(YBy%%E^X8l+zs8L!>7nup?;aIz zi&~C^ce46o#EW*;P5!0kMmu$ui*_vkOhq@O|C4<+sq1l>g~slRkbZiGv(mW7HD7;g zVA8kD-u_%*1w(8fVUIt+7xz3Gf@;OVv61MlELc1L^r6o!K1Lz|g(#cQz#)b?#P z{?XAc{~a-(vXZ>rhnG$9nEJvUfFdlHkCNZ;voWXnP{mcfd#gvl7C#{T`X4bB74Kb& z2|}ROb$bHqD(m!-4nY!emQuJ@zQYN?9@lM?dKRX&*o3$F^QzB4;x}FuFu;h_tGz7O zWshK1m2|}H{B1kU?P_3$xKd0(&hl^$|J{>3jOcw?VH@e+0rzrdYlSwp`2}M|r|>t3 z$?9_YYBAZndtbs^)r;fj?|g&~mXhdGv|~9LpRjKOC(AZjut2{tVUWId%C+iq+?%VL z8as3r{KX8iYIZCO-H6%O1dO<5*l3HPyLl0##3EBlY1+7-^f!{lpT95Uzq~8i&~lpW zAp~V+Sxy6oY=d&|2H3Os7JBNq2`rAH*ffNZ&DYd46Kq(w)*IF0av@}i0s1ghhp`-pl z-Qtg3iM`CPuc~V9dEn|H%ik7->@~81E3(41+jM)Ti!Yq!D(4@lFzoYB2(&r<2zH1y zC?7e{W`Fxa)$-J4;jY8zv$o$8QIW*paIZ*173QcBPcR~MQNTro#sa4miR+oms)JyP zoD%a5){?b)CnLsmITrUN_7-AeWy!Y-#G(6@G<2dPVqP25*QzG&{VHQfVlkc&Aa&Dn zuPFtPPMp3n9;TuQ9DB1i)B{=Lk8)QY6V0bi`$Z>ZdTvcxhiV+I4aBWFdKwewEc;q2 z_dD76@iQmWeD{v>uX)3CbbI`kHKaJ+VxGqOq!I%d)o-x&9Sb0eptzE%iOWpPwG`O^j$1DeDrzd*vI|t^s5NF=gv9^v3p6 znHtyLU2s0Eh#DA7wB%m+$XYrxYcq2e1*T$%rZPqNfb~s@>oKtkmb*InR+QgW>37`9 z>@B%ca;Tc0*efX;C(RY-Uis4MY1dnnQQLc$J|Jvbj|HeN8yA>_Jr=@X68|)_ESsDJ zUnkaM9#s%AuFDqZIX+^yMP6Tt6{bQEb$d3|0^?Y{F1>TFi#LzmRap7l9UOaQ42|Ep zDNneqo&3Hmm+>JTDM!anq)=P7EA2_(eNl+r1kL3oYG;FGrmEP9322_{)6jAks2yZk z;K#igR#LNgko(U&4Gl8{(+fW@IS|mih#GQ-AX!(UeGb@+%wPI|WvD)yuyK6a{Vuzx_Gs9dUh zJ_uU&U2k!UpQKXqQXf^p-yzl-%aDp(Wf5hxBiSAn1#nLal*mOUX6%1zB(N?rzr?jj zWhX`#K;p+aDMy;wCSftza>sHF=~9h(Mct$(p^>{1EJ2$dE8vx(_6|T8kFZGcvyteW z>>QIJ%|<;1Q*T3Jf*$L5-$OqY;m~;s;kn<4x-^xU2;9bCX0V8A;Q@!)T zXYqQc!-QAC>?LYX3Hr+0lkz&%1JgfrCMCY~ZVdT*ggX6HY`K%VOG~;;jFUMa;6|>g z!?`keyTHCDKPvnW@1@c0n3+#m!In3_eak{<*1tn^!b(0Gs|BqYC|ga!Z3)4jO>YEy zcOW_|LRWSkN-3`+^>Ivrv#lTc^sX*=7jHS6Ew(WwpCR*#dj{8 zJ^S{_Ks@J}N%juBs_VXA{yR$^_;l_Ct+{9Hyp^nBoxj{3VhoV5X_hI0wSry>-p*LM ztV%AryR6*-qj&Z9Ac}+Jd?MSu)b(ticdCCtL?C-7u1nwQ8w(OZoeLX`)k>R+k8MT@ zsjA%3G!-F76@QEryV6#F*&H`y#aH97I4CShxH}_ylmv-=EV*x>|0YhBc>*<~grPb* z9xb}GvCJsmiu+?wFXlQO-O_IgP&q)O-fOWoUg%eSDx`XkM~W>BDyWBzU|EfX3;N%y zLEklhOA2-xpM3w3*~_Y+cw##$qWUwfgyAmV{mF*dWY)0V#3%nW^fFu_nG{+~Q>R>9 ztrSLSx%ek;>exLPL!pW^(j}WRE(^eEIurX6|N{aV+SVRyk z;?jX4kH9fLh9+0VQdXtxYB_sqAD1ADx407Nj#74X^N3)I-&bCntNecyEB(dfHG+PG zW@4haUK?Ixw|vayIusDJrvI(&fZF0I&~3;mBI(thc*wM9qB=1)M+jD2XYKzp?otfV zPfRKr5o4JoBuU(r+>21V)hSkAUuK$+UYAS_C%gXHpoc|M-dEF7k6o|uXumtGsBci? zd**d{ay{7xf=JC{c}$7h>^8?jt10H4A3)L0u9$K42&~FXXM8INpA%!PUHvHJkiRJ< zN5!(0B&(6LWgSXdBZC(vo%jw7bM`$y@bX_G;y#OQR)i1QOCFW`R?$zB`3bJs}+^_gpQmTtcj zOOxuJWPog`po!&a)DAiaifLcSWl*gVT-#anaT7;>H6XHyvr}ush@Lr-60&@K?6LD> zmE4?IK95{dFY2s18i+}|wPe4xEOR6(To(lw6qjb6`jw$qaK^bHgV&03Vb1RHY4ytT zK%W1J!8VO5Z+t6J_4z%$OOjF@5bJz5Z`eM8ob`h3F?o=db3puqwW}(`DB>~-(vUIb z;1aQO8~Yp}!O4R%l^$Z8+%8T>k>Kr^+~ITjB|ZHGSIvYq+zp333MPT=L#R6v&@0F} zK{M#CX*^`fO$vnU;+&jU}=%U_YaP|I2{#WECN<;+pY_cE&e->pT zqtoE-s!Aq40OS>05}rvgWSn79^oSJutOKAUKPXunf8=EP`=i0AXM&TFXM>W9YN0+V z{b9N1H3>;cC0V=y?LtfKvG@$)%XXgyD&He?;idFXP37a0NJxw_DL|?T5*$cvG0WAN~4deJ)TX1rv+?tX#o(8Ef?2 zgmq?Dox$yuG(i1Zn3$T=mx#xl&_QcG4w2HFgz7kVw~9hT)U1xG3Pq3$MWNp+wx(oP z97O5tRP?s1g1{xYRHA8<@Kguu=`LJoh?L`bB} z|7QW&0NSkJcawvz%ow*rb`!^w>@ zB+n~_jhh#|Qv_~r2kOB--TOItM8rL5(cbSP|Nw*L5j^zR+_zo7jrvO z?|(umN|&g3>$DKj;>LeFq>EgO^mx6;Q&L+Q8D72b4o-6WMs!MT`sB|q#uK#dB~Rq^ za#r%23ZR{C*#Bh-(z1UWbWd%4v09>c?I#h{hm-LI1g*?@&kV)#q|`*AnI$%~J>1UIGpaGs?E^Sjet^2%tZ zTuNHSSHkhnlWHeRHd5#h&L{bhkRY*O|03@ov-Zm&?tLT+x~&ID{`)0;2^AY@fq}`P z9`DCl+%SfcaSO0t=7|)5nVk8t54^=0N;5Bxmb%Rmv4WUXp6Z?`=+46nVAm5u$Ro>T zn?TZ7Z{7OD?AH7h@*`4J80vBq`O8Wi^+6B${kn_K`^F$!b;U&g@@)lO@Lonf2dA7c zn4C{g;us~Mz2!GH)RL`Lbf-R8BR2BDKc25sr6DIs52?;81sNSeS9A>i1F4ga8dZ8GCYCs`D6VvM6AQX8R;NkC|@7{ZGeD2KIj3uQ~y1dXWO%C2R;Nj_5c`B=-IOS{5SM7JiLZ)OYsm zq^CgX!S9z2;4Bu;VV3ma*Q)KcF=qi=!NKHmDEZ({qn~1zOubvJvrTuThzY$3-3PJS zmAJlvTsh9z!={Yi(5Kpca_OBeK9S zr61B*@M)TQ6sgmM4RQCbh{r0Ov2@NE%gkS#j< zOUSSyWO93_Ev3E%_C9%dhO1ieB3L+qjy*$eC@0q`rGCNkGVx1$SMeHu%bgU;qJLDs z1T%?dRBv30y(jznUWL(bWYC*diSY_t7#wQ!<^8uHn{JR{w_=FcWK5=9ns)Oy$_Q+` zdZ2KBNCcN%Oz!c!_SBPzdf6=b6qhV9Co2op?GuCMC@ED~1PDRK~(WRskRkbwZM z3!SjNeQV2S90>~TPJ-_yX%4;{`(^^rC+meIbdCvR`dK#?9|fUIltsPU%I5YJe6H!OdtZ7DKT=Z>eZyZ!&EFPaZk(* z7vg(-SN@_GM7r3)si@)qU2Adio>(y`H5cb_^Z)oI|G7D>1hI7B|CcZOzy@vCNj3elVf=myN%UYYF2B5X<<>@Wtt_;Ry)t39ku zp4(6*OJH`JA@aS+-0+7l#x#fk0)K`uVWd~x?_cTwQD9D%yw{^T?cdgMp>90sZz;E3 zd$)I_*j!lRG6o7Q z=eV<@19QY(ZJZ7q%2Ea3XgCe>f7IEzSj6yfx?aLGr;x%00^%=C7c=JW8rn5$nkezLN6$HQ^`eHfuxQLXvA=D+GZ+4r6%@0A5 z^C$MM7Qq5*t`kHevTDNx1-&&k^M?fYQNM>=I_L5!ToH}^~)et0hETTeZ@@rEwT@z0z$JWsSeg^kxBo~l8 z%UKaONNt6KfL4vv*G?7lI8O#7oEx6{&T zDIsxrUg~k?sB0l!nZS;dtjc^a6kGWVEn!C2pRzy`IZ|aQ_n6)rD6WWZX`u8a*m7$6 zfS76&+`F;rZ)e;|707m97=SkZhSKwFoGLM1RN4I!mF1_w2x#lU_->IhUiJt7 z0y1JYEO72!B)-_H1&8(y=+2BC!S zyLH1S+cUjF+)E#7me+Q0bRx=_x!_hscIM2B z^w0Si9~+DeORbUEZ&tTx@tHH&n_AXF6qB#aXW-{QO@}*GTkUS#qN?*W8dYcY%X$|3 z6d;|LBJJ$An=asQCI%L-bu^=IcH~M-zm{j^Gwbyg}{YB7f3H~D@-Y8PG= z?dXQoSF6QuXRVFJM8>m56wRp!9y6U|)dKHU0QKMW>ol)-@V~nTE)%h7(*oV0{jpSS zSqi-}_EDz~q$JPGWrh`;Ey8?EP5~_kaLsc6g}h+pT1F?|$qduw?})AHhk_8y8)Yu> z>~wk9E*8V+2=7As@fOIRCA^y%^a4$6zg8V!IhfoD5a)qznglX8ZeWQ_%%NL(YGx8<{S2K3xTMdxW;U0TlXEodtlL>+e-W1FJ#>EQiq){(t23MOS2@+?-x< zCN#NwCI08MDwJPBMp*ooApT)cb&anZf-{7${xR;Fx3ZmJD8?)>&vT-VexV&>Z%DXy z!|^1QBjA##8l(ihjs5~8krfsQ#J6z`oxjZX?i5CgHP~C@TzVWBuP#Uc0SWf5d4ERG z#}DQNbx$fiU_uQ6c+=azkI+1jBS^ICkQ=wFaAh-tE`RJ*ETxhrAz`F#JN;2@ty_yn z_4lx;I#cAJr||r-3??c=WU9Z>q0k1}ML0$Wo+A3S1Lk=knV)&uu-~#~%4-(=eOU~f z?4lQeh?-wM9e^^!h9z393CbELaIF2}pw#6#1cIUNNWXv*+$oz$@|;UqgB)Hf(s|9;!njFgy!?XoZNC36d{XQ4xmsvq zIB@Yb)q=!~#0OUXC`xgE}hQf_e=57L63X=|dTg^(E+3}RokgomJ&+Dkc&{r6(U z=Sf|@H}BS{;PpBqf%$S+qv$iQM8o6R(Z7 z1AQ4#u-o4Lt!)0iGl>82*|&*|E8#!4b_IUL5aq}4lR{;Pb(n6c!I;IxpXWRmh0z8u z=00)1n>oqlxj7>fBhZbQ&YK>Zh)5#>U*PPhD&%DCgqlluTJ-T=;}7_7krCeRX!h`2 zhdU?F%?m=6vvsN47ZF?-xJ2rMU=bTv0W@U+bi-mFqN_Dbriw?ga^f*`x68Hj6t=Jh z+jN5(U%)HBfS4&-zlG(~Ur&Ciy+3(&&FdsRbzR?3Z?8`Z!DCl9cY~bIFl7QGfn1lX%WO_-I%c1l$b21K1Pd~e0C{7(-}%NiI}uCuBf*K zTvCgTta+TqJ{ZYlo%Q=Z2Y4_|PKh-aWEKj$1B-HX%5=;Y5v)!%z50>nWt>iyW zP)=01JvbkJH?{szIHUi;cyxG>n6$0y`Y%XHQemG%$y$0esqE0_ps25;+{Yy{7uCOV zVhU|n`EC()Wgq(3O~F7hhj&q#!qvrj8wcZ6?>GsO5V1m?&6wrc&dhKdh>HV`MnwZN{o$v2W9<*XM68BN&?vo9J{!mt?ZddF>A?MsR?x||D^4w z6AdZewkZ1(BW6SuaoTph;TY~sOX4y4#%Sz4L2eORQh}4T z&t~|q!)7b?NToTmLv~b%zHIw&4*Qof;0)x>b@4QyT77;5-$sDaP>kkuRzx!0ZlvA} zlVH+>kV=-&1Zd4})oVPw{N0d{zpNRL{^1=f3XuGeRUJ=C%Z`uQs<%q%a8xoqSBmGq zVK$01!a{;f^WXe$o&Fl8?w3+l&X%u-LY*BQKHBoU6(#<>l}Q7dJkooc<$>Sbkr(P; z-$P{(9_Bm%1Ao+Hspf=rHpzs%?+j0~G>bUulN*uayw8T!WSJeS*h2-fwbJq=ANeoT zXMM}Ea4UIHBD+JYAJJH(LR#=;C96E8p^@?Mz$LxVrt8S51@{p|n)g<*?iC%rVnv!i zK4&4*hLrZbBkXi zaanQSE9B)o(kS1C%rF>yiK3Eri#>4ECJ0D_UZ+*vL9ndgUiCcVXUb#_Ti%o?mZ;SD zYL_rDt3ig4vqbG8v+ouahS|nWCqBw$isyI^xA(zGJXbAOT)$A~!d%{d{Un$w)YwW- zEeMhpgdSUplqDglld!BJWxe!LUzTHaWd`1Lp0Di|ZjTa@nisNgkHL}3dXGtIlAW6I zh9}>Tny4HUbC}N@_bdHuXMLEiJEQ@m)V$~CW_JwMgHad%}DrkFM0)d^SH}rWb5IiUmQk0AXZzr^Iy`42i@!i&$Kb@4atA2|KX!&GKfnQ zVK<8muH4NClYd&EUHZUwhHWfjSDmOYt#F%;nzjE?U=nM~gYtY0ThrqAIFtMjIIv8q zTK)Nmr-_?*jN3?41#WXOAU2k0w>zAfCW=VoM-IAWBN@1WYN!JolzPcxjaufOCP2D~ z>+`!z|0}xT*SB;jKKC*?r_`3a!Q=F`Np-17NGZRiA{w}jrAes|?JKF@mZ&$o$FPo2 z0l0W^Xx%a9uEq`1H>=YAzHRrQ%o4YlV=)K!}^YaE^TD*(pqM#F9@@Zs;InnAJwRoVO zn)GIaXM&2Ib%#4SSm$G@~@H44S9eOw|5x*F{fCO2VW z8Nvq{6Vm*S=4MJh_0_&U4EkYA$9mBD`gQ<2`+bxcY`SXvny;v$1b8FX0saaaSf?HH zX8K;@qrQ_zsxv%4Y=b{BgkZ>nNT2o3eF6Z*`Oa(3One))qTB-dyiies^e)+u^P`q7 zqc3UZ1=6c7E?2lPuB&m&pI!WmE^`j5sNl5CEJlg}rDH9zzxILb5hPdscs<$?737P5 zz33|MUSs3zn)G&@mprX$py+K<36i*MC)Wy_|C2pqMOWWbU9t-o|ev2nO8cqQ~s+DI!S0)@AUsv zB28gr+r4oUVMixsn&G*W(Wc^;Rjm^q+{$lWPifcuhjg+H2Z8bTXE#1AtFIfqIl}7n zfsN07-D{#%TiA10iB?@t9k6<5LnnSVj>RR^Mv-k?x-=4=yfHCTzt^K+NbMrpir|qgA zxQaOUZ@RG1X5ndF1k4!77+L6oWN!B^Kt1J)o;>X#OZcFZ-JEk#;zZC9+N4lS;Xh>4 zA$8%uJvz`u6CR;V1Mea6-@+`yUz9tBLAVKu^O*?|Z@QY!_Qsa7aU$>j`NSoZo@sLZWe3@j&7dk`pOQ zEgmD)8!yF0`~fT?iOi(ERwzcjd3O^%djP>uTe_PuFlrG5I1yH zdCu3lfOjr!a9uTDKi_K~sTU$ZbowHXB6pHlhuT<`v;y0!$tcn?oZ1ljb!zfl%dHxr z_80Vwqn8GyMzU%hIjv86MdRJ06WHLfo!k+4A0Th=_a!qiPsaDIGb3S?C`gQW)N{uX-dwv_J-*Ej~(Y6GAa3Qh@El)$AVtpisB+qL;mvO%TlUPmXUGs%4` z$wIx=pf4l?opeEX!v#HhbzHFRgg?@YmRH?HPRH;pu3IS8-suP?7W|~QbMO5oJMKF` zI0$p6%zyV6oQW|>D25sQrt#zZZo%+=&I!lFk1S-I1wtW~m4iws#lSCzPS>lFdY{L< ztGq+VI)8Q&=I(ImI%iqdq8-2NDr=&?Z@`o>xw-A-%BA$cuz{Tgp6=-VTB(0QZv&Zk z7F!*W>1gcTmE5OQ{2Xk^ZkHQ!r83CqJV&RJ;2v!~&hz6UctD43kB%FF5(b)_o*mU9 zX@N>6j*6>kx*H_N;XA?Y?&=7$STHQMf@Jy>kvDFi@pl+mD1MsCjaBYr-m%CSk^`7L z5NBj=BB#A}|K7J%`JBWo_TywJz>CF@pUnq1;jrGh(dO<=XX_VDeT02nHg5vRzq_fD zRQG;=ty9vO8{U?p%jzq0Ysys-A5dG9{fZlW+E!9vYs5RN}#hN?1~bp32-e z#@=ZTp1`G7{#pEe=IvuBKv5QeAq&|908F6eij#UpP0u z(*3VdZLi=rD`iF`_963=>!fM_92O6YluJv4b5U&nwLuNde(UbuDHCWQMr^nLw}Tx^ zyd?+Lv5fz3%l=;nd+y)Mxs;_7)c@DDzrpVR>!-^;7rh??C}#co*Q)Jp_Wg6Bp4K4I zyJBX*c_>}bYU+33^g?z9CE$`MbcXG!g)?cak8|r|Q_L&3Mp#2v;gE}c`Q!CO`r}$~ zjnrjVE4F8_?AUL6%G3O~Z=e}zX`&DEdTjBti<>H9X_kgryN-5%0{LSBm>_Rg*QFS$v_$1c`yYuYppa<*#=kJkBFU+r zSb)*rU+5VB>dHsn>)(Gy%X^)^ z9&Nt=kkIQ>hb1nxl(T3I(!2p&dd{YWj1Vl=m)~!2asQh{f_WyEr4y6*8`T{wYKOnfb?2h&IFtAAqZ=BpT5v>mmeN}0YqFX2yApr2 z;~bd!GCQFC5`R`rTxa7SYs;k?XFo`VrFBO$60}>ovO0QRxnU!no9&&qO#@-tusz)F zvGZUp{gP5a2Cgq<^VEfkv7SI*?K<^pqGySdP06og(DYy+P`%5?`}@fKf~lbf$xkMJ z8(Em~D|$w!Cj7PI6?sroS*PQ1k0F|o_P+O1!iJ=X9yEF?HrR4=)7ND2<#>hQ698BdfLduNOrQ(kRcp7E&GD**mk! zfMsV|J(?7sE+`Lhr#s%lKOa&NcLI6set&Vkj{^;&121iR5I$LRo*;6@cv)~P8E8$& z(AhRSRiMYAWk{!Km~-JqhvV_6xu)`kv4?>6E8Tt}duC|d?cyOJY8$!)YvR!8<4^4W z@SlH^a&rWMdL&pX}|t$>g?t&3EBrFIge>O;}NU8)o>{X1jd0AdCNHsOV+o zjUn}^yUKfO6w`n_XUNQ8IzHTA1TjA;y8pq=C8LIt?JBE<($zLBs&xP^x}xqzIA?^T zk=cQZO*h|EiJ*SGQ{H({WY|42?8M@vvVOL?z>=y_ppc#p(-GWT$f6N7dn{x}6r}Z_ zIELi{hA4QTj;C;Q-HDywk(ADd`yhdC=0JtDW+4I_xARhZY#UzM7lO_pni8aS-j)1g zG*?iU;a&&HZ?GNPrJX32rc6l&=wcY0UhP3WQRkB}b*7LjpKJyxtkdyD3L@Q3`>s&= zFkpzOl3-F|;et$4uz>pEhp511+{`1wYx~}CKO8=GbL%;0h7f(G*{l7g48?hLbA}S@ zf)p|v_!%{tOpg)RBktKewCvbxvaQJQEdvfd+gX(s2R7A)&bd!08wbi9Mi0|GArF$^#gr5C)`oM$FWNo%nc|pfIU4vDzaK2>2yD0r*tdw>AlAWSk zk1eGU%ah~NECMpsc(Km$Hy0t)zI;0^dXTeXh?iyfVv<9Q2YPbdZL1yE^rF!T?tPXA zcIK|vxg)P7Ih!<)|JeQ}mVuh9v!*5AQL`ad$Zxb6|92ff0PW+z43^XreEVtv@!7{P zgAm9MjngtVO64^KXN?ZRRbm<#xQS*;VlVG51C!*qFn(cgU z>6-VsS<)b#F5;6D)6xWoC*MkpAq{@Pw8+p=e|oA4mb7#Faomd&vfmb#)*rU(jK!dA z;(OARPzSrm6={7Vkk3;1OM6e%6|CsVGCs>v<(z4of6<4MzkFEybvLso2iP>m+DH;v zMx)XH;8c>(!C2@q^nA~Mn_)&5H6=Q4WCeRLpR_}G>gy;axWVd6g`L`M7|GroS4?m5 z31P&r`Wj!<+afH#rb)hp#UtC&Skmk(ng%5~2lBarInlv0--gFX8KA&lJ#|UPLXF7Y#28ip9Ec<`q7tfxq90`fi zmPnAiJl7JwNwqc6SFkbigYjkR>%E$XBhRl|V~c%$cy|?2N(C3(W$!Vim1ue>3{f#A zCOhZ%&--6dh|Pu#rc)Zsj@S?BA_j3IPyCMesH~Pp#dk^S%C-Z%8Ed*XGct&eDT4=c zIh+*UvC^OYZt(^`&J+GCv*jC({P5>Q`Hb4xbP8VL=i%u4JCB$CcvMqO_HyXlA3a>P z+83wExE2gce|L9&M)FG@{3#WiKyRucn}OT8sxlR>(k(p8LQ;HBkkNYeV*}5n^$HJ^ z;c>0{9V4JD!f61ooS?XVK$le1rbH#e2lnC^eljx@s$Z-1MUj{IeeFhW(i6@R*H4c&1TB5v(lG@DHKA3P!9T>AR_Ba&gz znkW`}GxE++-mtNl$#UZD+EC9Gy-#$O>=r>XM&xWWAE<@Tb2AV7IoSkS_ujL&*vCG# z8bS$zS$G**S5Z$l6?Z(s4swJxlX023g}x~ij!_Zl!My3}CkkFRiyjN*i|^C$wPZ{n zpH0@Y<$fVHd@F-|K)vJn0y;2%k0(F8R2&z4bXhAr=;$eFF$_4f5LPdc1UH=)YQ;CU z68G&_uz-kQq1Pkscm|4y`{rzoYyRTV)e*4o82j12%a2YSUiI2RPs_`$ALi4zvYk1- zTc(gs4AaasKJ#0YzaP|Lnrp1YW97TXln?!z5(99s-HHe`4y74l5*a)zOBYbU06hePkb?_6h9ZJU?R7;Avr z;|`y_8>H#UEIgHXsQbWBR?wVDCiB;0fBD%rYj6201L=ucuHF*`xF?>`lMVghk6>DL z{at)9912+*^+w>KBu=;0TvnH&irgn+*dP7-Vpr3AdEB+udTQ+1z8>ZcX@>_Vnv9L; zk84UA%xW?w_6v^aHjjq>#c8XW@q%(b*RPravRThV$2|!KJ3T*EV<7dQJvX?fPKCZB zciSqlhVi*#GM6BFICYH{zz*4&7VB4e4DzH=K80TPw>XvkHbp-4WUh>^w|vH!{AnRa zPbS=C?;x0oa8z$h^}DuWz_*E+zEwi>g4J#G8x9N74`hp`*o|$Gzs31;5}7c|x;HX_ zBf)Goe;Qn6z2@luslXpD!Ux1M?$=&=wO~PkYoxAF+zO0I_o!G%@li`WI4<8!sToSL z(0Tlx0lpo7JP7gC<&^|8Y=f!xRq6Fv1$go={YAj&&3c}mMb+ZxBNS_Be|Y9-PGRY- z5x=Zv6LgRAey}7qMu5NkdX4e`|6t!~wp^6dzHcw+G+Qe0su`RCARM)5YE>aXXIi*2 zp!D&?Zlg}BQuYpCHHBUxQg*VkBz3m*u(V#z(P^MvaD<%8Z=>iO}3lVluTQpj< z4x!MB$fe*c+$#$TBGVBQCBQY|!Bn`aN)aNoWc|8pU20n*@5sU1gryST)+6!Q}(H&i)6#TH2?j#?}9hTgL6J%?oXNe zrMm;qaCjs!=UKx#JjeYp7&mZda(HQ`#6&iZVl_5lF$lfe9~r*(T|^~cUb@fFoJ+KI z6sq>e`_Mmx3^Oe5h!(Cm^FH0CR8|!K_P+j=;q(auZx6@yruwZSJ#DYBZ_#Q~E=uN`J2Ykb&rc1n3^8vh2Mz zeRTi(58bkx$Kh*NKeUVadt8Q|txx1S#xAdvprdwb8C?g}lQf-Cnq;3LT~jOH!m?e? z$ecH>Q_$uqtyan00hu>GoUa`_B*X|_WuHXVT_-mQX790ap1&&h1i1H`C+;TQogIMt zFJP=dZD(Kf`IqjaH#3|Al^iKj`kYa6bG4C3Q(WWoOu8A|>7#Y2kG{Nzv33i^68wwF zPDaaD!Ci}a!Im!;WBupdcjHfy82{@#jAeeePWCJ+$yY9}7yPp~S{VQ|&8h{dJNB@% z2z#&^6T{d;&%i_O?iF&=g)_c0KlcM^Tq=J$&?PxFAQSY)4g6H~1#!3+^5nu}TR==E zP4O*7p3qAfVH35}U#GHv7SE*29&nvc`2o-`kE@~wJkeRf8V@>K(2&Tw+-%wLD9iPq zrHlMpJ-28RLNs=16TVN|Mi4XMe@I$2U=z2A&KSq2V?Ep-6w3#%&ZyiCO-2ibiw^Ks zM<>+N@zcVa(`&Pw9;qjLW=Ud=GJf_5Ekcu5IRD;8J3zt9zMmwVkl|1bmPR2@qwkXk zuk8hkaX)FrRM@^`lb9_Uh~@LD*&z+RqXF@Y5xkwC!p6%v^Xj|W>8GZz;{WV(wT~0lZI5#O*wpMZ$;g5SFKr-N^QgVPb05Jfx)5wp+iW0!9ZoRY+H?pWt$($Z~!1 z_c|dl`G*Sm@Kbs4^UolOlPxV|PmR~MhP7aw!yGi3;sglhAvyME`$a*&srUUwG~<5G z4?wnH%Wv>TjLgqIQEGR$uIl^kme$GIy-)RcpVrbvROMHN2mDxgvZ~+2@(WOV%@ut^ zwdhpB>Gje*Be5!tcj4|XMORLDq~APby~WZPyY@bf67_f|kt_IV1#I z#{+9xemK7i|HaTvLF*097dF7PSVe3;6Sz&ctedo-uB=z>;jheL#gD?=Ufn8iNin@x zrG1#oZZD@(pb6roRNWaJ_9cFjVqd(`z{S|{M_06Qn$dF?X+3Oji?WQ%{RilJ&1Uz$N$$s)!7^O;ou76F z-}5GA6(Rc-rQ;DFv_tX6q#qqm1AAedGn!cZ|DU8Q&H7b z9I59j2IA5%NA|1`y7$}TRc+Q#^+Hd=m`eElfG;bpUn-<+Lpy>}8B>p8A4~52H6vi; zBI6SsDfUwgn-3Brefi>AUION>>gsnsw&MTA-dhL7^{ic^34!2&06{{q;2uKoU?GGc z!QGwU?he5Jh_d(ZBEy8Dr} zR?kn5t0Frc6>wdhFGsWM_;l-|20;+{NbW@$NWX|aD~odSdQTRZJ(N7%ghlHrIbY+D~3%D+I_N7X7GyjZg)^SU}jL}!E^1W?{q@-J`m4zNU1PIUq?Wvz zT!ex{7dx{lT!9cGBlGRuGO+niY#$qzV|YxoohS07-@yu0)XDSEQFdvtlKGm2b>8yk zwv&EvbRrB7eZ>Q_(1>bjY$LU=Oqh4DUJ76M*38}mmMoJVKn4;sv9>L%MdV^c9$Sj9 z3cAeV5I2_fjk}>Fb$y~%v9VmX{8EW)vQIEREGBtr`!k?}J7Sbj-1Mn8HJ#)nBi94= ziS{L?XZU(@n4gw+>x>2+p2yV)bPBgR&Y@aM-}rXw5^~0Jlq$R1RkwY)=Qza8T_y|v zzkp|w zW-Lk?MCXbiHiS3ujNL zaoPE!LbUhpGP_qbNg(&TFrF^}|3w*+#Ce1-Vxf91{5?VI#kBW8CHWo&G%d7HO+v zES%3fCa}BM+LmM-T!bm~&@E1)^x?{L^N!%)YzcXJ4KSPI0SaJ`?fnz z`aK3eCtk*7x*5DJQ6`(M0vjZ(kXQwoog|tS;agUcic{u;fXy~*J3Xrq z)k~^oQMK3cg1%kbx$6-jiZ^SLql0&89|?UR;%=~tg^eDx4OYLt4RPQ8;>228zw*KV zTY$oF!W-di|3A;@C}|Hd)tsq%&R`? zR;!rwMzT2U{&%xMF6|MVN;H(w-Bib?lWOo5+3v3QmIK_lHqGiw%=l7u?8YE)@r$2| z<>cta~s~%O5a*)5EG`ld?jR+9#}OD+O2jF1~wD8W>_<}D0Fh; zDm3Z1{A5O@_|0^#tc1|>_D+It4aoO}^XJJh;-TSE(NNXpqP=i&-5JTU?ZgUxa1+Wl zAB`W)Nv-)<|0T~{5M40oJ_k+zHc281lV@R|-{`E`&mSWA_ek2Is{=hF&rKg4>D?wu z!p1{Y`mE}aY#2123F>Lb(Z8>b`xShDXaJ;bBH}xL|x@rjTbSR zQNP0`_kE^oC2~CaZ6?pbco=zTe6f(WN5xhsXvbpQQlnoG@X+V|oj&Wz@|50h(4vNKvj1ddF+r*g zS$^zeWzon6M(1!$zg=VGaf&2IViX@e(GEK_ES|XfH1Bxb%iMCeqIjbHNDPTeyJgmV zyOTaE!Od029!>E9m;N5sk{PqkJp$#tmJift$$i0h?s8~!>1`I)t7k`hSe5FwJaC?F zn#$XlhhN#vr&zY?xr$xbYF;q*jnQ5^$$>|wO7%uTeX_mPGbxvxY`=g3yX$4PHG&pA z))Kt|rdUCA3uF2{p;pFy` z@*_;8FR|8`{gl0>HTr@C!P$sRs_^mr=RZ5#p3NI!ITk(-JUGdzn!oM{7getrmhv2< zHJ$4Fyoa%r*5+=#hPEBGBLEVjwTGle&)4>HwbL$em6xkamj(lipM$n~_R6Y?Ee;c(1J>F@G4EyTyZR$gvs;X8ZFu#;4L_b&JYV2=&7=tY^%)9cwY$-y z0W7q%*zY%N0}jl9lLXbfM2kQ*3uzFkSP~z-r$4nHKWSJf^60fzHwsNvUO4icZrwKw)X*s{s-k&cyQSre6ujM355wRi;)^SDFS zaIq0#zl|^YrVj(v+s-U%DEf7ycsC4NfqiLCWO{&tQ~W4rna0NIVNjG=9ZOz28lTwH z^3iVIR?j6he&JXU-rToqaf_3UFrKr8@?G3I-tp{Qer)K=X`|@ZtAi96dy8**Y2C*? zj$5nJL+zVFq9pp$(ZREqFYg3-5~QeZf8-j?lXgqiH*W%IQHkdq-@@l2`MO!acj3gI zQQbM;xjW5I#2|Ki*p7uu0e%ZuknY(1=UdO|ji3FH(JLD!-?2TeD8W~kOy)4(?Pf3b zt{7^VS4m0#G89G;#wzMeS>-;;W%G8;q~29b_KGIH`Xg(27m;|~DFIcD=5p}FkC>kB zoNnjQqB7*y#+kLQrOf0DMmZNhmyetmwtStT2hQ#wQvP|n%>BN3jA_t*8qtK|c6aeS zETl`=yX~?Ky$*#m$hfo6VYDztL;H@O(T^^U5ggP;z?UF`IHq3R8`n@|pl9xji1u{t zX;uByle6jJwiZQMZ$2%dL(#Wap#3%5di%Wh@=9%MP21k-R@=5~?@;9KLg>*($9^)7 zHxNSTa+xEUW^G{c^UGUhi*ZNd&dmO<7tX7`QgZ@{mWeBqvM=SxS~%H(8UYic`j^OaaI)iJT{1$zeLaBgvuL!f3{UzozV|1GN5% zobJx))IvXxvc^-4wRLP$5z2^#xHm(c#Ac3EzZ%|6onMlU-$EjsC(g!wK{{&920^M2 z&(}H1LPM?Nw9e24LlPu3l=dB}IL-nzcxHc~X)=19|Jt$bMdz0->?OnI;y+v4zW@Ag z6+&=EuxsSusjhWu{Ed&b4iv*s=RBTap*HV?c=GDPj=&FeKblSdWX_;W?uDw#77d*6 z7cT|}6eS_7rJN-Dnqx3BUh(Xfxp`1@M|pKErgO!8BO{r+MePero~=%QHaWqpvD`^w zSdRo!34|6p8Vy)mM7hr5Q;I0?*rjH-Wk!rn(!fdNP^;pR&Fd15^RSacQog&D&*Zq; zv7dg6U<{r5DEKqv$D0#NQ=O{mue#Lt*P&v#51;l@KBRT9L6+$I6Mgds21fw?HI=mT zGoBw`$yoW!DSwND0e(v_Go0-1I-YYZ{h!#HKj90%P+q{X3Ra{pwYV3z`Y$-ZUzdh~ ze15%-L%eW!u7ou=V0p0rdDKUc1e1CRjT{tF@Hq9IT_|R zJlmQ0TBTLBLsDTlm~?i|sMg%>cHUL9S<(_$R1={WH+SoH%rE+}g8Lg2OdqRWftSHJ|zQ zayad9QVO1u?6#G^J-CF zTrn=N`};$V`0^ShE-ZIh5^XUSIWlJ{#_H))kpcyNkOEEcrX&fsMHeA~|?|y)tw{{!9@oJ(ok_K_6OF{S=4xYVY2m2l z?mWPGbsKMB$+M&+W;Pw}csaeK`EGH-T8Ma)A9_Q`y61;(gtHlqm>X@6E0^11LB)R| zHtXhN|H0V$#2h05Ps^Da)|_e?|KaAQw37WLS2u>DihZmt+hMuw;?RIH+(ImsGC3Aq zmIkg5qviK}ri4xO2I48j?`-sT=MFq-HS_z18+XqU92-v-&Blt?*fz6Rc@kiF3wx>0 z=H2r)T4E31dz?Mj`n;1iJxiq4AVWV^sK8+xVLoQ3M|eTJPkrYhQ=lWR)V=H0{Goy% z+IQgfEpf9YJNMp8TLsWc9#oO)>I+nes)r^F=%zMG>GEa8Pi)w~44GyC9+%-}Lfxgy z-Y{apkp=K%P0p7brB3!7`4f5eJvuA*My4cQc=`erY~u>ktJDF9ISX^913Pb5Tj=(d zR&o%ABzw~}kfwdCRrSOtijspZjBxVxu!Q?WCHMUsxo_`-#_!^_Jcr#&WNr_~s~azU zYTp=-&P z)&~D8Na!9k^%OONjC}v~t&78}hJ$MG<5&)t&k^?BUbPa(-x_OgSQlzoAU}%FW;Rn; zrQR6SOwTJEWc1`D9XITL&X+HaF}CO6BvQ0fQl|8XmfJ}NbEgQd);q2>gG#&wOjE#Q)wH9WVytIN$A{n9dT4}Oq)lW2Ls8o_teXuRa? zm3Ta@Tydso&>!^cmWI&N;j2ZlXF)oQtcAJ9z_0!Tn6d{?`sFsM`R zIWNx{+t|;`=Z4^NHT*?s7^vu^-d!jx@m?o@Si5+4boSGxk>_b0!K=@OiB>(W@=a;U z=k?CB&DO-Mg+_Gz&Ds+zZl?B-k)Gl-^%hD2L$c zN0ZfL_AdKZQ>n>Aj!XCJwN)0@^{K4~1I6~8Cy>!2x1K;-uIt|ZoIwPmgkabG&C&CQ zeJZ)W>a#k4EzFIJ>g7;0{F*JIC~5Yw9+mTH-Wo)Kqe%4)OEP?nC!Y?-+`Ve5V^W^N z2~tfE-%+}~inCF-S+4$P8!=v6leK!jI%pP2Rkfngt4s`+j6M3jmKtMoFbeA1GOv{s zY0Z?0tPJD%pSAMkMj+2Y36Jw6y;_hu@nnbL*^>SL!n3s~oW88}l(9@0DH-B|e5njZDoz~D7E2VLWw-D7 z8<|se9BMsDY9G!XU&TMnaC22tx$)!tg8xldBZqBxo?Gw3oNa4yT3&ZHeJZ{{ z3V>Gohzk@eBh;A7v%=hvURyY=nLZ~(sFzlSAS%?k=xQg~*;&y)RlJxSr0V#DDpPp_ z9w8*?S7Dd1ZLjU1(fd97g8uECeDH+aNx!`0Zl@RV($)Z^z3vLL>e zuN;edl00>3Tn8!93mrFda+;FabzO9cRJ_-PTno)jeE0LwgL1=-`bA#*Hc*+<(;bf4 zro4S8YgW12gpLIY-vCeeF2sE^38Z?h#csO#{<>R>+*@C8`^ExdGFIF~>s`EBmmni+ zza-7KdCHx+Ad4`)eASIl1Y>=YP8cyW0WfreFI-fqjJ!$$m%QbaN#G_~8yJ5XuV{0m_ z{V@{->TYKWCy^kTA>!WVMpyh2OD(Rnrf+?Zs_;zaEzG%&LidZP6 zK;wc5FR5c!-?;a%0f6i-sc!v(eKyhWTjb1&Hplz%-qr&ngVilYW;)A*(+7PmiE!7^gK1}$+1j(g-;Sv$n-1{KX)%dYq>H6KiPg&fP1ZT zFn;F3VJyDGIxOYdF>k1$_|sJR!w3^VS&9a8SS;Dh;nlG#7T<78A_wQOnF2KPnv?Ji zG%+SDW z*qK$z$7w@kP%>}|)gUwlX3mQfY#Pof^yV#wXU~<0#RzA2#UVR^Rz&G&yZ|D{;=ZPu z*ikh^XcqU#U=_s)1}3Re=-LyX+TY&!nhZhMpb37#JXY8+(KAW8ujU#?rrcFnUS`%G zJJ-!nebioij){{MtM#h)_17WxK^J@lKECd@Z&Cf=N8E>2cp94)S1%irjuZu{Vxm;#Qjch zZMW6i8q0u)Sx$P#)xcriojRYNB1{FMAV3I&5GXj_Q3(0$`Jum}hgMH9?VsPR_uD}4 z_)<>t2uw6WEr@5RrwkS^TF3nFtzTcPF%NF%PDY5AFY*z~20gUC&!Uxd?pUW_sMSg} zd&cl~pr*!hN5-j9pSrKsmc>|5k~go|c=D72;t9=0tK^ zL%tL#ziAR~eM;;86)>#9O-)+WW_1PhOw^0FK_~U~!$@P1I>B?+XmagG5bYZ5CEU?T~(^f`Fbf~Rz+4k0P=xJI?aWl|o zYj~#idPak$MF9@LG;Q&G_XsF%i>*woEP8&DF1BdnOBGF$4mJH^K2^-yE#gnKAm98$d?U)%$Bt%71?{ISI=9{ zz>mez%5~GeDtn(9F$sWJ8V`@>ii^tFTkAurPc46PNyQjTbgo1w2ws4h?OyahJ6wsz0?s(`Z6>{Oci;#=!GWc(UtWzYLmJ?QyoOZKwhj{2(b zN&{xQIA!HF1O&f#>Zv})W$fR}s_!%2o+&D+k0~$c82DQ8YK#;IICrbE|G;DY>RnA# z*IYZfSYD{2 zrQBkU>&L-BZiiSQVqTqDeM#BiRdIUC`!?i`3;xS#`NGlyLVn(1ZD9iJS8+;Er?4J5 zHKu>hS=fer)I23W7M+TZ>RxA4ESrGlhkWu|0Oxi~?FV%395bWz@=sejREo*%4_A^~ zw9w$myq&Cae=UYzaW!1$(#Bh$GS_5!&v3r}0(ZVN*a@#g)Bt1O{U3$rj6?}k)O zx4p6-`gDzNIcz*%U-bI6YYpM^KKyWv+R$PW`)I1njk{ZNv{4svNa9?&v(an`pnX)^ zd$+!(!@g>-*V@&mex{k%!BXo=HqQLk+mUA%lo`(1>1iLWhx0&d)>fFS2Oe}!^T_9& zwmC!8xAk6=`%RH~N-Em*_&nVJm&eb%MN}QDpk{?smclp+RC7oVBxchMRK!geFez(W ze{fiLd{%C$m!nyY+kk2u;^XjFwh2W@+FMYE#539Bii6`e3V%K#SuA$VaGQ6_+5OPb+~7wwK;UD~0f)B)HwZquJuw>I>5Q9rxeFp@~N|8e2H6 zFQWIGvDu2Zst^1jSxZ2I=1QFOjw!jtUT*u39Fenx7e1Eqj?>D8|3^QRjRklXCkE^H zJ~qyz~v3R4I1lFSaMrlx94I_?qS@-V1gI|YjDAeQp1{ku5-3O?!JasJjeSy48(<~XNeJJQ%Nt*dhbwMk zemn9x62?ZtrK9zTq^`qb5&3LTv&l%a2yJS9ZKdFqR8-zb zlp>4|cOTEou)h$>^Y`(sC62EQs-_@wK($W%>8i}|1EXm<-^Z+evc1*v0z`8fY1MFf zE9(9jHP-dug}$`<2(@&Q4I`!;g#~Ds|B}E0Px-dWAvRmPK8w3(PS00l)9pgsAOL!8 z7{}FLDnapLex5#SlnA0!kE-cRdVFBnE7}=Cmm#p<>D0Kg@U{h+J&fTl-k9Tivn?UxM(( z{mhe-*&d=5oQP)^^Aj5M+l77~Bf8XHJ$PfVOza1xM=_*G_UJsacBeI#*fe-YPxvSl zf-h_WaD`ri^!>w#58xP23~fPGN6+p` z%ao;ePU~hjElFaY!ogM8vC7VNzZUc;ZDUL%B~56g4g#4`XQLimSd(z_TY9&3rXk~t z<++Q3luUwrCCg^;(LONaWj2^_dc zF9I+xaUD@tpOL9eYtJ@bodZyj4hJ}q4)g+)FW1@{zN;e*{veo zi0`1w{lffWJFGM$4rNRn%Djgp5TdxmJ3zgl7=3il7Qyds0Qr>7;m1Y$3fC%lf6UT&56*6R5{8~qsG-rz^= zH?KvYo(D)ki}@8nzyyU5B5;EwSGtow`$t|{U({>4{n3%P}AZj zma2TThr}vh18eH+%^Jha;2mEP`y^JTImkB2D|#4fDRSx>V8QJyx-YHe-PTr;)|MR} zhGGT29YtoLjRexjQ7B1COy=VbF&rXlA?Sslm9zbk;ps;(qy0rG=#yJB?^}~K2EIrY z`K*=GBLe#=_Le9Pnpi-UAub>0{it&r6KtHd@81%hUUiN!11Qd$XNpqS9*a^#a41SS zG-Q`_Vz~3wfn_V;p4bpkHv23O<%gJ_6sef$1oUJ+*H{Tj)vd1)xPBDx2*1Eo#QuhE z^^~-G2$9`Gmb)zs0|8Zx5{@}Drfm;lW{Qr-%0OEdy+y}Vi4JvB_{!Ie_dCW}z4h*U z4zdW>li{Pzu(tB$4-K*ymbbZ0hdJoqU45^N%~K+^3EVCk{Z&3tv%h6Be-UL9M-<(V zIGG>74b`6EYl$w@joR>62@5-xxdw0x4Rc}Q@Rrv>-W$54Dvob`P%=}pJfYlK5Z1qN z9t_5&F$stI_Gz{5%@%D^wR%UsYQ!MRMqaRH1ElBnBM@pyHD~UAi+G*5&i%erp1hX< zTdkk`!5a%U8sv)D@5fdu6urzFuYQPRIDR-8Dt;2vL#H3(IfS6Ga5i17r=_%2TTfBt zD$i@<+O(Y3UFDO#_7JLM=N@U>w(&+%(5Hb??^XYKI-C0ZmDx`|A3f$8>tdG+lD(ba zcc5uu<*a4RAXz&hKNcT{6@I;TFTon_jW@XTA7%Mx!QBLUjmyNXRY72?Deau7H&pR+ zOw`Q;dJHUi(zQ+IdWn?CQ#8!v%1^Pfb=4&}_K6A^kRQ!PL)-6n@xzzJlI@nrG-~-N z&NPN{HF`|dLpj3ZVO&}U06RphyqEFITm`<8wG!?_%v!Z#;Azks4@bC8uj%FDo_V-h z@H-=IJ|w0ONRJA%K|U8F6{EsZe*1>2&cmeq!z=B$mqx1*2=Lfwa9OWqP=b|^O5gK{ zM@S`HW(jU%X}V12hHy_>LVnfnQ!6t|1!-(yiU9PuEh1>m{gO95iKufIE4i+(E{ct7 zhe}Pb3XWbq)OkIyqj2*9#iA%Gyq(PLPu-hD0Y|orCZSU7mxa!L(dE6QU(n0%d(zvl{gnHUU^@an&dG>1cSL zFNQ?J$wEKdk{qlj5fcrx>eMtSB=vgfZL=yv5BZCSOK&)WNtZxwP)v1p3s6ZizY^az z$=II#yZdk941N1Wp+4JIEwIF2(fuL-JuzJWgpDRXm1)*(f?n__t|LdwdPsQ@Vd2wF zncL$z%KZIBI4}t|6NUkf;GjxUGK5fv;j_I5_61Q0pHFa$agRU0nLE>Gk9=pKE+dKj z-sk)4=-Je@_Osr-Gap@_YR=8x4q04k<)=@R!Sq5Jw{W*{OElOpJ&UcEA0yRq+?i4p z%AEy|V(@(4xd8})O~ZmvwC)idGu_=@MW+36{#b;mSKi%Hr6>jzc_b^%A9yk)Hu!fh z51``m4cG4Lpf^-{Z1&+z&2>G8AXnnGrw_xve!p3G0!0LictQB>3J(QIs?gTcJ|+f3TLZg&3(1G+T5h$s(D9o!QW3MG5R18D@ODhNl}yv$q3-1*vf_O7Y? zX@4uDl~8d6IwKzVWgOO0(ajL#aAD-;H7`>h3CrVSkP{o>%XJbCs*XfcGLG8>zJQHI z7}kJD$yRNu7Ah(483<_*yr`O=6xtR}FU3^;6B^)`U7zQo8j{-hV<6XN9PiJHEYef$ z(ap8oFAldx{4x~U!jX~*jXir9BzP%@eisJUgio@o#Vi>Jvqz4cS<57H1&)kIY2V)f z=-=^9rsA9BvOAv8wVn5=wjI+|K?-o$(RTe|+Sg_{0ixKY!-eAGoroazPGkbU@2;iO zl}pai#MGjDVlDJ4HYb%TomB+ZrfvfnR*$Wr?Z#KBom5T|KxSb3QZhNPtGfE z*E~dGMXtXeSJ!}ZSo_krZ|w;~9gK{;h23yl-Z-gqiT(=lHJPn9a_2+{WTrgoPo2w% zx^!b~SeTE)!Q^=)ZDfSFKx^IU@b=$Jz;8@V^H9|_`*$g;Hz%&+NnkrJ1?^y1yK^Mt z5w>w}HvksBh+Ufb>73qs-MuO%^RKeDfHfewTeVvMO%6Pc)rWAEBBQTRT5QQsl`_Qp zopege9!&Ibbz+{wqBO+d7*gVypvsm{5Z8#ol$X}7!9?7I^B;l?e|S27 zzvDQ=zP_RYa+&{Gng_<{|A%L{ejqKi*`TX%Ioo+lYdni;nIy#ro!vMaEjUP0T1rT? zZax^i>1_nW0tj-I+QWoMr^A=rE;5~M`a=kwrHIY~K9ouG%?>p5I7IApW@{+{sIqqh zmEGO%3w4Xt`rBHYKd5sOg*}=2&dRv|0v`Z*k#aJidd_}oR|xAS96h)t_xtEPS6x$E zd(czocRDxjQVAD^L)OlpfEBRr;x1SAs`+RVYB(7H%JK+kkx0F(PrR9@Um3h^iffII z)_QZ|kE9`LE^H*&OD?r^-!+VFa&NnZ`<47802ng>|ZuFDg3>>lgXUsM7HXQ0-A`Lq?Ga_xm2mHz0mJNt>aCn6 zi?J57ZZycY2Qz@k(6&AT6g%b*07kAA=x+Eg(Si6%bCX#|0&Tj%ATeIkxd&E3PH~ad z@KqZG5X5Yj&9~li%GMTu3WOd|0UvPLU<4ontdpB(^;LB5+U%z@5EJMdD%s~ODq^p$ zlSu{?-2Ic|wo*-iI!elnO93O%qn#cuo4bbHMqjR#%cRW#s-BW~4niv~mpeZWiM=F| zB%qMm&7g7|pQp6-*;WO5A}fZRummVG7#&qE@wwLDz@!Im-rO6F)yhN+HF?=us@xW*p@}}n!kRD04Y`OnI8$M(*I`YQC zE`^?aI(+3Ftmws(#s(VsEe5R_p-@M)T?BJuX8+Fq@bU+F#-j zwg9KAINokO>>`0yPK(9!wrb#w>BK^cyNi%*^(Vq9qtU80m&7@AEl=KIG!plks~fQ8 zrz$!`;CF!xpGq{K zc-E5!kDq&+GsY!}Kt#`ur)lM1w{=I29w*|-G!zu^dNVF)@(dz3mZ`>5pw8WsogFS? z10jkYu$_Ds>NZ=&2OhXx7iV>vPG!n7V(F&~dOlgAGsLq+QK8!P&mEStUjg>VNwCB2;!L)QkLu2 zy%5W0%g1QV6GV`)OQ~x@w8=uvwc|MxaCxz&mPeBZS{i_C;G~=ZfGB&{V_y~PqQ;HB z&Hjidy4!WU9n3L_^_7?ct8y7U6?-*=O=dCf)uuN{hPY?SRJHeRuFc!F$THTREj(|B zA?W8;0Er?kx#Y_6ncClz%Oy-K?#R?OwG3E5S*TvwjdSKoKWGcEI+pxTvwg57I?Vmc&gw?8W@y- zsh1H@vQ!C4q7dAEUl;`tdJ|AwV;uWrth9x{boJzW-mw5;4B@t)j+vNgXp?I8)B3M7 zBU(zMPab_b%Pgohm*|w~eUFUGH<*;BuhC_LBMC0j-9A6UD2c8dR)|knGm*EQE9HK9 zA8L-Uvo`c_gUC9jRCg9Yu5O0a7!t(1RHkAqLuml2 z%6fD&=N;L3hGF@ee(_5VTQxw@yrV12qonL%jjNV@Szf8DbH#+B!NPeRiRZTNrZ(?d zw$eoi4E?j|v9EjOaKJV&kj%k9QOrklYYerSOS(U68douxC~%LdAZ_Q)=@8z!*55yA z6?08?-`rin@oeUQD!^4de2M0>_p`>2f0+LQr$Bn3On~RxPTOW>PAWsi#UN0TcCgOW zUTD^kOfCI`Ngi}rCU>~kG__x?3Cg;@;;$|-Y^PO6yaiB)f57=@G+|0wntMeR&j8)5 zP54qQWU)&}E3NtiVD}$K3x&a=*S-@WFpZ9QyK8aFWL8Pj$oOTrgef}R zv~@qXqX|dDTq1B0>lHsBA*3;>OjD$K76H}lQho0v_^^{jGrWdH(u%nq0r8@6mMy|c zQOLvd(6%JFflC~1{xdGKrU{b#i@003Vm*-OQPG?`jMN#$dpB-(!K+dD5{DLGV9MvY zd0iQ|G4F5XDhBysp=5{0ljjq!&IaDFGbX+eqS}8Ep6~G8G}&<}S#L+x4>>rwn|k~; zz{m}>$wwg(Mf2ga6~z1w&nS6*Spb1Alj= zJSY<>9Y1P6nC~~8l!b4z_rKRveoFIwT19X2Qo}IJzUipk#vpt{oOAlvF#BFX;u3)2 z)wx}X$=R4Q5P7-*!YlJig~pA3Nc+r&&=j0;j1U}V7+JF(ylbRcY3)eGdt6v|HYA#3 zx}~^zDz^ir$Qw?({lEnwh#^)^UuMU(qbJv~dKoc?;Zxp?8pl1S0?G9(q!gF@beonk zY-I-0_UJ@?Nh~AHuIAcYplFaY9mIn;z4GBaILy)aH5y*&5RqE#YM|*@^U3`@m!5n3 zmC;L@R#lDhu`Y_24w69X*(TuW7&Q&$BQe^N^x*OopNClbE^bXbOi!d=wb(61UxzB~ z!q?@33*^5u_Q%kgOZykA7f8=n-AFx%K1Ao4uY$~0_*U{gdSe%@Q+qH`Tz@xZK0r#u*R3Ii zHw7kB?wP5{hYhsz0}mdsnu)#_lqYMBsF8iQ^8Urk5`mA7X5$X?>5DbuZJ8;@^g-@s z@wiKR7aHoNMyoTV^o3`VG5R)7Y8^EIv|`S22DHJ={m=wXQg8cx`tGM)Izwe7o$VNk zib9(}{7)DQJo7~kAFjC^vh%UX#Bt*&FWi5knojua8tC19L5Q!YJ5Oms#erI1q0-@W z^uT*kpCxLU-4Dns=cl%gB8k17^=X}|WEA7qr9gm)-lV3lKJf!mifzi2O z>aYeu1y8YUaY!&!3-Fk0aaMF$2OdkO9o?x5nLWdyw)TObml>C03L;}scY@n&d=t1O z@{NX)O#Q>3AH=+=?S9qPTyAT6;-w*+4?tz8jOzy|bHozmi;h|?caJO`P;#aCp|ddI*BX~emmt<@>DcY*K2*u7#8kYM85yYD`$)P> zxZAIm__1!!rZ861V~>|m-Zeum=|@SsO)7e4D3(pN!Zq4+hXA=y`R}F83ex5c-*D-3 z7aXR9n5u{7*dPBO800C@lffP0xts%O)$?IXB%h`V%oJ|=y$mLur9r#hQKz1r817y; zNeBt)G*OCB!F#K_>!$t87O6llZ8L}c6m`l;&X;oL&0!|uiG5@!lp`12DuB} zM*YkrCs$*oUmU=es(>RF3U#;1@p`h1YC=Qyj)vsope*`OIidBJKJ_gr7mKvEkR9T~(HJKa`*w^}4^QNB zc=tGs;lN|bH#+qhW`X63Z#De@^I}LP36IzrbJuW zU1jbUlu;!Wme`<0Ppsan7Y#3;yMMV);lElfUq>*diuqW$>OZon{NaicGP8Li!U7A~ zYEpQ_7{BmM?c7l9yIw|=fR@t6joPo zo1Juj4KAF=Ko+jV(p(yUXAe@lvlTDVXKv$jd2KFyWm^@7Clnf4RP>E`hwGZJQMjrwH=9E46oWV%Pah>m3HZad2281Uk_F~q)))tiU!|Z1w#!a2H~>Rlv{<9> zvlRYitw=Ld+i>h8LPRb1VmVDM^9~Q1l{rfHR*+b{g_=A_G@gCIL3tJBgVi=o2F9H+ z6s&kY+xm@;A;nU(;LRzp>5h($|7+PlqzZs#F_PC?A%u^e(y=hw{R1HvqROtB{xY2; z%#?#sAL6i!fiZt!v7>?{*{eF;{so(YxL;{4}I#_e{0jf+ZX2%kfNh|99AgzTOJKf63h!u+RLv1 z^kiuw;jP?bWA(kwo-2s`HJ1V@tMmlyWv(VG|NO7Ixe1OMsm(}%t=;6(-_~&r2lHDv zG`;CW|K-1d6G+M7-sYY(YT^qAr?yX<pLkT%mt`oPX{?$`6c)Xwa!b_3w>BUr-=8m0@{X`givR(z;SW z_H~`wJ(lrz;|X9^0WK&tsuTAw5A>hA{*~N3j)pO-M70cHPSStA1aM)@s{i}w|Jm{X zr}uhka4MF{i{k%cbOP`IrA}eDu&<5#AEf{ob;!L;=IR$to%T zFLsRz7^eP1ses>B1p);;V3a@p?EYDEF+|XYZ z{fCX0!}xBvhj!n8|8VQnz?eLaZtnj(#qe(f+nWJc#G?Q2qyMJk|9AJgchr?i?XOPv zUVX29Tru`3`w<46WNxADzs>F5?}W8MykNZiYgrXq2NaFyymr70{bE~zP7} zFnJUjSlW8TU#99mXIR)Lq(Oi&i+=eh==pbJ1x^R<^10)?>VGlz_rOS_csI-ZoBjaK zK!^dZj!>y1&-nYH^zo(kGakyQ(a$Zv9}Iy44=I5EFh$X>lBfLrB{01yfHhF;W!CNQ zf1$Jh%&ik3{4nubse9Pzvbz*dM?HRjd75;XXOoVeY4Y0&W1s*Q&_Gd0#{cC3aHN5& zO%MF!i$;NK>hKmPQF69YOIZuV7v-0ypb;wdms21TC#mj(JEC2;kJ=J*QY z|L)fPWnodUne6??Uwf_m_1Qm0n(hV6!nt1Tq4~dc$4TKtfsPUVzuo?uf%pGD>i+-j zc33o$_2$3L884+DAS-tbCBZ2(D*TUt;BPAdW-axy|0Sc&`@Y7JS=vV4p19{;V}dn$ zfSeiYofoOfEAIh{&+-Bkm@^vdr3|D<4e7nQR>BWebQb)6K824fEquzdy7PRo;Nkno z2ZWlB$pU?LRalTQ7coD+CVNN~JvCsbw0EmCoO&ujmAJo?w7s8i>1=3{({Mf61cJzH z_S`SNdjQ+M?60@SSftYg9|JFb?Qr(b$FNNaQJ#HN`rPsp7uX{jQ~cr5g&tS27?C_( zY;cz8fEq>U|I^%6hDEuAZCOc?P(aSoCMh5i5(}#cC@tv{(#?XjOQQlJC9(7_pi+{O z(iYuFEsb<{Ecv~hb6C!IIM?_4L_z~$})8ppfbIDv*N&^)SF zkBy0eOQkU&LFzA?t^SkWn{3`GEW(jPV=)^!pDjMRALV1#YE(nXrPZwU^{3%Z^MnZO zrpw1nPAaO{Mn-7`1ubzg3m%NazD@E}mc5L0+sUkazEM3Yl205fDbAs<5N+o>o>$n{ zvZBmumKHN{pU1q>bpl6~kD8FbLlVRs86T~n^5HxITt~$f<-eUjCx<{NeuhifDv4Ff z$E7WBDv)iS_XygSqc$I@kkZI3f9HPS4 zCzrshC7%1HxY+`RNT2iJxZM5@dj6%npNZIHoM2I}aGsCC)dT(E3s2}OtiCs6MmPPU zP8P(c@d`^{#sW6k1weHYL`P}9d0$gg6B+u^wLEvr;3eZ!wz~t9X=`Jz_7d(2`AAJ~ z{j`e1K}I}$Lyjb$knG(g!?cQstZrs!i%?WFYO}s7*P*szQQl%jkH@r?uv%yk?}QcU z)_5;bjc8_9|8pR9Zv7vO2a?DSVjzR4OP8U%O90aip0CU)2j!9D-G)=| zW2~C)M135LKs;)czpMB+yV;}w45%UEfxy$$Y+sqv2_BGrH%aM>Uc=n~L)I|vC*+Q5 z3-oW8SwKFH`0#f82GzJtNh<(1Wp*WRJ`!H^y z!2Ctxa+t3Id^le!ibwBiZsnGreE+s&=b)H+TpV4Kc=-I((bHkw?HnCMO^V4fDI?D2 zC}(a%^L`Dy8acMIxhpFL_Ot9cA9sy!$7a><*PxpZobY|)o=Id!YoDxKH%&LvpV)V+k08%e#B|PYCLfwiHbzeb3k@^O4cJTI%-aWqe{F|# zAGGxSCZN|jkmPm!my8fTnBElE3*D)a0QE%enYQLu%vQSdas-!bkznUKCeZ~w1i^{j_zA_T9i)qBsNJ>KseG+&TqMNcH}T+PMHb%{UYO} zX#w+Poydmzmjpr$oheEUa{^Wqqe|}btq1*@6OzpRtY1dfXxf1D{@amhiP#Se&%YXD z7Xs><%t8(`MLfwlT`!HCsz&K*6}Ep?DQ_JTg)_zAm^8pc)H-ytH(t<|3J_MS*c z%h5voC$!g|sFGshY<=o&-Tdbbt`_O*lVt@A!p7A>T_V~kwQ4&Ig|@PE{w9;5oC7IU z8uDxt^&{?uE|YHrUDX_133h-K&DhA?a5qndffOUoLR>?rx$8t?-n7(1|kuNKHCK1AV zJHfef>s{w3w?vot3|g;$GZQzrA_dWtIfV#M<(f3dbl9)oKDyloDdBqIHN2f0A-c4W zl$S`CI$UisYiQ!B=Fo#|gJ$RE!qqc}qt;uim9@0BClh(fptZq_oDR8%Xff=BYUS>a z;|q2Fh78FHtx=q8A%Pr+rT3Sf%Zo(F$~CH4W%U=9@1!P}J$!{|S$?NVPJd-^{N=n} zG(5J@8WR>CgY)95taE;%r3AXmS<8{~Kd9|cg<>0ngj5S}3pq)Z8(^p?9Ww<#F)Z*{DMo1 zZQY;0B1v!-TBNT0rj&bFI~ncKV$bG5r!n8(gHCzkQP*R^VdYsoYFg^jaZowDCRR|$ zz1(NCzcX4w;#o8N=7Y}hZcROk)@VIpp?d?iTTXkTX8+KX z3edDdI9cXc(?ZZKci3~qC9kDKFNZ*jfiMa|lb3U-RaS`A)_4b79ch#dLa~xxX_)iN z(d#=!zvG6MD?)~YbMI|GPywm%B&QgTP_r9IuD1 z7sG{yw&Gr_HZ^HTJuV0_| zbeGP!|ArDdDj`aw;O86x)ip#2Y)xI0wOYHXL+7qa++0g-BTunhv1wKYiy=5lAVFZB zxO97X?-j(Me?X|AFv=8hSVL>l@t){mCL%SiG0rIza!F^nzfAF&yIsoQ`uyHP9g$dX z%%t|+mT(T;XDJ3@HZc{We(@&2~Jh)HeGF#%gBQ;%dw?7l9i*eppw3;oQO=>?zW+XH;7MPx&hz0I*?tz;k z6hCRSR@tD$O0!zHvibI=6LhFvi^xU8Bjs#f3~aEM=vcP+k%NDYHhjLTqv{(GUe2V) zLz>8M8xNJ$jAbhu{LYHzZJ&)O$BJtOx_U@X|Gs*`VdY5V2&=D@yN z3m=zEwEd>4R;Pn{zNdM5Zgi=pE;sPTcYVaD7gJ)r92@HO$itHRd)om!e=uTj@l+{lq1IA{uDfoqQ(Ew#o;7v7?JWOapq5 z(OxqB;^q;;BV}B~PU7(IsSd5eqF-7&4&v^eB;R=W94ai`d>($eM_Zxif#fgU(Z|WE zgy(w3M%C^uYT?6NC-Km&>})!WQPlkXqJ36;MBGdxIUcNg03yYvv+xJc=%PR z^hXUm!Ca7&$>N!yfl{$#KE1+9xJ5L@GDK(i>A+P~C#9H_)!b`E#QvwS`!y{FdV06q zLbH(q^ddF6;G2rSJ|=ZH?=>kLj?1|=7wU^)T5JQW;gt&oZoyd|xpE>0B6jgxcen2% z#iz=0-CYZGR()?-jD#Z}o8?lOeZdf!5_35BGwlae95yR-_Vt-x@SnSZQY4bAvF__| z;oFTbp~=k(i}jaZcAHH)$WhABs&oxrFxaa9OwT$!VjYiNjv#~-6_qL=*GD)f%np`6 zE|vf4GDa(mv?VKzbmp;I?;Y^Ny5!^%4-5F0C6Y&lIX~HP<8mTHws%WdqN6{^L#`eN z`2Z?jB=78yCTAGTnMHW8<-$VGxn(+p>e zW;OzXnx)*y+71|{`gQ3h~l@JV%avZ93e8r`GS1Vz6iPdt` z(p&G8X_QcwAn1}_njiK?;{D@n@=XBr8Ksfu;Glr~6wk2vgE(osxx$yM%LjNegVS27 zvFktfTKKrv-)yKYJ~JihA^w$6+~9MPLLIB~gqU*SVe%vTWA|^3?! zkk#cgdBBi%pE)t7JJ}Sgp0QX{8|#D1CV&z%7$`dULkf?Jj-QX9=TXF&mhY`Or5i62 zoRmO-H)X@`tK_>N)qm`(>Q_efjzIX<`&-GLEo8dlWGeT#a=z?4+}2JU-0d{5x?ndFTf*nb2Lub zEOND2=1{D!_ulmrt%x^(Vs>`%o9*#J7=yM#RUq@dkL#FjB?_;xV2a`K#(dyav6nCF z^VaF?8Du(V3op_O%G1%&f%f)G>&pvAnAdZ=6J_|j0yx2UZBfnI)rKk6eQvFDZ_x#v zZcx&bSO?v_K)Il{JlNp?II7EdWJDVjn!Qf1zTTH40^U|aQT56A5A_a(q8=Ur;8)Yl zBfIYvf>VQQaPvtk>@ov8w<`pR6YjR@CQ(gZ(!Lz`m#-Dz1y=R!xgSFK*@WrmBZ-4IiGyeiKB0poKACd zb1ywD+TXR9!rlrzDlpFcz~A*`y$UJnY_nTl>Csl4oM`J`F=Vxn|(AuQXfbdUz?iMLlsY7R)Kc&H_(>FeKAT!yJ19m7D_Iw?O zi@#OSyr(&&6J_lwj}#^yAr;3lQmq8wxKkT*r3|p^LtB6JO5LkRLdWTs@m4RmB0$w_ z-iGu3cS2DSz23aQlQ zF1D(rmovE*Z((!E95tulEXgw?ZHbAz4p%%v%`cr;P&yL;&|EC1>sw&YflXf$1R2QP zH=taau!=k^AS1Sx!&XlpS&xihV7c9;9R&xC)lrD1Ube;Qs`c7(nt5et}Jt#DY?VGb^{PT&oK5IxpW6T+gWVr;w7Y&FpCB#9E zGj%&4`3@M*;=6UiHJqV8dJW9wT59b5YdEv{yBCxJpyTg*nL#8cz~P+2Wx$n0ysSgZ&C@o!Oo?o~p*g)sWtUS^_SnaStsb%LQy?EVo7aFS_mwj`&ra*g5$ zH%6ARoWDt9VwiyC|2Y9eTS;>BmN#qjZ3jH1rPUe1Q4%U@-%_E!vZMdqA)Jje zvZwD8{m5&v6hFSwNm!}345y2Z(7sCU4Mk!joYy{`)CHQEB1Hc5>{J~FodWBBLnu&V z^ERug-1>WptIaW5|ToI*lyVWS)zGDHnKkLuhW>6k+;BB2Y_s-w-%!Ds2f z>kX~`7UC%_$q2Avjf;NeV*9gdTdSMOf=!2_2ftUYo$W%Y@)cin3N~4O&wg+DAys2v z(j(in`L3ekhEqjPTfQXsw1ia`3?#v12z#WEjdFvk zwWw=l@wY=!gNdDsXXM||{c5M8IHO!kDCXMZUFS43%0O6TdsErw2*rDQ6?~SDEMQPb z@BEXA8qH-kRqn_JcwWK)wXn`tqgU79NGPY{E(mw}a7yMGp}x;t9?@pLBVKi(S#!6lFV~A@ zLN?G)=b(g>!;w>q_OYbtGs!a|>gJTUvk#TYeSP4P|Ls@7&)1@3LLS9N6S$)hoZBH* zi-+C^Je1nuT9yiv6q=bDncvlyI@qQSGw>u`Ge42t?l+{GcW?lO-`J zyiHF%+m@4o&*6~~%~K}Ex#%~t0o(ijzp9VF_@nm9oBg?+JXF<+a;h0j zeOo2>w_7CXTRu$I&Xh#T277ZQ_AHTDc)LKUhO8zJ-mTDZmwuwBN_8X>qf37+Y^^*& zus9(oMLrP4-O?$OJ)i8O+SktBeD6Ql$ik}z3YngK5UUcU9?Jy`j)b#Xvl(rVJULfK za@3WHPO1-5q9AkmzQu0teVn5ID?&hhN$@8Hux>-GdCq(otK~v}`Ga z!Mhb!UC|{6Pv%969pk*yUPy_bMFGjyUSQMc$49p|lYI42-vwIwRP*>J_)^76Iq}@d zN`SkfqeFJ4$tFD9#hskt=FvbsL*l%!0-!g|7NriSFp(vBYo8ocY$6HPO;ukosH;5` zt!cCaa&=snzoCEsmHb=C;zvI=I`0Vpw+(7HYYNq3p0*2mB!wQT#zQNmT{n$HYE^z@ z8bZD>owDkr^+r}d?ORBtk00}Hia&kBp{OY$isX$fnaQrkP~YJdhaNiD4* zW6`cO4thCKxO5K3==YR=@b-1YZ>SAT5QwFy4H=hl`tT333ygkN7fN}}*YB6Dm@ilP zU5!=h&eg)R&=FH}C@bd~(HG!_(smq*V%3Fi5=f=aNhkiKQ5%ZMW0Pkys!R3gq%jk8 z%r~0;FTTe?p8zOSXnc9`OhXPKA9J}SpM%Uu7C~JqP6tUZyMroBmhbasjc6cjDzNu3 kL`0!n&Kj~Z40J>>6o_`N*^)Co2mCyiQhb>6K>y|c0Q@BHZU6uP literal 0 HcmV?d00001 diff --git a/website/public/img/how-boundary-works.png b/website/public/img/how-boundary-works.png new file mode 100644 index 0000000000000000000000000000000000000000..a9bd98a5ecdcbad0f2642903e129dcb758b94ebe GIT binary patch literal 23938 zcmd42cQl+|^gcQwNFqogdP_bc5`rW|8#PUI(fdRTqKw|Vh=?d52%`5gI-~a*iBX~s zGx}hR(Z(>^edYK4-Mj8x_pkfcwU+fVyr=AQ&a83)D&p0v0ej#Ks1VPUTT6s zm$pG5vi&QRz$Zp%mL1@6)#;6aD+t8MbMZ~4sCf_g4-lEFrowYj*%13W@XKXuc~yB3 zs4|B7#Eb$2GGS7DDX;BChMNm?VkdfIjtYF`z9g<)akEh{9bA?B?}77@(WNgXqB?N4 zkY=PMM}~lA>dcr<&&}K>*j$@R?02FuG5m^6d6{PA&Z{r_2g`LT||taHh!TfBcv{`>lSACyp$gz%iSwD6C+ zhwIkqXLVPAq5l8>E2vle5=gb8!f8Ap!}uEXs5&$>ls8v?MAUSoNcQK_@9VTOQg>;T zpat5yLNcVad2Mc_zOivlWUzUq$n+*|4PpH}P)2w(=;+A1iP?kQ^J&V;ajT~}y4By6 z#{PA{VHej-&&|m{9Fg#`$t2(R@7`tJp{e)4rI@hqNuBq<&Y%XpvmjjtrC4{LZTnlt zn2Ow<&&foV%X_}e&Me8=4rsA?(9T=udM`a`P@)z1YcuzOly2QpV?Y;Ktv26ukA@34 zomX$){59*mxO|J%y_B!`#x1fI`)!GaojsNaxYi>^2QYOkgOrcL(QGDR>fo}{A9i5P3sA=G-ds9D=Kv=>3f*HYAMVmNiQk3CPw4jIum<{$= zVSMi{bwld(P-ka|$=4~aw92#us0l4&oH&FXpy-G3aVS92iaUg(+Tc+=nT`d^A?ifu9k!U_v}F+Ii{>jbeRu- zZhuY@HjFr@3gNuzhj)2ff)`6liliX>KgSzX*7Gbz2qs`?T>qehvcQP~k z$@0fcwmt5l_s+b$2EWAw>@!&&*Ev{WwXf~Xb*d*U;SQqOj+6biJF4d5j<*Im zM)=1<9G}3(T;pJTCp9-v!HNI1llT9)^RxUXg9t5teHayW7uD&r>)i*(H&`3pp6BTE zY;Mj>o#LF{i%aA4JMjV4+#utWyB{VoX&_eb`64!^WGkW5_jj2tK0zToHE~mWp&)Dn zJnT{ilDiM1*>IkZD%abLRDV<=(u2JxG`3ePt((^et1TUsT<@cX6w#jzyj7j!=H%m_`Yf+461M*!Fn5Zu*UT+r-j1{o!C4@9XJ>B%jHY#I15;b?R}?OaYrLvRFmu zRhW)IxkpocF48&zr5{OT)W&o`R(D@ zXbZ!pZ5D~PhK9ilq*_@~@s5d`m5;bN*F^kj|IIR=rcwE+X0Vu*4sp$=D(t>^tj>&e zKmbbclkuczNE72 zQ=q$GCk?N?+j?4l*Z%EBCQ%BUpXbhidylvASH0*+flewYzar7T#mlhZI4|^XnW1N& zd}e|VdQdM`pt8ByUVZuS0Ee{Z4DiB#%`|AtV@lruSG;Omf(U^M$7;m_?b{}sD|`fY z=XqsVe?#xJ>!m^-F|Od?=tQum%#|{+7Z6Cs=B#(dK9M*W%>fSa4oJ`{?%f+pl0BY2 z-rYhtQWcmB9HF}ByE53B+`z{-S|753!FG3@r6E?RxY7WN2_d$U-$rah^&lHCfOk(z zTSZfp;A2~}4cxA-i|ZIlVy1aqOY*txUrl2-N-PPgXva^nSoV-57bTH1De@kUTUfX6Y3YbwQ9S7_#aMfB_9?Yb>5 zw>gg|hO(QNcntGom(;Y$ZOhbL<*P!gsCbu z{i!4`187j!o!08sbH|9as59ne(gFOAjG~ql^iJb!{0~pL2?e14J3#-_ql@#7yv8$? zOX;7sECinJ9Bz3`jPD0m^q3df=dxvfu{CJB1`Q+^ELf${`ys}vO2{VBy4?V5NE6w6 z4=yY|!TM)0dr6#Wkqv{$fK$V+Y^}-q>{nAvUrLp58vpd|H)bzt_SM-5;(SRd=zPCG zmSgksJp*Mmsjv4mx?cB%!RaN^K9?b>&f`Qr0T5*dV7lla?H4v!I&KUu)>!SUu| zVejXpHUbQ$Q4X=~fego-Xrk0_&ivjiL{j$Q`P6kqgL$2MNiBQW}i zuHdo>W~SCol*35B-pAI%qmIS;u$#2V=hpc7=_MJF|E)(VVwrl*iMz*KU!?fk%VPB!6b^dSkim6o;1~bWr74vu?#$GY`<%?N<|fPo7Qh4N&cIk%py*0B5pP zumzP{{>N& zeg-wc3?KNq=tc#S!~*x)q<9G*oSg!(Fs?x)^j!4?Q867>I~tL`c=JQusAuaQ$7!|5 z{82--Be`sM+eAhV*`gHoDqEJbOmxY?l!G5S*y{83NBGj$7ei5`Qx)ivU?c3sFA5xX9pgm z6=ja65x>ORj(AyTPI4N4jt!F)nGVF8YBV38QLH~28*Sv10{lzp&G}&3Re|Gj|FgY} zv~RQwgqX>%zuFGJnS@FE$~>b-N6(0SptHgZ_J$|ry1(yg-3~)nM5<926%L(UYRw(X z6=4Ee>AE>j=5}3`TR5OdWMn8U@wGyh_jZT++W!16hmyiRhbJB(`B_;$LrRdX-Y7N~ z!p1W)(RYTOe15{=JGsE_7YBB~0Gy%2KZisjP5e}RRy0v%h`cPimak@gkKHVv1+a=q zP~bC=ePY^5rG~}PpN+_qSFk{Jzb&!AoU>4EvRs28_`==Pw_yc9b7cPx(~SE2yq&RX zgiovNTVT?EM{*RBa=Uo=mto9L^66h^$?MtaG5`)>_=5G!Y`A6|yEpxa%onhxS}dES zYIDU5C16EAT2|`Eae%k3I`VeGO@wY=8!cR}_MT zXPNLhTK(GCvjZel&sgaC_M}zL=9A6JAet%re_g#YCJW+ZqzP*fWHWisO;tECSa-Uv ze(s{oMV@R;7LX%g3t*Apa|!@#M7;hh@CpA`^X{~yjYJoEmkT=A$n(b%iE8l`%NcoB zEo%60t}JJ@pjZI`nQ!qF4yi%3wcq|Rf~2f4N>I?|=aTJz=yLZTw{{+Jk<%xzF*C0n zX5FpyZpLtwp!k}f{ZzdIEFo4Sm}>ZTp60-at!{x{UgTfj8~hW7rluZlDSV8|c!0{% zU6p**qH`Fc_VXpp+H(NuRLvyx3z}6&Uu{T#X0Vfpwi`>|ZtOZtO3O>XX?y>&oE|{B zK(W$TodxQP!(_OBLBk7U9fGq;d^9&C==qDUl41lm5ct(ym&!Y9BI7;_IDa-KkVzx} z2M-Un=IpZGsWe_+@L!^&qQaT;r3`x)M^Qs=0E|a3CyY|A?yzdh6Er}sC-IqqC21=x zMj@SSxaWex=0%^NbaXsD9#<%?n;wP$;MB+otP)~E1{TIquIwwmp>aEz!yF$>ty=40gk=O-hJ&(^@kPo{+h5ebDj52)xK4pyWO1Z zsn@`<_RM=11KebS=@#$VWxgu%D9mNK`vA4u|4#T6rJ{$m)4|*QDJhuAFfGt^DsNB; zayOvk3Z|5+@p zfY`GmQj>w6hB2~&477(ILiHTyTDjY{7knr8^Cvef@Gr-Uw>^_0clW?t-LJgb5bo9# zpjcaAd6E~8bfXhp%a+osiuVx#2LX?JP5-(U796Z@d>bT} zKk}UXjus`?SuW-7?8k{2>$nDZvvsozwW_t66+%QOLa3>EUGj|n5~yDa80zoo<6-n3 z2O69^a8R!n=5?m@Imt4{TWmkNpv%u77BXs-L|_Z=qom}t{2>QgBLn7a^X1=l)ZJtf z-Q5p#YXtSm3J9CmK`^JzfG-!y*k_A+z<3>vH&F4hTDTd3uk8 zsPIQS4#+x_sU}aS*FXauZ8g9(^Ze}8;|cc~%ZRV(=ldd)T9Q#4HHBlsMOFoFtRn-x zC-Bf3+)K&=cgY(98L{JSk#(C^SJmxB8RmFB3_8tzsIBd%s3m1154QlyzKn0K`BN-R5Am`HN1p)(Oh>A9#3t#&~z+wz6pf4dvR?XwcdN^x1(Y4!^>4sz=Jy zbD<49+dH>>tpTsB6hih?EFH#2SF_selU6i~@X19*Xn~Jd|5xYxRO|)&E-un(@HO#< z2qwr$%e(GqdfxO}V%OMuK87Iuo+#_Ro9nO>i$_-YM$_yOE7YJH{(Cy?n7jW!-wa5? z_yo&wv-E8fS-yoEF%%EE-0usS{ea))<~zaoOP)%FX*VJlzQXAG?wk#$3?Z#AO%%Xf;t8q8BsDfkU